diff --git a/Documentation/devicetree/bindings/dma/brcm,bcm2835-dma.txt b/Documentation/devicetree/bindings/dma/brcm,bcm2835-dma.txt
index baf9b34d20bf..11c052acf65e 100644
--- a/Documentation/devicetree/bindings/dma/brcm,bcm2835-dma.txt
+++ b/Documentation/devicetree/bindings/dma/brcm,bcm2835-dma.txt
@@ -74,8 +74,8 @@ Example:
 
 bcm2835_i2s: i2s@7e203000 {
 	compatible = "brcm,bcm2835-i2s";
-	reg = <	0x7e203000 0x20>,
-	      < 0x7e101098 0x02>;
+	reg = <	0x7e203000 0x24>,
+	      < 0x7e101098 0x08>;
 
 	dmas = <&dma 2>,
 	       <&dma 3>;
diff --git a/Documentation/devicetree/bindings/input/touchscreen/exc3000.txt b/Documentation/devicetree/bindings/input/touchscreen/exc3000.txt
new file mode 100644
index 000000000000..1dcff4a43eaa
--- /dev/null
+++ b/Documentation/devicetree/bindings/input/touchscreen/exc3000.txt
@@ -0,0 +1,27 @@
+* EETI EXC3000 Multiple Touch Controller
+
+Required properties:
+- compatible: must be "eeti,exc3000"
+- reg: i2c slave address
+- interrupt-parent: the phandle for the interrupt controller
+- interrupts: touch controller interrupt
+- touchscreen-size-x: See touchscreen.txt
+- touchscreen-size-y: See touchscreen.txt
+
+Optional properties:
+- touchscreen-inverted-x: See touchscreen.txt
+- touchscreen-inverted-y: See touchscreen.txt
+- touchscreen-swapped-x-y: See touchscreen.txt
+
+Example:
+
+	touchscreen@2a {
+		compatible = "eeti,exc3000";
+		reg = <0x2a>;
+		interrupt-parent = <&gpio1>;
+		interrupts = <9 IRQ_TYPE_LEVEL_LOW>;
+		touchscreen-size-x = <4096>;
+		touchscreen-size-y = <4096>;
+		touchscreen-inverted-x;
+		touchscreen-swapped-x-y;
+	};
diff --git a/Documentation/devicetree/bindings/misc/brcm,bcm2835-smi-dev.txt b/Documentation/devicetree/bindings/misc/brcm,bcm2835-smi-dev.txt
new file mode 100644
index 000000000000..68cc8ebc3392
--- /dev/null
+++ b/Documentation/devicetree/bindings/misc/brcm,bcm2835-smi-dev.txt
@@ -0,0 +1,17 @@
+* Broadcom BCM2835 SMI character device driver.
+
+SMI or secondary memory interface is a peripheral specific to certain Broadcom
+SOCs, and is helpful for talking to things like parallel-interface displays
+and NAND flashes (in fact, most things with a parallel register interface).
+
+This driver adds a character device which provides a user-space interface to
+an instance of the SMI driver.
+
+Required properties:
+- compatible: "brcm,bcm2835-smi-dev"
+- smi_handle: a phandle to the smi node.
+
+Optional properties:
+- None.
+
+
diff --git a/Documentation/devicetree/bindings/misc/brcm,bcm2835-smi.txt b/Documentation/devicetree/bindings/misc/brcm,bcm2835-smi.txt
new file mode 100644
index 000000000000..b76dc694f1ac
--- /dev/null
+++ b/Documentation/devicetree/bindings/misc/brcm,bcm2835-smi.txt
@@ -0,0 +1,48 @@
+* Broadcom BCM2835 SMI driver.
+
+SMI or secondary memory interface is a peripheral specific to certain Broadcom
+SOCs, and is helpful for talking to things like parallel-interface displays
+and NAND flashes (in fact, most things with a parallel register interface).
+
+Required properties:
+- compatible: "brcm,bcm2835-smi"
+- reg: Should contain location and length of SMI registers and SMI clkman regs
+- interrupts: *the* SMI interrupt.
+- pinctrl-names: should be "default".
+- pinctrl-0: the phandle of the gpio pin node.
+- brcm,smi-clock-source: the clock source for clkman
+- brcm,smi-clock-divisor: the integer clock divisor for clkman
+- dmas: the dma controller phandle and the DREQ number (4 on a 2835)
+- dma-names: the name used by the driver to request its channel.
+  Should be "rx-tx".
+
+Optional properties:
+- None.
+
+Examples:
+
+8 data pin configuration:
+
+smi: smi@7e600000 {
+	compatible = "brcm,bcm2835-smi";
+	reg = <0x7e600000 0x44>, <0x7e1010b0 0x8>;
+	interrupts = <2 16>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&smi_pins>;
+	brcm,smi-clock-source = <6>;
+	brcm,smi-clock-divisor = <4>;
+	dmas = <&dma 4>;
+	dma-names = "rx-tx";
+
+	status = "okay";
+};
+
+smi_pins: smi_pins {
+	brcm,pins = <2 3 4 5 6 7 8 9 10 11 12 13 14 15>;
+	/* Alt 1: SMI */
+	brcm,function = <5 5 5 5 5 5 5 5 5 5 5 5 5 5>;
+	/* /CS, /WE and /OE are pulled high, as they are
+	   generally active low signals */
+	brcm,pull = <2 2 2 2 2 2 0 0 0 0 0 0 0 0>;
+};
+
diff --git a/Documentation/devicetree/bindings/mtd/brcm,bcm2835-smi-nand.txt b/Documentation/devicetree/bindings/mtd/brcm,bcm2835-smi-nand.txt
new file mode 100644
index 000000000000..159544d65790
--- /dev/null
+++ b/Documentation/devicetree/bindings/mtd/brcm,bcm2835-smi-nand.txt
@@ -0,0 +1,42 @@
+* BCM2835 SMI NAND flash
+
+This driver is a shim between the BCM2835 SMI driver (SMI is a peripheral for
+talking to parallel register interfaces) and Linux's MTD layer.
+
+Required properties:
+- compatible: "brcm,bcm2835-smi-nand"
+- status: "okay"
+
+Optional properties:
+- partition@n, where n is an integer from a consecutive sequence starting at 0
+	- Difficult to store partition table on NAND device - normally put it
+	in the source code, kernel bootparams, or device tree (the best way!)
+	- Sub-properties:
+		- label: the partition name, as shown by mtdinfo /dev/mtd*
+		- reg: the size and offset of this partition.
+		- (optional) read-only: an empty property flagging as read only
+
+Example:
+
+nand: flash@0 {
+	compatible = "brcm,bcm2835-smi-nand";
+	status = "okay";
+
+	partition@0 {
+		label = "stage2";
+		// 128k
+		reg = <0 0x20000>;
+		read-only;
+	};
+	partition@1 {
+		label = "firmware";
+		// 16M
+		reg = <0x20000 0x1000000>;
+		read-only;
+	};
+	partition@2 {
+		label = "root";
+		// 2G
+		reg = <0x1020000 0x80000000>;
+	};
+};
\ No newline at end of file
diff --git a/Documentation/devicetree/bindings/power/reset/gpio-poweroff.txt b/Documentation/devicetree/bindings/power/reset/gpio-poweroff.txt
index e62d53d844cc..c9328a9223fa 100644
--- a/Documentation/devicetree/bindings/power/reset/gpio-poweroff.txt
+++ b/Documentation/devicetree/bindings/power/reset/gpio-poweroff.txt
@@ -27,6 +27,7 @@ Optional properties:
   it to an output when the power-off handler is called. If this optional
   property is not specified, the GPIO is initialized as an output in its
   inactive state.
+- export : Export the GPIO line to the sysfs system
 
 Examples:
 
diff --git a/Documentation/devicetree/bindings/serial/pl011.txt b/Documentation/devicetree/bindings/serial/pl011.txt
index 77863aefe9ef..8d65b0ec2828 100644
--- a/Documentation/devicetree/bindings/serial/pl011.txt
+++ b/Documentation/devicetree/bindings/serial/pl011.txt
@@ -35,6 +35,9 @@ Optional properties:
 - poll-timeout-ms:
 	   Poll timeout when auto-poll is set, default
 	   3000ms.
+- cts-event-workaround:
+	   Enables the (otherwise vendor-specific) workaround for the
+	   CTS-induced TX lockup.
 
 See also bindings/arm/primecell.txt
 
diff --git a/Documentation/devicetree/bindings/sound/brcm,bcm2835-i2s.txt b/Documentation/devicetree/bindings/sound/brcm,bcm2835-i2s.txt
index 65783de0aedf..a89fe4220fdc 100644
--- a/Documentation/devicetree/bindings/sound/brcm,bcm2835-i2s.txt
+++ b/Documentation/devicetree/bindings/sound/brcm,bcm2835-i2s.txt
@@ -16,8 +16,8 @@ Example:
 
 bcm2835_i2s: i2s@7e203000 {
 	compatible = "brcm,bcm2835-i2s";
-	reg = <0x7e203000 0x20>,
-	      <0x7e101098 0x02>;
+	reg = <0x7e203000 0x24>,
+	      <0x7e101098 0x08>;
 
 	dmas = <&dma 2>,
 	       <&dma 3>;
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index 1afd298eddd7..a87bbdb09177 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -49,6 +49,7 @@ axentia	Axentia Technologies AB
 axis	Axis Communications AB
 bananapi BIPAI KEJI LIMITED
 bhf	Beckhoff Automation GmbH & Co. KG
+blokaslabs	Vilniaus Blokas UAB
 boe	BOE Technology Group Co., Ltd.
 bosch	Bosch Sensortec GmbH
 boundary	Boundary Devices Inc.
diff --git a/Documentation/devicetree/configfs-overlays.txt b/Documentation/devicetree/configfs-overlays.txt
new file mode 100644
index 000000000000..5fa43e064307
--- /dev/null
+++ b/Documentation/devicetree/configfs-overlays.txt
@@ -0,0 +1,31 @@
+Howto use the configfs overlay interface.
+
+A device-tree configfs entry is created in /config/device-tree/overlays
+and and it is manipulated using standard file system I/O.
+Note that this is a debug level interface, for use by developers and
+not necessarily something accessed by normal users due to the
+security implications of having direct access to the kernel's device tree.
+
+* To create an overlay you mkdir the directory:
+
+	# mkdir /config/device-tree/overlays/foo
+
+* Either you echo the overlay firmware file to the path property file.
+
+	# echo foo.dtbo >/config/device-tree/overlays/foo/path
+
+* Or you cat the contents of the overlay to the dtbo file
+
+	# cat foo.dtbo >/config/device-tree/overlays/foo/dtbo
+
+The overlay file will be applied, and devices will be created/destroyed
+as required.
+
+To remove it simply rmdir the directory.
+
+	# rmdir /config/device-tree/overlays/foo
+
+The rationalle of the dual interface (firmware & direct copy) is that each is
+better suited to different use patterns. The firmware interface is what's
+intended to be used by hardware managers in the kernel, while the copy interface
+make sense for developers (since it avoids problems with namespaces).
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 36ae4454554c..be0fd4338da4 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -341,6 +341,8 @@ $(INSTALL_TARGETS):
 
 %.dtb: | scripts
 	$(Q)$(MAKE) $(build)=$(boot)/dts MACHINE=$(MACHINE) $(boot)/dts/$@
+%.dtbo: | scripts
+	$(Q)$(MAKE) $(build)=$(boot)/dts MACHINE=$(MACHINE) $(boot)/dts/$@
 
 PHONY += dtbs dtbs_install
 
diff --git a/arch/arm/boot/.gitignore b/arch/arm/boot/.gitignore
index ce1c5ff746e7..eaaeb17e5986 100644
--- a/arch/arm/boot/.gitignore
+++ b/arch/arm/boot/.gitignore
@@ -3,3 +3,4 @@ zImage
 xipImage
 bootpImage
 uImage
+*.dtb*
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index eff87a344566..37982e8e3a30 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -1,6 +1,16 @@
 # SPDX-License-Identifier: GPL-2.0
 ifeq ($(CONFIG_OF),y)
 
+dtb-$(CONFIG_ARCH_BCM2835) += \
+	bcm2708-rpi-b.dtb \
+	bcm2708-rpi-b-plus.dtb \
+	bcm2708-rpi-cm.dtb \
+	bcm2708-rpi-0-w.dtb \
+	bcm2709-rpi-2-b.dtb \
+	bcm2710-rpi-3-b.dtb \
+	bcm2710-rpi-3-b-plus.dtb \
+	bcm2710-rpi-cm3.dtb
+
 dtb-$(CONFIG_ARCH_ALPINE) += \
 	alpine-db.dtb
 dtb-$(CONFIG_MACH_ARTPEC6) += \
@@ -1069,10 +1079,21 @@ dtb-$(CONFIG_ARCH_ZX) += zx296702-ad1.dtb
 dtb-$(CONFIG_ARCH_ASPEED) += aspeed-bmc-opp-palmetto.dtb \
 	aspeed-bmc-opp-romulus.dtb \
 	aspeed-ast2500-evb.dtb
+
+targets += dtbs dtbs_install
+targets += $(dtb-y)
+
 endif
 
 dtstree		:= $(srctree)/$(src)
 dtb-$(CONFIG_OF_ALL_DTBS) := $(patsubst $(dtstree)/%.dts,%.dtb, $(wildcard $(dtstree)/*.dts))
 
 always		:= $(dtb-y)
+subdir-y	:= overlays
 clean-files	:= *.dtb
+
+# Enable fixups to support overlays on BCM2835 platforms
+ifeq ($(CONFIG_ARCH_BCM2835),y)
+	DTC_FLAGS ?= -@ -H epapr
+	dts-dirs += overlays
+endif
diff --git a/arch/arm/boot/dts/bcm2708-rpi-0-w.dts b/arch/arm/boot/dts/bcm2708-rpi-0-w.dts
new file mode 100644
index 000000000000..ef0b0f040ca5
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2708-rpi-0-w.dts
@@ -0,0 +1,166 @@
+/dts-v1/;
+
+#include "bcm2708.dtsi"
+
+/ {
+	compatible = "raspberrypi,model-zero-w", "brcm,bcm2835";
+	model = "Raspberry Pi Zero W";
+
+	chosen {
+		bootargs = "8250.nr_uarts=1";
+	};
+
+	aliases {
+		serial0 = &uart1;
+		serial1 = &uart0;
+	};
+};
+
+&gpio {
+	spi0_pins: spi0_pins {
+		brcm,pins = <9 10 11>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	spi0_cs_pins: spi0_cs_pins {
+		brcm,pins = <8 7>;
+		brcm,function = <1>; /* output */
+	};
+
+	i2c0_pins: i2c0 {
+		brcm,pins = <0 1>;
+		brcm,function = <4>;
+	};
+
+	i2c1_pins: i2c1 {
+		brcm,pins = <2 3>;
+		brcm,function = <4>;
+	};
+
+	i2s_pins: i2s {
+		brcm,pins = <18 19 20 21>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	sdio_pins: sdio_pins {
+		brcm,pins = <34 35 36 37 38 39>;
+		brcm,function = <7>; /* ALT3 = SD1 */
+		brcm,pull = <0 2 2 2 2 2>;
+	};
+
+	bt_pins: bt_pins {
+		brcm,pins = <43>;
+		brcm,function = <4>; /* alt0:GPCLK2 */
+		brcm,pull = <0>; /* none */
+	};
+
+	uart0_pins: uart0_pins {
+		brcm,pins = <30 31 32 33>;
+		brcm,function = <7>; /* alt3=UART0 */
+		brcm,pull = <2 0 0 2>; /* up none none up */
+	};
+
+	uart1_pins: uart1_pins {
+		brcm,pins;
+		brcm,function;
+		brcm,pull;
+	};
+
+	audio_pins: audio_pins {
+		brcm,pins = <>;
+		brcm,function = <>;
+	};
+};
+
+&mmc {
+	pinctrl-names = "default";
+	pinctrl-0 = <&sdio_pins>;
+	non-removable;
+	bus-width = <4>;
+	status = "okay";
+};
+
+&uart0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart0_pins &bt_pins>;
+	status = "okay";
+};
+
+&uart1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart1_pins>;
+	status = "okay";
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
+	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+
+	spidev0: spidev@0{
+		compatible = "spidev";
+		reg = <0>;	/* CE0 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+
+	spidev1: spidev@1{
+		compatible = "spidev";
+		reg = <1>;	/* CE1 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c2 {
+	clock-frequency = <100000>;
+};
+
+&i2s {
+	#sound-dai-cells = <0>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2s_pins>;
+};
+
+&random {
+	status = "okay";
+};
+
+&leds {
+	act_led: act {
+		label = "led0";
+		linux,default-trigger = "mmc0";
+		gpios = <&gpio 47 0>;
+	};
+};
+
+&hdmi {
+	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+};
+
+&audio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&audio_pins>;
+};
+
+/ {
+	__overrides__ {
+		act_led_gpio = <&act_led>,"gpios:4";
+		act_led_activelow = <&act_led>,"gpios:8";
+		act_led_trigger = <&act_led>,"linux,default-trigger";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts b/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
new file mode 100644
index 000000000000..31db4fd917a4
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2708-rpi-b-plus.dts
@@ -0,0 +1,122 @@
+/dts-v1/;
+
+#include "bcm2708.dtsi"
+#include "bcm283x-rpi-smsc9514.dtsi"
+
+/ {
+	model = "Raspberry Pi Model B+";
+};
+
+&gpio {
+	spi0_pins: spi0_pins {
+		brcm,pins = <9 10 11>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	spi0_cs_pins: spi0_cs_pins {
+		brcm,pins = <8 7>;
+		brcm,function = <1>; /* output */
+	};
+
+	i2c0_pins: i2c0 {
+		brcm,pins = <0 1>;
+		brcm,function = <4>;
+	};
+
+	i2c1_pins: i2c1 {
+		brcm,pins = <2 3>;
+		brcm,function = <4>;
+	};
+
+	i2s_pins: i2s {
+		brcm,pins = <18 19 20 21>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	audio_pins: audio_pins {
+		brcm,pins = <40 45>;
+		brcm,function = <4>;
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
+	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+
+	spidev0: spidev@0{
+		compatible = "spidev";
+		reg = <0>;	/* CE0 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+
+	spidev1: spidev@1{
+		compatible = "spidev";
+		reg = <1>;	/* CE1 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c2 {
+	clock-frequency = <100000>;
+};
+
+&i2s {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2s_pins>;
+};
+
+&leds {
+	act_led: act {
+		label = "led0";
+		linux,default-trigger = "mmc0";
+		gpios = <&gpio 47 0>;
+	};
+
+	pwr_led: pwr {
+		label = "led1";
+		linux,default-trigger = "input";
+		gpios = <&gpio 35 0>;
+	};
+};
+
+&hdmi {
+	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+};
+
+&audio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&audio_pins>;
+};
+
+/ {
+	__overrides__ {
+		act_led_gpio = <&act_led>,"gpios:4";
+		act_led_activelow = <&act_led>,"gpios:8";
+		act_led_trigger = <&act_led>,"linux,default-trigger";
+
+		pwr_led_gpio = <&pwr_led>,"gpios:4";
+		pwr_led_activelow = <&pwr_led>,"gpios:8";
+		pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2708-rpi-b.dts b/arch/arm/boot/dts/bcm2708-rpi-b.dts
new file mode 100644
index 000000000000..ffe5d14feb9f
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2708-rpi-b.dts
@@ -0,0 +1,112 @@
+/dts-v1/;
+
+#include "bcm2708.dtsi"
+#include "bcm283x-rpi-smsc9512.dtsi"
+
+/ {
+	model = "Raspberry Pi Model B";
+};
+
+&gpio {
+	spi0_pins: spi0_pins {
+		brcm,pins = <9 10 11>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	spi0_cs_pins: spi0_cs_pins {
+		brcm,pins = <8 7>;
+		brcm,function = <1>; /* output */
+	};
+
+	i2c0_pins: i2c0 {
+		brcm,pins = <0 1>;
+		brcm,function = <4>;
+	};
+
+	i2c1_pins: i2c1 {
+		brcm,pins = <2 3>;
+		brcm,function = <4>;
+	};
+
+	i2s_pins: i2s {
+		brcm,pins = <28 29 30 31>;
+		brcm,function = <6>; /* alt2 */
+	};
+
+	audio_pins: audio_pins {
+		brcm,pins = <40 45>;
+		brcm,function = <4>;
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
+	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+
+	spidev0: spidev@0{
+		compatible = "spidev";
+		reg = <0>;	/* CE0 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+
+	spidev1: spidev@1{
+		compatible = "spidev";
+		reg = <1>;	/* CE1 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c2 {
+	clock-frequency = <100000>;
+};
+
+&i2s {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2s_pins>;
+};
+
+&leds {
+	act_led: act {
+		label = "led0";
+		linux,default-trigger = "mmc0";
+		gpios = <&gpio 16 1>;
+	};
+};
+
+&hdmi {
+	hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>;
+};
+
+&audio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&audio_pins>;
+};
+
+/ {
+	__overrides__ {
+		act_led_gpio = <&act_led>,"gpios:4";
+		act_led_activelow = <&act_led>,"gpios:8";
+		act_led_trigger = <&act_led>,"linux,default-trigger";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2708-rpi-cm.dts b/arch/arm/boot/dts/bcm2708-rpi-cm.dts
new file mode 100644
index 000000000000..0b0d23256edd
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2708-rpi-cm.dts
@@ -0,0 +1,95 @@
+/dts-v1/;
+
+#include "bcm2708-rpi-cm.dtsi"
+
+/ {
+	model = "Raspberry Pi Compute Module";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&gpio {
+	spi0_pins: spi0_pins {
+		brcm,pins = <9 10 11>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	spi0_cs_pins: spi0_cs_pins {
+		brcm,pins = <8 7>;
+		brcm,function = <1>; /* output */
+	};
+
+	i2c0_pins: i2c0 {
+		brcm,pins = <0 1>;
+		brcm,function = <4>;
+	};
+
+	i2c1_pins: i2c1 {
+		brcm,pins = <2 3>;
+		brcm,function = <4>;
+	};
+
+	i2s_pins: i2s {
+		brcm,pins = <18 19 20 21>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	audio_pins: audio_pins {
+		brcm,pins;
+		brcm,function;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
+	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+
+	spidev0: spidev@0{
+		compatible = "spidev";
+		reg = <0>;	/* CE0 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+
+	spidev1: spidev@1{
+		compatible = "spidev";
+		reg = <1>;	/* CE1 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c2 {
+	clock-frequency = <100000>;
+};
+
+&i2s {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2s_pins>;
+};
+
+&audio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&audio_pins>;
+};
+
+&hdmi {
+	hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>;
+};
diff --git a/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi b/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi
new file mode 100644
index 000000000000..d0299e3d9a09
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2708-rpi-cm.dtsi
@@ -0,0 +1,17 @@
+#include "bcm2708.dtsi"
+
+&leds {
+	act_led: act {
+		label = "led0";
+		linux,default-trigger = "mmc0";
+		gpios = <&gpio 47 0>;
+	};
+};
+
+/ {
+	__overrides__ {
+		act_led_gpio = <&act_led>,"gpios:4";
+		act_led_activelow = <&act_led>,"gpios:8";
+		act_led_trigger = <&act_led>,"linux,default-trigger";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2708-rpi.dtsi b/arch/arm/boot/dts/bcm2708-rpi.dtsi
new file mode 100644
index 000000000000..fe2694a1cbdc
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2708-rpi.dtsi
@@ -0,0 +1,162 @@
+/* Downstream version of bcm2835-rpi.dtsi */
+
+#include <dt-bindings/power/raspberrypi-power.h>
+
+/ {
+	memory {
+		device_type = "memory";
+		reg = <0x0 0x0>;
+	};
+
+	aliases {
+		audio = &audio;
+		aux = &aux;
+		sound = &sound;
+		soc = &soc;
+		dma = &dma;
+		intc = &intc;
+		watchdog = &watchdog;
+		random = &random;
+		mailbox = &mailbox;
+		gpio = &gpio;
+		uart0 = &uart0;
+		sdhost = &sdhost;
+		mmc0 = &sdhost;
+		i2s = &i2s;
+		spi0 = &spi0;
+		i2c0 = &i2c0;
+		uart1 = &uart1;
+		spi1 = &spi1;
+		spi2 = &spi2;
+		mmc = &mmc;
+		mmc1 = &mmc;
+		i2c1 = &i2c1;
+		i2c2 = &i2c2;
+		usb = &usb;
+		leds = &leds;
+		fb = &fb;
+		vchiq = &vchiq;
+		thermal = &thermal;
+		axiperf = &axiperf;
+	};
+
+	leds: leds {
+		compatible = "gpio-leds";
+	};
+
+	soc {
+		gpiomem {
+			compatible = "brcm,bcm2835-gpiomem";
+			reg = <0x7e200000 0x1000>;
+		};
+
+		firmware: firmware {
+			compatible = "raspberrypi,bcm2835-firmware";
+			mboxes = <&mailbox>;
+		};
+
+		power: power {
+			compatible = "raspberrypi,bcm2835-power";
+			firmware = <&firmware>;
+			#power-domain-cells = <1>;
+		};
+
+		fb: fb {
+			compatible = "brcm,bcm2708-fb";
+			firmware = <&firmware>;
+			status = "disabled";
+		};
+
+		vchiq: vchiq {
+			compatible = "brcm,bcm2835-vchiq";
+			reg = <0x7e00b840 0xf>;
+			interrupts = <0 2>;
+			cache-line-size = <32>;
+			firmware = <&firmware>;
+		};
+
+		vcsm: vcsm {
+			compatible = "raspberrypi,bcm2835-vcsm";
+			firmware = <&firmware>;
+			status = "okay";
+		};
+
+		/* Onboard audio */
+		audio: audio {
+			compatible = "brcm,bcm2835-audio";
+			brcm,pwm-channels = <8>;
+			status = "disabled";
+		};
+
+		/* External sound card */
+		sound: sound {
+			status = "disabled";
+		};
+	};
+
+	__overrides__ {
+		cache_line_size = <&vchiq>, "cache-line-size:0";
+
+		uart0 = <&uart0>,"status";
+		uart1 = <&uart1>,"status";
+		i2s = <&i2s>,"status";
+		spi = <&spi0>,"status";
+		i2c0 = <&i2c0>,"status";
+		i2c1 = <&i2c1>,"status";
+		i2c2_iknowwhatimdoing = <&i2c2>,"status";
+		i2c0_baudrate = <&i2c0>,"clock-frequency:0";
+		i2c1_baudrate = <&i2c1>,"clock-frequency:0";
+		i2c2_baudrate = <&i2c2>,"clock-frequency:0";
+
+		audio = <&audio>,"status";
+		watchdog = <&watchdog>,"status";
+		random = <&random>,"status";
+		sd_overclock = <&sdhost>,"brcm,overclock-50:0";
+		sd_force_pio = <&sdhost>,"brcm,force-pio?";
+		sd_pio_limit = <&sdhost>,"brcm,pio-limit:0";
+		sd_debug     = <&sdhost>,"brcm,debug";
+		sdio_overclock = <&mmc>,"brcm,overclock-50:0";
+		axiperf      = <&axiperf>,"status";
+	};
+};
+
+&dma {
+	brcm,dma-channel-mask = <0x7f34>;
+};
+
+&hdmi {
+	power-domains = <&power RPI_POWER_DOMAIN_HDMI>;
+};
+
+&usb {
+	power-domains = <&power RPI_POWER_DOMAIN_USB>;
+};
+
+&clocks {
+	firmware = <&firmware>;
+};
+
+sdhost_pins: &sdhost_gpio48 {
+	/* Add alias */
+};
+
+&sdhost {
+	pinctrl-names = "default";
+	pinctrl-0 = <&sdhost_gpio48>;
+	bus-width = <4>;
+	brcm,overclock-50 = <0>;
+	brcm,pio-limit = <1>;
+	status = "okay";
+};
+
+&fb {
+	status = "okay";
+};
+
+&cpu_thermal {
+	/delete-node/ trips;
+};
+
+&vec {
+	status = "disabled";
+};
diff --git a/arch/arm/boot/dts/bcm2708.dtsi b/arch/arm/boot/dts/bcm2708.dtsi
new file mode 100644
index 000000000000..768c7da10f0e
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2708.dtsi
@@ -0,0 +1,11 @@
+#include "bcm2835.dtsi"
+#include "bcm270x.dtsi"
+#include "bcm2708-rpi.dtsi"
+
+/ {
+	/delete-node/ cpus;
+
+	__overrides__ {
+		arm_freq;
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2709-rpi-2-b.dts b/arch/arm/boot/dts/bcm2709-rpi-2-b.dts
new file mode 100644
index 000000000000..442d2ebbdd36
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2709-rpi-2-b.dts
@@ -0,0 +1,123 @@
+/dts-v1/;
+
+#include "bcm2709.dtsi"
+#include "bcm283x-rpi-smsc9514.dtsi"
+
+/ {
+	compatible = "raspberrypi,2-model-b", "brcm,bcm2836";
+	model = "Raspberry Pi 2 Model B";
+};
+
+&gpio {
+	spi0_pins: spi0_pins {
+		brcm,pins = <9 10 11>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	spi0_cs_pins: spi0_cs_pins {
+		brcm,pins = <8 7>;
+		brcm,function = <1>; /* output */
+	};
+
+	i2c0_pins: i2c0 {
+		brcm,pins = <0 1>;
+		brcm,function = <4>;
+	};
+
+	i2c1_pins: i2c1 {
+		brcm,pins = <2 3>;
+		brcm,function = <4>;
+	};
+
+	i2s_pins: i2s {
+		brcm,pins = <18 19 20 21>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	audio_pins: audio_pins {
+		brcm,pins = <40 45>;
+		brcm,function = <4>;
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
+	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+
+	spidev0: spidev@0{
+		compatible = "spidev";
+		reg = <0>;	/* CE0 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+
+	spidev1: spidev@1{
+		compatible = "spidev";
+		reg = <1>;	/* CE1 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c2 {
+	clock-frequency = <100000>;
+};
+
+&i2s {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2s_pins>;
+};
+
+&leds {
+	act_led: act {
+		label = "led0";
+		linux,default-trigger = "mmc0";
+		gpios = <&gpio 47 0>;
+	};
+
+	pwr_led: pwr {
+		label = "led1";
+		linux,default-trigger = "input";
+		gpios = <&gpio 35 0>;
+	};
+};
+
+&hdmi {
+	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+};
+
+&audio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&audio_pins>;
+};
+
+/ {
+	__overrides__ {
+		act_led_gpio = <&act_led>,"gpios:4";
+		act_led_activelow = <&act_led>,"gpios:8";
+		act_led_trigger = <&act_led>,"linux,default-trigger";
+
+		pwr_led_gpio = <&pwr_led>,"gpios:4";
+		pwr_led_activelow = <&pwr_led>,"gpios:8";
+		pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2709.dtsi b/arch/arm/boot/dts/bcm2709.dtsi
new file mode 100644
index 000000000000..715f5aca753e
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2709.dtsi
@@ -0,0 +1,19 @@
+#include "bcm2836.dtsi"
+#include "bcm270x.dtsi"
+#include "bcm2708-rpi.dtsi"
+
+/ {
+	soc {
+		ranges = <0x7e000000 0x3f000000 0x01000000>,
+		         <0x40000000 0x40000000 0x00040000>;
+
+		/delete-node/ timer@7e003000;
+	};
+
+	__overrides__ {
+		arm_freq = <&v7_cpu0>, "clock-frequency:0",
+			   <&v7_cpu1>, "clock-frequency:0",
+			   <&v7_cpu2>, "clock-frequency:0",
+			   <&v7_cpu3>, "clock-frequency:0";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm270x.dtsi b/arch/arm/boot/dts/bcm270x.dtsi
new file mode 100644
index 000000000000..d26b10ad0245
--- /dev/null
+++ b/arch/arm/boot/dts/bcm270x.dtsi
@@ -0,0 +1,175 @@
+/* Downstream bcm283x.dtsi diff */
+#include <dt-bindings/power/raspberrypi-power.h>
+
+/ {
+	chosen {
+		bootargs = "";
+		/delete-property/ stdout-path;
+	};
+
+	soc: soc {
+
+		watchdog: watchdog@7e100000 {
+			/* Add alias */
+		};
+
+		random: rng@7e104000 {
+			/* Add alias */
+		};
+
+		gpio@7e200000 { /* gpio */
+			interrupts = <2 17>, <2 18>;
+		};
+
+		serial@7e201000 { /* uart0 */
+			/* Enable CTS bug workaround */
+			cts-event-workaround;
+		};
+
+		i2s@7e203000 { /* i2s */
+			#sound-dai-cells = <0>;
+			reg = <0x7e203000 0x24>;
+			clocks = <&clocks BCM2835_CLOCK_PCM>;
+		};
+
+		spi0: spi@7e204000 {
+			/* Add alias */
+			dmas = <&dma 6>, <&dma 7>;
+			dma-names = "tx", "rx";
+		};
+
+		pixelvalve0: pixelvalve@7e206000 {
+			/* Add alias */
+			status = "disabled";
+		};
+
+		pixelvalve1: pixelvalve@7e207000 {
+			/* Add alias */
+			status = "disabled";
+		};
+
+		dpi: dpi@7e208000 {
+			compatible = "brcm,bcm2835-dpi";
+			reg = <0x7e208000 0x8c>;
+			clocks = <&clocks BCM2835_CLOCK_VPU>,
+				 <&clocks BCM2835_CLOCK_DPI>;
+			clock-names = "core", "pixel";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		/delete-node/ sdhci@7e300000;
+
+		mmc: mmc@7e300000 {
+			compatible = "brcm,bcm2835-mmc", "brcm,bcm2835-sdhci";
+			reg = <0x7e300000 0x100>;
+			interrupts = <2 30>;
+			clocks = <&clocks BCM2835_CLOCK_EMMC>;
+			dmas = <&dma 11>;
+			dma-names = "rx-tx";
+			brcm,overclock-50 = <0>;
+			status = "disabled";
+		};
+
+		hvs: hvs@7e400000 {
+			/* Add alias */
+			status = "disabled";
+		};
+
+		firmwarekms: firmwarekms@7e600000 {
+			compatible = "raspberrypi,rpi-firmware-kms";
+			/* SMI interrupt reg */
+			reg = <0x7e600000 0x100>;
+			interrupts = <2 16>;
+			brcm,firmware = <&firmware>;
+			status = "disabled";
+		};
+
+		smi: smi@7e600000 {
+			compatible = "brcm,bcm2835-smi";
+			reg = <0x7e600000 0x100>;
+			interrupts = <2 16>;
+			clocks = <&clocks BCM2835_CLOCK_SMI>;
+			assigned-clocks = <&clocks BCM2835_CLOCK_SMI>;
+			assigned-clock-rates = <125000000>;
+			dmas = <&dma 4>;
+			dma-names = "rx-tx";
+			status = "disabled";
+		};
+
+		pixelvalve2: pixelvalve@7e807000 {
+			/* Add alias */
+			status = "disabled";
+		};
+
+		hdmi@7e902000 { /* hdmi */
+			status = "disabled";
+		};
+
+		usb@7e980000 { /* usb */
+			compatible = "brcm,bcm2708-usb";
+			reg = <0x7e980000 0x10000>,
+			      <0x7e006000 0x1000>;
+			interrupts = <2 0>,
+				     <1 9>;
+		};
+
+		v3d@7ec00000 { /* vd3 */
+			compatible = "brcm,vc4-v3d";
+			power-domains = <&power RPI_POWER_DOMAIN_V3D>;
+			status = "disabled";
+		};
+
+		axiperf: axiperf {
+			compatible = "brcm,bcm2835-axiperf";
+			reg = <0x7e009800 0x100>,
+			      <0x7ee08000 0x100>;
+			firmware = <&firmware>;
+			status = "disabled";
+		};
+	};
+
+	vdd_5v0_reg: fixedregulator_5v0 {
+		compatible = "regulator-fixed";
+		regulator-name = "5v0";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-always-on;
+	};
+
+	vdd_3v3_reg: fixedregulator_3v3 {
+		compatible = "regulator-fixed";
+		regulator-name = "3v3";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-always-on;
+	};
+};
+
+/* Configure and use the auxilliary interrupt controller */
+
+&aux {
+	interrupts = <1 29>;
+	interrupt-controller;
+	#interrupt-cells = <1>;
+};
+
+&uart1 {
+	interrupt-parent = <&aux>;
+	interrupts = <0>;
+};
+
+&spi1 {
+	interrupt-parent = <&aux>;
+	interrupts = <1>;
+};
+
+&spi2 {
+	interrupt-parent = <&aux>;
+	interrupts = <2>;
+};
+
+&vc4 {
+	status = "disabled";
+};
diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
new file mode 100644
index 000000000000..7641360a63a8
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts
@@ -0,0 +1,183 @@
+/dts-v1/;
+
+#include "bcm2710.dtsi"
+#include "bcm283x-rpi-lan7515.dtsi"
+
+/ {
+	compatible = "raspberrypi,3-model-b-plus", "brcm,bcm2837";
+	model = "Raspberry Pi 3 Model B+";
+
+	chosen {
+		bootargs = "8250.nr_uarts=1";
+	};
+
+	aliases {
+		serial0 = &uart1;
+		serial1 = &uart0;
+	};
+};
+
+&gpio {
+	spi0_pins: spi0_pins {
+		brcm,pins = <9 10 11>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	spi0_cs_pins: spi0_cs_pins {
+		brcm,pins = <8 7>;
+		brcm,function = <1>; /* output */
+	};
+
+	i2c0_pins: i2c0 {
+		brcm,pins = <0 1>;
+		brcm,function = <4>;
+	};
+
+	i2c1_pins: i2c1 {
+		brcm,pins = <2 3>;
+		brcm,function = <4>;
+	};
+
+	i2s_pins: i2s {
+		brcm,pins = <18 19 20 21>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	sdio_pins: sdio_pins {
+		brcm,pins =     <34 35 36 37 38 39>;
+		brcm,function = <7>; // alt3 = SD1
+		brcm,pull =     <0 2 2 2 2 2>;
+	};
+
+	bt_pins: bt_pins {
+		brcm,pins = <43>;
+		brcm,function = <4>; /* alt0:GPCLK2 */
+		brcm,pull = <0>;
+	};
+
+	uart0_pins: uart0_pins {
+		brcm,pins = <32 33>;
+		brcm,function = <7>; /* alt3=UART0 */
+		brcm,pull = <0 2>;
+	};
+
+	uart1_pins: uart1_pins {
+		brcm,pins;
+		brcm,function;
+		brcm,pull;
+	};
+
+	audio_pins: audio_pins {
+		brcm,pins = <40 41>;
+		brcm,function = <4>;
+	};
+};
+
+&mmc {
+	pinctrl-names = "default";
+	pinctrl-0 = <&sdio_pins>;
+	non-removable;
+	bus-width = <4>;
+	status = "okay";
+	brcm,overclock-50 = <0>;
+};
+
+&soc {
+	expgpio: expgpio {
+		compatible = "brcm,bcm2835-expgpio";
+		gpio-controller;
+		#gpio-cells = <2>;
+		firmware = <&firmware>;
+		status = "okay";
+	};
+};
+
+&uart0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart0_pins &bt_pins>;
+	status = "okay";
+};
+
+&uart1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart1_pins>;
+	status = "okay";
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
+	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+
+	spidev0: spidev@0{
+		compatible = "spidev";
+		reg = <0>;	/* CE0 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+
+	spidev1: spidev@1{
+		compatible = "spidev";
+		reg = <1>;	/* CE1 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c2 {
+	clock-frequency = <100000>;
+};
+
+&i2s {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2s_pins>;
+};
+
+&leds {
+	act_led: act {
+		label = "led0";
+		linux,default-trigger = "mmc0";
+		gpios = <&gpio 29 0>;
+	};
+
+	pwr_led: pwr {
+		label = "led1";
+		linux,default-trigger = "default-on";
+		gpios = <&expgpio 2 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&hdmi {
+	hpd-gpios = <&expgpio 4 GPIO_ACTIVE_LOW>;
+};
+
+&audio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&audio_pins>;
+};
+
+/ {
+	__overrides__ {
+		act_led_gpio = <&act_led>,"gpios:4";
+		act_led_activelow = <&act_led>,"gpios:8";
+		act_led_trigger = <&act_led>,"linux,default-trigger";
+
+		pwr_led_gpio = <&pwr_led>,"gpios:4";
+		pwr_led_activelow = <&pwr_led>,"gpios:8";
+		pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
new file mode 100644
index 000000000000..3f84e2af8c25
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
@@ -0,0 +1,191 @@
+/dts-v1/;
+
+#include "bcm2710.dtsi"
+#include "bcm283x-rpi-smsc9514.dtsi"
+
+/ {
+	compatible = "raspberrypi,3-model-b", "brcm,bcm2837";
+	model = "Raspberry Pi 3 Model B";
+
+	chosen {
+		bootargs = "8250.nr_uarts=1";
+	};
+
+	aliases {
+		serial0 = &uart1;
+		serial1 = &uart0;
+	};
+};
+
+&gpio {
+	spi0_pins: spi0_pins {
+		brcm,pins = <9 10 11>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	spi0_cs_pins: spi0_cs_pins {
+		brcm,pins = <8 7>;
+		brcm,function = <1>; /* output */
+	};
+
+	i2c0_pins: i2c0 {
+		brcm,pins = <0 1>;
+		brcm,function = <4>;
+	};
+
+	i2c1_pins: i2c1 {
+		brcm,pins = <2 3>;
+		brcm,function = <4>;
+	};
+
+	i2s_pins: i2s {
+		brcm,pins = <18 19 20 21>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	sdio_pins: sdio_pins {
+		brcm,pins =     <34 35 36 37 38 39>;
+		brcm,function = <7>; // alt3 = SD1
+		brcm,pull =     <0 2 2 2 2 2>;
+	};
+
+	bt_pins: bt_pins {
+		brcm,pins = <43>;
+		brcm,function = <4>; /* alt0:GPCLK2 */
+		brcm,pull = <0>;
+	};
+
+	uart0_pins: uart0_pins {
+		brcm,pins = <32 33>;
+		brcm,function = <7>; /* alt3=UART0 */
+		brcm,pull = <0 2>;
+	};
+
+	uart1_pins: uart1_pins {
+		brcm,pins;
+		brcm,function;
+		brcm,pull;
+	};
+
+	audio_pins: audio_pins {
+		brcm,pins = <40 41>;
+		brcm,function = <4>;
+	};
+};
+
+&mmc {
+	pinctrl-names = "default";
+	pinctrl-0 = <&sdio_pins>;
+	non-removable;
+	bus-width = <4>;
+	status = "okay";
+	brcm,overclock-50 = <0>;
+};
+
+&soc {
+	virtgpio: virtgpio {
+		compatible = "brcm,bcm2835-virtgpio";
+		gpio-controller;
+		#gpio-cells = <2>;
+		firmware = <&firmware>;
+		status = "okay";
+	};
+
+	expgpio: expgpio {
+		compatible = "brcm,bcm2835-expgpio";
+		gpio-controller;
+		#gpio-cells = <2>;
+		firmware = <&firmware>;
+		status = "okay";
+	};
+};
+
+&uart0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart0_pins &bt_pins>;
+	status = "okay";
+};
+
+&uart1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart1_pins>;
+	status = "okay";
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
+	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+
+	spidev0: spidev@0{
+		compatible = "spidev";
+		reg = <0>;	/* CE0 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+
+	spidev1: spidev@1{
+		compatible = "spidev";
+		reg = <1>;	/* CE1 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c2 {
+	clock-frequency = <100000>;
+};
+
+&i2s {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2s_pins>;
+};
+
+&leds {
+	act_led: act {
+		label = "led0";
+		linux,default-trigger = "mmc0";
+		gpios = <&virtgpio 0 0>;
+	};
+
+	pwr_led: pwr {
+		label = "led1";
+		linux,default-trigger = "input";
+		gpios = <&expgpio 7 0>;
+	};
+};
+
+&hdmi {
+	hpd-gpios = <&expgpio 4 GPIO_ACTIVE_LOW>;
+};
+
+&audio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&audio_pins>;
+};
+
+/ {
+	__overrides__ {
+		act_led_gpio = <&act_led>,"gpios:4";
+		act_led_activelow = <&act_led>,"gpios:8";
+		act_led_trigger = <&act_led>,"linux,default-trigger";
+
+		pwr_led_gpio = <&pwr_led>,"gpios:4";
+		pwr_led_activelow = <&pwr_led>,"gpios:8";
+		pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2710-rpi-cm3.dts b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
new file mode 100644
index 000000000000..2500641c14dc
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2710-rpi-cm3.dts
@@ -0,0 +1,129 @@
+/dts-v1/;
+
+#include "bcm2710.dtsi"
+
+/ {
+	model = "Raspberry Pi Compute Module 3";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&gpio {
+	spi0_pins: spi0_pins {
+		brcm,pins = <9 10 11>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	spi0_cs_pins: spi0_cs_pins {
+		brcm,pins = <8 7>;
+		brcm,function = <1>; /* output */
+	};
+
+	i2c0_pins: i2c0 {
+		brcm,pins = <0 1>;
+		brcm,function = <4>;
+	};
+
+	i2c1_pins: i2c1 {
+		brcm,pins = <2 3>;
+		brcm,function = <4>;
+	};
+
+	i2s_pins: i2s {
+		brcm,pins = <18 19 20 21>;
+		brcm,function = <4>; /* alt0 */
+	};
+
+	audio_pins: audio_pins {
+		brcm,pins;
+		brcm,function;
+	};
+};
+
+&soc {
+	virtgpio: virtgpio {
+		compatible = "brcm,bcm2835-virtgpio";
+		gpio-controller;
+		#gpio-cells = <2>;
+		firmware = <&firmware>;
+		status = "okay";
+	};
+
+	expgpio: expgpio {
+		compatible = "brcm,bcm2835-expgpio";
+		gpio-controller;
+		#gpio-cells = <2>;
+		firmware = <&firmware>;
+		status = "okay";
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
+	cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+
+	spidev0: spidev@0{
+		compatible = "spidev";
+		reg = <0>;	/* CE0 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+
+	spidev1: spidev@1{
+		compatible = "spidev";
+		reg = <1>;	/* CE1 */
+		#address-cells = <1>;
+		#size-cells = <0>;
+		spi-max-frequency = <125000000>;
+	};
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+};
+
+&i2c2 {
+	clock-frequency = <100000>;
+};
+
+&i2s {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2s_pins>;
+};
+
+&leds {
+	act_led: act {
+		label = "led0";
+		linux,default-trigger = "mmc0";
+		gpios = <&virtgpio 0 0>;
+	};
+};
+
+&hdmi {
+	hpd-gpios = <&expgpio 0 GPIO_ACTIVE_LOW>;
+};
+
+&audio {
+	pinctrl-names = "default";
+	pinctrl-0 = <&audio_pins>;
+};
+
+/ {
+	__overrides__ {
+		act_led_gpio = <&act_led>,"gpios:4";
+		act_led_activelow = <&act_led>,"gpios:8";
+		act_led_trigger = <&act_led>,"linux,default-trigger";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm2710.dtsi b/arch/arm/boot/dts/bcm2710.dtsi
new file mode 100644
index 000000000000..6fb5ed655d63
--- /dev/null
+++ b/arch/arm/boot/dts/bcm2710.dtsi
@@ -0,0 +1,29 @@
+#include "bcm2837.dtsi"
+#include "bcm270x.dtsi"
+#include "bcm2708-rpi.dtsi"
+
+/ {
+	compatible = "brcm,bcm2837", "brcm,bcm2836";
+
+	soc {
+
+		arm-pmu {
+#ifdef RPI364
+			compatible = "arm,armv8-pmuv3", "arm,cortex-a7-pmu";
+#else
+			compatible = "arm,cortex-a7-pmu";
+#endif
+			interrupt-parent = <&local_intc>;
+			interrupts = <9>;
+		};
+
+		/delete-node/ timer@7e003000;
+	};
+
+	__overrides__ {
+		arm_freq = <&cpu0>, "clock-frequency:0",
+		       <&cpu1>, "clock-frequency:0",
+		       <&cpu2>, "clock-frequency:0",
+		       <&cpu3>, "clock-frequency:0";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi b/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
new file mode 100644
index 000000000000..154d48b7c45d
--- /dev/null
+++ b/arch/arm/boot/dts/bcm283x-rpi-lan7515.dtsi
@@ -0,0 +1,43 @@
+/ {
+	aliases {
+		ethernet0 = &ethernet;
+	};
+};
+
+&usb {
+	usb1@1 {
+		compatible = "usb424,2514";
+		reg = <1>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		usb1_1@1 {
+			compatible = "usb424,2514";
+			reg = <1>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			ethernet: usbether@1 {
+				compatible = "usb424,7800";
+				reg = <1>;
+				microchip,eee-enabled;
+				microchip,tx-lpi-timer = <600>; /* non-aggressive*/
+				/*
+				 * led0 = 1:link1000/activity
+				 * led1 = 6:link10/100/activity
+				 */
+				microchip,led-modes = <1 6>;
+			};
+		};
+	};
+};
+
+
+/ {
+	__overrides__ {
+		eee = <&ethernet>,"microchip,eee-enabled?";
+		tx_lpi_timer = <&ethernet>,"microchip,tx-lpi-timer:0";
+		eth_led0 = <&ethernet>,"microchip,led-modes:0";
+		eth_led1 = <&ethernet>,"microchip,led-modes:4";
+	};
+};
diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index 4745e3c7806b..9a378177ca4f 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -639,5 +639,6 @@
 
 	usbphy: phy {
 		compatible = "usb-nop-xceiv";
+		#phy-cells = <0>;
 	};
 };
diff --git a/arch/arm/boot/dts/overlays/Makefile b/arch/arm/boot/dts/overlays/Makefile
new file mode 100644
index 000000000000..a22141d24850
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/Makefile
@@ -0,0 +1,144 @@
+# Overlays for the Raspberry Pi platform
+
+dtbo-$(CONFIG_ARCH_BCM2835) += \
+	adau1977-adc.dtbo \
+	adau7002-simple.dtbo \
+	ads1015.dtbo \
+	ads1115.dtbo \
+	ads7846.dtbo \
+	akkordion-iqdacplus.dtbo \
+	allo-boss-dac-pcm512x-audio.dtbo \
+	allo-digione.dtbo \
+	allo-katana-dac-audio.dtbo \
+	allo-piano-dac-pcm512x-audio.dtbo \
+	allo-piano-dac-plus-pcm512x-audio.dtbo \
+	applepi-dac.dtbo \
+	at86rf233.dtbo \
+	audioinjector-addons.dtbo \
+	audioinjector-wm8731-audio.dtbo \
+	audremap.dtbo \
+	balena-fin.dtbo \
+	bmp085_i2c-sensor.dtbo \
+	dht11.dtbo \
+	dionaudio-loco.dtbo \
+	dionaudio-loco-v2.dtbo \
+	dpi18.dtbo \
+	dpi24.dtbo \
+	dwc-otg.dtbo \
+	dwc2.dtbo \
+	enc28j60.dtbo \
+	enc28j60-spi2.dtbo \
+	exc3000.dtbo \
+	fe-pi-audio.dtbo \
+	goodix.dtbo \
+	googlevoicehat-soundcard.dtbo \
+	gpio-ir.dtbo \
+	gpio-ir-tx.dtbo \
+	gpio-key.dtbo \
+	gpio-poweroff.dtbo \
+	gpio-shutdown.dtbo \
+	hifiberry-amp.dtbo \
+	hifiberry-dac.dtbo \
+	hifiberry-dacplus.dtbo \
+	hifiberry-digi.dtbo \
+	hifiberry-digi-pro.dtbo \
+	hy28a.dtbo \
+	hy28b.dtbo \
+	i2c-bcm2708.dtbo \
+	i2c-gpio.dtbo \
+	i2c-mux.dtbo \
+	i2c-pwm-pca9685a.dtbo \
+	i2c-rtc.dtbo \
+	i2c-rtc-gpio.dtbo \
+	i2c-sensor.dtbo \
+	i2c0-bcm2708.dtbo \
+	i2c1-bcm2708.dtbo \
+	i2s-gpio28-31.dtbo \
+	iqaudio-dac.dtbo \
+	iqaudio-dacplus.dtbo \
+	iqaudio-digi-wm8804-audio.dtbo \
+	jedec-spi-nor.dtbo \
+	justboom-dac.dtbo \
+	justboom-digi.dtbo \
+	lirc-rpi.dtbo \
+	ltc294x.dtbo \
+	mbed-dac.dtbo \
+	mcp23017.dtbo \
+	mcp23s17.dtbo \
+	mcp2515-can0.dtbo \
+	mcp2515-can1.dtbo \
+	mcp3008.dtbo \
+	mcp3202.dtbo \
+	media-center.dtbo \
+	midi-uart0.dtbo \
+	midi-uart1.dtbo \
+	mmc.dtbo \
+	mpu6050.dtbo \
+	mz61581.dtbo \
+	papirus.dtbo \
+	pi3-act-led.dtbo \
+	pi3-disable-bt.dtbo \
+	pi3-disable-wifi.dtbo \
+	pi3-miniuart-bt.dtbo \
+	pibell.dtbo \
+	piscreen.dtbo \
+	piscreen2r.dtbo \
+	pisound.dtbo \
+	pitft22.dtbo \
+	pitft28-capacitive.dtbo \
+	pitft28-resistive.dtbo \
+	pitft35-resistive.dtbo \
+	pps-gpio.dtbo \
+	pwm.dtbo \
+	pwm-2chan.dtbo \
+	pwm-ir-tx.dtbo \
+	qca7000.dtbo \
+	rotary-encoder.dtbo \
+	rpi-backlight.dtbo \
+	rpi-cirrus-wm5102.dtbo \
+	rpi-dac.dtbo \
+	rpi-display.dtbo \
+	rpi-ft5406.dtbo \
+	rpi-proto.dtbo \
+	rpi-sense.dtbo \
+	rpi-tv.dtbo \
+	rra-digidac1-wm8741-audio.dtbo \
+	sc16is750-i2c.dtbo \
+	sc16is752-i2c.dtbo \
+	sc16is752-spi1.dtbo \
+	sdhost.dtbo \
+	sdio.dtbo \
+	sdio-1bit.dtbo \
+	sdtweak.dtbo \
+	smi.dtbo \
+	smi-dev.dtbo \
+	smi-nand.dtbo \
+	spi-gpio35-39.dtbo \
+	spi-rtc.dtbo \
+	spi0-cs.dtbo \
+	spi0-hw-cs.dtbo \
+	spi1-1cs.dtbo \
+	spi1-2cs.dtbo \
+	spi1-3cs.dtbo \
+	spi2-1cs.dtbo \
+	spi2-2cs.dtbo \
+	spi2-3cs.dtbo \
+	superaudioboard.dtbo \
+	sx150x.dtbo \
+	tinylcd35.dtbo \
+	uart0.dtbo \
+	uart1.dtbo \
+	upstream.dtbo \
+	upstream-aux-interrupt.dtbo \
+	vc4-fkms-v3d.dtbo \
+	vc4-kms-v3d.dtbo \
+	vga666.dtbo \
+	w1-gpio.dtbo \
+	w1-gpio-pullup.dtbo \
+	wittypi.dtbo
+
+targets += dtbs dtbs_install
+targets += $(dtbo-y)
+
+always		:= $(dtbo-y)
+clean-files	:= *.dtbo
diff --git a/arch/arm/boot/dts/overlays/README b/arch/arm/boot/dts/overlays/README
new file mode 100644
index 000000000000..a9e56efd6532
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/README
@@ -0,0 +1,1945 @@
+Introduction
+============
+
+This directory contains Device Tree overlays. Device Tree makes it possible
+to support many hardware configurations with a single kernel and without the
+need to explicitly load or blacklist kernel modules. Note that this isn't a
+"pure" Device Tree configuration (c.f. MACH_BCM2835) - some on-board devices
+are still configured by the board support code, but the intention is to
+eventually reach that goal.
+
+On Raspberry Pi, Device Tree usage is controlled from /boot/config.txt. By
+default, the Raspberry Pi kernel boots with device tree enabled. You can
+completely disable DT usage (for now) by adding:
+
+    device_tree=
+
+to your config.txt, which should cause your Pi to revert to the old way of
+doing things after a reboot.
+
+In /boot you will find a .dtb for each base platform. This describes the
+hardware that is part of the Raspberry Pi board. The loader (start.elf and its
+siblings) selects the .dtb file appropriate for the platform by name, and reads
+it into memory. At this point, all of the optional interfaces (i2c, i2s, spi)
+are disabled, but they can be enabled using Device Tree parameters:
+
+    dtparam=i2c=on,i2s=on,spi=on
+
+However, this shouldn't be necessary in many use cases because loading an
+overlay that requires one of those interfaces will cause it to be enabled
+automatically, and it is advisable to only enable interfaces if they are
+needed.
+
+Configuring additional, optional hardware is done using Device Tree overlays
+(see below).
+
+GPIO numbering uses the hardware pin numbering scheme (aka BCM scheme) and
+not the physical pin numbers.
+
+raspi-config
+============
+
+The Advanced Options section of the raspi-config utility can enable and disable
+Device Tree use, as well as toggling the I2C and SPI interfaces. Note that it
+is possible to both enable an interface and blacklist the driver, if for some
+reason you should want to defer the loading.
+
+Modules
+=======
+
+As well as describing the hardware, Device Tree also gives enough information
+to allow suitable driver modules to be located and loaded, with the corollary
+that unneeded modules are not loaded. As a result it should be possible to
+remove lines from /etc/modules, and /etc/modprobe.d/raspi-blacklist.conf can
+have its contents deleted (or commented out).
+
+Using Overlays
+==============
+
+Overlays are loaded using the "dtoverlay" directive. As an example, consider
+the popular lirc-rpi module, the Linux Infrared Remote Control driver. In the
+pre-DT world this would be loaded from /etc/modules, with an explicit
+"modprobe lirc-rpi" command, or programmatically by lircd. With DT enabled,
+this becomes a line in config.txt:
+
+    dtoverlay=lirc-rpi
+
+This causes the file /boot/overlays/lirc-rpi.dtbo to be loaded. By
+default it will use GPIOs 17 (out) and 18 (in), but this can be modified using
+DT parameters:
+
+    dtoverlay=lirc-rpi,gpio_out_pin=17,gpio_in_pin=13
+
+Parameters always have default values, although in some cases (e.g. "w1-gpio")
+it is necessary to provided multiple overlays in order to get the desired
+behaviour. See the list of overlays below for a description of the parameters
+and their defaults.
+
+The Overlay and Parameter Reference
+===================================
+
+N.B. When editing this file, please preserve the indentation levels to make it
+simple to parse programmatically. NO HARD TABS.
+
+
+Name:   <The base DTB>
+Info:   Configures the base Raspberry Pi hardware
+Load:   <loaded automatically>
+Params:
+        audio                   Set to "on" to enable the onboard ALSA audio
+                                interface (default "off")
+
+        eee                     Enable Energy Efficient Ethernet support for
+                                compatible devices (default "on"). See also
+                                "tx_lpi_timer".
+
+        eth_led0                Set mode of LED0 (usually orange) (default
+                                "1"). The legal values are:
+                                0=link/activity          1=link1000/activity
+                                2=link100/activity       3=link10/activity
+                                4=link100/1000/activity  5=link10/1000/activity
+                                6=link10/100/activity    14=off    15=on
+
+        eth_led1                Set mode of LED1 (usually green) (default
+                                "6"). See eth_led0 for legal values.
+
+        i2c_arm                 Set to "on" to enable the ARM's i2c interface
+                                (default "off")
+
+        i2c_vc                  Set to "on" to enable the i2c interface
+                                usually reserved for the VideoCore processor
+                                (default "off")
+
+        i2c                     An alias for i2c_arm
+
+        i2c_arm_baudrate        Set the baudrate of the ARM's i2c interface
+                                (default "100000")
+
+        i2c_vc_baudrate         Set the baudrate of the VideoCore i2c interface
+                                (default "100000")
+
+        i2c_baudrate            An alias for i2c_arm_baudrate
+
+        i2s                     Set to "on" to enable the i2s interface
+                                (default "off")
+
+        spi                     Set to "on" to enable the spi interfaces
+                                (default "off")
+
+        random                  Set to "on" to enable the hardware random
+                                number generator (default "on")
+
+        sd_overclock            Clock (in MHz) to use when the MMC framework
+                                requests 50MHz
+
+        sd_force_pio            Disable DMA support for SD driver (default off)
+
+        sd_pio_limit            Number of blocks above which to use DMA for
+                                SD card (default 1)
+
+        sd_debug                Enable debug output from SD driver (default off)
+
+        sdio_overclock          Clock (in MHz) to use when the MMC framework
+                                requests 50MHz for the SDIO/WiFi interface.
+
+        tx_lpi_timer            Set the delay in microseconds between going idle
+                                and entering the low power state (default 600).
+                                Requires EEE to be enabled - see "eee".
+
+        uart0                   Set to "off" to disable uart0 (default "on")
+
+        uart1                   Set to "on" or "off" to enable or disable uart1
+                                (default varies)
+
+        watchdog                Set to "on" to enable the hardware watchdog
+                                (default "off")
+
+        act_led_trigger         Choose which activity the LED tracks.
+                                Use "heartbeat" for a nice load indicator.
+                                (default "mmc")
+
+        act_led_activelow       Set to "on" to invert the sense of the LED
+                                (default "off")
+                                N.B. For Pi3 see pi3-act-led overlay.
+
+        act_led_gpio            Set which GPIO to use for the activity LED
+                                (in case you want to connect it to an external
+                                device)
+                                (default "16" on a non-Plus board, "47" on a
+                                Plus or Pi 2)
+                                N.B. For Pi3 see pi3-act-led overlay.
+
+        pwr_led_trigger
+        pwr_led_activelow
+        pwr_led_gpio
+                                As for act_led_*, but using the PWR LED.
+                                Not available on Model A/B boards.
+
+        N.B. It is recommended to only enable those interfaces that are needed.
+        Leaving all interfaces enabled can lead to unwanted behaviour (i2c_vc
+        interfering with Pi Camera, I2S and SPI hogging GPIO pins, etc.)
+        Note also that i2c, i2c_arm and i2c_vc are aliases for the physical
+        interfaces i2c0 and i2c1. Use of the numeric variants is still possible
+        but deprecated because the ARM/VC assignments differ between board
+        revisions. The same board-specific mapping applies to i2c_baudrate,
+        and the other i2c baudrate parameters.
+
+
+Name:   adau1977-adc
+Info:   Overlay for activation of ADAU1977 ADC codec over I2C for control
+        and I2S for data.
+Load:   dtoverlay=adau1977-adc
+Params: <None>
+
+
+Name:   adau7002-simple
+Info:   Overlay for the activation of ADAU7002 stereo PDM to I2S converter.
+Load:   dtoverlay=adau7002-simple,<param>=<val>
+Params: card-name               Override the default, "adau7002", card name.
+
+
+Name:   ads1015
+Info:   Overlay for activation of Texas Instruments ADS1015 ADC over I2C
+Load:   dtoverlay=ads1015,<param>=<val>
+Params: addr                    I2C bus address of device. Set based on how the
+                                addr pin is wired. (default=0x48 assumes addr
+                                is pulled to GND)
+        cha_enable              Enable virtual channel a. (default=true)
+        cha_cfg                 Set the configuration for virtual channel a.
+                                (default=4 configures this channel for the
+                                voltage at A0 with respect to GND)
+        cha_datarate            Set the datarate (samples/sec) for this channel.
+                                (default=4 sets 1600 sps)
+        cha_gain                Set the gain of the Programmable Gain
+                                Amplifier for this channel. (default=2 sets the
+                                full scale of the channel to 2.048 Volts)
+
+        Channel (ch) parameters can be set for each enabled channel.
+        A maximum of 4 channels can be enabled (letters a thru d).
+        For more information refer to the device datasheet at:
+        http://www.ti.com/lit/ds/symlink/ads1015.pdf
+
+
+Name:   ads1115
+Info:   Texas Instruments ADS1115 ADC
+Load:   dtoverlay=ads1115,<param>[=<val>]
+Params: addr                    I2C bus address of device. Set based on how the
+                                addr pin is wired. (default=0x48 assumes addr
+                                is pulled to GND)
+        cha_enable              Enable virtual channel a.
+        cha_cfg                 Set the configuration for virtual channel a.
+                                (default=4 configures this channel for the
+                                voltage at A0 with respect to GND)
+        cha_datarate            Set the datarate (samples/sec) for this channel.
+                                (default=7 sets 860 sps)
+        cha_gain                Set the gain of the Programmable Gain
+                                Amplifier for this channel. (Default 1 sets the
+                                full scale of the channel to 4.096 Volts)
+
+        Channel parameters can be set for each enabled channel.
+        A maximum of 4 channels can be enabled (letters a thru d).
+        For more information refer to the device datasheet at:
+        http://www.ti.com/lit/ds/symlink/ads1115.pdf
+
+
+Name:   ads7846
+Info:   ADS7846 Touch controller
+Load:   dtoverlay=ads7846,<param>=<val>
+Params: cs                      SPI bus Chip Select (default 1)
+        speed                   SPI bus speed (default 2MHz, max 3.25MHz)
+        penirq                  GPIO used for PENIRQ. REQUIRED
+        penirq_pull             Set GPIO pull (default 0=none, 2=pullup)
+        swapxy                  Swap x and y axis
+        xmin                    Minimum value on the X axis (default 0)
+        ymin                    Minimum value on the Y axis (default 0)
+        xmax                    Maximum value on the X axis (default 4095)
+        ymax                    Maximum value on the Y axis (default 4095)
+        pmin                    Minimum reported pressure value (default 0)
+        pmax                    Maximum reported pressure value (default 65535)
+        xohms                   Touchpanel sensitivity (X-plate resistance)
+                                (default 400)
+
+        penirq is required and usually xohms (60-100) has to be set as well.
+        Apart from that, pmax (255) and swapxy are also common.
+        The rest of the calibration can be done with xinput-calibrator.
+        See: github.com/notro/fbtft/wiki/FBTFT-on-Raspian
+        Device Tree binding document:
+        www.kernel.org/doc/Documentation/devicetree/bindings/input/ads7846.txt
+
+
+Name:   akkordion-iqdacplus
+Info:   Configures the Digital Dreamtime Akkordion Music Player (based on the
+        OEM IQAudIO DAC+ or DAC Zero module).
+Load:   dtoverlay=akkordion-iqdacplus,<param>=<val>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control. Enable with
+                                dtoverlay=akkordion-iqdacplus,24db_digital_gain
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24db_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+
+
+Name:   allo-boss-dac-pcm512x-audio
+Info:   Configures the Allo Boss DAC audio cards.
+Load:   dtoverlay=allo-boss-dac-pcm512x-audio,<param>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control. Enable with
+                                "dtoverlay=allo-boss-dac-pcm512x-audio,
+                                24db_digital_gain"
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24db_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+        slave                   Force Boss DAC into slave mode, using Pi a
+                                master for bit clock and frame clock. Enable
+                                with "dtoverlay=allo-boss-dac-pcm512x-audio,
+                                slave"
+
+
+Name:   allo-digione
+Info:   Configures the Allo Digione audio card
+Load:   dtoverlay=allo-digione
+Params: <None>
+
+
+Name:   allo-katana-dac-audio
+Info:   Configures the Allo Katana DAC audio card
+Load:   dtoverlay=allo-katana-dac-audio
+Params: <None>
+
+
+Name:   allo-piano-dac-pcm512x-audio
+Info:   Configures the Allo Piano DAC (2.0/2.1) audio cards.
+        (NB. This initial support is for 2.0 channel audio ONLY! ie. stereo.
+        The subwoofer outputs on the Piano 2.1 are not currently supported!)
+Load:   dtoverlay=allo-piano-dac-pcm512x-audio,<param>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control.
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24db_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+
+
+Name:   allo-piano-dac-plus-pcm512x-audio
+Info:   Configures the Allo Piano DAC (2.1) audio cards.
+Load:   dtoverlay=allo-piano-dac-plus-pcm512x-audio,<param>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control.
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24db_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+        glb_mclk                This option is only with Kali board. If enabled,
+                                MCLK for Kali is used and PLL is disabled for
+                                better voice quality. (default Off)
+
+
+Name:   applepi-dac
+Info:   Configures the Orchard Audio ApplePi-DAC audio card
+Load:   dtoverlay=applepi-dac
+Params: <None>
+
+
+Name:   at86rf233
+Info:   Configures the Atmel AT86RF233 802.15.4 low-power WPAN transceiver,
+        connected to spi0.0
+Load:   dtoverlay=at86rf233,<param>=<val>
+Params: interrupt               GPIO used for INT (default 23)
+        reset                   GPIO used for Reset (default 24)
+        sleep                   GPIO used for Sleep (default 25)
+        speed                   SPI bus speed in Hz (default 3000000)
+        trim                    Fine tuning of the internal capacitance
+                                arrays (0=+0pF, 15=+4.5pF, default 15)
+
+
+Name:   audioinjector-addons
+Info:   Configures the audioinjector.net audio add on soundcards
+Load:   dtoverlay=audioinjector-addons,<param>=<val>
+Params: non-stop-clocks         Keeps the clocks running even when the stream
+                                is paused or stopped (default off)
+
+
+Name:   audioinjector-wm8731-audio
+Info:   Configures the audioinjector.net audio add on soundcard
+Load:   dtoverlay=audioinjector-wm8731-audio
+Params: <None>
+
+
+Name:   audremap
+Info:   Switches PWM sound output to pins 12 (Right) & 13 (Left)
+Load:   dtoverlay=audremap,<param>=<val>
+Params: swap_lr                 Reverse the channel allocation, which will also
+                                swap the audio jack outputs (default off)
+        enable_jack             Don't switch off the audio jack output
+                                (default off)
+
+
+Name:   balena-fin
+Info:   Overlay that enables WiFi, Bluetooth and the GPIO expander on the
+        Balena Fin board.
+Load:   dtoverlay=balena-fin
+Params: <None>
+
+
+Name:   bmp085_i2c-sensor
+Info:   This overlay is now deprecated - see i2c-sensor
+Load:   dtoverlay=bmp085_i2c-sensor
+Params: <None>
+
+
+Name:   dht11
+Info:   Overlay for the DHT11/DHT21/DHT22 humidity/temperature sensors
+        Also sometimes found with the part number(s) AM230x.
+Load:   dtoverlay=dht11,<param>=<val>
+Params: gpiopin                 GPIO connected to the sensor's DATA output.
+                                (default 4)
+
+
+Name:   dionaudio-loco
+Info:   Configures the Dion Audio LOCO DAC-AMP
+Load:   dtoverlay=dionaudio-loco
+Params: <None>
+
+
+Name:   dionaudio-loco-v2
+Info:   Configures the Dion Audio LOCO-V2 DAC-AMP
+Load:   dtoverlay=dionaudio-loco-v2,<param>=<val>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control. Enable with
+                                "dtoverlay=hifiberry-dacplus,24db_digital_gain"
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24dB_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+
+
+Name:   dpi18
+Info:   Overlay for a generic 18-bit DPI display
+        This uses GPIOs 0-21 (so no I2C, uart etc.), and activates the output
+        2-3 seconds after the kernel has started.
+Load:   dtoverlay=dpi18
+Params: <None>
+
+
+Name:   dpi24
+Info:   Overlay for a generic 24-bit DPI display
+        This uses GPIOs 0-27 (so no I2C, uart etc.), and activates the output
+        2-3 seconds after the kernel has started.
+Load:   dtoverlay=dpi24
+Params: <None>
+
+
+Name:   dwc-otg
+Info:   Selects the dwc_otg USB controller driver which has fiq support. This
+        is the default on all except the Pi Zero which defaults to dwc2.
+Load:   dtoverlay=dwc-otg
+Params: <None>
+
+
+Name:   dwc2
+Info:   Selects the dwc2 USB controller driver
+Load:   dtoverlay=dwc2,<param>=<val>
+Params: dr_mode                 Dual role mode: "host", "peripheral" or "otg"
+
+        g-rx-fifo-size          Size of rx fifo size in gadget mode
+
+        g-np-tx-fifo-size       Size of non-periodic tx fifo size in gadget
+                                mode
+
+
+[ The ds1307-rtc overlay has been deleted. See i2c-rtc. ]
+
+
+Name:   enc28j60
+Info:   Overlay for the Microchip ENC28J60 Ethernet Controller on SPI0
+Load:   dtoverlay=enc28j60,<param>=<val>
+Params: int_pin                 GPIO used for INT (default 25)
+
+        speed                   SPI bus speed (default 12000000)
+
+
+Name:   enc28j60-spi2
+Info:   Overlay for the Microchip ENC28J60 Ethernet Controller on SPI2
+Load:   dtoverlay=enc28j60-spi2,<param>=<val>
+Params: int_pin                 GPIO used for INT (default 39)
+
+        speed                   SPI bus speed (default 12000000)
+
+
+Name:   exc3000
+Info:   Enables I2C connected EETI EXC3000 multiple touch controller using
+        GPIO 4 (pin 7 on GPIO header) for interrupt.
+Load:   dtoverlay=exc3000,<param>=<val>
+Params: interrupt               GPIO used for interrupt (default 4)
+        sizex                   Touchscreen size x (default 4096)
+        sizey                   Touchscreen size y (default 4096)
+        invx                    Touchscreen inverted x axis
+        invy                    Touchscreen inverted y axis
+        swapxy                  Touchscreen swapped x y axis
+
+
+Name:   fe-pi-audio
+Info:   Configures the Fe-Pi Audio Sound Card
+Load:   dtoverlay=fe-pi-audio
+Params: <None>
+
+
+Name:   goodix
+Info:   Enables I2C connected Goodix gt9271 multiple touch controller using
+        GPIOs 4 and 17 (pins 7 and 11 on GPIO header) for interrupt and reset.
+Load:   dtoverlay=goodix,<param>=<val>
+Params: interrupt               GPIO used for interrupt (default 4)
+        reset                   GPIO used for reset (default 17)
+
+
+Name:   googlevoicehat-soundcard
+Info:   Configures the Google voiceHAT soundcard
+Load:   dtoverlay=googlevoicehat-soundcard
+Params: <None>
+
+
+Name:   gpio-ir
+Info:   Use GPIO pin as rc-core style infrared receiver input. The rc-core-
+        based gpio_ir_recv driver maps received keys directly to a
+        /dev/input/event* device, all decoding is done by the kernel - LIRC is
+        not required! The key mapping and other decoding parameters can be
+        configured by "ir-keytable" tool.
+Load:   dtoverlay=gpio-ir,<param>=<val>
+Params: gpio_pin                Input pin number. Default is 18.
+
+        gpio_pull               Desired pull-up/down state (off, down, up)
+                                Default is "down".
+
+        rc-map-name             Default rc keymap (can also be changed by
+                                ir-keytable), defaults to "rc-rc6-mce"
+
+
+Name:   gpio-ir-tx
+Info:   Use GPIO pin as bit-banged infrared transmitter output.
+        This is an alternative to "pwm-ir-tx". gpio-ir-tx doesn't require
+        a PWM so it can be used together with onboard analog audio.
+Load:   dtoverlay=gpio-ir-tx,<param>=<val>
+Params: gpio_pin                Output GPIO (default 18)
+
+        invert                  "1" = invert the output (make it active-low).
+                                Default is "0" (active-high).
+
+
+Name:   gpio-key
+Info:   This is a generic overlay for activating GPIO keypresses using
+        the gpio-keys library and this dtoverlay. Multiple keys can be
+        set up using multiple calls to the overlay for configuring
+        additional buttons or joysticks. You can see available keycodes
+        at https://github.com/torvalds/linux/blob/v4.12/include/uapi/
+        linux/input-event-codes.h#L64
+Load:   dtoverlay=gpio-key,<param>=<val>
+Params: gpio                    GPIO pin to trigger on (default 3)
+        active_low              When this is 1 (active low), a falling
+                                edge generates a key down event and a
+                                rising edge generates a key up event.
+                                When this is 0 (active high), this is
+                                reversed. The default is 1 (active low)
+        gpio_pull               Desired pull-up/down state (off, down, up)
+                                Default is "up". Note that the default pin
+                                (GPIO3) has an external pullup
+        label                   Set a label for the key
+        keycode                 Set the key code for the button
+
+
+Name:   gpio-poweroff
+Info:   Drives a GPIO high or low on poweroff (including halt). Enabling this
+        overlay will prevent the ability to boot by driving GPIO3 low.
+Load:   dtoverlay=gpio-poweroff,<param>=<val>
+Params: gpiopin                 GPIO for signalling (default 26)
+
+        active_low              Set if the power control device requires a
+                                high->low transition to trigger a power-down.
+                                Note that this will require the support of a
+                                custom dt-blob.bin to prevent a power-down
+                                during the boot process, and that a reboot
+                                will also cause the pin to go low.
+        input                   Set if the gpio pin should be configured as
+                                an input.
+        export                  Set to export the configured pin to sysfs
+
+
+Name:   gpio-shutdown
+Info:   Initiates a shutdown when GPIO pin changes. The given GPIO pin
+        is configured as an input key that generates KEY_POWER events.
+        This event is handled by systemd-logind by initiating a
+        shutdown. Systemd versions older than 225 need an udev rule
+        enable listening to the input device:
+
+                ACTION!="REMOVE", SUBSYSTEM=="input", KERNEL=="event*", \
+                        SUBSYSTEMS=="platform", DRIVERS=="gpio-keys", \
+                        ATTRS{keys}=="116", TAG+="power-switch"
+
+        This overlay only handles shutdown. After shutdown, the system
+        can be powered up again by driving GPIO3 low. The default
+        configuration uses GPIO3 with a pullup, so if you connect a
+        button between GPIO3 and GND (pin 5 and 6 on the 40-pin header),
+        you get a shutdown and power-up button.
+Load:   dtoverlay=gpio-shutdown,<param>=<val>
+Params: gpio_pin                GPIO pin to trigger on (default 3)
+
+        active_low              When this is 1 (active low), a falling
+                                edge generates a key down event and a
+                                rising edge generates a key up event.
+                                When this is 0 (active high), this is
+                                reversed. The default is 1 (active low).
+
+        gpio_pull               Desired pull-up/down state (off, down, up)
+                                Default is "up".
+
+                                Note that the default pin (GPIO3) has an
+                                external pullup.
+
+
+Name:   hifiberry-amp
+Info:   Configures the HifiBerry Amp and Amp+ audio cards
+Load:   dtoverlay=hifiberry-amp
+Params: <None>
+
+
+Name:   hifiberry-dac
+Info:   Configures the HifiBerry DAC audio card
+Load:   dtoverlay=hifiberry-dac
+Params: <None>
+
+
+Name:   hifiberry-dacplus
+Info:   Configures the HifiBerry DAC+ audio card
+Load:   dtoverlay=hifiberry-dacplus,<param>=<val>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control. Enable with
+                                "dtoverlay=hifiberry-dacplus,24db_digital_gain"
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24dB_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+        slave                   Force DAC+ Pro into slave mode, using Pi as
+                                master for bit clock and frame clock.
+
+
+Name:   hifiberry-digi
+Info:   Configures the HifiBerry Digi and Digi+ audio card
+Load:   dtoverlay=hifiberry-digi
+Params: <None>
+
+
+Name:   hifiberry-digi-pro
+Info:   Configures the HifiBerry Digi+ Pro audio card
+Load:   dtoverlay=hifiberry-digi-pro
+Params: <None>
+
+
+Name:   hy28a
+Info:   HY28A - 2.8" TFT LCD Display Module by HAOYU Electronics
+        Default values match Texy's display shield
+Load:   dtoverlay=hy28a,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+        xohms                   Touchpanel sensitivity (X-plate resistance)
+
+        resetgpio               GPIO used to reset controller
+
+        ledgpio                 GPIO used to control backlight
+
+
+Name:   hy28b
+Info:   HY28B - 2.8" TFT LCD Display Module by HAOYU Electronics
+        Default values match Texy's display shield
+Load:   dtoverlay=hy28b,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+        xohms                   Touchpanel sensitivity (X-plate resistance)
+
+        resetgpio               GPIO used to reset controller
+
+        ledgpio                 GPIO used to control backlight
+
+
+Name:   i2c-bcm2708
+Info:   Fall back to the i2c_bcm2708 driver for the i2c_arm bus.
+Load:   dtoverlay=i2c-bcm2708
+Params: <None>
+
+
+Name:   i2c-gpio
+Info:   Adds support for software i2c controller on gpio pins
+Load:   dtoverlay=i2c-gpio,<param>=<val>
+Params: i2c_gpio_sda            GPIO used for I2C data (default "23")
+
+        i2c_gpio_scl            GPIO used for I2C clock (default "24")
+
+        i2c_gpio_delay_us       Clock delay in microseconds
+                                (default "2" = ~100kHz)
+
+        bus                     Set to a unique, non-zero value if wanting
+                                multiple i2c-gpio busses. If set, will be used
+                                as the preferred bus number (/dev/i2c-<n>). If
+                                not set, the default value is 0, but the bus
+                                number will be dynamically assigned - probably
+                                3.
+
+
+Name:   i2c-mux
+Info:   Adds support for a number of I2C bus multiplexers on i2c_arm
+Load:   dtoverlay=i2c-mux,<param>=<val>
+Params: pca9542                 Select the NXP PCA9542 device
+
+        pca9545                 Select the NXP PCA9545 device
+
+        pca9548                 Select the NXP PCA9548 device
+
+        addr                    Change I2C address of the device (default 0x70)
+
+
+[ The i2c-mux-pca9548a overlay has been deleted. See i2c-mux. ]
+
+
+Name:   i2c-pwm-pca9685a
+Info:   Adds support for an NXP PCA9685A I2C PWM controller on i2c_arm
+Load:   dtoverlay=i2c-pwm-pca9685a,<param>=<val>
+Params: addr                    I2C address of PCA9685A (default 0x40)
+
+
+Name:   i2c-rtc
+Info:   Adds support for a number of I2C Real Time Clock devices
+Load:   dtoverlay=i2c-rtc,<param>=<val>
+Params: abx80x                  Select one of the ABx80x family:
+                                  AB0801, AB0803, AB0804, AB0805,
+                                  AB1801, AB1803, AB1804, AB1805
+
+        ds1307                  Select the DS1307 device
+
+        ds1339                  Select the DS1339 device
+
+        ds3231                  Select the DS3231 device
+
+        m41t62                  Select the M41T62 device
+
+        mcp7940x                Select the MCP7940x device
+
+        mcp7941x                Select the MCP7941x device
+
+        pcf2127                 Select the PCF2127 device
+
+        pcf8523                 Select the PCF8523 device
+
+        pcf8563                 Select the PCF8563 device
+
+        trickle-diode-type      Diode type for trickle charge - "standard" or
+                                "schottky" (ABx80x only)
+
+        trickle-resistor-ohms   Resistor value for trickle charge (DS1339,
+                                ABx80x)
+
+        wakeup-source           Specify that the RTC can be used as a wakeup
+                                source
+
+
+Name:   i2c-rtc-gpio
+Info:   Adds support for a number of I2C Real Time Clock devices
+        using the software i2c controller
+Load:   dtoverlay=i2c-rtc-gpio,<param>=<val>
+Params: abx80x                  Select one of the ABx80x family:
+                                  AB0801, AB0803, AB0804, AB0805,
+                                  AB1801, AB1803, AB1804, AB1805
+
+        ds1307                  Select the DS1307 device
+
+        ds1339                  Select the DS1339 device
+
+        ds3231                  Select the DS3231 device
+
+        mcp7940x                Select the MCP7940x device
+
+        mcp7941x                Select the MCP7941x device
+
+        pcf2127                 Select the PCF2127 device
+
+        pcf8523                 Select the PCF8523 device
+
+        pcf8563                 Select the PCF8563 device
+
+        trickle-diode-type      Diode type for trickle charge - "standard" or
+                                "schottky" (ABx80x only)
+
+        trickle-resistor-ohms   Resistor value for trickle charge (DS1339,
+                                ABx80x)
+
+        wakeup-source           Specify that the RTC can be used as a wakeup
+                                source
+
+        i2c_gpio_sda            GPIO used for I2C data (default "23")
+
+        i2c_gpio_scl            GPIO used for I2C clock (default "24")
+
+        i2c_gpio_delay_us       Clock delay in microseconds
+                                (default "2" = ~100kHz)
+
+
+Name:   i2c-sensor
+Info:   Adds support for a number of I2C barometric pressure and temperature
+        sensors on i2c_arm
+Load:   dtoverlay=i2c-sensor,<param>=<val>
+Params: addr                    Set the address for the BME280, BMP280, DS1621,
+                                HDC100X, LM75, SHT3x or TMP102
+
+        bme280                  Select the Bosch Sensortronic BME280
+                                Valid addresses 0x76-0x77, default 0x76
+
+        bmp085                  Select the Bosch Sensortronic BMP085
+
+        bmp180                  Select the Bosch Sensortronic BMP180
+
+        bmp280                  Select the Bosch Sensortronic BMP280
+                                Valid addresses 0x76-0x77, default 0x76
+
+        ds1621                  Select the Dallas Semiconductors DS1621 temp
+                                sensor. Valid addresses 0x48-0x4f, default 0x48
+
+        hdc100x                 Select the Texas Instruments HDC100x temp sensor
+                                Valid addresses 0x40-0x43, default 0x40
+
+        htu21                   Select the HTU21 temperature and humidity sensor
+
+        lm75                    Select the Maxim LM75 temperature sensor
+                                Valid addresses 0x48-0x4f, default 0x4f
+
+        lm75addr                Deprecated - use addr parameter instead
+
+        sht3x                   Select the Sensiron SHT3x temperature and
+                                humidity sensor. Valid addresses 0x44-0x45,
+                                default 0x44
+
+        si7020                  Select the Silicon Labs Si7013/20/21 humidity/
+                                temperature sensor
+
+        tmp102                  Select the Texas Instruments TMP102 temp sensor
+                                Valid addresses 0x48-0x4b, default 0x48
+
+        tsl4531                 Select the AMS TSL4531 digital ambient light
+                                sensor
+
+        veml6070                Select the Vishay VEML6070 ultraviolet light
+                                sensor
+
+
+Name:   i2c0-bcm2708
+Info:   Change i2c0 pin usage. Not all pin combinations are usable on all
+        platforms - platforms other then Compute Modules can only use this
+        to disable transaction combining.
+Load:   dtoverlay=i2c0-bcm2708,<param>=<val>
+Params: sda0_pin                GPIO pin for SDA0 (deprecated - use pins_*)
+        scl0_pin                GPIO pin for SCL0 (deprecated - use pins_*)
+        pins_0_1                Use pins 0 and 1 (default)
+        pins_28_29              Use pins 28 and 29
+        pins_44_45              Use pins 44 and 45
+        pins_46_47              Use pins 46 and 47
+        combine                 Allow transactions to be combined (default
+                                "yes")
+
+
+Name:   i2c1-bcm2708
+Info:   Change i2c1 pin usage. Not all pin combinations are usable on all
+        platforms - platforms other then Compute Modules can only use this
+        to disable transaction combining.
+Info:   Enable the i2c_bcm2708 driver for the i2c1 bus
+Load:   dtoverlay=i2c1-bcm2708,<param>=<val>
+Params: sda1_pin                GPIO pin for SDA1 (2 or 44 - default 2)
+        scl1_pin                GPIO pin for SCL1 (3 or 45 - default 3)
+        pin_func                Alternative pin function (4 (alt0), 6 (alt2) -
+                                default 4)
+        combine                 Allow transactions to be combined (default
+                                "yes")
+
+
+Name:   i2s-gpio28-31
+Info:   move I2S function block to GPIO 28 to 31
+Load:   dtoverlay=i2s-gpio28-31
+Params: <None>
+
+
+Name:   iqaudio-dac
+Info:   Configures the IQaudio DAC audio card
+Load:   dtoverlay=iqaudio-dac,<param>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control. Enable with
+                                "dtoverlay=iqaudio-dac,24db_digital_gain"
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24db_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+
+
+Name:   iqaudio-dacplus
+Info:   Configures the IQaudio DAC+ audio card
+Load:   dtoverlay=iqaudio-dacplus,<param>=<val>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control. Enable with
+                                "dtoverlay=iqaudio-dacplus,24db_digital_gain"
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24db_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+        auto_mute_amp           If specified, unmute/mute the IQaudIO amp when
+                                starting/stopping audio playback.
+        unmute_amp              If specified, unmute the IQaudIO amp once when
+                                the DAC driver module loads.
+
+
+Name:   iqaudio-digi-wm8804-audio
+Info:   Configures the IQAudIO Digi WM8804 audio card
+Load:   dtoverlay=iqaudio-digi-wm8804-audio,<param>=<val>
+Params: card_name               Override the default, "IQAudIODigi", card name.
+        dai_name                Override the default, "IQAudIO Digi", dai name.
+        dai_stream_name         Override the default, "IQAudIO Digi HiFi",
+                                dai stream name.
+
+
+Name:   jedec-spi-nor
+Info:   Adds support for JEDEC-compliant SPI NOR flash devices.  (Note: The
+        "jedec,spi-nor" kernel driver was formerly known as "m25p80".)
+Load:   dtoverlay=jedec-spi-nor,<param>=<val>
+Params: flash-spi<n>-<m>        Enables flash device on SPI<n>, CS#<m>.
+        flash-fastr-spi<n>-<m>  Enables flash device with fast read capability
+                                on SPI<n>, CS#<m>.
+
+
+Name:   justboom-dac
+Info:   Configures the JustBoom DAC HAT, Amp HAT, DAC Zero and Amp Zero audio
+        cards
+Load:   dtoverlay=justboom-dac,<param>=<val>
+Params: 24db_digital_gain       Allow gain to be applied via the PCM512x codec
+                                Digital volume control. Enable with
+                                "dtoverlay=justboom-dac,24db_digital_gain"
+                                (The default behaviour is that the Digital
+                                volume control is limited to a maximum of
+                                0dB. ie. it can attenuate but not provide
+                                gain. For most users, this will be desired
+                                as it will prevent clipping. By appending
+                                the 24dB_digital_gain parameter, the Digital
+                                volume control will allow up to 24dB of
+                                gain. If this parameter is enabled, it is the
+                                responsibility of the user to ensure that
+                                the Digital volume control is set to a value
+                                that does not result in clipping/distortion!)
+
+
+Name:   justboom-digi
+Info:   Configures the JustBoom Digi HAT and Digi Zero audio cards
+Load:   dtoverlay=justboom-digi
+Params: <None>
+
+
+Name:   lirc-rpi
+Info:   Configures lirc-rpi (Linux Infrared Remote Control for Raspberry Pi)
+        Consult the module documentation for more details.
+Load:   dtoverlay=lirc-rpi,<param>=<val>
+Params: gpio_out_pin            GPIO for output (default "17")
+
+        gpio_in_pin             GPIO for input (default "18")
+
+        gpio_in_pull            Pull up/down/off on the input pin
+                                (default "down")
+
+        sense                   Override the IR receive auto-detection logic:
+                                 "0" = force active-high
+                                 "1" = force active-low
+                                 "-1" = use auto-detection
+                                (default "-1")
+
+        softcarrier             Turn the software carrier "on" or "off"
+                                (default "on")
+
+        invert                  "on" = invert the output pin (default "off")
+
+        debug                   "on" = enable additional debug messages
+                                (default "off")
+
+
+Name:   ltc294x
+Info:   Adds support for the ltc294x family of battery gauges
+Load:   dtoverlay=ltc294x,<param>=<val>
+Params: ltc2941                 Select the ltc2941 device
+
+        ltc2942                 Select the ltc2942 device
+
+        ltc2943                 Select the ltc2943 device
+
+        ltc2944                 Select the ltc2944 device
+
+        resistor-sense          The sense resistor value in milli-ohms.
+                                Can be a 32-bit negative value when the battery
+                                has been connected to the wrong end of the
+                                resistor.
+
+        prescaler-exponent      Range and accuracy of the gauge. The value is
+                                programmed into the chip only if it differs
+                                from the current setting.
+                                For LTC2941 only:
+                                - Default value is 128
+                                - the exponent is in the range 0-7 (default 7)
+                                See the datasheet for more information.
+
+
+Name:   mbed-dac
+Info:   Configures the mbed AudioCODEC (TLV320AIC23B)
+Load:   dtoverlay=mbed-dac
+Params: <None>
+
+
+Name:   mcp23017
+Info:   Configures the MCP23017 I2C GPIO expander
+Load:   dtoverlay=mcp23017,<param>=<val>
+Params: gpiopin                 Gpio pin connected to the INTA output of the
+                                MCP23017 (default: 4)
+
+        addr                    I2C address of the MCP23017 (default: 0x20)
+
+
+Name:   mcp23s17
+Info:   Configures the MCP23S08/17 SPI GPIO expanders.
+        If devices are present on SPI1 or SPI2, those interfaces must be enabled
+        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
+        If interrupts are enabled for a device on a given CS# on a SPI bus, that
+        device must be the only one present on that SPI bus/CS#.
+Load:   dtoverlay=mcp23s17,<param>=<val>
+Params: s08-spi<n>-<m>-present  4-bit integer, bitmap indicating MCP23S08
+                                devices present on SPI<n>, CS#<m>
+
+        s17-spi<n>-<m>-present  8-bit integer, bitmap indicating MCP23S17
+                                devices present on SPI<n>, CS#<m>
+
+        s08-spi<n>-<m>-int-gpio integer, enables interrupts on a single
+                                MCP23S08 device on SPI<n>, CS#<m>, specifies
+                                the GPIO pin to which INT output of MCP23S08
+                                is connected.
+
+        s17-spi<n>-<m>-int-gpio integer, enables mirrored interrupts on a
+                                single MCP23S17 device on SPI<n>, CS#<m>,
+                                specifies the GPIO pin to which either INTA
+                                or INTB output of MCP23S17 is connected.
+
+
+Name:   mcp2515-can0
+Info:   Configures the MCP2515 CAN controller on spi0.0
+Load:   dtoverlay=mcp2515-can0,<param>=<val>
+Params: oscillator              Clock frequency for the CAN controller (Hz)
+
+        spimaxfrequency         Maximum SPI frequence (Hz)
+
+        interrupt               GPIO for interrupt signal
+
+
+Name:   mcp2515-can1
+Info:   Configures the MCP2515 CAN controller on spi0.1
+Load:   dtoverlay=mcp2515-can1,<param>=<val>
+Params: oscillator              Clock frequency for the CAN controller (Hz)
+
+        spimaxfrequency         Maximum SPI frequence (Hz)
+
+        interrupt               GPIO for interrupt signal
+
+
+Name:   mcp3008
+Info:   Configures MCP3008 A/D converters
+        For devices on spi1 or spi2, the interfaces should be enabled
+        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
+Load:   dtoverlay=mcp3008,<param>[=<val>]
+Params: spi<n>-<m>-present      boolean, configure device at spi<n>, cs<m>
+        spi<n>-<m>-speed        integer, set the spi bus speed for this device
+
+
+Name:   mcp3202
+Info:   Configures MCP3202 A/D converters
+        For devices on spi1 or spi2, the interfaces should be enabled
+        with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
+Load:   dtoverlay=mcp3202,<param>[=<val>]
+Params: spi<n>-<m>-present      boolean, configure device at spi<n>, cs<m>
+        spi<n>-<m>-speed        integer, set the spi bus speed for this device
+
+
+Name:   media-center
+Info:   Media Center HAT - 2.83" Touch Display + extras by Pi Supply
+Load:   dtoverlay=media-center,<param>=<val>
+Params: speed                   Display SPI bus speed
+        rotate                  Display rotation {0,90,180,270}
+        fps                     Delay between frame updates
+        xohms                   Touchpanel sensitivity (X-plate resistance)
+        swapxy                  Swap x and y axis
+        backlight               Change backlight GPIO pin {e.g. 12, 18}
+        gpio_out_pin            GPIO for output (default "17")
+        gpio_in_pin             GPIO for input (default "18")
+        gpio_in_pull            Pull up/down/off on the input pin
+                                (default "down")
+        sense                   Override the IR receive auto-detection logic:
+                                 "0" = force active-high
+                                 "1" = force active-low
+                                 "-1" = use auto-detection
+                                (default "-1")
+        softcarrier             Turn the software carrier "on" or "off"
+                                (default "on")
+        invert                  "on" = invert the output pin (default "off")
+        debug                   "on" = enable additional debug messages
+                                (default "off")
+
+
+Name:   midi-uart0
+Info:   Configures UART0 (ttyAMA0) so that a requested 38.4kbaud actually gets
+        31.25kbaud, the frequency required for MIDI
+Load:   dtoverlay=midi-uart0
+Params: <None>
+
+
+Name:   midi-uart1
+Info:   Configures UART1 (ttyS0) so that a requested 38.4kbaud actually gets
+        31.25kbaud, the frequency required for MIDI
+Load:   dtoverlay=midi-uart1
+Params: <None>
+
+
+Name:   mmc
+Info:   Selects the bcm2835-mmc SD/MMC driver, optionally with overclock
+Load:   dtoverlay=mmc,<param>=<val>
+Params: overclock_50            Clock (in MHz) to use when the MMC framework
+                                requests 50MHz
+
+
+Name:   mpu6050
+Info:   Overlay for i2c connected mpu6050 imu
+Load:   dtoverlay=mpu6050,<param>=<val>
+Params: interrupt               GPIO pin for interrupt (default 4)
+
+
+Name:   mz61581
+Info:   MZ61581 display by Tontec
+Load:   dtoverlay=mz61581,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        txbuflen                Transmit buffer length (default 32768)
+
+        debug                   Debug output level {0-7}
+
+        xohms                   Touchpanel sensitivity (X-plate resistance)
+
+
+Name:   papirus
+Info:   PaPiRus ePaper Screen by Pi Supply (both HAT and pHAT)
+Load:   dtoverlay=papirus,<param>=<val>
+Params: panel                   Display panel (required):
+                                1.44": e1144cs021
+                                2.0":  e2200cs021
+                                2.7":  e2271cs021
+
+        speed                   Display SPI bus speed
+
+
+[ The pcf2127-rtc overlay has been deleted. See i2c-rtc. ]
+
+
+[ The pcf8523-rtc overlay has been deleted. See i2c-rtc. ]
+
+
+[ The pcf8563-rtc overlay has been deleted. See i2c-rtc. ]
+
+
+Name:   pi3-act-led
+Info:   Pi3 uses a GPIO expander to drive the LEDs which can only be accessed
+        from the VPU. There is a special driver for this with a separate DT
+        node, which has the unfortunate consequence of breaking the
+        act_led_gpio and act_led_activelow dtparams.
+        This overlay changes the GPIO controller back to the standard one and
+        restores the dtparams.
+Load:   dtoverlay=pi3-act-led,<param>=<val>
+Params: activelow               Set to "on" to invert the sense of the LED
+                                (default "off")
+
+        gpio                    Set which GPIO to use for the activity LED
+                                (in case you want to connect it to an external
+                                device)
+                                REQUIRED
+
+
+Name:   pi3-disable-bt
+Info:   Disable Pi3 Bluetooth and restore UART0/ttyAMA0 over GPIOs 14 & 15
+        N.B. To disable the systemd service that initialises the modem so it
+        doesn't use the UART, use 'sudo systemctl disable hciuart'.
+Load:   dtoverlay=pi3-disable-bt
+Params: <None>
+
+
+Name:   pi3-disable-wifi
+Info:   Disable Pi3 onboard WiFi
+Load:   dtoverlay=pi3-disable-wifi
+Params: <None>
+
+
+Name:   pi3-miniuart-bt
+Info:   Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore
+        UART0/ttyAMA0 over GPIOs 14 & 15. Note that this may reduce the maximum
+        usable baudrate.
+        N.B. It is also necessary to edit /lib/systemd/system/hciuart.service
+        and replace ttyAMA0 with ttyS0, unless you have a system with udev rules
+        that create /dev/serial0 and /dev/serial1, in which case use
+        /dev/serial1 instead because it will always be correct. Furthermore,
+        you must also set core_freq=250 in config.txt or the miniuart will not
+        work.
+Load:   dtoverlay=pi3-miniuart-bt
+Params: <None>
+
+
+Name:   pibell
+Info:   Configures the pibell audio card.
+Load:   dtoverlay=pibell,<param>=<val>
+Params: alsaname                Set the name as it appears in ALSA (default
+                                "PiBell")
+
+
+Name:   piscreen
+Info:   PiScreen display by OzzMaker.com
+Load:   dtoverlay=piscreen,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+        xohms                   Touchpanel sensitivity (X-plate resistance)
+
+
+Name:   piscreen2r
+Info:   PiScreen 2 with resistive TP display by OzzMaker.com
+Load:   dtoverlay=piscreen2r,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+        xohms                   Touchpanel sensitivity (X-plate resistance)
+
+
+Name:   pisound
+Info:   Configures the Blokas Labs pisound card
+Load:   dtoverlay=pisound
+Params: <None>
+
+
+Name:   pitft22
+Info:   Adafruit PiTFT 2.2" screen
+Load:   dtoverlay=pitft22,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+
+Name:   pitft28-capacitive
+Info:   Adafruit PiTFT 2.8" capacitive touch screen
+Load:   dtoverlay=pitft28-capacitive,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+        touch-sizex             Touchscreen size x (default 240)
+
+        touch-sizey             Touchscreen size y (default 320)
+
+        touch-invx              Touchscreen inverted x axis
+
+        touch-invy              Touchscreen inverted y axis
+
+        touch-swapxy            Touchscreen swapped x y axis
+
+
+Name:   pitft28-resistive
+Info:   Adafruit PiTFT 2.8" resistive touch screen
+Load:   dtoverlay=pitft28-resistive,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+
+Name:   pitft35-resistive
+Info:   Adafruit PiTFT 3.5" resistive touch screen
+Load:   dtoverlay=pitft35-resistive,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+
+Name:   pps-gpio
+Info:   Configures the pps-gpio (pulse-per-second time signal via GPIO).
+Load:   dtoverlay=pps-gpio,<param>=<val>
+Params: gpiopin                 Input GPIO (default "18")
+        assert_falling_edge     When present, assert is indicated by a falling
+                                edge, rather than by a rising edge (default
+                                off)
+        capture_clear           Generate clear events on the trailing edge
+                                (default off)
+
+
+Name:   pwm
+Info:   Configures a single PWM channel
+        Legal pin,function combinations for each channel:
+          PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0)            52,5(Alt1)
+          PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
+        N.B.:
+          1) Pin 18 is the only one available on all platforms, and
+             it is the one used by the I2S audio interface.
+             Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
+          2) The onboard analogue audio output uses both PWM channels.
+          3) So be careful mixing audio and PWM.
+          4) Currently the clock must have been enabled and configured
+             by other means.
+Load:   dtoverlay=pwm,<param>=<val>
+Params: pin                     Output pin (default 18) - see table
+        func                    Pin function (default 2 = Alt5) - see above
+        clock                   PWM clock frequency (informational)
+
+
+Name:   pwm-2chan
+Info:   Configures both PWM channels
+        Legal pin,function combinations for each channel:
+          PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0)            52,5(Alt1)
+          PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
+        N.B.:
+          1) Pin 18 is the only one available on all platforms, and
+             it is the one used by the I2S audio interface.
+             Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
+          2) The onboard analogue audio output uses both PWM channels.
+          3) So be careful mixing audio and PWM.
+          4) Currently the clock must have been enabled and configured
+             by other means.
+Load:   dtoverlay=pwm-2chan,<param>=<val>
+Params: pin                     Output pin (default 18) - see table
+        pin2                    Output pin for other channel (default 19)
+        func                    Pin function (default 2 = Alt5) - see above
+        func2                   Function for pin2 (default 2 = Alt5)
+        clock                   PWM clock frequency (informational)
+
+
+Name:   pwm-ir-tx
+Info:   Use GPIO pin as pwm-assisted infrared transmitter output.
+        This is an alternative to "gpio-ir-tx". pwm-ir-tx makes use
+        of PWM0 to reduce the CPU load during transmission compared to
+        gpio-ir-tx which uses bit-banging.
+        Legal pin,function combinations are:
+          12,4(Alt0) 18,2(Alt5) 40,4(Alt0) 52,5(Alt1)
+Load:   dtoverlay=pwm-ir-tx,<param>=<val>
+Params: gpio_pin                Output GPIO (default 18)
+
+        func                    Pin function (default 2 = Alt5)
+
+
+Name:   qca7000
+Info:   I2SE's Evaluation Board for PLC Stamp micro
+Load:   dtoverlay=qca7000,<param>=<val>
+Params: int_pin                 GPIO pin for interrupt signal (default 23)
+
+        speed                   SPI bus speed (default 12 MHz)
+
+
+Name:   rotary-encoder
+Info:   Overlay for GPIO connected rotary encoder.
+Load:   dtoverlay=rotary-encoder,<param>=<val>
+Params: pin_a                   GPIO connected to rotary encoder channel A
+                                (default 4).
+        pin_b                   GPIO connected to rotary encoder channel B
+                                (default 17).
+        relative_axis           register a relative axis rather than an
+                                absolute one. Relative axis will only
+                                generate +1/-1 events on the input device,
+                                hence no steps need to be passed.
+        linux_axis              the input subsystem axis to map to this
+                                rotary encoder. Defaults to 0 (ABS_X / REL_X)
+        rollover                Automatic rollover when the rotary value
+                                becomes greater than the specified steps or
+                                smaller than 0. For absolute axis only.
+        steps-per-period        Number of steps (stable states) per period.
+                                The values have the following meaning:
+                                1: Full-period mode (default)
+                                2: Half-period mode
+                                4: Quarter-period mode
+        steps                   Number of steps in a full turnaround of the
+                                encoder. Only relevant for absolute axis.
+                                Defaults to 24 which is a typical value for
+                                such devices.
+        wakeup                  Boolean, rotary encoder can wake up the
+                                system.
+        encoding                String, the method used to encode steps.
+                                Supported are "gray" (the default and more
+                                common) and "binary".
+
+
+Name:   rpi-backlight
+Info:   Raspberry Pi official display backlight driver
+Load:   dtoverlay=rpi-backlight
+Params: <None>
+
+
+Name:   rpi-cirrus-wm5102
+Info:   Configures the Cirrus Logic Audio Card
+Load:   dtoverlay=rpi-cirrus-wm5102
+Params: <None>
+
+
+Name:   rpi-dac
+Info:   Configures the RPi DAC audio card
+Load:   dtoverlay=rpi-dac
+Params: <None>
+
+
+Name:   rpi-display
+Info:   RPi-Display - 2.8" Touch Display by Watterott
+Load:   dtoverlay=rpi-display,<param>=<val>
+Params: speed                   Display SPI bus speed
+        rotate                  Display rotation {0,90,180,270}
+        fps                     Delay between frame updates
+        debug                   Debug output level {0-7}
+        xohms                   Touchpanel sensitivity (X-plate resistance)
+        swapxy                  Swap x and y axis
+        backlight               Change backlight GPIO pin {e.g. 12, 18}
+
+
+Name:   rpi-ft5406
+Info:   Official Raspberry Pi display touchscreen
+Load:   dtoverlay=rpi-ft5406,<param>=<val>
+Params: touchscreen-size-x      Touchscreen X resolution (default 800)
+        touchscreen-size-y      Touchscreen Y resolution (default 600);
+        touchscreen-inverted-x  Invert touchscreen X coordinates (default 0);
+        touchscreen-inverted-y  Invert touchscreen Y coordinates (default 0);
+        touchscreen-swapped-x-y Swap X and Y cordinates (default 0);
+
+
+Name:   rpi-proto
+Info:   Configures the RPi Proto audio card
+Load:   dtoverlay=rpi-proto
+Params: <None>
+
+
+Name:   rpi-sense
+Info:   Raspberry Pi Sense HAT
+Load:   dtoverlay=rpi-sense
+Params: <None>
+
+
+Name:   rpi-tv
+Info:   Raspberry Pi TV HAT
+Load:   dtoverlay=rpi-tv
+Params: <None>
+
+
+Name:   rra-digidac1-wm8741-audio
+Info:   Configures the Red Rocks Audio DigiDAC1 soundcard
+Load:   dtoverlay=rra-digidac1-wm8741-audio
+Params: <None>
+
+
+Name:   sc16is750-i2c
+Info:   Overlay for the NXP SC16IS750 UART with I2C Interface
+        Enables the chip on I2C1 at 0x48 (or the "addr" parameter value). To
+        select another address, please refer to table 10 in reference manual.
+Load:   dtoverlay=sc16is750-i2c,<param>=<val>
+Params: int_pin                 GPIO used for IRQ (default 24)
+        addr                    Address (default 0x48)
+
+
+Name:   sc16is752-i2c
+Info:   Overlay for the NXP SC16IS752 dual UART with I2C Interface
+        Enables the chip on I2C1 at 0x48 (or the "addr" parameter value). To
+        select another address, please refer to table 10 in reference manual.
+Load:   dtoverlay=sc16is752-i2c,<param>=<val>
+Params: int_pin                 GPIO used for IRQ (default 24)
+        addr                    Address (default 0x48)
+        xtal                    On-board crystal frequency (default 14745600)
+
+
+Name:   sc16is752-spi1
+Info:   Overlay for the NXP SC16IS752 Dual UART with SPI Interface
+        Enables the chip on SPI1.
+        N.B.: spi1 is only accessible on devices with a 40pin header, eg:
+              A+, B+, Zero and PI2 B; as well as the Compute Module.
+
+Load:   dtoverlay=sc16is752-spi1,<param>=<val>
+Params: int_pin                 GPIO used for IRQ (default 24)
+
+
+Name:   sdhost
+Info:   Selects the bcm2835-sdhost SD/MMC driver, optionally with overclock.
+        N.B. This overlay is designed for situations where the mmc driver is
+        the default, so it disables the other (mmc) interface - this will kill
+        WiFi on a Pi3. If this isn't what you want, either use the sdtweak
+        overlay or the new sd_* dtparams of the base DTBs.
+Load:   dtoverlay=sdhost,<param>=<val>
+Params: overclock_50            Clock (in MHz) to use when the MMC framework
+                                requests 50MHz
+
+        force_pio               Disable DMA support (default off)
+
+        pio_limit               Number of blocks above which to use DMA
+                                (default 1)
+
+        debug                   Enable debug output (default off)
+
+
+Name:   sdio
+Info:   Selects the bcm2835-sdhost SD/MMC driver, optionally with overclock,
+        and enables SDIO via GPIOs 22-27.
+Load:   dtoverlay=sdio,<param>=<val>
+Params: sdio_overclock          SDIO Clock (in MHz) to use when the MMC
+                                framework requests 50MHz
+
+        poll_once               Disable SDIO-device polling every second
+                                (default on: polling once at boot-time)
+
+        bus_width               Set the SDIO host bus width (default 4 bits)
+
+
+Name:   sdio-1bit
+Info:   Selects the bcm2835-sdhost SD/MMC driver, optionally with overclock,
+        and enables 1-bit SDIO via GPIOs 22-25.
+Load:   dtoverlay=sdio-1bit,<param>=<val>
+Params: sdio_overclock          SDIO Clock (in MHz) to use when the MMC
+                                framework requests 50MHz
+
+        poll_once               Disable SDIO-device polling every second
+                                (default on: polling once at boot-time)
+
+
+Name:   sdtweak
+Info:   Tunes the bcm2835-sdhost SD/MMC driver
+        N.B. This functionality is now available via the sd_* dtparams in the
+        base DTB.
+Load:   dtoverlay=sdtweak,<param>=<val>
+Params: overclock_50            Clock (in MHz) to use when the MMC framework
+                                requests 50MHz
+
+        force_pio               Disable DMA support (default off)
+
+        pio_limit               Number of blocks above which to use DMA
+                                (default 1)
+
+        debug                   Enable debug output (default off)
+
+        poll_once               Looks for a card once after booting. Useful
+                                for network booting scenarios to avoid the
+                                overhead of continuous polling. N.B. Using
+                                this option restricts the system to using a
+                                single card per boot (or none at all).
+                                (default off)
+
+        enable                  Set to off to completely disable the interface
+                                (default on)
+
+
+Name:   smi
+Info:   Enables the Secondary Memory Interface peripheral. Uses GPIOs 2-25!
+Load:   dtoverlay=smi
+Params: <None>
+
+
+Name:   smi-dev
+Info:   Enables the userspace interface for the SMI driver
+Load:   dtoverlay=smi-dev
+Params: <None>
+
+
+Name:   smi-nand
+Info:   Enables access to NAND flash via the SMI interface
+Load:   dtoverlay=smi-nand
+Params: <None>
+
+
+Name:   spi-gpio35-39
+Info:   Move SPI function block to GPIO 35 to 39
+Load:   dtoverlay=spi-gpio35-39
+Params: <None>
+
+
+Name:   spi-rtc
+Info:   Adds support for a number of SPI Real Time Clock devices
+Load:   dtoverlay=spi-rtc,<param>=<val>
+Params: pcf2123                 Select the PCF2123 device
+
+
+Name:   spi0-cs
+Info:   Allows the (software) CS pins for SPI0 to be changed
+Load:   dtoverlay=spi0-cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 8)
+        cs1_pin                 GPIO pin for CS1 (default 7)
+
+
+Name:   spi0-hw-cs
+Info:   Re-enables hardware CS/CE (chip selects) for SPI0
+Load:   dtoverlay=spi0-hw-cs
+Params: <None>
+
+
+Name:   spi1-1cs
+Info:   Enables spi1 with a single chip select (CS) line and associated spidev
+        dev node. The gpio pin number for the CS line and spidev device node
+        creation are configurable.
+        N.B.: spi1 is only accessible on devices with a 40pin header, eg:
+              A+, B+, Zero and PI2 B; as well as the Compute Module.
+Load:   dtoverlay=spi1-1cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 18 - BCM SPI1_CE0).
+        cs0_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev1.0 (default
+                                is 'okay' or enabled).
+
+
+Name:   spi1-2cs
+Info:   Enables spi1 with two chip select (CS) lines and associated spidev
+        dev nodes. The gpio pin numbers for the CS lines and spidev device node
+        creation are configurable.
+        N.B.: spi1 is only accessible on devices with a 40pin header, eg:
+              A+, B+, Zero and PI2 B; as well as the Compute Module.
+Load:   dtoverlay=spi1-2cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 18 - BCM SPI1_CE0).
+        cs1_pin                 GPIO pin for CS1 (default 17 - BCM SPI1_CE1).
+        cs0_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev1.0 (default
+                                is 'okay' or enabled).
+        cs1_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev1.1 (default
+                                is 'okay' or enabled).
+
+
+Name:   spi1-3cs
+Info:   Enables spi1 with three chip select (CS) lines and associated spidev
+        dev nodes. The gpio pin numbers for the CS lines and spidev device node
+        creation are configurable.
+        N.B.: spi1 is only accessible on devices with a 40pin header, eg:
+              A+, B+, Zero and PI2 B; as well as the Compute Module.
+Load:   dtoverlay=spi1-3cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 18 - BCM SPI1_CE0).
+        cs1_pin                 GPIO pin for CS1 (default 17 - BCM SPI1_CE1).
+        cs2_pin                 GPIO pin for CS2 (default 16 - BCM SPI1_CE2).
+        cs0_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev1.0 (default
+                                is 'okay' or enabled).
+        cs1_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev1.1 (default
+                                is 'okay' or enabled).
+        cs2_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev1.2 (default
+                                is 'okay' or enabled).
+
+
+Name:   spi2-1cs
+Info:   Enables spi2 with a single chip select (CS) line and associated spidev
+        dev node. The gpio pin number for the CS line and spidev device node
+        creation are configurable.
+        N.B.: spi2 is only accessible with the Compute Module.
+Load:   dtoverlay=spi2-1cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 43 - BCM SPI2_CE0).
+        cs0_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev2.0 (default
+                                is 'okay' or enabled).
+
+
+Name:   spi2-2cs
+Info:   Enables spi2 with two chip select (CS) lines and associated spidev
+        dev nodes. The gpio pin numbers for the CS lines and spidev device node
+        creation are configurable.
+        N.B.: spi2 is only accessible with the Compute Module.
+Load:   dtoverlay=spi2-2cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 43 - BCM SPI2_CE0).
+        cs1_pin                 GPIO pin for CS1 (default 44 - BCM SPI2_CE1).
+        cs0_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev2.0 (default
+                                is 'okay' or enabled).
+        cs1_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev2.1 (default
+                                is 'okay' or enabled).
+
+
+Name:   spi2-3cs
+Info:   Enables spi2 with three chip select (CS) lines and associated spidev
+        dev nodes. The gpio pin numbers for the CS lines and spidev device node
+        creation are configurable.
+        N.B.: spi2 is only accessible with the Compute Module.
+Load:   dtoverlay=spi2-3cs,<param>=<val>
+Params: cs0_pin                 GPIO pin for CS0 (default 43 - BCM SPI2_CE0).
+        cs1_pin                 GPIO pin for CS1 (default 44 - BCM SPI2_CE1).
+        cs2_pin                 GPIO pin for CS2 (default 45 - BCM SPI2_CE2).
+        cs0_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev2.0 (default
+                                is 'okay' or enabled).
+        cs1_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev2.1 (default
+                                is 'okay' or enabled).
+        cs2_spidev              Set to 'disabled' to stop the creation of a
+                                userspace device node /dev/spidev2.2 (default
+                                is 'okay' or enabled).
+
+
+Name:   superaudioboard
+Info:   Configures the SuperAudioBoard sound card
+Load:   dtoverlay=superaudioboard,<param>=<val>
+Params: gpiopin                 GPIO pin for codec reset
+
+
+Name:   sx150x
+Info:   Configures the Semtech SX150X I2C GPIO expanders.
+Load:   dtoverlay=sx150x,<param>=<val>
+Params: sx150<x>-<n>-<m>        Enables SX150X device on I2C#<n> with slave
+                                address <m>. <x> may be 1-9. <n> may be 0 or 1.
+                                Permissible values of <m> (which is denoted in
+                                hex) depend on the device variant. For SX1501,
+                                SX1502, SX1504 and SX1505, <m> may be 20 or 21.
+                                For SX1503 and SX1506, <m> may be 20. For
+                                SX1507 and SX1509, <m> may be 3E, 3F, 70 or 71.
+                                For SX1508, <m> may be 20, 21, 22 or 23.
+
+        sx150<x>-<n>-<m>-int-gpio
+                                Integer, enables interrupts on SX150X device on
+                                I2C#<n> with slave address <m>, specifies
+                                the GPIO pin to which NINT output of SX150X is
+                                connected.
+
+
+Name:   tinylcd35
+Info:   3.5" Color TFT Display by www.tinylcd.com
+        Options: Touch, RTC, keypad
+Load:   dtoverlay=tinylcd35,<param>=<val>
+Params: speed                   Display SPI bus speed
+
+        rotate                  Display rotation {0,90,180,270}
+
+        fps                     Delay between frame updates
+
+        debug                   Debug output level {0-7}
+
+        touch                   Enable touch panel
+
+        touchgpio               Touch controller IRQ GPIO
+
+        xohms                   Touchpanel: Resistance of X-plate in ohms
+
+        rtc-pcf                 PCF8563 Real Time Clock
+
+        rtc-ds                  DS1307 Real Time Clock
+
+        keypad                  Enable keypad
+
+        Examples:
+            Display with touchpanel, PCF8563 RTC and keypad:
+                dtoverlay=tinylcd35,touch,rtc-pcf,keypad
+            Old touch display:
+                dtoverlay=tinylcd35,touch,touchgpio=3
+
+
+Name:   uart0
+Info:   Change the pin usage of uart0
+Load:   dtoverlay=uart0,<param>=<val>
+Params: txd0_pin                GPIO pin for TXD0 (14, 32 or 36 - default 14)
+
+        rxd0_pin                GPIO pin for RXD0 (15, 33 or 37 - default 15)
+
+        pin_func                Alternative pin function - 4(Alt0) for 14&15,
+                                7(Alt3) for 32&33, 6(Alt2) for 36&37
+
+
+Name:   uart1
+Info:   Change the pin usage of uart1
+Load:   dtoverlay=uart1,<param>=<val>
+Params: txd1_pin                GPIO pin for TXD1 (14, 32 or 40 - default 14)
+
+        rxd1_pin                GPIO pin for RXD1 (15, 33 or 41 - default 15)
+
+
+Name:   upstream
+Info:   Allow usage of downstream .dtb with upstream kernel. Comprises
+        vc4-kms-v3d, dwc2 and upstream-aux-interrupt overlays.
+Load:   dtoverlay=upstream
+Params: <None>
+
+
+Name:   upstream-aux-interrupt
+Info:   Allow usage of downstream .dtb with upstream kernel by binding AUX
+        devices directly to the shared AUX interrupt line. One of the parts
+        of the 'upstream' overlay
+Load:   dtoverlay=upstream-aux-interrupt
+Params: <None>
+
+
+Name:   vc4-fkms-v3d
+Info:   Enable Eric Anholt's DRM VC4 V3D driver on top of the dispmanx
+        display stack.
+Load:   dtoverlay=vc4-fkms-v3d,<param>
+Params: cma-256                 CMA is 256MB, 256MB-aligned (needs 1GB)
+        cma-192                 CMA is 192MB, 256MB-aligned (needs 1GB)
+        cma-128                 CMA is 128MB, 128MB-aligned
+        cma-96                  CMA is 96MB, 128MB-aligned
+        cma-64                  CMA is 64MB, 64MB-aligned
+
+
+Name:   vc4-kms-v3d
+Info:   Enable Eric Anholt's DRM VC4 HDMI/HVS/V3D driver. Running startx or
+        booting to GUI while this overlay is in use will cause interesting
+        lockups.
+Load:   dtoverlay=vc4-kms-v3d,<param>
+Params: cma-256                 CMA is 256MB, 256MB-aligned (needs 1GB)
+        cma-192                 CMA is 192MB, 256MB-aligned (needs 1GB)
+        cma-128                 CMA is 128MB, 128MB-aligned
+        cma-96                  CMA is 96MB, 128MB-aligned
+        cma-64                  CMA is 64MB, 64MB-aligned
+
+
+Name:   vga666
+Info:   Overlay for the Fen Logic VGA666 board
+        This uses GPIOs 2-21 (so no I2C), and activates the output 2-3 seconds
+        after the kernel has started.
+Load:   dtoverlay=vga666
+Params: <None>
+
+
+Name:   w1-gpio
+Info:   Configures the w1-gpio Onewire interface module.
+        Use this overlay if you *don't* need a GPIO to drive an external pullup.
+Load:   dtoverlay=w1-gpio,<param>=<val>
+Params: gpiopin                 GPIO for I/O (default "4")
+
+        pullup                  Non-zero, "on", or "y" to enable the parasitic
+                                power (2-wire, power-on-data) feature
+
+
+Name:   w1-gpio-pullup
+Info:   Configures the w1-gpio Onewire interface module.
+        Use this overlay if you *do* need a GPIO to drive an external pullup.
+Load:   dtoverlay=w1-gpio-pullup,<param>=<val>
+Params: gpiopin                 GPIO for I/O (default "4")
+
+        pullup                  Non-zero, "on", or "y" to enable the parasitic
+                                power (2-wire, power-on-data) feature
+
+        extpullup               GPIO for external pullup (default "5")
+
+
+Name:   wittypi
+Info:   Configures the wittypi RTC module.
+Load:   dtoverlay=wittypi,<param>=<val>
+Params: led_gpio                GPIO for LED (default "17")
+        led_trigger             Choose which activity the LED tracks (default
+                                "default-on")
+
+
+Troubleshooting
+===============
+
+If you are experiencing problems that you think are DT-related, enable DT
+diagnostic output by adding this to /boot/config.txt:
+
+    dtdebug=on
+
+and rebooting. Then run:
+
+    sudo vcdbg log msg
+
+and look for relevant messages.
+
+Further reading
+===============
+
+This is only meant to be a quick introduction to the subject of Device Tree on
+Raspberry Pi. There is a more complete explanation here:
+
+http://www.raspberrypi.org/documentation/configuration/device-tree.md
diff --git a/arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts b/arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts
new file mode 100644
index 000000000000..1aaca71c1b67
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/adau1977-adc-overlay.dts
@@ -0,0 +1,40 @@
+// Definitions for ADAU1977 ADC
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+    
+	fragment@0 {
+        	target = <&i2c>;
+        	
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+			
+			adau1977: codec@11 {
+                        	compatible = "adi,adau1977";
+                        	reg = <0x11>;
+                        	reset-gpios = <&gpio 5 0>;
+				AVDD-supply = <&vdd_3v3_reg>;
+                	};
+        	};
+	};
+
+	fragment@1 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "adi,adau1977-adc";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts b/arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts
new file mode 100644
index 000000000000..e67e6625d796
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/adau7002-simple-overlay.dts
@@ -0,0 +1,52 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "brcm,bcm2708";
+
+    fragment@0 {
+        target = <&i2s>;
+        __overlay__ {
+            status = "okay";
+        };
+    };
+
+    fragment@1 {
+        target-path = "/";
+        __overlay__ {
+                adau7002_codec: adau7002-codec {
+                #sound-dai-cells = <0>;
+                compatible = "adi,adau7002";
+/*                IOVDD-supply = <&supply>;*/
+                status = "okay";
+            };
+        };
+    };
+
+    fragment@2 {
+        target = <&sound>;
+            sound_overlay: __overlay__ {
+            compatible = "simple-audio-card";
+            simple-audio-card,format = "i2s";
+            simple-audio-card,name = "adau7002";
+            simple-audio-card,bitclock-slave = <&dailink0_slave>;
+            simple-audio-card,frame-slave = <&dailink0_slave>;
+            simple-audio-card,widgets =
+                    "Microphone", "Microphone Jack";
+            simple-audio-card,routing =
+                    "PDM_DAT", "Microphone Jack";
+            status = "okay";
+            simple-audio-card,cpu {
+                sound-dai = <&i2s>;
+            };
+            dailink0_slave: simple-audio-card,codec {
+                sound-dai = <&adau7002_codec>;
+            };
+        };
+    };
+
+
+    __overrides__ {
+        card-name = <&sound_overlay>,"simple-audio-card,name";
+    };
+};
diff --git a/arch/arm/boot/dts/overlays/ads1015-overlay.dts b/arch/arm/boot/dts/overlays/ads1015-overlay.dts
new file mode 100644
index 000000000000..02b9de46299b
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/ads1015-overlay.dts
@@ -0,0 +1,98 @@
+/*
+ * 2016 - Erik Sejr
+ */
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "brcm,bcm2708";
+    /* ----------- ADS1015 ------------ */
+    fragment@0 {
+        target = <&i2c_arm>;
+        __overlay__ {
+            #address-cells = <1>;
+            #size-cells = <0>;
+            status = "okay";
+            ads1015: ads1015 {
+                compatible = "ti,ads1015";
+                status = "okay";
+                #address-cells = <1>;
+                #size-cells = <0>;
+                reg = <0x48>;
+            };
+        };
+    };
+
+    fragment@1 {
+        target-path = "i2c_arm/ads1015";
+        __overlay__ {
+            #address-cells = <1>;
+            #size-cells = <0>;
+            channel_a: channel_a {
+                reg = <4>;
+                ti,gain = <2>;
+                ti,datarate = <4>;
+            };
+        };
+    };
+
+    fragment@2 {
+        target-path = "i2c_arm/ads1015";
+        __dormant__ {
+            #address-cells = <1>;
+            #size-cells = <0>;
+            channel_b: channel_b {
+                reg = <5>;
+                ti,gain = <2>;
+                ti,datarate = <4>;
+            };
+        };
+    };
+
+    fragment@3 {
+        target-path = "i2c_arm/ads1015";
+        __dormant__ {
+            #address-cells = <1>;
+            #size-cells = <0>;
+            channel_c: channel_c {
+                reg = <6>;
+                ti,gain = <2>;
+                ti,datarate = <4>;
+            };
+        };
+    };
+
+    fragment@4 {
+        target-path = "i2c_arm/ads1015";
+        __dormant__ {
+            #address-cells = <1>;
+            #size-cells = <0>;
+            channel_d: channel_d {
+                reg = <7>;
+                ti,gain = <2>;
+                ti,datarate = <4>;
+            };
+        };
+    };
+
+    __overrides__ {
+        addr =            <&ads1015>,"reg:0";
+        cha_enable =      <0>,"=1";
+        cha_cfg =         <&channel_a>,"reg:0";
+        cha_gain =        <&channel_a>,"ti,gain:0";
+        cha_datarate =    <&channel_a>,"ti,datarate:0";
+        chb_enable =      <0>,"=2";
+        chb_cfg =         <&channel_b>,"reg:0";
+        chb_gain =        <&channel_b>,"ti,gain:0";
+        chb_datarate =    <&channel_b>,"ti,datarate:0";
+        chc_enable =      <0>,"=3";
+        chc_cfg =         <&channel_c>,"reg:0";
+        chc_gain =        <&channel_c>,"ti,gain:0";
+        chc_datarate =    <&channel_c>,"ti,datarate:0";
+        chd_enable =      <0>,"=4";
+        chd_cfg =         <&channel_d>,"reg:0";
+        chd_gain =        <&channel_d>,"ti,gain:0";
+        chd_datarate =    <&channel_d>,"ti,datarate:0";
+   };
+
+};
diff --git a/arch/arm/boot/dts/overlays/ads1115-overlay.dts b/arch/arm/boot/dts/overlays/ads1115-overlay.dts
new file mode 100644
index 000000000000..7c16a1af3172
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/ads1115-overlay.dts
@@ -0,0 +1,103 @@
+/*
+ * TI ADS1115 multi-channel ADC overlay
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ads1115: ads1115 {
+				compatible = "ti,ads1115";
+				status = "okay";
+				#address-cells = <1>;
+				#size-cells = <0>;
+				reg = <0x48>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target-path = "i2c_arm/ads1115";
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			channel_a: channel_a {
+				reg = <4>;
+				ti,gain = <1>;
+				ti,datarate = <7>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target-path = "i2c_arm/ads1115";
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			channel_b: channel_b {
+				reg = <5>;
+				ti,gain = <1>;
+				ti,datarate = <7>;
+			};
+		};
+	};
+
+	fragment@3 {
+		target-path = "i2c_arm/ads1115";
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			channel_c: channel_c {
+				reg = <6>;
+				ti,gain = <1>;
+				ti,datarate = <7>;
+			};
+		};
+	};
+
+	fragment@4 {
+		target-path = "i2c_arm/ads1115";
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			channel_d: channel_d {
+				reg = <7>;
+				ti,gain = <1>;
+				ti,datarate = <7>;
+			};
+		};
+	};
+
+	__overrides__ {
+		addr =            <&ads1115>,"reg:0";
+		cha_enable =      <0>,"=1";
+		cha_cfg =         <&channel_a>,"reg:0";
+		cha_gain =        <&channel_a>,"ti,gain:0";
+		cha_datarate =    <&channel_a>,"ti,datarate:0";
+		chb_enable =      <0>,"=2";
+		chb_cfg =         <&channel_b>,"reg:0";
+		chb_gain =        <&channel_b>,"ti,gain:0";
+		chb_datarate =    <&channel_b>,"ti,datarate:0";
+		chc_enable =      <0>,"=3";
+		chc_cfg =         <&channel_c>,"reg:0";
+		chc_gain =        <&channel_c>,"ti,gain:0";
+		chc_datarate =    <&channel_c>,"ti,datarate:0";
+		chd_enable =      <0>,"=4";
+		chd_cfg =         <&channel_d>,"reg:0";
+		chd_gain =        <&channel_d>,"ti,gain:0";
+		chd_datarate =    <&channel_d>,"ti,datarate:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/ads7846-overlay.dts b/arch/arm/boot/dts/overlays/ads7846-overlay.dts
new file mode 100644
index 000000000000..edf2dc9d5d5f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/ads7846-overlay.dts
@@ -0,0 +1,89 @@
+/*
+ * Generic Device Tree overlay for the ADS7846 touch controller
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			ads7846_pins: ads7846_pins {
+				brcm,pins = <255>; /* illegal default value */
+				brcm,function = <0>; /* in */
+				brcm,pull = <0>; /* none */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			ads7846: ads7846@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&ads7846_pins>;
+
+				spi-max-frequency = <2000000>;
+				interrupts = <255 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 255 0>;
+
+				/* driver defaults */
+				ti,x-min = /bits/ 16 <0>;
+				ti,y-min = /bits/ 16 <0>;
+				ti,x-max = /bits/ 16 <0x0FFF>;
+				ti,y-max = /bits/ 16 <0x0FFF>;
+				ti,pressure-min = /bits/ 16 <0>;
+				ti,pressure-max = /bits/ 16 <0xFFFF>;
+				ti,x-plate-ohms = /bits/ 16 <400>;
+			};
+		};
+	};
+	__overrides__ {
+		cs =     <&ads7846>,"reg:0";
+		speed =  <&ads7846>,"spi-max-frequency:0";
+		penirq = <&ads7846_pins>,"brcm,pins:0", /* REQUIRED */
+			 <&ads7846>,"interrupts:0",
+			 <&ads7846>,"pendown-gpio:4";
+		penirq_pull = <&ads7846_pins>,"brcm,pull:0";
+		swapxy = <&ads7846>,"ti,swap-xy?";
+		xmin =   <&ads7846>,"ti,x-min;0";
+		ymin =   <&ads7846>,"ti,y-min;0";
+		xmax =   <&ads7846>,"ti,x-max;0";
+		ymax =   <&ads7846>,"ti,y-max;0";
+		pmin =   <&ads7846>,"ti,pressure-min;0";
+		pmax =   <&ads7846>,"ti,pressure-max;0";
+		xohms =  <&ads7846>,"ti,x-plate-ohms;0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts b/arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts
new file mode 100644
index 000000000000..241d03b9b79e
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/akkordion-iqdacplus-overlay.dts
@@ -0,0 +1,49 @@
+// Definitions for Digital Dreamtime Akkordion using IQaudIO DAC+ or DACZero
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcm5122@4c {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				reg = <0x4c>;
+				AVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				CPVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		frag2: __overlay__ {
+			compatible = "iqaudio,iqaudio-dac";
+			card_name = "Akkordion";
+			dai_name = "IQaudIO DAC";
+			dai_stream_name = "IQaudIO DAC HiFi";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain = <&frag2>,"iqaudio,24db_digital_gain?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts
new file mode 100644
index 000000000000..ac1cfe093d9a
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/allo-boss-dac-pcm512x-audio-overlay.dts
@@ -0,0 +1,59 @@
+/*
+ * Definitions for Allo Boss DAC board
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/clocks";
+		__overlay__ {
+			boss_osc: boss_osc {
+				compatible = "allo,dac-clk";
+				#clock-cells = <0>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcm5122@4d {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				clocks = <&boss_osc>;
+				reg = <0x4d>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&sound>;
+		boss_dac: __overlay__ {
+			compatible = "allo,boss-dac";
+			i2s-controller = <&i2s>;
+			mute-gpios = <&gpio 6 1>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain = <&boss_dac>,"allo,24db_digital_gain?";
+		slave = <&boss_dac>,"allo,slave?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/allo-digione-overlay.dts b/arch/arm/boot/dts/overlays/allo-digione-overlay.dts
new file mode 100644
index 000000000000..101277a11a24
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/allo-digione-overlay.dts
@@ -0,0 +1,44 @@
+// Definitions for Allo DigiOne
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			wm8804@3b {
+				#sound-dai-cells = <0>;
+				compatible = "wlf,wm8804";
+				reg = <0x3b>;
+				PVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+				wlf,reset-gpio = <&gpio 17 0>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "allo,allo-digione";
+			i2s-controller = <&i2s>;
+			status = "okay";
+			clock44-gpio = <&gpio 5 0>;
+			clock48-gpio = <&gpio 6 0>;
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts
new file mode 100644
index 000000000000..6dc4acf1f80c
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/allo-katana-dac-audio-overlay.dts
@@ -0,0 +1,57 @@
+/*
+ * Definitions for Allo Katana DAC boards
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			#sound-dai-cells = <0>;
+			status = "okay";
+			cpu_port: port {
+				cpu_endpoint: endpoint {
+					remote-endpoint = <&codec_endpoint>;
+					bitclock-master = <&codec_endpoint>;
+					frame-master = <&codec_endpoint>;
+					dai-format = "i2s";
+				};
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			allo-katana-codec@30 {
+				#sound-dai-cells = <0>;
+				compatible = "allo,allo-katana-codec";
+				reg = <0x30>;
+				port {
+					codec_endpoint: endpoint {
+					remote-endpoint = <&cpu_endpoint>;
+					};
+				};
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		katana_dac: __overlay__ {
+			compatible = "audio-graph-card";
+			label = "Allo Katana";
+			dais = <&cpu_port>;
+			status = "okay";
+		};
+	};
+};
+
diff --git a/arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts
new file mode 100644
index 000000000000..a5468d850a91
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/allo-piano-dac-pcm512x-audio-overlay.dts
@@ -0,0 +1,54 @@
+/*
+ * Definitions for Allo Piano DAC (2.0/2.1) boards
+ *
+ * NB. The Piano DAC 2.1 board contains 2x TI PCM5142 DAC's. One DAC is stereo
+ * (left/right) and the other provides a subwoofer output, using DSP on the
+ * chip for digital high/low pass crossover.
+ * The initial support for this hardware, that doesn't require any codec driver
+ * modifications, uses only one DAC chip for stereo (left/right) output, the
+ * chip with 0x4c slave address. The other chip at 0x4d is currently ignored!
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcm5142@4c {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5142";
+				reg = <0x4c>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		piano_dac: __overlay__ {
+			compatible = "allo,piano-dac";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain =
+			<&piano_dac>,"allo,24db_digital_gain?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts b/arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts
new file mode 100644
index 000000000000..5c1c81c427a8
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/allo-piano-dac-plus-pcm512x-audio-overlay.dts
@@ -0,0 +1,55 @@
+// Definitions for Piano DAC
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			allo_pcm5122_4c: pcm5122@4c {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				reg = <0x4c>;
+				status = "okay";
+			};
+			allo_pcm5122_4d: pcm5122@4d {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				reg = <0x4d>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		piano_dac: __overlay__ {
+			compatible = "allo,piano-dac-plus";
+			audio-codec = <&allo_pcm5122_4c &allo_pcm5122_4d>;
+			i2s-controller = <&i2s>;
+			mute1-gpios = <&gpio 6 1>;
+			mute2-gpios = <&gpio 25 1>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain =
+			<&piano_dac>,"allo,24db_digital_gain?";
+		glb_mclk =
+			<&piano_dac>,"allo,glb_mclk?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/applepi-dac-overlay.dts b/arch/arm/boot/dts/overlays/applepi-dac-overlay.dts
new file mode 100644
index 000000000000..fc02b295470e
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/applepi-dac-overlay.dts
@@ -0,0 +1,57 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "brcm,bcm2708";
+
+    fragment@0 {
+        target = <&sound>;
+        __overlay__ {
+            compatible = "simple-audio-card";
+            simple-audio-card,name = "ApplePi-DAC";
+
+            status = "okay";
+
+            playback_link: simple-audio-card,dai-link@1 {
+                format = "i2s";
+
+                p_cpu_dai: cpu {
+                    sound-dai = <&i2s>;
+                    dai-tdm-slot-num = <2>;
+                    dai-tdm-slot-width = <32>;
+                };
+
+                p_codec_dai: codec {
+                    sound-dai = <&codec_out>;
+                };
+            };
+        };
+    };
+
+    fragment@1 {
+        target-path = "/";
+        __overlay__ {
+            codec_out: pcm1794a-codec {
+                #sound-dai-cells = <0>;
+                compatible = "ti,pcm1794a";
+                status = "okay";
+            };
+        };
+    };
+
+    fragment@2 {
+        target = <&i2s>;
+        __overlay__ {
+            #sound-dai-cells = <0>;
+            status = "okay";
+        };
+    };
+};
+
+/*
+   Written by: Leonid Ayzenshtat
+   Company: Orchard Audio (www.orchardaudio.com)
+
+   compile with:
+   dtc -@ -H epapr -O dtb -o ApplePi-DAC.dtbo -W no-unit_address_vs_reg ApplePi-DAC.dts
+*/
diff --git a/arch/arm/boot/dts/overlays/at86rf233-overlay.dts b/arch/arm/boot/dts/overlays/at86rf233-overlay.dts
new file mode 100644
index 000000000000..880c7539d496
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/at86rf233-overlay.dts
@@ -0,0 +1,57 @@
+/dts-v1/;
+/plugin/;
+
+/* Overlay for Atmel AT86RF233 IEEE 802.15.4 WPAN transceiver on spi0.0 */
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "okay";
+
+			lowpan0: at86rf233@0 {
+				compatible = "atmel,at86rf233";
+				reg = <0>;
+				interrupt-parent = <&gpio>;
+				interrupts = <23 4>; /* active high */
+				reset-gpio = <&gpio 24 1>;
+				sleep-gpio = <&gpio 25 1>;
+				spi-max-frequency = <3000000>;
+				xtal-trim = /bits/ 8 <0xf>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&gpio>;
+		__overlay__ {
+			lowpan0_pins: lowpan0_pins {
+				brcm,pins = <23 24 25>;
+				brcm,function = <0 1 1>; /* in out out */
+			};
+		};
+	};
+
+	__overrides__ {
+		interrupt = <&lowpan0>, "interrupts:0",
+			<&lowpan0_pins>, "brcm,pins:0";
+		reset     = <&lowpan0>, "reset-gpio:4",
+			<&lowpan0_pins>, "brcm,pins:4";
+		sleep     = <&lowpan0>, "sleep-gpio:4",
+			<&lowpan0_pins>, "brcm,pins:8";
+		speed     = <&lowpan0>, "spi-max-frequency:0";
+		trim      = <&lowpan0>, "xtal-trim.0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
new file mode 100644
index 000000000000..60b2e94f2c9a
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/audioinjector-addons-overlay.dts
@@ -0,0 +1,59 @@
+// Definitions for audioinjector.net audio add on soundcard
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			cs42448: cs42448@48 {
+				#sound-dai-cells = <0>;
+				compatible = "cirrus,cs42448";
+				reg = <0x48>;
+				clocks = <&cs42448_mclk>;
+				clock-names = "mclk";
+				VA-supply = <&vdd_5v0_reg>;
+				VD-supply = <&vdd_3v3_reg>;
+				VLS-supply = <&vdd_3v3_reg>;
+				VLC-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+
+			cs42448_mclk: codec-mclk {
+				compatible = "fixed-clock";
+				#clock-cells = <0>;
+				clock-frequency = <49152000>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		snd: __overlay__ {
+			compatible = "ai,audioinjector-octo-soundcard";
+			mult-gpios = <&gpio 27 0>, <&gpio 22 0>, <&gpio 23 0>,
+				     <&gpio 24 0>;
+			reset-gpios = <&gpio 5 0>;
+			i2s-controller = <&i2s>;
+			codec = <&cs42448>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		non-stop-clocks = <&snd>, "non-stop-clocks?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts b/arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts
new file mode 100644
index 000000000000..4ed66577fa1d
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/audioinjector-wm8731-audio-overlay.dts
@@ -0,0 +1,39 @@
+// Definitions for audioinjector.net audio add on soundcard
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			wm8731@1a {
+				#sound-dai-cells = <0>;
+				compatible = "wlf,wm8731";
+				reg = <0x1a>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "ai,audioinjector-pi-soundcard";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/audremap-overlay.dts b/arch/arm/boot/dts/overlays/audremap-overlay.dts
new file mode 100644
index 000000000000..9582d6ab3121
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/audremap-overlay.dts
@@ -0,0 +1,19 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+        compatible = "brcm,bcm2708";
+
+        fragment@0 {
+                target = <&audio_pins>;
+                frag0: __overlay__ {
+                        brcm,pins = < 12 13 >;
+                        brcm,function = < 4 >; /* alt0 alt0 */
+                };
+        };
+
+	__overrides__ {
+		swap_lr = <&frag0>, "swap_lr?";
+		enable_jack = <&frag0>, "enable_jack?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/balena-fin-overlay.dts b/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
new file mode 100644
index 000000000000..269ab7d72938
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/balena-fin-overlay.dts
@@ -0,0 +1,79 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&mmc>;
+		sdio_wifi: __overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&sdio_pins>;
+			bus-width = <4>;
+			brcm,overclock-50 = <35>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			sdio_pins: sdio_pins {
+				brcm,pins = <34 35 36 37 38 39>;
+				brcm,function = <7>; /* ALT3 = SD1 */
+				brcm,pull = <0 2 2 2 2 2>;
+			};
+
+			power_ctrl_pins: power_ctrl_pins {
+				brcm,pins = <40>;
+				brcm,function = <1>; // out
+			};
+		};
+	};
+
+	fragment@2 {
+		target-path = "/";
+		__overlay__ {
+			// We should investigate how to switch to mmc-pwrseq-sd8787
+			// Currently that module requires two GPIOs to function since it
+			// targets a slightly different chip
+			power_ctrl: power_ctrl {
+				compatible = "gpio-poweroff";
+				gpios = <&gpio 40 1>;
+				force;
+			};
+
+			i2c_soft: i2c@0 {
+				compatible = "i2c-gpio";
+				gpios = <&gpio 43 0 /* sda */ &gpio 42 0 /* scl */>;
+				i2c-gpio,delay-us = <2>; /* ~100 kHz */
+				#address-cells = <1>;
+				#size-cells = <0>;
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&i2c_soft>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			gpio_expander: gpio_expander@20 {
+				compatible = "nxp,pca9554";
+				gpio-controller;
+				#gpio-cells = <2>;
+				reg = <0x20>;
+				status = "okay";
+			};
+
+			// rtc clock
+			ds1307: ds1307@68 {
+				compatible = "maxim,ds1307";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/bmp085_i2c-sensor-overlay.dts b/arch/arm/boot/dts/overlays/bmp085_i2c-sensor-overlay.dts
new file mode 100644
index 000000000000..782b1715467e
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/bmp085_i2c-sensor-overlay.dts
@@ -0,0 +1,23 @@
+// Definitions for BMP085/BMP180 digital barometric pressure and temperature sensors from Bosch Sensortec
+/dts-v1/;
+/plugin/;
+
+/ {
+        compatible = "brcm,bcm2708";
+
+        fragment@0 {
+                target = <&i2c_arm>;
+                __overlay__ {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                        status = "okay";
+
+                        bmp085@77 {
+                                compatible = "bosch,bmp085";
+                                reg = <0x77>;
+                                default-oversampling = <3>;
+                                status = "okay";
+                        };
+                };
+        };
+};
diff --git a/arch/arm/boot/dts/overlays/dht11-overlay.dts b/arch/arm/boot/dts/overlays/dht11-overlay.dts
new file mode 100644
index 000000000000..9bf67fd57bad
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/dht11-overlay.dts
@@ -0,0 +1,39 @@
+/*
+ * Overlay for the DHT11/21/22 humidity/temperature sensor modules.
+ */
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+
+			dht11: dht11@0 {
+				compatible = "dht11";
+				pinctrl-names = "default";
+				pinctrl-0 = <&dht11_pins>;
+				gpios = <&gpio 4 0>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			dht11_pins: dht11_pins {
+				brcm,pins = <4>;
+				brcm,function = <0>; // in
+				brcm,pull = <0>; // off
+			};
+		};
+	};
+
+	__overrides__ {
+		gpiopin = <&dht11_pins>,"brcm,pins:0",
+			<&dht11>,"gpios:4";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts b/arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts
new file mode 100644
index 000000000000..3930f412bca4
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/dionaudio-loco-overlay.dts
@@ -0,0 +1,39 @@
+// Definitions for Dion Audio LOCO DAC-AMP
+
+/*
+ * PCM5242 DAC (in hardware mode) and TPA3118 AMP.
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			pcm5102a-codec {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5102a";
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "dionaudio,loco-pcm5242-tpa3118";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts b/arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts
new file mode 100644
index 000000000000..a1af93de3011
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/dionaudio-loco-v2-overlay.dts
@@ -0,0 +1,49 @@
+/*
+ * Definitions for Dion Audio LOCO-V2 DAC-AMP
+ *  eg. dtoverlay=dionaudio-loco-v2
+ *
+ * PCM5242 DAC (in software mode) and TPA3255 AMP.
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&sound>;
+		frag0: __overlay__ {
+			compatible = "dionaudio,dionaudio-loco-v2";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcm5122@4c {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				reg = <0x4d>;
+				status = "okay";
+			};
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain = <&frag0>,"dionaudio,24db_digital_gain?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/dpi18-overlay.dts b/arch/arm/boot/dts/overlays/dpi18-overlay.dts
new file mode 100644
index 000000000000..8098d5e28a71
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/dpi18-overlay.dts
@@ -0,0 +1,31 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	// There is no DPI driver module, but we need a platform device
+	// node (that doesn't already use pinctrl) to hang the pinctrl
+	// reference on - leds will do
+
+	fragment@0 {
+		target = <&leds>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&dpi18_pins>;
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			dpi18_pins: dpi18_pins {
+				brcm,pins = <0 1 2 3 4 5 6 7 8 9 10 11
+					     12 13 14 15 16 17 18 19 20
+					     21>;
+				brcm,function = <6>; /* alt2 */
+				brcm,pull = <0>; /* no pull */
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/dpi24-overlay.dts b/arch/arm/boot/dts/overlays/dpi24-overlay.dts
new file mode 100644
index 000000000000..e4dbe40218a0
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/dpi24-overlay.dts
@@ -0,0 +1,31 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	// There is no DPI driver module, but we need a platform device
+	// node (that doesn't already use pinctrl) to hang the pinctrl
+	// reference on - leds will do
+
+	fragment@0 {
+		target = <&leds>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&dpi24_pins>;
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			dpi24_pins: dpi24_pins {
+				brcm,pins = <0 1 2 3 4 5 6 7 8 9 10 11
+					     12 13 14 15 16 17 18 19 20
+					     21 22 23 24 25 26 27>;
+				brcm,function = <6>; /* alt2 */
+				brcm,pull = <0>; /* no pull */
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts b/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts
new file mode 100644
index 000000000000..fc48bd1eac60
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/dwc-otg-overlay.dts
@@ -0,0 +1,20 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&usb>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		__overlay__ {
+			compatible = "brcm,bcm2708-usb";
+			reg = <0x7e980000 0x10000>,
+			      <0x7e006000 0x1000>;
+			interrupts = <2 0>,
+				     <1 9>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/dwc2-overlay.dts b/arch/arm/boot/dts/overlays/dwc2-overlay.dts
new file mode 100644
index 000000000000..d6c223bc559a
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/dwc2-overlay.dts
@@ -0,0 +1,28 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&usb>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		dwc2_usb: __overlay__ {
+			compatible = "brcm,bcm2835-usb";
+			reg = <0x7e980000 0x10000>;
+			interrupts = <1 9>;
+			dr_mode = "otg";
+			g-np-tx-fifo-size = <32>;
+			g-rx-fifo-size = <256>;
+			g-tx-fifo-size = <512 512 512 512 512 256 256>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		dr_mode = <&dwc2_usb>, "dr_mode";
+		g-np-tx-fifo-size = <&dwc2_usb>,"g-np-tx-fifo-size:0";
+		g-rx-fifo-size = <&dwc2_usb>,"g-rx-fifo-size:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/enc28j60-overlay.dts b/arch/arm/boot/dts/overlays/enc28j60-overlay.dts
new file mode 100644
index 000000000000..db8a8feed94c
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/enc28j60-overlay.dts
@@ -0,0 +1,53 @@
+// Overlay for the Microchip ENC28J60 Ethernet Controller
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "okay";
+
+			eth1: enc28j60@0{
+				compatible = "microchip,enc28j60";
+				reg = <0>; /* CE0 */
+				pinctrl-names = "default";
+				pinctrl-0 = <&eth1_pins>;
+				interrupt-parent = <&gpio>;
+				interrupts = <25 0x2>; /* falling edge */
+				spi-max-frequency = <12000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&gpio>;
+		__overlay__ {
+			eth1_pins: eth1_pins {
+				brcm,pins = <25>;
+				brcm,function = <0>; /* in */
+				brcm,pull = <0>; /* none */
+			};
+		};
+	};
+
+	__overrides__ {
+		int_pin = <&eth1>, "interrupts:0",
+		          <&eth1_pins>, "brcm,pins:0";
+		speed   = <&eth1>, "spi-max-frequency:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts b/arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts
new file mode 100644
index 000000000000..946c9d2107a8
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/enc28j60-spi2-overlay.dts
@@ -0,0 +1,47 @@
+// Overlay for the Microchip ENC28J60 Ethernet Controller - SPI2 Compute Module
+// Interrupt pin: 39
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&spi2>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "okay";
+
+			eth1: enc28j60@0{
+				compatible = "microchip,enc28j60";
+				reg = <0>; /* CE0 */
+				pinctrl-names = "default";
+				pinctrl-0 = <&eth1_pins>;
+				interrupt-parent = <&gpio>;
+				interrupts = <39 0x2>; /* falling edge */
+				spi-max-frequency = <12000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			eth1_pins: eth1_pins {
+				brcm,pins = <39>;
+				brcm,function = <0>; /* in */
+				brcm,pull = <0>; /* none */
+			};
+		};
+	};
+
+	__overrides__ {
+		int_pin = <&eth1>, "interrupts:0",
+		          <&eth1_pins>, "brcm,pins:0";
+		speed   = <&eth1>, "spi-max-frequency:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/exc3000-overlay.dts b/arch/arm/boot/dts/overlays/exc3000-overlay.dts
new file mode 100644
index 000000000000..c5694033d03f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/exc3000-overlay.dts
@@ -0,0 +1,48 @@
+// Device tree overlay for I2C connected EETI EXC3000 multiple touch controller
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			exc3000_pins: exc3000_pins {
+				brcm,pins = <4>; // interrupt
+				brcm,function = <0>; // in
+				brcm,pull = <2>; // pull-up
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			exc3000: exc3000@2a {
+				compatible = "eeti,exc3000";
+				reg = <0x2a>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&exc3000_pins>;
+				interrupt-parent = <&gpio>;
+				interrupts = <4 8>; // active low level-sensitive
+				touchscreen-size-x = <4096>;
+				touchscreen-size-y = <4096>;
+			};
+		};
+	};
+
+	__overrides__ {
+		interrupt = <&exc3000_pins>,"brcm,pins:0",
+			<&exc3000>,"interrupts:0";
+		sizex = <&exc3000>,"touchscreen-size-x:0";
+		sizey = <&exc3000>,"touchscreen-size-y:0";
+		invx = <&exc3000>,"touchscreen-inverted-x?";
+		invy = <&exc3000>,"touchscreen-inverted-y?";
+		swapxy = <&exc3000>,"touchscreen-swapped-x-y?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts b/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts
new file mode 100644
index 000000000000..81a07ed5a8c7
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/fe-pi-audio-overlay.dts
@@ -0,0 +1,70 @@
+// Definitions for Fe-Pi Audio
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&clocks>;
+		__overlay__ {
+			sgtl5000_mclk: sgtl5000_mclk {
+				compatible = "fixed-clock";
+				#clock-cells = <0>;
+				clock-frequency = <12288000>;
+				clock-output-names = "sgtl5000-mclk";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&soc>;
+		__overlay__ {
+			reg_1v8: reg_1v8@0 {
+				compatible = "regulator-fixed";
+				regulator-name = "1V8";
+				regulator-min-microvolt = <1800000>;
+				regulator-max-microvolt = <1800000>;
+				regulator-always-on;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			sgtl5000@0a {
+				#sound-dai-cells = <0>;
+				compatible = "fepi,sgtl5000";
+				reg = <0x0a>;
+				clocks = <&sgtl5000_mclk>;
+				micbias-resistor-k-ohms = <2>;
+				micbias-voltage-m-volts = <3000>;
+				VDDA-supply = <&vdd_3v3_reg>;
+				VDDIO-supply = <&vdd_3v3_reg>;
+				VDDD-supply = <&reg_1v8>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@4 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "fe-pi,fe-pi-audio";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/goodix-overlay.dts b/arch/arm/boot/dts/overlays/goodix-overlay.dts
new file mode 100644
index 000000000000..084f74042ed6
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/goodix-overlay.dts
@@ -0,0 +1,46 @@
+// Device tree overlay for I2C connected Goodix gt9271 multiple touch controller
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			goodix_pins: goodix_pins {
+				brcm,pins = <4 17>; // interrupt and reset
+				brcm,function = <0 0>; // in
+				brcm,pull = <2 2>; // pull-up
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			gt9271: gt9271@14 {
+				compatible = "goodix,gt9271";
+				reg = <0x14>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&goodix_pins>;
+				interrupt-parent = <&gpio>;
+				interrupts = <4 2>; // high-to-low edge triggered
+				irq-gpios = <&gpio 4 0>; // Pin7 on GPIO header
+				reset-gpios = <&gpio 17 0>; // Pin11 on GPIO header
+			};
+		};
+	};
+
+	__overrides__ {
+		interrupt = <&goodix_pins>,"brcm,pins:0",
+			<&gt9271>,"interrupts:0",
+			<&gt9271>,"irq-gpios:4";
+		reset = <&goodix_pins>,"brcm,pins:4",
+			<&gt9271>,"reset-gpios:4";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts b/arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts
new file mode 100644
index 000000000000..9a9e9a0ca28c
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/googlevoicehat-soundcard-overlay.dts
@@ -0,0 +1,49 @@
+// Definitions for Google voiceHAT v1 soundcard overlay
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			googlevoicehat_pins: googlevoicehat_pins {
+				brcm,pins = <16>;
+				brcm,function = <1>; /* out */
+				brcm,pull = <0>; /* up */
+			};
+		};
+	};
+
+
+	fragment@2 {
+		target-path = "/";
+		__overlay__ {
+			voicehat-codec {
+				#sound-dai-cells = <0>;
+				compatible = "google,voicehat";
+				pinctrl-names = "default";
+				pinctrl-0 = <&googlevoicehat_pins>;
+				sdmode-gpios= <&gpio 16 0>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "googlevoicehat,googlevoicehat-soundcard";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts b/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts
new file mode 100644
index 000000000000..1bd9bb950efa
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/gpio-ir-overlay.dts
@@ -0,0 +1,48 @@
+// Definitions for ir-gpio module
+/dts-v1/;
+/plugin/;
+
+/ {
+        compatible = "brcm,bcm2708";
+
+        fragment@0 {
+                target-path = "/";
+                __overlay__ {
+                        gpio_ir: ir-receiver@12 {
+                                compatible = "gpio-ir-receiver";
+                                pinctrl-names = "default";
+                                pinctrl-0 = <&gpio_ir_pins>;
+
+                                // pin number, high or low
+                                gpios = <&gpio 18 1>;
+
+                                // parameter for keymap name
+                                linux,rc-map-name = "rc-rc6-mce";
+
+                                status = "okay";
+                        };
+                };
+        };
+
+        fragment@1 {
+                target = <&gpio>;
+                __overlay__ {
+                        gpio_ir_pins: gpio_ir_pins@12 {
+                                brcm,pins = <18>;                       // pin 18
+                                brcm,function = <0>;                    // in
+                                brcm,pull = <1>;                        // down
+                        };
+                };
+        };
+
+        __overrides__ {
+                // parameters
+                gpio_pin =      <&gpio_ir>,"gpios:4",           // pin number
+                                <&gpio_ir>,"reg:0",
+                                <&gpio_ir_pins>,"brcm,pins:0",
+                                <&gpio_ir_pins>,"reg:0";
+                gpio_pull = <&gpio_ir_pins>,"brcm,pull:0";              // pull-up/down state
+
+                rc-map-name = <&gpio_ir>,"linux,rc-map-name";           // default rc map
+        };
+};
diff --git a/arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts b/arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts
new file mode 100644
index 000000000000..e054ba319398
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/gpio-ir-tx-overlay.dts
@@ -0,0 +1,36 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			gpio_ir_tx_pins: gpio_ir_tx_pins@12 {
+				brcm,pins = <18>;
+				brcm,function = <1>;	// out
+			};
+		};
+	};
+
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			gpio_ir_tx: gpio-ir-transmitter@12 {
+				compatible = "gpio-ir-tx";
+				pinctrl-names = "default";
+				pinctrl-0 = <&gpio_ir_tx_pins>;
+				gpios = <&gpio 18 0>;
+			};
+		};
+	};
+
+	__overrides__ {
+		gpio_pin = <&gpio_ir_tx>, "gpios:4",           	// pin number
+			   <&gpio_ir_tx>, "reg:0",
+			   <&gpio_ir_tx_pins>, "brcm,pins:0",
+			   <&gpio_ir_tx_pins>, "reg:0";
+		invert = <&gpio_ir_tx>, "gpios:8";		// 1 = active low
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/gpio-key-overlay.dts b/arch/arm/boot/dts/overlays/gpio-key-overlay.dts
new file mode 100644
index 000000000000..333d016d6f02
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/gpio-key-overlay.dts
@@ -0,0 +1,48 @@
+// Definitions for gpio-key module
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		// Configure the gpio pin controller
+		target = <&gpio>;
+		__overlay__ {
+			pin_state: button_pins@0 {
+				brcm,pins = <3>; // gpio number
+				brcm,function = <0>; // 0 = input, 1 = output
+				brcm,pull = <2>; // 0 = none, 1 = pull down, 2 = pull up
+			};
+		};
+	};
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			button: button@0 {
+				compatible = "gpio-keys";
+				pinctrl-names = "default";
+				pinctrl-0 = <&pin_state>;
+				status = "okay";
+
+				key: key {
+					linux,code = <116>;
+					gpios = <&gpio 3 1>;
+					label = "KEY_POWER";
+				};
+			};
+		};
+	};
+
+	__overrides__ {
+		gpio =       <&key>,"gpios:4",
+		             <&button>,"reg:0",
+		             <&pin_state>,"brcm,pins:0",
+		             <&pin_state>,"reg:0";
+		label =      <&key>,"label";
+		keycode =    <&key>,"linux,code:0";
+		gpio_pull =  <&pin_state>,"brcm,pull:0";
+		active_low = <&key>,"gpios:8";
+	};
+
+};
diff --git a/arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts b/arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts
new file mode 100644
index 000000000000..b9c834960556
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/gpio-poweroff-overlay.dts
@@ -0,0 +1,36 @@
+// Definitions for gpio-poweroff module
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+			power_ctrl: power_ctrl {
+				compatible = "gpio-poweroff";
+				gpios = <&gpio 26 0>;
+				force;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			power_ctrl_pins: power_ctrl_pins {
+				brcm,pins = <26>;
+				brcm,function = <1>; // out
+			};
+		};
+	};
+
+	__overrides__ {
+		gpiopin =       <&power_ctrl>,"gpios:4",
+				<&power_ctrl_pins>,"brcm,pins:0";
+		active_low =    <&power_ctrl>,"gpios:8";
+		input =         <&power_ctrl>,"input?";
+		export =        <&power_ctrl>,"export?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts b/arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts
new file mode 100644
index 000000000000..863fb395c853
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/gpio-shutdown-overlay.dts
@@ -0,0 +1,80 @@
+// Definitions for gpio-poweroff module
+/dts-v1/;
+/plugin/;
+
+// This overlay sets up an input device that generates KEY_POWER events
+// when a given GPIO pin changes. It defaults to using GPIO3, which can
+// also be used to wake up (start) the Rpi again after shutdown. Since
+// wakeup is active-low, this defaults to active-low with a pullup
+// enabled, but all of this can be changed using overlay parameters (but
+// note that GPIO3 has an external pullup on at least some boards).
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		// Configure the gpio pin controller
+		target = <&gpio>;
+		__overlay__ {
+			// Define a pinctrl state, that sets up the gpio
+			// as an input with a pullup enabled. This does
+			// not take effect by itself, only when referenced
+			// by a "pinctrl client", as is done below. See:
+			//   https://www.kernel.org/doc/Documentation/devicetree/bindings/pinctrl/pinctrl-bindings.txt
+			//   https://www.kernel.org/doc/Documentation/devicetree/bindings/pinctrl/brcm,bcm2835-gpio.txt
+			pin_state: shutdown_button_pins {
+				brcm,pins = <3>; // gpio number
+				brcm,function = <0>; // 0 = input, 1 = output
+				brcm,pull = <2>; // 0 = none, 1 = pull down, 2 = pull up
+			};
+		};
+	};
+	fragment@1 {
+		// Add a new device to the /soc devicetree node
+		target-path = "/soc";
+		__overlay__ {
+			shutdown_button {
+				// Let the gpio-keys driver handle this device. See:
+				// https://www.kernel.org/doc/Documentation/devicetree/bindings/input/gpio-keys.txt
+				compatible = "gpio-keys";
+
+				// Declare a single pinctrl state (referencing the one declared above) and name it
+				// default, so it is activated automatically.
+				pinctrl-names = "default";
+				pinctrl-0 = <&pin_state>;
+
+				// Enable this device
+				status = "okay";
+
+				// Define a single key, called "shutdown" that monitors the gpio and sends KEY_POWER
+				// (keycode 116, see
+				// https://github.com/torvalds/linux/blob/v4.12/include/uapi/linux/input-event-codes.h#L190)
+				button: shutdown {
+					label = "shutdown";
+					linux,code = <116>; // KEY_POWER
+					gpios = <&gpio 3 1>;
+				};
+			};
+		};
+	};
+
+	// This defines parameters that can be specified when loading
+	// the overlay. Each foo = line specifies one parameter, named
+	// foo. The rest of the specification gives properties where the
+	// parameter value is inserted into (changing the values above
+	// or adding new ones).
+	__overrides__ {
+		// Allow overriding the GPIO number.
+		gpio_pin = <&button>,"gpios:4",
+		           <&pin_state>,"brcm,pins:0";
+
+		// Allow changing the internal pullup/down state. 0 = none, 1 = pulldown, 2 = pullup
+		// Note that GPIO3 and GPIO2 are the I2c pins and have an external pullup (at least
+                // on some boards).
+		gpio_pull = <&pin_state>,"brcm,pull:0";
+
+		// Allow setting the active_low flag. 0 = active high, 1 = active low
+		active_low = <&button>,"gpios:8";
+	};
+
+};
diff --git a/arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts
new file mode 100644
index 000000000000..5f5785534fd3
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hifiberry-amp-overlay.dts
@@ -0,0 +1,39 @@
+// Definitions for HiFiBerry Amp/Amp+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			tas5713@1b {
+				#sound-dai-cells = <0>;
+				compatible = "ti,tas5713";
+				reg = <0x1b>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "hifiberry,hifiberry-amp";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts
new file mode 100644
index 000000000000..0b74fdc6e0f6
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hifiberry-dac-overlay.dts
@@ -0,0 +1,34 @@
+// Definitions for HiFiBerry DAC
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			pcm5102a-codec {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5102a";
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "hifiberry,hifiberry-dac";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts
new file mode 100644
index 000000000000..b4dc99633b9d
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hifiberry-dacplus-overlay.dts
@@ -0,0 +1,59 @@
+// Definitions for HiFiBerry DAC+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/clocks";
+		__overlay__ {
+			dacpro_osc: dacpro_osc {
+				compatible = "hifiberry,dacpro-clk";
+				#clock-cells = <0>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcm5122@4d {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				reg = <0x4d>;
+				clocks = <&dacpro_osc>;
+				AVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				CPVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&sound>;
+		hifiberry_dacplus: __overlay__ {
+			compatible = "hifiberry,hifiberry-dacplus";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain =
+			<&hifiberry_dacplus>,"hifiberry,24db_digital_gain?";
+		slave = <&hifiberry_dacplus>,"hifiberry-dacplus,slave?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts
new file mode 100644
index 000000000000..64cb1e00343b
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hifiberry-digi-overlay.dts
@@ -0,0 +1,41 @@
+// Definitions for HiFiBerry Digi
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			wm8804@3b {
+				#sound-dai-cells = <0>;
+				compatible = "wlf,wm8804";
+				reg = <0x3b>;
+				PVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "hifiberry,hifiberry-digi";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts b/arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts
new file mode 100644
index 000000000000..d02479ca4a25
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hifiberry-digi-pro-overlay.dts
@@ -0,0 +1,43 @@
+// Definitions for HiFiBerry Digi Pro
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			wm8804@3b {
+				#sound-dai-cells = <0>;
+				compatible = "wlf,wm8804";
+				reg = <0x3b>;
+				PVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "hifiberry,hifiberry-digi";
+			i2s-controller = <&i2s>;
+			status = "okay";
+			clock44-gpio = <&gpio 5 0>;
+			clock48-gpio = <&gpio 6 0>;
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/hy28a-overlay.dts b/arch/arm/boot/dts/overlays/hy28a-overlay.dts
new file mode 100644
index 000000000000..d7625a6372f5
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hy28a-overlay.dts
@@ -0,0 +1,93 @@
+/*
+ * Device Tree overlay for HY28A display
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			hy28a_pins: hy28a_pins {
+				brcm,pins = <17 25 18>;
+				brcm,function = <0 1 1>; /* in out out */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			hy28a: hy28a@0{
+				compatible = "ilitek,ili9320";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&hy28a_pins>;
+
+				spi-max-frequency = <32000000>;
+				spi-cpol;
+				spi-cpha;
+				rotate = <270>;
+				bgr;
+				fps = <50>;
+				buswidth = <8>;
+				startbyte = <0x70>;
+				reset-gpios = <&gpio 25 0>;
+				led-gpios = <&gpio 18 1>;
+				debug = <0>;
+			};
+
+			hy28a_ts: hy28a-ts@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+
+				spi-max-frequency = <2000000>;
+				interrupts = <17 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 17 0>;
+				ti,x-plate-ohms = /bits/ 16 <100>;
+				ti,pressure-max = /bits/ 16 <255>;
+			};
+		};
+	};
+	__overrides__ {
+		speed =		<&hy28a>,"spi-max-frequency:0";
+		rotate =	<&hy28a>,"rotate:0";
+		fps =		<&hy28a>,"fps:0";
+		debug =		<&hy28a>,"debug:0";
+		xohms =		<&hy28a_ts>,"ti,x-plate-ohms;0";
+		resetgpio =	<&hy28a>,"reset-gpios:4",
+				<&hy28a_pins>, "brcm,pins:4";
+		ledgpio =	<&hy28a>,"led-gpios:4",
+				<&hy28a_pins>, "brcm,pins:8";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/hy28b-overlay.dts b/arch/arm/boot/dts/overlays/hy28b-overlay.dts
new file mode 100644
index 000000000000..70c1118064b6
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/hy28b-overlay.dts
@@ -0,0 +1,148 @@
+/*
+ * Device Tree overlay for HY28b display shield by Texy
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			hy28b_pins: hy28b_pins {
+				brcm,pins = <17 25 18>;
+				brcm,function = <0 1 1>; /* in out out */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			hy28b: hy28b@0{
+				compatible = "ilitek,ili9325";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&hy28b_pins>;
+
+				spi-max-frequency = <48000000>;
+				spi-cpol;
+				spi-cpha;
+				rotate = <270>;
+				bgr;
+				fps = <50>;
+				buswidth = <8>;
+				startbyte = <0x70>;
+				reset-gpios = <&gpio 25 0>;
+				led-gpios = <&gpio 18 1>;
+
+				gamma = "04 1F 4 7 7 0 7 7 6 0\n0F 00 1 7 4 0 0 0 6 7";
+
+				init = <0x10000e7 0x0010
+					0x1000000 0x0001
+					0x1000001 0x0100
+					0x1000002 0x0700
+				        0x1000003 0x1030
+					0x1000004 0x0000
+					0x1000008 0x0207
+					0x1000009 0x0000
+				        0x100000a 0x0000
+					0x100000c 0x0001
+					0x100000d 0x0000
+					0x100000f 0x0000
+				        0x1000010 0x0000
+					0x1000011 0x0007
+					0x1000012 0x0000
+					0x1000013 0x0000
+				        0x2000032
+					0x1000010 0x1590
+					0x1000011 0x0227
+				        0x2000032
+					0x1000012 0x009c
+				        0x2000032
+				        0x1000013 0x1900
+					0x1000029 0x0023
+					0x100002b 0x000e
+				        0x2000032
+				        0x1000020 0x0000
+					0x1000021 0x0000
+				        0x2000032
+					0x1000050 0x0000
+				        0x1000051 0x00ef
+					0x1000052 0x0000
+					0x1000053 0x013f
+					0x1000060 0xa700
+				        0x1000061 0x0001
+					0x100006a 0x0000
+					0x1000080 0x0000
+					0x1000081 0x0000
+				        0x1000082 0x0000
+					0x1000083 0x0000
+					0x1000084 0x0000
+					0x1000085 0x0000
+				        0x1000090 0x0010
+					0x1000092 0x0000
+					0x1000093 0x0003
+					0x1000095 0x0110
+				        0x1000097 0x0000
+					0x1000098 0x0000
+					0x1000007 0x0133
+					0x1000020 0x0000
+				        0x1000021 0x0000
+				        0x2000064>;
+				debug = <0>;
+			};
+
+			hy28b_ts: hy28b-ts@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+
+				spi-max-frequency = <2000000>;
+				interrupts = <17 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 17 0>;
+				ti,x-plate-ohms = /bits/ 16 <100>;
+				ti,pressure-max = /bits/ 16 <255>;
+			};
+		};
+	};
+	__overrides__ {
+		speed = 	<&hy28b>,"spi-max-frequency:0";
+		rotate = 	<&hy28b>,"rotate:0";
+		fps = 		<&hy28b>,"fps:0";
+		debug = 	<&hy28b>,"debug:0";
+		xohms =		<&hy28b_ts>,"ti,x-plate-ohms;0";
+		resetgpio =	<&hy28b>,"reset-gpios:4",
+				<&hy28b_pins>, "brcm,pins:4";
+		ledgpio =	<&hy28b>,"led-gpios:4",
+				<&hy28b_pins>, "brcm,pins:8";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts b/arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts
new file mode 100644
index 000000000000..0afc6b405414
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c-bcm2708-overlay.dts
@@ -0,0 +1,13 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__overlay__ {
+			compatible = "brcm,bcm2708-i2c";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts b/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts
new file mode 100644
index 000000000000..3f692c1a8958
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c-gpio-overlay.dts
@@ -0,0 +1,43 @@
+// Overlay for i2c_gpio bitbanging host bus.
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+			i2c_gpio: i2c@0 {
+				compatible = "i2c-gpio";
+				gpios = <&gpio 23 0 /* sda */
+					 &gpio 24 0 /* scl */
+					>;
+				i2c-gpio,delay-us = <2>;        /* ~100 kHz */
+				#address-cells = <1>;
+				#size-cells = <0>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target-path = "/aliases";
+		__overlay__ {
+			i2c_gpio = "/i2c@0";
+		};
+	};
+
+	fragment@2 {
+		target-path = "/__symbols__";
+		__overlay__ {
+			i2c_gpio = "/i2c@0";
+		};
+	};
+
+	__overrides__ {
+		i2c_gpio_sda = <&i2c_gpio>,"gpios:4";
+		i2c_gpio_scl = <&i2c_gpio>,"gpios:16";
+		i2c_gpio_delay_us = <&i2c_gpio>,"i2c-gpio,delay-us:0";
+		bus = <&i2c_gpio>, "reg:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts b/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
new file mode 100644
index 000000000000..976d38e78153
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
@@ -0,0 +1,139 @@
+// Umbrella I2C Mux overlay
+
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pca9542: mux@70 {
+				compatible = "nxp,pca9542";
+				reg = <0x70>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				i2c@0 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <0>;
+				};
+				i2c@1 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <1>;
+				};
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pca9545: mux@70 {
+				compatible = "nxp,pca9545";
+				reg = <0x70>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				i2c@0 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <0>;
+				};
+				i2c@1 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <1>;
+				};
+				i2c@2 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <2>;
+				};
+				i2c@3 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <3>;
+				};
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pca9548: mux@70 {
+				compatible = "nxp,pca9548";
+				reg = <0x70>;
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				i2c@0 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <0>;
+				};
+				i2c@1 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <1>;
+				};
+				i2c@2 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <2>;
+				};
+				i2c@3 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <3>;
+				};
+				i2c@4 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <4>;
+				};
+				i2c@5 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <5>;
+				};
+				i2c@6 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <6>;
+				};
+				i2c@7 {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					reg = <7>;
+				};
+			};
+		};
+	};
+
+	__overrides__ {
+		pca9542 = <0>, "+0";
+		pca9545 = <0>, "+1";
+		pca9548 = <0>, "+2";
+
+		addr =  <&pca9542>,"reg:0",
+			<&pca9545>,"reg:0",
+			<&pca9548>,"reg:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts b/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
new file mode 100644
index 000000000000..d1ffd2326669
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
@@ -0,0 +1,26 @@
+// Definitions for NXP PCA9685A I2C PWM controller on ARM I2C bus.
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pca: pca@40 {
+				compatible = "nxp,pca9685";
+				#pwm-cells = <2>;
+				reg = <0x40>;
+				status = "okay";
+			};
+		};
+	};
+	__overrides__ {
+		addr = <&pca>,"reg:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts b/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
new file mode 100644
index 000000000000..8415e6081428
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c-rtc-gpio-overlay.dts
@@ -0,0 +1,183 @@
+// Definitions for several I2C based Real Time Clocks
+// Available through i2c-gpio
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+			i2c_gpio: i2c-gpio-rtc@0 {
+				compatible = "i2c-gpio";
+				gpios = <&gpio 23 0 /* sda */
+					 &gpio 24 0 /* scl */
+					>;
+				i2c-gpio,delay-us = <2>;        /* ~100 kHz */
+				#address-cells = <1>;
+				#size-cells = <0>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			abx80x: abx80x@69 {
+				compatible = "abracon,abx80x";
+				reg = <0x69>;
+				abracon,tc-diode = "standard";
+				abracon,tc-resistor = <0>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ds1307: ds1307@68 {
+				compatible = "maxim,ds1307";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ds1339: ds1339@68 {
+				compatible = "dallas,ds1339";
+				trickle-resistor-ohms = <0>;
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ds3231: ds3231@68 {
+				compatible = "maxim,ds3231";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@5 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			mcp7940x: mcp7940x@6f {
+				compatible = "microchip,mcp7940x";
+				reg = <0x6f>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@6 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			mcp7941x: mcp7941x@6f {
+				compatible = "microchip,mcp7941x";
+				reg = <0x6f>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@7 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcf2127: pcf2127@51 {
+				compatible = "nxp,pcf2127";
+				reg = <0x51>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@8 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcf8523: pcf8523@68 {
+				compatible = "nxp,pcf8523";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@9 {
+		target = <&i2c_gpio>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcf8563: pcf8563@51 {
+				compatible = "nxp,pcf8563";
+				reg = <0x51>;
+				status = "okay";
+			};
+		};
+	};
+
+	__overrides__ {
+		abx80x = <0>,"+1";
+		ds1307 = <0>,"+2";
+		ds1339 = <0>,"+3";
+		ds3231 = <0>,"+4";
+		mcp7940x = <0>,"+5";
+		mcp7941x = <0>,"+6";
+		pcf2127 = <0>,"+7";
+		pcf8523 = <0>,"+8";
+		pcf8563 = <0>,"+9";
+		trickle-diode-type = <&abx80x>,"abracon,tc-diode";
+		trickle-resistor-ohms = <&ds1339>,"trickle-resistor-ohms:0",
+					<&abx80x>,"abracon,tc-resistor";
+		wakeup-source = <&ds1339>,"wakeup-source?",
+				<&ds3231>,"wakeup-source?",
+				<&mcp7940x>,"wakeup-source?",
+					<&mcp7941x>,"wakeup-source?";
+		i2c_gpio_sda = <&i2c_gpio>,"gpios:4";
+		i2c_gpio_scl = <&i2c_gpio>,"gpios:16";
+		i2c_gpio_delay_us = <&i2c_gpio>,"i2c-gpio,delay-us:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
new file mode 100644
index 000000000000..fcb846a50d19
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
@@ -0,0 +1,181 @@
+// Definitions for several I2C based Real Time Clocks
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			abx80x: abx80x@69 {
+				compatible = "abracon,abx80x";
+				reg = <0x69>;
+				abracon,tc-diode = "standard";
+				abracon,tc-resistor = <0>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ds1307: ds1307@68 {
+				compatible = "maxim,ds1307";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ds1339: ds1339@68 {
+				compatible = "dallas,ds1339";
+				trickle-resistor-ohms = <0>;
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ds3231: ds3231@68 {
+				compatible = "maxim,ds3231";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			mcp7940x: mcp7940x@6f {
+				compatible = "microchip,mcp7940x";
+				reg = <0x6f>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@5 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			mcp7941x: mcp7941x@6f {
+				compatible = "microchip,mcp7941x";
+				reg = <0x6f>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@6 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcf2127: pcf2127@51 {
+				compatible = "nxp,pcf2127";
+				reg = <0x51>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@7 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcf8523: pcf8523@68 {
+				compatible = "nxp,pcf8523";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@8 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcf8563: pcf8563@51 {
+				compatible = "nxp,pcf8563";
+				reg = <0x51>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@9 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			m41t62: m41t62@68 {
+				compatible = "st,m41t62";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	__overrides__ {
+		abx80x = <0>,"+0";
+		ds1307 = <0>,"+1";
+		ds1339 = <0>,"+2";
+		ds3231 = <0>,"+3";
+		mcp7940x = <0>,"+4";
+		mcp7941x = <0>,"+5";
+		pcf2127 = <0>,"+6";
+		pcf8523 = <0>,"+7";
+		pcf8563 = <0>,"+8";
+		m41t62 = <0>,"+9";
+		trickle-diode-type = <&abx80x>,"abracon,tc-diode";
+		trickle-resistor-ohms = <&ds1339>,"trickle-resistor-ohms:0",
+					<&abx80x>,"abracon,tc-resistor";
+		wakeup-source = <&ds1339>,"wakeup-source?",
+				<&ds3231>,"wakeup-source?",
+				<&mcp7940x>,"wakeup-source?",
+				<&mcp7941x>,"wakeup-source?",
+				<&m41t62>,"wakeup-source?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts b/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
new file mode 100644
index 000000000000..4b5be8676d11
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
@@ -0,0 +1,223 @@
+// Definitions for I2C based sensors using the Industrial IO or HWMON interface.
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			bme280: bme280@76 {
+				compatible = "bosch,bme280";
+				reg = <0x76>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			bmp085: bmp085@77 {
+				compatible = "bosch,bmp085";
+				reg = <0x77>;
+				default-oversampling = <3>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			bmp180: bmp180@77 {
+				compatible = "bosch,bmp180";
+				reg = <0x77>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			bmp280: bmp280@76 {
+				compatible = "bosch,bmp280";
+				reg = <0x76>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			htu21: htu21@40 {
+				compatible = "htu21";
+				reg = <0x40>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@5 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			lm75: lm75@4f {
+				compatible = "lm75";
+				reg = <0x4f>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@6 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			si7020: si7020@40 {
+				compatible = "si7020";
+				reg = <0x40>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@7 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			tmp102: tmp102@48 {
+				compatible = "ti,tmp102";
+				reg = <0x48>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@8 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			hdc100x: hdc100x@40 {
+				compatible = "hdc100x";
+				reg = <0x40>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@9 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			tsl4531: tsl4531@29 {
+				compatible = "tsl4531";
+				reg = <0x29>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@10 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			veml6070: veml6070@38 {
+				compatible = "veml6070";
+				reg = <0x38>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@11 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			sht3x: sht3x@44 {
+				compatible = "sht3x";
+				reg = <0x44>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@12 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ds1621: ds1621@48 {
+				compatible = "ds1621";
+				reg = <0x48>;
+				status = "okay";
+			};
+		};
+	};
+
+	__overrides__ {
+		addr =  <&bme280>,"reg:0", <&bmp280>,"reg:0", <&tmp102>,"reg:0",
+			<&lm75>,"reg:0", <&hdc100x>,"reg:0", <&sht3x>,"reg:0",
+			<&ds1621>,"reg:0";
+		bme280 = <0>,"+0";
+		bmp085 = <0>,"+1";
+		bmp180 = <0>,"+2";
+		bmp280 = <0>,"+3";
+		htu21 = <0>,"+4";
+		lm75 = <0>,"+5";
+		lm75addr = <&lm75>,"reg:0";
+		si7020 = <0>,"+6";
+		tmp102 = <0>,"+7";
+		hdc100x = <0>,"+8";
+		tsl4531 = <0>,"+9";
+		veml6070 = <0>,"+10";
+		sht3x = <0>,"+11";
+		ds1621 = <0>,"+12";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/i2c0-bcm2708-overlay.dts b/arch/arm/boot/dts/overlays/i2c0-bcm2708-overlay.dts
new file mode 100644
index 000000000000..9b5776f1bf6a
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c0-bcm2708-overlay.dts
@@ -0,0 +1,69 @@
+/*
+ * Device tree overlay for i2c_bcm2708, i2c0 bus
+ *
+ * Compile:
+ * dtc -@ -I dts -O dtb -o i2c0-bcm2708-overlay.dtb i2c0-bcm2708-overlay.dts
+ */
+
+/dts-v1/;
+/plugin/;
+
+/{
+   compatible = "brcm,bcm2708";
+
+   fragment@0 {
+      target = <&i2c0>;
+      __overlay__ {
+         status = "okay";
+      };
+   };
+
+   fragment@1 {
+      target = <&i2c0_pins>;
+      frag1: __overlay__ {
+         brcm,pins = <0 1>;
+         brcm,function = <4>; /* alt0 */
+      };
+   };
+
+   fragment@2 {
+      target = <&i2c0_pins>;
+      __dormant__ {
+         brcm,pins = <28 29>;
+         brcm,function = <4>; /* alt0 */
+      };
+   };
+
+   fragment@3 {
+      target = <&i2c0_pins>;
+      __dormant__ {
+         brcm,pins = <44 45>;
+         brcm,function = <5>; /* alt1 */
+      };
+   };
+
+   fragment@4 {
+      target = <&i2c0_pins>;
+      __dormant__ {
+         brcm,pins = <46 47>;
+         brcm,function = <4>; /* alt0 */
+      };
+   };
+
+   fragment@5 {
+      target = <&i2c0>;
+      __dormant__ {
+         compatible = "brcm,bcm2708-i2c";
+      };
+   };
+
+   __overrides__ {
+      sda0_pin = <&frag1>,"brcm,pins:0";
+      scl0_pin = <&frag1>,"brcm,pins:4";
+      pins_0_1   = <0>,"+1-2-3-4";
+      pins_28_29 = <0>,"-1+2-3-4";
+      pins_44_45 = <0>,"-1-2+3-4";
+      pins_46_47 = <0>,"-1-2-3+4";
+      combine = <0>, "!5";
+   };
+};
diff --git a/arch/arm/boot/dts/overlays/i2c1-bcm2708-overlay.dts b/arch/arm/boot/dts/overlays/i2c1-bcm2708-overlay.dts
new file mode 100644
index 000000000000..c9da3eea0012
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2c1-bcm2708-overlay.dts
@@ -0,0 +1,43 @@
+/*
+ * Device tree overlay for i2c_bcm2708, i2c1 bus
+ *
+ * Compile:
+ * dtc -@ -I dts -O dtb -o i2c1-bcm2708-overlay.dtb i2c1-bcm2708-overlay.dts
+ */
+
+/dts-v1/;
+/plugin/;
+
+/{
+   compatible = "brcm,bcm2708";
+
+   fragment@0 {
+      target = <&i2c1>;
+      __overlay__ {
+         pinctrl-0 = <&i2c1_pins>;
+         status = "okay";
+      };
+   };
+
+   fragment@1 {
+      target = <&i2c1_pins>;
+         pins: __overlay__ {
+         brcm,pins = <2 3>;
+         brcm,function = <4>; /* alt 0 */
+      };
+   };
+
+   fragment@2 {
+      target = <&i2c1>;
+      __dormant__ {
+         compatible = "brcm,bcm2708-i2c";
+      };
+   };
+
+   __overrides__ {
+      sda1_pin = <&pins>,"brcm,pins:0";
+      scl1_pin = <&pins>,"brcm,pins:4";
+      pin_func = <&pins>,"brcm,function:0";
+      combine = <0>, "!2";
+   };
+};
diff --git a/arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts b/arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts
new file mode 100644
index 000000000000..30c356d6070c
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/i2s-gpio28-31-overlay.dts
@@ -0,0 +1,18 @@
+/*
+ * Device tree overlay to move i2s to gpio 28 to 31 on CM
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&i2s_pins>;
+		__overlay__ {
+			brcm,pins = <28 29 30 31>;
+			brcm,function = <6>; /* alt2 */
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts b/arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts
new file mode 100644
index 000000000000..f16586f05971
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/iqaudio-dac-overlay.dts
@@ -0,0 +1,46 @@
+// Definitions for IQaudIO DAC
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcm5122@4c {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				reg = <0x4c>;
+				AVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				CPVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		frag2: __overlay__ {
+			compatible = "iqaudio,iqaudio-dac";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain = <&frag2>,"iqaudio,24db_digital_gain?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts b/arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts
new file mode 100644
index 000000000000..4dcf17515f95
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/iqaudio-dacplus-overlay.dts
@@ -0,0 +1,49 @@
+// Definitions for IQaudIO DAC+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcm5122@4c {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				reg = <0x4c>;
+				AVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				CPVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		iqaudio_dac: __overlay__ {
+			compatible = "iqaudio,iqaudio-dac";
+			i2s-controller = <&i2s>;
+			mute-gpios = <&gpio 22 0>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain = <&iqaudio_dac>,"iqaudio,24db_digital_gain?";
+		auto_mute_amp = <&iqaudio_dac>,"iqaudio-dac,auto-mute-amp?";
+		unmute_amp = <&iqaudio_dac>,"iqaudio-dac,unmute-amp?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts b/arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts
new file mode 100644
index 000000000000..b86e1e5edc89
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/iqaudio-digi-wm8804-audio-overlay.dts
@@ -0,0 +1,47 @@
+// Definitions for IQAudIO Digi WM8804 audio board
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			wm8804@3b {
+				#sound-dai-cells = <0>;
+				compatible = "wlf,wm8804";
+				reg = <0x3b>;
+				status = "okay";
+				DVDD-supply = <&vdd_3v3_reg>;
+				PVDD-supply = <&vdd_3v3_reg>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		wm8804_digi: __overlay__ {
+			compatible = "iqaudio,wm8804-digi";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		card_name = <&wm8804_digi>,"wm8804-digi,card-name";
+		dai_name = <&wm8804_digi>,"wm8804-digi,dai-name";
+		dai_stream_name = <&wm8804_digi>,"wm8804-digi,dai-stream-name";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts b/arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts
new file mode 100644
index 000000000000..279e22efc013
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/jedec-spi-nor-overlay.dts
@@ -0,0 +1,309 @@
+// Overlay for JEDEC SPI-NOR Flash Devices (aka m25p80)
+
+// dtparams:
+//     flash-spi<n>-<m>        - Enables flash device on SPI<n>, CS#<m>.
+//     flash-fastr-spi<n>-<m>  - Enables flash device with fast read capability on SPI<n>, CS#<m>.
+//
+// If devices are present on SPI1 or SPI2, those interfaces must be enabled with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
+//
+// Example: A single flash device with fast read capability on SPI0, CS#0:
+// dtoverlay=jedec-spi-nor:flash-fastr-spi0-0
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	// disable spi-dev on spi0.0
+	fragment@0 {
+		target = <&spidev0>;
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi0.1
+	fragment@1 {
+		target = <&spidev1>;
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi1.0
+	fragment@2 {
+		target-path = "spi1/spidev@0";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi1.1
+	fragment@3 {
+		target-path = "spi1/spidev@1";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi1.2
+	fragment@4 {
+		target-path = "spi1/spidev@2";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi2.0
+	fragment@5 {
+		target-path = "spi2/spidev@0";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi2.1
+	fragment@6 {
+		target-path = "spi2/spidev@1";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi2.2
+	fragment@7 {
+		target-path = "spi2/spidev@2";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// enable flash on spi0.0
+	fragment@8 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			spi_nor_00: spi_nor@0 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				compatible = "jedec,spi-nor";
+				reg = <0>;
+				spi-max-frequency = <500000>;
+			};
+		};
+	};
+
+	// enable flash on spi0.1
+	fragment@9 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			spi_nor_01: spi_nor@1 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				compatible = "jedec,spi-nor";
+				reg = <1>;
+				spi-max-frequency = <500000>;
+			};
+		};
+	};
+
+	// enable flash on spi1.0
+	fragment@10 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			spi_nor_10: spi_nor@0 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				compatible = "jedec,spi-nor";
+				reg = <0>;
+				spi-max-frequency = <500000>;
+			};
+		};
+	};
+
+	// enable flash on spi1.1
+	fragment@11 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			spi_nor_11: spi_nor@1 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				compatible = "jedec,spi-nor";
+				reg = <1>;
+				spi-max-frequency = <500000>;
+			};
+		};
+	};
+
+	// enable flash on spi1.2
+	fragment@12 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			spi_nor_12: spi_nor@2 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				compatible = "jedec,spi-nor";
+				reg = <2>;
+				spi-max-frequency = <500000>;
+			};
+		};
+	};
+
+	// enable flash on spi2.0
+	fragment@13 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			spi_nor_20: spi_nor@0 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				compatible = "jedec,spi-nor";
+				reg = <0>;
+				spi-max-frequency = <500000>;
+			};
+		};
+	};
+
+	// enable flash on spi2.1
+	fragment@14 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			spi_nor_21: spi_nor@1 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				compatible = "jedec,spi-nor";
+				reg = <1>;
+				spi-max-frequency = <500000>;
+			};
+		};
+	};
+
+	// enable flash on spi2.2
+	fragment@15 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			spi_nor_22: spi_nor@2 {
+				#address-cells = <1>;
+				#size-cells = <1>;
+				compatible = "jedec,spi-nor";
+				reg = <2>;
+				spi-max-frequency = <500000>;
+			};
+		};
+	};
+
+	// Enable fast read for device on spi0.0.
+	// Use default active low interrupt signalling.
+	fragment@16 {
+		target = <&spi_nor_00>;
+		__dormant__ {
+			m25p,fast-read;
+		};
+	};
+
+	// Enable fast read for device on spi0.1.
+	// Use default active low interrupt signalling.
+	fragment@17 {
+		target = <&spi_nor_01>;
+		__dormant__ {
+			m25p,fast-read;
+		};
+	};
+
+	// Enable fast read for device on spi1.0.
+	// Use default active low interrupt signalling.
+	fragment@18 {
+		target = <&spi_nor_10>;
+		__dormant__ {
+			m25p,fast-read;
+		};
+	};
+
+	// Enable fast read for device on spi1.1.
+	// Use default active low interrupt signalling.
+	fragment@19 {
+		target = <&spi_nor_11>;
+		__dormant__ {
+			m25p,fast-read;
+		};
+	};
+
+	// Enable fast read for device on spi1.2.
+	// Use default active low interrupt signalling.
+	fragment@20 {
+		target = <&spi_nor_12>;
+		__dormant__ {
+			m25p,fast-read;
+		};
+	};
+
+	// Enable fast read for device on spi2.0.
+	// Use default active low interrupt signalling.
+	fragment@21 {
+		target = <&spi_nor_20>;
+		__dormant__ {
+			m25p,fast-read;
+		};
+	};
+
+	// Enable fast read for device on spi2.1.
+	// Use default active low interrupt signalling.
+	fragment@22 {
+		target = <&spi_nor_21>;
+		__dormant__ {
+			m25p,fast-read;
+		};
+	};
+
+	// Enable fast read for device on spi2.2.
+	// Use default active low interrupt signalling.
+	fragment@23 {
+		target = <&spi_nor_22>;
+		__dormant__ {
+			m25p,fast-read;
+		};
+	};
+
+	__overrides__ {
+		flash-spi0-0       = <0>,"+0+8";
+		flash-spi0-1       = <0>,"+1+9";
+		flash-spi1-0       = <0>,"+2+10";
+		flash-spi1-1       = <0>,"+3+11";
+		flash-spi1-2       = <0>,"+4+12";
+		flash-spi2-0       = <0>,"+5+13";
+		flash-spi2-1       = <0>,"+6+14";
+		flash-spi2-2       = <0>,"+7+15";
+		flash-fastr-spi0-0 = <0>,"+0+8+16";
+		flash-fastr-spi0-1 = <0>,"+1+9+17";
+		flash-fastr-spi1-0 = <0>,"+2+10+18";
+		flash-fastr-spi1-1 = <0>,"+3+11+19";
+		flash-fastr-spi1-2 = <0>,"+4+12+20";
+		flash-fastr-spi2-0 = <0>,"+5+13+21";
+		flash-fastr-spi2-1 = <0>,"+6+14+22";
+		flash-fastr-spi2-2 = <0>,"+7+15+23";
+	};
+};
+
diff --git a/arch/arm/boot/dts/overlays/justboom-dac-overlay.dts b/arch/arm/boot/dts/overlays/justboom-dac-overlay.dts
new file mode 100644
index 000000000000..2b8dba0c231b
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/justboom-dac-overlay.dts
@@ -0,0 +1,46 @@
+// Definitions for JustBoom DAC
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			pcm5122@4d {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5122";
+				reg = <0x4d>;
+				AVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				CPVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		frag2: __overlay__ {
+			compatible = "justboom,justboom-dac";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		24db_digital_gain = <&frag2>,"justboom,24db_digital_gain?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/justboom-digi-overlay.dts b/arch/arm/boot/dts/overlays/justboom-digi-overlay.dts
new file mode 100644
index 000000000000..1212e3ff591b
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/justboom-digi-overlay.dts
@@ -0,0 +1,41 @@
+// Definitions for JustBoom Digi
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			wm8804@3b {
+				#sound-dai-cells = <0>;
+				compatible = "wlf,wm8804";
+				reg = <0x3b>;
+				PVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "justboom,justboom-digi";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/lirc-rpi-overlay.dts b/arch/arm/boot/dts/overlays/lirc-rpi-overlay.dts
new file mode 100644
index 000000000000..7d5d82bdf4c4
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/lirc-rpi-overlay.dts
@@ -0,0 +1,57 @@
+// Definitions for lirc-rpi module
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+			lirc_rpi: lirc_rpi {
+				compatible = "rpi,lirc-rpi";
+				pinctrl-names = "default";
+				pinctrl-0 = <&lirc_pins>;
+				status = "okay";
+
+				// Override autodetection of IR receiver circuit
+				// (0 = active high, 1 = active low, -1 = no override )
+				rpi,sense = <0xffffffff>;
+
+				// Software carrier
+				// (0 = off, 1 = on)
+				rpi,softcarrier = <1>;
+
+				// Invert output
+				// (0 = off, 1 = on)
+				rpi,invert = <0>;
+
+				// Enable debugging messages
+				// (0 = off, 1 = on)
+				rpi,debug = <0>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			lirc_pins: lirc_pins {
+				brcm,pins = <17 18>;
+				brcm,function = <1 0>; // out in
+				brcm,pull = <0 1>; // off down
+			};
+		};
+	};
+
+	__overrides__ {
+		gpio_out_pin =  <&lirc_pins>,"brcm,pins:0";
+		gpio_in_pin =   <&lirc_pins>,"brcm,pins:4";
+		gpio_in_pull =  <&lirc_pins>,"brcm,pull:4";
+
+		sense =         <&lirc_rpi>,"rpi,sense:0";
+		softcarrier =   <&lirc_rpi>,"rpi,softcarrier:0";
+		invert =        <&lirc_rpi>,"rpi,invert:0";
+		debug =         <&lirc_rpi>,"rpi,debug:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/ltc294x-overlay.dts b/arch/arm/boot/dts/overlays/ltc294x-overlay.dts
new file mode 100644
index 000000000000..6d971f3649ca
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/ltc294x-overlay.dts
@@ -0,0 +1,86 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ltc2941: ltc2941@64 {
+				compatible = "lltc,ltc2941";
+				reg = <0x64>;
+				lltc,resistor-sense = <50>;
+				lltc,prescaler-exponent = <7>; 
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ltc2942: ltc2942@64 {
+				compatible = "lltc,ltc2942";
+				reg = <0x64>;
+				lltc,resistor-sense = <50>;
+				lltc,prescaler-exponent = <7>; 
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ltc2943: ltc2943@64 {
+				compatible = "lltc,ltc2943";
+				reg = <0x64>;
+				lltc,resistor-sense = <50>;
+				lltc,prescaler-exponent = <7>; 
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&i2c_arm>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			ltc2944: ltc2944@64 {
+				compatible = "lltc,ltc2944";
+				reg = <0x64>;
+				lltc,resistor-sense = <50>;
+				lltc,prescaler-exponent = <7>; 
+			};
+		};
+	};
+
+	__overrides__ {
+		ltc2941 = <0>,"+0";
+		ltc2942 = <0>,"+1";
+		ltc2943 = <0>,"+2";
+		ltc2944 = <0>,"+3";
+		resistor-sense = <&ltc2941>, "lltc,resistor-sense:0",
+			         <&ltc2942>, "lltc,resistor-sense:0",
+				 <&ltc2943>, "lltc,resistor-sense:0",
+				 <&ltc2944>, "lltc,resistor-sense:0";
+		prescaler-exponent = <&ltc2941>, "lltc,prescaler-exponent:0",
+			         <&ltc2942>, "lltc,prescaler-exponent:0",
+				 <&ltc2943>, "lltc,prescaler-exponent:0",
+				 <&ltc2944>, "lltc,prescaler-exponent:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/mbed-dac-overlay.dts b/arch/arm/boot/dts/overlays/mbed-dac-overlay.dts
new file mode 100644
index 000000000000..313563d6ed47
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mbed-dac-overlay.dts
@@ -0,0 +1,64 @@
+// Definitions for mbed DAC
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+                        #size-cells = <0>;
+			status = "okay";
+
+			tlv320aic23: codec@1a {
+				#sound-dai-cells = <0>;
+				reg = <0x1a>;
+				compatible = "ti,tlv320aic23";
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "simple-audio-card";
+			i2s-controller = <&i2s>;
+			status = "okay";
+
+			simple-audio-card,name = "mbed-DAC";
+
+			simple-audio-card,widgets =
+				"Microphone", "Mic Jack",
+				"Line", "Line In",
+				"Headphone", "Headphone Jack";
+
+			simple-audio-card,routing =
+				"Headphone Jack", "LHPOUT",
+				"Headphone Jack", "RHPOUT",
+				"LLINEIN", "Line In",
+				"RLINEIN", "Line In",
+				"MICIN", "Mic Jack";
+
+			simple-audio-card,format = "i2s";
+
+			simple-audio-card,cpu {
+				sound-dai = <&i2s>;
+			};
+
+			sound_master: simple-audio-card,codec {
+				sound-dai = <&tlv320aic23>;
+				system-clock-frequency = <12288000>;
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/mcp23017-overlay.dts b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
new file mode 100644
index 000000000000..412f966a3cc0
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
@@ -0,0 +1,54 @@
+// Definitions for MCP23017 Gpio Extender from Microchip Semiconductor
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&i2c1>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			mcp23017_pins: mcp23017_pins {
+				brcm,pins = <4>;
+				brcm,function = <0>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp23017: mcp@20 {
+				compatible = "microchip,mcp23017";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells=<2>;
+				interrupt-parent = <&gpio>;
+				interrupts = <4 2>;
+				interrupt-controller;
+				microchip,irq-mirror;
+
+				status = "okay";
+			};
+		};
+	};
+	
+	__overrides__ {
+		gpiopin = <&mcp23017_pins>,"brcm,pins:0",
+				<&mcp23017>,"interrupts:0";
+		addr = <&mcp23017>,"reg:0";
+	};
+};
+
diff --git a/arch/arm/boot/dts/overlays/mcp23s17-overlay.dts b/arch/arm/boot/dts/overlays/mcp23s17-overlay.dts
new file mode 100644
index 000000000000..7dcbacb3cd00
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mcp23s17-overlay.dts
@@ -0,0 +1,732 @@
+// Overlay for MCP23S08/17 GPIO Extenders from Microchip Semiconductor
+
+// dtparams:
+//     s08-spi<n>-<m>-present  - 4-bit integer, bitmap indicating MCP23S08 devices present on SPI<n>, CS#<m>.
+//     s17-spi<n>-<m>-present  - 8-bit integer, bitmap indicating MCP23S17 devices present on SPI<n>, CS#<m>.
+//     s08-spi<n>-<m>-int-gpio - integer, enables interrupts on a single MCP23S08 device on SPI<n>, CS#<m>, specifies the GPIO pin to which INT output is connected.
+//     s17-spi<n>-<m>-int-gpio - integer, enables mirrored interrupts on a single MCP23S17 device on SPI<n>, CS#<m>, specifies the GPIO pin to which either INTA or INTB output is connected.
+//
+// If devices are present on SPI1 or SPI2, those interfaces must be enabled with one of the spi1-1/2/3cs and/or spi2-1/2/3cs overlays.
+// If interrupts are enabled for a device on a given CS# on a SPI bus, that device must be the only one present on that SPI bus/CS#.
+//
+// Example 1: A single MCP23S17 device on SPI0, CS#0 with its SPI addr set to 0 and INTA output connected to GPIO25:
+// dtoverlay=mcp23s17:s17-spi0-0-present=1,s17-spi0-0-int-gpio=25
+//
+// Example 2: Two MCP23S08 devices on SPI1, CS#0 with their addrs set to 2 and 3. Three MCP23S17 devices on SPI1, CS#1 with their addrs set to 0, 1 and 7:
+// dtoverlay=spi1-2cs
+// dtoverlay=mcp23s17:s08-spi1-0-present=12,s17-spi1-1-present=131
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	// disable spi-dev on spi0.0
+	fragment@0 {
+		target = <&spidev0>;
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi0.1
+	fragment@1 {
+		target = <&spidev1>;
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi1.0
+	fragment@2 {
+		target-path = "spi1/spidev@0";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi1.1
+	fragment@3 {
+		target-path = "spi1/spidev@1";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi1.2
+	fragment@4 {
+		target-path = "spi1/spidev@2";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi2.0
+	fragment@5 {
+		target-path = "spi2/spidev@0";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi2.1
+	fragment@6 {
+		target-path = "spi2/spidev@1";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// disable spi-dev on spi2.2
+	fragment@7 {
+		target-path = "spi2/spidev@2";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	// enable one or more mcp23s08s on spi0.0
+	fragment@8 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s08_00: mcp23s08@0 {
+				compatible = "microchip,mcp23s08";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi0-0-present parameter */
+     				reg = <0>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi0-0-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s08s on spi0.1
+	fragment@9 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s08_01: mcp23s08@1 {
+				compatible = "microchip,mcp23s08";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi0-1-present parameter */
+     				reg = <1>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi0-1-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s08s on spi1.0
+	fragment@10 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s08_10: mcp23s08@0 {
+				compatible = "microchip,mcp23s08";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi1-0-present parameter */
+     				reg = <0>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi1-0-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s08s on spi1.1
+	fragment@11 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s08_11: mcp23s08@1 {
+				compatible = "microchip,mcp23s08";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi1-1-present parameter */
+     				reg = <1>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi1-1-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s08s on spi1.2
+	fragment@12 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s08_12: mcp23s08@2 {
+				compatible = "microchip,mcp23s08";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi1-2-present parameter */
+     				reg = <2>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi1-2-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s08s on spi2.0
+	fragment@13 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s08_20: mcp23s08@0 {
+				compatible = "microchip,mcp23s08";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi2-0-present parameter */
+     				reg = <0>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi2-0-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s08s on spi2.1
+	fragment@14 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s08_21: mcp23s08@1 {
+				compatible = "microchip,mcp23s08";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi2-1-present parameter */
+     				reg = <1>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi2-1-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s08s on spi2.2
+	fragment@15 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s08_22: mcp23s08@2 {
+				compatible = "microchip,mcp23s08";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s08-spi2-2-present parameter */
+     				reg = <2>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s08-spi2-2-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s17s on spi0.0
+	fragment@16 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s17_00: mcp23s17@0 {
+				compatible = "microchip,mcp23s17";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi0-0-present parameter */
+     				reg = <0>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi0-0-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s17s on spi0.1
+	fragment@17 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s17_01: mcp23s17@1 {
+				compatible = "microchip,mcp23s17";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi0-1-present parameter */
+     				reg = <1>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi0-1-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s17s on spi1.0
+	fragment@18 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s17_10: mcp23s17@0 {
+				compatible = "microchip,mcp23s17";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi1-0-present parameter */
+     				reg = <0>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi1-0-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s17s on spi1.1
+	fragment@19 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s17_11: mcp23s17@1 {
+				compatible = "microchip,mcp23s17";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi1-1-present parameter */
+     				reg = <1>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi1-1-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s17s on spi1.2
+	fragment@20 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s17_12: mcp23s17@2 {
+				compatible = "microchip,mcp23s17";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi1-2-present parameter */
+     				reg = <2>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi1-2-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s17s on spi2.0
+	fragment@21 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s17_20: mcp23s17@0 {
+				compatible = "microchip,mcp23s17";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi2-0-present parameter */
+     				reg = <0>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi2-0-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s17s on spi2.1
+	fragment@22 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s17_21: mcp23s17@1 {
+				compatible = "microchip,mcp23s17";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi2-1-present parameter */
+     				reg = <1>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi2-1-int-gpio parameter */
+			};
+		};
+	};
+
+	// enable one or more mcp23s17s on spi2.2
+	fragment@23 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+			mcp23s17_22: mcp23s17@2 {
+				compatible = "microchip,mcp23s17";
+  				gpio-controller;
+  				#gpio-cells = <2>;
+    				microchip,spi-present-mask = <0x00>;  /* overwritten by mcp23s17-spi2-2-present parameter */
+     				reg = <2>;
+    				spi-max-frequency = <500000>;
+				status = "okay";
+				#interrupt-cells=<2>;
+				interrupts = <0 2>;  /* 1st word overwritten by mcp23s17-spi2-2-int-gpio parameter */
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi0.0 as a input with no pull-up/down
+	fragment@24 {
+		target = <&gpio>;
+		__dormant__ {
+			spi0_0_int_pins: spi0_0_int_pins {
+				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi0-0-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi0.1 as a input with no pull-up/down
+	fragment@25 {
+		target = <&gpio>;
+		__dormant__ {
+			spi0_1_int_pins: spi0_1_int_pins {
+				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi0-1-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi1.0 as a input with no pull-up/down
+	fragment@26 {
+		target = <&gpio>;
+		__dormant__ {
+			spi1_0_int_pins: spi1_0_int_pins {
+				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi1-0-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi1.1 as a input with no pull-up/down
+	fragment@27 {
+		target = <&gpio>;
+		__dormant__ {
+			spi1_1_int_pins: spi1_1_int_pins {
+				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi1-1-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi1.2 as a input with no pull-up/down
+	fragment@28 {
+		target = <&gpio>;
+		__dormant__ {
+			spi1_2_int_pins: spi1_2_int_pins {
+				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi1-2-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi2.0 as a input with no pull-up/down
+	fragment@29 {
+		target = <&gpio>;
+		__dormant__ {
+			spi2_0_int_pins: spi2_0_int_pins {
+				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi2-0-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi2.1 as a input with no pull-up/down
+	fragment@30 {
+		target = <&gpio>;
+		__dormant__ {
+			spi2_1_int_pins: spi2_1_int_pins {
+				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi2-1-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to INT(A/B) output of mcp23s08/17 on spi2.2 as a input with no pull-up/down
+	fragment@31 {
+		target = <&gpio>;
+		__dormant__ {
+			spi2_2_int_pins: spi2_2_int_pins {
+				brcm,pins = <0>;  /* overwritten by mcp23s08/17-spi2-2-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Enable interrupts for a mcp23s08 on spi0.0.
+	// Use default active low interrupt signalling.
+	fragment@32 {
+		target = <&mcp23s08_00>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+		};
+	};
+
+	// Enable interrupts for a mcp23s08 on spi0.1.
+	// Use default active low interrupt signalling.
+	fragment@33 {
+		target = <&mcp23s08_01>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+		};
+	};
+
+	// Enable interrupts for a mcp23s08 on spi1.0.
+	// Use default active low interrupt signalling.
+	fragment@34 {
+		target = <&mcp23s08_10>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+		};
+	};
+
+	// Enable interrupts for a mcp23s08 on spi1.1.
+	// Use default active low interrupt signalling.
+	fragment@35 {
+		target = <&mcp23s08_11>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+		};
+	};
+
+	// Enable interrupts for a mcp23s08 on spi1.2.
+	// Use default active low interrupt signalling.
+	fragment@36 {
+		target = <&mcp23s08_12>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+		};
+	};
+
+	// Enable interrupts for a mcp23s08 on spi2.0.
+	// Use default active low interrupt signalling.
+	fragment@37 {
+		target = <&mcp23s08_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+		};
+	};
+
+	// Enable interrupts for a mcp23s08 on spi2.1.
+	// Use default active low interrupt signalling.
+	fragment@38 {
+		target = <&mcp23s08_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+		};
+	};
+
+	// Enable interrupts for a mcp23s08 on spi2.2.
+	// Use default active low interrupt signalling.
+	fragment@39 {
+		target = <&mcp23s08_22>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+		};
+	};
+
+	// Enable interrupts for a mcp23s17 on spi0.0.
+	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
+	// Use default active low interrupt signalling.
+	fragment@40 {
+		target = <&mcp23s17_00>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			microchip,irq-mirror;
+		};
+	};
+
+	// Enable interrupts for a mcp23s17 on spi0.1.
+	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
+	// Configure INTA/B outputs of mcp23s08/17 as active low.
+	fragment@41 {
+		target = <&mcp23s17_01>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			microchip,irq-mirror;
+		};
+	};
+
+	// Enable interrupts for a mcp23s17 on spi1.0.
+	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
+	// Configure INTA/B outputs of mcp23s08/17 as active low.
+	fragment@42 {
+		target = <&mcp23s17_10>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			microchip,irq-mirror;
+		};
+	};
+
+	// Enable interrupts for a mcp23s17 on spi1.1.
+	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
+	// Configure INTA/B outputs of mcp23s08/17 as active low.
+	fragment@43 {
+		target = <&mcp23s17_11>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			microchip,irq-mirror;
+		};
+	};
+
+	// Enable interrupts for a mcp23s17 on spi1.2.
+	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
+	// Configure INTA/B outputs of mcp23s08/17 as active low.
+	fragment@44 {
+		target = <&mcp23s17_12>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			microchip,irq-mirror;
+		};
+	};
+
+	// Enable interrupts for a mcp23s17 on spi2.0.
+	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
+	// Configure INTA/B outputs of mcp23s08/17 as active low.
+	fragment@45 {
+		target = <&mcp23s17_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			microchip,irq-mirror;
+		};
+	};
+
+	// Enable interrupts for a mcp23s17 on spi2.1.
+	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
+	// Configure INTA/B outputs of mcp23s08/17 as active low.
+	fragment@46 {
+		target = <&mcp23s17_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			microchip,irq-mirror;
+		};
+	};
+
+	// Enable interrupts for a mcp23s17 on spi2.2.
+	// Enable mirroring so that either INTA or INTB output of mcp23s17 can be connected to the GPIO pin.
+	// Configure INTA/B outputs of mcp23s08/17 as active low.
+	fragment@47 {
+		target = <&mcp23s17_22>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			microchip,irq-mirror;
+		};
+	};
+
+	__overrides__ {
+		s08-spi0-0-present = <0>,"+0+8",  <&mcp23s08_00>,"microchip,spi-present-mask:0";
+		s08-spi0-1-present = <0>,"+1+9",  <&mcp23s08_01>,"microchip,spi-present-mask:0";
+		s08-spi1-0-present = <0>,"+2+10", <&mcp23s08_10>,"microchip,spi-present-mask:0";
+		s08-spi1-1-present = <0>,"+3+11", <&mcp23s08_11>,"microchip,spi-present-mask:0";
+		s08-spi1-2-present = <0>,"+4+12", <&mcp23s08_12>,"microchip,spi-present-mask:0";
+		s08-spi2-0-present = <0>,"+5+13", <&mcp23s08_20>,"microchip,spi-present-mask:0";
+		s08-spi2-1-present = <0>,"+6+14", <&mcp23s08_21>,"microchip,spi-present-mask:0";
+		s08-spi2-2-present = <0>,"+7+15", <&mcp23s08_22>,"microchip,spi-present-mask:0";
+		s17-spi0-0-present = <0>,"+0+16", <&mcp23s17_00>,"microchip,spi-present-mask:0";
+		s17-spi0-1-present = <0>,"+1+17", <&mcp23s17_01>,"microchip,spi-present-mask:0";
+		s17-spi1-0-present = <0>,"+2+18", <&mcp23s17_10>,"microchip,spi-present-mask:0";
+		s17-spi1-1-present = <0>,"+3+19", <&mcp23s17_11>,"microchip,spi-present-mask:0";
+		s17-spi1-2-present = <0>,"+4+20", <&mcp23s17_12>,"microchip,spi-present-mask:0";
+		s17-spi2-0-present = <0>,"+5+21", <&mcp23s17_20>,"microchip,spi-present-mask:0";
+		s17-spi2-1-present = <0>,"+6+22", <&mcp23s17_21>,"microchip,spi-present-mask:0";
+		s17-spi2-2-present = <0>,"+7+23", <&mcp23s17_22>,"microchip,spi-present-mask:0";
+		s08-spi0-0-int-gpio = <0>,"+24+32", <&spi0_0_int_pins>,"brcm,pins:0", <&mcp23s08_00>,"interrupts:0";
+		s08-spi0-1-int-gpio = <0>,"+25+33", <&spi0_1_int_pins>,"brcm,pins:0", <&mcp23s08_01>,"interrupts:0";
+		s08-spi1-0-int-gpio = <0>,"+26+34", <&spi1_0_int_pins>,"brcm,pins:0", <&mcp23s08_10>,"interrupts:0";
+		s08-spi1-1-int-gpio = <0>,"+27+35", <&spi1_1_int_pins>,"brcm,pins:0", <&mcp23s08_11>,"interrupts:0";
+		s08-spi1-2-int-gpio = <0>,"+28+36", <&spi1_2_int_pins>,"brcm,pins:0", <&mcp23s08_12>,"interrupts:0";
+		s08-spi2-0-int-gpio = <0>,"+29+37", <&spi2_0_int_pins>,"brcm,pins:0", <&mcp23s08_20>,"interrupts:0";
+		s08-spi2-1-int-gpio = <0>,"+30+38", <&spi2_1_int_pins>,"brcm,pins:0", <&mcp23s08_21>,"interrupts:0";
+		s08-spi2-2-int-gpio = <0>,"+31+39", <&spi2_2_int_pins>,"brcm,pins:0", <&mcp23s08_22>,"interrupts:0";
+		s17-spi0-0-int-gpio = <0>,"+24+40", <&spi0_0_int_pins>,"brcm,pins:0", <&mcp23s17_00>,"interrupts:0";
+		s17-spi0-1-int-gpio = <0>,"+25+41", <&spi0_1_int_pins>,"brcm,pins:0", <&mcp23s17_01>,"interrupts:0";
+		s17-spi1-0-int-gpio = <0>,"+26+42", <&spi1_0_int_pins>,"brcm,pins:0", <&mcp23s17_10>,"interrupts:0";
+		s17-spi1-1-int-gpio = <0>,"+27+43", <&spi1_1_int_pins>,"brcm,pins:0", <&mcp23s17_11>,"interrupts:0";
+		s17-spi1-2-int-gpio = <0>,"+28+44", <&spi1_2_int_pins>,"brcm,pins:0", <&mcp23s17_12>,"interrupts:0";
+		s17-spi2-0-int-gpio = <0>,"+29+45", <&spi2_0_int_pins>,"brcm,pins:0", <&mcp23s17_20>,"interrupts:0";
+		s17-spi2-1-int-gpio = <0>,"+30+46", <&spi2_1_int_pins>,"brcm,pins:0", <&mcp23s17_21>,"interrupts:0";
+		s17-spi2-2-int-gpio = <0>,"+31+47", <&spi2_2_int_pins>,"brcm,pins:0", <&mcp23s17_22>,"interrupts:0";
+	};
+};
+
diff --git a/arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts b/arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts
new file mode 100755
index 000000000000..03eb5486fa9c
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mcp2515-can0-overlay.dts
@@ -0,0 +1,73 @@
+/*
+ * Device tree overlay for mcp251x/can0 on spi0.0
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+    /* disable spi-dev for spi0.0 */
+    fragment@0 {
+        target = <&spi0>;
+        __overlay__ {
+            status = "okay";
+        };
+    };
+
+    fragment@1 {
+	target = <&spidev0>;
+	__overlay__ {
+	    status = "disabled";
+	};
+    };
+
+    /* the interrupt pin of the can-controller */
+    fragment@2 {
+        target = <&gpio>;
+        __overlay__ {
+            can0_pins: can0_pins {
+                brcm,pins = <25>;
+                brcm,function = <0>; /* input */
+            };
+        };
+    };
+
+    /* the clock/oscillator of the can-controller */
+    fragment@3 {
+        target-path = "/clocks";
+        __overlay__ {
+            /* external oscillator of mcp2515 on SPI0.0 */
+            can0_osc: can0_osc {
+                compatible = "fixed-clock";
+                #clock-cells = <0>;
+                clock-frequency  = <16000000>;
+            };
+        };
+    };
+
+    /* the spi config of the can-controller itself binding everything together */
+    fragment@4 {
+        target = <&spi0>;
+        __overlay__ {
+            /* needed to avoid dtc warning */
+            #address-cells = <1>;
+            #size-cells = <0>;
+            can0: mcp2515@0 {
+                reg = <0>;
+                compatible = "microchip,mcp2515";
+                pinctrl-names = "default";
+                pinctrl-0 = <&can0_pins>;
+                spi-max-frequency = <10000000>;
+                interrupt-parent = <&gpio>;
+                interrupts = <25 8>; /* IRQ_TYPE_LEVEL_LOW */
+                clocks = <&can0_osc>;
+            };
+        };
+    };
+    __overrides__ {
+        oscillator = <&can0_osc>,"clock-frequency:0";
+        spimaxfrequency = <&can0>,"spi-max-frequency:0";
+        interrupt = <&can0_pins>,"brcm,pins:0",<&can0>,"interrupts:0";
+    };
+};
diff --git a/arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts b/arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts
new file mode 100644
index 000000000000..dc773fa3b50c
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mcp2515-can1-overlay.dts
@@ -0,0 +1,73 @@
+/*
+ * Device tree overlay for mcp251x/can1 on spi0.1 edited by petit_miner
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+    /* disable spi-dev for spi0.1 */
+    fragment@0 {
+        target = <&spi0>;
+        __overlay__ {
+            status = "okay";
+        };
+    };
+
+    fragment@1 {
+	target = <&spidev1>;
+	__overlay__ {
+	    status = "disabled";
+	};
+    };
+
+    /* the interrupt pin of the can-controller */
+    fragment@2 {
+        target = <&gpio>;
+        __overlay__ {
+            can1_pins: can1_pins {
+                brcm,pins = <25>;
+                brcm,function = <0>; /* input */
+            };
+        };
+    };
+
+    /* the clock/oscillator of the can-controller */
+    fragment@3 {
+        target-path = "/clocks";
+        __overlay__ {
+            /* external oscillator of mcp2515 on spi0.1 */
+            can1_osc: can1_osc {
+                compatible = "fixed-clock";
+                #clock-cells = <0>;
+                clock-frequency  = <16000000>;
+            };
+        };
+    };
+
+    /* the spi config of the can-controller itself binding everything together */
+    fragment@4 {
+        target = <&spi0>;
+        __overlay__ {
+            /* needed to avoid dtc warning */
+            #address-cells = <1>;
+            #size-cells = <0>;
+            can1: mcp2515@1 {
+                reg = <1>;
+                compatible = "microchip,mcp2515";
+                pinctrl-names = "default";
+                pinctrl-0 = <&can1_pins>;
+                spi-max-frequency = <10000000>;
+                interrupt-parent = <&gpio>;
+                interrupts = <25 8>; /* IRQ_TYPE_LEVEL_LOW */
+                clocks = <&can1_osc>;
+            };
+        };
+    };
+    __overrides__ {
+        oscillator = <&can1_osc>,"clock-frequency:0";
+        spimaxfrequency = <&can1>,"spi-max-frequency:0";
+        interrupt = <&can1_pins>,"brcm,pins:0",<&can1>,"interrupts:0";
+    };
+};
diff --git a/arch/arm/boot/dts/overlays/mcp3008-overlay.dts b/arch/arm/boot/dts/overlays/mcp3008-overlay.dts
new file mode 100755
index 000000000000..06bf4264959c
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mcp3008-overlay.dts
@@ -0,0 +1,205 @@
+/*
+ * Device tree overlay for Microchip mcp3008 10-Bit A/D Converters
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spidev0>;
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev1>;
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target-path = "spi1/spidev@0";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target-path = "spi1/spidev@1";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@4 {
+		target-path = "spi1/spidev@2";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@5 {
+		target-path = "spi2/spidev@0";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@6 {
+		target-path = "spi2/spidev@1";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@7 {
+		target-path = "spi2/spidev@2";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@8 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3008_00: mcp3008@0 {
+				compatible = "mcp3008";
+				reg = <0>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@9 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3008_01: mcp3008@1 {
+				compatible = "mcp3008";
+				reg = <1>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@10 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3008_10: mcp3008@0 {
+				compatible = "mcp3008";
+				reg = <0>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@11 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3008_11: mcp3008@1 {
+				compatible = "mcp3008";
+				reg = <1>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@12 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3008_12: mcp3008@2 {
+				compatible = "mcp3008";
+				reg = <2>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@13 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3008_20: mcp3008@0 {
+				compatible = "mcp3008";
+				reg = <0>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@14 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3008_21: mcp3008@1 {
+				compatible = "mcp3008";
+				reg = <1>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@15 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3008_22: mcp3008@2 {
+				compatible = "mcp3008";
+				reg = <2>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	__overrides__ {
+		spi0-0-present = <0>, "+0+8";
+		spi0-1-present = <0>, "+1+9";
+		spi1-0-present = <0>, "+2+10";
+		spi1-1-present = <0>, "+3+11";
+		spi1-2-present = <0>, "+4+12";
+		spi2-0-present = <0>, "+5+13";
+		spi2-1-present = <0>, "+6+14";
+		spi2-2-present = <0>, "+7+15";
+		spi0-0-speed = <&mcp3008_00>, "spi-max-frequency:0";
+		spi0-1-speed = <&mcp3008_01>, "spi-max-frequency:0";
+		spi1-0-speed = <&mcp3008_10>, "spi-max-frequency:0";
+		spi1-1-speed = <&mcp3008_11>, "spi-max-frequency:0";
+		spi1-2-speed = <&mcp3008_12>, "spi-max-frequency:0";
+		spi2-0-speed = <&mcp3008_20>, "spi-max-frequency:0";
+		spi2-1-speed = <&mcp3008_21>, "spi-max-frequency:0";
+		spi2-2-speed = <&mcp3008_22>, "spi-max-frequency:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/mcp3202-overlay.dts b/arch/arm/boot/dts/overlays/mcp3202-overlay.dts
new file mode 100755
index 000000000000..9902c4614ea1
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mcp3202-overlay.dts
@@ -0,0 +1,205 @@
+/*
+ * Device tree overlay for Microchip mcp3202 12-Bit A/D Converters
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spidev0>;
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev1>;
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target-path = "spi1/spidev@0";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target-path = "spi1/spidev@1";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@4 {
+		target-path = "spi1/spidev@2";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@5 {
+		target-path = "spi2/spidev@0";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@6 {
+		target-path = "spi2/spidev@1";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@7 {
+		target-path = "spi2/spidev@2";
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@8 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3202_00: mcp3202@0 {
+				compatible = "mcp3202";
+				reg = <0>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@9 {
+		target = <&spi0>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3202_01: mcp3202@1 {
+				compatible = "mcp3202";
+				reg = <1>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@10 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3202_10: mcp3202@0 {
+				compatible = "mcp3202";
+				reg = <0>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@11 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3202_11: mcp3202@1 {
+				compatible = "mcp3202";
+				reg = <1>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@12 {
+		target = <&spi1>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3202_12: mcp3202@2 {
+				compatible = "mcp3202";
+				reg = <2>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@13 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3202_20: mcp3202@0 {
+				compatible = "mcp3202";
+				reg = <0>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@14 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3202_21: mcp3202@1 {
+				compatible = "mcp3202";
+				reg = <1>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	fragment@15 {
+		target = <&spi2>;
+		__dormant__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mcp3202_22: mcp3202@2 {
+				compatible = "mcp3202";
+				reg = <2>;
+				spi-max-frequency = <1600000>;
+			};
+		};
+	};
+
+	__overrides__ {
+		spi0-0-present = <0>, "+0+8";
+		spi0-1-present = <0>, "+1+9";
+		spi1-0-present = <0>, "+2+10";
+		spi1-1-present = <0>, "+3+11";
+		spi1-2-present = <0>, "+4+12";
+		spi2-0-present = <0>, "+5+13";
+		spi2-1-present = <0>, "+6+14";
+		spi2-2-present = <0>, "+7+15";
+		spi0-0-speed = <&mcp3202_00>, "spi-max-frequency:0";
+		spi0-1-speed = <&mcp3202_01>, "spi-max-frequency:0";
+		spi1-0-speed = <&mcp3202_10>, "spi-max-frequency:0";
+		spi1-1-speed = <&mcp3202_11>, "spi-max-frequency:0";
+		spi1-2-speed = <&mcp3202_12>, "spi-max-frequency:0";
+		spi2-0-speed = <&mcp3202_20>, "spi-max-frequency:0";
+		spi2-1-speed = <&mcp3202_21>, "spi-max-frequency:0";
+		spi2-2-speed = <&mcp3202_22>, "spi-max-frequency:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/media-center-overlay.dts b/arch/arm/boot/dts/overlays/media-center-overlay.dts
new file mode 100644
index 000000000000..ce4db35228e9
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/media-center-overlay.dts
@@ -0,0 +1,134 @@
+/*
+ * Device Tree overlay for Media Center HAT by Pi Supply
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+
+			spidev@0{
+				status = "disabled";
+			};
+
+			spidev@1{
+				status = "disabled";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			rpi_display_pins: rpi_display_pins {
+				brcm,pins = <12 23 24 25>;
+				brcm,function = <1 1 1 0>; /* out out out in */
+				brcm,pull = <0 0 0 2>; /* - - - up */
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			rpidisplay: rpi-display@0{
+				compatible = "ilitek,ili9341";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&rpi_display_pins>;
+
+				spi-max-frequency = <32000000>;
+				rotate = <90>;
+				bgr;
+				fps = <30>;
+				buswidth = <8>;
+				reset-gpios = <&gpio 23 0>;
+				dc-gpios = <&gpio 24 0>;
+				led-gpios = <&gpio 12 1>;
+				debug = <0>;
+			};
+
+			rpidisplay_ts: rpi-display-ts@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+
+				spi-max-frequency = <2000000>;
+				interrupts = <25 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 25 0>;
+				ti,x-plate-ohms = /bits/ 16 <60>;
+				ti,pressure-max = /bits/ 16 <255>;
+			};
+		};
+	};
+
+	fragment@3 {
+		target-path = "/";
+		__overlay__ {
+			lirc_rpi: lirc_rpi {
+				compatible = "rpi,lirc-rpi";
+				pinctrl-names = "default";
+				pinctrl-0 = <&lirc_pins>;
+				status = "okay";
+
+				// Override autodetection of IR receiver circuit
+				// (0 = active high, 1 = active low, -1 = no override )
+				rpi,sense = <0xffffffff>;
+
+				// Software carrier
+				// (0 = off, 1 = on)
+				rpi,softcarrier = <1>;
+
+				// Invert output
+				// (0 = off, 1 = on)
+				rpi,invert = <0>;
+
+				// Enable debugging messages
+				// (0 = off, 1 = on)
+				rpi,debug = <0>;
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&gpio>;
+		__overlay__ {
+			lirc_pins: lirc_pins {
+				brcm,pins = <6 5>;
+				brcm,function = <1 0>; // out in
+				brcm,pull = <0 1>; // off down
+			};
+		};
+	};
+
+	__overrides__ {
+		speed =     <&rpidisplay>,"spi-max-frequency:0";
+		rotate =    <&rpidisplay>,"rotate:0";
+		fps =       <&rpidisplay>,"fps:0";
+		debug =     <&rpidisplay>,"debug:0", 
+		            <&lirc_rpi>,"rpi,debug:0";
+		xohms =     <&rpidisplay_ts>,"ti,x-plate-ohms;0";
+		swapxy =    <&rpidisplay_ts>,"ti,swap-xy?";
+		backlight = <&rpidisplay>,"led-gpios:4",
+		            <&rpi_display_pins>,"brcm,pins:0";
+
+		gpio_out_pin =  <&lirc_pins>,"brcm,pins:0";
+		gpio_in_pin =   <&lirc_pins>,"brcm,pins:4";
+		gpio_in_pull =  <&lirc_pins>,"brcm,pull:4";
+
+		sense =         <&lirc_rpi>,"rpi,sense:0";
+		softcarrier =   <&lirc_rpi>,"rpi,softcarrier:0";
+		invert =        <&lirc_rpi>,"rpi,invert:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/midi-uart0-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart0-overlay.dts
new file mode 100644
index 000000000000..565af7cf79d7
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/midi-uart0-overlay.dts
@@ -0,0 +1,36 @@
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/bcm2835.h>
+
+/*
+ * Fake a higher clock rate to get a larger divisor, and thereby a lower
+ * baudrate. The real clock is 48MHz, which we scale so that requesting
+ * 38.4kHz results in an actual 31.25kHz.
+ *
+ *   48000000*38400/31250 = 58982400
+ */
+
+/{
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		target-path = "/clocks";
+		__overlay__ {
+			midi_clk: midi_clk {
+				compatible = "fixed-clock";
+				#clock-cells = <0>;
+				clock-output-names = "uart0_pclk";
+				clock-frequency = <58982400>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&uart0>;
+		__overlay__ {
+			clocks = <&midi_clk>,
+			         <&clocks BCM2835_CLOCK_VPU>;
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/midi-uart1-overlay.dts b/arch/arm/boot/dts/overlays/midi-uart1-overlay.dts
new file mode 100644
index 000000000000..e0bc410acbff
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/midi-uart1-overlay.dts
@@ -0,0 +1,43 @@
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/bcm2835-aux.h>
+
+/*
+ * Fake a higher clock rate to get a larger divisor, and thereby a lower
+ * baudrate. The real clock is 48MHz, which we scale so that requesting
+ * 38.4kHz results in an actual 31.25kHz.
+ *
+ *   48000000*38400/31250 = 58982400
+ */
+
+/{
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		target-path = "/clocks";
+		__overlay__ {
+			midi_clk: clock@5 {
+				compatible = "fixed-factor-clock";
+				#clock-cells = <0>;
+				clocks = <&aux BCM2835_AUX_CLOCK_UART>;
+				clock-mult = <38400>;
+				clock-div  = <31250>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&uart1>;
+		__overlay__ {
+			clocks = <&midi_clk>;
+		};
+	};
+
+	fragment@2 {
+		target = <&aux>;
+		__overlay__ {
+			clock-output-names = "aux_uart", "aux_spi1", "aux_spi2";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/mmc-overlay.dts b/arch/arm/boot/dts/overlays/mmc-overlay.dts
new file mode 100644
index 000000000000..88251ad65391
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mmc-overlay.dts
@@ -0,0 +1,39 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&mmc>;
+		frag0: __overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&mmc_pins>;
+			bus-width = <4>;
+			brcm,overclock-50 = <0>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			mmc_pins: mmc_pins {
+				brcm,pins = <48 49 50 51 52 53>;
+				brcm,function = <7>; /* alt3 */
+				brcm,pull = <0 2 2 2 2 2>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sdhost>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	__overrides__ {
+		overclock_50     = <&frag0>,"brcm,overclock-50:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/mpu6050-overlay.dts b/arch/arm/boot/dts/overlays/mpu6050-overlay.dts
new file mode 100644
index 000000000000..06037969c3ab
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mpu6050-overlay.dts
@@ -0,0 +1,28 @@
+// Definitions for MPU6050
+/dts-v1/;
+/plugin/;
+
+/ {
+        compatible = "brcm,bcm2708";
+
+        fragment@0 {
+                target = <&i2c1>;
+                __overlay__ {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                        status = "okay";
+                        clock-frequency = <400000>;
+
+                        mpu6050: mpu6050@68 {
+                                compatible = "invensense,mpu6050";
+                                reg = <0x68>;
+                                interrupt-parent = <&gpio>;
+                                interrupts = <4 1>;
+                        };
+                };
+        };
+
+        __overrides__ {
+                interrupt = <&mpu6050>,"interrupts:0";
+        };
+};
diff --git a/arch/arm/boot/dts/overlays/mz61581-overlay.dts b/arch/arm/boot/dts/overlays/mz61581-overlay.dts
new file mode 100644
index 000000000000..2c29aaed44c5
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/mz61581-overlay.dts
@@ -0,0 +1,117 @@
+/*
+ * Device Tree overlay for MZ61581-PI-EXT 2014.12.28 by Tontec
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			mz61581_pins: mz61581_pins {
+				brcm,pins = <4 15 18 25>;
+				brcm,function = <0 1 1 1>; /* in out out out */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			mz61581: mz61581@0{
+				compatible = "samsung,s6d02a1";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&mz61581_pins>;
+
+				spi-max-frequency = <128000000>;
+				spi-cpol;
+				spi-cpha;
+
+				width = <320>;
+				height = <480>;
+				rotate = <270>;
+				bgr;
+				fps = <30>;
+				buswidth = <8>;
+				txbuflen = <32768>;
+
+				reset-gpios = <&gpio 15 0>;
+				dc-gpios = <&gpio 25 0>;
+				led-gpios = <&gpio 18 0>;
+
+				init = <0x10000b0 00
+					0x1000011
+					0x20000ff
+					0x10000b3 0x02 0x00 0x00 0x00
+					0x10000c0 0x13 0x3b 0x00 0x02 0x00 0x01 0x00 0x43
+					0x10000c1 0x08 0x16 0x08 0x08
+					0x10000c4 0x11 0x07 0x03 0x03
+					0x10000c6 0x00
+					0x10000c8 0x03 0x03 0x13 0x5c 0x03 0x07 0x14 0x08 0x00 0x21 0x08 0x14 0x07 0x53 0x0c 0x13 0x03 0x03 0x21 0x00
+					0x1000035 0x00
+					0x1000036 0xa0
+					0x100003a 0x55
+					0x1000044 0x00 0x01
+					0x10000d0 0x07 0x07 0x1d 0x03
+					0x10000d1 0x03 0x30 0x10
+					0x10000d2 0x03 0x14 0x04
+					0x1000029
+					0x100002c>;
+
+				/* This is a workaround to make sure the init sequence slows down and doesn't fail */
+				debug = <3>;
+			};
+
+			mz61581_ts: mz61581_ts@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+
+				spi-max-frequency = <2000000>;
+				interrupts = <4 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 4 0>;
+
+				ti,x-plate-ohms = /bits/ 16 <60>;
+				ti,pressure-max = /bits/ 16 <255>;
+			};
+		};
+	};
+	__overrides__ {
+		speed =   <&mz61581>, "spi-max-frequency:0";
+		rotate =  <&mz61581>, "rotate:0";
+		fps =     <&mz61581>, "fps:0";
+		txbuflen = <&mz61581>, "txbuflen:0";
+		debug =   <&mz61581>, "debug:0";
+		xohms =   <&mz61581_ts>,"ti,x-plate-ohms;0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/papirus-overlay.dts b/arch/arm/boot/dts/overlays/papirus-overlay.dts
new file mode 100644
index 000000000000..58eb8847f9ed
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/papirus-overlay.dts
@@ -0,0 +1,89 @@
+/* PaPiRus ePaper Screen by Pi Supply */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			display_temp: lm75@48 {
+				compatible = "lm75b";
+				reg = <0x48>;
+				status = "okay";
+				#thermal-sensor-cells = <0>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			thermal-zones {
+				display {
+					polling-delay-passive = <0>;
+					polling-delay = <0>;
+					thermal-sensors = <&display_temp>;
+				};
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+
+			spidev@0{
+				status = "disabled";
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			repaper_pins: repaper_pins {
+				brcm,pins = <14 15 23 24 25>;
+				brcm,function = <1 1 1 1 0>; /* out out out out in */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			repaper: repaper@0{
+				compatible = "not_set";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&repaper_pins>;
+
+				spi-max-frequency = <8000000>;
+
+				panel-on-gpios = <&gpio 23 0>;
+				border-gpios = <&gpio 14 0>;
+				discharge-gpios = <&gpio 15 0>;
+				reset-gpios = <&gpio 24 0>;
+				busy-gpios = <&gpio 25 0>;
+
+				repaper-thermal-zone = "display";
+			};
+		};
+	};
+
+	__overrides__ {
+		panel = <&repaper>, "compatible";
+		speed = <&repaper>, "spi-max-frequency:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pi3-act-led-overlay.dts b/arch/arm/boot/dts/overlays/pi3-act-led-overlay.dts
new file mode 100644
index 000000000000..14a59dcf13ca
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pi3-act-led-overlay.dts
@@ -0,0 +1,27 @@
+/dts-v1/;
+/plugin/;
+
+/* Pi3 uses a GPIO expander to drive the LEDs which can only be accessed
+   from the VPU. There is a special driver for this with a separate DT node,
+   which has the unfortunate consequence of breaking the act_led_gpio and
+   act_led_activelow dtparams.
+
+   This overlay changes the GPIO controller back to the standard one and
+   restores the dtparams.
+*/
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&act_led>;
+		frag0: __overlay__ {
+			gpios = <&gpio 0 0>;
+		};
+	};
+
+	__overrides__ {
+		gpio = <&frag0>,"gpios:4";
+		activelow = <&frag0>,"gpios:8";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts b/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts
new file mode 100644
index 000000000000..87cf345f9641
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts
@@ -0,0 +1,46 @@
+/dts-v1/;
+/plugin/;
+
+/* Disable Bluetooth and restore UART0/ttyAMA0 over GPIOs 14 & 15.
+   To disable the systemd service that initialises the modem so it doesn't use
+   the UART:
+
+       sudo systemctl disable hciuart
+*/
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&uart1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@1 {
+		target = <&uart0>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&uart0_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target = <&uart0_pins>;
+		__overlay__ {
+			brcm,pins;
+			brcm,function;
+			brcm,pull;
+		};
+	};
+
+	fragment@3 {
+		target-path = "/aliases";
+		__overlay__ {
+			serial0 = "/soc/serial@7e201000";
+			serial1 = "/soc/serial@7e215040";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts b/arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts
new file mode 100644
index 000000000000..017199554bf2
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pi3-disable-wifi-overlay.dts
@@ -0,0 +1,13 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&mmc>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts b/arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts
new file mode 100644
index 000000000000..98381656945f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts
@@ -0,0 +1,74 @@
+/dts-v1/;
+/plugin/;
+
+/* Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore
+   UART0/ttyAMA0 over GPIOs 14 & 15. Note that this may reduce the maximum
+   usable baudrate.
+
+   It is also necessary to edit /lib/systemd/system/hciuart.service and
+   replace ttyAMA0 with ttyS0, unless you have a system with udev rules
+   that create /dev/serial0 and /dev/serial1, in which case use /dev/serial1
+   instead because it will always be correct.
+
+   If cmdline.txt uses the alias serial0 to refer to the user-accessable port
+   then the firmware will replace with the appropriate port whether or not
+   this overlay is used.
+*/
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&uart0>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&uart0_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&uart1>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&uart1_pins &bt_pins &fake_bt_cts>;
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target = <&uart0_pins>;
+		__overlay__ {
+			brcm,pins;
+			brcm,function;
+			brcm,pull;
+		};
+	};
+
+	fragment@3 {
+		target = <&uart1_pins>;
+		__overlay__ {
+			brcm,pins = <32 33>;
+			brcm,function = <2>; /* alt5=UART1 */
+			brcm,pull = <0 2>;
+		};
+	};
+
+	fragment@4 {
+		target = <&gpio>;
+		__overlay__ {
+			fake_bt_cts: fake_bt_cts {
+				brcm,pins = <31>;
+				brcm,function = <1>; /* output */
+			};
+		};
+	};
+
+	fragment@5 {
+		target-path = "/aliases";
+		__overlay__ {
+			serial0 = "/soc/serial@7e201000";
+			serial1 = "/soc/serial@7e215040";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pibell-overlay.dts b/arch/arm/boot/dts/overlays/pibell-overlay.dts
new file mode 100644
index 000000000000..6e71c159357a
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pibell-overlay.dts
@@ -0,0 +1,81 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "brcm,bcm2708";
+
+    fragment@0 {
+        target-path = "/";
+        __overlay__ {
+            codec_out: spdif-transmitter {
+                #address-cells = <0>;
+                #size-cells = <0>;
+                #sound-dai-cells = <0>;
+                compatible = "linux,spdif-dit";
+                status = "okay";
+            };
+
+            codec_in: card-codec {
+                #sound-dai-cells = <0>;
+                compatible = "invensense,ics43432";
+                status = "okay";
+            };
+        };
+    };
+
+    fragment@1 {
+        target = <&i2s>;
+        __overlay__ {
+            #sound-dai-cells = <0>;
+            status = "okay";
+        };
+    };
+
+    fragment@2 {
+        target = <&sound>;
+        snd: __overlay__ {
+            compatible = "simple-audio-card";
+            simple-audio-card,name = "PiBell";
+
+            status="okay";
+
+            capture_link: simple-audio-card,dai-link@0 {
+                format = "i2s";
+
+                r_cpu_dai: cpu {
+                    sound-dai = <&i2s>;
+
+/* example TDM slot configuration
+                    dai-tdm-slot-num = <2>;
+                    dai-tdm-slot-width = <32>;
+*/
+                };
+
+                r_codec_dai: codec {
+                    sound-dai = <&codec_in>;
+                };
+            };
+
+            playback_link: simple-audio-card,dai-link@1 {
+                format = "i2s";
+
+                p_cpu_dai: cpu {
+                    sound-dai = <&i2s>;
+
+/* example TDM slot configuration
+                    dai-tdm-slot-num = <2>;
+                    dai-tdm-slot-width = <32>;
+*/
+                };
+
+                p_codec_dai: codec {
+                    sound-dai = <&codec_out>;
+                };
+            };
+        };
+    };
+
+    __overrides__ {
+        alsaname = <&snd>, "simple-audio-card,name";
+    };
+};
diff --git a/arch/arm/boot/dts/overlays/piscreen-overlay.dts b/arch/arm/boot/dts/overlays/piscreen-overlay.dts
new file mode 100644
index 000000000000..40a1f295346e
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/piscreen-overlay.dts
@@ -0,0 +1,102 @@
+/*
+ * Device Tree overlay for PiScreen 3.5" display shield by Ozzmaker
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			piscreen_pins: piscreen_pins {
+				brcm,pins = <17 25 24 22>;
+				brcm,function = <0 1 1 1>; /* in out out out */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			piscreen: piscreen@0{
+				compatible = "ilitek,ili9486";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&piscreen_pins>;
+
+				spi-max-frequency = <24000000>;
+				rotate = <270>;
+				bgr;
+				fps = <30>;
+				buswidth = <8>;
+				regwidth = <16>;
+				reset-gpios = <&gpio 25 0>;
+				dc-gpios = <&gpio 24 0>;
+				led-gpios = <&gpio 22 1>;
+				debug = <0>;
+
+				init = <0x10000b0 0x00
+				        0x1000011
+					0x20000ff
+					0x100003a 0x55
+					0x1000036 0x28
+					0x10000c2 0x44
+					0x10000c5 0x00 0x00 0x00 0x00
+					0x10000e0 0x0f 0x1f 0x1c 0x0c 0x0f 0x08 0x48 0x98 0x37 0x0a 0x13 0x04 0x11 0x0d 0x00
+					0x10000e1 0x0f 0x32 0x2e 0x0b 0x0d 0x05 0x47 0x75 0x37 0x06 0x10 0x03 0x24 0x20 0x00
+					0x10000e2 0x0f 0x32 0x2e 0x0b 0x0d 0x05 0x47 0x75 0x37 0x06 0x10 0x03 0x24 0x20 0x00
+					0x1000011
+					0x1000029>;
+			};
+
+			piscreen_ts: piscreen-ts@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+
+				spi-max-frequency = <2000000>;
+				interrupts = <17 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 17 0>;
+				ti,swap-xy;
+				ti,x-plate-ohms = /bits/ 16 <100>;
+				ti,pressure-max = /bits/ 16 <255>;
+			};
+		};
+	};
+	__overrides__ {
+		speed =		<&piscreen>,"spi-max-frequency:0";
+		rotate =	<&piscreen>,"rotate:0";
+		fps =		<&piscreen>,"fps:0";
+		debug =		<&piscreen>,"debug:0";
+		xohms =		<&piscreen_ts>,"ti,x-plate-ohms;0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/piscreen2r-overlay.dts b/arch/arm/boot/dts/overlays/piscreen2r-overlay.dts
new file mode 100644
index 000000000000..9c0bed893057
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/piscreen2r-overlay.dts
@@ -0,0 +1,106 @@
+ /*
+ * Device Tree overlay for PiScreen2 3.5" TFT with resistive touch  by Ozzmaker.com
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			piscreen2_pins: piscreen2_pins {
+				brcm,pins = <17 25 24 22>;
+				brcm,function = <0 1 1 1>; /* in out out out */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			piscreen2: piscreen2@0{
+				compatible = "ilitek,ili9486";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&piscreen2_pins>;
+				bgr;
+				spi-max-frequency = <64000000>;
+				rotate = <90>;
+				fps = <30>;
+				buswidth = <8>;
+				regwidth = <16>;
+				txbuflen = <32768>;
+				reset-gpios = <&gpio 25 0>;
+				dc-gpios = <&gpio 24 0>;
+				led-gpios = <&gpio 22 1>;
+				debug = <0>;
+
+                                init = <0x10000b0 0x00
+                                        0x1000011
+                                        0x20000ff
+                                        0x100003a 0x55
+                                        0x1000036 0x28
+                                        0x10000c0 0x11 0x09
+                                        0x10000c1 0x41
+                                        0x10000c5 0x00 0x00 0x00 0x00
+                                        0x10000b6 0x00 0x02
+                                        0x10000f7 0xa9 0x51 0x2c 0x2
+                                        0x10000be 0x00 0x04
+                                        0x10000e9 0x00
+                                        0x1000011
+                                        0x1000029>;
+
+			};
+
+			piscreen2_ts: piscreen2-ts@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+
+				spi-max-frequency = <2000000>;
+				interrupts = <17 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 17 0>;
+				ti,swap-xy;
+				ti,x-plate-ohms = /bits/ 16 <100>;
+				ti,pressure-max = /bits/ 16 <255>;
+			};
+		};
+	};
+	__overrides__ {
+		speed =		<&piscreen2>,"spi-max-frequency:0";
+		rotate =	<&piscreen2>,"rotate:0";
+		fps =		<&piscreen2>,"fps:0";
+		debug =		<&piscreen2>,"debug:0";
+		xohms =		<&piscreen2_ts>,"ti,x-plate-ohms;0";
+	};
+};
+
diff --git a/arch/arm/boot/dts/overlays/pisound-overlay.dts b/arch/arm/boot/dts/overlays/pisound-overlay.dts
new file mode 100644
index 000000000000..0893717af4e0
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pisound-overlay.dts
@@ -0,0 +1,120 @@
+/*
+ * Pisound Linux kernel module.
+ * Copyright (C) 2016-2017  Vilniaus Blokas UAB, https://blokas.io/pisound
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; version 2 of the
+ * License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@3 {
+		target = <&spi0>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			pisound_spi: pisound_spi@0{
+				compatible = "blokaslabs,pisound-spi";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&spi0_pins>;
+				spi-max-frequency = <1000000>;
+			};
+		};
+	};
+
+	fragment@4 {
+		target-path = "/";
+		__overlay__ {
+			pcm5102a-codec {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm5102a";
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@5 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "blokaslabs,pisound";
+			i2s-controller = <&i2s>;
+			status = "okay";
+
+			pinctrl-0 = <&pisound_button_pins>;
+
+			osr-gpios =
+				<&gpio 13 GPIO_ACTIVE_HIGH>,
+				<&gpio 26 GPIO_ACTIVE_HIGH>,
+				<&gpio 16 GPIO_ACTIVE_HIGH>;
+
+			reset-gpios =
+				<&gpio 12 GPIO_ACTIVE_HIGH>,
+				<&gpio 24 GPIO_ACTIVE_HIGH>;
+
+			data_available-gpios = <&gpio 25 GPIO_ACTIVE_HIGH>;
+
+			button-gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	fragment@6 {
+		target = <&gpio>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&pisound_button_pins>;
+
+			pisound_button_pins: pisound_button_pins {
+				brcm,pins = <17>;
+				brcm,function = <0>; // Input
+				brcm,pull = <2>; // Pull-Up
+			};
+		};
+	};
+
+	fragment@7 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pitft22-overlay.dts b/arch/arm/boot/dts/overlays/pitft22-overlay.dts
new file mode 100644
index 000000000000..894ba2292f6b
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pitft22-overlay.dts
@@ -0,0 +1,69 @@
+/*
+ * Device Tree overlay for pitft by Adafruit
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+        compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+        fragment@0 {
+                target = <&spi0>;
+                __overlay__ {
+                        status = "okay";
+
+                        spidev@0{
+                                status = "disabled";
+                        };
+
+                        spidev@1{
+                                status = "disabled";
+                        };
+                };
+        };
+
+        fragment@1 {
+                target = <&gpio>;
+                __overlay__ {
+                        pitft_pins: pitft_pins {
+                                brcm,pins = <25>;
+                                brcm,function = <1>; /* out */
+                                brcm,pull = <0>; /* none */
+                        };
+                };
+        };
+
+        fragment@2 {
+                target = <&spi0>;
+                __overlay__ {
+                        /* needed to avoid dtc warning */
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        pitft: pitft@0{
+                                compatible = "ilitek,ili9340";
+                                reg = <0>;
+                                pinctrl-names = "default";
+                                pinctrl-0 = <&pitft_pins>;
+
+                                spi-max-frequency = <32000000>;
+                                rotate = <90>;
+                                fps = <25>;
+                                bgr;
+                                buswidth = <8>;
+                                dc-gpios = <&gpio 25 0>;
+                                debug = <0>;
+                        };
+
+                };
+        };
+
+        __overrides__ {
+                speed =   <&pitft>,"spi-max-frequency:0";
+                rotate =  <&pitft>,"rotate:0";
+                fps =     <&pitft>,"fps:0";
+                debug =   <&pitft>,"debug:0";
+        };
+};
diff --git a/arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts b/arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts
new file mode 100644
index 000000000000..5c0752655c70
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pitft28-capacitive-overlay.dts
@@ -0,0 +1,91 @@
+/*
+ * Device Tree overlay for Adafruit PiTFT 2.8" capacitive touch screen
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+        compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+        fragment@0 {
+                target = <&spi0>;
+                __overlay__ {
+                        status = "okay";
+                };
+        };
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+        fragment@2 {
+                target = <&gpio>;
+                __overlay__ {
+                        pitft_pins: pitft_pins {
+                                brcm,pins = <24 25>;
+                                brcm,function = <0 1>; /* in out */
+                                brcm,pull = <2 0>; /* pullup none */
+                        };
+                };
+        };
+
+        fragment@3 {
+                target = <&spi0>;
+                __overlay__ {
+                        /* needed to avoid dtc warning */
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        pitft: pitft@0{
+                                compatible = "ilitek,ili9340";
+                                reg = <0>;
+                                pinctrl-names = "default";
+                                pinctrl-0 = <&pitft_pins>;
+
+                                spi-max-frequency = <32000000>;
+                                rotate = <90>;
+                                fps = <25>;
+                                bgr;
+                                buswidth = <8>;
+                                dc-gpios = <&gpio 25 0>;
+                                debug = <0>;
+                        };
+                };
+        };
+
+        fragment@4 {
+                target = <&i2c1>;
+                __overlay__ {
+                        /* needed to avoid dtc warning */
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        ft6236: ft6236@38 {
+                                compatible = "focaltech,ft6236";
+                                reg = <0x38>;
+
+                                interrupt-parent = <&gpio>;
+                                interrupts = <24 2>;
+                                touchscreen-size-x = <240>;
+                                touchscreen-size-y = <320>;
+                        };
+                };
+        };
+
+        __overrides__ {
+                speed =   <&pitft>,"spi-max-frequency:0";
+                rotate =  <&pitft>,"rotate:0";
+                fps =     <&pitft>,"fps:0";
+                debug =   <&pitft>,"debug:0";
+                touch-sizex = <&ft6236>,"touchscreen-size-x?";
+                touch-sizey = <&ft6236>,"touchscreen-size-y?";
+                touch-invx  = <&ft6236>,"touchscreen-inverted-x?";
+                touch-invy  = <&ft6236>,"touchscreen-inverted-y?";
+                touch-swapxy = <&ft6236>,"touchscreen-swapped-x-y?";
+        };
+};
diff --git a/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts b/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts
new file mode 100644
index 000000000000..ed2afc2f7fd6
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pitft28-resistive-overlay.dts
@@ -0,0 +1,121 @@
+/*
+ * Device Tree overlay for Adafruit PiTFT 2.8" resistive touch screen
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			pitft_pins: pitft_pins {
+				brcm,pins = <24 25>;
+				brcm,function = <0 1>; /* in out */
+				brcm,pull = <2 0>; /* pullup none */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			pitft: pitft@0{
+				compatible = "ilitek,ili9340";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&pitft_pins>;
+
+				spi-max-frequency = <32000000>;
+				rotate = <90>;
+				fps = <25>;
+				bgr;
+				buswidth = <8>;
+				dc-gpios = <&gpio 25 0>;
+				debug = <0>;
+			};
+
+			pitft_ts@1 {
+				#address-cells = <1>;
+				#size-cells = <0>;
+				compatible = "st,stmpe610";
+				reg = <1>;
+
+				spi-max-frequency = <500000>;
+				irq-gpio = <&gpio 24 0x2>; /* IRQF_TRIGGER_FALLING */
+				interrupts = <24 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				interrupt-controller;
+
+				stmpe_touchscreen {
+					compatible = "st,stmpe-ts";
+					st,sample-time = <4>;
+					st,mod-12b = <1>;
+					st,ref-sel = <0>;
+					st,adc-freq = <2>;
+					st,ave-ctrl = <3>;
+					st,touch-det-delay = <4>;
+					st,settling = <2>;
+					st,fraction-z = <7>;
+					st,i-drive = <0>;
+				};
+
+				stmpe_gpio: stmpe_gpio {
+					#gpio-cells = <2>;
+					compatible = "st,stmpe-gpio";
+					/*
+					 * only GPIO2 is wired/available
+					 * and it is wired to the backlight
+					 */
+					st,norequest-mask = <0x7b>;
+				};
+			};
+		};
+	};
+
+	fragment@5 {
+		target-path = "/soc";
+		__overlay__ {
+			backlight {
+				compatible = "gpio-backlight";
+				gpios = <&stmpe_gpio 2 0>;
+				default-on;
+			};
+		};
+	};
+
+	__overrides__ {
+		speed =   <&pitft>,"spi-max-frequency:0";
+		rotate =  <&pitft>,"rotate:0";
+		fps =     <&pitft>,"fps:0";
+		debug =   <&pitft>,"debug:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts b/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts
new file mode 100644
index 000000000000..25cb5cc9576d
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pitft35-resistive-overlay.dts
@@ -0,0 +1,121 @@
+/*
+ * Device Tree overlay for Adafruit PiTFT 3.5" resistive touch screen
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			pitft_pins: pitft_pins {
+				brcm,pins = <24 25>;
+				brcm,function = <0 1>; /* in out */
+				brcm,pull = <2 0>; /* pullup none */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			pitft: pitft@0{
+				compatible = "himax,hx8357d";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&pitft_pins>;
+
+				spi-max-frequency = <32000000>;
+				rotate = <90>;
+				fps = <25>;
+				bgr;
+				buswidth = <8>;
+				dc-gpios = <&gpio 25 0>;
+				debug = <0>;
+			};
+
+			pitft_ts@1 {
+				#address-cells = <1>;
+				#size-cells = <0>;
+				compatible = "st,stmpe610";
+				reg = <1>;
+
+				spi-max-frequency = <500000>;
+				irq-gpio = <&gpio 24 0x2>; /* IRQF_TRIGGER_FALLING */
+				interrupts = <24 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				interrupt-controller;
+
+				stmpe_touchscreen {
+					compatible = "st,stmpe-ts";
+					st,sample-time = <4>;
+					st,mod-12b = <1>;
+					st,ref-sel = <0>;
+					st,adc-freq = <2>;
+					st,ave-ctrl = <3>;
+					st,touch-det-delay = <4>;
+					st,settling = <2>;
+					st,fraction-z = <7>;
+					st,i-drive = <0>;
+				};
+
+				stmpe_gpio: stmpe_gpio {
+					#gpio-cells = <2>;
+					compatible = "st,stmpe-gpio";
+					/*
+					 * only GPIO2 is wired/available
+					 * and it is wired to the backlight
+					 */
+					st,norequest-mask = <0x7b>;
+				};
+			};
+		};
+	};
+
+	fragment@5 {
+		target-path = "/soc";
+		__overlay__ {
+			backlight {
+				compatible = "gpio-backlight";
+				gpios = <&stmpe_gpio 2 0>;
+				default-on;
+			};
+		};
+	};
+
+	__overrides__ {
+		speed =   <&pitft>,"spi-max-frequency:0";
+		rotate =  <&pitft>,"rotate:0";
+		fps =     <&pitft>,"fps:0";
+		debug =   <&pitft>,"debug:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pps-gpio-overlay.dts b/arch/arm/boot/dts/overlays/pps-gpio-overlay.dts
new file mode 100644
index 000000000000..af29b870f1a1
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pps-gpio-overlay.dts
@@ -0,0 +1,38 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+			pps: pps@12 {
+				compatible = "pps-gpio";
+				pinctrl-names = "default";
+				pinctrl-0 = <&pps_pins>;
+				gpios = <&gpio 18 0>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			pps_pins: pps_pins@12 {
+				brcm,pins =     <18>;
+				brcm,function = <0>;    // in
+				brcm,pull =     <0>;    // off
+			};
+		};
+	};
+
+	__overrides__ {
+		gpiopin = <&pps>,"gpios:4",
+			  <&pps>,"reg:0",
+			  <&pps_pins>,"brcm,pins:0",
+			  <&pps_pins>,"reg:0";
+		assert_falling_edge = <&pps>,"assert-falling-edge?";
+		capture_clear = <&pps>,"capture-clear?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pwm-2chan-overlay.dts b/arch/arm/boot/dts/overlays/pwm-2chan-overlay.dts
new file mode 100644
index 000000000000..abdeddd0f2c8
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pwm-2chan-overlay.dts
@@ -0,0 +1,47 @@
+/dts-v1/;
+/plugin/;
+
+/*
+This is the 2-channel overlay - only use it if you need both channels.
+
+Legal pin,function combinations for each channel:
+  PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0)            52,5(Alt1)
+  PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
+
+N.B.:
+  1) Pin 18 is the only one available on all platforms, and
+     it is the one used by the I2S audio interface.
+     Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
+  2) The onboard analogue audio output uses both PWM channels.
+  3) So be careful mixing audio and PWM.
+*/
+
+/ {
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			pwm_pins: pwm_pins {
+				brcm,pins = <18 19>;
+				brcm,function = <2 2>; /* Alt5 */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&pwm>;
+		frag1: __overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&pwm_pins>;
+			assigned-clock-rates = <100000000>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		pin   = <&pwm_pins>,"brcm,pins:0";
+		pin2  = <&pwm_pins>,"brcm,pins:4";
+		func  = <&pwm_pins>,"brcm,function:0";
+		func2 = <&pwm_pins>,"brcm,function:4";
+		clock = <&frag1>,"assigned-clock-rates:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts b/arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts
new file mode 100644
index 000000000000..141c126fe33b
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pwm-ir-tx-overlay.dts
@@ -0,0 +1,40 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			pwm0_pins: pwm0_pins {
+				brcm,pins = <18>;
+				brcm,function = <2>; /* Alt5 */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&pwm>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&pwm0_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@2 {
+		target-path = "/";
+		__overlay__ {
+			pwm-ir-transmitter {
+				compatible = "pwm-ir-tx";
+				pwms = <&pwm 0 100>;
+			};
+		};
+	};
+
+	__overrides__ {
+		gpio_pin = <&pwm0_pins>, "brcm,pins:0";
+		func = <&pwm0_pins>,"brcm,function:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/pwm-overlay.dts b/arch/arm/boot/dts/overlays/pwm-overlay.dts
new file mode 100644
index 000000000000..27809e8dc746
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/pwm-overlay.dts
@@ -0,0 +1,43 @@
+/dts-v1/;
+/plugin/;
+
+/*
+Legal pin,function combinations for each channel:
+  PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0)            52,5(Alt1)
+  PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
+
+N.B.:
+  1) Pin 18 is the only one available on all platforms, and
+     it is the one used by the I2S audio interface.
+     Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
+  2) The onboard analogue audio output uses both PWM channels.
+  3) So be careful mixing audio and PWM.
+*/
+
+/ {
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			pwm_pins: pwm_pins {
+				brcm,pins = <18>;
+				brcm,function = <2>; /* Alt5 */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&pwm>;
+		frag1: __overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&pwm_pins>;
+			assigned-clock-rates = <100000000>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		pin   = <&pwm_pins>,"brcm,pins:0";
+		func  = <&pwm_pins>,"brcm,function:0";
+		clock = <&frag1>,"assigned-clock-rates:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/qca7000-overlay.dts b/arch/arm/boot/dts/overlays/qca7000-overlay.dts
new file mode 100644
index 000000000000..b4e601396c49
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/qca7000-overlay.dts
@@ -0,0 +1,52 @@
+// Overlay for the Qualcomm Atheros QCA7000 on I2SE's PLC Stamp micro EVK
+// Visit: https://www.i2se.com/product/plc-stamp-micro-evk for details
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "okay";
+
+			spidev@0 {
+				status = "disabled";
+			};
+
+			eth1: qca7000@0 {
+				compatible = "qca,qca7000";
+				reg = <0>; /* CE0 */
+				pinctrl-names = "default";
+				pinctrl-0 = <&eth1_pins>;
+				interrupt-parent = <&gpio>;
+				interrupts = <23 0x1>; /* rising edge */
+				spi-max-frequency = <12000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			eth1_pins: eth1_pins {
+				brcm,pins = <23>;
+				brcm,function = <0>; /* in */
+				brcm,pull = <0>; /* none */
+			};
+		};
+	};
+
+	__overrides__ {
+		int_pin = <&eth1>, "interrupts:0",
+		          <&eth1_pins>, "brcm,pins:0";
+		speed   = <&eth1>, "spi-max-frequency:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts b/arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts
new file mode 100644
index 000000000000..819f400a9054
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rotary-encoder-overlay.dts
@@ -0,0 +1,59 @@
+// Device tree overlay for GPIO connected rotary encoder.
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			rotary_pins: rotary_pins@4 {
+				brcm,pins = <4 17>; /* gpio 4 17 */
+				brcm,function = <0 0>; /* input */
+				brcm,pull = <2 2>; /* pull-up */
+			};
+
+		};
+	};
+
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			rotary: rotary@4 {
+				compatible = "rotary-encoder";
+				status = "okay";
+				pinctrl-names = "default";
+				pinctrl-0 = <&rotary_pins>;
+				gpios = <&gpio 4 0>, <&gpio 17 0>;
+				linux,axis = <0>; /* REL_X */
+				rotary-encoder,encoding = "gray";
+				rotary-encoder,steps = <24>; /* 24 default */
+				rotary-encoder,steps-per-period = <1>; /* corresponds to full period mode. See README */
+			};
+		};
+
+	};  
+
+	__overrides__ {
+		pin_a =		    <&rotary>,"gpios:4",
+				    <&rotary_pins>,"brcm,pins:0",
+				    /* modify reg values to allow multiple instantiation */
+				    <&rotary>,"reg:0",
+				    <&rotary_pins>,"reg:0";
+		pin_b =		    <&rotary>,"gpios:16",
+				    <&rotary_pins>,"brcm,pins:4";
+		relative_axis =     <&rotary>,"rotary-encoder,relative-axis?";
+		linux_axis =        <&rotary>,"linux,axis:0";
+		rollover =          <&rotary>,"rotary-encoder,rollover?";
+		steps-per-period =  <&rotary>,"rotary-encoder,steps-per-period:0";
+		steps =             <&rotary>,"rotary-encoder,steps:0";
+		wakeup =            <&rotary>,"wakeup-source?";
+		encoding =          <&rotary>,"rotary-encoder,encoding";
+                /* legacy parameters*/
+		rotary0_pin_a =     <&rotary>,"gpios:4",
+		                    <&rotary_pins>,"brcm,pins:0";
+		rotary0_pin_b =     <&rotary>,"gpios:16",
+		                    <&rotary_pins>,"brcm,pins:4";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts b/arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts
new file mode 100644
index 000000000000..c021d02bb75f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rpi-backlight-overlay.dts
@@ -0,0 +1,21 @@
+/*
+ * Devicetree overlay for mailbox-driven Raspberry Pi DSI Display
+ * backlight controller
+ */
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+			rpi_backlight: rpi_backlight {
+				compatible = "raspberrypi,rpi-backlight";
+				firmware = <&firmware>;
+				status = "okay";
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/rpi-cirrus-wm5102-overlay.dts b/arch/arm/boot/dts/overlays/rpi-cirrus-wm5102-overlay.dts
new file mode 100644
index 000000000000..cf85f0af2240
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rpi-cirrus-wm5102-overlay.dts
@@ -0,0 +1,146 @@
+// Definitions for the Cirrus Logic Audio Card
+/dts-v1/;
+/plugin/;
+#include <dt-bindings/pinctrl/bcm2835.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/mfd/arizona.h>
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			wlf_pins: wlf_pins {
+				brcm,pins = <17 22 27 8>;
+				brcm,function = <
+					BCM2835_FSEL_GPIO_OUT
+					BCM2835_FSEL_GPIO_OUT
+					BCM2835_FSEL_GPIO_IN
+					BCM2835_FSEL_GPIO_OUT
+				>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target-path = "/";
+		__overlay__ {
+			rpi_cirrus_reg_1v8: rpi_cirrus_reg_1v8 {
+				compatible = "regulator-fixed";
+				regulator-name = "RPi-Cirrus 1v8";
+				regulator-min-microvolt = <1800000>;
+				regulator-max-microvolt = <1800000>;
+				regulator-always-on;
+			};
+		};
+	};
+
+	fragment@3 {
+		target = <&spi0>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			spidev@0{
+				status = "disabled";
+			};
+
+			spidev@1{
+				status = "disabled";
+			};
+
+			wm5102@1{
+				compatible = "wlf,wm5102";
+				reg = <1>;
+
+				spi-max-frequency = <500000>;
+
+				interrupt-parent = <&gpio>;
+				interrupts = <27 8>;
+				interrupt-controller;
+				#interrupt-cells = <2>;
+
+				gpio-controller;
+				#gpio-cells = <2>;
+
+				LDOVDD-supply = <&rpi_cirrus_reg_1v8>;
+				AVDD-supply = <&rpi_cirrus_reg_1v8>;
+				DBVDD1-supply = <&rpi_cirrus_reg_1v8>;
+				DBVDD2-supply = <&vdd_3v3_reg>;
+				DBVDD3-supply = <&vdd_3v3_reg>;
+				CPVDD-supply = <&rpi_cirrus_reg_1v8>;
+				SPKVDDL-supply = <&vdd_5v0_reg>;
+				SPKVDDR-supply = <&vdd_5v0_reg>;
+				DCVDD-supply = <&arizona_ldo1>;
+
+				wlf,reset = <&gpio 17 GPIO_ACTIVE_HIGH>;
+				wlf,ldoena = <&gpio 22 GPIO_ACTIVE_HIGH>;
+				wlf,gpio-defaults = <
+					ARIZONA_GP_DEFAULT
+					ARIZONA_GP_DEFAULT
+					ARIZONA_GP_DEFAULT
+					ARIZONA_GP_DEFAULT
+					ARIZONA_GP_DEFAULT
+				>;
+				wlf,micd-configs = <0 1 0>;
+				wlf,dmic-ref = <
+					ARIZONA_DMIC_MICVDD
+					ARIZONA_DMIC_MICBIAS2
+					ARIZONA_DMIC_MICVDD
+					ARIZONA_DMIC_MICVDD
+				>;
+				wlf,inmode = <
+					ARIZONA_INMODE_DIFF
+					ARIZONA_INMODE_DMIC
+					ARIZONA_INMODE_SE
+					ARIZONA_INMODE_DIFF
+				>;
+				status = "okay";
+
+				arizona_ldo1: ldo1 {
+					regulator-name = "LDO1";
+					// default constraints as in
+					// arizona-ldo1.c
+					regulator-min-microvolt = <1200000>;
+					regulator-max-microvolt = <1800000>;
+				};
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&i2c1>;
+		__overlay__ {
+			status = "okay";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			wm8804@3b {
+				compatible = "wlf,wm8804";
+				reg = <0x3b>;
+				status = "okay";
+				PVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+				wlf,reset-gpio = <&gpio 8 GPIO_ACTIVE_HIGH>;
+			};
+		};
+	};
+
+	fragment@5 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "wlf,rpi-cirrus";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/rpi-dac-overlay.dts b/arch/arm/boot/dts/overlays/rpi-dac-overlay.dts
new file mode 100644
index 000000000000..a442c8f0ec01
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rpi-dac-overlay.dts
@@ -0,0 +1,34 @@
+// Definitions for RPi DAC
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target-path = "/";
+		__overlay__ {
+			pcm1794a-codec {
+				#sound-dai-cells = <0>;
+				compatible = "ti,pcm1794a";
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "rpi,rpi-dac";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/rpi-display-overlay.dts b/arch/arm/boot/dts/overlays/rpi-display-overlay.dts
new file mode 100644
index 000000000000..533b5c140b54
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rpi-display-overlay.dts
@@ -0,0 +1,91 @@
+/*
+ * Device Tree overlay for rpi-display by Watterott
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			rpi_display_pins: rpi_display_pins {
+				brcm,pins = <18 23 24 25>;
+				brcm,function = <1 1 1 0>; /* out out out in */
+				brcm,pull = <0 0 0 2>; /* - - - up */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			rpidisplay: rpi-display@0{
+				compatible = "ilitek,ili9341";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&rpi_display_pins>;
+
+				spi-max-frequency = <32000000>;
+				rotate = <270>;
+				bgr;
+				fps = <30>;
+				buswidth = <8>;
+				reset-gpios = <&gpio 23 0>;
+				dc-gpios = <&gpio 24 0>;
+				led-gpios = <&gpio 18 1>;
+				debug = <0>;
+			};
+
+			rpidisplay_ts: rpi-display-ts@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+
+				spi-max-frequency = <2000000>;
+				interrupts = <25 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 25 0>;
+				ti,x-plate-ohms = /bits/ 16 <60>;
+				ti,pressure-max = /bits/ 16 <255>;
+			};
+		};
+	};
+	__overrides__ {
+		speed =     <&rpidisplay>,"spi-max-frequency:0";
+		rotate =    <&rpidisplay>,"rotate:0";
+		fps =       <&rpidisplay>,"fps:0";
+		debug =     <&rpidisplay>,"debug:0";
+		xohms =     <&rpidisplay_ts>,"ti,x-plate-ohms;0";
+		swapxy =    <&rpidisplay_ts>,"ti,swap-xy?";
+		backlight = <&rpidisplay>,"led-gpios:4",
+		            <&rpi_display_pins>,"brcm,pins:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts b/arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts
new file mode 100644
index 000000000000..1915ce188bf3
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rpi-ft5406-overlay.dts
@@ -0,0 +1,30 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+			rpi_ft5406: rpi_ft5406 {
+				compatible = "rpi,rpi-ft5406";
+				firmware = <&firmware>;
+				status = "okay";
+				touchscreen-size-x = <800>;
+				touchscreen-size-y = <480>;
+				touchscreen-inverted-x = <0>;
+				touchscreen-inverted-y = <0>;
+				touchscreen-swapped-x-y = <0>;
+			};
+		};
+	};
+
+	__overrides__ {
+		touchscreen-size-x = <&rpi_ft5406>,"touchscreen-size-x:0";
+		touchscreen-size-y = <&rpi_ft5406>,"touchscreen-size-y:0";
+		touchscreen-inverted-x = <&rpi_ft5406>,"touchscreen-inverted-x:0";
+		touchscreen-inverted-y = <&rpi_ft5406>,"touchscreen-inverted-y:0";
+		touchscreen-swapped-x-y = <&rpi_ft5406>,"touchscreen-swapped-x-y:0";
+        };
+};
diff --git a/arch/arm/boot/dts/overlays/rpi-proto-overlay.dts b/arch/arm/boot/dts/overlays/rpi-proto-overlay.dts
new file mode 100644
index 000000000000..8332d0159a45
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rpi-proto-overlay.dts
@@ -0,0 +1,39 @@
+// Definitions for Rpi-Proto
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			wm8731@1a {
+				#sound-dai-cells = <0>;
+				compatible = "wlf,wm8731";
+				reg = <0x1a>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "rpi,rpi-proto";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts b/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts
new file mode 100644
index 000000000000..27153240e1be
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rpi-sense-overlay.dts
@@ -0,0 +1,47 @@
+// rpi-sense HAT
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			rpi-sense@46 {
+				compatible = "rpi,rpi-sense";
+				reg = <0x46>;
+				keys-int-gpios = <&gpio 23 1>;
+				status = "okay";
+			};
+
+			lsm9ds1-magn@1c {
+				compatible = "st,lsm9ds1-magn";
+				reg = <0x1c>;
+				status = "okay";
+			};
+
+			lsm9ds1-accel6a {
+				compatible = "st,lsm9ds1-accel";
+				reg = <0x6a>;
+				status = "okay";
+			};
+
+			lps25h-press@5c {
+				compatible = "st,lps25h-press";
+				reg = <0x5c>;
+				status = "okay";
+			};
+
+			hts221-humid@5f {
+				compatible = "st,hts221-humid";
+				reg = <0x5f>;
+				status = "okay";
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts b/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts
new file mode 100644
index 000000000000..a68f6f793d8e
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rpi-tv-overlay.dts
@@ -0,0 +1,31 @@
+// rpi-tv HAT
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "okay";
+
+			spidev@0 {
+				status = "disabled";
+			};
+
+			cxd2880@0 {
+				compatible = "sony,cxd2880";
+				reg = <0>; /* CE0 */
+				spi-max-frequency = <50000000>;
+				status = "okay";
+			};
+		};
+	};
+
+};
diff --git a/arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts b/arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts
new file mode 100644
index 000000000000..f8d48233e28c
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/rra-digidac1-wm8741-audio-overlay.dts
@@ -0,0 +1,49 @@
+// Definitions for RRA DigiDAC1 Audio card
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			wm8804@3b {
+				#sound-dai-cells = <0>;
+				compatible = "wlf,wm8804";
+				reg = <0x3b>;
+				status = "okay";
+				PVDD-supply = <&vdd_3v3_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+			};
+
+			wm8742: wm8741@1a {
+				compatible = "wlf,wm8741";
+				reg = <0x1a>;
+				status = "okay";
+				AVDD-supply = <&vdd_5v0_reg>;
+				DVDD-supply = <&vdd_3v3_reg>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "rra,digidac1-soundcard";
+			i2s-controller = <&i2s>;
+			status = "okay";
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts b/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
new file mode 100644
index 000000000000..339d0d17c01f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
@@ -0,0 +1,37 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&i2c_arm>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			sc16is750: sc16is750@48 {
+				compatible = "nxp,sc16is750";
+				reg = <0x48>; /* address */
+				clocks = <&sc16is750_clk>;
+				interrupt-parent = <&gpio>;
+				interrupts = <24 2>; /* IRQ_TYPE_EDGE_FALLING */
+				#gpio-cells = <2>;
+
+				sc16is750_clk: sc16is750_clk {
+					compatible = "fixed-clock";
+					#clock-cells = <0>;
+					clock-frequency = <14745600>;
+				};
+			};
+		};
+	};
+
+
+	__overrides__ {
+		int_pin = <&sc16is750>,"interrupts:0";
+		addr = <&sc16is750>,"reg:0";
+	};
+
+};
diff --git a/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts b/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
new file mode 100644
index 000000000000..e43e81d5a28f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
@@ -0,0 +1,40 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835";
+
+	fragment@0 {
+		target = <&i2c1>;
+
+		frag1: __overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			sc16is752: sc16is752@48 {
+				compatible = "nxp,sc16is752";
+				reg = <0x48>; // i2c address
+				clocks = <&sc16is752_clk>;
+				interrupt-parent = <&gpio>;
+				interrupts = <24 0x2>; /* IRQ_TYPE_EDGE_FALLING */
+				gpio-controller;
+				#gpio-cells = <0>;
+				i2c-max-frequency = <400000>;
+				status = "okay";
+
+				sc16is752_clk: sc16is752_clk {
+					compatible = "fixed-clock";
+					#clock-cells = <0>;
+					clock-frequency = <14745600>;
+				};
+			};
+		};
+	};
+
+	__overrides__ {
+		int_pin = <&sc16is752>,"interrupts:0";
+		addr = <&sc16is752>,"reg:0";
+		xtal = <&sc16is752>,"clock-frequency:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts b/arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts
new file mode 100644
index 000000000000..d0a9e82dbea1
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/sc16is752-spi1-overlay.dts
@@ -0,0 +1,61 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			spi1_pins: spi1_pins {
+				brcm,pins = <19 20 21>;
+				brcm,function = <3>; /* alt4 */
+			};
+
+			spi1_cs_pins: spi1_cs_pins {
+				brcm,pins = <18>;
+				brcm,function = <1>; /* output */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&spi1>;
+		frag1: __overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
+			cs-gpios = <&gpio 18 1>;
+			status = "okay";
+
+			sc16is752: sc16is752@0 {
+				compatible = "nxp,sc16is752";
+				reg = <0>; /* CE0 */
+				clocks = <&sc16is752_clk>;
+				interrupt-parent = <&gpio>;
+				interrupts = <24 2>; /* IRQ_TYPE_EDGE_FALLING */
+				#gpio-controller;
+				#gpio-cells = <2>;
+				spi-max-frequency = <4000000>;
+
+				sc16is752_clk: sc16is752_clk {
+					compatible = "fixed-clock";
+					#clock-cells = <0>;
+					clock-frequency = <14745600>;
+				};
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&aux>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+    __overrides__ {
+      int_pin = <&sc16is752>,"interrupts:0";
+    };
+};
diff --git a/arch/arm/boot/dts/overlays/sdhost-overlay.dts b/arch/arm/boot/dts/overlays/sdhost-overlay.dts
new file mode 100644
index 000000000000..de3d1b0a5e40
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/sdhost-overlay.dts
@@ -0,0 +1,31 @@
+/dts-v1/;
+/plugin/;
+
+/* Provide backwards compatible aliases for the old sdhost dtparams. */
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&sdhost>;
+		frag0: __overlay__ {
+			brcm,overclock-50 = <0>;
+			brcm,pio-limit = <1>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&mmc>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	__overrides__ {
+		overclock_50     = <&frag0>,"brcm,overclock-50:0";
+		force_pio        = <&frag0>,"brcm,force-pio?";
+		pio_limit        = <&frag0>,"brcm,pio-limit:0";
+		debug            = <&frag0>,"brcm,debug?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/sdio-1bit-overlay.dts b/arch/arm/boot/dts/overlays/sdio-1bit-overlay.dts
new file mode 100644
index 000000000000..297daae8faf9
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/sdio-1bit-overlay.dts
@@ -0,0 +1,63 @@
+/dts-v1/;
+/plugin/;
+
+/* Enable 1-bit SDIO from MMC interface via GPIOs 22-25. Includes sdhost overlay. */
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&mmc>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@1 {
+		target = <&soc>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			sdio_1bit: sdio@7e300000 {
+				compatible = "brcm,bcm2835-mmc",
+					     "brcm,bcm2835-sdhci";
+				reg = <0x7e300000 0x100>;
+				interrupts = <2 30>;
+				clocks = <&clocks 28/*BCM2835_CLOCK_EMMC*/>;
+				dmas = <&dma 11>;
+				dma-names = "rx-tx";
+				brcm,overclock-50 = <0>;
+				status = "okay";
+				pinctrl-names = "default";
+				pinctrl-0 = <&sdio_1bit_pins>;
+				non-removable;
+				bus-width = <1>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&gpio>;
+		__overlay__ {
+			sdio_1bit_pins: sdio_1bit_pins {
+				brcm,pins = <22 23 24 25>;
+				brcm,function = <7>; /* ALT3 = SD1 */
+				brcm,pull = <0 2 2 2>;
+			};
+		};
+	};
+
+	fragment@3 {
+		target-path = "/aliases";
+		__overlay__ {
+			mmc1 = "/soc/sdio@7e300000";
+		};
+	};
+
+
+	__overrides__ {
+		poll_once = <&sdio_1bit>,"non-removable?";
+		sdio_overclock = <&sdio_1bit>,"brcm,overclock-50:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/sdio-overlay.dts b/arch/arm/boot/dts/overlays/sdio-overlay.dts
new file mode 100644
index 000000000000..685b65a858e8
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/sdio-overlay.dts
@@ -0,0 +1,63 @@
+/dts-v1/;
+/plugin/;
+
+/* Enable SDIO from MMC interface via GPIOs 22-27. Includes sdhost overlay. */
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&mmc>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@1 {
+		target = <&soc>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			sdio_ovl: sdio@7e300000 {
+				compatible = "brcm,bcm2835-mmc",
+					     "brcm,bcm2835-sdhci";
+				reg = <0x7e300000 0x100>;
+				interrupts = <2 30>;
+				clocks = <&clocks 28/*BCM2835_CLOCK_EMMC*/>;
+				dmas = <&dma 11>;
+				dma-names = "rx-tx";
+				brcm,overclock-50 = <0>;
+				status = "okay";
+				pinctrl-names = "default";
+				pinctrl-0 = <&sdio_ovl_pins>;
+				non-removable;
+				bus-width = <1>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&gpio>;
+		__overlay__ {
+			sdio_ovl_pins: sdio_ovl_pins {
+				brcm,pins = <22 23 24 25 26 27>;
+				brcm,function = <7>; /* ALT3 = SD1 */
+				brcm,pull = <0 2 2 2 2 2>;
+			};
+		};
+	};
+
+	fragment@3 {
+		target-path = "/aliases";
+		__overlay__ {
+			mmc1 = "/soc/sdio@7e300000";
+		};
+	};
+
+	__overrides__ {
+		poll_once = <&sdio_ovl>,"non-removable?";
+		bus_width = <&sdio_ovl>,"bus-width:0";
+		sdio_overclock = <&sdio_ovl>,"brcm,overclock-50:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/sdtweak-overlay.dts b/arch/arm/boot/dts/overlays/sdtweak-overlay.dts
new file mode 100644
index 000000000000..5880e7cd5d1c
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/sdtweak-overlay.dts
@@ -0,0 +1,25 @@
+/dts-v1/;
+/plugin/;
+
+/* Provide backwards compatible aliases for the old sdhost dtparams. */
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&sdhost>;
+		frag0: __overlay__ {
+			brcm,overclock-50 = <0>;
+			brcm,pio-limit = <1>;
+		};
+	};
+
+	__overrides__ {
+		overclock_50     = <&frag0>,"brcm,overclock-50:0";
+		force_pio        = <&frag0>,"brcm,force-pio?";
+		pio_limit        = <&frag0>,"brcm,pio-limit:0";
+		debug            = <&frag0>,"brcm,debug?";
+		enable           = <&frag0>,"status";
+		poll_once        = <&frag0>,"non-removable?";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/smi-dev-overlay.dts b/arch/arm/boot/dts/overlays/smi-dev-overlay.dts
new file mode 100644
index 000000000000..b610d8283608
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/smi-dev-overlay.dts
@@ -0,0 +1,18 @@
+// Description: Overlay to enable character device interface for SMI.
+// Author:	Luke Wren <luke@raspberrypi.org>
+
+/dts-v1/;
+/plugin/;
+
+/{
+	fragment@0 {
+		target = <&soc>;
+		__overlay__ {
+			smi_dev {
+				compatible = "brcm,bcm2835-smi-dev";
+				smi_handle = <&smi>;
+				status = "okay";
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/smi-nand-overlay.dts b/arch/arm/boot/dts/overlays/smi-nand-overlay.dts
new file mode 100644
index 000000000000..13ce0b7cfb24
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/smi-nand-overlay.dts
@@ -0,0 +1,69 @@
+// Description: Overlay to enable NAND flash through
+// the secondary memory interface
+// Author:	Luke Wren
+
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&smi>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&smi_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&soc>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			nand: flash@0 {
+				compatible = "brcm,bcm2835-smi-nand";
+				smi_handle = <&smi>;
+				#address-cells = <1>;
+				#size-cells = <1>;
+				status = "okay";
+
+				partition@0 {
+					label = "stage2";
+					// 128k
+					reg = <0 0x20000>;
+					read-only;
+				};
+				partition@1 {
+					label = "firmware";
+					// 16M
+					reg = <0x20000 0x1000000>;
+					read-only;
+				};
+				partition@2 {
+					label = "root";
+					// 2G (will need to use 64 bit for >=4G)
+					reg = <0x1020000 0x80000000>;
+				};
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&gpio>;
+		__overlay__ {
+			smi_pins: smi_pins {
+				brcm,pins = <0 1 2 3 4 5 6 7 8 9 10 11
+					12 13 14 15>;
+				/* Alt 1: SMI */
+				brcm,function = <5 5 5 5 5 5 5 5 5 5 5
+					5 5 5 5 5>;
+				/* /CS, /WE and /OE are pulled high, as they are
+				   generally active low signals */
+				brcm,pull = <2 2 2 2 2 2 2 2 0 0 0 0 0 0 0 0>;
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/smi-overlay.dts b/arch/arm/boot/dts/overlays/smi-overlay.dts
new file mode 100644
index 000000000000..095f52c355fd
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/smi-overlay.dts
@@ -0,0 +1,37 @@
+// Description:	Overlay to enable the secondary memory interface peripheral
+// Author:	Luke Wren
+
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&smi>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&smi_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			smi_pins: smi_pins {
+				/* Don't configure the top two address bits, as
+				   these are already used as ID_SD and ID_SC */
+				brcm,pins = <2 3 4 5 6 7 8 9 10 11 12 13 14 15
+					     16 17 18 19 20 21 22 23 24 25>;
+				/* Alt 0: SMI */
+				brcm,function = <5 5 5 5 5 5 5 5 5 5 5 5 5 5 5
+						 5 5 5 5 5 5 5 5 5>;
+				/* /CS, /WE and /OE are pulled high, as they are
+				   generally active low signals */
+				brcm,pull = <2 2 2 2 2 2 0 0 0 0 0 0 0 0 0 0 0
+					     0 0 0 0 0 0 0>;
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts b/arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts
new file mode 100644
index 000000000000..49803b309f86
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi-gpio35-39-overlay.dts
@@ -0,0 +1,31 @@
+/*
+ * Device tree overlay to move spi0 to gpio 35 to 39 on CM
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			cs-gpios = <&gpio 36 1>, <&gpio 35 1>;
+		};
+	};
+
+	fragment@1 {
+		target = <&spi0_cs_pins>;
+		__overlay__ {
+			brcm,pins = <36 35>;
+		};
+	};
+
+	fragment@2 {
+		target = <&spi0_pins>;
+		__overlay__ {
+			brcm,pins = <37 38 39>;
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi-rtc-overlay.dts b/arch/arm/boot/dts/overlays/spi-rtc-overlay.dts
new file mode 100644
index 000000000000..88d1800d63c9
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi-rtc-overlay.dts
@@ -0,0 +1,33 @@
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&spidev0>;
+		__dormant__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@1 {
+		target = <&spi0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			rtc-pcf2123@0 {
+				compatible = "nxp,rtc-pcf2123";
+				spi-max-frequency = <5000000>;
+				spi-cs-high = <1>;
+				reg = <0>;
+			};
+		};
+	};
+
+	__overrides__ {
+		pcf2123 = <0>, "=0=1";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi0-cs-overlay.dts b/arch/arm/boot/dts/overlays/spi0-cs-overlay.dts
new file mode 100644
index 000000000000..7f79029d043c
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi0-cs-overlay.dts
@@ -0,0 +1,29 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0_cs_pins>;
+		frag0: __overlay__ {
+			brcm,pins = <8 7>;
+		};
+	};
+
+	fragment@1 {
+		target = <&spi0>;
+		frag1: __overlay__ {
+			cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&frag0>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs1_pin  = <&frag0>,"brcm,pins:4",
+			   <&frag1>,"cs-gpios:16";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi0-hw-cs-overlay.dts b/arch/arm/boot/dts/overlays/spi0-hw-cs-overlay.dts
new file mode 100644
index 000000000000..ef9845f7184e
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi0-hw-cs-overlay.dts
@@ -0,0 +1,26 @@
+/*
+ * Device tree overlay to re-enable hardware CS for SPI0
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			cs-gpios = <0>, <0>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spi0_cs_pins>;
+		__overlay__ {
+			brcm,pins = <8 7>;
+			brcm,function = <4>; /* alt0 */
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts
new file mode 100644
index 000000000000..c3d4f96b7aa9
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi1-1cs-overlay.dts
@@ -0,0 +1,57 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			spi1_pins: spi1_pins {
+				brcm,pins = <19 20 21>;
+				brcm,function = <3>; /* alt4 */
+			};
+
+			spi1_cs_pins: spi1_cs_pins {
+				brcm,pins = <18>;
+				brcm,function = <1>; /* output */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&spi1>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
+			cs-gpios = <&gpio 18 1>;
+			status = "okay";
+
+			spidev1_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&aux>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&spi1_cs_pins>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs0_spidev = <&spidev1_0>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts
new file mode 100644
index 000000000000..2ad62497dc89
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi1-2cs-overlay.dts
@@ -0,0 +1,69 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			spi1_pins: spi1_pins {
+				brcm,pins = <19 20 21>;
+				brcm,function = <3>; /* alt4 */
+			};
+
+			spi1_cs_pins: spi1_cs_pins {
+				brcm,pins = <18 17>;
+				brcm,function = <1>; /* output */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&spi1>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
+			cs-gpios = <&gpio 18 1>, <&gpio 17 1>;
+			status = "okay";
+
+			spidev1_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+
+			spidev1_1: spidev@1 {
+				compatible = "spidev";
+				reg = <1>;      /* CE1 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&aux>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&spi1_cs_pins>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs1_pin  = <&spi1_cs_pins>,"brcm,pins:4",
+			   <&frag1>,"cs-gpios:16";
+		cs0_spidev = <&spidev1_0>,"status";
+		cs1_spidev = <&spidev1_1>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts b/arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts
new file mode 100644
index 000000000000..ef82890453bf
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi1-3cs-overlay.dts
@@ -0,0 +1,81 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			spi1_pins: spi1_pins {
+				brcm,pins = <19 20 21>;
+				brcm,function = <3>; /* alt4 */
+			};
+
+			spi1_cs_pins: spi1_cs_pins {
+				brcm,pins = <18 17 16>;
+				brcm,function = <1>; /* output */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&spi1>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi1_pins &spi1_cs_pins>;
+			cs-gpios = <&gpio 18 1>, <&gpio 17 1>, <&gpio 16 1>;
+			status = "okay";
+
+			spidev1_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+
+			spidev1_1: spidev@1 {
+				compatible = "spidev";
+				reg = <1>;      /* CE1 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+
+			spidev1_2: spidev@2 {
+				compatible = "spidev";
+				reg = <2>;      /* CE2 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&aux>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&spi1_cs_pins>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs1_pin  = <&spi1_cs_pins>,"brcm,pins:4",
+			   <&frag1>,"cs-gpios:16";
+		cs2_pin  = <&spi1_cs_pins>,"brcm,pins:8",
+			   <&frag1>,"cs-gpios:28";
+		cs0_spidev = <&spidev1_0>,"status";
+		cs1_spidev = <&spidev1_1>,"status";
+		cs2_spidev = <&spidev1_2>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts b/arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts
new file mode 100644
index 000000000000..761b6be4ff9b
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi2-1cs-overlay.dts
@@ -0,0 +1,57 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			spi2_pins: spi2_pins {
+				brcm,pins = <40 41 42>;
+				brcm,function = <3>; /* alt4 */
+			};
+
+			spi2_cs_pins: spi2_cs_pins {
+				brcm,pins = <43>;
+				brcm,function = <1>; /* output */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&spi2>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi2_pins &spi2_cs_pins>;
+			cs-gpios = <&gpio 43 1>;
+			status = "okay";
+
+			spidev2_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&aux>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&spi2_cs_pins>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs0_spidev = <&spidev2_0>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts b/arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts
new file mode 100644
index 000000000000..e533aba113de
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi2-2cs-overlay.dts
@@ -0,0 +1,69 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			spi2_pins: spi2_pins {
+				brcm,pins = <40 41 42>;
+				brcm,function = <3>; /* alt4 */
+			};
+
+			spi2_cs_pins: spi2_cs_pins {
+				brcm,pins = <43 44>;
+				brcm,function = <1>; /* output */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&spi2>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi2_pins &spi2_cs_pins>;
+			cs-gpios = <&gpio 43 1>, <&gpio 44 1>;
+			status = "okay";
+
+			spidev2_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+
+			spidev2_1: spidev@1 {
+				compatible = "spidev";
+				reg = <1>;      /* CE1 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&aux>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&spi2_cs_pins>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs1_pin  = <&spi2_cs_pins>,"brcm,pins:4",
+			   <&frag1>,"cs-gpios:16";
+		cs0_spidev = <&spidev2_0>,"status";
+		cs1_spidev = <&spidev2_1>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts b/arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts
new file mode 100644
index 000000000000..a62e107dc98f
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/spi2-3cs-overlay.dts
@@ -0,0 +1,81 @@
+/dts-v1/;
+/plugin/;
+
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&gpio>;
+		__overlay__ {
+			spi2_pins: spi2_pins {
+				brcm,pins = <40 41 42>;
+				brcm,function = <3>; /* alt4 */
+			};
+
+			spi2_cs_pins: spi2_cs_pins {
+				brcm,pins = <43 44 45>;
+				brcm,function = <1>; /* output */
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&spi2>;
+		frag1: __overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi2_pins &spi2_cs_pins>;
+			cs-gpios = <&gpio 43 1>, <&gpio 44 1>, <&gpio 45 1>;
+			status = "okay";
+
+			spidev2_0: spidev@0 {
+				compatible = "spidev";
+				reg = <0>;      /* CE0 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+
+			spidev2_1: spidev@1 {
+				compatible = "spidev";
+				reg = <1>;      /* CE1 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+
+			spidev2_2: spidev@2 {
+				compatible = "spidev";
+				reg = <2>;      /* CE2 */
+				#address-cells = <1>;
+				#size-cells = <0>;
+				spi-max-frequency = <125000000>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@2 {
+		target = <&aux>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		cs0_pin  = <&spi2_cs_pins>,"brcm,pins:0",
+			   <&frag1>,"cs-gpios:4";
+		cs1_pin  = <&spi2_cs_pins>,"brcm,pins:4",
+			   <&frag1>,"cs-gpios:16";
+		cs2_pin  = <&spi2_cs_pins>,"brcm,pins:8",
+			   <&frag1>,"cs-gpios:28";
+		cs0_spidev = <&spidev2_0>,"status";
+		cs1_spidev = <&spidev2_1>,"status";
+		cs2_spidev = <&spidev2_2>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/superaudioboard-overlay.dts b/arch/arm/boot/dts/overlays/superaudioboard-overlay.dts
new file mode 100755
index 000000000000..e625faeed7fb
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/superaudioboard-overlay.dts
@@ -0,0 +1,73 @@
+// Definitions for SuperAudioBoard
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&sound>;
+		__overlay__ {
+			compatible = "simple-audio-card";
+			i2s-controller = <&i2s>;
+			status = "okay";
+
+			simple-audio-card,name = "SuperAudioBoard";
+
+			simple-audio-card,widgets =
+				"Line", "Line In",
+				"Line", "Line Out";
+
+			simple-audio-card,routing =
+				"Line Out","AOUTA+",
+				"Line Out","AOUTA-",
+				"Line Out","AOUTB+",
+				"Line Out","AOUTB-",
+				"AINA","Line In",
+				"AINB","Line In";
+
+			simple-audio-card,format = "i2s";
+
+			simple-audio-card,bitclock-master = <&sound_master>;
+			simple-audio-card,frame-master = <&sound_master>;
+
+			simple-audio-card,cpu {
+				sound-dai = <&i2s>;
+				dai-tdm-slot-num = <2>;
+				dai-tdm-slot-width = <32>;
+			};
+
+			sound_master: simple-audio-card,codec {
+				sound-dai = <&cs4271>;
+				system-clock-frequency = <24576000>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2s>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+    
+	fragment@2 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			cs4271: cs4271@10 {
+				#sound-dai-cells = <0>;
+				compatible = "cirrus,cs4271";
+				reg = <0x10>;
+				status = "okay";
+				reset-gpio = <&gpio 26 0>; /* Pin 26, active high */
+			};
+		};
+	};
+	__overrides__ {
+		gpiopin = <&cs4271>,"reset-gpio:4";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/sx150x-overlay.dts b/arch/arm/boot/dts/overlays/sx150x-overlay.dts
new file mode 100644
index 000000000000..0321b292c133
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/sx150x-overlay.dts
@@ -0,0 +1,1706 @@
+// Definitions for SX150x I2C GPIO Expanders from Semtech
+
+// dtparams:
+//     sx150<x>-<n>-<m>          - Enables SX150X device on I2C#<n> with slave address <m>. <x> may be 1-9.
+//                                 <n> may be 0 or 1.  Permissible values of <m> (which is denoted in hex)
+//                                 depend on the device variant.
+//                                 For SX1501, SX1502, SX1504 and SX1505, <m> may be 20 or 21.
+//                                 For SX1503 and SX1506, <m> may be 20.
+//                                 For SX1507 and SX1509, <m> may be 3E, 3F, 70 or 71.
+//                                 For SX1508, <m> may be 20, 21, 22 or 23.
+//     sx150<x>-<n>-<m>-int-gpio - Integer, enables interrupts on SX150X device on I2C#<n> with slave address <m>,
+//                                 specifies the GPIO pin to which NINT output of SX150X is connected.
+//
+//
+// Example 1: A single SX1505 device on I2C#1 with its slave address set to 0x20 and NINT output connected to GPIO25:
+// dtoverlay=sx150x:sx1505-1-20,sx1505-1-20-int-gpio=25
+//
+// Example 2: Two SX1507 devices on I2C#0 with their slave addresses set to 0x3E and 0x70 (interrupts not used):
+// dtoverlay=sx150x:sx1507-0-3E,sx1507-0-70
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	// Enable I2C#0 interface
+	fragment@0 {
+		target = <&i2c0>;
+		__dormant__ {
+			status = "okay";
+		};
+	};
+
+	// Enable I2C#1 interface
+	fragment@1 {
+		target = <&i2c1>;
+		__dormant__ {
+			status = "okay";
+		};
+	};
+
+	// Enable a SX1501 on I2C#0 at slave addr 0x20
+	fragment@2 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1501_0_20: sx150x@20 {
+				compatible = "semtech,sx1501q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1501-0-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1501 on I2C#1 at slave addr 0x20
+	fragment@3 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1501_1_20: sx150x@20 {
+				compatible = "semtech,sx1501q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1501-1-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1501 on I2C#0 at slave addr 0x21
+	fragment@4 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1501_0_21: sx150x@21 {
+				compatible = "semtech,sx1501q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1501-0-21-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1501 on I2C#1 at slave addr 0x21
+	fragment@5 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1501_1_21: sx150x@21 {
+				compatible = "semtech,sx1501q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1501-1-21-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1502 on I2C#0 at slave addr 0x20
+	fragment@6 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1502_0_20: sx150x@20 {
+				compatible = "semtech,sx1502q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1502-0-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1502 on I2C#1 at slave addr 0x20
+	fragment@7 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1502_1_20: sx150x@20 {
+				compatible = "semtech,sx1502q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1502-1-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1502 on I2C#0 at slave addr 0x21
+	fragment@8 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1502_0_21: sx150x@21 {
+				compatible = "semtech,sx1502q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1502-0-21-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1502 on I2C#1 at slave addr 0x21
+	fragment@9 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1502_1_21: sx150x@21 {
+				compatible = "semtech,sx1502q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1501-1-21-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1503 on I2C#0 at slave addr 0x20
+	fragment@10 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1503_0_20: sx150x@20 {
+				compatible = "semtech,sx1503q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1503-0-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1503 on I2C#1 at slave addr 0x20
+	fragment@11 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1503_1_20: sx150x@20 {
+				compatible = "semtech,sx1503q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1503-1-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1504 on I2C#0 at slave addr 0x20
+	fragment@12 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1504_0_20: sx150x@20 {
+				compatible = "semtech,sx1504q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1504-0-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1504 on I2C#1 at slave addr 0x20
+	fragment@13 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1504_1_20: sx150x@20 {
+				compatible = "semtech,sx1504q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1504-1-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1504 on I2C#0 at slave addr 0x21
+	fragment@14 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1504_0_21: sx150x@21 {
+				compatible = "semtech,sx1504q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1504-0-21-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1504 on I2C#1 at slave addr 0x21
+	fragment@15 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1504_1_21: sx150x@21 {
+				compatible = "semtech,sx1504q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1504-1-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1505 on I2C#0 at slave addr 0x20
+	fragment@16 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1505_0_20: sx150x@20 {
+				compatible = "semtech,sx1505q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1505-0-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1505 on I2C#1 at slave addr 0x20
+	fragment@17 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1505_1_20: sx150x@20 {
+				compatible = "semtech,sx1505q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1505-1-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1505 on I2C#0 at slave addr 0x21
+	fragment@18 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1505_0_21: sx150x@21 {
+				compatible = "semtech,sx1505q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1505-0-21-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1505 on I2C#1 at slave addr 0x21
+	fragment@19 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1505_1_21: sx150x@21 {
+				compatible = "semtech,sx1505q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1505-1-21-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1506 on I2C#0 at slave addr 0x20
+	fragment@20 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1506_0_20: sx150x@20 {
+				compatible = "semtech,sx1506q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1506-0-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1506 on I2C#1 at slave addr 0x20
+	fragment@21 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1506_1_20: sx150x@20 {
+				compatible = "semtech,sx1506q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1506-1-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1507 on I2C#0 at slave addr 0x3E
+	fragment@22 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1507_0_3E: sx150x@3E {
+				compatible = "semtech,sx1507q";
+				reg = <0x3E>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1507_0_3E-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1507 on I2C#1 at slave addr 0x3E
+	fragment@23 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1507_1_3E: sx150x@3E {
+				compatible = "semtech,sx1507q";
+				reg = <0x3E>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1507_1_3E-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1507 on I2C#0 at slave addr 0x3F
+	fragment@24 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1507_0_3F: sx150x@3F {
+				compatible = "semtech,sx1507q";
+				reg = <0x3F>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1507_0_3F-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1507 on I2C#1 at slave addr 0x3F
+	fragment@25 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1507_1_3F: sx150x@3F {
+				compatible = "semtech,sx1507q";
+				reg = <0x3F>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1507_1_3F-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1507 on I2C#0 at slave addr 0x70
+	fragment@26 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1507_0_70: sx150x@70 {
+				compatible = "semtech,sx1507q";
+				reg = <0x70>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1507-0-70-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1507 on I2C#1 at slave addr 0x70
+	fragment@27 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1507_1_70: sx150x@70 {
+				compatible = "semtech,sx1507q";
+				reg = <0x70>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1507-1-70-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1507 on I2C#0 at slave addr 0x71
+	fragment@28 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1507_0_71: sx150x@71 {
+				compatible = "semtech,sx1507q";
+				reg = <0x71>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1507-0-71-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1507 on I2C#1 at slave addr 0x71
+	fragment@29 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1507_1_71: sx150x@71 {
+				compatible = "semtech,sx1507q";
+				reg = <0x71>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1507-1-71-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1508 on I2C#0 at slave addr 0x20
+	fragment@30 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1508_0_20: sx150x@20 {
+				compatible = "semtech,sx1508q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1508-0-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1508 on I2C#1 at slave addr 0x20
+	fragment@31 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1508_1_20: sx150x@20 {
+				compatible = "semtech,sx1508q";
+				reg = <0x20>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1508-1-20-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1508 on I2C#0 at slave addr 0x21
+	fragment@32 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1508_0_21: sx150x@21 {
+				compatible = "semtech,sx1508q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1508-0-21-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1508 on I2C#1 at slave addr 0x21
+	fragment@33 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1508_1_21: sx150x@21 {
+				compatible = "semtech,sx1508q";
+				reg = <0x21>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1508-1-21-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1508 on I2C#0 at slave addr 0x22
+	fragment@34 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1508_0_22: sx150x@22 {
+				compatible = "semtech,sx1508q";
+				reg = <0x22>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1508-0-22-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1508 on I2C#1 at slave addr 0x22
+	fragment@35 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1508_1_22: sx150x@22 {
+				compatible = "semtech,sx1508q";
+				reg = <0x22>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1508-1-22-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1508 on I2C#0 at slave addr 0x23
+	fragment@36 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1508_0_23: sx150x@23 {
+				compatible = "semtech,sx1508q";
+				reg = <0x23>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1508-0-23-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1508 on I2C#1 at slave addr 0x23
+	fragment@37 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1508_1_23: sx150x@23 {
+				compatible = "semtech,sx1508q";
+				reg = <0x23>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1508-1-23-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1509 on I2C#0 at slave addr 0x3E
+	fragment@38 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1509_0_3E: sx150x@3E {
+				compatible = "semtech,sx1509q";
+				reg = <0x3E>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1509_0_3E-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1509 on I2C#1 at slave addr 0x3E
+	fragment@39 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1509_1_3E: sx150x@3E {
+				compatible = "semtech,sx1509q";
+				reg = <0x3E>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1509_1_3E-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1509 on I2C#0 at slave addr 0x3F
+	fragment@40 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1509_0_3F: sx150x@3F {
+				compatible = "semtech,sx1509q";
+				reg = <0x3F>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1509_0_3F-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1509 on I2C#1 at slave addr 0x3F
+	fragment@41 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1509_1_3F: sx150x@3F {
+				compatible = "semtech,sx1509q";
+				reg = <0x3F>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1509_1_3F-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1509 on I2C#0 at slave addr 0x70
+	fragment@42 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1509_0_70: sx150x@70 {
+				compatible = "semtech,sx1509q";
+				reg = <0x70>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1509-0-70-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1509 on I2C#1 at slave addr 0x70
+	fragment@43 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1509_1_70: sx150x@70 {
+				compatible = "semtech,sx1509q";
+				reg = <0x70>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1509-1-70-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1509 on I2C#0 at slave addr 0x71
+	fragment@44 {
+		target = <&i2c0>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1509_0_71: sx150x@71 {
+				compatible = "semtech,sx1509q";
+				reg = <0x71>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1509-0-71-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable a SX1509 on I2C#1 at slave addr 0x71
+	fragment@45 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sx1509_1_71: sx150x@71 {
+				compatible = "semtech,sx1509q";
+				reg = <0x71>;
+				gpio-controller;
+				#gpio-cells = <2>;
+				#interrupt-cells = <2>;
+				interrupts = <25 2>; /* 1st word overwritten by sx1509-1-71-int-gpio parameter
+				                        2nd word is 2 for falling-edge triggered */
+				status = "okay";
+			};
+		};
+	};
+
+	// Enable interrupts for a SX1501 on I2C#0 at slave addr 0x20
+	fragment@46 {
+		target = <&sx1501_0_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1501 on I2C#1 at slave addr 0x20
+	fragment@47 {
+		target = <&sx1501_1_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1501 on I2C#0 at slave addr 0x21
+	fragment@48 {
+		target = <&sx1501_0_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1501 on I2C#1 at slave addr 0x21
+	fragment@49 {
+		target = <&sx1501_1_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1502 on I2C#0 at slave addr 0x20
+	fragment@50 {
+		target = <&sx1502_0_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1502 on I2C#1 at slave addr 0x20
+	fragment@51 {
+		target = <&sx1502_1_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1502 on I2C#0 at slave addr 0x21
+	fragment@52 {
+		target = <&sx1502_0_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1502 on I2C#1 at slave addr 0x21
+	fragment@53 {
+		target = <&sx1502_1_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1503 on I2C#0 at slave addr 0x20
+	fragment@54 {
+		target = <&sx1503_0_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1503 on I2C#1 at slave addr 0x20
+	fragment@55 {
+		target = <&sx1503_1_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1504 on I2C#0 at slave addr 0x20
+	fragment@56 {
+		target = <&sx1504_0_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1504 on I2C#1 at slave addr 0x20
+	fragment@57 {
+		target = <&sx1504_1_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1504 on I2C#0 at slave addr 0x21
+	fragment@58 {
+		target = <&sx1504_0_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1504 on I2C#1 at slave addr 0x21
+	fragment@59 {
+		target = <&sx1504_1_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1505 on I2C#0 at slave addr 0x20
+	fragment@60 {
+		target = <&sx1505_0_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1505 on I2C#1 at slave addr 0x20
+	fragment@61 {
+		target = <&sx1505_1_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1505 on I2C#0 at slave addr 0x21
+	fragment@62 {
+		target = <&sx1505_0_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1505 on I2C#1 at slave addr 0x21
+	fragment@63 {
+		target = <&sx1505_1_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1506 on I2C#0 at slave addr 0x20
+	fragment@64 {
+		target = <&sx1506_0_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1506 on I2C#1 at slave addr 0x20
+	fragment@65 {
+		target = <&sx1506_1_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1507 on I2C#0 at slave addr 0x3E
+	fragment@66 {
+		target = <&sx1507_0_3E>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_3E_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1507 on I2C#1 at slave addr 0x3E
+	fragment@67 {
+		target = <&sx1507_1_3E>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_3E_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1507 on I2C#0 at slave addr 0x3F
+	fragment@68 {
+		target = <&sx1507_0_3F>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_3F_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1507 on I2C#1 at slave addr 0x3F
+	fragment@69 {
+		target = <&sx1507_1_3F>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_3F_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1507 on I2C#0 at slave addr 0x70
+	fragment@70 {
+		target = <&sx1507_0_70>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_70_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1507 on I2C#1 at slave addr 0x70
+	fragment@71 {
+		target = <&sx1507_1_70>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_70_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1507 on I2C#0 at slave addr 0x71
+	fragment@72 {
+		target = <&sx1507_0_71>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_71_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1507 on I2C#1 at slave addr 0x71
+	fragment@73 {
+		target = <&sx1507_1_71>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_71_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1508 on I2C#0 at slave addr 0x20
+	fragment@74 {
+		target = <&sx1508_0_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1508 on I2C#1 at slave addr 0x20
+	fragment@75 {
+		target = <&sx1508_1_20>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_20_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1508 on I2C#0 at slave addr 0x21
+	fragment@76 {
+		target = <&sx1508_0_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1508 on I2C#1 at slave addr 0x21
+	fragment@77 {
+		target = <&sx1508_1_21>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_21_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1508 on I2C#0 at slave addr 0x22
+	fragment@78 {
+		target = <&sx1508_0_22>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_22_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1508 on I2C#1 at slave addr 0x22
+	fragment@79 {
+		target = <&sx1508_1_22>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_22_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1508 on I2C#0 at slave addr 0x23
+	fragment@80 {
+		target = <&sx1508_0_23>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_23_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1508 on I2C#1 at slave addr 0x23
+	fragment@81 {
+		target = <&sx1508_1_23>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_23_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1509 on I2C#0 at slave addr 0x3E
+	fragment@82 {
+		target = <&sx1509_0_3E>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_3E_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1509 on I2C#1 at slave addr 0x3E
+	fragment@83 {
+		target = <&sx1509_1_3E>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_3E_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1509 on I2C#0 at slave addr 0x3F
+	fragment@84 {
+		target = <&sx1509_0_3F>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_3F_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1509 on I2C#1 at slave addr 0x3F
+	fragment@85 {
+		target = <&sx1509_1_3F>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_3F_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1509 on I2C#0 at slave addr 0x70
+	fragment@86 {
+		target = <&sx1509_0_70>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_70_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1509 on I2C#1 at slave addr 0x70
+	fragment@87 {
+		target = <&sx1509_1_70>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_70_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1509 on I2C#0 at slave addr 0x71
+	fragment@88 {
+		target = <&sx1509_0_71>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_0_71_pins>;
+		};
+	};
+
+	// Enable interrupts for a SX1509 on I2C#1 at slave addr 0x71
+	fragment@89 {
+		target = <&sx1509_1_71>;
+		__dormant__ {
+			interrupt-parent = <&gpio>;
+			interrupt-controller;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sx150x_1_71_pins>;
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x20
+        // Configure as a input with no pull-up/down
+	fragment@90 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_0_20_pins: sx150x_0_20_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-0-20-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x20
+        // Configure as a input with no pull-up/down
+	fragment@91 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_1_20_pins: sx150x_1_20_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-1-20-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x21
+        // Configure as a input with no pull-up/down
+	fragment@92 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_0_21_pins: sx150x_0_21_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-0-21-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x21
+        // Configure as a input with no pull-up/down
+	fragment@93 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_1_21_pins: sx150x_1_21_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-1-21-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x22
+        // Configure as a input with no pull-up/down
+	fragment@94 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_0_22_pins: sx150x_0_22_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-0-22-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x22
+        // Configure as a input with no pull-up/down
+	fragment@95 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_1_22_pins: sx150x_1_22_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-1-22-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x23
+        // Configure as a input with no pull-up/down
+	fragment@96 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_0_23_pins: sx150x_0_23_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-0-23-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x23
+        // Configure as a input with no pull-up/down
+	fragment@97 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_1_23_pins: sx150x_1_23_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-1-23-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x3E
+        // Configure as a input with no pull-up/down
+	fragment@98 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_0_3E_pins: sx150x_0_3E_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-0-3E-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x3E
+        // Configure as a input with no pull-up/down
+	fragment@99 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_1_3E_pins: sx150x_1_3E_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-1-3E-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x3F
+        // Configure as a input with no pull-up/down
+	fragment@100 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_0_3F_pins: sx150x_0_3F_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-0-3F-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x3F
+        // Configure as a input with no pull-up/down
+	fragment@101 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_1_3F_pins: sx150x_1_3F_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-1-3F-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x70
+        // Configure as a input with no pull-up/down
+	fragment@102 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_0_70_pins: sx150x_0_70_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-0-70-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x70
+        // Configure as a input with no pull-up/down
+	fragment@103 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_1_70_pins: sx150x_1_70_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-1-70-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#0 interface at slave addr 0x71
+        // Configure as a input with no pull-up/down
+	fragment@104 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_0_71_pins: sx150x_0_71_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-0-71-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	// Configure GPIO pin connected to NINT output of a SX150x on I2C#1 interface at slave addr 0x71
+        // Configure as a input with no pull-up/down
+	fragment@105 {
+		target = <&gpio>;
+		__dormant__ {
+			sx150x_1_71_pins: sx150x_1_71_pins {
+				brcm,pins = <0>;  /* overwritten by sx150x-1-71-int-gpio parameter */
+				brcm,function = <0>;
+				brcm,pull = <0>;
+			};
+		};
+	};
+
+	__overrides__ {
+		sx1501-0-20          = <0>,"+0+2";
+		sx1501-1-20          = <0>,"+1+3";
+		sx1501-0-21          = <0>,"+0+4";
+		sx1501-1-21          = <0>,"+1+5";
+		sx1502-0-20          = <0>,"+0+6";
+		sx1502-1-20          = <0>,"+1+7";
+		sx1502-0-21          = <0>,"+0+8";
+		sx1502-1-21          = <0>,"+1+9";
+		sx1503-0-20          = <0>,"+0+10";
+		sx1503-1-20          = <0>,"+1+11";
+		sx1504-0-20          = <0>,"+0+12";
+		sx1504-1-20          = <0>,"+1+13";
+		sx1504-0-21          = <0>,"+0+14";
+		sx1504-1-21          = <0>,"+1+15";
+		sx1505-0-20          = <0>,"+0+16";
+		sx1505-1-20          = <0>,"+1+17";
+		sx1505-0-21          = <0>,"+0+18";
+		sx1505-1-21          = <0>,"+1+19";
+		sx1506-0-20          = <0>,"+0+20";
+		sx1506-1-20          = <0>,"+1+21";
+		sx1507-0-3E          = <0>,"+0+22";
+		sx1507-1-3E          = <0>,"+1+23";
+		sx1507-0-3F          = <0>,"+0+24";
+		sx1507-1-3F          = <0>,"+1+25";
+		sx1507-0-70          = <0>,"+0+26";
+		sx1507-1-70          = <0>,"+1+27";
+		sx1507-0-71          = <0>,"+0+28";
+		sx1507-1-71          = <0>,"+1+29";
+		sx1508-0-20          = <0>,"+0+30";
+		sx1508-1-20          = <0>,"+1+31";
+		sx1508-0-21          = <0>,"+0+32";
+		sx1508-1-21          = <0>,"+1+33";
+		sx1508-0-22          = <0>,"+0+34";
+		sx1508-1-22          = <0>,"+1+35";
+		sx1508-0-23          = <0>,"+0+36";
+		sx1508-1-23          = <0>,"+1+37";
+		sx1509-0-3E          = <0>,"+0+38";
+		sx1509-1-3E          = <0>,"+1+39";
+		sx1509-0-3F          = <0>,"+0+40";
+		sx1509-1-3F          = <0>,"+1+41";
+		sx1509-0-70          = <0>,"+0+42";
+		sx1509-1-70          = <0>,"+1+43";
+		sx1509-0-71          = <0>,"+0+44";
+		sx1509-1-71          = <0>,"+1+45";
+		sx1501-0-20-int-gpio = <0>,"+46+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1501_0_20>,"interrupts:0";
+		sx1501-1-20-int-gpio = <0>,"+47+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1501_1_20>,"interrupts:0";
+		sx1501-0-21-int-gpio = <0>,"+48+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1501_0_21>,"interrupts:0";
+		sx1501-1-21-int-gpio = <0>,"+49+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1501_1_21>,"interrupts:0";
+		sx1502-0-20-int-gpio = <0>,"+50+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1502_0_20>,"interrupts:0";
+		sx1502-1-20-int-gpio = <0>,"+51+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1502_1_20>,"interrupts:0";
+		sx1502-0-21-int-gpio = <0>,"+52+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1502_0_21>,"interrupts:0";
+		sx1502-1-21-int-gpio = <0>,"+53+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1502_1_21>,"interrupts:0";
+		sx1503-0-20-int-gpio = <0>,"+54+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1503_0_20>,"interrupts:0";
+		sx1503-1-20-int-gpio = <0>,"+55+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1503_1_20>,"interrupts:0";
+		sx1504-0-20-int-gpio = <0>,"+56+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1504_0_20>,"interrupts:0";
+		sx1504-1-20-int-gpio = <0>,"+57+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1504_1_20>,"interrupts:0";
+		sx1504-0-21-int-gpio = <0>,"+58+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1504_0_21>,"interrupts:0";
+		sx1504-1-21-int-gpio = <0>,"+59+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1504_1_21>,"interrupts:0";
+		sx1505-0-20-int-gpio = <0>,"+60+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1505_0_20>,"interrupts:0";
+		sx1505-1-20-int-gpio = <0>,"+61+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1505_1_20>,"interrupts:0";
+		sx1505-0-21-int-gpio = <0>,"+62+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1505_0_21>,"interrupts:0";
+		sx1505-1-21-int-gpio = <0>,"+63+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1505_1_21>,"interrupts:0";
+		sx1506-0-20-int-gpio = <0>,"+64+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1506_0_20>,"interrupts:0";
+		sx1506-1-20-int-gpio = <0>,"+65+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1506_1_20>,"interrupts:0";
+		sx1507-0-3E-int-gpio = <0>,"+66+98",  <&sx150x_0_3E_pins>,"brcm,pins:0", <&sx1507_0_3E>,"interrupts:0";
+		sx1507-1-3E-int-gpio = <0>,"+67+99",  <&sx150x_1_3E_pins>,"brcm,pins:0", <&sx1507_1_3E>,"interrupts:0";
+		sx1507-0-3F-int-gpio = <0>,"+68+100", <&sx150x_0_3F_pins>,"brcm,pins:0", <&sx1507_0_3F>,"interrupts:0";
+		sx1507-1-3F-int-gpio = <0>,"+69+101", <&sx150x_1_3F_pins>,"brcm,pins:0", <&sx1507_1_3F>,"interrupts:0";
+		sx1507-0-70-int-gpio = <0>,"+60+102", <&sx150x_0_70_pins>,"brcm,pins:0", <&sx1507_0_70>,"interrupts:0";
+		sx1507-1-70-int-gpio = <0>,"+71+103", <&sx150x_1_70_pins>,"brcm,pins:0", <&sx1507_1_70>,"interrupts:0";
+		sx1507-0-71-int-gpio = <0>,"+72+104", <&sx150x_0_71_pins>,"brcm,pins:0", <&sx1507_0_71>,"interrupts:0";
+		sx1507-1-71-int-gpio = <0>,"+73+105", <&sx150x_1_71_pins>,"brcm,pins:0", <&sx1507_1_71>,"interrupts:0";
+		sx1508-0-20-int-gpio = <0>,"+74+90",  <&sx150x_0_20_pins>,"brcm,pins:0", <&sx1508_0_20>,"interrupts:0";
+		sx1508-1-20-int-gpio = <0>,"+75+91",  <&sx150x_1_20_pins>,"brcm,pins:0", <&sx1508_1_20>,"interrupts:0";
+		sx1508-0-21-int-gpio = <0>,"+76+92",  <&sx150x_0_21_pins>,"brcm,pins:0", <&sx1508_0_21>,"interrupts:0";
+		sx1508-1-21-int-gpio = <0>,"+77+93",  <&sx150x_1_21_pins>,"brcm,pins:0", <&sx1508_1_21>,"interrupts:0";
+		sx1508-0-22-int-gpio = <0>,"+78+94",  <&sx150x_0_22_pins>,"brcm,pins:0", <&sx1508_0_22>,"interrupts:0";
+		sx1508-1-22-int-gpio = <0>,"+79+95",  <&sx150x_1_22_pins>,"brcm,pins:0", <&sx1508_1_22>,"interrupts:0";
+		sx1508-0-23-int-gpio = <0>,"+80+96",  <&sx150x_0_23_pins>,"brcm,pins:0", <&sx1508_0_23>,"interrupts:0";
+		sx1508-1-23-int-gpio = <0>,"+81+97",  <&sx150x_1_23_pins>,"brcm,pins:0", <&sx1508_1_23>,"interrupts:0";
+		sx1509-0-3E-int-gpio = <0>,"+82+98",  <&sx150x_0_3E_pins>,"brcm,pins:0", <&sx1509_0_3E>,"interrupts:0";
+		sx1509-1-3E-int-gpio = <0>,"+83+99",  <&sx150x_1_3E_pins>,"brcm,pins:0", <&sx1509_1_3E>,"interrupts:0";
+		sx1509-0-3F-int-gpio = <0>,"+84+100", <&sx150x_0_3F_pins>,"brcm,pins:0", <&sx1509_0_3F>,"interrupts:0";
+		sx1509-1-3F-int-gpio = <0>,"+85+101", <&sx150x_1_3F_pins>,"brcm,pins:0", <&sx1509_1_3F>,"interrupts:0";
+		sx1509-0-70-int-gpio = <0>,"+86+102", <&sx150x_0_70_pins>,"brcm,pins:0", <&sx1509_0_70>,"interrupts:0";
+		sx1509-1-70-int-gpio = <0>,"+87+103", <&sx150x_1_70_pins>,"brcm,pins:0", <&sx1509_1_70>,"interrupts:0";
+		sx1509-0-71-int-gpio = <0>,"+88+104", <&sx150x_0_71_pins>,"brcm,pins:0", <&sx1509_0_71>,"interrupts:0";
+		sx1509-1-71-int-gpio = <0>,"+89+105", <&sx150x_1_71_pins>,"brcm,pins:0", <&sx1509_1_71>,"interrupts:0";
+	};
+};
+
diff --git a/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts b/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
new file mode 100644
index 000000000000..ed2b053aef23
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/tinylcd35-overlay.dts
@@ -0,0 +1,224 @@
+/*
+ * tinylcd35-overlay.dts
+ *
+ * -------------------------------------------------
+ * www.tinlylcd.com
+ * -------------------------------------------------
+ * Device---Driver-----BUS       GPIO's
+ * display  tinylcd35  spi0.0    25 24 18
+ * touch    ads7846    spi0.1    5
+ * rtc      ds1307     i2c1-0068
+ * rtc      pcf8563    i2c1-0051
+ * keypad   gpio-keys  --------- 17 22 27 23 28
+ *
+ *
+ * TinyLCD.com 3.5 inch TFT
+ *
+ *  Version 001
+ *  5/3/2015  -- Noralf Trønnes     Initial Device tree framework
+ *  10/3/2015 -- tinylcd@gmail.com  added ds1307 support.
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&spi0>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&spidev0>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@2 {
+		target = <&spidev1>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+
+	fragment@3 {
+		target = <&gpio>;
+		__overlay__ {
+			tinylcd35_pins: tinylcd35_pins {
+				brcm,pins = <25 24 18>;
+				brcm,function = <1>; /* out */
+			};
+			tinylcd35_ts_pins: tinylcd35_ts_pins {
+				brcm,pins = <5>;
+				brcm,function = <0>; /* in */
+			};
+			keypad_pins: keypad_pins {
+				brcm,pins = <4 17 22 23 27>;
+				brcm,function = <0>; /* in */
+				brcm,pull = <1>; /* down */
+			};
+		};
+	};
+
+	fragment@4 {
+		target = <&spi0>;
+		__overlay__ {
+			/* needed to avoid dtc warning */
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			tinylcd35: tinylcd35@0{
+				compatible = "neosec,tinylcd";
+				reg = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&tinylcd35_pins>,
+					    <&tinylcd35_ts_pins>;
+
+				spi-max-frequency = <48000000>;
+				rotate = <270>;
+				fps = <20>;
+				bgr;
+				buswidth = <8>;
+				reset-gpios = <&gpio 25 0>;
+				dc-gpios = <&gpio 24 0>;
+				led-gpios = <&gpio 18 1>;
+				debug = <0>;
+
+				init = <0x10000B0 0x80
+					0x10000C0 0x0A 0x0A
+					0x10000C1 0x01 0x01
+					0x10000C2 0x33
+					0x10000C5 0x00 0x42 0x80
+					0x10000B1 0xD0 0x11
+					0x10000B4 0x02
+					0x10000B6 0x00 0x22 0x3B
+					0x10000B7 0x07
+					0x1000036 0x58
+					0x10000F0 0x36 0xA5 0xD3
+					0x10000E5 0x80
+					0x10000E5 0x01
+					0x10000B3 0x00
+					0x10000E5 0x00
+					0x10000F0 0x36 0xA5 0x53
+					0x10000E0 0x00 0x35 0x33 0x00 0x00 0x00 0x00 0x35 0x33 0x00 0x00 0x00
+					0x100003A 0x55
+					0x1000011
+					0x2000001
+					0x1000029>;
+			};
+
+			tinylcd35_ts: tinylcd35_ts@1 {
+				compatible = "ti,ads7846";
+				reg = <1>;
+				status = "disabled";
+
+				spi-max-frequency = <2000000>;
+				interrupts = <5 2>; /* high-to-low edge triggered */
+				interrupt-parent = <&gpio>;
+				pendown-gpio = <&gpio 5 0>;
+				ti,x-plate-ohms = /bits/ 16 <100>;
+				ti,pressure-max = /bits/ 16 <255>;
+			};
+		};
+	};
+
+	/*  RTC    */
+
+	fragment@5 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "okay";
+
+			pcf8563: pcf8563@51 {
+				compatible = "nxp,pcf8563";
+				reg = <0x51>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@6 {
+		target = <&i2c1>;
+		__dormant__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "okay";
+
+			ds1307: ds1307@68 {
+				compatible = "maxim,ds1307";
+				reg = <0x68>;
+				status = "okay";
+			};
+		};
+	};
+
+	/*
+	 * Values for input event code is found under the
+	 * 'Keys and buttons' heading in include/uapi/linux/input.h
+	 */
+	fragment@7 {
+		target-path = "/soc";
+		__overlay__ {
+			keypad: keypad {
+				compatible = "gpio-keys";
+				#address-cells = <1>;
+				#size-cells = <0>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&keypad_pins>;
+				status = "disabled";
+				autorepeat;
+
+				button@17 {
+					label = "GPIO KEY_UP";
+					linux,code = <103>;
+					gpios = <&gpio 17 0>;
+				};
+				button@22 {
+					label = "GPIO KEY_DOWN";
+					linux,code = <108>;
+					gpios = <&gpio 22 0>;
+				};
+				button@27 {
+					label = "GPIO KEY_LEFT";
+					linux,code = <105>;
+					gpios = <&gpio 27 0>;
+				};
+				button@23 {
+					label = "GPIO KEY_RIGHT";
+					linux,code = <106>;
+					gpios = <&gpio 23 0>;
+				};
+				button@4 {
+					label = "GPIO KEY_ENTER";
+					linux,code = <28>;
+					gpios = <&gpio 4 0>;
+				};
+			};
+		};
+	};
+
+	__overrides__ {
+		speed =      <&tinylcd35>,"spi-max-frequency:0";
+		rotate =     <&tinylcd35>,"rotate:0";
+		fps =        <&tinylcd35>,"fps:0";
+		debug =      <&tinylcd35>,"debug:0";
+		touch =      <&tinylcd35_ts>,"status";
+		touchgpio =  <&tinylcd35_ts_pins>,"brcm,pins:0",
+			     <&tinylcd35_ts>,"interrupts:0",
+			     <&tinylcd35_ts>,"pendown-gpio:4";
+		xohms =      <&tinylcd35_ts>,"ti,x-plate-ohms;0";
+		rtc-pcf =    <0>,"=5";
+		rtc-ds =     <0>,"=6";
+		keypad =     <&keypad>,"status";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/uart0-overlay.dts b/arch/arm/boot/dts/overlays/uart0-overlay.dts
new file mode 100755
index 000000000000..20b2a609c511
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/uart0-overlay.dts
@@ -0,0 +1,32 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&uart0>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&uart0_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			uart0_pins: uart0_pins {
+				brcm,pins = <14 15>;
+				brcm,function = <4>; /* alt0 */
+				brcm,pull = <0 2>;
+			};
+		};
+	};
+
+	__overrides__ {
+		txd0_pin = <&uart0_pins>,"brcm,pins:0";
+		rxd0_pin = <&uart0_pins>,"brcm,pins:4";
+		pin_func = <&uart0_pins>,"brcm,function:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/uart1-overlay.dts b/arch/arm/boot/dts/overlays/uart1-overlay.dts
new file mode 100644
index 000000000000..fa73e1feaeb1
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/uart1-overlay.dts
@@ -0,0 +1,38 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target = <&uart1>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&uart1_pins>;
+			status = "okay";
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			uart1_pins: uart1_pins {
+				brcm,pins = <14 15>;
+				brcm,function = <2>; /* alt5 */
+				brcm,pull = <0 2>;
+			};
+		};
+	};
+
+	fragment@2 {
+		target-path = "/chosen";
+		__overlay__ {
+			bootargs = "8250.nr_uarts=1";
+		};
+	};
+
+	__overrides__ {
+		txd1_pin = <&uart1_pins>,"brcm,pins:0";
+		rxd1_pin = <&uart1_pins>,"brcm,pins:4";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/upstream-aux-interrupt-overlay.dts b/arch/arm/boot/dts/overlays/upstream-aux-interrupt-overlay.dts
new file mode 100644
index 000000000000..04e271b72a3a
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/upstream-aux-interrupt-overlay.dts
@@ -0,0 +1,33 @@
+// Overlay for missing AUX interrupt controller
+// Instead we bind all AUX devices to the generic AUX interrupt line
+/dts-v1/;
+/plugin/;
+
+/ {
+    compatible = "brcm,bcm2708";
+
+    fragment@0 {
+        target = <&uart1>;
+        __overlay__ {
+            interrupt-parent = <&intc>;
+            interrupts = <0x1 0x1d>;
+        };
+    };
+
+    fragment@1 {
+        target = <&spi1>;
+        __overlay__ {
+            interrupt-parent = <&intc>;
+            interrupts = <0x1 0x1d>;
+        };
+    };
+
+    fragment@2 {
+        target = <&spi2>;
+        __overlay__ {
+            interrupt-parent = <&intc>;
+            interrupts = <0x1 0x1d>;
+        };
+    };
+};
+
diff --git a/arch/arm/boot/dts/overlays/upstream-overlay.dts b/arch/arm/boot/dts/overlays/upstream-overlay.dts
new file mode 100644
index 000000000000..ff37a5013de4
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/upstream-overlay.dts
@@ -0,0 +1,154 @@
+// redo: ovmerge -c vc4-kms-v3d-overlay.dts,cma-96 dwc2-overlay.dts,dr_mode=otg upstream-aux-interrupt-overlay.dts,
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/bcm2835.h>
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+	fragment@0 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=256M";
+		};
+	};
+	fragment@1 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=192M";
+		};
+	};
+	fragment@2 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=128M";
+		};
+	};
+	fragment@3 {
+		target-path = "/chosen";
+		__overlay__ {
+			bootargs = "cma=96M";
+		};
+	};
+	fragment@4 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=64M";
+		};
+	};
+	fragment@5 {
+		target = <&i2c2>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+	fragment@6 {
+		target = <&fb>;
+		__overlay__ {
+			status = "disabled";
+		};
+	};
+	fragment@7 {
+		target = <&pixelvalve0>;
+		__overlay__ {
+			interrupts = <2 13>;
+			status = "okay";
+		};
+	};
+	fragment@8 {
+		target = <&pixelvalve1>;
+		__overlay__ {
+			interrupts = <2 14>;
+			status = "okay";
+		};
+	};
+	fragment@9 {
+		target = <&pixelvalve2>;
+		__overlay__ {
+			interrupts = <2 10>;
+			status = "okay";
+		};
+	};
+	fragment@10 {
+		target = <&hvs>;
+		__overlay__ {
+			interrupts = <2 1>;
+			status = "okay";
+		};
+	};
+	fragment@11 {
+		target = <&hdmi>;
+		__overlay__ {
+			interrupts = <2 8>, <2 9>;
+			status = "okay";
+		};
+	};
+	fragment@12 {
+		target = <&v3d>;
+		__overlay__ {
+			interrupts = <1 10>;
+			status = "okay";
+		};
+	};
+	fragment@13 {
+		target = <&vc4>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+	fragment@14 {
+		target-path = "/soc/dma";
+		__overlay__ {
+			brcm,dma-channel-mask = <0x7f35>;
+		};
+	};
+	fragment@15 {
+		target = <&clocks>;
+		__overlay__ {
+			claim-clocks = <BCM2835_PLLD_DSI0 BCM2835_PLLD_DSI1 BCM2835_PLLH_AUX BCM2835_PLLH_PIX>;
+		};
+	};
+	fragment@16 {
+		target = <&vec>;
+		__overlay__ {
+			status = "okay";
+		};
+	};
+	fragment@17 {
+		target = <&usb>;
+		#address-cells = <1>;
+		#size-cells = <1>;
+		dwc2_usb: __overlay__ {
+			compatible = "brcm,bcm2835-usb";
+			reg = <0x7e980000 0x10000>;
+			interrupts = <1 9>;
+			dr_mode = "otg";
+			g-np-tx-fifo-size = <32>;
+			g-rx-fifo-size = <256>;
+			g-tx-fifo-size = <512 512 512 512 512 256 256>;
+			status = "okay";
+		};
+	};
+	fragment@18 {
+		target = <&uart1>;
+		__overlay__ {
+			interrupt-parent = <&intc>;
+			interrupts = <0x1 0x1d>;
+		};
+	};
+	fragment@19 {
+		target = <&spi1>;
+		__overlay__ {
+			interrupt-parent = <&intc>;
+			interrupts = <0x1 0x1d>;
+		};
+	};
+	fragment@20 {
+		target = <&spi2>;
+		__overlay__ {
+			interrupt-parent = <&intc>;
+			interrupts = <0x1 0x1d>;
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
new file mode 100644
index 000000000000..14f7687172c3
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
@@ -0,0 +1,89 @@
+/*
+ * vc4-fkms-v3d-overlay.dts
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target-path = "/chosen";
+		__overlay__ {
+			bootargs = "cma=256M";
+		};
+	};
+
+	fragment@1 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=192M";
+		};
+	};
+
+	fragment@2 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=128M";
+		};
+	};
+
+	fragment@3 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=96M";
+		};
+	};
+
+	fragment@4 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=64M";
+		};
+	};
+
+	fragment@5 {
+		target = <&fb>;
+		__overlay__  {
+			status = "disabled";
+		};
+	};
+
+	fragment@6 {
+		target = <&firmwarekms>;
+		__overlay__  {
+			status = "okay";
+		};
+	};
+
+	fragment@7 {
+		target = <&v3d>;
+		__overlay__  {
+			interrupts = <1 10>;
+			status = "okay";
+		};
+	};
+
+	fragment@8 {
+		target = <&vc4>;
+		__overlay__  {
+			status = "okay";
+		};
+	};
+
+	fragment@9 {
+		target-path = "/soc/dma";
+		__overlay__ {
+			brcm,dma-channel-mask = <0x7f35>;
+		};
+	};
+
+	__overrides__ {
+		cma-256 = <0>,"+0-1-2-3-4";
+		cma-192 = <0>,"-0+1-2-3-4";
+		cma-128 = <0>,"-0-1+2-3-4";
+		cma-96  = <0>,"-0-1-2+3-4";
+		cma-64  = <0>,"-0-1-2-3+4";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts b/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
new file mode 100644
index 000000000000..489679637306
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
@@ -0,0 +1,151 @@
+/*
+ * vc4-kms-v3d-overlay.dts
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/bcm2835.h>
+
+/ {
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target-path = "/chosen";
+		__overlay__ {
+			bootargs = "cma=256M";
+		};
+	};
+
+	fragment@1 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=192M";
+		};
+	};
+
+	fragment@2 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=128M";
+		};
+	};
+
+	fragment@3 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=96M";
+		};
+	};
+
+	fragment@4 {
+		target-path = "/chosen";
+		__dormant__ {
+			bootargs = "cma=64M";
+		};
+	};
+
+	fragment@5 {
+		target = <&i2c2>;
+		__overlay__  {
+			status = "okay";
+		};
+	};
+
+	fragment@6 {
+		target = <&fb>;
+		__overlay__  {
+			status = "disabled";
+		};
+	};
+
+	fragment@7 {
+		target = <&pixelvalve0>;
+		__overlay__  {
+			interrupts = <2 13>; /* pwa0 */
+			status = "okay";
+		};
+	};
+
+	fragment@8 {
+		target = <&pixelvalve1>;
+		__overlay__  {
+			interrupts = <2 14>; /* pwa1 */
+			status = "okay";
+		};
+	};
+
+	fragment@9 {
+		target = <&pixelvalve2>;
+		__overlay__  {
+			interrupts = <2 10>; /* pixelvalve */
+			status = "okay";
+		};
+	};
+
+	fragment@10 {
+		target = <&hvs>;
+		__overlay__  {
+			interrupts = <2 1>;
+			status = "okay";
+		};
+	};
+
+	fragment@11 {
+		target = <&hdmi>;
+		__overlay__  {
+			interrupts = <2 8>, <2 9>;
+			status = "okay";
+		};
+	};
+
+	fragment@12 {
+		target = <&v3d>;
+		__overlay__  {
+			interrupts = <1 10>;
+			status = "okay";
+		};
+	};
+
+	fragment@13 {
+		target = <&vc4>;
+		__overlay__  {
+			status = "okay";
+		};
+	};
+
+	fragment@14 {
+		target-path = "/soc/dma";
+		__overlay__ {
+			brcm,dma-channel-mask = <0x7f35>;
+		};
+	};
+
+
+	fragment@15 {
+		target = <&clocks>;
+		__overlay__  {
+			claim-clocks = <
+				BCM2835_PLLD_DSI0
+				BCM2835_PLLD_DSI1
+				BCM2835_PLLH_AUX
+				BCM2835_PLLH_PIX
+			>;
+		};
+	};
+
+	fragment@16 {
+		target = <&vec>;
+		__overlay__  {
+			status = "okay";
+		};
+	};
+
+	__overrides__ {
+		cma-256 = <0>,"+0-1-2-3-4";
+		cma-192 = <0>,"-0+1-2-3-4";
+		cma-128 = <0>,"-0-1+2-3-4";
+		cma-96  = <0>,"-0-1-2+3-4";
+		cma-64  = <0>,"-0-1-2-3+4";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/vga666-overlay.dts b/arch/arm/boot/dts/overlays/vga666-overlay.dts
new file mode 100644
index 000000000000..7fcab963eb4a
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/vga666-overlay.dts
@@ -0,0 +1,30 @@
+/dts-v1/;
+/plugin/;
+
+/{
+	compatible = "brcm,bcm2708";
+
+	// There is no VGA driver module, but we need a platform device
+	// node (that doesn't already use pinctrl) to hang the pinctrl
+	// reference on - leds will do
+
+	fragment@0 {
+		target = <&leds>;
+		__overlay__ {
+			pinctrl-names = "default";
+			pinctrl-0 = <&vga666_pins>;
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			vga666_pins: vga666_pins {
+				brcm,pins = <2 3 4 5 6 7 8 9 10 11 12
+					     13 14 15 16 17 18 19 20 21>;
+				brcm,function = <6>; /* alt2 */
+				brcm,pull = <0>; /* no pull */
+			};
+		};
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts b/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts
new file mode 100644
index 000000000000..f7f874751265
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/w1-gpio-overlay.dts
@@ -0,0 +1,41 @@
+// Definitions for w1-gpio module (without external pullup)
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+
+			w1: onewire@0 {
+				compatible = "w1-gpio";
+				pinctrl-names = "default";
+				pinctrl-0 = <&w1_pins>;
+				gpios = <&gpio 4 0>;
+				rpi,parasitic-power = <0>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			w1_pins: w1_pins@0 {
+				brcm,pins = <4>;
+				brcm,function = <0>; // in (initially)
+				brcm,pull = <0>; // off
+			};
+		};
+	};
+
+	__overrides__ {
+		gpiopin =       <&w1>,"gpios:4",
+				<&w1>,"reg:0",
+				<&w1_pins>,"brcm,pins:0",
+				<&w1_pins>,"reg:0";
+		pullup =        <&w1>,"rpi,parasitic-power:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts b/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts
new file mode 100644
index 000000000000..ef8bfbcabdb3
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/w1-gpio-pullup-overlay.dts
@@ -0,0 +1,43 @@
+// Definitions for w1-gpio module (with external pullup)
+/dts-v1/;
+/plugin/;
+
+/ {
+	compatible = "brcm,bcm2708";
+
+	fragment@0 {
+		target-path = "/";
+		__overlay__ {
+
+			w1: onewire@0 {
+				compatible = "w1-gpio";
+				pinctrl-names = "default";
+				pinctrl-0 = <&w1_pins>;
+				gpios = <&gpio 4 0>, <&gpio 5 1>;
+				rpi,parasitic-power = <0>;
+				status = "okay";
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&gpio>;
+		__overlay__ {
+			w1_pins: w1_pins@0 {
+				brcm,pins = <4 5>;
+				brcm,function = <0 1>; // in out
+				brcm,pull = <0 0>; // off off
+			};
+		};
+	};
+
+	__overrides__ {
+		gpiopin =       <&w1>,"gpios:4",
+				<&w1>,"reg:0",
+				<&w1_pins>,"brcm,pins:0",
+				<&w1_pins>,"reg:0";
+		extpullup =     <&w1>,"gpios:16",
+				<&w1_pins>,"brcm,pins:4";
+		pullup =        <&w1>,"rpi,parasitic-power:0";
+	};
+};
diff --git a/arch/arm/boot/dts/overlays/wittypi-overlay.dts b/arch/arm/boot/dts/overlays/wittypi-overlay.dts
new file mode 100644
index 000000000000..8498134fdbb3
--- /dev/null
+++ b/arch/arm/boot/dts/overlays/wittypi-overlay.dts
@@ -0,0 +1,44 @@
+/*
+ * Device Tree overlay for Witty Pi extension board by UUGear
+ *
+ */
+
+/dts-v1/;
+/plugin/;
+
+/ {
+
+	compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
+
+	fragment@0 {
+		target = <&leds>;
+		__overlay__ {
+			compatible = "gpio-leds";
+			wittypi_led: wittypi_led {
+				label = "wittypi_led";
+				linux,default-trigger = "default-on";
+				gpios = <&gpio 17 0>;
+			};
+		};
+	};
+
+	fragment@1 {
+		target = <&i2c1>;
+		__overlay__ {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			rtc: ds1337@68 {
+				compatible = "dallas,ds1337";
+				reg = <0x68>;
+				wakeup-source;
+			};
+		};
+	};
+
+	__overrides__ {
+		led_gpio =	<&wittypi_led>,"gpios:4";
+		led_trigger =	<&wittypi_led>,"linux,default-trigger";
+	};
+
+};
diff --git a/arch/arm/configs/bcm2709_defconfig b/arch/arm/configs/bcm2709_defconfig
new file mode 100644
index 000000000000..2a20554ca7b0
--- /dev/null
+++ b/arch/arm/configs/bcm2709_defconfig
@@ -0,0 +1,1368 @@
+CONFIG_LOCALVERSION="-v7"
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_GENERIC_IRQ_DEBUGFS=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_IKCONFIG=m
+CONFIG_IKCONFIG_PROC=y
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_NAMESPACES=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_EMBEDDED=y
+# CONFIG_COMPAT_BRK is not set
+CONFIG_PROFILING=y
+CONFIG_OPROFILE=m
+CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_MAC_PARTITION=y
+CONFIG_CFQ_GROUP_IOSCHED=y
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
+# CONFIG_CACHE_L2X0 is not set
+CONFIG_SMP=y
+CONFIG_VMSPLIT_2G=y
+CONFIG_PREEMPT_VOLUNTARY=y
+# CONFIG_CPU_SW_DOMAIN_PAN is not set
+CONFIG_CLEANCACHE=y
+CONFIG_FRONTSWAP=y
+CONFIG_CMA=y
+CONFIG_ZSMALLOC=m
+CONFIG_PGTABLE_MAPPING=y
+CONFIG_UACCESS_WITH_MEMCPY=y
+CONFIG_SECCOMP=y
+# CONFIG_ATAGS is not set
+CONFIG_ZBOOT_ROM_TEXT=0x0
+CONFIG_ZBOOT_ROM_BSS=0x0
+CONFIG_CMDLINE="console=ttyAMA0,115200 kgdboc=ttyAMA0,115200 root=/dev/mmcblk0p2 rootfstype=ext4 rootwait"
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_VFP=y
+CONFIG_NEON=y
+CONFIG_KERNEL_MODE_NEON=y
+CONFIG_BINFMT_MISC=m
+# CONFIG_SUSPEND is not set
+CONFIG_PM=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_XFRM_USER=y
+CONFIG_NET_KEY=m
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_ROUTE_VERBOSE=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_RARP=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE_DEMUX=m
+CONFIG_NET_IPGRE=m
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
+CONFIG_INET_AH=m
+CONFIG_INET_ESP=m
+CONFIG_INET_IPCOMP=m
+CONFIG_INET_XFRM_MODE_TRANSPORT=m
+CONFIG_INET_XFRM_MODE_TUNNEL=m
+CONFIG_INET_XFRM_MODE_BEET=m
+CONFIG_INET_DIAG=m
+CONFIG_TCP_CONG_ADVANCED=y
+CONFIG_TCP_CONG_BBR=m
+CONFIG_IPV6=m
+CONFIG_IPV6_ROUTER_PREF=y
+CONFIG_IPV6_ROUTE_INFO=y
+CONFIG_INET6_AH=m
+CONFIG_INET6_ESP=m
+CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_SIT_6RD=y
+CONFIG_IPV6_TUNNEL=m
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETFILTER=y
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=m
+CONFIG_NF_CONNTRACK_FTP=m
+CONFIG_NF_CONNTRACK_H323=m
+CONFIG_NF_CONNTRACK_IRC=m
+CONFIG_NF_CONNTRACK_NETBIOS_NS=m
+CONFIG_NF_CONNTRACK_SNMP=m
+CONFIG_NF_CONNTRACK_PPTP=m
+CONFIG_NF_CONNTRACK_SANE=m
+CONFIG_NF_CONNTRACK_SIP=m
+CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_CT_NETLINK=m
+CONFIG_NETFILTER_XT_SET=m
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
+CONFIG_NETFILTER_XT_TARGET_DSCP=m
+CONFIG_NETFILTER_XT_TARGET_HMARK=m
+CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
+CONFIG_NETFILTER_XT_TARGET_LED=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFLOG=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
+CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
+CONFIG_NETFILTER_XT_TARGET_TRACE=m
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
+CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_BPF=m
+CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_CPU=m
+CONFIG_NETFILTER_XT_MATCH_DCCP=m
+CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_ESP=m
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
+CONFIG_NETFILTER_XT_MATCH_IPVS=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_NFACCT=m
+CONFIG_NETFILTER_XT_MATCH_OSF=m
+CONFIG_NETFILTER_XT_MATCH_OWNER=m
+CONFIG_NETFILTER_XT_MATCH_POLICY=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_QUOTA=m
+CONFIG_NETFILTER_XT_MATCH_RATEEST=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
+CONFIG_NETFILTER_XT_MATCH_TIME=m
+CONFIG_NETFILTER_XT_MATCH_U32=m
+CONFIG_IP_SET=m
+CONFIG_IP_SET_BITMAP_IP=m
+CONFIG_IP_SET_BITMAP_IPMAC=m
+CONFIG_IP_SET_BITMAP_PORT=m
+CONFIG_IP_SET_HASH_IP=m
+CONFIG_IP_SET_HASH_IPPORT=m
+CONFIG_IP_SET_HASH_IPPORTIP=m
+CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETPORT=m
+CONFIG_IP_SET_HASH_NETIFACE=m
+CONFIG_IP_SET_LIST_SET=m
+CONFIG_IP_VS=m
+CONFIG_IP_VS_PROTO_TCP=y
+CONFIG_IP_VS_PROTO_UDP=y
+CONFIG_IP_VS_PROTO_ESP=y
+CONFIG_IP_VS_PROTO_AH=y
+CONFIG_IP_VS_PROTO_SCTP=y
+CONFIG_IP_VS_RR=m
+CONFIG_IP_VS_WRR=m
+CONFIG_IP_VS_LC=m
+CONFIG_IP_VS_WLC=m
+CONFIG_IP_VS_LBLC=m
+CONFIG_IP_VS_LBLCR=m
+CONFIG_IP_VS_DH=m
+CONFIG_IP_VS_SH=m
+CONFIG_IP_VS_SED=m
+CONFIG_IP_VS_NQ=m
+CONFIG_IP_VS_FTP=m
+CONFIG_IP_VS_PE_SIP=m
+CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_CLUSTERIP=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_TTL=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_ARPTABLES=m
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_TARGET_HL=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_AMONG=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_MARK=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_MARK_T=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_SCTP_COOKIE_HMAC_SHA1=y
+CONFIG_ATM=m
+CONFIG_L2TP=m
+CONFIG_L2TP_V3=y
+CONFIG_L2TP_IP=m
+CONFIG_L2TP_ETH=m
+CONFIG_BRIDGE=m
+CONFIG_VLAN_8021Q=m
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_ATALK=m
+CONFIG_6LOWPAN=m
+CONFIG_IEEE802154=m
+CONFIG_IEEE802154_6LOWPAN=m
+CONFIG_MAC802154=m
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_CBQ=m
+CONFIG_NET_SCH_HTB=m
+CONFIG_NET_SCH_HFSC=m
+CONFIG_NET_SCH_ATM=m
+CONFIG_NET_SCH_PRIO=m
+CONFIG_NET_SCH_MULTIQ=m
+CONFIG_NET_SCH_RED=m
+CONFIG_NET_SCH_SFB=m
+CONFIG_NET_SCH_SFQ=m
+CONFIG_NET_SCH_TEQL=m
+CONFIG_NET_SCH_TBF=m
+CONFIG_NET_SCH_GRED=m
+CONFIG_NET_SCH_DSMARK=m
+CONFIG_NET_SCH_NETEM=m
+CONFIG_NET_SCH_DRR=m
+CONFIG_NET_SCH_MQPRIO=m
+CONFIG_NET_SCH_CHOKE=m
+CONFIG_NET_SCH_QFQ=m
+CONFIG_NET_SCH_CODEL=m
+CONFIG_NET_SCH_FQ_CODEL=m
+CONFIG_NET_SCH_FQ=m
+CONFIG_NET_SCH_HHF=m
+CONFIG_NET_SCH_PIE=m
+CONFIG_NET_SCH_INGRESS=m
+CONFIG_NET_SCH_PLUG=m
+CONFIG_NET_CLS_BASIC=m
+CONFIG_NET_CLS_TCINDEX=m
+CONFIG_NET_CLS_ROUTE4=m
+CONFIG_NET_CLS_FW=m
+CONFIG_NET_CLS_U32=m
+CONFIG_CLS_U32_MARK=y
+CONFIG_NET_CLS_RSVP=m
+CONFIG_NET_CLS_RSVP6=m
+CONFIG_NET_CLS_FLOW=m
+CONFIG_NET_CLS_CGROUP=m
+CONFIG_NET_EMATCH=y
+CONFIG_NET_EMATCH_CMP=m
+CONFIG_NET_EMATCH_NBYTE=m
+CONFIG_NET_EMATCH_U32=m
+CONFIG_NET_EMATCH_META=m
+CONFIG_NET_EMATCH_TEXT=m
+CONFIG_NET_EMATCH_IPSET=m
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_ACT_POLICE=m
+CONFIG_NET_ACT_GACT=m
+CONFIG_GACT_PROB=y
+CONFIG_NET_ACT_MIRRED=m
+CONFIG_NET_ACT_IPT=m
+CONFIG_NET_ACT_NAT=m
+CONFIG_NET_ACT_PEDIT=m
+CONFIG_NET_ACT_SIMP=m
+CONFIG_NET_ACT_SKBEDIT=m
+CONFIG_NET_ACT_CSUM=m
+CONFIG_BATMAN_ADV=m
+CONFIG_OPENVSWITCH=m
+CONFIG_NET_L3_MASTER_DEV=y
+CONFIG_NET_PKTGEN=m
+CONFIG_HAMRADIO=y
+CONFIG_AX25=m
+CONFIG_NETROM=m
+CONFIG_ROSE=m
+CONFIG_MKISS=m
+CONFIG_6PACK=m
+CONFIG_BPQETHER=m
+CONFIG_BAYCOM_SER_FDX=m
+CONFIG_BAYCOM_SER_HDX=m
+CONFIG_YAM=m
+CONFIG_CAN=m
+CONFIG_CAN_VCAN=m
+CONFIG_CAN_SLCAN=m
+CONFIG_CAN_MCP251X=m
+CONFIG_CAN_GS_USB=m
+CONFIG_BT=m
+CONFIG_BT_RFCOMM=m
+CONFIG_BT_RFCOMM_TTY=y
+CONFIG_BT_BNEP=m
+CONFIG_BT_BNEP_MC_FILTER=y
+CONFIG_BT_BNEP_PROTO_FILTER=y
+CONFIG_BT_HIDP=m
+CONFIG_BT_6LOWPAN=m
+CONFIG_BT_HCIBTUSB=m
+CONFIG_BT_HCIUART=m
+CONFIG_BT_HCIUART_3WIRE=y
+CONFIG_BT_HCIUART_BCM=y
+CONFIG_BT_HCIBCM203X=m
+CONFIG_BT_HCIBPA10X=m
+CONFIG_BT_HCIBFUSB=m
+CONFIG_BT_HCIVHCI=m
+CONFIG_BT_MRVL=m
+CONFIG_BT_MRVL_SDIO=m
+CONFIG_BT_ATH3K=m
+CONFIG_BT_WILINK=m
+CONFIG_CFG80211=m
+CONFIG_MAC80211=m
+CONFIG_MAC80211_MESH=y
+CONFIG_WIMAX=m
+CONFIG_RFKILL=m
+CONFIG_RFKILL_INPUT=y
+CONFIG_NET_9P=m
+CONFIG_NFC=m
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=5
+CONFIG_MTD=m
+CONFIG_MTD_BLOCK=m
+CONFIG_MTD_M25P80=m
+CONFIG_MTD_BLOCK2MTD=m
+CONFIG_MTD_NAND=m
+CONFIG_MTD_SPI_NOR=m
+CONFIG_MTD_UBI=m
+CONFIG_OF_CONFIGFS=y
+CONFIG_ZRAM=m
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
+CONFIG_BLK_DEV_NBD=m
+CONFIG_BLK_DEV_RAM=y
+CONFIG_CDROM_PKTCDVD=m
+CONFIG_ATA_OVER_ETH=m
+CONFIG_EEPROM_AT24=m
+CONFIG_TI_ST=m
+CONFIG_SCSI=y
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_BLK_DEV_SD=y
+CONFIG_CHR_DEV_ST=m
+CONFIG_CHR_DEV_OSST=m
+CONFIG_BLK_DEV_SR=m
+CONFIG_CHR_DEV_SG=m
+CONFIG_SCSI_ISCSI_ATTRS=y
+CONFIG_ISCSI_TCP=m
+CONFIG_ISCSI_BOOT_SYSFS=m
+CONFIG_MD=y
+CONFIG_MD_LINEAR=m
+CONFIG_BLK_DEV_DM=m
+CONFIG_DM_CRYPT=m
+CONFIG_DM_SNAPSHOT=m
+CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_CACHE=m
+CONFIG_DM_MIRROR=m
+CONFIG_DM_LOG_USERSPACE=m
+CONFIG_DM_RAID=m
+CONFIG_DM_ZERO=m
+CONFIG_DM_DELAY=m
+CONFIG_NETDEVICES=y
+CONFIG_BONDING=m
+CONFIG_DUMMY=m
+CONFIG_IFB=m
+CONFIG_MACVLAN=m
+CONFIG_IPVLAN=m
+CONFIG_VXLAN=m
+CONFIG_NETCONSOLE=m
+CONFIG_TUN=m
+CONFIG_VETH=m
+CONFIG_ENC28J60=m
+CONFIG_QCA7000_SPI=m
+CONFIG_MDIO_BITBANG=m
+CONFIG_PPP=m
+CONFIG_PPP_BSDCOMP=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPP_FILTER=y
+CONFIG_PPP_MPPE=m
+CONFIG_PPP_MULTILINK=y
+CONFIG_PPPOATM=m
+CONFIG_PPPOE=m
+CONFIG_PPPOL2TP=m
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_SYNC_TTY=m
+CONFIG_SLIP=m
+CONFIG_SLIP_COMPRESSED=y
+CONFIG_SLIP_SMART=y
+CONFIG_USB_CATC=m
+CONFIG_USB_KAWETH=m
+CONFIG_USB_PEGASUS=m
+CONFIG_USB_RTL8150=m
+CONFIG_USB_RTL8152=m
+CONFIG_USB_LAN78XX=y
+CONFIG_USB_USBNET=y
+CONFIG_USB_NET_AX8817X=m
+CONFIG_USB_NET_AX88179_178A=m
+CONFIG_USB_NET_CDCETHER=m
+CONFIG_USB_NET_CDC_EEM=m
+CONFIG_USB_NET_CDC_NCM=m
+CONFIG_USB_NET_HUAWEI_CDC_NCM=m
+CONFIG_USB_NET_CDC_MBIM=m
+CONFIG_USB_NET_DM9601=m
+CONFIG_USB_NET_SR9700=m
+CONFIG_USB_NET_SR9800=m
+CONFIG_USB_NET_SMSC75XX=m
+CONFIG_USB_NET_SMSC95XX=y
+CONFIG_USB_NET_GL620A=m
+CONFIG_USB_NET_NET1080=m
+CONFIG_USB_NET_PLUSB=m
+CONFIG_USB_NET_MCS7830=m
+CONFIG_USB_NET_CDC_SUBSET=m
+CONFIG_USB_ALI_M5632=y
+CONFIG_USB_AN2720=y
+CONFIG_USB_EPSON2888=y
+CONFIG_USB_KC2190=y
+CONFIG_USB_NET_ZAURUS=m
+CONFIG_USB_NET_CX82310_ETH=m
+CONFIG_USB_NET_KALMIA=m
+CONFIG_USB_NET_QMI_WWAN=m
+CONFIG_USB_HSO=m
+CONFIG_USB_NET_INT51X1=m
+CONFIG_USB_IPHETH=m
+CONFIG_USB_SIERRA_NET=m
+CONFIG_USB_VL600=m
+CONFIG_ATH9K=m
+CONFIG_ATH9K_HTC=m
+CONFIG_CARL9170=m
+CONFIG_ATH6KL=m
+CONFIG_ATH6KL_USB=m
+CONFIG_AR5523=m
+CONFIG_AT76C50X_USB=m
+CONFIG_B43=m
+# CONFIG_B43_PHY_N is not set
+CONFIG_B43LEGACY=m
+CONFIG_BRCMFMAC=m
+CONFIG_BRCMFMAC_USB=y
+CONFIG_BRCMDBG=y
+CONFIG_HOSTAP=m
+CONFIG_P54_COMMON=m
+CONFIG_P54_USB=m
+CONFIG_LIBERTAS=m
+CONFIG_LIBERTAS_USB=m
+CONFIG_LIBERTAS_SDIO=m
+CONFIG_LIBERTAS_THINFIRM=m
+CONFIG_LIBERTAS_THINFIRM_USB=m
+CONFIG_MWIFIEX=m
+CONFIG_MWIFIEX_SDIO=m
+CONFIG_MT7601U=m
+CONFIG_RT2X00=m
+CONFIG_RT2500USB=m
+CONFIG_RT73USB=m
+CONFIG_RT2800USB=m
+CONFIG_RT2800USB_RT3573=y
+CONFIG_RT2800USB_RT53XX=y
+CONFIG_RT2800USB_RT55XX=y
+CONFIG_RT2800USB_UNKNOWN=y
+CONFIG_RTL8187=m
+CONFIG_RTL8192CU=m
+CONFIG_RTL8XXXU=m
+CONFIG_USB_ZD1201=m
+CONFIG_ZD1211RW=m
+CONFIG_MAC80211_HWSIM=m
+CONFIG_USB_NET_RNDIS_WLAN=m
+CONFIG_WIMAX_I2400M_USB=m
+CONFIG_IEEE802154_AT86RF230=m
+CONFIG_IEEE802154_MRF24J40=m
+CONFIG_IEEE802154_CC2520=m
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_JOYDEV=m
+CONFIG_INPUT_EVDEV=m
+# CONFIG_KEYBOARD_ATKBD is not set
+CONFIG_KEYBOARD_GPIO=m
+CONFIG_KEYBOARD_MATRIX=m
+# CONFIG_INPUT_MOUSE is not set
+CONFIG_INPUT_JOYSTICK=y
+CONFIG_JOYSTICK_IFORCE=m
+CONFIG_JOYSTICK_IFORCE_USB=y
+CONFIG_JOYSTICK_XPAD=m
+CONFIG_JOYSTICK_XPAD_FF=y
+CONFIG_JOYSTICK_XPAD_LEDS=y
+CONFIG_JOYSTICK_PSXPAD_SPI=m
+CONFIG_JOYSTICK_PSXPAD_SPI_FF=y
+CONFIG_JOYSTICK_RPISENSE=m
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_ADS7846=m
+CONFIG_TOUCHSCREEN_EGALAX=m
+CONFIG_TOUCHSCREEN_EXC3000=m
+CONFIG_TOUCHSCREEN_GOODIX=m
+CONFIG_TOUCHSCREEN_EDT_FT5X06=m
+CONFIG_TOUCHSCREEN_RPI_FT5406=m
+CONFIG_TOUCHSCREEN_USB_COMPOSITE=m
+CONFIG_TOUCHSCREEN_STMPE=m
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_AD714X=m
+CONFIG_INPUT_ATI_REMOTE2=m
+CONFIG_INPUT_KEYSPAN_REMOTE=m
+CONFIG_INPUT_POWERMATE=m
+CONFIG_INPUT_YEALINK=m
+CONFIG_INPUT_CM109=m
+CONFIG_INPUT_UINPUT=m
+CONFIG_INPUT_GPIO_ROTARY_ENCODER=m
+CONFIG_INPUT_ADXL34X=m
+CONFIG_INPUT_CMA3000=m
+CONFIG_SERIO=m
+CONFIG_SERIO_RAW=m
+CONFIG_GAMEPORT=m
+CONFIG_GAMEPORT_NS558=m
+CONFIG_GAMEPORT_L4=m
+CONFIG_BRCM_CHAR_DRIVERS=y
+CONFIG_BCM_VCIO=y
+CONFIG_BCM_VC_SM=y
+CONFIG_BCM2835_DEVGPIOMEM=y
+# CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_8250=y
+# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+# CONFIG_SERIAL_8250_DMA is not set
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_BCM2835AUX=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_SC16IS7XX=m
+CONFIG_SERIAL_SC16IS7XX_SPI=y
+CONFIG_SERIAL_DEV_BUS=m
+CONFIG_TTY_PRINTK=y
+CONFIG_HW_RANDOM=y
+CONFIG_RAW_DRIVER=y
+CONFIG_I2C=y
+CONFIG_I2C_CHARDEV=m
+CONFIG_I2C_MUX_GPMUX=m
+CONFIG_I2C_MUX_PCA954x=m
+CONFIG_I2C_BCM2708=m
+CONFIG_I2C_BCM2835=m
+CONFIG_I2C_GPIO=m
+CONFIG_I2C_ROBOTFUZZ_OSIF=m
+CONFIG_I2C_TINY_USB=m
+CONFIG_SPI=y
+CONFIG_SPI_BCM2835=m
+CONFIG_SPI_BCM2835AUX=m
+CONFIG_SPI_SPIDEV=m
+CONFIG_SPI_SLAVE=y
+CONFIG_PPS=m
+CONFIG_PPS_CLIENT_LDISC=m
+CONFIG_PPS_CLIENT_GPIO=m
+CONFIG_PINCTRL_MCP23S08=m
+CONFIG_GPIO_BCM_EXP=y
+CONFIG_GPIO_BCM_VIRT=y
+CONFIG_GPIO_MOCKUP=m
+CONFIG_GPIO_PCF857X=m
+CONFIG_GPIO_ARIZONA=m
+CONFIG_GPIO_STMPE=y
+CONFIG_W1=m
+CONFIG_W1_MASTER_DS2490=m
+CONFIG_W1_MASTER_DS2482=m
+CONFIG_W1_MASTER_DS1WM=m
+CONFIG_W1_MASTER_GPIO=m
+CONFIG_W1_SLAVE_THERM=m
+CONFIG_W1_SLAVE_SMEM=m
+CONFIG_W1_SLAVE_DS2408=m
+CONFIG_W1_SLAVE_DS2413=m
+CONFIG_W1_SLAVE_DS2406=m
+CONFIG_W1_SLAVE_DS2423=m
+CONFIG_W1_SLAVE_DS2431=m
+CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
+CONFIG_W1_SLAVE_DS2760=m
+CONFIG_W1_SLAVE_DS2780=m
+CONFIG_W1_SLAVE_DS2781=m
+CONFIG_W1_SLAVE_DS28E04=m
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_GPIO=y
+CONFIG_BATTERY_DS2760=m
+CONFIG_BATTERY_GAUGE_LTC2941=m
+CONFIG_HWMON=m
+CONFIG_SENSORS_DS1621=m
+CONFIG_SENSORS_JC42=m
+CONFIG_SENSORS_LM75=m
+CONFIG_SENSORS_SHT21=m
+CONFIG_SENSORS_SHT3x=m
+CONFIG_SENSORS_SHTC1=m
+CONFIG_SENSORS_ADS1015=m
+CONFIG_SENSORS_INA2XX=m
+CONFIG_SENSORS_TMP102=m
+CONFIG_THERMAL=y
+CONFIG_BCM2835_THERMAL=y
+CONFIG_WATCHDOG=y
+CONFIG_GPIO_WATCHDOG=m
+CONFIG_BCM2835_WDT=y
+CONFIG_MFD_STMPE=y
+CONFIG_STMPE_SPI=y
+CONFIG_MFD_ARIZONA_I2C=m
+CONFIG_MFD_ARIZONA_SPI=m
+CONFIG_MFD_WM5102=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=m
+CONFIG_REGULATOR_ARIZONA_LDO1=m
+CONFIG_REGULATOR_ARIZONA_MICSUPP=m
+CONFIG_LIRC=m
+CONFIG_RC_DEVICES=y
+CONFIG_RC_ATI_REMOTE=m
+CONFIG_IR_IMON=m
+CONFIG_IR_MCEUSB=m
+CONFIG_IR_REDRAT3=m
+CONFIG_IR_STREAMZAP=m
+CONFIG_IR_IGUANA=m
+CONFIG_IR_TTUSBIR=m
+CONFIG_RC_LOOPBACK=m
+CONFIG_IR_GPIO_CIR=m
+CONFIG_IR_GPIO_TX=m
+CONFIG_IR_PWM_TX=m
+CONFIG_MEDIA_SUPPORT=m
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_ANALOG_TV_SUPPORT=y
+CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y
+CONFIG_MEDIA_RADIO_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_MEDIA_USB_SUPPORT=y
+CONFIG_USB_VIDEO_CLASS=m
+CONFIG_USB_M5602=m
+CONFIG_USB_STV06XX=m
+CONFIG_USB_GL860=m
+CONFIG_USB_GSPCA_BENQ=m
+CONFIG_USB_GSPCA_CONEX=m
+CONFIG_USB_GSPCA_CPIA1=m
+CONFIG_USB_GSPCA_DTCS033=m
+CONFIG_USB_GSPCA_ETOMS=m
+CONFIG_USB_GSPCA_FINEPIX=m
+CONFIG_USB_GSPCA_JEILINJ=m
+CONFIG_USB_GSPCA_JL2005BCD=m
+CONFIG_USB_GSPCA_KINECT=m
+CONFIG_USB_GSPCA_KONICA=m
+CONFIG_USB_GSPCA_MARS=m
+CONFIG_USB_GSPCA_MR97310A=m
+CONFIG_USB_GSPCA_NW80X=m
+CONFIG_USB_GSPCA_OV519=m
+CONFIG_USB_GSPCA_OV534=m
+CONFIG_USB_GSPCA_OV534_9=m
+CONFIG_USB_GSPCA_PAC207=m
+CONFIG_USB_GSPCA_PAC7302=m
+CONFIG_USB_GSPCA_PAC7311=m
+CONFIG_USB_GSPCA_SE401=m
+CONFIG_USB_GSPCA_SN9C2028=m
+CONFIG_USB_GSPCA_SN9C20X=m
+CONFIG_USB_GSPCA_SONIXB=m
+CONFIG_USB_GSPCA_SONIXJ=m
+CONFIG_USB_GSPCA_SPCA500=m
+CONFIG_USB_GSPCA_SPCA501=m
+CONFIG_USB_GSPCA_SPCA505=m
+CONFIG_USB_GSPCA_SPCA506=m
+CONFIG_USB_GSPCA_SPCA508=m
+CONFIG_USB_GSPCA_SPCA561=m
+CONFIG_USB_GSPCA_SPCA1528=m
+CONFIG_USB_GSPCA_SQ905=m
+CONFIG_USB_GSPCA_SQ905C=m
+CONFIG_USB_GSPCA_SQ930X=m
+CONFIG_USB_GSPCA_STK014=m
+CONFIG_USB_GSPCA_STK1135=m
+CONFIG_USB_GSPCA_STV0680=m
+CONFIG_USB_GSPCA_SUNPLUS=m
+CONFIG_USB_GSPCA_T613=m
+CONFIG_USB_GSPCA_TOPRO=m
+CONFIG_USB_GSPCA_TV8532=m
+CONFIG_USB_GSPCA_VC032X=m
+CONFIG_USB_GSPCA_VICAM=m
+CONFIG_USB_GSPCA_XIRLINK_CIT=m
+CONFIG_USB_GSPCA_ZC3XX=m
+CONFIG_USB_PWC=m
+CONFIG_VIDEO_CPIA2=m
+CONFIG_USB_ZR364XX=m
+CONFIG_USB_STKWEBCAM=m
+CONFIG_USB_S2255=m
+CONFIG_VIDEO_USBTV=m
+CONFIG_VIDEO_PVRUSB2=m
+CONFIG_VIDEO_HDPVR=m
+CONFIG_VIDEO_USBVISION=m
+CONFIG_VIDEO_STK1160_COMMON=m
+CONFIG_VIDEO_GO7007=m
+CONFIG_VIDEO_GO7007_USB=m
+CONFIG_VIDEO_GO7007_USB_S2250_BOARD=m
+CONFIG_VIDEO_AU0828=m
+CONFIG_VIDEO_AU0828_RC=y
+CONFIG_VIDEO_CX231XX=m
+CONFIG_VIDEO_CX231XX_ALSA=m
+CONFIG_VIDEO_CX231XX_DVB=m
+CONFIG_VIDEO_TM6000=m
+CONFIG_VIDEO_TM6000_ALSA=m
+CONFIG_VIDEO_TM6000_DVB=m
+CONFIG_DVB_USB=m
+CONFIG_DVB_USB_A800=m
+CONFIG_DVB_USB_DIBUSB_MB=m
+CONFIG_DVB_USB_DIBUSB_MB_FAULTY=y
+CONFIG_DVB_USB_DIBUSB_MC=m
+CONFIG_DVB_USB_DIB0700=m
+CONFIG_DVB_USB_UMT_010=m
+CONFIG_DVB_USB_CXUSB=m
+CONFIG_DVB_USB_M920X=m
+CONFIG_DVB_USB_DIGITV=m
+CONFIG_DVB_USB_VP7045=m
+CONFIG_DVB_USB_VP702X=m
+CONFIG_DVB_USB_GP8PSK=m
+CONFIG_DVB_USB_NOVA_T_USB2=m
+CONFIG_DVB_USB_TTUSB2=m
+CONFIG_DVB_USB_DTT200U=m
+CONFIG_DVB_USB_OPERA1=m
+CONFIG_DVB_USB_AF9005=m
+CONFIG_DVB_USB_AF9005_REMOTE=m
+CONFIG_DVB_USB_PCTV452E=m
+CONFIG_DVB_USB_DW2102=m
+CONFIG_DVB_USB_CINERGY_T2=m
+CONFIG_DVB_USB_DTV5100=m
+CONFIG_DVB_USB_FRIIO=m
+CONFIG_DVB_USB_AZ6027=m
+CONFIG_DVB_USB_TECHNISAT_USB2=m
+CONFIG_DVB_USB_V2=m
+CONFIG_DVB_USB_AF9015=m
+CONFIG_DVB_USB_AF9035=m
+CONFIG_DVB_USB_ANYSEE=m
+CONFIG_DVB_USB_AU6610=m
+CONFIG_DVB_USB_AZ6007=m
+CONFIG_DVB_USB_CE6230=m
+CONFIG_DVB_USB_EC168=m
+CONFIG_DVB_USB_GL861=m
+CONFIG_DVB_USB_LME2510=m
+CONFIG_DVB_USB_MXL111SF=m
+CONFIG_DVB_USB_RTL28XXU=m
+CONFIG_DVB_USB_DVBSKY=m
+CONFIG_SMS_USB_DRV=m
+CONFIG_DVB_B2C2_FLEXCOP_USB=m
+CONFIG_DVB_AS102=m
+CONFIG_VIDEO_EM28XX=m
+CONFIG_VIDEO_EM28XX_V4L2=m
+CONFIG_VIDEO_EM28XX_ALSA=m
+CONFIG_VIDEO_EM28XX_DVB=m
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_RADIO_SI470X=y
+CONFIG_USB_SI470X=m
+CONFIG_I2C_SI470X=m
+CONFIG_RADIO_SI4713=m
+CONFIG_I2C_SI4713=m
+CONFIG_USB_MR800=m
+CONFIG_USB_DSBR=m
+CONFIG_RADIO_SHARK=m
+CONFIG_RADIO_SHARK2=m
+CONFIG_USB_KEENE=m
+CONFIG_USB_MA901=m
+CONFIG_RADIO_TEA5764=m
+CONFIG_RADIO_SAA7706H=m
+CONFIG_RADIO_TEF6862=m
+CONFIG_RADIO_WL1273=m
+CONFIG_RADIO_WL128X=m
+# CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
+CONFIG_VIDEO_UDA1342=m
+CONFIG_VIDEO_SONY_BTF_MPX=m
+CONFIG_VIDEO_TVP5150=m
+CONFIG_VIDEO_TW2804=m
+CONFIG_VIDEO_TW9903=m
+CONFIG_VIDEO_TW9906=m
+CONFIG_VIDEO_OV7640=m
+CONFIG_VIDEO_MT9V011=m
+CONFIG_DRM=m
+CONFIG_DRM_LOAD_EDID_FIRMWARE=y
+CONFIG_DRM_UDL=m
+CONFIG_DRM_PANEL_SIMPLE=m
+CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN=m
+CONFIG_DRM_VC4=m
+CONFIG_DRM_TINYDRM=m
+CONFIG_TINYDRM_MI0283QT=m
+CONFIG_TINYDRM_REPAPER=m
+CONFIG_FB=y
+CONFIG_FB_BCM2708=y
+CONFIG_FB_UDL=m
+CONFIG_FB_SSD1307=m
+CONFIG_FB_RPISENSE=m
+# CONFIG_BACKLIGHT_GENERIC is not set
+CONFIG_BACKLIGHT_RPI=m
+CONFIG_BACKLIGHT_GPIO=m
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_LOGO=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_SOUND=y
+CONFIG_SND=m
+CONFIG_SND_HRTIMER=m
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_DUMMY=m
+CONFIG_SND_ALOOP=m
+CONFIG_SND_VIRMIDI=m
+CONFIG_SND_MTPAV=m
+CONFIG_SND_SERIAL_U16550=m
+CONFIG_SND_MPU401=m
+CONFIG_SND_USB_AUDIO=m
+CONFIG_SND_USB_UA101=m
+CONFIG_SND_USB_CAIAQ=m
+CONFIG_SND_USB_CAIAQ_INPUT=y
+CONFIG_SND_USB_6FIRE=m
+CONFIG_SND_USB_HIFACE=m
+CONFIG_SND_SOC=m
+CONFIG_SND_BCM2835_SOC_I2S=m
+CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP=m
+CONFIG_SND_BCM2708_SOC_RPI_CIRRUS=m
+CONFIG_SND_BCM2708_SOC_RPI_DAC=m
+CONFIG_SND_BCM2708_SOC_RPI_PROTO=m
+CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC=m
+CONFIG_SND_BCM2708_SOC_JUSTBOOM_DIGI=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI=m
+CONFIG_SND_BCM2708_SOC_ADAU1977_ADC=m
+CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD=m
+CONFIG_SND_AUDIOINJECTOR_OCTO_SOUNDCARD=m
+CONFIG_SND_DIGIDAC1_SOUNDCARD=m
+CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO=m
+CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO_V2=m
+CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC=m
+CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC_PLUS=m
+CONFIG_SND_BCM2708_SOC_ALLO_BOSS_DAC=m
+CONFIG_SND_BCM2708_SOC_ALLO_DIGIONE=m
+CONFIG_SND_BCM2708_SOC_ALLO_KATANA_DAC=m
+CONFIG_SND_BCM2708_SOC_FE_PI_AUDIO=m
+CONFIG_SND_PISOUND=m
+CONFIG_SND_SOC_ADAU1701=m
+CONFIG_SND_SOC_ADAU7002=m
+CONFIG_SND_SOC_AK4554=m
+CONFIG_SND_SOC_CS4271_I2C=m
+CONFIG_SND_SOC_SPDIF=m
+CONFIG_SND_SOC_WM8804_I2C=m
+CONFIG_SND_SIMPLE_CARD=m
+CONFIG_HID_BATTERY_STRENGTH=y
+CONFIG_HIDRAW=y
+CONFIG_UHID=m
+CONFIG_HID_A4TECH=m
+CONFIG_HID_ACRUX=m
+CONFIG_HID_APPLE=m
+CONFIG_HID_ASUS=m
+CONFIG_HID_BELKIN=m
+CONFIG_HID_BETOP_FF=m
+CONFIG_HID_CHERRY=m
+CONFIG_HID_CHICONY=m
+CONFIG_HID_CYPRESS=m
+CONFIG_HID_DRAGONRISE=m
+CONFIG_HID_EMS_FF=m
+CONFIG_HID_ELECOM=m
+CONFIG_HID_ELO=m
+CONFIG_HID_EZKEY=m
+CONFIG_HID_GEMBIRD=m
+CONFIG_HID_HOLTEK=m
+CONFIG_HID_KEYTOUCH=m
+CONFIG_HID_KYE=m
+CONFIG_HID_UCLOGIC=m
+CONFIG_HID_WALTOP=m
+CONFIG_HID_GYRATION=m
+CONFIG_HID_TWINHAN=m
+CONFIG_HID_KENSINGTON=m
+CONFIG_HID_LCPOWER=m
+CONFIG_HID_LOGITECH=m
+CONFIG_HID_LOGITECH_DJ=m
+CONFIG_LOGITECH_FF=y
+CONFIG_LOGIRUMBLEPAD2_FF=y
+CONFIG_LOGIG940_FF=y
+CONFIG_HID_MAGICMOUSE=m
+CONFIG_HID_MICROSOFT=m
+CONFIG_HID_MONTEREY=m
+CONFIG_HID_MULTITOUCH=m
+CONFIG_HID_NTRIG=m
+CONFIG_HID_ORTEK=m
+CONFIG_HID_PANTHERLORD=m
+CONFIG_HID_PETALYNX=m
+CONFIG_HID_PICOLCD=m
+CONFIG_HID_ROCCAT=m
+CONFIG_HID_SAMSUNG=m
+CONFIG_HID_SONY=m
+CONFIG_SONY_FF=y
+CONFIG_HID_SPEEDLINK=m
+CONFIG_HID_SUNPLUS=m
+CONFIG_HID_GREENASIA=m
+CONFIG_HID_SMARTJOYPLUS=m
+CONFIG_HID_TOPSEED=m
+CONFIG_HID_THINGM=m
+CONFIG_HID_THRUSTMASTER=m
+CONFIG_HID_WACOM=m
+CONFIG_HID_WIIMOTE=m
+CONFIG_HID_XINMO=m
+CONFIG_HID_ZEROPLUS=m
+CONFIG_HID_ZYDACRON=m
+CONFIG_HID_PID=y
+CONFIG_USB_HIDDEV=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_MON=m
+CONFIG_USB_DWCOTG=y
+CONFIG_USB_PRINTER=m
+CONFIG_USB_STORAGE=y
+CONFIG_USB_STORAGE_REALTEK=m
+CONFIG_USB_STORAGE_DATAFAB=m
+CONFIG_USB_STORAGE_FREECOM=m
+CONFIG_USB_STORAGE_ISD200=m
+CONFIG_USB_STORAGE_USBAT=m
+CONFIG_USB_STORAGE_SDDR09=m
+CONFIG_USB_STORAGE_SDDR55=m
+CONFIG_USB_STORAGE_JUMPSHOT=m
+CONFIG_USB_STORAGE_ALAUDA=m
+CONFIG_USB_STORAGE_ONETOUCH=m
+CONFIG_USB_STORAGE_KARMA=m
+CONFIG_USB_STORAGE_CYPRESS_ATACB=m
+CONFIG_USB_STORAGE_ENE_UB6250=m
+CONFIG_USB_MDC800=m
+CONFIG_USB_MICROTEK=m
+CONFIG_USBIP_CORE=m
+CONFIG_USBIP_VHCI_HCD=m
+CONFIG_USBIP_HOST=m
+CONFIG_USB_DWC2=m
+CONFIG_USB_SERIAL=m
+CONFIG_USB_SERIAL_GENERIC=y
+CONFIG_USB_SERIAL_AIRCABLE=m
+CONFIG_USB_SERIAL_ARK3116=m
+CONFIG_USB_SERIAL_BELKIN=m
+CONFIG_USB_SERIAL_CH341=m
+CONFIG_USB_SERIAL_WHITEHEAT=m
+CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
+CONFIG_USB_SERIAL_CP210X=m
+CONFIG_USB_SERIAL_CYPRESS_M8=m
+CONFIG_USB_SERIAL_EMPEG=m
+CONFIG_USB_SERIAL_FTDI_SIO=m
+CONFIG_USB_SERIAL_VISOR=m
+CONFIG_USB_SERIAL_IPAQ=m
+CONFIG_USB_SERIAL_IR=m
+CONFIG_USB_SERIAL_EDGEPORT=m
+CONFIG_USB_SERIAL_EDGEPORT_TI=m
+CONFIG_USB_SERIAL_F81232=m
+CONFIG_USB_SERIAL_GARMIN=m
+CONFIG_USB_SERIAL_IPW=m
+CONFIG_USB_SERIAL_IUU=m
+CONFIG_USB_SERIAL_KEYSPAN_PDA=m
+CONFIG_USB_SERIAL_KEYSPAN=m
+CONFIG_USB_SERIAL_KLSI=m
+CONFIG_USB_SERIAL_KOBIL_SCT=m
+CONFIG_USB_SERIAL_MCT_U232=m
+CONFIG_USB_SERIAL_METRO=m
+CONFIG_USB_SERIAL_MOS7720=m
+CONFIG_USB_SERIAL_MOS7840=m
+CONFIG_USB_SERIAL_NAVMAN=m
+CONFIG_USB_SERIAL_PL2303=m
+CONFIG_USB_SERIAL_OTI6858=m
+CONFIG_USB_SERIAL_QCAUX=m
+CONFIG_USB_SERIAL_QUALCOMM=m
+CONFIG_USB_SERIAL_SPCP8X5=m
+CONFIG_USB_SERIAL_SAFE=m
+CONFIG_USB_SERIAL_SIERRAWIRELESS=m
+CONFIG_USB_SERIAL_SYMBOL=m
+CONFIG_USB_SERIAL_TI=m
+CONFIG_USB_SERIAL_CYBERJACK=m
+CONFIG_USB_SERIAL_XIRCOM=m
+CONFIG_USB_SERIAL_OPTION=m
+CONFIG_USB_SERIAL_OMNINET=m
+CONFIG_USB_SERIAL_OPTICON=m
+CONFIG_USB_SERIAL_XSENS_MT=m
+CONFIG_USB_SERIAL_WISHBONE=m
+CONFIG_USB_SERIAL_SSU100=m
+CONFIG_USB_SERIAL_QT2=m
+CONFIG_USB_SERIAL_DEBUG=m
+CONFIG_USB_EMI62=m
+CONFIG_USB_EMI26=m
+CONFIG_USB_ADUTUX=m
+CONFIG_USB_SEVSEG=m
+CONFIG_USB_RIO500=m
+CONFIG_USB_LEGOTOWER=m
+CONFIG_USB_LCD=m
+CONFIG_USB_CYPRESS_CY7C63=m
+CONFIG_USB_CYTHERM=m
+CONFIG_USB_IDMOUSE=m
+CONFIG_USB_FTDI_ELAN=m
+CONFIG_USB_APPLEDISPLAY=m
+CONFIG_USB_LD=m
+CONFIG_USB_TRANCEVIBRATOR=m
+CONFIG_USB_IOWARRIOR=m
+CONFIG_USB_TEST=m
+CONFIG_USB_ISIGHTFW=m
+CONFIG_USB_YUREX=m
+CONFIG_USB_ATM=m
+CONFIG_USB_SPEEDTOUCH=m
+CONFIG_USB_CXACRU=m
+CONFIG_USB_UEAGLEATM=m
+CONFIG_USB_XUSBATM=m
+CONFIG_USB_GADGET=m
+CONFIG_USB_ZERO=m
+CONFIG_USB_AUDIO=m
+CONFIG_USB_ETH=m
+CONFIG_USB_GADGETFS=m
+CONFIG_USB_MASS_STORAGE=m
+CONFIG_USB_G_SERIAL=m
+CONFIG_USB_MIDI_GADGET=m
+CONFIG_USB_G_PRINTER=m
+CONFIG_USB_CDC_COMPOSITE=m
+CONFIG_USB_G_ACM_MS=m
+CONFIG_USB_G_MULTI=m
+CONFIG_USB_G_HID=m
+CONFIG_USB_G_WEBCAM=m
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_BCM2835_MMC=y
+CONFIG_MMC_BCM2835_DMA=y
+CONFIG_MMC_BCM2835_SDHOST=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SPI=m
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_ONESHOT=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_BACKLIGHT=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_GPIO=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+CONFIG_LEDS_TRIGGER_TRANSIENT=m
+CONFIG_LEDS_TRIGGER_CAMERA=m
+CONFIG_LEDS_TRIGGER_INPUT=y
+CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_HCTOSYS is not set
+CONFIG_RTC_DRV_ABX80X=m
+CONFIG_RTC_DRV_DS1307=m
+CONFIG_RTC_DRV_DS1374=m
+CONFIG_RTC_DRV_DS1672=m
+CONFIG_RTC_DRV_MAX6900=m
+CONFIG_RTC_DRV_RS5C372=m
+CONFIG_RTC_DRV_ISL1208=m
+CONFIG_RTC_DRV_ISL12022=m
+CONFIG_RTC_DRV_X1205=m
+CONFIG_RTC_DRV_PCF8523=m
+CONFIG_RTC_DRV_PCF8563=m
+CONFIG_RTC_DRV_PCF8583=m
+CONFIG_RTC_DRV_M41T80=m
+CONFIG_RTC_DRV_BQ32K=m
+CONFIG_RTC_DRV_S35390A=m
+CONFIG_RTC_DRV_FM3130=m
+CONFIG_RTC_DRV_RX8581=m
+CONFIG_RTC_DRV_RX8025=m
+CONFIG_RTC_DRV_EM3027=m
+CONFIG_RTC_DRV_M41T93=m
+CONFIG_RTC_DRV_M41T94=m
+CONFIG_RTC_DRV_DS1302=m
+CONFIG_RTC_DRV_DS1305=m
+CONFIG_RTC_DRV_DS1390=m
+CONFIG_RTC_DRV_R9701=m
+CONFIG_RTC_DRV_RX4581=m
+CONFIG_RTC_DRV_RS5C348=m
+CONFIG_RTC_DRV_MAX6902=m
+CONFIG_RTC_DRV_PCF2123=m
+CONFIG_RTC_DRV_DS3232=m
+CONFIG_RTC_DRV_PCF2127=m
+CONFIG_RTC_DRV_RV3029C2=m
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2835=y
+CONFIG_DMA_BCM2708=y
+CONFIG_UIO=m
+CONFIG_UIO_PDRV_GENIRQ=m
+CONFIG_STAGING=y
+CONFIG_IRDA=m
+CONFIG_IRLAN=m
+CONFIG_IRNET=m
+CONFIG_IRCOMM=m
+CONFIG_IRDA_ULTRA=y
+CONFIG_IRDA_CACHE_LAST_LSAP=y
+CONFIG_IRDA_FAST_RR=y
+CONFIG_IRTTY_SIR=m
+CONFIG_KINGSUN_DONGLE=m
+CONFIG_KSDAZZLE_DONGLE=m
+CONFIG_KS959_DONGLE=m
+CONFIG_USB_IRDA=m
+CONFIG_SIGMATEL_FIR=m
+CONFIG_MCS_FIR=m
+CONFIG_PRISM2_USB=m
+CONFIG_R8712U=m
+CONFIG_R8188EU=m
+CONFIG_VT6656=m
+CONFIG_SPEAKUP=m
+CONFIG_SPEAKUP_SYNTH_SOFT=m
+CONFIG_STAGING_MEDIA=y
+CONFIG_LIRC_STAGING=y
+CONFIG_LIRC_RPI=m
+CONFIG_FB_TFT=m
+CONFIG_FB_TFT_AGM1264K_FL=m
+CONFIG_FB_TFT_BD663474=m
+CONFIG_FB_TFT_HX8340BN=m
+CONFIG_FB_TFT_HX8347D=m
+CONFIG_FB_TFT_HX8353D=m
+CONFIG_FB_TFT_HX8357D=m
+CONFIG_FB_TFT_ILI9163=m
+CONFIG_FB_TFT_ILI9320=m
+CONFIG_FB_TFT_ILI9325=m
+CONFIG_FB_TFT_ILI9340=m
+CONFIG_FB_TFT_ILI9341=m
+CONFIG_FB_TFT_ILI9481=m
+CONFIG_FB_TFT_ILI9486=m
+CONFIG_FB_TFT_PCD8544=m
+CONFIG_FB_TFT_RA8875=m
+CONFIG_FB_TFT_S6D02A1=m
+CONFIG_FB_TFT_S6D1121=m
+CONFIG_FB_TFT_SSD1289=m
+CONFIG_FB_TFT_SSD1306=m
+CONFIG_FB_TFT_SSD1331=m
+CONFIG_FB_TFT_SSD1351=m
+CONFIG_FB_TFT_ST7735R=m
+CONFIG_FB_TFT_ST7789V=m
+CONFIG_FB_TFT_TINYLCD=m
+CONFIG_FB_TFT_TLS8204=m
+CONFIG_FB_TFT_UC1701=m
+CONFIG_FB_TFT_UPD161704=m
+CONFIG_FB_TFT_WATTEROTT=m
+CONFIG_FB_FLEX=m
+CONFIG_FB_TFT_FBTFT_DEVICE=m
+CONFIG_BCM2835_VCHIQ=y
+CONFIG_BCM2835_VCHIQ_SUPPORT_MEMDUMP=y
+CONFIG_SND_BCM2835=m
+CONFIG_VIDEO_BCM2835=m
+CONFIG_MAILBOX=y
+CONFIG_BCM2835_MBOX=y
+# CONFIG_IOMMU_SUPPORT is not set
+CONFIG_RASPBERRYPI_POWER=y
+CONFIG_EXTCON=m
+CONFIG_EXTCON_ARIZONA=m
+CONFIG_IIO=m
+CONFIG_IIO_BUFFER_CB=m
+CONFIG_MCP320X=m
+CONFIG_MCP3422=m
+CONFIG_DHT11=m
+CONFIG_HDC100X=m
+CONFIG_HTU21=m
+CONFIG_INV_MPU6050_I2C=m
+CONFIG_TSL4531=m
+CONFIG_VEML6070=m
+CONFIG_BMP280=m
+CONFIG_PWM_BCM2835=m
+CONFIG_PWM_PCA9685=m
+CONFIG_RPI_AXIPERF=m
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_REISERFS_FS=m
+CONFIG_REISERFS_FS_XATTR=y
+CONFIG_REISERFS_FS_POSIX_ACL=y
+CONFIG_REISERFS_FS_SECURITY=y
+CONFIG_JFS_FS=m
+CONFIG_JFS_POSIX_ACL=y
+CONFIG_JFS_SECURITY=y
+CONFIG_JFS_STATISTICS=y
+CONFIG_XFS_FS=m
+CONFIG_XFS_QUOTA=y
+CONFIG_XFS_POSIX_ACL=y
+CONFIG_XFS_RT=y
+CONFIG_GFS2_FS=m
+CONFIG_OCFS2_FS=m
+CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_NILFS2_FS=m
+CONFIG_F2FS_FS=y
+CONFIG_FANOTIFY=y
+CONFIG_QFMT_V1=m
+CONFIG_QFMT_V2=m
+CONFIG_AUTOFS4_FS=y
+CONFIG_FUSE_FS=m
+CONFIG_CUSE=m
+CONFIG_OVERLAY_FS=m
+CONFIG_FSCACHE=y
+CONFIG_FSCACHE_STATS=y
+CONFIG_FSCACHE_HISTOGRAM=y
+CONFIG_CACHEFILES=y
+CONFIG_ISO9660_FS=m
+CONFIG_JOLIET=y
+CONFIG_ZISOFS=y
+CONFIG_UDF_FS=m
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_FAT_DEFAULT_IOCHARSET="ascii"
+CONFIG_NTFS_FS=m
+CONFIG_NTFS_RW=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_ECRYPT_FS=m
+CONFIG_HFS_FS=m
+CONFIG_HFSPLUS_FS=m
+CONFIG_JFFS2_FS=m
+CONFIG_JFFS2_SUMMARY=y
+CONFIG_UBIFS_FS=m
+CONFIG_SQUASHFS=m
+CONFIG_SQUASHFS_XATTR=y
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_SWAP=y
+CONFIG_NFS_V4_1=y
+CONFIG_ROOT_NFS=y
+CONFIG_NFS_FSCACHE=y
+CONFIG_NFSD=m
+CONFIG_NFSD_V3_ACL=y
+CONFIG_NFSD_V4=y
+CONFIG_CIFS=m
+CONFIG_CIFS_WEAK_PW_HASH=y
+CONFIG_CIFS_UPCALL=y
+CONFIG_CIFS_XATTR=y
+CONFIG_CIFS_POSIX=y
+CONFIG_CIFS_ACL=y
+CONFIG_CIFS_DFS_UPCALL=y
+CONFIG_CIFS_FSCACHE=y
+CONFIG_9P_FS=m
+CONFIG_9P_FS_POSIX_ACL=y
+CONFIG_NLS_DEFAULT="utf8"
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_CODEPAGE_737=m
+CONFIG_NLS_CODEPAGE_775=m
+CONFIG_NLS_CODEPAGE_850=m
+CONFIG_NLS_CODEPAGE_852=m
+CONFIG_NLS_CODEPAGE_855=m
+CONFIG_NLS_CODEPAGE_857=m
+CONFIG_NLS_CODEPAGE_860=m
+CONFIG_NLS_CODEPAGE_861=m
+CONFIG_NLS_CODEPAGE_862=m
+CONFIG_NLS_CODEPAGE_863=m
+CONFIG_NLS_CODEPAGE_864=m
+CONFIG_NLS_CODEPAGE_865=m
+CONFIG_NLS_CODEPAGE_866=m
+CONFIG_NLS_CODEPAGE_869=m
+CONFIG_NLS_CODEPAGE_936=m
+CONFIG_NLS_CODEPAGE_950=m
+CONFIG_NLS_CODEPAGE_932=m
+CONFIG_NLS_CODEPAGE_949=m
+CONFIG_NLS_CODEPAGE_874=m
+CONFIG_NLS_ISO8859_8=m
+CONFIG_NLS_CODEPAGE_1250=m
+CONFIG_NLS_CODEPAGE_1251=m
+CONFIG_NLS_ASCII=y
+CONFIG_NLS_ISO8859_1=m
+CONFIG_NLS_ISO8859_2=m
+CONFIG_NLS_ISO8859_3=m
+CONFIG_NLS_ISO8859_4=m
+CONFIG_NLS_ISO8859_5=m
+CONFIG_NLS_ISO8859_6=m
+CONFIG_NLS_ISO8859_7=m
+CONFIG_NLS_ISO8859_9=m
+CONFIG_NLS_ISO8859_13=m
+CONFIG_NLS_ISO8859_14=m
+CONFIG_NLS_ISO8859_15=m
+CONFIG_NLS_KOI8_R=m
+CONFIG_NLS_KOI8_U=m
+CONFIG_DLM=m
+CONFIG_PRINTK_TIME=y
+CONFIG_BOOT_PRINTK_DELAY=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DETECT_HUNG_TASK=y
+# CONFIG_RCU_TRACE is not set
+CONFIG_LATENCYTOP=y
+CONFIG_IRQSOFF_TRACER=y
+CONFIG_SCHED_TRACER=y
+CONFIG_STACK_TRACER=y
+CONFIG_BLK_DEV_IO_TRACE=y
+# CONFIG_UPROBE_EVENTS is not set
+CONFIG_FUNCTION_PROFILER=y
+CONFIG_KGDB=y
+CONFIG_KGDB_KDB=y
+CONFIG_KDB_KEYBOARD=y
+CONFIG_CRYPTO_USER=m
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CTS=m
+CONFIG_CRYPTO_XTS=m
+CONFIG_CRYPTO_XCBC=m
+CONFIG_CRYPTO_SHA512=m
+CONFIG_CRYPTO_TGR192=m
+CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_CAST5=m
+CONFIG_CRYPTO_DES=y
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_USER_API_SKCIPHER=m
+# CONFIG_CRYPTO_HW is not set
+CONFIG_ARM_CRYPTO=y
+CONFIG_CRYPTO_SHA1_ARM_NEON=m
+CONFIG_CRYPTO_AES_ARM=m
+CONFIG_CRYPTO_AES_ARM_BS=m
+CONFIG_CRC_ITU_T=y
+CONFIG_LIBCRC32C=y
diff --git a/arch/arm/configs/bcmrpi_defconfig b/arch/arm/configs/bcmrpi_defconfig
new file mode 100644
index 000000000000..9aa5ff893f87
--- /dev/null
+++ b/arch/arm/configs/bcmrpi_defconfig
@@ -0,0 +1,1360 @@
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_GENERIC_IRQ_DEBUGFS=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_IKCONFIG=m
+CONFIG_IKCONFIG_PROC=y
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_NAMESPACES=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_EMBEDDED=y
+# CONFIG_COMPAT_BRK is not set
+CONFIG_PROFILING=y
+CONFIG_OPROFILE=m
+CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_MAC_PARTITION=y
+CONFIG_CFQ_GROUP_IOSCHED=y
+CONFIG_ARCH_MULTI_V6=y
+# CONFIG_ARCH_MULTI_V7 is not set
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
+# CONFIG_CACHE_L2X0 is not set
+CONFIG_PREEMPT_VOLUNTARY=y
+# CONFIG_CPU_SW_DOMAIN_PAN is not set
+CONFIG_CLEANCACHE=y
+CONFIG_FRONTSWAP=y
+CONFIG_CMA=y
+CONFIG_ZSMALLOC=m
+CONFIG_PGTABLE_MAPPING=y
+CONFIG_UACCESS_WITH_MEMCPY=y
+CONFIG_SECCOMP=y
+# CONFIG_ATAGS is not set
+CONFIG_ZBOOT_ROM_TEXT=0x0
+CONFIG_ZBOOT_ROM_BSS=0x0
+CONFIG_CMDLINE="console=ttyAMA0,115200 kgdboc=ttyAMA0,115200 root=/dev/mmcblk0p2 rootfstype=ext4 rootwait"
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_VFP=y
+CONFIG_BINFMT_MISC=m
+# CONFIG_SUSPEND is not set
+CONFIG_PM=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_XFRM_USER=y
+CONFIG_NET_KEY=m
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_ROUTE_VERBOSE=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_RARP=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE_DEMUX=m
+CONFIG_NET_IPGRE=m
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
+CONFIG_INET_AH=m
+CONFIG_INET_ESP=m
+CONFIG_INET_IPCOMP=m
+CONFIG_INET_XFRM_MODE_TRANSPORT=m
+CONFIG_INET_XFRM_MODE_TUNNEL=m
+CONFIG_INET_XFRM_MODE_BEET=m
+CONFIG_INET_DIAG=m
+CONFIG_TCP_CONG_ADVANCED=y
+CONFIG_TCP_CONG_BBR=m
+CONFIG_IPV6=m
+CONFIG_IPV6_ROUTER_PREF=y
+CONFIG_IPV6_ROUTE_INFO=y
+CONFIG_INET6_AH=m
+CONFIG_INET6_ESP=m
+CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_SIT_6RD=y
+CONFIG_IPV6_TUNNEL=m
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETFILTER=y
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=m
+CONFIG_NF_CONNTRACK_FTP=m
+CONFIG_NF_CONNTRACK_H323=m
+CONFIG_NF_CONNTRACK_IRC=m
+CONFIG_NF_CONNTRACK_NETBIOS_NS=m
+CONFIG_NF_CONNTRACK_SNMP=m
+CONFIG_NF_CONNTRACK_PPTP=m
+CONFIG_NF_CONNTRACK_SANE=m
+CONFIG_NF_CONNTRACK_SIP=m
+CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_CT_NETLINK=m
+CONFIG_NETFILTER_XT_SET=m
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
+CONFIG_NETFILTER_XT_TARGET_DSCP=m
+CONFIG_NETFILTER_XT_TARGET_HMARK=m
+CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
+CONFIG_NETFILTER_XT_TARGET_LED=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFLOG=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
+CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
+CONFIG_NETFILTER_XT_TARGET_TRACE=m
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
+CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_BPF=m
+CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_CPU=m
+CONFIG_NETFILTER_XT_MATCH_DCCP=m
+CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_ESP=m
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
+CONFIG_NETFILTER_XT_MATCH_IPVS=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_NFACCT=m
+CONFIG_NETFILTER_XT_MATCH_OSF=m
+CONFIG_NETFILTER_XT_MATCH_OWNER=m
+CONFIG_NETFILTER_XT_MATCH_POLICY=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_QUOTA=m
+CONFIG_NETFILTER_XT_MATCH_RATEEST=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
+CONFIG_NETFILTER_XT_MATCH_TIME=m
+CONFIG_NETFILTER_XT_MATCH_U32=m
+CONFIG_IP_SET=m
+CONFIG_IP_SET_BITMAP_IP=m
+CONFIG_IP_SET_BITMAP_IPMAC=m
+CONFIG_IP_SET_BITMAP_PORT=m
+CONFIG_IP_SET_HASH_IP=m
+CONFIG_IP_SET_HASH_IPPORT=m
+CONFIG_IP_SET_HASH_IPPORTIP=m
+CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETPORT=m
+CONFIG_IP_SET_HASH_NETIFACE=m
+CONFIG_IP_SET_LIST_SET=m
+CONFIG_IP_VS=m
+CONFIG_IP_VS_PROTO_TCP=y
+CONFIG_IP_VS_PROTO_UDP=y
+CONFIG_IP_VS_PROTO_ESP=y
+CONFIG_IP_VS_PROTO_AH=y
+CONFIG_IP_VS_PROTO_SCTP=y
+CONFIG_IP_VS_RR=m
+CONFIG_IP_VS_WRR=m
+CONFIG_IP_VS_LC=m
+CONFIG_IP_VS_WLC=m
+CONFIG_IP_VS_LBLC=m
+CONFIG_IP_VS_LBLCR=m
+CONFIG_IP_VS_DH=m
+CONFIG_IP_VS_SH=m
+CONFIG_IP_VS_SED=m
+CONFIG_IP_VS_NQ=m
+CONFIG_IP_VS_FTP=m
+CONFIG_IP_VS_PE_SIP=m
+CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_CLUSTERIP=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_TTL=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_ARPTABLES=m
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_TARGET_HL=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_AMONG=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_MARK=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_MARK_T=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_SCTP_COOKIE_HMAC_SHA1=y
+CONFIG_ATM=m
+CONFIG_L2TP=m
+CONFIG_L2TP_V3=y
+CONFIG_L2TP_IP=m
+CONFIG_L2TP_ETH=m
+CONFIG_BRIDGE=m
+CONFIG_VLAN_8021Q=m
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_ATALK=m
+CONFIG_6LOWPAN=m
+CONFIG_IEEE802154=m
+CONFIG_IEEE802154_6LOWPAN=m
+CONFIG_MAC802154=m
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_CBQ=m
+CONFIG_NET_SCH_HTB=m
+CONFIG_NET_SCH_HFSC=m
+CONFIG_NET_SCH_ATM=m
+CONFIG_NET_SCH_PRIO=m
+CONFIG_NET_SCH_MULTIQ=m
+CONFIG_NET_SCH_RED=m
+CONFIG_NET_SCH_SFB=m
+CONFIG_NET_SCH_SFQ=m
+CONFIG_NET_SCH_TEQL=m
+CONFIG_NET_SCH_TBF=m
+CONFIG_NET_SCH_GRED=m
+CONFIG_NET_SCH_DSMARK=m
+CONFIG_NET_SCH_NETEM=m
+CONFIG_NET_SCH_DRR=m
+CONFIG_NET_SCH_MQPRIO=m
+CONFIG_NET_SCH_CHOKE=m
+CONFIG_NET_SCH_QFQ=m
+CONFIG_NET_SCH_CODEL=m
+CONFIG_NET_SCH_FQ_CODEL=m
+CONFIG_NET_SCH_FQ=m
+CONFIG_NET_SCH_HHF=m
+CONFIG_NET_SCH_PIE=m
+CONFIG_NET_SCH_INGRESS=m
+CONFIG_NET_SCH_PLUG=m
+CONFIG_NET_CLS_BASIC=m
+CONFIG_NET_CLS_TCINDEX=m
+CONFIG_NET_CLS_ROUTE4=m
+CONFIG_NET_CLS_FW=m
+CONFIG_NET_CLS_U32=m
+CONFIG_CLS_U32_MARK=y
+CONFIG_NET_CLS_RSVP=m
+CONFIG_NET_CLS_RSVP6=m
+CONFIG_NET_CLS_FLOW=m
+CONFIG_NET_CLS_CGROUP=m
+CONFIG_NET_EMATCH=y
+CONFIG_NET_EMATCH_CMP=m
+CONFIG_NET_EMATCH_NBYTE=m
+CONFIG_NET_EMATCH_U32=m
+CONFIG_NET_EMATCH_META=m
+CONFIG_NET_EMATCH_TEXT=m
+CONFIG_NET_EMATCH_IPSET=m
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_ACT_POLICE=m
+CONFIG_NET_ACT_GACT=m
+CONFIG_GACT_PROB=y
+CONFIG_NET_ACT_MIRRED=m
+CONFIG_NET_ACT_IPT=m
+CONFIG_NET_ACT_NAT=m
+CONFIG_NET_ACT_PEDIT=m
+CONFIG_NET_ACT_SIMP=m
+CONFIG_NET_ACT_SKBEDIT=m
+CONFIG_NET_ACT_CSUM=m
+CONFIG_BATMAN_ADV=m
+CONFIG_OPENVSWITCH=m
+CONFIG_NET_L3_MASTER_DEV=y
+CONFIG_NET_PKTGEN=m
+CONFIG_HAMRADIO=y
+CONFIG_AX25=m
+CONFIG_NETROM=m
+CONFIG_ROSE=m
+CONFIG_MKISS=m
+CONFIG_6PACK=m
+CONFIG_BPQETHER=m
+CONFIG_BAYCOM_SER_FDX=m
+CONFIG_BAYCOM_SER_HDX=m
+CONFIG_YAM=m
+CONFIG_CAN=m
+CONFIG_CAN_VCAN=m
+CONFIG_CAN_SLCAN=m
+CONFIG_CAN_MCP251X=m
+CONFIG_CAN_GS_USB=m
+CONFIG_BT=m
+CONFIG_BT_RFCOMM=m
+CONFIG_BT_RFCOMM_TTY=y
+CONFIG_BT_BNEP=m
+CONFIG_BT_BNEP_MC_FILTER=y
+CONFIG_BT_BNEP_PROTO_FILTER=y
+CONFIG_BT_HIDP=m
+CONFIG_BT_6LOWPAN=m
+CONFIG_BT_HCIBTUSB=m
+CONFIG_BT_HCIUART=m
+CONFIG_BT_HCIUART_3WIRE=y
+CONFIG_BT_HCIUART_BCM=y
+CONFIG_BT_HCIBCM203X=m
+CONFIG_BT_HCIBPA10X=m
+CONFIG_BT_HCIBFUSB=m
+CONFIG_BT_HCIVHCI=m
+CONFIG_BT_MRVL=m
+CONFIG_BT_MRVL_SDIO=m
+CONFIG_BT_ATH3K=m
+CONFIG_BT_WILINK=m
+CONFIG_CFG80211=m
+CONFIG_MAC80211=m
+CONFIG_MAC80211_MESH=y
+CONFIG_WIMAX=m
+CONFIG_RFKILL=m
+CONFIG_RFKILL_INPUT=y
+CONFIG_NET_9P=m
+CONFIG_NFC=m
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=5
+CONFIG_MTD=m
+CONFIG_MTD_BLOCK=m
+CONFIG_MTD_M25P80=m
+CONFIG_MTD_BLOCK2MTD=m
+CONFIG_MTD_NAND=m
+CONFIG_MTD_SPI_NOR=m
+CONFIG_MTD_UBI=m
+CONFIG_OF_CONFIGFS=y
+CONFIG_ZRAM=m
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
+CONFIG_BLK_DEV_NBD=m
+CONFIG_BLK_DEV_RAM=y
+CONFIG_CDROM_PKTCDVD=m
+CONFIG_ATA_OVER_ETH=m
+CONFIG_EEPROM_AT24=m
+CONFIG_TI_ST=m
+CONFIG_SCSI=y
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_BLK_DEV_SD=y
+CONFIG_CHR_DEV_ST=m
+CONFIG_CHR_DEV_OSST=m
+CONFIG_BLK_DEV_SR=m
+CONFIG_CHR_DEV_SG=m
+CONFIG_SCSI_ISCSI_ATTRS=y
+CONFIG_ISCSI_TCP=m
+CONFIG_ISCSI_BOOT_SYSFS=m
+CONFIG_MD=y
+CONFIG_MD_LINEAR=m
+CONFIG_BLK_DEV_DM=m
+CONFIG_DM_CRYPT=m
+CONFIG_DM_SNAPSHOT=m
+CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_CACHE=m
+CONFIG_DM_MIRROR=m
+CONFIG_DM_LOG_USERSPACE=m
+CONFIG_DM_RAID=m
+CONFIG_DM_ZERO=m
+CONFIG_DM_DELAY=m
+CONFIG_NETDEVICES=y
+CONFIG_BONDING=m
+CONFIG_DUMMY=m
+CONFIG_IFB=m
+CONFIG_MACVLAN=m
+CONFIG_IPVLAN=m
+CONFIG_VXLAN=m
+CONFIG_NETCONSOLE=m
+CONFIG_TUN=m
+CONFIG_VETH=m
+CONFIG_ENC28J60=m
+CONFIG_QCA7000_SPI=m
+CONFIG_MDIO_BITBANG=m
+CONFIG_PPP=m
+CONFIG_PPP_BSDCOMP=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPP_FILTER=y
+CONFIG_PPP_MPPE=m
+CONFIG_PPP_MULTILINK=y
+CONFIG_PPPOATM=m
+CONFIG_PPPOE=m
+CONFIG_PPPOL2TP=m
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_SYNC_TTY=m
+CONFIG_SLIP=m
+CONFIG_SLIP_COMPRESSED=y
+CONFIG_SLIP_SMART=y
+CONFIG_USB_CATC=m
+CONFIG_USB_KAWETH=m
+CONFIG_USB_PEGASUS=m
+CONFIG_USB_RTL8150=m
+CONFIG_USB_RTL8152=m
+CONFIG_USB_LAN78XX=m
+CONFIG_USB_USBNET=y
+CONFIG_USB_NET_AX8817X=m
+CONFIG_USB_NET_AX88179_178A=m
+CONFIG_USB_NET_CDCETHER=m
+CONFIG_USB_NET_CDC_EEM=m
+CONFIG_USB_NET_CDC_NCM=m
+CONFIG_USB_NET_HUAWEI_CDC_NCM=m
+CONFIG_USB_NET_CDC_MBIM=m
+CONFIG_USB_NET_DM9601=m
+CONFIG_USB_NET_SR9700=m
+CONFIG_USB_NET_SR9800=m
+CONFIG_USB_NET_SMSC75XX=m
+CONFIG_USB_NET_SMSC95XX=y
+CONFIG_USB_NET_GL620A=m
+CONFIG_USB_NET_NET1080=m
+CONFIG_USB_NET_PLUSB=m
+CONFIG_USB_NET_MCS7830=m
+CONFIG_USB_NET_CDC_SUBSET=m
+CONFIG_USB_ALI_M5632=y
+CONFIG_USB_AN2720=y
+CONFIG_USB_EPSON2888=y
+CONFIG_USB_KC2190=y
+CONFIG_USB_NET_ZAURUS=m
+CONFIG_USB_NET_CX82310_ETH=m
+CONFIG_USB_NET_KALMIA=m
+CONFIG_USB_NET_QMI_WWAN=m
+CONFIG_USB_HSO=m
+CONFIG_USB_NET_INT51X1=m
+CONFIG_USB_IPHETH=m
+CONFIG_USB_SIERRA_NET=m
+CONFIG_USB_VL600=m
+CONFIG_ATH9K=m
+CONFIG_ATH9K_HTC=m
+CONFIG_CARL9170=m
+CONFIG_ATH6KL=m
+CONFIG_ATH6KL_USB=m
+CONFIG_AR5523=m
+CONFIG_AT76C50X_USB=m
+CONFIG_B43=m
+# CONFIG_B43_PHY_N is not set
+CONFIG_B43LEGACY=m
+CONFIG_BRCMFMAC=m
+CONFIG_BRCMFMAC_USB=y
+CONFIG_BRCMDBG=y
+CONFIG_HOSTAP=m
+CONFIG_P54_COMMON=m
+CONFIG_P54_USB=m
+CONFIG_LIBERTAS=m
+CONFIG_LIBERTAS_USB=m
+CONFIG_LIBERTAS_SDIO=m
+CONFIG_LIBERTAS_THINFIRM=m
+CONFIG_LIBERTAS_THINFIRM_USB=m
+CONFIG_MWIFIEX=m
+CONFIG_MWIFIEX_SDIO=m
+CONFIG_MT7601U=m
+CONFIG_RT2X00=m
+CONFIG_RT2500USB=m
+CONFIG_RT73USB=m
+CONFIG_RT2800USB=m
+CONFIG_RT2800USB_RT3573=y
+CONFIG_RT2800USB_RT53XX=y
+CONFIG_RT2800USB_RT55XX=y
+CONFIG_RT2800USB_UNKNOWN=y
+CONFIG_RTL8187=m
+CONFIG_RTL8192CU=m
+CONFIG_RTL8XXXU=m
+CONFIG_USB_ZD1201=m
+CONFIG_ZD1211RW=m
+CONFIG_MAC80211_HWSIM=m
+CONFIG_USB_NET_RNDIS_WLAN=m
+CONFIG_WIMAX_I2400M_USB=m
+CONFIG_IEEE802154_AT86RF230=m
+CONFIG_IEEE802154_MRF24J40=m
+CONFIG_IEEE802154_CC2520=m
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_JOYDEV=m
+CONFIG_INPUT_EVDEV=m
+# CONFIG_KEYBOARD_ATKBD is not set
+CONFIG_KEYBOARD_GPIO=m
+CONFIG_KEYBOARD_MATRIX=m
+# CONFIG_INPUT_MOUSE is not set
+CONFIG_INPUT_JOYSTICK=y
+CONFIG_JOYSTICK_IFORCE=m
+CONFIG_JOYSTICK_IFORCE_USB=y
+CONFIG_JOYSTICK_XPAD=m
+CONFIG_JOYSTICK_XPAD_FF=y
+CONFIG_JOYSTICK_XPAD_LEDS=y
+CONFIG_JOYSTICK_PSXPAD_SPI=m
+CONFIG_JOYSTICK_PSXPAD_SPI_FF=y
+CONFIG_JOYSTICK_RPISENSE=m
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_ADS7846=m
+CONFIG_TOUCHSCREEN_EGALAX=m
+CONFIG_TOUCHSCREEN_EXC3000=m
+CONFIG_TOUCHSCREEN_GOODIX=m
+CONFIG_TOUCHSCREEN_EDT_FT5X06=m
+CONFIG_TOUCHSCREEN_RPI_FT5406=m
+CONFIG_TOUCHSCREEN_USB_COMPOSITE=m
+CONFIG_TOUCHSCREEN_STMPE=m
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_AD714X=m
+CONFIG_INPUT_ATI_REMOTE2=m
+CONFIG_INPUT_KEYSPAN_REMOTE=m
+CONFIG_INPUT_POWERMATE=m
+CONFIG_INPUT_YEALINK=m
+CONFIG_INPUT_CM109=m
+CONFIG_INPUT_UINPUT=m
+CONFIG_INPUT_GPIO_ROTARY_ENCODER=m
+CONFIG_INPUT_ADXL34X=m
+CONFIG_INPUT_CMA3000=m
+CONFIG_SERIO=m
+CONFIG_SERIO_RAW=m
+CONFIG_GAMEPORT=m
+CONFIG_GAMEPORT_NS558=m
+CONFIG_GAMEPORT_L4=m
+CONFIG_BRCM_CHAR_DRIVERS=y
+CONFIG_BCM_VCIO=y
+CONFIG_BCM_VC_SM=y
+CONFIG_BCM2835_DEVGPIOMEM=y
+# CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_8250=y
+# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+# CONFIG_SERIAL_8250_DMA is not set
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_BCM2835AUX=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_SC16IS7XX=m
+CONFIG_SERIAL_SC16IS7XX_SPI=y
+CONFIG_SERIAL_DEV_BUS=m
+CONFIG_TTY_PRINTK=y
+CONFIG_HW_RANDOM=y
+CONFIG_RAW_DRIVER=y
+CONFIG_I2C=y
+CONFIG_I2C_CHARDEV=m
+CONFIG_I2C_MUX_GPMUX=m
+CONFIG_I2C_MUX_PCA954x=m
+CONFIG_I2C_BCM2708=m
+CONFIG_I2C_BCM2835=m
+CONFIG_I2C_GPIO=m
+CONFIG_I2C_ROBOTFUZZ_OSIF=m
+CONFIG_I2C_TINY_USB=m
+CONFIG_SPI=y
+CONFIG_SPI_BCM2835=m
+CONFIG_SPI_BCM2835AUX=m
+CONFIG_SPI_SPIDEV=m
+CONFIG_SPI_SLAVE=y
+CONFIG_PPS=m
+CONFIG_PPS_CLIENT_LDISC=m
+CONFIG_PPS_CLIENT_GPIO=m
+CONFIG_PINCTRL_MCP23S08=m
+CONFIG_GPIO_MOCKUP=m
+CONFIG_GPIO_PCF857X=m
+CONFIG_GPIO_ARIZONA=m
+CONFIG_GPIO_STMPE=y
+CONFIG_W1=m
+CONFIG_W1_MASTER_DS2490=m
+CONFIG_W1_MASTER_DS2482=m
+CONFIG_W1_MASTER_DS1WM=m
+CONFIG_W1_MASTER_GPIO=m
+CONFIG_W1_SLAVE_THERM=m
+CONFIG_W1_SLAVE_SMEM=m
+CONFIG_W1_SLAVE_DS2408=m
+CONFIG_W1_SLAVE_DS2413=m
+CONFIG_W1_SLAVE_DS2406=m
+CONFIG_W1_SLAVE_DS2423=m
+CONFIG_W1_SLAVE_DS2431=m
+CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2438=m
+CONFIG_W1_SLAVE_DS2760=m
+CONFIG_W1_SLAVE_DS2780=m
+CONFIG_W1_SLAVE_DS2781=m
+CONFIG_W1_SLAVE_DS28E04=m
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_GPIO=y
+CONFIG_BATTERY_DS2760=m
+CONFIG_BATTERY_GAUGE_LTC2941=m
+CONFIG_HWMON=m
+CONFIG_SENSORS_DS1621=m
+CONFIG_SENSORS_JC42=m
+CONFIG_SENSORS_LM75=m
+CONFIG_SENSORS_SHT21=m
+CONFIG_SENSORS_SHT3x=m
+CONFIG_SENSORS_SHTC1=m
+CONFIG_SENSORS_ADS1015=m
+CONFIG_SENSORS_INA2XX=m
+CONFIG_SENSORS_TMP102=m
+CONFIG_THERMAL=y
+CONFIG_BCM2835_THERMAL=y
+CONFIG_WATCHDOG=y
+CONFIG_GPIO_WATCHDOG=m
+CONFIG_BCM2835_WDT=y
+CONFIG_MFD_STMPE=y
+CONFIG_STMPE_SPI=y
+CONFIG_MFD_ARIZONA_I2C=m
+CONFIG_MFD_ARIZONA_SPI=m
+CONFIG_MFD_WM5102=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=m
+CONFIG_REGULATOR_ARIZONA_LDO1=m
+CONFIG_REGULATOR_ARIZONA_MICSUPP=m
+CONFIG_LIRC=m
+CONFIG_RC_DEVICES=y
+CONFIG_RC_ATI_REMOTE=m
+CONFIG_IR_IMON=m
+CONFIG_IR_MCEUSB=m
+CONFIG_IR_REDRAT3=m
+CONFIG_IR_STREAMZAP=m
+CONFIG_IR_IGUANA=m
+CONFIG_IR_TTUSBIR=m
+CONFIG_RC_LOOPBACK=m
+CONFIG_IR_GPIO_CIR=m
+CONFIG_IR_GPIO_TX=m
+CONFIG_IR_PWM_TX=m
+CONFIG_MEDIA_SUPPORT=m
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_ANALOG_TV_SUPPORT=y
+CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y
+CONFIG_MEDIA_RADIO_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_MEDIA_USB_SUPPORT=y
+CONFIG_USB_VIDEO_CLASS=m
+CONFIG_USB_M5602=m
+CONFIG_USB_STV06XX=m
+CONFIG_USB_GL860=m
+CONFIG_USB_GSPCA_BENQ=m
+CONFIG_USB_GSPCA_CONEX=m
+CONFIG_USB_GSPCA_CPIA1=m
+CONFIG_USB_GSPCA_DTCS033=m
+CONFIG_USB_GSPCA_ETOMS=m
+CONFIG_USB_GSPCA_FINEPIX=m
+CONFIG_USB_GSPCA_JEILINJ=m
+CONFIG_USB_GSPCA_JL2005BCD=m
+CONFIG_USB_GSPCA_KINECT=m
+CONFIG_USB_GSPCA_KONICA=m
+CONFIG_USB_GSPCA_MARS=m
+CONFIG_USB_GSPCA_MR97310A=m
+CONFIG_USB_GSPCA_NW80X=m
+CONFIG_USB_GSPCA_OV519=m
+CONFIG_USB_GSPCA_OV534=m
+CONFIG_USB_GSPCA_OV534_9=m
+CONFIG_USB_GSPCA_PAC207=m
+CONFIG_USB_GSPCA_PAC7302=m
+CONFIG_USB_GSPCA_PAC7311=m
+CONFIG_USB_GSPCA_SE401=m
+CONFIG_USB_GSPCA_SN9C2028=m
+CONFIG_USB_GSPCA_SN9C20X=m
+CONFIG_USB_GSPCA_SONIXB=m
+CONFIG_USB_GSPCA_SONIXJ=m
+CONFIG_USB_GSPCA_SPCA500=m
+CONFIG_USB_GSPCA_SPCA501=m
+CONFIG_USB_GSPCA_SPCA505=m
+CONFIG_USB_GSPCA_SPCA506=m
+CONFIG_USB_GSPCA_SPCA508=m
+CONFIG_USB_GSPCA_SPCA561=m
+CONFIG_USB_GSPCA_SPCA1528=m
+CONFIG_USB_GSPCA_SQ905=m
+CONFIG_USB_GSPCA_SQ905C=m
+CONFIG_USB_GSPCA_SQ930X=m
+CONFIG_USB_GSPCA_STK014=m
+CONFIG_USB_GSPCA_STK1135=m
+CONFIG_USB_GSPCA_STV0680=m
+CONFIG_USB_GSPCA_SUNPLUS=m
+CONFIG_USB_GSPCA_T613=m
+CONFIG_USB_GSPCA_TOPRO=m
+CONFIG_USB_GSPCA_TV8532=m
+CONFIG_USB_GSPCA_VC032X=m
+CONFIG_USB_GSPCA_VICAM=m
+CONFIG_USB_GSPCA_XIRLINK_CIT=m
+CONFIG_USB_GSPCA_ZC3XX=m
+CONFIG_USB_PWC=m
+CONFIG_VIDEO_CPIA2=m
+CONFIG_USB_ZR364XX=m
+CONFIG_USB_STKWEBCAM=m
+CONFIG_USB_S2255=m
+CONFIG_VIDEO_USBTV=m
+CONFIG_VIDEO_PVRUSB2=m
+CONFIG_VIDEO_HDPVR=m
+CONFIG_VIDEO_USBVISION=m
+CONFIG_VIDEO_STK1160_COMMON=m
+CONFIG_VIDEO_GO7007=m
+CONFIG_VIDEO_GO7007_USB=m
+CONFIG_VIDEO_GO7007_USB_S2250_BOARD=m
+CONFIG_VIDEO_AU0828=m
+CONFIG_VIDEO_AU0828_RC=y
+CONFIG_VIDEO_CX231XX=m
+CONFIG_VIDEO_CX231XX_ALSA=m
+CONFIG_VIDEO_CX231XX_DVB=m
+CONFIG_VIDEO_TM6000=m
+CONFIG_VIDEO_TM6000_ALSA=m
+CONFIG_VIDEO_TM6000_DVB=m
+CONFIG_DVB_USB=m
+CONFIG_DVB_USB_A800=m
+CONFIG_DVB_USB_DIBUSB_MB=m
+CONFIG_DVB_USB_DIBUSB_MB_FAULTY=y
+CONFIG_DVB_USB_DIBUSB_MC=m
+CONFIG_DVB_USB_DIB0700=m
+CONFIG_DVB_USB_UMT_010=m
+CONFIG_DVB_USB_CXUSB=m
+CONFIG_DVB_USB_M920X=m
+CONFIG_DVB_USB_DIGITV=m
+CONFIG_DVB_USB_VP7045=m
+CONFIG_DVB_USB_VP702X=m
+CONFIG_DVB_USB_GP8PSK=m
+CONFIG_DVB_USB_NOVA_T_USB2=m
+CONFIG_DVB_USB_TTUSB2=m
+CONFIG_DVB_USB_DTT200U=m
+CONFIG_DVB_USB_OPERA1=m
+CONFIG_DVB_USB_AF9005=m
+CONFIG_DVB_USB_AF9005_REMOTE=m
+CONFIG_DVB_USB_PCTV452E=m
+CONFIG_DVB_USB_DW2102=m
+CONFIG_DVB_USB_CINERGY_T2=m
+CONFIG_DVB_USB_DTV5100=m
+CONFIG_DVB_USB_FRIIO=m
+CONFIG_DVB_USB_AZ6027=m
+CONFIG_DVB_USB_TECHNISAT_USB2=m
+CONFIG_DVB_USB_V2=m
+CONFIG_DVB_USB_AF9015=m
+CONFIG_DVB_USB_AF9035=m
+CONFIG_DVB_USB_ANYSEE=m
+CONFIG_DVB_USB_AU6610=m
+CONFIG_DVB_USB_AZ6007=m
+CONFIG_DVB_USB_CE6230=m
+CONFIG_DVB_USB_EC168=m
+CONFIG_DVB_USB_GL861=m
+CONFIG_DVB_USB_LME2510=m
+CONFIG_DVB_USB_MXL111SF=m
+CONFIG_DVB_USB_RTL28XXU=m
+CONFIG_DVB_USB_DVBSKY=m
+CONFIG_SMS_USB_DRV=m
+CONFIG_DVB_B2C2_FLEXCOP_USB=m
+CONFIG_DVB_AS102=m
+CONFIG_VIDEO_EM28XX=m
+CONFIG_VIDEO_EM28XX_V4L2=m
+CONFIG_VIDEO_EM28XX_ALSA=m
+CONFIG_VIDEO_EM28XX_DVB=m
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_RADIO_SI470X=y
+CONFIG_USB_SI470X=m
+CONFIG_I2C_SI470X=m
+CONFIG_RADIO_SI4713=m
+CONFIG_I2C_SI4713=m
+CONFIG_USB_MR800=m
+CONFIG_USB_DSBR=m
+CONFIG_RADIO_SHARK=m
+CONFIG_RADIO_SHARK2=m
+CONFIG_USB_KEENE=m
+CONFIG_USB_MA901=m
+CONFIG_RADIO_TEA5764=m
+CONFIG_RADIO_SAA7706H=m
+CONFIG_RADIO_TEF6862=m
+CONFIG_RADIO_WL1273=m
+CONFIG_RADIO_WL128X=m
+# CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
+CONFIG_VIDEO_UDA1342=m
+CONFIG_VIDEO_SONY_BTF_MPX=m
+CONFIG_VIDEO_TVP5150=m
+CONFIG_VIDEO_TW2804=m
+CONFIG_VIDEO_TW9903=m
+CONFIG_VIDEO_TW9906=m
+CONFIG_VIDEO_OV7640=m
+CONFIG_VIDEO_MT9V011=m
+CONFIG_DRM=m
+CONFIG_DRM_LOAD_EDID_FIRMWARE=y
+CONFIG_DRM_UDL=m
+CONFIG_DRM_PANEL_SIMPLE=m
+CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN=m
+CONFIG_DRM_VC4=m
+CONFIG_DRM_TINYDRM=m
+CONFIG_TINYDRM_MI0283QT=m
+CONFIG_TINYDRM_REPAPER=m
+CONFIG_FB=y
+CONFIG_FB_BCM2708=y
+CONFIG_FB_UDL=m
+CONFIG_FB_SSD1307=m
+CONFIG_FB_RPISENSE=m
+# CONFIG_BACKLIGHT_GENERIC is not set
+CONFIG_BACKLIGHT_RPI=m
+CONFIG_BACKLIGHT_GPIO=m
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_LOGO=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_SOUND=y
+CONFIG_SND=m
+CONFIG_SND_HRTIMER=m
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_DUMMY=m
+CONFIG_SND_ALOOP=m
+CONFIG_SND_VIRMIDI=m
+CONFIG_SND_MTPAV=m
+CONFIG_SND_SERIAL_U16550=m
+CONFIG_SND_MPU401=m
+CONFIG_SND_USB_AUDIO=m
+CONFIG_SND_USB_UA101=m
+CONFIG_SND_USB_CAIAQ=m
+CONFIG_SND_USB_CAIAQ_INPUT=y
+CONFIG_SND_USB_6FIRE=m
+CONFIG_SND_USB_HIFACE=m
+CONFIG_SND_SOC=m
+CONFIG_SND_BCM2835_SOC_I2S=m
+CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP=m
+CONFIG_SND_BCM2708_SOC_RPI_CIRRUS=m
+CONFIG_SND_BCM2708_SOC_RPI_DAC=m
+CONFIG_SND_BCM2708_SOC_RPI_PROTO=m
+CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC=m
+CONFIG_SND_BCM2708_SOC_JUSTBOOM_DIGI=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI=m
+CONFIG_SND_BCM2708_SOC_ADAU1977_ADC=m
+CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD=m
+CONFIG_SND_AUDIOINJECTOR_OCTO_SOUNDCARD=m
+CONFIG_SND_DIGIDAC1_SOUNDCARD=m
+CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO=m
+CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO_V2=m
+CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC=m
+CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC_PLUS=m
+CONFIG_SND_BCM2708_SOC_ALLO_BOSS_DAC=m
+CONFIG_SND_BCM2708_SOC_ALLO_DIGIONE=m
+CONFIG_SND_BCM2708_SOC_ALLO_KATANA_DAC=m
+CONFIG_SND_BCM2708_SOC_FE_PI_AUDIO=m
+CONFIG_SND_PISOUND=m
+CONFIG_SND_SOC_ADAU1701=m
+CONFIG_SND_SOC_ADAU7002=m
+CONFIG_SND_SOC_AK4554=m
+CONFIG_SND_SOC_CS4271_I2C=m
+CONFIG_SND_SOC_SPDIF=m
+CONFIG_SND_SOC_WM8804_I2C=m
+CONFIG_SND_SIMPLE_CARD=m
+CONFIG_HID_BATTERY_STRENGTH=y
+CONFIG_HIDRAW=y
+CONFIG_UHID=m
+CONFIG_HID_A4TECH=m
+CONFIG_HID_ACRUX=m
+CONFIG_HID_APPLE=m
+CONFIG_HID_ASUS=m
+CONFIG_HID_BELKIN=m
+CONFIG_HID_BETOP_FF=m
+CONFIG_HID_CHERRY=m
+CONFIG_HID_CHICONY=m
+CONFIG_HID_CYPRESS=m
+CONFIG_HID_DRAGONRISE=m
+CONFIG_HID_EMS_FF=m
+CONFIG_HID_ELECOM=m
+CONFIG_HID_ELO=m
+CONFIG_HID_EZKEY=m
+CONFIG_HID_GEMBIRD=m
+CONFIG_HID_HOLTEK=m
+CONFIG_HID_KEYTOUCH=m
+CONFIG_HID_KYE=m
+CONFIG_HID_UCLOGIC=m
+CONFIG_HID_WALTOP=m
+CONFIG_HID_GYRATION=m
+CONFIG_HID_TWINHAN=m
+CONFIG_HID_KENSINGTON=m
+CONFIG_HID_LCPOWER=m
+CONFIG_HID_LOGITECH=m
+CONFIG_HID_LOGITECH_DJ=m
+CONFIG_LOGITECH_FF=y
+CONFIG_LOGIRUMBLEPAD2_FF=y
+CONFIG_LOGIG940_FF=y
+CONFIG_HID_MAGICMOUSE=m
+CONFIG_HID_MICROSOFT=m
+CONFIG_HID_MONTEREY=m
+CONFIG_HID_MULTITOUCH=m
+CONFIG_HID_NTRIG=m
+CONFIG_HID_ORTEK=m
+CONFIG_HID_PANTHERLORD=m
+CONFIG_HID_PETALYNX=m
+CONFIG_HID_PICOLCD=m
+CONFIG_HID_ROCCAT=m
+CONFIG_HID_SAMSUNG=m
+CONFIG_HID_SONY=m
+CONFIG_SONY_FF=y
+CONFIG_HID_SPEEDLINK=m
+CONFIG_HID_SUNPLUS=m
+CONFIG_HID_GREENASIA=m
+CONFIG_HID_SMARTJOYPLUS=m
+CONFIG_HID_TOPSEED=m
+CONFIG_HID_THINGM=m
+CONFIG_HID_THRUSTMASTER=m
+CONFIG_HID_WACOM=m
+CONFIG_HID_WIIMOTE=m
+CONFIG_HID_XINMO=m
+CONFIG_HID_ZEROPLUS=m
+CONFIG_HID_ZYDACRON=m
+CONFIG_HID_PID=y
+CONFIG_USB_HIDDEV=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_MON=m
+CONFIG_USB_DWCOTG=y
+CONFIG_USB_PRINTER=m
+CONFIG_USB_STORAGE=y
+CONFIG_USB_STORAGE_REALTEK=m
+CONFIG_USB_STORAGE_DATAFAB=m
+CONFIG_USB_STORAGE_FREECOM=m
+CONFIG_USB_STORAGE_ISD200=m
+CONFIG_USB_STORAGE_USBAT=m
+CONFIG_USB_STORAGE_SDDR09=m
+CONFIG_USB_STORAGE_SDDR55=m
+CONFIG_USB_STORAGE_JUMPSHOT=m
+CONFIG_USB_STORAGE_ALAUDA=m
+CONFIG_USB_STORAGE_ONETOUCH=m
+CONFIG_USB_STORAGE_KARMA=m
+CONFIG_USB_STORAGE_CYPRESS_ATACB=m
+CONFIG_USB_STORAGE_ENE_UB6250=m
+CONFIG_USB_MDC800=m
+CONFIG_USB_MICROTEK=m
+CONFIG_USBIP_CORE=m
+CONFIG_USBIP_VHCI_HCD=m
+CONFIG_USBIP_HOST=m
+CONFIG_USB_DWC2=m
+CONFIG_USB_SERIAL=m
+CONFIG_USB_SERIAL_GENERIC=y
+CONFIG_USB_SERIAL_AIRCABLE=m
+CONFIG_USB_SERIAL_ARK3116=m
+CONFIG_USB_SERIAL_BELKIN=m
+CONFIG_USB_SERIAL_CH341=m
+CONFIG_USB_SERIAL_WHITEHEAT=m
+CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
+CONFIG_USB_SERIAL_CP210X=m
+CONFIG_USB_SERIAL_CYPRESS_M8=m
+CONFIG_USB_SERIAL_EMPEG=m
+CONFIG_USB_SERIAL_FTDI_SIO=m
+CONFIG_USB_SERIAL_VISOR=m
+CONFIG_USB_SERIAL_IPAQ=m
+CONFIG_USB_SERIAL_IR=m
+CONFIG_USB_SERIAL_EDGEPORT=m
+CONFIG_USB_SERIAL_EDGEPORT_TI=m
+CONFIG_USB_SERIAL_F81232=m
+CONFIG_USB_SERIAL_GARMIN=m
+CONFIG_USB_SERIAL_IPW=m
+CONFIG_USB_SERIAL_IUU=m
+CONFIG_USB_SERIAL_KEYSPAN_PDA=m
+CONFIG_USB_SERIAL_KEYSPAN=m
+CONFIG_USB_SERIAL_KLSI=m
+CONFIG_USB_SERIAL_KOBIL_SCT=m
+CONFIG_USB_SERIAL_MCT_U232=m
+CONFIG_USB_SERIAL_METRO=m
+CONFIG_USB_SERIAL_MOS7720=m
+CONFIG_USB_SERIAL_MOS7840=m
+CONFIG_USB_SERIAL_NAVMAN=m
+CONFIG_USB_SERIAL_PL2303=m
+CONFIG_USB_SERIAL_OTI6858=m
+CONFIG_USB_SERIAL_QCAUX=m
+CONFIG_USB_SERIAL_QUALCOMM=m
+CONFIG_USB_SERIAL_SPCP8X5=m
+CONFIG_USB_SERIAL_SAFE=m
+CONFIG_USB_SERIAL_SIERRAWIRELESS=m
+CONFIG_USB_SERIAL_SYMBOL=m
+CONFIG_USB_SERIAL_TI=m
+CONFIG_USB_SERIAL_CYBERJACK=m
+CONFIG_USB_SERIAL_XIRCOM=m
+CONFIG_USB_SERIAL_OPTION=m
+CONFIG_USB_SERIAL_OMNINET=m
+CONFIG_USB_SERIAL_OPTICON=m
+CONFIG_USB_SERIAL_XSENS_MT=m
+CONFIG_USB_SERIAL_WISHBONE=m
+CONFIG_USB_SERIAL_SSU100=m
+CONFIG_USB_SERIAL_QT2=m
+CONFIG_USB_SERIAL_DEBUG=m
+CONFIG_USB_EMI62=m
+CONFIG_USB_EMI26=m
+CONFIG_USB_ADUTUX=m
+CONFIG_USB_SEVSEG=m
+CONFIG_USB_RIO500=m
+CONFIG_USB_LEGOTOWER=m
+CONFIG_USB_LCD=m
+CONFIG_USB_CYPRESS_CY7C63=m
+CONFIG_USB_CYTHERM=m
+CONFIG_USB_IDMOUSE=m
+CONFIG_USB_FTDI_ELAN=m
+CONFIG_USB_APPLEDISPLAY=m
+CONFIG_USB_LD=m
+CONFIG_USB_TRANCEVIBRATOR=m
+CONFIG_USB_IOWARRIOR=m
+CONFIG_USB_TEST=m
+CONFIG_USB_ISIGHTFW=m
+CONFIG_USB_YUREX=m
+CONFIG_USB_ATM=m
+CONFIG_USB_SPEEDTOUCH=m
+CONFIG_USB_CXACRU=m
+CONFIG_USB_UEAGLEATM=m
+CONFIG_USB_XUSBATM=m
+CONFIG_USB_GADGET=m
+CONFIG_USB_ZERO=m
+CONFIG_USB_AUDIO=m
+CONFIG_USB_ETH=m
+CONFIG_USB_GADGETFS=m
+CONFIG_USB_MASS_STORAGE=m
+CONFIG_USB_G_SERIAL=m
+CONFIG_USB_MIDI_GADGET=m
+CONFIG_USB_G_PRINTER=m
+CONFIG_USB_CDC_COMPOSITE=m
+CONFIG_USB_G_ACM_MS=m
+CONFIG_USB_G_MULTI=m
+CONFIG_USB_G_HID=m
+CONFIG_USB_G_WEBCAM=m
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_BCM2835_MMC=y
+CONFIG_MMC_BCM2835_DMA=y
+CONFIG_MMC_BCM2835_SDHOST=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SPI=m
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_ONESHOT=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_BACKLIGHT=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_GPIO=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+CONFIG_LEDS_TRIGGER_TRANSIENT=m
+CONFIG_LEDS_TRIGGER_CAMERA=m
+CONFIG_LEDS_TRIGGER_INPUT=y
+CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_HCTOSYS is not set
+CONFIG_RTC_DRV_ABX80X=m
+CONFIG_RTC_DRV_DS1307=m
+CONFIG_RTC_DRV_DS1374=m
+CONFIG_RTC_DRV_DS1672=m
+CONFIG_RTC_DRV_MAX6900=m
+CONFIG_RTC_DRV_RS5C372=m
+CONFIG_RTC_DRV_ISL1208=m
+CONFIG_RTC_DRV_ISL12022=m
+CONFIG_RTC_DRV_X1205=m
+CONFIG_RTC_DRV_PCF8523=m
+CONFIG_RTC_DRV_PCF8563=m
+CONFIG_RTC_DRV_PCF8583=m
+CONFIG_RTC_DRV_M41T80=m
+CONFIG_RTC_DRV_BQ32K=m
+CONFIG_RTC_DRV_S35390A=m
+CONFIG_RTC_DRV_FM3130=m
+CONFIG_RTC_DRV_RX8581=m
+CONFIG_RTC_DRV_RX8025=m
+CONFIG_RTC_DRV_EM3027=m
+CONFIG_RTC_DRV_M41T93=m
+CONFIG_RTC_DRV_M41T94=m
+CONFIG_RTC_DRV_DS1302=m
+CONFIG_RTC_DRV_DS1305=m
+CONFIG_RTC_DRV_DS1390=m
+CONFIG_RTC_DRV_R9701=m
+CONFIG_RTC_DRV_RX4581=m
+CONFIG_RTC_DRV_RS5C348=m
+CONFIG_RTC_DRV_MAX6902=m
+CONFIG_RTC_DRV_PCF2123=m
+CONFIG_RTC_DRV_DS3232=m
+CONFIG_RTC_DRV_PCF2127=m
+CONFIG_RTC_DRV_RV3029C2=m
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2835=y
+CONFIG_DMA_BCM2708=y
+CONFIG_UIO=m
+CONFIG_UIO_PDRV_GENIRQ=m
+CONFIG_STAGING=y
+CONFIG_IRDA=m
+CONFIG_IRLAN=m
+CONFIG_IRNET=m
+CONFIG_IRCOMM=m
+CONFIG_IRDA_ULTRA=y
+CONFIG_IRDA_CACHE_LAST_LSAP=y
+CONFIG_IRDA_FAST_RR=y
+CONFIG_IRTTY_SIR=m
+CONFIG_KINGSUN_DONGLE=m
+CONFIG_KSDAZZLE_DONGLE=m
+CONFIG_KS959_DONGLE=m
+CONFIG_USB_IRDA=m
+CONFIG_SIGMATEL_FIR=m
+CONFIG_MCS_FIR=m
+CONFIG_PRISM2_USB=m
+CONFIG_R8712U=m
+CONFIG_R8188EU=m
+CONFIG_VT6656=m
+CONFIG_SPEAKUP=m
+CONFIG_SPEAKUP_SYNTH_SOFT=m
+CONFIG_STAGING_MEDIA=y
+CONFIG_LIRC_STAGING=y
+CONFIG_LIRC_RPI=m
+CONFIG_FB_TFT=m
+CONFIG_FB_TFT_AGM1264K_FL=m
+CONFIG_FB_TFT_BD663474=m
+CONFIG_FB_TFT_HX8340BN=m
+CONFIG_FB_TFT_HX8347D=m
+CONFIG_FB_TFT_HX8353D=m
+CONFIG_FB_TFT_HX8357D=m
+CONFIG_FB_TFT_ILI9163=m
+CONFIG_FB_TFT_ILI9320=m
+CONFIG_FB_TFT_ILI9325=m
+CONFIG_FB_TFT_ILI9340=m
+CONFIG_FB_TFT_ILI9341=m
+CONFIG_FB_TFT_ILI9481=m
+CONFIG_FB_TFT_ILI9486=m
+CONFIG_FB_TFT_PCD8544=m
+CONFIG_FB_TFT_RA8875=m
+CONFIG_FB_TFT_S6D02A1=m
+CONFIG_FB_TFT_S6D1121=m
+CONFIG_FB_TFT_SSD1289=m
+CONFIG_FB_TFT_SSD1306=m
+CONFIG_FB_TFT_SSD1331=m
+CONFIG_FB_TFT_SSD1351=m
+CONFIG_FB_TFT_ST7735R=m
+CONFIG_FB_TFT_ST7789V=m
+CONFIG_FB_TFT_TINYLCD=m
+CONFIG_FB_TFT_TLS8204=m
+CONFIG_FB_TFT_UC1701=m
+CONFIG_FB_TFT_UPD161704=m
+CONFIG_FB_TFT_WATTEROTT=m
+CONFIG_FB_FLEX=m
+CONFIG_FB_TFT_FBTFT_DEVICE=m
+CONFIG_BCM2835_VCHIQ=y
+CONFIG_BCM2835_VCHIQ_SUPPORT_MEMDUMP=y
+CONFIG_SND_BCM2835=m
+CONFIG_VIDEO_BCM2835=m
+CONFIG_MAILBOX=y
+CONFIG_BCM2835_MBOX=y
+# CONFIG_IOMMU_SUPPORT is not set
+CONFIG_RASPBERRYPI_POWER=y
+CONFIG_EXTCON=m
+CONFIG_EXTCON_ARIZONA=m
+CONFIG_IIO=m
+CONFIG_IIO_BUFFER_CB=m
+CONFIG_MCP320X=m
+CONFIG_MCP3422=m
+CONFIG_DHT11=m
+CONFIG_HDC100X=m
+CONFIG_HTU21=m
+CONFIG_INV_MPU6050_I2C=m
+CONFIG_TSL4531=m
+CONFIG_VEML6070=m
+CONFIG_BMP280=m
+CONFIG_PWM_BCM2835=m
+CONFIG_PWM_PCA9685=m
+CONFIG_RPI_AXIPERF=m
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_REISERFS_FS=m
+CONFIG_REISERFS_FS_XATTR=y
+CONFIG_REISERFS_FS_POSIX_ACL=y
+CONFIG_REISERFS_FS_SECURITY=y
+CONFIG_JFS_FS=m
+CONFIG_JFS_POSIX_ACL=y
+CONFIG_JFS_SECURITY=y
+CONFIG_JFS_STATISTICS=y
+CONFIG_XFS_FS=m
+CONFIG_XFS_QUOTA=y
+CONFIG_XFS_POSIX_ACL=y
+CONFIG_XFS_RT=y
+CONFIG_GFS2_FS=m
+CONFIG_OCFS2_FS=m
+CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_NILFS2_FS=m
+CONFIG_F2FS_FS=y
+CONFIG_FANOTIFY=y
+CONFIG_QFMT_V1=m
+CONFIG_QFMT_V2=m
+CONFIG_AUTOFS4_FS=y
+CONFIG_FUSE_FS=m
+CONFIG_CUSE=m
+CONFIG_OVERLAY_FS=m
+CONFIG_FSCACHE=y
+CONFIG_FSCACHE_STATS=y
+CONFIG_FSCACHE_HISTOGRAM=y
+CONFIG_CACHEFILES=y
+CONFIG_ISO9660_FS=m
+CONFIG_JOLIET=y
+CONFIG_ZISOFS=y
+CONFIG_UDF_FS=m
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_FAT_DEFAULT_IOCHARSET="ascii"
+CONFIG_NTFS_FS=m
+CONFIG_NTFS_RW=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_ECRYPT_FS=m
+CONFIG_HFS_FS=m
+CONFIG_HFSPLUS_FS=m
+CONFIG_JFFS2_FS=m
+CONFIG_JFFS2_SUMMARY=y
+CONFIG_UBIFS_FS=m
+CONFIG_SQUASHFS=m
+CONFIG_SQUASHFS_XATTR=y
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_SWAP=y
+CONFIG_NFS_V4_1=y
+CONFIG_ROOT_NFS=y
+CONFIG_NFS_FSCACHE=y
+CONFIG_NFSD=m
+CONFIG_NFSD_V3_ACL=y
+CONFIG_NFSD_V4=y
+CONFIG_CIFS=m
+CONFIG_CIFS_WEAK_PW_HASH=y
+CONFIG_CIFS_UPCALL=y
+CONFIG_CIFS_XATTR=y
+CONFIG_CIFS_POSIX=y
+CONFIG_CIFS_ACL=y
+CONFIG_CIFS_DFS_UPCALL=y
+CONFIG_CIFS_FSCACHE=y
+CONFIG_9P_FS=m
+CONFIG_9P_FS_POSIX_ACL=y
+CONFIG_NLS_DEFAULT="utf8"
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_CODEPAGE_737=m
+CONFIG_NLS_CODEPAGE_775=m
+CONFIG_NLS_CODEPAGE_850=m
+CONFIG_NLS_CODEPAGE_852=m
+CONFIG_NLS_CODEPAGE_855=m
+CONFIG_NLS_CODEPAGE_857=m
+CONFIG_NLS_CODEPAGE_860=m
+CONFIG_NLS_CODEPAGE_861=m
+CONFIG_NLS_CODEPAGE_862=m
+CONFIG_NLS_CODEPAGE_863=m
+CONFIG_NLS_CODEPAGE_864=m
+CONFIG_NLS_CODEPAGE_865=m
+CONFIG_NLS_CODEPAGE_866=m
+CONFIG_NLS_CODEPAGE_869=m
+CONFIG_NLS_CODEPAGE_936=m
+CONFIG_NLS_CODEPAGE_950=m
+CONFIG_NLS_CODEPAGE_932=m
+CONFIG_NLS_CODEPAGE_949=m
+CONFIG_NLS_CODEPAGE_874=m
+CONFIG_NLS_ISO8859_8=m
+CONFIG_NLS_CODEPAGE_1250=m
+CONFIG_NLS_CODEPAGE_1251=m
+CONFIG_NLS_ASCII=y
+CONFIG_NLS_ISO8859_1=m
+CONFIG_NLS_ISO8859_2=m
+CONFIG_NLS_ISO8859_3=m
+CONFIG_NLS_ISO8859_4=m
+CONFIG_NLS_ISO8859_5=m
+CONFIG_NLS_ISO8859_6=m
+CONFIG_NLS_ISO8859_7=m
+CONFIG_NLS_ISO8859_9=m
+CONFIG_NLS_ISO8859_13=m
+CONFIG_NLS_ISO8859_14=m
+CONFIG_NLS_ISO8859_15=m
+CONFIG_NLS_KOI8_R=m
+CONFIG_NLS_KOI8_U=m
+CONFIG_DLM=m
+CONFIG_PRINTK_TIME=y
+CONFIG_BOOT_PRINTK_DELAY=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_LATENCYTOP=y
+CONFIG_IRQSOFF_TRACER=y
+CONFIG_SCHED_TRACER=y
+CONFIG_STACK_TRACER=y
+CONFIG_BLK_DEV_IO_TRACE=y
+# CONFIG_UPROBE_EVENTS is not set
+CONFIG_FUNCTION_PROFILER=y
+CONFIG_KGDB=y
+CONFIG_KGDB_KDB=y
+CONFIG_KDB_KEYBOARD=y
+CONFIG_CRYPTO_USER=m
+CONFIG_CRYPTO_CRYPTD=m
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CTS=m
+CONFIG_CRYPTO_XTS=m
+CONFIG_CRYPTO_XCBC=m
+CONFIG_CRYPTO_SHA512=m
+CONFIG_CRYPTO_TGR192=m
+CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_CAST5=m
+CONFIG_CRYPTO_DES=y
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_USER_API_SKCIPHER=m
+# CONFIG_CRYPTO_HW is not set
+CONFIG_ARM_CRYPTO=y
+CONFIG_CRYPTO_SHA1_ARM=m
+CONFIG_CRYPTO_AES_ARM=m
+CONFIG_CRC_ITU_T=y
+CONFIG_LIBCRC32C=y
diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
index 74504b154256..8ccb358b7043 100644
--- a/arch/arm/include/asm/cacheflush.h
+++ b/arch/arm/include/asm/cacheflush.h
@@ -94,6 +94,21 @@
  *	DMA Cache Coherency
  *	===================
  *
+ *	dma_inv_range(start, end)
+ *
+ *		Invalidate (discard) the specified virtual address range.
+ *		May not write back any entries.  If 'start' or 'end'
+ *		are not cache line aligned, those lines must be written
+ *		back.
+ *		- start  - virtual start address
+ *		- end    - virtual end address
+ *
+ *	dma_clean_range(start, end)
+ *
+ *		Clean (write back) the specified virtual address range.
+ *		- start  - virtual start address
+ *		- end    - virtual end address
+ *
  *	dma_flush_range(start, end)
  *
  *		Clean and invalidate the specified virtual address range.
@@ -115,6 +130,8 @@ struct cpu_cache_fns {
 	void (*dma_map_area)(const void *, size_t, int);
 	void (*dma_unmap_area)(const void *, size_t, int);
 
+	void (*dma_inv_range)(const void *, const void *);
+	void (*dma_clean_range)(const void *, const void *);
 	void (*dma_flush_range)(const void *, const void *);
 } __no_randomize_layout;
 
@@ -140,6 +157,8 @@ extern struct cpu_cache_fns cpu_cache;
  * is visible to DMA, or data written by DMA to system memory is
  * visible to the CPU.
  */
+#define dmac_inv_range			cpu_cache.dma_inv_range
+#define dmac_clean_range		cpu_cache.dma_clean_range
 #define dmac_flush_range		cpu_cache.dma_flush_range
 
 #else
@@ -159,6 +178,8 @@ extern void __cpuc_flush_dcache_area(void *, size_t);
  * is visible to DMA, or data written by DMA to system memory is
  * visible to the CPU.
  */
+extern void dmac_inv_range(const void *, const void *);
+extern void dmac_clean_range(const void *, const void *);
 extern void dmac_flush_range(const void *, const void *);
 
 #endif
diff --git a/arch/arm/include/asm/glue-cache.h b/arch/arm/include/asm/glue-cache.h
index 01c3d92624e5..99f29f1963ae 100644
--- a/arch/arm/include/asm/glue-cache.h
+++ b/arch/arm/include/asm/glue-cache.h
@@ -154,6 +154,8 @@ static inline void nop_dma_unmap_area(const void *s, size_t l, int f) { }
 #define __cpuc_coherent_user_range	__glue(_CACHE,_coherent_user_range)
 #define __cpuc_flush_dcache_area	__glue(_CACHE,_flush_kern_dcache_area)
 
+#define dmac_inv_range			__glue(_CACHE,_dma_inv_range)
+#define dmac_clean_range		__glue(_CACHE,_dma_clean_range)
 #define dmac_flush_range		__glue(_CACHE,_dma_flush_range)
 #endif
 
diff --git a/arch/arm/include/asm/irqflags.h b/arch/arm/include/asm/irqflags.h
index aeec7f24eb75..a3b186608c60 100644
--- a/arch/arm/include/asm/irqflags.h
+++ b/arch/arm/include/asm/irqflags.h
@@ -163,13 +163,23 @@ static inline unsigned long arch_local_save_flags(void)
 }
 
 /*
- * restore saved IRQ & FIQ state
+ * restore saved IRQ state
  */
 #define arch_local_irq_restore arch_local_irq_restore
 static inline void arch_local_irq_restore(unsigned long flags)
 {
-	asm volatile(
-		"	msr	" IRQMASK_REG_NAME_W ", %0	@ local_irq_restore"
+	unsigned long temp = 0;
+	flags &= ~(1 << 6);
+	asm volatile (
+		" mrs %0, cpsr"
+		: "=r" (temp)
+		:
+		: "memory", "cc");
+		/* Preserve FIQ bit */
+		temp &= (1 << 6);
+		flags = flags | temp;
+	asm volatile (
+		"    msr    cpsr_c, %0    @ local_irq_restore"
 		:
 		: "r" (flags)
 		: "memory", "cc");
diff --git a/arch/arm/include/asm/string.h b/arch/arm/include/asm/string.h
index f54a3136aac6..a6c0004c4dcd 100644
--- a/arch/arm/include/asm/string.h
+++ b/arch/arm/include/asm/string.h
@@ -39,6 +39,11 @@ static inline void *memset64(uint64_t *p, uint64_t v, __kernel_size_t n)
 	return __memset64(p, v, n * 8, v >> 32);
 }
 
+#ifdef CONFIG_BCM2835_FAST_MEMCPY
+#define __HAVE_ARCH_MEMCMP
+extern int memcmp(const void *, const void *, size_t);
+#endif
+
 extern void __memzero(void *ptr, __kernel_size_t n);
 
 #define memset(p,v,n)							\
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index 0bf2347495f1..6c7927ab1a47 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -447,6 +447,9 @@ do {									\
 extern unsigned long __must_check
 arm_copy_from_user(void *to, const void __user *from, unsigned long n);
 
+extern unsigned long __must_check
+__copy_from_user_std(void *to, const void __user *from, unsigned long n);
+
 static inline unsigned long __must_check
 raw_copy_from_user(void *to, const void __user *from, unsigned long n)
 {
diff --git a/arch/arm/kernel/fiqasm.S b/arch/arm/kernel/fiqasm.S
index 8dd26e1a9bd6..eef484756af2 100644
--- a/arch/arm/kernel/fiqasm.S
+++ b/arch/arm/kernel/fiqasm.S
@@ -47,3 +47,7 @@ ENTRY(__get_fiq_regs)
 	mov	r0, r0		@ avoid hazard prior to ARMv4
 	ret	lr
 ENDPROC(__get_fiq_regs)
+
+ENTRY(__FIQ_Branch)
+	mov pc, r8
+ENDPROC(__FIQ_Branch)
diff --git a/arch/arm/kernel/reboot.c b/arch/arm/kernel/reboot.c
index 3b2aa9a9fe26..0180d89a34af 100644
--- a/arch/arm/kernel/reboot.c
+++ b/arch/arm/kernel/reboot.c
@@ -105,9 +105,7 @@ void machine_shutdown(void)
  */
 void machine_halt(void)
 {
-	local_irq_disable();
-	smp_send_stop();
-	while (1);
+	machine_power_off();
 }
 
 /*
diff --git a/arch/arm/lib/Makefile b/arch/arm/lib/Makefile
index 4cb0b9624d8f..6759bed32756 100644
--- a/arch/arm/lib/Makefile
+++ b/arch/arm/lib/Makefile
@@ -7,9 +7,8 @@
 
 lib-y		:= backtrace.o changebit.o csumipv6.o csumpartial.o   \
 		   csumpartialcopy.o csumpartialcopyuser.o clearbit.o \
-		   delay.o delay-loop.o findbit.o memchr.o memcpy.o   \
-		   memmove.o memset.o memzero.o setbit.o              \
-		   strchr.o strrchr.o                                 \
+		   delay.o delay-loop.o findbit.o memchr.o memzero.o  \
+		   setbit.o strchr.o strrchr.o                        \
 		   testchangebit.o testclearbit.o testsetbit.o        \
 		   ashldi3.o ashrdi3.o lshrdi3.o muldi3.o             \
 		   ucmpdi2.o lib1funcs.o div64.o                      \
@@ -19,6 +18,16 @@ lib-y		:= backtrace.o changebit.o csumipv6.o csumpartial.o   \
 mmu-y		:= clear_user.o copy_page.o getuser.o putuser.o       \
 		   copy_from_user.o copy_to_user.o
 
+# Choose optimised implementations for Raspberry Pi
+ifeq ($(CONFIG_BCM2835_FAST_MEMCPY),y)
+  CFLAGS_uaccess_with_memcpy.o += -DCOPY_FROM_USER_THRESHOLD=1600
+  CFLAGS_uaccess_with_memcpy.o += -DCOPY_TO_USER_THRESHOLD=672
+  obj-$(CONFIG_MODULES) += exports_rpi.o
+  lib-y        += memcpy_rpi.o memmove_rpi.o memset_rpi.o memcmp_rpi.o
+else
+  lib-y        += memcpy.o memmove.o memset.o
+endif
+
 # using lib_ here won't override already available weak symbols
 obj-$(CONFIG_UACCESS_WITH_MEMCPY) += uaccess_with_memcpy.o
 
diff --git a/arch/arm/lib/arm-mem.h b/arch/arm/lib/arm-mem.h
new file mode 100644
index 000000000000..5d4bda19ad20
--- /dev/null
+++ b/arch/arm/lib/arm-mem.h
@@ -0,0 +1,159 @@
+/*
+Copyright (c) 2013, Raspberry Pi Foundation
+Copyright (c) 2013, RISC OS Open Ltd
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of the copyright holder nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+.macro myfunc fname
+ .func fname
+ .global fname
+fname:
+.endm
+
+.macro preload_leading_step1  backwards, ptr, base
+/* If the destination is already 16-byte aligned, then we need to preload
+ * between 0 and prefetch_distance (inclusive) cache lines ahead so there
+ * are no gaps when the inner loop starts.
+ */
+ .if backwards
+        sub     ptr, base, #1
+        bic     ptr, ptr, #31
+ .else
+        bic     ptr, base, #31
+ .endif
+ .set OFFSET, 0
+ .rept prefetch_distance+1
+        pld     [ptr, #OFFSET]
+  .if backwards
+   .set OFFSET, OFFSET-32
+  .else
+   .set OFFSET, OFFSET+32
+  .endif
+ .endr
+.endm
+
+.macro preload_leading_step2  backwards, ptr, base, leading_bytes, tmp
+/* However, if the destination is not 16-byte aligned, we may need to
+ * preload one more cache line than that. The question we need to ask is:
+ * are the leading bytes more than the amount by which the source
+ * pointer will be rounded down for preloading, and if so, by how many
+ * cache lines?
+ */
+ .if backwards
+/* Here we compare against how many bytes we are into the
+ * cache line, counting down from the highest such address.
+ * Effectively, we want to calculate
+ *     leading_bytes = dst&15
+ *     cacheline_offset = 31-((src-leading_bytes-1)&31)
+ *     extra_needed = leading_bytes - cacheline_offset
+ * and test if extra_needed is <= 0, or rearranging:
+ *     leading_bytes + (src-leading_bytes-1)&31 <= 31
+ */
+        mov     tmp, base, lsl #32-5
+        sbc     tmp, tmp, leading_bytes, lsl #32-5
+        adds    tmp, tmp, leading_bytes, lsl #32-5
+        bcc     61f
+        pld     [ptr, #-32*(prefetch_distance+1)]
+ .else
+/* Effectively, we want to calculate
+ *     leading_bytes = (-dst)&15
+ *     cacheline_offset = (src+leading_bytes)&31
+ *     extra_needed = leading_bytes - cacheline_offset
+ * and test if extra_needed is <= 0.
+ */
+        mov     tmp, base, lsl #32-5
+        add     tmp, tmp, leading_bytes, lsl #32-5
+        rsbs    tmp, tmp, leading_bytes, lsl #32-5
+        bls     61f
+        pld     [ptr, #32*(prefetch_distance+1)]
+ .endif
+61:
+.endm
+
+.macro preload_trailing  backwards, base, remain, tmp
+        /* We need either 0, 1 or 2 extra preloads */
+ .if backwards
+        rsb     tmp, base, #0
+        mov     tmp, tmp, lsl #32-5
+ .else
+        mov     tmp, base, lsl #32-5
+ .endif
+        adds    tmp, tmp, remain, lsl #32-5
+        adceqs  tmp, tmp, #0
+        /* The instruction above has two effects: ensures Z is only
+         * set if C was clear (so Z indicates that both shifted quantities
+         * were 0), and clears C if Z was set (so C indicates that the sum
+         * of the shifted quantities was greater and not equal to 32) */
+        beq     82f
+ .if backwards
+        sub     tmp, base, #1
+        bic     tmp, tmp, #31
+ .else
+        bic     tmp, base, #31
+ .endif
+        bcc     81f
+ .if backwards
+        pld     [tmp, #-32*(prefetch_distance+1)]
+81:
+        pld     [tmp, #-32*prefetch_distance]
+ .else
+        pld     [tmp, #32*(prefetch_distance+2)]
+81:
+        pld     [tmp, #32*(prefetch_distance+1)]
+ .endif
+82:
+.endm
+
+.macro preload_all    backwards, narrow_case, shift, base, remain, tmp0, tmp1
+ .if backwards
+        sub     tmp0, base, #1
+        bic     tmp0, tmp0, #31
+        pld     [tmp0]
+        sub     tmp1, base, remain, lsl #shift
+ .else
+        bic     tmp0, base, #31
+        pld     [tmp0]
+        add     tmp1, base, remain, lsl #shift
+        sub     tmp1, tmp1, #1
+ .endif
+        bic     tmp1, tmp1, #31
+        cmp     tmp1, tmp0
+        beq     92f
+ .if narrow_case
+        /* In this case, all the data fits in either 1 or 2 cache lines */
+        pld     [tmp1]
+ .else
+91:
+  .if backwards
+        sub     tmp0, tmp0, #32
+  .else
+        add     tmp0, tmp0, #32
+  .endif
+        cmp     tmp0, tmp1
+        pld     [tmp0]
+        bne     91b
+ .endif
+92:
+.endm
diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
index 7a4b06049001..fb40a1b3a5b7 100644
--- a/arch/arm/lib/copy_from_user.S
+++ b/arch/arm/lib/copy_from_user.S
@@ -89,11 +89,13 @@
 
 	.text
 
-ENTRY(arm_copy_from_user)
+ENTRY(__copy_from_user_std)
+WEAK(arm_copy_from_user)
 
 #include "copy_template.S"
 
 ENDPROC(arm_copy_from_user)
+ENDPROC(__copy_from_user_std)
 
 	.pushsection .fixup,"ax"
 	.align 0
diff --git a/arch/arm/lib/exports_rpi.c b/arch/arm/lib/exports_rpi.c
new file mode 100644
index 000000000000..1f826047db75
--- /dev/null
+++ b/arch/arm/lib/exports_rpi.c
@@ -0,0 +1,37 @@
+/**
+ * Copyright (c) 2014, Raspberry Pi (Trading) Ltd.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2, as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+
+EXPORT_SYMBOL(memcmp);
diff --git a/arch/arm/lib/memcmp_rpi.S b/arch/arm/lib/memcmp_rpi.S
new file mode 100644
index 000000000000..bf6e4edfc9d3
--- /dev/null
+++ b/arch/arm/lib/memcmp_rpi.S
@@ -0,0 +1,285 @@
+/*
+Copyright (c) 2013, Raspberry Pi Foundation
+Copyright (c) 2013, RISC OS Open Ltd
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of the copyright holder nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include <linux/linkage.h>
+#include "arm-mem.h"
+
+/* Prevent the stack from becoming executable */
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
+
+    .text
+    .arch armv6
+    .object_arch armv4
+    .arm
+    .altmacro
+    .p2align 2
+
+.macro memcmp_process_head  unaligned
+ .if unaligned
+        ldr     DAT0, [S_1], #4
+        ldr     DAT1, [S_1], #4
+        ldr     DAT2, [S_1], #4
+        ldr     DAT3, [S_1], #4
+ .else
+        ldmia   S_1!, {DAT0, DAT1, DAT2, DAT3}
+ .endif
+        ldmia   S_2!, {DAT4, DAT5, DAT6, DAT7}
+.endm
+
+.macro memcmp_process_tail
+        cmp     DAT0, DAT4
+        cmpeq   DAT1, DAT5
+        cmpeq   DAT2, DAT6
+        cmpeq   DAT3, DAT7
+        bne     200f
+.endm
+
+.macro memcmp_leading_31bytes
+        movs    DAT0, OFF, lsl #31
+        ldrmib  DAT0, [S_1], #1
+        ldrcsh  DAT1, [S_1], #2
+        ldrmib  DAT4, [S_2], #1
+        ldrcsh  DAT5, [S_2], #2
+        movpl   DAT0, #0
+        movcc   DAT1, #0
+        movpl   DAT4, #0
+        movcc   DAT5, #0
+        submi   N, N, #1
+        subcs   N, N, #2
+        cmp     DAT0, DAT4
+        cmpeq   DAT1, DAT5
+        bne     200f
+        movs    DAT0, OFF, lsl #29
+        ldrmi   DAT0, [S_1], #4
+        ldrcs   DAT1, [S_1], #4
+        ldrcs   DAT2, [S_1], #4
+        ldrmi   DAT4, [S_2], #4
+        ldmcsia S_2!, {DAT5, DAT6}
+        movpl   DAT0, #0
+        movcc   DAT1, #0
+        movcc   DAT2, #0
+        movpl   DAT4, #0
+        movcc   DAT5, #0
+        movcc   DAT6, #0
+        submi   N, N, #4
+        subcs   N, N, #8
+        cmp     DAT0, DAT4
+        cmpeq   DAT1, DAT5
+        cmpeq   DAT2, DAT6
+        bne     200f
+        tst     OFF, #16
+        beq     105f
+        memcmp_process_head  1
+        sub     N, N, #16
+        memcmp_process_tail
+105:
+.endm
+
+.macro memcmp_trailing_15bytes  unaligned
+        movs    N, N, lsl #29
+ .if unaligned
+        ldrcs   DAT0, [S_1], #4
+        ldrcs   DAT1, [S_1], #4
+ .else
+        ldmcsia S_1!, {DAT0, DAT1}
+ .endif
+        ldrmi   DAT2, [S_1], #4
+        ldmcsia S_2!, {DAT4, DAT5}
+        ldrmi   DAT6, [S_2], #4
+        movcc   DAT0, #0
+        movcc   DAT1, #0
+        movpl   DAT2, #0
+        movcc   DAT4, #0
+        movcc   DAT5, #0
+        movpl   DAT6, #0
+        cmp     DAT0, DAT4
+        cmpeq   DAT1, DAT5
+        cmpeq   DAT2, DAT6
+        bne     200f
+        movs    N, N, lsl #2
+        ldrcsh  DAT0, [S_1], #2
+        ldrmib  DAT1, [S_1]
+        ldrcsh  DAT4, [S_2], #2
+        ldrmib  DAT5, [S_2]
+        movcc   DAT0, #0
+        movpl   DAT1, #0
+        movcc   DAT4, #0
+        movpl   DAT5, #0
+        cmp     DAT0, DAT4
+        cmpeq   DAT1, DAT5
+        bne     200f
+.endm
+
+.macro memcmp_long_inner_loop  unaligned
+110:
+        memcmp_process_head  unaligned
+        pld     [S_2, #prefetch_distance*32 + 16]
+        memcmp_process_tail
+        memcmp_process_head  unaligned
+        pld     [S_1, OFF]
+        memcmp_process_tail
+        subs    N, N, #32
+        bhs     110b
+        /* Just before the final (prefetch_distance+1) 32-byte blocks,
+         * deal with final preloads */
+        preload_trailing  0, S_1, N, DAT0
+        preload_trailing  0, S_2, N, DAT0
+        add     N, N, #(prefetch_distance+2)*32 - 16
+120:
+        memcmp_process_head  unaligned
+        memcmp_process_tail
+        subs    N, N, #16
+        bhs     120b
+        /* Trailing words and bytes */
+        tst     N, #15
+        beq     199f
+        memcmp_trailing_15bytes  unaligned
+199:    /* Reached end without detecting a difference */
+        mov     a1, #0
+        setend  le
+        pop     {DAT1-DAT6, pc}
+.endm
+
+.macro memcmp_short_inner_loop  unaligned
+        subs    N, N, #16     /* simplifies inner loop termination */
+        blo     122f
+120:
+        memcmp_process_head  unaligned
+        memcmp_process_tail
+        subs    N, N, #16
+        bhs     120b
+122:    /* Trailing words and bytes */
+        tst     N, #15
+        beq     199f
+        memcmp_trailing_15bytes  unaligned
+199:    /* Reached end without detecting a difference */
+        mov     a1, #0
+        setend  le
+        pop     {DAT1-DAT6, pc}
+.endm
+
+/*
+ * int memcmp(const void *s1, const void *s2, size_t n);
+ * On entry:
+ * a1 = pointer to buffer 1
+ * a2 = pointer to buffer 2
+ * a3 = number of bytes to compare (as unsigned chars)
+ * On exit:
+ * a1 = >0/=0/<0 if s1 >/=/< s2
+ */
+
+.set prefetch_distance, 2
+
+ENTRY(memcmp)
+        S_1     .req    a1
+        S_2     .req    a2
+        N       .req    a3
+        DAT0    .req    a4
+        DAT1    .req    v1
+        DAT2    .req    v2
+        DAT3    .req    v3
+        DAT4    .req    v4
+        DAT5    .req    v5
+        DAT6    .req    v6
+        DAT7    .req    ip
+        OFF     .req    lr
+
+        push    {DAT1-DAT6, lr}
+        setend  be /* lowest-addressed bytes are most significant */
+
+        /* To preload ahead as we go, we need at least (prefetch_distance+2) 32-byte blocks */
+        cmp     N, #(prefetch_distance+3)*32 - 1
+        blo     170f
+
+        /* Long case */
+        /* Adjust N so that the decrement instruction can also test for
+         * inner loop termination. We want it to stop when there are
+         * (prefetch_distance+1) complete blocks to go. */
+        sub     N, N, #(prefetch_distance+2)*32
+        preload_leading_step1  0, DAT0, S_1
+        preload_leading_step1  0, DAT1, S_2
+        tst     S_2, #31
+        beq     154f
+        rsb     OFF, S_2, #0 /* no need to AND with 15 here */
+        preload_leading_step2  0, DAT0, S_1, OFF, DAT2
+        preload_leading_step2  0, DAT1, S_2, OFF, DAT2
+        memcmp_leading_31bytes
+154:    /* Second source now cacheline (32-byte) aligned; we have at
+         * least one prefetch to go. */
+        /* Prefetch offset is best selected such that it lies in the
+         * first 8 of each 32 bytes - but it's just as easy to aim for
+         * the first one */
+        and     OFF, S_1, #31
+        rsb     OFF, OFF, #32*prefetch_distance
+        tst     S_1, #3
+        bne     140f
+        memcmp_long_inner_loop  0
+140:    memcmp_long_inner_loop  1
+
+170:    /* Short case */
+        teq     N, #0
+        beq     199f
+        preload_all 0, 0, 0, S_1, N, DAT0, DAT1
+        preload_all 0, 0, 0, S_2, N, DAT0, DAT1
+        tst     S_2, #3
+        beq     174f
+172:    subs    N, N, #1
+        blo     199f
+        ldrb    DAT0, [S_1], #1
+        ldrb    DAT4, [S_2], #1
+        cmp     DAT0, DAT4
+        bne     200f
+        tst     S_2, #3
+        bne     172b
+174:    /* Second source now 4-byte aligned; we have 0 or more bytes to go */
+        tst     S_1, #3
+        bne     140f
+        memcmp_short_inner_loop  0
+140:    memcmp_short_inner_loop  1
+
+200:    /* Difference found: determine sign. */
+        movhi   a1, #1
+        movlo   a1, #-1
+        setend  le
+        pop     {DAT1-DAT6, pc}
+
+        .unreq  S_1
+        .unreq  S_2
+        .unreq  N
+        .unreq  DAT0
+        .unreq  DAT1
+        .unreq  DAT2
+        .unreq  DAT3
+        .unreq  DAT4
+        .unreq  DAT5
+        .unreq  DAT6
+        .unreq  DAT7
+        .unreq  OFF
+ENDPROC(memcmp)
diff --git a/arch/arm/lib/memcpy_rpi.S b/arch/arm/lib/memcpy_rpi.S
new file mode 100644
index 000000000000..30f8a9089a83
--- /dev/null
+++ b/arch/arm/lib/memcpy_rpi.S
@@ -0,0 +1,61 @@
+/*
+Copyright (c) 2013, Raspberry Pi Foundation
+Copyright (c) 2013, RISC OS Open Ltd
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of the copyright holder nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include <linux/linkage.h>
+#include "arm-mem.h"
+#include "memcpymove.h"
+
+/* Prevent the stack from becoming executable */
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
+
+    .text
+    .arch armv6
+    .object_arch armv4
+    .arm
+    .altmacro
+    .p2align 2
+
+/*
+ * void *memcpy(void * restrict s1, const void * restrict s2, size_t n);
+ * On entry:
+ * a1 = pointer to destination
+ * a2 = pointer to source
+ * a3 = number of bytes to copy
+ * On exit:
+ * a1 preserved
+ */
+
+.set prefetch_distance, 3
+
+ENTRY(mmiocpy)
+ENTRY(memcpy)
+        memcpy  0
+ENDPROC(memcpy)
+ENDPROC(mmiocpy)
diff --git a/arch/arm/lib/memcpymove.h b/arch/arm/lib/memcpymove.h
new file mode 100644
index 000000000000..d8be5849c860
--- /dev/null
+++ b/arch/arm/lib/memcpymove.h
@@ -0,0 +1,506 @@
+/*
+Copyright (c) 2013, Raspberry Pi Foundation
+Copyright (c) 2013, RISC OS Open Ltd
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of the copyright holder nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+.macro unaligned_words  backwards, align, use_pld, words, r0, r1, r2, r3, r4, r5, r6, r7, r8
+ .if words == 1
+  .if backwards
+        mov     r1, r0, lsl #32-align*8
+        ldr     r0, [S, #-4]!
+        orr     r1, r1, r0, lsr #align*8
+        str     r1, [D, #-4]!
+  .else
+        mov     r0, r1, lsr #align*8
+        ldr     r1, [S, #4]!
+        orr     r0, r0, r1, lsl #32-align*8
+        str     r0, [D], #4
+  .endif
+ .elseif words == 2
+  .if backwards
+        ldr     r1, [S, #-4]!
+        mov     r2, r0, lsl #32-align*8
+        ldr     r0, [S, #-4]!
+        orr     r2, r2, r1, lsr #align*8
+        mov     r1, r1, lsl #32-align*8
+        orr     r1, r1, r0, lsr #align*8
+        stmdb   D!, {r1, r2}
+  .else
+        ldr     r1, [S, #4]!
+        mov     r0, r2, lsr #align*8
+        ldr     r2, [S, #4]!
+        orr     r0, r0, r1, lsl #32-align*8
+        mov     r1, r1, lsr #align*8
+        orr     r1, r1, r2, lsl #32-align*8
+        stmia   D!, {r0, r1}
+  .endif
+ .elseif words == 4
+  .if backwards
+        ldmdb   S!, {r2, r3}
+        mov     r4, r0, lsl #32-align*8
+        ldmdb   S!, {r0, r1}
+        orr     r4, r4, r3, lsr #align*8
+        mov     r3, r3, lsl #32-align*8
+        orr     r3, r3, r2, lsr #align*8
+        mov     r2, r2, lsl #32-align*8
+        orr     r2, r2, r1, lsr #align*8
+        mov     r1, r1, lsl #32-align*8
+        orr     r1, r1, r0, lsr #align*8
+        stmdb   D!, {r1, r2, r3, r4}
+  .else
+        ldmib   S!, {r1, r2}
+        mov     r0, r4, lsr #align*8
+        ldmib   S!, {r3, r4}
+        orr     r0, r0, r1, lsl #32-align*8
+        mov     r1, r1, lsr #align*8
+        orr     r1, r1, r2, lsl #32-align*8
+        mov     r2, r2, lsr #align*8
+        orr     r2, r2, r3, lsl #32-align*8
+        mov     r3, r3, lsr #align*8
+        orr     r3, r3, r4, lsl #32-align*8
+        stmia   D!, {r0, r1, r2, r3}
+  .endif
+ .elseif words == 8
+  .if backwards
+        ldmdb   S!, {r4, r5, r6, r7}
+        mov     r8, r0, lsl #32-align*8
+        ldmdb   S!, {r0, r1, r2, r3}
+   .if use_pld
+        pld     [S, OFF]
+   .endif
+        orr     r8, r8, r7, lsr #align*8
+        mov     r7, r7, lsl #32-align*8
+        orr     r7, r7, r6, lsr #align*8
+        mov     r6, r6, lsl #32-align*8
+        orr     r6, r6, r5, lsr #align*8
+        mov     r5, r5, lsl #32-align*8
+        orr     r5, r5, r4, lsr #align*8
+        mov     r4, r4, lsl #32-align*8
+        orr     r4, r4, r3, lsr #align*8
+        mov     r3, r3, lsl #32-align*8
+        orr     r3, r3, r2, lsr #align*8
+        mov     r2, r2, lsl #32-align*8
+        orr     r2, r2, r1, lsr #align*8
+        mov     r1, r1, lsl #32-align*8
+        orr     r1, r1, r0, lsr #align*8
+        stmdb   D!, {r5, r6, r7, r8}
+        stmdb   D!, {r1, r2, r3, r4}
+  .else
+        ldmib   S!, {r1, r2, r3, r4}
+        mov     r0, r8, lsr #align*8
+        ldmib   S!, {r5, r6, r7, r8}
+   .if use_pld
+        pld     [S, OFF]
+   .endif
+        orr     r0, r0, r1, lsl #32-align*8
+        mov     r1, r1, lsr #align*8
+        orr     r1, r1, r2, lsl #32-align*8
+        mov     r2, r2, lsr #align*8
+        orr     r2, r2, r3, lsl #32-align*8
+        mov     r3, r3, lsr #align*8
+        orr     r3, r3, r4, lsl #32-align*8
+        mov     r4, r4, lsr #align*8
+        orr     r4, r4, r5, lsl #32-align*8
+        mov     r5, r5, lsr #align*8
+        orr     r5, r5, r6, lsl #32-align*8
+        mov     r6, r6, lsr #align*8
+        orr     r6, r6, r7, lsl #32-align*8
+        mov     r7, r7, lsr #align*8
+        orr     r7, r7, r8, lsl #32-align*8
+        stmia   D!, {r0, r1, r2, r3}
+        stmia   D!, {r4, r5, r6, r7}
+  .endif
+ .endif
+.endm
+
+.macro memcpy_leading_15bytes  backwards, align
+        movs    DAT1, DAT2, lsl #31
+        sub     N, N, DAT2
+ .if backwards
+        ldrmib  DAT0, [S, #-1]!
+        ldrcsh  DAT1, [S, #-2]!
+        strmib  DAT0, [D, #-1]!
+        strcsh  DAT1, [D, #-2]!
+ .else
+        ldrmib  DAT0, [S], #1
+        ldrcsh  DAT1, [S], #2
+        strmib  DAT0, [D], #1
+        strcsh  DAT1, [D], #2
+ .endif
+        movs    DAT1, DAT2, lsl #29
+ .if backwards
+        ldrmi   DAT0, [S, #-4]!
+  .if align == 0
+        ldmcsdb S!, {DAT1, DAT2}
+  .else
+        ldrcs   DAT2, [S, #-4]!
+        ldrcs   DAT1, [S, #-4]!
+  .endif
+        strmi   DAT0, [D, #-4]!
+        stmcsdb D!, {DAT1, DAT2}
+ .else
+        ldrmi   DAT0, [S], #4
+  .if align == 0
+        ldmcsia S!, {DAT1, DAT2}
+  .else
+        ldrcs   DAT1, [S], #4
+        ldrcs   DAT2, [S], #4
+  .endif
+        strmi   DAT0, [D], #4
+        stmcsia D!, {DAT1, DAT2}
+ .endif
+.endm
+
+.macro memcpy_trailing_15bytes  backwards, align
+        movs    N, N, lsl #29
+ .if backwards
+  .if align == 0
+        ldmcsdb S!, {DAT0, DAT1}
+  .else
+        ldrcs   DAT1, [S, #-4]!
+        ldrcs   DAT0, [S, #-4]!
+  .endif
+        ldrmi   DAT2, [S, #-4]!
+        stmcsdb D!, {DAT0, DAT1}
+        strmi   DAT2, [D, #-4]!
+ .else
+  .if align == 0
+        ldmcsia S!, {DAT0, DAT1}
+  .else
+        ldrcs   DAT0, [S], #4
+        ldrcs   DAT1, [S], #4
+  .endif
+        ldrmi   DAT2, [S], #4
+        stmcsia D!, {DAT0, DAT1}
+        strmi   DAT2, [D], #4
+ .endif
+        movs    N, N, lsl #2
+ .if backwards
+        ldrcsh  DAT0, [S, #-2]!
+        ldrmib  DAT1, [S, #-1]
+        strcsh  DAT0, [D, #-2]!
+        strmib  DAT1, [D, #-1]
+ .else
+        ldrcsh  DAT0, [S], #2
+        ldrmib  DAT1, [S]
+        strcsh  DAT0, [D], #2
+        strmib  DAT1, [D]
+ .endif
+.endm
+
+.macro memcpy_long_inner_loop  backwards, align
+ .if align != 0
+  .if backwards
+        ldr     DAT0, [S, #-align]!
+  .else
+        ldr     LAST, [S, #-align]!
+  .endif
+ .endif
+110:
+ .if align == 0
+  .if backwards
+        ldmdb   S!, {DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, LAST}
+        pld     [S, OFF]
+        stmdb   D!, {DAT4, DAT5, DAT6, LAST}
+        stmdb   D!, {DAT0, DAT1, DAT2, DAT3}
+  .else
+        ldmia   S!, {DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, LAST}
+        pld     [S, OFF]
+        stmia   D!, {DAT0, DAT1, DAT2, DAT3}
+        stmia   D!, {DAT4, DAT5, DAT6, LAST}
+  .endif
+ .else
+        unaligned_words  backwards, align, 1, 8, DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, DAT7, LAST
+ .endif
+        subs    N, N, #32
+        bhs     110b
+        /* Just before the final (prefetch_distance+1) 32-byte blocks, deal with final preloads */
+        preload_trailing  backwards, S, N, OFF
+        add     N, N, #(prefetch_distance+2)*32 - 32
+120:
+ .if align == 0
+  .if backwards
+        ldmdb   S!, {DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, LAST}
+        stmdb   D!, {DAT4, DAT5, DAT6, LAST}
+        stmdb   D!, {DAT0, DAT1, DAT2, DAT3}
+  .else
+        ldmia   S!, {DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, LAST}
+        stmia   D!, {DAT0, DAT1, DAT2, DAT3}
+        stmia   D!, {DAT4, DAT5, DAT6, LAST}
+  .endif
+ .else
+        unaligned_words  backwards, align, 0, 8, DAT0, DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, DAT7, LAST
+ .endif
+        subs    N, N, #32
+        bhs     120b
+        tst     N, #16
+ .if align == 0
+  .if backwards
+        ldmnedb S!, {DAT0, DAT1, DAT2, LAST}
+        stmnedb D!, {DAT0, DAT1, DAT2, LAST}
+  .else
+        ldmneia S!, {DAT0, DAT1, DAT2, LAST}
+        stmneia D!, {DAT0, DAT1, DAT2, LAST}
+  .endif
+ .else
+        beq     130f
+        unaligned_words  backwards, align, 0, 4, DAT0, DAT1, DAT2, DAT3, LAST
+130:
+ .endif
+        /* Trailing words and bytes */
+        tst      N, #15
+        beq      199f
+ .if align != 0
+        add     S, S, #align
+ .endif
+        memcpy_trailing_15bytes  backwards, align
+199:
+        pop     {DAT3, DAT4, DAT5, DAT6, DAT7}
+        pop     {D, DAT1, DAT2, pc}
+.endm
+
+.macro memcpy_medium_inner_loop  backwards, align
+120:
+ .if backwards
+  .if align == 0
+        ldmdb   S!, {DAT0, DAT1, DAT2, LAST}
+  .else
+        ldr     LAST, [S, #-4]!
+        ldr     DAT2, [S, #-4]!
+        ldr     DAT1, [S, #-4]!
+        ldr     DAT0, [S, #-4]!
+  .endif
+        stmdb   D!, {DAT0, DAT1, DAT2, LAST}
+ .else
+  .if align == 0
+        ldmia   S!, {DAT0, DAT1, DAT2, LAST}
+  .else
+        ldr     DAT0, [S], #4
+        ldr     DAT1, [S], #4
+        ldr     DAT2, [S], #4
+        ldr     LAST, [S], #4
+  .endif
+        stmia   D!, {DAT0, DAT1, DAT2, LAST}
+ .endif
+        subs     N, N, #16
+        bhs      120b
+        /* Trailing words and bytes */
+        tst      N, #15
+        beq      199f
+        memcpy_trailing_15bytes  backwards, align
+199:
+        pop     {D, DAT1, DAT2, pc}
+.endm
+
+.macro memcpy_short_inner_loop  backwards, align
+        tst     N, #16
+ .if backwards
+  .if align == 0
+        ldmnedb S!, {DAT0, DAT1, DAT2, LAST}
+  .else
+        ldrne   LAST, [S, #-4]!
+        ldrne   DAT2, [S, #-4]!
+        ldrne   DAT1, [S, #-4]!
+        ldrne   DAT0, [S, #-4]!
+  .endif
+        stmnedb D!, {DAT0, DAT1, DAT2, LAST}
+ .else
+  .if align == 0
+        ldmneia S!, {DAT0, DAT1, DAT2, LAST}
+  .else
+        ldrne   DAT0, [S], #4
+        ldrne   DAT1, [S], #4
+        ldrne   DAT2, [S], #4
+        ldrne   LAST, [S], #4
+  .endif
+        stmneia D!, {DAT0, DAT1, DAT2, LAST}
+ .endif
+        memcpy_trailing_15bytes  backwards, align
+199:
+        pop     {D, DAT1, DAT2, pc}
+.endm
+
+.macro memcpy backwards
+        D       .req    a1
+        S       .req    a2
+        N       .req    a3
+        DAT0    .req    a4
+        DAT1    .req    v1
+        DAT2    .req    v2
+        DAT3    .req    v3
+        DAT4    .req    v4
+        DAT5    .req    v5
+        DAT6    .req    v6
+        DAT7    .req    sl
+        LAST    .req    ip
+        OFF     .req    lr
+
+        .cfi_startproc
+
+        push    {D, DAT1, DAT2, lr}
+
+        .cfi_def_cfa_offset 16
+        .cfi_rel_offset D, 0
+        .cfi_undefined  S
+        .cfi_undefined  N
+        .cfi_undefined  DAT0
+        .cfi_rel_offset DAT1, 4
+        .cfi_rel_offset DAT2, 8
+        .cfi_undefined  LAST
+        .cfi_rel_offset lr, 12
+
+ .if backwards
+        add     D, D, N
+        add     S, S, N
+ .endif
+
+        /* See if we're guaranteed to have at least one 16-byte aligned 16-byte write */
+        cmp     N, #31
+        blo     170f
+        /* To preload ahead as we go, we need at least (prefetch_distance+2) 32-byte blocks */
+        cmp     N, #(prefetch_distance+3)*32 - 1
+        blo     160f
+
+        /* Long case */
+        push    {DAT3, DAT4, DAT5, DAT6, DAT7}
+
+        .cfi_def_cfa_offset 36
+        .cfi_rel_offset D, 20
+        .cfi_rel_offset DAT1, 24
+        .cfi_rel_offset DAT2, 28
+        .cfi_rel_offset DAT3, 0
+        .cfi_rel_offset DAT4, 4
+        .cfi_rel_offset DAT5, 8
+        .cfi_rel_offset DAT6, 12
+        .cfi_rel_offset DAT7, 16
+        .cfi_rel_offset lr, 32
+
+        /* Adjust N so that the decrement instruction can also test for
+         * inner loop termination. We want it to stop when there are
+         * (prefetch_distance+1) complete blocks to go. */
+        sub     N, N, #(prefetch_distance+2)*32
+        preload_leading_step1  backwards, DAT0, S
+ .if backwards
+        /* Bug in GAS: it accepts, but mis-assembles the instruction
+         * ands    DAT2, D, #60, 2
+         * which sets DAT2 to the number of leading bytes until destination is aligned and also clears C (sets borrow)
+         */
+        .word   0xE210513C
+        beq     154f
+ .else
+        ands    DAT2, D, #15
+        beq     154f
+        rsb     DAT2, DAT2, #16 /* number of leading bytes until destination aligned */
+ .endif
+        preload_leading_step2  backwards, DAT0, S, DAT2, OFF
+        memcpy_leading_15bytes backwards, 1
+154:    /* Destination now 16-byte aligned; we have at least one prefetch as well as at least one 16-byte output block */
+        /* Prefetch offset is best selected such that it lies in the first 8 of each 32 bytes - but it's just as easy to aim for the first one */
+ .if backwards
+        rsb     OFF, S, #3
+        and     OFF, OFF, #28
+        sub     OFF, OFF, #32*(prefetch_distance+1)
+ .else
+        and     OFF, S, #28
+        rsb     OFF, OFF, #32*prefetch_distance
+ .endif
+        movs    DAT0, S, lsl #31
+        bhi     157f
+        bcs     156f
+        bmi     155f
+        memcpy_long_inner_loop  backwards, 0
+155:    memcpy_long_inner_loop  backwards, 1
+156:    memcpy_long_inner_loop  backwards, 2
+157:    memcpy_long_inner_loop  backwards, 3
+
+        .cfi_def_cfa_offset 16
+        .cfi_rel_offset D, 0
+        .cfi_rel_offset DAT1, 4
+        .cfi_rel_offset DAT2, 8
+        .cfi_same_value DAT3
+        .cfi_same_value DAT4
+        .cfi_same_value DAT5
+        .cfi_same_value DAT6
+        .cfi_same_value DAT7
+        .cfi_rel_offset lr, 12
+
+160:    /* Medium case */
+        preload_all  backwards, 0, 0, S, N, DAT2, OFF
+        sub     N, N, #16     /* simplifies inner loop termination */
+ .if backwards
+        ands    DAT2, D, #15
+        beq     164f
+ .else
+        ands    DAT2, D, #15
+        beq     164f
+        rsb     DAT2, DAT2, #16
+ .endif
+        memcpy_leading_15bytes backwards, align
+164:    /* Destination now 16-byte aligned; we have at least one 16-byte output block */
+        tst     S, #3
+        bne     140f
+        memcpy_medium_inner_loop  backwards, 0
+140:    memcpy_medium_inner_loop  backwards, 1
+
+170:    /* Short case, less than 31 bytes, so no guarantee of at least one 16-byte block */
+        teq     N, #0
+        beq     199f
+        preload_all  backwards, 1, 0, S, N, DAT2, LAST
+        tst     D, #3
+        beq     174f
+172:    subs    N, N, #1
+        blo     199f
+ .if backwards
+        ldrb    DAT0, [S, #-1]!
+        strb    DAT0, [D, #-1]!
+ .else
+        ldrb    DAT0, [S], #1
+        strb    DAT0, [D], #1
+ .endif
+        tst     D, #3
+        bne     172b
+174:    /* Destination now 4-byte aligned; we have 0 or more output bytes to go */
+        tst     S, #3
+        bne     140f
+        memcpy_short_inner_loop  backwards, 0
+140:    memcpy_short_inner_loop  backwards, 1
+
+        .cfi_endproc
+
+        .unreq  D
+        .unreq  S
+        .unreq  N
+        .unreq  DAT0
+        .unreq  DAT1
+        .unreq  DAT2
+        .unreq  DAT3
+        .unreq  DAT4
+        .unreq  DAT5
+        .unreq  DAT6
+        .unreq  DAT7
+        .unreq  LAST
+        .unreq  OFF
+.endm
diff --git a/arch/arm/lib/memmove_rpi.S b/arch/arm/lib/memmove_rpi.S
new file mode 100644
index 000000000000..8b0760c0904c
--- /dev/null
+++ b/arch/arm/lib/memmove_rpi.S
@@ -0,0 +1,61 @@
+/*
+Copyright (c) 2013, Raspberry Pi Foundation
+Copyright (c) 2013, RISC OS Open Ltd
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of the copyright holder nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include <linux/linkage.h>
+#include "arm-mem.h"
+#include "memcpymove.h"
+
+/* Prevent the stack from becoming executable */
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
+
+    .text
+    .arch armv6
+    .object_arch armv4
+    .arm
+    .altmacro
+    .p2align 2
+
+/*
+ * void *memmove(void *s1, const void *s2, size_t n);
+ * On entry:
+ * a1 = pointer to destination
+ * a2 = pointer to source
+ * a3 = number of bytes to copy
+ * On exit:
+ * a1 preserved
+ */
+
+.set prefetch_distance, 3
+
+ENTRY(memmove)
+        cmp     a2, a1
+        bpl     memcpy  /* pl works even over -1 - 0 and 0x7fffffff - 0x80000000 boundaries */
+        memcpy  1
+ENDPROC(memmove)
diff --git a/arch/arm/lib/memset_rpi.S b/arch/arm/lib/memset_rpi.S
new file mode 100644
index 000000000000..2ca0d3618515
--- /dev/null
+++ b/arch/arm/lib/memset_rpi.S
@@ -0,0 +1,128 @@
+/*
+Copyright (c) 2013, Raspberry Pi Foundation
+Copyright (c) 2013, RISC OS Open Ltd
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of the copyright holder nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include <linux/linkage.h>
+#include "arm-mem.h"
+
+/* Prevent the stack from becoming executable */
+#if defined(__linux__) && defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif
+
+    .text
+    .arch armv6
+    .object_arch armv4
+    .arm
+    .altmacro
+    .p2align 2
+
+/*
+ *  void *memset(void *s, int c, size_t n);
+ *  On entry:
+ *  a1 = pointer to buffer to fill
+ *  a2 = byte pattern to fill with (caller-narrowed)
+ *  a3 = number of bytes to fill
+ *  On exit:
+ *  a1 preserved
+ */
+ENTRY(mmioset)
+ENTRY(memset)
+ENTRY(__memset32)
+ENTRY(__memset64)
+
+        S       .req    a1
+        DAT0    .req    a2
+        N       .req    a3
+        DAT1    .req    a4
+        DAT2    .req    ip
+        DAT3    .req    lr
+
+        orr     DAT0, DAT0, lsl #8
+        push    {S, lr}
+        orr     DAT0, DAT0, lsl #16
+        mov     DAT1, DAT0
+
+        /* See if we're guaranteed to have at least one 16-byte aligned 16-byte write */
+        cmp     N, #31
+        blo     170f
+
+161:    sub     N, N, #16     /* simplifies inner loop termination */
+        /* Leading words and bytes */
+        tst     S, #15
+        beq     164f
+        rsb     DAT3, S, #0   /* bits 0-3 = number of leading bytes until aligned */
+        movs    DAT2, DAT3, lsl #31
+        submi   N, N, #1
+        strmib  DAT0, [S], #1
+        subcs   N, N, #2
+        strcsh  DAT0, [S], #2
+        movs    DAT2, DAT3, lsl #29
+        submi   N, N, #4
+        strmi   DAT0, [S], #4
+        subcs   N, N, #8
+        stmcsia S!, {DAT0, DAT1}
+164:    /* Delayed set up of DAT2 and DAT3 so we could use them as scratch registers above */
+        mov     DAT2, DAT0
+        mov     DAT3, DAT0
+        /* Now the inner loop of 16-byte stores */
+165:    stmia   S!, {DAT0, DAT1, DAT2, DAT3}
+        subs    N, N, #16
+        bhs     165b
+166:    /* Trailing words and bytes */
+        movs    N, N, lsl #29
+        stmcsia S!, {DAT0, DAT1}
+        strmi   DAT0, [S], #4
+        movs    N, N, lsl #2
+        strcsh  DAT0, [S], #2
+        strmib  DAT0, [S]
+199:    pop     {S, pc}
+
+170:    /* Short case */
+        mov     DAT2, DAT0
+        mov     DAT3, DAT0
+        tst     S, #3
+        beq     174f
+172:    subs    N, N, #1
+        blo     199b
+        strb    DAT0, [S], #1
+        tst     S, #3
+        bne     172b
+174:    tst     N, #16
+        stmneia S!, {DAT0, DAT1, DAT2, DAT3}
+        b       166b
+
+        .unreq  S
+        .unreq  DAT0
+        .unreq  N
+        .unreq  DAT1
+        .unreq  DAT2
+        .unreq  DAT3
+ENDPROC(__memset64)
+ENDPROC(__memset32)
+ENDPROC(memset)
+ENDPROC(mmioset)
diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
index 9b4ed1728616..9dc1b8517dff 100644
--- a/arch/arm/lib/uaccess_with_memcpy.c
+++ b/arch/arm/lib/uaccess_with_memcpy.c
@@ -22,6 +22,14 @@
 #include <asm/current.h>
 #include <asm/page.h>
 
+#ifndef COPY_FROM_USER_THRESHOLD
+#define COPY_FROM_USER_THRESHOLD 64
+#endif
+
+#ifndef COPY_TO_USER_THRESHOLD
+#define COPY_TO_USER_THRESHOLD 64
+#endif
+
 static int
 pin_page_for_write(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp)
 {
@@ -84,7 +92,44 @@ pin_page_for_write(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp)
 	return 1;
 }
 
-static unsigned long noinline
+static int
+pin_page_for_read(const void __user *_addr, pte_t **ptep, spinlock_t **ptlp)
+{
+	unsigned long addr = (unsigned long)_addr;
+	pgd_t *pgd;
+	pmd_t *pmd;
+	pte_t *pte;
+	pud_t *pud;
+	spinlock_t *ptl;
+
+	pgd = pgd_offset(current->mm, addr);
+	if (unlikely(pgd_none(*pgd) || pgd_bad(*pgd)))
+	{
+		return 0;
+	}
+	pud = pud_offset(pgd, addr);
+	if (unlikely(pud_none(*pud) || pud_bad(*pud)))
+	{
+		return 0;
+	}
+
+	pmd = pmd_offset(pud, addr);
+	if (unlikely(pmd_none(*pmd) || pmd_bad(*pmd)))
+		return 0;
+
+	pte = pte_offset_map_lock(current->mm, pmd, addr, &ptl);
+	if (unlikely(!pte_present(*pte) || !pte_young(*pte))) {
+		pte_unmap_unlock(pte, ptl);
+		return 0;
+	}
+
+	*ptep = pte;
+	*ptlp = ptl;
+
+	return 1;
+}
+
+unsigned long noinline
 __copy_to_user_memcpy(void __user *to, const void *from, unsigned long n)
 {
 	unsigned long ua_flags;
@@ -137,6 +182,57 @@ __copy_to_user_memcpy(void __user *to, const void *from, unsigned long n)
 	return n;
 }
 
+unsigned long noinline
+__copy_from_user_memcpy(void *to, const void __user *from, unsigned long n)
+{
+	unsigned long ua_flags;
+	int atomic;
+
+	if (unlikely(segment_eq(get_fs(), KERNEL_DS))) {
+		memcpy(to, (const void *)from, n);
+		return 0;
+	}
+
+	/* the mmap semaphore is taken only if not in an atomic context */
+	atomic = in_atomic();
+
+	if (!atomic)
+		down_read(&current->mm->mmap_sem);
+	while (n) {
+		pte_t *pte;
+		spinlock_t *ptl;
+		int tocopy;
+
+		while (!pin_page_for_read(from, &pte, &ptl)) {
+			char temp;
+			if (!atomic)
+				up_read(&current->mm->mmap_sem);
+			if (__get_user(temp, (char __user *)from))
+				goto out;
+			if (!atomic)
+				down_read(&current->mm->mmap_sem);
+		}
+
+		tocopy = (~(unsigned long)from & ~PAGE_MASK) + 1;
+		if (tocopy > n)
+			tocopy = n;
+
+		ua_flags = uaccess_save_and_enable();
+		memcpy(to, (const void *)from, tocopy);
+		uaccess_restore(ua_flags);
+		to += tocopy;
+		from += tocopy;
+		n -= tocopy;
+
+		pte_unmap_unlock(pte, ptl);
+	}
+	if (!atomic)
+		up_read(&current->mm->mmap_sem);
+
+out:
+	return n;
+}
+
 unsigned long
 arm_copy_to_user(void __user *to, const void *from, unsigned long n)
 {
@@ -147,7 +243,7 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n)
 	 * With frame pointer disabled, tail call optimization kicks in
 	 * as well making this test almost invisible.
 	 */
-	if (n < 64) {
+	if (n < COPY_TO_USER_THRESHOLD) {
 		unsigned long ua_flags = uaccess_save_and_enable();
 		n = __copy_to_user_std(to, from, n);
 		uaccess_restore(ua_flags);
@@ -156,6 +252,26 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n)
 	}
 	return n;
 }
+
+unsigned long __must_check
+arm_copy_from_user(void *to, const void __user *from, unsigned long n)
+{
+	/*
+	 * This test is stubbed out of the main function above to keep
+	 * the overhead for small copies low by avoiding a large
+	 * register dump on the stack just to reload them right away.
+	 * With frame pointer disabled, tail call optimization kicks in
+	 * as well making this test almost invisible.
+	 */
+	if (n < COPY_TO_USER_THRESHOLD) {
+		unsigned long ua_flags = uaccess_save_and_enable();
+		n = __copy_from_user_std(to, from, n);
+		uaccess_restore(ua_flags);
+	} else {
+		n = __copy_from_user_memcpy(to, from, n);
+	}
+	return n;
+}
 	
 static unsigned long noinline
 __clear_user_memset(void __user *addr, unsigned long n)
diff --git a/arch/arm/mach-bcm/Kconfig b/arch/arm/mach-bcm/Kconfig
index 5d2925e2ce1f..78e9f6e8c6fd 100644
--- a/arch/arm/mach-bcm/Kconfig
+++ b/arch/arm/mach-bcm/Kconfig
@@ -155,8 +155,10 @@ config ARCH_BCM2835
 	select HAVE_ARM_ARCH_TIMER if ARCH_MULTI_V7
 	select TIMER_OF
 	select BCM2835_TIMER
+	select FIQ
 	select PINCTRL
 	select PINCTRL_BCM2835
+	select MFD_SYSCON if ARCH_MULTI_V7
 	help
 	  This enables support for the Broadcom BCM2835 and BCM2836 SoCs.
 	  This SoC is used in the Raspberry Pi and Roku 2 devices.
@@ -175,6 +177,13 @@ config ARCH_BCM_53573
 	  The base chip is BCM53573 and there are some packaging modifications
 	  like BCM47189 and BCM47452.
 
+config BCM2835_FAST_MEMCPY
+	bool "Enable optimized __copy_to_user and __copy_from_user"
+	depends on ARCH_BCM2835 && ARCH_MULTI_V6
+	default y
+	help
+	  Optimized versions of __copy_to_user and __copy_from_user for Pi1.
+
 config ARCH_BCM_63XX
 	bool "Broadcom BCM63xx DSL SoC"
 	depends on ARCH_MULTI_V7
diff --git a/arch/arm/mach-bcm/Makefile b/arch/arm/mach-bcm/Makefile
index 980f5850097c..62a59008c5a8 100644
--- a/arch/arm/mach-bcm/Makefile
+++ b/arch/arm/mach-bcm/Makefile
@@ -43,6 +43,11 @@ endif
 
 # BCM2835
 obj-$(CONFIG_ARCH_BCM2835)	+= board_bcm2835.o
+ifeq ($(CONFIG_ARCH_BCM2835),y)
+ifeq ($(CONFIG_ARM),y)
+obj-$(CONFIG_SMP)		+= platsmp.o
+endif
+endif
 
 # BCM5301X
 obj-$(CONFIG_ARCH_BCM_5301X)	+= bcm_5301x.o
diff --git a/arch/arm/mach-bcm/board_bcm2835.c b/arch/arm/mach-bcm/board_bcm2835.c
index 0c1edfc98696..54f807a2c466 100644
--- a/arch/arm/mach-bcm/board_bcm2835.c
+++ b/arch/arm/mach-bcm/board_bcm2835.c
@@ -16,13 +16,32 @@
 #include <linux/irqchip.h>
 #include <linux/of_address.h>
 #include <linux/clk/bcm2835.h>
+#include <asm/system_info.h>
 
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
 
+#include "platsmp.h"
+#include <linux/dma-mapping.h>
+
 static void __init bcm2835_init(void)
 {
+	struct device_node *np = of_find_node_by_path("/system");
+	u32 val;
+	u64 val64;
+
 	bcm2835_init_clocks();
+
+	if (!of_property_read_u32(np, "linux,revision", &val))
+		system_rev = val;
+	if (!of_property_read_u64(np, "linux,serial", &val64))
+		system_serial_low = val64;
+}
+
+static void __init bcm2835_init_early(void)
+{
+	/* dwc_otg needs this for bounce buffers on non-aligned transfers */
+	init_dma_coherent_pool_size(SZ_1M);
 }
 
 static const char * const bcm2835_compat[] = {
@@ -31,11 +50,14 @@ static const char * const bcm2835_compat[] = {
 #endif
 #ifdef CONFIG_ARCH_MULTI_V7
 	"brcm,bcm2836",
+	"brcm,bcm2837",
 #endif
 	NULL
 };
 
 DT_MACHINE_START(BCM2835, "BCM2835")
 	.init_machine = bcm2835_init,
-	.dt_compat = bcm2835_compat
+	.init_early = bcm2835_init_early,
+	.dt_compat = bcm2835_compat,
+	.smp = smp_ops(bcm2836_smp_ops),
 MACHINE_END
diff --git a/arch/arm/mach-bcm/platsmp.c b/arch/arm/mach-bcm/platsmp.c
index 9e3f275934eb..34506a608fea 100644
--- a/arch/arm/mach-bcm/platsmp.c
+++ b/arch/arm/mach-bcm/platsmp.c
@@ -17,6 +17,7 @@
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/io.h>
+#include <linux/irqchip/irq-bcm2836.h>
 #include <linux/jiffies.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
@@ -287,6 +288,35 @@ static int nsp_boot_secondary(unsigned int cpu, struct task_struct *idle)
 	return ret;
 }
 
+static int bcm2836_boot_secondary(unsigned int cpu, struct task_struct *idle)
+{
+	void __iomem *intc_base;
+	struct device_node *dn;
+	char *name;
+
+	name = "brcm,bcm2836-l1-intc";
+	dn = of_find_compatible_node(NULL, NULL, name);
+	if (!dn) {
+		pr_err("unable to find intc node\n");
+		return -ENODEV;
+	}
+
+	intc_base = of_iomap(dn, 0);
+	of_node_put(dn);
+
+	if (!intc_base) {
+		pr_err("unable to remap intc base register\n");
+		return -ENOMEM;
+	}
+
+	writel(virt_to_phys(secondary_startup),
+	       intc_base + LOCAL_MAILBOX3_SET0 + 16 * cpu);
+
+	iounmap(intc_base);
+
+	return 0;
+}
+
 static const struct smp_operations kona_smp_ops __initconst = {
 	.smp_prepare_cpus	= bcm_smp_prepare_cpus,
 	.smp_boot_secondary	= kona_boot_secondary,
@@ -305,3 +335,8 @@ static const struct smp_operations nsp_smp_ops __initconst = {
 	.smp_boot_secondary	= nsp_boot_secondary,
 };
 CPU_METHOD_OF_DECLARE(bcm_smp_nsp, "brcm,bcm-nsp-smp", &nsp_smp_ops);
+
+const struct smp_operations bcm2836_smp_ops __initconst = {
+	.smp_boot_secondary	= bcm2836_boot_secondary,
+};
+CPU_METHOD_OF_DECLARE(bcm_smp_bcm2836, "brcm,bcm2836-smp", &bcm2836_smp_ops);
diff --git a/arch/arm/mach-bcm/platsmp.h b/arch/arm/mach-bcm/platsmp.h
new file mode 100644
index 000000000000..b8b8b3fa350d
--- /dev/null
+++ b/arch/arm/mach-bcm/platsmp.h
@@ -0,0 +1,10 @@
+/*
+ * Copyright (C) 2017 Stefan Wahren <stefan.wahren@i2se.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation version 2.
+ *
+ */
+
+extern const struct smp_operations bcm2836_smp_ops;
diff --git a/arch/arm/mm/cache-v6.S b/arch/arm/mm/cache-v6.S
index 24659952c278..1ee5bc3a1018 100644
--- a/arch/arm/mm/cache-v6.S
+++ b/arch/arm/mm/cache-v6.S
@@ -201,7 +201,7 @@ ENTRY(v6_flush_kern_dcache_area)
  *	- start   - virtual start address of region
  *	- end     - virtual end address of region
  */
-v6_dma_inv_range:
+ENTRY(v6_dma_inv_range)
 #ifdef CONFIG_DMA_CACHE_RWFO
 	ldrb	r2, [r0]			@ read for ownership
 	strb	r2, [r0]			@ write for ownership
@@ -246,7 +246,7 @@ v6_dma_inv_range:
  *	- start   - virtual start address of region
  *	- end     - virtual end address of region
  */
-v6_dma_clean_range:
+ENTRY(v6_dma_clean_range)
 	bic	r0, r0, #D_CACHE_LINE_SIZE - 1
 1:
 #ifdef CONFIG_DMA_CACHE_RWFO
diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
index de78109d002d..4c850aa3af2b 100644
--- a/arch/arm/mm/cache-v7.S
+++ b/arch/arm/mm/cache-v7.S
@@ -349,7 +349,7 @@ ENDPROC(v7_flush_kern_dcache_area)
  *	- start   - virtual start address of region
  *	- end     - virtual end address of region
  */
-v7_dma_inv_range:
+ENTRY(v7_dma_inv_range)
 	dcache_line_size r2, r3
 	sub	r3, r2, #1
 	tst	r0, r3
@@ -377,7 +377,7 @@ ENDPROC(v7_dma_inv_range)
  *	- start   - virtual start address of region
  *	- end     - virtual end address of region
  */
-v7_dma_clean_range:
+ENTRY(v7_dma_clean_range)
 	dcache_line_size r2, r3
 	sub	r3, r2, #1
 	bic	r0, r0, r3
diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S
index f10e31d0730a..1bc23484e8e3 100644
--- a/arch/arm/mm/proc-macros.S
+++ b/arch/arm/mm/proc-macros.S
@@ -324,6 +324,8 @@ ENTRY(\name\()_cache_fns)
 	.long	\name\()_flush_kern_dcache_area
 	.long	\name\()_dma_map_area
 	.long	\name\()_dma_unmap_area
+	.long	\name\()_dma_inv_range
+	.long	\name\()_dma_clean_range
 	.long	\name\()_dma_flush_range
 	.size	\name\()_cache_fns, . - \name\()_cache_fns
 .endm
diff --git a/arch/arm/mm/proc-syms.c b/arch/arm/mm/proc-syms.c
index 054b491ff764..70e8b7d34434 100644
--- a/arch/arm/mm/proc-syms.c
+++ b/arch/arm/mm/proc-syms.c
@@ -30,6 +30,9 @@ EXPORT_SYMBOL(__cpuc_flush_user_all);
 EXPORT_SYMBOL(__cpuc_flush_user_range);
 EXPORT_SYMBOL(__cpuc_coherent_kern_range);
 EXPORT_SYMBOL(__cpuc_flush_dcache_area);
+EXPORT_SYMBOL(dmac_inv_range);
+EXPORT_SYMBOL(dmac_clean_range);
+EXPORT_SYMBOL(dmac_flush_range);
 #else
 EXPORT_SYMBOL(cpu_cache);
 #endif
diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S
index 06d890a2342b..30d96e81c0e0 100644
--- a/arch/arm/mm/proc-v6.S
+++ b/arch/arm/mm/proc-v6.S
@@ -73,10 +73,19 @@ ENDPROC(cpu_v6_reset)
  *
  *	IRQs are already disabled.
  */
+
+/* See jira SW-5991 for details of this workaround */
 ENTRY(cpu_v6_do_idle)
-	mov	r1, #0
-	mcr	p15, 0, r1, c7, c10, 4		@ DWB - WFI may enter a low-power mode
-	mcr	p15, 0, r1, c7, c0, 4		@ wait for interrupt
+	.align 5
+	mov     r1, #2
+1:	subs	r1, #1
+	nop
+	mcreq	p15, 0, r1, c7, c10, 4		@ DWB - WFI may enter a low-power mode
+	mcreq	p15, 0, r1, c7, c0, 4		@ wait for interrupt
+	nop
+	nop
+	nop
+	bne 1b
 	ret	lr
 
 ENTRY(cpu_v6_dcache_clean_area)
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index aa7496be311d..d514aceea406 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -179,8 +179,11 @@ static int vfp_notifier(struct notifier_block *self, unsigned long cmd, void *v)
 		 * case the thread migrates to a different CPU. The
 		 * restoring is done lazily.
 		 */
-		if ((fpexc & FPEXC_EN) && vfp_current_hw_state[cpu])
+		if ((fpexc & FPEXC_EN) && vfp_current_hw_state[cpu]) {
+			/* vfp_save_state oopses on VFP11 if EX bit set */
+			fmxr(FPEXC, fpexc & ~FPEXC_EX);
 			vfp_save_state(vfp_current_hw_state[cpu], fpexc);
+		}
 #endif
 
 		/*
@@ -463,13 +466,16 @@ static int vfp_pm_suspend(void)
 	/* if vfp is on, then save state for resumption */
 	if (fpexc & FPEXC_EN) {
 		pr_debug("%s: saving vfp state\n", __func__);
+		/* vfp_save_state oopses on VFP11 if EX bit set */
+		fmxr(FPEXC, fpexc & ~FPEXC_EX);
 		vfp_save_state(&ti->vfpstate, fpexc);
 
 		/* disable, just in case */
 		fmxr(FPEXC, fmrx(FPEXC) & ~FPEXC_EN);
 	} else if (vfp_current_hw_state[ti->cpu]) {
 #ifndef CONFIG_SMP
-		fmxr(FPEXC, fpexc | FPEXC_EN);
+		/* vfp_save_state oopses on VFP11 if EX bit set */
+		fmxr(FPEXC, (fpexc & ~FPEXC_EX) | FPEXC_EN);
 		vfp_save_state(vfp_current_hw_state[ti->cpu], fpexc);
 		fmxr(FPEXC, fpexc);
 #endif
@@ -532,7 +538,8 @@ void vfp_sync_hwstate(struct thread_info *thread)
 		/*
 		 * Save the last VFP state on this CPU.
 		 */
-		fmxr(FPEXC, fpexc | FPEXC_EN);
+		/* vfp_save_state oopses on VFP11 if EX bit set */
+		fmxr(FPEXC, (fpexc & ~FPEXC_EX) | FPEXC_EN);
 		vfp_save_state(&thread->vfpstate, fpexc | FPEXC_EN);
 		fmxr(FPEXC, fpexc);
 	}
@@ -604,6 +611,7 @@ int vfp_restore_user_hwstate(struct user_vfp __user *ufp,
 	struct vfp_hard_struct *hwstate = &thread->vfpstate.hard;
 	unsigned long fpexc;
 	int err = 0;
+	u32 fpsid = fmrx(FPSID);
 
 	/* Disable VFP to avoid corrupting the new thread state. */
 	vfp_flush_hwstate(thread);
@@ -627,8 +635,12 @@ int vfp_restore_user_hwstate(struct user_vfp __user *ufp,
 	/* Ensure the VFP is enabled. */
 	fpexc |= FPEXC_EN;
 
-	/* Ensure FPINST2 is invalid and the exception flag is cleared. */
-	fpexc &= ~(FPEXC_EX | FPEXC_FP2V);
+	/* Mask FPXEC_EX and FPEXC_FP2V if not required by VFP arch */
+	if ((fpsid & FPSID_ARCH_MASK) != (1 << FPSID_ARCH_BIT)) {
+		/* Ensure FPINST2 is invalid and the exception flag is cleared. */
+		fpexc &= ~(FPEXC_EX | FPEXC_FP2V);
+	}
+
 	hwstate->fpexc = fpexc;
 
 	__get_user_error(hwstate->fpinst, &ufp_exc->fpinst, err);
@@ -698,7 +710,8 @@ void kernel_neon_begin(void)
 	cpu = get_cpu();
 
 	fpexc = fmrx(FPEXC) | FPEXC_EN;
-	fmxr(FPEXC, fpexc);
+	/* vfp_save_state oopses on VFP11 if EX bit set */
+	fmxr(FPEXC, fpexc & ~FPEXC_EX);
 
 	/*
 	 * Save the userland NEON/VFP state. Under UP,
diff --git a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms
index 6b54ee8c1262..e57169584af0 100644
--- a/arch/arm64/Kconfig.platforms
+++ b/arch/arm64/Kconfig.platforms
@@ -1,11 +1,5 @@
 menu "Platform selection"
 
-config ARCH_ACTIONS
-	bool "Actions Semi Platforms"
-	select OWL_TIMER
-	help
-	  This enables support for the Actions Semiconductor S900 SoC family.
-
 config ARCH_SUNXI
 	bool "Allwinner sunxi 64-bit SoC Family"
 	select ARCH_HAS_RESET_CONTROLLER
diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index 7318165cfc90..f6f5df3f262b 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -132,6 +132,9 @@ zinstall install:
 %.dtb: scripts
 	$(Q)$(MAKE) $(build)=$(boot)/dts $(boot)/dts/$@
 
+%.dtbo: | scripts
+	$(Q)$(MAKE) $(build)=$(boot)/dts MACHINE=$(MACHINE) $(boot)/dts/$@
+
 PHONY += dtbs dtbs_install
 
 dtbs: prepare scripts
diff --git a/arch/arm64/boot/dts/broadcom/Makefile b/arch/arm64/boot/dts/broadcom/Makefile
index 3df2db7f8878..f056f542dac4 100644
--- a/arch/arm64/boot/dts/broadcom/Makefile
+++ b/arch/arm64/boot/dts/broadcom/Makefile
@@ -1,7 +1,17 @@
 # SPDX-License-Identifier: GPL-2.0
+# Enable fixups to support overlays on BCM2835 platforms
+
+ifeq ($(CONFIG_ARCH_BCM2835),y)
+DTC_FLAGS ?= -@ -H epapr
+endif
+
 dtb-$(CONFIG_ARCH_BCM2835) += bcm2837-rpi-3-b.dtb
+dtb-$(CONFIG_ARCH_BCM2709) += bcm2710-rpi-3-b.dtb
+dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-3-b.dtb
+dtb-$(CONFIG_ARCH_BCM2835) += bcm2710-rpi-3-b-plus.dtb
+
+dts-dirs += ../overlays
 
-dts-dirs	+= northstar2
 dts-dirs	+= stingray
 always		:= $(dtb-y)
 subdir-y	:= $(dts-dirs)
diff --git a/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts
new file mode 100644
index 000000000000..d9242ff77079
--- /dev/null
+++ b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b-plus.dts
@@ -0,0 +1,3 @@
+#define RPI364
+
+#include "../../../../arm/boot/dts/bcm2710-rpi-3-b-plus.dts"
diff --git a/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b.dts b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b.dts
new file mode 100644
index 000000000000..deb33441da95
--- /dev/null
+++ b/arch/arm64/boot/dts/broadcom/bcm2710-rpi-3-b.dts
@@ -0,0 +1,3 @@
+#define RPI364
+
+#include "../../../../arm/boot/dts/bcm2710-rpi-3-b.dts"
diff --git a/arch/arm64/boot/dts/broadcom/bcm283x-rpi-lan7515.dtsi b/arch/arm64/boot/dts/broadcom/bcm283x-rpi-lan7515.dtsi
new file mode 120000
index 000000000000..fc4c05bbe7fd
--- /dev/null
+++ b/arch/arm64/boot/dts/broadcom/bcm283x-rpi-lan7515.dtsi
@@ -0,0 +1 @@
+../../../../arm/boot/dts/bcm283x-rpi-lan7515.dtsi
\ No newline at end of file
diff --git a/arch/arm64/boot/dts/overlays b/arch/arm64/boot/dts/overlays
new file mode 120000
index 000000000000..ded08646b6f6
--- /dev/null
+++ b/arch/arm64/boot/dts/overlays
@@ -0,0 +1 @@
+../../../arm/boot/dts/overlays
\ No newline at end of file
diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
new file mode 100644
index 000000000000..3ef1f986bcb1
--- /dev/null
+++ b/arch/arm64/configs/bcmrpi3_defconfig
@@ -0,0 +1,1286 @@
+CONFIG_LOCALVERSION="-v8"
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_IKCONFIG=m
+CONFIG_IKCONFIG_PROC=y
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_NAMESPACES=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_EMBEDDED=y
+# CONFIG_COMPAT_BRK is not set
+CONFIG_PROFILING=y
+CONFIG_KPROBES=y
+CONFIG_JUMP_LABEL=y
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_MAC_PARTITION=y
+CONFIG_CFQ_GROUP_IOSCHED=y
+CONFIG_ARCH_BCM2835=y
+# CONFIG_CAVIUM_ERRATUM_22375 is not set
+# CONFIG_CAVIUM_ERRATUM_23154 is not set
+# CONFIG_CAVIUM_ERRATUM_27456 is not set
+CONFIG_SCHED_MC=y
+CONFIG_NR_CPUS=4
+CONFIG_PREEMPT=y
+CONFIG_HZ_1000=y
+CONFIG_CLEANCACHE=y
+CONFIG_FRONTSWAP=y
+CONFIG_CMA=y
+CONFIG_ZSMALLOC=m
+CONFIG_PGTABLE_MAPPING=y
+CONFIG_SECCOMP=y
+CONFIG_ARMV8_DEPRECATED=y
+CONFIG_SWP_EMULATION=y
+CONFIG_CP15_BARRIER_EMULATION=y
+CONFIG_SETEND_EMULATION=y
+CONFIG_RANDOMIZE_BASE=y
+CONFIG_CMDLINE="console=ttyAMA0,115200 kgdboc=ttyAMA0,115200 root=/dev/mmcblk0p2 rootfstype=ext4 rootwait"
+CONFIG_BINFMT_MISC=y
+CONFIG_COMPAT=y
+# CONFIG_SUSPEND is not set
+CONFIG_PM=y
+CONFIG_CPU_IDLE=y
+CONFIG_ARM_CPUIDLE=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_XFRM_USER=y
+CONFIG_NET_KEY=m
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_ROUTE_VERBOSE=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_RARP=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE_DEMUX=m
+CONFIG_NET_IPGRE=m
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
+CONFIG_INET_AH=m
+CONFIG_INET_ESP=m
+CONFIG_INET_IPCOMP=m
+CONFIG_INET_XFRM_MODE_TRANSPORT=m
+CONFIG_INET_XFRM_MODE_TUNNEL=m
+CONFIG_INET_XFRM_MODE_BEET=m
+CONFIG_INET_DIAG=m
+CONFIG_IPV6=m
+CONFIG_IPV6_ROUTER_PREF=y
+CONFIG_INET6_AH=m
+CONFIG_INET6_ESP=m
+CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_TUNNEL=m
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETFILTER=y
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_ZONES=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=m
+CONFIG_NF_CONNTRACK_FTP=m
+CONFIG_NF_CONNTRACK_H323=m
+CONFIG_NF_CONNTRACK_IRC=m
+CONFIG_NF_CONNTRACK_NETBIOS_NS=m
+CONFIG_NF_CONNTRACK_SNMP=m
+CONFIG_NF_CONNTRACK_PPTP=m
+CONFIG_NF_CONNTRACK_SANE=m
+CONFIG_NF_CONNTRACK_SIP=m
+CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_CT_NETLINK=m
+CONFIG_NETFILTER_XT_SET=m
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
+CONFIG_NETFILTER_XT_TARGET_DSCP=m
+CONFIG_NETFILTER_XT_TARGET_HMARK=m
+CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
+CONFIG_NETFILTER_XT_TARGET_LED=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFLOG=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
+CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
+CONFIG_NETFILTER_XT_TARGET_TRACE=m
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
+CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_BPF=m
+CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_CPU=m
+CONFIG_NETFILTER_XT_MATCH_DCCP=m
+CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_ESP=m
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
+CONFIG_NETFILTER_XT_MATCH_IPVS=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_NFACCT=m
+CONFIG_NETFILTER_XT_MATCH_OSF=m
+CONFIG_NETFILTER_XT_MATCH_OWNER=m
+CONFIG_NETFILTER_XT_MATCH_POLICY=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_QUOTA=m
+CONFIG_NETFILTER_XT_MATCH_RATEEST=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
+CONFIG_NETFILTER_XT_MATCH_TIME=m
+CONFIG_NETFILTER_XT_MATCH_U32=m
+CONFIG_IP_SET=m
+CONFIG_IP_SET_BITMAP_IP=m
+CONFIG_IP_SET_BITMAP_IPMAC=m
+CONFIG_IP_SET_BITMAP_PORT=m
+CONFIG_IP_SET_HASH_IP=m
+CONFIG_IP_SET_HASH_IPPORT=m
+CONFIG_IP_SET_HASH_IPPORTIP=m
+CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETPORT=m
+CONFIG_IP_SET_HASH_NETIFACE=m
+CONFIG_IP_SET_LIST_SET=m
+CONFIG_IP_VS=m
+CONFIG_IP_VS_PROTO_TCP=y
+CONFIG_IP_VS_PROTO_UDP=y
+CONFIG_IP_VS_PROTO_ESP=y
+CONFIG_IP_VS_PROTO_AH=y
+CONFIG_IP_VS_PROTO_SCTP=y
+CONFIG_IP_VS_RR=m
+CONFIG_IP_VS_WRR=m
+CONFIG_IP_VS_LC=m
+CONFIG_IP_VS_WLC=m
+CONFIG_IP_VS_LBLC=m
+CONFIG_IP_VS_LBLCR=m
+CONFIG_IP_VS_DH=m
+CONFIG_IP_VS_SH=m
+CONFIG_IP_VS_SED=m
+CONFIG_IP_VS_NQ=m
+CONFIG_IP_VS_FTP=m
+CONFIG_IP_VS_PE_SIP=m
+CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_CLUSTERIP=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_TTL=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_ARPTABLES=m
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_TARGET_HL=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_AMONG=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_MARK=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_MARK_T=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_SCTP_COOKIE_HMAC_SHA1=y
+CONFIG_ATM=m
+CONFIG_L2TP=m
+CONFIG_L2TP_V3=y
+CONFIG_L2TP_IP=m
+CONFIG_L2TP_ETH=m
+CONFIG_BRIDGE=m
+CONFIG_VLAN_8021Q=m
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_ATALK=m
+CONFIG_6LOWPAN=m
+CONFIG_IEEE802154=m
+CONFIG_IEEE802154_6LOWPAN=m
+CONFIG_MAC802154=m
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_CBQ=m
+CONFIG_NET_SCH_HTB=m
+CONFIG_NET_SCH_HFSC=m
+CONFIG_NET_SCH_PRIO=m
+CONFIG_NET_SCH_MULTIQ=m
+CONFIG_NET_SCH_RED=m
+CONFIG_NET_SCH_SFB=m
+CONFIG_NET_SCH_SFQ=m
+CONFIG_NET_SCH_TEQL=m
+CONFIG_NET_SCH_TBF=m
+CONFIG_NET_SCH_GRED=m
+CONFIG_NET_SCH_DSMARK=m
+CONFIG_NET_SCH_NETEM=m
+CONFIG_NET_SCH_DRR=m
+CONFIG_NET_SCH_MQPRIO=m
+CONFIG_NET_SCH_CHOKE=m
+CONFIG_NET_SCH_QFQ=m
+CONFIG_NET_SCH_CODEL=m
+CONFIG_NET_SCH_FQ_CODEL=m
+CONFIG_NET_SCH_INGRESS=m
+CONFIG_NET_SCH_PLUG=m
+CONFIG_NET_SCH_FQ=m
+CONFIG_TCP_CONG_ADVANCED=y
+CONFIG_TCP_CONG_BBR=m
+CONFIG_NET_CLS_BASIC=m
+CONFIG_NET_CLS_TCINDEX=m
+CONFIG_NET_CLS_ROUTE4=m
+CONFIG_NET_CLS_FW=m
+CONFIG_NET_CLS_U32=m
+CONFIG_CLS_U32_MARK=y
+CONFIG_NET_CLS_RSVP=m
+CONFIG_NET_CLS_RSVP6=m
+CONFIG_NET_CLS_FLOW=m
+CONFIG_NET_CLS_CGROUP=m
+CONFIG_NET_EMATCH=y
+CONFIG_NET_EMATCH_CMP=m
+CONFIG_NET_EMATCH_NBYTE=m
+CONFIG_NET_EMATCH_U32=m
+CONFIG_NET_EMATCH_META=m
+CONFIG_NET_EMATCH_TEXT=m
+CONFIG_NET_EMATCH_IPSET=m
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_ACT_POLICE=m
+CONFIG_NET_ACT_GACT=m
+CONFIG_GACT_PROB=y
+CONFIG_NET_ACT_MIRRED=m
+CONFIG_NET_ACT_IPT=m
+CONFIG_NET_ACT_NAT=m
+CONFIG_NET_ACT_PEDIT=m
+CONFIG_NET_ACT_SIMP=m
+CONFIG_NET_ACT_SKBEDIT=m
+CONFIG_NET_ACT_CSUM=m
+CONFIG_BATMAN_ADV=m
+CONFIG_OPENVSWITCH=m
+CONFIG_NET_PKTGEN=m
+CONFIG_HAMRADIO=y
+CONFIG_AX25=m
+CONFIG_NETROM=m
+CONFIG_ROSE=m
+CONFIG_MKISS=m
+CONFIG_6PACK=m
+CONFIG_BPQETHER=m
+CONFIG_BAYCOM_SER_FDX=m
+CONFIG_BAYCOM_SER_HDX=m
+CONFIG_YAM=m
+CONFIG_CAN=m
+CONFIG_CAN_VCAN=m
+CONFIG_CAN_MCP251X=m
+CONFIG_BT=m
+CONFIG_BT_RFCOMM=m
+CONFIG_BT_RFCOMM_TTY=y
+CONFIG_BT_BNEP=m
+CONFIG_BT_BNEP_MC_FILTER=y
+CONFIG_BT_BNEP_PROTO_FILTER=y
+CONFIG_BT_HIDP=m
+CONFIG_BT_6LOWPAN=m
+CONFIG_BT_HCIBTUSB=m
+CONFIG_BT_HCIUART=m
+CONFIG_BT_HCIUART_3WIRE=y
+CONFIG_BT_HCIUART_BCM=y
+CONFIG_BT_HCIBCM203X=m
+CONFIG_BT_HCIBPA10X=m
+CONFIG_BT_HCIBFUSB=m
+CONFIG_BT_HCIVHCI=m
+CONFIG_BT_MRVL=m
+CONFIG_BT_MRVL_SDIO=m
+CONFIG_BT_ATH3K=m
+CONFIG_BT_WILINK=m
+CONFIG_CFG80211=m
+CONFIG_MAC80211=m
+CONFIG_MAC80211_MESH=y
+CONFIG_WIMAX=m
+CONFIG_RFKILL=m
+CONFIG_RFKILL_INPUT=y
+CONFIG_NET_9P=m
+CONFIG_NFC=m
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=5
+CONFIG_MTD=m
+CONFIG_MTD_BLOCK=m
+CONFIG_MTD_NAND=m
+CONFIG_MTD_UBI=m
+CONFIG_OF_CONFIGFS=y
+CONFIG_ZRAM=m
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
+CONFIG_BLK_DEV_NBD=m
+CONFIG_BLK_DEV_RAM=y
+CONFIG_CDROM_PKTCDVD=m
+CONFIG_ATA_OVER_ETH=m
+CONFIG_EEPROM_AT24=m
+CONFIG_TI_ST=m
+CONFIG_SCSI=y
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_BLK_DEV_SD=y
+CONFIG_CHR_DEV_ST=m
+CONFIG_CHR_DEV_OSST=m
+CONFIG_BLK_DEV_SR=m
+CONFIG_CHR_DEV_SG=m
+CONFIG_SCSI_ISCSI_ATTRS=y
+CONFIG_ISCSI_TCP=m
+CONFIG_ISCSI_BOOT_SYSFS=m
+CONFIG_MD=y
+CONFIG_MD_LINEAR=m
+CONFIG_BLK_DEV_DM=m
+CONFIG_DM_CRYPT=m
+CONFIG_DM_SNAPSHOT=m
+CONFIG_DM_THIN_PROVISIONING=m
+CONFIG_DM_CACHE=m
+CONFIG_DM_MIRROR=m
+CONFIG_DM_LOG_USERSPACE=m
+CONFIG_DM_RAID=m
+CONFIG_DM_ZERO=m
+CONFIG_DM_DELAY=m
+CONFIG_NETDEVICES=y
+CONFIG_BONDING=m
+CONFIG_DUMMY=m
+CONFIG_IFB=m
+CONFIG_MACVLAN=m
+CONFIG_VXLAN=m
+CONFIG_NETCONSOLE=m
+CONFIG_TUN=m
+CONFIG_VETH=m
+CONFIG_ENC28J60=m
+CONFIG_QCA7000_SPI=m
+CONFIG_MDIO_BITBANG=m
+CONFIG_PPP=m
+CONFIG_PPP_BSDCOMP=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPP_FILTER=y
+CONFIG_PPP_MPPE=m
+CONFIG_PPP_MULTILINK=y
+CONFIG_PPPOATM=m
+CONFIG_PPPOE=m
+CONFIG_PPPOL2TP=m
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_SYNC_TTY=m
+CONFIG_SLIP=m
+CONFIG_SLIP_COMPRESSED=y
+CONFIG_SLIP_SMART=y
+CONFIG_USB_CATC=m
+CONFIG_USB_KAWETH=m
+CONFIG_USB_PEGASUS=m
+CONFIG_USB_RTL8150=m
+CONFIG_USB_RTL8152=m
+CONFIG_USB_LAN78XX=y
+CONFIG_USB_USBNET=y
+CONFIG_USB_NET_AX8817X=m
+CONFIG_USB_NET_AX88179_178A=m
+CONFIG_USB_NET_CDCETHER=m
+CONFIG_USB_NET_CDC_EEM=m
+CONFIG_USB_NET_CDC_NCM=m
+CONFIG_USB_NET_HUAWEI_CDC_NCM=m
+CONFIG_USB_NET_CDC_MBIM=m
+CONFIG_USB_NET_DM9601=m
+CONFIG_USB_NET_SR9700=m
+CONFIG_USB_NET_SR9800=m
+CONFIG_USB_NET_SMSC75XX=m
+CONFIG_USB_NET_SMSC95XX=y
+CONFIG_USB_NET_GL620A=m
+CONFIG_USB_NET_NET1080=m
+CONFIG_USB_NET_PLUSB=m
+CONFIG_USB_NET_MCS7830=m
+CONFIG_USB_NET_CDC_SUBSET=m
+CONFIG_USB_ALI_M5632=y
+CONFIG_USB_AN2720=y
+CONFIG_USB_EPSON2888=y
+CONFIG_USB_KC2190=y
+CONFIG_USB_NET_ZAURUS=m
+CONFIG_USB_NET_CX82310_ETH=m
+CONFIG_USB_NET_KALMIA=m
+CONFIG_USB_NET_QMI_WWAN=m
+CONFIG_USB_HSO=m
+CONFIG_USB_NET_INT51X1=m
+CONFIG_USB_IPHETH=m
+CONFIG_USB_SIERRA_NET=m
+CONFIG_USB_VL600=m
+CONFIG_ATH9K=m
+CONFIG_ATH9K_HTC=m
+CONFIG_CARL9170=m
+CONFIG_ATH6KL=m
+CONFIG_ATH6KL_USB=m
+CONFIG_AR5523=m
+CONFIG_AT76C50X_USB=m
+CONFIG_B43=m
+# CONFIG_B43_PHY_N is not set
+CONFIG_B43LEGACY=m
+CONFIG_BRCMFMAC=m
+CONFIG_BRCMFMAC_USB=y
+CONFIG_HOSTAP=m
+CONFIG_P54_COMMON=m
+CONFIG_P54_USB=m
+CONFIG_LIBERTAS=m
+CONFIG_LIBERTAS_USB=m
+CONFIG_LIBERTAS_SDIO=m
+CONFIG_LIBERTAS_THINFIRM=m
+CONFIG_LIBERTAS_THINFIRM_USB=m
+CONFIG_MWIFIEX=m
+CONFIG_MWIFIEX_SDIO=m
+CONFIG_MT7601U=m
+CONFIG_RT2X00=m
+CONFIG_RT2500USB=m
+CONFIG_RT73USB=m
+CONFIG_RT2800USB=m
+CONFIG_RT2800USB_RT3573=y
+CONFIG_RT2800USB_RT53XX=y
+CONFIG_RT2800USB_RT55XX=y
+CONFIG_RT2800USB_UNKNOWN=y
+CONFIG_RTL8187=m
+CONFIG_RTL8192CU=m
+CONFIG_USB_ZD1201=m
+CONFIG_ZD1211RW=m
+CONFIG_MAC80211_HWSIM=m
+CONFIG_USB_NET_RNDIS_WLAN=m
+CONFIG_WIMAX_I2400M_USB=m
+CONFIG_IEEE802154_AT86RF230=m
+CONFIG_IEEE802154_MRF24J40=m
+CONFIG_IEEE802154_CC2520=m
+CONFIG_INPUT_POLLDEV=m
+CONFIG_INPUT_JOYDEV=m
+CONFIG_INPUT_EVDEV=m
+# CONFIG_KEYBOARD_ATKBD is not set
+CONFIG_KEYBOARD_GPIO=m
+CONFIG_KEYBOARD_MATRIX=m
+# CONFIG_INPUT_MOUSE is not set
+CONFIG_INPUT_JOYSTICK=y
+CONFIG_JOYSTICK_IFORCE=m
+CONFIG_JOYSTICK_IFORCE_USB=y
+CONFIG_JOYSTICK_XPAD=m
+CONFIG_JOYSTICK_XPAD_FF=y
+CONFIG_JOYSTICK_XPAD_LEDS=y
+CONFIG_JOYSTICK_RPISENSE=m
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_ADS7846=m
+CONFIG_TOUCHSCREEN_EGALAX=m
+CONFIG_TOUCHSCREEN_EKTF2127=m
+CONFIG_TOUCHSCREEN_RPI_FT5406=m
+CONFIG_TOUCHSCREEN_USB_COMPOSITE=m
+CONFIG_TOUCHSCREEN_STMPE=m
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_AD714X=m
+CONFIG_INPUT_ATI_REMOTE2=m
+CONFIG_INPUT_KEYSPAN_REMOTE=m
+CONFIG_INPUT_POWERMATE=m
+CONFIG_INPUT_YEALINK=m
+CONFIG_INPUT_CM109=m
+CONFIG_INPUT_UINPUT=m
+CONFIG_INPUT_GPIO_ROTARY_ENCODER=m
+CONFIG_INPUT_ADXL34X=m
+CONFIG_INPUT_CMA3000=m
+CONFIG_SERIO=m
+CONFIG_SERIO_RAW=m
+CONFIG_GAMEPORT=m
+CONFIG_GAMEPORT_NS558=m
+CONFIG_GAMEPORT_L4=m
+CONFIG_BRCM_CHAR_DRIVERS=y
+CONFIG_BCM_VCIO=y
+CONFIG_BCM2835_DEVGPIOMEM=y
+# CONFIG_BCM2835_SMI_DEV is not set
+# CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_8250=y
+# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
+CONFIG_SERIAL_8250_CONSOLE=y
+# CONFIG_SERIAL_8250_DMA is not set
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=0
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_BCM2835AUX=y
+CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_SC16IS7XX=m
+CONFIG_SERIAL_SC16IS7XX_SPI=y
+CONFIG_SERIAL_DEV_BUS=m
+CONFIG_TTY_PRINTK=y
+CONFIG_HW_RANDOM=y
+CONFIG_RAW_DRIVER=y
+CONFIG_I2C=y
+CONFIG_I2C_CHARDEV=m
+CONFIG_I2C_MUX_PCA954x=m
+CONFIG_I2C_BCM2708=m
+CONFIG_I2C_BCM2835=m
+CONFIG_I2C_GPIO=m
+CONFIG_SPI=y
+CONFIG_SPI_BCM2835=m
+CONFIG_SPI_BCM2835AUX=m
+CONFIG_SPI_SPIDEV=y
+CONFIG_PPS=m
+CONFIG_PPS_CLIENT_LDISC=m
+CONFIG_PPS_CLIENT_GPIO=m
+CONFIG_GPIO_SYSFS=y
+CONFIG_GPIO_BCM_EXP=y
+CONFIG_GPIO_BCM_VIRT=y
+CONFIG_GPIO_ARIZONA=m
+CONFIG_GPIO_STMPE=y
+CONFIG_W1=m
+CONFIG_W1_MASTER_DS2490=m
+CONFIG_W1_MASTER_DS2482=m
+CONFIG_W1_MASTER_DS1WM=m
+CONFIG_W1_MASTER_GPIO=m
+CONFIG_W1_SLAVE_THERM=m
+CONFIG_W1_SLAVE_SMEM=m
+CONFIG_W1_SLAVE_DS2408=m
+CONFIG_W1_SLAVE_DS2413=m
+CONFIG_W1_SLAVE_DS2406=m
+CONFIG_W1_SLAVE_DS2423=m
+CONFIG_W1_SLAVE_DS2431=m
+CONFIG_W1_SLAVE_DS2433=m
+CONFIG_W1_SLAVE_DS2760=m
+CONFIG_W1_SLAVE_DS2780=m
+CONFIG_W1_SLAVE_DS2781=m
+CONFIG_W1_SLAVE_DS28E04=m
+CONFIG_POWER_RESET_GPIO=y
+CONFIG_BATTERY_DS2760=m
+CONFIG_HWMON=m
+CONFIG_SENSORS_LM75=m
+CONFIG_SENSORS_SHT21=m
+CONFIG_SENSORS_SHTC1=m
+CONFIG_SENSORS_INA2XX=m
+CONFIG_THERMAL=y
+CONFIG_BCM2835_THERMAL=y
+CONFIG_WATCHDOG=y
+CONFIG_BCM2835_WDT=y
+CONFIG_MFD_STMPE=y
+CONFIG_STMPE_SPI=y
+CONFIG_MFD_ARIZONA_I2C=m
+CONFIG_MFD_ARIZONA_SPI=m
+CONFIG_MFD_WM5102=y
+CONFIG_LIRC=m
+CONFIG_RC_DEVICES=y
+CONFIG_RC_ATI_REMOTE=m
+CONFIG_IR_IMON=m
+CONFIG_IR_MCEUSB=m
+CONFIG_IR_REDRAT3=m
+CONFIG_IR_STREAMZAP=m
+CONFIG_IR_IGUANA=m
+CONFIG_IR_TTUSBIR=m
+CONFIG_RC_LOOPBACK=m
+CONFIG_IR_GPIO_CIR=m
+CONFIG_MEDIA_SUPPORT=m
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_ANALOG_TV_SUPPORT=y
+CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y
+CONFIG_MEDIA_RADIO_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_MEDIA_USB_SUPPORT=y
+CONFIG_USB_VIDEO_CLASS=m
+CONFIG_USB_M5602=m
+CONFIG_USB_STV06XX=m
+CONFIG_USB_GL860=m
+CONFIG_USB_GSPCA_BENQ=m
+CONFIG_USB_GSPCA_CONEX=m
+CONFIG_USB_GSPCA_CPIA1=m
+CONFIG_USB_GSPCA_DTCS033=m
+CONFIG_USB_GSPCA_ETOMS=m
+CONFIG_USB_GSPCA_FINEPIX=m
+CONFIG_USB_GSPCA_JEILINJ=m
+CONFIG_USB_GSPCA_JL2005BCD=m
+CONFIG_USB_GSPCA_KINECT=m
+CONFIG_USB_GSPCA_KONICA=m
+CONFIG_USB_GSPCA_MARS=m
+CONFIG_USB_GSPCA_MR97310A=m
+CONFIG_USB_GSPCA_NW80X=m
+CONFIG_USB_GSPCA_OV519=m
+CONFIG_USB_GSPCA_OV534=m
+CONFIG_USB_GSPCA_OV534_9=m
+CONFIG_USB_GSPCA_PAC207=m
+CONFIG_USB_GSPCA_PAC7302=m
+CONFIG_USB_GSPCA_PAC7311=m
+CONFIG_USB_GSPCA_SE401=m
+CONFIG_USB_GSPCA_SN9C2028=m
+CONFIG_USB_GSPCA_SN9C20X=m
+CONFIG_USB_GSPCA_SONIXB=m
+CONFIG_USB_GSPCA_SONIXJ=m
+CONFIG_USB_GSPCA_SPCA500=m
+CONFIG_USB_GSPCA_SPCA501=m
+CONFIG_USB_GSPCA_SPCA505=m
+CONFIG_USB_GSPCA_SPCA506=m
+CONFIG_USB_GSPCA_SPCA508=m
+CONFIG_USB_GSPCA_SPCA561=m
+CONFIG_USB_GSPCA_SPCA1528=m
+CONFIG_USB_GSPCA_SQ905=m
+CONFIG_USB_GSPCA_SQ905C=m
+CONFIG_USB_GSPCA_SQ930X=m
+CONFIG_USB_GSPCA_STK014=m
+CONFIG_USB_GSPCA_STK1135=m
+CONFIG_USB_GSPCA_STV0680=m
+CONFIG_USB_GSPCA_SUNPLUS=m
+CONFIG_USB_GSPCA_T613=m
+CONFIG_USB_GSPCA_TOPRO=m
+CONFIG_USB_GSPCA_TV8532=m
+CONFIG_USB_GSPCA_VC032X=m
+CONFIG_USB_GSPCA_VICAM=m
+CONFIG_USB_GSPCA_XIRLINK_CIT=m
+CONFIG_USB_GSPCA_ZC3XX=m
+CONFIG_USB_PWC=m
+CONFIG_VIDEO_CPIA2=m
+CONFIG_USB_ZR364XX=m
+CONFIG_USB_STKWEBCAM=m
+CONFIG_USB_S2255=m
+CONFIG_VIDEO_USBTV=m
+CONFIG_VIDEO_PVRUSB2=m
+CONFIG_VIDEO_HDPVR=m
+CONFIG_VIDEO_USBVISION=m
+CONFIG_VIDEO_STK1160_COMMON=m
+CONFIG_VIDEO_GO7007=m
+CONFIG_VIDEO_GO7007_USB=m
+CONFIG_VIDEO_GO7007_USB_S2250_BOARD=m
+CONFIG_VIDEO_AU0828=m
+CONFIG_VIDEO_AU0828_RC=y
+CONFIG_VIDEO_CX231XX=m
+CONFIG_VIDEO_CX231XX_ALSA=m
+CONFIG_VIDEO_CX231XX_DVB=m
+CONFIG_VIDEO_TM6000=m
+CONFIG_VIDEO_TM6000_ALSA=m
+CONFIG_VIDEO_TM6000_DVB=m
+CONFIG_DVB_USB=m
+CONFIG_DVB_USB_A800=m
+CONFIG_DVB_USB_DIBUSB_MB=m
+CONFIG_DVB_USB_DIBUSB_MB_FAULTY=y
+CONFIG_DVB_USB_DIBUSB_MC=m
+CONFIG_DVB_USB_DIB0700=m
+CONFIG_DVB_USB_UMT_010=m
+CONFIG_DVB_USB_CXUSB=m
+CONFIG_DVB_USB_M920X=m
+CONFIG_DVB_USB_DIGITV=m
+CONFIG_DVB_USB_VP7045=m
+CONFIG_DVB_USB_VP702X=m
+CONFIG_DVB_USB_GP8PSK=m
+CONFIG_DVB_USB_NOVA_T_USB2=m
+CONFIG_DVB_USB_TTUSB2=m
+CONFIG_DVB_USB_DTT200U=m
+CONFIG_DVB_USB_OPERA1=m
+CONFIG_DVB_USB_AF9005=m
+CONFIG_DVB_USB_AF9005_REMOTE=m
+CONFIG_DVB_USB_PCTV452E=m
+CONFIG_DVB_USB_DW2102=m
+CONFIG_DVB_USB_CINERGY_T2=m
+CONFIG_DVB_USB_DTV5100=m
+CONFIG_DVB_USB_FRIIO=m
+CONFIG_DVB_USB_AZ6027=m
+CONFIG_DVB_USB_TECHNISAT_USB2=m
+CONFIG_DVB_USB_V2=m
+CONFIG_DVB_USB_AF9015=m
+CONFIG_DVB_USB_AF9035=m
+CONFIG_DVB_USB_ANYSEE=m
+CONFIG_DVB_USB_AU6610=m
+CONFIG_DVB_USB_AZ6007=m
+CONFIG_DVB_USB_CE6230=m
+CONFIG_DVB_USB_EC168=m
+CONFIG_DVB_USB_GL861=m
+CONFIG_DVB_USB_LME2510=m
+CONFIG_DVB_USB_MXL111SF=m
+CONFIG_DVB_USB_RTL28XXU=m
+CONFIG_DVB_USB_DVBSKY=m
+CONFIG_SMS_USB_DRV=m
+CONFIG_DVB_B2C2_FLEXCOP_USB=m
+CONFIG_DVB_AS102=m
+CONFIG_VIDEO_EM28XX=m
+CONFIG_VIDEO_EM28XX_V4L2=m
+CONFIG_VIDEO_EM28XX_ALSA=m
+CONFIG_VIDEO_EM28XX_DVB=m
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_RADIO_SI470X=y
+CONFIG_USB_SI470X=m
+CONFIG_I2C_SI470X=m
+CONFIG_RADIO_SI4713=m
+CONFIG_I2C_SI4713=m
+CONFIG_USB_MR800=m
+CONFIG_USB_DSBR=m
+CONFIG_RADIO_SHARK=m
+CONFIG_RADIO_SHARK2=m
+CONFIG_USB_KEENE=m
+CONFIG_USB_MA901=m
+CONFIG_RADIO_TEA5764=m
+CONFIG_RADIO_SAA7706H=m
+CONFIG_RADIO_TEF6862=m
+CONFIG_RADIO_WL1273=m
+CONFIG_RADIO_WL128X=m
+# CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
+CONFIG_VIDEO_UDA1342=m
+CONFIG_VIDEO_SONY_BTF_MPX=m
+CONFIG_VIDEO_TVP5150=m
+CONFIG_VIDEO_TW2804=m
+CONFIG_VIDEO_TW9903=m
+CONFIG_VIDEO_TW9906=m
+CONFIG_VIDEO_OV7640=m
+CONFIG_VIDEO_MT9V011=m
+CONFIG_DRM=m
+CONFIG_DRM_LOAD_EDID_FIRMWARE=y
+CONFIG_DRM_UDL=m
+CONFIG_DRM_PANEL_SIMPLE=m
+CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN=m
+CONFIG_DRM_VC4=m
+CONFIG_FB=y
+CONFIG_FB_BCM2708=y
+CONFIG_FB_UDL=m
+CONFIG_FB_SSD1307=m
+CONFIG_FB_RPISENSE=m
+# CONFIG_BACKLIGHT_GENERIC is not set
+CONFIG_BACKLIGHT_RPI=m
+CONFIG_BACKLIGHT_GPIO=m
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_LOGO=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_SOUND=y
+CONFIG_SND=m
+CONFIG_SND_HRTIMER=m
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_DUMMY=m
+CONFIG_SND_ALOOP=m
+CONFIG_SND_VIRMIDI=m
+CONFIG_SND_MTPAV=m
+CONFIG_SND_SERIAL_U16550=m
+CONFIG_SND_MPU401=m
+CONFIG_SND_USB_AUDIO=m
+CONFIG_SND_USB_UA101=m
+CONFIG_SND_USB_CAIAQ=m
+CONFIG_SND_USB_CAIAQ_INPUT=y
+CONFIG_SND_USB_6FIRE=m
+CONFIG_SND_SOC=m
+CONFIG_SND_BCM2835_SOC_I2S=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI=m
+CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP=m
+CONFIG_SND_BCM2708_SOC_RPI_DAC=m
+CONFIG_SND_BCM2708_SOC_RPI_PROTO=m
+CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC=m
+CONFIG_SND_BCM2708_SOC_JUSTBOOM_DIGI=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC=m
+CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI=m
+CONFIG_SND_BCM2708_SOC_ADAU1977_ADC=m
+CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD=m
+CONFIG_SND_DIGIDAC1_SOUNDCARD=m
+CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO=m
+CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC=m
+CONFIG_SND_PISOUND=m
+CONFIG_SND_SOC_ADAU1701=m
+CONFIG_SND_SOC_AK4554=m
+CONFIG_SND_SOC_CS4271_I2C=m
+CONFIG_SND_SOC_WM8804_I2C=m
+CONFIG_SND_SIMPLE_CARD=m
+CONFIG_HIDRAW=y
+CONFIG_UHID=m
+CONFIG_HID_A4TECH=m
+CONFIG_HID_ACRUX=m
+CONFIG_HID_APPLE=m
+CONFIG_HID_BELKIN=m
+CONFIG_HID_BETOP_FF=m
+CONFIG_HID_CHERRY=m
+CONFIG_HID_CHICONY=m
+CONFIG_HID_CYPRESS=m
+CONFIG_HID_DRAGONRISE=m
+CONFIG_HID_EMS_FF=m
+CONFIG_HID_ELECOM=m
+CONFIG_HID_ELO=m
+CONFIG_HID_EZKEY=m
+CONFIG_HID_GEMBIRD=m
+CONFIG_HID_HOLTEK=m
+CONFIG_HID_KEYTOUCH=m
+CONFIG_HID_KYE=m
+CONFIG_HID_UCLOGIC=m
+CONFIG_HID_WALTOP=m
+CONFIG_HID_GYRATION=m
+CONFIG_HID_TWINHAN=m
+CONFIG_HID_KENSINGTON=m
+CONFIG_HID_LCPOWER=m
+CONFIG_HID_LOGITECH=m
+CONFIG_HID_LOGITECH_DJ=m
+CONFIG_LOGITECH_FF=y
+CONFIG_LOGIRUMBLEPAD2_FF=y
+CONFIG_LOGIG940_FF=y
+CONFIG_HID_MAGICMOUSE=m
+CONFIG_HID_MICROSOFT=m
+CONFIG_HID_MONTEREY=m
+CONFIG_HID_MULTITOUCH=m
+CONFIG_HID_NTRIG=m
+CONFIG_HID_ORTEK=m
+CONFIG_HID_PANTHERLORD=m
+CONFIG_HID_PETALYNX=m
+CONFIG_HID_PICOLCD=m
+CONFIG_HID_ROCCAT=m
+CONFIG_HID_SAMSUNG=m
+CONFIG_HID_SONY=m
+CONFIG_HID_SPEEDLINK=m
+CONFIG_HID_SUNPLUS=m
+CONFIG_HID_GREENASIA=m
+CONFIG_HID_SMARTJOYPLUS=m
+CONFIG_HID_TOPSEED=m
+CONFIG_HID_THINGM=m
+CONFIG_HID_THRUSTMASTER=m
+CONFIG_HID_WACOM=m
+CONFIG_HID_WIIMOTE=m
+CONFIG_HID_XINMO=m
+CONFIG_HID_ZEROPLUS=m
+CONFIG_HID_ZYDACRON=m
+CONFIG_HID_PID=y
+CONFIG_USB_HIDDEV=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_MON=m
+CONFIG_USB_DWCOTG=y
+CONFIG_USB_PRINTER=m
+CONFIG_USB_STORAGE=y
+CONFIG_USB_STORAGE_REALTEK=m
+CONFIG_USB_STORAGE_DATAFAB=m
+CONFIG_USB_STORAGE_FREECOM=m
+CONFIG_USB_STORAGE_ISD200=m
+CONFIG_USB_STORAGE_USBAT=m
+CONFIG_USB_STORAGE_SDDR09=m
+CONFIG_USB_STORAGE_SDDR55=m
+CONFIG_USB_STORAGE_JUMPSHOT=m
+CONFIG_USB_STORAGE_ALAUDA=m
+CONFIG_USB_STORAGE_ONETOUCH=m
+CONFIG_USB_STORAGE_KARMA=m
+CONFIG_USB_STORAGE_CYPRESS_ATACB=m
+CONFIG_USB_STORAGE_ENE_UB6250=m
+CONFIG_USB_MDC800=m
+CONFIG_USB_MICROTEK=m
+CONFIG_USBIP_CORE=m
+CONFIG_USBIP_VHCI_HCD=m
+CONFIG_USBIP_HOST=m
+CONFIG_USB_DWC2=y
+CONFIG_USB_SERIAL=m
+CONFIG_USB_SERIAL_GENERIC=y
+CONFIG_USB_SERIAL_AIRCABLE=m
+CONFIG_USB_SERIAL_ARK3116=m
+CONFIG_USB_SERIAL_BELKIN=m
+CONFIG_USB_SERIAL_CH341=m
+CONFIG_USB_SERIAL_WHITEHEAT=m
+CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
+CONFIG_USB_SERIAL_CP210X=m
+CONFIG_USB_SERIAL_CYPRESS_M8=m
+CONFIG_USB_SERIAL_EMPEG=m
+CONFIG_USB_SERIAL_FTDI_SIO=m
+CONFIG_USB_SERIAL_VISOR=m
+CONFIG_USB_SERIAL_IPAQ=m
+CONFIG_USB_SERIAL_IR=m
+CONFIG_USB_SERIAL_EDGEPORT=m
+CONFIG_USB_SERIAL_EDGEPORT_TI=m
+CONFIG_USB_SERIAL_F81232=m
+CONFIG_USB_SERIAL_GARMIN=m
+CONFIG_USB_SERIAL_IPW=m
+CONFIG_USB_SERIAL_IUU=m
+CONFIG_USB_SERIAL_KEYSPAN_PDA=m
+CONFIG_USB_SERIAL_KEYSPAN=m
+CONFIG_USB_SERIAL_KLSI=m
+CONFIG_USB_SERIAL_KOBIL_SCT=m
+CONFIG_USB_SERIAL_MCT_U232=m
+CONFIG_USB_SERIAL_METRO=m
+CONFIG_USB_SERIAL_MOS7720=m
+CONFIG_USB_SERIAL_MOS7840=m
+CONFIG_USB_SERIAL_NAVMAN=m
+CONFIG_USB_SERIAL_PL2303=m
+CONFIG_USB_SERIAL_OTI6858=m
+CONFIG_USB_SERIAL_QCAUX=m
+CONFIG_USB_SERIAL_QUALCOMM=m
+CONFIG_USB_SERIAL_SPCP8X5=m
+CONFIG_USB_SERIAL_SAFE=m
+CONFIG_USB_SERIAL_SIERRAWIRELESS=m
+CONFIG_USB_SERIAL_SYMBOL=m
+CONFIG_USB_SERIAL_TI=m
+CONFIG_USB_SERIAL_CYBERJACK=m
+CONFIG_USB_SERIAL_XIRCOM=m
+CONFIG_USB_SERIAL_OPTION=m
+CONFIG_USB_SERIAL_OMNINET=m
+CONFIG_USB_SERIAL_OPTICON=m
+CONFIG_USB_SERIAL_XSENS_MT=m
+CONFIG_USB_SERIAL_WISHBONE=m
+CONFIG_USB_SERIAL_SSU100=m
+CONFIG_USB_SERIAL_QT2=m
+CONFIG_USB_SERIAL_DEBUG=m
+CONFIG_USB_EMI62=m
+CONFIG_USB_EMI26=m
+CONFIG_USB_ADUTUX=m
+CONFIG_USB_SEVSEG=m
+CONFIG_USB_RIO500=m
+CONFIG_USB_LEGOTOWER=m
+CONFIG_USB_LCD=m
+CONFIG_USB_CYPRESS_CY7C63=m
+CONFIG_USB_CYTHERM=m
+CONFIG_USB_IDMOUSE=m
+CONFIG_USB_FTDI_ELAN=m
+CONFIG_USB_APPLEDISPLAY=m
+CONFIG_USB_LD=m
+CONFIG_USB_TRANCEVIBRATOR=m
+CONFIG_USB_IOWARRIOR=m
+CONFIG_USB_TEST=m
+CONFIG_USB_ISIGHTFW=m
+CONFIG_USB_YUREX=m
+CONFIG_USB_ATM=m
+CONFIG_USB_SPEEDTOUCH=m
+CONFIG_USB_CXACRU=m
+CONFIG_USB_UEAGLEATM=m
+CONFIG_USB_XUSBATM=m
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_BCM2835_MMC=y
+CONFIG_MMC_BCM2835_DMA=y
+CONFIG_MMC_BCM2835_SDHOST=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_IPROC=m
+CONFIG_MMC_SPI=m
+CONFIG_MMC_BCM2835=y
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_ONESHOT=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_BACKLIGHT=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_GPIO=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+CONFIG_LEDS_TRIGGER_TRANSIENT=m
+CONFIG_LEDS_TRIGGER_CAMERA=m
+CONFIG_LEDS_TRIGGER_INPUT=y
+CONFIG_LEDS_TRIGGER_PANIC=y
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_HCTOSYS is not set
+CONFIG_RTC_DRV_ABX80X=m
+CONFIG_RTC_DRV_DS1307=m
+CONFIG_RTC_DRV_DS1374=m
+CONFIG_RTC_DRV_DS1672=m
+CONFIG_RTC_DRV_MAX6900=m
+CONFIG_RTC_DRV_RS5C372=m
+CONFIG_RTC_DRV_ISL1208=m
+CONFIG_RTC_DRV_ISL12022=m
+CONFIG_RTC_DRV_X1205=m
+CONFIG_RTC_DRV_PCF8523=m
+CONFIG_RTC_DRV_PCF8563=m
+CONFIG_RTC_DRV_PCF8583=m
+CONFIG_RTC_DRV_M41T80=m
+CONFIG_RTC_DRV_BQ32K=m
+CONFIG_RTC_DRV_S35390A=m
+CONFIG_RTC_DRV_FM3130=m
+CONFIG_RTC_DRV_RX8581=m
+CONFIG_RTC_DRV_RX8025=m
+CONFIG_RTC_DRV_EM3027=m
+CONFIG_RTC_DRV_M41T93=m
+CONFIG_RTC_DRV_M41T94=m
+CONFIG_RTC_DRV_DS1302=m
+CONFIG_RTC_DRV_DS1305=m
+CONFIG_RTC_DRV_DS1390=m
+CONFIG_RTC_DRV_R9701=m
+CONFIG_RTC_DRV_RX4581=m
+CONFIG_RTC_DRV_RS5C348=m
+CONFIG_RTC_DRV_MAX6902=m
+CONFIG_RTC_DRV_PCF2123=m
+CONFIG_RTC_DRV_DS3232=m
+CONFIG_RTC_DRV_PCF2127=m
+CONFIG_RTC_DRV_RV3029C2=m
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2835=y
+CONFIG_DMA_BCM2708=y
+CONFIG_UIO=m
+CONFIG_UIO_PDRV_GENIRQ=m
+CONFIG_STAGING=y
+CONFIG_IRDA=m
+CONFIG_IRLAN=m
+CONFIG_IRNET=m
+CONFIG_IRCOMM=m
+CONFIG_IRDA_ULTRA=y
+CONFIG_IRDA_CACHE_LAST_LSAP=y
+CONFIG_IRDA_FAST_RR=y
+CONFIG_IRTTY_SIR=m
+CONFIG_KINGSUN_DONGLE=m
+CONFIG_KSDAZZLE_DONGLE=m
+CONFIG_KS959_DONGLE=m
+CONFIG_USB_IRDA=m
+CONFIG_SIGMATEL_FIR=m
+CONFIG_MCS_FIR=m
+CONFIG_PRISM2_USB=m
+CONFIG_R8712U=m
+CONFIG_R8188EU=m
+CONFIG_VT6656=m
+CONFIG_SPEAKUP=m
+CONFIG_SPEAKUP_SYNTH_SOFT=m
+CONFIG_STAGING_MEDIA=y
+CONFIG_LIRC_STAGING=y
+CONFIG_LIRC_RPI=m
+CONFIG_FB_TFT=m
+CONFIG_FB_TFT_AGM1264K_FL=m
+CONFIG_FB_TFT_BD663474=m
+CONFIG_FB_TFT_HX8340BN=m
+CONFIG_FB_TFT_HX8347D=m
+CONFIG_FB_TFT_HX8353D=m
+CONFIG_FB_TFT_HX8357D=m
+CONFIG_FB_TFT_ILI9163=m
+CONFIG_FB_TFT_ILI9320=m
+CONFIG_FB_TFT_ILI9325=m
+CONFIG_FB_TFT_ILI9340=m
+CONFIG_FB_TFT_ILI9341=m
+CONFIG_FB_TFT_ILI9481=m
+CONFIG_FB_TFT_ILI9486=m
+CONFIG_FB_TFT_PCD8544=m
+CONFIG_FB_TFT_RA8875=m
+CONFIG_FB_TFT_S6D02A1=m
+CONFIG_FB_TFT_S6D1121=m
+CONFIG_FB_TFT_SSD1289=m
+CONFIG_FB_TFT_SSD1306=m
+CONFIG_FB_TFT_SSD1331=m
+CONFIG_FB_TFT_SSD1351=m
+CONFIG_FB_TFT_ST7735R=m
+CONFIG_FB_TFT_TINYLCD=m
+CONFIG_FB_TFT_TLS8204=m
+CONFIG_FB_TFT_UC1701=m
+CONFIG_FB_TFT_UPD161704=m
+CONFIG_FB_TFT_WATTEROTT=m
+CONFIG_FB_FLEX=m
+CONFIG_FB_TFT_FBTFT_DEVICE=m
+CONFIG_SND_BCM2835=m
+CONFIG_MAILBOX=y
+CONFIG_BCM2835_MBOX=y
+# CONFIG_IOMMU_SUPPORT is not set
+CONFIG_RASPBERRYPI_POWER=y
+CONFIG_EXTCON=m
+CONFIG_EXTCON_ARIZONA=m
+CONFIG_IIO=m
+CONFIG_IIO_BUFFER=y
+CONFIG_IIO_BUFFER_CB=m
+CONFIG_IIO_KFIFO_BUF=m
+CONFIG_MCP320X=m
+CONFIG_MCP3422=m
+CONFIG_DHT11=m
+CONFIG_HTU21=m
+CONFIG_PWM_BCM2835=m
+CONFIG_PWM_PCA9685=m
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_REISERFS_FS=m
+CONFIG_REISERFS_FS_XATTR=y
+CONFIG_REISERFS_FS_POSIX_ACL=y
+CONFIG_REISERFS_FS_SECURITY=y
+CONFIG_JFS_FS=m
+CONFIG_JFS_POSIX_ACL=y
+CONFIG_JFS_SECURITY=y
+CONFIG_JFS_STATISTICS=y
+CONFIG_XFS_FS=m
+CONFIG_XFS_QUOTA=y
+CONFIG_XFS_POSIX_ACL=y
+CONFIG_XFS_RT=y
+CONFIG_GFS2_FS=m
+CONFIG_OCFS2_FS=m
+CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_NILFS2_FS=m
+CONFIG_F2FS_FS=y
+CONFIG_FANOTIFY=y
+CONFIG_QFMT_V1=m
+CONFIG_QFMT_V2=m
+CONFIG_AUTOFS4_FS=y
+CONFIG_FUSE_FS=m
+CONFIG_CUSE=m
+CONFIG_OVERLAY_FS=m
+CONFIG_FSCACHE=y
+CONFIG_FSCACHE_STATS=y
+CONFIG_FSCACHE_HISTOGRAM=y
+CONFIG_CACHEFILES=y
+CONFIG_ISO9660_FS=m
+CONFIG_JOLIET=y
+CONFIG_ZISOFS=y
+CONFIG_UDF_FS=m
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_FAT_DEFAULT_IOCHARSET="ascii"
+CONFIG_NTFS_FS=m
+CONFIG_NTFS_RW=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_ECRYPT_FS=m
+CONFIG_HFS_FS=m
+CONFIG_HFSPLUS_FS=m
+CONFIG_JFFS2_FS=m
+CONFIG_JFFS2_SUMMARY=y
+CONFIG_UBIFS_FS=m
+CONFIG_SQUASHFS=m
+CONFIG_SQUASHFS_XATTR=y
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_NFS_FS=y
+CONFIG_NFS_V3_ACL=y
+CONFIG_NFS_V4=y
+CONFIG_NFS_SWAP=y
+CONFIG_ROOT_NFS=y
+CONFIG_NFS_FSCACHE=y
+CONFIG_NFSD=m
+CONFIG_NFSD_V3_ACL=y
+CONFIG_NFSD_V4=y
+CONFIG_CIFS=m
+CONFIG_CIFS_WEAK_PW_HASH=y
+CONFIG_CIFS_UPCALL=y
+CONFIG_CIFS_XATTR=y
+CONFIG_CIFS_POSIX=y
+CONFIG_CIFS_ACL=y
+CONFIG_CIFS_DFS_UPCALL=y
+CONFIG_CIFS_FSCACHE=y
+CONFIG_9P_FS=m
+CONFIG_9P_FS_POSIX_ACL=y
+CONFIG_NLS_DEFAULT="utf8"
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_CODEPAGE_737=m
+CONFIG_NLS_CODEPAGE_775=m
+CONFIG_NLS_CODEPAGE_850=m
+CONFIG_NLS_CODEPAGE_852=m
+CONFIG_NLS_CODEPAGE_855=m
+CONFIG_NLS_CODEPAGE_857=m
+CONFIG_NLS_CODEPAGE_860=m
+CONFIG_NLS_CODEPAGE_861=m
+CONFIG_NLS_CODEPAGE_862=m
+CONFIG_NLS_CODEPAGE_863=m
+CONFIG_NLS_CODEPAGE_864=m
+CONFIG_NLS_CODEPAGE_865=m
+CONFIG_NLS_CODEPAGE_866=m
+CONFIG_NLS_CODEPAGE_869=m
+CONFIG_NLS_CODEPAGE_936=m
+CONFIG_NLS_CODEPAGE_950=m
+CONFIG_NLS_CODEPAGE_932=m
+CONFIG_NLS_CODEPAGE_949=m
+CONFIG_NLS_CODEPAGE_874=m
+CONFIG_NLS_ISO8859_8=m
+CONFIG_NLS_CODEPAGE_1250=m
+CONFIG_NLS_CODEPAGE_1251=m
+CONFIG_NLS_ASCII=y
+CONFIG_NLS_ISO8859_1=m
+CONFIG_NLS_ISO8859_2=m
+CONFIG_NLS_ISO8859_3=m
+CONFIG_NLS_ISO8859_4=m
+CONFIG_NLS_ISO8859_5=m
+CONFIG_NLS_ISO8859_6=m
+CONFIG_NLS_ISO8859_7=m
+CONFIG_NLS_ISO8859_9=m
+CONFIG_NLS_ISO8859_13=m
+CONFIG_NLS_ISO8859_14=m
+CONFIG_NLS_ISO8859_15=m
+CONFIG_NLS_KOI8_R=m
+CONFIG_NLS_KOI8_U=m
+CONFIG_DLM=m
+CONFIG_PRINTK_TIME=y
+CONFIG_BOOT_PRINTK_DELAY=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_LATENCYTOP=y
+CONFIG_IRQSOFF_TRACER=y
+CONFIG_SCHED_TRACER=y
+CONFIG_STACK_TRACER=y
+CONFIG_BLK_DEV_IO_TRACE=y
+CONFIG_FUNCTION_PROFILER=y
+CONFIG_KGDB=y
+CONFIG_KGDB_KDB=y
+CONFIG_KDB_KEYBOARD=y
+CONFIG_CRYPTO_USER=m
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CTS=m
+CONFIG_CRYPTO_XTS=m
+CONFIG_CRYPTO_XCBC=m
+CONFIG_CRYPTO_TGR192=m
+CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_CAST5=m
+CONFIG_CRYPTO_DES=y
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_USER_API_SKCIPHER=m
+CONFIG_ARM64_CRYPTO=y
+CONFIG_CRYPTO_AES_ARM64=m
+CONFIG_CRYPTO_AES_ARM64_BS=m
+CONFIG_CRYPTO_AES_ARM64_NEON_BLK=m
+CONFIG_CRC_ITU_T=y
+CONFIG_LIBCRC32C=y
diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
index d06fbe4cd38d..877b7c90f955 100644
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -183,10 +183,15 @@ static void __init register_insn_emulation(struct insn_emulation_ops *ops)
 
 	switch (ops->status) {
 	case INSN_DEPRECATED:
+#if 0
 		insn->current_mode = INSN_EMULATE;
 		/* Disable the HW mode if it was turned on at early boot time */
 		run_all_cpu_set_hw_mode(insn, false);
+#else
+		insn->current_mode = INSN_HW;
+		run_all_cpu_set_hw_mode(insn, true);
 		insn->max = INSN_HW;
+#endif
 		break;
 	case INSN_OBSOLETE:
 		insn->current_mode = INSN_UNDEF;
diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
index c0e4e26dc30d..7308287259ee 100644
--- a/drivers/bluetooth/hci_h5.c
+++ b/drivers/bluetooth/hci_h5.c
@@ -308,7 +308,8 @@ static void h5_handle_internal_rx(struct hci_uart *hu)
 		h5_link_control(hu, conf_req, 3);
 	} else if (memcmp(data, conf_req, 2) == 0) {
 		h5_link_control(hu, conf_rsp, 2);
-		h5_link_control(hu, conf_req, 3);
+		if (h5->state != H5_ACTIVE)
+		    h5_link_control(hu, conf_req, 3);
 	} else if (memcmp(data, conf_rsp, 2) == 0) {
 		if (H5_HDR_LEN(hdr) > 2)
 			h5->tx_win = (data[2] & 0x07);
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index c28dca0c613d..3e4e9927dd42 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -5,6 +5,8 @@
 
 menu "Character devices"
 
+source "drivers/char/broadcom/Kconfig"
+
 source "drivers/tty/Kconfig"
 
 config DEVMEM
diff --git a/drivers/char/Makefile b/drivers/char/Makefile
index 7dc3abe66464..5c896839d6b2 100644
--- a/drivers/char/Makefile
+++ b/drivers/char/Makefile
@@ -60,3 +60,4 @@ js-rtc-y = rtc.o
 obj-$(CONFIG_TILE_SROM)		+= tile-srom.o
 obj-$(CONFIG_XILLYBUS)		+= xillybus/
 obj-$(CONFIG_POWERNV_OP_PANEL)	+= powernv-op-panel.o
+obj-$(CONFIG_BRCM_CHAR_DRIVERS) += broadcom/
diff --git a/drivers/char/broadcom/Kconfig b/drivers/char/broadcom/Kconfig
new file mode 100644
index 000000000000..cffd17df6a1b
--- /dev/null
+++ b/drivers/char/broadcom/Kconfig
@@ -0,0 +1,51 @@
+#
+# Broadcom char driver config
+#
+
+menuconfig BRCM_CHAR_DRIVERS
+	bool "Broadcom Char Drivers"
+	help
+	  Broadcom's char drivers
+
+if BRCM_CHAR_DRIVERS
+
+config BCM2708_VCMEM
+	bool "Videocore Memory"
+        default y
+        help
+          Helper for videocore memory access and total size allocation.
+
+config BCM_VCIO
+	tristate "Mailbox userspace access"
+	depends on BCM2835_MBOX
+	help
+	  Gives access to the mailbox property channel from userspace.
+
+endif
+
+config BCM_VC_SM
+	bool "VMCS Shared Memory"
+	depends on BCM2835_VCHIQ
+	select BCM2708_VCMEM
+	select DMA_SHARED_BUFFER
+	default n
+	help
+	Support for the VC shared memory on the Broadcom reference
+	design. Uses the VCHIQ stack.
+
+config BCM2835_DEVGPIOMEM
+	tristate "/dev/gpiomem rootless GPIO access via mmap() on the BCM2835"
+	default m
+	help
+		Provides users with root-free access to the GPIO registers
+		on the 2835. Calling mmap(/dev/gpiomem) will map the GPIO
+		register page to the user's pointer.
+
+config BCM2835_SMI_DEV
+	tristate "Character device driver for BCM2835 Secondary Memory Interface"
+	depends on BCM2835_SMI
+	default m
+	help
+		This driver provides a character device interface (ioctl + read/write) to
+		Broadcom's Secondary Memory interface. The low-level functionality is provided
+		by the SMI driver itself.
diff --git a/drivers/char/broadcom/Makefile b/drivers/char/broadcom/Makefile
new file mode 100644
index 000000000000..7d9cb3e0b1c3
--- /dev/null
+++ b/drivers/char/broadcom/Makefile
@@ -0,0 +1,6 @@
+obj-$(CONFIG_BCM2708_VCMEM)	+= vc_mem.o
+obj-$(CONFIG_BCM_VCIO)		+= vcio.o
+obj-$(CONFIG_BCM_VC_SM)         += vc_sm/
+
+obj-$(CONFIG_BCM2835_DEVGPIOMEM)+= bcm2835-gpiomem.o
+obj-$(CONFIG_BCM2835_SMI_DEV)	+= bcm2835_smi_dev.o
diff --git a/drivers/char/broadcom/bcm2835-gpiomem.c b/drivers/char/broadcom/bcm2835-gpiomem.c
new file mode 100644
index 000000000000..f5e7f1ba8fb6
--- /dev/null
+++ b/drivers/char/broadcom/bcm2835-gpiomem.c
@@ -0,0 +1,258 @@
+/**
+ * GPIO memory device driver
+ *
+ * Creates a chardev /dev/gpiomem which will provide user access to
+ * the BCM2835's GPIO registers when it is mmap()'d.
+ * No longer need root for user GPIO access, but without relaxing permissions
+ * on /dev/mem.
+ *
+ * Written by Luke Wren <luke@raspberrypi.org>
+ * Copyright (c) 2015, Raspberry Pi (Trading) Ltd.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2, as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/cdev.h>
+#include <linux/pagemap.h>
+#include <linux/io.h>
+
+#define DEVICE_NAME "bcm2835-gpiomem"
+#define DRIVER_NAME "gpiomem-bcm2835"
+#define DEVICE_MINOR 0
+
+struct bcm2835_gpiomem_instance {
+	unsigned long gpio_regs_phys;
+	struct device *dev;
+};
+
+static struct cdev bcm2835_gpiomem_cdev;
+static dev_t bcm2835_gpiomem_devid;
+static struct class *bcm2835_gpiomem_class;
+static struct device *bcm2835_gpiomem_dev;
+static struct bcm2835_gpiomem_instance *inst;
+
+
+/****************************************************************************
+*
+*   GPIO mem chardev file ops
+*
+***************************************************************************/
+
+static int bcm2835_gpiomem_open(struct inode *inode, struct file *file)
+{
+	int dev = iminor(inode);
+	int ret = 0;
+
+	if (dev != DEVICE_MINOR) {
+		dev_err(inst->dev, "Unknown minor device: %d", dev);
+		ret = -ENXIO;
+	}
+	return ret;
+}
+
+static int bcm2835_gpiomem_release(struct inode *inode, struct file *file)
+{
+	int dev = iminor(inode);
+	int ret = 0;
+
+	if (dev != DEVICE_MINOR) {
+		dev_err(inst->dev, "Unknown minor device %d", dev);
+		ret = -ENXIO;
+	}
+	return ret;
+}
+
+static const struct vm_operations_struct bcm2835_gpiomem_vm_ops = {
+#ifdef CONFIG_HAVE_IOREMAP_PROT
+	.access = generic_access_phys
+#endif
+};
+
+static int bcm2835_gpiomem_mmap(struct file *file, struct vm_area_struct *vma)
+{
+	/* Ignore what the user says - they're getting the GPIO regs
+	   whether they like it or not! */
+	unsigned long gpio_page = inst->gpio_regs_phys >> PAGE_SHIFT;
+
+	vma->vm_page_prot = phys_mem_access_prot(file, gpio_page,
+						 PAGE_SIZE,
+						 vma->vm_page_prot);
+	vma->vm_ops = &bcm2835_gpiomem_vm_ops;
+	if (remap_pfn_range(vma, vma->vm_start,
+			gpio_page,
+			PAGE_SIZE,
+			vma->vm_page_prot)) {
+		return -EAGAIN;
+	}
+	return 0;
+}
+
+static const struct file_operations
+bcm2835_gpiomem_fops = {
+	.owner = THIS_MODULE,
+	.open = bcm2835_gpiomem_open,
+	.release = bcm2835_gpiomem_release,
+	.mmap = bcm2835_gpiomem_mmap,
+};
+
+
+ /****************************************************************************
+*
+*   Probe and remove functions
+*
+***************************************************************************/
+
+
+static int bcm2835_gpiomem_probe(struct platform_device *pdev)
+{
+	int err;
+	void *ptr_err;
+	struct device *dev = &pdev->dev;
+	struct resource *ioresource;
+
+	/* Allocate buffers and instance data */
+
+	inst = kzalloc(sizeof(struct bcm2835_gpiomem_instance), GFP_KERNEL);
+
+	if (!inst) {
+		err = -ENOMEM;
+		goto failed_inst_alloc;
+	}
+
+	inst->dev = dev;
+
+	ioresource = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (ioresource) {
+		inst->gpio_regs_phys = ioresource->start;
+	} else {
+		dev_err(inst->dev, "failed to get IO resource");
+		err = -ENOENT;
+		goto failed_get_resource;
+	}
+
+	/* Create character device entries */
+
+	err = alloc_chrdev_region(&bcm2835_gpiomem_devid,
+				  DEVICE_MINOR, 1, DEVICE_NAME);
+	if (err != 0) {
+		dev_err(inst->dev, "unable to allocate device number");
+		goto failed_alloc_chrdev;
+	}
+	cdev_init(&bcm2835_gpiomem_cdev, &bcm2835_gpiomem_fops);
+	bcm2835_gpiomem_cdev.owner = THIS_MODULE;
+	err = cdev_add(&bcm2835_gpiomem_cdev, bcm2835_gpiomem_devid, 1);
+	if (err != 0) {
+		dev_err(inst->dev, "unable to register device");
+		goto failed_cdev_add;
+	}
+
+	/* Create sysfs entries */
+
+	bcm2835_gpiomem_class = class_create(THIS_MODULE, DEVICE_NAME);
+	ptr_err = bcm2835_gpiomem_class;
+	if (IS_ERR(ptr_err))
+		goto failed_class_create;
+
+	bcm2835_gpiomem_dev = device_create(bcm2835_gpiomem_class, NULL,
+					bcm2835_gpiomem_devid, NULL,
+					"gpiomem");
+	ptr_err = bcm2835_gpiomem_dev;
+	if (IS_ERR(ptr_err))
+		goto failed_device_create;
+
+	dev_info(inst->dev, "Initialised: Registers at 0x%08lx",
+		inst->gpio_regs_phys);
+
+	return 0;
+
+failed_device_create:
+	class_destroy(bcm2835_gpiomem_class);
+failed_class_create:
+	cdev_del(&bcm2835_gpiomem_cdev);
+	err = PTR_ERR(ptr_err);
+failed_cdev_add:
+	unregister_chrdev_region(bcm2835_gpiomem_devid, 1);
+failed_alloc_chrdev:
+failed_get_resource:
+	kfree(inst);
+failed_inst_alloc:
+	dev_err(inst->dev, "could not load bcm2835_gpiomem");
+	return err;
+}
+
+static int bcm2835_gpiomem_remove(struct platform_device *pdev)
+{
+	struct device *dev = inst->dev;
+
+	kfree(inst);
+	device_destroy(bcm2835_gpiomem_class, bcm2835_gpiomem_devid);
+	class_destroy(bcm2835_gpiomem_class);
+	cdev_del(&bcm2835_gpiomem_cdev);
+	unregister_chrdev_region(bcm2835_gpiomem_devid, 1);
+
+	dev_info(dev, "GPIO mem driver removed - OK");
+	return 0;
+}
+
+ /****************************************************************************
+*
+*   Register the driver with device tree
+*
+***************************************************************************/
+
+static const struct of_device_id bcm2835_gpiomem_of_match[] = {
+	{.compatible = "brcm,bcm2835-gpiomem",},
+	{ /* sentinel */ },
+};
+
+MODULE_DEVICE_TABLE(of, bcm2835_gpiomem_of_match);
+
+static struct platform_driver bcm2835_gpiomem_driver = {
+	.probe = bcm2835_gpiomem_probe,
+	.remove = bcm2835_gpiomem_remove,
+	.driver = {
+		   .name = DRIVER_NAME,
+		   .owner = THIS_MODULE,
+		   .of_match_table = bcm2835_gpiomem_of_match,
+		   },
+};
+
+module_platform_driver(bcm2835_gpiomem_driver);
+
+MODULE_ALIAS("platform:gpiomem-bcm2835");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("gpiomem driver for accessing GPIO from userspace");
+MODULE_AUTHOR("Luke Wren <luke@raspberrypi.org>");
diff --git a/drivers/char/broadcom/bcm2835_smi_dev.c b/drivers/char/broadcom/bcm2835_smi_dev.c
new file mode 100644
index 000000000000..d6efd92fdfe4
--- /dev/null
+++ b/drivers/char/broadcom/bcm2835_smi_dev.c
@@ -0,0 +1,402 @@
+/**
+ * Character device driver for Broadcom Secondary Memory Interface
+ *
+ * Written by Luke Wren <luke@raspberrypi.org>
+ * Copyright (c) 2015, Raspberry Pi (Trading) Ltd.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2, as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/mm.h>
+#include <linux/pagemap.h>
+#include <linux/fs.h>
+#include <linux/cdev.h>
+#include <linux/fs.h>
+
+#include <linux/broadcom/bcm2835_smi.h>
+
+#define DEVICE_NAME "bcm2835-smi-dev"
+#define DRIVER_NAME "smi-dev-bcm2835"
+#define DEVICE_MINOR 0
+
+static struct cdev bcm2835_smi_cdev;
+static dev_t bcm2835_smi_devid;
+static struct class *bcm2835_smi_class;
+static struct device *bcm2835_smi_dev;
+
+struct bcm2835_smi_dev_instance {
+	struct device *dev;
+};
+
+static struct bcm2835_smi_instance *smi_inst;
+static struct bcm2835_smi_dev_instance *inst;
+
+static const char *const ioctl_names[] = {
+	"READ_SETTINGS",
+	"WRITE_SETTINGS",
+	"ADDRESS"
+};
+
+/****************************************************************************
+*
+*   SMI chardev file ops
+*
+***************************************************************************/
+static long
+bcm2835_smi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+	long ret = 0;
+
+	dev_info(inst->dev, "serving ioctl...");
+
+	switch (cmd) {
+	case BCM2835_SMI_IOC_GET_SETTINGS:{
+		struct smi_settings *settings;
+
+		dev_info(inst->dev, "Reading SMI settings to user.");
+		settings = bcm2835_smi_get_settings_from_regs(smi_inst);
+		if (copy_to_user((void *)arg, settings,
+				 sizeof(struct smi_settings)))
+			dev_err(inst->dev, "settings copy failed.");
+		break;
+	}
+	case BCM2835_SMI_IOC_WRITE_SETTINGS:{
+		struct smi_settings *settings;
+
+		dev_info(inst->dev, "Setting user's SMI settings.");
+		settings = bcm2835_smi_get_settings_from_regs(smi_inst);
+		if (copy_from_user(settings, (void *)arg,
+				   sizeof(struct smi_settings)))
+			dev_err(inst->dev, "settings copy failed.");
+		else
+			bcm2835_smi_set_regs_from_settings(smi_inst);
+		break;
+	}
+	case BCM2835_SMI_IOC_ADDRESS:
+		dev_info(inst->dev, "SMI address set: 0x%02x", (int)arg);
+		bcm2835_smi_set_address(smi_inst, arg);
+		break;
+	default:
+		dev_err(inst->dev, "invalid ioctl cmd: %d", cmd);
+		ret = -ENOTTY;
+		break;
+	}
+
+	return ret;
+}
+
+static int bcm2835_smi_open(struct inode *inode, struct file *file)
+{
+	int dev = iminor(inode);
+
+	dev_dbg(inst->dev, "SMI device opened.");
+
+	if (dev != DEVICE_MINOR) {
+		dev_err(inst->dev,
+			"bcm2835_smi_release: Unknown minor device: %d",
+			dev);
+		return -ENXIO;
+	}
+
+	return 0;
+}
+
+static int bcm2835_smi_release(struct inode *inode, struct file *file)
+{
+	int dev = iminor(inode);
+
+	if (dev != DEVICE_MINOR) {
+		dev_err(inst->dev,
+			"bcm2835_smi_release: Unknown minor device %d", dev);
+		return -ENXIO;
+	}
+
+	return 0;
+}
+
+static ssize_t dma_bounce_user(
+	enum dma_transfer_direction dma_dir,
+	char __user *user_ptr,
+	size_t count,
+	struct bcm2835_smi_bounce_info *bounce)
+{
+	int chunk_size;
+	int chunk_no = 0;
+	int count_left = count;
+
+	while (count_left) {
+		int rv;
+		void *buf;
+
+		/* Wait for current chunk to complete: */
+		if (down_timeout(&bounce->callback_sem,
+			msecs_to_jiffies(1000))) {
+			dev_err(inst->dev, "DMA bounce timed out");
+			count -= (count_left);
+			break;
+		}
+
+		if (bounce->callback_sem.count >= DMA_BOUNCE_BUFFER_COUNT - 1)
+			dev_err(inst->dev, "WARNING: Ring buffer overflow");
+		chunk_size = count_left > DMA_BOUNCE_BUFFER_SIZE ?
+			DMA_BOUNCE_BUFFER_SIZE : count_left;
+		buf = bounce->buffer[chunk_no % DMA_BOUNCE_BUFFER_COUNT];
+		if (dma_dir == DMA_DEV_TO_MEM)
+			rv = copy_to_user(user_ptr, buf, chunk_size);
+		else
+			rv = copy_from_user(buf, user_ptr, chunk_size);
+		if (rv)
+			dev_err(inst->dev, "copy_*_user() failed!: %d", rv);
+		user_ptr += chunk_size;
+		count_left -= chunk_size;
+		chunk_no++;
+	}
+	return count;
+}
+
+static ssize_t
+bcm2835_read_file(struct file *f, char __user *user_ptr,
+		  size_t count, loff_t *offs)
+{
+	int odd_bytes;
+
+	dev_dbg(inst->dev, "User reading %d bytes from SMI.", count);
+	/* We don't want to DMA a number of bytes % 4 != 0 (32 bit FIFO) */
+	if (count > DMA_THRESHOLD_BYTES)
+		odd_bytes = count & 0x3;
+	else
+		odd_bytes = count;
+	count -= odd_bytes;
+	if (count) {
+		struct bcm2835_smi_bounce_info *bounce;
+
+		count = bcm2835_smi_user_dma(smi_inst,
+			DMA_DEV_TO_MEM, user_ptr, count,
+			&bounce);
+		if (count)
+			count = dma_bounce_user(DMA_DEV_TO_MEM, user_ptr,
+				count, bounce);
+	}
+	if (odd_bytes) {
+		/* Read from FIFO directly if not using DMA */
+		uint8_t buf[DMA_THRESHOLD_BYTES];
+
+		bcm2835_smi_read_buf(smi_inst, buf, odd_bytes);
+		if (copy_to_user(user_ptr, buf, odd_bytes))
+			dev_err(inst->dev, "copy_to_user() failed.");
+		count += odd_bytes;
+
+	}
+	return count;
+}
+
+static ssize_t
+bcm2835_write_file(struct file *f, const char __user *user_ptr,
+		   size_t count, loff_t *offs)
+{
+	int odd_bytes;
+
+	dev_dbg(inst->dev, "User writing %d bytes to SMI.", count);
+	if (count > DMA_THRESHOLD_BYTES)
+		odd_bytes = count & 0x3;
+	else
+		odd_bytes = count;
+	count -= odd_bytes;
+	if (count) {
+		struct bcm2835_smi_bounce_info *bounce;
+
+		count = bcm2835_smi_user_dma(smi_inst,
+			DMA_MEM_TO_DEV, (char __user *)user_ptr, count,
+			&bounce);
+		if (count)
+			count = dma_bounce_user(DMA_MEM_TO_DEV,
+				(char __user *)user_ptr,
+				count, bounce);
+	}
+	if (odd_bytes) {
+		uint8_t buf[DMA_THRESHOLD_BYTES];
+
+		if (copy_from_user(buf, user_ptr, odd_bytes))
+			dev_err(inst->dev, "copy_from_user() failed.");
+		else
+			bcm2835_smi_write_buf(smi_inst, buf, odd_bytes);
+		count += odd_bytes;
+	}
+	return count;
+}
+
+static const struct file_operations
+bcm2835_smi_fops = {
+	.owner = THIS_MODULE,
+	.unlocked_ioctl = bcm2835_smi_ioctl,
+	.open = bcm2835_smi_open,
+	.release = bcm2835_smi_release,
+	.read = bcm2835_read_file,
+	.write = bcm2835_write_file,
+};
+
+
+/****************************************************************************
+*
+*   bcm2835_smi_probe - called when the driver is loaded.
+*
+***************************************************************************/
+
+static int bcm2835_smi_dev_probe(struct platform_device *pdev)
+{
+	int err;
+	void *ptr_err;
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node, *smi_node;
+
+	if (!node) {
+		dev_err(dev, "No device tree node supplied!");
+		return -EINVAL;
+	}
+
+	smi_node = of_parse_phandle(node, "smi_handle", 0);
+
+	if (!smi_node) {
+		dev_err(dev, "No such property: smi_handle");
+		return -ENXIO;
+	}
+
+	smi_inst = bcm2835_smi_get(smi_node);
+
+	if (!smi_inst)
+		return -EPROBE_DEFER;
+
+	/* Allocate buffers and instance data */
+
+	inst = devm_kzalloc(dev, sizeof(*inst), GFP_KERNEL);
+
+	if (!inst)
+		return -ENOMEM;
+
+	inst->dev = dev;
+
+	/* Create character device entries */
+
+	err = alloc_chrdev_region(&bcm2835_smi_devid,
+				  DEVICE_MINOR, 1, DEVICE_NAME);
+	if (err != 0) {
+		dev_err(inst->dev, "unable to allocate device number");
+		return -ENOMEM;
+	}
+	cdev_init(&bcm2835_smi_cdev, &bcm2835_smi_fops);
+	bcm2835_smi_cdev.owner = THIS_MODULE;
+	err = cdev_add(&bcm2835_smi_cdev, bcm2835_smi_devid, 1);
+	if (err != 0) {
+		dev_err(inst->dev, "unable to register device");
+		err = -ENOMEM;
+		goto failed_cdev_add;
+	}
+
+	/* Create sysfs entries */
+
+	bcm2835_smi_class = class_create(THIS_MODULE, DEVICE_NAME);
+	ptr_err = bcm2835_smi_class;
+	if (IS_ERR(ptr_err))
+		goto failed_class_create;
+
+	bcm2835_smi_dev = device_create(bcm2835_smi_class, NULL,
+					bcm2835_smi_devid, NULL,
+					"smi");
+	ptr_err = bcm2835_smi_dev;
+	if (IS_ERR(ptr_err))
+		goto failed_device_create;
+
+	dev_info(inst->dev, "initialised");
+
+	return 0;
+
+failed_device_create:
+	class_destroy(bcm2835_smi_class);
+failed_class_create:
+	cdev_del(&bcm2835_smi_cdev);
+	err = PTR_ERR(ptr_err);
+failed_cdev_add:
+	unregister_chrdev_region(bcm2835_smi_devid, 1);
+	dev_err(dev, "could not load bcm2835_smi_dev");
+	return err;
+}
+
+/****************************************************************************
+*
+*   bcm2835_smi_remove - called when the driver is unloaded.
+*
+***************************************************************************/
+
+static int bcm2835_smi_dev_remove(struct platform_device *pdev)
+{
+	device_destroy(bcm2835_smi_class, bcm2835_smi_devid);
+	class_destroy(bcm2835_smi_class);
+	cdev_del(&bcm2835_smi_cdev);
+	unregister_chrdev_region(bcm2835_smi_devid, 1);
+
+	dev_info(inst->dev, "SMI character dev removed - OK");
+	return 0;
+}
+
+/****************************************************************************
+*
+*   Register the driver with device tree
+*
+***************************************************************************/
+
+static const struct of_device_id bcm2835_smi_dev_of_match[] = {
+	{.compatible = "brcm,bcm2835-smi-dev",},
+	{ /* sentinel */ },
+};
+
+MODULE_DEVICE_TABLE(of, bcm2835_smi_dev_of_match);
+
+static struct platform_driver bcm2835_smi_dev_driver = {
+	.probe = bcm2835_smi_dev_probe,
+	.remove = bcm2835_smi_dev_remove,
+	.driver = {
+		   .name = DRIVER_NAME,
+		   .owner = THIS_MODULE,
+		   .of_match_table = bcm2835_smi_dev_of_match,
+		   },
+};
+
+module_platform_driver(bcm2835_smi_dev_driver);
+
+MODULE_ALIAS("platform:smi-dev-bcm2835");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION(
+	"Character device driver for BCM2835's secondary memory interface");
+MODULE_AUTHOR("Luke Wren <luke@raspberrypi.org>");
diff --git a/drivers/char/broadcom/vc_mem.c b/drivers/char/broadcom/vc_mem.c
new file mode 100644
index 000000000000..d063c106de2f
--- /dev/null
+++ b/drivers/char/broadcom/vc_mem.c
@@ -0,0 +1,422 @@
+/*****************************************************************************
+* Copyright 2010 - 2011 Broadcom Corporation.  All rights reserved.
+*
+* Unless you and Broadcom execute a separate written software license
+* agreement governing use of this software, this software is licensed to you
+* under the terms of the GNU General Public License version 2, available at
+* http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+*
+* Notwithstanding the above, under no circumstances may you combine this
+* software in any way with any other Broadcom software provided under a
+* license other than the GPL, without Broadcom's express prior written
+* consent.
+*****************************************************************************/
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/device.h>
+#include <linux/cdev.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/debugfs.h>
+#include <linux/uaccess.h>
+#include <linux/dma-mapping.h>
+#include <linux/broadcom/vc_mem.h>
+
+#define DRIVER_NAME  "vc-mem"
+
+// Device (/dev) related variables
+static dev_t vc_mem_devnum = 0;
+static struct class *vc_mem_class = NULL;
+static struct cdev vc_mem_cdev;
+static int vc_mem_inited = 0;
+
+#ifdef CONFIG_DEBUG_FS
+static struct dentry *vc_mem_debugfs_entry;
+#endif
+
+/*
+ * Videocore memory addresses and size
+ *
+ * Drivers that wish to know the videocore memory addresses and sizes should
+ * use these variables instead of the MM_IO_BASE and MM_ADDR_IO defines in
+ * headers. This allows the other drivers to not be tied down to a a certain
+ * address/size at compile time.
+ *
+ * In the future, the goal is to have the videocore memory virtual address and
+ * size be calculated at boot time rather than at compile time. The decision of
+ * where the videocore memory resides and its size would be in the hands of the
+ * bootloader (and/or kernel). When that happens, the values of these variables
+ * would be calculated and assigned in the init function.
+ */
+// in the 2835 VC in mapped above ARM, but ARM has full access to VC space
+unsigned long mm_vc_mem_phys_addr = 0x00000000;
+unsigned int mm_vc_mem_size = 0;
+unsigned int mm_vc_mem_base = 0;
+
+EXPORT_SYMBOL(mm_vc_mem_phys_addr);
+EXPORT_SYMBOL(mm_vc_mem_size);
+EXPORT_SYMBOL(mm_vc_mem_base);
+
+static uint phys_addr = 0;
+static uint mem_size = 0;
+static uint mem_base = 0;
+
+
+/****************************************************************************
+*
+*   vc_mem_open
+*
+***************************************************************************/
+
+static int
+vc_mem_open(struct inode *inode, struct file *file)
+{
+	(void) inode;
+	(void) file;
+
+	pr_debug("%s: called file = 0x%p\n", __func__, file);
+
+	return 0;
+}
+
+/****************************************************************************
+*
+*   vc_mem_release
+*
+***************************************************************************/
+
+static int
+vc_mem_release(struct inode *inode, struct file *file)
+{
+	(void) inode;
+	(void) file;
+
+	pr_debug("%s: called file = 0x%p\n", __func__, file);
+
+	return 0;
+}
+
+/****************************************************************************
+*
+*   vc_mem_get_size
+*
+***************************************************************************/
+
+static void
+vc_mem_get_size(void)
+{
+}
+
+/****************************************************************************
+*
+*   vc_mem_get_base
+*
+***************************************************************************/
+
+static void
+vc_mem_get_base(void)
+{
+}
+
+/****************************************************************************
+*
+*   vc_mem_get_current_size
+*
+***************************************************************************/
+
+int
+vc_mem_get_current_size(void)
+{
+	return mm_vc_mem_size;
+}
+
+EXPORT_SYMBOL_GPL(vc_mem_get_current_size);
+
+/****************************************************************************
+*
+*   vc_mem_ioctl
+*
+***************************************************************************/
+
+static long
+vc_mem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+	int rc = 0;
+
+	(void) cmd;
+	(void) arg;
+
+	pr_debug("%s: called file = 0x%p\n", __func__, file);
+
+	switch (cmd) {
+	case VC_MEM_IOC_MEM_PHYS_ADDR:
+		{
+			pr_debug("%s: VC_MEM_IOC_MEM_PHYS_ADDR=0x%p\n",
+				__func__, (void *) mm_vc_mem_phys_addr);
+
+			if (copy_to_user((void *) arg, &mm_vc_mem_phys_addr,
+					 sizeof (mm_vc_mem_phys_addr)) != 0) {
+				rc = -EFAULT;
+			}
+			break;
+		}
+	case VC_MEM_IOC_MEM_SIZE:
+		{
+			// Get the videocore memory size first
+			vc_mem_get_size();
+
+			pr_debug("%s: VC_MEM_IOC_MEM_SIZE=%u\n", __func__,
+				mm_vc_mem_size);
+
+			if (copy_to_user((void *) arg, &mm_vc_mem_size,
+					 sizeof (mm_vc_mem_size)) != 0) {
+				rc = -EFAULT;
+			}
+			break;
+		}
+	case VC_MEM_IOC_MEM_BASE:
+		{
+			// Get the videocore memory base
+			vc_mem_get_base();
+
+			pr_debug("%s: VC_MEM_IOC_MEM_BASE=%u\n", __func__,
+				mm_vc_mem_base);
+
+			if (copy_to_user((void *) arg, &mm_vc_mem_base,
+					 sizeof (mm_vc_mem_base)) != 0) {
+				rc = -EFAULT;
+			}
+			break;
+		}
+	case VC_MEM_IOC_MEM_LOAD:
+		{
+			// Get the videocore memory base
+			vc_mem_get_base();
+
+			pr_debug("%s: VC_MEM_IOC_MEM_LOAD=%u\n", __func__,
+				mm_vc_mem_base);
+
+			if (copy_to_user((void *) arg, &mm_vc_mem_base,
+					 sizeof (mm_vc_mem_base)) != 0) {
+				rc = -EFAULT;
+			}
+			break;
+		}
+	default:
+		{
+			return -ENOTTY;
+		}
+	}
+	pr_debug("%s: file = 0x%p returning %d\n", __func__, file, rc);
+
+	return rc;
+}
+
+/****************************************************************************
+*
+*   vc_mem_mmap
+*
+***************************************************************************/
+
+static int
+vc_mem_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+	int rc = 0;
+	unsigned long length = vma->vm_end - vma->vm_start;
+	unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
+
+	pr_debug("%s: vm_start = 0x%08lx vm_end = 0x%08lx vm_pgoff = 0x%08lx\n",
+		__func__, (long) vma->vm_start, (long) vma->vm_end,
+		(long) vma->vm_pgoff);
+
+	if (offset + length > mm_vc_mem_size) {
+		pr_err("%s: length %ld is too big\n", __func__, length);
+		return -EINVAL;
+	}
+	// Do not cache the memory map
+	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+
+	rc = remap_pfn_range(vma, vma->vm_start,
+			     (mm_vc_mem_phys_addr >> PAGE_SHIFT) +
+			     vma->vm_pgoff, length, vma->vm_page_prot);
+	if (rc != 0) {
+		pr_err("%s: remap_pfn_range failed (rc=%d)\n", __func__, rc);
+	}
+
+	return rc;
+}
+
+/****************************************************************************
+*
+*   File Operations for the driver.
+*
+***************************************************************************/
+
+static const struct file_operations vc_mem_fops = {
+	.owner = THIS_MODULE,
+	.open = vc_mem_open,
+	.release = vc_mem_release,
+	.unlocked_ioctl = vc_mem_ioctl,
+	.mmap = vc_mem_mmap,
+};
+
+#ifdef CONFIG_DEBUG_FS
+static void vc_mem_debugfs_deinit(void)
+{
+	debugfs_remove_recursive(vc_mem_debugfs_entry);
+	vc_mem_debugfs_entry = NULL;
+}
+
+
+static int vc_mem_debugfs_init(
+	struct device *dev)
+{
+	vc_mem_debugfs_entry = debugfs_create_dir(DRIVER_NAME, NULL);
+	if (!vc_mem_debugfs_entry) {
+		dev_warn(dev, "could not create debugfs entry\n");
+		return -EFAULT;
+	}
+
+	if (!debugfs_create_x32("vc_mem_phys_addr",
+				0444,
+				vc_mem_debugfs_entry,
+				(u32 *)&mm_vc_mem_phys_addr)) {
+		dev_warn(dev, "%s:could not create vc_mem_phys entry\n",
+			__func__);
+		goto fail;
+	}
+
+	if (!debugfs_create_x32("vc_mem_size",
+				0444,
+				vc_mem_debugfs_entry,
+				(u32 *)&mm_vc_mem_size)) {
+		dev_warn(dev, "%s:could not create vc_mem_size entry\n",
+			__func__);
+		goto fail;
+	}
+
+	if (!debugfs_create_x32("vc_mem_base",
+				0444,
+				vc_mem_debugfs_entry,
+				(u32 *)&mm_vc_mem_base)) {
+		dev_warn(dev, "%s:could not create vc_mem_base entry\n",
+			 __func__);
+		goto fail;
+	}
+
+	return 0;
+
+fail:
+	vc_mem_debugfs_deinit();
+	return -EFAULT;
+}
+
+#endif /* CONFIG_DEBUG_FS */
+
+
+/****************************************************************************
+*
+*   vc_mem_init
+*
+***************************************************************************/
+
+static int __init
+vc_mem_init(void)
+{
+	int rc = -EFAULT;
+	struct device *dev;
+
+	pr_debug("%s: called\n", __func__);
+
+	mm_vc_mem_phys_addr = phys_addr;
+	mm_vc_mem_size = mem_size;
+	mm_vc_mem_base = mem_base;
+
+	vc_mem_get_size();
+
+	pr_info("vc-mem: phys_addr:0x%08lx mem_base=0x%08x mem_size:0x%08x(%u MiB)\n",
+		mm_vc_mem_phys_addr, mm_vc_mem_base, mm_vc_mem_size, mm_vc_mem_size / (1024 * 1024));
+
+	if ((rc = alloc_chrdev_region(&vc_mem_devnum, 0, 1, DRIVER_NAME)) < 0) {
+		pr_err("%s: alloc_chrdev_region failed (rc=%d)\n",
+		       __func__, rc);
+		goto out_err;
+	}
+
+	cdev_init(&vc_mem_cdev, &vc_mem_fops);
+	if ((rc = cdev_add(&vc_mem_cdev, vc_mem_devnum, 1)) != 0) {
+		pr_err("%s: cdev_add failed (rc=%d)\n", __func__, rc);
+		goto out_unregister;
+	}
+
+	vc_mem_class = class_create(THIS_MODULE, DRIVER_NAME);
+	if (IS_ERR(vc_mem_class)) {
+		rc = PTR_ERR(vc_mem_class);
+		pr_err("%s: class_create failed (rc=%d)\n", __func__, rc);
+		goto out_cdev_del;
+	}
+
+	dev = device_create(vc_mem_class, NULL, vc_mem_devnum, NULL,
+			    DRIVER_NAME);
+	if (IS_ERR(dev)) {
+		rc = PTR_ERR(dev);
+		pr_err("%s: device_create failed (rc=%d)\n", __func__, rc);
+		goto out_class_destroy;
+	}
+
+#ifdef CONFIG_DEBUG_FS
+	/* don't fail if the debug entries cannot be created */
+	vc_mem_debugfs_init(dev);
+#endif
+
+	vc_mem_inited = 1;
+	return 0;
+
+	device_destroy(vc_mem_class, vc_mem_devnum);
+
+      out_class_destroy:
+	class_destroy(vc_mem_class);
+	vc_mem_class = NULL;
+
+      out_cdev_del:
+	cdev_del(&vc_mem_cdev);
+
+      out_unregister:
+	unregister_chrdev_region(vc_mem_devnum, 1);
+
+      out_err:
+	return -1;
+}
+
+/****************************************************************************
+*
+*   vc_mem_exit
+*
+***************************************************************************/
+
+static void __exit
+vc_mem_exit(void)
+{
+	pr_debug("%s: called\n", __func__);
+
+	if (vc_mem_inited) {
+#if CONFIG_DEBUG_FS
+		vc_mem_debugfs_deinit();
+#endif
+		device_destroy(vc_mem_class, vc_mem_devnum);
+		class_destroy(vc_mem_class);
+		cdev_del(&vc_mem_cdev);
+		unregister_chrdev_region(vc_mem_devnum, 1);
+	}
+}
+
+module_init(vc_mem_init);
+module_exit(vc_mem_exit);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Broadcom Corporation");
+
+module_param(phys_addr, uint, 0644);
+module_param(mem_size, uint, 0644);
+module_param(mem_base, uint, 0644);
diff --git a/drivers/char/broadcom/vc_sm/Makefile b/drivers/char/broadcom/vc_sm/Makefile
new file mode 100644
index 000000000000..19ce263bc273
--- /dev/null
+++ b/drivers/char/broadcom/vc_sm/Makefile
@@ -0,0 +1,9 @@
+ccflags-$(CONFIG_BCM_VC_SM) += -Werror -Wall -Wstrict-prototypes -Wno-trigraphs -O2
+ccflags-$(CONFIG_BCM_VC_SM) += -I"drivers/staging/vc04_services" -I"drivers/staging/vc04_services/interface/vchi" -I"drivers/staging/vc04_services/interface/vchiq_arm" -I"$(srctree)/fs/"
+ccflags-$(CONFIG_BCM_VC_SM) += -DOS_ASSERT_FAILURE -D__STDC_VERSION=199901L -D__STDC_VERSION__=199901L -D__VCCOREVER__=0 -D__KERNEL__ -D__linux__
+
+obj-$(CONFIG_BCM_VC_SM) := vc-sm.o
+
+vc-sm-objs := \
+    vmcs_sm.o \
+    vc_vchi_sm.o
diff --git a/drivers/char/broadcom/vc_sm/vc_sm_defs.h b/drivers/char/broadcom/vc_sm/vc_sm_defs.h
new file mode 100644
index 000000000000..de6afe9f65af
--- /dev/null
+++ b/drivers/char/broadcom/vc_sm/vc_sm_defs.h
@@ -0,0 +1,237 @@
+/*
+ ****************************************************************************
+ * Copyright 2011 Broadcom Corporation.  All rights reserved.
+ *
+ * Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2, available at
+ * http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+ *
+ * Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a
+ * license other than the GPL, without Broadcom's express prior written
+ * consent.
+ ****************************************************************************
+ */
+
+#ifndef __VC_SM_DEFS_H__INCLUDED__
+#define __VC_SM_DEFS_H__INCLUDED__
+
+/* FourCC code used for VCHI connection */
+#define VC_SM_SERVER_NAME MAKE_FOURCC("SMEM")
+
+/* Maximum message length */
+#define VC_SM_MAX_MSG_LEN (sizeof(union vc_sm_msg_union_t) + \
+	sizeof(struct vc_sm_msg_hdr_t))
+#define VC_SM_MAX_RSP_LEN (sizeof(union vc_sm_msg_union_t))
+
+/* Resource name maximum size */
+#define VC_SM_RESOURCE_NAME 32
+
+enum vc_sm_msg_type {
+	/* Message types supported for HOST->VC direction */
+
+	/* Allocate shared memory block */
+	VC_SM_MSG_TYPE_ALLOC,
+	/* Lock allocated shared memory block */
+	VC_SM_MSG_TYPE_LOCK,
+	/* Unlock allocated shared memory block */
+	VC_SM_MSG_TYPE_UNLOCK,
+	/* Unlock allocated shared memory block, do not answer command */
+	VC_SM_MSG_TYPE_UNLOCK_NOANS,
+	/* Free shared memory block */
+	VC_SM_MSG_TYPE_FREE,
+	/* Resize a shared memory block */
+	VC_SM_MSG_TYPE_RESIZE,
+	/* Walk the allocated shared memory block(s) */
+	VC_SM_MSG_TYPE_WALK_ALLOC,
+
+	/* A previously applied action will need to be reverted */
+	VC_SM_MSG_TYPE_ACTION_CLEAN,
+
+	/*
+	 * Import a physical address and wrap into a MEM_HANDLE_T.
+	 * Release with VC_SM_MSG_TYPE_FREE.
+	 */
+	VC_SM_MSG_TYPE_IMPORT,
+
+	/* Message types supported for VC->HOST direction */
+
+	/*
+	 * VC has finished with an imported memory allocation.
+	 * Release any Linux reference counts on the underlying block.
+	 */
+	VC_SM_MSG_TYPE_RELEASED,
+
+	VC_SM_MSG_TYPE_MAX
+};
+
+/* Type of memory to be allocated */
+enum vc_sm_alloc_type_t {
+	VC_SM_ALLOC_CACHED,
+	VC_SM_ALLOC_NON_CACHED,
+};
+
+/* Message header for all messages in HOST->VC direction */
+struct vc_sm_msg_hdr_t {
+	int32_t type;
+	uint32_t trans_id;
+	uint8_t body[0];
+
+};
+
+/* Request to allocate memory (HOST->VC) */
+struct vc_sm_alloc_t {
+	/* type of memory to allocate */
+	enum vc_sm_alloc_type_t type;
+	/* byte amount of data to allocate per unit */
+	uint32_t base_unit;
+	/* number of unit to allocate */
+	uint32_t num_unit;
+	/* alignement to be applied on allocation */
+	uint32_t alignement;
+	/* identity of who allocated this block */
+	uint32_t allocator;
+	/* resource name (for easier tracking on vc side) */
+	char name[VC_SM_RESOURCE_NAME];
+
+};
+
+/* Result of a requested memory allocation (VC->HOST) */
+struct vc_sm_alloc_result_t {
+	/* Transaction identifier */
+	uint32_t trans_id;
+
+	/* Resource handle */
+	uint32_t res_handle;
+	/* Pointer to resource buffer */
+	uint32_t res_mem;
+	/* Resource base size (bytes) */
+	uint32_t res_base_size;
+	/* Resource number */
+	uint32_t res_num;
+
+};
+
+/* Request to free a previously allocated memory (HOST->VC) */
+struct vc_sm_free_t {
+	/* Resource handle (returned from alloc) */
+	uint32_t res_handle;
+	/* Resource buffer (returned from alloc) */
+	uint32_t res_mem;
+
+};
+
+/* Request to lock a previously allocated memory (HOST->VC) */
+struct vc_sm_lock_unlock_t {
+	/* Resource handle (returned from alloc) */
+	uint32_t res_handle;
+	/* Resource buffer (returned from alloc) */
+	uint32_t res_mem;
+
+};
+
+/* Request to resize a previously allocated memory (HOST->VC) */
+struct vc_sm_resize_t {
+	/* Resource handle (returned from alloc) */
+	uint32_t res_handle;
+	/* Resource buffer (returned from alloc) */
+	uint32_t res_mem;
+	/* Resource *new* size requested (bytes) */
+	uint32_t res_new_size;
+
+};
+
+/* Result of a requested memory lock (VC->HOST) */
+struct vc_sm_lock_result_t {
+	/* Transaction identifier */
+	uint32_t trans_id;
+
+	/* Resource handle */
+	uint32_t res_handle;
+	/* Pointer to resource buffer */
+	uint32_t res_mem;
+	/*
+	 * Pointer to former resource buffer if the memory
+	 * was reallocated
+	 */
+	uint32_t res_old_mem;
+
+};
+
+/* Generic result for a request (VC->HOST) */
+struct vc_sm_result_t {
+	/* Transaction identifier */
+	uint32_t trans_id;
+
+	int32_t success;
+
+};
+
+/* Request to revert a previously applied action (HOST->VC) */
+struct vc_sm_action_clean_t {
+	/* Action of interest */
+	enum vc_sm_msg_type res_action;
+	/* Transaction identifier for the action of interest */
+	uint32_t action_trans_id;
+
+};
+
+/* Request to remove all data associated with a given allocator (HOST->VC) */
+struct vc_sm_free_all_t {
+	/* Allocator identifier */
+	uint32_t allocator;
+};
+
+/* Request to import memory (HOST->VC) */
+struct vc_sm_import {
+	/* type of memory to allocate */
+	enum vc_sm_alloc_type_t type;
+	/* pointer to the VC (ie physical) address of the allocated memory */
+	uint32_t addr;
+	/* size of buffer */
+	uint32_t size;
+	/* opaque handle returned in RELEASED messages */
+	int32_t  kernel_id;
+	/* Allocator identifier */
+	uint32_t allocator;
+	/* resource name (for easier tracking on vc side) */
+	char     name[VC_SM_RESOURCE_NAME];
+};
+
+/* Result of a requested memory import (VC->HOST) */
+struct vc_sm_import_result {
+	/* Transaction identifier */
+	uint32_t trans_id;
+
+	/* Resource handle */
+	uint32_t res_handle;
+};
+
+/* Notification that VC has finished with an allocation (VC->HOST) */
+struct vc_sm_released {
+	/* pointer to the VC (ie physical) address of the allocated memory */
+	uint32_t addr;
+	/* size of buffer */
+	uint32_t size;
+	/* opaque handle returned in RELEASED messages */
+	int32_t  kernel_id;
+};
+
+/* Union of ALL messages */
+union vc_sm_msg_union_t {
+	struct vc_sm_alloc_t alloc;
+	struct vc_sm_alloc_result_t alloc_result;
+	struct vc_sm_free_t free;
+	struct vc_sm_lock_unlock_t lock_unlock;
+	struct vc_sm_action_clean_t action_clean;
+	struct vc_sm_resize_t resize;
+	struct vc_sm_lock_result_t lock_result;
+	struct vc_sm_result_t result;
+	struct vc_sm_free_all_t free_all;
+	struct vc_sm_import import;
+	struct vc_sm_import_result import_result;
+	struct vc_sm_released released;
+};
+
+#endif /* __VC_SM_DEFS_H__INCLUDED__ */
diff --git a/drivers/char/broadcom/vc_sm/vc_sm_knl.h b/drivers/char/broadcom/vc_sm/vc_sm_knl.h
new file mode 100644
index 000000000000..f7f74750d835
--- /dev/null
+++ b/drivers/char/broadcom/vc_sm/vc_sm_knl.h
@@ -0,0 +1,53 @@
+/*
+ ****************************************************************************
+ * Copyright 2011 Broadcom Corporation.  All rights reserved.
+ *
+ * Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2, available at
+ * http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+ *
+ * Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a
+ * license other than the GPL, without Broadcom's express prior written
+ * consent.
+ ****************************************************************************
+ */
+
+#ifndef __VC_SM_KNL_H__INCLUDED__
+#define __VC_SM_KNL_H__INCLUDED__
+
+#if !defined(__KERNEL__)
+#error "This interface is for kernel use only..."
+#endif
+
+/* Type of memory to be locked (ie mapped) */
+enum vc_sm_lock_cache_mode {
+	VC_SM_LOCK_CACHED,
+	VC_SM_LOCK_NON_CACHED,
+};
+
+/* Allocate a shared memory handle and block. */
+int vc_sm_alloc(struct vc_sm_alloc_t *alloc, int *handle);
+
+/* Free a previously allocated shared memory handle and block. */
+int vc_sm_free(int handle);
+
+/* Lock a memory handle for use by kernel. */
+int vc_sm_lock(int handle, enum vc_sm_lock_cache_mode mode,
+	       unsigned long *data);
+
+/* Unlock a memory handle in use by kernel. */
+int vc_sm_unlock(int handle, int flush, int no_vc_unlock);
+
+/* Get an internal resource handle mapped from the external one. */
+int vc_sm_int_handle(int handle);
+
+/* Map a shared memory region for use by kernel. */
+int vc_sm_map(int handle, unsigned int sm_addr,
+	      enum vc_sm_lock_cache_mode mode, unsigned long *data);
+
+/* Import a block of memory into the GPU space. */
+int vc_sm_import_dmabuf(struct dma_buf *dmabuf, int *handle);
+
+#endif /* __VC_SM_KNL_H__INCLUDED__ */
diff --git a/drivers/char/broadcom/vc_sm/vc_vchi_sm.c b/drivers/char/broadcom/vc_sm/vc_vchi_sm.c
new file mode 100644
index 000000000000..f8b909a09adb
--- /dev/null
+++ b/drivers/char/broadcom/vc_sm/vc_vchi_sm.c
@@ -0,0 +1,516 @@
+/*
+ ****************************************************************************
+ * Copyright 2011-2012 Broadcom Corporation.  All rights reserved.
+ *
+ * Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2, available at
+ * http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+ *
+ * Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a
+ * license other than the GPL, without Broadcom's express prior written
+ * consent.
+ ****************************************************************************
+ */
+
+/* ---- Include Files ----------------------------------------------------- */
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/semaphore.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/kthread.h>
+
+#include "vc_vchi_sm.h"
+
+#define VC_SM_VER  1
+#define VC_SM_MIN_VER 0
+
+/* ---- Private Constants and Types -------------------------------------- */
+
+/* Command blocks come from a pool */
+#define SM_MAX_NUM_CMD_RSP_BLKS 32
+
+struct sm_cmd_rsp_blk {
+	struct list_head head;	/* To create lists */
+	struct semaphore sema;	/* To be signaled when the response is there */
+
+	uint16_t id;
+	uint16_t length;
+
+	uint8_t msg[VC_SM_MAX_MSG_LEN];
+
+	uint32_t wait:1;
+	uint32_t sent:1;
+	uint32_t alloc:1;
+
+};
+
+struct sm_instance {
+	uint32_t num_connections;
+	VCHI_SERVICE_HANDLE_T vchi_handle[VCHI_MAX_NUM_CONNECTIONS];
+	struct task_struct *io_thread;
+	struct semaphore io_sema;
+
+	uint32_t trans_id;
+
+	struct mutex lock;
+	struct list_head cmd_list;
+	struct list_head rsp_list;
+	struct list_head dead_list;
+
+	struct sm_cmd_rsp_blk free_blk[SM_MAX_NUM_CMD_RSP_BLKS];
+	struct list_head free_list;
+	struct mutex free_lock;
+	struct semaphore free_sema;
+
+};
+
+/* ---- Private Variables ------------------------------------------------ */
+
+/* ---- Private Function Prototypes -------------------------------------- */
+
+/* ---- Private Functions ------------------------------------------------ */
+static int
+bcm2835_vchi_msg_queue(VCHI_SERVICE_HANDLE_T handle,
+		       void *data,
+		       unsigned int size)
+{
+	return vchi_queue_kernel_message(handle,
+					 data,
+					 size);
+}
+
+static struct
+sm_cmd_rsp_blk *vc_vchi_cmd_create(struct sm_instance *instance,
+		enum vc_sm_msg_type id, void *msg,
+		uint32_t size, int wait)
+{
+	struct sm_cmd_rsp_blk *blk;
+	struct vc_sm_msg_hdr_t *hdr;
+
+	if (down_interruptible(&instance->free_sema)) {
+		blk = kmalloc(sizeof(*blk), GFP_KERNEL);
+		if (!blk)
+			return NULL;
+
+		blk->alloc = 1;
+		sema_init(&blk->sema, 0);
+	} else {
+		mutex_lock(&instance->free_lock);
+		blk =
+		    list_first_entry(&instance->free_list,
+				    struct sm_cmd_rsp_blk, head);
+		list_del(&blk->head);
+		mutex_unlock(&instance->free_lock);
+	}
+
+	blk->sent = 0;
+	blk->wait = wait;
+	blk->length = sizeof(*hdr) + size;
+
+	hdr = (struct vc_sm_msg_hdr_t *) blk->msg;
+	hdr->type = id;
+	mutex_lock(&instance->lock);
+	hdr->trans_id = blk->id = ++instance->trans_id;
+	mutex_unlock(&instance->lock);
+
+	if (size)
+		memcpy(hdr->body, msg, size);
+
+	return blk;
+}
+
+static void
+vc_vchi_cmd_delete(struct sm_instance *instance, struct sm_cmd_rsp_blk *blk)
+{
+	if (blk->alloc) {
+		kfree(blk);
+		return;
+	}
+
+	mutex_lock(&instance->free_lock);
+	list_add(&blk->head, &instance->free_list);
+	mutex_unlock(&instance->free_lock);
+	up(&instance->free_sema);
+}
+
+static int vc_vchi_sm_videocore_io(void *arg)
+{
+	struct sm_instance *instance = arg;
+	struct sm_cmd_rsp_blk *cmd = NULL, *cmd_tmp;
+	struct vc_sm_result_t *reply;
+	uint32_t reply_len;
+	int32_t status;
+	int svc_use = 1;
+
+	while (1) {
+		if (svc_use)
+			vchi_service_release(instance->vchi_handle[0]);
+		svc_use = 0;
+		if (!down_interruptible(&instance->io_sema)) {
+			vchi_service_use(instance->vchi_handle[0]);
+			svc_use = 1;
+
+			do {
+				/*
+				 * Get new command and move it to response list
+				 */
+				mutex_lock(&instance->lock);
+				if (list_empty(&instance->cmd_list)) {
+					/* no more commands to process */
+					mutex_unlock(&instance->lock);
+					break;
+				}
+				cmd =
+				    list_first_entry(&instance->cmd_list,
+						     struct sm_cmd_rsp_blk,
+						     head);
+				list_move(&cmd->head, &instance->rsp_list);
+				cmd->sent = 1;
+				mutex_unlock(&instance->lock);
+
+				/* Send the command */
+				status = bcm2835_vchi_msg_queue(
+						instance->vchi_handle[0],
+						cmd->msg, cmd->length);
+				if (status) {
+					pr_err("%s: failed to queue message (%d)",
+					     __func__, status);
+				}
+
+				/* If no reply is needed then we're done */
+				if (!cmd->wait) {
+					mutex_lock(&instance->lock);
+					list_del(&cmd->head);
+					mutex_unlock(&instance->lock);
+					vc_vchi_cmd_delete(instance, cmd);
+					continue;
+				}
+
+				if (status) {
+					up(&cmd->sema);
+					continue;
+				}
+
+			} while (1);
+
+			while (!vchi_msg_peek
+			       (instance->vchi_handle[0], (void **)&reply,
+				&reply_len, VCHI_FLAGS_NONE)) {
+				mutex_lock(&instance->lock);
+				list_for_each_entry(cmd, &instance->rsp_list,
+						    head) {
+					if (cmd->id == reply->trans_id)
+						break;
+				}
+				mutex_unlock(&instance->lock);
+
+				if (&cmd->head == &instance->rsp_list) {
+					pr_debug("%s: received response %u, throw away...",
+					     __func__, reply->trans_id);
+				} else if (reply_len > sizeof(cmd->msg)) {
+					pr_err("%s: reply too big (%u) %u, throw away...",
+					     __func__, reply_len,
+					     reply->trans_id);
+				} else {
+					memcpy(cmd->msg, reply, reply_len);
+					up(&cmd->sema);
+				}
+
+				vchi_msg_remove(instance->vchi_handle[0]);
+			}
+
+			/* Go through the dead list and free them */
+			mutex_lock(&instance->lock);
+			list_for_each_entry_safe(cmd, cmd_tmp,
+						 &instance->dead_list, head) {
+				list_del(&cmd->head);
+				vc_vchi_cmd_delete(instance, cmd);
+			}
+			mutex_unlock(&instance->lock);
+		}
+	}
+
+	return 0;
+}
+
+static void vc_sm_vchi_callback(void *param,
+				const VCHI_CALLBACK_REASON_T reason,
+				void *msg_handle)
+{
+	struct sm_instance *instance = param;
+
+	(void)msg_handle;
+
+	switch (reason) {
+	case VCHI_CALLBACK_MSG_AVAILABLE:
+		up(&instance->io_sema);
+		break;
+
+	case VCHI_CALLBACK_SERVICE_CLOSED:
+		pr_info("%s: service CLOSED!!", __func__);
+	default:
+		break;
+	}
+}
+
+struct sm_instance *vc_vchi_sm_init(VCHI_INSTANCE_T vchi_instance,
+				    VCHI_CONNECTION_T **vchi_connections,
+				    uint32_t num_connections)
+{
+	uint32_t i;
+	struct sm_instance *instance;
+	int status;
+
+	pr_debug("%s: start", __func__);
+
+	if (num_connections > VCHI_MAX_NUM_CONNECTIONS) {
+		pr_err("%s: unsupported number of connections %u (max=%u)",
+			__func__, num_connections, VCHI_MAX_NUM_CONNECTIONS);
+
+		goto err_null;
+	}
+	/* Allocate memory for this instance */
+	instance = kzalloc(sizeof(*instance), GFP_KERNEL);
+
+	/* Misc initialisations */
+	mutex_init(&instance->lock);
+	sema_init(&instance->io_sema, 0);
+	INIT_LIST_HEAD(&instance->cmd_list);
+	INIT_LIST_HEAD(&instance->rsp_list);
+	INIT_LIST_HEAD(&instance->dead_list);
+	INIT_LIST_HEAD(&instance->free_list);
+	sema_init(&instance->free_sema, SM_MAX_NUM_CMD_RSP_BLKS);
+	mutex_init(&instance->free_lock);
+	for (i = 0; i < SM_MAX_NUM_CMD_RSP_BLKS; i++) {
+		sema_init(&instance->free_blk[i].sema, 0);
+		list_add(&instance->free_blk[i].head, &instance->free_list);
+	}
+
+	/* Open the VCHI service connections */
+	instance->num_connections = num_connections;
+	for (i = 0; i < num_connections; i++) {
+		SERVICE_CREATION_T params = {
+			VCHI_VERSION_EX(VC_SM_VER, VC_SM_MIN_VER),
+			VC_SM_SERVER_NAME,
+			vchi_connections[i],
+			0,
+			0,
+			vc_sm_vchi_callback,
+			instance,
+			0,
+			0,
+			0,
+		};
+
+		status = vchi_service_open(vchi_instance,
+					   &params, &instance->vchi_handle[i]);
+		if (status) {
+			pr_err("%s: failed to open VCHI service (%d)",
+					__func__, status);
+
+			goto err_close_services;
+		}
+	}
+
+	/* Create the thread which takes care of all io to/from videoocore. */
+	instance->io_thread = kthread_create(&vc_vchi_sm_videocore_io,
+					     (void *)instance, "SMIO");
+	if (instance->io_thread == NULL) {
+		pr_err("%s: failed to create SMIO thread", __func__);
+
+		goto err_close_services;
+	}
+	set_user_nice(instance->io_thread, -10);
+	wake_up_process(instance->io_thread);
+
+	pr_debug("%s: success - instance 0x%x", __func__,
+		 (unsigned int)instance);
+	return instance;
+
+err_close_services:
+	for (i = 0; i < instance->num_connections; i++) {
+		if (instance->vchi_handle[i] != NULL)
+			vchi_service_close(instance->vchi_handle[i]);
+	}
+	kfree(instance);
+err_null:
+	pr_debug("%s: FAILED", __func__);
+	return NULL;
+}
+
+int vc_vchi_sm_stop(struct sm_instance **handle)
+{
+	struct sm_instance *instance;
+	uint32_t i;
+
+	if (handle == NULL) {
+		pr_err("%s: invalid pointer to handle %p", __func__, handle);
+		goto lock;
+	}
+
+	if (*handle == NULL) {
+		pr_err("%s: invalid handle %p", __func__, *handle);
+		goto lock;
+	}
+
+	instance = *handle;
+
+	/* Close all VCHI service connections */
+	for (i = 0; i < instance->num_connections; i++) {
+		int32_t success;
+
+		vchi_service_use(instance->vchi_handle[i]);
+
+		success = vchi_service_close(instance->vchi_handle[i]);
+	}
+
+	kfree(instance);
+
+	*handle = NULL;
+	return 0;
+
+lock:
+	return -EINVAL;
+}
+
+int vc_vchi_sm_send_msg(struct sm_instance *handle,
+			enum vc_sm_msg_type msg_id,
+			void *msg, uint32_t msg_size,
+			void *result, uint32_t result_size,
+			uint32_t *cur_trans_id, uint8_t wait_reply)
+{
+	int status = 0;
+	struct sm_instance *instance = handle;
+	struct sm_cmd_rsp_blk *cmd_blk;
+
+	if (handle == NULL) {
+		pr_err("%s: invalid handle", __func__);
+		return -EINVAL;
+	}
+	if (msg == NULL) {
+		pr_err("%s: invalid msg pointer", __func__);
+		return -EINVAL;
+	}
+
+	cmd_blk =
+	    vc_vchi_cmd_create(instance, msg_id, msg, msg_size, wait_reply);
+	if (cmd_blk == NULL) {
+		pr_err("[%s]: failed to allocate global tracking resource",
+			__func__);
+		return -ENOMEM;
+	}
+
+	if (cur_trans_id != NULL)
+		*cur_trans_id = cmd_blk->id;
+
+	mutex_lock(&instance->lock);
+	list_add_tail(&cmd_blk->head, &instance->cmd_list);
+	mutex_unlock(&instance->lock);
+	up(&instance->io_sema);
+
+	if (!wait_reply)
+		/* We're done */
+		return 0;
+
+	/* Wait for the response */
+	if (down_interruptible(&cmd_blk->sema)) {
+		mutex_lock(&instance->lock);
+		if (!cmd_blk->sent) {
+			list_del(&cmd_blk->head);
+			mutex_unlock(&instance->lock);
+			vc_vchi_cmd_delete(instance, cmd_blk);
+			return -ENXIO;
+		}
+		mutex_unlock(&instance->lock);
+
+		mutex_lock(&instance->lock);
+		list_move(&cmd_blk->head, &instance->dead_list);
+		mutex_unlock(&instance->lock);
+		up(&instance->io_sema);
+		return -EINTR;	/* We're done */
+	}
+
+	if (result && result_size) {
+		memcpy(result, cmd_blk->msg, result_size);
+	} else {
+		struct vc_sm_result_t *res =
+			(struct vc_sm_result_t *) cmd_blk->msg;
+		status = (res->success == 0) ? 0 : -ENXIO;
+	}
+
+	mutex_lock(&instance->lock);
+	list_del(&cmd_blk->head);
+	mutex_unlock(&instance->lock);
+	vc_vchi_cmd_delete(instance, cmd_blk);
+	return status;
+}
+
+int vc_vchi_sm_alloc(struct sm_instance *handle, struct vc_sm_alloc_t *msg,
+		     struct vc_sm_alloc_result_t *result,
+		     uint32_t *cur_trans_id)
+{
+	return vc_vchi_sm_send_msg(handle, VC_SM_MSG_TYPE_ALLOC,
+				   msg, sizeof(*msg), result, sizeof(*result),
+				   cur_trans_id, 1);
+}
+
+int vc_vchi_sm_free(struct sm_instance *handle,
+		    struct vc_sm_free_t *msg, uint32_t *cur_trans_id)
+{
+	return vc_vchi_sm_send_msg(handle, VC_SM_MSG_TYPE_FREE,
+				   msg, sizeof(*msg), 0, 0, cur_trans_id, 0);
+}
+
+int vc_vchi_sm_lock(struct sm_instance *handle,
+		    struct vc_sm_lock_unlock_t *msg,
+		    struct vc_sm_lock_result_t *result,
+		    uint32_t *cur_trans_id)
+{
+	return vc_vchi_sm_send_msg(handle, VC_SM_MSG_TYPE_LOCK,
+				   msg, sizeof(*msg), result, sizeof(*result),
+				   cur_trans_id, 1);
+}
+
+int vc_vchi_sm_unlock(struct sm_instance *handle,
+		      struct vc_sm_lock_unlock_t *msg,
+		      uint32_t *cur_trans_id, uint8_t wait_reply)
+{
+	return vc_vchi_sm_send_msg(handle, wait_reply ?
+				   VC_SM_MSG_TYPE_UNLOCK :
+				   VC_SM_MSG_TYPE_UNLOCK_NOANS, msg,
+				   sizeof(*msg), 0, 0, cur_trans_id,
+				   wait_reply);
+}
+
+int vc_vchi_sm_resize(struct sm_instance *handle, struct vc_sm_resize_t *msg,
+		      uint32_t *cur_trans_id)
+{
+	return vc_vchi_sm_send_msg(handle, VC_SM_MSG_TYPE_RESIZE,
+				   msg, sizeof(*msg), 0, 0, cur_trans_id, 1);
+}
+
+int vc_vchi_sm_walk_alloc(struct sm_instance *handle)
+{
+	return vc_vchi_sm_send_msg(handle, VC_SM_MSG_TYPE_WALK_ALLOC,
+				   0, 0, 0, 0, 0, 0);
+}
+
+int vc_vchi_sm_clean_up(struct sm_instance *handle,
+			struct vc_sm_action_clean_t *msg)
+{
+	return vc_vchi_sm_send_msg(handle, VC_SM_MSG_TYPE_ACTION_CLEAN,
+				   msg, sizeof(*msg), 0, 0, 0, 0);
+}
+
+int vc_vchi_sm_import(struct sm_instance *handle, struct vc_sm_import *msg,
+		      struct vc_sm_import_result *result,
+		      uint32_t *cur_trans_id)
+{
+	return vc_vchi_sm_send_msg(handle, VC_SM_MSG_TYPE_IMPORT,
+				   msg, sizeof(*msg), result, sizeof(*result),
+				   cur_trans_id, 1);
+}
diff --git a/drivers/char/broadcom/vc_sm/vc_vchi_sm.h b/drivers/char/broadcom/vc_sm/vc_vchi_sm.h
new file mode 100644
index 000000000000..abe4ed15836f
--- /dev/null
+++ b/drivers/char/broadcom/vc_sm/vc_vchi_sm.h
@@ -0,0 +1,102 @@
+/*
+ ****************************************************************************
+ * Copyright 2011 Broadcom Corporation.  All rights reserved.
+ *
+ * Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2, available at
+ * http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+ *
+ * Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a
+ * license other than the GPL, without Broadcom's express prior written
+ * consent.
+ ****************************************************************************
+ */
+
+#ifndef __VC_VCHI_SM_H__INCLUDED__
+#define __VC_VCHI_SM_H__INCLUDED__
+
+#include "interface/vchi/vchi.h"
+
+#include "vc_sm_defs.h"
+
+/*
+ * Forward declare.
+ */
+struct sm_instance;
+
+/*
+ * Initialize the shared memory service, opens up vchi connection to talk to it.
+ */
+struct sm_instance *vc_vchi_sm_init(VCHI_INSTANCE_T vchi_instance,
+				    VCHI_CONNECTION_T **vchi_connections,
+				    uint32_t num_connections);
+
+/*
+ * Terminates the shared memory service.
+ */
+int vc_vchi_sm_stop(struct sm_instance **handle);
+
+/*
+ * Ask the shared memory service to allocate some memory on videocre and
+ * return the result of this allocation (which upon success will be a pointer
+ * to some memory in videocore space).
+ */
+int vc_vchi_sm_alloc(struct sm_instance *handle, struct vc_sm_alloc_t *alloc,
+		     struct vc_sm_alloc_result_t *alloc_result,
+		     uint32_t *trans_id);
+
+/*
+ * Ask the shared memory service to free up some memory that was previously
+ * allocated by the vc_vchi_sm_alloc function call.
+ */
+int vc_vchi_sm_free(struct sm_instance *handle,
+		    struct vc_sm_free_t *free, uint32_t *trans_id);
+
+/*
+ * Ask the shared memory service to lock up some memory that was previously
+ * allocated by the vc_vchi_sm_alloc function call.
+ */
+int vc_vchi_sm_lock(struct sm_instance *handle,
+		    struct vc_sm_lock_unlock_t *lock_unlock,
+		    struct vc_sm_lock_result_t *lock_result,
+		    uint32_t *trans_id);
+
+/*
+ * Ask the shared memory service to unlock some memory that was previously
+ * allocated by the vc_vchi_sm_alloc function call.
+ */
+int vc_vchi_sm_unlock(struct sm_instance *handle,
+		      struct vc_sm_lock_unlock_t *lock_unlock,
+		      uint32_t *trans_id, uint8_t wait_reply);
+
+/*
+ * Ask the shared memory service to resize some memory that was previously
+ * allocated by the vc_vchi_sm_alloc function call.
+ */
+int vc_vchi_sm_resize(struct sm_instance *handle,
+		      struct vc_sm_resize_t *resize, uint32_t *trans_id);
+
+/*
+ * Walk the allocated resources on the videocore side, the allocation will
+ * show up in the log.  This is purely for debug/information and takes no
+ * specific actions.
+ */
+int vc_vchi_sm_walk_alloc(struct sm_instance *handle);
+
+/*
+ * Clean up following a previously interrupted action which left the system
+ * in a bad state of some sort.
+ */
+int vc_vchi_sm_clean_up(struct sm_instance *handle,
+			struct vc_sm_action_clean_t *action_clean);
+
+/*
+ * Import a contiguous block of memory and wrap it in a GPU MEM_HANDLE_T.
+ */
+int vc_vchi_sm_import(struct sm_instance *handle, struct vc_sm_import *msg,
+		      struct vc_sm_import_result *result,
+		      uint32_t *cur_trans_id);
+
+#endif /* __VC_VCHI_SM_H__INCLUDED__ */
diff --git a/drivers/char/broadcom/vc_sm/vmcs_sm.c b/drivers/char/broadcom/vc_sm/vmcs_sm.c
new file mode 100644
index 000000000000..1bc37ee88225
--- /dev/null
+++ b/drivers/char/broadcom/vc_sm/vmcs_sm.c
@@ -0,0 +1,3543 @@
+/*
+ ****************************************************************************
+ * Copyright 2011-2012 Broadcom Corporation.  All rights reserved.
+ *
+ * Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2, available at
+ * http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+ *
+ * Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a
+ * license other than the GPL, without Broadcom's express prior written
+ * consent.
+ ****************************************************************************
+ */
+
+/* ---- Include Files ----------------------------------------------------- */
+
+#include <linux/cdev.h>
+#include <linux/broadcom/vc_mem.h>
+#include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/dma-mapping.h>
+#include <linux/dma-buf.h>
+#include <linux/errno.h>
+#include <linux/fs.h>
+#include <linux/hugetlb.h>
+#include <linux/ioctl.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/module.h>
+#include <linux/mm.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/pfn.h>
+#include <linux/proc_fs.h>
+#include <linux/pagemap.h>
+#include <linux/semaphore.h>
+#include <linux/slab.h>
+#include <linux/seq_file.h>
+#include <linux/types.h>
+#include <asm/cacheflush.h>
+
+#include "vchiq_connected.h"
+#include "vc_vchi_sm.h"
+
+#include <linux/broadcom/vmcs_sm_ioctl.h>
+#include "vc_sm_knl.h"
+
+/* ---- Private Constants and Types --------------------------------------- */
+
+#define DEVICE_NAME              "vcsm"
+#define DRIVER_NAME		 "bcm2835-vcsm"
+#define DEVICE_MINOR             0
+
+#define VC_SM_DIR_ROOT_NAME       "vc-smem"
+#define VC_SM_DIR_ALLOC_NAME      "alloc"
+#define VC_SM_STATE               "state"
+#define VC_SM_STATS               "statistics"
+#define VC_SM_RESOURCES           "resources"
+#define VC_SM_DEBUG               "debug"
+#define VC_SM_WRITE_BUF_SIZE      128
+
+/* Statistics tracked per resource and globally. */
+enum sm_stats_t {
+	/* Attempt. */
+	ALLOC,
+	FREE,
+	LOCK,
+	UNLOCK,
+	MAP,
+	FLUSH,
+	INVALID,
+	IMPORT,
+
+	END_ATTEMPT,
+
+	/* Failure. */
+	ALLOC_FAIL,
+	FREE_FAIL,
+	LOCK_FAIL,
+	UNLOCK_FAIL,
+	MAP_FAIL,
+	FLUSH_FAIL,
+	INVALID_FAIL,
+	IMPORT_FAIL,
+
+	END_ALL,
+
+};
+
+static const char *const sm_stats_human_read[] = {
+	"Alloc",
+	"Free",
+	"Lock",
+	"Unlock",
+	"Map",
+	"Cache Flush",
+	"Cache Invalidate",
+	"Import",
+};
+
+typedef int (*VC_SM_SHOW) (struct seq_file *s, void *v);
+struct sm_pde_t {
+	VC_SM_SHOW show;          /* Debug fs function hookup. */
+	struct dentry *dir_entry; /* Debug fs directory entry. */
+	void *priv_data;          /* Private data */
+
+};
+
+/* Single resource allocation tracked for all devices. */
+struct sm_mmap {
+	struct list_head map_list;	/* Linked list of maps. */
+
+	struct sm_resource_t *resource;	/* Pointer to the resource. */
+
+	pid_t res_pid;			/* PID owning that resource. */
+	unsigned int res_vc_hdl;	/* Resource handle (videocore). */
+	unsigned int res_usr_hdl;	/* Resource handle (user). */
+
+	unsigned long res_addr;	/* Mapped virtual address. */
+	struct vm_area_struct *vma;	/* VM area for this mapping. */
+	unsigned int ref_count;		/* Reference count to this vma. */
+
+	/* Used to link maps associated with a resource. */
+	struct list_head resource_map_list;
+};
+
+/* Single resource allocation tracked for each opened device. */
+struct sm_resource_t {
+	struct list_head resource_list;	/* List of resources. */
+	struct list_head global_resource_list;	/* Global list of resources. */
+
+	pid_t pid;		/* PID owning that resource. */
+	uint32_t res_guid;	/* Unique identifier. */
+	uint32_t lock_count;	/* Lock count for this resource. */
+	uint32_t ref_count;	/* Ref count for this resource. */
+
+	uint32_t res_handle;	/* Resource allocation handle. */
+	void *res_base_mem;	/* Resource base memory address. */
+	uint32_t res_size;	/* Resource size allocated. */
+	enum vmcs_sm_cache_e res_cached;	/* Resource cache type. */
+	struct sm_resource_t *res_shared;	/* Shared resource */
+
+	enum sm_stats_t res_stats[END_ALL];	/* Resource statistics. */
+
+	uint8_t map_count;	/* Counter of mappings for this resource. */
+	struct list_head map_list;	/* Maps associated with a resource. */
+
+	/* DMABUF related fields */
+	struct dma_buf *dma_buf;
+	struct dma_buf_attachment *attach;
+	struct sg_table *sgt;
+	dma_addr_t dma_addr;
+
+	struct sm_priv_data_t *private;
+	bool map;		/* whether to map pages up front */
+};
+
+/* Private file data associated with each opened device. */
+struct sm_priv_data_t {
+	struct list_head resource_list; /* List of resources. */
+
+	pid_t pid;                      /* PID of creator. */
+
+	struct dentry *dir_pid;	   /* Debug fs entries root. */
+	struct sm_pde_t dir_stats; /* Debug fs entries statistics sub-tree. */
+	struct sm_pde_t dir_res;   /* Debug fs resource sub-tree. */
+
+	int restart_sys;           /* Tracks restart on interrupt. */
+	enum vc_sm_msg_type int_action; /* Interrupted action. */
+	uint32_t int_trans_id;     /* Interrupted transaction. */
+
+};
+
+/* Global state information. */
+struct sm_state_t {
+	struct platform_device *pdev;
+	struct sm_instance *sm_handle;	/* Handle for videocore service. */
+	struct dentry *dir_root;   /* Debug fs entries root. */
+	struct dentry *dir_alloc;  /* Debug fs entries allocations. */
+	struct sm_pde_t dir_stats; /* Debug fs entries statistics sub-tree. */
+	struct sm_pde_t dir_state; /* Debug fs entries state sub-tree. */
+	struct dentry *debug;      /* Debug fs entries debug. */
+
+	struct mutex map_lock;          /* Global map lock. */
+	struct list_head map_list;      /* List of maps. */
+	struct list_head resource_list;	/* List of resources. */
+
+	enum sm_stats_t deceased[END_ALL];    /* Natural termination stats. */
+	enum sm_stats_t terminated[END_ALL];  /* Forced termination stats. */
+	uint32_t res_deceased_cnt;	      /* Natural termination counter. */
+	uint32_t res_terminated_cnt;	      /* Forced termination counter. */
+
+	struct cdev sm_cdev;	/* Device. */
+	dev_t sm_devid;		/* Device identifier. */
+	struct class *sm_class;	/* Class. */
+	struct device *sm_dev;	/* Device. */
+
+	struct sm_priv_data_t *data_knl;    /* Kernel internal data tracking. */
+
+	struct mutex lock;	/* Global lock. */
+	uint32_t guid;		/* GUID (next) tracker. */
+
+};
+
+/* ---- Private Variables ----------------------------------------------- */
+
+static struct sm_state_t *sm_state;
+static int sm_inited;
+
+#if 0
+static const char *const sm_cache_map_vector[] = {
+	"(null)",
+	"host",
+	"videocore",
+	"host+videocore",
+};
+#endif
+
+/* ---- Private Function Prototypes -------------------------------------- */
+
+/* ---- Private Functions ------------------------------------------------ */
+
+static inline unsigned int vcaddr_to_pfn(unsigned long vc_addr)
+{
+	unsigned long pfn = vc_addr & 0x3FFFFFFF;
+
+	pfn += mm_vc_mem_phys_addr;
+	pfn >>= PAGE_SHIFT;
+	return pfn;
+}
+
+/*
+ * Carries over to the state statistics the statistics once owned by a deceased
+ * resource.
+ */
+static void vc_sm_resource_deceased(struct sm_resource_t *p_res, int terminated)
+{
+	if (sm_state != NULL) {
+		if (p_res != NULL) {
+			int ix;
+
+			if (terminated)
+				sm_state->res_terminated_cnt++;
+			else
+				sm_state->res_deceased_cnt++;
+
+			for (ix = 0; ix < END_ALL; ix++) {
+				if (terminated)
+					sm_state->terminated[ix] +=
+					    p_res->res_stats[ix];
+				else
+					sm_state->deceased[ix] +=
+					    p_res->res_stats[ix];
+			}
+		}
+	}
+}
+
+/*
+ * Fetch a videocore handle corresponding to a mapping of the pid+address
+ * returns 0 (ie NULL) if no such handle exists in the global map.
+ */
+static unsigned int vmcs_sm_vc_handle_from_pid_and_address(unsigned int pid,
+							   unsigned int addr)
+{
+	struct sm_mmap *map = NULL;
+	unsigned int handle = 0;
+
+	if (!sm_state || addr == 0)
+		goto out;
+
+	mutex_lock(&(sm_state->map_lock));
+
+	/* Lookup the resource. */
+	if (!list_empty(&sm_state->map_list)) {
+		list_for_each_entry(map, &sm_state->map_list, map_list) {
+			if (map->res_pid != pid)
+				continue;
+			if (addr < map->res_addr ||
+						addr >= (map->res_addr + map->resource->res_size))
+				continue;
+
+			pr_debug("[%s]: global map %p (pid %u, addr %lx) -> vc-hdl %x (usr-hdl %x)\n",
+				__func__, map, map->res_pid, map->res_addr,
+				map->res_vc_hdl, map->res_usr_hdl);
+
+			handle = map->res_vc_hdl;
+			break;
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+out:
+	/*
+	 * Use a debug log here as it may be a valid situation that we query
+	 * for something that is not mapped, we do not want a kernel log each
+	 * time around.
+	 *
+	 * There are other error log that would pop up accordingly if someone
+	 * subsequently tries to use something invalid after being told not to
+	 * use it...
+	 */
+	if (handle == 0) {
+		pr_debug("[%s]: not a valid map (pid %u, addr %x)\n",
+			__func__, pid, addr);
+	}
+
+	return handle;
+}
+
+/*
+ * Fetch a user handle corresponding to a mapping of the pid+address
+ * returns 0 (ie NULL) if no such handle exists in the global map.
+ */
+static unsigned int vmcs_sm_usr_handle_from_pid_and_address(unsigned int pid,
+							    unsigned int addr)
+{
+	struct sm_mmap *map = NULL;
+	unsigned int handle = 0;
+
+	if (!sm_state || addr == 0)
+		goto out;
+
+	mutex_lock(&(sm_state->map_lock));
+
+	/* Lookup the resource. */
+	if (!list_empty(&sm_state->map_list)) {
+		list_for_each_entry(map, &sm_state->map_list, map_list) {
+			if (map->res_pid != pid)
+				continue;
+			if (addr < map->res_addr ||
+						addr >= (map->res_addr + map->resource->res_size))
+				continue;
+
+			pr_debug("[%s]: global map %p (pid %u, addr %lx) -> usr-hdl %x (vc-hdl %x)\n",
+				__func__, map, map->res_pid, map->res_addr,
+				map->res_usr_hdl, map->res_vc_hdl);
+
+			handle = map->res_usr_hdl;
+			break;
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+out:
+	/*
+	 * Use a debug log here as it may be a valid situation that we query
+	 * for something that is not mapped yet.
+	 *
+	 * There are other error log that would pop up accordingly if someone
+	 * subsequently tries to use something invalid after being told not to
+	 * use it...
+	 */
+	if (handle == 0)
+		pr_debug("[%s]: not a valid map (pid %u, addr %x)\n",
+			__func__, pid, addr);
+
+	return handle;
+}
+
+#if defined(DO_NOT_USE)
+/*
+ * Fetch an address corresponding to a mapping of the pid+handle
+ * returns 0 (ie NULL) if no such address exists in the global map.
+ */
+static unsigned int vmcs_sm_usr_address_from_pid_and_vc_handle(unsigned int pid,
+							       unsigned int hdl)
+{
+	struct sm_mmap *map = NULL;
+	unsigned int addr = 0;
+
+	if (sm_state == NULL || hdl == 0)
+		goto out;
+
+	mutex_lock(&(sm_state->map_lock));
+
+	/* Lookup the resource. */
+	if (!list_empty(&sm_state->map_list)) {
+		list_for_each_entry(map, &sm_state->map_list, map_list) {
+			if (map->res_pid != pid || map->res_vc_hdl != hdl)
+				continue;
+
+			pr_debug("[%s]: global map %p (pid %u, vc-hdl %x, usr-hdl %x) -> addr %lx\n",
+				__func__, map, map->res_pid, map->res_vc_hdl,
+				map->res_usr_hdl, map->res_addr);
+
+			addr = map->res_addr;
+			break;
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+out:
+	/*
+	 * Use a debug log here as it may be a valid situation that we query
+	 * for something that is not mapped, we do not want a kernel log each
+	 * time around.
+	 *
+	 * There are other error log that would pop up accordingly if someone
+	 * subsequently tries to use something invalid after being told not to
+	 * use it...
+	 */
+	if (addr == 0)
+		pr_debug("[%s]: not a valid map (pid %u, hdl %x)\n",
+			__func__, pid, hdl);
+
+	return addr;
+}
+#endif
+
+/*
+ * Fetch an address corresponding to a mapping of the pid+handle
+ * returns 0 (ie NULL) if no such address exists in the global map.
+ */
+static unsigned int vmcs_sm_usr_address_from_pid_and_usr_handle(unsigned int
+								pid,
+								unsigned int
+								hdl)
+{
+	struct sm_mmap *map = NULL;
+	unsigned int addr = 0;
+
+	if (sm_state == NULL || hdl == 0)
+		goto out;
+
+	mutex_lock(&(sm_state->map_lock));
+
+	/* Lookup the resource. */
+	if (!list_empty(&sm_state->map_list)) {
+		list_for_each_entry(map, &sm_state->map_list, map_list) {
+			if (map->res_pid != pid || map->res_usr_hdl != hdl)
+				continue;
+
+			pr_debug("[%s]: global map %p (pid %u, vc-hdl %x, usr-hdl %x) -> addr %lx\n",
+				__func__, map, map->res_pid, map->res_vc_hdl,
+				map->res_usr_hdl, map->res_addr);
+
+			addr = map->res_addr;
+			break;
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+out:
+	/*
+	 * Use a debug log here as it may be a valid situation that we query
+	 * for something that is not mapped, we do not want a kernel log each
+	 * time around.
+	 *
+	 * There are other error log that would pop up accordingly if someone
+	 * subsequently tries to use something invalid after being told not to
+	 * use it...
+	 */
+	if (addr == 0)
+		pr_debug("[%s]: not a valid map (pid %u, hdl %x)\n", __func__,
+				pid, hdl);
+
+	return addr;
+}
+
+/* Adds a resource mapping to the global data list. */
+static void vmcs_sm_add_map(struct sm_state_t *state,
+			    struct sm_resource_t *resource, struct sm_mmap *map)
+{
+	mutex_lock(&(state->map_lock));
+
+	/* Add to the global list of mappings */
+	list_add(&map->map_list, &state->map_list);
+
+	/* Add to the list of mappings for this resource */
+	list_add(&map->resource_map_list, &resource->map_list);
+	resource->map_count++;
+
+	mutex_unlock(&(state->map_lock));
+
+	pr_debug("[%s]: added map %p (pid %u, vc-hdl %x, usr-hdl %x, addr %lx)\n",
+		__func__, map, map->res_pid, map->res_vc_hdl,
+		map->res_usr_hdl, map->res_addr);
+}
+
+/* Removes a resource mapping from the global data list. */
+static void vmcs_sm_remove_map(struct sm_state_t *state,
+			       struct sm_resource_t *resource,
+			       struct sm_mmap *map)
+{
+	mutex_lock(&(state->map_lock));
+
+	/* Remove from the global list of mappings */
+	list_del(&map->map_list);
+
+	/* Remove from the list of mapping for this resource */
+	list_del(&map->resource_map_list);
+	if (resource->map_count > 0)
+		resource->map_count--;
+
+	mutex_unlock(&(state->map_lock));
+
+	pr_debug("[%s]: removed map %p (pid %d, vc-hdl %x, usr-hdl %x, addr %lx)\n",
+		__func__, map, map->res_pid, map->res_vc_hdl, map->res_usr_hdl,
+		map->res_addr);
+
+	kfree(map);
+}
+
+/* Read callback for the global state proc entry. */
+static int vc_sm_global_state_show(struct seq_file *s, void *v)
+{
+	struct sm_mmap *map = NULL;
+	struct sm_resource_t *resource = NULL;
+	int map_count = 0;
+	int resource_count = 0;
+
+	if (sm_state == NULL)
+		return 0;
+
+	seq_printf(s, "\nVC-ServiceHandle     0x%x\n",
+		   (unsigned int)sm_state->sm_handle);
+
+	/* Log all applicable mapping(s). */
+
+	mutex_lock(&(sm_state->map_lock));
+	seq_puts(s, "\nResources\n");
+	if (!list_empty(&sm_state->resource_list)) {
+		list_for_each_entry(resource, &sm_state->resource_list,
+				    global_resource_list) {
+			resource_count++;
+
+			seq_printf(s, "\nResource                %p\n",
+				   resource);
+			seq_printf(s, "           PID          %u\n",
+				   resource->pid);
+			seq_printf(s, "           RES_GUID     0x%x\n",
+				   resource->res_guid);
+			seq_printf(s, "           LOCK_COUNT   %u\n",
+				   resource->lock_count);
+			seq_printf(s, "           REF_COUNT    %u\n",
+				   resource->ref_count);
+			seq_printf(s, "           res_handle   0x%X\n",
+				   resource->res_handle);
+			seq_printf(s, "           res_base_mem %p\n",
+				   resource->res_base_mem);
+			seq_printf(s, "           SIZE         %d\n",
+				   resource->res_size);
+			seq_printf(s, "           DMABUF       %p\n",
+				   resource->dma_buf);
+			seq_printf(s, "           ATTACH       %p\n",
+				   resource->attach);
+			seq_printf(s, "           SGT          %p\n",
+				   resource->sgt);
+			seq_printf(s, "           DMA_ADDR     %pad\n",
+				   &resource->dma_addr);
+		}
+	}
+	seq_printf(s, "\n\nTotal resource count:   %d\n\n", resource_count);
+
+	seq_puts(s, "\nMappings\n");
+	if (!list_empty(&sm_state->map_list)) {
+		list_for_each_entry(map, &sm_state->map_list, map_list) {
+			map_count++;
+
+			seq_printf(s, "\nMapping                0x%x\n",
+				   (unsigned int)map);
+			seq_printf(s, "           TGID        %u\n",
+				   map->res_pid);
+			seq_printf(s, "           VC-HDL      0x%x\n",
+				   map->res_vc_hdl);
+			seq_printf(s, "           USR-HDL     0x%x\n",
+				   map->res_usr_hdl);
+			seq_printf(s, "           USR-ADDR    0x%lx\n",
+				   map->res_addr);
+			seq_printf(s, "           SIZE        %d\n",
+				   map->resource->res_size);
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+	seq_printf(s, "\n\nTotal map count:   %d\n\n", map_count);
+
+	return 0;
+}
+
+static int vc_sm_global_statistics_show(struct seq_file *s, void *v)
+{
+	int ix;
+
+	/* Global state tracked statistics. */
+	if (sm_state != NULL) {
+		seq_puts(s, "\nDeceased Resources Statistics\n");
+
+		seq_printf(s, "\nNatural Cause (%u occurences)\n",
+			   sm_state->res_deceased_cnt);
+		for (ix = 0; ix < END_ATTEMPT; ix++) {
+			if (sm_state->deceased[ix] > 0) {
+				seq_printf(s, "                %u\t%s\n",
+					   sm_state->deceased[ix],
+					   sm_stats_human_read[ix]);
+			}
+		}
+		seq_puts(s, "\n");
+		for (ix = 0; ix < END_ATTEMPT; ix++) {
+			if (sm_state->deceased[ix + END_ATTEMPT] > 0) {
+				seq_printf(s, "                %u\tFAILED %s\n",
+					   sm_state->deceased[ix + END_ATTEMPT],
+					   sm_stats_human_read[ix]);
+			}
+		}
+
+		seq_printf(s, "\nForcefull (%u occurences)\n",
+			   sm_state->res_terminated_cnt);
+		for (ix = 0; ix < END_ATTEMPT; ix++) {
+			if (sm_state->terminated[ix] > 0) {
+				seq_printf(s, "                %u\t%s\n",
+					   sm_state->terminated[ix],
+					   sm_stats_human_read[ix]);
+			}
+		}
+		seq_puts(s, "\n");
+		for (ix = 0; ix < END_ATTEMPT; ix++) {
+			if (sm_state->terminated[ix + END_ATTEMPT] > 0) {
+				seq_printf(s, "                %u\tFAILED %s\n",
+					   sm_state->terminated[ix +
+								END_ATTEMPT],
+					   sm_stats_human_read[ix]);
+			}
+		}
+	}
+
+	return 0;
+}
+
+#if 0
+/* Read callback for the statistics proc entry. */
+static int vc_sm_statistics_show(struct seq_file *s, void *v)
+{
+	int ix;
+	struct sm_priv_data_t *file_data;
+	struct sm_resource_t *resource;
+	int res_count = 0;
+	struct sm_pde_t *p_pde;
+
+	p_pde = (struct sm_pde_t *)(s->private);
+	file_data = (struct sm_priv_data_t *)(p_pde->priv_data);
+
+	if (file_data == NULL)
+		return 0;
+
+	/* Per process statistics. */
+
+	seq_printf(s, "\nStatistics for TGID %d\n", file_data->pid);
+
+	mutex_lock(&(sm_state->map_lock));
+
+	if (!list_empty(&file_data->resource_list)) {
+		list_for_each_entry(resource, &file_data->resource_list,
+				    resource_list) {
+			res_count++;
+
+			seq_printf(s, "\nGUID:         0x%x\n\n",
+				   resource->res_guid);
+			for (ix = 0; ix < END_ATTEMPT; ix++) {
+				if (resource->res_stats[ix] > 0) {
+					seq_printf(s,
+						   "                %u\t%s\n",
+						   resource->res_stats[ix],
+						   sm_stats_human_read[ix]);
+				}
+			}
+			seq_puts(s, "\n");
+			for (ix = 0; ix < END_ATTEMPT; ix++) {
+				if (resource->res_stats[ix + END_ATTEMPT] > 0) {
+					seq_printf(s,
+						   "                %u\tFAILED %s\n",
+						   resource->res_stats[
+						   ix + END_ATTEMPT],
+						   sm_stats_human_read[ix]);
+				}
+			}
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+	seq_printf(s, "\nResources Count %d\n", res_count);
+
+	return 0;
+}
+#endif
+
+#if 0
+/* Read callback for the allocation proc entry.  */
+static int vc_sm_alloc_show(struct seq_file *s, void *v)
+{
+	struct sm_priv_data_t *file_data;
+	struct sm_resource_t *resource;
+	int alloc_count = 0;
+	struct sm_pde_t *p_pde;
+
+	p_pde = (struct sm_pde_t *)(s->private);
+	file_data = (struct sm_priv_data_t *)(p_pde->priv_data);
+
+	if (!file_data)
+		return 0;
+
+	/* Per process statistics.  */
+	seq_printf(s, "\nAllocation for TGID %d\n", file_data->pid);
+
+	mutex_lock(&(sm_state->map_lock));
+
+	if (!list_empty(&file_data->resource_list)) {
+		list_for_each_entry(resource, &file_data->resource_list,
+				    resource_list) {
+			alloc_count++;
+
+			seq_printf(s, "\nGUID:              0x%x\n",
+				   resource->res_guid);
+			seq_printf(s, "Lock Count:        %u\n",
+				   resource->lock_count);
+			seq_printf(s, "Mapped:            %s\n",
+				   (resource->map_count ? "yes" : "no"));
+			seq_printf(s, "VC-handle:         0x%x\n",
+				   resource->res_handle);
+			seq_printf(s, "VC-address:        0x%p\n",
+				   resource->res_base_mem);
+			seq_printf(s, "VC-size (bytes):   %u\n",
+				   resource->res_size);
+			seq_printf(s, "Cache:             %s\n",
+				   sm_cache_map_vector[resource->res_cached]);
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+	seq_printf(s, "\n\nTotal allocation count: %d\n\n", alloc_count);
+
+	return 0;
+}
+#endif
+
+static int vc_sm_seq_file_show(struct seq_file *s, void *v)
+{
+	struct sm_pde_t *sm_pde;
+
+	sm_pde = (struct sm_pde_t *)(s->private);
+
+	if (sm_pde && sm_pde->show)
+		sm_pde->show(s, v);
+
+	return 0;
+}
+
+static int vc_sm_single_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, vc_sm_seq_file_show, inode->i_private);
+}
+
+static const struct file_operations vc_sm_debug_fs_fops = {
+	.open = vc_sm_single_open,
+	.read = seq_read,
+	.llseek = seq_lseek,
+	.release = single_release,
+};
+
+/*
+ * Adds a resource to the private data list which tracks all the allocated
+ * data.
+ */
+static void vmcs_sm_add_resource(struct sm_priv_data_t *privdata,
+				 struct sm_resource_t *resource)
+{
+	mutex_lock(&(sm_state->map_lock));
+	list_add(&resource->resource_list, &privdata->resource_list);
+	list_add(&resource->global_resource_list, &sm_state->resource_list);
+	mutex_unlock(&(sm_state->map_lock));
+
+	pr_debug("[%s]: added resource %p (base addr %p, hdl %x, size %u, cache %u)\n",
+		__func__, resource, resource->res_base_mem,
+		resource->res_handle, resource->res_size, resource->res_cached);
+}
+
+/*
+ * Locates a resource and acquire a reference on it.
+ * The resource won't be deleted while there is a reference on it.
+ */
+static struct sm_resource_t *vmcs_sm_acquire_resource(struct sm_priv_data_t
+						      *private,
+						      unsigned int res_guid)
+{
+	struct sm_resource_t *resource, *ret = NULL;
+
+	mutex_lock(&(sm_state->map_lock));
+
+	list_for_each_entry(resource, &private->resource_list, resource_list) {
+		if (resource->res_guid != res_guid)
+			continue;
+
+		pr_debug("[%s]: located resource %p (guid: %x, base addr %p, hdl %x, size %u, cache %u)\n",
+			__func__, resource, resource->res_guid,
+			resource->res_base_mem, resource->res_handle,
+			resource->res_size, resource->res_cached);
+		resource->ref_count++;
+		ret = resource;
+		break;
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+	return ret;
+}
+
+/*
+ * Locates a resource and acquire a reference on it.
+ * The resource won't be deleted while there is a reference on it.
+ */
+static struct sm_resource_t *vmcs_sm_acquire_first_resource(
+		struct sm_priv_data_t *private)
+{
+	struct sm_resource_t *resource, *ret = NULL;
+
+	mutex_lock(&(sm_state->map_lock));
+
+	list_for_each_entry(resource, &private->resource_list, resource_list) {
+		pr_debug("[%s]: located resource %p (guid: %x, base addr %p, hdl %x, size %u, cache %u)\n",
+			__func__, resource, resource->res_guid,
+			resource->res_base_mem, resource->res_handle,
+			resource->res_size, resource->res_cached);
+		resource->ref_count++;
+		ret = resource;
+		break;
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+	return ret;
+}
+
+/*
+ * Locates a resource and acquire a reference on it.
+ * The resource won't be deleted while there is a reference on it.
+ */
+static struct sm_resource_t *vmcs_sm_acquire_global_resource(unsigned int
+							     res_guid)
+{
+	struct sm_resource_t *resource, *ret = NULL;
+
+	mutex_lock(&(sm_state->map_lock));
+
+	list_for_each_entry(resource, &sm_state->resource_list,
+			    global_resource_list) {
+		if (resource->res_guid != res_guid)
+			continue;
+
+		pr_debug("[%s]: located resource %p (guid: %x, base addr %p, hdl %x, size %u, cache %u)\n",
+			__func__, resource, resource->res_guid,
+			resource->res_base_mem, resource->res_handle,
+			resource->res_size, resource->res_cached);
+		resource->ref_count++;
+		ret = resource;
+		break;
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+	return ret;
+}
+
+/*
+ * Release a previously acquired resource.
+ * The resource will be deleted when its refcount reaches 0.
+ */
+static void vmcs_sm_release_resource(struct sm_resource_t *resource, int force)
+{
+	struct sm_priv_data_t *private = resource->private;
+	struct sm_mmap *map, *map_tmp;
+	struct sm_resource_t *res_tmp;
+	int ret;
+
+	mutex_lock(&(sm_state->map_lock));
+
+	if (--resource->ref_count) {
+		if (force)
+			pr_err("[%s]: resource %p in use\n", __func__, resource);
+
+		mutex_unlock(&(sm_state->map_lock));
+		return;
+	}
+
+	/* Time to free the resource. Start by removing it from the list */
+	list_del(&resource->resource_list);
+	list_del(&resource->global_resource_list);
+
+	/*
+	 * Walk the global resource list, find out if the resource is used
+	 * somewhere else. In which case we don't want to delete it.
+	 */
+	list_for_each_entry(res_tmp, &sm_state->resource_list,
+			    global_resource_list) {
+		if (res_tmp->res_handle == resource->res_handle) {
+			resource->res_handle = 0;
+			break;
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+
+	pr_debug("[%s]: freeing data - guid %x, hdl %x, base address %p\n",
+		__func__, resource->res_guid, resource->res_handle,
+		resource->res_base_mem);
+	resource->res_stats[FREE]++;
+
+	/* Make sure the resource we're removing is unmapped first */
+	if (resource->map_count && !list_empty(&resource->map_list)) {
+		down_write(&current->mm->mmap_sem);
+		list_for_each_entry_safe(map, map_tmp, &resource->map_list,
+					 resource_map_list) {
+			ret =
+			    do_munmap(current->mm, map->res_addr,
+				      resource->res_size, NULL);
+			if (ret) {
+				pr_err("[%s]: could not unmap resource %p\n",
+					__func__, resource);
+			}
+		}
+		up_write(&current->mm->mmap_sem);
+	}
+
+	/* Free up the videocore allocated resource. */
+	if (resource->res_handle) {
+		struct vc_sm_free_t free = {
+			resource->res_handle, (uint32_t)resource->res_base_mem
+		};
+		int status = vc_vchi_sm_free(sm_state->sm_handle, &free,
+					     &private->int_trans_id);
+		if (status != 0 && status != -EINTR) {
+			pr_err("[%s]: failed to free memory on videocore (status: %u, trans_id: %u)\n",
+			     __func__, status, private->int_trans_id);
+			resource->res_stats[FREE_FAIL]++;
+			ret = -EPERM;
+		}
+	}
+
+	if (resource->sgt)
+		dma_buf_unmap_attachment(resource->attach, resource->sgt,
+					 DMA_BIDIRECTIONAL);
+	if (resource->attach)
+		dma_buf_detach(resource->dma_buf, resource->attach);
+	if (resource->dma_buf)
+		dma_buf_put(resource->dma_buf);
+
+	/* Free up the shared resource. */
+	if (resource->res_shared)
+		vmcs_sm_release_resource(resource->res_shared, 0);
+
+	/* Free up the local resource tracking this allocation. */
+	vc_sm_resource_deceased(resource, force);
+	kfree(resource);
+}
+
+/*
+ * Dump the map table for the driver.  If process is -1, dumps the whole table,
+ * if process is a valid pid (non -1) dump only the entries associated with the
+ * pid of interest.
+ */
+static void vmcs_sm_host_walk_map_per_pid(int pid)
+{
+	struct sm_mmap *map = NULL;
+
+	/* Make sure the device was started properly. */
+	if (sm_state == NULL) {
+		pr_err("[%s]: invalid device\n", __func__);
+		return;
+	}
+
+	mutex_lock(&(sm_state->map_lock));
+
+	/* Log all applicable mapping(s). */
+	if (!list_empty(&sm_state->map_list)) {
+		list_for_each_entry(map, &sm_state->map_list, map_list) {
+			if (pid == -1 || map->res_pid == pid) {
+				pr_info("[%s]: tgid: %u - vc-hdl: %x, usr-hdl: %x, usr-addr: %lx\n",
+				     __func__, map->res_pid, map->res_vc_hdl,
+				     map->res_usr_hdl, map->res_addr);
+			}
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+}
+
+/*
+ * Dump the allocation table from host side point of view.  This only dumps the
+ * data allocated for this process/device referenced by the file_data.
+ */
+static void vmcs_sm_host_walk_alloc(struct sm_priv_data_t *file_data)
+{
+	struct sm_resource_t *resource = NULL;
+
+	/* Make sure the device was started properly. */
+	if ((sm_state == NULL) || (file_data == NULL)) {
+		pr_err("[%s]: invalid device\n", __func__);
+		return;
+	}
+
+	mutex_lock(&(sm_state->map_lock));
+
+	if (!list_empty(&file_data->resource_list)) {
+		list_for_each_entry(resource, &file_data->resource_list,
+				    resource_list) {
+			pr_info("[%s]: guid: %x - hdl: %x, vc-mem: %p, size: %u, cache: %u\n",
+			     __func__, resource->res_guid, resource->res_handle,
+			     resource->res_base_mem, resource->res_size,
+			     resource->res_cached);
+		}
+	}
+
+	mutex_unlock(&(sm_state->map_lock));
+}
+
+/* Create support for private data tracking. */
+static struct sm_priv_data_t *vc_sm_create_priv_data(pid_t id)
+{
+	char alloc_name[32];
+	struct sm_priv_data_t *file_data = NULL;
+
+	/* Allocate private structure. */
+	file_data = kzalloc(sizeof(*file_data), GFP_KERNEL);
+
+	if (!file_data) {
+		pr_err("[%s]: cannot allocate file data\n", __func__);
+		goto out;
+	}
+
+	snprintf(alloc_name, sizeof(alloc_name), "%d", id);
+
+	INIT_LIST_HEAD(&file_data->resource_list);
+	file_data->pid = id;
+	file_data->dir_pid = debugfs_create_dir(alloc_name,
+			sm_state->dir_alloc);
+#if 0
+  /* TODO: fix this to support querying statistics per pid */
+
+	if (IS_ERR_OR_NULL(file_data->dir_pid)) {
+		file_data->dir_pid = NULL;
+	} else {
+		struct dentry *dir_entry;
+
+		dir_entry = debugfs_create_file(VC_SM_RESOURCES, 0444,
+				file_data->dir_pid, file_data,
+				vc_sm_debug_fs_fops);
+
+		file_data->dir_res.dir_entry = dir_entry;
+		file_data->dir_res.priv_data = file_data;
+		file_data->dir_res.show = &vc_sm_alloc_show;
+
+		dir_entry = debugfs_create_file(VC_SM_STATS, 0444,
+				file_data->dir_pid, file_data,
+				vc_sm_debug_fs_fops);
+
+		file_data->dir_res.dir_entry = dir_entry;
+		file_data->dir_res.priv_data = file_data;
+		file_data->dir_res.show = &vc_sm_statistics_show;
+	}
+	pr_debug("[%s]: private data allocated %p\n", __func__, file_data);
+
+#endif
+out:
+	return file_data;
+}
+
+/*
+ * Open the device.  Creates a private state to help track all allocation
+ * associated with this device.
+ */
+static int vc_sm_open(struct inode *inode, struct file *file)
+{
+	int ret = 0;
+
+	/* Make sure the device was started properly. */
+	if (!sm_state) {
+		pr_err("[%s]: invalid device\n", __func__);
+		ret = -EPERM;
+		goto out;
+	}
+
+	file->private_data = vc_sm_create_priv_data(current->tgid);
+	if (file->private_data == NULL) {
+		pr_err("[%s]: failed to create data tracker\n", __func__);
+
+		ret = -ENOMEM;
+		goto out;
+	}
+
+out:
+	return ret;
+}
+
+/*
+ * Close the device.  Free up all resources still associated with this device
+ * at the time.
+ */
+static int vc_sm_release(struct inode *inode, struct file *file)
+{
+	struct sm_priv_data_t *file_data =
+	    (struct sm_priv_data_t *)file->private_data;
+	struct sm_resource_t *resource;
+	int ret = 0;
+
+	/* Make sure the device was started properly. */
+	if (sm_state == NULL || file_data == NULL) {
+		pr_err("[%s]: invalid device\n", __func__);
+		ret = -EPERM;
+		goto out;
+	}
+
+	pr_debug("[%s]: using private data %p\n", __func__, file_data);
+
+	if (file_data->restart_sys == -EINTR) {
+		struct vc_sm_action_clean_t action_clean;
+
+		pr_debug("[%s]: releasing following EINTR on %u (trans_id: %u) (likely due to signal)...\n",
+			__func__, file_data->int_action,
+			file_data->int_trans_id);
+
+		action_clean.res_action = file_data->int_action;
+		action_clean.action_trans_id = file_data->int_trans_id;
+
+		vc_vchi_sm_clean_up(sm_state->sm_handle, &action_clean);
+	}
+
+	while ((resource = vmcs_sm_acquire_first_resource(file_data)) != NULL) {
+		vmcs_sm_release_resource(resource, 0);
+		vmcs_sm_release_resource(resource, 1);
+	}
+
+	/* Remove the corresponding proc entry. */
+	debugfs_remove_recursive(file_data->dir_pid);
+
+	/* Terminate the private data. */
+	kfree(file_data);
+
+out:
+	return ret;
+}
+
+static void vcsm_vma_open(struct vm_area_struct *vma)
+{
+	struct sm_mmap *map = (struct sm_mmap *)vma->vm_private_data;
+
+	pr_debug("[%s]: virt %lx-%lx, pid %i, pfn %i\n",
+		__func__, vma->vm_start, vma->vm_end, (int)current->tgid,
+		(int)vma->vm_pgoff);
+
+	map->ref_count++;
+}
+
+static void vcsm_vma_close(struct vm_area_struct *vma)
+{
+	struct sm_mmap *map = (struct sm_mmap *)vma->vm_private_data;
+
+	pr_debug("[%s]: virt %lx-%lx, pid %i, pfn %i\n",
+		__func__, vma->vm_start, vma->vm_end, (int)current->tgid,
+		(int)vma->vm_pgoff);
+
+	map->ref_count--;
+
+	/* Remove from the map table. */
+	if (map->ref_count == 0)
+		vmcs_sm_remove_map(sm_state, map->resource, map);
+}
+
+static int vcsm_vma_fault(struct vm_fault *vmf)
+{
+	struct sm_mmap *map = (struct sm_mmap *)vmf->vma->vm_private_data;
+	struct sm_resource_t *resource = map->resource;
+	pgoff_t page_offset;
+	unsigned long pfn;
+	int ret = 0;
+
+	/* Lock the resource if necessary. */
+	if (!resource->lock_count) {
+		struct vc_sm_lock_unlock_t lock_unlock;
+		struct vc_sm_lock_result_t lock_result;
+		int status;
+
+		lock_unlock.res_handle = resource->res_handle;
+		lock_unlock.res_mem = (uint32_t)resource->res_base_mem;
+
+		pr_debug("[%s]: attempt to lock data - hdl %x, base address %p\n",
+			__func__, lock_unlock.res_handle,
+			(void *)lock_unlock.res_mem);
+
+		/* Lock the videocore allocated resource. */
+		status = vc_vchi_sm_lock(sm_state->sm_handle,
+					 &lock_unlock, &lock_result, 0);
+		if (status || !lock_result.res_mem) {
+			pr_err("[%s]: failed to lock memory on videocore (status: %u)\n",
+					__func__, status);
+			resource->res_stats[LOCK_FAIL]++;
+			return VM_FAULT_SIGBUS;
+		}
+
+		pfn = vcaddr_to_pfn((unsigned long)resource->res_base_mem);
+		outer_inv_range(__pfn_to_phys(pfn),
+				__pfn_to_phys(pfn) + resource->res_size);
+
+		resource->res_stats[LOCK]++;
+		resource->lock_count++;
+
+		/* Keep track of the new base memory. */
+		if (lock_result.res_mem &&
+		    lock_result.res_old_mem &&
+		    (lock_result.res_mem != lock_result.res_old_mem)) {
+			resource->res_base_mem = (void *)lock_result.res_mem;
+		}
+	}
+
+	/* We don't use vmf->pgoff since that has the fake offset */
+	page_offset = ((unsigned long)vmf->address - vmf->vma->vm_start);
+	pfn = (uint32_t)resource->res_base_mem & 0x3FFFFFFF;
+	pfn += mm_vc_mem_phys_addr;
+	pfn += page_offset;
+	pfn >>= PAGE_SHIFT;
+
+	/* Finally, remap it */
+	ret = vm_insert_pfn(vmf->vma, (unsigned long)vmf->address, pfn);
+
+	switch (ret) {
+	case 0:
+	case -ERESTARTSYS:
+	/*
+	 * EBUSY is ok: this just means that another thread
+	 * already did the job.
+	 */
+	case -EBUSY:
+		return VM_FAULT_NOPAGE;
+	case -ENOMEM:
+	case -EAGAIN:
+		pr_err("[%s]: failed to map page pfn:%lx virt:%lx ret:%d\n", __func__,
+			pfn, (unsigned long)vmf->address, ret);
+		return VM_FAULT_OOM;
+	default:
+		pr_err("[%s]: failed to map page pfn:%lx virt:%lx ret:%d\n", __func__,
+			pfn, (unsigned long)vmf->address, ret);
+		return VM_FAULT_SIGBUS;
+	}
+}
+
+static const struct vm_operations_struct vcsm_vm_ops = {
+	.open = vcsm_vma_open,
+	.close = vcsm_vma_close,
+	.fault = vcsm_vma_fault,
+};
+
+/* Converts VCSM_CACHE_OP_* to an operating function. */
+static void (*cache_op_to_func(const unsigned cache_op))
+		(const void*, const void*)
+{
+	switch (cache_op) {
+	case VCSM_CACHE_OP_NOP:
+		return NULL;
+
+	case VCSM_CACHE_OP_INV:
+		return dmac_inv_range;
+
+	case VCSM_CACHE_OP_CLEAN:
+		return dmac_clean_range;
+
+	case VCSM_CACHE_OP_FLUSH:
+		return dmac_flush_range;
+
+	default:
+		pr_err("[%s]: Invalid cache_op: 0x%08x\n", __func__, cache_op);
+		return NULL;
+	}
+}
+
+/*
+ * Clean/invalid/flush cache of which buffer is already pinned (i.e. accessed).
+ */
+static int clean_invalid_contiguous_mem_2d(const void __user *addr,
+		const size_t block_count, const size_t block_size, const size_t stride,
+		const unsigned cache_op)
+{
+	size_t i;
+	void (*op_fn)(const void*, const void*);
+
+	if (!block_size) {
+		pr_err("[%s]: size cannot be 0\n", __func__);
+		return -EINVAL;
+	}
+
+	op_fn = cache_op_to_func(cache_op);
+	if (op_fn == NULL)
+		return -EINVAL;
+
+	for (i = 0; i < block_count; i ++, addr += stride)
+		op_fn(addr, addr + block_size);
+
+	return 0;
+}
+
+/* Clean/invalid/flush cache of which buffer may be non-pinned. */
+/* The caller must lock current->mm->mmap_sem for read. */
+static int clean_invalid_mem_walk(unsigned long addr, const size_t size,
+		const unsigned cache_op)
+{
+	pgd_t *pgd;
+	pud_t *pud;
+	pmd_t *pmd;
+	pte_t *pte;
+	unsigned long pgd_next, pud_next, pmd_next;
+	const unsigned long end = ALIGN(addr + size, PAGE_SIZE);
+	void (*op_fn)(const void*, const void*);
+
+	addr &= PAGE_MASK;
+
+	if (addr >= end)
+		return 0;
+
+	op_fn = cache_op_to_func(cache_op);
+	if (op_fn == NULL)
+		return -EINVAL;
+
+	/* Walk PGD */
+	pgd = pgd_offset(current->mm, addr);
+	do {
+		pgd_next = pgd_addr_end(addr, end);
+
+		if (pgd_none(*pgd) || pgd_bad(*pgd))
+			continue;
+
+		/* Walk PUD */
+		pud = pud_offset(pgd, addr);
+		do {
+			pud_next = pud_addr_end(addr, pgd_next);
+			if (pud_none(*pud) || pud_bad(*pud))
+				continue;
+
+			/* Walk PMD */
+			pmd = pmd_offset(pud, addr);
+			do {
+				pmd_next = pmd_addr_end(addr, pud_next);
+				if (pmd_none(*pmd) || pmd_bad(*pmd))
+					continue;
+
+				/* Walk PTE */
+				pte = pte_offset_map(pmd, addr);
+				do {
+					if (pte_none(*pte) || !pte_present(*pte))
+						continue;
+
+					op_fn((const void __user*) addr,
+							(const void __user*) (addr + PAGE_SIZE));
+				} while (pte++, addr += PAGE_SIZE, addr != pmd_next);
+				pte_unmap(pte);
+
+			} while (pmd++, addr = pmd_next, addr != pud_next);
+
+		} while (pud++, addr = pud_next, addr != pgd_next);
+
+	} while (pgd++, addr = pgd_next, addr != end);
+
+	return 0;
+}
+
+/* Clean/invalid/flush cache of buffer in resource */
+static int clean_invalid_resource_walk(const void __user *addr,
+		const size_t size, const unsigned cache_op, const int usr_hdl,
+		struct sm_resource_t *resource)
+{
+	int err;
+	enum sm_stats_t stat_attempt, stat_failure;
+	void __user *res_addr;
+
+	if (resource == NULL) {
+		pr_err("[%s]: resource is NULL\n", __func__);
+		return -EINVAL;
+	}
+	if (resource->res_cached != VMCS_SM_CACHE_HOST &&
+				resource->res_cached != VMCS_SM_CACHE_BOTH)
+		return 0;
+
+	switch (cache_op) {
+	case VCSM_CACHE_OP_NOP:
+		return 0;
+	case VCSM_CACHE_OP_INV:
+		stat_attempt = INVALID;
+		stat_failure = INVALID_FAIL;
+		break;
+	case VCSM_CACHE_OP_CLEAN:
+		/* Like the original VMCS_SM_CMD_CLEAN_INVALID ioctl handler does. */
+		stat_attempt = FLUSH;
+		stat_failure = FLUSH_FAIL;
+		break;
+	case VCSM_CACHE_OP_FLUSH:
+		stat_attempt = FLUSH;
+		stat_failure = FLUSH_FAIL;
+		break;
+	default:
+		pr_err("[%s]: Invalid cache_op: 0x%08x\n", __func__, cache_op);
+		return -EINVAL;
+	}
+	resource->res_stats[stat_attempt]++;
+
+	if (size > resource->res_size) {
+		pr_err("[%s]: size (0x%08zu) is larger than res_size (0x%08zu)\n",
+				__func__, size, resource->res_size);
+		return -EFAULT;
+	}
+	res_addr = (void __user*) vmcs_sm_usr_address_from_pid_and_usr_handle(
+			current->tgid, usr_hdl);
+	if (res_addr == NULL) {
+		pr_err("[%s]: Failed to get user address "
+				"from pid (%d) and user handle (%d)\n", __func__, current->tgid,
+				resource->res_handle);
+		return -EINVAL;
+	}
+	if (!(res_addr <= addr && addr + size <= res_addr + resource->res_size)) {
+		pr_err("[%s]: Addr (0x%p-0x%p) out of range (0x%p-0x%p)\n",
+				__func__, addr, addr + size, res_addr,
+				res_addr + resource->res_size);
+		return -EFAULT;
+	}
+
+	down_read(&current->mm->mmap_sem);
+	err = clean_invalid_mem_walk((unsigned long) addr, size, cache_op);
+	up_read(&current->mm->mmap_sem);
+
+	if (err)
+		resource->res_stats[stat_failure]++;
+
+	return err;
+}
+
+/* Map an allocated data into something that the user space. */
+static int vc_sm_mmap(struct file *file, struct vm_area_struct *vma)
+{
+	int ret = 0;
+	struct sm_priv_data_t *file_data =
+	    (struct sm_priv_data_t *)file->private_data;
+	struct sm_resource_t *resource = NULL;
+	struct sm_mmap *map = NULL;
+
+	/* Make sure the device was started properly. */
+	if ((sm_state == NULL) || (file_data == NULL)) {
+		pr_err("[%s]: invalid device\n", __func__);
+		return -EPERM;
+	}
+
+	pr_debug("[%s]: private data %p, guid %x\n", __func__, file_data,
+		((unsigned int)vma->vm_pgoff << PAGE_SHIFT));
+
+	/*
+	 * We lookup to make sure that the data we are being asked to mmap is
+	 * something that we allocated.
+	 *
+	 * We use the offset information as the key to tell us which resource
+	 * we are mapping.
+	 */
+	resource = vmcs_sm_acquire_resource(file_data,
+					    ((unsigned int)vma->vm_pgoff <<
+					     PAGE_SHIFT));
+	if (resource == NULL) {
+		pr_err("[%s]: failed to locate resource for guid %x\n", __func__,
+			((unsigned int)vma->vm_pgoff << PAGE_SHIFT));
+		return -ENOMEM;
+	}
+
+	pr_debug("[%s]: guid %x, tgid %u, %u, %u\n",
+		__func__, resource->res_guid, current->tgid, resource->pid,
+		file_data->pid);
+
+	/* Check permissions. */
+	if (resource->pid && (resource->pid != current->tgid)) {
+		pr_err("[%s]: current tgid %u != %u owner\n",
+			__func__, current->tgid, resource->pid);
+		ret = -EPERM;
+		goto error;
+	}
+
+	/* Verify that what we are asked to mmap is proper. */
+	if (resource->res_size != (unsigned int)(vma->vm_end - vma->vm_start)) {
+		pr_err("[%s]: size inconsistency (resource: %u - mmap: %u)\n",
+			__func__,
+			resource->res_size,
+			(unsigned int)(vma->vm_end - vma->vm_start));
+
+		ret = -EINVAL;
+		goto error;
+	}
+
+	/*
+	 * Keep track of the tuple in the global resource list such that one
+	 * can do a mapping lookup for address/memory handle.
+	 */
+	map = kzalloc(sizeof(*map), GFP_KERNEL);
+	if (map == NULL) {
+		pr_err("[%s]: failed to allocate global tracking resource\n",
+			__func__);
+		ret = -ENOMEM;
+		goto error;
+	}
+
+	map->res_pid = current->tgid;
+	map->res_vc_hdl = resource->res_handle;
+	map->res_usr_hdl = resource->res_guid;
+	map->res_addr = (unsigned long)vma->vm_start;
+	map->resource = resource;
+	map->vma = vma;
+	vmcs_sm_add_map(sm_state, resource, map);
+
+	/*
+	 * We are not actually mapping the pages, we just provide a fault
+	 * handler to allow pages to be mapped when accessed
+	 */
+	vma->vm_flags |=
+	    VM_IO | VM_PFNMAP | VM_DONTCOPY | VM_DONTEXPAND;
+	vma->vm_ops = &vcsm_vm_ops;
+	vma->vm_private_data = map;
+
+	/* vm_pgoff is the first PFN of the mapped memory */
+	vma->vm_pgoff = (unsigned long)resource->res_base_mem & 0x3FFFFFFF;
+	vma->vm_pgoff += mm_vc_mem_phys_addr;
+	vma->vm_pgoff >>= PAGE_SHIFT;
+
+	if ((resource->res_cached == VMCS_SM_CACHE_NONE) ||
+	    (resource->res_cached == VMCS_SM_CACHE_VC)) {
+		/* Allocated non host cached memory, honour it. */
+		vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+	}
+
+	pr_debug("[%s]: resource %p (guid %x) - cnt %u, base address %p, handle %x, size %u (%u), cache %u\n",
+		__func__,
+		resource, resource->res_guid, resource->lock_count,
+		resource->res_base_mem, resource->res_handle,
+		resource->res_size, (unsigned int)(vma->vm_end - vma->vm_start),
+		resource->res_cached);
+
+	pr_debug("[%s]: resource %p (base address %p, handle %x) - map-count %d, usr-addr %x\n",
+		__func__, resource, resource->res_base_mem,
+		resource->res_handle, resource->map_count,
+		(unsigned int)vma->vm_start);
+
+	vcsm_vma_open(vma);
+	resource->res_stats[MAP]++;
+	vmcs_sm_release_resource(resource, 0);
+
+	if (resource->map) {
+		/* We don't use vmf->pgoff since that has the fake offset */
+		unsigned long addr;
+
+		for (addr = vma->vm_start; addr < vma->vm_end; addr += PAGE_SIZE) {
+			/* Finally, remap it */
+			unsigned long pfn = (unsigned long)resource->res_base_mem & 0x3FFFFFFF;
+
+			pfn += mm_vc_mem_phys_addr;
+			pfn += addr - vma->vm_start;
+			pfn >>= PAGE_SHIFT;
+			ret = vm_insert_pfn(vma, addr, pfn);
+		}
+	}
+
+	return 0;
+
+error:
+	resource->res_stats[MAP_FAIL]++;
+	vmcs_sm_release_resource(resource, 0);
+	return ret;
+}
+
+/* Allocate a shared memory handle and block. */
+int vc_sm_ioctl_alloc(struct sm_priv_data_t *private,
+		      struct vmcs_sm_ioctl_alloc *ioparam)
+{
+	int ret = 0;
+	int status;
+	struct sm_resource_t *resource;
+	struct vc_sm_alloc_t alloc = { 0 };
+	struct vc_sm_alloc_result_t result = { 0 };
+	enum vmcs_sm_cache_e cached = ioparam->cached;
+	bool map = false;
+
+	/* flag to requst buffer is mapped up front, rather than lazily */
+	if (cached & 0x80) {
+		map = true;
+		cached &= ~0x80;
+	}
+
+	/* Setup our allocation parameters */
+	alloc.type = ((cached == VMCS_SM_CACHE_VC)
+		      || (cached ==
+			  VMCS_SM_CACHE_BOTH)) ? VC_SM_ALLOC_CACHED :
+	    VC_SM_ALLOC_NON_CACHED;
+	alloc.base_unit = ioparam->size;
+	alloc.num_unit = ioparam->num;
+	alloc.allocator = current->tgid;
+	/* Align to kernel page size */
+	alloc.alignement = 4096;
+	/* Align the size to the kernel page size */
+	alloc.base_unit =
+	    (alloc.base_unit + alloc.alignement - 1) & ~(alloc.alignement - 1);
+	if (*ioparam->name) {
+		memcpy(alloc.name, ioparam->name, sizeof(alloc.name) - 1);
+	} else {
+		memcpy(alloc.name, VMCS_SM_RESOURCE_NAME_DEFAULT,
+		       sizeof(VMCS_SM_RESOURCE_NAME_DEFAULT));
+	}
+
+	pr_debug("[%s]: attempt to allocate \"%s\" data - type %u, base %u (%u), num %u, alignement %u\n",
+		__func__, alloc.name, alloc.type, ioparam->size,
+		alloc.base_unit, alloc.num_unit, alloc.alignement);
+
+	/* Allocate local resource to track this allocation. */
+	resource = kzalloc(sizeof(*resource), GFP_KERNEL);
+	if (!resource) {
+		ret = -ENOMEM;
+		goto error;
+	}
+	INIT_LIST_HEAD(&resource->map_list);
+	resource->ref_count++;
+	resource->pid = current->tgid;
+
+	/* Allocate the videocore resource. */
+	status = vc_vchi_sm_alloc(sm_state->sm_handle, &alloc, &result,
+				  &private->int_trans_id);
+	if (status == -EINTR) {
+		pr_debug("[%s]: requesting allocate memory action restart (trans_id: %u)\n",
+			__func__, private->int_trans_id);
+		ret = -ERESTARTSYS;
+		private->restart_sys = -EINTR;
+		private->int_action = VC_SM_MSG_TYPE_ALLOC;
+		goto error;
+	} else if (status != 0 || !result.res_mem) {
+		pr_err("[%s]: failed to allocate memory on videocore (status: %u, trans_id: %u)\n",
+		     __func__, status, private->int_trans_id);
+		ret = -ENOMEM;
+		resource->res_stats[ALLOC_FAIL]++;
+		goto error;
+	}
+
+	/* Keep track of the resource we created. */
+	resource->private = private;
+	resource->res_handle = result.res_handle;
+	resource->res_base_mem = (void *)result.res_mem;
+	resource->res_size = alloc.base_unit * alloc.num_unit;
+	resource->res_cached = cached;
+	resource->map = map;
+
+	/*
+	 * Kernel/user GUID.  This global identifier is used for mmap'ing the
+	 * allocated region from user space, it is passed as the mmap'ing
+	 * offset, we use it to 'hide' the videocore handle/address.
+	 */
+	mutex_lock(&sm_state->lock);
+	resource->res_guid = ++sm_state->guid;
+	mutex_unlock(&sm_state->lock);
+	resource->res_guid <<= PAGE_SHIFT;
+
+	vmcs_sm_add_resource(private, resource);
+
+	pr_debug("[%s]: allocated data - guid %x, hdl %x, base address %p, size %d, cache %d\n",
+		__func__, resource->res_guid, resource->res_handle,
+		resource->res_base_mem, resource->res_size,
+		resource->res_cached);
+
+	/* We're done */
+	resource->res_stats[ALLOC]++;
+	ioparam->handle = resource->res_guid;
+	return 0;
+
+error:
+	pr_err("[%s]: failed to allocate \"%s\" data (%i) - type %u, base %u (%u), num %u, alignment %u\n",
+	     __func__, alloc.name, ret, alloc.type, ioparam->size,
+	     alloc.base_unit, alloc.num_unit, alloc.alignement);
+	if (resource != NULL) {
+		vc_sm_resource_deceased(resource, 1);
+		kfree(resource);
+	}
+	return ret;
+}
+
+/* Share an allocate memory handle and block.*/
+int vc_sm_ioctl_alloc_share(struct sm_priv_data_t *private,
+			    struct vmcs_sm_ioctl_alloc_share *ioparam)
+{
+	struct sm_resource_t *resource, *shared_resource;
+	int ret = 0;
+
+	pr_debug("[%s]: attempt to share resource %u\n", __func__,
+			ioparam->handle);
+
+	shared_resource = vmcs_sm_acquire_global_resource(ioparam->handle);
+	if (shared_resource == NULL) {
+		ret = -ENOMEM;
+		goto error;
+	}
+
+	/* Allocate local resource to track this allocation. */
+	resource = kzalloc(sizeof(*resource), GFP_KERNEL);
+	if (resource == NULL) {
+		pr_err("[%s]: failed to allocate local tracking resource\n",
+			__func__);
+		ret = -ENOMEM;
+		goto error;
+	}
+	INIT_LIST_HEAD(&resource->map_list);
+	resource->ref_count++;
+	resource->pid = current->tgid;
+
+	/* Keep track of the resource we created. */
+	resource->private = private;
+	resource->res_handle = shared_resource->res_handle;
+	resource->res_base_mem = shared_resource->res_base_mem;
+	resource->res_size = shared_resource->res_size;
+	resource->res_cached = shared_resource->res_cached;
+	resource->res_shared = shared_resource;
+
+	mutex_lock(&sm_state->lock);
+	resource->res_guid = ++sm_state->guid;
+	mutex_unlock(&sm_state->lock);
+	resource->res_guid <<= PAGE_SHIFT;
+
+	vmcs_sm_add_resource(private, resource);
+
+	pr_debug("[%s]: allocated data - guid %x, hdl %x, base address %p, size %d, cache %d\n",
+		__func__, resource->res_guid, resource->res_handle,
+		resource->res_base_mem, resource->res_size,
+		resource->res_cached);
+
+	/* We're done */
+	resource->res_stats[ALLOC]++;
+	ioparam->handle = resource->res_guid;
+	ioparam->size = resource->res_size;
+	return 0;
+
+error:
+	pr_err("[%s]: failed to share %u\n", __func__, ioparam->handle);
+	if (shared_resource != NULL)
+		vmcs_sm_release_resource(shared_resource, 0);
+
+	return ret;
+}
+
+/* Free a previously allocated shared memory handle and block.*/
+static int vc_sm_ioctl_free(struct sm_priv_data_t *private,
+			    struct vmcs_sm_ioctl_free *ioparam)
+{
+	struct sm_resource_t *resource =
+	    vmcs_sm_acquire_resource(private, ioparam->handle);
+
+	if (resource == NULL) {
+		pr_err("[%s]: resource for guid %u does not exist\n", __func__,
+			ioparam->handle);
+		return -EINVAL;
+	}
+
+	/* Check permissions. */
+	if (resource->pid && (resource->pid != current->tgid)) {
+		pr_err("[%s]: current tgid %u != %u owner\n",
+			__func__, current->tgid, resource->pid);
+		vmcs_sm_release_resource(resource, 0);
+		return -EPERM;
+	}
+
+	vmcs_sm_release_resource(resource, 0);
+	vmcs_sm_release_resource(resource, 0);
+	return 0;
+}
+
+/* Resize a previously allocated shared memory handle and block. */
+static int vc_sm_ioctl_resize(struct sm_priv_data_t *private,
+			      struct vmcs_sm_ioctl_resize *ioparam)
+{
+	int ret = 0;
+	int status;
+	struct vc_sm_resize_t resize;
+	struct sm_resource_t *resource;
+
+	/* Locate resource from GUID. */
+	resource = vmcs_sm_acquire_resource(private, ioparam->handle);
+	if (!resource) {
+		pr_err("[%s]: failed resource - guid %x\n",
+				__func__, ioparam->handle);
+		ret = -EFAULT;
+		goto error;
+	}
+
+	/*
+	 * If the resource is locked, its reference count will be not NULL,
+	 * in which case we will not be allowed to resize it anyways, so
+	 * reject the attempt here.
+	 */
+	if (resource->lock_count != 0) {
+		pr_err("[%s]: cannot resize - guid %x, ref-cnt %d\n",
+		     __func__, ioparam->handle, resource->lock_count);
+		ret = -EFAULT;
+		goto error;
+	}
+
+	/* Check permissions. */
+	if (resource->pid && (resource->pid != current->tgid)) {
+		pr_err("[%s]: current tgid %u != %u owner\n", __func__,
+				current->tgid, resource->pid);
+		ret = -EPERM;
+		goto error;
+	}
+
+	if (resource->map_count != 0) {
+		pr_err("[%s]: cannot resize - guid %x, ref-cnt %d\n",
+		     __func__, ioparam->handle, resource->map_count);
+		ret = -EFAULT;
+		goto error;
+	}
+
+	resize.res_handle = resource->res_handle;
+	resize.res_mem = (uint32_t)resource->res_base_mem;
+	resize.res_new_size = ioparam->new_size;
+
+	pr_debug("[%s]: attempt to resize data - guid %x, hdl %x, base address %p\n",
+		__func__, ioparam->handle, resize.res_handle,
+		(void *)resize.res_mem);
+
+	/* Resize the videocore allocated resource. */
+	status = vc_vchi_sm_resize(sm_state->sm_handle, &resize,
+				   &private->int_trans_id);
+	if (status == -EINTR) {
+		pr_debug("[%s]: requesting resize memory action restart (trans_id: %u)\n",
+			__func__, private->int_trans_id);
+		ret = -ERESTARTSYS;
+		private->restart_sys = -EINTR;
+		private->int_action = VC_SM_MSG_TYPE_RESIZE;
+		goto error;
+	} else if (status) {
+		pr_err("[%s]: failed to resize memory on videocore (status: %u, trans_id: %u)\n",
+		     __func__, status, private->int_trans_id);
+		ret = -EPERM;
+		goto error;
+	}
+
+	pr_debug("[%s]: success to resize data - hdl %x, size %d -> %d\n",
+		__func__, resize.res_handle, resource->res_size,
+		resize.res_new_size);
+
+	/* Successfully resized, save the information and inform the user. */
+	ioparam->old_size = resource->res_size;
+	resource->res_size = resize.res_new_size;
+
+error:
+	if (resource)
+		vmcs_sm_release_resource(resource, 0);
+
+	return ret;
+}
+
+/* Lock a previously allocated shared memory handle and block. */
+static int vc_sm_ioctl_lock(struct sm_priv_data_t *private,
+			    struct vmcs_sm_ioctl_lock_unlock *ioparam,
+			    int change_cache, enum vmcs_sm_cache_e cache_type,
+			    unsigned int vc_addr)
+{
+	int status;
+	struct vc_sm_lock_unlock_t lock;
+	struct vc_sm_lock_result_t result;
+	struct sm_resource_t *resource;
+	int ret = 0;
+	struct sm_mmap *map, *map_tmp;
+	unsigned long phys_addr;
+
+	map = NULL;
+
+	/* Locate resource from GUID. */
+	resource = vmcs_sm_acquire_resource(private, ioparam->handle);
+	if (resource == NULL) {
+		ret = -EINVAL;
+		goto error;
+	}
+
+	/* Check permissions. */
+	if (resource->pid && (resource->pid != current->tgid)) {
+		pr_err("[%s]: current tgid %u != %u owner\n", __func__,
+				current->tgid, resource->pid);
+		ret = -EPERM;
+		goto error;
+	}
+
+	lock.res_handle = resource->res_handle;
+	lock.res_mem = (uint32_t)resource->res_base_mem;
+
+	/* Take the lock and get the address to be mapped. */
+	if (vc_addr == 0) {
+		pr_debug("[%s]: attempt to lock data - guid %x, hdl %x, base address %p\n",
+			__func__, ioparam->handle, lock.res_handle,
+			(void *)lock.res_mem);
+
+		/* Lock the videocore allocated resource. */
+		status = vc_vchi_sm_lock(sm_state->sm_handle, &lock, &result,
+					 &private->int_trans_id);
+		if (status == -EINTR) {
+			pr_debug("[%s]: requesting lock memory action restart (trans_id: %u)\n",
+				__func__, private->int_trans_id);
+			ret = -ERESTARTSYS;
+			private->restart_sys = -EINTR;
+			private->int_action = VC_SM_MSG_TYPE_LOCK;
+			goto error;
+		} else if (status ||
+			   (!status && !(void *)result.res_mem)) {
+			pr_err("[%s]: failed to lock memory on videocore (status: %u, trans_id: %u)\n",
+			     __func__, status, private->int_trans_id);
+			ret = -EPERM;
+			resource->res_stats[LOCK_FAIL]++;
+			goto error;
+		}
+
+		pr_debug("[%s]: succeed to lock data - hdl %x, base address %p (%p), ref-cnt %d\n",
+			__func__, lock.res_handle, (void *)result.res_mem,
+			(void *)lock.res_mem, resource->lock_count);
+	}
+	/* Lock assumed taken already, address to be mapped is known. */
+	else
+		resource->res_base_mem = (void *)vc_addr;
+
+	resource->res_stats[LOCK]++;
+	resource->lock_count++;
+
+	/* Keep track of the new base memory allocation if it has changed. */
+	if ((vc_addr == 0) &&
+	    ((void *)result.res_mem) &&
+	    ((void *)result.res_old_mem) &&
+	    (result.res_mem != result.res_old_mem)) {
+		resource->res_base_mem = (void *)result.res_mem;
+
+		/* Kernel allocated resources. */
+		if (resource->pid == 0) {
+			if (!list_empty(&resource->map_list)) {
+				list_for_each_entry_safe(map, map_tmp,
+							 &resource->map_list,
+							 resource_map_list) {
+					if (map->res_addr) {
+						iounmap((void *)map->res_addr);
+						map->res_addr = 0;
+
+						vmcs_sm_remove_map(sm_state,
+								map->resource,
+								map);
+						break;
+					}
+				}
+			}
+		}
+	}
+
+	if (change_cache)
+		resource->res_cached = cache_type;
+
+	if (resource->map_count) {
+		ioparam->addr =
+		    vmcs_sm_usr_address_from_pid_and_usr_handle(
+				    current->tgid, ioparam->handle);
+
+		pr_debug("[%s] map_count %d private->pid %d current->tgid %d hnd %x addr %u\n",
+			__func__, resource->map_count, private->pid,
+			current->tgid, ioparam->handle, ioparam->addr);
+	} else {
+		/* Kernel allocated resources. */
+		if (resource->pid == 0) {
+			pr_debug("[%s]: attempt mapping kernel resource - guid %x, hdl %x\n",
+				__func__, ioparam->handle, lock.res_handle);
+
+			ioparam->addr = 0;
+
+			map = kzalloc(sizeof(*map), GFP_KERNEL);
+			if (map == NULL) {
+				pr_err("[%s]: failed allocating tracker\n",
+						__func__);
+				ret = -ENOMEM;
+				goto error;
+			} else {
+				phys_addr = (uint32_t)resource->res_base_mem &
+				    0x3FFFFFFF;
+				phys_addr += mm_vc_mem_phys_addr;
+				if (resource->res_cached
+						== VMCS_SM_CACHE_HOST) {
+					ioparam->addr = (unsigned long)
+					/* TODO - make cached work */
+					    ioremap_nocache(phys_addr,
+							   resource->res_size);
+
+					pr_debug("[%s]: mapping kernel - guid %x, hdl %x - cached mapping %u\n",
+						__func__, ioparam->handle,
+						lock.res_handle, ioparam->addr);
+				} else {
+					ioparam->addr = (unsigned long)
+					    ioremap_nocache(phys_addr,
+							    resource->res_size);
+
+					pr_debug("[%s]: mapping kernel- guid %x, hdl %x - non cached mapping %u\n",
+						__func__, ioparam->handle,
+						lock.res_handle, ioparam->addr);
+				}
+
+				map->res_pid = 0;
+				map->res_vc_hdl = resource->res_handle;
+				map->res_usr_hdl = resource->res_guid;
+				map->res_addr = ioparam->addr;
+				map->resource = resource;
+				map->vma = NULL;
+
+				vmcs_sm_add_map(sm_state, resource, map);
+			}
+		} else
+			ioparam->addr = 0;
+	}
+
+error:
+	if (resource)
+		vmcs_sm_release_resource(resource, 0);
+
+	return ret;
+}
+
+/* Unlock a previously allocated shared memory handle and block.*/
+static int vc_sm_ioctl_unlock(struct sm_priv_data_t *private,
+			      struct vmcs_sm_ioctl_lock_unlock *ioparam,
+			      int flush, int wait_reply, int no_vc_unlock)
+{
+	int status;
+	struct vc_sm_lock_unlock_t unlock;
+	struct sm_mmap *map, *map_tmp;
+	struct sm_resource_t *resource;
+	int ret = 0;
+
+	map = NULL;
+
+	/* Locate resource from GUID. */
+	resource = vmcs_sm_acquire_resource(private, ioparam->handle);
+	if (resource == NULL) {
+		ret = -EINVAL;
+		goto error;
+	}
+
+	/* Check permissions. */
+	if (resource->pid && (resource->pid != current->tgid)) {
+		pr_err("[%s]: current tgid %u != %u owner\n",
+			__func__, current->tgid, resource->pid);
+		ret = -EPERM;
+		goto error;
+	}
+
+	unlock.res_handle = resource->res_handle;
+	unlock.res_mem = (uint32_t)resource->res_base_mem;
+
+	pr_debug("[%s]: attempt to unlock data - guid %x, hdl %x, base address %p\n",
+		__func__, ioparam->handle, unlock.res_handle,
+		(void *)unlock.res_mem);
+
+	/* User space allocated resources. */
+	if (resource->pid) {
+		/* Flush if requested */
+		if (resource->res_cached && flush) {
+			dma_addr_t phys_addr = 0;
+
+			resource->res_stats[FLUSH]++;
+
+			phys_addr =
+			    (dma_addr_t)((uint32_t)resource->res_base_mem &
+					 0x3FFFFFFF);
+			phys_addr += (dma_addr_t)mm_vc_mem_phys_addr;
+
+			/* L1 cache flush */
+			down_read(&current->mm->mmap_sem);
+			list_for_each_entry(map, &resource->map_list,
+					    resource_map_list) {
+				if (map->vma) {
+					const unsigned long start = map->vma->vm_start;
+					const unsigned long end = map->vma->vm_end;
+
+					ret = clean_invalid_mem_walk(start, end - start,
+							VCSM_CACHE_OP_FLUSH);
+					if (ret)
+						goto error;
+				}
+			}
+			up_read(&current->mm->mmap_sem);
+
+			/* L2 cache flush */
+			outer_clean_range(phys_addr,
+					  phys_addr +
+					  (size_t) resource->res_size);
+		}
+
+		/* We need to zap all the vmas associated with this resource */
+		if (resource->lock_count == 1) {
+			down_read(&current->mm->mmap_sem);
+			list_for_each_entry(map, &resource->map_list,
+					    resource_map_list) {
+				if (map->vma) {
+					zap_vma_ptes(map->vma,
+						     map->vma->vm_start,
+						     map->vma->vm_end -
+						     map->vma->vm_start);
+				}
+			}
+			up_read(&current->mm->mmap_sem);
+		}
+	}
+	/* Kernel allocated resources. */
+	else {
+		/* Global + Taken in this context */
+		if (resource->ref_count == 2) {
+			if (!list_empty(&resource->map_list)) {
+				list_for_each_entry_safe(map, map_tmp,
+						&resource->map_list,
+						resource_map_list) {
+					if (map->res_addr) {
+						if (flush &&
+								(resource->res_cached ==
+									VMCS_SM_CACHE_HOST)) {
+							unsigned long
+								phys_addr;
+							phys_addr = (uint32_t)
+								resource->res_base_mem & 0x3FFFFFFF;
+							phys_addr +=
+								mm_vc_mem_phys_addr;
+
+							/* L1 cache flush */
+							dmac_flush_range((const
+										void
+										*)
+									map->res_addr, (const void *)
+									(map->res_addr + resource->res_size));
+
+							/* L2 cache flush */
+							outer_clean_range
+								(phys_addr,
+								 phys_addr +
+								 (size_t)
+								 resource->res_size);
+						}
+
+						iounmap((void *)map->res_addr);
+						map->res_addr = 0;
+
+						vmcs_sm_remove_map(sm_state,
+								map->resource,
+								map);
+						break;
+					}
+				}
+			}
+		}
+	}
+
+	if (resource->lock_count) {
+		/* Bypass the videocore unlock. */
+		if (no_vc_unlock)
+			status = 0;
+		/* Unlock the videocore allocated resource. */
+		else {
+			status =
+			    vc_vchi_sm_unlock(sm_state->sm_handle, &unlock,
+					      &private->int_trans_id,
+					      wait_reply);
+			if (status == -EINTR) {
+				pr_debug("[%s]: requesting unlock memory action restart (trans_id: %u)\n",
+					__func__, private->int_trans_id);
+
+				ret = -ERESTARTSYS;
+				resource->res_stats[UNLOCK]--;
+				private->restart_sys = -EINTR;
+				private->int_action = VC_SM_MSG_TYPE_UNLOCK;
+				goto error;
+			} else if (status != 0) {
+				pr_err("[%s]: failed to unlock vc mem (status: %u, trans_id: %u)\n",
+				     __func__, status, private->int_trans_id);
+
+				ret = -EPERM;
+				resource->res_stats[UNLOCK_FAIL]++;
+				goto error;
+			}
+		}
+
+		resource->res_stats[UNLOCK]++;
+		resource->lock_count--;
+	}
+
+	pr_debug("[%s]: success to unlock data - hdl %x, base address %p, ref-cnt %d\n",
+		__func__, unlock.res_handle, (void *)unlock.res_mem,
+		resource->lock_count);
+
+error:
+	if (resource)
+		vmcs_sm_release_resource(resource, 0);
+
+	return ret;
+}
+
+/* Import a contiguous block of memory to be shared with VC. */
+int vc_sm_ioctl_import_dmabuf(struct sm_priv_data_t *private,
+			      struct vmcs_sm_ioctl_import_dmabuf *ioparam,
+			      struct dma_buf *src_dma_buf)
+{
+	int ret = 0;
+	int status;
+	struct sm_resource_t *resource = NULL;
+	struct vc_sm_import import = { 0 };
+	struct vc_sm_import_result result = { 0 };
+	struct dma_buf *dma_buf;
+	struct dma_buf_attachment *attach = NULL;
+	struct sg_table *sgt = NULL;
+
+	/* Setup our allocation parameters */
+	if (src_dma_buf) {
+		get_dma_buf(src_dma_buf);
+		dma_buf = src_dma_buf;
+	} else {
+		dma_buf = dma_buf_get(ioparam->dmabuf_fd);
+	}
+	if (IS_ERR(dma_buf))
+		return PTR_ERR(dma_buf);
+
+	attach = dma_buf_attach(dma_buf, &sm_state->pdev->dev);
+	if (IS_ERR(attach)) {
+		ret = PTR_ERR(attach);
+		goto error;
+	}
+
+	sgt = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL);
+	if (IS_ERR(sgt)) {
+		ret = PTR_ERR(sgt);
+		goto error;
+	}
+
+	/* Verify that the address block is contiguous */
+	if (sgt->nents != 1) {
+		ret = -ENOMEM;
+		goto error;
+	}
+
+	import.type = ((ioparam->cached == VMCS_SM_CACHE_VC) ||
+		       (ioparam->cached == VMCS_SM_CACHE_BOTH)) ?
+				VC_SM_ALLOC_CACHED : VC_SM_ALLOC_NON_CACHED;
+	import.addr = (uint32_t)sg_dma_address(sgt->sgl);
+	import.size = sg_dma_len(sgt->sgl);
+	import.allocator = current->tgid;
+
+	if (*ioparam->name)
+		memcpy(import.name, ioparam->name, sizeof(import.name) - 1);
+	else
+		memcpy(import.name, VMCS_SM_RESOURCE_NAME_DEFAULT,
+		       sizeof(VMCS_SM_RESOURCE_NAME_DEFAULT));
+
+	pr_debug("[%s]: attempt to import \"%s\" data - type %u, addr %p, size %u\n",
+		 __func__, import.name, import.type,
+		 (void *)import.addr, import.size);
+
+	/* Allocate local resource to track this allocation. */
+	resource = kzalloc(sizeof(*resource), GFP_KERNEL);
+	if (!resource) {
+		ret = -ENOMEM;
+		goto error;
+	}
+	INIT_LIST_HEAD(&resource->map_list);
+	resource->ref_count++;
+	resource->pid = current->tgid;
+
+	/* Allocate the videocore resource. */
+	status = vc_vchi_sm_import(sm_state->sm_handle, &import, &result,
+				   &private->int_trans_id);
+	if (status == -EINTR) {
+		pr_debug("[%s]: requesting import memory action restart (trans_id: %u)\n",
+			 __func__, private->int_trans_id);
+		ret = -ERESTARTSYS;
+		private->restart_sys = -EINTR;
+		private->int_action = VC_SM_MSG_TYPE_IMPORT;
+		goto error;
+	} else if (status || !result.res_handle) {
+		pr_debug("[%s]: failed to import memory on videocore (status: %u, trans_id: %u)\n",
+			 __func__, status, private->int_trans_id);
+		ret = -ENOMEM;
+		resource->res_stats[ALLOC_FAIL]++;
+		goto error;
+	}
+
+	/* Keep track of the resource we created. */
+	resource->private = private;
+	resource->res_handle = result.res_handle;
+	resource->res_size = import.size;
+	resource->res_cached = ioparam->cached;
+
+	resource->dma_buf = dma_buf;
+	resource->attach = attach;
+	resource->sgt = sgt;
+	resource->dma_addr = sg_dma_address(sgt->sgl);
+
+	/*
+	 * Kernel/user GUID.  This global identifier is used for mmap'ing the
+	 * allocated region from user space, it is passed as the mmap'ing
+	 * offset, we use it to 'hide' the videocore handle/address.
+	 */
+	mutex_lock(&sm_state->lock);
+	resource->res_guid = ++sm_state->guid;
+	mutex_unlock(&sm_state->lock);
+	resource->res_guid <<= PAGE_SHIFT;
+
+	vmcs_sm_add_resource(private, resource);
+
+	/* We're done */
+	resource->res_stats[IMPORT]++;
+	ioparam->handle = resource->res_guid;
+	return 0;
+
+error:
+	resource->res_stats[IMPORT_FAIL]++;
+	if (resource) {
+		vc_sm_resource_deceased(resource, 1);
+		kfree(resource);
+	}
+	if (sgt)
+		dma_buf_unmap_attachment(attach, sgt, DMA_BIDIRECTIONAL);
+	if (attach)
+		dma_buf_detach(dma_buf, attach);
+	dma_buf_put(dma_buf);
+	return ret;
+}
+
+/* Handle control from host. */
+static long vc_sm_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+	int ret = 0;
+	unsigned int cmdnr = _IOC_NR(cmd);
+	struct sm_priv_data_t *file_data =
+	    (struct sm_priv_data_t *)file->private_data;
+	struct sm_resource_t *resource = NULL;
+
+	/* Validate we can work with this device. */
+	if ((sm_state == NULL) || (file_data == NULL)) {
+		pr_err("[%s]: invalid device\n", __func__);
+		ret = -EPERM;
+		goto out;
+	}
+
+	pr_debug("[%s]: cmd %x tgid %u, owner %u\n", __func__, cmdnr,
+			current->tgid, file_data->pid);
+
+	/* Action is a re-post of a previously interrupted action? */
+	if (file_data->restart_sys == -EINTR) {
+		struct vc_sm_action_clean_t action_clean;
+
+		pr_debug("[%s]: clean up of action %u (trans_id: %u) following EINTR\n",
+			__func__, file_data->int_action,
+			file_data->int_trans_id);
+
+		action_clean.res_action = file_data->int_action;
+		action_clean.action_trans_id = file_data->int_trans_id;
+
+		vc_vchi_sm_clean_up(sm_state->sm_handle, &action_clean);
+
+		file_data->restart_sys = 0;
+	}
+
+	/* Now process the command. */
+	switch (cmdnr) {
+		/* New memory allocation.
+		 */
+	case VMCS_SM_CMD_ALLOC:
+		{
+			struct vmcs_sm_ioctl_alloc ioparam;
+
+			/* Get the parameter data. */
+			if (copy_from_user
+			    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			ret = vc_sm_ioctl_alloc(file_data, &ioparam);
+			if (!ret &&
+			    (copy_to_user((void *)arg,
+					  &ioparam, sizeof(ioparam)) != 0)) {
+				struct vmcs_sm_ioctl_free freeparam = {
+					ioparam.handle
+				};
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+						__func__, cmdnr);
+				vc_sm_ioctl_free(file_data, &freeparam);
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Share existing memory allocation. */
+	case VMCS_SM_CMD_ALLOC_SHARE:
+		{
+			struct vmcs_sm_ioctl_alloc_share ioparam;
+
+			/* Get the parameter data. */
+			if (copy_from_user
+			    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			ret = vc_sm_ioctl_alloc_share(file_data, &ioparam);
+
+			/* Copy result back to user. */
+			if (!ret
+			    && copy_to_user((void *)arg, &ioparam,
+					    sizeof(ioparam)) != 0) {
+				struct vmcs_sm_ioctl_free freeparam = {
+					ioparam.handle
+				};
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+						__func__, cmdnr);
+				vc_sm_ioctl_free(file_data, &freeparam);
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+	case VMCS_SM_CMD_IMPORT_DMABUF:
+		{
+			struct vmcs_sm_ioctl_import_dmabuf ioparam;
+
+			/* Get the parameter data. */
+			if (copy_from_user
+			    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+				       __func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			ret = vc_sm_ioctl_import_dmabuf(file_data, &ioparam,
+							NULL);
+			if (!ret &&
+			    (copy_to_user((void *)arg,
+					  &ioparam, sizeof(ioparam)) != 0)) {
+				struct vmcs_sm_ioctl_free freeparam = {
+					ioparam.handle
+				};
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+				       __func__, cmdnr);
+				vc_sm_ioctl_free(file_data, &freeparam);
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Lock (attempt to) *and* register a cache behavior change. */
+	case VMCS_SM_CMD_LOCK_CACHE:
+		{
+			struct vmcs_sm_ioctl_lock_cache ioparam;
+			struct vmcs_sm_ioctl_lock_unlock lock;
+
+			/* Get parameter data. */
+			if (copy_from_user
+			    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			lock.handle = ioparam.handle;
+			ret =
+			    vc_sm_ioctl_lock(file_data, &lock, 1,
+					     ioparam.cached, 0);
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Lock (attempt to) existing memory allocation. */
+	case VMCS_SM_CMD_LOCK:
+		{
+			struct vmcs_sm_ioctl_lock_unlock ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user
+			    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			ret = vc_sm_ioctl_lock(file_data, &ioparam, 0, 0, 0);
+
+			/* Copy result back to user. */
+			if (copy_to_user((void *)arg, &ioparam, sizeof(ioparam))
+			    != 0) {
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+				     __func__, cmdnr);
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Unlock (attempt to) existing memory allocation. */
+	case VMCS_SM_CMD_UNLOCK:
+		{
+			struct vmcs_sm_ioctl_lock_unlock ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user
+			    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			ret = vc_sm_ioctl_unlock(file_data, &ioparam, 0, 1, 0);
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Resize (attempt to) existing memory allocation. */
+	case VMCS_SM_CMD_RESIZE:
+		{
+			struct vmcs_sm_ioctl_resize ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user
+			    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			ret = vc_sm_ioctl_resize(file_data, &ioparam);
+
+			/* Copy result back to user. */
+			if (copy_to_user((void *)arg, &ioparam, sizeof(ioparam))
+			    != 0) {
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+				     __func__, cmdnr);
+				ret = -EFAULT;
+			}
+			goto out;
+		}
+		break;
+
+		/* Terminate existing memory allocation.
+		 */
+	case VMCS_SM_CMD_FREE:
+		{
+			struct vmcs_sm_ioctl_free ioparam;
+
+			/* Get parameter data.
+			 */
+			if (copy_from_user
+			    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			ret = vc_sm_ioctl_free(file_data, &ioparam);
+
+			/* Done.
+			 */
+			goto out;
+		}
+		break;
+
+		/* Walk allocation on videocore, information shows up in the
+		 ** videocore log.
+		 */
+	case VMCS_SM_CMD_VC_WALK_ALLOC:
+		{
+			pr_debug("[%s]: invoking walk alloc\n", __func__);
+
+			if (vc_vchi_sm_walk_alloc(sm_state->sm_handle) != 0)
+				pr_err("[%s]: failed to walk-alloc on videocore\n",
+				     __func__);
+
+			/* Done.
+			 */
+			goto out;
+		}
+		break;
+		/* Walk mapping table on host, information shows up in the
+		 ** kernel log.
+		 */
+	case VMCS_SM_CMD_HOST_WALK_MAP:
+		{
+			/* Use pid of -1 to tell to walk the whole map. */
+			vmcs_sm_host_walk_map_per_pid(-1);
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Walk mapping table per process on host.  */
+	case VMCS_SM_CMD_HOST_WALK_PID_ALLOC:
+		{
+			struct vmcs_sm_ioctl_walk ioparam;
+
+			/* Get parameter data.  */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			vmcs_sm_host_walk_alloc(file_data);
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Walk allocation per process on host.  */
+	case VMCS_SM_CMD_HOST_WALK_PID_MAP:
+		{
+			struct vmcs_sm_ioctl_walk ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			vmcs_sm_host_walk_map_per_pid(ioparam.pid);
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Gets the size of the memory associated with a user handle. */
+	case VMCS_SM_CMD_SIZE_USR_HANDLE:
+		{
+			struct vmcs_sm_ioctl_size ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			/* Locate resource from GUID. */
+			resource =
+			    vmcs_sm_acquire_resource(file_data, ioparam.handle);
+			if (resource != NULL) {
+				ioparam.size = resource->res_size;
+				vmcs_sm_release_resource(resource, 0);
+			} else {
+				ioparam.size = 0;
+			}
+
+			if (copy_to_user((void *)arg,
+					 &ioparam, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+				     __func__, cmdnr);
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Verify we are dealing with a valid resource. */
+	case VMCS_SM_CMD_CHK_USR_HANDLE:
+		{
+			struct vmcs_sm_ioctl_chk ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+
+				ret = -EFAULT;
+				goto out;
+			}
+
+			/* Locate resource from GUID. */
+			resource =
+			    vmcs_sm_acquire_resource(file_data, ioparam.handle);
+			if (resource == NULL)
+				ret = -EINVAL;
+			/*
+			 * If the resource is cacheable, return additional
+			 * information that may be needed to flush the cache.
+			 */
+			else if ((resource->res_cached == VMCS_SM_CACHE_HOST) ||
+				 (resource->res_cached == VMCS_SM_CACHE_BOTH)) {
+				ioparam.addr =
+				    vmcs_sm_usr_address_from_pid_and_usr_handle
+				    (current->tgid, ioparam.handle);
+				ioparam.size = resource->res_size;
+				ioparam.cache = resource->res_cached;
+			} else {
+				ioparam.addr = 0;
+				ioparam.size = 0;
+				ioparam.cache = resource->res_cached;
+			}
+
+			if (resource)
+				vmcs_sm_release_resource(resource, 0);
+
+			if (copy_to_user((void *)arg,
+					 &ioparam, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/*
+		 * Maps a user handle given the process and the virtual address.
+		 */
+	case VMCS_SM_CMD_MAPPED_USR_HANDLE:
+		{
+			struct vmcs_sm_ioctl_map ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+
+				ret = -EFAULT;
+				goto out;
+			}
+
+			ioparam.handle =
+			    vmcs_sm_usr_handle_from_pid_and_address(
+					    ioparam.pid, ioparam.addr);
+
+			resource =
+			    vmcs_sm_acquire_resource(file_data, ioparam.handle);
+			if ((resource != NULL)
+			    && ((resource->res_cached == VMCS_SM_CACHE_HOST)
+				|| (resource->res_cached ==
+				    VMCS_SM_CACHE_BOTH))) {
+				ioparam.size = resource->res_size;
+			} else {
+				ioparam.size = 0;
+			}
+
+			if (resource)
+				vmcs_sm_release_resource(resource, 0);
+
+			if (copy_to_user((void *)arg,
+					 &ioparam, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+				     __func__, cmdnr);
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/*
+		 * Maps a videocore handle given process and virtual address.
+		 */
+	case VMCS_SM_CMD_MAPPED_VC_HDL_FROM_ADDR:
+		{
+			struct vmcs_sm_ioctl_map ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			ioparam.handle = vmcs_sm_vc_handle_from_pid_and_address(
+					    ioparam.pid, ioparam.addr);
+
+			if (copy_to_user((void *)arg,
+					 &ioparam, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+				     __func__, cmdnr);
+
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Maps a videocore handle given process and user handle. */
+	case VMCS_SM_CMD_MAPPED_VC_HDL_FROM_HDL:
+		{
+			struct vmcs_sm_ioctl_map ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			/* Locate resource from GUID. */
+			resource =
+			    vmcs_sm_acquire_resource(file_data, ioparam.handle);
+			if (resource != NULL) {
+				ioparam.handle = resource->res_handle;
+				vmcs_sm_release_resource(resource, 0);
+			} else {
+				ioparam.handle = 0;
+			}
+
+			if (copy_to_user((void *)arg,
+					 &ioparam, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+				     __func__, cmdnr);
+
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/*
+		 * Maps a videocore address given process and videocore handle.
+		 */
+	case VMCS_SM_CMD_MAPPED_VC_ADDR_FROM_HDL:
+		{
+			struct vmcs_sm_ioctl_map ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+
+				ret = -EFAULT;
+				goto out;
+			}
+
+			/* Locate resource from GUID. */
+			resource =
+			    vmcs_sm_acquire_resource(file_data, ioparam.handle);
+			if (resource != NULL) {
+				ioparam.addr =
+					(unsigned int)resource->res_base_mem;
+				vmcs_sm_release_resource(resource, 0);
+			} else {
+				ioparam.addr = 0;
+			}
+
+			if (copy_to_user((void *)arg,
+					 &ioparam, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+				     __func__, cmdnr);
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Maps a user address given process and vc handle. */
+	case VMCS_SM_CMD_MAPPED_USR_ADDRESS:
+		{
+			struct vmcs_sm_ioctl_map ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			/*
+			 * Return the address information from the mapping,
+			 * 0 (ie NULL) if it cannot locate the actual mapping.
+			 */
+			ioparam.addr =
+			    vmcs_sm_usr_address_from_pid_and_usr_handle
+			    (ioparam.pid, ioparam.handle);
+
+			if (copy_to_user((void *)arg,
+					 &ioparam, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-to-user for cmd %x\n",
+				     __func__, cmdnr);
+				ret = -EFAULT;
+			}
+
+			/* Done. */
+			goto out;
+		}
+		break;
+
+		/* Flush the cache for a given mapping. */
+	case VMCS_SM_CMD_FLUSH:
+		{
+			struct vmcs_sm_ioctl_cache ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			/* Locate resource from GUID. */
+			resource =
+			    vmcs_sm_acquire_resource(file_data, ioparam.handle);
+			if (resource == NULL) {
+				ret = -EINVAL;
+				goto out;
+			}
+
+			ret = clean_invalid_resource_walk((void __user*) ioparam.addr,
+					ioparam.size, VCSM_CACHE_OP_FLUSH, ioparam.handle,
+					resource);
+			vmcs_sm_release_resource(resource, 0);
+			if (ret)
+				goto out;
+		}
+		break;
+
+		/* Invalidate the cache for a given mapping. */
+	case VMCS_SM_CMD_INVALID:
+		{
+			struct vmcs_sm_ioctl_cache ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+
+			/* Locate resource from GUID. */
+			resource =
+			    vmcs_sm_acquire_resource(file_data, ioparam.handle);
+			if (resource == NULL) {
+				ret = -EINVAL;
+				goto out;
+			}
+
+			ret = clean_invalid_resource_walk((void __user*) ioparam.addr,
+					ioparam.size, VCSM_CACHE_OP_INV, ioparam.handle, resource);
+			vmcs_sm_release_resource(resource, 0);
+			if (ret)
+				goto out;
+		}
+		break;
+
+	/* Flush/Invalidate the cache for a given mapping. */
+	case VMCS_SM_CMD_CLEAN_INVALID:
+		{
+			int i;
+			struct vmcs_sm_ioctl_clean_invalid ioparam;
+
+			/* Get parameter data. */
+			if (copy_from_user(&ioparam,
+					   (void *)arg, sizeof(ioparam)) != 0) {
+				pr_err("[%s]: failed to copy-from-user for cmd %x\n",
+						__func__, cmdnr);
+				ret = -EFAULT;
+				goto out;
+			}
+			for (i = 0; i < sizeof(ioparam.s) / sizeof(*ioparam.s); i++) {
+				if (ioparam.s[i].cmd == VCSM_CACHE_OP_NOP)
+					break;
+
+				/* Locate resource from GUID. */
+				resource =
+					vmcs_sm_acquire_resource(file_data, ioparam.s[i].handle);
+				if (resource == NULL) {
+					ret = -EINVAL;
+					goto out;
+				}
+
+				ret = clean_invalid_resource_walk(
+						(void __user*) ioparam.s[i].addr, ioparam.s[i].size,
+						ioparam.s[i].cmd, ioparam.s[i].handle, resource);
+				vmcs_sm_release_resource(resource, 0);
+				if (ret)
+					goto out;
+			}
+		}
+		break;
+	/*
+	 * Flush/Invalidate the cache for a given mapping.
+	 * Blocks must be pinned (i.e. accessed) before this call.
+	 */
+	case VMCS_SM_CMD_CLEAN_INVALID2:
+		{
+				int i;
+				struct vmcs_sm_ioctl_clean_invalid2 ioparam;
+				struct vmcs_sm_ioctl_clean_invalid_block *block = NULL;
+
+				/* Get parameter data. */
+				if (copy_from_user(&ioparam,
+						   (void *)arg, sizeof(ioparam)) != 0) {
+					pr_err("[%s]: failed to copy-from-user header for cmd %x\n",
+							__func__, cmdnr);
+					ret = -EFAULT;
+					goto out;
+				}
+				block = kmalloc(ioparam.op_count *
+						sizeof(struct vmcs_sm_ioctl_clean_invalid_block),
+						GFP_KERNEL);
+				if (!block) {
+					ret = -EFAULT;
+					goto out;
+				}
+				if (copy_from_user(block,
+						   (void *)(arg + sizeof(ioparam)), ioparam.op_count * sizeof(struct vmcs_sm_ioctl_clean_invalid_block)) != 0) {
+					pr_err("[%s]: failed to copy-from-user payload for cmd %x\n",
+							__func__, cmdnr);
+					ret = -EFAULT;
+					goto out;
+				}
+
+				for (i = 0; i < ioparam.op_count; i++) {
+					const struct vmcs_sm_ioctl_clean_invalid_block * const op = block + i;
+
+					if (op->invalidate_mode == VCSM_CACHE_OP_NOP)
+						continue;
+
+					ret = clean_invalid_contiguous_mem_2d(
+							(void __user*) op->start_address, op->block_count,
+							op->block_size, op->inter_block_stride,
+							op->invalidate_mode);
+					if (ret)
+						break;
+				}
+				kfree(block);
+			}
+		break;
+
+	default:
+		{
+			ret = -EINVAL;
+			goto out;
+		}
+		break;
+	}
+
+out:
+	return ret;
+}
+
+/* Device operations that we managed in this driver. */
+static const struct file_operations vmcs_sm_ops = {
+	.owner = THIS_MODULE,
+	.unlocked_ioctl = vc_sm_ioctl,
+	.open = vc_sm_open,
+	.release = vc_sm_release,
+	.mmap = vc_sm_mmap,
+};
+
+/* Creation of device. */
+static int vc_sm_create_sharedmemory(void)
+{
+	int ret;
+
+	if (sm_state == NULL) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	/* Create a device class for creating dev nodes. */
+	sm_state->sm_class = class_create(THIS_MODULE, "vc-sm");
+	if (IS_ERR(sm_state->sm_class)) {
+		pr_err("[%s]: unable to create device class\n", __func__);
+		ret = PTR_ERR(sm_state->sm_class);
+		goto out;
+	}
+
+	/* Create a character driver. */
+	ret = alloc_chrdev_region(&sm_state->sm_devid,
+				  DEVICE_MINOR, 1, DEVICE_NAME);
+	if (ret != 0) {
+		pr_err("[%s]: unable to allocate device number\n", __func__);
+		goto out_dev_class_destroy;
+	}
+
+	cdev_init(&sm_state->sm_cdev, &vmcs_sm_ops);
+	ret = cdev_add(&sm_state->sm_cdev, sm_state->sm_devid, 1);
+	if (ret != 0) {
+		pr_err("[%s]: unable to register device\n", __func__);
+		goto out_chrdev_unreg;
+	}
+
+	/* Create a device node. */
+	sm_state->sm_dev = device_create(sm_state->sm_class,
+					 NULL,
+					 MKDEV(MAJOR(sm_state->sm_devid),
+					       DEVICE_MINOR), NULL,
+					 DEVICE_NAME);
+	if (IS_ERR(sm_state->sm_dev)) {
+		pr_err("[%s]: unable to create device node\n", __func__);
+		ret = PTR_ERR(sm_state->sm_dev);
+		goto out_chrdev_del;
+	}
+
+	goto out;
+
+out_chrdev_del:
+	cdev_del(&sm_state->sm_cdev);
+out_chrdev_unreg:
+	unregister_chrdev_region(sm_state->sm_devid, 1);
+out_dev_class_destroy:
+	class_destroy(sm_state->sm_class);
+	sm_state->sm_class = NULL;
+out:
+	return ret;
+}
+
+/* Termination of the device. */
+static int vc_sm_remove_sharedmemory(void)
+{
+	int ret;
+
+	if (sm_state == NULL) {
+		/* Nothing to do. */
+		ret = 0;
+		goto out;
+	}
+
+	/* Remove the sharedmemory character driver. */
+	cdev_del(&sm_state->sm_cdev);
+
+	/* Unregister region. */
+	unregister_chrdev_region(sm_state->sm_devid, 1);
+
+	ret = 0;
+	goto out;
+
+out:
+	return ret;
+}
+
+/* Videocore connected.  */
+static void vc_sm_connected_init(void)
+{
+	int ret;
+	VCHI_INSTANCE_T vchi_instance;
+	VCHI_CONNECTION_T *vchi_connection = NULL;
+
+	pr_info("[%s]: start\n", __func__);
+
+	/*
+	 * Initialize and create a VCHI connection for the shared memory service
+	 * running on videocore.
+	 */
+	ret = vchi_initialise(&vchi_instance);
+	if (ret != 0) {
+		pr_err("[%s]: failed to initialise VCHI instance (ret=%d)\n",
+			__func__, ret);
+
+		ret = -EIO;
+		goto err_free_mem;
+	}
+
+	ret = vchi_connect(NULL, 0, vchi_instance);
+	if (ret != 0) {
+		pr_err("[%s]: failed to connect VCHI instance (ret=%d)\n",
+			__func__, ret);
+
+		ret = -EIO;
+		goto err_free_mem;
+	}
+
+	/* Initialize an instance of the shared memory service. */
+	sm_state->sm_handle =
+	    vc_vchi_sm_init(vchi_instance, &vchi_connection, 1);
+	if (sm_state->sm_handle == NULL) {
+		pr_err("[%s]: failed to initialize shared memory service\n",
+			__func__);
+
+		ret = -EPERM;
+		goto err_free_mem;
+	}
+
+	/* Create a debug fs directory entry (root). */
+	sm_state->dir_root = debugfs_create_dir(VC_SM_DIR_ROOT_NAME, NULL);
+	if (!sm_state->dir_root) {
+		pr_err("[%s]: failed to create \'%s\' directory entry\n",
+			__func__, VC_SM_DIR_ROOT_NAME);
+
+		ret = -EPERM;
+		goto err_stop_sm_service;
+	}
+
+	sm_state->dir_state.show = &vc_sm_global_state_show;
+	sm_state->dir_state.dir_entry = debugfs_create_file(VC_SM_STATE,
+			0444, sm_state->dir_root, &sm_state->dir_state,
+			&vc_sm_debug_fs_fops);
+
+	sm_state->dir_stats.show = &vc_sm_global_statistics_show;
+	sm_state->dir_stats.dir_entry = debugfs_create_file(VC_SM_STATS,
+			0444, sm_state->dir_root, &sm_state->dir_stats,
+			&vc_sm_debug_fs_fops);
+
+	/* Create the proc entry children. */
+	sm_state->dir_alloc = debugfs_create_dir(VC_SM_DIR_ALLOC_NAME,
+			sm_state->dir_root);
+
+	/* Create a shared memory device. */
+	ret = vc_sm_create_sharedmemory();
+	if (ret != 0) {
+		pr_err("[%s]: failed to create shared memory device\n",
+			__func__);
+		goto err_remove_debugfs;
+	}
+
+	INIT_LIST_HEAD(&sm_state->map_list);
+	INIT_LIST_HEAD(&sm_state->resource_list);
+
+	sm_state->data_knl = vc_sm_create_priv_data(0);
+	if (sm_state->data_knl == NULL) {
+		pr_err("[%s]: failed to create kernel private data tracker\n",
+			__func__);
+		goto err_remove_shared_memory;
+	}
+
+	/* Done! */
+	sm_inited = 1;
+	goto out;
+
+err_remove_shared_memory:
+	vc_sm_remove_sharedmemory();
+err_remove_debugfs:
+	debugfs_remove_recursive(sm_state->dir_root);
+err_stop_sm_service:
+	vc_vchi_sm_stop(&sm_state->sm_handle);
+err_free_mem:
+	kfree(sm_state);
+out:
+	pr_info("[%s]: end - returning %d\n", __func__, ret);
+}
+
+/* Driver loading. */
+static int bcm2835_vcsm_probe(struct platform_device *pdev)
+{
+	pr_info("vc-sm: Videocore shared memory driver\n");
+
+	sm_state = kzalloc(sizeof(*sm_state), GFP_KERNEL);
+	if (!sm_state)
+		return -ENOMEM;
+	sm_state->pdev = pdev;
+	mutex_init(&sm_state->lock);
+	mutex_init(&sm_state->map_lock);
+
+	vchiq_add_connected_callback(vc_sm_connected_init);
+	return 0;
+}
+
+/* Driver unloading. */
+static int bcm2835_vcsm_remove(struct platform_device *pdev)
+{
+	pr_debug("[%s]: start\n", __func__);
+	if (sm_inited) {
+		/* Remove shared memory device. */
+		vc_sm_remove_sharedmemory();
+
+		/* Remove all proc entries. */
+		debugfs_remove_recursive(sm_state->dir_root);
+
+		/* Stop the videocore shared memory service. */
+		vc_vchi_sm_stop(&sm_state->sm_handle);
+
+		/* Free the memory for the state structure. */
+		mutex_destroy(&(sm_state->map_lock));
+		kfree(sm_state);
+	}
+
+	pr_debug("[%s]: end\n", __func__);
+	return 0;
+}
+
+#if defined(__KERNEL__)
+/* Allocate a shared memory handle and block. */
+int vc_sm_alloc(struct vc_sm_alloc_t *alloc, int *handle)
+{
+	struct vmcs_sm_ioctl_alloc ioparam = { 0 };
+	int ret;
+	struct sm_resource_t *resource;
+
+	/* Validate we can work with this device. */
+	if (sm_state == NULL || alloc == NULL || handle == NULL) {
+		pr_err("[%s]: invalid input\n", __func__);
+		return -EPERM;
+	}
+
+	ioparam.size = alloc->base_unit;
+	ioparam.num = alloc->num_unit;
+	ioparam.cached =
+	    alloc->type == VC_SM_ALLOC_CACHED ? VMCS_SM_CACHE_VC : 0;
+
+	ret = vc_sm_ioctl_alloc(sm_state->data_knl, &ioparam);
+
+	if (ret == 0) {
+		resource =
+		    vmcs_sm_acquire_resource(sm_state->data_knl,
+					     ioparam.handle);
+		if (resource) {
+			resource->pid = 0;
+			vmcs_sm_release_resource(resource, 0);
+
+			/* Assign valid handle at this time. */
+			*handle = ioparam.handle;
+		} else {
+			ret = -ENOMEM;
+		}
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(vc_sm_alloc);
+
+/* Get an internal resource handle mapped from the external one. */
+int vc_sm_int_handle(int handle)
+{
+	struct sm_resource_t *resource;
+	int ret = 0;
+
+	/* Validate we can work with this device. */
+	if (sm_state == NULL || handle == 0) {
+		pr_err("[%s]: invalid input\n", __func__);
+		return 0;
+	}
+
+	/* Locate resource from GUID. */
+	resource = vmcs_sm_acquire_resource(sm_state->data_knl, handle);
+	if (resource) {
+		ret = resource->res_handle;
+		vmcs_sm_release_resource(resource, 0);
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(vc_sm_int_handle);
+
+/* Free a previously allocated shared memory handle and block. */
+int vc_sm_free(int handle)
+{
+	struct vmcs_sm_ioctl_free ioparam = { handle };
+
+	/* Validate we can work with this device. */
+	if (sm_state == NULL || handle == 0) {
+		pr_err("[%s]: invalid input\n", __func__);
+		return -EPERM;
+	}
+
+	return vc_sm_ioctl_free(sm_state->data_knl, &ioparam);
+}
+EXPORT_SYMBOL_GPL(vc_sm_free);
+
+/* Lock a memory handle for use by kernel. */
+int vc_sm_lock(int handle, enum vc_sm_lock_cache_mode mode,
+	       unsigned long *data)
+{
+	struct vmcs_sm_ioctl_lock_unlock ioparam;
+	int ret;
+
+	/* Validate we can work with this device. */
+	if (sm_state == NULL || handle == 0 || data == NULL) {
+		pr_err("[%s]: invalid input\n", __func__);
+		return -EPERM;
+	}
+
+	*data = 0;
+
+	ioparam.handle = handle;
+	ret = vc_sm_ioctl_lock(sm_state->data_knl,
+			       &ioparam,
+			       1,
+			       ((mode ==
+				 VC_SM_LOCK_CACHED) ? VMCS_SM_CACHE_HOST :
+				VMCS_SM_CACHE_NONE), 0);
+
+	*data = ioparam.addr;
+	return ret;
+}
+EXPORT_SYMBOL_GPL(vc_sm_lock);
+
+/* Unlock a memory handle in use by kernel. */
+int vc_sm_unlock(int handle, int flush, int no_vc_unlock)
+{
+	struct vmcs_sm_ioctl_lock_unlock ioparam;
+
+	/* Validate we can work with this device. */
+	if (sm_state == NULL || handle == 0) {
+		pr_err("[%s]: invalid input\n", __func__);
+		return -EPERM;
+	}
+
+	ioparam.handle = handle;
+	return vc_sm_ioctl_unlock(sm_state->data_knl,
+				  &ioparam, flush, 0, no_vc_unlock);
+}
+EXPORT_SYMBOL_GPL(vc_sm_unlock);
+
+/* Map a shared memory region for use by kernel. */
+int vc_sm_map(int handle, unsigned int sm_addr,
+	      enum vc_sm_lock_cache_mode mode, unsigned long *data)
+{
+	struct vmcs_sm_ioctl_lock_unlock ioparam;
+	int ret;
+
+	/* Validate we can work with this device. */
+	if (sm_state == NULL || handle == 0 || data == NULL || sm_addr == 0) {
+		pr_err("[%s]: invalid input\n", __func__);
+		return -EPERM;
+	}
+
+	*data = 0;
+
+	ioparam.handle = handle;
+	ret = vc_sm_ioctl_lock(sm_state->data_knl,
+			       &ioparam,
+			       1,
+			       ((mode ==
+				 VC_SM_LOCK_CACHED) ? VMCS_SM_CACHE_HOST :
+				VMCS_SM_CACHE_NONE), sm_addr);
+
+	*data = ioparam.addr;
+	return ret;
+}
+EXPORT_SYMBOL_GPL(vc_sm_map);
+
+/* Import a dmabuf to be shared with VC. */
+int vc_sm_import_dmabuf(struct dma_buf *dmabuf, int *handle)
+{
+	struct vmcs_sm_ioctl_import_dmabuf ioparam = { 0 };
+	int ret;
+	struct sm_resource_t *resource;
+
+	/* Validate we can work with this device. */
+	if (!sm_state || !dmabuf || !handle) {
+		pr_err("[%s]: invalid input\n", __func__);
+		return -EPERM;
+	}
+
+	ioparam.cached = 0;
+	strcpy(ioparam.name, "KRNL DMABUF");
+
+	ret = vc_sm_ioctl_import_dmabuf(sm_state->data_knl, &ioparam, dmabuf);
+
+	if (!ret) {
+		resource = vmcs_sm_acquire_resource(sm_state->data_knl,
+						    ioparam.handle);
+		if (resource) {
+			resource->pid = 0;
+			vmcs_sm_release_resource(resource, 0);
+
+			/* Assign valid handle at this time.*/
+			*handle = ioparam.handle;
+		} else {
+			ret = -ENOMEM;
+		}
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(vc_sm_import_dmabuf);
+#endif
+
+/*
+ *   Register the driver with device tree
+ */
+
+static const struct of_device_id bcm2835_vcsm_of_match[] = {
+	{.compatible = "raspberrypi,bcm2835-vcsm",},
+	{ /* sentinel */ },
+};
+
+MODULE_DEVICE_TABLE(of, bcm2835_vcsm_of_match);
+
+static struct platform_driver bcm2835_vcsm_driver = {
+	.probe = bcm2835_vcsm_probe,
+	.remove = bcm2835_vcsm_remove,
+	.driver = {
+		   .name = DRIVER_NAME,
+		   .owner = THIS_MODULE,
+		   .of_match_table = bcm2835_vcsm_of_match,
+		   },
+};
+
+module_platform_driver(bcm2835_vcsm_driver);
+
+MODULE_AUTHOR("Broadcom");
+MODULE_DESCRIPTION("VideoCore SharedMemory Driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/char/broadcom/vcio.c b/drivers/char/broadcom/vcio.c
new file mode 100644
index 000000000000..c19bc2075c77
--- /dev/null
+++ b/drivers/char/broadcom/vcio.c
@@ -0,0 +1,175 @@
+/*
+ *  Copyright (C) 2010 Broadcom
+ *  Copyright (C) 2015 Noralf Trønnes
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/cdev.h>
+#include <linux/device.h>
+#include <linux/fs.h>
+#include <linux/init.h>
+#include <linux/ioctl.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+#define MBOX_CHAN_PROPERTY 8
+
+#define VCIO_IOC_MAGIC 100
+#define IOCTL_MBOX_PROPERTY _IOWR(VCIO_IOC_MAGIC, 0, char *)
+
+static struct {
+	dev_t devt;
+	struct cdev cdev;
+	struct class *class;
+	struct rpi_firmware *fw;
+} vcio;
+
+static int vcio_user_property_list(void *user)
+{
+	u32 *buf, size;
+	int ret;
+
+	/* The first 32-bit is the size of the buffer */
+	if (copy_from_user(&size, user, sizeof(size)))
+		return -EFAULT;
+
+	buf = kmalloc(size, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	if (copy_from_user(buf, user, size)) {
+		kfree(buf);
+		return -EFAULT;
+	}
+
+	/* Strip off protocol encapsulation */
+	ret = rpi_firmware_property_list(vcio.fw, &buf[2], size - 12);
+	if (ret) {
+		kfree(buf);
+		return ret;
+	}
+
+	buf[1] = RPI_FIRMWARE_STATUS_SUCCESS;
+	if (copy_to_user(user, buf, size))
+		ret = -EFAULT;
+
+	kfree(buf);
+
+	return ret;
+}
+
+static int vcio_device_open(struct inode *inode, struct file *file)
+{
+	try_module_get(THIS_MODULE);
+
+	return 0;
+}
+
+static int vcio_device_release(struct inode *inode, struct file *file)
+{
+	module_put(THIS_MODULE);
+
+	return 0;
+}
+
+static long vcio_device_ioctl(struct file *file, unsigned int ioctl_num,
+			      unsigned long ioctl_param)
+{
+	switch (ioctl_num) {
+	case IOCTL_MBOX_PROPERTY:
+		return vcio_user_property_list((void *)ioctl_param);
+	default:
+		pr_err("unknown ioctl: %d\n", ioctl_num);
+		return -EINVAL;
+	}
+}
+
+const struct file_operations vcio_fops = {
+	.unlocked_ioctl = vcio_device_ioctl,
+	.open = vcio_device_open,
+	.release = vcio_device_release,
+};
+
+static int __init vcio_init(void)
+{
+	struct device_node *np;
+	static struct device *dev;
+	int ret;
+
+	np = of_find_compatible_node(NULL, NULL,
+				     "raspberrypi,bcm2835-firmware");
+/* Uncomment this when we only boot with Device Tree
+	if (!of_device_is_available(np))
+		return -ENODEV;
+*/
+	vcio.fw = rpi_firmware_get(np);
+	if (!vcio.fw)
+		return -ENODEV;
+
+	ret = alloc_chrdev_region(&vcio.devt, 0, 1, "vcio");
+	if (ret) {
+		pr_err("failed to allocate device number\n");
+		return ret;
+	}
+
+	cdev_init(&vcio.cdev, &vcio_fops);
+	vcio.cdev.owner = THIS_MODULE;
+	ret = cdev_add(&vcio.cdev, vcio.devt, 1);
+	if (ret) {
+		pr_err("failed to register device\n");
+		goto err_unregister_chardev;
+	}
+
+	/*
+	 * Create sysfs entries
+	 * 'bcm2708_vcio' is used for backwards compatibility so we don't break
+	 * userspace. Raspian has a udev rule that changes the permissions.
+	 */
+	vcio.class = class_create(THIS_MODULE, "bcm2708_vcio");
+	if (IS_ERR(vcio.class)) {
+		ret = PTR_ERR(vcio.class);
+		pr_err("failed to create class\n");
+		goto err_cdev_del;
+	}
+
+	dev = device_create(vcio.class, NULL, vcio.devt, NULL, "vcio");
+	if (IS_ERR(dev)) {
+		ret = PTR_ERR(dev);
+		pr_err("failed to create device\n");
+		goto err_class_destroy;
+	}
+
+	return 0;
+
+err_class_destroy:
+	class_destroy(vcio.class);
+err_cdev_del:
+	cdev_del(&vcio.cdev);
+err_unregister_chardev:
+	unregister_chrdev_region(vcio.devt, 1);
+
+	return ret;
+}
+module_init(vcio_init);
+
+static void __exit vcio_exit(void)
+{
+	device_destroy(vcio.class, vcio.devt);
+	class_destroy(vcio.class);
+	cdev_del(&vcio.cdev);
+	unregister_chrdev_region(vcio.devt, 1);
+}
+module_exit(vcio_exit);
+
+MODULE_AUTHOR("Gray Girling");
+MODULE_AUTHOR("Noralf Trønnes");
+MODULE_DESCRIPTION("Mailbox userspace access");
+MODULE_LICENSE("GPL");
diff --git a/drivers/char/hw_random/bcm2835-rng.c b/drivers/char/hw_random/bcm2835-rng.c
index 574211a49549..e66c0fca8c60 100644
--- a/drivers/char/hw_random/bcm2835-rng.c
+++ b/drivers/char/hw_random/bcm2835-rng.c
@@ -102,9 +102,10 @@ static int bcm2835_rng_probe(struct platform_device *pdev)
 		rng_setup(rng_base);
 
 	/* set warm-up count & enable */
-	__raw_writel(RNG_WARMUP_COUNT, rng_base + RNG_STATUS);
-	__raw_writel(RNG_RBGEN, rng_base + RNG_CTRL);
-
+	if (!(__raw_readl(rng_base + RNG_CTRL) & RNG_RBGEN)) {
+		__raw_writel(RNG_WARMUP_COUNT, rng_base + RNG_STATUS);
+		__raw_writel(RNG_RBGEN, rng_base + RNG_CTRL);
+	}
 	/* register driver */
 	err = hwrng_register(&bcm2835_rng_ops);
 	if (err) {
diff --git a/drivers/clk/Makefile b/drivers/clk/Makefile
index f7f761b02bed..3bb3ad099a02 100644
--- a/drivers/clk/Makefile
+++ b/drivers/clk/Makefile
@@ -18,6 +18,7 @@ endif
 
 # hardware specific clock types
 # please keep this section sorted lexicographically by file path name
+obj-$(CONFIG_SND_BCM2708_SOC_ALLO_BOSS_DAC)	+= clk-allo-dac.o
 obj-$(CONFIG_MACH_ASM9260)		+= clk-asm9260.o
 obj-$(CONFIG_COMMON_CLK_AXI_CLKGEN)	+= clk-axi-clkgen.o
 obj-$(CONFIG_ARCH_AXXIA)		+= clk-axm5516.o
@@ -29,6 +30,7 @@ obj-$(CONFIG_ARCH_EFM32)		+= clk-efm32gg.o
 obj-$(CONFIG_COMMON_CLK_GEMINI)		+= clk-gemini.o
 obj-$(CONFIG_ARCH_HIGHBANK)		+= clk-highbank.o
 obj-$(CONFIG_CLK_HSDK)			+= clk-hsdk-pll.o
+obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS) += clk-hifiberry-dacpro.o
 obj-$(CONFIG_COMMON_CLK_MAX77686)	+= clk-max77686.o
 obj-$(CONFIG_ARCH_MOXART)		+= clk-moxart.o
 obj-$(CONFIG_ARCH_NOMADIK)		+= clk-nomadik.o
diff --git a/drivers/clk/bcm/clk-bcm2835-aux.c b/drivers/clk/bcm/clk-bcm2835-aux.c
index bd750cf2238d..41e0702fae46 100644
--- a/drivers/clk/bcm/clk-bcm2835-aux.c
+++ b/drivers/clk/bcm/clk-bcm2835-aux.c
@@ -17,17 +17,107 @@
 #include <linux/clk/bcm2835.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
+#include <linux/interrupt.h>
+#include <linux/irqdomain.h>
+#include <linux/of_irq.h>
 #include <dt-bindings/clock/bcm2835-aux.h>
 
 #define BCM2835_AUXIRQ		0x00
 #define BCM2835_AUXENB		0x04
 
+#define BCM2835_AUXIRQ_NUM_IRQS  3
+
+#define BCM2835_AUXIRQ_UART_IRQ  0
+#define BCM2835_AUXIRQ_SPI1_IRQ  1
+#define BCM2835_AUXIRQ_SPI2_IRQ  2
+
+#define BCM2835_AUXIRQ_UART_MASK 0x01
+#define BCM2835_AUXIRQ_SPI1_MASK 0x02
+#define BCM2835_AUXIRQ_SPI2_MASK 0x04
+
+#define BCM2835_AUXIRQ_ALL_MASK \
+	(BCM2835_AUXIRQ_UART_MASK | \
+	 BCM2835_AUXIRQ_SPI1_MASK | \
+	 BCM2835_AUXIRQ_SPI2_MASK)
+
+struct auxirq_state {
+	void __iomem      *status;
+	u32                enables;
+	struct irq_domain *domain;
+	struct regmap     *local_regmap;
+};
+
+static struct auxirq_state auxirq __read_mostly;
+
+static irqreturn_t bcm2835_auxirq_handler(int irq, void *dev_id)
+{
+	u32 stat = readl_relaxed(auxirq.status);
+	u32 masked = stat & auxirq.enables;
+
+	if (masked & BCM2835_AUXIRQ_UART_MASK)
+		generic_handle_irq(irq_linear_revmap(auxirq.domain,
+						     BCM2835_AUXIRQ_UART_IRQ));
+
+	if (masked & BCM2835_AUXIRQ_SPI1_MASK)
+		generic_handle_irq(irq_linear_revmap(auxirq.domain,
+						     BCM2835_AUXIRQ_SPI1_IRQ));
+
+	if (masked & BCM2835_AUXIRQ_SPI2_MASK)
+		generic_handle_irq(irq_linear_revmap(auxirq.domain,
+						     BCM2835_AUXIRQ_SPI2_IRQ));
+
+	return (masked & BCM2835_AUXIRQ_ALL_MASK) ? IRQ_HANDLED : IRQ_NONE;
+}
+
+static int bcm2835_auxirq_xlate(struct irq_domain *d,
+				 struct device_node *ctrlr,
+				 const u32 *intspec, unsigned int intsize,
+				 unsigned long *out_hwirq,
+				 unsigned int *out_type)
+{
+	if (WARN_ON(intsize != 1))
+		return -EINVAL;
+
+	if (WARN_ON(intspec[0] >= BCM2835_AUXIRQ_NUM_IRQS))
+		return -EINVAL;
+
+	*out_hwirq = intspec[0];
+	*out_type = IRQ_TYPE_NONE;
+	return 0;
+}
+
+static void bcm2835_auxirq_mask(struct irq_data *data)
+{
+	irq_hw_number_t hwirq = irqd_to_hwirq(data);
+
+	auxirq.enables &= ~(1 << hwirq);
+}
+
+static void bcm2835_auxirq_unmask(struct irq_data *data)
+{
+	irq_hw_number_t hwirq = irqd_to_hwirq(data);
+
+	auxirq.enables |= (1 << hwirq);
+}
+
+static struct irq_chip bcm2835_auxirq_chip = {
+	.name = "bcm2835-auxirq",
+	.irq_mask = bcm2835_auxirq_mask,
+	.irq_unmask = bcm2835_auxirq_unmask,
+};
+
+static const struct irq_domain_ops bcm2835_auxirq_ops = {
+	.xlate = bcm2835_auxirq_xlate//irq_domain_xlate_onecell
+};
+
 static int bcm2835_aux_clk_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
 	struct clk_hw_onecell_data *onecell;
 	const char *parent;
 	struct clk *parent_clk;
+	int parent_irq;
 	struct resource *res;
 	void __iomem *reg, *gate;
 
@@ -41,6 +131,36 @@ static int bcm2835_aux_clk_probe(struct platform_device *pdev)
 	if (IS_ERR(reg))
 		return PTR_ERR(reg);
 
+	parent_irq = irq_of_parse_and_map(node, 0);
+	if (parent_irq) {
+		int ret;
+		int i;
+
+		/* Manage the AUX irq as well */
+		auxirq.status = reg + BCM2835_AUXIRQ;
+		auxirq.domain = irq_domain_add_linear(node,
+						      BCM2835_AUXIRQ_NUM_IRQS,
+						      &bcm2835_auxirq_ops,
+						      NULL);
+		if (!auxirq.domain)
+			return -ENXIO;
+
+		for (i = 0; i < BCM2835_AUXIRQ_NUM_IRQS; i++) {
+			unsigned int irq = irq_create_mapping(auxirq.domain, i);
+
+			if (irq == 0)
+				return -ENXIO;
+
+			irq_set_chip_and_handler(irq, &bcm2835_auxirq_chip,
+						 handle_level_irq);
+		}
+
+		ret = devm_request_irq(dev, parent_irq, bcm2835_auxirq_handler,
+				       0, "bcm2835-auxirq", NULL);
+		if (ret)
+			return ret;
+	}
+
 	onecell = devm_kmalloc(dev, sizeof(*onecell) + sizeof(*onecell->hws) *
 			       BCM2835_AUX_CLOCK_COUNT, GFP_KERNEL);
 	if (!onecell)
diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
index 5f8082d89131..d6caac9c32bd 100644
--- a/drivers/clk/bcm/clk-bcm2835.c
+++ b/drivers/clk/bcm/clk-bcm2835.c
@@ -45,6 +45,7 @@
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 #include <dt-bindings/clock/bcm2835.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
 
 #define CM_PASSWORD		0x5a000000
 
@@ -299,6 +300,8 @@
 #define LOCK_TIMEOUT_NS		100000000
 #define BCM2835_MAX_FB_RATE	1750000000u
 
+#define VCMSG_ID_CORE_CLOCK     4
+
 /*
  * Names of clocks used within the driver that need to be replaced
  * with an external parent's name.  This array is in the order that
@@ -317,6 +320,7 @@ static const char *const cprman_parent_names[] = {
 struct bcm2835_cprman {
 	struct device *dev;
 	void __iomem *regs;
+	struct rpi_firmware *fw;
 	spinlock_t regs_lock; /* spinlock for all clocks */
 
 	/*
@@ -1032,6 +1036,30 @@ static unsigned long bcm2835_clock_get_rate(struct clk_hw *hw,
 	return bcm2835_clock_rate_from_divisor(clock, parent_rate, div);
 }
 
+static unsigned long bcm2835_clock_get_rate_vpu(struct clk_hw *hw,
+						unsigned long parent_rate)
+{
+	struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
+	struct bcm2835_cprman *cprman = clock->cprman;
+
+	if (cprman->fw) {
+		struct {
+			u32 id;
+			u32 val;
+		} packet;
+
+		packet.id = VCMSG_ID_CORE_CLOCK;
+		packet.val = 0;
+
+		if (!rpi_firmware_property(cprman->fw,
+					   RPI_FIRMWARE_GET_MAX_CLOCK_RATE,
+					   &packet, sizeof(packet)))
+			return packet.val;
+	}
+
+	return bcm2835_clock_get_rate(hw, parent_rate);
+}
+
 static void bcm2835_clock_wait_busy(struct bcm2835_clock *clock)
 {
 	struct bcm2835_cprman *cprman = clock->cprman;
@@ -1321,7 +1349,7 @@ static int bcm2835_vpu_clock_is_on(struct clk_hw *hw)
  */
 static const struct clk_ops bcm2835_vpu_clock_clk_ops = {
 	.is_prepared = bcm2835_vpu_clock_is_on,
-	.recalc_rate = bcm2835_clock_get_rate,
+	.recalc_rate = bcm2835_clock_get_rate_vpu,
 	.set_rate = bcm2835_clock_set_rate,
 	.determine_rate = bcm2835_clock_determine_rate,
 	.set_parent = bcm2835_clock_set_parent,
@@ -1329,6 +1357,8 @@ static const struct clk_ops bcm2835_vpu_clock_clk_ops = {
 	.debug_init = bcm2835_clock_debug_init,
 };
 
+static bool bcm2835_clk_is_claimed(const char *name);
+
 static struct clk_hw *bcm2835_register_pll(struct bcm2835_cprman *cprman,
 					   const struct bcm2835_pll_data *data)
 {
@@ -1345,6 +1375,9 @@ static struct clk_hw *bcm2835_register_pll(struct bcm2835_cprman *cprman,
 	init.ops = &bcm2835_pll_clk_ops;
 	init.flags = CLK_IGNORE_UNUSED;
 
+	if (!bcm2835_clk_is_claimed(data->name))
+		init.flags |= CLK_IS_CRITICAL;
+
 	pll = kzalloc(sizeof(*pll), GFP_KERNEL);
 	if (!pll)
 		return NULL;
@@ -1397,6 +1430,13 @@ bcm2835_register_pll_divider(struct bcm2835_cprman *cprman,
 	divider->div.hw.init = &init;
 	divider->div.table = NULL;
 
+	if (!(cprman_read(cprman, data->cm_reg) & data->hold_mask)) {
+		if (!bcm2835_clk_is_claimed(data->source_pll))
+			init.flags |= CLK_IS_CRITICAL;
+		if (!bcm2835_clk_is_claimed(data->name))
+			divider->div.flags |= CLK_IS_CRITICAL;
+	}
+
 	divider->cprman = cprman;
 	divider->data = data;
 
@@ -1449,6 +1489,15 @@ static struct clk_hw *bcm2835_register_clock(struct bcm2835_cprman *cprman,
 	init.name = data->name;
 	init.flags = data->flags | CLK_IGNORE_UNUSED;
 
+	/*
+	 * Some GPIO clocks for ethernet/wifi PLLs are marked as
+	 * critical (since some platforms use them), but if the
+	 * firmware didn't have them turned on then they clearly
+	 * aren't actually critical.
+	 */
+	if ((cprman_read(cprman, data->ctl_reg) & CM_ENABLE) == 0)
+		init.flags &= ~CLK_IS_CRITICAL;
+
 	/*
 	 * Pass the CLK_SET_RATE_PARENT flag if we are allowed to propagate
 	 * rate changes on at least of the parents.
@@ -2147,6 +2196,8 @@ static const struct bcm2835_clk_desc clk_desc_array[] = {
 		.ctl_reg = CM_PERIICTL),
 };
 
+static bool bcm2835_clk_claimed[ARRAY_SIZE(clk_desc_array)];
+
 /*
  * Permanently take a reference on the parent of the SDRAM clock.
  *
@@ -2166,6 +2217,19 @@ static int bcm2835_mark_sdc_parent_critical(struct clk *sdc)
 	return clk_prepare_enable(parent);
 }
 
+static bool bcm2835_clk_is_claimed(const char *name)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(clk_desc_array); i++) {
+		const char *clk_name = *(const char **)(clk_desc_array[i].data);
+		if (!strcmp(name, clk_name))
+		    return bcm2835_clk_claimed[i];
+	}
+
+	return false;
+}
+
 static int bcm2835_clk_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -2174,7 +2238,9 @@ static int bcm2835_clk_probe(struct platform_device *pdev)
 	struct resource *res;
 	const struct bcm2835_clk_desc *desc;
 	const size_t asize = ARRAY_SIZE(clk_desc_array);
+	struct device_node *fw_node;
 	size_t i;
+	u32 clk_id;
 	int ret;
 
 	cprman = devm_kzalloc(dev, sizeof(*cprman) +
@@ -2190,6 +2256,21 @@ static int bcm2835_clk_probe(struct platform_device *pdev)
 	if (IS_ERR(cprman->regs))
 		return PTR_ERR(cprman->regs);
 
+	fw_node = of_parse_phandle(dev->of_node, "firmware", 0);
+	if (fw_node) {
+		struct rpi_firmware *fw = rpi_firmware_get(NULL);
+		if (!fw)
+			return -EPROBE_DEFER;
+		cprman->fw = fw;
+	}
+
+	memset(bcm2835_clk_claimed, 0, sizeof(bcm2835_clk_claimed));
+	for (i = 0;
+	     !of_property_read_u32_index(pdev->dev.of_node, "claim-clocks",
+					 i, &clk_id);
+	     i++)
+		bcm2835_clk_claimed[clk_id]= true;
+
 	memcpy(cprman->real_parent_names, cprman_parent_names,
 	       sizeof(cprman_parent_names));
 	of_clk_parent_fill(dev->of_node, cprman->real_parent_names,
@@ -2220,8 +2301,15 @@ static int bcm2835_clk_probe(struct platform_device *pdev)
 	if (ret)
 		return ret;
 
-	return of_clk_add_hw_provider(dev->of_node, of_clk_hw_onecell_get,
+	ret = of_clk_add_hw_provider(dev->of_node, of_clk_hw_onecell_get,
 				      &cprman->onecell);
+	if (ret)
+		return ret;
+
+	/* note that we have registered all the clocks */
+	dev_dbg(dev, "registered %d clocks\n", asize);
+
+	return 0;
 }
 
 static const struct of_device_id bcm2835_clk_of_match[] = {
@@ -2238,7 +2326,11 @@ static struct platform_driver bcm2835_clk_driver = {
 	.probe          = bcm2835_clk_probe,
 };
 
-builtin_platform_driver(bcm2835_clk_driver);
+static int __init __bcm2835_clk_driver_init(void)
+{
+	return platform_driver_register(&bcm2835_clk_driver);
+}
+core_initcall(__bcm2835_clk_driver_init);
 
 MODULE_AUTHOR("Eric Anholt <eric@anholt.net>");
 MODULE_DESCRIPTION("BCM2835 clock driver");
diff --git a/drivers/clk/clk-allo-dac.c b/drivers/clk/clk-allo-dac.c
new file mode 100644
index 000000000000..0baf821d6947
--- /dev/null
+++ b/drivers/clk/clk-allo-dac.c
@@ -0,0 +1,161 @@
+/*
+ * Clock Driver for Allo DAC
+ *
+ * Author:	Baswaraj K <jaikumar@cem-solutions.net>
+ *		Copyright 2016
+ *		based on code by Stuart MacLean
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/clkdev.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+
+/* Clock rate of CLK44EN attached to GPIO6 pin */
+#define CLK_44EN_RATE 45158400UL
+/* Clock rate of CLK48EN attached to GPIO3 pin */
+#define CLK_48EN_RATE 49152000UL
+
+/**
+ * struct allo_dac_clk - Common struct to the Allo DAC
+ * @hw: clk_hw for the common clk framework
+ * @mode: 0 => CLK44EN, 1 => CLK48EN
+ */
+struct clk_allo_hw {
+	struct clk_hw hw;
+	uint8_t mode;
+};
+
+#define to_allo_clk(_hw) container_of(_hw, struct clk_allo_hw, hw)
+
+static const struct of_device_id clk_allo_dac_dt_ids[] = {
+	{ .compatible = "allo,dac-clk",},
+	{ }
+};
+MODULE_DEVICE_TABLE(of, clk_allo_dac_dt_ids);
+
+static unsigned long clk_allo_dac_recalc_rate(struct clk_hw *hw,
+	unsigned long parent_rate)
+{
+	return (to_allo_clk(hw)->mode == 0) ? CLK_44EN_RATE :
+		CLK_48EN_RATE;
+}
+
+static long clk_allo_dac_round_rate(struct clk_hw *hw,
+	unsigned long rate, unsigned long *parent_rate)
+{
+	long actual_rate;
+
+	if (rate <= CLK_44EN_RATE) {
+		actual_rate = (long)CLK_44EN_RATE;
+	} else if (rate >= CLK_48EN_RATE) {
+		actual_rate = (long)CLK_48EN_RATE;
+	} else {
+		long diff44Rate = (long)(rate - CLK_44EN_RATE);
+		long diff48Rate = (long)(CLK_48EN_RATE - rate);
+
+		if (diff44Rate < diff48Rate)
+			actual_rate = (long)CLK_44EN_RATE;
+		else
+			actual_rate = (long)CLK_48EN_RATE;
+	}
+	return actual_rate;
+}
+
+
+static int clk_allo_dac_set_rate(struct clk_hw *hw,
+	unsigned long rate, unsigned long parent_rate)
+{
+	unsigned long actual_rate;
+	struct clk_allo_hw *clk = to_allo_clk(hw);
+
+	actual_rate = (unsigned long)clk_allo_dac_round_rate(hw, rate,
+		&parent_rate);
+	clk->mode = (actual_rate == CLK_44EN_RATE) ? 0 : 1;
+	return 0;
+}
+
+
+const struct clk_ops clk_allo_dac_rate_ops = {
+	.recalc_rate = clk_allo_dac_recalc_rate,
+	.round_rate = clk_allo_dac_round_rate,
+	.set_rate = clk_allo_dac_set_rate,
+};
+
+static int clk_allo_dac_probe(struct platform_device *pdev)
+{
+	int ret;
+	struct clk_allo_hw *proclk;
+	struct clk *clk;
+	struct device *dev;
+	struct clk_init_data init;
+
+	dev = &pdev->dev;
+
+	proclk = kzalloc(sizeof(struct clk_allo_hw), GFP_KERNEL);
+	if (!proclk)
+		return -ENOMEM;
+
+	init.name = "clk-allo-dac";
+	init.ops = &clk_allo_dac_rate_ops;
+	init.flags = CLK_IS_BASIC;
+	init.parent_names = NULL;
+	init.num_parents = 0;
+
+	proclk->mode = 0;
+	proclk->hw.init = &init;
+
+	clk = devm_clk_register(dev, &proclk->hw);
+	if (!IS_ERR(clk)) {
+		ret = of_clk_add_provider(dev->of_node, of_clk_src_simple_get,
+			clk);
+	} else {
+		dev_err(dev, "Fail to register clock driver\n");
+		kfree(proclk);
+		ret = PTR_ERR(clk);
+	}
+	return ret;
+}
+
+static int clk_allo_dac_remove(struct platform_device *pdev)
+{
+	of_clk_del_provider(pdev->dev.of_node);
+	return 0;
+}
+
+static struct platform_driver clk_allo_dac_driver = {
+	.probe = clk_allo_dac_probe,
+	.remove = clk_allo_dac_remove,
+	.driver = {
+		.name = "clk-allo-dac",
+		.of_match_table = clk_allo_dac_dt_ids,
+	},
+};
+
+static int __init clk_allo_dac_init(void)
+{
+	return platform_driver_register(&clk_allo_dac_driver);
+}
+core_initcall(clk_allo_dac_init);
+
+static void __exit clk_allo_dac_exit(void)
+{
+	platform_driver_unregister(&clk_allo_dac_driver);
+}
+module_exit(clk_allo_dac_exit);
+
+MODULE_DESCRIPTION("Allo DAC clock driver");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:clk-allo-dac");
diff --git a/drivers/clk/clk-hifiberry-dacpro.c b/drivers/clk/clk-hifiberry-dacpro.c
new file mode 100644
index 000000000000..99cee2b1706c
--- /dev/null
+++ b/drivers/clk/clk-hifiberry-dacpro.c
@@ -0,0 +1,160 @@
+/*
+ * Clock Driver for HiFiBerry DAC Pro
+ *
+ * Author: Stuart MacLean
+ *         Copyright 2015
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/clkdev.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+
+/* Clock rate of CLK44EN attached to GPIO6 pin */
+#define CLK_44EN_RATE 22579200UL
+/* Clock rate of CLK48EN attached to GPIO3 pin */
+#define CLK_48EN_RATE 24576000UL
+
+/**
+ * struct hifiberry_dacpro_clk - Common struct to the HiFiBerry DAC Pro
+ * @hw: clk_hw for the common clk framework
+ * @mode: 0 => CLK44EN, 1 => CLK48EN
+ */
+struct clk_hifiberry_hw {
+	struct clk_hw hw;
+	uint8_t mode;
+};
+
+#define to_hifiberry_clk(_hw) container_of(_hw, struct clk_hifiberry_hw, hw)
+
+static const struct of_device_id clk_hifiberry_dacpro_dt_ids[] = {
+	{ .compatible = "hifiberry,dacpro-clk",},
+	{ }
+};
+MODULE_DEVICE_TABLE(of, clk_hifiberry_dacpro_dt_ids);
+
+static unsigned long clk_hifiberry_dacpro_recalc_rate(struct clk_hw *hw,
+	unsigned long parent_rate)
+{
+	return (to_hifiberry_clk(hw)->mode == 0) ? CLK_44EN_RATE :
+		CLK_48EN_RATE;
+}
+
+static long clk_hifiberry_dacpro_round_rate(struct clk_hw *hw,
+	unsigned long rate, unsigned long *parent_rate)
+{
+	long actual_rate;
+
+	if (rate <= CLK_44EN_RATE) {
+		actual_rate = (long)CLK_44EN_RATE;
+	} else if (rate >= CLK_48EN_RATE) {
+		actual_rate = (long)CLK_48EN_RATE;
+	} else {
+		long diff44Rate = (long)(rate - CLK_44EN_RATE);
+		long diff48Rate = (long)(CLK_48EN_RATE - rate);
+
+		if (diff44Rate < diff48Rate)
+			actual_rate = (long)CLK_44EN_RATE;
+		else
+			actual_rate = (long)CLK_48EN_RATE;
+	}
+	return actual_rate;
+}
+
+
+static int clk_hifiberry_dacpro_set_rate(struct clk_hw *hw,
+	unsigned long rate, unsigned long parent_rate)
+{
+	unsigned long actual_rate;
+	struct clk_hifiberry_hw *clk = to_hifiberry_clk(hw);
+
+	actual_rate = (unsigned long)clk_hifiberry_dacpro_round_rate(hw, rate,
+		&parent_rate);
+	clk->mode = (actual_rate == CLK_44EN_RATE) ? 0 : 1;
+	return 0;
+}
+
+
+const struct clk_ops clk_hifiberry_dacpro_rate_ops = {
+	.recalc_rate = clk_hifiberry_dacpro_recalc_rate,
+	.round_rate = clk_hifiberry_dacpro_round_rate,
+	.set_rate = clk_hifiberry_dacpro_set_rate,
+};
+
+static int clk_hifiberry_dacpro_probe(struct platform_device *pdev)
+{
+	int ret;
+	struct clk_hifiberry_hw *proclk;
+	struct clk *clk;
+	struct device *dev;
+	struct clk_init_data init;
+
+	dev = &pdev->dev;
+
+	proclk = kzalloc(sizeof(struct clk_hifiberry_hw), GFP_KERNEL);
+	if (!proclk)
+		return -ENOMEM;
+
+	init.name = "clk-hifiberry-dacpro";
+	init.ops = &clk_hifiberry_dacpro_rate_ops;
+	init.flags = CLK_IS_BASIC;
+	init.parent_names = NULL;
+	init.num_parents = 0;
+
+	proclk->mode = 0;
+	proclk->hw.init = &init;
+
+	clk = devm_clk_register(dev, &proclk->hw);
+	if (!IS_ERR(clk)) {
+		ret = of_clk_add_provider(dev->of_node, of_clk_src_simple_get,
+			clk);
+	} else {
+		dev_err(dev, "Fail to register clock driver\n");
+		kfree(proclk);
+		ret = PTR_ERR(clk);
+	}
+	return ret;
+}
+
+static int clk_hifiberry_dacpro_remove(struct platform_device *pdev)
+{
+	of_clk_del_provider(pdev->dev.of_node);
+	return 0;
+}
+
+static struct platform_driver clk_hifiberry_dacpro_driver = {
+	.probe = clk_hifiberry_dacpro_probe,
+	.remove = clk_hifiberry_dacpro_remove,
+	.driver = {
+		.name = "clk-hifiberry-dacpro",
+		.of_match_table = clk_hifiberry_dacpro_dt_ids,
+	},
+};
+
+static int __init clk_hifiberry_dacpro_init(void)
+{
+	return platform_driver_register(&clk_hifiberry_dacpro_driver);
+}
+core_initcall(clk_hifiberry_dacpro_init);
+
+static void __exit clk_hifiberry_dacpro_exit(void)
+{
+	platform_driver_unregister(&clk_hifiberry_dacpro_driver);
+}
+module_exit(clk_hifiberry_dacpro_exit);
+
+MODULE_DESCRIPTION("HiFiBerry DAC Pro clock driver");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:clk-hifiberry-dacpro");
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index bdce4488ded1..e6e43bb9b51a 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -237,6 +237,15 @@ config ARM_TANGO_CPUFREQ
 	depends on CPUFREQ_DT && ARCH_TANGO
 	default y
 
+config ARM_BCM2835_CPUFREQ
+	depends on RASPBERRYPI_FIRMWARE
+	bool "BCM2835 Driver"
+	default y
+	help
+	  This adds the CPUFreq driver for BCM2835
+
+	  If in doubt, say N.
+
 config ARM_TEGRA20_CPUFREQ
 	bool "Tegra20 CPUFreq support"
 	depends on ARCH_TEGRA
diff --git a/drivers/cpufreq/Makefile b/drivers/cpufreq/Makefile
index 812f9e0d01a3..f8da42e2b4fa 100644
--- a/drivers/cpufreq/Makefile
+++ b/drivers/cpufreq/Makefile
@@ -76,6 +76,7 @@ obj-$(CONFIG_ARM_SCPI_CPUFREQ)		+= scpi-cpufreq.o
 obj-$(CONFIG_ARM_SPEAR_CPUFREQ)		+= spear-cpufreq.o
 obj-$(CONFIG_ARM_STI_CPUFREQ)		+= sti-cpufreq.o
 obj-$(CONFIG_ARM_TANGO_CPUFREQ)		+= tango-cpufreq.o
+obj-$(CONFIG_ARM_BCM2835_CPUFREQ)	+= bcm2835-cpufreq.o
 obj-$(CONFIG_ARM_TEGRA20_CPUFREQ)	+= tegra20-cpufreq.o
 obj-$(CONFIG_ARM_TEGRA124_CPUFREQ)	+= tegra124-cpufreq.o
 obj-$(CONFIG_ARM_TEGRA186_CPUFREQ)	+= tegra186-cpufreq.o
diff --git a/drivers/cpufreq/bcm2835-cpufreq.c b/drivers/cpufreq/bcm2835-cpufreq.c
new file mode 100644
index 000000000000..99345969b0e4
--- /dev/null
+++ b/drivers/cpufreq/bcm2835-cpufreq.c
@@ -0,0 +1,210 @@
+/*
+ * Copyright 2011 Broadcom Corporation.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; version 2
+ * of the License.
+ *
+ * This driver dynamically manages the CPU Frequency of the ARM
+ * processor. Messages are sent to Videocore either setting or requesting the
+ * frequency of the ARM in order to match an appropiate frequency to the current
+ * usage of the processor. The policy which selects the frequency to use is
+ * defined in the kernel .config file, but can be changed during runtime.
+ */
+
+/* ---------- INCLUDES ---------- */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/cpufreq.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+/* ---------- DEFINES ---------- */
+/*#define CPUFREQ_DEBUG_ENABLE*/		/* enable debugging */
+#define MODULE_NAME "bcm2835-cpufreq"
+
+#define VCMSG_ID_ARM_CLOCK 0x000000003		/* Clock/Voltage ID's */
+
+/* debug printk macros */
+#ifdef CPUFREQ_DEBUG_ENABLE
+#define print_debug(fmt,...) pr_debug("%s:%s:%d: "fmt, MODULE_NAME, __func__, __LINE__, ##__VA_ARGS__)
+#else
+#define print_debug(fmt,...)
+#endif
+#define print_err(fmt,...) pr_err("%s:%s:%d: "fmt, MODULE_NAME, __func__,__LINE__, ##__VA_ARGS__)
+#define print_info(fmt,...) pr_info("%s: "fmt, MODULE_NAME, ##__VA_ARGS__)
+
+/* ---------- GLOBALS ---------- */
+static struct cpufreq_driver bcm2835_cpufreq_driver;	/* the cpufreq driver global */
+static unsigned int min_frequency, max_frequency;
+static struct cpufreq_frequency_table bcm2835_freq_table[3];
+
+/*
+ ===============================================
+  clk_rate either gets or sets the clock rates.
+ ===============================================
+*/
+
+static int bcm2835_cpufreq_clock_property(u32 tag, u32 id, u32 *val)
+{
+	struct rpi_firmware *fw = rpi_firmware_get(NULL);
+	struct {
+		u32 id;
+		u32 val;
+	} packet;
+	int ret;
+
+	packet.id = id;
+	packet.val = *val;
+	ret = rpi_firmware_property(fw, tag, &packet, sizeof(packet));
+	if (ret)
+		return ret;
+
+	*val = packet.val;
+
+	return 0;
+}
+
+static uint32_t bcm2835_cpufreq_set_clock(int cur_rate, int arm_rate)
+{
+	u32 rate = arm_rate * 1000;
+	int ret;
+
+	ret = bcm2835_cpufreq_clock_property(RPI_FIRMWARE_SET_CLOCK_RATE, VCMSG_ID_ARM_CLOCK, &rate);
+	if (ret) {
+		print_err("Failed to set clock: %d (%d)\n", arm_rate, ret);
+		return 0;
+	}
+
+	rate /= 1000;
+	print_debug("Setting new frequency = %d -> %d (actual %d)\n", cur_rate, arm_rate, rate);
+
+	return rate;
+}
+
+static uint32_t bcm2835_cpufreq_get_clock(int tag)
+{
+	u32 rate;
+	int ret;
+
+	ret = bcm2835_cpufreq_clock_property(tag, VCMSG_ID_ARM_CLOCK, &rate);
+	if (ret) {
+		print_err("Failed to get clock (%d)\n", ret);
+		return 0;
+	}
+
+	rate /= 1000;
+	print_debug("%s frequency = %u\n",
+		tag == RPI_FIRMWARE_GET_CLOCK_RATE ? "Current":
+		tag == RPI_FIRMWARE_GET_MIN_CLOCK_RATE ? "Min":
+		tag == RPI_FIRMWARE_GET_MAX_CLOCK_RATE ? "Max":
+		"Unexpected", rate);
+
+	return rate;
+}
+
+/*
+ ====================================================
+  Module Initialisation registers the cpufreq driver
+ ====================================================
+*/
+static int __init bcm2835_cpufreq_module_init(void)
+{
+	print_debug("IN\n");
+	return cpufreq_register_driver(&bcm2835_cpufreq_driver);
+}
+
+/*
+ =============
+  Module exit
+ =============
+*/
+static void __exit bcm2835_cpufreq_module_exit(void)
+{
+	print_debug("IN\n");
+	cpufreq_unregister_driver(&bcm2835_cpufreq_driver);
+	return;
+}
+
+/*
+ ==============================================================
+  Initialisation function sets up the CPU policy for first use
+ ==============================================================
+*/
+static int bcm2835_cpufreq_driver_init(struct cpufreq_policy *policy)
+{
+	/* measured value of how long it takes to change frequency */
+	const unsigned int transition_latency = 355000; /* ns */
+
+	if (!rpi_firmware_get(NULL)) {
+		print_err("Firmware is not available\n");
+		return -ENODEV;
+	}
+
+	/* now find out what the maximum and minimum frequencies are */
+	min_frequency = bcm2835_cpufreq_get_clock(RPI_FIRMWARE_GET_MIN_CLOCK_RATE);
+	max_frequency = bcm2835_cpufreq_get_clock(RPI_FIRMWARE_GET_MAX_CLOCK_RATE);
+
+	if (min_frequency == max_frequency) {
+		bcm2835_freq_table[0].frequency = min_frequency;
+		bcm2835_freq_table[1].frequency = CPUFREQ_TABLE_END;
+	} else {
+		bcm2835_freq_table[0].frequency = min_frequency;
+		bcm2835_freq_table[1].frequency = max_frequency;
+		bcm2835_freq_table[2].frequency = CPUFREQ_TABLE_END;
+	}
+
+	print_info("min=%d max=%d\n", min_frequency, max_frequency);
+	return cpufreq_generic_init(policy, bcm2835_freq_table, transition_latency);
+}
+
+/*
+ =====================================================================
+  Target index function chooses the requested frequency from the table
+ =====================================================================
+*/
+
+static int bcm2835_cpufreq_driver_target_index(struct cpufreq_policy *policy, unsigned int state)
+{
+	unsigned int target_freq = state == 0 ? min_frequency : max_frequency;
+	unsigned int cur = bcm2835_cpufreq_set_clock(policy->cur, target_freq);
+
+	if (!cur)
+	{
+		print_err("Error occurred setting a new frequency (%d)\n", target_freq);
+		return -EINVAL;
+	}
+	print_debug("%s: %i: freq %d->%d\n", policy->governor->name, state, policy->cur, cur);
+	return 0;
+}
+
+/*
+ ======================================================
+  Get function returns the current frequency from table
+ ======================================================
+*/
+
+static unsigned int bcm2835_cpufreq_driver_get(unsigned int cpu)
+{
+	unsigned int actual_rate = bcm2835_cpufreq_get_clock(RPI_FIRMWARE_GET_CLOCK_RATE);
+	print_debug("cpu%d: freq=%d\n", cpu, actual_rate);
+	return actual_rate <= min_frequency ? min_frequency : max_frequency;
+}
+
+/* the CPUFreq driver */
+static struct cpufreq_driver bcm2835_cpufreq_driver = {
+	.name         = "BCM2835 CPUFreq",
+	.init         = bcm2835_cpufreq_driver_init,
+	.verify       = cpufreq_generic_frequency_table_verify,
+	.target_index = bcm2835_cpufreq_driver_target_index,
+	.get          = bcm2835_cpufreq_driver_get,
+	.attr         = cpufreq_generic_attr,
+};
+
+MODULE_AUTHOR("Dorian Peake and Dom Cobley");
+MODULE_DESCRIPTION("CPU frequency driver for BCM2835 chip");
+MODULE_LICENSE("GPL");
+
+module_init(bcm2835_cpufreq_module_init);
+module_exit(bcm2835_cpufreq_module_exit);
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index fadc4d8783bd..845fb2ff22a2 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -535,6 +535,10 @@ config TIMB_DMA
 	help
 	  Enable support for the Timberdale FPGA DMA engine.
 
+config DMA_BCM2708
+	tristate "BCM2708 DMA legacy API support"
+	depends on DMA_BCM2835
+
 config TI_CPPI41
 	tristate "CPPI 4.1 DMA support"
 	depends on (ARCH_OMAP || ARCH_DAVINCI_DA8XX)
diff --git a/drivers/dma/Makefile b/drivers/dma/Makefile
index 9d0156b50294..3ebe6b90eb30 100644
--- a/drivers/dma/Makefile
+++ b/drivers/dma/Makefile
@@ -21,6 +21,7 @@ obj-$(CONFIG_AT_XDMAC) += at_xdmac.o
 obj-$(CONFIG_AXI_DMAC) += dma-axi-dmac.o
 obj-$(CONFIG_BCM_SBA_RAID) += bcm-sba-raid.o
 obj-$(CONFIG_COH901318) += coh901318.o coh901318_lli.o
+obj-$(CONFIG_DMA_BCM2708) += bcm2708-dmaengine.o
 obj-$(CONFIG_DMA_BCM2835) += bcm2835-dma.o
 obj-$(CONFIG_DMA_JZ4740) += dma-jz4740.o
 obj-$(CONFIG_DMA_JZ4780) += dma-jz4780.o
diff --git a/drivers/dma/bcm2708-dmaengine.c b/drivers/dma/bcm2708-dmaengine.c
new file mode 100644
index 000000000000..0f4a26983e40
--- /dev/null
+++ b/drivers/dma/bcm2708-dmaengine.c
@@ -0,0 +1,281 @@
+/*
+ * BCM2708 legacy DMA API
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/list.h>
+#include <linux/module.h>
+#include <linux/platform_data/dma-bcm2708.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/io.h>
+#include <linux/spinlock.h>
+
+#include "virt-dma.h"
+
+#define CACHE_LINE_MASK 31
+#define DEFAULT_DMACHAN_BITMAP 0x10  /* channel 4 only */
+
+/* valid only for channels 0 - 14, 15 has its own base address */
+#define BCM2708_DMA_CHAN(n)	((n) << 8) /* base address */
+#define BCM2708_DMA_CHANIO(dma_base, n) \
+	((void __iomem *)((char *)(dma_base) + BCM2708_DMA_CHAN(n)))
+
+struct vc_dmaman {
+	void __iomem *dma_base;
+	u32 chan_available; /* bitmap of available channels */
+	u32 has_feature[BCM_DMA_FEATURE_COUNT]; /* bitmap of feature presence */
+	struct mutex lock;
+};
+
+static struct device *dmaman_dev;	/* we assume there's only one! */
+static struct vc_dmaman *g_dmaman;	/* DMA manager */
+
+/* DMA Auxiliary Functions */
+
+/* A DMA buffer on an arbitrary boundary may separate a cache line into a
+   section inside the DMA buffer and another section outside it.
+   Even if we flush DMA buffers from the cache there is always the chance that
+   during a DMA someone will access the part of a cache line that is outside
+   the DMA buffer - which will then bring in unwelcome data.
+   Without being able to dictate our own buffer pools we must insist that
+   DMA buffers consist of a whole number of cache lines.
+*/
+extern int bcm_sg_suitable_for_dma(struct scatterlist *sg_ptr, int sg_len)
+{
+	int i;
+
+	for (i = 0; i < sg_len; i++) {
+		if (sg_ptr[i].offset & CACHE_LINE_MASK ||
+		    sg_ptr[i].length & CACHE_LINE_MASK)
+			return 0;
+	}
+
+	return 1;
+}
+EXPORT_SYMBOL_GPL(bcm_sg_suitable_for_dma);
+
+extern void bcm_dma_start(void __iomem *dma_chan_base,
+			  dma_addr_t control_block)
+{
+	dsb(sy);	/* ARM data synchronization (push) operation */
+
+	writel(control_block, dma_chan_base + BCM2708_DMA_ADDR);
+	writel(BCM2708_DMA_ACTIVE, dma_chan_base + BCM2708_DMA_CS);
+}
+EXPORT_SYMBOL_GPL(bcm_dma_start);
+
+extern void bcm_dma_wait_idle(void __iomem *dma_chan_base)
+{
+	dsb(sy);
+
+	/* ugly busy wait only option for now */
+	while (readl(dma_chan_base + BCM2708_DMA_CS) & BCM2708_DMA_ACTIVE)
+		cpu_relax();
+}
+EXPORT_SYMBOL_GPL(bcm_dma_wait_idle);
+
+extern bool bcm_dma_is_busy(void __iomem *dma_chan_base)
+{
+	dsb(sy);
+
+	return readl(dma_chan_base + BCM2708_DMA_CS) & BCM2708_DMA_ACTIVE;
+}
+EXPORT_SYMBOL_GPL(bcm_dma_is_busy);
+
+/* Complete an ongoing DMA (assuming its results are to be ignored)
+   Does nothing if there is no DMA in progress.
+   This routine waits for the current AXI transfer to complete before
+   terminating the current DMA. If the current transfer is hung on a DREQ used
+   by an uncooperative peripheral the AXI transfer may never complete.	In this
+   case the routine times out and return a non-zero error code.
+   Use of this routine doesn't guarantee that the ongoing or aborted DMA
+   does not produce an interrupt.
+*/
+extern int bcm_dma_abort(void __iomem *dma_chan_base)
+{
+	unsigned long int cs;
+	int rc = 0;
+
+	cs = readl(dma_chan_base + BCM2708_DMA_CS);
+
+	if (BCM2708_DMA_ACTIVE & cs) {
+		long int timeout = 10000;
+
+		/* write 0 to the active bit - pause the DMA */
+		writel(0, dma_chan_base + BCM2708_DMA_CS);
+
+		/* wait for any current AXI transfer to complete */
+		while (0 != (cs & BCM2708_DMA_ISPAUSED) && --timeout >= 0)
+			cs = readl(dma_chan_base + BCM2708_DMA_CS);
+
+		if (0 != (cs & BCM2708_DMA_ISPAUSED)) {
+			/* we'll un-pause when we set of our next DMA */
+			rc = -ETIMEDOUT;
+
+		} else if (BCM2708_DMA_ACTIVE & cs) {
+			/* terminate the control block chain */
+			writel(0, dma_chan_base + BCM2708_DMA_NEXTCB);
+
+			/* abort the whole DMA */
+			writel(BCM2708_DMA_ABORT | BCM2708_DMA_ACTIVE,
+			       dma_chan_base + BCM2708_DMA_CS);
+		}
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL_GPL(bcm_dma_abort);
+
+ /* DMA Manager Device Methods */
+
+static void vc_dmaman_init(struct vc_dmaman *dmaman, void __iomem *dma_base,
+			   u32 chans_available)
+{
+	dmaman->dma_base = dma_base;
+	dmaman->chan_available = chans_available;
+	dmaman->has_feature[BCM_DMA_FEATURE_FAST_ORD] = 0x0c;  /* 2 & 3 */
+	dmaman->has_feature[BCM_DMA_FEATURE_BULK_ORD] = 0x01;  /* 0 */
+	dmaman->has_feature[BCM_DMA_FEATURE_NORMAL_ORD] = 0xfe;  /* 1 to 7 */
+	dmaman->has_feature[BCM_DMA_FEATURE_LITE_ORD] = 0x7f00;  /* 8 to 14 */
+}
+
+static int vc_dmaman_chan_alloc(struct vc_dmaman *dmaman,
+				unsigned required_feature_set)
+{
+	u32 chans;
+	int chan = 0;
+	int feature;
+
+	chans = dmaman->chan_available;
+	for (feature = 0; feature < BCM_DMA_FEATURE_COUNT; feature++)
+		/* select the subset of available channels with the desired
+		   features */
+		if (required_feature_set & (1 << feature))
+			chans &= dmaman->has_feature[feature];
+
+	if (!chans)
+		return -ENOENT;
+
+	/* return the ordinal of the first channel in the bitmap */
+	while (chans != 0 && (chans & 1) == 0) {
+		chans >>= 1;
+		chan++;
+	}
+	/* claim the channel */
+	dmaman->chan_available &= ~(1 << chan);
+
+	return chan;
+}
+
+static int vc_dmaman_chan_free(struct vc_dmaman *dmaman, int chan)
+{
+	if (chan < 0)
+		return -EINVAL;
+
+	if ((1 << chan) & dmaman->chan_available)
+		return -EIDRM;
+
+	dmaman->chan_available |= (1 << chan);
+
+	return 0;
+}
+
+/* DMA Manager Monitor */
+
+extern int bcm_dma_chan_alloc(unsigned required_feature_set,
+			      void __iomem **out_dma_base, int *out_dma_irq)
+{
+	struct vc_dmaman *dmaman = g_dmaman;
+	struct platform_device *pdev = to_platform_device(dmaman_dev);
+	struct resource *r;
+	int chan;
+
+	if (!dmaman_dev)
+		return -ENODEV;
+
+	mutex_lock(&dmaman->lock);
+	chan = vc_dmaman_chan_alloc(dmaman, required_feature_set);
+	if (chan < 0)
+		goto out;
+
+	r = platform_get_resource(pdev, IORESOURCE_IRQ, (unsigned int)chan);
+	if (!r) {
+		dev_err(dmaman_dev, "failed to get irq for DMA channel %d\n",
+			chan);
+		vc_dmaman_chan_free(dmaman, chan);
+		chan = -ENOENT;
+		goto out;
+	}
+
+	*out_dma_base = BCM2708_DMA_CHANIO(dmaman->dma_base, chan);
+	*out_dma_irq = r->start;
+	dev_dbg(dmaman_dev,
+		"Legacy API allocated channel=%d, base=%p, irq=%i\n",
+		chan, *out_dma_base, *out_dma_irq);
+
+out:
+	mutex_unlock(&dmaman->lock);
+
+	return chan;
+}
+EXPORT_SYMBOL_GPL(bcm_dma_chan_alloc);
+
+extern int bcm_dma_chan_free(int channel)
+{
+	struct vc_dmaman *dmaman = g_dmaman;
+	int rc;
+
+	if (!dmaman_dev)
+		return -ENODEV;
+
+	mutex_lock(&dmaman->lock);
+	rc = vc_dmaman_chan_free(dmaman, channel);
+	mutex_unlock(&dmaman->lock);
+
+	return rc;
+}
+EXPORT_SYMBOL_GPL(bcm_dma_chan_free);
+
+int bcm_dmaman_probe(struct platform_device *pdev, void __iomem *base,
+		     u32 chans_available)
+{
+	struct device *dev = &pdev->dev;
+	struct vc_dmaman *dmaman;
+
+	dmaman = devm_kzalloc(dev, sizeof(*dmaman), GFP_KERNEL);
+	if (!dmaman)
+		return -ENOMEM;
+
+	mutex_init(&dmaman->lock);
+	vc_dmaman_init(dmaman, base, chans_available);
+	g_dmaman = dmaman;
+	dmaman_dev = dev;
+
+	dev_info(dev, "DMA legacy API manager at %p, dmachans=0x%x\n",
+		 base, chans_available);
+
+	return 0;
+}
+EXPORT_SYMBOL(bcm_dmaman_probe);
+
+int bcm_dmaman_remove(struct platform_device *pdev)
+{
+	dmaman_dev = NULL;
+
+	return 0;
+}
+EXPORT_SYMBOL(bcm_dmaman_remove);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index 6204cc32d09c..599c218dc8a7 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -37,6 +37,7 @@
 #include <linux/interrupt.h>
 #include <linux/list.h>
 #include <linux/module.h>
+#include <linux/platform_data/dma-bcm2708.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 #include <linux/io.h>
@@ -48,6 +49,7 @@
 
 #define BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED 14
 #define BCM2835_DMA_CHAN_NAME_SIZE 8
+#define BCM2835_DMA_BULK_MASK  BIT(0)
 
 struct bcm2835_dmadev {
 	struct dma_device ddev;
@@ -925,6 +927,9 @@ static int bcm2835_dma_probe(struct platform_device *pdev)
 	base = devm_ioremap_resource(&pdev->dev, res);
 	if (IS_ERR(base))
 		return PTR_ERR(base);
+	rc = bcm_dmaman_probe(pdev, base, BCM2835_DMA_BULK_MASK);
+	if (rc)
+		dev_err(&pdev->dev, "Failed to initialize the legacy API\n");
 
 	od->base = base;
 
@@ -962,6 +967,9 @@ static int bcm2835_dma_probe(struct platform_device *pdev)
 		goto err_no_dma;
 	}
 
+	/* Channel 0 is used by the legacy API */
+	chans_available &= ~BCM2835_DMA_BULK_MASK;
+
 	/* get irqs for each channel that we support */
 	for (i = 0; i <= BCM2835_DMA_MAX_DMA_CHAN_SUPPORTED; i++) {
 		/* skip masked out channels */
@@ -1036,6 +1044,7 @@ static int bcm2835_dma_remove(struct platform_device *pdev)
 {
 	struct bcm2835_dmadev *od = platform_get_drvdata(pdev);
 
+	bcm_dmaman_remove(pdev);
 	dma_async_device_unregister(&od->ddev);
 	bcm2835_dma_free(od);
 
@@ -1051,7 +1060,22 @@ static struct platform_driver bcm2835_dma_driver = {
 	},
 };
 
-module_platform_driver(bcm2835_dma_driver);
+static int bcm2835_dma_init(void)
+{
+	return platform_driver_register(&bcm2835_dma_driver);
+}
+
+static void bcm2835_dma_exit(void)
+{
+	platform_driver_unregister(&bcm2835_dma_driver);
+}
+
+/*
+ * Load after serial driver (arch_initcall) so we see the messages if it fails,
+ * but before drivers (module_init) that need a DMA channel.
+ */
+subsys_initcall(bcm2835_dma_init);
+module_exit(bcm2835_dma_exit);
 
 MODULE_ALIAS("platform:bcm2835-dma");
 MODULE_DESCRIPTION("BCM2835 DMA engine driver");
diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
index dd506cd3a5b8..a82819a78f53 100644
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -14,6 +14,8 @@
 #include <linux/module.h>
 #include <linux/of_platform.h>
 #include <linux/platform_device.h>
+#include <linux/reboot.h>
+#include <linux/workqueue.h>
 #include <soc/bcm2835/raspberrypi-firmware.h>
 
 #define MBOX_MSG(chan, data28)		(((data28) & ~0xf) | ((chan) & 0xf))
@@ -21,13 +23,50 @@
 #define MBOX_DATA28(msg)		((msg) & ~0xf)
 #define MBOX_CHAN_PROPERTY		8
 
+#define UNDERVOLTAGE_BIT		BIT(0)
+
+
+/*
+ * This section defines some rate limited logging that prevent
+ * repeated messages at much lower Hz than the default kernel settings.
+ * It's usually 5s, this is 5 minutes.
+ * Burst 3 means you may get three messages 'quickly', before
+ * the ratelimiting kicks in.
+ */
+#define LOCAL_RATELIMIT_INTERVAL (5 * 60 * HZ)
+#define LOCAL_RATELIMIT_BURST 3
+
+#ifdef CONFIG_PRINTK
+#define printk_ratelimited_local(fmt, ...)	\
+({						\
+	static DEFINE_RATELIMIT_STATE(_rs,	\
+		LOCAL_RATELIMIT_INTERVAL,	\
+		LOCAL_RATELIMIT_BURST);		\
+						\
+	if (__ratelimit(&_rs))			\
+		printk(fmt, ##__VA_ARGS__);	\
+})
+#else
+#define printk_ratelimited_local(fmt, ...)	\
+	no_printk(fmt, ##__VA_ARGS__)
+#endif
+
+#define pr_crit_ratelimited_local(fmt, ...)              \
+	printk_ratelimited_local(KERN_CRIT pr_fmt(fmt), ##__VA_ARGS__)
+#define pr_info_ratelimited_local(fmt, ...)              \
+	printk_ratelimited_local(KERN_INFO pr_fmt(fmt), ##__VA_ARGS__)
+
+
 struct rpi_firmware {
 	struct mbox_client cl;
 	struct mbox_chan *chan; /* The property channel. */
 	struct completion c;
 	u32 enabled;
+	struct delayed_work get_throttled_poll_work;
 };
 
+static struct platform_device *g_pdev;
+
 static DEFINE_MUTEX(transaction_lock);
 
 static void response_callback(struct mbox_client *cl, void *msg)
@@ -40,7 +79,7 @@ static void response_callback(struct mbox_client *cl, void *msg)
  * Sends a request to the firmware through the BCM2835 mailbox driver,
  * and synchronously waits for the reply.
  */
-static int
+int
 rpi_firmware_transaction(struct rpi_firmware *fw, u32 chan, u32 data)
 {
 	u32 message = MBOX_MSG(chan, data);
@@ -61,6 +100,7 @@ rpi_firmware_transaction(struct rpi_firmware *fw, u32 chan, u32 data)
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(rpi_firmware_transaction);
 
 /**
  * rpi_firmware_property_list - Submit firmware property list
@@ -112,7 +152,7 @@ int rpi_firmware_property_list(struct rpi_firmware *fw,
 		 * error, if there were multiple tags in the request.
 		 * But single-tag is the most common, so go with it.
 		 */
-		dev_err(fw->cl.dev, "Request 0x%08x returned status 0x%08x\n",
+		dev_dbg(fw->cl.dev, "Request 0x%08x returned status 0x%08x\n",
 			buf[2], buf[1]);
 		ret = -EINVAL;
 	}
@@ -163,6 +203,138 @@ int rpi_firmware_property(struct rpi_firmware *fw,
 }
 EXPORT_SYMBOL_GPL(rpi_firmware_property);
 
+static int rpi_firmware_get_throttled(struct rpi_firmware *fw, u32 *value)
+{
+	static int old_firmware;
+	static ktime_t old_timestamp;
+	static u32 old_value;
+	u32 new_sticky, old_sticky, new_uv, old_uv;
+	ktime_t new_timestamp;
+	s64 elapsed_ms;
+	int ret;
+
+	if (!fw)
+		return -EBUSY;
+
+	if (old_firmware)
+		return -EINVAL;
+
+	/*
+	 * We can't run faster than the sticky shift (100ms) since we get
+	 * flipping in the sticky bits that are cleared.
+	 * This happens on polling, so just return the previous value.
+	 */
+	new_timestamp = ktime_get();
+	elapsed_ms = ktime_ms_delta(new_timestamp, old_timestamp);
+	if (elapsed_ms < 150) {
+		*value = old_value;
+		return 0;
+	}
+	old_timestamp = new_timestamp;
+
+	/* Clear sticky bits */
+	*value = 0xffff;
+
+	ret = rpi_firmware_property(fw, RPI_FIRMWARE_GET_THROTTLED,
+				    value, sizeof(*value));
+
+	if (ret) {
+		/* If the mailbox call fails once, then it will continue to
+		 * fail in the future, so no point in continuing to call it
+		 * Usual failure reason is older firmware
+		 */
+		old_firmware = 1;
+		dev_err(fw->cl.dev, "Get Throttled mailbox call failed");
+
+		return ret;
+	}
+
+	new_sticky = *value >> 16;
+	old_sticky = old_value >> 16;
+	old_value = *value;
+
+	/* Only notify about changes in the sticky bits */
+	if (new_sticky == old_sticky)
+		return 0;
+
+	new_uv = new_sticky & UNDERVOLTAGE_BIT;
+	old_uv = old_sticky & UNDERVOLTAGE_BIT;
+
+	if (new_uv != old_uv) {
+		if (new_uv)
+			pr_crit_ratelimited_local(
+				"Under-voltage detected! (0x%08x)\n",
+				 *value);
+		else
+			pr_info_ratelimited_local(
+				"Voltage normalised (0x%08x)\n",
+				 *value);
+	}
+
+	sysfs_notify(&fw->cl.dev->kobj, NULL, "get_throttled");
+
+	return 0;
+}
+
+static int rpi_firmware_notify_reboot(struct notifier_block *nb,
+				      unsigned long action,
+				      void *data)
+{
+	struct rpi_firmware *fw;
+	struct platform_device *pdev = g_pdev;
+
+	if (!pdev)
+		return 0;
+
+	fw = platform_get_drvdata(pdev);
+	if (!fw)
+		return 0;
+
+	(void)rpi_firmware_property(fw, RPI_FIRMWARE_NOTIFY_REBOOT,
+				    0, 0);
+
+	return 0;
+}
+
+static void get_throttled_poll(struct work_struct *work)
+{
+	struct rpi_firmware *fw = container_of(work, struct rpi_firmware,
+					       get_throttled_poll_work.work);
+	u32 dummy;
+	int ret;
+
+	ret = rpi_firmware_get_throttled(fw, &dummy);
+
+	/* Only reschedule if we are getting valid responses */
+	if (!ret)
+		schedule_delayed_work(&fw->get_throttled_poll_work, 2 * HZ);
+}
+
+static ssize_t get_throttled_show(struct device *dev,
+				  struct device_attribute *attr, char *buf)
+{
+	struct rpi_firmware *fw = dev_get_drvdata(dev);
+	u32 value;
+	int ret;
+
+	ret = rpi_firmware_get_throttled(fw, &value);
+	if (ret)
+		return ret;
+
+	return sprintf(buf, "%x\n", value);
+}
+
+static DEVICE_ATTR_RO(get_throttled);
+
+static struct attribute *rpi_firmware_dev_attrs[] = {
+	&dev_attr_get_throttled.attr,
+	NULL,
+};
+
+static const struct attribute_group rpi_firmware_dev_group = {
+	.attrs = rpi_firmware_dev_attrs,
+};
+
 static void
 rpi_firmware_print_firmware_revision(struct rpi_firmware *fw)
 {
@@ -187,6 +359,11 @@ static int rpi_firmware_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
 	struct rpi_firmware *fw;
+	int ret;
+
+	ret = devm_device_add_group(dev, &rpi_firmware_dev_group);
+	if (ret)
+		return ret;
 
 	fw = devm_kzalloc(dev, sizeof(*fw), GFP_KERNEL);
 	if (!fw)
@@ -205,11 +382,15 @@ static int rpi_firmware_probe(struct platform_device *pdev)
 	}
 
 	init_completion(&fw->c);
+	INIT_DELAYED_WORK(&fw->get_throttled_poll_work, get_throttled_poll);
 
 	platform_set_drvdata(pdev, fw);
+	g_pdev = pdev;
 
 	rpi_firmware_print_firmware_revision(fw);
 
+	schedule_delayed_work(&fw->get_throttled_poll_work, 0);
+
 	return 0;
 }
 
@@ -217,7 +398,9 @@ static int rpi_firmware_remove(struct platform_device *pdev)
 {
 	struct rpi_firmware *fw = platform_get_drvdata(pdev);
 
+	cancel_delayed_work_sync(&fw->get_throttled_poll_work);
 	mbox_free_channel(fw->chan);
+	g_pdev = NULL;
 
 	return 0;
 }
@@ -230,7 +413,7 @@ static int rpi_firmware_remove(struct platform_device *pdev)
  */
 struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)
 {
-	struct platform_device *pdev = of_find_device_by_node(firmware_node);
+	struct platform_device *pdev = g_pdev;
 
 	if (!pdev)
 		return NULL;
@@ -253,7 +436,35 @@ static struct platform_driver rpi_firmware_driver = {
 	.probe		= rpi_firmware_probe,
 	.remove		= rpi_firmware_remove,
 };
-module_platform_driver(rpi_firmware_driver);
+
+static struct notifier_block rpi_firmware_reboot_notifier = {
+	.notifier_call = rpi_firmware_notify_reboot,
+};
+
+static int __init rpi_firmware_init(void)
+{
+	int ret = register_reboot_notifier(&rpi_firmware_reboot_notifier);
+	if (ret)
+		goto out1;
+	ret = platform_driver_register(&rpi_firmware_driver);
+	if (ret)
+		goto out2;
+
+	return 0;
+
+out2:
+	unregister_reboot_notifier(&rpi_firmware_reboot_notifier);
+out1:
+	return ret;
+}
+subsys_initcall(rpi_firmware_init);
+
+static void __init rpi_firmware_exit(void)
+{
+	platform_driver_unregister(&rpi_firmware_driver);
+	unregister_reboot_notifier(&rpi_firmware_reboot_notifier);
+}
+module_exit(rpi_firmware_exit);
 
 MODULE_AUTHOR("Eric Anholt <eric@anholt.net>");
 MODULE_DESCRIPTION("Raspberry Pi firmware driver");
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 3f80f167ed56..5f53e1f4e8e2 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -128,12 +128,25 @@ config GPIO_AXP209
 	help
 	  Say yes to enable GPIO support for the AXP209 PMIC
 
+config GPIO_BCM_EXP
+	bool "Broadcom Exp GPIO"
+	depends on OF_GPIO && RASPBERRYPI_FIRMWARE && (ARCH_BCM2835 || COMPILE_TEST)
+	help
+	  Turn on GPIO support for Broadcom chips using the firmware mailbox
+	  to communicate with VideoCore on BCM283x chips.
+
 config GPIO_BCM_KONA
 	bool "Broadcom Kona GPIO"
 	depends on OF_GPIO && (ARCH_BCM_MOBILE || COMPILE_TEST)
 	help
 	  Turn on GPIO support for Broadcom "Kona" chips.
 
+config GPIO_BCM_VIRT
+	bool "Broadcom Virt GPIO"
+	depends on OF_GPIO && RASPBERRYPI_FIRMWARE && (ARCH_BCM2835 || COMPILE_TEST)
+	help
+	  Turn on virtual GPIO support for Broadcom BCM283X chips.
+
 config GPIO_BRCMSTB
 	tristate "BRCMSTB GPIO support"
 	default y if (ARCH_BRCMSTB || BMIPS_GENERIC)
diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile
index 8a2dfba3b231..726a1550f445 100644
--- a/drivers/gpio/Makefile
+++ b/drivers/gpio/Makefile
@@ -33,8 +33,10 @@ obj-$(CONFIG_GPIO_ARIZONA)	+= gpio-arizona.o
 obj-$(CONFIG_GPIO_ATH79)	+= gpio-ath79.o
 obj-$(CONFIG_GPIO_ASPEED)	+= gpio-aspeed.o
 obj-$(CONFIG_GPIO_AXP209)	+= gpio-axp209.o
+obj-$(CONFIG_GPIO_BCM_EXP)	+= gpio-bcm-exp.o
 obj-$(CONFIG_GPIO_BCM_KONA)	+= gpio-bcm-kona.o
 obj-$(CONFIG_GPIO_BD9571MWV)	+= gpio-bd9571mwv.o
+obj-$(CONFIG_GPIO_BCM_VIRT)	+= gpio-bcm-virt.o
 obj-$(CONFIG_GPIO_BRCMSTB)	+= gpio-brcmstb.o
 obj-$(CONFIG_GPIO_BT8XX)	+= gpio-bt8xx.o
 obj-$(CONFIG_GPIO_CLPS711X)	+= gpio-clps711x.o
diff --git a/drivers/gpio/gpio-bcm-exp.c b/drivers/gpio/gpio-bcm-exp.c
new file mode 100644
index 000000000000..d68adafaee4a
--- /dev/null
+++ b/drivers/gpio/gpio-bcm-exp.c
@@ -0,0 +1,254 @@
+/*
+ *  Broadcom expander GPIO driver
+ *
+ *  Uses the firmware mailbox service to communicate with the
+ *  GPIO expander on the VPU.
+ *
+ *  Copyright (C) 2017 Raspberry Pi Trading Ltd.
+ *
+ *  Author: Dave Stevenson <dave.stevenson@raspberrypi.org>
+ *  Based on gpio-bcm-virt.c by Dom Cobley <popcornmix@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <linux/err.h>
+#include <linux/gpio.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/dma-mapping.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+#define MODULE_NAME "brcmexp-gpio"
+#define NUM_GPIO 8
+
+struct brcmexp_gpio {
+	struct gpio_chip gc;
+	struct device *dev;
+	struct rpi_firmware *fw;
+};
+
+struct gpio_set_config {
+	u32 gpio, direction, polarity, term_en, term_pull_up, state;
+};
+
+struct gpio_get_config {
+	u32 gpio, direction, polarity, term_en, term_pull_up;
+};
+
+struct gpio_get_set_state {
+	u32 gpio, state;
+};
+
+static int brcmexp_gpio_get_polarity(struct gpio_chip *gc, unsigned int off)
+{
+	struct brcmexp_gpio *gpio;
+	struct gpio_get_config get;
+	int ret;
+
+	gpio = container_of(gc, struct brcmexp_gpio, gc);
+
+	get.gpio = off + gpio->gc.base;	/* GPIO to update */
+
+	ret = rpi_firmware_property(gpio->fw, RPI_FIRMWARE_GET_GPIO_CONFIG,
+				    &get, sizeof(get));
+	if (ret) {
+		dev_err(gpio->dev,
+			"Failed to get GPIO %u config (%d)\n", off, ret);
+		return ret;
+	}
+	return get.polarity;
+}
+
+static int brcmexp_gpio_dir_in(struct gpio_chip *gc, unsigned int off)
+{
+	struct brcmexp_gpio *gpio;
+	struct gpio_set_config set_in;
+	int ret;
+
+	gpio = container_of(gc, struct brcmexp_gpio, gc);
+
+	set_in.gpio = off + gpio->gc.base;	/* GPIO to update */
+	set_in.direction = 0;		/* Input */
+	set_in.polarity = brcmexp_gpio_get_polarity(gc, off);
+					/* Retain existing setting */
+	set_in.term_en = 0;		/* termination disabled */
+	set_in.term_pull_up = 0;	/* n/a as termination disabled */
+	set_in.state = 0;		/* n/a as configured as an input */
+
+	ret = rpi_firmware_property(gpio->fw, RPI_FIRMWARE_SET_GPIO_CONFIG,
+				    &set_in, sizeof(set_in));
+	if (ret) {
+		dev_err(gpio->dev,
+			"Failed to set GPIO %u to input (%d)\n",
+			off, ret);
+		return ret;
+	}
+	return 0;
+}
+
+static int brcmexp_gpio_dir_out(struct gpio_chip *gc, unsigned int off, int val)
+{
+	struct brcmexp_gpio *gpio;
+	struct gpio_set_config set_out;
+	int ret;
+
+	gpio = container_of(gc, struct brcmexp_gpio, gc);
+
+	set_out.gpio = off + gpio->gc.base;	/* GPIO to update */
+	set_out.direction = 1;		/* Output */
+	set_out.polarity = brcmexp_gpio_get_polarity(gc, off);
+					/* Retain existing setting */
+	set_out.term_en = 0;		/* n/a as an output */
+	set_out.term_pull_up = 0;	/* n/a as termination disabled */
+	set_out.state = val;		/* Output state */
+
+	ret = rpi_firmware_property(gpio->fw, RPI_FIRMWARE_SET_GPIO_CONFIG,
+				    &set_out, sizeof(set_out));
+	if (ret) {
+		dev_err(gpio->dev,
+			"Failed to set GPIO %u to output (%d)\n", off, ret);
+		return ret;
+	}
+	return 0;
+}
+
+static int brcmexp_gpio_get_direction(struct gpio_chip *gc, unsigned int off)
+{
+	struct brcmexp_gpio *gpio;
+	struct gpio_get_config get;
+	int ret;
+
+	gpio = container_of(gc, struct brcmexp_gpio, gc);
+
+	get.gpio = off + gpio->gc.base;	/* GPIO to update */
+
+	ret = rpi_firmware_property(gpio->fw, RPI_FIRMWARE_GET_GPIO_CONFIG,
+				    &get, sizeof(get));
+	if (ret) {
+		dev_err(gpio->dev,
+			"Failed to get GPIO %u config (%d)\n", off, ret);
+		return ret;
+	}
+	return get.direction ? GPIOF_DIR_OUT : GPIOF_DIR_IN;
+}
+
+static int brcmexp_gpio_get(struct gpio_chip *gc, unsigned int off)
+{
+	struct brcmexp_gpio *gpio;
+	struct gpio_get_set_state get;
+	int ret;
+
+	gpio = container_of(gc, struct brcmexp_gpio, gc);
+
+	get.gpio = off + gpio->gc.base;	/* GPIO to update */
+	get.state = 0;		/* storage for returned value */
+
+	ret = rpi_firmware_property(gpio->fw, RPI_FIRMWARE_GET_GPIO_STATE,
+					 &get, sizeof(get));
+	if (ret) {
+		dev_err(gpio->dev,
+			"Failed to get GPIO %u state (%d)\n", off, ret);
+		return ret;
+	}
+	return !!get.state;
+}
+
+static void brcmexp_gpio_set(struct gpio_chip *gc, unsigned int off, int val)
+{
+	struct brcmexp_gpio *gpio;
+	struct gpio_get_set_state set;
+	int ret;
+
+	gpio = container_of(gc, struct brcmexp_gpio, gc);
+
+	set.gpio = off + gpio->gc.base;	/* GPIO to update */
+	set.state = val;	/* Output state */
+
+	ret = rpi_firmware_property(gpio->fw, RPI_FIRMWARE_SET_GPIO_STATE,
+					 &set, sizeof(set));
+	if (ret)
+		dev_err(gpio->dev,
+			"Failed to set GPIO %u state (%d)\n", off, ret);
+}
+
+static int brcmexp_gpio_probe(struct platform_device *pdev)
+{
+	int err = 0;
+	struct device *dev = &pdev->dev;
+	struct device_node *np = dev->of_node;
+	struct device_node *fw_node;
+	struct rpi_firmware *fw;
+	struct brcmexp_gpio *ucb;
+
+	fw_node = of_parse_phandle(np, "firmware", 0);
+	if (!fw_node) {
+		dev_err(dev, "Missing firmware node\n");
+		return -ENOENT;
+	}
+
+	fw = rpi_firmware_get(fw_node);
+	if (!fw)
+		return -EPROBE_DEFER;
+
+	ucb = devm_kzalloc(dev, sizeof(*ucb), GFP_KERNEL);
+	if (!ucb)
+		return -EINVAL;
+
+	ucb->fw = fw;
+	ucb->dev = dev;
+	ucb->gc.label = MODULE_NAME;
+	ucb->gc.owner = THIS_MODULE;
+	ucb->gc.of_node = np;
+	ucb->gc.base = 128;
+	ucb->gc.ngpio = NUM_GPIO;
+
+	ucb->gc.direction_input = brcmexp_gpio_dir_in;
+	ucb->gc.direction_output = brcmexp_gpio_dir_out;
+	ucb->gc.get_direction = brcmexp_gpio_get_direction;
+	ucb->gc.get = brcmexp_gpio_get;
+	ucb->gc.set = brcmexp_gpio_set;
+	ucb->gc.can_sleep = true;
+
+	err = gpiochip_add(&ucb->gc);
+	if (err)
+		return err;
+
+	platform_set_drvdata(pdev, ucb);
+
+	return 0;
+}
+
+static int brcmexp_gpio_remove(struct platform_device *pdev)
+{
+	struct brcmexp_gpio *ucb = platform_get_drvdata(pdev);
+
+	gpiochip_remove(&ucb->gc);
+
+	return 0;
+}
+
+static const struct of_device_id __maybe_unused brcmexp_gpio_ids[] = {
+	{ .compatible = "brcm,bcm2835-expgpio" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, brcmexp_gpio_ids);
+
+static struct platform_driver brcmexp_gpio_driver = {
+	.driver	= {
+		.name		= MODULE_NAME,
+		.owner		= THIS_MODULE,
+		.of_match_table	= of_match_ptr(brcmexp_gpio_ids),
+	},
+	.probe	= brcmexp_gpio_probe,
+	.remove	= brcmexp_gpio_remove,
+};
+module_platform_driver(brcmexp_gpio_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Dave Stevenson <dave.stevenson@raspberrypi.org>");
+MODULE_DESCRIPTION("brcm-exp GPIO driver");
+MODULE_ALIAS("platform:brcmexp-gpio");
diff --git a/drivers/gpio/gpio-bcm-virt.c b/drivers/gpio/gpio-bcm-virt.c
new file mode 100644
index 000000000000..c3725546def9
--- /dev/null
+++ b/drivers/gpio/gpio-bcm-virt.c
@@ -0,0 +1,214 @@
+/*
+ *  brcmvirt GPIO driver
+ *
+ *  Copyright (C) 2012,2013 Dom Cobley <popcornmix@gmail.com>
+ *  Based on gpio-clps711x.c by Alexander Shiyan <shc_work@mail.ru>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <linux/err.h>
+#include <linux/gpio.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/dma-mapping.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+#define MODULE_NAME "brcmvirt-gpio"
+#define NUM_GPIO 2
+
+struct brcmvirt_gpio {
+	struct gpio_chip	gc;
+	u32 __iomem		*ts_base;
+	/* two packed 16-bit counts of enabled and disables
+           Allows host to detect a brief enable that was missed */
+	u32			enables_disables[NUM_GPIO];
+	dma_addr_t		bus_addr;
+};
+
+static int brcmvirt_gpio_dir_in(struct gpio_chip *gc, unsigned off)
+{
+	struct brcmvirt_gpio *gpio;
+	gpio = container_of(gc, struct brcmvirt_gpio, gc);
+	return -EINVAL;
+}
+
+static int brcmvirt_gpio_dir_out(struct gpio_chip *gc, unsigned off, int val)
+{
+	struct brcmvirt_gpio *gpio;
+	gpio = container_of(gc, struct brcmvirt_gpio, gc);
+	return 0;
+}
+
+static int brcmvirt_gpio_get(struct gpio_chip *gc, unsigned off)
+{
+	struct brcmvirt_gpio *gpio;
+	unsigned v;
+	gpio = container_of(gc, struct brcmvirt_gpio, gc);
+	v = readl(gpio->ts_base + off);
+	return (v >> off) & 1;
+}
+
+static void brcmvirt_gpio_set(struct gpio_chip *gc, unsigned off, int val)
+{
+	struct brcmvirt_gpio *gpio;
+	u16 enables, disables;
+	s16 diff;
+	bool lit;
+	gpio = container_of(gc, struct brcmvirt_gpio, gc);
+	enables  = gpio->enables_disables[off] >> 16;
+	disables = gpio->enables_disables[off] >>  0;
+	diff = (s16)(enables - disables);
+	lit = diff > 0;
+	if ((val && lit) || (!val && !lit))
+		return;
+	if (val)
+		enables++;
+	else
+		disables++;
+	diff = (s16)(enables - disables);
+	BUG_ON(diff != 0 && diff != 1);
+	gpio->enables_disables[off] = (enables << 16) | (disables << 0);
+	writel(gpio->enables_disables[off], gpio->ts_base + off);
+}
+
+static int brcmvirt_gpio_probe(struct platform_device *pdev)
+{
+	int err = 0;
+	struct device *dev = &pdev->dev;
+	struct device_node *np = dev->of_node;
+	struct device_node *fw_node;
+	struct rpi_firmware *fw;
+	struct brcmvirt_gpio *ucb;
+	u32 gpiovirtbuf;
+
+	fw_node = of_parse_phandle(np, "firmware", 0);
+	if (!fw_node) {
+		dev_err(dev, "Missing firmware node\n");
+		return -ENOENT;
+	}
+
+	fw = rpi_firmware_get(fw_node);
+	if (!fw)
+		return -EPROBE_DEFER;
+
+	ucb = devm_kzalloc(dev, sizeof *ucb, GFP_KERNEL);
+	if (!ucb) {
+		err = -EINVAL;
+		goto out;
+	}
+
+	ucb->ts_base = dma_zalloc_coherent(dev, PAGE_SIZE, &ucb->bus_addr, GFP_KERNEL);
+	if (!ucb->ts_base) {
+		pr_err("[%s]: failed to dma_alloc_coherent(%ld)\n",
+				__func__, PAGE_SIZE);
+		err = -ENOMEM;
+		goto out;
+	}
+
+	gpiovirtbuf = (u32)ucb->bus_addr;
+	err = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_SET_GPIOVIRTBUF,
+				    &gpiovirtbuf, sizeof(gpiovirtbuf));
+
+	if (err || gpiovirtbuf != 0) {
+		dev_warn(dev, "Failed to set gpiovirtbuf, trying to get err:%x\n", err);
+		dma_free_coherent(dev, PAGE_SIZE, ucb->ts_base, ucb->bus_addr);
+		ucb->ts_base = 0;
+		ucb->bus_addr = 0;
+	}
+
+	if (!ucb->ts_base) {
+		err = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_GET_GPIOVIRTBUF,
+					    &gpiovirtbuf, sizeof(gpiovirtbuf));
+
+		if (err) {
+			dev_err(dev, "Failed to get gpiovirtbuf\n");
+			goto out;
+		}
+
+		if (!gpiovirtbuf) {
+			dev_err(dev, "No virtgpio buffer\n");
+			err = -ENOENT;
+			goto out;
+		}
+
+		// mmap the physical memory
+		gpiovirtbuf &= ~0xc0000000;
+		ucb->ts_base = ioremap(gpiovirtbuf, 4096);
+		if (ucb->ts_base == NULL) {
+			dev_err(dev, "Failed to map physical address\n");
+			err = -ENOENT;
+			goto out;
+		}
+		ucb->bus_addr = 0;
+	}
+	ucb->gc.label = MODULE_NAME;
+	ucb->gc.owner = THIS_MODULE;
+	//ucb->gc.dev = dev;
+	ucb->gc.of_node = np;
+	ucb->gc.base = 100;
+	ucb->gc.ngpio = NUM_GPIO;
+
+	ucb->gc.direction_input = brcmvirt_gpio_dir_in;
+	ucb->gc.direction_output = brcmvirt_gpio_dir_out;
+	ucb->gc.get = brcmvirt_gpio_get;
+	ucb->gc.set = brcmvirt_gpio_set;
+	ucb->gc.can_sleep = true;
+
+	err = gpiochip_add(&ucb->gc);
+	if (err)
+		goto out;
+
+	platform_set_drvdata(pdev, ucb);
+
+	return 0;
+out:
+	if (ucb->bus_addr) {
+		dma_free_coherent(dev, PAGE_SIZE, ucb->ts_base, ucb->bus_addr);
+		ucb->bus_addr = 0;
+		ucb->ts_base = NULL;
+	} else if (ucb->ts_base) {
+		iounmap(ucb->ts_base);
+		ucb->ts_base = NULL;
+	}
+	return err;
+}
+
+static int brcmvirt_gpio_remove(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	int err = 0;
+	struct brcmvirt_gpio *ucb = platform_get_drvdata(pdev);
+
+	gpiochip_remove(&ucb->gc);
+	if (ucb->bus_addr)
+		dma_free_coherent(dev, PAGE_SIZE, ucb->ts_base, ucb->bus_addr);
+	else if (ucb->ts_base)
+		iounmap(ucb->ts_base);
+	return err;
+}
+
+static const struct of_device_id __maybe_unused brcmvirt_gpio_ids[] = {
+	{ .compatible = "brcm,bcm2835-virtgpio" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, brcmvirt_gpio_ids);
+
+static struct platform_driver brcmvirt_gpio_driver = {
+	.driver	= {
+		.name		= MODULE_NAME,
+		.owner		= THIS_MODULE,
+		.of_match_table	= of_match_ptr(brcmvirt_gpio_ids),
+	},
+	.probe	= brcmvirt_gpio_probe,
+	.remove	= brcmvirt_gpio_remove,
+};
+module_platform_driver(brcmvirt_gpio_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Dom Cobley <popcornmix@gmail.com>");
+MODULE_DESCRIPTION("brcmvirt GPIO driver");
+MODULE_ALIAS("platform:brcmvirt-gpio");
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 68ea6e712bf9..fa5bb2c472f0 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -53,6 +53,8 @@
 #define	extra_checks	0
 #endif
 
+#define dont_test_bit(b,d) (0)
+
 /* Device and char device-related information */
 static DEFINE_IDA(gpio_ida);
 static dev_t gpio_devt;
@@ -2302,7 +2304,7 @@ static int _gpiod_direction_output_raw(struct gpio_desc *desc, int value)
 	int ret;
 
 	/* GPIOs used for IRQs shall not be set as output */
-	if (test_bit(FLAG_USED_AS_IRQ, &desc->flags)) {
+	if (dont_test_bit(FLAG_USED_AS_IRQ, &desc->flags)) {
 		gpiod_err(desc,
 			  "%s: tried to set a GPIO tied to an IRQ as output\n",
 			  __func__);
@@ -2817,7 +2819,7 @@ int gpiochip_lock_as_irq(struct gpio_chip *chip, unsigned int offset)
 			set_bit(FLAG_IS_OUT, &desc->flags);
 	}
 
-	if (test_bit(FLAG_IS_OUT, &desc->flags)) {
+	if (dont_test_bit(FLAG_IS_OUT, &desc->flags)) {
 		chip_err(chip,
 			  "%s: tried to flag a GPIO set as output for IRQ\n",
 			  __func__);
diff --git a/drivers/gpu/drm/panel/Kconfig b/drivers/gpu/drm/panel/Kconfig
index d84a031fae24..d6f1969b8a3b 100644
--- a/drivers/gpu/drm/panel/Kconfig
+++ b/drivers/gpu/drm/panel/Kconfig
@@ -73,6 +73,14 @@ config DRM_PANEL_PANASONIC_VVX10F034N00
 	  WUXGA (1920x1200) Novatek NT1397-based DSI panel as found in some
 	  Xperia Z2 tablets
 
+config DRM_PANEL_RASPBERRYPI_TOUCHSCREEN
+	tristate "Raspberry Pi 7-inch touchscreen panel"
+	depends on DRM_MIPI_DSI
+	help
+	  Say Y here if you want to enable support for the Raspberry
+	  Pi 7" Touchscreen.  To compile this driver as a module,
+	  choose M here.
+
 config DRM_PANEL_SAMSUNG_S6E3HA2
 	tristate "Samsung S6E3HA2 DSI video mode panel"
 	depends on OF
diff --git a/drivers/gpu/drm/panel/Makefile b/drivers/gpu/drm/panel/Makefile
index d73d3e661cec..6975da6d6109 100644
--- a/drivers/gpu/drm/panel/Makefile
+++ b/drivers/gpu/drm/panel/Makefile
@@ -5,6 +5,7 @@ obj-$(CONFIG_DRM_PANEL_INNOLUX_P079ZCA) += panel-innolux-p079zca.o
 obj-$(CONFIG_DRM_PANEL_JDI_LT070ME05000) += panel-jdi-lt070me05000.o
 obj-$(CONFIG_DRM_PANEL_LG_LG4573) += panel-lg-lg4573.o
 obj-$(CONFIG_DRM_PANEL_PANASONIC_VVX10F034N00) += panel-panasonic-vvx10f034n00.o
+obj-$(CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN) += panel-raspberrypi-touchscreen.o
 obj-$(CONFIG_DRM_PANEL_SAMSUNG_LD9040) += panel-samsung-ld9040.o
 obj-$(CONFIG_DRM_PANEL_SAMSUNG_S6E3HA2) += panel-samsung-s6e3ha2.o
 obj-$(CONFIG_DRM_PANEL_SAMSUNG_S6E8AA0) += panel-samsung-s6e8aa0.o
diff --git a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
new file mode 100644
index 000000000000..128523d8d518
--- /dev/null
+++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
@@ -0,0 +1,522 @@
+/*
+ * Copyright © 2016 Broadcom
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Portions of this file (derived from panel-simple.c) are:
+ *
+ * Copyright (C) 2013, NVIDIA Corporation.  All rights reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sub license,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+/**
+ * DOC: Raspberry Pi 7" touchscreen panel driver.
+ *
+ * The 7" touchscreen consists of a DPI LCD panel, a Toshiba
+ * TC358762XBG DSI-DPI bridge, and an I2C-connected Atmel ATTINY88-MUR
+ * controlling power management, the LCD PWM, and the touchscreen.
+ *
+ * This driver presents this device as a MIPI DSI panel to the DRM
+ * driver, and should expose the touchscreen as a HID device.
+ */
+
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/fb.h>
+#include <linux/gpio.h>
+#include <linux/gpio/consumer.h>
+#include <linux/i2c.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/of_graph.h>
+#include <linux/pm.h>
+
+#include <drm/drm_panel.h>
+#include <drm/drmP.h>
+#include <drm/drm_crtc.h>
+#include <drm/drm_mipi_dsi.h>
+#include <drm/drm_panel.h>
+
+/* I2C registers of the Atmel microcontroller. */
+enum REG_ADDR {
+	REG_ID = 0x80,
+	REG_PORTA, // BIT(2) for horizontal flip, BIT(3) for vertical flip
+	REG_PORTB,
+	REG_PORTC,
+	REG_PORTD,
+	REG_POWERON,
+	REG_PWM,
+	REG_DDRA,
+	REG_DDRB,
+	REG_DDRC,
+	REG_DDRD,
+	REG_TEST,
+	REG_WR_ADDRL,
+	REG_WR_ADDRH,
+	REG_READH,
+	REG_READL,
+	REG_WRITEH,
+	REG_WRITEL,
+	REG_ID2,
+};
+
+/* We only turn the PWM on or off, without varying values. */
+#define RPI_TOUCHSCREEN_MAX_BRIGHTNESS 1
+
+/* DSI D-PHY Layer Registers */
+#define D0W_DPHYCONTTX		0x0004
+#define CLW_DPHYCONTRX		0x0020
+#define D0W_DPHYCONTRX		0x0024
+#define D1W_DPHYCONTRX		0x0028
+#define COM_DPHYCONTRX		0x0038
+#define CLW_CNTRL		0x0040
+#define D0W_CNTRL		0x0044
+#define D1W_CNTRL		0x0048
+#define DFTMODE_CNTRL		0x0054
+
+/* DSI PPI Layer Registers */
+#define PPI_STARTPPI		0x0104
+#define PPI_BUSYPPI		0x0108
+#define PPI_LINEINITCNT		0x0110
+#define PPI_LPTXTIMECNT		0x0114
+//#define PPI_LANEENABLE		0x0134
+//#define PPI_TX_RX_TA		0x013C
+#define PPI_CLS_ATMR		0x0140
+#define PPI_D0S_ATMR		0x0144
+#define PPI_D1S_ATMR		0x0148
+#define PPI_D0S_CLRSIPOCOUNT	0x0164
+#define PPI_D1S_CLRSIPOCOUNT	0x0168
+#define CLS_PRE			0x0180
+#define D0S_PRE			0x0184
+#define D1S_PRE			0x0188
+#define CLS_PREP		0x01A0
+#define D0S_PREP		0x01A4
+#define D1S_PREP		0x01A8
+#define CLS_ZERO		0x01C0
+#define D0S_ZERO		0x01C4
+#define D1S_ZERO		0x01C8
+#define PPI_CLRFLG		0x01E0
+#define PPI_CLRSIPO		0x01E4
+#define HSTIMEOUT		0x01F0
+#define HSTIMEOUTENABLE		0x01F4
+
+/* DSI Protocol Layer Registers */
+#define DSI_STARTDSI		0x0204
+#define DSI_BUSYDSI		0x0208
+#define DSI_LANEENABLE		0x0210
+# define DSI_LANEENABLE_CLOCK		BIT(0)
+# define DSI_LANEENABLE_D0		BIT(1)
+# define DSI_LANEENABLE_D1		BIT(2)
+
+#define DSI_LANESTATUS0		0x0214
+#define DSI_LANESTATUS1		0x0218
+#define DSI_INTSTATUS		0x0220
+#define DSI_INTMASK		0x0224
+#define DSI_INTCLR		0x0228
+#define DSI_LPTXTO		0x0230
+#define DSI_MODE		0x0260
+#define DSI_PAYLOAD0		0x0268
+#define DSI_PAYLOAD1		0x026C
+#define DSI_SHORTPKTDAT		0x0270
+#define DSI_SHORTPKTREQ		0x0274
+#define DSI_BTASTA		0x0278
+#define DSI_BTACLR		0x027C
+
+/* DSI General Registers */
+#define DSIERRCNT		0x0300
+#define DSISIGMOD		0x0304
+
+/* DSI Application Layer Registers */
+#define APLCTRL			0x0400
+#define APLSTAT			0x0404
+#define APLERR			0x0408
+#define PWRMOD			0x040C
+#define RDPKTLN			0x0410
+#define PXLFMT			0x0414
+#define MEMWRCMD		0x0418
+
+/* LCDC/DPI Host Registers */
+#define LCDCTRL			0x0420
+#define HSR			0x0424
+#define HDISPR			0x0428
+#define VSR			0x042C
+#define VDISPR			0x0430
+#define VFUEN			0x0434
+
+/* DBI-B Host Registers */
+#define DBIBCTRL		0x0440
+
+/* SPI Master Registers */
+#define SPICMR			0x0450
+#define SPITCR			0x0454
+
+/* System Controller Registers */
+#define SYSSTAT			0x0460
+#define SYSCTRL			0x0464
+#define SYSPLL1			0x0468
+#define SYSPLL2			0x046C
+#define SYSPLL3			0x0470
+#define SYSPMCTRL		0x047C
+
+/* GPIO Registers */
+#define GPIOC			0x0480
+#define GPIOO			0x0484
+#define GPIOI			0x0488
+
+/* I2C Registers */
+#define I2CCLKCTRL		0x0490
+
+/* Chip/Rev Registers */
+#define IDREG			0x04A0
+
+/* Debug Registers */
+#define WCMDQUEUE		0x0500
+#define RCMDQUEUE		0x0504
+
+struct rpi_touchscreen {
+	struct drm_panel base;
+	struct mipi_dsi_device *dsi;
+	struct i2c_client *bridge_i2c;
+
+	/* Version of the firmware on the bridge chip */
+	int atmel_ver;
+};
+
+static const struct drm_display_mode rpi_touchscreen_modes[] = {
+	{
+		/* The DSI PLL can only integer divide from the 2Ghz
+		 * PLLD, giving us few choices.  We pick a divide by 3
+		 * as our DSI HS clock, giving us a pixel clock of
+		 * that divided by 24 bits.  Pad out HFP to get our
+		 * panel to refresh at 60Hz, even if that doesn't
+		 * match the datasheet.
+		 */
+#define PIXEL_CLOCK ((2000000000 / 3) / 24)
+#define VREFRESH    60
+#define VTOTAL      (480 + 7 + 2 + 21)
+#define HACT        800
+#define HSW         2
+#define HBP         46
+#define HFP         ((PIXEL_CLOCK / (VTOTAL * VREFRESH)) - (HACT + HSW + HBP))
+
+		/* Round up the pixel clock a bit (10khz), so that the
+		 * "don't run things faster than the requested clock
+		 * rate" rule of the clk driver doesn't reject the
+		 * divide-by-3 mode due to rounding error.
+		 */
+		.clock = PIXEL_CLOCK / 1000 + 10,
+		.hdisplay = HACT,
+		.hsync_start = HACT + HFP,
+		.hsync_end = HACT + HFP + HSW,
+		.htotal = HACT + HFP + HSW + HBP,
+		.vdisplay = 480,
+		.vsync_start = 480 + 7,
+		.vsync_end = 480 + 7 + 2,
+		.vtotal = VTOTAL,
+		.vrefresh = 60,
+	},
+};
+
+static struct rpi_touchscreen *panel_to_ts(struct drm_panel *panel)
+{
+	return container_of(panel, struct rpi_touchscreen, base);
+}
+
+static int rpi_touchscreen_i2c_read(struct rpi_touchscreen *ts, u8 reg)
+{
+	return i2c_smbus_read_byte_data(ts->bridge_i2c, reg);
+}
+
+static void rpi_touchscreen_i2c_write(struct rpi_touchscreen *ts,
+				      u8 reg, u8 val)
+{
+	int ret;
+
+	ret = i2c_smbus_write_byte_data(ts->bridge_i2c, reg, val);
+	if (ret)
+		dev_err(&ts->dsi->dev, "I2C write failed: %d\n", ret);
+}
+
+static int rpi_touchscreen_write(struct rpi_touchscreen *ts, u16 reg, u32 val)
+{
+#if 0
+	/* The firmware uses LP DSI transactions like this to bring up
+	 * the hardware, which should be faster than using I2C to then
+	 * pass to the Toshiba.  However, I was unable to get it to
+	 * work.
+	 */
+	u8 msg[] = {
+		reg,
+		reg >> 8,
+		val,
+		val >> 8,
+		val >> 16,
+		val >> 24,
+	};
+
+	mipi_dsi_dcs_write_buffer(ts->dsi, msg, sizeof(msg));
+#else
+	rpi_touchscreen_i2c_write(ts, REG_WR_ADDRH, reg >> 8);
+	rpi_touchscreen_i2c_write(ts, REG_WR_ADDRL, reg);
+	rpi_touchscreen_i2c_write(ts, REG_WRITEH, val >> 8);
+	rpi_touchscreen_i2c_write(ts, REG_WRITEL, val);
+#endif
+
+	return 0;
+}
+
+static int rpi_touchscreen_disable(struct drm_panel *panel)
+{
+	struct rpi_touchscreen *ts = panel_to_ts(panel);
+
+	rpi_touchscreen_i2c_write(ts, REG_PWM, 0);
+
+	rpi_touchscreen_i2c_write(ts, REG_POWERON, 0);
+	udelay(1);
+
+	return 0;
+}
+
+static int rpi_touchscreen_noop(struct drm_panel *panel)
+{
+	return 0;
+}
+
+static int rpi_touchscreen_enable(struct drm_panel *panel)
+{
+	struct rpi_touchscreen *ts = panel_to_ts(panel);
+	int i;
+
+	rpi_touchscreen_i2c_write(ts, REG_POWERON, 1);
+	/* Wait for nPWRDWN to go low to indicate poweron is done. */
+	for (i = 0; i < 100; i++) {
+		if (rpi_touchscreen_i2c_read(ts, REG_PORTB) & 1)
+			break;
+	}
+
+	rpi_touchscreen_write(ts, DSI_LANEENABLE,
+			      DSI_LANEENABLE_CLOCK |
+			      DSI_LANEENABLE_D0 |
+			      (ts->dsi->lanes > 1 ? DSI_LANEENABLE_D1 : 0));
+	rpi_touchscreen_write(ts, PPI_D0S_CLRSIPOCOUNT, 0x05);
+	rpi_touchscreen_write(ts, PPI_D1S_CLRSIPOCOUNT, 0x05);
+	rpi_touchscreen_write(ts, PPI_D0S_ATMR, 0x00);
+	rpi_touchscreen_write(ts, PPI_D1S_ATMR, 0x00);
+	rpi_touchscreen_write(ts, PPI_LPTXTIMECNT, 0x03);
+
+	rpi_touchscreen_write(ts, SPICMR, 0x00);
+	rpi_touchscreen_write(ts, LCDCTRL, 0x00100150);
+	rpi_touchscreen_write(ts, SYSCTRL, 0x040f);
+	msleep(100);
+
+	rpi_touchscreen_write(ts, PPI_STARTPPI, 0x01);
+	rpi_touchscreen_write(ts, DSI_STARTDSI, 0x01);
+	msleep(100);
+
+	/* Turn on the backlight. */
+	rpi_touchscreen_i2c_write(ts, REG_PWM, 255);
+
+	/* Default to the same orientation as the closed source
+	 * firmware used for the panel.  Runtime rotation
+	 * configuration will be supported using VC4's plane
+	 * orientation bits.
+	 */
+	rpi_touchscreen_i2c_write(ts, REG_PORTA, BIT(2));
+
+	return 0;
+}
+
+static int rpi_touchscreen_get_modes(struct drm_panel *panel)
+{
+	struct drm_connector *connector = panel->connector;
+	struct drm_device *drm = panel->drm;
+	unsigned int i, num = 0;
+
+	for (i = 0; i < ARRAY_SIZE(rpi_touchscreen_modes); i++) {
+		const struct drm_display_mode *m = &rpi_touchscreen_modes[i];
+		struct drm_display_mode *mode;
+
+		mode = drm_mode_duplicate(drm, m);
+		if (!mode) {
+			dev_err(drm->dev, "failed to add mode %ux%u@%u\n",
+				m->hdisplay, m->vdisplay, m->vrefresh);
+			continue;
+		}
+
+		mode->type |= DRM_MODE_TYPE_DRIVER;
+
+		if (i == 0)
+			mode->type |= DRM_MODE_TYPE_PREFERRED;
+
+		drm_mode_set_name(mode);
+
+		drm_mode_probed_add(connector, mode);
+		num++;
+	}
+
+	connector->display_info.bpc = 8;
+	connector->display_info.width_mm = 154;
+	connector->display_info.height_mm = 86;
+
+	return num;
+}
+
+static const struct drm_panel_funcs rpi_touchscreen_funcs = {
+	.disable = rpi_touchscreen_disable,
+	.unprepare = rpi_touchscreen_noop,
+	.prepare = rpi_touchscreen_noop,
+	.enable = rpi_touchscreen_enable,
+	.get_modes = rpi_touchscreen_get_modes,
+};
+
+static struct i2c_client *rpi_touchscreen_get_i2c(struct device *dev,
+						  const char *name)
+{
+	struct device_node *node;
+	struct i2c_client *client;
+
+	node = of_parse_phandle(dev->of_node, name, 0);
+	if (!node)
+		return ERR_PTR(-ENODEV);
+
+	client = of_find_i2c_device_by_node(node);
+
+	of_node_put(node);
+
+	if (!client)
+		return ERR_PTR(-EPROBE_DEFER);
+
+	return client;
+}
+
+static int rpi_touchscreen_dsi_probe(struct mipi_dsi_device *dsi)
+{
+	struct device *dev = &dsi->dev;
+	struct rpi_touchscreen *ts;
+	int ret, ver;
+
+	ts = devm_kzalloc(dev, sizeof(*ts), GFP_KERNEL);
+	if (!ts)
+		return -ENOMEM;
+
+	dev_set_drvdata(dev, ts);
+
+	ts->dsi = dsi;
+	dsi->mode_flags = (MIPI_DSI_MODE_VIDEO |
+			   MIPI_DSI_MODE_VIDEO_SYNC_PULSE |
+			   MIPI_DSI_MODE_LPM);
+	dsi->format = MIPI_DSI_FMT_RGB888;
+	dsi->lanes = 1;
+
+	ts->bridge_i2c =
+		rpi_touchscreen_get_i2c(dev, "raspberrypi,touchscreen-bridge");
+	if (IS_ERR(ts->bridge_i2c)) {
+		ret = -EPROBE_DEFER;
+		return ret;
+	}
+
+	ver = rpi_touchscreen_i2c_read(ts, REG_ID);
+	if (ver < 0) {
+		dev_err(dev, "Atmel I2C read failed: %d\n", ver);
+		return -ENODEV;
+	}
+
+	switch (ver) {
+	case 0xde:
+		ts->atmel_ver = 1;
+		break;
+	case 0xc3:
+		ts->atmel_ver = 2;
+		break;
+	default:
+		dev_err(dev, "Unknown Atmel firmware revision: 0x%02x\n", ver);
+		return -ENODEV;
+	}
+
+	/* Turn off at boot, so we can cleanly sequence powering on. */
+	rpi_touchscreen_i2c_write(ts, REG_POWERON, 0);
+
+	drm_panel_init(&ts->base);
+	ts->base.dev = dev;
+	ts->base.funcs = &rpi_touchscreen_funcs;
+
+	ret = drm_panel_add(&ts->base);
+	if (ret < 0)
+		goto err_release_bridge;
+
+	return mipi_dsi_attach(dsi);
+
+err_release_bridge:
+	put_device(&ts->bridge_i2c->dev);
+	return ret;
+}
+
+static int rpi_touchscreen_dsi_remove(struct mipi_dsi_device *dsi)
+{
+	struct device *dev = &dsi->dev;
+	struct rpi_touchscreen *ts = dev_get_drvdata(dev);
+	int ret;
+
+	ret = mipi_dsi_detach(dsi);
+	if (ret < 0) {
+		dev_err(&dsi->dev, "failed to detach from DSI host: %d\n", ret);
+		return ret;
+	}
+
+	drm_panel_detach(&ts->base);
+	drm_panel_remove(&ts->base);
+
+	put_device(&ts->bridge_i2c->dev);
+
+	return 0;
+}
+
+static void rpi_touchscreen_dsi_shutdown(struct mipi_dsi_device *dsi)
+{
+	struct device *dev = &dsi->dev;
+	struct rpi_touchscreen *ts = dev_get_drvdata(dev);
+
+	rpi_touchscreen_i2c_write(ts, REG_POWERON, 0);
+}
+
+static const struct of_device_id rpi_touchscreen_of_match[] = {
+	{ .compatible = "raspberrypi,touchscreen" },
+	{ } /* sentinel */
+};
+MODULE_DEVICE_TABLE(of, rpi_touchscreen_of_match);
+
+static struct mipi_dsi_driver rpi_touchscreen_driver = {
+	.driver = {
+		.name = "raspberrypi-touchscreen",
+		.of_match_table = rpi_touchscreen_of_match,
+	},
+	.probe = rpi_touchscreen_dsi_probe,
+	.remove = rpi_touchscreen_dsi_remove,
+	.shutdown = rpi_touchscreen_dsi_shutdown,
+};
+module_mipi_dsi_driver(rpi_touchscreen_driver);
+
+MODULE_AUTHOR("Eric Anholt <eric@anholt.net>");
+MODULE_DESCRIPTION("Raspberry Pi 7-inch touchscreen driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/gpu/drm/vc4/Makefile b/drivers/gpu/drm/vc4/Makefile
index 837c82757339..1eed0e92bd20 100644
--- a/drivers/gpu/drm/vc4/Makefile
+++ b/drivers/gpu/drm/vc4/Makefile
@@ -9,6 +9,7 @@ vc4-y := \
 	vc4_dpi.o \
 	vc4_dsi.o \
 	vc4_fence.o \
+	vc4_firmware_kms.o \
 	vc4_kms.o \
 	vc4_gem.o \
 	vc4_hdmi.o \
@@ -25,5 +26,3 @@ vc4-y := \
 vc4-$(CONFIG_DEBUG_FS) += vc4_debugfs.o
 
 obj-$(CONFIG_DRM_VC4)  += vc4.o
-
-CFLAGS_vc4_trace_points.o := -I$(src)
diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c
index eff0a8ece8bc..add9cc97a3b6 100644
--- a/drivers/gpu/drm/vc4/vc4_bo.c
+++ b/drivers/gpu/drm/vc4/vc4_bo.c
@@ -53,6 +53,17 @@ static void vc4_bo_stats_dump(struct vc4_dev *vc4)
 			 vc4->bo_labels[i].size_allocated / 1024,
 			 vc4->bo_labels[i].num_allocated);
 	}
+
+	mutex_lock(&vc4->purgeable.lock);
+	if (vc4->purgeable.num)
+		DRM_INFO("%30s: %6zdkb BOs (%d)\n", "userspace BO cache",
+			 vc4->purgeable.size / 1024, vc4->purgeable.num);
+
+	if (vc4->purgeable.purged_num)
+		DRM_INFO("%30s: %6zdkb BOs (%d)\n", "total purged BO",
+			 vc4->purgeable.purged_size / 1024,
+			 vc4->purgeable.purged_num);
+	mutex_unlock(&vc4->purgeable.lock);
 }
 
 #ifdef CONFIG_DEBUG_FS
@@ -75,6 +86,17 @@ int vc4_bo_stats_debugfs(struct seq_file *m, void *unused)
 	}
 	mutex_unlock(&vc4->bo_lock);
 
+	mutex_lock(&vc4->purgeable.lock);
+	if (vc4->purgeable.num)
+		seq_printf(m, "%30s: %6zdkb BOs (%d)\n", "userspace BO cache",
+			   vc4->purgeable.size / 1024, vc4->purgeable.num);
+
+	if (vc4->purgeable.purged_num)
+		seq_printf(m, "%30s: %6zdkb BOs (%d)\n", "total purged BO",
+			   vc4->purgeable.purged_size / 1024,
+			   vc4->purgeable.purged_num);
+	mutex_unlock(&vc4->purgeable.lock);
+
 	return 0;
 }
 #endif
@@ -248,6 +270,109 @@ static void vc4_bo_cache_purge(struct drm_device *dev)
 	mutex_unlock(&vc4->bo_lock);
 }
 
+void vc4_bo_add_to_purgeable_pool(struct vc4_bo *bo)
+{
+	struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
+
+	mutex_lock(&vc4->purgeable.lock);
+	list_add_tail(&bo->size_head, &vc4->purgeable.list);
+	vc4->purgeable.num++;
+	vc4->purgeable.size += bo->base.base.size;
+	mutex_unlock(&vc4->purgeable.lock);
+}
+
+static void vc4_bo_remove_from_purgeable_pool_locked(struct vc4_bo *bo)
+{
+	struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
+
+	/* list_del_init() is used here because the caller might release
+	 * the purgeable lock in order to acquire the madv one and update the
+	 * madv status.
+	 * During this short period of time a user might decide to mark
+	 * the BO as unpurgeable, and if bo->madv is set to
+	 * VC4_MADV_DONTNEED it will try to remove the BO from the
+	 * purgeable list which will fail if the ->next/prev fields
+	 * are set to LIST_POISON1/LIST_POISON2 (which is what
+	 * list_del() does).
+	 * Re-initializing the list element guarantees that list_del()
+	 * will work correctly even if it's a NOP.
+	 */
+	list_del_init(&bo->size_head);
+	vc4->purgeable.num--;
+	vc4->purgeable.size -= bo->base.base.size;
+}
+
+void vc4_bo_remove_from_purgeable_pool(struct vc4_bo *bo)
+{
+	struct vc4_dev *vc4 = to_vc4_dev(bo->base.base.dev);
+
+	mutex_lock(&vc4->purgeable.lock);
+	vc4_bo_remove_from_purgeable_pool_locked(bo);
+	mutex_unlock(&vc4->purgeable.lock);
+}
+
+static void vc4_bo_purge(struct drm_gem_object *obj)
+{
+	struct vc4_bo *bo = to_vc4_bo(obj);
+	struct drm_device *dev = obj->dev;
+
+	WARN_ON(!mutex_is_locked(&bo->madv_lock));
+	WARN_ON(bo->madv != VC4_MADV_DONTNEED);
+
+	drm_vma_node_unmap(&obj->vma_node, dev->anon_inode->i_mapping);
+
+	dma_free_wc(dev->dev, obj->size, bo->base.vaddr, bo->base.paddr);
+	bo->base.vaddr = NULL;
+	bo->madv = __VC4_MADV_PURGED;
+}
+
+static void vc4_bo_userspace_cache_purge(struct drm_device *dev)
+{
+	struct vc4_dev *vc4 = to_vc4_dev(dev);
+
+	mutex_lock(&vc4->purgeable.lock);
+	while (!list_empty(&vc4->purgeable.list)) {
+		struct vc4_bo *bo = list_first_entry(&vc4->purgeable.list,
+						     struct vc4_bo, size_head);
+		struct drm_gem_object *obj = &bo->base.base;
+		size_t purged_size = 0;
+
+		vc4_bo_remove_from_purgeable_pool_locked(bo);
+
+		/* Release the purgeable lock while we're purging the BO so
+		 * that other people can continue inserting things in the
+		 * purgeable pool without having to wait for all BOs to be
+		 * purged.
+		 */
+		mutex_unlock(&vc4->purgeable.lock);
+		mutex_lock(&bo->madv_lock);
+
+		/* Since we released the purgeable pool lock before acquiring
+		 * the BO madv one, the user may have marked the BO as WILLNEED
+		 * and re-used it in the meantime.
+		 * Before purging the BO we need to make sure
+		 * - it is still marked as DONTNEED
+		 * - it has not been re-inserted in the purgeable list
+		 * - it is not used by HW blocks
+		 * If one of these conditions is not met, just skip the entry.
+		 */
+		if (bo->madv == VC4_MADV_DONTNEED &&
+		    list_empty(&bo->size_head) &&
+		    !refcount_read(&bo->usecnt)) {
+			purged_size = bo->base.base.size;
+			vc4_bo_purge(obj);
+		}
+		mutex_unlock(&bo->madv_lock);
+		mutex_lock(&vc4->purgeable.lock);
+
+		if (purged_size) {
+			vc4->purgeable.purged_size += purged_size;
+			vc4->purgeable.purged_num++;
+		}
+	}
+	mutex_unlock(&vc4->purgeable.lock);
+}
+
 static struct vc4_bo *vc4_bo_get_from_cache(struct drm_device *dev,
 					    uint32_t size,
 					    enum vc4_kernel_bo_type type)
@@ -294,6 +419,9 @@ struct drm_gem_object *vc4_create_object(struct drm_device *dev, size_t size)
 	if (!bo)
 		return ERR_PTR(-ENOMEM);
 
+	bo->madv = VC4_MADV_WILLNEED;
+	refcount_set(&bo->usecnt, 0);
+	mutex_init(&bo->madv_lock);
 	mutex_lock(&vc4->bo_lock);
 	bo->label = VC4_BO_TYPE_KERNEL;
 	vc4->bo_labels[VC4_BO_TYPE_KERNEL].num_allocated++;
@@ -331,16 +459,38 @@ struct vc4_bo *vc4_bo_create(struct drm_device *dev, size_t unaligned_size,
 		 * CMA allocations we've got laying around and try again.
 		 */
 		vc4_bo_cache_purge(dev);
+		cma_obj = drm_gem_cma_create(dev, size);
+	}
 
+	if (IS_ERR(cma_obj)) {
+		/*
+		 * Still not enough CMA memory, purge the userspace BO
+		 * cache and retry.
+		 * This is sub-optimal since we purge the whole userspace
+		 * BO cache which forces user that want to re-use the BO to
+		 * restore its initial content.
+		 * Ideally, we should purge entries one by one and retry
+		 * after each to see if CMA allocation succeeds. Or even
+		 * better, try to find an entry with at least the same
+		 * size.
+		 */
+		vc4_bo_userspace_cache_purge(dev);
 		cma_obj = drm_gem_cma_create(dev, size);
-		if (IS_ERR(cma_obj)) {
-			DRM_ERROR("Failed to allocate from CMA:\n");
-			vc4_bo_stats_dump(vc4);
-			return ERR_PTR(-ENOMEM);
-		}
+	}
+
+	if (IS_ERR(cma_obj)) {
+		DRM_ERROR("Failed to allocate from CMA:\n");
+		vc4_bo_stats_dump(vc4);
+		return ERR_PTR(-ENOMEM);
 	}
 	bo = to_vc4_bo(&cma_obj->base);
 
+	/* By default, BOs do not support the MADV ioctl. This will be enabled
+	 * only on BOs that are exposed to userspace (V3D, V3D_SHADER and DUMB
+	 * BOs).
+	 */
+	bo->madv = __VC4_MADV_NOTSUPP;
+
 	mutex_lock(&vc4->bo_lock);
 	vc4_bo_set_label(&cma_obj->base, type);
 	mutex_unlock(&vc4->bo_lock);
@@ -366,6 +516,8 @@ int vc4_dumb_create(struct drm_file *file_priv,
 	if (IS_ERR(bo))
 		return PTR_ERR(bo);
 
+	bo->madv = VC4_MADV_WILLNEED;
+
 	ret = drm_gem_handle_create(file_priv, &bo->base.base, &args->handle);
 	drm_gem_object_put_unlocked(&bo->base.base);
 
@@ -404,6 +556,12 @@ void vc4_free_object(struct drm_gem_object *gem_bo)
 	struct vc4_bo *bo = to_vc4_bo(gem_bo);
 	struct list_head *cache_list;
 
+	/* Remove the BO from the purgeable list. */
+	mutex_lock(&bo->madv_lock);
+	if (bo->madv == VC4_MADV_DONTNEED && !refcount_read(&bo->usecnt))
+		vc4_bo_remove_from_purgeable_pool(bo);
+	mutex_unlock(&bo->madv_lock);
+
 	mutex_lock(&vc4->bo_lock);
 	/* If the object references someone else's memory, we can't cache it.
 	 */
@@ -419,7 +577,8 @@ void vc4_free_object(struct drm_gem_object *gem_bo)
 	}
 
 	/* If this object was partially constructed but CMA allocation
-	 * had failed, just free it.
+	 * had failed, just free it. Can also happen when the BO has been
+	 * purged.
 	 */
 	if (!bo->base.vaddr) {
 		vc4_bo_destroy(bo);
@@ -439,6 +598,10 @@ void vc4_free_object(struct drm_gem_object *gem_bo)
 		bo->validated_shader = NULL;
 	}
 
+	/* Reset madv and usecnt before adding the BO to the cache. */
+	bo->madv = __VC4_MADV_NOTSUPP;
+	refcount_set(&bo->usecnt, 0);
+
 	bo->t_format = false;
 	bo->free_time = jiffies;
 	list_add(&bo->size_head, cache_list);
@@ -463,10 +626,60 @@ static void vc4_bo_cache_time_work(struct work_struct *work)
 	mutex_unlock(&vc4->bo_lock);
 }
 
-static void vc4_bo_cache_time_timer(unsigned long data)
+int vc4_bo_inc_usecnt(struct vc4_bo *bo)
 {
-	struct drm_device *dev = (struct drm_device *)data;
-	struct vc4_dev *vc4 = to_vc4_dev(dev);
+	int ret;
+
+	/* Fast path: if the BO is already retained by someone, no need to
+	 * check the madv status.
+	 */
+	if (refcount_inc_not_zero(&bo->usecnt))
+		return 0;
+
+	mutex_lock(&bo->madv_lock);
+	switch (bo->madv) {
+	case VC4_MADV_WILLNEED:
+		if (!refcount_inc_not_zero(&bo->usecnt))
+			refcount_set(&bo->usecnt, 1);
+		ret = 0;
+		break;
+	case VC4_MADV_DONTNEED:
+		/* We shouldn't use a BO marked as purgeable if at least
+		 * someone else retained its content by incrementing usecnt.
+		 * Luckily the BO hasn't been purged yet, but something wrong
+		 * is happening here. Just throw an error instead of
+		 * authorizing this use case.
+		 */
+	case __VC4_MADV_PURGED:
+		/* We can't use a purged BO. */
+	default:
+		/* Invalid madv value. */
+		ret = -EINVAL;
+		break;
+	}
+	mutex_unlock(&bo->madv_lock);
+
+	return ret;
+}
+
+void vc4_bo_dec_usecnt(struct vc4_bo *bo)
+{
+	/* Fast path: if the BO is still retained by someone, no need to test
+	 * the madv value.
+	 */
+	if (refcount_dec_not_one(&bo->usecnt))
+		return;
+
+	mutex_lock(&bo->madv_lock);
+	if (refcount_dec_and_test(&bo->usecnt) &&
+	    bo->madv == VC4_MADV_DONTNEED)
+		vc4_bo_add_to_purgeable_pool(bo);
+	mutex_unlock(&bo->madv_lock);
+}
+
+static void vc4_bo_cache_time_timer(struct timer_list *t)
+{
+	struct vc4_dev *vc4 = from_timer(vc4, t, bo_cache.time_timer);
 
 	schedule_work(&vc4->bo_cache.time_work);
 }
@@ -482,18 +695,52 @@ struct dma_buf *
 vc4_prime_export(struct drm_device *dev, struct drm_gem_object *obj, int flags)
 {
 	struct vc4_bo *bo = to_vc4_bo(obj);
+	struct dma_buf *dmabuf;
+	int ret;
 
 	if (bo->validated_shader) {
 		DRM_DEBUG("Attempting to export shader BO\n");
 		return ERR_PTR(-EINVAL);
 	}
 
-	return drm_gem_prime_export(dev, obj, flags);
+	/* Note: as soon as the BO is exported it becomes unpurgeable, because
+	 * noone ever decrements the usecnt even if the reference held by the
+	 * exported BO is released. This shouldn't be a problem since we don't
+	 * expect exported BOs to be marked as purgeable.
+	 */
+	ret = vc4_bo_inc_usecnt(bo);
+	if (ret) {
+		DRM_ERROR("Failed to increment BO usecnt\n");
+		return ERR_PTR(ret);
+	}
+
+	dmabuf = drm_gem_prime_export(dev, obj, flags);
+	if (IS_ERR(dmabuf))
+		vc4_bo_dec_usecnt(bo);
+
+	return dmabuf;
+}
+
+int vc4_fault(struct vm_fault *vmf)
+{
+	struct vm_area_struct *vma = vmf->vma;
+	struct drm_gem_object *obj = vma->vm_private_data;
+	struct vc4_bo *bo = to_vc4_bo(obj);
+
+	/* The only reason we would end up here is when user-space accesses
+	 * BO's memory after it's been purged.
+	 */
+	mutex_lock(&bo->madv_lock);
+	WARN_ON(bo->madv != __VC4_MADV_PURGED);
+	mutex_unlock(&bo->madv_lock);
+
+	return VM_FAULT_SIGBUS;
 }
 
 int vc4_mmap(struct file *filp, struct vm_area_struct *vma)
 {
 	struct drm_gem_object *gem_obj;
+	unsigned long vm_pgoff;
 	struct vc4_bo *bo;
 	int ret;
 
@@ -509,16 +756,36 @@ int vc4_mmap(struct file *filp, struct vm_area_struct *vma)
 		return -EINVAL;
 	}
 
+	if (bo->madv != VC4_MADV_WILLNEED) {
+		DRM_DEBUG("mmaping of %s BO not allowed\n",
+			  bo->madv == VC4_MADV_DONTNEED ?
+			  "purgeable" : "purged");
+		return -EINVAL;
+	}
+
 	/*
 	 * Clear the VM_PFNMAP flag that was set by drm_gem_mmap(), and set the
 	 * vm_pgoff (used as a fake buffer offset by DRM) to 0 as we want to map
 	 * the whole buffer.
 	 */
 	vma->vm_flags &= ~VM_PFNMAP;
-	vma->vm_pgoff = 0;
 
+	/* This ->vm_pgoff dance is needed to make all parties happy:
+	 * - dma_mmap_wc() uses ->vm_pgoff as an offset within the allocated
+	 *   mem-region, hence the need to set it to zero (the value set by
+	 *   the DRM core is a virtual offset encoding the GEM object-id)
+	 * - the mmap() core logic needs ->vm_pgoff to be restored to its
+	 *   initial value before returning from this function because it
+	 *   encodes the  offset of this GEM in the dev->anon_inode pseudo-file
+	 *   and this information will be used when we invalidate userspace
+	 *   mappings  with drm_vma_node_unmap() (called from vc4_gem_purge()).
+	 */
+	vm_pgoff = vma->vm_pgoff;
+	vma->vm_pgoff = 0;
 	ret = dma_mmap_wc(bo->base.base.dev->dev, vma, bo->base.vaddr,
 			  bo->base.paddr, vma->vm_end - vma->vm_start);
+	vma->vm_pgoff = vm_pgoff;
+
 	if (ret)
 		drm_gem_vm_close(vma);
 
@@ -582,6 +849,8 @@ int vc4_create_bo_ioctl(struct drm_device *dev, void *data,
 	if (IS_ERR(bo))
 		return PTR_ERR(bo);
 
+	bo->madv = VC4_MADV_WILLNEED;
+
 	ret = drm_gem_handle_create(file_priv, &bo->base.base, &args->handle);
 	drm_gem_object_put_unlocked(&bo->base.base);
 
@@ -635,6 +904,8 @@ vc4_create_shader_bo_ioctl(struct drm_device *dev, void *data,
 	if (IS_ERR(bo))
 		return PTR_ERR(bo);
 
+	bo->madv = VC4_MADV_WILLNEED;
+
 	if (copy_from_user(bo->base.vaddr,
 			     (void __user *)(uintptr_t)args->data,
 			     args->size)) {
@@ -770,9 +1041,7 @@ int vc4_bo_cache_init(struct drm_device *dev)
 	INIT_LIST_HEAD(&vc4->bo_cache.time_list);
 
 	INIT_WORK(&vc4->bo_cache.time_work, vc4_bo_cache_time_work);
-	setup_timer(&vc4->bo_cache.time_timer,
-		    vc4_bo_cache_time_timer,
-		    (unsigned long)dev);
+	timer_setup(&vc4->bo_cache.time_timer, vc4_bo_cache_time_timer, 0);
 
 	return 0;
 }
diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index ce1e3b9e14c9..6fca0f686207 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -164,6 +164,9 @@ bool vc4_crtc_get_scanoutpos(struct drm_device *dev, unsigned int crtc_id,
 	int vblank_lines;
 	bool ret = false;
 
+	if (vc4->firmware_kms)
+		return 0;
+
 	/* preempt_disable_rt() should go right here in PREEMPT_RT patchset. */
 
 	/* Get optional system timestamp before query. */
diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c
index 1c96edcb302b..982ec1bb3f01 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.c
+++ b/drivers/gpu/drm/vc4/vc4_drv.c
@@ -100,6 +100,7 @@ static int vc4_get_param_ioctl(struct drm_device *dev, void *data,
 	case DRM_VC4_PARAM_SUPPORTS_ETC1:
 	case DRM_VC4_PARAM_SUPPORTS_THREADED_FS:
 	case DRM_VC4_PARAM_SUPPORTS_FIXED_RCL_ORDER:
+	case DRM_VC4_PARAM_SUPPORTS_MADVISE:
 		args->value = true;
 		break;
 	default:
@@ -117,6 +118,12 @@ static void vc4_lastclose(struct drm_device *dev)
 	drm_fbdev_cma_restore_mode(vc4->fbdev);
 }
 
+static const struct vm_operations_struct vc4_vm_ops = {
+	.fault = vc4_fault,
+	.open = drm_gem_vm_open,
+	.close = drm_gem_vm_close,
+};
+
 static const struct file_operations vc4_drm_fops = {
 	.owner = THIS_MODULE,
 	.open = drm_open,
@@ -142,6 +149,7 @@ static const struct drm_ioctl_desc vc4_drm_ioctls[] = {
 	DRM_IOCTL_DEF_DRV(VC4_SET_TILING, vc4_set_tiling_ioctl, DRM_RENDER_ALLOW),
 	DRM_IOCTL_DEF_DRV(VC4_GET_TILING, vc4_get_tiling_ioctl, DRM_RENDER_ALLOW),
 	DRM_IOCTL_DEF_DRV(VC4_LABEL_BO, vc4_label_bo_ioctl, DRM_RENDER_ALLOW),
+	DRM_IOCTL_DEF_DRV(VC4_GEM_MADVISE, vc4_gem_madvise_ioctl, DRM_RENDER_ALLOW),
 };
 
 static struct drm_driver vc4_drm_driver = {
@@ -166,7 +174,7 @@ static struct drm_driver vc4_drm_driver = {
 
 	.gem_create_object = vc4_create_object,
 	.gem_free_object_unlocked = vc4_free_object,
-	.gem_vm_ops = &drm_gem_cma_vm_ops,
+	.gem_vm_ops = &vc4_vm_ops,
 
 	.prime_handle_to_fd = drm_gem_prime_handle_to_fd,
 	.prime_fd_to_handle = drm_gem_prime_fd_to_handle,
@@ -317,6 +325,7 @@ static struct platform_driver *const component_drivers[] = {
 	&vc4_dsi_driver,
 	&vc4_hvs_driver,
 	&vc4_crtc_driver,
+	&vc4_firmware_kms_driver,
 	&vc4_v3d_driver,
 };
 
diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
index 87f2d8e5c134..0d71831571ea 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.h
+++ b/drivers/gpu/drm/vc4/vc4_drv.h
@@ -32,6 +32,9 @@ enum vc4_kernel_bo_type {
 struct vc4_dev {
 	struct drm_device *dev;
 
+	bool firmware_kms;
+	struct rpi_firmware *firmware;
+
 	struct vc4_hdmi *hdmi;
 	struct vc4_hvs *hvs;
 	struct vc4_v3d *v3d;
@@ -74,6 +77,19 @@ struct vc4_dev {
 	/* Protects bo_cache and bo_labels. */
 	struct mutex bo_lock;
 
+	/* Purgeable BO pool. All BOs in this pool can have their memory
+	 * reclaimed if the driver is unable to allocate new BOs. We also
+	 * keep stats related to the purge mechanism here.
+	 */
+	struct {
+		struct list_head list;
+		unsigned int num;
+		size_t size;
+		unsigned int purged_num;
+		size_t purged_size;
+		struct mutex lock;
+	} purgeable;
+
 	uint64_t dma_fence_context;
 
 	/* Sequence number for the last job queued in bin_job_list.
@@ -192,6 +208,16 @@ struct vc4_bo {
 	 * for user-allocated labels.
 	 */
 	int label;
+
+	/* Count the number of active users. This is needed to determine
+	 * whether we can move the BO to the purgeable list or not (when the BO
+	 * is used by the GPU or the display engine we can't purge it).
+	 */
+	refcount_t usecnt;
+
+	/* Store purgeable/purged state here */
+	u32 madv;
+	struct mutex madv_lock;
 };
 
 static inline struct vc4_bo *
@@ -503,6 +529,7 @@ int vc4_get_hang_state_ioctl(struct drm_device *dev, void *data,
 			     struct drm_file *file_priv);
 int vc4_label_bo_ioctl(struct drm_device *dev, void *data,
 		       struct drm_file *file_priv);
+int vc4_fault(struct vm_fault *vmf);
 int vc4_mmap(struct file *filp, struct vm_area_struct *vma);
 struct reservation_object *vc4_prime_res_obj(struct drm_gem_object *obj);
 int vc4_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma);
@@ -513,6 +540,10 @@ void *vc4_prime_vmap(struct drm_gem_object *obj);
 int vc4_bo_cache_init(struct drm_device *dev);
 void vc4_bo_cache_destroy(struct drm_device *dev);
 int vc4_bo_stats_debugfs(struct seq_file *m, void *arg);
+int vc4_bo_inc_usecnt(struct vc4_bo *bo);
+void vc4_bo_dec_usecnt(struct vc4_bo *bo);
+void vc4_bo_add_to_purgeable_pool(struct vc4_bo *bo);
+void vc4_bo_remove_from_purgeable_pool(struct vc4_bo *bo);
 
 /* vc4_crtc.c */
 extern struct platform_driver vc4_crtc_driver;
@@ -539,6 +570,10 @@ int vc4_dsi_debugfs_regs(struct seq_file *m, void *unused);
 /* vc4_fence.c */
 extern const struct dma_fence_ops vc4_fence_ops;
 
+/* vc4_firmware_kms.c */
+extern struct platform_driver vc4_firmware_kms_driver;
+void vc4_fkms_cancel_page_flip(struct drm_crtc *crtc, struct drm_file *file);
+
 /* vc4_gem.c */
 void vc4_gem_init(struct drm_device *dev);
 void vc4_gem_destroy(struct drm_device *dev);
@@ -557,6 +592,8 @@ void vc4_job_handle_completed(struct vc4_dev *vc4);
 int vc4_queue_seqno_cb(struct drm_device *dev,
 		       struct vc4_seqno_cb *cb, uint64_t seqno,
 		       void (*func)(struct vc4_seqno_cb *cb));
+int vc4_gem_madvise_ioctl(struct drm_device *dev, void *data,
+			  struct drm_file *file_priv);
 
 /* vc4_hdmi.c */
 extern struct platform_driver vc4_hdmi_driver;
diff --git a/drivers/gpu/drm/vc4/vc4_dsi.c b/drivers/gpu/drm/vc4/vc4_dsi.c
index 04796d7d0fdb..a3f416cbd1d6 100644
--- a/drivers/gpu/drm/vc4/vc4_dsi.c
+++ b/drivers/gpu/drm/vc4/vc4_dsi.c
@@ -753,6 +753,11 @@ static void vc4_dsi_ulps(struct vc4_dsi *dsi, bool ulps)
 			 (dsi->lanes > 2 ? DSI1_STAT_PHY_D2_STOP : 0) |
 			 (dsi->lanes > 3 ? DSI1_STAT_PHY_D3_STOP : 0));
 	int ret;
+	bool ulps_currently_enabled = (DSI_PORT_READ(PHY_AFEC0) &
+				       DSI_PORT_BIT(PHY_AFEC0_LATCH_ULPS));
+
+	if (ulps == ulps_currently_enabled)
+		return;
 
 	DSI_PORT_WRITE(STAT, stat_ulps);
 	DSI_PORT_WRITE(PHYC, DSI_PORT_READ(PHYC) | phyc_ulps);
@@ -859,11 +864,7 @@ static bool vc4_dsi_encoder_mode_fixup(struct drm_encoder *encoder,
 	pll_clock = parent_rate / divider;
 	pixel_clock_hz = pll_clock / dsi->divider;
 
-	/* Round up the clk_set_rate() request slightly, since
-	 * PLLD_DSI1 is an integer divider and its rate selection will
-	 * never round up.
-	 */
-	adjusted_mode->clock = pixel_clock_hz / 1000 + 1;
+	adjusted_mode->clock = pixel_clock_hz / 1000;
 
 	/* Given the new pixel clock, adjust HFP to keep vrefresh the same. */
 	adjusted_mode->htotal = adjusted_mode->clock * mode->htotal /
@@ -901,7 +902,11 @@ static void vc4_dsi_encoder_enable(struct drm_encoder *encoder)
 		vc4_dsi_dump_regs(dsi);
 	}
 
-	phy_clock = pixel_clock_hz * dsi->divider;
+	/* Round up the clk_set_rate() request slightly, since
+	 * PLLD_DSI1 is an integer divider and its rate selection will
+	 * never round up.
+	 */
+	phy_clock = (pixel_clock_hz + 1000) * dsi->divider;
 	ret = clk_set_rate(dsi->pll_phy_clock, phy_clock);
 	if (ret) {
 		dev_err(&dsi->pdev->dev,
@@ -1383,6 +1388,27 @@ static void dsi_handle_error(struct vc4_dsi *dsi,
 	*ret = IRQ_HANDLED;
 }
 
+/*
+ * Initial handler for port 1 where we need the reg_dma workaround.
+ * The register DMA writes sleep, so we can't do it in the top half.
+ * Instead we use IRQF_ONESHOT so that the IRQ gets disabled in the
+ * parent interrupt contrller until our interrupt thread is done.
+ */
+static irqreturn_t vc4_dsi_irq_defer_to_thread_handler(int irq, void *data)
+{
+	struct vc4_dsi *dsi = data;
+	u32 stat = DSI_PORT_READ(INT_STAT);
+
+	if (!stat)
+		return IRQ_NONE;
+
+	return IRQ_WAKE_THREAD;
+}
+
+/*
+ * Normal IRQ handler for port 0, or the threaded IRQ handler for port
+ * 1 where we need the reg_dma workaround.
+ */
 static irqreturn_t vc4_dsi_irq_handler(int irq, void *data)
 {
 	struct vc4_dsi *dsi = data;
@@ -1566,8 +1592,15 @@ static int vc4_dsi_bind(struct device *dev, struct device *master, void *data)
 	/* Clear any existing interrupt state. */
 	DSI_PORT_WRITE(INT_STAT, DSI_PORT_READ(INT_STAT));
 
-	ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
-			       vc4_dsi_irq_handler, 0, "vc4 dsi", dsi);
+	if (dsi->reg_dma_mem)
+		ret = devm_request_threaded_irq(dev, platform_get_irq(pdev, 0),
+						vc4_dsi_irq_defer_to_thread_handler,
+						vc4_dsi_irq_handler,
+						IRQF_ONESHOT,
+						"vc4 dsi", dsi);
+	else
+		ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
+				       vc4_dsi_irq_handler, 0, "vc4 dsi", dsi);
 	if (ret) {
 		if (ret != -EPROBE_DEFER)
 			dev_err(dev, "Failed to get interrupt: %d\n", ret);
diff --git a/drivers/gpu/drm/vc4/vc4_firmware_kms.c b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
new file mode 100644
index 000000000000..60e9d8fa5511
--- /dev/null
+++ b/drivers/gpu/drm/vc4/vc4_firmware_kms.c
@@ -0,0 +1,770 @@
+/*
+ * Copyright (C) 2016 Broadcom
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/**
+ * DOC: VC4 firmware KMS module.
+ *
+ * As a hack to get us from the current closed source driver world
+ * toward a totally open stack, implement KMS on top of the Raspberry
+ * Pi's firmware display stack.
+ */
+
+#include "drm/drm_atomic_helper.h"
+#include "drm/drm_plane_helper.h"
+#include "drm/drm_crtc_helper.h"
+#include "drm/drm_fourcc.h"
+#include "linux/clk.h"
+#include "linux/debugfs.h"
+#include "drm/drm_fb_cma_helper.h"
+#include "linux/component.h"
+#include "linux/of_device.h"
+#include "vc4_drv.h"
+#include "vc4_regs.h"
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+/* The firmware delivers a vblank interrupt to us through the SMI
+ * hardware, which has only this one register.
+ */
+#define SMICS 0x0
+#define SMICS_INTERRUPTS (BIT(9) | BIT(10) | BIT(11))
+
+struct vc4_crtc {
+	struct drm_crtc base;
+	struct drm_encoder *encoder;
+	struct drm_connector *connector;
+	void __iomem *regs;
+
+	struct drm_pending_vblank_event *event;
+	u32 overscan[4];
+	bool vblank_enabled;
+};
+
+static inline struct vc4_crtc *to_vc4_crtc(struct drm_crtc *crtc)
+{
+	return container_of(crtc, struct vc4_crtc, base);
+}
+
+struct vc4_fkms_encoder {
+	struct drm_encoder base;
+};
+
+static inline struct vc4_fkms_encoder *
+to_vc4_fkms_encoder(struct drm_encoder *encoder)
+{
+	return container_of(encoder, struct vc4_fkms_encoder, base);
+}
+
+/* VC4 FKMS connector KMS struct */
+struct vc4_fkms_connector {
+	struct drm_connector base;
+
+	/* Since the connector is attached to just the one encoder,
+	 * this is the reference to it so we can do the best_encoder()
+	 * hook.
+	 */
+	struct drm_encoder *encoder;
+};
+
+static inline struct vc4_fkms_connector *
+to_vc4_fkms_connector(struct drm_connector *connector)
+{
+	return container_of(connector, struct vc4_fkms_connector, base);
+}
+
+/* Firmware's structure for making an FB mbox call. */
+struct fbinfo_s {
+	u32 xres, yres, xres_virtual, yres_virtual;
+	u32 pitch, bpp;
+	u32 xoffset, yoffset;
+	u32 base;
+	u32 screen_size;
+	u16 cmap[256];
+};
+
+struct vc4_fkms_plane {
+	struct drm_plane base;
+	struct fbinfo_s *fbinfo;
+	dma_addr_t fbinfo_bus_addr;
+	u32 pitch;
+};
+
+static inline struct vc4_fkms_plane *to_vc4_fkms_plane(struct drm_plane *plane)
+{
+	return (struct vc4_fkms_plane *)plane;
+}
+
+/* Turns the display on/off. */
+static int vc4_plane_set_primary_blank(struct drm_plane *plane, bool blank)
+{
+	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
+
+	u32 packet = blank;
+
+	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] primary plane %s",
+			 plane->base.id, plane->name,
+			 blank ? "blank" : "unblank");
+
+	return rpi_firmware_property(vc4->firmware,
+				     RPI_FIRMWARE_FRAMEBUFFER_BLANK,
+				     &packet, sizeof(packet));
+}
+
+static void vc4_primary_plane_atomic_update(struct drm_plane *plane,
+					    struct drm_plane_state *old_state)
+{
+	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
+	struct vc4_fkms_plane *vc4_plane = to_vc4_fkms_plane(plane);
+	struct drm_plane_state *state = plane->state;
+	struct drm_framebuffer *fb = state->fb;
+	struct drm_gem_cma_object *bo = drm_fb_cma_get_gem_obj(fb, 0);
+	volatile struct fbinfo_s *fbinfo = vc4_plane->fbinfo;
+	u32 bpp = 32;
+	int ret;
+
+	fbinfo->xres = state->crtc_w;
+	fbinfo->yres = state->crtc_h;
+	fbinfo->xres_virtual = state->crtc_w;
+	fbinfo->yres_virtual = state->crtc_h;
+	fbinfo->bpp = bpp;
+	fbinfo->xoffset = state->crtc_x;
+	fbinfo->yoffset = state->crtc_y;
+	fbinfo->base = bo->paddr + fb->offsets[0];
+	fbinfo->pitch = fb->pitches[0];
+
+	if (fb->modifier == DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED)
+		fbinfo->bpp |= BIT(31);
+
+	/* A bug in the firmware makes it so that if the fb->base is
+	 * set to nonzero, the configured pitch gets overwritten with
+	 * the previous pitch.  So, to get the configured pitch
+	 * recomputed, we have to make it allocate itself a new buffer
+	 * in VC memory, first.
+	 */
+	if (vc4_plane->pitch != fb->pitches[0]) {
+		u32 saved_base = fbinfo->base;
+		fbinfo->base = 0;
+
+		ret = rpi_firmware_transaction(vc4->firmware,
+					       RPI_FIRMWARE_CHAN_FB,
+					       vc4_plane->fbinfo_bus_addr);
+		fbinfo->base = saved_base;
+
+		vc4_plane->pitch = fbinfo->pitch;
+		WARN_ON_ONCE(vc4_plane->pitch != fb->pitches[0]);
+	}
+
+	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] primary update %dx%d@%d +%d,%d 0x%08x/%d\n",
+			 plane->base.id, plane->name,
+			 state->crtc_w,
+			 state->crtc_h,
+			 bpp,
+			 state->crtc_x,
+			 state->crtc_y,
+			 bo->paddr + fb->offsets[0],
+			 fb->pitches[0]);
+
+	ret = rpi_firmware_transaction(vc4->firmware,
+				       RPI_FIRMWARE_CHAN_FB,
+				       vc4_plane->fbinfo_bus_addr);
+	WARN_ON_ONCE(fbinfo->pitch != fb->pitches[0]);
+	WARN_ON_ONCE(fbinfo->base != bo->paddr + fb->offsets[0]);
+
+	/* If the CRTC is on (or going to be on) and we're enabled,
+	 * then unblank.  Otherwise, stay blank until CRTC enable.
+	*/
+	if (state->crtc->state->active)
+		vc4_plane_set_primary_blank(plane, false);
+}
+
+static void vc4_primary_plane_atomic_disable(struct drm_plane *plane,
+					     struct drm_plane_state *old_state)
+{
+	vc4_plane_set_primary_blank(plane, true);
+}
+
+static void vc4_cursor_plane_atomic_update(struct drm_plane *plane,
+					   struct drm_plane_state *old_state)
+{
+	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
+	struct vc4_crtc *vc4_crtc = to_vc4_crtc(plane->crtc);
+	struct drm_plane_state *state = plane->state;
+	struct drm_framebuffer *fb = state->fb;
+	struct drm_gem_cma_object *bo = drm_fb_cma_get_gem_obj(fb, 0);
+	int ret;
+	u32 packet_state[] = {
+		state->crtc->state->active,
+		state->crtc_x,
+		state->crtc_y,
+		0
+	};
+	WARN_ON_ONCE(fb->pitches[0] != state->crtc_w * 4);
+
+	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] update %dx%d cursor at %d,%d (0x%08x/%d)",
+			 plane->base.id, plane->name,
+			 state->crtc_w,
+			 state->crtc_h,
+			 state->crtc_x,
+			 state->crtc_y,
+			 bo->paddr + fb->offsets[0],
+			 fb->pitches[0]);
+
+	/* add on the top/left offsets when overscan is active */
+	if (vc4_crtc) {
+		packet_state[1] += vc4_crtc->overscan[0];
+		packet_state[2] += vc4_crtc->overscan[1];
+	}
+
+	ret = rpi_firmware_property(vc4->firmware,
+				    RPI_FIRMWARE_SET_CURSOR_STATE,
+				    &packet_state,
+				    sizeof(packet_state));
+	if (ret || packet_state[0] != 0)
+		DRM_ERROR("Failed to set cursor state: 0x%08x\n", packet_state[0]);
+
+	/* Note: When the cursor contents change, the modesetting
+	 * driver calls drm_mode_cursor_univeral() with
+	 * DRM_MODE_CURSOR_BO, which means a new fb will be allocated.
+	 */
+	if (!old_state ||
+	    state->crtc_w != old_state->crtc_w ||
+	    state->crtc_h != old_state->crtc_h ||
+	    fb != old_state->fb) {
+		u32 packet_info[] = { state->crtc_w, state->crtc_h,
+				      0, /* unused */
+				      bo->paddr + fb->offsets[0],
+				      0, 0, /* hotx, hoty */};
+
+		ret = rpi_firmware_property(vc4->firmware,
+					    RPI_FIRMWARE_SET_CURSOR_INFO,
+					    &packet_info,
+					    sizeof(packet_info));
+		if (ret || packet_info[0] != 0)
+			DRM_ERROR("Failed to set cursor info: 0x%08x\n", packet_info[0]);
+	}
+}
+
+static void vc4_cursor_plane_atomic_disable(struct drm_plane *plane,
+					    struct drm_plane_state *old_state)
+{
+	struct vc4_dev *vc4 = to_vc4_dev(plane->dev);
+	u32 packet_state[] = { false, 0, 0, 0 };
+	int ret;
+
+	DRM_DEBUG_ATOMIC("[PLANE:%d:%s] disabling cursor", plane->base.id, plane->name);
+
+	ret = rpi_firmware_property(vc4->firmware,
+				    RPI_FIRMWARE_SET_CURSOR_STATE,
+				    &packet_state,
+				    sizeof(packet_state));
+	if (ret || packet_state[0] != 0)
+		DRM_ERROR("Failed to set cursor state: 0x%08x\n", packet_state[0]);
+}
+
+static int vc4_plane_atomic_check(struct drm_plane *plane,
+				  struct drm_plane_state *state)
+{
+	return 0;
+}
+
+static void vc4_plane_destroy(struct drm_plane *plane)
+{
+	drm_plane_helper_disable(plane);
+	drm_plane_cleanup(plane);
+}
+
+static const struct drm_plane_funcs vc4_plane_funcs = {
+	.update_plane = drm_atomic_helper_update_plane,
+	.disable_plane = drm_atomic_helper_disable_plane,
+	.destroy = vc4_plane_destroy,
+	.set_property = NULL,
+	.reset = drm_atomic_helper_plane_reset,
+	.atomic_duplicate_state = drm_atomic_helper_plane_duplicate_state,
+	.atomic_destroy_state = drm_atomic_helper_plane_destroy_state,
+};
+
+static const struct drm_plane_helper_funcs vc4_primary_plane_helper_funcs = {
+	.prepare_fb = NULL,
+	.cleanup_fb = NULL,
+	.atomic_check = vc4_plane_atomic_check,
+	.atomic_update = vc4_primary_plane_atomic_update,
+	.atomic_disable = vc4_primary_plane_atomic_disable,
+};
+
+static const struct drm_plane_helper_funcs vc4_cursor_plane_helper_funcs = {
+	.prepare_fb = NULL,
+	.cleanup_fb = NULL,
+	.atomic_check = vc4_plane_atomic_check,
+	.atomic_update = vc4_cursor_plane_atomic_update,
+	.atomic_disable = vc4_cursor_plane_atomic_disable,
+};
+
+static struct drm_plane *vc4_fkms_plane_init(struct drm_device *dev,
+					     enum drm_plane_type type)
+{
+	struct drm_plane *plane = NULL;
+	struct vc4_fkms_plane *vc4_plane;
+	u32 xrgb8888 = DRM_FORMAT_XRGB8888;
+	u32 argb8888 = DRM_FORMAT_ARGB8888;
+	int ret = 0;
+	bool primary = (type == DRM_PLANE_TYPE_PRIMARY);
+
+	vc4_plane = devm_kzalloc(dev->dev, sizeof(*vc4_plane),
+				 GFP_KERNEL);
+	if (!vc4_plane) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	plane = &vc4_plane->base;
+	ret = drm_universal_plane_init(dev, plane, 0xff,
+				       &vc4_plane_funcs,
+				       primary ? &xrgb8888 : &argb8888, 1, NULL,
+				       type, primary ? "primary" : "cursor");
+
+	if (type == DRM_PLANE_TYPE_PRIMARY) {
+		vc4_plane->fbinfo =
+			dma_alloc_coherent(dev->dev,
+					   sizeof(*vc4_plane->fbinfo),
+					   &vc4_plane->fbinfo_bus_addr,
+					   GFP_KERNEL);
+		memset(vc4_plane->fbinfo, 0, sizeof(*vc4_plane->fbinfo));
+
+		drm_plane_helper_add(plane, &vc4_primary_plane_helper_funcs);
+	} else {
+		drm_plane_helper_add(plane, &vc4_cursor_plane_helper_funcs);
+	}
+
+	return plane;
+fail:
+	if (plane)
+		vc4_plane_destroy(plane);
+
+	return ERR_PTR(ret);
+}
+
+static void vc4_crtc_mode_set_nofb(struct drm_crtc *crtc)
+{
+	/* Everyting is handled in the planes. */
+}
+
+static void vc4_crtc_disable(struct drm_crtc *crtc, struct drm_crtc_state *old_state)
+{
+	/* Always turn the planes off on CRTC disable. In DRM, planes
+	 * are enabled/disabled through the update/disable hooks
+	 * above, and the CRTC enable/disable independently controls
+	 * whether anything scans out at all, but the firmware doesn't
+	 * give us a CRTC-level control for that.
+	 */
+	vc4_cursor_plane_atomic_disable(crtc->cursor, crtc->cursor->state);
+	vc4_plane_set_primary_blank(crtc->primary, true);
+}
+
+static void vc4_crtc_enable(struct drm_crtc *crtc, struct drm_crtc_state *old_state)
+{
+	/* Unblank the planes (if they're supposed to be displayed). */
+	if (crtc->primary->state->fb)
+		vc4_plane_set_primary_blank(crtc->primary, false);
+	if (crtc->cursor->state->fb) {
+		vc4_cursor_plane_atomic_update(crtc->cursor,
+					       crtc->cursor->state);
+	}
+}
+
+static int vc4_crtc_atomic_check(struct drm_crtc *crtc,
+				 struct drm_crtc_state *state)
+{
+	return 0;
+}
+
+static void vc4_crtc_atomic_flush(struct drm_crtc *crtc,
+				  struct drm_crtc_state *old_state)
+{
+	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+	struct drm_device *dev = crtc->dev;
+
+	if (crtc->state->event) {
+		unsigned long flags;
+
+		crtc->state->event->pipe = drm_crtc_index(crtc);
+
+		WARN_ON(drm_crtc_vblank_get(crtc) != 0);
+
+		spin_lock_irqsave(&dev->event_lock, flags);
+		vc4_crtc->event = crtc->state->event;
+		crtc->state->event = NULL;
+		spin_unlock_irqrestore(&dev->event_lock, flags);
+	}
+}
+
+static void vc4_crtc_handle_page_flip(struct vc4_crtc *vc4_crtc)
+{
+	struct drm_crtc *crtc = &vc4_crtc->base;
+	struct drm_device *dev = crtc->dev;
+	unsigned long flags;
+
+	spin_lock_irqsave(&dev->event_lock, flags);
+	if (vc4_crtc->event) {
+		drm_crtc_send_vblank_event(crtc, vc4_crtc->event);
+		vc4_crtc->event = NULL;
+		drm_crtc_vblank_put(crtc);
+	}
+	spin_unlock_irqrestore(&dev->event_lock, flags);
+}
+
+static irqreturn_t vc4_crtc_irq_handler(int irq, void *data)
+{
+	struct vc4_crtc *vc4_crtc = data;
+	u32 stat = readl(vc4_crtc->regs + SMICS);
+	irqreturn_t ret = IRQ_NONE;
+
+	if (stat & SMICS_INTERRUPTS) {
+		writel(0, vc4_crtc->regs + SMICS);
+		if (vc4_crtc->vblank_enabled)
+			drm_crtc_handle_vblank(&vc4_crtc->base);
+		vc4_crtc_handle_page_flip(vc4_crtc);
+		ret = IRQ_HANDLED;
+	}
+
+	return ret;
+}
+
+static int vc4_page_flip(struct drm_crtc *crtc,
+			 struct drm_framebuffer *fb,
+			 struct drm_pending_vblank_event *event,
+			 uint32_t flags, struct drm_modeset_acquire_ctx *ctx)
+{
+	if (flags & DRM_MODE_PAGE_FLIP_ASYNC) {
+		DRM_ERROR("Async flips aren't allowed\n");
+		return -EINVAL;
+	}
+
+	return drm_atomic_helper_page_flip(crtc, fb, event, flags, ctx);
+}
+
+static int vc4_fkms_enable_vblank(struct drm_crtc *crtc)
+{
+	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+
+	vc4_crtc->vblank_enabled = true;
+
+	return 0;
+}
+
+static void vc4_fkms_disable_vblank(struct drm_crtc *crtc)
+{
+}
+
+static const struct drm_crtc_funcs vc4_crtc_funcs = {
+	.set_config = drm_atomic_helper_set_config,
+	.destroy = drm_crtc_cleanup,
+	.page_flip = vc4_page_flip,
+	.set_property = NULL,
+	.cursor_set = NULL, /* handled by drm_mode_cursor_universal */
+	.cursor_move = NULL, /* handled by drm_mode_cursor_universal */
+	.reset = drm_atomic_helper_crtc_reset,
+	.atomic_duplicate_state = drm_atomic_helper_crtc_duplicate_state,
+	.atomic_destroy_state = drm_atomic_helper_crtc_destroy_state,
+	.enable_vblank = vc4_fkms_enable_vblank,
+	.disable_vblank = vc4_fkms_disable_vblank,
+};
+
+static const struct drm_crtc_helper_funcs vc4_crtc_helper_funcs = {
+	.mode_set_nofb = vc4_crtc_mode_set_nofb,
+	.atomic_disable = vc4_crtc_disable,
+	.atomic_enable = vc4_crtc_enable,
+	.atomic_check = vc4_crtc_atomic_check,
+	.atomic_flush = vc4_crtc_atomic_flush,
+};
+
+/* Frees the page flip event when the DRM device is closed with the
+ * event still outstanding.
+ */
+void vc4_fkms_cancel_page_flip(struct drm_crtc *crtc, struct drm_file *file)
+{
+	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+	struct drm_device *dev = crtc->dev;
+	unsigned long flags;
+
+	spin_lock_irqsave(&dev->event_lock, flags);
+
+	if (vc4_crtc->event && vc4_crtc->event->base.file_priv == file) {
+		kfree(&vc4_crtc->event->base);
+		drm_crtc_vblank_put(crtc);
+		vc4_crtc->event = NULL;
+	}
+
+	spin_unlock_irqrestore(&dev->event_lock, flags);
+}
+
+static const struct of_device_id vc4_firmware_kms_dt_match[] = {
+	{ .compatible = "raspberrypi,rpi-firmware-kms" },
+	{}
+};
+
+static enum drm_connector_status
+vc4_fkms_connector_detect(struct drm_connector *connector, bool force)
+{
+	return connector_status_connected;
+}
+
+static int vc4_fkms_connector_get_modes(struct drm_connector *connector)
+{
+	struct drm_device *dev = connector->dev;
+	struct vc4_dev *vc4 = to_vc4_dev(dev);
+	u32 wh[2] = {0, 0};
+	int ret;
+	struct drm_display_mode *mode;
+
+	ret = rpi_firmware_property(vc4->firmware,
+				    RPI_FIRMWARE_FRAMEBUFFER_GET_PHYSICAL_WIDTH_HEIGHT,
+				    &wh, sizeof(wh));
+	if (ret) {
+		DRM_ERROR("Failed to get screen size: %d (0x%08x 0x%08x)\n",
+			  ret, wh[0], wh[1]);
+		return 0;
+	}
+
+	mode = drm_cvt_mode(dev, wh[0], wh[1], 60 /* vrefresh */,
+			    0, 0, false);
+	drm_mode_probed_add(connector, mode);
+
+	return 1;
+}
+
+static struct drm_encoder *
+vc4_fkms_connector_best_encoder(struct drm_connector *connector)
+{
+	struct vc4_fkms_connector *fkms_connector =
+		to_vc4_fkms_connector(connector);
+	return fkms_connector->encoder;
+}
+
+static void vc4_fkms_connector_destroy(struct drm_connector *connector)
+{
+	drm_connector_unregister(connector);
+	drm_connector_cleanup(connector);
+}
+
+static const struct drm_connector_funcs vc4_fkms_connector_funcs = {
+	.detect = vc4_fkms_connector_detect,
+	.fill_modes = drm_helper_probe_single_connector_modes,
+	.destroy = vc4_fkms_connector_destroy,
+	.reset = drm_atomic_helper_connector_reset,
+	.atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
+	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+};
+
+static const struct drm_connector_helper_funcs vc4_fkms_connector_helper_funcs = {
+	.get_modes = vc4_fkms_connector_get_modes,
+	.best_encoder = vc4_fkms_connector_best_encoder,
+};
+
+static struct drm_connector *vc4_fkms_connector_init(struct drm_device *dev,
+						     struct drm_encoder *encoder)
+{
+	struct drm_connector *connector = NULL;
+	struct vc4_fkms_connector *fkms_connector;
+	int ret = 0;
+
+	fkms_connector = devm_kzalloc(dev->dev, sizeof(*fkms_connector),
+				      GFP_KERNEL);
+	if (!fkms_connector) {
+		ret = -ENOMEM;
+		goto fail;
+	}
+	connector = &fkms_connector->base;
+
+	fkms_connector->encoder = encoder;
+
+	drm_connector_init(dev, connector, &vc4_fkms_connector_funcs,
+			   DRM_MODE_CONNECTOR_HDMIA);
+	drm_connector_helper_add(connector, &vc4_fkms_connector_helper_funcs);
+
+	connector->polled = (DRM_CONNECTOR_POLL_CONNECT |
+			     DRM_CONNECTOR_POLL_DISCONNECT);
+
+	connector->interlace_allowed = 0;
+	connector->doublescan_allowed = 0;
+
+	drm_mode_connector_attach_encoder(connector, encoder);
+
+	return connector;
+
+ fail:
+	if (connector)
+		vc4_fkms_connector_destroy(connector);
+
+	return ERR_PTR(ret);
+}
+
+static void vc4_fkms_encoder_destroy(struct drm_encoder *encoder)
+{
+	drm_encoder_cleanup(encoder);
+}
+
+static const struct drm_encoder_funcs vc4_fkms_encoder_funcs = {
+	.destroy = vc4_fkms_encoder_destroy,
+};
+
+static void vc4_fkms_encoder_enable(struct drm_encoder *encoder)
+{
+}
+
+static void vc4_fkms_encoder_disable(struct drm_encoder *encoder)
+{
+}
+
+static const struct drm_encoder_helper_funcs vc4_fkms_encoder_helper_funcs = {
+	.enable = vc4_fkms_encoder_enable,
+	.disable = vc4_fkms_encoder_disable,
+};
+
+static int vc4_fkms_bind(struct device *dev, struct device *master, void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct drm_device *drm = dev_get_drvdata(master);
+	struct vc4_dev *vc4 = to_vc4_dev(drm);
+	struct vc4_crtc *vc4_crtc;
+	struct vc4_fkms_encoder *vc4_encoder;
+	struct drm_crtc *crtc;
+	struct drm_plane *primary_plane, *cursor_plane, *destroy_plane, *temp;
+	struct device_node *firmware_node;
+	int ret;
+
+	vc4->firmware_kms = true;
+
+	vc4_crtc = devm_kzalloc(dev, sizeof(*vc4_crtc), GFP_KERNEL);
+	if (!vc4_crtc)
+		return -ENOMEM;
+	crtc = &vc4_crtc->base;
+
+	firmware_node = of_parse_phandle(dev->of_node, "brcm,firmware", 0);
+	vc4->firmware = rpi_firmware_get(firmware_node);
+	if (!vc4->firmware) {
+		DRM_DEBUG("Failed to get Raspberry Pi firmware reference.\n");
+		return -EPROBE_DEFER;
+	}
+	of_node_put(firmware_node);
+
+	/* Map the SMI interrupt reg */
+	vc4_crtc->regs = vc4_ioremap_regs(pdev, 0);
+	if (IS_ERR(vc4_crtc->regs))
+		return PTR_ERR(vc4_crtc->regs);
+
+	/* For now, we create just the primary and the legacy cursor
+	 * planes.  We should be able to stack more planes on easily,
+	 * but to do that we would need to compute the bandwidth
+	 * requirement of the plane configuration, and reject ones
+	 * that will take too much.
+	 */
+	primary_plane = vc4_fkms_plane_init(drm, DRM_PLANE_TYPE_PRIMARY);
+	if (IS_ERR(primary_plane)) {
+		dev_err(dev, "failed to construct primary plane\n");
+		ret = PTR_ERR(primary_plane);
+		goto err;
+	}
+
+	cursor_plane = vc4_fkms_plane_init(drm, DRM_PLANE_TYPE_CURSOR);
+	if (IS_ERR(cursor_plane)) {
+		dev_err(dev, "failed to construct cursor plane\n");
+		ret = PTR_ERR(cursor_plane);
+		goto err;
+	}
+
+	drm_crtc_init_with_planes(drm, crtc, primary_plane, cursor_plane,
+				  &vc4_crtc_funcs, NULL);
+	drm_crtc_helper_add(crtc, &vc4_crtc_helper_funcs);
+	primary_plane->crtc = crtc;
+	cursor_plane->crtc = crtc;
+
+	vc4_encoder = devm_kzalloc(dev, sizeof(*vc4_encoder), GFP_KERNEL);
+	if (!vc4_encoder)
+		return -ENOMEM;
+	vc4_crtc->encoder = &vc4_encoder->base;
+	vc4_encoder->base.possible_crtcs |= drm_crtc_mask(crtc) ;
+	drm_encoder_init(drm, &vc4_encoder->base, &vc4_fkms_encoder_funcs,
+			 DRM_MODE_ENCODER_TMDS, NULL);
+	drm_encoder_helper_add(&vc4_encoder->base,
+			       &vc4_fkms_encoder_helper_funcs);
+
+	vc4_crtc->connector = vc4_fkms_connector_init(drm, &vc4_encoder->base);
+	if (IS_ERR(vc4_crtc->connector)) {
+		ret = PTR_ERR(vc4_crtc->connector);
+		goto err_destroy_encoder;
+	}
+
+	writel(0, vc4_crtc->regs + SMICS);
+	ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
+			       vc4_crtc_irq_handler, 0, "vc4 firmware kms",
+			       vc4_crtc);
+	if (ret)
+		goto err_destroy_connector;
+
+	ret = rpi_firmware_property(vc4->firmware,
+				    RPI_FIRMWARE_FRAMEBUFFER_GET_OVERSCAN,
+				    &vc4_crtc->overscan,
+				    sizeof(vc4_crtc->overscan));
+	if (ret) {
+		DRM_ERROR("Failed to get overscan state: 0x%08x\n", vc4_crtc->overscan[0]);
+		memset(&vc4_crtc->overscan, 0, sizeof(vc4_crtc->overscan));
+	}
+
+	platform_set_drvdata(pdev, vc4_crtc);
+
+	return 0;
+
+err_destroy_connector:
+	vc4_fkms_connector_destroy(vc4_crtc->connector);
+err_destroy_encoder:
+	vc4_fkms_encoder_destroy(vc4_crtc->encoder);
+	list_for_each_entry_safe(destroy_plane, temp,
+				 &drm->mode_config.plane_list, head) {
+		if (destroy_plane->possible_crtcs == 1 << drm_crtc_index(crtc))
+		    destroy_plane->funcs->destroy(destroy_plane);
+	}
+err:
+	return ret;
+}
+
+static void vc4_fkms_unbind(struct device *dev, struct device *master,
+			    void *data)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct vc4_crtc *vc4_crtc = dev_get_drvdata(dev);
+
+	vc4_fkms_connector_destroy(vc4_crtc->connector);
+	vc4_fkms_encoder_destroy(vc4_crtc->encoder);
+	drm_crtc_cleanup(&vc4_crtc->base);
+
+	platform_set_drvdata(pdev, NULL);
+}
+
+static const struct component_ops vc4_fkms_ops = {
+	.bind   = vc4_fkms_bind,
+	.unbind = vc4_fkms_unbind,
+};
+
+static int vc4_fkms_probe(struct platform_device *pdev)
+{
+	return component_add(&pdev->dev, &vc4_fkms_ops);
+}
+
+static int vc4_fkms_remove(struct platform_device *pdev)
+{
+	component_del(&pdev->dev, &vc4_fkms_ops);
+	return 0;
+}
+
+struct platform_driver vc4_firmware_kms_driver = {
+	.probe = vc4_fkms_probe,
+	.remove = vc4_fkms_remove,
+	.driver = {
+		.name = "vc4_firmware_kms",
+		.of_match_table = vc4_firmware_kms_dt_match,
+	},
+};
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
index d31b3d0c9955..c94cce96544c 100644
--- a/drivers/gpu/drm/vc4/vc4_gem.c
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
@@ -188,11 +188,22 @@ vc4_save_hang_state(struct drm_device *dev)
 			continue;
 
 		for (j = 0; j < exec[i]->bo_count; j++) {
+			bo = to_vc4_bo(&exec[i]->bo[j]->base);
+
+			/* Retain BOs just in case they were marked purgeable.
+			 * This prevents the BO from being purged before
+			 * someone had a chance to dump the hang state.
+			 */
+			WARN_ON(!refcount_read(&bo->usecnt));
+			refcount_inc(&bo->usecnt);
 			drm_gem_object_get(&exec[i]->bo[j]->base);
 			kernel_state->bo[k++] = &exec[i]->bo[j]->base;
 		}
 
 		list_for_each_entry(bo, &exec[i]->unref_list, unref_head) {
+			/* No need to retain BOs coming from the ->unref_list
+			 * because they are naturally unpurgeable.
+			 */
 			drm_gem_object_get(&bo->base.base);
 			kernel_state->bo[k++] = &bo->base.base;
 		}
@@ -233,6 +244,26 @@ vc4_save_hang_state(struct drm_device *dev)
 	state->fdbgs = V3D_READ(V3D_FDBGS);
 	state->errstat = V3D_READ(V3D_ERRSTAT);
 
+	/* We need to turn purgeable BOs into unpurgeable ones so that
+	 * userspace has a chance to dump the hang state before the kernel
+	 * decides to purge those BOs.
+	 * Note that BO consistency at dump time cannot be guaranteed. For
+	 * example, if the owner of these BOs decides to re-use them or mark
+	 * them purgeable again there's nothing we can do to prevent it.
+	 */
+	for (i = 0; i < kernel_state->user_state.bo_count; i++) {
+		struct vc4_bo *bo = to_vc4_bo(kernel_state->bo[i]);
+
+		if (bo->madv == __VC4_MADV_NOTSUPP)
+			continue;
+
+		mutex_lock(&bo->madv_lock);
+		if (!WARN_ON(bo->madv == __VC4_MADV_PURGED))
+			bo->madv = VC4_MADV_WILLNEED;
+		refcount_dec(&bo->usecnt);
+		mutex_unlock(&bo->madv_lock);
+	}
+
 	spin_lock_irqsave(&vc4->job_lock, irqflags);
 	if (vc4->hang_state) {
 		spin_unlock_irqrestore(&vc4->job_lock, irqflags);
@@ -281,10 +312,10 @@ vc4_reset_work(struct work_struct *work)
 }
 
 static void
-vc4_hangcheck_elapsed(unsigned long data)
+vc4_hangcheck_elapsed(struct timer_list *t)
 {
-	struct drm_device *dev = (struct drm_device *)data;
-	struct vc4_dev *vc4 = to_vc4_dev(dev);
+	struct vc4_dev *vc4 = from_timer(vc4, t, hangcheck.timer);
+	struct drm_device *dev = vc4->dev;
 	uint32_t ct0ca, ct1ca;
 	unsigned long irqflags;
 	struct vc4_exec_info *bin_exec, *render_exec;
@@ -405,6 +436,19 @@ vc4_flush_caches(struct drm_device *dev)
 		  VC4_SET_FIELD(0xf, V3D_SLCACTL_ICC));
 }
 
+static void
+vc4_flush_texture_caches(struct drm_device *dev)
+{
+	struct vc4_dev *vc4 = to_vc4_dev(dev);
+
+	V3D_WRITE(V3D_L2CACTL,
+		  V3D_L2CACTL_L2CCLR);
+
+	V3D_WRITE(V3D_SLCACTL,
+		  VC4_SET_FIELD(0xf, V3D_SLCACTL_T1CC) |
+		  VC4_SET_FIELD(0xf, V3D_SLCACTL_T0CC));
+}
+
 /* Sets the registers for the next job to be actually be executed in
  * the hardware.
  *
@@ -443,6 +487,14 @@ vc4_submit_next_render_job(struct drm_device *dev)
 	if (!exec)
 		return;
 
+	/* A previous RCL may have written to one of our textures, and
+	 * our full cache flush at bin time may have occurred before
+	 * that RCL completed.  Flush the texture cache now, but not
+	 * the instructions or uniforms (since we don't write those
+	 * from an RCL).
+	 */
+	vc4_flush_texture_caches(dev);
+
 	submit_cl(dev, 1, exec->ct1ca, exec->ct1ea);
 }
 
@@ -639,9 +691,6 @@ vc4_queue_submit(struct drm_device *dev, struct vc4_exec_info *exec,
  * The command validator needs to reference BOs by their index within
  * the submitted job's BO list.  This does the validation of the job's
  * BO list and reference counting for the lifetime of the job.
- *
- * Note that this function doesn't need to unreference the BOs on
- * failure, because that will happen at vc4_complete_exec() time.
  */
 static int
 vc4_cl_lookup_bos(struct drm_device *dev,
@@ -693,16 +742,47 @@ vc4_cl_lookup_bos(struct drm_device *dev,
 			DRM_DEBUG("Failed to look up GEM BO %d: %d\n",
 				  i, handles[i]);
 			ret = -EINVAL;
-			spin_unlock(&file_priv->table_lock);
-			goto fail;
+			break;
 		}
+
 		drm_gem_object_get(bo);
 		exec->bo[i] = (struct drm_gem_cma_object *)bo;
 	}
 	spin_unlock(&file_priv->table_lock);
 
+	if (ret)
+		goto fail_put_bo;
+
+	for (i = 0; i < exec->bo_count; i++) {
+		ret = vc4_bo_inc_usecnt(to_vc4_bo(&exec->bo[i]->base));
+		if (ret)
+			goto fail_dec_usecnt;
+	}
+
+	kvfree(handles);
+	return 0;
+
+fail_dec_usecnt:
+	/* Decrease usecnt on acquired objects.
+	 * We cannot rely on  vc4_complete_exec() to release resources here,
+	 * because vc4_complete_exec() has no information about which BO has
+	 * had its ->usecnt incremented.
+	 * To make things easier we just free everything explicitly and set
+	 * exec->bo to NULL so that vc4_complete_exec() skips the 'BO release'
+	 * step.
+	 */
+	for (i-- ; i >= 0; i--)
+		vc4_bo_dec_usecnt(to_vc4_bo(&exec->bo[i]->base));
+
+fail_put_bo:
+	/* Release any reference to acquired objects. */
+	for (i = 0; i < exec->bo_count && exec->bo[i]; i++)
+		drm_gem_object_put_unlocked(&exec->bo[i]->base);
+
 fail:
 	kvfree(handles);
+	kvfree(exec->bo);
+	exec->bo = NULL;
 	return ret;
 }
 
@@ -835,8 +915,12 @@ vc4_complete_exec(struct drm_device *dev, struct vc4_exec_info *exec)
 	}
 
 	if (exec->bo) {
-		for (i = 0; i < exec->bo_count; i++)
+		for (i = 0; i < exec->bo_count; i++) {
+			struct vc4_bo *bo = to_vc4_bo(&exec->bo[i]->base);
+
+			vc4_bo_dec_usecnt(bo);
 			drm_gem_object_put_unlocked(&exec->bo[i]->base);
+		}
 		kvfree(exec->bo);
 	}
 
@@ -1093,13 +1177,14 @@ vc4_gem_init(struct drm_device *dev)
 	spin_lock_init(&vc4->job_lock);
 
 	INIT_WORK(&vc4->hangcheck.reset_work, vc4_reset_work);
-	setup_timer(&vc4->hangcheck.timer,
-		    vc4_hangcheck_elapsed,
-		    (unsigned long)dev);
+	timer_setup(&vc4->hangcheck.timer, vc4_hangcheck_elapsed, 0);
 
 	INIT_WORK(&vc4->job_done_work, vc4_job_done_work);
 
 	mutex_init(&vc4->power_lock);
+
+	INIT_LIST_HEAD(&vc4->purgeable.list);
+	mutex_init(&vc4->purgeable.lock);
 }
 
 void
@@ -1123,3 +1208,81 @@ vc4_gem_destroy(struct drm_device *dev)
 	if (vc4->hang_state)
 		vc4_free_hang_state(dev, vc4->hang_state);
 }
+
+int vc4_gem_madvise_ioctl(struct drm_device *dev, void *data,
+			  struct drm_file *file_priv)
+{
+	struct drm_vc4_gem_madvise *args = data;
+	struct drm_gem_object *gem_obj;
+	struct vc4_bo *bo;
+	int ret;
+
+	switch (args->madv) {
+	case VC4_MADV_DONTNEED:
+	case VC4_MADV_WILLNEED:
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (args->pad != 0)
+		return -EINVAL;
+
+	gem_obj = drm_gem_object_lookup(file_priv, args->handle);
+	if (!gem_obj) {
+		DRM_DEBUG("Failed to look up GEM BO %d\n", args->handle);
+		return -ENOENT;
+	}
+
+	bo = to_vc4_bo(gem_obj);
+
+	/* Only BOs exposed to userspace can be purged. */
+	if (bo->madv == __VC4_MADV_NOTSUPP) {
+		DRM_DEBUG("madvise not supported on this BO\n");
+		ret = -EINVAL;
+		goto out_put_gem;
+	}
+
+	/* Not sure it's safe to purge imported BOs. Let's just assume it's
+	 * not until proven otherwise.
+	 */
+	if (gem_obj->import_attach) {
+		DRM_DEBUG("madvise not supported on imported BOs\n");
+		ret = -EINVAL;
+		goto out_put_gem;
+	}
+
+	mutex_lock(&bo->madv_lock);
+
+	if (args->madv == VC4_MADV_DONTNEED && bo->madv == VC4_MADV_WILLNEED &&
+	    !refcount_read(&bo->usecnt)) {
+		/* If the BO is about to be marked as purgeable, is not used
+		 * and is not already purgeable or purged, add it to the
+		 * purgeable list.
+		 */
+		vc4_bo_add_to_purgeable_pool(bo);
+	} else if (args->madv == VC4_MADV_WILLNEED &&
+		   bo->madv == VC4_MADV_DONTNEED &&
+		   !refcount_read(&bo->usecnt)) {
+		/* The BO has not been purged yet, just remove it from
+		 * the purgeable list.
+		 */
+		vc4_bo_remove_from_purgeable_pool(bo);
+	}
+
+	/* Save the purged state. */
+	args->retained = bo->madv != __VC4_MADV_PURGED;
+
+	/* Update internal madv state only if the bo was not purged. */
+	if (bo->madv != __VC4_MADV_PURGED)
+		bo->madv = args->madv;
+
+	mutex_unlock(&bo->madv_lock);
+
+	ret = 0;
+
+out_put_gem:
+	drm_gem_object_put_unlocked(gem_obj);
+
+	return ret;
+}
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index 8f71157a2b06..54fe4ceb1c3e 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -309,16 +309,13 @@ static const struct drm_connector_helper_funcs vc4_hdmi_connector_helper_funcs =
 static struct drm_connector *vc4_hdmi_connector_init(struct drm_device *dev,
 						     struct drm_encoder *encoder)
 {
-	struct drm_connector *connector = NULL;
+	struct drm_connector *connector;
 	struct vc4_hdmi_connector *hdmi_connector;
-	int ret = 0;
 
 	hdmi_connector = devm_kzalloc(dev->dev, sizeof(*hdmi_connector),
 				      GFP_KERNEL);
-	if (!hdmi_connector) {
-		ret = -ENOMEM;
-		goto fail;
-	}
+	if (!hdmi_connector)
+		return ERR_PTR(-ENOMEM);
 	connector = &hdmi_connector->base;
 
 	hdmi_connector->encoder = encoder;
@@ -336,12 +333,6 @@ static struct drm_connector *vc4_hdmi_connector_init(struct drm_device *dev,
 	drm_mode_connector_attach_encoder(connector, encoder);
 
 	return connector;
-
- fail:
-	if (connector)
-		vc4_hdmi_connector_destroy(connector);
-
-	return ERR_PTR(ret);
 }
 
 static void vc4_hdmi_encoder_destroy(struct drm_encoder *encoder)
@@ -704,7 +695,22 @@ static void vc4_hdmi_encoder_enable(struct drm_encoder *encoder)
 	}
 }
 
+static enum drm_mode_status
+vc4_hdmi_encoder_mode_valid(struct drm_encoder *crtc,
+			    const struct drm_display_mode *mode)
+{
+	/* HSM clock must be 108% of the pixel clock.  Additionally,
+	 * the AXI clock needs to be at least 25% of pixel clock, but
+	 * HSM ends up being the limiting factor.
+	 */
+	if (mode->clock > HSM_CLOCK_FREQ / (1000 * 108 / 100))
+		return MODE_CLOCK_HIGH;
+
+	return MODE_OK;
+}
+
 static const struct drm_encoder_helper_funcs vc4_hdmi_encoder_helper_funcs = {
+	.mode_valid = vc4_hdmi_encoder_mode_valid,
 	.disable = vc4_hdmi_encoder_disable,
 	.enable = vc4_hdmi_encoder_enable,
 };
@@ -1124,7 +1130,7 @@ static int vc4_hdmi_audio_init(struct vc4_hdmi *hdmi)
 	 * snd_soc_card_get_drvdata() if needed.
 	 */
 	snd_soc_card_set_drvdata(card, hdmi);
-	ret = devm_snd_soc_register_card(dev, card);
+	ret = snd_soc_register_card(card);
 	if (ret) {
 		dev_err(dev, "Could not register sound card: %d\n", ret);
 		goto unregister_codec;
@@ -1141,13 +1147,16 @@ static int vc4_hdmi_audio_init(struct vc4_hdmi *hdmi)
 static void vc4_hdmi_audio_cleanup(struct vc4_hdmi *hdmi)
 {
 	struct device *dev = &hdmi->pdev->dev;
+	struct snd_soc_card *card = &hdmi->audio.card;
 
 	/*
 	 * If drvdata is not set this means the audio card was not
 	 * registered, just skip codec unregistration in this case.
 	 */
-	if (dev_get_drvdata(dev))
+	if (dev_get_drvdata(dev)) {
+		snd_soc_unregister_card(card);
 		snd_soc_unregister_codec(dev);
+	}
 }
 
 #ifdef CONFIG_DRM_VC4_HDMI_CEC
diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
index 50c4959b5bd3..f73343e08fe6 100644
--- a/drivers/gpu/drm/vc4/vc4_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_kms.c
@@ -53,7 +53,8 @@ vc4_atomic_complete_commit(struct drm_atomic_state *state)
 	 * display lists before we free it and potentially reallocate
 	 * and overwrite the dlist memory with a new modeset.
 	 */
-	state->legacy_cursor_update = false;
+	if (!vc4->firmware_kms)
+		state->legacy_cursor_update = false;
 
 	drm_atomic_helper_commit_hw_done(state);
 
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index 77c56264c05b..bda52f8ffb91 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -23,6 +23,7 @@
 #include <drm/drm_fb_cma_helper.h>
 #include <drm/drm_plane_helper.h>
 
+#include "uapi/drm/vc4_drm.h"
 #include "vc4_drv.h"
 #include "vc4_regs.h"
 
@@ -85,7 +86,6 @@ static const struct hvs_format {
 	u32 hvs; /* HVS_FORMAT_* */
 	u32 pixel_order;
 	bool has_alpha;
-	bool flip_cbcr;
 } hvs_formats[] = {
 	{
 		.drm = DRM_FORMAT_XRGB8888, .hvs = HVS_PIXEL_FORMAT_RGBA8888,
@@ -119,31 +119,53 @@ static const struct hvs_format {
 		.drm = DRM_FORMAT_XRGB1555, .hvs = HVS_PIXEL_FORMAT_RGBA5551,
 		.pixel_order = HVS_PIXEL_ORDER_ABGR, .has_alpha = false,
 	},
+	{
+		.drm = DRM_FORMAT_RGB888, .hvs = HVS_PIXEL_FORMAT_RGB888,
+		.pixel_order = HVS_PIXEL_ORDER_XRGB, .has_alpha = false,
+	},
+	{
+		.drm = DRM_FORMAT_BGR888, .hvs = HVS_PIXEL_FORMAT_RGB888,
+		.pixel_order = HVS_PIXEL_ORDER_XBGR, .has_alpha = false,
+	},
 	{
 		.drm = DRM_FORMAT_YUV422,
 		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV422_3PLANE,
+		.pixel_order = HVS_PIXEL_ORDER_XYCBCR,
 	},
 	{
 		.drm = DRM_FORMAT_YVU422,
 		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV422_3PLANE,
-		.flip_cbcr = true,
+		.pixel_order = HVS_PIXEL_ORDER_XYCRCB,
 	},
 	{
 		.drm = DRM_FORMAT_YUV420,
 		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV420_3PLANE,
+		.pixel_order = HVS_PIXEL_ORDER_XYCBCR,
 	},
 	{
 		.drm = DRM_FORMAT_YVU420,
 		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV420_3PLANE,
-		.flip_cbcr = true,
+		.pixel_order = HVS_PIXEL_ORDER_XYCRCB,
 	},
 	{
 		.drm = DRM_FORMAT_NV12,
 		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV420_2PLANE,
+		.pixel_order = HVS_PIXEL_ORDER_XYCBCR,
+	},
+	{
+		.drm = DRM_FORMAT_NV21,
+		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV420_2PLANE,
+		.pixel_order = HVS_PIXEL_ORDER_XYCRCB,
 	},
 	{
 		.drm = DRM_FORMAT_NV16,
 		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV422_2PLANE,
+		.pixel_order = HVS_PIXEL_ORDER_XYCBCR,
+	},
+	{
+		.drm = DRM_FORMAT_NV61,
+		.hvs = HVS_PIXEL_FORMAT_YCBCR_YUV422_2PLANE,
+		.pixel_order = HVS_PIXEL_ORDER_XYCRCB,
 	},
 };
 
@@ -547,14 +569,24 @@ static int vc4_plane_mode_set(struct drm_plane *plane,
 		tiling = SCALER_CTL0_TILING_LINEAR;
 		pitch0 = VC4_SET_FIELD(fb->pitches[0], SCALER_SRC_PITCH);
 		break;
-	case DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED:
+
+	case DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED: {
+		/* For T-tiled, the FB pitch is "how many bytes from
+		 * one row to the next, such that pitch * tile_h ==
+		 * tile_size * tiles_per_row."
+		 */
+		u32 tile_size_shift = 12;
+		u32 tile_h_shift = 5;
+		u32 tiles_w = fb->pitches[0] >> (tile_size_shift - tile_h_shift);
+
 		tiling = SCALER_CTL0_TILING_256B_OR_T;
 
-		pitch0 = (VC4_SET_FIELD(0, SCALER_PITCH0_TILE_Y_OFFSET),
-			  VC4_SET_FIELD(0, SCALER_PITCH0_TILE_WIDTH_L),
-			  VC4_SET_FIELD((vc4_state->src_w[0] + 31) >> 5,
-					SCALER_PITCH0_TILE_WIDTH_R));
+		pitch0 = (VC4_SET_FIELD(0, SCALER_PITCH0_TILE_Y_OFFSET) |
+			  VC4_SET_FIELD(0, SCALER_PITCH0_TILE_WIDTH_L) |
+			  VC4_SET_FIELD(tiles_w, SCALER_PITCH0_TILE_WIDTH_R));
 		break;
+	}
+
 	default:
 		DRM_DEBUG_KMS("Unsupported FB tiling flag 0x%16llx",
 			      (long long)fb->modifier);
@@ -606,15 +638,8 @@ static int vc4_plane_mode_set(struct drm_plane *plane,
 	 * The pointers may be any byte address.
 	 */
 	vc4_state->ptr0_offset = vc4_state->dlist_count;
-	if (!format->flip_cbcr) {
-		for (i = 0; i < num_planes; i++)
-			vc4_dlist_write(vc4_state, vc4_state->offsets[i]);
-	} else {
-		WARN_ON_ONCE(num_planes != 3);
-		vc4_dlist_write(vc4_state, vc4_state->offsets[0]);
-		vc4_dlist_write(vc4_state, vc4_state->offsets[2]);
-		vc4_dlist_write(vc4_state, vc4_state->offsets[1]);
-	}
+	for (i = 0; i < num_planes; i++)
+		vc4_dlist_write(vc4_state, vc4_state->offsets[i]);
 
 	/* Pointer Context Word 0/1/2: Written by the HVS */
 	for (i = 0; i < num_planes; i++)
@@ -764,21 +789,40 @@ static int vc4_prepare_fb(struct drm_plane *plane,
 {
 	struct vc4_bo *bo;
 	struct dma_fence *fence;
+	int ret;
 
 	if ((plane->state->fb == state->fb) || !state->fb)
 		return 0;
 
 	bo = to_vc4_bo(&drm_fb_cma_get_gem_obj(state->fb, 0)->base);
+
+	ret = vc4_bo_inc_usecnt(bo);
+	if (ret)
+		return ret;
+
 	fence = reservation_object_get_excl_rcu(bo->resv);
 	drm_atomic_set_fence_for_plane(state, fence);
 
 	return 0;
 }
 
+static void vc4_cleanup_fb(struct drm_plane *plane,
+			   struct drm_plane_state *state)
+{
+	struct vc4_bo *bo;
+
+	if (plane->state->fb == state->fb || !state->fb)
+		return;
+
+	bo = to_vc4_bo(&drm_fb_cma_get_gem_obj(state->fb, 0)->base);
+	vc4_bo_dec_usecnt(bo);
+}
+
 static const struct drm_plane_helper_funcs vc4_plane_helper_funcs = {
 	.atomic_check = vc4_plane_atomic_check,
 	.atomic_update = vc4_plane_atomic_update,
 	.prepare_fb = vc4_prepare_fb,
+	.cleanup_fb = vc4_cleanup_fb,
 };
 
 static void vc4_plane_destroy(struct drm_plane *plane)
diff --git a/drivers/gpu/drm/vc4/vc4_trace.h b/drivers/gpu/drm/vc4/vc4_trace.h
index ad7b1ea720c2..deafb32923e1 100644
--- a/drivers/gpu/drm/vc4/vc4_trace.h
+++ b/drivers/gpu/drm/vc4/vc4_trace.h
@@ -59,5 +59,5 @@ TRACE_EVENT(vc4_wait_for_seqno_end,
 
 /* This part must be outside protection */
 #undef TRACE_INCLUDE_PATH
-#define TRACE_INCLUDE_PATH .
+#define TRACE_INCLUDE_PATH ../../drivers/gpu/drm/vc4
 #include <trace/define_trace.h>
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 045b5da9b992..45abcbab4efe 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -48,7 +48,7 @@
  * Module parameters.
  */
 
-static unsigned int hid_mousepoll_interval;
+static unsigned int hid_mousepoll_interval = ~0;
 module_param_named(mousepoll, hid_mousepoll_interval, uint, 0644);
 MODULE_PARM_DESC(mousepoll, "Polling interval of mice");
 
@@ -1098,7 +1098,9 @@ static int usbhid_start(struct hid_device *hid)
 		/* Change the polling interval of mice and joysticks. */
 		switch (hid->collection->usage) {
 		case HID_GD_MOUSE:
-			if (hid_mousepoll_interval > 0)
+			if (hid_mousepoll_interval == ~0 && interval < 16)
+				interval = 16;
+			else if (hid_mousepoll_interval != ~0 && hid_mousepoll_interval != 0)
 				interval = hid_mousepoll_interval;
 			break;
 		case HID_GD_JOYSTICK:
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 45a3f3ca29b3..9dbd9e7619f4 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -8,6 +8,25 @@ menu "I2C Hardware Bus support"
 comment "PC SMBus host controller drivers"
 	depends on PCI
 
+config I2C_BCM2708
+	tristate "BCM2708 BSC"
+	depends on ARCH_BCM2835
+	help
+	  Enabling this option will add BSC (Broadcom Serial Controller)
+	  support for the BCM2708. BSC is a Broadcom proprietary bus compatible
+	  with I2C/TWI/SMBus.
+
+config I2C_BCM2708_BAUDRATE
+	prompt "BCM2708 I2C baudrate"
+	depends on I2C_BCM2708
+	int
+	default 100000
+	help
+	  Set the I2C baudrate. This will alter the default value. A
+	  different baudrate can be set by using a module parameter as well. If
+	  no parameter is provided when loading, this is the value that will be
+	  used.
+
 config I2C_ALI1535
 	tristate "ALI 1535"
 	depends on PCI
diff --git a/drivers/i2c/busses/Makefile b/drivers/i2c/busses/Makefile
index 2ce8576540a2..5e4896e973bb 100644
--- a/drivers/i2c/busses/Makefile
+++ b/drivers/i2c/busses/Makefile
@@ -3,6 +3,8 @@
 # Makefile for the i2c bus drivers.
 #
 
+obj-$(CONFIG_I2C_BCM2708)	+= i2c-bcm2708.o
+
 # ACPI drivers
 obj-$(CONFIG_I2C_SCMI)		+= i2c-scmi.o
 
diff --git a/drivers/i2c/busses/i2c-bcm2708.c b/drivers/i2c/busses/i2c-bcm2708.c
new file mode 100644
index 000000000000..962f2e5c7455
--- /dev/null
+++ b/drivers/i2c/busses/i2c-bcm2708.c
@@ -0,0 +1,512 @@
+/*
+ * Driver for Broadcom BCM2708 BSC Controllers
+ *
+ * Copyright (C) 2012 Chris Boot & Frank Buss
+ *
+ * This driver is inspired by:
+ * i2c-ocores.c, by Peter Korsgaard <jacmet@sunsite.dk>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/spinlock.h>
+#include <linux/clk.h>
+#include <linux/err.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/interrupt.h>
+#include <linux/sched.h>
+#include <linux/wait.h>
+
+/* BSC register offsets */
+#define BSC_C			0x00
+#define BSC_S			0x04
+#define BSC_DLEN		0x08
+#define BSC_A			0x0c
+#define BSC_FIFO		0x10
+#define BSC_DIV			0x14
+#define BSC_DEL			0x18
+#define BSC_CLKT		0x1c
+
+/* Bitfields in BSC_C */
+#define BSC_C_I2CEN		0x00008000
+#define BSC_C_INTR		0x00000400
+#define BSC_C_INTT		0x00000200
+#define BSC_C_INTD		0x00000100
+#define BSC_C_ST		0x00000080
+#define BSC_C_CLEAR_1		0x00000020
+#define BSC_C_CLEAR_2		0x00000010
+#define BSC_C_READ		0x00000001
+
+/* Bitfields in BSC_S */
+#define BSC_S_CLKT		0x00000200
+#define BSC_S_ERR		0x00000100
+#define BSC_S_RXF		0x00000080
+#define BSC_S_TXE		0x00000040
+#define BSC_S_RXD		0x00000020
+#define BSC_S_TXD		0x00000010
+#define BSC_S_RXR		0x00000008
+#define BSC_S_TXW		0x00000004
+#define BSC_S_DONE		0x00000002
+#define BSC_S_TA		0x00000001
+
+#define I2C_WAIT_LOOP_COUNT	200
+
+#define DRV_NAME		"bcm2708_i2c"
+
+static unsigned int baudrate;
+module_param(baudrate, uint, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
+MODULE_PARM_DESC(baudrate, "The I2C baudrate");
+
+static bool combined = false;
+module_param(combined, bool, 0644);
+MODULE_PARM_DESC(combined, "Use combined transactions");
+
+struct bcm2708_i2c {
+	struct i2c_adapter adapter;
+
+	spinlock_t lock;
+	void __iomem *base;
+	int irq;
+	struct clk *clk;
+	u32 cdiv;
+	u32 clk_tout;
+
+	struct completion done;
+
+	struct i2c_msg *msg;
+	int pos;
+	int nmsgs;
+	bool error;
+};
+
+static inline u32 bcm2708_rd(struct bcm2708_i2c *bi, unsigned reg)
+{
+	return readl(bi->base + reg);
+}
+
+static inline void bcm2708_wr(struct bcm2708_i2c *bi, unsigned reg, u32 val)
+{
+	writel(val, bi->base + reg);
+}
+
+static inline void bcm2708_bsc_reset(struct bcm2708_i2c *bi)
+{
+	bcm2708_wr(bi, BSC_C, 0);
+	bcm2708_wr(bi, BSC_S, BSC_S_CLKT | BSC_S_ERR | BSC_S_DONE);
+}
+
+static inline void bcm2708_bsc_fifo_drain(struct bcm2708_i2c *bi)
+{
+	while ((bi->pos < bi->msg->len) && (bcm2708_rd(bi, BSC_S) & BSC_S_RXD))
+		bi->msg->buf[bi->pos++] = bcm2708_rd(bi, BSC_FIFO);
+}
+
+static inline void bcm2708_bsc_fifo_fill(struct bcm2708_i2c *bi)
+{
+	while ((bi->pos < bi->msg->len) && (bcm2708_rd(bi, BSC_S) & BSC_S_TXD))
+		bcm2708_wr(bi, BSC_FIFO, bi->msg->buf[bi->pos++]);
+}
+
+static inline int bcm2708_bsc_setup(struct bcm2708_i2c *bi)
+{
+	u32 cdiv, s, clk_tout;
+	u32 c = BSC_C_I2CEN | BSC_C_INTD | BSC_C_ST | BSC_C_CLEAR_1;
+	int wait_loops = I2C_WAIT_LOOP_COUNT;
+
+	/* Can't call clk_get_rate as it locks a mutex and here we are spinlocked.
+	 * Use the value that we cached in the probe.
+	 */
+	cdiv = bi->cdiv;
+	clk_tout = bi->clk_tout;
+
+	if (bi->msg->flags & I2C_M_RD)
+		c |= BSC_C_INTR | BSC_C_READ;
+	else
+		c |= BSC_C_INTT;
+
+	bcm2708_wr(bi, BSC_CLKT, clk_tout);
+	bcm2708_wr(bi, BSC_DIV, cdiv);
+	bcm2708_wr(bi, BSC_A, bi->msg->addr);
+	bcm2708_wr(bi, BSC_DLEN, bi->msg->len);
+	if (combined)
+	{
+		/* Do the next two messages meet combined transaction criteria?
+		   - Current message is a write, next message is a read
+		   - Both messages to same slave address
+		   - Write message can fit inside FIFO (16 bytes or less) */
+		if ( (bi->nmsgs > 1) &&
+			!(bi->msg[0].flags & I2C_M_RD) && (bi->msg[1].flags & I2C_M_RD) &&
+			 (bi->msg[0].addr == bi->msg[1].addr) && (bi->msg[0].len <= 16)) {
+
+			/* Clear FIFO */
+			bcm2708_wr(bi, BSC_C, BSC_C_CLEAR_1);
+
+			/* Fill FIFO with entire write message (16 byte FIFO) */
+			while (bi->pos < bi->msg->len) {
+				bcm2708_wr(bi, BSC_FIFO, bi->msg->buf[bi->pos++]);
+			}
+			/* Start write transfer (no interrupts, don't clear FIFO) */
+			bcm2708_wr(bi, BSC_C, BSC_C_I2CEN | BSC_C_ST);
+
+			/* poll for transfer start bit (should only take 1-20 polls) */
+			do {
+				s = bcm2708_rd(bi, BSC_S);
+			} while (!(s & (BSC_S_TA | BSC_S_ERR | BSC_S_CLKT | BSC_S_DONE)) && --wait_loops >= 0);
+
+			/* did we time out or some error occured? */
+			if (wait_loops < 0 || (s & (BSC_S_ERR | BSC_S_CLKT))) {
+				return -1;
+			}
+
+			/* Send next read message before the write transfer finishes. */
+			bi->nmsgs--;
+			bi->msg++;
+			bi->pos = 0;
+			bcm2708_wr(bi, BSC_DLEN, bi->msg->len);
+			c = BSC_C_I2CEN | BSC_C_INTD | BSC_C_INTR | BSC_C_ST | BSC_C_READ;
+		}
+	}
+	bcm2708_wr(bi, BSC_C, c);
+
+	return 0;
+}
+
+static irqreturn_t bcm2708_i2c_interrupt(int irq, void *dev_id)
+{
+	struct bcm2708_i2c *bi = dev_id;
+	bool handled = true;
+	u32 s;
+	int ret;
+
+	spin_lock(&bi->lock);
+
+	/* we may see camera interrupts on the "other" I2C channel
+		   Just return if we've not sent anything */
+	if (!bi->nmsgs || !bi->msg) {
+		goto early_exit;
+	}
+
+	s = bcm2708_rd(bi, BSC_S);
+
+	if (s & (BSC_S_CLKT | BSC_S_ERR)) {
+		bcm2708_bsc_reset(bi);
+		bi->error = true;
+
+		bi->msg = 0; /* to inform the that all work is done */
+		bi->nmsgs = 0;
+		/* wake up our bh */
+		complete(&bi->done);
+	} else if (s & BSC_S_DONE) {
+		bi->nmsgs--;
+
+		if (bi->msg->flags & I2C_M_RD) {
+			bcm2708_bsc_fifo_drain(bi);
+		}
+
+		bcm2708_bsc_reset(bi);
+
+		if (bi->nmsgs) {
+			/* advance to next message */
+			bi->msg++;
+			bi->pos = 0;
+			ret = bcm2708_bsc_setup(bi);
+			if (ret < 0) {
+				bcm2708_bsc_reset(bi);
+				bi->error = true;
+				bi->msg = 0; /* to inform the that all work is done */
+				bi->nmsgs = 0;
+				/* wake up our bh */
+				complete(&bi->done);
+				goto early_exit;
+			}
+		} else {
+			bi->msg = 0; /* to inform the that all work is done */
+			bi->nmsgs = 0;
+			/* wake up our bh */
+			complete(&bi->done);
+		}
+	} else if (s & BSC_S_TXW) {
+		bcm2708_bsc_fifo_fill(bi);
+	} else if (s & BSC_S_RXR) {
+		bcm2708_bsc_fifo_drain(bi);
+	} else {
+		handled = false;
+	}
+
+early_exit:
+	spin_unlock(&bi->lock);
+
+	return handled ? IRQ_HANDLED : IRQ_NONE;
+}
+
+static int bcm2708_i2c_master_xfer(struct i2c_adapter *adap,
+	struct i2c_msg *msgs, int num)
+{
+	struct bcm2708_i2c *bi = adap->algo_data;
+	unsigned long flags;
+	int ret;
+
+	spin_lock_irqsave(&bi->lock, flags);
+
+	reinit_completion(&bi->done);
+	bi->msg = msgs;
+	bi->pos = 0;
+	bi->nmsgs = num;
+	bi->error = false;
+
+	ret = bcm2708_bsc_setup(bi);
+
+	spin_unlock_irqrestore(&bi->lock, flags);
+
+	/* check the result of the setup */
+	if (ret < 0)
+	{
+		dev_err(&adap->dev, "transfer setup timed out\n");
+		goto error_timeout;
+	}
+
+	ret = wait_for_completion_timeout(&bi->done, adap->timeout);
+	if (ret == 0) {
+		dev_err(&adap->dev, "transfer timed out\n");
+		goto error_timeout;
+	}
+
+	ret = bi->error ? -EIO : num;
+	return ret;
+
+error_timeout:
+	spin_lock_irqsave(&bi->lock, flags);
+	bcm2708_bsc_reset(bi);
+	bi->msg = 0; /* to inform the interrupt handler that there's nothing else to be done */
+	bi->nmsgs = 0;
+	spin_unlock_irqrestore(&bi->lock, flags);
+	return -ETIMEDOUT;
+}
+
+static u32 bcm2708_i2c_functionality(struct i2c_adapter *adap)
+{
+	return I2C_FUNC_I2C | /*I2C_FUNC_10BIT_ADDR |*/ I2C_FUNC_SMBUS_EMUL;
+}
+
+static struct i2c_algorithm bcm2708_i2c_algorithm = {
+	.master_xfer = bcm2708_i2c_master_xfer,
+	.functionality = bcm2708_i2c_functionality,
+};
+
+static int bcm2708_i2c_probe(struct platform_device *pdev)
+{
+	struct resource *regs;
+	int irq, err = -ENOMEM;
+	struct clk *clk;
+	struct bcm2708_i2c *bi;
+	struct i2c_adapter *adap;
+	unsigned long bus_hz;
+	u32 cdiv, clk_tout;
+	u32 baud;
+
+	baud = CONFIG_I2C_BCM2708_BAUDRATE;
+
+	if (pdev->dev.of_node) {
+		u32 bus_clk_rate;
+		pdev->id = of_alias_get_id(pdev->dev.of_node, "i2c");
+		if (pdev->id < 0) {
+			dev_err(&pdev->dev, "alias is missing\n");
+			return -EINVAL;
+		}
+		if (!of_property_read_u32(pdev->dev.of_node,
+					"clock-frequency", &bus_clk_rate))
+			baud = bus_clk_rate;
+		else
+			dev_warn(&pdev->dev,
+				"Could not read clock-frequency property\n");
+	}
+
+	if (baudrate)
+		baud = baudrate;
+
+	regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!regs) {
+		dev_err(&pdev->dev, "could not get IO memory\n");
+		return -ENXIO;
+	}
+
+	irq = platform_get_irq(pdev, 0);
+	if (irq < 0) {
+		dev_err(&pdev->dev, "could not get IRQ\n");
+		return irq;
+	}
+
+	clk = clk_get(&pdev->dev, NULL);
+	if (IS_ERR(clk)) {
+		dev_err(&pdev->dev, "could not find clk: %ld\n", PTR_ERR(clk));
+		return PTR_ERR(clk);
+	}
+
+	err = clk_prepare_enable(clk);
+	if (err) {
+		dev_err(&pdev->dev, "could not enable clk: %d\n", err);
+		goto out_clk_put;
+	}
+
+	bi = kzalloc(sizeof(*bi), GFP_KERNEL);
+	if (!bi)
+		goto out_clk_disable;
+
+	platform_set_drvdata(pdev, bi);
+
+	adap = &bi->adapter;
+	adap->class = I2C_CLASS_HWMON | I2C_CLASS_DDC;
+	adap->algo = &bcm2708_i2c_algorithm;
+	adap->algo_data = bi;
+	adap->dev.parent = &pdev->dev;
+	adap->nr = pdev->id;
+	strlcpy(adap->name, dev_name(&pdev->dev), sizeof(adap->name));
+	adap->dev.of_node = pdev->dev.of_node;
+
+	switch (pdev->id) {
+	case 0:
+		adap->class = I2C_CLASS_HWMON;
+		break;
+	case 1:
+		adap->class = I2C_CLASS_DDC;
+		break;
+	case 2:
+		adap->class = I2C_CLASS_DDC;
+		break;
+	default:
+		dev_err(&pdev->dev, "can only bind to BSC 0, 1 or 2\n");
+		err = -ENXIO;
+		goto out_free_bi;
+	}
+
+	spin_lock_init(&bi->lock);
+	init_completion(&bi->done);
+
+	bi->base = ioremap(regs->start, resource_size(regs));
+	if (!bi->base) {
+		dev_err(&pdev->dev, "could not remap memory\n");
+		goto out_free_bi;
+	}
+
+	bi->irq = irq;
+	bi->clk = clk;
+
+	err = request_irq(irq, bcm2708_i2c_interrupt, IRQF_SHARED,
+			dev_name(&pdev->dev), bi);
+	if (err) {
+		dev_err(&pdev->dev, "could not request IRQ: %d\n", err);
+		goto out_iounmap;
+	}
+
+	bcm2708_bsc_reset(bi);
+
+	err = i2c_add_numbered_adapter(adap);
+	if (err < 0) {
+		dev_err(&pdev->dev, "could not add I2C adapter: %d\n", err);
+		goto out_free_irq;
+	}
+
+	bus_hz = clk_get_rate(bi->clk);
+	cdiv = bus_hz / baud;
+	if (cdiv > 0xffff) {
+		cdiv = 0xffff;
+		baud = bus_hz / cdiv;
+	}
+
+	clk_tout = 35/1000*baud; //35ms timeout as per SMBus specs.
+	if (clk_tout > 0xffff)
+		clk_tout = 0xffff;
+	
+	bi->cdiv = cdiv;
+	bi->clk_tout = clk_tout;
+
+	dev_info(&pdev->dev, "BSC%d Controller at 0x%08lx (irq %d) (baudrate %d)\n",
+		pdev->id, (unsigned long)regs->start, irq, baud);
+
+	return 0;
+
+out_free_irq:
+	free_irq(bi->irq, bi);
+out_iounmap:
+	iounmap(bi->base);
+out_free_bi:
+	kfree(bi);
+out_clk_disable:
+	clk_disable_unprepare(clk);
+out_clk_put:
+	clk_put(clk);
+	return err;
+}
+
+static int bcm2708_i2c_remove(struct platform_device *pdev)
+{
+	struct bcm2708_i2c *bi = platform_get_drvdata(pdev);
+
+	platform_set_drvdata(pdev, NULL);
+
+	i2c_del_adapter(&bi->adapter);
+	free_irq(bi->irq, bi);
+	iounmap(bi->base);
+	clk_disable_unprepare(bi->clk);
+	clk_put(bi->clk);
+	kfree(bi);
+
+	return 0;
+}
+
+static const struct of_device_id bcm2708_i2c_of_match[] = {
+        { .compatible = "brcm,bcm2708-i2c" },
+        {},
+};
+MODULE_DEVICE_TABLE(of, bcm2708_i2c_of_match);
+
+static struct platform_driver bcm2708_i2c_driver = {
+	.driver		= {
+		.name	= DRV_NAME,
+		.owner	= THIS_MODULE,
+		.of_match_table = bcm2708_i2c_of_match,
+	},
+	.probe		= bcm2708_i2c_probe,
+	.remove		= bcm2708_i2c_remove,
+};
+
+// module_platform_driver(bcm2708_i2c_driver);
+
+
+static int __init bcm2708_i2c_init(void)
+{
+	return platform_driver_register(&bcm2708_i2c_driver);
+}
+
+static void __exit bcm2708_i2c_exit(void)
+{
+	platform_driver_unregister(&bcm2708_i2c_driver);
+}
+
+module_init(bcm2708_i2c_init);
+module_exit(bcm2708_i2c_exit);
+
+
+
+MODULE_DESCRIPTION("BSC controller driver for Broadcom BCM2708");
+MODULE_AUTHOR("Chris Boot <bootc@bootc.net>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:" DRV_NAME);
diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
index 44deae78913e..b7110eb2163e 100644
--- a/drivers/i2c/busses/i2c-bcm2835.c
+++ b/drivers/i2c/busses/i2c-bcm2835.c
@@ -56,6 +56,18 @@
 #define BCM2835_I2C_CDIV_MIN	0x0002
 #define BCM2835_I2C_CDIV_MAX	0xFFFE
 
+static unsigned int debug;
+module_param(debug, uint, 0644);
+MODULE_PARM_DESC(debug, "1=err, 2=isr, 3=xfer");
+
+#define BCM2835_DEBUG_MAX	512
+struct bcm2835_debug {
+	struct i2c_msg *msg;
+	int msg_idx;
+	size_t remain;
+	u32 status;
+};
+
 struct bcm2835_i2c_dev {
 	struct device *dev;
 	void __iomem *regs;
@@ -69,8 +81,78 @@ struct bcm2835_i2c_dev {
 	u32 msg_err;
 	u8 *msg_buf;
 	size_t msg_buf_remaining;
+	struct bcm2835_debug debug[BCM2835_DEBUG_MAX];
+	unsigned int debug_num;
+	unsigned int debug_num_msgs;
 };
 
+static inline void bcm2835_debug_add(struct bcm2835_i2c_dev *i2c_dev, u32 s)
+{
+	if (!i2c_dev->debug_num_msgs || i2c_dev->debug_num >= BCM2835_DEBUG_MAX)
+		return;
+
+	i2c_dev->debug[i2c_dev->debug_num].msg = i2c_dev->curr_msg;
+	i2c_dev->debug[i2c_dev->debug_num].msg_idx =
+				i2c_dev->debug_num_msgs - i2c_dev->num_msgs;
+	i2c_dev->debug[i2c_dev->debug_num].remain = i2c_dev->msg_buf_remaining;
+	i2c_dev->debug[i2c_dev->debug_num].status = s;
+	i2c_dev->debug_num++;
+}
+
+static void bcm2835_debug_print_status(struct bcm2835_i2c_dev *i2c_dev,
+				       struct bcm2835_debug *d)
+{
+	u32 s = d->status;
+
+	pr_info("isr: remain=%zu, status=0x%x : %s%s%s%s%s%s%s%s%s%s [i2c%d]\n",
+		d->remain, s,
+		s & BCM2835_I2C_S_TA ? "TA " : "",
+		s & BCM2835_I2C_S_DONE ? "DONE " : "",
+		s & BCM2835_I2C_S_TXW ? "TXW " : "",
+		s & BCM2835_I2C_S_RXR ? "RXR " : "",
+		s & BCM2835_I2C_S_TXD ? "TXD " : "",
+		s & BCM2835_I2C_S_RXD ? "RXD " : "",
+		s & BCM2835_I2C_S_TXE ? "TXE " : "",
+		s & BCM2835_I2C_S_RXF ? "RXF " : "",
+		s & BCM2835_I2C_S_ERR ? "ERR " : "",
+		s & BCM2835_I2C_S_CLKT ? "CLKT " : "",
+		i2c_dev->adapter.nr);
+}
+
+static void bcm2835_debug_print_msg(struct bcm2835_i2c_dev *i2c_dev,
+				    struct i2c_msg *msg, int i, int total,
+				    const char *fname)
+{
+	pr_info("%s: msg(%d/%d) %s addr=0x%02x, len=%u flags=%s%s%s%s%s%s%s [i2c%d]\n",
+		fname, i, total,
+		msg->flags & I2C_M_RD ? "read" : "write", msg->addr, msg->len,
+		msg->flags & I2C_M_TEN ? "TEN" : "",
+		msg->flags & I2C_M_RECV_LEN ? "RECV_LEN" : "",
+		msg->flags & I2C_M_NO_RD_ACK ? "NO_RD_ACK" : "",
+		msg->flags & I2C_M_IGNORE_NAK ? "IGNORE_NAK" : "",
+		msg->flags & I2C_M_REV_DIR_ADDR ? "REV_DIR_ADDR" : "",
+		msg->flags & I2C_M_NOSTART ? "NOSTART" : "",
+		msg->flags & I2C_M_STOP ? "STOP" : "",
+		i2c_dev->adapter.nr);
+}
+
+static void bcm2835_debug_print(struct bcm2835_i2c_dev *i2c_dev)
+{
+	struct bcm2835_debug *d;
+	unsigned int i;
+
+	for (i = 0; i < i2c_dev->debug_num; i++) {
+		d = &i2c_dev->debug[i];
+		if (d->status == ~0)
+			bcm2835_debug_print_msg(i2c_dev, d->msg, d->msg_idx,
+				i2c_dev->debug_num_msgs, "start_transfer");
+		else
+			bcm2835_debug_print_status(i2c_dev, d);
+	}
+	if (i2c_dev->debug_num >= BCM2835_DEBUG_MAX)
+		pr_info("BCM2835_DEBUG_MAX reached\n");
+}
+
 static inline void bcm2835_i2c_writel(struct bcm2835_i2c_dev *i2c_dev,
 				      u32 reg, u32 val)
 {
@@ -189,6 +271,7 @@ static void bcm2835_i2c_start_transfer(struct bcm2835_i2c_dev *i2c_dev)
 	bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_A, msg->addr);
 	bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_DLEN, msg->len);
 	bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, c);
+	bcm2835_debug_add(i2c_dev, ~0);
 }
 
 /*
@@ -206,6 +289,7 @@ static irqreturn_t bcm2835_i2c_isr(int this_irq, void *data)
 	u32 val, err;
 
 	val = bcm2835_i2c_readl(i2c_dev, BCM2835_I2C_S);
+	bcm2835_debug_add(i2c_dev, val);
 
 	err = val & (BCM2835_I2C_S_CLKT | BCM2835_I2C_S_ERR);
 	if (err) {
@@ -272,6 +356,13 @@ static int bcm2835_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
 	unsigned long time_left;
 	int i, ret;
 
+	if (debug)
+		i2c_dev->debug_num_msgs = num;
+
+	if (debug > 2)
+		for (i = 0; i < num; i++)
+			bcm2835_debug_print_msg(i2c_dev, &msgs[i], i + 1, num, __func__);
+
 	for (i = 0; i < (num - 1); i++)
 		if (msgs[i].flags & I2C_M_RD) {
 			dev_warn_once(i2c_dev->dev,
@@ -291,6 +382,10 @@ static int bcm2835_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
 
 	time_left = wait_for_completion_timeout(&i2c_dev->completion,
 						adap->timeout);
+	if (debug > 1 || (debug && (!time_left || i2c_dev->msg_err)))
+		bcm2835_debug_print(i2c_dev);
+	i2c_dev->debug_num_msgs = 0;
+	i2c_dev->debug_num = 0;
 	if (!time_left) {
 		bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C,
 				   BCM2835_I2C_C_CLEAR);
@@ -301,7 +396,9 @@ static int bcm2835_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
 	if (!i2c_dev->msg_err)
 		return num;
 
-	dev_dbg(i2c_dev->dev, "i2c transfer failed: %x\n", i2c_dev->msg_err);
+	if (debug)
+		dev_err(i2c_dev->dev, "i2c transfer failed: %x\n",
+			i2c_dev->msg_err);
 
 	if (i2c_dev->msg_err & BCM2835_I2C_S_ERR)
 		return -EREMOTEIO;
diff --git a/drivers/i2c/busses/i2c-gpio.c b/drivers/i2c/busses/i2c-gpio.c
index 0ef8fcc6ac3a..147dd691652a 100644
--- a/drivers/i2c/busses/i2c-gpio.c
+++ b/drivers/i2c/busses/i2c-gpio.c
@@ -220,7 +220,9 @@ static int i2c_gpio_probe(struct platform_device *pdev)
 	adap->dev.parent = &pdev->dev;
 	adap->dev.of_node = pdev->dev.of_node;
 
-	adap->nr = pdev->id;
+	if (pdev->id != PLATFORM_DEVID_NONE || !pdev->dev.of_node ||
+	    of_property_read_u32(pdev->dev.of_node, "reg", &adap->nr))
+		adap->nr = pdev->id;
 	ret = i2c_bit_add_numbered_bus(adap);
 	if (ret)
 		return ret;
diff --git a/drivers/input/joystick/Kconfig b/drivers/input/joystick/Kconfig
index f3c2f6ea8b44..c6a85b012bd8 100644
--- a/drivers/input/joystick/Kconfig
+++ b/drivers/input/joystick/Kconfig
@@ -351,4 +351,12 @@ config JOYSTICK_PSXPAD_SPI_FF
 
 	  To drive rumble motor a dedicated power supply is required.
 
+config JOYSTICK_RPISENSE
+	tristate "Raspberry Pi Sense HAT joystick"
+	depends on GPIOLIB && INPUT
+	select MFD_RPISENSE_CORE
+
+	help
+	  This is the joystick driver for the Raspberry Pi Sense HAT
+
 endif
diff --git a/drivers/input/joystick/Makefile b/drivers/input/joystick/Makefile
index 67651efda2e1..600fbe2fa7d1 100644
--- a/drivers/input/joystick/Makefile
+++ b/drivers/input/joystick/Makefile
@@ -34,4 +34,5 @@ obj-$(CONFIG_JOYSTICK_WARRIOR)		+= warrior.o
 obj-$(CONFIG_JOYSTICK_XPAD)		+= xpad.o
 obj-$(CONFIG_JOYSTICK_ZHENHUA)		+= zhenhua.o
 obj-$(CONFIG_JOYSTICK_WALKERA0701)	+= walkera0701.o
+obj-$(CONFIG_JOYSTICK_RPISENSE)		+= rpisense-js.o
 
diff --git a/drivers/input/joystick/rpisense-js.c b/drivers/input/joystick/rpisense-js.c
new file mode 100644
index 000000000000..6a416769065d
--- /dev/null
+++ b/drivers/input/joystick/rpisense-js.c
@@ -0,0 +1,153 @@
+/*
+ * Raspberry Pi Sense HAT joystick driver
+ * http://raspberrypi.org
+ *
+ * Copyright (C) 2015 Raspberry Pi
+ *
+ * Author: Serge Schneider
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ */
+
+#include <linux/module.h>
+
+#include <linux/mfd/rpisense/joystick.h>
+#include <linux/mfd/rpisense/core.h>
+
+static struct rpisense *rpisense;
+static unsigned char keymap[5] = {KEY_DOWN, KEY_RIGHT, KEY_UP, KEY_ENTER, KEY_LEFT,};
+
+static void keys_work_fn(struct work_struct *work)
+{
+	int i;
+	static s32 prev_keys;
+	struct rpisense_js *rpisense_js = &rpisense->joystick;
+	s32 keys = rpisense_reg_read(rpisense, RPISENSE_KEYS);
+	s32 changes = keys ^ prev_keys;
+
+	prev_keys = keys;
+	for (i = 0; i < 5; i++) {
+		if (changes & 1) {
+			input_report_key(rpisense_js->keys_dev,
+					 keymap[i], keys & 1);
+		}
+		changes >>= 1;
+		keys >>= 1;
+	}
+	input_sync(rpisense_js->keys_dev);
+}
+
+static irqreturn_t keys_irq_handler(int irq, void *pdev)
+{
+	struct rpisense_js *rpisense_js = &rpisense->joystick;
+
+	schedule_work(&rpisense_js->keys_work_s);
+	return IRQ_HANDLED;
+}
+
+static int rpisense_js_probe(struct platform_device *pdev)
+{
+	int ret;
+	int i;
+	struct rpisense_js *rpisense_js;
+
+	rpisense = rpisense_get_dev();
+	rpisense_js = &rpisense->joystick;
+
+	INIT_WORK(&rpisense_js->keys_work_s, keys_work_fn);
+
+	rpisense_js->keys_dev = input_allocate_device();
+	if (!rpisense_js->keys_dev) {
+		dev_err(&pdev->dev, "Could not allocate input device.\n");
+		return -ENOMEM;
+	}
+
+	rpisense_js->keys_dev->evbit[0] = BIT_MASK(EV_KEY);
+	for (i = 0; i < ARRAY_SIZE(keymap); i++) {
+		set_bit(keymap[i],
+			rpisense_js->keys_dev->keybit);
+	}
+
+	rpisense_js->keys_dev->name = "Raspberry Pi Sense HAT Joystick";
+	rpisense_js->keys_dev->phys = "rpi-sense-joy/input0";
+	rpisense_js->keys_dev->id.bustype = BUS_I2C;
+	rpisense_js->keys_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP);
+	rpisense_js->keys_dev->keycode = keymap;
+	rpisense_js->keys_dev->keycodesize = sizeof(unsigned char);
+	rpisense_js->keys_dev->keycodemax = ARRAY_SIZE(keymap);
+
+	ret = input_register_device(rpisense_js->keys_dev);
+	if (ret) {
+		dev_err(&pdev->dev, "Could not register input device.\n");
+		goto err_keys_alloc;
+	}
+
+	ret = gpiod_direction_input(rpisense_js->keys_desc);
+	if (ret) {
+		dev_err(&pdev->dev, "Could not set keys-int direction.\n");
+		goto err_keys_reg;
+	}
+
+	rpisense_js->keys_irq = gpiod_to_irq(rpisense_js->keys_desc);
+	if (rpisense_js->keys_irq < 0) {
+		dev_err(&pdev->dev, "Could not determine keys-int IRQ.\n");
+		ret = rpisense_js->keys_irq;
+		goto err_keys_reg;
+	}
+
+	ret = devm_request_irq(&pdev->dev, rpisense_js->keys_irq,
+			       keys_irq_handler, IRQF_TRIGGER_RISING,
+			       "keys", &pdev->dev);
+	if (ret) {
+		dev_err(&pdev->dev, "IRQ request failed.\n");
+		goto err_keys_reg;
+	}
+	return 0;
+err_keys_reg:
+	input_unregister_device(rpisense_js->keys_dev);
+err_keys_alloc:
+	input_free_device(rpisense_js->keys_dev);
+	return ret;
+}
+
+static int rpisense_js_remove(struct platform_device *pdev)
+{
+	struct rpisense_js *rpisense_js = &rpisense->joystick;
+
+	input_unregister_device(rpisense_js->keys_dev);
+	input_free_device(rpisense_js->keys_dev);
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id rpisense_js_id[] = {
+	{ .compatible = "rpi,rpi-sense-js" },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, rpisense_js_id);
+#endif
+
+static struct platform_device_id rpisense_js_device_id[] = {
+	{ .name = "rpi-sense-js" },
+	{ },
+};
+MODULE_DEVICE_TABLE(platform, rpisense_js_device_id);
+
+static struct platform_driver rpisense_js_driver = {
+	.probe = rpisense_js_probe,
+	.remove = rpisense_js_remove,
+	.driver = {
+		.name = "rpi-sense-js",
+		.owner = THIS_MODULE,
+	},
+};
+
+module_platform_driver(rpisense_js_driver);
+
+MODULE_DESCRIPTION("Raspberry Pi Sense HAT joystick driver");
+MODULE_AUTHOR("Serge Schneider <serge@raspberrypi.org>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 64b30fe273fd..80c3f6e9fae3 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -316,6 +316,16 @@ config TOUCHSCREEN_EGALAX_SERIAL
 	  To compile this driver as a module, choose M here: the
 	  module will be called egalax_ts_serial.
 
+config TOUCHSCREEN_EXC3000
+	tristate "EETI EXC3000 multi-touch panel support"
+	depends on I2C
+	help
+	  Say Y here to enable support for I2C connected EETI
+	  EXC3000 multi-touch panels.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called exc3000.
+
 config TOUCHSCREEN_FUJITSU
 	tristate "Fujitsu serial touchscreen"
 	select SERIO
@@ -628,6 +638,13 @@ config TOUCHSCREEN_EDT_FT5X06
 	  To compile this driver as a module, choose M here: the
 	  module will be called edt-ft5x06.
 
+config TOUCHSCREEN_RPI_FT5406
+	tristate "Raspberry Pi FT5406 driver"
+	depends on RASPBERRYPI_FIRMWARE
+	help
+	  Say Y here to enable the Raspberry Pi memory based FT5406 device
+
+
 config TOUCHSCREEN_MIGOR
 	tristate "Renesas MIGO-R touchscreen"
 	depends on (SH_MIGOR || COMPILE_TEST) && I2C
diff --git a/drivers/input/touchscreen/Makefile b/drivers/input/touchscreen/Makefile
index 850c1562555a..12ff1216da20 100644
--- a/drivers/input/touchscreen/Makefile
+++ b/drivers/input/touchscreen/Makefile
@@ -30,6 +30,7 @@ obj-$(CONFIG_TOUCHSCREEN_DA9034)	+= da9034-ts.o
 obj-$(CONFIG_TOUCHSCREEN_DA9052)	+= da9052_tsi.o
 obj-$(CONFIG_TOUCHSCREEN_DYNAPRO)	+= dynapro.o
 obj-$(CONFIG_TOUCHSCREEN_EDT_FT5X06)	+= edt-ft5x06.o
+obj-$(CONFIG_TOUCHSCREEN_RPI_FT5406)	+= rpi-ft5406.o
 obj-$(CONFIG_TOUCHSCREEN_HAMPSHIRE)	+= hampshire.o
 obj-$(CONFIG_TOUCHSCREEN_GUNZE)		+= gunze.o
 obj-$(CONFIG_TOUCHSCREEN_EETI)		+= eeti_ts.o
@@ -38,6 +39,7 @@ obj-$(CONFIG_TOUCHSCREEN_ELAN)		+= elants_i2c.o
 obj-$(CONFIG_TOUCHSCREEN_ELO)		+= elo.o
 obj-$(CONFIG_TOUCHSCREEN_EGALAX)	+= egalax_ts.o
 obj-$(CONFIG_TOUCHSCREEN_EGALAX_SERIAL)	+= egalax_ts_serial.o
+obj-$(CONFIG_TOUCHSCREEN_EXC3000)	+= exc3000.o
 obj-$(CONFIG_TOUCHSCREEN_FUJITSU)	+= fujitsu_ts.o
 obj-$(CONFIG_TOUCHSCREEN_GOODIX)	+= goodix.o
 obj-$(CONFIG_TOUCHSCREEN_ILI210X)	+= ili210x.o
diff --git a/drivers/input/touchscreen/exc3000.c b/drivers/input/touchscreen/exc3000.c
new file mode 100644
index 000000000000..bed0db699905
--- /dev/null
+++ b/drivers/input/touchscreen/exc3000.c
@@ -0,0 +1,223 @@
+/*
+ * Driver for I2C connected EETI EXC3000 multiple touch controller
+ *
+ * Copyright (C) 2017 Ahmet Inan <inan@distec.de>
+ *
+ * minimal implementation based on egalax_ts.c and egalax_i2c.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/bitops.h>
+#include <linux/device.h>
+#include <linux/i2c.h>
+#include <linux/input.h>
+#include <linux/input/mt.h>
+#include <linux/input/touchscreen.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/timer.h>
+#include <asm/unaligned.h>
+
+#define EXC3000_NUM_SLOTS		10
+#define EXC3000_SLOTS_PER_FRAME		5
+#define EXC3000_LEN_FRAME		66
+#define EXC3000_LEN_POINT		10
+#define EXC3000_MT_EVENT		6
+#define EXC3000_TIMEOUT_MS		100
+
+struct exc3000_data {
+	struct i2c_client *client;
+	struct input_dev *input;
+	struct touchscreen_properties prop;
+	struct timer_list timer;
+	u8 buf[2 * EXC3000_LEN_FRAME];
+};
+
+static void exc3000_report_slots(struct input_dev *input,
+				 struct touchscreen_properties *prop,
+				 const u8 *buf, int num)
+{
+	for (; num--; buf += EXC3000_LEN_POINT) {
+		if (buf[0] & BIT(0)) {
+			input_mt_slot(input, buf[1]);
+			input_mt_report_slot_state(input, MT_TOOL_FINGER, true);
+			touchscreen_report_pos(input, prop,
+					       get_unaligned_le16(buf + 2),
+					       get_unaligned_le16(buf + 4),
+					       true);
+		}
+	}
+}
+
+static void exc3000_timer(unsigned long d)
+{
+	struct exc3000_data *data = (void *)d;
+
+	input_mt_sync_frame(data->input);
+	input_sync(data->input);
+}
+
+static int exc3000_read_frame(struct i2c_client *client, u8 *buf)
+{
+	int ret;
+
+	ret = i2c_master_send(client, "'", 2);
+	if (ret < 0)
+		return ret;
+
+	if (ret != 2)
+		return -EIO;
+
+	ret = i2c_master_recv(client, buf, EXC3000_LEN_FRAME);
+	if (ret < 0)
+		return ret;
+
+	if (ret != EXC3000_LEN_FRAME)
+		return -EIO;
+
+	if (get_unaligned_le16(buf) != EXC3000_LEN_FRAME ||
+			buf[2] != EXC3000_MT_EVENT)
+		return -EINVAL;
+
+	return 0;
+}
+
+static int exc3000_read_data(struct i2c_client *client,
+			     u8 *buf, int *n_slots)
+{
+	int error;
+
+	error = exc3000_read_frame(client, buf);
+	if (error)
+		return error;
+
+	*n_slots = buf[3];
+	if (!*n_slots || *n_slots > EXC3000_NUM_SLOTS)
+		return -EINVAL;
+
+	if (*n_slots > EXC3000_SLOTS_PER_FRAME) {
+		/* Read 2nd frame to get the rest of the contacts. */
+		error = exc3000_read_frame(client, buf + EXC3000_LEN_FRAME);
+		if (error)
+			return error;
+
+		/* 2nd chunk must have number of contacts set to 0. */
+		if (buf[EXC3000_LEN_FRAME + 3] != 0)
+			return -EINVAL;
+	}
+
+	return 0;
+}
+
+static irqreturn_t exc3000_interrupt(int irq, void *dev_id)
+{
+	struct exc3000_data *data = dev_id;
+	struct input_dev *input = data->input;
+	u8 *buf = data->buf;
+	int slots, total_slots;
+	int error;
+
+	error = exc3000_read_data(data->client, buf, &total_slots);
+	if (error) {
+		/* Schedule a timer to release "stuck" contacts */
+		mod_timer(&data->timer,
+			  jiffies + msecs_to_jiffies(EXC3000_TIMEOUT_MS));
+		goto out;
+	}
+
+	/*
+	 * We read full state successfully, no contacts will be "stuck".
+	 */
+	del_timer_sync(&data->timer);
+
+	while (total_slots > 0) {
+		slots = min(total_slots, EXC3000_SLOTS_PER_FRAME);
+		exc3000_report_slots(input, &data->prop, buf + 4, slots);
+		total_slots -= slots;
+		buf += EXC3000_LEN_FRAME;
+	}
+
+	input_mt_sync_frame(input);
+	input_sync(input);
+
+out:
+	return IRQ_HANDLED;
+}
+
+static int exc3000_probe(struct i2c_client *client,
+			 const struct i2c_device_id *id)
+{
+	struct exc3000_data *data;
+	struct input_dev *input;
+	int error;
+
+	data = devm_kzalloc(&client->dev, sizeof(*data), GFP_KERNEL);
+	if (!data)
+		return -ENOMEM;
+
+	data->client = client;
+	setup_timer(&data->timer, exc3000_timer, (unsigned long)data);
+
+	input = devm_input_allocate_device(&client->dev);
+	if (!input)
+		return -ENOMEM;
+
+	data->input = input;
+
+	input->name = "EETI EXC3000 Touch Screen";
+	input->id.bustype = BUS_I2C;
+
+	input_set_abs_params(input, ABS_MT_POSITION_X, 0, 4095, 0, 0);
+	input_set_abs_params(input, ABS_MT_POSITION_Y, 0, 4095, 0, 0);
+	touchscreen_parse_properties(input, true, &data->prop);
+
+	error = input_mt_init_slots(input, EXC3000_NUM_SLOTS,
+				    INPUT_MT_DIRECT | INPUT_MT_DROP_UNUSED);
+	if (error)
+		return error;
+
+	error = input_register_device(input);
+	if (error)
+		return error;
+
+	error = devm_request_threaded_irq(&client->dev, client->irq,
+					  NULL, exc3000_interrupt, IRQF_ONESHOT,
+					  client->name, data);
+	if (error)
+		return error;
+
+	return 0;
+}
+
+static const struct i2c_device_id exc3000_id[] = {
+	{ "exc3000", 0 },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, exc3000_id);
+
+#ifdef CONFIG_OF
+static const struct of_device_id exc3000_of_match[] = {
+	{ .compatible = "eeti,exc3000" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, exc3000_of_match);
+#endif
+
+static struct i2c_driver exc3000_driver = {
+	.driver = {
+		.name	= "exc3000",
+		.of_match_table = of_match_ptr(exc3000_of_match),
+	},
+	.id_table	= exc3000_id,
+	.probe		= exc3000_probe,
+};
+
+module_i2c_driver(exc3000_driver);
+
+MODULE_AUTHOR("Ahmet Inan <inan@distec.de>");
+MODULE_DESCRIPTION("I2C connected EETI EXC3000 multiple touch controller driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/input/touchscreen/rpi-ft5406.c b/drivers/input/touchscreen/rpi-ft5406.c
new file mode 100644
index 000000000000..40bbde9ce1bc
--- /dev/null
+++ b/drivers/input/touchscreen/rpi-ft5406.c
@@ -0,0 +1,364 @@
+/*
+ * Driver for memory based ft5406 touchscreen
+ *
+ * Copyright (C) 2015, 2017 Raspberry Pi
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/input.h>
+#include <linux/irq.h>
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/bitops.h>
+#include <linux/input/mt.h>
+#include <linux/kthread.h>
+#include <linux/platform_device.h>
+#include <linux/stddef.h>
+#include <linux/io.h>
+#include <linux/dma-mapping.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+#define MAXIMUM_SUPPORTED_POINTS 10
+#define FTS_TOUCH_DOWN      0
+#define FTS_TOUCH_UP        1
+#define FTS_TOUCH_CONTACT   2
+
+struct ft5406_regs {
+	uint8_t device_mode;
+	uint8_t gesture_id;
+	uint8_t num_points;
+	struct ft5406_touch {
+		uint8_t xh;
+		uint8_t xl;
+		uint8_t yh;
+		uint8_t yl;
+		uint8_t pressure; /* Not supported */
+		uint8_t area;     /* Not supported */
+	} point[MAXIMUM_SUPPORTED_POINTS];
+};
+
+/* These are defaults if the DT entries are missing */
+#define DEFAULT_SCREEN_WIDTH  800
+#define DEFAULT_SCREEN_HEIGHT 480
+
+struct ft5406 {
+	struct platform_device	*pdev;
+	struct input_dev	*input_dev;
+	void __iomem		*ts_base;
+	dma_addr_t		bus_addr;
+	struct task_struct	*thread;
+
+	uint16_t	max_x;
+	uint16_t	max_y;
+	uint8_t		hflip;
+	uint8_t		vflip;
+	uint8_t		xyswap;
+};
+
+/* Thread to poll for touchscreen events
+ *
+ * This thread polls the memory based register copy of the ft5406 registers
+ * using the number of points register to know whether the copy has been
+ * updated (we write 99 to the memory copy, the GPU will write between
+ * 0 - 10 points)
+ */
+#define ID_TO_BIT(a) (1 << a)
+
+static int ft5406_thread(void *arg)
+{
+	struct ft5406 *ts = (struct ft5406 *) arg;
+	struct ft5406_regs regs;
+	int known_ids = 0;
+
+	while (!kthread_should_stop()) {
+		/* 60fps polling */
+		msleep_interruptible(17);
+		memcpy_fromio(&regs, ts->ts_base, sizeof(struct ft5406_regs));
+		iowrite8(99,
+			 ts->ts_base +
+			 offsetof(struct ft5406_regs, num_points));
+
+		/*
+		 * Do not output if theres no new information (num_points is 99)
+		 * or we have no touch points and don't need to release any
+		 */
+		if (!(regs.num_points == 99 ||
+		    (regs.num_points == 0 && known_ids == 0))) {
+			int i;
+			int modified_ids = 0, released_ids;
+
+			for (i = 0; i < regs.num_points; i++) {
+				int x = (((int) regs.point[i].xh & 0xf) << 8) +
+					regs.point[i].xl;
+				int y = (((int) regs.point[i].yh & 0xf) << 8) +
+					regs.point[i].yl;
+				int touchid = (regs.point[i].yh >> 4) & 0xf;
+				int event_type = (regs.point[i].xh >> 6) & 0x03;
+
+				modified_ids |= ID_TO_BIT(touchid);
+
+				if (event_type == FTS_TOUCH_DOWN ||
+				    event_type == FTS_TOUCH_CONTACT) {
+					if (ts->hflip)
+						x = ts->max_x - 1 - x;
+
+					if (ts->vflip)
+						y = ts->max_y - 1 - y;
+
+					if (ts->xyswap)
+						swap(x, y);
+
+					if (!((ID_TO_BIT(touchid)) & known_ids))
+						dev_dbg(&ts->pdev->dev,
+							"x = %d, y = %d, press = %d, touchid = %d\n",
+							x, y,
+							regs.point[i].pressure,
+							touchid);
+
+					input_mt_slot(ts->input_dev, touchid);
+					input_mt_report_slot_state(
+							ts->input_dev,
+							MT_TOOL_FINGER,
+							1);
+
+					input_report_abs(ts->input_dev,
+							 ABS_MT_POSITION_X, x);
+					input_report_abs(ts->input_dev,
+							 ABS_MT_POSITION_Y, y);
+				}
+			}
+
+			released_ids = known_ids & ~modified_ids;
+			for (i = 0;
+			     released_ids && i < MAXIMUM_SUPPORTED_POINTS;
+			     i++) {
+				if (released_ids & (1<<i)) {
+					dev_dbg(&ts->pdev->dev,
+						"Released %d, known = %x, modified = %x\n",
+						i, known_ids, modified_ids);
+					input_mt_slot(ts->input_dev, i);
+					input_mt_report_slot_state(
+							ts->input_dev,
+							MT_TOOL_FINGER,
+							0);
+					modified_ids &= ~(ID_TO_BIT(i));
+				}
+			}
+			known_ids = modified_ids;
+
+			input_mt_report_pointer_emulation(ts->input_dev, true);
+			input_sync(ts->input_dev);
+		}
+	}
+
+	return 0;
+}
+
+static int ft5406_probe(struct platform_device *pdev)
+{
+	int err = 0;
+	struct device *dev = &pdev->dev;
+	struct device_node *np = dev->of_node;
+	struct ft5406 *ts;
+	struct device_node *fw_node;
+	struct rpi_firmware *fw;
+	u32 touchbuf;
+	u32 val;
+
+	dev_info(dev, "Probing device\n");
+
+	fw_node = of_parse_phandle(np, "firmware", 0);
+	if (!fw_node) {
+		dev_err(dev, "Missing firmware node\n");
+		return -ENOENT;
+	}
+
+	fw = rpi_firmware_get(fw_node);
+	if (!fw)
+		return -EPROBE_DEFER;
+
+	ts = devm_kzalloc(dev, sizeof(struct ft5406), GFP_KERNEL);
+	if (!ts) {
+		dev_err(dev, "Failed to allocate memory\n");
+		return -ENOMEM;
+	}
+
+	ts->input_dev = input_allocate_device();
+	if (!ts->input_dev) {
+		dev_err(dev, "Failed to allocate input device\n");
+		return -ENOMEM;
+	}
+
+	ts->ts_base = dma_zalloc_coherent(dev, PAGE_SIZE, &ts->bus_addr,
+					  GFP_KERNEL);
+	if (!ts->ts_base) {
+		pr_err("[%s]: failed to dma_alloc_coherent(%ld)\n",
+				__func__, PAGE_SIZE);
+		err = -ENOMEM;
+		goto out;
+	}
+
+	touchbuf = (u32)ts->bus_addr;
+	err = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_SET_TOUCHBUF,
+				    &touchbuf, sizeof(touchbuf));
+
+	if (err || touchbuf != 0) {
+		dev_warn(dev, "Failed to set touchbuf, trying to get err:%x\n",
+			 err);
+		dma_free_coherent(dev, PAGE_SIZE, ts->ts_base, ts->bus_addr);
+		ts->ts_base = 0;
+		ts->bus_addr = 0;
+	}
+
+	if (!ts->ts_base) {
+		dev_warn(dev,
+		"set failed, trying get (err:%d touchbuf:%x virt:%p bus:%x)\n",
+		err, touchbuf, ts->ts_base, ts->bus_addr);
+
+		err = rpi_firmware_property(
+				fw,
+				RPI_FIRMWARE_FRAMEBUFFER_GET_TOUCHBUF,
+				&touchbuf, sizeof(touchbuf));
+		if (err) {
+			dev_err(dev, "Failed to get touch buffer\n");
+			goto out;
+		}
+
+		if (!touchbuf) {
+			dev_err(dev, "Touchscreen not detected\n");
+			err = -ENODEV;
+			goto out;
+		}
+
+		dev_dbg(dev, "Got TS buffer 0x%x\n", touchbuf);
+
+		/* mmap the physical memory */
+		touchbuf &= ~0xc0000000;
+		ts->ts_base = ioremap(touchbuf, sizeof(struct ft5406_regs));
+		if (ts->ts_base == NULL) {
+			dev_err(dev, "Failed to map physical address\n");
+			err = -ENOMEM;
+			goto out;
+		}
+	}
+	platform_set_drvdata(pdev, ts);
+	ts->pdev = pdev;
+
+	ts->input_dev->name = "FT5406 memory based driver";
+
+	if (of_property_read_u32(np, "touchscreen-size-x", &val) >= 0)
+		ts->max_x = val;
+	else
+		ts->max_x = DEFAULT_SCREEN_WIDTH;
+
+	if (of_property_read_u32(np, "touchscreen-size-y", &val) >= 0)
+		ts->max_y = val;
+	else
+		ts->max_y = DEFAULT_SCREEN_HEIGHT;
+
+	if (of_property_read_u32(np, "touchscreen-inverted-x", &val) >= 0)
+		ts->hflip = val;
+
+	if (of_property_read_u32(np, "touchscreen-inverted-y", &val) >= 0)
+		ts->vflip = val;
+
+	if (of_property_read_u32(np, "touchscreen-swapped-x-y", &val) >= 0)
+		ts->xyswap = val;
+
+	dev_dbg(dev,
+		"Touchscreen parameters (%d,%d), hflip=%d, vflip=%d, xyswap=%d",
+		ts->max_x, ts->max_y, ts->hflip, ts->vflip, ts->xyswap);
+
+	__set_bit(EV_KEY, ts->input_dev->evbit);
+	__set_bit(EV_SYN, ts->input_dev->evbit);
+	__set_bit(EV_ABS, ts->input_dev->evbit);
+
+	input_set_abs_params(ts->input_dev, ABS_MT_POSITION_X, 0,
+			     ts->xyswap ? ts->max_y : ts->max_x, 0, 0);
+	input_set_abs_params(ts->input_dev, ABS_MT_POSITION_Y, 0,
+			     ts->xyswap ? ts->max_x : ts->max_y, 0, 0);
+
+	input_mt_init_slots(ts->input_dev,
+			    MAXIMUM_SUPPORTED_POINTS, INPUT_MT_DIRECT);
+
+	input_set_drvdata(ts->input_dev, ts);
+
+	err = input_register_device(ts->input_dev);
+	if (err) {
+		dev_err(dev, "could not register input device, %d\n",
+			err);
+		goto out;
+	}
+
+	/* create thread that polls the touch events */
+	ts->thread = kthread_run(ft5406_thread, ts, "ft5406");
+	if (ts->thread == NULL) {
+		dev_err(dev, "Failed to create kernel thread");
+		err = -ENOMEM;
+		goto out;
+	}
+
+	return 0;
+
+out:
+	if (ts->bus_addr) {
+		dma_free_coherent(dev, PAGE_SIZE, ts->ts_base, ts->bus_addr);
+		ts->bus_addr = 0;
+		ts->ts_base = NULL;
+	} else if (ts->ts_base) {
+		iounmap(ts->ts_base);
+		ts->ts_base = NULL;
+	}
+	if (ts->input_dev) {
+		input_unregister_device(ts->input_dev);
+		ts->input_dev = NULL;
+	}
+	return err;
+}
+
+static int ft5406_remove(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct ft5406 *ts = (struct ft5406 *) platform_get_drvdata(pdev);
+
+	dev_info(dev, "Removing rpi-ft5406\n");
+
+	kthread_stop(ts->thread);
+
+	if (ts->bus_addr)
+		dma_free_coherent(dev, PAGE_SIZE, ts->ts_base, ts->bus_addr);
+	else if (ts->ts_base)
+		iounmap(ts->ts_base);
+	if (ts->input_dev)
+		input_unregister_device(ts->input_dev);
+
+	return 0;
+}
+
+static const struct of_device_id ft5406_match[] = {
+	{ .compatible = "rpi,rpi-ft5406", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, ft5406_match);
+
+static struct platform_driver ft5406_driver = {
+	.driver = {
+		.name   = "rpi-ft5406",
+		.owner  = THIS_MODULE,
+		.of_match_table = ft5406_match,
+	},
+	.probe          = ft5406_probe,
+	.remove         = ft5406_remove,
+};
+
+module_platform_driver(ft5406_driver);
+
+MODULE_AUTHOR("Gordon Hollingworth");
+MODULE_DESCRIPTION("Touchscreen driver for memory based FT5406");
+MODULE_LICENSE("GPL");
diff --git a/drivers/irqchip/irq-bcm2835.c b/drivers/irqchip/irq-bcm2835.c
index d2da8a1e6b1b..ecb014728974 100644
--- a/drivers/irqchip/irq-bcm2835.c
+++ b/drivers/irqchip/irq-bcm2835.c
@@ -52,9 +52,12 @@
 #include <linux/irqdomain.h>
 
 #include <asm/exception.h>
+#ifndef CONFIG_ARM64
+#include <asm/mach/irq.h>
+#endif
 
 /* Put the bank and irq (32 bits) into the hwirq */
-#define MAKE_HWIRQ(b, n)	((b << 5) | (n))
+#define MAKE_HWIRQ(b, n)	(((b) << 5) | (n))
 #define HWIRQ_BANK(i)		(i >> 5)
 #define HWIRQ_BIT(i)		BIT(i & 0x1f)
 
@@ -69,10 +72,18 @@
 #define BANK0_VALID_MASK	(BANK0_HWIRQ_MASK | BANK1_HWIRQ | BANK2_HWIRQ \
 					| SHORTCUT1_MASK | SHORTCUT2_MASK)
 
+#undef ARM_LOCAL_GPU_INT_ROUTING
+#define ARM_LOCAL_GPU_INT_ROUTING 0x0c
+
 #define REG_FIQ_CONTROL		0x0c
+#define REG_FIQ_ENABLE		0x80
+#define REG_FIQ_DISABLE		0
 
 #define NR_BANKS		3
 #define IRQS_PER_BANK		32
+#define NUMBER_IRQS		MAKE_HWIRQ(NR_BANKS, 0)
+#undef FIQ_START
+#define FIQ_START		(NR_IRQS_BANK0 + MAKE_HWIRQ(NR_BANKS - 1, 0))
 
 static const int reg_pending[] __initconst = { 0x00, 0x04, 0x08 };
 static const int reg_enable[] __initconst = { 0x18, 0x10, 0x14 };
@@ -90,6 +101,7 @@ struct armctrl_ic {
 	void __iomem *enable[NR_BANKS];
 	void __iomem *disable[NR_BANKS];
 	struct irq_domain *domain;
+	void __iomem *local_base;
 };
 
 static struct armctrl_ic intc __read_mostly;
@@ -97,20 +109,76 @@ static void __exception_irq_entry bcm2835_handle_irq(
 	struct pt_regs *regs);
 static void bcm2836_chained_handle_irq(struct irq_desc *desc);
 
+static inline unsigned int hwirq_to_fiq(unsigned long hwirq)
+{
+	hwirq -= NUMBER_IRQS;
+	/*
+	 * The hwirq numbering used in this driver is:
+	 *   BASE (0-7) GPU1 (32-63) GPU2 (64-95).
+	 * This differ from the one used in the FIQ register:
+	 *   GPU1 (0-31) GPU2 (32-63) BASE (64-71)
+	 */
+	if (hwirq >= 32)
+		return hwirq - 32;
+
+	return hwirq + 64;
+}
+
 static void armctrl_mask_irq(struct irq_data *d)
 {
-	writel_relaxed(HWIRQ_BIT(d->hwirq), intc.disable[HWIRQ_BANK(d->hwirq)]);
+	if (d->hwirq >= NUMBER_IRQS)
+		writel_relaxed(REG_FIQ_DISABLE, intc.base + REG_FIQ_CONTROL);
+	else
+		writel_relaxed(HWIRQ_BIT(d->hwirq),
+			       intc.disable[HWIRQ_BANK(d->hwirq)]);
 }
 
 static void armctrl_unmask_irq(struct irq_data *d)
 {
-	writel_relaxed(HWIRQ_BIT(d->hwirq), intc.enable[HWIRQ_BANK(d->hwirq)]);
+	if (d->hwirq >= NUMBER_IRQS) {
+		if (num_online_cpus() > 1) {
+			unsigned int data;
+
+			if (!intc.local_base) {
+				pr_err("FIQ is disabled due to missing arm_local_intc\n");
+				return;
+			}
+
+			data = readl_relaxed(intc.local_base +
+					     ARM_LOCAL_GPU_INT_ROUTING);
+
+			data &= ~0xc;
+			data |= (1 << 2);
+			writel_relaxed(data,
+				       intc.local_base +
+				       ARM_LOCAL_GPU_INT_ROUTING);
+		}
+
+		writel_relaxed(REG_FIQ_ENABLE | hwirq_to_fiq(d->hwirq),
+			       intc.base + REG_FIQ_CONTROL);
+	} else {
+		writel_relaxed(HWIRQ_BIT(d->hwirq),
+			       intc.enable[HWIRQ_BANK(d->hwirq)]);
+	}
+}
+
+#ifdef CONFIG_ARM64
+void bcm2836_arm_irqchip_spin_gpu_irq(void);
+
+static void armctrl_ack_irq(struct irq_data *d)
+{
+	bcm2836_arm_irqchip_spin_gpu_irq();
 }
 
+#endif
+
 static struct irq_chip armctrl_chip = {
 	.name = "ARMCTRL-level",
 	.irq_mask = armctrl_mask_irq,
-	.irq_unmask = armctrl_unmask_irq
+	.irq_unmask = armctrl_unmask_irq,
+#ifdef CONFIG_ARM64
+	.irq_ack    = armctrl_ack_irq
+#endif
 };
 
 static int armctrl_xlate(struct irq_domain *d, struct device_node *ctrlr,
@@ -149,8 +217,9 @@ static int __init armctrl_of_init(struct device_node *node,
 	if (!base)
 		panic("%pOF: unable to map IC registers\n", node);
 
-	intc.domain = irq_domain_add_linear(node, MAKE_HWIRQ(NR_BANKS, 0),
-			&armctrl_ops, NULL);
+	intc.base = base;
+	intc.domain = irq_domain_add_linear(node, NUMBER_IRQS * 2,
+					    &armctrl_ops, NULL);
 	if (!intc.domain)
 		panic("%pOF: unable to create IRQ domain\n", node);
 
@@ -180,6 +249,27 @@ static int __init armctrl_of_init(struct device_node *node,
 		set_handle_irq(bcm2835_handle_irq);
 	}
 
+	if (is_2836) {
+		extern void __iomem * __attribute__((weak)) arm_local_intc;
+		intc.local_base = arm_local_intc;
+		if (!intc.local_base)
+			pr_err("Failed to get local intc base. FIQ is disabled for cpus > 1\n");
+	}
+
+	/* Make a duplicate irq range which is used to enable FIQ */
+	for (b = 0; b < NR_BANKS; b++) {
+		for (i = 0; i < bank_irqs[b]; i++) {
+			irq = irq_create_mapping(intc.domain,
+					MAKE_HWIRQ(b, i) + NUMBER_IRQS);
+			BUG_ON(irq <= 0);
+			irq_set_chip(irq, &armctrl_chip);
+			irq_set_probe(irq);
+		}
+	}
+#ifndef CONFIG_ARM64
+	init_FIQ(FIQ_START);
+#endif
+
 	return 0;
 }
 
diff --git a/drivers/irqchip/irq-bcm2836.c b/drivers/irqchip/irq-bcm2836.c
index dc8c1e3eafe7..738ed5e5a6de 100644
--- a/drivers/irqchip/irq-bcm2836.c
+++ b/drivers/irqchip/irq-bcm2836.c
@@ -19,62 +19,9 @@
 #include <linux/of_irq.h>
 #include <linux/irqchip.h>
 #include <linux/irqdomain.h>
-#include <asm/exception.h>
-
-#define LOCAL_CONTROL			0x000
-#define LOCAL_PRESCALER			0x008
+#include <linux/irqchip/irq-bcm2836.h>
 
-/*
- * The low 2 bits identify the CPU that the GPU IRQ goes to, and the
- * next 2 bits identify the CPU that the GPU FIQ goes to.
- */
-#define LOCAL_GPU_ROUTING		0x00c
-/* When setting bits 0-3, enables PMU interrupts on that CPU. */
-#define LOCAL_PM_ROUTING_SET		0x010
-/* When setting bits 0-3, disables PMU interrupts on that CPU. */
-#define LOCAL_PM_ROUTING_CLR		0x014
-/*
- * The low 4 bits of this are the CPU's timer IRQ enables, and the
- * next 4 bits are the CPU's timer FIQ enables (which override the IRQ
- * bits).
- */
-#define LOCAL_TIMER_INT_CONTROL0	0x040
-/*
- * The low 4 bits of this are the CPU's per-mailbox IRQ enables, and
- * the next 4 bits are the CPU's per-mailbox FIQ enables (which
- * override the IRQ bits).
- */
-#define LOCAL_MAILBOX_INT_CONTROL0	0x050
-/*
- * The CPU's interrupt status register.  Bits are defined by the the
- * LOCAL_IRQ_* bits below.
- */
-#define LOCAL_IRQ_PENDING0		0x060
-/* Same status bits as above, but for FIQ. */
-#define LOCAL_FIQ_PENDING0		0x070
-/*
- * Mailbox write-to-set bits.  There are 16 mailboxes, 4 per CPU, and
- * these bits are organized by mailbox number and then CPU number.  We
- * use mailbox 0 for IPIs.  The mailbox's interrupt is raised while
- * any bit is set.
- */
-#define LOCAL_MAILBOX0_SET0		0x080
-#define LOCAL_MAILBOX3_SET0		0x08c
-/* Mailbox write-to-clear bits. */
-#define LOCAL_MAILBOX0_CLR0		0x0c0
-#define LOCAL_MAILBOX3_CLR0		0x0cc
-
-#define LOCAL_IRQ_CNTPSIRQ	0
-#define LOCAL_IRQ_CNTPNSIRQ	1
-#define LOCAL_IRQ_CNTHPIRQ	2
-#define LOCAL_IRQ_CNTVIRQ	3
-#define LOCAL_IRQ_MAILBOX0	4
-#define LOCAL_IRQ_MAILBOX1	5
-#define LOCAL_IRQ_MAILBOX2	6
-#define LOCAL_IRQ_MAILBOX3	7
-#define LOCAL_IRQ_GPU_FAST	8
-#define LOCAL_IRQ_PMU_FAST	9
-#define LAST_IRQ		LOCAL_IRQ_PMU_FAST
+#include <asm/exception.h>
 
 struct bcm2836_arm_irqchip_intc {
 	struct irq_domain *domain;
@@ -83,6 +30,9 @@ struct bcm2836_arm_irqchip_intc {
 
 static struct bcm2836_arm_irqchip_intc intc  __read_mostly;
 
+void __iomem *arm_local_intc;
+EXPORT_SYMBOL_GPL(arm_local_intc);
+
 static void bcm2836_arm_irqchip_mask_per_cpu_irq(unsigned int reg_offset,
 						 unsigned int bit,
 						 int cpu)
@@ -145,6 +95,27 @@ static void bcm2836_arm_irqchip_unmask_gpu_irq(struct irq_data *d)
 {
 }
 
+#ifdef CONFIG_ARM64
+
+void bcm2836_arm_irqchip_spin_gpu_irq(void)
+{
+	u32 i;
+	void __iomem *gpurouting = (intc.base + LOCAL_GPU_ROUTING);
+	u32 routing_val = readl(gpurouting);
+
+	for (i = 1; i <= 3; i++) {
+		u32 new_routing_val = (routing_val + i) & 3;
+
+		if (cpu_active(new_routing_val)) {
+			writel(new_routing_val, gpurouting);
+			return;
+		}
+	}
+}
+EXPORT_SYMBOL(bcm2836_arm_irqchip_spin_gpu_irq);
+
+#endif
+
 static struct irq_chip bcm2836_arm_irqchip_gpu = {
 	.name		= "bcm2836-gpu",
 	.irq_mask	= bcm2836_arm_irqchip_mask_gpu_irq,
@@ -157,7 +128,7 @@ static void bcm2836_arm_irqchip_register_irq(int hwirq, struct irq_chip *chip)
 
 	irq_set_percpu_devid(irq);
 	irq_set_chip_and_handler(irq, chip, handle_percpu_devid_irq);
-	irq_set_status_flags(irq, IRQ_NOAUTOEN);
+	irq_set_status_flags(irq, IRQ_NOAUTOEN | IRQ_TYPE_LEVEL_LOW);
 }
 
 static void
@@ -175,6 +146,7 @@ __exception_irq_entry bcm2836_arm_irqchip_handle_irq(struct pt_regs *regs)
 		u32 ipi = ffs(mbox_val) - 1;
 
 		writel(1 << ipi, mailbox0);
+		dsb(sy);
 		handle_IPI(ipi, regs);
 #endif
 	} else if (stat) {
@@ -215,24 +187,6 @@ static int bcm2836_cpu_dying(unsigned int cpu)
 					     cpu);
 	return 0;
 }
-
-#ifdef CONFIG_ARM
-static int __init bcm2836_smp_boot_secondary(unsigned int cpu,
-					     struct task_struct *idle)
-{
-	unsigned long secondary_startup_phys =
-		(unsigned long)virt_to_phys((void *)secondary_startup);
-
-	writel(secondary_startup_phys,
-	       intc.base + LOCAL_MAILBOX3_SET0 + 16 * cpu);
-
-	return 0;
-}
-
-static const struct smp_operations bcm2836_smp_ops __initconst = {
-	.smp_boot_secondary	= bcm2836_smp_boot_secondary,
-};
-#endif
 #endif
 
 static const struct irq_domain_ops bcm2836_arm_irqchip_intc_ops = {
@@ -249,10 +203,6 @@ bcm2836_arm_irqchip_smp_init(void)
 			  bcm2836_cpu_dying);
 
 	set_smp_cross_call(bcm2836_arm_irqchip_send_ipi);
-
-#ifdef CONFIG_ARM
-	smp_set_ops(&bcm2836_smp_ops);
-#endif
 #endif
 }
 
@@ -285,6 +235,8 @@ static int __init bcm2836_arm_irqchip_l1_intc_of_init(struct device_node *node,
 		panic("%pOF: unable to map local interrupt registers\n", node);
 	}
 
+	arm_local_intc = intc.base;
+
 	bcm2835_init_local_timer_frequency();
 
 	intc.domain = irq_domain_add_linear(node, LAST_IRQ + 1,
diff --git a/drivers/leds/leds-gpio.c b/drivers/leds/leds-gpio.c
index 764c31301f90..9544067cafa5 100644
--- a/drivers/leds/leds-gpio.c
+++ b/drivers/leds/leds-gpio.c
@@ -50,8 +50,15 @@ static void gpio_led_set(struct led_classdev *led_cdev,
 		led_dat->platform_gpio_blink_set(led_dat->gpiod, level,
 						 NULL, NULL);
 		led_dat->blinking = 0;
+	} else if (led_dat->cdev.flags & SET_GPIO_INPUT) {
+		gpiod_direction_input(led_dat->gpiod);
+		led_dat->cdev.flags &= ~SET_GPIO_INPUT;
+	} else if (led_dat->cdev.flags & SET_GPIO_OUTPUT) {
+		gpiod_direction_output(led_dat->gpiod, level);
+		led_dat->cdev.flags &= ~SET_GPIO_OUTPUT;
 	} else {
-		if (led_dat->can_sleep)
+		if (led_dat->can_sleep ||
+			(led_dat->cdev.flags & (SET_GPIO_INPUT | SET_GPIO_OUTPUT) ))
 			gpiod_set_value_cansleep(led_dat->gpiod, level);
 		else
 			gpiod_set_value(led_dat->gpiod, level);
@@ -65,6 +72,13 @@ static int gpio_led_set_blocking(struct led_classdev *led_cdev,
 	return 0;
 }
 
+static enum led_brightness gpio_led_get(struct led_classdev *led_cdev)
+{
+	struct gpio_led_data *led_dat =
+		container_of(led_cdev, struct gpio_led_data, cdev);
+	return gpiod_get_value_cansleep(led_dat->gpiod) ? LED_FULL : LED_OFF;
+}
+
 static int gpio_blink_set(struct led_classdev *led_cdev,
 	unsigned long *delay_on, unsigned long *delay_off)
 {
@@ -122,6 +136,7 @@ static int create_gpio_led(const struct gpio_led *template,
 		led_dat->platform_gpio_blink_set = blink_set;
 		led_dat->cdev.blink_set = gpio_blink_set;
 	}
+	led_dat->cdev.brightness_get = gpio_led_get;
 	if (template->default_state == LEDS_GPIO_DEFSTATE_KEEP) {
 		state = gpiod_get_value_cansleep(led_dat->gpiod);
 		if (state < 0)
diff --git a/drivers/leds/trigger/Kconfig b/drivers/leds/trigger/Kconfig
index 3f9ddb9fafa7..c1b6c83f3b63 100644
--- a/drivers/leds/trigger/Kconfig
+++ b/drivers/leds/trigger/Kconfig
@@ -116,6 +116,13 @@ config LEDS_TRIGGER_CAMERA
 	  This enables direct flash/torch on/off by the driver, kernel space.
 	  If unsure, say Y.
 
+config LEDS_TRIGGER_INPUT
+	tristate "LED Input Trigger"
+	depends on LEDS_TRIGGERS
+	help
+	  This allows the GPIOs assigned to be LEDs to be initialised to inputs.
+	  If unsure, say Y.
+
 config LEDS_TRIGGER_PANIC
 	bool "LED Panic Trigger"
 	depends on LEDS_TRIGGERS
diff --git a/drivers/leds/trigger/Makefile b/drivers/leds/trigger/Makefile
index 9f2e868811e2..48dbdc50d579 100644
--- a/drivers/leds/trigger/Makefile
+++ b/drivers/leds/trigger/Makefile
@@ -10,4 +10,5 @@ obj-$(CONFIG_LEDS_TRIGGER_CPU)		+= ledtrig-cpu.o
 obj-$(CONFIG_LEDS_TRIGGER_DEFAULT_ON)	+= ledtrig-default-on.o
 obj-$(CONFIG_LEDS_TRIGGER_TRANSIENT)	+= ledtrig-transient.o
 obj-$(CONFIG_LEDS_TRIGGER_CAMERA)	+= ledtrig-camera.o
+obj-$(CONFIG_LEDS_TRIGGER_INPUT)	+= ledtrig-input.o
 obj-$(CONFIG_LEDS_TRIGGER_PANIC)	+= ledtrig-panic.o
diff --git a/drivers/leds/trigger/ledtrig-input.c b/drivers/leds/trigger/ledtrig-input.c
new file mode 100644
index 000000000000..27f8ebea43d8
--- /dev/null
+++ b/drivers/leds/trigger/ledtrig-input.c
@@ -0,0 +1,54 @@
+/*
+ * Set LED GPIO to Input "Trigger"
+ *
+ * Copyright 2015 Phil Elwell <phil@raspberrypi.org>
+ *
+ * Based on Nick Forbes's ledtrig-default-on.c.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/leds.h>
+#include <linux/gpio.h>
+#include "../leds.h"
+
+static void input_trig_activate(struct led_classdev *led_cdev)
+{
+	led_cdev->flags |= SET_GPIO_INPUT;
+	led_set_brightness(led_cdev, 0);
+}
+
+static void input_trig_deactivate(struct led_classdev *led_cdev)
+{
+	led_cdev->flags |= SET_GPIO_OUTPUT;
+	led_set_brightness(led_cdev, 0);
+}
+
+static struct led_trigger input_led_trigger = {
+	.name     = "input",
+	.activate = input_trig_activate,
+	.deactivate = input_trig_deactivate,
+};
+
+static int __init input_trig_init(void)
+{
+	return led_trigger_register(&input_led_trigger);
+}
+
+static void __exit input_trig_exit(void)
+{
+	led_trigger_unregister(&input_led_trigger);
+}
+
+module_init(input_trig_init);
+module_exit(input_trig_exit);
+
+MODULE_AUTHOR("Phil Elwell <phil@raspberrypi.org>");
+MODULE_DESCRIPTION("Set LED GPIO to Input \"trigger\"");
+MODULE_LICENSE("GPL");
diff --git a/drivers/mailbox/bcm2835-mailbox.c b/drivers/mailbox/bcm2835-mailbox.c
index cfb4b4496dd9..d9c6c217c4d6 100644
--- a/drivers/mailbox/bcm2835-mailbox.c
+++ b/drivers/mailbox/bcm2835-mailbox.c
@@ -51,12 +51,15 @@
 #define MAIL1_WRT	(ARM_0_MAIL1 + 0x00)
 #define MAIL1_STA	(ARM_0_MAIL1 + 0x18)
 
+/* On ARCH_BCM270x these come through <linux/interrupt.h> (arm_control.h ) */
+#ifndef ARM_MS_FULL
 /* Status register: FIFO state. */
 #define ARM_MS_FULL		BIT(31)
 #define ARM_MS_EMPTY		BIT(30)
 
 /* Configuration register: Enable interrupts. */
 #define ARM_MC_IHAVEDATAIRQEN	BIT(0)
+#endif
 
 struct bcm2835_mbox {
 	void __iomem *regs;
@@ -151,7 +154,7 @@ static int bcm2835_mbox_probe(struct platform_device *pdev)
 		return -ENOMEM;
 	spin_lock_init(&mbox->lock);
 
-	ret = devm_request_irq(dev, irq_of_parse_and_map(dev->of_node, 0),
+	ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
 			       bcm2835_mbox_irq, 0, dev_name(dev), mbox);
 	if (ret) {
 		dev_err(dev, "Failed to register a mailbox IRQ handler: %d\n",
@@ -209,7 +212,18 @@ static struct platform_driver bcm2835_mbox_driver = {
 	.probe		= bcm2835_mbox_probe,
 	.remove		= bcm2835_mbox_remove,
 };
-module_platform_driver(bcm2835_mbox_driver);
+
+static int __init bcm2835_mbox_init(void)
+{
+	return platform_driver_register(&bcm2835_mbox_driver);
+}
+arch_initcall(bcm2835_mbox_init);
+
+static void __init bcm2835_mbox_exit(void)
+{
+	platform_driver_unregister(&bcm2835_mbox_driver);
+}
+module_exit(bcm2835_mbox_exit);
 
 MODULE_AUTHOR("Lubomir Rintel <lkundrak@v3.sk>");
 MODULE_DESCRIPTION("BCM2835 mailbox IPC driver");
diff --git a/drivers/media/dvb-frontends/Kconfig b/drivers/media/dvb-frontends/Kconfig
index 2631d0e0a024..f29100832639 100644
--- a/drivers/media/dvb-frontends/Kconfig
+++ b/drivers/media/dvb-frontends/Kconfig
@@ -546,6 +546,8 @@ config DVB_GP8PSK_FE
 	depends on DVB_CORE
 	default DVB_USB_GP8PSK
 
+source "drivers/media/dvb-frontends/cxd2880/Kconfig"
+
 comment "DVB-C (cable) frontends"
 	depends on DVB_CORE
 
diff --git a/drivers/media/dvb-frontends/Makefile b/drivers/media/dvb-frontends/Makefile
index d025eb373842..7c7aca05678a 100644
--- a/drivers/media/dvb-frontends/Makefile
+++ b/drivers/media/dvb-frontends/Makefile
@@ -130,3 +130,4 @@ obj-$(CONFIG_DVB_HORUS3A) += horus3a.o
 obj-$(CONFIG_DVB_ASCOT2E) += ascot2e.o
 obj-$(CONFIG_DVB_HELENE) += helene.o
 obj-$(CONFIG_DVB_ZD1301_DEMOD) += zd1301_demod.o
+obj-$(CONFIG_DVB_CXD2880) += cxd2880/
diff --git a/drivers/media/dvb-frontends/cxd2880/Kconfig b/drivers/media/dvb-frontends/cxd2880/Kconfig
new file mode 100644
index 000000000000..36b8b6f7c4f7
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/Kconfig
@@ -0,0 +1,6 @@
+config DVB_CXD2880
+	tristate "Sony CXD2880 DVB-T2/T tuner + demodulator"
+	depends on DVB_CORE && SPI
+	default m if !MEDIA_SUBDRV_AUTOSELECT
+	help
+	  Say Y when you want to support this frontend.
\ No newline at end of file
diff --git a/drivers/media/dvb-frontends/cxd2880/Makefile b/drivers/media/dvb-frontends/cxd2880/Makefile
new file mode 100644
index 000000000000..2672c4a3d65c
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/Makefile
@@ -0,0 +1,21 @@
+cxd2880-objs := cxd2880_common.o \
+		cxd2880_devio_spi.o \
+		cxd2880_integ.o \
+		cxd2880_integ_dvbt2.o \
+		cxd2880_integ_dvbt.o \
+		cxd2880_io.o \
+		cxd2880_spi_device.o \
+		cxd2880_stopwatch_port.o \
+		cxd2880_tnrdmd.o \
+		cxd2880_tnrdmd_dvbt2.o \
+		cxd2880_tnrdmd_dvbt2_mon.o \
+		cxd2880_tnrdmd_dvbt.o \
+		cxd2880_tnrdmd_dvbt_mon.o\
+		cxd2880_tnrdmd_mon.o\
+		cxd2880_math.o \
+		cxd2880_top.o
+
+obj-$(CONFIG_DVB_CXD2880) += cxd2880.o
+
+ccflags-y += -Idrivers/media/dvb-core
+ccflags-y += -Idrivers/media/dvb-frontends
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880.h b/drivers/media/dvb-frontends/cxd2880/cxd2880.h
new file mode 100644
index 000000000000..281f9a784eb5
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880.h
@@ -0,0 +1,46 @@
+/*
+ * cxd2880.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver public definitions
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_H
+#define CXD2880_H
+
+struct cxd2880_config {
+	struct spi_device *spi;
+	struct mutex *spi_mutex; /* For SPI access exclusive control */
+};
+
+#if IS_REACHABLE(CONFIG_DVB_CXD2880)
+extern struct dvb_frontend *cxd2880_attach(struct dvb_frontend *fe,
+					struct cxd2880_config *cfg);
+#else
+static inline struct dvb_frontend *cxd2880_attach(struct dvb_frontend *fe,
+					struct cxd2880_config *cfg)
+{
+	pr_warn("%s: driver disabled by Kconfig\n", __func__);
+	return NULL;
+}
+#endif /* CONFIG_DVB_CXD2880 */
+
+#endif /* CXD2880_H */
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_common.c b/drivers/media/dvb-frontends/cxd2880/cxd2880_common.c
new file mode 100644
index 000000000000..850f3a76b2c7
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_common.c
@@ -0,0 +1,84 @@
+/*
+ * cxd2880_common.c
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * common functions
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "cxd2880_common.h"
+
+#define MASKUPPER(n) (((n) == 0) ? 0 : (0xFFFFFFFFU << (32 - (n))))
+#define MASKLOWER(n) (((n) == 0) ? 0 : (0xFFFFFFFFU >> (32 - (n))))
+
+int cxd2880_convert2s_complement(u32 value, u32 bitlen)
+{
+	if ((bitlen == 0) || (bitlen >= 32))
+		return (int)value;
+
+	if (value & (u32)(1 << (bitlen - 1)))
+		return (int)(MASKUPPER(32 - bitlen) | value);
+	else
+		return (int)(MASKLOWER(bitlen) & value);
+}
+
+u32 cxd2880_bit_split_from_byte_array(u8 *array, u32 start_bit, u32 bit_num)
+{
+	u32 value = 0;
+	u8 *array_read;
+	u8 bit_read;
+	u32 len_remain;
+
+	if (!array)
+		return 0;
+	if ((bit_num == 0) || (bit_num > 32))
+		return 0;
+
+	array_read = array + (start_bit / 8);
+	bit_read = (u8)(start_bit % 8);
+	len_remain = bit_num;
+
+	if (bit_read != 0) {
+		if (((int)len_remain) <= 8 - bit_read) {
+			value = (*array_read) >> ((8 - bit_read) - len_remain);
+			len_remain = 0;
+		} else {
+			value = *array_read++;
+			len_remain -= 8 - bit_read;
+		}
+	}
+
+	while (len_remain > 0) {
+		if (len_remain < 8) {
+			value <<= len_remain;
+			value |= (*array_read++ >> (8 - len_remain));
+			len_remain = 0;
+		} else {
+			value <<= 8;
+			value |= (u32)(*array_read++);
+			len_remain -= 8;
+		}
+	}
+
+	value &= MASKLOWER(bit_num);
+
+	return value;
+}
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_common.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_common.h
new file mode 100644
index 000000000000..b1ecb44bca10
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_common.h
@@ -0,0 +1,86 @@
+/*
+ * cxd2880_common.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver common definitions
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_COMMON_H
+#define CXD2880_COMMON_H
+
+#include <linux/types.h>
+
+#ifndef NULL
+#ifdef __cplusplus
+#define NULL 0
+#else
+#define NULL ((void *)0)
+#endif
+#endif
+
+#include <linux/delay.h>
+#define CXD2880_SLEEP(n) msleep(n)
+#ifndef CXD2880_SLEEP_IN_MON
+#define CXD2880_SLEEP_IN_MON(n, obj) CXD2880_SLEEP(n)
+#endif
+
+#define CXD2880_ARG_UNUSED(arg) ((void)(arg))
+
+enum cxd2880_ret {
+	CXD2880_RESULT_OK,
+	CXD2880_RESULT_ERROR_ARG,
+	CXD2880_RESULT_ERROR_IO,
+	CXD2880_RESULT_ERROR_SW_STATE,
+	CXD2880_RESULT_ERROR_HW_STATE,
+	CXD2880_RESULT_ERROR_TIMEOUT,
+	CXD2880_RESULT_ERROR_UNLOCK,
+	CXD2880_RESULT_ERROR_RANGE,
+	CXD2880_RESULT_ERROR_NOSUPPORT,
+	CXD2880_RESULT_ERROR_CANCEL,
+	CXD2880_RESULT_ERROR_OTHER,
+	CXD2880_RESULT_ERROR_OVERFLOW,
+	CXD2880_RESULT_OK_CONFIRM
+};
+
+int cxd2880_convert2s_complement(u32 value, u32 bitlen);
+
+u32 cxd2880_bit_split_from_byte_array(u8 *array, u32 start_bit, u32 bit_num);
+
+struct cxd2880_atomic {
+	int counter;
+};
+
+#define cxd2880_atomic_set(a, i) ((a)->counter = i)
+#define cxd2880_atomic_read(a) ((a)->counter)
+
+struct cxd2880_stopwatch {
+	u32 start_time;
+};
+
+enum cxd2880_ret cxd2880_stopwatch_start(struct cxd2880_stopwatch *stopwatch);
+
+enum cxd2880_ret cxd2880_stopwatch_sleep(struct cxd2880_stopwatch *stopwatch,
+					 u32 ms);
+
+enum cxd2880_ret cxd2880_stopwatch_elapsed(struct cxd2880_stopwatch *stopwatch,
+					   u32 *elapsed);
+
+#endif
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_devio_spi.c b/drivers/media/dvb-frontends/cxd2880/cxd2880_devio_spi.c
new file mode 100644
index 000000000000..516efade6bf5
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_devio_spi.c
@@ -0,0 +1,147 @@
+/*
+ * cxd2880_devio_spi.c
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * I/O interface via SPI
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "cxd2880_devio_spi.h"
+#include "cxd2880_stdlib.h"
+
+#define BURST_WRITE_MAX 128
+
+static enum cxd2880_ret cxd2880_io_spi_read_reg(struct cxd2880_io *io,
+						enum cxd2880_io_tgt tgt,
+						u8 sub_address, u8 *data,
+						u32 size)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	struct cxd2880_spi *spi = NULL;
+	u8 send_data[6];
+	u8 *read_data_top = data;
+
+	if ((!io) || (!io->if_object) || (!data))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (sub_address + size > 0x100)
+		return CXD2880_RESULT_ERROR_RANGE;
+
+	spi = (struct cxd2880_spi *)(io->if_object);
+
+	if (tgt == CXD2880_IO_TGT_SYS)
+		send_data[0] = 0x0B;
+	else
+		send_data[0] = 0x0A;
+
+	send_data[3] = 0;
+	send_data[4] = 0;
+	send_data[5] = 0;
+
+	while (size > 0) {
+		send_data[1] = sub_address;
+		if (size > 255)
+			send_data[2] = 255;
+		else
+			send_data[2] = (u8)size;
+
+		ret =
+		    spi->write_read(spi, send_data, sizeof(send_data),
+				    read_data_top, send_data[2]);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		sub_address += send_data[2];
+		read_data_top += send_data[2];
+		size -= send_data[2];
+	}
+
+	return ret;
+}
+
+static enum cxd2880_ret cxd2880_io_spi_write_reg(struct cxd2880_io *io,
+						 enum cxd2880_io_tgt tgt,
+						 u8 sub_address,
+						 const u8 *data, u32 size)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	struct cxd2880_spi *spi = NULL;
+	u8 send_data[BURST_WRITE_MAX + 4];
+	const u8 *write_data_top = data;
+
+	if ((!io) || (!io->if_object) || (!data))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (size > BURST_WRITE_MAX)
+		return CXD2880_RESULT_ERROR_OVERFLOW;
+
+	if (sub_address + size > 0x100)
+		return CXD2880_RESULT_ERROR_RANGE;
+
+	spi = (struct cxd2880_spi *)(io->if_object);
+
+	if (tgt == CXD2880_IO_TGT_SYS)
+		send_data[0] = 0x0F;
+	else
+		send_data[0] = 0x0E;
+
+	while (size > 0) {
+		send_data[1] = sub_address;
+		if (size > 255)
+			send_data[2] = 255;
+		else
+			send_data[2] = (u8)size;
+
+		cxd2880_memcpy(&send_data[3], write_data_top, send_data[2]);
+
+		if (tgt == CXD2880_IO_TGT_SYS) {
+			send_data[3 + send_data[2]] = 0x00;
+			ret = spi->write(spi, send_data, send_data[2] + 4);
+		} else {
+			ret = spi->write(spi, send_data, send_data[2] + 3);
+		}
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		sub_address += send_data[2];
+		write_data_top += send_data[2];
+		size -= send_data[2];
+	}
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_io_spi_create(struct cxd2880_io *io,
+				       struct cxd2880_spi *spi, u8 slave_select)
+{
+	if ((!io) || (!spi))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	io->read_regs = cxd2880_io_spi_read_reg;
+	io->write_regs = cxd2880_io_spi_write_reg;
+	io->write_reg = cxd2880_io_common_write_one_reg;
+	io->if_object = spi;
+	io->i2c_address_sys = 0;
+	io->i2c_address_demod = 0;
+	io->slave_select = slave_select;
+
+	return CXD2880_RESULT_OK;
+}
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_devio_spi.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_devio_spi.h
new file mode 100644
index 000000000000..15934bf11935
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_devio_spi.h
@@ -0,0 +1,40 @@
+/*
+ * cxd2880_devio_spi.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * I/O interface via SPI
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_DEVIO_SPI_H
+#define CXD2880_DEVIO_SPI_H
+
+#include "cxd2880_common.h"
+#include "cxd2880_io.h"
+#include "cxd2880_spi.h"
+
+#include "cxd2880_tnrdmd.h"
+
+enum cxd2880_ret cxd2880_io_spi_create(struct cxd2880_io *io,
+				       struct cxd2880_spi *spi,
+				       u8 slave_select);
+
+#endif
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_dtv.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_dtv.h
new file mode 100644
index 000000000000..7de098d556fe
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_dtv.h
@@ -0,0 +1,50 @@
+/*
+ * cxd2880_dtv.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * DTV related definitions
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_DTV_H
+#define CXD2880_DTV_H
+
+enum cxd2880_dtv_sys {
+	CXD2880_DTV_SYS_UNKNOWN,
+	CXD2880_DTV_SYS_DVBT,
+	CXD2880_DTV_SYS_DVBT2,
+	CXD2880_DTV_SYS_ISDBT,
+	CXD2880_DTV_SYS_ISDBTSB,
+	CXD2880_DTV_SYS_ISDBTMM_A,
+	CXD2880_DTV_SYS_ISDBTMM_B,
+	CXD2880_DTV_SYS_ANY
+};
+
+enum cxd2880_dtv_bandwidth {
+	CXD2880_DTV_BW_UNKNOWN = 0,
+	CXD2880_DTV_BW_1_7_MHZ = 1,
+	CXD2880_DTV_BW_5_MHZ = 5,
+	CXD2880_DTV_BW_6_MHZ = 6,
+	CXD2880_DTV_BW_7_MHZ = 7,
+	CXD2880_DTV_BW_8_MHZ = 8
+};
+
+#endif
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_dvbt.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_dvbt.h
new file mode 100644
index 000000000000..345c094760d2
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_dvbt.h
@@ -0,0 +1,91 @@
+/*
+ * cxd2880_dvbt.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * DVB-T related definitions
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_DVBT_H
+#define CXD2880_DVBT_H
+
+#include "cxd2880_common.h"
+
+enum cxd2880_dvbt_constellation {
+	CXD2880_DVBT_CONSTELLATION_QPSK,
+	CXD2880_DVBT_CONSTELLATION_16QAM,
+	CXD2880_DVBT_CONSTELLATION_64QAM,
+	CXD2880_DVBT_CONSTELLATION_RESERVED_3
+};
+
+enum cxd2880_dvbt_hierarchy {
+	CXD2880_DVBT_HIERARCHY_NON,
+	CXD2880_DVBT_HIERARCHY_1,
+	CXD2880_DVBT_HIERARCHY_2,
+	CXD2880_DVBT_HIERARCHY_4
+};
+
+enum cxd2880_dvbt_coderate {
+	CXD2880_DVBT_CODERATE_1_2,
+	CXD2880_DVBT_CODERATE_2_3,
+	CXD2880_DVBT_CODERATE_3_4,
+	CXD2880_DVBT_CODERATE_5_6,
+	CXD2880_DVBT_CODERATE_7_8,
+	CXD2880_DVBT_CODERATE_RESERVED_5,
+	CXD2880_DVBT_CODERATE_RESERVED_6,
+	CXD2880_DVBT_CODERATE_RESERVED_7
+};
+
+enum cxd2880_dvbt_guard {
+	CXD2880_DVBT_GUARD_1_32,
+	CXD2880_DVBT_GUARD_1_16,
+	CXD2880_DVBT_GUARD_1_8,
+	CXD2880_DVBT_GUARD_1_4
+};
+
+enum cxd2880_dvbt_mode {
+	CXD2880_DVBT_MODE_2K,
+	CXD2880_DVBT_MODE_8K,
+	CXD2880_DVBT_MODE_RESERVED_2,
+	CXD2880_DVBT_MODE_RESERVED_3
+};
+
+enum cxd2880_dvbt_profile {
+	CXD2880_DVBT_PROFILE_HP = 0,
+	CXD2880_DVBT_PROFILE_LP
+};
+
+struct cxd2880_dvbt_tpsinfo {
+	enum cxd2880_dvbt_constellation constellation;
+	enum cxd2880_dvbt_hierarchy hierarchy;
+	enum cxd2880_dvbt_coderate rate_hp;
+	enum cxd2880_dvbt_coderate rate_lp;
+	enum cxd2880_dvbt_guard guard;
+	enum cxd2880_dvbt_mode mode;
+	u8 fnum;
+	u8 length_indicator;
+	u16 cell_id;
+	u8 cell_id_ok;
+	u8 reserved_even;
+	u8 reserved_odd;
+};
+
+#endif
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_dvbt2.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_dvbt2.h
new file mode 100644
index 000000000000..1870398cba9d
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_dvbt2.h
@@ -0,0 +1,402 @@
+/*
+ * cxd2880_dvbt2.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * DVB-T2 related definitions
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_DVBT2_H
+#define CXD2880_DVBT2_H
+
+#include "cxd2880_common.h"
+
+enum cxd2880_dvbt2_profile {
+	CXD2880_DVBT2_PROFILE_BASE,
+	CXD2880_DVBT2_PROFILE_LITE,
+	CXD2880_DVBT2_PROFILE_ANY
+};
+
+enum cxd2880_dvbt2_version {
+	CXD2880_DVBT2_V111,
+	CXD2880_DVBT2_V121,
+	CXD2880_DVBT2_V131
+};
+
+enum cxd2880_dvbt2_s1 {
+	CXD2880_DVBT2_S1_BASE_SISO = 0x00,
+	CXD2880_DVBT2_S1_BASE_MISO = 0x01,
+	CXD2880_DVBT2_S1_NON_DVBT2 = 0x02,
+	CXD2880_DVBT2_S1_LITE_SISO = 0x03,
+	CXD2880_DVBT2_S1_LITE_MISO = 0x04,
+	CXD2880_DVBT2_S1_RSVD3 = 0x05,
+	CXD2880_DVBT2_S1_RSVD4 = 0x06,
+	CXD2880_DVBT2_S1_RSVD5 = 0x07,
+	CXD2880_DVBT2_S1_UNKNOWN = 0xFF
+};
+
+enum cxd2880_dvbt2_base_s2 {
+	CXD2880_DVBT2_BASE_S2_M2K_G_ANY = 0x00,
+	CXD2880_DVBT2_BASE_S2_M8K_G_DVBT = 0x01,
+	CXD2880_DVBT2_BASE_S2_M4K_G_ANY = 0x02,
+	CXD2880_DVBT2_BASE_S2_M1K_G_ANY = 0x03,
+	CXD2880_DVBT2_BASE_S2_M16K_G_ANY = 0x04,
+	CXD2880_DVBT2_BASE_S2_M32K_G_DVBT = 0x05,
+	CXD2880_DVBT2_BASE_S2_M8K_G_DVBT2 = 0x06,
+	CXD2880_DVBT2_BASE_S2_M32K_G_DVBT2 = 0x07,
+	CXD2880_DVBT2_BASE_S2_UNKNOWN = 0xFF
+};
+
+enum cxd2880_dvbt2_lite_s2 {
+	CXD2880_DVBT2_LITE_S2_M2K_G_ANY = 0x00,
+	CXD2880_DVBT2_LITE_S2_M8K_G_DVBT = 0x01,
+	CXD2880_DVBT2_LITE_S2_M4K_G_ANY = 0x02,
+	CXD2880_DVBT2_LITE_S2_M16K_G_DVBT2 = 0x03,
+	CXD2880_DVBT2_LITE_S2_M16K_G_DVBT = 0x04,
+	CXD2880_DVBT2_LITE_S2_RSVD1 = 0x05,
+	CXD2880_DVBT2_LITE_S2_M8K_G_DVBT2 = 0x06,
+	CXD2880_DVBT2_LITE_S2_RSVD2 = 0x07,
+	CXD2880_DVBT2_LITE_S2_UNKNOWN = 0xFF
+};
+
+enum cxd2880_dvbt2_guard {
+	CXD2880_DVBT2_G1_32 = 0x00,
+	CXD2880_DVBT2_G1_16 = 0x01,
+	CXD2880_DVBT2_G1_8 = 0x02,
+	CXD2880_DVBT2_G1_4 = 0x03,
+	CXD2880_DVBT2_G1_128 = 0x04,
+	CXD2880_DVBT2_G19_128 = 0x05,
+	CXD2880_DVBT2_G19_256 = 0x06,
+	CXD2880_DVBT2_G_RSVD1 = 0x07,
+	CXD2880_DVBT2_G_UNKNOWN = 0xFF
+};
+
+enum cxd2880_dvbt2_mode {
+	CXD2880_DVBT2_M2K = 0x00,
+	CXD2880_DVBT2_M8K = 0x01,
+	CXD2880_DVBT2_M4K = 0x02,
+	CXD2880_DVBT2_M1K = 0x03,
+	CXD2880_DVBT2_M16K = 0x04,
+	CXD2880_DVBT2_M32K = 0x05,
+	CXD2880_DVBT2_M_RSVD1 = 0x06,
+	CXD2880_DVBT2_M_RSVD2 = 0x07
+};
+
+enum cxd2880_dvbt2_bw {
+	CXD2880_DVBT2_BW_8 = 0x00,
+	CXD2880_DVBT2_BW_7 = 0x01,
+	CXD2880_DVBT2_BW_6 = 0x02,
+	CXD2880_DVBT2_BW_5 = 0x03,
+	CXD2880_DVBT2_BW_10 = 0x04,
+	CXD2880_DVBT2_BW_1_7 = 0x05,
+	CXD2880_DVBT2_BW_RSVD1 = 0x06,
+	CXD2880_DVBT2_BW_RSVD2 = 0x07,
+	CXD2880_DVBT2_BW_RSVD3 = 0x08,
+	CXD2880_DVBT2_BW_RSVD4 = 0x09,
+	CXD2880_DVBT2_BW_RSVD5 = 0x0A,
+	CXD2880_DVBT2_BW_RSVD6 = 0x0B,
+	CXD2880_DVBT2_BW_RSVD7 = 0x0C,
+	CXD2880_DVBT2_BW_RSVD8 = 0x0D,
+	CXD2880_DVBT2_BW_RSVD9 = 0x0E,
+	CXD2880_DVBT2_BW_RSVD10 = 0x0F,
+	CXD2880_DVBT2_BW_UNKNOWN = 0xFF
+};
+
+enum cxd2880_dvbt2_l1pre_type {
+	CXD2880_DVBT2_L1PRE_TYPE_TS = 0x00,
+	CXD2880_DVBT2_L1PRE_TYPE_GS = 0x01,
+	CXD2880_DVBT2_L1PRE_TYPE_TS_GS = 0x02,
+	CXD2880_DVBT2_L1PRE_TYPE_RESERVED = 0x03,
+	CXD2880_DVBT2_L1PRE_TYPE_UNKNOWN = 0xFF
+};
+
+enum cxd2880_dvbt2_papr {
+	CXD2880_DVBT2_PAPR_0 = 0x00,
+	CXD2880_DVBT2_PAPR_1 = 0x01,
+	CXD2880_DVBT2_PAPR_2 = 0x02,
+	CXD2880_DVBT2_PAPR_3 = 0x03,
+	CXD2880_DVBT2_PAPR_RSVD1 = 0x04,
+	CXD2880_DVBT2_PAPR_RSVD2 = 0x05,
+	CXD2880_DVBT2_PAPR_RSVD3 = 0x06,
+	CXD2880_DVBT2_PAPR_RSVD4 = 0x07,
+	CXD2880_DVBT2_PAPR_RSVD5 = 0x08,
+	CXD2880_DVBT2_PAPR_RSVD6 = 0x09,
+	CXD2880_DVBT2_PAPR_RSVD7 = 0x0A,
+	CXD2880_DVBT2_PAPR_RSVD8 = 0x0B,
+	CXD2880_DVBT2_PAPR_RSVD9 = 0x0C,
+	CXD2880_DVBT2_PAPR_RSVD10 = 0x0D,
+	CXD2880_DVBT2_PAPR_RSVD11 = 0x0E,
+	CXD2880_DVBT2_PAPR_RSVD12 = 0x0F,
+	CXD2880_DVBT2_PAPR_UNKNOWN = 0xFF
+};
+
+enum cxd2880_dvbt2_l1post_constell {
+	CXD2880_DVBT2_L1POST_BPSK = 0x00,
+	CXD2880_DVBT2_L1POST_QPSK = 0x01,
+	CXD2880_DVBT2_L1POST_QAM16 = 0x02,
+	CXD2880_DVBT2_L1POST_QAM64 = 0x03,
+	CXD2880_DVBT2_L1POST_C_RSVD1 = 0x04,
+	CXD2880_DVBT2_L1POST_C_RSVD2 = 0x05,
+	CXD2880_DVBT2_L1POST_C_RSVD3 = 0x06,
+	CXD2880_DVBT2_L1POST_C_RSVD4 = 0x07,
+	CXD2880_DVBT2_L1POST_C_RSVD5 = 0x08,
+	CXD2880_DVBT2_L1POST_C_RSVD6 = 0x09,
+	CXD2880_DVBT2_L1POST_C_RSVD7 = 0x0A,
+	CXD2880_DVBT2_L1POST_C_RSVD8 = 0x0B,
+	CXD2880_DVBT2_L1POST_C_RSVD9 = 0x0C,
+	CXD2880_DVBT2_L1POST_C_RSVD10 = 0x0D,
+	CXD2880_DVBT2_L1POST_C_RSVD11 = 0x0E,
+	CXD2880_DVBT2_L1POST_C_RSVD12 = 0x0F,
+	CXD2880_DVBT2_L1POST_CONSTELL_UNKNOWN = 0xFF
+};
+
+enum cxd2880_dvbt2_l1post_cr {
+	CXD2880_DVBT2_L1POST_R1_2 = 0x00,
+	CXD2880_DVBT2_L1POST_R_RSVD1 = 0x01,
+	CXD2880_DVBT2_L1POST_R_RSVD2 = 0x02,
+	CXD2880_DVBT2_L1POST_R_RSVD3 = 0x03,
+	CXD2880_DVBT2_L1POST_R_UNKNOWN = 0xFF
+};
+
+enum cxd2880_dvbt2_l1post_fec_type {
+	CXD2880_DVBT2_L1POST_FEC_LDPC16K = 0x00,
+	CXD2880_DVBT2_L1POST_FEC_RSVD1 = 0x01,
+	CXD2880_DVBT2_L1POST_FEC_RSVD2 = 0x02,
+	CXD2880_DVBT2_L1POST_FEC_RSVD3 = 0x03,
+	CXD2880_DVBT2_L1POST_FEC_UNKNOWN = 0xFF
+};
+
+enum cxd2880_dvbt2_pp {
+	CXD2880_DVBT2_PP1 = 0x00,
+	CXD2880_DVBT2_PP2 = 0x01,
+	CXD2880_DVBT2_PP3 = 0x02,
+	CXD2880_DVBT2_PP4 = 0x03,
+	CXD2880_DVBT2_PP5 = 0x04,
+	CXD2880_DVBT2_PP6 = 0x05,
+	CXD2880_DVBT2_PP7 = 0x06,
+	CXD2880_DVBT2_PP8 = 0x07,
+	CXD2880_DVBT2_PP_RSVD1 = 0x08,
+	CXD2880_DVBT2_PP_RSVD2 = 0x09,
+	CXD2880_DVBT2_PP_RSVD3 = 0x0A,
+	CXD2880_DVBT2_PP_RSVD4 = 0x0B,
+	CXD2880_DVBT2_PP_RSVD5 = 0x0C,
+	CXD2880_DVBT2_PP_RSVD6 = 0x0D,
+	CXD2880_DVBT2_PP_RSVD7 = 0x0E,
+	CXD2880_DVBT2_PP_RSVD8 = 0x0F,
+	CXD2880_DVBT2_PP_UNKNOWN = 0xFF
+};
+
+enum cxd2880_dvbt2_plp_code_rate {
+	CXD2880_DVBT2_R1_2 = 0x00,
+	CXD2880_DVBT2_R3_5 = 0x01,
+	CXD2880_DVBT2_R2_3 = 0x02,
+	CXD2880_DVBT2_R3_4 = 0x03,
+	CXD2880_DVBT2_R4_5 = 0x04,
+	CXD2880_DVBT2_R5_6 = 0x05,
+	CXD2880_DVBT2_R1_3 = 0x06,
+	CXD2880_DVBT2_R2_5 = 0x07,
+	CXD2880_DVBT2_PLP_CR_UNKNOWN = 0xFF
+};
+
+enum cxd2880_dvbt2_plp_constell {
+	CXD2880_DVBT2_QPSK = 0x00,
+	CXD2880_DVBT2_QAM16 = 0x01,
+	CXD2880_DVBT2_QAM64 = 0x02,
+	CXD2880_DVBT2_QAM256 = 0x03,
+	CXD2880_DVBT2_CON_RSVD1 = 0x04,
+	CXD2880_DVBT2_CON_RSVD2 = 0x05,
+	CXD2880_DVBT2_CON_RSVD3 = 0x06,
+	CXD2880_DVBT2_CON_RSVD4 = 0x07,
+	CXD2880_DVBT2_CONSTELL_UNKNOWN = 0xFF
+};
+
+enum cxd2880_dvbt2_plp_type {
+	CXD2880_DVBT2_PLP_TYPE_COMMON = 0x00,
+	CXD2880_DVBT2_PLP_TYPE_DATA1 = 0x01,
+	CXD2880_DVBT2_PLP_TYPE_DATA2 = 0x02,
+	CXD2880_DVBT2_PLP_TYPE_RSVD1 = 0x03,
+	CXD2880_DVBT2_PLP_TYPE_RSVD2 = 0x04,
+	CXD2880_DVBT2_PLP_TYPE_RSVD3 = 0x05,
+	CXD2880_DVBT2_PLP_TYPE_RSVD4 = 0x06,
+	CXD2880_DVBT2_PLP_TYPE_RSVD5 = 0x07,
+	CXD2880_DVBT2_PLP_TYPE_UNKNOWN = 0xFF
+};
+
+enum cxd2880_dvbt2_plp_payload {
+	CXD2880_DVBT2_PLP_PAYLOAD_GFPS = 0x00,
+	CXD2880_DVBT2_PLP_PAYLOAD_GCS = 0x01,
+	CXD2880_DVBT2_PLP_PAYLOAD_GSE = 0x02,
+	CXD2880_DVBT2_PLP_PAYLOAD_TS = 0x03,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD1 = 0x04,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD2 = 0x05,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD3 = 0x06,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD4 = 0x07,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD5 = 0x08,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD6 = 0x09,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD7 = 0x0A,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD8 = 0x0B,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD9 = 0x0C,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD10 = 0x0D,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD11 = 0x0E,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD12 = 0x0F,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD13 = 0x10,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD14 = 0x11,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD15 = 0x12,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD16 = 0x13,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD17 = 0x14,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD18 = 0x15,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD19 = 0x16,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD20 = 0x17,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD21 = 0x18,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD22 = 0x19,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD23 = 0x1A,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD24 = 0x1B,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD25 = 0x1C,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD26 = 0x1D,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD27 = 0x1E,
+	CXD2880_DVBT2_PLP_PAYLOAD_RSVD28 = 0x1F,
+	CXD2880_DVBT2_PLP_PAYLOAD_UNKNOWN = 0xFF
+};
+
+enum cxd2880_dvbt2_plp_fec {
+	CXD2880_DVBT2_FEC_LDPC_16K = 0x00,
+	CXD2880_DVBT2_FEC_LDPC_64K = 0x01,
+	CXD2880_DVBT2_FEC_RSVD1 = 0x02,
+	CXD2880_DVBT2_FEC_RSVD2 = 0x03,
+	CXD2880_DVBT2_FEC_UNKNOWN = 0xFF
+};
+
+enum cxd2880_dvbt2_plp_mode {
+	CXD2880_DVBT2_PLP_MODE_NOTSPECIFIED = 0x00,
+	CXD2880_DVBT2_PLP_MODE_NM = 0x01,
+	CXD2880_DVBT2_PLP_MODE_HEM = 0x02,
+	CXD2880_DVBT2_PLP_MODE_RESERVED = 0x03,
+	CXD2880_DVBT2_PLP_MODE_UNKNOWN = 0xFF
+};
+
+enum cxd2880_dvbt2_plp_btype {
+	CXD2880_DVBT2_PLP_COMMON,
+	CXD2880_DVBT2_PLP_DATA
+};
+
+enum cxd2880_dvbt2_stream {
+	CXD2880_DVBT2_STREAM_GENERIC_PACKETIZED = 0x00,
+	CXD2880_DVBT2_STREAM_GENERIC_CONTINUOUS = 0x01,
+	CXD2880_DVBT2_STREAM_GENERIC_ENCAPSULATED = 0x02,
+	CXD2880_DVBT2_STREAM_TRANSPORT = 0x03,
+	CXD2880_DVBT2_STREAM_UNKNOWN = 0xFF
+};
+
+struct cxd2880_dvbt2_l1pre {
+	enum cxd2880_dvbt2_l1pre_type type;
+	u8 bw_ext;
+	enum cxd2880_dvbt2_s1 s1;
+	u8 s2;
+	u8 mixed;
+	enum cxd2880_dvbt2_mode fft_mode;
+	u8 l1_rep;
+	enum cxd2880_dvbt2_guard gi;
+	enum cxd2880_dvbt2_papr papr;
+	enum cxd2880_dvbt2_l1post_constell mod;
+	enum cxd2880_dvbt2_l1post_cr cr;
+	enum cxd2880_dvbt2_l1post_fec_type fec;
+	u32 l1_post_size;
+	u32 l1_post_info_size;
+	enum cxd2880_dvbt2_pp pp;
+	u8 tx_id_availability;
+	u16 cell_id;
+	u16 network_id;
+	u16 sys_id;
+	u8 num_frames;
+	u16 num_symbols;
+	u8 regen;
+	u8 post_ext;
+	u8 num_rf_freqs;
+	u8 rf_idx;
+	enum cxd2880_dvbt2_version t2_version;
+	u8 l1_post_scrambled;
+	u8 t2_base_lite;
+	u32 crc32;
+};
+
+struct cxd2880_dvbt2_plp {
+	u8 id;
+	enum cxd2880_dvbt2_plp_type type;
+	enum cxd2880_dvbt2_plp_payload payload;
+	u8 ff;
+	u8 first_rf_idx;
+	u8 first_frm_idx;
+	u8 group_id;
+	enum cxd2880_dvbt2_plp_constell constell;
+	enum cxd2880_dvbt2_plp_code_rate plp_cr;
+	u8 rot;
+	enum cxd2880_dvbt2_plp_fec fec;
+	u16 num_blocks_max;
+	u8 frm_int;
+	u8 til_len;
+	u8 til_type;
+	u8 in_band_a_flag;
+	u8 in_band_b_flag;
+	u16 rsvd;
+	enum cxd2880_dvbt2_plp_mode plp_mode;
+	u8 static_flag;
+	u8 static_padding_flag;
+};
+
+struct cxd2880_dvbt2_l1post {
+	u16 sub_slices_per_frame;
+	u8 num_plps;
+	u8 num_aux;
+	u8 aux_cfg_rfu;
+	u8 rf_idx;
+	u32 freq;
+	u8 fef_type;
+	u32 fef_length;
+	u8 fef_intvl;
+};
+
+struct cxd2880_dvbt2_ofdm {
+	u8 mixed;
+	u8 is_miso;
+	enum cxd2880_dvbt2_mode mode;
+	enum cxd2880_dvbt2_guard gi;
+	enum cxd2880_dvbt2_pp pp;
+	u8 bw_ext;
+	enum cxd2880_dvbt2_papr papr;
+	u16 num_symbols;
+};
+
+struct cxd2880_dvbt2_bbheader {
+	enum cxd2880_dvbt2_stream stream_input;
+	u8 is_single_input_stream;
+	u8 is_constant_coding_modulation;
+	u8 issy_indicator;
+	u8 null_packet_deletion;
+	u8 ext;
+	u8 input_stream_identifier;
+	u16 user_packet_length;
+	u16 data_field_length;
+	u8 sync_byte;
+	u32 issy;
+	enum cxd2880_dvbt2_plp_mode plp_mode;
+};
+
+#endif
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_integ.c b/drivers/media/dvb-frontends/cxd2880/cxd2880_integ.c
new file mode 100644
index 000000000000..5ad6685e2a1d
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_integ.c
@@ -0,0 +1,99 @@
+/*
+ * cxd2880_integ.c
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * integration layer common functions
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "cxd2880_tnrdmd.h"
+#include "cxd2880_tnrdmd_mon.h"
+#include "cxd2880_integ.h"
+
+enum cxd2880_ret cxd2880_integ_init(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	struct cxd2880_stopwatch timer;
+	u32 elapsed_time = 0;
+	u8 cpu_task_completed = 0;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret = cxd2880_tnrdmd_init1(tnr_dmd);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret = cxd2880_stopwatch_start(&timer);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	while (1) {
+		ret = cxd2880_stopwatch_elapsed(&timer, &elapsed_time);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		ret =
+		    cxd2880_tnrdmd_check_internal_cpu_status(tnr_dmd,
+						     &cpu_task_completed);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (cpu_task_completed)
+			break;
+
+		if (elapsed_time > CXD2880_TNRDMD_WAIT_INIT_TIMEOUT)
+			return CXD2880_RESULT_ERROR_TIMEOUT;
+		ret =
+		    cxd2880_stopwatch_sleep(&timer,
+					    CXD2880_TNRDMD_WAIT_INIT_INTVL);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	ret = cxd2880_tnrdmd_init2(tnr_dmd);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_integ_cancel(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	cxd2880_atomic_set(&tnr_dmd->cancel, 1);
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_integ_check_cancellation(struct cxd2880_tnrdmd
+						  *tnr_dmd)
+{
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (cxd2880_atomic_read(&tnr_dmd->cancel) != 0)
+		return CXD2880_RESULT_ERROR_CANCEL;
+
+	return CXD2880_RESULT_OK;
+}
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_integ.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_integ.h
new file mode 100644
index 000000000000..9cfc52dbf9d4
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_integ.h
@@ -0,0 +1,44 @@
+/*
+ * cxd2880_integ.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * integration layer common interface
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_INTEG_H
+#define CXD2880_INTEG_H
+
+#include "cxd2880_tnrdmd.h"
+
+#define CXD2880_TNRDMD_WAIT_INIT_TIMEOUT	500
+#define CXD2880_TNRDMD_WAIT_INIT_INTVL	10
+
+#define CXD2880_TNRDMD_WAIT_AGC_STABLE		100
+
+enum cxd2880_ret cxd2880_integ_init(struct cxd2880_tnrdmd *tnr_dmd);
+
+enum cxd2880_ret cxd2880_integ_cancel(struct cxd2880_tnrdmd *tnr_dmd);
+
+enum cxd2880_ret cxd2880_integ_check_cancellation(struct cxd2880_tnrdmd
+						  *tnr_dmd);
+
+#endif
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_integ_dvbt.c b/drivers/media/dvb-frontends/cxd2880/cxd2880_integ_dvbt.c
new file mode 100644
index 000000000000..43b7da69fc6d
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_integ_dvbt.c
@@ -0,0 +1,197 @@
+/*
+ * cxd2880_integ_dvbt.c
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * integration layer functions for DVB-T
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "cxd2880_tnrdmd_dvbt.h"
+#include "cxd2880_integ_dvbt.h"
+
+static enum cxd2880_ret dvbt_wait_demod_lock(struct cxd2880_tnrdmd *tnr_dmd);
+
+enum cxd2880_ret cxd2880_integ_dvbt_tune(struct cxd2880_tnrdmd *tnr_dmd,
+					 struct cxd2880_dvbt_tune_param
+					 *tune_param)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!tune_param))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	cxd2880_atomic_set(&tnr_dmd->cancel, 0);
+
+	if ((tune_param->bandwidth != CXD2880_DTV_BW_5_MHZ) &&
+	    (tune_param->bandwidth != CXD2880_DTV_BW_6_MHZ) &&
+	    (tune_param->bandwidth != CXD2880_DTV_BW_7_MHZ) &&
+	    (tune_param->bandwidth != CXD2880_DTV_BW_8_MHZ)) {
+		return CXD2880_RESULT_ERROR_NOSUPPORT;
+	}
+
+	ret = cxd2880_tnrdmd_dvbt_tune1(tnr_dmd, tune_param);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	CXD2880_SLEEP(CXD2880_TNRDMD_WAIT_AGC_STABLE);
+
+	ret = cxd2880_tnrdmd_dvbt_tune2(tnr_dmd, tune_param);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret = dvbt_wait_demod_lock(tnr_dmd);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_integ_dvbt_wait_ts_lock(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	enum cxd2880_tnrdmd_lock_result lock =
+	    CXD2880_TNRDMD_LOCK_RESULT_NOTDETECT;
+	struct cxd2880_stopwatch timer;
+	u8 continue_wait = 1;
+	u32 elapsed = 0;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret = cxd2880_stopwatch_start(&timer);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	for (;;) {
+		ret = cxd2880_stopwatch_elapsed(&timer, &elapsed);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (elapsed >= CXD2880_DVBT_WAIT_TS_LOCK)
+			continue_wait = 0;
+
+		ret = cxd2880_tnrdmd_dvbt_check_ts_lock(tnr_dmd, &lock);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		switch (lock) {
+		case CXD2880_TNRDMD_LOCK_RESULT_LOCKED:
+			return CXD2880_RESULT_OK;
+
+		case CXD2880_TNRDMD_LOCK_RESULT_UNLOCKED:
+			return CXD2880_RESULT_ERROR_UNLOCK;
+
+		default:
+			break;
+		}
+
+		ret = cxd2880_integ_check_cancellation(tnr_dmd);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (continue_wait) {
+			ret =
+			    cxd2880_stopwatch_sleep(&timer,
+					    CXD2880_DVBT_WAIT_LOCK_INTVL);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+		} else {
+			ret = CXD2880_RESULT_ERROR_TIMEOUT;
+			break;
+		}
+	}
+
+	return ret;
+}
+
+static enum cxd2880_ret dvbt_wait_demod_lock(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	enum cxd2880_tnrdmd_lock_result lock =
+	    CXD2880_TNRDMD_LOCK_RESULT_NOTDETECT;
+	struct cxd2880_stopwatch timer;
+	u8 continue_wait = 1;
+	u32 elapsed = 0;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret = cxd2880_stopwatch_start(&timer);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	for (;;) {
+		ret = cxd2880_stopwatch_elapsed(&timer, &elapsed);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (elapsed >= CXD2880_DVBT_WAIT_DMD_LOCK)
+			continue_wait = 0;
+
+		ret = cxd2880_tnrdmd_dvbt_check_demod_lock(tnr_dmd, &lock);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		switch (lock) {
+		case CXD2880_TNRDMD_LOCK_RESULT_LOCKED:
+			return CXD2880_RESULT_OK;
+
+		case CXD2880_TNRDMD_LOCK_RESULT_UNLOCKED:
+			return CXD2880_RESULT_ERROR_UNLOCK;
+
+		default:
+			break;
+		}
+
+		ret = cxd2880_integ_check_cancellation(tnr_dmd);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (continue_wait) {
+			ret =
+			    cxd2880_stopwatch_sleep(&timer,
+					    CXD2880_DVBT_WAIT_LOCK_INTVL);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+		} else {
+			ret = CXD2880_RESULT_ERROR_TIMEOUT;
+			break;
+		}
+	}
+
+	return ret;
+}
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_integ_dvbt.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_integ_dvbt.h
new file mode 100644
index 000000000000..41f35c07a15e
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_integ_dvbt.h
@@ -0,0 +1,58 @@
+/*
+ * cxd2880_integ_dvbt.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * integration layer interface for DVB-T
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_INTEG_DVBT_H
+#define CXD2880_INTEG_DVBT_H
+
+#include "cxd2880_tnrdmd.h"
+#include "cxd2880_tnrdmd_dvbt.h"
+#include "cxd2880_integ.h"
+
+#define CXD2880_DVBT_WAIT_DMD_LOCK	   1000
+#define CXD2880_DVBT_WAIT_TS_LOCK	      1000
+#define CXD2880_DVBT_WAIT_LOCK_INTVL	10
+
+struct cxd2880_integ_dvbt_scan_param {
+	u32 start_frequency_khz;
+	u32 end_frequency_khz;
+	u32 step_frequency_khz;
+	enum cxd2880_dtv_bandwidth bandwidth;
+};
+
+struct cxd2880_integ_dvbt_scan_result {
+	u32 center_freq_khz;
+	enum cxd2880_ret tune_result;
+	struct cxd2880_dvbt_tune_param dvbt_tune_param;
+};
+
+enum cxd2880_ret cxd2880_integ_dvbt_tune(struct cxd2880_tnrdmd *tnr_dmd,
+					 struct cxd2880_dvbt_tune_param
+					 *tune_param);
+
+enum cxd2880_ret cxd2880_integ_dvbt_wait_ts_lock(struct cxd2880_tnrdmd
+						 *tnr_dmd);
+
+#endif
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_integ_dvbt2.c b/drivers/media/dvb-frontends/cxd2880/cxd2880_integ_dvbt2.c
new file mode 100644
index 000000000000..1d60b9c236d8
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_integ_dvbt2.c
@@ -0,0 +1,311 @@
+/*
+ * cxd2880_integ_dvbt2.c
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * integration layer functions for DVB-T2
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "cxd2880_tnrdmd_dvbt2.h"
+#include "cxd2880_tnrdmd_dvbt2_mon.h"
+#include "cxd2880_integ_dvbt2.h"
+
+static enum cxd2880_ret dvbt2_wait_demod_lock(struct cxd2880_tnrdmd *tnr_dmd,
+					      enum cxd2880_dvbt2_profile
+					      profile);
+
+static enum cxd2880_ret dvbt2_wait_l1_post_lock(struct cxd2880_tnrdmd *tnr_dmd);
+
+enum cxd2880_ret cxd2880_integ_dvbt2_tune(struct cxd2880_tnrdmd *tnr_dmd,
+					  struct cxd2880_dvbt2_tune_param
+					  *tune_param)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!tune_param))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	cxd2880_atomic_set(&tnr_dmd->cancel, 0);
+
+	if ((tune_param->bandwidth != CXD2880_DTV_BW_1_7_MHZ) &&
+	    (tune_param->bandwidth != CXD2880_DTV_BW_5_MHZ) &&
+	    (tune_param->bandwidth != CXD2880_DTV_BW_6_MHZ) &&
+	    (tune_param->bandwidth != CXD2880_DTV_BW_7_MHZ) &&
+	    (tune_param->bandwidth != CXD2880_DTV_BW_8_MHZ)) {
+		return CXD2880_RESULT_ERROR_NOSUPPORT;
+	}
+
+	if ((tune_param->profile != CXD2880_DVBT2_PROFILE_BASE) &&
+	    (tune_param->profile != CXD2880_DVBT2_PROFILE_LITE))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret = cxd2880_tnrdmd_dvbt2_tune1(tnr_dmd, tune_param);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	CXD2880_SLEEP(CXD2880_TNRDMD_WAIT_AGC_STABLE);
+
+	ret = cxd2880_tnrdmd_dvbt2_tune2(tnr_dmd, tune_param);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret = dvbt2_wait_demod_lock(tnr_dmd, tune_param->profile);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret = cxd2880_tnrdmd_dvbt2_diver_fef_setting(tnr_dmd);
+	if (ret == CXD2880_RESULT_ERROR_HW_STATE)
+		return CXD2880_RESULT_ERROR_UNLOCK;
+	else if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret = dvbt2_wait_l1_post_lock(tnr_dmd);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	{
+		u8 plp_not_found;
+
+		ret =
+		    cxd2880_tnrdmd_dvbt2_mon_data_plp_error(tnr_dmd,
+							    &plp_not_found);
+		if (ret == CXD2880_RESULT_ERROR_HW_STATE)
+			return CXD2880_RESULT_ERROR_UNLOCK;
+		else if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (plp_not_found) {
+			ret = CXD2880_RESULT_OK_CONFIRM;
+			tune_param->tune_info =
+			    CXD2880_TNRDMD_DVBT2_TUNE_INFO_INVALID_PLP_ID;
+		} else {
+			tune_param->tune_info =
+			    CXD2880_TNRDMD_DVBT2_TUNE_INFO_OK;
+		}
+	}
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_integ_dvbt2_wait_ts_lock(struct cxd2880_tnrdmd
+						  *tnr_dmd,
+						  enum cxd2880_dvbt2_profile
+						  profile)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	enum cxd2880_tnrdmd_lock_result lock =
+	    CXD2880_TNRDMD_LOCK_RESULT_NOTDETECT;
+	u16 timeout = 0;
+	struct cxd2880_stopwatch timer;
+	u8 continue_wait = 1;
+	u32 elapsed = 0;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret = cxd2880_stopwatch_start(&timer);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (profile == CXD2880_DVBT2_PROFILE_BASE)
+		timeout = CXD2880_DVBT2_BASE_WAIT_TS_LOCK;
+	else if (profile == CXD2880_DVBT2_PROFILE_LITE)
+		timeout = CXD2880_DVBT2_LITE_WAIT_TS_LOCK;
+	else
+		return CXD2880_RESULT_ERROR_ARG;
+
+	for (;;) {
+		ret = cxd2880_stopwatch_elapsed(&timer, &elapsed);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (elapsed >= timeout)
+			continue_wait = 0;
+
+		ret = cxd2880_tnrdmd_dvbt2_check_ts_lock(tnr_dmd, &lock);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		switch (lock) {
+		case CXD2880_TNRDMD_LOCK_RESULT_LOCKED:
+			return CXD2880_RESULT_OK;
+
+		case CXD2880_TNRDMD_LOCK_RESULT_UNLOCKED:
+			return CXD2880_RESULT_ERROR_UNLOCK;
+
+		default:
+			break;
+		}
+
+		ret = cxd2880_integ_check_cancellation(tnr_dmd);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (continue_wait) {
+			ret =
+			    cxd2880_stopwatch_sleep(&timer,
+					    CXD2880_DVBT2_WAIT_LOCK_INTVL);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+		} else {
+			ret = CXD2880_RESULT_ERROR_TIMEOUT;
+			break;
+		}
+	}
+
+	return ret;
+}
+
+static enum cxd2880_ret dvbt2_wait_demod_lock(struct cxd2880_tnrdmd *tnr_dmd,
+					      enum cxd2880_dvbt2_profile
+					      profile)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	enum cxd2880_tnrdmd_lock_result lock =
+	    CXD2880_TNRDMD_LOCK_RESULT_NOTDETECT;
+	u16 timeout = 0;
+	struct cxd2880_stopwatch timer;
+	u8 continue_wait = 1;
+	u32 elapsed = 0;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret = cxd2880_stopwatch_start(&timer);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (profile == CXD2880_DVBT2_PROFILE_BASE)
+		timeout = CXD2880_DVBT2_BASE_WAIT_DMD_LOCK;
+	else if ((profile == CXD2880_DVBT2_PROFILE_LITE) ||
+		 (profile == CXD2880_DVBT2_PROFILE_ANY))
+		timeout = CXD2880_DVBT2_LITE_WAIT_DMD_LOCK;
+	else
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	for (;;) {
+		ret = cxd2880_stopwatch_elapsed(&timer, &elapsed);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (elapsed >= timeout)
+			continue_wait = 0;
+
+		ret = cxd2880_tnrdmd_dvbt2_check_demod_lock(tnr_dmd, &lock);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		switch (lock) {
+		case CXD2880_TNRDMD_LOCK_RESULT_LOCKED:
+			return CXD2880_RESULT_OK;
+
+		case CXD2880_TNRDMD_LOCK_RESULT_UNLOCKED:
+			return CXD2880_RESULT_ERROR_UNLOCK;
+
+		default:
+			break;
+		}
+
+		ret = cxd2880_integ_check_cancellation(tnr_dmd);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (continue_wait) {
+			ret =
+			    cxd2880_stopwatch_sleep(&timer,
+					    CXD2880_DVBT2_WAIT_LOCK_INTVL);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+		} else {
+			ret = CXD2880_RESULT_ERROR_TIMEOUT;
+			break;
+		}
+	}
+
+	return ret;
+}
+
+static enum cxd2880_ret dvbt2_wait_l1_post_lock(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	struct cxd2880_stopwatch timer;
+	u8 continue_wait = 1;
+	u32 elapsed = 0;
+	u8 l1_post_valid;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret = cxd2880_stopwatch_start(&timer);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	for (;;) {
+		ret = cxd2880_stopwatch_elapsed(&timer, &elapsed);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (elapsed >= CXD2880_DVBT2_L1POST_TIMEOUT)
+			continue_wait = 0;
+
+		ret =
+		    cxd2880_tnrdmd_dvbt2_check_l1post_valid(tnr_dmd,
+							    &l1_post_valid);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (l1_post_valid)
+			return CXD2880_RESULT_OK;
+
+		ret = cxd2880_integ_check_cancellation(tnr_dmd);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (continue_wait) {
+			ret =
+			    cxd2880_stopwatch_sleep(&timer,
+					    CXD2880_DVBT2_WAIT_LOCK_INTVL);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+		} else {
+			ret = CXD2880_RESULT_ERROR_TIMEOUT;
+			break;
+		}
+	}
+
+	return ret;
+}
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_integ_dvbt2.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_integ_dvbt2.h
new file mode 100644
index 000000000000..bc72eb8188f2
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_integ_dvbt2.h
@@ -0,0 +1,64 @@
+/*
+ * cxd2880_integ_dvbt2.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * integration layer interface for DVB-T2
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_INTEG_DVBT2_H
+#define CXD2880_INTEG_DVBT2_H
+
+#include "cxd2880_tnrdmd.h"
+#include "cxd2880_tnrdmd_dvbt2.h"
+#include "cxd2880_integ.h"
+
+#define CXD2880_DVBT2_BASE_WAIT_DMD_LOCK     3500
+#define CXD2880_DVBT2_BASE_WAIT_TS_LOCK	1500
+#define CXD2880_DVBT2_LITE_WAIT_DMD_LOCK     5000
+#define CXD2880_DVBT2_LITE_WAIT_TS_LOCK	2300
+#define CXD2880_DVBT2_WAIT_LOCK_INTVL       10
+#define CXD2880_DVBT2_L1POST_TIMEOUT	   500
+
+struct cxd2880_integ_dvbt2_scan_param {
+	u32 start_frequency_khz;
+	u32 end_frequency_khz;
+	u32 step_frequency_khz;
+	enum cxd2880_dtv_bandwidth bandwidth;
+	enum cxd2880_dvbt2_profile t2_profile;
+};
+
+struct cxd2880_integ_dvbt2_scan_result {
+	u32 center_freq_khz;
+	enum cxd2880_ret tune_result;
+	struct cxd2880_dvbt2_tune_param dvbt2_tune_param;
+};
+
+enum cxd2880_ret cxd2880_integ_dvbt2_tune(struct cxd2880_tnrdmd *tnr_dmd,
+					  struct cxd2880_dvbt2_tune_param
+					  *tune_param);
+
+enum cxd2880_ret cxd2880_integ_dvbt2_wait_ts_lock(struct cxd2880_tnrdmd
+						  *tnr_dmd,
+						  enum cxd2880_dvbt2_profile
+						  profile);
+
+#endif
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_io.c b/drivers/media/dvb-frontends/cxd2880/cxd2880_io.c
new file mode 100644
index 000000000000..f0f82055a953
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_io.c
@@ -0,0 +1,68 @@
+/*
+ * cxd2880_io.c
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * register I/O interface functions
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "cxd2880_io.h"
+
+enum cxd2880_ret cxd2880_io_common_write_one_reg(struct cxd2880_io *io,
+						 enum cxd2880_io_tgt tgt,
+						 u8 sub_address, u8 data)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!io)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret = io->write_regs(io, tgt, sub_address, &data, 1);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_io_set_reg_bits(struct cxd2880_io *io,
+					 enum cxd2880_io_tgt tgt,
+					 u8 sub_address, u8 data, u8 mask)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!io)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (mask == 0x00)
+		return CXD2880_RESULT_OK;
+
+	if (mask != 0xFF) {
+		u8 rdata = 0x00;
+
+		ret = io->read_regs(io, tgt, sub_address, &rdata, 1);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		data = (u8)((data & mask) | (rdata & (mask ^ 0xFF)));
+	}
+
+	ret = io->write_reg(io, tgt, sub_address, data);
+
+	return ret;
+}
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_io.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_io.h
new file mode 100644
index 000000000000..4d6db13cf910
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_io.h
@@ -0,0 +1,62 @@
+/*
+ * cxd2880_io.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * register I/O interface definitions
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_IO_H
+#define CXD2880_IO_H
+
+#include "cxd2880_common.h"
+
+enum cxd2880_io_tgt {
+	CXD2880_IO_TGT_SYS,
+	CXD2880_IO_TGT_DMD
+};
+
+struct cxd2880_io {
+	enum cxd2880_ret (*read_regs)(struct cxd2880_io *io,
+				       enum cxd2880_io_tgt tgt, u8 sub_address,
+				       u8 *data, u32 size);
+	enum cxd2880_ret (*write_regs)(struct cxd2880_io *io,
+					enum cxd2880_io_tgt tgt, u8 sub_address,
+					const u8 *data, u32 size);
+	enum cxd2880_ret (*write_reg)(struct cxd2880_io *io,
+				       enum cxd2880_io_tgt tgt, u8 sub_address,
+				       u8 data);
+	void *if_object;
+	u8 i2c_address_sys;
+	u8 i2c_address_demod;
+	u8 slave_select;
+	void *user;
+};
+
+enum cxd2880_ret cxd2880_io_common_write_one_reg(struct cxd2880_io *io,
+						 enum cxd2880_io_tgt tgt,
+						 u8 sub_address, u8 data);
+
+enum cxd2880_ret cxd2880_io_set_reg_bits(struct cxd2880_io *io,
+					 enum cxd2880_io_tgt tgt,
+					 u8 sub_address, u8 data, u8 mask);
+
+#endif
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_math.c b/drivers/media/dvb-frontends/cxd2880/cxd2880_math.c
new file mode 100644
index 000000000000..434c827898ff
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_math.c
@@ -0,0 +1,89 @@
+/*
+ * cxd2880_math.c
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * mathmatics functions
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "cxd2880_math.h"
+
+#define MAX_BIT_PRECISION	  5
+#define FRAC_BITMASK	    0x1F
+#define LOG2_10_100X	     332
+#define LOG2_E_100X	      144
+
+static const u8 log2_look_up[] = {
+	0, 4,
+	9, 13,
+	17, 21,
+	25, 29,
+	32, 36,
+	39, 43,
+	46, 49,
+	52, 55,
+	58, 61,
+	64, 67,
+	70, 73,
+	75, 78,
+	81, 83,
+	86, 88,
+	91, 93,
+	95, 98
+};
+
+u32 cxd2880_math_log2(u32 x)
+{
+	u8 count = 0;
+	u8 index = 0;
+	u32 xval = x;
+
+	for (x >>= 1; x > 0; x >>= 1)
+		count++;
+
+	x = count * 100;
+
+	if (count > 0) {
+		if (count <= MAX_BIT_PRECISION) {
+			index =
+			    (u8)(xval << (MAX_BIT_PRECISION - count)) &
+			    FRAC_BITMASK;
+			x += log2_look_up[index];
+		} else {
+			index =
+			    (u8)(xval >> (count - MAX_BIT_PRECISION)) &
+			    FRAC_BITMASK;
+			x += log2_look_up[index];
+		}
+	}
+
+	return x;
+}
+
+u32 cxd2880_math_log10(u32 x)
+{
+	return ((100 * cxd2880_math_log2(x) + LOG2_10_100X / 2) / LOG2_10_100X);
+}
+
+u32 cxd2880_math_log(u32 x)
+{
+	return ((100 * cxd2880_math_log2(x) + LOG2_E_100X / 2) / LOG2_E_100X);
+}
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_math.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_math.h
new file mode 100644
index 000000000000..94211835a4ad
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_math.h
@@ -0,0 +1,40 @@
+/*
+ * cxd2880_math.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * mathmatics definitions
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_MATH_H_
+#define CXD2880_MATH_H_
+
+#include "cxd2880_common.h"
+
+u32 cxd2880_math_log2(u32 x);
+u32 cxd2880_math_log10(u32 x);
+u32 cxd2880_math_log(u32 x);
+
+#ifndef min
+#define min(a, b)	    (((a) < (b)) ? (a) : (b))
+#endif
+
+#endif
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_spi.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_spi.h
new file mode 100644
index 000000000000..81e5be747962
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_spi.h
@@ -0,0 +1,51 @@
+/*
+ * cxd2880_spi.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * SPI access definitions
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_SPI_H
+#define CXD2880_SPI_H
+
+#include "cxd2880_common.h"
+
+enum cxd2880_spi_mode {
+	CXD2880_SPI_MODE_0,
+	CXD2880_SPI_MODE_1,
+	CXD2880_SPI_MODE_2,
+	CXD2880_SPI_MODE_3
+};
+
+struct cxd2880_spi {
+	enum cxd2880_ret (*read)(struct cxd2880_spi *spi, u8 *data,
+				  u32 size);
+	enum cxd2880_ret (*write)(struct cxd2880_spi *spi, const u8 *data,
+				   u32 size);
+	enum cxd2880_ret (*write_read)(struct cxd2880_spi *spi,
+					const u8 *tx_data, u32 tx_size,
+					u8 *rx_data, u32 rx_size);
+	u32 flags;
+	void *user;
+};
+
+#endif
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_spi_device.c b/drivers/media/dvb-frontends/cxd2880/cxd2880_spi_device.c
new file mode 100644
index 000000000000..af9ed40c900b
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_spi_device.c
@@ -0,0 +1,130 @@
+/*
+ * cxd2880_spi_device.c
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * SPI access functions
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/spi/spi.h>
+
+#include "cxd2880_spi_device.h"
+
+static enum cxd2880_ret cxd2880_spi_device_write(struct cxd2880_spi *spi,
+						const u8 *data, u32 size)
+{
+	struct cxd2880_spi_device *spi_device = NULL;
+	struct spi_message msg;
+	struct spi_transfer tx;
+	int result = 0;
+
+	if ((!spi) || (!spi->user) || (!data) || (size == 0))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	spi_device = (struct cxd2880_spi_device *)(spi->user);
+
+	memset(&tx, 0, sizeof(tx));
+	tx.tx_buf = data;
+	tx.len = size;
+
+	spi_message_init(&msg);
+	spi_message_add_tail(&tx, &msg);
+	result = spi_sync(spi_device->spi, &msg);
+
+	if (result < 0)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret cxd2880_spi_device_write_read(struct cxd2880_spi *spi,
+							const u8 *tx_data,
+							u32 tx_size,
+							u8 *rx_data,
+							u32 rx_size)
+{
+	struct cxd2880_spi_device *spi_device = NULL;
+	int result = 0;
+
+	if ((!spi) || (!spi->user) || (!tx_data) ||
+		 (tx_size == 0) || (!rx_data) || (rx_size == 0))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	spi_device = (struct cxd2880_spi_device *)(spi->user);
+
+	result = spi_write_then_read(spi_device->spi, tx_data,
+					tx_size, rx_data, rx_size);
+	if (result < 0)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret
+cxd2880_spi_device_initialize(struct cxd2880_spi_device *spi_device,
+				enum cxd2880_spi_mode mode,
+				u32 speed_hz)
+{
+	int result = 0;
+	struct spi_device *spi = spi_device->spi;
+
+	switch (mode) {
+	case CXD2880_SPI_MODE_0:
+		spi->mode = SPI_MODE_0;
+		break;
+	case CXD2880_SPI_MODE_1:
+		spi->mode = SPI_MODE_1;
+		break;
+	case CXD2880_SPI_MODE_2:
+		spi->mode = SPI_MODE_2;
+		break;
+	case CXD2880_SPI_MODE_3:
+		spi->mode = SPI_MODE_3;
+		break;
+	default:
+		return CXD2880_RESULT_ERROR_ARG;
+	}
+
+	spi->max_speed_hz = speed_hz;
+	spi->bits_per_word = 8;
+	result = spi_setup(spi);
+	if (result != 0) {
+		pr_err("spi_setup failed %d\n", result);
+		return CXD2880_RESULT_ERROR_ARG;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_spi_device_create_spi(struct cxd2880_spi *spi,
+					struct cxd2880_spi_device *spi_device)
+{
+	if ((!spi) || (!spi_device))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	spi->read = NULL;
+	spi->write = cxd2880_spi_device_write;
+	spi->write_read = cxd2880_spi_device_write_read;
+	spi->flags = 0;
+	spi->user = spi_device;
+
+	return CXD2880_RESULT_OK;
+}
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_spi_device.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_spi_device.h
new file mode 100644
index 000000000000..343d9161d537
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_spi_device.h
@@ -0,0 +1,45 @@
+/*
+ * cxd2880_spi_device.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * SPI access interface
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_SPI_DEVICE_H
+#define CXD2880_SPI_DEVICE_H
+
+#include "cxd2880_spi.h"
+
+struct cxd2880_spi_device {
+	struct spi_device *spi;
+};
+
+enum cxd2880_ret
+cxd2880_spi_device_initialize(struct cxd2880_spi_device *spi_device,
+				enum cxd2880_spi_mode mode,
+				u32 speedHz);
+
+enum cxd2880_ret
+cxd2880_spi_device_create_spi(struct cxd2880_spi *spi,
+				struct cxd2880_spi_device *spi_device);
+
+#endif /* CXD2880_SPI_DEVICE_H */
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_stdlib.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_stdlib.h
new file mode 100644
index 000000000000..b9ca1b9df110
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_stdlib.h
@@ -0,0 +1,35 @@
+/*
+ * cxd2880_stdlib.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * standard lib function aliases
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_STDLIB_H
+#define CXD2880_STDLIB_H
+
+#include <linux/string.h>
+
+#define cxd2880_memcpy  memcpy
+#define cxd2880_memset  memset
+
+#endif
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_stopwatch_port.c b/drivers/media/dvb-frontends/cxd2880/cxd2880_stopwatch_port.c
new file mode 100644
index 000000000000..14ad6aa6c4c0
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_stopwatch_port.c
@@ -0,0 +1,71 @@
+/*
+ * cxd2880_stopwatch_port.c
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * time measurement functions
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "cxd2880_common.h"
+
+#include <linux/ktime.h>
+#include <linux/time.h>
+#include <linux/timekeeping.h>
+
+static u32 get_time_count(void)
+{
+	struct timespec tp;
+
+	getnstimeofday(&tp);
+
+	return (u32)((tp.tv_sec * 1000) + (tp.tv_nsec / 1000000));
+}
+
+enum cxd2880_ret cxd2880_stopwatch_start(struct cxd2880_stopwatch *stopwatch)
+{
+	if (!stopwatch)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	stopwatch->start_time = get_time_count();
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_stopwatch_sleep(struct cxd2880_stopwatch *stopwatch,
+					 u32 ms)
+{
+	if (!stopwatch)
+		return CXD2880_RESULT_ERROR_ARG;
+	CXD2880_ARG_UNUSED(*stopwatch);
+	CXD2880_SLEEP(ms);
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_stopwatch_elapsed(struct cxd2880_stopwatch *stopwatch,
+					   u32 *elapsed)
+{
+	if (!stopwatch || !elapsed)
+		return CXD2880_RESULT_ERROR_ARG;
+	*elapsed = get_time_count() - stopwatch->start_time;
+
+	return CXD2880_RESULT_OK;
+}
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd.c b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd.c
new file mode 100644
index 000000000000..286384ae0124
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd.c
@@ -0,0 +1,3925 @@
+/*
+ * cxd2880_tnrdmd.c
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * common control functions
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "cxd2880_common.h"
+#include "cxd2880_stdlib.h"
+#include "cxd2880_tnrdmd.h"
+#include "cxd2880_tnrdmd_mon.h"
+#include "cxd2880_tnrdmd_dvbt.h"
+#include "cxd2880_tnrdmd_dvbt2.h"
+
+static enum cxd2880_ret p_init1(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	u8 data = 0;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if ((tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SINGLE) ||
+	    (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN)) {
+		switch (tnr_dmd->create_param.ts_output_if) {
+		case CXD2880_TNRDMD_TSOUT_IF_TS:
+			data = 0x00;
+			break;
+		case CXD2880_TNRDMD_TSOUT_IF_SPI:
+			data = 0x01;
+			break;
+		case CXD2880_TNRDMD_TSOUT_IF_SDIO:
+			data = 0x02;
+			break;
+		default:
+			return CXD2880_RESULT_ERROR_ARG;
+		}
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x10,
+					   data) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x11,
+				   0x16) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	switch (tnr_dmd->chip_id) {
+	case CXD2880_TNRDMD_CHIP_ID_CXD2880_ES1_0X:
+		data = 0x1A;
+		break;
+	case CXD2880_TNRDMD_CHIP_ID_CXD2880_ES1_11:
+		data = 0x16;
+		break;
+	default:
+		return CXD2880_RESULT_ERROR_NOSUPPORT;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x10,
+				   data) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->create_param.en_internal_ldo)
+		data = 0x01;
+	else
+		data = 0x00;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x11,
+				   data) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x13,
+				   data) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x12,
+				   data) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	switch (tnr_dmd->chip_id) {
+	case CXD2880_TNRDMD_CHIP_ID_CXD2880_ES1_0X:
+		data = 0x01;
+		break;
+	case CXD2880_TNRDMD_CHIP_ID_CXD2880_ES1_11:
+		data = 0x00;
+		break;
+	default:
+		return CXD2880_RESULT_ERROR_NOSUPPORT;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x69,
+				   data) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret p_init2(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	u8 data[6] = { 0 };
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = tnr_dmd->create_param.xosc_cap;
+	data[1] = tnr_dmd->create_param.xosc_i;
+	switch (tnr_dmd->create_param.xtal_share_type) {
+	case CXD2880_TNRDMD_XTAL_SHARE_NONE:
+		data[2] = 0x01;
+		data[3] = 0x00;
+		break;
+	case CXD2880_TNRDMD_XTAL_SHARE_EXTREF:
+		data[2] = 0x00;
+		data[3] = 0x00;
+		break;
+	case CXD2880_TNRDMD_XTAL_SHARE_MASTER:
+		data[2] = 0x01;
+		data[3] = 0x01;
+		break;
+	case CXD2880_TNRDMD_XTAL_SHARE_SLAVE:
+		data[2] = 0x00;
+		data[3] = 0x01;
+		break;
+	default:
+		return CXD2880_RESULT_ERROR_ARG;
+	}
+	data[4] = 0x06;
+	data[5] = 0x00;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x13, data,
+				    6) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret p_init3(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	u8 data[2] = { 0 };
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	switch (tnr_dmd->diver_mode) {
+	case CXD2880_TNRDMD_DIVERMODE_SINGLE:
+		data[0] = 0x00;
+		break;
+	case CXD2880_TNRDMD_DIVERMODE_MAIN:
+		data[0] = 0x03;
+		break;
+	case CXD2880_TNRDMD_DIVERMODE_SUB:
+		data[0] = 0x02;
+		break;
+	default:
+		return CXD2880_RESULT_ERROR_ARG;
+	}
+
+	data[1] = 0x01;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x1F, data,
+				    2) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret rf_init1(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	u8 data[80] = { 0 };
+	u8 addr = 0;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x01;
+	data[1] = 0x00;
+	data[2] = 0x01;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x21, data,
+				    3) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x01;
+	data[1] = 0x01;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x17, data,
+				    2) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->create_param.stationary_use) {
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x1A,
+					   0x06) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x4F,
+				   0x18) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x61,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x71,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x9D,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x7D,
+				   0x02) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x8F,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x8B,
+				   0xC6) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x9A,
+				   0x03) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x1C,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x00;
+	if ((tnr_dmd->create_param.is_cxd2881gg) &&
+	    (tnr_dmd->create_param.xtal_share_type ==
+		CXD2880_TNRDMD_XTAL_SHARE_SLAVE))
+		data[1] = 0x00;
+	else
+		data[1] = 0x1F;
+	data[2] = 0x0A;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0xB5, data,
+				    3) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0xB9,
+				   0x07) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x33,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0xC1,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0xC4,
+				   0x1E) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->chip_id == CXD2880_TNRDMD_CHIP_ID_CXD2880_ES1_0X) {
+		data[0] = 0x34;
+		data[1] = 0x2C;
+	} else {
+		data[0] = 0x2F;
+		data[1] = 0x25;
+	}
+	data[2] = 0x15;
+	data[3] = 0x19;
+	data[4] = 0x1B;
+	data[5] = 0x15;
+	data[6] = 0x19;
+	data[7] = 0x1B;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0xD9, data,
+				    8) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x11) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x6C;
+	data[1] = 0x10;
+	data[2] = 0xA6;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x44, data,
+				    3) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x16;
+	data[1] = 0xA8;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x50, data,
+				    2) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x00;
+	data[1] = 0x22;
+	data[2] = 0x00;
+	data[3] = 0x88;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x62, data,
+				    4) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x74,
+				   0x75) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x05;
+	data[1] = 0x05;
+	data[2] = 0x05;
+	data[3] = 0x05;
+	data[4] = 0x05;
+	data[5] = 0x05;
+	data[6] = 0x05;
+	data[7] = 0x05;
+	data[8] = 0x05;
+	data[9] = 0x04;
+	data[10] = 0x04;
+	data[11] = 0x04;
+	data[12] = 0x03;
+	data[13] = 0x03;
+	data[14] = 0x03;
+	data[15] = 0x04;
+	data[16] = 0x04;
+	data[17] = 0x05;
+	data[18] = 0x05;
+	data[19] = 0x05;
+	data[20] = 0x02;
+	data[21] = 0x02;
+	data[22] = 0x02;
+	data[23] = 0x02;
+	data[24] = 0x02;
+	data[25] = 0x02;
+	data[26] = 0x02;
+	data[27] = 0x02;
+	data[28] = 0x02;
+	data[29] = 0x03;
+	data[30] = 0x02;
+	data[31] = 0x01;
+	data[32] = 0x01;
+	data[33] = 0x01;
+	data[34] = 0x02;
+	data[35] = 0x02;
+	data[36] = 0x03;
+	data[37] = 0x04;
+	data[38] = 0x04;
+	data[39] = 0x04;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x7F, data,
+				    40) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x16) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x00;
+	data[1] = 0x71;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x10, data,
+				    2) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x23,
+				   0x89) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0xFF;
+	data[1] = 0x00;
+	data[2] = 0x00;
+	data[3] = 0x00;
+	data[4] = 0x00;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x27, data,
+				    5) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x00;
+	data[1] = 0x00;
+	data[2] = 0x00;
+	data[3] = 0x00;
+	data[4] = 0x00;
+	data[5] = 0x01;
+	data[6] = 0x00;
+	data[7] = 0x01;
+	data[8] = 0x00;
+	data[9] = 0x02;
+	data[10] = 0x00;
+	data[11] = 0x63;
+	data[12] = 0x00;
+	data[13] = 0x00;
+	data[14] = 0x00;
+	data[15] = 0x03;
+	data[16] = 0x00;
+	data[17] = 0x04;
+	data[18] = 0x00;
+	data[19] = 0x04;
+	data[20] = 0x00;
+	data[21] = 0x06;
+	data[22] = 0x00;
+	data[23] = 0x06;
+	data[24] = 0x00;
+	data[25] = 0x08;
+	data[26] = 0x00;
+	data[27] = 0x09;
+	data[28] = 0x00;
+	data[29] = 0x0B;
+	data[30] = 0x00;
+	data[31] = 0x0B;
+	data[32] = 0x00;
+	data[33] = 0x0D;
+	data[34] = 0x00;
+	data[35] = 0x0D;
+	data[36] = 0x00;
+	data[37] = 0x0F;
+	data[38] = 0x00;
+	data[39] = 0x0F;
+	data[40] = 0x00;
+	data[41] = 0x0F;
+	data[42] = 0x00;
+	data[43] = 0x10;
+	data[44] = 0x00;
+	data[45] = 0x79;
+	data[46] = 0x00;
+	data[47] = 0x00;
+	data[48] = 0x00;
+	data[49] = 0x02;
+	data[50] = 0x00;
+	data[51] = 0x00;
+	data[52] = 0x00;
+	data[53] = 0x03;
+	data[54] = 0x00;
+	data[55] = 0x01;
+	data[56] = 0x00;
+	data[57] = 0x03;
+	data[58] = 0x00;
+	data[59] = 0x03;
+	data[60] = 0x00;
+	data[61] = 0x03;
+	data[62] = 0x00;
+	data[63] = 0x04;
+	data[64] = 0x00;
+	data[65] = 0x04;
+	data[66] = 0x00;
+	data[67] = 0x06;
+	data[68] = 0x00;
+	data[69] = 0x05;
+	data[70] = 0x00;
+	data[71] = 0x07;
+	data[72] = 0x00;
+	data[73] = 0x07;
+	data[74] = 0x00;
+	data[75] = 0x08;
+	data[76] = 0x00;
+	data[77] = 0x0A;
+	data[78] = 0x03;
+	data[79] = 0xE0;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x3A, data,
+				    80) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	data[0] = 0x03;
+	data[1] = 0xE0;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0xBC, data,
+				    2) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x51,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0xC5,
+				   0x07) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x11) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x70,
+				   0xE9) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x76,
+				   0x0A) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x78,
+				   0x32) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x7A,
+				   0x46) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x7C,
+				   0x86) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x7E,
+				   0xA4) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0xE1,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->create_param.stationary_use) {
+		data[0] = 0x06;
+		data[1] = 0x07;
+		data[2] = 0x1A;
+	} else {
+		data[0] = 0x00;
+		data[1] = 0x08;
+		data[2] = 0x19;
+	}
+	data[3] = 0x0E;
+	data[4] = 0x09;
+	data[5] = 0x0E;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x12) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	for (addr = 0x10; addr < 0x9F; addr += 6) {
+		if (tnr_dmd->lna_thrs_tbl_air) {
+			u8 idx = 0;
+
+			idx = (addr - 0x10) / 6;
+			data[0] =
+			    tnr_dmd->lna_thrs_tbl_air->thrs[idx].off_on;
+			data[1] =
+			    tnr_dmd->lna_thrs_tbl_air->thrs[idx].on_off;
+		}
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_SYS, addr,
+					    data,
+					    6) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	data[0] = 0x00;
+	data[1] = 0x08;
+	if (tnr_dmd->create_param.stationary_use)
+		data[2] = 0x1A;
+	else
+		data[2] = 0x19;
+	data[3] = 0x0E;
+	data[4] = 0x09;
+	data[5] = 0x0E;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x13) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	for (addr = 0x10; addr < 0xCF; addr += 6) {
+		if (tnr_dmd->lna_thrs_tbl_cable) {
+			u8 idx = 0;
+
+			idx = (addr - 0x10) / 6;
+			data[0] =
+			    tnr_dmd->lna_thrs_tbl_cable->thrs[idx].off_on;
+			data[1] =
+			    tnr_dmd->lna_thrs_tbl_cable->thrs[idx].on_off;
+		}
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_SYS, addr,
+					    data,
+					    6) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x11) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x08;
+	data[1] = 0x09;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0xBD, data,
+				    2) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x08;
+	data[1] = 0x09;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0xC4, data,
+				    2) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x20;
+	data[1] = 0x20;
+	data[2] = 0x30;
+	data[3] = 0x41;
+	data[4] = 0x50;
+	data[5] = 0x5F;
+	data[6] = 0x6F;
+	data[7] = 0x80;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0xC9, data,
+				    8) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x14) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x15;
+	data[1] = 0x18;
+	data[2] = 0x00;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x10, data,
+				    3) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x15,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x16) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x00;
+	data[1] = 0x09;
+	data[2] = 0x00;
+	data[3] = 0x08;
+	data[4] = 0x00;
+	data[5] = 0x07;
+	data[6] = 0x00;
+	data[7] = 0x06;
+	data[8] = 0x00;
+	data[9] = 0x05;
+	data[10] = 0x00;
+	data[11] = 0x03;
+	data[12] = 0x00;
+	data[13] = 0x02;
+	data[14] = 0x00;
+	data[15] = 0x00;
+	data[16] = 0x00;
+	data[17] = 0x78;
+	data[18] = 0x00;
+	data[19] = 0x00;
+	data[20] = 0x00;
+	data[21] = 0x06;
+	data[22] = 0x00;
+	data[23] = 0x08;
+	data[24] = 0x00;
+	data[25] = 0x08;
+	data[26] = 0x00;
+	data[27] = 0x0C;
+	data[28] = 0x00;
+	data[29] = 0x0C;
+	data[30] = 0x00;
+	data[31] = 0x0D;
+	data[32] = 0x00;
+	data[33] = 0x0F;
+	data[34] = 0x00;
+	data[35] = 0x0E;
+	data[36] = 0x00;
+	data[37] = 0x0E;
+	data[38] = 0x00;
+	data[39] = 0x10;
+	data[40] = 0x00;
+	data[41] = 0x0F;
+	data[42] = 0x00;
+	data[43] = 0x0E;
+	data[44] = 0x00;
+	data[45] = 0x10;
+	data[46] = 0x00;
+	data[47] = 0x0F;
+	data[48] = 0x00;
+	data[49] = 0x0E;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x12, data,
+				    50) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	CXD2880_SLEEP(1);
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x0A) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x10, data,
+				   1) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if ((data[0] & 0x01) == 0x00)
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x25,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	CXD2880_SLEEP(1);
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x0A) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x11, data,
+				   1) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if ((data[0] & 0x01) == 0x00)
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x02,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x21,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0xE1) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x8F,
+				   0x16) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x67,
+				   0x60) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x6A,
+				   0x0F) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x6C,
+				   0x17) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x00;
+	data[1] = 0xFE;
+	data[2] = 0xEE;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_DMD, 0x6E, data,
+				    3) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0xA1;
+	data[1] = 0x8B;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_DMD, 0x8D, data,
+				    2) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x08;
+	data[1] = 0x09;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_DMD, 0x77, data,
+				    2) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->create_param.stationary_use) {
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x80,
+					   0xAA) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0xE2) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x41,
+				   0xA0) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x4B,
+				   0x68) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x21,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x10,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x25,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	CXD2880_SLEEP(1);
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x1A) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x10, data,
+				   1) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if ((data[0] & 0x01) == 0x00)
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x14,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x26,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret rf_init2(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	u8 data[5] = { 0 };
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x40;
+	data[1] = 0x40;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0xEA, data,
+				    2) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	CXD2880_SLEEP(1);
+
+	data[0] = 0x00;
+	if (tnr_dmd->chip_id == CXD2880_TNRDMD_CHIP_ID_CXD2880_ES1_0X)
+		data[1] = 0x00;
+	else
+		data[1] = 0x01;
+	data[2] = 0x01;
+	data[3] = 0x03;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x30, data,
+				    4) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x14) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x1B,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x21,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0xE1) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0xD3,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x21,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret x_tune1(struct cxd2880_tnrdmd *tnr_dmd,
+				enum cxd2880_dtv_sys sys, u32 freq_khz,
+				enum cxd2880_dtv_bandwidth bandwidth,
+				u8 is_cable, int shift_frequency_khz)
+{
+	u8 data[11] = { 0 };
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x10,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	data[0] = 0x00;
+	data[1] = 0x00;
+	data[2] = 0x0E;
+	data[3] = 0x00;
+	data[4] = 0x03;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0xE7, data,
+				    5) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	data[0] = 0x1F;
+	data[1] = 0x80;
+	data[2] = 0x18;
+	data[3] = 0x00;
+	data[4] = 0x07;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0xE7, data,
+				    5) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	CXD2880_SLEEP(1);
+
+	data[0] = 0x72;
+	data[1] = 0x81;
+	data[3] = 0x1D;
+	data[4] = 0x6F;
+	data[5] = 0x7E;
+	data[7] = 0x1C;
+	switch (sys) {
+	case CXD2880_DTV_SYS_DVBT:
+	case CXD2880_DTV_SYS_ISDBT:
+	case CXD2880_DTV_SYS_ISDBTSB:
+	case CXD2880_DTV_SYS_ISDBTMM_A:
+	case CXD2880_DTV_SYS_ISDBTMM_B:
+		data[2] = 0x94;
+		data[6] = 0x91;
+		break;
+	case CXD2880_DTV_SYS_DVBT2:
+		data[2] = 0x96;
+		data[6] = 0x93;
+		break;
+	default:
+		return CXD2880_RESULT_ERROR_ARG;
+	}
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x44, data,
+				    8) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x62,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x15) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x03;
+	data[1] = 0xE2;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x1E, data,
+				    2) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	data[0] = (u8)(is_cable ? 0x01 : 0x00);
+	data[1] = 0x00;
+	data[2] = 0x6B;
+	data[3] = 0x4D;
+
+	switch (bandwidth) {
+	case CXD2880_DTV_BW_1_7_MHZ:
+		data[4] = 0x03;
+		break;
+	case CXD2880_DTV_BW_5_MHZ:
+	case CXD2880_DTV_BW_6_MHZ:
+		data[4] = 0x00;
+		break;
+	case CXD2880_DTV_BW_7_MHZ:
+		data[4] = 0x01;
+		break;
+	case CXD2880_DTV_BW_8_MHZ:
+		data[4] = 0x02;
+		break;
+	default:
+		return CXD2880_RESULT_ERROR_ARG;
+	}
+
+	data[5] = 0x00;
+
+	freq_khz += shift_frequency_khz;
+
+	data[6] = (u8)((freq_khz >> 16) & 0x0F);
+	data[7] = (u8)((freq_khz >> 8) & 0xFF);
+	data[8] = (u8)(freq_khz & 0xFF);
+	data[9] = 0xFF;
+	data[10] = 0xFE;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x52, data,
+				    11) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret x_tune2(struct cxd2880_tnrdmd *tnr_dmd,
+				enum cxd2880_dtv_bandwidth bandwidth,
+				enum cxd2880_tnrdmd_clockmode clk_mode,
+				int shift_frequency_khz)
+{
+	u8 data[3] = { 0 };
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x11) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	data[0] = 0x01;
+	data[1] = 0x0E;
+	data[2] = 0x01;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x2D, data,
+				    3) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x1A) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x29,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x2C, data,
+				   1) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x60,
+				   data[0]) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x62,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x11) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x2D,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x2F,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x10,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x21,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (shift_frequency_khz != 0) {
+		int shift_freq = 0;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0xE1) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x60, data,
+					   2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		shift_freq = shift_frequency_khz * 1000;
+
+		switch (clk_mode) {
+		case CXD2880_TNRDMD_CLOCKMODE_A:
+		case CXD2880_TNRDMD_CLOCKMODE_C:
+		default:
+			if (shift_freq >= 0)
+				shift_freq = (shift_freq + 183 / 2) / 183;
+			else
+				shift_freq = (shift_freq - 183 / 2) / 183;
+			break;
+		case CXD2880_TNRDMD_CLOCKMODE_B:
+			if (shift_freq >= 0)
+				shift_freq = (shift_freq + 178 / 2) / 178;
+			else
+				shift_freq = (shift_freq - 178 / 2) / 178;
+			break;
+		}
+
+		shift_freq +=
+		    cxd2880_convert2s_complement((data[0] << 8) | data[1], 16);
+
+		if (shift_freq > 32767)
+			shift_freq = 32767;
+		else if (shift_freq < -32768)
+			shift_freq = -32768;
+
+		data[0] = (u8)(((u32)shift_freq >> 8) & 0xFF);
+		data[1] = (u8)((u32)shift_freq & 0xFF);
+
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_DMD, 0x60, data,
+					    2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x69, data,
+					   1) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		shift_freq = -shift_frequency_khz;
+
+		if (bandwidth == CXD2880_DTV_BW_1_7_MHZ) {
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+			default:
+				if (shift_freq >= 0)
+					shift_freq =
+					    (shift_freq * 1000 +
+					     17578 / 2) / 17578;
+				else
+					shift_freq =
+					    (shift_freq * 1000 -
+					     17578 / 2) / 17578;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				if (shift_freq >= 0)
+					shift_freq =
+					    (shift_freq * 1000 +
+					     17090 / 2) / 17090;
+				else
+					shift_freq =
+					    (shift_freq * 1000 -
+					     17090 / 2) / 17090;
+				break;
+			}
+		} else {
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+			default:
+				if (shift_freq >= 0)
+					shift_freq =
+					    (shift_freq * 1000 +
+					     35156 / 2) / 35156;
+				else
+					shift_freq =
+					    (shift_freq * 1000 -
+					     35156 / 2) / 35156;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				if (shift_freq >= 0)
+					shift_freq =
+					    (shift_freq * 1000 +
+					     34180 / 2) / 34180;
+				else
+					shift_freq =
+					    (shift_freq * 1000 -
+					     34180 / 2) / 34180;
+				break;
+			}
+		}
+
+		shift_freq += cxd2880_convert2s_complement(data[0], 8);
+
+		if (shift_freq > 127)
+			shift_freq = 127;
+		else if (shift_freq < -128)
+			shift_freq = -128;
+
+		data[0] = (u8)((u32)shift_freq & 0xFF);
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x69,
+					   data[0]) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->create_param.stationary_use) {
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0xE1) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x8A,
+					   0x87) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x21,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret x_tune3(struct cxd2880_tnrdmd *tnr_dmd,
+				enum cxd2880_dtv_sys sys,
+				u8 en_fef_intmtnt_ctrl)
+{
+	u8 data[6] = { 0 };
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x21,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0xE2) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x41,
+				   0xA0) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x21,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0xFE,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if ((sys == CXD2880_DTV_SYS_DVBT2) && en_fef_intmtnt_ctrl) {
+		data[0] = 0x01;
+		data[1] = 0x01;
+		data[2] = 0x01;
+		data[3] = 0x01;
+		data[4] = 0x01;
+		data[5] = 0x01;
+	} else {
+		data[0] = 0x00;
+		data[1] = 0x00;
+		data[2] = 0x00;
+		data[3] = 0x00;
+		data[4] = 0x00;
+		data[5] = 0x00;
+	}
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0xEF, data,
+				    6) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x2D) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if ((sys == CXD2880_DTV_SYS_DVBT2) && en_fef_intmtnt_ctrl)
+		data[0] = 0x00;
+	else
+		data[0] = 0x01;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0xB1,
+				   data[0]) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret x_tune4(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	u8 data[2] = { 0 };
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	{
+		if (tnr_dmd->diver_sub->io->write_reg(tnr_dmd->diver_sub->io,
+						      CXD2880_IO_TGT_SYS, 0x00,
+						      0x00) !=
+		    CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+		data[0] = 0x14;
+		data[1] = 0x00;
+		if (tnr_dmd->diver_sub->io->write_regs(tnr_dmd->diver_sub->io,
+						       CXD2880_IO_TGT_SYS, 0x55,
+						       data,
+						       2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	{
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x00,
+					   0x00) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+		data[0] = 0x0B;
+		data[1] = 0xFF;
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_SYS, 0x53, data,
+					    2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x57,
+					   0x01) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+		data[0] = 0x0B;
+		data[1] = 0xFF;
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_SYS, 0x55, data,
+					    2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	{
+		if (tnr_dmd->diver_sub->io->write_reg(tnr_dmd->diver_sub->io,
+						      CXD2880_IO_TGT_SYS, 0x00,
+						      0x00) !=
+		    CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+		data[0] = 0x14;
+		data[1] = 0x00;
+		if (tnr_dmd->diver_sub->io->write_regs(tnr_dmd->diver_sub->io,
+						       CXD2880_IO_TGT_SYS, 0x53,
+						       data,
+						       2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+		if (tnr_dmd->diver_sub->io->write_reg(tnr_dmd->diver_sub->io,
+						      CXD2880_IO_TGT_SYS, 0x57,
+						      0x02) !=
+		    CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0xFE,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->diver_sub->io->write_reg(tnr_dmd->diver_sub->io,
+					      CXD2880_IO_TGT_DMD, 0x00,
+					      0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->diver_sub->io->write_reg(tnr_dmd->diver_sub->io,
+					      CXD2880_IO_TGT_DMD, 0xFE,
+					      0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret x_sleep1(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	u8 data[3] = { 0 };
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	{
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x00,
+					   0x00) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x57,
+					   0x03) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+		data[0] = 0x00;
+		data[1] = 0x00;
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_SYS, 0x53, data,
+					    2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	{
+		if (tnr_dmd->diver_sub->io->write_reg(tnr_dmd->diver_sub->io,
+						      CXD2880_IO_TGT_SYS, 0x00,
+						      0x00) !=
+		    CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+		data[0] = 0x1F;
+		data[1] = 0xFF;
+		data[2] = 0x03;
+		if (tnr_dmd->diver_sub->io->write_regs(tnr_dmd->diver_sub->io,
+						       CXD2880_IO_TGT_SYS, 0x55,
+						       data,
+						       3) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+		data[0] = 0x00;
+		data[1] = 0x00;
+		if (tnr_dmd->diver_sub->io->write_regs(tnr_dmd->diver_sub->io,
+						       CXD2880_IO_TGT_SYS, 0x53,
+						       data,
+						       2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	{
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x00,
+					   0x00) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+		data[0] = 0x1F;
+		data[1] = 0xFF;
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_SYS, 0x55, data,
+					    2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret x_sleep2(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	u8 data = 0;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x2D) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0xB1,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	CXD2880_SLEEP(1);
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0xB2, &data,
+				   1) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if ((data & 0x01) == 0x00)
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0xF4,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0xF3,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0xF2,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0xF1,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0xF0,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0xEF,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret x_sleep3(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0xFD,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret x_sleep4(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x21,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0xE2) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x41,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x21,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret spll_reset(struct cxd2880_tnrdmd *tnr_dmd,
+				   enum cxd2880_tnrdmd_clockmode clockmode)
+{
+	u8 data[4] = { 0 };
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x29,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x28,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x27,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x26,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x10,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x27,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x22,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	switch (clockmode) {
+	case CXD2880_TNRDMD_CLOCKMODE_A:
+		data[0] = 0x00;
+		break;
+
+	case CXD2880_TNRDMD_CLOCKMODE_B:
+		data[0] = 0x01;
+		break;
+
+	case CXD2880_TNRDMD_CLOCKMODE_C:
+		data[0] = 0x02;
+		break;
+
+	default:
+		return CXD2880_RESULT_ERROR_ARG;
+	}
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x30,
+				   data[0]) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x22,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	CXD2880_SLEEP(2);
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x0A) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x10, data,
+				   1) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if ((data[0] & 0x01) == 0x00)
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x27,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	CXD2880_SLEEP(1);
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x10,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x00;
+	data[1] = 0x00;
+	data[2] = 0x00;
+	data[3] = 0x00;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x26, data,
+				    4) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret t_power_x(struct cxd2880_tnrdmd *tnr_dmd, u8 on)
+{
+	u8 data[3] = { 0 };
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x29,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x28,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x27,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x10,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x27,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x25,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (on) {
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x2B,
+					   0x01) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		CXD2880_SLEEP(1);
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x00,
+					   0x0A) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x12, data,
+					   1) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+		if ((data[0] & 0x01) == 0)
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x00,
+					   0x00) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x2A,
+					   0x00) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	} else {
+		data[0] = 0x03;
+		data[1] = 0x00;
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_SYS, 0x2A, data,
+					    2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		CXD2880_SLEEP(1);
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x00,
+					   0x0A) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x13, data,
+					   1) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+		if ((data[0] & 0x01) == 0)
+			return CXD2880_RESULT_ERROR_HW_STATE;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x25,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	CXD2880_SLEEP(1);
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x0A) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x11, data,
+				   1) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if ((data[0] & 0x01) == 0)
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x27,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	CXD2880_SLEEP(1);
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x10,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	data[0] = 0x00;
+	data[1] = 0x00;
+	data[2] = 0x00;
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x27, data,
+				    3) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+struct cxd2880_tnrdmd_ts_clk_cfg {
+	u8 srl_clk_mode;
+	u8 srl_duty_mode;
+	u8 ts_clk_period;
+};
+
+static enum cxd2880_ret set_ts_clk_mode_and_freq(struct cxd2880_tnrdmd *tnr_dmd,
+						 enum cxd2880_dtv_sys sys)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	u8 backwards_compatible = 0;
+	struct cxd2880_tnrdmd_ts_clk_cfg ts_clk_cfg;
+
+	const struct cxd2880_tnrdmd_ts_clk_cfg srl_ts_clk_stgs[2][2] = {
+	{
+		{3, 1, 8,},
+		{0, 2, 16,}
+	},
+	{
+		{1, 1, 8,},
+		{2, 2, 16,}
+	}
+	};
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	{
+		u8 ts_rate_ctrl_off = 0;
+		u8 ts_in_off = 0;
+		u8 ts_clk_manaul_on = 0;
+
+		if ((sys == CXD2880_DTV_SYS_ISDBT) ||
+		    (sys == CXD2880_DTV_SYS_ISDBTSB) ||
+		    (sys == CXD2880_DTV_SYS_ISDBTMM_A) ||
+		    (sys == CXD2880_DTV_SYS_ISDBTMM_B)) {
+			backwards_compatible = 0;
+			ts_rate_ctrl_off = 1;
+			ts_in_off = 0;
+		} else if (tnr_dmd->is_ts_backwards_compatible_mode) {
+			backwards_compatible = 1;
+			ts_rate_ctrl_off = 1;
+			ts_in_off = 1;
+		} else {
+			backwards_compatible = 0;
+			ts_rate_ctrl_off = 0;
+			ts_in_off = 0;
+		}
+
+		if (tnr_dmd->ts_byte_clk_manual_setting) {
+			ts_clk_manaul_on = 1;
+			ts_rate_ctrl_off = 0;
+		}
+
+		ret =
+		    cxd2880_io_set_reg_bits(tnr_dmd->io, CXD2880_IO_TGT_DMD,
+					    0xD3, ts_rate_ctrl_off, 0x01);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		ret =
+		    cxd2880_io_set_reg_bits(tnr_dmd->io, CXD2880_IO_TGT_DMD,
+					    0xDE, ts_in_off, 0x01);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		ret =
+		    cxd2880_io_set_reg_bits(tnr_dmd->io, CXD2880_IO_TGT_DMD,
+					    0xDA, ts_clk_manaul_on, 0x01);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	ts_clk_cfg =
+	    srl_ts_clk_stgs[tnr_dmd->srl_ts_clk_mod_cnts]
+			[(u8)tnr_dmd->srl_ts_clk_frq];
+
+	if (tnr_dmd->ts_byte_clk_manual_setting)
+		ts_clk_cfg.ts_clk_period = tnr_dmd->ts_byte_clk_manual_setting;
+
+	ret =
+	    cxd2880_io_set_reg_bits(tnr_dmd->io, CXD2880_IO_TGT_DMD, 0xC4,
+				    ts_clk_cfg.srl_clk_mode, 0x03);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret =
+	    cxd2880_io_set_reg_bits(tnr_dmd->io, CXD2880_IO_TGT_DMD, 0xD1,
+				    ts_clk_cfg.srl_duty_mode, 0x03);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret = tnr_dmd->io->write_reg(tnr_dmd->io,
+				     CXD2880_IO_TGT_DMD, 0xD9,
+				     ts_clk_cfg.ts_clk_period);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	{
+		u8 data = (u8)(backwards_compatible ? 0x00 : 0x01);
+
+		if (sys == CXD2880_DTV_SYS_DVBT) {
+			if (tnr_dmd->io->write_reg(tnr_dmd->io,
+						   CXD2880_IO_TGT_DMD, 0x00,
+						   0x10) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+
+			ret =
+			    cxd2880_io_set_reg_bits(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x66,
+						    data, 0x01);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+		}
+	}
+
+	return ret;
+}
+
+static enum cxd2880_ret pid_ftr_setting(struct cxd2880_tnrdmd *tnr_dmd,
+					struct cxd2880_tnrdmd_pid_ftr_cfg
+					*pid_ftr_cfg)
+{
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (!pid_ftr_cfg) {
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x50,
+					   0x02) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	} else {
+		u8 data[65];
+
+		data[0] = (u8)(pid_ftr_cfg->is_negative ? 0x01 : 0x00);
+		{
+			int i = 0;
+
+			for (i = 0; i < 32; i++) {
+				if (pid_ftr_cfg->pid_cfg[i].is_en) {
+					data[1 + (i * 2)] =
+					    (u8)((u8)
+					    (pid_ftr_cfg->pid_cfg[i].pid
+					     >> 8) | 0x20);
+					data[2 + (i * 2)] =
+					    (u8)(pid_ftr_cfg->pid_cfg[i].pid
+					     & 0xFF);
+				} else {
+					data[1 + (i * 2)] = 0x00;
+					data[2 + (i * 2)] = 0x00;
+				}
+			}
+		}
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_DMD, 0x50, data,
+					    65) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret load_cfg_mem(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	u8 i;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	for (i = 0; i < tnr_dmd->cfg_mem_last_entry; i++) {
+		ret = tnr_dmd->io->write_reg(tnr_dmd->io,
+					     tnr_dmd->cfg_mem[i].tgt,
+					     0x00, tnr_dmd->cfg_mem[i].bank);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		ret = cxd2880_io_set_reg_bits(tnr_dmd->io,
+					      tnr_dmd->cfg_mem[i].tgt,
+					      tnr_dmd->cfg_mem[i].address,
+					      tnr_dmd->cfg_mem[i].value,
+					      tnr_dmd->cfg_mem[i].bit_mask);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	return ret;
+}
+
+static enum cxd2880_ret set_cfg_mem(struct cxd2880_tnrdmd *tnr_dmd,
+				    enum cxd2880_io_tgt tgt,
+				    u8 bank, u8 address, u8 value, u8 bit_mask)
+{
+	u8 i;
+	u8 value_stored = 0;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	for (i = 0; i < tnr_dmd->cfg_mem_last_entry; i++) {
+		if ((value_stored == 0) &&
+		    (tnr_dmd->cfg_mem[i].tgt == tgt) &&
+		    (tnr_dmd->cfg_mem[i].bank == bank) &&
+		    (tnr_dmd->cfg_mem[i].address == address)) {
+			tnr_dmd->cfg_mem[i].value &= ~bit_mask;
+			tnr_dmd->cfg_mem[i].value |= (value & bit_mask);
+
+			tnr_dmd->cfg_mem[i].bit_mask |= bit_mask;
+
+			value_stored = 1;
+		}
+	}
+
+	if (value_stored == 0) {
+		if (tnr_dmd->cfg_mem_last_entry <
+		    CXD2880_TNRDMD_MAX_CFG_MEM_COUNT) {
+			tnr_dmd->cfg_mem[tnr_dmd->cfg_mem_last_entry].tgt = tgt;
+			tnr_dmd->cfg_mem[tnr_dmd->cfg_mem_last_entry].bank =
+			    bank;
+			tnr_dmd->cfg_mem[tnr_dmd->cfg_mem_last_entry].address =
+			    address;
+			tnr_dmd->cfg_mem[tnr_dmd->cfg_mem_last_entry].value =
+			    (value & bit_mask);
+			tnr_dmd->cfg_mem[tnr_dmd->cfg_mem_last_entry].bit_mask =
+			    bit_mask;
+			tnr_dmd->cfg_mem_last_entry++;
+		} else {
+			return CXD2880_RESULT_ERROR_OVERFLOW;
+		}
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_create(struct cxd2880_tnrdmd *tnr_dmd,
+				       struct cxd2880_io *io,
+				       struct cxd2880_tnrdmd_create_param
+				       *create_param)
+{
+	if ((!tnr_dmd) || (!io) || (!create_param))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	cxd2880_memset(tnr_dmd, 0, sizeof(struct cxd2880_tnrdmd));
+
+	tnr_dmd->io = io;
+	tnr_dmd->create_param = *create_param;
+
+	tnr_dmd->diver_mode = CXD2880_TNRDMD_DIVERMODE_SINGLE;
+	tnr_dmd->diver_sub = NULL;
+
+	tnr_dmd->srl_ts_clk_mod_cnts = 1;
+	tnr_dmd->en_fef_intmtnt_base = 1;
+	tnr_dmd->en_fef_intmtnt_lite = 1;
+	tnr_dmd->rf_lvl_cmpstn = NULL;
+	tnr_dmd->lna_thrs_tbl_air = NULL;
+	tnr_dmd->lna_thrs_tbl_cable = NULL;
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_diver_create(struct cxd2880_tnrdmd
+					     *tnr_dmd_main,
+					     struct cxd2880_io *io_main,
+					     struct cxd2880_tnrdmd *tnr_dmd_sub,
+					     struct cxd2880_io *io_sub,
+					     struct
+					     cxd2880_tnrdmd_diver_create_param
+					     *create_param)
+{
+	if ((!tnr_dmd_main) || (!io_main) || (!tnr_dmd_sub) || (!io_sub) ||
+	    (!create_param))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	cxd2880_memset(tnr_dmd_main, 0, sizeof(struct cxd2880_tnrdmd));
+	cxd2880_memset(tnr_dmd_sub, 0, sizeof(struct cxd2880_tnrdmd));
+
+	tnr_dmd_main->io = io_main;
+	tnr_dmd_main->diver_mode = CXD2880_TNRDMD_DIVERMODE_MAIN;
+	tnr_dmd_main->diver_sub = tnr_dmd_sub;
+	tnr_dmd_main->create_param.en_internal_ldo =
+	    create_param->en_internal_ldo;
+	tnr_dmd_main->create_param.ts_output_if = create_param->ts_output_if;
+	tnr_dmd_main->create_param.xtal_share_type =
+	    CXD2880_TNRDMD_XTAL_SHARE_MASTER;
+	tnr_dmd_main->create_param.xosc_cap = create_param->xosc_cap_main;
+	tnr_dmd_main->create_param.xosc_i = create_param->xosc_i_main;
+	tnr_dmd_main->create_param.is_cxd2881gg = create_param->is_cxd2881gg;
+	tnr_dmd_main->create_param.stationary_use =
+	    create_param->stationary_use;
+
+	tnr_dmd_sub->io = io_sub;
+	tnr_dmd_sub->diver_mode = CXD2880_TNRDMD_DIVERMODE_SUB;
+	tnr_dmd_sub->diver_sub = NULL;
+	tnr_dmd_sub->create_param.en_internal_ldo =
+	    create_param->en_internal_ldo;
+	tnr_dmd_sub->create_param.ts_output_if = create_param->ts_output_if;
+	tnr_dmd_sub->create_param.xtal_share_type =
+	    CXD2880_TNRDMD_XTAL_SHARE_SLAVE;
+	tnr_dmd_sub->create_param.xosc_cap = 0;
+	tnr_dmd_sub->create_param.xosc_i = create_param->xosc_i_sub;
+	tnr_dmd_sub->create_param.is_cxd2881gg = create_param->is_cxd2881gg;
+	tnr_dmd_sub->create_param.stationary_use = create_param->stationary_use;
+
+	tnr_dmd_main->srl_ts_clk_mod_cnts = 1;
+	tnr_dmd_main->en_fef_intmtnt_base = 1;
+	tnr_dmd_main->en_fef_intmtnt_lite = 1;
+	tnr_dmd_main->rf_lvl_cmpstn = NULL;
+	tnr_dmd_main->lna_thrs_tbl_air = NULL;
+	tnr_dmd_main->lna_thrs_tbl_cable = NULL;
+
+	tnr_dmd_sub->srl_ts_clk_mod_cnts = 1;
+	tnr_dmd_sub->en_fef_intmtnt_base = 1;
+	tnr_dmd_sub->en_fef_intmtnt_lite = 1;
+	tnr_dmd_sub->rf_lvl_cmpstn = NULL;
+	tnr_dmd_sub->lna_thrs_tbl_air = NULL;
+	tnr_dmd_sub->lna_thrs_tbl_cable = NULL;
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_init1(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	tnr_dmd->chip_id = CXD2880_TNRDMD_CHIP_ID_UNKNOWN;
+	tnr_dmd->state = CXD2880_TNRDMD_STATE_UNKNOWN;
+	tnr_dmd->clk_mode = CXD2880_TNRDMD_CLOCKMODE_UNKNOWN;
+	tnr_dmd->frequency_khz = 0;
+	tnr_dmd->sys = CXD2880_DTV_SYS_UNKNOWN;
+	tnr_dmd->bandwidth = CXD2880_DTV_BW_UNKNOWN;
+	tnr_dmd->scan_mode = 0;
+	cxd2880_atomic_set(&tnr_dmd->cancel, 0);
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		tnr_dmd->diver_sub->chip_id = CXD2880_TNRDMD_CHIP_ID_UNKNOWN;
+		tnr_dmd->diver_sub->state = CXD2880_TNRDMD_STATE_UNKNOWN;
+		tnr_dmd->diver_sub->clk_mode = CXD2880_TNRDMD_CLOCKMODE_UNKNOWN;
+		tnr_dmd->diver_sub->frequency_khz = 0;
+		tnr_dmd->diver_sub->sys = CXD2880_DTV_SYS_UNKNOWN;
+		tnr_dmd->diver_sub->bandwidth = CXD2880_DTV_BW_UNKNOWN;
+		tnr_dmd->diver_sub->scan_mode = 0;
+		cxd2880_atomic_set(&tnr_dmd->diver_sub->cancel, 0);
+	}
+
+	ret = cxd2880_tnrdmd_chip_id(tnr_dmd, &tnr_dmd->chip_id);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (!CXD2880_TNRDMD_CHIP_ID_VALID(tnr_dmd->chip_id))
+		return CXD2880_RESULT_ERROR_NOSUPPORT;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		ret =
+		    cxd2880_tnrdmd_chip_id(tnr_dmd->diver_sub,
+					   &tnr_dmd->diver_sub->chip_id);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (!CXD2880_TNRDMD_CHIP_ID_VALID(tnr_dmd->diver_sub->chip_id))
+			return CXD2880_RESULT_ERROR_NOSUPPORT;
+	}
+
+	ret = p_init1(tnr_dmd);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		ret = p_init1(tnr_dmd->diver_sub);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	CXD2880_SLEEP(1);
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		ret = p_init2(tnr_dmd->diver_sub);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	ret = p_init2(tnr_dmd);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	CXD2880_SLEEP(5);
+
+	ret = p_init3(tnr_dmd);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		ret = p_init3(tnr_dmd->diver_sub);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	ret = rf_init1(tnr_dmd);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		ret = rf_init1(tnr_dmd->diver_sub);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_init2(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	{
+		u8 cpu_task_completed = 0;
+
+		ret =
+		    cxd2880_tnrdmd_check_internal_cpu_status(tnr_dmd,
+						     &cpu_task_completed);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (!cpu_task_completed)
+			return CXD2880_RESULT_ERROR_HW_STATE;
+	}
+
+	ret = rf_init2(tnr_dmd);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		ret = rf_init2(tnr_dmd->diver_sub);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	ret = load_cfg_mem(tnr_dmd);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		ret = load_cfg_mem(tnr_dmd->diver_sub);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	tnr_dmd->state = CXD2880_TNRDMD_STATE_SLEEP;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN)
+		tnr_dmd->diver_sub->state = CXD2880_TNRDMD_STATE_SLEEP;
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_check_internal_cpu_status(struct cxd2880_tnrdmd
+							  *tnr_dmd,
+							  u8 *task_completed)
+{
+	u16 cpu_status = 0;
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!task_completed))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret = cxd2880_tnrdmd_mon_internal_cpu_status(tnr_dmd, &cpu_status);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SINGLE) {
+		if (cpu_status == 0)
+			*task_completed = 1;
+		else
+			*task_completed = 0;
+
+		return ret;
+	}
+	if (cpu_status != 0) {
+		*task_completed = 0;
+		return ret;
+	}
+
+	ret = cxd2880_tnrdmd_mon_internal_cpu_status_sub(tnr_dmd, &cpu_status);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (cpu_status == 0)
+		*task_completed = 1;
+	else
+		*task_completed = 0;
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_common_tune_setting1(struct cxd2880_tnrdmd
+						     *tnr_dmd,
+						     enum cxd2880_dtv_sys sys,
+						     u32 frequency_khz,
+						     enum cxd2880_dtv_bandwidth
+						     bandwidth, u8 one_seg_opt,
+						     u8 one_seg_opt_shft_dir)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (frequency_khz < 4000)
+		return CXD2880_RESULT_ERROR_RANGE;
+
+	ret = cxd2880_tnrdmd_sleep(tnr_dmd);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	{
+		u8 data = 0;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x00,
+					   0x00) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x2B, &data,
+					   1) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		switch (sys) {
+		case CXD2880_DTV_SYS_DVBT:
+		case CXD2880_DTV_SYS_ISDBT:
+		case CXD2880_DTV_SYS_ISDBTSB:
+		case CXD2880_DTV_SYS_ISDBTMM_A:
+		case CXD2880_DTV_SYS_ISDBTMM_B:
+			if (data == 0x00) {
+				ret = t_power_x(tnr_dmd, 1);
+				if (ret != CXD2880_RESULT_OK)
+					return ret;
+
+				if (tnr_dmd->diver_mode ==
+				    CXD2880_TNRDMD_DIVERMODE_MAIN) {
+					ret = t_power_x(tnr_dmd->diver_sub, 1);
+					if (ret != CXD2880_RESULT_OK)
+						return ret;
+				}
+			}
+			break;
+
+		case CXD2880_DTV_SYS_DVBT2:
+			if (data == 0x01) {
+				ret = t_power_x(tnr_dmd, 0);
+				if (ret != CXD2880_RESULT_OK)
+					return ret;
+
+				if (tnr_dmd->diver_mode ==
+				    CXD2880_TNRDMD_DIVERMODE_MAIN) {
+					ret = t_power_x(tnr_dmd->diver_sub, 0);
+					if (ret != CXD2880_RESULT_OK)
+						return ret;
+				}
+			}
+			break;
+
+		default:
+			return CXD2880_RESULT_ERROR_ARG;
+		}
+	}
+
+	{
+		enum cxd2880_tnrdmd_clockmode new_clk_mode =
+		    CXD2880_TNRDMD_CLOCKMODE_A;
+
+		ret = spll_reset(tnr_dmd, new_clk_mode);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		tnr_dmd->clk_mode = new_clk_mode;
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+			ret = spll_reset(tnr_dmd->diver_sub, new_clk_mode);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+
+			tnr_dmd->diver_sub->clk_mode = new_clk_mode;
+		}
+
+		ret = load_cfg_mem(tnr_dmd);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+			ret = load_cfg_mem(tnr_dmd->diver_sub);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+		}
+	}
+
+	{
+		int shift_frequency_khz = 0;
+
+		if (one_seg_opt) {
+			if (tnr_dmd->diver_mode ==
+			    CXD2880_TNRDMD_DIVERMODE_MAIN) {
+				shift_frequency_khz = 350;
+			} else {
+				if (one_seg_opt_shft_dir)
+					shift_frequency_khz = 350;
+				else
+					shift_frequency_khz = -350;
+
+				if (tnr_dmd->create_param.xtal_share_type ==
+				    CXD2880_TNRDMD_XTAL_SHARE_SLAVE)
+					shift_frequency_khz *= -1;
+			}
+		} else {
+			if (tnr_dmd->diver_mode ==
+			    CXD2880_TNRDMD_DIVERMODE_MAIN) {
+				shift_frequency_khz = 150;
+			} else {
+				switch (tnr_dmd->create_param.xtal_share_type) {
+				case CXD2880_TNRDMD_XTAL_SHARE_NONE:
+				case CXD2880_TNRDMD_XTAL_SHARE_EXTREF:
+				default:
+					shift_frequency_khz = 0;
+					break;
+				case CXD2880_TNRDMD_XTAL_SHARE_MASTER:
+					shift_frequency_khz = 150;
+					break;
+				case CXD2880_TNRDMD_XTAL_SHARE_SLAVE:
+					shift_frequency_khz = -150;
+					break;
+				}
+			}
+		}
+
+		ret =
+		    x_tune1(tnr_dmd, sys, frequency_khz, bandwidth,
+			    tnr_dmd->is_cable_input, shift_frequency_khz);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+			ret =
+			    x_tune1(tnr_dmd->diver_sub, sys, frequency_khz,
+				    bandwidth, tnr_dmd->is_cable_input,
+				    -shift_frequency_khz);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+		}
+
+		CXD2880_SLEEP(10);
+
+		{
+			u8 cpu_task_completed = 0;
+
+			ret =
+			    cxd2880_tnrdmd_check_internal_cpu_status(tnr_dmd,
+						     &cpu_task_completed);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+
+			if (!cpu_task_completed)
+				return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+
+		ret =
+		    x_tune2(tnr_dmd, bandwidth, tnr_dmd->clk_mode,
+			    shift_frequency_khz);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+			ret =
+			    x_tune2(tnr_dmd->diver_sub, bandwidth,
+				    tnr_dmd->diver_sub->clk_mode,
+				    -shift_frequency_khz);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+		}
+	}
+
+	if (tnr_dmd->create_param.ts_output_if == CXD2880_TNRDMD_TSOUT_IF_TS) {
+		ret = set_ts_clk_mode_and_freq(tnr_dmd, sys);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	} else {
+		struct cxd2880_tnrdmd_pid_ftr_cfg *pid_ftr_cfg;
+
+		if (tnr_dmd->pid_ftr_cfg_en)
+			pid_ftr_cfg = &tnr_dmd->pid_ftr_cfg;
+		else
+			pid_ftr_cfg = NULL;
+
+		ret = pid_ftr_setting(tnr_dmd, pid_ftr_cfg);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_common_tune_setting2(struct cxd2880_tnrdmd
+						     *tnr_dmd,
+						     enum cxd2880_dtv_sys sys,
+						     u8 en_fef_intmtnt_ctrl)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret = x_tune3(tnr_dmd, sys, en_fef_intmtnt_ctrl);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		ret = x_tune3(tnr_dmd->diver_sub, sys, en_fef_intmtnt_ctrl);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		ret = x_tune4(tnr_dmd);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	ret = cxd2880_tnrdmd_set_ts_output(tnr_dmd, 1);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_sleep(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state == CXD2880_TNRDMD_STATE_SLEEP) {
+	} else if (tnr_dmd->state == CXD2880_TNRDMD_STATE_ACTIVE) {
+		ret = cxd2880_tnrdmd_set_ts_output(tnr_dmd, 0);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+			ret = x_sleep1(tnr_dmd);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+		}
+
+		ret = x_sleep2(tnr_dmd);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+			ret = x_sleep2(tnr_dmd->diver_sub);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+		}
+
+		switch (tnr_dmd->sys) {
+		case CXD2880_DTV_SYS_DVBT:
+			ret = cxd2880_tnrdmd_dvbt_sleep_setting(tnr_dmd);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+			break;
+
+		case CXD2880_DTV_SYS_DVBT2:
+			ret = cxd2880_tnrdmd_dvbt2_sleep_setting(tnr_dmd);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+			break;
+
+		default:
+			return CXD2880_RESULT_ERROR_SW_STATE;
+		}
+
+		ret = x_sleep3(tnr_dmd);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+			ret = x_sleep3(tnr_dmd->diver_sub);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+		}
+
+		ret = x_sleep4(tnr_dmd);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+			ret = x_sleep4(tnr_dmd->diver_sub);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+		}
+
+		tnr_dmd->state = CXD2880_TNRDMD_STATE_SLEEP;
+		tnr_dmd->frequency_khz = 0;
+		tnr_dmd->sys = CXD2880_DTV_SYS_UNKNOWN;
+		tnr_dmd->bandwidth = CXD2880_DTV_BW_UNKNOWN;
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+			tnr_dmd->diver_sub->state = CXD2880_TNRDMD_STATE_SLEEP;
+			tnr_dmd->diver_sub->frequency_khz = 0;
+			tnr_dmd->diver_sub->sys = CXD2880_DTV_SYS_UNKNOWN;
+			tnr_dmd->diver_sub->bandwidth = CXD2880_DTV_BW_UNKNOWN;
+		}
+	} else {
+		return CXD2880_RESULT_ERROR_SW_STATE;
+	}
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_set_cfg(struct cxd2880_tnrdmd *tnr_dmd,
+					enum cxd2880_tnrdmd_cfg_id id,
+					int value)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	u8 data[2] = { 0 };
+	u8 need_sub_setting = 0;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	switch (id) {
+	case CXD2880_TNRDMD_CFG_OUTPUT_SEL_MSB:
+		if (tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP)
+			return CXD2880_RESULT_ERROR_SW_STATE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0xC4,
+							 (u8)(value ? 0x00 :
+							       0x10), 0x10);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_TSVALID_ACTIVE_HI:
+		if (tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP)
+			return CXD2880_RESULT_ERROR_SW_STATE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0xC5,
+							 (u8)(value ? 0x00 :
+							       0x02), 0x02);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_TSSYNC_ACTIVE_HI:
+		if (tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP)
+			return CXD2880_RESULT_ERROR_SW_STATE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0xC5,
+							 (u8)(value ? 0x00 :
+							       0x04), 0x04);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_TSERR_ACTIVE_HI:
+		if (tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP)
+			return CXD2880_RESULT_ERROR_SW_STATE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0xCB,
+							 (u8)(value ? 0x00 :
+							       0x01), 0x01);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_LATCH_ON_POSEDGE:
+		if (tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP)
+			return CXD2880_RESULT_ERROR_SW_STATE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0xC5,
+							 (u8)(value ? 0x01 :
+							       0x00), 0x01);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_TSCLK_CONT:
+		if (tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP)
+			return CXD2880_RESULT_ERROR_SW_STATE;
+
+		tnr_dmd->srl_ts_clk_mod_cnts = (u8)(value ? 0x01 : 0x00);
+		break;
+
+	case CXD2880_TNRDMD_CFG_TSCLK_MASK:
+		if (tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP)
+			return CXD2880_RESULT_ERROR_SW_STATE;
+
+		if ((value < 0) || (value > 0x1F))
+			return CXD2880_RESULT_ERROR_RANGE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0xC6, (u8)value,
+							 0x1F);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_TSVALID_MASK:
+		if (tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP)
+			return CXD2880_RESULT_ERROR_SW_STATE;
+
+		if ((value < 0) || (value > 0x1F))
+			return CXD2880_RESULT_ERROR_RANGE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0xC8, (u8)value,
+							 0x1F);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_TSERR_MASK:
+		if (tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP)
+			return CXD2880_RESULT_ERROR_SW_STATE;
+
+		if ((value < 0) || (value > 0x1F))
+			return CXD2880_RESULT_ERROR_RANGE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0xC9, (u8)value,
+							 0x1F);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_TSERR_VALID_DIS:
+		if (tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP)
+			return CXD2880_RESULT_ERROR_SW_STATE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0x91,
+							 (u8)(value ? 0x01 :
+							       0x00), 0x01);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_TSPIN_CURRENT:
+		if (tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP)
+			return CXD2880_RESULT_ERROR_SW_STATE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_SYS,
+							 0x00, 0x51, (u8)value,
+							 0x3F);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_TSPIN_PULLUP_MANUAL:
+		if (tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP)
+			return CXD2880_RESULT_ERROR_SW_STATE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_SYS,
+							 0x00, 0x50,
+							 (u8)(value ? 0x80 :
+							       0x00), 0x80);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_TSPIN_PULLUP:
+		if (tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP)
+			return CXD2880_RESULT_ERROR_SW_STATE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_SYS,
+							 0x00, 0x50, (u8)value,
+							 0x3F);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_TSCLK_FREQ:
+		if (tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP)
+			return CXD2880_RESULT_ERROR_SW_STATE;
+
+		if ((value < 0) || (value > 1))
+			return CXD2880_RESULT_ERROR_RANGE;
+
+		tnr_dmd->srl_ts_clk_frq =
+		    (enum cxd2880_tnrdmd_serial_ts_clk)value;
+		break;
+
+	case CXD2880_TNRDMD_CFG_TSBYTECLK_MANUAL:
+		if (tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP)
+			return CXD2880_RESULT_ERROR_SW_STATE;
+
+		if ((value < 0) || (value > 0xFF))
+			return CXD2880_RESULT_ERROR_RANGE;
+
+		tnr_dmd->ts_byte_clk_manual_setting = (u8)value;
+
+		break;
+
+	case CXD2880_TNRDMD_CFG_TS_PACKET_GAP:
+		if (tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP)
+			return CXD2880_RESULT_ERROR_SW_STATE;
+
+		if ((value < 0) || (value > 7))
+			return CXD2880_RESULT_ERROR_RANGE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0xD6, (u8)value,
+							 0x07);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		break;
+
+	case CXD2880_TNRDMD_CFG_TS_BACKWARDS_COMPATIBLE:
+		if (tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP)
+			return CXD2880_RESULT_ERROR_SW_STATE;
+
+		tnr_dmd->is_ts_backwards_compatible_mode = (u8)(value ? 1 : 0);
+
+		break;
+
+	case CXD2880_TNRDMD_CFG_PWM_VALUE:
+		if ((value < 0) || (value > 0x1000))
+			return CXD2880_RESULT_ERROR_RANGE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0x22,
+							 (u8)(value ? 0x01 :
+							       0x00), 0x01);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		{
+			u8 data[2];
+
+			data[0] = (u8)(((u16)value >> 8) & 0x1F);
+			data[1] = (u8)((u16)value & 0xFF);
+
+			ret =
+			    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0x23,
+							 data[0], 0x1F);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+
+			ret =
+			    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0x24,
+							 data[1], 0xFF);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+		}
+
+		break;
+
+	case CXD2880_TNRDMD_CFG_INTERRUPT:
+		data[0] = (u8)((value >> 8) & 0xFF);
+		data[1] = (u8)(value & 0xFF);
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_SYS,
+							 0x00, 0x48, data[0],
+							 0xFF);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_SYS,
+							 0x00, 0x49, data[1],
+							 0xFF);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_INTERRUPT_LOCK_SEL:
+		data[0] = (u8)(value & 0x07);
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_SYS,
+							 0x00, 0x4A, data[0],
+							 0x07);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_INTERRUPT_INV_LOCK_SEL:
+		data[0] = (u8)((value & 0x07) << 3);
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_SYS,
+							 0x00, 0x4A, data[0],
+							 0x38);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_FIXED_CLOCKMODE:
+		if ((value < (int)CXD2880_TNRDMD_CLOCKMODE_UNKNOWN) ||
+		    (value > (int)CXD2880_TNRDMD_CLOCKMODE_C))
+			return CXD2880_RESULT_ERROR_RANGE;
+		tnr_dmd->fixed_clk_mode = (enum cxd2880_tnrdmd_clockmode)value;
+		break;
+
+	case CXD2880_TNRDMD_CFG_CABLE_INPUT:
+		tnr_dmd->is_cable_input = (u8)(value ? 1 : 0);
+		break;
+
+	case CXD2880_TNRDMD_CFG_DVBT2_FEF_INTERMITTENT_BASE:
+		tnr_dmd->en_fef_intmtnt_base = (u8)(value ? 1 : 0);
+		break;
+
+	case CXD2880_TNRDMD_CFG_DVBT2_FEF_INTERMITTENT_LITE:
+		tnr_dmd->en_fef_intmtnt_lite = (u8)(value ? 1 : 0);
+		break;
+
+	case CXD2880_TNRDMD_CFG_TS_BUF_ALMOST_EMPTY_THRS:
+		data[0] = (u8)((value >> 8) & 0x07);
+		data[1] = (u8)(value & 0xFF);
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0x99, data[0],
+							 0x07);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0x9A, data[1],
+							 0xFF);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_TS_BUF_ALMOST_FULL_THRS:
+		data[0] = (u8)((value >> 8) & 0x07);
+		data[1] = (u8)(value & 0xFF);
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0x9B, data[0],
+							 0x07);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0x9C, data[1],
+							 0xFF);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_TS_BUF_RRDY_THRS:
+		data[0] = (u8)((value >> 8) & 0x07);
+		data[1] = (u8)(value & 0xFF);
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0x9D, data[0],
+							 0x07);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x00, 0x9E, data[1],
+							 0xFF);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_BLINDTUNE_DVBT2_FIRST:
+		tnr_dmd->blind_tune_dvbt2_first = (u8)(value ? 1 : 0);
+		break;
+
+	case CXD2880_TNRDMD_CFG_DVBT_BERN_PERIOD:
+		if ((value < 0) || (value > 31))
+			return CXD2880_RESULT_ERROR_RANGE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x10, 0x60,
+							 (u8)(value & 0x1F),
+							 0x1F);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_DVBT_VBER_PERIOD:
+		if ((value < 0) || (value > 7))
+			return CXD2880_RESULT_ERROR_RANGE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x10, 0x6F,
+							 (u8)(value & 0x07),
+							 0x07);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_DVBT2_BBER_MES:
+		if ((value < 0) || (value > 15))
+			return CXD2880_RESULT_ERROR_RANGE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x20, 0x72,
+							 (u8)(value & 0x0F),
+							 0x0F);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_DVBT2_LBER_MES:
+		if ((value < 0) || (value > 15))
+			return CXD2880_RESULT_ERROR_RANGE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x20, 0x6F,
+							 (u8)(value & 0x0F),
+							 0x0F);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_DVBT_PER_MES:
+		if ((value < 0) || (value > 15))
+			return CXD2880_RESULT_ERROR_RANGE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x10, 0x5C,
+							 (u8)(value & 0x0F),
+							 0x0F);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_DVBT2_PER_MES:
+		if ((value < 0) || (value > 15))
+			return CXD2880_RESULT_ERROR_RANGE;
+
+		ret =
+		    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x24, 0xDC,
+							 (u8)(value & 0x0F),
+							 0x0F);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+		break;
+
+	case CXD2880_TNRDMD_CFG_ISDBT_BERPER_PERIOD:
+		{
+			u8 data[2];
+
+			data[0] = (u8)((value & 0x00007F00) >> 8);
+			data[1] = (u8)(value & 0x000000FF);
+
+			ret =
+			    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x60, 0x5B,
+							 data[0], 0x7F);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+			ret =
+			    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd,
+							 CXD2880_IO_TGT_DMD,
+							 0x60, 0x5C,
+							 data[1], 0xFF);
+			if (ret != CXD2880_RESULT_OK)
+				return ret;
+		}
+		break;
+
+	default:
+		return CXD2880_RESULT_ERROR_ARG;
+	}
+
+	if (need_sub_setting &&
+	    (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN)) {
+		ret = cxd2880_tnrdmd_set_cfg(tnr_dmd->diver_sub, id, value);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_gpio_set_cfg(struct cxd2880_tnrdmd *tnr_dmd,
+					     u8 id,
+					     u8 en,
+					     enum cxd2880_tnrdmd_gpio_mode mode,
+					     u8 open_drain, u8 invert)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (id > 2)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (mode > CXD2880_TNRDMD_GPIO_MODE_EEW)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret =
+	    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd, CXD2880_IO_TGT_SYS,
+						 0x00, 0x40 + id, (u8)mode,
+						 0x0F);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret =
+	    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd, CXD2880_IO_TGT_SYS,
+						 0x00, 0x43,
+						 (u8)(open_drain ? (1 << id) :
+						       0), (u8)(1 << id));
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret =
+	    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd, CXD2880_IO_TGT_SYS,
+						 0x00, 0x44,
+						 (u8)(invert ? (1 << id) : 0),
+						 (u8)(1 << id));
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret =
+	    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd, CXD2880_IO_TGT_SYS,
+						 0x00, 0x45,
+						 (u8)(en ? 0 : (1 << id)),
+						 (u8)(1 << id));
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_gpio_set_cfg_sub(struct cxd2880_tnrdmd *tnr_dmd,
+						 u8 id,
+						 u8 en,
+						 enum cxd2880_tnrdmd_gpio_mode
+						 mode, u8 open_drain, u8 invert)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret =
+	    cxd2880_tnrdmd_gpio_set_cfg(tnr_dmd->diver_sub, id, en, mode,
+					open_drain, invert);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_gpio_read(struct cxd2880_tnrdmd *tnr_dmd,
+					  u8 id, u8 *value)
+{
+	u8 data = 0;
+
+	if ((!tnr_dmd) || (!value))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (id > 2)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x0A) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x20, &data,
+				   1) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	*value = (u8)((data >> id) & 0x01);
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_gpio_read_sub(struct cxd2880_tnrdmd *tnr_dmd,
+					      u8 id, u8 *value)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret = cxd2880_tnrdmd_gpio_read(tnr_dmd->diver_sub, id, value);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_gpio_write(struct cxd2880_tnrdmd *tnr_dmd,
+					   u8 id, u8 value)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (id > 2)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret =
+	    cxd2880_tnrdmd_set_and_save_reg_bits(tnr_dmd, CXD2880_IO_TGT_SYS,
+						 0x00, 0x46,
+						 (u8)(value ? (1 << id) : 0),
+						 (u8)(1 << id));
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_gpio_write_sub(struct cxd2880_tnrdmd *tnr_dmd,
+					       u8 id, u8 value)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret = cxd2880_tnrdmd_gpio_write(tnr_dmd->diver_sub, id, value);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_interrupt_read(struct cxd2880_tnrdmd *tnr_dmd,
+					       u16 *value)
+{
+	u8 data[2] = { 0 };
+
+	if ((!tnr_dmd) || (!value))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x0A) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x15, data,
+				   2) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	*value = (u16)(((u16)data[0] << 8) | (data[1]));
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_interrupt_clear(struct cxd2880_tnrdmd *tnr_dmd,
+						u16 value)
+{
+	u8 data[2] = { 0 };
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	data[0] = (u8)((value >> 8) & 0xFF);
+	data[1] = (u8)(value & 0xFF);
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_SYS, 0x3C, data,
+				    2) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_ts_buf_clear(struct cxd2880_tnrdmd *tnr_dmd,
+					     u8 clear_overflow_flag,
+					     u8 clear_underflow_flag,
+					     u8 clear_buf)
+{
+	u8 data[2] = { 0 };
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	data[0] = (u8)(clear_overflow_flag ? 0x02 : 0x00);
+	data[0] |= (u8)(clear_underflow_flag ? 0x01 : 0x00);
+	data[1] = (u8)(clear_buf ? 0x01 : 0x00);
+	if (tnr_dmd->io->write_regs(tnr_dmd->io,
+				    CXD2880_IO_TGT_DMD, 0x9F, data,
+				    2) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_chip_id(struct cxd2880_tnrdmd *tnr_dmd,
+					enum cxd2880_tnrdmd_chip_id *chip_id)
+{
+	u8 data = 0;
+
+	if ((!tnr_dmd) || (!chip_id))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0xFD, &data,
+				   1) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	*chip_id = (enum cxd2880_tnrdmd_chip_id)data;
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_set_and_save_reg_bits(struct cxd2880_tnrdmd
+						      *tnr_dmd,
+						      enum cxd2880_io_tgt tgt,
+						      u8 bank, u8 address,
+						      u8 value, u8 bit_mask)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   tgt, 0x00, bank) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (cxd2880_io_set_reg_bits(tnr_dmd->io, tgt, address, value, bit_mask)
+	    != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	ret = set_cfg_mem(tnr_dmd, tgt, bank, address, value, bit_mask);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_set_scan_mode(struct cxd2880_tnrdmd *tnr_dmd,
+					      enum cxd2880_dtv_sys sys,
+					      u8 scan_mode_end)
+{
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	CXD2880_ARG_UNUSED(sys);
+
+	tnr_dmd->scan_mode = scan_mode_end;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+		ret =
+		    cxd2880_tnrdmd_set_scan_mode(tnr_dmd->diver_sub, sys,
+						 scan_mode_end);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_set_pid_ftr(struct cxd2880_tnrdmd *tnr_dmd,
+					    struct cxd2880_tnrdmd_pid_ftr_cfg
+					    *pid_ftr_cfg)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->create_param.ts_output_if == CXD2880_TNRDMD_TSOUT_IF_TS)
+		return CXD2880_RESULT_ERROR_NOSUPPORT;
+
+	if (pid_ftr_cfg) {
+		tnr_dmd->pid_ftr_cfg = *pid_ftr_cfg;
+		tnr_dmd->pid_ftr_cfg_en = 1;
+	} else {
+		tnr_dmd->pid_ftr_cfg_en = 0;
+	}
+
+	if (tnr_dmd->state == CXD2880_TNRDMD_STATE_ACTIVE) {
+		ret = pid_ftr_setting(tnr_dmd, pid_ftr_cfg);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_set_rf_lvl_cmpstn(struct cxd2880_tnrdmd
+					  *tnr_dmd,
+					  enum
+					  cxd2880_ret(*rf_lvl_cmpstn)
+					  (struct cxd2880_tnrdmd *,
+					   int *))
+{
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	tnr_dmd->rf_lvl_cmpstn = rf_lvl_cmpstn;
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_set_rf_lvl_cmpstn_sub(struct cxd2880_tnrdmd
+						      *tnr_dmd,
+						      enum
+						      cxd2880_ret
+						      (*rf_lvl_cmpstn)(struct
+								cxd2880_tnrdmd
+								*,
+								int *))
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret =
+	    cxd2880_tnrdmd_set_rf_lvl_cmpstn(tnr_dmd->diver_sub, rf_lvl_cmpstn);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_set_lna_thrs(struct cxd2880_tnrdmd *tnr_dmd,
+					     struct
+					     cxd2880_tnrdmd_lna_thrs_tbl_air
+					     *tbl_air,
+					     struct
+					     cxd2880_tnrdmd_lna_thrs_tbl_cable
+					     *tbl_cable)
+{
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	tnr_dmd->lna_thrs_tbl_air = tbl_air;
+	tnr_dmd->lna_thrs_tbl_cable = tbl_cable;
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_set_lna_thrs_sub(struct cxd2880_tnrdmd *tnr_dmd,
+					 struct
+					 cxd2880_tnrdmd_lna_thrs_tbl_air
+					 *tbl_air,
+					 struct
+					 cxd2880_tnrdmd_lna_thrs_tbl_cable
+					 *tbl_cable)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret =
+	    cxd2880_tnrdmd_set_lna_thrs(tnr_dmd->diver_sub, tbl_air, tbl_cable);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_set_ts_pin_high_low(struct cxd2880_tnrdmd
+						    *tnr_dmd, u8 en, u8 value)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->create_param.ts_output_if != CXD2880_TNRDMD_TSOUT_IF_TS)
+		return CXD2880_RESULT_ERROR_NOSUPPORT;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (en) {
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x50,
+					   ((value & 0x1F) | 0x80)) !=
+		    CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x52,
+					   (value & 0x1F)) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	} else {
+		ret = tnr_dmd->io->write_reg(tnr_dmd->io,
+					     CXD2880_IO_TGT_SYS, 0x50, 0x3F);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x52,
+					   0x1F) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		ret = load_cfg_mem(tnr_dmd);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_set_ts_output(struct cxd2880_tnrdmd *tnr_dmd,
+					      u8 en)
+{
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	switch (tnr_dmd->create_param.ts_output_if) {
+	case CXD2880_TNRDMD_TSOUT_IF_TS:
+		if (en) {
+			if (tnr_dmd->io->write_reg(tnr_dmd->io,
+						   CXD2880_IO_TGT_SYS, 0x00,
+						   0x00) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+			if (tnr_dmd->io->write_reg(tnr_dmd->io,
+						   CXD2880_IO_TGT_SYS, 0x52,
+						   0x00) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+			if (tnr_dmd->io->write_reg(tnr_dmd->io,
+						   CXD2880_IO_TGT_DMD, 0x00,
+						   0x00) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+			if (tnr_dmd->io->write_reg(tnr_dmd->io,
+						   CXD2880_IO_TGT_DMD, 0xC3,
+						   0x00) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		} else {
+			if (tnr_dmd->io->write_reg(tnr_dmd->io,
+						   CXD2880_IO_TGT_DMD, 0x00,
+						   0x00) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+			if (tnr_dmd->io->write_reg(tnr_dmd->io,
+						   CXD2880_IO_TGT_DMD, 0xC3,
+						   0x01) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+			if (tnr_dmd->io->write_reg(tnr_dmd->io,
+						   CXD2880_IO_TGT_SYS, 0x00,
+						   0x00) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+			if (tnr_dmd->io->write_reg(tnr_dmd->io,
+						   CXD2880_IO_TGT_SYS, 0x52,
+						   0x1F) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+		break;
+
+	case CXD2880_TNRDMD_TSOUT_IF_SPI:
+		break;
+
+	case CXD2880_TNRDMD_TSOUT_IF_SDIO:
+		break;
+
+	default:
+		return CXD2880_RESULT_ERROR_SW_STATE;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret slvt_freeze_reg(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	switch (tnr_dmd->create_param.ts_output_if) {
+	case CXD2880_TNRDMD_TSOUT_IF_SPI:
+	case CXD2880_TNRDMD_TSOUT_IF_SDIO:
+		{
+			u8 data = 0;
+
+			if (tnr_dmd->io->read_regs(tnr_dmd->io,
+						   CXD2880_IO_TGT_DMD, 0x00,
+						   &data,
+						   1) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+		break;
+	case CXD2880_TNRDMD_TSOUT_IF_TS:
+	default:
+		break;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x01,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return ret;
+}
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd.h
new file mode 100644
index 000000000000..26e29b3b9f6b
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd.h
@@ -0,0 +1,395 @@
+/*
+ * cxd2880_tnrdmd.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * common control interface
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_TNRDMD_H
+#define CXD2880_TNRDMD_H
+
+#include "cxd2880_common.h"
+#include "cxd2880_io.h"
+#include "cxd2880_dtv.h"
+#include "cxd2880_dvbt.h"
+#include "cxd2880_dvbt2.h"
+
+#define CXD2880_TNRDMD_MAX_CFG_MEM_COUNT 100
+
+#define slvt_unfreeze_reg(tnr_dmd) ((void)((tnr_dmd)->io->write_reg\
+((tnr_dmd)->io, CXD2880_IO_TGT_DMD, 0x01, 0x00)))
+
+#define CXD2880_TNRDMD_INTERRUPT_TYPE_BUF_UNDERFLOW     0x0001
+#define CXD2880_TNRDMD_INTERRUPT_TYPE_BUF_OVERFLOW      0x0002
+#define CXD2880_TNRDMD_INTERRUPT_TYPE_BUF_ALMOST_EMPTY  0x0004
+#define CXD2880_TNRDMD_INTERRUPT_TYPE_BUF_ALMOST_FULL   0x0008
+#define CXD2880_TNRDMD_INTERRUPT_TYPE_BUF_RRDY	  0x0010
+#define CXD2880_TNRDMD_INTERRUPT_TYPE_ILLEGAL_COMMAND      0x0020
+#define CXD2880_TNRDMD_INTERRUPT_TYPE_ILLEGAL_ACCESS       0x0040
+#define CXD2880_TNRDMD_INTERRUPT_TYPE_CPU_ERROR	    0x0100
+#define CXD2880_TNRDMD_INTERRUPT_TYPE_LOCK		 0x0200
+#define CXD2880_TNRDMD_INTERRUPT_TYPE_INV_LOCK	     0x0400
+#define CXD2880_TNRDMD_INTERRUPT_TYPE_NOOFDM	       0x0800
+#define CXD2880_TNRDMD_INTERRUPT_TYPE_EWS		  0x1000
+#define CXD2880_TNRDMD_INTERRUPT_TYPE_EEW		  0x2000
+#define CXD2880_TNRDMD_INTERRUPT_TYPE_FEC_FAIL	     0x4000
+
+#define CXD2880_TNRDMD_INTERRUPT_LOCK_SEL_L1POST_OK	0x01
+#define CXD2880_TNRDMD_INTERRUPT_LOCK_SEL_DMD_LOCK	 0x02
+#define CXD2880_TNRDMD_INTERRUPT_LOCK_SEL_TS_LOCK	  0x04
+
+enum cxd2880_tnrdmd_chip_id {
+	CXD2880_TNRDMD_CHIP_ID_UNKNOWN = 0x00,
+	CXD2880_TNRDMD_CHIP_ID_CXD2880_ES1_0X = 0x62,
+	CXD2880_TNRDMD_CHIP_ID_CXD2880_ES1_11 = 0x6A
+};
+
+#define CXD2880_TNRDMD_CHIP_ID_VALID(chip_id) (((chip_id) == \
+CXD2880_TNRDMD_CHIP_ID_CXD2880_ES1_0X) || \
+((chip_id) == CXD2880_TNRDMD_CHIP_ID_CXD2880_ES1_11))
+
+enum cxd2880_tnrdmd_state {
+	CXD2880_TNRDMD_STATE_UNKNOWN,
+	CXD2880_TNRDMD_STATE_SLEEP,
+	CXD2880_TNRDMD_STATE_ACTIVE,
+	CXD2880_TNRDMD_STATE_INVALID
+};
+
+enum cxd2880_tnrdmd_divermode {
+	CXD2880_TNRDMD_DIVERMODE_SINGLE,
+	CXD2880_TNRDMD_DIVERMODE_MAIN,
+	CXD2880_TNRDMD_DIVERMODE_SUB
+};
+
+enum cxd2880_tnrdmd_clockmode {
+	CXD2880_TNRDMD_CLOCKMODE_UNKNOWN,
+	CXD2880_TNRDMD_CLOCKMODE_A,
+	CXD2880_TNRDMD_CLOCKMODE_B,
+	CXD2880_TNRDMD_CLOCKMODE_C
+};
+
+enum cxd2880_tnrdmd_tsout_if {
+	CXD2880_TNRDMD_TSOUT_IF_TS,
+	CXD2880_TNRDMD_TSOUT_IF_SPI,
+	CXD2880_TNRDMD_TSOUT_IF_SDIO
+};
+
+enum cxd2880_tnrdmd_xtal_share {
+	CXD2880_TNRDMD_XTAL_SHARE_NONE,
+	CXD2880_TNRDMD_XTAL_SHARE_EXTREF,
+	CXD2880_TNRDMD_XTAL_SHARE_MASTER,
+	CXD2880_TNRDMD_XTAL_SHARE_SLAVE
+};
+
+enum cxd2880_tnrdmd_spectrum_sense {
+	CXD2880_TNRDMD_SPECTRUM_NORMAL,
+	CXD2880_TNRDMD_SPECTRUM_INV
+};
+
+enum cxd2880_tnrdmd_cfg_id {
+	CXD2880_TNRDMD_CFG_OUTPUT_SEL_MSB,
+	CXD2880_TNRDMD_CFG_TSVALID_ACTIVE_HI,
+	CXD2880_TNRDMD_CFG_TSSYNC_ACTIVE_HI,
+	CXD2880_TNRDMD_CFG_TSERR_ACTIVE_HI,
+	CXD2880_TNRDMD_CFG_LATCH_ON_POSEDGE,
+	CXD2880_TNRDMD_CFG_TSCLK_CONT,
+	CXD2880_TNRDMD_CFG_TSCLK_MASK,
+	CXD2880_TNRDMD_CFG_TSVALID_MASK,
+	CXD2880_TNRDMD_CFG_TSERR_MASK,
+	CXD2880_TNRDMD_CFG_TSERR_VALID_DIS,
+	CXD2880_TNRDMD_CFG_TSPIN_CURRENT,
+	CXD2880_TNRDMD_CFG_TSPIN_PULLUP_MANUAL,
+	CXD2880_TNRDMD_CFG_TSPIN_PULLUP,
+	CXD2880_TNRDMD_CFG_TSCLK_FREQ,
+	CXD2880_TNRDMD_CFG_TSBYTECLK_MANUAL,
+	CXD2880_TNRDMD_CFG_TS_PACKET_GAP,
+	CXD2880_TNRDMD_CFG_TS_BACKWARDS_COMPATIBLE,
+	CXD2880_TNRDMD_CFG_PWM_VALUE,
+	CXD2880_TNRDMD_CFG_INTERRUPT,
+	CXD2880_TNRDMD_CFG_INTERRUPT_LOCK_SEL,
+	CXD2880_TNRDMD_CFG_INTERRUPT_INV_LOCK_SEL,
+	CXD2880_TNRDMD_CFG_TS_BUF_ALMOST_EMPTY_THRS,
+	CXD2880_TNRDMD_CFG_TS_BUF_ALMOST_FULL_THRS,
+	CXD2880_TNRDMD_CFG_TS_BUF_RRDY_THRS,
+	CXD2880_TNRDMD_CFG_FIXED_CLOCKMODE,
+	CXD2880_TNRDMD_CFG_CABLE_INPUT,
+	CXD2880_TNRDMD_CFG_DVBT2_FEF_INTERMITTENT_BASE,
+	CXD2880_TNRDMD_CFG_DVBT2_FEF_INTERMITTENT_LITE,
+	CXD2880_TNRDMD_CFG_BLINDTUNE_DVBT2_FIRST,
+	CXD2880_TNRDMD_CFG_DVBT_BERN_PERIOD,
+	CXD2880_TNRDMD_CFG_DVBT_VBER_PERIOD,
+	CXD2880_TNRDMD_CFG_DVBT_PER_MES,
+	CXD2880_TNRDMD_CFG_DVBT2_BBER_MES,
+	CXD2880_TNRDMD_CFG_DVBT2_LBER_MES,
+	CXD2880_TNRDMD_CFG_DVBT2_PER_MES,
+	CXD2880_TNRDMD_CFG_ISDBT_BERPER_PERIOD
+};
+
+enum cxd2880_tnrdmd_lock_result {
+	CXD2880_TNRDMD_LOCK_RESULT_NOTDETECT,
+	CXD2880_TNRDMD_LOCK_RESULT_LOCKED,
+	CXD2880_TNRDMD_LOCK_RESULT_UNLOCKED
+};
+
+enum cxd2880_tnrdmd_gpio_mode {
+	CXD2880_TNRDMD_GPIO_MODE_OUTPUT = 0x00,
+	CXD2880_TNRDMD_GPIO_MODE_INPUT = 0x01,
+	CXD2880_TNRDMD_GPIO_MODE_INT = 0x02,
+	CXD2880_TNRDMD_GPIO_MODE_FEC_FAIL = 0x03,
+	CXD2880_TNRDMD_GPIO_MODE_PWM = 0x04,
+	CXD2880_TNRDMD_GPIO_MODE_EWS = 0x05,
+	CXD2880_TNRDMD_GPIO_MODE_EEW = 0x06
+};
+
+enum cxd2880_tnrdmd_serial_ts_clk {
+	CXD2880_TNRDMD_SERIAL_TS_CLK_FULL,
+	CXD2880_TNRDMD_SERIAL_TS_CLK_HALF
+};
+
+struct cxd2880_tnrdmd_cfg_mem {
+	enum cxd2880_io_tgt tgt;
+	u8 bank;
+	u8 address;
+	u8 value;
+	u8 bit_mask;
+};
+
+struct cxd2880_tnrdmd_pid_cfg {
+	u8 is_en;
+	u16 pid;
+};
+
+struct cxd2880_tnrdmd_pid_ftr_cfg {
+	u8 is_negative;
+	struct cxd2880_tnrdmd_pid_cfg pid_cfg[32];
+};
+
+struct cxd2880_tnrdmd_ts_buf_info {
+	u8 read_ready;
+	u8 almost_full;
+	u8 almost_empty;
+	u8 overflow;
+	u8 underflow;
+	u16 packet_num;
+};
+
+struct cxd2880_tnrdmd_lna_thrs {
+	u8 off_on;
+	u8 on_off;
+};
+
+struct cxd2880_tnrdmd_lna_thrs_tbl_air {
+	struct cxd2880_tnrdmd_lna_thrs thrs[24];
+};
+
+struct cxd2880_tnrdmd_lna_thrs_tbl_cable {
+	struct cxd2880_tnrdmd_lna_thrs thrs[32];
+};
+
+struct cxd2880_tnrdmd_create_param {
+	enum cxd2880_tnrdmd_tsout_if ts_output_if;
+	u8 en_internal_ldo;
+	enum cxd2880_tnrdmd_xtal_share xtal_share_type;
+	u8 xosc_cap;
+	u8 xosc_i;
+	u8 is_cxd2881gg;
+	u8 stationary_use;
+};
+
+struct cxd2880_tnrdmd_diver_create_param {
+	enum cxd2880_tnrdmd_tsout_if ts_output_if;
+	u8 en_internal_ldo;
+	u8 xosc_cap_main;
+	u8 xosc_i_main;
+	u8 xosc_i_sub;
+	u8 is_cxd2881gg;
+	u8 stationary_use;
+};
+
+struct cxd2880_tnrdmd {
+	struct cxd2880_tnrdmd *diver_sub;
+	struct cxd2880_io *io;
+	struct cxd2880_tnrdmd_create_param create_param;
+	enum cxd2880_tnrdmd_divermode diver_mode;
+	enum cxd2880_tnrdmd_clockmode fixed_clk_mode;
+	u8 is_cable_input;
+	u8 en_fef_intmtnt_base;
+	u8 en_fef_intmtnt_lite;
+	u8 blind_tune_dvbt2_first;
+	enum cxd2880_ret (*rf_lvl_cmpstn)(struct cxd2880_tnrdmd *tnr_dmd,
+					   int *rf_lvl_db);
+	struct cxd2880_tnrdmd_lna_thrs_tbl_air *lna_thrs_tbl_air;
+	struct cxd2880_tnrdmd_lna_thrs_tbl_cable *lna_thrs_tbl_cable;
+	u8 srl_ts_clk_mod_cnts;
+	enum cxd2880_tnrdmd_serial_ts_clk srl_ts_clk_frq;
+	u8 ts_byte_clk_manual_setting;
+	u8 is_ts_backwards_compatible_mode;
+	struct cxd2880_tnrdmd_cfg_mem cfg_mem[CXD2880_TNRDMD_MAX_CFG_MEM_COUNT];
+	u8 cfg_mem_last_entry;
+	struct cxd2880_tnrdmd_pid_ftr_cfg pid_ftr_cfg;
+	u8 pid_ftr_cfg_en;
+	void *user;
+	enum cxd2880_tnrdmd_chip_id chip_id;
+	enum cxd2880_tnrdmd_state state;
+	enum cxd2880_tnrdmd_clockmode clk_mode;
+	u32 frequency_khz;
+	enum cxd2880_dtv_sys sys;
+	enum cxd2880_dtv_bandwidth bandwidth;
+	u8 scan_mode;
+	struct cxd2880_atomic cancel;
+};
+
+enum cxd2880_ret cxd2880_tnrdmd_create(struct cxd2880_tnrdmd *tnr_dmd,
+				       struct cxd2880_io *io,
+				       struct cxd2880_tnrdmd_create_param
+				       *create_param);
+
+enum cxd2880_ret cxd2880_tnrdmd_diver_create(struct cxd2880_tnrdmd
+					     *tnr_dmd_main,
+					     struct cxd2880_io *io_main,
+					     struct cxd2880_tnrdmd *tnr_dmd_sub,
+					     struct cxd2880_io *io_sub,
+					     struct
+					     cxd2880_tnrdmd_diver_create_param
+					     *create_param);
+
+enum cxd2880_ret cxd2880_tnrdmd_init1(struct cxd2880_tnrdmd *tnr_dmd);
+
+enum cxd2880_ret cxd2880_tnrdmd_init2(struct cxd2880_tnrdmd *tnr_dmd);
+
+enum cxd2880_ret cxd2880_tnrdmd_check_internal_cpu_status(struct cxd2880_tnrdmd
+							  *tnr_dmd,
+							  u8 *task_completed);
+
+enum cxd2880_ret cxd2880_tnrdmd_common_tune_setting1(struct cxd2880_tnrdmd
+						     *tnr_dmd,
+						     enum cxd2880_dtv_sys sys,
+						     u32 frequency_khz,
+						     enum cxd2880_dtv_bandwidth
+						     bandwidth, u8 one_seg_opt,
+						     u8 one_seg_opt_shft_dir);
+
+enum cxd2880_ret cxd2880_tnrdmd_common_tune_setting2(struct cxd2880_tnrdmd
+						     *tnr_dmd,
+						     enum cxd2880_dtv_sys sys,
+						     u8 en_fef_intmtnt_ctrl);
+
+enum cxd2880_ret cxd2880_tnrdmd_sleep(struct cxd2880_tnrdmd *tnr_dmd);
+
+enum cxd2880_ret cxd2880_tnrdmd_set_cfg(struct cxd2880_tnrdmd *tnr_dmd,
+					enum cxd2880_tnrdmd_cfg_id id,
+					int value);
+
+enum cxd2880_ret cxd2880_tnrdmd_gpio_set_cfg(struct cxd2880_tnrdmd *tnr_dmd,
+					     u8 id,
+					     u8 en,
+					     enum cxd2880_tnrdmd_gpio_mode mode,
+					     u8 open_drain, u8 invert);
+
+enum cxd2880_ret cxd2880_tnrdmd_gpio_set_cfg_sub(struct cxd2880_tnrdmd *tnr_dmd,
+						 u8 id,
+						 u8 en,
+						 enum cxd2880_tnrdmd_gpio_mode
+						 mode, u8 open_drain,
+						 u8 invert);
+
+enum cxd2880_ret cxd2880_tnrdmd_gpio_read(struct cxd2880_tnrdmd *tnr_dmd,
+					  u8 id, u8 *value);
+
+enum cxd2880_ret cxd2880_tnrdmd_gpio_read_sub(struct cxd2880_tnrdmd *tnr_dmd,
+					      u8 id, u8 *value);
+
+enum cxd2880_ret cxd2880_tnrdmd_gpio_write(struct cxd2880_tnrdmd *tnr_dmd,
+					   u8 id, u8 value);
+
+enum cxd2880_ret cxd2880_tnrdmd_gpio_write_sub(struct cxd2880_tnrdmd *tnr_dmd,
+					       u8 id, u8 value);
+
+enum cxd2880_ret cxd2880_tnrdmd_interrupt_read(struct cxd2880_tnrdmd *tnr_dmd,
+					       u16 *value);
+
+enum cxd2880_ret cxd2880_tnrdmd_interrupt_clear(struct cxd2880_tnrdmd *tnr_dmd,
+						u16 value);
+
+enum cxd2880_ret cxd2880_tnrdmd_ts_buf_clear(struct cxd2880_tnrdmd *tnr_dmd,
+					     u8 clear_overflow_flag,
+					     u8 clear_underflow_flag,
+					     u8 clear_buf);
+
+enum cxd2880_ret cxd2880_tnrdmd_chip_id(struct cxd2880_tnrdmd *tnr_dmd,
+					enum cxd2880_tnrdmd_chip_id *chip_id);
+
+enum cxd2880_ret cxd2880_tnrdmd_set_and_save_reg_bits(struct cxd2880_tnrdmd
+						      *tnr_dmd,
+						      enum cxd2880_io_tgt tgt,
+						      u8 bank, u8 address,
+						      u8 value, u8 bit_mask);
+
+enum cxd2880_ret cxd2880_tnrdmd_set_scan_mode(struct cxd2880_tnrdmd *tnr_dmd,
+					      enum cxd2880_dtv_sys sys,
+					      u8 scan_mode_end);
+
+enum cxd2880_ret cxd2880_tnrdmd_set_pid_ftr(struct cxd2880_tnrdmd *tnr_dmd,
+					    struct cxd2880_tnrdmd_pid_ftr_cfg
+					    *pid_ftr_cfg);
+
+enum cxd2880_ret cxd2880_tnrdmd_set_rf_lvl_cmpstn(struct cxd2880_tnrdmd
+						  *tnr_dmd,
+						  enum
+						  cxd2880_ret(*rf_lvl_cmpstn)
+						  (struct cxd2880_tnrdmd *,
+						   int *));
+
+enum cxd2880_ret cxd2880_tnrdmd_set_rf_lvl_cmpstn_sub(struct cxd2880_tnrdmd
+						      *tnr_dmd,
+						      enum
+						      cxd2880_ret
+						      (*rf_lvl_cmpstn)(struct
+								cxd2880_tnrdmd
+								*,
+								int *));
+
+enum cxd2880_ret cxd2880_tnrdmd_set_lna_thrs(struct cxd2880_tnrdmd *tnr_dmd,
+					     struct
+					     cxd2880_tnrdmd_lna_thrs_tbl_air
+					     *tbl_air,
+					     struct
+					     cxd2880_tnrdmd_lna_thrs_tbl_cable
+					     *tbl_cable);
+
+enum cxd2880_ret cxd2880_tnrdmd_set_lna_thrs_sub(struct cxd2880_tnrdmd *tnr_dmd,
+					 struct
+					 cxd2880_tnrdmd_lna_thrs_tbl_air
+					 *tbl_air,
+					 struct
+					 cxd2880_tnrdmd_lna_thrs_tbl_cable
+					 *tbl_cable);
+
+enum cxd2880_ret cxd2880_tnrdmd_set_ts_pin_high_low(struct cxd2880_tnrdmd
+						    *tnr_dmd, u8 en, u8 value);
+
+enum cxd2880_ret cxd2880_tnrdmd_set_ts_output(struct cxd2880_tnrdmd *tnr_dmd,
+					      u8 en);
+
+enum cxd2880_ret slvt_freeze_reg(struct cxd2880_tnrdmd *tnr_dmd);
+
+#endif
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_driver_version.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_driver_version.h
new file mode 100644
index 000000000000..68fb3af04bd4
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_driver_version.h
@@ -0,0 +1,29 @@
+/*
+ * cxd2880_tnrdmd_driver_version.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * version information
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define CXD2880_TNRDMD_DRIVER_VERSION "1.4.1 - 1.0.1"
+
+#define CXD2880_TNRDMD_DRIVER_RELEASE_DATE "2017-04-13"
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt.c b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt.c
new file mode 100644
index 000000000000..f36cf533ec17
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt.c
@@ -0,0 +1,1072 @@
+/*
+ * cxd2880_tnrdmd_dvbt.c
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * control functions for DVB-T
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "cxd2880_tnrdmd_dvbt.h"
+#include "cxd2880_tnrdmd_dvbt_mon.h"
+
+static enum cxd2880_ret x_tune_dvbt_demod_setting(struct cxd2880_tnrdmd
+						  *tnr_dmd,
+						  enum cxd2880_dtv_bandwidth
+						  bandwidth,
+						  enum cxd2880_tnrdmd_clockmode
+						  clk_mode)
+{
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x31,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	{
+		u8 data_a[2] = { 0x52, 0x49 };
+		u8 data_b[2] = { 0x5D, 0x55 };
+		u8 data_c[2] = { 0x60, 0x00 };
+		u8 *data = NULL;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x04) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		switch (clk_mode) {
+		case CXD2880_TNRDMD_CLOCKMODE_A:
+			data = data_a;
+			break;
+		case CXD2880_TNRDMD_CLOCKMODE_B:
+			data = data_b;
+			break;
+		case CXD2880_TNRDMD_CLOCKMODE_C:
+			data = data_c;
+			break;
+		default:
+			return CXD2880_RESULT_ERROR_SW_STATE;
+		}
+
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_DMD, 0x65, data,
+					    2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x5D,
+				   0x07) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_SUB) {
+		u8 data[2] = { 0x01, 0x01 };
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x00) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_DMD, 0xCE, data,
+					    2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x04) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x5C,
+				   0xFB) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0xA4,
+				   0x03) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x14) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0xB0,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x25) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	{
+		u8 data[2] = { 0x01, 0xF0 };
+
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_DMD, 0xF0, data,
+					    2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if ((tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) ||
+	    (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)) {
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x12) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x44,
+					   0x00) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB) {
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x11) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x87,
+					   0xD2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_SUB) {
+		u8 data_a[3] = { 0x73, 0xCA, 0x49 };
+		u8 data_b[3] = { 0xC8, 0x13, 0xAA };
+		u8 data_c[3] = { 0xDC, 0x6C, 0x00 };
+		u8 *data = NULL;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x04) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		switch (clk_mode) {
+		case CXD2880_TNRDMD_CLOCKMODE_A:
+			data = data_a;
+			break;
+		case CXD2880_TNRDMD_CLOCKMODE_B:
+			data = data_b;
+			break;
+		case CXD2880_TNRDMD_CLOCKMODE_C:
+			data = data_c;
+			break;
+		default:
+			return CXD2880_RESULT_ERROR_SW_STATE;
+		}
+
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_DMD, 0x68, data,
+					    3) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x04) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	switch (bandwidth) {
+	case CXD2880_DTV_BW_8_MHZ:
+
+		{
+			u8 data_ac[5] = { 0x15, 0x00, 0x00, 0x00,
+				0x00
+			};
+			u8 data_b[5] = { 0x14, 0x6A, 0xAA, 0xAA,
+				0xAA
+			};
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_ac;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x60,
+						    data,
+						    5) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x4A,
+					   0x00) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		{
+			u8 data_a[2] = { 0x01, 0x28 };
+			u8 data_b[2] = { 0x11, 0x44 };
+			u8 data_c[2] = { 0x15, 0x28 };
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x7D,
+						    data,
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		{
+			u8 data = 0;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = 0x35;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = 0x34;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_reg(tnr_dmd->io,
+						   CXD2880_IO_TGT_DMD, 0x71,
+						   data) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+			u8 data_a[5] = { 0x30, 0x00, 0x00, 0x90,
+				0x00
+			};
+			u8 data_b[5] = { 0x36, 0x71, 0x00, 0xA3,
+				0x55
+			};
+			u8 data_c[5] = { 0x38, 0x00, 0x00, 0xA8,
+				0x00
+			};
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x4B,
+						    &data[0],
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x51,
+						    &data[2],
+						    3) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		{
+			u8 data[4] = { 0xB3, 0x00, 0x01, 0x02 };
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x72,
+						    &data[0],
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x6B,
+						    &data[2],
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+		break;
+
+	case CXD2880_DTV_BW_7_MHZ:
+
+		{
+			u8 data_ac[5] = { 0x18, 0x00, 0x00, 0x00,
+				0x00
+			};
+			u8 data_b[5] = { 0x17, 0x55, 0x55, 0x55,
+				0x55
+			};
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_ac;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x60,
+						    data,
+						    5) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x4A,
+					   0x02) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		{
+			u8 data_a[2] = { 0x12, 0x4C };
+			u8 data_b[2] = { 0x1F, 0x15 };
+			u8 data_c[2] = { 0x1F, 0xF8 };
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x7D,
+						    data,
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		{
+			u8 data = 0;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = 0x2F;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = 0x2E;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_reg(tnr_dmd->io,
+						   CXD2880_IO_TGT_DMD, 0x71,
+						   data) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+			u8 data_a[5] = { 0x36, 0xDB, 0x00, 0xA4,
+				0x92
+			};
+			u8 data_b[5] = { 0x3E, 0x38, 0x00, 0xBA,
+				0xAA
+			};
+			u8 data_c[5] = { 0x40, 0x00, 0x00, 0xC0,
+				0x00
+			};
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x4B,
+						    &data[0],
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x51,
+						    &data[2],
+						    3) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		{
+			u8 data[4] = { 0xB8, 0x00, 0x00, 0x03 };
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x72,
+						    &data[0],
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x6B,
+						    &data[2],
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+		break;
+
+	case CXD2880_DTV_BW_6_MHZ:
+
+		{
+			u8 data_ac[5] = { 0x1C, 0x00, 0x00, 0x00,
+				0x00
+			};
+			u8 data_b[5] = { 0x1B, 0x38, 0xE3, 0x8E,
+				0x38
+			};
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_ac;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x60,
+						    data,
+						    5) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x4A,
+					   0x04) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		{
+			u8 data_a[2] = { 0x1F, 0xF8 };
+			u8 data_b[2] = { 0x24, 0x43 };
+			u8 data_c[2] = { 0x25, 0x4C };
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x7D,
+						    data,
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		{
+			u8 data = 0;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = 0x29;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = 0x2A;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_reg(tnr_dmd->io,
+						   CXD2880_IO_TGT_DMD, 0x71,
+						   data) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+			u8 data_a[5] = { 0x40, 0x00, 0x00, 0xC0,
+				0x00
+			};
+			u8 data_b[5] = { 0x48, 0x97, 0x00, 0xD9,
+				0xC7
+			};
+			u8 data_c[5] = { 0x4A, 0xAA, 0x00, 0xDF,
+				0xFF
+			};
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x4B,
+						    &data[0],
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x51,
+						    &data[2],
+						    3) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		{
+			u8 data[4] = { 0xBE, 0xAB, 0x00, 0x03 };
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x72,
+						    &data[0],
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x6B,
+						    &data[2],
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+		break;
+
+	case CXD2880_DTV_BW_5_MHZ:
+
+		{
+			u8 data_ac[5] = { 0x21, 0x99, 0x99, 0x99,
+				0x99
+			};
+			u8 data_b[5] = { 0x20, 0xAA, 0xAA, 0xAA,
+				0xAA
+			};
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_ac;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x60,
+						    data,
+						    5) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x4A,
+					   0x06) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		{
+			u8 data_a[2] = { 0x26, 0x5D };
+			u8 data_b[2] = { 0x2B, 0x84 };
+			u8 data_c[2] = { 0x2C, 0xC2 };
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x7D,
+						    data,
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		{
+			u8 data = 0;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = 0x24;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = 0x23;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_reg(tnr_dmd->io,
+						   CXD2880_IO_TGT_DMD, 0x71,
+						   data) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+			u8 data_a[5] = { 0x4C, 0xCC, 0x00, 0xE6,
+				0x66
+			};
+			u8 data_b[5] = { 0x57, 0x1C, 0x01, 0x05,
+				0x55
+			};
+			u8 data_c[5] = { 0x59, 0x99, 0x01, 0x0C,
+				0xCC
+			};
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x4B,
+						    &data[0],
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x51,
+						    &data[2],
+						    3) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		{
+			u8 data[4] = { 0xC8, 0x01, 0x00, 0x03 };
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x72,
+						    &data[0],
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x6B,
+						    &data[2],
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+		break;
+
+	default:
+		return CXD2880_RESULT_ERROR_SW_STATE;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0xFD,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret x_sleep_dvbt_demod_setting(struct cxd2880_tnrdmd
+						   *tnr_dmd)
+{
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x04) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x5C,
+				   0xD8) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0xA4,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB) {
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x11) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x87,
+					   0x04) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret dvbt_set_profile(struct cxd2880_tnrdmd *tnr_dmd,
+					 enum cxd2880_dvbt_profile profile)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x67,
+				   (profile ==
+				    CXD2880_DVBT_PROFILE_HP) ? 0x00 : 0x01) !=
+	    CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_tune1(struct cxd2880_tnrdmd *tnr_dmd,
+					   struct cxd2880_dvbt_tune_param
+					   *tune_param)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!tune_param))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret =
+	    cxd2880_tnrdmd_common_tune_setting1(tnr_dmd, CXD2880_DTV_SYS_DVBT,
+						tune_param->center_freq_khz,
+						tune_param->bandwidth, 0, 0);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret =
+	    x_tune_dvbt_demod_setting(tnr_dmd, tune_param->bandwidth,
+				      tnr_dmd->clk_mode);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		ret =
+		    x_tune_dvbt_demod_setting(tnr_dmd->diver_sub,
+					      tune_param->bandwidth,
+					      tnr_dmd->diver_sub->clk_mode);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	ret = dvbt_set_profile(tnr_dmd, tune_param->profile);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_tune2(struct cxd2880_tnrdmd *tnr_dmd,
+					   struct cxd2880_dvbt_tune_param
+					   *tune_param)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!tune_param))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret =
+	    cxd2880_tnrdmd_common_tune_setting2(tnr_dmd, CXD2880_DTV_SYS_DVBT,
+						0);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	tnr_dmd->state = CXD2880_TNRDMD_STATE_ACTIVE;
+	tnr_dmd->frequency_khz = tune_param->center_freq_khz;
+	tnr_dmd->sys = CXD2880_DTV_SYS_DVBT;
+	tnr_dmd->bandwidth = tune_param->bandwidth;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		tnr_dmd->diver_sub->state = CXD2880_TNRDMD_STATE_ACTIVE;
+		tnr_dmd->diver_sub->frequency_khz = tune_param->center_freq_khz;
+		tnr_dmd->diver_sub->sys = CXD2880_DTV_SYS_DVBT;
+		tnr_dmd->diver_sub->bandwidth = tune_param->bandwidth;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_sleep_setting(struct cxd2880_tnrdmd
+						   *tnr_dmd)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret = x_sleep_dvbt_demod_setting(tnr_dmd);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		ret = x_sleep_dvbt_demod_setting(tnr_dmd->diver_sub);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_check_demod_lock(struct cxd2880_tnrdmd
+						      *tnr_dmd,
+						      enum
+						      cxd2880_tnrdmd_lock_result
+						      *lock)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	u8 sync_stat = 0;
+	u8 ts_lock = 0;
+	u8 unlock_detected = 0;
+	u8 unlock_detected_sub = 0;
+
+	if ((!tnr_dmd) || (!lock))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret =
+	    cxd2880_tnrdmd_dvbt_mon_sync_stat(tnr_dmd, &sync_stat, &ts_lock,
+					      &unlock_detected);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SINGLE) {
+		if (sync_stat == 6)
+			*lock = CXD2880_TNRDMD_LOCK_RESULT_LOCKED;
+		else if (unlock_detected)
+			*lock = CXD2880_TNRDMD_LOCK_RESULT_UNLOCKED;
+		else
+			*lock = CXD2880_TNRDMD_LOCK_RESULT_NOTDETECT;
+
+		return ret;
+	}
+
+	if (sync_stat == 6) {
+		*lock = CXD2880_TNRDMD_LOCK_RESULT_LOCKED;
+		return ret;
+	}
+
+	ret =
+	    cxd2880_tnrdmd_dvbt_mon_sync_stat_sub(tnr_dmd, &sync_stat,
+						  &unlock_detected_sub);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (sync_stat == 6)
+		*lock = CXD2880_TNRDMD_LOCK_RESULT_LOCKED;
+	else if (unlock_detected && unlock_detected_sub)
+		*lock = CXD2880_TNRDMD_LOCK_RESULT_UNLOCKED;
+	else
+		*lock = CXD2880_TNRDMD_LOCK_RESULT_NOTDETECT;
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_check_ts_lock(struct cxd2880_tnrdmd
+						   *tnr_dmd,
+						   enum
+						   cxd2880_tnrdmd_lock_result
+						   *lock)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	u8 sync_stat = 0;
+	u8 ts_lock = 0;
+	u8 unlock_detected = 0;
+	u8 unlock_detected_sub = 0;
+
+	if ((!tnr_dmd) || (!lock))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret =
+	    cxd2880_tnrdmd_dvbt_mon_sync_stat(tnr_dmd, &sync_stat, &ts_lock,
+					      &unlock_detected);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SINGLE) {
+		if (ts_lock)
+			*lock = CXD2880_TNRDMD_LOCK_RESULT_LOCKED;
+		else if (unlock_detected)
+			*lock = CXD2880_TNRDMD_LOCK_RESULT_UNLOCKED;
+		else
+			*lock = CXD2880_TNRDMD_LOCK_RESULT_NOTDETECT;
+
+		return ret;
+	}
+
+	if (ts_lock) {
+		*lock = CXD2880_TNRDMD_LOCK_RESULT_LOCKED;
+		return ret;
+	} else if (!unlock_detected) {
+		*lock = CXD2880_TNRDMD_LOCK_RESULT_NOTDETECT;
+		return ret;
+	}
+
+	ret =
+	    cxd2880_tnrdmd_dvbt_mon_sync_stat_sub(tnr_dmd, &sync_stat,
+						  &unlock_detected_sub);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (unlock_detected && unlock_detected_sub)
+		*lock = CXD2880_TNRDMD_LOCK_RESULT_UNLOCKED;
+	else
+		*lock = CXD2880_TNRDMD_LOCK_RESULT_NOTDETECT;
+
+	return ret;
+}
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt.h
new file mode 100644
index 000000000000..de394d8e27f3
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt.h
@@ -0,0 +1,62 @@
+/*
+ * cxd2880_tnrdmd_dvbt.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * control interface for DVB-T
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_TNRDMD_DVBT_H
+#define CXD2880_TNRDMD_DVBT_H
+
+#include "cxd2880_common.h"
+#include "cxd2880_tnrdmd.h"
+
+struct cxd2880_dvbt_tune_param {
+	u32 center_freq_khz;
+	enum cxd2880_dtv_bandwidth bandwidth;
+	enum cxd2880_dvbt_profile profile;
+};
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_tune1(struct cxd2880_tnrdmd *tnr_dmd,
+					   struct cxd2880_dvbt_tune_param
+					   *tune_param);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_tune2(struct cxd2880_tnrdmd *tnr_dmd,
+					   struct cxd2880_dvbt_tune_param
+					   *tune_param);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_sleep_setting(struct cxd2880_tnrdmd
+						   *tnr_dmd);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_check_demod_lock(struct cxd2880_tnrdmd
+						      *tnr_dmd,
+						      enum
+						      cxd2880_tnrdmd_lock_result
+						      *lock);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_check_ts_lock(struct cxd2880_tnrdmd
+						   *tnr_dmd,
+						   enum
+						   cxd2880_tnrdmd_lock_result
+						   *lock);
+
+#endif
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt2.c b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt2.c
new file mode 100644
index 000000000000..bdad65b7298a
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt2.c
@@ -0,0 +1,1309 @@
+/*
+ * cxd2880_tnrdmd_dvbt2.c
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * control functions for DVB-T2
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "cxd2880_tnrdmd_dvbt2.h"
+#include "cxd2880_tnrdmd_dvbt2_mon.h"
+
+static enum cxd2880_ret x_tune_dvbt2_demod_setting(struct cxd2880_tnrdmd
+						   *tnr_dmd,
+						   enum cxd2880_dtv_bandwidth
+						   bandwidth,
+						   enum cxd2880_tnrdmd_clockmode
+						   clk_mode)
+{
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x31,
+				   0x02) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x04) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x5D,
+				   0x0B) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_SUB) {
+		u8 data[2] = { 0x01, 0x01 };
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x00) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_DMD, 0xCE, data,
+					    2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	{
+		u8 data[14] = { 0x07, 0x06, 0x01, 0xF0,
+			0x00, 0x00, 0x04, 0xB0, 0x00, 0x00, 0x09, 0x9C, 0x0E,
+			    0x4C
+		};
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x20) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x8A,
+					   data[0]) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x90,
+					   data[1]) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x25) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_DMD, 0xF0, &data[2],
+					    2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x2A) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0xDC,
+					   data[4]) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0xDE,
+					   data[5]) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x2D) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_DMD, 0x73, &data[6],
+					    4) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_DMD, 0x8F, &data[10],
+					    4) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	{
+		u8 data_a_1[9] = { 0x52, 0x49, 0x2C, 0x51,
+			0x51, 0x3D, 0x15, 0x29, 0x0C
+		};
+		u8 data_b_1[9] = { 0x5D, 0x55, 0x32, 0x5C,
+			0x5C, 0x45, 0x17, 0x2E, 0x0D
+		};
+		u8 data_c_1[9] = { 0x60, 0x00, 0x34, 0x5E,
+			0x5E, 0x47, 0x18, 0x2F, 0x0E
+		};
+
+		u8 data_a_2[13] = { 0x04, 0xE7, 0x94, 0x92,
+			0x09, 0xCF, 0x7E, 0xD0, 0x49, 0xCD, 0xCD, 0x1F, 0x5B
+		};
+		u8 data_b_2[13] = { 0x05, 0x90, 0x27, 0x55,
+			0x0B, 0x20, 0x8F, 0xD6, 0xEA, 0xC8, 0xC8, 0x23, 0x91
+		};
+		u8 data_c_2[13] = { 0x05, 0xB8, 0xD8, 0x00,
+			0x0B, 0x72, 0x93, 0xF3, 0x00, 0xCD, 0xCD, 0x24, 0x95
+		};
+
+		u8 data_a_3[5] = { 0x0B, 0x6A, 0xC9, 0x03,
+			0x33
+		};
+		u8 data_b_3[5] = { 0x01, 0x02, 0xE4, 0x03,
+			0x39
+		};
+		u8 data_c_3[5] = { 0x01, 0x02, 0xEB, 0x03,
+			0x3B
+		};
+
+		u8 *data_1 = NULL;
+		u8 *data_2 = NULL;
+		u8 *data_3 = NULL;
+
+		switch (clk_mode) {
+		case CXD2880_TNRDMD_CLOCKMODE_A:
+			data_1 = data_a_1;
+			data_2 = data_a_2;
+			data_3 = data_a_3;
+			break;
+		case CXD2880_TNRDMD_CLOCKMODE_B:
+			data_1 = data_b_1;
+			data_2 = data_b_2;
+			data_3 = data_b_3;
+			break;
+		case CXD2880_TNRDMD_CLOCKMODE_C:
+			data_1 = data_c_1;
+			data_2 = data_c_2;
+			data_3 = data_c_3;
+			break;
+		default:
+			return CXD2880_RESULT_ERROR_SW_STATE;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x04) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_DMD, 0x1D,
+					    &data_1[0], 3) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x22,
+					   data_1[3]) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x24,
+					   data_1[4]) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x26,
+					   data_1[5]) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_DMD, 0x29,
+					    &data_1[6], 2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x2D,
+					   data_1[8]) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_SUB) {
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x2E,
+						    &data_2[0],
+						    6) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x35,
+						    &data_2[6],
+						    7) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_DMD, 0x3C,
+					    &data_3[0], 2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_DMD, 0x56,
+					    &data_3[2], 3) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	switch (bandwidth) {
+	case CXD2880_DTV_BW_8_MHZ:
+
+		{
+			u8 data_ac[6] = { 0x15, 0x00, 0x00, 0x00,
+				0x00, 0x00
+			};
+			u8 data_b[6] = { 0x14, 0x6A, 0xAA, 0xAA,
+				0xAB, 0x00
+			};
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_ac;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x10,
+						    data,
+						    6) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x4A,
+					   0x00) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		{
+			u8 data_a[2] = { 0x19, 0xD2 };
+			u8 data_bc[2] = { 0x3F, 0xFF };
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_bc;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x19,
+						    data,
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		{
+			u8 data_a[2] = { 0x06, 0x2A };
+			u8 data_b[2] = { 0x06, 0x29 };
+			u8 data_c[2] = { 0x06, 0x28 };
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x1B,
+						    data,
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+			u8 data_a[9] = { 0x28, 0x00, 0x50, 0x00,
+				0x60, 0x00, 0x00, 0x90, 0x00
+			};
+			u8 data_b[9] = { 0x2D, 0x5E, 0x5A, 0xBD,
+				0x6C, 0xE3, 0x00, 0xA3, 0x55
+			};
+			u8 data_c[9] = { 0x2E, 0xAA, 0x5D, 0x55,
+				0x70, 0x00, 0x00, 0xA8, 0x00
+			};
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x4B,
+						    data,
+						    9) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+		break;
+
+	case CXD2880_DTV_BW_7_MHZ:
+
+		{
+			u8 data_ac[6] = { 0x18, 0x00, 0x00, 0x00,
+				0x00, 0x00
+			};
+			u8 data_b[6] = { 0x17, 0x55, 0x55, 0x55,
+				0x55, 0x00
+			};
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_ac;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x10,
+						    data,
+						    6) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x4A,
+					   0x02) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		{
+			u8 data[2] = { 0x3F, 0xFF };
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x19,
+						    data,
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		{
+			u8 data_a[2] = { 0x06, 0x23 };
+			u8 data_b[2] = { 0x06, 0x22 };
+			u8 data_c[2] = { 0x06, 0x21 };
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x1B,
+						    data,
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+			u8 data_a[9] = { 0x2D, 0xB6, 0x5B, 0x6D,
+				0x6D, 0xB6, 0x00, 0xA4, 0x92
+			};
+			u8 data_b[9] = { 0x33, 0xDA, 0x67, 0xB4,
+				0x7C, 0x71, 0x00, 0xBA, 0xAA
+			};
+			u8 data_c[9] = { 0x35, 0x55, 0x6A, 0xAA,
+				0x80, 0x00, 0x00, 0xC0, 0x00
+			};
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x4B,
+						    data,
+						    9) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+		break;
+
+	case CXD2880_DTV_BW_6_MHZ:
+
+		{
+			u8 data_ac[6] = { 0x1C, 0x00, 0x00, 0x00,
+				0x00, 0x00
+			};
+			u8 data_b[6] = { 0x1B, 0x38, 0xE3, 0x8E,
+				0x39, 0x00
+			};
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_ac;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x10,
+						    data,
+						    6) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x4A,
+					   0x04) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		{
+			u8 data[2] = { 0x3F, 0xFF };
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x19,
+						    data,
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		{
+			u8 data_a[2] = { 0x06, 0x1C };
+			u8 data_b[2] = { 0x06, 0x1B };
+			u8 data_c[2] = { 0x06, 0x1A };
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x1B,
+						    data,
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+			u8 data_a[9] = { 0x35, 0x55, 0x6A, 0xAA,
+				0x80, 0x00, 0x00, 0xC0, 0x00
+			};
+			u8 data_b[9] = { 0x3C, 0x7E, 0x78, 0xFC,
+				0x91, 0x2F, 0x00, 0xD9, 0xC7
+			};
+			u8 data_c[9] = { 0x3E, 0x38, 0x7C, 0x71,
+				0x95, 0x55, 0x00, 0xDF, 0xFF
+			};
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x4B,
+						    data,
+						    9) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+		break;
+
+	case CXD2880_DTV_BW_5_MHZ:
+
+		{
+			u8 data_ac[6] = { 0x21, 0x99, 0x99, 0x99,
+				0x9A, 0x00
+			};
+			u8 data_b[6] = { 0x20, 0xAA, 0xAA, 0xAA,
+				0xAB, 0x00
+			};
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_ac;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x10,
+						    data,
+						    6) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x4A,
+					   0x06) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		{
+			u8 data[2] = { 0x3F, 0xFF };
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x19,
+						    data,
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		{
+			u8 data_a[2] = { 0x06, 0x15 };
+			u8 data_b[2] = { 0x06, 0x15 };
+			u8 data_c[2] = { 0x06, 0x14 };
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x1B,
+						    data,
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+			u8 data_a[9] = { 0x40, 0x00, 0x6A, 0xAA,
+				0x80, 0x00, 0x00, 0xE6, 0x66
+			};
+			u8 data_b[9] = { 0x48, 0x97, 0x78, 0xFC,
+				0x91, 0x2F, 0x01, 0x05, 0x55
+			};
+			u8 data_c[9] = { 0x4A, 0xAA, 0x7C, 0x71,
+				0x95, 0x55, 0x01, 0x0C, 0xCC
+			};
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x4B,
+						    data,
+						    9) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+		break;
+
+	case CXD2880_DTV_BW_1_7_MHZ:
+
+		{
+			u8 data_a[6] = { 0x68, 0x0F, 0xA2, 0x32,
+				0xCF, 0x03
+			};
+			u8 data_c[6] = { 0x68, 0x0F, 0xA2, 0x32,
+				0xCF, 0x03
+			};
+			u8 data_b[6] = { 0x65, 0x2B, 0xA4, 0xCD,
+				0xD8, 0x03
+			};
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x10,
+						    data,
+						    6) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x4A,
+					   0x03) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		{
+			u8 data[2] = { 0x3F, 0xFF };
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x19,
+						    data,
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		{
+			u8 data_a[2] = { 0x06, 0x0C };
+			u8 data_b[2] = { 0x06, 0x0C };
+			u8 data_c[2] = { 0x06, 0x0B };
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x1B,
+						    data,
+						    2) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+			u8 data_a[9] = { 0x40, 0x00, 0x6A, 0xAA,
+				0x80, 0x00, 0x02, 0xC9, 0x8F
+			};
+			u8 data_b[9] = { 0x48, 0x97, 0x78, 0xFC,
+				0x91, 0x2F, 0x03, 0x29, 0x5D
+			};
+			u8 data_c[9] = { 0x4A, 0xAA, 0x7C, 0x71,
+				0x95, 0x55, 0x03, 0x40, 0x7D
+			};
+			u8 *data = NULL;
+
+			switch (clk_mode) {
+			case CXD2880_TNRDMD_CLOCKMODE_A:
+				data = data_a;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_B:
+				data = data_b;
+				break;
+			case CXD2880_TNRDMD_CLOCKMODE_C:
+				data = data_c;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_SW_STATE;
+			}
+
+			if (tnr_dmd->io->write_regs(tnr_dmd->io,
+						    CXD2880_IO_TGT_DMD, 0x4B,
+						    data,
+						    9) != CXD2880_RESULT_OK)
+				return CXD2880_RESULT_ERROR_IO;
+		}
+		break;
+
+	default:
+		return CXD2880_RESULT_ERROR_SW_STATE;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0xFD,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret x_sleep_dvbt2_demod_setting(struct cxd2880_tnrdmd
+						    *tnr_dmd)
+{
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		u8 data[] = { 0, 1, 0, 2,
+			0, 4, 0, 8, 0, 16, 0, 32
+		};
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x1D) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_DMD, 0x47, data,
+					    12) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret dvbt2_set_profile(struct cxd2880_tnrdmd *tnr_dmd,
+					  enum cxd2880_dvbt2_profile profile)
+{
+	u8 t2_mode_tune_mode = 0;
+	u8 seq_not2_dtime = 0;
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	{
+		u8 dtime1 = 0;
+		u8 dtime2 = 0;
+
+		switch (tnr_dmd->clk_mode) {
+		case CXD2880_TNRDMD_CLOCKMODE_A:
+			dtime1 = 0x27;
+			dtime2 = 0x0C;
+			break;
+		case CXD2880_TNRDMD_CLOCKMODE_B:
+			dtime1 = 0x2C;
+			dtime2 = 0x0D;
+			break;
+		case CXD2880_TNRDMD_CLOCKMODE_C:
+			dtime1 = 0x2E;
+			dtime2 = 0x0E;
+			break;
+		default:
+			return CXD2880_RESULT_ERROR_SW_STATE;
+		}
+
+		switch (profile) {
+		case CXD2880_DVBT2_PROFILE_BASE:
+			t2_mode_tune_mode = 0x01;
+			seq_not2_dtime = dtime2;
+			break;
+
+		case CXD2880_DVBT2_PROFILE_LITE:
+			t2_mode_tune_mode = 0x05;
+			seq_not2_dtime = dtime1;
+			break;
+
+		case CXD2880_DVBT2_PROFILE_ANY:
+			t2_mode_tune_mode = 0x00;
+			seq_not2_dtime = dtime1;
+			break;
+
+		default:
+			return CXD2880_RESULT_ERROR_ARG;
+		}
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x2E) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x10,
+				   t2_mode_tune_mode) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x04) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x2C,
+				   seq_not2_dtime) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_tune1(struct cxd2880_tnrdmd *tnr_dmd,
+					    struct cxd2880_dvbt2_tune_param
+					    *tune_param)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!tune_param))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if ((tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) &&
+	    (tune_param->profile == CXD2880_DVBT2_PROFILE_ANY))
+		return CXD2880_RESULT_ERROR_NOSUPPORT;
+
+	ret =
+	    cxd2880_tnrdmd_common_tune_setting1(tnr_dmd, CXD2880_DTV_SYS_DVBT2,
+						tune_param->center_freq_khz,
+						tune_param->bandwidth, 0, 0);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret =
+	    x_tune_dvbt2_demod_setting(tnr_dmd, tune_param->bandwidth,
+				       tnr_dmd->clk_mode);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		ret =
+		    x_tune_dvbt2_demod_setting(tnr_dmd->diver_sub,
+					       tune_param->bandwidth,
+					       tnr_dmd->diver_sub->clk_mode);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	ret = dvbt2_set_profile(tnr_dmd, tune_param->profile);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		ret =
+		    dvbt2_set_profile(tnr_dmd->diver_sub, tune_param->profile);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	if (tune_param->data_plp_id == CXD2880_DVBT2_TUNE_PARAM_PLPID_AUTO) {
+		ret = cxd2880_tnrdmd_dvbt2_set_plp_cfg(tnr_dmd, 1, 0);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	} else {
+		ret =
+		    cxd2880_tnrdmd_dvbt2_set_plp_cfg(tnr_dmd, 0,
+					     (u8)(tune_param->data_plp_id));
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_tune2(struct cxd2880_tnrdmd *tnr_dmd,
+					    struct cxd2880_dvbt2_tune_param
+					    *tune_param)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!tune_param))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	{
+		u8 en_fef_intmtnt_ctrl = 1;
+
+		switch (tune_param->profile) {
+		case CXD2880_DVBT2_PROFILE_BASE:
+			en_fef_intmtnt_ctrl = tnr_dmd->en_fef_intmtnt_base;
+			break;
+		case CXD2880_DVBT2_PROFILE_LITE:
+			en_fef_intmtnt_ctrl = tnr_dmd->en_fef_intmtnt_lite;
+			break;
+		case CXD2880_DVBT2_PROFILE_ANY:
+			if (tnr_dmd->en_fef_intmtnt_base &&
+			    tnr_dmd->en_fef_intmtnt_lite)
+				en_fef_intmtnt_ctrl = 1;
+			else
+				en_fef_intmtnt_ctrl = 0;
+			break;
+		default:
+			return CXD2880_RESULT_ERROR_ARG;
+		}
+
+		ret =
+		    cxd2880_tnrdmd_common_tune_setting2(tnr_dmd,
+							CXD2880_DTV_SYS_DVBT2,
+							en_fef_intmtnt_ctrl);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	tnr_dmd->state = CXD2880_TNRDMD_STATE_ACTIVE;
+	tnr_dmd->frequency_khz = tune_param->center_freq_khz;
+	tnr_dmd->sys = CXD2880_DTV_SYS_DVBT2;
+	tnr_dmd->bandwidth = tune_param->bandwidth;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		tnr_dmd->diver_sub->state = CXD2880_TNRDMD_STATE_ACTIVE;
+		tnr_dmd->diver_sub->frequency_khz = tune_param->center_freq_khz;
+		tnr_dmd->diver_sub->sys = CXD2880_DTV_SYS_DVBT2;
+		tnr_dmd->diver_sub->bandwidth = tune_param->bandwidth;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_sleep_setting(struct cxd2880_tnrdmd
+						    *tnr_dmd)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret = x_sleep_dvbt2_demod_setting(tnr_dmd);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN) {
+		ret = x_sleep_dvbt2_demod_setting(tnr_dmd->diver_sub);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_check_demod_lock(struct cxd2880_tnrdmd
+					       *tnr_dmd,
+					       enum
+					       cxd2880_tnrdmd_lock_result
+					       *lock)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	u8 sync_stat = 0;
+	u8 ts_lock = 0;
+	u8 unlock_detected = 0;
+	u8 unlock_detected_sub = 0;
+
+	if ((!tnr_dmd) || (!lock))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret =
+	    cxd2880_tnrdmd_dvbt2_mon_sync_stat(tnr_dmd, &sync_stat, &ts_lock,
+					       &unlock_detected);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SINGLE) {
+		if (sync_stat == 6)
+			*lock = CXD2880_TNRDMD_LOCK_RESULT_LOCKED;
+		else if (unlock_detected)
+			*lock = CXD2880_TNRDMD_LOCK_RESULT_UNLOCKED;
+		else
+			*lock = CXD2880_TNRDMD_LOCK_RESULT_NOTDETECT;
+
+		return ret;
+	}
+
+	if (sync_stat == 6) {
+		*lock = CXD2880_TNRDMD_LOCK_RESULT_LOCKED;
+		return ret;
+	}
+
+	ret =
+	    cxd2880_tnrdmd_dvbt2_mon_sync_stat_sub(tnr_dmd, &sync_stat,
+						   &unlock_detected_sub);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (sync_stat == 6)
+		*lock = CXD2880_TNRDMD_LOCK_RESULT_LOCKED;
+	else if (unlock_detected && unlock_detected_sub)
+		*lock = CXD2880_TNRDMD_LOCK_RESULT_UNLOCKED;
+	else
+		*lock = CXD2880_TNRDMD_LOCK_RESULT_NOTDETECT;
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_check_ts_lock(struct cxd2880_tnrdmd
+						    *tnr_dmd,
+						    enum
+						    cxd2880_tnrdmd_lock_result
+						    *lock)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	u8 sync_stat = 0;
+	u8 ts_lock = 0;
+	u8 unlock_detected = 0;
+	u8 unlock_detected_sub = 0;
+
+	if ((!tnr_dmd) || (!lock))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret =
+	    cxd2880_tnrdmd_dvbt2_mon_sync_stat(tnr_dmd, &sync_stat, &ts_lock,
+					       &unlock_detected);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SINGLE) {
+		if (ts_lock)
+			*lock = CXD2880_TNRDMD_LOCK_RESULT_LOCKED;
+		else if (unlock_detected)
+			*lock = CXD2880_TNRDMD_LOCK_RESULT_UNLOCKED;
+		else
+			*lock = CXD2880_TNRDMD_LOCK_RESULT_NOTDETECT;
+
+		return ret;
+	}
+
+	if (ts_lock) {
+		*lock = CXD2880_TNRDMD_LOCK_RESULT_LOCKED;
+		return ret;
+	} else if (!unlock_detected) {
+		*lock = CXD2880_TNRDMD_LOCK_RESULT_NOTDETECT;
+		return ret;
+	}
+
+	ret =
+	    cxd2880_tnrdmd_dvbt2_mon_sync_stat_sub(tnr_dmd, &sync_stat,
+						   &unlock_detected_sub);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (unlock_detected && unlock_detected_sub)
+		*lock = CXD2880_TNRDMD_LOCK_RESULT_UNLOCKED;
+	else
+		*lock = CXD2880_TNRDMD_LOCK_RESULT_NOTDETECT;
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_set_plp_cfg(struct cxd2880_tnrdmd
+						  *tnr_dmd, u8 auto_plp,
+						  u8 plp_id)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x23) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (!auto_plp) {
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0xAF,
+					   plp_id) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0xAD,
+				   auto_plp ? 0x00 : 0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_diver_fef_setting(struct cxd2880_tnrdmd
+							*tnr_dmd)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SINGLE)
+		return CXD2880_RESULT_OK;
+
+	{
+		struct cxd2880_dvbt2_ofdm ofdm;
+
+		ret = cxd2880_tnrdmd_dvbt2_mon_ofdm(tnr_dmd, &ofdm);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		if (!ofdm.mixed)
+			return CXD2880_RESULT_OK;
+	}
+
+	{
+		u8 data[] = { 0, 8, 0, 16,
+			0, 32, 0, 64, 0, 128, 1, 0
+		};
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x1D) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_DMD, 0x47, data,
+					    12) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_check_l1post_valid(struct cxd2880_tnrdmd
+							 *tnr_dmd,
+							 u8 *l1_post_valid)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	u8 data;
+
+	if ((!tnr_dmd) || (!l1_post_valid))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0B) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x86, &data,
+				   1) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	*l1_post_valid = data & 0x01;
+
+	return ret;
+}
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt2.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt2.h
new file mode 100644
index 000000000000..8735280f0143
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt2.h
@@ -0,0 +1,82 @@
+/*
+ * cxd2880_tnrdmd_dvbt2.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * control interface for DVB-T2
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_TNRDMD_DVBT2_H
+#define CXD2880_TNRDMD_DVBT2_H
+
+#include "cxd2880_common.h"
+#include "cxd2880_tnrdmd.h"
+
+enum cxd2880_tnrdmd_dvbt2_tune_info {
+	CXD2880_TNRDMD_DVBT2_TUNE_INFO_OK,
+	CXD2880_TNRDMD_DVBT2_TUNE_INFO_INVALID_PLP_ID
+};
+
+struct cxd2880_dvbt2_tune_param {
+	u32 center_freq_khz;
+	enum cxd2880_dtv_bandwidth bandwidth;
+	u16 data_plp_id;
+	enum cxd2880_dvbt2_profile profile;
+	enum cxd2880_tnrdmd_dvbt2_tune_info tune_info;
+};
+
+#define CXD2880_DVBT2_TUNE_PARAM_PLPID_AUTO  0xFFFF
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_tune1(struct cxd2880_tnrdmd *tnr_dmd,
+					    struct cxd2880_dvbt2_tune_param
+					    *tune_param);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_tune2(struct cxd2880_tnrdmd *tnr_dmd,
+					    struct cxd2880_dvbt2_tune_param
+					    *tune_param);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_sleep_setting(struct cxd2880_tnrdmd
+						    *tnr_dmd);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_check_demod_lock(struct cxd2880_tnrdmd
+					       *tnr_dmd,
+					       enum
+					       cxd2880_tnrdmd_lock_result
+					       *lock);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_check_ts_lock(struct cxd2880_tnrdmd
+						    *tnr_dmd,
+						    enum
+						    cxd2880_tnrdmd_lock_result
+						    *lock);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_set_plp_cfg(struct cxd2880_tnrdmd
+						  *tnr_dmd, u8 auto_plp,
+						  u8 plp_id);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_diver_fef_setting(struct cxd2880_tnrdmd
+							*tnr_dmd);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_check_l1post_valid(struct cxd2880_tnrdmd
+							 *tnr_dmd,
+							 u8 *l1_post_valid);
+
+#endif
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt2_mon.c b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt2_mon.c
new file mode 100644
index 000000000000..235db16f4a08
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt2_mon.c
@@ -0,0 +1,2523 @@
+/*
+ * cxd2880_tnrdmd_dvbt2_mon.c
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * DVB-T2 monitor functions
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "cxd2880_tnrdmd_mon.h"
+#include "cxd2880_tnrdmd_dvbt2.h"
+#include "cxd2880_tnrdmd_dvbt2_mon.h"
+#include "cxd2880_math.h"
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_sync_stat(struct cxd2880_tnrdmd
+						    *tnr_dmd, u8 *sync_stat,
+						    u8 *ts_lock_stat,
+						    u8 *unlock_detected)
+{
+	if ((!tnr_dmd) || (!sync_stat) || (!ts_lock_stat) || (!unlock_detected))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0B) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	{
+		u8 data;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x10, &data,
+					   sizeof(data)) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		*sync_stat = data & 0x07;
+		*ts_lock_stat = ((data & 0x20) ? 1 : 0);
+		*unlock_detected = ((data & 0x10) ? 1 : 0);
+	}
+
+	if (*sync_stat == 0x07)
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_sync_stat_sub(struct cxd2880_tnrdmd
+							*tnr_dmd,
+							u8 *sync_stat,
+							u8 *unlock_detected)
+{
+	u8 ts_lock_stat = 0;
+
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!sync_stat) || (!unlock_detected))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret =
+	    cxd2880_tnrdmd_dvbt2_mon_sync_stat(tnr_dmd->diver_sub, sync_stat,
+					       &ts_lock_stat, unlock_detected);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_carrier_offset(struct cxd2880_tnrdmd
+							 *tnr_dmd, int *offset)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!offset))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	{
+		u8 data[4];
+		u32 ctl_val = 0;
+		u8 sync_state = 0;
+		u8 ts_lock = 0;
+		u8 unlock_detected = 0;
+
+		if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		ret =
+		    cxd2880_tnrdmd_dvbt2_mon_sync_stat(tnr_dmd, &sync_state,
+						       &ts_lock,
+						       &unlock_detected);
+		if (ret != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (sync_state != 6) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x0B) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x30, data,
+					   sizeof(data)) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		slvt_unfreeze_reg(tnr_dmd);
+
+		ctl_val =
+		    ((data[0] & 0x0F) << 24) | (data[1] << 16) | (data[2] << 8)
+		    | (data[3]);
+		*offset = cxd2880_convert2s_complement(ctl_val, 28);
+
+		switch (tnr_dmd->bandwidth) {
+		case CXD2880_DTV_BW_1_7_MHZ:
+			*offset = -1 * ((*offset) / 582);
+			break;
+		case CXD2880_DTV_BW_5_MHZ:
+		case CXD2880_DTV_BW_6_MHZ:
+		case CXD2880_DTV_BW_7_MHZ:
+		case CXD2880_DTV_BW_8_MHZ:
+			*offset =
+			    -1 * ((*offset) * (u8)tnr_dmd->bandwidth / 940);
+			break;
+		default:
+			return CXD2880_RESULT_ERROR_SW_STATE;
+		}
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_carrier_offset_sub(struct
+							     cxd2880_tnrdmd
+							     *tnr_dmd,
+							     int *offset)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!offset))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret =
+	    cxd2880_tnrdmd_dvbt2_mon_carrier_offset(tnr_dmd->diver_sub, offset);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_l1_pre(struct cxd2880_tnrdmd *tnr_dmd,
+						 struct cxd2880_dvbt2_l1pre
+						 *l1_pre)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!l1_pre))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	{
+		u8 data[37];
+		u8 sync_state = 0;
+		u8 ts_lock = 0;
+		u8 unlock_detected = 0;
+		u8 version = 0;
+		enum cxd2880_dvbt2_profile profile;
+
+		if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		ret =
+		    cxd2880_tnrdmd_dvbt2_mon_sync_stat(tnr_dmd, &sync_state,
+						       &ts_lock,
+						       &unlock_detected);
+		if (ret != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return ret;
+		}
+
+		if (sync_state < 5) {
+			if (tnr_dmd->diver_mode ==
+			    CXD2880_TNRDMD_DIVERMODE_MAIN) {
+				ret =
+				    cxd2880_tnrdmd_dvbt2_mon_sync_stat_sub
+				    (tnr_dmd, &sync_state, &unlock_detected);
+				if (ret != CXD2880_RESULT_OK) {
+					slvt_unfreeze_reg(tnr_dmd);
+					return ret;
+				}
+
+				if (sync_state < 5) {
+					slvt_unfreeze_reg(tnr_dmd);
+					return CXD2880_RESULT_ERROR_HW_STATE;
+				}
+			} else {
+				slvt_unfreeze_reg(tnr_dmd);
+				return CXD2880_RESULT_ERROR_HW_STATE;
+			}
+		}
+
+		ret = cxd2880_tnrdmd_dvbt2_mon_profile(tnr_dmd, &profile);
+		if (ret != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return ret;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x0B) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x61, data,
+					   sizeof(data)) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+		slvt_unfreeze_reg(tnr_dmd);
+
+		l1_pre->type = (enum cxd2880_dvbt2_l1pre_type)data[0];
+		l1_pre->bw_ext = data[1] & 0x01;
+		l1_pre->s1 = (enum cxd2880_dvbt2_s1)(data[2] & 0x07);
+		l1_pre->s2 = data[3] & 0x0F;
+		l1_pre->l1_rep = data[4] & 0x01;
+		l1_pre->gi = (enum cxd2880_dvbt2_guard)(data[5] & 0x07);
+		l1_pre->papr = (enum cxd2880_dvbt2_papr)(data[6] & 0x0F);
+		l1_pre->mod =
+		    (enum cxd2880_dvbt2_l1post_constell)(data[7] & 0x0F);
+		l1_pre->cr = (enum cxd2880_dvbt2_l1post_cr)(data[8] & 0x03);
+		l1_pre->fec =
+		    (enum cxd2880_dvbt2_l1post_fec_type)(data[9] & 0x03);
+		l1_pre->l1_post_size = (data[10] & 0x03) << 16;
+		l1_pre->l1_post_size |= (data[11]) << 8;
+		l1_pre->l1_post_size |= (data[12]);
+		l1_pre->l1_post_info_size = (data[13] & 0x03) << 16;
+		l1_pre->l1_post_info_size |= (data[14]) << 8;
+		l1_pre->l1_post_info_size |= (data[15]);
+		l1_pre->pp = (enum cxd2880_dvbt2_pp)(data[16] & 0x0F);
+		l1_pre->tx_id_availability = data[17];
+		l1_pre->cell_id = (data[18] << 8);
+		l1_pre->cell_id |= (data[19]);
+		l1_pre->network_id = (data[20] << 8);
+		l1_pre->network_id |= (data[21]);
+		l1_pre->sys_id = (data[22] << 8);
+		l1_pre->sys_id |= (data[23]);
+		l1_pre->num_frames = data[24];
+		l1_pre->num_symbols = (data[25] & 0x0F) << 8;
+		l1_pre->num_symbols |= data[26];
+		l1_pre->regen = data[27] & 0x07;
+		l1_pre->post_ext = data[28] & 0x01;
+		l1_pre->num_rf_freqs = data[29] & 0x07;
+		l1_pre->rf_idx = data[30] & 0x07;
+		version = (data[31] & 0x03) << 2;
+		version |= (data[32] & 0xC0) >> 6;
+		l1_pre->t2_version = (enum cxd2880_dvbt2_version)version;
+		l1_pre->l1_post_scrambled = (data[32] & 0x20) >> 5;
+		l1_pre->t2_base_lite = (data[32] & 0x10) >> 4;
+		l1_pre->crc32 = (data[33] << 24);
+		l1_pre->crc32 |= (data[34] << 16);
+		l1_pre->crc32 |= (data[35] << 8);
+		l1_pre->crc32 |= data[36];
+
+		if (profile == CXD2880_DVBT2_PROFILE_BASE) {
+			switch ((l1_pre->s2 >> 1)) {
+			case CXD2880_DVBT2_BASE_S2_M1K_G_ANY:
+				l1_pre->fft_mode = CXD2880_DVBT2_M1K;
+				break;
+			case CXD2880_DVBT2_BASE_S2_M2K_G_ANY:
+				l1_pre->fft_mode = CXD2880_DVBT2_M2K;
+				break;
+			case CXD2880_DVBT2_BASE_S2_M4K_G_ANY:
+				l1_pre->fft_mode = CXD2880_DVBT2_M4K;
+				break;
+			case CXD2880_DVBT2_BASE_S2_M8K_G_DVBT:
+			case CXD2880_DVBT2_BASE_S2_M8K_G_DVBT2:
+				l1_pre->fft_mode = CXD2880_DVBT2_M8K;
+				break;
+			case CXD2880_DVBT2_BASE_S2_M16K_G_ANY:
+				l1_pre->fft_mode = CXD2880_DVBT2_M16K;
+				break;
+			case CXD2880_DVBT2_BASE_S2_M32K_G_DVBT:
+			case CXD2880_DVBT2_BASE_S2_M32K_G_DVBT2:
+				l1_pre->fft_mode = CXD2880_DVBT2_M32K;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_HW_STATE;
+			}
+		} else if (profile == CXD2880_DVBT2_PROFILE_LITE) {
+			switch ((l1_pre->s2 >> 1)) {
+			case CXD2880_DVBT2_LITE_S2_M2K_G_ANY:
+				l1_pre->fft_mode = CXD2880_DVBT2_M2K;
+				break;
+			case CXD2880_DVBT2_LITE_S2_M4K_G_ANY:
+				l1_pre->fft_mode = CXD2880_DVBT2_M4K;
+				break;
+			case CXD2880_DVBT2_LITE_S2_M8K_G_DVBT:
+			case CXD2880_DVBT2_LITE_S2_M8K_G_DVBT2:
+				l1_pre->fft_mode = CXD2880_DVBT2_M8K;
+				break;
+			case CXD2880_DVBT2_LITE_S2_M16K_G_DVBT:
+			case CXD2880_DVBT2_LITE_S2_M16K_G_DVBT2:
+				l1_pre->fft_mode = CXD2880_DVBT2_M16K;
+				break;
+			default:
+				return CXD2880_RESULT_ERROR_HW_STATE;
+			}
+		} else {
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+
+		l1_pre->mixed = l1_pre->s2 & 0x01;
+	}
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_version(struct cxd2880_tnrdmd
+						  *tnr_dmd,
+						  enum cxd2880_dvbt2_version
+						  *ver)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	u8 version = 0;
+
+	if ((!tnr_dmd) || (!ver))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	{
+		u8 data[2];
+		u8 sync_state = 0;
+		u8 ts_lock = 0;
+		u8 unlock_detected = 0;
+
+		if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		ret =
+		    cxd2880_tnrdmd_dvbt2_mon_sync_stat(tnr_dmd, &sync_state,
+						       &ts_lock,
+						       &unlock_detected);
+		if (ret != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (sync_state < 5) {
+			if (tnr_dmd->diver_mode ==
+			    CXD2880_TNRDMD_DIVERMODE_MAIN) {
+				ret =
+				    cxd2880_tnrdmd_dvbt2_mon_sync_stat_sub
+				    (tnr_dmd, &sync_state, &unlock_detected);
+				if (ret != CXD2880_RESULT_OK) {
+					slvt_unfreeze_reg(tnr_dmd);
+					return ret;
+				}
+
+				if (sync_state < 5) {
+					slvt_unfreeze_reg(tnr_dmd);
+					return CXD2880_RESULT_ERROR_HW_STATE;
+				}
+			} else {
+				slvt_unfreeze_reg(tnr_dmd);
+				return CXD2880_RESULT_ERROR_HW_STATE;
+			}
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x0B) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x80, data,
+					   sizeof(data)) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		slvt_unfreeze_reg(tnr_dmd);
+
+		version = ((data[0] & 0x03) << 2);
+		version |= ((data[1] & 0xC0) >> 6);
+		*ver = (enum cxd2880_dvbt2_version)version;
+	}
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_ofdm(struct cxd2880_tnrdmd *tnr_dmd,
+					       struct cxd2880_dvbt2_ofdm *ofdm)
+{
+	if ((!tnr_dmd) || (!ofdm))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	{
+		u8 data[5];
+		u8 sync_state = 0;
+		u8 ts_lock = 0;
+		u8 unlock_detected = 0;
+		enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+		if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		ret =
+		    cxd2880_tnrdmd_dvbt2_mon_sync_stat(tnr_dmd, &sync_state,
+						       &ts_lock,
+						       &unlock_detected);
+		if (ret != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (sync_state != 6) {
+			slvt_unfreeze_reg(tnr_dmd);
+
+			ret = CXD2880_RESULT_ERROR_HW_STATE;
+
+			if (tnr_dmd->diver_mode ==
+			    CXD2880_TNRDMD_DIVERMODE_MAIN)
+				ret =
+				    cxd2880_tnrdmd_dvbt2_mon_ofdm(
+					tnr_dmd->diver_sub, ofdm);
+
+			return ret;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x0B) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x1D, data,
+					   sizeof(data)) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		slvt_unfreeze_reg(tnr_dmd);
+
+		ofdm->mixed = ((data[0] & 0x20) ? 1 : 0);
+		ofdm->is_miso = ((data[0] & 0x10) >> 4);
+		ofdm->mode = (enum cxd2880_dvbt2_mode)(data[0] & 0x07);
+		ofdm->gi = (enum cxd2880_dvbt2_guard)((data[1] & 0x70) >> 4);
+		ofdm->pp = (enum cxd2880_dvbt2_pp)(data[1] & 0x07);
+		ofdm->bw_ext = (data[2] & 0x10) >> 4;
+		ofdm->papr = (enum cxd2880_dvbt2_papr)(data[2] & 0x0F);
+		ofdm->num_symbols = (data[3] << 8) | data[4];
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_data_plps(struct cxd2880_tnrdmd
+						    *tnr_dmd, u8 *plp_ids,
+						    u8 *num_plps)
+{
+	if ((!tnr_dmd) || (!num_plps))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	{
+		u8 l1_post_ok = 0;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x0B) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x86,
+					   &l1_post_ok,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (!(l1_post_ok & 0x01)) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0xC1, num_plps,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (*num_plps == 0) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_OTHER;
+		}
+
+		if (!plp_ids) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_OK;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0xC2, plp_ids,
+					   ((*num_plps >
+					     62) ? 62 : *num_plps)) !=
+		    CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (*num_plps > 62) {
+			if (tnr_dmd->io->write_reg(tnr_dmd->io,
+						   CXD2880_IO_TGT_DMD, 0x00,
+						   0x0C) != CXD2880_RESULT_OK) {
+				slvt_unfreeze_reg(tnr_dmd);
+				return CXD2880_RESULT_ERROR_IO;
+			}
+
+			if (tnr_dmd->io->read_regs(tnr_dmd->io,
+						   CXD2880_IO_TGT_DMD, 0x10,
+						   plp_ids + 62,
+						   *num_plps - 62) !=
+			    CXD2880_RESULT_OK) {
+				slvt_unfreeze_reg(tnr_dmd);
+				return CXD2880_RESULT_ERROR_IO;
+			}
+		}
+
+		slvt_unfreeze_reg(tnr_dmd);
+	}
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_active_plp(struct cxd2880_tnrdmd
+						     *tnr_dmd,
+						     enum
+						     cxd2880_dvbt2_plp_btype
+						     type,
+						     struct cxd2880_dvbt2_plp
+						     *plp_info)
+{
+	if ((!tnr_dmd) || (!plp_info))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	{
+		u8 data[20];
+		u8 addr = 0;
+		u8 index = 0;
+		u8 l1_post_ok = 0;
+
+		if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x0B) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x86,
+					   &l1_post_ok,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (!l1_post_ok) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+
+		if (type == CXD2880_DVBT2_PLP_COMMON)
+			addr = 0xA9;
+		else
+			addr = 0x96;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, addr, data,
+					   sizeof(data)) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		slvt_unfreeze_reg(tnr_dmd);
+
+		if ((type == CXD2880_DVBT2_PLP_COMMON) && (data[13] == 0))
+			return CXD2880_RESULT_ERROR_HW_STATE;
+
+		plp_info->id = data[index++];
+		plp_info->type =
+		    (enum cxd2880_dvbt2_plp_type)(data[index++] & 0x07);
+		plp_info->payload =
+		    (enum cxd2880_dvbt2_plp_payload)(data[index++] & 0x1F);
+		plp_info->ff = data[index++] & 0x01;
+		plp_info->first_rf_idx = data[index++] & 0x07;
+		plp_info->first_frm_idx = data[index++];
+		plp_info->group_id = data[index++];
+		plp_info->plp_cr =
+		    (enum cxd2880_dvbt2_plp_code_rate)(data[index++] & 0x07);
+		plp_info->constell =
+		    (enum cxd2880_dvbt2_plp_constell)(data[index++] & 0x07);
+		plp_info->rot = data[index++] & 0x01;
+		plp_info->fec =
+		    (enum cxd2880_dvbt2_plp_fec)(data[index++] & 0x03);
+		plp_info->num_blocks_max = (u16)((data[index++] & 0x03)) << 8;
+		plp_info->num_blocks_max |= data[index++];
+		plp_info->frm_int = data[index++];
+		plp_info->til_len = data[index++];
+		plp_info->til_type = data[index++] & 0x01;
+
+		plp_info->in_band_a_flag = data[index++] & 0x01;
+		plp_info->rsvd = data[index++] << 8;
+		plp_info->rsvd |= data[index++];
+
+		plp_info->in_band_b_flag =
+		    (u8)((plp_info->rsvd & 0x8000) >> 15);
+		plp_info->plp_mode =
+		    (enum cxd2880_dvbt2_plp_mode)((plp_info->rsvd & 0x000C) >>
+						  2);
+		plp_info->static_flag = (u8)((plp_info->rsvd & 0x0002) >> 1);
+		plp_info->static_padding_flag = (u8)(plp_info->rsvd & 0x0001);
+		plp_info->rsvd = (u16)((plp_info->rsvd & 0x7FF0) >> 4);
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_data_plp_error(struct cxd2880_tnrdmd
+							 *tnr_dmd,
+							 u8 *plp_error)
+{
+	if ((!tnr_dmd) || (!plp_error))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	{
+		u8 data;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x0B) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x86, &data,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if ((data & 0x01) == 0x00) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0xC0, &data,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		slvt_unfreeze_reg(tnr_dmd);
+
+		*plp_error = data & 0x01;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_l1_change(struct cxd2880_tnrdmd
+						    *tnr_dmd, u8 *l1_change)
+{
+	if ((!tnr_dmd) || (!l1_change))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	{
+		u8 data;
+		u8 sync_state = 0;
+		u8 ts_lock = 0;
+		u8 unlock_detected = 0;
+		enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+		if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		ret =
+		    cxd2880_tnrdmd_dvbt2_mon_sync_stat(tnr_dmd, &sync_state,
+						       &ts_lock,
+						       &unlock_detected);
+		if (ret != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (sync_state < 5) {
+			if (tnr_dmd->diver_mode ==
+			    CXD2880_TNRDMD_DIVERMODE_MAIN) {
+				ret =
+				    cxd2880_tnrdmd_dvbt2_mon_sync_stat_sub
+				    (tnr_dmd, &sync_state, &unlock_detected);
+				if (ret != CXD2880_RESULT_OK) {
+					slvt_unfreeze_reg(tnr_dmd);
+					return ret;
+				}
+
+				if (sync_state < 5) {
+					slvt_unfreeze_reg(tnr_dmd);
+					return CXD2880_RESULT_ERROR_HW_STATE;
+				}
+			} else {
+				slvt_unfreeze_reg(tnr_dmd);
+				return CXD2880_RESULT_ERROR_HW_STATE;
+			}
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x0B) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x5F, &data,
+					   sizeof(data)) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		*l1_change = data & 0x01;
+		if (*l1_change) {
+			if (tnr_dmd->io->write_reg(tnr_dmd->io,
+						   CXD2880_IO_TGT_DMD, 0x00,
+						   0x22) != CXD2880_RESULT_OK) {
+				slvt_unfreeze_reg(tnr_dmd);
+				return CXD2880_RESULT_ERROR_IO;
+			}
+
+			if (tnr_dmd->io->write_reg(tnr_dmd->io,
+						   CXD2880_IO_TGT_DMD, 0x16,
+						   0x01) != CXD2880_RESULT_OK) {
+				slvt_unfreeze_reg(tnr_dmd);
+				return CXD2880_RESULT_ERROR_IO;
+			}
+		}
+		slvt_unfreeze_reg(tnr_dmd);
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_l1_post(struct cxd2880_tnrdmd
+						  *tnr_dmd,
+						  struct cxd2880_dvbt2_l1post
+						  *l1_post)
+{
+	if ((!tnr_dmd) || (!l1_post))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	{
+		u8 data[16];
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x0B) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x86, data,
+					   sizeof(data)) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (!(data[0] & 0x01))
+			return CXD2880_RESULT_ERROR_HW_STATE;
+
+		l1_post->sub_slices_per_frame = (data[1] & 0x7F) << 8;
+		l1_post->sub_slices_per_frame |= data[2];
+		l1_post->num_plps = data[3];
+		l1_post->num_aux = data[4] & 0x0F;
+		l1_post->aux_cfg_rfu = data[5];
+		l1_post->rf_idx = data[6] & 0x07;
+		l1_post->freq = data[7] << 24;
+		l1_post->freq |= data[8] << 16;
+		l1_post->freq |= data[9] << 8;
+		l1_post->freq |= data[10];
+		l1_post->fef_type = data[11] & 0x0F;
+		l1_post->fef_length = data[12] << 16;
+		l1_post->fef_length |= data[13] << 8;
+		l1_post->fef_length |= data[14];
+		l1_post->fef_intvl = data[15];
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_bbheader(struct cxd2880_tnrdmd
+						   *tnr_dmd,
+						   enum cxd2880_dvbt2_plp_btype
+						   type,
+						   struct cxd2880_dvbt2_bbheader
+						   *bbheader)
+{
+	if ((!tnr_dmd) || (!bbheader))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	{
+		enum cxd2880_ret ret = CXD2880_RESULT_OK;
+		u8 sync_state = 0;
+		u8 ts_lock = 0;
+		u8 unlock_detected = 0;
+
+		ret =
+		    cxd2880_tnrdmd_dvbt2_mon_sync_stat(tnr_dmd, &sync_state,
+						       &ts_lock,
+						       &unlock_detected);
+		if (ret != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return ret;
+		}
+
+		if (!ts_lock) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0B) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (type == CXD2880_DVBT2_PLP_COMMON) {
+		u8 l1_post_ok;
+		u8 data;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x86,
+					   &l1_post_ok,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (!(l1_post_ok & 0x01)) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0xB6, &data,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (data == 0) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+	}
+
+	{
+		u8 data[14];
+		u8 addr = 0;
+
+		if (type == CXD2880_DVBT2_PLP_COMMON)
+			addr = 0x51;
+		else
+			addr = 0x42;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, addr, data,
+					   sizeof(data)) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		slvt_unfreeze_reg(tnr_dmd);
+
+		bbheader->stream_input =
+		    (enum cxd2880_dvbt2_stream)((data[0] >> 6) & 0x03);
+		bbheader->is_single_input_stream = (u8)((data[0] >> 5) & 0x01);
+		bbheader->is_constant_coding_modulation =
+		    (u8)((data[0] >> 4) & 0x01);
+		bbheader->issy_indicator = (u8)((data[0] >> 3) & 0x01);
+		bbheader->null_packet_deletion = (u8)((data[0] >> 2) & 0x01);
+		bbheader->ext = (u8)(data[0] & 0x03);
+
+		bbheader->input_stream_identifier = data[1];
+		bbheader->plp_mode =
+		    (data[3] & 0x01) ? CXD2880_DVBT2_PLP_MODE_HEM :
+		    CXD2880_DVBT2_PLP_MODE_NM;
+		bbheader->data_field_length = (u16)((data[4] << 8) | data[5]);
+
+		if (bbheader->plp_mode == CXD2880_DVBT2_PLP_MODE_NM) {
+			bbheader->user_packet_length =
+			    (u16)((data[6] << 8) | data[7]);
+			bbheader->sync_byte = data[8];
+			bbheader->issy = 0;
+		} else {
+			bbheader->user_packet_length = 0;
+			bbheader->sync_byte = 0;
+			bbheader->issy =
+			    (u32)((data[11] << 16) | (data[12] << 8) |
+				   data[13]);
+		}
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_in_bandb_ts_rate(struct cxd2880_tnrdmd
+						   *tnr_dmd,
+						   enum
+						   cxd2880_dvbt2_plp_btype
+						   type,
+						   u32 *ts_rate_bps)
+{
+	if ((!tnr_dmd) || (!ts_rate_bps))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	{
+		enum cxd2880_ret ret = CXD2880_RESULT_OK;
+		u8 sync_state = 0;
+		u8 ts_lock = 0;
+		u8 unlock_detected = 0;
+
+		ret =
+		    cxd2880_tnrdmd_dvbt2_mon_sync_stat(tnr_dmd, &sync_state,
+						       &ts_lock,
+						       &unlock_detected);
+		if (ret != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return ret;
+		}
+
+		if (!ts_lock) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0B) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	{
+		u8 l1_post_ok = 0;
+		u8 addr = 0;
+		u8 data = 0;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x86,
+					   &l1_post_ok,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (!(l1_post_ok & 0x01)) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+
+		if (type == CXD2880_DVBT2_PLP_COMMON)
+			addr = 0xBA;
+		else
+			addr = 0xA7;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, addr, &data,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if ((data & 0x80) == 0x00) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x25) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	{
+		u8 data[4];
+		u8 addr = 0;
+
+		if (type == CXD2880_DVBT2_PLP_COMMON)
+			addr = 0xA6;
+		else
+			addr = 0xAA;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, addr, &data[0],
+					   4) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		*ts_rate_bps =
+		    (u32)(((data[0] & 0x07) << 24) | (data[1] << 16) |
+			   (data[2] << 8) | data[3]);
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_spectrum_sense(struct cxd2880_tnrdmd
+						 *tnr_dmd,
+						 enum
+						 cxd2880_tnrdmd_spectrum_sense
+						 *sense)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	u8 sync_state = 0;
+	u8 ts_lock = 0;
+	u8 early_unlock = 0;
+
+	if ((!tnr_dmd) || (!sense))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	ret =
+	    cxd2880_tnrdmd_dvbt2_mon_sync_stat(tnr_dmd, &sync_state, &ts_lock,
+					       &early_unlock);
+	if (ret != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return ret;
+	}
+
+	if (sync_state != 6) {
+		slvt_unfreeze_reg(tnr_dmd);
+
+		ret = CXD2880_RESULT_ERROR_HW_STATE;
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN)
+			ret =
+			    cxd2880_tnrdmd_dvbt2_mon_spectrum_sense(
+				tnr_dmd->diver_sub, sense);
+
+		return ret;
+	}
+
+	{
+		u8 data = 0;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x0B) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x2F, &data,
+					   sizeof(data)) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		slvt_unfreeze_reg(tnr_dmd);
+
+		*sense =
+		    (data & 0x01) ? CXD2880_TNRDMD_SPECTRUM_INV :
+		    CXD2880_TNRDMD_SPECTRUM_NORMAL;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret dvbt2_read_snr_reg(struct cxd2880_tnrdmd *tnr_dmd,
+					   u16 *reg_value)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!reg_value))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	{
+		u8 sync_state = 0;
+		u8 ts_lock = 0;
+		u8 unlock_detected = 0;
+		u8 data[2];
+
+		if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		ret =
+		    cxd2880_tnrdmd_dvbt2_mon_sync_stat(tnr_dmd, &sync_state,
+						       &ts_lock,
+						       &unlock_detected);
+		if (ret != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (sync_state != 6) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x0B) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x13, data,
+					   sizeof(data)) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		slvt_unfreeze_reg(tnr_dmd);
+
+		*reg_value = (data[0] << 8) | data[1];
+	}
+
+	return ret;
+}
+
+static enum cxd2880_ret dvbt2_calc_snr(struct cxd2880_tnrdmd *tnr_dmd,
+				       u32 reg_value, int *snr)
+{
+	if ((!tnr_dmd) || (!snr))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (reg_value == 0)
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	if (reg_value > 10876)
+		reg_value = 10876;
+
+	*snr =
+	    10 * 10 * ((int)cxd2880_math_log10(reg_value) -
+		       (int)cxd2880_math_log10(12600 - reg_value));
+	*snr += 32000;
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_snr(struct cxd2880_tnrdmd *tnr_dmd,
+					      int *snr)
+{
+	u16 reg_value = 0;
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!snr))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	*snr = -1000 * 1000;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SINGLE) {
+		ret = dvbt2_read_snr_reg(tnr_dmd, &reg_value);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		ret = dvbt2_calc_snr(tnr_dmd, reg_value, snr);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	} else {
+		int snr_main = 0;
+		int snr_sub = 0;
+
+		ret =
+		    cxd2880_tnrdmd_dvbt2_mon_snr_diver(tnr_dmd, snr, &snr_main,
+						       &snr_sub);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_snr_diver(struct cxd2880_tnrdmd
+						    *tnr_dmd, int *snr,
+						    int *snr_main, int *snr_sub)
+{
+	u16 reg_value = 0;
+	u32 reg_value_sum = 0;
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!snr) || (!snr_main) || (!snr_sub))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	*snr = -1000 * 1000;
+	*snr_main = -1000 * 1000;
+	*snr_sub = -1000 * 1000;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret = dvbt2_read_snr_reg(tnr_dmd, &reg_value);
+	if (ret == CXD2880_RESULT_OK) {
+		ret = dvbt2_calc_snr(tnr_dmd, reg_value, snr_main);
+		if (ret != CXD2880_RESULT_OK)
+			reg_value = 0;
+	} else if (ret == CXD2880_RESULT_ERROR_HW_STATE) {
+		reg_value = 0;
+	} else {
+		return ret;
+	}
+
+	reg_value_sum += reg_value;
+
+	ret = dvbt2_read_snr_reg(tnr_dmd->diver_sub, &reg_value);
+	if (ret == CXD2880_RESULT_OK) {
+		ret = dvbt2_calc_snr(tnr_dmd->diver_sub, reg_value, snr_sub);
+		if (ret != CXD2880_RESULT_OK)
+			reg_value = 0;
+	} else if (ret == CXD2880_RESULT_ERROR_HW_STATE) {
+		reg_value = 0;
+	} else {
+		return ret;
+	}
+
+	reg_value_sum += reg_value;
+
+	ret = dvbt2_calc_snr(tnr_dmd, reg_value_sum, snr);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_pre_ldpcber(struct cxd2880_tnrdmd
+						      *tnr_dmd, u32 *ber)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	u32 bit_error = 0;
+	u32 period_exp = 0;
+	u32 n_ldpc = 0;
+
+	if ((!tnr_dmd) || (!ber))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0B) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	{
+		u8 data[5];
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x3C, data,
+					   sizeof(data)) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (!(data[0] & 0x01)) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+
+		bit_error =
+		    ((data[1] & 0x0F) << 24) | (data[2] << 16) | (data[3] << 8)
+		    | data[4];
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0xA0, data,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (((enum cxd2880_dvbt2_plp_fec)(data[0] & 0x03)) ==
+		    CXD2880_DVBT2_FEC_LDPC_16K)
+			n_ldpc = 16200;
+		else
+			n_ldpc = 64800;
+
+		slvt_unfreeze_reg(tnr_dmd);
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x20) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x6F, data,
+					   1) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		period_exp = data[0] & 0x0F;
+	}
+
+	if (bit_error > ((1U << period_exp) * n_ldpc))
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	{
+		u32 div = 0;
+		u32 Q = 0;
+		u32 R = 0;
+
+		if (period_exp >= 4) {
+			div = (1U << (period_exp - 4)) * (n_ldpc / 200);
+
+			Q = (bit_error * 5) / div;
+			R = (bit_error * 5) % div;
+
+			R *= 625;
+			Q = Q * 625 + R / div;
+			R = R % div;
+		} else {
+			div = (1U << period_exp) * (n_ldpc / 200);
+
+			Q = (bit_error * 10) / div;
+			R = (bit_error * 10) % div;
+
+			R *= 5000;
+			Q = Q * 5000 + R / div;
+			R = R % div;
+		}
+
+		if (div / 2 <= R)
+			*ber = Q + 1;
+		else
+			*ber = Q;
+	}
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_post_bchfer(struct cxd2880_tnrdmd
+						      *tnr_dmd, u32 *fer)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	u32 fec_error = 0;
+	u32 period = 0;
+
+	if ((!tnr_dmd) || (!fer))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0B) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	{
+		u8 data[2];
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x1B, data,
+					   2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (!(data[0] & 0x80))
+			return CXD2880_RESULT_ERROR_HW_STATE;
+
+		fec_error = ((data[0] & 0x7F) << 8) | (data[1]);
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x20) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x72, data,
+					   1) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		period = (1 << (data[0] & 0x0F));
+	}
+
+	if ((period == 0) || (fec_error > period))
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	{
+		u32 div = 0;
+		u32 Q = 0;
+		u32 R = 0;
+
+		div = period;
+
+		Q = (fec_error * 1000) / div;
+		R = (fec_error * 1000) % div;
+
+		R *= 1000;
+		Q = Q * 1000 + R / div;
+		R = R % div;
+
+		if ((div != 1) && (div / 2 <= R))
+			*fer = Q + 1;
+		else
+			*fer = Q;
+	}
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_pre_bchber(struct cxd2880_tnrdmd
+						     *tnr_dmd, u32 *ber)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	u32 bit_error = 0;
+	u32 period_exp = 0;
+	u32 n_bch = 0;
+
+	if ((!tnr_dmd) || (!ber))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	{
+		u8 data[3];
+		enum cxd2880_dvbt2_plp_fec plp_fec_type =
+		    CXD2880_DVBT2_FEC_LDPC_16K;
+		enum cxd2880_dvbt2_plp_code_rate plp_cr = CXD2880_DVBT2_R1_2;
+
+		static const u16 n_bch_bits_lookup[2][8] = {
+			{7200, 9720, 10800, 11880, 12600, 13320, 5400, 6480},
+			{32400, 38880, 43200, 48600, 51840, 54000, 21600, 25920}
+		};
+
+		if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x0B) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x15, data,
+					   3) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (!(data[0] & 0x40)) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+
+		bit_error = ((data[0] & 0x3F) << 16) | (data[1] << 8) | data[2];
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x9D, data,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		plp_cr = (enum cxd2880_dvbt2_plp_code_rate)(data[0] & 0x07);
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0xA0, data,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		plp_fec_type = (enum cxd2880_dvbt2_plp_fec)(data[0] & 0x03);
+
+		slvt_unfreeze_reg(tnr_dmd);
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x20) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x72, data,
+					   1) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		period_exp = data[0] & 0x0F;
+
+		if ((plp_fec_type > CXD2880_DVBT2_FEC_LDPC_64K) ||
+		    (plp_cr > CXD2880_DVBT2_R2_5))
+			return CXD2880_RESULT_ERROR_HW_STATE;
+
+		n_bch = n_bch_bits_lookup[plp_fec_type][plp_cr];
+	}
+
+	if (bit_error > ((1U << period_exp) * n_bch))
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	{
+		u32 div = 0;
+		u32 Q = 0;
+		u32 R = 0;
+
+		if (period_exp >= 6) {
+			div = (1U << (period_exp - 6)) * (n_bch / 40);
+
+			Q = (bit_error * 625) / div;
+			R = (bit_error * 625) % div;
+
+			R *= 625;
+			Q = Q * 625 + R / div;
+			R = R % div;
+		} else {
+			div = (1U << period_exp) * (n_bch / 40);
+
+			Q = (bit_error * 1000) / div;
+			R = (bit_error * 1000) % div;
+
+			R *= 25000;
+			Q = Q * 25000 + R / div;
+			R = R % div;
+		}
+
+		if (div / 2 <= R)
+			*ber = Q + 1;
+		else
+			*ber = Q;
+	}
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_packet_error_number(struct
+							      cxd2880_tnrdmd
+							      *tnr_dmd,
+							      u32 *pen)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	u8 data[3];
+
+	if ((!tnr_dmd) || (!pen))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0B) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x39, data,
+				   sizeof(data)) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (!(data[0] & 0x01))
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	*pen = ((data[1] << 8) | data[2]);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_sampling_offset(struct cxd2880_tnrdmd
+							  *tnr_dmd, int *ppm)
+{
+	if ((!tnr_dmd) || (!ppm))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	{
+		u8 ctl_val_reg[5];
+		u8 nominal_rate_reg[5];
+		u32 trl_ctl_val = 0;
+		u32 trcg_nominal_rate = 0;
+		int num;
+		int den;
+		enum cxd2880_ret ret = CXD2880_RESULT_OK;
+		u8 sync_state = 0;
+		u8 ts_lock = 0;
+		u8 unlock_detected = 0;
+		s8 diff_upper = 0;
+
+		if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		ret =
+		    cxd2880_tnrdmd_dvbt2_mon_sync_stat(tnr_dmd, &sync_state,
+						       &ts_lock,
+						       &unlock_detected);
+		if (ret != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (sync_state != 6) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x0B) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x34,
+					   ctl_val_reg,
+					   sizeof(ctl_val_reg)) !=
+		    CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x04) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x10,
+					   nominal_rate_reg,
+					   sizeof(nominal_rate_reg)) !=
+		    CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		slvt_unfreeze_reg(tnr_dmd);
+
+		diff_upper =
+		    (ctl_val_reg[0] & 0x7F) - (nominal_rate_reg[0] & 0x7F);
+
+		if ((diff_upper < -1) || (diff_upper > 1))
+			return CXD2880_RESULT_ERROR_HW_STATE;
+
+		trl_ctl_val = ctl_val_reg[1] << 24;
+		trl_ctl_val |= ctl_val_reg[2] << 16;
+		trl_ctl_val |= ctl_val_reg[3] << 8;
+		trl_ctl_val |= ctl_val_reg[4];
+
+		trcg_nominal_rate = nominal_rate_reg[1] << 24;
+		trcg_nominal_rate |= nominal_rate_reg[2] << 16;
+		trcg_nominal_rate |= nominal_rate_reg[3] << 8;
+		trcg_nominal_rate |= nominal_rate_reg[4];
+
+		trl_ctl_val >>= 1;
+		trcg_nominal_rate >>= 1;
+
+		if (diff_upper == 1)
+			num =
+			    (int)((trl_ctl_val + 0x80000000u) -
+				  trcg_nominal_rate);
+		else if (diff_upper == -1)
+			num =
+			    -(int)((trcg_nominal_rate + 0x80000000u) -
+				   trl_ctl_val);
+		else
+			num = (int)(trl_ctl_val - trcg_nominal_rate);
+
+		den = (nominal_rate_reg[0] & 0x7F) << 24;
+		den |= nominal_rate_reg[1] << 16;
+		den |= nominal_rate_reg[2] << 8;
+		den |= nominal_rate_reg[3];
+		den = (den + (390625 / 2)) / 390625;
+
+		den >>= 1;
+
+		if (num >= 0)
+			*ppm = (num + (den / 2)) / den;
+		else
+			*ppm = (num - (den / 2)) / den;
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_sampling_offset_sub(struct
+							      cxd2880_tnrdmd
+							      *tnr_dmd,
+							      int *ppm)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!ppm))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret = cxd2880_tnrdmd_dvbt2_mon_sampling_offset(tnr_dmd->diver_sub, ppm);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_quality(struct cxd2880_tnrdmd
+						  *tnr_dmd, u8 *quality)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	int snr = 0;
+	int snr_rel = 0;
+	u32 ber = 0;
+	u32 ber_sqi = 0;
+	enum cxd2880_dvbt2_plp_constell qam;
+	enum cxd2880_dvbt2_plp_code_rate code_rate;
+
+	static const int snr_nordig_p1_db_1000[4][8] = {
+		{3500, 4700, 5600, 6600, 7200, 7700, 1300, 2200},
+		{8700, 10100, 11400, 12500, 13300, 13800, 6000, 7200},
+		{13000, 14800, 16200, 17700, 18700, 19400, 9800, 11100},
+		{17000, 19400, 20800, 22900, 24300, 25100, 13200, 14800},
+	};
+
+	if ((!tnr_dmd) || (!quality))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret = cxd2880_tnrdmd_dvbt2_mon_pre_bchber(tnr_dmd, &ber);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret = cxd2880_tnrdmd_dvbt2_mon_snr(tnr_dmd, &snr);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret =
+	    cxd2880_tnrdmd_dvbt2_mon_qam(tnr_dmd, CXD2880_DVBT2_PLP_DATA, &qam);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret =
+	    cxd2880_tnrdmd_dvbt2_mon_code_rate(tnr_dmd, CXD2880_DVBT2_PLP_DATA,
+					       &code_rate);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if ((code_rate > CXD2880_DVBT2_R2_5) || (qam > CXD2880_DVBT2_QAM256))
+		return CXD2880_RESULT_ERROR_OTHER;
+
+	if (ber > 100000)
+		ber_sqi = 0;
+	else if (ber >= 100)
+		ber_sqi = 6667;
+	else
+		ber_sqi = 16667;
+
+	snr_rel = snr - snr_nordig_p1_db_1000[qam][code_rate];
+
+	if (snr_rel < -3000) {
+		*quality = 0;
+	} else if (snr_rel <= 3000) {
+		u32 temp_sqi =
+		    (((snr_rel + 3000) * ber_sqi) + 500000) / 1000000;
+		*quality = (temp_sqi > 100) ? 100 : (u8)temp_sqi;
+	} else {
+		*quality = 100;
+	}
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_ts_rate(struct cxd2880_tnrdmd
+						  *tnr_dmd, u32 *ts_rate_kbps)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	u32 rd_smooth_dp = 0;
+	u32 ep_ck_nume = 0;
+	u32 ep_ck_deno = 0;
+	u8 issy_on_data = 0;
+
+	if ((!tnr_dmd) || (!ts_rate_kbps))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	{
+		u8 data[12];
+		u8 sync_state = 0;
+		u8 ts_lock = 0;
+		u8 unlock_detected = 0;
+
+		if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		ret =
+		    cxd2880_tnrdmd_dvbt2_mon_sync_stat(tnr_dmd, &sync_state,
+						       &ts_lock,
+						       &unlock_detected);
+		if (ret != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (!ts_lock) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x0B) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x23, data,
+					   12) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		rd_smooth_dp = (u32)((data[0] & 0x1F) << 24);
+		rd_smooth_dp |= (u32)(data[1] << 16);
+		rd_smooth_dp |= (u32)(data[2] << 8);
+		rd_smooth_dp |= (u32)data[3];
+
+		if (rd_smooth_dp < 214958) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+
+		ep_ck_nume = (u32)((data[4] & 0x3F) << 24);
+		ep_ck_nume |= (u32)(data[5] << 16);
+		ep_ck_nume |= (u32)(data[6] << 8);
+		ep_ck_nume |= (u32)data[7];
+
+		ep_ck_deno = (u32)((data[8] & 0x3F) << 24);
+		ep_ck_deno |= (u32)(data[9] << 16);
+		ep_ck_deno |= (u32)(data[10] << 8);
+		ep_ck_deno |= (u32)data[11];
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x41, data,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		issy_on_data = data[0] & 0x01;
+
+		slvt_unfreeze_reg(tnr_dmd);
+	}
+
+	if (issy_on_data) {
+		if ((ep_ck_deno == 0) || (ep_ck_nume == 0) ||
+		    (ep_ck_deno >= ep_ck_nume))
+			return CXD2880_RESULT_ERROR_HW_STATE;
+	}
+
+	{
+		u32 ick_x100;
+		u32 div = 0;
+		u32 Q = 0;
+		u32 R = 0;
+
+		switch (tnr_dmd->clk_mode) {
+		case CXD2880_TNRDMD_CLOCKMODE_A:
+			ick_x100 = 8228;
+			break;
+		case CXD2880_TNRDMD_CLOCKMODE_B:
+			ick_x100 = 9330;
+			break;
+		case CXD2880_TNRDMD_CLOCKMODE_C:
+			ick_x100 = 9600;
+			break;
+		default:
+			return CXD2880_RESULT_ERROR_SW_STATE;
+		}
+
+		div = rd_smooth_dp;
+
+		Q = ick_x100 * 262144U / div;
+		R = ick_x100 * 262144U % div;
+
+		R *= 5U;
+		Q = Q * 5 + R / div;
+		R = R % div;
+
+		R *= 2U;
+		Q = Q * 2 + R / div;
+		R = R % div;
+
+		if (div / 2 <= R)
+			*ts_rate_kbps = Q + 1;
+		else
+			*ts_rate_kbps = Q;
+	}
+
+	if (issy_on_data) {
+		u32 diff = ep_ck_nume - ep_ck_deno;
+
+		while (diff > 0x7FFF) {
+			diff >>= 1;
+			ep_ck_nume >>= 1;
+		}
+
+		*ts_rate_kbps -=
+		    (*ts_rate_kbps * diff + ep_ck_nume / 2) / ep_ck_nume;
+	}
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_per(struct cxd2880_tnrdmd *tnr_dmd,
+					      u32 *per)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	u32 packet_error = 0;
+	u32 period = 0;
+
+	if (!tnr_dmd || !per)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	{
+		u8 rdata[3];
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x0B) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x18, rdata,
+					   3) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if ((rdata[0] & 0x01) == 0)
+			return CXD2880_RESULT_ERROR_HW_STATE;
+
+		packet_error = (rdata[1] << 8) | rdata[2];
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x24) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0xDC, rdata,
+					   1) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		period = 1U << (rdata[0] & 0x0F);
+	}
+
+	if ((period == 0) || (packet_error > period))
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	{
+		u32 div = 0;
+		u32 Q = 0;
+		u32 R = 0;
+
+		div = period;
+
+		Q = (packet_error * 1000) / div;
+		R = (packet_error * 1000) % div;
+
+		R *= 1000;
+		Q = Q * 1000 + R / div;
+		R = R % div;
+
+		if ((div != 1) && (div / 2 <= R))
+			*per = Q + 1;
+		else
+			*per = Q;
+	}
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_qam(struct cxd2880_tnrdmd *tnr_dmd,
+					      enum cxd2880_dvbt2_plp_btype type,
+					      enum cxd2880_dvbt2_plp_constell
+					      *qam)
+{
+	u8 data;
+	u8 l1_post_ok = 0;
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!qam))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0B) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x86, &l1_post_ok,
+				   1) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (!(l1_post_ok & 0x01)) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_HW_STATE;
+	}
+
+	if (type == CXD2880_DVBT2_PLP_COMMON) {
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0xB6, &data,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (data == 0) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0xB1, &data,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+	} else {
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x9E, &data,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+	}
+
+	slvt_unfreeze_reg(tnr_dmd);
+
+	*qam = (enum cxd2880_dvbt2_plp_constell)(data & 0x07);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_code_rate(struct cxd2880_tnrdmd
+						    *tnr_dmd,
+						    enum cxd2880_dvbt2_plp_btype
+						    type,
+						    enum
+						    cxd2880_dvbt2_plp_code_rate
+						    *code_rate)
+{
+	u8 data;
+	u8 l1_post_ok = 0;
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!code_rate))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0B) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x86, &l1_post_ok,
+				   1) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (!(l1_post_ok & 0x01)) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_HW_STATE;
+	}
+
+	if (type == CXD2880_DVBT2_PLP_COMMON) {
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0xB6, &data,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (data == 0) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0xB0, &data,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+	} else {
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x9D, &data,
+					   1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+	}
+
+	slvt_unfreeze_reg(tnr_dmd);
+
+	*code_rate = (enum cxd2880_dvbt2_plp_code_rate)(data & 0x07);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_profile(struct cxd2880_tnrdmd
+						  *tnr_dmd,
+						  enum cxd2880_dvbt2_profile
+						  *profile)
+{
+	if ((!tnr_dmd) || (!profile))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0B) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	{
+		u8 data;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x22, &data,
+					   sizeof(data)) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (data & 0x02) {
+			if (data & 0x01)
+				*profile = CXD2880_DVBT2_PROFILE_LITE;
+			else
+				*profile = CXD2880_DVBT2_PROFILE_BASE;
+		} else {
+			enum cxd2880_ret ret = CXD2880_RESULT_ERROR_HW_STATE;
+
+			if (tnr_dmd->diver_mode ==
+			    CXD2880_TNRDMD_DIVERMODE_MAIN)
+				ret =
+				    cxd2880_tnrdmd_dvbt2_mon_profile(
+					tnr_dmd->diver_sub, profile);
+
+			return ret;
+		}
+	}
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret dvbt2_calc_sdi(struct cxd2880_tnrdmd *tnr_dmd,
+				       int rf_lvl, u8 *ssi)
+{
+	enum cxd2880_dvbt2_plp_constell qam;
+	enum cxd2880_dvbt2_plp_code_rate code_rate;
+	int prel;
+	int temp_ssi = 0;
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	static const int ref_dbm_1000[4][8] = {
+		{-96000, -95000, -94000, -93000, -92000, -92000, -98000,
+		 -97000},
+		{-91000, -89000, -88000, -87000, -86000, -86000, -93000,
+		 -92000},
+		{-86000, -85000, -83000, -82000, -81000, -80000, -89000,
+		 -88000},
+		{-82000, -80000, -78000, -76000, -75000, -74000, -86000,
+		 -84000},
+	};
+
+	if ((!tnr_dmd) || (!ssi))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret =
+	    cxd2880_tnrdmd_dvbt2_mon_qam(tnr_dmd, CXD2880_DVBT2_PLP_DATA, &qam);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret =
+	    cxd2880_tnrdmd_dvbt2_mon_code_rate(tnr_dmd, CXD2880_DVBT2_PLP_DATA,
+					       &code_rate);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if ((code_rate > CXD2880_DVBT2_R2_5) || (qam > CXD2880_DVBT2_QAM256))
+		return CXD2880_RESULT_ERROR_OTHER;
+
+	prel = rf_lvl - ref_dbm_1000[qam][code_rate];
+
+	if (prel < -15000)
+		temp_ssi = 0;
+	else if (prel < 0)
+		temp_ssi = ((2 * (prel + 15000)) + 1500) / 3000;
+	else if (prel < 20000)
+		temp_ssi = (((4 * prel) + 500) / 1000) + 10;
+	else if (prel < 35000)
+		temp_ssi = (((2 * (prel - 20000)) + 1500) / 3000) + 90;
+	else
+		temp_ssi = 100;
+
+	*ssi = (temp_ssi > 100) ? 100 : (u8)temp_ssi;
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_ssi(struct cxd2880_tnrdmd *tnr_dmd,
+					      u8 *ssi)
+{
+	int rf_lvl = 0;
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!ssi))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret = cxd2880_tnrdmd_mon_rf_lvl(tnr_dmd, &rf_lvl);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret = dvbt2_calc_sdi(tnr_dmd, rf_lvl, ssi);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_ssi_sub(struct cxd2880_tnrdmd
+						  *tnr_dmd, u8 *ssi)
+{
+	int rf_lvl = 0;
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!ssi))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret = cxd2880_tnrdmd_mon_rf_lvl(tnr_dmd->diver_sub, &rf_lvl);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret = dvbt2_calc_sdi(tnr_dmd, rf_lvl, ssi);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	return ret;
+}
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt2_mon.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt2_mon.h
new file mode 100644
index 000000000000..784ad2844d1b
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt2_mon.h
@@ -0,0 +1,170 @@
+/*
+ * cxd2880_tnrdmd_dvbt2_mon.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * DVB-T2 monitor interface
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_TNRDMD_DVBT2_MON_H
+#define CXD2880_TNRDMD_DVBT2_MON_H
+
+#include "cxd2880_tnrdmd.h"
+#include "cxd2880_dvbt2.h"
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_sync_stat(struct cxd2880_tnrdmd
+						    *tnr_dmd, u8 *sync_stat,
+						    u8 *ts_lock_stat,
+						    u8 *unlock_detected);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_sync_stat_sub(struct cxd2880_tnrdmd
+							*tnr_dmd,
+							u8 *sync_stat,
+							u8 *unlock_detected);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_carrier_offset(struct cxd2880_tnrdmd
+							 *tnr_dmd, int *offset);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_carrier_offset_sub(struct
+							     cxd2880_tnrdmd
+							     *tnr_dmd,
+							     int *offset);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_l1_pre(struct cxd2880_tnrdmd *tnr_dmd,
+						 struct cxd2880_dvbt2_l1pre
+						 *l1_pre);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_version(struct cxd2880_tnrdmd
+						  *tnr_dmd,
+						  enum cxd2880_dvbt2_version
+						  *ver);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_ofdm(struct cxd2880_tnrdmd *tnr_dmd,
+					       struct cxd2880_dvbt2_ofdm *ofdm);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_data_plps(struct cxd2880_tnrdmd
+						    *tnr_dmd, u8 *plp_ids,
+						    u8 *num_plps);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_active_plp(struct cxd2880_tnrdmd
+						     *tnr_dmd,
+						     enum
+						     cxd2880_dvbt2_plp_btype
+						     type,
+						     struct cxd2880_dvbt2_plp
+						     *plp_info);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_data_plp_error(struct cxd2880_tnrdmd
+							 *tnr_dmd,
+							 u8 *plp_error);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_l1_change(struct cxd2880_tnrdmd
+						    *tnr_dmd, u8 *l1_change);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_l1_post(struct cxd2880_tnrdmd
+						  *tnr_dmd,
+						  struct cxd2880_dvbt2_l1post
+						  *l1_post);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_bbheader(struct cxd2880_tnrdmd
+						   *tnr_dmd,
+						   enum cxd2880_dvbt2_plp_btype
+						   type,
+						   struct cxd2880_dvbt2_bbheader
+						   *bbheader);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_in_bandb_ts_rate(struct cxd2880_tnrdmd
+						   *tnr_dmd,
+						   enum
+						   cxd2880_dvbt2_plp_btype
+						   type,
+						   u32 *ts_rate_bps);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_spectrum_sense(struct cxd2880_tnrdmd
+						 *tnr_dmd,
+						 enum
+						 cxd2880_tnrdmd_spectrum_sense
+						 *sense);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_snr(struct cxd2880_tnrdmd *tnr_dmd,
+					      int *snr);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_snr_diver(struct cxd2880_tnrdmd
+						    *tnr_dmd, int *snr,
+						    int *snr_main,
+						    int *snr_sub);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_pre_ldpcber(struct cxd2880_tnrdmd
+						      *tnr_dmd, u32 *ber);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_post_bchfer(struct cxd2880_tnrdmd
+						      *tnr_dmd, u32 *fer);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_pre_bchber(struct cxd2880_tnrdmd
+						     *tnr_dmd, u32 *ber);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_packet_error_number(struct
+							      cxd2880_tnrdmd
+							      *tnr_dmd,
+							      u32 *pen);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_sampling_offset(struct cxd2880_tnrdmd
+							  *tnr_dmd, int *ppm);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_sampling_offset_sub(struct
+							      cxd2880_tnrdmd
+							      *tnr_dmd,
+							      int *ppm);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_ts_rate(struct cxd2880_tnrdmd
+						  *tnr_dmd, u32 *ts_rate_kbps);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_quality(struct cxd2880_tnrdmd
+						  *tnr_dmd, u8 *quality);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_per(struct cxd2880_tnrdmd *tnr_dmd,
+					      u32 *per);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_qam(struct cxd2880_tnrdmd *tnr_dmd,
+					      enum cxd2880_dvbt2_plp_btype type,
+					      enum cxd2880_dvbt2_plp_constell
+					      *qam);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_code_rate(struct cxd2880_tnrdmd
+						    *tnr_dmd,
+						    enum cxd2880_dvbt2_plp_btype
+						    type,
+						    enum
+						    cxd2880_dvbt2_plp_code_rate
+						    *code_rate);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_profile(struct cxd2880_tnrdmd
+						  *tnr_dmd,
+						  enum cxd2880_dvbt2_profile
+						  *profile);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_ssi(struct cxd2880_tnrdmd *tnr_dmd,
+					      u8 *ssi);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt2_mon_ssi_sub(struct cxd2880_tnrdmd
+						  *tnr_dmd, u8 *ssi);
+
+#endif
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt_mon.c b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt_mon.c
new file mode 100644
index 000000000000..d890081b6424
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt_mon.c
@@ -0,0 +1,1190 @@
+/*
+ * cxd2880_tnrdmd_dvbt_mon.c
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * DVB-T monitor functions
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "cxd2880_tnrdmd_mon.h"
+#include "cxd2880_tnrdmd_dvbt.h"
+#include "cxd2880_tnrdmd_dvbt_mon.h"
+#include "cxd2880_math.h"
+
+static enum cxd2880_ret is_tps_locked(struct cxd2880_tnrdmd *tnr_dmd);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_sync_stat(struct cxd2880_tnrdmd
+						   *tnr_dmd, u8 *sync_stat,
+						   u8 *ts_lock_stat,
+						   u8 *unlock_detected)
+{
+	u8 rdata = 0x00;
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!sync_stat) || (!ts_lock_stat) || (!unlock_detected))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0D) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x10, &rdata,
+				   1) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	*unlock_detected = (u8)((rdata & 0x10) ? 1 : 0);
+	*sync_stat = (u8)(rdata & 0x07);
+	*ts_lock_stat = (u8)((rdata & 0x20) ? 1 : 0);
+
+	if (*sync_stat == 0x07)
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_sync_stat_sub(struct cxd2880_tnrdmd
+						       *tnr_dmd, u8 *sync_stat,
+						       u8 *unlock_detected)
+{
+	u8 ts_lock_stat = 0;
+
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!sync_stat) || (!unlock_detected))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret =
+	    cxd2880_tnrdmd_dvbt_mon_sync_stat(tnr_dmd->diver_sub, sync_stat,
+					      &ts_lock_stat, unlock_detected);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_mode_guard(struct cxd2880_tnrdmd
+						    *tnr_dmd,
+						    enum cxd2880_dvbt_mode
+						    *mode,
+						    enum cxd2880_dvbt_guard
+						    *guard)
+{
+	u8 rdata = 0x00;
+
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!mode) || (!guard))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	ret = is_tps_locked(tnr_dmd);
+	if (ret != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN)
+			ret =
+			    cxd2880_tnrdmd_dvbt_mon_mode_guard(
+					tnr_dmd->diver_sub, mode, guard);
+
+		return ret;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0D) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x1B, &rdata,
+				   1) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	slvt_unfreeze_reg(tnr_dmd);
+
+	*mode = (enum cxd2880_dvbt_mode)((rdata >> 2) & 0x03);
+	*guard = (enum cxd2880_dvbt_guard)(rdata & 0x03);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_carrier_offset(struct cxd2880_tnrdmd
+							*tnr_dmd, int *offset)
+{
+	u8 rdata[4];
+	u32 ctl_val = 0;
+
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!offset))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	ret = is_tps_locked(tnr_dmd);
+	if (ret != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return ret;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0D) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x1D, rdata,
+				   4) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	slvt_unfreeze_reg(tnr_dmd);
+
+	ctl_val =
+	    ((rdata[0] & 0x1F) << 24) | (rdata[1] << 16) | (rdata[2] << 8) |
+	    (rdata[3]);
+	*offset = cxd2880_convert2s_complement(ctl_val, 29);
+	*offset = -1 * ((*offset) * (u8)tnr_dmd->bandwidth / 235);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_carrier_offset_sub(struct
+							    cxd2880_tnrdmd
+							    *tnr_dmd,
+							    int *offset)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!offset))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret =
+	    cxd2880_tnrdmd_dvbt_mon_carrier_offset(tnr_dmd->diver_sub, offset);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_pre_viterbiber(struct cxd2880_tnrdmd
+							*tnr_dmd, u32 *ber)
+{
+	u8 rdata[2];
+	u32 bit_error = 0;
+	u32 period = 0;
+
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!ber))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x10) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x39, rdata,
+				   1) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if ((rdata[0] & 0x01) == 0) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_HW_STATE;
+	}
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x22, rdata,
+				   2) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	bit_error = (rdata[0] << 8) | rdata[1];
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x6F, rdata,
+				   1) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	slvt_unfreeze_reg(tnr_dmd);
+
+	period = ((rdata[0] & 0x07) == 0) ? 256 : (0x1000 << (rdata[0] & 0x07));
+
+	if ((period == 0) || (bit_error > period))
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	{
+		u32 div = 0;
+		u32 Q = 0;
+		u32 R = 0;
+
+		div = period / 128;
+
+		Q = (bit_error * 3125) / div;
+		R = (bit_error * 3125) % div;
+
+		R *= 25;
+		Q = Q * 25 + R / div;
+		R = R % div;
+
+		if (div / 2 <= R)
+			*ber = Q + 1;
+		else
+			*ber = Q;
+	}
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_pre_rsber(struct cxd2880_tnrdmd
+						   *tnr_dmd, u32 *ber)
+{
+	u8 rdata[3];
+	u32 bit_error = 0;
+	u32 period_exp = 0;
+
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!ber))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0D) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x15, rdata,
+				   3) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if ((rdata[0] & 0x40) == 0)
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	bit_error = ((rdata[0] & 0x3F) << 16) | (rdata[1] << 8) | rdata[2];
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x60, rdata,
+				   1) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	period_exp = (rdata[0] & 0x1F);
+
+	if ((period_exp <= 11) && (bit_error > (1U << period_exp) * 204 * 8))
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	{
+		u32 div = 0;
+		u32 Q = 0;
+		u32 R = 0;
+
+		if (period_exp <= 8)
+			div = (1U << period_exp) * 51;
+		else
+			div = (1U << 8) * 51;
+
+		Q = (bit_error * 250) / div;
+		R = (bit_error * 250) % div;
+
+		R *= 1250;
+		Q = Q * 1250 + R / div;
+		R = R % div;
+
+		if (period_exp > 8) {
+			*ber =
+			    (Q + (1 << (period_exp - 9))) >> (period_exp - 8);
+		} else {
+			if (div / 2 <= R)
+				*ber = Q + 1;
+			else
+				*ber = Q;
+		}
+	}
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_tps_info(struct cxd2880_tnrdmd
+						  *tnr_dmd,
+						  struct cxd2880_dvbt_tpsinfo
+						  *info)
+{
+	u8 rdata[7];
+	u8 cell_id_ok = 0;
+
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!info))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	ret = is_tps_locked(tnr_dmd);
+	if (ret != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN)
+			ret =
+			    cxd2880_tnrdmd_dvbt_mon_tps_info(tnr_dmd->diver_sub,
+							     info);
+
+		return ret;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0D) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x29, rdata,
+				   7) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x11) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0xD5, &cell_id_ok,
+				   1) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	slvt_unfreeze_reg(tnr_dmd);
+
+	info->constellation =
+	    (enum cxd2880_dvbt_constellation)((rdata[0] >> 6) & 0x03);
+	info->hierarchy = (enum cxd2880_dvbt_hierarchy)((rdata[0] >> 3) & 0x07);
+	info->rate_hp = (enum cxd2880_dvbt_coderate)(rdata[0] & 0x07);
+	info->rate_lp = (enum cxd2880_dvbt_coderate)((rdata[1] >> 5) & 0x07);
+	info->guard = (enum cxd2880_dvbt_guard)((rdata[1] >> 3) & 0x03);
+	info->mode = (enum cxd2880_dvbt_mode)((rdata[1] >> 1) & 0x03);
+	info->fnum = (rdata[2] >> 6) & 0x03;
+	info->length_indicator = rdata[2] & 0x3F;
+	info->cell_id = (u16)((rdata[3] << 8) | rdata[4]);
+	info->reserved_even = rdata[5] & 0x3F;
+	info->reserved_odd = rdata[6] & 0x3F;
+
+	info->cell_id_ok = cell_id_ok & 0x01;
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_packet_error_number(struct
+							     cxd2880_tnrdmd
+							     *tnr_dmd,
+							     u32 *pen)
+{
+	u8 rdata[3];
+
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!pen))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0D) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x26, rdata,
+				   3) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (!(rdata[0] & 0x01))
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	*pen = (rdata[1] << 8) | rdata[2];
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_spectrum_sense(struct cxd2880_tnrdmd
+						*tnr_dmd,
+						enum
+						cxd2880_tnrdmd_spectrum_sense
+						*sense)
+{
+	u8 data = 0;
+
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!sense))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	ret = is_tps_locked(tnr_dmd);
+	if (ret != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+
+		if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_MAIN)
+			ret =
+				cxd2880_tnrdmd_dvbt_mon_spectrum_sense(
+					tnr_dmd->diver_sub, sense);
+
+		return ret;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0D) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x1C, &data,
+				   sizeof(data)) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	slvt_unfreeze_reg(tnr_dmd);
+
+	*sense =
+	    (data & 0x01) ? CXD2880_TNRDMD_SPECTRUM_INV :
+	    CXD2880_TNRDMD_SPECTRUM_NORMAL;
+
+	return ret;
+}
+
+static enum cxd2880_ret dvbt_read_snr_reg(struct cxd2880_tnrdmd *tnr_dmd,
+					  u16 *reg_value)
+{
+	u8 rdata[2];
+
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!reg_value))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	ret = is_tps_locked(tnr_dmd);
+	if (ret != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return ret;
+	}
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0D) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x13, rdata,
+				   2) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnr_dmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	slvt_unfreeze_reg(tnr_dmd);
+
+	*reg_value = (rdata[0] << 8) | rdata[1];
+
+	return ret;
+}
+
+static enum cxd2880_ret dvbt_calc_snr(struct cxd2880_tnrdmd *tnr_dmd,
+				      u32 reg_value, int *snr)
+{
+	if ((!tnr_dmd) || (!snr))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (reg_value == 0)
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	if (reg_value > 4996)
+		reg_value = 4996;
+
+	*snr =
+	    10 * 10 * ((int)cxd2880_math_log10(reg_value) -
+		       (int)cxd2880_math_log10(5350 - reg_value));
+	*snr += 28500;
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_snr(struct cxd2880_tnrdmd *tnr_dmd,
+					     int *snr)
+{
+	u16 reg_value = 0;
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!snr))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	*snr = -1000 * 1000;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SINGLE) {
+		ret = dvbt_read_snr_reg(tnr_dmd, &reg_value);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+
+		ret = dvbt_calc_snr(tnr_dmd, reg_value, snr);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	} else {
+		int snr_main = 0;
+		int snr_sub = 0;
+
+		ret =
+		    cxd2880_tnrdmd_dvbt_mon_snr_diver(tnr_dmd, snr, &snr_main,
+						      &snr_sub);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_snr_diver(struct cxd2880_tnrdmd
+						   *tnr_dmd, int *snr,
+						   int *snr_main, int *snr_sub)
+{
+	u16 reg_value = 0;
+	u32 reg_value_sum = 0;
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!snr) || (!snr_main) || (!snr_sub))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	*snr = -1000 * 1000;
+	*snr_main = -1000 * 1000;
+	*snr_sub = -1000 * 1000;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret = dvbt_read_snr_reg(tnr_dmd, &reg_value);
+	if (ret == CXD2880_RESULT_OK) {
+		ret = dvbt_calc_snr(tnr_dmd, reg_value, snr_main);
+		if (ret != CXD2880_RESULT_OK)
+			reg_value = 0;
+	} else if (ret == CXD2880_RESULT_ERROR_HW_STATE) {
+		reg_value = 0;
+	} else {
+		return ret;
+	}
+
+	reg_value_sum += reg_value;
+
+	ret = dvbt_read_snr_reg(tnr_dmd->diver_sub, &reg_value);
+	if (ret == CXD2880_RESULT_OK) {
+		ret = dvbt_calc_snr(tnr_dmd->diver_sub, reg_value, snr_sub);
+		if (ret != CXD2880_RESULT_OK)
+			reg_value = 0;
+	} else if (ret == CXD2880_RESULT_ERROR_HW_STATE) {
+		reg_value = 0;
+	} else {
+		return ret;
+	}
+
+	reg_value_sum += reg_value;
+
+	ret = dvbt_calc_snr(tnr_dmd, reg_value_sum, snr);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_sampling_offset(struct cxd2880_tnrdmd
+							 *tnr_dmd, int *ppm)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!ppm))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	{
+		u8 ctl_val_reg[5];
+		u8 nominal_rate_reg[5];
+		u32 trl_ctl_val = 0;
+		u32 trcg_nominal_rate = 0;
+		int num;
+		int den;
+		s8 diff_upper = 0;
+
+		if (slvt_freeze_reg(tnr_dmd) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		ret = is_tps_locked(tnr_dmd);
+		if (ret != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return ret;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x0D) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x21,
+					   ctl_val_reg,
+					   sizeof(ctl_val_reg)) !=
+		    CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x04) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x60,
+					   nominal_rate_reg,
+					   sizeof(nominal_rate_reg)) !=
+		    CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnr_dmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		slvt_unfreeze_reg(tnr_dmd);
+
+		diff_upper =
+		    (ctl_val_reg[0] & 0x7F) - (nominal_rate_reg[0] & 0x7F);
+
+		if ((diff_upper < -1) || (diff_upper > 1))
+			return CXD2880_RESULT_ERROR_HW_STATE;
+
+		trl_ctl_val = ctl_val_reg[1] << 24;
+		trl_ctl_val |= ctl_val_reg[2] << 16;
+		trl_ctl_val |= ctl_val_reg[3] << 8;
+		trl_ctl_val |= ctl_val_reg[4];
+
+		trcg_nominal_rate = nominal_rate_reg[1] << 24;
+		trcg_nominal_rate |= nominal_rate_reg[2] << 16;
+		trcg_nominal_rate |= nominal_rate_reg[3] << 8;
+		trcg_nominal_rate |= nominal_rate_reg[4];
+
+		trl_ctl_val >>= 1;
+		trcg_nominal_rate >>= 1;
+
+		if (diff_upper == 1)
+			num =
+			    (int)((trl_ctl_val + 0x80000000u) -
+				  trcg_nominal_rate);
+		else if (diff_upper == -1)
+			num =
+			    -(int)((trcg_nominal_rate + 0x80000000u) -
+				   trl_ctl_val);
+		else
+			num = (int)(trl_ctl_val - trcg_nominal_rate);
+
+		den = (nominal_rate_reg[0] & 0x7F) << 24;
+		den |= nominal_rate_reg[1] << 16;
+		den |= nominal_rate_reg[2] << 8;
+		den |= nominal_rate_reg[3];
+		den = (den + (390625 / 2)) / 390625;
+
+		den >>= 1;
+
+		if (num >= 0)
+			*ppm = (num + (den / 2)) / den;
+		else
+			*ppm = (num - (den / 2)) / den;
+	}
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_sampling_offset_sub(struct
+							     cxd2880_tnrdmd
+							     *tnr_dmd, int *ppm)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!ppm))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret = cxd2880_tnrdmd_dvbt_mon_sampling_offset(tnr_dmd->diver_sub, ppm);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_quality(struct cxd2880_tnrdmd *tnr_dmd,
+						 u8 *quality)
+{
+	struct cxd2880_dvbt_tpsinfo tps;
+	enum cxd2880_dvbt_profile profile = CXD2880_DVBT_PROFILE_HP;
+	u32 ber = 0;
+	int sn = 0;
+	int sn_rel = 0;
+	int ber_sqi = 0;
+
+	static const int nordig_non_hdvbt_db_1000[3][5] = {
+		{5100, 6900, 7900, 8900, 9700},
+		{10800, 13100, 14600, 15600, 16000},
+		{16500, 18700, 20200, 21600, 22500}
+	};
+
+	static const int nordig_hier_hp_dvbt_db_1000[3][2][5] = {
+		{
+		 {9100, 12000, 13600, 15000, 16600},
+		 {10900, 14100, 15700, 19400, 20600}
+		 },
+		{
+		 {6800, 9100, 10400, 11900, 12700},
+		 {8500, 11000, 12800, 15000, 16000}
+		 },
+		{
+		 {5800, 7900, 9100, 10300, 12100},
+		 {8000, 9300, 11600, 13000, 12900}
+		}
+	};
+
+	static const int nordig_hier_lp_dvbt_db_1000[3][2][5] = {
+		{
+		 {12500, 14300, 15300, 16300, 16900},
+		 {16700, 19100, 20900, 22500, 23700}
+		 },
+		{
+		 {15000, 17200, 18400, 19100, 20100},
+		 {18500, 21200, 23600, 24700, 25900}
+		 },
+		{
+		 {19500, 21400, 22500, 23700, 24700},
+		 {21900, 24200, 25600, 26900, 27800}
+		}
+	};
+
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!quality))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret = cxd2880_tnrdmd_dvbt_mon_tps_info(tnr_dmd, &tps);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (tps.hierarchy != CXD2880_DVBT_HIERARCHY_NON) {
+		u8 data = 0;
+
+		if (tnr_dmd->io->write_reg(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x00,
+					   0x10) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_DMD, 0x67, &data,
+					   1) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		profile =
+		    ((data & 0x01) ==
+		     0x01) ? CXD2880_DVBT_PROFILE_LP : CXD2880_DVBT_PROFILE_HP;
+	}
+
+	ret = cxd2880_tnrdmd_dvbt_mon_pre_rsber(tnr_dmd, &ber);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret = cxd2880_tnrdmd_dvbt_mon_snr(tnr_dmd, &sn);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if ((tps.constellation >= CXD2880_DVBT_CONSTELLATION_RESERVED_3) ||
+	    (tps.rate_hp >= CXD2880_DVBT_CODERATE_RESERVED_5) ||
+	    (tps.rate_lp >= CXD2880_DVBT_CODERATE_RESERVED_5) ||
+	    (tps.hierarchy > CXD2880_DVBT_HIERARCHY_4)) {
+		return CXD2880_RESULT_ERROR_OTHER;
+	}
+
+	if ((tps.hierarchy != CXD2880_DVBT_HIERARCHY_NON) &&
+	    (tps.constellation == CXD2880_DVBT_CONSTELLATION_QPSK))
+		return CXD2880_RESULT_ERROR_OTHER;
+
+	if (tps.hierarchy == CXD2880_DVBT_HIERARCHY_NON)
+		sn_rel =
+		    sn -
+		    nordig_non_hdvbt_db_1000[tps.constellation][tps.rate_hp];
+	else if (profile == CXD2880_DVBT_PROFILE_LP)
+		sn_rel =
+		    sn - nordig_hier_lp_dvbt_db_1000[(int)tps.hierarchy -
+						     1][(int)tps.constellation -
+							1][tps.rate_lp];
+	else
+		sn_rel =
+		    sn - nordig_hier_hp_dvbt_db_1000[(int)tps.hierarchy -
+						     1][(int)tps.constellation -
+							1][tps.rate_hp];
+
+	if (ber > 10000) {
+		ber_sqi = 0;
+	} else if (ber > 1) {
+		ber_sqi = (int)(10 * cxd2880_math_log10(ber));
+		ber_sqi = 20 * (7 * 1000 - (ber_sqi)) - 40 * 1000;
+	} else {
+		ber_sqi = 100 * 1000;
+	}
+
+	if (sn_rel < -7 * 1000) {
+		*quality = 0;
+	} else if (sn_rel < 3 * 1000) {
+		int tmp_sqi = (((sn_rel - (3 * 1000)) / 10) + 1000);
+		*quality =
+		    (u8)(((tmp_sqi * ber_sqi) +
+			   (1000000 / 2)) / (1000000)) & 0xFF;
+	} else {
+		*quality = (u8)((ber_sqi + 500) / 1000);
+	}
+
+	if (*quality > 100)
+		*quality = 100;
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_per(struct cxd2880_tnrdmd *tnr_dmd,
+					     u32 *per)
+{
+	u32 packet_error = 0;
+	u32 period = 0;
+	u8 rdata[3];
+
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!per))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0D) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x18, rdata,
+				   3) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if ((rdata[0] & 0x01) == 0)
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	packet_error = (rdata[1] << 8) | rdata[2];
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x5C, rdata,
+				   1) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	period = 1U << (rdata[0] & 0x0F);
+
+	if ((period == 0) || (packet_error > period))
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	{
+		u32 div = 0;
+		u32 Q = 0;
+		u32 R = 0;
+
+		div = period;
+
+		Q = (packet_error * 1000) / div;
+		R = (packet_error * 1000) % div;
+
+		R *= 1000;
+		Q = Q * 1000 + R / div;
+		R = R % div;
+
+		if ((div != 1) && (div / 2 <= R))
+			*per = Q + 1;
+		else
+			*per = Q;
+	}
+
+	return ret;
+}
+
+static enum cxd2880_ret dvbt_calc_ssi(struct cxd2880_tnrdmd *tnr_dmd,
+				      int rf_lvl, u8 *ssi)
+{
+	struct cxd2880_dvbt_tpsinfo tps;
+	int prel;
+	int temp_ssi = 0;
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	static const int ref_dbm_1000[3][5] = {
+		{-93000, -91000, -90000, -89000, -88000},
+		{-87000, -85000, -84000, -83000, -82000},
+		{-82000, -80000, -78000, -77000, -76000},
+	};
+
+	if ((!tnr_dmd) || (!ssi))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret = cxd2880_tnrdmd_dvbt_mon_tps_info(tnr_dmd, &tps);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if ((tps.constellation >= CXD2880_DVBT_CONSTELLATION_RESERVED_3) ||
+	    (tps.rate_hp >= CXD2880_DVBT_CODERATE_RESERVED_5))
+		return CXD2880_RESULT_ERROR_OTHER;
+
+	prel = rf_lvl - ref_dbm_1000[tps.constellation][tps.rate_hp];
+
+	if (prel < -15000)
+		temp_ssi = 0;
+	else if (prel < 0)
+		temp_ssi = ((2 * (prel + 15000)) + 1500) / 3000;
+	else if (prel < 20000)
+		temp_ssi = (((4 * prel) + 500) / 1000) + 10;
+	else if (prel < 35000)
+		temp_ssi = (((2 * (prel - 20000)) + 1500) / 3000) + 90;
+	else
+		temp_ssi = 100;
+
+	*ssi = (temp_ssi > 100) ? 100 : (u8)temp_ssi;
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_ssi(struct cxd2880_tnrdmd *tnr_dmd,
+					     u8 *ssi)
+{
+	int rf_lvl = 0;
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!ssi))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret = cxd2880_tnrdmd_mon_rf_lvl(tnr_dmd, &rf_lvl);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret = dvbt_calc_ssi(tnr_dmd, rf_lvl, ssi);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_ssi_sub(struct cxd2880_tnrdmd *tnr_dmd,
+						 u8 *ssi)
+{
+	int rf_lvl = 0;
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!ssi))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->sys != CXD2880_DTV_SYS_DVBT)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	ret = cxd2880_tnrdmd_mon_rf_lvl(tnr_dmd->diver_sub, &rf_lvl);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	ret = dvbt_calc_ssi(tnr_dmd, rf_lvl, ssi);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	return ret;
+}
+
+static enum cxd2880_ret is_tps_locked(struct cxd2880_tnrdmd *tnr_dmd)
+{
+	u8 sync = 0;
+	u8 tslock = 0;
+	u8 early_unlock = 0;
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if (!tnr_dmd)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret =
+	    cxd2880_tnrdmd_dvbt_mon_sync_stat(tnr_dmd, &sync, &tslock,
+					      &early_unlock);
+	if (ret != CXD2880_RESULT_OK)
+		return ret;
+
+	if (sync != 6)
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	return CXD2880_RESULT_OK;
+}
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt_mon.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt_mon.h
new file mode 100644
index 000000000000..486fc466272e
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt_mon.h
@@ -0,0 +1,106 @@
+/*
+ * cxd2880_tnrdmd_dvbt_mon.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * DVB-T monitor interface
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_TNRDMD_DVBT_MON_H
+#define CXD2880_TNRDMD_DVBT_MON_H
+
+#include "cxd2880_tnrdmd.h"
+#include "cxd2880_dvbt.h"
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_sync_stat(struct cxd2880_tnrdmd
+						   *tnr_dmd, u8 *sync_stat,
+						   u8 *ts_lock_stat,
+						   u8 *unlock_detected);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_sync_stat_sub(struct cxd2880_tnrdmd
+						       *tnr_dmd, u8 *sync_stat,
+						       u8 *unlock_detected);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_mode_guard(struct cxd2880_tnrdmd
+						    *tnr_dmd,
+						    enum cxd2880_dvbt_mode
+						    *mode,
+						    enum cxd2880_dvbt_guard
+						    *guard);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_carrier_offset(struct cxd2880_tnrdmd
+							*tnr_dmd, int *offset);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_carrier_offset_sub(struct
+							    cxd2880_tnrdmd
+							    *tnr_dmd,
+							    int *offset);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_pre_viterbiber(struct cxd2880_tnrdmd
+							*tnr_dmd, u32 *ber);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_pre_rsber(struct cxd2880_tnrdmd
+						   *tnr_dmd, u32 *ber);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_tps_info(struct cxd2880_tnrdmd
+						  *tnr_dmd,
+						  struct cxd2880_dvbt_tpsinfo
+						  *info);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_packet_error_number(struct
+							     cxd2880_tnrdmd
+							     *tnr_dmd,
+							     u32 *pen);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_spectrum_sense(struct cxd2880_tnrdmd
+						*tnr_dmd,
+						enum
+						cxd2880_tnrdmd_spectrum_sense
+						*sense);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_snr(struct cxd2880_tnrdmd *tnr_dmd,
+					     int *snr);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_snr_diver(struct cxd2880_tnrdmd
+						   *tnr_dmd, int *snr,
+						   int *snr_main, int *snr_sub);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_sampling_offset(struct cxd2880_tnrdmd
+							 *tnr_dmd, int *ppm);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_sampling_offset_sub(struct
+							     cxd2880_tnrdmd
+							     *tnr_dmd,
+							     int *ppm);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_quality(struct cxd2880_tnrdmd *tnr_dmd,
+						 u8 *quality);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_per(struct cxd2880_tnrdmd *tnr_dmd,
+					     u32 *per);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_ssi(struct cxd2880_tnrdmd *tnr_dmd,
+					     u8 *ssi);
+
+enum cxd2880_ret cxd2880_tnrdmd_dvbt_mon_ssi_sub(struct cxd2880_tnrdmd *tnr_dmd,
+						 u8 *ssi);
+
+#endif
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_mon.c b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_mon.c
new file mode 100644
index 000000000000..0ac5b9bf3be8
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_mon.c
@@ -0,0 +1,207 @@
+/*
+ * cxd2880_tnrdmd_mon.c
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * common monitor functions
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "cxd2880_common.h"
+#include "cxd2880_tnrdmd_mon.h"
+
+enum cxd2880_ret cxd2880_tnrdmd_mon_rf_lvl(struct cxd2880_tnrdmd *tnr_dmd,
+					   int *rf_lvl_db)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!rf_lvl_db))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x10,
+				   0x01) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	{
+		u8 data[2] = { 0x80, 0x00 };
+
+		if (tnr_dmd->io->write_regs(tnr_dmd->io,
+					    CXD2880_IO_TGT_SYS, 0x5B, data,
+					    2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+	}
+
+	CXD2880_SLEEP_IN_MON(2, tnr_dmd);
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x1A) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	{
+		u8 data[2];
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x15, data,
+					   2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if ((data[0] != 0) || (data[1] != 0))
+			return CXD2880_RESULT_ERROR_OTHER;
+
+		if (tnr_dmd->io->read_regs(tnr_dmd->io,
+					   CXD2880_IO_TGT_SYS, 0x11, data,
+					   2) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		*rf_lvl_db =
+		    cxd2880_convert2s_complement((data[0] << 3) |
+						 ((data[1] & 0xE0) >> 5), 11);
+	}
+
+	*rf_lvl_db *= 125;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x10,
+				   0x00) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnr_dmd->rf_lvl_cmpstn) {
+		ret = tnr_dmd->rf_lvl_cmpstn(tnr_dmd, rf_lvl_db);
+		if (ret != CXD2880_RESULT_OK)
+			return ret;
+	}
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_mon_rf_lvl_sub(struct cxd2880_tnrdmd *tnr_dmd,
+					       int *rf_lvl_db)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!rf_lvl_db))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret = cxd2880_tnrdmd_mon_rf_lvl(tnr_dmd->diver_sub, rf_lvl_db);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_mon_internal_cpu_status(struct cxd2880_tnrdmd
+							*tnr_dmd, u16 *status)
+{
+	u8 data[2] = { 0 };
+
+	if ((!tnr_dmd) || (!status))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x00,
+				   0x1A) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_SYS, 0x15, data,
+				   2) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	*status = (u16)(((u16)data[0] << 8) | data[1]);
+
+	return CXD2880_RESULT_OK;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_mon_internal_cpu_status_sub(struct
+							    cxd2880_tnrdmd
+							    *tnr_dmd,
+							    u16 *status)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!status))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode != CXD2880_TNRDMD_DIVERMODE_MAIN)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	ret =
+	    cxd2880_tnrdmd_mon_internal_cpu_status(tnr_dmd->diver_sub, status);
+
+	return ret;
+}
+
+enum cxd2880_ret cxd2880_tnrdmd_mon_ts_buf_info(struct cxd2880_tnrdmd *tnr_dmd,
+						struct
+						cxd2880_tnrdmd_ts_buf_info
+						*info)
+{
+	u8 data[3] = { 0 };
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+
+	if ((!tnr_dmd) || (!info))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnr_dmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if ((tnr_dmd->state != CXD2880_TNRDMD_STATE_SLEEP) &&
+	    (tnr_dmd->state != CXD2880_TNRDMD_STATE_ACTIVE))
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnr_dmd->io->write_reg(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x00,
+				   0x0A) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+	if (tnr_dmd->io->read_regs(tnr_dmd->io,
+				   CXD2880_IO_TGT_DMD, 0x50, data,
+				   3) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	info->read_ready = (u8)((data[0] & 0x10) ? 0x01 : 0x00);
+	info->almost_full = (u8)((data[0] & 0x08) ? 0x01 : 0x00);
+	info->almost_empty = (u8)((data[0] & 0x04) ? 0x01 : 0x00);
+	info->overflow = (u8)((data[0] & 0x02) ? 0x01 : 0x00);
+	info->underflow = (u8)((data[0] & 0x01) ? 0x01 : 0x00);
+
+	info->packet_num = (u16)(((u32)(data[1] & 0x07) << 8) | data[2]);
+
+	return ret;
+}
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_mon.h b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_mon.h
new file mode 100644
index 000000000000..506bd559668f
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_mon.h
@@ -0,0 +1,52 @@
+/*
+ * cxd2880_tnrdmd_mon.h
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * common monitor interface
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CXD2880_TNRDMD_MON_H
+#define CXD2880_TNRDMD_MON_H
+
+#include "cxd2880_common.h"
+#include "cxd2880_tnrdmd.h"
+
+enum cxd2880_ret cxd2880_tnrdmd_mon_rf_lvl(struct cxd2880_tnrdmd *tnr_dmd,
+					   int *rf_lvl_db);
+
+enum cxd2880_ret cxd2880_tnrdmd_mon_rf_lvl_sub(struct cxd2880_tnrdmd *tnr_dmd,
+					       int *rf_lvl_db);
+
+enum cxd2880_ret cxd2880_tnrdmd_mon_internal_cpu_status(struct cxd2880_tnrdmd
+							*tnr_dmd, u16 *status);
+
+enum cxd2880_ret cxd2880_tnrdmd_mon_internal_cpu_status_sub(struct
+							    cxd2880_tnrdmd
+							    *tnr_dmd,
+							    u16 *status);
+
+enum cxd2880_ret cxd2880_tnrdmd_mon_ts_buf_info(struct cxd2880_tnrdmd *tnr_dmd,
+						struct
+						cxd2880_tnrdmd_ts_buf_info
+						*info);
+
+#endif
diff --git a/drivers/media/dvb-frontends/cxd2880/cxd2880_top.c b/drivers/media/dvb-frontends/cxd2880/cxd2880_top.c
new file mode 100644
index 000000000000..66d78fb93a13
--- /dev/null
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_top.c
@@ -0,0 +1,1550 @@
+/*
+ * cxd2880_top.c
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/spi/spi.h>
+
+#include "dvb_frontend.h"
+
+#include "cxd2880.h"
+#include "cxd2880_tnrdmd_mon.h"
+#include "cxd2880_tnrdmd_dvbt2_mon.h"
+#include "cxd2880_tnrdmd_dvbt_mon.h"
+#include "cxd2880_integ_dvbt2.h"
+#include "cxd2880_integ_dvbt.h"
+#include "cxd2880_devio_spi.h"
+#include "cxd2880_spi_device.h"
+#include "cxd2880_tnrdmd_driver_version.h"
+
+struct cxd2880_priv {
+	struct cxd2880_tnrdmd tnrdmd;
+	struct spi_device *spi;
+	struct cxd2880_io regio;
+	struct cxd2880_spi_device spi_device;
+	struct cxd2880_spi cxd2880_spi;
+	struct cxd2880_dvbt_tune_param dvbt_tune_param;
+	struct cxd2880_dvbt2_tune_param dvbt2_tune_param;
+	struct mutex *spi_mutex; /* For SPI access exclusive control */
+};
+
+/*
+ * return value conversion table
+ */
+static int return_tbl[] = {
+	0,             /* CXD2880_RESULT_OK */
+	-EINVAL,       /* CXD2880_RESULT_ERROR_ARG*/
+	-EIO,          /* CXD2880_RESULT_ERROR_IO */
+	-EPERM,        /* CXD2880_RESULT_ERROR_SW_STATE */
+	-EBUSY,        /* CXD2880_RESULT_ERROR_HW_STATE */
+	-ETIME,        /* CXD2880_RESULT_ERROR_TIMEOUT */
+	-EAGAIN,       /* CXD2880_RESULT_ERROR_UNLOCK */
+	-ERANGE,       /* CXD2880_RESULT_ERROR_RANGE */
+	-EOPNOTSUPP,   /* CXD2880_RESULT_ERROR_NOSUPPORT */
+	-ECANCELED,    /* CXD2880_RESULT_ERROR_CANCEL */
+	-EPERM,        /* CXD2880_RESULT_ERROR_OTHER */
+	-EOVERFLOW,    /* CXD2880_RESULT_ERROR_OVERFLOW */
+	0,             /* CXD2880_RESULT_OK_CONFIRM */
+};
+
+static enum cxd2880_ret cxd2880_pre_bit_err_t(
+		struct cxd2880_tnrdmd *tnrdmd, u32 *pre_bit_err,
+		u32 *pre_bit_count)
+{
+	u8 rdata[2];
+
+	if ((!tnrdmd) || (!pre_bit_err) || (!pre_bit_count))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnrdmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnrdmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnrdmd->sys != CXD2880_DTV_SYS_DVBT)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (slvt_freeze_reg(tnrdmd) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnrdmd->io->write_reg(tnrdmd->io, CXD2880_IO_TGT_DMD,
+				0x00, 0x10) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnrdmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnrdmd->io->read_regs(tnrdmd->io, CXD2880_IO_TGT_DMD,
+				0x39, rdata, 1) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnrdmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if ((rdata[0] & 0x01) == 0) {
+		slvt_unfreeze_reg(tnrdmd);
+		return CXD2880_RESULT_ERROR_HW_STATE;
+	}
+
+	if (tnrdmd->io->read_regs(tnrdmd->io, CXD2880_IO_TGT_DMD,
+				0x22, rdata, 2) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnrdmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	*pre_bit_err = (rdata[0] << 8) | rdata[1];
+
+	if (tnrdmd->io->read_regs(tnrdmd->io, CXD2880_IO_TGT_DMD,
+				0x6F, rdata, 1) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnrdmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	slvt_unfreeze_reg(tnrdmd);
+
+	*pre_bit_count = ((rdata[0] & 0x07) == 0) ?
+			256 : (0x1000 << (rdata[0] & 0x07));
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret cxd2880_pre_bit_err_t2(
+		struct cxd2880_tnrdmd *tnrdmd, u32 *pre_bit_err,
+		u32 *pre_bit_count)
+{
+	u32 period_exp = 0;
+	u32 n_ldpc = 0;
+	u8 data[5];
+
+	if ((!tnrdmd) || (!pre_bit_err) || (!pre_bit_count))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnrdmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnrdmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnrdmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (slvt_freeze_reg(tnrdmd) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnrdmd->io->write_reg(tnrdmd->io, CXD2880_IO_TGT_DMD,
+				0x00, 0x0B) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnrdmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (tnrdmd->io->read_regs(tnrdmd->io, CXD2880_IO_TGT_DMD,
+				0x3C, data, sizeof(data))
+				 != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnrdmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (!(data[0] & 0x01)) {
+		slvt_unfreeze_reg(tnrdmd);
+		return CXD2880_RESULT_ERROR_HW_STATE;
+	}
+	*pre_bit_err =
+	((data[1] & 0x0F) << 24) | (data[2] << 16) | (data[3] << 8) | data[4];
+
+	if (tnrdmd->io->read_regs(tnrdmd->io, CXD2880_IO_TGT_DMD,
+				0xA0, data, 1) != CXD2880_RESULT_OK) {
+		slvt_unfreeze_reg(tnrdmd);
+		return CXD2880_RESULT_ERROR_IO;
+	}
+
+	if (((enum cxd2880_dvbt2_plp_fec)(data[0] & 0x03)) ==
+	    CXD2880_DVBT2_FEC_LDPC_16K)
+		n_ldpc = 16200;
+	else
+		n_ldpc = 64800;
+	slvt_unfreeze_reg(tnrdmd);
+
+	if (tnrdmd->io->write_reg(tnrdmd->io, CXD2880_IO_TGT_DMD,
+				0x00, 0x20) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnrdmd->io->read_regs(tnrdmd->io, CXD2880_IO_TGT_DMD,
+				0x6F, data, 1) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	period_exp = data[0] & 0x0F;
+
+	*pre_bit_count = (1U << period_exp) * n_ldpc;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret cxd2880_post_bit_err_t(struct cxd2880_tnrdmd *tnrdmd,
+						u32 *post_bit_err,
+						u32 *post_bit_count)
+{
+	u8 rdata[3];
+	u32 bit_error = 0;
+	u32 period_exp = 0;
+
+	if ((!tnrdmd) || (!post_bit_err) || (!post_bit_count))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnrdmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnrdmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnrdmd->sys != CXD2880_DTV_SYS_DVBT)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnrdmd->io->write_reg(tnrdmd->io, CXD2880_IO_TGT_DMD,
+				0x00, 0x0D) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnrdmd->io->read_regs(tnrdmd->io, CXD2880_IO_TGT_DMD,
+				0x15, rdata, 3) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if ((rdata[0] & 0x40) == 0)
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	*post_bit_err = ((rdata[0] & 0x3F) << 16) | (rdata[1] << 8) | rdata[2];
+
+	if (tnrdmd->io->write_reg(tnrdmd->io, CXD2880_IO_TGT_DMD,
+				0x00, 0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnrdmd->io->read_regs(tnrdmd->io, CXD2880_IO_TGT_DMD,
+				0x60, rdata, 1) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	period_exp = (rdata[0] & 0x1F);
+
+	if ((period_exp <= 11) && (bit_error > (1U << period_exp) * 204 * 8))
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	if (period_exp == 11)
+		*post_bit_count = 3342336;
+	else
+		*post_bit_count = (1U << period_exp) * 204 * 81;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret cxd2880_post_bit_err_t2(struct cxd2880_tnrdmd *tnrdmd,
+						u32 *post_bit_err,
+						u32 *post_bit_count)
+{
+	u32 period_exp = 0;
+	u32 n_bch = 0;
+
+	if ((!tnrdmd) || (!post_bit_err) || (!post_bit_count))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnrdmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnrdmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnrdmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	{
+		u8 data[3];
+		enum cxd2880_dvbt2_plp_fec plp_fec_type =
+			CXD2880_DVBT2_FEC_LDPC_16K;
+		enum cxd2880_dvbt2_plp_code_rate plp_code_rate =
+			CXD2880_DVBT2_R1_2;
+
+		static const u16 n_bch_bits_lookup[2][8] = {
+			{7200, 9720, 10800, 11880, 12600, 13320, 5400, 6480},
+			{32400, 38880, 43200, 48600, 51840, 54000, 21600, 25920}
+		};
+
+		if (slvt_freeze_reg(tnrdmd) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnrdmd->io->write_reg(tnrdmd->io, CXD2880_IO_TGT_DMD,
+					0x00, 0x0B) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnrdmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (tnrdmd->io->read_regs(tnrdmd->io, CXD2880_IO_TGT_DMD,
+					 0x15, data, 3) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnrdmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		if (!(data[0] & 0x40)) {
+			slvt_unfreeze_reg(tnrdmd);
+			return CXD2880_RESULT_ERROR_HW_STATE;
+		}
+
+		*post_bit_err =
+			((data[0] & 0x3F) << 16) | (data[1] << 8) | data[2];
+
+		if (tnrdmd->io->read_regs(tnrdmd->io, CXD2880_IO_TGT_DMD,
+					0x9D, data, 1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnrdmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		plp_code_rate =
+		(enum cxd2880_dvbt2_plp_code_rate)(data[0] & 0x07);
+
+		if (tnrdmd->io->read_regs(tnrdmd->io, CXD2880_IO_TGT_DMD,
+					0xA0, data, 1) != CXD2880_RESULT_OK) {
+			slvt_unfreeze_reg(tnrdmd);
+			return CXD2880_RESULT_ERROR_IO;
+		}
+
+		plp_fec_type = (enum cxd2880_dvbt2_plp_fec)(data[0] & 0x03);
+
+		slvt_unfreeze_reg(tnrdmd);
+
+		if (tnrdmd->io->write_reg(tnrdmd->io, CXD2880_IO_TGT_DMD,
+					0x00, 0x20) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnrdmd->io->read_regs(tnrdmd->io, CXD2880_IO_TGT_DMD,
+					0x72, data, 1) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		period_exp = data[0] & 0x0F;
+
+		if ((plp_fec_type > CXD2880_DVBT2_FEC_LDPC_64K) ||
+			(plp_code_rate > CXD2880_DVBT2_R2_5))
+			return CXD2880_RESULT_ERROR_HW_STATE;
+
+		n_bch = n_bch_bits_lookup[plp_fec_type][plp_code_rate];
+	}
+
+	if (*post_bit_err > ((1U << period_exp) * n_bch))
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	*post_bit_count = (1U << period_exp) * n_bch;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret cxd2880_read_block_err_t(
+					struct cxd2880_tnrdmd *tnrdmd,
+					u32 *block_err,
+					u32 *block_count)
+{
+	u8 rdata[3];
+
+	if ((!tnrdmd) || (!block_err) || (!block_count))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnrdmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnrdmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnrdmd->sys != CXD2880_DTV_SYS_DVBT)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	if (tnrdmd->io->write_reg(tnrdmd->io, CXD2880_IO_TGT_DMD,
+				0x00, 0x0D) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnrdmd->io->read_regs(tnrdmd->io, CXD2880_IO_TGT_DMD,
+				0x18, rdata, 3) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if ((rdata[0] & 0x01) == 0)
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	*block_err = (rdata[1] << 8) | rdata[2];
+
+	if (tnrdmd->io->write_reg(tnrdmd->io, CXD2880_IO_TGT_DMD,
+				0x00, 0x10) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	if (tnrdmd->io->read_regs(tnrdmd->io, CXD2880_IO_TGT_DMD,
+				0x5C, rdata, 1) != CXD2880_RESULT_OK)
+		return CXD2880_RESULT_ERROR_IO;
+
+	*block_count = 1U << (rdata[0] & 0x0F);
+
+	if ((*block_count == 0) || (*block_err > *block_count))
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	return CXD2880_RESULT_OK;
+}
+
+static enum cxd2880_ret cxd2880_read_block_err_t2(
+					struct cxd2880_tnrdmd *tnrdmd,
+					u32 *block_err,
+					u32 *block_count)
+{
+	if ((!tnrdmd) || (!block_err) || (!block_count))
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnrdmd->diver_mode == CXD2880_TNRDMD_DIVERMODE_SUB)
+		return CXD2880_RESULT_ERROR_ARG;
+
+	if (tnrdmd->state != CXD2880_TNRDMD_STATE_ACTIVE)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+	if (tnrdmd->sys != CXD2880_DTV_SYS_DVBT2)
+		return CXD2880_RESULT_ERROR_SW_STATE;
+
+	{
+		u8 rdata[3];
+
+		if (tnrdmd->io->write_reg(tnrdmd->io, CXD2880_IO_TGT_DMD,
+					0x00, 0x0B) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnrdmd->io->read_regs(tnrdmd->io, CXD2880_IO_TGT_DMD,
+					0x18, rdata, 3) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if ((rdata[0] & 0x01) == 0)
+			return CXD2880_RESULT_ERROR_HW_STATE;
+
+		*block_err = (rdata[1] << 8) | rdata[2];
+
+		if (tnrdmd->io->write_reg(tnrdmd->io, CXD2880_IO_TGT_DMD,
+					0x00, 0x24) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		if (tnrdmd->io->read_regs(tnrdmd->io, CXD2880_IO_TGT_DMD,
+					0xDC, rdata, 1) != CXD2880_RESULT_OK)
+			return CXD2880_RESULT_ERROR_IO;
+
+		*block_count = 1U << (rdata[0] & 0x0F);
+	}
+
+	if ((*block_count == 0) || (*block_err > *block_count))
+		return CXD2880_RESULT_ERROR_HW_STATE;
+
+	return CXD2880_RESULT_OK;
+}
+
+static void cxd2880_release(struct dvb_frontend *fe)
+{
+	struct cxd2880_priv *priv = NULL;
+
+	if (!fe) {
+		pr_err("%s: invalid arg.\n", __func__);
+		return;
+	}
+	priv = (struct cxd2880_priv *)fe->demodulator_priv;
+	kfree(priv);
+}
+
+static int cxd2880_init(struct dvb_frontend *fe)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	struct cxd2880_priv *priv = NULL;
+	struct cxd2880_tnrdmd_create_param create_param;
+
+	if (!fe) {
+		pr_err("%s: invalid arg.\n", __func__);
+		return -EINVAL;
+	}
+
+	priv = (struct cxd2880_priv *)fe->demodulator_priv;
+
+	create_param.ts_output_if = CXD2880_TNRDMD_TSOUT_IF_SPI;
+	create_param.xtal_share_type = CXD2880_TNRDMD_XTAL_SHARE_NONE;
+	create_param.en_internal_ldo = 1;
+	create_param.xosc_cap = 18;
+	create_param.xosc_i = 8;
+	create_param.stationary_use = 1;
+
+	mutex_lock(priv->spi_mutex);
+	if (priv->tnrdmd.io != &priv->regio) {
+		ret = cxd2880_tnrdmd_create(&priv->tnrdmd,
+				&priv->regio, &create_param);
+		if (ret != CXD2880_RESULT_OK) {
+			mutex_unlock(priv->spi_mutex);
+			dev_info(&priv->spi->dev,
+				"%s: cxd2880 tnrdmd create failed %d\n",
+				__func__, ret);
+			return return_tbl[ret];
+		}
+	}
+	ret = cxd2880_integ_init(&priv->tnrdmd);
+	if (ret != CXD2880_RESULT_OK) {
+		mutex_unlock(priv->spi_mutex);
+		dev_err(&priv->spi->dev, "%s: cxd2880 integ init failed %d\n",
+				__func__, ret);
+		return return_tbl[ret];
+	}
+	mutex_unlock(priv->spi_mutex);
+
+	dev_dbg(&priv->spi->dev, "%s: OK.\n", __func__);
+
+	return return_tbl[ret];
+}
+
+static int cxd2880_sleep(struct dvb_frontend *fe)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	struct cxd2880_priv *priv = NULL;
+
+	if (!fe) {
+		pr_err("%s: inavlid arg\n", __func__);
+		return -EINVAL;
+	}
+
+	priv = (struct cxd2880_priv *)fe->demodulator_priv;
+
+	mutex_lock(priv->spi_mutex);
+	ret = cxd2880_tnrdmd_sleep(&priv->tnrdmd);
+	mutex_unlock(priv->spi_mutex);
+
+	dev_dbg(&priv->spi->dev, "%s: tnrdmd_sleep ret %d\n",
+		__func__, ret);
+
+	return return_tbl[ret];
+}
+
+static int cxd2880_read_signal_strength(struct dvb_frontend *fe,
+				u16 *strength)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	struct cxd2880_priv *priv = NULL;
+	struct dtv_frontend_properties *c = NULL;
+	int level = 0;
+
+	if ((!fe) || (!strength)) {
+		pr_err("%s: inavlid arg\n", __func__);
+		return -EINVAL;
+	}
+
+	priv = (struct cxd2880_priv *)fe->demodulator_priv;
+	c = &fe->dtv_property_cache;
+
+	mutex_lock(priv->spi_mutex);
+	if ((c->delivery_system == SYS_DVBT) ||
+		(c->delivery_system == SYS_DVBT2)) {
+		ret = cxd2880_tnrdmd_mon_rf_lvl(&priv->tnrdmd, &level);
+	} else {
+		dev_dbg(&priv->spi->dev, "%s: invalid system\n", __func__);
+		mutex_unlock(priv->spi_mutex);
+		return -EINVAL;
+	}
+	mutex_unlock(priv->spi_mutex);
+
+	level /= 125;
+	/* -105dBm - -30dBm (-105000/125 = -840, -30000/125 = -240 */
+	level = clamp(level, -840, -240);
+	/* scale value to 0x0000-0xFFFF */
+	*strength = (u16)(((level + 840) * 0xFFFF) / (-240 + 840));
+
+	if (ret != CXD2880_RESULT_OK)
+		dev_dbg(&priv->spi->dev, "%s: ret = %d\n", __func__, ret);
+
+	return return_tbl[ret];
+}
+
+static int cxd2880_read_snr(struct dvb_frontend *fe, u16 *snr)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	int snrvalue = 0;
+	struct cxd2880_priv *priv = NULL;
+	struct dtv_frontend_properties *c = NULL;
+
+	if ((!fe) || (!snr)) {
+		pr_err("%s: inavlid arg\n", __func__);
+		return -EINVAL;
+	}
+
+	priv = (struct cxd2880_priv *)fe->demodulator_priv;
+	c = &fe->dtv_property_cache;
+
+	mutex_lock(priv->spi_mutex);
+	if (c->delivery_system == SYS_DVBT) {
+		ret = cxd2880_tnrdmd_dvbt_mon_snr(&priv->tnrdmd,
+						&snrvalue);
+	} else if (c->delivery_system == SYS_DVBT2) {
+		ret = cxd2880_tnrdmd_dvbt2_mon_snr(&priv->tnrdmd,
+						&snrvalue);
+	} else {
+		dev_err(&priv->spi->dev, "%s: invalid system\n", __func__);
+		mutex_unlock(priv->spi_mutex);
+		return -EINVAL;
+	}
+	mutex_unlock(priv->spi_mutex);
+
+	if (snrvalue < 0)
+		snrvalue = 0;
+	*snr = (u16)snrvalue;
+
+	if (ret != CXD2880_RESULT_OK)
+		dev_dbg(&priv->spi->dev, "%s: ret = %d\n", __func__, ret);
+
+	return return_tbl[ret];
+}
+
+static int cxd2880_read_ucblocks(struct dvb_frontend *fe, u32 *ucblocks)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	struct cxd2880_priv *priv = NULL;
+	struct dtv_frontend_properties *c = NULL;
+
+	if ((!fe) || (!ucblocks)) {
+		pr_err("%s: inavlid arg\n", __func__);
+		return -EINVAL;
+	}
+
+	priv = (struct cxd2880_priv *)fe->demodulator_priv;
+	c = &fe->dtv_property_cache;
+
+	mutex_lock(priv->spi_mutex);
+	if (c->delivery_system == SYS_DVBT) {
+		ret = cxd2880_tnrdmd_dvbt_mon_packet_error_number(
+								&priv->tnrdmd,
+								ucblocks);
+	} else if (c->delivery_system == SYS_DVBT2) {
+		ret = cxd2880_tnrdmd_dvbt2_mon_packet_error_number(
+								&priv->tnrdmd,
+								ucblocks);
+	} else {
+		dev_err(&priv->spi->dev, "%s: invlaid system\n", __func__);
+		mutex_unlock(priv->spi_mutex);
+		return -EINVAL;
+	}
+	mutex_unlock(priv->spi_mutex);
+
+	if (ret != CXD2880_RESULT_OK)
+		dev_dbg(&priv->spi->dev, "%s: ret = %d\n", __func__, ret);
+
+	return return_tbl[ret];
+}
+
+static int cxd2880_read_ber(struct dvb_frontend *fe, u32 *ber)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	struct cxd2880_priv *priv = NULL;
+	struct dtv_frontend_properties *c = NULL;
+
+	if ((!fe) || (!ber)) {
+		pr_err("%s: inavlid arg\n", __func__);
+		return -EINVAL;
+	}
+
+	priv = (struct cxd2880_priv *)fe->demodulator_priv;
+	c = &fe->dtv_property_cache;
+
+	mutex_lock(priv->spi_mutex);
+	if (c->delivery_system == SYS_DVBT) {
+		ret = cxd2880_tnrdmd_dvbt_mon_pre_rsber(&priv->tnrdmd,
+						ber);
+		/* x100 to change unit.(10^7 -> 10^9 */
+		*ber *= 100;
+	} else if (c->delivery_system == SYS_DVBT2) {
+		ret = cxd2880_tnrdmd_dvbt2_mon_pre_bchber(&priv->tnrdmd,
+						ber);
+	} else {
+		dev_err(&priv->spi->dev, "%s: invlaid system\n", __func__);
+		mutex_unlock(priv->spi_mutex);
+		return -EINVAL;
+	}
+	mutex_unlock(priv->spi_mutex);
+
+	if (ret != CXD2880_RESULT_OK)
+		dev_dbg(&priv->spi->dev, "%s: ret = %d\n", __func__, ret);
+
+	return return_tbl[ret];
+}
+
+static int cxd2880_set_frontend(struct dvb_frontend *fe)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	struct dtv_frontend_properties *c;
+	struct cxd2880_priv *priv;
+	enum cxd2880_dtv_bandwidth bw = CXD2880_DTV_BW_1_7_MHZ;
+
+	if (!fe) {
+		pr_err("%s: inavlid arg\n", __func__);
+		return -EINVAL;
+	}
+
+	priv = (struct cxd2880_priv *)fe->demodulator_priv;
+	c = &fe->dtv_property_cache;
+
+	switch (c->bandwidth_hz) {
+	case 1712000:
+		bw = CXD2880_DTV_BW_1_7_MHZ;
+		break;
+	case 5000000:
+		bw = CXD2880_DTV_BW_5_MHZ;
+		break;
+	case 6000000:
+		bw = CXD2880_DTV_BW_6_MHZ;
+		break;
+	case 7000000:
+		bw = CXD2880_DTV_BW_7_MHZ;
+		break;
+	case 8000000:
+		bw = CXD2880_DTV_BW_8_MHZ;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	dev_info(&priv->spi->dev, "%s: sys:%d freq:%d bw:%d\n", __func__,
+			c->delivery_system, c->frequency, bw);
+	mutex_lock(priv->spi_mutex);
+	if (c->delivery_system == SYS_DVBT) {
+		priv->tnrdmd.sys = CXD2880_DTV_SYS_DVBT;
+		priv->dvbt_tune_param.center_freq_khz = c->frequency / 1000;
+		priv->dvbt_tune_param.bandwidth = bw;
+		priv->dvbt_tune_param.profile = CXD2880_DVBT_PROFILE_HP;
+		ret = cxd2880_integ_dvbt_tune(&priv->tnrdmd,
+						&priv->dvbt_tune_param);
+	} else if (c->delivery_system == SYS_DVBT2) {
+		priv->tnrdmd.sys = CXD2880_DTV_SYS_DVBT2;
+		priv->dvbt2_tune_param.center_freq_khz = c->frequency / 1000;
+		priv->dvbt2_tune_param.bandwidth = bw;
+		priv->dvbt2_tune_param.data_plp_id = (u16)c->stream_id;
+		ret = cxd2880_integ_dvbt2_tune(&priv->tnrdmd,
+						&priv->dvbt2_tune_param);
+	} else {
+		dev_err(&priv->spi->dev, "%s: invalid system\n", __func__);
+		mutex_unlock(priv->spi_mutex);
+		return -EINVAL;
+	}
+	mutex_unlock(priv->spi_mutex);
+	dev_info(&priv->spi->dev, "%s: tune result %d\n", __func__, ret);
+
+	return return_tbl[ret];
+}
+
+static int cxd2880_read_status(struct dvb_frontend *fe,
+				enum fe_status *status)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	u8 sync = 0;
+	u8 lock = 0;
+	u8 unlock = 0;
+	struct cxd2880_priv *priv = NULL;
+	struct dtv_frontend_properties *c = NULL;
+
+	if ((!fe) || (!status)) {
+		pr_err("%s: invalid arg\n", __func__);
+		return -EINVAL;
+	}
+
+	priv = (struct cxd2880_priv *)fe->demodulator_priv;
+	c = &fe->dtv_property_cache;
+	*status = 0;
+
+	if (priv->tnrdmd.state == CXD2880_TNRDMD_STATE_ACTIVE) {
+		mutex_lock(priv->spi_mutex);
+		if (c->delivery_system == SYS_DVBT) {
+			ret = cxd2880_tnrdmd_dvbt_mon_sync_stat(
+							&priv->tnrdmd,
+							&sync,
+							&lock,
+							&unlock);
+		} else if (c->delivery_system == SYS_DVBT2) {
+			ret = cxd2880_tnrdmd_dvbt2_mon_sync_stat(
+							&priv->tnrdmd,
+							&sync,
+							&lock,
+							&unlock);
+		} else {
+			dev_err(&priv->spi->dev,
+				"%s: invlaid system", __func__);
+			mutex_unlock(priv->spi_mutex);
+			return -EINVAL;
+		}
+
+		mutex_unlock(priv->spi_mutex);
+		if (ret != CXD2880_RESULT_OK) {
+			dev_err(&priv->spi->dev, "%s: failed. sys = %d\n",
+				__func__, priv->tnrdmd.sys);
+			return  return_tbl[ret];
+		}
+
+		if (sync == 6) {
+			*status = FE_HAS_SIGNAL |
+					FE_HAS_CARRIER;
+		}
+		if (lock)
+			*status |= FE_HAS_VITERBI |
+					FE_HAS_SYNC |
+					FE_HAS_LOCK;
+	}
+
+	dev_dbg(&priv->spi->dev, "%s: status %d result %d\n", __func__,
+		*status, ret);
+
+	return  return_tbl[CXD2880_RESULT_OK];
+}
+
+static int cxd2880_tune(struct dvb_frontend *fe,
+			bool retune,
+			unsigned int mode_flags,
+			unsigned int *delay,
+			enum fe_status *status)
+{
+	int ret = 0;
+
+	if ((!fe) || (!delay) || (!status)) {
+		pr_err("%s: invalid arg.", __func__);
+		return -EINVAL;
+	}
+
+	if (retune) {
+		ret = cxd2880_set_frontend(fe);
+		if (ret) {
+			pr_err("%s: cxd2880_set_frontend failed %d\n",
+				__func__, ret);
+			return ret;
+		}
+	}
+
+	*delay = HZ / 5;
+
+	return cxd2880_read_status(fe, status);
+}
+
+static int cxd2880_get_frontend_t(struct dvb_frontend *fe,
+				struct dtv_frontend_properties *c)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	int result = 0;
+	struct cxd2880_priv *priv = NULL;
+	enum cxd2880_dvbt_mode mode = CXD2880_DVBT_MODE_2K;
+	enum cxd2880_dvbt_guard guard = CXD2880_DVBT_GUARD_1_32;
+	struct cxd2880_dvbt_tpsinfo tps;
+	enum cxd2880_tnrdmd_spectrum_sense sense;
+	u16 snr = 0;
+	int strength = 0;
+	u32 pre_bit_err = 0, pre_bit_count = 0;
+	u32 post_bit_err = 0, post_bit_count = 0;
+	u32 block_err = 0, block_count = 0;
+
+	if ((!fe) || (!c)) {
+		pr_err("%s: invalid arg\n", __func__);
+		return -EINVAL;
+	}
+
+	priv = (struct cxd2880_priv *)fe->demodulator_priv;
+
+	mutex_lock(priv->spi_mutex);
+	ret = cxd2880_tnrdmd_dvbt_mon_mode_guard(&priv->tnrdmd,
+						 &mode, &guard);
+	mutex_unlock(priv->spi_mutex);
+	if (ret == CXD2880_RESULT_OK) {
+		switch (mode) {
+		case CXD2880_DVBT_MODE_2K:
+			c->transmission_mode = TRANSMISSION_MODE_2K;
+			break;
+		case CXD2880_DVBT_MODE_8K:
+			c->transmission_mode = TRANSMISSION_MODE_8K;
+			break;
+		default:
+			c->transmission_mode = TRANSMISSION_MODE_2K;
+			dev_err(&priv->spi->dev, "%s: get invalid mode %d\n",
+					__func__, mode);
+			break;
+		}
+		switch (guard) {
+		case CXD2880_DVBT_GUARD_1_32:
+			c->guard_interval = GUARD_INTERVAL_1_32;
+			break;
+		case CXD2880_DVBT_GUARD_1_16:
+			c->guard_interval = GUARD_INTERVAL_1_16;
+			break;
+		case CXD2880_DVBT_GUARD_1_8:
+			c->guard_interval = GUARD_INTERVAL_1_8;
+			break;
+		case CXD2880_DVBT_GUARD_1_4:
+			c->guard_interval = GUARD_INTERVAL_1_4;
+			break;
+		default:
+			c->guard_interval = GUARD_INTERVAL_1_32;
+			dev_err(&priv->spi->dev, "%s: get invalid guard %d\n",
+					__func__, guard);
+			break;
+		}
+	} else {
+		c->transmission_mode = TRANSMISSION_MODE_2K;
+		c->guard_interval = GUARD_INTERVAL_1_32;
+		dev_dbg(&priv->spi->dev,
+			"%s: ModeGuard err %d\n", __func__, ret);
+	}
+
+	mutex_lock(priv->spi_mutex);
+	ret = cxd2880_tnrdmd_dvbt_mon_tps_info(&priv->tnrdmd, &tps);
+	mutex_unlock(priv->spi_mutex);
+	if (ret == CXD2880_RESULT_OK) {
+		switch (tps.hierarchy) {
+		case CXD2880_DVBT_HIERARCHY_NON:
+			c->hierarchy = HIERARCHY_NONE;
+			break;
+		case CXD2880_DVBT_HIERARCHY_1:
+			c->hierarchy = HIERARCHY_1;
+			break;
+		case CXD2880_DVBT_HIERARCHY_2:
+			c->hierarchy = HIERARCHY_2;
+			break;
+		case CXD2880_DVBT_HIERARCHY_4:
+			c->hierarchy = HIERARCHY_4;
+			break;
+		default:
+			c->hierarchy = HIERARCHY_NONE;
+			dev_err(&priv->spi->dev,
+				"%s: TPSInfo hierarchy invalid %d\n",
+				__func__, tps.hierarchy);
+			break;
+		}
+
+		switch (tps.rate_hp) {
+		case CXD2880_DVBT_CODERATE_1_2:
+			c->code_rate_HP = FEC_1_2;
+			break;
+		case CXD2880_DVBT_CODERATE_2_3:
+			c->code_rate_HP = FEC_2_3;
+			break;
+		case CXD2880_DVBT_CODERATE_3_4:
+			c->code_rate_HP = FEC_3_4;
+			break;
+		case CXD2880_DVBT_CODERATE_5_6:
+			c->code_rate_HP = FEC_5_6;
+			break;
+		case CXD2880_DVBT_CODERATE_7_8:
+			c->code_rate_HP = FEC_7_8;
+			break;
+		default:
+			c->code_rate_HP = FEC_NONE;
+			dev_err(&priv->spi->dev,
+				"%s: TPSInfo rateHP invalid %d\n",
+				__func__, tps.rate_hp);
+			break;
+		}
+		switch (tps.rate_lp) {
+		case CXD2880_DVBT_CODERATE_1_2:
+			c->code_rate_LP = FEC_1_2;
+			break;
+		case CXD2880_DVBT_CODERATE_2_3:
+			c->code_rate_LP = FEC_2_3;
+			break;
+		case CXD2880_DVBT_CODERATE_3_4:
+			c->code_rate_LP = FEC_3_4;
+			break;
+		case CXD2880_DVBT_CODERATE_5_6:
+			c->code_rate_LP = FEC_5_6;
+			break;
+		case CXD2880_DVBT_CODERATE_7_8:
+			c->code_rate_LP = FEC_7_8;
+			break;
+		default:
+			c->code_rate_LP = FEC_NONE;
+			dev_err(&priv->spi->dev,
+				"%s: TPSInfo rateLP invalid %d\n",
+				__func__, tps.rate_lp);
+			break;
+		}
+		switch (tps.constellation) {
+		case CXD2880_DVBT_CONSTELLATION_QPSK:
+			c->modulation = QPSK;
+			break;
+		case CXD2880_DVBT_CONSTELLATION_16QAM:
+			c->modulation = QAM_16;
+			break;
+		case CXD2880_DVBT_CONSTELLATION_64QAM:
+			c->modulation = QAM_64;
+			break;
+		default:
+			c->modulation = QPSK;
+			dev_err(&priv->spi->dev,
+				"%s: TPSInfo constellation invalid %d\n",
+				__func__, tps.constellation);
+			break;
+		}
+	} else {
+		c->hierarchy = HIERARCHY_NONE;
+		c->code_rate_HP = FEC_NONE;
+		c->code_rate_LP = FEC_NONE;
+		c->modulation = QPSK;
+		dev_dbg(&priv->spi->dev,
+			"%s: TPS info err %d\n", __func__, ret);
+	}
+
+	mutex_lock(priv->spi_mutex);
+	ret = cxd2880_tnrdmd_dvbt_mon_spectrum_sense(&priv->tnrdmd, &sense);
+	mutex_unlock(priv->spi_mutex);
+	if (ret == CXD2880_RESULT_OK) {
+		switch (sense) {
+		case CXD2880_TNRDMD_SPECTRUM_NORMAL:
+			c->inversion = INVERSION_OFF;
+			break;
+		case CXD2880_TNRDMD_SPECTRUM_INV:
+			c->inversion = INVERSION_ON;
+			break;
+		default:
+			c->inversion = INVERSION_OFF;
+			dev_err(&priv->spi->dev,
+				"%s: spectrum sense invalid %d\n",
+				__func__, sense);
+			break;
+		}
+	} else {
+		c->inversion = INVERSION_OFF;
+		dev_dbg(&priv->spi->dev,
+			"%s: spectrum_sense %d\n", __func__, ret);
+	}
+
+	mutex_lock(priv->spi_mutex);
+	ret = cxd2880_tnrdmd_mon_rf_lvl(&priv->tnrdmd, &strength);
+	mutex_unlock(priv->spi_mutex);
+	if (ret == CXD2880_RESULT_OK) {
+		c->strength.len = 1;
+		c->strength.stat[0].scale = FE_SCALE_DECIBEL;
+		c->strength.stat[0].svalue = strength;
+	} else {
+		c->strength.len = 1;
+		c->strength.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+		dev_dbg(&priv->spi->dev, "%s: mon_rf_lvl %d\n",
+			__func__, result);
+	}
+
+	result = cxd2880_read_snr(fe, &snr);
+	if (!result) {
+		c->cnr.len = 1;
+		c->cnr.stat[0].scale = FE_SCALE_DECIBEL;
+		c->cnr.stat[0].svalue = snr;
+	} else {
+		c->cnr.len = 1;
+		c->cnr.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+		dev_dbg(&priv->spi->dev, "%s: read_snr %d\n", __func__, result);
+	}
+
+	mutex_lock(priv->spi_mutex);
+	ret = cxd2880_pre_bit_err_t(&priv->tnrdmd, &pre_bit_err,
+					&pre_bit_count);
+	mutex_unlock(priv->spi_mutex);
+	if (ret == CXD2880_RESULT_OK) {
+		c->pre_bit_error.len = 1;
+		c->pre_bit_error.stat[0].scale = FE_SCALE_COUNTER;
+		c->pre_bit_error.stat[0].uvalue = pre_bit_err;
+		c->pre_bit_count.len = 1;
+		c->pre_bit_count.stat[0].scale = FE_SCALE_COUNTER;
+		c->pre_bit_count.stat[0].uvalue = pre_bit_count;
+	} else {
+		c->pre_bit_error.len = 1;
+		c->pre_bit_error.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+		c->pre_bit_count.len = 1;
+		c->pre_bit_count.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+		dev_dbg(&priv->spi->dev,
+			"%s: pre_bit_error_t failed %d\n",
+			__func__, ret);
+	}
+
+	mutex_lock(priv->spi_mutex);
+	ret = cxd2880_post_bit_err_t(&priv->tnrdmd,
+				&post_bit_err, &post_bit_count);
+	mutex_unlock(priv->spi_mutex);
+	if (ret == CXD2880_RESULT_OK) {
+		c->post_bit_error.len = 1;
+		c->post_bit_error.stat[0].scale = FE_SCALE_COUNTER;
+		c->post_bit_error.stat[0].uvalue = post_bit_err;
+		c->post_bit_count.len = 1;
+		c->post_bit_count.stat[0].scale = FE_SCALE_COUNTER;
+		c->post_bit_count.stat[0].uvalue = post_bit_count;
+	} else {
+		c->post_bit_error.len = 1;
+		c->post_bit_error.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+		c->post_bit_count.len = 1;
+		c->post_bit_count.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+		dev_dbg(&priv->spi->dev,
+			"%s: post_bit_err_t %d\n", __func__, ret);
+	}
+
+	mutex_lock(priv->spi_mutex);
+	ret = cxd2880_read_block_err_t(&priv->tnrdmd,
+					&block_err, &block_count);
+	mutex_unlock(priv->spi_mutex);
+	if (ret == CXD2880_RESULT_OK) {
+		c->block_error.len = 1;
+		c->block_error.stat[0].scale = FE_SCALE_COUNTER;
+		c->block_error.stat[0].uvalue = block_err;
+		c->block_count.len = 1;
+		c->block_count.stat[0].scale = FE_SCALE_COUNTER;
+		c->block_count.stat[0].uvalue = block_count;
+	} else {
+		c->block_error.len = 1;
+		c->block_error.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+		c->block_count.len = 1;
+		c->block_count.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+		dev_dbg(&priv->spi->dev,
+			"%s: read_block_err_t  %d\n", __func__, ret);
+	}
+
+	return 0;
+}
+
+static int cxd2880_get_frontend_t2(struct dvb_frontend *fe,
+				struct dtv_frontend_properties *c)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	int result = 0;
+	struct cxd2880_priv *priv = NULL;
+	struct cxd2880_dvbt2_l1pre l1pre;
+	enum cxd2880_dvbt2_plp_code_rate coderate;
+	enum cxd2880_dvbt2_plp_constell qam;
+	enum cxd2880_tnrdmd_spectrum_sense sense;
+	u16 snr = 0;
+	int strength = 0;
+	u32 pre_bit_err = 0, pre_bit_count = 0;
+	u32 post_bit_err = 0, post_bit_count = 0;
+	u32 block_err = 0, block_count = 0;
+
+	if ((!fe) || (!c)) {
+		pr_err("%s: invalid arg.\n", __func__);
+		return -EINVAL;
+	}
+
+	priv = (struct cxd2880_priv *)fe->demodulator_priv;
+
+	mutex_lock(priv->spi_mutex);
+	ret = cxd2880_tnrdmd_dvbt2_mon_l1_pre(&priv->tnrdmd, &l1pre);
+	mutex_unlock(priv->spi_mutex);
+	if (ret == CXD2880_RESULT_OK) {
+		switch (l1pre.fft_mode) {
+		case CXD2880_DVBT2_M2K:
+			c->transmission_mode = TRANSMISSION_MODE_2K;
+			break;
+		case CXD2880_DVBT2_M8K:
+			c->transmission_mode = TRANSMISSION_MODE_8K;
+			break;
+		case CXD2880_DVBT2_M4K:
+			c->transmission_mode = TRANSMISSION_MODE_4K;
+			break;
+		case CXD2880_DVBT2_M1K:
+			c->transmission_mode = TRANSMISSION_MODE_1K;
+			break;
+		case CXD2880_DVBT2_M16K:
+			c->transmission_mode = TRANSMISSION_MODE_16K;
+			break;
+		case CXD2880_DVBT2_M32K:
+			c->transmission_mode = TRANSMISSION_MODE_32K;
+			break;
+		default:
+			c->transmission_mode = TRANSMISSION_MODE_2K;
+			dev_err(&priv->spi->dev,
+				"%s: L1Pre fft_mode invalid %d\n",
+				__func__, l1pre.fft_mode);
+			break;
+		}
+		switch (l1pre.gi) {
+		case CXD2880_DVBT2_G1_32:
+			c->guard_interval = GUARD_INTERVAL_1_32;
+			break;
+		case CXD2880_DVBT2_G1_16:
+			c->guard_interval = GUARD_INTERVAL_1_16;
+			break;
+		case CXD2880_DVBT2_G1_8:
+			c->guard_interval = GUARD_INTERVAL_1_8;
+			break;
+		case CXD2880_DVBT2_G1_4:
+			c->guard_interval = GUARD_INTERVAL_1_4;
+			break;
+		case CXD2880_DVBT2_G1_128:
+			c->guard_interval = GUARD_INTERVAL_1_128;
+			break;
+		case CXD2880_DVBT2_G19_128:
+			c->guard_interval = GUARD_INTERVAL_19_128;
+			break;
+		case CXD2880_DVBT2_G19_256:
+			c->guard_interval = GUARD_INTERVAL_19_256;
+			break;
+		default:
+			c->guard_interval = GUARD_INTERVAL_1_32;
+			dev_err(&priv->spi->dev,
+				"%s: L1Pre gi invalid %d\n",
+				__func__, l1pre.gi);
+			break;
+		}
+	} else {
+		c->transmission_mode = TRANSMISSION_MODE_2K;
+		c->guard_interval = GUARD_INTERVAL_1_32;
+		dev_dbg(&priv->spi->dev,
+			"%s: L1Pre err %d\n", __func__, ret);
+	}
+
+	mutex_lock(priv->spi_mutex);
+	ret = cxd2880_tnrdmd_dvbt2_mon_code_rate(&priv->tnrdmd,
+						CXD2880_DVBT2_PLP_DATA,
+						&coderate);
+	mutex_unlock(priv->spi_mutex);
+	if (ret == CXD2880_RESULT_OK) {
+		switch (coderate) {
+		case CXD2880_DVBT2_R1_2:
+			c->fec_inner = FEC_1_2;
+			break;
+		case CXD2880_DVBT2_R3_5:
+			c->fec_inner = FEC_3_5;
+			break;
+		case CXD2880_DVBT2_R2_3:
+			c->fec_inner = FEC_2_3;
+			break;
+		case CXD2880_DVBT2_R3_4:
+			c->fec_inner = FEC_3_4;
+			break;
+		case CXD2880_DVBT2_R4_5:
+			c->fec_inner = FEC_4_5;
+			break;
+		case CXD2880_DVBT2_R5_6:
+			c->fec_inner = FEC_5_6;
+			break;
+		default:
+			c->fec_inner = FEC_NONE;
+			dev_err(&priv->spi->dev,
+				"%s: CodeRate invalid %d\n",
+				__func__, coderate);
+			break;
+		}
+	} else {
+		c->fec_inner = FEC_NONE;
+		dev_dbg(&priv->spi->dev, "%s: CodeRate %d\n", __func__, ret);
+	}
+
+	mutex_lock(priv->spi_mutex);
+	ret = cxd2880_tnrdmd_dvbt2_mon_qam(&priv->tnrdmd,
+					CXD2880_DVBT2_PLP_DATA,
+					&qam);
+	mutex_unlock(priv->spi_mutex);
+	if (ret == CXD2880_RESULT_OK) {
+		switch (qam) {
+		case CXD2880_DVBT2_QPSK:
+			c->modulation = QPSK;
+			break;
+		case CXD2880_DVBT2_QAM16:
+			c->modulation = QAM_16;
+			break;
+		case CXD2880_DVBT2_QAM64:
+			c->modulation = QAM_64;
+			break;
+		case CXD2880_DVBT2_QAM256:
+			c->modulation = QAM_256;
+			break;
+		default:
+			c->modulation = QPSK;
+			dev_err(&priv->spi->dev,
+				"%s: QAM invalid %d\n",
+				__func__, qam);
+			break;
+		}
+	} else {
+		c->modulation = QPSK;
+		dev_dbg(&priv->spi->dev, "%s: QAM %d\n", __func__, ret);
+	}
+
+	mutex_lock(priv->spi_mutex);
+	ret = cxd2880_tnrdmd_dvbt2_mon_spectrum_sense(&priv->tnrdmd, &sense);
+	mutex_unlock(priv->spi_mutex);
+	if (ret == CXD2880_RESULT_OK) {
+		switch (sense) {
+		case CXD2880_TNRDMD_SPECTRUM_NORMAL:
+			c->inversion = INVERSION_OFF;
+			break;
+		case CXD2880_TNRDMD_SPECTRUM_INV:
+			c->inversion = INVERSION_ON;
+			break;
+		default:
+			c->inversion = INVERSION_OFF;
+			dev_err(&priv->spi->dev,
+				"%s: spectrum sense invalid %d\n",
+				__func__, sense);
+			break;
+		}
+	} else {
+		c->inversion = INVERSION_OFF;
+		dev_dbg(&priv->spi->dev,
+			"%s: SpectrumSense %d\n", __func__, ret);
+	}
+
+	mutex_lock(priv->spi_mutex);
+	ret = cxd2880_tnrdmd_mon_rf_lvl(&priv->tnrdmd, &strength);
+	mutex_unlock(priv->spi_mutex);
+	if (ret == CXD2880_RESULT_OK) {
+		c->strength.len = 1;
+		c->strength.stat[0].scale = FE_SCALE_DECIBEL;
+		c->strength.stat[0].svalue = strength;
+	} else {
+		c->strength.len = 1;
+		c->strength.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+		dev_dbg(&priv->spi->dev,
+			"%s: mon_rf_lvl %d\n", __func__, ret);
+	}
+
+	result = cxd2880_read_snr(fe, &snr);
+	if (!result) {
+		c->cnr.len = 1;
+		c->cnr.stat[0].scale = FE_SCALE_DECIBEL;
+		c->cnr.stat[0].svalue = snr;
+	} else {
+		c->cnr.len = 1;
+		c->cnr.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+		dev_dbg(&priv->spi->dev, "%s: read_snr %d\n", __func__, result);
+	}
+
+	mutex_lock(priv->spi_mutex);
+	ret = cxd2880_pre_bit_err_t2(&priv->tnrdmd,
+				&pre_bit_err,
+				&pre_bit_count);
+	mutex_unlock(priv->spi_mutex);
+	if (ret == CXD2880_RESULT_OK) {
+		c->pre_bit_error.len = 1;
+		c->pre_bit_error.stat[0].scale = FE_SCALE_COUNTER;
+		c->pre_bit_error.stat[0].uvalue = pre_bit_err;
+		c->pre_bit_count.len = 1;
+		c->pre_bit_count.stat[0].scale = FE_SCALE_COUNTER;
+		c->pre_bit_count.stat[0].uvalue = pre_bit_count;
+	} else {
+		c->pre_bit_error.len = 1;
+		c->pre_bit_error.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+		c->pre_bit_count.len = 1;
+		c->pre_bit_count.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+		dev_dbg(&priv->spi->dev,
+			"%s: read_bit_err_t2 %d\n", __func__, ret);
+	}
+
+	mutex_lock(priv->spi_mutex);
+	ret = cxd2880_post_bit_err_t2(&priv->tnrdmd,
+				&post_bit_err, &post_bit_count);
+	mutex_unlock(priv->spi_mutex);
+	if (ret == CXD2880_RESULT_OK) {
+		c->post_bit_error.len = 1;
+		c->post_bit_error.stat[0].scale = FE_SCALE_COUNTER;
+		c->post_bit_error.stat[0].uvalue = post_bit_err;
+		c->post_bit_count.len = 1;
+		c->post_bit_count.stat[0].scale = FE_SCALE_COUNTER;
+		c->post_bit_count.stat[0].uvalue = post_bit_count;
+	} else {
+		c->post_bit_error.len = 1;
+		c->post_bit_error.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+		c->post_bit_count.len = 1;
+		c->post_bit_count.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+		dev_dbg(&priv->spi->dev,
+			"%s: post_bit_err_t2 %d\n", __func__, ret);
+	}
+
+	mutex_lock(priv->spi_mutex);
+	ret = cxd2880_read_block_err_t2(&priv->tnrdmd,
+					&block_err, &block_count);
+	mutex_unlock(priv->spi_mutex);
+	if (ret == CXD2880_RESULT_OK) {
+		c->block_error.len = 1;
+		c->block_error.stat[0].scale = FE_SCALE_COUNTER;
+		c->block_error.stat[0].uvalue = block_err;
+		c->block_count.len = 1;
+		c->block_count.stat[0].scale = FE_SCALE_COUNTER;
+		c->block_count.stat[0].uvalue = block_count;
+	} else {
+		c->block_error.len = 1;
+		c->block_error.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+		c->block_count.len = 1;
+		c->block_count.stat[0].scale = FE_SCALE_NOT_AVAILABLE;
+		dev_dbg(&priv->spi->dev,
+			"%s: read_block_err_t2 %d\n", __func__, ret);
+	}
+
+	return 0;
+}
+
+static int cxd2880_get_frontend(struct dvb_frontend *fe,
+				struct dtv_frontend_properties *props)
+{
+	struct cxd2880_priv *priv = NULL;
+	int result = 0;
+
+	if ((!fe) || (!props)) {
+		pr_err("%s: invalid arg.", __func__);
+		return -EINVAL;
+	}
+
+	priv = (struct cxd2880_priv *)fe->demodulator_priv;
+
+	dev_dbg(&priv->spi->dev, "%s: system=%d\n", __func__,
+		fe->dtv_property_cache.delivery_system);
+	switch (fe->dtv_property_cache.delivery_system) {
+	case SYS_DVBT:
+		result = cxd2880_get_frontend_t(fe, props);
+		break;
+	case SYS_DVBT2:
+		result = cxd2880_get_frontend_t2(fe, props);
+		break;
+	default:
+		result = -EINVAL;
+		break;
+	}
+
+	return result;
+}
+
+static enum dvbfe_algo cxd2880_get_frontend_algo(struct dvb_frontend *fe)
+{
+	return DVBFE_ALGO_HW;
+}
+
+static struct dvb_frontend_ops cxd2880_dvbt_t2_ops;
+
+struct dvb_frontend *cxd2880_attach(struct dvb_frontend *fe,
+				struct cxd2880_config *cfg)
+{
+	enum cxd2880_ret ret = CXD2880_RESULT_OK;
+	enum cxd2880_tnrdmd_chip_id chipid =
+					CXD2880_TNRDMD_CHIP_ID_UNKNOWN;
+	static struct cxd2880_priv *priv;
+	u8 data = 0;
+
+	if (!fe) {
+		pr_err("%s: invalid arg.\n", __func__);
+		return NULL;
+	}
+
+	priv = kzalloc(sizeof(struct cxd2880_priv), GFP_KERNEL);
+	if (!priv)
+		return NULL;
+
+	priv->spi = cfg->spi;
+	priv->spi_mutex = cfg->spi_mutex;
+	priv->spi_device.spi = cfg->spi;
+
+	memcpy(&fe->ops, &cxd2880_dvbt_t2_ops,
+			sizeof(struct dvb_frontend_ops));
+
+	ret = cxd2880_spi_device_initialize(&priv->spi_device,
+						CXD2880_SPI_MODE_0,
+						55000000);
+	if (ret != CXD2880_RESULT_OK) {
+		dev_err(&priv->spi->dev,
+			"%s: spi_device_initialize failed. %d\n",
+			__func__, ret);
+		kfree(priv);
+		return NULL;
+	}
+
+	ret = cxd2880_spi_device_create_spi(&priv->cxd2880_spi,
+					&priv->spi_device);
+	if (ret != CXD2880_RESULT_OK) {
+		dev_err(&priv->spi->dev,
+			"%s: spi_device_create_spi failed. %d\n",
+			__func__, ret);
+		kfree(priv);
+		return NULL;
+	}
+
+	ret = cxd2880_io_spi_create(&priv->regio, &priv->cxd2880_spi, 0);
+	if (ret != CXD2880_RESULT_OK) {
+		dev_err(&priv->spi->dev,
+			"%s: io_spi_create failed. %d\n", __func__, ret);
+		kfree(priv);
+		return NULL;
+	}
+	if (priv->regio.write_reg(&priv->regio, CXD2880_IO_TGT_SYS, 0x00, 0x00)
+		!= CXD2880_RESULT_OK) {
+		dev_err(&priv->spi->dev,
+			"%s: set bank to 0x00 failed.\n", __func__);
+		kfree(priv);
+		return NULL;
+	}
+	if (priv->regio.read_regs(&priv->regio,
+					CXD2880_IO_TGT_SYS, 0xFD, &data, 1)
+					!= CXD2880_RESULT_OK) {
+		dev_err(&priv->spi->dev,
+			"%s: read chip id failed.\n", __func__);
+		kfree(priv);
+		return NULL;
+	}
+
+	chipid = (enum cxd2880_tnrdmd_chip_id)data;
+	if ((chipid != CXD2880_TNRDMD_CHIP_ID_CXD2880_ES1_0X) &&
+		(chipid != CXD2880_TNRDMD_CHIP_ID_CXD2880_ES1_11)) {
+		dev_err(&priv->spi->dev,
+			"%s: chip id invalid.\n", __func__);
+		kfree(priv);
+		return NULL;
+	}
+
+	fe->demodulator_priv = priv;
+	dev_info(&priv->spi->dev,
+		"CXD2880 driver version: Ver %s\n",
+		CXD2880_TNRDMD_DRIVER_VERSION);
+
+	return fe;
+}
+EXPORT_SYMBOL(cxd2880_attach);
+
+static struct dvb_frontend_ops cxd2880_dvbt_t2_ops = {
+	.info = {
+		.name = "Sony CXD2880",
+		.frequency_min =  174000000,
+		.frequency_max = 862000000,
+		.frequency_stepsize = 1000,
+		.caps = FE_CAN_INVERSION_AUTO |
+				FE_CAN_FEC_1_2 |
+				FE_CAN_FEC_2_3 |
+				FE_CAN_FEC_3_4 |
+				FE_CAN_FEC_4_5 |
+				FE_CAN_FEC_5_6	|
+				FE_CAN_FEC_7_8	|
+				FE_CAN_FEC_AUTO |
+				FE_CAN_QPSK |
+				FE_CAN_QAM_16 |
+				FE_CAN_QAM_32 |
+				FE_CAN_QAM_64 |
+				FE_CAN_QAM_128 |
+				FE_CAN_QAM_256 |
+				FE_CAN_QAM_AUTO |
+				FE_CAN_TRANSMISSION_MODE_AUTO |
+				FE_CAN_GUARD_INTERVAL_AUTO |
+				FE_CAN_2G_MODULATION |
+				FE_CAN_RECOVER |
+				FE_CAN_MUTE_TS,
+	},
+	.delsys = { SYS_DVBT, SYS_DVBT2 },
+
+	.release = cxd2880_release,
+	.init = cxd2880_init,
+	.sleep = cxd2880_sleep,
+	.tune = cxd2880_tune,
+	.set_frontend = cxd2880_set_frontend,
+	.get_frontend = cxd2880_get_frontend,
+	.read_status = cxd2880_read_status,
+	.read_ber = cxd2880_read_ber,
+	.read_signal_strength = cxd2880_read_signal_strength,
+	.read_snr = cxd2880_read_snr,
+	.read_ucblocks = cxd2880_read_ucblocks,
+	.get_frontend_algo = cxd2880_get_frontend_algo,
+};
+
+MODULE_DESCRIPTION(
+"Sony CXD2880 DVB-T2/T tuner + demodulator drvier");
+MODULE_AUTHOR("Sony Semiconductor Solutions Corporation");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/media/spi/Kconfig b/drivers/media/spi/Kconfig
index a21f5a39a440..b07ac86fc53c 100644
--- a/drivers/media/spi/Kconfig
+++ b/drivers/media/spi/Kconfig
@@ -12,3 +12,17 @@ config VIDEO_GS1662
 endmenu
 
 endif
+
+if SPI
+menu "Media SPI Adapters"
+
+config CXD2880_SPI_DRV
+	tristate "Sony CXD2880 SPI support"
+	depends on DVB_CORE && SPI
+	default m if !MEDIA_SUBDRV_AUTOSELECT
+	help
+	  Choose if you would like to have SPI interface support for Sony CXD2880.
+
+endmenu
+
+endif
diff --git a/drivers/media/spi/Makefile b/drivers/media/spi/Makefile
index ea64013d16cc..40e0f88d9f6c 100644
--- a/drivers/media/spi/Makefile
+++ b/drivers/media/spi/Makefile
@@ -1 +1,6 @@
 obj-$(CONFIG_VIDEO_GS1662) += gs1662.o
+obj-$(CONFIG_CXD2880_SPI_DRV) += cxd2880-spi.o
+
+ccflags-y += -Idrivers/media/dvb-core
+ccflags-y += -Idrivers/media/dvb-frontends
+ccflags-y += -Idrivers/media/dvb-frontends/cxd2880
\ No newline at end of file
diff --git a/drivers/media/spi/cxd2880-spi.c b/drivers/media/spi/cxd2880-spi.c
new file mode 100644
index 000000000000..82e122349055
--- /dev/null
+++ b/drivers/media/spi/cxd2880-spi.c
@@ -0,0 +1,728 @@
+/*
+ * cxd2880-spi.c
+ * Sony CXD2880 DVB-T2/T tuner + demodulator driver
+ * SPI adapter
+ *
+ * Copyright (C) 2016, 2017 Sony Semiconductor Solutions Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/spi/spi.h>
+
+#include "dvb_demux.h"
+#include "dmxdev.h"
+#include "dvb_frontend.h"
+#include "cxd2880.h"
+
+#define CXD2880_MAX_FILTER_SIZE 32
+#define BURST_WRITE_MAX 128
+#define MAX_TRANS_PACKET 300
+
+struct cxd2880_ts_buf_info {
+	u8 read_ready;
+	u8 almost_full;
+	u8 almost_empty;
+	u8 overflow;
+	u8 underflow;
+	u16 packet_num;
+};
+
+struct cxd2880_pid_config {
+	u8 is_enable;
+	u16 pid;
+};
+
+struct cxd2880_pid_filter_config {
+	u8 is_negative;
+	struct cxd2880_pid_config pid_config[CXD2880_MAX_FILTER_SIZE];
+};
+
+struct cxd2880_dvb_spi {
+	struct dvb_frontend dvb_fe;
+	struct dvb_adapter adapter;
+	struct dvb_demux demux;
+	struct dmxdev dmxdev;
+	struct dmx_frontend dmx_fe;
+	struct task_struct *cxd2880_ts_read_thread;
+	struct spi_device *spi;
+	struct mutex spi_mutex; /* For SPI access exclusive control */
+	int feed_count;
+	int all_pid_feed_count;
+	u8 *ts_buf;
+	struct cxd2880_pid_filter_config filter_config;
+};
+
+DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
+
+static int cxd2880_write_spi(struct spi_device *spi, u8 *data, u32 size)
+{
+	struct spi_message msg;
+	struct spi_transfer tx;
+	int ret = 0;
+
+	if ((!spi) || (!data)) {
+		pr_err("%s: invalid arg\n", __func__);
+		return -EINVAL;
+	}
+
+	memset(&tx, 0, sizeof(tx));
+	tx.tx_buf = data;
+	tx.len = size;
+
+	spi_message_init(&msg);
+	spi_message_add_tail(&tx, &msg);
+	ret = spi_sync(spi, &msg);
+
+	return ret;
+}
+
+static int cxd2880_write_reg(struct spi_device *spi,
+				u8 subAddress, const u8 *data, u32 size)
+{
+	u8 send_data[BURST_WRITE_MAX + 4];
+	const u8 *write_data_top = NULL;
+	int ret = 0;
+
+	if ((!spi) || (!data)) {
+		pr_err("%s: invalid arg\n", __func__);
+		return -EINVAL;
+	}
+	if (size > BURST_WRITE_MAX) {
+		pr_err("%s: data size > WRITE_MAX\n", __func__);
+		return -EINVAL;
+	}
+
+	if (subAddress + size > 0x100) {
+		pr_err("%s: out of range\n", __func__);
+		return -EINVAL;
+	}
+
+	send_data[0] = 0x0E;
+	write_data_top = data;
+
+	while (size > 0) {
+		send_data[1] = subAddress;
+		if (size > 255)
+			send_data[2] = 255;
+		else
+			send_data[2] = (u8)size;
+
+		memcpy(&send_data[3], write_data_top, send_data[2]);
+
+		ret = cxd2880_write_spi(spi, send_data, send_data[2] + 3);
+		if (ret) {
+			dev_err(&spi->dev, "%s: write spi failed %d\n",
+				__func__, ret);
+			break;
+		}
+		subAddress += send_data[2];
+		write_data_top += send_data[2];
+		size -= send_data[2];
+	}
+
+	return ret;
+}
+
+static int cxd2880_spi_read_ts(struct spi_device *spi,
+					u8 *read_data,
+					u32 packet_num)
+{
+	int ret = 0;
+	u8 data[3];
+	struct spi_message message;
+	struct spi_transfer transfer[2];
+
+	if ((!spi) || (!read_data) || (!packet_num)) {
+		pr_err("%s: invalid arg\n", __func__);
+		return -EINVAL;
+	}
+	if (packet_num > 0xFFFF) {
+		dev_err(&spi->dev, "%s: packet num > 0xFFFF\n", __func__);
+		return -EINVAL;
+	}
+
+	data[0] = 0x10;
+	data[1] = (u8)((packet_num >> 8) & 0xFF);
+	data[2] = (u8)(packet_num & 0xFF);
+
+	spi_message_init(&message);
+	memset(transfer, 0, sizeof(transfer));
+
+	transfer[0].len = 3;
+	transfer[0].tx_buf = data;
+	spi_message_add_tail(&transfer[0], &message);
+	transfer[1].len = packet_num * 188;
+	transfer[1].rx_buf = read_data;
+	spi_message_add_tail(&transfer[1], &message);
+
+	ret = spi_sync(spi, &message);
+	if (ret)
+		dev_err(&spi->dev, "%s: spi_write_then_read failed\n",
+			__func__);
+
+	return ret;
+}
+
+static int cxd2880_spi_read_ts_buffer_info(struct spi_device *spi,
+					struct cxd2880_ts_buf_info *info)
+{
+	u8 send_data = 0x20;
+	u8 recv_data[2];
+	int ret = 0;
+
+	if ((!spi) || (!info)) {
+		pr_err("%s: invalid arg\n", __func__);
+		return -EINVAL;
+	}
+
+	ret = spi_write_then_read(spi, &send_data, 1,
+			recv_data, sizeof(recv_data));
+	if (ret)
+		dev_err(&spi->dev,
+			"%s: spi_write_then_read failed\n", __func__);
+
+	info->read_ready = (u8)((recv_data[0] & 0x80) ? 1 : 0);
+	info->almost_full = (u8)((recv_data[0] & 0x40) ? 1 : 0);
+	info->almost_empty = (u8)((recv_data[0] & 0x20) ? 1 : 0);
+	info->overflow = (u8)((recv_data[0] & 0x10) ? 1 : 0);
+	info->underflow = (u8)((recv_data[0] & 0x08) ? 1 : 0);
+	info->packet_num = (u16)(((recv_data[0] & 0x07) << 8) | recv_data[1]);
+
+	return ret;
+}
+
+static int cxd2880_spi_clear_ts_buffer(struct spi_device *spi)
+{
+	u8 data = 0x03;
+	int ret = 0;
+
+	ret = cxd2880_write_spi(spi, &data, 1);
+
+	if (ret)
+		pr_err("%s: write spi failed\n", __func__);
+
+	return ret;
+}
+
+static int cxd2880_set_pid_filter(struct spi_device *spi,
+				struct cxd2880_pid_filter_config *cfg)
+{
+	u8 data[65];
+
+	if (!spi) {
+		pr_err("%s: ivnalid arg\n", __func__);
+		return -EINVAL;
+	}
+
+	data[0] = 0x00;
+	if (cxd2880_write_reg(spi, 0x00, &data[0], 1) != 0)
+		return -EIO;
+	if (!cfg) {
+		data[0] = 0x02;
+		if (cxd2880_write_reg(spi, 0x50, &data[0], 1) != 0)
+			return -EIO;
+	} else {
+		data[0] = (u8)(cfg->is_negative ? 0x01 : 0x00);
+		{
+			int i = 0;
+			u16 pid = 0;
+
+			for (i = 0; i < CXD2880_MAX_FILTER_SIZE; i++) {
+				pid = cfg->pid_config[i].pid;
+				if (cfg->pid_config[i].is_enable) {
+					data[1 + (i * 2)] =
+					    (u8)((u8)(pid >> 8) | 0x20);
+					data[2 + (i * 2)] =
+					    (u8)(pid & 0xFF);
+				} else {
+					data[1 + (i * 2)] = 0x00;
+					data[2 + (i * 2)] = 0x00;
+				}
+			}
+		}
+		if (cxd2880_write_reg(spi, 0x50, data, 65) != 0)
+			return -EIO;
+	}
+
+	return 0;
+}
+
+static int cxd2880_update_pid_filter(struct cxd2880_dvb_spi *dvb_spi,
+				struct cxd2880_pid_filter_config *cfg,
+				bool is_all_pid_filter)
+{
+	int ret = 0;
+
+	if ((!dvb_spi) || (!cfg)) {
+		pr_err("%s: invalid arg.\n", __func__);
+		return -EINVAL;
+	}
+
+	mutex_lock(&dvb_spi->spi_mutex);
+	if (is_all_pid_filter) {
+		struct cxd2880_pid_filter_config tmpcfg;
+
+		memset(&tmpcfg, 0, sizeof(tmpcfg));
+		tmpcfg.is_negative = 1;
+		tmpcfg.pid_config[0].is_enable = 1;
+		tmpcfg.pid_config[0].pid = 0x1FFF;
+
+		ret = cxd2880_set_pid_filter(dvb_spi->spi, &tmpcfg);
+	} else {
+		ret = cxd2880_set_pid_filter(dvb_spi->spi, cfg);
+	}
+	mutex_unlock(&dvb_spi->spi_mutex);
+
+	if (ret) {
+		dev_err(&dvb_spi->spi->dev,
+			"%s: set_pid_filter failed\n", __func__);
+	}
+
+	return ret;
+}
+
+static int cxd2880_ts_read(void *arg)
+{
+	struct cxd2880_dvb_spi *dvb_spi = NULL;
+	struct cxd2880_ts_buf_info info;
+	struct timespec ts;
+	long elapsed = 0;
+	long starttime = 0;
+	u32 i;
+	int ret;
+
+	dvb_spi = (struct cxd2880_dvb_spi *)arg;
+	if (!dvb_spi) {
+		pr_err("%s: invalid arg\n", __func__);
+		return -EINVAL;
+	}
+
+	ret = cxd2880_spi_clear_ts_buffer(dvb_spi->spi);
+	if (ret) {
+		dev_err(&dvb_spi->spi->dev,
+			"%s: set_clear_ts_buffer failed\n", __func__);
+		return ret;
+	}
+
+	getnstimeofday(&ts);
+	starttime = (ts.tv_sec * 1000) + (ts.tv_nsec / 1000000);
+	while (!kthread_should_stop()) {
+		getnstimeofday(&ts);
+		elapsed =
+			((ts.tv_sec * 1000) + (ts.tv_nsec / 1000000))
+			- starttime;
+		ret = cxd2880_spi_read_ts_buffer_info(dvb_spi->spi,
+							&info);
+		if (ret) {
+			pr_err("%s: spi_read_ts_buffer_info error\n",
+				__func__);
+			return ret;
+		}
+
+		if (info.packet_num > MAX_TRANS_PACKET) {
+			for (i = 0; i < info.packet_num / MAX_TRANS_PACKET;
+				i++) {
+				cxd2880_spi_read_ts(dvb_spi->spi,
+							dvb_spi->ts_buf,
+							MAX_TRANS_PACKET);
+				dvb_dmx_swfilter(&dvb_spi->demux,
+						dvb_spi->ts_buf,
+						MAX_TRANS_PACKET * 188);
+			}
+			starttime = (ts.tv_sec * 1000) + (ts.tv_nsec / 1000000);
+		} else if ((info.packet_num > 0) && (elapsed >= 500)) {
+			cxd2880_spi_read_ts(dvb_spi->spi,
+						dvb_spi->ts_buf,
+						info.packet_num);
+			dvb_dmx_swfilter(&dvb_spi->demux,
+					dvb_spi->ts_buf,
+					info.packet_num * 188);
+			starttime = (ts.tv_sec * 1000) + (ts.tv_nsec / 1000000);
+		} else {
+			usleep_range(10000, 11000);
+		}
+	}
+
+	return 0;
+}
+
+static int cxd2880_start_feed(struct dvb_demux_feed *feed)
+{
+	int ret = 0;
+	int i = 0;
+	struct dvb_demux *demux = NULL;
+	struct cxd2880_dvb_spi *dvb_spi = NULL;
+
+	if (!feed) {
+		pr_err("%s: invalid arg\n", __func__);
+		return -EINVAL;
+	}
+
+	demux = feed->demux;
+	if (!demux) {
+		pr_err("%s: feed->demux is NULL\n", __func__);
+		return -EINVAL;
+	}
+	dvb_spi = (struct cxd2880_dvb_spi *)demux->priv;
+
+	if (dvb_spi->feed_count == CXD2880_MAX_FILTER_SIZE) {
+		dev_err(&dvb_spi->spi->dev,
+			"%s: Exceeded maximum PID count (32).", __func__);
+		dev_err(&dvb_spi->spi->dev,
+			"Selected PID cannot be enabled.\n");
+		return -EBUSY;
+	}
+
+	if (feed->pid == 0x2000) {
+		if (dvb_spi->all_pid_feed_count == 0) {
+			ret = cxd2880_update_pid_filter(dvb_spi,
+							&dvb_spi->filter_config,
+							true);
+			if (ret) {
+				dev_err(&dvb_spi->spi->dev,
+					"%s: update pid filter failed\n",
+					__func__);
+				return ret;
+			}
+		}
+		dvb_spi->all_pid_feed_count++;
+
+		dev_dbg(&dvb_spi->spi->dev,
+			"%s: all PID feed (count = %d)\n",
+			__func__, dvb_spi->all_pid_feed_count);
+	} else {
+		struct cxd2880_pid_filter_config cfgtmp;
+
+		cfgtmp = dvb_spi->filter_config;
+
+		for (i = 0; i < CXD2880_MAX_FILTER_SIZE; i++) {
+			if (cfgtmp.pid_config[i].is_enable == 0) {
+				cfgtmp.pid_config[i].is_enable = 1;
+				cfgtmp.pid_config[i].pid = feed->pid;
+				dev_dbg(&dvb_spi->spi->dev,
+				"%s: store PID %d to #%d\n",
+				__func__, feed->pid, i);
+				break;
+			}
+		}
+		if (i == CXD2880_MAX_FILTER_SIZE) {
+			dev_err(&dvb_spi->spi->dev,
+				"%s: PID filter is full. Assumed bug.\n",
+				__func__);
+			return -EBUSY;
+		}
+		if (!dvb_spi->all_pid_feed_count)
+			ret = cxd2880_update_pid_filter(dvb_spi,
+							&cfgtmp,
+							false);
+		if (ret)
+			return ret;
+
+		dvb_spi->filter_config = cfgtmp;
+	}
+
+	if (dvb_spi->feed_count == 0) {
+		dvb_spi->ts_buf =
+			kmalloc(sizeof(u8) * MAX_TRANS_PACKET * 188,
+				GFP_KERNEL | GFP_DMA);
+		if (!dvb_spi->ts_buf) {
+			dev_err(&dvb_spi->spi->dev,
+			"%s: ts buffer allocate failed\n", __func__);
+			memset(&dvb_spi->filter_config, 0,
+				sizeof(dvb_spi->filter_config));
+			dvb_spi->all_pid_feed_count = 0;
+			return -ENOMEM;
+		}
+		dvb_spi->cxd2880_ts_read_thread = kthread_run(cxd2880_ts_read,
+								dvb_spi,
+								"cxd2880_ts_read");
+		if (IS_ERR(dvb_spi->cxd2880_ts_read_thread)) {
+			dev_err(&dvb_spi->spi->dev,
+				"%s: kthread_run failed/\n",
+				__func__);
+			kfree(dvb_spi->ts_buf);
+			dvb_spi->ts_buf = NULL;
+			memset(&dvb_spi->filter_config, 0,
+				sizeof(dvb_spi->filter_config));
+			dvb_spi->all_pid_feed_count = 0;
+			return PTR_ERR(dvb_spi->cxd2880_ts_read_thread);
+		}
+	}
+
+	dvb_spi->feed_count++;
+
+	dev_dbg(&dvb_spi->spi->dev, "%s: start feed (count %d)\n",
+		__func__, dvb_spi->feed_count);
+	return 0;
+}
+
+static int cxd2880_stop_feed(struct dvb_demux_feed *feed)
+{
+	int i = 0;
+	int ret = 0;
+	struct dvb_demux *demux = NULL;
+	struct cxd2880_dvb_spi *dvb_spi = NULL;
+
+	if (!feed) {
+		pr_err("%s: invalid arg\n", __func__);
+		return -EINVAL;
+	}
+
+	demux = feed->demux;
+	if (!demux) {
+		pr_err("%s: feed->demux is NULL\n", __func__);
+		return -EINVAL;
+	}
+	dvb_spi = (struct cxd2880_dvb_spi *)demux->priv;
+
+	if (!dvb_spi->feed_count) {
+		dev_warn(&dvb_spi->spi->dev,
+			"%s: no feed is started\n", __func__);
+		return -EINVAL;
+	}
+
+	if (feed->pid == 0x2000) {
+		/*
+		 * Special PID case.
+		 * Number of 0x2000 feed request was stored
+		 * in dvb_spi->all_pid_feed_count.
+		 */
+		if (dvb_spi->all_pid_feed_count <= 0) {
+			dev_warn(&dvb_spi->spi->dev,
+				"%s: PID %d not found.\n",
+				__func__, feed->pid);
+			return -EINVAL;
+		}
+		dvb_spi->all_pid_feed_count--;
+	} else {
+		struct cxd2880_pid_filter_config cfgtmp;
+
+		cfgtmp = dvb_spi->filter_config;
+
+		for (i = 0; i < CXD2880_MAX_FILTER_SIZE; i++) {
+			if (feed->pid == cfgtmp.pid_config[i].pid &&
+				cfgtmp.pid_config[i].is_enable != 0) {
+				cfgtmp.pid_config[i].is_enable = 0;
+				cfgtmp.pid_config[i].pid = 0;
+				dev_dbg(&dvb_spi->spi->dev,
+					"%s: removed PID %d from #%d\n",
+					__func__, feed->pid, i);
+				break;
+			}
+		}
+		dvb_spi->filter_config = cfgtmp;
+
+		if (i == CXD2880_MAX_FILTER_SIZE) {
+			dev_warn(&dvb_spi->spi->dev, "%s: PID %d not found\n",
+				__func__, feed->pid);
+			return -EINVAL;
+		}
+	}
+
+	ret = cxd2880_update_pid_filter(dvb_spi,
+					&dvb_spi->filter_config,
+					dvb_spi->all_pid_feed_count > 0);
+	dvb_spi->feed_count--;
+
+	if (dvb_spi->feed_count == 0) {
+		int ret_stop = 0;
+
+		ret_stop = kthread_stop(dvb_spi->cxd2880_ts_read_thread);
+		if (ret_stop) {
+			dev_err(&dvb_spi->spi->dev,
+			"%s: cxd2880_ts_read thread didn't terminate normally\n",
+			__func__);
+			ret = ret_stop;
+		}
+		kfree(dvb_spi->ts_buf);
+		dvb_spi->ts_buf = NULL;
+	}
+
+	dev_dbg(&dvb_spi->spi->dev, "%s: stop feed ok.(count %d)\n",
+		__func__, dvb_spi->feed_count);
+
+	return ret;
+}
+
+static const struct of_device_id cxd2880_spi_of_match[] = {
+	{ .compatible = "sony,cxd2880" },
+	{ /* sentinel */ }
+};
+
+MODULE_DEVICE_TABLE(of, cxd2880_spi_of_match);
+
+static int
+cxd2880_spi_probe(struct spi_device *spi)
+{
+	int ret = 0;
+	struct cxd2880_dvb_spi *dvb_spi = NULL;
+	struct cxd2880_config config;
+
+	if (!spi) {
+		pr_err("%s: invalid arg.\n", __func__);
+		return -EINVAL;
+	}
+
+	dvb_spi = kzalloc(sizeof(struct cxd2880_dvb_spi), GFP_KERNEL);
+	if (!dvb_spi)
+		return -ENOMEM;
+
+	dvb_spi->spi = spi;
+	mutex_init(&dvb_spi->spi_mutex);
+	dev_set_drvdata(&spi->dev, dvb_spi);
+	config.spi = spi;
+	config.spi_mutex = &dvb_spi->spi_mutex;
+
+	ret = dvb_register_adapter(&dvb_spi->adapter,
+					"CXD2880",
+					THIS_MODULE,
+					&spi->dev,
+					adapter_nr);
+	if (ret < 0) {
+		dev_err(&spi->dev, "%s: dvb_register_adapter() failed\n",
+			__func__);
+		goto fail_adapter;
+	}
+
+	if (!dvb_attach(cxd2880_attach, &dvb_spi->dvb_fe, &config)) {
+		dev_err(&spi->dev, "%s: cxd2880_attach failed\n", __func__);
+		goto fail_attach;
+	}
+
+	ret = dvb_register_frontend(&dvb_spi->adapter,
+					&dvb_spi->dvb_fe);
+	if (ret < 0) {
+		dev_err(&spi->dev, "%s: dvb_register_frontend() failed\n",
+			__func__);
+		goto fail_frontend;
+	}
+
+	dvb_spi->demux.dmx.capabilities = DMX_TS_FILTERING;
+	dvb_spi->demux.priv = dvb_spi;
+	dvb_spi->demux.filternum = CXD2880_MAX_FILTER_SIZE;
+	dvb_spi->demux.feednum = CXD2880_MAX_FILTER_SIZE;
+	dvb_spi->demux.start_feed = cxd2880_start_feed;
+	dvb_spi->demux.stop_feed = cxd2880_stop_feed;
+
+	ret = dvb_dmx_init(&dvb_spi->demux);
+	if (ret < 0) {
+		dev_err(&spi->dev, "%s: dvb_dmx_init() failed\n", __func__);
+		goto fail_dmx;
+	}
+
+	dvb_spi->dmxdev.filternum = CXD2880_MAX_FILTER_SIZE;
+	dvb_spi->dmxdev.demux = &dvb_spi->demux.dmx;
+	dvb_spi->dmxdev.capabilities = 0;
+	ret = dvb_dmxdev_init(&dvb_spi->dmxdev,
+				&dvb_spi->adapter);
+	if (ret < 0) {
+		dev_err(&spi->dev, "%s: dvb_dmxdev_init() failed\n", __func__);
+		goto fail_dmxdev;
+	}
+
+	dvb_spi->dmx_fe.source = DMX_FRONTEND_0;
+	ret = dvb_spi->demux.dmx.add_frontend(&dvb_spi->demux.dmx,
+						&dvb_spi->dmx_fe);
+	if (ret < 0) {
+		dev_err(&spi->dev, "%s: add_frontend() failed\n", __func__);
+		goto fail_dmx_fe;
+	}
+
+	ret = dvb_spi->demux.dmx.connect_frontend(&dvb_spi->demux.dmx,
+						&dvb_spi->dmx_fe);
+	if (ret < 0) {
+		dev_err(&spi->dev, "%s: dvb_register_frontend() failed\n",
+			__func__);
+		goto fail_fe_conn;
+	}
+
+	dev_info(&spi->dev, "Sony CXD2880 has successfully attached.\n");
+
+	return 0;
+
+fail_fe_conn:
+	dvb_spi->demux.dmx.remove_frontend(&dvb_spi->demux.dmx,
+			&dvb_spi->dmx_fe);
+fail_dmx_fe:
+	dvb_dmxdev_release(&dvb_spi->dmxdev);
+fail_dmxdev:
+	dvb_dmx_release(&dvb_spi->demux);
+fail_dmx:
+	dvb_unregister_frontend(&dvb_spi->dvb_fe);
+fail_frontend:
+	dvb_frontend_detach(&dvb_spi->dvb_fe);
+fail_attach:
+	dvb_unregister_adapter(&dvb_spi->adapter);
+fail_adapter:
+	kfree(dvb_spi);
+	return ret;
+}
+
+static int
+cxd2880_spi_remove(struct spi_device *spi)
+{
+	struct cxd2880_dvb_spi *dvb_spi;
+
+	if (!spi) {
+		pr_err("%s: invalid arg\n", __func__);
+		return -EINVAL;
+	}
+
+	dvb_spi = (struct cxd2880_dvb_spi *)dev_get_drvdata(&spi->dev);
+
+	if (!dvb_spi) {
+		pr_err("%s: failed\n", __func__);
+		return -EINVAL;
+	}
+	dvb_spi->demux.dmx.remove_frontend(&dvb_spi->demux.dmx,
+					&dvb_spi->dmx_fe);
+	dvb_dmxdev_release(&dvb_spi->dmxdev);
+	dvb_dmx_release(&dvb_spi->demux);
+	dvb_unregister_frontend(&dvb_spi->dvb_fe);
+	dvb_frontend_detach(&dvb_spi->dvb_fe);
+	dvb_unregister_adapter(&dvb_spi->adapter);
+
+	kfree(dvb_spi);
+	dev_info(&spi->dev, "%s: cxd2880_spi remove ok.\n", __func__);
+
+	return 0;
+}
+
+static const struct spi_device_id cxd2880_spi_id[] = {
+	{ "cxd2880", 0 },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(spi, cxd2880_spi_id);
+
+static struct spi_driver cxd2880_spi_driver = {
+	.driver	= {
+		.name	= "cxd2880",
+		.of_match_table = cxd2880_spi_of_match,
+	},
+	.id_table = cxd2880_spi_id,
+	.probe    = cxd2880_spi_probe,
+	.remove   = cxd2880_spi_remove,
+};
+module_spi_driver(cxd2880_spi_driver);
+
+MODULE_DESCRIPTION(
+"Sony CXD2880 DVB-T2/T tuner + demodulator drvier SPI adapter");
+MODULE_AUTHOR("Sony Semiconductor Solutions Corporation");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
index 95a7b9123f8e..2c1333691666 100644
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -1917,6 +1917,10 @@ static const struct usb_device_id rtl28xxu_id_table[] = {
 		&rtl28xxu_props, "Compro VideoMate U650F", NULL) },
 	{ DVB_USB_DEVICE(USB_VID_KWORLD_2, 0xd394,
 		&rtl28xxu_props, "MaxMedia HU394-T", NULL) },
+	{ DVB_USB_DEVICE(USB_VID_GTEK, 0xb803 /*USB_PID_AUGUST_DVBT205*/,
+		&rtl28xxu_props, "August DVB-T 205", NULL) },
+	{ DVB_USB_DEVICE(USB_VID_GTEK, 0xa803 /*USB_PID_AUGUST_DVBT205*/,
+		&rtl28xxu_props, "August DVB-T 205", NULL) },
 	{ DVB_USB_DEVICE(USB_VID_LEADTEK, 0x6a03,
 		&rtl28xxu_props, "Leadtek WinFast DTV Dongle mini", NULL) },
 	{ DVB_USB_DEVICE(USB_VID_GTEK, USB_PID_CPYTO_REDI_PC50A,
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index fc5e4fef89d2..ec1c75856507 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -10,6 +10,14 @@ config MFD_CORE
 	select IRQ_DOMAIN
 	default n
 
+config MFD_RPISENSE_CORE
+	tristate "Raspberry Pi Sense HAT core functions"
+	depends on I2C
+	select MFD_CORE
+	help
+	  This is the core driver for the Raspberry Pi Sense HAT. This provides
+	  the necessary functions to communicate with the hardware.
+
 config MFD_CS5535
 	tristate "AMD CS5535 and CS5536 southbridge core functions"
 	select MFD_CORE
diff --git a/drivers/mfd/Makefile b/drivers/mfd/Makefile
index 8703ff17998e..b0a1f0049843 100644
--- a/drivers/mfd/Makefile
+++ b/drivers/mfd/Makefile
@@ -227,3 +227,4 @@ obj-$(CONFIG_MFD_SUN4I_GPADC)	+= sun4i-gpadc.o
 obj-$(CONFIG_MFD_STM32_LPTIMER)	+= stm32-lptimer.o
 obj-$(CONFIG_MFD_STM32_TIMERS) 	+= stm32-timers.o
 obj-$(CONFIG_MFD_MXS_LRADC)     += mxs-lradc.o
+obj-$(CONFIG_MFD_RPISENSE_CORE)	+= rpisense-core.o
diff --git a/drivers/mfd/rpisense-core.c b/drivers/mfd/rpisense-core.c
new file mode 100644
index 000000000000..eea9312dc96a
--- /dev/null
+++ b/drivers/mfd/rpisense-core.c
@@ -0,0 +1,157 @@
+/*
+ * Raspberry Pi Sense HAT core driver
+ * http://raspberrypi.org
+ *
+ * Copyright (C) 2015 Raspberry Pi
+ *
+ * Author: Serge Schneider
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ *  This driver is based on wm8350 implementation.
+ */
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/err.h>
+#include <linux/init.h>
+#include <linux/i2c.h>
+#include <linux/platform_device.h>
+#include <linux/mfd/rpisense/core.h>
+#include <linux/slab.h>
+
+static struct rpisense *rpisense;
+
+static void rpisense_client_dev_register(struct rpisense *rpisense,
+					 const char *name,
+					 struct platform_device **pdev)
+{
+	int ret;
+
+	*pdev = platform_device_alloc(name, -1);
+	if (*pdev == NULL) {
+		dev_err(rpisense->dev, "Failed to allocate %s\n", name);
+		return;
+	}
+
+	(*pdev)->dev.parent = rpisense->dev;
+	platform_set_drvdata(*pdev, rpisense);
+	ret = platform_device_add(*pdev);
+	if (ret != 0) {
+		dev_err(rpisense->dev, "Failed to register %s: %d\n",
+			name, ret);
+		platform_device_put(*pdev);
+		*pdev = NULL;
+	}
+}
+
+static int rpisense_probe(struct i2c_client *i2c,
+			       const struct i2c_device_id *id)
+{
+	int ret;
+	struct rpisense_js *rpisense_js;
+
+	rpisense = devm_kzalloc(&i2c->dev, sizeof(struct rpisense), GFP_KERNEL);
+	if (rpisense == NULL)
+		return -ENOMEM;
+
+	i2c_set_clientdata(i2c, rpisense);
+	rpisense->dev = &i2c->dev;
+	rpisense->i2c_client = i2c;
+
+	ret = rpisense_reg_read(rpisense, RPISENSE_WAI);
+	if (ret > 0) {
+		if (ret != 's')
+			return -EINVAL;
+	} else {
+		return ret;
+	}
+	ret = rpisense_reg_read(rpisense, RPISENSE_VER);
+	if (ret < 0)
+		return ret;
+
+	dev_info(rpisense->dev,
+		 "Raspberry Pi Sense HAT firmware version %i\n", ret);
+
+	rpisense_js = &rpisense->joystick;
+	rpisense_js->keys_desc = devm_gpiod_get(&i2c->dev,
+						"keys-int", GPIOD_IN);
+	if (IS_ERR(rpisense_js->keys_desc)) {
+		dev_warn(&i2c->dev, "Failed to get keys-int descriptor.\n");
+		rpisense_js->keys_desc = gpio_to_desc(23);
+		if (rpisense_js->keys_desc == NULL) {
+			dev_err(&i2c->dev, "GPIO23 fallback failed.\n");
+			return PTR_ERR(rpisense_js->keys_desc);
+		}
+	}
+	rpisense_client_dev_register(rpisense, "rpi-sense-js",
+				     &(rpisense->joystick.pdev));
+	rpisense_client_dev_register(rpisense, "rpi-sense-fb",
+				     &(rpisense->framebuffer.pdev));
+
+	return 0;
+}
+
+static int rpisense_remove(struct i2c_client *i2c)
+{
+	struct rpisense *rpisense = i2c_get_clientdata(i2c);
+
+	platform_device_unregister(rpisense->joystick.pdev);
+	return 0;
+}
+
+struct rpisense *rpisense_get_dev(void)
+{
+	return rpisense;
+}
+EXPORT_SYMBOL_GPL(rpisense_get_dev);
+
+s32 rpisense_reg_read(struct rpisense *rpisense, int reg)
+{
+	int ret = i2c_smbus_read_byte_data(rpisense->i2c_client, reg);
+
+	if (ret < 0)
+		dev_err(rpisense->dev, "Read from reg %d failed\n", reg);
+	/* Due to the BCM270x I2C clock stretching bug, some values
+	 * may have MSB set. Clear it to avoid incorrect values.
+	 * */
+	return ret & 0x7F;
+}
+EXPORT_SYMBOL_GPL(rpisense_reg_read);
+
+int rpisense_block_write(struct rpisense *rpisense, const char *buf, int count)
+{
+	int ret = i2c_master_send(rpisense->i2c_client, buf, count);
+
+	if (ret < 0)
+		dev_err(rpisense->dev, "Block write failed\n");
+	return ret;
+}
+EXPORT_SYMBOL_GPL(rpisense_block_write);
+
+static const struct i2c_device_id rpisense_i2c_id[] = {
+	{ "rpi-sense", 0 },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, rpisense_i2c_id);
+
+
+static struct i2c_driver rpisense_driver = {
+	.driver = {
+		   .name = "rpi-sense",
+		   .owner = THIS_MODULE,
+	},
+	.probe = rpisense_probe,
+	.remove = rpisense_remove,
+	.id_table = rpisense_i2c_id,
+};
+
+module_i2c_driver(rpisense_driver);
+
+MODULE_DESCRIPTION("Raspberry Pi Sense HAT core driver");
+MODULE_AUTHOR("Serge Schneider <serge@raspberrypi.org>");
+MODULE_LICENSE("GPL");
+
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 8136dc7e863d..3db74632766e 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -10,6 +10,14 @@ config SENSORS_LIS3LV02D
 	select INPUT_POLLDEV
 	default n
 
+config BCM2835_SMI
+	tristate "Broadcom 283x Secondary Memory Interface driver"
+	depends on ARCH_BCM2835
+	default m
+	help
+		Driver for enabling and using Broadcom's Secondary/Slow Memory Interface.
+		Appears as /dev/bcm2835_smi. For ioctl interface see drivers/misc/bcm2835_smi.h
+
 config AD525X_DPOT
 	tristate "Analog Devices Digital Potentiometers"
 	depends on (I2C || SPI) && SYSFS
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index ad0e64fdba34..db70f5c0e504 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -10,6 +10,7 @@ obj-$(CONFIG_AD525X_DPOT_SPI)	+= ad525x_dpot-spi.o
 obj-$(CONFIG_INTEL_MID_PTI)	+= pti.o
 obj-$(CONFIG_ATMEL_SSC)		+= atmel-ssc.o
 obj-$(CONFIG_ATMEL_TCLIB)	+= atmel_tclib.o
+obj-$(CONFIG_BCM2835_SMI)	+= bcm2835_smi.o
 obj-$(CONFIG_DUMMY_IRQ)		+= dummy-irq.o
 obj-$(CONFIG_ICS932S401)	+= ics932s401.o
 obj-$(CONFIG_LKDTM)		+= lkdtm.o
diff --git a/drivers/misc/bcm2835_smi.c b/drivers/misc/bcm2835_smi.c
new file mode 100644
index 000000000000..126154070312
--- /dev/null
+++ b/drivers/misc/bcm2835_smi.c
@@ -0,0 +1,955 @@
+/**
+ * Broadcom Secondary Memory Interface driver
+ *
+ * Written by Luke Wren <luke@raspberrypi.org>
+ * Copyright (c) 2015, Raspberry Pi (Trading) Ltd.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2, as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <linux/clk.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/of_address.h>
+#include <linux/of_platform.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/pagemap.h>
+#include <linux/dma-mapping.h>
+#include <linux/dmaengine.h>
+#include <linux/semaphore.h>
+#include <linux/spinlock.h>
+#include <linux/io.h>
+
+#define BCM2835_SMI_IMPLEMENTATION
+#include <linux/broadcom/bcm2835_smi.h>
+
+#define DRIVER_NAME "smi-bcm2835"
+
+#define N_PAGES_FROM_BYTES(n) ((n + PAGE_SIZE-1) / PAGE_SIZE)
+
+#define DMA_WRITE_TO_MEM true
+#define DMA_READ_FROM_MEM false
+
+struct bcm2835_smi_instance {
+	struct device *dev;
+	struct smi_settings settings;
+	__iomem void *smi_regs_ptr;
+	dma_addr_t smi_regs_busaddr;
+
+	struct dma_chan *dma_chan;
+	struct dma_slave_config dma_config;
+
+	struct bcm2835_smi_bounce_info bounce;
+
+	struct scatterlist buffer_sgl;
+
+	struct clk *clk;
+
+	/* Sometimes we are called into in an atomic context (e.g. by
+	   JFFS2 + MTD) so we can't use a mutex */
+	spinlock_t transaction_lock;
+};
+
+/****************************************************************************
+*
+*   SMI peripheral setup
+*
+***************************************************************************/
+
+static inline void write_smi_reg(struct bcm2835_smi_instance *inst,
+	u32 val, unsigned reg)
+{
+	writel(val, inst->smi_regs_ptr + reg);
+}
+
+static inline u32 read_smi_reg(struct bcm2835_smi_instance *inst, unsigned reg)
+{
+	return readl(inst->smi_regs_ptr + reg);
+}
+
+/* Token-paste macro for e.g SMIDSR_RSTROBE ->  value of SMIDSR_RSTROBE_MASK */
+#define _CONCAT(x, y) x##y
+#define CONCAT(x, y) _CONCAT(x, y)
+
+#define SET_BIT_FIELD(dest, field, bits) ((dest) = \
+	((dest) & ~CONCAT(field, _MASK)) | (((bits) << CONCAT(field, _OFFS))& \
+	 CONCAT(field, _MASK)))
+#define GET_BIT_FIELD(src, field) (((src) & \
+	CONCAT(field, _MASK)) >> CONCAT(field, _OFFS))
+
+static void smi_dump_context_labelled(struct bcm2835_smi_instance *inst,
+	const char *label)
+{
+	dev_err(inst->dev, "SMI context dump: %s", label);
+	dev_err(inst->dev, "SMICS:  0x%08x", read_smi_reg(inst, SMICS));
+	dev_err(inst->dev, "SMIL:   0x%08x", read_smi_reg(inst, SMIL));
+	dev_err(inst->dev, "SMIDSR: 0x%08x", read_smi_reg(inst, SMIDSR0));
+	dev_err(inst->dev, "SMIDSW: 0x%08x", read_smi_reg(inst, SMIDSW0));
+	dev_err(inst->dev, "SMIDC:  0x%08x", read_smi_reg(inst, SMIDC));
+	dev_err(inst->dev, "SMIFD:  0x%08x", read_smi_reg(inst, SMIFD));
+	dev_err(inst->dev, " ");
+}
+
+static inline void smi_dump_context(struct bcm2835_smi_instance *inst)
+{
+	smi_dump_context_labelled(inst, "");
+}
+
+static void smi_get_default_settings(struct bcm2835_smi_instance *inst)
+{
+	struct smi_settings *settings = &inst->settings;
+
+	settings->data_width = SMI_WIDTH_16BIT;
+	settings->pack_data = true;
+
+	settings->read_setup_time = 1;
+	settings->read_hold_time = 1;
+	settings->read_pace_time = 1;
+	settings->read_strobe_time = 3;
+
+	settings->write_setup_time = settings->read_setup_time;
+	settings->write_hold_time = settings->read_hold_time;
+	settings->write_pace_time = settings->read_pace_time;
+	settings->write_strobe_time = settings->read_strobe_time;
+
+	settings->dma_enable = true;
+	settings->dma_passthrough_enable = false;
+	settings->dma_read_thresh = 0x01;
+	settings->dma_write_thresh = 0x3f;
+	settings->dma_panic_read_thresh = 0x20;
+	settings->dma_panic_write_thresh = 0x20;
+}
+
+void bcm2835_smi_set_regs_from_settings(struct bcm2835_smi_instance *inst)
+{
+	struct smi_settings *settings = &inst->settings;
+	int smidsr_temp = 0, smidsw_temp = 0, smics_temp,
+	    smidcs_temp, smidc_temp = 0;
+
+	spin_lock(&inst->transaction_lock);
+
+	/* temporarily disable the peripheral: */
+	smics_temp = read_smi_reg(inst, SMICS);
+	write_smi_reg(inst, 0, SMICS);
+	smidcs_temp = read_smi_reg(inst, SMIDCS);
+	write_smi_reg(inst, 0, SMIDCS);
+
+	if (settings->pack_data)
+		smics_temp |= SMICS_PXLDAT;
+	else
+		smics_temp &= ~SMICS_PXLDAT;
+
+	SET_BIT_FIELD(smidsr_temp, SMIDSR_RWIDTH, settings->data_width);
+	SET_BIT_FIELD(smidsr_temp, SMIDSR_RSETUP, settings->read_setup_time);
+	SET_BIT_FIELD(smidsr_temp, SMIDSR_RHOLD, settings->read_hold_time);
+	SET_BIT_FIELD(smidsr_temp, SMIDSR_RPACE, settings->read_pace_time);
+	SET_BIT_FIELD(smidsr_temp, SMIDSR_RSTROBE, settings->read_strobe_time);
+	write_smi_reg(inst, smidsr_temp, SMIDSR0);
+
+	SET_BIT_FIELD(smidsw_temp, SMIDSW_WWIDTH, settings->data_width);
+	if (settings->data_width == SMI_WIDTH_8BIT)
+		smidsw_temp |= SMIDSW_WSWAP;
+	else
+		smidsw_temp &= ~SMIDSW_WSWAP;
+	SET_BIT_FIELD(smidsw_temp, SMIDSW_WSETUP, settings->write_setup_time);
+	SET_BIT_FIELD(smidsw_temp, SMIDSW_WHOLD, settings->write_hold_time);
+	SET_BIT_FIELD(smidsw_temp, SMIDSW_WPACE, settings->write_pace_time);
+	SET_BIT_FIELD(smidsw_temp, SMIDSW_WSTROBE,
+			settings->write_strobe_time);
+	write_smi_reg(inst, smidsw_temp, SMIDSW0);
+
+	SET_BIT_FIELD(smidc_temp, SMIDC_REQR, settings->dma_read_thresh);
+	SET_BIT_FIELD(smidc_temp, SMIDC_REQW, settings->dma_write_thresh);
+	SET_BIT_FIELD(smidc_temp, SMIDC_PANICR,
+		      settings->dma_panic_read_thresh);
+	SET_BIT_FIELD(smidc_temp, SMIDC_PANICW,
+		      settings->dma_panic_write_thresh);
+	if (settings->dma_passthrough_enable) {
+		smidc_temp |= SMIDC_DMAP;
+		smidsr_temp |= SMIDSR_RDREQ;
+		write_smi_reg(inst, smidsr_temp, SMIDSR0);
+		smidsw_temp |= SMIDSW_WDREQ;
+		write_smi_reg(inst, smidsw_temp, SMIDSW0);
+	} else
+		smidc_temp &= ~SMIDC_DMAP;
+	if (settings->dma_enable)
+		smidc_temp |= SMIDC_DMAEN;
+	else
+		smidc_temp &= ~SMIDC_DMAEN;
+
+	write_smi_reg(inst, smidc_temp, SMIDC);
+
+	/* re-enable (if was previously enabled) */
+	write_smi_reg(inst, smics_temp, SMICS);
+	write_smi_reg(inst, smidcs_temp, SMIDCS);
+
+	spin_unlock(&inst->transaction_lock);
+}
+EXPORT_SYMBOL(bcm2835_smi_set_regs_from_settings);
+
+struct smi_settings *bcm2835_smi_get_settings_from_regs
+	(struct bcm2835_smi_instance *inst)
+{
+	struct smi_settings *settings = &inst->settings;
+	int smidsr, smidsw, smidc;
+
+	spin_lock(&inst->transaction_lock);
+
+	smidsr = read_smi_reg(inst, SMIDSR0);
+	smidsw = read_smi_reg(inst, SMIDSW0);
+	smidc = read_smi_reg(inst, SMIDC);
+
+	settings->pack_data = (read_smi_reg(inst, SMICS) & SMICS_PXLDAT) ?
+	    true : false;
+
+	settings->data_width = GET_BIT_FIELD(smidsr, SMIDSR_RWIDTH);
+	settings->read_setup_time = GET_BIT_FIELD(smidsr, SMIDSR_RSETUP);
+	settings->read_hold_time = GET_BIT_FIELD(smidsr, SMIDSR_RHOLD);
+	settings->read_pace_time = GET_BIT_FIELD(smidsr, SMIDSR_RPACE);
+	settings->read_strobe_time = GET_BIT_FIELD(smidsr, SMIDSR_RSTROBE);
+
+	settings->write_setup_time = GET_BIT_FIELD(smidsw, SMIDSW_WSETUP);
+	settings->write_hold_time = GET_BIT_FIELD(smidsw, SMIDSW_WHOLD);
+	settings->write_pace_time = GET_BIT_FIELD(smidsw, SMIDSW_WPACE);
+	settings->write_strobe_time = GET_BIT_FIELD(smidsw, SMIDSW_WSTROBE);
+
+	settings->dma_read_thresh = GET_BIT_FIELD(smidc, SMIDC_REQR);
+	settings->dma_write_thresh = GET_BIT_FIELD(smidc, SMIDC_REQW);
+	settings->dma_panic_read_thresh = GET_BIT_FIELD(smidc, SMIDC_PANICR);
+	settings->dma_panic_write_thresh = GET_BIT_FIELD(smidc, SMIDC_PANICW);
+	settings->dma_passthrough_enable = (smidc & SMIDC_DMAP) ? true : false;
+	settings->dma_enable = (smidc & SMIDC_DMAEN) ? true : false;
+
+	spin_unlock(&inst->transaction_lock);
+
+	return settings;
+}
+EXPORT_SYMBOL(bcm2835_smi_get_settings_from_regs);
+
+static inline void smi_set_address(struct bcm2835_smi_instance *inst,
+	unsigned int address)
+{
+	int smia_temp = 0, smida_temp = 0;
+
+	SET_BIT_FIELD(smia_temp, SMIA_ADDR, address);
+	SET_BIT_FIELD(smida_temp, SMIDA_ADDR, address);
+
+	/* Write to both address registers - user doesn't care whether we're
+	   doing programmed or direct transfers. */
+	write_smi_reg(inst, smia_temp, SMIA);
+	write_smi_reg(inst, smida_temp, SMIDA);
+}
+
+static void smi_setup_regs(struct bcm2835_smi_instance *inst)
+{
+
+	dev_dbg(inst->dev, "Initialising SMI registers...");
+	/* Disable the peripheral if already enabled */
+	write_smi_reg(inst, 0, SMICS);
+	write_smi_reg(inst, 0, SMIDCS);
+
+	smi_get_default_settings(inst);
+	bcm2835_smi_set_regs_from_settings(inst);
+	smi_set_address(inst, 0);
+
+	write_smi_reg(inst, read_smi_reg(inst, SMICS) | SMICS_ENABLE, SMICS);
+	write_smi_reg(inst, read_smi_reg(inst, SMIDCS) | SMIDCS_ENABLE,
+		SMIDCS);
+}
+
+/****************************************************************************
+*
+*   Low-level SMI access functions
+*   Other modules should use the exported higher-level functions e.g.
+*   bcm2835_smi_write_buf() unless they have a good reason to use these
+*
+***************************************************************************/
+
+static inline uint32_t smi_read_single_word(struct bcm2835_smi_instance *inst)
+{
+	int timeout = 0;
+
+	write_smi_reg(inst, SMIDCS_ENABLE, SMIDCS);
+	write_smi_reg(inst, SMIDCS_ENABLE | SMIDCS_START, SMIDCS);
+	/* Make sure things happen in the right order...*/
+	mb();
+	while (!(read_smi_reg(inst, SMIDCS) & SMIDCS_DONE) &&
+		++timeout < 10000)
+		;
+	if (timeout < 10000)
+		return read_smi_reg(inst, SMIDD);
+
+	dev_err(inst->dev,
+		"SMI direct read timed out (is the clock set up correctly?)");
+	return 0;
+}
+
+static inline void smi_write_single_word(struct bcm2835_smi_instance *inst,
+	uint32_t data)
+{
+	int timeout = 0;
+
+	write_smi_reg(inst, SMIDCS_ENABLE | SMIDCS_WRITE, SMIDCS);
+	write_smi_reg(inst, data, SMIDD);
+	write_smi_reg(inst, SMIDCS_ENABLE | SMIDCS_WRITE | SMIDCS_START,
+		SMIDCS);
+
+	while (!(read_smi_reg(inst, SMIDCS) & SMIDCS_DONE) &&
+		++timeout < 10000)
+		;
+	if (timeout >= 10000)
+		dev_err(inst->dev,
+		"SMI direct write timed out (is the clock set up correctly?)");
+}
+
+/* Initiates a programmed read into the read FIFO. It is up to the caller to
+ * read data from the FIFO -  either via paced DMA transfer,
+ * or polling SMICS_RXD to check whether data is available.
+ * SMICS_ACTIVE will go low upon completion. */
+static void smi_init_programmed_read(struct bcm2835_smi_instance *inst,
+	int num_transfers)
+{
+	int smics_temp;
+
+	/* Disable the peripheral: */
+	smics_temp = read_smi_reg(inst, SMICS) & ~(SMICS_ENABLE | SMICS_WRITE);
+	write_smi_reg(inst, smics_temp, SMICS);
+	while (read_smi_reg(inst, SMICS) & SMICS_ENABLE)
+		;
+
+	/* Program the transfer count: */
+	write_smi_reg(inst, num_transfers, SMIL);
+
+	/* re-enable and start: */
+	smics_temp |= SMICS_ENABLE;
+	write_smi_reg(inst, smics_temp, SMICS);
+	smics_temp |= SMICS_CLEAR;
+	/* Just to be certain: */
+	mb();
+	while (read_smi_reg(inst, SMICS) & SMICS_ACTIVE)
+		;
+	write_smi_reg(inst, smics_temp, SMICS);
+	smics_temp |= SMICS_START;
+	write_smi_reg(inst, smics_temp, SMICS);
+}
+
+/* Initiates a programmed write sequence, using data from the write FIFO.
+ * It is up to the caller to initiate a DMA transfer before calling,
+ * or use another method to keep the write FIFO topped up.
+ * SMICS_ACTIVE will go low upon completion.
+ */
+static void smi_init_programmed_write(struct bcm2835_smi_instance *inst,
+	int num_transfers)
+{
+	int smics_temp;
+
+	/* Disable the peripheral: */
+	smics_temp = read_smi_reg(inst, SMICS) & ~SMICS_ENABLE;
+	write_smi_reg(inst, smics_temp, SMICS);
+	while (read_smi_reg(inst, SMICS) & SMICS_ENABLE)
+		;
+
+	/* Program the transfer count: */
+	write_smi_reg(inst, num_transfers, SMIL);
+
+	/* setup, re-enable and start: */
+	smics_temp |= SMICS_WRITE | SMICS_ENABLE;
+	write_smi_reg(inst, smics_temp, SMICS);
+	smics_temp |= SMICS_START;
+	write_smi_reg(inst, smics_temp, SMICS);
+}
+
+/* Initiate a read and then poll FIFO for data, reading out as it appears. */
+static void smi_read_fifo(struct bcm2835_smi_instance *inst,
+	uint32_t *dest, int n_bytes)
+{
+	if (read_smi_reg(inst, SMICS) & SMICS_RXD) {
+		smi_dump_context_labelled(inst,
+			"WARNING: read FIFO not empty at start of read call.");
+		while (read_smi_reg(inst, SMICS))
+			;
+	}
+
+	/* Dispatch the read: */
+	if (inst->settings.data_width == SMI_WIDTH_8BIT)
+		smi_init_programmed_read(inst, n_bytes);
+	else if (inst->settings.data_width == SMI_WIDTH_16BIT)
+		smi_init_programmed_read(inst, n_bytes / 2);
+	else {
+		dev_err(inst->dev, "Unsupported data width for read.");
+		return;
+	}
+
+	/* Poll FIFO to keep it empty */
+	while (!(read_smi_reg(inst, SMICS) & SMICS_DONE))
+		if (read_smi_reg(inst, SMICS) & SMICS_RXD)
+			*dest++ = read_smi_reg(inst, SMID);
+
+	/* Ensure that the FIFO is emptied */
+	if (read_smi_reg(inst, SMICS) & SMICS_RXD) {
+		int fifo_count;
+
+		fifo_count = GET_BIT_FIELD(read_smi_reg(inst, SMIFD),
+			SMIFD_FCNT);
+		while (fifo_count--)
+			*dest++ = read_smi_reg(inst, SMID);
+	}
+
+	if (!(read_smi_reg(inst, SMICS) & SMICS_DONE))
+		smi_dump_context_labelled(inst,
+			"WARNING: transaction finished but done bit not set.");
+
+	if (read_smi_reg(inst, SMICS) & SMICS_RXD)
+		smi_dump_context_labelled(inst,
+			"WARNING: read FIFO not empty at end of read call.");
+
+}
+
+/* Initiate a write, and then keep the FIFO topped up. */
+static void smi_write_fifo(struct bcm2835_smi_instance *inst,
+	uint32_t *src, int n_bytes)
+{
+	int i, timeout = 0;
+
+	/* Empty FIFOs if not already so */
+	if (!(read_smi_reg(inst, SMICS) & SMICS_TXE)) {
+		smi_dump_context_labelled(inst,
+		    "WARNING: write fifo not empty at start of write call.");
+		write_smi_reg(inst, read_smi_reg(inst, SMICS) | SMICS_CLEAR,
+			SMICS);
+	}
+
+	/* Initiate the transfer */
+	if (inst->settings.data_width == SMI_WIDTH_8BIT)
+		smi_init_programmed_write(inst, n_bytes);
+	else if (inst->settings.data_width == SMI_WIDTH_16BIT)
+		smi_init_programmed_write(inst, n_bytes / 2);
+	else {
+		dev_err(inst->dev, "Unsupported data width for write.");
+		return;
+	}
+	/* Fill the FIFO: */
+	for (i = 0; i < (n_bytes - 1) / 4 + 1; ++i) {
+		while (!(read_smi_reg(inst, SMICS) & SMICS_TXD))
+			;
+		write_smi_reg(inst, *src++, SMID);
+	}
+	/* Busy wait... */
+	while (!(read_smi_reg(inst, SMICS) & SMICS_DONE) && ++timeout <
+		1000000)
+		;
+	if (timeout >= 1000000)
+		smi_dump_context_labelled(inst,
+			"Timed out on write operation!");
+	if (!(read_smi_reg(inst, SMICS) & SMICS_TXE))
+		smi_dump_context_labelled(inst,
+			"WARNING: FIFO not empty at end of write operation.");
+}
+
+/****************************************************************************
+*
+*   SMI DMA operations
+*
+***************************************************************************/
+
+/* Disable SMI and put it into the correct direction before doing DMA setup.
+   Stops spurious DREQs during setup. Peripheral is re-enabled by init_*() */
+static void smi_disable(struct bcm2835_smi_instance *inst,
+	enum dma_transfer_direction direction)
+{
+	int smics_temp = read_smi_reg(inst, SMICS) & ~SMICS_ENABLE;
+
+	if (direction == DMA_DEV_TO_MEM)
+		smics_temp &= ~SMICS_WRITE;
+	else
+		smics_temp |= SMICS_WRITE;
+	write_smi_reg(inst, smics_temp, SMICS);
+	while (read_smi_reg(inst, SMICS) & SMICS_ACTIVE)
+		;
+}
+
+static struct scatterlist *smi_scatterlist_from_buffer(
+	struct bcm2835_smi_instance *inst,
+	dma_addr_t buf,
+	size_t len,
+	struct scatterlist *sg)
+{
+	sg_init_table(sg, 1);
+	sg_dma_address(sg) = buf;
+	sg_dma_len(sg) = len;
+	return sg;
+}
+
+static void smi_dma_callback_user_copy(void *param)
+{
+	/* Notify the bottom half that a chunk is ready for user copy */
+	struct bcm2835_smi_instance *inst =
+		(struct bcm2835_smi_instance *)param;
+
+	up(&inst->bounce.callback_sem);
+}
+
+/* Creates a descriptor, assigns the given callback, and submits the
+   descriptor to dmaengine. Does not block - can queue up multiple
+   descriptors and then wait for them all to complete.
+   sg_len is the number of control blocks, NOT the number of bytes.
+   dir can be DMA_MEM_TO_DEV or DMA_DEV_TO_MEM.
+   callback can be NULL - in this case it is not called. */
+static inline struct dma_async_tx_descriptor *smi_dma_submit_sgl(
+	struct bcm2835_smi_instance *inst,
+	struct scatterlist *sgl,
+	size_t sg_len,
+	enum dma_transfer_direction dir,
+	dma_async_tx_callback callback)
+{
+	struct dma_async_tx_descriptor *desc;
+
+	desc = dmaengine_prep_slave_sg(inst->dma_chan,
+				       sgl,
+				       sg_len,
+				       dir,
+				       DMA_PREP_INTERRUPT | DMA_CTRL_ACK |
+				       DMA_PREP_FENCE);
+	if (!desc) {
+		dev_err(inst->dev, "read_sgl: dma slave preparation failed!");
+		write_smi_reg(inst, read_smi_reg(inst, SMICS) & ~SMICS_ACTIVE,
+			SMICS);
+		while (read_smi_reg(inst, SMICS) & SMICS_ACTIVE)
+			cpu_relax();
+		write_smi_reg(inst, read_smi_reg(inst, SMICS) | SMICS_ACTIVE,
+			SMICS);
+		return NULL;
+	}
+	desc->callback = callback;
+	desc->callback_param = inst;
+	if (dmaengine_submit(desc) < 0)
+		return NULL;
+	return desc;
+}
+
+/* NB this function blocks until the transfer is complete */
+static void
+smi_dma_read_sgl(struct bcm2835_smi_instance *inst,
+	struct scatterlist *sgl, size_t sg_len, size_t n_bytes)
+{
+	struct dma_async_tx_descriptor *desc;
+
+	/* Disable SMI and set to read before dispatching DMA - if SMI is in
+	 * write mode and TX fifo is empty, it will generate a DREQ which may
+	 * cause the read DMA to complete before the SMI read command is even
+	 * dispatched! We want to dispatch DMA before SMI read so that reading
+	 * is gapless, for logic analyser.
+	 */
+
+	smi_disable(inst, DMA_DEV_TO_MEM);
+
+	desc = smi_dma_submit_sgl(inst, sgl, sg_len, DMA_DEV_TO_MEM, NULL);
+	dma_async_issue_pending(inst->dma_chan);
+
+	if (inst->settings.data_width == SMI_WIDTH_8BIT)
+		smi_init_programmed_read(inst, n_bytes);
+	else
+		smi_init_programmed_read(inst, n_bytes / 2);
+
+	if (dma_wait_for_async_tx(desc) == DMA_ERROR)
+		smi_dump_context_labelled(inst, "DMA timeout!");
+}
+
+static void
+smi_dma_write_sgl(struct bcm2835_smi_instance *inst,
+	struct scatterlist *sgl, size_t sg_len, size_t n_bytes)
+{
+	struct dma_async_tx_descriptor *desc;
+
+	if (inst->settings.data_width == SMI_WIDTH_8BIT)
+		smi_init_programmed_write(inst, n_bytes);
+	else
+		smi_init_programmed_write(inst, n_bytes / 2);
+
+	desc = smi_dma_submit_sgl(inst, sgl, sg_len, DMA_MEM_TO_DEV, NULL);
+	dma_async_issue_pending(inst->dma_chan);
+
+	if (dma_wait_for_async_tx(desc) == DMA_ERROR)
+		smi_dump_context_labelled(inst, "DMA timeout!");
+	else
+		/* Wait for SMI to finish our writes */
+		while (!(read_smi_reg(inst, SMICS) & SMICS_DONE))
+			cpu_relax();
+}
+
+ssize_t bcm2835_smi_user_dma(
+	struct bcm2835_smi_instance *inst,
+	enum dma_transfer_direction dma_dir,
+	char __user *user_ptr, size_t count,
+	struct bcm2835_smi_bounce_info **bounce)
+{
+	int chunk_no = 0, chunk_size, count_left = count;
+	struct scatterlist *sgl;
+	void (*init_trans_func)(struct bcm2835_smi_instance *, int);
+
+	spin_lock(&inst->transaction_lock);
+
+	if (dma_dir == DMA_DEV_TO_MEM)
+		init_trans_func = smi_init_programmed_read;
+	else
+		init_trans_func = smi_init_programmed_write;
+
+	smi_disable(inst, dma_dir);
+
+	sema_init(&inst->bounce.callback_sem, 0);
+	if (bounce)
+		*bounce = &inst->bounce;
+	while (count_left) {
+		chunk_size = count_left > DMA_BOUNCE_BUFFER_SIZE ?
+			DMA_BOUNCE_BUFFER_SIZE : count_left;
+		if (chunk_size == DMA_BOUNCE_BUFFER_SIZE) {
+			sgl =
+			&inst->bounce.sgl[chunk_no % DMA_BOUNCE_BUFFER_COUNT];
+		} else {
+			sgl = smi_scatterlist_from_buffer(
+				inst,
+				inst->bounce.phys[
+					chunk_no % DMA_BOUNCE_BUFFER_COUNT],
+				chunk_size,
+				&inst->buffer_sgl);
+		}
+
+		if (!smi_dma_submit_sgl(inst, sgl, 1, dma_dir,
+			smi_dma_callback_user_copy
+		)) {
+			dev_err(inst->dev, "sgl submit failed");
+			count = 0;
+			goto out;
+		}
+		count_left -= chunk_size;
+		chunk_no++;
+	}
+	dma_async_issue_pending(inst->dma_chan);
+
+	if (inst->settings.data_width == SMI_WIDTH_8BIT)
+		init_trans_func(inst, count);
+	else if (inst->settings.data_width == SMI_WIDTH_16BIT)
+		init_trans_func(inst, count / 2);
+out:
+	spin_unlock(&inst->transaction_lock);
+	return count;
+}
+EXPORT_SYMBOL(bcm2835_smi_user_dma);
+
+
+/****************************************************************************
+*
+*   High level buffer transfer functions - for use by other drivers
+*
+***************************************************************************/
+
+/* Buffer must be physically contiguous - i.e. kmalloc, not vmalloc! */
+void bcm2835_smi_write_buf(
+	struct bcm2835_smi_instance *inst,
+	const void *buf, size_t n_bytes)
+{
+	int odd_bytes = n_bytes & 0x3;
+
+	n_bytes -= odd_bytes;
+
+	spin_lock(&inst->transaction_lock);
+
+	if (n_bytes > DMA_THRESHOLD_BYTES) {
+		dma_addr_t phy_addr = dma_map_single(
+			inst->dev,
+			(void *)buf,
+			n_bytes,
+			DMA_MEM_TO_DEV);
+		struct scatterlist *sgl =
+			smi_scatterlist_from_buffer(inst, phy_addr, n_bytes,
+				&inst->buffer_sgl);
+
+		if (!sgl) {
+			smi_dump_context_labelled(inst,
+			"Error: could not create scatterlist for write!");
+			goto out;
+		}
+		smi_dma_write_sgl(inst, sgl, 1, n_bytes);
+
+		dma_unmap_single
+			(inst->dev, phy_addr, n_bytes, DMA_MEM_TO_DEV);
+	} else if (n_bytes) {
+		smi_write_fifo(inst, (uint32_t *) buf, n_bytes);
+	}
+	buf += n_bytes;
+
+	if (inst->settings.data_width == SMI_WIDTH_8BIT) {
+		while (odd_bytes--)
+			smi_write_single_word(inst, *(uint8_t *) (buf++));
+	} else {
+		while (odd_bytes >= 2) {
+			smi_write_single_word(inst, *(uint16_t *)buf);
+			buf += 2;
+			odd_bytes -= 2;
+		}
+		if (odd_bytes) {
+			/* Reading an odd number of bytes on a 16 bit bus is
+			   a user bug. It's kinder to fail early and tell them
+			   than to e.g. transparently give them the bottom byte
+			   of a 16 bit transfer. */
+			dev_err(inst->dev,
+		"WARNING: odd number of bytes specified for wide transfer.");
+			dev_err(inst->dev,
+		"At least one byte dropped as a result.");
+			dump_stack();
+		}
+	}
+out:
+	spin_unlock(&inst->transaction_lock);
+}
+EXPORT_SYMBOL(bcm2835_smi_write_buf);
+
+void bcm2835_smi_read_buf(struct bcm2835_smi_instance *inst,
+	void *buf, size_t n_bytes)
+{
+
+	/* SMI is inherently 32-bit, which causes surprising amounts of mess
+	   for bytes % 4 != 0. Easiest to avoid this mess altogether
+	   by handling remainder separately. */
+	int odd_bytes = n_bytes & 0x3;
+
+	spin_lock(&inst->transaction_lock);
+	n_bytes -= odd_bytes;
+	if (n_bytes > DMA_THRESHOLD_BYTES) {
+		dma_addr_t phy_addr = dma_map_single(inst->dev,
+						     buf, n_bytes,
+						     DMA_DEV_TO_MEM);
+		struct scatterlist *sgl = smi_scatterlist_from_buffer(
+			inst, phy_addr, n_bytes,
+			&inst->buffer_sgl);
+		if (!sgl) {
+			smi_dump_context_labelled(inst,
+			"Error: could not create scatterlist for read!");
+			goto out;
+		}
+		smi_dma_read_sgl(inst, sgl, 1, n_bytes);
+		dma_unmap_single(inst->dev, phy_addr, n_bytes, DMA_DEV_TO_MEM);
+	} else if (n_bytes) {
+		smi_read_fifo(inst, (uint32_t *)buf, n_bytes);
+	}
+	buf += n_bytes;
+
+	if (inst->settings.data_width == SMI_WIDTH_8BIT) {
+		while (odd_bytes--)
+			*((uint8_t *) (buf++)) = smi_read_single_word(inst);
+	} else {
+		while (odd_bytes >= 2) {
+			*(uint16_t *) buf = smi_read_single_word(inst);
+			buf += 2;
+			odd_bytes -= 2;
+		}
+		if (odd_bytes) {
+			dev_err(inst->dev,
+		"WARNING: odd number of bytes specified for wide transfer.");
+			dev_err(inst->dev,
+		"At least one byte dropped as a result.");
+			dump_stack();
+		}
+	}
+out:
+	spin_unlock(&inst->transaction_lock);
+}
+EXPORT_SYMBOL(bcm2835_smi_read_buf);
+
+void bcm2835_smi_set_address(struct bcm2835_smi_instance *inst,
+	unsigned int address)
+{
+	spin_lock(&inst->transaction_lock);
+	smi_set_address(inst, address);
+	spin_unlock(&inst->transaction_lock);
+}
+EXPORT_SYMBOL(bcm2835_smi_set_address);
+
+struct bcm2835_smi_instance *bcm2835_smi_get(struct device_node *node)
+{
+	struct platform_device *pdev;
+
+	if (!node)
+		return NULL;
+
+	pdev = of_find_device_by_node(node);
+	if (!pdev)
+		return NULL;
+
+	return platform_get_drvdata(pdev);
+}
+EXPORT_SYMBOL(bcm2835_smi_get);
+
+/****************************************************************************
+*
+*   bcm2835_smi_probe - called when the driver is loaded.
+*
+***************************************************************************/
+
+static int bcm2835_smi_dma_setup(struct bcm2835_smi_instance *inst)
+{
+	int i, rv = 0;
+
+	inst->dma_chan = dma_request_slave_channel(inst->dev, "rx-tx");
+
+	inst->dma_config.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+	inst->dma_config.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+	inst->dma_config.src_addr = inst->smi_regs_busaddr + SMID;
+	inst->dma_config.dst_addr = inst->dma_config.src_addr;
+	/* Direction unimportant - always overridden by prep_slave_sg */
+	inst->dma_config.direction = DMA_DEV_TO_MEM;
+	dmaengine_slave_config(inst->dma_chan, &inst->dma_config);
+	/* Alloc and map bounce buffers */
+	for (i = 0; i < DMA_BOUNCE_BUFFER_COUNT; ++i) {
+		inst->bounce.buffer[i] =
+		dmam_alloc_coherent(inst->dev, DMA_BOUNCE_BUFFER_SIZE,
+				&inst->bounce.phys[i],
+				GFP_KERNEL);
+		if (!inst->bounce.buffer[i]) {
+			dev_err(inst->dev, "Could not allocate buffer!");
+			rv = -ENOMEM;
+			break;
+		}
+		smi_scatterlist_from_buffer(
+			inst,
+			inst->bounce.phys[i],
+			DMA_BOUNCE_BUFFER_SIZE,
+			&inst->bounce.sgl[i]
+		);
+	}
+
+	return rv;
+}
+
+static int bcm2835_smi_probe(struct platform_device *pdev)
+{
+	int err;
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
+	struct resource *ioresource;
+	struct bcm2835_smi_instance *inst;
+	const __be32 *addr;
+
+	/* We require device tree support */
+	if (!node)
+		return -EINVAL;
+	/* Allocate buffers and instance data */
+	inst = devm_kzalloc(dev, sizeof(struct bcm2835_smi_instance),
+		GFP_KERNEL);
+	if (!inst)
+		return -ENOMEM;
+
+	inst->dev = dev;
+	spin_lock_init(&inst->transaction_lock);
+
+	ioresource = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	inst->smi_regs_ptr = devm_ioremap_resource(dev, ioresource);
+	if (IS_ERR(inst->smi_regs_ptr)) {
+		err = PTR_ERR(inst->smi_regs_ptr);
+		goto err;
+	}
+	addr = of_get_address(node, 0, NULL, NULL);
+	inst->smi_regs_busaddr = be32_to_cpu(addr);
+
+	err = bcm2835_smi_dma_setup(inst);
+	if (err)
+		goto err;
+
+	/* request clock */
+	inst->clk = devm_clk_get(dev, NULL);
+	if (!inst->clk)
+		goto err;
+	clk_prepare_enable(inst->clk);
+
+	/* Finally, do peripheral setup */
+	smi_setup_regs(inst);
+
+	platform_set_drvdata(pdev, inst);
+
+	dev_info(inst->dev, "initialised");
+
+	return 0;
+err:
+	kfree(inst);
+	return err;
+}
+
+/****************************************************************************
+*
+*   bcm2835_smi_remove - called when the driver is unloaded.
+*
+***************************************************************************/
+
+static int bcm2835_smi_remove(struct platform_device *pdev)
+{
+	struct bcm2835_smi_instance *inst = platform_get_drvdata(pdev);
+	struct device *dev = inst->dev;
+
+	dmaengine_terminate_all(inst->dma_chan);
+	dma_release_channel(inst->dma_chan);
+
+	clk_disable_unprepare(inst->clk);
+
+	dev_info(dev, "SMI device removed - OK");
+	return 0;
+}
+
+/****************************************************************************
+*
+*   Register the driver with device tree
+*
+***************************************************************************/
+
+static const struct of_device_id bcm2835_smi_of_match[] = {
+	{.compatible = "brcm,bcm2835-smi",},
+	{ /* sentinel */ },
+};
+
+MODULE_DEVICE_TABLE(of, bcm2835_smi_of_match);
+
+static struct platform_driver bcm2835_smi_driver = {
+	.probe = bcm2835_smi_probe,
+	.remove = bcm2835_smi_remove,
+	.driver = {
+		   .name = DRIVER_NAME,
+		   .owner = THIS_MODULE,
+		   .of_match_table = bcm2835_smi_of_match,
+		   },
+};
+
+module_platform_driver(bcm2835_smi_driver);
+
+MODULE_ALIAS("platform:smi-bcm2835");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Device driver for BCM2835's secondary memory interface");
+MODULE_AUTHOR("Luke Wren <luke@raspberrypi.org>");
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 4281fdc0a13c..e7c4eff156fb 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -131,6 +131,13 @@ static DEFINE_MUTEX(open_lock);
 module_param(perdev_minors, int, 0444);
 MODULE_PARM_DESC(perdev_minors, "Minors numbers to allocate per device");
 
+/*
+ * Allow quirks to be overridden for the current card
+ */
+static char *card_quirks;
+module_param(card_quirks, charp, 0644);
+MODULE_PARM_DESC(card_quirks, "Force the use of the indicated quirks (a bitfield)");
+
 static inline int mmc_blk_part_switch(struct mmc_card *card,
 				      unsigned int part_type);
 
@@ -2504,6 +2511,7 @@ static int mmc_blk_probe(struct mmc_card *card)
 {
 	struct mmc_blk_data *md, *part_md;
 	char cap_str[10];
+	char quirk_str[24];
 
 	/*
 	 * Check that the card supports the command class(es) we need.
@@ -2511,7 +2519,16 @@ static int mmc_blk_probe(struct mmc_card *card)
 	if (!(card->csd.cmdclass & CCC_BLOCK_READ))
 		return -ENODEV;
 
-	mmc_fixup_device(card, mmc_blk_fixups);
+	if (card_quirks) {
+		unsigned long quirks;
+		if (kstrtoul(card_quirks, 0, &quirks) == 0)
+			card->quirks = (unsigned int)quirks;
+		else
+			pr_err("mmc_block: Invalid card_quirks parameter '%s'\n",
+			       card_quirks);
+	}
+	else
+		mmc_fixup_device(card, mmc_blk_fixups);
 
 	md = mmc_blk_alloc(card);
 	if (IS_ERR(md))
@@ -2519,9 +2536,14 @@ static int mmc_blk_probe(struct mmc_card *card)
 
 	string_get_size((u64)get_capacity(md->disk), 512, STRING_UNITS_2,
 			cap_str, sizeof(cap_str));
-	pr_info("%s: %s %s %s %s\n",
+	if (card->quirks)
+		snprintf(quirk_str, sizeof(quirk_str),
+			 " (quirks 0x%08x)", card->quirks);
+	else
+		quirk_str[0] = '\0';
+	pr_info("%s: %s %s %s%s%s\n",
 		md->disk->disk_name, mmc_card_id(card), mmc_card_name(card),
-		cap_str, md->read_only ? "(ro)" : "");
+		cap_str, md->read_only ? " (ro)" : "", quirk_str);
 
 	if (mmc_blk_alloc_parts(card, md))
 		goto out;
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 29bfff2ed4d3..77393ea50531 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -2210,7 +2210,8 @@ EXPORT_SYMBOL(mmc_erase);
 int mmc_can_erase(struct mmc_card *card)
 {
 	if ((card->host->caps & MMC_CAP_ERASE) &&
-	    (card->csd.cmdclass & CCC_ERASE) && card->erase_size)
+	    (card->csd.cmdclass & CCC_ERASE) && card->erase_size &&
+	    !(card->quirks & MMC_QUIRK_ERASE_BROKEN))
 		return 1;
 	return 0;
 }
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index ad88deb2e8f3..2b424604e171 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -350,15 +350,30 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
 {
 	int err;
 	struct mmc_host *host;
+	int id;
 
 	host = kzalloc(sizeof(struct mmc_host) + extra, GFP_KERNEL);
 	if (!host)
 		return NULL;
 
+	/* If OF aliases exist, start dynamic assignment after highest */
+	id = of_alias_get_highest_id("mmc");
+	id = (id < 0) ? 0 : id + 1;
+
+	/* If this devices has OF node, maybe it has an alias */
+	if (dev->of_node) {
+		int of_id = of_alias_get_id(dev->of_node, "mmc");
+
+		if (of_id < 0)
+			dev_warn(dev, "/aliases ID not available\n");
+		else
+			id = of_id;
+	}
+
 	/* scanning will be enabled when we're ready */
 	host->rescan_disable = 1;
 
-	err = ida_simple_get(&mmc_host_ida, 0, 0, GFP_KERNEL);
+	err = ida_simple_get(&mmc_host_ida, id, 0, GFP_KERNEL);
 	if (err < 0) {
 		kfree(host);
 		return NULL;
diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
index 5153577754f0..223f3fd1c790 100644
--- a/drivers/mmc/core/quirks.h
+++ b/drivers/mmc/core/quirks.h
@@ -99,6 +99,14 @@ static const struct mmc_fixup mmc_blk_fixups[] = {
 	MMC_FIXUP("V10016", CID_MANFID_KINGSTON, CID_OEMID_ANY, add_quirk_mmc,
 		  MMC_QUIRK_TRIM_BROKEN),
 
+	/*
+	 *  On some Kingston SD cards, multiple erases of less than 64
+	 *  sectors can cause corruption.
+	 */
+	MMC_FIXUP("SD16G", 0x41, 0x3432, add_quirk, MMC_QUIRK_ERASE_BROKEN),
+	MMC_FIXUP("SD32G", 0x41, 0x3432, add_quirk, MMC_QUIRK_ERASE_BROKEN),
+	MMC_FIXUP("SD64G", 0x41, 0x3432, add_quirk, MMC_QUIRK_ERASE_BROKEN),
+
 	END_FIXUP
 };
 
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index 8c15637178ff..91adb0d9936c 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -4,6 +4,45 @@
 
 comment "MMC/SD/SDIO Host Controller Drivers"
 
+config MMC_BCM2835_MMC
+	tristate "MMC support on BCM2835"
+	depends on MACH_BCM2708 || MACH_BCM2709 || ARCH_BCM2835
+	help
+	  This selects the MMC Interface on BCM2835.
+
+	  If you have a controller with this interface, say Y or M here.
+
+	  If unsure, say N.
+
+config MMC_BCM2835_DMA
+	bool "DMA support on BCM2835 Arasan controller"
+	depends on MMC_BCM2835_MMC
+	help
+	  Enable DMA support on the Arasan SDHCI controller in Broadcom 2708
+	  based chips.
+
+	  If unsure, say N.
+
+config MMC_BCM2835_PIO_DMA_BARRIER
+	int "Block count limit for PIO transfers"
+	depends on MMC_BCM2835_MMC && MMC_BCM2835_DMA
+	range 0 256
+	default 2
+	help
+	  The inclusive limit in bytes under which PIO will be used instead of DMA
+
+	  If unsure, say 2 here.
+
+config MMC_BCM2835_SDHOST
+	tristate "Support for the SDHost controller on BCM2708/9"
+	depends on ARCH_BCM2835
+	help
+	  This selects the SDHost controller on BCM2835/6.
+
+	  If you have a controller with this interface, say Y or M here.
+
+	  If unsure, say N.
+
 config MMC_DEBUG
 	bool "MMC host drivers debugging"
 	depends on MMC != n
diff --git a/drivers/mmc/host/Makefile b/drivers/mmc/host/Makefile
index 7c7b29ff591a..b44ecbd0afaf 100644
--- a/drivers/mmc/host/Makefile
+++ b/drivers/mmc/host/Makefile
@@ -20,6 +20,8 @@ obj-$(CONFIG_MMC_SDHCI_S3C)	+= sdhci-s3c.o
 obj-$(CONFIG_MMC_SDHCI_SIRF)   	+= sdhci-sirf.o
 obj-$(CONFIG_MMC_SDHCI_F_SDH30)	+= sdhci_f_sdh30.o
 obj-$(CONFIG_MMC_SDHCI_SPEAR)	+= sdhci-spear.o
+obj-$(CONFIG_MMC_BCM2835_MMC)	+= bcm2835-mmc.o
+obj-$(CONFIG_MMC_BCM2835_SDHOST)	+= bcm2835-sdhost.o
 obj-$(CONFIG_MMC_WBSD)		+= wbsd.o
 obj-$(CONFIG_MMC_AU1X)		+= au1xmmc.o
 obj-$(CONFIG_MMC_MTK)		+= mtk-sd.o
diff --git a/drivers/mmc/host/bcm2835-mmc.c b/drivers/mmc/host/bcm2835-mmc.c
new file mode 100644
index 000000000000..b7f5fd96ecb6
--- /dev/null
+++ b/drivers/mmc/host/bcm2835-mmc.c
@@ -0,0 +1,1584 @@
+/*
+ * BCM2835 MMC host driver.
+ *
+ * Author:      Gellert Weisz <gellert@raspberrypi.org>
+ *              Copyright 2014
+ *
+ * Based on
+ *  sdhci-bcm2708.c by Broadcom
+ *  sdhci-bcm2835.c by Stephen Warren and Oleksandr Tymoshenko
+ *  sdhci.c and sdhci-pci.c by Pierre Ossman
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/delay.h>
+#include <linux/module.h>
+#include <linux/io.h>
+#include <linux/mmc/mmc.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/sd.h>
+#include <linux/scatterlist.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
+#include <linux/clk.h>
+#include <linux/platform_device.h>
+#include <linux/err.h>
+#include <linux/blkdev.h>
+#include <linux/dmaengine.h>
+#include <linux/dma-mapping.h>
+#include <linux/of_dma.h>
+
+#include "sdhci.h"
+
+
+#define DRIVER_NAME "mmc-bcm2835"
+
+#define DBG(f, x...) \
+pr_debug(DRIVER_NAME " [%s()]: " f, __func__, ## x)
+
+#ifndef CONFIG_MMC_BCM2835_DMA
+ #define FORCE_PIO
+#endif
+
+
+/* the inclusive limit in bytes under which PIO will be used instead of DMA */
+#ifdef CONFIG_MMC_BCM2835_PIO_DMA_BARRIER
+#define PIO_DMA_BARRIER CONFIG_MMC_BCM2835_PIO_DMA_BARRIER
+#else
+#define PIO_DMA_BARRIER 00
+#endif
+
+#define MIN_FREQ 400000
+#define TIMEOUT_VAL 0xE
+#define BCM2835_SDHCI_WRITE_DELAY(f)	(((2 * 1000000) / f) + 1)
+
+
+unsigned mmc_debug;
+unsigned mmc_debug2;
+
+struct bcm2835_host {
+	spinlock_t				lock;
+
+	void __iomem			*ioaddr;
+	u32						bus_addr;
+
+	struct mmc_host			*mmc;
+
+	u32						timeout;
+
+	int						clock;	/* Current clock speed */
+	u8						pwr;	/* Current voltage */
+
+	unsigned int			max_clk;		/* Max possible freq */
+	unsigned int			timeout_clk;	/* Timeout freq (KHz) */
+	unsigned int			clk_mul;		/* Clock Muliplier value */
+
+	struct tasklet_struct	finish_tasklet;		/* Tasklet structures */
+
+	struct timer_list		timer;			/* Timer for timeouts */
+
+	struct sg_mapping_iter	sg_miter;		/* SG state for PIO */
+	unsigned int			blocks;			/* remaining PIO blocks */
+
+	int						irq;			/* Device IRQ */
+
+
+	u32						ier;			/* cached registers */
+
+	struct mmc_request		*mrq;			/* Current request */
+	struct mmc_command		*cmd;			/* Current command */
+	struct mmc_data			*data;			/* Current data request */
+	unsigned int			data_early:1;		/* Data finished before cmd */
+
+	wait_queue_head_t		buf_ready_int;		/* Waitqueue for Buffer Read Ready interrupt */
+
+	u32						thread_isr;
+
+	u32						shadow;
+
+	/*DMA part*/
+	struct dma_chan			*dma_chan_rxtx;		/* DMA channel for reads and writes */
+	struct dma_slave_config		dma_cfg_rx;
+	struct dma_slave_config		dma_cfg_tx;
+	struct dma_async_tx_descriptor	*tx_desc;	/* descriptor */
+
+	bool					have_dma;
+	bool					use_dma;
+	bool					wait_for_dma;
+	/*end of DMA part*/
+
+	int						max_delay;	/* maximum length of time spent waiting */
+
+	int						flags;				/* Host attributes */
+#define SDHCI_REQ_USE_DMA	(1<<2)	/* Use DMA for this req. */
+#define SDHCI_DEVICE_DEAD	(1<<3)	/* Device unresponsive */
+#define SDHCI_AUTO_CMD12	(1<<6)	/* Auto CMD12 support */
+#define SDHCI_AUTO_CMD23	(1<<7)	/* Auto CMD23 support */
+#define SDHCI_SDIO_IRQ_ENABLED	(1<<9)	/* SDIO irq enabled */
+
+	u32				overclock_50;	/* frequency to use when 50MHz is requested (in MHz) */
+	u32				max_overclock;	/* Highest reported */
+};
+
+
+static inline void bcm2835_mmc_writel(struct bcm2835_host *host, u32 val, int reg, int from)
+{
+	unsigned delay;
+	lockdep_assert_held_once(&host->lock);
+	writel(val, host->ioaddr + reg);
+	udelay(BCM2835_SDHCI_WRITE_DELAY(max(host->clock, MIN_FREQ)));
+
+	delay = ((mmc_debug >> 16) & 0xf) << ((mmc_debug >> 20) & 0xf);
+	if (delay && !((1<<from) & mmc_debug2))
+		udelay(delay);
+}
+
+static inline void mmc_raw_writel(struct bcm2835_host *host, u32 val, int reg)
+{
+	unsigned delay;
+	lockdep_assert_held_once(&host->lock);
+	writel(val, host->ioaddr + reg);
+
+	delay = ((mmc_debug >> 24) & 0xf) << ((mmc_debug >> 28) & 0xf);
+	if (delay)
+		udelay(delay);
+}
+
+static inline u32 bcm2835_mmc_readl(struct bcm2835_host *host, int reg)
+{
+	lockdep_assert_held_once(&host->lock);
+	return readl(host->ioaddr + reg);
+}
+
+static inline void bcm2835_mmc_writew(struct bcm2835_host *host, u16 val, int reg)
+{
+	u32 oldval = (reg == SDHCI_COMMAND) ? host->shadow :
+		bcm2835_mmc_readl(host, reg & ~3);
+	u32 word_num = (reg >> 1) & 1;
+	u32 word_shift = word_num * 16;
+	u32 mask = 0xffff << word_shift;
+	u32 newval = (oldval & ~mask) | (val << word_shift);
+
+	if (reg == SDHCI_TRANSFER_MODE)
+		host->shadow = newval;
+	else
+		bcm2835_mmc_writel(host, newval, reg & ~3, 0);
+
+}
+
+static inline void bcm2835_mmc_writeb(struct bcm2835_host *host, u8 val, int reg)
+{
+	u32 oldval = bcm2835_mmc_readl(host, reg & ~3);
+	u32 byte_num = reg & 3;
+	u32 byte_shift = byte_num * 8;
+	u32 mask = 0xff << byte_shift;
+	u32 newval = (oldval & ~mask) | (val << byte_shift);
+
+	bcm2835_mmc_writel(host, newval, reg & ~3, 1);
+}
+
+
+static inline u16 bcm2835_mmc_readw(struct bcm2835_host *host, int reg)
+{
+	u32 val = bcm2835_mmc_readl(host, (reg & ~3));
+	u32 word_num = (reg >> 1) & 1;
+	u32 word_shift = word_num * 16;
+	u32 word = (val >> word_shift) & 0xffff;
+
+	return word;
+}
+
+static inline u8 bcm2835_mmc_readb(struct bcm2835_host *host, int reg)
+{
+	u32 val = bcm2835_mmc_readl(host, (reg & ~3));
+	u32 byte_num = reg & 3;
+	u32 byte_shift = byte_num * 8;
+	u32 byte = (val >> byte_shift) & 0xff;
+
+	return byte;
+}
+
+static void bcm2835_mmc_unsignal_irqs(struct bcm2835_host *host, u32 clear)
+{
+	u32 ier;
+
+	ier = bcm2835_mmc_readl(host, SDHCI_SIGNAL_ENABLE);
+	ier &= ~clear;
+	/* change which requests generate IRQs - makes no difference to
+	   the content of SDHCI_INT_STATUS, or the need to acknowledge IRQs */
+	bcm2835_mmc_writel(host, ier, SDHCI_SIGNAL_ENABLE, 2);
+}
+
+
+static void bcm2835_mmc_dumpregs(struct bcm2835_host *host)
+{
+	pr_debug(DRIVER_NAME ": =========== REGISTER DUMP (%s)===========\n",
+		mmc_hostname(host->mmc));
+
+	pr_debug(DRIVER_NAME ": Sys addr: 0x%08x | Version:  0x%08x\n",
+		bcm2835_mmc_readl(host, SDHCI_DMA_ADDRESS),
+		bcm2835_mmc_readw(host, SDHCI_HOST_VERSION));
+	pr_debug(DRIVER_NAME ": Blk size: 0x%08x | Blk cnt:  0x%08x\n",
+		bcm2835_mmc_readw(host, SDHCI_BLOCK_SIZE),
+		bcm2835_mmc_readw(host, SDHCI_BLOCK_COUNT));
+	pr_debug(DRIVER_NAME ": Argument: 0x%08x | Trn mode: 0x%08x\n",
+		bcm2835_mmc_readl(host, SDHCI_ARGUMENT),
+		bcm2835_mmc_readw(host, SDHCI_TRANSFER_MODE));
+	pr_debug(DRIVER_NAME ": Present:  0x%08x | Host ctl: 0x%08x\n",
+		bcm2835_mmc_readl(host, SDHCI_PRESENT_STATE),
+		bcm2835_mmc_readb(host, SDHCI_HOST_CONTROL));
+	pr_debug(DRIVER_NAME ": Power:    0x%08x | Blk gap:  0x%08x\n",
+		bcm2835_mmc_readb(host, SDHCI_POWER_CONTROL),
+		bcm2835_mmc_readb(host, SDHCI_BLOCK_GAP_CONTROL));
+	pr_debug(DRIVER_NAME ": Wake-up:  0x%08x | Clock:    0x%08x\n",
+		bcm2835_mmc_readb(host, SDHCI_WAKE_UP_CONTROL),
+		bcm2835_mmc_readw(host, SDHCI_CLOCK_CONTROL));
+	pr_debug(DRIVER_NAME ": Timeout:  0x%08x | Int stat: 0x%08x\n",
+		bcm2835_mmc_readb(host, SDHCI_TIMEOUT_CONTROL),
+		bcm2835_mmc_readl(host, SDHCI_INT_STATUS));
+	pr_debug(DRIVER_NAME ": Int enab: 0x%08x | Sig enab: 0x%08x\n",
+		bcm2835_mmc_readl(host, SDHCI_INT_ENABLE),
+		bcm2835_mmc_readl(host, SDHCI_SIGNAL_ENABLE));
+	pr_debug(DRIVER_NAME ": AC12 err: 0x%08x | Slot int: 0x%08x\n",
+		bcm2835_mmc_readw(host, SDHCI_ACMD12_ERR),
+		bcm2835_mmc_readw(host, SDHCI_SLOT_INT_STATUS));
+	pr_debug(DRIVER_NAME ": Caps:     0x%08x | Caps_1:   0x%08x\n",
+		bcm2835_mmc_readl(host, SDHCI_CAPABILITIES),
+		bcm2835_mmc_readl(host, SDHCI_CAPABILITIES_1));
+	pr_debug(DRIVER_NAME ": Cmd:      0x%08x | Max curr: 0x%08x\n",
+		bcm2835_mmc_readw(host, SDHCI_COMMAND),
+		bcm2835_mmc_readl(host, SDHCI_MAX_CURRENT));
+	pr_debug(DRIVER_NAME ": Host ctl2: 0x%08x\n",
+		bcm2835_mmc_readw(host, SDHCI_HOST_CONTROL2));
+
+	pr_debug(DRIVER_NAME ": ===========================================\n");
+}
+
+
+static void bcm2835_mmc_reset(struct bcm2835_host *host, u8 mask)
+{
+	unsigned long timeout;
+	unsigned long flags;
+
+	spin_lock_irqsave(&host->lock, flags);
+	bcm2835_mmc_writeb(host, mask, SDHCI_SOFTWARE_RESET);
+
+	if (mask & SDHCI_RESET_ALL)
+		host->clock = 0;
+
+	/* Wait max 100 ms */
+	timeout = 100;
+
+	/* hw clears the bit when it's done */
+	while (bcm2835_mmc_readb(host, SDHCI_SOFTWARE_RESET) & mask) {
+		if (timeout == 0) {
+			pr_err("%s: Reset 0x%x never completed.\n",
+				mmc_hostname(host->mmc), (int)mask);
+			bcm2835_mmc_dumpregs(host);
+			return;
+		}
+		timeout--;
+		spin_unlock_irqrestore(&host->lock, flags);
+		mdelay(1);
+		spin_lock_irqsave(&host->lock, flags);
+	}
+
+	if (100-timeout > 10 && 100-timeout > host->max_delay) {
+		host->max_delay = 100-timeout;
+		pr_warning("Warning: MMC controller hung for %d ms\n", host->max_delay);
+	}
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void bcm2835_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios);
+
+static void bcm2835_mmc_init(struct bcm2835_host *host, int soft)
+{
+	unsigned long flags;
+	if (soft)
+		bcm2835_mmc_reset(host, SDHCI_RESET_CMD|SDHCI_RESET_DATA);
+	else
+		bcm2835_mmc_reset(host, SDHCI_RESET_ALL);
+
+	host->ier = SDHCI_INT_BUS_POWER | SDHCI_INT_DATA_END_BIT |
+		    SDHCI_INT_DATA_CRC | SDHCI_INT_DATA_TIMEOUT |
+		    SDHCI_INT_INDEX | SDHCI_INT_END_BIT | SDHCI_INT_CRC |
+		    SDHCI_INT_TIMEOUT | SDHCI_INT_DATA_END |
+		    SDHCI_INT_RESPONSE;
+
+	spin_lock_irqsave(&host->lock, flags);
+	bcm2835_mmc_writel(host, host->ier, SDHCI_INT_ENABLE, 3);
+	bcm2835_mmc_writel(host, host->ier, SDHCI_SIGNAL_ENABLE, 3);
+	spin_unlock_irqrestore(&host->lock, flags);
+
+	if (soft) {
+		/* force clock reconfiguration */
+		host->clock = 0;
+		bcm2835_mmc_set_ios(host->mmc, &host->mmc->ios);
+	}
+}
+
+
+
+static void bcm2835_mmc_finish_data(struct bcm2835_host *host);
+
+static void bcm2835_mmc_dma_complete(void *param)
+{
+	struct bcm2835_host *host = param;
+	struct dma_chan *dma_chan;
+	unsigned long flags;
+	u32 dir_data;
+
+	spin_lock_irqsave(&host->lock, flags);
+
+	host->use_dma = false;
+
+	if (host->data && !(host->data->flags & MMC_DATA_WRITE)) {
+		/* otherwise handled in SDHCI IRQ */
+		dma_chan = host->dma_chan_rxtx;
+		dir_data = DMA_FROM_DEVICE;
+
+		dma_unmap_sg(dma_chan->device->dev,
+		     host->data->sg, host->data->sg_len,
+		     dir_data);
+
+		bcm2835_mmc_finish_data(host);
+	} else if (host->wait_for_dma) {
+		host->wait_for_dma = false;
+		tasklet_schedule(&host->finish_tasklet);
+	}
+
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void bcm2835_bcm2835_mmc_read_block_pio(struct bcm2835_host *host)
+{
+	unsigned long flags;
+	size_t blksize, len, chunk;
+
+	u32 uninitialized_var(scratch);
+	u8 *buf;
+
+	blksize = host->data->blksz;
+	chunk = 0;
+
+	local_irq_save(flags);
+
+	while (blksize) {
+		if (!sg_miter_next(&host->sg_miter))
+			BUG();
+
+		len = min(host->sg_miter.length, blksize);
+
+		blksize -= len;
+		host->sg_miter.consumed = len;
+
+		buf = host->sg_miter.addr;
+
+		while (len) {
+			if (chunk == 0) {
+				scratch = bcm2835_mmc_readl(host, SDHCI_BUFFER);
+				chunk = 4;
+			}
+
+			*buf = scratch & 0xFF;
+
+			buf++;
+			scratch >>= 8;
+			chunk--;
+			len--;
+		}
+	}
+
+	sg_miter_stop(&host->sg_miter);
+
+	local_irq_restore(flags);
+}
+
+static void bcm2835_bcm2835_mmc_write_block_pio(struct bcm2835_host *host)
+{
+	unsigned long flags;
+	size_t blksize, len, chunk;
+	u32 scratch;
+	u8 *buf;
+
+	blksize = host->data->blksz;
+	chunk = 0;
+	chunk = 0;
+	scratch = 0;
+
+	local_irq_save(flags);
+
+	while (blksize) {
+		if (!sg_miter_next(&host->sg_miter))
+			BUG();
+
+		len = min(host->sg_miter.length, blksize);
+
+		blksize -= len;
+		host->sg_miter.consumed = len;
+
+		buf = host->sg_miter.addr;
+
+		while (len) {
+			scratch |= (u32)*buf << (chunk * 8);
+
+			buf++;
+			chunk++;
+			len--;
+
+			if ((chunk == 4) || ((len == 0) && (blksize == 0))) {
+				mmc_raw_writel(host, scratch, SDHCI_BUFFER);
+				chunk = 0;
+				scratch = 0;
+			}
+		}
+	}
+
+	sg_miter_stop(&host->sg_miter);
+
+	local_irq_restore(flags);
+}
+
+
+static void bcm2835_mmc_transfer_pio(struct bcm2835_host *host)
+{
+	u32 mask;
+
+	BUG_ON(!host->data);
+
+	if (host->blocks == 0)
+		return;
+
+	if (host->data->flags & MMC_DATA_READ)
+		mask = SDHCI_DATA_AVAILABLE;
+	else
+		mask = SDHCI_SPACE_AVAILABLE;
+
+	while (bcm2835_mmc_readl(host, SDHCI_PRESENT_STATE) & mask) {
+
+		if (host->data->flags & MMC_DATA_READ)
+			bcm2835_bcm2835_mmc_read_block_pio(host);
+		else
+			bcm2835_bcm2835_mmc_write_block_pio(host);
+
+		host->blocks--;
+
+		/* QUIRK used in sdhci.c removes the 'if' */
+		/* but it seems this is unnecessary */
+		if (host->blocks == 0)
+			break;
+
+
+	}
+}
+
+
+static void bcm2835_mmc_transfer_dma(struct bcm2835_host *host)
+{
+	u32 len, dir_data, dir_slave;
+	struct dma_async_tx_descriptor *desc = NULL;
+	struct dma_chan *dma_chan;
+
+
+	WARN_ON(!host->data);
+
+	if (!host->data)
+		return;
+
+	if (host->blocks == 0)
+		return;
+
+	dma_chan = host->dma_chan_rxtx;
+	if (host->data->flags & MMC_DATA_READ) {
+		dir_data = DMA_FROM_DEVICE;
+		dir_slave = DMA_DEV_TO_MEM;
+	} else {
+		dir_data = DMA_TO_DEVICE;
+		dir_slave = DMA_MEM_TO_DEV;
+	}
+
+	/* The parameters have already been validated, so this will not fail */
+	(void)dmaengine_slave_config(dma_chan,
+				     (dir_data == DMA_FROM_DEVICE) ?
+				     &host->dma_cfg_rx :
+				     &host->dma_cfg_tx);
+
+	BUG_ON(!dma_chan->device);
+	BUG_ON(!dma_chan->device->dev);
+	BUG_ON(!host->data->sg);
+
+	len = dma_map_sg(dma_chan->device->dev, host->data->sg,
+			 host->data->sg_len, dir_data);
+	if (len > 0) {
+		desc = dmaengine_prep_slave_sg(dma_chan, host->data->sg,
+					       len, dir_slave,
+					       DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+	} else {
+		dev_err(mmc_dev(host->mmc), "dma_map_sg returned zero length\n");
+	}
+	if (desc) {
+		unsigned long flags;
+		spin_lock_irqsave(&host->lock, flags);
+		bcm2835_mmc_unsignal_irqs(host, SDHCI_INT_DATA_AVAIL |
+						    SDHCI_INT_SPACE_AVAIL);
+		host->tx_desc = desc;
+		desc->callback = bcm2835_mmc_dma_complete;
+		desc->callback_param = host;
+		spin_unlock_irqrestore(&host->lock, flags);
+		dmaengine_submit(desc);
+		dma_async_issue_pending(dma_chan);
+	}
+
+}
+
+
+
+static void bcm2835_mmc_set_transfer_irqs(struct bcm2835_host *host)
+{
+	u32 pio_irqs = SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL;
+	u32 dma_irqs = SDHCI_INT_DMA_END | SDHCI_INT_ADMA_ERROR;
+
+	if (host->use_dma)
+		host->ier = (host->ier & ~pio_irqs) | dma_irqs;
+	else
+		host->ier = (host->ier & ~dma_irqs) | pio_irqs;
+
+	bcm2835_mmc_writel(host, host->ier, SDHCI_INT_ENABLE, 4);
+	bcm2835_mmc_writel(host, host->ier, SDHCI_SIGNAL_ENABLE, 4);
+}
+
+
+static void bcm2835_mmc_prepare_data(struct bcm2835_host *host, struct mmc_command *cmd)
+{
+	u8 count;
+	struct mmc_data *data = cmd->data;
+
+	WARN_ON(host->data);
+
+	if (data || (cmd->flags & MMC_RSP_BUSY)) {
+		count = TIMEOUT_VAL;
+		bcm2835_mmc_writeb(host, count, SDHCI_TIMEOUT_CONTROL);
+	}
+
+	if (!data)
+		return;
+
+	/* Sanity checks */
+	BUG_ON(data->blksz * data->blocks > 524288);
+	BUG_ON(data->blksz > host->mmc->max_blk_size);
+	BUG_ON(data->blocks > 65535);
+
+	host->data = data;
+	host->data_early = 0;
+	host->data->bytes_xfered = 0;
+
+
+	if (!(host->flags & SDHCI_REQ_USE_DMA)) {
+		int flags;
+
+		flags = SG_MITER_ATOMIC;
+		if (host->data->flags & MMC_DATA_READ)
+			flags |= SG_MITER_TO_SG;
+		else
+			flags |= SG_MITER_FROM_SG;
+		sg_miter_start(&host->sg_miter, data->sg, data->sg_len, flags);
+		host->blocks = data->blocks;
+	}
+
+	host->use_dma = host->have_dma && data->blocks > PIO_DMA_BARRIER;
+
+	bcm2835_mmc_set_transfer_irqs(host);
+
+	/* Set the DMA boundary value and block size */
+	bcm2835_mmc_writew(host, SDHCI_MAKE_BLKSZ(SDHCI_DEFAULT_BOUNDARY_ARG,
+		data->blksz), SDHCI_BLOCK_SIZE);
+	bcm2835_mmc_writew(host, data->blocks, SDHCI_BLOCK_COUNT);
+
+	BUG_ON(!host->data);
+}
+
+static void bcm2835_mmc_set_transfer_mode(struct bcm2835_host *host,
+	struct mmc_command *cmd)
+{
+	u16 mode;
+	struct mmc_data *data = cmd->data;
+
+	if (data == NULL) {
+		/* clear Auto CMD settings for no data CMDs */
+		mode = bcm2835_mmc_readw(host, SDHCI_TRANSFER_MODE);
+		bcm2835_mmc_writew(host, mode & ~(SDHCI_TRNS_AUTO_CMD12 |
+				SDHCI_TRNS_AUTO_CMD23), SDHCI_TRANSFER_MODE);
+		return;
+	}
+
+	WARN_ON(!host->data);
+
+	mode = SDHCI_TRNS_BLK_CNT_EN;
+
+	if ((mmc_op_multi(cmd->opcode) || data->blocks > 1)) {
+		mode |= SDHCI_TRNS_MULTI;
+
+		/*
+		 * If we are sending CMD23, CMD12 never gets sent
+		 * on successful completion (so no Auto-CMD12).
+		 */
+		if (!host->mrq->sbc && (host->flags & SDHCI_AUTO_CMD12))
+			mode |= SDHCI_TRNS_AUTO_CMD12;
+		else if (host->mrq->sbc && (host->flags & SDHCI_AUTO_CMD23)) {
+			mode |= SDHCI_TRNS_AUTO_CMD23;
+			bcm2835_mmc_writel(host, host->mrq->sbc->arg, SDHCI_ARGUMENT2, 5);
+		}
+	}
+
+	if (data->flags & MMC_DATA_READ)
+		mode |= SDHCI_TRNS_READ;
+	if (host->flags & SDHCI_REQ_USE_DMA)
+		mode |= SDHCI_TRNS_DMA;
+
+	bcm2835_mmc_writew(host, mode, SDHCI_TRANSFER_MODE);
+}
+
+void bcm2835_mmc_send_command(struct bcm2835_host *host, struct mmc_command *cmd)
+{
+	int flags;
+	u32 mask;
+	unsigned long timeout;
+
+	WARN_ON(host->cmd);
+
+	/* Wait max 10 ms */
+	timeout = 1000;
+
+	mask = SDHCI_CMD_INHIBIT;
+	if ((cmd->data != NULL) || (cmd->flags & MMC_RSP_BUSY))
+		mask |= SDHCI_DATA_INHIBIT;
+
+	/* We shouldn't wait for data inihibit for stop commands, even
+	   though they might use busy signaling */
+	if (host->mrq->data && (cmd == host->mrq->data->stop))
+		mask &= ~SDHCI_DATA_INHIBIT;
+
+	while (bcm2835_mmc_readl(host, SDHCI_PRESENT_STATE) & mask) {
+		if (timeout == 0) {
+			pr_err("%s: Controller never released inhibit bit(s).\n",
+				mmc_hostname(host->mmc));
+			bcm2835_mmc_dumpregs(host);
+			cmd->error = -EIO;
+			tasklet_schedule(&host->finish_tasklet);
+			return;
+		}
+		timeout--;
+		udelay(10);
+	}
+
+	if ((1000-timeout)/100 > 1 && (1000-timeout)/100 > host->max_delay) {
+		host->max_delay = (1000-timeout)/100;
+		pr_warning("Warning: MMC controller hung for %d ms\n", host->max_delay);
+	}
+
+	timeout = jiffies;
+	if (!cmd->data && cmd->busy_timeout > 9000)
+		timeout += DIV_ROUND_UP(cmd->busy_timeout, 1000) * HZ + HZ;
+	else
+		timeout += 10 * HZ;
+	mod_timer(&host->timer, timeout);
+
+	host->cmd = cmd;
+	host->use_dma = false;
+
+	bcm2835_mmc_prepare_data(host, cmd);
+
+	bcm2835_mmc_writel(host, cmd->arg, SDHCI_ARGUMENT, 6);
+
+	bcm2835_mmc_set_transfer_mode(host, cmd);
+
+	if ((cmd->flags & MMC_RSP_136) && (cmd->flags & MMC_RSP_BUSY)) {
+		pr_err("%s: Unsupported response type!\n",
+			mmc_hostname(host->mmc));
+		cmd->error = -EINVAL;
+		tasklet_schedule(&host->finish_tasklet);
+		return;
+	}
+
+	if (!(cmd->flags & MMC_RSP_PRESENT))
+		flags = SDHCI_CMD_RESP_NONE;
+	else if (cmd->flags & MMC_RSP_136)
+		flags = SDHCI_CMD_RESP_LONG;
+	else if (cmd->flags & MMC_RSP_BUSY)
+		flags = SDHCI_CMD_RESP_SHORT_BUSY;
+	else
+		flags = SDHCI_CMD_RESP_SHORT;
+
+	if (cmd->flags & MMC_RSP_CRC)
+		flags |= SDHCI_CMD_CRC;
+	if (cmd->flags & MMC_RSP_OPCODE)
+		flags |= SDHCI_CMD_INDEX;
+
+	if (cmd->data)
+		flags |= SDHCI_CMD_DATA;
+
+	bcm2835_mmc_writew(host, SDHCI_MAKE_CMD(cmd->opcode, flags), SDHCI_COMMAND);
+}
+
+
+static void bcm2835_mmc_finish_data(struct bcm2835_host *host)
+{
+	struct mmc_data *data;
+
+	BUG_ON(!host->data);
+
+	data = host->data;
+	host->data = NULL;
+
+	if (data->error)
+		data->bytes_xfered = 0;
+	else
+		data->bytes_xfered = data->blksz * data->blocks;
+
+	/*
+	 * Need to send CMD12 if -
+	 * a) open-ended multiblock transfer (no CMD23)
+	 * b) error in multiblock transfer
+	 */
+	if (data->stop &&
+	    (data->error ||
+	     !host->mrq->sbc)) {
+
+		/*
+		 * The controller needs a reset of internal state machines
+		 * upon error conditions.
+		 */
+		if (data->error) {
+			bcm2835_mmc_reset(host, SDHCI_RESET_CMD);
+			bcm2835_mmc_reset(host, SDHCI_RESET_DATA);
+		}
+
+		bcm2835_mmc_send_command(host, data->stop);
+	} else if (host->use_dma) {
+		host->wait_for_dma = true;
+	} else {
+		tasklet_schedule(&host->finish_tasklet);
+	}
+}
+
+static void bcm2835_mmc_finish_command(struct bcm2835_host *host)
+{
+	int i;
+
+	BUG_ON(host->cmd == NULL);
+
+	if (host->cmd->flags & MMC_RSP_PRESENT) {
+		if (host->cmd->flags & MMC_RSP_136) {
+			/* CRC is stripped so we need to do some shifting. */
+			for (i = 0; i < 4; i++) {
+				host->cmd->resp[i] = bcm2835_mmc_readl(host,
+					SDHCI_RESPONSE + (3-i)*4) << 8;
+				if (i != 3)
+					host->cmd->resp[i] |=
+						bcm2835_mmc_readb(host,
+						SDHCI_RESPONSE + (3-i)*4-1);
+			}
+		} else {
+			host->cmd->resp[0] = bcm2835_mmc_readl(host, SDHCI_RESPONSE);
+		}
+	}
+
+	host->cmd->error = 0;
+
+	/* Finished CMD23, now send actual command. */
+	if (host->cmd == host->mrq->sbc) {
+		host->cmd = NULL;
+		bcm2835_mmc_send_command(host, host->mrq->cmd);
+
+		if (host->mrq->cmd->data && host->use_dma) {
+			/* DMA transfer starts now, PIO starts after interrupt */
+			bcm2835_mmc_transfer_dma(host);
+		}
+	} else {
+
+		/* Processed actual command. */
+		if (host->data && host->data_early)
+			bcm2835_mmc_finish_data(host);
+
+		if (!host->cmd->data)
+			tasklet_schedule(&host->finish_tasklet);
+
+		host->cmd = NULL;
+	}
+}
+
+
+static void bcm2835_mmc_timeout_timer(unsigned long data)
+{
+	struct bcm2835_host *host;
+	unsigned long flags;
+
+	host = (struct bcm2835_host *)data;
+
+	spin_lock_irqsave(&host->lock, flags);
+
+	if (host->mrq) {
+		pr_err("%s: Timeout waiting for hardware interrupt.\n",
+			mmc_hostname(host->mmc));
+		bcm2835_mmc_dumpregs(host);
+
+		if (host->data) {
+			host->data->error = -ETIMEDOUT;
+			bcm2835_mmc_finish_data(host);
+		} else {
+			if (host->cmd)
+				host->cmd->error = -ETIMEDOUT;
+			else
+				host->mrq->cmd->error = -ETIMEDOUT;
+
+			tasklet_schedule(&host->finish_tasklet);
+		}
+	}
+
+	mmiowb();
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+
+static void bcm2835_mmc_enable_sdio_irq_nolock(struct bcm2835_host *host, int enable)
+{
+	if (!(host->flags & SDHCI_DEVICE_DEAD)) {
+		if (enable)
+			host->ier |= SDHCI_INT_CARD_INT;
+		else
+			host->ier &= ~SDHCI_INT_CARD_INT;
+
+		bcm2835_mmc_writel(host, host->ier, SDHCI_INT_ENABLE, 7);
+		bcm2835_mmc_writel(host, host->ier, SDHCI_SIGNAL_ENABLE, 7);
+		mmiowb();
+	}
+}
+
+static void bcm2835_mmc_enable_sdio_irq(struct mmc_host *mmc, int enable)
+{
+	struct bcm2835_host *host = mmc_priv(mmc);
+	unsigned long flags;
+
+	spin_lock_irqsave(&host->lock, flags);
+	if (enable)
+		host->flags |= SDHCI_SDIO_IRQ_ENABLED;
+	else
+		host->flags &= ~SDHCI_SDIO_IRQ_ENABLED;
+
+	bcm2835_mmc_enable_sdio_irq_nolock(host, enable);
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void bcm2835_mmc_cmd_irq(struct bcm2835_host *host, u32 intmask)
+{
+
+	BUG_ON(intmask == 0);
+
+	if (!host->cmd) {
+		pr_err("%s: Got command interrupt 0x%08x even "
+			"though no command operation was in progress.\n",
+			mmc_hostname(host->mmc), (unsigned)intmask);
+		bcm2835_mmc_dumpregs(host);
+		return;
+	}
+
+	if (intmask & SDHCI_INT_TIMEOUT)
+		host->cmd->error = -ETIMEDOUT;
+	else if (intmask & (SDHCI_INT_CRC | SDHCI_INT_END_BIT |
+			SDHCI_INT_INDEX)) {
+			host->cmd->error = -EILSEQ;
+	}
+
+	if (host->cmd->error) {
+		tasklet_schedule(&host->finish_tasklet);
+		return;
+	}
+
+	if (intmask & SDHCI_INT_RESPONSE)
+		bcm2835_mmc_finish_command(host);
+
+}
+
+static void bcm2835_mmc_data_irq(struct bcm2835_host *host, u32 intmask)
+{
+	struct dma_chan *dma_chan;
+	u32 dir_data;
+
+	BUG_ON(intmask == 0);
+
+	if (!host->data) {
+		/*
+		 * The "data complete" interrupt is also used to
+		 * indicate that a busy state has ended. See comment
+		 * above in sdhci_cmd_irq().
+		 */
+		if (host->cmd && (host->cmd->flags & MMC_RSP_BUSY)) {
+			if (intmask & SDHCI_INT_DATA_END) {
+				bcm2835_mmc_finish_command(host);
+				return;
+			}
+		}
+
+		pr_debug("%s: Got data interrupt 0x%08x even "
+			"though no data operation was in progress.\n",
+			mmc_hostname(host->mmc), (unsigned)intmask);
+		bcm2835_mmc_dumpregs(host);
+
+		return;
+	}
+
+	if (intmask & SDHCI_INT_DATA_TIMEOUT)
+		host->data->error = -ETIMEDOUT;
+	else if (intmask & SDHCI_INT_DATA_END_BIT)
+		host->data->error = -EILSEQ;
+	else if ((intmask & SDHCI_INT_DATA_CRC) &&
+		SDHCI_GET_CMD(bcm2835_mmc_readw(host, SDHCI_COMMAND))
+			!= MMC_BUS_TEST_R)
+		host->data->error = -EILSEQ;
+
+	if (host->use_dma) {
+		if  (host->data->flags & MMC_DATA_WRITE) {
+			/* IRQ handled here */
+
+			dma_chan = host->dma_chan_rxtx;
+			dir_data = DMA_TO_DEVICE;
+			dma_unmap_sg(dma_chan->device->dev,
+				 host->data->sg, host->data->sg_len,
+				 dir_data);
+
+			bcm2835_mmc_finish_data(host);
+		}
+
+	} else {
+		if (host->data->error)
+			bcm2835_mmc_finish_data(host);
+		else {
+			if (intmask & (SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL))
+				bcm2835_mmc_transfer_pio(host);
+
+			if (intmask & SDHCI_INT_DATA_END) {
+				if (host->cmd) {
+					/*
+					 * Data managed to finish before the
+					 * command completed. Make sure we do
+					 * things in the proper order.
+					 */
+					host->data_early = 1;
+				} else {
+					bcm2835_mmc_finish_data(host);
+				}
+			}
+		}
+	}
+}
+
+
+static irqreturn_t bcm2835_mmc_irq(int irq, void *dev_id)
+{
+	irqreturn_t result = IRQ_NONE;
+	struct bcm2835_host *host = dev_id;
+	u32 intmask, mask, unexpected = 0;
+	int max_loops = 16;
+
+	spin_lock(&host->lock);
+
+	intmask = bcm2835_mmc_readl(host, SDHCI_INT_STATUS);
+
+	if (!intmask || intmask == 0xffffffff) {
+		result = IRQ_NONE;
+		goto out;
+	}
+
+	do {
+		/* Clear selected interrupts. */
+		mask = intmask & (SDHCI_INT_CMD_MASK | SDHCI_INT_DATA_MASK |
+				  SDHCI_INT_BUS_POWER);
+		bcm2835_mmc_writel(host, mask, SDHCI_INT_STATUS, 8);
+
+
+		if (intmask & SDHCI_INT_CMD_MASK)
+			bcm2835_mmc_cmd_irq(host, intmask & SDHCI_INT_CMD_MASK);
+
+		if (intmask & SDHCI_INT_DATA_MASK)
+			bcm2835_mmc_data_irq(host, intmask & SDHCI_INT_DATA_MASK);
+
+		if (intmask & SDHCI_INT_BUS_POWER)
+			pr_err("%s: Card is consuming too much power!\n",
+				mmc_hostname(host->mmc));
+
+		if (intmask & SDHCI_INT_CARD_INT) {
+			bcm2835_mmc_enable_sdio_irq_nolock(host, false);
+			host->thread_isr |= SDHCI_INT_CARD_INT;
+			result = IRQ_WAKE_THREAD;
+		}
+
+		intmask &= ~(SDHCI_INT_CARD_INSERT | SDHCI_INT_CARD_REMOVE |
+			     SDHCI_INT_CMD_MASK | SDHCI_INT_DATA_MASK |
+			     SDHCI_INT_ERROR | SDHCI_INT_BUS_POWER |
+			     SDHCI_INT_CARD_INT);
+
+		if (intmask) {
+			unexpected |= intmask;
+			bcm2835_mmc_writel(host, intmask, SDHCI_INT_STATUS, 9);
+		}
+
+		if (result == IRQ_NONE)
+			result = IRQ_HANDLED;
+
+		intmask = bcm2835_mmc_readl(host, SDHCI_INT_STATUS);
+	} while (intmask && --max_loops);
+out:
+	spin_unlock(&host->lock);
+
+	if (unexpected) {
+		pr_err("%s: Unexpected interrupt 0x%08x.\n",
+			   mmc_hostname(host->mmc), unexpected);
+		bcm2835_mmc_dumpregs(host);
+	}
+
+	return result;
+}
+
+static irqreturn_t bcm2835_mmc_thread_irq(int irq, void *dev_id)
+{
+	struct bcm2835_host *host = dev_id;
+	unsigned long flags;
+	u32 isr;
+
+	spin_lock_irqsave(&host->lock, flags);
+	isr = host->thread_isr;
+	host->thread_isr = 0;
+	spin_unlock_irqrestore(&host->lock, flags);
+
+	if (isr & SDHCI_INT_CARD_INT) {
+		sdio_run_irqs(host->mmc);
+
+		spin_lock_irqsave(&host->lock, flags);
+		if (host->flags & SDHCI_SDIO_IRQ_ENABLED)
+			bcm2835_mmc_enable_sdio_irq_nolock(host, true);
+		spin_unlock_irqrestore(&host->lock, flags);
+	}
+
+	return isr ? IRQ_HANDLED : IRQ_NONE;
+}
+
+
+
+void bcm2835_mmc_set_clock(struct bcm2835_host *host, unsigned int clock)
+{
+	int div = 0; /* Initialized for compiler warning */
+	int real_div = div, clk_mul = 1;
+	u16 clk = 0;
+	unsigned long timeout;
+	unsigned int input_clock = clock;
+
+	if (host->overclock_50 && (clock == 50000000))
+		clock = host->overclock_50 * 1000000 + 999999;
+
+	host->mmc->actual_clock = 0;
+
+	bcm2835_mmc_writew(host, 0, SDHCI_CLOCK_CONTROL);
+
+	if (clock == 0)
+		return;
+
+	/* Version 3.00 divisors must be a multiple of 2. */
+	if (host->max_clk <= clock)
+		div = 1;
+	else {
+		for (div = 2; div < SDHCI_MAX_DIV_SPEC_300;
+			 div += 2) {
+			if ((host->max_clk / div) <= clock)
+				break;
+		}
+	}
+
+	real_div = div;
+	div >>= 1;
+
+	if (real_div)
+		clock = (host->max_clk * clk_mul) / real_div;
+	host->mmc->actual_clock = clock;
+
+	if ((clock > input_clock) && (clock > host->max_overclock)) {
+		pr_warn("%s: Overclocking to %dHz\n",
+			mmc_hostname(host->mmc), clock);
+		host->max_overclock = clock;
+	}
+
+	clk |= (div & SDHCI_DIV_MASK) << SDHCI_DIVIDER_SHIFT;
+	clk |= ((div & SDHCI_DIV_HI_MASK) >> SDHCI_DIV_MASK_LEN)
+		<< SDHCI_DIVIDER_HI_SHIFT;
+	clk |= SDHCI_CLOCK_INT_EN;
+	bcm2835_mmc_writew(host, clk, SDHCI_CLOCK_CONTROL);
+
+	/* Wait max 20 ms */
+	timeout = 20;
+	while (!((clk = bcm2835_mmc_readw(host, SDHCI_CLOCK_CONTROL))
+		& SDHCI_CLOCK_INT_STABLE)) {
+		if (timeout == 0) {
+			pr_err("%s: Internal clock never "
+				"stabilised.\n", mmc_hostname(host->mmc));
+			bcm2835_mmc_dumpregs(host);
+			return;
+		}
+		timeout--;
+		mdelay(1);
+	}
+
+	if (20-timeout > 10 && 20-timeout > host->max_delay) {
+		host->max_delay = 20-timeout;
+		pr_warning("Warning: MMC controller hung for %d ms\n", host->max_delay);
+	}
+
+	clk |= SDHCI_CLOCK_CARD_EN;
+	bcm2835_mmc_writew(host, clk, SDHCI_CLOCK_CONTROL);
+}
+
+static void bcm2835_mmc_request(struct mmc_host *mmc, struct mmc_request *mrq)
+{
+	struct bcm2835_host *host;
+	unsigned long flags;
+
+	host = mmc_priv(mmc);
+
+	spin_lock_irqsave(&host->lock, flags);
+
+	WARN_ON(host->mrq != NULL);
+
+	host->mrq = mrq;
+
+	if (mrq->sbc && !(host->flags & SDHCI_AUTO_CMD23))
+		bcm2835_mmc_send_command(host, mrq->sbc);
+	else
+		bcm2835_mmc_send_command(host, mrq->cmd);
+
+	mmiowb();
+	spin_unlock_irqrestore(&host->lock, flags);
+
+	if (!(mrq->sbc && !(host->flags & SDHCI_AUTO_CMD23)) && mrq->cmd->data && host->use_dma) {
+		/* DMA transfer starts now, PIO starts after interrupt */
+		bcm2835_mmc_transfer_dma(host);
+	}
+}
+
+
+static void bcm2835_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+{
+
+	struct bcm2835_host *host = mmc_priv(mmc);
+	unsigned long flags;
+	u8 ctrl;
+	u16 clk, ctrl_2;
+
+	pr_debug("bcm2835_mmc_set_ios: clock %d, pwr %d, bus_width %d, timing %d, vdd %d, drv_type %d\n",
+		 ios->clock, ios->power_mode, ios->bus_width,
+		 ios->timing, ios->signal_voltage, ios->drv_type);
+
+	spin_lock_irqsave(&host->lock, flags);
+
+	if (!ios->clock || ios->clock != host->clock) {
+		bcm2835_mmc_set_clock(host, ios->clock);
+		host->clock = ios->clock;
+	}
+
+	if (host->pwr != SDHCI_POWER_330) {
+		host->pwr = SDHCI_POWER_330;
+		bcm2835_mmc_writeb(host, SDHCI_POWER_330 | SDHCI_POWER_ON, SDHCI_POWER_CONTROL);
+	}
+
+	ctrl = bcm2835_mmc_readb(host, SDHCI_HOST_CONTROL);
+
+	/* set bus width */
+	ctrl &= ~SDHCI_CTRL_8BITBUS;
+	if (ios->bus_width == MMC_BUS_WIDTH_4)
+		ctrl |= SDHCI_CTRL_4BITBUS;
+	else
+		ctrl &= ~SDHCI_CTRL_4BITBUS;
+
+	ctrl &= ~SDHCI_CTRL_HISPD; /* NO_HISPD_BIT */
+
+
+	bcm2835_mmc_writeb(host, ctrl, SDHCI_HOST_CONTROL);
+	/*
+	 * We only need to set Driver Strength if the
+	 * preset value enable is not set.
+	 */
+	ctrl_2 = bcm2835_mmc_readw(host, SDHCI_HOST_CONTROL2);
+	ctrl_2 &= ~SDHCI_CTRL_DRV_TYPE_MASK;
+	if (ios->drv_type == MMC_SET_DRIVER_TYPE_A)
+		ctrl_2 |= SDHCI_CTRL_DRV_TYPE_A;
+	else if (ios->drv_type == MMC_SET_DRIVER_TYPE_C)
+		ctrl_2 |= SDHCI_CTRL_DRV_TYPE_C;
+
+	bcm2835_mmc_writew(host, ctrl_2, SDHCI_HOST_CONTROL2);
+
+	/* Reset SD Clock Enable */
+	clk = bcm2835_mmc_readw(host, SDHCI_CLOCK_CONTROL);
+	clk &= ~SDHCI_CLOCK_CARD_EN;
+	bcm2835_mmc_writew(host, clk, SDHCI_CLOCK_CONTROL);
+
+	/* Re-enable SD Clock */
+	bcm2835_mmc_set_clock(host, host->clock);
+	bcm2835_mmc_writeb(host, ctrl, SDHCI_HOST_CONTROL);
+
+	mmiowb();
+
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+
+static struct mmc_host_ops bcm2835_ops = {
+	.request = bcm2835_mmc_request,
+	.set_ios = bcm2835_mmc_set_ios,
+	.enable_sdio_irq = bcm2835_mmc_enable_sdio_irq,
+};
+
+
+static void bcm2835_mmc_tasklet_finish(unsigned long param)
+{
+	struct bcm2835_host *host;
+	unsigned long flags;
+	struct mmc_request *mrq;
+
+	host = (struct bcm2835_host *)param;
+
+	spin_lock_irqsave(&host->lock, flags);
+
+	/*
+	 * If this tasklet gets rescheduled while running, it will
+	 * be run again afterwards but without any active request.
+	 */
+	if (!host->mrq) {
+		spin_unlock_irqrestore(&host->lock, flags);
+		return;
+	}
+
+	del_timer(&host->timer);
+
+	mrq = host->mrq;
+
+	/*
+	 * The controller needs a reset of internal state machines
+	 * upon error conditions.
+	 */
+	if (!(host->flags & SDHCI_DEVICE_DEAD) &&
+	    ((mrq->cmd && mrq->cmd->error) ||
+		 (mrq->data && (mrq->data->error ||
+		  (mrq->data->stop && mrq->data->stop->error))))) {
+
+		spin_unlock_irqrestore(&host->lock, flags);
+		bcm2835_mmc_reset(host, SDHCI_RESET_CMD);
+		bcm2835_mmc_reset(host, SDHCI_RESET_DATA);
+		spin_lock_irqsave(&host->lock, flags);
+	}
+
+	host->mrq = NULL;
+	host->cmd = NULL;
+	host->data = NULL;
+
+	mmiowb();
+
+	spin_unlock_irqrestore(&host->lock, flags);
+	mmc_request_done(host->mmc, mrq);
+}
+
+
+
+static int bcm2835_mmc_add_host(struct bcm2835_host *host)
+{
+	struct mmc_host *mmc = host->mmc;
+	struct device *dev = mmc->parent;
+#ifndef FORCE_PIO
+	struct dma_slave_config cfg;
+#endif
+	int ret;
+
+	bcm2835_mmc_reset(host, SDHCI_RESET_ALL);
+
+	host->clk_mul = 0;
+
+	if (!mmc->f_max || mmc->f_max > host->max_clk)
+		mmc->f_max = host->max_clk;
+	mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_300;
+
+	/* SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK */
+	host->timeout_clk = mmc->f_max / 1000;
+	mmc->max_busy_timeout = (1 << 27) / host->timeout_clk;
+
+	/* host controller capabilities */
+	mmc->caps |= MMC_CAP_CMD23 | MMC_CAP_ERASE | MMC_CAP_NEEDS_POLL |
+		MMC_CAP_SDIO_IRQ | MMC_CAP_SD_HIGHSPEED |
+		MMC_CAP_MMC_HIGHSPEED;
+
+	mmc->caps2 |= MMC_CAP2_SDIO_IRQ_NOTHREAD;
+
+	host->flags = SDHCI_AUTO_CMD23;
+
+	dev_info(dev, "mmc_debug:%x mmc_debug2:%x\n", mmc_debug, mmc_debug2);
+#ifdef FORCE_PIO
+	dev_info(dev, "Forcing PIO mode\n");
+	host->have_dma = false;
+#else
+	if (IS_ERR_OR_NULL(host->dma_chan_rxtx)) {
+		dev_err(dev, "%s: Unable to initialise DMA channel. Falling back to PIO\n",
+			DRIVER_NAME);
+		host->have_dma = false;
+	} else {
+		dev_info(dev, "DMA channel allocated");
+
+		cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+		cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+		cfg.slave_id = 11;		/* DREQ channel */
+
+		/* Validate the slave configurations */
+
+		cfg.direction = DMA_MEM_TO_DEV;
+		cfg.src_addr = 0;
+		cfg.dst_addr = host->bus_addr + SDHCI_BUFFER;
+
+		ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
+
+		if (ret == 0) {
+			host->dma_cfg_tx = cfg;
+
+			cfg.direction = DMA_DEV_TO_MEM;
+			cfg.src_addr = host->bus_addr + SDHCI_BUFFER;
+			cfg.dst_addr = 0;
+
+			ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
+		}
+
+		if (ret == 0) {
+			host->dma_cfg_rx = cfg;
+
+			host->have_dma = true;
+		} else {
+			pr_err("%s: unable to configure DMA channel. "
+			       "Falling back to PIO\n",
+			       mmc_hostname(mmc));
+			dma_release_channel(host->dma_chan_rxtx);
+			host->dma_chan_rxtx = NULL;
+			host->have_dma = false;
+		}
+	}
+#endif
+	mmc->max_segs = 128;
+	mmc->max_req_size = 524288;
+	mmc->max_seg_size = mmc->max_req_size;
+	mmc->max_blk_size = 512;
+	mmc->max_blk_count =  65535;
+
+	/* report supported voltage ranges */
+	mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
+
+	tasklet_init(&host->finish_tasklet,
+		bcm2835_mmc_tasklet_finish, (unsigned long)host);
+
+	setup_timer(&host->timer, bcm2835_mmc_timeout_timer, (unsigned long)host);
+	init_waitqueue_head(&host->buf_ready_int);
+
+	bcm2835_mmc_init(host, 0);
+	ret = devm_request_threaded_irq(dev, host->irq, bcm2835_mmc_irq,
+					bcm2835_mmc_thread_irq, IRQF_SHARED,
+					mmc_hostname(mmc), host);
+	if (ret) {
+		dev_err(dev, "Failed to request IRQ %d: %d\n", host->irq, ret);
+		goto untasklet;
+	}
+
+	mmiowb();
+	mmc_add_host(mmc);
+
+	return 0;
+
+untasklet:
+	tasklet_kill(&host->finish_tasklet);
+
+	return ret;
+}
+
+static int bcm2835_mmc_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
+	struct clk *clk;
+	struct resource *iomem;
+	struct bcm2835_host *host;
+	struct mmc_host *mmc;
+	const __be32 *addr;
+	int ret;
+
+	mmc = mmc_alloc_host(sizeof(*host), dev);
+	if (!mmc)
+		return -ENOMEM;
+
+	mmc->ops = &bcm2835_ops;
+	host = mmc_priv(mmc);
+	host->mmc = mmc;
+	host->timeout = msecs_to_jiffies(1000);
+	spin_lock_init(&host->lock);
+
+	iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	host->ioaddr = devm_ioremap_resource(dev, iomem);
+	if (IS_ERR(host->ioaddr)) {
+		ret = PTR_ERR(host->ioaddr);
+		goto err;
+	}
+
+	addr = of_get_address(node, 0, NULL, NULL);
+	if (!addr) {
+		dev_err(dev, "could not get DMA-register address\n");
+		return -ENODEV;
+	}
+	host->bus_addr = be32_to_cpup(addr);
+	pr_debug(" - ioaddr %lx, iomem->start %lx, bus_addr %lx\n",
+		 (unsigned long)host->ioaddr,
+		 (unsigned long)iomem->start,
+		 (unsigned long)host->bus_addr);
+
+#ifndef FORCE_PIO
+	if (node) {
+		host->dma_chan_rxtx = dma_request_slave_channel(dev, "rx-tx");
+		if (!host->dma_chan_rxtx)
+			host->dma_chan_rxtx =
+				dma_request_slave_channel(dev, "tx");
+		if (!host->dma_chan_rxtx)
+			host->dma_chan_rxtx =
+				dma_request_slave_channel(dev, "rx");
+	} else {
+		dma_cap_mask_t mask;
+
+		dma_cap_zero(mask);
+		/* we don't care about the channel, any would work */
+		dma_cap_set(DMA_SLAVE, mask);
+		host->dma_chan_rxtx = dma_request_channel(mask, NULL, NULL);
+	}
+#endif
+	clk = devm_clk_get(dev, NULL);
+	if (IS_ERR(clk)) {
+		ret = PTR_ERR(clk);
+		if (ret == -EPROBE_DEFER)
+			dev_info(dev, "could not get clk, deferring probe\n");
+		else
+			dev_err(dev, "could not get clk\n");
+		goto err;
+	}
+
+	host->max_clk = clk_get_rate(clk);
+
+	host->irq = platform_get_irq(pdev, 0);
+	if (host->irq <= 0) {
+		dev_err(dev, "get IRQ failed\n");
+		ret = -EINVAL;
+		goto err;
+	}
+
+	if (node) {
+		mmc_of_parse(mmc);
+
+		/* Read any custom properties */
+		of_property_read_u32(node,
+				     "brcm,overclock-50",
+				     &host->overclock_50);
+	} else {
+		mmc->caps |= MMC_CAP_4_BIT_DATA;
+	}
+
+	ret = bcm2835_mmc_add_host(host);
+	if (ret)
+		goto err;
+
+	platform_set_drvdata(pdev, host);
+
+	return 0;
+err:
+	mmc_free_host(mmc);
+
+	return ret;
+}
+
+static int bcm2835_mmc_remove(struct platform_device *pdev)
+{
+	struct bcm2835_host *host = platform_get_drvdata(pdev);
+	unsigned long flags;
+	int dead;
+	u32 scratch;
+
+	dead = 0;
+	scratch = bcm2835_mmc_readl(host, SDHCI_INT_STATUS);
+	if (scratch == (u32)-1)
+		dead = 1;
+
+
+	if (dead) {
+		spin_lock_irqsave(&host->lock, flags);
+
+		host->flags |= SDHCI_DEVICE_DEAD;
+
+		if (host->mrq) {
+			pr_err("%s: Controller removed during "
+				" transfer!\n", mmc_hostname(host->mmc));
+
+			host->mrq->cmd->error = -ENOMEDIUM;
+			tasklet_schedule(&host->finish_tasklet);
+		}
+
+		spin_unlock_irqrestore(&host->lock, flags);
+	}
+
+	mmc_remove_host(host->mmc);
+
+	if (!dead)
+		bcm2835_mmc_reset(host, SDHCI_RESET_ALL);
+
+	free_irq(host->irq, host);
+
+	del_timer_sync(&host->timer);
+
+	tasklet_kill(&host->finish_tasklet);
+
+	mmc_free_host(host->mmc);
+	platform_set_drvdata(pdev, NULL);
+
+	return 0;
+}
+
+
+static const struct of_device_id bcm2835_mmc_match[] = {
+	{ .compatible = "brcm,bcm2835-mmc" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, bcm2835_mmc_match);
+
+
+
+static struct platform_driver bcm2835_mmc_driver = {
+	.probe      = bcm2835_mmc_probe,
+	.remove     = bcm2835_mmc_remove,
+	.driver     = {
+		.name		= DRIVER_NAME,
+		.owner		= THIS_MODULE,
+		.of_match_table	= bcm2835_mmc_match,
+	},
+};
+module_platform_driver(bcm2835_mmc_driver);
+
+module_param(mmc_debug, uint, 0644);
+module_param(mmc_debug2, uint, 0644);
+MODULE_ALIAS("platform:mmc-bcm2835");
+MODULE_DESCRIPTION("BCM2835 SDHCI driver");
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Gellert Weisz");
diff --git a/drivers/mmc/host/bcm2835-sdhost.c b/drivers/mmc/host/bcm2835-sdhost.c
new file mode 100644
index 000000000000..273b1be058c5
--- /dev/null
+++ b/drivers/mmc/host/bcm2835-sdhost.c
@@ -0,0 +1,2194 @@
+/*
+ * BCM2835 SD host driver.
+ *
+ * Author:      Phil Elwell <phil@raspberrypi.org>
+ *              Copyright (C) 2015-2016 Raspberry Pi (Trading) Ltd.
+ *
+ * Based on
+ *  mmc-bcm2835.c by Gellert Weisz
+ * which is, in turn, based on
+ *  sdhci-bcm2708.c by Broadcom
+ *  sdhci-bcm2835.c by Stephen Warren and Oleksandr Tymoshenko
+ *  sdhci.c and sdhci-pci.c by Pierre Ossman
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define FIFO_READ_THRESHOLD     4
+#define FIFO_WRITE_THRESHOLD    4
+#define ALLOW_CMD23_READ        1
+#define ALLOW_CMD23_WRITE       0
+#define ENABLE_LOG              1
+#define SDDATA_FIFO_PIO_BURST   8
+#define CMD_DALLY_US            1
+
+#include <linux/delay.h>
+#include <linux/module.h>
+#include <linux/io.h>
+#include <linux/mmc/mmc.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/sd.h>
+#include <linux/mmc/sdio.h>
+#include <linux/scatterlist.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
+#include <linux/clk.h>
+#include <linux/platform_device.h>
+#include <linux/err.h>
+#include <linux/blkdev.h>
+#include <linux/dmaengine.h>
+#include <linux/dma-mapping.h>
+#include <linux/of_dma.h>
+#include <linux/time.h>
+#include <linux/workqueue.h>
+#include <linux/interrupt.h>
+#include <linux/highmem.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+/* For mmc_card_blockaddr */
+#include "../core/card.h"
+
+#define DRIVER_NAME "sdhost-bcm2835"
+
+#define SDCMD  0x00 /* Command to SD card              - 16 R/W */
+#define SDARG  0x04 /* Argument to SD card             - 32 R/W */
+#define SDTOUT 0x08 /* Start value for timeout counter - 32 R/W */
+#define SDCDIV 0x0c /* Start value for clock divider   - 11 R/W */
+#define SDRSP0 0x10 /* SD card response (31:0)         - 32 R   */
+#define SDRSP1 0x14 /* SD card response (63:32)        - 32 R   */
+#define SDRSP2 0x18 /* SD card response (95:64)        - 32 R   */
+#define SDRSP3 0x1c /* SD card response (127:96)       - 32 R   */
+#define SDHSTS 0x20 /* SD host status                  - 11 R   */
+#define SDVDD  0x30 /* SD card power control           -  1 R/W */
+#define SDEDM  0x34 /* Emergency Debug Mode            - 13 R/W */
+#define SDHCFG 0x38 /* Host configuration              -  2 R/W */
+#define SDHBCT 0x3c /* Host byte count (debug)         - 32 R/W */
+#define SDDATA 0x40 /* Data to/from SD card            - 32 R/W */
+#define SDHBLC 0x50 /* Host block count (SDIO/SDHC)    -  9 R/W */
+
+#define SDCMD_NEW_FLAG                  0x8000
+#define SDCMD_FAIL_FLAG                 0x4000
+#define SDCMD_BUSYWAIT                  0x800
+#define SDCMD_NO_RESPONSE               0x400
+#define SDCMD_LONG_RESPONSE             0x200
+#define SDCMD_WRITE_CMD                 0x80
+#define SDCMD_READ_CMD                  0x40
+#define SDCMD_CMD_MASK                  0x3f
+
+#define SDCDIV_MAX_CDIV                 0x7ff
+
+#define SDHSTS_BUSY_IRPT                0x400
+#define SDHSTS_BLOCK_IRPT               0x200
+#define SDHSTS_SDIO_IRPT                0x100
+#define SDHSTS_REW_TIME_OUT             0x80
+#define SDHSTS_CMD_TIME_OUT             0x40
+#define SDHSTS_CRC16_ERROR              0x20
+#define SDHSTS_CRC7_ERROR               0x10
+#define SDHSTS_FIFO_ERROR               0x08
+/* Reserved */
+/* Reserved */
+#define SDHSTS_DATA_FLAG                0x01
+
+#define SDHSTS_TRANSFER_ERROR_MASK      (SDHSTS_CRC7_ERROR|SDHSTS_CRC16_ERROR|SDHSTS_REW_TIME_OUT|SDHSTS_FIFO_ERROR)
+#define SDHSTS_ERROR_MASK               (SDHSTS_CMD_TIME_OUT|SDHSTS_TRANSFER_ERROR_MASK)
+
+#define SDHCFG_BUSY_IRPT_EN     (1<<10)
+#define SDHCFG_BLOCK_IRPT_EN    (1<<8)
+#define SDHCFG_SDIO_IRPT_EN     (1<<5)
+#define SDHCFG_DATA_IRPT_EN     (1<<4)
+#define SDHCFG_SLOW_CARD        (1<<3)
+#define SDHCFG_WIDE_EXT_BUS     (1<<2)
+#define SDHCFG_WIDE_INT_BUS     (1<<1)
+#define SDHCFG_REL_CMD_LINE     (1<<0)
+
+#define SDEDM_FORCE_DATA_MODE   (1<<19)
+#define SDEDM_CLOCK_PULSE       (1<<20)
+#define SDEDM_BYPASS            (1<<21)
+
+#define SDEDM_WRITE_THRESHOLD_SHIFT 9
+#define SDEDM_READ_THRESHOLD_SHIFT 14
+#define SDEDM_THRESHOLD_MASK     0x1f
+
+#define SDEDM_FSM_MASK           0xf
+#define SDEDM_FSM_IDENTMODE      0x0
+#define SDEDM_FSM_DATAMODE       0x1
+#define SDEDM_FSM_READDATA       0x2
+#define SDEDM_FSM_WRITEDATA      0x3
+#define SDEDM_FSM_READWAIT       0x4
+#define SDEDM_FSM_READCRC        0x5
+#define SDEDM_FSM_WRITECRC       0x6
+#define SDEDM_FSM_WRITEWAIT1     0x7
+#define SDEDM_FSM_POWERDOWN      0x8
+#define SDEDM_FSM_POWERUP        0x9
+#define SDEDM_FSM_WRITESTART1    0xa
+#define SDEDM_FSM_WRITESTART2    0xb
+#define SDEDM_FSM_GENPULSES      0xc
+#define SDEDM_FSM_WRITEWAIT2     0xd
+#define SDEDM_FSM_STARTPOWDOWN   0xf
+
+#define SDDATA_FIFO_WORDS        16
+
+#define USE_CMD23_FLAGS          ((ALLOW_CMD23_READ * MMC_DATA_READ) | \
+				  (ALLOW_CMD23_WRITE * MMC_DATA_WRITE))
+
+#define MHZ 1000000
+
+
+struct bcm2835_host {
+	spinlock_t		lock;
+
+	void __iomem		*ioaddr;
+	u32			bus_addr;
+
+	struct mmc_host		*mmc;
+
+	u32			pio_timeout;	/* In jiffies */
+
+	int			clock;		/* Current clock speed */
+
+	bool			slow_card;	/* Force 11-bit divisor */
+
+	unsigned int		max_clk;	/* Max possible freq */
+
+	struct tasklet_struct	finish_tasklet;	/* Tasklet structures */
+
+	struct work_struct	cmd_wait_wq;	/* Workqueue function */
+
+	struct timer_list	timer;		/* Timer for timeouts */
+
+	struct sg_mapping_iter	sg_miter;	/* SG state for PIO */
+	unsigned int		blocks;		/* remaining PIO blocks */
+
+	int			irq;		/* Device IRQ */
+
+	u32			cmd_quick_poll_retries;
+	u32			ns_per_fifo_word;
+
+	/* cached registers */
+	u32			hcfg;
+	u32			cdiv;
+
+	struct mmc_request		*mrq;			/* Current request */
+	struct mmc_command		*cmd;			/* Current command */
+	struct mmc_data			*data;			/* Current data request */
+	unsigned int			data_complete:1;	/* Data finished before cmd */
+
+	unsigned int			flush_fifo:1;		/* Drain the fifo when finishing */
+
+	unsigned int			use_busy:1;		/* Wait for busy interrupt */
+
+	unsigned int			use_sbc:1;		/* Send CMD23 */
+
+	unsigned int			debug:1;		/* Enable debug output */
+	unsigned int			firmware_sets_cdiv:1;	/* Let the firmware manage the clock */
+	unsigned int			reset_clock:1;		/* Reset the clock fore the next request */
+
+	/*DMA part*/
+	struct dma_chan			*dma_chan_rxtx;		/* DMA channel for reads and writes */
+	struct dma_chan			*dma_chan;		/* Channel in use */
+	struct dma_slave_config		dma_cfg_rx;
+	struct dma_slave_config		dma_cfg_tx;
+	struct dma_async_tx_descriptor	*dma_desc;
+	u32				dma_dir;
+	u32				drain_words;
+	struct page 			*drain_page;
+	u32				drain_offset;
+
+	bool				allow_dma;
+	bool				use_dma;
+	/*end of DMA part*/
+
+	int				max_delay;	/* maximum length of time spent waiting */
+	struct timeval			stop_time;	/* when the last stop was issued */
+	u32				delay_after_stop; /* minimum time between stop and subsequent data transfer */
+	u32				delay_after_this_stop; /* minimum time between this stop and subsequent data transfer */
+	u32				user_overclock_50; /* User's preferred frequency to use when 50MHz is requested (in MHz) */
+	u32				overclock_50;	/* frequency to use when 50MHz is requested (in MHz) */
+	u32				overclock;	/* Current frequency if overclocked, else zero */
+	u32				pio_limit;	/* Maximum block count for PIO (0 = always DMA) */
+
+	u32				sectors;	/* Cached card size in sectors */
+};
+
+#if ENABLE_LOG
+
+struct log_entry_struct {
+	char event[4];
+	u32 timestamp;
+	u32 param1;
+	u32 param2;
+};
+
+typedef struct log_entry_struct LOG_ENTRY_T;
+
+LOG_ENTRY_T *sdhost_log_buf;
+dma_addr_t sdhost_log_addr;
+static u32 sdhost_log_idx;
+static spinlock_t log_lock;
+static void __iomem *timer_base;
+
+#define LOG_ENTRIES (256*1)
+#define LOG_SIZE (sizeof(LOG_ENTRY_T)*LOG_ENTRIES)
+
+static void log_init(struct device *dev, u32 bus_to_phys)
+{
+	spin_lock_init(&log_lock);
+	sdhost_log_buf = dma_zalloc_coherent(dev, LOG_SIZE, &sdhost_log_addr,
+					     GFP_KERNEL);
+	if (sdhost_log_buf) {
+		pr_info("sdhost: log_buf @ %p (%x)\n",
+			sdhost_log_buf, sdhost_log_addr);
+		timer_base = ioremap_nocache(bus_to_phys + 0x7e003000, SZ_4K);
+		if (!timer_base)
+			pr_err("sdhost: failed to remap timer\n");
+	}
+	else
+		pr_err("sdhost: failed to allocate log buf\n");
+}
+
+static void log_event_impl(const char *event, u32 param1, u32 param2)
+{
+	if (sdhost_log_buf) {
+		LOG_ENTRY_T *entry;
+		unsigned long flags;
+
+		spin_lock_irqsave(&log_lock, flags);
+
+		entry = sdhost_log_buf + sdhost_log_idx;
+		memcpy(entry->event, event, 4);
+		entry->timestamp = (readl(timer_base + 4) & 0x3fffffff) +
+			(smp_processor_id()<<30);
+		entry->param1 = param1;
+		entry->param2 = param2;
+		sdhost_log_idx = (sdhost_log_idx + 1) % LOG_ENTRIES;
+
+		spin_unlock_irqrestore(&log_lock, flags);
+	}
+}
+
+static void log_dump(void)
+{
+	if (sdhost_log_buf) {
+		LOG_ENTRY_T *entry;
+		unsigned long flags;
+		int idx;
+
+		spin_lock_irqsave(&log_lock, flags);
+
+		idx = sdhost_log_idx;
+		do {
+			entry = sdhost_log_buf + idx;
+			if (entry->event[0] != '\0')
+				pr_info("[%08x] %.4s %x %x\n",
+				       entry->timestamp,
+				       entry->event,
+				       entry->param1,
+				       entry->param2);
+			idx = (idx + 1) % LOG_ENTRIES;
+		} while (idx != sdhost_log_idx);
+
+		spin_unlock_irqrestore(&log_lock, flags);
+	}
+}
+
+#define log_event(event, param1, param2) log_event_impl(event, param1, param2)
+
+#else
+
+#define log_init(x) (void)0
+#define log_event(event, param1, param2) (void)0
+#define log_dump() (void)0
+
+#endif
+
+static inline void bcm2835_sdhost_write(struct bcm2835_host *host, u32 val, int reg)
+{
+	writel(val, host->ioaddr + reg);
+}
+
+static inline u32 bcm2835_sdhost_read(struct bcm2835_host *host, int reg)
+{
+	return readl(host->ioaddr + reg);
+}
+
+static inline u32 bcm2835_sdhost_read_relaxed(struct bcm2835_host *host, int reg)
+{
+	return readl_relaxed(host->ioaddr + reg);
+}
+
+static void bcm2835_sdhost_dumpcmd(struct bcm2835_host *host,
+				   struct mmc_command *cmd,
+				   const char *label)
+{
+	if (cmd)
+		pr_info("%s:%c%s op %d arg 0x%x flags 0x%x - resp %08x %08x %08x %08x, err %d\n",
+			mmc_hostname(host->mmc),
+			(cmd == host->cmd) ? '>' : ' ',
+			label, cmd->opcode, cmd->arg, cmd->flags,
+			cmd->resp[0], cmd->resp[1], cmd->resp[2], cmd->resp[3],
+			cmd->error);
+}
+
+static void bcm2835_sdhost_dumpregs(struct bcm2835_host *host)
+{
+	if (host->mrq)
+	{
+		bcm2835_sdhost_dumpcmd(host, host->mrq->sbc, "sbc");
+		bcm2835_sdhost_dumpcmd(host, host->mrq->cmd, "cmd");
+		if (host->mrq->data)
+			pr_info("%s: data blocks %x blksz %x - err %d\n",
+			       mmc_hostname(host->mmc),
+			       host->mrq->data->blocks,
+			       host->mrq->data->blksz,
+			       host->mrq->data->error);
+		bcm2835_sdhost_dumpcmd(host, host->mrq->stop, "stop");
+	}
+
+	pr_info("%s: =========== REGISTER DUMP ===========\n",
+		mmc_hostname(host->mmc));
+
+	pr_info("%s: SDCMD  0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDCMD));
+	pr_info("%s: SDARG  0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDARG));
+	pr_info("%s: SDTOUT 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDTOUT));
+	pr_info("%s: SDCDIV 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDCDIV));
+	pr_info("%s: SDRSP0 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDRSP0));
+	pr_info("%s: SDRSP1 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDRSP1));
+	pr_info("%s: SDRSP2 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDRSP2));
+	pr_info("%s: SDRSP3 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDRSP3));
+	pr_info("%s: SDHSTS 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDHSTS));
+	pr_info("%s: SDVDD  0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDVDD));
+	pr_info("%s: SDEDM  0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDEDM));
+	pr_info("%s: SDHCFG 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDHCFG));
+	pr_info("%s: SDHBCT 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDHBCT));
+	pr_info("%s: SDHBLC 0x%08x\n",
+		mmc_hostname(host->mmc),
+		bcm2835_sdhost_read(host, SDHBLC));
+
+	pr_info("%s: ===========================================\n",
+		mmc_hostname(host->mmc));
+}
+
+static void bcm2835_sdhost_set_power(struct bcm2835_host *host, bool on)
+{
+	bcm2835_sdhost_write(host, on ? 1 : 0, SDVDD);
+}
+
+static void bcm2835_sdhost_reset_internal(struct bcm2835_host *host)
+{
+	u32 temp;
+
+	if (host->debug)
+		pr_info("%s: reset\n", mmc_hostname(host->mmc));
+
+	bcm2835_sdhost_set_power(host, false);
+
+	bcm2835_sdhost_write(host, 0, SDCMD);
+	bcm2835_sdhost_write(host, 0, SDARG);
+	bcm2835_sdhost_write(host, 0xf00000, SDTOUT);
+	bcm2835_sdhost_write(host, 0, SDCDIV);
+	bcm2835_sdhost_write(host, 0x7f8, SDHSTS); /* Write 1s to clear */
+	bcm2835_sdhost_write(host, 0, SDHCFG);
+	bcm2835_sdhost_write(host, 0, SDHBCT);
+	bcm2835_sdhost_write(host, 0, SDHBLC);
+
+	/* Limit fifo usage due to silicon bug */
+	temp = bcm2835_sdhost_read(host, SDEDM);
+	temp &= ~((SDEDM_THRESHOLD_MASK<<SDEDM_READ_THRESHOLD_SHIFT) |
+		  (SDEDM_THRESHOLD_MASK<<SDEDM_WRITE_THRESHOLD_SHIFT));
+	temp |= (FIFO_READ_THRESHOLD << SDEDM_READ_THRESHOLD_SHIFT) |
+		(FIFO_WRITE_THRESHOLD << SDEDM_WRITE_THRESHOLD_SHIFT);
+	bcm2835_sdhost_write(host, temp, SDEDM);
+	mdelay(10);
+	bcm2835_sdhost_set_power(host, true);
+	mdelay(10);
+	host->clock = 0;
+	host->sectors = 0;
+	bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
+	bcm2835_sdhost_write(host, SDCDIV_MAX_CDIV, SDCDIV);
+	mmiowb();
+}
+
+static void bcm2835_sdhost_reset(struct mmc_host *mmc)
+{
+	struct bcm2835_host *host = mmc_priv(mmc);
+	unsigned long flags;
+	spin_lock_irqsave(&host->lock, flags);
+	log_event("RST<", 0, 0);
+
+	bcm2835_sdhost_reset_internal(host);
+
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void bcm2835_sdhost_set_ios(struct mmc_host *mmc, struct mmc_ios *ios);
+
+static void bcm2835_sdhost_init(struct bcm2835_host *host, int soft)
+{
+	pr_debug("bcm2835_sdhost_init(%d)\n", soft);
+
+	/* Set interrupt enables */
+	host->hcfg = SDHCFG_BUSY_IRPT_EN;
+
+	bcm2835_sdhost_reset_internal(host);
+
+	if (soft) {
+		/* force clock reconfiguration */
+		host->clock = 0;
+		bcm2835_sdhost_set_ios(host->mmc, &host->mmc->ios);
+	}
+}
+
+static void bcm2835_sdhost_wait_transfer_complete(struct bcm2835_host *host)
+{
+	int timediff;
+	u32 alternate_idle;
+	u32 edm;
+
+	alternate_idle = (host->mrq->data->flags & MMC_DATA_READ) ?
+		SDEDM_FSM_READWAIT : SDEDM_FSM_WRITESTART1;
+
+	edm = bcm2835_sdhost_read(host, SDEDM);
+
+	log_event("WTC<", edm, 0);
+
+	timediff = 0;
+
+	while (1) {
+		u32 fsm = edm & SDEDM_FSM_MASK;
+		if ((fsm == SDEDM_FSM_IDENTMODE) ||
+		    (fsm == SDEDM_FSM_DATAMODE))
+			break;
+		if (fsm == alternate_idle) {
+			bcm2835_sdhost_write(host,
+					     edm | SDEDM_FORCE_DATA_MODE,
+					     SDEDM);
+			break;
+		}
+
+		timediff++;
+		if (timediff == 100000) {
+			pr_err("%s: wait_transfer_complete - still waiting after %d retries\n",
+			       mmc_hostname(host->mmc),
+			       timediff);
+			log_dump();
+			bcm2835_sdhost_dumpregs(host);
+			host->mrq->data->error = -ETIMEDOUT;
+			log_event("WTC!", edm, 0);
+			return;
+		}
+		cpu_relax();
+		edm = bcm2835_sdhost_read(host, SDEDM);
+	}
+	log_event("WTC>", edm, 0);
+}
+
+static void bcm2835_sdhost_finish_data(struct bcm2835_host *host);
+
+static void bcm2835_sdhost_dma_complete(void *param)
+{
+	struct bcm2835_host *host = param;
+	struct mmc_data *data = host->data;
+	unsigned long flags;
+
+	spin_lock_irqsave(&host->lock, flags);
+	log_event("DMA<", (u32)host->data, bcm2835_sdhost_read(host, SDHSTS));
+	log_event("DMA ", bcm2835_sdhost_read(host, SDCMD),
+		  bcm2835_sdhost_read(host, SDEDM));
+
+	if (host->dma_chan) {
+		dma_unmap_sg(host->dma_chan->device->dev,
+			     data->sg, data->sg_len,
+			     host->dma_dir);
+
+		host->dma_chan = NULL;
+	}
+
+	if (host->drain_words) {
+		void *page;
+		u32 *buf;
+
+		page = kmap_atomic(host->drain_page);
+		buf = page + host->drain_offset;
+
+		while (host->drain_words) {
+			u32 edm = bcm2835_sdhost_read(host, SDEDM);
+			if ((edm >> 4) & 0x1f)
+				*(buf++) = bcm2835_sdhost_read(host,
+							       SDDATA);
+			host->drain_words--;
+		}
+
+		kunmap_atomic(page);
+	}
+
+	bcm2835_sdhost_finish_data(host);
+
+	log_event("DMA>", (u32)host->data, 0);
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void bcm2835_sdhost_read_block_pio(struct bcm2835_host *host)
+{
+	unsigned long flags;
+	size_t blksize, len;
+	u32 *buf;
+	unsigned long wait_max;
+
+	blksize = host->data->blksz;
+
+	wait_max = jiffies + msecs_to_jiffies(host->pio_timeout);
+
+	local_irq_save(flags);
+
+	while (blksize) {
+		int copy_words;
+		u32 hsts = 0;
+
+		if (!sg_miter_next(&host->sg_miter)) {
+			host->data->error = -EINVAL;
+			break;
+		}
+
+		len = min(host->sg_miter.length, blksize);
+		if (len % 4) {
+			host->data->error = -EINVAL;
+			break;
+		}
+
+		blksize -= len;
+		host->sg_miter.consumed = len;
+
+		buf = (u32 *)host->sg_miter.addr;
+
+		copy_words = len/4;
+
+		while (copy_words) {
+			int burst_words, words;
+			u32 edm;
+
+			burst_words = SDDATA_FIFO_PIO_BURST;
+			if (burst_words > copy_words)
+				burst_words = copy_words;
+			edm = bcm2835_sdhost_read(host, SDEDM);
+			words = ((edm >> 4) & 0x1f);
+
+			if (words < burst_words) {
+				int fsm_state = (edm & SDEDM_FSM_MASK);
+				if ((fsm_state != SDEDM_FSM_READDATA) &&
+				    (fsm_state != SDEDM_FSM_READWAIT) &&
+				    (fsm_state != SDEDM_FSM_READCRC)) {
+					hsts = bcm2835_sdhost_read(host,
+								   SDHSTS);
+					pr_info("%s: fsm %x, hsts %x\n",
+					       mmc_hostname(host->mmc),
+					       fsm_state, hsts);
+					if (hsts & SDHSTS_ERROR_MASK)
+						break;
+				}
+
+				if (time_after(jiffies, wait_max)) {
+					pr_err("%s: PIO read timeout - EDM %x\n",
+					       mmc_hostname(host->mmc),
+					       edm);
+					hsts = SDHSTS_REW_TIME_OUT;
+					break;
+				}
+				ndelay((burst_words - words) *
+				       host->ns_per_fifo_word);
+				continue;
+			} else if (words > copy_words) {
+				words = copy_words;
+			}
+
+			copy_words -= words;
+
+			while (words) {
+				*(buf++) = bcm2835_sdhost_read(host, SDDATA);
+				words--;
+			}
+		}
+
+		if (hsts & SDHSTS_ERROR_MASK)
+			break;
+	}
+
+	sg_miter_stop(&host->sg_miter);
+
+	local_irq_restore(flags);
+}
+
+static void bcm2835_sdhost_write_block_pio(struct bcm2835_host *host)
+{
+	unsigned long flags;
+	size_t blksize, len;
+	u32 *buf;
+	unsigned long wait_max;
+
+	blksize = host->data->blksz;
+
+	wait_max = jiffies + msecs_to_jiffies(host->pio_timeout);
+
+	local_irq_save(flags);
+
+	while (blksize) {
+		int copy_words;
+		u32 hsts = 0;
+
+		if (!sg_miter_next(&host->sg_miter)) {
+			host->data->error = -EINVAL;
+			break;
+		}
+
+		len = min(host->sg_miter.length, blksize);
+		if (len % 4) {
+			host->data->error = -EINVAL;
+			break;
+		}
+
+		blksize -= len;
+		host->sg_miter.consumed = len;
+
+		buf = (u32 *)host->sg_miter.addr;
+
+		copy_words = len/4;
+
+		while (copy_words) {
+			int burst_words, words;
+			u32 edm;
+
+			burst_words = SDDATA_FIFO_PIO_BURST;
+			if (burst_words > copy_words)
+				burst_words = copy_words;
+			edm = bcm2835_sdhost_read(host, SDEDM);
+			words = SDDATA_FIFO_WORDS - ((edm >> 4) & 0x1f);
+
+			if (words < burst_words) {
+				int fsm_state = (edm & SDEDM_FSM_MASK);
+				if ((fsm_state != SDEDM_FSM_WRITEDATA) &&
+				    (fsm_state != SDEDM_FSM_WRITESTART1) &&
+				    (fsm_state != SDEDM_FSM_WRITESTART2)) {
+					hsts = bcm2835_sdhost_read(host,
+								   SDHSTS);
+					pr_info("%s: fsm %x, hsts %x\n",
+					       mmc_hostname(host->mmc),
+					       fsm_state, hsts);
+					if (hsts & SDHSTS_ERROR_MASK)
+						break;
+				}
+
+				if (time_after(jiffies, wait_max)) {
+					pr_err("%s: PIO write timeout - EDM %x\n",
+					       mmc_hostname(host->mmc),
+					       edm);
+					hsts = SDHSTS_REW_TIME_OUT;
+					break;
+				}
+				ndelay((burst_words - words) *
+				       host->ns_per_fifo_word);
+				continue;
+			} else if (words > copy_words) {
+				words = copy_words;
+			}
+
+			copy_words -= words;
+
+			while (words) {
+				bcm2835_sdhost_write(host, *(buf++), SDDATA);
+				words--;
+			}
+		}
+
+		if (hsts & SDHSTS_ERROR_MASK)
+			break;
+	}
+
+	sg_miter_stop(&host->sg_miter);
+
+	local_irq_restore(flags);
+}
+
+static void bcm2835_sdhost_transfer_pio(struct bcm2835_host *host)
+{
+	u32 sdhsts;
+	bool is_read;
+	BUG_ON(!host->data);
+	log_event("XFP<", (u32)host->data, host->blocks);
+
+	is_read = (host->data->flags & MMC_DATA_READ) != 0;
+	if (is_read)
+		bcm2835_sdhost_read_block_pio(host);
+	else
+		bcm2835_sdhost_write_block_pio(host);
+
+	sdhsts = bcm2835_sdhost_read(host, SDHSTS);
+	if (sdhsts & (SDHSTS_CRC16_ERROR |
+		      SDHSTS_CRC7_ERROR |
+		      SDHSTS_FIFO_ERROR)) {
+		pr_err("%s: %s transfer error - HSTS %x\n",
+		       mmc_hostname(host->mmc),
+		       is_read ? "read" : "write",
+		       sdhsts);
+		host->data->error = -EILSEQ;
+	} else if ((sdhsts & (SDHSTS_CMD_TIME_OUT |
+			      SDHSTS_REW_TIME_OUT))) {
+		pr_err("%s: %s timeout error - HSTS %x\n",
+		       mmc_hostname(host->mmc),
+		       is_read ? "read" : "write",
+		       sdhsts);
+		host->data->error = -ETIMEDOUT;
+	}
+	log_event("XFP>", (u32)host->data, host->blocks);
+}
+
+static void bcm2835_sdhost_prepare_dma(struct bcm2835_host *host,
+	struct mmc_data *data)
+{
+	int len, dir_data, dir_slave;
+	struct dma_async_tx_descriptor *desc = NULL;
+	struct dma_chan *dma_chan;
+
+	log_event("PRD<", (u32)data, 0);
+	pr_debug("bcm2835_sdhost_prepare_dma()\n");
+
+	dma_chan = host->dma_chan_rxtx;
+	if (data->flags & MMC_DATA_READ) {
+		dir_data = DMA_FROM_DEVICE;
+		dir_slave = DMA_DEV_TO_MEM;
+	} else {
+		dir_data = DMA_TO_DEVICE;
+		dir_slave = DMA_MEM_TO_DEV;
+	}
+	log_event("PRD1", (u32)dma_chan, 0);
+
+	BUG_ON(!dma_chan->device);
+	BUG_ON(!dma_chan->device->dev);
+	BUG_ON(!data->sg);
+
+	/* The block doesn't manage the FIFO DREQs properly for multi-block
+	   transfers, so don't attempt to DMA the final few words.
+	   Unfortunately this requires the final sg entry to be trimmed.
+	   N.B. This code demands that the overspill is contained in
+	   a single sg entry.
+	*/
+
+	host->drain_words = 0;
+	if ((data->blocks > 1) && (dir_data == DMA_FROM_DEVICE)) {
+		struct scatterlist *sg;
+		u32 len;
+		int i;
+
+		len = min((u32)(FIFO_READ_THRESHOLD - 1) * 4,
+			  (u32)data->blocks * data->blksz);
+
+		for_each_sg(data->sg, sg, data->sg_len, i) {
+			if (sg_is_last(sg)) {
+				BUG_ON(sg->length < len);
+				sg->length -= len;
+				host->drain_page = sg_page(sg);
+				host->drain_offset = sg->offset + sg->length;
+			}
+		}
+		host->drain_words = len/4;
+	}
+
+	/* The parameters have already been validated, so this will not fail */
+	(void)dmaengine_slave_config(dma_chan,
+				     (dir_data == DMA_FROM_DEVICE) ?
+				     &host->dma_cfg_rx :
+				     &host->dma_cfg_tx);
+
+	len = dma_map_sg(dma_chan->device->dev, data->sg, data->sg_len,
+			 dir_data);
+
+	log_event("PRD2", len, 0);
+	if (len > 0)
+		desc = dmaengine_prep_slave_sg(dma_chan, data->sg,
+					       len, dir_slave,
+					       DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+	log_event("PRD3", (u32)desc, 0);
+
+	if (desc) {
+		desc->callback = bcm2835_sdhost_dma_complete;
+		desc->callback_param = host;
+		host->dma_desc = desc;
+		host->dma_chan = dma_chan;
+		host->dma_dir = dir_data;
+	}
+	log_event("PDM>", (u32)data, 0);
+}
+
+static void bcm2835_sdhost_start_dma(struct bcm2835_host *host)
+{
+	log_event("SDMA", (u32)host->data, (u32)host->dma_chan);
+	dmaengine_submit(host->dma_desc);
+	dma_async_issue_pending(host->dma_chan);
+}
+
+static void bcm2835_sdhost_set_transfer_irqs(struct bcm2835_host *host)
+{
+	u32 all_irqs = SDHCFG_DATA_IRPT_EN | SDHCFG_BLOCK_IRPT_EN |
+		SDHCFG_BUSY_IRPT_EN;
+	if (host->dma_desc)
+		host->hcfg = (host->hcfg & ~all_irqs) |
+			SDHCFG_BUSY_IRPT_EN;
+	else
+		host->hcfg = (host->hcfg & ~all_irqs) |
+			SDHCFG_DATA_IRPT_EN |
+			SDHCFG_BUSY_IRPT_EN;
+
+	bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
+}
+
+static void bcm2835_sdhost_prepare_data(struct bcm2835_host *host, struct mmc_command *cmd)
+{
+	struct mmc_data *data = cmd->data;
+
+	WARN_ON(host->data);
+
+	host->data = data;
+	if (!data)
+		return;
+
+	/* Sanity checks */
+	BUG_ON(data->blksz * data->blocks > 524288);
+	BUG_ON(data->blksz > host->mmc->max_blk_size);
+	BUG_ON(data->blocks > 65535);
+
+	host->data_complete = 0;
+	host->flush_fifo = 0;
+	host->data->bytes_xfered = 0;
+
+	if (!host->sectors && host->mmc->card) {
+		struct mmc_card *card = host->mmc->card;
+		if (!mmc_card_sd(card) && mmc_card_blockaddr(card)) {
+			/*
+			 * The EXT_CSD sector count is in number of 512 byte
+			 * sectors.
+			 */
+			host->sectors = card->ext_csd.sectors;
+		} else {
+			/*
+			 * The CSD capacity field is in units of read_blkbits.
+			 * set_capacity takes units of 512 bytes.
+			 */
+			host->sectors = card->csd.capacity <<
+				(card->csd.read_blkbits - 9);
+		}
+	}
+
+	if (!host->dma_desc) {
+		/* Use PIO */
+		int flags = SG_MITER_ATOMIC;
+
+		if (data->flags & MMC_DATA_READ)
+			flags |= SG_MITER_TO_SG;
+		else
+			flags |= SG_MITER_FROM_SG;
+		sg_miter_start(&host->sg_miter, data->sg, data->sg_len, flags);
+		host->blocks = data->blocks;
+	}
+
+	bcm2835_sdhost_set_transfer_irqs(host);
+
+	bcm2835_sdhost_write(host, data->blksz, SDHBCT);
+	bcm2835_sdhost_write(host, data->blocks, SDHBLC);
+
+	BUG_ON(!host->data);
+}
+
+bool bcm2835_sdhost_send_command(struct bcm2835_host *host,
+				 struct mmc_command *cmd)
+{
+	u32 sdcmd, sdhsts;
+	unsigned long timeout;
+	int delay;
+
+	WARN_ON(host->cmd);
+	log_event("CMD<", cmd->opcode, cmd->arg);
+
+	if (cmd->data)
+		pr_debug("%s: send_command %d 0x%x "
+			 "(flags 0x%x) - %s %d*%d\n",
+			 mmc_hostname(host->mmc),
+			 cmd->opcode, cmd->arg, cmd->flags,
+			 (cmd->data->flags & MMC_DATA_READ) ?
+			 "read" : "write", cmd->data->blocks,
+			 cmd->data->blksz);
+	else
+		pr_debug("%s: send_command %d 0x%x (flags 0x%x)\n",
+			 mmc_hostname(host->mmc),
+			 cmd->opcode, cmd->arg, cmd->flags);
+
+	/* Wait max 100 ms */
+	timeout = 10000;
+
+	while (bcm2835_sdhost_read(host, SDCMD) & SDCMD_NEW_FLAG) {
+		if (timeout == 0) {
+			pr_warn("%s: previous command never completed.\n",
+				mmc_hostname(host->mmc));
+			if (host->debug)
+				bcm2835_sdhost_dumpregs(host);
+			cmd->error = -EILSEQ;
+			tasklet_schedule(&host->finish_tasklet);
+			return false;
+		}
+		timeout--;
+		udelay(10);
+	}
+
+	delay = (10000 - timeout)/100;
+	if (delay > host->max_delay) {
+		host->max_delay = delay;
+		pr_warning("%s: controller hung for %d ms\n",
+			   mmc_hostname(host->mmc),
+			   host->max_delay);
+	}
+
+	timeout = jiffies;
+	if (!cmd->data && cmd->busy_timeout > 9000)
+		timeout += DIV_ROUND_UP(cmd->busy_timeout, 1000) * HZ + HZ;
+	else
+		timeout += 10 * HZ;
+	mod_timer(&host->timer, timeout);
+
+	host->cmd = cmd;
+
+	/* Clear any error flags */
+	sdhsts = bcm2835_sdhost_read(host, SDHSTS);
+	if (sdhsts & SDHSTS_ERROR_MASK)
+		bcm2835_sdhost_write(host, sdhsts, SDHSTS);
+
+	if ((cmd->flags & MMC_RSP_136) && (cmd->flags & MMC_RSP_BUSY)) {
+		pr_err("%s: unsupported response type!\n",
+			mmc_hostname(host->mmc));
+		cmd->error = -EINVAL;
+		tasklet_schedule(&host->finish_tasklet);
+		return false;
+	}
+
+	bcm2835_sdhost_prepare_data(host, cmd);
+
+	bcm2835_sdhost_write(host, cmd->arg, SDARG);
+
+	sdcmd = cmd->opcode & SDCMD_CMD_MASK;
+
+	host->use_busy = 0;
+	if (!(cmd->flags & MMC_RSP_PRESENT)) {
+		sdcmd |= SDCMD_NO_RESPONSE;
+	} else {
+		if (cmd->flags & MMC_RSP_136)
+			sdcmd |= SDCMD_LONG_RESPONSE;
+		if (cmd->flags & MMC_RSP_BUSY) {
+			sdcmd |= SDCMD_BUSYWAIT;
+			host->use_busy = 1;
+		}
+	}
+
+	if (cmd->data) {
+		log_event("CMDD", cmd->data->blocks, cmd->data->blksz);
+		if (host->delay_after_this_stop) {
+			struct timeval now;
+			int time_since_stop;
+			do_gettimeofday(&now);
+			time_since_stop = (now.tv_sec - host->stop_time.tv_sec);
+			if (time_since_stop < 2) {
+				/* Possibly less than one second */
+				time_since_stop = time_since_stop * 1000000 +
+					(now.tv_usec - host->stop_time.tv_usec);
+				if (time_since_stop <
+				    host->delay_after_this_stop)
+					udelay(host->delay_after_this_stop -
+					       time_since_stop);
+			}
+		}
+
+		host->delay_after_this_stop = host->delay_after_stop;
+		if ((cmd->data->flags & MMC_DATA_READ) && !host->use_sbc) {
+			/* See if read crosses one of the hazardous sectors */
+			u32 first_blk, last_blk;
+
+			/* Intentionally include the following sector because
+			   without CMD23/SBC the read may run on. */
+			first_blk = host->mrq->cmd->arg;
+			last_blk = first_blk + cmd->data->blocks;
+
+			if (((last_blk >= (host->sectors - 64)) &&
+			     (first_blk <= (host->sectors - 64))) ||
+			    ((last_blk >= (host->sectors - 32)) &&
+			     (first_blk <= (host->sectors - 32)))) {
+				host->delay_after_this_stop =
+					max(250u, host->delay_after_stop);
+			}
+		}
+
+		if (cmd->data->flags & MMC_DATA_WRITE)
+			sdcmd |= SDCMD_WRITE_CMD;
+		if (cmd->data->flags & MMC_DATA_READ)
+			sdcmd |= SDCMD_READ_CMD;
+	}
+
+	bcm2835_sdhost_write(host, sdcmd | SDCMD_NEW_FLAG, SDCMD);
+
+	return true;
+}
+
+static void bcm2835_sdhost_finish_command(struct bcm2835_host *host,
+					  unsigned long *irq_flags);
+static void bcm2835_sdhost_transfer_complete(struct bcm2835_host *host);
+
+static void bcm2835_sdhost_finish_data(struct bcm2835_host *host)
+{
+	struct mmc_data *data;
+
+	data = host->data;
+	BUG_ON(!data);
+
+	log_event("FDA<", (u32)host->mrq, (u32)host->cmd);
+	pr_debug("finish_data(error %d, stop %d, sbc %d)\n",
+	       data->error, data->stop ? 1 : 0,
+	       host->mrq->sbc ? 1 : 0);
+
+	host->hcfg &= ~(SDHCFG_DATA_IRPT_EN | SDHCFG_BLOCK_IRPT_EN);
+	bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
+
+	data->bytes_xfered = data->error ? 0 : (data->blksz * data->blocks);
+
+	host->data_complete = 1;
+
+	if (host->cmd) {
+		/*
+		 * Data managed to finish before the
+		 * command completed. Make sure we do
+		 * things in the proper order.
+		 */
+		pr_debug("Finished early - HSTS %x\n",
+			 bcm2835_sdhost_read(host, SDHSTS));
+	}
+	else
+		bcm2835_sdhost_transfer_complete(host);
+	log_event("FDA>", (u32)host->mrq, (u32)host->cmd);
+}
+
+static void bcm2835_sdhost_transfer_complete(struct bcm2835_host *host)
+{
+	struct mmc_data *data;
+
+	BUG_ON(host->cmd);
+	BUG_ON(!host->data);
+	BUG_ON(!host->data_complete);
+
+	data = host->data;
+	host->data = NULL;
+
+	log_event("TCM<", (u32)data, data->error);
+	pr_debug("transfer_complete(error %d, stop %d)\n",
+	       data->error, data->stop ? 1 : 0);
+
+	/*
+	 * Need to send CMD12 if -
+	 * a) open-ended multiblock transfer (no CMD23)
+	 * b) error in multiblock transfer
+	 */
+	if (host->mrq->stop && (data->error || !host->use_sbc)) {
+		if (bcm2835_sdhost_send_command(host, host->mrq->stop)) {
+			/* No busy, so poll for completion */
+			if (!host->use_busy)
+				bcm2835_sdhost_finish_command(host, NULL);
+
+			if (host->delay_after_this_stop)
+				do_gettimeofday(&host->stop_time);
+		}
+	} else {
+		bcm2835_sdhost_wait_transfer_complete(host);
+		tasklet_schedule(&host->finish_tasklet);
+	}
+	log_event("TCM>", (u32)data, 0);
+}
+
+/* If irq_flags is valid, the caller is in a thread context and is allowed
+   to sleep */
+static void bcm2835_sdhost_finish_command(struct bcm2835_host *host,
+					  unsigned long *irq_flags)
+{
+	u32 sdcmd;
+	u32 retries;
+#ifdef DEBUG
+	struct timeval before, after;
+	int timediff = 0;
+#endif
+
+	log_event("FCM<", (u32)host->mrq, (u32)host->cmd);
+	pr_debug("finish_command(%x)\n", bcm2835_sdhost_read(host, SDCMD));
+
+	BUG_ON(!host->cmd || !host->mrq);
+
+	/* Poll quickly at first */
+
+	retries = host->cmd_quick_poll_retries;
+	if (!retries) {
+		/* Work out how many polls take 1us by timing 10us */
+		struct timeval start, now;
+		int us_diff;
+
+		retries = 1;
+		do {
+			int i;
+
+			retries *= 2;
+
+			do_gettimeofday(&start);
+
+			for (i = 0; i < retries; i++) {
+				cpu_relax();
+				sdcmd = bcm2835_sdhost_read(host, SDCMD);
+			}
+
+			do_gettimeofday(&now);
+			us_diff = (now.tv_sec - start.tv_sec) * 1000000 +
+				(now.tv_usec - start.tv_usec);
+		} while (us_diff < 10);
+
+		host->cmd_quick_poll_retries = ((retries * us_diff + 9)*CMD_DALLY_US)/10 + 1;
+		retries = 1; // We've already waited long enough this time
+	}
+
+	for (sdcmd = bcm2835_sdhost_read(host, SDCMD);
+	     (sdcmd & SDCMD_NEW_FLAG) && retries;
+	     retries--) {
+		cpu_relax();
+		sdcmd = bcm2835_sdhost_read(host, SDCMD);
+	}
+
+	if (!retries) {
+		unsigned long wait_max;
+
+		if (!irq_flags) {
+			/* Schedule the work */
+			log_event("CWWQ", 0, 0);
+			schedule_work(&host->cmd_wait_wq);
+			return;
+		}
+
+		/* Wait max 100 ms */
+		wait_max = jiffies + msecs_to_jiffies(100);
+		while (time_before(jiffies, wait_max)) {
+			spin_unlock_irqrestore(&host->lock, *irq_flags);
+			usleep_range(1, 10);
+			spin_lock_irqsave(&host->lock, *irq_flags);
+			sdcmd = bcm2835_sdhost_read(host, SDCMD);
+			if (!(sdcmd & SDCMD_NEW_FLAG))
+				break;
+		}
+	}
+
+	/* Check for errors */
+	if (sdcmd & SDCMD_NEW_FLAG) {
+		if (host->debug) {
+			pr_err("%s: command %d never completed.\n",
+			       mmc_hostname(host->mmc), host->cmd->opcode);
+			bcm2835_sdhost_dumpregs(host);
+		}
+		host->cmd->error = -EILSEQ;
+		tasklet_schedule(&host->finish_tasklet);
+		return;
+	} else if (sdcmd & SDCMD_FAIL_FLAG) {
+		u32 sdhsts = bcm2835_sdhost_read(host, SDHSTS);
+
+		/* Clear the errors */
+		bcm2835_sdhost_write(host, SDHSTS_ERROR_MASK, SDHSTS);
+
+		if (host->debug)
+			pr_info("%s: error detected - CMD %x, HSTS %03x, EDM %x\n",
+				mmc_hostname(host->mmc), sdcmd, sdhsts,
+				bcm2835_sdhost_read(host, SDEDM));
+
+		if ((sdhsts & SDHSTS_CRC7_ERROR) &&
+		    (host->cmd->opcode == 1)) {
+			if (host->debug)
+				pr_info("%s: ignoring CRC7 error for CMD1\n",
+					mmc_hostname(host->mmc));
+		} else {
+			if (sdhsts & SDHSTS_CMD_TIME_OUT) {
+				if (host->debug)
+					pr_warn("%s: command %d timeout\n",
+					       mmc_hostname(host->mmc),
+					       host->cmd->opcode);
+				host->cmd->error = -ETIMEDOUT;
+			} else {
+				pr_warn("%s: unexpected command %d error\n",
+				       mmc_hostname(host->mmc),
+				       host->cmd->opcode);
+				host->cmd->error = -EILSEQ;
+			}
+			tasklet_schedule(&host->finish_tasklet);
+			return;
+		}
+	}
+
+	if (host->cmd->flags & MMC_RSP_PRESENT) {
+		if (host->cmd->flags & MMC_RSP_136) {
+			int i;
+			for (i = 0; i < 4; i++)
+				host->cmd->resp[3 - i] = bcm2835_sdhost_read(host, SDRSP0 + i*4);
+			pr_debug("%s: finish_command %08x %08x %08x %08x\n",
+				 mmc_hostname(host->mmc),
+				 host->cmd->resp[0], host->cmd->resp[1], host->cmd->resp[2], host->cmd->resp[3]);
+			log_event("RSP ", host->cmd->resp[0], host->cmd->resp[1]);
+		} else {
+			host->cmd->resp[0] = bcm2835_sdhost_read(host, SDRSP0);
+			pr_debug("%s: finish_command %08x\n",
+				 mmc_hostname(host->mmc),
+				 host->cmd->resp[0]);
+			log_event("RSP ", host->cmd->resp[0], 0);
+		}
+	}
+
+	if (host->cmd == host->mrq->sbc) {
+		/* Finished CMD23, now send actual command. */
+		host->cmd = NULL;
+		if (bcm2835_sdhost_send_command(host, host->mrq->cmd)) {
+			if (host->data && host->dma_desc)
+				/* DMA transfer starts now, PIO starts after irq */
+				bcm2835_sdhost_start_dma(host);
+
+			if (!host->use_busy)
+				bcm2835_sdhost_finish_command(host, NULL);
+		}
+	} else if (host->cmd == host->mrq->stop) {
+		/* Finished CMD12 */
+		tasklet_schedule(&host->finish_tasklet);
+	} else {
+		/* Processed actual command. */
+		host->cmd = NULL;
+		if (!host->data)
+			tasklet_schedule(&host->finish_tasklet);
+		else if (host->data_complete)
+			bcm2835_sdhost_transfer_complete(host);
+	}
+	log_event("FCM>", (u32)host->mrq, (u32)host->cmd);
+}
+
+static void bcm2835_sdhost_timeout(unsigned long data)
+{
+	struct bcm2835_host *host;
+	unsigned long flags;
+
+	host = (struct bcm2835_host *)data;
+
+	spin_lock_irqsave(&host->lock, flags);
+	log_event("TIM<", 0, 0);
+
+	if (host->mrq) {
+		pr_err("%s: timeout waiting for hardware interrupt.\n",
+			mmc_hostname(host->mmc));
+		log_dump();
+		bcm2835_sdhost_dumpregs(host);
+
+		if (host->data) {
+			host->data->error = -ETIMEDOUT;
+			bcm2835_sdhost_finish_data(host);
+		} else {
+			if (host->cmd)
+				host->cmd->error = -ETIMEDOUT;
+			else
+				host->mrq->cmd->error = -ETIMEDOUT;
+
+			pr_debug("timeout_timer tasklet_schedule\n");
+			tasklet_schedule(&host->finish_tasklet);
+		}
+	}
+
+	mmiowb();
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void bcm2835_sdhost_busy_irq(struct bcm2835_host *host, u32 intmask)
+{
+	log_event("IRQB", (u32)host->cmd, intmask);
+	if (!host->cmd) {
+		pr_err("%s: got command busy interrupt 0x%08x even "
+			"though no command operation was in progress.\n",
+			mmc_hostname(host->mmc), (unsigned)intmask);
+		bcm2835_sdhost_dumpregs(host);
+		return;
+	}
+
+	if (!host->use_busy) {
+		pr_err("%s: got command busy interrupt 0x%08x even "
+			"though not expecting one.\n",
+			mmc_hostname(host->mmc), (unsigned)intmask);
+		bcm2835_sdhost_dumpregs(host);
+		return;
+	}
+	host->use_busy = 0;
+
+	if (intmask & SDHSTS_ERROR_MASK)
+	{
+		pr_err("sdhost_busy_irq: intmask %x, data %p\n", intmask, host->mrq->data);
+		if (intmask & SDHSTS_CRC7_ERROR)
+			host->cmd->error = -EILSEQ;
+		else if (intmask & (SDHSTS_CRC16_ERROR |
+				    SDHSTS_FIFO_ERROR)) {
+			if (host->mrq->data)
+				host->mrq->data->error = -EILSEQ;
+			else
+				host->cmd->error = -EILSEQ;
+		} else if (intmask & SDHSTS_REW_TIME_OUT) {
+			if (host->mrq->data)
+				host->mrq->data->error = -ETIMEDOUT;
+			else
+				host->cmd->error = -ETIMEDOUT;
+		} else if (intmask & SDHSTS_CMD_TIME_OUT)
+			host->cmd->error = -ETIMEDOUT;
+
+		if (host->debug) {
+			log_dump();
+			bcm2835_sdhost_dumpregs(host);
+		}
+	}
+	else
+		bcm2835_sdhost_finish_command(host, NULL);
+}
+
+static void bcm2835_sdhost_data_irq(struct bcm2835_host *host, u32 intmask)
+{
+	/* There are no dedicated data/space available interrupt
+	   status bits, so it is necessary to use the single shared
+	   data/space available FIFO status bits. It is therefore not
+	   an error to get here when there is no data transfer in
+	   progress. */
+	log_event("IRQD", (u32)host->data, intmask);
+	if (!host->data)
+		return;
+
+	if (intmask & (SDHSTS_CRC16_ERROR |
+		       SDHSTS_FIFO_ERROR |
+		       SDHSTS_REW_TIME_OUT)) {
+		if (intmask & (SDHSTS_CRC16_ERROR |
+			       SDHSTS_FIFO_ERROR))
+			host->data->error = -EILSEQ;
+		else
+			host->data->error = -ETIMEDOUT;
+
+		if (host->debug) {
+			log_dump();
+			bcm2835_sdhost_dumpregs(host);
+		}
+	}
+
+	if (host->data->error) {
+		bcm2835_sdhost_finish_data(host);
+	} else if (host->data->flags & MMC_DATA_WRITE) {
+		/* Use the block interrupt for writes after the first block */
+		host->hcfg &= ~(SDHCFG_DATA_IRPT_EN);
+		host->hcfg |= SDHCFG_BLOCK_IRPT_EN;
+		bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
+		bcm2835_sdhost_transfer_pio(host);
+	} else {
+		bcm2835_sdhost_transfer_pio(host);
+		host->blocks--;
+		if ((host->blocks == 0) || host->data->error)
+			bcm2835_sdhost_finish_data(host);
+	}
+}
+
+static void bcm2835_sdhost_block_irq(struct bcm2835_host *host, u32 intmask)
+{
+	log_event("IRQK", (u32)host->data, intmask);
+	if (!host->data) {
+		pr_err("%s: got block interrupt 0x%08x even "
+			"though no data operation was in progress.\n",
+			mmc_hostname(host->mmc), (unsigned)intmask);
+		bcm2835_sdhost_dumpregs(host);
+		return;
+	}
+
+	if (intmask & (SDHSTS_CRC16_ERROR |
+		       SDHSTS_FIFO_ERROR |
+		       SDHSTS_REW_TIME_OUT)) {
+		if (intmask & (SDHSTS_CRC16_ERROR |
+			       SDHSTS_FIFO_ERROR))
+			host->data->error = -EILSEQ;
+		else
+			host->data->error = -ETIMEDOUT;
+
+		if (host->debug) {
+			log_dump();
+			bcm2835_sdhost_dumpregs(host);
+		}
+	}
+
+	if (!host->dma_desc) {
+		BUG_ON(!host->blocks);
+		if (host->data->error || (--host->blocks == 0)) {
+			bcm2835_sdhost_finish_data(host);
+		} else {
+			bcm2835_sdhost_transfer_pio(host);
+		}
+	} else if (host->data->flags & MMC_DATA_WRITE) {
+		bcm2835_sdhost_finish_data(host);
+	}
+}
+
+static irqreturn_t bcm2835_sdhost_irq(int irq, void *dev_id)
+{
+	irqreturn_t result = IRQ_NONE;
+	struct bcm2835_host *host = dev_id;
+	u32 intmask;
+
+	spin_lock(&host->lock);
+
+	intmask = bcm2835_sdhost_read(host, SDHSTS);
+	log_event("IRQ<", intmask, 0);
+
+	bcm2835_sdhost_write(host,
+			     SDHSTS_BUSY_IRPT |
+			     SDHSTS_BLOCK_IRPT |
+			     SDHSTS_SDIO_IRPT |
+			     SDHSTS_DATA_FLAG,
+			     SDHSTS);
+
+	if (intmask & SDHSTS_BLOCK_IRPT) {
+		bcm2835_sdhost_block_irq(host, intmask);
+		result = IRQ_HANDLED;
+	}
+
+	if (intmask & SDHSTS_BUSY_IRPT) {
+		bcm2835_sdhost_busy_irq(host, intmask);
+		result = IRQ_HANDLED;
+	}
+
+	/* There is no true data interrupt status bit, so it is
+	   necessary to qualify the data flag with the interrupt
+	   enable bit */
+	if ((intmask & SDHSTS_DATA_FLAG) &&
+	    (host->hcfg & SDHCFG_DATA_IRPT_EN)) {
+		bcm2835_sdhost_data_irq(host, intmask);
+		result = IRQ_HANDLED;
+	}
+
+	mmiowb();
+
+	log_event("IRQ>", bcm2835_sdhost_read(host, SDHSTS), 0);
+	spin_unlock(&host->lock);
+
+	return result;
+}
+
+void bcm2835_sdhost_set_clock(struct bcm2835_host *host, unsigned int clock)
+{
+	int div = 0; /* Initialized for compiler warning */
+	unsigned int input_clock = clock;
+	unsigned long flags;
+
+	if (host->debug)
+		pr_info("%s: set_clock(%d)\n", mmc_hostname(host->mmc), clock);
+
+	if (host->overclock_50 && (clock == 50*MHZ))
+		clock = host->overclock_50 * MHZ + (MHZ - 1);
+
+	/* The SDCDIV register has 11 bits, and holds (div - 2).
+	   But in data mode the max is 50MHz wihout a minimum, and only the
+	   bottom 3 bits are used. Since the switch over is automatic (unless
+	   we have marked the card as slow...), chosen values have to make
+	   sense in both modes.
+	   Ident mode must be 100-400KHz, so can range check the requested
+	   clock. CMD15 must be used to return to data mode, so this can be
+	   monitored.
+
+	   clock 250MHz -> 0->125MHz, 1->83.3MHz, 2->62.5MHz, 3->50.0MHz
+                           4->41.7MHz, 5->35.7MHz, 6->31.3MHz, 7->27.8MHz
+
+			 623->400KHz/27.8MHz
+			 reset value (507)->491159/50MHz
+
+	   BUT, the 3-bit clock divisor in data mode is too small if the
+	   core clock is higher than 250MHz, so instead use the SLOW_CARD
+	   configuration bit to force the use of the ident clock divisor
+	   at all times.
+	*/
+
+	host->mmc->actual_clock = 0;
+
+	if (host->firmware_sets_cdiv) {
+		u32 msg[3] = { clock, 0, 0 };
+
+		rpi_firmware_property(rpi_firmware_get(NULL),
+				      RPI_FIRMWARE_SET_SDHOST_CLOCK,
+				      &msg, sizeof(msg));
+
+		clock = max(msg[1], msg[2]);
+		spin_lock_irqsave(&host->lock, flags);
+	} else {
+		spin_lock_irqsave(&host->lock, flags);
+		if (clock < 100000) {
+			/* Can't stop the clock, but make it as slow as
+			 * possible to show willing
+			 */
+			host->cdiv = SDCDIV_MAX_CDIV;
+			bcm2835_sdhost_write(host, host->cdiv, SDCDIV);
+			mmiowb();
+			spin_unlock_irqrestore(&host->lock, flags);
+			return;
+		}
+
+		div = host->max_clk / clock;
+		if (div < 2)
+			div = 2;
+		if ((host->max_clk / div) > clock)
+			div++;
+		div -= 2;
+
+		if (div > SDCDIV_MAX_CDIV)
+			div = SDCDIV_MAX_CDIV;
+
+		clock = host->max_clk / (div + 2);
+
+		host->cdiv = div;
+		bcm2835_sdhost_write(host, host->cdiv, SDCDIV);
+
+		if (host->debug)
+			pr_info("%s: clock=%d -> max_clk=%d, cdiv=%x "
+				"(actual clock %d)\n",
+				mmc_hostname(host->mmc), input_clock,
+				host->max_clk, host->cdiv,
+				clock);
+	}
+
+	/* Calibrate some delays */
+
+	host->ns_per_fifo_word = (1000000000/clock) *
+		((host->mmc->caps & MMC_CAP_4_BIT_DATA) ? 8 : 32);
+
+	if (input_clock == 50 * MHZ) {
+		if (clock > input_clock) {
+			/* Save the closest value, to make it easier
+			   to reduce in the event of error */
+			host->overclock_50 = (clock/MHZ);
+
+			if (clock != host->overclock) {
+				pr_info("%s: overclocking to %dHz\n",
+					mmc_hostname(host->mmc), clock);
+				host->overclock = clock;
+			}
+		} else if (host->overclock) {
+			host->overclock = 0;
+			if (clock == 50 * MHZ)
+				pr_warn("%s: cancelling overclock\n",
+					mmc_hostname(host->mmc));
+		}
+	} else if (input_clock == 0) {
+		/* Reset the preferred overclock when the clock is stopped.
+		 * This always happens during initialisation. */
+		host->overclock_50 = host->user_overclock_50;
+		host->overclock = 0;
+	}
+
+	/* Set the timeout to 500ms */
+	bcm2835_sdhost_write(host, clock/2, SDTOUT);
+
+	host->mmc->actual_clock = clock;
+	host->clock = input_clock;
+	host->reset_clock = 0;
+
+	mmiowb();
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void bcm2835_sdhost_request(struct mmc_host *mmc, struct mmc_request *mrq)
+{
+	struct bcm2835_host *host;
+	unsigned long flags;
+	u32 edm, fsm;
+
+	host = mmc_priv(mmc);
+
+	if (host->debug) {
+		struct mmc_command *cmd = mrq->cmd;
+		BUG_ON(!cmd);
+		if (cmd->data)
+			pr_info("%s: cmd %d 0x%x (flags 0x%x) - %s %d*%d\n",
+				mmc_hostname(mmc),
+				cmd->opcode, cmd->arg, cmd->flags,
+				(cmd->data->flags & MMC_DATA_READ) ?
+				"read" : "write", cmd->data->blocks,
+				cmd->data->blksz);
+		else
+			pr_info("%s: cmd %d 0x%x (flags 0x%x)\n",
+				mmc_hostname(mmc),
+				cmd->opcode, cmd->arg, cmd->flags);
+	}
+
+	/* Reset the error statuses in case this is a retry */
+	if (mrq->sbc)
+		mrq->sbc->error = 0;
+	if (mrq->cmd)
+		mrq->cmd->error = 0;
+	if (mrq->data)
+		mrq->data->error = 0;
+	if (mrq->stop)
+		mrq->stop->error = 0;
+
+	if (mrq->data && !is_power_of_2(mrq->data->blksz)) {
+		pr_err("%s: unsupported block size (%d bytes)\n",
+		       mmc_hostname(mmc), mrq->data->blksz);
+		mrq->cmd->error = -EINVAL;
+		mmc_request_done(mmc, mrq);
+		return;
+	}
+
+	if (host->use_dma && mrq->data &&
+	    (mrq->data->blocks > host->pio_limit))
+		bcm2835_sdhost_prepare_dma(host, mrq->data);
+
+	if (host->reset_clock)
+	    bcm2835_sdhost_set_clock(host, host->clock);
+
+	spin_lock_irqsave(&host->lock, flags);
+
+	WARN_ON(host->mrq != NULL);
+	host->mrq = mrq;
+
+	edm = bcm2835_sdhost_read(host, SDEDM);
+	fsm = edm & SDEDM_FSM_MASK;
+
+	log_event("REQ<", (u32)mrq, edm);
+	if ((fsm != SDEDM_FSM_IDENTMODE) &&
+	    (fsm != SDEDM_FSM_DATAMODE)) {
+		log_event("REQ!", (u32)mrq, edm);
+		if (host->debug) {
+			pr_warn("%s: previous command (%d) not complete (EDM %x)\n",
+			       mmc_hostname(host->mmc),
+			       bcm2835_sdhost_read(host, SDCMD) & SDCMD_CMD_MASK,
+			       edm);
+			log_dump();
+			bcm2835_sdhost_dumpregs(host);
+		}
+		mrq->cmd->error = -EILSEQ;
+		tasklet_schedule(&host->finish_tasklet);
+		mmiowb();
+		spin_unlock_irqrestore(&host->lock, flags);
+		return;
+	}
+
+	host->use_sbc = !!mrq->sbc &&
+		(host->mrq->data->flags & USE_CMD23_FLAGS);
+	if (host->use_sbc) {
+		if (bcm2835_sdhost_send_command(host, mrq->sbc)) {
+			if (!host->use_busy)
+				bcm2835_sdhost_finish_command(host, &flags);
+		}
+	} else if (bcm2835_sdhost_send_command(host, mrq->cmd)) {
+		if (host->data && host->dma_desc)
+			/* DMA transfer starts now, PIO starts after irq */
+			bcm2835_sdhost_start_dma(host);
+
+		if (!host->use_busy)
+			bcm2835_sdhost_finish_command(host, &flags);
+	}
+
+	log_event("CMD ", (u32)mrq->cmd->opcode,
+		   mrq->data ? (u32)mrq->data->blksz : 0);
+	mmiowb();
+
+	log_event("REQ>", (u32)mrq, 0);
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void bcm2835_sdhost_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+{
+
+	struct bcm2835_host *host = mmc_priv(mmc);
+	unsigned long flags;
+
+	if (host->debug)
+		pr_info("%s: ios clock %d, pwr %d, bus_width %d, "
+			"timing %d, vdd %d, drv_type %d\n",
+			mmc_hostname(mmc),
+			ios->clock, ios->power_mode, ios->bus_width,
+			ios->timing, ios->signal_voltage, ios->drv_type);
+
+	spin_lock_irqsave(&host->lock, flags);
+
+	log_event("IOS<", ios->clock, 0);
+
+	/* set bus width */
+	host->hcfg &= ~SDHCFG_WIDE_EXT_BUS;
+	if (ios->bus_width == MMC_BUS_WIDTH_4)
+		host->hcfg |= SDHCFG_WIDE_EXT_BUS;
+
+	host->hcfg |= SDHCFG_WIDE_INT_BUS;
+
+	/* Disable clever clock switching, to cope with fast core clocks */
+	host->hcfg |= SDHCFG_SLOW_CARD;
+
+	bcm2835_sdhost_write(host, host->hcfg, SDHCFG);
+
+	mmiowb();
+
+	spin_unlock_irqrestore(&host->lock, flags);
+
+	if (!ios->clock || ios->clock != host->clock)
+		bcm2835_sdhost_set_clock(host, ios->clock);
+}
+
+static struct mmc_host_ops bcm2835_sdhost_ops = {
+	.request = bcm2835_sdhost_request,
+	.set_ios = bcm2835_sdhost_set_ios,
+	.hw_reset = bcm2835_sdhost_reset,
+};
+
+static void bcm2835_sdhost_cmd_wait_work(struct work_struct *work)
+{
+	struct bcm2835_host *host;
+	unsigned long flags;
+
+	host = container_of(work, struct bcm2835_host, cmd_wait_wq);
+
+	spin_lock_irqsave(&host->lock, flags);
+
+	log_event("CWK<", (u32)host->cmd, (u32)host->mrq);
+
+	/*
+	 * If this tasklet gets rescheduled while running, it will
+	 * be run again afterwards but without any active request.
+	 */
+	if (!host->mrq) {
+		spin_unlock_irqrestore(&host->lock, flags);
+		return;
+	}
+
+	bcm2835_sdhost_finish_command(host, &flags);
+
+	mmiowb();
+
+	log_event("CWK>", (u32)host->cmd, 0);
+
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void bcm2835_sdhost_tasklet_finish(unsigned long param)
+{
+	struct bcm2835_host *host;
+	unsigned long flags;
+	struct mmc_request *mrq;
+	struct dma_chan *terminate_chan = NULL;
+
+	host = (struct bcm2835_host *)param;
+
+	spin_lock_irqsave(&host->lock, flags);
+
+	log_event("TSK<", (u32)host->mrq, 0);
+	/*
+	 * If this tasklet gets rescheduled while running, it will
+	 * be run again afterwards but without any active request.
+	 */
+	if (!host->mrq) {
+		spin_unlock_irqrestore(&host->lock, flags);
+		return;
+	}
+
+	del_timer(&host->timer);
+
+	mrq = host->mrq;
+
+	/* Drop the overclock after any data corruption, or after any
+	 * error while overclocked. Ignore errors for status commands,
+	 * as they are likely when a card is ejected. */
+	if (host->overclock) {
+		if ((mrq->cmd && mrq->cmd->error &&
+		     (mrq->cmd->opcode != MMC_SEND_STATUS)) ||
+		    (mrq->data && mrq->data->error) ||
+		    (mrq->stop && mrq->stop->error) ||
+		    (mrq->sbc && mrq->sbc->error)) {
+			host->overclock_50--;
+			pr_warn("%s: reducing overclock due to errors\n",
+				mmc_hostname(host->mmc));
+			host->reset_clock = 1;
+			mrq->cmd->error = -ETIMEDOUT;
+			mrq->cmd->retries = 1;
+		}
+	}
+
+	host->mrq = NULL;
+	host->cmd = NULL;
+	host->data = NULL;
+
+	mmiowb();
+
+	host->dma_desc = NULL;
+	terminate_chan = host->dma_chan;
+	host->dma_chan = NULL;
+
+	spin_unlock_irqrestore(&host->lock, flags);
+
+	if (terminate_chan)
+	{
+		int err = dmaengine_terminate_all(terminate_chan);
+		if (err)
+			pr_err("%s: failed to terminate DMA (%d)\n",
+			       mmc_hostname(host->mmc), err);
+	}
+
+	/* The SDHOST block doesn't report any errors for a disconnected
+	   interface. All cards and SDIO devices should report some supported
+	   voltage range, so a zero response to SEND_OP_COND, IO_SEND_OP_COND
+	   or APP_SEND_OP_COND can be treated as an error. */
+	if (((mrq->cmd->opcode == MMC_SEND_OP_COND) ||
+	     (mrq->cmd->opcode == SD_IO_SEND_OP_COND) ||
+	     (mrq->cmd->opcode == SD_APP_OP_COND)) &&
+	    (mrq->cmd->error == 0) &&
+	    (mrq->cmd->resp[0] == 0)) {
+		mrq->cmd->error = -ETIMEDOUT;
+		if (host->debug)
+			pr_info("%s: faking timeout due to zero OCR\n",
+				mmc_hostname(host->mmc));
+	}
+
+	mmc_request_done(host->mmc, mrq);
+	log_event("TSK>", (u32)mrq, 0);
+}
+
+int bcm2835_sdhost_add_host(struct bcm2835_host *host)
+{
+	struct mmc_host *mmc;
+	struct dma_slave_config cfg;
+	char pio_limit_string[20];
+	int ret;
+
+	mmc = host->mmc;
+
+	if (!mmc->f_max || mmc->f_max > host->max_clk)
+		mmc->f_max = host->max_clk;
+	mmc->f_min = host->max_clk / SDCDIV_MAX_CDIV;
+
+	mmc->max_busy_timeout =  (~(unsigned int)0)/(mmc->f_max/1000);
+
+	pr_debug("f_max %d, f_min %d, max_busy_timeout %d\n",
+		 mmc->f_max, mmc->f_min, mmc->max_busy_timeout);
+
+	/* host controller capabilities */
+	mmc->caps |=
+		MMC_CAP_SD_HIGHSPEED | MMC_CAP_MMC_HIGHSPEED |
+		MMC_CAP_NEEDS_POLL | MMC_CAP_HW_RESET | MMC_CAP_ERASE |
+		((ALLOW_CMD23_READ|ALLOW_CMD23_WRITE) * MMC_CAP_CMD23);
+
+	spin_lock_init(&host->lock);
+
+	if (host->allow_dma) {
+		if (IS_ERR_OR_NULL(host->dma_chan_rxtx)) {
+			pr_err("%s: unable to initialise DMA channel. "
+			       "Falling back to PIO\n",
+			       mmc_hostname(mmc));
+			host->use_dma = false;
+		} else {
+			cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+			cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+			cfg.slave_id = 13;		/* DREQ channel */
+
+			/* Validate the slave configurations */
+
+			cfg.direction = DMA_MEM_TO_DEV;
+			cfg.src_addr = 0;
+			cfg.dst_addr = host->bus_addr + SDDATA;
+
+			ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
+
+			if (ret == 0) {
+				host->dma_cfg_tx = cfg;
+
+				cfg.direction = DMA_DEV_TO_MEM;
+				cfg.src_addr = host->bus_addr + SDDATA;
+				cfg.dst_addr = 0;
+
+				ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
+			}
+
+			if (ret == 0) {
+				host->dma_cfg_rx = cfg;
+
+				host->use_dma = true;
+			} else {
+				pr_err("%s: unable to configure DMA channel. "
+				       "Falling back to PIO\n",
+				       mmc_hostname(mmc));
+				dma_release_channel(host->dma_chan_rxtx);
+				host->dma_chan_rxtx = NULL;
+				host->use_dma = false;
+			}
+		}
+	} else {
+		host->use_dma = false;
+	}
+
+	mmc->max_segs = 128;
+	mmc->max_req_size = 524288;
+	mmc->max_seg_size = mmc->max_req_size;
+	mmc->max_blk_size = 512;
+	mmc->max_blk_count =  65535;
+
+	/* report supported voltage ranges */
+	mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
+
+	tasklet_init(&host->finish_tasklet,
+		bcm2835_sdhost_tasklet_finish, (unsigned long)host);
+
+	INIT_WORK(&host->cmd_wait_wq, bcm2835_sdhost_cmd_wait_work);
+
+	setup_timer(&host->timer, bcm2835_sdhost_timeout,
+		    (unsigned long)host);
+
+	bcm2835_sdhost_init(host, 0);
+
+	ret = request_irq(host->irq, bcm2835_sdhost_irq, 0 /*IRQF_SHARED*/,
+				  mmc_hostname(mmc), host);
+	if (ret) {
+		pr_err("%s: failed to request IRQ %d: %d\n",
+		       mmc_hostname(mmc), host->irq, ret);
+		goto untasklet;
+	}
+
+	mmiowb();
+	mmc_add_host(mmc);
+
+	pio_limit_string[0] = '\0';
+	if (host->use_dma && (host->pio_limit > 0))
+		sprintf(pio_limit_string, " (>%d)", host->pio_limit);
+	pr_info("%s: %s loaded - DMA %s%s\n",
+		mmc_hostname(mmc), DRIVER_NAME,
+		host->use_dma ? "enabled" : "disabled",
+		pio_limit_string);
+
+	return 0;
+
+untasklet:
+	tasklet_kill(&host->finish_tasklet);
+
+	return ret;
+}
+
+static int bcm2835_sdhost_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
+	struct clk *clk;
+	struct resource *iomem;
+	struct bcm2835_host *host;
+	struct mmc_host *mmc;
+	const __be32 *addr;
+	u32 msg[3];
+	int ret;
+
+	pr_debug("bcm2835_sdhost_probe\n");
+	mmc = mmc_alloc_host(sizeof(*host), dev);
+	if (!mmc)
+		return -ENOMEM;
+
+	mmc->ops = &bcm2835_sdhost_ops;
+	host = mmc_priv(mmc);
+	host->mmc = mmc;
+	host->pio_timeout = msecs_to_jiffies(500);
+	host->pio_limit = 1;
+	host->max_delay = 1; /* Warn if over 1ms */
+	host->allow_dma = 1;
+	spin_lock_init(&host->lock);
+
+	iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	host->ioaddr = devm_ioremap_resource(dev, iomem);
+	if (IS_ERR(host->ioaddr)) {
+		ret = PTR_ERR(host->ioaddr);
+		goto err;
+	}
+
+	addr = of_get_address(node, 0, NULL, NULL);
+	if (!addr) {
+		dev_err(dev, "could not get DMA-register address\n");
+		return -ENODEV;
+	}
+	host->bus_addr = be32_to_cpup(addr);
+	pr_debug(" - ioaddr %lx, iomem->start %lx, bus_addr %lx\n",
+		 (unsigned long)host->ioaddr,
+		 (unsigned long)iomem->start,
+		 (unsigned long)host->bus_addr);
+
+	if (node) {
+		/* Read any custom properties */
+		of_property_read_u32(node,
+				     "brcm,delay-after-stop",
+				     &host->delay_after_stop);
+		of_property_read_u32(node,
+				     "brcm,overclock-50",
+				     &host->user_overclock_50);
+		of_property_read_u32(node,
+				     "brcm,pio-limit",
+				     &host->pio_limit);
+		host->allow_dma =
+			!of_property_read_bool(node, "brcm,force-pio");
+		host->debug = of_property_read_bool(node, "brcm,debug");
+	}
+
+	host->dma_chan = NULL;
+	host->dma_desc = NULL;
+
+	/* Formally recognise the other way of disabling DMA */
+	if (host->pio_limit == 0x7fffffff)
+		host->allow_dma = false;
+
+	if (host->allow_dma) {
+		if (node) {
+			host->dma_chan_rxtx =
+				dma_request_slave_channel(dev, "rx-tx");
+			if (!host->dma_chan_rxtx)
+				host->dma_chan_rxtx =
+					dma_request_slave_channel(dev, "tx");
+			if (!host->dma_chan_rxtx)
+				host->dma_chan_rxtx =
+					dma_request_slave_channel(dev, "rx");
+		} else {
+			dma_cap_mask_t mask;
+
+			dma_cap_zero(mask);
+			/* we don't care about the channel, any would work */
+			dma_cap_set(DMA_SLAVE, mask);
+			host->dma_chan_rxtx =
+				dma_request_channel(mask, NULL, NULL);
+		}
+	}
+
+	clk = devm_clk_get(dev, NULL);
+	if (IS_ERR(clk)) {
+		ret = PTR_ERR(clk);
+		if (ret == -EPROBE_DEFER)
+			dev_info(dev, "could not get clk, deferring probe\n");
+		else
+			dev_err(dev, "could not get clk\n");
+		goto err;
+	}
+
+	host->max_clk = clk_get_rate(clk);
+
+	host->irq = platform_get_irq(pdev, 0);
+	if (host->irq <= 0) {
+		dev_err(dev, "get IRQ failed\n");
+		ret = -EINVAL;
+		goto err;
+	}
+
+	pr_debug(" - max_clk %lx, irq %d\n",
+		 (unsigned long)host->max_clk,
+		 (int)host->irq);
+
+	log_init(dev, iomem->start - host->bus_addr);
+
+	if (node)
+		mmc_of_parse(mmc);
+	else
+		mmc->caps |= MMC_CAP_4_BIT_DATA;
+
+	msg[0] = 0;
+	msg[1] = ~0;
+	msg[2] = ~0;
+
+	rpi_firmware_property(rpi_firmware_get(NULL),
+			      RPI_FIRMWARE_SET_SDHOST_CLOCK,
+			      &msg, sizeof(msg));
+
+	host->firmware_sets_cdiv = (msg[1] != ~0);
+
+	ret = bcm2835_sdhost_add_host(host);
+	if (ret)
+		goto err;
+
+	platform_set_drvdata(pdev, host);
+
+	pr_debug("bcm2835_sdhost_probe -> OK\n");
+
+	return 0;
+
+err:
+	pr_debug("bcm2835_sdhost_probe -> err %d\n", ret);
+	mmc_free_host(mmc);
+
+	return ret;
+}
+
+static int bcm2835_sdhost_remove(struct platform_device *pdev)
+{
+	struct bcm2835_host *host = platform_get_drvdata(pdev);
+
+	pr_debug("bcm2835_sdhost_remove\n");
+
+	mmc_remove_host(host->mmc);
+
+	bcm2835_sdhost_set_power(host, false);
+
+	free_irq(host->irq, host);
+
+	del_timer_sync(&host->timer);
+
+	tasklet_kill(&host->finish_tasklet);
+
+	mmc_free_host(host->mmc);
+	platform_set_drvdata(pdev, NULL);
+
+	pr_debug("bcm2835_sdhost_remove - OK\n");
+	return 0;
+}
+
+static const struct of_device_id bcm2835_sdhost_match[] = {
+	{ .compatible = "brcm,bcm2835-sdhost" },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, bcm2835_sdhost_match);
+
+static struct platform_driver bcm2835_sdhost_driver = {
+	.probe      = bcm2835_sdhost_probe,
+	.remove     = bcm2835_sdhost_remove,
+	.driver     = {
+		.name		= DRIVER_NAME,
+		.owner		= THIS_MODULE,
+		.of_match_table	= bcm2835_sdhost_match,
+	},
+};
+module_platform_driver(bcm2835_sdhost_driver);
+
+MODULE_ALIAS("platform:sdhost-bcm2835");
+MODULE_DESCRIPTION("BCM2835 SDHost driver");
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Phil Elwell");
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index 3f2036f31da4..0534944728b7 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -40,6 +40,13 @@ config MTD_SM_COMMON
 	tristate
 	default n
 
+config MTD_NAND_BCM2835_SMI
+        tristate "Use Broadcom's Secondary Memory Interface as a NAND controller (BCM283x)"
+        depends on BCM2835_SMI
+        default m
+        help
+	  Uses the BCM2835's SMI peripheral as a NAND controller.
+
 config MTD_NAND_DENALI
 	tristate
 
diff --git a/drivers/mtd/nand/Makefile b/drivers/mtd/nand/Makefile
index 6e2db700d923..798981f3ec05 100644
--- a/drivers/mtd/nand/Makefile
+++ b/drivers/mtd/nand/Makefile
@@ -14,6 +14,7 @@ obj-$(CONFIG_MTD_NAND_DENALI)		+= denali.o
 obj-$(CONFIG_MTD_NAND_DENALI_PCI)	+= denali_pci.o
 obj-$(CONFIG_MTD_NAND_DENALI_DT)	+= denali_dt.o
 obj-$(CONFIG_MTD_NAND_AU1550)		+= au1550nd.o
+obj-$(CONFIG_MTD_NAND_BCM2835_SMI)	+= bcm2835_smi_nand.o
 obj-$(CONFIG_MTD_NAND_BF5XX)		+= bf5xx_nand.o
 obj-$(CONFIG_MTD_NAND_S3C2410)		+= s3c2410.o
 obj-$(CONFIG_MTD_NAND_TANGO)		+= tango_nand.o
diff --git a/drivers/mtd/nand/bcm2835_smi_nand.c b/drivers/mtd/nand/bcm2835_smi_nand.c
new file mode 100644
index 000000000000..c4826ea1c2ba
--- /dev/null
+++ b/drivers/mtd/nand/bcm2835_smi_nand.c
@@ -0,0 +1,267 @@
+/**
+ * NAND flash driver for Broadcom Secondary Memory Interface
+ *
+ * Written by Luke Wren <luke@raspberrypi.org>
+ * Copyright (c) 2015, Raspberry Pi (Trading) Ltd.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2, as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/mtd/rawnand.h>
+#include <linux/mtd/partitions.h>
+
+#include <linux/broadcom/bcm2835_smi.h>
+
+#define DEVICE_NAME "bcm2835-smi-nand"
+#define DRIVER_NAME "smi-nand-bcm2835"
+
+struct bcm2835_smi_nand_host {
+	struct bcm2835_smi_instance *smi_inst;
+	struct nand_chip nand_chip;
+	struct mtd_info mtd;
+	struct device *dev;
+};
+
+/****************************************************************************
+*
+*   NAND functionality implementation
+*
+****************************************************************************/
+
+#define SMI_NAND_CLE_PIN 0x01
+#define SMI_NAND_ALE_PIN 0x02
+
+static inline void bcm2835_smi_nand_cmd_ctrl(struct mtd_info *mtd, int cmd,
+					     unsigned int ctrl)
+{
+	uint32_t cmd32 = cmd;
+	uint32_t addr = ~(SMI_NAND_CLE_PIN | SMI_NAND_ALE_PIN);
+	struct bcm2835_smi_nand_host *host = dev_get_drvdata(mtd->dev.parent);
+	struct bcm2835_smi_instance *inst = host->smi_inst;
+
+	if (ctrl & NAND_CLE)
+		addr |= SMI_NAND_CLE_PIN;
+	if (ctrl & NAND_ALE)
+		addr |= SMI_NAND_ALE_PIN;
+	/* Lower ALL the CS pins! */
+	if (ctrl & NAND_NCE)
+		addr &= (SMI_NAND_CLE_PIN | SMI_NAND_ALE_PIN);
+
+	bcm2835_smi_set_address(inst, addr);
+
+	if (cmd != NAND_CMD_NONE)
+		bcm2835_smi_write_buf(inst, &cmd32, 1);
+}
+
+static inline uint8_t bcm2835_smi_nand_read_byte(struct mtd_info *mtd)
+{
+	uint8_t byte;
+	struct bcm2835_smi_nand_host *host = dev_get_drvdata(mtd->dev.parent);
+	struct bcm2835_smi_instance *inst = host->smi_inst;
+
+	bcm2835_smi_read_buf(inst, &byte, 1);
+	return byte;
+}
+
+static inline void bcm2835_smi_nand_write_byte(struct mtd_info *mtd,
+					       uint8_t byte)
+{
+	struct bcm2835_smi_nand_host *host = dev_get_drvdata(mtd->dev.parent);
+	struct bcm2835_smi_instance *inst = host->smi_inst;
+
+	bcm2835_smi_write_buf(inst, &byte, 1);
+}
+
+static inline void bcm2835_smi_nand_write_buf(struct mtd_info *mtd,
+					      const uint8_t *buf, int len)
+{
+	struct bcm2835_smi_nand_host *host = dev_get_drvdata(mtd->dev.parent);
+	struct bcm2835_smi_instance *inst = host->smi_inst;
+
+	bcm2835_smi_write_buf(inst, buf, len);
+}
+
+static inline void bcm2835_smi_nand_read_buf(struct mtd_info *mtd,
+					     uint8_t *buf, int len)
+{
+	struct bcm2835_smi_nand_host *host = dev_get_drvdata(mtd->dev.parent);
+	struct bcm2835_smi_instance *inst = host->smi_inst;
+
+	bcm2835_smi_read_buf(inst, buf, len);
+}
+
+/****************************************************************************
+*
+*   Probe and remove functions
+*
+***************************************************************************/
+
+static int bcm2835_smi_nand_probe(struct platform_device *pdev)
+{
+	struct bcm2835_smi_nand_host *host;
+	struct nand_chip *this;
+	struct mtd_info *mtd;
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node, *smi_node;
+	struct mtd_part_parser_data ppdata;
+	struct smi_settings *smi_settings;
+	struct bcm2835_smi_instance *smi_inst;
+	int ret = -ENXIO;
+
+	if (!node) {
+		dev_err(dev, "No device tree node supplied!");
+		return -EINVAL;
+	}
+
+	smi_node = of_parse_phandle(node, "smi_handle", 0);
+
+	/* Request use of SMI peripheral: */
+	smi_inst = bcm2835_smi_get(smi_node);
+
+	if (!smi_inst) {
+		dev_err(dev, "Could not register with SMI.");
+		return -EPROBE_DEFER;
+	}
+
+	/* Set SMI timing and bus width */
+
+	smi_settings = bcm2835_smi_get_settings_from_regs(smi_inst);
+
+	smi_settings->data_width = SMI_WIDTH_8BIT;
+	smi_settings->read_setup_time = 2;
+	smi_settings->read_hold_time = 1;
+	smi_settings->read_pace_time = 1;
+	smi_settings->read_strobe_time = 3;
+
+	smi_settings->write_setup_time = 2;
+	smi_settings->write_hold_time = 1;
+	smi_settings->write_pace_time = 1;
+	smi_settings->write_strobe_time = 3;
+
+	bcm2835_smi_set_regs_from_settings(smi_inst);
+
+	host = devm_kzalloc(dev, sizeof(struct bcm2835_smi_nand_host),
+		GFP_KERNEL);
+	if (!host)
+		return -ENOMEM;
+
+	host->dev = dev;
+	host->smi_inst = smi_inst;
+
+	platform_set_drvdata(pdev, host);
+
+	/* Link the structures together */
+
+	this = &host->nand_chip;
+	mtd = &host->mtd;
+	mtd->priv = this;
+	mtd->owner = THIS_MODULE;
+	mtd->dev.parent = dev;
+	mtd->name = DRIVER_NAME;
+
+	/* 20 us command delay time... */
+	this->chip_delay = 20;
+
+	this->priv = host;
+	this->cmd_ctrl = bcm2835_smi_nand_cmd_ctrl;
+	this->read_byte = bcm2835_smi_nand_read_byte;
+	this->write_byte = bcm2835_smi_nand_write_byte;
+	this->write_buf = bcm2835_smi_nand_write_buf;
+	this->read_buf = bcm2835_smi_nand_read_buf;
+
+	this->ecc.mode = NAND_ECC_SOFT;
+
+	/* Should never be accessed directly: */
+
+	this->IO_ADDR_R = (void *)0xdeadbeef;
+	this->IO_ADDR_W = (void *)0xdeadbeef;
+
+	/* First scan to find the device and get the page size */
+
+	if (nand_scan_ident(mtd, 1, NULL))
+		return -ENXIO;
+
+	/* Second phase scan */
+
+	if (nand_scan_tail(mtd))
+		return -ENXIO;
+
+	ret = mtd_device_parse_register(mtd, NULL, &ppdata, NULL, 0);
+	if (!ret)
+		return 0;
+
+	nand_release(mtd);
+	return -EINVAL;
+}
+
+static int bcm2835_smi_nand_remove(struct platform_device *pdev)
+{
+	struct bcm2835_smi_nand_host *host = platform_get_drvdata(pdev);
+
+	nand_release(&host->mtd);
+
+	return 0;
+}
+
+/****************************************************************************
+*
+*   Register the driver with device tree
+*
+***************************************************************************/
+
+static const struct of_device_id bcm2835_smi_nand_of_match[] = {
+	{.compatible = "brcm,bcm2835-smi-nand",},
+	{ /* sentinel */ }
+};
+
+MODULE_DEVICE_TABLE(of, bcm2835_smi_nand_of_match);
+
+static struct platform_driver bcm2835_smi_nand_driver = {
+	.probe = bcm2835_smi_nand_probe,
+	.remove = bcm2835_smi_nand_remove,
+	.driver = {
+		.name = DRIVER_NAME,
+		.owner = THIS_MODULE,
+		.of_match_table = bcm2835_smi_nand_of_match,
+	},
+};
+
+module_platform_driver(bcm2835_smi_nand_driver);
+
+MODULE_ALIAS("platform:smi-nand-bcm2835");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION
+	("Driver for NAND chips using Broadcom Secondary Memory Interface");
+MODULE_AUTHOR("Luke Wren <luke@raspberrypi.org>");
diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
index f3f05fea8e1f..6c2d3aba2591 100644
--- a/drivers/net/can/spi/mcp251x.c
+++ b/drivers/net/can/spi/mcp251x.c
@@ -952,6 +952,9 @@ static int mcp251x_open(struct net_device *net)
 	priv->tx_skb = NULL;
 	priv->tx_len = 0;
 
+	if (spi->dev.of_node)
+	    flags = 0;
+
 	ret = request_threaded_irq(spi->irq, NULL, mcp251x_can_ist,
 				   flags | IRQF_ONESHOT, DEVICE_NAME, priv);
 	if (ret) {
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 2df7b62c1a36..7da805475517 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -492,6 +492,55 @@ struct phy_device *mdiobus_scan(struct mii_bus *bus, int addr)
 }
 EXPORT_SYMBOL(mdiobus_scan);
 
+/**
+ * __mdiobus_read - Unlocked version of the mdiobus_read function
+ * @bus: the mii_bus struct
+ * @addr: the phy address
+ * @regnum: register number to read
+ *
+ * Read a MDIO bus register. Caller must hold the mdio bus lock.
+ *
+ * NOTE: MUST NOT be called from interrupt context.
+ */
+int __mdiobus_read(struct mii_bus *bus, int addr, u32 regnum)
+{
+	int retval;
+
+	WARN_ON_ONCE(!mutex_is_locked(&bus->mdio_lock));
+
+	retval = bus->read(bus, addr, regnum);
+
+	trace_mdio_access(bus, 1, addr, regnum, retval, retval);
+
+	return retval;
+}
+EXPORT_SYMBOL(__mdiobus_read);
+
+/**
+ * __mdiobus_write - Unlocked version of the mdiobus_write function
+ * @bus: the mii_bus struct
+ * @addr: the phy address
+ * @regnum: register number to write
+ * @val: value to write to @regnum
+ *
+ * Write a MDIO bus register. Caller must hold the mdio bus lock.
+ *
+ * NOTE: MUST NOT be called from interrupt context.
+ */
+int __mdiobus_write(struct mii_bus *bus, int addr, u32 regnum, u16 val)
+{
+	int err;
+
+	WARN_ON_ONCE(!mutex_is_locked(&bus->mdio_lock));
+
+	err = bus->write(bus, addr, regnum, val);
+
+	trace_mdio_access(bus, 0, addr, regnum, val, err);
+
+	return err;
+}
+EXPORT_SYMBOL(__mdiobus_write);
+
 /**
  * mdiobus_read_nested - Nested version of the mdiobus_read function
  * @bus: the mii_bus struct
@@ -512,11 +561,9 @@ int mdiobus_read_nested(struct mii_bus *bus, int addr, u32 regnum)
 	BUG_ON(in_interrupt());
 
 	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
-	retval = bus->read(bus, addr, regnum);
+	retval = __mdiobus_read(bus, addr, regnum);
 	mutex_unlock(&bus->mdio_lock);
 
-	trace_mdio_access(bus, 1, addr, regnum, retval, retval);
-
 	return retval;
 }
 EXPORT_SYMBOL(mdiobus_read_nested);
@@ -538,11 +585,9 @@ int mdiobus_read(struct mii_bus *bus, int addr, u32 regnum)
 	BUG_ON(in_interrupt());
 
 	mutex_lock(&bus->mdio_lock);
-	retval = bus->read(bus, addr, regnum);
+	retval = __mdiobus_read(bus, addr, regnum);
 	mutex_unlock(&bus->mdio_lock);
 
-	trace_mdio_access(bus, 1, addr, regnum, retval, retval);
-
 	return retval;
 }
 EXPORT_SYMBOL(mdiobus_read);
@@ -568,11 +613,9 @@ int mdiobus_write_nested(struct mii_bus *bus, int addr, u32 regnum, u16 val)
 	BUG_ON(in_interrupt());
 
 	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
-	err = bus->write(bus, addr, regnum, val);
+	err = __mdiobus_write(bus, addr, regnum, val);
 	mutex_unlock(&bus->mdio_lock);
 
-	trace_mdio_access(bus, 0, addr, regnum, val, err);
-
 	return err;
 }
 EXPORT_SYMBOL(mdiobus_write_nested);
@@ -595,11 +638,9 @@ int mdiobus_write(struct mii_bus *bus, int addr, u32 regnum, u16 val)
 	BUG_ON(in_interrupt());
 
 	mutex_lock(&bus->mdio_lock);
-	err = bus->write(bus, addr, regnum, val);
+	err = __mdiobus_write(bus, addr, regnum, val);
 	mutex_unlock(&bus->mdio_lock);
 
-	trace_mdio_access(bus, 0, addr, regnum, val, err);
-
 	return err;
 }
 EXPORT_SYMBOL(mdiobus_write);
diff --git a/drivers/net/phy/microchip.c b/drivers/net/phy/microchip.c
index 37ee856c7680..5418c662b08c 100644
--- a/drivers/net/phy/microchip.c
+++ b/drivers/net/phy/microchip.c
@@ -20,6 +20,7 @@
 #include <linux/ethtool.h>
 #include <linux/phy.h>
 #include <linux/microchipphy.h>
+#include <linux/delay.h>
 
 #define DRIVER_AUTHOR	"WOOJUNG HUH <woojung.huh@microchip.com>"
 #define DRIVER_DESC	"Microchip LAN88XX PHY driver"
@@ -30,6 +31,16 @@ struct lan88xx_priv {
 	__u32	wolopts;
 };
 
+static int lan88xx_read_page(struct phy_device *phydev)
+{
+	return __phy_read(phydev, LAN88XX_EXT_PAGE_ACCESS);
+}
+
+static int lan88xx_write_page(struct phy_device *phydev, int page)
+{
+	return __phy_write(phydev, LAN88XX_EXT_PAGE_ACCESS, page);
+}
+
 static int lan88xx_phy_config_intr(struct phy_device *phydev)
 {
 	int rc;
@@ -66,6 +77,150 @@ static int lan88xx_suspend(struct phy_device *phydev)
 	return 0;
 }
 
+static int lan88xx_TR_reg_set(struct phy_device *phydev, u16 regaddr,
+			      u32 data)
+{
+	int val, save_page, ret = 0;
+	u16 buf;
+
+	/* Save current page */
+	save_page = phy_save_page(phydev);
+	if (save_page < 0) {
+		pr_warn("Failed to get current page\n");
+		goto err;
+	}
+
+	/* Switch to TR page */
+	lan88xx_write_page(phydev, LAN88XX_EXT_PAGE_ACCESS_TR);
+
+	ret = __phy_write(phydev, LAN88XX_EXT_PAGE_TR_LOW_DATA,
+			  (data & 0xFFFF));
+	if (ret < 0) {
+		pr_warn("Failed to write TR low data\n");
+		goto err;
+	}
+
+	ret = __phy_write(phydev, LAN88XX_EXT_PAGE_TR_HIGH_DATA,
+			  (data & 0x00FF0000) >> 16);
+	if (ret < 0) {
+		pr_warn("Failed to write TR high data\n");
+		goto err;
+	}
+
+	/* Config control bits [15:13] of register */
+	buf = (regaddr & ~(0x3 << 13));/* Clr [14:13] to write data in reg */
+	buf |= 0x8000; /* Set [15] to Packet transmit */
+
+	ret = __phy_write(phydev, LAN88XX_EXT_PAGE_TR_CR, buf);
+	if (ret < 0) {
+		pr_warn("Failed to write data in reg\n");
+		goto err;
+	}
+
+	usleep_range(1000, 2000);/* Wait for Data to be written */
+	val = __phy_read(phydev, LAN88XX_EXT_PAGE_TR_CR);
+	if (!(val & 0x8000))
+		pr_warn("TR Register[0x%X] configuration failed\n", regaddr);
+err:
+	return phy_restore_page(phydev, save_page, ret);
+}
+
+static void lan88xx_config_TR_regs(struct phy_device *phydev)
+{
+	int err;
+
+	/* Get access to Channel 0x1, Node 0xF , Register 0x01.
+	 * Write 24-bit value 0x12B00A to register. Setting MrvlTrFix1000Kf,
+	 * MrvlTrFix1000Kp, MasterEnableTR bits.
+	 */
+	err = lan88xx_TR_reg_set(phydev, 0x0F82, 0x12B00A);
+	if (err < 0)
+		pr_warn("Failed to Set Register[0x0F82]\n");
+
+	/* Get access to Channel b'10, Node b'1101, Register 0x06.
+	 * Write 24-bit value 0xD2C46F to register. Setting SSTrKf1000Slv,
+	 * SSTrKp1000Mas bits.
+	 */
+	err = lan88xx_TR_reg_set(phydev, 0x168C, 0xD2C46F);
+	if (err < 0)
+		pr_warn("Failed to Set Register[0x168C]\n");
+
+	/* Get access to Channel b'10, Node b'1111, Register 0x11.
+	 * Write 24-bit value 0x620 to register. Setting rem_upd_done_thresh
+	 * bits
+	 */
+	err = lan88xx_TR_reg_set(phydev, 0x17A2, 0x620);
+	if (err < 0)
+		pr_warn("Failed to Set Register[0x17A2]\n");
+
+	/* Get access to Channel b'10, Node b'1101, Register 0x10.
+	 * Write 24-bit value 0xEEFFDD to register. Setting
+	 * eee_TrKp1Long_1000, eee_TrKp2Long_1000, eee_TrKp3Long_1000,
+	 * eee_TrKp1Short_1000,eee_TrKp2Short_1000, eee_TrKp3Short_1000 bits.
+	 */
+	err = lan88xx_TR_reg_set(phydev, 0x16A0, 0xEEFFDD);
+	if (err < 0)
+		pr_warn("Failed to Set Register[0x16A0]\n");
+
+	/* Get access to Channel b'10, Node b'1101, Register 0x13.
+	 * Write 24-bit value 0x071448 to register. Setting
+	 * slv_lpi_tr_tmr_val1, slv_lpi_tr_tmr_val2 bits.
+	 */
+	err = lan88xx_TR_reg_set(phydev, 0x16A6, 0x071448);
+	if (err < 0)
+		pr_warn("Failed to Set Register[0x16A6]\n");
+
+	/* Get access to Channel b'10, Node b'1101, Register 0x12.
+	 * Write 24-bit value 0x13132F to register. Setting
+	 * slv_sigdet_timer_val1, slv_sigdet_timer_val2 bits.
+	 */
+	err = lan88xx_TR_reg_set(phydev, 0x16A4, 0x13132F);
+	if (err < 0)
+		pr_warn("Failed to Set Register[0x16A4]\n");
+
+	/* Get access to Channel b'10, Node b'1101, Register 0x14.
+	 * Write 24-bit value 0x0 to register. Setting eee_3level_delay,
+	 * eee_TrKf_freeze_delay bits.
+	 */
+	err = lan88xx_TR_reg_set(phydev, 0x16A8, 0x0);
+	if (err < 0)
+		pr_warn("Failed to Set Register[0x16A8]\n");
+
+	/* Get access to Channel b'01, Node b'1111, Register 0x34.
+	 * Write 24-bit value 0x91B06C to register. Setting
+	 * FastMseSearchThreshLong1000, FastMseSearchThreshShort1000,
+	 * FastMseSearchUpdGain1000 bits.
+	 */
+	err = lan88xx_TR_reg_set(phydev, 0x0FE8, 0x91B06C);
+	if (err < 0)
+		pr_warn("Failed to Set Register[0x0FE8]\n");
+
+	/* Get access to Channel b'01, Node b'1111, Register 0x3E.
+	 * Write 24-bit value 0xC0A028 to register. Setting
+	 * FastMseKp2ThreshLong1000, FastMseKp2ThreshShort1000,
+	 * FastMseKp2UpdGain1000, FastMseKp2ExitEn1000 bits.
+	 */
+	err = lan88xx_TR_reg_set(phydev, 0x0FFC, 0xC0A028);
+	if (err < 0)
+		pr_warn("Failed to Set Register[0x0FFC]\n");
+
+	/* Get access to Channel b'01, Node b'1111, Register 0x35.
+	 * Write 24-bit value 0x041600 to register. Setting
+	 * FastMseSearchPhShNum1000, FastMseSearchClksPerPh1000,
+	 * FastMsePhChangeDelay1000 bits.
+	 */
+	err = lan88xx_TR_reg_set(phydev, 0x0FEA, 0x041600);
+	if (err < 0)
+		pr_warn("Failed to Set Register[0x0FEA]\n");
+
+	/* Get access to Channel b'10, Node b'1101, Register 0x03.
+	 * Write 24-bit value 0x000004 to register. Setting TrFreeze bits.
+	 */
+	err = lan88xx_TR_reg_set(phydev, 0x1686, 0x000004);
+	if (err < 0)
+		pr_warn("Failed to Set Register[0x1686]\n");
+}
+
 static int lan88xx_probe(struct phy_device *phydev)
 {
 	struct device *dev = &phydev->mdio.dev;
@@ -132,6 +287,25 @@ static void lan88xx_set_mdix(struct phy_device *phydev)
 	phy_write(phydev, LAN88XX_EXT_PAGE_ACCESS, LAN88XX_EXT_PAGE_SPACE_0);
 }
 
+static int lan88xx_config_init(struct phy_device *phydev)
+{
+	int val;
+
+	genphy_config_init(phydev);
+	/*Zerodetect delay enable */
+	val = phy_read_mmd(phydev, MDIO_MMD_PCS,
+			   PHY_ARDENNES_MMD_DEV_3_PHY_CFG);
+	val |= PHY_ARDENNES_MMD_DEV_3_PHY_CFG_ZD_DLY_EN_;
+
+	phy_write_mmd(phydev, MDIO_MMD_PCS, PHY_ARDENNES_MMD_DEV_3_PHY_CFG,
+		      val);
+
+	/* Config DSP registers */
+	lan88xx_config_TR_regs(phydev);
+
+	return 0;
+}
+
 static int lan88xx_config_aneg(struct phy_device *phydev)
 {
 	lan88xx_set_mdix(phydev);
@@ -151,7 +325,7 @@ static struct phy_driver microchip_phy_driver[] = {
 	.probe		= lan88xx_probe,
 	.remove		= lan88xx_remove,
 
-	.config_init	= genphy_config_init,
+	.config_init	= lan88xx_config_init,
 	.config_aneg	= lan88xx_config_aneg,
 	.read_status	= genphy_read_status,
 
@@ -161,6 +335,8 @@ static struct phy_driver microchip_phy_driver[] = {
 	.suspend	= lan88xx_suspend,
 	.resume		= genphy_resume,
 	.set_wol	= lan88xx_set_wol,
+	.read_page	= lan88xx_read_page,
+	.write_page	= lan88xx_write_page,
 } };
 
 module_phy_driver(microchip_phy_driver);
diff --git a/drivers/net/phy/phy-core.c b/drivers/net/phy/phy-core.c
index 21f75ae244b3..412ed8ff50e2 100644
--- a/drivers/net/phy/phy-core.c
+++ b/drivers/net/phy/phy-core.c
@@ -193,13 +193,14 @@ static void mmd_phy_indirect(struct mii_bus *bus, int phy_addr, int devad,
 			     u16 regnum)
 {
 	/* Write the desired MMD Devad */
-	bus->write(bus, phy_addr, MII_MMD_CTRL, devad);
+	__mdiobus_write(bus, phy_addr, MII_MMD_CTRL, devad);
 
 	/* Write the desired MMD register address */
-	bus->write(bus, phy_addr, MII_MMD_DATA, regnum);
+	__mdiobus_write(bus, phy_addr, MII_MMD_DATA, regnum);
 
 	/* Select the Function : DATA with no post increment */
-	bus->write(bus, phy_addr, MII_MMD_CTRL, devad | MII_MMD_CTRL_NOINCR);
+	__mdiobus_write(bus, phy_addr, MII_MMD_CTRL,
+			devad | MII_MMD_CTRL_NOINCR);
 }
 
 /**
@@ -232,7 +233,7 @@ int phy_read_mmd(struct phy_device *phydev, int devad, u32 regnum)
 		mmd_phy_indirect(bus, phy_addr, devad, regnum);
 
 		/* Read the content of the MMD's selected register */
-		val = bus->read(bus, phy_addr, MII_MMD_DATA);
+		val = __mdiobus_read(bus, phy_addr, MII_MMD_DATA);
 		mutex_unlock(&bus->mdio_lock);
 	}
 	return val;
@@ -271,7 +272,7 @@ int phy_write_mmd(struct phy_device *phydev, int devad, u32 regnum, u16 val)
 		mmd_phy_indirect(bus, phy_addr, devad, regnum);
 
 		/* Write the data into MMD's selected register */
-		bus->write(bus, phy_addr, MII_MMD_DATA, val);
+		__mdiobus_write(bus, phy_addr, MII_MMD_DATA, val);
 		mutex_unlock(&bus->mdio_lock);
 
 		ret = 0;
@@ -279,3 +280,185 @@ int phy_write_mmd(struct phy_device *phydev, int devad, u32 regnum, u16 val)
 	return ret;
 }
 EXPORT_SYMBOL(phy_write_mmd);
+
+/**
+ * __phy_modify() - Convenience function for modifying a PHY register
+ * @phydev: a pointer to a &struct phy_device
+ * @regnum: register number
+ * @mask: bit mask of bits to clear
+ * @set: bit mask of bits to set
+ *
+ * Unlocked helper function which allows a PHY register to be modified as
+ * new register value = (old register value & mask) | set
+ */
+int __phy_modify(struct phy_device *phydev, u32 regnum, u16 mask, u16 set)
+{
+	int ret, res;
+
+	ret = __phy_read(phydev, regnum);
+	if (ret >= 0) {
+		res = __phy_write(phydev, regnum, (ret & ~mask) | set);
+		if (res < 0)
+			ret = res;
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(__phy_modify);
+
+static int __phy_read_page(struct phy_device *phydev)
+{
+	return phydev->drv->read_page(phydev);
+}
+
+static int __phy_write_page(struct phy_device *phydev, int page)
+{
+	return phydev->drv->write_page(phydev, page);
+}
+
+/**
+ * phy_save_page() - take the bus lock and save the current page
+ * @phydev: a pointer to a &struct phy_device
+ *
+ * Take the MDIO bus lock, and return the current page number. On error,
+ * returns a negative errno. phy_restore_page() must always be called
+ * after this, irrespective of success or failure of this call.
+ */
+int phy_save_page(struct phy_device *phydev)
+{
+	mutex_lock(&phydev->mdio.bus->mdio_lock);
+	return __phy_read_page(phydev);
+}
+EXPORT_SYMBOL_GPL(phy_save_page);
+
+/**
+ * phy_select_page() - take the bus lock, save the current page, and set a page
+ * @phydev: a pointer to a &struct phy_device
+ * @page: desired page
+ *
+ * Take the MDIO bus lock to protect against concurrent access, save the
+ * current PHY page, and set the current page.  On error, returns a
+ * negative errno, otherwise returns the previous page number.
+ * phy_restore_page() must always be called after this, irrespective
+ * of success or failure of this call.
+ */
+int phy_select_page(struct phy_device *phydev, int page)
+{
+	int ret, oldpage;
+
+	oldpage = ret = phy_save_page(phydev);
+	if (ret < 0)
+		return ret;
+
+	if (oldpage != page) {
+		ret = __phy_write_page(phydev, page);
+		if (ret < 0)
+			return ret;
+	}
+
+	return oldpage;
+}
+EXPORT_SYMBOL_GPL(phy_select_page);
+
+/**
+ * phy_restore_page() - restore the page register and release the bus lock
+ * @phydev: a pointer to a &struct phy_device
+ * @oldpage: the old page, return value from phy_save_page() or phy_select_page()
+ * @ret: operation's return code
+ *
+ * Release the MDIO bus lock, restoring @oldpage if it is a valid page.
+ * This function propagates the earliest error code from the group of
+ * operations.
+ *
+ * Returns:
+ *   @oldpage if it was a negative value, otherwise
+ *   @ret if it was a negative errno value, otherwise
+ *   phy_write_page()'s negative value if it were in error, otherwise
+ *   @ret.
+ */
+int phy_restore_page(struct phy_device *phydev, int oldpage, int ret)
+{
+	int r;
+
+	if (oldpage >= 0) {
+		r = __phy_write_page(phydev, oldpage);
+
+		/* Propagate the operation return code if the page write
+		 * was successful.
+		 */
+		if (ret >= 0 && r < 0)
+			ret = r;
+	} else {
+		/* Propagate the phy page selection error code */
+		ret = oldpage;
+	}
+
+	mutex_unlock(&phydev->mdio.bus->mdio_lock);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(phy_restore_page);
+
+/**
+ * phy_read_paged() - Convenience function for reading a paged register
+ * @phydev: a pointer to a &struct phy_device
+ * @page: the page for the phy
+ * @regnum: register number
+ *
+ * Same rules as for phy_read().
+ */
+int phy_read_paged(struct phy_device *phydev, int page, u32 regnum)
+{
+	int ret = 0, oldpage;
+
+	oldpage = phy_select_page(phydev, page);
+	if (oldpage >= 0)
+		ret = __phy_read(phydev, regnum);
+
+	return phy_restore_page(phydev, oldpage, ret);
+}
+EXPORT_SYMBOL(phy_read_paged);
+
+/**
+ * phy_write_paged() - Convenience function for writing a paged register
+ * @phydev: a pointer to a &struct phy_device
+ * @page: the page for the phy
+ * @regnum: register number
+ * @val: value to write
+ *
+ * Same rules as for phy_write().
+ */
+int phy_write_paged(struct phy_device *phydev, int page, u32 regnum, u16 val)
+{
+	int ret = 0, oldpage;
+
+	oldpage = phy_select_page(phydev, page);
+	if (oldpage >= 0)
+		ret = __phy_write(phydev, regnum, val);
+
+	return phy_restore_page(phydev, oldpage, ret);
+}
+EXPORT_SYMBOL(phy_write_paged);
+
+/**
+ * phy_modify_paged() - Convenience function for modifying a paged register
+ * @phydev: a pointer to a &struct phy_device
+ * @page: the page for the phy
+ * @regnum: register number
+ * @mask: bit mask of bits to clear
+ * @set: bit mask of bits to set
+ *
+ * Same rules as for phy_read() and phy_write().
+ */
+int phy_modify_paged(struct phy_device *phydev, int page, u32 regnum,
+		     u16 mask, u16 set)
+{
+	int ret = 0, oldpage;
+
+	oldpage = phy_select_page(phydev, page);
+	if (oldpage >= 0)
+		ret = __phy_modify(phydev, regnum, mask, set);
+
+	return phy_restore_page(phydev, oldpage, ret);
+}
+EXPORT_SYMBOL(phy_modify_paged);
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 9881edc568ba..28c47345420a 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -37,6 +37,7 @@
 #include <linux/irqchip/chained_irq.h>
 #include <linux/microchipphy.h>
 #include <linux/phy.h>
+#include <linux/of_net.h>
 #include "lan78xx.h"
 
 #define DRIVER_AUTHOR	"WOOJUNG HUH <woojung.huh@microchip.com>"
@@ -63,6 +64,7 @@
 #define DEFAULT_RX_CSUM_ENABLE		(true)
 #define DEFAULT_TSO_CSUM_ENABLE		(true)
 #define DEFAULT_VLAN_FILTER_ENABLE	(true)
+#define DEFAULT_VLAN_RX_OFFLOAD		(true)
 #define TX_OVERHEAD			(8)
 #define RXW_PADDING			2
 
@@ -1652,6 +1654,15 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev)
 	addr[5] = (addr_hi >> 8) & 0xFF;
 
 	if (!is_valid_ether_addr(addr)) {
+		const u8 *mac_addr;
+
+		/* maybe the boot loader passed the MAC address in devicetree */
+		mac_addr = of_get_mac_address(dev->udev->dev.of_node);
+		if (mac_addr) {
+			ether_addr_copy(addr, mac_addr);
+			goto set_mac_addr;
+		}
+
 		/* reading mac address from EEPROM or OTP */
 		if ((lan78xx_read_eeprom(dev, EEPROM_MAC_OFFSET, ETH_ALEN,
 					 addr) == 0) ||
@@ -1668,6 +1679,7 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev)
 					  "MAC address set to random addr");
 			}
 
+set_mac_addr:
 			addr_lo = addr[0] | (addr[1] << 8) |
 				  (addr[2] << 16) | (addr[3] << 24);
 			addr_hi = addr[4] | (addr[5] << 8);
@@ -2007,6 +2019,9 @@ static int lan78xx_phy_init(struct lan78xx_net *dev)
 {
 	int ret;
 	u32 mii_adv;
+	u32 led_modes[2];
+	u32 led_modes_reg;
+	int i;
 	struct phy_device *phydev = dev->net->phydev;
 
 	phydev = phy_find_first(dev->mdiobus);
@@ -2079,6 +2094,44 @@ static int lan78xx_phy_init(struct lan78xx_net *dev)
 	mii_adv = (u32)mii_advertise_flowctrl(dev->fc_request_control);
 	phydev->advertising |= mii_adv_to_ethtool_adv_t(mii_adv);
 
+	if (of_property_read_bool(dev->udev->dev.of_node,
+				  "microchip,eee-enabled")) {
+		struct ethtool_eee edata;
+		memset(&edata, 0, sizeof(edata));
+		edata.cmd = ETHTOOL_SEEE;
+		edata.advertised = ADVERTISED_1000baseT_Full |
+				   ADVERTISED_100baseT_Full;
+		edata.eee_enabled = true;
+		edata.tx_lpi_enabled = true;
+		if (of_property_read_u32(dev->udev->dev.of_node,
+					 "microchip,tx-lpi-timer",
+					 &edata.tx_lpi_timer))
+			edata.tx_lpi_timer = 600; /* non-aggressive */
+		(void)lan78xx_set_eee(dev->net, &edata);
+	}
+
+	/* Set LED modes:
+	 * led: 0=link/activity          1=link1000/activity
+	 *      2=link100/activity       3=link10/activity
+	 *      4=link100/1000/activity  5=link10/1000/activity
+	 *      6=link10/100/activity    14=off    15=on
+	 */
+
+	memset(led_modes, ~0, sizeof(led_modes));
+
+	of_property_read_u32_array(dev->udev->dev.of_node,
+				   "microchip,led-modes",
+				   led_modes, ARRAY_SIZE(led_modes));
+
+	led_modes_reg = phy_read(phydev, 0x1d);
+	for (i = 0; i < ARRAY_SIZE(led_modes); i++) {
+		if (led_modes[i] != ~0) {
+			led_modes_reg &= ~(0xf << (i * 4));
+			led_modes_reg |= (led_modes[i] & 0xf) << (i * 4);
+		}
+	}
+	(void)phy_write(phydev, 0x1d, led_modes_reg);
+
 	genphy_config_aneg(phydev);
 
 	dev->fc_autoneg = phydev->autoneg;
@@ -2178,7 +2231,7 @@ static int lan78xx_change_mtu(struct net_device *netdev, int new_mtu)
 	if ((ll_mtu % dev->maxpacket) == 0)
 		return -EDOM;
 
-	ret = lan78xx_set_rx_max_frame_length(dev, new_mtu + ETH_HLEN);
+	ret = lan78xx_set_rx_max_frame_length(dev, new_mtu + VLAN_ETH_HLEN);
 
 	netdev->mtu = new_mtu;
 
@@ -2244,6 +2297,11 @@ static int lan78xx_set_features(struct net_device *netdev,
 	}
 
 	if (features & NETIF_F_HW_VLAN_CTAG_RX)
+		pdata->rfe_ctl |= RFE_CTL_VLAN_STRIP_;
+	else
+		pdata->rfe_ctl &= ~RFE_CTL_VLAN_STRIP_;
+
+	if (features & NETIF_F_HW_VLAN_CTAG_FILTER)
 		pdata->rfe_ctl |= RFE_CTL_VLAN_FILTER_;
 	else
 		pdata->rfe_ctl &= ~RFE_CTL_VLAN_FILTER_;
@@ -2348,7 +2406,11 @@ static int lan78xx_reset(struct lan78xx_net *dev)
 	u32 buf;
 	int ret = 0;
 	unsigned long timeout;
-	u8 sig;
+	bool has_eeprom;
+	bool has_otp;
+
+	has_eeprom = !lan78xx_read_eeprom(dev, 0, 0, NULL);
+	has_otp = !lan78xx_read_otp(dev, 0, 0, NULL);
 
 	ret = lan78xx_read_reg(dev, HW_CFG, &buf);
 	buf |= HW_CFG_LRST_;
@@ -2402,6 +2464,9 @@ static int lan78xx_reset(struct lan78xx_net *dev)
 
 	ret = lan78xx_read_reg(dev, HW_CFG, &buf);
 	buf |= HW_CFG_MEF_;
+	/* If no valid EEPROM and no valid OTP, enable the LEDs by default */
+	if (!has_eeprom && !has_otp)
+	    buf |= HW_CFG_LED0_EN_ | HW_CFG_LED1_EN_;
 	ret = lan78xx_write_reg(dev, HW_CFG, buf);
 
 	ret = lan78xx_read_reg(dev, USB_CFG0, &buf);
@@ -2448,15 +2513,9 @@ static int lan78xx_reset(struct lan78xx_net *dev)
 	/* LAN7801 only has RGMII mode */
 	if (dev->chipid == ID_REV_CHIP_ID_7801_)
 		buf &= ~MAC_CR_GMII_EN_;
-
-	if (dev->chipid == ID_REV_CHIP_ID_7800_) {
-		ret = lan78xx_read_raw_eeprom(dev, 0, 1, &sig);
-		if (!ret && sig != EEPROM_INDICATOR) {
-			/* Implies there is no external eeprom. Set mac speed */
-			netdev_info(dev->net, "No External EEPROM. Setting MAC Speed\n");
-			buf |= MAC_CR_AUTO_DUPLEX_ | MAC_CR_AUTO_SPEED_;
-		}
-	}
+	/* If no valid EEPROM and no valid OTP, enable AUTO negotiation */
+	if (!has_eeprom && !has_otp)
+	    buf |= MAC_CR_AUTO_DUPLEX_ | MAC_CR_AUTO_SPEED_;
 	ret = lan78xx_write_reg(dev, MAC_CR, buf);
 
 	ret = lan78xx_read_reg(dev, MAC_TX, &buf);
@@ -2467,7 +2526,8 @@ static int lan78xx_reset(struct lan78xx_net *dev)
 	buf |= FCT_TX_CTL_EN_;
 	ret = lan78xx_write_reg(dev, FCT_TX_CTL, buf);
 
-	ret = lan78xx_set_rx_max_frame_length(dev, dev->net->mtu + ETH_HLEN);
+	ret = lan78xx_set_rx_max_frame_length(dev,
+					      dev->net->mtu + VLAN_ETH_HLEN);
 
 	ret = lan78xx_read_reg(dev, MAC_RX, &buf);
 	buf |= MAC_RX_RXEN_;
@@ -2503,7 +2563,7 @@ static void lan78xx_init_stats(struct lan78xx_net *dev)
 	dev->stats.rollover_max.eee_tx_lpi_transitions = 0xFFFFFFFF;
 	dev->stats.rollover_max.eee_tx_lpi_time = 0xFFFFFFFF;
 
-	lan78xx_defer_kevent(dev, EVENT_STAT_UPDATE);
+	set_bit(EVENT_STAT_UPDATE, &dev->flags);
 }
 
 static int lan78xx_open(struct net_device *net)
@@ -2515,10 +2575,6 @@ static int lan78xx_open(struct net_device *net)
 	if (ret < 0)
 		goto out;
 
-	ret = lan78xx_reset(dev);
-	if (ret < 0)
-		goto done;
-
 	phy_start(net->phydev);
 
 	netif_dbg(dev, ifup, dev->net, "phy initialised successfully");
@@ -2859,6 +2915,12 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf)
 	if (DEFAULT_TSO_CSUM_ENABLE)
 		dev->net->features |= NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_SG;
 
+	if (DEFAULT_VLAN_RX_OFFLOAD)
+		dev->net->features |= NETIF_F_HW_VLAN_CTAG_RX;
+
+	if (DEFAULT_VLAN_FILTER_ENABLE)
+		dev->net->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
+
 	dev->net->hw_features = dev->net->features;
 
 	ret = lan78xx_setup_irq_domain(dev);
@@ -2923,8 +2985,13 @@ static void lan78xx_rx_csum_offload(struct lan78xx_net *dev,
 				    struct sk_buff *skb,
 				    u32 rx_cmd_a, u32 rx_cmd_b)
 {
+	/* HW Checksum offload appears to be flawed if used when not stripping
+	 * VLAN headers.
+	 */
 	if (!(dev->net->features & NETIF_F_RXCSUM) ||
-	    unlikely(rx_cmd_a & RX_CMD_A_ICSM_)) {
+	    unlikely(rx_cmd_a & RX_CMD_A_ICSM_) ||
+	    ((rx_cmd_a & RX_CMD_A_FVTG_) &&
+	     !(dev->net->features & NETIF_F_HW_VLAN_CTAG_RX))) {
 		skb->ip_summed = CHECKSUM_NONE;
 	} else {
 		skb->csum = ntohs((u16)(rx_cmd_b >> RX_CMD_B_CSUM_SHIFT_));
@@ -2932,6 +2999,16 @@ static void lan78xx_rx_csum_offload(struct lan78xx_net *dev,
 	}
 }
 
+static void lan78xx_rx_vlan_offload(struct lan78xx_net *dev,
+				    struct sk_buff *skb,
+				    u32 rx_cmd_a, u32 rx_cmd_b)
+{
+	if ((dev->net->features & NETIF_F_HW_VLAN_CTAG_RX) &&
+	    (rx_cmd_a & RX_CMD_A_FVTG_))
+		__vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q),
+				       (rx_cmd_b & 0xffff));
+}
+
 static void lan78xx_skb_return(struct lan78xx_net *dev, struct sk_buff *skb)
 {
 	int		status;
@@ -2996,6 +3073,8 @@ static int lan78xx_rx(struct lan78xx_net *dev, struct sk_buff *skb)
 			if (skb->len == size) {
 				lan78xx_rx_csum_offload(dev, skb,
 							rx_cmd_a, rx_cmd_b);
+				lan78xx_rx_vlan_offload(dev, skb,
+							rx_cmd_a, rx_cmd_b);
 
 				skb_trim(skb, skb->len - 4); /* remove fcs */
 				skb->truesize = size + sizeof(struct sk_buff);
@@ -3014,6 +3093,7 @@ static int lan78xx_rx(struct lan78xx_net *dev, struct sk_buff *skb)
 			skb_set_tail_pointer(skb2, size);
 
 			lan78xx_rx_csum_offload(dev, skb2, rx_cmd_a, rx_cmd_b);
+			lan78xx_rx_vlan_offload(dev, skb2, rx_cmd_a, rx_cmd_b);
 
 			skb_trim(skb2, skb2->len - 4); /* remove fcs */
 			skb2->truesize = size + sizeof(struct sk_buff);
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 309b88acd3d0..4d9704d0b184 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -60,6 +60,7 @@
 #define SUSPEND_SUSPEND3		(0x08)
 #define SUSPEND_ALLMODES		(SUSPEND_SUSPEND0 | SUSPEND_SUSPEND1 | \
 					 SUSPEND_SUSPEND2 | SUSPEND_SUSPEND3)
+#define MAC_ADDR_LEN                    (6)
 
 #define CARRIER_CHECK_DELAY (2 * HZ)
 
@@ -82,6 +83,18 @@ static bool turbo_mode = true;
 module_param(turbo_mode, bool, 0644);
 MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction");
 
+static bool truesize_mode = false;
+module_param(truesize_mode, bool, 0644);
+MODULE_PARM_DESC(truesize_mode, "Report larger truesize value");
+
+static int packetsize = 2560;
+module_param(packetsize, int, 0644);
+MODULE_PARM_DESC(packetsize, "Override the RX URB packet size");
+
+static char *macaddr = ":";
+module_param(macaddr, charp, 0);
+MODULE_PARM_DESC(macaddr, "MAC address");
+
 static int __must_check __smsc95xx_read_reg(struct usbnet *dev, u32 index,
 					    u32 *data, int in_pm)
 {
@@ -910,6 +923,53 @@ static int smsc95xx_ioctl(struct net_device *netdev, struct ifreq *rq, int cmd)
 	return generic_mii_ioctl(&dev->mii, if_mii(rq), cmd, NULL);
 }
 
+/* Check the macaddr module parameter for a MAC address */
+static int smsc95xx_is_macaddr_param(struct usbnet *dev, u8 *dev_mac)
+{
+       int i, j, got_num, num;
+       u8 mtbl[MAC_ADDR_LEN];
+
+       if (macaddr[0] == ':')
+               return 0;
+
+       i = 0;
+       j = 0;
+       num = 0;
+       got_num = 0;
+       while (j < MAC_ADDR_LEN) {
+               if (macaddr[i] && macaddr[i] != ':') {
+                       got_num++;
+                       if ('0' <= macaddr[i] && macaddr[i] <= '9')
+                               num = num * 16 + macaddr[i] - '0';
+                       else if ('A' <= macaddr[i] && macaddr[i] <= 'F')
+                               num = num * 16 + 10 + macaddr[i] - 'A';
+                       else if ('a' <= macaddr[i] && macaddr[i] <= 'f')
+                               num = num * 16 + 10 + macaddr[i] - 'a';
+                       else
+                               break;
+                       i++;
+               } else if (got_num == 2) {
+                       mtbl[j++] = (u8) num;
+                       num = 0;
+                       got_num = 0;
+                       i++;
+               } else {
+                       break;
+               }
+       }
+
+       if (j == MAC_ADDR_LEN) {
+               netif_dbg(dev, ifup, dev->net, "Overriding MAC address with: "
+               "%02x:%02x:%02x:%02x:%02x:%02x\n", mtbl[0], mtbl[1], mtbl[2],
+                                               mtbl[3], mtbl[4], mtbl[5]);
+               for (i = 0; i < MAC_ADDR_LEN; i++)
+                       dev_mac[i] = mtbl[i];
+               return 1;
+       } else {
+               return 0;
+       }
+}
+
 static void smsc95xx_init_mac_address(struct usbnet *dev)
 {
 	const u8 *mac_addr;
@@ -931,6 +991,10 @@ static void smsc95xx_init_mac_address(struct usbnet *dev)
 		}
 	}
 
+	/* Check module parameters */
+	if (smsc95xx_is_macaddr_param(dev, dev->net->dev_addr))
+		return;
+
 	/* no useful static MAC address found. generate a random one */
 	eth_hw_addr_random(dev->net);
 	netif_dbg(dev, ifup, dev->net, "MAC address set to eth_random_addr\n");
@@ -1102,13 +1166,13 @@ static int smsc95xx_reset(struct usbnet *dev)
 
 	if (!turbo_mode) {
 		burst_cap = 0;
-		dev->rx_urb_size = MAX_SINGLE_PACKET_SIZE;
+		dev->rx_urb_size = packetsize ? packetsize : MAX_SINGLE_PACKET_SIZE;
 	} else if (dev->udev->speed == USB_SPEED_HIGH) {
-		burst_cap = DEFAULT_HS_BURST_CAP_SIZE / HS_USB_PKT_SIZE;
-		dev->rx_urb_size = DEFAULT_HS_BURST_CAP_SIZE;
+		dev->rx_urb_size = packetsize ? packetsize : DEFAULT_HS_BURST_CAP_SIZE;
+		burst_cap = dev->rx_urb_size / HS_USB_PKT_SIZE;
 	} else {
-		burst_cap = DEFAULT_FS_BURST_CAP_SIZE / FS_USB_PKT_SIZE;
-		dev->rx_urb_size = DEFAULT_FS_BURST_CAP_SIZE;
+		dev->rx_urb_size = packetsize ? packetsize : DEFAULT_FS_BURST_CAP_SIZE;
+		burst_cap = dev->rx_urb_size / FS_USB_PKT_SIZE;
 	}
 
 	netif_dbg(dev, ifup, dev->net, "rx_urb_size=%ld\n",
@@ -1959,7 +2023,8 @@ static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 				if (dev->net->features & NETIF_F_RXCSUM)
 					smsc95xx_rx_csum_offload(skb);
 				skb_trim(skb, skb->len - 4); /* remove fcs */
-				skb->truesize = size + sizeof(struct sk_buff);
+				if (truesize_mode)
+					skb->truesize = size + sizeof(struct sk_buff);
 
 				return 1;
 			}
@@ -1977,7 +2042,8 @@ static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 			if (dev->net->features & NETIF_F_RXCSUM)
 				smsc95xx_rx_csum_offload(ax_skb);
 			skb_trim(ax_skb, ax_skb->len - 4); /* remove fcs */
-			ax_skb->truesize = size + sizeof(struct sk_buff);
+			if (truesize_mode)
+				ax_skb->truesize = size + sizeof(struct sk_buff);
 
 			usbnet_skb_return(dev, ax_skb);
 		}
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
index 163ddc49f951..fb60a7c66e2c 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
@@ -71,6 +71,7 @@ struct brcmf_bus_dcmd {
  * @wowl_config: specify if dongle is configured for wowl when going to suspend
  * @get_ramsize: obtain size of device memory.
  * @get_memdump: obtain device memory dump in provided buffer.
+ * @get_fwname: obtain firmware name.
  *
  * This structure provides an abstract interface towards the
  * bus specific driver. For control messages to common driver
@@ -87,6 +88,8 @@ struct brcmf_bus_ops {
 	void (*wowl_config)(struct device *dev, bool enabled);
 	size_t (*get_ramsize)(struct device *dev);
 	int (*get_memdump)(struct device *dev, void *data, size_t len);
+	int (*get_fwname)(struct device *dev, uint chip, uint chiprev,
+			  unsigned char *fw_name);
 };
 
 
@@ -224,6 +227,16 @@ int brcmf_bus_get_memdump(struct brcmf_bus *bus, void *data, size_t len)
 	return bus->ops->get_memdump(bus->dev, data, len);
 }
 
+static inline
+int brcmf_bus_get_fwname(struct brcmf_bus *bus, uint chip, uint chiprev,
+			 unsigned char *fw_name)
+{
+	if (!bus->ops->get_fwname)
+		return -EOPNOTSUPP;
+
+	return bus->ops->get_fwname(bus->dev, chip, chiprev, fw_name);
+}
+
 /*
  * interface functions from common layer
  */
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 083e5ce7eac7..51b995044e6c 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -472,47 +472,6 @@ send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 	return err;
 }
 
-static s32
-brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
-{
-	s32 err;
-	u32 mode;
-
-	if (enable)
-		mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
-	else
-		mode = 0;
-
-	/* Try to set and enable ARP offload feature, this may fail, then it  */
-	/* is simply not supported and err 0 will be returned                 */
-	err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
-	if (err) {
-		brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
-			  mode, err);
-		err = 0;
-	} else {
-		err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
-		if (err) {
-			brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
-				  enable, err);
-			err = 0;
-		} else
-			brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
-				  enable, mode);
-	}
-
-	err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
-	if (err) {
-		brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
-			  enable, err);
-		err = 0;
-	} else
-		brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
-			  enable, mode);
-
-	return err;
-}
-
 static void
 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 {
@@ -2810,6 +2769,8 @@ brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
 	 * preference in cfg struct to apply this to
 	 * FW later while initializing the dongle
 	 */
+	pr_info("power management disabled\n");
+	enabled = false;
 	cfg->pwr_save = enabled;
 	if (!check_vif_up(ifp->vif)) {
 
@@ -6862,12 +6823,18 @@ static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
 	struct brcmfmac_pd_cc *country_codes;
 	struct brcmfmac_pd_cc_entry *cc;
 	s32 found_index;
+	char ccode[BRCMF_COUNTRY_BUF_SZ];
+	int rev;
 	int i;
 
+	memcpy(ccode, alpha2, sizeof(ccode));
+	rev = -1;
+
 	country_codes = drvr->settings->country_codes;
 	if (!country_codes) {
-		brcmf_dbg(TRACE, "No country codes configured for device\n");
-		return -EINVAL;
+		brcmf_dbg(TRACE, "No country codes configured for device"
+				 " - use requested value\n");
+		goto use_input_value;
 	}
 
 	if ((alpha2[0] == ccreq->country_abbrev[0]) &&
@@ -6891,10 +6858,14 @@ static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
 		brcmf_dbg(TRACE, "No country code match found\n");
 		return -EINVAL;
 	}
-	memset(ccreq, 0, sizeof(*ccreq));
-	ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
-	memcpy(ccreq->ccode, country_codes->table[found_index].cc,
+	rev = country_codes->table[found_index].rev;
+	memcpy(ccode, country_codes->table[found_index].cc,
 	       BRCMF_COUNTRY_BUF_SZ);
+
+use_input_value:
+	memset(ccreq, 0, sizeof(*ccreq));
+	ccreq->rev = cpu_to_le32(rev);
+	memcpy(ccreq->ccode, ccode, sizeof(ccode));
 	ccreq->country_abbrev[0] = alpha2[0];
 	ccreq->country_abbrev[1] = alpha2[1];
 	ccreq->country_abbrev[2] = 0;
@@ -6918,6 +6889,8 @@ static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
 	/* ignore non-ISO3166 country codes */
 	for (i = 0; i < 2; i++)
 		if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
+			if (req->alpha2[0] == '0' && req->alpha2[1] == '0')
+				return;
 			brcmf_err("not an ISO3166 code (0x%02x 0x%02x)\n",
 				  req->alpha2[0], req->alpha2[1]);
 			return;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
index 7a2b49587b4d..b5889360da96 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
@@ -18,6 +18,7 @@
 #include <linux/string.h>
 #include <linux/netdevice.h>
 #include <linux/module.h>
+#include <linux/firmware.h>
 #include <brcmu_wifi.h>
 #include <brcmu_utils.h>
 #include "core.h"
@@ -28,6 +29,7 @@
 #include "tracepoint.h"
 #include "common.h"
 #include "of.h"
+#include "firmware.h"
 
 MODULE_AUTHOR("Broadcom Corporation");
 MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
@@ -69,7 +71,7 @@ static int brcmf_fcmode;
 module_param_named(fcmode, brcmf_fcmode, int, 0);
 MODULE_PARM_DESC(fcmode, "Mode of firmware signalled flow control");
 
-static int brcmf_roamoff;
+static int brcmf_roamoff = 1;
 module_param_named(roamoff, brcmf_roamoff, int, S_IRUSR);
 MODULE_PARM_DESC(roamoff, "Do not use internal roaming engine");
 
@@ -104,15 +106,170 @@ void brcmf_c_set_joinpref_default(struct brcmf_if *ifp)
 		brcmf_err("Set join_pref error (%d)\n", err);
 }
 
+int brcmf_c_download_2_dongle(struct brcmf_if *ifp, char *dcmd, u16 flag,
+			      u16 dload_type, char *dload_buf, u32 len)
+{
+	struct brcmf_dload_data_le *dload_ptr;
+	u32 dload_data_offset;
+	u16 flags;
+	s32 err;
+
+	dload_ptr = (struct brcmf_dload_data_le *)dload_buf;
+	dload_data_offset = offsetof(struct brcmf_dload_data_le, data);
+	flags = flag | (DLOAD_HANDLER_VER << DLOAD_FLAG_VER_SHIFT);
+
+	dload_ptr->flag = cpu_to_le16(flags);
+	dload_ptr->dload_type = cpu_to_le16(dload_type);
+	dload_ptr->len = cpu_to_le32(len - dload_data_offset);
+	dload_ptr->crc = cpu_to_le32(0);
+	len = len + 8 - (len % 8);
+
+	err = brcmf_fil_iovar_data_set(ifp, dcmd, (void *)dload_buf, len);
+
+	return err;
+}
+
+int brcmf_c_get_clm_name(struct brcmf_if *ifp, u8 *clm_name)
+{
+	struct brcmf_rev_info_le revinfo;
+	struct brcmf_bus *bus = ifp->drvr->bus_if;
+	u8 fw_name[BRCMF_FW_NAME_LEN];
+	u8 *ptr;
+	size_t len;
+	u32 chipnum;
+	u32 chiprev;
+	s32 err;
+
+	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_REVINFO, &revinfo,
+				     sizeof(revinfo));
+	if (err < 0) {
+		brcmf_err("retrieving revision info failed (%d)\n", err);
+		goto done;
+	}
+
+	chipnum = le32_to_cpu(revinfo.chipnum);
+	chiprev = le32_to_cpu(revinfo.chiprev);
+
+	memset(fw_name, 0, BRCMF_FW_NAME_LEN);
+	err = brcmf_bus_get_fwname(bus, chipnum, chiprev, fw_name);
+	if (err) {
+		brcmf_err("get firmware name failed (%d)\n", err);
+		goto done;
+	}
+
+	/* generate CLM blob file name */
+	ptr = strrchr(fw_name, '.');
+	len = ptr - fw_name + 1;
+	if (len + strlen(".clm_blob") > BRCMF_FW_NAME_LEN) {
+		err = -E2BIG;
+	} else {
+		strlcpy(clm_name, fw_name, len);
+		strlcat(clm_name, ".clm_blob", BRCMF_FW_NAME_LEN);
+	}
+done:
+	return err;
+}
+
+int brcmf_c_process_clm_blob(struct brcmf_if *ifp)
+{
+	struct device *dev = ifp->drvr->bus_if->dev;
+	const struct firmware *clm = NULL;
+	u8 buf[BRCMF_DCMD_SMLEN];
+	u8 clm_name[BRCMF_FW_NAME_LEN];
+	u32 data_offset;
+	u32 size2alloc;
+	u8 *chunk_buf;
+	u32 chunk_len;
+	u32 datalen;
+	u32 cumulative_len = 0;
+	u16 dl_flag = DL_BEGIN;
+	s32 err;
+
+	brcmf_dbg(INFO, "Enter\n");
+
+	memset(clm_name, 0, BRCMF_FW_NAME_LEN);
+	err = brcmf_c_get_clm_name(ifp, clm_name);
+	if (err) {
+		brcmf_err("get CLM blob file name failed (%d)\n", err);
+		return err;
+	}
+
+	err = request_firmware_direct(&clm, clm_name, dev);
+	if (err) {
+		if (err == -ENOENT)
+			return 0;
+		brcmf_err("request CLM blob file failed (%d)\n", err);
+		return err;
+	}
+
+	datalen = clm->size;
+	data_offset = offsetof(struct brcmf_dload_data_le, data);
+	size2alloc = data_offset + MAX_CHUNK_LEN;
+
+	chunk_buf = kzalloc(size2alloc, GFP_KERNEL);
+	if (!chunk_buf) {
+		err = -ENOMEM;
+		goto done;
+	}
+
+	do {
+		if (datalen > MAX_CHUNK_LEN) {
+			chunk_len = MAX_CHUNK_LEN;
+		} else {
+			chunk_len = datalen;
+			dl_flag |= DL_END;
+		}
+
+		memcpy(chunk_buf + data_offset, clm->data + cumulative_len,
+		       chunk_len);
+
+		err = brcmf_c_download_2_dongle(ifp, "clmload", dl_flag,
+						DL_TYPE_CLM, chunk_buf,
+						data_offset + chunk_len);
+
+		dl_flag &= ~DL_BEGIN;
+
+		cumulative_len += chunk_len;
+		datalen -= chunk_len;
+	} while ((datalen > 0) && (err == 0));
+
+	if (err) {
+		brcmf_err("clmload (%d byte file) failed (%d); ",
+			  (u32)clm->size, err);
+		/* Retrieve clmload_status and print */
+		memset(buf, 0, BRCMF_DCMD_SMLEN);
+		err = brcmf_fil_iovar_data_get(ifp, "clmload_status", buf,
+					       BRCMF_DCMD_SMLEN);
+		if (err)
+			brcmf_err("get clmload_status failed (%d)\n", err);
+		else
+			brcmf_err("clmload_status=%d\n", *((int *)buf));
+		err = -EIO;
+	}
+
+	kfree(chunk_buf);
+done:
+	release_firmware(clm);
+	return err;
+}
+
 int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
 {
 	s8 eventmask[BRCMF_EVENTING_MASK_LEN];
 	u8 buf[BRCMF_DCMD_SMLEN];
 	struct brcmf_rev_info_le revinfo;
 	struct brcmf_rev_info *ri;
+	char *clmver;
 	char *ptr;
 	s32 err;
 
+	/* Do any CLM downloading */
+	err = brcmf_c_process_clm_blob(ifp);
+	if (err < 0) {
+		brcmf_err("download CLM blob file failed, %d\n", err);
+		goto done;
+	}
+
 	/* retreive mac address */
 	err = brcmf_fil_iovar_data_get(ifp, "cur_etheraddr", ifp->mac_addr,
 				       sizeof(ifp->mac_addr));
@@ -167,6 +324,24 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
 	ptr = strrchr(buf, ' ') + 1;
 	strlcpy(ifp->drvr->fwver, ptr, sizeof(ifp->drvr->fwver));
 
+	/* Query for 'clmver' to get CLM version info from firmware */
+	memset(buf, 0, sizeof(buf));
+	err = brcmf_fil_iovar_data_get(ifp, "clmver", buf, sizeof(buf));
+	if (err) {
+		brcmf_err("retrieving clmver failed, %d\n", err);
+		goto done;
+	} else {
+		clmver = (char *)buf;
+		/* Replace all newline/linefeed characters with space
+		 * character
+		 */
+		ptr = clmver;
+		while ((ptr = strchr(ptr, '\n')) != NULL)
+			*ptr = ' ';
+
+		brcmf_err("CLM version = %s\n", clmver);
+	}
+
 	/* set mpc */
 	err = brcmf_fil_iovar_int_set(ifp, "mpc", 1);
 	if (err) {
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index 5cc3a07dda9e..9763ff4f7ddc 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -71,6 +71,43 @@ struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx)
 	return ifp;
 }
 
+void brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
+{
+	s32 err;
+	u32 mode;
+
+	if (enable)
+		mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
+	else
+		mode = 0;
+
+	/* Try to set and enable ARP offload feature, this may fail, then it  */
+	/* is simply not supported and err 0 will be returned                 */
+	err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
+	if (err) {
+		brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
+			  mode, err);
+		err = 0;
+	} else {
+		err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
+		if (err) {
+			brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
+				  enable, err);
+			err = 0;
+		} else
+			brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
+				  enable, mode);
+	}
+
+	err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
+	if (err)
+		brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
+			  enable, err);
+	else
+		brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
+			  enable, mode);
+}
+
 static void _brcmf_set_multicast_list(struct work_struct *work)
 {
 	struct brcmf_if *ifp;
@@ -134,6 +171,8 @@ static void _brcmf_set_multicast_list(struct work_struct *work)
 	if (err < 0)
 		brcmf_err("Setting BRCMF_C_SET_PROMISC failed, %d\n",
 			  err);
+
+	brcmf_configure_arp_nd_offload(ifp, !cmd_value);
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
index a4dd313140f3..b9a96cbc70f0 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
@@ -204,6 +204,7 @@ int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp);
 char *brcmf_ifname(struct brcmf_if *ifp);
 struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx);
 int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
+void brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable);
 struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bsscfgidx, s32 ifidx,
 			      bool is_p2pdev, const char *name, u8 *mac_addr);
 void brcmf_remove_interface(struct brcmf_if *ifp, bool rtnl_locked);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
index ef72baf6dd96..e7eaa57d11d9 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
@@ -257,11 +257,6 @@ static void brcmf_fweh_event_worker(struct work_struct *work)
 		brcmf_dbg_hex_dump(BRCMF_EVENT_ON(), event->data,
 				   min_t(u32, emsg.datalen, 64),
 				   "event payload, len=%d\n", emsg.datalen);
-		if (emsg.datalen > event->datalen) {
-			brcmf_err("event invalid length header=%d, msg=%d\n",
-				  event->datalen, emsg.datalen);
-			goto event_free;
-		}
 
 		/* special handling of interface event */
 		if (event->code == BRCMF_E_IF) {
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
index e0d22fedb2b4..b99dc2b76046 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
@@ -155,6 +155,22 @@
 #define BRCMF_MFP_CAPABLE		1
 #define BRCMF_MFP_REQUIRED		2
 
+/* MAX_CHUNK_LEN is the amount of the clm file we send in each ioctl.
+ * It is relatively small because dongles (FW) have a small maximum size
+ * input payload restriction for ioctls.
+ */
+#define MAX_CHUNK_LEN			1400
+
+#define DLOAD_HANDLER_VER		1	/* Downloader version */
+#define DLOAD_FLAG_VER_MASK		0xf000	/* Downloader version mask */
+#define DLOAD_FLAG_VER_SHIFT		12	/* Downloader version shift */
+
+#define DL_CRC_NOT_INUSE		0x0001
+#define DL_BEGIN			0x0002
+#define DL_END				0x0004
+
+#define DL_TYPE_CLM			2
+
 /* join preference types for join_pref iovar */
 enum brcmf_join_pref_types {
 	BRCMF_JOIN_PREF_RSSI = 1,
@@ -932,4 +948,15 @@ struct brcmf_gscan_config {
 	struct brcmf_gscan_bucket_config bucket[1];
 };
 
+/**
+ * struct brcmf_dload_data_le - data passing to firmware for downloading
+ */
+struct brcmf_dload_data_le {
+	__le16 flag;
+	__le16 dload_type;
+	__le32 len;
+	__le32 crc;
+	u8 data[1];
+};
+
 #endif /* FWIL_TYPES_H_ */
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index 450f2216fac2..30f4b06ee60c 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -1851,7 +1851,6 @@ s32 brcmf_p2p_notify_rx_mgmt_p2p_probereq(struct brcmf_if *ifp,
 	struct afx_hdl *afx_hdl = &p2p->afx_hdl;
 	struct brcmf_cfg80211_vif *vif = ifp->vif;
 	struct brcmf_rx_mgmt_data *rxframe = (struct brcmf_rx_mgmt_data *)data;
-	u16 chanspec = be16_to_cpu(rxframe->chanspec);
 	struct brcmu_chan ch;
 	u8 *mgmt_frame;
 	u32 mgmt_frame_len;
@@ -1904,7 +1903,7 @@ s32 brcmf_p2p_notify_rx_mgmt_p2p_probereq(struct brcmf_if *ifp,
 	cfg80211_rx_mgmt(&vif->wdev, freq, 0, mgmt_frame, mgmt_frame_len, 0);
 
 	brcmf_dbg(INFO, "mgmt_frame_len (%d) , e->datalen (%d), chanspec (%04x), freq (%d)\n",
-		  mgmt_frame_len, e->datalen, chanspec, freq);
+		  mgmt_frame_len, e->datalen, ch.chspec, freq);
 
 	return 0;
 }
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
index e6e9b00b79d7..3c87157f5b85 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
@@ -1350,6 +1350,24 @@ static int brcmf_pcie_get_memdump(struct device *dev, void *data, size_t len)
 	return 0;
 }
 
+static int brcmf_pcie_get_fwname(struct device *dev, u32 chip, u32 chiprev,
+				 u8 *fw_name)
+{
+	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+	struct brcmf_pciedev *buspub = bus_if->bus_priv.pcie;
+	struct brcmf_pciedev_info *devinfo = buspub->devinfo;
+	int ret = 0;
+
+	if (devinfo->fw_name[0] != '\0')
+		strlcpy(fw_name, devinfo->fw_name, BRCMF_FW_NAME_LEN);
+	else
+		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
+						brcmf_pcie_fwnames,
+						ARRAY_SIZE(brcmf_pcie_fwnames),
+						fw_name, NULL);
+
+	return ret;
+}
 
 static const struct brcmf_bus_ops brcmf_pcie_bus_ops = {
 	.txdata = brcmf_pcie_tx,
@@ -1359,6 +1377,7 @@ static const struct brcmf_bus_ops brcmf_pcie_bus_ops = {
 	.wowl_config = brcmf_pcie_wowl_config,
 	.get_ramsize = brcmf_pcie_get_ramsize,
 	.get_memdump = brcmf_pcie_get_memdump,
+	.get_fwname = brcmf_pcie_get_fwname,
 };
 
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index eccd25febfe6..952d88347756 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -609,6 +609,7 @@ BRCMF_FW_NVRAM_DEF(4329, "brcmfmac4329-sdio.bin", "brcmfmac4329-sdio.txt");
 BRCMF_FW_NVRAM_DEF(4330, "brcmfmac4330-sdio.bin", "brcmfmac4330-sdio.txt");
 BRCMF_FW_NVRAM_DEF(4334, "brcmfmac4334-sdio.bin", "brcmfmac4334-sdio.txt");
 BRCMF_FW_NVRAM_DEF(43340, "brcmfmac43340-sdio.bin", "brcmfmac43340-sdio.txt");
+BRCMF_FW_NVRAM_DEF(43341, "brcmfmac43341-sdio.bin", "brcmfmac43341-sdio.txt");
 BRCMF_FW_NVRAM_DEF(4335, "brcmfmac4335-sdio.bin", "brcmfmac4335-sdio.txt");
 BRCMF_FW_NVRAM_DEF(43362, "brcmfmac43362-sdio.bin", "brcmfmac43362-sdio.txt");
 BRCMF_FW_NVRAM_DEF(4339, "brcmfmac4339-sdio.bin", "brcmfmac4339-sdio.txt");
@@ -629,7 +630,7 @@ static struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4330_CHIP_ID, 0xFFFFFFFF, 4330),
 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4334_CHIP_ID, 0xFFFFFFFF, 4334),
 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43340_CHIP_ID, 0xFFFFFFFF, 43340),
-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43341_CHIP_ID, 0xFFFFFFFF, 43340),
+	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43341_CHIP_ID, 0xFFFFFFFF, 43341),
 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, 4335),
 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, 43362),
 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, 4339),
@@ -3979,6 +3980,24 @@ brcmf_sdio_watchdog(unsigned long data)
 	}
 }
 
+static int brcmf_sdio_get_fwname(struct device *dev, u32 chip, u32 chiprev,
+				 u8 *fw_name)
+{
+	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+	int ret = 0;
+
+	if (sdiodev->fw_name[0] != '\0')
+		strlcpy(fw_name, sdiodev->fw_name, BRCMF_FW_NAME_LEN);
+	else
+		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
+						brcmf_sdio_fwnames,
+						ARRAY_SIZE(brcmf_sdio_fwnames),
+						fw_name, NULL);
+
+	return ret;
+}
+
 static const struct brcmf_bus_ops brcmf_sdio_bus_ops = {
 	.stop = brcmf_sdio_bus_stop,
 	.preinit = brcmf_sdio_bus_preinit,
@@ -3989,6 +4008,7 @@ static const struct brcmf_bus_ops brcmf_sdio_bus_ops = {
 	.wowl_config = brcmf_sdio_wowl_config,
 	.get_ramsize = brcmf_sdio_bus_get_ramsize,
 	.get_memdump = brcmf_sdio_bus_get_memdump,
+	.get_fwname = brcmf_sdio_get_fwname,
 };
 
 static void brcmf_sdio_firmware_callback(struct device *dev, int err,
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
index 11ffaa01599e..b27170c12482 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
@@ -1128,12 +1128,30 @@ static void brcmf_usb_wowl_config(struct device *dev, bool enabled)
 		device_set_wakeup_enable(devinfo->dev, false);
 }
 
+static int brcmf_usb_get_fwname(struct device *dev, u32 chip, u32 chiprev,
+				u8 *fw_name)
+{
+	struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
+	int ret = 0;
+
+	if (devinfo->fw_name[0] != '\0')
+		strlcpy(fw_name, devinfo->fw_name, BRCMF_FW_NAME_LEN);
+	else
+		ret = brcmf_fw_map_chip_to_name(chip, chiprev,
+						brcmf_usb_fwnames,
+						ARRAY_SIZE(brcmf_usb_fwnames),
+						fw_name, NULL);
+
+	return ret;
+}
+
 static const struct brcmf_bus_ops brcmf_usb_bus_ops = {
 	.txdata = brcmf_usb_tx,
 	.stop = brcmf_usb_down,
 	.txctl = brcmf_usb_tx_ctlpkt,
 	.rxctl = brcmf_usb_rx_ctlpkt,
 	.wowl_config = brcmf_usb_wowl_config,
+	.get_fwname = brcmf_usb_get_fwname,
 };
 
 static int brcmf_usb_bus_setup(struct brcmf_usbdev_info *devinfo)
diff --git a/drivers/net/wireless/realtek/Kconfig b/drivers/net/wireless/realtek/Kconfig
index 8a8ba2003964..7df19ad94856 100644
--- a/drivers/net/wireless/realtek/Kconfig
+++ b/drivers/net/wireless/realtek/Kconfig
@@ -13,6 +13,7 @@ if WLAN_VENDOR_REALTEK
 
 source "drivers/net/wireless/realtek/rtl818x/Kconfig"
 source "drivers/net/wireless/realtek/rtlwifi/Kconfig"
+source "drivers/net/wireless/realtek/rtl8192cu/Kconfig"
 source "drivers/net/wireless/realtek/rtl8xxxu/Kconfig"
 
 endif # WLAN_VENDOR_REALTEK
diff --git a/drivers/net/wireless/realtek/Makefile b/drivers/net/wireless/realtek/Makefile
index 9c78deb5eea9..e5407ed50833 100644
--- a/drivers/net/wireless/realtek/Makefile
+++ b/drivers/net/wireless/realtek/Makefile
@@ -5,5 +5,6 @@
 obj-$(CONFIG_RTL8180)		+= rtl818x/
 obj-$(CONFIG_RTL8187)		+= rtl818x/
 obj-$(CONFIG_RTLWIFI)		+= rtlwifi/
+obj-$(CONFIG_RTL8192CU)		+= rtl8192cu/
 obj-$(CONFIG_RTL8XXXU)		+= rtl8xxxu/
 
diff --git a/drivers/net/wireless/realtek/rtl8192cu/Kconfig b/drivers/net/wireless/realtek/rtl8192cu/Kconfig
new file mode 100644
index 000000000000..cd7830bb9d5d
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/Kconfig
@@ -0,0 +1,9 @@
+config RTL8192CU
+	tristate "Realtek 8192C USB WiFi"
+	depends on MAC80211 && USB
+	select CFG80211_WEXT
+	select WIRELESS_EXT
+	select WEXT_PRIV
+	---help---
+	  This option adds the Realtek RTL8192CU USB device such as Edimax EW-7811Un.
+
diff --git a/drivers/net/wireless/realtek/rtl8192cu/Makefile b/drivers/net/wireless/realtek/rtl8192cu/Makefile
new file mode 100644
index 000000000000..c7f358dd5513
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/Makefile
@@ -0,0 +1,629 @@
+EXTRA_CFLAGS += $(USER_EXTRA_CFLAGS)
+EXTRA_CFLAGS += -O1
+#EXTRA_CFLAGS += -O3
+EXTRA_CFLAGS += -Wall
+EXTRA_CFLAGS += -Wextra
+#EXTRA_CFLAGS += -Werror
+#EXTRA_CFLAGS += -pedantic
+#EXTRA_CFLAGS += -Wshadow -Wpointer-arith -Wcast-qual -Wstrict-prototypes -Wmissing-prototypes
+
+# The "$(call cc-option,-Wxxx)" macro only includes that option when it's
+# supported by the compiler used. It may only work on Debian systems.
+
+# Wdate-time was added in gcc-4.9
+EXTRA_CFLAGS += $(call cc-option,-Werror=date-time)
+# Wincompatible-pointer-types was added in gcc-5.0
+EXTRA_CFLAGS += $(call cc-option,-Werror=incompatible-pointer-types)
+
+EXTRA_CFLAGS += -Wno-unused-variable
+EXTRA_CFLAGS += -Wno-unused-value
+EXTRA_CFLAGS += -Wno-unused-label
+EXTRA_CFLAGS += -Wno-unused-parameter
+EXTRA_CFLAGS += -Wno-unused-function
+EXTRA_CFLAGS += -Wno-unused
+
+# Relax some warnings from '-Wextra' so we won't get flooded with warnings
+EXTRA_CFLAGS += -Wno-sign-compare
+EXTRA_CFLAGS += -Wno-missing-field-initializers
+
+#EXTRA_CFLAGS += -Wno-uninitialized
+
+EXTRA_CFLAGS += -I$(src)/include
+
+EXTRA_LDFLAGS += --strip-debug
+
+CONFIG_AUTOCFG_CP = n
+
+CONFIG_RTL8192C = y
+CONFIG_RTL8192D = n
+CONFIG_RTL8723A = n
+
+CONFIG_USB_HCI = y
+CONFIG_PCI_HCI = n
+CONFIG_SDIO_HCI = n
+
+CONFIG_MP_INCLUDED = n
+CONFIG_POWER_SAVING = y
+CONFIG_USB_AUTOSUSPEND = n
+CONFIG_HW_PWRP_DETECTION = n
+CONFIG_WIFI_TEST = n
+CONFIG_BT_COEXISTENCE = n
+CONFIG_RTL8192CU_REDEFINE_1X1 = n
+CONFIG_INTEL_WIDI = n
+CONFIG_WAKE_ON_WLAN = n
+
+CONFIG_PLATFORM_I386_PC = y
+CONFIG_PLATFORM_TI_AM3517 = n
+CONFIG_PLATFORM_ANDROID_X86 = n
+CONFIG_PLATFORM_JB_X86 = n
+CONFIG_PLATFORM_ARM_S3C2K4 = n
+CONFIG_PLATFORM_ARM_PXA2XX = n
+CONFIG_PLATFORM_ARM_S3C6K4 = n
+CONFIG_PLATFORM_MIPS_RMI = n
+CONFIG_PLATFORM_RTD2880B = n
+CONFIG_PLATFORM_MIPS_AR9132 = n
+CONFIG_PLATFORM_RTK_DMP = n
+CONFIG_PLATFORM_MIPS_PLM = n
+CONFIG_PLATFORM_MSTAR389 = n
+CONFIG_PLATFORM_MT53XX = n
+CONFIG_PLATFORM_ARM_MX51_241H = n
+CONFIG_PLATFORM_FS_MX61 = n
+CONFIG_PLATFORM_ACTIONS_ATJ227X = n
+CONFIG_PLATFORM_TEGRA3_CARDHU = n
+CONFIG_PLATFORM_TEGRA4_DALMORE = n
+CONFIG_PLATFORM_ARM_TCC8900 = n
+CONFIG_PLATFORM_ARM_TCC8920 = n
+CONFIG_PLATFORM_ARM_TCC8920_JB42 = n
+CONFIG_PLATFORM_ARM_RK2818 = n
+CONFIG_PLATFORM_ARM_TI_PANDA = n
+CONFIG_PLATFORM_MIPS_JZ4760 = n
+CONFIG_PLATFORM_DMP_PHILIPS = n
+CONFIG_PLATFORM_TI_DM365 = n
+CONFIG_PLATFORM_MN10300 = n
+CONFIG_PLATFORM_MSTAR_TITANIA12 = n
+CONFIG_PLATFORM_MSTAR_A3 = n
+CONFIG_PLATFORM_ARM_SUNxI = n
+CONFIG_PLATFORM_ARM_SUN6I = n
+
+CONFIG_DRVEXT_MODULE = n
+
+export TopDIR ?= $(shell pwd)
+
+
+ifeq ($(CONFIG_RTL8192C), y)
+
+RTL871X = rtl8192c
+
+ifeq ($(CONFIG_USB_HCI), y)
+MODULE_NAME = 8192cu
+FW_FILES := hal/$(RTL871X)/usb/Hal8192CUHWImg.o
+ifneq ($(CONFIG_WAKE_ON_WLAN), n)
+FW_FILES += hal/$(RTL871X)/usb/Hal8192CUHWImg_wowlan.o
+endif
+endif
+ifeq ($(CONFIG_PCI_HCI), y)
+MODULE_NAME = 8192ce
+FW_FILES := hal/$(RTL871X)/pci/Hal8192CEHWImg.o
+endif
+
+CHIP_FILES := \
+	hal/$(RTL871X)/$(RTL871X)_sreset.o \
+	hal/$(RTL871X)/$(RTL871X)_xmit.o
+CHIP_FILES += $(FW_FILES)
+endif
+
+ifeq ($(CONFIG_RTL8192D), y)
+
+RTL871X = rtl8192d
+
+ifeq ($(CONFIG_USB_HCI), y)
+MODULE_NAME = 8192du
+FW_FILES := hal/$(RTL871X)/usb/Hal8192DUHWImg.o
+ifneq ($(CONFIG_WAKE_ON_WLAN), n)
+FW_FILES += hal/$(RTL871X)/usb/Hal8192DUHWImg_wowlan.o
+endif
+endif
+ifeq ($(CONFIG_PCI_HCI), y)
+MODULE_NAME = 8192de
+FW_FILES := hal/$(RTL871X)/pci/Hal8192DEHWImg.o
+endif
+
+CHIP_FILES := \
+	hal/$(RTL871X)/$(RTL871X)_xmit.o
+CHIP_FILES += $(FW_FILES)
+endif
+
+ifeq ($(CONFIG_RTL8723A), y)
+
+RTL871X = rtl8723a
+
+ifeq ($(CONFIG_SDIO_HCI), y)
+MODULE_NAME = 8723as
+FW_FILES := hal/$(RTL871X)/sdio/Hal8723SHWImg.o
+endif
+
+ifeq ($(CONFIG_USB_HCI), y)
+MODULE_NAME = 8723au
+FW_FILES := hal/$(RTL871X)/usb/Hal8723UHWImg.o
+endif
+
+ifeq ($(CONFIG_PCI_HCI), y)
+MODULE_NAME = 8723ae
+FW_FILES := hal/$(RTL871X)/pci/Hal8723EHWImg.o
+endif
+
+PWRSEQ_FILES := hal/HalPwrSeqCmd.o \
+				hal/$(RTL871X)/Hal8723PwrSeq.o
+
+CHIP_FILES += $(FW_FILES) $(PWRSEQ_FILES)
+
+endif
+
+ifeq ($(CONFIG_SDIO_HCI), y)
+HCI_NAME = sdio
+endif
+
+ifeq ($(CONFIG_USB_HCI), y)
+HCI_NAME = usb
+endif
+
+ifeq ($(CONFIG_PCI_HCI), y)
+HCI_NAME = pci
+endif
+
+
+_OS_INTFS_FILES :=	os_dep/osdep_service.o \
+			os_dep/linux/os_intfs.o \
+			os_dep/linux/$(HCI_NAME)_intf.o \
+			os_dep/linux/$(HCI_NAME)_ops_linux.o \
+			os_dep/linux/ioctl_linux.o \
+			os_dep/linux/xmit_linux.o \
+			os_dep/linux/mlme_linux.o \
+			os_dep/linux/recv_linux.o \
+			os_dep/linux/ioctl_cfg80211.o \
+			os_dep/linux/rtw_android.o
+
+
+_HAL_INTFS_FILES :=	hal/hal_intf.o \
+			hal/hal_com.o \
+			hal/dm.o \
+			hal/$(RTL871X)/$(RTL871X)_hal_init.o \
+			hal/$(RTL871X)/$(RTL871X)_phycfg.o \
+			hal/$(RTL871X)/$(RTL871X)_rf6052.o \
+			hal/$(RTL871X)/$(RTL871X)_dm.o \
+			hal/$(RTL871X)/$(RTL871X)_rxdesc.o \
+			hal/$(RTL871X)/$(RTL871X)_cmd.o \
+			hal/$(RTL871X)/$(HCI_NAME)/$(HCI_NAME)_halinit.o \
+			hal/$(RTL871X)/$(HCI_NAME)/rtl$(MODULE_NAME)_led.o \
+			hal/$(RTL871X)/$(HCI_NAME)/rtl$(MODULE_NAME)_xmit.o \
+			hal/$(RTL871X)/$(HCI_NAME)/rtl$(MODULE_NAME)_recv.o
+
+ifeq ($(CONFIG_SDIO_HCI), y)
+_HAL_INTFS_FILES += hal/$(RTL871X)/$(HCI_NAME)/$(HCI_NAME)_ops.o
+else
+_HAL_INTFS_FILES += hal/$(RTL871X)/$(HCI_NAME)/$(HCI_NAME)_ops_linux.o
+endif
+
+ifeq ($(CONFIG_MP_INCLUDED), y)
+_HAL_INTFS_FILES += hal/$(RTL871X)/$(RTL871X)_mp.o
+endif
+
+_HAL_INTFS_FILES += $(CHIP_FILES)
+
+
+ifeq ($(CONFIG_AUTOCFG_CP), y)
+$(shell cp $(TopDIR)/autoconf_$(RTL871X)_$(HCI_NAME)_linux.h $(TopDIR)/include/autoconf.h)
+endif
+
+
+ifeq ($(CONFIG_USB_HCI), y)
+ifeq ($(CONFIG_USB_AUTOSUSPEND), y)
+EXTRA_CFLAGS += -DCONFIG_USB_AUTOSUSPEND
+endif
+endif
+
+ifeq ($(CONFIG_POWER_SAVING), y)
+EXTRA_CFLAGS += -DCONFIG_POWER_SAVING
+endif
+
+ifeq ($(CONFIG_HW_PWRP_DETECTION), y)
+EXTRA_CFLAGS += -DCONFIG_HW_PWRP_DETECTION
+endif
+
+ifeq ($(CONFIG_WIFI_TEST), y)
+EXTRA_CFLAGS += -DCONFIG_WIFI_TEST
+endif
+
+ifeq ($(CONFIG_BT_COEXISTENCE), y)
+EXTRA_CFLAGS += -DCONFIG_BT_COEXISTENCE
+endif
+
+ifeq ($(CONFIG_RTL8192CU_REDEFINE_1X1), y)
+EXTRA_CFLAGS += -DRTL8192C_RECONFIG_TO_1T1R
+endif
+
+ifeq ($(CONFIG_WAKE_ON_WLAN), y)
+EXTRA_CFLAGS += -DCONFIG_WAKE_ON_WLAN
+endif
+
+ifeq ($(CONFIG_INTEL_WIDI), y)
+EXTRA_CFLAGS += -DCONFIG_INTEL_WIDI
+endif
+
+ifeq ($(CONFIG_PLATFORM_I386_PC), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+SUBARCH := $(shell uname -m | sed -e s/i.86/i386/)
+ARCH ?= $(SUBARCH)
+CROSS_COMPILE ?=
+KVER  := $(shell uname -r)
+KSRC := /lib/modules/$(KVER)/build
+MODDESTDIR := /lib/modules/$(KVER)/kernel/drivers/net/wireless/
+INSTALL_PREFIX :=
+endif
+
+ifeq ($(CONFIG_PLATFORM_TI_AM3517), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_ANDROID -DCONFIG_PLATFORM_SHUTTLE
+CROSS_COMPILE := arm-eabi-
+KSRC := $(shell pwd)/../../../Android/kernel
+ARCH := arm
+endif
+
+ifeq ($(CONFIG_PLATFORM_MSTAR_TITANIA12), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_MSTAR -DCONFIG_PLATFORM_MSTAR_TITANIA12
+ARCH:=mips
+CROSS_COMPILE:= /usr/src/Mstar_kernel/mips-4.3/bin/mips-linux-gnu-
+KVER:= 2.6.28.9
+KSRC:= /usr/src/Mstar_kernel/2.6.28.9/
+endif
+
+ifeq ($(CONFIG_PLATFORM_MSTAR_A3), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_MSTAR -DCONFIG_PLATFORM_MSTAR_A3
+ARCH:=arm
+CROSS_COMPILE:= arm-none-linux-gnueabi-
+KVER:= 2.6.35.11
+KSRC:= /home/gary/PERFORCE/THEALE/RedLion/2.6.35.11/
+MODULE_NAME = wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_ANDROID_X86), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+SUBARCH := $(shell uname -m | sed -e s/i.86/i386/)
+ARCH := $(SUBARCH)
+CROSS_COMPILE := /media/DATA-2/android-x86/ics-x86_20120130/prebuilt/linux-x86/toolchain/i686-unknown-linux-gnu-4.2.1/bin/i686-unknown-linux-gnu-
+KSRC := /media/DATA-2/android-x86/ics-x86_20120130/out/target/product/generic_x86/obj/kernel
+MODULE_NAME :=wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_JB_X86), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+EXTRA_CFLAGS += -DCONFIG_CONCURRENT_MODE
+EXTRA_CFLAGS += -DCONFIG_IOCTL_CFG80211 -DRTW_USE_CFG80211_STA_EVENT
+EXTRA_CFLAGS += -DCONFIG_P2P_IPS
+SUBARCH := $(shell uname -m | sed -e s/i.86/i386/)
+ARCH := $(SUBARCH)
+CROSS_COMPILE := /home/android_sdk/android-x86_JB/prebuilts/gcc/linux-x86/x86/i686-linux-android-4.7/bin/i686-linux-android-
+KSRC := /home/android_sdk/android-x86_JB/out/target/product/x86/obj/kernel/
+MODULE_NAME :=wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_PXA2XX), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+ARCH := arm
+CROSS_COMPILE := arm-none-linux-gnueabi-
+KVER  := 2.6.34.1
+KSRC ?= /usr/src/linux-2.6.34.1
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_S3C2K4), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+ARCH := arm
+CROSS_COMPILE := arm-linux-
+KVER  := 2.6.24.7_$(ARCH)
+KSRC := /usr/src/kernels/linux-$(KVER)
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_S3C6K4), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+ARCH := arm
+CROSS_COMPILE := arm-none-linux-gnueabi-
+KVER  := 2.6.34.1
+KSRC ?= /usr/src/linux-2.6.34.1
+endif
+
+ifeq ($(CONFIG_PLATFORM_RTD2880B), y)
+EXTRA_CFLAGS += -DCONFIG_BIG_ENDIAN -DCONFIG_PLATFORM_RTD2880B
+ARCH:=
+CROSS_COMPILE:=
+KVER:=
+KSRC:=
+endif
+
+ifeq ($(CONFIG_PLATFORM_MIPS_RMI), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+ARCH:=mips
+CROSS_COMPILE:=mipsisa32r2-uclibc-
+KVER:=
+KSRC:= /root/work/kernel_realtek
+endif
+
+ifeq ($(CONFIG_PLATFORM_MIPS_PLM), y)
+EXTRA_CFLAGS += -DCONFIG_BIG_ENDIAN
+ARCH:=mips
+CROSS_COMPILE:=mipsisa32r2-uclibc-
+KVER:=
+KSRC:= /root/work/kernel_realtek
+endif
+
+ifeq ($(CONFIG_PLATFORM_MSTAR389), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_MSTAR389
+ARCH:=mips
+CROSS_COMPILE:= mips-linux-gnu-
+KVER:= 2.6.28.10
+KSRC:= /home/mstar/mstar_linux/2.6.28.9/
+endif
+
+ifeq ($(CONFIG_PLATFORM_MIPS_AR9132), y)
+EXTRA_CFLAGS += -DCONFIG_BIG_ENDIAN
+ARCH := mips
+CROSS_COMPILE := mips-openwrt-linux-
+KSRC := /home/alex/test_openwrt/tmp/linux-2.6.30.9
+endif
+
+ifeq ($(CONFIG_PLATFORM_DMP_PHILIPS), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DRTK_DMP_PLATFORM
+ARCH := mips
+#CROSS_COMPILE:=/usr/local/msdk-4.3.6-mips-EL-2.6.12.6-0.9.30.3/bin/mipsel-linux-
+CROSS_COMPILE:=/usr/local/toolchain_mipsel/bin/mipsel-linux-
+KSRC ?=/usr/local/Jupiter/linux-2.6.12
+endif
+
+ifeq ($(CONFIG_PLATFORM_RTK_DMP), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DRTK_DMP_PLATFORM
+ARCH:=mips
+CROSS_COMPILE:=mipsel-linux-
+KVER:=
+KSRC ?= /usr/src/DMP_Kernel/jupiter/linux-2.6.12
+endif
+
+ifeq ($(CONFIG_PLATFORM_MT53XX), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_MT53XX
+ARCH:= arm
+CROSS_COMPILE:= arm11_mtk_le-
+KVER:= 2.6.27
+KSRC?= /proj/mtk00802/BD_Compare/BDP/Dev/BDP_V301/BDP_Linux/linux-2.6.27
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_MX51_241H), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_WISTRON_PLATFORM
+ARCH := arm
+CROSS_COMPILE := /opt/freescale/usr/local/gcc-4.1.2-glibc-2.5-nptl-3/arm-none-linux-gnueabi/bin/arm-none-linux-gnueabi-
+KVER  := 2.6.31
+KSRC ?= /lib/modules/2.6.31-770-g0e46b52/source
+endif
+
+ifeq ($(CONFIG_PLATFORM_FS_MX61), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+ARCH := arm
+CROSS_COMPILE := /home/share/CusEnv/FreeScale/arm-eabi-4.4.3/bin/arm-eabi-
+KSRC ?= /home/share/CusEnv/FreeScale/FS_kernel_env
+endif
+
+
+
+ifeq ($(CONFIG_PLATFORM_ACTIONS_ATJ227X), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_ACTIONS_ATJ227X
+ARCH := mips
+CROSS_COMPILE := /home/cnsd4/project/actions/tools-2.6.27/bin/mipsel-linux-gnu-
+KVER  := 2.6.27
+KSRC := /home/cnsd4/project/actions/linux-2.6.27.28
+endif
+
+ifeq ($(CONFIG_PLATFORM_TI_DM365), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_TI_DM365
+ARCH := arm
+CROSS_COMPILE := /home/cnsd4/Appro/mv_pro_5.0/montavista/pro/devkit/arm/v5t_le/bin/arm_v5t_le-
+KVER  := 2.6.18
+KSRC := /home/cnsd4/Appro/mv_pro_5.0/montavista/pro/devkit/lsp/ti-davinci/linux-dm365
+endif
+
+ifeq ($(CONFIG_PLATFORM_TEGRA3_CARDHU), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+# default setting for Android 4.1, 4.2
+EXTRA_CFLAGS += -DRTW_ENABLE_WIFI_CONTROL_FUNC
+EXTRA_CFLAGS += -DCONFIG_CONCURRENT_MODE
+EXTRA_CFLAGS += -DCONFIG_IOCTL_CFG80211 -DRTW_USE_CFG80211_STA_EVENT
+EXTRA_CFLAGS += -DCONFIG_P2P_IPS
+ARCH := arm
+CROSS_COMPILE := /home/android_sdk/nvidia/tegra-16r3-partner-android-4.1_20120723/prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin/arm-eabi-
+KSRC := /home/android_sdk/nvidia/tegra-16r3-partner-android-4.1_20120723/out/target/product/cardhu/obj/KERNEL
+MODULE_NAME := wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_TEGRA4_DALMORE), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+# default setting for Android 4.1, 4.2
+EXTRA_CFLAGS += -DRTW_ENABLE_WIFI_CONTROL_FUNC
+EXTRA_CFLAGS += -DCONFIG_CONCURRENT_MODE
+EXTRA_CFLAGS += -DCONFIG_IOCTL_CFG80211 -DRTW_USE_CFG80211_STA_EVENT
+EXTRA_CFLAGS += -DCONFIG_P2P_IPS
+ARCH := arm
+CROSS_COMPILE := /home/android_sdk/nvidia/tegra-17r9-partner-android-4.2-dalmore_20130131/prebuilts/gcc/linux-x86/arm/arm-eabi-4.6/bin/arm-eabi-
+KSRC := /home/android_sdk/nvidia/tegra-17r9-partner-android-4.2-dalmore_20130131/out/target/product/dalmore/obj/KERNEL
+MODULE_NAME := wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_TCC8900), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+ARCH := arm
+CROSS_COMPILE := /home/android_sdk/Telechips/SDK_2304_20110613/prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin/arm-eabi-
+KSRC := /home/android_sdk/Telechips/SDK_2304_20110613/kernel
+MODULE_NAME := wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_TCC8920), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+ARCH := arm
+CROSS_COMPILE := /home/android_sdk/Telechips/v12.06_r1-tcc-android-4.0.4/prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin/arm-eabi-
+KSRC := /home/android_sdk/Telechips/v12.06_r1-tcc-android-4.0.4/kernel
+MODULE_NAME := wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_TCC8920_JB42), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+# default setting for Android 4.1, 4.2
+EXTRA_CFLAGS += -DCONFIG_CONCURRENT_MODE
+EXTRA_CFLAGS += -DCONFIG_IOCTL_CFG80211 -DRTW_USE_CFG80211_STA_EVENT
+EXTRA_CFLAGS += -DCONFIG_P2P_IPS
+ARCH := arm
+CROSS_COMPILE := /home/android_sdk/Telechips/v13.03_r1-tcc-android-4.2.2_ds_patched/prebuilts/gcc/linux-x86/arm/arm-eabi-4.6/bin/arm-eabi-
+KSRC := /home/android_sdk/Telechips/v13.03_r1-tcc-android-4.2.2_ds_patched/kernel
+MODULE_NAME := wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_RK2818), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_ANDROID -DCONFIG_PLATFORM_ROCKCHIPS -DCONFIG_MINIMAL_MEMORY_USAGE
+ARCH := arm
+CROSS_COMPILE := /usr/src/release_fae_version/toolchain/arm-eabi-4.4.0/bin/arm-eabi-
+KSRC := /usr/src/release_fae_version/kernel25_A7_281x
+MODULE_NAME := wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_TI_PANDA), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN #-DCONFIG_MINIMAL_MEMORY_USAGE
+ARCH := arm
+#CROSS_COMPILE := /media/DATA-1/aosp/ics-aosp_20111227/prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin/arm-eabi-
+#KSRC := /media/DATA-1/aosp/android-omap-panda-3.0_20120104
+CROSS_COMPILE := /media/DATA-1/android-4.0/prebuilt/linux-x86/toolchain/arm-eabi-4.4.3/bin/arm-eabi-
+KSRC := /media/DATA-1/android-4.0/panda_kernel/omap
+MODULE_NAME := wlan
+endif
+
+ifeq ($(CONFIG_PLATFORM_MIPS_JZ4760), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_MINIMAL_MEMORY_USAGE
+ARCH ?= mips
+CROSS_COMPILE ?= /mnt/sdb5/Ingenic/Umido/mips-4.3/bin/mips-linux-gnu-
+KSRC ?= /mnt/sdb5/Ingenic/Umido/kernel
+endif
+
+#Add setting for MN10300
+ifeq ($(CONFIG_PLATFORM_MN10300), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_MN10300
+ARCH := mn10300
+CROSS_COMPILE := mn10300-linux-
+KVER := 2.6.32.2
+KSRC := /home/winuser/work/Plat_sLD2T_V3010/usr/src/linux-2.6.32.2
+INSTALL_PREFIX :=
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_SUNxI), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN -DCONFIG_PLATFORM_ARM_SUNxI
+ARCH := arm
+CROSS_COMPILE := arm-none-linux-gnueabi-
+KVER  := 3.0.8
+#KSRC:= ../lichee/linux-3.0/
+endif
+
+ifeq ($(CONFIG_PLATFORM_ARM_SUN6I), y)
+EXTRA_CFLAGS += -DCONFIG_LITTLE_ENDIAN
+EXTRA_CFLAGS += -DCONFIG_PLATFORM_ARM_SUN6I
+EXTRA_CFLAGS += -DCONFIG_USE_USB_BUFFER_ALLOC_TX
+EXTRA_CFLAGS += -DCONFIG_TRAFFIC_PROTECT
+# default setting for Android 4.1, 4.2
+EXTRA_CFLAGS += -DCONFIG_CONCURRENT_MODE
+EXTRA_CFLAGS += -DCONFIG_IOCTL_CFG80211 -DRTW_USE_CFG80211_STA_EVENT
+EXTRA_CFLAGS += -DCONFIG_P2P_IPS
+ARCH := arm
+CROSS_COMPILE := arm-none-linux-gnueabi-
+KVER  := 3.3.0
+#KSRC:= ../lichee/linux-3.3/
+endif
+
+ifneq ($(USER_MODULE_NAME),)
+MODULE_NAME := $(USER_MODULE_NAME)
+endif
+
+ifeq ($(CONFIG_MP_INCLUDED), y)
+MODULE_NAME := $(MODULE_NAME)_mp
+EXTRA_CFLAGS += -DCONFIG_MP_INCLUDED
+endif
+
+
+ifneq ($(KERNELRELEASE),)
+
+
+rtk_core :=	core/rtw_cmd.o \
+		core/rtw_security.o \
+		core/rtw_debug.o \
+		core/rtw_io.o \
+		core/rtw_ioctl_query.o \
+		core/rtw_ioctl_set.o \
+		core/rtw_ieee80211.o \
+		core/rtw_mlme.o \
+		core/rtw_mlme_ext.o \
+		core/rtw_wlan_util.o \
+		core/rtw_pwrctrl.o \
+		core/rtw_rf.o \
+		core/rtw_recv.o \
+		core/rtw_sta_mgt.o \
+		core/rtw_ap.o \
+		core/rtw_xmit.o	\
+		core/rtw_p2p.o \
+		core/rtw_tdls.o \
+		core/rtw_br_ext.o \
+		core/rtw_iol.o \
+		core/rtw_sreset.o
+
+$(MODULE_NAME)-y += $(rtk_core)
+
+$(MODULE_NAME)-$(CONFIG_INTEL_WIDI) += core/rtw_intel_widi.o
+
+$(MODULE_NAME)-y += core/efuse/rtw_efuse.o
+
+$(MODULE_NAME)-y += $(_HAL_INTFS_FILES)
+
+$(MODULE_NAME)-y += $(_OS_INTFS_FILES)
+
+$(MODULE_NAME)-$(CONFIG_MP_INCLUDED) += core/rtw_mp.o \
+					core/rtw_mp_ioctl.o
+
+obj-$(CONFIG_RTL8192CU) := $(MODULE_NAME).o
+
+else
+
+export CONFIG_RTL8192CU = m
+
+all: modules
+
+modules:
+	$(MAKE) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) -C $(KSRC) M=$(shell pwd)  modules
+
+strip:
+	$(CROSS_COMPILE)strip $(MODULE_NAME).ko --strip-unneeded
+
+install:
+	install -p -m 644 $(MODULE_NAME).ko  $(MODDESTDIR)
+	/sbin/depmod -a ${KVER}
+
+uninstall:
+	rm -f $(MODDESTDIR)/$(MODULE_NAME).ko
+	/sbin/depmod -a ${KVER}
+
+
+config_r:
+	@echo "make config"
+	/bin/bash script/Configure script/config.in
+
+.PHONY: modules clean
+
+clean:
+	rm -fr *.mod.c *.mod *.o .*.cmd *.ko *~
+	rm .tmp_versions -fr ; rm Module.symvers -fr
+	rm -fr Module.markers ; rm -fr modules.order
+	cd core/efuse ; rm -fr *.mod.c *.mod *.o .*.cmd *.ko
+	cd core ; rm -fr *.mod.c *.mod *.o .*.cmd *.ko
+	cd hal/$(RTL871X)/$(HCI_NAME) ; rm -fr *.mod.c *.mod *.o .*.cmd *.ko
+	cd hal/$(RTL871X) ; rm -fr *.mod.c *.mod *.o .*.cmd *.ko
+	cd hal ; rm -fr *.mod.c *.mod *.o .*.cmd *.ko
+	cd os_dep/linux ; rm -fr *.mod.c *.mod *.o .*.cmd *.ko
+	cd os_dep ; rm -fr *.mod.c *.mod *.o .*.cmd *.ko
+endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/clean b/drivers/net/wireless/realtek/rtl8192cu/clean
new file mode 100755
index 000000000000..87664218b889
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/clean
@@ -0,0 +1,5 @@
+#!/bin/bash
+rmmod 8192cu
+rmmod 8192ce
+rmmod 8192du
+rmmod 8192de
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/efuse/rtw_efuse.c b/drivers/net/wireless/realtek/rtl8192cu/core/efuse/rtw_efuse.c
new file mode 100644
index 000000000000..c7f2b6705105
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/efuse/rtw_efuse.c
@@ -0,0 +1,1145 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_EFUSE_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#include <rtw_efuse.h>
+
+
+
+/*------------------------Define local variable------------------------------*/
+u8	fakeEfuseBank=0;
+u32	fakeEfuseUsedBytes=0;
+u8	fakeEfuseContent[EFUSE_MAX_HW_SIZE]={0};
+u8	fakeEfuseInitMap[EFUSE_MAX_MAP_LEN]={0};
+u8	fakeEfuseModifiedMap[EFUSE_MAX_MAP_LEN]={0};
+
+u32	BTEfuseUsedBytes=0;
+u8	BTEfuseContent[EFUSE_MAX_BT_BANK][EFUSE_MAX_HW_SIZE];
+u8	BTEfuseInitMap[EFUSE_BT_MAX_MAP_LEN]={0};
+u8	BTEfuseModifiedMap[EFUSE_BT_MAX_MAP_LEN]={0};
+
+u32	fakeBTEfuseUsedBytes=0;
+u8	fakeBTEfuseContent[EFUSE_MAX_BT_BANK][EFUSE_MAX_HW_SIZE];
+u8	fakeBTEfuseInitMap[EFUSE_BT_MAX_MAP_LEN]={0};
+u8	fakeBTEfuseModifiedMap[EFUSE_BT_MAX_MAP_LEN]={0};
+/*------------------------Define local variable------------------------------*/
+
+//------------------------------------------------------------------------------
+#define REG_EFUSE_CTRL		0x0030
+#define EFUSE_CTRL			REG_EFUSE_CTRL		// E-Fuse Control.
+//------------------------------------------------------------------------------
+
+BOOLEAN
+Efuse_Read1ByteFromFakeContent(
+	IN		PADAPTER	pAdapter,
+	IN		u16		Offset,
+	IN OUT	u8		*Value	);
+BOOLEAN
+Efuse_Read1ByteFromFakeContent(
+	IN		PADAPTER	pAdapter,
+	IN		u16		Offset,
+	IN OUT	u8		*Value	)
+{
+	if(Offset >= EFUSE_MAX_HW_SIZE)
+	{
+		return _FALSE;
+	}
+	//DbgPrint("Read fake content, offset = %d\n", Offset);
+	if(fakeEfuseBank == 0)
+		*Value = fakeEfuseContent[Offset];
+	else
+		*Value = fakeBTEfuseContent[fakeEfuseBank-1][Offset];
+	return _TRUE;
+}
+
+BOOLEAN
+Efuse_Write1ByteToFakeContent(
+	IN		PADAPTER	pAdapter,
+	IN		u16		Offset,
+	IN 		u8		Value	);
+BOOLEAN
+Efuse_Write1ByteToFakeContent(
+	IN		PADAPTER	pAdapter,
+	IN		u16		Offset,
+	IN 		u8		Value	)
+{
+	if(Offset >= EFUSE_MAX_HW_SIZE)
+	{
+		return _FALSE;
+	}
+	if(fakeEfuseBank == 0)
+		fakeEfuseContent[Offset] = Value;
+	else
+	{
+		fakeBTEfuseContent[fakeEfuseBank-1][Offset] = Value;
+	}
+	return _TRUE;
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	Efuse_PowerSwitch
+ *
+ * Overview:	When we want to enable write operation, we should change to
+ *				pwr on state. When we stop write, we should switch to 500k mode
+ *				and disable LDO 2.5V.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/17/2008 	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+VOID
+Efuse_PowerSwitch(
+	IN	PADAPTER	pAdapter,
+	IN	u8		bWrite,
+	IN	u8		PwrState)
+{
+	pAdapter->HalFunc.EfusePowerSwitch(pAdapter, bWrite, PwrState);
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	efuse_GetCurrentSize
+ *
+ * Overview:	Get current efuse size!!!
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/16/2008 	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+u16
+Efuse_GetCurrentSize(
+	IN PADAPTER		pAdapter,
+	IN u8			efuseType,
+	IN BOOLEAN		bPseudoTest)
+{
+	u16 ret=0;
+
+	ret = pAdapter->HalFunc.EfuseGetCurrentSize(pAdapter, efuseType, bPseudoTest);
+
+	return ret;
+}
+
+/*  11/16/2008 MH Add description. Get current efuse area enabled word!!. */
+u8
+Efuse_CalculateWordCnts(IN u8	word_en)
+{
+	u8 word_cnts = 0;
+	if(!(word_en & BIT(0)))	word_cnts++; // 0 : write enable
+	if(!(word_en & BIT(1)))	word_cnts++;
+	if(!(word_en & BIT(2)))	word_cnts++;
+	if(!(word_en & BIT(3)))	word_cnts++;
+	return word_cnts;
+}
+
+//
+//	Description:
+//		Execute E-Fuse read byte operation.
+//		Refered from SD1 Richard.
+//
+//	Assumption:
+//		1. Boot from E-Fuse and successfully auto-load.
+//		2. PASSIVE_LEVEL (USB interface)
+//
+//	Created by Roger, 2008.10.21.
+//
+VOID
+ReadEFuseByte(
+		PADAPTER	Adapter,
+		u16 			_offset,
+		u8 			*pbuf,
+		IN BOOLEAN	bPseudoTest)
+{
+	u32	value32;
+	u8	readbyte;
+	u16	retry;
+	//u32 start=rtw_get_current_time();
+
+	if(bPseudoTest)
+	{
+		Efuse_Read1ByteFromFakeContent(Adapter, _offset, pbuf);
+		return;
+	}
+
+	//Write Address
+	rtw_write8(Adapter, EFUSE_CTRL+1, (_offset & 0xff));
+	readbyte = rtw_read8(Adapter, EFUSE_CTRL+2);
+	rtw_write8(Adapter, EFUSE_CTRL+2, ((_offset >> 8) & 0x03) | (readbyte & 0xfc));
+
+	//Write bit 32 0
+	readbyte = rtw_read8(Adapter, EFUSE_CTRL+3);
+	rtw_write8(Adapter, EFUSE_CTRL+3, (readbyte & 0x7f));
+
+	//Check bit 32 read-ready
+	retry = 0;
+	value32 = rtw_read32(Adapter, EFUSE_CTRL);
+	//while(!(((value32 >> 24) & 0xff) & 0x80)  && (retry<10))
+	while(!(((value32 >> 24) & 0xff) & 0x80)  && (retry<10000))
+	{
+		value32 = rtw_read32(Adapter, EFUSE_CTRL);
+		retry++;
+	}
+
+	// 20100205 Joseph: Add delay suggested by SD1 Victor.
+	// This fix the problem that Efuse read error in high temperature condition.
+	// Designer says that there shall be some delay after ready bit is set, or the
+	// result will always stay on last data we read.
+	rtw_udelay_os(50);
+	value32 = rtw_read32(Adapter, EFUSE_CTRL);
+
+	*pbuf = (u8)(value32 & 0xff);
+	//DBG_871X("ReadEFuseByte _offset:%08u, in %d ms\n",_offset ,rtw_get_passing_time_ms(start));
+
+}
+
+
+//
+//	Description:
+//		1. Execute E-Fuse read byte operation according as map offset and
+//		    save to E-Fuse table.
+//		2. Refered from SD1 Richard.
+//
+//	Assumption:
+//		1. Boot from E-Fuse and successfully auto-load.
+//		2. PASSIVE_LEVEL (USB interface)
+//
+//	Created by Roger, 2008.10.21.
+//
+//	2008/12/12 MH 	1. Reorganize code flow and reserve bytes. and add description.
+//					2. Add efuse utilization collect.
+//	2008/12/22 MH	Read Efuse must check if we write section 1 data again!!! Sec1
+//					write addr must be after sec5.
+//
+
+VOID
+efuse_ReadEFuse(
+	PADAPTER	Adapter,
+	u8		efuseType,
+	u16		_offset,
+	u16 		_size_byte,
+	u8      	*pbuf,
+	IN	BOOLEAN	bPseudoTest
+	);
+VOID
+efuse_ReadEFuse(
+	PADAPTER	Adapter,
+	u8		efuseType,
+	u16		_offset,
+	u16 		_size_byte,
+	u8      	*pbuf,
+	IN	BOOLEAN	bPseudoTest
+	)
+{
+	Adapter->HalFunc.ReadEFuse(Adapter, efuseType, _offset, _size_byte, pbuf, bPseudoTest);
+}
+
+VOID
+EFUSE_GetEfuseDefinition(
+	IN		PADAPTER	pAdapter,
+	IN		u8		efuseType,
+	IN		u8		type,
+	OUT		void		*pOut,
+	IN		BOOLEAN		bPseudoTest
+	)
+{
+	pAdapter->HalFunc.EFUSEGetEfuseDefinition(pAdapter, efuseType, type, pOut, bPseudoTest);
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	EFUSE_Read1Byte
+ *
+ * Overview:	Copy from WMAC fot EFUSE read 1 byte.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 09/23/2008 	MHC		Copy from WMAC.
+ *
+ *---------------------------------------------------------------------------*/
+u8
+EFUSE_Read1Byte(
+	IN	PADAPTER	Adapter,
+	IN	u16		Address)
+{
+	u8	data;
+	u8	Bytetemp = {0x00};
+	u8	temp = {0x00};
+	u32	k=0;
+	u16	contentLen=0;
+
+	EFUSE_GetEfuseDefinition(Adapter, EFUSE_WIFI , TYPE_EFUSE_REAL_CONTENT_LEN, (PVOID)&contentLen, _FALSE);
+
+	if (Address < contentLen)	//E-fuse 512Byte
+	{
+		//Write E-fuse Register address bit0~7
+		temp = Address & 0xFF;
+		rtw_write8(Adapter, EFUSE_CTRL+1, temp);
+		Bytetemp = rtw_read8(Adapter, EFUSE_CTRL+2);
+		//Write E-fuse Register address bit8~9
+		temp = ((Address >> 8) & 0x03) | (Bytetemp & 0xFC);
+		rtw_write8(Adapter, EFUSE_CTRL+2, temp);
+
+		//Write 0x30[31]=0
+		Bytetemp = rtw_read8(Adapter, EFUSE_CTRL+3);
+		temp = Bytetemp & 0x7F;
+		rtw_write8(Adapter, EFUSE_CTRL+3, temp);
+
+		//Wait Write-ready (0x30[31]=1)
+		Bytetemp = rtw_read8(Adapter, EFUSE_CTRL+3);
+		while(!(Bytetemp & 0x80))
+		{
+			Bytetemp = rtw_read8(Adapter, EFUSE_CTRL+3);
+			k++;
+			if(k==1000)
+			{
+				k=0;
+				break;
+			}
+		}
+		data=rtw_read8(Adapter, EFUSE_CTRL);
+		return data;
+	}
+	else
+		return 0xFF;
+
+}/* EFUSE_Read1Byte */
+
+/*-----------------------------------------------------------------------------
+ * Function:	EFUSE_Write1Byte
+ *
+ * Overview:	Copy from WMAC fot EFUSE write 1 byte.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 09/23/2008 	MHC		Copy from WMAC.
+ *
+ *---------------------------------------------------------------------------*/
+
+void
+EFUSE_Write1Byte(
+	IN	PADAPTER	Adapter,
+	IN	u16		Address,
+	IN	u8		Value);
+void
+EFUSE_Write1Byte(
+	IN	PADAPTER	Adapter,
+	IN	u16		Address,
+	IN	u8		Value)
+{
+	u8	Bytetemp = {0x00};
+	u8	temp = {0x00};
+	u32	k=0;
+	u16	contentLen=0;
+
+	//RT_TRACE(COMP_EFUSE, DBG_LOUD, ("Addr=%x Data =%x\n", Address, Value));
+	EFUSE_GetEfuseDefinition(Adapter, EFUSE_WIFI , TYPE_EFUSE_REAL_CONTENT_LEN, (PVOID)&contentLen, _FALSE);
+
+	if( Address < contentLen)	//E-fuse 512Byte
+	{
+		rtw_write8(Adapter, EFUSE_CTRL, Value);
+
+		//Write E-fuse Register address bit0~7
+		temp = Address & 0xFF;
+		rtw_write8(Adapter, EFUSE_CTRL+1, temp);
+		Bytetemp = rtw_read8(Adapter, EFUSE_CTRL+2);
+
+		//Write E-fuse Register address bit8~9
+		temp = ((Address >> 8) & 0x03) | (Bytetemp & 0xFC);
+		rtw_write8(Adapter, EFUSE_CTRL+2, temp);
+
+		//Write 0x30[31]=1
+		Bytetemp = rtw_read8(Adapter, EFUSE_CTRL+3);
+		temp = Bytetemp | 0x80;
+		rtw_write8(Adapter, EFUSE_CTRL+3, temp);
+
+		//Wait Write-ready (0x30[31]=0)
+		Bytetemp = rtw_read8(Adapter, EFUSE_CTRL+3);
+		while(Bytetemp & 0x80)
+		{
+			Bytetemp = rtw_read8(Adapter, EFUSE_CTRL+3);
+			k++;
+			if(k==100)
+			{
+				k=0;
+				break;
+			}
+		}
+	}
+}/* EFUSE_Write1Byte */
+
+/*  11/16/2008 MH Read one byte from real Efuse. */
+u8
+efuse_OneByteRead(
+	IN	PADAPTER	pAdapter,
+	IN	u16			addr,
+	IN	u8			*data,
+	IN	BOOLEAN		bPseudoTest)
+{
+	u8	tmpidx = 0;
+	u8	bResult;
+
+	if(bPseudoTest)
+	{
+		bResult = Efuse_Read1ByteFromFakeContent(pAdapter, addr, data);
+		return bResult;
+	}
+	// -----------------e-fuse reg ctrl ---------------------------------
+	//address
+	rtw_write8(pAdapter, EFUSE_CTRL+1, (u8)(addr&0xff));
+	rtw_write8(pAdapter, EFUSE_CTRL+2, ((u8)((addr>>8) &0x03) ) |
+	(rtw_read8(pAdapter, EFUSE_CTRL+2)&0xFC ));
+
+	rtw_write8(pAdapter, EFUSE_CTRL+3,  0x72);//read cmd
+
+	while(!(0x80 &rtw_read8(pAdapter, EFUSE_CTRL+3))&&(tmpidx<100))
+	{
+		tmpidx++;
+	}
+	if(tmpidx<100)
+	{
+		*data=rtw_read8(pAdapter, EFUSE_CTRL);
+		bResult = _TRUE;
+	}
+	else
+	{
+		*data = 0xff;
+		bResult = _FALSE;
+	}
+	return bResult;
+}
+
+/*  11/16/2008 MH Write one byte to reald Efuse. */
+u8
+efuse_OneByteWrite(
+	IN	PADAPTER	pAdapter,
+	IN	u16			addr,
+	IN	u8			data,
+	IN	BOOLEAN		bPseudoTest)
+{
+	u8	tmpidx = 0;
+	u8	bResult;
+
+	if(bPseudoTest)
+	{
+		bResult = Efuse_Write1ByteToFakeContent(pAdapter, addr, data);
+		return bResult;
+	}
+	//RT_TRACE(COMP_EFUSE, DBG_LOUD, ("Addr = %x Data=%x\n", addr, data));
+
+	//return	0;
+
+	// -----------------e-fuse reg ctrl ---------------------------------
+	//address
+	rtw_write8(pAdapter, EFUSE_CTRL+1, (u8)(addr&0xff));
+	rtw_write8(pAdapter, EFUSE_CTRL+2,
+	(rtw_read8(pAdapter, EFUSE_CTRL+2)&0xFC )|(u8)((addr>>8)&0x03) );
+	rtw_write8(pAdapter, EFUSE_CTRL, data);//data
+
+	rtw_write8(pAdapter, EFUSE_CTRL+3, 0xF2);//write cmd
+
+	while((0x80 &  rtw_read8(pAdapter, EFUSE_CTRL+3)) && (tmpidx<100) ){
+		tmpidx++;
+	}
+
+	if(tmpidx<100)
+	{
+		bResult = _TRUE;
+	}
+	else
+	{
+		bResult = _FALSE;
+	}
+
+	return bResult;
+}
+
+int
+Efuse_PgPacketRead(	IN	PADAPTER	pAdapter,
+					IN	u8			offset,
+					IN	u8			*data,
+					IN	BOOLEAN		bPseudoTest)
+{
+	int	ret=0;
+
+	ret =  pAdapter->HalFunc.Efuse_PgPacketRead(pAdapter, offset, data, bPseudoTest);
+
+	return ret;
+}
+
+int
+Efuse_PgPacketWrite(IN	PADAPTER	pAdapter,
+					IN	u8 			offset,
+					IN	u8			word_en,
+					IN	u8			*data,
+					IN	BOOLEAN		bPseudoTest)
+{
+	int ret;
+
+	ret =  pAdapter->HalFunc.Efuse_PgPacketWrite(pAdapter, offset, word_en, data, bPseudoTest);
+
+	return ret;
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	efuse_WordEnableDataRead
+ *
+ * Overview:	Read allowed word in current efuse section data.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/16/2008 	MHC		Create Version 0.
+ * 11/21/2008 	MHC		Fix Write bug when we only enable late word.
+ *
+ *---------------------------------------------------------------------------*/
+void
+efuse_WordEnableDataRead(IN	u8	word_en,
+							IN	u8	*sourdata,
+							IN	u8	*targetdata)
+{
+	if (!(word_en&BIT(0)))
+	{
+		targetdata[0] = sourdata[0];
+		targetdata[1] = sourdata[1];
+	}
+	if (!(word_en&BIT(1)))
+	{
+		targetdata[2] = sourdata[2];
+		targetdata[3] = sourdata[3];
+	}
+	if (!(word_en&BIT(2)))
+	{
+		targetdata[4] = sourdata[4];
+		targetdata[5] = sourdata[5];
+	}
+	if (!(word_en&BIT(3)))
+	{
+		targetdata[6] = sourdata[6];
+		targetdata[7] = sourdata[7];
+	}
+}
+
+
+u8
+Efuse_WordEnableDataWrite(	IN	PADAPTER	pAdapter,
+							IN	u16		efuse_addr,
+							IN	u8		word_en,
+							IN	u8		*data,
+							IN	BOOLEAN		bPseudoTest)
+{
+	u8	ret=0;
+
+	ret =  pAdapter->HalFunc.Efuse_WordEnableDataWrite(pAdapter, efuse_addr, word_en, data, bPseudoTest);
+
+	return ret;
+}
+
+static u8 efuse_read8(PADAPTER padapter, u16 address, u8 *value)
+{
+	return efuse_OneByteRead(padapter,address, value, _FALSE);
+}
+
+static u8 efuse_write8(PADAPTER padapter, u16 address, u8 *value)
+{
+	return efuse_OneByteWrite(padapter,address, *value, _FALSE);
+}
+
+/*
+ * read/wirte raw efuse data
+ */
+u8 rtw_efuse_access(PADAPTER padapter, u8 bWrite, u16 start_addr, u16 cnts, u8 *data)
+{
+	int i = 0;
+	u16	real_content_len = 0, max_available_size = 0;
+	u8 res = _FAIL ;
+	u8 (*rw8)(PADAPTER, u16, u8*);
+
+	EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_EFUSE_REAL_CONTENT_LEN, (PVOID)&real_content_len, _FALSE);
+	EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+
+	if (start_addr > real_content_len)
+		return _FAIL;
+
+	if (_TRUE == bWrite) {
+		if ((start_addr + cnts) > max_available_size)
+			return _FAIL;
+		rw8 = &efuse_write8;
+	} else
+		rw8 = &efuse_read8;
+
+	Efuse_PowerSwitch(padapter, bWrite, _TRUE);
+
+	// e-fuse one byte read / write
+	for (i = 0; i < cnts; i++) {
+		if (start_addr >= real_content_len) {
+			res = _FAIL;
+			break;
+		}
+
+		res = rw8(padapter, start_addr++, data++);
+		if (_FAIL == res) break;
+	}
+
+	Efuse_PowerSwitch(padapter, bWrite, _FALSE);
+
+	return res;
+}
+//------------------------------------------------------------------------------
+u16 efuse_GetMaxSize(PADAPTER padapter)
+{
+	u16	max_size;
+	EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI , TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_size, _FALSE);
+	return max_size;
+}
+//------------------------------------------------------------------------------
+u8 efuse_GetCurrentSize(PADAPTER padapter, u16 *size)
+{
+	Efuse_PowerSwitch(padapter, _FALSE, _TRUE);
+	*size = Efuse_GetCurrentSize(padapter, EFUSE_WIFI, _FALSE);
+	Efuse_PowerSwitch(padapter, _FALSE, _FALSE);
+
+	return _SUCCESS;
+}
+//------------------------------------------------------------------------------
+u8 rtw_efuse_map_read(PADAPTER padapter, u16 addr, u16 cnts, u8 *data)
+{
+	u16	mapLen=0;
+
+	EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_EFUSE_MAP_LEN, (PVOID)&mapLen, _FALSE);
+
+	if ((addr + cnts) > mapLen)
+		return _FAIL;
+
+	Efuse_PowerSwitch(padapter, _FALSE, _TRUE);
+
+	efuse_ReadEFuse(padapter, EFUSE_WIFI, addr, cnts, data, _FALSE);
+
+	Efuse_PowerSwitch(padapter, _FALSE, _FALSE);
+
+	return _SUCCESS;
+}
+//------------------------------------------------------------------------------
+u8 rtw_efuse_map_write(PADAPTER padapter, u16 addr, u16 cnts, u8 *data)
+{
+	u8	offset, word_en;
+	u8	*map;
+	u8	newdata[PGPKT_DATA_SIZE];
+	s32	i, j, idx;
+	u8	ret = _SUCCESS;
+	u16	mapLen=0;
+
+	EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_EFUSE_MAP_LEN, (PVOID)&mapLen, _FALSE);
+
+	if ((addr + cnts) > mapLen)
+		return _FAIL;
+
+	map = rtw_zmalloc(mapLen);
+	if(map == NULL){
+		return _FAIL;
+	}
+
+	ret = rtw_efuse_map_read(padapter, 0, mapLen, map);
+	if (ret == _FAIL) goto exit;
+
+	Efuse_PowerSwitch(padapter, _TRUE, _TRUE);
+
+	offset = (addr >> 3);
+	word_en = 0xF;
+	_rtw_memset(newdata, 0xFF, PGPKT_DATA_SIZE);
+	i = addr & 0x7;	// index of one package
+	j = 0;		// index of new package
+	idx = 0;	// data index
+
+	if (i & 0x1) {
+		// odd start
+		if (data[idx] != map[addr+idx]) {
+			word_en &= ~BIT(i >> 1);
+			newdata[i-1] = map[addr+idx-1];
+			newdata[i] = data[idx];
+		}
+		i++;
+		idx++;
+	}
+	do {
+		for (; i < PGPKT_DATA_SIZE; i += 2)
+		{
+			if (cnts == idx) break;
+			if ((cnts - idx) == 1) {
+				if (data[idx] != map[addr+idx]) {
+					word_en &= ~BIT(i >> 1);
+					newdata[i] = data[idx];
+					newdata[i+1] = map[addr+idx+1];
+				}
+				idx++;
+				break;
+			} else {
+				if ((data[idx] != map[addr+idx]) ||
+				    (data[idx+1] != map[addr+idx+1]))
+				{
+					word_en &= ~BIT(i >> 1);
+					newdata[i] = data[idx];
+					newdata[i+1] = data[idx + 1];
+				}
+				idx += 2;
+			}
+			if (idx == cnts) break;
+		}
+
+		if (word_en != 0xF) {
+			ret = Efuse_PgPacketWrite(padapter, offset, word_en, newdata, _FALSE);
+			DBG_871X("offset=%x \n",offset);
+			DBG_871X("word_en=%x \n",word_en);
+
+			for(i=0;i<PGPKT_DATA_SIZE;i++)
+			{
+				DBG_871X("data=%x \t",newdata[i]);
+			}
+			if (ret == _FAIL) break;
+		}
+
+		if (idx == cnts) break;
+
+		offset++;
+		i = 0;
+		j = 0;
+		word_en = 0xF;
+		_rtw_memset(newdata, 0xFF, PGPKT_DATA_SIZE);
+	} while (1);
+
+	Efuse_PowerSwitch(padapter, _TRUE, _FALSE);
+
+exit:
+
+	rtw_mfree(map, mapLen);
+
+	return ret;
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	Efuse_ReadAllMap
+ *
+ * Overview:	Read All Efuse content
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/11/2008 	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+VOID
+Efuse_ReadAllMap(
+	IN		PADAPTER	pAdapter,
+	IN		u8		efuseType,
+	IN OUT	u8		*Efuse,
+	IN		BOOLEAN		bPseudoTest);
+VOID
+Efuse_ReadAllMap(
+	IN		PADAPTER	pAdapter,
+	IN		u8		efuseType,
+	IN OUT	u8		*Efuse,
+	IN		BOOLEAN		bPseudoTest)
+{
+	u16	mapLen=0;
+
+	Efuse_PowerSwitch(pAdapter,_FALSE, _TRUE);
+
+	EFUSE_GetEfuseDefinition(pAdapter, efuseType, TYPE_EFUSE_MAP_LEN, (PVOID)&mapLen, bPseudoTest);
+
+	efuse_ReadEFuse(pAdapter, efuseType, 0, mapLen, Efuse, bPseudoTest);
+
+	Efuse_PowerSwitch(pAdapter,_FALSE, _FALSE);
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	efuse_ShadowRead1Byte
+ *			efuse_ShadowRead2Byte
+ *			efuse_ShadowRead4Byte
+ *
+ * Overview:	Read from efuse init map by one/two/four bytes !!!!!
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/12/2008 	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+static VOID
+efuse_ShadowRead1Byte(
+	IN	PADAPTER	pAdapter,
+	IN	u16		Offset,
+	IN OUT	u8		*Value)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(pAdapter);
+
+	*Value = pEEPROM->efuse_eeprom_data[Offset];
+
+}	// EFUSE_ShadowRead1Byte
+
+//---------------Read Two Bytes
+static VOID
+efuse_ShadowRead2Byte(
+	IN	PADAPTER	pAdapter,
+	IN	u16		Offset,
+	IN OUT	u16		*Value)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(pAdapter);
+
+	*Value = pEEPROM->efuse_eeprom_data[Offset];
+	*Value |= pEEPROM->efuse_eeprom_data[Offset+1]<<8;
+
+}	// EFUSE_ShadowRead2Byte
+
+//---------------Read Four Bytes
+static VOID
+efuse_ShadowRead4Byte(
+	IN	PADAPTER	pAdapter,
+	IN	u16		Offset,
+	IN OUT	u32		*Value)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(pAdapter);
+
+	*Value = pEEPROM->efuse_eeprom_data[Offset];
+	*Value |= pEEPROM->efuse_eeprom_data[Offset+1]<<8;
+	*Value |= pEEPROM->efuse_eeprom_data[Offset+2]<<16;
+	*Value |= pEEPROM->efuse_eeprom_data[Offset+3]<<24;
+
+}	// efuse_ShadowRead4Byte
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	efuse_ShadowWrite1Byte
+ *			efuse_ShadowWrite2Byte
+ *			efuse_ShadowWrite4Byte
+ *
+ * Overview:	Write efuse modify map by one/two/four byte.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/12/2008 	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+#ifdef PLATFORM
+static VOID
+efuse_ShadowWrite1Byte(
+	IN	PADAPTER	pAdapter,
+	IN	u16		Offset,
+	IN 	u8		Value);
+#endif //PLATFORM
+static VOID
+efuse_ShadowWrite1Byte(
+	IN	PADAPTER	pAdapter,
+	IN	u16		Offset,
+	IN 	u8		Value)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(pAdapter);
+
+	pEEPROM->efuse_eeprom_data[Offset] = Value;
+
+}	// efuse_ShadowWrite1Byte
+
+//---------------Write Two Bytes
+static VOID
+efuse_ShadowWrite2Byte(
+	IN	PADAPTER	pAdapter,
+	IN	u16		Offset,
+	IN 	u16		Value)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(pAdapter);
+
+	pEEPROM->efuse_eeprom_data[Offset] = Value&0x00FF;
+	pEEPROM->efuse_eeprom_data[Offset+1] = Value>>8;
+
+}	// efuse_ShadowWrite1Byte
+
+//---------------Write Four Bytes
+static VOID
+efuse_ShadowWrite4Byte(
+	IN	PADAPTER	pAdapter,
+	IN	u16		Offset,
+	IN	u32		Value)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(pAdapter);
+
+	pEEPROM->efuse_eeprom_data[Offset] = (u8)(Value&0x000000FF);
+	pEEPROM->efuse_eeprom_data[Offset+1] = (u8)((Value>>8)&0x0000FF);
+	pEEPROM->efuse_eeprom_data[Offset+2] = (u8)((Value>>16)&0x00FF);
+	pEEPROM->efuse_eeprom_data[Offset+3] = (u8)((Value>>24)&0xFF);
+
+}	// efuse_ShadowWrite1Byte
+
+/*-----------------------------------------------------------------------------
+ * Function:	EFUSE_ShadowMapUpdate
+ *
+ * Overview:	Transfer current EFUSE content to shadow init and modify map.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/13/2008 	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+void EFUSE_ShadowMapUpdate(
+	IN PADAPTER	pAdapter,
+	IN u8		efuseType,
+	IN BOOLEAN	bPseudoTest)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(pAdapter);
+	u16	mapLen=0;
+
+	EFUSE_GetEfuseDefinition(pAdapter, efuseType, TYPE_EFUSE_MAP_LEN, (PVOID)&mapLen, bPseudoTest);
+
+	if (pEEPROM->bautoload_fail_flag == _TRUE)
+	{
+		_rtw_memset(pEEPROM->efuse_eeprom_data, 0xFF, mapLen);
+	}
+	else
+	{
+		#ifdef CONFIG_ADAPTOR_INFO_CACHING_FILE
+		if(_SUCCESS != retriveAdaptorInfoFile(pAdapter->registrypriv.adaptor_info_caching_file_path, pEEPROM)) {
+		#endif
+
+		Efuse_ReadAllMap(pAdapter, efuseType, pEEPROM->efuse_eeprom_data, bPseudoTest);
+
+		#ifdef CONFIG_ADAPTOR_INFO_CACHING_FILE
+			storeAdaptorInfoFile(pAdapter->registrypriv.adaptor_info_caching_file_path, pEEPROM);
+		}
+		#endif
+	}
+
+	//PlatformMoveMemory((PVOID)&pHalData->EfuseMap[EFUSE_MODIFY_MAP][0],
+	//(PVOID)&pHalData->EfuseMap[EFUSE_INIT_MAP][0], mapLen);
+}// EFUSE_ShadowMapUpdate
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	EFUSE_ShadowRead
+ *
+ * Overview:	Read from efuse init map !!!!!
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/12/2008 	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+void
+EFUSE_ShadowRead(
+	IN		PADAPTER	pAdapter,
+	IN		u8		Type,
+	IN		u16		Offset,
+	IN OUT	u32		*Value	)
+{
+	if (Type == 1)
+		efuse_ShadowRead1Byte(pAdapter, Offset, (u8 *)Value);
+	else if (Type == 2)
+		efuse_ShadowRead2Byte(pAdapter, Offset, (u16 *)Value);
+	else if (Type == 4)
+		efuse_ShadowRead4Byte(pAdapter, Offset, (u32 *)Value);
+
+}	// EFUSE_ShadowRead
+
+/*-----------------------------------------------------------------------------
+ * Function:	EFUSE_ShadowWrite
+ *
+ * Overview:	Write efuse modify map for later update operation to use!!!!!
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/12/2008 	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+VOID
+EFUSE_ShadowWrite(
+	IN	PADAPTER	pAdapter,
+	IN	u8		Type,
+	IN	u16		Offset,
+	IN OUT	u32		Value);
+VOID
+EFUSE_ShadowWrite(
+	IN	PADAPTER	pAdapter,
+	IN	u8		Type,
+	IN	u16		Offset,
+	IN OUT	u32		Value)
+{
+#if (MP_DRIVER == 0)
+	return;
+#endif
+
+	if (Type == 1)
+		efuse_ShadowWrite1Byte(pAdapter, Offset, (u8)Value);
+	else if (Type == 2)
+		efuse_ShadowWrite2Byte(pAdapter, Offset, (u16)Value);
+	else if (Type == 4)
+		efuse_ShadowWrite4Byte(pAdapter, Offset, (u32)Value);
+
+}	// EFUSE_ShadowWrite
+
+VOID
+Efuse_InitSomeVar(
+	IN		PADAPTER	pAdapter
+	);
+VOID
+Efuse_InitSomeVar(
+	IN		PADAPTER	pAdapter
+	)
+{
+	u8 i;
+
+	_rtw_memset((PVOID)&fakeEfuseContent[0], 0xff, EFUSE_MAX_HW_SIZE);
+	_rtw_memset((PVOID)&fakeEfuseInitMap[0], 0xff, EFUSE_MAX_MAP_LEN);
+	_rtw_memset((PVOID)&fakeEfuseModifiedMap[0], 0xff, EFUSE_MAX_MAP_LEN);
+
+	for(i=0; i<EFUSE_MAX_BT_BANK; i++)
+	{
+		_rtw_memset((PVOID)&BTEfuseContent[i][0], EFUSE_MAX_HW_SIZE, 0xff);
+	}
+	_rtw_memset((PVOID)&BTEfuseInitMap[0], 0xff, EFUSE_BT_MAX_MAP_LEN);
+	_rtw_memset((PVOID)&BTEfuseModifiedMap[0], 0xff, EFUSE_BT_MAX_MAP_LEN);
+
+	for(i=0; i<EFUSE_MAX_BT_BANK; i++)
+	{
+		_rtw_memset((PVOID)&fakeBTEfuseContent[i][0], 0xff, EFUSE_MAX_HW_SIZE);
+	}
+	_rtw_memset((PVOID)&fakeBTEfuseInitMap[0], 0xff, EFUSE_BT_MAX_MAP_LEN);
+	_rtw_memset((PVOID)&fakeBTEfuseModifiedMap[0], 0xff, EFUSE_BT_MAX_MAP_LEN);
+}
+
+#ifdef PLATFORM_LINUX
+#ifdef CONFIG_ADAPTOR_INFO_CACHING_FILE
+//#include <rtw_eeprom.h>
+
+ int isAdaptorInfoFileValid(void)
+{
+	return _TRUE;
+}
+
+int storeAdaptorInfoFile(char *path, struct eeprom_priv * eeprom_priv)
+{
+	int ret =_SUCCESS;
+
+	if(path && eeprom_priv) {
+		ret = rtw_store_to_file(path, eeprom_priv->efuse_eeprom_data, EEPROM_MAX_SIZE);
+		if(ret == EEPROM_MAX_SIZE)
+			ret = _SUCCESS;
+		else
+			ret = _FAIL;
+	} else {
+		DBG_871X("%s NULL pointer\n",__FUNCTION__);
+		ret =  _FAIL;
+	}
+	return ret;
+}
+
+int retriveAdaptorInfoFile(char *path, struct eeprom_priv * eeprom_priv)
+{
+	int ret = _SUCCESS;
+	mm_segment_t oldfs;
+	struct file *fp;
+
+	if(path && eeprom_priv) {
+
+		ret = rtw_retrive_from_file(path, eeprom_priv->efuse_eeprom_data, EEPROM_MAX_SIZE);
+
+		if(ret == EEPROM_MAX_SIZE)
+			ret = _SUCCESS;
+		else
+			ret = _FAIL;
+
+		#if 0
+		if(isAdaptorInfoFileValid()) {
+			return 0;
+		} else {
+			return _FAIL;
+		}
+		#endif
+
+	} else {
+		DBG_871X("%s NULL pointer\n",__FUNCTION__);
+		ret = _FAIL;
+	}
+	return ret;
+}
+#endif //CONFIG_ADAPTOR_INFO_CACHING_FILE
+#endif //PLATFORM_LINUX
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ap.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ap.c
new file mode 100644
index 000000000000..e2403d2bc325
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ap.c
@@ -0,0 +1,2942 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_AP_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <wifi.h>
+
+
+#ifdef CONFIG_AP_MODE
+
+extern unsigned char	RTW_WPA_OUI[];
+extern unsigned char 	WMM_OUI[];
+extern unsigned char	WPS_OUI[];
+extern unsigned char	P2P_OUI[];
+extern unsigned char	WFD_OUI[];
+
+void init_mlme_ap_info(_adapter *padapter)
+{
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
+
+
+	_rtw_spinlock_init(&pmlmepriv->bcn_update_lock);
+
+	//for ACL
+	_rtw_init_queue(&pacl_list->acl_node_q);
+
+	//pmlmeext->bstart_bss = _FALSE;
+
+	start_ap_mode(padapter);
+}
+
+void free_mlme_ap_info(_adapter *padapter)
+{
+	_irqL irqL;
+	struct sta_info *psta=NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	//stop_ap_mode(padapter);
+
+	pmlmepriv->update_bcn = _FALSE;
+	pmlmeext->bstart_bss = _FALSE;
+
+	rtw_sta_flush(padapter);
+
+	pmlmeinfo->state = _HW_STATE_NOLINK_;
+
+	//free_assoc_sta_resources
+	rtw_free_all_stainfo(padapter);
+
+	//free bc/mc sta_info
+	psta = rtw_get_bcmc_stainfo(padapter);
+	_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+	rtw_free_stainfo(padapter, psta);
+	_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+
+
+	_rtw_spinlock_free(&pmlmepriv->bcn_update_lock);
+
+}
+
+static void update_BCNTIM(_adapter *padapter)
+{
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX *pnetwork_mlmeext = &(pmlmeinfo->network);
+	unsigned char *pie = pnetwork_mlmeext->IEs;
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	//update TIM IE
+	//if(pstapriv->tim_bitmap)
+	if(_TRUE)
+	{
+		u8 *p, *dst_ie, *premainder_ie=NULL, *pbackup_remainder_ie=NULL;
+		u16 tim_bitmap_le;
+		uint offset, tmp_len, tim_ielen, tim_ie_offset, remainder_ielen;
+
+		tim_bitmap_le = cpu_to_le16(pstapriv->tim_bitmap);
+
+		p = rtw_get_ie(pie + _FIXED_IE_LENGTH_, _TIM_IE_, &tim_ielen, pnetwork_mlmeext->IELength - _FIXED_IE_LENGTH_);
+		if (p != NULL && tim_ielen>0)
+		{
+			tim_ielen += 2;
+
+			premainder_ie = p+tim_ielen;
+
+			tim_ie_offset = (sint)(p -pie);
+
+			remainder_ielen = pnetwork_mlmeext->IELength - tim_ie_offset - tim_ielen;
+
+			//append TIM IE from dst_ie offset
+			dst_ie = p;
+		}
+		else
+		{
+			tim_ielen = 0;
+
+			//calucate head_len
+			offset = _FIXED_IE_LENGTH_;
+
+			/* get ssid_ie len */
+			p = rtw_get_ie(pie + _BEACON_IE_OFFSET_, _SSID_IE_, &tmp_len, (pnetwork_mlmeext->IELength - _BEACON_IE_OFFSET_));
+			if (p !=  NULL)
+				offset += tmp_len+2;
+
+			// get supported rates len
+			p = rtw_get_ie(pie + _BEACON_IE_OFFSET_, _SUPPORTEDRATES_IE_, &tmp_len, (pnetwork_mlmeext->IELength - _BEACON_IE_OFFSET_));
+			if (p !=  NULL)
+			{
+				offset += tmp_len+2;
+			}
+
+			//DS Parameter Set IE, len=3
+			offset += 3;
+
+			premainder_ie = pie + offset;
+
+			remainder_ielen = pnetwork_mlmeext->IELength - offset - tim_ielen;
+
+			//append TIM IE from offset
+			dst_ie = pie + offset;
+
+		}
+
+
+		if(remainder_ielen>0)
+		{
+			pbackup_remainder_ie = rtw_malloc(remainder_ielen);
+			if(pbackup_remainder_ie && premainder_ie)
+				_rtw_memcpy(pbackup_remainder_ie, premainder_ie, remainder_ielen);
+		}
+
+		*dst_ie++=_TIM_IE_;
+
+		if((pstapriv->tim_bitmap&0xff00) && (pstapriv->tim_bitmap&0x00fc))
+			tim_ielen = 5;
+		else
+			tim_ielen = 4;
+
+		*dst_ie++= tim_ielen;
+
+		*dst_ie++=0;//DTIM count
+		*dst_ie++=1;//DTIM peroid
+
+		if(pstapriv->tim_bitmap&BIT(0))//for bc/mc frames
+			*dst_ie++ = BIT(0);//bitmap ctrl
+		else
+			*dst_ie++ = 0;
+
+		if(tim_ielen==4)
+		{
+			*dst_ie++ = *(u8*)&tim_bitmap_le;
+		}
+		else if(tim_ielen==5)
+		{
+			_rtw_memcpy(dst_ie, &tim_bitmap_le, 2);
+			dst_ie+=2;
+		}
+
+		//copy remainder IE
+		if(pbackup_remainder_ie)
+		{
+			_rtw_memcpy(dst_ie, pbackup_remainder_ie, remainder_ielen);
+
+			rtw_mfree(pbackup_remainder_ie, remainder_ielen);
+		}
+
+		offset =  (uint)(dst_ie - pie);
+		pnetwork_mlmeext->IELength = offset + remainder_ielen;
+
+	}
+
+#ifndef CONFIG_INTERRUPT_BASED_TXBCN
+#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI) || defined(CONFIG_GSPI_HCI)
+	set_tx_beacon_cmd(padapter);
+#endif
+#endif //!CONFIG_INTERRUPT_BASED_TXBCN
+
+
+}
+
+void rtw_add_bcn_ie(_adapter *padapter, WLAN_BSSID_EX *pnetwork, u8 index, u8 *data, u8 len)
+{
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8	bmatch = _FALSE;
+	u8	*pie = pnetwork->IEs;
+	u8	*p=NULL, *dst_ie=NULL, *premainder_ie=NULL, *pbackup_remainder_ie=NULL;
+	u32	i, offset, ielen, ie_offset, remainder_ielen = 0;
+
+	for (i = sizeof(NDIS_802_11_FIXED_IEs); i < pnetwork->IELength;)
+	{
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(pnetwork->IEs + i);
+
+		if (pIE->ElementID > index)
+		{
+			break;
+		}
+		else if(pIE->ElementID == index) // already exist the same IE
+		{
+			p = (u8 *)pIE;
+			ielen = pIE->Length;
+			bmatch = _TRUE;
+			break;
+		}
+
+		p = (u8 *)pIE;
+		ielen = pIE->Length;
+		i += (pIE->Length + 2);
+	}
+
+	if (p != NULL && ielen>0)
+	{
+		ielen += 2;
+
+		premainder_ie = p+ielen;
+
+		ie_offset = (sint)(p -pie);
+
+		remainder_ielen = pnetwork->IELength - ie_offset - ielen;
+
+		if(bmatch)
+			dst_ie = p;
+		else
+			dst_ie = (p+ielen);
+	}
+
+	if(dst_ie == NULL)
+		return;
+
+	if(remainder_ielen>0)
+	{
+		pbackup_remainder_ie = rtw_malloc(remainder_ielen);
+		if(pbackup_remainder_ie && premainder_ie)
+			_rtw_memcpy(pbackup_remainder_ie, premainder_ie, remainder_ielen);
+	}
+
+	*dst_ie++=index;
+	*dst_ie++=len;
+
+	_rtw_memcpy(dst_ie, data, len);
+	dst_ie+=len;
+
+	//copy remainder IE
+	if(pbackup_remainder_ie)
+	{
+		_rtw_memcpy(dst_ie, pbackup_remainder_ie, remainder_ielen);
+
+		rtw_mfree(pbackup_remainder_ie, remainder_ielen);
+	}
+
+	offset =  (uint)(dst_ie - pie);
+	pnetwork->IELength = offset + remainder_ielen;
+}
+
+void rtw_remove_bcn_ie(_adapter *padapter, WLAN_BSSID_EX *pnetwork, u8 index)
+{
+	u8 *p, *dst_ie, *premainder_ie=NULL, *pbackup_remainder_ie=NULL;
+	uint offset, ielen, ie_offset, remainder_ielen = 0;
+	u8	*pie = pnetwork->IEs;
+
+	p = rtw_get_ie(pie + _FIXED_IE_LENGTH_, index, &ielen, pnetwork->IELength - _FIXED_IE_LENGTH_);
+	if (p != NULL && ielen>0)
+	{
+		ielen += 2;
+
+		premainder_ie = p+ielen;
+
+		ie_offset = (sint)(p -pie);
+
+		remainder_ielen = pnetwork->IELength - ie_offset - ielen;
+
+		dst_ie = p;
+	}
+	else {
+		return;
+	}
+
+	if(remainder_ielen>0)
+	{
+		pbackup_remainder_ie = rtw_malloc(remainder_ielen);
+		if(pbackup_remainder_ie && premainder_ie)
+			_rtw_memcpy(pbackup_remainder_ie, premainder_ie, remainder_ielen);
+	}
+
+	//copy remainder IE
+	if(pbackup_remainder_ie)
+	{
+		_rtw_memcpy(dst_ie, pbackup_remainder_ie, remainder_ielen);
+
+		rtw_mfree(pbackup_remainder_ie, remainder_ielen);
+	}
+
+	offset =  (uint)(dst_ie - pie);
+	pnetwork->IELength = offset + remainder_ielen;
+}
+
+
+u8 chk_sta_is_alive(struct sta_info *psta);
+u8 chk_sta_is_alive(struct sta_info *psta)
+{
+	u8 ret = _FALSE;
+	#ifdef DBG_EXPIRATION_CHK
+	DBG_871X("sta:"MAC_FMT", rssi:%d, rx:"STA_PKTS_FMT", expire_to:%u, %s%ssq_len:%u\n"
+		, MAC_ARG(psta->hwaddr)
+		, psta->rssi_stat.UndecoratedSmoothedPWDB
+		//, STA_RX_PKTS_ARG(psta)
+		, STA_RX_PKTS_DIFF_ARG(psta)
+		, psta->expire_to
+		, psta->state&WIFI_SLEEP_STATE?"PS, ":""
+		, psta->state&WIFI_STA_ALIVE_CHK_STATE?"SAC, ":""
+		, psta->sleepq_len
+	);
+	#endif
+
+	//if(sta_last_rx_pkts(psta) == sta_rx_pkts(psta))
+	if((psta->sta_stats.last_rx_data_pkts + psta->sta_stats.last_rx_ctrl_pkts) == (psta->sta_stats.rx_data_pkts + psta->sta_stats.rx_ctrl_pkts))
+	{
+		#if 0
+		if(psta->state&WIFI_SLEEP_STATE)
+			ret = _TRUE;
+		#endif
+	}
+	else
+	{
+		ret = _TRUE;
+	}
+
+	sta_update_last_rx_pkts(psta);
+
+	return ret;
+}
+
+void	expire_timeout_chk(_adapter *padapter)
+{
+	_irqL irqL;
+	_list	*phead, *plist;
+	u8 updated = _FALSE;
+	struct sta_info *psta=NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	u8 chk_alive_num = 0;
+	char chk_alive_list[NUM_STA];
+	int i;
+
+	_enter_critical_bh(&pstapriv->auth_list_lock, &irqL);
+
+	phead = &pstapriv->auth_list;
+	plist = get_next(phead);
+
+	//check auth_queue
+	#ifdef DBG_EXPIRATION_CHK
+	if (rtw_end_of_queue_search(phead, plist) == _FALSE) {
+		DBG_871X(FUNC_NDEV_FMT" auth_list, cnt:%u\n"
+			, FUNC_NDEV_ARG(padapter->pnetdev), pstapriv->auth_list_cnt);
+	}
+	#endif
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+	{
+		psta = LIST_CONTAINOR(plist, struct sta_info, auth_list);
+		plist = get_next(plist);
+
+		if(psta->expire_to>0)
+		{
+			psta->expire_to--;
+			if (psta->expire_to == 0)
+			{
+				rtw_list_delete(&psta->auth_list);
+				pstapriv->auth_list_cnt--;
+
+				DBG_871X("auth expire %02X%02X%02X%02X%02X%02X\n",
+					psta->hwaddr[0],psta->hwaddr[1],psta->hwaddr[2],psta->hwaddr[3],psta->hwaddr[4],psta->hwaddr[5]);
+
+				_exit_critical_bh(&pstapriv->auth_list_lock, &irqL);
+
+				_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+				rtw_free_stainfo(padapter, psta);
+				_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+
+				_enter_critical_bh(&pstapriv->auth_list_lock, &irqL);
+			}
+		}
+
+	}
+
+	_exit_critical_bh(&pstapriv->auth_list_lock, &irqL);
+
+	psta = NULL;
+
+
+	_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	phead = &pstapriv->asoc_list;
+	plist = get_next(phead);
+
+	//check asoc_queue
+	#ifdef DBG_EXPIRATION_CHK
+	if (rtw_end_of_queue_search(phead, plist) == _FALSE) {
+		DBG_871X(FUNC_NDEV_FMT" asoc_list, cnt:%u\n"
+			, FUNC_NDEV_ARG(padapter->pnetdev), pstapriv->asoc_list_cnt);
+	}
+	#endif
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+	{
+		psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
+		plist = get_next(plist);
+
+		if (chk_sta_is_alive(psta) || !psta->expire_to) {
+			psta->expire_to = pstapriv->expire_to;
+			psta->keep_alive_trycnt = 0;
+			#ifdef CONFIG_TX_MCAST2UNI
+			psta->under_exist_checking = 0;
+			#endif	// CONFIG_TX_MCAST2UNI
+		} else {
+			psta->expire_to--;
+		}
+
+#ifndef CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+#ifdef CONFIG_TX_MCAST2UNI
+		if ( (psta->flags & WLAN_STA_HT) && (psta->htpriv.agg_enable_bitmap || psta->under_exist_checking) ) {
+			// check sta by delba(addba) for 11n STA
+			// ToDo: use CCX report to check for all STAs
+			//DBG_871X("asoc check by DELBA/ADDBA! (pstapriv->expire_to=%d s)(psta->expire_to=%d s), [%02x, %d]\n", pstapriv->expire_to*2, psta->expire_to*2, psta->htpriv.agg_enable_bitmap, psta->under_exist_checking);
+
+			if ( psta->expire_to <= (pstapriv->expire_to - 50 ) ) {
+				DBG_871X("asoc expire by DELBA/ADDBA! (%d s)\n", (pstapriv->expire_to-psta->expire_to)*2);
+				psta->under_exist_checking = 0;
+				psta->expire_to = 0;
+			} else if ( psta->expire_to <= (pstapriv->expire_to - 3) && (psta->under_exist_checking==0)) {
+				DBG_871X("asoc check by DELBA/ADDBA! (%d s)\n", (pstapriv->expire_to-psta->expire_to)*2);
+				psta->under_exist_checking = 1;
+				//tear down TX AMPDU
+				send_delba(padapter, 1, psta->hwaddr);// // originator
+				psta->htpriv.agg_enable_bitmap = 0x0;//reset
+				psta->htpriv.candidate_tid_bitmap = 0x0;//reset
+			}
+		}
+#endif // CONFIG_TX_MCAST2UNI
+#endif //CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+
+		if (psta->expire_to <= 0)
+		{
+			#ifdef CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+			struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+
+			if (padapter->registrypriv.wifi_spec == 1)
+			{
+				psta->expire_to = pstapriv->expire_to;
+				continue;
+			}
+
+			if (psta->state & WIFI_SLEEP_STATE) {
+				if (!(psta->state & WIFI_STA_ALIVE_CHK_STATE)) {
+					//to check if alive by another methods if staion is at ps mode.
+					psta->expire_to = pstapriv->expire_to;
+					psta->state |= WIFI_STA_ALIVE_CHK_STATE;
+
+					//DBG_871X("alive chk, sta:" MAC_FMT " is at ps mode!\n", MAC_ARG(psta->hwaddr));
+
+					//to update bcn with tim_bitmap for this station
+					pstapriv->tim_bitmap |= BIT(psta->aid);
+					update_beacon(padapter, _TIM_IE_, NULL, _FALSE);
+
+					if(!pmlmeext->active_keep_alive_check)
+						continue;
+				}
+			}
+
+			if (pmlmeext->active_keep_alive_check) {
+				int stainfo_offset;
+
+				stainfo_offset = rtw_stainfo_offset(pstapriv, psta);
+				if (stainfo_offset_valid(stainfo_offset)) {
+					chk_alive_list[chk_alive_num++] = stainfo_offset;
+				}
+
+				continue;
+			}
+			#endif /* CONFIG_ACTIVE_KEEP_ALIVE_CHECK */
+
+			rtw_list_delete(&psta->asoc_list);
+			pstapriv->asoc_list_cnt--;
+
+			DBG_871X("asoc expire "MAC_FMT", state=0x%x\n", MAC_ARG(psta->hwaddr), psta->state);
+			updated = ap_free_sta(padapter, psta, _FALSE, WLAN_REASON_DEAUTH_LEAVING);
+		}
+		else
+		{
+			/* TODO: Aging mechanism to digest frames in sleep_q to avoid running out of xmitframe */
+			if (psta->sleepq_len > (NR_XMITFRAME/pstapriv->asoc_list_cnt)
+				&& padapter->xmitpriv.free_xmitframe_cnt < (NR_XMITFRAME/pstapriv->asoc_list_cnt/2)
+			){
+				DBG_871X("%s sta:"MAC_FMT", sleepq_len:%u, free_xmitframe_cnt:%u, asoc_list_cnt:%u, clear sleep_q\n", __func__
+					, MAC_ARG(psta->hwaddr)
+					, psta->sleepq_len, padapter->xmitpriv.free_xmitframe_cnt, pstapriv->asoc_list_cnt);
+				wakeup_sta_to_xmit(padapter, psta);
+			}
+		}
+	}
+
+	_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+#ifdef CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+if (chk_alive_num) {
+
+	u8 backup_oper_channel=0;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	/* switch to correct channel of current network  before issue keep-alive frames */
+	if (rtw_get_oper_ch(padapter) != pmlmeext->cur_channel) {
+		backup_oper_channel = rtw_get_oper_ch(padapter);
+		SelectChannel(padapter, pmlmeext->cur_channel);
+	}
+
+	/* issue null data to check sta alive*/
+	for (i = 0; i < chk_alive_num; i++) {
+
+		int ret = _FAIL;
+
+		psta = rtw_get_stainfo_by_offset(pstapriv, chk_alive_list[i]);
+		if(!(psta->state &_FW_LINKED))
+			continue;
+
+		if (psta->state & WIFI_SLEEP_STATE)
+			ret = issue_nulldata(padapter, psta->hwaddr, 0, 1, 50);
+		else
+			ret = issue_nulldata(padapter, psta->hwaddr, 0, 3, 50);
+
+		psta->keep_alive_trycnt++;
+		if (ret == _SUCCESS)
+		{
+			DBG_871X("asoc check, sta(" MAC_FMT ") is alive\n", MAC_ARG(psta->hwaddr));
+			psta->expire_to = pstapriv->expire_to;
+			psta->keep_alive_trycnt = 0;
+			continue;
+		}
+		else if (psta->keep_alive_trycnt <= 3)
+		{
+			DBG_871X("ack check for asoc expire, keep_alive_trycnt=%d\n", psta->keep_alive_trycnt);
+			psta->expire_to = 1;
+			continue;
+		}
+
+		psta->keep_alive_trycnt = 0;
+
+		DBG_871X("asoc expire "MAC_FMT", state=0x%x\n", MAC_ARG(psta->hwaddr), psta->state);
+		_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+		if (rtw_is_list_empty(&psta->asoc_list)==_FALSE) {
+			rtw_list_delete(&psta->asoc_list);
+			pstapriv->asoc_list_cnt--;
+			updated = ap_free_sta(padapter, psta, _FALSE, WLAN_REASON_DEAUTH_LEAVING);
+		}
+		_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	}
+
+	if (backup_oper_channel>0) /* back to the original operation channel */
+		SelectChannel(padapter, backup_oper_channel);
+}
+#endif /* CONFIG_ACTIVE_KEEP_ALIVE_CHECK */
+
+	associated_clients_update(padapter, updated);
+}
+
+
+static void add_RATid(_adapter *padapter, struct sta_info *psta)
+{
+	int i;
+	u8 rf_type;
+	u32 init_rate=0;
+	unsigned char sta_band = 0, raid, shortGIrate = _FALSE;
+	unsigned char limit;
+	unsigned int tx_ra_bitmap=0;
+	struct ht_priv	*psta_ht = NULL;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	WLAN_BSSID_EX *pcur_network = (WLAN_BSSID_EX *)&pmlmepriv->cur_network.network;
+
+
+	if(psta)
+		psta_ht = &psta->htpriv;
+	else
+		return;
+
+	//b/g mode ra_bitmap
+	for (i=0; i<sizeof(psta->bssrateset); i++)
+	{
+		if (psta->bssrateset[i])
+			tx_ra_bitmap |= rtw_get_bit_value_from_ieee_value(psta->bssrateset[i]&0x7f);
+	}
+
+	//n mode ra_bitmap
+	if(psta_ht->ht_option)
+	{
+		rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+		if(rf_type == RF_2T2R)
+			limit=16;// 2R
+		else
+			limit=8;//  1R
+
+		for (i=0; i<limit; i++) {
+			if (psta_ht->ht_cap.supp_mcs_set[i/8] & BIT(i%8))
+				tx_ra_bitmap |= BIT(i+12);
+		}
+
+		//max short GI rate
+		shortGIrate = psta_ht->sgi;
+	}
+
+
+#if 0//gtest
+	if(get_rf_mimo_mode(padapter) == RTL8712_RF_2T2R)
+	{
+		//is this a 2r STA?
+		if((pstat->tx_ra_bitmap & 0x0ff00000) != 0 && !(priv->pshare->has_2r_sta & BIT(pstat->aid)))
+		{
+			priv->pshare->has_2r_sta |= BIT(pstat->aid);
+			if(rtw_read16(padapter, 0x102501f6) != 0xffff)
+			{
+				rtw_write16(padapter, 0x102501f6, 0xffff);
+				reset_1r_sta_RA(priv, 0xffff);
+				Switch_1SS_Antenna(priv, 3);
+			}
+		}
+		else// bg or 1R STA?
+		{
+			if((priv->pmib->dot11BssType.net_work_type & WIRELESS_11N) && pstat->ht_cap_len && priv->pshare->has_2r_sta == 0)
+			{
+				if(rtw_read16(padapter, 0x102501f6) != 0x7777)
+				{ // MCS7 SGI
+					rtw_write16(padapter, 0x102501f6,0x7777);
+					reset_1r_sta_RA(priv, 0x7777);
+					Switch_1SS_Antenna(priv, 2);
+				}
+			}
+		}
+
+	}
+
+	if ((pstat->rssi_level < 1) || (pstat->rssi_level > 3))
+	{
+		if (pstat->rssi >= priv->pshare->rf_ft_var.raGoDownUpper)
+			pstat->rssi_level = 1;
+		else if ((pstat->rssi >= priv->pshare->rf_ft_var.raGoDown20MLower) ||
+			((priv->pshare->is_40m_bw) && (pstat->ht_cap_len) &&
+			(pstat->rssi >= priv->pshare->rf_ft_var.raGoDown40MLower) &&
+			(pstat->ht_cap_buf.ht_cap_info & cpu_to_le16(_HTCAP_SUPPORT_CH_WDTH_))))
+			pstat->rssi_level = 2;
+		else
+			pstat->rssi_level = 3;
+	}
+
+	// rate adaptive by rssi
+	if ((priv->pmib->dot11BssType.net_work_type & WIRELESS_11N) && pstat->ht_cap_len)
+	{
+		if ((get_rf_mimo_mode(priv) == MIMO_1T2R) || (get_rf_mimo_mode(priv) == MIMO_1T1R))
+		{
+			switch (pstat->rssi_level) {
+				case 1:
+					pstat->tx_ra_bitmap &= 0x100f0000;
+					break;
+				case 2:
+					pstat->tx_ra_bitmap &= 0x100ff000;
+					break;
+				case 3:
+					if (priv->pshare->is_40m_bw)
+						pstat->tx_ra_bitmap &= 0x100ff005;
+					else
+						pstat->tx_ra_bitmap &= 0x100ff001;
+
+					break;
+			}
+		}
+		else
+		{
+			switch (pstat->rssi_level) {
+				case 1:
+					pstat->tx_ra_bitmap &= 0x1f0f0000;
+					break;
+				case 2:
+					pstat->tx_ra_bitmap &= 0x1f0ff000;
+					break;
+				case 3:
+					if (priv->pshare->is_40m_bw)
+						pstat->tx_ra_bitmap &= 0x000ff005;
+					else
+						pstat->tx_ra_bitmap &= 0x000ff001;
+
+					break;
+			}
+
+			// Don't need to mask high rates due to new rate adaptive parameters
+			//if (pstat->is_broadcom_sta)		// use MCS12 as the highest rate vs. Broadcom sta
+			//	pstat->tx_ra_bitmap &= 0x81ffffff;
+
+			// NIC driver will report not supporting MCS15 and MCS14 in asoc req
+			//if (pstat->is_rtl8190_sta && !pstat->is_2t_mimo_sta)
+			//	pstat->tx_ra_bitmap &= 0x83ffffff;		// if Realtek 1x2 sta, don't use MCS15 and MCS14
+		}
+	}
+	else if ((priv->pmib->dot11BssType.net_work_type & WIRELESS_11G) && isErpSta(pstat))
+	{
+		switch (pstat->rssi_level) {
+			case 1:
+				pstat->tx_ra_bitmap &= 0x00000f00;
+				break;
+			case 2:
+				pstat->tx_ra_bitmap &= 0x00000ff0;
+				break;
+			case 3:
+				pstat->tx_ra_bitmap &= 0x00000ff5;
+				break;
+		}
+	}
+	else
+	{
+		pstat->tx_ra_bitmap &= 0x0000000d;
+	}
+
+	// disable tx short GI when station cannot rx MCS15(AP is 2T2R)
+	// disable tx short GI when station cannot rx MCS7 (AP is 1T2R or 1T1R)
+	// if there is only 1r STA and we are 2T2R, DO NOT mask SGI rate
+	if ((!(pstat->tx_ra_bitmap & 0x8000000) && (priv->pshare->has_2r_sta > 0) && (get_rf_mimo_mode(padapter) == RTL8712_RF_2T2R)) ||
+		 (!(pstat->tx_ra_bitmap & 0x80000) && (get_rf_mimo_mode(padapter) != RTL8712_RF_2T2R)))
+	{
+		pstat->tx_ra_bitmap &= ~BIT(28);
+	}
+#endif
+
+	if ( pcur_network->Configuration.DSConfig > 14 ) {
+		// 5G band
+		if (tx_ra_bitmap & 0xffff000)
+			sta_band |= WIRELESS_11_5N | WIRELESS_11A;
+		else
+			sta_band |= WIRELESS_11A;
+	} else {
+		if (tx_ra_bitmap & 0xffff000)
+			sta_band |= WIRELESS_11_24N | WIRELESS_11G | WIRELESS_11B;
+		else if (tx_ra_bitmap & 0xff0)
+			sta_band |= WIRELESS_11G |WIRELESS_11B;
+		else
+			sta_band |= WIRELESS_11B;
+	}
+
+	raid = networktype_to_raid(sta_band);
+	init_rate = get_highest_rate_idx(tx_ra_bitmap&0x0fffffff)&0x3f;
+
+	if (psta->aid < NUM_STA)
+	{
+		u8 arg = 0;
+
+		arg = psta->mac_id&0x1f;
+
+		arg |= BIT(7);//support entry 2~31
+
+		if (shortGIrate==_TRUE)
+			arg |= BIT(5);
+
+		tx_ra_bitmap |= ((raid<<28)&0xf0000000);
+
+		DBG_871X("%s=> mac_id:%d , raid:%d , bitmap=0x%x, arg=0x%x\n",
+			__FUNCTION__ , psta->mac_id, raid ,tx_ra_bitmap, arg);
+
+		//bitmap[0:27] = tx_rate_bitmap
+		//bitmap[28:31]= Rate Adaptive id
+		//arg[0:4] = macid
+		//arg[5] = Short GI
+		rtw_hal_add_ra_tid(padapter, tx_ra_bitmap, arg);
+
+		if (shortGIrate==_TRUE)
+			init_rate |= BIT(6);
+
+		//set ra_id, init_rate
+		psta->raid = raid;
+		psta->init_rate = init_rate;
+
+	}
+	else
+	{
+		DBG_871X("station aid %d exceed the max number\n", psta->aid);
+	}
+
+}
+
+static void update_bmc_sta(_adapter *padapter)
+{
+	_irqL	irqL;
+	u32 init_rate=0;
+	unsigned char	network_type, raid;
+	int i, supportRateNum = 0;
+	unsigned int tx_ra_bitmap=0;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	WLAN_BSSID_EX *pcur_network = (WLAN_BSSID_EX *)&pmlmepriv->cur_network.network;
+	struct sta_info *psta = rtw_get_bcmc_stainfo(padapter);
+
+	if(psta)
+	{
+		psta->aid = 0;//default set to 0
+		//psta->mac_id = psta->aid+4;
+		psta->mac_id = psta->aid + 1;
+
+		psta->qos_option = 0;
+		psta->htpriv.ht_option = _FALSE;
+
+		psta->ieee8021x_blocked = 0;
+
+		_rtw_memset((void*)&psta->sta_stats, 0, sizeof(struct stainfo_stats));
+
+		//psta->dot118021XPrivacy = _NO_PRIVACY_;//!!! remove it, because it has been set before this.
+
+
+
+		//prepare for add_RATid
+		supportRateNum = rtw_get_rateset_len((u8*)&pcur_network->SupportedRates);
+		network_type = rtw_check_network_type((u8*)&pcur_network->SupportedRates, supportRateNum, 1);
+
+		_rtw_memcpy(psta->bssrateset, &pcur_network->SupportedRates, supportRateNum);
+		psta->bssratelen = supportRateNum;
+
+		//b/g mode ra_bitmap
+		for (i=0; i<supportRateNum; i++)
+		{
+			if (psta->bssrateset[i])
+				tx_ra_bitmap |= rtw_get_bit_value_from_ieee_value(psta->bssrateset[i]&0x7f);
+		}
+
+		if ( pcur_network->Configuration.DSConfig > 14 ) {
+			//force to A mode. 5G doesn't support CCK rates
+			network_type = WIRELESS_11A;
+			tx_ra_bitmap = 0x150; // 6, 12, 24 Mbps
+		} else {
+			//force to b mode
+			network_type = WIRELESS_11B;
+			tx_ra_bitmap = 0xf;
+		}
+
+		//tx_ra_bitmap = update_basic_rate(pcur_network->SupportedRates, supportRateNum);
+
+		raid = networktype_to_raid(network_type);
+		init_rate = get_highest_rate_idx(tx_ra_bitmap&0x0fffffff)&0x3f;
+
+		//DBG_871X("Add id %d val %08x to ratr for bmc sta\n", psta->aid, tx_ra_bitmap);
+
+		//if(pHalData->fw_ractrl == _TRUE)
+		{
+			u8 arg = 0;
+
+			arg = psta->mac_id&0x1f;
+
+			arg |= BIT(7);
+
+			//if (shortGIrate==_TRUE)
+			//	arg |= BIT(5);
+
+			tx_ra_bitmap |= ((raid<<28)&0xf0000000);
+
+			DBG_871X("update_bmc_sta, mask=0x%x, arg=0x%x\n", tx_ra_bitmap, arg);
+
+			//bitmap[0:27] = tx_rate_bitmap
+			//bitmap[28:31]= Rate Adaptive id
+			//arg[0:4] = macid
+			//arg[5] = Short GI
+			rtw_hal_add_ra_tid(padapter, tx_ra_bitmap, arg);
+
+		}
+
+		//set ra_id, init_rate
+		psta->raid = raid;
+		psta->init_rate = init_rate;
+
+		_enter_critical_bh(&psta->lock, &irqL);
+		psta->state = _FW_LINKED;
+		_exit_critical_bh(&psta->lock, &irqL);
+
+	}
+	else
+	{
+		DBG_871X("add_RATid_bmc_sta error!\n");
+	}
+
+}
+
+//notes:
+//AID: 1~MAX for sta and 0 for bc/mc in ap/adhoc mode
+//MAC_ID = AID+1 for sta in ap/adhoc mode
+//MAC_ID = 1 for bc/mc for sta/ap/adhoc
+//MAC_ID = 0 for bssid for sta/ap/adhoc
+//CAM_ID = //0~3 for default key, cmd_id=macid + 3, macid=aid+1;
+
+void update_sta_info_apmode(_adapter *padapter, struct sta_info *psta)
+{
+	_irqL	irqL;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct ht_priv	*phtpriv_ap = &pmlmepriv->htpriv;
+	struct ht_priv	*phtpriv_sta = &psta->htpriv;
+
+	//set intf_tag to if1
+	//psta->intf_tag = 0;
+
+	//psta->mac_id = psta->aid+4;
+	psta->mac_id = psta->aid+1;
+
+	if(psecuritypriv->dot11AuthAlgrthm==dot11AuthAlgrthm_8021X)
+		psta->ieee8021x_blocked = _TRUE;
+	else
+		psta->ieee8021x_blocked = _FALSE;
+
+
+	//update sta's cap
+
+	//ERP
+	VCS_update(padapter, psta);
+
+	//HT related cap
+	if(phtpriv_sta->ht_option)
+	{
+		//check if sta supports rx ampdu
+		phtpriv_sta->ampdu_enable = phtpriv_ap->ampdu_enable;
+
+		//check if sta support s Short GI
+		if((phtpriv_sta->ht_cap.cap_info & phtpriv_ap->ht_cap.cap_info) & cpu_to_le16(IEEE80211_HT_CAP_SGI_20|IEEE80211_HT_CAP_SGI_40))
+		{
+			phtpriv_sta->sgi = _TRUE;
+		}
+
+		// bwmode
+		if((phtpriv_sta->ht_cap.cap_info & phtpriv_ap->ht_cap.cap_info) & cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH))
+		{
+			//phtpriv_sta->bwmode = HT_CHANNEL_WIDTH_40;
+			phtpriv_sta->bwmode = pmlmeext->cur_bwmode;
+			phtpriv_sta->ch_offset = pmlmeext->cur_ch_offset;
+
+		}
+
+		psta->qos_option = _TRUE;
+
+	}
+	else
+	{
+		phtpriv_sta->ampdu_enable = _FALSE;
+
+		phtpriv_sta->sgi = _FALSE;
+		phtpriv_sta->bwmode = HT_CHANNEL_WIDTH_20;
+		phtpriv_sta->ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+	}
+
+	//Rx AMPDU
+	send_delba(padapter, 0, psta->hwaddr);// recipient
+
+	//TX AMPDU
+	send_delba(padapter, 1, psta->hwaddr);// // originator
+	phtpriv_sta->agg_enable_bitmap = 0x0;//reset
+	phtpriv_sta->candidate_tid_bitmap = 0x0;//reset
+
+
+	//todo: init other variables
+
+	_rtw_memset((void*)&psta->sta_stats, 0, sizeof(struct stainfo_stats));
+
+
+	//add ratid
+	//add_RATid(padapter, psta);//move to ap_sta_info_defer_update()
+
+
+	_enter_critical_bh(&psta->lock, &irqL);
+	psta->state |= _FW_LINKED;
+	_exit_critical_bh(&psta->lock, &irqL);
+
+
+}
+
+static void update_hw_ht_param(_adapter *padapter)
+{
+	unsigned char		max_AMPDU_len;
+	unsigned char		min_MPDU_spacing;
+	struct registry_priv	 *pregpriv = &padapter->registrypriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+
+	//handle A-MPDU parameter field
+	/*
+		AMPDU_para [1:0]:Max AMPDU Len => 0:8k , 1:16k, 2:32k, 3:64k
+		AMPDU_para [4:2]:Min MPDU Start Spacing
+	*/
+	max_AMPDU_len = pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para & 0x03;
+
+	min_MPDU_spacing = (pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para & 0x1c) >> 2;
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_AMPDU_MIN_SPACE, (u8 *)(&min_MPDU_spacing));
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_AMPDU_FACTOR, (u8 *)(&max_AMPDU_len));
+
+	//
+	// Config SM Power Save setting
+	//
+	pmlmeinfo->SM_PS = (pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info & 0x0C) >> 2;
+	if(pmlmeinfo->SM_PS == WLAN_HT_CAP_SM_PS_STATIC)
+	{
+		/*u8 i;
+		//update the MCS rates
+		for (i = 0; i < 16; i++)
+		{
+			pmlmeinfo->HT_caps.HT_cap_element.MCS_rate[i] &= MCS_rate_1R[i];
+		}*/
+		DBG_871X("%s(): WLAN_HT_CAP_SM_PS_STATIC\n",__FUNCTION__);
+	}
+
+	//
+	// Config current HT Protection mode.
+	//
+	//pmlmeinfo->HT_protection = pmlmeinfo->HT_info.infos[1] & 0x3;
+
+}
+
+static void start_bss_network(_adapter *padapter, u8 *pbuf)
+{
+	u8 *p;
+	u8 val8, cur_channel, cur_bwmode, cur_ch_offset;
+	u16 bcn_interval;
+	u32	acparm;
+	int	ie_len;
+	struct registry_priv	 *pregpriv = &padapter->registrypriv;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct security_priv* psecuritypriv=&(padapter->securitypriv);
+	WLAN_BSSID_EX *pnetwork = (WLAN_BSSID_EX *)&pmlmepriv->cur_network.network;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX *pnetwork_mlmeext = &(pmlmeinfo->network);
+	struct HT_info_element *pht_info=NULL;
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+#endif //CONFIG_P2P
+	u8 cbw40_enable=0;
+	u8 change_band = _FALSE;
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	bcn_interval = (u16)pnetwork->Configuration.BeaconPeriod;
+	cur_channel = pnetwork->Configuration.DSConfig;
+	cur_bwmode = HT_CHANNEL_WIDTH_20;;
+	cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+
+	//check if there is wps ie,
+	//if there is wpsie in beacon, the hostapd will update beacon twice when stating hostapd,
+	//and at first time the security ie ( RSN/WPA IE) will not include in beacon.
+	if(NULL == rtw_get_wps_ie(pnetwork->IEs+_FIXED_IE_LENGTH_, pnetwork->IELength-_FIXED_IE_LENGTH_, NULL, NULL))
+	{
+		pmlmeext->bstart_bss = _TRUE;
+	}
+
+	//todo: update wmm, ht cap
+	//pmlmeinfo->WMM_enable;
+	//pmlmeinfo->HT_enable;
+	if(pmlmepriv->qospriv.qos_option)
+		pmlmeinfo->WMM_enable = _TRUE;
+
+	if(pmlmepriv->htpriv.ht_option)
+	{
+		pmlmeinfo->WMM_enable = _TRUE;
+		pmlmeinfo->HT_enable = _TRUE;
+		//pmlmeinfo->HT_info_enable = _TRUE;
+		//pmlmeinfo->HT_caps_enable = _TRUE;
+
+		update_hw_ht_param(padapter);
+	}
+
+
+	if(pmlmepriv->cur_network.join_res != _TRUE) //setting only at  first time
+	{
+		//WEP Key will be set before this function, do not clear CAM.
+		if ((psecuritypriv->dot11PrivacyAlgrthm != _WEP40_) && (psecuritypriv->dot11PrivacyAlgrthm != _WEP104_))
+			flush_all_cam_entry(padapter);	//clear CAM
+	}
+
+	//set MSR to AP_Mode
+	Set_MSR(padapter, _HW_STATE_AP_);
+
+	//Set BSSID REG
+	rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, pnetwork->MacAddress);
+
+	//Set EDCA param reg
+#ifdef CONFIG_CONCURRENT_MODE
+	acparm = 0x005ea42b;
+#else
+	acparm = 0x002F3217; // VO
+#endif
+	rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_VO, (u8 *)(&acparm));
+	acparm = 0x005E4317; // VI
+	rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_VI, (u8 *)(&acparm));
+	//acparm = 0x00105320; // BE
+	acparm = 0x005ea42b;
+	rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_BE, (u8 *)(&acparm));
+	acparm = 0x0000A444; // BK
+	rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_BK, (u8 *)(&acparm));
+
+	//Set Security
+	val8 = (psecuritypriv->dot11AuthAlgrthm == dot11AuthAlgrthm_8021X)? 0xcc: 0xcf;
+	rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
+
+	//Beacon Control related register
+	rtw_hal_set_hwreg(padapter, HW_VAR_BEACON_INTERVAL, (u8 *)(&bcn_interval));
+
+	if(pmlmepriv->cur_network.join_res != _TRUE) //setting only at  first time
+	{
+		u32 initialgain;
+
+		initialgain = 0x1e;
+
+
+		//disable dynamic functions, such as high power, DIG
+		//Save_DM_Func_Flag(padapter);
+		//Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, _FALSE);
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if(padapter->adapter_type > PRIMARY_ADAPTER)
+		{
+			if(rtw_buddy_adapter_up(padapter))
+			{
+				_adapter *pbuddy_adapter = padapter->pbuddy_adapter;
+
+				//turn on dynamic functions on PRIMARY_ADAPTER, dynamic functions only runs at PRIMARY_ADAPTER
+				Switch_DM_Func(pbuddy_adapter, DYNAMIC_FUNC_DIG|DYNAMIC_FUNC_HP|DYNAMIC_FUNC_SS, _TRUE);
+
+				rtw_hal_set_hwreg(pbuddy_adapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
+			}
+		}
+		else
+#endif
+		{
+			//turn on dynamic functions
+			Switch_DM_Func(padapter, DYNAMIC_FUNC_DIG|DYNAMIC_FUNC_HP|DYNAMIC_FUNC_SS, _TRUE);
+
+			rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
+		}
+
+	}
+
+	//set channel, bwmode
+	p = rtw_get_ie((pnetwork->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _HT_ADD_INFO_IE_, &ie_len, (pnetwork->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+	if( p && ie_len)
+	{
+		pht_info = (struct HT_info_element *)(p+2);
+
+		if( pmlmeext->cur_channel > 14 )
+		{
+			if( pregpriv->cbw40_enable & BIT(1) )
+				cbw40_enable = 1;
+		}
+		else
+			if( pregpriv->cbw40_enable & BIT(0) )
+				cbw40_enable = 1;
+
+		if ((cbw40_enable) &&	 (pht_info->infos[0] & BIT(2)))
+		{
+			//switch to the 40M Hz mode
+			//pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+			cur_bwmode = HT_CHANNEL_WIDTH_40;
+			switch (pht_info->infos[0] & 0x3)
+			{
+				case 1:
+					//pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+					cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+					break;
+
+				case 3:
+					//pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+					cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+					break;
+
+				default:
+					//pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+					cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+					break;
+			}
+
+		}
+
+	}
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	dc_set_ap_channel_bandwidth(padapter, cur_channel, cur_ch_offset, cur_bwmode);
+#else
+	//TODO: need to judge the phy parameters on concurrent mode for single phy
+	//set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+#ifdef CONFIG_CONCURRENT_MODE
+	if(!check_buddy_fwstate(padapter, _FW_LINKED|_FW_UNDER_LINKING|_FW_UNDER_SURVEY))
+	{
+		set_channel_bwmode(padapter, cur_channel, cur_ch_offset, cur_bwmode);
+	}
+	else if(check_buddy_fwstate(padapter, _FW_LINKED)==_TRUE)//only second adapter can enter AP Mode
+	{
+		_adapter *pbuddy_adapter = padapter->pbuddy_adapter;
+		struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+		//To sync cur_channel/cur_bwmode/cur_ch_offset with primary adapter
+		DBG_871X("primary iface is at linked state, sync cur_channel/cur_bwmode/cur_ch_offset\n");
+		DBG_871X("primary adapter, CH=%d, BW=%d, offset=%d\n", pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_bwmode, pbuddy_mlmeext->cur_ch_offset);
+		DBG_871X("second adapter, CH=%d, BW=%d, offset=%d\n", cur_channel, cur_bwmode, cur_ch_offset);
+
+		if((cur_channel <= 14 && pbuddy_mlmeext->cur_channel >= 36) ||
+		(cur_channel >= 36 && pbuddy_mlmeext->cur_channel <= 14))
+			change_band = _TRUE;
+
+		cur_channel = pbuddy_mlmeext->cur_channel;
+		if(cur_bwmode == HT_CHANNEL_WIDTH_40)
+		{
+			if(pht_info)
+				pht_info->infos[0] &= ~(BIT(0)|BIT(1));
+
+			if(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40)
+			{
+				cur_ch_offset = pbuddy_mlmeext->cur_ch_offset;
+
+				//to update cur_ch_offset value in beacon
+				if(pht_info)
+				{
+					switch(cur_ch_offset)
+					{
+						case HAL_PRIME_CHNL_OFFSET_LOWER:
+							pht_info->infos[0] |= 0x1;
+							break;
+						case HAL_PRIME_CHNL_OFFSET_UPPER:
+							pht_info->infos[0] |= 0x3;
+							break;
+						case HAL_PRIME_CHNL_OFFSET_DONT_CARE:
+						default:
+							break;
+					}
+				}
+
+			}
+			else if(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_20)
+			{
+				cur_bwmode = HT_CHANNEL_WIDTH_20;
+				cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+				if(cur_channel>0 && cur_channel<5)
+				{
+					if(pht_info)
+						pht_info->infos[0] |= 0x1;
+
+					cur_bwmode = HT_CHANNEL_WIDTH_40;
+					cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+				}
+
+				if(cur_channel>7 && cur_channel<(14+1))
+				{
+					if(pht_info)
+						pht_info->infos[0] |= 0x3;
+
+					cur_bwmode = HT_CHANNEL_WIDTH_40;
+					cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+				}
+
+				set_channel_bwmode(padapter, cur_channel, cur_ch_offset, cur_bwmode);
+			}
+
+		}
+
+		// to update channel value in beacon
+		pnetwork->Configuration.DSConfig = cur_channel;
+		p = rtw_get_ie((pnetwork->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _DSSET_IE_, &ie_len, (pnetwork->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+		if(p && ie_len>0)
+			*(p + 2) = cur_channel;
+
+		if(pht_info)
+			pht_info->primary_channel = cur_channel;
+
+		//set buddy adapter channel, bandwidth, offeset to current adapter
+		pmlmeext->cur_channel = cur_channel;
+		pmlmeext->cur_bwmode = cur_bwmode;
+		pmlmeext->cur_ch_offset = cur_ch_offset;
+
+		//buddy interface band is different from current interface, update ERP, support rate, ext support rate IE
+		if(change_band == _TRUE)
+			change_band_update_ie(padapter, pnetwork);
+	}
+#else
+	set_channel_bwmode(padapter, cur_channel, cur_ch_offset, cur_bwmode);
+#endif //CONFIG_CONCURRENT_MODE
+
+	DBG_871X("CH=%d, BW=%d, offset=%d\n", cur_channel, cur_bwmode, cur_ch_offset);
+
+	//
+	pmlmeext->cur_channel = cur_channel;
+	pmlmeext->cur_bwmode = cur_bwmode;
+	pmlmeext->cur_ch_offset = cur_ch_offset;
+#endif //CONFIG_DUALMAC_CONCURRENT
+	pmlmeext->cur_wireless_mode = pmlmepriv->cur_network.network_type;
+
+	//update cur_wireless_mode
+	update_wireless_mode(padapter);
+
+	//update RRSR after set channel and bandwidth
+	UpdateBrateTbl(padapter, pnetwork->SupportedRates);
+	rtw_hal_set_hwreg(padapter, HW_VAR_BASIC_RATE, pnetwork->SupportedRates);
+
+	//udpate capability after cur_wireless_mode updated
+	update_capinfo(padapter, rtw_get_capability((WLAN_BSSID_EX *)pnetwork));
+
+	//let pnetwork_mlmeext == pnetwork_mlme.
+	_rtw_memcpy(pnetwork_mlmeext, pnetwork, pnetwork->Length);
+
+#ifdef CONFIG_P2P
+	_rtw_memcpy(pwdinfo->p2p_group_ssid, pnetwork->Ssid.Ssid, pnetwork->Ssid.SsidLength);
+	pwdinfo->p2p_group_ssid_len = pnetwork->Ssid.SsidLength;
+#endif //CONFIG_P2P
+
+	if(_TRUE == pmlmeext->bstart_bss)
+	{
+		update_beacon(padapter, _TIM_IE_, NULL, _FALSE);
+
+#ifndef CONFIG_INTERRUPT_BASED_TXBCN //other case will  tx beacon when bcn interrupt coming in.
+#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI) || defined(CONFIG_GSPI_HCI)
+		//issue beacon frame
+		if(send_beacon(padapter)==_FAIL)
+		{
+			DBG_871X("issue_beacon, fail!\n");
+		}
+#endif
+#endif //!CONFIG_INTERRUPT_BASED_TXBCN
+
+	}
+
+
+	//update bc/mc sta_info
+	update_bmc_sta(padapter);
+
+	//pmlmeext->bstart_bss = _TRUE;
+
+}
+
+int rtw_check_beacon_data(_adapter *padapter, u8 *pbuf,  int len)
+{
+	int ret=_SUCCESS;
+	u8 *p;
+	u8 *pHT_caps_ie=NULL;
+	u8 *pHT_info_ie=NULL;
+	struct sta_info *psta = NULL;
+	u16 cap, ht_cap=_FALSE;
+	uint ie_len = 0;
+	int group_cipher, pairwise_cipher;
+	u8	channel, network_type, supportRate[NDIS_802_11_LENGTH_RATES_EX];
+	int supportRateNum = 0;
+	u8 OUI1[] = {0x00, 0x50, 0xf2,0x01};
+	u8 wps_oui[4]={0x0,0x50,0xf2,0x04};
+	u8 WMM_PARA_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
+	struct registry_priv *pregistrypriv = &padapter->registrypriv;
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	WLAN_BSSID_EX *pbss_network = (WLAN_BSSID_EX *)&pmlmepriv->cur_network.network;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	u8 *ie = pbss_network->IEs;
+
+
+	/* SSID */
+	/* Supported rates */
+	/* DS Params */
+	/* WLAN_EID_COUNTRY */
+	/* ERP Information element */
+	/* Extended supported rates */
+	/* WPA/WPA2 */
+	/* Wi-Fi Wireless Multimedia Extensions */
+	/* ht_capab, ht_oper */
+	/* WPS IE */
+
+	DBG_871X("%s, len=%d\n", __FUNCTION__, len);
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return _FAIL;
+
+
+	if(len>MAX_IE_SZ)
+		return _FAIL;
+
+	pbss_network->IELength = len;
+
+	_rtw_memset(ie, 0, MAX_IE_SZ);
+
+	_rtw_memcpy(ie, pbuf, pbss_network->IELength);
+
+
+	if(pbss_network->InfrastructureMode!=Ndis802_11APMode)
+		return _FAIL;
+
+	pbss_network->Rssi = 0;
+
+	_rtw_memcpy(pbss_network->MacAddress, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	//beacon interval
+	p = rtw_get_beacon_interval_from_ie(ie);//ie + 8;	// 8: TimeStamp, 2: Beacon Interval 2:Capability
+	//pbss_network->Configuration.BeaconPeriod = le16_to_cpu(*(unsigned short*)p);
+	pbss_network->Configuration.BeaconPeriod = RTW_GET_LE16(p);
+
+	//capability
+	//cap = *(unsigned short *)rtw_get_capability_from_ie(ie);
+	//cap = le16_to_cpu(cap);
+	cap = RTW_GET_LE16(ie);
+
+	//SSID
+	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _SSID_IE_, &ie_len, (pbss_network->IELength -_BEACON_IE_OFFSET_));
+	if(p && ie_len>0)
+	{
+		_rtw_memset(&pbss_network->Ssid, 0, sizeof(NDIS_802_11_SSID));
+		_rtw_memcpy(pbss_network->Ssid.Ssid, (p + 2), ie_len);
+		pbss_network->Ssid.SsidLength = ie_len;
+	}
+
+	//chnnel
+	channel = 0;
+	pbss_network->Configuration.Length = 0;
+	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _DSSET_IE_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_));
+	if(p && ie_len>0)
+		channel = *(p + 2);
+
+	pbss_network->Configuration.DSConfig = channel;
+
+
+	_rtw_memset(supportRate, 0, NDIS_802_11_LENGTH_RATES_EX);
+	// get supported rates
+	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _SUPPORTEDRATES_IE_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_));
+	if (p !=  NULL)
+	{
+		_rtw_memcpy(supportRate, p+2, ie_len);
+		supportRateNum = ie_len;
+	}
+
+	//get ext_supported rates
+	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _EXT_SUPPORTEDRATES_IE_, &ie_len, pbss_network->IELength - _BEACON_IE_OFFSET_);
+	if (p !=  NULL)
+	{
+		_rtw_memcpy(supportRate+supportRateNum, p+2, ie_len);
+		supportRateNum += ie_len;
+
+	}
+
+	network_type = rtw_check_network_type(supportRate, supportRateNum, channel);
+
+	rtw_set_supported_rate(pbss_network->SupportedRates, network_type);
+
+
+	//parsing ERP_IE
+	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _ERPINFO_IE_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_));
+	if(p && ie_len>0)
+	{
+		ERP_IE_handler(padapter, (PNDIS_802_11_VARIABLE_IEs)p);
+	}
+
+	//update privacy/security
+	if (cap & BIT(4))
+		pbss_network->Privacy = 1;
+	else
+		pbss_network->Privacy = 0;
+
+	psecuritypriv->wpa_psk = 0;
+
+	//wpa2
+	group_cipher = 0; pairwise_cipher = 0;
+	psecuritypriv->wpa2_group_cipher = _NO_PRIVACY_;
+	psecuritypriv->wpa2_pairwise_cipher = _NO_PRIVACY_;
+	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _RSN_IE_2_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_));
+	if(p && ie_len>0)
+	{
+		if(rtw_parse_wpa2_ie(p, ie_len+2, &group_cipher, &pairwise_cipher) == _SUCCESS)
+		{
+			psecuritypriv->dot11AuthAlgrthm= dot11AuthAlgrthm_8021X;
+
+			psecuritypriv->dot8021xalg = 1;//psk,  todo:802.1x
+			psecuritypriv->wpa_psk |= BIT(1);
+
+			psecuritypriv->wpa2_group_cipher = group_cipher;
+			psecuritypriv->wpa2_pairwise_cipher = pairwise_cipher;
+#if 0
+			switch(group_cipher)
+			{
+				case WPA_CIPHER_NONE:
+				psecuritypriv->wpa2_group_cipher = _NO_PRIVACY_;
+				break;
+				case WPA_CIPHER_WEP40:
+				psecuritypriv->wpa2_group_cipher = _WEP40_;
+				break;
+				case WPA_CIPHER_TKIP:
+				psecuritypriv->wpa2_group_cipher = _TKIP_;
+				break;
+				case WPA_CIPHER_CCMP:
+				psecuritypriv->wpa2_group_cipher = _AES_;
+				break;
+				case WPA_CIPHER_WEP104:
+				psecuritypriv->wpa2_group_cipher = _WEP104_;
+				break;
+			}
+
+			switch(pairwise_cipher)
+			{
+				case WPA_CIPHER_NONE:
+				psecuritypriv->wpa2_pairwise_cipher = _NO_PRIVACY_;
+				break;
+				case WPA_CIPHER_WEP40:
+				psecuritypriv->wpa2_pairwise_cipher = _WEP40_;
+				break;
+				case WPA_CIPHER_TKIP:
+				psecuritypriv->wpa2_pairwise_cipher = _TKIP_;
+				break;
+				case WPA_CIPHER_CCMP:
+				psecuritypriv->wpa2_pairwise_cipher = _AES_;
+				break;
+				case WPA_CIPHER_WEP104:
+				psecuritypriv->wpa2_pairwise_cipher = _WEP104_;
+				break;
+			}
+#endif
+		}
+
+	}
+
+	//wpa
+	ie_len = 0;
+	group_cipher = 0; pairwise_cipher = 0;
+	psecuritypriv->wpa_group_cipher = _NO_PRIVACY_;
+	psecuritypriv->wpa_pairwise_cipher = _NO_PRIVACY_;
+	for (p = ie + _BEACON_IE_OFFSET_; ;p += (ie_len + 2))
+	{
+		p = rtw_get_ie(p, _SSN_IE_1_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_ - (ie_len + 2)));
+		if ((p) && (_rtw_memcmp(p+2, OUI1, 4)))
+		{
+			if(rtw_parse_wpa_ie(p, ie_len+2, &group_cipher, &pairwise_cipher) == _SUCCESS)
+			{
+				psecuritypriv->dot11AuthAlgrthm= dot11AuthAlgrthm_8021X;
+
+				psecuritypriv->dot8021xalg = 1;//psk,  todo:802.1x
+
+				psecuritypriv->wpa_psk |= BIT(0);
+
+				psecuritypriv->wpa_group_cipher = group_cipher;
+				psecuritypriv->wpa_pairwise_cipher = pairwise_cipher;
+
+#if 0
+				switch(group_cipher)
+				{
+					case WPA_CIPHER_NONE:
+					psecuritypriv->wpa_group_cipher = _NO_PRIVACY_;
+					break;
+					case WPA_CIPHER_WEP40:
+					psecuritypriv->wpa_group_cipher = _WEP40_;
+					break;
+					case WPA_CIPHER_TKIP:
+					psecuritypriv->wpa_group_cipher = _TKIP_;
+					break;
+					case WPA_CIPHER_CCMP:
+					psecuritypriv->wpa_group_cipher = _AES_;
+					break;
+					case WPA_CIPHER_WEP104:
+					psecuritypriv->wpa_group_cipher = _WEP104_;
+					break;
+				}
+
+				switch(pairwise_cipher)
+				{
+					case WPA_CIPHER_NONE:
+					psecuritypriv->wpa_pairwise_cipher = _NO_PRIVACY_;
+					break;
+					case WPA_CIPHER_WEP40:
+					psecuritypriv->wpa_pairwise_cipher = _WEP40_;
+					break;
+					case WPA_CIPHER_TKIP:
+					psecuritypriv->wpa_pairwise_cipher = _TKIP_;
+					break;
+					case WPA_CIPHER_CCMP:
+					psecuritypriv->wpa_pairwise_cipher = _AES_;
+					break;
+					case WPA_CIPHER_WEP104:
+					psecuritypriv->wpa_pairwise_cipher = _WEP104_;
+					break;
+				}
+#endif
+			}
+
+			break;
+
+		}
+
+		if ((p == NULL) || (ie_len == 0))
+		{
+				break;
+		}
+
+	}
+
+	//wmm
+	ie_len = 0;
+	pmlmepriv->qospriv.qos_option = 0;
+	if(pregistrypriv->wmm_enable)
+	{
+		for (p = ie + _BEACON_IE_OFFSET_; ;p += (ie_len + 2))
+		{
+			p = rtw_get_ie(p, _VENDOR_SPECIFIC_IE_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_ - (ie_len + 2)));
+			if((p) && _rtw_memcmp(p+2, WMM_PARA_IE, 6))
+			{
+				pmlmepriv->qospriv.qos_option = 1;
+
+				*(p+8) |= BIT(7);//QoS Info, support U-APSD
+
+				/* disable all ACM bits since the WMM admission control is not supported */
+				*(p + 10) &= ~BIT(4); /* BE */
+				*(p + 14) &= ~BIT(4); /* BK */
+				*(p + 18) &= ~BIT(4); /* VI */
+				*(p + 22) &= ~BIT(4); /* VO */
+
+				break;
+			}
+
+			if ((p == NULL) || (ie_len == 0))
+			{
+				break;
+			}
+		}
+	}
+
+	//parsing HT_CAP_IE
+	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_CAPABILITY_IE_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_));
+	if(p && ie_len>0)
+	{
+		u8 rf_type;
+
+		struct rtw_ieee80211_ht_cap *pht_cap = (struct rtw_ieee80211_ht_cap *)(p+2);
+
+		pHT_caps_ie=p;
+
+
+		ht_cap = _TRUE;
+		network_type |= WIRELESS_11_24N;
+
+
+		rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+
+		if((psecuritypriv->wpa_pairwise_cipher & WPA_CIPHER_CCMP) ||
+			(psecuritypriv->wpa2_pairwise_cipher & WPA_CIPHER_CCMP))
+		{
+			pht_cap->ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY&(0x07<<2));
+		}
+		else
+		{
+			pht_cap->ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY&0x00);
+		}
+
+		pht_cap->ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_FACTOR & 0x03); //set  Max Rx AMPDU size  to 64K
+
+		if(rf_type == RF_1T1R)
+		{
+			pht_cap->supp_mcs_set[0] = 0xff;
+			pht_cap->supp_mcs_set[1] = 0x0;
+		}
+
+		_rtw_memcpy(&pmlmepriv->htpriv.ht_cap, p+2, ie_len);
+
+	}
+
+	//parsing HT_INFO_IE
+	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_ADD_INFO_IE_, &ie_len, (pbss_network->IELength - _BEACON_IE_OFFSET_));
+	if(p && ie_len>0)
+	{
+		pHT_info_ie=p;
+	}
+
+	switch(network_type)
+	{
+		case WIRELESS_11B:
+			pbss_network->NetworkTypeInUse = Ndis802_11DS;
+			break;
+		case WIRELESS_11G:
+		case WIRELESS_11BG:
+             case WIRELESS_11G_24N:
+		case WIRELESS_11BG_24N:
+			pbss_network->NetworkTypeInUse = Ndis802_11OFDM24;
+			break;
+		case WIRELESS_11A:
+			pbss_network->NetworkTypeInUse = Ndis802_11OFDM5;
+			break;
+		default :
+			pbss_network->NetworkTypeInUse = Ndis802_11OFDM24;
+			break;
+	}
+
+	pmlmepriv->cur_network.network_type = network_type;
+
+
+	pmlmepriv->htpriv.ht_option = _FALSE;
+#ifdef CONFIG_80211N_HT
+	if( (psecuritypriv->wpa2_pairwise_cipher&WPA_CIPHER_TKIP) ||
+		      (psecuritypriv->wpa_pairwise_cipher&WPA_CIPHER_TKIP))
+	{
+		//todo:
+		//ht_cap = _FALSE;
+	}
+
+	//ht_cap
+	if(pregistrypriv->ht_enable && ht_cap==_TRUE)
+	{
+		pmlmepriv->htpriv.ht_option = _TRUE;
+		pmlmepriv->qospriv.qos_option = 1;
+
+		if(pregistrypriv->ampdu_enable==1)
+		{
+			pmlmepriv->htpriv.ampdu_enable = _TRUE;
+		}
+
+		HT_caps_handler(padapter, (PNDIS_802_11_VARIABLE_IEs)pHT_caps_ie);
+
+		HT_info_handler(padapter, (PNDIS_802_11_VARIABLE_IEs)pHT_info_ie);
+	}
+#endif
+
+
+	pbss_network->Length = get_WLAN_BSSID_EX_sz((WLAN_BSSID_EX  *)pbss_network);
+
+	//issue beacon to start bss network
+	start_bss_network(padapter, (u8*)pbss_network);
+
+
+	//alloc sta_info for ap itself
+	psta = rtw_get_stainfo(&padapter->stapriv, pbss_network->MacAddress);
+	if(!psta)
+	{
+		psta = rtw_alloc_stainfo(&padapter->stapriv, pbss_network->MacAddress);
+		if (psta == NULL)
+		{
+			return _FAIL;
+		}
+	}
+	psta->state |= WIFI_AP_STATE;		//Aries, add,fix bug of flush_cam_entry at STOP AP mode , 0724
+	rtw_indicate_connect( padapter);
+
+	pmlmepriv->cur_network.join_res = _TRUE;//for check if already set beacon
+
+	//update bc/mc sta_info
+	//update_bmc_sta(padapter);
+
+	return ret;
+
+}
+
+void rtw_set_macaddr_acl(_adapter *padapter, int mode)
+{
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
+
+	DBG_871X("%s, mode=%d\n", __func__, mode);
+
+	pacl_list->mode = mode;
+}
+
+int rtw_acl_add_sta(_adapter *padapter, u8 *addr)
+{
+	_irqL irqL;
+	_list	*plist, *phead;
+	u8 added = _FALSE;
+	int i, ret=0;
+	struct rtw_wlan_acl_node *paclnode;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
+	_queue	*pacl_node_q =&pacl_list->acl_node_q;
+
+	DBG_871X("%s(acl_num=%d)=" MAC_FMT "\n", __func__, pacl_list->num, MAC_ARG(addr));
+
+	if((NUM_ACL-1) < pacl_list->num)
+		return (-1);
+
+
+	_enter_critical_bh(&(pacl_node_q->lock), &irqL);
+
+	phead = get_list_head(pacl_node_q);
+	plist = get_next(phead);
+
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+	{
+		paclnode = LIST_CONTAINOR(plist, struct rtw_wlan_acl_node, list);
+		plist = get_next(plist);
+
+		if(_rtw_memcmp(paclnode->addr, addr, ETH_ALEN))
+		{
+			if(paclnode->valid == _TRUE)
+			{
+				added = _TRUE;
+				DBG_871X("%s, sta has been added\n", __func__);
+				break;
+			}
+		}
+	}
+
+	_exit_critical_bh(&(pacl_node_q->lock), &irqL);
+
+
+	if(added == _TRUE)
+		return ret;
+
+
+	_enter_critical_bh(&(pacl_node_q->lock), &irqL);
+
+	for(i=0; i< NUM_ACL; i++)
+	{
+		paclnode = &pacl_list->aclnode[i];
+
+		if(paclnode->valid == _FALSE)
+		{
+			_rtw_init_listhead(&paclnode->list);
+
+			_rtw_memcpy(paclnode->addr, addr, ETH_ALEN);
+
+			paclnode->valid = _TRUE;
+
+			rtw_list_insert_tail(&paclnode->list, get_list_head(pacl_node_q));
+
+			pacl_list->num++;
+
+			break;
+		}
+	}
+
+	DBG_871X("%s, acl_num=%d\n", __func__, pacl_list->num);
+
+	_exit_critical_bh(&(pacl_node_q->lock), &irqL);
+
+	return ret;
+}
+
+int rtw_acl_remove_sta(_adapter *padapter, u8 *addr)
+{
+	_irqL irqL;
+	_list	*plist, *phead;
+	int i, ret=0;
+	struct rtw_wlan_acl_node *paclnode;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
+	_queue	*pacl_node_q =&pacl_list->acl_node_q;
+
+	DBG_871X("%s(acl_num=%d)=" MAC_FMT "\n", __func__, pacl_list->num, MAC_ARG(addr));
+
+	_enter_critical_bh(&(pacl_node_q->lock), &irqL);
+
+	phead = get_list_head(pacl_node_q);
+	plist = get_next(phead);
+
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+	{
+		paclnode = LIST_CONTAINOR(plist, struct rtw_wlan_acl_node, list);
+		plist = get_next(plist);
+
+		if(_rtw_memcmp(paclnode->addr, addr, ETH_ALEN))
+		{
+			if(paclnode->valid == _TRUE)
+			{
+				paclnode->valid = _FALSE;
+
+				rtw_list_delete(&paclnode->list);
+
+				pacl_list->num--;
+			}
+		}
+	}
+
+	_exit_critical_bh(&(pacl_node_q->lock), &irqL);
+
+	DBG_871X("%s, acl_num=%d\n", __func__, pacl_list->num);
+
+	return ret;
+
+}
+
+#ifdef CONFIG_NATIVEAP_MLME
+
+static void update_bcn_fixed_ie(_adapter *padapter)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+
+}
+
+static void update_bcn_erpinfo_ie(_adapter *padapter)
+{
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX *pnetwork = &(pmlmeinfo->network);
+	unsigned char *p, *ie = pnetwork->IEs;
+	u32 len = 0;
+
+	DBG_871X("%s, ERP_enable=%d\n", __FUNCTION__, pmlmeinfo->ERP_enable);
+
+	if(!pmlmeinfo->ERP_enable)
+		return;
+
+	//parsing ERP_IE
+	p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _ERPINFO_IE_, &len, (pnetwork->IELength - _BEACON_IE_OFFSET_));
+	if(p && len>0)
+	{
+		PNDIS_802_11_VARIABLE_IEs pIE = (PNDIS_802_11_VARIABLE_IEs)p;
+
+		if (pmlmepriv->num_sta_non_erp == 1)
+			pIE->data[0] |= RTW_ERP_INFO_NON_ERP_PRESENT|RTW_ERP_INFO_USE_PROTECTION;
+		else
+			pIE->data[0] &= ~(RTW_ERP_INFO_NON_ERP_PRESENT|RTW_ERP_INFO_USE_PROTECTION);
+
+		if(pmlmepriv->num_sta_no_short_preamble > 0)
+			pIE->data[0] |= RTW_ERP_INFO_BARKER_PREAMBLE_MODE;
+		else
+			pIE->data[0] &= ~(RTW_ERP_INFO_BARKER_PREAMBLE_MODE);
+
+		ERP_IE_handler(padapter, pIE);
+	}
+
+}
+
+static void update_bcn_htcap_ie(_adapter *padapter)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+
+}
+
+static void update_bcn_htinfo_ie(_adapter *padapter)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+
+}
+
+static void update_bcn_rsn_ie(_adapter *padapter)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+
+}
+
+static void update_bcn_wpa_ie(_adapter *padapter)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+
+}
+
+static void update_bcn_wmm_ie(_adapter *padapter)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+
+}
+
+static void update_bcn_wps_ie(_adapter *padapter)
+{
+	u8 *pwps_ie=NULL, *pwps_ie_src, *premainder_ie, *pbackup_remainder_ie=NULL;
+	uint wps_ielen=0, wps_offset, remainder_ielen;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX *pnetwork = &(pmlmeinfo->network);
+	unsigned char *ie = pnetwork->IEs;
+	u32 ielen = pnetwork->IELength;
+
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	pwps_ie = rtw_get_wps_ie(ie+_FIXED_IE_LENGTH_, ielen-_FIXED_IE_LENGTH_, NULL, &wps_ielen);
+
+	if(pwps_ie==NULL || wps_ielen==0)
+		return;
+
+	wps_offset = (uint)(pwps_ie-ie);
+
+	premainder_ie = pwps_ie + wps_ielen;
+
+	remainder_ielen = ielen - wps_offset - wps_ielen;
+
+	if(remainder_ielen>0)
+	{
+		pbackup_remainder_ie = rtw_malloc(remainder_ielen);
+		if(pbackup_remainder_ie)
+			_rtw_memcpy(pbackup_remainder_ie, premainder_ie, remainder_ielen);
+	}
+
+
+	pwps_ie_src = pmlmepriv->wps_beacon_ie;
+	if(pwps_ie_src == NULL)
+		return;
+
+
+	wps_ielen = (uint)pwps_ie_src[1];//to get ie data len
+	if((wps_offset+wps_ielen+2+remainder_ielen)<=MAX_IE_SZ)
+	{
+		_rtw_memcpy(pwps_ie, pwps_ie_src, wps_ielen+2);
+		pwps_ie += (wps_ielen+2);
+
+		if(pbackup_remainder_ie)
+			_rtw_memcpy(pwps_ie, pbackup_remainder_ie, remainder_ielen);
+
+		//update IELength
+		pnetwork->IELength = wps_offset + (wps_ielen+2) + remainder_ielen;
+	}
+
+	if(pbackup_remainder_ie)
+		rtw_mfree(pbackup_remainder_ie, remainder_ielen);
+
+}
+
+static void update_bcn_p2p_ie(_adapter *padapter)
+{
+
+}
+
+static void update_bcn_vendor_spec_ie(_adapter *padapter, u8*oui)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+
+	if(_rtw_memcmp(RTW_WPA_OUI, oui, 4))
+	{
+		update_bcn_wpa_ie(padapter);
+	}
+	else if(_rtw_memcmp(WMM_OUI, oui, 4))
+	{
+		update_bcn_wmm_ie(padapter);
+	}
+	else if(_rtw_memcmp(WPS_OUI, oui, 4))
+	{
+		update_bcn_wps_ie(padapter);
+	}
+	else if(_rtw_memcmp(P2P_OUI, oui, 4))
+	{
+		update_bcn_p2p_ie(padapter);
+	}
+	else
+	{
+		DBG_871X("unknown OUI type!\n");
+	}
+
+
+}
+
+void update_beacon(_adapter *padapter, u8 ie_id, u8 *oui, u8 tx)
+{
+	_irqL irqL;
+	struct mlme_priv *pmlmepriv;
+	struct mlme_ext_priv	*pmlmeext;
+	//struct mlme_ext_info	*pmlmeinfo;
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	if(!padapter)
+		return;
+
+	pmlmepriv = &(padapter->mlmepriv);
+	pmlmeext = &(padapter->mlmeextpriv);
+	//pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if(_FALSE == pmlmeext->bstart_bss)
+		return;
+
+	_enter_critical_bh(&pmlmepriv->bcn_update_lock, &irqL);
+
+	switch(ie_id)
+	{
+		case 0xFF:
+
+			update_bcn_fixed_ie(padapter);//8: TimeStamp, 2: Beacon Interval 2:Capability
+
+			break;
+
+		case _TIM_IE_:
+
+			update_BCNTIM(padapter);
+
+			break;
+
+		case _ERPINFO_IE_:
+
+			update_bcn_erpinfo_ie(padapter);
+
+			break;
+
+		case _HT_CAPABILITY_IE_:
+
+			update_bcn_htcap_ie(padapter);
+
+			break;
+
+		case _RSN_IE_2_:
+
+			update_bcn_rsn_ie(padapter);
+
+			break;
+
+		case _HT_ADD_INFO_IE_:
+
+			update_bcn_htinfo_ie(padapter);
+
+			break;
+
+		case _VENDOR_SPECIFIC_IE_:
+
+			update_bcn_vendor_spec_ie(padapter, oui);
+
+			break;
+
+		default:
+			break;
+	}
+
+	pmlmepriv->update_bcn = _TRUE;
+
+	_exit_critical_bh(&pmlmepriv->bcn_update_lock, &irqL);
+
+#ifndef CONFIG_INTERRUPT_BASED_TXBCN
+#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI) || defined(CONFIG_GSPI_HCI)
+	if(tx)
+	{
+		//send_beacon(padapter);//send_beacon must execute on TSR level
+		set_tx_beacon_cmd(padapter);
+	}
+#else
+	{
+		//PCI will issue beacon when BCN interrupt occurs.
+	}
+#endif
+#endif //!CONFIG_INTERRUPT_BASED_TXBCN
+
+}
+
+#ifdef CONFIG_80211N_HT
+
+/*
+op_mode
+Set to 0 (HT pure) under the followign conditions
+	- all STAs in the BSS are 20/40 MHz HT in 20/40 MHz BSS or
+	- all STAs in the BSS are 20 MHz HT in 20 MHz BSS
+Set to 1 (HT non-member protection) if there may be non-HT STAs
+	in both the primary and the secondary channel
+Set to 2 if only HT STAs are associated in BSS,
+	however and at least one 20 MHz HT STA is associated
+Set to 3 (HT mixed mode) when one or more non-HT STAs are associated
+	(currently non-GF HT station is considered as non-HT STA also)
+*/
+static int rtw_ht_operation_update(_adapter *padapter)
+{
+	u16 cur_op_mode, new_op_mode;
+	int op_mode_changes = 0;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct ht_priv	*phtpriv_ap = &pmlmepriv->htpriv;
+
+	if(pmlmepriv->htpriv.ht_option == _TRUE)
+		return 0;
+
+	//if (!iface->conf->ieee80211n || iface->conf->ht_op_mode_fixed)
+	//	return 0;
+
+	DBG_871X("%s current operation mode=0x%X\n",
+		   __FUNCTION__, pmlmepriv->ht_op_mode);
+
+	if (!(pmlmepriv->ht_op_mode & HT_INFO_OPERATION_MODE_NON_GF_DEVS_PRESENT)
+	    && pmlmepriv->num_sta_ht_no_gf) {
+		pmlmepriv->ht_op_mode |=
+			HT_INFO_OPERATION_MODE_NON_GF_DEVS_PRESENT;
+		op_mode_changes++;
+	} else if ((pmlmepriv->ht_op_mode &
+		    HT_INFO_OPERATION_MODE_NON_GF_DEVS_PRESENT) &&
+		   pmlmepriv->num_sta_ht_no_gf == 0) {
+		pmlmepriv->ht_op_mode &=
+			~HT_INFO_OPERATION_MODE_NON_GF_DEVS_PRESENT;
+		op_mode_changes++;
+	}
+
+	if (!(pmlmepriv->ht_op_mode & HT_INFO_OPERATION_MODE_NON_HT_STA_PRESENT) &&
+	    (pmlmepriv->num_sta_no_ht || pmlmepriv->olbc_ht)) {
+		pmlmepriv->ht_op_mode |= HT_INFO_OPERATION_MODE_NON_HT_STA_PRESENT;
+		op_mode_changes++;
+	} else if ((pmlmepriv->ht_op_mode &
+		    HT_INFO_OPERATION_MODE_NON_HT_STA_PRESENT) &&
+		   (pmlmepriv->num_sta_no_ht == 0 && !pmlmepriv->olbc_ht)) {
+		pmlmepriv->ht_op_mode &=
+			~HT_INFO_OPERATION_MODE_NON_HT_STA_PRESENT;
+		op_mode_changes++;
+	}
+
+	/* Note: currently we switch to the MIXED op mode if HT non-greenfield
+	 * station is associated. Probably it's a theoretical case, since
+	 * it looks like all known HT STAs support greenfield.
+	 */
+	new_op_mode = 0;
+	if (pmlmepriv->num_sta_no_ht ||
+	    (pmlmepriv->ht_op_mode & HT_INFO_OPERATION_MODE_NON_GF_DEVS_PRESENT))
+		new_op_mode = OP_MODE_MIXED;
+	else if ((phtpriv_ap->ht_cap.cap_info & IEEE80211_HT_CAP_SUP_WIDTH)
+		 && pmlmepriv->num_sta_ht_20mhz)
+		new_op_mode = OP_MODE_20MHZ_HT_STA_ASSOCED;
+	else if (pmlmepriv->olbc_ht)
+		new_op_mode = OP_MODE_MAY_BE_LEGACY_STAS;
+	else
+		new_op_mode = OP_MODE_PURE;
+
+	cur_op_mode = pmlmepriv->ht_op_mode & HT_INFO_OPERATION_MODE_OP_MODE_MASK;
+	if (cur_op_mode != new_op_mode) {
+		pmlmepriv->ht_op_mode &= ~HT_INFO_OPERATION_MODE_OP_MODE_MASK;
+		pmlmepriv->ht_op_mode |= new_op_mode;
+		op_mode_changes++;
+	}
+
+	DBG_871X("%s new operation mode=0x%X changes=%d\n",
+		   __FUNCTION__, pmlmepriv->ht_op_mode, op_mode_changes);
+
+	return op_mode_changes;
+
+}
+
+#endif /* CONFIG_80211N_HT */
+
+void associated_clients_update(_adapter *padapter, u8 updated)
+{
+	//update associcated stations cap.
+	if(updated == _TRUE)
+	{
+		_irqL irqL;
+		_list	*phead, *plist;
+		struct sta_info *psta=NULL;
+		struct sta_priv *pstapriv = &padapter->stapriv;
+
+		_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+		phead = &pstapriv->asoc_list;
+		plist = get_next(phead);
+
+		//check asoc_queue
+		while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+		{
+			psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
+
+			plist = get_next(plist);
+
+			VCS_update(padapter, psta);
+		}
+
+		_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	}
+
+}
+
+/* called > TSR LEVEL for USB or SDIO Interface*/
+void bss_cap_update_on_sta_join(_adapter *padapter, struct sta_info *psta)
+{
+	u8 beacon_updated = _FALSE;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
+
+
+#if 0
+	if (!(psta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) &&
+	    !psta->no_short_preamble_set) {
+		psta->no_short_preamble_set = 1;
+		pmlmepriv->num_sta_no_short_preamble++;
+		if ((pmlmeext->cur_wireless_mode > WIRELESS_11B) &&
+		     (pmlmepriv->num_sta_no_short_preamble == 1))
+			ieee802_11_set_beacons(hapd->iface);
+	}
+#endif
+
+
+	if(!(psta->flags & WLAN_STA_SHORT_PREAMBLE))
+	{
+		if(!psta->no_short_preamble_set)
+		{
+			psta->no_short_preamble_set = 1;
+
+			pmlmepriv->num_sta_no_short_preamble++;
+
+			if ((pmlmeext->cur_wireless_mode > WIRELESS_11B) &&
+				(pmlmepriv->num_sta_no_short_preamble == 1))
+			{
+				beacon_updated = _TRUE;
+				update_beacon(padapter, 0xFF, NULL, _TRUE);
+			}
+
+		}
+	}
+	else
+	{
+		if(psta->no_short_preamble_set)
+		{
+			psta->no_short_preamble_set = 0;
+
+			pmlmepriv->num_sta_no_short_preamble--;
+
+			if ((pmlmeext->cur_wireless_mode > WIRELESS_11B) &&
+				(pmlmepriv->num_sta_no_short_preamble == 0))
+			{
+				beacon_updated = _TRUE;
+				update_beacon(padapter, 0xFF, NULL, _TRUE);
+			}
+
+		}
+	}
+
+#if 0
+	if (psta->flags & WLAN_STA_NONERP && !psta->nonerp_set) {
+		psta->nonerp_set = 1;
+		pmlmepriv->num_sta_non_erp++;
+		if (pmlmepriv->num_sta_non_erp == 1)
+			ieee802_11_set_beacons(hapd->iface);
+	}
+#endif
+
+	if(psta->flags & WLAN_STA_NONERP)
+	{
+		if(!psta->nonerp_set)
+		{
+			psta->nonerp_set = 1;
+
+			pmlmepriv->num_sta_non_erp++;
+
+			if (pmlmepriv->num_sta_non_erp == 1)
+			{
+				beacon_updated = _TRUE;
+				update_beacon(padapter, _ERPINFO_IE_, NULL, _TRUE);
+			}
+		}
+
+	}
+	else
+	{
+		if(psta->nonerp_set)
+		{
+			psta->nonerp_set = 0;
+
+			pmlmepriv->num_sta_non_erp--;
+
+			if (pmlmepriv->num_sta_non_erp == 0)
+			{
+				beacon_updated = _TRUE;
+				update_beacon(padapter, _ERPINFO_IE_, NULL, _TRUE);
+			}
+		}
+
+	}
+
+
+#if 0
+	if (!(psta->capability & WLAN_CAPABILITY_SHORT_SLOT) &&
+	    !psta->no_short_slot_time_set) {
+		psta->no_short_slot_time_set = 1;
+		pmlmepriv->num_sta_no_short_slot_time++;
+		if ((pmlmeext->cur_wireless_mode > WIRELESS_11B) &&
+		    (pmlmepriv->num_sta_no_short_slot_time == 1))
+			ieee802_11_set_beacons(hapd->iface);
+	}
+#endif
+
+	if(!(psta->capability & WLAN_CAPABILITY_SHORT_SLOT))
+	{
+		if(!psta->no_short_slot_time_set)
+		{
+			psta->no_short_slot_time_set = 1;
+
+			pmlmepriv->num_sta_no_short_slot_time++;
+
+			if ((pmlmeext->cur_wireless_mode > WIRELESS_11B) &&
+				 (pmlmepriv->num_sta_no_short_slot_time == 1))
+			{
+				beacon_updated = _TRUE;
+				update_beacon(padapter, 0xFF, NULL, _TRUE);
+			}
+
+		}
+	}
+	else
+	{
+		if(psta->no_short_slot_time_set)
+		{
+			psta->no_short_slot_time_set = 0;
+
+			pmlmepriv->num_sta_no_short_slot_time--;
+
+			if ((pmlmeext->cur_wireless_mode > WIRELESS_11B) &&
+				 (pmlmepriv->num_sta_no_short_slot_time == 0))
+			{
+				beacon_updated = _TRUE;
+				update_beacon(padapter, 0xFF, NULL, _TRUE);
+			}
+		}
+	}
+
+#ifdef CONFIG_80211N_HT
+
+	if (psta->flags & WLAN_STA_HT)
+	{
+		u16 ht_capab = le16_to_cpu(psta->htpriv.ht_cap.cap_info);
+
+		DBG_871X("HT: STA " MAC_FMT " HT Capabilities "
+			   "Info: 0x%04x\n", MAC_ARG(psta->hwaddr), ht_capab);
+
+		if (psta->no_ht_set) {
+			psta->no_ht_set = 0;
+			pmlmepriv->num_sta_no_ht--;
+		}
+
+		if ((ht_capab & IEEE80211_HT_CAP_GRN_FLD) == 0) {
+			if (!psta->no_ht_gf_set) {
+				psta->no_ht_gf_set = 1;
+				pmlmepriv->num_sta_ht_no_gf++;
+			}
+			DBG_871X("%s STA " MAC_FMT " - no "
+				   "greenfield, num of non-gf stations %d\n",
+				   __FUNCTION__, MAC_ARG(psta->hwaddr),
+				   pmlmepriv->num_sta_ht_no_gf);
+		}
+
+		if ((ht_capab & IEEE80211_HT_CAP_SUP_WIDTH) == 0) {
+			if (!psta->ht_20mhz_set) {
+				psta->ht_20mhz_set = 1;
+				pmlmepriv->num_sta_ht_20mhz++;
+			}
+			DBG_871X("%s STA " MAC_FMT " - 20 MHz HT, "
+				   "num of 20MHz HT STAs %d\n",
+				   __FUNCTION__, MAC_ARG(psta->hwaddr),
+				   pmlmepriv->num_sta_ht_20mhz);
+		}
+
+	}
+	else
+	{
+		if (!psta->no_ht_set) {
+			psta->no_ht_set = 1;
+			pmlmepriv->num_sta_no_ht++;
+		}
+		if(pmlmepriv->htpriv.ht_option == _TRUE) {
+			DBG_871X("%s STA " MAC_FMT
+				   " - no HT, num of non-HT stations %d\n",
+				   __FUNCTION__, MAC_ARG(psta->hwaddr),
+				   pmlmepriv->num_sta_no_ht);
+		}
+	}
+
+	if (rtw_ht_operation_update(padapter) > 0)
+	{
+		update_beacon(padapter, _HT_CAPABILITY_IE_, NULL, _FALSE);
+		update_beacon(padapter, _HT_ADD_INFO_IE_, NULL, _TRUE);
+	}
+
+#endif /* CONFIG_80211N_HT */
+
+	//update associcated stations cap.
+	associated_clients_update(padapter,  beacon_updated);
+
+	DBG_871X("%s, updated=%d\n", __func__, beacon_updated);
+
+}
+
+u8 bss_cap_update_on_sta_leave(_adapter *padapter, struct sta_info *psta)
+{
+	u8 beacon_updated = _FALSE;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
+
+	if(!psta)
+		return beacon_updated;
+
+	if (psta->no_short_preamble_set) {
+		psta->no_short_preamble_set = 0;
+		pmlmepriv->num_sta_no_short_preamble--;
+		if (pmlmeext->cur_wireless_mode > WIRELESS_11B
+		    && pmlmepriv->num_sta_no_short_preamble == 0)
+		{
+			beacon_updated = _TRUE;
+			update_beacon(padapter, 0xFF, NULL, _TRUE);
+		}
+	}
+
+	if (psta->nonerp_set) {
+		psta->nonerp_set = 0;
+		pmlmepriv->num_sta_non_erp--;
+		if (pmlmepriv->num_sta_non_erp == 0)
+		{
+			beacon_updated = _TRUE;
+			update_beacon(padapter, _ERPINFO_IE_, NULL, _TRUE);
+		}
+	}
+
+	if (psta->no_short_slot_time_set) {
+		psta->no_short_slot_time_set = 0;
+		pmlmepriv->num_sta_no_short_slot_time--;
+		if (pmlmeext->cur_wireless_mode > WIRELESS_11B
+		    && pmlmepriv->num_sta_no_short_slot_time == 0)
+		{
+			beacon_updated = _TRUE;
+			update_beacon(padapter, 0xFF, NULL, _TRUE);
+		}
+	}
+
+#ifdef CONFIG_80211N_HT
+
+	if (psta->no_ht_gf_set) {
+		psta->no_ht_gf_set = 0;
+		pmlmepriv->num_sta_ht_no_gf--;
+	}
+
+	if (psta->no_ht_set) {
+		psta->no_ht_set = 0;
+		pmlmepriv->num_sta_no_ht--;
+	}
+
+	if (psta->ht_20mhz_set) {
+		psta->ht_20mhz_set = 0;
+		pmlmepriv->num_sta_ht_20mhz--;
+	}
+
+	if (rtw_ht_operation_update(padapter) > 0)
+	{
+		update_beacon(padapter, _HT_CAPABILITY_IE_, NULL, _FALSE);
+		update_beacon(padapter, _HT_ADD_INFO_IE_, NULL, _TRUE);
+	}
+
+#endif /* CONFIG_80211N_HT */
+
+	//update associcated stations cap.
+	//associated_clients_update(padapter,  beacon_updated); //move it to avoid deadlock
+
+	DBG_871X("%s, updated=%d\n", __func__, beacon_updated);
+
+	return beacon_updated;
+
+}
+
+u8 ap_free_sta(_adapter *padapter, struct sta_info *psta, bool active, u16 reason)
+{
+	_irqL irqL;
+	u8 beacon_updated = _FALSE;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	if(!psta)
+		return beacon_updated;
+
+	if (active == _TRUE)
+	{
+#ifdef CONFIG_80211N_HT
+		//tear down Rx AMPDU
+		send_delba(padapter, 0, psta->hwaddr);// recipient
+
+		//tear down TX AMPDU
+		send_delba(padapter, 1, psta->hwaddr);// // originator
+
+#endif //CONFIG_80211N_HT
+
+		issue_deauth(padapter, psta->hwaddr, reason);
+	}
+
+	psta->htpriv.agg_enable_bitmap = 0x0;//reset
+	psta->htpriv.candidate_tid_bitmap = 0x0;//reset
+
+
+	//report_del_sta_event(padapter, psta->hwaddr, reason);
+
+	//clear cam entry / key
+	//clear_cam_entry(padapter, (psta->mac_id + 3));
+	rtw_clearstakey_cmd(padapter, (u8*)psta, (u8)(psta->mac_id + 3), _TRUE);
+
+
+	_enter_critical_bh(&psta->lock, &irqL);
+	psta->state &= ~_FW_LINKED;
+	_exit_critical_bh(&psta->lock, &irqL);
+
+	#ifdef CONFIG_IOCTL_CFG80211
+	if (1) {
+		#ifdef COMPAT_KERNEL_RELEASE
+		rtw_cfg80211_indicate_sta_disassoc(padapter, psta->hwaddr, reason);
+		#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) && !defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+		rtw_cfg80211_indicate_sta_disassoc(padapter, psta->hwaddr, reason);
+		#else //(LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) && !defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+		/* will call rtw_cfg80211_indicate_sta_disassoc() in cmd_thread for old API context */
+		#endif //(LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) && !defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+	} else
+	#endif //CONFIG_IOCTL_CFG80211
+	{
+		rtw_indicate_sta_disassoc_event(padapter, psta);
+	}
+
+	report_del_sta_event(padapter, psta->hwaddr, reason);
+
+	beacon_updated = bss_cap_update_on_sta_leave(padapter, psta);
+
+	_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+	rtw_free_stainfo(padapter, psta);
+	_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+
+
+	return beacon_updated;
+
+}
+
+int rtw_ap_inform_ch_switch(_adapter *padapter, u8 new_ch, u8 ch_offset)
+{
+	_irqL irqL;
+	_list	*phead, *plist;
+	int ret=0;
+	struct sta_info *psta = NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 bc_addr[ETH_ALEN] = {0xff,0xff,0xff,0xff,0xff,0xff};
+
+	if((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
+		return ret;
+
+	DBG_871X(FUNC_NDEV_FMT" with ch:%u, offset:%u\n",
+		FUNC_NDEV_ARG(padapter->pnetdev), new_ch, ch_offset);
+
+	_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+	phead = &pstapriv->asoc_list;
+	plist = get_next(phead);
+
+	/* for each sta in asoc_queue */
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+	{
+		psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
+		plist = get_next(plist);
+
+		issue_action_spct_ch_switch(padapter, psta->hwaddr, new_ch, ch_offset);
+		psta->expire_to = ((pstapriv->expire_to * 2) > 5) ? 5 : (pstapriv->expire_to * 2);
+	}
+	_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	issue_action_spct_ch_switch(padapter, bc_addr, new_ch, ch_offset);
+
+	return ret;
+}
+
+int rtw_sta_flush(_adapter *padapter)
+{
+	_irqL irqL;
+	_list	*phead, *plist;
+	int ret=0;
+	struct sta_info *psta = NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 bc_addr[ETH_ALEN] = {0xff,0xff,0xff,0xff,0xff,0xff};
+	u8 chk_alive_num = 0;
+	char chk_alive_list[NUM_STA];
+	int i;
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(padapter->pnetdev));
+
+	if((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
+		return ret;
+
+	_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+	phead = &pstapriv->asoc_list;
+	plist = get_next(phead);
+
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE) {
+		int stainfo_offset;
+
+		psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
+		plist = get_next(plist);
+
+		/* Remove sta from asoc_list */
+		rtw_list_delete(&psta->asoc_list);
+		pstapriv->asoc_list_cnt--;
+
+		/* Keep sta for ap_free_sta() beyond this asoc_list loop */
+		stainfo_offset = rtw_stainfo_offset(pstapriv, psta);
+		if (stainfo_offset_valid(stainfo_offset)) {
+			chk_alive_list[chk_alive_num++] = stainfo_offset;
+		}
+	}
+	_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+
+	/* For each sta in chk_alive_list, call ap_free_sta */
+	for (i = 0; i < chk_alive_num; i++) {
+		psta = rtw_get_stainfo_by_offset(pstapriv, chk_alive_list[i]);
+		ap_free_sta(padapter, psta, _TRUE, WLAN_REASON_DEAUTH_LEAVING);
+	}
+
+	issue_deauth(padapter, bc_addr, WLAN_REASON_DEAUTH_LEAVING);
+
+	associated_clients_update(padapter, _TRUE);
+
+	return ret;
+
+}
+
+/* called > TSR LEVEL for USB or SDIO Interface*/
+void sta_info_update(_adapter *padapter, struct sta_info *psta)
+{
+	int flags = psta->flags;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+
+	//update wmm cap.
+	if(WLAN_STA_WME&flags)
+		psta->qos_option = 1;
+	else
+		psta->qos_option = 0;
+
+	if(pmlmepriv->qospriv.qos_option == 0)
+		psta->qos_option = 0;
+
+
+#ifdef CONFIG_80211N_HT
+	//update 802.11n ht cap.
+	if(WLAN_STA_HT&flags)
+	{
+		psta->htpriv.ht_option = _TRUE;
+		psta->qos_option = 1;
+	}
+	else
+	{
+		psta->htpriv.ht_option = _FALSE;
+	}
+
+	if(pmlmepriv->htpriv.ht_option == _FALSE)
+		psta->htpriv.ht_option = _FALSE;
+#endif
+
+
+	update_sta_info_apmode(padapter, psta);
+
+
+}
+
+/* called >= TSR LEVEL for USB or SDIO Interface*/
+void ap_sta_info_defer_update(_adapter *padapter, struct sta_info *psta)
+{
+	if(psta->state & _FW_LINKED)
+	{
+		//add ratid
+		add_RATid(padapter, psta);
+	}
+}
+
+/* restore hw setting from sw data structures */
+void rtw_ap_restore_network(_adapter *padapter)
+{
+	struct mlme_priv *mlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct sta_priv * pstapriv = &padapter->stapriv;
+	struct sta_info *psta;
+	struct security_priv* psecuritypriv=&(padapter->securitypriv);
+	_irqL irqL;
+	_list	*phead, *plist;
+	u8 chk_alive_num = 0;
+	char chk_alive_list[NUM_STA];
+	int i;
+
+	rtw_setopmode_cmd(padapter, Ndis802_11APMode);
+
+	set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+
+	start_bss_network(padapter, (u8*)&mlmepriv->cur_network.network);
+
+	if((padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_) ||
+		(padapter->securitypriv.dot11PrivacyAlgrthm == _AES_))
+	{
+		/* restore group key, WEP keys is restored in ips_leave() */
+		rtw_set_key(padapter, psecuritypriv, psecuritypriv->dot118021XGrpKeyid, 0);
+	}
+
+	/* per sta pairwise key and settings */
+	if((padapter->securitypriv.dot11PrivacyAlgrthm != _TKIP_) &&
+		(padapter->securitypriv.dot11PrivacyAlgrthm != _AES_)) {
+		return;
+	}
+
+	_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	phead = &pstapriv->asoc_list;
+	plist = get_next(phead);
+
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE) {
+		int stainfo_offset;
+
+		psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
+		plist = get_next(plist);
+
+		stainfo_offset = rtw_stainfo_offset(pstapriv, psta);
+		if (stainfo_offset_valid(stainfo_offset)) {
+			chk_alive_list[chk_alive_num++] = stainfo_offset;
+		}
+	}
+
+	_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	for (i = 0; i < chk_alive_num; i++) {
+		psta = rtw_get_stainfo_by_offset(pstapriv, chk_alive_list[i]);
+
+		if (psta == NULL) {
+			DBG_871X(FUNC_ADPT_FMT" sta_info is null\n", FUNC_ADPT_ARG(padapter));
+		} else if (psta->state &_FW_LINKED) {
+			Update_RA_Entry(padapter, psta->mac_id);
+			//pairwise key
+			rtw_setstakey_cmd(padapter, (unsigned char *)psta, _TRUE);
+		}
+	}
+
+}
+
+void start_ap_mode(_adapter *padapter)
+{
+	int i;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
+
+	pmlmepriv->update_bcn = _FALSE;
+
+	//init_mlme_ap_info(padapter);
+	pmlmeext->bstart_bss = _FALSE;
+
+	pmlmepriv->num_sta_non_erp = 0;
+
+	pmlmepriv->num_sta_no_short_slot_time = 0;
+
+	pmlmepriv->num_sta_no_short_preamble = 0;
+
+	pmlmepriv->num_sta_ht_no_gf = 0;
+
+	pmlmepriv->num_sta_no_ht = 0;
+
+	pmlmepriv->num_sta_ht_20mhz = 0;
+
+	pmlmepriv->olbc = _FALSE;
+
+	pmlmepriv->olbc_ht = _FALSE;
+
+#ifdef CONFIG_80211N_HT
+	pmlmepriv->ht_op_mode = 0;
+#endif
+
+	for(i=0; i<NUM_STA; i++)
+		pstapriv->sta_aid[i] = NULL;
+
+	pmlmepriv->wps_beacon_ie = NULL;
+	pmlmepriv->wps_probe_resp_ie = NULL;
+	pmlmepriv->wps_assoc_resp_ie = NULL;
+
+	pmlmepriv->p2p_beacon_ie = NULL;
+	pmlmepriv->p2p_probe_resp_ie = NULL;
+
+
+	//for ACL
+	_rtw_init_listhead(&(pacl_list->acl_node_q.queue));
+	pacl_list->num = 0;
+	pacl_list->mode = 0;
+	for(i = 0; i < NUM_ACL; i++)
+	{
+		_rtw_init_listhead(&pacl_list->aclnode[i].list);
+		pacl_list->aclnode[i].valid = _FALSE;
+	}
+
+}
+
+void stop_ap_mode(_adapter *padapter)
+{
+	_irqL irqL;
+	_list	*phead, *plist;
+	struct rtw_wlan_acl_node *paclnode;
+	struct sta_info *psta=NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
+	_queue	*pacl_node_q =&pacl_list->acl_node_q;
+
+	pmlmepriv->update_bcn = _FALSE;
+	pmlmeext->bstart_bss = _FALSE;
+	//_rtw_spinlock_free(&pmlmepriv->bcn_update_lock);
+
+	//reset and init security priv , this can refine with rtw_reset_securitypriv
+	_rtw_memset((unsigned char *)&padapter->securitypriv, 0, sizeof (struct security_priv));
+	padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeOpen;
+	padapter->securitypriv.ndisencryptstatus = Ndis802_11WEPDisabled;
+
+	//for ACL
+	_enter_critical_bh(&(pacl_node_q->lock), &irqL);
+	phead = get_list_head(pacl_node_q);
+	plist = get_next(phead);
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+	{
+		paclnode = LIST_CONTAINOR(plist, struct rtw_wlan_acl_node, list);
+		plist = get_next(plist);
+
+		if(paclnode->valid == _TRUE)
+		{
+			paclnode->valid = _FALSE;
+
+			rtw_list_delete(&paclnode->list);
+
+			pacl_list->num--;
+		}
+	}
+	_exit_critical_bh(&(pacl_node_q->lock), &irqL);
+
+	DBG_871X("%s, free acl_node_queue, num=%d\n", __func__, pacl_list->num);
+
+	rtw_sta_flush(padapter);
+
+	//free_assoc_sta_resources
+	rtw_free_all_stainfo(padapter);
+
+	psta = rtw_get_bcmc_stainfo(padapter);
+	_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+	rtw_free_stainfo(padapter, psta);
+	_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+
+	rtw_init_bcmc_stainfo(padapter);
+
+	rtw_free_mlme_priv_ie_data(pmlmepriv);
+
+}
+
+#endif //CONFIG_NATIVEAP_MLME
+#endif //CONFIG_AP_MODE
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_br_ext.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_br_ext.c
new file mode 100644
index 000000000000..39289c970543
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_br_ext.c
@@ -0,0 +1,1700 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_BR_EXT_C_
+
+#ifdef __KERNEL__
+#include <linux/if_arp.h>
+#include <net/ip.h>
+#include <net/ipx.h>
+#include <linux/atalk.h>
+#include <linux/udp.h>
+#include <linux/if_pppox.h>
+#endif
+
+#if 1	// rtw_wifi_driver
+#include <drv_conf.h>
+#include <drv_types.h>
+#include "rtw_br_ext.h"
+#else	// rtw_wifi_driver
+#include "./8192cd_cfg.h"
+
+#ifndef __KERNEL__
+#include "./sys-support.h"
+#endif
+
+#include "./8192cd.h"
+#include "./8192cd_headers.h"
+#include "./8192cd_br_ext.h"
+#include "./8192cd_debug.h"
+#endif	// rtw_wifi_driver
+
+#ifdef CL_IPV6_PASS
+#ifdef __KERNEL__
+#include <linux/ipv6.h>
+#include <linux/icmpv6.h>
+#include <net/ndisc.h>
+#include <net/checksum.h>
+#include <net/ip6_checksum.h>
+#endif
+#endif
+
+#ifdef CONFIG_BR_EXT
+
+//#define BR_EXT_DEBUG
+
+#define NAT25_IPV4		01
+#define NAT25_IPV6		02
+#define NAT25_IPX		03
+#define NAT25_APPLE		04
+#define NAT25_PPPOE		05
+
+#define RTL_RELAY_TAG_LEN (ETH_ALEN)
+#define TAG_HDR_LEN		4
+
+#define MAGIC_CODE		0x8186
+#define MAGIC_CODE_LEN	2
+#define WAIT_TIME_PPPOE	5	// waiting time for pppoe server in sec
+
+/*-----------------------------------------------------------------
+  How database records network address:
+           0    1    2    3    4    5    6    7    8    9   10
+        |----|----|----|----|----|----|----|----|----|----|----|
+  IPv4  |type|                             |      IP addr      |
+  IPX   |type|      Net addr     |          Node addr          |
+  IPX   |type|      Net addr     |Sckt addr|
+  Apple |type| Network |node|
+  PPPoE |type|   SID   |           AC MAC            |
+-----------------------------------------------------------------*/
+
+
+//Find a tag in pppoe frame and return the pointer
+static __inline__ unsigned char *__nat25_find_pppoe_tag(struct pppoe_hdr *ph, unsigned short type)
+{
+	unsigned char *cur_ptr, *start_ptr;
+	unsigned short tagLen, tagType;
+
+	start_ptr = cur_ptr = (unsigned char *)ph->tag;
+	while((cur_ptr - start_ptr) < ntohs(ph->length)) {
+		// prevent un-alignment access
+		tagType = (unsigned short)((cur_ptr[0] << 8) + cur_ptr[1]);
+		tagLen  = (unsigned short)((cur_ptr[2] << 8) + cur_ptr[3]);
+		if(tagType == type)
+			return cur_ptr;
+		cur_ptr = cur_ptr + TAG_HDR_LEN + tagLen;
+	}
+	return 0;
+}
+
+
+static __inline__ int __nat25_add_pppoe_tag(struct sk_buff *skb, struct pppoe_tag *tag)
+{
+	struct pppoe_hdr *ph = (struct pppoe_hdr *)(skb->data + ETH_HLEN);
+	int data_len;
+
+	data_len = tag->tag_len + TAG_HDR_LEN;
+	if (skb_tailroom(skb) < data_len) {
+		_DEBUG_ERR("skb_tailroom() failed in add SID tag!\n");
+		return -1;
+	}
+
+	skb_put(skb, data_len);
+	// have a room for new tag
+	memmove(((unsigned char *)ph->tag + data_len), (unsigned char *)ph->tag, ntohs(ph->length));
+	ph->length = htons(ntohs(ph->length) + data_len);
+	memcpy((unsigned char *)ph->tag, tag, data_len);
+	return data_len;
+}
+
+static int skb_pull_and_merge(struct sk_buff *skb, unsigned char *src, int len)
+{
+	int tail_len;
+	unsigned long end, tail;
+
+	if ((src+len) > skb_tail_pointer(skb) || skb->len < len)
+		return -1;
+
+	tail = (unsigned long)skb_tail_pointer(skb);
+	end = (unsigned long)src+len;
+	if (tail < end)
+		return -1;
+
+	tail_len = (int)(tail-end);
+	if (tail_len > 0)
+		memmove(src, src+len, tail_len);
+
+	skb_trim(skb, skb->len-len);
+	return 0;
+}
+
+static __inline__ unsigned long __nat25_timeout(_adapter *priv)
+{
+	unsigned long timeout;
+
+	timeout = jiffies - NAT25_AGEING_TIME*HZ;
+
+	return timeout;
+}
+
+
+static __inline__ int  __nat25_has_expired(_adapter *priv,
+				struct nat25_network_db_entry *fdb)
+{
+	if(time_before_eq(fdb->ageing_timer, __nat25_timeout(priv)))
+		return 1;
+
+	return 0;
+}
+
+
+static __inline__ void __nat25_generate_ipv4_network_addr(unsigned char *networkAddr,
+				unsigned int *ipAddr)
+{
+	memset(networkAddr, 0, MAX_NETWORK_ADDR_LEN);
+
+	networkAddr[0] = NAT25_IPV4;
+	memcpy(networkAddr+7, (unsigned char *)ipAddr, 4);
+}
+
+
+static __inline__ void __nat25_generate_ipx_network_addr_with_node(unsigned char *networkAddr,
+				unsigned int *ipxNetAddr, unsigned char *ipxNodeAddr)
+{
+	memset(networkAddr, 0, MAX_NETWORK_ADDR_LEN);
+
+	networkAddr[0] = NAT25_IPX;
+	memcpy(networkAddr+1, (unsigned char *)ipxNetAddr, 4);
+	memcpy(networkAddr+5, ipxNodeAddr, 6);
+}
+
+
+static __inline__ void __nat25_generate_ipx_network_addr_with_socket(unsigned char *networkAddr,
+				unsigned int *ipxNetAddr, unsigned short *ipxSocketAddr)
+{
+	memset(networkAddr, 0, MAX_NETWORK_ADDR_LEN);
+
+	networkAddr[0] = NAT25_IPX;
+	memcpy(networkAddr+1, (unsigned char *)ipxNetAddr, 4);
+	memcpy(networkAddr+5, (unsigned char *)ipxSocketAddr, 2);
+}
+
+
+static __inline__ void __nat25_generate_apple_network_addr(unsigned char *networkAddr,
+				unsigned short *network, unsigned char *node)
+{
+	memset(networkAddr, 0, MAX_NETWORK_ADDR_LEN);
+
+	networkAddr[0] = NAT25_APPLE;
+	memcpy(networkAddr+1, (unsigned char *)network, 2);
+	networkAddr[3] = *node;
+}
+
+
+static __inline__ void __nat25_generate_pppoe_network_addr(unsigned char *networkAddr,
+				unsigned char *ac_mac, unsigned short *sid)
+{
+	memset(networkAddr, 0, MAX_NETWORK_ADDR_LEN);
+
+	networkAddr[0] = NAT25_PPPOE;
+	memcpy(networkAddr+1, (unsigned char *)sid, 2);
+	memcpy(networkAddr+3, (unsigned char *)ac_mac, 6);
+}
+
+
+#ifdef CL_IPV6_PASS
+static  void __nat25_generate_ipv6_network_addr(unsigned char *networkAddr,
+				unsigned int *ipAddr)
+{
+	memset(networkAddr, 0, MAX_NETWORK_ADDR_LEN);
+
+	networkAddr[0] = NAT25_IPV6;
+	memcpy(networkAddr+1, (unsigned char *)ipAddr, 16);
+}
+
+
+static unsigned char *scan_tlv(unsigned char *data, int len, unsigned char tag, unsigned char len8b)
+{
+	while (len > 0) {
+		if (*data == tag && *(data+1) == len8b && len >= len8b*8)
+			return data+2;
+
+		len -= (*(data+1))*8;
+		data += (*(data+1))*8;
+	}
+	return NULL;
+}
+
+
+static int update_nd_link_layer_addr(unsigned char *data, int len, unsigned char *replace_mac)
+{
+	struct icmp6hdr *icmphdr = (struct icmp6hdr *)data;
+	unsigned char *mac;
+
+	if (icmphdr->icmp6_type == NDISC_ROUTER_SOLICITATION) {
+		if (len >= 8) {
+			mac = scan_tlv(&data[8], len-8, 1, 1);
+			if (mac) {
+				_DEBUG_INFO("Router Solicitation, replace MAC From: %02x:%02x:%02x:%02x:%02x:%02x, To: %02x:%02x:%02x:%02x:%02x:%02x\n",
+					mac[0],mac[1],mac[2],mac[3],mac[4],mac[5],
+					replace_mac[0],replace_mac[1],replace_mac[2],replace_mac[3],replace_mac[4],replace_mac[5]);
+				memcpy(mac, replace_mac, 6);
+				return 1;
+			}
+		}
+	}
+	else if (icmphdr->icmp6_type == NDISC_ROUTER_ADVERTISEMENT) {
+		if (len >= 16) {
+			mac = scan_tlv(&data[16], len-16, 1, 1);
+			if (mac) {
+				_DEBUG_INFO("Router Advertisement, replace MAC From: %02x:%02x:%02x:%02x:%02x:%02x, To: %02x:%02x:%02x:%02x:%02x:%02x\n",
+					mac[0],mac[1],mac[2],mac[3],mac[4],mac[5],
+					replace_mac[0],replace_mac[1],replace_mac[2],replace_mac[3],replace_mac[4],replace_mac[5]);
+				memcpy(mac, replace_mac, 6);
+				return 1;
+			}
+		}
+	}
+	else if (icmphdr->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION) {
+		if (len >= 24) {
+			mac = scan_tlv(&data[24], len-24, 1, 1);
+			if (mac) {
+				_DEBUG_INFO("Neighbor Solicitation, replace MAC From: %02x:%02x:%02x:%02x:%02x:%02x, To: %02x:%02x:%02x:%02x:%02x:%02x\n",
+					mac[0],mac[1],mac[2],mac[3],mac[4],mac[5],
+					replace_mac[0],replace_mac[1],replace_mac[2],replace_mac[3],replace_mac[4],replace_mac[5]);
+				memcpy(mac, replace_mac, 6);
+				return 1;
+			}
+		}
+	}
+	else if (icmphdr->icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT) {
+		if (len >= 24) {
+			mac = scan_tlv(&data[24], len-24, 2, 1);
+			if (mac) {
+				_DEBUG_INFO("Neighbor Advertisement, replace MAC From: %02x:%02x:%02x:%02x:%02x:%02x, To: %02x:%02x:%02x:%02x:%02x:%02x\n",
+					mac[0],mac[1],mac[2],mac[3],mac[4],mac[5],
+					replace_mac[0],replace_mac[1],replace_mac[2],replace_mac[3],replace_mac[4],replace_mac[5]);
+				memcpy(mac, replace_mac, 6);
+				return 1;
+			}
+		}
+	}
+	else if (icmphdr->icmp6_type == NDISC_REDIRECT) {
+		if (len >= 40) {
+			mac = scan_tlv(&data[40], len-40, 2, 1);
+			if (mac) {
+				_DEBUG_INFO("Redirect,  replace MAC From: %02x:%02x:%02x:%02x:%02x:%02x, To: %02x:%02x:%02x:%02x:%02x:%02x\n",
+					mac[0],mac[1],mac[2],mac[3],mac[4],mac[5],
+					replace_mac[0],replace_mac[1],replace_mac[2],replace_mac[3],replace_mac[4],replace_mac[5]);
+				memcpy(mac, replace_mac, 6);
+				return 1;
+			}
+		}
+	}
+	return 0;
+}
+
+
+static void convert_ipv6_mac_to_mc(struct sk_buff *skb)
+{
+	struct ipv6hdr *iph = (struct ipv6hdr *)(skb->data + ETH_HLEN);
+	unsigned char *dst_mac = skb->data;
+
+	//dst_mac[0] = 0xff;
+	//dst_mac[1] = 0xff;
+	/*modified by qinjunjie,ipv6 multicast address ix 0x33-33-xx-xx-xx-xx*/
+	dst_mac[0] = 0x33;
+	dst_mac[1] = 0x33;
+	memcpy(&dst_mac[2], &iph->daddr.s6_addr32[3], 4);
+	#if defined(__LINUX_2_6__)
+	/*modified by qinjunjie,warning:should not remove next line*/
+	skb->pkt_type = PACKET_MULTICAST;
+	#endif
+}
+#endif /* CL_IPV6_PASS */
+
+
+static __inline__ int __nat25_network_hash(unsigned char *networkAddr)
+{
+	if(networkAddr[0] == NAT25_IPV4)
+	{
+		unsigned long x;
+
+		x = networkAddr[7] ^ networkAddr[8] ^ networkAddr[9] ^ networkAddr[10];
+
+		return x & (NAT25_HASH_SIZE - 1);
+	}
+	else if(networkAddr[0] == NAT25_IPX)
+	{
+		unsigned long x;
+
+		x = networkAddr[1] ^ networkAddr[2] ^ networkAddr[3] ^ networkAddr[4] ^ networkAddr[5] ^
+			networkAddr[6] ^ networkAddr[7] ^ networkAddr[8] ^ networkAddr[9] ^ networkAddr[10];
+
+		return x & (NAT25_HASH_SIZE - 1);
+	}
+	else if(networkAddr[0] == NAT25_APPLE)
+	{
+		unsigned long x;
+
+		x = networkAddr[1] ^ networkAddr[2] ^ networkAddr[3];
+
+		return x & (NAT25_HASH_SIZE - 1);
+	}
+	else if(networkAddr[0] == NAT25_PPPOE)
+	{
+		unsigned long x;
+
+		x = networkAddr[0] ^ networkAddr[1] ^ networkAddr[2] ^ networkAddr[3] ^ networkAddr[4] ^ networkAddr[5] ^ networkAddr[6] ^ networkAddr[7] ^ networkAddr[8];
+
+		return x & (NAT25_HASH_SIZE - 1);
+	}
+#ifdef CL_IPV6_PASS
+	else if(networkAddr[0] == NAT25_IPV6)
+	{
+		unsigned long x;
+
+		x = networkAddr[1] ^ networkAddr[2] ^ networkAddr[3] ^ networkAddr[4] ^ networkAddr[5] ^
+			networkAddr[6] ^ networkAddr[7] ^ networkAddr[8] ^ networkAddr[9] ^ networkAddr[10] ^
+			networkAddr[11] ^ networkAddr[12] ^ networkAddr[13] ^ networkAddr[14] ^ networkAddr[15] ^
+			networkAddr[16];
+
+		return x & (NAT25_HASH_SIZE - 1);
+	}
+#endif
+	else
+	{
+		unsigned long x = 0;
+		int i;
+
+		for (i=0; i<MAX_NETWORK_ADDR_LEN; i++)
+			x ^= networkAddr[i];
+
+		return x & (NAT25_HASH_SIZE - 1);
+	}
+}
+
+
+static __inline__ void __network_hash_link(_adapter *priv,
+				struct nat25_network_db_entry *ent, int hash)
+{
+	// Caller must _enter_critical_bh already!
+	//_irqL irqL;
+	//_enter_critical_bh(&priv->br_ext_lock, &irqL);
+
+	ent->next_hash = priv->nethash[hash];
+	if(ent->next_hash != NULL)
+		ent->next_hash->pprev_hash = &ent->next_hash;
+	priv->nethash[hash] = ent;
+	ent->pprev_hash = &priv->nethash[hash];
+
+	//_exit_critical_bh(&priv->br_ext_lock, &irqL);
+}
+
+
+static __inline__ void __network_hash_unlink(struct nat25_network_db_entry *ent)
+{
+	// Caller must _enter_critical_bh already!
+	//_irqL irqL;
+	//_enter_critical_bh(&priv->br_ext_lock, &irqL);
+
+	*(ent->pprev_hash) = ent->next_hash;
+	if(ent->next_hash != NULL)
+		ent->next_hash->pprev_hash = ent->pprev_hash;
+	ent->next_hash = NULL;
+	ent->pprev_hash = NULL;
+
+	//_exit_critical_bh(&priv->br_ext_lock, &irqL);
+}
+
+
+static int __nat25_db_network_lookup_and_replace(_adapter *priv,
+				struct sk_buff *skb, unsigned char *networkAddr)
+{
+	struct nat25_network_db_entry *db;
+	_irqL irqL;
+	_enter_critical_bh(&priv->br_ext_lock, &irqL);
+
+	db = priv->nethash[__nat25_network_hash(networkAddr)];
+	while (db != NULL)
+	{
+		if(!memcmp(db->networkAddr, networkAddr, MAX_NETWORK_ADDR_LEN))
+		{
+			if(!__nat25_has_expired(priv, db))
+			{
+				// replace the destination mac address
+				memcpy(skb->data, db->macAddr, ETH_ALEN);
+				atomic_inc(&db->use_count);
+
+#ifdef CL_IPV6_PASS
+				DEBUG_INFO("NAT25: Lookup M:%02x%02x%02x%02x%02x%02x N:%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x"
+							"%02x%02x%02x%02x%02x%02x\n",
+					db->macAddr[0],
+					db->macAddr[1],
+					db->macAddr[2],
+					db->macAddr[3],
+					db->macAddr[4],
+					db->macAddr[5],
+					db->networkAddr[0],
+					db->networkAddr[1],
+					db->networkAddr[2],
+					db->networkAddr[3],
+					db->networkAddr[4],
+					db->networkAddr[5],
+					db->networkAddr[6],
+					db->networkAddr[7],
+					db->networkAddr[8],
+					db->networkAddr[9],
+					db->networkAddr[10],
+					db->networkAddr[11],
+					db->networkAddr[12],
+					db->networkAddr[13],
+					db->networkAddr[14],
+					db->networkAddr[15],
+					db->networkAddr[16]);
+#else
+				DEBUG_INFO("NAT25: Lookup M:%02x%02x%02x%02x%02x%02x N:%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n",
+					db->macAddr[0],
+					db->macAddr[1],
+					db->macAddr[2],
+					db->macAddr[3],
+					db->macAddr[4],
+					db->macAddr[5],
+					db->networkAddr[0],
+					db->networkAddr[1],
+					db->networkAddr[2],
+					db->networkAddr[3],
+					db->networkAddr[4],
+					db->networkAddr[5],
+					db->networkAddr[6],
+					db->networkAddr[7],
+					db->networkAddr[8],
+					db->networkAddr[9],
+					db->networkAddr[10]);
+#endif
+			}
+			_exit_critical_bh(&priv->br_ext_lock, &irqL);
+			return 1;
+		}
+
+		db = db->next_hash;
+	}
+
+	_exit_critical_bh(&priv->br_ext_lock, &irqL);
+	return 0;
+}
+
+
+static void __nat25_db_network_insert(_adapter *priv,
+				unsigned char *macAddr, unsigned char *networkAddr)
+{
+	struct nat25_network_db_entry *db;
+	int hash;
+	_irqL irqL;
+	_enter_critical_bh(&priv->br_ext_lock, &irqL);
+
+	hash = __nat25_network_hash(networkAddr);
+	db = priv->nethash[hash];
+	while (db != NULL)
+	{
+		if(!memcmp(db->networkAddr, networkAddr, MAX_NETWORK_ADDR_LEN))
+		{
+			memcpy(db->macAddr, macAddr, ETH_ALEN);
+			db->ageing_timer = jiffies;
+			_exit_critical_bh(&priv->br_ext_lock, &irqL);
+			return;
+		}
+
+		db = db->next_hash;
+	}
+
+	db = (struct nat25_network_db_entry *) rtw_malloc(sizeof(*db));
+	if(db == NULL) {
+		_exit_critical_bh(&priv->br_ext_lock, &irqL);
+		return;
+	}
+
+	memcpy(db->networkAddr, networkAddr, MAX_NETWORK_ADDR_LEN);
+	memcpy(db->macAddr, macAddr, ETH_ALEN);
+	atomic_set(&db->use_count, 1);
+	db->ageing_timer = jiffies;
+
+	__network_hash_link(priv, db, hash);
+
+	_exit_critical_bh(&priv->br_ext_lock, &irqL);
+}
+
+
+static void __nat25_db_print(_adapter *priv)
+{
+	_irqL irqL;
+	_enter_critical_bh(&priv->br_ext_lock, &irqL);
+
+#ifdef BR_EXT_DEBUG
+	static int counter = 0;
+	int i, j;
+	struct nat25_network_db_entry *db;
+
+	counter++;
+	if((counter % 16) != 0)
+		return;
+
+	for(i=0, j=0; i<NAT25_HASH_SIZE; i++)
+	{
+		db = priv->nethash[i];
+
+		while (db != NULL)
+		{
+#ifdef CL_IPV6_PASS
+			panic_printk("NAT25: DB(%d) H(%02d) C(%d) M:%02x%02x%02x%02x%02x%02x N:%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x"
+					"%02x%02x%02x%02x%02x%02x\n",
+				j,
+				i,
+				atomic_read(&db->use_count),
+				db->macAddr[0],
+				db->macAddr[1],
+				db->macAddr[2],
+				db->macAddr[3],
+				db->macAddr[4],
+				db->macAddr[5],
+				db->networkAddr[0],
+				db->networkAddr[1],
+				db->networkAddr[2],
+				db->networkAddr[3],
+				db->networkAddr[4],
+				db->networkAddr[5],
+				db->networkAddr[6],
+				db->networkAddr[7],
+				db->networkAddr[8],
+				db->networkAddr[9],
+				db->networkAddr[10],
+				db->networkAddr[11],
+				db->networkAddr[12],
+				db->networkAddr[13],
+				db->networkAddr[14],
+				db->networkAddr[15],
+				db->networkAddr[16]);
+#else
+			panic_printk("NAT25: DB(%d) H(%02d) C(%d) M:%02x%02x%02x%02x%02x%02x N:%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n",
+				j,
+				i,
+				atomic_read(&db->use_count),
+				db->macAddr[0],
+				db->macAddr[1],
+				db->macAddr[2],
+				db->macAddr[3],
+				db->macAddr[4],
+				db->macAddr[5],
+				db->networkAddr[0],
+				db->networkAddr[1],
+				db->networkAddr[2],
+				db->networkAddr[3],
+				db->networkAddr[4],
+				db->networkAddr[5],
+				db->networkAddr[6],
+				db->networkAddr[7],
+				db->networkAddr[8],
+				db->networkAddr[9],
+				db->networkAddr[10]);
+#endif
+			j++;
+
+			db = db->next_hash;
+		}
+	}
+#endif
+
+	_exit_critical_bh(&priv->br_ext_lock, &irqL);
+}
+
+
+
+
+/*
+ *	NAT2.5 interface
+ */
+
+void nat25_db_cleanup(_adapter *priv)
+{
+	int i;
+	_irqL irqL;
+	_enter_critical_bh(&priv->br_ext_lock, &irqL);
+
+	for(i=0; i<NAT25_HASH_SIZE; i++)
+	{
+		struct nat25_network_db_entry *f;
+		f = priv->nethash[i];
+		while (f != NULL) {
+			struct nat25_network_db_entry *g;
+
+			g = f->next_hash;
+			if(priv->scdb_entry == f)
+			{
+				memset(priv->scdb_mac, 0, ETH_ALEN);
+				memset(priv->scdb_ip, 0, 4);
+				priv->scdb_entry = NULL;
+			}
+			__network_hash_unlink(f);
+			rtw_mfree((u8 *) f, sizeof(struct nat25_network_db_entry));
+
+			f = g;
+		}
+	}
+
+	_exit_critical_bh(&priv->br_ext_lock, &irqL);
+}
+
+
+void nat25_db_expire(_adapter *priv)
+{
+	int i;
+	_irqL irqL;
+	_enter_critical_bh(&priv->br_ext_lock, &irqL);
+
+	//if(!priv->ethBrExtInfo.nat25_disable)
+	{
+		for (i=0; i<NAT25_HASH_SIZE; i++)
+		{
+			struct nat25_network_db_entry *f;
+			f = priv->nethash[i];
+
+			while (f != NULL)
+			{
+				struct nat25_network_db_entry *g;
+				g = f->next_hash;
+
+				if(__nat25_has_expired(priv, f))
+				{
+					if(atomic_dec_and_test(&f->use_count))
+					{
+#ifdef BR_EXT_DEBUG
+#ifdef CL_IPV6_PASS
+						panic_printk("NAT25 Expire H(%02d) M:%02x%02x%02x%02x%02x%02x N:%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x"
+								"%02x%02x%02x%02x%02x%02x\n",
+							i,
+							f->macAddr[0],
+							f->macAddr[1],
+							f->macAddr[2],
+							f->macAddr[3],
+							f->macAddr[4],
+							f->macAddr[5],
+							f->networkAddr[0],
+							f->networkAddr[1],
+							f->networkAddr[2],
+							f->networkAddr[3],
+							f->networkAddr[4],
+							f->networkAddr[5],
+							f->networkAddr[6],
+							f->networkAddr[7],
+							f->networkAddr[8],
+							f->networkAddr[9],
+							f->networkAddr[10],
+							f->networkAddr[11],
+							f->networkAddr[12],
+							f->networkAddr[13],
+							f->networkAddr[14],
+							f->networkAddr[15],
+							f->networkAddr[16]);
+#else
+
+						panic_printk("NAT25 Expire H(%02d) M:%02x%02x%02x%02x%02x%02x N:%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n",
+							i,
+							f->macAddr[0],
+							f->macAddr[1],
+							f->macAddr[2],
+							f->macAddr[3],
+							f->macAddr[4],
+							f->macAddr[5],
+							f->networkAddr[0],
+							f->networkAddr[1],
+							f->networkAddr[2],
+							f->networkAddr[3],
+							f->networkAddr[4],
+							f->networkAddr[5],
+							f->networkAddr[6],
+							f->networkAddr[7],
+							f->networkAddr[8],
+							f->networkAddr[9],
+							f->networkAddr[10]);
+#endif
+#endif
+						if(priv->scdb_entry == f)
+						{
+							memset(priv->scdb_mac, 0, ETH_ALEN);
+							memset(priv->scdb_ip, 0, 4);
+							priv->scdb_entry = NULL;
+						}
+						__network_hash_unlink(f);
+						rtw_mfree((u8 *) f, sizeof(struct nat25_network_db_entry));
+					}
+				}
+
+				f = g;
+			}
+		}
+	}
+
+	_exit_critical_bh(&priv->br_ext_lock, &irqL);
+}
+
+
+#ifdef SUPPORT_TX_MCAST2UNI
+static int checkIPMcAndReplace(_adapter *priv, struct sk_buff *skb, unsigned int *dst_ip)
+{
+	struct stat_info	*pstat;
+	struct list_head	*phead, *plist;
+	int i;
+
+	phead = &priv->asoc_list;
+	plist = phead->next;
+
+	while (plist != phead) {
+		pstat = list_entry(plist, struct stat_info, asoc_list);
+		plist = plist->next;
+
+		if (pstat->ipmc_num == 0)
+			continue;
+
+		for (i=0; i<MAX_IP_MC_ENTRY; i++) {
+			if (pstat->ipmc[i].used && !memcmp(&pstat->ipmc[i].mcmac[3], ((unsigned char *)dst_ip)+1, 3)) {
+				memcpy(skb->data, pstat->ipmc[i].mcmac, ETH_ALEN);
+				return 1;
+			}
+		}
+	}
+	return 0;
+}
+#endif
+
+int nat25_db_handle(_adapter *priv, struct sk_buff *skb, int method)
+{
+	unsigned short protocol;
+	unsigned char networkAddr[MAX_NETWORK_ADDR_LEN];
+
+	if(skb == NULL)
+		return -1;
+
+	if((method <= NAT25_MIN) || (method >= NAT25_MAX))
+		return -1;
+
+	protocol = *((unsigned short *)(skb->data + 2 * ETH_ALEN));
+
+	/*---------------------------------------------------*/
+	/*                 Handle IP frame                   */
+	/*---------------------------------------------------*/
+	if(protocol == __constant_htons(ETH_P_IP))
+	{
+		struct iphdr* iph = (struct iphdr *)(skb->data + ETH_HLEN);
+
+		if(((unsigned char*)(iph) + (iph->ihl<<2)) >= (skb->data + ETH_HLEN + skb->len))
+		{
+			DEBUG_WARN("NAT25: malformed IP packet !\n");
+			return -1;
+		}
+
+		switch(method)
+		{
+			case NAT25_CHECK:
+				return -1;
+
+			case NAT25_INSERT:
+				{
+					//some muticast with source IP is all zero, maybe other case is illegal
+					//in class A, B, C, host address is all zero or all one is illegal
+					if (iph->saddr == 0)
+						return 0;
+					DEBUG_INFO("NAT25: Insert IP, SA=%08x, DA=%08x\n", iph->saddr, iph->daddr);
+					__nat25_generate_ipv4_network_addr(networkAddr, &iph->saddr);
+					//record source IP address and , source mac address into db
+					__nat25_db_network_insert(priv, skb->data+ETH_ALEN, networkAddr);
+
+					__nat25_db_print(priv);
+				}
+				return 0;
+
+			case NAT25_LOOKUP:
+				{
+					DEBUG_INFO("NAT25: Lookup IP, SA=%08x, DA=%08x\n", iph->saddr, iph->daddr);
+#ifdef SUPPORT_TX_MCAST2UNI
+					if (priv->pshare->rf_ft_var.mc2u_disable ||
+							((((OPMODE & (WIFI_STATION_STATE|WIFI_ASOC_STATE))
+							== (WIFI_STATION_STATE|WIFI_ASOC_STATE)) &&
+							!checkIPMcAndReplace(priv, skb, &iph->daddr)) ||
+							(OPMODE & WIFI_ADHOC_STATE)))
+#endif
+					{
+						__nat25_generate_ipv4_network_addr(networkAddr, &iph->daddr);
+
+						if (!__nat25_db_network_lookup_and_replace(priv, skb, networkAddr)) {
+							if (*((unsigned char *)&iph->daddr + 3) == 0xff) {
+								// L2 is unicast but L3 is broadcast, make L2 bacome broadcast
+								DEBUG_INFO("NAT25: Set DA as boardcast\n");
+								memset(skb->data, 0xff, ETH_ALEN);
+							}
+							else {
+								// forward unknow IP packet to upper TCP/IP
+								DEBUG_INFO("NAT25: Replace DA with BR's MAC\n");
+								if ( (*(u32 *)priv->br_mac) == 0 && (*(u16 *)(priv->br_mac+4)) == 0 ) {
+									void netdev_br_init(struct net_device *netdev);
+									printk("Re-init netdev_br_init() due to br_mac==0!\n");
+									netdev_br_init(priv->pnetdev);
+								}
+								memcpy(skb->data, priv->br_mac, ETH_ALEN);
+							}
+						}
+					}
+				}
+				return 0;
+
+			default:
+				return -1;
+		}
+	}
+
+	/*---------------------------------------------------*/
+	/*                 Handle ARP frame                  */
+	/*---------------------------------------------------*/
+	else if(protocol == __constant_htons(ETH_P_ARP))
+	{
+		struct arphdr *arp = (struct arphdr *)(skb->data + ETH_HLEN);
+		unsigned char *arp_ptr = (unsigned char *)(arp + 1);
+		unsigned int *sender, *target;
+
+		if(arp->ar_pro != __constant_htons(ETH_P_IP))
+		{
+			DEBUG_WARN("NAT25: arp protocol unknown (%4x)!\n", htons(arp->ar_pro));
+			return -1;
+		}
+
+		switch(method)
+		{
+			case NAT25_CHECK:
+				return 0;	// skb_copy for all ARP frame
+
+			case NAT25_INSERT:
+				{
+					DEBUG_INFO("NAT25: Insert ARP, MAC=%02x%02x%02x%02x%02x%02x\n", arp_ptr[0],
+						arp_ptr[1], arp_ptr[2], arp_ptr[3], arp_ptr[4], arp_ptr[5]);
+
+					// change to ARP sender mac address to wlan STA address
+                                        memcpy(arp_ptr, GET_MY_HWADDR(priv), ETH_ALEN);
+
+					arp_ptr += arp->ar_hln;
+					sender = (unsigned int *)arp_ptr;
+
+					__nat25_generate_ipv4_network_addr(networkAddr, sender);
+
+					__nat25_db_network_insert(priv, skb->data+ETH_ALEN, networkAddr);
+
+					__nat25_db_print(priv);
+				}
+				return 0;
+
+			case NAT25_LOOKUP:
+				{
+					DEBUG_INFO("NAT25: Lookup ARP\n");
+
+					arp_ptr += arp->ar_hln;
+					sender = (unsigned int *)arp_ptr;
+					arp_ptr += (arp->ar_hln + arp->ar_pln);
+					target = (unsigned int *)arp_ptr;
+
+					__nat25_generate_ipv4_network_addr(networkAddr, target);
+
+					__nat25_db_network_lookup_and_replace(priv, skb, networkAddr);
+
+					// change to ARP target mac address to Lookup result
+					arp_ptr = (unsigned char *)(arp + 1);
+					arp_ptr += (arp->ar_hln + arp->ar_pln);
+					memcpy(arp_ptr, skb->data, ETH_ALEN);
+				}
+				return 0;
+
+			default:
+				return -1;
+		}
+	}
+
+	/*---------------------------------------------------*/
+	/*         Handle IPX and Apple Talk frame           */
+	/*---------------------------------------------------*/
+	else if((protocol == __constant_htons(ETH_P_IPX)) ||
+		(protocol <= __constant_htons(ETH_FRAME_LEN)))
+	{
+		unsigned char ipx_header[2] = {0xFF, 0xFF};
+		struct ipxhdr	*ipx = NULL;
+		struct elapaarp	*ea = NULL;
+		struct ddpehdr	*ddp = NULL;
+		unsigned char *framePtr = skb->data + ETH_HLEN;
+
+		if(protocol == __constant_htons(ETH_P_IPX))
+		{
+			DEBUG_INFO("NAT25: Protocol=IPX (Ethernet II)\n");
+			ipx = (struct ipxhdr *)framePtr;
+		}
+		else if(protocol <= __constant_htons(ETH_FRAME_LEN))
+		{
+			if(!memcmp(ipx_header, framePtr, 2))
+			{
+				DEBUG_INFO("NAT25: Protocol=IPX (Ethernet 802.3)\n");
+				ipx = (struct ipxhdr *)framePtr;
+			}
+			else
+			{
+				unsigned char ipx_8022_type =  0xE0;
+				unsigned char snap_8022_type = 0xAA;
+
+				if(*framePtr == snap_8022_type)
+				{
+					unsigned char ipx_snap_id[5] = {0x0, 0x0, 0x0, 0x81, 0x37};		// IPX SNAP ID
+					unsigned char aarp_snap_id[5] = {0x00, 0x00, 0x00, 0x80, 0xF3};	// Apple Talk AARP SNAP ID
+					unsigned char ddp_snap_id[5] = {0x08, 0x00, 0x07, 0x80, 0x9B};	// Apple Talk DDP SNAP ID
+
+					framePtr += 3;	// eliminate the 802.2 header
+
+					if(!memcmp(ipx_snap_id, framePtr, 5))
+					{
+						framePtr += 5;	// eliminate the SNAP header
+
+						DEBUG_INFO("NAT25: Protocol=IPX (Ethernet SNAP)\n");
+						ipx = (struct ipxhdr *)framePtr;
+					}
+					else if(!memcmp(aarp_snap_id, framePtr, 5))
+					{
+						framePtr += 5;	// eliminate the SNAP header
+
+						ea = (struct elapaarp *)framePtr;
+					}
+					else if(!memcmp(ddp_snap_id, framePtr, 5))
+					{
+						framePtr += 5;	// eliminate the SNAP header
+
+						ddp = (struct ddpehdr *)framePtr;
+					}
+					else
+					{
+						DEBUG_WARN("NAT25: Protocol=Ethernet SNAP %02x%02x%02x%02x%02x\n", framePtr[0],
+							framePtr[1], framePtr[2], framePtr[3], framePtr[4]);
+						return -1;
+					}
+				}
+				else if(*framePtr == ipx_8022_type)
+				{
+					framePtr += 3;	// eliminate the 802.2 header
+
+					if(!memcmp(ipx_header, framePtr, 2))
+					{
+						DEBUG_INFO("NAT25: Protocol=IPX (Ethernet 802.2)\n");
+						ipx = (struct ipxhdr *)framePtr;
+					}
+					else
+						return -1;
+				}
+				else
+					return -1;
+			}
+		}
+		else
+			return -1;
+
+		/*   IPX   */
+		if(ipx != NULL)
+		{
+			switch(method)
+			{
+				case NAT25_CHECK:
+					if(!memcmp(skb->data+ETH_ALEN, ipx->ipx_source.node, ETH_ALEN))
+					{
+						DEBUG_INFO("NAT25: Check IPX skb_copy\n");
+						return 0;
+					}
+					return -1;
+
+				case NAT25_INSERT:
+					{
+						DEBUG_INFO("NAT25: Insert IPX, Dest=%08x,%02x%02x%02x%02x%02x%02x,%04x Source=%08x,%02x%02x%02x%02x%02x%02x,%04x\n",
+							ipx->ipx_dest.net,
+							ipx->ipx_dest.node[0],
+							ipx->ipx_dest.node[1],
+							ipx->ipx_dest.node[2],
+							ipx->ipx_dest.node[3],
+							ipx->ipx_dest.node[4],
+							ipx->ipx_dest.node[5],
+							ipx->ipx_dest.sock,
+							ipx->ipx_source.net,
+							ipx->ipx_source.node[0],
+							ipx->ipx_source.node[1],
+							ipx->ipx_source.node[2],
+							ipx->ipx_source.node[3],
+							ipx->ipx_source.node[4],
+							ipx->ipx_source.node[5],
+							ipx->ipx_source.sock);
+
+						if(!memcmp(skb->data+ETH_ALEN, ipx->ipx_source.node, ETH_ALEN))
+						{
+							DEBUG_INFO("NAT25: Use IPX Net, and Socket as network addr\n");
+
+							__nat25_generate_ipx_network_addr_with_socket(networkAddr, &ipx->ipx_source.net, &ipx->ipx_source.sock);
+
+							// change IPX source node addr to wlan STA address
+                                                        memcpy(ipx->ipx_source.node, GET_MY_HWADDR(priv), ETH_ALEN);
+						}
+						else
+						{
+							__nat25_generate_ipx_network_addr_with_node(networkAddr, &ipx->ipx_source.net, ipx->ipx_source.node);
+						}
+
+						__nat25_db_network_insert(priv, skb->data+ETH_ALEN, networkAddr);
+
+						__nat25_db_print(priv);
+					}
+					return 0;
+
+				case NAT25_LOOKUP:
+					{
+                                                if(!memcmp(GET_MY_HWADDR(priv), ipx->ipx_dest.node, ETH_ALEN))
+						{
+							DEBUG_INFO("NAT25: Lookup IPX, Modify Destination IPX Node addr\n");
+
+							__nat25_generate_ipx_network_addr_with_socket(networkAddr, &ipx->ipx_dest.net, &ipx->ipx_dest.sock);
+
+							__nat25_db_network_lookup_and_replace(priv, skb, networkAddr);
+
+							// replace IPX destination node addr with Lookup destination MAC addr
+							memcpy(ipx->ipx_dest.node, skb->data, ETH_ALEN);
+						}
+						else
+						{
+							__nat25_generate_ipx_network_addr_with_node(networkAddr, &ipx->ipx_dest.net, ipx->ipx_dest.node);
+
+							__nat25_db_network_lookup_and_replace(priv, skb, networkAddr);
+						}
+					}
+					return 0;
+
+				default:
+					return -1;
+			}
+		}
+
+		/*   AARP   */
+		else if(ea != NULL)
+		{
+			/* Sanity check fields. */
+			if(ea->hw_len != ETH_ALEN || ea->pa_len != AARP_PA_ALEN)
+			{
+				DEBUG_WARN("NAT25: Appletalk AARP Sanity check fail!\n");
+				return -1;
+			}
+
+			switch(method)
+			{
+				case NAT25_CHECK:
+					return 0;
+
+				case NAT25_INSERT:
+					{
+						// change to AARP source mac address to wlan STA address
+                                                memcpy(ea->hw_src, GET_MY_HWADDR(priv), ETH_ALEN);
+
+						DEBUG_INFO("NAT25: Insert AARP, Source=%d,%d Destination=%d,%d\n",
+							ea->pa_src_net,
+							ea->pa_src_node,
+							ea->pa_dst_net,
+							ea->pa_dst_node);
+
+						__nat25_generate_apple_network_addr(networkAddr, &ea->pa_src_net, &ea->pa_src_node);
+
+						__nat25_db_network_insert(priv, skb->data+ETH_ALEN, networkAddr);
+
+						__nat25_db_print(priv);
+					}
+					return 0;
+
+				case NAT25_LOOKUP:
+					{
+						DEBUG_INFO("NAT25: Lookup AARP, Source=%d,%d Destination=%d,%d\n",
+							ea->pa_src_net,
+							ea->pa_src_node,
+							ea->pa_dst_net,
+							ea->pa_dst_node);
+
+						__nat25_generate_apple_network_addr(networkAddr, &ea->pa_dst_net, &ea->pa_dst_node);
+
+						__nat25_db_network_lookup_and_replace(priv, skb, networkAddr);
+
+						// change to AARP destination mac address to Lookup result
+						memcpy(ea->hw_dst, skb->data, ETH_ALEN);
+					}
+					return 0;
+
+				default:
+					return -1;
+			}
+		}
+
+		/*   DDP   */
+		else if(ddp != NULL)
+		{
+			switch(method)
+			{
+				case NAT25_CHECK:
+					return -1;
+
+				case NAT25_INSERT:
+					{
+						DEBUG_INFO("NAT25: Insert DDP, Source=%d,%d Destination=%d,%d\n",
+							ddp->deh_snet,
+							ddp->deh_snode,
+							ddp->deh_dnet,
+							ddp->deh_dnode);
+
+						__nat25_generate_apple_network_addr(networkAddr, &ddp->deh_snet, &ddp->deh_snode);
+
+						__nat25_db_network_insert(priv, skb->data+ETH_ALEN, networkAddr);
+
+						__nat25_db_print(priv);
+					}
+					return 0;
+
+				case NAT25_LOOKUP:
+					{
+						DEBUG_INFO("NAT25: Lookup DDP, Source=%d,%d Destination=%d,%d\n",
+							ddp->deh_snet,
+							ddp->deh_snode,
+							ddp->deh_dnet,
+							ddp->deh_dnode);
+
+						__nat25_generate_apple_network_addr(networkAddr, &ddp->deh_dnet, &ddp->deh_dnode);
+
+						__nat25_db_network_lookup_and_replace(priv, skb, networkAddr);
+					}
+					return 0;
+
+				default:
+					return -1;
+			}
+		}
+
+		return -1;
+	}
+
+	/*---------------------------------------------------*/
+	/*                Handle PPPoE frame                 */
+	/*---------------------------------------------------*/
+	else if((protocol == __constant_htons(ETH_P_PPP_DISC)) ||
+		(protocol == __constant_htons(ETH_P_PPP_SES)))
+	{
+		struct pppoe_hdr *ph = (struct pppoe_hdr *)(skb->data + ETH_HLEN);
+		unsigned short *pMagic;
+
+		switch(method)
+		{
+			case NAT25_CHECK:
+				if (ph->sid == 0)
+					return 0;
+				return 1;
+
+			case NAT25_INSERT:
+				if(ph->sid == 0)	// Discovery phase according to tag
+				{
+					if(ph->code == PADI_CODE || ph->code == PADR_CODE)
+					{
+						if (priv->ethBrExtInfo.addPPPoETag) {
+							struct pppoe_tag *tag, *pOldTag;
+							unsigned char tag_buf[40];
+							int old_tag_len=0;
+
+							tag = (struct pppoe_tag *)tag_buf;
+							pOldTag = (struct pppoe_tag *)__nat25_find_pppoe_tag(ph, ntohs(PTT_RELAY_SID));
+							if (pOldTag) { // if SID existed, copy old value and delete it
+								old_tag_len = ntohs(pOldTag->tag_len);
+								if (old_tag_len+TAG_HDR_LEN+MAGIC_CODE_LEN+RTL_RELAY_TAG_LEN > sizeof(tag_buf)) {
+									DEBUG_ERR("SID tag length too long!\n");
+									return -1;
+								}
+
+								memcpy(tag->tag_data+MAGIC_CODE_LEN+RTL_RELAY_TAG_LEN,
+									pOldTag->tag_data, old_tag_len);
+
+								if (skb_pull_and_merge(skb, (unsigned char *)pOldTag, TAG_HDR_LEN+old_tag_len) < 0) {
+									DEBUG_ERR("call skb_pull_and_merge() failed in PADI/R packet!\n");
+									return -1;
+								}
+								ph->length = htons(ntohs(ph->length)-TAG_HDR_LEN-old_tag_len);
+							}
+
+							tag->tag_type = PTT_RELAY_SID;
+							tag->tag_len = htons(MAGIC_CODE_LEN+RTL_RELAY_TAG_LEN+old_tag_len);
+
+							// insert the magic_code+client mac in relay tag
+							pMagic = (unsigned short *)tag->tag_data;
+							*pMagic = htons(MAGIC_CODE);
+							memcpy(tag->tag_data+MAGIC_CODE_LEN, skb->data+ETH_ALEN, ETH_ALEN);
+
+							//Add relay tag
+							if(__nat25_add_pppoe_tag(skb, tag) < 0)
+								return -1;
+
+							DEBUG_INFO("NAT25: Insert PPPoE, forward %s packet\n",
+											(ph->code == PADI_CODE ? "PADI" : "PADR"));
+						}
+						else { // not add relay tag
+							if (priv->pppoe_connection_in_progress &&
+									memcmp(skb->data+ETH_ALEN, priv->pppoe_addr, ETH_ALEN))	 {
+								DEBUG_ERR("Discard PPPoE packet due to another PPPoE connection is in progress!\n");
+								return -2;
+							}
+
+							if (priv->pppoe_connection_in_progress == 0)
+								memcpy(priv->pppoe_addr, skb->data+ETH_ALEN, ETH_ALEN);
+
+							priv->pppoe_connection_in_progress = WAIT_TIME_PPPOE;
+						}
+					}
+					else
+						return -1;
+				}
+				else	// session phase
+				{
+						DEBUG_INFO("NAT25: Insert PPPoE, insert session packet to %s\n", skb->dev->name);
+
+						__nat25_generate_pppoe_network_addr(networkAddr, skb->data, &(ph->sid));
+
+						__nat25_db_network_insert(priv, skb->data+ETH_ALEN, networkAddr);
+
+						__nat25_db_print(priv);
+
+						if (!priv->ethBrExtInfo.addPPPoETag &&
+								priv->pppoe_connection_in_progress &&
+									!memcmp(skb->data+ETH_ALEN, priv->pppoe_addr, ETH_ALEN))
+							priv->pppoe_connection_in_progress = 0;
+				}
+				return 0;
+
+			case NAT25_LOOKUP:
+				if(ph->code == PADO_CODE || ph->code == PADS_CODE)
+				{
+					if (priv->ethBrExtInfo.addPPPoETag) {
+						struct pppoe_tag *tag;
+						unsigned char *ptr;
+						unsigned short tagType, tagLen;
+						int offset=0;
+
+						if((ptr = __nat25_find_pppoe_tag(ph, ntohs(PTT_RELAY_SID))) == 0) {
+							DEBUG_ERR("Fail to find PTT_RELAY_SID in FADO!\n");
+							return -1;
+						}
+
+						tag = (struct pppoe_tag *)ptr;
+						tagType = (unsigned short)((ptr[0] << 8) + ptr[1]);
+						tagLen = (unsigned short)((ptr[2] << 8) + ptr[3]);
+
+						if((tagType != ntohs(PTT_RELAY_SID)) || (tagLen < (MAGIC_CODE_LEN+RTL_RELAY_TAG_LEN))) {
+							DEBUG_ERR("Invalid PTT_RELAY_SID tag length [%d]!\n", tagLen);
+							return -1;
+						}
+
+						pMagic = (unsigned short *)tag->tag_data;
+						if (ntohs(*pMagic) != MAGIC_CODE) {
+							DEBUG_ERR("Can't find MAGIC_CODE in %s packet!\n",
+								(ph->code == PADO_CODE ? "PADO" : "PADS"));
+							return -1;
+						}
+
+						memcpy(skb->data, tag->tag_data+MAGIC_CODE_LEN, ETH_ALEN);
+
+						if (tagLen > MAGIC_CODE_LEN+RTL_RELAY_TAG_LEN)
+							offset = TAG_HDR_LEN;
+
+						if (skb_pull_and_merge(skb, ptr+offset, TAG_HDR_LEN+MAGIC_CODE_LEN+RTL_RELAY_TAG_LEN-offset) < 0) {
+							DEBUG_ERR("call skb_pull_and_merge() failed in PADO packet!\n");
+							return -1;
+						}
+						ph->length = htons(ntohs(ph->length)-(TAG_HDR_LEN+MAGIC_CODE_LEN+RTL_RELAY_TAG_LEN-offset));
+						if (offset > 0)
+							tag->tag_len = htons(tagLen-MAGIC_CODE_LEN-RTL_RELAY_TAG_LEN);
+
+						DEBUG_INFO("NAT25: Lookup PPPoE, forward %s Packet from %s\n",
+							(ph->code == PADO_CODE ? "PADO" : "PADS"),	skb->dev->name);
+					}
+					else { // not add relay tag
+						if (!priv->pppoe_connection_in_progress) {
+							DEBUG_ERR("Discard PPPoE packet due to no connection in progresss!\n");
+							return -1;
+						}
+						memcpy(skb->data, priv->pppoe_addr, ETH_ALEN);
+						priv->pppoe_connection_in_progress = WAIT_TIME_PPPOE;
+					}
+				}
+				else {
+					if(ph->sid != 0)
+					{
+						DEBUG_INFO("NAT25: Lookup PPPoE, lookup session packet from %s\n", skb->dev->name);
+						__nat25_generate_pppoe_network_addr(networkAddr, skb->data+ETH_ALEN, &(ph->sid));
+
+						__nat25_db_network_lookup_and_replace(priv, skb, networkAddr);
+
+						__nat25_db_print(priv);
+					}
+					else
+						return -1;
+
+				}
+				return 0;
+
+			default:
+				return -1;
+		}
+	}
+
+	/*---------------------------------------------------*/
+	/*                 Handle EAP frame                  */
+	/*---------------------------------------------------*/
+	else if(protocol == __constant_htons(0x888e))
+	{
+		switch(method)
+		{
+			case NAT25_CHECK:
+				return -1;
+
+			case NAT25_INSERT:
+				return 0;
+
+			case NAT25_LOOKUP:
+				return 0;
+
+			default:
+				return -1;
+		}
+	}
+
+	/*---------------------------------------------------*/
+	/*         Handle C-Media proprietary frame          */
+	/*---------------------------------------------------*/
+	else if((protocol == __constant_htons(0xe2ae)) ||
+		(protocol == __constant_htons(0xe2af)))
+	{
+		switch(method)
+		{
+			case NAT25_CHECK:
+				return -1;
+
+			case NAT25_INSERT:
+				return 0;
+
+			case NAT25_LOOKUP:
+				return 0;
+
+			default:
+				return -1;
+		}
+	}
+
+	/*---------------------------------------------------*/
+	/*         Handle IPV6 frame      							  */
+	/*---------------------------------------------------*/
+#ifdef CL_IPV6_PASS
+	else if(protocol == __constant_htons(ETH_P_IPV6))
+	{
+		struct ipv6hdr *iph = (struct ipv6hdr *)(skb->data + ETH_HLEN);
+
+		if (sizeof(*iph) >= (skb->len - ETH_HLEN))
+		{
+			DEBUG_WARN("NAT25: malformed IPv6 packet !\n");
+			return -1;
+		}
+
+		switch(method)
+		{
+			case NAT25_CHECK:
+				if (skb->data[0] & 1)
+					return 0;
+				return -1;
+
+			case NAT25_INSERT:
+				{
+					DEBUG_INFO("NAT25: Insert IP, SA=%4x:%4x:%4x:%4x:%4x:%4x:%4x:%4x,"
+									" DA=%4x:%4x:%4x:%4x:%4x:%4x:%4x:%4x\n",
+						iph->saddr.s6_addr16[0],iph->saddr.s6_addr16[1],iph->saddr.s6_addr16[2],iph->saddr.s6_addr16[3],
+						iph->saddr.s6_addr16[4],iph->saddr.s6_addr16[5],iph->saddr.s6_addr16[6],iph->saddr.s6_addr16[7],
+						iph->daddr.s6_addr16[0],iph->daddr.s6_addr16[1],iph->daddr.s6_addr16[2],iph->daddr.s6_addr16[3],
+						iph->daddr.s6_addr16[4],iph->daddr.s6_addr16[5],iph->daddr.s6_addr16[6],iph->daddr.s6_addr16[7]);
+
+					if (memcmp(&iph->saddr, "\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0", 16)) {
+						__nat25_generate_ipv6_network_addr(networkAddr, (unsigned int *)&iph->saddr);
+						__nat25_db_network_insert(priv, skb->data+ETH_ALEN, networkAddr);
+						__nat25_db_print(priv);
+
+						if (iph->nexthdr == IPPROTO_ICMPV6 &&
+								skb->len > (ETH_HLEN +  sizeof(*iph) + 4)) {
+							if (update_nd_link_layer_addr(skb->data + ETH_HLEN + sizeof(*iph),
+                                                                skb->len - ETH_HLEN - sizeof(*iph), GET_MY_HWADDR(priv))) {
+								struct icmp6hdr  *hdr = (struct icmp6hdr *)(skb->data + ETH_HLEN + sizeof(*iph));
+								hdr->icmp6_cksum = 0;
+								hdr->icmp6_cksum = csum_ipv6_magic(&iph->saddr, &iph->daddr,
+												iph->payload_len,
+												IPPROTO_ICMPV6,
+												csum_partial((__u8 *)hdr, iph->payload_len, 0));
+							}
+						}
+					}
+				}
+				return 0;
+
+			case NAT25_LOOKUP:
+				DEBUG_INFO("NAT25: Lookup IP, SA=%4x:%4x:%4x:%4x:%4x:%4x:%4x:%4x,"
+								" DA=%4x:%4x:%4x:%4x:%4x:%4x:%4x:%4x\n",
+						iph->saddr.s6_addr16[0],iph->saddr.s6_addr16[1],iph->saddr.s6_addr16[2],iph->saddr.s6_addr16[3],
+						iph->saddr.s6_addr16[4],iph->saddr.s6_addr16[5],iph->saddr.s6_addr16[6],iph->saddr.s6_addr16[7],
+						iph->daddr.s6_addr16[0],iph->daddr.s6_addr16[1],iph->daddr.s6_addr16[2],iph->daddr.s6_addr16[3],
+						iph->daddr.s6_addr16[4],iph->daddr.s6_addr16[5],iph->daddr.s6_addr16[6],iph->daddr.s6_addr16[7]);
+
+
+				__nat25_generate_ipv6_network_addr(networkAddr, (unsigned int *)&iph->daddr);
+				if (!__nat25_db_network_lookup_and_replace(priv, skb, networkAddr)) {
+#ifdef SUPPORT_RX_UNI2MCAST
+					if (iph->daddr.s6_addr[0] == 0xff)
+						convert_ipv6_mac_to_mc(skb);
+#endif
+				}
+				return 0;
+
+			default:
+				return -1;
+		}
+	}
+#endif	// CL_IPV6_PASS
+
+	return -1;
+}
+
+
+int nat25_handle_frame(_adapter *priv, struct sk_buff *skb)
+{
+#ifdef BR_EXT_DEBUG
+	if((!priv->ethBrExtInfo.nat25_disable) && (!(skb->data[0] & 1)))
+	{
+		panic_printk("NAT25: Input Frame: DA=%02x%02x%02x%02x%02x%02x SA=%02x%02x%02x%02x%02x%02x\n",
+			skb->data[0],
+			skb->data[1],
+			skb->data[2],
+			skb->data[3],
+			skb->data[4],
+			skb->data[5],
+			skb->data[6],
+			skb->data[7],
+			skb->data[8],
+			skb->data[9],
+			skb->data[10],
+			skb->data[11]);
+	}
+#endif
+
+	if(!(skb->data[0] & 1))
+	{
+		int is_vlan_tag=0, i, retval=0;
+		unsigned short vlan_hdr=0;
+
+		if (*((unsigned short *)(skb->data+ETH_ALEN*2)) == __constant_htons(ETH_P_8021Q)) {
+			is_vlan_tag = 1;
+			vlan_hdr = *((unsigned short *)(skb->data+ETH_ALEN*2+2));
+			for (i=0; i<6; i++)
+				*((unsigned short *)(skb->data+ETH_ALEN*2+2-i*2)) = *((unsigned short *)(skb->data+ETH_ALEN*2-2-i*2));
+			skb_pull(skb, 4);
+		}
+
+		if (!priv->ethBrExtInfo.nat25_disable)
+		{
+			_irqL irqL;
+			_enter_critical_bh(&priv->br_ext_lock, &irqL);
+			/*
+			 *	This function look up the destination network address from
+			 *	the NAT2.5 database. Return value = -1 means that the
+			 *	corresponding network protocol is NOT support.
+			 */
+			if (!priv->ethBrExtInfo.nat25sc_disable &&
+				(*((unsigned short *)(skb->data+ETH_ALEN*2)) == __constant_htons(ETH_P_IP)) &&
+				!memcmp(priv->scdb_ip, skb->data+ETH_HLEN+16, 4)) {
+				memcpy(skb->data, priv->scdb_mac, ETH_ALEN);
+
+				_exit_critical_bh(&priv->br_ext_lock, &irqL);
+			}
+			else {
+				_exit_critical_bh(&priv->br_ext_lock, &irqL);
+
+				retval = nat25_db_handle(priv, skb, NAT25_LOOKUP);
+			}
+		}
+		else {
+			if (((*((unsigned short *)(skb->data+ETH_ALEN*2)) == __constant_htons(ETH_P_IP)) &&
+					!memcmp(priv->br_ip, skb->data+ETH_HLEN+16, 4)) ||
+				((*((unsigned short *)(skb->data+ETH_ALEN*2)) == __constant_htons(ETH_P_ARP)) &&
+					!memcmp(priv->br_ip, skb->data+ETH_HLEN+24, 4))) {
+				// for traffic to upper TCP/IP
+				retval = nat25_db_handle(priv, skb, NAT25_LOOKUP);
+			}
+		}
+
+		if (is_vlan_tag) {
+			skb_push(skb, 4);
+			for (i=0; i<6; i++)
+				*((unsigned short *)(skb->data+i*2)) = *((unsigned short *)(skb->data+4+i*2));
+			*((unsigned short *)(skb->data+ETH_ALEN*2)) = __constant_htons(ETH_P_8021Q);
+			*((unsigned short *)(skb->data+ETH_ALEN*2+2)) = vlan_hdr;
+		}
+
+		if(retval == -1) {
+			//DEBUG_ERR("NAT25: Lookup fail!\n");
+			return -1;
+		}
+	}
+
+	return 0;
+}
+
+#if 0
+void mac_clone(_adapter *priv, unsigned char *addr)
+{
+	struct sockaddr sa;
+
+	memcpy(sa.sa_data, addr, ETH_ALEN);
+	DEBUG_INFO("MAC Clone: Addr=%02x%02x%02x%02x%02x%02x\n",
+		addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
+	rtl8192cd_set_hwaddr(priv->dev, &sa);
+}
+
+
+int mac_clone_handle_frame(_adapter *priv, struct sk_buff *skb)
+{
+	if(priv->ethBrExtInfo.macclone_enable && !priv->macclone_completed)
+	{
+		if(!(skb->data[ETH_ALEN] & 1))	//// check any other particular MAC add
+		{
+                        if(memcmp(skb->data+ETH_ALEN, GET_MY_HWADDR(priv), ETH_ALEN) &&
+				((priv->dev->br_port) &&
+				 memcmp(skb->data+ETH_ALEN, priv->br_mac, ETH_ALEN)))
+			{
+				mac_clone(priv, skb->data+ETH_ALEN);
+				priv->macclone_completed = 1;
+			}
+		}
+	}
+
+	return 0;
+}
+#endif // 0
+
+#define SERVER_PORT			67
+#define CLIENT_PORT			68
+#define DHCP_MAGIC			0x63825363
+#define BROADCAST_FLAG		0x8000
+
+struct dhcpMessage {
+	u_int8_t op;
+	u_int8_t htype;
+	u_int8_t hlen;
+	u_int8_t hops;
+	u_int32_t xid;
+	u_int16_t secs;
+	u_int16_t flags;
+	u_int32_t ciaddr;
+	u_int32_t yiaddr;
+	u_int32_t siaddr;
+	u_int32_t giaddr;
+	u_int8_t chaddr[16];
+	u_int8_t sname[64];
+	u_int8_t file[128];
+	u_int32_t cookie;
+	u_int8_t options[308]; /* 312 - cookie */
+};
+
+void dhcp_flag_bcast(_adapter *priv, struct sk_buff *skb)
+{
+	if(skb == NULL)
+		return;
+
+	if(!priv->ethBrExtInfo.dhcp_bcst_disable)
+	{
+		unsigned short protocol = *((unsigned short *)(skb->data + 2 * ETH_ALEN));
+
+		if(protocol == __constant_htons(ETH_P_IP)) // IP
+		{
+			struct iphdr* iph = (struct iphdr *)(skb->data + ETH_HLEN);
+
+			if(iph->protocol == IPPROTO_UDP) // UDP
+			{
+				struct udphdr *udph = (struct udphdr *)((SIZE_PTR)iph + (iph->ihl << 2));
+
+				if((udph->source == __constant_htons(CLIENT_PORT))
+					&& (udph->dest == __constant_htons(SERVER_PORT))) // DHCP request
+				{
+					struct dhcpMessage *dhcph =
+						(struct dhcpMessage *)((SIZE_PTR)udph + sizeof(struct udphdr));
+
+					if(dhcph->cookie == __constant_htonl(DHCP_MAGIC)) // match magic word
+					{
+						if(!(dhcph->flags & htons(BROADCAST_FLAG))) // if not broadcast
+						{
+							register int sum = 0;
+
+							DEBUG_INFO("DHCP: change flag of DHCP request to broadcast.\n");
+							// or BROADCAST flag
+							dhcph->flags |= htons(BROADCAST_FLAG);
+							// recalculate checksum
+							sum = ~(udph->check) & 0xffff;
+							sum += dhcph->flags;
+							while(sum >> 16)
+								sum = (sum & 0xffff) + (sum >> 16);
+							udph->check = ~sum;
+						}
+					}
+				}
+			}
+		}
+	}
+}
+
+
+void *scdb_findEntry(_adapter *priv, unsigned char *macAddr,
+				unsigned char *ipAddr)
+{
+	unsigned char networkAddr[MAX_NETWORK_ADDR_LEN];
+	struct nat25_network_db_entry *db;
+	int hash;
+	//_irqL irqL;
+	//_enter_critical_bh(&priv->br_ext_lock, &irqL);
+
+	__nat25_generate_ipv4_network_addr(networkAddr, (unsigned int *)ipAddr);
+	hash = __nat25_network_hash(networkAddr);
+	db = priv->nethash[hash];
+	while (db != NULL)
+	{
+		if(!memcmp(db->networkAddr, networkAddr, MAX_NETWORK_ADDR_LEN)) {
+			//_exit_critical_bh(&priv->br_ext_lock, &irqL);
+			return (void *)db;
+		}
+
+		db = db->next_hash;
+	}
+
+	//_exit_critical_bh(&priv->br_ext_lock, &irqL);
+	return NULL;
+}
+
+#endif	// CONFIG_BR_EXT
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_cmd.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_cmd.c
new file mode 100644
index 000000000000..2455304514c8
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_cmd.c
@@ -0,0 +1,3034 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_CMD_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#include <cmd_osdep.h>
+#include <mlme_osdep.h>
+#include <rtw_byteorder.h>
+#ifdef CONFIG_BR_EXT
+#include <rtw_br_ext.h>
+#endif //CONFIG_BR_EXT
+/*
+Caller and the rtw_cmd_thread can protect cmd_q by spin_lock.
+No irqsave is necessary.
+*/
+
+sint	_rtw_init_cmd_priv (struct	cmd_priv *pcmdpriv)
+{
+	sint res=_SUCCESS;
+
+_func_enter_;
+
+	_rtw_init_sema(&(pcmdpriv->cmd_queue_sema), 0);
+	//_rtw_init_sema(&(pcmdpriv->cmd_done_sema), 0);
+	_rtw_init_sema(&(pcmdpriv->terminate_cmdthread_sema), 0);
+
+
+	_rtw_init_queue(&(pcmdpriv->cmd_queue));
+
+	//allocate DMA-able/Non-Page memory for cmd_buf and rsp_buf
+
+	pcmdpriv->cmd_seq = 1;
+
+	pcmdpriv->cmd_allocated_buf = rtw_zmalloc(MAX_CMDSZ + CMDBUFF_ALIGN_SZ);
+
+	if (pcmdpriv->cmd_allocated_buf == NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	pcmdpriv->cmd_buf = pcmdpriv->cmd_allocated_buf  +  CMDBUFF_ALIGN_SZ - ( (SIZE_PTR)(pcmdpriv->cmd_allocated_buf) & (CMDBUFF_ALIGN_SZ-1));
+
+	pcmdpriv->rsp_allocated_buf = rtw_zmalloc(MAX_RSPSZ + 4);
+
+	if (pcmdpriv->rsp_allocated_buf == NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	pcmdpriv->rsp_buf = pcmdpriv->rsp_allocated_buf  +  4 - ( (SIZE_PTR)(pcmdpriv->rsp_allocated_buf) & 3);
+
+	pcmdpriv->cmd_issued_cnt = pcmdpriv->cmd_done_cnt = pcmdpriv->rsp_cnt = 0;
+
+exit:
+
+_func_exit_;
+
+	return res;
+
+}
+
+#ifdef CONFIG_C2H_WK
+static void c2h_wk_callback(_workitem *work);
+#endif
+sint _rtw_init_evt_priv(struct evt_priv *pevtpriv)
+{
+	sint res=_SUCCESS;
+
+_func_enter_;
+
+#ifdef CONFIG_H2CLBK
+	_rtw_init_sema(&(pevtpriv->lbkevt_done), 0);
+	pevtpriv->lbkevt_limit = 0;
+	pevtpriv->lbkevt_num = 0;
+	pevtpriv->cmdevt_parm = NULL;
+#endif
+
+	//allocate DMA-able/Non-Page memory for cmd_buf and rsp_buf
+	ATOMIC_SET(&pevtpriv->event_seq, 0);
+	pevtpriv->evt_done_cnt = 0;
+
+#ifdef CONFIG_EVENT_THREAD_MODE
+
+	_rtw_init_sema(&(pevtpriv->evt_notify), 0);
+	_rtw_init_sema(&(pevtpriv->terminate_evtthread_sema), 0);
+
+	pevtpriv->evt_allocated_buf = rtw_zmalloc(MAX_EVTSZ + 4);
+	if (pevtpriv->evt_allocated_buf == NULL){
+		res= _FAIL;
+		goto exit;
+		}
+	pevtpriv->evt_buf = pevtpriv->evt_allocated_buf  +  4 - ((unsigned int)(pevtpriv->evt_allocated_buf) & 3);
+
+
+#ifdef CONFIG_SDIO_HCI
+	pevtpriv->allocated_c2h_mem = rtw_zmalloc(C2H_MEM_SZ +4);
+
+	if (pevtpriv->allocated_c2h_mem == NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	pevtpriv->c2h_mem = pevtpriv->allocated_c2h_mem +  4\
+	- ( (u32)(pevtpriv->allocated_c2h_mem) & 3);
+#ifdef PLATFORM_OS_XP
+	pevtpriv->pc2h_mdl= IoAllocateMdl((u8 *)pevtpriv->c2h_mem, C2H_MEM_SZ , FALSE, FALSE, NULL);
+
+	if(pevtpriv->pc2h_mdl == NULL){
+		res= _FAIL;
+		goto exit;
+	}
+	MmBuildMdlForNonPagedPool(pevtpriv->pc2h_mdl);
+#endif
+#endif //end of CONFIG_SDIO_HCI
+
+	_rtw_init_queue(&(pevtpriv->evt_queue));
+
+exit:
+
+#endif //end of CONFIG_EVENT_THREAD_MODE
+
+#ifdef CONFIG_C2H_WK
+	_init_workitem(&pevtpriv->c2h_wk, c2h_wk_callback, NULL);
+	pevtpriv->c2h_wk_alive = _FALSE;
+	pevtpriv->c2h_queue = rtw_cbuf_alloc(C2H_QUEUE_MAX_LEN+1);
+#endif
+
+_func_exit_;
+
+	return res;
+}
+
+void _rtw_free_evt_priv (struct	evt_priv *pevtpriv)
+{
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,("+_rtw_free_evt_priv \n"));
+
+#ifdef CONFIG_EVENT_THREAD_MODE
+	_rtw_free_sema(&(pevtpriv->evt_notify));
+	_rtw_free_sema(&(pevtpriv->terminate_evtthread_sema));
+
+
+	if (pevtpriv->evt_allocated_buf)
+		rtw_mfree(pevtpriv->evt_allocated_buf, MAX_EVTSZ + 4);
+#endif
+
+#ifdef CONFIG_C2H_WK
+	_cancel_workitem_sync(&pevtpriv->c2h_wk);
+	while(pevtpriv->c2h_wk_alive)
+		rtw_msleep_os(10);
+
+	while (!rtw_cbuf_empty(pevtpriv->c2h_queue)) {
+		void *c2h;
+		if ((c2h = rtw_cbuf_pop(pevtpriv->c2h_queue)) != NULL
+			&& c2h != (void *)pevtpriv) {
+			rtw_mfree(c2h, 16);
+		}
+	}
+	rtw_cbuf_free(pevtpriv->c2h_queue);
+#endif
+
+	RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,("-_rtw_free_evt_priv \n"));
+
+_func_exit_;
+
+}
+
+void _rtw_free_cmd_priv (struct	cmd_priv *pcmdpriv)
+{
+_func_enter_;
+
+	if(pcmdpriv){
+		_rtw_spinlock_free(&(pcmdpriv->cmd_queue.lock));
+		_rtw_free_sema(&(pcmdpriv->cmd_queue_sema));
+		//_rtw_free_sema(&(pcmdpriv->cmd_done_sema));
+		_rtw_free_sema(&(pcmdpriv->terminate_cmdthread_sema));
+
+		if (pcmdpriv->cmd_allocated_buf)
+			rtw_mfree(pcmdpriv->cmd_allocated_buf, MAX_CMDSZ + CMDBUFF_ALIGN_SZ);
+
+		if (pcmdpriv->rsp_allocated_buf)
+			rtw_mfree(pcmdpriv->rsp_allocated_buf, MAX_RSPSZ + 4);
+	}
+_func_exit_;
+}
+
+/*
+Calling Context:
+
+rtw_enqueue_cmd can only be called between kernel thread,
+since only spin_lock is used.
+
+ISR/Call-Back functions can't call this sub-function.
+
+*/
+
+sint	_rtw_enqueue_cmd(_queue *queue, struct cmd_obj *obj)
+{
+	_irqL irqL;
+
+_func_enter_;
+
+	if (obj == NULL)
+		goto exit;
+
+	//_enter_critical_bh(&queue->lock, &irqL);
+	_enter_critical(&queue->lock, &irqL);
+
+	rtw_list_insert_tail(&obj->list, &queue->queue);
+
+	//_exit_critical_bh(&queue->lock, &irqL);
+	_exit_critical(&queue->lock, &irqL);
+
+exit:
+
+_func_exit_;
+
+	return _SUCCESS;
+}
+
+struct	cmd_obj	*_rtw_dequeue_cmd(_queue *queue)
+{
+	_irqL irqL;
+	struct cmd_obj *obj;
+
+_func_enter_;
+
+	//_enter_critical_bh(&(queue->lock), &irqL);
+	_enter_critical(&queue->lock, &irqL);
+	if (rtw_is_list_empty(&(queue->queue)))
+		obj = NULL;
+	else
+	{
+		obj = LIST_CONTAINOR(get_next(&(queue->queue)), struct cmd_obj, list);
+		rtw_list_delete(&obj->list);
+	}
+
+	//_exit_critical_bh(&(queue->lock), &irqL);
+	_exit_critical(&queue->lock, &irqL);
+
+_func_exit_;
+
+	return obj;
+}
+
+u32	rtw_init_cmd_priv(struct cmd_priv *pcmdpriv)
+{
+	u32	res;
+_func_enter_;
+	res = _rtw_init_cmd_priv (pcmdpriv);
+_func_exit_;
+	return res;
+}
+
+u32	rtw_init_evt_priv (struct	evt_priv *pevtpriv)
+{
+	int	res;
+_func_enter_;
+	res = _rtw_init_evt_priv(pevtpriv);
+_func_exit_;
+	return res;
+}
+
+void rtw_free_evt_priv (struct	evt_priv *pevtpriv)
+{
+_func_enter_;
+	RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,("rtw_free_evt_priv\n"));
+	_rtw_free_evt_priv(pevtpriv);
+_func_exit_;
+}
+
+void rtw_free_cmd_priv (struct	cmd_priv *pcmdpriv)
+{
+_func_enter_;
+	RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,("rtw_free_cmd_priv\n"));
+	_rtw_free_cmd_priv(pcmdpriv);
+_func_exit_;
+}
+
+int rtw_cmd_filter(struct cmd_priv *pcmdpriv, struct cmd_obj *cmd_obj);
+int rtw_cmd_filter(struct cmd_priv *pcmdpriv, struct cmd_obj *cmd_obj)
+{
+	u8 bAllow = _FALSE; //set to _TRUE to allow enqueuing cmd when hw_init_completed is _FALSE
+
+	#ifdef SUPPORT_HW_RFOFF_DETECTED
+	//To decide allow or not
+	if(	(pcmdpriv->padapter->pwrctrlpriv.bHWPwrPindetect)
+		&&(!pcmdpriv->padapter->registrypriv.usbss_enable)
+	)
+	{
+		if(cmd_obj->cmdcode == GEN_CMD_CODE(_Set_Drv_Extra) )
+		{
+			struct drvextra_cmd_parm	*pdrvextra_cmd_parm = (struct drvextra_cmd_parm	*)cmd_obj->parmbuf;
+			if(pdrvextra_cmd_parm->ec_id == POWER_SAVING_CTRL_WK_CID)
+			{
+				//DBG_871X("==>enqueue POWER_SAVING_CTRL_WK_CID\n");
+				bAllow = _TRUE;
+			}
+		}
+	}
+	#endif
+
+	if(cmd_obj->cmdcode == GEN_CMD_CODE(_SetChannelPlan))
+		bAllow = _TRUE;
+
+	if( (pcmdpriv->padapter->hw_init_completed ==_FALSE && bAllow == _FALSE)
+		|| pcmdpriv->cmdthd_running== _FALSE	//com_thread not running
+	)
+	{
+		//DBG_871X("%s:%s: drop cmdcode:%u, hw_init_completed:%u, cmdthd_running:%u\n", caller_func, __FUNCTION__,
+		//	cmd_obj->cmdcode,
+		//	pcmdpriv->padapter->hw_init_completed,
+		//	pcmdpriv->cmdthd_running
+		//);
+
+		return _FAIL;
+	}
+	return _SUCCESS;
+}
+
+
+
+u32 rtw_enqueue_cmd(struct cmd_priv *pcmdpriv, struct cmd_obj *cmd_obj)
+{
+	int res = _FAIL;
+	PADAPTER padapter = pcmdpriv->padapter;
+
+_func_enter_;
+
+	if (cmd_obj == NULL) {
+		goto exit;
+	}
+
+	cmd_obj->padapter = padapter;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	//change pcmdpriv to primary's pcmdpriv
+	if (padapter->adapter_type != PRIMARY_ADAPTER && padapter->pbuddy_adapter)
+		pcmdpriv = &(padapter->pbuddy_adapter->cmdpriv);
+#endif
+
+	if( _FAIL == (res=rtw_cmd_filter(pcmdpriv, cmd_obj)) ) {
+		rtw_free_cmd_obj(cmd_obj);
+		goto exit;
+	}
+
+	res = _rtw_enqueue_cmd(&pcmdpriv->cmd_queue, cmd_obj);
+
+	if(res == _SUCCESS)
+		_rtw_up_sema(&pcmdpriv->cmd_queue_sema);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+struct	cmd_obj	*rtw_dequeue_cmd(struct cmd_priv *pcmdpriv)
+{
+	struct cmd_obj *cmd_obj;
+
+_func_enter_;
+
+	cmd_obj = _rtw_dequeue_cmd(&pcmdpriv->cmd_queue);
+
+_func_exit_;
+	return cmd_obj;
+}
+
+void rtw_cmd_clr_isr(struct	cmd_priv *pcmdpriv)
+{
+_func_enter_;
+	pcmdpriv->cmd_done_cnt++;
+	//_rtw_up_sema(&(pcmdpriv->cmd_done_sema));
+_func_exit_;
+}
+
+void rtw_free_cmd_obj(struct cmd_obj *pcmd)
+{
+_func_enter_;
+
+	if((pcmd->cmdcode!=_JoinBss_CMD_) &&(pcmd->cmdcode!= _CreateBss_CMD_))
+	{
+		//free parmbuf in cmd_obj
+		rtw_mfree((unsigned char*)pcmd->parmbuf, pcmd->cmdsz);
+	}
+
+	if(pcmd->rsp!=NULL)
+	{
+		if(pcmd->rspsz!= 0)
+		{
+			//free rsp in cmd_obj
+			rtw_mfree((unsigned char*)pcmd->rsp, pcmd->rspsz);
+		}
+	}
+
+	//free cmd_obj
+	rtw_mfree((unsigned char*)pcmd, sizeof(struct cmd_obj));
+
+_func_exit_;
+}
+
+void rtw_stop_cmd_thread(_adapter *adapter)
+{
+	if(adapter->cmdThread && adapter->cmdpriv.cmdthd_running == _TRUE
+		&& adapter->cmdpriv.stop_req == 0)
+	{
+		adapter->cmdpriv.stop_req = 1;
+		_rtw_up_sema(&adapter->cmdpriv.cmd_queue_sema);
+		_rtw_down_sema(&adapter->cmdpriv.terminate_cmdthread_sema);
+	}
+}
+
+thread_return rtw_cmd_thread(thread_context context)
+{
+	u8 ret;
+	struct cmd_obj *pcmd;
+	u8 *pcmdbuf, *prspbuf;
+	u8 (*cmd_hdl)(_adapter *padapter, u8* pbuf);
+	void (*pcmd_callback)(_adapter *dev, struct cmd_obj *pcmd);
+       _adapter *padapter = (_adapter *)context;
+	struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
+
+_func_enter_;
+
+	thread_enter("RTW_CMD_THREAD");
+
+	pcmdbuf = pcmdpriv->cmd_buf;
+	prspbuf = pcmdpriv->rsp_buf;
+
+	pcmdpriv->stop_req = 0;
+	pcmdpriv->cmdthd_running=_TRUE;
+	_rtw_up_sema(&pcmdpriv->terminate_cmdthread_sema);
+
+	RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,("start r871x rtw_cmd_thread !!!!\n"));
+
+	while(1)
+	{
+		if ((_rtw_down_sema(&(pcmdpriv->cmd_queue_sema))) == _FAIL) {
+			LOG_LEVEL(_drv_err_, FUNC_ADPT_FMT" _rtw_down_sema(&pcmdpriv->cmd_queue_sema) return _FAIL, break\n", FUNC_ADPT_ARG(padapter));
+			break;
+		}
+
+		if (pcmdpriv->stop_req) {
+			LOG_LEVEL(_drv_err_, FUNC_ADPT_FMT" stop_req:%u, break\n", FUNC_ADPT_ARG(padapter), pcmdpriv->stop_req);
+			break;
+		}
+
+#ifdef CONFIG_LPS_LCLK
+		if (rtw_register_cmd_alive(padapter) != _SUCCESS)
+		{
+			continue;
+		}
+#endif
+
+_next:
+		if ((padapter->bDriverStopped == _TRUE)||(padapter->bSurpriseRemoved == _TRUE))
+		{
+			LOG_LEVEL(_drv_err_, "%s: DriverStopped(%d) SurpriseRemoved(%d) break at line %d\n",
+				__FUNCTION__, padapter->bDriverStopped, padapter->bSurpriseRemoved, __LINE__);
+			break;
+		}
+
+		if(!(pcmd = rtw_dequeue_cmd(pcmdpriv))) {
+#ifdef CONFIG_LPS_LCLK
+			rtw_unregister_cmd_alive(padapter);
+#endif
+			continue;
+		}
+
+		if( _FAIL == rtw_cmd_filter(pcmdpriv, pcmd) )
+		{
+			pcmd->res = H2C_DROPPED;
+			goto post_process;
+		}
+
+		if( _FAIL == rtw_cmd_filter(pcmdpriv, pcmd) ) {
+			rtw_free_cmd_obj(pcmd);
+			continue;
+		}
+
+		pcmdpriv->cmd_issued_cnt++;
+
+		pcmd->cmdsz = _RND4((pcmd->cmdsz));//_RND4
+
+		_rtw_memcpy(pcmdbuf, pcmd->parmbuf, pcmd->cmdsz);
+
+		if(pcmd->cmdcode <= (sizeof(wlancmds) /sizeof(struct cmd_hdl)))
+		{
+			cmd_hdl = wlancmds[pcmd->cmdcode].h2cfuns;
+
+			if (cmd_hdl)
+			{
+				ret = cmd_hdl(pcmd->padapter, pcmdbuf);
+				pcmd->res = ret;
+			}
+
+			pcmdpriv->cmd_seq++;
+		}
+		else
+		{
+			pcmd->res = H2C_PARAMETERS_ERROR;
+		}
+
+		cmd_hdl = NULL;
+
+post_process:
+
+		//call callback function for post-processed
+		if(pcmd->cmdcode <= (sizeof(rtw_cmd_callback) /sizeof(struct _cmd_callback)))
+		{
+			pcmd_callback = rtw_cmd_callback[pcmd->cmdcode].callback;
+			if(pcmd_callback == NULL)
+			{
+				RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,("mlme_cmd_hdl(): pcmd_callback=0x%p, cmdcode=0x%x\n", pcmd_callback, pcmd->cmdcode));
+				rtw_free_cmd_obj(pcmd);
+			}
+			else
+			{
+				//todo: !!! fill rsp_buf to pcmd->rsp if (pcmd->rsp!=NULL)
+				pcmd_callback(pcmd->padapter, pcmd);//need conider that free cmd_obj in rtw_cmd_callback
+			}
+		}
+
+		flush_signals_thread();
+
+		goto _next;
+
+	}
+	pcmdpriv->cmdthd_running=_FALSE;
+
+
+	// free all cmd_obj resources
+	do{
+		pcmd = rtw_dequeue_cmd(pcmdpriv);
+		if(pcmd==NULL)
+			break;
+
+		//DBG_871X("%s: leaving... drop cmdcode:%u\n", __FUNCTION__, pcmd->cmdcode);
+
+		rtw_free_cmd_obj(pcmd);
+	}while(1);
+
+	_rtw_up_sema(&pcmdpriv->terminate_cmdthread_sema);
+
+_func_exit_;
+
+	thread_exit();
+
+}
+
+
+#ifdef CONFIG_EVENT_THREAD_MODE
+u32 rtw_enqueue_evt(struct evt_priv *pevtpriv, struct evt_obj *obj)
+{
+	_irqL irqL;
+	int	res;
+	_queue *queue = &pevtpriv->evt_queue;
+
+_func_enter_;
+
+	res = _SUCCESS;
+
+	if (obj == NULL) {
+		res = _FAIL;
+		goto exit;
+	}
+
+	_enter_critical_bh(&queue->lock, &irqL);
+
+	rtw_list_insert_tail(&obj->list, &queue->queue);
+
+	_exit_critical_bh(&queue->lock, &irqL);
+
+	//rtw_evt_notify_isr(pevtpriv);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+struct evt_obj *rtw_dequeue_evt(_queue *queue)
+{
+	_irqL irqL;
+	struct	evt_obj	*pevtobj;
+
+_func_enter_;
+
+	_enter_critical_bh(&queue->lock, &irqL);
+
+	if (rtw_is_list_empty(&(queue->queue)))
+		pevtobj = NULL;
+	else
+	{
+		pevtobj = LIST_CONTAINOR(get_next(&(queue->queue)), struct evt_obj, list);
+		rtw_list_delete(&pevtobj->list);
+	}
+
+	_exit_critical_bh(&queue->lock, &irqL);
+
+_func_exit_;
+
+	return pevtobj;
+}
+
+void rtw_free_evt_obj(struct evt_obj *pevtobj)
+{
+_func_enter_;
+
+	if(pevtobj->parmbuf)
+		rtw_mfree((unsigned char*)pevtobj->parmbuf, pevtobj->evtsz);
+
+	rtw_mfree((unsigned char*)pevtobj, sizeof(struct evt_obj));
+
+_func_exit_;
+}
+
+void rtw_evt_notify_isr(struct evt_priv *pevtpriv)
+{
+_func_enter_;
+	pevtpriv->evt_done_cnt++;
+	_rtw_up_sema(&(pevtpriv->evt_notify));
+_func_exit_;
+}
+#endif
+
+
+/*
+u8 rtw_setstandby_cmd(unsigned char  *adapter)
+*/
+u8 rtw_setstandby_cmd(_adapter *padapter, uint action)
+{
+	struct cmd_obj*			ph2c;
+	struct usb_suspend_parm*	psetusbsuspend;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+
+	u8 ret = _SUCCESS;
+
+_func_enter_;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if (ph2c == NULL) {
+		ret = _FAIL;
+		goto exit;
+	}
+
+	psetusbsuspend = (struct usb_suspend_parm*)rtw_zmalloc(sizeof(struct usb_suspend_parm));
+	if (psetusbsuspend == NULL) {
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		ret = _FAIL;
+		goto exit;
+	}
+
+	psetusbsuspend->action = action;
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, psetusbsuspend, GEN_CMD_CODE(_SetUsbSuspend));
+
+	ret = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+exit:
+
+_func_exit_;
+
+	return ret;
+}
+
+/*
+rtw_sitesurvey_cmd(~)
+	### NOTE:#### (!!!!)
+	MUST TAKE CARE THAT BEFORE CALLING THIS FUNC, YOU SHOULD HAVE LOCKED pmlmepriv->lock
+*/
+u8 rtw_sitesurvey_cmd(_adapter  *padapter, NDIS_802_11_SSID *ssid, int ssid_num,
+	struct rtw_ieee80211_channel *ch, int ch_num)
+{
+	u8 res = _FAIL;
+	struct cmd_obj		*ph2c;
+	struct sitesurvey_parm	*psurveyPara;
+	struct cmd_priv 	*pcmdpriv = &padapter->cmdpriv;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+
+_func_enter_;
+
+#ifdef CONFIG_LPS
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE){
+		rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_SCAN, 1);
+	}
+#endif
+
+#ifdef CONFIG_P2P_PS
+	if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) {
+		p2p_ps_wk_cmd(padapter, P2P_PS_SCAN, 1);
+	}
+#endif // CONFIG_P2P_PS
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if (ph2c == NULL)
+		return _FAIL;
+
+	psurveyPara = (struct sitesurvey_parm*)rtw_zmalloc(sizeof(struct sitesurvey_parm));
+	if (psurveyPara == NULL) {
+		rtw_mfree((unsigned char*) ph2c, sizeof(struct cmd_obj));
+		return _FAIL;
+	}
+
+	rtw_free_network_queue(padapter, _FALSE);
+
+	RT_TRACE(_module_rtl871x_cmd_c_, _drv_info_, ("\nflush  network queue\n\n"));
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, psurveyPara, GEN_CMD_CODE(_SiteSurvey));
+
+	/* psurveyPara->bsslimit = 48; */
+	psurveyPara->scan_mode = pmlmepriv->scan_mode;
+
+	/* prepare ssid list */
+	if (ssid) {
+		int i;
+		for (i=0; i<ssid_num && i< RTW_SSID_SCAN_AMOUNT; i++) {
+			if (ssid[i].SsidLength) {
+				_rtw_memcpy(&psurveyPara->ssid[i], &ssid[i], sizeof(NDIS_802_11_SSID));
+				psurveyPara->ssid_num++;
+				if (0)
+				DBG_871X(FUNC_ADPT_FMT" ssid:(%s, %d)\n", FUNC_ADPT_ARG(padapter),
+					psurveyPara->ssid[i].Ssid, psurveyPara->ssid[i].SsidLength);
+			}
+		}
+	}
+
+	/* prepare channel list */
+	if (ch) {
+		int i;
+		for (i=0; i<ch_num && i< RTW_CHANNEL_SCAN_AMOUNT; i++) {
+			if (ch[i].hw_value && !(ch[i].flags & RTW_IEEE80211_CHAN_DISABLED)) {
+				_rtw_memcpy(&psurveyPara->ch[i], &ch[i], sizeof(struct rtw_ieee80211_channel));
+				psurveyPara->ch_num++;
+				if (0)
+				DBG_871X(FUNC_ADPT_FMT" ch:%u\n", FUNC_ADPT_ARG(padapter),
+					psurveyPara->ch[i].hw_value);
+			}
+		}
+	}
+
+	set_fwstate(pmlmepriv, _FW_UNDER_SURVEY);
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+	if(res == _SUCCESS) {
+
+		pmlmepriv->scan_start_time = rtw_get_current_time();
+
+#ifdef CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+		if (padapter->pbuddy_adapter == NULL )
+			goto full_scan_timeout;
+		if((padapter->pbuddy_adapter->mlmeextpriv.mlmext_info.state&0x03) == WIFI_FW_AP_STATE)
+			_set_timer(&pmlmepriv->scan_to_timer,
+				SURVEY_TO * ( padapter->mlmeextpriv.max_chan_nums + ( padapter->mlmeextpriv.max_chan_nums  / RTW_SCAN_NUM_OF_CH ) * RTW_STAY_AP_CH_MILLISECOND ) + 1000 );
+		else
+#endif //CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+full_scan_timeout:
+			_set_timer(&pmlmepriv->scan_to_timer, SCANNING_TIMEOUT);
+
+		rtw_led_control(padapter, LED_CTL_SITE_SURVEY);
+
+		pmlmepriv->scan_interval = SCAN_INTERVAL;// 30*2 sec = 60sec
+	} else {
+		_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
+	}
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_setdatarate_cmd(_adapter *padapter, u8 *rateset)
+{
+	struct cmd_obj*			ph2c;
+	struct setdatarate_parm*	pbsetdataratepara;
+	struct cmd_priv*		pcmdpriv = &padapter->cmdpriv;
+	u8	res = _SUCCESS;
+
+_func_enter_;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if (ph2c == NULL) {
+		res = _FAIL;
+		goto exit;
+	}
+
+	pbsetdataratepara = (struct setdatarate_parm*)rtw_zmalloc(sizeof(struct setdatarate_parm));
+	if (pbsetdataratepara == NULL) {
+		rtw_mfree((u8 *) ph2c, sizeof(struct cmd_obj));
+		res = _FAIL;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pbsetdataratepara, GEN_CMD_CODE(_SetDataRate));
+#ifdef MP_FIRMWARE_OFFLOAD
+	pbsetdataratepara->curr_rateidx = *(u32*)rateset;
+//	_rtw_memcpy(pbsetdataratepara, rateset, sizeof(u32));
+#else
+	pbsetdataratepara->mac_id = 5;
+	_rtw_memcpy(pbsetdataratepara->datarates, rateset, NumRates);
+#endif
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_setbasicrate_cmd(_adapter *padapter, u8 *rateset)
+{
+	struct cmd_obj*			ph2c;
+	struct setbasicrate_parm*	pssetbasicratepara;
+	struct cmd_priv*		pcmdpriv=&padapter->cmdpriv;
+	u8	res = _SUCCESS;
+
+_func_enter_;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if (ph2c == NULL) {
+		res= _FAIL;
+		goto exit;
+	}
+	pssetbasicratepara = (struct setbasicrate_parm*)rtw_zmalloc(sizeof(struct setbasicrate_parm));
+
+	if (pssetbasicratepara == NULL) {
+		rtw_mfree((u8*) ph2c, sizeof(struct cmd_obj));
+		res = _FAIL;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pssetbasicratepara, _SetBasicRate_CMD_);
+
+	_rtw_memcpy(pssetbasicratepara->basicrates, rateset, NumRates);
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+
+/*
+unsigned char rtw_setphy_cmd(unsigned char  *adapter)
+
+1.  be called only after rtw_update_registrypriv_dev_network( ~) or mp testing program
+2.  for AdHoc/Ap mode or mp mode?
+
+*/
+u8 rtw_setphy_cmd(_adapter *padapter, u8 modem, u8 ch)
+{
+	struct cmd_obj*			ph2c;
+	struct setphy_parm*		psetphypara;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+//	struct mlme_priv			*pmlmepriv = &padapter->mlmepriv;
+//	struct registry_priv*		pregistry_priv = &padapter->registrypriv;
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+		}
+	psetphypara = (struct setphy_parm*)rtw_zmalloc(sizeof(struct setphy_parm));
+
+	if(psetphypara==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, psetphypara, _SetPhy_CMD_);
+
+	RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,("CH=%d, modem=%d", ch, modem));
+
+	psetphypara->modem = modem;
+	psetphypara->rfchannel = ch;
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+exit:
+_func_exit_;
+	return res;
+}
+
+u8 rtw_setbbreg_cmd(_adapter*padapter, u8 offset, u8 val)
+{
+	struct cmd_obj*			ph2c;
+	struct writeBB_parm*		pwritebbparm;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+_func_enter_;
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+		}
+	pwritebbparm = (struct writeBB_parm*)rtw_zmalloc(sizeof(struct writeBB_parm));
+
+	if(pwritebbparm==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pwritebbparm, GEN_CMD_CODE(_SetBBReg));
+
+	pwritebbparm->offset = offset;
+	pwritebbparm->value = val;
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+exit:
+_func_exit_;
+	return res;
+}
+
+u8 rtw_getbbreg_cmd(_adapter  *padapter, u8 offset, u8 *pval)
+{
+	struct cmd_obj*			ph2c;
+	struct readBB_parm*		prdbbparm;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+
+_func_enter_;
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res=_FAIL;
+		goto exit;
+		}
+	prdbbparm = (struct readBB_parm*)rtw_zmalloc(sizeof(struct readBB_parm));
+
+	if(prdbbparm ==NULL){
+		rtw_mfree((unsigned char *) ph2c, sizeof(struct	cmd_obj));
+		return _FAIL;
+	}
+
+	_rtw_init_listhead(&ph2c->list);
+	ph2c->cmdcode =GEN_CMD_CODE(_GetBBReg);
+	ph2c->parmbuf = (unsigned char *)prdbbparm;
+	ph2c->cmdsz =  sizeof(struct readBB_parm);
+	ph2c->rsp = pval;
+	ph2c->rspsz = sizeof(struct readBB_rsp);
+
+	prdbbparm ->offset = offset;
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+exit:
+_func_exit_;
+	return res;
+}
+
+u8 rtw_setrfreg_cmd(_adapter  *padapter, u8 offset, u32 val)
+{
+	struct cmd_obj*			ph2c;
+	struct writeRF_parm*		pwriterfparm;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+_func_enter_;
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+	pwriterfparm = (struct writeRF_parm*)rtw_zmalloc(sizeof(struct writeRF_parm));
+
+	if(pwriterfparm==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pwriterfparm, GEN_CMD_CODE(_SetRFReg));
+
+	pwriterfparm->offset = offset;
+	pwriterfparm->value = val;
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+exit:
+_func_exit_;
+	return res;
+}
+
+u8 rtw_getrfreg_cmd(_adapter  *padapter, u8 offset, u8 *pval)
+{
+	struct cmd_obj*			ph2c;
+	struct readRF_parm*		prdrfparm;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	prdrfparm = (struct readRF_parm*)rtw_zmalloc(sizeof(struct readRF_parm));
+	if(prdrfparm ==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	_rtw_init_listhead(&ph2c->list);
+	ph2c->cmdcode =GEN_CMD_CODE(_GetRFReg);
+	ph2c->parmbuf = (unsigned char *)prdrfparm;
+	ph2c->cmdsz =  sizeof(struct readRF_parm);
+	ph2c->rsp = pval;
+	ph2c->rspsz = sizeof(struct readRF_rsp);
+
+	prdrfparm ->offset = offset;
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+void rtw_getbbrfreg_cmdrsp_callback(_adapter*	padapter,  struct cmd_obj *pcmd)
+{
+ _func_enter_;
+
+	//rtw_free_cmd_obj(pcmd);
+	rtw_mfree((unsigned char*) pcmd->parmbuf, pcmd->cmdsz);
+	rtw_mfree((unsigned char*) pcmd, sizeof(struct cmd_obj));
+
+#ifdef CONFIG_MP_INCLUDED
+	padapter->mppriv.workparam.bcompleted= _TRUE;
+#endif
+_func_exit_;
+}
+
+void rtw_readtssi_cmdrsp_callback(_adapter*	padapter,  struct cmd_obj *pcmd)
+{
+ _func_enter_;
+
+	rtw_mfree((unsigned char*) pcmd->parmbuf, pcmd->cmdsz);
+	rtw_mfree((unsigned char*) pcmd, sizeof(struct cmd_obj));
+
+#ifdef CONFIG_MP_INCLUDED
+	padapter->mppriv.workparam.bcompleted= _TRUE;
+#endif
+
+_func_exit_;
+}
+
+u8 rtw_createbss_cmd(_adapter  *padapter)
+{
+	struct cmd_obj*			pcmd;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+	struct mlme_priv			*pmlmepriv = &padapter->mlmepriv;
+	WLAN_BSSID_EX		*pdev_network = &padapter->registrypriv.dev_network;
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	rtw_led_control(padapter, LED_CTL_START_TO_LINK);
+
+	if (pmlmepriv->assoc_ssid.SsidLength == 0){
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,(" createbss for Any SSid:%s\n",pmlmepriv->assoc_ssid.Ssid));
+	} else {
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,(" createbss for SSid:%s\n", pmlmepriv->assoc_ssid.Ssid));
+	}
+
+	pcmd = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(pcmd==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	_rtw_init_listhead(&pcmd->list);
+	pcmd->cmdcode = _CreateBss_CMD_;
+	pcmd->parmbuf = (unsigned char *)pdev_network;
+	pcmd->cmdsz = get_WLAN_BSSID_EX_sz((WLAN_BSSID_EX*)pdev_network);
+	pcmd->rsp = NULL;
+	pcmd->rspsz = 0;
+
+	pdev_network->Length = pcmd->cmdsz;
+
+#ifdef CONFIG_RTL8712
+	//notes: translate IELength & Length after assign the Length to cmdsz;
+	pdev_network->Length = cpu_to_le32(pcmd->cmdsz);
+	pdev_network->IELength = cpu_to_le32(pdev_network->IELength);
+	pdev_network->Ssid.SsidLength = cpu_to_le32(pdev_network->Ssid.SsidLength);
+#endif
+
+	res = rtw_enqueue_cmd(pcmdpriv, pcmd);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_createbss_cmd_ex(_adapter  *padapter, unsigned char *pbss, unsigned int sz)
+{
+	struct cmd_obj*	pcmd;
+	struct cmd_priv 	*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	pcmd = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(pcmd==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	_rtw_init_listhead(&pcmd->list);
+	pcmd->cmdcode = GEN_CMD_CODE(_CreateBss);
+	pcmd->parmbuf = pbss;
+	pcmd->cmdsz =  sz;
+	pcmd->rsp = NULL;
+	pcmd->rspsz = 0;
+
+	res = rtw_enqueue_cmd(pcmdpriv, pcmd);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_joinbss_cmd(_adapter  *padapter, struct wlan_network* pnetwork)
+{
+	u8	*auth, res = _SUCCESS;
+	uint	t_len = 0;
+	WLAN_BSSID_EX		*psecnetwork;
+	struct cmd_obj		*pcmd;
+	struct cmd_priv		*pcmdpriv=&padapter->cmdpriv;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct qos_priv		*pqospriv= &pmlmepriv->qospriv;
+	struct security_priv	*psecuritypriv=&padapter->securitypriv;
+	struct registry_priv	*pregistrypriv = &padapter->registrypriv;
+	struct ht_priv			*phtpriv = &pmlmepriv->htpriv;
+	NDIS_802_11_NETWORK_INFRASTRUCTURE ndis_network_mode = pnetwork->network.InfrastructureMode;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+_func_enter_;
+
+	rtw_led_control(padapter, LED_CTL_START_TO_LINK);
+
+	if (pmlmepriv->assoc_ssid.SsidLength == 0){
+		RT_TRACE(_module_rtl871x_cmd_c_, _drv_info_, ("+Join cmd: Any SSid\n"));
+	} else {
+		RT_TRACE(_module_rtl871x_cmd_c_, _drv_notice_, ("+Join cmd: SSid=[%s]\n", pmlmepriv->assoc_ssid.Ssid));
+	}
+
+	pcmd = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(pcmd==NULL){
+		res=_FAIL;
+		RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, ("rtw_joinbss_cmd: memory allocate for cmd_obj fail!!!\n"));
+		goto exit;
+	}
+	/* // for IEs is pointer
+	t_len = sizeof (ULONG) + sizeof (NDIS_802_11_MAC_ADDRESS) + 2 +
+			sizeof (NDIS_802_11_SSID) + sizeof (ULONG) +
+			sizeof (NDIS_802_11_RSSI) + sizeof (NDIS_802_11_NETWORK_TYPE) +
+			sizeof (NDIS_802_11_CONFIGURATION) +
+			sizeof (NDIS_802_11_NETWORK_INFRASTRUCTURE) +
+			sizeof (NDIS_802_11_RATES_EX)+ sizeof(WLAN_PHY_INFO)+ sizeof (ULONG) + MAX_IE_SZ;
+	*/
+	//for IEs is fix buf size
+	t_len = sizeof(WLAN_BSSID_EX);
+
+
+	//for hidden ap to set fw_state here
+	if (check_fwstate(pmlmepriv, WIFI_STATION_STATE|WIFI_ADHOC_STATE) != _TRUE)
+	{
+		switch(ndis_network_mode)
+		{
+			case Ndis802_11IBSS:
+				set_fwstate(pmlmepriv, WIFI_ADHOC_STATE);
+				break;
+
+			case Ndis802_11Infrastructure:
+				set_fwstate(pmlmepriv, WIFI_STATION_STATE);
+				break;
+
+			case Ndis802_11APMode:
+			case Ndis802_11AutoUnknown:
+			case Ndis802_11InfrastructureMax:
+				break;
+
+		}
+	}
+
+	psecnetwork=(WLAN_BSSID_EX *)&psecuritypriv->sec_bss;
+	if(psecnetwork==NULL)
+	{
+		if(pcmd !=NULL)
+			rtw_mfree((unsigned char *)pcmd, sizeof(struct	cmd_obj));
+
+		res=_FAIL;
+
+		RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, ("rtw_joinbss_cmd :psecnetwork==NULL!!!\n"));
+
+		goto exit;
+	}
+
+	_rtw_memset(psecnetwork, 0, t_len);
+
+	_rtw_memcpy(psecnetwork, &pnetwork->network, get_WLAN_BSSID_EX_sz(&pnetwork->network));
+
+	auth=&psecuritypriv->authenticator_ie[0];
+	psecuritypriv->authenticator_ie[0]=(unsigned char)psecnetwork->IELength;
+
+	if((psecnetwork->IELength-12) < (256-1)) {
+		_rtw_memcpy(&psecuritypriv->authenticator_ie[1], &psecnetwork->IEs[12], psecnetwork->IELength-12);
+	} else {
+		_rtw_memcpy(&psecuritypriv->authenticator_ie[1], &psecnetwork->IEs[12], (256-1));
+	}
+
+	psecnetwork->IELength = 0;
+	// Added by Albert 2009/02/18
+	// If the the driver wants to use the bssid to create the connection.
+	// If not,  we have to copy the connecting AP's MAC address to it so that
+	// the driver just has the bssid information for PMKIDList searching.
+
+	if ( pmlmepriv->assoc_by_bssid == _FALSE )
+	{
+		_rtw_memcpy( &pmlmepriv->assoc_bssid[ 0 ], &pnetwork->network.MacAddress[ 0 ], ETH_ALEN );
+	}
+
+	psecnetwork->IELength = rtw_restruct_sec_ie(padapter, &pnetwork->network.IEs[0], &psecnetwork->IEs[0], pnetwork->network.IELength);
+
+
+	pqospriv->qos_option = 0;
+
+	if(pregistrypriv->wmm_enable)
+	{
+		u32 tmp_len;
+
+		tmp_len = rtw_restruct_wmm_ie(padapter, &pnetwork->network.IEs[0], &psecnetwork->IEs[0], pnetwork->network.IELength, psecnetwork->IELength);
+
+		if (psecnetwork->IELength != tmp_len)
+		{
+			psecnetwork->IELength = tmp_len;
+			pqospriv->qos_option = 1; //There is WMM IE in this corresp. beacon
+		}
+		else
+		{
+			pqospriv->qos_option = 0;//There is no WMM IE in this corresp. beacon
+		}
+	}
+
+#ifdef CONFIG_80211N_HT
+	phtpriv->ht_option = _FALSE;
+	if(pregistrypriv->ht_enable)
+	{
+		//	Added by Albert 2010/06/23
+		//	For the WEP mode, we will use the bg mode to do the connection to avoid some IOT issue.
+		//	Especially for Realtek 8192u SoftAP.
+		if (	( padapter->securitypriv.dot11PrivacyAlgrthm != _WEP40_ ) &&
+			( padapter->securitypriv.dot11PrivacyAlgrthm != _WEP104_ ) &&
+			( padapter->securitypriv.dot11PrivacyAlgrthm != _TKIP_ ))
+		{
+			//rtw_restructure_ht_ie
+			rtw_restructure_ht_ie(padapter, &pnetwork->network.IEs[0], &psecnetwork->IEs[0],
+									pnetwork->network.IELength, &psecnetwork->IELength, (u8)psecnetwork->Configuration.DSConfig );
+		}
+	}
+
+#endif
+
+	pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pnetwork->network.IEs, pnetwork->network.IELength);
+
+	#if 0
+	psecuritypriv->supplicant_ie[0]=(u8)psecnetwork->IELength;
+
+	if(psecnetwork->IELength < (256-1))
+	{
+		_rtw_memcpy(&psecuritypriv->supplicant_ie[1], &psecnetwork->IEs[0], psecnetwork->IELength);
+	}
+	else
+	{
+		_rtw_memcpy(&psecuritypriv->supplicant_ie[1], &psecnetwork->IEs[0], (256-1));
+	}
+	#endif
+
+	pcmd->cmdsz = get_WLAN_BSSID_EX_sz(psecnetwork);//get cmdsz before endian conversion
+
+#ifdef CONFIG_RTL8712
+	//wlan_network endian conversion
+	psecnetwork->Length = cpu_to_le32(psecnetwork->Length);
+	psecnetwork->Ssid.SsidLength= cpu_to_le32(psecnetwork->Ssid.SsidLength);
+	psecnetwork->Privacy = cpu_to_le32(psecnetwork->Privacy);
+	psecnetwork->Rssi = cpu_to_le32(psecnetwork->Rssi);
+	psecnetwork->NetworkTypeInUse = cpu_to_le32(psecnetwork->NetworkTypeInUse);
+	psecnetwork->Configuration.ATIMWindow = cpu_to_le32(psecnetwork->Configuration.ATIMWindow);
+	psecnetwork->Configuration.BeaconPeriod = cpu_to_le32(psecnetwork->Configuration.BeaconPeriod);
+	psecnetwork->Configuration.DSConfig = cpu_to_le32(psecnetwork->Configuration.DSConfig);
+	psecnetwork->Configuration.FHConfig.DwellTime=cpu_to_le32(psecnetwork->Configuration.FHConfig.DwellTime);
+	psecnetwork->Configuration.FHConfig.HopPattern=cpu_to_le32(psecnetwork->Configuration.FHConfig.HopPattern);
+	psecnetwork->Configuration.FHConfig.HopSet=cpu_to_le32(psecnetwork->Configuration.FHConfig.HopSet);
+	psecnetwork->Configuration.FHConfig.Length=cpu_to_le32(psecnetwork->Configuration.FHConfig.Length);
+	psecnetwork->Configuration.Length = cpu_to_le32(psecnetwork->Configuration.Length);
+	psecnetwork->InfrastructureMode = cpu_to_le32(psecnetwork->InfrastructureMode);
+	psecnetwork->IELength = cpu_to_le32(psecnetwork->IELength);
+#endif
+
+	_rtw_init_listhead(&pcmd->list);
+	pcmd->cmdcode = _JoinBss_CMD_;//GEN_CMD_CODE(_JoinBss)
+	pcmd->parmbuf = (unsigned char *)psecnetwork;
+	pcmd->rsp = NULL;
+	pcmd->rspsz = 0;
+
+	res = rtw_enqueue_cmd(pcmdpriv, pcmd);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_disassoc_cmd(_adapter*padapter, u32 deauth_timeout_ms, bool enqueue) /* for sta_mode */
+{
+	struct cmd_obj *cmdobj = NULL;
+	struct disconnect_parm *param = NULL;
+	struct cmd_priv *cmdpriv = &padapter->cmdpriv;
+	u8 res = _SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_cmd_c_, _drv_notice_, ("+rtw_disassoc_cmd\n"));
+
+	/* prepare cmd parameter */
+	param = (struct disconnect_parm *)rtw_zmalloc(sizeof(*param));
+	if (param == NULL) {
+		res = _FAIL;
+		goto exit;
+	}
+	param->deauth_timeout_ms = deauth_timeout_ms;
+
+	if (enqueue) {
+		/* need enqueue, prepare cmd_obj and enqueue */
+		cmdobj = (struct cmd_obj *)rtw_zmalloc(sizeof(*cmdobj));
+		if (cmdobj == NULL) {
+			res = _FAIL;
+			rtw_mfree((u8 *)param, sizeof(*param));
+			goto exit;
+		}
+		init_h2fwcmd_w_parm_no_rsp(cmdobj, param, _DisConnect_CMD_);
+		res = rtw_enqueue_cmd(cmdpriv, cmdobj);
+	} else {
+		/* no need to enqueue, do the cmd hdl directly and free cmd parameter */
+		if (H2C_SUCCESS != disconnect_hdl(padapter, (u8 *)param))
+			res = _FAIL;
+		rtw_mfree((u8 *)param, sizeof(*param));
+	}
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_setopmode_cmd(_adapter  *padapter, NDIS_802_11_NETWORK_INFRASTRUCTURE networktype)
+{
+	struct	cmd_obj*	ph2c;
+	struct	setopmode_parm* psetop;
+
+	struct	cmd_priv   *pcmdpriv= &padapter->cmdpriv;
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FALSE;
+		goto exit;
+	}
+	psetop = (struct setopmode_parm*)rtw_zmalloc(sizeof(struct setopmode_parm));
+
+	if(psetop==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		res=_FALSE;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, psetop, _SetOpMode_CMD_);
+	psetop->mode = (u8)networktype;
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_setstakey_cmd(_adapter *padapter, u8 *psta, u8 unicast_key)
+{
+	struct cmd_obj*			ph2c;
+	struct set_stakey_parm	*psetstakey_para;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+	struct set_stakey_rsp		*psetstakey_rsp = NULL;
+
+	struct mlme_priv			*pmlmepriv = &padapter->mlmepriv;
+	struct security_priv 		*psecuritypriv = &padapter->securitypriv;
+	struct sta_info* 			sta = (struct sta_info* )psta;
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if ( ph2c == NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	psetstakey_para = (struct set_stakey_parm*)rtw_zmalloc(sizeof(struct set_stakey_parm));
+	if(psetstakey_para==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		res=_FAIL;
+		goto exit;
+	}
+
+	psetstakey_rsp = (struct set_stakey_rsp*)rtw_zmalloc(sizeof(struct set_stakey_rsp));
+	if(psetstakey_rsp == NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		rtw_mfree((u8 *) psetstakey_para, sizeof(struct set_stakey_parm));
+		res=_FAIL;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, psetstakey_para, _SetStaKey_CMD_);
+	ph2c->rsp = (u8 *) psetstakey_rsp;
+	ph2c->rspsz = sizeof(struct set_stakey_rsp);
+
+	_rtw_memcpy(psetstakey_para->addr, sta->hwaddr,ETH_ALEN);
+
+	if(check_fwstate(pmlmepriv, WIFI_STATION_STATE)){
+#ifdef CONFIG_TDLS
+		if(sta->tdls_sta_state&TDLS_LINKED_STATE)
+			psetstakey_para->algorithm=(u8)sta->dot118021XPrivacy;
+		else
+#endif //CONFIG_TDLS
+		psetstakey_para->algorithm =(unsigned char) psecuritypriv->dot11PrivacyAlgrthm;
+	}else{
+		GET_ENCRY_ALGO(psecuritypriv, sta, psetstakey_para->algorithm, _FALSE);
+	}
+
+	if (unicast_key == _TRUE) {
+#ifdef CONFIG_TDLS
+		if(sta->tdls_sta_state&TDLS_LINKED_STATE)
+			_rtw_memcpy(&psetstakey_para->key, sta->tpk.tk, 16);
+		else
+#endif //CONFIG_TDLS
+			_rtw_memcpy(&psetstakey_para->key, &sta->dot118021x_UncstKey, 16);
+        } else {
+		_rtw_memcpy(&psetstakey_para->key, &psecuritypriv->dot118021XGrpKey[psecuritypriv->dot118021XGrpKeyid].skey, 16);
+        }
+
+	//jeff: set this becasue at least sw key is ready
+	padapter->securitypriv.busetkipkey=_TRUE;
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_clearstakey_cmd(_adapter *padapter, u8 *psta, u8 entry, u8 enqueue)
+{
+	struct cmd_obj*			ph2c;
+	struct set_stakey_parm	*psetstakey_para;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+	struct set_stakey_rsp		*psetstakey_rsp = NULL;
+	struct mlme_priv			*pmlmepriv = &padapter->mlmepriv;
+	struct security_priv 		*psecuritypriv = &padapter->securitypriv;
+	struct sta_info* 			sta = (struct sta_info* )psta;
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	if(!enqueue)
+	{
+		clear_cam_entry(padapter, entry);
+	}
+	else
+	{
+		ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+		if ( ph2c == NULL){
+			res= _FAIL;
+			goto exit;
+		}
+
+		psetstakey_para = (struct set_stakey_parm*)rtw_zmalloc(sizeof(struct set_stakey_parm));
+		if(psetstakey_para==NULL){
+			rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+			res=_FAIL;
+			goto exit;
+		}
+
+		psetstakey_rsp = (struct set_stakey_rsp*)rtw_zmalloc(sizeof(struct set_stakey_rsp));
+		if(psetstakey_rsp == NULL){
+			rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+			rtw_mfree((u8 *) psetstakey_para, sizeof(struct set_stakey_parm));
+			res=_FAIL;
+			goto exit;
+		}
+
+		init_h2fwcmd_w_parm_no_rsp(ph2c, psetstakey_para, _SetStaKey_CMD_);
+		ph2c->rsp = (u8 *) psetstakey_rsp;
+		ph2c->rspsz = sizeof(struct set_stakey_rsp);
+
+		_rtw_memcpy(psetstakey_para->addr, sta->hwaddr, ETH_ALEN);
+
+		psetstakey_para->algorithm = _NO_PRIVACY_;
+
+		psetstakey_para->id = entry;
+
+		res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+	}
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_setrttbl_cmd(_adapter  *padapter, struct setratable_parm *prate_table)
+{
+	struct cmd_obj*			ph2c;
+	struct setratable_parm *	psetrttblparm;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+_func_enter_;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+		}
+	psetrttblparm = (struct setratable_parm*)rtw_zmalloc(sizeof(struct setratable_parm));
+
+	if(psetrttblparm==NULL){
+		rtw_mfree((unsigned char *) ph2c, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, psetrttblparm, GEN_CMD_CODE(_SetRaTable));
+
+	_rtw_memcpy(psetrttblparm,prate_table,sizeof(struct setratable_parm));
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+exit:
+_func_exit_;
+	return res;
+
+}
+
+u8 rtw_getrttbl_cmd(_adapter  *padapter, struct getratable_rsp *pval)
+{
+	struct cmd_obj*			ph2c;
+	struct getratable_parm *	pgetrttblparm;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+_func_enter_;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+	pgetrttblparm = (struct getratable_parm*)rtw_zmalloc(sizeof(struct getratable_parm));
+
+	if(pgetrttblparm==NULL){
+		rtw_mfree((unsigned char *) ph2c, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+//	init_h2fwcmd_w_parm_no_rsp(ph2c, psetrttblparm, GEN_CMD_CODE(_SetRaTable));
+
+	_rtw_init_listhead(&ph2c->list);
+	ph2c->cmdcode =GEN_CMD_CODE(_GetRaTable);
+	ph2c->parmbuf = (unsigned char *)pgetrttblparm;
+	ph2c->cmdsz =  sizeof(struct getratable_parm);
+	ph2c->rsp = (u8*)pval;
+	ph2c->rspsz = sizeof(struct getratable_rsp);
+
+	pgetrttblparm ->rsvd = 0x0;
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+exit:
+_func_exit_;
+	return res;
+
+}
+
+u8 rtw_setassocsta_cmd(_adapter  *padapter, u8 *mac_addr)
+{
+	struct cmd_priv 		*pcmdpriv = &padapter->cmdpriv;
+	struct cmd_obj*			ph2c;
+	struct set_assocsta_parm	*psetassocsta_para;
+	struct set_stakey_rsp		*psetassocsta_rsp = NULL;
+
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	psetassocsta_para = (struct set_assocsta_parm*)rtw_zmalloc(sizeof(struct set_assocsta_parm));
+	if(psetassocsta_para==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		res=_FAIL;
+		goto exit;
+	}
+
+	psetassocsta_rsp = (struct set_stakey_rsp*)rtw_zmalloc(sizeof(struct set_assocsta_rsp));
+	if(psetassocsta_rsp==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct	cmd_obj));
+		rtw_mfree((u8 *) psetassocsta_para, sizeof(struct set_assocsta_parm));
+		return _FAIL;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, psetassocsta_para, _SetAssocSta_CMD_);
+	ph2c->rsp = (u8 *) psetassocsta_rsp;
+	ph2c->rspsz = sizeof(struct set_assocsta_rsp);
+
+	_rtw_memcpy(psetassocsta_para->addr, mac_addr,ETH_ALEN);
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+exit:
+
+_func_exit_;
+
+	return res;
+ }
+
+u8 rtw_addbareq_cmd(_adapter*padapter, u8 tid, u8 *addr)
+{
+	struct cmd_priv		*pcmdpriv = &padapter->cmdpriv;
+	struct cmd_obj*		ph2c;
+	struct addBaReq_parm	*paddbareq_parm;
+
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	paddbareq_parm = (struct addBaReq_parm*)rtw_zmalloc(sizeof(struct addBaReq_parm));
+	if(paddbareq_parm==NULL){
+		rtw_mfree((unsigned char *)ph2c, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	paddbareq_parm->tid = tid;
+	_rtw_memcpy(paddbareq_parm->addr, addr, ETH_ALEN);
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, paddbareq_parm, GEN_CMD_CODE(_AddBAReq));
+
+	//DBG_871X("rtw_addbareq_cmd, tid=%d\n", tid);
+
+	//rtw_enqueue_cmd(pcmdpriv, ph2c);
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+//add for CONFIG_IEEE80211W, none 11w can use it
+u8 rtw_reset_securitypriv_cmd(_adapter*padapter)
+{
+	struct cmd_obj*		ph2c;
+	struct drvextra_cmd_parm  *pdrvextra_cmd_parm;
+	struct cmd_priv	*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
+	if(pdrvextra_cmd_parm==NULL){
+		rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm->ec_id = RESET_SECURITYPRIV;
+	pdrvextra_cmd_parm->type_size = 0;
+	pdrvextra_cmd_parm->pbuf = (u8 *)padapter;
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+
+	//rtw_enqueue_cmd(pcmdpriv, ph2c);
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+exit:
+
+_func_exit_;
+
+	return res;
+
+}
+
+u8 rtw_free_assoc_resources_cmd(_adapter*padapter)
+{
+	struct cmd_obj*		ph2c;
+	struct drvextra_cmd_parm  *pdrvextra_cmd_parm;
+	struct cmd_priv	*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
+	if(pdrvextra_cmd_parm==NULL){
+		rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm->ec_id = FREE_ASSOC_RESOURCES;
+	pdrvextra_cmd_parm->type_size = 0;
+	pdrvextra_cmd_parm->pbuf = (u8 *)padapter;
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+
+	//rtw_enqueue_cmd(pcmdpriv, ph2c);
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+exit:
+
+_func_exit_;
+
+	return res;
+
+}
+
+
+u8 rtw_dynamic_chk_wk_cmd(_adapter*padapter)
+{
+	struct cmd_obj*		ph2c;
+	struct drvextra_cmd_parm  *pdrvextra_cmd_parm;
+	struct cmd_priv	*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	if ((padapter->bDriverStopped == _TRUE)||(padapter->bSurpriseRemoved== _TRUE))
+		goto exit;
+
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (padapter->adapter_type != PRIMARY_ADAPTER && padapter->pbuddy_adapter)
+		pcmdpriv = &(padapter->pbuddy_adapter->cmdpriv);
+#endif
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
+	if(pdrvextra_cmd_parm==NULL){
+		rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm->ec_id = DYNAMIC_CHK_WK_CID;
+	pdrvextra_cmd_parm->type_size = 0;
+	pdrvextra_cmd_parm->pbuf = (u8 *)padapter;
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+
+	//rtw_enqueue_cmd(pcmdpriv, ph2c);
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+exit:
+
+_func_exit_;
+
+	return res;
+
+}
+
+u8 rtw_set_ch_cmd(_adapter*padapter, u8 ch, u8 bw, u8 ch_offset, u8 enqueue)
+{
+	struct cmd_obj *pcmdobj;
+	struct set_ch_parm *set_ch_parm;
+	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
+
+	u8 res=_SUCCESS;
+
+_func_enter_;
+
+	DBG_871X(FUNC_NDEV_FMT" ch:%u, bw:%u, ch_offset:%u\n",
+		FUNC_NDEV_ARG(padapter->pnetdev), ch, bw, ch_offset);
+
+	/* check input parameter */
+
+	/* prepare cmd parameter */
+	set_ch_parm = (struct set_ch_parm *)rtw_zmalloc(sizeof(*set_ch_parm));
+	if (set_ch_parm == NULL) {
+		res= _FAIL;
+		goto exit;
+	}
+	set_ch_parm->ch = ch;
+	set_ch_parm->bw = bw;
+	set_ch_parm->ch_offset = ch_offset;
+
+	if (enqueue) {
+		/* need enqueue, prepare cmd_obj and enqueue */
+		pcmdobj = (struct cmd_obj*)rtw_zmalloc(sizeof(struct	cmd_obj));
+		if(pcmdobj == NULL){
+			rtw_mfree((u8 *)set_ch_parm, sizeof(*set_ch_parm));
+			res=_FAIL;
+			goto exit;
+		}
+
+		init_h2fwcmd_w_parm_no_rsp(pcmdobj, set_ch_parm, GEN_CMD_CODE(_SetChannel));
+		res = rtw_enqueue_cmd(pcmdpriv, pcmdobj);
+	} else {
+		/* no need to enqueue, do the cmd hdl directly and free cmd parameter */
+		if( H2C_SUCCESS !=set_ch_hdl(padapter, (u8 *)set_ch_parm) )
+			res = _FAIL;
+
+		rtw_mfree((u8 *)set_ch_parm, sizeof(*set_ch_parm));
+	}
+
+	/* do something based on res... */
+
+exit:
+
+	DBG_871X(FUNC_NDEV_FMT" res:%u\n", FUNC_NDEV_ARG(padapter->pnetdev), res);
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_set_chplan_cmd(_adapter*padapter, u8 chplan, u8 enqueue)
+{
+	struct	cmd_obj*	pcmdobj;
+	struct	SetChannelPlan_param *setChannelPlan_param;
+	struct	cmd_priv   *pcmdpriv = &padapter->cmdpriv;
+
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_cmd_c_, _drv_notice_, ("+rtw_set_chplan_cmd\n"));
+
+	//check input parameter
+	if(!rtw_is_channel_plan_valid(chplan)) {
+		res = _FAIL;
+		goto exit;
+	}
+
+	//prepare cmd parameter
+	setChannelPlan_param = (struct	SetChannelPlan_param *)rtw_zmalloc(sizeof(struct SetChannelPlan_param));
+	if(setChannelPlan_param == NULL) {
+		res= _FAIL;
+		goto exit;
+	}
+	setChannelPlan_param->channel_plan=chplan;
+
+	if(enqueue)
+	{
+		//need enqueue, prepare cmd_obj and enqueue
+		pcmdobj = (struct	cmd_obj*)rtw_zmalloc(sizeof(struct	cmd_obj));
+		if(pcmdobj == NULL){
+			rtw_mfree((u8 *)setChannelPlan_param, sizeof(struct SetChannelPlan_param));
+			res=_FAIL;
+			goto exit;
+		}
+
+		init_h2fwcmd_w_parm_no_rsp(pcmdobj, setChannelPlan_param, GEN_CMD_CODE(_SetChannelPlan));
+		res = rtw_enqueue_cmd(pcmdpriv, pcmdobj);
+	}
+	else
+	{
+		//no need to enqueue, do the cmd hdl directly and free cmd parameter
+		if( H2C_SUCCESS !=set_chplan_hdl(padapter, (unsigned char *)setChannelPlan_param) )
+			res = _FAIL;
+
+		rtw_mfree((u8 *)setChannelPlan_param, sizeof(struct SetChannelPlan_param));
+	}
+
+	//do something based on res...
+	if(res == _SUCCESS)
+		padapter->mlmepriv.ChannelPlan = chplan;
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_led_blink_cmd(_adapter*padapter, PLED_871x pLed)
+{
+	struct	cmd_obj*	pcmdobj;
+	struct	LedBlink_param *ledBlink_param;
+	struct	cmd_priv   *pcmdpriv = &padapter->cmdpriv;
+
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_cmd_c_, _drv_notice_, ("+rtw_led_blink_cmd\n"));
+
+	pcmdobj = (struct	cmd_obj*)rtw_zmalloc(sizeof(struct	cmd_obj));
+	if(pcmdobj == NULL){
+		res=_FAIL;
+		goto exit;
+	}
+
+	ledBlink_param = (struct	LedBlink_param *)rtw_zmalloc(sizeof(struct	LedBlink_param));
+	if(ledBlink_param == NULL) {
+		rtw_mfree((u8 *)pcmdobj, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	ledBlink_param->pLed=pLed;
+
+	init_h2fwcmd_w_parm_no_rsp(pcmdobj, ledBlink_param, GEN_CMD_CODE(_LedBlink));
+	res = rtw_enqueue_cmd(pcmdpriv, pcmdobj);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_set_csa_cmd(_adapter*padapter, u8 new_ch_no)
+{
+	struct	cmd_obj*	pcmdobj;
+	struct	SetChannelSwitch_param*setChannelSwitch_param;
+	struct 	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct	cmd_priv   *pcmdpriv = &padapter->cmdpriv;
+
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_cmd_c_, _drv_notice_, ("+rtw_set_csa_cmd\n"));
+
+	pcmdobj = (struct	cmd_obj*)rtw_zmalloc(sizeof(struct	cmd_obj));
+	if(pcmdobj == NULL){
+		res=_FAIL;
+		goto exit;
+	}
+
+	setChannelSwitch_param = (struct SetChannelSwitch_param *)rtw_zmalloc(sizeof(struct	SetChannelSwitch_param));
+	if(setChannelSwitch_param == NULL) {
+		rtw_mfree((u8 *)pcmdobj, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	setChannelSwitch_param->new_ch_no=new_ch_no;
+
+	init_h2fwcmd_w_parm_no_rsp(pcmdobj, setChannelSwitch_param, GEN_CMD_CODE(_SetChannelSwitch));
+	res = rtw_enqueue_cmd(pcmdpriv, pcmdobj);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_tdls_cmd(_adapter *padapter, u8 *addr, u8 option)
+{
+	struct	cmd_obj*	pcmdobj;
+	struct	TDLSoption_param	*TDLSoption;
+	struct 	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct	cmd_priv   *pcmdpriv = &padapter->cmdpriv;
+
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+#ifdef CONFIG_TDLS
+
+	RT_TRACE(_module_rtl871x_cmd_c_, _drv_notice_, ("+rtw_set_tdls_cmd\n"));
+
+	pcmdobj = (struct	cmd_obj*)rtw_zmalloc(sizeof(struct	cmd_obj));
+	if(pcmdobj == NULL){
+		res=_FAIL;
+		goto exit;
+	}
+
+	TDLSoption= (struct TDLSoption_param *)rtw_zmalloc(sizeof(struct TDLSoption_param));
+	if(TDLSoption == NULL) {
+		rtw_mfree((u8 *)pcmdobj, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	_rtw_spinlock(&(padapter->tdlsinfo.cmd_lock));
+	_rtw_memcpy(TDLSoption->addr, addr, 6);
+	TDLSoption->option = option;
+	_rtw_spinunlock(&(padapter->tdlsinfo.cmd_lock));
+	init_h2fwcmd_w_parm_no_rsp(pcmdobj, TDLSoption, GEN_CMD_CODE(_TDLS));
+	res = rtw_enqueue_cmd(pcmdpriv, pcmdobj);
+
+#endif	//CONFIG_TDLS
+
+exit:
+
+
+_func_exit_;
+
+	return res;
+}
+
+static void traffic_status_watchdog(_adapter *padapter)
+{
+#ifdef CONFIG_LPS
+	u8	bEnterPS;
+#endif
+	u16	BusyThreshold = 100;
+	u8	bBusyTraffic = _FALSE, bTxBusyTraffic = _FALSE, bRxBusyTraffic = _FALSE;
+	u8	bHigherBusyTraffic = _FALSE, bHigherBusyRxTraffic = _FALSE, bHigherBusyTxTraffic = _FALSE;
+	struct mlme_priv		*pmlmepriv = &(padapter->mlmepriv);
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &(padapter->tdlsinfo);
+#endif //CONFIG_TDLS
+
+	RT_LINK_DETECT_T * link_detect = &pmlmepriv->LinkDetectInfo;
+
+	//
+	// Determine if our traffic is busy now
+	//
+	if((check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE)
+		/*&& !MgntInitAdapterInProgress(pMgntInfo)*/)
+	{
+
+		// if we raise bBusyTraffic in last watchdog, using lower threshold.
+		if (pmlmepriv->LinkDetectInfo.bBusyTraffic)
+			BusyThreshold = 75;
+		if( pmlmepriv->LinkDetectInfo.NumRxOkInPeriod > BusyThreshold ||
+			pmlmepriv->LinkDetectInfo.NumTxOkInPeriod > BusyThreshold )
+		{
+			bBusyTraffic = _TRUE;
+
+			if(pmlmepriv->LinkDetectInfo.NumRxOkInPeriod > BusyThreshold)
+				bRxBusyTraffic = _TRUE;
+
+			if(pmlmepriv->LinkDetectInfo.NumTxOkInPeriod > BusyThreshold)
+				bTxBusyTraffic = _TRUE;
+		}
+
+		// Higher Tx/Rx data.
+		if( pmlmepriv->LinkDetectInfo.NumRxOkInPeriod > 4000 ||
+			pmlmepriv->LinkDetectInfo.NumTxOkInPeriod > 4000 )
+		{
+			bHigherBusyTraffic = _TRUE;
+
+			// Extremely high Rx data.
+			if(pmlmepriv->LinkDetectInfo.NumRxOkInPeriod > 5000)
+				bHigherBusyRxTraffic = _TRUE;
+
+			// Extremely high Tx data.
+			if(pmlmepriv->LinkDetectInfo.NumTxOkInPeriod > 5000)
+				bHigherBusyTxTraffic = _TRUE;
+		}
+
+#ifdef CONFIG_TRAFFIC_PROTECT
+#define TX_ACTIVE_TH 2
+#define RX_ACTIVE_TH 1
+#define TRAFFIC_PROTECT_PERIOD_MS 4500
+
+	if (link_detect->NumTxOkInPeriod > TX_ACTIVE_TH
+		|| link_detect->NumRxUnicastOkInPeriod > RX_ACTIVE_TH) {
+
+		LOG_LEVEL(_drv_info_, FUNC_ADPT_FMT" acqiure wake_lock for %u ms(tx:%d,rx_unicast:%d)\n",
+			FUNC_ADPT_ARG(padapter),
+			TRAFFIC_PROTECT_PERIOD_MS,
+			link_detect->NumTxOkInPeriod,
+			link_detect->NumRxUnicastOkInPeriod);
+
+		rtw_lock_suspend_timeout(TRAFFIC_PROTECT_PERIOD_MS);
+	}
+#endif
+
+#ifdef CONFIG_TDLS
+#ifdef CONFIG_TDLS_AUTOSETUP
+		if( ( ptdlsinfo->watchdog_count % TDLS_WATCHDOG_PERIOD ) == 0 )	//TDLS_WATCHDOG_PERIOD * 2sec, periodically sending
+			issue_tdls_dis_req( padapter, NULL );
+		ptdlsinfo->watchdog_count++;
+#endif //CONFIG_TDLS_AUTOSETUP
+#endif //CONFIG_TDLS
+
+#ifdef CONFIG_LPS
+		// check traffic for  powersaving.
+		if( ((pmlmepriv->LinkDetectInfo.NumRxUnicastOkInPeriod + pmlmepriv->LinkDetectInfo.NumTxOkInPeriod) > 8 ) ||
+			(pmlmepriv->LinkDetectInfo.NumRxUnicastOkInPeriod > 2) )
+		{
+			//DBG_871X("Tx = %d, Rx = %d \n",pmlmepriv->LinkDetectInfo.NumTxOkInPeriod,pmlmepriv->LinkDetectInfo.NumRxUnicastOkInPeriod);
+			bEnterPS= _FALSE;
+		}
+		else
+		{
+			bEnterPS= _TRUE;
+		}
+
+		// LeisurePS only work in infra mode.
+		if(bEnterPS)
+		{
+			LPS_Enter(padapter);
+		}
+		else
+		{
+			LPS_Leave(padapter);
+		}
+#endif
+	}
+	else
+	{
+#ifdef CONFIG_LPS
+		LPS_Leave(padapter);
+#endif
+	}
+
+	pmlmepriv->LinkDetectInfo.NumRxOkInPeriod = 0;
+	pmlmepriv->LinkDetectInfo.NumTxOkInPeriod = 0;
+	pmlmepriv->LinkDetectInfo.NumRxUnicastOkInPeriod = 0;
+	pmlmepriv->LinkDetectInfo.bBusyTraffic = bBusyTraffic;
+	pmlmepriv->LinkDetectInfo.bTxBusyTraffic = bTxBusyTraffic;
+	pmlmepriv->LinkDetectInfo.bRxBusyTraffic = bRxBusyTraffic;
+	pmlmepriv->LinkDetectInfo.bHigherBusyTraffic = bHigherBusyTraffic;
+	pmlmepriv->LinkDetectInfo.bHigherBusyRxTraffic = bHigherBusyRxTraffic;
+	pmlmepriv->LinkDetectInfo.bHigherBusyTxTraffic = bHigherBusyTxTraffic;
+
+}
+
+void dynamic_chk_wk_hdl(_adapter *padapter, u8 *pbuf, int sz);
+void dynamic_chk_wk_hdl(_adapter *padapter, u8 *pbuf, int sz)
+{
+	struct mlme_priv *pmlmepriv;
+
+	if ((padapter->bDriverStopped == _TRUE)||(padapter->bSurpriseRemoved== _TRUE))
+		return;
+
+	if((void*)padapter != (void*)pbuf && padapter->pbuddy_adapter == NULL)
+		return;
+
+	padapter = (_adapter *)pbuf;
+
+	if ((padapter->bDriverStopped == _TRUE)||(padapter->bSurpriseRemoved== _TRUE))
+		return;
+
+	pmlmepriv = &(padapter->mlmepriv);
+
+#ifdef CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+#ifdef CONFIG_AP_MODE
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+		expire_timeout_chk(padapter);
+	}
+#endif
+#endif //CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+
+	#ifdef DBG_CONFIG_ERROR_DETECT
+	rtw_hal_sreset_xmit_status_check(padapter);
+	#endif
+
+	//if(check_fwstate(pmlmepriv, _FW_UNDER_LINKING|_FW_UNDER_SURVEY)==_FALSE)
+	{
+		linked_status_chk(padapter);
+		traffic_status_watchdog(padapter);
+	}
+
+	rtw_hal_dm_watchdog(padapter);
+
+	//check_hw_pbc(padapter, pdrvextra_cmd->pbuf, pdrvextra_cmd->type_size);
+
+}
+
+#ifdef CONFIG_LPS
+
+void lps_ctrl_wk_hdl(_adapter *padapter, u8 lps_ctrl_type);
+void lps_ctrl_wk_hdl(_adapter *padapter, u8 lps_ctrl_type)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	u8	mstatus;
+
+_func_enter_;
+
+	if((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE)
+		|| (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE))
+	{
+		return;
+	}
+
+	switch(lps_ctrl_type)
+	{
+		case LPS_CTRL_SCAN:
+			//DBG_871X("LPS_CTRL_SCAN \n");
+			LeaveAllPowerSaveMode(padapter);
+			break;
+		case LPS_CTRL_JOINBSS:
+			//DBG_871X("LPS_CTRL_JOINBSS \n");
+			LPS_Leave(padapter);
+			break;
+		case LPS_CTRL_CONNECT:
+			//DBG_871X("LPS_CTRL_CONNECT \n");
+			mstatus = 1;
+			// Reset LPS Setting
+			padapter->pwrctrlpriv.LpsIdleCount = 0;
+			rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_JOINBSSRPT, (u8 *)(&mstatus));
+			break;
+		case LPS_CTRL_DISCONNECT:
+			//DBG_871X("LPS_CTRL_DISCONNECT \n");
+			mstatus = 0;
+			LPS_Leave(padapter);
+			rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_JOINBSSRPT, (u8 *)(&mstatus));
+			break;
+		case LPS_CTRL_SPECIAL_PACKET:
+			//DBG_871X("LPS_CTRL_SPECIAL_PACKET \n");
+			pwrpriv->DelayLPSLastTimeStamp = rtw_get_current_time();
+			LPS_Leave(padapter);
+			break;
+
+		default:
+			break;
+	}
+
+_func_exit_;
+}
+
+u8 rtw_lps_ctrl_wk_cmd(_adapter*padapter, u8 lps_ctrl_type, u8 enqueue)
+{
+	struct cmd_obj	*ph2c;
+	struct drvextra_cmd_parm	*pdrvextra_cmd_parm;
+	struct cmd_priv	*pcmdpriv = &padapter->cmdpriv;
+	//struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv;
+	u8	res = _SUCCESS;
+
+_func_enter_;
+
+	//if(!pwrctrlpriv->bLeisurePs)
+	//	return res;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (padapter->iface_type != IFACE_PORT0)
+		return res;
+#endif
+
+	if(enqueue)
+	{
+		ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+		if(ph2c==NULL){
+			res= _FAIL;
+			goto exit;
+		}
+
+		pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
+		if(pdrvextra_cmd_parm==NULL){
+			rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+			res= _FAIL;
+			goto exit;
+		}
+
+		pdrvextra_cmd_parm->ec_id = LPS_CTRL_WK_CID;
+		pdrvextra_cmd_parm->type_size = lps_ctrl_type;
+		pdrvextra_cmd_parm->pbuf = NULL;
+
+		init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+		res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+	}
+	else
+	{
+		lps_ctrl_wk_hdl(padapter, lps_ctrl_type);
+	}
+
+exit:
+
+_func_exit_;
+
+	return res;
+
+}
+
+#endif
+#ifdef CONFIG_ANTENNA_DIVERSITY
+
+void antenna_select_wk_hdl(_adapter *padapter, u8 antenna)
+{
+	rtw_hal_set_hwreg(padapter, HW_VAR_ANTENNA_DIVERSITY_SELECT, (u8 *)(&antenna));
+}
+
+u8 rtw_antenna_select_cmd(_adapter*padapter, u8 antenna,u8 enqueue)
+{
+	struct cmd_obj		*ph2c;
+	struct drvextra_cmd_parm	*pdrvextra_cmd_parm;
+	struct cmd_priv	*pcmdpriv = &padapter->cmdpriv;
+	u8 	bSupportAntDiv = _FALSE;
+	u8	res = _SUCCESS;
+
+_func_enter_;
+	rtw_hal_get_def_var(padapter, HAL_DEF_IS_SUPPORT_ANT_DIV, &(bSupportAntDiv));
+	if(_FALSE == bSupportAntDiv )	return res;
+
+	if(_TRUE == enqueue)
+	{
+		ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+		if(ph2c==NULL){
+			res= _FAIL;
+			goto exit;
+		}
+
+		pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
+		if(pdrvextra_cmd_parm==NULL){
+			rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+			res= _FAIL;
+			goto exit;
+		}
+
+		pdrvextra_cmd_parm->ec_id = ANT_SELECT_WK_CID;
+		pdrvextra_cmd_parm->type_size = antenna;
+		pdrvextra_cmd_parm->pbuf = NULL;
+		init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+		res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+	}
+	else{
+		antenna_select_wk_hdl(padapter,antenna );
+	}
+exit:
+
+_func_exit_;
+
+	return res;
+
+}
+#endif
+
+void power_saving_wk_hdl(_adapter *padapter, u8 *pbuf, int sz);
+void power_saving_wk_hdl(_adapter *padapter, u8 *pbuf, int sz)
+{
+	 rtw_ps_processor(padapter);
+}
+
+//add for CONFIG_IEEE80211W, none 11w can use it
+void reset_securitypriv_hdl(_adapter *padapter)
+{
+	 rtw_reset_securitypriv(padapter);
+}
+
+void free_assoc_resources_hdl(_adapter *padapter)
+{
+	 rtw_free_assoc_resources(padapter, 1);
+}
+
+#ifdef CONFIG_P2P
+u8 p2p_protocol_wk_cmd(_adapter*padapter, int intCmdType )
+{
+	struct cmd_obj	*ph2c;
+	struct drvextra_cmd_parm	*pdrvextra_cmd_parm;
+	struct wifidirect_info	*pwdinfo= &(padapter->wdinfo);
+	struct cmd_priv	*pcmdpriv = &padapter->cmdpriv;
+	u8	res = _SUCCESS;
+
+_func_enter_;
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		return res;
+	}
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
+	if(pdrvextra_cmd_parm==NULL){
+		rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm->ec_id = P2P_PROTO_WK_CID;
+	pdrvextra_cmd_parm->type_size = intCmdType;	//	As the command tppe.
+	pdrvextra_cmd_parm->pbuf = NULL;		//	Must be NULL here
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+exit:
+
+_func_exit_;
+
+	return res;
+
+}
+#endif //CONFIG_P2P
+
+u8 rtw_ps_cmd(_adapter*padapter)
+{
+	struct cmd_obj		*ppscmd;
+	struct drvextra_cmd_parm	*pdrvextra_cmd_parm;
+	struct cmd_priv	*pcmdpriv = &padapter->cmdpriv;
+
+	u8	res = _SUCCESS;
+_func_enter_;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (padapter->adapter_type != PRIMARY_ADAPTER)
+		goto exit;
+#endif
+
+	ppscmd = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ppscmd==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
+	if(pdrvextra_cmd_parm==NULL){
+		rtw_mfree((unsigned char *)ppscmd, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm->ec_id = POWER_SAVING_CTRL_WK_CID;
+	pdrvextra_cmd_parm->pbuf = NULL;
+	init_h2fwcmd_w_parm_no_rsp(ppscmd, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+	res = rtw_enqueue_cmd(pcmdpriv, ppscmd);
+
+exit:
+
+_func_exit_;
+
+	return res;
+
+}
+
+#ifdef CONFIG_AP_MODE
+
+static void rtw_chk_hi_queue_hdl(_adapter *padapter)
+{
+	int cnt=0;
+	struct sta_info *psta_bmc;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	psta_bmc = rtw_get_bcmc_stainfo(padapter);
+	if(!psta_bmc)
+		return;
+
+
+	if(psta_bmc->sleepq_len==0)
+	{
+		while((rtw_read32(padapter, 0x414)&0x00ffff00)!=0)
+		{
+			rtw_msleep_os(100);
+
+			cnt++;
+
+			if(cnt>10)
+				break;
+		}
+
+		if(cnt<=10)
+		{
+			pstapriv->tim_bitmap &= ~BIT(0);
+			pstapriv->sta_dz_bitmap &= ~BIT(0);
+
+			update_beacon(padapter, _TIM_IE_, NULL, _FALSE);
+		}
+	}
+
+}
+
+u8 rtw_chk_hi_queue_cmd(_adapter*padapter)
+{
+	struct cmd_obj	*ph2c;
+	struct drvextra_cmd_parm	*pdrvextra_cmd_parm;
+	struct cmd_priv	*pcmdpriv = &padapter->cmdpriv;
+	u8	res = _SUCCESS;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if(ph2c==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
+	if(pdrvextra_cmd_parm==NULL){
+		rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm->ec_id = CHECK_HIQ_WK_CID;
+	pdrvextra_cmd_parm->type_size = 0;
+	pdrvextra_cmd_parm->pbuf = NULL;
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+exit:
+
+	return res;
+
+}
+#endif
+
+u8 rtw_c2h_wk_cmd(PADAPTER padapter, u8 *c2h_evt)
+{
+	struct cmd_obj *ph2c;
+	struct drvextra_cmd_parm *pdrvextra_cmd_parm;
+	struct cmd_priv	*pcmdpriv = &padapter->cmdpriv;
+	u8	res = _SUCCESS;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if (ph2c == NULL) {
+		res = _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
+	if (pdrvextra_cmd_parm == NULL) {
+		rtw_mfree((u8*)ph2c, sizeof(struct cmd_obj));
+		res = _FAIL;
+		goto exit;
+	}
+
+	pdrvextra_cmd_parm->ec_id = C2H_WK_CID;
+	pdrvextra_cmd_parm->type_size = c2h_evt?16:0;
+	pdrvextra_cmd_parm->pbuf = c2h_evt;
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+exit:
+
+	return res;
+}
+
+s32 c2h_evt_hdl(_adapter *adapter, struct c2h_evt_hdr *c2h_evt, c2h_id_filter filter)
+{
+	s32 ret = _FAIL;
+	u8 buf[16];
+
+	if (!c2h_evt) {
+		/* No c2h event in cmd_obj, read c2h event before handling*/
+		if (c2h_evt_read(adapter, buf) == _SUCCESS) {
+			c2h_evt = (struct c2h_evt_hdr *)buf;
+
+			if (filter && filter(c2h_evt->id) == _FALSE)
+				goto exit;
+
+			ret = rtw_hal_c2h_handler(adapter, c2h_evt);
+		}
+	} else {
+
+		if (filter && filter(c2h_evt->id) == _FALSE)
+			goto exit;
+
+		ret = rtw_hal_c2h_handler(adapter, c2h_evt);
+	}
+exit:
+	return ret;
+}
+
+#ifdef CONFIG_C2H_WK
+static void c2h_wk_callback(_workitem *work)
+{
+	struct evt_priv *evtpriv = container_of(work, struct evt_priv, c2h_wk);
+	_adapter *adapter = container_of(evtpriv, _adapter, evtpriv);
+	struct c2h_evt_hdr *c2h_evt;
+	c2h_id_filter ccx_id_filter = rtw_hal_c2h_id_filter_ccx(adapter);
+
+	evtpriv->c2h_wk_alive = _TRUE;
+
+	while (!rtw_cbuf_empty(evtpriv->c2h_queue)) {
+		if ((c2h_evt = (struct c2h_evt_hdr *)rtw_cbuf_pop(evtpriv->c2h_queue)) != NULL) {
+			/* This C2H event is read, clear it */
+			c2h_evt_clear(adapter);
+		} else if ((c2h_evt = (struct c2h_evt_hdr *)rtw_malloc(16)) != NULL) {
+			/* This C2H event is not read, read & clear now */
+			if (c2h_evt_read(adapter, (u8*)c2h_evt) != _SUCCESS)
+				continue;
+		}
+
+		/* Special pointer to trigger c2h_evt_clear only */
+		if ((void *)c2h_evt == (void *)evtpriv)
+			continue;
+
+		if (!c2h_evt_exist(c2h_evt)) {
+			rtw_mfree((u8*)c2h_evt, 16);
+			continue;
+		}
+
+		if (ccx_id_filter(c2h_evt->id) == _TRUE) {
+			/* Handle CCX report here */
+			rtw_hal_c2h_handler(adapter, c2h_evt);
+			rtw_mfree((u8*)c2h_evt, 16);
+		} else {
+			/* Enqueue into cmd_thread for others */
+			rtw_c2h_wk_cmd(adapter, (u8 *)c2h_evt);
+		}
+	}
+
+	evtpriv->c2h_wk_alive = _FALSE;
+}
+#endif
+
+u8 rtw_drvextra_cmd_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	struct drvextra_cmd_parm *pdrvextra_cmd;
+
+	if(!pbuf)
+		return H2C_PARAMETERS_ERROR;
+
+	pdrvextra_cmd = (struct drvextra_cmd_parm*)pbuf;
+
+	switch(pdrvextra_cmd->ec_id)
+	{
+		case DYNAMIC_CHK_WK_CID:
+			dynamic_chk_wk_hdl(padapter, pdrvextra_cmd->pbuf, pdrvextra_cmd->type_size);
+			break;
+		case POWER_SAVING_CTRL_WK_CID:
+			power_saving_wk_hdl(padapter, pdrvextra_cmd->pbuf, pdrvextra_cmd->type_size);
+			break;
+#ifdef CONFIG_LPS
+		case LPS_CTRL_WK_CID:
+			lps_ctrl_wk_hdl(padapter, (u8)pdrvextra_cmd->type_size);
+			break;
+#endif
+#ifdef CONFIG_ANTENNA_DIVERSITY
+		case ANT_SELECT_WK_CID:
+			antenna_select_wk_hdl(padapter, pdrvextra_cmd->type_size);
+			break;
+#endif
+#ifdef CONFIG_P2P_PS
+		case P2P_PS_WK_CID:
+			p2p_ps_wk_hdl(padapter, pdrvextra_cmd->type_size);
+			break;
+#endif // CONFIG_P2P_PS
+		case P2P_PROTO_WK_CID:
+			//	Commented by Albert 2011/07/01
+			//	I used the type_size as the type command
+			p2p_protocol_wk_hdl( padapter, pdrvextra_cmd->type_size );
+			break;
+#ifdef CONFIG_AP_MODE
+		case CHECK_HIQ_WK_CID:
+			rtw_chk_hi_queue_hdl(padapter);
+			break;
+#endif //CONFIG_AP_MODE
+#ifdef CONFIG_INTEL_WIDI
+		case INTEl_WIDI_WK_CID:
+			intel_widi_wk_hdl(padapter, pdrvextra_cmd->type_size, pdrvextra_cmd->pbuf);
+			break;
+#endif //CONFIG_INTEL_WIDI
+		//add for CONFIG_IEEE80211W, none 11w can use it
+		case RESET_SECURITYPRIV:
+			reset_securitypriv_hdl(padapter);
+			break;
+		case FREE_ASSOC_RESOURCES:
+			free_assoc_resources_hdl(padapter);
+			break;
+		case C2H_WK_CID:
+			c2h_evt_hdl(padapter, (struct c2h_evt_hdr *)pdrvextra_cmd->pbuf, NULL);
+			break;
+
+		default:
+			break;
+	}
+
+
+	if(pdrvextra_cmd->pbuf && pdrvextra_cmd->type_size>0)
+	{
+		rtw_mfree(pdrvextra_cmd->pbuf, pdrvextra_cmd->type_size);
+	}
+
+
+	return H2C_SUCCESS;
+
+}
+
+void rtw_survey_cmd_callback(_adapter*	padapter ,  struct cmd_obj *pcmd)
+{
+	struct 	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+_func_enter_;
+
+	if(pcmd->res == H2C_DROPPED)
+	{
+		//TODO: cancel timer and do timeout handler directly...
+		//need to make timeout handlerOS independent
+		_set_timer(&pmlmepriv->scan_to_timer, 1);
+	}
+	else if (pcmd->res != H2C_SUCCESS) {
+		_set_timer(&pmlmepriv->scan_to_timer, 1);
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\n ********Error: MgntActrtw_set_802_11_bssid_LIST_SCAN Fail ************\n\n."));
+	}
+
+	// free cmd
+	rtw_free_cmd_obj(pcmd);
+
+_func_exit_;
+}
+void rtw_disassoc_cmd_callback(_adapter*	padapter,  struct cmd_obj *pcmd)
+{
+	_irqL	irqL;
+	struct 	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+_func_enter_;
+
+	if (pcmd->res != H2C_SUCCESS)
+	{
+		_enter_critical_bh(&pmlmepriv->lock, &irqL);
+		set_fwstate(pmlmepriv, _FW_LINKED);
+		_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\n ***Error: disconnect_cmd_callback Fail ***\n."));
+
+		goto exit;
+	}
+#ifdef CONFIG_BR_EXT
+	else //clear bridge database
+		nat25_db_cleanup(padapter);
+#endif //CONFIG_BR_EXT
+
+	// free cmd
+	rtw_free_cmd_obj(pcmd);
+
+exit:
+
+_func_exit_;
+}
+
+
+void rtw_joinbss_cmd_callback(_adapter*	padapter,  struct cmd_obj *pcmd)
+{
+	struct 	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+_func_enter_;
+
+	if(pcmd->res == H2C_DROPPED)
+	{
+		//TODO: cancel timer and do timeout handler directly...
+		//need to make timeout handlerOS independent
+		_set_timer(&pmlmepriv->assoc_timer, 1);
+	}
+	else if(pcmd->res != H2C_SUCCESS)
+	{
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("********Error:rtw_select_and_join_from_scanned_queue Wait Sema  Fail ************\n"));
+		_set_timer(&pmlmepriv->assoc_timer, 1);
+	}
+
+	rtw_free_cmd_obj(pcmd);
+
+_func_exit_;
+}
+
+void rtw_createbss_cmd_callback(_adapter *padapter, struct cmd_obj *pcmd)
+{
+	_irqL irqL;
+	u8 timer_cancelled;
+	struct sta_info *psta = NULL;
+	struct wlan_network *pwlan = NULL;
+	struct 	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	WLAN_BSSID_EX *pnetwork = (WLAN_BSSID_EX *)pcmd->parmbuf;
+	struct wlan_network *tgt_network = &(pmlmepriv->cur_network);
+
+_func_enter_;
+
+	if((pcmd->res != H2C_SUCCESS))
+	{
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\n ********Error: rtw_createbss_cmd_callback  Fail ************\n\n."));
+		_set_timer(&pmlmepriv->assoc_timer, 1 );
+	}
+
+	_cancel_timer(&pmlmepriv->assoc_timer, &timer_cancelled);
+
+#ifdef CONFIG_FW_MLMLE
+       //endian_convert
+	pnetwork->Length = le32_to_cpu(pnetwork->Length);
+	pnetwork->Ssid.SsidLength = le32_to_cpu(pnetwork->Ssid.SsidLength);
+	pnetwork->Privacy =le32_to_cpu(pnetwork->Privacy);
+	pnetwork->Rssi = le32_to_cpu(pnetwork->Rssi);
+	pnetwork->NetworkTypeInUse =le32_to_cpu(pnetwork->NetworkTypeInUse);
+	pnetwork->Configuration.ATIMWindow = le32_to_cpu(pnetwork->Configuration.ATIMWindow);
+	//pnetwork->Configuration.BeaconPeriod = le32_to_cpu(pnetwork->Configuration.BeaconPeriod);
+	pnetwork->Configuration.DSConfig =le32_to_cpu(pnetwork->Configuration.DSConfig);
+	pnetwork->Configuration.FHConfig.DwellTime=le32_to_cpu(pnetwork->Configuration.FHConfig.DwellTime);
+	pnetwork->Configuration.FHConfig.HopPattern=le32_to_cpu(pnetwork->Configuration.FHConfig.HopPattern);
+	pnetwork->Configuration.FHConfig.HopSet=le32_to_cpu(pnetwork->Configuration.FHConfig.HopSet);
+	pnetwork->Configuration.FHConfig.Length=le32_to_cpu(pnetwork->Configuration.FHConfig.Length);
+	pnetwork->Configuration.Length = le32_to_cpu(pnetwork->Configuration.Length);
+	pnetwork->InfrastructureMode = le32_to_cpu(pnetwork->InfrastructureMode);
+	pnetwork->IELength = le32_to_cpu(pnetwork->IELength);
+#endif
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) )
+	{
+		psta = rtw_get_stainfo(&padapter->stapriv, pnetwork->MacAddress);
+		if(!psta)
+		{
+		psta = rtw_alloc_stainfo(&padapter->stapriv, pnetwork->MacAddress);
+		if (psta == NULL)
+		{
+			RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\nCan't alloc sta_info when createbss_cmd_callback\n"));
+			goto createbss_cmd_fail ;
+		}
+		}
+
+		rtw_indicate_connect( padapter);
+	}
+	else
+	{
+		_irqL	irqL;
+
+		pwlan = _rtw_alloc_network(pmlmepriv);
+		_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+		if ( pwlan == NULL)
+		{
+			pwlan = rtw_get_oldest_wlan_network(&pmlmepriv->scanned_queue);
+			if( pwlan == NULL)
+			{
+				RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\n Error:  can't get pwlan in rtw_joinbss_event_callback \n"));
+				_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+				goto createbss_cmd_fail;
+			}
+			pwlan->last_scanned = rtw_get_current_time();
+		}
+		else
+		{
+			rtw_list_insert_tail(&(pwlan->list), &pmlmepriv->scanned_queue.queue);
+		}
+
+		pnetwork->Length = get_WLAN_BSSID_EX_sz(pnetwork);
+		_rtw_memcpy(&(pwlan->network), pnetwork, pnetwork->Length);
+		//pwlan->fixed = _TRUE;
+
+		//rtw_list_insert_tail(&(pwlan->list), &pmlmepriv->scanned_queue.queue);
+
+		// copy pdev_network information to 	pmlmepriv->cur_network
+		_rtw_memcpy(&tgt_network->network, pnetwork, (get_WLAN_BSSID_EX_sz(pnetwork)));
+
+		// reset DSConfig
+		//tgt_network->network.Configuration.DSConfig = (u32)rtw_ch2freq(pnetwork->Configuration.DSConfig);
+
+		_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+
+#if 0
+		if((pmlmepriv->fw_state) & WIFI_AP_STATE)
+		{
+			psta = rtw_alloc_stainfo(&padapter->stapriv, pnetwork->MacAddress);
+
+			if (psta == NULL) { // for AP Mode & Adhoc Master Mode
+				RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\nCan't alloc sta_info when createbss_cmd_callback\n"));
+				goto createbss_cmd_fail ;
+			}
+
+			rtw_indicate_connect( padapter);
+		}
+		else {
+
+			//rtw_indicate_disconnect(dev);
+		}
+#endif
+		_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+		// we will set _FW_LINKED when there is one more sat to join us (rtw_stassoc_event_callback)
+
+	}
+
+createbss_cmd_fail:
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+	rtw_free_cmd_obj(pcmd);
+
+_func_exit_;
+
+}
+
+
+
+void rtw_setstaKey_cmdrsp_callback(_adapter*	padapter ,  struct cmd_obj *pcmd)
+{
+
+	struct sta_priv * pstapriv = &padapter->stapriv;
+	struct set_stakey_rsp* psetstakey_rsp = (struct set_stakey_rsp*) (pcmd->rsp);
+	struct sta_info*	psta = rtw_get_stainfo(pstapriv, psetstakey_rsp->addr);
+
+_func_enter_;
+
+	if(psta==NULL)
+	{
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\nERROR: rtw_setstaKey_cmdrsp_callback => can't get sta_info \n\n"));
+		goto exit;
+	}
+
+	//psta->aid = psta->mac_id = psetstakey_rsp->keyid; //CAM_ID(CAM_ENTRY)
+
+exit:
+
+	rtw_free_cmd_obj(pcmd);
+
+_func_exit_;
+
+}
+void rtw_setassocsta_cmdrsp_callback(_adapter*	padapter,  struct cmd_obj *pcmd)
+{
+	_irqL	irqL;
+	struct sta_priv * pstapriv = &padapter->stapriv;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct set_assocsta_parm* passocsta_parm = (struct set_assocsta_parm*)(pcmd->parmbuf);
+	struct set_assocsta_rsp* passocsta_rsp = (struct set_assocsta_rsp*) (pcmd->rsp);
+	struct sta_info*	psta = rtw_get_stainfo(pstapriv, passocsta_parm->addr);
+
+_func_enter_;
+
+	if(psta==NULL)
+	{
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\nERROR: setassocsta_cmdrsp_callbac => can't get sta_info \n\n"));
+		goto exit;
+	}
+
+	psta->aid = psta->mac_id = passocsta_rsp->cam_id;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	if ((check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE) && (check_fwstate(pmlmepriv, _FW_UNDER_LINKING) == _TRUE))
+		_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+
+       set_fwstate(pmlmepriv, _FW_LINKED);
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+exit:
+	rtw_free_cmd_obj(pcmd);
+
+_func_exit_;
+}
+
+void rtw_getrttbl_cmd_cmdrsp_callback(_adapter*	padapter,  struct cmd_obj *pcmd);
+void rtw_getrttbl_cmd_cmdrsp_callback(_adapter*	padapter,  struct cmd_obj *pcmd)
+{
+_func_enter_;
+
+	rtw_free_cmd_obj(pcmd);
+#ifdef CONFIG_MP_INCLUDED
+	padapter->mppriv.workparam.bcompleted=_TRUE;
+#endif
+
+_func_exit_;
+
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_debug.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_debug.c
new file mode 100644
index 000000000000..2268c1aafd86
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_debug.c
@@ -0,0 +1,1336 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_DEBUG_C_
+
+
+#include <rtw_debug.h>
+#include <../hal/dm.h>
+
+//#ifdef CONFIG_DEBUG_RTL871X
+
+	u32 GlobalDebugLevel = _drv_err_;
+
+	u64 GlobalDebugComponents = \
+			_module_rtl871x_xmit_c_ |
+			_module_xmit_osdep_c_ |
+			_module_rtl871x_recv_c_ |
+			_module_recv_osdep_c_ |
+			_module_rtl871x_mlme_c_ |
+			_module_mlme_osdep_c_ |
+			_module_rtl871x_sta_mgt_c_ |
+			_module_rtl871x_cmd_c_ |
+			_module_cmd_osdep_c_ |
+			_module_rtl871x_io_c_ |
+			_module_io_osdep_c_ |
+			_module_os_intfs_c_|
+			_module_rtl871x_security_c_|
+			_module_rtl871x_eeprom_c_|
+			_module_hal_init_c_|
+			_module_hci_hal_init_c_|
+			_module_rtl871x_ioctl_c_|
+			_module_rtl871x_ioctl_set_c_|
+			_module_rtl871x_ioctl_query_c_|
+			_module_rtl871x_pwrctrl_c_|
+			_module_hci_intfs_c_|
+			_module_hci_ops_c_|
+			_module_hci_ops_os_c_|
+			_module_rtl871x_ioctl_os_c|
+			_module_rtl8712_cmd_c_|
+			_module_hal_xmit_c_|
+			_module_rtl8712_recv_c_ |
+			_module_mp_ |
+			_module_efuse_;
+
+//#endif
+
+#ifdef CONFIG_PROC_DEBUG
+#include <rtw_version.h>
+
+int proc_get_drv_version(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+
+	int len = 0;
+
+	len += snprintf(page + len, count - len, "%s\n", DRIVERVERSION);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_get_log_level(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+	int len = 0;
+
+	len += snprintf(page + len, count - len,
+		"log_level:%d\n",
+		GlobalDebugLevel
+		);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_set_log_level(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	char tmp[32];
+	u32 is_signal_dbg;
+
+	if (count < 1)
+		return -EFAULT;
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {
+
+		int num = sscanf(tmp, "%d ", &is_signal_dbg);
+
+		if( is_signal_dbg >= 0 && is_signal_dbg < 10 )
+		{
+			GlobalDebugLevel= is_signal_dbg;
+			printk("%d\n", GlobalDebugLevel);
+		}
+	}
+
+	return count;
+
+}
+
+#ifdef DBG_MEM_ALLOC
+int proc_get_mstat(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	int len = 0;
+
+	len += _rtw_mstat_dump(page+len, count-len);
+	*eof = 1;
+
+	return len;
+}
+#endif /* DBG_MEM_ALLOC */
+
+int proc_get_write_reg(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	*eof = 1;
+	return 0;
+}
+
+int proc_set_write_reg(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	char tmp[32];
+	u32 addr, val, len;
+
+	if (count < 3)
+	{
+		DBG_871X("argument size is less than 3\n");
+		return -EFAULT;
+	}
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {
+
+		int num = sscanf(tmp, "%x %x %x", &addr, &val, &len);
+
+		if (num !=  3) {
+			DBG_871X("invalid write_reg parameter!\n");
+			return count;
+		}
+
+		switch(len)
+		{
+			case 1:
+				rtw_write8(padapter, addr, (u8)val);
+				break;
+			case 2:
+				rtw_write16(padapter, addr, (u16)val);
+				break;
+			case 4:
+				rtw_write32(padapter, addr, val);
+				break;
+			default:
+				DBG_871X("error write length=%d", len);
+				break;
+		}
+
+	}
+
+	return count;
+
+}
+
+static u32 proc_get_read_addr=0xeeeeeeee;
+static u32 proc_get_read_len=0x4;
+
+int proc_get_read_reg(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	int len = 0;
+
+	if(proc_get_read_addr==0xeeeeeeee)
+	{
+		*eof = 1;
+		return len;
+	}
+
+	switch(proc_get_read_len)
+	{
+		case 1:
+			len += snprintf(page + len, count - len, "rtw_read8(0x%x)=0x%x\n", proc_get_read_addr, rtw_read8(padapter, proc_get_read_addr));
+			break;
+		case 2:
+			len += snprintf(page + len, count - len, "rtw_read16(0x%x)=0x%x\n", proc_get_read_addr, rtw_read16(padapter, proc_get_read_addr));
+			break;
+		case 4:
+			len += snprintf(page + len, count - len, "rtw_read32(0x%x)=0x%x\n", proc_get_read_addr, rtw_read32(padapter, proc_get_read_addr));
+			break;
+		default:
+			len += snprintf(page + len, count - len, "error read length=%d\n", proc_get_read_len);
+			break;
+	}
+
+	*eof = 1;
+	return len;
+
+}
+
+int proc_set_read_reg(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	char tmp[16];
+	u32 addr, len;
+
+	if (count < 2)
+	{
+		DBG_871X("argument size is less than 2\n");
+		return -EFAULT;
+	}
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {
+
+		int num = sscanf(tmp, "%x %x", &addr, &len);
+
+		if (num !=  2) {
+			DBG_871X("invalid read_reg parameter!\n");
+			return count;
+		}
+
+		proc_get_read_addr = addr;
+
+		proc_get_read_len = len;
+	}
+
+	return count;
+
+}
+
+int proc_get_fwstate(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+	int len = 0;
+
+	len += snprintf(page + len, count - len, "fwstate=0x%x\n", get_fwstate(pmlmepriv));
+
+	*eof = 1;
+	return len;
+}
+
+int proc_get_sec_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+
+	int len = 0;
+
+	len += snprintf(page + len, count - len, "auth_alg=0x%x, enc_alg=0x%x, auth_type=0x%x, enc_type=0x%x\n",
+						psecuritypriv->dot11AuthAlgrthm, psecuritypriv->dot11PrivacyAlgrthm,
+						psecuritypriv->ndisauthtype, psecuritypriv->ndisencryptstatus);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_get_mlmext_state(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	int len = 0;
+
+	len += snprintf(page + len, count - len, "pmlmeinfo->state=0x%x\n", pmlmeinfo->state);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_get_qos_option(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+	int len = 0;
+
+	len += snprintf(page + len, count - len, "qos_option=%d\n", pmlmepriv->qospriv.qos_option);
+
+	*eof = 1;
+	return len;
+
+}
+
+int proc_get_ht_option(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+	int len = 0;
+
+	len += snprintf(page + len, count - len, "ht_option=%d\n", pmlmepriv->htpriv.ht_option);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_get_rf_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	int len = 0;
+
+	len += snprintf(page + len, count - len, "cur_ch=%d, cur_bw=%d, cur_ch_offet=%d\n"
+		"oper_ch=%d, oper_bw=%d, oper_ch_offet=%d\n",
+		pmlmeext->cur_channel, pmlmeext->cur_bwmode, pmlmeext->cur_ch_offset,
+		rtw_get_oper_ch(padapter), rtw_get_oper_bw(padapter), rtw_get_oper_choffset(padapter));
+	*eof = 1;
+
+	return len;
+}
+
+int proc_get_ap_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct sta_info *psta;
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct wlan_network *cur_network = &(pmlmepriv->cur_network);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	int len = 0;
+
+	psta = rtw_get_stainfo(pstapriv, cur_network->network.MacAddress);
+	if(psta)
+	{
+		int i;
+		struct recv_reorder_ctrl *preorder_ctrl;
+
+		len += snprintf(page + len, count - len, "SSID=%s\n", cur_network->network.Ssid.Ssid);
+		len += snprintf(page + len, count - len, "sta's macaddr:" MAC_FMT "\n", MAC_ARG(psta->hwaddr));
+		len += snprintf(page + len, count - len, "cur_channel=%d, cur_bwmode=%d, cur_ch_offset=%d\n", pmlmeext->cur_channel, pmlmeext->cur_bwmode, pmlmeext->cur_ch_offset);
+		len += snprintf(page + len, count - len, "rtsen=%d, cts2slef=%d\n", psta->rtsen, psta->cts2self);
+		len += snprintf(page + len, count - len, "qos_en=%d, ht_en=%d, init_rate=%d\n", psta->qos_option, psta->htpriv.ht_option, psta->init_rate);
+		len += snprintf(page + len, count - len, "state=0x%x, aid=%d, macid=%d, raid=%d\n", psta->state, psta->aid, psta->mac_id, psta->raid);
+		len += snprintf(page + len, count - len, "bwmode=%d, ch_offset=%d, sgi=%d\n", psta->htpriv.bwmode, psta->htpriv.ch_offset, psta->htpriv.sgi);
+		len += snprintf(page + len, count - len, "ampdu_enable = %d\n", psta->htpriv.ampdu_enable);
+		len += snprintf(page + len, count - len, "agg_enable_bitmap=%x, candidate_tid_bitmap=%x\n", psta->htpriv.agg_enable_bitmap, psta->htpriv.candidate_tid_bitmap);
+
+		for(i=0;i<16;i++)
+		{
+			preorder_ctrl = &psta->recvreorder_ctrl[i];
+			if(preorder_ctrl->enable)
+			{
+				len += snprintf(page + len, count - len, "tid=%d, indicate_seq=%d\n", i, preorder_ctrl->indicate_seq);
+			}
+		}
+
+	}
+	else
+	{
+		len += snprintf(page + len, count - len, "can't get sta's macaddr, cur_network's macaddr:" MAC_FMT "\n", MAC_ARG(cur_network->network.MacAddress));
+	}
+
+	*eof = 1;
+	return len;
+
+}
+
+int proc_get_adapter_state(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+
+	len += snprintf(page + len, count - len, "bSurpriseRemoved=%d, bDriverStopped=%d\n",
+						padapter->bSurpriseRemoved, padapter->bDriverStopped);
+
+	*eof = 1;
+	return len;
+
+}
+
+int proc_get_trx_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	int i;
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+	struct recv_priv  *precvpriv = &padapter->recvpriv;
+	struct dvobj_priv	*pdvobj = adapter_to_dvobj(padapter);
+        struct hw_xmit *phwxmit;
+	int len = 0;
+
+	len += snprintf(page + len, count - len, "free_xmitbuf_cnt=%d, free_xmitframe_cnt=%d"
+				", free_ext_xmitbuf_cnt=%d, free_xframe_ext_cnt=%d"
+				", free_recvframe_cnt=%d\n",
+				pxmitpriv->free_xmitbuf_cnt, pxmitpriv->free_xmitframe_cnt,
+				pxmitpriv->free_xmit_extbuf_cnt, pxmitpriv->free_xframe_ext_cnt,
+				precvpriv->free_recvframe_cnt);
+#ifdef CONFIG_USB_HCI
+	len += snprintf(page + len, count - len, "rx_urb_pending_cnt=%d\n", precvpriv->rx_pending_cnt);
+#endif
+
+	len += snprintf(page + len, count - len, "recvbuf_skb_alloc_fail_cnt=%d\n", precvpriv->recvbuf_skb_alloc_fail_cnt);
+	len += snprintf(page + len, count - len, "recvbuf_null_cnt=%d\n", precvpriv->recvbuf_null_cnt);
+	len += snprintf(page + len, count - len, "read_port_complete_EINPROGRESS_cnt=%d\n", precvpriv->read_port_complete_EINPROGRESS_cnt);
+	len += snprintf(page + len, count - len, "read_port_complete_other_urb_err_cnt=%d\n", precvpriv->read_port_complete_other_urb_err_cnt);
+	len += snprintf(page + len, count - len, "hw_init_completed=%d\n", padapter->hw_init_completed);
+#ifdef CONFIG_USB_HCI
+	len += snprintf(page + len, count - len, "continual_urb_error=%d\n", atomic_read(&pdvobj->continual_urb_error));
+#endif
+
+        for(i = 0; i < 4; i++)
+	{
+		phwxmit = pxmitpriv->hwxmits + i;
+		len += snprintf(page + len, count - len, "%d, hwq.accnt=%d\n", i, phwxmit->accnt);
+	}
+
+	*eof = 1;
+	return len;
+
+}
+
+
+
+int proc_get_mac_reg_dump1(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+	int i,j=1;
+
+	len += snprintf(page + len, count - len, "\n======= MAC REG =======\n");
+
+	for(i=0x0;i<0x300;i+=4)
+	{
+		if(j%4==1)	len += snprintf(page + len, count - len,"0x%02x",i);
+		len += snprintf(page + len, count - len," 0x%08x ",rtw_read32(padapter,i));
+		if((j++)%4 == 0)	len += snprintf(page + len, count - len,"\n");
+	}
+
+	*eof = 1;
+	return len;
+
+}
+
+int proc_get_mac_reg_dump2(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+	int i,j=1;
+
+	len += snprintf(page + len, count - len, "\n======= MAC REG =======\n");
+	memset(page, 0, count);
+	for(i=0x300;i<0x600;i+=4)
+	{
+		if(j%4==1)	len += snprintf(page + len, count - len,"0x%02x",i);
+		len += snprintf(page + len, count - len," 0x%08x ",rtw_read32(padapter,i));
+		if((j++)%4 == 0)	len += snprintf(page + len, count - len,"\n");
+	}
+
+	*eof = 1;
+	return len;
+
+}
+
+int proc_get_mac_reg_dump3(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+	int i,j=1;
+
+	len += snprintf(page + len, count - len, "\n======= MAC REG =======\n");
+
+	for(i=0x600;i<0x800;i+=4)
+	{
+		if(j%4==1)	len += snprintf(page + len, count - len,"0x%02x",i);
+		len += snprintf(page + len, count - len," 0x%08x ",rtw_read32(padapter,i));
+		if((j++)%4 == 0)	len += snprintf(page + len, count - len,"\n");
+	}
+
+	*eof = 1;
+	return len;
+
+}
+
+int proc_get_bb_reg_dump1(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+	int i,j=1;
+
+	len += snprintf(page + len, count - len, "\n======= BB REG =======\n");
+	for(i=0x800;i<0xB00;i+=4)
+	{
+		if(j%4==1) 	len += snprintf(page + len, count - len,"0x%02x",i);
+		len += snprintf(page + len, count - len," 0x%08x ",rtw_read32(padapter,i));
+		if((j++)%4 == 0)	len += snprintf(page + len, count - len,"\n");
+	}
+	*eof = 1;
+	return len;
+}
+
+int proc_get_bb_reg_dump2(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+	int i,j=1;
+
+	len += snprintf(page + len, count - len, "\n======= BB REG =======\n");
+	for(i=0xB00;i<0xE00;i+=4)
+	{
+		if(j%4==1) 	len += snprintf(page + len, count - len,"0x%02x",i);
+		len += snprintf(page + len, count - len," 0x%08x ",rtw_read32(padapter,i));
+		if((j++)%4 == 0)	len += snprintf(page + len, count - len,"\n");
+	}
+	*eof = 1;
+	return len;
+}
+
+int proc_get_bb_reg_dump3(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+	int i,j=1;
+
+	len += snprintf(page + len, count - len, "\n======= BB REG =======\n");
+	for(i=0xE00;i<0x1000;i+=4)
+	{
+		if(j%4==1) 	len += snprintf(page + len, count - len,"0x%02x",i);
+		len += snprintf(page + len, count - len," 0x%08x ",rtw_read32(padapter,i));
+		if((j++)%4 == 0)	len += snprintf(page + len, count - len,"\n");
+	}
+	*eof = 1;
+	return len;
+}
+
+int proc_get_rf_reg_dump1(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+	int i,j=1,path;
+	u32 value;
+
+	len += snprintf(page + len, count - len, "\n======= RF REG =======\n");
+	path = 1;
+	len += snprintf(page + len, count - len, "\nRF_Path(%x)\n",path);
+	for(i=0;i<0xC0;i++)
+	{
+		//value = PHY_QueryRFReg(padapter, (RF90_RADIO_PATH_E)path,i, bMaskDWord);
+		value =rtw_hal_read_rfreg(padapter, path, i, 0xffffffff);
+		if(j%4==1)	len += snprintf(page + len, count - len, "0x%02x ",i);
+		len += snprintf(page + len, count - len, " 0x%08x ",value);
+		if((j++)%4==0)	len += snprintf(page + len, count - len, "\n");
+	}
+
+	*eof = 1;
+	return len;
+}
+
+
+int proc_get_rf_reg_dump2(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+	int i,j=1,path;
+	u32 value;
+
+	len += snprintf(page + len, count - len, "\n======= RF REG =======\n");
+	path = 1;
+	len += snprintf(page + len, count - len, "\nRF_Path(%x)\n",path);
+	for(i=0xC0;i<0x100;i++)
+	{
+		//value = PHY_QueryRFReg(padapter, (RF90_RADIO_PATH_E)path,i, bMaskDWord);
+		value =rtw_hal_read_rfreg(padapter, path, i, 0xffffffff);
+		if(j%4==1)	len += snprintf(page + len, count - len, "0x%02x ",i);
+		len += snprintf(page + len, count - len, " 0x%08x ",value);
+		if((j++)%4==0)	len += snprintf(page + len, count - len, "\n");
+	}
+	*eof = 1;
+	return len;
+}
+
+
+int proc_get_rf_reg_dump3(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+	int i,j=1,path;
+	u32 value;
+
+	len += snprintf(page + len, count - len, "\n======= RF REG =======\n");
+	path = 2;
+	len += snprintf(page + len, count - len, "\nRF_Path(%x)\n",path);
+	for(i=0;i<0xC0;i++)
+	{
+		//value = PHY_QueryRFReg(padapter, (RF90_RADIO_PATH_E)path,i, bMaskDWord);
+		value =rtw_hal_read_rfreg(padapter, path, i, 0xffffffff);
+		if(j%4==1)	len += snprintf(page + len, count - len, "0x%02x ",i);
+		len += snprintf(page + len, count - len, " 0x%08x ",value);
+		if((j++)%4==0)	len += snprintf(page + len, count - len, "\n");
+	}
+
+	*eof = 1;
+	return len;
+}
+
+
+int proc_get_rf_reg_dump4(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+	int i,j=1,path;
+	u32 value;
+
+	len += snprintf(page + len, count - len, "\n======= RF REG =======\n");
+	path = 2;
+	len += snprintf(page + len, count - len, "\nRF_Path(%x)\n",path);
+	for(i=0xC0;i<0x100;i++)
+	{
+		//value = PHY_QueryRFReg(padapter, (RF90_RADIO_PATH_E)path,i, bMaskDWord);
+		value =rtw_hal_read_rfreg(padapter, path, i, 0xffffffff);
+		if(j%4==1)	len += snprintf(page + len, count - len, "0x%02x ",i);
+		len += snprintf(page + len, count - len, " 0x%08x ",value);
+		if((j++)%4==0)	len += snprintf(page + len, count - len, "\n");
+	}
+	*eof = 1;
+	return len;
+}
+
+
+
+int proc_get_rx_signal(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+	int len = 0;
+
+	len += snprintf(page + len, count - len,
+		"rssi:%d\n"
+		"rxpwdb:%d\n"
+		"signal_strength:%u\n"
+		"signal_qual:%u\n"
+		"noise:%u\n",
+		padapter->recvpriv.rssi,
+		padapter->recvpriv.rxpwdb,
+		padapter->recvpriv.signal_strength,
+		padapter->recvpriv.signal_qual,
+		padapter->recvpriv.noise
+		);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_set_rx_signal(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	char tmp[32];
+	u32 is_signal_dbg, signal_strength;
+
+	if (count < 1)
+		return -EFAULT;
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {
+
+		int num = sscanf(tmp, "%u %u", &is_signal_dbg, &signal_strength);
+
+		is_signal_dbg = is_signal_dbg==0?0:1;
+
+		if(is_signal_dbg && num!=2)
+			return count;
+
+		signal_strength = signal_strength>100?100:signal_strength;
+		signal_strength = signal_strength<0?0:signal_strength;
+
+		padapter->recvpriv.is_signal_dbg = is_signal_dbg;
+		padapter->recvpriv.signal_strength_dbg=signal_strength;
+
+		if(is_signal_dbg)
+			DBG_871X("set %s %u\n", "DBG_SIGNAL_STRENGTH", signal_strength);
+		else
+			DBG_871X("set %s\n", "HW_SIGNAL_STRENGTH");
+
+	}
+
+	return count;
+
+}
+
+int proc_get_ht_enable(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+
+	int len = 0;
+
+	if(pregpriv)
+		len += snprintf(page + len, count - len,
+			"%d\n",
+			pregpriv->ht_enable
+			);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_set_ht_enable(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	char tmp[32];
+	u32 mode;
+
+	if (count < 1)
+		return -EFAULT;
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {
+
+		int num = sscanf(tmp, "%d ", &mode);
+
+		if( pregpriv && mode >= 0 && mode < 2 )
+		{
+			pregpriv->ht_enable= mode;
+			printk("ht_enable=%d\n", pregpriv->ht_enable);
+		}
+	}
+
+	return count;
+
+}
+
+
+int proc_get_cbw40_enable(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+
+	int len = 0;
+
+	if(pregpriv)
+		len += snprintf(page + len, count - len,
+			"%d\n",
+			pregpriv->cbw40_enable
+			);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_set_cbw40_enable(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	char tmp[32];
+	u32 mode;
+
+	if (count < 1)
+		return -EFAULT;
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {
+
+		int num = sscanf(tmp, "%d ", &mode);
+
+		if( pregpriv && mode >= 0 && mode < 2 )
+		{
+			pregpriv->cbw40_enable= mode;
+			printk("cbw40_enable=%d\n", mode);
+		}
+	}
+
+	return count;
+
+}
+
+int proc_get_ampdu_enable(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+
+	int len = 0;
+
+	if(pregpriv)
+		len += snprintf(page + len, count - len,
+			"%d\n",
+			pregpriv->ampdu_enable
+			);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_set_ampdu_enable(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	char tmp[32];
+	u32 mode;
+
+	if (count < 1)
+		return -EFAULT;
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {
+
+		int num = sscanf(tmp, "%d ", &mode);
+
+		if( pregpriv && mode >= 0 && mode < 3 )
+		{
+			pregpriv->ampdu_enable= mode;
+			printk("ampdu_enable=%d\n", mode);
+		}
+	}
+
+	return count;
+
+}
+
+
+int proc_get_two_path_rssi(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	int len = 0;
+
+	if(padapter)
+		len += snprintf(page + len, count - len,
+			"%d %d\n",
+			padapter->recvpriv.RxRssi[0],
+			padapter->recvpriv.RxRssi[1]
+			);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_get_rx_stbc(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+
+	int len = 0;
+
+	if(pregpriv)
+		len += snprintf(page + len, count - len,
+			"%d\n",
+			pregpriv->rx_stbc
+			);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_set_rx_stbc(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	char tmp[32];
+	u32 mode;
+
+	if (count < 1)
+		return -EFAULT;
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {
+
+		int num = sscanf(tmp, "%d ", &mode);
+
+		if( pregpriv && (mode == 0 || mode == 1|| mode == 2|| mode == 3))
+		{
+			pregpriv->rx_stbc= mode;
+			printk("rx_stbc=%d\n", mode);
+		}
+	}
+
+	return count;
+
+}
+
+int proc_get_vid(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u16 VID=0;
+	int len = 0;
+
+	rtw_hal_get_hwreg(padapter, HW_VAR_VID, (u8 *)&VID);
+	len += snprintf(page + len, count - len,
+		"%04x\n",
+		VID
+		);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_get_pid(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u16 PID=0;
+	int len = 0;
+
+	rtw_hal_get_hwreg(padapter, HW_VAR_PID, (u8 *)&PID);
+	len += snprintf(page + len, count - len,
+		"%04x\n",
+		PID
+		);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_get_rssi_disp(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	*eof = 1;
+	return 0;
+}
+
+int proc_set_rssi_disp(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	char tmp[32];
+	u32 enable=0;
+
+	if (count < 1)
+	{
+		DBG_8192C("argument size is less than 1\n");
+		return -EFAULT;
+	}
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {
+
+		int num = sscanf(tmp, "%x", &enable);
+
+		if (num !=  1) {
+			DBG_8192C("invalid set_rssi_disp parameter!\n");
+			return count;
+		}
+
+		if(enable)
+		{
+			DBG_8192C("Turn On Rx RSSI Display Function\n");
+			padapter->bRxRSSIDisplay = enable ;
+		}
+		else
+		{
+			DBG_8192C("Turn Off Rx RSSI Display Function\n");
+			padapter->bRxRSSIDisplay = 0 ;
+		}
+
+	}
+
+	return count;
+
+}
+
+
+#ifdef CONFIG_AP_MODE
+
+int proc_get_all_sta_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	_irqL irqL;
+	struct sta_info *psta;
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	int i, j;
+	_list	*plist, *phead;
+	struct recv_reorder_ctrl *preorder_ctrl;
+	int len = 0;
+
+
+	len += snprintf(page + len, count - len, "sta_dz_bitmap=0x%x, tim_bitmap=0x%x\n", pstapriv->sta_dz_bitmap, pstapriv->tim_bitmap);
+
+	_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+	for(i=0; i< NUM_STA; i++)
+	{
+		phead = &(pstapriv->sta_hash[i]);
+		plist = get_next(phead);
+
+		while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+		{
+			psta = LIST_CONTAINOR(plist, struct sta_info, hash_list);
+
+			plist = get_next(plist);
+
+			//if(extra_arg == psta->aid)
+			{
+				len += snprintf(page + len, count - len, "sta's macaddr:" MAC_FMT "\n", MAC_ARG(psta->hwaddr));
+				len += snprintf(page + len, count - len, "rtsen=%d, cts2slef=%d\n", psta->rtsen, psta->cts2self);
+				len += snprintf(page + len, count - len, "qos_en=%d, ht_en=%d, init_rate=%d\n", psta->qos_option, psta->htpriv.ht_option, psta->init_rate);
+				len += snprintf(page + len, count - len, "state=0x%x, aid=%d, macid=%d, raid=%d\n", psta->state, psta->aid, psta->mac_id, psta->raid);
+				len += snprintf(page + len, count - len, "bwmode=%d, ch_offset=%d, sgi=%d\n", psta->htpriv.bwmode, psta->htpriv.ch_offset, psta->htpriv.sgi);
+				len += snprintf(page + len, count - len, "ampdu_enable = %d\n", psta->htpriv.ampdu_enable);
+				len += snprintf(page + len, count - len, "agg_enable_bitmap=%x, candidate_tid_bitmap=%x\n", psta->htpriv.agg_enable_bitmap, psta->htpriv.candidate_tid_bitmap);
+				len += snprintf(page + len, count - len, "sleepq_len=%d\n", psta->sleepq_len);
+				len += snprintf(page + len, count - len, "capability=0x%x\n", psta->capability);
+				len += snprintf(page + len, count - len, "flags=0x%x\n", psta->flags);
+				len += snprintf(page + len, count - len, "wpa_psk=0x%x\n", psta->wpa_psk);
+				len += snprintf(page + len, count - len, "wpa2_group_cipher=0x%x\n", psta->wpa2_group_cipher);
+				len += snprintf(page + len, count - len, "wpa2_pairwise_cipher=0x%x\n", psta->wpa2_pairwise_cipher);
+				len += snprintf(page + len, count - len, "qos_info=0x%x\n", psta->qos_info);
+				len += snprintf(page + len, count - len, "dot118021XPrivacy=0x%x\n", psta->dot118021XPrivacy);
+
+				for(j=0;j<16;j++)
+				{
+					preorder_ctrl = &psta->recvreorder_ctrl[j];
+					if(preorder_ctrl->enable)
+					{
+						len += snprintf(page + len, count - len, "tid=%d, indicate_seq=%d\n", j, preorder_ctrl->indicate_seq);
+					}
+				}
+
+			}
+
+		}
+
+	}
+
+	_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+	*eof = 1;
+	return len;
+
+}
+
+#endif
+
+#ifdef DBG_MEMORY_LEAK
+#include <asm/atomic.h>
+extern atomic_t _malloc_cnt;;
+extern atomic_t _malloc_size;;
+
+int proc_get_malloc_cnt(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+
+	int len = 0;
+
+	len += snprintf(page + len, count - len, "_malloc_cnt=%d\n", atomic_read(&_malloc_cnt));
+	len += snprintf(page + len, count - len, "_malloc_size=%d\n", atomic_read(&_malloc_size));
+
+	*eof = 1;
+	return len;
+}
+#endif /* DBG_MEMORY_LEAK */
+
+#ifdef CONFIG_FIND_BEST_CHANNEL
+int proc_get_best_channel(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	int len = 0;
+	u32 i, best_channel_24G = 1, best_channel_5G = 36, index_24G = 0, index_5G = 0;
+
+	for (i=0; pmlmeext->channel_set[i].ChannelNum !=0; i++) {
+		if ( pmlmeext->channel_set[i].ChannelNum == 1)
+			index_24G = i;
+		if ( pmlmeext->channel_set[i].ChannelNum == 36)
+			index_5G = i;
+	}
+
+	for (i=0; pmlmeext->channel_set[i].ChannelNum !=0; i++) {
+		// 2.4G
+		if ( pmlmeext->channel_set[i].ChannelNum == 6 ) {
+			if ( pmlmeext->channel_set[i].rx_count < pmlmeext->channel_set[index_24G].rx_count ) {
+				index_24G = i;
+				best_channel_24G = pmlmeext->channel_set[i].ChannelNum;
+			}
+		}
+
+		// 5G
+		if ( pmlmeext->channel_set[i].ChannelNum >= 36
+			&& pmlmeext->channel_set[i].ChannelNum < 140 ) {
+			 // Find primary channel
+			if ( (( pmlmeext->channel_set[i].ChannelNum - 36) % 8 == 0)
+				&& (pmlmeext->channel_set[i].rx_count < pmlmeext->channel_set[index_5G].rx_count) ) {
+				index_5G = i;
+				best_channel_5G = pmlmeext->channel_set[i].ChannelNum;
+			}
+		}
+
+		if ( pmlmeext->channel_set[i].ChannelNum >= 149
+			&& pmlmeext->channel_set[i].ChannelNum < 165) {
+			 // find primary channel
+			if ( (( pmlmeext->channel_set[i].ChannelNum - 149) % 8 == 0)
+				&& (pmlmeext->channel_set[i].rx_count < pmlmeext->channel_set[index_5G].rx_count) ) {
+				index_5G = i;
+				best_channel_5G = pmlmeext->channel_set[i].ChannelNum;
+			}
+		}
+#if 1 // debug
+		len += snprintf(page + len, count - len, "The rx cnt of channel %3d = %d\n",
+					pmlmeext->channel_set[i].ChannelNum, pmlmeext->channel_set[i].rx_count);
+#endif
+	}
+
+	len += snprintf(page + len, count - len, "best_channel_5G = %d\n", best_channel_5G);
+	len += snprintf(page + len, count - len, "best_channel_24G = %d\n", best_channel_24G);
+
+	*eof = 1;
+	return len;
+
+}
+
+int proc_set_best_channel(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	char tmp[32];
+
+	if(count < 1)
+		return -EFAULT;
+
+	if(buffer && !copy_from_user(tmp, buffer, sizeof(tmp)))
+	{
+		int i;
+		for(i = 0; pmlmeext->channel_set[i].ChannelNum != 0; i++)
+		{
+			pmlmeext->channel_set[i].rx_count = 0;
+		}
+
+		DBG_871X("set %s\n", "Clean Best Channel Count");
+	}
+
+	return count;
+}
+#endif /* CONFIG_FIND_BEST_CHANNEL */
+
+#if defined(DBG_CONFIG_ERROR_DETECT)
+#include <rtw_sreset.h>
+int proc_get_sreset(char *page, char **start, off_t offset, int count, int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+	int len = 0;
+
+	*eof = 1;
+	return len;
+}
+
+int proc_set_sreset(struct file *file, const char *buffer, unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	char tmp[32];
+	s32 trigger_point;
+
+	if (count < 1)
+		return -EFAULT;
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {
+
+		int num = sscanf(tmp, "%d", &trigger_point);
+
+		if (trigger_point == SRESET_TGP_NULL)
+			rtw_hal_sreset_reset(padapter);
+		else
+			sreset_set_trigger_point(padapter, trigger_point);
+	}
+
+	return count;
+
+}
+#endif /* DBG_CONFIG_ERROR_DETECT */
+
+#ifdef CONFIG_DM_ADAPTIVITY
+int proc_get_dm_adaptivity(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	int len = 0;
+
+	len += dm_adaptivity_get_parm_str(padapter, page, count);
+
+	*eof = 1;
+	return len;
+}
+
+int proc_set_dm_adaptivity(struct file *file, const char *buffer,
+		unsigned long count, void *data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	char tmp[32];
+	u32 TH_L2H_ini;
+	s8 TH_EDCCA_HL_diff;
+	u32 IGI_Base;
+	int ForceEDCCA;
+	u8 AdapEn_RSSI;
+	u8 IGI_LowerBound;
+
+	if (count < 1)
+		return -EFAULT;
+
+	if (buffer && !copy_from_user(tmp, buffer, sizeof(tmp))) {
+
+		int num = sscanf(tmp, "%x %hhd %x %d %hhu %hhu",
+			&TH_L2H_ini, &TH_EDCCA_HL_diff, &IGI_Base, &ForceEDCCA, &AdapEn_RSSI, &IGI_LowerBound);
+
+		if (num != 6)
+			return count;
+
+		dm_adaptivity_set_parm(padapter, (s8)TH_L2H_ini, TH_EDCCA_HL_diff, (s8)IGI_Base, (bool)ForceEDCCA, AdapEn_RSSI, IGI_LowerBound);
+	}
+
+	return count;
+}
+#endif /* CONFIG_DM_ADAPTIVITY */
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_eeprom.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_eeprom.c
new file mode 100644
index 000000000000..c0a6b541bf12
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_eeprom.c
@@ -0,0 +1,422 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_EEPROM_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+void up_clk(_adapter*	padapter,	 u16 *x)
+{
+_func_enter_;
+	*x = *x | _EESK;
+	rtw_write8(padapter, EE_9346CR, (u8)*x);
+	rtw_udelay_os(CLOCK_RATE);
+
+_func_exit_;
+
+}
+
+void down_clk(_adapter *	padapter, u16 *x	)
+{
+_func_enter_;
+	*x = *x & ~_EESK;
+	rtw_write8(padapter, EE_9346CR, (u8)*x);
+	rtw_udelay_os(CLOCK_RATE);
+_func_exit_;
+}
+
+void shift_out_bits(_adapter * padapter, u16 data, u16 count)
+{
+	u16 x,mask;
+_func_enter_;
+
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+	mask = 0x01 << (count - 1);
+	x = rtw_read8(padapter, EE_9346CR);
+
+	x &= ~(_EEDO | _EEDI);
+
+	do
+	{
+		x &= ~_EEDI;
+		if(data & mask)
+			x |= _EEDI;
+		if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+		}
+		rtw_write8(padapter, EE_9346CR, (u8)x);
+		rtw_udelay_os(CLOCK_RATE);
+		up_clk(padapter, &x);
+		down_clk(padapter, &x);
+		mask = mask >> 1;
+	} while(mask);
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+	x &= ~_EEDI;
+	rtw_write8(padapter, EE_9346CR, (u8)x);
+out:
+_func_exit_;
+}
+
+u16 shift_in_bits (_adapter * padapter)
+{
+	u16 x,d=0,i;
+_func_enter_;
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+	x = rtw_read8(padapter, EE_9346CR);
+
+	x &= ~( _EEDO | _EEDI);
+	d = 0;
+
+	for(i=0; i<16; i++)
+	{
+		d = d << 1;
+		up_clk(padapter, &x);
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+		x = rtw_read8(padapter, EE_9346CR);
+
+		x &= ~(_EEDI);
+		if(x & _EEDO)
+		d |= 1;
+
+		down_clk(padapter, &x);
+	}
+out:
+_func_exit_;
+
+	return d;
+}
+
+void standby(_adapter *	padapter	)
+{
+	u8   x;
+_func_enter_;
+	x = rtw_read8(padapter, EE_9346CR);
+
+	x &= ~(_EECS | _EESK);
+	rtw_write8(padapter, EE_9346CR,x);
+
+	rtw_udelay_os(CLOCK_RATE);
+	x |= _EECS;
+	rtw_write8(padapter, EE_9346CR, x);
+	rtw_udelay_os(CLOCK_RATE);
+_func_exit_;
+}
+
+u16 wait_eeprom_cmd_done(_adapter* padapter)
+{
+	u8 	x;
+	u16	i,res=_FALSE;
+_func_enter_;
+	standby(padapter );
+	for (i=0; i<200; i++)
+	{
+		x = rtw_read8(padapter, EE_9346CR);
+		if (x & _EEDO){
+			res=_TRUE;
+			goto exit;
+			}
+		rtw_udelay_os(CLOCK_RATE);
+	}
+exit:
+_func_exit_;
+	return res;
+}
+
+void eeprom_clean(_adapter * padapter)
+{
+	u16 x;
+_func_enter_;
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+	x = rtw_read8(padapter, EE_9346CR);
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+	x &= ~(_EECS | _EEDI);
+	rtw_write8(padapter, EE_9346CR, (u8)x);
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+	up_clk(padapter, &x);
+		if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+	down_clk(padapter, &x);
+out:
+_func_exit_;
+}
+
+void eeprom_write16(_adapter * padapter, u16 reg, u16 data)
+{
+	u8 x;
+#ifdef CONFIG_RTL8712
+	u8	tmp8_ori,tmp8_new,tmp8_clk_ori,tmp8_clk_new;
+	tmp8_ori=rtw_read8(padapter, 0x102502f1);
+	tmp8_new=tmp8_ori & 0xf7;
+	if(tmp8_ori != tmp8_new){
+		rtw_write8(padapter, 0x102502f1, tmp8_new);
+		RT_TRACE(_module_rtl871x_mp_ioctl_c_,_drv_err_,("====write 0x102502f1=====\n"));
+	}
+	tmp8_clk_ori=rtw_read8(padapter,0x10250003);
+	tmp8_clk_new=tmp8_clk_ori|0x20;
+	if(tmp8_clk_new!=tmp8_clk_ori){
+		RT_TRACE(_module_rtl871x_mp_ioctl_c_,_drv_err_,("====write 0x10250003=====\n"));
+		rtw_write8(padapter, 0x10250003, tmp8_clk_new);
+	}
+#endif
+_func_enter_;
+
+	x = rtw_read8(padapter, EE_9346CR);
+
+	x &= ~(_EEDI | _EEDO | _EESK | _EEM0);
+	x |= _EEM1 | _EECS;
+	rtw_write8(padapter, EE_9346CR, x);
+
+	shift_out_bits(padapter, EEPROM_EWEN_OPCODE, 5);
+
+	if(padapter->EepromAddressSize==8)	//CF+ and SDIO
+		shift_out_bits(padapter, 0, 6);
+	else									//USB
+		shift_out_bits(padapter, 0, 4);
+
+	standby( padapter);
+
+// Commented out by rcnjko, 2004.0
+//	// Erase this particular word.  Write the erase opcode and register
+//	// number in that order. The opcode is 3bits in length; reg is 6 bits long.
+//	shift_out_bits(Adapter, EEPROM_ERASE_OPCODE, 3);
+//	shift_out_bits(Adapter, reg, Adapter->EepromAddressSize);
+//
+//	if (wait_eeprom_cmd_done(Adapter ) == FALSE)
+//	{
+//		return;
+//	}
+
+
+	standby(padapter );
+
+	// write the new word to the EEPROM
+
+	// send the write opcode the EEPORM
+	shift_out_bits(padapter, EEPROM_WRITE_OPCODE, 3);
+
+	// select which word in the EEPROM that we are writing to.
+	shift_out_bits(padapter, reg, padapter->EepromAddressSize);
+
+	// write the data to the selected EEPROM word.
+	shift_out_bits(padapter, data, 16);
+
+	if (wait_eeprom_cmd_done(padapter ) == _FALSE)
+	{
+
+		goto exit;
+	}
+
+	standby(padapter );
+
+	shift_out_bits(padapter, EEPROM_EWDS_OPCODE, 5);
+	shift_out_bits(padapter, reg, 4);
+
+	eeprom_clean(padapter );
+exit:
+#ifdef CONFIG_RTL8712
+	if(tmp8_clk_new!=tmp8_clk_ori)
+		rtw_write8(padapter, 0x10250003, tmp8_clk_ori);
+	if(tmp8_new!=tmp8_ori)
+		rtw_write8(padapter, 0x102502f1, tmp8_ori);
+
+#endif
+_func_exit_;
+	return;
+}
+
+u16 eeprom_read16(_adapter * padapter, u16 reg) //ReadEEprom
+{
+
+	u16 x;
+	u16 data=0;
+#ifdef CONFIG_RTL8712
+	u8	tmp8_ori,tmp8_new,tmp8_clk_ori,tmp8_clk_new;
+	tmp8_ori= rtw_read8(padapter, 0x102502f1);
+	tmp8_new = tmp8_ori & 0xf7;
+	if(tmp8_ori != tmp8_new){
+		rtw_write8(padapter, 0x102502f1, tmp8_new);
+		RT_TRACE(_module_rtl871x_mp_ioctl_c_,_drv_err_,("====write 0x102502f1=====\n"));
+	}
+	tmp8_clk_ori=rtw_read8(padapter,0x10250003);
+	tmp8_clk_new=tmp8_clk_ori|0x20;
+	if(tmp8_clk_new!=tmp8_clk_ori){
+		RT_TRACE(_module_rtl871x_mp_ioctl_c_,_drv_err_,("====write 0x10250003=====\n"));
+		rtw_write8(padapter, 0x10250003, tmp8_clk_new);
+	}
+#endif
+_func_enter_;
+
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+	// select EEPROM, reset bits, set _EECS
+	x = rtw_read8(padapter, EE_9346CR);
+
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+
+	x &= ~(_EEDI | _EEDO | _EESK | _EEM0);
+	x |= _EEM1 | _EECS;
+	rtw_write8(padapter, EE_9346CR, (unsigned char)x);
+
+	// write the read opcode and register number in that order
+	// The opcode is 3bits in length, reg is 6 bits long
+	shift_out_bits(padapter, EEPROM_READ_OPCODE, 3);
+	shift_out_bits(padapter, reg, padapter->EepromAddressSize);
+
+	// Now read the data (16 bits) in from the selected EEPROM word
+	data = shift_in_bits(padapter);
+
+	eeprom_clean(padapter);
+out:
+#ifdef CONFIG_RTL8712
+	if(tmp8_clk_new!=tmp8_clk_ori)
+		rtw_write8(padapter, 0x10250003, tmp8_clk_ori);
+	if(tmp8_new!=tmp8_ori)
+		rtw_write8(padapter, 0x102502f1, tmp8_ori);
+
+#endif
+_func_exit_;
+	return data;
+
+
+}
+
+
+
+
+//From even offset
+void eeprom_read_sz(_adapter * padapter, u16 reg, u8* data, u32 sz)
+{
+
+	u16 x, data16;
+	u32 i;
+_func_enter_;
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+	// select EEPROM, reset bits, set _EECS
+	x = rtw_read8(padapter, EE_9346CR);
+
+	if(padapter->bSurpriseRemoved==_TRUE){
+		RT_TRACE(_module_rtl871x_eeprom_c_,_drv_err_,("padapter->bSurpriseRemoved==_TRUE"));
+		goto out;
+	}
+
+	x &= ~(_EEDI | _EEDO | _EESK | _EEM0);
+	x |= _EEM1 | _EECS;
+	rtw_write8(padapter, EE_9346CR, (unsigned char)x);
+
+	// write the read opcode and register number in that order
+	// The opcode is 3bits in length, reg is 6 bits long
+	shift_out_bits(padapter, EEPROM_READ_OPCODE, 3);
+	shift_out_bits(padapter, reg, padapter->EepromAddressSize);
+
+
+	for(i=0; i<sz; i+=2)
+	{
+		data16 = shift_in_bits(padapter);
+		data[i] = data16 & 0xff;
+		data[i+1] = data16 >>8;
+	}
+
+	eeprom_clean(padapter);
+out:
+_func_exit_;
+
+
+
+}
+
+
+//addr_off : address offset of the entry in eeprom (not the tuple number of eeprom (reg); that is addr_off !=reg)
+u8 eeprom_read(_adapter * padapter, u32 addr_off, u8 sz, u8* rbuf)
+{
+	u8 quotient, remainder, addr_2align_odd;
+	u16 reg, stmp , i=0, idx = 0;
+_func_enter_;
+	reg = (u16)(addr_off >> 1);
+	addr_2align_odd = (u8)(addr_off & 0x1);
+
+	if(addr_2align_odd) //read that start at high part: e.g  1,3,5,7,9,...
+	{
+		stmp = eeprom_read16(padapter, reg);
+		rbuf[idx++] = (u8) ((stmp>>8)&0xff); //return hogh-part of the short
+		reg++; sz--;
+	}
+
+	quotient = sz >> 1;
+	remainder = sz & 0x1;
+
+	for( i=0 ; i < quotient; i++)
+	{
+		stmp = eeprom_read16(padapter, reg+i);
+		rbuf[idx++] = (u8) (stmp&0xff);
+		rbuf[idx++] = (u8) ((stmp>>8)&0xff);
+	}
+
+	reg = reg+i;
+	if(remainder){ //end of read at lower part of short : 0,2,4,6,...
+		stmp = eeprom_read16(padapter, reg);
+		rbuf[idx] = (u8)(stmp & 0xff);
+	}
+_func_exit_;
+	return _TRUE;
+}
+
+
+
+VOID read_eeprom_content(_adapter *	padapter)
+{
+
+_func_enter_;
+
+
+_func_exit_;
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ieee80211.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ieee80211.c
new file mode 100644
index 000000000000..9470d72ac6a1
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ieee80211.c
@@ -0,0 +1,1915 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _IEEE80211_C
+
+#include <drv_types.h>
+#include <ieee80211.h>
+#include <wifi.h>
+#include <osdep_service.h>
+#include <wlan_bssdef.h>
+
+u8 RTW_WPA_OUI_TYPE[] = { 0x00, 0x50, 0xf2, 1 };
+u16 RTW_WPA_VERSION = 1;
+u8 WPA_AUTH_KEY_MGMT_NONE[] = { 0x00, 0x50, 0xf2, 0 };
+u8 WPA_AUTH_KEY_MGMT_UNSPEC_802_1X[] = { 0x00, 0x50, 0xf2, 1 };
+u8 WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X[] = { 0x00, 0x50, 0xf2, 2 };
+u8 WPA_CIPHER_SUITE_NONE[] = { 0x00, 0x50, 0xf2, 0 };
+u8 WPA_CIPHER_SUITE_WEP40[] = { 0x00, 0x50, 0xf2, 1 };
+u8 WPA_CIPHER_SUITE_TKIP[] = { 0x00, 0x50, 0xf2, 2 };
+u8 WPA_CIPHER_SUITE_WRAP[] = { 0x00, 0x50, 0xf2, 3 };
+u8 WPA_CIPHER_SUITE_CCMP[] = { 0x00, 0x50, 0xf2, 4 };
+u8 WPA_CIPHER_SUITE_WEP104[] = { 0x00, 0x50, 0xf2, 5 };
+
+u16 RSN_VERSION_BSD = 1;
+u8 RSN_AUTH_KEY_MGMT_UNSPEC_802_1X[] = { 0x00, 0x0f, 0xac, 1 };
+u8 RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X[] = { 0x00, 0x0f, 0xac, 2 };
+u8 RSN_CIPHER_SUITE_NONE[] = { 0x00, 0x0f, 0xac, 0 };
+u8 RSN_CIPHER_SUITE_WEP40[] = { 0x00, 0x0f, 0xac, 1 };
+u8 RSN_CIPHER_SUITE_TKIP[] = { 0x00, 0x0f, 0xac, 2 };
+u8 RSN_CIPHER_SUITE_WRAP[] = { 0x00, 0x0f, 0xac, 3 };
+u8 RSN_CIPHER_SUITE_CCMP[] = { 0x00, 0x0f, 0xac, 4 };
+u8 RSN_CIPHER_SUITE_WEP104[] = { 0x00, 0x0f, 0xac, 5 };
+//-----------------------------------------------------------
+// for adhoc-master to generate ie and provide supported-rate to fw
+//-----------------------------------------------------------
+
+static u8 	WIFI_CCKRATES[] =
+{(IEEE80211_CCK_RATE_1MB | IEEE80211_BASIC_RATE_MASK),
+ (IEEE80211_CCK_RATE_2MB | IEEE80211_BASIC_RATE_MASK),
+ (IEEE80211_CCK_RATE_5MB | IEEE80211_BASIC_RATE_MASK),
+ (IEEE80211_CCK_RATE_11MB | IEEE80211_BASIC_RATE_MASK)};
+
+static u8 	WIFI_OFDMRATES[] =
+{(IEEE80211_OFDM_RATE_6MB),
+ (IEEE80211_OFDM_RATE_9MB),
+ (IEEE80211_OFDM_RATE_12MB),
+ (IEEE80211_OFDM_RATE_18MB),
+ (IEEE80211_OFDM_RATE_24MB),
+ IEEE80211_OFDM_RATE_36MB,
+ IEEE80211_OFDM_RATE_48MB,
+ IEEE80211_OFDM_RATE_54MB};
+
+
+int rtw_get_bit_value_from_ieee_value(u8 val)
+{
+	unsigned char dot11_rate_table[]={2,4,11,22,12,18,24,36,48,72,96,108,0}; // last element must be zero!!
+
+	int i=0;
+	while(dot11_rate_table[i] != 0) {
+		if (dot11_rate_table[i] == val)
+			return BIT(i);
+		i++;
+	}
+	return 0;
+}
+
+uint	rtw_is_cckrates_included(u8 *rate)
+{
+		u32	i = 0;
+
+		while(rate[i]!=0)
+		{
+			if  (  (((rate[i]) & 0x7f) == 2)	|| (((rate[i]) & 0x7f) == 4) ||
+			(((rate[i]) & 0x7f) == 11)  || (((rate[i]) & 0x7f) == 22) )
+			return _TRUE;
+			i++;
+		}
+
+		return _FALSE;
+}
+
+uint	rtw_is_cckratesonly_included(u8 *rate)
+{
+	u32 i = 0;
+
+
+	while(rate[i]!=0)
+	{
+			if  (  (((rate[i]) & 0x7f) != 2) && (((rate[i]) & 0x7f) != 4) &&
+				(((rate[i]) & 0x7f) != 11)  && (((rate[i]) & 0x7f) != 22) )
+
+			return _FALSE;
+
+			i++;
+	}
+
+	return _TRUE;
+
+}
+
+int rtw_check_network_type(unsigned char *rate, int ratelen, int channel)
+{
+	if (channel > 14)
+	{
+		if ((rtw_is_cckrates_included(rate)) == _TRUE)
+			return WIRELESS_INVALID;
+		else
+			return WIRELESS_11A;
+	}
+	else  // could be pure B, pure G, or B/G
+	{
+		if ((rtw_is_cckratesonly_included(rate)) == _TRUE)
+			return WIRELESS_11B;
+		else if((rtw_is_cckrates_included(rate)) == _TRUE)
+			return 	WIRELESS_11BG;
+		else
+			return WIRELESS_11G;
+	}
+
+}
+
+u8 *rtw_set_fixed_ie(unsigned char *pbuf, unsigned int len, unsigned char *source,
+				unsigned int *frlen)
+{
+	_rtw_memcpy((void *)pbuf, (void *)source, len);
+	*frlen = *frlen + len;
+	return (pbuf + len);
+}
+
+// rtw_set_ie will update frame length
+u8 *rtw_set_ie
+(
+	u8 *pbuf,
+	sint index,
+	uint len,
+	u8 *source,
+	uint *frlen //frame length
+)
+{
+_func_enter_;
+	*pbuf = (u8)index;
+
+	*(pbuf + 1) = (u8)len;
+
+	if (len > 0)
+		_rtw_memcpy((void *)(pbuf + 2), (void *)source, len);
+
+	*frlen = *frlen + (len + 2);
+
+	return (pbuf + len + 2);
+_func_exit_;
+}
+
+inline u8 *rtw_set_ie_ch_switch(u8 *buf, u32 *buf_len, u8 ch_switch_mode,
+	u8 new_ch, u8 ch_switch_cnt)
+{
+	u8 ie_data[3];
+
+	ie_data[0] = ch_switch_mode;
+	ie_data[1] = new_ch;
+	ie_data[2] = ch_switch_cnt;
+	return rtw_set_ie(buf, WLAN_EID_CHANNEL_SWITCH,  3, ie_data, buf_len);
+}
+
+inline u8 secondary_ch_offset_to_hal_ch_offset(u8 ch_offset)
+{
+	if (ch_offset == SCN)
+		return HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+	else if(ch_offset == SCA)
+		return HAL_PRIME_CHNL_OFFSET_UPPER;
+	else if(ch_offset == SCB)
+		return HAL_PRIME_CHNL_OFFSET_LOWER;
+
+	return HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+}
+
+inline u8 hal_ch_offset_to_secondary_ch_offset(u8 ch_offset)
+{
+	if (ch_offset == HAL_PRIME_CHNL_OFFSET_DONT_CARE)
+		return SCN;
+	else if(ch_offset == HAL_PRIME_CHNL_OFFSET_LOWER)
+		return SCB;
+	else if(ch_offset == HAL_PRIME_CHNL_OFFSET_UPPER)
+		return SCA;
+
+	return SCN;
+}
+
+inline u8 *rtw_set_ie_secondary_ch_offset(u8 *buf, u32 *buf_len, u8 secondary_ch_offset)
+{
+	return rtw_set_ie(buf, WLAN_EID_SECONDARY_CHANNEL_OFFSET,  1, &secondary_ch_offset, buf_len);
+}
+
+inline u8 *rtw_set_ie_mesh_ch_switch_parm(u8 *buf, u32 *buf_len, u8 ttl,
+	u8 flags, u16 reason, u16 precedence)
+{
+	u8 ie_data[6];
+
+	ie_data[0] = ttl;
+	ie_data[1] = flags;
+	RTW_PUT_LE16((u8*)&ie_data[2], reason);
+	RTW_PUT_LE16((u8*)&ie_data[4], precedence);
+
+	return rtw_set_ie(buf, 0x118,  6, ie_data, buf_len);
+}
+
+/*----------------------------------------------------------------------------
+index: the information element id index, limit is the limit for search
+-----------------------------------------------------------------------------*/
+u8 *rtw_get_ie(u8 *pbuf, sint index, sint *len, sint limit)
+{
+	sint tmp,i;
+	u8 *p;
+_func_enter_;
+	if (limit < 1){
+		_func_exit_;
+		return NULL;
+	}
+
+	p = pbuf;
+	i = 0;
+	*len = 0;
+	while(1)
+	{
+		if (*p == index)
+		{
+			*len = *(p + 1);
+			return (p);
+		}
+		else
+		{
+			tmp = *(p + 1);
+			p += (tmp + 2);
+			i += (tmp + 2);
+		}
+		if (i >= limit)
+			break;
+	}
+_func_exit_;
+	return NULL;
+}
+
+/**
+ * rtw_get_ie_ex - Search specific IE from a series of IEs
+ * @in_ie: Address of IEs to search
+ * @in_len: Length limit from in_ie
+ * @eid: Element ID to match
+ * @oui: OUI to match
+ * @oui_len: OUI length
+ * @ie: If not NULL and the specific IE is found, the IE will be copied to the buf starting from the specific IE
+ * @ielen: If not NULL and the specific IE is found, will set to the length of the entire IE
+ *
+ * Returns: The address of the specific IE found, or NULL
+ */
+u8 *rtw_get_ie_ex(u8 *in_ie, uint in_len, u8 eid, u8 *oui, u8 oui_len, u8 *ie, uint *ielen)
+{
+	uint cnt;
+	u8 *target_ie = NULL;
+
+
+	if(ielen)
+		*ielen = 0;
+
+	if(!in_ie || in_len<=0)
+		return target_ie;
+
+	cnt = 0;
+
+	while(cnt<in_len)
+	{
+		if(eid == in_ie[cnt]
+			&& ( !oui || _rtw_memcmp(&in_ie[cnt+2], oui, oui_len) == _TRUE))
+		{
+			target_ie = &in_ie[cnt];
+
+			if(ie)
+				_rtw_memcpy(ie, &in_ie[cnt], in_ie[cnt+1]+2);
+
+			if(ielen)
+				*ielen = in_ie[cnt+1]+2;
+
+			break;
+		}
+		else
+		{
+			cnt+=in_ie[cnt+1]+2; //goto next
+		}
+
+	}
+
+	return target_ie;
+}
+
+/**
+ * rtw_ies_remove_ie - Find matching IEs and remove
+ * @ies: Address of IEs to search
+ * @ies_len: Pointer of length of ies, will update to new length
+ * @offset: The offset to start scarch
+ * @eid: Element ID to match
+ * @oui: OUI to match
+ * @oui_len: OUI length
+ *
+ * Returns: _SUCCESS: ies is updated, _FAIL: not updated
+ */
+int rtw_ies_remove_ie(u8 *ies, uint *ies_len, uint offset, u8 eid, u8 *oui, u8 oui_len)
+{
+	int ret = _FAIL;
+	u8 *target_ie;
+	u32 target_ielen;
+	u8 *start;
+	uint search_len;
+
+	if(!ies || !ies_len || *ies_len <= offset)
+		goto exit;
+
+	start = ies + offset;
+	search_len = *ies_len - offset;
+
+	while (1) {
+		target_ie = rtw_get_ie_ex(start, search_len, eid, oui, oui_len, NULL, &target_ielen);
+		if (target_ie && target_ielen) {
+			u8 buf[MAX_IE_SZ] = {0};
+			u8 *remain_ies = target_ie + target_ielen;
+			uint remain_len = search_len - (remain_ies - start);
+
+			_rtw_memcpy(buf, remain_ies, remain_len);
+			_rtw_memcpy(target_ie, buf, remain_len);
+			*ies_len = *ies_len - target_ielen;
+			ret = _SUCCESS;
+
+			start = target_ie;
+			search_len = remain_len;
+		} else {
+			break;
+		}
+	}
+exit:
+	return ret;
+}
+
+void rtw_set_supported_rate(u8* SupportedRates, uint mode)
+{
+_func_enter_;
+
+	_rtw_memset(SupportedRates, 0, NDIS_802_11_LENGTH_RATES_EX);
+
+	switch (mode)
+	{
+		case WIRELESS_11B:
+			_rtw_memcpy(SupportedRates, WIFI_CCKRATES, IEEE80211_CCK_RATE_LEN);
+			break;
+
+		case WIRELESS_11G:
+		case WIRELESS_11A:
+		case WIRELESS_11_5N:
+		case WIRELESS_11A_5N://Todo: no basic rate for ofdm ?
+			_rtw_memcpy(SupportedRates, WIFI_OFDMRATES, IEEE80211_NUM_OFDM_RATESLEN);
+			break;
+
+		case WIRELESS_11BG:
+		case WIRELESS_11G_24N:
+		case WIRELESS_11_24N:
+		case WIRELESS_11BG_24N:
+			_rtw_memcpy(SupportedRates, WIFI_CCKRATES, IEEE80211_CCK_RATE_LEN);
+			_rtw_memcpy(SupportedRates + IEEE80211_CCK_RATE_LEN, WIFI_OFDMRATES, IEEE80211_NUM_OFDM_RATESLEN);
+			break;
+
+	}
+_func_exit_;
+}
+
+uint	rtw_get_rateset_len(u8	*rateset)
+{
+	uint i = 0;
+_func_enter_;
+	while(1)
+	{
+		if ((rateset[i]) == 0)
+			break;
+
+		if (i > 12)
+			break;
+
+		i++;
+	}
+_func_exit_;
+	return i;
+}
+
+int rtw_generate_ie(struct registry_priv *pregistrypriv)
+{
+	u8	wireless_mode;
+	int 	sz = 0, rateLen;
+	WLAN_BSSID_EX*	pdev_network = &pregistrypriv->dev_network;
+	u8*	ie = pdev_network->IEs;
+
+_func_enter_;
+
+	//timestamp will be inserted by hardware
+	sz += 8;
+	ie += sz;
+
+	//beacon interval : 2bytes
+	*(u16*)ie = cpu_to_le16((u16)pdev_network->Configuration.BeaconPeriod);//BCN_INTERVAL;
+	sz += 2;
+	ie += 2;
+
+	//capability info
+	*(u16*)ie = 0;
+
+	*(u16*)ie |= cpu_to_le16(cap_IBSS);
+
+	if(pregistrypriv->preamble == PREAMBLE_SHORT)
+		*(u16*)ie |= cpu_to_le16(cap_ShortPremble);
+
+	if (pdev_network->Privacy)
+		*(u16*)ie |= cpu_to_le16(cap_Privacy);
+
+	sz += 2;
+	ie += 2;
+
+	//SSID
+	ie = rtw_set_ie(ie, _SSID_IE_, pdev_network->Ssid.SsidLength, pdev_network->Ssid.Ssid, &sz);
+
+	//supported rates
+	if(pregistrypriv->wireless_mode == WIRELESS_11ABGN)
+	{
+		if(pdev_network->Configuration.DSConfig > 14)
+			wireless_mode = WIRELESS_11A_5N;
+		else
+			wireless_mode = WIRELESS_11BG_24N;
+	}
+	else
+	{
+		wireless_mode = pregistrypriv->wireless_mode;
+	}
+
+	rtw_set_supported_rate(pdev_network->SupportedRates, wireless_mode) ;
+
+	rateLen = rtw_get_rateset_len(pdev_network->SupportedRates);
+
+	if (rateLen > 8)
+	{
+		ie = rtw_set_ie(ie, _SUPPORTEDRATES_IE_, 8, pdev_network->SupportedRates, &sz);
+		//ie = rtw_set_ie(ie, _EXT_SUPPORTEDRATES_IE_, (rateLen - 8), (pdev_network->SupportedRates + 8), &sz);
+	}
+	else
+	{
+		ie = rtw_set_ie(ie, _SUPPORTEDRATES_IE_, rateLen, pdev_network->SupportedRates, &sz);
+	}
+
+	//DS parameter set
+	ie = rtw_set_ie(ie, _DSSET_IE_, 1, (u8 *)&(pdev_network->Configuration.DSConfig), &sz);
+
+
+	//IBSS Parameter Set
+
+	ie = rtw_set_ie(ie, _IBSS_PARA_IE_, 2, (u8 *)&(pdev_network->Configuration.ATIMWindow), &sz);
+
+	if (rateLen > 8)
+	{
+		ie = rtw_set_ie(ie, _EXT_SUPPORTEDRATES_IE_, (rateLen - 8), (pdev_network->SupportedRates + 8), &sz);
+	}
+
+
+	//HT Cap.
+	if(((pregistrypriv->wireless_mode&WIRELESS_11_5N)||(pregistrypriv->wireless_mode&WIRELESS_11_24N))
+		&& (pregistrypriv->ht_enable==_TRUE))
+	{
+		//todo:
+	}
+
+	//pdev_network->IELength =  sz; //update IELength
+
+_func_exit_;
+
+	//return _SUCCESS;
+
+	return sz;
+
+}
+
+unsigned char *rtw_get_wpa_ie(unsigned char *pie, int *wpa_ie_len, int limit)
+{
+	int len;
+	u16 val16;
+	unsigned char wpa_oui_type[] = {0x00, 0x50, 0xf2, 0x01};
+	u8 *pbuf = pie;
+
+	while(1)
+	{
+		pbuf = rtw_get_ie(pbuf, _WPA_IE_ID_, &len, limit);
+
+		if (pbuf) {
+
+			//check if oui matches...
+			if (_rtw_memcmp((pbuf + 2), wpa_oui_type, sizeof (wpa_oui_type)) == _FALSE) {
+
+				goto check_next_ie;
+			}
+
+			//check version...
+			_rtw_memcpy((u8 *)&val16, (pbuf + 6), sizeof(val16));
+
+			val16 = le16_to_cpu(val16);
+			if (val16 != 0x0001)
+				goto check_next_ie;
+
+			*wpa_ie_len = *(pbuf + 1);
+
+			return pbuf;
+		}
+		else {
+
+			*wpa_ie_len = 0;
+			return NULL;
+		}
+
+check_next_ie:
+
+		limit -= (2 + len);
+
+		if (limit <= 0)
+			break;
+
+		pbuf += (2 + len);
+	}
+
+	*wpa_ie_len = 0;
+
+	return NULL;
+}
+
+unsigned char *rtw_get_wpa2_ie(unsigned char *pie, int *rsn_ie_len, int limit)
+{
+
+	return rtw_get_ie(pie, _WPA2_IE_ID_,rsn_ie_len, limit);
+
+}
+
+int rtw_get_wpa_cipher_suite(u8 *s)
+{
+	if (_rtw_memcmp(s, WPA_CIPHER_SUITE_NONE, WPA_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_NONE;
+	if (_rtw_memcmp(s, WPA_CIPHER_SUITE_WEP40, WPA_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_WEP40;
+	if (_rtw_memcmp(s, WPA_CIPHER_SUITE_TKIP, WPA_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_TKIP;
+	if (_rtw_memcmp(s, WPA_CIPHER_SUITE_CCMP, WPA_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_CCMP;
+	if (_rtw_memcmp(s, WPA_CIPHER_SUITE_WEP104, WPA_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_WEP104;
+
+	return 0;
+}
+
+int rtw_get_wpa2_cipher_suite(u8 *s)
+{
+	if (_rtw_memcmp(s, RSN_CIPHER_SUITE_NONE, RSN_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_NONE;
+	if (_rtw_memcmp(s, RSN_CIPHER_SUITE_WEP40, RSN_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_WEP40;
+	if (_rtw_memcmp(s, RSN_CIPHER_SUITE_TKIP, RSN_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_TKIP;
+	if (_rtw_memcmp(s, RSN_CIPHER_SUITE_CCMP, RSN_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_CCMP;
+	if (_rtw_memcmp(s, RSN_CIPHER_SUITE_WEP104, RSN_SELECTOR_LEN) == _TRUE)
+		return WPA_CIPHER_WEP104;
+
+	return 0;
+}
+
+
+int rtw_parse_wpa_ie(u8* wpa_ie, int wpa_ie_len, int *group_cipher, int *pairwise_cipher)
+{
+	int i, ret=_SUCCESS;
+	int left, count;
+	u8 *pos;
+
+	if (wpa_ie_len <= 0) {
+		/* No WPA IE - fail silently */
+		return _FAIL;
+	}
+
+
+	if ((*wpa_ie != _WPA_IE_ID_) || (*(wpa_ie+1) != (u8)(wpa_ie_len - 2)) ||
+	   (_rtw_memcmp(wpa_ie+2, RTW_WPA_OUI_TYPE, WPA_SELECTOR_LEN) != _TRUE) )
+	{
+		return _FAIL;
+	}
+
+	pos = wpa_ie;
+
+	pos += 8;
+	left = wpa_ie_len - 8;
+
+
+	//group_cipher
+	if (left >= WPA_SELECTOR_LEN) {
+
+		*group_cipher = rtw_get_wpa_cipher_suite(pos);
+
+		pos += WPA_SELECTOR_LEN;
+		left -= WPA_SELECTOR_LEN;
+
+	}
+	else if (left > 0)
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("%s: ie length mismatch, %u too much", __FUNCTION__, left));
+
+		return _FAIL;
+	}
+
+
+	//pairwise_cipher
+	if (left >= 2)
+	{
+                //count = le16_to_cpu(*(u16*)pos);
+		count = RTW_GET_LE16(pos);
+		pos += 2;
+		left -= 2;
+
+		if (count == 0 || left < count * WPA_SELECTOR_LEN) {
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("%s: ie count botch (pairwise), "
+						"count %u left %u", __FUNCTION__, count, left));
+			return _FAIL;
+		}
+
+		for (i = 0; i < count; i++)
+		{
+			*pairwise_cipher |= rtw_get_wpa_cipher_suite(pos);
+
+			pos += WPA_SELECTOR_LEN;
+			left -= WPA_SELECTOR_LEN;
+		}
+
+	}
+	else if (left == 1)
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("%s: ie too short (for key mgmt)",   __FUNCTION__));
+		return _FAIL;
+	}
+
+
+	return ret;
+
+}
+
+int rtw_parse_wpa2_ie(u8* rsn_ie, int rsn_ie_len, int *group_cipher, int *pairwise_cipher)
+{
+	int i, ret=_SUCCESS;
+	int left, count;
+	u8 *pos;
+
+	if (rsn_ie_len <= 0) {
+		/* No RSN IE - fail silently */
+		return _FAIL;
+	}
+
+
+	if ((*rsn_ie!= _WPA2_IE_ID_) || (*(rsn_ie+1) != (u8)(rsn_ie_len - 2)))
+	{
+		return _FAIL;
+	}
+
+	pos = rsn_ie;
+	pos += 4;
+	left = rsn_ie_len - 4;
+
+	//group_cipher
+	if (left >= RSN_SELECTOR_LEN) {
+
+		*group_cipher = rtw_get_wpa2_cipher_suite(pos);
+
+		pos += RSN_SELECTOR_LEN;
+		left -= RSN_SELECTOR_LEN;
+
+	} else if (left > 0) {
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("%s: ie length mismatch, %u too much", __FUNCTION__, left));
+		return _FAIL;
+	}
+
+	//pairwise_cipher
+	if (left >= 2)
+	{
+	        //count = le16_to_cpu(*(u16*)pos);
+		count = RTW_GET_LE16(pos);
+		pos += 2;
+		left -= 2;
+
+		if (count == 0 || left < count * RSN_SELECTOR_LEN) {
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("%s: ie count botch (pairwise), "
+						 "count %u left %u", __FUNCTION__, count, left));
+			return _FAIL;
+		}
+
+		for (i = 0; i < count; i++)
+		{
+			*pairwise_cipher |= rtw_get_wpa2_cipher_suite(pos);
+
+			pos += RSN_SELECTOR_LEN;
+			left -= RSN_SELECTOR_LEN;
+		}
+
+	}
+	else if (left == 1)
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("%s: ie too short (for key mgmt)",  __FUNCTION__));
+
+		return _FAIL;
+	}
+
+
+	return ret;
+
+}
+
+int rtw_get_sec_ie(u8 *in_ie,uint in_len,u8 *rsn_ie,u16 *rsn_len,u8 *wpa_ie,u16 *wpa_len)
+{
+	u8 authmode, sec_idx, i;
+	u8 wpa_oui[4]={0x0,0x50,0xf2,0x01};
+	uint 	cnt;
+
+_func_enter_;
+
+	//Search required WPA or WPA2 IE and copy to sec_ie[ ]
+
+	cnt = (_TIMESTAMP_ + _BEACON_ITERVAL_ + _CAPABILITY_);
+
+	sec_idx=0;
+
+	while(cnt<in_len)
+	{
+		authmode=in_ie[cnt];
+
+		if((authmode==_WPA_IE_ID_)&&(_rtw_memcmp(&in_ie[cnt+2], &wpa_oui[0],4)==_TRUE))
+		{
+				RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("\n rtw_get_wpa_ie: sec_idx=%d in_ie[cnt+1]+2=%d\n",sec_idx,in_ie[cnt+1]+2));
+
+				_rtw_memcpy(wpa_ie, &in_ie[cnt],in_ie[cnt+1]+2);
+
+				for(i=0;i<(in_ie[cnt+1]+2);i=i+8){
+					RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("\n %2x,%2x,%2x,%2x,%2x,%2x,%2x,%2x\n",wpa_ie[i],wpa_ie[i+1],wpa_ie[i+2],wpa_ie[i+3],wpa_ie[i+4],wpa_ie[i+5],wpa_ie[i+6],wpa_ie[i+7]));
+				}
+
+				*wpa_len=in_ie[cnt+1]+2;
+				cnt+=in_ie[cnt+1]+2;  //get next
+		}
+		else
+		{
+			if(authmode==_WPA2_IE_ID_)
+			{
+				RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("\n get_rsn_ie: sec_idx=%d in_ie[cnt+1]+2=%d\n",sec_idx,in_ie[cnt+1]+2));
+
+				_rtw_memcpy(rsn_ie, &in_ie[cnt],in_ie[cnt+1]+2);
+
+				for(i=0;i<(in_ie[cnt+1]+2);i=i+8){
+					RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("\n %2x,%2x,%2x,%2x,%2x,%2x,%2x,%2x\n",rsn_ie[i],rsn_ie[i+1],rsn_ie[i+2],rsn_ie[i+3],rsn_ie[i+4],rsn_ie[i+5],rsn_ie[i+6],rsn_ie[i+7]));
+				}
+
+				*rsn_len=in_ie[cnt+1]+2;
+				cnt+=in_ie[cnt+1]+2;  //get next
+			}
+			else
+			{
+				cnt+=in_ie[cnt+1]+2;   //get next
+			}
+		}
+
+	}
+
+_func_exit_;
+
+	return (*rsn_len+*wpa_len);
+
+}
+
+u8 rtw_is_wps_ie(u8 *ie_ptr, uint *wps_ielen)
+{
+	u8 match = _FALSE;
+	u8 eid, wps_oui[4]={0x0,0x50,0xf2,0x04};
+
+	if(ie_ptr == NULL) return match;
+
+	eid = ie_ptr[0];
+
+	if((eid==_WPA_IE_ID_)&&(_rtw_memcmp(&ie_ptr[2], wps_oui, 4)==_TRUE))
+	{
+		//printk("==> found WPS_IE.....\n");
+		*wps_ielen = ie_ptr[1]+2;
+		match=_TRUE;
+	}
+	return match;
+}
+
+/**
+ * rtw_get_wps_ie - Search WPS IE from a series of IEs
+ * @in_ie: Address of IEs to search
+ * @in_len: Length limit from in_ie
+ * @wps_ie: If not NULL and WPS IE is found, WPS IE will be copied to the buf starting from wps_ie
+ * @wps_ielen: If not NULL and WPS IE is found, will set to the length of the entire WPS IE
+ *
+ * Returns: The address of the WPS IE found, or NULL
+ */
+u8 *rtw_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen)
+{
+	uint cnt;
+	u8 *wpsie_ptr=NULL;
+	u8 eid, wps_oui[4]={0x0,0x50,0xf2,0x04};
+
+	if(wps_ielen)
+		*wps_ielen = 0;
+
+	if(!in_ie || in_len<=0)
+		return wpsie_ptr;
+
+	cnt = 0;
+
+	while(cnt<in_len)
+	{
+		eid = in_ie[cnt];
+
+		if((eid==_WPA_IE_ID_)&&(_rtw_memcmp(&in_ie[cnt+2], wps_oui, 4)==_TRUE))
+		{
+			wpsie_ptr = &in_ie[cnt];
+
+			if(wps_ie)
+				_rtw_memcpy(wps_ie, &in_ie[cnt], in_ie[cnt+1]+2);
+
+			if(wps_ielen)
+				*wps_ielen = in_ie[cnt+1]+2;
+
+			cnt+=in_ie[cnt+1]+2;
+
+			break;
+		}
+		else
+		{
+			cnt+=in_ie[cnt+1]+2; //goto next
+		}
+
+	}
+
+	return wpsie_ptr;
+}
+
+/**
+ * rtw_get_wps_attr - Search a specific WPS attribute from a given WPS IE
+ * @wps_ie: Address of WPS IE to search
+ * @wps_ielen: Length limit from wps_ie
+ * @target_attr_id: The attribute ID of WPS attribute to search
+ * @buf_attr: If not NULL and the WPS attribute is found, WPS attribute will be copied to the buf starting from buf_attr
+ * @len_attr: If not NULL and the WPS attribute is found, will set to the length of the entire WPS attribute
+ *
+ * Returns: the address of the specific WPS attribute found, or NULL
+ */
+u8 *rtw_get_wps_attr(u8 *wps_ie, uint wps_ielen, u16 target_attr_id ,u8 *buf_attr, u32 *len_attr)
+{
+	u8 *attr_ptr = NULL;
+	u8 * target_attr_ptr = NULL;
+	u8 wps_oui[4]={0x00,0x50,0xF2,0x04};
+
+	if(len_attr)
+		*len_attr = 0;
+
+	if ( ( wps_ie[0] != _VENDOR_SPECIFIC_IE_ ) ||
+		( _rtw_memcmp( wps_ie + 2, wps_oui , 4 ) != _TRUE ) )
+	{
+		return attr_ptr;
+	}
+
+	// 6 = 1(Element ID) + 1(Length) + 4(WPS OUI)
+	attr_ptr = wps_ie + 6; //goto first attr
+
+	while(attr_ptr - wps_ie < wps_ielen)
+	{
+		// 4 = 2(Attribute ID) + 2(Length)
+		u16 attr_id = RTW_GET_BE16(attr_ptr);
+		u16 attr_data_len = RTW_GET_BE16(attr_ptr + 2);
+		u16 attr_len = attr_data_len + 4;
+
+		//DBG_871X("%s attr_ptr:%p, id:%u, length:%u\n", __FUNCTION__, attr_ptr, attr_id, attr_data_len);
+		if( attr_id == target_attr_id )
+		{
+			target_attr_ptr = attr_ptr;
+
+			if(buf_attr)
+				_rtw_memcpy(buf_attr, attr_ptr, attr_len);
+
+			if(len_attr)
+				*len_attr = attr_len;
+
+			break;
+		}
+		else
+		{
+			attr_ptr += attr_len; //goto next
+		}
+
+	}
+
+	return target_attr_ptr;
+}
+
+/**
+ * rtw_get_wps_attr_content - Search a specific WPS attribute content from a given WPS IE
+ * @wps_ie: Address of WPS IE to search
+ * @wps_ielen: Length limit from wps_ie
+ * @target_attr_id: The attribute ID of WPS attribute to search
+ * @buf_content: If not NULL and the WPS attribute is found, WPS attribute content will be copied to the buf starting from buf_content
+ * @len_content: If not NULL and the WPS attribute is found, will set to the length of the WPS attribute content
+ *
+ * Returns: the address of the specific WPS attribute content found, or NULL
+ */
+u8 *rtw_get_wps_attr_content(u8 *wps_ie, uint wps_ielen, u16 target_attr_id ,u8 *buf_content, uint *len_content)
+{
+	u8 *attr_ptr;
+	u32 attr_len;
+
+	if(len_content)
+		*len_content = 0;
+
+	attr_ptr = rtw_get_wps_attr(wps_ie, wps_ielen, target_attr_id, NULL, &attr_len);
+
+	if(attr_ptr && attr_len)
+	{
+		if(buf_content)
+			_rtw_memcpy(buf_content, attr_ptr+4, attr_len-4);
+
+		if(len_content)
+			*len_content = attr_len-4;
+
+		return attr_ptr+4;
+	}
+
+	return NULL;
+}
+
+static int rtw_ieee802_11_parse_vendor_specific(u8 *pos, uint elen,
+					    struct rtw_ieee802_11_elems *elems,
+					    int show_errors)
+{
+	unsigned int oui;
+
+	/* first 3 bytes in vendor specific information element are the IEEE
+	 * OUI of the vendor. The following byte is used a vendor specific
+	 * sub-type. */
+	if (elen < 4) {
+		if (show_errors) {
+			DBG_871X("short vendor specific "
+				   "information element ignored (len=%lu)\n",
+				   (unsigned long) elen);
+		}
+		return -1;
+	}
+
+	oui = RTW_GET_BE24(pos);
+	switch (oui) {
+	case OUI_MICROSOFT:
+		/* Microsoft/Wi-Fi information elements are further typed and
+		 * subtyped */
+		switch (pos[3]) {
+		case 1:
+			/* Microsoft OUI (00:50:F2) with OUI Type 1:
+			 * real WPA information element */
+			elems->wpa_ie = pos;
+			elems->wpa_ie_len = elen;
+			break;
+		case WME_OUI_TYPE: /* this is a Wi-Fi WME info. element */
+			if (elen < 5) {
+				DBG_871X("short WME "
+					   "information element ignored "
+					   "(len=%lu)\n",
+					   (unsigned long) elen);
+				return -1;
+			}
+			switch (pos[4]) {
+			case WME_OUI_SUBTYPE_INFORMATION_ELEMENT:
+			case WME_OUI_SUBTYPE_PARAMETER_ELEMENT:
+				elems->wme = pos;
+				elems->wme_len = elen;
+				break;
+			case WME_OUI_SUBTYPE_TSPEC_ELEMENT:
+				elems->wme_tspec = pos;
+				elems->wme_tspec_len = elen;
+				break;
+			default:
+				DBG_871X("unknown WME "
+					   "information element ignored "
+					   "(subtype=%d len=%lu)\n",
+					   pos[4], (unsigned long) elen);
+				return -1;
+			}
+			break;
+		case 4:
+			/* Wi-Fi Protected Setup (WPS) IE */
+			elems->wps_ie = pos;
+			elems->wps_ie_len = elen;
+			break;
+		default:
+			DBG_871X("Unknown Microsoft "
+				   "information element ignored "
+				   "(type=%d len=%lu)\n",
+				   pos[3], (unsigned long) elen);
+			return -1;
+		}
+		break;
+
+	case OUI_BROADCOM:
+		switch (pos[3]) {
+		case VENDOR_HT_CAPAB_OUI_TYPE:
+			elems->vendor_ht_cap = pos;
+			elems->vendor_ht_cap_len = elen;
+			break;
+		default:
+			DBG_871X("Unknown Broadcom "
+				   "information element ignored "
+				   "(type=%d len=%lu)\n",
+				   pos[3], (unsigned long) elen);
+			return -1;
+		}
+		break;
+
+	default:
+		DBG_871X("unknown vendor specific information "
+			   "element ignored (vendor OUI %02x:%02x:%02x "
+			   "len=%lu)\n",
+			   pos[0], pos[1], pos[2], (unsigned long) elen);
+		return -1;
+	}
+
+	return 0;
+
+}
+
+/**
+ * ieee802_11_parse_elems - Parse information elements in management frames
+ * @start: Pointer to the start of IEs
+ * @len: Length of IE buffer in octets
+ * @elems: Data structure for parsed elements
+ * @show_errors: Whether to show parsing errors in debug log
+ * Returns: Parsing result
+ */
+ParseRes rtw_ieee802_11_parse_elems(u8 *start, uint len,
+				struct rtw_ieee802_11_elems *elems,
+				int show_errors)
+{
+	uint left = len;
+	u8 *pos = start;
+	int unknown = 0;
+
+	_rtw_memset(elems, 0, sizeof(*elems));
+
+	while (left >= 2) {
+		u8 id, elen;
+
+		id = *pos++;
+		elen = *pos++;
+		left -= 2;
+
+		if (elen > left) {
+			if (show_errors) {
+				DBG_871X("IEEE 802.11 element "
+					   "parse failed (id=%d elen=%d "
+					   "left=%lu)\n",
+					   id, elen, (unsigned long) left);
+			}
+			return ParseFailed;
+		}
+
+		switch (id) {
+		case WLAN_EID_SSID:
+			elems->ssid = pos;
+			elems->ssid_len = elen;
+			break;
+		case WLAN_EID_SUPP_RATES:
+			elems->supp_rates = pos;
+			elems->supp_rates_len = elen;
+			break;
+		case WLAN_EID_FH_PARAMS:
+			elems->fh_params = pos;
+			elems->fh_params_len = elen;
+			break;
+		case WLAN_EID_DS_PARAMS:
+			elems->ds_params = pos;
+			elems->ds_params_len = elen;
+			break;
+		case WLAN_EID_CF_PARAMS:
+			elems->cf_params = pos;
+			elems->cf_params_len = elen;
+			break;
+		case WLAN_EID_TIM:
+			elems->tim = pos;
+			elems->tim_len = elen;
+			break;
+		case WLAN_EID_IBSS_PARAMS:
+			elems->ibss_params = pos;
+			elems->ibss_params_len = elen;
+			break;
+		case WLAN_EID_CHALLENGE:
+			elems->challenge = pos;
+			elems->challenge_len = elen;
+			break;
+		case WLAN_EID_ERP_INFO:
+			elems->erp_info = pos;
+			elems->erp_info_len = elen;
+			break;
+		case WLAN_EID_EXT_SUPP_RATES:
+			elems->ext_supp_rates = pos;
+			elems->ext_supp_rates_len = elen;
+			break;
+		case WLAN_EID_VENDOR_SPECIFIC:
+			if (rtw_ieee802_11_parse_vendor_specific(pos, elen,
+							     elems,
+							     show_errors))
+				unknown++;
+			break;
+		case WLAN_EID_RSN:
+			elems->rsn_ie = pos;
+			elems->rsn_ie_len = elen;
+			break;
+		case WLAN_EID_PWR_CAPABILITY:
+			elems->power_cap = pos;
+			elems->power_cap_len = elen;
+			break;
+		case WLAN_EID_SUPPORTED_CHANNELS:
+			elems->supp_channels = pos;
+			elems->supp_channels_len = elen;
+			break;
+		case WLAN_EID_MOBILITY_DOMAIN:
+			elems->mdie = pos;
+			elems->mdie_len = elen;
+			break;
+		case WLAN_EID_FAST_BSS_TRANSITION:
+			elems->ftie = pos;
+			elems->ftie_len = elen;
+			break;
+		case WLAN_EID_TIMEOUT_INTERVAL:
+			elems->timeout_int = pos;
+			elems->timeout_int_len = elen;
+			break;
+		case WLAN_EID_HT_CAP:
+			elems->ht_capabilities = pos;
+			elems->ht_capabilities_len = elen;
+			break;
+		case WLAN_EID_HT_OPERATION:
+			elems->ht_operation = pos;
+			elems->ht_operation_len = elen;
+			break;
+		default:
+			unknown++;
+			if (!show_errors)
+				break;
+			DBG_871X("IEEE 802.11 element parse "
+				   "ignored unknown element (id=%d elen=%d)\n",
+				   id, elen);
+			break;
+		}
+
+		left -= elen;
+		pos += elen;
+	}
+
+	if (left)
+		return ParseFailed;
+
+	return unknown ? ParseUnknown : ParseOK;
+
+}
+
+static u8 key_char2num(u8 ch);
+static u8 key_char2num(u8 ch)
+{
+    if((ch>='0')&&(ch<='9'))
+        return ch - '0';
+    else if ((ch>='a')&&(ch<='f'))
+        return ch - 'a' + 10;
+    else if ((ch>='A')&&(ch<='F'))
+        return ch - 'A' + 10;
+    else
+	 return 0xff;
+}
+
+u8 str_2char2num(u8 hch, u8 lch);
+u8 str_2char2num(u8 hch, u8 lch)
+{
+    return ((key_char2num(hch) * 10 ) + key_char2num(lch));
+}
+
+u8 key_2char2num(u8 hch, u8 lch);
+u8 key_2char2num(u8 hch, u8 lch)
+{
+    return ((key_char2num(hch) << 4) | key_char2num(lch));
+}
+
+u8 convert_ip_addr(u8 hch, u8 mch, u8 lch)
+{
+    return ((key_char2num(hch) * 100) + (key_char2num(mch) * 10 ) + key_char2num(lch));
+}
+
+extern char* rtw_initmac;
+void rtw_macaddr_cfg(u8 *mac_addr)
+{
+	u8 mac[ETH_ALEN];
+	if(mac_addr == NULL)	return;
+
+	if ( rtw_initmac )
+	{	//	Users specify the mac address
+		int jj,kk;
+
+		for( jj = 0, kk = 0; jj < ETH_ALEN; jj++, kk += 3 )
+		{
+			mac[jj] = key_2char2num(rtw_initmac[kk], rtw_initmac[kk+ 1]);
+		}
+		_rtw_memcpy(mac_addr, mac, ETH_ALEN);
+	}
+	else
+	{	//	Use the mac address stored in the Efuse
+		_rtw_memcpy(mac, mac_addr, ETH_ALEN);
+	}
+
+	if (((mac[0]==0xff) &&(mac[1]==0xff) && (mac[2]==0xff) &&
+	     (mac[3]==0xff) && (mac[4]==0xff) &&(mac[5]==0xff)) ||
+	    ((mac[0]==0x0) && (mac[1]==0x0) && (mac[2]==0x0) &&
+	     (mac[3]==0x0) && (mac[4]==0x0) &&(mac[5]==0x0)))
+	{
+		mac[0] = 0x00;
+		mac[1] = 0xe0;
+		mac[2] = 0x4c;
+		mac[3] = 0x87;
+		mac[4] = 0x00;
+		mac[5] = 0x00;
+		// use default mac addresss
+		_rtw_memcpy(mac_addr, mac, ETH_ALEN);
+		DBG_871X("MAC Address from efuse error, assign default one !!!\n");
+	}
+
+	DBG_871X("rtw_macaddr_cfg MAC Address  = "MAC_FMT"\n", MAC_ARG(mac_addr));
+}
+
+void dump_ies(u8 *buf, u32 buf_len) {
+	u8* pos = (u8*)buf;
+	u8 id, len;
+
+	while(pos-buf<=buf_len){
+		id = *pos;
+		len = *(pos+1);
+
+		DBG_871X("%s ID:%u, LEN:%u\n", __FUNCTION__, id, len);
+		#ifdef CONFIG_P2P
+		dump_p2p_ie(pos, len);
+		#endif
+		dump_wps_ie(pos, len);
+
+		pos+=(2+len);
+	}
+}
+
+void dump_wps_ie(u8 *ie, u32 ie_len) {
+	u8* pos = (u8*)ie;
+	u16 id;
+	u16 len;
+
+	u8 *wps_ie;
+	uint wps_ielen;
+
+	wps_ie = rtw_get_wps_ie(ie, ie_len, NULL, &wps_ielen);
+	if(wps_ie != ie || wps_ielen == 0)
+		return;
+
+	pos+=6;
+	while(pos-ie < ie_len){
+		id = RTW_GET_BE16(pos);
+		len = RTW_GET_BE16(pos + 2);
+
+		DBG_871X("%s ID:0x%04x, LEN:%u\n", __FUNCTION__, id, len);
+
+		pos+=(4+len);
+	}
+}
+
+#ifdef CONFIG_P2P
+/**
+ * rtw_get_p2p_merged_len - Get merged ie length from muitiple p2p ies.
+ * @in_ie: Pointer of the first p2p ie
+ * @in_len: Total len of muiltiple p2p ies
+ * Returns: Length of merged p2p ie length
+ */
+u32 rtw_get_p2p_merged_ies_len(u8 *in_ie, u32 in_len)
+{
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8 OUI[4] = { 0x50, 0x6f, 0x9a, 0x09 };
+	int i=0;
+	int j=0, len=0;
+
+	while( i < in_len)
+	{
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(in_ie+ i);
+
+		if( pIE->ElementID == _VENDOR_SPECIFIC_IE_ && _rtw_memcmp(pIE->data, OUI, 4) )
+		{
+			len += pIE->Length-4; // 4 is P2P OUI length, don't count it in this loop
+		}
+
+		i += (pIE->Length + 2);
+	}
+
+	return len + 4;	// Append P2P OUI length at last.
+}
+
+/**
+ * rtw_p2p_merge_ies - Merge muitiple p2p ies into one
+ * @in_ie: Pointer of the first p2p ie
+ * @in_len: Total len of muiltiple p2p ies
+ * @merge_ie: Pointer of merged ie
+ * Returns: Length of merged p2p ie
+ */
+int rtw_p2p_merge_ies(u8 *in_ie, u32 in_len, u8 *merge_ie)
+{
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8 len = 0;
+	u8 OUI[4] = { 0x50, 0x6f, 0x9a, 0x09 };
+	u8 ELOUI[6] = { 0xDD, 0x00, 0x50, 0x6f, 0x9a, 0x09 };	//EID;Len;OUI, Len would copy at the end of function
+	int i=0;
+
+	if( merge_ie != NULL)
+	{
+		//Set first P2P OUI
+		_rtw_memcpy(merge_ie, ELOUI, 6);
+		merge_ie += 6;
+
+		while( i < in_len)
+		{
+			pIE = (PNDIS_802_11_VARIABLE_IEs)(in_ie+ i);
+
+			// Take out the rest of P2P OUIs
+			if( pIE->ElementID == _VENDOR_SPECIFIC_IE_ && _rtw_memcmp(pIE->data, OUI, 4) )
+			{
+				_rtw_memcpy( merge_ie, pIE->data +4, pIE->Length -4);
+				len += pIE->Length-4;
+				merge_ie += pIE->Length-4;
+			}
+
+			i += (pIE->Length + 2);
+		}
+
+		return len + 4;	// 4 is for P2P OUI
+
+	}
+
+	return 0;
+}
+
+void dump_p2p_ie(u8 *ie, u32 ie_len) {
+	u8* pos = (u8*)ie;
+	u8 id;
+	u16 len;
+
+	u8 *p2p_ie;
+	uint p2p_ielen;
+
+	p2p_ie = rtw_get_p2p_ie(ie, ie_len, NULL, &p2p_ielen);
+	if(p2p_ie != ie || p2p_ielen == 0)
+		return;
+
+	pos+=6;
+	while(pos-ie < ie_len){
+		id = *pos;
+		len = RTW_GET_LE16(pos+1);
+
+		DBG_871X("%s ID:%u, LEN:%u\n", __FUNCTION__, id, len);
+
+		pos+=(3+len);
+	}
+}
+
+/**
+ * rtw_get_p2p_ie - Search P2P IE from a series of IEs
+ * @in_ie: Address of IEs to search
+ * @in_len: Length limit from in_ie
+ * @p2p_ie: If not NULL and P2P IE is found, P2P IE will be copied to the buf starting from p2p_ie
+ * @p2p_ielen: If not NULL and P2P IE is found, will set to the length of the entire P2P IE
+ *
+ * Returns: The address of the P2P IE found, or NULL
+ */
+u8 *rtw_get_p2p_ie(u8 *in_ie, int in_len, u8 *p2p_ie, uint *p2p_ielen)
+{
+	uint cnt = 0;
+	u8 *p2p_ie_ptr;
+	u8 eid, p2p_oui[4]={0x50,0x6F,0x9A,0x09};
+
+	if ( p2p_ielen != NULL )
+		*p2p_ielen = 0;
+
+	while(cnt<in_len)
+	{
+		eid = in_ie[cnt];
+		if ((in_len < 0) || (cnt > MAX_IE_SZ)) {
+#ifdef PLATFORM_LINUX
+			dump_stack();
+#endif
+			return NULL;
+		}
+		if( ( eid == _VENDOR_SPECIFIC_IE_ ) && ( _rtw_memcmp( &in_ie[cnt+2], p2p_oui, 4) == _TRUE ) )
+		{
+			p2p_ie_ptr = in_ie + cnt;
+
+			if ( p2p_ie != NULL )
+			{
+				_rtw_memcpy( p2p_ie, &in_ie[ cnt ], in_ie[ cnt + 1 ] + 2 );
+			}
+
+			if ( p2p_ielen != NULL )
+			{
+				*p2p_ielen = in_ie[ cnt + 1 ] + 2;
+			}
+
+			return p2p_ie_ptr;
+
+			break;
+		}
+		else
+		{
+			cnt += in_ie[ cnt + 1 ] +2; //goto next
+		}
+
+	}
+
+	return NULL;
+
+}
+
+/**
+ * rtw_get_p2p_attr - Search a specific P2P attribute from a given P2P IE
+ * @p2p_ie: Address of P2P IE to search
+ * @p2p_ielen: Length limit from p2p_ie
+ * @target_attr_id: The attribute ID of P2P attribute to search
+ * @buf_attr: If not NULL and the P2P attribute is found, P2P attribute will be copied to the buf starting from buf_attr
+ * @len_attr: If not NULL and the P2P attribute is found, will set to the length of the entire P2P attribute
+ *
+ * Returns: the address of the specific WPS attribute found, or NULL
+ */
+u8 *rtw_get_p2p_attr(u8 *p2p_ie, uint p2p_ielen, u8 target_attr_id ,u8 *buf_attr, u32 *len_attr)
+{
+	u8 *attr_ptr = NULL;
+	u8 *target_attr_ptr = NULL;
+	u8 p2p_oui[4]={0x50,0x6F,0x9A,0x09};
+
+	if(len_attr)
+		*len_attr = 0;
+
+	if ( !p2p_ie || ( p2p_ie[0] != _VENDOR_SPECIFIC_IE_ ) ||
+		( _rtw_memcmp( p2p_ie + 2, p2p_oui , 4 ) != _TRUE ) )
+	{
+		return attr_ptr;
+	}
+
+	// 6 = 1(Element ID) + 1(Length) + 3 (OUI) + 1(OUI Type)
+	attr_ptr = p2p_ie + 6; //goto first attr
+
+	while(attr_ptr - p2p_ie < p2p_ielen)
+	{
+		// 3 = 1(Attribute ID) + 2(Length)
+		u8 attr_id = *attr_ptr;
+		u16 attr_data_len = RTW_GET_LE16(attr_ptr + 1);
+		u16 attr_len = attr_data_len + 3;
+
+		//DBG_871X("%s attr_ptr:%p, id:%u, length:%u\n", __FUNCTION__, attr_ptr, attr_id, attr_data_len);
+		if( attr_id == target_attr_id )
+		{
+			target_attr_ptr = attr_ptr;
+
+			if(buf_attr)
+				_rtw_memcpy(buf_attr, attr_ptr, attr_len);
+
+			if(len_attr)
+				*len_attr = attr_len;
+
+			break;
+		}
+		else
+		{
+			attr_ptr += attr_len; //goto next
+		}
+
+	}
+
+	return target_attr_ptr;
+}
+
+/**
+ * rtw_get_p2p_attr_content - Search a specific P2P attribute content from a given P2P IE
+ * @p2p_ie: Address of P2P IE to search
+ * @p2p_ielen: Length limit from p2p_ie
+ * @target_attr_id: The attribute ID of P2P attribute to search
+ * @buf_content: If not NULL and the P2P attribute is found, P2P attribute content will be copied to the buf starting from buf_content
+ * @len_content: If not NULL and the P2P attribute is found, will set to the length of the P2P attribute content
+ *
+ * Returns: the address of the specific P2P attribute content found, or NULL
+ */
+u8 *rtw_get_p2p_attr_content(u8 *p2p_ie, uint p2p_ielen, u8 target_attr_id ,u8 *buf_content, uint *len_content)
+{
+	u8 *attr_ptr;
+	u32 attr_len;
+
+	if(len_content)
+		*len_content = 0;
+
+	attr_ptr = rtw_get_p2p_attr(p2p_ie, p2p_ielen, target_attr_id, NULL, &attr_len);
+
+	if(attr_ptr && attr_len)
+	{
+		if(buf_content)
+			_rtw_memcpy(buf_content, attr_ptr+3, attr_len-3);
+
+		if(len_content)
+			*len_content = attr_len-3;
+
+		return attr_ptr+3;
+	}
+
+	return NULL;
+}
+
+u32 rtw_set_p2p_attr_content(u8 *pbuf, u8 attr_id, u16 attr_len, u8 *pdata_attr)
+{
+	u32 a_len;
+
+	*pbuf = attr_id;
+
+	//*(u16*)(pbuf + 1) = cpu_to_le16(attr_len);
+	RTW_PUT_LE16(pbuf + 1, attr_len);
+
+	if(pdata_attr)
+		_rtw_memcpy(pbuf + 3, pdata_attr, attr_len);
+
+	a_len = attr_len + 3;
+
+	return a_len;
+}
+
+static uint rtw_p2p_attr_remove(u8 *ie, uint ielen_ori, u8 attr_id)
+{
+	u8 *target_attr;
+	u32 target_attr_len;
+	uint ielen = ielen_ori;
+	int index=0;
+
+	while(1) {
+		target_attr=rtw_get_p2p_attr(ie, ielen, attr_id, NULL, &target_attr_len);
+		if(target_attr && target_attr_len)
+		{
+			u8 *next_attr = target_attr+target_attr_len;
+			uint remain_len = ielen-(next_attr-ie);
+			//dump_ies(ie, ielen);
+			#if 0
+			DBG_871X("[%d] ie:%p, ielen:%u\n"
+				"target_attr:%p, target_attr_len:%u\n"
+				"next_attr:%p, remain_len:%u\n"
+				, index++
+				, ie, ielen
+				, target_attr, target_attr_len
+				, next_attr, remain_len
+			);
+			#endif
+
+			_rtw_memset(target_attr, 0, target_attr_len);
+			_rtw_memcpy(target_attr, next_attr, remain_len);
+			_rtw_memset(target_attr+remain_len, 0, target_attr_len);
+			*(ie+1) -= target_attr_len;
+			ielen-=target_attr_len;
+		}
+		else
+		{
+			//if(index>0)
+			//	dump_ies(ie, ielen);
+			break;
+		}
+	}
+
+	return ielen;
+}
+
+void rtw_WLAN_BSSID_EX_remove_p2p_attr(WLAN_BSSID_EX *bss_ex, u8 attr_id)
+{
+	u8 *p2p_ie;
+	uint p2p_ielen, p2p_ielen_ori;
+	int cnt;
+
+	if( (p2p_ie=rtw_get_p2p_ie(bss_ex->IEs+_FIXED_IE_LENGTH_, bss_ex->IELength-_FIXED_IE_LENGTH_, NULL, &p2p_ielen_ori)) )
+	{
+		#if 0
+		if(rtw_get_p2p_attr(p2p_ie, p2p_ielen_ori, attr_id, NULL, NULL)) {
+			DBG_871X("rtw_get_p2p_attr: GOT P2P_ATTR:%u!!!!!!!!\n", attr_id);
+			dump_ies(bss_ex->IEs+_FIXED_IE_LENGTH_, bss_ex->IELength-_FIXED_IE_LENGTH_);
+		}
+		#endif
+
+		p2p_ielen=rtw_p2p_attr_remove(p2p_ie, p2p_ielen_ori, attr_id);
+		if(p2p_ielen != p2p_ielen_ori) {
+
+			u8 *next_ie_ori = p2p_ie+p2p_ielen_ori;
+			u8 *next_ie = p2p_ie+p2p_ielen;
+			uint remain_len = bss_ex->IELength-(next_ie_ori-bss_ex->IEs);
+
+			_rtw_memcpy(next_ie, next_ie_ori, remain_len);
+			_rtw_memset(next_ie+remain_len, 0, p2p_ielen_ori-p2p_ielen);
+			bss_ex->IELength -= p2p_ielen_ori-p2p_ielen;
+
+			#if 0
+			DBG_871X("remove P2P_ATTR:%u!\n", attr_id);
+			dump_ies(bss_ex->IEs+_FIXED_IE_LENGTH_, bss_ex->IELength-_FIXED_IE_LENGTH_);
+			#endif
+		}
+	}
+}
+
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_WFD
+int rtw_get_wfd_ie(u8 *in_ie, int in_len, u8 *wfd_ie, uint *wfd_ielen)
+{
+	int match;
+	uint cnt = 0;
+	u8 eid, wfd_oui[4]={0x50,0x6F,0x9A,0x0A};
+
+
+	match=_FALSE;
+
+	if ( in_len < 0 )
+	{
+		return match;
+	}
+
+	while(cnt<in_len)
+	{
+		eid = in_ie[cnt];
+
+		if( ( eid == _VENDOR_SPECIFIC_IE_ ) && ( _rtw_memcmp( &in_ie[cnt+2], wfd_oui, 4) == _TRUE ) )
+		{
+			if ( wfd_ie != NULL )
+			{
+				_rtw_memcpy( wfd_ie, &in_ie[ cnt ], in_ie[ cnt + 1 ] + 2 );
+
+			}
+			else
+			{
+				if ( wfd_ielen != NULL )
+				{
+					*wfd_ielen = 0;
+				}
+			}
+
+			if ( wfd_ielen != NULL )
+			{
+				*wfd_ielen = in_ie[ cnt + 1 ] + 2;
+			}
+
+			cnt += in_ie[ cnt + 1 ] + 2;
+
+			match = _TRUE;
+			break;
+		}
+		else
+		{
+			cnt += in_ie[ cnt + 1 ] +2; //goto next
+		}
+
+	}
+
+	if ( match == _TRUE )
+	{
+		match = cnt;
+	}
+
+	return match;
+
+}
+
+//	attr_content: The output buffer, contains the "body field" of WFD attribute.
+//	attr_contentlen: The data length of the "body field" of WFD attribute.
+int rtw_get_wfd_attr_content(u8 *wfd_ie, uint wfd_ielen, u8 target_attr_id ,u8 *attr_content, uint *attr_contentlen)
+{
+	int match;
+	uint cnt = 0;
+	u8 attr_id, wfd_oui[4]={0x50,0x6F,0x9A,0x0A};
+
+
+	match=_FALSE;
+
+	if ( ( wfd_ie[ 0 ] != _VENDOR_SPECIFIC_IE_ ) ||
+		( _rtw_memcmp( wfd_ie + 2, wfd_oui , 4 ) != _TRUE ) )
+	{
+		return( match );
+	}
+
+	//	1 ( WFD IE ) + 1 ( Length ) + 3 ( OUI ) + 1 ( OUI Type )
+	cnt = 6;
+	while( cnt < wfd_ielen )
+	{
+		u16 attrlen = RTW_GET_BE16(wfd_ie + cnt + 1);
+
+		attr_id = wfd_ie[cnt];
+		if( attr_id == target_attr_id )
+		{
+			//	3 -> 1 byte for attribute ID field, 2 bytes for length field
+			if(attr_content)
+				_rtw_memcpy( attr_content, &wfd_ie[ cnt + 3 ], attrlen );
+
+			if(attr_contentlen)
+				*attr_contentlen = attrlen;
+
+			cnt += attrlen + 3;
+
+			match = _TRUE;
+			break;
+		}
+		else
+		{
+			cnt += attrlen + 3; //goto next
+		}
+
+	}
+
+	return match;
+
+}
+#endif // CONFIG_WFD
+
+//Baron adds to avoid FreeBSD warning
+int ieee80211_is_empty_essid(const char *essid, int essid_len)
+{
+	/* Single white space is for Linksys APs */
+	if (essid_len == 1 && essid[0] == ' ')
+		return 1;
+
+	/* Otherwise, if the entire essid is 0, we assume it is hidden */
+	while (essid_len) {
+		essid_len--;
+		if (essid[essid_len] != '\0')
+			return 0;
+	}
+
+	return 1;
+}
+
+int ieee80211_get_hdrlen(u16 fc)
+{
+	int hdrlen = 24;
+
+	switch (WLAN_FC_GET_TYPE(fc)) {
+	case RTW_IEEE80211_FTYPE_DATA:
+		if (fc & RTW_IEEE80211_STYPE_QOS_DATA)
+			hdrlen += 2;
+		if ((fc & RTW_IEEE80211_FCTL_FROMDS) && (fc & RTW_IEEE80211_FCTL_TODS))
+			hdrlen += 6; /* Addr4 */
+		break;
+	case RTW_IEEE80211_FTYPE_CTL:
+		switch (WLAN_FC_GET_STYPE(fc)) {
+		case RTW_IEEE80211_STYPE_CTS:
+		case RTW_IEEE80211_STYPE_ACK:
+			hdrlen = 10;
+			break;
+		default:
+			hdrlen = 16;
+			break;
+		}
+		break;
+	}
+
+	return hdrlen;
+}
+
+//show MCS rate, unit: 100Kbps
+u16 rtw_mcs_rate(u8 rf_type, u8 bw_40MHz, u8 short_GI_20, u8 short_GI_40, unsigned char * MCS_rate)
+{
+	u16 max_rate = 0;
+
+	if(rf_type == RF_1T1R)
+	{
+		if(MCS_rate[0] & BIT(7))
+			max_rate = (bw_40MHz) ? ((short_GI_40)?1500:1350):((short_GI_20)?722:650);
+		else if(MCS_rate[0] & BIT(6))
+			max_rate = (bw_40MHz) ? ((short_GI_40)?1350:1215):((short_GI_20)?650:585);
+		else if(MCS_rate[0] & BIT(5))
+			max_rate = (bw_40MHz) ? ((short_GI_40)?1200:1080):((short_GI_20)?578:520);
+		else if(MCS_rate[0] & BIT(4))
+			max_rate = (bw_40MHz) ? ((short_GI_40)?900:810):((short_GI_20)?433:390);
+		else if(MCS_rate[0] & BIT(3))
+			max_rate = (bw_40MHz) ? ((short_GI_40)?600:540):((short_GI_20)?289:260);
+		else if(MCS_rate[0] & BIT(2))
+			max_rate = (bw_40MHz) ? ((short_GI_40)?450:405):((short_GI_20)?217:195);
+		else if(MCS_rate[0] & BIT(1))
+			max_rate = (bw_40MHz) ? ((short_GI_40)?300:270):((short_GI_20)?144:130);
+		else if(MCS_rate[0] & BIT(0))
+			max_rate = (bw_40MHz) ? ((short_GI_40)?150:135):((short_GI_20)?72:65);
+	}
+	else
+	{
+		if(MCS_rate[1])
+		{
+			if(MCS_rate[1] & BIT(7))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?3000:2700):((short_GI_20)?1444:1300);
+			else if(MCS_rate[1] & BIT(6))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?2700:2430):((short_GI_20)?1300:1170);
+			else if(MCS_rate[1] & BIT(5))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?2400:2160):((short_GI_20)?1156:1040);
+			else if(MCS_rate[1] & BIT(4))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?1800:1620):((short_GI_20)?867:780);
+			else if(MCS_rate[1] & BIT(3))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?1200:1080):((short_GI_20)?578:520);
+			else if(MCS_rate[1] & BIT(2))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?900:810):((short_GI_20)?433:390);
+			else if(MCS_rate[1] & BIT(1))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?600:540):((short_GI_20)?289:260);
+			else if(MCS_rate[1] & BIT(0))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?300:270):((short_GI_20)?144:130);
+		}
+		else
+		{
+			if(MCS_rate[0] & BIT(7))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?1500:1350):((short_GI_20)?722:650);
+			else if(MCS_rate[0] & BIT(6))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?1350:1215):((short_GI_20)?650:585);
+			else if(MCS_rate[0] & BIT(5))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?1200:1080):((short_GI_20)?578:520);
+			else if(MCS_rate[0] & BIT(4))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?900:810):((short_GI_20)?433:390);
+			else if(MCS_rate[0] & BIT(3))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?600:540):((short_GI_20)?289:260);
+			else if(MCS_rate[0] & BIT(2))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?450:405):((short_GI_20)?217:195);
+			else if(MCS_rate[0] & BIT(1))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?300:270):((short_GI_20)?144:130);
+			else if(MCS_rate[0] & BIT(0))
+				max_rate = (bw_40MHz) ? ((short_GI_40)?150:135):((short_GI_20)?72:65);
+		}
+	}
+	return max_rate;
+}
+
+int rtw_action_frame_parse(const u8 *frame, u32 frame_len, u8* category, u8 *action)
+{
+	const u8 *frame_body = frame + sizeof(struct rtw_ieee80211_hdr_3addr);
+	u16 fc;
+	u8 c;
+	u8 a = ACT_PUBLIC_MAX;
+
+	fc = le16_to_cpu(((struct rtw_ieee80211_hdr_3addr *)frame)->frame_ctl);
+
+	if ((fc & (RTW_IEEE80211_FCTL_FTYPE|RTW_IEEE80211_FCTL_STYPE))
+		!= (RTW_IEEE80211_FTYPE_MGMT|RTW_IEEE80211_STYPE_ACTION)
+	)
+	{
+		return _FALSE;
+	}
+
+	c = frame_body[0];
+
+	switch(c) {
+	case RTW_WLAN_CATEGORY_P2P: /* vendor-specific */
+		break;
+	default:
+		a = frame_body[1];
+	}
+
+	if (category)
+		*category = c;
+	if (action)
+		*action = a;
+
+	return _TRUE;
+}
+
+static const char *_action_public_str[] = {
+	"ACT_PUB_BSSCOEXIST",
+	"ACT_PUB_DSE_ENABLE",
+	"ACT_PUB_DSE_DEENABLE",
+	"ACT_PUB_DSE_REG_LOCATION",
+	"ACT_PUB_EXT_CHL_SWITCH",
+	"ACT_PUB_DSE_MSR_REQ",
+	"ACT_PUB_DSE_MSR_RPRT",
+	"ACT_PUB_MP",
+	"ACT_PUB_DSE_PWR_CONSTRAINT",
+	"ACT_PUB_VENDOR",
+	"ACT_PUB_GAS_INITIAL_REQ",
+	"ACT_PUB_GAS_INITIAL_RSP",
+	"ACT_PUB_GAS_COMEBACK_REQ",
+	"ACT_PUB_GAS_COMEBACK_RSP",
+	"ACT_PUB_TDLS_DISCOVERY_RSP",
+	"ACT_PUB_LOCATION_TRACK",
+	"ACT_PUB_RSVD",
+};
+
+const char *action_public_str(u8 action)
+{
+	action = (action >= ACT_PUBLIC_MAX) ? ACT_PUBLIC_MAX : action;
+	return _action_public_str[action];
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_io.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_io.c
new file mode 100644
index 000000000000..3e8ee42fe798
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_io.c
@@ -0,0 +1,462 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*
+
+The purpose of rtw_io.c
+
+a. provides the API
+
+b. provides the protocol engine
+
+c. provides the software interface between caller and the hardware interface
+
+
+Compiler Flag Option:
+
+1. CONFIG_SDIO_HCI:
+    a. USE_SYNC_IRP:  Only sync operations are provided.
+    b. USE_ASYNC_IRP:Both sync/async operations are provided.
+
+2. CONFIG_USB_HCI:
+   a. USE_ASYNC_IRP: Both sync/async operations are provided.
+
+3. CONFIG_CFIO_HCI:
+   b. USE_SYNC_IRP: Only sync operations are provided.
+
+
+Only sync read/rtw_write_mem operations are provided.
+
+jackson@realtek.com.tw
+
+*/
+
+#define _RTW_IO_C_
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_io.h>
+#include <osdep_intf.h>
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+#error "Shall be Linux or Windows, but not both!\n"
+#endif
+
+#ifdef CONFIG_SDIO_HCI
+#include <sdio_ops.h>
+#endif
+
+#ifdef CONFIG_USB_HCI
+#include <usb_ops.h>
+#endif
+
+#ifdef CONFIG_PCI_HCI
+#include <pci_ops.h>
+#endif
+
+
+u8 _rtw_read8(_adapter *adapter, u32 addr)
+{
+	u8 r_val;
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	u8 (*_read8)(struct intf_hdl *pintfhdl, u32 addr);
+	_func_enter_;
+	_read8 = pintfhdl->io_ops._read8;
+
+	r_val = _read8(pintfhdl, addr);
+	_func_exit_;
+	return r_val;
+}
+
+u16 _rtw_read16(_adapter *adapter, u32 addr)
+{
+	u16 r_val;
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	u16 	(*_read16)(struct intf_hdl *pintfhdl, u32 addr);
+	_func_enter_;
+	_read16 = pintfhdl->io_ops._read16;
+
+	r_val = _read16(pintfhdl, addr);
+	_func_exit_;
+	return r_val;
+}
+
+u32 _rtw_read32(_adapter *adapter, u32 addr)
+{
+	u32 r_val;
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	u32 	(*_read32)(struct intf_hdl *pintfhdl, u32 addr);
+	_func_enter_;
+	_read32 = pintfhdl->io_ops._read32;
+
+	r_val = _read32(pintfhdl, addr);
+	_func_exit_;
+	return r_val;
+
+}
+
+int _rtw_write8(_adapter *adapter, u32 addr, u8 val)
+{
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	int (*_write8)(struct intf_hdl *pintfhdl, u32 addr, u8 val);
+	int ret;
+	_func_enter_;
+	_write8 = pintfhdl->io_ops._write8;
+
+	ret = _write8(pintfhdl, addr, val);
+	_func_exit_;
+
+	return RTW_STATUS_CODE(ret);
+}
+int _rtw_write16(_adapter *adapter, u32 addr, u16 val)
+{
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	int (*_write16)(struct intf_hdl *pintfhdl, u32 addr, u16 val);
+	int ret;
+	_func_enter_;
+	_write16 = pintfhdl->io_ops._write16;
+
+	ret = _write16(pintfhdl, addr, val);
+	_func_exit_;
+
+	return RTW_STATUS_CODE(ret);
+}
+int _rtw_write32(_adapter *adapter, u32 addr, u32 val)
+{
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	int (*_write32)(struct intf_hdl *pintfhdl, u32 addr, u32 val);
+	int ret;
+	_func_enter_;
+	_write32 = pintfhdl->io_ops._write32;
+
+	ret = _write32(pintfhdl, addr, val);
+	_func_exit_;
+
+	return RTW_STATUS_CODE(ret);
+}
+
+int _rtw_writeN(_adapter *adapter, u32 addr ,u32 length , u8 *pdata)
+{
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+        struct	intf_hdl	*pintfhdl = (struct intf_hdl*)(&(pio_priv->intf));
+	int (*_writeN)(struct intf_hdl *pintfhdl, u32 addr,u32 length, u8 *pdata);
+	int ret;
+	_func_enter_;
+	_writeN = pintfhdl->io_ops._writeN;
+
+	ret = _writeN(pintfhdl, addr,length,pdata);
+	_func_exit_;
+
+	return RTW_STATUS_CODE(ret);
+}
+int _rtw_write8_async(_adapter *adapter, u32 addr, u8 val)
+{
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	int (*_write8_async)(struct intf_hdl *pintfhdl, u32 addr, u8 val);
+	int ret;
+	_func_enter_;
+	_write8_async = pintfhdl->io_ops._write8_async;
+
+	ret = _write8_async(pintfhdl, addr, val);
+	_func_exit_;
+
+	return RTW_STATUS_CODE(ret);
+}
+int _rtw_write16_async(_adapter *adapter, u32 addr, u16 val)
+{
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	int (*_write16_async)(struct intf_hdl *pintfhdl, u32 addr, u16 val);
+	int ret;
+	_func_enter_;
+	_write16_async = pintfhdl->io_ops._write16_async;
+
+	ret = _write16_async(pintfhdl, addr, val);
+	_func_exit_;
+
+	return RTW_STATUS_CODE(ret);
+}
+int _rtw_write32_async(_adapter *adapter, u32 addr, u32 val)
+{
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	int (*_write32_async)(struct intf_hdl *pintfhdl, u32 addr, u32 val);
+	int ret;
+	_func_enter_;
+	_write32_async = pintfhdl->io_ops._write32_async;
+
+	ret = _write32_async(pintfhdl, addr, val);
+	_func_exit_;
+
+	return RTW_STATUS_CODE(ret);
+}
+void _rtw_read_mem(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem)
+{
+	void (*_read_mem)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+
+	_func_enter_;
+
+	if( (adapter->bDriverStopped ==_TRUE) || (adapter->bSurpriseRemoved == _TRUE))
+	{
+	     RT_TRACE(_module_rtl871x_io_c_, _drv_info_, ("rtw_read_mem:bDriverStopped(%d) OR bSurpriseRemoved(%d)", adapter->bDriverStopped, adapter->bSurpriseRemoved));
+	     return;
+	}
+
+	_read_mem = pintfhdl->io_ops._read_mem;
+
+	_read_mem(pintfhdl, addr, cnt, pmem);
+
+	_func_exit_;
+
+}
+
+void _rtw_write_mem(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem)
+{
+	void (*_write_mem)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+
+	_func_enter_;
+
+	_write_mem = pintfhdl->io_ops._write_mem;
+
+	_write_mem(pintfhdl, addr, cnt, pmem);
+
+	_func_exit_;
+
+}
+
+void _rtw_read_port(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem)
+{
+	u32 (*_read_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+
+	_func_enter_;
+
+	if( (adapter->bDriverStopped ==_TRUE) || (adapter->bSurpriseRemoved == _TRUE))
+	{
+	     RT_TRACE(_module_rtl871x_io_c_, _drv_info_, ("rtw_read_port:bDriverStopped(%d) OR bSurpriseRemoved(%d)", adapter->bDriverStopped, adapter->bSurpriseRemoved));
+	     return;
+	}
+
+	_read_port = pintfhdl->io_ops._read_port;
+
+	_read_port(pintfhdl, addr, cnt, pmem);
+
+	_func_exit_;
+
+}
+
+void _rtw_read_port_cancel(_adapter *adapter)
+{
+	void (*_read_port_cancel)(struct intf_hdl *pintfhdl);
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct intf_hdl *pintfhdl = &(pio_priv->intf);
+
+	_read_port_cancel = pintfhdl->io_ops._read_port_cancel;
+
+	if(_read_port_cancel)
+		_read_port_cancel(pintfhdl);
+
+}
+
+u32 _rtw_write_port(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem)
+{
+	u32 (*_write_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+	//struct	io_queue  	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct	intf_hdl		*pintfhdl = &(pio_priv->intf);
+	u32 ret = _SUCCESS;
+
+	_func_enter_;
+
+	_write_port = pintfhdl->io_ops._write_port;
+
+	ret = _write_port(pintfhdl, addr, cnt, pmem);
+
+	 _func_exit_;
+
+	return ret;
+}
+
+u32 _rtw_write_port_and_wait(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem, int timeout_ms)
+{
+	int ret = _SUCCESS;
+	struct xmit_buf *pxmitbuf = (struct xmit_buf *)pmem;
+	struct submit_ctx sctx;
+
+	rtw_sctx_init(&sctx, timeout_ms);
+	pxmitbuf->sctx = &sctx;
+
+	ret = _rtw_write_port(adapter, addr, cnt, pmem);
+
+	if (ret == _SUCCESS)
+		ret = rtw_sctx_wait(&sctx);
+
+	 return ret;
+}
+
+void _rtw_write_port_cancel(_adapter *adapter)
+{
+	void (*_write_port_cancel)(struct intf_hdl *pintfhdl);
+	struct io_priv *pio_priv = &adapter->iopriv;
+	struct intf_hdl *pintfhdl = &(pio_priv->intf);
+
+	_write_port_cancel = pintfhdl->io_ops._write_port_cancel;
+
+	if(_write_port_cancel)
+		_write_port_cancel(pintfhdl);
+
+}
+
+int rtw_init_io_priv(_adapter *padapter, void (*set_intf_ops)(struct _io_ops *pops))
+{
+	struct io_priv	*piopriv = &padapter->iopriv;
+	struct intf_hdl *pintf = &piopriv->intf;
+
+	if (set_intf_ops == NULL)
+		return _FAIL;
+
+	piopriv->padapter = padapter;
+	pintf->padapter = padapter;
+	pintf->pintf_dev = adapter_to_dvobj(padapter);
+
+	set_intf_ops(&pintf->io_ops);
+
+	return _SUCCESS;
+}
+
+#ifdef DBG_IO
+
+u16 read_sniff_ranges[][2] = {
+	//{0x550, 0x551},
+};
+
+u16 write_sniff_ranges[][2] = {
+	//{0x550, 0x551},
+	//{0x4c, 0x4c},
+};
+
+int read_sniff_num = sizeof(read_sniff_ranges)/sizeof(u16)/2;
+int write_sniff_num = sizeof(write_sniff_ranges)/sizeof(u16)/2;
+
+bool match_read_sniff_ranges(u16 addr, u16 len)
+{
+	int i;
+	for (i = 0; i<read_sniff_num; i++) {
+		if (addr + len > read_sniff_ranges[i][0] && addr <= read_sniff_ranges[i][1])
+			return _TRUE;
+	}
+
+	return _FALSE;
+}
+
+bool match_write_sniff_ranges(u16 addr, u16 len)
+{
+	int i;
+	for (i = 0; i<write_sniff_num; i++) {
+		if (addr + len > write_sniff_ranges[i][0] && addr <= write_sniff_ranges[i][1])
+			return _TRUE;
+	}
+
+	return _FALSE;
+}
+
+u8 dbg_rtw_read8(_adapter *adapter, u32 addr, const char *caller, const int line)
+{
+	u8 val = _rtw_read8(adapter, addr);
+
+	if (match_read_sniff_ranges(addr, 1))
+		DBG_871X("DBG_IO %s:%d rtw_read8(0x%04x) return 0x%02x\n", caller, line, addr, val);
+
+	return val;
+}
+
+u16 dbg_rtw_read16(_adapter *adapter, u32 addr, const char *caller, const int line)
+{
+	u16 val = _rtw_read16(adapter, addr);
+
+	if (match_read_sniff_ranges(addr, 2))
+		DBG_871X("DBG_IO %s:%d rtw_read16(0x%04x) return 0x%04x\n", caller, line, addr, val);
+
+	return val;
+}
+
+u32 dbg_rtw_read32(_adapter *adapter, u32 addr, const char *caller, const int line)
+{
+	u32 val = _rtw_read32(adapter, addr);
+
+	if (match_read_sniff_ranges(addr, 4))
+		DBG_871X("DBG_IO %s:%d rtw_read32(0x%04x) return 0x%08x\n", caller, line, addr, val);
+
+	return val;
+}
+
+int dbg_rtw_write8(_adapter *adapter, u32 addr, u8 val, const char *caller, const int line)
+{
+	if (match_write_sniff_ranges(addr, 1))
+		DBG_871X("DBG_IO %s:%d rtw_write8(0x%04x, 0x%02x)\n", caller, line, addr, val);
+
+	return _rtw_write8(adapter, addr, val);
+}
+int dbg_rtw_write16(_adapter *adapter, u32 addr, u16 val, const char *caller, const int line)
+{
+	if (match_write_sniff_ranges(addr, 2))
+		DBG_871X("DBG_IO %s:%d rtw_write16(0x%04x, 0x%04x)\n", caller, line, addr, val);
+
+	return _rtw_write16(adapter, addr, val);
+}
+int dbg_rtw_write32(_adapter *adapter, u32 addr, u32 val, const char *caller, const int line)
+{
+	if (match_write_sniff_ranges(addr, 4))
+		DBG_871X("DBG_IO %s:%d rtw_write32(0x%04x, 0x%08x)\n", caller, line, addr, val);
+
+	return _rtw_write32(adapter, addr, val);
+}
+int dbg_rtw_writeN(_adapter *adapter, u32 addr ,u32 length , u8 *data, const char *caller, const int line)
+{
+	if (match_write_sniff_ranges(addr, length))
+		DBG_871X("DBG_IO %s:%d rtw_writeN(0x%04x, %u)\n", caller, line, addr, length);
+
+	return _rtw_writeN(adapter, addr, length, data);
+}
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_query.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_query.c
new file mode 100644
index 000000000000..a67b08dce3b2
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_query.c
@@ -0,0 +1,195 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_IOCTL_QUERY_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_ioctl_query.h>
+#include <wifi.h>
+
+
+#ifdef PLATFORM_WINDOWS
+//
+// Added for WPA2-PSK, by Annie, 2005-09-20.
+//
+u8
+query_802_11_capability(
+	_adapter*		Adapter,
+	u8*			pucBuf,
+	u32 *		pulOutLen
+)
+{
+	static NDIS_802_11_AUTHENTICATION_ENCRYPTION szAuthEnc[] =
+	{
+		{Ndis802_11AuthModeOpen, Ndis802_11EncryptionDisabled},
+		{Ndis802_11AuthModeOpen, Ndis802_11Encryption1Enabled},
+		{Ndis802_11AuthModeShared, Ndis802_11EncryptionDisabled},
+		{Ndis802_11AuthModeShared, Ndis802_11Encryption1Enabled},
+		{Ndis802_11AuthModeWPA, Ndis802_11Encryption2Enabled},
+		{Ndis802_11AuthModeWPA, Ndis802_11Encryption3Enabled},
+		{Ndis802_11AuthModeWPAPSK, Ndis802_11Encryption2Enabled},
+		{Ndis802_11AuthModeWPAPSK, Ndis802_11Encryption3Enabled},
+		{Ndis802_11AuthModeWPANone, Ndis802_11Encryption2Enabled},
+		{Ndis802_11AuthModeWPANone, Ndis802_11Encryption3Enabled},
+		{Ndis802_11AuthModeWPA2, Ndis802_11Encryption2Enabled},
+		{Ndis802_11AuthModeWPA2, Ndis802_11Encryption3Enabled},
+		{Ndis802_11AuthModeWPA2PSK, Ndis802_11Encryption2Enabled},
+		{Ndis802_11AuthModeWPA2PSK, Ndis802_11Encryption3Enabled}
+	};
+	static ULONG	ulNumOfPairSupported = sizeof(szAuthEnc)/sizeof(NDIS_802_11_AUTHENTICATION_ENCRYPTION);
+	NDIS_802_11_CAPABILITY * pCap = (NDIS_802_11_CAPABILITY *)pucBuf;
+	u8*	pucAuthEncryptionSupported = (u8*) pCap->AuthenticationEncryptionSupported;
+
+
+	pCap->Length = sizeof(NDIS_802_11_CAPABILITY);
+	if(ulNumOfPairSupported > 1 )
+		pCap->Length += 	(ulNumOfPairSupported-1) * sizeof(NDIS_802_11_AUTHENTICATION_ENCRYPTION);
+
+	pCap->Version = 2;
+	pCap->NoOfPMKIDs = NUM_PMKID_CACHE;
+	pCap->NoOfAuthEncryptPairsSupported = ulNumOfPairSupported;
+
+	if( sizeof (szAuthEnc) <= 240 )		// 240 = 256 - 4*4	// SecurityInfo.szCapability: only 256 bytes in size.
+	{
+		_rtw_memcpy( pucAuthEncryptionSupported, (u8*)szAuthEnc,  sizeof (szAuthEnc) );
+		*pulOutLen = pCap->Length;
+		return _TRUE;
+	}
+	else
+	{
+		*pulOutLen = 0;
+		RT_TRACE(_module_rtl871x_ioctl_query_c_,_drv_info_,("_query_802_11_capability(): szAuthEnc size is too large.\n"));
+		return _FALSE;
+	}
+}
+
+u8 query_802_11_association_information(	_adapter *padapter,PNDIS_802_11_ASSOCIATION_INFORMATION	pAssocInfo)
+{
+	struct wlan_network *tgt_network;
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	struct	security_priv  *psecuritypriv=&(padapter->securitypriv);
+	WLAN_BSSID_EX	*psecnetwork=(WLAN_BSSID_EX*)&(psecuritypriv->sec_bss);
+	u8 *	pDest = (u8 *)pAssocInfo + sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
+	unsigned char i,*auth_ie,*supp_ie;
+
+	//NdisZeroMemory(pAssocInfo, sizeof(NDIS_802_11_ASSOCIATION_INFORMATION));
+	_rtw_memset(pAssocInfo, 0, sizeof(NDIS_802_11_ASSOCIATION_INFORMATION));
+	//pAssocInfo->Length = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
+
+	//------------------------------------------------------
+	// Association Request related information
+	//------------------------------------------------------
+	// Req_1. AvailableRequestFixedIEs
+	if(psecnetwork!=NULL){
+
+	pAssocInfo->AvailableRequestFixedIEs |= NDIS_802_11_AI_REQFI_CAPABILITIES|NDIS_802_11_AI_REQFI_CURRENTAPADDRESS;
+	pAssocInfo->RequestFixedIEs.Capabilities = (unsigned short)* & psecnetwork->IEs[10];
+	_rtw_memcpy(pAssocInfo->RequestFixedIEs.CurrentAPAddress,
+		& psecnetwork->MacAddress, 6);
+
+	pAssocInfo->OffsetRequestIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
+
+	if(check_fwstate( pmlmepriv, _FW_UNDER_LINKING|_FW_LINKED)==_TRUE)
+	{
+
+		if(psecuritypriv->ndisauthtype>=Ndis802_11AuthModeWPA2)
+			pDest[0] =48;		//RSN Information Element
+		else
+			pDest[0] =221;	//WPA(SSN) Information Element
+
+		RT_TRACE(_module_rtl871x_ioctl_query_c_,_drv_info_,("\n Adapter->ndisauthtype==Ndis802_11AuthModeWPA)?0xdd:0x30 [%d]",pDest[0]));
+		supp_ie=&psecuritypriv->supplicant_ie[0];
+		for(i=0;i<supp_ie[0];i++)
+		{
+			RT_TRACE(_module_rtl871x_ioctl_query_c_,_drv_info_,("IEs [%d] = 0x%x \n\n", i,supp_ie[i]));
+		}
+
+		i=13;	//0~11 is fixed information element
+		RT_TRACE(_module_rtl871x_ioctl_query_c_,_drv_info_,("i= %d tgt_network->network.IELength=%d\n\n", i,(int)psecnetwork->IELength));
+		while((i<supp_ie[0]) && (i<256)){
+			if((unsigned char)supp_ie[i]==pDest[0]){
+						_rtw_memcpy((u8 *)(pDest),
+							&supp_ie[i],
+							supp_ie[1+i]+2);
+
+				break;
+			}
+
+			i=i+supp_ie[i+1]+2;
+			if(supp_ie[1+i]==0)
+				i=i+1;
+			RT_TRACE(_module_rtl871x_ioctl_query_c_,_drv_info_,("iteration i=%d IEs [%d] = 0x%x \n\n", i,i,supp_ie[i+1]));
+
+		}
+
+
+		pAssocInfo->RequestIELength += (2 + supp_ie[1+i]);// (2 + psecnetwork->IEs[1+i]+4);
+
+	}
+
+
+		RT_TRACE(_module_rtl871x_ioctl_query_c_,_drv_info_,("\n psecnetwork != NULL,fwstate==_FW_UNDER_LINKING \n"));
+
+	}
+
+
+	//------------------------------------------------------
+	// Association Response related information
+	//------------------------------------------------------
+
+	if(check_fwstate( pmlmepriv, _FW_LINKED)==_TRUE)
+	{
+		tgt_network =&(pmlmepriv->cur_network);
+		if(tgt_network!=NULL){
+		pAssocInfo->AvailableResponseFixedIEs =
+				NDIS_802_11_AI_RESFI_CAPABILITIES
+				|NDIS_802_11_AI_RESFI_ASSOCIATIONID
+				;
+
+		pAssocInfo->ResponseFixedIEs.Capabilities =(unsigned short)* & tgt_network->network.IEs[10];
+		pAssocInfo->ResponseFixedIEs.StatusCode = 0;
+		pAssocInfo->ResponseFixedIEs.AssociationId =(unsigned short) tgt_network->aid;
+
+		pDest = (u8 *)pAssocInfo + sizeof(NDIS_802_11_ASSOCIATION_INFORMATION)+pAssocInfo->RequestIELength;
+		auth_ie=&psecuritypriv->authenticator_ie[0];
+
+		for(i=0;i<auth_ie[0];i++)
+			RT_TRACE(_module_rtl871x_ioctl_query_c_,_drv_info_,("IEs [%d] = 0x%x \n\n", i,auth_ie[i]));
+
+		i=auth_ie[0]-12;
+		if(i>0){
+			_rtw_memcpy((u8 *)&pDest[0],&auth_ie[1],i);
+			pAssocInfo->ResponseIELength =i;
+		}
+
+
+		pAssocInfo->OffsetResponseIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION) + pAssocInfo->RequestIELength;
+
+
+		RT_TRACE(_module_rtl871x_ioctl_query_c_,_drv_info_,("\n tgt_network != NULL,fwstate==_FW_LINKED \n"));
+		}
+	}
+	RT_TRACE(_module_rtl871x_ioctl_query_c_,_drv_info_,("\n exit query_802_11_association_information \n"));
+_func_exit_;
+
+	return _TRUE;
+}
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_rtl.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_rtl.c
new file mode 100644
index 000000000000..4e663d7a6809
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_rtl.c
@@ -0,0 +1,1031 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define  _RTW_IOCTL_RTL_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <wlan_bssdef.h>
+#include <wifi.h>
+#include <rtw_ioctl.h>
+#include <rtw_ioctl_set.h>
+#include <rtw_ioctl_query.h>
+#include <rtw_ioctl_rtl.h>
+#include <mp_custom_oid.h>
+#ifdef CONFIG_MP_INCLUDED
+#include <rtw_mp.h>
+#include <rtw_mp_ioctl.h>
+#endif
+
+struct oid_obj_priv oid_rtl_seg_01_01[] =
+{
+	{1, &oid_null_function},										//0x80
+	{1, &oid_null_function},										//0x81
+	{1, &oid_null_function},										//0x82
+	{1, &oid_null_function},										//0x83//OID_RT_SET_SNIFFER_MODE
+	{1, &oid_rt_get_signal_quality_hdl},							//0x84
+	{1, &oid_rt_get_small_packet_crc_hdl},						//0x85
+	{1, &oid_rt_get_middle_packet_crc_hdl},						//0x86
+	{1, &oid_rt_get_large_packet_crc_hdl},						//0x87
+	{1, &oid_rt_get_tx_retry_hdl},								//0x88
+	{1, &oid_rt_get_rx_retry_hdl},								//0x89
+	{1, &oid_rt_pro_set_fw_dig_state_hdl},						//0x8A
+	{1, &oid_rt_pro_set_fw_ra_state_hdl}	,						//0x8B
+	{1, &oid_null_function},										//0x8C
+	{1, &oid_null_function},										//0x8D
+	{1, &oid_null_function},										//0x8E
+	{1, &oid_null_function},										//0x8F
+	{1, &oid_rt_get_rx_total_packet_hdl},							//0x90
+	{1, &oid_rt_get_tx_beacon_ok_hdl},							//0x91
+	{1, &oid_rt_get_tx_beacon_err_hdl},							//0x92
+	{1, &oid_rt_get_rx_icv_err_hdl},								//0x93
+	{1, &oid_rt_set_encryption_algorithm_hdl},					//0x94
+	{1, &oid_null_function},										//0x95
+	{1, &oid_rt_get_preamble_mode_hdl},							//0x96
+	{1, &oid_null_function},										//0x97
+	{1, &oid_rt_get_ap_ip_hdl},									//0x98
+	{1, &oid_rt_get_channelplan_hdl},							//0x99
+	{1, &oid_rt_set_preamble_mode_hdl},	 						//0x9A
+	{1, &oid_rt_set_bcn_intvl_hdl},								//0x9B
+	{1, &oid_null_function},										//0x9C
+	{1, &oid_rt_dedicate_probe_hdl},								//0x9D
+	{1, &oid_null_function},										//0x9E
+	{1, &oid_null_function},										//0x9F
+	{1, &oid_null_function},										//0xA0
+	{1, &oid_null_function},										//0xA1
+	{1, &oid_null_function},										//0xA2
+	{1, &oid_null_function},										//0xA3
+	{1, &oid_null_function},										//0xA4
+	{1, &oid_null_function},										//0xA5
+	{1, &oid_null_function},										//0xA6
+	{1, &oid_rt_get_total_tx_bytes_hdl},							//0xA7
+	{1, &oid_rt_get_total_rx_bytes_hdl},							//0xA8
+	{1, &oid_rt_current_tx_power_level_hdl},						//0xA9
+	{1, &oid_rt_get_enc_key_mismatch_count_hdl},	 			//0xAA
+	{1, &oid_rt_get_enc_key_match_count_hdl},					//0xAB
+	{1, &oid_rt_get_channel_hdl},								//0xAC
+	{1, &oid_rt_set_channelplan_hdl},								//0xAD
+	{1, &oid_rt_get_hardware_radio_off_hdl},						//0xAE
+	{1, &oid_null_function},										//0xAF
+	{1, &oid_null_function},										//0xB0
+	{1, &oid_null_function},										//0xB1
+	{1, &oid_null_function},										//0xB2
+	{1, &oid_null_function},										//0xB3
+	{1, &oid_rt_get_key_mismatch_hdl},							//0xB4
+	{1, &oid_null_function},										//0xB5
+	{1, &oid_null_function},										//0xB6
+	{1, &oid_null_function},										//0xB7
+	{1, &oid_null_function},										//0xB8
+	{1, &oid_null_function},										//0xB9
+	{1, &oid_null_function},	 									//0xBA
+	{1, &oid_rt_supported_wireless_mode_hdl},					//0xBB
+	{1, &oid_rt_get_channel_list_hdl},							//0xBC
+	{1, &oid_rt_get_scan_in_progress_hdl},						//0xBD
+	{1, &oid_null_function},										//0xBE
+	{1, &oid_null_function},										//0xBF
+	{1, &oid_null_function},										//0xC0
+	{1, &oid_rt_forced_data_rate_hdl},							//0xC1
+	{1, &oid_rt_wireless_mode_for_scan_list_hdl},					//0xC2
+	{1, &oid_rt_get_bss_wireless_mode_hdl},						//0xC3
+	{1, &oid_rt_scan_with_magic_packet_hdl},					//0xC4
+	{1, &oid_null_function},										//0xC5
+	{1, &oid_null_function},										//0xC6
+	{1, &oid_null_function},										//0xC7
+	{1, &oid_null_function},										//0xC8
+	{1, &oid_null_function},										//0xC9
+	{1, &oid_null_function},	 									//0xCA
+	{1, &oid_null_function},										//0xCB
+	{1, &oid_null_function},										//0xCC
+	{1, &oid_null_function},										//0xCD
+	{1, &oid_null_function},										//0xCE
+	{1, &oid_null_function},										//0xCF
+
+};
+
+struct oid_obj_priv oid_rtl_seg_01_03[] =
+{
+	{1, &oid_rt_ap_get_associated_station_list_hdl},				//0x00
+	{1, &oid_null_function},										//0x01
+	{1, &oid_rt_ap_switch_into_ap_mode_hdl},					//0x02
+	{1, &oid_null_function},										//0x03
+	{1, &oid_rt_ap_supported_hdl},								//0x04
+	{1, &oid_rt_ap_set_passphrase_hdl},							//0x05
+
+};
+
+struct oid_obj_priv oid_rtl_seg_01_11[] =
+{
+	{1, &oid_null_function},					//0xC0	OID_RT_PRO_RX_FILTER
+	{1, &oid_null_function},					//0xC1	OID_CE_USB_WRITE_REGISTRY
+	{1, &oid_null_function},					//0xC2	OID_CE_USB_READ_REGISTRY
+	{1, &oid_null_function},					//0xC3	OID_RT_PRO_SET_INITIAL_GAIN
+	{1, &oid_null_function},					//0xC4	OID_RT_PRO_SET_BB_RF_STANDBY_MODE
+	{1, &oid_null_function},					//0xC5	OID_RT_PRO_SET_BB_RF_SHUTDOWN_MODE
+	{1, &oid_null_function},					//0xC6	OID_RT_PRO_SET_TX_CHARGE_PUMP
+	{1, &oid_null_function},					//0xC7	OID_RT_PRO_SET_RX_CHARGE_PUMP
+	{1, &oid_rt_pro_rf_write_registry_hdl},	//0xC8
+	{1, &oid_rt_pro_rf_read_registry_hdl},	//0xC9
+	{1, &oid_null_function}					//0xCA	OID_RT_PRO_QUERY_RF_TYPE
+
+};
+
+struct oid_obj_priv oid_rtl_seg_03_00[] =
+{
+	{1, &oid_null_function},										//0x00
+	{1, &oid_rt_get_connect_state_hdl},							//0x01
+	{1, &oid_null_function},										//0x02
+	{1, &oid_null_function},										//0x03
+	{1, &oid_rt_set_default_key_id_hdl},							//0x04
+
+
+};
+
+
+//**************  oid_rtl_seg_01_01 section start **************
+
+NDIS_STATUS oid_rt_pro_set_fw_dig_state_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS		status = NDIS_STATUS_SUCCESS;
+#if 0
+	PADAPTER		Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+	_irqL			oldirql;
+
+	_func_enter_;
+
+	if(poid_par_priv->type_of_oid != SET_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	_irqlevel_changed_(&oldirql,LOWER);
+	if(poid_par_priv->information_buf_len >= sizeof(struct setdig_parm))
+	{
+		//DEBUG_ERR(("===> oid_rt_pro_set_fw_dig_state_hdl. type:0x%02x.\n",*((unsigned char*)poid_par_priv->information_buf )));
+		if(!rtw_setfwdig_cmd(Adapter,*((unsigned char*)poid_par_priv->information_buf )))
+		{
+			status = NDIS_STATUS_NOT_ACCEPTED;
+		}
+
+	}
+	else{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+	}
+	_irqlevel_changed_(&oldirql,RAISE);
+	_func_exit_;
+#endif
+	return status;
+}
+//-----------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_set_fw_ra_state_hdl(struct oid_par_priv* poid_par_priv)
+{
+
+	NDIS_STATUS		status = NDIS_STATUS_SUCCESS;
+#if 0
+	PADAPTER		Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+	_irqL			oldirql;
+
+	_func_enter_;
+	if(poid_par_priv->type_of_oid != SET_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+
+	_irqlevel_changed_(&oldirql,LOWER);
+
+	if(poid_par_priv->information_buf_len >= sizeof(struct setra_parm))
+	{
+		//DEBUG_ERR(("===> oid_rt_pro_set_fw_ra_state_hdl. type:0x%02x.\n",*((unsigned char*)poid_par_priv->information_buf )));
+		if(!rtw_setfwra_cmd(Adapter,*((unsigned char*)poid_par_priv->information_buf )))
+		{
+			status = NDIS_STATUS_NOT_ACCEPTED;
+		}
+
+	}
+	else{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+	}
+	_irqlevel_changed_(&oldirql,RAISE);
+	_func_exit_;
+#endif
+	return status;
+}
+//-----------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_signal_quality_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	//DEBUG_ERR(("<**********************oid_rt_get_signal_quality_hdl \n"));
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+#if 0
+		if(pMgntInfo->mAssoc || pMgntInfo->mIbss)
+		{
+			ulInfo = pAdapter->RxStats.SignalQuality;
+			*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+		}
+		else
+		{
+			ulInfo = 0xffffffff; // It stands for -1 in 4-byte integer.
+		}
+		break;
+#endif
+
+	return status;
+}
+
+//------------------------------------------------------------------------------
+
+NDIS_STATUS oid_rt_get_small_packet_crc_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	if(poid_par_priv->information_buf_len >=  sizeof(ULONG) )
+	{
+		*(ULONG *)poid_par_priv->information_buf = padapter->recvpriv.rx_smallpacket_crcerr;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	}
+	else
+	{
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_middle_packet_crc_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	if(poid_par_priv->information_buf_len >=  sizeof(ULONG) )
+	{
+		*(ULONG *)poid_par_priv->information_buf = padapter->recvpriv.rx_middlepacket_crcerr;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	}
+	else
+	{
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_large_packet_crc_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	if(poid_par_priv->information_buf_len >=  sizeof(ULONG) )
+	{
+		*(ULONG *)poid_par_priv->information_buf = padapter->recvpriv.rx_largepacket_crcerr;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	}
+	else
+	{
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+
+
+	return status;
+}
+
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_tx_retry_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_rx_retry_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_rx_total_packet_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS		status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	if(poid_par_priv->information_buf_len >=  sizeof(ULONG) )
+	{
+		*(u64 *)poid_par_priv->information_buf = padapter->recvpriv.rx_pkts + padapter->recvpriv.rx_drop;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	}
+	else
+	{
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_tx_beacon_ok_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_tx_beacon_err_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_rx_icv_err_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	if(poid_par_priv->information_buf_len>= sizeof(u32))
+	{
+		//_rtw_memcpy(*(uint *)poid_par_priv->information_buf,padapter->recvpriv.rx_icv_err,sizeof(u32));
+		*(uint *)poid_par_priv->information_buf = padapter->recvpriv.rx_icv_err;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	}
+	else
+	{
+		status = NDIS_STATUS_INVALID_LENGTH ;
+	}
+
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_set_encryption_algorithm_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != SET_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_preamble_mode_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+	ULONG			preamblemode = 0 ;
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	if(poid_par_priv->information_buf_len>= sizeof(ULONG))
+	{
+		if(padapter->registrypriv.preamble == PREAMBLE_LONG)
+			preamblemode = 0;
+		else if (padapter->registrypriv.preamble == PREAMBLE_AUTO)
+			preamblemode = 1;
+		else if (padapter->registrypriv.preamble == PREAMBLE_SHORT)
+			preamblemode = 2;
+
+
+		*(ULONG *)poid_par_priv->information_buf = preamblemode ;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	}
+	else
+	{
+		status = NDIS_STATUS_INVALID_LENGTH ;
+	}
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_ap_ip_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_get_channelplan_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+	struct eeprom_priv*	peeprompriv = &padapter->eeprompriv;
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	*(u16 *)poid_par_priv->information_buf = peeprompriv->channel_plan ;
+
+	return status;
+}
+NDIS_STATUS oid_rt_set_channelplan_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+	struct eeprom_priv*	peeprompriv = &padapter->eeprompriv;
+
+	if(poid_par_priv->type_of_oid != SET_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	peeprompriv->channel_plan = *(u16 *)poid_par_priv->information_buf ;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_set_preamble_mode_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+	ULONG			preamblemode = 0;
+	if(poid_par_priv->type_of_oid != SET_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	if(poid_par_priv->information_buf_len>= sizeof(ULONG))
+	{
+		preamblemode = *(ULONG *)poid_par_priv->information_buf ;
+		if( preamblemode == 0)
+			padapter->registrypriv.preamble = PREAMBLE_LONG;
+		else if (preamblemode==1 )
+			padapter->registrypriv.preamble = PREAMBLE_AUTO;
+		else if ( preamblemode==2 )
+			padapter->registrypriv.preamble = PREAMBLE_SHORT;
+
+		*(ULONG *)poid_par_priv->information_buf = preamblemode ;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	}
+	else
+	{
+		status = NDIS_STATUS_INVALID_LENGTH ;
+	}
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_set_bcn_intvl_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != SET_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	return status;
+}
+NDIS_STATUS oid_rt_dedicate_probe_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_total_tx_bytes_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	if(poid_par_priv->information_buf_len>= sizeof(ULONG))
+	{
+		*(u64 *)poid_par_priv->information_buf = padapter->xmitpriv.tx_bytes;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	}
+	else
+	{
+		status = NDIS_STATUS_INVALID_LENGTH ;
+	}
+
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_total_rx_bytes_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS		status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	if(poid_par_priv->information_buf_len>= sizeof(ULONG))
+	{
+		//_rtw_memcpy(*(uint *)poid_par_priv->information_buf,padapter->recvpriv.rx_icv_err,sizeof(u32));
+		*(u64 *)poid_par_priv->information_buf = padapter->recvpriv.rx_bytes;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	}
+	else
+	{
+		status = NDIS_STATUS_INVALID_LENGTH ;
+	}
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_current_tx_power_level_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_enc_key_mismatch_count_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_enc_key_match_count_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_channel_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+	struct	mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	NDIS_802_11_CONFIGURATION		*pnic_Config;
+
+	ULONG   channelnum;
+
+	_func_enter_;
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	if ( (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE))
+		pnic_Config = &pmlmepriv->cur_network.network.Configuration;
+	else
+		pnic_Config = &padapter->registrypriv.dev_network.Configuration;
+
+	channelnum = pnic_Config->DSConfig;
+	*(ULONG *)poid_par_priv->information_buf = channelnum;
+
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	_func_exit_;
+
+
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_hardware_radio_off_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_key_mismatch_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	return status;
+}
+NDIS_STATUS oid_rt_supported_wireless_mode_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+	ULONG 			ulInfo = 0 ;
+	//DEBUG_ERR(("<**********************oid_rt_supported_wireless_mode_hdl \n"));
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	if(poid_par_priv->information_buf_len >= sizeof(ULONG)){
+		ulInfo |= 0x0100; //WIRELESS_MODE_B
+		ulInfo |= 0x0200; //WIRELESS_MODE_G
+		ulInfo |= 0x0400; //WIRELESS_MODE_A
+
+		*(ULONG *) poid_par_priv->information_buf = ulInfo;
+		//DEBUG_ERR(("<===oid_rt_supported_wireless_mode %x\n",ulInfo));
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	}
+	else{
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_channel_list_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_scan_in_progress_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	return status;
+}
+
+
+NDIS_STATUS oid_rt_forced_data_rate_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	return status;
+}
+NDIS_STATUS oid_rt_wireless_mode_for_scan_list_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	return status;
+}
+NDIS_STATUS oid_rt_get_bss_wireless_mode_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_scan_with_magic_packet_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	return status;
+}
+//**************  oid_rtl_seg_01_01 section end **************
+
+//**************  oid_rtl_seg_01_03 section start **************
+NDIS_STATUS oid_rt_ap_get_associated_station_list_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	return status;
+}
+NDIS_STATUS oid_rt_ap_switch_into_ap_mode_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	return status;
+}
+NDIS_STATUS oid_rt_ap_supported_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	return status;
+}
+NDIS_STATUS oid_rt_ap_set_passphrase_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != SET_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	return status;
+}
+
+//**************  oid_rtl_seg_01_03 section end **************
+
+//****************  oid_rtl_seg_01_11   section start ****************
+NDIS_STATUS oid_rt_pro_rf_write_registry_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS		status = NDIS_STATUS_SUCCESS;
+	PADAPTER		Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+	_irqL			oldirql;
+	_func_enter_;
+	//DEBUG_ERR(("<**********************oid_rt_pro_rf_write_registry_hdl \n"));
+	if(poid_par_priv->type_of_oid != SET_OID) //QUERY_OID
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	_irqlevel_changed_(&oldirql,LOWER);
+	if(poid_par_priv->information_buf_len== (sizeof(unsigned long)*3))
+	{
+		//RegOffsetValue	- The offset of RF register to write.
+		//RegDataWidth	- The data width of RF register to write.
+		//RegDataValue	- The value to write.
+		//RegOffsetValue = *((unsigned long*)InformationBuffer);
+		//RegDataWidth = *((unsigned long*)InformationBuffer+1);
+		//RegDataValue =  *((unsigned long*)InformationBuffer+2);
+		if(!rtw_setrfreg_cmd(Adapter,
+						*(unsigned char*)poid_par_priv->information_buf,
+						(unsigned long)(*((unsigned long*)poid_par_priv->information_buf+2))))
+		{
+			status = NDIS_STATUS_NOT_ACCEPTED;
+		}
+
+	}
+	else{
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+	_irqlevel_changed_(&oldirql,RAISE);
+	_func_exit_;
+
+	return status;
+}
+
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_rf_read_registry_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS		status = NDIS_STATUS_SUCCESS;
+#if 0
+	PADAPTER		Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+	_irqL	oldirql;
+	_func_enter_;
+
+	//DEBUG_ERR(("<**********************oid_rt_pro_rf_read_registry_hdl \n"));
+	if(poid_par_priv->type_of_oid != SET_OID) //QUERY_OID
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	_irqlevel_changed_(&oldirql,LOWER);
+	if(poid_par_priv->information_buf_len== (sizeof(unsigned long)*3))
+	{
+		if(Adapter->mppriv.act_in_progress == _TRUE)
+		{
+			status = NDIS_STATUS_NOT_ACCEPTED;
+		}
+		else
+		{
+			//init workparam
+			Adapter->mppriv.act_in_progress = _TRUE;
+			Adapter->mppriv.workparam.bcompleted= _FALSE;
+			Adapter->mppriv.workparam.act_type = MPT_READ_RF;
+			Adapter->mppriv.workparam.io_offset = *(unsigned long*)poid_par_priv->information_buf;
+			Adapter->mppriv.workparam.io_value = 0xcccccccc;
+
+			//RegOffsetValue	- The offset of RF register to read.
+			//RegDataWidth	- The data width of RF register to read.
+			//RegDataValue	- The value to read.
+			//RegOffsetValue = *((unsigned long*)InformationBuffer);
+			//RegDataWidth = *((unsigned long*)InformationBuffer+1);
+			//RegDataValue =  *((unsigned long*)InformationBuffer+2);
+			if(!rtw_getrfreg_cmd(Adapter,
+							*(unsigned char*)poid_par_priv->information_buf,
+							(unsigned char*)&Adapter->mppriv.workparam.io_value))
+			{
+				status = NDIS_STATUS_NOT_ACCEPTED;
+			}
+		}
+
+
+	}
+	else	{
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+	_irqlevel_changed_(&oldirql,RAISE);
+	_func_exit_;
+#endif
+	return status;
+}
+
+//****************  oid_rtl_seg_01_11   section end****************
+
+
+//**************  oid_rtl_seg_03_00 section start **************
+enum _CONNECT_STATE_{
+	CHECKINGSTATUS,
+	ASSOCIATED,
+	ADHOCMODE,
+	NOTASSOCIATED
+};
+
+NDIS_STATUS oid_rt_get_connect_state_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS		status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+
+	ULONG ulInfo;
+
+	if(poid_par_priv->type_of_oid != QUERY_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	// nStatus==0	CheckingStatus
+	// nStatus==1	Associated
+	// nStatus==2	AdHocMode
+	// nStatus==3	NotAssociated
+
+	if(check_fwstate(pmlmepriv, _FW_UNDER_LINKING) == _TRUE)
+		ulInfo = CHECKINGSTATUS;
+	else if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+		ulInfo = ASSOCIATED;
+	else if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)== _TRUE)
+		ulInfo = ADHOCMODE;
+	else
+		ulInfo = NOTASSOCIATED ;
+
+	*(ULONG *)poid_par_priv->information_buf = ulInfo;
+	*poid_par_priv->bytes_rw =  poid_par_priv->information_buf_len;
+
+#if 0
+	// Rearrange the order to let the UI still shows connection when scan is in progress
+	RT_TRACE(COMP_OID_QUERY, DBG_LOUD, ("===> Query OID_RT_GET_CONNECT_STATE.\n"));
+	if(pMgntInfo->mAssoc)
+		ulInfo = 1;
+	else if(pMgntInfo->mIbss)
+		ulInfo = 2;
+	else if(pMgntInfo->bScanInProgress)
+		ulInfo = 0;
+	else
+		ulInfo = 3;
+	ulInfoLen = sizeof(ULONG);
+	RT_TRACE(COMP_OID_QUERY, DBG_LOUD, ("<=== Query OID_RT_GET_CONNECT_STATE: %d\n", ulInfo));
+#endif
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_set_default_key_id_hdl(struct oid_par_priv* poid_par_priv)
+{
+	NDIS_STATUS	 	status = NDIS_STATUS_SUCCESS;
+	PADAPTER		padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	if(poid_par_priv->type_of_oid != SET_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	return status;
+}
+//**************  oid_rtl_seg_03_00 section end **************
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_set.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_set.c
new file mode 100644
index 000000000000..a86fa5f99a91
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_ioctl_set.c
@@ -0,0 +1,1494 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_IOCTL_SET_C_
+
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_ioctl_set.h>
+#include <hal_intf.h>
+
+#ifdef CONFIG_USB_HCI
+#include <usb_osintf.h>
+#include <usb_ops.h>
+#endif
+#ifdef CONFIG_SDIO_HCI
+#include <sdio_osintf.h>
+#endif
+
+extern void indicate_wx_scan_complete_event(_adapter *padapter);
+
+#define IS_MAC_ADDRESS_BROADCAST(addr) \
+( \
+	( (addr[0] == 0xff) && (addr[1] == 0xff) && \
+		(addr[2] == 0xff) && (addr[3] == 0xff) && \
+		(addr[4] == 0xff) && (addr[5] == 0xff) )  ? _TRUE : _FALSE \
+)
+
+u8 rtw_validate_bssid(const u8 *bssid)
+{
+	u8 ret = _TRUE;
+
+	if (is_zero_mac_addr(bssid)
+		|| is_broadcast_mac_addr(bssid)
+		|| is_multicast_mac_addr(bssid)
+	) {
+		ret = _FALSE;
+	}
+
+	return ret;
+}
+
+u8 rtw_validate_ssid(NDIS_802_11_SSID *ssid)
+{
+	u8	 i;
+	u8	ret=_TRUE;
+
+_func_enter_;
+
+	if (ssid->SsidLength > 32) {
+		RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_err_, ("ssid length >32\n"));
+		ret= _FALSE;
+		goto exit;
+	}
+
+#ifdef CONFIG_VALIDATE_SSID
+	for(i = 0; i < ssid->SsidLength; i++)
+	{
+		//wifi, printable ascii code must be supported
+		if(!( (ssid->Ssid[i] >= 0x20) && (ssid->Ssid[i] <= 0x7e) )){
+			RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_err_, ("ssid has nonprintabl ascii\n"));
+			ret= _FALSE;
+			break;
+		}
+	}
+#endif /* CONFIG_VALIDATE_SSID */
+
+exit:
+
+_func_exit_;
+
+	return ret;
+}
+
+u8 rtw_do_join(_adapter * padapter);
+u8 rtw_do_join(_adapter * padapter)
+{
+	_irqL	irqL;
+	_list	*plist, *phead;
+	u8* pibss = NULL;
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	_queue	*queue	= &(pmlmepriv->scanned_queue);
+	u8 ret=_SUCCESS;
+
+_func_enter_;
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("\n rtw_do_join: phead = %p; plist = %p \n\n\n", phead, plist));
+
+	pmlmepriv->cur_network.join_res = -2;
+
+	set_fwstate(pmlmepriv, _FW_UNDER_LINKING);
+
+	pmlmepriv->pscanned = plist;
+
+	pmlmepriv->to_join = _TRUE;
+
+	if(_rtw_queue_empty(queue)== _TRUE)
+	{
+		_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+		_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+
+		//when set_ssid/set_bssid for rtw_do_join(), but scanning queue is empty
+		//we try to issue sitesurvey firstly
+
+		if (pmlmepriv->LinkDetectInfo.bBusyTraffic ==_FALSE
+			|| rtw_to_roaming(padapter) > 0
+		)
+		{
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("rtw_do_join(): site survey if scanned_queue is empty\n."));
+			// submit site_survey_cmd
+			if(_SUCCESS!=(ret=rtw_sitesurvey_cmd(padapter, &pmlmepriv->assoc_ssid, 1, NULL, 0)) ) {
+				RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("rtw_do_join(): site survey return error\n."));
+			}
+		}
+
+		goto exit;
+	}
+	else
+	{
+		int select_ret;
+		_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+		if((select_ret=rtw_select_and_join_from_scanned_queue(pmlmepriv))==_SUCCESS)
+		{
+			pmlmepriv->to_join = _FALSE;
+			_set_timer(&pmlmepriv->assoc_timer, MAX_JOIN_TIMEOUT);
+		}
+		else if(ret == 2)//there is no need to wait for join
+		{
+			ret = _SUCCESS;
+			_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+			rtw_indicate_connect(padapter);
+		}
+		else
+		{
+			if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)==_TRUE)
+			{
+				// submit createbss_cmd to change to a ADHOC_MASTER
+
+				//pmlmepriv->lock has been acquired by caller...
+				WLAN_BSSID_EX    *pdev_network = &(padapter->registrypriv.dev_network);
+
+				pmlmepriv->fw_state = WIFI_ADHOC_MASTER_STATE;
+
+				pibss = padapter->registrypriv.dev_network.MacAddress;
+
+				_rtw_memset(&pdev_network->Ssid, 0, sizeof(NDIS_802_11_SSID));
+				_rtw_memcpy(&pdev_network->Ssid, &pmlmepriv->assoc_ssid, sizeof(NDIS_802_11_SSID));
+
+				rtw_update_registrypriv_dev_network(padapter);
+
+				rtw_generate_random_ibss(pibss);
+
+				if(rtw_createbss_cmd(padapter)!=_SUCCESS)
+				{
+					RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("***Error=>do_goin: rtw_createbss_cmd status FAIL*** \n "));
+					ret =  _FALSE;
+					goto exit;
+				}
+
+				pmlmepriv->to_join = _FALSE;
+
+				RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("***Error=> rtw_select_and_join_from_scanned_queue FAIL under STA_Mode*** \n "));
+
+			}
+			else
+			{
+				// can't associate ; reset under-linking
+				_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+
+#if 0
+				if((check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE))
+				{
+					if(_rtw_memcmp(pmlmepriv->cur_network.network.Ssid.Ssid, pmlmepriv->assoc_ssid.Ssid, pmlmepriv->assoc_ssid.SsidLength))
+					{
+						// for funk to do roaming
+						// funk will reconnect, but funk will not sitesurvey before reconnect
+						RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("for funk to do roaming"));
+						if(pmlmepriv->sitesurveyctrl.traffic_busy==_FALSE)
+							rtw_sitesurvey_cmd(padapter, &pmlmepriv->assoc_ssid, 1, NULL, 0);
+					}
+
+				}
+#endif
+
+				//when set_ssid/set_bssid for rtw_do_join(), but there are no desired bss in scanning queue
+				//we try to issue sitesurvey firstly
+				if(pmlmepriv->LinkDetectInfo.bBusyTraffic==_FALSE
+					|| rtw_to_roaming(padapter) > 0
+				)
+				{
+					//DBG_871X("rtw_do_join() when   no desired bss in scanning queue \n");
+					if( _SUCCESS!=(ret=rtw_sitesurvey_cmd(padapter, &pmlmepriv->assoc_ssid, 1, NULL, 0)) ){
+						RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("do_join(): site survey return error\n."));
+					}
+				}
+
+
+			}
+
+		}
+
+	}
+
+exit:
+
+_func_exit_;
+
+	return ret;
+}
+
+#ifdef PLATFORM_WINDOWS
+u8 rtw_pnp_set_power_wakeup(_adapter* padapter)
+{
+	u8 res=_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("==>rtw_pnp_set_power_wakeup!!!\n"));
+
+	res = rtw_setstandby_cmd(padapter, 0);
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("<==rtw_pnp_set_power_wakeup!!!\n"));
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_pnp_set_power_sleep(_adapter* padapter)
+{
+	u8 res=_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("==>rtw_pnp_set_power_sleep!!!\n"));
+	//DbgPrint("+rtw_pnp_set_power_sleep\n");
+
+	res = rtw_setstandby_cmd(padapter, 1);
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("<==rtw_pnp_set_power_sleep!!!\n"));
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_set_802_11_reload_defaults(_adapter * padapter, NDIS_802_11_RELOAD_DEFAULTS reloadDefaults)
+{
+_func_enter_;
+
+	switch( reloadDefaults)
+	{
+		case Ndis802_11ReloadWEPKeys:
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("SetInfo OID_802_11_RELOAD_DEFAULTS : Ndis802_11ReloadWEPKeys\n"));
+			break;
+	}
+
+	// SecClearAllKeys(Adapter);
+	// 8711 CAM was not for En/Decrypt only
+	// so, we can't clear all keys.
+	// should we disable WPAcfg (ox0088) bit 1-2, instead of clear all CAM
+
+	//TO DO...
+
+_func_exit_;
+
+	return _TRUE;
+}
+
+u8 set_802_11_test(_adapter* padapter, NDIS_802_11_TEST *test)
+{
+	u8 ret=_TRUE;
+
+_func_enter_;
+
+	switch(test->Type)
+	{
+		case 1:
+			NdisMIndicateStatus(padapter->hndis_adapter, NDIS_STATUS_MEDIA_SPECIFIC_INDICATION, (PVOID)&test->AuthenticationEvent, test->Length - 8);
+			NdisMIndicateStatusComplete(padapter->hndis_adapter);
+			break;
+
+		case 2:
+			NdisMIndicateStatus(padapter->hndis_adapter, NDIS_STATUS_MEDIA_SPECIFIC_INDICATION, (PVOID)&test->RssiTrigger, sizeof(NDIS_802_11_RSSI));
+			NdisMIndicateStatusComplete(padapter->hndis_adapter);
+			break;
+
+		default:
+			ret=_FALSE;
+			break;
+	}
+
+_func_exit_;
+
+	return ret;
+}
+
+u8	rtw_set_802_11_pmkid(_adapter*	padapter, NDIS_802_11_PMKID *pmkid)
+{
+	u8	ret=_SUCCESS;
+
+	return ret;
+}
+
+#endif
+
+u8 rtw_set_802_11_bssid(_adapter* padapter, u8 *bssid)
+{
+	_irqL irqL;
+	u8 status=_SUCCESS;
+	u32 cur_time = 0;
+
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_notice_,
+		 ("+rtw_set_802_11_bssid: bssid="MAC_FMT"\n", MAC_ARG(bssid) ));
+
+	if ((bssid[0]==0x00 && bssid[1]==0x00 && bssid[2]==0x00 && bssid[3]==0x00 && bssid[4]==0x00 &&bssid[5]==0x00) ||
+	    (bssid[0]==0xFF && bssid[1]==0xFF && bssid[2]==0xFF && bssid[3]==0xFF && bssid[4]==0xFF &&bssid[5]==0xFF))
+	{
+		status = _FAIL;
+		goto exit;
+	}
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+
+	DBG_871X("Set BSSID under fw_state=0x%08x\n", get_fwstate(pmlmepriv));
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE) {
+		goto handle_tkip_countermeasure;
+	} else if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING) == _TRUE) {
+		goto release_mlme_lock;
+	}
+
+	if (check_fwstate(pmlmepriv, _FW_LINKED|WIFI_ADHOC_MASTER_STATE) == _TRUE)
+	{
+		RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_info_, ("set_bssid: _FW_LINKED||WIFI_ADHOC_MASTER_STATE\n"));
+
+		if (_rtw_memcmp(&pmlmepriv->cur_network.network.MacAddress, bssid, ETH_ALEN) == _TRUE)
+		{
+			if (check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _FALSE)
+				goto release_mlme_lock;//it means driver is in WIFI_ADHOC_MASTER_STATE, we needn't create bss again.
+		} else {
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("Set BSSID not the same bssid\n"));
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("set_bssid="MAC_FMT"\n", MAC_ARG(bssid) ));
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("cur_bssid="MAC_FMT"\n", MAC_ARG(pmlmepriv->cur_network.network.MacAddress) ));
+
+			rtw_disassoc_cmd(padapter, 0, _TRUE);
+
+			if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+				rtw_indicate_disconnect(padapter);
+
+			rtw_free_assoc_resources(padapter, 1);
+
+			if ((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE)) {
+				_clr_fwstate_(pmlmepriv, WIFI_ADHOC_MASTER_STATE);
+				set_fwstate(pmlmepriv, WIFI_ADHOC_STATE);
+			}
+		}
+	}
+
+handle_tkip_countermeasure:
+	if (rtw_handle_tkip_countermeasure(padapter, __func__) == _FAIL) {
+		status = _FAIL;
+		goto release_mlme_lock;
+	}
+
+	_rtw_memcpy(&pmlmepriv->assoc_bssid, bssid, ETH_ALEN);
+	pmlmepriv->assoc_by_bssid=_TRUE;
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE) {
+		pmlmepriv->to_join = _TRUE;
+	}
+	else {
+		status = rtw_do_join(padapter);
+	}
+
+release_mlme_lock:
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+exit:
+	RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_err_,
+		("rtw_set_802_11_bssid: status=%d\n", status));
+
+_func_exit_;
+
+	return status;
+}
+
+u8 rtw_set_802_11_ssid(_adapter* padapter, NDIS_802_11_SSID *ssid)
+{
+	_irqL irqL;
+	u8 status = _SUCCESS;
+	u32 cur_time = 0;
+
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct wlan_network *pnetwork = &pmlmepriv->cur_network;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_notice_,
+		 ("+rtw_set_802_11_ssid: ssid=[%s] fw_state=0x%08x\n",
+		  ssid->Ssid, get_fwstate(pmlmepriv)));
+
+	if(padapter->hw_init_completed==_FALSE){
+		RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_err_,
+			 ("set_ssid: hw_init_completed==_FALSE=>exit!!!\n"));
+		status = _FAIL;
+		goto exit;
+	}
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	DBG_871X("Set SSID under fw_state=0x%08x\n", get_fwstate(pmlmepriv));
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE) {
+		goto handle_tkip_countermeasure;
+	} else if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING) == _TRUE) {
+		goto release_mlme_lock;
+	}
+
+	if (check_fwstate(pmlmepriv, _FW_LINKED|WIFI_ADHOC_MASTER_STATE) == _TRUE)
+	{
+		RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_info_,
+			 ("set_ssid: _FW_LINKED||WIFI_ADHOC_MASTER_STATE\n"));
+
+		if ((pmlmepriv->assoc_ssid.SsidLength == ssid->SsidLength) &&
+		    (_rtw_memcmp(&pmlmepriv->assoc_ssid.Ssid, ssid->Ssid, ssid->SsidLength) == _TRUE))
+		{
+			if((check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _FALSE))
+			{
+				RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_err_,
+					 ("Set SSID is the same ssid, fw_state=0x%08x\n",
+					  get_fwstate(pmlmepriv)));
+
+				if(rtw_is_same_ibss(padapter, pnetwork) == _FALSE)
+				{
+					//if in WIFI_ADHOC_MASTER_STATE | WIFI_ADHOC_STATE, create bss or rejoin again
+					rtw_disassoc_cmd(padapter, 0, _TRUE);
+
+					if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+						rtw_indicate_disconnect(padapter);
+
+					rtw_free_assoc_resources(padapter, 1);
+
+					if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE) {
+						_clr_fwstate_(pmlmepriv, WIFI_ADHOC_MASTER_STATE);
+						set_fwstate(pmlmepriv, WIFI_ADHOC_STATE);
+					}
+				}
+				else
+				{
+					goto release_mlme_lock;//it means driver is in WIFI_ADHOC_MASTER_STATE, we needn't create bss again.
+				}
+			}
+#ifdef CONFIG_LPS
+			else {
+				rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_JOINBSS, 1);
+			}
+#endif
+		}
+		else
+		{
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("Set SSID not the same ssid\n"));
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("set_ssid=[%s] len=0x%x\n", ssid->Ssid, (unsigned int)ssid->SsidLength));
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("assoc_ssid=[%s] len=0x%x\n", pmlmepriv->assoc_ssid.Ssid, (unsigned int)pmlmepriv->assoc_ssid.SsidLength));
+
+			rtw_disassoc_cmd(padapter, 0, _TRUE);
+
+			if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+				rtw_indicate_disconnect(padapter);
+
+			rtw_free_assoc_resources(padapter, 1);
+
+			if (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE) {
+				_clr_fwstate_(pmlmepriv, WIFI_ADHOC_MASTER_STATE);
+				set_fwstate(pmlmepriv, WIFI_ADHOC_STATE);
+			}
+		}
+	}
+
+handle_tkip_countermeasure:
+	if (rtw_handle_tkip_countermeasure(padapter, __func__) == _FAIL) {
+		status = _FAIL;
+		goto release_mlme_lock;
+	}
+
+	if (rtw_validate_ssid(ssid) == _FALSE) {
+		status = _FAIL;
+		goto release_mlme_lock;
+	}
+
+	_rtw_memcpy(&pmlmepriv->assoc_ssid, ssid, sizeof(NDIS_802_11_SSID));
+	pmlmepriv->assoc_by_bssid=_FALSE;
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE) {
+		pmlmepriv->to_join = _TRUE;
+	}
+	else {
+		status = rtw_do_join(padapter);
+	}
+
+release_mlme_lock:
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+exit:
+	RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_err_,
+		("-rtw_set_802_11_ssid: status=%d\n", status));
+
+_func_exit_;
+
+	return status;
+
+}
+
+u8 rtw_set_802_11_connect(_adapter *padapter, const u8 *bssid
+	, NDIS_802_11_SSID *ssid)
+{
+	_irqL irqL;
+	u8 status = _SUCCESS;
+	u32 cur_time = 0;
+	bool bssid_valid = _TRUE;
+	bool ssid_valid = _TRUE;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+_func_enter_;
+
+	if (!ssid || rtw_validate_ssid(ssid) == _FALSE)
+		ssid_valid = _FALSE;
+
+	if (!bssid || rtw_validate_bssid(bssid) == _FALSE)
+		bssid_valid = _FALSE;
+
+	if (ssid_valid == _FALSE && bssid_valid == _FALSE) {
+		DBG_871X(FUNC_ADPT_FMT" ssid:%p, ssid_valid:%d, bssid:%p, bssid_valid:%d\n",
+			FUNC_ADPT_ARG(padapter), ssid, ssid_valid, bssid, bssid_valid);
+		status = _FAIL;
+		goto exit;
+	}
+
+	if(padapter->hw_init_completed==_FALSE){
+		RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_err_,
+			 ("set_ssid: hw_init_completed==_FALSE=>exit!!!\n"));
+		status = _FAIL;
+		goto exit;
+	}
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	LOG_LEVEL(_drv_info_, FUNC_ADPT_FMT"  fw_state=0x%08x\n",
+		FUNC_ADPT_ARG(padapter), get_fwstate(pmlmepriv));
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE) {
+		goto handle_tkip_countermeasure;
+	} else if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING) == _TRUE) {
+		goto release_mlme_lock;
+	}
+
+handle_tkip_countermeasure:
+	if (rtw_handle_tkip_countermeasure(padapter, __func__) == _FAIL) {
+		status = _FAIL;
+		goto release_mlme_lock;
+	}
+
+	if (ssid && ssid_valid)
+		_rtw_memcpy(&pmlmepriv->assoc_ssid, ssid, sizeof(NDIS_802_11_SSID));
+
+	if (bssid && bssid_valid) {
+		_rtw_memcpy(&pmlmepriv->assoc_bssid, bssid, ETH_ALEN);
+		pmlmepriv->assoc_by_bssid = _TRUE;
+	}
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE) {
+		pmlmepriv->to_join = _TRUE;
+	}
+	else {
+		status = rtw_do_join(padapter);
+	}
+
+release_mlme_lock:
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+exit:
+
+_func_exit_;
+
+	return status;
+}
+
+/*
+rtw_set_802_11_infrastructure_mode(~)
+	### NOTE:#### (!!!!)
+	MUST TAKE CARE THAT BEFORE CALLING THIS FUNC, YOU SHOULD HAVE LOCKED pmlmepriv->lock and scanned_queue->lock in sequence
+*/
+u8 rtw_set_802_11_infrastructure_mode(_adapter* padapter,
+	NDIS_802_11_NETWORK_INFRASTRUCTURE networktype)
+{
+	_irqL irqL;
+	struct	mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct	wlan_network	*cur_network = &pmlmepriv->cur_network;
+	NDIS_802_11_NETWORK_INFRASTRUCTURE* pold_state = &(cur_network->network.InfrastructureMode);
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_notice_,
+		 ("+rtw_set_802_11_infrastructure_mode: old=%d new=%d fw_state=0x%08x\n",
+		  *pold_state, networktype, get_fwstate(pmlmepriv)));
+
+	if(*pold_state != networktype)
+	{
+
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,(" change mode!"));
+		//DBG_871X("change mode, old_mode=%d, new_mode=%d, fw_state=0x%x\n", *pold_state, networktype, get_fwstate(pmlmepriv));
+
+		if(*pold_state==Ndis802_11APMode)
+		{
+			//change to other mode from Ndis802_11APMode
+			cur_network->join_res = -1;
+
+#ifdef CONFIG_NATIVEAP_MLME
+			stop_ap_mode(padapter);
+#endif
+		}
+
+		if((check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE) ||(*pold_state==Ndis802_11IBSS))
+			rtw_disassoc_cmd(padapter, 0, _TRUE);
+
+		if((check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE) ||
+			(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)== _TRUE) )
+			rtw_free_assoc_resources(padapter, 0);
+
+		if((*pold_state == Ndis802_11Infrastructure) ||(*pold_state == Ndis802_11IBSS))
+	       {
+			if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+			{
+				rtw_indicate_disconnect(padapter); //will clr Linked_state; before this function, we must have chked whether  issue dis-assoc_cmd or not
+			}
+	       }
+
+		*pold_state = networktype;
+
+		_clr_fwstate_(pmlmepriv, ~WIFI_NULL_STATE);
+
+		switch(networktype)
+		{
+			case Ndis802_11IBSS:
+				set_fwstate(pmlmepriv, WIFI_ADHOC_STATE);
+				break;
+
+			case Ndis802_11Infrastructure:
+				set_fwstate(pmlmepriv, WIFI_STATION_STATE);
+				break;
+
+			case Ndis802_11APMode:
+				set_fwstate(pmlmepriv, WIFI_AP_STATE);
+#ifdef CONFIG_NATIVEAP_MLME
+				start_ap_mode(padapter);
+				//rtw_indicate_connect(padapter);
+#endif
+
+				break;
+
+			case Ndis802_11AutoUnknown:
+			case Ndis802_11InfrastructureMax:
+				break;
+		}
+
+		//SecClearAllKeys(adapter);
+
+		//RT_TRACE(COMP_OID_SET, DBG_LOUD, ("set_infrastructure: fw_state:%x after changing mode\n",
+		//									get_fwstate(pmlmepriv) ));
+
+	}
+
+_func_exit_;
+
+	return _TRUE;
+}
+
+
+u8 rtw_set_802_11_disassociate(_adapter *padapter)
+{
+	_irqL irqL;
+	struct mlme_priv * pmlmepriv = &padapter->mlmepriv;
+
+_func_enter_;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+	{
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("MgntActrtw_set_802_11_disassociate: rtw_indicate_disconnect\n"));
+
+		rtw_disassoc_cmd(padapter, 0, _TRUE);
+		rtw_indicate_disconnect(padapter);
+		//modify for CONFIG_IEEE80211W, none 11w can use it
+		rtw_free_assoc_resources_cmd(padapter);
+	}
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+_func_exit_;
+
+	return _TRUE;
+}
+
+u8 rtw_set_802_11_bssid_list_scan(_adapter* padapter, NDIS_802_11_SSID *pssid, int ssid_max_num)
+{
+	_irqL	irqL;
+	struct	mlme_priv		*pmlmepriv= &padapter->mlmepriv;
+	u8	res=_TRUE;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("+rtw_set_802_11_bssid_list_scan(), fw_state=%x\n", get_fwstate(pmlmepriv)));
+
+	if (padapter == NULL) {
+		res=_FALSE;
+		goto exit;
+	}
+	if (padapter->hw_init_completed==_FALSE){
+		res = _FALSE;
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n===rtw_set_802_11_bssid_list_scan:hw_init_completed==_FALSE===\n"));
+		goto exit;
+	}
+
+	if ((check_fwstate(pmlmepriv, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE) ||
+		(pmlmepriv->LinkDetectInfo.bBusyTraffic == _TRUE))
+	{
+		// Scan or linking is in progress, do nothing.
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("rtw_set_802_11_bssid_list_scan fail since fw_state = %x\n", get_fwstate(pmlmepriv)));
+		res = _TRUE;
+
+		if(check_fwstate(pmlmepriv, (_FW_UNDER_SURVEY|_FW_UNDER_LINKING))== _TRUE){
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n###_FW_UNDER_SURVEY|_FW_UNDER_LINKING\n\n"));
+		} else {
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n###pmlmepriv->sitesurveyctrl.traffic_busy==_TRUE\n\n"));
+		}
+	} else {
+		if (rtw_is_scan_deny(padapter)) {
+			DBG_871X(FUNC_ADPT_FMT": scan deny\n", FUNC_ADPT_ARG(padapter));
+			indicate_wx_scan_complete_event(padapter);
+			return _SUCCESS;
+		}
+
+		_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+		res = rtw_sitesurvey_cmd(padapter, pssid, ssid_max_num, NULL, 0);
+
+		_exit_critical_bh(&pmlmepriv->lock, &irqL);
+	}
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtw_set_802_11_authentication_mode(_adapter* padapter, NDIS_802_11_AUTHENTICATION_MODE authmode)
+{
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+	int res;
+	u8 ret;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("set_802_11_auth.mode(): mode=%x\n", authmode));
+
+	psecuritypriv->ndisauthtype=authmode;
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("rtw_set_802_11_authentication_mode:psecuritypriv->ndisauthtype=%d", psecuritypriv->ndisauthtype));
+
+	if(psecuritypriv->ndisauthtype>3)
+		psecuritypriv->dot11AuthAlgrthm=dot11AuthAlgrthm_8021X;
+
+	res=rtw_set_auth(padapter,psecuritypriv);
+
+	if(res==_SUCCESS)
+		ret=_TRUE;
+	else
+		ret=_FALSE;
+
+_func_exit_;
+
+	return ret;
+}
+
+u8 rtw_set_802_11_add_wep(_adapter* padapter, NDIS_802_11_WEP *wep){
+
+	u8		bdefaultkey;
+	u8		btransmitkey;
+	sint		keyid,res;
+	struct security_priv* psecuritypriv=&(padapter->securitypriv);
+	u8		ret=_SUCCESS;
+
+_func_enter_;
+
+	bdefaultkey=(wep->KeyIndex & 0x40000000) > 0 ? _FALSE : _TRUE;   //for ???
+	btransmitkey= (wep->KeyIndex & 0x80000000) > 0 ? _TRUE  : _FALSE;	//for ???
+	keyid=wep->KeyIndex & 0x3fffffff;
+
+	if(keyid>4)
+	{
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("MgntActrtw_set_802_11_add_wep:keyid>4=>fail\n"));
+		ret=_FALSE;
+		goto exit;
+	}
+
+	switch(wep->KeyLength)
+	{
+		case 5:
+			psecuritypriv->dot11PrivacyAlgrthm=_WEP40_;
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("MgntActrtw_set_802_11_add_wep:wep->KeyLength=5\n"));
+			break;
+		case 13:
+			psecuritypriv->dot11PrivacyAlgrthm=_WEP104_;
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("MgntActrtw_set_802_11_add_wep:wep->KeyLength=13\n"));
+			break;
+		default:
+			psecuritypriv->dot11PrivacyAlgrthm=_NO_PRIVACY_;
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("MgntActrtw_set_802_11_add_wep:wep->KeyLength!=5 or 13\n"));
+			break;
+	}
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("rtw_set_802_11_add_wep:befor memcpy, wep->KeyLength=0x%x wep->KeyIndex=0x%x  keyid =%x\n",wep->KeyLength,wep->KeyIndex,keyid));
+
+	_rtw_memcpy(&(psecuritypriv->dot11DefKey[keyid].skey[0]),&(wep->KeyMaterial),wep->KeyLength);
+
+	psecuritypriv->dot11DefKeylen[keyid]=wep->KeyLength;
+
+	psecuritypriv->dot11PrivacyKeyIndex=keyid;
+
+	RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("rtw_set_802_11_add_wep:security key material : %x %x %x %x %x %x %x %x %x %x %x %x %x \n",
+		psecuritypriv->dot11DefKey[keyid].skey[0],psecuritypriv->dot11DefKey[keyid].skey[1],psecuritypriv->dot11DefKey[keyid].skey[2],
+		psecuritypriv->dot11DefKey[keyid].skey[3],psecuritypriv->dot11DefKey[keyid].skey[4],psecuritypriv->dot11DefKey[keyid].skey[5],
+		psecuritypriv->dot11DefKey[keyid].skey[6],psecuritypriv->dot11DefKey[keyid].skey[7],psecuritypriv->dot11DefKey[keyid].skey[8],
+		psecuritypriv->dot11DefKey[keyid].skey[9],psecuritypriv->dot11DefKey[keyid].skey[10],psecuritypriv->dot11DefKey[keyid].skey[11],
+		psecuritypriv->dot11DefKey[keyid].skey[12]));
+
+	res=rtw_set_key(padapter,psecuritypriv, keyid, 1);
+
+	if(res==_FAIL)
+		ret= _FALSE;
+exit:
+
+_func_exit_;
+
+	return ret;
+
+}
+
+u8 rtw_set_802_11_remove_wep(_adapter* padapter, u32 keyindex){
+
+	u8 ret=_SUCCESS;
+
+_func_enter_;
+
+	if (keyindex >= 0x80000000 || padapter == NULL){
+
+		ret=_FALSE;
+		goto exit;
+
+	}
+	else
+	{
+		int res;
+		struct security_priv* psecuritypriv=&(padapter->securitypriv);
+		if( keyindex < 4 ){
+
+			_rtw_memset(&psecuritypriv->dot11DefKey[keyindex], 0, 16);
+
+			res=rtw_set_key(padapter,psecuritypriv,keyindex, 0);
+
+			psecuritypriv->dot11DefKeylen[keyindex]=0;
+
+			if(res==_FAIL)
+				ret=_FAIL;
+
+		}
+		else
+		{
+			ret=_FAIL;
+		}
+
+	}
+
+exit:
+
+_func_exit_;
+
+	return ret;
+
+}
+
+u8 rtw_set_802_11_add_key(_adapter* padapter, NDIS_802_11_KEY *key){
+
+	uint	encryptionalgo;
+	u8 * pbssid;
+	struct sta_info *stainfo;
+	u8	bgroup = _FALSE;
+	u8	bgrouptkey = _FALSE;//can be remove later
+	u8	ret=_SUCCESS;
+
+_func_enter_;
+
+	if (((key->KeyIndex & 0x80000000) == 0) && ((key->KeyIndex & 0x40000000) > 0)){
+
+		// It is invalid to clear bit 31 and set bit 30. If the miniport driver encounters this combination,
+		// it must fail the request and return NDIS_STATUS_INVALID_DATA.
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("rtw_set_802_11_add_key: ((key->KeyIndex & 0x80000000) == 0)[=%d] ",(int)(key->KeyIndex & 0x80000000) == 0));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("rtw_set_802_11_add_key:((key->KeyIndex & 0x40000000) > 0)[=%d]" , (int)(key->KeyIndex & 0x40000000) > 0));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_info_,("rtw_set_802_11_add_key: key->KeyIndex=%d \n" ,(int)key->KeyIndex));
+		ret= _FAIL;
+		goto exit;
+	}
+
+	if(key->KeyIndex & 0x40000000)
+	{
+		// Pairwise key
+
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("OID_802_11_ADD_KEY: +++++ Pairwise key +++++\n"));
+
+		pbssid=get_bssid(&padapter->mlmepriv);
+		stainfo=rtw_get_stainfo(&padapter->stapriv, pbssid);
+
+		if((stainfo!=NULL)&&(padapter->securitypriv.dot11AuthAlgrthm==dot11AuthAlgrthm_8021X)){
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("OID_802_11_ADD_KEY:( stainfo!=NULL)&&(Adapter->securitypriv.dot11AuthAlgrthm==dot11AuthAlgrthm_8021X)\n"));
+			encryptionalgo=stainfo->dot118021XPrivacy;
+		}
+		else{
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("OID_802_11_ADD_KEY: stainfo==NULL)||(Adapter->securitypriv.dot11AuthAlgrthm!=dot11AuthAlgrthm_8021X)\n"));
+			encryptionalgo=padapter->securitypriv.dot11PrivacyAlgrthm;
+		}
+
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("rtw_set_802_11_add_key: (encryptionalgo ==%d)!\n",encryptionalgo ));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("rtw_set_802_11_add_key: (Adapter->securitypriv.dot11PrivacyAlgrthm ==%d)!\n",padapter->securitypriv.dot11PrivacyAlgrthm));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("rtw_set_802_11_add_key: (Adapter->securitypriv.dot11AuthAlgrthm ==%d)!\n",padapter->securitypriv.dot11AuthAlgrthm));
+
+		if((stainfo!=NULL)){
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("rtw_set_802_11_add_key: (stainfo->dot118021XPrivacy ==%d)!\n", stainfo->dot118021XPrivacy));
+		}
+
+		if(key->KeyIndex & 0x000000FF){
+			// The key index is specified in the lower 8 bits by values of zero to 255.
+			// The key index should be set to zero for a Pairwise key, and the driver should fail with
+			// NDIS_STATUS_INVALID_DATA if the lower 8 bits is not zero
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,(" key->KeyIndex & 0x000000FF.\n"));
+			ret= _FAIL;
+			goto exit;
+		}
+
+		// check BSSID
+		if (IS_MAC_ADDRESS_BROADCAST(key->BSSID) == _TRUE){
+
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("MacAddr_isBcst(key->BSSID)\n"));
+			ret= _FALSE;
+			goto exit;
+		}
+
+		// Check key length for TKIP.
+		//if(encryptionAlgorithm == RT_ENC_TKIP_ENCRYPTION && key->KeyLength != 32)
+		if((encryptionalgo== _TKIP_)&& (key->KeyLength != 32)){
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("TKIP KeyLength:0x%x != 32\n", key->KeyLength));
+			ret=_FAIL;
+			goto exit;
+
+		}
+
+		// Check key length for AES.
+		if((encryptionalgo== _AES_)&& (key->KeyLength != 16)) {
+			// For our supplicant, EAPPkt9x.vxd, cannot differentiate TKIP and AES case.
+			if(key->KeyLength == 32) {
+				key->KeyLength = 16;
+			} else {
+				ret= _FAIL;
+				goto exit;
+			}
+		}
+
+		// Check key length for WEP. For NDTEST, 2005.01.27, by rcnjko.
+		if(	(encryptionalgo== _WEP40_|| encryptionalgo== _WEP104_) && (key->KeyLength != 5 || key->KeyLength != 13)) {
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("WEP KeyLength:0x%x != 5 or 13\n", key->KeyLength));
+			ret=_FAIL;
+			goto exit;
+		}
+
+		bgroup = _FALSE;
+
+		// Check the pairwise key. Added by Annie, 2005-07-06.
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("------------------------------------------\n"));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("[Pairwise Key set]\n"));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("------------------------------------------\n"));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("key index: 0x%8x(0x%8x)\n", key->KeyIndex,(key->KeyIndex&0x3)));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("key Length: %d\n", key->KeyLength));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("------------------------------------------\n"));
+
+	}
+	else
+	{
+		// Group key - KeyIndex(BIT30==0)
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("OID_802_11_ADD_KEY: +++++ Group key +++++\n"));
+
+
+		// when add wep key through add key and didn't assigned encryption type before
+		if((padapter->securitypriv.ndisauthtype<=3)&&(padapter->securitypriv.dot118021XGrpPrivacy==0))
+		{
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("keylen=%d( Adapter->securitypriv.dot11PrivacyAlgrthm=%x  )padapter->securitypriv.dot118021XGrpPrivacy(%x)\n", key->KeyLength,padapter->securitypriv.dot11PrivacyAlgrthm,padapter->securitypriv.dot118021XGrpPrivacy));
+
+			switch(key->KeyLength)
+			{
+				case 5:
+					padapter->securitypriv.dot11PrivacyAlgrthm=_WEP40_;
+					RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("Adapter->securitypriv.dot11PrivacyAlgrthm= %x key->KeyLength=%u\n", padapter->securitypriv.dot11PrivacyAlgrthm,key->KeyLength));
+					break;
+				case 13:
+					padapter->securitypriv.dot11PrivacyAlgrthm=_WEP104_;
+					RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("Adapter->securitypriv.dot11PrivacyAlgrthm= %x key->KeyLength=%u\n", padapter->securitypriv.dot11PrivacyAlgrthm,key->KeyLength));
+					break;
+				default:
+					padapter->securitypriv.dot11PrivacyAlgrthm=_NO_PRIVACY_;
+					RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("Adapter->securitypriv.dot11PrivacyAlgrthm= %x key->KeyLength=%u \n", padapter->securitypriv.dot11PrivacyAlgrthm,key->KeyLength));
+					break;
+			}
+
+			encryptionalgo=padapter->securitypriv.dot11PrivacyAlgrthm;
+
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,(" Adapter->securitypriv.dot11PrivacyAlgrthm=%x\n", padapter->securitypriv.dot11PrivacyAlgrthm));
+
+		}
+		else
+		{
+			encryptionalgo=padapter->securitypriv.dot118021XGrpPrivacy;
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("( Adapter->securitypriv.dot11PrivacyAlgrthm=%x  )encryptionalgo(%x)=padapter->securitypriv.dot118021XGrpPrivacy(%x)keylen=%d\n", padapter->securitypriv.dot11PrivacyAlgrthm,encryptionalgo,padapter->securitypriv.dot118021XGrpPrivacy,key->KeyLength));
+
+		}
+
+		if((check_fwstate(&padapter->mlmepriv, WIFI_ADHOC_STATE)==_TRUE) && (IS_MAC_ADDRESS_BROADCAST(key->BSSID) == _FALSE)) {
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,(" IBSS but BSSID is not Broadcast Address.\n"));
+			ret= _FAIL;
+			goto exit;
+		}
+
+		// Check key length for TKIP
+		if((encryptionalgo== _TKIP_) && (key->KeyLength != 32)) {
+
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,(" TKIP GTK KeyLength:%u != 32\n", key->KeyLength));
+			ret= _FAIL;
+			goto exit;
+
+		} else if(encryptionalgo== _AES_ && (key->KeyLength != 16 && key->KeyLength != 32) ) {
+
+			// Check key length for AES
+			// For NDTEST, we allow keylen=32 in this case. 2005.01.27, by rcnjko.
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("<=== SetInfo, OID_802_11_ADD_KEY: AES GTK KeyLength:%u != 16 or 32\n", key->KeyLength));
+			ret= _FAIL;
+			goto exit;
+		}
+
+		// Change the key length for EAPPkt9x.vxd. Added by Annie, 2005-11-03.
+		if((encryptionalgo==  _AES_) && (key->KeyLength == 32) ) {
+			key->KeyLength = 16;
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("AES key length changed: %u\n", key->KeyLength) );
+		}
+
+		if(key->KeyIndex & 0x8000000) {//error ??? 0x8000_0000
+			bgrouptkey = _TRUE;
+		}
+
+		if((check_fwstate(&padapter->mlmepriv, WIFI_ADHOC_STATE)==_TRUE)&&(check_fwstate(&padapter->mlmepriv, _FW_LINKED)==_TRUE))
+		{
+			bgrouptkey = _TRUE;
+		}
+
+		bgroup = _TRUE;
+
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("------------------------------------------\n") );
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("[Group Key set]\n") );
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("------------------------------------------\n")) ;
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("key index: 0x%8x(0x%8x)\n", key->KeyIndex,(key->KeyIndex&0x3)));
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("key Length: %d\n", key->KeyLength)) ;
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("------------------------------------------\n"));
+
+	}
+
+	// If WEP encryption algorithm, just call rtw_set_802_11_add_wep().
+	if((padapter->securitypriv.dot11AuthAlgrthm !=dot11AuthAlgrthm_8021X)&&(encryptionalgo== _WEP40_  || encryptionalgo== _WEP104_))
+	{
+		u8 ret;
+		u32 keyindex;
+		u32 len = FIELD_OFFSET(NDIS_802_11_KEY, KeyMaterial) + key->KeyLength;
+		NDIS_802_11_WEP *wep = &padapter->securitypriv.ndiswep;
+
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("OID_802_11_ADD_KEY: +++++ WEP key +++++\n"));
+
+		wep->Length = len;
+		keyindex = key->KeyIndex&0x7fffffff;
+		wep->KeyIndex = keyindex ;
+		wep->KeyLength = key->KeyLength;
+
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("OID_802_11_ADD_KEY:Before memcpy \n"));
+
+		_rtw_memcpy(wep->KeyMaterial, key->KeyMaterial, key->KeyLength);
+		_rtw_memcpy(&(padapter->securitypriv.dot11DefKey[keyindex].skey[0]), key->KeyMaterial, key->KeyLength);
+
+		padapter->securitypriv.dot11DefKeylen[keyindex]=key->KeyLength;
+		padapter->securitypriv.dot11PrivacyKeyIndex=keyindex;
+
+		ret = rtw_set_802_11_add_wep(padapter, wep);
+
+		goto exit;
+
+	}
+
+	if(key->KeyIndex & 0x20000000){
+		// SetRSC
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("OID_802_11_ADD_KEY: +++++ SetRSC+++++\n"));
+		if(bgroup == _TRUE)
+		{
+			NDIS_802_11_KEY_RSC keysrc=key->KeyRSC & 0x00FFFFFFFFFFFFULL;
+			_rtw_memcpy(&padapter->securitypriv.dot11Grprxpn, &keysrc, 8);
+		}
+		else
+		{
+			NDIS_802_11_KEY_RSC keysrc=key->KeyRSC & 0x00FFFFFFFFFFFFULL;
+			_rtw_memcpy(&padapter->securitypriv.dot11Grptxpn, &keysrc, 8);
+		}
+
+	}
+
+	// Indicate this key idx is used for TX
+	// Save the key in KeyMaterial
+	if(bgroup == _TRUE) // Group transmit key
+	{
+		int res;
+
+		if(bgrouptkey == _TRUE)
+		{
+			padapter->securitypriv.dot118021XGrpKeyid=(u8)key->KeyIndex;
+		}
+
+		if((key->KeyIndex&0x3) == 0){
+			ret = _FAIL;
+			goto exit;
+		}
+
+		_rtw_memset(&padapter->securitypriv.dot118021XGrpKey[(u8)((key->KeyIndex) & 0x03)], 0, 16);
+		_rtw_memset(&padapter->securitypriv.dot118021XGrptxmickey[(u8)((key->KeyIndex) & 0x03)], 0, 16);
+		_rtw_memset(&padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)], 0, 16);
+
+		if((key->KeyIndex & 0x10000000))
+		{
+			_rtw_memcpy(&padapter->securitypriv.dot118021XGrptxmickey[(u8)((key->KeyIndex) & 0x03)], key->KeyMaterial + 16, 8);
+			_rtw_memcpy(&padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)], key->KeyMaterial + 24, 8);
+
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n rtw_set_802_11_add_key:rx mic :0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+				padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)].skey[0],padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex-1) & 0x03)].skey[1],
+				padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)].skey[2],padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex-1) & 0x03)].skey[3],
+				padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)].skey[4],padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex-1) & 0x03)].skey[5],
+				padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)].skey[6],padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex-1) & 0x03)].skey[7]));
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n rtw_set_802_11_add_key:set Group mic key!!!!!!!!\n"));
+
+		}
+		else
+		{
+			_rtw_memcpy(&padapter->securitypriv.dot118021XGrptxmickey[(u8)((key->KeyIndex) & 0x03)], key->KeyMaterial + 24, 8);
+			_rtw_memcpy(&padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)], key->KeyMaterial + 16, 8);
+
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n rtw_set_802_11_add_key:rx mic :0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+				padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)].skey[0],padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex-1) & 0x03)].skey[1],
+				padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)].skey[2],padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex-1) & 0x03)].skey[3],
+				padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)].skey[4],padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex-1) & 0x03)].skey[5],
+				padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex) & 0x03)].skey[6],padapter->securitypriv.dot118021XGrprxmickey[(u8)((key->KeyIndex-1) & 0x03)].skey[7]));
+			RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n rtw_set_802_11_add_key:set Group mic key!!!!!!!!\n"));
+
+		}
+
+		//set group key by index
+		_rtw_memcpy(&padapter->securitypriv.dot118021XGrpKey[(u8)((key->KeyIndex) & 0x03)], key->KeyMaterial, key->KeyLength);
+
+		key->KeyIndex=key->KeyIndex & 0x03;
+
+		padapter->securitypriv.binstallGrpkey=_TRUE;
+
+		padapter->securitypriv.bcheck_grpkey=_FALSE;
+
+		RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("reset group key"));
+
+		res=rtw_set_key(padapter,&padapter->securitypriv, key->KeyIndex, 1);
+
+		if(res==_FAIL)
+			ret= _FAIL;
+
+		goto exit;
+
+	}
+	else // Pairwise Key
+	{
+		u8 res;
+
+		pbssid=get_bssid(&padapter->mlmepriv);
+		stainfo=rtw_get_stainfo(&padapter->stapriv , pbssid );
+
+		if(stainfo!=NULL)
+		{
+			_rtw_memset( &stainfo->dot118021x_UncstKey, 0, 16);// clear keybuffer
+
+			_rtw_memcpy(&stainfo->dot118021x_UncstKey, key->KeyMaterial, 16);
+
+			if(encryptionalgo== _TKIP_)
+			{
+				padapter->securitypriv.busetkipkey=_FALSE;
+
+				//_set_timer(&padapter->securitypriv.tkip_timer, 50);
+
+				RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n ==========_set_timer\n"));
+
+				// if TKIP, save the Receive/Transmit MIC key in KeyMaterial[128-255]
+				if((key->KeyIndex & 0x10000000)){
+					_rtw_memcpy(&stainfo->dot11tkiptxmickey, key->KeyMaterial + 16, 8);
+					_rtw_memcpy(&stainfo->dot11tkiprxmickey, key->KeyMaterial + 24, 8);
+
+				} else {
+					_rtw_memcpy(&stainfo->dot11tkiptxmickey, key->KeyMaterial + 24, 8);
+					_rtw_memcpy(&stainfo->dot11tkiprxmickey, key->KeyMaterial + 16, 8);
+
+				}
+
+			}
+			else if(encryptionalgo == _AES_)
+			{
+
+			}
+
+
+			//Set key to CAM through H2C command
+			if(bgrouptkey)//never go to here
+			{
+				res=rtw_setstakey_cmd(padapter, (unsigned char *)stainfo, _FALSE);
+				RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n rtw_set_802_11_add_key:rtw_setstakey_cmd(group)\n"));
+			}
+			else{
+				res=rtw_setstakey_cmd(padapter, (unsigned char *)stainfo, _TRUE);
+				RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("\n rtw_set_802_11_add_key:rtw_setstakey_cmd(unicast)\n"));
+			}
+
+			if(res ==_FALSE)
+				ret= _FAIL;
+
+		}
+
+	}
+
+exit:
+
+_func_exit_;
+
+	return ret;
+}
+
+u8 rtw_set_802_11_remove_key(_adapter*	padapter, NDIS_802_11_REMOVE_KEY *key){
+
+	uint				encryptionalgo;
+	u8 * pbssid;
+	struct sta_info *stainfo;
+	u8	bgroup = (key->KeyIndex & 0x4000000) > 0 ? _FALSE: _TRUE;
+	u8	keyIndex = (u8)key->KeyIndex & 0x03;
+	u8	ret=_SUCCESS;
+
+_func_enter_;
+
+	if ((key->KeyIndex & 0xbffffffc) > 0) {
+		ret=_FAIL;
+		goto exit;
+	}
+
+	if (bgroup == _TRUE) {
+		encryptionalgo= padapter->securitypriv.dot118021XGrpPrivacy;
+		// clear group key by index
+		//NdisZeroMemory(Adapter->MgntInfo.SecurityInfo.KeyBuf[keyIndex], MAX_WEP_KEY_LEN);
+		//Adapter->MgntInfo.SecurityInfo.KeyLen[keyIndex] = 0;
+
+		_rtw_memset(&padapter->securitypriv.dot118021XGrpKey[keyIndex], 0, 16);
+
+		//! \todo Send a H2C Command to Firmware for removing this Key in CAM Entry.
+
+	} else {
+
+		pbssid=get_bssid(&padapter->mlmepriv);
+		stainfo=rtw_get_stainfo(&padapter->stapriv , pbssid );
+		if(stainfo !=NULL){
+			encryptionalgo=stainfo->dot118021XPrivacy;
+
+		// clear key by BSSID
+		_rtw_memset(&stainfo->dot118021x_UncstKey, 0, 16);
+
+		//! \todo Send a H2C Command to Firmware for disable this Key in CAM Entry.
+
+		}
+		else{
+			ret= _FAIL;
+			goto exit;
+		}
+	}
+
+exit:
+
+_func_exit_;
+
+	return _TRUE;
+
+}
+
+/*
+* rtw_get_cur_max_rate -
+* @adapter: pointer to _adapter structure
+*
+* Return 0 or 100Kbps
+*/
+u16 rtw_get_cur_max_rate(_adapter *adapter)
+{
+	int	i = 0;
+	u8	*p;
+	u16	rate = 0, max_rate = 0;
+	struct mlme_ext_priv	*pmlmeext = &adapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct registry_priv *pregistrypriv = &adapter->registrypriv;
+	struct mlme_priv	*pmlmepriv = &adapter->mlmepriv;
+	WLAN_BSSID_EX  *pcur_bss = &pmlmepriv->cur_network.network;
+#ifdef CONFIG_80211N_HT
+	struct rtw_ieee80211_ht_cap *pht_capie;
+	u8	rf_type = 0;
+	u8	bw_40MHz=0, short_GI_20=0, short_GI_40=0;
+	u16	mcs_rate=0;
+	u32	ht_ielen = 0;
+#endif
+
+#ifdef CONFIG_MP_INCLUDED
+	if (adapter->registrypriv.mp_mode == 1)
+	{
+		if (check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE)
+			return 0;
+	}
+#endif
+
+	if((check_fwstate(pmlmepriv, _FW_LINKED) != _TRUE)
+		&& (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) != _TRUE))
+		return 0;
+
+#ifdef CONFIG_80211N_HT
+	if (pmlmeext->cur_wireless_mode & (WIRELESS_11_24N|WIRELESS_11_5N)) {
+		p = rtw_get_ie(&pcur_bss->IEs[12], _HT_CAPABILITY_IE_, &ht_ielen, pcur_bss->IELength-12);
+		if(p && ht_ielen>0)
+		{
+			pht_capie = (struct rtw_ieee80211_ht_cap *)(p+2);
+
+			_rtw_memcpy(&mcs_rate , pht_capie->supp_mcs_set, 2);
+
+			//bw_40MHz = (pht_capie->cap_info&IEEE80211_HT_CAP_SUP_WIDTH) ? 1:0;
+			//cur_bwmod is updated by beacon, pmlmeinfo is updated by association response
+			bw_40MHz = (pmlmeext->cur_bwmode && (HT_INFO_HT_PARAM_REC_TRANS_CHNL_WIDTH & pmlmeinfo->HT_info.infos[0])) ? 1:0;
+
+			//short_GI = (pht_capie->cap_info&(IEEE80211_HT_CAP_SGI_20|IEEE80211_HT_CAP_SGI_40)) ? 1:0;
+			short_GI_20 = (pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info&IEEE80211_HT_CAP_SGI_20) ? 1:0;
+			short_GI_40 = (pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info&IEEE80211_HT_CAP_SGI_40) ? 1:0;
+
+			rtw_hal_get_hwreg(adapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+			max_rate = rtw_mcs_rate(
+				rf_type,
+				bw_40MHz & (pregistrypriv->cbw40_enable),
+				short_GI_20,
+				short_GI_40,
+				pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate
+			);
+		}
+	}
+	else
+#endif //CONFIG_80211N_HT
+	{
+		while( (pcur_bss->SupportedRates[i]!=0) && (pcur_bss->SupportedRates[i]!=0xFF))
+		{
+			rate = pcur_bss->SupportedRates[i]&0x7F;
+			if(rate>max_rate)
+				max_rate = rate;
+			i++;
+		}
+
+		max_rate = max_rate*10/2;
+	}
+
+	return max_rate;
+}
+
+/*
+* rtw_set_scan_mode -
+* @adapter: pointer to _adapter structure
+* @scan_mode:
+*
+* Return _SUCCESS or _FAIL
+*/
+int rtw_set_scan_mode(_adapter *adapter, RT_SCAN_TYPE scan_mode)
+{
+	if(scan_mode != SCAN_ACTIVE && scan_mode != SCAN_PASSIVE)
+		return _FAIL;
+
+	adapter->mlmepriv.scan_mode = scan_mode;
+
+	return _SUCCESS;
+}
+
+/*
+* rtw_set_channel_plan -
+* @adapter: pointer to _adapter structure
+* @channel_plan:
+*
+* Return _SUCCESS or _FAIL
+*/
+int rtw_set_channel_plan(_adapter *adapter, u8 channel_plan)
+{
+	struct registry_priv *pregistrypriv = &adapter->registrypriv;
+	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
+
+	//handle by cmd_thread to sync with scan operation
+	return rtw_set_chplan_cmd(adapter, channel_plan, 1);
+}
+
+/*
+* rtw_set_country -
+* @adapter: pointer to _adapter structure
+* @country_code: string of country code
+*
+* Return _SUCCESS or _FAIL
+*/
+int rtw_set_country(_adapter *adapter, const char *country_code)
+{
+	int channel_plan = RT_CHANNEL_DOMAIN_WORLD_WIDE_5G;
+
+	DBG_871X("%s country_code:%s\n", __func__, country_code);
+
+	//TODO: should have a table to match country code and RT_CHANNEL_DOMAIN
+	//TODO: should consider 2-character and 3-character country code
+	if(0 == strcmp(country_code, "US"))
+		channel_plan = RT_CHANNEL_DOMAIN_FCC;
+	else if(0 == strcmp(country_code, "EU"))
+		channel_plan = RT_CHANNEL_DOMAIN_ETSI;
+	else if(0 == strcmp(country_code, "JP"))
+		channel_plan = RT_CHANNEL_DOMAIN_MKK;
+	else if(0 == strcmp(country_code, "CN"))
+		channel_plan = RT_CHANNEL_DOMAIN_CHINA;
+	else
+		DBG_871X("%s unknown country_code:%s\n", __FUNCTION__, country_code);
+
+	return rtw_set_channel_plan(adapter, channel_plan);
+}
+
+/*
+* rtw_set_band -
+* @adapter: pointer to _adapter structure
+* @band: band to set
+*
+* Return _SUCCESS or _FAIL
+*/
+int rtw_set_band(_adapter *adapter, enum _BAND band)
+{
+	if (rtw_band_valid(band)) {
+		DBG_871X(FUNC_ADPT_FMT" band:%d\n", FUNC_ADPT_ARG(adapter), band);
+		adapter->setband = band;
+		return _SUCCESS;
+	}
+
+	DBG_871X_LEVEL(_drv_always_, FUNC_ADPT_FMT" band:%d fail\n", FUNC_ADPT_ARG(adapter), band);
+	return _FAIL;
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_iol.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_iol.c
new file mode 100644
index 000000000000..20632d66bb4c
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_iol.c
@@ -0,0 +1,262 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#include<rtw_iol.h>
+
+#ifdef CONFIG_IOL
+struct xmit_frame	*rtw_IOL_accquire_xmit_frame(ADAPTER *adapter)
+{
+	struct xmit_frame	*xmit_frame;
+	struct xmit_buf	*xmitbuf;
+	struct pkt_attrib	*pattrib;
+	struct xmit_priv	*pxmitpriv = &(adapter->xmitpriv);
+
+#if 1
+	if ((xmit_frame = rtw_alloc_xmitframe(pxmitpriv)) == NULL)
+	{
+		DBG_871X("%s rtw_alloc_xmitframe return null\n", __FUNCTION__);
+		goto exit;
+	}
+
+	if ((xmitbuf = rtw_alloc_xmitbuf(pxmitpriv)) == NULL)
+	{
+		DBG_871X("%s rtw_alloc_xmitbuf return null\n", __FUNCTION__);
+		rtw_free_xmitframe(pxmitpriv, xmit_frame);
+		xmit_frame=NULL;
+		goto exit;
+	}
+
+	xmit_frame->frame_tag = MGNT_FRAMETAG;
+	xmit_frame->pxmitbuf = xmitbuf;
+	xmit_frame->buf_addr = xmitbuf->pbuf;
+	xmitbuf->priv_data = xmit_frame;
+
+	pattrib = &xmit_frame->attrib;
+	update_mgntframe_attrib(adapter, pattrib);
+	pattrib->qsel = 0x10;
+	pattrib->pktlen = pattrib->last_txcmdsz = 0;
+
+#else
+	if ((xmit_frame = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		DBG_871X("%s alloc_mgtxmitframe return null\n", __FUNCTION__);
+	}
+	else {
+		pattrib = &xmit_frame->attrib;
+		update_mgntframe_attrib(adapter, pattrib);
+		pattrib->qsel = 0x10;
+		pattrib->pktlen = pattrib->last_txcmdsz = 0;
+	}
+#endif
+
+exit:
+	return xmit_frame;
+}
+
+
+int rtw_IOL_append_cmds(struct xmit_frame *xmit_frame, u8 *IOL_cmds, u32 cmd_len)
+{
+	struct pkt_attrib	*pattrib = &xmit_frame->attrib;
+	u16 buf_offset;
+	u32 ori_len;
+
+//Todo: bulkout without this offset
+#ifdef CONFIG_USB_HCI
+	buf_offset = TXDESC_OFFSET;
+#else
+	buf_offset = 0;
+#endif
+
+	ori_len = buf_offset+pattrib->pktlen;
+
+	//check if the io_buf can accommodate new cmds
+	if(ori_len + cmd_len + 8 > MAX_XMITBUF_SZ) {
+		DBG_871X("%s %u is large than MAX_XMITBUF_SZ:%u, can't accommodate new cmds\n", __FUNCTION__
+			, ori_len + cmd_len + 8, MAX_XMITBUF_SZ);
+		return _FAIL;
+	}
+
+	_rtw_memcpy(xmit_frame->buf_addr + buf_offset + pattrib->pktlen, IOL_cmds, cmd_len);
+	pattrib->pktlen += cmd_len;
+	pattrib->last_txcmdsz += cmd_len;
+
+	//DBG_871X("%s ori:%u + cmd_len:%u = %u\n", __FUNCTION__, ori_len, cmd_len, buf_offset+pattrib->pktlen);
+
+	return _SUCCESS;
+}
+
+int rtw_IOL_append_LLT_cmd(struct xmit_frame *xmit_frame, u8 page_boundary)
+{
+	IOL_CMD cmd = {0x0, IOL_CMD_LLT, 0x0, 0x0};
+
+	RTW_PUT_BE32((u8*)&cmd.value, (u32)page_boundary);
+
+	return rtw_IOL_append_cmds(xmit_frame, (u8*)&cmd, 8);
+}
+
+int _rtw_IOL_append_WB_cmd(struct xmit_frame *xmit_frame, u16 addr, u8 value)
+{
+	IOL_CMD cmd = {0x0, IOL_CMD_WB_REG, 0x0, 0x0};
+
+	RTW_PUT_BE16((u8*)&cmd.address, (u16)addr);
+	RTW_PUT_BE32((u8*)&cmd.value, (u32)value);
+
+	return rtw_IOL_append_cmds(xmit_frame, (u8*)&cmd, 8);
+}
+
+int _rtw_IOL_append_WW_cmd(struct xmit_frame *xmit_frame, u16 addr, u16 value)
+{
+	IOL_CMD cmd = {0x0, IOL_CMD_WW_REG, 0x0, 0x0};
+
+	RTW_PUT_BE16((u8*)&cmd.address, (u16)addr);
+	RTW_PUT_BE32((u8*)&cmd.value, (u32)value);
+
+	return rtw_IOL_append_cmds(xmit_frame, (u8*)&cmd, 8);
+}
+
+int _rtw_IOL_append_WD_cmd(struct xmit_frame *xmit_frame, u16 addr, u32 value)
+{
+	IOL_CMD cmd = {0x0, IOL_CMD_WD_REG, 0x0, 0x0};
+	u8* pos = (u8 *)&cmd;
+
+	RTW_PUT_BE16((u8*)&cmd.address, (u16)addr);
+	RTW_PUT_BE32((u8*)&cmd.value, (u32)value);
+
+	return rtw_IOL_append_cmds(xmit_frame, (u8*)&cmd, 8);
+}
+
+#ifdef DBG_IO
+int dbg_rtw_IOL_append_WB_cmd(struct xmit_frame *xmit_frame, u16 addr, u8 value, const char *caller, const int line)
+{
+	if (match_write_sniff_ranges(addr, 1))
+		DBG_871X("DBG_IO %s:%d IOL_WB(0x%04x, 0x%02x)\n", caller, line, addr, value);
+
+	return _rtw_IOL_append_WB_cmd(xmit_frame, addr, value);
+}
+
+int dbg_rtw_IOL_append_WW_cmd(struct xmit_frame *xmit_frame, u16 addr, u16 value, const char *caller, const int line)
+{
+	if (match_write_sniff_ranges(addr, 2))
+		DBG_871X("DBG_IO %s:%d IOL_WW(0x%04x, 0x%04x)\n", caller, line, addr, value);
+
+	return _rtw_IOL_append_WW_cmd(xmit_frame, addr, value);
+}
+
+int dbg_rtw_IOL_append_WD_cmd(struct xmit_frame *xmit_frame, u16 addr, u32 value, const char *caller, const int line)
+{
+	if (match_write_sniff_ranges(addr, 4))
+		DBG_871X("DBG_IO %s:%d IOL_WD(0x%04x, 0x%08x)\n", caller, line, addr, value);
+
+	return _rtw_IOL_append_WD_cmd(xmit_frame, addr, value);
+}
+#endif
+
+int rtw_IOL_append_DELAY_US_cmd(struct xmit_frame *xmit_frame, u16 us)
+{
+	IOL_CMD cmd = {0x0, IOL_CMD_DELAY_US, 0x0, 0x0};
+
+	RTW_PUT_BE32((u8*)&cmd.value, (u32)us);
+
+	//DBG_871X("%s %u\n", __FUNCTION__, us);
+
+	return rtw_IOL_append_cmds(xmit_frame, (u8*)&cmd, 8);
+}
+
+int rtw_IOL_append_DELAY_MS_cmd(struct xmit_frame *xmit_frame, u16 ms)
+{
+	IOL_CMD cmd = {0x0, IOL_CMD_DELAY_MS, 0x0, 0x0};
+
+	RTW_PUT_BE32((u8*)&cmd.value, (u32)ms);
+
+	//DBG_871X("%s %u\n", __FUNCTION__, ms);
+
+	return rtw_IOL_append_cmds(xmit_frame, (u8*)&cmd, 8);
+}
+
+int rtw_IOL_append_END_cmd(struct xmit_frame *xmit_frame)
+{
+	struct pkt_attrib	*pattrib = &xmit_frame->attrib;
+	u16 buf_offset;
+	u32 ori_len;
+	IOL_CMD end_cmd = {0x0, IOL_CMD_END, 0x0, 0x0};
+
+//Todo: bulkout without this offset
+#ifdef CONFIG_USB_HCI
+	buf_offset = TXDESC_OFFSET;
+#else
+	buf_offset = 0;
+#endif
+
+	ori_len = buf_offset+pattrib->pktlen;
+
+	//check if the io_buf can accommodate new cmds
+	if(ori_len + 8 > MAX_XMITBUF_SZ) {
+		DBG_871X("%s %u is large than MAX_XMITBUF_SZ:%u, can't accommodate end cmd\n", __FUNCTION__
+			, ori_len + 8, MAX_XMITBUF_SZ);
+		return _FAIL;
+	}
+
+	_rtw_memcpy(xmit_frame->buf_addr + buf_offset + pattrib->pktlen, (u8*)&end_cmd, 8);
+	pattrib->pktlen += 8;
+	pattrib->last_txcmdsz += 8;
+
+	//DBG_871X("%s ori:%u + 8 = %u\n", __FUNCTION__ , ori_len, buf_offset+pattrib->pktlen);
+
+	return _SUCCESS;
+}
+
+int rtw_IOL_exec_cmds_sync(ADAPTER *adapter, struct xmit_frame *xmit_frame, u32 max_wating_ms)
+{
+	return rtw_hal_iol_cmd(adapter, xmit_frame, max_wating_ms);
+}
+
+int rtw_IOL_exec_cmd_array_sync(PADAPTER adapter, u8 *IOL_cmds, u32 cmd_num, u32 max_wating_ms)
+{
+	struct xmit_frame	*xmit_frame;
+
+	if((xmit_frame=rtw_IOL_accquire_xmit_frame(adapter)) == NULL)
+		return _FAIL;
+
+	if(rtw_IOL_append_cmds(xmit_frame, IOL_cmds, cmd_num<<3) == _FAIL)
+		return _FAIL;
+
+	return rtw_IOL_exec_cmds_sync(adapter, xmit_frame, max_wating_ms);
+}
+
+int rtw_IOL_exec_empty_cmds_sync(ADAPTER *adapter, u32 max_wating_ms)
+{
+	IOL_CMD end_cmd = {0x0, IOL_CMD_END, 0x0, 0x0};
+	return rtw_IOL_exec_cmd_array_sync(adapter, (u8*)&end_cmd, 1, max_wating_ms);
+}
+
+bool rtw_IOL_applied(ADAPTER *adapter)
+{
+	if(adapter->registrypriv.force_iol)
+		return _TRUE;
+
+#ifdef CONFIG_USB_HCI
+	if(!adapter_to_dvobj(adapter)->ishighspeed)
+		return _TRUE;
+#endif
+
+	return _FALSE;
+}
+
+#endif //CONFIG_IOL
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mlme.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mlme.c
new file mode 100644
index 000000000000..2dc13a43c118
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mlme.c
@@ -0,0 +1,3966 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_MLME_C_
+
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#include <xmit_osdep.h>
+#include <hal_intf.h>
+#include <mlme_osdep.h>
+#include <sta_info.h>
+#include <wifi.h>
+#include <wlan_bssdef.h>
+#include <rtw_ioctl_set.h>
+
+extern void indicate_wx_scan_complete_event(_adapter *padapter);
+extern u8 rtw_do_join(_adapter * padapter);
+
+#ifdef CONFIG_DISABLE_MCS13TO15
+extern unsigned char	MCS_rate_2R_MCS13TO15_OFF[16];
+extern unsigned char	MCS_rate_2R[16];
+#else //CONFIG_DISABLE_MCS13TO15
+extern unsigned char	MCS_rate_2R[16];
+#endif //CONFIG_DISABLE_MCS13TO15
+extern unsigned char	MCS_rate_1R[16];
+
+sint	_rtw_init_mlme_priv (_adapter* padapter)
+{
+	sint	i;
+	u8	*pbuf;
+	struct wlan_network	*pnetwork;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	sint	res = _SUCCESS;
+
+_func_enter_;
+
+	// We don't need to memset padapter->XXX to zero, because adapter is allocated by rtw_zvmalloc().
+	//_rtw_memset((u8 *)pmlmepriv, 0, sizeof(struct mlme_priv));
+
+	pmlmepriv->nic_hdl = (u8 *)padapter;
+
+	pmlmepriv->pscanned = NULL;
+	pmlmepriv->fw_state = 0;
+	pmlmepriv->cur_network.network.InfrastructureMode = Ndis802_11AutoUnknown;
+	pmlmepriv->scan_mode=SCAN_ACTIVE;// 1: active, 0: pasive. Maybe someday we should rename this varable to "active_mode" (Jeff)
+
+	_rtw_spinlock_init(&(pmlmepriv->lock));
+	_rtw_init_queue(&(pmlmepriv->free_bss_pool));
+	_rtw_init_queue(&(pmlmepriv->scanned_queue));
+
+	set_scanned_network_val(pmlmepriv, 0);
+
+	_rtw_memset(&pmlmepriv->assoc_ssid,0,sizeof(NDIS_802_11_SSID));
+
+	pbuf = rtw_zvmalloc(MAX_BSS_CNT * (sizeof(struct wlan_network)));
+
+	if (pbuf == NULL){
+		res=_FAIL;
+		goto exit;
+	}
+	pmlmepriv->free_bss_buf = pbuf;
+
+	pnetwork = (struct wlan_network *)pbuf;
+
+	for(i = 0; i < MAX_BSS_CNT; i++)
+	{
+		_rtw_init_listhead(&(pnetwork->list));
+
+		rtw_list_insert_tail(&(pnetwork->list), &(pmlmepriv->free_bss_pool.queue));
+
+		pnetwork++;
+	}
+
+	//allocate DMA-able/Non-Page memory for cmd_buf and rsp_buf
+
+	rtw_clear_scan_deny(padapter);
+
+	rtw_init_mlme_timer(padapter);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+void rtw_mfree_mlme_priv_lock (struct mlme_priv *pmlmepriv);
+void rtw_mfree_mlme_priv_lock (struct mlme_priv *pmlmepriv)
+{
+	_rtw_spinlock_free(&pmlmepriv->lock);
+	_rtw_spinlock_free(&(pmlmepriv->free_bss_pool.lock));
+	_rtw_spinlock_free(&(pmlmepriv->scanned_queue.lock));
+}
+
+static void rtw_free_mlme_ie_data(u8 **ppie, u32 *plen)
+{
+	if(*ppie)
+	{
+		rtw_mfree(*ppie, *plen);
+		*plen = 0;
+		*ppie=NULL;
+	}
+}
+
+void rtw_free_mlme_priv_ie_data(struct mlme_priv *pmlmepriv)
+{
+#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	rtw_buf_free(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len);
+	rtw_buf_free(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->wps_beacon_ie, &pmlmepriv->wps_beacon_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->wps_probe_req_ie, &pmlmepriv->wps_probe_req_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->wps_probe_resp_ie, &pmlmepriv->wps_probe_resp_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->wps_assoc_resp_ie, &pmlmepriv->wps_assoc_resp_ie_len);
+
+	rtw_free_mlme_ie_data(&pmlmepriv->p2p_beacon_ie, &pmlmepriv->p2p_beacon_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->p2p_probe_req_ie, &pmlmepriv->p2p_probe_req_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->p2p_probe_resp_ie, &pmlmepriv->p2p_probe_resp_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->p2p_go_probe_resp_ie, &pmlmepriv->p2p_go_probe_resp_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->p2p_assoc_req_ie, &pmlmepriv->p2p_assoc_req_ie_len);
+#endif
+
+#if defined(CONFIG_WFD) && defined(CONFIG_IOCTL_CFG80211)
+	rtw_free_mlme_ie_data(&pmlmepriv->wfd_beacon_ie, &pmlmepriv->wfd_beacon_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->wfd_probe_req_ie, &pmlmepriv->wfd_probe_req_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->wfd_probe_resp_ie, &pmlmepriv->wfd_probe_resp_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->wfd_go_probe_resp_ie, &pmlmepriv->wfd_go_probe_resp_ie_len);
+	rtw_free_mlme_ie_data(&pmlmepriv->wfd_assoc_req_ie, &pmlmepriv->wfd_assoc_req_ie_len);
+#endif
+
+}
+
+void _rtw_free_mlme_priv (struct mlme_priv *pmlmepriv)
+{
+_func_enter_;
+
+	rtw_free_mlme_priv_ie_data(pmlmepriv);
+
+	if(pmlmepriv){
+		rtw_mfree_mlme_priv_lock (pmlmepriv);
+
+		if (pmlmepriv->free_bss_buf) {
+			rtw_vmfree(pmlmepriv->free_bss_buf, MAX_BSS_CNT * sizeof(struct wlan_network));
+		}
+	}
+_func_exit_;
+}
+
+sint	_rtw_enqueue_network(_queue *queue, struct wlan_network *pnetwork)
+{
+	_irqL irqL;
+
+_func_enter_;
+
+	if (pnetwork == NULL)
+		goto exit;
+
+	_enter_critical_bh(&queue->lock, &irqL);
+
+	rtw_list_insert_tail(&pnetwork->list, &queue->queue);
+
+	_exit_critical_bh(&queue->lock, &irqL);
+
+exit:
+
+_func_exit_;
+
+	return _SUCCESS;
+}
+
+struct	wlan_network *_rtw_dequeue_network(_queue *queue)
+{
+	_irqL irqL;
+
+	struct wlan_network *pnetwork;
+
+_func_enter_;
+
+	_enter_critical_bh(&queue->lock, &irqL);
+
+	if (_rtw_queue_empty(queue) == _TRUE)
+
+		pnetwork = NULL;
+
+	else
+	{
+		pnetwork = LIST_CONTAINOR(get_next(&queue->queue), struct wlan_network, list);
+
+		rtw_list_delete(&(pnetwork->list));
+	}
+
+	_exit_critical_bh(&queue->lock, &irqL);
+
+_func_exit_;
+
+	return pnetwork;
+}
+
+struct	wlan_network *_rtw_alloc_network(struct	mlme_priv *pmlmepriv )//(_queue *free_queue)
+{
+	_irqL	irqL;
+	struct	wlan_network	*pnetwork;
+	_queue *free_queue = &pmlmepriv->free_bss_pool;
+	_list* plist = NULL;
+
+_func_enter_;
+
+	_enter_critical_bh(&free_queue->lock, &irqL);
+
+	if (_rtw_queue_empty(free_queue) == _TRUE) {
+		pnetwork=NULL;
+		goto exit;
+	}
+	plist = get_next(&(free_queue->queue));
+
+	pnetwork = LIST_CONTAINOR(plist , struct wlan_network, list);
+
+	rtw_list_delete(&pnetwork->list);
+
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("_rtw_alloc_network: ptr=%p\n", plist));
+	pnetwork->network_type = 0;
+	pnetwork->fixed = _FALSE;
+	pnetwork->last_scanned = rtw_get_current_time();
+	pnetwork->aid=0;
+	pnetwork->join_res=0;
+
+	pmlmepriv->num_of_scanned ++;
+
+exit:
+	_exit_critical_bh(&free_queue->lock, &irqL);
+
+_func_exit_;
+
+	return pnetwork;
+}
+
+void _rtw_free_network(struct	mlme_priv *pmlmepriv ,struct wlan_network *pnetwork, u8 isfreeall)
+{
+	u32 curr_time, delta_time;
+	u32 lifetime = SCANQUEUE_LIFETIME;
+	_irqL irqL;
+	_queue *free_queue = &(pmlmepriv->free_bss_pool);
+
+_func_enter_;
+
+	if (pnetwork == NULL)
+		goto exit;
+
+	if (pnetwork->fixed == _TRUE)
+		goto exit;
+
+	curr_time = rtw_get_current_time();
+
+	if ( (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)==_TRUE ) ||
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)==_TRUE ) )
+		lifetime = 1;
+
+	if(!isfreeall)
+	{
+#ifdef PLATFORM_WINDOWS
+
+		delta_time = (curr_time -pnetwork->last_scanned)/10;
+
+		if(delta_time  < lifetime*1000000)// unit:usec
+		{
+			goto exit;
+		}
+
+#endif
+
+#ifdef PLATFORM_LINUX
+
+		delta_time = (curr_time -pnetwork->last_scanned)/HZ;
+
+		if(delta_time < lifetime)// unit:sec
+		{
+			goto exit;
+		}
+
+#endif
+
+#ifdef PLATFORM_FREEBSD
+        //i think needs to check again
+		delta_time = (curr_time -pnetwork->last_scanned)/hz;
+
+		if(delta_time < lifetime)// unit:sec
+		{
+			goto exit;
+		}
+
+#endif
+	}
+
+	_enter_critical_bh(&free_queue->lock, &irqL);
+
+	rtw_list_delete(&(pnetwork->list));
+
+	rtw_list_insert_tail(&(pnetwork->list),&(free_queue->queue));
+
+	pmlmepriv->num_of_scanned --;
+
+
+	//DBG_871X("_rtw_free_network:SSID=%s\n", pnetwork->network.Ssid.Ssid);
+
+	_exit_critical_bh(&free_queue->lock, &irqL);
+
+exit:
+
+_func_exit_;
+
+}
+
+void _rtw_free_network_nolock(struct	mlme_priv *pmlmepriv, struct wlan_network *pnetwork)
+{
+
+	_queue *free_queue = &(pmlmepriv->free_bss_pool);
+
+_func_enter_;
+
+	if (pnetwork == NULL)
+		goto exit;
+
+	if (pnetwork->fixed == _TRUE)
+		goto exit;
+
+	//_enter_critical(&free_queue->lock, &irqL);
+
+	rtw_list_delete(&(pnetwork->list));
+
+	rtw_list_insert_tail(&(pnetwork->list), get_list_head(free_queue));
+
+	pmlmepriv->num_of_scanned --;
+
+	//_exit_critical(&free_queue->lock, &irqL);
+
+exit:
+
+_func_exit_;
+
+}
+
+
+/*
+	return the wlan_network with the matching addr
+
+	Shall be calle under atomic context... to avoid possible racing condition...
+*/
+struct wlan_network *_rtw_find_network(_queue *scanned_queue, u8 *addr)
+{
+
+	//_irqL irqL;
+	_list	*phead, *plist;
+	struct	wlan_network *pnetwork = NULL;
+	u8 zero_addr[ETH_ALEN] = {0,0,0,0,0,0};
+
+_func_enter_;
+
+	if(_rtw_memcmp(zero_addr, addr, ETH_ALEN)){
+		pnetwork=NULL;
+		goto exit;
+	}
+
+	//_enter_critical_bh(&scanned_queue->lock, &irqL);
+
+	phead = get_list_head(scanned_queue);
+	plist = get_next(phead);
+
+	while (plist != phead)
+       {
+                pnetwork = LIST_CONTAINOR(plist, struct wlan_network ,list);
+
+		if (_rtw_memcmp(addr, pnetwork->network.MacAddress, ETH_ALEN) == _TRUE)
+                        break;
+
+		plist = get_next(plist);
+        }
+
+	if(plist == phead)
+		pnetwork = NULL;
+
+	//_exit_critical_bh(&scanned_queue->lock, &irqL);
+
+exit:
+
+_func_exit_;
+
+	return pnetwork;
+
+}
+
+
+void _rtw_free_network_queue(_adapter *padapter, u8 isfreeall)
+{
+	_irqL irqL;
+	_list *phead, *plist;
+	struct wlan_network *pnetwork;
+	struct mlme_priv* pmlmepriv = &padapter->mlmepriv;
+	_queue *scanned_queue = &pmlmepriv->scanned_queue;
+
+_func_enter_;
+
+
+	_enter_critical_bh(&scanned_queue->lock, &irqL);
+
+	phead = get_list_head(scanned_queue);
+	plist = get_next(phead);
+
+	while (rtw_end_of_queue_search(phead, plist) == _FALSE)
+	{
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+
+		plist = get_next(plist);
+
+		_rtw_free_network(pmlmepriv,pnetwork, isfreeall);
+
+	}
+
+	_exit_critical_bh(&scanned_queue->lock, &irqL);
+
+_func_exit_;
+
+}
+
+
+
+
+sint rtw_if_up(_adapter *padapter)	{
+
+	sint res;
+_func_enter_;
+
+	if( padapter->bDriverStopped || padapter->bSurpriseRemoved ||
+		(check_fwstate(&padapter->mlmepriv, _FW_LINKED)== _FALSE)){
+		RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("rtw_if_up:bDriverStopped(%d) OR bSurpriseRemoved(%d)", padapter->bDriverStopped, padapter->bSurpriseRemoved));
+		res=_FALSE;
+	}
+	else
+		res=  _TRUE;
+
+_func_exit_;
+	return res;
+}
+
+
+void rtw_generate_random_ibss(u8* pibss)
+{
+	u32	curtime = rtw_get_current_time();
+
+_func_enter_;
+	pibss[0] = 0x02;  //in ad-hoc mode bit1 must set to 1
+	pibss[1] = 0x11;
+	pibss[2] = 0x87;
+	pibss[3] = (u8)(curtime & 0xff) ;//p[0];
+	pibss[4] = (u8)((curtime>>8) & 0xff) ;//p[1];
+	pibss[5] = (u8)((curtime>>16) & 0xff) ;//p[2];
+_func_exit_;
+	return;
+}
+
+u8 *rtw_get_capability_from_ie(u8 *ie)
+{
+	return (ie + 8 + 2);
+}
+
+
+u16 rtw_get_capability(WLAN_BSSID_EX *bss)
+{
+	u16	val;
+_func_enter_;
+
+	_rtw_memcpy((u8 *)&val, rtw_get_capability_from_ie(bss->IEs), 2);
+
+_func_exit_;
+	return le16_to_cpu(val);
+}
+
+u8 *rtw_get_timestampe_from_ie(u8 *ie)
+{
+	return (ie + 0);
+}
+
+u8 *rtw_get_beacon_interval_from_ie(u8 *ie)
+{
+	return (ie + 8);
+}
+
+
+int	rtw_init_mlme_priv (_adapter *padapter)//(struct	mlme_priv *pmlmepriv)
+{
+	int	res;
+_func_enter_;
+	res = _rtw_init_mlme_priv(padapter);// (pmlmepriv);
+_func_exit_;
+	return res;
+}
+
+void rtw_free_mlme_priv (struct mlme_priv *pmlmepriv)
+{
+_func_enter_;
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("rtw_free_mlme_priv\n"));
+	_rtw_free_mlme_priv (pmlmepriv);
+_func_exit_;
+}
+
+int	rtw_enqueue_network(_queue *queue, struct wlan_network *pnetwork);
+int	rtw_enqueue_network(_queue *queue, struct wlan_network *pnetwork)
+{
+	int	res;
+_func_enter_;
+	res = _rtw_enqueue_network(queue, pnetwork);
+_func_exit_;
+	return res;
+}
+
+
+#ifndef PLATFORM_FREEBSD //Baron
+static struct	wlan_network *rtw_dequeue_network(_queue *queue)
+{
+	struct wlan_network *pnetwork;
+_func_enter_;
+	pnetwork = _rtw_dequeue_network(queue);
+_func_exit_;
+	return pnetwork;
+}
+#endif //PLATFORM_FREEBSD
+
+struct	wlan_network *rtw_alloc_network(struct	mlme_priv *pmlmepriv );
+struct	wlan_network *rtw_alloc_network(struct	mlme_priv *pmlmepriv )//(_queue	*free_queue)
+{
+	struct	wlan_network	*pnetwork;
+_func_enter_;
+	pnetwork = _rtw_alloc_network(pmlmepriv);
+_func_exit_;
+	return pnetwork;
+}
+
+void rtw_free_network(struct mlme_priv *pmlmepriv, struct	wlan_network *pnetwork, u8 is_freeall);
+void rtw_free_network(struct mlme_priv *pmlmepriv, struct	wlan_network *pnetwork, u8 is_freeall)//(struct	wlan_network *pnetwork, _queue	*free_queue)
+{
+_func_enter_;
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("rtw_free_network==> ssid = %s \n\n" , pnetwork->network.Ssid.Ssid));
+	_rtw_free_network(pmlmepriv, pnetwork, is_freeall);
+_func_exit_;
+}
+
+void rtw_free_network_nolock(struct mlme_priv *pmlmepriv, struct wlan_network *pnetwork );
+void rtw_free_network_nolock(struct mlme_priv *pmlmepriv, struct wlan_network *pnetwork )
+{
+_func_enter_;
+	//RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("rtw_free_network==> ssid = %s \n\n" , pnetwork->network.Ssid.Ssid));
+	_rtw_free_network_nolock(pmlmepriv, pnetwork);
+_func_exit_;
+}
+
+
+void rtw_free_network_queue(_adapter* dev, u8 isfreeall)
+{
+_func_enter_;
+	_rtw_free_network_queue(dev, isfreeall);
+_func_exit_;
+}
+
+/*
+	return the wlan_network with the matching addr
+
+	Shall be calle under atomic context... to avoid possible racing condition...
+*/
+struct	wlan_network *rtw_find_network(_queue *scanned_queue, u8 *addr)
+{
+	struct	wlan_network *pnetwork = _rtw_find_network(scanned_queue, addr);
+
+	return pnetwork;
+}
+
+int rtw_is_same_ibss(_adapter *adapter, struct wlan_network *pnetwork)
+{
+	int ret=_TRUE;
+	struct security_priv *psecuritypriv = &adapter->securitypriv;
+
+	if ( (psecuritypriv->dot11PrivacyAlgrthm != _NO_PRIVACY_ ) &&
+		    ( pnetwork->network.Privacy == 0 ) )
+	{
+		ret=_FALSE;
+	}
+	else if((psecuritypriv->dot11PrivacyAlgrthm == _NO_PRIVACY_ ) &&
+		 ( pnetwork->network.Privacy == 1 ) )
+	{
+		ret=_FALSE;
+	}
+	else
+	{
+		ret=_TRUE;
+	}
+
+	return ret;
+
+}
+
+inline int is_same_ess(WLAN_BSSID_EX *a, WLAN_BSSID_EX *b);
+inline int is_same_ess(WLAN_BSSID_EX *a, WLAN_BSSID_EX *b)
+{
+	//RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("(%s,%d)(%s,%d)\n",
+	//		a->Ssid.Ssid,a->Ssid.SsidLength,b->Ssid.Ssid,b->Ssid.SsidLength));
+	return (a->Ssid.SsidLength == b->Ssid.SsidLength)
+		&&  _rtw_memcmp(a->Ssid.Ssid, b->Ssid.Ssid, a->Ssid.SsidLength)==_TRUE;
+}
+
+int is_same_network(WLAN_BSSID_EX *src, WLAN_BSSID_EX *dst)
+{
+	 u16 s_cap, d_cap;
+
+_func_enter_;
+
+#ifdef PLATFORM_OS_XP
+	 if ( ((uint)dst) <= 0x7fffffff ||
+		((uint)src) <= 0x7fffffff ||
+		((uint)&s_cap) <= 0x7fffffff ||
+		((uint)&d_cap) <= 0x7fffffff)
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("\n@@@@ error address of dst\n"));
+
+		KeBugCheckEx(0x87110000, (ULONG_PTR)dst, (ULONG_PTR)src,(ULONG_PTR)&s_cap, (ULONG_PTR)&d_cap);
+
+		return _FALSE;
+	}
+#endif
+
+
+	_rtw_memcpy((u8 *)&s_cap, rtw_get_capability_from_ie(src->IEs), 2);
+	_rtw_memcpy((u8 *)&d_cap, rtw_get_capability_from_ie(dst->IEs), 2);
+
+
+	s_cap = le16_to_cpu(s_cap);
+	d_cap = le16_to_cpu(d_cap);
+
+_func_exit_;
+
+	return ((src->Ssid.SsidLength == dst->Ssid.SsidLength) &&
+		//	(src->Configuration.DSConfig == dst->Configuration.DSConfig) &&
+			( (_rtw_memcmp(src->MacAddress, dst->MacAddress, ETH_ALEN)) == _TRUE) &&
+			( (_rtw_memcmp(src->Ssid.Ssid, dst->Ssid.Ssid, src->Ssid.SsidLength)) == _TRUE) &&
+			((s_cap & WLAN_CAPABILITY_IBSS) ==
+			(d_cap & WLAN_CAPABILITY_IBSS)) &&
+			((s_cap & WLAN_CAPABILITY_BSS) ==
+			(d_cap & WLAN_CAPABILITY_BSS)));
+
+}
+
+struct	wlan_network	* rtw_get_oldest_wlan_network(_queue *scanned_queue)
+{
+	_list	*plist, *phead;
+
+
+	struct	wlan_network	*pwlan = NULL;
+	struct	wlan_network	*oldest = NULL;
+_func_enter_;
+	phead = get_list_head(scanned_queue);
+
+	plist = get_next(phead);
+
+	while(1)
+	{
+
+		if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+			break;
+
+		pwlan= LIST_CONTAINOR(plist, struct wlan_network, list);
+
+		if(pwlan->fixed!=_TRUE)
+		{
+			if (oldest == NULL ||time_after(oldest->last_scanned, pwlan->last_scanned))
+				oldest = pwlan;
+		}
+
+		plist = get_next(plist);
+	}
+_func_exit_;
+	return oldest;
+
+}
+
+static void update_network(WLAN_BSSID_EX *dst, WLAN_BSSID_EX *src,
+	_adapter * padapter, bool update_ie)
+{
+	u8 ss_ori = dst->PhyInfo.SignalStrength;
+	u8 sq_ori = dst->PhyInfo.SignalQuality;
+	long rssi_ori = dst->Rssi;
+
+	u8 ss_smp = src->PhyInfo.SignalStrength;
+	u8 sq_smp = src->PhyInfo.SignalQuality;
+	long rssi_smp = src->Rssi;
+
+	u8 ss_final;
+	u8 sq_final;
+	long rssi_final;
+
+_func_enter_;
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+	rtw_hal_antdiv_rssi_compared(padapter, dst, src); //this will update src.Rssi, need consider again
+#endif
+
+	#if defined(DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED) && 1
+	if(strcmp(dst->Ssid.Ssid, DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED) == 0) {
+		DBG_871X(FUNC_ADPT_FMT" %s("MAC_FMT", ch%u) ss_ori:%3u, sq_ori:%3u, rssi_ori:%3ld, ss_smp:%3u, sq_smp:%3u, rssi_smp:%3ld\n"
+			, FUNC_ADPT_ARG(padapter)
+			, src->Ssid.Ssid, MAC_ARG(src->MacAddress), src->Configuration.DSConfig
+			,ss_ori, sq_ori, rssi_ori
+			,ss_smp, sq_smp, rssi_smp
+		);
+	}
+	#endif
+
+	/* The rule below is 1/5 for sample value, 4/5 for history value */
+	if (check_fwstate(&padapter->mlmepriv, _FW_LINKED) && is_same_network(&(padapter->mlmepriv.cur_network.network), src)) {
+		/* Take the recvpriv's value for the connected AP*/
+		ss_final = padapter->recvpriv.signal_strength;
+		sq_final = padapter->recvpriv.signal_qual;
+		/* the rssi value here is undecorated, and will be used for antenna diversity */
+		if(sq_smp != 101) /* from the right channel */
+			rssi_final = (src->Rssi+dst->Rssi*4)/5;
+		else
+			rssi_final = rssi_ori;
+	}
+	else {
+		if(sq_smp != 101) { /* from the right channel */
+			ss_final = ((u32)(src->PhyInfo.SignalStrength)+(u32)(dst->PhyInfo.SignalStrength)*4)/5;
+			sq_final = ((u32)(src->PhyInfo.SignalQuality)+(u32)(dst->PhyInfo.SignalQuality)*4)/5;
+			rssi_final = (src->Rssi+dst->Rssi*4)/5;
+		} else {
+			/* bss info not receving from the right channel, use the original RX signal infos */
+			ss_final = dst->PhyInfo.SignalStrength;
+			sq_final = dst->PhyInfo.SignalQuality;
+			rssi_final = dst->Rssi;
+		}
+
+	}
+
+	if (update_ie)
+		_rtw_memcpy((u8 *)dst, (u8 *)src, get_WLAN_BSSID_EX_sz(src));
+
+	dst->PhyInfo.SignalStrength = ss_final;
+	dst->PhyInfo.SignalQuality = sq_final;
+	dst->Rssi = rssi_final;
+
+	#if defined(DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED) && 1
+	if(strcmp(dst->Ssid.Ssid, DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED) == 0) {
+		DBG_871X(FUNC_ADPT_FMT" %s("MAC_FMT"), SignalStrength:%u, SignalQuality:%u, RawRSSI:%ld\n"
+			, FUNC_ADPT_ARG(padapter)
+			, dst->Ssid.Ssid, MAC_ARG(dst->MacAddress), dst->PhyInfo.SignalStrength, dst->PhyInfo.SignalQuality, dst->Rssi);
+	}
+	#endif
+
+#if 0 // old codes, may be useful one day...
+//	DBG_871X("update_network: rssi=0x%lx dst->Rssi=%d ,dst->Rssi=0x%lx , src->Rssi=0x%lx",(dst->Rssi+src->Rssi)/2,dst->Rssi,dst->Rssi,src->Rssi);
+	if (check_fwstate(&padapter->mlmepriv, _FW_LINKED) && is_same_network(&(padapter->mlmepriv.cur_network.network), src))
+	{
+
+		//DBG_871X("b:ssid=%s update_network: src->rssi=0x%d padapter->recvpriv.ui_rssi=%d\n",src->Ssid.Ssid,src->Rssi,padapter->recvpriv.signal);
+		if(padapter->recvpriv.signal_qual_data.total_num++ >= PHY_LINKQUALITY_SLID_WIN_MAX)
+	        {
+	              padapter->recvpriv.signal_qual_data.total_num = PHY_LINKQUALITY_SLID_WIN_MAX;
+	              last_evm = padapter->recvpriv.signal_qual_data.elements[padapter->recvpriv.signal_qual_data.index];
+	              padapter->recvpriv.signal_qual_data.total_val -= last_evm;
+	        }
+		padapter->recvpriv.signal_qual_data.total_val += query_rx_pwr_percentage(src->Rssi);
+
+		padapter->recvpriv.signal_qual_data.elements[padapter->recvpriv.signal_qual_data.index++] = query_rx_pwr_percentage(src->Rssi);
+                if(padapter->recvpriv.signal_qual_data.index >= PHY_LINKQUALITY_SLID_WIN_MAX)
+                       padapter->recvpriv.signal_qual_data.index = 0;
+
+		//DBG_871X("Total SQ=%d  pattrib->signal_qual= %d\n", padapter->recvpriv.signal_qual_data.total_val, src->Rssi);
+
+		// <1> Showed on UI for user,in percentage.
+		tmpVal = padapter->recvpriv.signal_qual_data.total_val/padapter->recvpriv.signal_qual_data.total_num;
+                padapter->recvpriv.signal=(u8)tmpVal;//Link quality
+
+		src->Rssi= translate_percentage_to_dbm(padapter->recvpriv.signal) ;
+	}
+	else{
+//	DBG_871X("ELSE:ssid=%s update_network: src->rssi=0x%d dst->rssi=%d\n",src->Ssid.Ssid,src->Rssi,dst->Rssi);
+		src->Rssi=(src->Rssi +dst->Rssi)/2;//dBM
+	}
+
+//	DBG_871X("a:update_network: src->rssi=0x%d padapter->recvpriv.ui_rssi=%d\n",src->Rssi,padapter->recvpriv.signal);
+
+#endif
+
+_func_exit_;
+}
+
+static void update_current_network(_adapter *adapter, WLAN_BSSID_EX *pnetwork)
+{
+	struct	mlme_priv	*pmlmepriv = &(adapter->mlmepriv);
+
+_func_enter_;
+
+#ifdef PLATFORM_OS_XP
+	if ((unsigned long)(&(pmlmepriv->cur_network.network)) < 0x7ffffff)
+	{
+		KeBugCheckEx(0x87111c1c, (ULONG_PTR)(&(pmlmepriv->cur_network.network)), 0, 0,0);
+	}
+#endif
+
+	if ( (check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE) && (is_same_network(&(pmlmepriv->cur_network.network), pnetwork)))
+	{
+		//RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,"Same Network\n");
+
+		//if(pmlmepriv->cur_network.network.IELength<= pnetwork->IELength)
+		{
+			update_network(&(pmlmepriv->cur_network.network), pnetwork,adapter, _TRUE);
+			rtw_update_protection(adapter, (pmlmepriv->cur_network.network.IEs) + sizeof (NDIS_802_11_FIXED_IEs),
+									pmlmepriv->cur_network.network.IELength);
+		}
+	}
+
+_func_exit_;
+
+}
+
+
+/*
+
+Caller must hold pmlmepriv->lock first.
+
+
+*/
+void rtw_update_scanned_network(_adapter *adapter, WLAN_BSSID_EX *target)
+{
+	_irqL irqL;
+	_list	*plist, *phead;
+	ULONG	bssid_ex_sz;
+	struct mlme_priv	*pmlmepriv = &(adapter->mlmepriv);
+	_queue	*queue	= &(pmlmepriv->scanned_queue);
+	struct wlan_network	*pnetwork = NULL;
+	struct wlan_network	*oldest = NULL;
+
+_func_enter_;
+
+	_enter_critical_bh(&queue->lock, &irqL);
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while(1)
+	{
+		if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+			break;
+
+		pnetwork	= LIST_CONTAINOR(plist, struct wlan_network, list);
+
+		if ((unsigned long)(pnetwork) < 0x7ffffff)
+		{
+#ifdef PLATFORM_OS_XP
+			KeBugCheckEx(0x87111c1c, (ULONG_PTR)pnetwork, 0, 0,0);
+#endif
+		}
+
+		if (is_same_network(&(pnetwork->network), target))
+			break;
+
+		if ((oldest == ((struct wlan_network *)0)) ||
+		time_after(oldest->last_scanned, pnetwork->last_scanned))
+			oldest = pnetwork;
+
+		plist = get_next(plist);
+
+	}
+
+
+	/* If we didn't find a match, then get a new network slot to initialize
+	 * with this beacon's information */
+	if (rtw_end_of_queue_search(phead,plist)== _TRUE) {
+
+		if (_rtw_queue_empty(&(pmlmepriv->free_bss_pool)) == _TRUE) {
+			/* If there are no more slots, expire the oldest */
+			//list_del_init(&oldest->list);
+			pnetwork = oldest;
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+			//target->PhyInfo.Optimum_antenna = pHalData->CurAntenna;//optimum_antenna=>For antenna diversity
+			rtw_hal_get_def_var(adapter, HAL_DEF_CURRENT_ANTENNA, &(target->PhyInfo.Optimum_antenna));
+#endif
+			_rtw_memcpy(&(pnetwork->network), target,  get_WLAN_BSSID_EX_sz(target));
+			//pnetwork->last_scanned = rtw_get_current_time();
+			// variable initialize
+			pnetwork->fixed = _FALSE;
+			pnetwork->last_scanned = rtw_get_current_time();
+
+			pnetwork->network_type = 0;
+			pnetwork->aid=0;
+			pnetwork->join_res=0;
+
+			/* bss info not receving from the right channel */
+			if (pnetwork->network.PhyInfo.SignalQuality == 101)
+				pnetwork->network.PhyInfo.SignalQuality = 0;
+		}
+		else {
+			/* Otherwise just pull from the free list */
+
+			pnetwork = rtw_alloc_network(pmlmepriv); // will update scan_time
+
+			if(pnetwork==NULL){
+				RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("\n\n\nsomething wrong here\n\n\n"));
+				goto exit;
+			}
+
+			bssid_ex_sz = get_WLAN_BSSID_EX_sz(target);
+			target->Length = bssid_ex_sz;
+#ifdef CONFIG_ANTENNA_DIVERSITY
+			//target->PhyInfo.Optimum_antenna = pHalData->CurAntenna;
+			rtw_hal_get_def_var(adapter, HAL_DEF_CURRENT_ANTENNA, &(target->PhyInfo.Optimum_antenna));
+#endif
+			_rtw_memcpy(&(pnetwork->network), target, bssid_ex_sz );
+
+			pnetwork->last_scanned = rtw_get_current_time();
+
+			/* bss info not receving from the right channel */
+			if (pnetwork->network.PhyInfo.SignalQuality == 101)
+				pnetwork->network.PhyInfo.SignalQuality = 0;
+
+			rtw_list_insert_tail(&(pnetwork->list),&(queue->queue));
+
+		}
+	}
+	else {
+		/* we have an entry and we are going to update it. But this entry may
+		 * be already expired. In this case we do the same as we found a new
+		 * net and call the new_net handler
+		 */
+		bool update_ie = _TRUE;
+
+		pnetwork->last_scanned = rtw_get_current_time();
+
+		//target.Reserved[0]==1, means that scaned network is a bcn frame.
+		if((pnetwork->network.IELength>target->IELength) && (target->Reserved[0]==1))
+			update_ie = _FALSE;
+
+		update_network(&(pnetwork->network), target,adapter, update_ie);
+	}
+
+exit:
+	_exit_critical_bh(&queue->lock, &irqL);
+
+_func_exit_;
+}
+
+void rtw_add_network(_adapter *adapter, WLAN_BSSID_EX *pnetwork);
+void rtw_add_network(_adapter *adapter, WLAN_BSSID_EX *pnetwork)
+{
+	_irqL irqL;
+	struct	mlme_priv	*pmlmepriv = &(((_adapter *)adapter)->mlmepriv);
+	//_queue	*queue	= &(pmlmepriv->scanned_queue);
+
+_func_enter_;
+
+	//_enter_critical_bh(&queue->lock, &irqL);
+
+	#if defined(CONFIG_P2P) && defined(CONFIG_P2P_REMOVE_GROUP_INFO)
+	rtw_WLAN_BSSID_EX_remove_p2p_attr(pnetwork, P2P_ATTR_GROUP_INFO);
+	#endif
+
+	update_current_network(adapter, pnetwork);
+
+	rtw_update_scanned_network(adapter, pnetwork);
+
+	//_exit_critical_bh(&queue->lock, &irqL);
+
+_func_exit_;
+}
+
+//select the desired network based on the capability of the (i)bss.
+// check items: (1) security
+//			   (2) network_type
+//			   (3) WMM
+//			   (4) HT
+//                     (5) others
+int rtw_is_desired_network(_adapter *adapter, struct wlan_network *pnetwork);
+int rtw_is_desired_network(_adapter *adapter, struct wlan_network *pnetwork)
+{
+	struct security_priv *psecuritypriv = &adapter->securitypriv;
+	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
+	u32 desired_encmode;
+	u32 privacy;
+
+	//u8 wps_ie[512];
+	uint wps_ielen;
+
+	int bselected = _TRUE;
+
+	desired_encmode = psecuritypriv->ndisencryptstatus;
+	privacy = pnetwork->network.Privacy;
+
+	if(check_fwstate(pmlmepriv, WIFI_UNDER_WPS))
+	{
+		if(rtw_get_wps_ie(pnetwork->network.IEs+_FIXED_IE_LENGTH_, pnetwork->network.IELength-_FIXED_IE_LENGTH_, NULL, &wps_ielen)!=NULL)
+		{
+			return _TRUE;
+		}
+		else
+		{
+			return _FALSE;
+		}
+	}
+	if (adapter->registrypriv.wifi_spec == 1) //for  correct flow of 8021X  to do....
+	{
+		u8 *p=NULL;
+		uint ie_len=0;
+
+		if ((desired_encmode == Ndis802_11EncryptionDisabled) && (privacy != 0))
+	            bselected = _FALSE;
+
+		if ( psecuritypriv->ndisauthtype == Ndis802_11AuthModeWPA2PSK) {
+			p = rtw_get_ie(pnetwork->network.IEs + _BEACON_IE_OFFSET_, _RSN_IE_2_, &ie_len, (pnetwork->network.IELength - _BEACON_IE_OFFSET_));
+			if (p && ie_len>0) {
+				bselected = _TRUE;
+			} else {
+				bselected = _FALSE;
+			}
+		}
+	}
+
+
+	if ((desired_encmode != Ndis802_11EncryptionDisabled) && (privacy == 0)) {
+		DBG_871X("desired_encmode: %d, privacy: %d\n", desired_encmode, privacy);
+		bselected = _FALSE;
+	}
+
+	if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE)
+	{
+		if(pnetwork->network.InfrastructureMode != pmlmepriv->cur_network.network.InfrastructureMode)
+			bselected = _FALSE;
+	}
+
+
+	return bselected;
+}
+
+/* TODO: Perry : For Power Management */
+void rtw_atimdone_event_callback(_adapter	*adapter , u8 *pbuf)
+{
+
+_func_enter_;
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("receive atimdone_evet\n"));
+_func_exit_;
+	return;
+}
+
+
+void rtw_survey_event_callback(_adapter	*adapter, u8 *pbuf)
+{
+	_irqL  irqL;
+	u32 len;
+	WLAN_BSSID_EX *pnetwork;
+	struct	mlme_priv	*pmlmepriv = &(adapter->mlmepriv);
+
+_func_enter_;
+
+	pnetwork = (WLAN_BSSID_EX *)pbuf;
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("rtw_survey_event_callback, ssid=%s\n",  pnetwork->Ssid.Ssid));
+
+#ifdef CONFIG_RTL8712
+        //endian_convert
+	pnetwork->Length = le32_to_cpu(pnetwork->Length);
+	pnetwork->Ssid.SsidLength = le32_to_cpu(pnetwork->Ssid.SsidLength);
+	pnetwork->Privacy =le32_to_cpu( pnetwork->Privacy);
+	pnetwork->Rssi = le32_to_cpu(pnetwork->Rssi);
+	pnetwork->NetworkTypeInUse =le32_to_cpu(pnetwork->NetworkTypeInUse);
+	pnetwork->Configuration.ATIMWindow = le32_to_cpu(pnetwork->Configuration.ATIMWindow);
+	pnetwork->Configuration.BeaconPeriod = le32_to_cpu(pnetwork->Configuration.BeaconPeriod);
+	pnetwork->Configuration.DSConfig =le32_to_cpu(pnetwork->Configuration.DSConfig);
+	pnetwork->Configuration.FHConfig.DwellTime=le32_to_cpu(pnetwork->Configuration.FHConfig.DwellTime);
+	pnetwork->Configuration.FHConfig.HopPattern=le32_to_cpu(pnetwork->Configuration.FHConfig.HopPattern);
+	pnetwork->Configuration.FHConfig.HopSet=le32_to_cpu(pnetwork->Configuration.FHConfig.HopSet);
+	pnetwork->Configuration.FHConfig.Length=le32_to_cpu(pnetwork->Configuration.FHConfig.Length);
+	pnetwork->Configuration.Length = le32_to_cpu(pnetwork->Configuration.Length);
+	pnetwork->InfrastructureMode = le32_to_cpu(pnetwork->InfrastructureMode);
+	pnetwork->IELength = le32_to_cpu(pnetwork->IELength);
+#endif
+
+	len = get_WLAN_BSSID_EX_sz(pnetwork);
+	if(len > (sizeof(WLAN_BSSID_EX)))
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("\n ****rtw_survey_event_callback: return a wrong bss ***\n"));
+		return;
+	}
+
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	// update IBSS_network 's timestamp
+	if ((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) == _TRUE)
+	{
+		//RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,"rtw_survey_event_callback : WIFI_ADHOC_MASTER_STATE \n\n");
+		if(_rtw_memcmp(&(pmlmepriv->cur_network.network.MacAddress), pnetwork->MacAddress, ETH_ALEN))
+		{
+			struct wlan_network* ibss_wlan = NULL;
+			_irqL	irqL;
+
+			_rtw_memcpy(pmlmepriv->cur_network.network.IEs, pnetwork->IEs, 8);
+			_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+			ibss_wlan = rtw_find_network(&pmlmepriv->scanned_queue,  pnetwork->MacAddress);
+			if(ibss_wlan)
+			{
+				_rtw_memcpy(ibss_wlan->network.IEs , pnetwork->IEs, 8);
+				_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+				goto exit;
+			}
+			_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+		}
+	}
+
+	// lock pmlmepriv->lock when you accessing network_q
+	if ((check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) == _FALSE)
+	{
+	        if( pnetwork->Ssid.Ssid[0] == 0 )
+		{
+			pnetwork->Ssid.SsidLength = 0;
+		}
+		rtw_add_network(adapter, pnetwork);
+	}
+
+exit:
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+_func_exit_;
+
+	return;
+}
+
+
+
+void rtw_surveydone_event_callback(_adapter	*adapter, u8 *pbuf)
+{
+	_irqL  irqL;
+	u8 timer_cancelled = _FALSE;
+	struct	mlme_priv	*pmlmepriv = &(adapter->mlmepriv);
+
+#ifdef CONFIG_MLME_EXT
+
+	mlmeext_surveydone_event_callback(adapter);
+
+#endif
+
+_func_enter_;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	if(pmlmepriv->wps_probe_req_ie)
+	{
+		u32 free_len = pmlmepriv->wps_probe_req_ie_len;
+		pmlmepriv->wps_probe_req_ie_len = 0;
+		rtw_mfree(pmlmepriv->wps_probe_req_ie, free_len);
+		pmlmepriv->wps_probe_req_ie = NULL;
+	}
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("rtw_surveydone_event_callback: fw_state:%x\n\n", get_fwstate(pmlmepriv)));
+
+	if (check_fwstate(pmlmepriv,_FW_UNDER_SURVEY))
+	{
+		//u8 timer_cancelled;
+
+		timer_cancelled = _TRUE;
+		//_cancel_timer(&pmlmepriv->scan_to_timer, &timer_cancelled);
+
+		_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
+	}
+	else {
+
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("nic status =%x, survey done event comes too late!\n", get_fwstate(pmlmepriv)));
+	}
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+	if(timer_cancelled)
+		_cancel_timer(&pmlmepriv->scan_to_timer, &timer_cancelled);
+
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	rtw_set_signal_stat_timer(&adapter->recvpriv);
+	#endif
+
+	if(pmlmepriv->to_join == _TRUE)
+	{
+		if((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)==_TRUE) )
+		{
+			if(check_fwstate(pmlmepriv, _FW_LINKED)==_FALSE)
+			{
+				set_fwstate(pmlmepriv, _FW_UNDER_LINKING);
+
+				if(rtw_select_and_join_from_scanned_queue(pmlmepriv)==_SUCCESS)
+				{
+					_set_timer(&pmlmepriv->assoc_timer, MAX_JOIN_TIMEOUT );
+				}
+				else
+				{
+					WLAN_BSSID_EX    *pdev_network = &(adapter->registrypriv.dev_network);
+					u8 *pibss = adapter->registrypriv.dev_network.MacAddress;
+
+					//pmlmepriv->fw_state ^= _FW_UNDER_SURVEY;//because don't set assoc_timer
+					_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
+
+					RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("switching to adhoc master\n"));
+
+					_rtw_memset(&pdev_network->Ssid, 0, sizeof(NDIS_802_11_SSID));
+					_rtw_memcpy(&pdev_network->Ssid, &pmlmepriv->assoc_ssid, sizeof(NDIS_802_11_SSID));
+
+					rtw_update_registrypriv_dev_network(adapter);
+					rtw_generate_random_ibss(pibss);
+
+					pmlmepriv->fw_state = WIFI_ADHOC_MASTER_STATE;
+
+					if(rtw_createbss_cmd(adapter)!=_SUCCESS)
+					{
+					RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("Error=>rtw_createbss_cmd status FAIL\n"));
+					}
+
+					pmlmepriv->to_join = _FALSE;
+				}
+			}
+		}
+		else
+		{
+			int s_ret;
+			set_fwstate(pmlmepriv, _FW_UNDER_LINKING);
+			pmlmepriv->to_join = _FALSE;
+			if(_SUCCESS == (s_ret=rtw_select_and_join_from_scanned_queue(pmlmepriv)))
+			{
+			     _set_timer(&pmlmepriv->assoc_timer, MAX_JOIN_TIMEOUT);
+			}
+			else if(s_ret == 2)//there is no need to wait for join
+			{
+				_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+				rtw_indicate_connect(adapter);
+			}
+			else
+			{
+				DBG_871X("try_to_join, but select scanning queue fail, to_roaming:%d\n", rtw_to_roaming(adapter));
+				#ifdef CONFIG_LAYER2_ROAMING
+				if (rtw_to_roaming(adapter) != 0) {
+					if( --pmlmepriv->to_roaming == 0
+						|| _SUCCESS != rtw_sitesurvey_cmd(adapter, &pmlmepriv->assoc_ssid, 1, NULL, 0)
+					) {
+						rtw_set_roaming(adapter, 0);
+#ifdef CONFIG_INTEL_WIDI
+						if(adapter->mlmepriv.widi_state == INTEL_WIDI_STATE_ROAMING)
+						{
+							_rtw_memset(pmlmepriv->sa_ext, 0x00, L2SDTA_SERVICE_VE_LEN);
+							intel_widi_wk_cmd(adapter, INTEL_WIDI_LISTEN_WK, NULL);
+							DBG_871X("change to widi listen\n");
+						}
+#endif // CONFIG_INTEL_WIDI
+						rtw_free_assoc_resources(adapter, 1);
+						rtw_indicate_disconnect(adapter);
+					} else {
+						pmlmepriv->to_join = _TRUE;
+					}
+				}
+				#endif
+				_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+			}
+		}
+	}
+
+	indicate_wx_scan_complete_event(adapter);
+	//DBG_871X("scan complete in %dms\n",rtw_get_passing_time_ms(pmlmepriv->scan_start_time));
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+#ifdef CONFIG_P2P_PS
+	if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) {
+		p2p_ps_wk_cmd(adapter, P2P_PS_SCAN_DONE, 0);
+	}
+#endif // CONFIG_P2P_PS
+
+	rtw_os_xmit_schedule(adapter);
+#ifdef CONFIG_CONCURRENT_MODE
+	rtw_os_xmit_schedule(adapter->pbuddy_adapter);
+#endif
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	dc_resume_xmit(adapter);
+#endif
+
+#ifdef CONFIG_DRVEXT_MODULE_WSC
+	drvext_surveydone_callback(&adapter->drvextpriv);
+#endif
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+#ifdef CONFIG_INTEL_WIDI
+	if (adapter->mlmepriv.widi_state == INTEL_WIDI_STATE_NONE)
+#endif
+	{
+		struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
+		if(pmlmeext->sitesurvey_res.bss_cnt == 0){
+			rtw_hal_sreset_reset(adapter);
+		}
+	}
+#endif
+
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_cfg80211_surveydone_event_callback(adapter);
+#endif //CONFIG_IOCTL_CFG80211
+
+_func_exit_;
+
+}
+
+void rtw_dummy_event_callback(_adapter *adapter , u8 *pbuf)
+{
+
+}
+
+void rtw_fwdbg_event_callback(_adapter *adapter , u8 *pbuf)
+{
+
+}
+
+static void free_scanqueue(struct	mlme_priv *pmlmepriv)
+{
+	_irqL irqL, irqL0;
+	_queue *free_queue = &pmlmepriv->free_bss_pool;
+	_queue *scan_queue = &pmlmepriv->scanned_queue;
+	_list	*plist, *phead, *ptemp;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_, ("+free_scanqueue\n"));
+	_enter_critical_bh(&scan_queue->lock, &irqL0);
+	_enter_critical_bh(&free_queue->lock, &irqL);
+
+	phead = get_list_head(scan_queue);
+	plist = get_next(phead);
+
+	while (plist != phead)
+       {
+		ptemp = get_next(plist);
+		rtw_list_delete(plist);
+		rtw_list_insert_tail(plist, &free_queue->queue);
+		plist =ptemp;
+		pmlmepriv->num_of_scanned --;
+        }
+
+	_exit_critical_bh(&free_queue->lock, &irqL);
+	_exit_critical_bh(&scan_queue->lock, &irqL0);
+
+_func_exit_;
+}
+
+/*
+*rtw_free_assoc_resources: the caller has to lock pmlmepriv->lock
+*/
+void rtw_free_assoc_resources(_adapter *adapter, int lock_scanned_queue)
+{
+	_irqL irqL;
+	struct wlan_network* pwlan = NULL;
+	struct	mlme_priv *pmlmepriv = &adapter->mlmepriv;
+	struct	sta_priv *pstapriv = &adapter->stapriv;
+	struct wlan_network *tgt_network = &pmlmepriv->cur_network;
+
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &adapter->tdlsinfo;
+#endif //CONFIG_TDLS
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_, ("+rtw_free_assoc_resources\n"));
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("tgt_network->network.MacAddress="MAC_FMT" ssid=%s\n",
+		MAC_ARG(tgt_network->network.MacAddress), tgt_network->network.Ssid.Ssid));
+
+	if(check_fwstate( pmlmepriv, WIFI_STATION_STATE|WIFI_AP_STATE))
+	{
+		struct sta_info* psta;
+
+		psta = rtw_get_stainfo(&adapter->stapriv, tgt_network->network.MacAddress);
+
+#ifdef CONFIG_TDLS
+		if(ptdlsinfo->setup_state != TDLS_STATE_NONE)
+		{
+			rtw_tdls_cmd(adapter, myid(&(adapter->eeprompriv)), TDLS_RS_RCR);
+			rtw_reset_tdls_info(adapter);
+			rtw_free_all_stainfo(adapter);
+			_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+		}
+		else
+#endif //CONFIG_TDLS
+		{
+			_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+			rtw_free_stainfo(adapter,  psta);
+		}
+
+		_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+
+	}
+
+	if(check_fwstate( pmlmepriv, WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE|WIFI_AP_STATE))
+	{
+		struct sta_info* psta;
+
+		rtw_free_all_stainfo(adapter);
+
+		psta = rtw_get_bcmc_stainfo(adapter);
+		_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+		rtw_free_stainfo(adapter, psta);
+		_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+
+		rtw_init_bcmc_stainfo(adapter);
+	}
+
+	if(lock_scanned_queue)
+		_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	pwlan = rtw_find_network(&pmlmepriv->scanned_queue, tgt_network->network.MacAddress);
+	if(pwlan)
+	{
+		pwlan->fixed = _FALSE;
+#ifdef CONFIG_P2P
+		if(!rtw_p2p_chk_state(&adapter->wdinfo, P2P_STATE_NONE))
+		{
+			u32 p2p_ielen=0;
+			u8  *p2p_ie;
+			//u16 capability;
+			u8 *pcap = NULL;
+			u32 capability_len=0;
+
+			//DBG_871X("free disconnecting network\n");
+			//rtw_free_network_nolock(pmlmepriv, pwlan);
+
+			if((p2p_ie=rtw_get_p2p_ie(pwlan->network.IEs+_FIXED_IE_LENGTH_, pwlan->network.IELength-_FIXED_IE_LENGTH_, NULL, &p2p_ielen)))
+			{
+				pcap = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CAPABILITY, NULL, &capability_len);
+				if(pcap && capability_len==2)
+				{
+					u16 cap = *(u16*)pcap ;
+					*(u16*)pcap = cap&0x00ff;//clear group capability when free this network
+				}
+			}
+
+			rtw_set_scan_deny(adapter, 2000);
+			//rtw_clear_scan_deny(adapter);
+		}
+#endif //CONFIG_P2P
+	}
+	else
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("rtw_free_assoc_resources : pwlan== NULL \n\n"));
+	}
+
+
+	if((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) && (adapter->stapriv.asoc_sta_count== 1))
+		/*||check_fwstate(pmlmepriv, WIFI_STATION_STATE)*/)
+	{
+		rtw_free_network_nolock(pmlmepriv, pwlan);
+	}
+
+	if(lock_scanned_queue)
+		_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	adapter->securitypriv.key_mask = 0;
+
+_func_exit_;
+
+}
+
+/*
+*rtw_indicate_connect: the caller has to lock pmlmepriv->lock
+*/
+void rtw_indicate_connect(_adapter *padapter)
+{
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("+rtw_indicate_connect\n"));
+
+	pmlmepriv->to_join = _FALSE;
+
+	if(!check_fwstate(&padapter->mlmepriv, _FW_LINKED))
+	{
+
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+	rtw_hal_set_hwreg(padapter, HW_VAR_ANTENNA_DIVERSITY_LINK, 0);
+#endif
+	set_fwstate(pmlmepriv, _FW_LINKED);
+
+	rtw_led_control(padapter, LED_CTL_LINK);
+
+#ifdef CONFIG_DRVEXT_MODULE
+	if(padapter->drvextpriv.enable_wpa)
+	{
+		indicate_l2_connect(padapter);
+	}
+	else
+#endif
+	{
+		rtw_os_indicate_connect(padapter);
+	}
+
+	}
+
+	rtw_set_roaming(padapter, 0);
+
+#ifdef CONFIG_INTEL_WIDI
+	if(padapter->mlmepriv.widi_state == INTEL_WIDI_STATE_ROAMING)
+	{
+		_rtw_memset(pmlmepriv->sa_ext, 0x00, L2SDTA_SERVICE_VE_LEN);
+		intel_widi_wk_cmd(padapter, INTEL_WIDI_LISTEN_WK, NULL);
+		DBG_871X("change to widi listen\n");
+	}
+#endif // CONFIG_INTEL_WIDI
+
+	rtw_set_scan_deny(padapter, 3000);
+
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("-rtw_indicate_connect: fw_state=0x%08x\n", get_fwstate(pmlmepriv)));
+
+_func_exit_;
+
+}
+
+
+/*
+*rtw_indicate_disconnect: the caller has to lock pmlmepriv->lock
+*/
+void rtw_indicate_disconnect( _adapter *padapter )
+{
+	struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("+rtw_indicate_disconnect\n"));
+
+	_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING|WIFI_UNDER_WPS);
+
+	if(rtw_to_roaming(padapter) > 0)
+		_clr_fwstate_(pmlmepriv, _FW_LINKED);
+
+	if(check_fwstate(&padapter->mlmepriv, _FW_LINKED)
+		|| (rtw_to_roaming(padapter) <= 0)
+	)
+	{
+		rtw_os_indicate_disconnect(padapter);
+
+		//set ips_deny_time to avoid enter IPS before LPS leave
+		padapter->pwrctrlpriv.ips_deny_time = rtw_get_current_time() + rtw_ms_to_systime(3000);
+
+	      _clr_fwstate_(pmlmepriv, _FW_LINKED);
+
+		rtw_led_control(padapter, LED_CTL_NO_LINK);
+
+		rtw_clear_scan_deny(padapter);
+
+	}
+
+#ifdef CONFIG_P2P_PS
+	p2p_ps_wk_cmd(padapter, P2P_PS_DISABLE, 1);
+#endif // CONFIG_P2P_PS
+
+#ifdef CONFIG_LPS
+#ifdef CONFIG_WOWLAN
+	if(padapter->pwrctrlpriv.wowlan_mode==_FALSE)
+#endif //CONFIG_WOWLAN
+	rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_DISCONNECT, 1);
+
+#endif
+
+_func_exit_;
+}
+
+inline void rtw_indicate_scan_done( _adapter *padapter, bool aborted)
+{
+	rtw_os_indicate_scan_done(padapter, aborted);
+}
+
+void rtw_scan_abort(_adapter *adapter)
+{
+	u32 cnt=0;
+	u32 start;
+	struct mlme_priv	*pmlmepriv = &(adapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &(adapter->mlmeextpriv);
+
+	start = rtw_get_current_time();
+	pmlmeext->scan_abort = _TRUE;
+	while (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY)
+		&& rtw_get_passing_time_ms(start) <= 200) {
+
+		if (adapter->bDriverStopped || adapter->bSurpriseRemoved)
+			break;
+
+		DBG_871X(FUNC_NDEV_FMT"fw_state=_FW_UNDER_SURVEY!\n", FUNC_NDEV_ARG(adapter->pnetdev));
+		rtw_msleep_os(20);
+	}
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY)) {
+		if (!adapter->bDriverStopped && !adapter->bSurpriseRemoved)
+			DBG_871X(FUNC_NDEV_FMT"waiting for scan_abort time out!\n", FUNC_NDEV_ARG(adapter->pnetdev));
+		#ifdef CONFIG_PLATFORM_MSTAR
+		//_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
+		set_survey_timer(pmlmeext, 0);
+		_set_timer(&pmlmepriv->scan_to_timer, 50);
+		#endif
+		rtw_indicate_scan_done(adapter, _TRUE);
+	}
+	pmlmeext->scan_abort = _FALSE;
+}
+
+static struct sta_info *rtw_joinbss_update_stainfo(_adapter *padapter, struct wlan_network *pnetwork)
+{
+	int i;
+	struct sta_info *bmc_sta, *psta=NULL;
+	struct recv_reorder_ctrl *preorder_ctrl;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+
+	psta = rtw_get_stainfo(pstapriv, pnetwork->network.MacAddress);
+	if(psta==NULL) {
+		psta = rtw_alloc_stainfo(pstapriv, pnetwork->network.MacAddress);
+	}
+
+	if(psta) //update ptarget_sta
+	{
+		DBG_871X("%s\n", __FUNCTION__);
+
+		psta->aid  = pnetwork->join_res;
+#ifdef CONFIG_CONCURRENT_MODE
+
+		if(PRIMARY_ADAPTER == padapter->adapter_type)
+			psta->mac_id=0;
+		else
+			psta->mac_id=2;
+#else
+		psta->mac_id=0;
+#endif
+
+		psta->raid = networktype_to_raid(pmlmeext->cur_wireless_mode);
+
+		//security related
+		if(padapter->securitypriv.dot11AuthAlgrthm== dot11AuthAlgrthm_8021X)
+		{
+			padapter->securitypriv.binstallGrpkey=_FALSE;
+			padapter->securitypriv.busetkipkey=_FALSE;
+			padapter->securitypriv.bgrpkey_handshake=_FALSE;
+
+			psta->ieee8021x_blocked=_TRUE;
+			psta->dot118021XPrivacy=padapter->securitypriv.dot11PrivacyAlgrthm;
+
+			_rtw_memset((u8 *)&psta->dot118021x_UncstKey, 0, sizeof (union Keytype));
+
+			_rtw_memset((u8 *)&psta->dot11tkiprxmickey, 0, sizeof (union Keytype));
+			_rtw_memset((u8 *)&psta->dot11tkiptxmickey, 0, sizeof (union Keytype));
+
+			_rtw_memset((u8 *)&psta->dot11txpn, 0, sizeof (union pn48));
+#ifdef CONFIG_IEEE80211W
+			_rtw_memset((u8 *)&psta->dot11wtxpn, 0, sizeof (union pn48));
+#endif //CONFIG_IEEE80211W
+			_rtw_memset((u8 *)&psta->dot11rxpn, 0, sizeof (union pn48));
+		}
+
+		//	Commented by Albert 2012/07/21
+		//	When doing the WPS, the wps_ie_len won't equal to 0
+		//	And the Wi-Fi driver shouldn't allow the data packet to be tramsmitted.
+		if ( padapter->securitypriv.wps_ie_len != 0 )
+		{
+			psta->ieee8021x_blocked=_TRUE;
+			padapter->securitypriv.wps_ie_len = 0;
+		}
+
+
+		//for A-MPDU Rx reordering buffer control for bmc_sta & sta_info
+		//if A-MPDU Rx is enabled, reseting  rx_ordering_ctrl wstart_b(indicate_seq) to default value=0xffff
+		//todo: check if AP can send A-MPDU packets
+		for(i=0; i < 16 ; i++)
+		{
+			//preorder_ctrl = &precvpriv->recvreorder_ctrl[i];
+			preorder_ctrl = &psta->recvreorder_ctrl[i];
+			preorder_ctrl->enable = _FALSE;
+			preorder_ctrl->indicate_seq = 0xffff;
+			#ifdef DBG_RX_SEQ
+			DBG_871X("DBG_RX_SEQ %s:%d indicate_seq:%u \n", __FUNCTION__, __LINE__,
+				preorder_ctrl->indicate_seq);
+			#endif
+			preorder_ctrl->wend_b= 0xffff;
+			preorder_ctrl->wsize_b = 64;//max_ampdu_sz;//ex. 32(kbytes) -> wsize_b=32
+		}
+
+
+		bmc_sta = rtw_get_bcmc_stainfo(padapter);
+		if(bmc_sta)
+		{
+			for(i=0; i < 16 ; i++)
+			{
+				//preorder_ctrl = &precvpriv->recvreorder_ctrl[i];
+				preorder_ctrl = &bmc_sta->recvreorder_ctrl[i];
+				preorder_ctrl->enable = _FALSE;
+				preorder_ctrl->indicate_seq = 0xffff;
+				#ifdef DBG_RX_SEQ
+				DBG_871X("DBG_RX_SEQ %s:%d indicate_seq:%u \n", __FUNCTION__, __LINE__,
+					preorder_ctrl->indicate_seq);
+				#endif
+				preorder_ctrl->wend_b= 0xffff;
+				preorder_ctrl->wsize_b = 64;//max_ampdu_sz;//ex. 32(kbytes) -> wsize_b=32
+			}
+		}
+
+
+		//misc.
+		update_sta_info(padapter, psta);
+
+	}
+
+	return psta;
+
+}
+
+//pnetwork : returns from rtw_joinbss_event_callback
+//ptarget_wlan: found from scanned_queue
+static void rtw_joinbss_update_network(_adapter *padapter, struct wlan_network *ptarget_wlan, struct wlan_network  *pnetwork)
+{
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	struct wlan_network  *cur_network = &(pmlmepriv->cur_network);
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("\nfw_state:%x, BSSID:"MAC_FMT"\n"
+		,get_fwstate(pmlmepriv), MAC_ARG(pnetwork->network.MacAddress)));
+
+
+	// why not use ptarget_wlan??
+	_rtw_memcpy(&cur_network->network, &pnetwork->network, pnetwork->network.Length);
+
+	cur_network->aid = pnetwork->join_res;
+
+
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	rtw_set_signal_stat_timer(&padapter->recvpriv);
+#endif
+	padapter->recvpriv.signal_strength = ptarget_wlan->network.PhyInfo.SignalStrength;
+	padapter->recvpriv.signal_qual = ptarget_wlan->network.PhyInfo.SignalQuality;
+	//the ptarget_wlan->network.Rssi is raw data, we use ptarget_wlan->network.PhyInfo.SignalStrength instead (has scaled)
+	padapter->recvpriv.rssi = translate_percentage_to_dbm(ptarget_wlan->network.PhyInfo.SignalStrength);
+	#if defined(DBG_RX_SIGNAL_DISPLAY_PROCESSING) && 1
+		DBG_871X(FUNC_ADPT_FMT" signal_strength:%3u, rssi:%3d, signal_qual:%3u"
+			"\n"
+			, FUNC_ADPT_ARG(padapter)
+			, padapter->recvpriv.signal_strength
+			, padapter->recvpriv.rssi
+			, padapter->recvpriv.signal_qual
+	);
+	#endif
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	rtw_set_signal_stat_timer(&padapter->recvpriv);
+#endif
+
+	//update fw_state //will clr _FW_UNDER_LINKING here indirectly
+	switch(pnetwork->network.InfrastructureMode)
+	{
+		case Ndis802_11Infrastructure:
+
+				if(pmlmepriv->fw_state&WIFI_UNDER_WPS)
+					pmlmepriv->fw_state = WIFI_STATION_STATE|WIFI_UNDER_WPS;
+				else
+					pmlmepriv->fw_state = WIFI_STATION_STATE;
+
+				break;
+		case Ndis802_11IBSS:
+				pmlmepriv->fw_state = WIFI_ADHOC_STATE;
+				break;
+		default:
+				pmlmepriv->fw_state = WIFI_NULL_STATE;
+				RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("Invalid network_mode\n"));
+				break;
+	}
+
+	rtw_update_protection(padapter, (cur_network->network.IEs) + sizeof (NDIS_802_11_FIXED_IEs),
+									(cur_network->network.IELength));
+
+#ifdef CONFIG_80211N_HT
+	rtw_update_ht_cap(padapter, cur_network->network.IEs, cur_network->network.IELength, (u8) cur_network->network.Configuration.DSConfig);
+#endif
+
+
+}
+
+//Notes: the fucntion could be > passive_level (the same context as Rx tasklet)
+//pnetwork : returns from rtw_joinbss_event_callback
+//ptarget_wlan: found from scanned_queue
+//if join_res > 0, for (fw_state==WIFI_STATION_STATE), we check if  "ptarget_sta" & "ptarget_wlan" exist.
+//if join_res > 0, for (fw_state==WIFI_ADHOC_STATE), we only check if "ptarget_wlan" exist.
+//if join_res > 0, update "cur_network->network" from "pnetwork->network" if (ptarget_wlan !=NULL).
+//
+//#define REJOIN
+void rtw_joinbss_event_prehandle(_adapter *adapter, u8 *pbuf)
+{
+	_irqL irqL,irqL2;
+	static u8 retry=0;
+	u8 timer_cancelled;
+	struct sta_info *ptarget_sta= NULL, *pcur_sta = NULL;
+	struct	sta_priv *pstapriv = &adapter->stapriv;
+	struct	mlme_priv	*pmlmepriv = &(adapter->mlmepriv);
+	struct wlan_network 	*pnetwork	= (struct wlan_network *)pbuf;
+	struct wlan_network 	*cur_network = &(pmlmepriv->cur_network);
+	struct wlan_network	*pcur_wlan = NULL, *ptarget_wlan = NULL;
+	unsigned int 		the_same_macaddr = _FALSE;
+
+_func_enter_;
+
+#ifdef CONFIG_RTL8712
+       //endian_convert
+	pnetwork->join_res = le32_to_cpu(pnetwork->join_res);
+	pnetwork->network_type = le32_to_cpu(pnetwork->network_type);
+	pnetwork->network.Length = le32_to_cpu(pnetwork->network.Length);
+	pnetwork->network.Ssid.SsidLength = le32_to_cpu(pnetwork->network.Ssid.SsidLength);
+	pnetwork->network.Privacy =le32_to_cpu( pnetwork->network.Privacy);
+	pnetwork->network.Rssi = le32_to_cpu(pnetwork->network.Rssi);
+	pnetwork->network.NetworkTypeInUse =le32_to_cpu(pnetwork->network.NetworkTypeInUse) ;
+	pnetwork->network.Configuration.ATIMWindow = le32_to_cpu(pnetwork->network.Configuration.ATIMWindow);
+	pnetwork->network.Configuration.BeaconPeriod = le32_to_cpu(pnetwork->network.Configuration.BeaconPeriod);
+	pnetwork->network.Configuration.DSConfig = le32_to_cpu(pnetwork->network.Configuration.DSConfig);
+	pnetwork->network.Configuration.FHConfig.DwellTime=le32_to_cpu(pnetwork->network.Configuration.FHConfig.DwellTime);
+	pnetwork->network.Configuration.FHConfig.HopPattern=le32_to_cpu(pnetwork->network.Configuration.FHConfig.HopPattern);
+	pnetwork->network.Configuration.FHConfig.HopSet=le32_to_cpu(pnetwork->network.Configuration.FHConfig.HopSet);
+	pnetwork->network.Configuration.FHConfig.Length=le32_to_cpu(pnetwork->network.Configuration.FHConfig.Length);
+	pnetwork->network.Configuration.Length = le32_to_cpu(pnetwork->network.Configuration.Length);
+	pnetwork->network.InfrastructureMode = le32_to_cpu(pnetwork->network.InfrastructureMode);
+	pnetwork->network.IELength = le32_to_cpu(pnetwork->network.IELength );
+#endif
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("joinbss event call back received with res=%d\n", pnetwork->join_res));
+
+	rtw_get_encrypt_decrypt_from_registrypriv(adapter);
+
+
+	if (pmlmepriv->assoc_ssid.SsidLength == 0)
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("@@@@@   joinbss event call back  for Any SSid\n"));
+	}
+	else
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("@@@@@   rtw_joinbss_event_callback for SSid:%s\n", pmlmepriv->assoc_ssid.Ssid));
+	}
+
+	the_same_macaddr = _rtw_memcmp(pnetwork->network.MacAddress, cur_network->network.MacAddress, ETH_ALEN);
+
+	pnetwork->network.Length = get_WLAN_BSSID_EX_sz(&pnetwork->network);
+	if(pnetwork->network.Length > sizeof(WLAN_BSSID_EX))
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("\n\n ***joinbss_evt_callback return a wrong bss ***\n\n"));
+		goto ignore_joinbss_callback;
+	}
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("\n rtw_joinbss_event_callback !! _enter_critical \n"));
+
+	if(pnetwork->join_res > 0)
+	{
+		_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+		retry = 0;
+		if (check_fwstate(pmlmepriv,_FW_UNDER_LINKING) )
+		{
+			//s1. find ptarget_wlan
+			if(check_fwstate(pmlmepriv, _FW_LINKED) )
+			{
+				if(the_same_macaddr == _TRUE)
+				{
+					ptarget_wlan = rtw_find_network(&pmlmepriv->scanned_queue, cur_network->network.MacAddress);
+				}
+				else
+				{
+					pcur_wlan = rtw_find_network(&pmlmepriv->scanned_queue, cur_network->network.MacAddress);
+					if(pcur_wlan)	pcur_wlan->fixed = _FALSE;
+
+					pcur_sta = rtw_get_stainfo(pstapriv, cur_network->network.MacAddress);
+					if(pcur_sta){
+						_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL2);
+						rtw_free_stainfo(adapter,  pcur_sta);
+						_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL2);
+					}
+
+					ptarget_wlan = rtw_find_network(&pmlmepriv->scanned_queue, pnetwork->network.MacAddress);
+					if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE){
+						if(ptarget_wlan)	ptarget_wlan->fixed = _TRUE;
+					}
+				}
+
+			}
+			else
+			{
+				ptarget_wlan = rtw_find_network(&pmlmepriv->scanned_queue, pnetwork->network.MacAddress);
+				if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE){
+					if(ptarget_wlan)	ptarget_wlan->fixed = _TRUE;
+				}
+			}
+
+			//s2. update cur_network
+			if(ptarget_wlan)
+			{
+				rtw_joinbss_update_network(adapter, ptarget_wlan, pnetwork);
+			}
+			else
+			{
+				RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("Can't find ptarget_wlan when joinbss_event callback\n"));
+				_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+				goto ignore_joinbss_callback;
+			}
+
+
+			//s3. find ptarget_sta & update ptarget_sta after update cur_network only for station mode
+			if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE)
+			{
+				ptarget_sta = rtw_joinbss_update_stainfo(adapter, pnetwork);
+				if(ptarget_sta==NULL)
+				{
+					RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("Can't update stainfo when joinbss_event callback\n"));
+					_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+					goto ignore_joinbss_callback;
+				}
+			}
+
+			//s4. indicate connect
+			if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE)
+			{
+				rtw_indicate_connect(adapter);
+			}
+			else
+			{
+				//adhoc mode will rtw_indicate_connect when rtw_stassoc_event_callback
+				RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("adhoc mode, fw_state:%x", get_fwstate(pmlmepriv)));
+			}
+
+
+			//s5. Cancle assoc_timer
+			_cancel_timer(&pmlmepriv->assoc_timer, &timer_cancelled);
+
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("Cancle assoc_timer\n"));
+
+		}
+		else
+		{
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("rtw_joinbss_event_callback err: fw_state:%x", get_fwstate(pmlmepriv)));
+			_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+			goto ignore_joinbss_callback;
+		}
+
+		_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	}
+	else if(pnetwork->join_res == -4)
+	{
+		rtw_reset_securitypriv(adapter);
+		_set_timer(&pmlmepriv->assoc_timer, 1);
+
+		//rtw_free_assoc_resources(adapter, 1);
+
+		if((check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) == _TRUE)
+		{
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("fail! clear _FW_UNDER_LINKING ^^^fw_state=%x\n", get_fwstate(pmlmepriv)));
+			_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+		}
+
+	}
+	else //if join_res < 0 (join fails), then try again
+	{
+
+		#ifdef REJOIN
+		res = _FAIL;
+		if(retry < 2) {
+			res = rtw_select_and_join_from_scanned_queue(pmlmepriv);
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("rtw_select_and_join_from_scanned_queue again! res:%d\n",res));
+		}
+
+		 if(res == _SUCCESS)
+		{
+			//extend time of assoc_timer
+			_set_timer(&pmlmepriv->assoc_timer, MAX_JOIN_TIMEOUT);
+			retry++;
+		}
+		else if(res == 2)//there is no need to wait for join
+		{
+			_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+			rtw_indicate_connect(adapter);
+		}
+		else
+		{
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("Set Assoc_Timer = 1; can't find match ssid in scanned_q \n"));
+		#endif
+
+			_set_timer(&pmlmepriv->assoc_timer, 1);
+			//rtw_free_assoc_resources(adapter, 1);
+			_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+
+		#ifdef REJOIN
+			retry = 0;
+		}
+		#endif
+	}
+
+ignore_joinbss_callback:
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+	_func_exit_;
+}
+
+void rtw_joinbss_event_callback(_adapter *adapter, u8 *pbuf)
+{
+	struct wlan_network 	*pnetwork	= (struct wlan_network *)pbuf;
+
+_func_enter_;
+
+	mlmeext_joinbss_event_callback(adapter, pnetwork->join_res);
+
+	rtw_os_xmit_schedule(adapter);
+
+#ifdef CONFIG_CONCURRENT_MODE
+	rtw_os_xmit_schedule(adapter->pbuddy_adapter);
+#endif
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	dc_resume_xmit(adapter);
+#endif
+
+_func_exit_;
+}
+
+void rtw_stassoc_event_callback(_adapter *adapter, u8 *pbuf)
+{
+	_irqL irqL;
+	struct sta_info *psta;
+	struct mlme_priv *pmlmepriv = &(adapter->mlmepriv);
+	struct stassoc_event	*pstassoc	= (struct stassoc_event*)pbuf;
+	struct wlan_network 	*cur_network = &(pmlmepriv->cur_network);
+	struct wlan_network	*ptarget_wlan = NULL;
+
+_func_enter_;
+
+	if(rtw_access_ctrl(adapter, pstassoc->macaddr) == _FALSE)
+		return;
+
+#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE))
+	{
+		psta = rtw_get_stainfo(&adapter->stapriv, pstassoc->macaddr);
+		if(psta)
+		{
+#ifdef CONFIG_IOCTL_CFG80211
+#ifdef COMPAT_KERNEL_RELEASE
+
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,37)) || defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+			u8 *passoc_req = NULL;
+			u32 assoc_req_len;
+
+			_enter_critical_bh(&psta->lock, &irqL);
+			if(psta->passoc_req && psta->assoc_req_len>0)
+			{
+				passoc_req = rtw_zmalloc(psta->assoc_req_len);
+				if(passoc_req)
+				{
+					assoc_req_len = psta->assoc_req_len;
+					_rtw_memcpy(passoc_req, psta->passoc_req, assoc_req_len);
+
+					rtw_mfree(psta->passoc_req , psta->assoc_req_len);
+					psta->passoc_req = NULL;
+					psta->assoc_req_len = 0;
+				}
+			}
+			_exit_critical_bh(&psta->lock, &irqL);
+
+			if(passoc_req && assoc_req_len>0)
+			{
+				rtw_cfg80211_indicate_sta_assoc(adapter, passoc_req, assoc_req_len);
+
+				rtw_mfree(passoc_req, assoc_req_len);
+			}
+#endif //(LINUX_VERSION_CODE < KERNEL_VERSION(2,6,37)) || defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+#endif //CONFIG_IOCTL_CFG80211
+
+			//bss_cap_update_on_sta_join(adapter, psta);
+			//sta_info_update(adapter, psta);
+			ap_sta_info_defer_update(adapter, psta);
+		}
+
+		goto exit;
+	}
+#endif
+
+	psta = rtw_get_stainfo(&adapter->stapriv, pstassoc->macaddr);
+	if( psta != NULL)
+	{
+		//the sta have been in sta_info_queue => do nothing
+
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("Error: rtw_stassoc_event_callback: sta has been in sta_hash_queue \n"));
+
+		goto exit; //(between drv has received this event before and  fw have not yet to set key to CAM_ENTRY)
+	}
+
+	psta = rtw_alloc_stainfo(&adapter->stapriv, pstassoc->macaddr);
+	if (psta == NULL) {
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("Can't alloc sta_info when rtw_stassoc_event_callback\n"));
+		goto exit;
+	}
+
+	//to do : init sta_info variable
+	psta->qos_option = 0;
+	psta->mac_id = (uint)pstassoc->cam_id;
+	//psta->aid = (uint)pstassoc->cam_id;
+
+	if(adapter->securitypriv.dot11AuthAlgrthm==dot11AuthAlgrthm_8021X)
+		psta->dot118021XPrivacy = adapter->securitypriv.dot11PrivacyAlgrthm;
+
+	psta->ieee8021x_blocked = _FALSE;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	if ( (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)==_TRUE ) ||
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)==_TRUE ) )
+	{
+		if(adapter->stapriv.asoc_sta_count== 2)
+		{
+			_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+			ptarget_wlan = rtw_find_network(&pmlmepriv->scanned_queue, cur_network->network.MacAddress);
+			if(ptarget_wlan)	ptarget_wlan->fixed = _TRUE;
+			_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+			// a sta + bc/mc_stainfo (not Ibss_stainfo)
+			rtw_indicate_connect(adapter);
+		}
+	}
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+
+	mlmeext_sta_add_event_callback(adapter, psta);
+
+#ifdef CONFIG_RTL8711
+	//submit SetStaKey_cmd to tell fw, fw will allocate an CAM entry for this sta
+	rtw_setstakey_cmd(adapter, (unsigned char*)psta, _FALSE);
+#endif
+
+exit:
+
+_func_exit_;
+
+}
+
+void rtw_stadel_event_callback(_adapter *adapter, u8 *pbuf)
+{
+	_irqL irqL,irqL2;
+	struct sta_info *psta;
+	struct wlan_network* pwlan = NULL;
+	WLAN_BSSID_EX    *pdev_network=NULL;
+	u8* pibss = NULL;
+	struct	mlme_priv	*pmlmepriv = &(adapter->mlmepriv);
+	struct 	stadel_event *pstadel	= (struct stadel_event*)pbuf;
+	struct	sta_priv *pstapriv = &adapter->stapriv;
+	struct wlan_network *tgt_network = &(pmlmepriv->cur_network);
+
+_func_enter_;
+
+        if(check_fwstate(pmlmepriv, WIFI_AP_STATE))
+        {
+#ifdef CONFIG_IOCTL_CFG80211
+#ifdef COMPAT_KERNEL_RELEASE
+
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,37)) || defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+		rtw_cfg80211_indicate_sta_disassoc(adapter, pstadel->macaddr, *(u16*)pstadel->rsvd);
+#endif //(LINUX_VERSION_CODE < KERNEL_VERSION(2,6,37)) || defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+#endif //CONFIG_IOCTL_CFG80211
+
+		return;
+        }
+
+
+	mlmeext_sta_del_event_callback(adapter);
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL2);
+
+	if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) )
+	{
+		#ifdef CONFIG_LAYER2_ROAMING
+		if (rtw_to_roaming(adapter) > 0)
+			pmlmepriv->to_roaming--; /* this stadel_event is caused by roaming, decrease to_roaming */
+		else if (rtw_to_roaming(adapter) == 0)
+			rtw_set_roaming(adapter, adapter->registrypriv.max_roaming_times);
+#ifdef CONFIG_INTEL_WIDI
+		if(adapter->mlmepriv.widi_state != INTEL_WIDI_STATE_CONNECTED)
+#endif // CONFIG_INTEL_WIDI
+		if(*((unsigned short *)(pstadel->rsvd)) != WLAN_REASON_EXPIRATION_CHK)
+			rtw_set_roaming(adapter, 0); /* don't roam */
+		#endif
+
+		rtw_free_uc_swdec_pending_queue(adapter);
+
+		rtw_free_assoc_resources(adapter, 1);
+		rtw_indicate_disconnect(adapter);
+		_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+		// remove the network entry in scanned_queue
+		pwlan = rtw_find_network(&pmlmepriv->scanned_queue, tgt_network->network.MacAddress);
+		if (pwlan) {
+			pwlan->fixed = _FALSE;
+			rtw_free_network_nolock(pmlmepriv, pwlan);
+		}
+		_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+		_rtw_roaming(adapter, tgt_network);
+
+#ifdef CONFIG_INTEL_WIDI
+		if (!rtw_to_roaming(adapter))
+			process_intel_widi_disconnect(adapter, 1);
+#endif // CONFIG_INTEL_WIDI
+	}
+
+	if ( check_fwstate(pmlmepriv,WIFI_ADHOC_MASTER_STATE) ||
+	      check_fwstate(pmlmepriv,WIFI_ADHOC_STATE))
+	{
+		psta = rtw_get_stainfo(&adapter->stapriv, pstadel->macaddr);
+
+		_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+		rtw_free_stainfo(adapter,  psta);
+		_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+
+		if(adapter->stapriv.asoc_sta_count== 1) //a sta + bc/mc_stainfo (not Ibss_stainfo)
+		{
+			//rtw_indicate_disconnect(adapter);//removed@20091105
+			_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+			//free old ibss network
+			//pwlan = rtw_find_network(&pmlmepriv->scanned_queue, pstadel->macaddr);
+			pwlan = rtw_find_network(&pmlmepriv->scanned_queue, tgt_network->network.MacAddress);
+			if(pwlan)
+			{
+				pwlan->fixed = _FALSE;
+				rtw_free_network_nolock(pmlmepriv, pwlan);
+			}
+			_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+			//re-create ibss
+			pdev_network = &(adapter->registrypriv.dev_network);
+			pibss = adapter->registrypriv.dev_network.MacAddress;
+
+			_rtw_memcpy(pdev_network, &tgt_network->network, get_WLAN_BSSID_EX_sz(&tgt_network->network));
+
+			_rtw_memset(&pdev_network->Ssid, 0, sizeof(NDIS_802_11_SSID));
+			_rtw_memcpy(&pdev_network->Ssid, &pmlmepriv->assoc_ssid, sizeof(NDIS_802_11_SSID));
+
+			rtw_update_registrypriv_dev_network(adapter);
+
+			rtw_generate_random_ibss(pibss);
+
+			if(check_fwstate(pmlmepriv,WIFI_ADHOC_STATE))
+			{
+				set_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE);
+				_clr_fwstate_(pmlmepriv, WIFI_ADHOC_STATE);
+			}
+
+			if(rtw_createbss_cmd(adapter)!=_SUCCESS)
+			{
+
+				RT_TRACE(_module_rtl871x_ioctl_set_c_,_drv_err_,("***Error=>stadel_event_callback: rtw_createbss_cmd status FAIL*** \n "));
+
+			}
+
+
+		}
+
+	}
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL2);
+
+_func_exit_;
+
+}
+
+
+void rtw_cpwm_event_callback(PADAPTER padapter, u8 *pbuf)
+{
+#ifdef CONFIG_LPS_LCLK
+	struct reportpwrstate_parm *preportpwrstate;
+#endif
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("rtw_cpwm_event_callback !!!\n"));
+#ifdef CONFIG_LPS_LCLK
+	preportpwrstate = (struct reportpwrstate_parm*)pbuf;
+	preportpwrstate->state |= (u8)(padapter->pwrctrlpriv.cpwm_tog + 0x80);
+	cpwm_int_hdl(padapter, preportpwrstate);
+#endif
+
+_func_exit_;
+
+}
+
+/*
+* _rtw_join_timeout_handler - Timeout/faliure handler for CMD JoinBss
+* @adapter: pointer to _adapter structure
+*/
+void _rtw_join_timeout_handler (_adapter *adapter)
+{
+	_irqL irqL;
+	struct	mlme_priv *pmlmepriv = &adapter->mlmepriv;
+#ifdef CONFIG_LAYER2_ROAMING
+	int do_join_r;
+#endif //CONFIG_LAYER2_ROAMING
+
+#if 0
+	if (adapter->bDriverStopped == _TRUE){
+		_rtw_up_sema(&pmlmepriv->assoc_terminate);
+		return;
+	}
+#endif
+
+_func_enter_;
+#ifdef PLATFORM_FREEBSD
+		rtw_mtx_lock(NULL);
+		 if (callout_pending(&adapter->mlmepriv.assoc_timer.callout)) {
+			 /* callout was reset */
+			 //mtx_unlock(&sc->sc_mtx);
+			 rtw_mtx_unlock(NULL);
+			 return;
+		 }
+		 if (!callout_active(&adapter->mlmepriv.assoc_timer.callout)) {
+			 /* callout was stopped */
+			 //mtx_unlock(&sc->sc_mtx);
+			 rtw_mtx_unlock(NULL);
+			 return;
+		 }
+		 callout_deactivate(&adapter->mlmepriv.assoc_timer.callout);
+
+
+#endif
+
+	DBG_871X("%s, fw_state=%x\n", __FUNCTION__, get_fwstate(pmlmepriv));
+
+	if(adapter->bDriverStopped ||adapter->bSurpriseRemoved)
+		return;
+
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	#ifdef CONFIG_LAYER2_ROAMING
+	if (rtw_to_roaming(adapter) > 0) { /* join timeout caused by roaming */
+		while(1) {
+			pmlmepriv->to_roaming--;
+			if (rtw_to_roaming(adapter) != 0) { /* try another */
+				DBG_871X("%s try another roaming\n", __FUNCTION__);
+				if( _SUCCESS!=(do_join_r=rtw_do_join(adapter)) ) {
+					DBG_871X("%s roaming do_join return %d\n", __FUNCTION__ ,do_join_r);
+					continue;
+				}
+				break;
+			} else {
+#ifdef CONFIG_INTEL_WIDI
+				if(adapter->mlmepriv.widi_state == INTEL_WIDI_STATE_ROAMING)
+				{
+					_rtw_memset(pmlmepriv->sa_ext, 0x00, L2SDTA_SERVICE_VE_LEN);
+					intel_widi_wk_cmd(adapter, INTEL_WIDI_LISTEN_WK, NULL);
+					DBG_871X("change to widi listen\n");
+				}
+#endif // CONFIG_INTEL_WIDI
+				DBG_871X("%s We've try roaming but fail\n", __FUNCTION__);
+				rtw_indicate_disconnect(adapter);
+				break;
+			}
+		}
+
+	} else
+	#endif
+	{
+		rtw_indicate_disconnect(adapter);
+		free_scanqueue(pmlmepriv);//???
+
+#ifdef CONFIG_IOCTL_CFG80211
+		//indicate disconnect for the case that join_timeout and check_fwstate != FW_LINKED
+		rtw_cfg80211_indicate_disconnect(adapter);
+#endif //CONFIG_IOCTL_CFG80211
+
+	}
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+
+#ifdef CONFIG_DRVEXT_MODULE_WSC
+	drvext_assoc_fail_indicate(&adapter->drvextpriv);
+#endif
+#ifdef PLATFORM_FREEBSD
+		rtw_mtx_unlock(NULL);
+#endif
+
+_func_exit_;
+
+}
+
+/*
+* rtw_scan_timeout_handler - Timeout/Faliure handler for CMD SiteSurvey
+* @adapter: pointer to _adapter structure
+*/
+void rtw_scan_timeout_handler (_adapter *adapter)
+{
+	_irqL irqL;
+	struct	mlme_priv *pmlmepriv = &adapter->mlmepriv;
+
+	DBG_871X(FUNC_ADPT_FMT" fw_state=%x\n", FUNC_ADPT_ARG(adapter), get_fwstate(pmlmepriv));
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+	rtw_indicate_scan_done(adapter, _TRUE);
+
+}
+
+static void rtw_auto_scan_handler(_adapter *padapter)
+{
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv;
+
+	//auto site survey per 60sec
+	if(pmlmepriv->scan_interval >0)
+	{
+		pmlmepriv->scan_interval--;
+		if(pmlmepriv->scan_interval==0)
+		{
+/*
+			if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE)
+			{
+				DBG_871X("exit %s when _FW_UNDER_SURVEY|_FW_UNDER_LINKING -> \n", __FUNCTION__);
+				return;
+			}
+
+			if(pmlmepriv->sitesurveyctrl.traffic_busy == _TRUE)
+			{
+				DBG_871X("%s exit cause traffic_busy(%x)\n",__FUNCTION__, pmlmepriv->sitesurveyctrl.traffic_busy);
+				return;
+			}
+*/
+
+#ifdef CONFIG_CONCURRENT_MODE
+			if (rtw_buddy_adapter_up(padapter))
+			{
+				if ((check_buddy_fwstate(padapter, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE) ||
+					(padapter->pbuddy_adapter->mlmepriv.LinkDetectInfo.bBusyTraffic == _TRUE))
+				{
+					DBG_871X("%s, but buddy_intf is under scanning or linking or BusyTraffic\n", __FUNCTION__);
+					return;
+				}
+			}
+#endif
+
+			DBG_871X("%s\n", __FUNCTION__);
+
+			rtw_set_802_11_bssid_list_scan(padapter, NULL, 0);
+
+			pmlmepriv->scan_interval = SCAN_INTERVAL;// 30*2 sec = 60sec
+
+		}
+
+	}
+
+}
+
+void rtw_dynamic_check_timer_handlder(_adapter *adapter)
+{
+#ifdef CONFIG_AP_MODE
+	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
+#endif //CONFIG_AP_MODE
+	struct registry_priv *pregistrypriv = &adapter->registrypriv;
+#ifdef CONFIG_CONCURRENT_MODE
+	PADAPTER pbuddy_adapter = adapter->pbuddy_adapter;
+#endif
+
+	if(!adapter)
+		return;
+
+	if(adapter->hw_init_completed == _FALSE)
+		return;
+
+	if ((adapter->bDriverStopped == _TRUE)||(adapter->bSurpriseRemoved== _TRUE))
+		return;
+
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(pbuddy_adapter)
+	{
+		if(adapter->net_closed == _TRUE && pbuddy_adapter->net_closed == _TRUE)
+		{
+			return;
+		}
+	}
+	else
+#endif //CONFIG_CONCURRENT_MODE
+	if(adapter->net_closed == _TRUE)
+	{
+		return;
+	}
+
+	rtw_dynamic_chk_wk_cmd(adapter);
+
+	if(pregistrypriv->wifi_spec==1)
+	{
+#ifdef CONFIG_P2P
+		struct wifidirect_info *pwdinfo = &adapter->wdinfo;
+		if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+#endif
+		{
+			//auto site survey
+			rtw_auto_scan_handler(adapter);
+		}
+	}
+
+#ifndef CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+#ifdef CONFIG_AP_MODE
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+		expire_timeout_chk(adapter);
+	}
+#endif
+#endif //!CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+
+#ifdef CONFIG_BR_EXT
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35))
+	rcu_read_lock();
+#endif	// (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35))
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+	if( adapter->pnetdev->br_port
+#else	// (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+	if( rcu_dereference(adapter->pnetdev->rx_handler_data)
+#endif	// (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+		&& (check_fwstate(pmlmepriv, WIFI_STATION_STATE|WIFI_ADHOC_STATE) == _TRUE) )
+	{
+		// expire NAT2.5 entry
+		void nat25_db_expire(_adapter *priv);
+		nat25_db_expire(adapter);
+
+		if (adapter->pppoe_connection_in_progress > 0) {
+			adapter->pppoe_connection_in_progress--;
+		}
+
+		// due to rtw_dynamic_check_timer_handlder() is called every 2 seconds
+		if (adapter->pppoe_connection_in_progress > 0) {
+			adapter->pppoe_connection_in_progress--;
+		}
+	}
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35))
+	rcu_read_unlock();
+#endif	// (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35))
+
+#endif	// CONFIG_BR_EXT
+
+}
+
+
+#ifdef CONFIG_SET_SCAN_DENY_TIMER
+inline bool rtw_is_scan_deny(_adapter *adapter)
+{
+	struct mlme_priv *mlmepriv = &adapter->mlmepriv;
+	return (ATOMIC_READ(&mlmepriv->set_scan_deny) != 0) ? _TRUE : _FALSE;
+}
+
+inline void rtw_clear_scan_deny(_adapter *adapter)
+{
+	struct mlme_priv *mlmepriv = &adapter->mlmepriv;
+	ATOMIC_SET(&mlmepriv->set_scan_deny, 0);
+	if (0)
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(adapter));
+}
+
+void rtw_set_scan_deny_timer_hdl(_adapter *adapter)
+{
+	rtw_clear_scan_deny(adapter);
+}
+
+void rtw_set_scan_deny(_adapter *adapter, u32 ms)
+{
+	struct mlme_priv *mlmepriv = &adapter->mlmepriv;
+#ifdef CONFIG_CONCURRENT_MODE
+	struct mlme_priv *b_mlmepriv;
+#endif
+
+	if (0)
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(adapter));
+	ATOMIC_SET(&mlmepriv->set_scan_deny, 1);
+	_set_timer(&mlmepriv->set_scan_deny_timer, ms);
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (!adapter->pbuddy_adapter)
+		return;
+
+	if (0)
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(adapter->pbuddy_adapter));
+	b_mlmepriv = &adapter->pbuddy_adapter->mlmepriv;
+	ATOMIC_SET(&b_mlmepriv->set_scan_deny, 1);
+	_set_timer(&b_mlmepriv->set_scan_deny_timer, ms);
+#endif
+
+}
+#endif
+
+#if defined(IEEE80211_SCAN_RESULT_EXPIRE)
+#define RTW_SCAN_RESULT_EXPIRE IEEE80211_SCAN_RESULT_EXPIRE/HZ*1000 -1000 //3000 -1000
+#else
+#define RTW_SCAN_RESULT_EXPIRE 2000
+#endif
+
+#ifndef PLATFORM_FREEBSD
+/*
+* Select a new join candidate from the original @param candidate and @param competitor
+* @return _TRUE: candidate is updated
+* @return _FALSE: candidate is not updated
+*/
+static int rtw_check_join_candidate(struct mlme_priv *pmlmepriv
+	, struct wlan_network **candidate, struct wlan_network *competitor)
+{
+	int updated = _FALSE;
+	_adapter *adapter = container_of(pmlmepriv, _adapter, mlmepriv);
+
+
+	//check bssid, if needed
+	if(pmlmepriv->assoc_by_bssid==_TRUE) {
+		if(_rtw_memcmp(competitor->network.MacAddress, pmlmepriv->assoc_bssid, ETH_ALEN) ==_FALSE)
+			goto exit;
+	}
+
+	//check ssid, if needed
+	if(pmlmepriv->assoc_ssid.Ssid && pmlmepriv->assoc_ssid.SsidLength) {
+		if(	competitor->network.Ssid.SsidLength != pmlmepriv->assoc_ssid.SsidLength
+			|| _rtw_memcmp(competitor->network.Ssid.Ssid, pmlmepriv->assoc_ssid.Ssid, pmlmepriv->assoc_ssid.SsidLength) == _FALSE
+		)
+			goto exit;
+	}
+
+	if(rtw_is_desired_network(adapter, competitor)  == _FALSE)
+		goto exit;
+
+#ifdef  CONFIG_LAYER2_ROAMING
+	if(rtw_to_roaming(adapter) > 0) {
+		if(	rtw_get_passing_time_ms((u32)competitor->last_scanned) >= RTW_SCAN_RESULT_EXPIRE
+			|| is_same_ess(&competitor->network, &pmlmepriv->cur_network.network) == _FALSE
+		)
+			goto exit;
+	}
+#endif
+
+	if(*candidate == NULL ||(*candidate)->network.Rssi<competitor->network.Rssi )
+	{
+		*candidate = competitor;
+		updated = _TRUE;
+	}
+
+#if 0
+	if(pmlmepriv->assoc_by_bssid==_TRUE) { // associate with bssid
+		if(	(*candidate == NULL ||(*candidate)->network.Rssi<competitor->network.Rssi )
+			&& _rtw_memcmp(competitor->network.MacAddress, pmlmepriv->assoc_bssid, ETH_ALEN)==_TRUE
+		) {
+			*candidate = competitor;
+			updated = _TRUE;
+		}
+	} else  if (pmlmepriv->assoc_ssid.SsidLength == 0 ) { // associate with ssid, but ssidlength is 0
+		if(	(*candidate == NULL ||(*candidate)->network.Rssi<competitor->network.Rssi ) ) {
+			*candidate = competitor;
+			updated = _TRUE;
+		}
+	} else
+#ifdef  CONFIG_LAYER2_ROAMING
+	if(rtw_to_roaming(adapter)) { // roaming
+		if(	(*candidate == NULL ||(*candidate)->network.Rssi<competitor->network.Rssi )
+			&& is_same_ess(&competitor->network, &pmlmepriv->cur_network.network)
+			//&&(!is_same_network(&competitor->network, &pmlmepriv->cur_network.network))
+			&& rtw_get_passing_time_ms((u32)competitor->last_scanned) < RTW_SCAN_RESULT_EXPIRE
+			&& rtw_is_desired_network(adapter, competitor)
+		) {
+			*candidate = competitor;
+			updated = _TRUE;
+		}
+
+	} else
+#endif
+	{ // associate with ssid
+		if(	(*candidate == NULL ||(*candidate)->network.Rssi<competitor->network.Rssi )
+			&& (competitor->network.Ssid.SsidLength==pmlmepriv->assoc_ssid.SsidLength)
+			&&((_rtw_memcmp(competitor->network.Ssid.Ssid, pmlmepriv->assoc_ssid.Ssid, pmlmepriv->assoc_ssid.SsidLength)) == _TRUE)
+			&& rtw_is_desired_network(adapter, competitor)
+		) {
+			*candidate = competitor;
+			updated = _TRUE;
+		}
+	}
+#endif
+
+	if(updated){
+		DBG_871X("[by_bssid:%u][assoc_ssid:%s]"
+			#ifdef  CONFIG_LAYER2_ROAMING
+			"[to_roaming:%u] "
+			#endif
+			"new candidate: %s("MAC_FMT", ch%u) rssi:%d\n",
+			pmlmepriv->assoc_by_bssid,
+			pmlmepriv->assoc_ssid.Ssid,
+			#ifdef  CONFIG_LAYER2_ROAMING
+			rtw_to_roaming(adapter),
+			#endif
+			(*candidate)->network.Ssid.Ssid,
+			MAC_ARG((*candidate)->network.MacAddress),
+			(*candidate)->network.Configuration.DSConfig,
+			(int)(*candidate)->network.Rssi
+		);
+	}
+
+exit:
+	return updated;
+}
+
+/*
+Calling context:
+The caller of the sub-routine will be in critical section...
+
+The caller must hold the following spinlock
+
+pmlmepriv->lock
+
+
+*/
+
+int rtw_select_and_join_from_scanned_queue(struct mlme_priv *pmlmepriv )
+{
+	_irqL	irqL;
+	int ret;
+	_list	*phead;
+	_adapter *adapter;
+	_queue	*queue	= &(pmlmepriv->scanned_queue);
+	struct	wlan_network	*pnetwork = NULL;
+	struct	wlan_network	*candidate = NULL;
+	u8 		bSupportAntDiv = _FALSE;
+
+_func_enter_;
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+	phead = get_list_head(queue);
+	adapter = (_adapter *)pmlmepriv->nic_hdl;
+
+	pmlmepriv->pscanned = get_next( phead );
+
+	while (!rtw_end_of_queue_search(phead, pmlmepriv->pscanned)) {
+
+		pnetwork = LIST_CONTAINOR(pmlmepriv->pscanned, struct wlan_network, list);
+		if(pnetwork==NULL){
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("%s return _FAIL:(pnetwork==NULL)\n", __FUNCTION__));
+			ret = _FAIL;
+			goto exit;
+		}
+
+		pmlmepriv->pscanned = get_next(pmlmepriv->pscanned);
+
+		#if 0
+		DBG_871X("MacAddress:"MAC_FMT" ssid:%s\n", MAC_ARG(pnetwork->network.MacAddress), pnetwork->network.Ssid.Ssid);
+		#endif
+
+		rtw_check_join_candidate(pmlmepriv, &candidate, pnetwork);
+
+	}
+
+	if(candidate == NULL) {
+		DBG_871X("%s: return _FAIL(candidate == NULL)\n", __FUNCTION__);
+		ret = _FAIL;
+		goto exit;
+	} else {
+		DBG_871X("%s: candidate: %s("MAC_FMT", ch:%u)\n", __FUNCTION__,
+			candidate->network.Ssid.Ssid, MAC_ARG(candidate->network.MacAddress),
+			candidate->network.Configuration.DSConfig);
+	}
+
+
+	// check for situation of  _FW_LINKED
+	if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+	{
+		DBG_871X("%s: _FW_LINKED while ask_for_joinbss!!!\n", __FUNCTION__);
+
+		#if 0 // for WPA/WPA2 authentication, wpa_supplicant will expect authentication from AP, it is needed to reconnect AP...
+		if(is_same_network(&pmlmepriv->cur_network.network, &candidate->network))
+		{
+			DBG_871X("%s: _FW_LINKED and is same network, it needn't join again\n", __FUNCTION__);
+
+			rtw_indicate_connect(adapter);//rtw_indicate_connect again
+
+			ret = 2;
+			goto exit;
+		}
+		else
+		#endif
+		{
+			rtw_disassoc_cmd(adapter, 0, _TRUE);
+			rtw_indicate_disconnect(adapter);
+			rtw_free_assoc_resources(adapter, 0);
+		}
+	}
+
+	#ifdef CONFIG_ANTENNA_DIVERSITY
+	rtw_hal_get_def_var(adapter, HAL_DEF_IS_SUPPORT_ANT_DIV, &(bSupportAntDiv));
+	if(_TRUE == bSupportAntDiv)
+	{
+		u8 CurrentAntenna;
+		rtw_hal_get_def_var(adapter, HAL_DEF_CURRENT_ANTENNA, &(CurrentAntenna));
+		DBG_871X("#### Opt_Ant_(%s) , cur_Ant(%s)\n",
+			(2==candidate->network.PhyInfo.Optimum_antenna)?"A":"B",
+			(2==CurrentAntenna)?"A":"B"
+		);
+	}
+	#endif
+	set_fwstate(pmlmepriv, _FW_UNDER_LINKING);
+	ret = rtw_joinbss_cmd(adapter, candidate);
+
+exit:
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+_func_exit_;
+
+	return ret;
+}
+#else
+int rtw_select_and_join_from_scanned_queue(struct mlme_priv *pmlmepriv )
+{
+	_irqL	irqL;
+	_list	*phead;
+#ifdef CONFIG_ANTENNA_DIVERSITY
+	u8 CurrentAntenna;
+#endif
+	unsigned char *dst_ssid, *src_ssid;
+	_adapter *adapter;
+	_queue	*queue	= &(pmlmepriv->scanned_queue);
+	struct	wlan_network	*pnetwork = NULL;
+	struct	wlan_network	*pnetwork_max_rssi = NULL;
+	#ifdef CONFIG_LAYER2_ROAMING
+	struct wlan_network * roaming_candidate=NULL;
+	u32 cur_time=rtw_get_current_time();
+	#endif
+
+_func_enter_;
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+	phead = get_list_head(queue);
+	adapter = (_adapter *)pmlmepriv->nic_hdl;
+
+	pmlmepriv->pscanned = get_next( phead );
+
+	while (!rtw_end_of_queue_search(phead, pmlmepriv->pscanned)) {
+
+		pnetwork = LIST_CONTAINOR(pmlmepriv->pscanned, struct wlan_network, list);
+		if(pnetwork==NULL){
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("(2)rtw_select_and_join_from_scanned_queue return _FAIL:(pnetwork==NULL)\n"));
+			_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+			return _FAIL;
+		}
+
+		dst_ssid = pnetwork->network.Ssid.Ssid;
+		src_ssid = pmlmepriv->assoc_ssid.Ssid;
+
+		pmlmepriv->pscanned = get_next(pmlmepriv->pscanned);
+
+		#if 0
+		DBG_871X("MacAddress:"MAC_FMT" ssid:%s\n", MAC_ARG(pnetwork->network.MacAddress), pnetwork->network.Ssid.Ssid);
+		#endif
+
+		if(pmlmepriv->assoc_by_bssid==_TRUE)
+		{
+			if(_rtw_memcmp(pnetwork->network.MacAddress, pmlmepriv->assoc_bssid, ETH_ALEN)==_TRUE)
+			{
+				//remove the condition @ 20081125
+				//if((pmlmepriv->cur_network.network.InfrastructureMode==Ndis802_11AutoUnknown)||
+				//	pmlmepriv->cur_network.network.InfrastructureMode == pnetwork->network.InfrastructureMode)
+				//		goto ask_for_joinbss;
+
+				if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+				{
+					if(is_same_network(&pmlmepriv->cur_network.network, &pnetwork->network))
+					{
+						//DBG_871X("select_and_join(1): _FW_LINKED and is same network, it needn't join again\n");
+
+						rtw_indicate_connect(adapter);//rtw_indicate_connect again
+						_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+						return 2;
+					}
+					else
+					{
+						rtw_disassoc_cmd(adapter, 0, _TRUE);
+						rtw_indicate_disconnect(adapter);
+						rtw_free_assoc_resources(adapter, 0);
+						_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+						goto ask_for_joinbss;
+
+					}
+				}
+				else
+				{
+					_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+					goto ask_for_joinbss;
+				}
+
+			}
+
+		} else if (pmlmepriv->assoc_ssid.SsidLength == 0) {
+			_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+			goto ask_for_joinbss;//anyway, join first selected(dequeued) pnetwork if ssid_len=0
+
+		#ifdef CONFIG_LAYER2_ROAMING
+		} else if (rtw_to_roaming(adapter) > 0) {
+
+			if(	(roaming_candidate == NULL ||roaming_candidate->network.Rssi<pnetwork->network.Rssi )
+				&& is_same_ess(&pnetwork->network, &pmlmepriv->cur_network.network)
+				//&&(!is_same_network(&pnetwork->network, &pmlmepriv->cur_network.network))
+				&&  rtw_get_time_interval_ms((u32)pnetwork->last_scanned,cur_time) < 5000
+				) {
+				roaming_candidate = pnetwork;
+				//RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,
+				DBG_871X
+					("roaming_candidate???: %s("MAC_FMT")\n",
+					roaming_candidate->network.Ssid.Ssid, MAC_ARG(roaming_candidate->network.MacAddress) )
+					//)
+					;
+			}
+			continue;
+		#endif
+
+		} else if ( (pnetwork->network.Ssid.SsidLength==pmlmepriv->assoc_ssid.SsidLength)
+			&&((_rtw_memcmp(dst_ssid, src_ssid, pmlmepriv->assoc_ssid.SsidLength)) == _TRUE)
+			)
+		{
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("dst_ssid=%s, src_ssid=%s \n", dst_ssid, src_ssid));
+#ifdef CONFIG_ANTENNA_DIVERSITY
+			rtw_hal_get_def_var(adapter, HAL_DEF_CURRENT_ANTENNA, &(CurrentAntenna));
+			DBG_871X("#### dst_ssid=(%s) Opt_Ant_(%s) , cur_Ant(%s)\n", dst_ssid,
+				(2==pnetwork->network.PhyInfo.Optimum_antenna)?"A":"B",
+				(2==CurrentAntenna)?"A":"B");
+#endif
+			//remove the condition @ 20081125
+			//if((pmlmepriv->cur_network.network.InfrastructureMode==Ndis802_11AutoUnknown)||
+			//	pmlmepriv->cur_network.network.InfrastructureMode == pnetwork->network.InfrastructureMode)
+			//{
+			//	_rtw_memcpy(pmlmepriv->assoc_bssid, pnetwork->network.MacAddress, ETH_ALEN);
+			//	goto ask_for_joinbss;
+			//}
+
+			if(pmlmepriv->assoc_by_rssi==_TRUE)//if the ssid is the same, select the bss which has the max rssi
+			{
+				if( NULL==pnetwork_max_rssi|| pnetwork->network.Rssi > pnetwork_max_rssi->network.Rssi)
+						pnetwork_max_rssi = pnetwork;
+			}
+			else if(rtw_is_desired_network(adapter, pnetwork) == _TRUE)
+			{
+				if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+				{
+#if 0
+					if(is_same_network(&pmlmepriv->cur_network.network, &pnetwork->network))
+					{
+						DBG_871X("select_and_join(2): _FW_LINKED and is same network, it needn't join again\n");
+
+						rtw_indicate_connect(adapter);//rtw_indicate_connect again
+
+						return 2;
+					}
+					else
+#endif
+					{
+						rtw_disassoc_cmd(adapter, 0, _TRUE);
+						//rtw_indicate_disconnect(adapter);//
+						rtw_free_assoc_resources(adapter, 0);
+						_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+						goto ask_for_joinbss;
+					}
+				}
+				else
+				{
+					_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+					goto ask_for_joinbss;
+				}
+
+			}
+
+
+		}
+
+	}
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+	#ifdef CONFIG_LAYER2_ROAMING
+	if(rtw_to_roaming(adapter) > 0 && roaming_candidate ){
+		pnetwork=roaming_candidate;
+		DBG_871X("select_and_join_from_scanned_queue: roaming_candidate: %s("MAC_FMT")\n",
+			pnetwork->network.Ssid.Ssid, MAC_ARG(pnetwork->network.MacAddress));
+		goto ask_for_joinbss;
+	}
+	#endif
+
+	if((pmlmepriv->assoc_by_rssi==_TRUE)  && (pnetwork_max_rssi!=NULL))
+	{
+		pnetwork = pnetwork_max_rssi;
+		DBG_871X("select_and_join_from_scanned_queue: pnetwork_max_rssi: %s("MAC_FMT")\n",
+			pnetwork->network.Ssid.Ssid, MAC_ARG(pnetwork->network.MacAddress));
+		goto ask_for_joinbss;
+	}
+
+	DBG_871X("(1)rtw_select_and_join_from_scanned_queue return _FAIL\n");
+
+_func_exit_;
+
+     return _FAIL;
+
+ask_for_joinbss:
+
+_func_exit_;
+
+	return rtw_joinbss_cmd(adapter, pnetwork);
+
+}
+#endif //PLATFORM_FREEBSD
+
+
+sint rtw_set_auth(_adapter * adapter,struct security_priv *psecuritypriv)
+{
+	struct	cmd_obj* pcmd;
+	struct 	setauth_parm *psetauthparm;
+	struct	cmd_priv	*pcmdpriv=&(adapter->cmdpriv);
+	sint		res=_SUCCESS;
+
+_func_enter_;
+
+	pcmd = (struct	cmd_obj*)rtw_zmalloc(sizeof(struct	cmd_obj));
+	if(pcmd==NULL){
+		res= _FAIL;  //try again
+		goto exit;
+	}
+
+	psetauthparm=(struct setauth_parm*)rtw_zmalloc(sizeof(struct setauth_parm));
+	if(psetauthparm==NULL){
+		rtw_mfree((unsigned char *)pcmd, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	_rtw_memset(psetauthparm, 0, sizeof(struct setauth_parm));
+	psetauthparm->mode=(unsigned char)psecuritypriv->dot11AuthAlgrthm;
+
+	pcmd->cmdcode = _SetAuth_CMD_;
+	pcmd->parmbuf = (unsigned char *)psetauthparm;
+	pcmd->cmdsz =  (sizeof(struct setauth_parm));
+	pcmd->rsp = NULL;
+	pcmd->rspsz = 0;
+
+
+	_rtw_init_listhead(&pcmd->list);
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("after enqueue set_auth_cmd, auth_mode=%x\n", psecuritypriv->dot11AuthAlgrthm));
+
+	res = rtw_enqueue_cmd(pcmdpriv, pcmd);
+
+exit:
+
+_func_exit_;
+
+	return res;
+
+}
+
+
+sint rtw_set_key(_adapter * adapter,struct security_priv *psecuritypriv,sint keyid, u8 set_tx)
+{
+	u8	keylen;
+	struct cmd_obj		*pcmd;
+	struct setkey_parm	*psetkeyparm;
+	struct cmd_priv		*pcmdpriv = &(adapter->cmdpriv);
+	struct mlme_priv		*pmlmepriv = &(adapter->mlmepriv);
+	sint	res=_SUCCESS;
+
+_func_enter_;
+
+	pcmd = (struct	cmd_obj*)rtw_zmalloc(sizeof(struct	cmd_obj));
+	if(pcmd==NULL){
+		res= _FAIL;  //try again
+		goto exit;
+	}
+	psetkeyparm=(struct setkey_parm*)rtw_zmalloc(sizeof(struct setkey_parm));
+	if(psetkeyparm==NULL){
+		rtw_mfree((unsigned char *)pcmd, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	_rtw_memset(psetkeyparm, 0, sizeof(struct setkey_parm));
+
+	if(psecuritypriv->dot11AuthAlgrthm ==dot11AuthAlgrthm_8021X){
+		psetkeyparm->algorithm=(unsigned char)psecuritypriv->dot118021XGrpPrivacy;
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("\n rtw_set_key: psetkeyparm->algorithm=(unsigned char)psecuritypriv->dot118021XGrpPrivacy=%d \n", psetkeyparm->algorithm));
+	}
+	else{
+		psetkeyparm->algorithm=(u8)psecuritypriv->dot11PrivacyAlgrthm;
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("\n rtw_set_key: psetkeyparm->algorithm=(u8)psecuritypriv->dot11PrivacyAlgrthm=%d \n", psetkeyparm->algorithm));
+
+	}
+	psetkeyparm->keyid = (u8)keyid;//0~3
+	psetkeyparm->set_tx = set_tx;
+	if (is_wep_enc(psetkeyparm->algorithm))
+		psecuritypriv->key_mask |= BIT(psetkeyparm->keyid);
+
+	DBG_871X("==> rtw_set_key algorithm(%x),keyid(%x),key_mask(%x)\n",psetkeyparm->algorithm,psetkeyparm->keyid, psecuritypriv->key_mask);
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("\n rtw_set_key: psetkeyparm->algorithm=%d psetkeyparm->keyid=(u8)keyid=%d \n",psetkeyparm->algorithm, keyid));
+
+	switch(psetkeyparm->algorithm){
+
+		case _WEP40_:
+			keylen=5;
+			_rtw_memcpy(&(psetkeyparm->key[0]), &(psecuritypriv->dot11DefKey[keyid].skey[0]), keylen);
+			break;
+		case _WEP104_:
+			keylen=13;
+			_rtw_memcpy(&(psetkeyparm->key[0]), &(psecuritypriv->dot11DefKey[keyid].skey[0]), keylen);
+			break;
+		case _TKIP_:
+			keylen=16;
+			_rtw_memcpy(&psetkeyparm->key, &psecuritypriv->dot118021XGrpKey[keyid], keylen);
+			psetkeyparm->grpkey=1;
+			break;
+		case _AES_:
+			keylen=16;
+			_rtw_memcpy(&psetkeyparm->key, &psecuritypriv->dot118021XGrpKey[keyid], keylen);
+			psetkeyparm->grpkey=1;
+			break;
+		default:
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("\n rtw_set_key:psecuritypriv->dot11PrivacyAlgrthm = %x (must be 1 or 2 or 4 or 5)\n",psecuritypriv->dot11PrivacyAlgrthm));
+			res= _FAIL;
+			goto exit;
+	}
+
+
+	pcmd->cmdcode = _SetKey_CMD_;
+	pcmd->parmbuf = (u8 *)psetkeyparm;
+	pcmd->cmdsz =  (sizeof(struct setkey_parm));
+	pcmd->rsp = NULL;
+	pcmd->rspsz = 0;
+
+
+	_rtw_init_listhead(&pcmd->list);
+
+	//_rtw_init_sema(&(pcmd->cmd_sem), 0);
+
+	res = rtw_enqueue_cmd(pcmdpriv, pcmd);
+
+exit:
+_func_exit_;
+	return res;
+
+}
+
+
+//adjust IEs for rtw_joinbss_cmd in WMM
+int rtw_restruct_wmm_ie(_adapter *adapter, u8 *in_ie, u8 *out_ie, uint in_len, uint initial_out_len)
+{
+	unsigned	int ielength=0;
+	unsigned int i, j;
+
+	i = 12; //after the fixed IE
+	while(i<in_len)
+	{
+		ielength = initial_out_len;
+
+		if(in_ie[i] == 0xDD && in_ie[i+2] == 0x00 && in_ie[i+3] == 0x50  && in_ie[i+4] == 0xF2 && in_ie[i+5] == 0x02 && i+5 < in_len) //WMM element ID and OUI
+		{
+
+			//Append WMM IE to the last index of out_ie
+			/*
+			for(j=i; j< i+(in_ie[i+1]+2); j++)
+			{
+				out_ie[ielength] = in_ie[j];
+				ielength++;
+			}
+			out_ie[initial_out_len+8] = 0x00; //force the QoS Info Field to be zero
+	                */
+
+                        for ( j = i; j < i + 9; j++ )
+                        {
+                            out_ie[ ielength] = in_ie[ j ];
+                            ielength++;
+                        }
+                        out_ie[ initial_out_len + 1 ] = 0x07;
+                        out_ie[ initial_out_len + 6 ] = 0x00;
+                        out_ie[ initial_out_len + 8 ] = 0x00;
+
+			break;
+		}
+
+		i+=(in_ie[i+1]+2); // to the next IE element
+	}
+
+	return ielength;
+
+}
+
+
+//
+// Ported from 8185: IsInPreAuthKeyList(). (Renamed from SecIsInPreAuthKeyList(), 2006-10-13.)
+// Added by Annie, 2006-05-07.
+//
+// Search by BSSID,
+// Return Value:
+//		-1 		:if there is no pre-auth key in the  table
+//		>=0		:if there is pre-auth key, and   return the entry id
+//
+//
+
+static int SecIsInPMKIDList(_adapter *Adapter, u8 *bssid)
+{
+	struct security_priv *psecuritypriv=&Adapter->securitypriv;
+	int i=0;
+
+	do
+	{
+		if( ( psecuritypriv->PMKIDList[i].bUsed ) &&
+                    (  _rtw_memcmp( psecuritypriv->PMKIDList[i].Bssid, bssid, ETH_ALEN ) == _TRUE ) )
+		{
+			break;
+		}
+		else
+		{
+			i++;
+			//continue;
+		}
+
+	}while(i<NUM_PMKID_CACHE);
+
+	if( i == NUM_PMKID_CACHE )
+	{
+		i = -1;// Could not find.
+	}
+	else
+	{
+		// There is one Pre-Authentication Key for the specific BSSID.
+	}
+
+	return (i);
+
+}
+
+//
+// Check the RSN IE length
+// If the RSN IE length <= 20, the RSN IE didn't include the PMKID information
+// 0-11th element in the array are the fixed IE
+// 12th element in the array is the IE
+// 13th element in the array is the IE length
+//
+
+static int rtw_append_pmkid(_adapter *Adapter,int iEntry, u8 *ie, uint ie_len)
+{
+	struct security_priv *psecuritypriv=&Adapter->securitypriv;
+
+	if(ie[13]<=20){
+		// The RSN IE didn't include the PMK ID, append the PMK information
+			ie[ie_len]=1;
+			ie_len++;
+			ie[ie_len]=0;	//PMKID count = 0x0100
+			ie_len++;
+			_rtw_memcpy(	&ie[ie_len], &psecuritypriv->PMKIDList[iEntry].PMKID, 16);
+
+			ie_len+=16;
+			ie[13]+=18;//PMKID length = 2+16
+
+	}
+	return (ie_len);
+
+}
+sint rtw_restruct_sec_ie(_adapter *adapter,u8 *in_ie, u8 *out_ie, uint in_len)
+{
+	u8 authmode, securitytype, match;
+	u8 sec_ie[255], uncst_oui[4], bkup_ie[255];
+	u8 wpa_oui[4]={0x0, 0x50, 0xf2, 0x01};
+	uint 	ielength, cnt, remove_cnt;
+	int iEntry;
+
+	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
+	struct security_priv *psecuritypriv=&adapter->securitypriv;
+	uint 	ndisauthmode=psecuritypriv->ndisauthtype;
+	uint ndissecuritytype = psecuritypriv->ndisencryptstatus;
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
+		 ("+rtw_restruct_sec_ie: ndisauthmode=%d ndissecuritytype=%d\n",
+		  ndisauthmode, ndissecuritytype));
+
+	//copy fixed ie only
+	_rtw_memcpy(out_ie, in_ie,12);
+	ielength=12;
+	if((ndisauthmode==Ndis802_11AuthModeWPA)||(ndisauthmode==Ndis802_11AuthModeWPAPSK))
+			authmode=_WPA_IE_ID_;
+	if((ndisauthmode==Ndis802_11AuthModeWPA2)||(ndisauthmode==Ndis802_11AuthModeWPA2PSK))
+			authmode=_WPA2_IE_ID_;
+
+	if(check_fwstate(pmlmepriv, WIFI_UNDER_WPS))
+	{
+		_rtw_memcpy(out_ie+ielength, psecuritypriv->wps_ie, psecuritypriv->wps_ie_len);
+
+		ielength += psecuritypriv->wps_ie_len;
+	}
+	else if((authmode==_WPA_IE_ID_)||(authmode==_WPA2_IE_ID_))
+	{
+		//copy RSN or SSN
+		_rtw_memcpy(&out_ie[ielength], &psecuritypriv->supplicant_ie[0], psecuritypriv->supplicant_ie[1]+2);
+		/* debug for CONFIG_IEEE80211W
+		{
+			int jj;
+			printk("supplicant_ie_length=%d &&&&&&&&&&&&&&&&&&&\n", psecuritypriv->supplicant_ie[1]+2);
+			for(jj=0; jj < psecuritypriv->supplicant_ie[1]+2; jj++)
+				printk(" %02x ", psecuritypriv->supplicant_ie[jj]);
+			printk("\n");
+		}*/
+		ielength+=psecuritypriv->supplicant_ie[1]+2;
+		rtw_report_sec_ie(adapter, authmode, psecuritypriv->supplicant_ie);
+
+#ifdef CONFIG_DRVEXT_MODULE
+		drvext_report_sec_ie(&adapter->drvextpriv, authmode, sec_ie);
+#endif
+	}
+
+	iEntry = SecIsInPMKIDList(adapter, pmlmepriv->assoc_bssid);
+	if(iEntry<0)
+	{
+		return ielength;
+	}
+	else
+	{
+		if(authmode == _WPA2_IE_ID_)
+		{
+			ielength=rtw_append_pmkid(adapter, iEntry, out_ie, ielength);
+		}
+	}
+
+_func_exit_;
+
+	return ielength;
+}
+
+void rtw_init_registrypriv_dev_network(	_adapter* adapter)
+{
+	struct registry_priv* pregistrypriv = &adapter->registrypriv;
+	struct eeprom_priv* peepriv = &adapter->eeprompriv;
+	WLAN_BSSID_EX    *pdev_network = &pregistrypriv->dev_network;
+	u8 *myhwaddr = myid(peepriv);
+
+_func_enter_;
+
+	_rtw_memcpy(pdev_network->MacAddress, myhwaddr, ETH_ALEN);
+
+	_rtw_memcpy(&pdev_network->Ssid, &pregistrypriv->ssid, sizeof(NDIS_802_11_SSID));
+
+	pdev_network->Configuration.Length=sizeof(NDIS_802_11_CONFIGURATION);
+	pdev_network->Configuration.BeaconPeriod = 100;
+	pdev_network->Configuration.FHConfig.Length = 0;
+	pdev_network->Configuration.FHConfig.HopPattern = 0;
+	pdev_network->Configuration.FHConfig.HopSet = 0;
+	pdev_network->Configuration.FHConfig.DwellTime = 0;
+
+
+_func_exit_;
+
+}
+
+void rtw_update_registrypriv_dev_network(_adapter* adapter)
+{
+	int sz=0;
+	struct registry_priv* pregistrypriv = &adapter->registrypriv;
+	WLAN_BSSID_EX    *pdev_network = &pregistrypriv->dev_network;
+	struct	security_priv*	psecuritypriv = &adapter->securitypriv;
+	struct	wlan_network	*cur_network = &adapter->mlmepriv.cur_network;
+	//struct	xmit_priv	*pxmitpriv = &adapter->xmitpriv;
+
+_func_enter_;
+
+#if 0
+	pxmitpriv->vcs_setting = pregistrypriv->vrtl_carrier_sense;
+	pxmitpriv->vcs = pregistrypriv->vcs_type;
+	pxmitpriv->vcs_type = pregistrypriv->vcs_type;
+	//pxmitpriv->rts_thresh = pregistrypriv->rts_thresh;
+	pxmitpriv->frag_len = pregistrypriv->frag_thresh;
+
+	adapter->qospriv.qos_option = pregistrypriv->wmm_enable;
+#endif
+
+	pdev_network->Privacy = (psecuritypriv->dot11PrivacyAlgrthm > 0 ? 1 : 0) ; // adhoc no 802.1x
+
+	pdev_network->Rssi = 0;
+
+	switch(pregistrypriv->wireless_mode)
+	{
+		case WIRELESS_11B:
+			pdev_network->NetworkTypeInUse = (Ndis802_11DS);
+			break;
+		case WIRELESS_11G:
+		case WIRELESS_11BG:
+		case WIRELESS_11_24N:
+		case WIRELESS_11G_24N:
+		case WIRELESS_11BG_24N:
+			pdev_network->NetworkTypeInUse = (Ndis802_11OFDM24);
+			break;
+		case WIRELESS_11A:
+		case WIRELESS_11A_5N:
+			pdev_network->NetworkTypeInUse = (Ndis802_11OFDM5);
+			break;
+		case WIRELESS_11ABGN:
+			if(pregistrypriv->channel > 14)
+				pdev_network->NetworkTypeInUse = (Ndis802_11OFDM5);
+			else
+				pdev_network->NetworkTypeInUse = (Ndis802_11OFDM24);
+			break;
+		default :
+			// TODO
+			break;
+	}
+
+	pdev_network->Configuration.DSConfig = (pregistrypriv->channel);
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("pregistrypriv->channel=%d, pdev_network->Configuration.DSConfig=0x%x\n", pregistrypriv->channel, pdev_network->Configuration.DSConfig));
+
+	if(cur_network->network.InfrastructureMode == Ndis802_11IBSS)
+		pdev_network->Configuration.ATIMWindow = (0);
+
+	pdev_network->InfrastructureMode = (cur_network->network.InfrastructureMode);
+
+	// 1. Supported rates
+	// 2. IE
+
+	//rtw_set_supported_rate(pdev_network->SupportedRates, pregistrypriv->wireless_mode) ; // will be called in rtw_generate_ie
+	sz = rtw_generate_ie(pregistrypriv);
+
+	pdev_network->IELength = sz;
+
+	pdev_network->Length = get_WLAN_BSSID_EX_sz((WLAN_BSSID_EX  *)pdev_network);
+
+	//notes: translate IELength & Length after assign the Length to cmdsz in createbss_cmd();
+	//pdev_network->IELength = cpu_to_le32(sz);
+
+_func_exit_;
+
+}
+
+void rtw_get_encrypt_decrypt_from_registrypriv(_adapter* adapter)
+{
+_func_enter_;
+
+
+_func_exit_;
+
+}
+
+//the fucntion is at passive_level
+void rtw_joinbss_reset(_adapter *padapter)
+{
+	u8	threshold;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+
+#ifdef CONFIG_80211N_HT
+	struct ht_priv		*phtpriv = &pmlmepriv->htpriv;
+#endif
+
+	//todo: if you want to do something io/reg/hw setting before join_bss, please add code here
+
+
+
+
+#ifdef CONFIG_80211N_HT
+
+	pmlmepriv->num_FortyMHzIntolerant = 0;
+
+	pmlmepriv->num_sta_no_ht = 0;
+
+	phtpriv->ampdu_enable = _FALSE;//reset to disabled
+
+#ifdef CONFIG_USB_HCI
+	// TH=1 => means that invalidate usb rx aggregation
+	// TH=0 => means that validate usb rx aggregation, use init value.
+	if(phtpriv->ht_option)
+	{
+		if(padapter->registrypriv.wifi_spec==1)
+			threshold = 1;
+		else
+			threshold = 0;
+		rtw_hal_set_hwreg(padapter, HW_VAR_RXDMA_AGG_PG_TH, (u8 *)(&threshold));
+	}
+	else
+	{
+		threshold = 1;
+		rtw_hal_set_hwreg(padapter, HW_VAR_RXDMA_AGG_PG_TH, (u8 *)(&threshold));
+	}
+#endif
+
+#endif
+
+}
+
+
+#ifdef CONFIG_80211N_HT
+
+//the fucntion is >= passive_level
+unsigned int rtw_restructure_ht_ie(_adapter *padapter, u8 *in_ie, u8 *out_ie, uint in_len, uint *pout_len, u8 channel)
+{
+	u32 ielen, out_len;
+	unsigned char *p, *pframe;
+	struct rtw_ieee80211_ht_cap ht_capie;
+	unsigned char WMM_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01, 0x00};
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct qos_priv   	*pqospriv= &pmlmepriv->qospriv;
+	struct ht_priv		*phtpriv = &pmlmepriv->htpriv;
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	u8 cbw40_enable = 0;
+
+	phtpriv->ht_option = _FALSE;
+
+	p = rtw_get_ie(in_ie+12, _HT_CAPABILITY_IE_, &ielen, in_len-12);
+
+	if(p && ielen>0)
+	{
+		if(pqospriv->qos_option == 0)
+		{
+			out_len = *pout_len;
+			pframe = rtw_set_ie(out_ie+out_len, _VENDOR_SPECIFIC_IE_,
+								_WMM_IE_Length_, WMM_IE, pout_len);
+
+			pqospriv->qos_option = 1;
+		}
+
+		out_len = *pout_len;
+
+		_rtw_memset(&ht_capie, 0, sizeof(struct rtw_ieee80211_ht_cap));
+
+		ht_capie.cap_info =  IEEE80211_HT_CAP_SGI_20 | IEEE80211_HT_CAP_TX_STBC |
+							IEEE80211_HT_CAP_DSSSCCK40;
+		//if insert module set only support 20MHZ, don't add the 40MHZ and SGI_40
+		if( channel > 14 )
+		{
+			if( pregpriv->cbw40_enable & BIT(1) )
+				cbw40_enable = 1;
+		}
+		else
+			if( pregpriv->cbw40_enable & BIT(0) )
+				cbw40_enable = 1;
+
+		if ( cbw40_enable != 0 )
+			ht_capie.cap_info |= IEEE80211_HT_CAP_SUP_WIDTH | IEEE80211_HT_CAP_SGI_40;
+
+
+
+		{
+			u32 rx_packet_offset, max_recvbuf_sz;
+			rtw_hal_get_def_var(padapter, HAL_DEF_RX_PACKET_OFFSET, &rx_packet_offset);
+			rtw_hal_get_def_var(padapter, HAL_DEF_MAX_RECVBUF_SZ, &max_recvbuf_sz);
+			//if(max_recvbuf_sz-rx_packet_offset>(8191-256)) {
+			//	DBG_871X("%s IEEE80211_HT_CAP_MAX_AMSDU is set\n", __FUNCTION__);
+			//	ht_capie.cap_info = ht_capie.cap_info |IEEE80211_HT_CAP_MAX_AMSDU;
+			//}
+		}
+
+		ht_capie.ampdu_params_info = (IEEE80211_HT_CAP_AMPDU_FACTOR&0x03);
+
+		if(padapter->securitypriv.dot11PrivacyAlgrthm == _AES_ )
+			ht_capie.ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY&(0x07<<2));
+		else
+			ht_capie.ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY&0x00);
+
+
+		pframe = rtw_set_ie(out_ie+out_len, _HT_CAPABILITY_IE_,
+							sizeof(struct rtw_ieee80211_ht_cap), (unsigned char*)&ht_capie, pout_len);
+
+
+		//_rtw_memcpy(out_ie+out_len, p, ielen+2);//gtest
+		//*pout_len = *pout_len + (ielen+2);
+
+
+		phtpriv->ht_option = _TRUE;
+
+		p = rtw_get_ie(in_ie+12, _HT_ADD_INFO_IE_, &ielen, in_len-12);
+		if(p && (ielen==sizeof(struct ieee80211_ht_addt_info)))
+		{
+			out_len = *pout_len;
+			pframe = rtw_set_ie(out_ie+out_len, _HT_ADD_INFO_IE_, ielen, p+2 , pout_len);
+		}
+
+	}
+
+	return (phtpriv->ht_option);
+
+}
+
+//the fucntion is > passive_level (in critical_section)
+void rtw_update_ht_cap(_adapter *padapter, u8 *pie, uint ie_len, u8 channel)
+{
+	u8 *p, max_ampdu_sz;
+	int len;
+	//struct sta_info *bmc_sta, *psta;
+	struct rtw_ieee80211_ht_cap *pht_capie;
+	struct ieee80211_ht_addt_info *pht_addtinfo;
+	//struct recv_reorder_ctrl *preorder_ctrl;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct ht_priv		*phtpriv = &pmlmepriv->htpriv;
+	//struct recv_priv *precvpriv = &padapter->recvpriv;
+	struct registry_priv *pregistrypriv = &padapter->registrypriv;
+	//struct wlan_network *pcur_network = &(pmlmepriv->cur_network);;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 cbw40_enable=0;
+
+	if(!phtpriv->ht_option)
+		return;
+
+	if ((!pmlmeinfo->HT_info_enable) || (!pmlmeinfo->HT_caps_enable))
+		return;
+
+	DBG_871X("+rtw_update_ht_cap()\n");
+
+	//maybe needs check if ap supports rx ampdu.
+	if((phtpriv->ampdu_enable==_FALSE) &&(pregistrypriv->ampdu_enable==1))
+	{
+		//In the wifi cert. test, the test Lab should turn off the AP's RX AMPDU. client doen't need to close the TX AMPDU
+		/*if(pregistrypriv->wifi_spec==1)
+		{
+			phtpriv->ampdu_enable = _FALSE;
+		}
+		else*/
+		{
+			phtpriv->ampdu_enable = _TRUE;
+		}
+	}
+	else if(pregistrypriv->ampdu_enable==2)
+	{
+		phtpriv->ampdu_enable = _TRUE;
+	}
+
+
+	//check Max Rx A-MPDU Size
+	len = 0;
+	p = rtw_get_ie(pie+sizeof (NDIS_802_11_FIXED_IEs), _HT_CAPABILITY_IE_, &len, ie_len-sizeof (NDIS_802_11_FIXED_IEs));
+	if(p && len>0)
+	{
+		pht_capie = (struct rtw_ieee80211_ht_cap *)(p+2);
+		max_ampdu_sz = (pht_capie->ampdu_params_info & IEEE80211_HT_CAP_AMPDU_FACTOR);
+		max_ampdu_sz = 1 << (max_ampdu_sz+3); // max_ampdu_sz (kbytes);
+
+		//DBG_871X("rtw_update_ht_cap(): max_ampdu_sz=%d\n", max_ampdu_sz);
+		phtpriv->rx_ampdu_maxlen = max_ampdu_sz;
+
+	}
+
+
+	len=0;
+	p = rtw_get_ie(pie+sizeof (NDIS_802_11_FIXED_IEs), _HT_ADD_INFO_IE_, &len, ie_len-sizeof (NDIS_802_11_FIXED_IEs));
+	if(p && len>0)
+	{
+		pht_addtinfo = (struct ieee80211_ht_addt_info *)(p+2);
+		//todo:
+	}
+
+	if( channel > 14 )
+	{
+		if( pregistrypriv->cbw40_enable & BIT(1) )
+			cbw40_enable = 1;
+	}
+	else
+		if( pregistrypriv->cbw40_enable & BIT(0) )
+			cbw40_enable = 1;
+
+
+	//update cur_bwmode & cur_ch_offset
+	if ((cbw40_enable) &&
+		(pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info & BIT(1)) &&
+		(pmlmeinfo->HT_info.infos[0] & BIT(2)))
+	{
+		int i;
+		u8	rf_type;
+
+		rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+
+		//update the MCS rates
+		for (i = 0; i < 16; i++)
+		{
+			if((rf_type == RF_1T1R) || (rf_type == RF_1T2R))
+			{
+				pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_1R[i];
+			}
+			else
+			{
+				#ifdef CONFIG_DISABLE_MCS13TO15
+				if(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40 && pregistrypriv->wifi_spec != 1 )
+				{
+					pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_2R_MCS13TO15_OFF[i];
+				}
+				else
+					pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_2R[i];
+				#else
+				pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_2R[i];
+				#endif //CONFIG_DISABLE_MCS13TO15
+			}
+			#ifdef RTL8192C_RECONFIG_TO_1T1R
+			{
+				pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_1R[i];
+			}
+			#endif
+
+			if(pregistrypriv->special_rf_path)
+				pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_1R[i];
+
+		}
+		//switch to the 40M Hz mode accoring to the AP
+		pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+		switch ((pmlmeinfo->HT_info.infos[0] & 0x3))
+		{
+			case HT_EXTCHNL_OFFSET_UPPER:
+				pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+				break;
+
+			case HT_EXTCHNL_OFFSET_LOWER:
+				pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+				break;
+
+			default:
+				pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+				break;
+		}
+	}
+
+	//
+	// Config SM Power Save setting
+	//
+	pmlmeinfo->SM_PS = (pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info & 0x0C) >> 2;
+	if(pmlmeinfo->SM_PS == WLAN_HT_CAP_SM_PS_STATIC)
+	{
+		/*u8 i;
+		//update the MCS rates
+		for (i = 0; i < 16; i++)
+		{
+			pmlmeinfo->HT_caps.HT_cap_element.MCS_rate[i] &= MCS_rate_1R[i];
+		}*/
+		DBG_871X("%s(): WLAN_HT_CAP_SM_PS_STATIC\n",__FUNCTION__);
+	}
+
+	//
+	// Config current HT Protection mode.
+	//
+	pmlmeinfo->HT_protection = pmlmeinfo->HT_info.infos[1] & 0x3;
+
+
+
+#if 0 //move to rtw_update_sta_info_client()
+	//for A-MPDU Rx reordering buffer control for bmc_sta & sta_info
+	//if A-MPDU Rx is enabled, reseting  rx_ordering_ctrl wstart_b(indicate_seq) to default value=0xffff
+	//todo: check if AP can send A-MPDU packets
+	bmc_sta = rtw_get_bcmc_stainfo(padapter);
+	if(bmc_sta)
+	{
+		for(i=0; i < 16 ; i++)
+		{
+			//preorder_ctrl = &precvpriv->recvreorder_ctrl[i];
+			preorder_ctrl = &bmc_sta->recvreorder_ctrl[i];
+			preorder_ctrl->enable = _FALSE;
+			preorder_ctrl->indicate_seq = 0xffff;
+			#ifdef DBG_RX_SEQ
+			DBG_871X("DBG_RX_SEQ %s:%d indicate_seq:%u \n", __FUNCTION__, __LINE__,
+				preorder_ctrl->indicate_seq);
+			#endif
+			preorder_ctrl->wend_b= 0xffff;
+			preorder_ctrl->wsize_b = 64;//max_ampdu_sz;//ex. 32(kbytes) -> wsize_b=32
+		}
+	}
+
+	psta = rtw_get_stainfo(&padapter->stapriv, pcur_network->network.MacAddress);
+	if(psta)
+	{
+		for(i=0; i < 16 ; i++)
+		{
+			//preorder_ctrl = &precvpriv->recvreorder_ctrl[i];
+			preorder_ctrl = &psta->recvreorder_ctrl[i];
+			preorder_ctrl->enable = _FALSE;
+			preorder_ctrl->indicate_seq = 0xffff;
+			#ifdef DBG_RX_SEQ
+			DBG_871X("DBG_RX_SEQ %s:%d indicate_seq:%u \n", __FUNCTION__, __LINE__,
+				preorder_ctrl->indicate_seq);
+			#endif
+			preorder_ctrl->wend_b= 0xffff;
+			preorder_ctrl->wsize_b = 64;//max_ampdu_sz;//ex. 32(kbytes) -> wsize_b=32
+		}
+	}
+#endif
+
+}
+
+void rtw_issue_addbareq_cmd(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	u8 issued;
+	int priority;
+	struct sta_info *psta=NULL;
+	struct ht_priv	*phtpriv;
+	struct pkt_attrib *pattrib =&pxmitframe->attrib;
+	s32 bmcst = IS_MCAST(pattrib->ra);
+
+	if(bmcst || (padapter->mlmepriv.LinkDetectInfo.bTxBusyTraffic == _FALSE))
+		return;
+
+	priority = pattrib->priority;
+
+	if (pattrib->psta)
+		psta = pattrib->psta;
+	else
+	{
+		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+		psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
+	}
+
+	if(psta==NULL)
+	{
+		DBG_871X("%s, psta==NUL\n", __func__);
+		return;
+	}
+
+	if(!(psta->state &_FW_LINKED))
+	{
+		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
+		return;
+	}
+
+
+	phtpriv = &psta->htpriv;
+
+	if((phtpriv->ht_option==_TRUE) && (phtpriv->ampdu_enable==_TRUE))
+	{
+		issued = (phtpriv->agg_enable_bitmap>>priority)&0x1;
+		issued |= (phtpriv->candidate_tid_bitmap>>priority)&0x1;
+
+		if(0==issued)
+		{
+			DBG_871X("rtw_issue_addbareq_cmd, p=%d\n", priority);
+			psta->htpriv.candidate_tid_bitmap |= BIT((u8)priority);
+			rtw_addbareq_cmd(padapter,(u8) priority, pattrib->ra);
+		}
+	}
+
+}
+
+#endif
+
+#ifdef CONFIG_LAYER2_ROAMING
+inline void rtw_set_roaming(_adapter *adapter, u8 to_roaming)
+{
+	if (to_roaming == 0)
+		adapter->mlmepriv.to_join = _FALSE;
+	adapter->mlmepriv.to_roaming = to_roaming;
+}
+
+inline u8 rtw_to_roaming(_adapter *adapter)
+{
+	return adapter->mlmepriv.to_roaming;
+}
+
+void rtw_roaming(_adapter *padapter, struct wlan_network *tgt_network)
+{
+	_irqL irqL;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	_rtw_roaming(padapter, tgt_network);
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+}
+void _rtw_roaming(_adapter *padapter, struct wlan_network *tgt_network)
+{
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	int do_join_r;
+
+	struct wlan_network *pnetwork;
+
+	if(tgt_network != NULL)
+		pnetwork = tgt_network;
+	else
+		pnetwork = &pmlmepriv->cur_network;
+
+	if(0 < rtw_to_roaming(padapter)) {
+		DBG_871X("roaming from %s("MAC_FMT"), length:%d\n",
+				pnetwork->network.Ssid.Ssid, MAC_ARG(pnetwork->network.MacAddress),
+				pnetwork->network.Ssid.SsidLength);
+		_rtw_memcpy(&pmlmepriv->assoc_ssid, &pnetwork->network.Ssid, sizeof(NDIS_802_11_SSID));
+
+		pmlmepriv->assoc_by_bssid = _FALSE;
+
+		while(1) {
+			if( _SUCCESS==(do_join_r=rtw_do_join(padapter)) ) {
+				break;
+			} else {
+				DBG_871X("roaming do_join return %d\n", do_join_r);
+				pmlmepriv->to_roaming--;
+
+				if(0< rtw_to_roaming(padapter)) {
+					continue;
+				} else {
+					DBG_871X("%s(%d) -to roaming fail, indicate_disconnect\n", __FUNCTION__,__LINE__);
+					rtw_indicate_disconnect(padapter);
+					break;
+				}
+			}
+		}
+	}
+
+}
+#endif
+
+#ifdef CONFIG_CONCURRENT_MODE
+sint rtw_buddy_adapter_up(_adapter *padapter)
+{
+	sint res = _FALSE;
+
+	if(padapter == NULL)
+		return res;
+
+
+	if(padapter->pbuddy_adapter == NULL)
+	{
+		res = _FALSE;
+	}
+	else if( (padapter->pbuddy_adapter->bDriverStopped) || (padapter->pbuddy_adapter->bSurpriseRemoved) ||
+		(padapter->pbuddy_adapter->bup == _FALSE) || (padapter->pbuddy_adapter->hw_init_completed == _FALSE))
+	{
+		res = _FALSE;
+	}
+	else
+	{
+		res = _TRUE;
+	}
+
+	return res;
+
+}
+
+sint check_buddy_fwstate(_adapter *padapter, sint state)
+{
+	if(padapter == NULL)
+		return _FALSE;
+
+	if(padapter->pbuddy_adapter == NULL)
+		return _FALSE;
+
+	if ((state == WIFI_FW_NULL_STATE) &&
+		(padapter->pbuddy_adapter->mlmepriv.fw_state == WIFI_FW_NULL_STATE))
+		return _TRUE;
+
+	if (padapter->pbuddy_adapter->mlmepriv.fw_state & state)
+		return _TRUE;
+
+	return _FALSE;
+}
+#endif //CONFIG_CONCURRENT_MODE
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mlme_ext.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mlme_ext.c
new file mode 100644
index 000000000000..555ff54c8406
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mlme_ext.c
@@ -0,0 +1,13600 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_MLME_EXT_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <wifi.h>
+#include <rtw_mlme_ext.h>
+#include <wlan_bssdef.h>
+#include <mlme_osdep.h>
+#include <recv_osdep.h>
+
+struct mlme_handler mlme_sta_tbl[]={
+	{WIFI_ASSOCREQ,		"OnAssocReq",	&OnAssocReq},
+	{WIFI_ASSOCRSP,		"OnAssocRsp",	&OnAssocRsp},
+	{WIFI_REASSOCREQ,	"OnReAssocReq",	&OnAssocReq},
+	{WIFI_REASSOCRSP,	"OnReAssocRsp",	&OnAssocRsp},
+	{WIFI_PROBEREQ,		"OnProbeReq",	&OnProbeReq},
+	{WIFI_PROBERSP,		"OnProbeRsp",		&OnProbeRsp},
+
+	/*----------------------------------------------------------
+					below 2 are reserved
+	-----------------------------------------------------------*/
+	{0,					"DoReserved",		&DoReserved},
+	{0,					"DoReserved",		&DoReserved},
+	{WIFI_BEACON,		"OnBeacon",		&OnBeacon},
+	{WIFI_ATIM,			"OnATIM",		&OnAtim},
+	{WIFI_DISASSOC,		"OnDisassoc",		&OnDisassoc},
+	{WIFI_AUTH,			"OnAuth",		&OnAuthClient},
+	{WIFI_DEAUTH,		"OnDeAuth",		&OnDeAuth},
+	{WIFI_ACTION,		"OnAction",		&OnAction},
+};
+
+#ifdef _CONFIG_NATIVEAP_MLME_
+struct mlme_handler mlme_ap_tbl[]={
+	{WIFI_ASSOCREQ,		"OnAssocReq",	&OnAssocReq},
+	{WIFI_ASSOCRSP,		"OnAssocRsp",	&OnAssocRsp},
+	{WIFI_REASSOCREQ,	"OnReAssocReq",	&OnAssocReq},
+	{WIFI_REASSOCRSP,	"OnReAssocRsp",	&OnAssocRsp},
+	{WIFI_PROBEREQ,		"OnProbeReq",	&OnProbeReq},
+	{WIFI_PROBERSP,		"OnProbeRsp",		&OnProbeRsp},
+
+	/*----------------------------------------------------------
+					below 2 are reserved
+	-----------------------------------------------------------*/
+	{0,					"DoReserved",		&DoReserved},
+	{0,					"DoReserved",		&DoReserved},
+	{WIFI_BEACON,		"OnBeacon",		&OnBeacon},
+	{WIFI_ATIM,			"OnATIM",		&OnAtim},
+	{WIFI_DISASSOC,		"OnDisassoc",		&OnDisassoc},
+	{WIFI_AUTH,			"OnAuth",		&OnAuth},
+	{WIFI_DEAUTH,		"OnDeAuth",		&OnDeAuth},
+	{WIFI_ACTION,		"OnAction",		&OnAction},
+};
+#endif
+
+struct action_handler OnAction_tbl[]={
+	{RTW_WLAN_CATEGORY_SPECTRUM_MGMT,	 "ACTION_SPECTRUM_MGMT", on_action_spct},
+	{RTW_WLAN_CATEGORY_QOS, "ACTION_QOS", &OnAction_qos},
+	{RTW_WLAN_CATEGORY_DLS, "ACTION_DLS", &OnAction_dls},
+	{RTW_WLAN_CATEGORY_BACK, "ACTION_BACK", &OnAction_back},
+	{RTW_WLAN_CATEGORY_PUBLIC, "ACTION_PUBLIC", on_action_public},
+	{RTW_WLAN_CATEGORY_RADIO_MEASUREMENT, "ACTION_RADIO_MEASUREMENT", &DoReserved},
+	{RTW_WLAN_CATEGORY_FT, "ACTION_FT",	&DoReserved},
+	{RTW_WLAN_CATEGORY_HT,	"ACTION_HT",	&OnAction_ht},
+#ifdef CONFIG_IEEE80211W
+	{RTW_WLAN_CATEGORY_SA_QUERY, "ACTION_SA_QUERY", &OnAction_sa_query},
+#else
+	{RTW_WLAN_CATEGORY_SA_QUERY, "ACTION_SA_QUERY", &DoReserved},
+#endif //CONFIG_IEEE80211W
+	//add for CONFIG_IEEE80211W
+	{RTW_WLAN_CATEGORY_UNPROTECTED_WNM, "ACTION_UNPROTECTED_WNM", &DoReserved},
+	{RTW_WLAN_CATEGORY_SELF_PROTECTED, "ACTION_SELF_PROTECTED", &DoReserved},
+	{RTW_WLAN_CATEGORY_WMM, "ACTION_WMM", &OnAction_wmm},
+	{RTW_WLAN_CATEGORY_P2P, "ACTION_P2P", &OnAction_p2p},
+};
+
+
+u8	null_addr[ETH_ALEN]= {0,0,0,0,0,0};
+
+/**************************************************
+OUI definitions for the vendor specific IE
+***************************************************/
+unsigned char	RTW_WPA_OUI[] = {0x00, 0x50, 0xf2, 0x01};
+unsigned char WMM_OUI[] = {0x00, 0x50, 0xf2, 0x02};
+unsigned char	WPS_OUI[] = {0x00, 0x50, 0xf2, 0x04};
+unsigned char	P2P_OUI[] = {0x50,0x6F,0x9A,0x09};
+unsigned char	WFD_OUI[] = {0x50,0x6F,0x9A,0x0A};
+
+unsigned char	WMM_INFO_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
+unsigned char	WMM_PARA_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
+
+unsigned char WPA_TKIP_CIPHER[4] = {0x00, 0x50, 0xf2, 0x02};
+unsigned char RSN_TKIP_CIPHER[4] = {0x00, 0x0f, 0xac, 0x02};
+
+extern unsigned char REALTEK_96B_IE[];
+
+/********************************************************
+MCS rate definitions
+*********************************************************/
+#ifdef CONFIG_DISABLE_MCS13TO15
+unsigned char	MCS_rate_2R_MCS13TO15_OFF[16] = {0xff, 0x1f, 0x0, 0x0, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
+unsigned char	MCS_rate_2R[16] = {0xff, 0xff, 0x0, 0x0, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
+#else //CONFIG_DISABLE_MCS13TO15
+unsigned char	MCS_rate_2R[16] = {0xff, 0xff, 0x0, 0x0, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
+#endif //CONFIG_DISABLE_MCS13TO15
+unsigned char	MCS_rate_1R[16] = {0xff, 0x00, 0x0, 0x0, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
+
+/********************************************************
+ChannelPlan definitions
+*********************************************************/
+/*static RT_CHANNEL_PLAN	DefaultChannelPlan[RT_CHANNEL_DOMAIN_MAX] = {
+	{{1,2,3,4,5,6,7,8,9,10,11,36,40,44,48,52,56,60,64,100,104,108,112,116,132,136,140,149,153,157,161,165},32},					// 0x00, RT_CHANNEL_DOMAIN_FCC
+	{{1,2,3,4,5,6,7,8,9,10,11,36,40,44,48,52,56,60,64,100,104,108,112,116,136,140,149,153,157,161,165},31},						// 0x01, RT_CHANNEL_DOMAIN_IC
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140},32},						// 0x02, RT_CHANNEL_DOMAIN_ETSI
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13},13},																					// 0x03, RT_CHANNEL_DOMAIN_SPAIN
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13},13},																					// 0x04, RT_CHANNEL_DOMAIN_FRANCE
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13},13},																					// 0x05, RT_CHANNEL_DOMAIN_MKK
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13},13},																					// 0x06, RT_CHANNEL_DOMAIN_MKK1
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48,52,56,60,64},21},																// 0x07, RT_CHANNEL_DOMAIN_ISRAEL
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,14,36,40,44,48,52,56,60,64},22},															// 0x08, RT_CHANNEL_DOMAIN_TELEC
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,14},14},																				// 0x09, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13},13},																					// 0x0A, RT_CHANNEL_DOMAIN_WORLD_WIDE_13
+	{{1,2,3,4,5,6,7,8,9,10,11,56,60,64,100,104,108,112,116,136,140,149,153,157,161,165},26},									// 0x0B, RT_CHANNEL_DOMAIN_TAIWAN
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,149,153,157,161,165},18},																// 0x0C, RT_CHANNEL_DOMAIN_CHINA
+	{{1,2,3,4,5,6,7,8,9,10,11,36,40,44,48,52,56,60,64,149,153,157,161,165},24},												// 0x0D, RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO
+	{{1,2,3,4,5,6,7,8,9,10,11,36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,149,153,157,161,165},31},						// 0x0E, RT_CHANNEL_DOMAIN_KOREA
+	{{1,2,3,4,5,6,7,8,9,10,11,36,40,44,48,52,56,60,64},19},																	// 0x0F, RT_CHANNEL_DOMAIN_TURKEY
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140},32},						// 0x10, RT_CHANNEL_DOMAIN_JAPAN
+	{{1,2,3,4,5,6,7,8,9,10,11,36,40,44,48,149,153,157,161,165},20},															// 0x11, RT_CHANNEL_DOMAIN_FCC_NO_DFS
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48},17},																		// 0x12, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,149,153,157,161,165},37},	// 0x13, RT_CHANNEL_DOMAIN_WORLD_WIDE_5G
+	{{1,2,3,4,5,6,7,8,9,10,11,56,60,64,149,153,157,161,165},19},																// 0x14, RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS
+};*/
+
+static RT_CHANNEL_PLAN_2G	RTW_ChannelPlan2G[RT_CHANNEL_DOMAIN_2G_MAX] = {
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13},13},		// 0x00, RT_CHANNEL_DOMAIN_2G_WORLD , Passive scan CH 12, 13
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13},13},		// 0x01, RT_CHANNEL_DOMAIN_2G_ETSI1
+	{{1,2,3,4,5,6,7,8,9,10,11},11},			// 0x02, RT_CHANNEL_DOMAIN_2G_FCC1
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,14},14},	// 0x03, RT_CHANNEL_DOMAIN_2G_MIKK1
+	{{10,11,12,13},4},						// 0x04, RT_CHANNEL_DOMAIN_2G_ETSI2
+	{{},0},									// 0x05, RT_CHANNEL_DOMAIN_2G_NULL
+};
+
+static RT_CHANNEL_PLAN_5G	RTW_ChannelPlan5G[RT_CHANNEL_DOMAIN_5G_MAX] = {
+	{{},0},																					// 0x00, RT_CHANNEL_DOMAIN_5G_NULL
+	{{36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140},19},						// 0x01, RT_CHANNEL_DOMAIN_5G_ETSI1
+	{{36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,149,153,157,161,165},24},	// 0x02, RT_CHANNEL_DOMAIN_5G_ETSI2
+	{{36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,149,153,157,161,165},22},			// 0x03, RT_CHANNEL_DOMAIN_5G_ETSI3
+	{{36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,149,153,157,161,165},24},	// 0x04, RT_CHANNEL_DOMAIN_5G_FCC1
+	{{36,40,44,48,149,153,157,161,165},9},														// 0x05, RT_CHANNEL_DOMAIN_5G_FCC2
+	{{36,40,44,48,52,56,60,64,149,153,157,161,165},13},											// 0x06, RT_CHANNEL_DOMAIN_5G_FCC3
+	{{36,40,44,48,52,56,60,64,149,153,157,161},12},												// 0x07, RT_CHANNEL_DOMAIN_5G_FCC4
+	{{149,153,157,161,165},5},																	// 0x08, RT_CHANNEL_DOMAIN_5G_FCC5
+	{{36,40,44,48,52,56,60,64},8},																// 0x09, RT_CHANNEL_DOMAIN_5G_FCC6
+	{{36,40,44,48,52,56,60,64,100,104,108,112,116,136,140,149,153,157,161,165},20},					// 0x0A, RT_CHANNEL_DOMAIN_5G_FCC7_IC1
+	{{36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,149,153,157,161,165},20},					// 0x0B, RT_CHANNEL_DOMAIN_5G_KCC1
+	{{36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140},19},						// 0x0C, RT_CHANNEL_DOMAIN_5G_MKK1
+	{{36,40,44,48,52,56,60,64},8},																// 0x0D, RT_CHANNEL_DOMAIN_5G_MKK2
+	{{100,104,108,112,116,120,124,128,132,136,140},11},											// 0x0E, RT_CHANNEL_DOMAIN_5G_MKK3
+	{{56,60,64,100,104,108,112,116,136,140,149,153,157,161,165},15},								// 0x0F, RT_CHANNEL_DOMAIN_5G_NCC1
+	{{56,60,64,149,153,157,161,165},8},															// 0x10, RT_CHANNEL_DOMAIN_5G_NCC2
+
+	//===== Driver self defined for old channel plan Compatible ,Remember to modify if have new channel plan definition =====
+	{{36,40,44,48,52,56,60,64,100,104,108,112,116,132,136,140,149,153,157,161,165},21},				// 0x11, RT_CHANNEL_DOMAIN_5G_FCC
+	{{36,40,44,48},4},																			// 0x12, RT_CHANNEL_DOMAIN_5G_JAPAN_NO_DFS
+	{{36,40,44,48,149,153,157,161},8},																// 0x13, RT_CHANNEL_DOMAIN_5G_FCC4_NO_DFS
+};
+
+static RT_CHANNEL_PLAN_MAP	RTW_ChannelPlanMap[RT_CHANNEL_DOMAIN_MAX] = {
+	//===== 0x00 ~ 0x1F , Old Define =====
+	{0x02,0x11},	//0x00, RT_CHANNEL_DOMAIN_FCC
+	{0x02,0x0A},	//0x01, RT_CHANNEL_DOMAIN_IC
+	{0x01,0x01},	//0x02, RT_CHANNEL_DOMAIN_ETSI
+	{0x01,0x00},	//0x03, RT_CHANNEL_DOMAIN_SPAIN
+	{0x01,0x00},	//0x04, RT_CHANNEL_DOMAIN_FRANCE
+	{0x03,0x00},	//0x05, RT_CHANNEL_DOMAIN_MKK
+	{0x03,0x00},	//0x06, RT_CHANNEL_DOMAIN_MKK1
+	{0x01,0x09},	//0x07, RT_CHANNEL_DOMAIN_ISRAEL
+	{0x03,0x09},	//0x08, RT_CHANNEL_DOMAIN_TELEC
+	{0x03,0x00},	//0x09, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN
+	{0x00,0x00},	//0x0A, RT_CHANNEL_DOMAIN_WORLD_WIDE_13
+	{0x02,0x0F},	//0x0B, RT_CHANNEL_DOMAIN_TAIWAN
+	{0x01,0x08},	//0x0C, RT_CHANNEL_DOMAIN_CHINA
+	{0x02,0x06},	//0x0D, RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO
+	{0x02,0x0B},	//0x0E, RT_CHANNEL_DOMAIN_KOREA
+	{0x02,0x09},	//0x0F, RT_CHANNEL_DOMAIN_TURKEY
+	{0x01,0x01},	//0x10, RT_CHANNEL_DOMAIN_JAPAN
+	{0x02,0x05},	//0x11, RT_CHANNEL_DOMAIN_FCC_NO_DFS
+	{0x01,0x12},	//0x12, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS
+	{0x00,0x04},	//0x13, RT_CHANNEL_DOMAIN_WORLD_WIDE_5G
+	{0x02,0x10},	//0x14, RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS
+	{0x00,0x12},	//0x15, RT_CHANNEL_DOMAIN_ETSI_NO_DFS
+	{0x00,0x13},	//0x16, RT_CHANNEL_DOMAIN_KOREA_NO_DFS
+	{0x03,0x12},	//0x17, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS
+	{0x05,0x08},	//0x18, RT_CHANNEL_DOMAIN_PAKISTAN_NO_DFS
+	{0x02,0x08},	//0x19, RT_CHANNEL_DOMAIN_TAIWAN2_NO_DFS
+	{0x00,0x00},	//0x1A,
+	{0x00,0x00},	//0x1B,
+	{0x00,0x00},	//0x1C,
+	{0x00,0x00},	//0x1D,
+	{0x00,0x00},	//0x1E,
+	{0x05,0x04},	//0x1F, RT_CHANNEL_DOMAIN_WORLD_WIDE_ONLY_5G
+	//===== 0x20 ~ 0x7F ,New Define =====
+	{0x00,0x00},	//0x20, RT_CHANNEL_DOMAIN_WORLD_NULL
+	{0x01,0x00},	//0x21, RT_CHANNEL_DOMAIN_ETSI1_NULL
+	{0x02,0x00},	//0x22, RT_CHANNEL_DOMAIN_FCC1_NULL
+	{0x03,0x00},	//0x23, RT_CHANNEL_DOMAIN_MKK1_NULL
+	{0x04,0x00},	//0x24, RT_CHANNEL_DOMAIN_ETSI2_NULL
+	{0x02,0x04},	//0x25, RT_CHANNEL_DOMAIN_FCC1_FCC1
+	{0x00,0x01},	//0x26, RT_CHANNEL_DOMAIN_WORLD_ETSI1
+	{0x03,0x0C},	//0x27, RT_CHANNEL_DOMAIN_MKK1_MKK1
+	{0x00,0x0B},	//0x28, RT_CHANNEL_DOMAIN_WORLD_KCC1
+	{0x00,0x05},	//0x29, RT_CHANNEL_DOMAIN_WORLD_FCC2
+	{0x00,0x00},	//0x2A,
+	{0x00,0x00},	//0x2B,
+	{0x00,0x00},	//0x2C,
+	{0x00,0x00},	//0x2D,
+	{0x00,0x00},	//0x2E,
+	{0x00,0x00},	//0x2F,
+	{0x00,0x06},	//0x30, RT_CHANNEL_DOMAIN_WORLD_FCC3
+	{0x00,0x07},	//0x31, RT_CHANNEL_DOMAIN_WORLD_FCC4
+	{0x00,0x08},	//0x32, RT_CHANNEL_DOMAIN_WORLD_FCC5
+	{0x00,0x09},	//0x33, RT_CHANNEL_DOMAIN_WORLD_FCC6
+	{0x02,0x0A},	//0x34, RT_CHANNEL_DOMAIN_FCC1_FCC7
+	{0x00,0x02},	//0x35, RT_CHANNEL_DOMAIN_WORLD_ETSI2
+	{0x00,0x03},	//0x36, RT_CHANNEL_DOMAIN_WORLD_ETSI3
+	{0x03,0x0D},	//0x37, RT_CHANNEL_DOMAIN_MKK1_MKK2
+	{0x03,0x0E},	//0x38, RT_CHANNEL_DOMAIN_MKK1_MKK3
+	{0x02,0x0F},	//0x39, RT_CHANNEL_DOMAIN_FCC1_NCC1
+	{0x00,0x00},	//0x3A,
+	{0x00,0x00},	//0x3B,
+	{0x00,0x00},	//0x3C,
+	{0x00,0x00},	//0x3D,
+	{0x00,0x00},	//0x3E,
+	{0x00,0x00},	//0x3F,
+	{0x02,0x10},	//0x40, RT_CHANNEL_DOMAIN_FCC1_NCC2
+};
+
+static RT_CHANNEL_PLAN_MAP	RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE = {0x03,0x02}; //use the conbination for max channel numbers
+
+/*
+ * Search the @param ch in given @param ch_set
+ * @ch_set: the given channel set
+ * @ch: the given channel number
+ *
+ * return the index of channel_num in channel_set, -1 if not found
+ */
+int rtw_ch_set_search_ch(RT_CHANNEL_INFO *ch_set, const u32 ch)
+{
+	int i;
+	for(i=0;ch_set[i].ChannelNum!=0;i++){
+		if(ch == ch_set[i].ChannelNum)
+			break;
+	}
+
+	if(i >= ch_set[i].ChannelNum)
+		return -1;
+	return i;
+}
+
+/*
+ * Check the @param ch is fit with setband setting of @param adapter
+ * @adapter: the given adapter
+ * @ch: the given channel number
+ *
+ * return _TRUE when check valid, _FALSE not valid
+ */
+bool rtw_mlme_band_check(_adapter *adapter, const u32 ch)
+{
+	if (adapter->setband == GHZ24_50 /* 2.4G and 5G */
+		|| (adapter->setband == GHZ_24 && ch < 35) /* 2.4G only */
+		|| (adapter->setband == GHZ_50 && ch > 35) /* 5G only */
+	) {
+		return _TRUE;
+	}
+	return _FALSE;
+}
+
+/****************************************************************************
+
+Following are the initialization functions for WiFi MLME
+
+*****************************************************************************/
+
+int init_hw_mlme_ext(_adapter *padapter)
+{
+	struct	mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+
+	//set_opmode_cmd(padapter, infra_client_with_mlme);//removed
+
+	set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+
+	return _SUCCESS;
+}
+
+static void init_mlme_ext_priv_value(_adapter* padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	//unsigned char default_channel_set[MAX_CHANNEL_NUM] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 0, 0};
+	unsigned char	mixed_datarate[NumRates] = {_1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_,_9M_RATE_, _12M_RATE_, _18M_RATE_, _24M_RATE_, _36M_RATE_, _48M_RATE_, _54M_RATE_, 0xff};
+	unsigned char	mixed_basicrate[NumRates] ={_1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_, _12M_RATE_, _24M_RATE_, 0xff,};
+
+	ATOMIC_SET(&pmlmeext->event_seq, 0);
+	pmlmeext->mgnt_seq = 0;//reset to zero when disconnect at client mode
+#ifdef CONFIG_IEEE80211W
+	pmlmeext->sa_query_seq = 0;
+	pmlmeext->mgnt_80211w_IPN=0;
+	pmlmeext->mgnt_80211w_IPN_rx=0;
+#endif //CONFIG_IEEE80211W
+	pmlmeext->cur_channel = padapter->registrypriv.channel;
+	pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
+	pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+	pmlmeext->retry = 0;
+
+	pmlmeext->cur_wireless_mode = padapter->registrypriv.wireless_mode;
+
+	//_rtw_memcpy(pmlmeext->channel_set, DefaultChannelPlan[padapter->mlmepriv.ChannelPlan].Channel, DefaultChannelPlan[padapter->mlmepriv.ChannelPlan].Len);
+	//_rtw_memcpy(pmlmeext->channel_set, default_channel_set, MAX_CHANNEL_NUM);
+	_rtw_memcpy(pmlmeext->datarate, mixed_datarate, NumRates);
+	_rtw_memcpy(pmlmeext->basicrate, mixed_basicrate, NumRates);
+
+	if(pmlmeext->cur_channel > 14)
+		pmlmeext->tx_rate = IEEE80211_OFDM_RATE_6MB;
+	else
+		pmlmeext->tx_rate = IEEE80211_CCK_RATE_1MB;
+
+	pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
+	pmlmeext->sitesurvey_res.channel_idx = 0;
+	pmlmeext->sitesurvey_res.bss_cnt = 0;
+	pmlmeext->scan_abort = _FALSE;
+
+	pmlmeinfo->state = WIFI_FW_NULL_STATE;
+	pmlmeinfo->reauth_count = 0;
+	pmlmeinfo->reassoc_count = 0;
+	pmlmeinfo->link_count = 0;
+	pmlmeinfo->auth_seq = 0;
+	pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
+	pmlmeinfo->key_index = 0;
+	pmlmeinfo->iv = 0;
+
+	pmlmeinfo->enc_algo = _NO_PRIVACY_;
+	pmlmeinfo->authModeToggle = 0;
+
+	_rtw_memset(pmlmeinfo->chg_txt, 0, 128);
+
+	pmlmeinfo->slotTime = SHORT_SLOT_TIME;
+	pmlmeinfo->preamble_mode = PREAMBLE_AUTO;
+
+	pmlmeinfo->dialogToken = 0;
+
+	pmlmeext->action_public_rxseq = 0xffff;
+	pmlmeext->action_public_dialog_token = 0xff;
+}
+
+static int has_channel(RT_CHANNEL_INFO *channel_set,
+					   u8 chanset_size,
+					   u8 chan) {
+	int i;
+
+	for (i = 0; i < chanset_size; i++) {
+		if (channel_set[i].ChannelNum == chan) {
+			return 1;
+		}
+	}
+
+	return 0;
+}
+
+static void init_channel_list(_adapter *padapter, RT_CHANNEL_INFO *channel_set,
+							  u8 chanset_size,
+							  struct p2p_channels *channel_list) {
+
+	struct p2p_oper_class_map op_class[] = {
+		{ IEEE80211G,  81,   1,  13,  1, BW20 },
+		{ IEEE80211G,  82,  14,  14,  1, BW20 },
+#if 0 /* Do not enable HT40 on 2 GHz */
+		{ IEEE80211G,  83,   1,   9,  1, BW40PLUS },
+		{ IEEE80211G,  84,   5,  13,  1, BW40MINUS },
+#endif
+		{ IEEE80211A, 115,  36,  48,  4, BW20 },
+		{ IEEE80211A, 116,  36,  44,  8, BW40PLUS },
+		{ IEEE80211A, 117,  40,  48,  8, BW40MINUS },
+		{ IEEE80211A, 124, 149, 161,  4, BW20 },
+		{ IEEE80211A, 125, 149, 169,  4, BW20 },
+		{ IEEE80211A, 126, 149, 157,  8, BW40PLUS },
+		{ IEEE80211A, 127, 153, 161,  8, BW40MINUS },
+		{ -1, 0, 0, 0, 0, BW20 }
+	};
+
+	int cla, op;
+
+	cla = 0;
+
+	for (op = 0; op_class[op].op_class; op++) {
+		u8 ch;
+		struct p2p_oper_class_map *o = &op_class[op];
+		struct p2p_reg_class *reg = NULL;
+
+		for (ch = o->min_chan; ch <= o->max_chan; ch += o->inc) {
+			if (!has_channel(channel_set, chanset_size, ch)) {
+				continue;
+			}
+
+			if ((0 == padapter->registrypriv.ht_enable) && (8 == o->inc))
+				continue;
+
+			if ((0 == (padapter->registrypriv.cbw40_enable & BIT(1))) &&
+				((BW40MINUS == o->bw) || (BW40PLUS == o->bw)))
+				continue;
+
+			if (reg == NULL) {
+				reg = &channel_list->reg_class[cla];
+				cla++;
+				reg->reg_class = o->op_class;
+				reg->channels = 0;
+			}
+			reg->channel[reg->channels] = ch;
+			reg->channels++;
+		}
+	}
+	channel_list->reg_classes = cla;
+
+}
+
+static u8 init_channel_set(_adapter* padapter, u8 ChannelPlan, RT_CHANNEL_INFO *channel_set)
+{
+	u8	index,chanset_size = 0;
+	u8	b5GBand = _FALSE, b2_4GBand = _FALSE;
+	u8	Index2G = 0, Index5G=0;
+
+	_rtw_memset(channel_set, 0, sizeof(RT_CHANNEL_INFO)*MAX_CHANNEL_NUM);
+
+	if(ChannelPlan >= RT_CHANNEL_DOMAIN_MAX && ChannelPlan != RT_CHANNEL_DOMAIN_REALTEK_DEFINE)
+	{
+		DBG_871X("ChannelPlan ID %x error !!!!!\n",ChannelPlan);
+		return chanset_size;
+	}
+
+	if(padapter->registrypriv.wireless_mode & WIRELESS_11G)
+	{
+		b2_4GBand = _TRUE;
+		if(RT_CHANNEL_DOMAIN_REALTEK_DEFINE == ChannelPlan)
+			Index2G = RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE.Index2G;
+		else
+			Index2G = RTW_ChannelPlanMap[ChannelPlan].Index2G;
+	}
+
+	if(padapter->registrypriv.wireless_mode & WIRELESS_11A)
+	{
+		b5GBand = _TRUE;
+		if(RT_CHANNEL_DOMAIN_REALTEK_DEFINE == ChannelPlan)
+			Index5G = RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE.Index5G;
+		else
+			Index5G = RTW_ChannelPlanMap[ChannelPlan].Index5G;
+	}
+
+	if(b2_4GBand)
+	{
+		for(index=0;index<RTW_ChannelPlan2G[Index2G].Len;index++)
+		{
+			channel_set[chanset_size].ChannelNum = RTW_ChannelPlan2G[Index2G].Channel[index];
+
+			if(RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN == ChannelPlan) //Channel 1~11 is active, and 12~14 is passive
+			{
+				if(channel_set[chanset_size].ChannelNum >= 1 && channel_set[chanset_size].ChannelNum <= 11)
+					channel_set[chanset_size].ScanType = SCAN_ACTIVE;
+				else if((channel_set[chanset_size].ChannelNum  >= 12 && channel_set[chanset_size].ChannelNum  <= 14))
+					channel_set[chanset_size].ScanType  = SCAN_PASSIVE;
+			}
+			else if(RT_CHANNEL_DOMAIN_WORLD_WIDE_13 == ChannelPlan ||
+				RT_CHANNEL_DOMAIN_WORLD_WIDE_5G == ChannelPlan ||
+				RT_CHANNEL_DOMAIN_2G_WORLD == Index2G)// channel 12~13, passive scan
+			{
+				if(channel_set[chanset_size].ChannelNum <= 11)
+					channel_set[chanset_size].ScanType = SCAN_ACTIVE;
+				else
+					channel_set[chanset_size].ScanType = SCAN_PASSIVE;
+			}
+			else
+			{
+				channel_set[chanset_size].ScanType = SCAN_ACTIVE;
+			}
+
+			chanset_size++;
+		}
+	}
+
+	if(b5GBand)
+	{
+		for(index=0;index<RTW_ChannelPlan5G[Index5G].Len;index++)
+		{
+#ifdef CONFIG_DFS
+			channel_set[chanset_size].ChannelNum = RTW_ChannelPlan5G[Index5G].Channel[index];
+			if ( channel_set[chanset_size].ChannelNum <= 48
+				|| channel_set[chanset_size].ChannelNum >= 149 )
+			{
+				if(RT_CHANNEL_DOMAIN_WORLD_WIDE_5G == ChannelPlan)//passive scan for all 5G channels
+					channel_set[chanset_size].ScanType = SCAN_PASSIVE;
+				else
+					channel_set[chanset_size].ScanType = SCAN_ACTIVE;
+			}
+			else
+			{
+				channel_set[chanset_size].ScanType = SCAN_PASSIVE;
+			}
+			chanset_size++;
+#else /* CONFIG_DFS */
+			if ( RTW_ChannelPlan5G[Index5G].Channel[index] <= 48
+				|| RTW_ChannelPlan5G[Index5G].Channel[index] >= 149 ) {
+				channel_set[chanset_size].ChannelNum = RTW_ChannelPlan5G[Index5G].Channel[index];
+				if(RT_CHANNEL_DOMAIN_WORLD_WIDE_5G == ChannelPlan)//passive scan for all 5G channels
+					channel_set[chanset_size].ScanType = SCAN_PASSIVE;
+				else
+					channel_set[chanset_size].ScanType = SCAN_ACTIVE;
+				DBG_871X("%s(): channel_set[%d].ChannelNum = %d\n", __FUNCTION__, chanset_size, channel_set[chanset_size].ChannelNum);
+				chanset_size++;
+			}
+#endif /* CONFIG_DFS */
+		}
+	}
+
+	return chanset_size;
+}
+
+int	init_mlme_ext_priv(_adapter* padapter)
+{
+	int	res = _SUCCESS;
+	struct registry_priv* pregistrypriv = &padapter->registrypriv;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	// We don't need to memset padapter->XXX to zero, because adapter is allocated by rtw_zvmalloc().
+	//_rtw_memset((u8 *)pmlmeext, 0, sizeof(struct mlme_ext_priv));
+
+	pmlmeext->padapter = padapter;
+
+	//fill_fwpriv(padapter, &(pmlmeext->fwpriv));
+
+	init_mlme_ext_priv_value(padapter);
+	pmlmeinfo->bAcceptAddbaReq = pregistrypriv->bAcceptAddbaReq;
+
+	init_mlme_ext_timer(padapter);
+
+#ifdef CONFIG_AP_MODE
+	init_mlme_ap_info(padapter);
+#endif
+
+	pmlmeext->max_chan_nums = init_channel_set(padapter, pmlmepriv->ChannelPlan,pmlmeext->channel_set);
+	init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
+
+	pmlmeext->chan_scan_time = SURVEY_TO;
+	pmlmeext->mlmeext_init = _TRUE;
+
+
+#ifdef CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+	pmlmeext->active_keep_alive_check = _TRUE;
+#endif
+
+	return res;
+
+}
+
+void free_mlme_ext_priv (struct mlme_ext_priv *pmlmeext)
+{
+	_adapter *padapter = pmlmeext->padapter;
+
+	if (!padapter)
+		return;
+
+	if (padapter->bDriverStopped == _TRUE)
+	{
+		_cancel_timer_ex(&pmlmeext->survey_timer);
+		_cancel_timer_ex(&pmlmeext->link_timer);
+		//_cancel_timer_ex(&pmlmeext->ADDBA_timer);
+	}
+}
+
+static u8 cmp_pkt_chnl_diff(_adapter *padapter,u8* pframe,uint packet_len)
+{	// if the channel is same, return 0. else return channel differential
+	uint len;
+	u8 channel;
+	u8 *p;
+	p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _BEACON_IE_OFFSET_, _DSSET_IE_, &len, packet_len - _BEACON_IE_OFFSET_);
+	if (p)
+	{
+		channel = *(p + 2);
+		if(padapter->mlmeextpriv.cur_channel >= channel)
+		{
+			return (padapter->mlmeextpriv.cur_channel - channel);
+		}
+		else
+		{
+			return (channel-padapter->mlmeextpriv.cur_channel);
+		}
+	}
+	else
+	{
+		return 0;
+	}
+}
+
+static void _mgt_dispatcher(_adapter *padapter, struct mlme_handler *ptable, union recv_frame *precv_frame)
+{
+	u8 bc_addr[ETH_ALEN] = {0xff,0xff,0xff,0xff,0xff,0xff};
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+
+	  if(ptable->func)
+        {
+	 //receive the frames that ra(a1) is my address or ra(a1) is bc address.
+		if (!_rtw_memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
+			!_rtw_memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
+		{
+			return;
+		}
+
+		ptable->func(padapter, precv_frame);
+        }
+
+}
+
+void mgt_dispatcher(_adapter *padapter, union recv_frame *precv_frame)
+{
+	int index;
+	struct mlme_handler *ptable;
+#ifdef CONFIG_AP_MODE
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+#endif //CONFIG_AP_MODE
+	u8 bc_addr[ETH_ALEN] = {0xff,0xff,0xff,0xff,0xff,0xff};
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, GetAddr2Ptr(pframe));
+
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_,
+		 ("+mgt_dispatcher: type(0x%x) subtype(0x%x)\n",
+		  GetFrameType(pframe), GetFrameSubType(pframe)));
+
+#if 0
+	{
+		u8 *pbuf;
+		pbuf = GetAddr1Ptr(pframe);
+		DBG_871X("A1-%x:%x:%x:%x:%x:%x\n", *pbuf, *(pbuf+1), *(pbuf+2), *(pbuf+3), *(pbuf+4), *(pbuf+5));
+		pbuf = GetAddr2Ptr(pframe);
+		DBG_871X("A2-%x:%x:%x:%x:%x:%x\n", *pbuf, *(pbuf+1), *(pbuf+2), *(pbuf+3), *(pbuf+4), *(pbuf+5));
+		pbuf = GetAddr3Ptr(pframe);
+		DBG_871X("A3-%x:%x:%x:%x:%x:%x\n", *pbuf, *(pbuf+1), *(pbuf+2), *(pbuf+3), *(pbuf+4), *(pbuf+5));
+	}
+#endif
+
+	if (GetFrameType(pframe) != WIFI_MGT_TYPE)
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("mgt_dispatcher: type(0x%x) error!\n", GetFrameType(pframe)));
+		return;
+	}
+
+	//receive the frames that ra(a1) is my address or ra(a1) is bc address.
+	if (!_rtw_memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
+		!_rtw_memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
+	{
+		return;
+	}
+
+	ptable = mlme_sta_tbl;
+
+	index = GetFrameSubType(pframe) >> 4;
+
+#ifdef CONFIG_TDLS
+	if((index << 4)==WIFI_ACTION){
+		//category==RTW_WLAN_CATEGORY_PUBLIC, action==TDLS_DISCOVERY_RESPONSE
+		if(*(pframe + IEEE80211_MGMT_HDR_LEN ) == RTW_WLAN_CATEGORY_PUBLIC
+			&& *(pframe + IEEE80211_MGMT_HDR_LEN + 1) == TDLS_DISCOVERY_RESPONSE )
+		{
+			DBG_871X("recv tdls discovery response frame\n");
+			On_TDLS_Dis_Rsp(padapter, precv_frame);
+		}
+	}
+#endif //CONFIG_TDLS
+
+	if (index > 13)
+	{
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("Currently we do not support reserved sub-fr-type=%d\n", index));
+		return;
+	}
+	ptable += index;
+
+#if 1
+	if (psta != NULL)
+	{
+		if (GetRetry(pframe))
+		{
+			if (precv_frame->u.hdr.attrib.seq_num == psta->RxMgmtFrameSeqNum)
+			{
+				/* drop the duplicate management frame */
+				DBG_871X("Drop duplicate management frame with seq_num = %d.\n", precv_frame->u.hdr.attrib.seq_num);
+				return;
+			}
+		}
+		psta->RxMgmtFrameSeqNum = precv_frame->u.hdr.attrib.seq_num;
+	}
+#else
+
+	if(GetRetry(pframe))
+	{
+		//RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("drop due to decache!\n"));
+		//return;
+	}
+#endif
+
+#ifdef CONFIG_AP_MODE
+	switch (GetFrameSubType(pframe))
+	{
+		case WIFI_AUTH:
+			if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+				ptable->func = &OnAuth;
+				/* falls through */
+			else
+				ptable->func = &OnAuthClient;
+				/* falls through */
+		case WIFI_ASSOCREQ:
+		case WIFI_REASSOCREQ:
+			_mgt_dispatcher(padapter, ptable, precv_frame);
+#ifdef CONFIG_HOSTAPD_MLME
+			if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+				rtw_hostapd_mlme_rx(padapter, precv_frame);
+#endif
+			break;
+		case WIFI_PROBEREQ:
+			if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+			{
+#ifdef CONFIG_HOSTAPD_MLME
+				rtw_hostapd_mlme_rx(padapter, precv_frame);
+#else
+				_mgt_dispatcher(padapter, ptable, precv_frame);
+#endif
+			}
+			else
+				_mgt_dispatcher(padapter, ptable, precv_frame);
+			break;
+		case WIFI_BEACON:
+			_mgt_dispatcher(padapter, ptable, precv_frame);
+			break;
+		case WIFI_ACTION:
+			//if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+			_mgt_dispatcher(padapter, ptable, precv_frame);
+			break;
+		default:
+			_mgt_dispatcher(padapter, ptable, precv_frame);
+			if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+				rtw_hostapd_mlme_rx(padapter, precv_frame);
+			break;
+	}
+#else
+
+	_mgt_dispatcher(padapter, ptable, precv_frame);
+
+#endif
+
+}
+
+#ifdef CONFIG_P2P
+u32 p2p_listen_state_process(_adapter *padapter, unsigned char *da)
+{
+	bool response = _TRUE;
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if( padapter->wdinfo.driver_interface == DRIVER_CFG80211 )
+	{
+		if (wdev_to_priv(padapter->rtw_wdev)->p2p_enabled == _FALSE
+			|| padapter->mlmepriv.wps_probe_resp_ie == NULL
+			|| padapter->mlmepriv.p2p_probe_resp_ie == NULL
+		)
+		{
+			DBG_871X("DON'T issue_probersp_p2p: p2p_enabled:%d, wps_probe_resp_ie:%p, p2p_probe_resp_ie:%p\n",
+				wdev_to_priv(padapter->rtw_wdev)->p2p_enabled,
+				padapter->mlmepriv.wps_probe_resp_ie,
+				padapter->mlmepriv.p2p_probe_resp_ie);
+			response = _FALSE;
+		}
+	}
+	else
+#endif //CONFIG_IOCTL_CFG80211
+	if( padapter->wdinfo.driver_interface == DRIVER_WEXT )
+	{
+		//	do nothing if the device name is empty
+		if ( !padapter->wdinfo.device_name_len )
+		{
+			response	= _FALSE;
+		}
+	}
+
+	if (response == _TRUE)
+		issue_probersp_p2p( padapter, da);
+
+	return _SUCCESS;
+}
+#endif //CONFIG_P2P
+
+
+/****************************************************************************
+
+Following are the callback functions for each subtype of the management frames
+
+*****************************************************************************/
+
+unsigned int OnProbeReq(_adapter *padapter, union recv_frame *precv_frame)
+{
+	unsigned int	ielen;
+	unsigned char	*p;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 	*cur = &(pmlmeinfo->network);
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint len = precv_frame->u.hdr.len;
+	u8 is_valid_p2p_probereq = _FALSE;
+
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+	struct rx_pkt_attrib	*pattrib = &precv_frame->u.hdr.attrib;
+	u8 wifi_test_chk_rate = 1;
+
+	if (	!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE) &&
+		!rtw_p2p_chk_state(pwdinfo, P2P_STATE_IDLE) &&
+		!rtw_p2p_chk_role(pwdinfo, P2P_ROLE_CLIENT) &&
+		!rtw_p2p_chk_state(pwdinfo, P2P_STATE_FIND_PHASE_SEARCH) &&
+		!rtw_p2p_chk_state(pwdinfo, P2P_STATE_SCAN)
+	   )
+	{
+		//	Commented by Albert 2011/03/17
+		//	mcs_rate = 0 -> CCK 1M rate
+		//	mcs_rate = 1 -> CCK 2M rate
+		//	mcs_rate = 2 -> CCK 5.5M rate
+		//	mcs_rate = 3 -> CCK 11M rate
+		//	In the P2P mode, the driver should not support the CCK rate
+
+		//	Commented by Kurt 2012/10/16
+		//	IOT issue: Google Nexus7 use 1M rate to send p2p_probe_req after GO nego completed and Nexus7 is client
+#ifdef CONFIG_WIFI_TEST
+		if ( pattrib->mcs_rate <= 3 )
+		{
+			wifi_test_chk_rate = 0;
+		}
+#endif //CONFIG_WIFI_TEST
+
+		if( wifi_test_chk_rate == 1 )
+		{
+			if((is_valid_p2p_probereq = process_probe_req_p2p_ie(pwdinfo, pframe, len)) == _TRUE)
+			{
+				if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_DEVICE))
+				{
+					p2p_listen_state_process( padapter,  get_sa(pframe));
+
+					return _SUCCESS;
+				}
+
+				if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+				{
+					goto _continue;
+				}
+			}
+		}
+	}
+
+_continue:
+#endif //CONFIG_P2P
+
+	if(check_fwstate(pmlmepriv, WIFI_STATION_STATE))
+	{
+		return _SUCCESS;
+	}
+
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _FALSE &&
+		check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE|WIFI_AP_STATE)==_FALSE)
+	{
+		return _SUCCESS;
+	}
+
+
+	//DBG_871X("+OnProbeReq\n");
+
+#ifdef CONFIG_AUTO_AP_MODE
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE &&
+			pmlmepriv->cur_network.join_res == _TRUE)
+	{
+		_irqL	irqL;
+		struct sta_info	*psta;
+		u8 *mac_addr, *peer_addr;
+		struct sta_priv *pstapriv = &padapter->stapriv;
+		u8 RC_OUI[4]={0x00,0xE0,0x4C,0x0A};
+		//EID[1] + EID_LEN[1] + RC_OUI[4] + MAC[6] + PairingID[2] + ChannelNum[2]
+
+		p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, _VENDOR_SPECIFIC_IE_, (int *)&ielen,
+			len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);
+
+		if(!p || ielen !=14)
+			goto _non_rc_device;
+
+		if(!_rtw_memcmp(p+2, RC_OUI, sizeof(RC_OUI)))
+			goto _non_rc_device;
+
+		if(!_rtw_memcmp(p+6, get_sa(pframe), ETH_ALEN))
+		{
+			DBG_871X("%s, do rc pairing ("MAC_FMT"), but mac addr mismatch!("MAC_FMT")\n", __FUNCTION__,
+				MAC_ARG(get_sa(pframe)), MAC_ARG(p+6));
+
+			goto _non_rc_device;
+		}
+
+		DBG_871X("%s, got the pairing device("MAC_FMT")\n", __FUNCTION__,  MAC_ARG(get_sa(pframe)));
+
+		//new a station
+		psta = rtw_get_stainfo(pstapriv, get_sa(pframe));
+		if (psta == NULL)
+		{
+			// allocate a new one
+			DBG_871X("going to alloc stainfo for rc="MAC_FMT"\n",  MAC_ARG(get_sa(pframe)));
+			psta = rtw_alloc_stainfo(pstapriv, get_sa(pframe));
+			if (psta == NULL)
+			{
+				//TODO:
+				DBG_871X(" Exceed the upper limit of supported clients...\n");
+				return _SUCCESS;
+			}
+
+			_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+			if (rtw_is_list_empty(&psta->asoc_list))
+			{
+				psta->expire_to = pstapriv->expire_to;
+				rtw_list_insert_tail(&psta->asoc_list, &pstapriv->asoc_list);
+				pstapriv->asoc_list_cnt++;
+			}
+			_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+			//generate pairing ID
+			mac_addr = myid(&(padapter->eeprompriv));
+			peer_addr = psta->hwaddr;
+			psta->pid = (u16)(((mac_addr[4]<<8) + mac_addr[5]) + ((peer_addr[4]<<8) + peer_addr[5]));
+
+			//update peer stainfo
+			psta->isrc = _TRUE;
+			//psta->aid = 0;
+			//psta->mac_id = 2;
+
+			/* get a unique AID */
+			if (psta->aid > 0) {
+				DBG_871X("old AID %d\n", psta->aid);
+			} else {
+				for (psta->aid = 1; psta->aid <= NUM_STA; psta->aid++)
+					if (pstapriv->sta_aid[psta->aid - 1] == NULL)
+						break;
+
+				if (psta->aid > pstapriv->max_num_sta) {
+					psta->aid = 0;
+					DBG_871X("no room for more AIDs\n");
+					return _SUCCESS;
+				} else {
+					pstapriv->sta_aid[psta->aid - 1] = psta;
+					DBG_871X("allocate new AID = (%d)\n", psta->aid);
+				}
+			}
+
+			psta->qos_option = 1;
+			psta->htpriv.ht_option = _TRUE;
+			psta->ieee8021x_blocked = _FALSE;
+			psta->htpriv.ampdu_enable = _FALSE;
+			psta->htpriv.sgi = _FALSE;
+			psta->htpriv.bwmode = HT_CHANNEL_WIDTH_20;
+			psta->htpriv.ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+			//rtw_hal_set_odm_var(padapter, HAL_ODM_STA_INFO, psta, _TRUE);
+
+			psta->htpriv.agg_enable_bitmap = 0x0;//reset
+			psta->htpriv.candidate_tid_bitmap = 0x0;//reset
+
+			_rtw_memset((void*)&psta->sta_stats, 0, sizeof(struct stainfo_stats));
+
+			_enter_critical_bh(&psta->lock, &irqL);
+			psta->state |= _FW_LINKED;
+			_exit_critical_bh(&psta->lock, &irqL);
+
+			report_add_sta_event(padapter, psta->hwaddr, psta->aid);
+
+		}
+
+		issue_probersp(padapter, get_sa(pframe), _FALSE);
+
+		return _SUCCESS;
+
+	}
+
+_non_rc_device:
+
+	return _SUCCESS;
+#endif //CONFIG_AUTO_AP_MODE
+
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) &&
+		check_buddy_fwstate(padapter, _FW_UNDER_LINKING|_FW_UNDER_SURVEY))
+	{
+		//don't process probe req
+		return _SUCCESS;
+	}
+#endif
+
+	p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, _SSID_IE_, (int *)&ielen,
+			len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);
+
+
+	//check (wildcard) SSID
+	if (p != NULL)
+	{
+		if(is_valid_p2p_probereq == _TRUE)
+		{
+			goto _issue_probersp;
+		}
+
+		if ( (ielen != 0 && _FALSE ==_rtw_memcmp((void *)(p+2), (void *)cur->Ssid.Ssid, cur->Ssid.SsidLength))
+			|| (ielen == 0 && pmlmeinfo->hidden_ssid_mode)
+		)
+		{
+			return _SUCCESS;
+		}
+
+_issue_probersp:
+
+		if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE &&
+			pmlmepriv->cur_network.join_res == _TRUE)
+		{
+			//DBG_871X("+issue_probersp during ap mode\n");
+			issue_probersp(padapter, get_sa(pframe), is_valid_p2p_probereq);
+		}
+
+	}
+
+	return _SUCCESS;
+
+}
+
+unsigned int OnProbeRsp(_adapter *padapter, union recv_frame *precv_frame)
+{
+	struct sta_info		*psta;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct sta_priv		*pstapriv = &padapter->stapriv;
+	u8	*pframe = precv_frame->u.hdr.rx_data;
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &padapter->wdinfo;
+#endif
+
+
+#ifdef CONFIG_P2P
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_TX_PROVISION_DIS_REQ))
+	{
+		if ( _TRUE == pwdinfo->tx_prov_disc_info.benable )
+		{
+			if( _rtw_memcmp( pwdinfo->tx_prov_disc_info.peerIFAddr, GetAddr2Ptr(pframe), ETH_ALEN ) )
+			{
+				if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_CLIENT))
+				{
+					pwdinfo->tx_prov_disc_info.benable = _FALSE;
+					issue_p2p_provision_request( padapter,
+												pwdinfo->tx_prov_disc_info.ssid.Ssid,
+												pwdinfo->tx_prov_disc_info.ssid.SsidLength,
+												pwdinfo->tx_prov_disc_info.peerDevAddr );
+				}
+				else if ( rtw_p2p_chk_role(pwdinfo, P2P_ROLE_DEVICE) || rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO) )
+				{
+					pwdinfo->tx_prov_disc_info.benable = _FALSE;
+					issue_p2p_provision_request( padapter,
+												NULL,
+												0,
+												pwdinfo->tx_prov_disc_info.peerDevAddr );
+				}
+			}
+		}
+		return _SUCCESS;
+	}
+	else if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_ING))
+	{
+		if ( _TRUE == pwdinfo->nego_req_info.benable )
+		{
+			DBG_871X( "[%s] P2P State is GONEGO ING!\n", __FUNCTION__ );
+			if( _rtw_memcmp( pwdinfo->nego_req_info.peerDevAddr, GetAddr2Ptr(pframe), ETH_ALEN ) )
+			{
+				pwdinfo->nego_req_info.benable = _FALSE;
+				issue_p2p_GO_request( padapter, pwdinfo->nego_req_info.peerDevAddr);
+			}
+		}
+	}
+	else if( rtw_p2p_chk_state(pwdinfo, P2P_STATE_TX_INVITE_REQ ) )
+	{
+		if ( _TRUE == pwdinfo->invitereq_info.benable )
+		{
+			DBG_871X( "[%s] P2P_STATE_TX_INVITE_REQ!\n", __FUNCTION__ );
+			if( _rtw_memcmp( pwdinfo->invitereq_info.peer_macaddr, GetAddr2Ptr(pframe), ETH_ALEN ) )
+			{
+				pwdinfo->invitereq_info.benable = _FALSE;
+				issue_p2p_invitation_request( padapter, pwdinfo->invitereq_info.peer_macaddr );
+			}
+		}
+	}
+#endif
+
+
+	if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS)
+	{
+		report_survey_event(padapter, precv_frame);
+#ifdef CONFIG_CONCURRENT_MODE
+		report_survey_event(padapter->pbuddy_adapter, precv_frame);
+#endif
+#ifdef CONFIG_DUALMAC_CONCURRENT
+		dc_report_survey_event(padapter, precv_frame);
+#endif
+		return _SUCCESS;
+	}
+
+	#if 0 //move to validate_recv_mgnt_frame
+	if (_rtw_memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN))
+	{
+		if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)
+		{
+			if ((psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe))) != NULL)
+			{
+				psta->sta_stats.rx_mgnt_pkts++;
+			}
+		}
+	}
+	#endif
+
+	return _SUCCESS;
+
+}
+
+unsigned int OnBeacon(_adapter *padapter, union recv_frame *precv_frame)
+{
+	int cam_idx;
+	struct sta_info	*psta;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct sta_priv	*pstapriv = &padapter->stapriv;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint len = precv_frame->u.hdr.len;
+	u8 *p = NULL;
+	u32 ielen = 0;
+
+#ifdef CONFIG_ATTEMPT_TO_FIX_AP_BEACON_ERROR
+	p = rtw_get_ie(pframe + sizeof(struct rtw_ieee80211_hdr_3addr) + _BEACON_IE_OFFSET_, _EXT_SUPPORTEDRATES_IE_, &ielen, precv_frame->u.hdr.len -sizeof(struct rtw_ieee80211_hdr_3addr) - _BEACON_IE_OFFSET_);
+	if ((p != NULL) && (ielen > 0))
+	{
+		if ((*(p + 1 + ielen) == 0x2D) && (*(p + 2 + ielen) != 0x2D))
+		{
+			/* Invalid value 0x2D is detected in Extended Supported Rates (ESR) IE. Try to fix the IE length to avoid failed Beacon parsing. */
+			DBG_871X("[WIFIDBG] Error in ESR IE is detected in Beacon of BSSID:"MAC_FMT". Fix the length of ESR IE to avoid failed Beacon parsing.\n", MAC_ARG(GetAddr3Ptr(pframe)));
+			*(p + 1) = ielen - 1;
+		}
+	}
+#endif
+
+	if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS)
+	{
+		report_survey_event(padapter, precv_frame);
+#ifdef CONFIG_CONCURRENT_MODE
+		report_survey_event(padapter->pbuddy_adapter, precv_frame);
+#endif
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+		dc_report_survey_event(padapter, precv_frame);
+#endif
+
+		return _SUCCESS;
+	}
+
+	if (_rtw_memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN))
+	{
+		if (pmlmeinfo->state & WIFI_FW_AUTH_NULL)
+		{
+			//check the vendor of the assoc AP
+			pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pframe+sizeof(struct rtw_ieee80211_hdr_3addr), len-sizeof(struct rtw_ieee80211_hdr_3addr));
+#ifdef CONFIG_P2P_PS
+			// do P2P PS Before link ? , ToDo
+			//process_p2p_ps_ie(padapter, (pframe + WLAN_HDR_A3_LEN), (len - WLAN_HDR_A3_LEN));
+#endif // CONFIG_P2P_PS
+
+			//update TSF Value
+			update_TSF(pmlmeext, pframe, len);
+
+			//start auth
+			start_clnt_auth(padapter);
+
+			return _SUCCESS;
+		}
+
+		if(((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) && (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
+		{
+			if ((psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe))) != NULL)
+			{
+				#ifdef CONFIG_PATCH_JOIN_WRONG_CHANNEL
+				//Merge from 8712 FW code
+				if (cmp_pkt_chnl_diff(padapter,pframe,len) != 0)
+				{            // join wrong channel, deauth and reconnect
+					issue_deauth(padapter, (&(pmlmeinfo->network))->MacAddress, WLAN_REASON_DEAUTH_LEAVING);
+
+					report_del_sta_event(padapter,(&(pmlmeinfo->network))->MacAddress, WLAN_REASON_JOIN_WRONG_CHANNEL);
+					pmlmeinfo->state &= (~WIFI_FW_ASSOC_SUCCESS);
+					return _SUCCESS;
+				}
+				#endif //CONFIG_PATCH_JOIN_WRONG_CHANNEL
+
+				//update WMM, ERP in the beacon
+				//todo: the timer is used instead of the number of the beacon received
+				if ((sta_rx_pkts(psta) & 0xf) == 0)
+				{
+					//DBG_871X("update_bcn_info\n");
+					update_beacon_info(padapter, pframe, len, psta);
+				}
+
+#ifdef CONFIG_DFS
+				process_csa_ie(padapter, pframe, len);	//channel switch announcement
+#endif //CONFIG_DFS
+
+#ifdef CONFIG_P2P_PS
+				//if(psta->ieee8021x_blocked == _FALSE) // do not allow P2P PS during EAPOL handshake ?
+				process_p2p_ps_ie(padapter, (pframe + WLAN_HDR_A3_LEN), (len - WLAN_HDR_A3_LEN));
+#endif //CONFIG_P2P_PS
+
+				#if 0 //move to validate_recv_mgnt_frame
+				psta->sta_stats.rx_mgnt_pkts++;
+				#endif
+			}
+		}
+		else if((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE)
+		{
+			if ((psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe))) != NULL)
+			{
+				//update WMM, ERP in the beacon
+				//todo: the timer is used instead of the number of the beacon received
+				if ((sta_rx_pkts(psta) & 0xf) == 0)
+				{
+					//DBG_871X("update_bcn_info\n");
+					update_beacon_info(padapter, pframe, len, psta);
+				}
+
+				#if 0 //move to validate_recv_mgnt_frame
+				psta->sta_stats.rx_mgnt_pkts++;
+				#endif
+			}
+			else
+			{
+				//allocate a new CAM entry for IBSS station
+				if ((cam_idx = allocate_fw_sta_entry(padapter)) == NUM_STA)
+				{
+					goto _END_ONBEACON_;
+				}
+
+				//get supported rate
+				if (update_sta_support_rate(padapter, (pframe + WLAN_HDR_A3_LEN + _BEACON_IE_OFFSET_), (len - WLAN_HDR_A3_LEN - _BEACON_IE_OFFSET_), cam_idx) == _FAIL)
+				{
+					pmlmeinfo->FW_sta_info[cam_idx].status = 0;
+					goto _END_ONBEACON_;
+				}
+
+				//update TSF Value
+				update_TSF(pmlmeext, pframe, len);
+
+				//report sta add event
+				report_add_sta_event(padapter, GetAddr2Ptr(pframe), cam_idx);
+			}
+		}
+	}
+
+_END_ONBEACON_:
+
+	return _SUCCESS;
+
+}
+
+unsigned int OnAuth(_adapter *padapter, union recv_frame *precv_frame)
+{
+#ifdef CONFIG_AP_MODE
+	_irqL irqL;
+	unsigned int	auth_mode, seq, ie_len;
+	unsigned char	*sa, *p;
+	u16	algorithm;
+	int	status;
+	static struct sta_info stat;
+	struct	sta_info	*pstat=NULL;
+	struct	sta_priv *pstapriv = &padapter->stapriv;
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint len = precv_frame->u.hdr.len;
+
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) &&
+		check_buddy_fwstate(padapter, _FW_UNDER_LINKING|_FW_UNDER_SURVEY))
+	{
+		//don't process auth request;
+		return _SUCCESS;
+	}
+#endif //CONFIG_CONCURRENT_MODE
+
+	if((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
+		return _FAIL;
+
+	DBG_871X("+OnAuth\n");
+
+	sa = GetAddr2Ptr(pframe);
+
+	auth_mode = psecuritypriv->dot11AuthAlgrthm;
+	seq = cpu_to_le16(*(u16*)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + 2));
+	algorithm = cpu_to_le16(*(u16*)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN));
+
+	if (GetPrivacy(pframe))
+	{
+#if 0 //TODO: SW rtw_wep_decrypt
+		if (SWCRYPTO)
+		{
+			status = rtw_wep_decrypt(priv, pframe, pfrinfo->pktlen,
+				priv->pmib->dot1180211AuthEntry.dot11PrivacyAlgrthm);
+			if (status == FALSE)
+			{
+				SAVE_INT_AND_CLI(flags);
+				RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,"wep-decrypt a Auth frame error!\n");
+				status = _STATS_CHALLENGE_FAIL_;
+				goto auth_fail;
+			}
+		}
+
+		seq = cpu_to_le16(*(unsigned short *)((unsigned int)pframe + WLAN_HDR_A3_LEN + 4 + 2));
+		algorithm = cpu_to_le16(*(unsigned short *)((unsigned int)pframe + WLAN_HDR_A3_LEN + 4));
+#endif
+	}
+
+
+	DBG_871X("auth alg=%x, seq=%X\n", algorithm, seq);
+
+	if (auth_mode == 2 &&
+			psecuritypriv->dot11PrivacyAlgrthm != _WEP40_ &&
+			psecuritypriv->dot11PrivacyAlgrthm != _WEP104_)
+		auth_mode = 0;
+
+	if ((algorithm > 0 && auth_mode == 0) ||	// rx a shared-key auth but shared not enabled
+		(algorithm == 0 && auth_mode == 1) )	// rx a open-system auth but shared-key is enabled
+	{
+		DBG_871X("auth rejected due to bad alg [alg=%d, auth_mib=%d] %02X%02X%02X%02X%02X%02X\n",
+			algorithm, auth_mode, sa[0], sa[1], sa[2], sa[3], sa[4], sa[5]);
+
+		status = _STATS_NO_SUPP_ALG_;
+
+		goto auth_fail;
+	}
+
+#if 0 //ACL control
+	phead = &priv->wlan_acl_list;
+	plist = phead->next;
+	//check sa
+	if (acl_mode == 1)		// 1: positive check, only those on acl_list can be connected.
+		res = FAIL;
+	else
+		res = SUCCESS;
+
+	while(plist != phead)
+	{
+		paclnode = list_entry(plist, struct rtw_wlan_acl_node, list);
+		plist = plist->next;
+		if (!memcmp((void *)sa, paclnode->addr, 6)) {
+			if (paclnode->mode & 2) { // deny
+				res = FAIL;
+				break;
+			}
+			else {
+				res = SUCCESS;
+				break;
+			}
+		}
+	}
+
+	if (res != SUCCESS) {
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,"auth abort because ACL!\n");
+		return FAIL;
+	}
+#else
+	if(rtw_access_ctrl(padapter, sa) == _FALSE)
+	{
+		status = _STATS_UNABLE_HANDLE_STA_;
+		goto auth_fail;
+	}
+#endif
+
+	pstat = rtw_get_stainfo(pstapriv, sa);
+	if (pstat == NULL)
+	{
+		// allocate a new one
+		DBG_871X("going to alloc stainfo for sa="MAC_FMT"\n",  MAC_ARG(sa));
+		pstat = rtw_alloc_stainfo(pstapriv, sa);
+		if (pstat == NULL)
+		{
+			DBG_871X(" Exceed the upper limit of supported clients...\n");
+			status = _STATS_UNABLE_HANDLE_STA_;
+			goto auth_fail;
+		}
+
+		pstat->state = WIFI_FW_AUTH_NULL;
+		pstat->auth_seq = 0;
+
+		//pstat->flags = 0;
+		//pstat->capability = 0;
+	}
+	else
+	{
+		_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+		if(rtw_is_list_empty(&pstat->asoc_list)==_FALSE)
+		{
+			rtw_list_delete(&pstat->asoc_list);
+			pstapriv->asoc_list_cnt--;
+			if (pstat->expire_to > 0)
+			{
+				//TODO: STA re_auth within expire_to
+			}
+		}
+		_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+		if (seq==1) {
+			//TODO: STA re_auth and auth timeout
+		}
+	}
+
+	_enter_critical_bh(&pstapriv->auth_list_lock, &irqL);
+	if (rtw_is_list_empty(&pstat->auth_list))
+	{
+		rtw_list_insert_tail(&pstat->auth_list, &pstapriv->auth_list);
+		pstapriv->auth_list_cnt++;
+	}
+	_exit_critical_bh(&pstapriv->auth_list_lock, &irqL);
+
+	if (pstat->auth_seq == 0)
+		pstat->expire_to = pstapriv->auth_to;
+
+	if ((pstat->auth_seq + 1) != seq)
+	{
+		DBG_871X("(1)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
+			seq, pstat->auth_seq+1);
+		status = _STATS_OUT_OF_AUTH_SEQ_;
+		goto auth_fail;
+	}
+
+	if (algorithm==0 && (auth_mode == 0 || auth_mode == 2))
+	{
+		if (seq == 1)
+		{
+			pstat->state &= ~WIFI_FW_AUTH_NULL;
+			pstat->state |= WIFI_FW_AUTH_SUCCESS;
+			pstat->expire_to = pstapriv->assoc_to;
+			pstat->authalg = algorithm;
+		}
+		else
+		{
+			DBG_871X("(2)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
+				seq, pstat->auth_seq+1);
+			status = _STATS_OUT_OF_AUTH_SEQ_;
+			goto auth_fail;
+		}
+	}
+	else // shared system or auto authentication
+	{
+		if (seq == 1)
+		{
+			//prepare for the challenging txt...
+
+			//get_random_bytes((void *)pstat->chg_txt, 128);//TODO:
+
+			pstat->state &= ~WIFI_FW_AUTH_NULL;
+			pstat->state |= WIFI_FW_AUTH_STATE;
+			pstat->authalg = algorithm;
+			pstat->auth_seq = 2;
+		}
+		else if (seq == 3)
+		{
+			//checking for challenging txt...
+			DBG_871X("checking for challenging txt...\n");
+
+			p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + 4 + _AUTH_IE_OFFSET_ , _CHLGETXT_IE_, (int *)&ie_len,
+					len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ - 4);
+
+			if((p==NULL) || (ie_len<=0))
+			{
+				DBG_871X("auth rejected because challenge failure!(1)\n");
+				status = _STATS_CHALLENGE_FAIL_;
+				goto auth_fail;
+			}
+
+			if (_rtw_memcmp((void *)(p + 2), pstat->chg_txt, 128))
+			{
+				pstat->state &= (~WIFI_FW_AUTH_STATE);
+				pstat->state |= WIFI_FW_AUTH_SUCCESS;
+				// challenging txt is correct...
+				pstat->expire_to =  pstapriv->assoc_to;
+			}
+			else
+			{
+				DBG_871X("auth rejected because challenge failure!\n");
+				status = _STATS_CHALLENGE_FAIL_;
+				goto auth_fail;
+			}
+		}
+		else
+		{
+			DBG_871X("(3)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
+				seq, pstat->auth_seq+1);
+			status = _STATS_OUT_OF_AUTH_SEQ_;
+			goto auth_fail;
+		}
+	}
+
+
+	// Now, we are going to issue_auth...
+	pstat->auth_seq = seq + 1;
+
+#ifdef CONFIG_NATIVEAP_MLME
+	issue_auth(padapter, pstat, (unsigned short)(_STATS_SUCCESSFUL_));
+#endif
+
+	if (pstat->state & WIFI_FW_AUTH_SUCCESS)
+		pstat->auth_seq = 0;
+
+
+	return _SUCCESS;
+
+auth_fail:
+
+	if(pstat)
+		rtw_free_stainfo(padapter , pstat);
+
+	pstat = &stat;
+	_rtw_memset((char *)pstat, '\0', sizeof(stat));
+	pstat->auth_seq = 2;
+	_rtw_memcpy(pstat->hwaddr, sa, 6);
+
+#ifdef CONFIG_NATIVEAP_MLME
+	issue_auth(padapter, pstat, (unsigned short)status);
+#endif
+
+#endif
+	return _FAIL;
+
+}
+
+unsigned int OnAuthClient(_adapter *padapter, union recv_frame *precv_frame)
+{
+	unsigned int	seq, len, status, algthm, offset;
+	unsigned char	*p;
+	unsigned int	go2asoc = 0;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint pkt_len = precv_frame->u.hdr.len;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	//check A1 matches or not
+	if (!_rtw_memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
+		return _SUCCESS;
+
+	if (!(pmlmeinfo->state & WIFI_FW_AUTH_STATE))
+		return _SUCCESS;
+
+	offset = (GetPrivacy(pframe))? 4: 0;
+
+	algthm 	= le16_to_cpu(*(unsigned short *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset));
+	seq 	= le16_to_cpu(*(unsigned short *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset + 2));
+	status 	= le16_to_cpu(*(unsigned short *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset + 4));
+
+	if (status != 0)
+	{
+		DBG_871X("clnt auth fail, status: %d\n", status);
+		if(status == 13)//&& pmlmeinfo->auth_algo == dot11AuthAlgrthm_Auto)
+		{
+			if(pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
+				pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
+			else
+				pmlmeinfo->auth_algo = dot11AuthAlgrthm_Shared;
+			//pmlmeinfo->reauth_count = 0;
+		}
+
+		set_link_timer(pmlmeext, 1);
+		goto authclnt_fail;
+	}
+
+	if (seq == 2)
+	{
+		if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
+		{
+			 // legendary shared system
+			p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _AUTH_IE_OFFSET_, _CHLGETXT_IE_, (int *)&len,
+				pkt_len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_);
+
+			if (p == NULL)
+			{
+				//DBG_871X("marc: no challenge text?\n");
+				goto authclnt_fail;
+			}
+
+			_rtw_memcpy((void *)(pmlmeinfo->chg_txt), (void *)(p + 2), len);
+			pmlmeinfo->auth_seq = 3;
+			issue_auth(padapter, NULL, 0);
+			set_link_timer(pmlmeext, REAUTH_TO);
+
+			return _SUCCESS;
+		}
+		else
+		{
+			// open system
+			go2asoc = 1;
+		}
+	}
+	else if (seq == 4)
+	{
+		if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
+		{
+			go2asoc = 1;
+		}
+		else
+		{
+			goto authclnt_fail;
+		}
+	}
+	else
+	{
+		// this is also illegal
+		//DBG_871X("marc: clnt auth failed due to illegal seq=%x\n", seq);
+		goto authclnt_fail;
+	}
+
+	if (go2asoc)
+	{
+		start_clnt_assoc(padapter);
+		return _SUCCESS;
+	}
+
+authclnt_fail:
+
+	//pmlmeinfo->state &= ~(WIFI_FW_AUTH_STATE);
+
+	return _FAIL;
+
+}
+
+unsigned int OnAssocReq(_adapter *padapter, union recv_frame *precv_frame)
+{
+#ifdef CONFIG_AP_MODE
+	_irqL irqL;
+	u16 capab_info, listen_interval;
+	struct rtw_ieee802_11_elems elems;
+	struct sta_info	*pstat;
+	unsigned char		reassoc, *p, *pos, *wpa_ie;
+	unsigned char WMM_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
+	int		i, ie_len, wpa_ie_len, left;
+	unsigned char		supportRate[16];
+	int					supportRateNum;
+	unsigned short		status = _STATS_SUCCESSFUL_;
+	unsigned short		frame_type, ie_offset=0;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 	*cur = &(pmlmeinfo->network);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint pkt_len = precv_frame->u.hdr.len;
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+	u8 p2p_status_code = P2P_STATUS_SUCCESS;
+	u8 *p2pie;
+	u32 p2pielen = 0;
+#ifdef CONFIG_WFD
+	u8	wfd_ie[ 128 ] = { 0x00 };
+	u32	wfd_ielen = 0;
+#endif // CONFIG_WFD
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) &&
+		check_buddy_fwstate(padapter, _FW_UNDER_LINKING|_FW_UNDER_SURVEY))
+	{
+		//don't process assoc request;
+		return _SUCCESS;
+	}
+#endif //CONFIG_CONCURRENT_MODE
+
+	if((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
+		return _FAIL;
+
+	frame_type = GetFrameSubType(pframe);
+	if (frame_type == WIFI_ASSOCREQ)
+	{
+		reassoc = 0;
+		ie_offset = _ASOCREQ_IE_OFFSET_;
+	}
+	else // WIFI_REASSOCREQ
+	{
+		reassoc = 1;
+		ie_offset = _REASOCREQ_IE_OFFSET_;
+	}
+
+
+	if (pkt_len < IEEE80211_3ADDR_LEN + ie_offset) {
+		DBG_871X("handle_assoc(reassoc=%d) - too short payload (len=%lu)"
+		       "\n", reassoc, (unsigned long)pkt_len);
+		return _FAIL;
+	}
+
+	pstat = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
+	if (pstat == (struct sta_info *)NULL)
+	{
+		status = _RSON_CLS2_;
+		goto asoc_class2_error;
+	}
+
+	capab_info = RTW_GET_LE16(pframe + WLAN_HDR_A3_LEN);
+	//capab_info = le16_to_cpu(*(unsigned short *)(pframe + WLAN_HDR_A3_LEN));
+	//listen_interval = le16_to_cpu(*(unsigned short *)(pframe + WLAN_HDR_A3_LEN+2));
+	listen_interval = RTW_GET_LE16(pframe + WLAN_HDR_A3_LEN+2);
+
+	left = pkt_len - (IEEE80211_3ADDR_LEN + ie_offset);
+	pos = pframe + (IEEE80211_3ADDR_LEN + ie_offset);
+
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	// check if this stat has been successfully authenticated/assocated
+	if (!((pstat->state) & WIFI_FW_AUTH_SUCCESS))
+	{
+		if (!((pstat->state) & WIFI_FW_ASSOC_SUCCESS))
+		{
+			status = _RSON_CLS2_;
+			goto asoc_class2_error;
+		}
+		else
+		{
+			pstat->state &= (~WIFI_FW_ASSOC_SUCCESS);
+			pstat->state |= WIFI_FW_ASSOC_STATE;
+		}
+	}
+	else
+	{
+		pstat->state &= (~WIFI_FW_AUTH_SUCCESS);
+		pstat->state |= WIFI_FW_ASSOC_STATE;
+	}
+
+
+#if 0// todo:tkip_countermeasures
+	if (hapd->tkip_countermeasures) {
+		resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
+		goto fail;
+	}
+#endif
+
+	pstat->capability = capab_info;
+
+#if 0//todo:
+	//check listen_interval
+	if (listen_interval > hapd->conf->max_listen_interval) {
+		hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
+			       HOSTAPD_LEVEL_DEBUG,
+			       "Too large Listen Interval (%d)",
+			       listen_interval);
+		resp = WLAN_STATUS_ASSOC_DENIED_LISTEN_INT_TOO_LARGE;
+		goto fail;
+	}
+
+	pstat->listen_interval = listen_interval;
+#endif
+
+	//now parse all ieee802_11 ie to point to elems
+	if (rtw_ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed ||
+	    !elems.ssid) {
+		DBG_871X("STA " MAC_FMT " sent invalid association request\n",
+		       MAC_ARG(pstat->hwaddr));
+		status = _STATS_FAILURE_;
+		goto OnAssocReqFail;
+	}
+
+
+	// now we should check all the fields...
+	// checking SSID
+	p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SSID_IE_, &ie_len,
+		pkt_len - WLAN_HDR_A3_LEN - ie_offset);
+	if (p == NULL)
+	{
+		status = _STATS_FAILURE_;
+	}
+
+	if (ie_len == 0) // broadcast ssid, however it is not allowed in assocreq
+		status = _STATS_FAILURE_;
+	else
+	{
+		// check if ssid match
+		if (!_rtw_memcmp((void *)(p+2), cur->Ssid.Ssid, cur->Ssid.SsidLength))
+			status = _STATS_FAILURE_;
+
+		if (ie_len != cur->Ssid.SsidLength)
+			status = _STATS_FAILURE_;
+	}
+
+	if(_STATS_SUCCESSFUL_ != status)
+		goto OnAssocReqFail;
+
+	// check if the supported rate is ok
+	p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SUPPORTEDRATES_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
+	if (p == NULL) {
+		DBG_871X("Rx a sta assoc-req which supported rate is empty!\n");
+		// use our own rate set as statoin used
+		//_rtw_memcpy(supportRate, AP_BSSRATE, AP_BSSRATE_LEN);
+		//supportRateNum = AP_BSSRATE_LEN;
+
+		status = _STATS_FAILURE_;
+		goto OnAssocReqFail;
+	}
+	else {
+		_rtw_memcpy(supportRate, p+2, ie_len);
+		supportRateNum = ie_len;
+
+		p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _EXT_SUPPORTEDRATES_IE_ , &ie_len,
+				pkt_len - WLAN_HDR_A3_LEN - ie_offset);
+		if (p !=  NULL) {
+
+			if(supportRateNum<=sizeof(supportRate))
+			{
+				_rtw_memcpy(supportRate+supportRateNum, p+2, ie_len);
+				supportRateNum += ie_len;
+			}
+		}
+	}
+
+	//todo: mask supportRate between AP & STA -> move to update raid
+	//get_matched_rate(pmlmeext, supportRate, &supportRateNum, 0);
+
+	//update station supportRate
+	pstat->bssratelen = supportRateNum;
+	_rtw_memcpy(pstat->bssrateset, supportRate, supportRateNum);
+
+
+	//check RSN/WPA/WPS
+	pstat->dot8021xalg = 0;
+	pstat->wpa_psk = 0;
+	pstat->wpa_group_cipher = 0;
+	pstat->wpa2_group_cipher = 0;
+	pstat->wpa_pairwise_cipher = 0;
+	pstat->wpa2_pairwise_cipher = 0;
+	_rtw_memset(pstat->wpa_ie, 0, sizeof(pstat->wpa_ie));
+	if((psecuritypriv->wpa_psk & BIT(1)) && elems.rsn_ie) {
+
+		int group_cipher=0, pairwise_cipher=0;
+
+		wpa_ie = elems.rsn_ie;
+		wpa_ie_len = elems.rsn_ie_len;
+
+		if(rtw_parse_wpa2_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher) == _SUCCESS)
+		{
+			pstat->dot8021xalg = 1;//psk,  todo:802.1x
+			pstat->wpa_psk |= BIT(1);
+
+			pstat->wpa2_group_cipher = group_cipher&psecuritypriv->wpa2_group_cipher;
+			pstat->wpa2_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa2_pairwise_cipher;
+
+			if(!pstat->wpa2_group_cipher)
+				status = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
+
+			if(!pstat->wpa2_pairwise_cipher)
+				status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
+		}
+		else
+		{
+			status = WLAN_STATUS_INVALID_IE;
+		}
+
+	} else if ((psecuritypriv->wpa_psk & BIT(0)) && elems.wpa_ie) {
+
+		int group_cipher=0, pairwise_cipher=0;
+
+		wpa_ie = elems.wpa_ie;
+		wpa_ie_len = elems.wpa_ie_len;
+
+		if(rtw_parse_wpa_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher) == _SUCCESS)
+		{
+			pstat->dot8021xalg = 1;//psk,  todo:802.1x
+			pstat->wpa_psk |= BIT(0);
+
+			pstat->wpa_group_cipher = group_cipher&psecuritypriv->wpa_group_cipher;
+			pstat->wpa_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa_pairwise_cipher;
+
+			if(!pstat->wpa_group_cipher)
+				status = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
+
+			if(!pstat->wpa_pairwise_cipher)
+				status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
+
+		}
+		else
+		{
+			status = WLAN_STATUS_INVALID_IE;
+		}
+
+	} else {
+		wpa_ie = NULL;
+		wpa_ie_len = 0;
+	}
+
+	if(_STATS_SUCCESSFUL_ != status)
+		goto OnAssocReqFail;
+
+	pstat->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS);
+	//if (hapd->conf->wps_state && wpa_ie == NULL) { //todo: to check ap if supporting WPS
+	if(wpa_ie == NULL) {
+		if (elems.wps_ie) {
+			DBG_871X("STA included WPS IE in "
+				   "(Re)Association Request - assume WPS is "
+				   "used\n");
+			pstat->flags |= WLAN_STA_WPS;
+			//wpabuf_free(sta->wps_ie);
+			//sta->wps_ie = wpabuf_alloc_copy(elems.wps_ie + 4,
+			//				elems.wps_ie_len - 4);
+		} else {
+			DBG_871X("STA did not include WPA/RSN IE "
+				   "in (Re)Association Request - possible WPS "
+				   "use\n");
+			pstat->flags |= WLAN_STA_MAYBE_WPS;
+		}
+
+
+		// AP support WPA/RSN, and sta is going to do WPS, but AP is not ready
+		// that the selected registrar of AP is _FLASE
+		if((psecuritypriv->wpa_psk >0)
+			&& (pstat->flags & (WLAN_STA_WPS|WLAN_STA_MAYBE_WPS)))
+		{
+			if(pmlmepriv->wps_beacon_ie)
+			{
+				u8 selected_registrar = 0;
+
+				rtw_get_wps_attr_content(pmlmepriv->wps_beacon_ie, pmlmepriv->wps_beacon_ie_len, WPS_ATTR_SELECTED_REGISTRAR , &selected_registrar, NULL);
+
+				if(!selected_registrar)
+				{
+					DBG_871X("selected_registrar is _FALSE , or AP is not ready to do WPS\n");
+
+					status = _STATS_UNABLE_HANDLE_STA_;
+
+					goto OnAssocReqFail;
+				}
+			}
+		}
+
+	}
+	else
+	{
+		int copy_len;
+
+		if(psecuritypriv->wpa_psk == 0)
+		{
+			DBG_871X("STA " MAC_FMT ": WPA/RSN IE in association "
+			"request, but AP don't support WPA/RSN\n", MAC_ARG(pstat->hwaddr));
+
+			status = WLAN_STATUS_INVALID_IE;
+
+			goto OnAssocReqFail;
+
+		}
+
+		if (elems.wps_ie) {
+			DBG_871X("STA included WPS IE in "
+				   "(Re)Association Request - WPS is "
+				   "used\n");
+			pstat->flags |= WLAN_STA_WPS;
+			copy_len=0;
+		}
+		else
+		{
+			copy_len = ((wpa_ie_len+2) > sizeof(pstat->wpa_ie)) ? (sizeof(pstat->wpa_ie)):(wpa_ie_len+2);
+		}
+
+
+		if(copy_len>0)
+			_rtw_memcpy(pstat->wpa_ie, wpa_ie-2, copy_len);
+
+	}
+
+
+	// check if there is WMM IE & support WWM-PS
+	pstat->flags &= ~WLAN_STA_WME;
+	pstat->qos_option = 0;
+	pstat->qos_info = 0;
+	pstat->has_legacy_ac = _TRUE;
+	pstat->uapsd_vo = 0;
+	pstat->uapsd_vi = 0;
+	pstat->uapsd_be = 0;
+	pstat->uapsd_bk = 0;
+	if (pmlmepriv->qospriv.qos_option)
+	{
+		p = pframe + WLAN_HDR_A3_LEN + ie_offset; ie_len = 0;
+		for (;;)
+		{
+			p = rtw_get_ie(p, _VENDOR_SPECIFIC_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
+			if (p != NULL) {
+				if (_rtw_memcmp(p+2, WMM_IE, 6)) {
+
+					pstat->flags |= WLAN_STA_WME;
+
+					pstat->qos_option = 1;
+					pstat->qos_info = *(p+8);
+
+					pstat->max_sp_len = (pstat->qos_info>>5)&0x3;
+
+					if((pstat->qos_info&0xf) !=0xf)
+						pstat->has_legacy_ac = _TRUE;
+					else
+						pstat->has_legacy_ac = _FALSE;
+
+					if(pstat->qos_info&0xf)
+					{
+						if(pstat->qos_info&BIT(0))
+							pstat->uapsd_vo = BIT(0)|BIT(1);
+						else
+							pstat->uapsd_vo = 0;
+
+						if(pstat->qos_info&BIT(1))
+							pstat->uapsd_vi = BIT(0)|BIT(1);
+						else
+							pstat->uapsd_vi = 0;
+
+						if(pstat->qos_info&BIT(2))
+							pstat->uapsd_bk = BIT(0)|BIT(1);
+						else
+							pstat->uapsd_bk = 0;
+
+						if(pstat->qos_info&BIT(3))
+							pstat->uapsd_be = BIT(0)|BIT(1);
+						else
+							pstat->uapsd_be = 0;
+
+					}
+
+					break;
+				}
+			}
+			else {
+				break;
+			}
+			p = p + ie_len + 2;
+		}
+	}
+
+
+#ifdef CONFIG_80211N_HT
+	/* save HT capabilities in the sta object */
+	_rtw_memset(&pstat->htpriv.ht_cap, 0, sizeof(struct rtw_ieee80211_ht_cap));
+	if (elems.ht_capabilities && elems.ht_capabilities_len >= sizeof(struct rtw_ieee80211_ht_cap))
+	{
+		pstat->flags |= WLAN_STA_HT;
+
+		pstat->flags |= WLAN_STA_WME;
+
+		_rtw_memcpy(&pstat->htpriv.ht_cap, elems.ht_capabilities, sizeof(struct rtw_ieee80211_ht_cap));
+
+	} else
+		pstat->flags &= ~WLAN_STA_HT;
+
+
+	if((pmlmepriv->htpriv.ht_option == _FALSE) && (pstat->flags&WLAN_STA_HT))
+	{
+		status = _STATS_FAILURE_;
+		goto OnAssocReqFail;
+	}
+
+
+	if ((pstat->flags & WLAN_STA_HT) &&
+		    ((pstat->wpa2_pairwise_cipher&WPA_CIPHER_TKIP) ||
+		      (pstat->wpa_pairwise_cipher&WPA_CIPHER_TKIP)))
+	{
+		DBG_871X("HT: " MAC_FMT " tried to "
+				   "use TKIP with HT association\n", MAC_ARG(pstat->hwaddr));
+
+		//status = WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
+		//goto OnAssocReqFail;
+	}
+#endif /* CONFIG_80211N_HT */
+
+       //
+       //if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G)//?
+	pstat->flags |= WLAN_STA_NONERP;
+	for (i = 0; i < pstat->bssratelen; i++) {
+		if ((pstat->bssrateset[i] & 0x7f) > 22) {
+			pstat->flags &= ~WLAN_STA_NONERP;
+			break;
+		}
+	}
+
+	if (pstat->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
+		pstat->flags |= WLAN_STA_SHORT_PREAMBLE;
+	else
+		pstat->flags &= ~WLAN_STA_SHORT_PREAMBLE;
+
+
+
+	if (status != _STATS_SUCCESSFUL_)
+		goto OnAssocReqFail;
+
+#ifdef CONFIG_P2P
+	pstat->is_p2p_device = _FALSE;
+	if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+	{
+		if( (p2pie=rtw_get_p2p_ie(pframe + WLAN_HDR_A3_LEN + ie_offset , pkt_len - WLAN_HDR_A3_LEN - ie_offset , NULL, &p2pielen)))
+		{
+			pstat->is_p2p_device = _TRUE;
+			if((p2p_status_code=(u8)process_assoc_req_p2p_ie(pwdinfo, pframe, pkt_len, pstat))>0)
+			{
+				pstat->p2p_status_code = p2p_status_code;
+				status = _STATS_CAP_FAIL_;
+				goto OnAssocReqFail;
+			}
+		}
+#ifdef CONFIG_WFD
+		if(rtw_get_wfd_ie(pframe + WLAN_HDR_A3_LEN + ie_offset , pkt_len - WLAN_HDR_A3_LEN - ie_offset , wfd_ie, &wfd_ielen ))
+		{
+			u8	attr_content[ 10 ] = { 0x00 };
+			u32	attr_contentlen = 0;
+
+			DBG_8192C( "[%s] WFD IE Found!!\n", __FUNCTION__ );
+			rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_DEVICE_INFO, attr_content, &attr_contentlen);
+			if ( attr_contentlen )
+			{
+				pwdinfo->wfd_info->peer_rtsp_ctrlport = RTW_GET_BE16( attr_content + 2 );
+				DBG_8192C( "[%s] Peer PORT NUM = %d\n", __FUNCTION__, pwdinfo->wfd_info->peer_rtsp_ctrlport );
+			}
+		}
+#endif
+	}
+	pstat->p2p_status_code = p2p_status_code;
+#endif //CONFIG_P2P
+
+	//TODO: identify_proprietary_vendor_ie();
+	// Realtek proprietary IE
+	// identify if this is Broadcom sta
+	// identify if this is ralink sta
+	// Customer proprietary IE
+
+
+
+	/* get a unique AID */
+	if (pstat->aid > 0) {
+		DBG_871X("  old AID %d\n", pstat->aid);
+	} else {
+		for (pstat->aid = 1; pstat->aid <= NUM_STA; pstat->aid++)
+			if (pstapriv->sta_aid[pstat->aid - 1] == NULL)
+				break;
+
+		//if (pstat->aid > NUM_STA) {
+		if (pstat->aid > pstapriv->max_num_sta) {
+
+			pstat->aid = 0;
+
+			DBG_871X("  no room for more AIDs\n");
+
+			status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
+
+			goto OnAssocReqFail;
+
+
+		} else {
+			pstapriv->sta_aid[pstat->aid - 1] = pstat;
+			DBG_871X("allocate new AID = (%d)\n", pstat->aid);
+		}
+	}
+
+
+	pstat->state &= (~WIFI_FW_ASSOC_STATE);
+	pstat->state |= WIFI_FW_ASSOC_SUCCESS;
+
+	_enter_critical_bh(&pstapriv->auth_list_lock, &irqL);
+	if (!rtw_is_list_empty(&pstat->auth_list))
+	{
+		rtw_list_delete(&pstat->auth_list);
+		pstapriv->auth_list_cnt--;
+	}
+	_exit_critical_bh(&pstapriv->auth_list_lock, &irqL);
+
+	_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+	if (rtw_is_list_empty(&pstat->asoc_list))
+	{
+		pstat->expire_to = pstapriv->expire_to;
+		rtw_list_insert_tail(&pstat->asoc_list, &pstapriv->asoc_list);
+		pstapriv->asoc_list_cnt++;
+	}
+	_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	// now the station is qualified to join our BSS...
+	if(pstat && (pstat->state & WIFI_FW_ASSOC_SUCCESS) && (_STATS_SUCCESSFUL_==status))
+	{
+#ifdef CONFIG_NATIVEAP_MLME
+		//.1 bss_cap_update & sta_info_update
+		bss_cap_update_on_sta_join(padapter, pstat);
+		sta_info_update(padapter, pstat);
+
+		//issue assoc rsp before notify station join event.
+		if (frame_type == WIFI_ASSOCREQ)
+			issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
+		else
+			issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
+
+		//.2 - report to upper layer
+		DBG_871X("indicate_sta_join_event to upper layer - hostapd\n");
+
+#ifdef CONFIG_IOCTL_CFG80211
+		#ifdef COMPAT_KERNEL_RELEASE
+		rtw_cfg80211_indicate_sta_assoc(padapter, pframe, pkt_len);
+		#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) && !defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+		rtw_cfg80211_indicate_sta_assoc(padapter, pframe, pkt_len);
+		#else //(LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) && !defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+		_enter_critical_bh(&pstat->lock, &irqL);
+		if(pstat->passoc_req)
+		{
+			rtw_mfree(pstat->passoc_req, pstat->assoc_req_len);
+			pstat->passoc_req = NULL;
+			pstat->assoc_req_len = 0;
+		}
+
+		pstat->passoc_req =  rtw_zmalloc(pkt_len);
+		if(pstat->passoc_req)
+		{
+			_rtw_memcpy(pstat->passoc_req, pframe, pkt_len);
+			pstat->assoc_req_len = pkt_len;
+		}
+		_exit_critical_bh(&pstat->lock, &irqL);
+		#endif //(LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) && !defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+#else
+		rtw_indicate_sta_assoc_event(padapter, pstat);
+#endif //CONFIG_IOCTL_CFG80211
+
+		//.3-(1) report sta add event
+		report_add_sta_event(padapter, pstat->hwaddr, pstat->aid);
+
+/*
+		//issue assoc rsp before notify station join event.
+		if (frame_type == WIFI_ASSOCREQ)
+			issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
+		else
+			issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
+*/
+
+#endif
+	}
+
+	return _SUCCESS;
+
+asoc_class2_error:
+
+#ifdef CONFIG_NATIVEAP_MLME
+	issue_deauth(padapter, (void *)GetAddr2Ptr(pframe), status);
+#endif
+
+	return _FAIL;
+
+OnAssocReqFail:
+
+
+#ifdef CONFIG_NATIVEAP_MLME
+	pstat->aid = 0;
+	if (frame_type == WIFI_ASSOCREQ)
+		issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
+	else
+		issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
+#endif
+
+
+#endif /* CONFIG_AP_MODE */
+
+	return _FAIL;
+
+}
+
+unsigned int OnAssocRsp(_adapter *padapter, union recv_frame *precv_frame)
+{
+	uint i;
+	int res;
+	unsigned short	status;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	//WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint pkt_len = precv_frame->u.hdr.len;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	//check A1 matches or not
+	if (!_rtw_memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
+		return _SUCCESS;
+
+	if (!(pmlmeinfo->state & (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE)))
+		return _SUCCESS;
+
+	if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)
+		return _SUCCESS;
+
+	_cancel_timer_ex(&pmlmeext->link_timer);
+
+	//status
+	if ((status = le16_to_cpu(*(unsigned short *)(pframe + WLAN_HDR_A3_LEN + 2))) > 0)
+	{
+		DBG_871X("assoc reject, status code: %d\n", status);
+		pmlmeinfo->state = WIFI_FW_NULL_STATE;
+		res = -4;
+		goto report_assoc_result;
+	}
+
+	//get capabilities
+	pmlmeinfo->capability = le16_to_cpu(*(unsigned short *)(pframe + WLAN_HDR_A3_LEN));
+
+	//set slot time
+	pmlmeinfo->slotTime = (pmlmeinfo->capability & BIT(10))? 9: 20;
+
+	//AID
+	res = pmlmeinfo->aid = (int)(le16_to_cpu(*(unsigned short *)(pframe + WLAN_HDR_A3_LEN + 4))&0x3fff);
+
+	//following are moved to join event callback function
+	//to handle HT, WMM, rate adaptive, update MAC reg
+	//for not to handle the synchronous IO in the tasklet
+	for (i = (6 + WLAN_HDR_A3_LEN); i < pkt_len;)
+	{
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(pframe + i);
+
+		switch (pIE->ElementID)
+		{
+			case _VENDOR_SPECIFIC_IE_:
+				if (_rtw_memcmp(pIE->data, WMM_PARA_OUI, 6))	//WMM
+				{
+					WMM_param_handler(padapter, pIE);
+				}
+#if defined(CONFIG_P2P) && defined(CONFIG_WFD)
+				else if ( _rtw_memcmp(pIE->data, WFD_OUI, 4))		//WFD
+				{
+					DBG_871X( "[%s] Found WFD IE\n", __FUNCTION__ );
+					WFD_info_handler( padapter, pIE );
+				}
+#endif
+				break;
+
+			case _HT_CAPABILITY_IE_:	//HT caps
+				HT_caps_handler(padapter, pIE);
+				break;
+
+			case _HT_EXTRA_INFO_IE_:	//HT info
+				HT_info_handler(padapter, pIE);
+				break;
+
+			case _ERPINFO_IE_:
+				ERP_IE_handler(padapter, pIE);
+
+			default:
+				break;
+		}
+
+		i += (pIE->Length + 2);
+	}
+
+	pmlmeinfo->state &= (~WIFI_FW_ASSOC_STATE);
+	pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
+
+	//Update Basic Rate Table for spec, 2010-12-28 , by thomas
+	UpdateBrateTbl(padapter, pmlmeinfo->network.SupportedRates);
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if (!rtw_cfg80211_check_bss(padapter)) {
+		DBG_871X("rtw_cfg80211_check_bss() : BSS not found !!\n");
+		res = -2;
+		goto report_assoc_result;
+	}
+#endif
+
+report_assoc_result:
+	if (res > 0) {
+		rtw_buf_update(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len, pframe, pkt_len);
+	} else {
+		rtw_buf_free(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len);
+	}
+
+	report_join_res(padapter, res);
+	return _SUCCESS;
+}
+
+unsigned int OnDeAuth(_adapter *padapter, union recv_frame *precv_frame)
+{
+	unsigned short	reason;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+#endif //CONFIG_P2P
+
+	//check A3
+	if (!(_rtw_memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN)))
+		return _SUCCESS;
+
+#ifdef CONFIG_P2P
+	if ( pwdinfo->rx_invitereq_info.scan_op_ch_only )
+	{
+		_cancel_timer_ex( &pwdinfo->reset_ch_sitesurvey );
+		_set_timer( &pwdinfo->reset_ch_sitesurvey, 10 );
+	}
+#endif //CONFIG_P2P
+
+	reason = le16_to_cpu(*(unsigned short *)(pframe + WLAN_HDR_A3_LEN));
+
+	DBG_871X("%s Reason code(%d)\n", __FUNCTION__,reason);
+
+#ifdef CONFIG_AP_MODE
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+		_irqL irqL;
+		struct sta_info *psta;
+		struct sta_priv *pstapriv = &padapter->stapriv;
+
+		//_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+		//rtw_free_stainfo(padapter, psta);
+		//_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+
+		DBG_871X("%s, STA:" MAC_FMT "\n", __FUNCTION__, MAC_ARG(GetAddr2Ptr(pframe)));
+
+		psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
+		if(psta)
+		{
+			u8 updated = _FALSE;
+
+			_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+			if(rtw_is_list_empty(&psta->asoc_list)==_FALSE)
+			{
+				rtw_list_delete(&psta->asoc_list);
+				pstapriv->asoc_list_cnt--;
+				updated = ap_free_sta(padapter, psta, _FALSE, reason);
+
+			}
+			_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+			associated_clients_update(padapter, updated);
+		}
+
+
+		return _SUCCESS;
+	}
+	else
+#endif
+	{
+		int	ignore_received_deauth = 0;
+
+		//	Commented by Albert 20130604
+		//	Before sending the auth frame to start the STA/GC mode connection with AP/GO,
+		//	we will send the deauth first.
+		//	However, the Win8.1 with BRCM Wi-Fi will send the deauth with reason code 6 to us after receieving our deauth.
+		//	Added the following code to avoid this case.
+		if ( ( pmlmeinfo->state & WIFI_FW_AUTH_STATE ) ||
+			( pmlmeinfo->state & WIFI_FW_ASSOC_STATE ) )
+		{
+			if ( reason == WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA )
+			{
+				ignore_received_deauth = 1;
+			} else if (WLAN_REASON_PREV_AUTH_NOT_VALID == reason) {
+				// TODO: 802.11r
+				ignore_received_deauth = 1;
+			}
+		}
+
+		DBG_871X("%s, STA:" MAC_FMT ", ignore = %d\n", __FUNCTION__, MAC_ARG(GetAddr3Ptr(pframe)), ignore_received_deauth);
+		if ( 0 == ignore_received_deauth )
+		{
+			receive_disconnect(padapter, GetAddr3Ptr(pframe) ,reason);
+		}
+	}
+	pmlmepriv->LinkDetectInfo.bBusyTraffic = _FALSE;
+	return _SUCCESS;
+
+}
+
+unsigned int OnDisassoc(_adapter *padapter, union recv_frame *precv_frame)
+{
+	unsigned short	reason;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+#endif //CONFIG_P2P
+
+	//check A3
+	if (!(_rtw_memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN)))
+		return _SUCCESS;
+
+#ifdef CONFIG_P2P
+	if ( pwdinfo->rx_invitereq_info.scan_op_ch_only )
+	{
+		_cancel_timer_ex( &pwdinfo->reset_ch_sitesurvey );
+		_set_timer( &pwdinfo->reset_ch_sitesurvey, 10 );
+	}
+#endif //CONFIG_P2P
+
+	reason = le16_to_cpu(*(unsigned short *)(pframe + WLAN_HDR_A3_LEN));
+
+        DBG_871X("%s Reason code(%d)\n", __FUNCTION__,reason);
+
+#ifdef CONFIG_AP_MODE
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+		_irqL irqL;
+		struct sta_info *psta;
+		struct sta_priv *pstapriv = &padapter->stapriv;
+
+		//_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+		//rtw_free_stainfo(padapter, psta);
+		//_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+
+		DBG_871X("%s, STA:" MAC_FMT "\n", __FUNCTION__, MAC_ARG(GetAddr2Ptr(pframe)));
+
+		psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
+		if(psta)
+		{
+			u8 updated = _FALSE;
+
+			_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+			if(rtw_is_list_empty(&psta->asoc_list)==_FALSE)
+			{
+				rtw_list_delete(&psta->asoc_list);
+				pstapriv->asoc_list_cnt--;
+				updated = ap_free_sta(padapter, psta, _FALSE, reason);
+
+			}
+			_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+			associated_clients_update(padapter, updated);
+		}
+
+		return _SUCCESS;
+	}
+	else
+#endif
+	{
+		DBG_871X("%s, STA:" MAC_FMT "\n", __FUNCTION__, MAC_ARG(GetAddr3Ptr(pframe)));
+
+		receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);
+	}
+	pmlmepriv->LinkDetectInfo.bBusyTraffic = _FALSE;
+	return _SUCCESS;
+
+}
+
+unsigned int OnAtim(_adapter *padapter, union recv_frame *precv_frame)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+	return _SUCCESS;
+}
+
+unsigned int on_action_spct_ch_switch(_adapter *padapter, struct sta_info *psta, u8 *ies, uint ies_len)
+{
+	unsigned int ret = _FAIL;
+	struct mlme_ext_priv *mlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(mlmeext->mlmext_info);
+
+	if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)) {
+		ret = _SUCCESS;
+		goto exit;
+	}
+
+	if ((pmlmeinfo->state & 0x03) == WIFI_FW_STATION_STATE) {
+
+		int ch_switch_mode = -1, ch = -1, ch_switch_cnt = -1;
+		int ch_offset = -1;
+		u8 bwmode;
+		struct ieee80211_info_element *ie;
+
+		DBG_871X(FUNC_NDEV_FMT" from "MAC_FMT"\n",
+			FUNC_NDEV_ARG(padapter->pnetdev), MAC_ARG(psta->hwaddr));
+
+		for_each_ie(ie, ies, ies_len) {
+			if (ie->id == WLAN_EID_CHANNEL_SWITCH) {
+				ch_switch_mode = ie->data[0];
+				ch = ie->data[1];
+				ch_switch_cnt = ie->data[2];
+				DBG_871X("ch_switch_mode:%d, ch:%d, ch_switch_cnt:%d\n",
+					ch_switch_mode, ch, ch_switch_cnt);
+			}
+			else if (ie->id == WLAN_EID_SECONDARY_CHANNEL_OFFSET) {
+				ch_offset = secondary_ch_offset_to_hal_ch_offset(ie->data[0]);
+				DBG_871X("ch_offset:%d\n", ch_offset);
+			}
+		}
+
+		if (ch == -1)
+			return _SUCCESS;
+
+		if (ch_offset == -1)
+			bwmode = mlmeext->cur_bwmode;
+		else
+			bwmode = (ch_offset == HAL_PRIME_CHNL_OFFSET_DONT_CARE) ?
+				HT_CHANNEL_WIDTH_20 : HT_CHANNEL_WIDTH_40;
+
+		ch_offset = (ch_offset == -1) ? mlmeext->cur_ch_offset : ch_offset;
+
+		/* todo:
+		 * 1. the decision of channel switching
+		 * 2. things after channel switching
+		 */
+
+		ret = rtw_set_ch_cmd(padapter, ch, bwmode, ch_offset, _TRUE);
+	}
+
+exit:
+	return ret;
+}
+
+unsigned int on_action_spct(_adapter *padapter, union recv_frame *precv_frame)
+{
+	unsigned int ret = _FAIL;
+	struct sta_info *psta = NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint frame_len = precv_frame->u.hdr.len;
+	u8 *frame_body = (u8 *)(pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
+	u8 category;
+	u8 action;
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(padapter->pnetdev));
+
+	psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
+
+	if (!psta)
+		goto exit;
+
+	category = frame_body[0];
+	if(category != RTW_WLAN_CATEGORY_SPECTRUM_MGMT)
+		goto exit;
+
+	action = frame_body[1];
+	switch (action) {
+	case RTW_WLAN_ACTION_SPCT_MSR_REQ:
+	case RTW_WLAN_ACTION_SPCT_MSR_RPRT:
+	case RTW_WLAN_ACTION_SPCT_TPC_REQ:
+	case RTW_WLAN_ACTION_SPCT_TPC_RPRT:
+		break;
+	case RTW_WLAN_ACTION_SPCT_CHL_SWITCH:
+		#ifdef CONFIG_SPCT_CH_SWITCH
+		ret = on_action_spct_ch_switch(padapter, psta, &frame_body[2],
+			frame_len-(frame_body-pframe)-2);
+		#endif
+		break;
+	default:
+		break;
+	}
+
+exit:
+	return ret;
+}
+
+unsigned int OnAction_qos(_adapter *padapter, union recv_frame *precv_frame)
+{
+	return _SUCCESS;
+}
+
+unsigned int OnAction_dls(_adapter *padapter, union recv_frame *precv_frame)
+{
+	return _SUCCESS;
+}
+
+unsigned int OnAction_back(_adapter *padapter, union recv_frame *precv_frame)
+{
+	u8 *addr;
+	struct sta_info *psta=NULL;
+	struct recv_reorder_ctrl *preorder_ctrl;
+	unsigned char		*frame_body;
+	unsigned char		category, action;
+	unsigned short	tid, status, reason_code = 0;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	//check RA matches or not
+	if (!_rtw_memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))//for if1, sta/ap mode
+		return _SUCCESS;
+
+/*
+	//check A1 matches or not
+	if (!_rtw_memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
+		return _SUCCESS;
+*/
+	DBG_871X("%s\n", __FUNCTION__);
+
+	if((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
+		if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
+			return _SUCCESS;
+
+	addr = GetAddr2Ptr(pframe);
+	psta = rtw_get_stainfo(pstapriv, addr);
+
+	if(psta==NULL)
+		return _SUCCESS;
+
+	frame_body = (unsigned char *)(pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
+
+	category = frame_body[0];
+	if (category == RTW_WLAN_CATEGORY_BACK)// representing Block Ack
+	{
+#ifdef CONFIG_TDLS
+		if((psta->tdls_sta_state & TDLS_LINKED_STATE) &&
+			(psta->htpriv.ht_option==_TRUE) &&
+			(psta->htpriv.ampdu_enable==_TRUE) )
+		{
+			//do nothing; just don't want to return _SUCCESS;
+		}
+		else
+#endif //CONFIG_TDLS
+		if (!pmlmeinfo->HT_enable)
+		{
+			return _SUCCESS;
+		}
+
+		action = frame_body[1];
+		DBG_871X("%s, action=%d\n", __FUNCTION__, action);
+		switch (action)
+		{
+			case RTW_WLAN_ACTION_ADDBA_REQ: //ADDBA request
+
+				_rtw_memcpy(&(pmlmeinfo->ADDBA_req), &(frame_body[2]), sizeof(struct ADDBA_request));
+				//process_addba_req(padapter, (u8*)&(pmlmeinfo->ADDBA_req), GetAddr3Ptr(pframe));
+				process_addba_req(padapter, (u8*)&(pmlmeinfo->ADDBA_req), addr);
+
+				if(pmlmeinfo->bAcceptAddbaReq == _TRUE)
+				{
+					issue_action_BA(padapter, addr, RTW_WLAN_ACTION_ADDBA_RESP, 0);
+				}
+				else
+				{
+					issue_action_BA(padapter, addr, RTW_WLAN_ACTION_ADDBA_RESP, 37);//reject ADDBA Req
+				}
+
+				break;
+
+			case RTW_WLAN_ACTION_ADDBA_RESP: //ADDBA response
+
+				//status = frame_body[3] | (frame_body[4] << 8); //endian issue
+				status = RTW_GET_LE16(&frame_body[3]);
+				tid = ((frame_body[5] >> 2) & 0x7);
+
+				if (status == 0)
+				{	//successful
+					DBG_871X("agg_enable for TID=%d\n", tid);
+					psta->htpriv.agg_enable_bitmap |= 1 << tid;
+					psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
+				}
+				else
+				{
+					psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
+				}
+
+				//DBG_871X("marc: ADDBA RSP: %x\n", pmlmeinfo->agg_enable_bitmap);
+				break;
+
+			case RTW_WLAN_ACTION_DELBA: //DELBA
+				if ((frame_body[3] & BIT(3)) == 0)
+				{
+					psta->htpriv.agg_enable_bitmap &= ~(1 << ((frame_body[3] >> 4) & 0xf));
+					psta->htpriv.candidate_tid_bitmap &= ~(1 << ((frame_body[3] >> 4) & 0xf));
+
+					//reason_code = frame_body[4] | (frame_body[5] << 8);
+					reason_code = RTW_GET_LE16(&frame_body[4]);
+				}
+				else if((frame_body[3] & BIT(3)) == BIT(3))
+				{
+					tid = (frame_body[3] >> 4) & 0x0F;
+
+					preorder_ctrl =  &psta->recvreorder_ctrl[tid];
+					preorder_ctrl->enable = _FALSE;
+					preorder_ctrl->indicate_seq = 0xffff;
+					#ifdef DBG_RX_SEQ
+					DBG_871X("DBG_RX_SEQ %s:%d indicate_seq:%u \n", __FUNCTION__, __LINE__,
+						preorder_ctrl->indicate_seq);
+					#endif
+				}
+
+				DBG_871X("%s(): DELBA: %x(%x)\n", __FUNCTION__,pmlmeinfo->agg_enable_bitmap, reason_code);
+				//todo: how to notify the host while receiving DELETE BA
+				break;
+
+			default:
+				break;
+		}
+	}
+
+	return _SUCCESS;
+}
+
+#ifdef CONFIG_P2P
+
+static int get_reg_classes_full_count(struct p2p_channels channel_list) {
+	int cnt = 0;
+	int i;
+
+	for (i = 0; i < channel_list.reg_classes; i++) {
+		cnt += channel_list.reg_class[i].channels;
+	}
+
+	return cnt;
+}
+
+static void get_channel_cnt_24g_5gl_5gh(  struct mlme_ext_priv *pmlmeext, u8* p24g_cnt, u8* p5gl_cnt, u8* p5gh_cnt )
+{
+	int	i = 0;
+
+	*p24g_cnt = 0;
+	*p5gl_cnt = 0;
+	*p5gh_cnt = 0;
+
+	for( i = 0; i < pmlmeext->max_chan_nums; i++ )
+	{
+		if ( pmlmeext->channel_set[ i ].ChannelNum <= 14 )
+		{
+			(*p24g_cnt)++;
+		}
+		else if ( ( pmlmeext->channel_set[ i ].ChannelNum > 14 ) && ( pmlmeext->channel_set[ i ].ChannelNum <= 48 ) )
+		{
+			//	Just include the channel 36, 40, 44, 48 channels for 5G low
+			(*p5gl_cnt)++;
+		}
+		else if ( ( pmlmeext->channel_set[ i ].ChannelNum >= 149 ) && ( pmlmeext->channel_set[ i ].ChannelNum <= 161 ) )
+		{
+			//	Just include the channel 149, 153, 157, 161 channels for 5G high
+			(*p5gh_cnt)++;
+		}
+	}
+}
+
+void issue_p2p_GO_request(_adapter *padapter, u8* raddr)
+{
+
+	unsigned char category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8			action = P2P_PUB_ACTION_ACTION;
+	u32			p2poui = cpu_to_be32(P2POUI);
+	u8			oui_subtype = P2P_GO_NEGO_REQ;
+	u8			wpsie[ 255 ] = { 0x00 }, p2pie[ 255 ] = { 0x00 };
+	u8			wpsielen = 0, p2pielen = 0, i;
+	u8			channel_cnt_24g = 0, channel_cnt_5gl = 0, channel_cnt_5gh = 0;
+	u16			len_channellist_attr = 0;
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo);
+
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	DBG_871X( "[%s] In\n", __FUNCTION__ );
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));
+	pwdinfo->negotiation_dialog_token = 1;	//	Initialize the dialog value
+	pframe = rtw_set_fixed_ie(pframe, 1, &pwdinfo->negotiation_dialog_token, &(pattrib->pktlen));
+
+
+
+	//	WPS Section
+	wpsielen = 0;
+	//	WPS OUI
+	*(u32*) ( wpsie ) = cpu_to_be32( WPSOUI );
+	wpsielen += 4;
+
+	//	WPS version
+	//	Type:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_VER1 );
+	wpsielen += 2;
+
+	//	Length:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+	wpsielen += 2;
+
+	//	Value:
+	wpsie[wpsielen++] = WPS_VERSION_1;	//	Version 1.0
+
+	//	Device Password ID
+	//	Type:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_DEVICE_PWID );
+	wpsielen += 2;
+
+	//	Length:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0002 );
+	wpsielen += 2;
+
+	//	Value:
+
+	if ( pwdinfo->ui_got_wps_info == P2P_GOT_WPSINFO_PEER_DISPLAY_PIN )
+	{
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_DPID_USER_SPEC );
+	}
+	else if ( pwdinfo->ui_got_wps_info == P2P_GOT_WPSINFO_SELF_DISPLAY_PIN )
+	{
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_DPID_REGISTRAR_SPEC );
+	}
+	else if ( pwdinfo->ui_got_wps_info == P2P_GOT_WPSINFO_PBC )
+	{
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_DPID_PBC );
+	}
+
+	wpsielen += 2;
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, wpsielen, (unsigned char *) wpsie, &pattrib->pktlen );
+
+
+	//	P2P IE Section.
+
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	//	Commented by Albert 20110306
+	//	According to the P2P Specification, the group negoitation request frame should contain 9 P2P attributes
+	//	1. P2P Capability
+	//	2. Group Owner Intent
+	//	3. Configuration Timeout
+	//	4. Listen Channel
+	//	5. Extended Listen Timing
+	//	6. Intended P2P Interface Address
+	//	7. Channel List
+	//	8. P2P Device Info
+	//	9. Operating Channel
+
+
+	//	P2P Capability
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CAPABILITY;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Device Capability Bitmap, 1 byte
+	p2pie[ p2pielen++ ] = DMP_P2P_DEVCAP_SUPPORT;
+
+	//	Group Capability Bitmap, 1 byte
+	if ( pwdinfo->persistent_supported )
+	{
+		p2pie[ p2pielen++ ] = P2P_GRPCAP_CROSS_CONN | P2P_GRPCAP_PERSISTENT_GROUP;
+	}
+	else
+	{
+		p2pie[ p2pielen++ ] = P2P_GRPCAP_CROSS_CONN;
+	}
+
+
+	//	Group Owner Intent
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_GO_INTENT;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0001 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Todo the tie breaker bit.
+	p2pie[ p2pielen++ ] = ( ( pwdinfo->intent << 1 ) | BIT(0) );
+
+	//	Configuration Timeout
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CONF_TIMEOUT;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	p2pielen += 2;
+
+	//	Value:
+	p2pie[ p2pielen++ ] = 200;	//	2 seconds needed to be the P2P GO
+	p2pie[ p2pielen++ ] = 200;	//	2 seconds needed to be the P2P Client
+
+
+	//	Listen Channel
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_LISTEN_CH;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0005 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Country String
+	p2pie[ p2pielen++ ] = 'X';
+	p2pie[ p2pielen++ ] = 'X';
+
+	//	The third byte should be set to 0x04.
+	//	Described in the "Operating Channel Attribute" section.
+	p2pie[ p2pielen++ ] = 0x04;
+
+	//	Operating Class
+	p2pie[ p2pielen++ ] = 0x51;	//	Copy from SD7
+
+	//	Channel Number
+	p2pie[ p2pielen++ ] = pwdinfo->listen_channel;	//	listening channel number
+
+
+	//	Extended Listen Timing ATTR
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_EX_LISTEN_TIMING;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0004 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Availability Period
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0xFFFF );
+	p2pielen += 2;
+
+	//	Availability Interval
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0xFFFF );
+	p2pielen += 2;
+
+
+	//	Intended P2P Interface Address
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_INTENTED_IF_ADDR;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( ETH_ALEN );
+	p2pielen += 2;
+
+	//	Value:
+	_rtw_memcpy( p2pie + p2pielen, myid( &padapter->eeprompriv ), ETH_ALEN );
+	p2pielen += ETH_ALEN;
+
+
+	//	Channel List
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CH_LIST;
+
+	// Length:
+	// Country String(3)
+	// + ( Operating Class (1) + Number of Channels(1) ) * Operation Classes (?)
+	// + number of channels in all classes
+	len_channellist_attr = 3
+	   + (1 + 1) * (u16)(pmlmeext->channel_list.reg_classes)
+	   + get_reg_classes_full_count(pmlmeext->channel_list);
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+	{
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 5 + 1 );
+	}
+	else
+	{
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( len_channellist_attr );
+	}
+#else
+
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( len_channellist_attr );
+
+#endif
+	p2pielen += 2;
+
+	//	Value:
+	//	Country String
+	p2pie[ p2pielen++ ] = 'X';
+	p2pie[ p2pielen++ ] = 'X';
+
+	//	The third byte should be set to 0x04.
+	//	Described in the "Operating Channel Attribute" section.
+	p2pie[ p2pielen++ ] = 0x04;
+
+	//	Channel Entry List
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+	{
+		_adapter *pbuddy_adapter = padapter->pbuddy_adapter;
+		struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+		//	Operating Class
+		if ( pbuddy_mlmeext->cur_channel > 14 )
+		{
+			if ( pbuddy_mlmeext->cur_channel >= 149 )
+			{
+				p2pie[ p2pielen++ ] = 0x7c;
+			}
+			else
+			{
+				p2pie[ p2pielen++ ] = 0x73;
+			}
+		}
+		else
+		{
+			p2pie[ p2pielen++ ] = 0x51;
+		}
+
+		//	Number of Channels
+		//	Just support 1 channel and this channel is AP's channel
+		p2pie[ p2pielen++ ] = 1;
+
+		//	Channel List
+		p2pie[ p2pielen++ ] = pbuddy_mlmeext->cur_channel;
+	}
+	else
+	{
+		int i,j;
+		for (j = 0; j < pmlmeext->channel_list.reg_classes; j++) {
+			//	Operating Class
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].reg_class;
+
+			//	Number of Channels
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channels;
+
+			//	Channel List
+			for (i = 0; i < pmlmeext->channel_list.reg_class[j].channels; i++) {
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channel[i];
+			}
+		}
+	}
+#else // CONFIG_CONCURRENT_MODE
+	{
+		int i,j;
+		for (j = 0; j < pmlmeext->channel_list.reg_classes; j++) {
+			//	Operating Class
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].reg_class;
+
+			//	Number of Channels
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channels;
+
+			//	Channel List
+			for (i = 0; i < pmlmeext->channel_list.reg_class[j].channels; i++) {
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channel[i];
+			}
+		}
+	}
+#endif // CONFIG_CONCURRENT_MODE
+
+	//	Device Info
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	21 -> P2P Device Address (6bytes) + Config Methods (2bytes) + Primary Device Type (8bytes)
+	//	+ NumofSecondDevType (1byte) + WPS Device Name ID field (2bytes) + WPS Device Name Len field (2bytes)
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 21 + pwdinfo->device_name_len );
+	p2pielen += 2;
+
+	//	Value:
+	//	P2P Device Address
+	_rtw_memcpy( p2pie + p2pielen, myid( &padapter->eeprompriv ), ETH_ALEN );
+	p2pielen += ETH_ALEN;
+
+	//	Config Method
+	//	This field should be big endian. Noted by P2P specification.
+
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( pwdinfo->supported_wps_cm );
+
+	p2pielen += 2;
+
+	//	Primary Device Type
+	//	Category ID
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_CID_MULIT_MEDIA );
+	p2pielen += 2;
+
+	//	OUI
+	*(u32*) ( p2pie + p2pielen ) = cpu_to_be32( WPSOUI );
+	p2pielen += 4;
+
+	//	Sub Category ID
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_SCID_MEDIA_SERVER );
+	p2pielen += 2;
+
+	//	Number of Secondary Device Types
+	p2pie[ p2pielen++ ] = 0x00;	//	No Secondary Device Type List
+
+	//	Device Name
+	//	Type:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+	p2pielen += 2;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( pwdinfo->device_name_len );
+	p2pielen += 2;
+
+	//	Value:
+	_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_name , pwdinfo->device_name_len );
+	p2pielen += pwdinfo->device_name_len;
+
+
+	//	Operating Channel
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_OPERATING_CH;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0005 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Country String
+	p2pie[ p2pielen++ ] = 'X';
+	p2pie[ p2pielen++ ] = 'X';
+
+	//	The third byte should be set to 0x04.
+	//	Described in the "Operating Channel Attribute" section.
+	p2pie[ p2pielen++ ] = 0x04;
+
+	//	Operating Class
+	if ( pwdinfo->operating_channel <= 14 )
+	{
+		//	Operating Class
+		p2pie[ p2pielen++ ] = 0x51;
+	}
+	else if ( ( pwdinfo->operating_channel >= 36 ) && ( pwdinfo->operating_channel <= 48 ) )
+	{
+		//	Operating Class
+		p2pie[ p2pielen++ ] = 0x73;
+	}
+	else
+	{
+		//	Operating Class
+		p2pie[ p2pielen++ ] = 0x7c;
+	}
+
+	//	Channel Number
+	p2pie[ p2pielen++ ] = pwdinfo->operating_channel;	//	operating channel number
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &pattrib->pktlen );
+
+#ifdef CONFIG_WFD
+	wfdielen = build_nego_req_wfd_ie(pwdinfo, pframe);
+	pframe += wfdielen;
+	pattrib->pktlen += wfdielen;
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+
+}
+
+
+void issue_p2p_GO_response(_adapter *padapter, u8* raddr, u8* frame_body,uint len, u8 result)
+{
+
+	unsigned char category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8			action = P2P_PUB_ACTION_ACTION;
+	u32			p2poui = cpu_to_be32(P2POUI);
+	u8			oui_subtype = P2P_GO_NEGO_RESP;
+	u8			wpsie[ 255 ] = { 0x00 }, p2pie[ 255 ] = { 0x00 };
+	u8			p2pielen = 0, i;
+	uint			wpsielen = 0;
+	u16			wps_devicepassword_id = 0x0000;
+	uint			wps_devicepassword_id_len = 0;
+	u8			channel_cnt_24g = 0, channel_cnt_5gl = 0, channel_cnt_5gh;
+	u16			len_channellist_attr = 0;
+
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo);
+
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	DBG_871X( "[%s] In, result = %d\n", __FUNCTION__,  result );
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));
+	pwdinfo->negotiation_dialog_token = frame_body[7];	//	The Dialog Token of provisioning discovery request frame.
+	pframe = rtw_set_fixed_ie(pframe, 1, &(pwdinfo->negotiation_dialog_token), &(pattrib->pktlen));
+
+	//	Commented by Albert 20110328
+	//	Try to get the device password ID from the WPS IE of group negotiation request frame
+	//	WiFi Direct test plan 5.1.15
+	rtw_get_wps_ie( frame_body + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_, wpsie, &wpsielen);
+	rtw_get_wps_attr_content( wpsie, wpsielen, WPS_ATTR_DEVICE_PWID, (u8*) &wps_devicepassword_id, &wps_devicepassword_id_len);
+	wps_devicepassword_id = be16_to_cpu( wps_devicepassword_id );
+
+	_rtw_memset( wpsie, 0x00, 255 );
+	wpsielen = 0;
+
+	//	WPS Section
+	wpsielen = 0;
+	//	WPS OUI
+	*(u32*) ( wpsie ) = cpu_to_be32( WPSOUI );
+	wpsielen += 4;
+
+	//	WPS version
+	//	Type:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_VER1 );
+	wpsielen += 2;
+
+	//	Length:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+	wpsielen += 2;
+
+	//	Value:
+	wpsie[wpsielen++] = WPS_VERSION_1;	//	Version 1.0
+
+	//	Device Password ID
+	//	Type:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_DEVICE_PWID );
+	wpsielen += 2;
+
+	//	Length:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0002 );
+	wpsielen += 2;
+
+	//	Value:
+	if ( wps_devicepassword_id == WPS_DPID_USER_SPEC )
+	{
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_DPID_REGISTRAR_SPEC );
+	}
+	else if ( wps_devicepassword_id == WPS_DPID_REGISTRAR_SPEC )
+	{
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_DPID_USER_SPEC );
+	}
+	else
+	{
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_DPID_PBC );
+	}
+	wpsielen += 2;
+
+	//	Commented by Kurt 20120113
+	//	If some device wants to do p2p handshake without sending prov_disc_req
+	//	We have to get peer_req_cm from here.
+	if(_rtw_memcmp( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "000", 3) )
+	{
+		if ( wps_devicepassword_id == WPS_DPID_USER_SPEC )
+		{
+			_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "dis", 3 );
+		}
+		else if ( wps_devicepassword_id == WPS_DPID_REGISTRAR_SPEC )
+		{
+			_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "pad", 3 );
+		}
+		else
+		{
+			_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "pbc", 3 );
+		}
+	}
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, wpsielen, (unsigned char *) wpsie, &pattrib->pktlen );
+
+
+	//	P2P IE Section.
+
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	//	Commented by Albert 20100908
+	//	According to the P2P Specification, the group negoitation response frame should contain 9 P2P attributes
+	//	1. Status
+	//	2. P2P Capability
+	//	3. Group Owner Intent
+	//	4. Configuration Timeout
+	//	5. Operating Channel
+	//	6. Intended P2P Interface Address
+	//	7. Channel List
+	//	8. Device Info
+	//	9. Group ID	( Only GO )
+
+
+	//	ToDo:
+
+	//	P2P Status
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_STATUS;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0001 );
+	p2pielen += 2;
+
+	//	Value:
+	p2pie[ p2pielen++ ] = result;
+
+	//	P2P Capability
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CAPABILITY;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Device Capability Bitmap, 1 byte
+
+	if ( rtw_p2p_chk_role(pwdinfo, P2P_ROLE_CLIENT) )
+	{
+		//	Commented by Albert 2011/03/08
+		//	According to the P2P specification
+		//	if the sending device will be client, the P2P Capability should be reserved of group negotation response frame
+		p2pie[ p2pielen++ ] = 0;
+	}
+	else
+	{
+		//	Be group owner or meet the error case
+		p2pie[ p2pielen++ ] = DMP_P2P_DEVCAP_SUPPORT;
+	}
+
+	//	Group Capability Bitmap, 1 byte
+	if ( pwdinfo->persistent_supported )
+	{
+		p2pie[ p2pielen++ ] = P2P_GRPCAP_CROSS_CONN | P2P_GRPCAP_PERSISTENT_GROUP;
+	}
+	else
+	{
+		p2pie[ p2pielen++ ] = P2P_GRPCAP_CROSS_CONN;
+	}
+
+	//	Group Owner Intent
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_GO_INTENT;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0001 );
+	p2pielen += 2;
+
+	//	Value:
+	if ( pwdinfo->peer_intent & 0x01 )
+	{
+		//	Peer's tie breaker bit is 1, our tie breaker bit should be 0
+		p2pie[ p2pielen++ ] = ( pwdinfo->intent << 1 );
+	}
+	else
+	{
+		//	Peer's tie breaker bit is 0, our tie breaker bit should be 1
+		p2pie[ p2pielen++ ] = ( ( pwdinfo->intent << 1 ) | BIT(0) );
+	}
+
+
+	//	Configuration Timeout
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CONF_TIMEOUT;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	p2pielen += 2;
+
+	//	Value:
+	p2pie[ p2pielen++ ] = 200;	//	2 seconds needed to be the P2P GO
+	p2pie[ p2pielen++ ] = 200;	//	2 seconds needed to be the P2P Client
+
+	//	Operating Channel
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_OPERATING_CH;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0005 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Country String
+	p2pie[ p2pielen++ ] = 'X';
+	p2pie[ p2pielen++ ] = 'X';
+
+	//	The third byte should be set to 0x04.
+	//	Described in the "Operating Channel Attribute" section.
+	p2pie[ p2pielen++ ] = 0x04;
+
+	//	Operating Class
+	if ( pwdinfo->operating_channel <= 14 )
+	{
+		//	Operating Class
+		p2pie[ p2pielen++ ] = 0x51;
+	}
+	else if ( ( pwdinfo->operating_channel >= 36 ) && ( pwdinfo->operating_channel <= 48 ) )
+	{
+		//	Operating Class
+		p2pie[ p2pielen++ ] = 0x73;
+	}
+	else
+	{
+		//	Operating Class
+		p2pie[ p2pielen++ ] = 0x7c;
+	}
+
+	//	Channel Number
+	p2pie[ p2pielen++ ] = pwdinfo->operating_channel;	//	operating channel number
+
+	//	Intended P2P Interface Address
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_INTENTED_IF_ADDR;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( ETH_ALEN );
+	p2pielen += 2;
+
+	//	Value:
+	_rtw_memcpy( p2pie + p2pielen, myid( &padapter->eeprompriv ), ETH_ALEN );
+	p2pielen += ETH_ALEN;
+
+	//	Channel List
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CH_LIST;
+
+	// Country String(3)
+	// + ( Operating Class (1) + Number of Channels(1) ) * Operation Classes (?)
+	// + number of channels in all classes
+	len_channellist_attr = 3
+	   + (1 + 1) * (u16)pmlmeext->channel_list.reg_classes
+	   + get_reg_classes_full_count(pmlmeext->channel_list);
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+	{
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 5 + 1 );
+	}
+	else
+	{
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( len_channellist_attr );
+	}
+#else
+
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( len_channellist_attr );
+
+ #endif
+	p2pielen += 2;
+
+	//	Value:
+	//	Country String
+	p2pie[ p2pielen++ ] = 'X';
+	p2pie[ p2pielen++ ] = 'X';
+
+	//	The third byte should be set to 0x04.
+	//	Described in the "Operating Channel Attribute" section.
+	p2pie[ p2pielen++ ] = 0x04;
+
+	//	Channel Entry List
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+	{
+		_adapter *pbuddy_adapter = padapter->pbuddy_adapter;
+		struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+		//	Operating Class
+		if ( pbuddy_mlmeext->cur_channel > 14 )
+		{
+			if ( pbuddy_mlmeext->cur_channel >= 149 )
+			{
+				p2pie[ p2pielen++ ] = 0x7c;
+			}
+			else
+			{
+				p2pie[ p2pielen++ ] = 0x73;
+			}
+		}
+		else
+		{
+			p2pie[ p2pielen++ ] = 0x51;
+		}
+
+		//	Number of Channels
+		//	Just support 1 channel and this channel is AP's channel
+		p2pie[ p2pielen++ ] = 1;
+
+		//	Channel List
+		p2pie[ p2pielen++ ] = pbuddy_mlmeext->cur_channel;
+	}
+	else
+	{
+		int i, j;
+		for (j = 0; j < pmlmeext->channel_list.reg_classes; j++) {
+			//	Operating Class
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].reg_class;
+
+			//	Number of Channels
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channels;
+
+			//	Channel List
+			for (i = 0; i < pmlmeext->channel_list.reg_class[j].channels; i++) {
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channel[i];
+			}
+		}
+	}
+#else // CONFIG_CONCURRENT_MODE
+	{
+		int i, j;
+		for (j = 0; j < pmlmeext->channel_list.reg_classes; j++) {
+			//	Operating Class
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].reg_class;
+
+			//	Number of Channels
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channels;
+
+			//	Channel List
+			for (i = 0; i < pmlmeext->channel_list.reg_class[j].channels; i++) {
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channel[i];
+			}
+		}
+	}
+#endif // CONFIG_CONCURRENT_MODE
+
+	//	Device Info
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	21 -> P2P Device Address (6bytes) + Config Methods (2bytes) + Primary Device Type (8bytes)
+	//	+ NumofSecondDevType (1byte) + WPS Device Name ID field (2bytes) + WPS Device Name Len field (2bytes)
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 21 + pwdinfo->device_name_len );
+	p2pielen += 2;
+
+	//	Value:
+	//	P2P Device Address
+	_rtw_memcpy( p2pie + p2pielen, myid( &padapter->eeprompriv ), ETH_ALEN );
+	p2pielen += ETH_ALEN;
+
+	//	Config Method
+	//	This field should be big endian. Noted by P2P specification.
+
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( pwdinfo->supported_wps_cm );
+
+	p2pielen += 2;
+
+	//	Primary Device Type
+	//	Category ID
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_CID_MULIT_MEDIA );
+	p2pielen += 2;
+
+	//	OUI
+	*(u32*) ( p2pie + p2pielen ) = cpu_to_be32( WPSOUI );
+	p2pielen += 4;
+
+	//	Sub Category ID
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_SCID_MEDIA_SERVER );
+	p2pielen += 2;
+
+	//	Number of Secondary Device Types
+	p2pie[ p2pielen++ ] = 0x00;	//	No Secondary Device Type List
+
+	//	Device Name
+	//	Type:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+	p2pielen += 2;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( pwdinfo->device_name_len );
+	p2pielen += 2;
+
+	//	Value:
+	_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_name , pwdinfo->device_name_len );
+	p2pielen += pwdinfo->device_name_len;
+
+	if ( rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO) )
+	{
+		//	Group ID Attribute
+		//	Type:
+		p2pie[ p2pielen++ ] = P2P_ATTR_GROUP_ID;
+
+		//	Length:
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( ETH_ALEN + pwdinfo->nego_ssidlen );
+		p2pielen += 2;
+
+		//	Value:
+		//	p2P Device Address
+		_rtw_memcpy( p2pie + p2pielen , pwdinfo->device_addr, ETH_ALEN );
+		p2pielen += ETH_ALEN;
+
+		//	SSID
+		_rtw_memcpy( p2pie + p2pielen, pwdinfo->nego_ssid, pwdinfo->nego_ssidlen );
+		p2pielen += pwdinfo->nego_ssidlen;
+
+	}
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &pattrib->pktlen );
+
+#ifdef CONFIG_WFD
+	wfdielen = build_nego_resp_wfd_ie(pwdinfo, pframe);
+	pframe += wfdielen;
+	pattrib->pktlen += wfdielen;
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+
+}
+
+void issue_p2p_GO_confirm(_adapter *padapter, u8* raddr, u8 result)
+{
+
+	unsigned char category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8			action = P2P_PUB_ACTION_ACTION;
+	u32			p2poui = cpu_to_be32(P2POUI);
+	u8			oui_subtype = P2P_GO_NEGO_CONF;
+	u8			wpsie[ 255 ] = { 0x00 }, p2pie[ 255 ] = { 0x00 };
+	u8			wpsielen = 0, p2pielen = 0;
+
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo);
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	DBG_871X( "[%s] In\n", __FUNCTION__ );
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(pwdinfo->negotiation_dialog_token), &(pattrib->pktlen));
+
+
+
+	//	P2P IE Section.
+
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	//	Commented by Albert 20110306
+	//	According to the P2P Specification, the group negoitation request frame should contain 5 P2P attributes
+	//	1. Status
+	//	2. P2P Capability
+	//	3. Operating Channel
+	//	4. Channel List
+	//	5. Group ID	( if this WiFi is GO )
+
+	//	P2P Status
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_STATUS;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0001 );
+	p2pielen += 2;
+
+	//	Value:
+	p2pie[ p2pielen++ ] = result;
+
+	//	P2P Capability
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CAPABILITY;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Device Capability Bitmap, 1 byte
+	p2pie[ p2pielen++ ] = DMP_P2P_DEVCAP_SUPPORT;
+
+	//	Group Capability Bitmap, 1 byte
+	if ( pwdinfo->persistent_supported )
+	{
+		p2pie[ p2pielen++ ] = P2P_GRPCAP_CROSS_CONN | P2P_GRPCAP_PERSISTENT_GROUP;
+	}
+	else
+	{
+		p2pie[ p2pielen++ ] = P2P_GRPCAP_CROSS_CONN;
+	}
+
+
+	//	Operating Channel
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_OPERATING_CH;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0005 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Country String
+	p2pie[ p2pielen++ ] = 'X';
+	p2pie[ p2pielen++ ] = 'X';
+
+	//	The third byte should be set to 0x04.
+	//	Described in the "Operating Channel Attribute" section.
+	p2pie[ p2pielen++ ] = 0x04;
+
+
+	if ( rtw_p2p_chk_role(pwdinfo, P2P_ROLE_CLIENT) )
+	{
+		if ( pwdinfo->peer_operating_ch <= 14 )
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x51;
+		}
+		else if ( ( pwdinfo->peer_operating_ch >= 36 ) && ( pwdinfo->peer_operating_ch <= 48 ) )
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x73;
+		}
+		else
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x7c;
+		}
+
+		p2pie[ p2pielen++ ] = pwdinfo->peer_operating_ch;
+	}
+	else
+	{
+		if ( pwdinfo->operating_channel <= 14 )
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x51;
+		}
+		else if ( ( pwdinfo->operating_channel >= 36 ) && ( pwdinfo->operating_channel <= 48 ) )
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x73;
+		}
+		else
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x7c;
+		}
+
+		//	Channel Number
+		p2pie[ p2pielen++ ] = pwdinfo->operating_channel;		//	Use the listen channel as the operating channel
+	}
+
+
+	//	Channel List
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CH_LIST;
+
+	*(u16*) ( p2pie + p2pielen ) = 6;
+	p2pielen += 2;
+
+	//	Country String
+	p2pie[ p2pielen++ ] = 'X';
+	p2pie[ p2pielen++ ] = 'X';
+
+	//	The third byte should be set to 0x04.
+	//	Described in the "Operating Channel Attribute" section.
+	p2pie[ p2pielen++ ] = 0x04;
+
+	//	Value:
+	if ( rtw_p2p_chk_role(pwdinfo, P2P_ROLE_CLIENT) )
+	{
+		if ( pwdinfo->peer_operating_ch <= 14 )
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x51;
+		}
+		else if ( ( pwdinfo->peer_operating_ch >= 36 ) && ( pwdinfo->peer_operating_ch <= 48 ) )
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x73;
+		}
+		else
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x7c;
+		}
+		p2pie[ p2pielen++ ] = 1;
+		p2pie[ p2pielen++ ] = pwdinfo->peer_operating_ch;
+	}
+	else
+	{
+		if ( pwdinfo->operating_channel <= 14 )
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x51;
+		}
+		else if ( ( pwdinfo->operating_channel >= 36 ) && ( pwdinfo->operating_channel <= 48 ) )
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x73;
+		}
+		else
+		{
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x7c;
+		}
+
+		//	Channel Number
+		p2pie[ p2pielen++ ] = 1;
+		p2pie[ p2pielen++ ] = pwdinfo->operating_channel;		//	Use the listen channel as the operating channel
+	}
+
+	if (rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO) )
+	{
+		//	Group ID Attribute
+		//	Type:
+		p2pie[ p2pielen++ ] = P2P_ATTR_GROUP_ID;
+
+		//	Length:
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( ETH_ALEN + pwdinfo->nego_ssidlen );
+		p2pielen += 2;
+
+		//	Value:
+		//	p2P Device Address
+		_rtw_memcpy( p2pie + p2pielen , pwdinfo->device_addr, ETH_ALEN );
+		p2pielen += ETH_ALEN;
+
+		//	SSID
+		_rtw_memcpy( p2pie + p2pielen, pwdinfo->nego_ssid, pwdinfo->nego_ssidlen );
+		p2pielen += pwdinfo->nego_ssidlen;
+	}
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &pattrib->pktlen );
+
+#ifdef CONFIG_WFD
+	wfdielen = build_nego_confirm_wfd_ie(pwdinfo, pframe);
+	pframe += wfdielen;
+	pattrib->pktlen += wfdielen;
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+
+}
+
+void issue_p2p_invitation_request(_adapter *padapter, u8* raddr )
+{
+
+	unsigned char category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8			action = P2P_PUB_ACTION_ACTION;
+	u32			p2poui = cpu_to_be32(P2POUI);
+	u8			oui_subtype = P2P_INVIT_REQ;
+	u8			p2pie[ 255 ] = { 0x00 };
+	u8			p2pielen = 0, i;
+	u8			dialogToken = 3;
+	u8			channel_cnt_24g = 0, channel_cnt_5gl = 0, channel_cnt_5gh = 0;
+	u16			len_channellist_attr = 0;
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+	struct wifidirect_info	*pbuddy_wdinfo = &pbuddy_adapter->wdinfo;
+	struct mlme_priv		*pbuddy_mlmepriv = &pbuddy_adapter->mlmepriv;
+	struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+#endif
+
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo);
+
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, raddr,  ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialogToken), &(pattrib->pktlen));
+
+	//	P2P IE Section.
+
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	//	Commented by Albert 20101011
+	//	According to the P2P Specification, the P2P Invitation request frame should contain 7 P2P attributes
+	//	1. Configuration Timeout
+	//	2. Invitation Flags
+	//	3. Operating Channel	( Only GO )
+	//	4. P2P Group BSSID	( Should be included if I am the GO )
+	//	5. Channel List
+	//	6. P2P Group ID
+	//	7. P2P Device Info
+
+	//	Configuration Timeout
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CONF_TIMEOUT;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	p2pielen += 2;
+
+	//	Value:
+	p2pie[ p2pielen++ ] = 200;	//	2 seconds needed to be the P2P GO
+	p2pie[ p2pielen++ ] = 200;	//	2 seconds needed to be the P2P Client
+
+	//	Invitation Flags
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_INVITATION_FLAGS;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0001 );
+	p2pielen += 2;
+
+	//	Value:
+	p2pie[ p2pielen++ ] = P2P_INVITATION_FLAGS_PERSISTENT;
+
+
+	//	Operating Channel
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_OPERATING_CH;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0005 );
+	p2pielen += 2;
+
+	//	Value:
+	//	Country String
+	p2pie[ p2pielen++ ] = 'X';
+	p2pie[ p2pielen++ ] = 'X';
+
+	//	The third byte should be set to 0x04.
+	//	Described in the "Operating Channel Attribute" section.
+	p2pie[ p2pielen++ ] = 0x04;
+
+	//	Operating Class
+	if ( pwdinfo->invitereq_info.operating_ch <= 14 )
+		p2pie[ p2pielen++ ] = 0x51;
+	else if ( ( pwdinfo->invitereq_info.operating_ch >= 36 ) && ( pwdinfo->invitereq_info.operating_ch <= 48 ) )
+		p2pie[ p2pielen++ ] = 0x73;
+	else
+		p2pie[ p2pielen++ ] = 0x7c;
+
+	//	Channel Number
+	p2pie[ p2pielen++ ] = pwdinfo->invitereq_info.operating_ch;	//	operating channel number
+
+	if ( _rtw_memcmp( myid( &padapter->eeprompriv ), pwdinfo->invitereq_info.go_bssid, ETH_ALEN ) )
+	{
+		//	P2P Group BSSID
+		//	Type:
+		p2pie[ p2pielen++ ] = P2P_ATTR_GROUP_BSSID;
+
+		//	Length:
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( ETH_ALEN );
+		p2pielen += 2;
+
+		//	Value:
+		//	P2P Device Address for GO
+		_rtw_memcpy( p2pie + p2pielen, pwdinfo->invitereq_info.go_bssid, ETH_ALEN );
+		p2pielen += ETH_ALEN;
+	}
+
+	//	Channel List
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CH_LIST;
+
+
+	//	Length:
+	// Country String(3)
+	// + ( Operating Class (1) + Number of Channels(1) ) * Operation Classes (?)
+	// + number of channels in all classes
+	len_channellist_attr = 3
+	   + (1 + 1) * (u16)pmlmeext->channel_list.reg_classes
+	   + get_reg_classes_full_count(pmlmeext->channel_list);
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+	{
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 5 + 1 );
+	}
+	else
+	{
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( len_channellist_attr );
+	}
+#else
+
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( len_channellist_attr );
+
+ #endif
+	p2pielen += 2;
+
+	//	Value:
+	//	Country String
+	p2pie[ p2pielen++ ] = 'X';
+	p2pie[ p2pielen++ ] = 'X';
+
+	//	The third byte should be set to 0x04.
+	//	Described in the "Operating Channel Attribute" section.
+	p2pie[ p2pielen++ ] = 0x04;
+
+	//	Channel Entry List
+#ifdef CONFIG_CONCURRENT_MODE
+	if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+	{
+		_adapter *pbuddy_adapter = padapter->pbuddy_adapter;
+		struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+		//	Operating Class
+		if ( pbuddy_mlmeext->cur_channel > 14 )
+		{
+			if ( pbuddy_mlmeext->cur_channel >= 149 )
+			{
+				p2pie[ p2pielen++ ] = 0x7c;
+			}
+			else
+			{
+				p2pie[ p2pielen++ ] = 0x73;
+			}
+		}
+		else
+		{
+			p2pie[ p2pielen++ ] = 0x51;
+		}
+
+		//	Number of Channels
+		//	Just support 1 channel and this channel is AP's channel
+		p2pie[ p2pielen++ ] = 1;
+
+		//	Channel List
+		p2pie[ p2pielen++ ] = pbuddy_mlmeext->cur_channel;
+	}
+	else
+	{
+		int i, j;
+		for (j = 0; j < pmlmeext->channel_list.reg_classes; j++) {
+			//	Operating Class
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].reg_class;
+
+			//	Number of Channels
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channels;
+
+			//	Channel List
+			for (i = 0; i < pmlmeext->channel_list.reg_class[j].channels; i++) {
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channel[i];
+			}
+		}
+	}
+#else // CONFIG_CONCURRENT_MODE
+	{
+		int i, j;
+		for (j = 0; j < pmlmeext->channel_list.reg_classes; j++) {
+			//	Operating Class
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].reg_class;
+
+			//	Number of Channels
+			p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channels;
+
+			//	Channel List
+			for (i = 0; i < pmlmeext->channel_list.reg_class[j].channels; i++) {
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channel[i];
+			}
+		}
+	}
+#endif // CONFIG_CONCURRENT_MODE
+
+
+	//	P2P Group ID
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_GROUP_ID;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 6 + pwdinfo->invitereq_info.ssidlen );
+	p2pielen += 2;
+
+	//	Value:
+	//	P2P Device Address for GO
+	_rtw_memcpy( p2pie + p2pielen, pwdinfo->invitereq_info.go_bssid, ETH_ALEN );
+	p2pielen += ETH_ALEN;
+
+	//	SSID
+	_rtw_memcpy( p2pie + p2pielen, pwdinfo->invitereq_info.go_ssid, pwdinfo->invitereq_info.ssidlen );
+	p2pielen += pwdinfo->invitereq_info.ssidlen;
+
+
+	//	Device Info
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	21 -> P2P Device Address (6bytes) + Config Methods (2bytes) + Primary Device Type (8bytes)
+	//	+ NumofSecondDevType (1byte) + WPS Device Name ID field (2bytes) + WPS Device Name Len field (2bytes)
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 21 + pwdinfo->device_name_len );
+	p2pielen += 2;
+
+	//	Value:
+	//	P2P Device Address
+	_rtw_memcpy( p2pie + p2pielen, myid( &padapter->eeprompriv ), ETH_ALEN );
+	p2pielen += ETH_ALEN;
+
+	//	Config Method
+	//	This field should be big endian. Noted by P2P specification.
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_CONFIG_METHOD_DISPLAY );
+	p2pielen += 2;
+
+	//	Primary Device Type
+	//	Category ID
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_CID_MULIT_MEDIA );
+	p2pielen += 2;
+
+	//	OUI
+	*(u32*) ( p2pie + p2pielen ) = cpu_to_be32( WPSOUI );
+	p2pielen += 4;
+
+	//	Sub Category ID
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_SCID_MEDIA_SERVER );
+	p2pielen += 2;
+
+	//	Number of Secondary Device Types
+	p2pie[ p2pielen++ ] = 0x00;	//	No Secondary Device Type List
+
+	//	Device Name
+	//	Type:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+	p2pielen += 2;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( pwdinfo->device_name_len );
+	p2pielen += 2;
+
+	//	Value:
+	_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_name, pwdinfo->device_name_len );
+	p2pielen += pwdinfo->device_name_len;
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &pattrib->pktlen );
+
+#ifdef CONFIG_WFD
+	wfdielen = build_invitation_req_wfd_ie(pwdinfo, pframe);
+	pframe += wfdielen;
+	pattrib->pktlen += wfdielen;
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+
+}
+
+void issue_p2p_invitation_response(_adapter *padapter, u8* raddr, u8 dialogToken, u8 status_code)
+{
+
+	unsigned char category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8			action = P2P_PUB_ACTION_ACTION;
+	u32			p2poui = cpu_to_be32(P2POUI);
+	u8			oui_subtype = P2P_INVIT_RESP;
+	u8			p2pie[ 255 ] = { 0x00 };
+	u8			p2pielen = 0, i;
+	u8			channel_cnt_24g = 0, channel_cnt_5gl = 0, channel_cnt_5gh = 0;
+	u16			len_channellist_attr = 0;
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+	struct wifidirect_info	*pbuddy_wdinfo = &pbuddy_adapter->wdinfo;
+	struct mlme_priv		*pbuddy_mlmepriv = &pbuddy_adapter->mlmepriv;
+	struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+#endif
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo);
+
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, raddr,  ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialogToken), &(pattrib->pktlen));
+
+	//	P2P IE Section.
+
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	//	Commented by Albert 20101005
+	//	According to the P2P Specification, the P2P Invitation response frame should contain 5 P2P attributes
+	//	1. Status
+	//	2. Configuration Timeout
+	//	3. Operating Channel	( Only GO )
+	//	4. P2P Group BSSID	( Only GO )
+	//	5. Channel List
+
+	//	P2P Status
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_STATUS;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0001 );
+	p2pielen += 2;
+
+	//	Value:
+	//	When status code is P2P_STATUS_FAIL_INFO_UNAVAILABLE.
+	//	Sent the event receiving the P2P Invitation Req frame to DMP UI.
+	//	DMP had to compare the MAC address to find out the profile.
+	//	So, the WiFi driver will send the P2P_STATUS_FAIL_INFO_UNAVAILABLE to NB.
+	//	If the UI found the corresponding profile, the WiFi driver sends the P2P Invitation Req
+	//	to NB to rebuild the persistent group.
+	p2pie[ p2pielen++ ] = status_code;
+
+	//	Configuration Timeout
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CONF_TIMEOUT;
+
+	//	Length:
+	*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	p2pielen += 2;
+
+	//	Value:
+	p2pie[ p2pielen++ ] = 200;	//	2 seconds needed to be the P2P GO
+	p2pie[ p2pielen++ ] = 200;	//	2 seconds needed to be the P2P Client
+
+	if( status_code == P2P_STATUS_SUCCESS )
+	{
+		if( rtw_p2p_chk_role( pwdinfo, P2P_ROLE_GO ) )
+		{
+			//	The P2P Invitation request frame asks this Wi-Fi device to be the P2P GO
+			//	In this case, the P2P Invitation response frame should carry the two more P2P attributes.
+			//	First one is operating channel attribute.
+			//	Second one is P2P Group BSSID attribute.
+
+			//	Operating Channel
+			//	Type:
+			p2pie[ p2pielen++ ] = P2P_ATTR_OPERATING_CH;
+
+			//	Length:
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0005 );
+			p2pielen += 2;
+
+			//	Value:
+			//	Country String
+			p2pie[ p2pielen++ ] = 'X';
+			p2pie[ p2pielen++ ] = 'X';
+
+			//	The third byte should be set to 0x04.
+			//	Described in the "Operating Channel Attribute" section.
+			p2pie[ p2pielen++ ] = 0x04;
+
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x51;	//	Copy from SD7
+
+			//	Channel Number
+			p2pie[ p2pielen++ ] = pwdinfo->operating_channel;	//	operating channel number
+
+
+			//	P2P Group BSSID
+			//	Type:
+			p2pie[ p2pielen++ ] = P2P_ATTR_GROUP_BSSID;
+
+			//	Length:
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( ETH_ALEN );
+			p2pielen += 2;
+
+			//	Value:
+			//	P2P Device Address for GO
+			_rtw_memcpy( p2pie + p2pielen, myid( &padapter->eeprompriv ), ETH_ALEN );
+			p2pielen += ETH_ALEN;
+
+		}
+
+		//	Channel List
+		//	Type:
+		p2pie[ p2pielen++ ] = P2P_ATTR_CH_LIST;
+
+		//	Length:
+		// Country String(3)
+		// + ( Operating Class (1) + Number of Channels(1) ) * Operation Classes (?)
+		// + number of channels in all classes
+		len_channellist_attr = 3
+			+ (1 + 1) * (u16)pmlmeext->channel_list.reg_classes
+			+ get_reg_classes_full_count(pmlmeext->channel_list);
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+		{
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 5 + 1 );
+		}
+		else
+		{
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( len_channellist_attr );
+		}
+#else
+
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( len_channellist_attr );
+
+#endif
+		p2pielen += 2;
+
+		//	Value:
+		//	Country String
+		p2pie[ p2pielen++ ] = 'X';
+		p2pie[ p2pielen++ ] = 'X';
+
+		//	The third byte should be set to 0x04.
+		//	Described in the "Operating Channel Attribute" section.
+		p2pie[ p2pielen++ ] = 0x04;
+
+		//	Channel Entry List
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+		{
+			_adapter *pbuddy_adapter = padapter->pbuddy_adapter;
+			struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+			//	Operating Class
+			if ( pbuddy_mlmeext->cur_channel > 14 )
+			{
+				if ( pbuddy_mlmeext->cur_channel >= 149 )
+				{
+					p2pie[ p2pielen++ ] = 0x7c;
+				}
+				else
+				{
+					p2pie[ p2pielen++ ] = 0x73;
+				}
+			}
+			else
+			{
+				p2pie[ p2pielen++ ] = 0x51;
+			}
+
+			//	Number of Channels
+			//	Just support 1 channel and this channel is AP's channel
+			p2pie[ p2pielen++ ] = 1;
+
+			//	Channel List
+			p2pie[ p2pielen++ ] = pbuddy_mlmeext->cur_channel;
+		}
+		else
+		{
+			int i, j;
+			for (j = 0; j < pmlmeext->channel_list.reg_classes; j++) {
+				//	Operating Class
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].reg_class;
+
+				//	Number of Channels
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channels;
+
+				//	Channel List
+				for (i = 0; i < pmlmeext->channel_list.reg_class[j].channels; i++) {
+					p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channel[i];
+				}
+			}
+		}
+#else // CONFIG_CONCURRENT_MODE
+		{
+			int i, j;
+			for (j = 0; j < pmlmeext->channel_list.reg_classes; j++) {
+				//	Operating Class
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].reg_class;
+
+				//	Number of Channels
+				p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channels;
+
+				//	Channel List
+				for (i = 0; i < pmlmeext->channel_list.reg_class[j].channels; i++) {
+					p2pie[p2pielen++] = pmlmeext->channel_list.reg_class[j].channel[i];
+				}
+			}
+		}
+#endif // CONFIG_CONCURRENT_MODE
+	}
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &pattrib->pktlen );
+
+#ifdef CONFIG_WFD
+	wfdielen = build_invitation_resp_wfd_ie(pwdinfo, pframe);
+	pframe += wfdielen;
+	pattrib->pktlen += wfdielen;
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+
+}
+
+void issue_p2p_provision_request(_adapter *padapter, u8* pssid, u8 ussidlen, u8* pdev_raddr )
+{
+	unsigned char category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8			action = P2P_PUB_ACTION_ACTION;
+	u8			dialogToken = 1;
+	u32			p2poui = cpu_to_be32(P2POUI);
+	u8			oui_subtype = P2P_PROVISION_DISC_REQ;
+	u8			wpsie[ 100 ] = { 0x00 };
+	u8			wpsielen = 0;
+	u32			p2pielen = 0;
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	DBG_871X( "[%s] In\n", __FUNCTION__ );
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, pdev_raddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, pdev_raddr, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialogToken), &(pattrib->pktlen));
+
+	p2pielen = build_prov_disc_request_p2p_ie( pwdinfo, pframe, pssid, ussidlen, pdev_raddr );
+
+	pframe += p2pielen;
+	pattrib->pktlen += p2pielen;
+
+	wpsielen = 0;
+	//	WPS OUI
+	*(u32*) ( wpsie ) = cpu_to_be32( WPSOUI );
+	wpsielen += 4;
+
+	//	WPS version
+	//	Type:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_VER1 );
+	wpsielen += 2;
+
+	//	Length:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+	wpsielen += 2;
+
+	//	Value:
+	wpsie[wpsielen++] = WPS_VERSION_1;	//	Version 1.0
+
+	//	Config Method
+	//	Type:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_CONF_METHOD );
+	wpsielen += 2;
+
+	//	Length:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0002 );
+	wpsielen += 2;
+
+	//	Value:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( pwdinfo->tx_prov_disc_info.wps_config_method_request );
+	wpsielen += 2;
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, wpsielen, (unsigned char *) wpsie, &pattrib->pktlen );
+
+
+#ifdef CONFIG_WFD
+	wfdielen = build_provdisc_req_wfd_ie(pwdinfo, pframe);
+	pframe += wfdielen;
+	pattrib->pktlen += wfdielen;
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+
+}
+
+
+u8 is_matched_in_profilelist( u8* peermacaddr, struct profile_info* profileinfo )
+{
+	u8 i, match_result = 0;
+
+	DBG_871X( "[%s] peermac = %.2X %.2X %.2X %.2X %.2X %.2X\n", __FUNCTION__,
+		    peermacaddr[0], peermacaddr[1],peermacaddr[2],peermacaddr[3],peermacaddr[4],peermacaddr[5]);
+
+	for( i = 0; i < P2P_MAX_PERSISTENT_GROUP_NUM; i++, profileinfo++ )
+	{
+	       DBG_871X( "[%s] profileinfo_mac = %.2X %.2X %.2X %.2X %.2X %.2X\n", __FUNCTION__,
+			    profileinfo->peermac[0], profileinfo->peermac[1],profileinfo->peermac[2],profileinfo->peermac[3],profileinfo->peermac[4],profileinfo->peermac[5]);
+		if ( _rtw_memcmp( peermacaddr, profileinfo->peermac, ETH_ALEN ) )
+		{
+			match_result = 1;
+			DBG_871X( "[%s] Match!\n", __FUNCTION__ );
+			break;
+		}
+	}
+
+	return (match_result );
+}
+
+void issue_probersp_p2p(_adapter *padapter, unsigned char *da)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	unsigned char					*mac;
+	struct xmit_priv	*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	//WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+	u16					beacon_interval = 100;
+	u16					capInfo = 0;
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+	u8					wpsie[255] = { 0x00 };
+	u32					wpsielen = 0, p2pielen = 0;
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+#ifdef CONFIG_INTEL_WIDI
+	u8 zero_array_check[L2SDTA_SERVICE_VE_LEN] = { 0x00 };
+#endif //CONFIG_INTEL_WIDI
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	mac = myid(&(padapter->eeprompriv));
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+	_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
+
+	//	Use the device address for BSSID field.
+	_rtw_memcpy(pwlanhdr->addr3, mac, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(fctrl, WIFI_PROBERSP);
+
+	pattrib->hdrlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = pattrib->hdrlen;
+	pframe += pattrib->hdrlen;
+
+	//timestamp will be inserted by hardware
+	pframe += 8;
+	pattrib->pktlen += 8;
+
+	// beacon interval: 2 bytes
+	_rtw_memcpy(pframe, (unsigned char *) &beacon_interval, 2);
+	pframe += 2;
+	pattrib->pktlen += 2;
+
+	//	capability info: 2 bytes
+	//	ESS and IBSS bits must be 0 (defined in the 3.1.2.1.1 of WiFi Direct Spec)
+	capInfo |= cap_ShortPremble;
+	capInfo |= cap_ShortSlot;
+
+	_rtw_memcpy(pframe, (unsigned char *) &capInfo, 2);
+	pframe += 2;
+	pattrib->pktlen += 2;
+
+
+	// SSID
+	pframe = rtw_set_ie(pframe, _SSID_IE_, 7, pwdinfo->p2p_wildcard_ssid, &pattrib->pktlen);
+
+	// supported rates...
+	//	Use the OFDM rate in the P2P probe response frame. ( 6(B), 9(B), 12, 18, 24, 36, 48, 54 )
+	pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, pwdinfo->support_rate, &pattrib->pktlen);
+
+	// DS parameter set
+	pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&pwdinfo->listen_channel, &pattrib->pktlen);
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if(wdev_to_priv(padapter->rtw_wdev)->p2p_enabled && pwdinfo->driver_interface == DRIVER_CFG80211 )
+	{
+		if( pmlmepriv->wps_probe_resp_ie != NULL && pmlmepriv->p2p_probe_resp_ie != NULL )
+		{
+			//WPS IE
+			_rtw_memcpy(pframe, pmlmepriv->wps_probe_resp_ie, pmlmepriv->wps_probe_resp_ie_len);
+			pattrib->pktlen += pmlmepriv->wps_probe_resp_ie_len;
+			pframe += pmlmepriv->wps_probe_resp_ie_len;
+
+			//P2P IE
+			_rtw_memcpy(pframe, pmlmepriv->p2p_probe_resp_ie, pmlmepriv->p2p_probe_resp_ie_len);
+			pattrib->pktlen += pmlmepriv->p2p_probe_resp_ie_len;
+			pframe += pmlmepriv->p2p_probe_resp_ie_len;
+		}
+	}
+	else
+#endif //CONFIG_IOCTL_CFG80211
+	{
+
+		//	Todo: WPS IE
+		//	Noted by Albert 20100907
+		//	According to the WPS specification, all the WPS attribute is presented by Big Endian.
+
+		wpsielen = 0;
+		//	WPS OUI
+		*(u32*) ( wpsie ) = cpu_to_be32( WPSOUI );
+		wpsielen += 4;
+
+		//	WPS version
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_VER1 );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+		wpsielen += 2;
+
+		//	Value:
+		wpsie[wpsielen++] = WPS_VERSION_1;	//	Version 1.0
+
+#ifdef CONFIG_INTEL_WIDI
+		//	Commented by Kurt
+		//	Appended WiDi info. only if we did issued_probereq_widi(), and then we saved ven. ext. in pmlmepriv->sa_ext.
+		if(  _rtw_memcmp(pmlmepriv->sa_ext, zero_array_check, L2SDTA_SERVICE_VE_LEN) == _FALSE
+			|| pmlmepriv->num_p2p_sdt != 0 )
+		{
+			//Sec dev type
+			*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_SEC_DEV_TYPE_LIST );
+			wpsielen += 2;
+
+			//	Length:
+			*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0008 );
+			wpsielen += 2;
+
+			//	Value:
+			//	Category ID
+			*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_PDT_CID_DISPLAYS );
+			wpsielen += 2;
+
+			//	OUI
+			*(u32*) ( wpsie + wpsielen ) = cpu_to_be32( INTEL_DEV_TYPE_OUI );
+			wpsielen += 4;
+
+			*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_PDT_SCID_WIDI_CONSUMER_SINK );
+			wpsielen += 2;
+
+			if(  _rtw_memcmp(pmlmepriv->sa_ext, zero_array_check, L2SDTA_SERVICE_VE_LEN) == _FALSE )
+			{
+				//	Vendor Extension
+				_rtw_memcpy( wpsie + wpsielen, pmlmepriv->sa_ext, L2SDTA_SERVICE_VE_LEN );
+				wpsielen += L2SDTA_SERVICE_VE_LEN;
+			}
+		}
+#endif //CONFIG_INTEL_WIDI
+
+		//	WiFi Simple Config State
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_SIMPLE_CONF_STATE );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+		wpsielen += 2;
+
+		//	Value:
+		wpsie[wpsielen++] = WPS_WSC_STATE_NOT_CONFIG;	//	Not Configured.
+
+		//	Response Type
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_RESP_TYPE );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+		wpsielen += 2;
+
+		//	Value:
+		wpsie[wpsielen++] = WPS_RESPONSE_TYPE_8021X;
+
+		//	UUID-E
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_UUID_E );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0010 );
+		wpsielen += 2;
+
+		//	Value:
+		if (pwdinfo->external_uuid == 0) {
+			_rtw_memset( wpsie + wpsielen, 0x0, 16 );
+			_rtw_memcpy( wpsie + wpsielen, myid( &padapter->eeprompriv ), ETH_ALEN );
+		} else {
+			_rtw_memcpy( wpsie + wpsielen, pwdinfo->uuid, 0x10 );
+		}
+		wpsielen += 0x10;
+
+		//	Manufacturer
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_MANUFACTURER );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0007 );
+		wpsielen += 2;
+
+		//	Value:
+		_rtw_memcpy( wpsie + wpsielen, "Realtek", 7 );
+		wpsielen += 7;
+
+		//	Model Name
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_MODEL_NAME );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0006 );
+		wpsielen += 2;
+
+		//	Value:
+		_rtw_memcpy( wpsie + wpsielen, "8192CU", 6 );
+		wpsielen += 6;
+
+		//	Model Number
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_MODEL_NUMBER );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+		wpsielen += 2;
+
+		//	Value:
+		wpsie[ wpsielen++ ] = 0x31;		//	character 1
+
+		//	Serial Number
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_SERIAL_NUMBER );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( ETH_ALEN );
+		wpsielen += 2;
+
+		//	Value:
+		_rtw_memcpy( wpsie + wpsielen, "123456" , ETH_ALEN );
+		wpsielen += ETH_ALEN;
+
+		//	Primary Device Type
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_PRIMARY_DEV_TYPE );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0008 );
+		wpsielen += 2;
+
+		//	Value:
+		//	Category ID
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_PDT_CID_RTK_WIDI );
+		wpsielen += 2;
+
+		//	OUI
+		*(u32*) ( wpsie + wpsielen ) = cpu_to_be32( WPSOUI );
+		wpsielen += 4;
+
+		//	Sub Category ID
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_PDT_SCID_RTK_DMP );
+		wpsielen += 2;
+
+		//	Device Name
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( pwdinfo->device_name_len );
+		wpsielen += 2;
+
+		//	Value:
+		_rtw_memcpy( wpsie + wpsielen, pwdinfo->device_name, pwdinfo->device_name_len );
+		wpsielen += pwdinfo->device_name_len;
+
+		//	Config Method
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_CONF_METHOD );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0002 );
+		wpsielen += 2;
+
+		//	Value:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( pwdinfo->supported_wps_cm );
+		wpsielen += 2;
+
+
+		pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, wpsielen, (unsigned char *) wpsie, &pattrib->pktlen );
+
+
+		p2pielen = build_probe_resp_p2p_ie(pwdinfo, pframe);
+		pframe += p2pielen;
+		pattrib->pktlen += p2pielen;
+	}
+
+#ifdef CONFIG_WFD
+#ifdef CONFIG_IOCTL_CFG80211
+	if ( _TRUE == pwdinfo->wfd_info->wfd_enable )
+#endif //CONFIG_IOCTL_CFG80211
+	{
+		wfdielen = build_probe_resp_wfd_ie(pwdinfo, pframe, 0);
+		pframe += wfdielen;
+		pattrib->pktlen += wfdielen;
+	}
+#ifdef CONFIG_IOCTL_CFG80211
+	else if (pmlmepriv->wfd_probe_resp_ie != NULL && pmlmepriv->wfd_probe_resp_ie_len>0)
+	{
+		//WFD IE
+		_rtw_memcpy(pframe, pmlmepriv->wfd_probe_resp_ie, pmlmepriv->wfd_probe_resp_ie_len);
+		pattrib->pktlen += pmlmepriv->wfd_probe_resp_ie_len;
+		pframe += pmlmepriv->wfd_probe_resp_ie_len;
+	}
+#endif //CONFIG_IOCTL_CFG80211
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+
+}
+
+int _issue_probereq_p2p(_adapter *padapter, u8 *da, int wait_ack)
+{
+	int ret = _FAIL;
+	struct xmit_frame		*pmgntframe;
+	struct pkt_attrib		*pattrib;
+	unsigned char			*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short		*fctrl;
+	unsigned char			*mac;
+	unsigned char			bssrate[NumRates];
+	struct xmit_priv		*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	int	bssrate_len = 0;
+	u8	bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+	u8					wpsie[255] = { 0x00 }, p2pie[ 255 ] = { 0x00 };
+	u16					wpsielen = 0, p2pielen = 0;
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		goto exit;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	mac = myid(&(padapter->eeprompriv));
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	if (da) {
+		_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+		_rtw_memcpy(pwlanhdr->addr3, da, ETH_ALEN);
+	} else {
+		if ( ( pwdinfo->p2p_info.scan_op_ch_only ) || ( pwdinfo->rx_invitereq_info.scan_op_ch_only ) )
+		{
+			//	This two flags will be set when this is only the P2P client mode.
+			_rtw_memcpy(pwlanhdr->addr1, pwdinfo->p2p_peer_interface_addr, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr3, pwdinfo->p2p_peer_interface_addr, ETH_ALEN);
+		}
+		else
+		{
+			//	broadcast probe request frame
+			_rtw_memcpy(pwlanhdr->addr1, bc_addr, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr3, bc_addr, ETH_ALEN);
+		}
+	}
+	_rtw_memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_PROBEREQ);
+
+	pframe += sizeof (struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof (struct rtw_ieee80211_hdr_3addr);
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_TX_PROVISION_DIS_REQ))
+	{
+		pframe = rtw_set_ie(pframe, _SSID_IE_, pwdinfo->tx_prov_disc_info.ssid.SsidLength, pwdinfo->tx_prov_disc_info.ssid.Ssid, &(pattrib->pktlen));
+	}
+	else
+	{
+		pframe = rtw_set_ie(pframe, _SSID_IE_, P2P_WILDCARD_SSID_LEN, pwdinfo->p2p_wildcard_ssid, &(pattrib->pktlen));
+	}
+	//	Use the OFDM rate in the P2P probe request frame. ( 6(B), 9(B), 12(B), 24(B), 36, 48, 54 )
+	pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, pwdinfo->support_rate, &pattrib->pktlen);
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if(wdev_to_priv(padapter->rtw_wdev)->p2p_enabled && pwdinfo->driver_interface == DRIVER_CFG80211 )
+	{
+		if( pmlmepriv->wps_probe_req_ie != NULL && pmlmepriv->p2p_probe_req_ie != NULL )
+		{
+			//WPS IE
+			_rtw_memcpy(pframe, pmlmepriv->wps_probe_req_ie, pmlmepriv->wps_probe_req_ie_len);
+			pattrib->pktlen += pmlmepriv->wps_probe_req_ie_len;
+			pframe += pmlmepriv->wps_probe_req_ie_len;
+
+			//P2P IE
+			_rtw_memcpy(pframe, pmlmepriv->p2p_probe_req_ie, pmlmepriv->p2p_probe_req_ie_len);
+			pattrib->pktlen += pmlmepriv->p2p_probe_req_ie_len;
+			pframe += pmlmepriv->p2p_probe_req_ie_len;
+		}
+	}
+	else
+#endif //CONFIG_IOCTL_CFG80211
+	{
+
+		//	WPS IE
+		//	Noted by Albert 20110221
+		//	According to the WPS specification, all the WPS attribute is presented by Big Endian.
+
+		wpsielen = 0;
+		//	WPS OUI
+		*(u32*) ( wpsie ) = cpu_to_be32( WPSOUI );
+		wpsielen += 4;
+
+		//	WPS version
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_VER1 );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+		wpsielen += 2;
+
+		//	Value:
+		wpsie[wpsielen++] = WPS_VERSION_1;	//	Version 1.0
+
+		if( pmlmepriv->wps_probe_req_ie == NULL )
+		{
+			//	UUID-E
+			//	Type:
+			*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_UUID_E );
+			wpsielen += 2;
+
+			//	Length:
+			*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0010 );
+			wpsielen += 2;
+
+			//	Value:
+			if (pwdinfo->external_uuid == 0) {
+				_rtw_memset( wpsie + wpsielen, 0x0, 16 );
+				_rtw_memcpy( wpsie + wpsielen, myid( &padapter->eeprompriv ), ETH_ALEN );
+			} else {
+				_rtw_memcpy( wpsie + wpsielen, pwdinfo->uuid, 0x10 );
+			}
+			wpsielen += 0x10;
+
+			//	Config Method
+			//	Type:
+			*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_CONF_METHOD );
+			wpsielen += 2;
+
+			//	Length:
+			*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0002 );
+			wpsielen += 2;
+
+			//	Value:
+			*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( pwdinfo->supported_wps_cm );
+			wpsielen += 2;
+		}
+
+		//	Device Name
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( pwdinfo->device_name_len );
+		wpsielen += 2;
+
+		//	Value:
+		_rtw_memcpy( wpsie + wpsielen, pwdinfo->device_name, pwdinfo->device_name_len );
+		wpsielen += pwdinfo->device_name_len;
+
+		//	Primary Device Type
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_PRIMARY_DEV_TYPE );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0008 );
+		wpsielen += 2;
+
+		//	Value:
+		//	Category ID
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_PDT_CID_MULIT_MEDIA );
+		wpsielen += 2;
+
+		//	OUI
+		*(u32*) ( wpsie + wpsielen ) = cpu_to_be32( WPSOUI );
+		wpsielen += 4;
+
+		//	Sub Category ID
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_PDT_SCID_MEDIA_SERVER );
+		wpsielen += 2;
+
+		//	Device Password ID
+		//	Type:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_DEVICE_PWID );
+		wpsielen += 2;
+
+		//	Length:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0002 );
+		wpsielen += 2;
+
+		//	Value:
+		*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_DPID_REGISTRAR_SPEC );	//	Registrar-specified
+		wpsielen += 2;
+
+		pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, wpsielen, (unsigned char *) wpsie, &pattrib->pktlen );
+
+		//	P2P OUI
+		p2pielen = 0;
+		p2pie[ p2pielen++ ] = 0x50;
+		p2pie[ p2pielen++ ] = 0x6F;
+		p2pie[ p2pielen++ ] = 0x9A;
+		p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+		//	Commented by Albert 20110221
+		//	According to the P2P Specification, the probe request frame should contain 5 P2P attributes
+		//	1. P2P Capability
+		//	2. P2P Device ID if this probe request wants to find the specific P2P device
+		//	3. Listen Channel
+		//	4. Extended Listen Timing
+		//	5. Operating Channel if this WiFi is working as the group owner now
+
+		//	P2P Capability
+		//	Type:
+		p2pie[ p2pielen++ ] = P2P_ATTR_CAPABILITY;
+
+		//	Length:
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+		p2pielen += 2;
+
+		//	Value:
+		//	Device Capability Bitmap, 1 byte
+		p2pie[ p2pielen++ ] = DMP_P2P_DEVCAP_SUPPORT;
+
+		//	Group Capability Bitmap, 1 byte
+		if ( pwdinfo->persistent_supported )
+			p2pie[ p2pielen++ ] = P2P_GRPCAP_PERSISTENT_GROUP | DMP_P2P_GRPCAP_SUPPORT;
+		else
+			p2pie[ p2pielen++ ] = DMP_P2P_GRPCAP_SUPPORT;
+
+		//	Listen Channel
+		//	Type:
+		p2pie[ p2pielen++ ] = P2P_ATTR_LISTEN_CH;
+
+		//	Length:
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0005 );
+		p2pielen += 2;
+
+		//	Value:
+		//	Country String
+		p2pie[ p2pielen++ ] = 'X';
+		p2pie[ p2pielen++ ] = 'X';
+
+		//	The third byte should be set to 0x04.
+		//	Described in the "Operating Channel Attribute" section.
+		p2pie[ p2pielen++ ] = 0x04;
+
+		//	Operating Class
+		p2pie[ p2pielen++ ] = 0x51;	//	Copy from SD7
+
+		//	Channel Number
+		p2pie[ p2pielen++ ] = pwdinfo->listen_channel;	//	listen channel
+
+
+		//	Extended Listen Timing
+		//	Type:
+		p2pie[ p2pielen++ ] = P2P_ATTR_EX_LISTEN_TIMING;
+
+		//	Length:
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0004 );
+		p2pielen += 2;
+
+		//	Value:
+		//	Availability Period
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0xFFFF );
+		p2pielen += 2;
+
+		//	Availability Interval
+		*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0xFFFF );
+		p2pielen += 2;
+
+		if ( rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO) )
+		{
+			//	Operating Channel (if this WiFi is working as the group owner now)
+			//	Type:
+			p2pie[ p2pielen++ ] = P2P_ATTR_OPERATING_CH;
+
+			//	Length:
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0005 );
+			p2pielen += 2;
+
+			//	Value:
+			//	Country String
+			p2pie[ p2pielen++ ] = 'X';
+			p2pie[ p2pielen++ ] = 'X';
+
+			//	The third byte should be set to 0x04.
+			//	Described in the "Operating Channel Attribute" section.
+			p2pie[ p2pielen++ ] = 0x04;
+
+			//	Operating Class
+			p2pie[ p2pielen++ ] = 0x51;	//	Copy from SD7
+
+			//	Channel Number
+			p2pie[ p2pielen++ ] = pwdinfo->operating_channel;	//	operating channel number
+
+		}
+
+		pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &pattrib->pktlen );
+
+		if( pmlmepriv->wps_probe_req_ie != NULL )
+		{
+			//WPS IE
+			_rtw_memcpy(pframe, pmlmepriv->wps_probe_req_ie, pmlmepriv->wps_probe_req_ie_len);
+			pattrib->pktlen += pmlmepriv->wps_probe_req_ie_len;
+			pframe += pmlmepriv->wps_probe_req_ie_len;
+		}
+	}
+
+#ifdef CONFIG_WFD
+#ifdef CONFIG_IOCTL_CFG80211
+	if ( _TRUE == pwdinfo->wfd_info->wfd_enable )
+#endif
+	{
+		wfdielen = build_probe_req_wfd_ie(pwdinfo, pframe);
+		pframe += wfdielen;
+		pattrib->pktlen += wfdielen;
+	}
+#ifdef CONFIG_IOCTL_CFG80211
+	else if (pmlmepriv->wfd_probe_req_ie != NULL && pmlmepriv->wfd_probe_req_ie_len>0)
+	{
+		//WFD IE
+		_rtw_memcpy(pframe, pmlmepriv->wfd_probe_req_ie, pmlmepriv->wfd_probe_req_ie_len);
+		pattrib->pktlen += pmlmepriv->wfd_probe_req_ie_len;
+		pframe += pmlmepriv->wfd_probe_req_ie_len;
+	}
+#endif //CONFIG_IOCTL_CFG80211
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("issuing probe_req, tx_len=%d\n", pattrib->last_txcmdsz));
+
+	if (wait_ack) {
+		ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
+	} else {
+		dump_mgntframe(padapter, pmgntframe);
+		ret = _SUCCESS;
+	}
+
+exit:
+	return ret;
+}
+
+inline void issue_probereq_p2p(_adapter *adapter, u8 *da)
+{
+	_issue_probereq_p2p(adapter, da, _FALSE);
+}
+
+int issue_probereq_p2p_ex(_adapter *adapter, u8 *da, int try_cnt, int wait_ms)
+{
+	int ret;
+	int i = 0;
+	u32 start = rtw_get_current_time();
+
+	do
+	{
+		ret = _issue_probereq_p2p(adapter, da, wait_ms>0?_TRUE:_FALSE);
+
+		i++;
+
+		if (adapter->bDriverStopped || adapter->bSurpriseRemoved)
+			break;
+
+		if(i < try_cnt && wait_ms > 0 && ret==_FAIL)
+			rtw_msleep_os(wait_ms);
+
+	}while((i<try_cnt) && ((ret==_FAIL)||(wait_ms==0)));
+
+	if (ret != _FAIL) {
+		ret = _SUCCESS;
+		#ifndef DBG_XMIT_ACK
+		goto exit;
+		#endif
+	}
+
+	if (try_cnt && wait_ms) {
+		if (da)
+			DBG_871X(FUNC_ADPT_FMT" to "MAC_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(adapter), MAC_ARG(da), rtw_get_oper_ch(adapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+		else
+			DBG_871X(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(adapter), rtw_get_oper_ch(adapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+	}
+exit:
+	return ret;
+}
+
+#endif //CONFIG_P2P
+
+s32 rtw_action_public_decache(union recv_frame *recv_frame, s32 token)
+{
+	_adapter *adapter = recv_frame->u.hdr.adapter;
+	struct mlme_ext_priv *mlmeext = &(adapter->mlmeextpriv);
+	u8 *frame = recv_frame->u.hdr.rx_data;
+	u16 seq_ctrl = ( (recv_frame->u.hdr.attrib.seq_num&0xffff) << 4) |
+		(recv_frame->u.hdr.attrib.frag_num & 0xf);
+
+	if (GetRetry(frame)) {
+		if (token >= 0) {
+			if ((seq_ctrl == mlmeext->action_public_rxseq)
+				&& (token == mlmeext->action_public_dialog_token))
+			{
+				DBG_871X(FUNC_ADPT_FMT" seq_ctrl=0x%x, rxseq=0x%x, token:%d\n",
+					FUNC_ADPT_ARG(adapter), seq_ctrl, mlmeext->action_public_rxseq, token);
+				return _FAIL;
+			}
+		} else {
+			if (seq_ctrl == mlmeext->action_public_rxseq) {
+				DBG_871X(FUNC_ADPT_FMT" seq_ctrl=0x%x, rxseq=0x%x\n",
+					FUNC_ADPT_ARG(adapter), seq_ctrl, mlmeext->action_public_rxseq);
+				return _FAIL;
+			}
+		}
+	}
+
+	mlmeext->action_public_rxseq = seq_ctrl;
+
+	if (token >= 0)
+		mlmeext->action_public_dialog_token = token;
+
+	return _SUCCESS;
+}
+
+unsigned int on_action_public_p2p(union recv_frame *precv_frame)
+{
+	_adapter *padapter = precv_frame->u.hdr.adapter;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint len = precv_frame->u.hdr.len;
+	u8 *frame_body;
+	u8 dialogToken=0;
+#ifdef CONFIG_P2P
+	u8 *p2p_ie;
+	u32	p2p_ielen, wps_ielen;
+	struct	wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+	u8	result = P2P_STATUS_SUCCESS;
+	u8	empty_addr[ETH_ALEN] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+	u8 *merged_p2pie = NULL;
+	u32 merged_p2p_ielen = 0;
+#endif //CONFIG_P2P
+
+	frame_body = (unsigned char *)(pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
+
+	dialogToken = frame_body[7];
+
+	if (rtw_action_public_decache(precv_frame, dialogToken) == _FAIL)
+		return _FAIL;
+
+#ifdef CONFIG_P2P
+	_cancel_timer_ex( &pwdinfo->reset_ch_sitesurvey );
+#ifdef CONFIG_IOCTL_CFG80211
+	if(wdev_to_priv(padapter->rtw_wdev)->p2p_enabled && pwdinfo->driver_interface == DRIVER_CFG80211)
+	{
+		rtw_cfg80211_rx_p2p_action_public(padapter, pframe, len);
+	}
+	else
+#endif //CONFIG_IOCTL_CFG80211
+	{
+		//	Do nothing if the driver doesn't enable the P2P function.
+		if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE) || rtw_p2p_chk_state(pwdinfo, P2P_STATE_IDLE))
+			return _SUCCESS;
+
+		len -= sizeof(struct rtw_ieee80211_hdr_3addr);
+
+		switch( frame_body[ 6 ] )//OUI Subtype
+		{
+			case P2P_GO_NEGO_REQ:
+			{
+				DBG_871X( "[%s] Got GO Nego Req Frame\n", __FUNCTION__);
+				_rtw_memset( &pwdinfo->groupid_info, 0x00, sizeof( struct group_id_info ) );
+
+				if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_RX_PROVISION_DIS_REQ))
+				{
+					rtw_p2p_set_state(pwdinfo, rtw_p2p_pre_state(pwdinfo));
+				}
+
+				if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_FAIL))
+				{
+					//	Commented by Albert 20110526
+					//	In this case, this means the previous nego fail doesn't be reset yet.
+					_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+					//	Restore the previous p2p state
+					rtw_p2p_set_state(pwdinfo, rtw_p2p_pre_state(pwdinfo));
+					DBG_871X( "[%s] Restore the previous p2p state to %d\n", __FUNCTION__, rtw_p2p_state(pwdinfo) );
+				}
+#ifdef CONFIG_CONCURRENT_MODE
+				if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+				{
+					_cancel_timer_ex( &pwdinfo->ap_p2p_switch_timer );
+				}
+#endif // CONFIG_CONCURRENT_MODE
+
+				//	Commented by Kurt 20110902
+				//Add if statement to avoid receiving duplicate prov disc req. such that pre_p2p_state would be covered.
+				if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_ING))
+					rtw_p2p_set_pre_state(pwdinfo, rtw_p2p_state(pwdinfo));
+
+				//	Commented by Kurt 20120113
+				//	Get peer_dev_addr here if peer doesn't issue prov_disc frame.
+				if( _rtw_memcmp(pwdinfo->rx_prov_disc_info.peerDevAddr, empty_addr, ETH_ALEN) )
+					_rtw_memcpy(pwdinfo->rx_prov_disc_info.peerDevAddr, GetAddr2Ptr(pframe), ETH_ALEN);
+
+				result = process_p2p_group_negotation_req( pwdinfo, frame_body, len );
+				issue_p2p_GO_response( padapter, GetAddr2Ptr(pframe), frame_body, len, result );
+#ifdef CONFIG_INTEL_WIDI
+				if( (padapter->mlmepriv.widi_state == INTEL_WIDI_STATE_LISTEN) && (padapter->mlmepriv.widi_state != INTEL_WIDI_STATE_WFD_CONNECTION) )
+				{
+					padapter->mlmepriv.widi_state = INTEL_WIDI_STATE_WFD_CONNECTION;
+					_cancel_timer_ex(&(padapter->mlmepriv.listen_timer));
+					intel_widi_wk_cmd(padapter, INTEL_WIDI_LISTEN_STOP_WK, NULL);
+				}
+#endif //CONFIG_INTEL_WIDI
+
+				//	Commented by Albert 20110718
+				//	No matter negotiating or negotiation failure, the driver should set up the restore P2P state timer.
+#ifdef CONFIG_CONCURRENT_MODE
+				//	Commented by Albert 20120107
+				_set_timer( &pwdinfo->restore_p2p_state_timer, 3000 );
+#else // CONFIG_CONCURRENT_MODE
+				_set_timer( &pwdinfo->restore_p2p_state_timer, 5000 );
+#endif // CONFIG_CONCURRENT_MODE
+				break;
+			}
+			case P2P_GO_NEGO_RESP:
+			{
+				DBG_871X( "[%s] Got GO Nego Resp Frame\n", __FUNCTION__);
+
+				if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_ING))
+				{
+					//	Commented by Albert 20110425
+					//	The restore timer is enabled when issuing the nego request frame of rtw_p2p_connect function.
+					_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+					pwdinfo->nego_req_info.benable = _FALSE;
+					result = process_p2p_group_negotation_resp( pwdinfo, frame_body, len);
+					issue_p2p_GO_confirm( pwdinfo->padapter, GetAddr2Ptr(pframe), result);
+					if ( P2P_STATUS_SUCCESS == result )
+					{
+						if ( rtw_p2p_role(pwdinfo) == P2P_ROLE_CLIENT )
+						{
+							pwdinfo->p2p_info.operation_ch[ 0 ] = pwdinfo->peer_operating_ch;
+							#ifdef P2P_OP_CHECK_SOCIAL_CH
+							pwdinfo->p2p_info.operation_ch[ 1 ] = 1;	//Check whether GO is operating in channel 1;
+							pwdinfo->p2p_info.operation_ch[ 2 ] = 6;	//Check whether GO is operating in channel 6;
+							pwdinfo->p2p_info.operation_ch[ 3 ] = 11;	//Check whether GO is operating in channel 11;
+							#endif //P2P_OP_CHECK_SOCIAL_CH
+							pwdinfo->p2p_info.scan_op_ch_only = 1;
+							_set_timer( &pwdinfo->reset_ch_sitesurvey2, P2P_RESET_SCAN_CH );
+						}
+					}
+
+					//	Reset the dialog token for group negotiation frames.
+					pwdinfo->negotiation_dialog_token = 1;
+
+					if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_FAIL))
+					{
+						_set_timer( &pwdinfo->restore_p2p_state_timer, 5000 );
+					}
+				}
+				else
+				{
+					DBG_871X( "[%s] Skipped GO Nego Resp Frame (p2p_state != P2P_STATE_GONEGO_ING)\n", __FUNCTION__);
+				}
+
+				break;
+			}
+			case P2P_GO_NEGO_CONF:
+			{
+				DBG_871X( "[%s] Got GO Nego Confirm Frame\n", __FUNCTION__);
+				result = process_p2p_group_negotation_confirm( pwdinfo, frame_body, len);
+				if ( P2P_STATUS_SUCCESS == result )
+				{
+					if ( rtw_p2p_role(pwdinfo) == P2P_ROLE_CLIENT )
+					{
+						pwdinfo->p2p_info.operation_ch[ 0 ] = pwdinfo->peer_operating_ch;
+						#ifdef P2P_OP_CHECK_SOCIAL_CH
+						pwdinfo->p2p_info.operation_ch[ 1 ] = 1;	//Check whether GO is operating in channel 1;
+						pwdinfo->p2p_info.operation_ch[ 2 ] = 6;	//Check whether GO is operating in channel 6;
+						pwdinfo->p2p_info.operation_ch[ 3 ] = 11;	//Check whether GO is operating in channel 11;
+						#endif //P2P_OP_CHECK_SOCIAL_CH
+						pwdinfo->p2p_info.scan_op_ch_only = 1;
+						_set_timer( &pwdinfo->reset_ch_sitesurvey2, P2P_RESET_SCAN_CH );
+					}
+				}
+				break;
+			}
+			case P2P_INVIT_REQ:
+			{
+				//	Added by Albert 2010/10/05
+				//	Received the P2P Invite Request frame.
+
+				DBG_871X( "[%s] Got invite request frame!\n", __FUNCTION__ );
+				if ( (p2p_ie=rtw_get_p2p_ie( frame_body + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_, NULL, &p2p_ielen)) )
+				{
+					//	Parse the necessary information from the P2P Invitation Request frame.
+					//	For example: The MAC address of sending this P2P Invitation Request frame.
+					u32	attr_contentlen = 0;
+					u8	status_code = P2P_STATUS_FAIL_INFO_UNAVAILABLE;
+					struct group_id_info group_id;
+					u8	invitation_flag = 0;
+
+					merged_p2p_ielen = rtw_get_p2p_merged_ies_len(frame_body + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_);
+
+					merged_p2pie = rtw_malloc(merged_p2p_ielen);
+					if (merged_p2pie == NULL)
+					{
+						DBG_871X( "[%s] Malloc p2p ie fail\n", __FUNCTION__);
+						goto exit;
+					}
+					_rtw_memset(merged_p2pie, 0x00, merged_p2p_ielen);
+
+					merged_p2p_ielen = rtw_p2p_merge_ies(frame_body + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_, merged_p2pie);
+
+					rtw_get_p2p_attr_content( merged_p2pie, merged_p2p_ielen, P2P_ATTR_INVITATION_FLAGS, &invitation_flag, &attr_contentlen);
+					if ( attr_contentlen )
+					{
+
+						rtw_get_p2p_attr_content( merged_p2pie, merged_p2p_ielen, P2P_ATTR_GROUP_BSSID, pwdinfo->p2p_peer_interface_addr, &attr_contentlen);
+						//	Commented by Albert 20120510
+						//	Copy to the pwdinfo->p2p_peer_interface_addr.
+						//	So that the WFD UI ( or Sigma ) can get the peer interface address by using the following command.
+						//	#> iwpriv wlan0 p2p_get peer_ifa
+						//	After having the peer interface address, the sigma can find the correct conf file for wpa_supplicant.
+
+						if ( attr_contentlen )
+						{
+							DBG_871X( "[%s] GO's BSSID = %.2X %.2X %.2X %.2X %.2X %.2X\n", __FUNCTION__,
+									pwdinfo->p2p_peer_interface_addr[0], pwdinfo->p2p_peer_interface_addr[1],
+									pwdinfo->p2p_peer_interface_addr[2], pwdinfo->p2p_peer_interface_addr[3],
+									pwdinfo->p2p_peer_interface_addr[4], pwdinfo->p2p_peer_interface_addr[5] );
+						}
+
+						if ( invitation_flag & P2P_INVITATION_FLAGS_PERSISTENT )
+						{
+							//	Re-invoke the persistent group.
+
+							_rtw_memset( &group_id, 0x00, sizeof( struct group_id_info ) );
+							rtw_get_p2p_attr_content( merged_p2pie, merged_p2p_ielen, P2P_ATTR_GROUP_ID, ( u8* ) &group_id, &attr_contentlen);
+							if ( attr_contentlen )
+							{
+								if ( _rtw_memcmp( group_id.go_device_addr, myid( &padapter->eeprompriv ), ETH_ALEN ) )
+								{
+									//	The p2p device sending this p2p invitation request wants this Wi-Fi device to be the persistent GO.
+									rtw_p2p_set_state(pwdinfo, P2P_STATE_RECV_INVITE_REQ_GO );
+									rtw_p2p_set_role( pwdinfo, P2P_ROLE_GO );
+									status_code = P2P_STATUS_SUCCESS;
+								}
+								else
+								{
+									//	The p2p device sending this p2p invitation request wants to be the persistent GO.
+									if ( is_matched_in_profilelist( pwdinfo->p2p_peer_interface_addr, &pwdinfo->profileinfo[ 0 ] ) )
+									{
+										u8 operatingch_info[5] = { 0x00 };
+
+										if ( rtw_get_p2p_attr_content(merged_p2pie, merged_p2p_ielen, P2P_ATTR_OPERATING_CH, operatingch_info, &attr_contentlen) )
+										{
+											if( rtw_ch_set_search_ch(padapter->mlmeextpriv.channel_set, (u32)operatingch_info[4] ) >= 0 )
+											{
+												//	The operating channel is acceptable for this device.
+												pwdinfo->rx_invitereq_info.operation_ch[0]= operatingch_info[4];
+												#ifdef P2P_OP_CHECK_SOCIAL_CH
+												pwdinfo->rx_invitereq_info.operation_ch[1]= 1;		//Check whether GO is operating in channel 1;
+												pwdinfo->rx_invitereq_info.operation_ch[2]= 6;		//Check whether GO is operating in channel 6;
+												pwdinfo->rx_invitereq_info.operation_ch[3]= 11;		//Check whether GO is operating in channel 11;
+												#endif //P2P_OP_CHECK_SOCIAL_CH
+												pwdinfo->rx_invitereq_info.scan_op_ch_only = 1;
+												_set_timer( &pwdinfo->reset_ch_sitesurvey, P2P_RESET_SCAN_CH );
+												rtw_p2p_set_state(pwdinfo, P2P_STATE_RECV_INVITE_REQ_MATCH );
+												rtw_p2p_set_role( pwdinfo, P2P_ROLE_CLIENT );
+												status_code = P2P_STATUS_SUCCESS;
+											}
+											else
+											{
+												//	The operating channel isn't supported by this device.
+												rtw_p2p_set_state(pwdinfo, P2P_STATE_RECV_INVITE_REQ_DISMATCH );
+												rtw_p2p_set_role( pwdinfo, P2P_ROLE_DEVICE );
+												status_code = P2P_STATUS_FAIL_NO_COMMON_CH;
+												_set_timer( &pwdinfo->restore_p2p_state_timer, 3000 );
+											}
+										}
+										else
+										{
+											//	Commented by Albert 20121130
+											//	Intel will use the different P2P IE to store the operating channel information
+											//	Workaround for Intel WiDi 3.5
+											rtw_p2p_set_state(pwdinfo, P2P_STATE_RECV_INVITE_REQ_MATCH );
+											rtw_p2p_set_role( pwdinfo, P2P_ROLE_CLIENT );
+											status_code = P2P_STATUS_SUCCESS;
+										}
+									}
+									else
+									{
+										rtw_p2p_set_state(pwdinfo, P2P_STATE_RECV_INVITE_REQ_DISMATCH );
+										#ifdef CONFIG_INTEL_WIDI
+										_rtw_memcpy( pwdinfo->p2p_peer_device_addr, group_id.go_device_addr , ETH_ALEN );
+										rtw_p2p_set_role( pwdinfo, P2P_ROLE_CLIENT );
+										#endif //CONFIG_INTEL_WIDI
+
+										status_code = P2P_STATUS_FAIL_UNKNOWN_P2PGROUP;
+									}
+								}
+							}
+							else
+							{
+								DBG_871X( "[%s] P2P Group ID Attribute NOT FOUND!\n", __FUNCTION__ );
+								status_code = P2P_STATUS_FAIL_INFO_UNAVAILABLE;
+							}
+						}
+						else
+						{
+							//	Received the invitation to join a P2P group.
+
+							_rtw_memset( &group_id, 0x00, sizeof( struct group_id_info ) );
+							rtw_get_p2p_attr_content( merged_p2pie, merged_p2p_ielen, P2P_ATTR_GROUP_ID, ( u8* ) &group_id, &attr_contentlen);
+							if ( attr_contentlen )
+							{
+								if ( _rtw_memcmp( group_id.go_device_addr, myid( &padapter->eeprompriv ), ETH_ALEN ) )
+								{
+									//	In this case, the GO can't be myself.
+									rtw_p2p_set_state(pwdinfo, P2P_STATE_RECV_INVITE_REQ_DISMATCH );
+									status_code = P2P_STATUS_FAIL_INFO_UNAVAILABLE;
+								}
+								else
+								{
+									//	The p2p device sending this p2p invitation request wants to join an existing P2P group
+									//	Commented by Albert 2012/06/28
+									//	In this case, this Wi-Fi device should use the iwpriv command to get the peer device address.
+									//	The peer device address should be the destination address for the provisioning discovery request.
+									//	Then, this Wi-Fi device should use the iwpriv command to get the peer interface address.
+									//	The peer interface address should be the address for WPS mac address
+									_rtw_memcpy( pwdinfo->p2p_peer_device_addr, group_id.go_device_addr , ETH_ALEN );
+									rtw_p2p_set_role( pwdinfo, P2P_ROLE_CLIENT );
+									rtw_p2p_set_state(pwdinfo, P2P_STATE_RECV_INVITE_REQ_JOIN );
+									status_code = P2P_STATUS_SUCCESS;
+								}
+							}
+							else
+							{
+								DBG_871X( "[%s] P2P Group ID Attribute NOT FOUND!\n", __FUNCTION__ );
+								status_code = P2P_STATUS_FAIL_INFO_UNAVAILABLE;
+							}
+						}
+					}
+					else
+					{
+						DBG_871X( "[%s] P2P Invitation Flags Attribute NOT FOUND!\n", __FUNCTION__ );
+						status_code = P2P_STATUS_FAIL_INFO_UNAVAILABLE;
+					}
+
+					DBG_871X( "[%s] status_code = %d\n", __FUNCTION__, status_code );
+
+					pwdinfo->inviteresp_info.token = frame_body[ 7 ];
+					issue_p2p_invitation_response( padapter, GetAddr2Ptr(pframe), pwdinfo->inviteresp_info.token, status_code );
+					_set_timer( &pwdinfo->restore_p2p_state_timer, 3000 );
+				}
+#ifdef CONFIG_INTEL_WIDI
+				if( (padapter->mlmepriv.widi_state == INTEL_WIDI_STATE_LISTEN) && (padapter->mlmepriv.widi_state != INTEL_WIDI_STATE_WFD_CONNECTION) )
+				{
+					padapter->mlmepriv.widi_state = INTEL_WIDI_STATE_WFD_CONNECTION;
+					_cancel_timer_ex(&(padapter->mlmepriv.listen_timer));
+					intel_widi_wk_cmd(padapter, INTEL_WIDI_LISTEN_STOP_WK, NULL);
+				}
+#endif //CONFIG_INTEL_WIDI
+				break;
+			}
+			case P2P_INVIT_RESP:
+			{
+				u8	attr_content = 0x00;
+				u32	attr_contentlen = 0;
+
+				DBG_871X( "[%s] Got invite response frame!\n", __FUNCTION__ );
+				_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+				if ( (p2p_ie=rtw_get_p2p_ie( frame_body + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_, NULL, &p2p_ielen)) )
+				{
+					rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_STATUS, &attr_content, &attr_contentlen);
+
+					if ( attr_contentlen == 1 )
+					{
+						DBG_871X( "[%s] Status = %d\n", __FUNCTION__, attr_content );
+						pwdinfo->invitereq_info.benable = _FALSE;
+
+						if ( attr_content == P2P_STATUS_SUCCESS )
+						{
+							if ( _rtw_memcmp( pwdinfo->invitereq_info.go_bssid, myid( &padapter->eeprompriv ), ETH_ALEN ))
+							{
+								rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO );
+							}
+							else
+							{
+								rtw_p2p_set_role(pwdinfo, P2P_ROLE_CLIENT);
+							}
+							rtw_p2p_set_state( pwdinfo, P2P_STATE_RX_INVITE_RESP_OK );
+						}
+						else
+						{
+							rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+							rtw_p2p_set_state( pwdinfo, P2P_STATE_RX_INVITE_RESP_FAIL );
+						}
+					}
+					else
+					{
+						rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+						rtw_p2p_set_state( pwdinfo, P2P_STATE_RX_INVITE_RESP_FAIL );
+					}
+				}
+				else
+				{
+					rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+					rtw_p2p_set_state( pwdinfo, P2P_STATE_RX_INVITE_RESP_FAIL );
+				}
+
+				if ( rtw_p2p_chk_state( pwdinfo, P2P_STATE_RX_INVITE_RESP_FAIL ) )
+				{
+					_set_timer( &pwdinfo->restore_p2p_state_timer, 5000 );
+				}
+				break;
+			}
+			case P2P_DEVDISC_REQ:
+
+				process_p2p_devdisc_req(pwdinfo, pframe, len);
+
+				break;
+
+			case P2P_DEVDISC_RESP:
+
+				process_p2p_devdisc_resp(pwdinfo, pframe, len);
+
+				break;
+
+			case P2P_PROVISION_DISC_REQ:
+				DBG_871X( "[%s] Got Provisioning Discovery Request Frame\n", __FUNCTION__ );
+				process_p2p_provdisc_req(pwdinfo, pframe, len);
+				_rtw_memcpy(pwdinfo->rx_prov_disc_info.peerDevAddr, GetAddr2Ptr(pframe), ETH_ALEN);
+
+				//20110902 Kurt
+				//Add the following statement to avoid receiving duplicate prov disc req. such that pre_p2p_state would be covered.
+				if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_RX_PROVISION_DIS_REQ))
+					rtw_p2p_set_pre_state(pwdinfo, rtw_p2p_state(pwdinfo));
+
+				rtw_p2p_set_state(pwdinfo, P2P_STATE_RX_PROVISION_DIS_REQ);
+				_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_PROVISION_TIMEOUT );
+#ifdef CONFIG_INTEL_WIDI
+				if( (padapter->mlmepriv.widi_state == INTEL_WIDI_STATE_LISTEN) && (padapter->mlmepriv.widi_state != INTEL_WIDI_STATE_WFD_CONNECTION) )
+				{
+					padapter->mlmepriv.widi_state = INTEL_WIDI_STATE_WFD_CONNECTION;
+					_cancel_timer_ex(&(padapter->mlmepriv.listen_timer));
+					intel_widi_wk_cmd(padapter, INTEL_WIDI_LISTEN_STOP_WK, NULL);
+				}
+#endif //CONFIG_INTEL_WIDI
+				break;
+
+			case P2P_PROVISION_DISC_RESP:
+				//	Commented by Albert 20110707
+				//	Should we check the pwdinfo->tx_prov_disc_info.bsent flag here??
+				DBG_871X( "[%s] Got Provisioning Discovery Response Frame\n", __FUNCTION__ );
+				//	Commented by Albert 20110426
+				//	The restore timer is enabled when issuing the provisioing request frame in rtw_p2p_prov_disc function.
+				_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+				rtw_p2p_set_state(pwdinfo, P2P_STATE_RX_PROVISION_DIS_RSP);
+				process_p2p_provdisc_resp(pwdinfo, pframe);
+				_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_PROVISION_TIMEOUT );
+				break;
+
+		}
+	}
+#endif //CONFIG_P2P
+
+exit:
+
+	if(merged_p2pie)
+	{
+		rtw_mfree(merged_p2pie, merged_p2p_ielen);
+	}
+
+	return _SUCCESS;
+}
+
+unsigned int on_action_public_vendor(union recv_frame *precv_frame)
+{
+	unsigned int ret = _FAIL;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint frame_len = precv_frame->u.hdr.len;
+	u8 *frame_body = pframe + sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	if (_rtw_memcmp(frame_body + 2, P2P_OUI, 4) == _TRUE) {
+		ret = on_action_public_p2p(precv_frame);
+	}
+
+	return ret;
+}
+
+unsigned int on_action_public_default(union recv_frame *precv_frame, u8 action)
+{
+	unsigned int ret = _FAIL;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint frame_len = precv_frame->u.hdr.len;
+	u8 *frame_body = pframe + sizeof(struct rtw_ieee80211_hdr_3addr);
+	u8 token;
+	_adapter *adapter = precv_frame->u.hdr.adapter;
+	int cnt = 0;
+	char msg[64];
+
+	token = frame_body[2];
+
+	if (rtw_action_public_decache(precv_frame, token) == _FAIL)
+		goto exit;
+
+	#ifdef CONFIG_IOCTL_CFG80211
+	cnt += sprintf((msg+cnt), "%s(token:%u)", action_public_str(action), token);
+	rtw_cfg80211_rx_action(adapter, pframe, frame_len, msg);
+	#endif
+
+	ret = _SUCCESS;
+
+exit:
+	return ret;
+}
+
+unsigned int on_action_public(_adapter *padapter, union recv_frame *precv_frame)
+{
+	unsigned int ret = _FAIL;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint frame_len = precv_frame->u.hdr.len;
+	u8 *frame_body = pframe + sizeof(struct rtw_ieee80211_hdr_3addr);
+	u8 category, action;
+
+	/* check RA matches or not */
+	if (!_rtw_memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))
+		goto exit;
+
+	category = frame_body[0];
+	if(category != RTW_WLAN_CATEGORY_PUBLIC)
+		goto exit;
+
+	action = frame_body[1];
+	switch (action) {
+	case ACT_PUBLIC_VENDOR:
+		ret = on_action_public_vendor(precv_frame);
+		break;
+	default:
+		ret = on_action_public_default(precv_frame, action);
+		break;
+	}
+
+exit:
+	return ret;
+}
+
+unsigned int OnAction_ht(_adapter *padapter, union recv_frame *precv_frame)
+{
+	return _SUCCESS;
+}
+
+#ifdef CONFIG_IEEE80211W
+unsigned int OnAction_sa_query(_adapter *padapter, union recv_frame *precv_frame)
+{
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	unsigned short tid;
+	//Baron
+
+	DBG_871X("OnAction_sa_query\n");
+
+	switch (pframe[WLAN_HDR_A3_LEN+1])
+	{
+		case 0: //SA Query req
+			_rtw_memcpy(&tid, &pframe[WLAN_HDR_A3_LEN+2], sizeof(unsigned short));
+			DBG_871X("OnAction_sa_query request,action=%d, tid=%04x\n", pframe[WLAN_HDR_A3_LEN+1], tid);
+			issue_action_SA_Query(padapter, GetAddr2Ptr(pframe), 1, tid);
+			break;
+
+		case 1: //SA Query rsp
+			_cancel_timer_ex(&pmlmeext->sa_query_timer);
+			DBG_871X("OnAction_sa_query response,action=%d, tid=%04x, cancel timer\n", pframe[WLAN_HDR_A3_LEN+1], pframe[WLAN_HDR_A3_LEN+2]);
+			break;
+		default:
+			break;
+	}
+	if(0)
+	{
+		int pp;
+		printk("pattrib->pktlen = %d =>", pattrib->pkt_len);
+		for(pp=0;pp< pattrib->pkt_len; pp++)
+			printk(" %02x ", pframe[pp]);
+		printk("\n");
+	}
+
+	return _SUCCESS;
+}
+#endif //CONFIG_IEEE80211W
+
+unsigned int OnAction_wmm(_adapter *padapter, union recv_frame *precv_frame)
+{
+	return _SUCCESS;
+}
+
+unsigned int OnAction_p2p(_adapter *padapter, union recv_frame *precv_frame)
+{
+#ifdef CONFIG_P2P
+	u8 *frame_body;
+	u8 category, OUI_Subtype, dialogToken=0;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	uint len = precv_frame->u.hdr.len;
+	struct	wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	//check RA matches or not
+	if (!_rtw_memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))//for if1, sta/ap mode
+		return _SUCCESS;
+
+	frame_body = (unsigned char *)(pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
+
+	category = frame_body[0];
+	if(category != RTW_WLAN_CATEGORY_P2P)
+		return _SUCCESS;
+
+	if ( cpu_to_be32( *( ( u32* ) ( frame_body + 1 ) ) ) != P2POUI )
+		return _SUCCESS;
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if(wdev_to_priv(padapter->rtw_wdev)->p2p_enabled && pwdinfo->driver_interface == DRIVER_CFG80211 )
+	{
+		rtw_cfg80211_rx_action_p2p(padapter, pframe, len);
+		return _SUCCESS;
+	}
+	else
+#endif //CONFIG_IOCTL_CFG80211
+	{
+		len -= sizeof(struct rtw_ieee80211_hdr_3addr);
+		OUI_Subtype = frame_body[5];
+		dialogToken = frame_body[6];
+
+		switch(OUI_Subtype)
+		{
+			case P2P_NOTICE_OF_ABSENCE:
+
+				break;
+
+			case P2P_PRESENCE_REQUEST:
+
+				process_p2p_presence_req(pwdinfo, pframe, len);
+
+				break;
+
+			case P2P_PRESENCE_RESPONSE:
+
+				break;
+
+			case P2P_GO_DISC_REQUEST:
+
+				break;
+
+			default:
+				break;
+
+		}
+	}
+#endif //CONFIG_P2P
+
+	return _SUCCESS;
+
+}
+
+unsigned int OnAction(_adapter *padapter, union recv_frame *precv_frame)
+{
+	int i;
+	unsigned char	category;
+	struct action_handler *ptable;
+	unsigned char	*frame_body;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+
+	frame_body = (unsigned char *)(pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
+
+	category = frame_body[0];
+
+	for(i = 0; i < sizeof(OnAction_tbl)/sizeof(struct action_handler); i++)
+	{
+		ptable = &OnAction_tbl[i];
+
+		if(category == ptable->num)
+			ptable->func(padapter, precv_frame);
+
+	}
+
+	return _SUCCESS;
+
+}
+
+unsigned int DoReserved(_adapter *padapter, union recv_frame *precv_frame)
+{
+
+	//DBG_871X("rcvd mgt frame(%x, %x)\n", (GetFrameSubType(pframe) >> 4), *(unsigned int *)GetAddr1Ptr(pframe));
+	return _SUCCESS;
+}
+
+struct xmit_frame *_alloc_mgtxmitframe(struct xmit_priv *pxmitpriv, bool once)
+{
+	struct xmit_frame *pmgntframe;
+	struct xmit_buf *pxmitbuf;
+
+	if (once)
+		pmgntframe = rtw_alloc_xmitframe_once(pxmitpriv);
+	else
+		pmgntframe = rtw_alloc_xmitframe_ext(pxmitpriv);
+
+	if (pmgntframe == NULL) {
+		DBG_871X(FUNC_ADPT_FMT" alloc xmitframe fail, once:%d\n", FUNC_ADPT_ARG(pxmitpriv->adapter), once);
+		goto exit;
+	}
+
+	if ((pxmitbuf = rtw_alloc_xmitbuf_ext(pxmitpriv)) == NULL) {
+		DBG_871X(FUNC_ADPT_FMT" alloc xmitbuf fail\n", FUNC_ADPT_ARG(pxmitpriv->adapter));
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		pmgntframe = NULL;
+		goto exit;
+	}
+
+	pmgntframe->frame_tag = MGNT_FRAMETAG;
+	pmgntframe->pxmitbuf = pxmitbuf;
+	pmgntframe->buf_addr = pxmitbuf->pbuf;
+	pxmitbuf->priv_data = pmgntframe;
+
+exit:
+	return pmgntframe;
+
+}
+
+inline struct xmit_frame *alloc_mgtxmitframe(struct xmit_priv *pxmitpriv)
+{
+	return _alloc_mgtxmitframe(pxmitpriv, _FALSE);
+}
+
+inline struct xmit_frame *alloc_mgtxmitframe_once(struct xmit_priv *pxmitpriv)
+{
+	return _alloc_mgtxmitframe(pxmitpriv, _TRUE);
+}
+
+
+/****************************************************************************
+
+Following are some TX fuctions for WiFi MLME
+
+*****************************************************************************/
+
+void update_mgnt_tx_rate(_adapter *padapter, u8 rate)
+{
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+
+	pmlmeext->tx_rate = rate;
+
+	//DBG_871X("%s(): rate = %x\n",__FUNCTION__, rate);
+}
+
+void update_mgntframe_attrib(_adapter *padapter, struct pkt_attrib *pattrib)
+{
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+
+	_rtw_memset((u8 *)(pattrib), 0, sizeof(struct pkt_attrib));
+
+	pattrib->hdrlen = 24;
+	pattrib->nr_frags = 1;
+	pattrib->priority = 7;
+	pattrib->mac_id = 0;
+	pattrib->qsel = 0x12;
+
+	pattrib->pktlen = 0;
+
+	if(pmlmeext->cur_wireless_mode & WIRELESS_11B)
+		pattrib->raid = 6;//b mode
+	else
+		pattrib->raid = 5;//a/g mode
+
+	pattrib->encrypt = _NO_PRIVACY_;
+	pattrib->bswenc = _FALSE;
+
+	pattrib->qos_en = _FALSE;
+	pattrib->ht_en = _FALSE;
+	pattrib->bwmode = HT_CHANNEL_WIDTH_20;
+	pattrib->ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+	pattrib->sgi = _FALSE;
+
+	pattrib->seqnum = pmlmeext->mgnt_seq;
+
+	pattrib->retry_ctrl = _TRUE;
+
+}
+
+void dump_mgntframe(_adapter *padapter, struct xmit_frame *pmgntframe)
+{
+	if(padapter->bSurpriseRemoved == _TRUE ||
+		padapter->bDriverStopped == _TRUE)
+	{
+		rtw_free_xmitbuf(&padapter->xmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(&padapter->xmitpriv, pmgntframe);
+		return;
+	}
+
+	rtw_hal_mgnt_xmit(padapter, pmgntframe);
+}
+
+s32 dump_mgntframe_and_wait(_adapter *padapter, struct xmit_frame *pmgntframe, int timeout_ms)
+{
+	s32 ret = _FAIL;
+	_irqL irqL;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+	struct xmit_buf *pxmitbuf = pmgntframe->pxmitbuf;
+	struct submit_ctx sctx;
+
+	if(padapter->bSurpriseRemoved == _TRUE ||
+		padapter->bDriverStopped == _TRUE)
+	{
+		rtw_free_xmitbuf(&padapter->xmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(&padapter->xmitpriv, pmgntframe);
+		return ret;
+	}
+
+	rtw_sctx_init(&sctx, timeout_ms);
+	pxmitbuf->sctx = &sctx;
+
+	ret = rtw_hal_mgnt_xmit(padapter, pmgntframe);
+
+	if (ret == _SUCCESS)
+		ret = rtw_sctx_wait(&sctx);
+
+	_enter_critical(&pxmitpriv->lock_sctx, &irqL);
+	pxmitbuf->sctx = NULL;
+	_exit_critical(&pxmitpriv->lock_sctx, &irqL);
+
+	 return ret;
+}
+
+s32 dump_mgntframe_and_wait_ack(_adapter *padapter, struct xmit_frame *pmgntframe)
+{
+#ifdef CONFIG_XMIT_ACK
+	s32 ret = _FAIL;
+	u32 timeout_ms = 500;//  500ms
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+	#ifdef CONFIG_CONCURRENT_MODE
+	if (padapter->pbuddy_adapter && !padapter->isprimary)
+		pxmitpriv = &(padapter->pbuddy_adapter->xmitpriv);
+	#endif
+
+	if(padapter->bSurpriseRemoved == _TRUE ||
+		padapter->bDriverStopped == _TRUE)
+	{
+		rtw_free_xmitbuf(&padapter->xmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(&padapter->xmitpriv, pmgntframe);
+		return -1;
+	}
+
+	_enter_critical_mutex(&pxmitpriv->ack_tx_mutex, NULL);
+	pxmitpriv->ack_tx = _TRUE;
+
+	pmgntframe->ack_report = 1;
+	if (rtw_hal_mgnt_xmit(padapter, pmgntframe) == _SUCCESS) {
+		ret = rtw_ack_tx_wait(pxmitpriv, timeout_ms);
+	}
+
+	pxmitpriv->ack_tx = _FALSE;
+	_exit_critical_mutex(&pxmitpriv->ack_tx_mutex, NULL);
+
+	 return ret;
+#else //!CONFIG_XMIT_ACK
+	dump_mgntframe(padapter, pmgntframe);
+	rtw_msleep_os(50);
+	return _SUCCESS;
+#endif //!CONFIG_XMIT_ACK
+}
+
+int update_hidden_ssid(u8 *ies, u32 ies_len, u8 hidden_ssid_mode)
+{
+	u8 *ssid_ie;
+	sint ssid_len_ori;
+	int len_diff = 0;
+
+	ssid_ie = rtw_get_ie(ies,  WLAN_EID_SSID, &ssid_len_ori, ies_len);
+
+	//DBG_871X("%s hidden_ssid_mode:%u, ssid_ie:%p, ssid_len_ori:%d\n", __FUNCTION__, hidden_ssid_mode, ssid_ie, ssid_len_ori);
+
+	if(ssid_ie && ssid_len_ori>0)
+	{
+		switch(hidden_ssid_mode)
+		{
+			case 1:
+			{
+				u8 *next_ie = ssid_ie + 2 + ssid_len_ori;
+				u32 remain_len = 0;
+
+				remain_len = ies_len -(next_ie-ies);
+
+				ssid_ie[1] = 0;
+				_rtw_memcpy(ssid_ie+2, next_ie, remain_len);
+				len_diff -= ssid_len_ori;
+
+				break;
+			}
+			case 2:
+				_rtw_memset(&ssid_ie[2], 0, ssid_len_ori);
+				break;
+			default:
+				break;
+		}
+	}
+
+	return len_diff;
+}
+
+void issue_beacon(_adapter *padapter)
+{
+	struct xmit_frame	*pmgntframe;
+	struct pkt_attrib	*pattrib;
+	unsigned char	*pframe;
+	struct rtw_ieee80211_hdr *pwlanhdr;
+	unsigned short *fctrl;
+	unsigned int	rate_len;
+	struct xmit_priv	*pxmitpriv = &(padapter->xmitpriv);
+#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	_irqL irqL;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+#endif //#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+	u8	bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+#endif //CONFIG_P2P
+
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		DBG_871X("%s, alloc mgnt frame fail\n", __FUNCTION__);
+		return;
+	}
+#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	_enter_critical_bh(&pmlmepriv->bcn_update_lock, &irqL);
+#endif //#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+	pattrib->qsel = 0x10;
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, bc_addr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(cur_network), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, 0/*pmlmeext->mgnt_seq*/);
+	//pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_BEACON);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof (struct rtw_ieee80211_hdr_3addr);
+
+	if( (pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
+	{
+		//DBG_871X("ie len=%d\n", cur_network->IELength);
+#ifdef CONFIG_P2P
+		// for P2P : Primary Device Type & Device Name
+		u32 wpsielen=0, insert_len=0;
+		u8 *wpsie=NULL;
+		wpsie = rtw_get_wps_ie(cur_network->IEs+_FIXED_IE_LENGTH_, cur_network->IELength-_FIXED_IE_LENGTH_, NULL, &wpsielen);
+
+		if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO) && wpsie && wpsielen>0)
+		{
+			uint wps_offset, remainder_ielen;
+			u8 *premainder_ie, *pframe_wscie;
+
+			wps_offset = (uint)(wpsie - cur_network->IEs);
+
+			premainder_ie = wpsie + wpsielen;
+
+			remainder_ielen = cur_network->IELength - wps_offset - wpsielen;
+
+#ifdef CONFIG_IOCTL_CFG80211
+			if(wdev_to_priv(padapter->rtw_wdev)->p2p_enabled && pwdinfo->driver_interface == DRIVER_CFG80211 )
+			{
+				if(pmlmepriv->wps_beacon_ie && pmlmepriv->wps_beacon_ie_len>0)
+				{
+					_rtw_memcpy(pframe, cur_network->IEs, wps_offset);
+					pframe += wps_offset;
+					pattrib->pktlen += wps_offset;
+
+					_rtw_memcpy(pframe, pmlmepriv->wps_beacon_ie, pmlmepriv->wps_beacon_ie_len);
+					pframe += pmlmepriv->wps_beacon_ie_len;
+					pattrib->pktlen += pmlmepriv->wps_beacon_ie_len;
+
+					//copy remainder_ie to pframe
+					_rtw_memcpy(pframe, premainder_ie, remainder_ielen);
+					pframe += remainder_ielen;
+					pattrib->pktlen += remainder_ielen;
+				}
+				else
+				{
+					_rtw_memcpy(pframe, cur_network->IEs, cur_network->IELength);
+					pframe += cur_network->IELength;
+					pattrib->pktlen += cur_network->IELength;
+				}
+			}
+			else
+#endif //CONFIG_IOCTL_CFG80211
+			{
+				pframe_wscie = pframe + wps_offset;
+				_rtw_memcpy(pframe, cur_network->IEs, wps_offset+wpsielen);
+				pframe += (wps_offset + wpsielen);
+				pattrib->pktlen += (wps_offset + wpsielen);
+
+				//now pframe is end of wsc ie, insert Primary Device Type & Device Name
+				//	Primary Device Type
+				//	Type:
+				*(u16*) ( pframe + insert_len) = cpu_to_be16( WPS_ATTR_PRIMARY_DEV_TYPE );
+				insert_len += 2;
+
+				//	Length:
+				*(u16*) ( pframe + insert_len ) = cpu_to_be16( 0x0008 );
+				insert_len += 2;
+
+				//	Value:
+				//	Category ID
+				*(u16*) ( pframe + insert_len ) = cpu_to_be16( WPS_PDT_CID_MULIT_MEDIA );
+				insert_len += 2;
+
+				//	OUI
+				*(u32*) ( pframe + insert_len ) = cpu_to_be32( WPSOUI );
+				insert_len += 4;
+
+				//	Sub Category ID
+				*(u16*) ( pframe + insert_len ) = cpu_to_be16( WPS_PDT_SCID_MEDIA_SERVER );
+				insert_len += 2;
+
+
+				//	Device Name
+				//	Type:
+				*(u16*) ( pframe + insert_len ) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+				insert_len += 2;
+
+				//	Length:
+				*(u16*) ( pframe + insert_len ) = cpu_to_be16( pwdinfo->device_name_len );
+				insert_len += 2;
+
+				//	Value:
+				_rtw_memcpy( pframe + insert_len, pwdinfo->device_name, pwdinfo->device_name_len );
+				insert_len += pwdinfo->device_name_len;
+
+
+				//update wsc ie length
+				*(pframe_wscie+1) = (wpsielen -2) + insert_len;
+
+				//pframe move to end
+				pframe+=insert_len;
+				pattrib->pktlen += insert_len;
+
+				//copy remainder_ie to pframe
+				_rtw_memcpy(pframe, premainder_ie, remainder_ielen);
+				pframe += remainder_ielen;
+				pattrib->pktlen += remainder_ielen;
+			}
+		}
+		else
+#endif //CONFIG_P2P
+		{
+			int len_diff;
+			_rtw_memcpy(pframe, cur_network->IEs, cur_network->IELength);
+			len_diff = update_hidden_ssid(
+				pframe+_BEACON_IE_OFFSET_
+				, cur_network->IELength-_BEACON_IE_OFFSET_
+				, pmlmeinfo->hidden_ssid_mode
+			);
+			pframe += (cur_network->IELength+len_diff);
+			pattrib->pktlen += (cur_network->IELength+len_diff);
+		}
+
+		{
+			u8 *wps_ie;
+			uint wps_ielen;
+			u8 sr = 0;
+			wps_ie = rtw_get_wps_ie(pmgntframe->buf_addr+TXDESC_OFFSET+sizeof (struct rtw_ieee80211_hdr_3addr)+_BEACON_IE_OFFSET_,
+				pattrib->pktlen-sizeof (struct rtw_ieee80211_hdr_3addr)-_BEACON_IE_OFFSET_, NULL, &wps_ielen);
+			if (wps_ie && wps_ielen>0) {
+				rtw_get_wps_attr_content(wps_ie,  wps_ielen, WPS_ATTR_SELECTED_REGISTRAR, (u8*)(&sr), NULL);
+			}
+			if (sr != 0)
+				set_fwstate(pmlmepriv, WIFI_UNDER_WPS);
+			else
+				_clr_fwstate_(pmlmepriv, WIFI_UNDER_WPS);
+		}
+
+#ifdef CONFIG_P2P
+		if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+		{
+			u32 len;
+#ifdef CONFIG_IOCTL_CFG80211
+			if(wdev_to_priv(padapter->rtw_wdev)->p2p_enabled && pwdinfo->driver_interface == DRIVER_CFG80211 )
+			{
+				len = pmlmepriv->p2p_beacon_ie_len;
+				if(pmlmepriv->p2p_beacon_ie && len>0)
+					_rtw_memcpy(pframe, pmlmepriv->p2p_beacon_ie, len);
+			}
+			else
+#endif //CONFIG_IOCTL_CFG80211
+			{
+				len = build_beacon_p2p_ie(pwdinfo, pframe);
+			}
+
+			pframe += len;
+			pattrib->pktlen += len;
+#ifdef CONFIG_WFD
+#ifdef CONFIG_IOCTL_CFG80211
+			if(_TRUE == pwdinfo->wfd_info->wfd_enable)
+#endif //CONFIG_IOCTL_CFG80211
+			{
+				len = build_beacon_wfd_ie( pwdinfo, pframe );
+			}
+#ifdef CONFIG_IOCTL_CFG80211
+			else
+			{
+				len = 0;
+				if(pmlmepriv->wfd_beacon_ie && pmlmepriv->wfd_beacon_ie_len>0)
+				{
+					len = pmlmepriv->wfd_beacon_ie_len;
+					_rtw_memcpy(pframe, pmlmepriv->wfd_beacon_ie, len);
+				}
+			}
+#endif //CONFIG_IOCTL_CFG80211
+			pframe += len;
+			pattrib->pktlen += len;
+#endif //CONFIG_WFD
+		}
+#endif //CONFIG_P2P
+
+		goto _issue_bcn;
+
+	}
+
+	//below for ad-hoc mode
+
+	//timestamp will be inserted by hardware
+	pframe += 8;
+	pattrib->pktlen += 8;
+
+	// beacon interval: 2 bytes
+
+	_rtw_memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->IEs)), 2);
+
+	pframe += 2;
+	pattrib->pktlen += 2;
+
+	// capability info: 2 bytes
+
+	_rtw_memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->IEs)), 2);
+
+	pframe += 2;
+	pattrib->pktlen += 2;
+
+	// SSID
+	pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &pattrib->pktlen);
+
+	// supported rates...
+	rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
+	pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, ((rate_len > 8)? 8: rate_len), cur_network->SupportedRates, &pattrib->pktlen);
+
+	// DS parameter set
+	pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &pattrib->pktlen);
+
+	//if( (pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE)
+	{
+		u8 erpinfo=0;
+		u32 ATIMWindow;
+		// IBSS Parameter Set...
+		//ATIMWindow = cur->Configuration.ATIMWindow;
+		ATIMWindow = 0;
+		pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
+
+		//ERP IE
+		pframe = rtw_set_ie(pframe, _ERPINFO_IE_, 1, &erpinfo, &pattrib->pktlen);
+	}
+
+
+	// EXTERNDED SUPPORTED RATE
+	if (rate_len > 8)
+	{
+		pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pattrib->pktlen);
+	}
+
+
+	//todo:HT for adhoc
+
+_issue_bcn:
+
+#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	pmlmepriv->update_bcn = _FALSE;
+
+	_exit_critical_bh(&pmlmepriv->bcn_update_lock, &irqL);
+#endif //#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+
+	if ((pattrib->pktlen + TXDESC_SIZE) > 512)
+	{
+		DBG_871X("beacon frame too large\n");
+		return;
+	}
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	//DBG_871X("issue bcn_sz=%d\n", pattrib->last_txcmdsz);
+
+	dump_mgntframe(padapter, pmgntframe);
+
+}
+
+void issue_probersp(_adapter *padapter, unsigned char *da, u8 is_valid_p2p_probereq)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	unsigned char					*mac, *bssid;
+	struct xmit_priv	*pxmitpriv = &(padapter->xmitpriv);
+#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	u8 *pwps_ie;
+	uint wps_ielen;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+#endif //#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+	unsigned int	rate_len;
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+#endif //CONFIG_P2P
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		DBG_871X("%s, alloc mgnt frame fail\n", __FUNCTION__);
+		return;
+	}
+
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	mac = myid(&(padapter->eeprompriv));
+	bssid = cur_network->MacAddress;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+	_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, bssid, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(fctrl, WIFI_PROBERSP);
+
+	pattrib->hdrlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = pattrib->hdrlen;
+	pframe += pattrib->hdrlen;
+
+
+	if(cur_network->IELength>MAX_IE_SZ)
+		return;
+
+#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	if( (pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
+	{
+		pwps_ie = rtw_get_wps_ie(cur_network->IEs+_FIXED_IE_LENGTH_, cur_network->IELength-_FIXED_IE_LENGTH_, NULL, &wps_ielen);
+
+		//inerset & update wps_probe_resp_ie
+		if((pmlmepriv->wps_probe_resp_ie!=NULL) && pwps_ie && (wps_ielen>0))
+		{
+			uint wps_offset, remainder_ielen;
+			u8 *premainder_ie;
+
+			wps_offset = (uint)(pwps_ie - cur_network->IEs);
+
+			premainder_ie = pwps_ie + wps_ielen;
+
+			remainder_ielen = cur_network->IELength - wps_offset - wps_ielen;
+
+			_rtw_memcpy(pframe, cur_network->IEs, wps_offset);
+			pframe += wps_offset;
+			pattrib->pktlen += wps_offset;
+
+			wps_ielen = (uint)pmlmepriv->wps_probe_resp_ie[1];//to get ie data len
+			if((wps_offset+wps_ielen+2)<=MAX_IE_SZ)
+			{
+				_rtw_memcpy(pframe, pmlmepriv->wps_probe_resp_ie, wps_ielen+2);
+				pframe += wps_ielen+2;
+				pattrib->pktlen += wps_ielen+2;
+			}
+
+			if((wps_offset+wps_ielen+2+remainder_ielen)<=MAX_IE_SZ)
+			{
+				_rtw_memcpy(pframe, premainder_ie, remainder_ielen);
+				pframe += remainder_ielen;
+				pattrib->pktlen += remainder_ielen;
+			}
+		}
+		else
+		{
+			_rtw_memcpy(pframe, cur_network->IEs, cur_network->IELength);
+			pframe += cur_network->IELength;
+			pattrib->pktlen += cur_network->IELength;
+		}
+
+		/* retrieve SSID IE from cur_network->Ssid */
+		{
+			u8 *ssid_ie;
+			sint ssid_ielen;
+			sint ssid_ielen_diff;
+			u8 buf[MAX_IE_SZ];
+			u8 *ies = pmgntframe->buf_addr+TXDESC_OFFSET+sizeof(struct rtw_ieee80211_hdr_3addr);
+
+			ssid_ie = rtw_get_ie(ies+_FIXED_IE_LENGTH_, _SSID_IE_, &ssid_ielen,
+				(pframe-ies)-_FIXED_IE_LENGTH_);
+
+			ssid_ielen_diff = cur_network->Ssid.SsidLength - ssid_ielen;
+
+			if (ssid_ie &&  cur_network->Ssid.SsidLength) {
+				uint remainder_ielen;
+				u8 *remainder_ie;
+				remainder_ie = ssid_ie+2;
+				remainder_ielen = (pframe-remainder_ie);
+
+				LOG_LEVEL(_drv_warning_, FUNC_ADPT_FMT" remainder_ielen > MAX_IE_SZ\n", FUNC_ADPT_ARG(padapter));
+				if (remainder_ielen > MAX_IE_SZ) {
+					remainder_ielen = MAX_IE_SZ;
+				}
+
+				_rtw_memcpy(buf, remainder_ie, remainder_ielen);
+				_rtw_memcpy(remainder_ie+ssid_ielen_diff, buf, remainder_ielen);
+				*(ssid_ie+1) = cur_network->Ssid.SsidLength;
+				_rtw_memcpy(ssid_ie+2, cur_network->Ssid.Ssid, cur_network->Ssid.SsidLength);
+
+				pframe += ssid_ielen_diff;
+				pattrib->pktlen += ssid_ielen_diff;
+			}
+		}
+	}
+	else
+#endif
+	{
+
+		//timestamp will be inserted by hardware
+		pframe += 8;
+		pattrib->pktlen += 8;
+
+		// beacon interval: 2 bytes
+
+		_rtw_memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->IEs)), 2);
+
+		pframe += 2;
+		pattrib->pktlen += 2;
+
+		// capability info: 2 bytes
+
+		_rtw_memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->IEs)), 2);
+
+		pframe += 2;
+		pattrib->pktlen += 2;
+
+		//below for ad-hoc mode
+
+		// SSID
+		pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &pattrib->pktlen);
+
+		// supported rates...
+		rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, ((rate_len > 8)? 8: rate_len), cur_network->SupportedRates, &pattrib->pktlen);
+
+		// DS parameter set
+		pframe =rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &pattrib->pktlen);
+
+		if( (pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE)
+		{
+			u8 erpinfo=0;
+			u32 ATIMWindow;
+			// IBSS Parameter Set...
+			//ATIMWindow = cur->Configuration.ATIMWindow;
+			ATIMWindow = 0;
+			pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
+
+			//ERP IE
+			pframe = rtw_set_ie(pframe, _ERPINFO_IE_, 1, &erpinfo, &pattrib->pktlen);
+		}
+
+
+		// EXTERNDED SUPPORTED RATE
+		if (rate_len > 8)
+		{
+			pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pattrib->pktlen);
+		}
+
+
+		//todo:HT for adhoc
+
+	}
+
+#ifdef CONFIG_P2P
+	if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO) /*&& is_valid_p2p_probereq*/)
+	{
+		u32 len;
+#ifdef CONFIG_IOCTL_CFG80211
+		if(wdev_to_priv(padapter->rtw_wdev)->p2p_enabled && pwdinfo->driver_interface == DRIVER_CFG80211 )
+		{
+			//if pwdinfo->role == P2P_ROLE_DEVICE will call issue_probersp_p2p()
+			len = pmlmepriv->p2p_go_probe_resp_ie_len;
+			if(pmlmepriv->p2p_go_probe_resp_ie && len>0)
+				_rtw_memcpy(pframe, pmlmepriv->p2p_go_probe_resp_ie, len);
+		}
+		else
+#endif //CONFIG_IOCTL_CFG80211
+		{
+			len = build_probe_resp_p2p_ie(pwdinfo, pframe);
+		}
+
+		pframe += len;
+		pattrib->pktlen += len;
+
+#ifdef CONFIG_WFD
+#ifdef CONFIG_IOCTL_CFG80211
+		if(_TRUE == pwdinfo->wfd_info->wfd_enable)
+#endif //CONFIG_IOCTL_CFG80211
+		{
+			len = build_probe_resp_wfd_ie(pwdinfo, pframe, 0);
+		}
+#ifdef CONFIG_IOCTL_CFG80211
+		else
+		{
+			len = 0;
+			if(pmlmepriv->wfd_probe_resp_ie && pmlmepriv->wfd_probe_resp_ie_len>0)
+			{
+				len = pmlmepriv->wfd_probe_resp_ie_len;
+				_rtw_memcpy(pframe, pmlmepriv->wfd_probe_resp_ie, len);
+			}
+		}
+#endif //CONFIG_IOCTL_CFG80211
+		pframe += len;
+		pattrib->pktlen += len;
+#endif //CONFIG_WFD
+
+	}
+#endif //CONFIG_P2P
+
+
+#ifdef CONFIG_AUTO_AP_MODE
+{
+	struct sta_info *psta;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	DBG_871X("(%s)\n", __FUNCTION__);
+
+	//check rc station
+	psta = rtw_get_stainfo(pstapriv, da);
+	if (psta && psta->isrc && psta->pid>0)
+	{
+		u8 RC_OUI[4]={0x00,0xE0,0x4C,0x0A};
+		u8 RC_INFO[14] = {0};
+		//EID[1] + EID_LEN[1] + RC_OUI[4] + MAC[6] + PairingID[2] + ChannelNum[2]
+		u16 cu_ch = (u16)cur_network->Configuration.DSConfig;
+
+		DBG_871X("%s, reply rc(pid=0x%x) device "MAC_FMT" in ch=%d\n", __FUNCTION__,
+			psta->pid, MAC_ARG(psta->hwaddr), cu_ch);
+
+		//append vendor specific ie
+		_rtw_memcpy(RC_INFO, RC_OUI, sizeof(RC_OUI));
+		_rtw_memcpy(&RC_INFO[4], mac, ETH_ALEN);
+		_rtw_memcpy(&RC_INFO[10], (u8*)&psta->pid, 2);
+		_rtw_memcpy(&RC_INFO[12], (u8*)&cu_ch, 2);
+
+		pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, sizeof(RC_INFO), RC_INFO, &pattrib->pktlen);
+	}
+}
+#endif //CONFIG_AUTO_AP_MODE
+
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+
+}
+
+int _issue_probereq(_adapter *padapter, NDIS_802_11_SSID *pssid, u8 *da, int wait_ack)
+{
+	int ret = _FAIL;
+	struct xmit_frame		*pmgntframe;
+	struct pkt_attrib		*pattrib;
+	unsigned char			*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short		*fctrl;
+	unsigned char			*mac;
+	unsigned char			bssrate[NumRates];
+	struct xmit_priv		*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	int	bssrate_len = 0;
+	u8	bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_notice_,("+issue_probereq\n"));
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		goto exit;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	mac = myid(&(padapter->eeprompriv));
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	if (da)
+	{
+		//	unicast probe request frame
+		_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+		_rtw_memcpy(pwlanhdr->addr3, da, ETH_ALEN);
+	}
+	else
+	{
+		//	broadcast probe request frame
+		_rtw_memcpy(pwlanhdr->addr1, bc_addr, ETH_ALEN);
+		_rtw_memcpy(pwlanhdr->addr3, bc_addr, ETH_ALEN);
+	}
+
+	_rtw_memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_PROBEREQ);
+
+	pframe += sizeof (struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof (struct rtw_ieee80211_hdr_3addr);
+
+	if(pssid)
+		pframe = rtw_set_ie(pframe, _SSID_IE_, pssid->SsidLength, pssid->Ssid, &(pattrib->pktlen));
+	else
+		pframe = rtw_set_ie(pframe, _SSID_IE_, 0, NULL, &(pattrib->pktlen));
+
+	get_rate_set(padapter, bssrate, &bssrate_len);
+
+	if (bssrate_len > 8)
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , 8, bssrate, &(pattrib->pktlen));
+		pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_ , (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
+	}
+	else
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , bssrate_len , bssrate, &(pattrib->pktlen));
+	}
+
+#if 0
+	//add wps_ie for wps2.0
+	if(pmlmepriv->probereq_wpsie_len>0 && pmlmepriv->probereq_wpsie_len<MAX_WPS_IE_LEN)
+	{
+		_rtw_memcpy(pframe, pmlmepriv->probereq_wpsie, pmlmepriv->probereq_wpsie_len);
+		pframe += pmlmepriv->probereq_wpsie_len;
+		pattrib->pktlen += pmlmepriv->probereq_wpsie_len;
+		//pmlmepriv->probereq_wpsie_len = 0 ;//reset to zero
+	}
+#else
+	//add wps_ie for wps2.0
+	if(pmlmepriv->wps_probe_req_ie_len>0 && pmlmepriv->wps_probe_req_ie)
+	{
+		_rtw_memcpy(pframe, pmlmepriv->wps_probe_req_ie, pmlmepriv->wps_probe_req_ie_len);
+		pframe += pmlmepriv->wps_probe_req_ie_len;
+		pattrib->pktlen += pmlmepriv->wps_probe_req_ie_len;
+		//pmlmepriv->wps_probe_req_ie_len = 0 ;//reset to zero
+	}
+#endif
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_notice_,("issuing probe_req, tx_len=%d\n", pattrib->last_txcmdsz));
+
+	if (wait_ack) {
+		ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
+	} else {
+		dump_mgntframe(padapter, pmgntframe);
+		ret = _SUCCESS;
+	}
+
+exit:
+	return ret;
+}
+
+inline void issue_probereq(_adapter *padapter, NDIS_802_11_SSID *pssid, u8 *da)
+{
+	_issue_probereq(padapter, pssid, da, _FALSE);
+}
+
+int issue_probereq_ex(_adapter *padapter, NDIS_802_11_SSID *pssid, u8 *da,
+	int try_cnt, int wait_ms)
+{
+	int ret;
+	int i = 0;
+	u32 start = rtw_get_current_time();
+
+	do
+	{
+		ret = _issue_probereq(padapter, pssid, da, wait_ms>0?_TRUE:_FALSE);
+
+		i++;
+
+		if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
+			break;
+
+		if(i < try_cnt && wait_ms > 0 && ret==_FAIL)
+			rtw_msleep_os(wait_ms);
+
+	}while((i<try_cnt) && ((ret==_FAIL)||(wait_ms==0)));
+
+	if (ret != _FAIL) {
+		ret = _SUCCESS;
+		#ifndef DBG_XMIT_ACK
+		goto exit;
+		#endif
+	}
+
+	if (try_cnt && wait_ms) {
+		if (da)
+			DBG_871X(FUNC_ADPT_FMT" to "MAC_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(padapter), MAC_ARG(da), rtw_get_oper_ch(padapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+		else
+			DBG_871X(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+	}
+exit:
+	return ret;
+}
+
+// if psta == NULL, indiate we are station(client) now...
+void issue_auth(_adapter *padapter, struct sta_info *psta, unsigned short status)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	unsigned int					val32;
+	unsigned short				val16;
+	int use_shared_key = 0;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_AUTH);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+
+	if(psta)// for AP mode
+	{
+#ifdef CONFIG_NATIVEAP_MLME
+
+		_rtw_memcpy(pwlanhdr->addr1, psta->hwaddr, ETH_ALEN);
+		_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+		_rtw_memcpy(pwlanhdr->addr3, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+
+		// setting auth algo number
+		val16 = (u16)psta->authalg;
+
+		if(status != _STATS_SUCCESSFUL_)
+			val16 = 0;
+
+		if (val16)	{
+			val16 = cpu_to_le16(val16);
+			use_shared_key = 1;
+		}
+
+		pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, (unsigned char *)&val16, &(pattrib->pktlen));
+
+		// setting auth seq number
+		val16 =(u16)psta->auth_seq;
+		val16 = cpu_to_le16(val16);
+		pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, (unsigned char *)&val16, &(pattrib->pktlen));
+
+		// setting status code...
+		val16 = status;
+		val16 = cpu_to_le16(val16);
+		pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, (unsigned char *)&val16, &(pattrib->pktlen));
+
+		// added challenging text...
+		if ((psta->auth_seq == 2) && (psta->state & WIFI_FW_AUTH_STATE) && (use_shared_key==1))
+		{
+			pframe = rtw_set_ie(pframe, _CHLGETXT_IE_, 128, psta->chg_txt, &(pattrib->pktlen));
+		}
+#endif
+	}
+	else
+	{
+		_rtw_memcpy(pwlanhdr->addr1, get_my_bssid(&pmlmeinfo->network), ETH_ALEN);
+		_rtw_memcpy(pwlanhdr->addr2, myid(&padapter->eeprompriv), ETH_ALEN);
+		_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&pmlmeinfo->network), ETH_ALEN);
+
+		// setting auth algo number
+		val16 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)? 1: 0;// 0:OPEN System, 1:Shared key
+		if (val16)	{
+			val16 = cpu_to_le16(val16);
+			use_shared_key = 1;
+		}
+		//DBG_871X("%s auth_algo= %s auth_seq=%d\n",__FUNCTION__,(pmlmeinfo->auth_algo==0)?"OPEN":"SHARED",pmlmeinfo->auth_seq);
+
+		//setting IV for auth seq #3
+		if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key==1))
+		{
+			//DBG_871X("==> iv(%d),key_index(%d)\n",pmlmeinfo->iv,pmlmeinfo->key_index);
+			val32 = ((pmlmeinfo->iv++) | (pmlmeinfo->key_index << 30));
+			val32 = cpu_to_le32(val32);
+			pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *)&val32, &(pattrib->pktlen));
+
+			pattrib->iv_len = 4;
+		}
+
+		pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, (unsigned char *)&val16, &(pattrib->pktlen));
+
+		// setting auth seq number
+		val16 = pmlmeinfo->auth_seq;
+		val16 = cpu_to_le16(val16);
+		pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, (unsigned char *)&val16, &(pattrib->pktlen));
+
+
+		// setting status code...
+		val16 = status;
+		val16 = cpu_to_le16(val16);
+		pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, (unsigned char *)&val16, &(pattrib->pktlen));
+
+		// then checking to see if sending challenging text...
+		if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key==1))
+		{
+			pframe = rtw_set_ie(pframe, _CHLGETXT_IE_, 128, pmlmeinfo->chg_txt, &(pattrib->pktlen));
+
+			SetPrivacy(fctrl);
+
+			pattrib->hdrlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+			pattrib->encrypt = _WEP40_;
+
+			pattrib->icv_len = 4;
+
+			pattrib->pktlen += pattrib->icv_len;
+
+		}
+
+	}
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	rtw_wep_encrypt(padapter, (u8 *)pmgntframe);
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+}
+
+
+void issue_asocrsp(_adapter *padapter, unsigned short status, struct sta_info *pstat, int pkt_type)
+{
+#ifdef CONFIG_AP_MODE
+	struct xmit_frame	*pmgntframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	struct pkt_attrib *pattrib;
+	unsigned char	*pbuf, *pframe;
+	unsigned short val;
+	unsigned short *fctrl;
+	struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX *pnetwork = &(pmlmeinfo->network);
+	u8 *ie = pnetwork->IEs;
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+#endif //CONFIG_P2P
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy((void *)GetAddr1Ptr(pwlanhdr), pstat->hwaddr, ETH_ALEN);
+	_rtw_memcpy((void *)GetAddr2Ptr(pwlanhdr), myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy((void *)GetAddr3Ptr(pwlanhdr), get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	if ((pkt_type == WIFI_ASSOCRSP) || (pkt_type == WIFI_REASSOCRSP))
+		SetFrameSubType(pwlanhdr, pkt_type);
+	else
+		return;
+
+	pattrib->hdrlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen += pattrib->hdrlen;
+	pframe += pattrib->hdrlen;
+
+	//capability
+	val = *(unsigned short *)rtw_get_capability_from_ie(ie);
+
+	pframe = rtw_set_fixed_ie(pframe, _CAPABILITY_ , (unsigned char *)&val, &(pattrib->pktlen));
+
+	status = cpu_to_le16(status);
+	pframe = rtw_set_fixed_ie(pframe , _STATUS_CODE_ , (unsigned char *)&status, &(pattrib->pktlen));
+
+	val = cpu_to_le16(pstat->aid | BIT(14) | BIT(15));
+	pframe = rtw_set_fixed_ie(pframe, _ASOC_ID_ , (unsigned char *)&val, &(pattrib->pktlen));
+
+	if (pstat->bssratelen <= 8)
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, pstat->bssratelen, pstat->bssrateset, &(pattrib->pktlen));
+	}
+	else
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, pstat->bssrateset, &(pattrib->pktlen));
+		pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (pstat->bssratelen-8), pstat->bssrateset+8, &(pattrib->pktlen));
+	}
+
+#ifdef CONFIG_80211N_HT
+	if ((pstat->flags & WLAN_STA_HT) && (pmlmepriv->htpriv.ht_option))
+	{
+		uint ie_len=0;
+
+		//FILL HT CAP INFO IE
+		//p = hostapd_eid_ht_capabilities_info(hapd, p);
+		pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_CAPABILITY_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_));
+		if(pbuf && ie_len>0)
+		{
+			_rtw_memcpy(pframe, pbuf, ie_len+2);
+			pframe += (ie_len+2);
+			pattrib->pktlen +=(ie_len+2);
+		}
+
+		//FILL HT ADD INFO IE
+		//p = hostapd_eid_ht_operation(hapd, p);
+		pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_ADD_INFO_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_));
+		if(pbuf && ie_len>0)
+		{
+			_rtw_memcpy(pframe, pbuf, ie_len+2);
+			pframe += (ie_len+2);
+			pattrib->pktlen +=(ie_len+2);
+		}
+
+	}
+#endif
+
+	//FILL WMM IE
+	if ((pstat->flags & WLAN_STA_WME) && (pmlmepriv->qospriv.qos_option))
+	{
+		uint ie_len=0;
+		unsigned char WMM_PARA_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
+
+		for (pbuf = ie + _BEACON_IE_OFFSET_; ;pbuf+= (ie_len + 2))
+		{
+			pbuf = rtw_get_ie(pbuf, _VENDOR_SPECIFIC_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_ - (ie_len + 2)));
+			if(pbuf && _rtw_memcmp(pbuf+2, WMM_PARA_IE, 6))
+			{
+				_rtw_memcpy(pframe, pbuf, ie_len+2);
+				pframe += (ie_len+2);
+				pattrib->pktlen +=(ie_len+2);
+
+				break;
+			}
+
+			if ((pbuf == NULL) || (ie_len == 0))
+			{
+				break;
+			}
+		}
+
+	}
+
+
+	if (pmlmeinfo->assoc_AP_vendor == realtekAP)
+	{
+		pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 6 , REALTEK_96B_IE, &(pattrib->pktlen));
+	}
+
+	//add WPS IE ie for wps 2.0
+	if(pmlmepriv->wps_assoc_resp_ie && pmlmepriv->wps_assoc_resp_ie_len>0)
+	{
+		_rtw_memcpy(pframe, pmlmepriv->wps_assoc_resp_ie, pmlmepriv->wps_assoc_resp_ie_len);
+
+		pframe += pmlmepriv->wps_assoc_resp_ie_len;
+		pattrib->pktlen += pmlmepriv->wps_assoc_resp_ie_len;
+	}
+
+#ifdef CONFIG_P2P
+	if( padapter->wdinfo.driver_interface == DRIVER_WEXT )
+	{
+		if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO) && (pstat->is_p2p_device == _TRUE))
+		{
+			u32 len;
+
+			len = build_assoc_resp_p2p_ie(pwdinfo, pframe, pstat->p2p_status_code);
+
+			pframe += len;
+			pattrib->pktlen += len;
+		}
+	}
+#ifdef CONFIG_WFD
+	if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO)
+#ifdef CONFIG_IOCTL_CFG80211
+		&& (_TRUE == pwdinfo->wfd_info->wfd_enable)
+#endif //CONFIG_IOCTL_CFG80211
+	)
+	{
+		wfdielen = build_assoc_resp_wfd_ie(pwdinfo, pframe);
+		pframe += wfdielen;
+		pattrib->pktlen += wfdielen;
+	}
+#endif //CONFIG_WFD
+#endif //CONFIG_P2P
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+#endif
+}
+
+void issue_assocreq(_adapter *padapter)
+{
+	int ret = _FAIL;
+	struct xmit_frame				*pmgntframe;
+	struct pkt_attrib				*pattrib;
+	unsigned char					*pframe, *p;
+	struct rtw_ieee80211_hdr			*pwlanhdr;
+	unsigned short				*fctrl;
+	unsigned short				val16;
+	unsigned int					i, j, ie_len, index=0;
+	unsigned char					rf_type, bssrate[NumRates], sta_bssrate[NumRates];
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	struct xmit_priv		*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	int	bssrate_len = 0, sta_bssrate_len = 0;
+	u8	cbw40_enable = 0;
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &(padapter->wdinfo);
+	u8					p2pie[ 255 ] = { 0x00 };
+	u16					p2pielen = 0;
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_DFS
+	u16	cap;
+	u8 pow_cap_ele[2] = { 0x00 };
+	u8 sup_ch[ 30 * 2 ] = {0x00 }, sup_ch_idx = 0, idx_5g = 2;	//For supported channel
+#endif //CONFIG_DFS
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+		goto exit;
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+	_rtw_memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ASSOCREQ);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	//caps
+
+#ifdef CONFIG_DFS
+	_rtw_memcpy(&cap, rtw_get_capability_from_ie(pmlmeinfo->network.IEs), 2);
+	if(pmlmeext->cur_channel > 14)
+		cap |= BIT(8); //Spectrum Mgmt. Enabled
+	_rtw_memcpy(pframe, &cap, 2);
+#else
+	_rtw_memcpy(pframe, rtw_get_capability_from_ie(pmlmeinfo->network.IEs), 2);
+#endif //CONFIG_DFS
+
+	pframe += 2;
+	pattrib->pktlen += 2;
+
+	//listen interval
+	//todo: listen interval for power saving
+	val16 = cpu_to_le16(3);
+	_rtw_memcpy(pframe ,(unsigned char *)&val16, 2);
+	pframe += 2;
+	pattrib->pktlen += 2;
+
+	//SSID
+	pframe = rtw_set_ie(pframe, _SSID_IE_,  pmlmeinfo->network.Ssid.SsidLength, pmlmeinfo->network.Ssid.Ssid, &(pattrib->pktlen));
+
+	//supported rate & extended supported rate
+
+#if 1	// Check if the AP's supported rates are also supported by STA.
+	get_rate_set(padapter, sta_bssrate, &sta_bssrate_len);
+	//DBG_871X("sta_bssrate_len=%d\n", sta_bssrate_len);
+
+	if(pmlmeext->cur_channel == 14)// for JAPAN, channel 14 can only uses B Mode(CCK)
+	{
+		sta_bssrate_len = 4;
+	}
+
+
+	//for (i = 0; i < sta_bssrate_len; i++) {
+	//	DBG_871X("sta_bssrate[%d]=%02X\n", i, sta_bssrate[i]);
+	//}
+
+	for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
+		if (pmlmeinfo->network.SupportedRates[i] == 0) break;
+		DBG_871X("network.SupportedRates[%d]=%02X\n", i, pmlmeinfo->network.SupportedRates[i]);
+	}
+
+
+	for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
+		if (pmlmeinfo->network.SupportedRates[i] == 0) break;
+
+
+		// Check if the AP's supported rates are also supported by STA.
+		for (j=0; j < sta_bssrate_len; j++) {
+			 // Avoid the proprietary data rate (22Mbps) of Handlink WSG-4000 AP
+			if ( (pmlmeinfo->network.SupportedRates[i]|IEEE80211_BASIC_RATE_MASK)
+					== (sta_bssrate[j]|IEEE80211_BASIC_RATE_MASK)) {
+				//DBG_871X("match i = %d, j=%d\n", i, j);
+				break;
+			} else {
+				//DBG_871X("not match: %02X != %02X\n", (pmlmeinfo->network.SupportedRates[i]|IEEE80211_BASIC_RATE_MASK), (sta_bssrate[j]|IEEE80211_BASIC_RATE_MASK));
+			}
+		}
+
+		if (j == sta_bssrate_len) {
+			// the rate is not supported by STA
+			DBG_871X("%s(): the rate[%d]=%02X is not supported by STA!\n",__FUNCTION__, i, pmlmeinfo->network.SupportedRates[i]);
+		} else {
+			// the rate is supported by STA
+			bssrate[index++] = pmlmeinfo->network.SupportedRates[i];
+		}
+	}
+
+	bssrate_len = index;
+	DBG_871X("bssrate_len = %d\n", bssrate_len);
+
+#else	// Check if the AP's supported rates are also supported by STA.
+#if 0
+	get_rate_set(padapter, bssrate, &bssrate_len);
+#else
+	for (bssrate_len = 0; bssrate_len < NumRates; bssrate_len++) {
+		if (pmlmeinfo->network.SupportedRates[bssrate_len] == 0) break;
+
+		if (pmlmeinfo->network.SupportedRates[bssrate_len] == 0x2C) // Avoid the proprietary data rate (22Mbps) of Handlink WSG-4000 AP
+			break;
+
+		bssrate[bssrate_len] = pmlmeinfo->network.SupportedRates[bssrate_len];
+	}
+#endif
+#endif	// Check if the AP's supported rates are also supported by STA.
+
+	if (bssrate_len == 0) {
+		rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit; //don't connect to AP if no joint supported rate
+	}
+
+
+	if (bssrate_len > 8)
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , 8, bssrate, &(pattrib->pktlen));
+		pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_ , (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
+	}
+	else
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , bssrate_len , bssrate, &(pattrib->pktlen));
+	}
+
+#ifdef CONFIG_DFS
+	if(pmlmeext->cur_channel > 14)
+	{
+		pow_cap_ele[0] = 13;	// Minimum transmit power capability
+		pow_cap_ele[1] = 21;	// Maximum transmit power capability
+		pframe = rtw_set_ie(pframe, _POW_CAP_IE_, 2, pow_cap_ele, &(pattrib->pktlen));
+
+		//supported channels
+		do{
+			if( pmlmeext->channel_set[sup_ch_idx].ChannelNum <= 14 )
+			{
+				sup_ch[0] = 1;	//First channel number
+				sup_ch[1] = pmlmeext->channel_set[sup_ch_idx].ChannelNum;	//Number of channel
+			}
+			else
+			{
+				sup_ch[idx_5g++] = pmlmeext->channel_set[sup_ch_idx].ChannelNum;
+				sup_ch[idx_5g++] = 1;
+			}
+			sup_ch_idx++;
+		}
+		while( pmlmeext->channel_set[sup_ch_idx].ChannelNum != 0 );
+		pframe = rtw_set_ie(pframe, _SUPPORTED_CH_IE_, idx_5g, sup_ch, &(pattrib->pktlen));
+	}
+#endif //CONFIG_DFS
+
+	//RSN
+	p = rtw_get_ie((pmlmeinfo->network.IEs + sizeof(NDIS_802_11_FIXED_IEs)), _RSN_IE_2_, &ie_len, (pmlmeinfo->network.IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+	if (p != NULL)
+	{
+		pframe = rtw_set_ie(pframe, _RSN_IE_2_, ie_len, (p + 2), &(pattrib->pktlen));
+	}
+
+#ifdef CONFIG_80211N_HT
+	//HT caps
+	if(padapter->mlmepriv.htpriv.ht_option==_TRUE)
+	{
+		p = rtw_get_ie((pmlmeinfo->network.IEs + sizeof(NDIS_802_11_FIXED_IEs)), _HT_CAPABILITY_IE_, &ie_len, (pmlmeinfo->network.IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+		if ((p != NULL) && (!(is_ap_in_tkip(padapter))))
+		{
+			_rtw_memcpy(&(pmlmeinfo->HT_caps), (p + 2), sizeof(struct HT_caps_element));
+
+			//to disable 40M Hz support while gd_bw_40MHz_en = 0
+			if( pmlmeext->cur_channel > 14)
+			{
+				if(pregpriv->cbw40_enable & BIT(1) )
+					cbw40_enable=1;
+			}
+			else
+				if(pregpriv->cbw40_enable & BIT(0) )
+					cbw40_enable=1;
+
+			if (cbw40_enable == 0)
+			{
+				pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info &= (~(BIT(6) | BIT(1)));
+			}
+			else
+			{
+				pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info |= BIT(1);
+			}
+
+			//todo: disable SM power save mode
+			pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info |= 0x000c;
+
+			rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+			//switch (pregpriv->rf_config)
+			switch(rf_type)
+			{
+				case RF_1T1R:
+
+					if(pregpriv->rx_stbc)
+						pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info |= cpu_to_le16(0x0100);//RX STBC One spatial stream
+
+					_rtw_memcpy(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_rate_1R, 16);
+					break;
+
+				case RF_2T2R:
+				case RF_1T2R:
+				default:
+
+
+					if(pregpriv->special_rf_path)
+					{
+						if(pregpriv->rx_stbc)
+							pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info |= cpu_to_le16(0x0100);//RX STBC One spatial stream
+						_rtw_memcpy(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_rate_1R, 16);
+						break;
+					}
+
+					if((pregpriv->rx_stbc == 0x3) ||//enable for 2.4/5 GHz
+						((pmlmeext->cur_wireless_mode & WIRELESS_11_24N) && (pregpriv->rx_stbc == 0x1)) || //enable for 2.4GHz
+						((pmlmeext->cur_wireless_mode & WIRELESS_11_5N) && (pregpriv->rx_stbc == 0x2)) || //enable for 5GHz
+						(pregpriv->wifi_spec==1))
+					{
+						DBG_871X("declare supporting RX STBC\n");
+						pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info |= cpu_to_le16(0x0200);//RX STBC two spatial stream
+					}
+					#ifdef CONFIG_DISABLE_MCS13TO15
+					if(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40 && (pregpriv->wifi_spec!=1))
+						_rtw_memcpy(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_rate_2R_MCS13TO15_OFF, 16);
+					else
+					_rtw_memcpy(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_rate_2R, 16);
+					#else //CONFIG_DISABLE_MCS13TO15
+					_rtw_memcpy(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_rate_2R, 16);
+					#endif //CONFIG_DISABLE_MCS13TO15
+					break;
+			}
+#ifdef RTL8192C_RECONFIG_TO_1T1R
+			{
+				if(pregpriv->rx_stbc)
+					pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info |= cpu_to_le16(0x0100);//RX STBC One spatial stream
+
+				_rtw_memcpy(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_rate_1R, 16);
+			}
+#endif
+			pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info = cpu_to_le16(pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info);
+			pframe = rtw_set_ie(pframe, _HT_CAPABILITY_IE_, ie_len , (u8 *)(&(pmlmeinfo->HT_caps)), &(pattrib->pktlen));
+
+		}
+	}
+#endif
+
+	//vendor specific IE, such as WPA, WMM, WPS
+	for (i = sizeof(NDIS_802_11_FIXED_IEs); i < pmlmeinfo->network.IELength;)
+	{
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(pmlmeinfo->network.IEs + i);
+
+		switch (pIE->ElementID)
+		{
+			case _VENDOR_SPECIFIC_IE_:
+				if ((_rtw_memcmp(pIE->data, RTW_WPA_OUI, 4)) ||
+						(_rtw_memcmp(pIE->data, WMM_OUI, 4)) ||
+						(_rtw_memcmp(pIE->data, WPS_OUI, 4)))
+				{
+					if(!padapter->registrypriv.wifi_spec)
+					{
+						//Commented by Kurt 20110629
+						//In some older APs, WPS handshake
+						//would be fail if we append vender extensions informations to AP
+						if(_rtw_memcmp(pIE->data, WPS_OUI, 4)){
+							pIE->Length=14;
+						}
+					}
+					pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, pIE->Length, pIE->data, &(pattrib->pktlen));
+				}
+				break;
+
+			default:
+				break;
+		}
+
+		i += (pIE->Length + 2);
+	}
+
+	if (pmlmeinfo->assoc_AP_vendor == realtekAP)
+	{
+		pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 6 , REALTEK_96B_IE, &(pattrib->pktlen));
+	}
+
+#ifdef CONFIG_P2P
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if(wdev_to_priv(padapter->rtw_wdev)->p2p_enabled && pwdinfo->driver_interface == DRIVER_CFG80211 )
+	{
+		if(pmlmepriv->p2p_assoc_req_ie && pmlmepriv->p2p_assoc_req_ie_len>0)
+		{
+			_rtw_memcpy(pframe, pmlmepriv->p2p_assoc_req_ie, pmlmepriv->p2p_assoc_req_ie_len);
+			pframe += pmlmepriv->p2p_assoc_req_ie_len;
+			pattrib->pktlen += pmlmepriv->p2p_assoc_req_ie_len;
+		}
+	}
+	else
+#endif //CONFIG_IOCTL_CFG80211
+	{
+		if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE) && !rtw_p2p_chk_state(pwdinfo, P2P_STATE_IDLE))
+		{
+			//	Should add the P2P IE in the association request frame.
+			//	P2P OUI
+
+			p2pielen = 0;
+			p2pie[ p2pielen++ ] = 0x50;
+			p2pie[ p2pielen++ ] = 0x6F;
+			p2pie[ p2pielen++ ] = 0x9A;
+			p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+			//	Commented by Albert 20101109
+			//	According to the P2P Specification, the association request frame should contain 3 P2P attributes
+			//	1. P2P Capability
+			//	2. Extended Listen Timing
+			//	3. Device Info
+			//	Commented by Albert 20110516
+			//	4. P2P Interface
+
+			//	P2P Capability
+			//	Type:
+			p2pie[ p2pielen++ ] = P2P_ATTR_CAPABILITY;
+
+			//	Length:
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+			p2pielen += 2;
+
+			//	Value:
+			//	Device Capability Bitmap, 1 byte
+			p2pie[ p2pielen++ ] = DMP_P2P_DEVCAP_SUPPORT;
+
+			//	Group Capability Bitmap, 1 byte
+			if ( pwdinfo->persistent_supported )
+				p2pie[ p2pielen++ ] = P2P_GRPCAP_PERSISTENT_GROUP | DMP_P2P_GRPCAP_SUPPORT;
+			else
+				p2pie[ p2pielen++ ] = DMP_P2P_GRPCAP_SUPPORT;
+
+			//	Extended Listen Timing
+			//	Type:
+			p2pie[ p2pielen++ ] = P2P_ATTR_EX_LISTEN_TIMING;
+
+			//	Length:
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0004 );
+			p2pielen += 2;
+
+			//	Value:
+			//	Availability Period
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0xFFFF );
+			p2pielen += 2;
+
+			//	Availability Interval
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0xFFFF );
+			p2pielen += 2;
+
+			//	Device Info
+			//	Type:
+			p2pie[ p2pielen++ ] = P2P_ATTR_DEVICE_INFO;
+
+			//	Length:
+			//	21 -> P2P Device Address (6bytes) + Config Methods (2bytes) + Primary Device Type (8bytes)
+			//	+ NumofSecondDevType (1byte) + WPS Device Name ID field (2bytes) + WPS Device Name Len field (2bytes)
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 21 + pwdinfo->device_name_len );
+			p2pielen += 2;
+
+			//	Value:
+			//	P2P Device Address
+			_rtw_memcpy( p2pie + p2pielen, myid( &padapter->eeprompriv ), ETH_ALEN );
+			p2pielen += ETH_ALEN;
+
+			//	Config Method
+			//	This field should be big endian. Noted by P2P specification.
+			if ( ( pwdinfo->ui_got_wps_info == P2P_GOT_WPSINFO_PEER_DISPLAY_PIN ) ||
+				( pwdinfo->ui_got_wps_info == P2P_GOT_WPSINFO_SELF_DISPLAY_PIN ) )
+			{
+				*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_CONFIG_METHOD_DISPLAY );
+			}
+			else
+			{
+				*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_CONFIG_METHOD_PBC );
+			}
+
+			p2pielen += 2;
+
+			//	Primary Device Type
+			//	Category ID
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_CID_MULIT_MEDIA );
+			p2pielen += 2;
+
+			//	OUI
+			*(u32*) ( p2pie + p2pielen ) = cpu_to_be32( WPSOUI );
+			p2pielen += 4;
+
+			//	Sub Category ID
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_SCID_MEDIA_SERVER );
+			p2pielen += 2;
+
+			//	Number of Secondary Device Types
+			p2pie[ p2pielen++ ] = 0x00;	//	No Secondary Device Type List
+
+			//	Device Name
+			//	Type:
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+			p2pielen += 2;
+
+			//	Length:
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( pwdinfo->device_name_len );
+			p2pielen += 2;
+
+			//	Value:
+			_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_name, pwdinfo->device_name_len );
+			p2pielen += pwdinfo->device_name_len;
+
+			//	P2P Interface
+			//	Type:
+			p2pie[ p2pielen++ ] = P2P_ATTR_INTERFACE;
+
+			//	Length:
+			*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x000D );
+			p2pielen += 2;
+
+			//	Value:
+			_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_addr, ETH_ALEN );	//	P2P Device Address
+			p2pielen += ETH_ALEN;
+
+			p2pie[ p2pielen++ ] = 1;	//	P2P Interface Address Count
+
+			_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_addr, ETH_ALEN );	//	P2P Interface Address List
+			p2pielen += ETH_ALEN;
+
+			pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &pattrib->pktlen );
+
+#ifdef CONFIG_WFD
+			//wfdielen = build_assoc_req_wfd_ie(pwdinfo, pframe);
+			//pframe += wfdielen;
+			//pattrib->pktlen += wfdielen;
+#endif //CONFIG_WFD
+		}
+	}
+
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_WFD
+#ifdef CONFIG_IOCTL_CFG80211
+	if ( _TRUE == pwdinfo->wfd_info->wfd_enable )
+#endif //CONFIG_IOCTL_CFG80211
+	{
+		wfdielen = build_assoc_req_wfd_ie(pwdinfo, pframe);
+		pframe += wfdielen;
+		pattrib->pktlen += wfdielen;
+	}
+#ifdef CONFIG_IOCTL_CFG80211
+	else if (pmlmepriv->wfd_assoc_req_ie != NULL && pmlmepriv->wfd_assoc_req_ie_len>0)
+	{
+		//WFD IE
+		_rtw_memcpy(pframe, pmlmepriv->wfd_assoc_req_ie, pmlmepriv->wfd_assoc_req_ie_len);
+		pattrib->pktlen += pmlmepriv->wfd_assoc_req_ie_len;
+		pframe += pmlmepriv->wfd_assoc_req_ie_len;
+	}
+#endif //CONFIG_IOCTL_CFG80211
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+	dump_mgntframe(padapter, pmgntframe);
+
+	ret = _SUCCESS;
+
+exit:
+	if (ret == _SUCCESS)
+		rtw_buf_update(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len, (u8 *)pwlanhdr, pattrib->pktlen);
+	else
+		rtw_buf_free(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len);
+
+	return;
+}
+
+//when wait_ack is ture, this function shoule be called at process context
+static int _issue_nulldata(_adapter *padapter, unsigned char *da, unsigned int power_mode, int wait_ack)
+{
+	int ret = _FAIL;
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv	*pxmitpriv;
+	struct mlme_ext_priv	*pmlmeext;
+	struct mlme_ext_info	*pmlmeinfo;
+
+	//DBG_871X("%s:%d\n", __FUNCTION__, power_mode);
+
+	if(!padapter)
+		goto exit;
+
+	pxmitpriv = &(padapter->xmitpriv);
+	pmlmeext = &(padapter->mlmeextpriv);
+	pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		goto exit;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+	pattrib->retry_ctrl = _FALSE;
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	if((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
+	{
+		SetFrDs(fctrl);
+	}
+	else if((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
+	{
+		SetToDs(fctrl);
+	}
+
+	if (power_mode)
+	{
+		SetPwrMgt(fctrl);
+	}
+
+	_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_DATA_NULL);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	if(wait_ack)
+	{
+		ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
+	}
+	else
+	{
+		dump_mgntframe(padapter, pmgntframe);
+		ret = _SUCCESS;
+	}
+
+exit:
+	return ret;
+}
+
+
+//when wait_ms >0 , this function shoule be called at process context
+//da == NULL for station mode
+int issue_nulldata(_adapter *padapter, unsigned char *da, unsigned int power_mode, int try_cnt, int wait_ms)
+{
+	int ret;
+	int i = 0;
+	u32 start = rtw_get_current_time();
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	/* da == NULL, assum it's null data for sta to ap*/
+	if (da == NULL)
+		da = get_my_bssid(&(pmlmeinfo->network));
+
+	do
+	{
+		ret = _issue_nulldata(padapter, da, power_mode, wait_ms>0?_TRUE:_FALSE);
+
+		i++;
+
+		if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
+			break;
+
+		if(i < try_cnt && wait_ms > 0 && ret==_FAIL)
+			rtw_msleep_os(wait_ms);
+
+	}while((i<try_cnt) && ((ret==_FAIL)||(wait_ms==0)));
+
+	if (ret != _FAIL) {
+		ret = _SUCCESS;
+		#ifndef DBG_XMIT_ACK
+		goto exit;
+		#endif
+	}
+
+	if (try_cnt && wait_ms) {
+		if (da)
+			DBG_871X(FUNC_ADPT_FMT" to "MAC_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(padapter), MAC_ARG(da), rtw_get_oper_ch(padapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+		else
+			DBG_871X(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+	}
+exit:
+	return ret;
+}
+
+//when wait_ack is ture, this function shoule be called at process context
+static int _issue_qos_nulldata(_adapter *padapter, unsigned char *da, u16 tid, int wait_ack)
+{
+	int ret = _FAIL;
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl, *qc;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		goto exit;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	pattrib->hdrlen +=2;
+	pattrib->qos_en = _TRUE;
+	pattrib->eosp = 1;
+	pattrib->ack_policy = 0;
+	pattrib->mdata = 0;
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	if((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
+	{
+		SetFrDs(fctrl);
+	}
+	else if((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
+	{
+		SetToDs(fctrl);
+	}
+
+	if(pattrib->mdata)
+		SetMData(fctrl);
+
+	qc = (unsigned short *)(pframe + pattrib->hdrlen - 2);
+
+	SetPriority(qc, tid);
+
+	SetEOSP(qc, pattrib->eosp);
+
+	SetAckpolicy(qc, pattrib->ack_policy);
+
+	_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_QOS_DATA_NULL);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr_qos);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr_qos);
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	if(wait_ack)
+	{
+		ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
+	}
+	else
+	{
+		dump_mgntframe(padapter, pmgntframe);
+		ret = _SUCCESS;
+	}
+
+exit:
+	return ret;
+}
+
+//when wait_ms >0 , this function shoule be called at process context
+//da == NULL for station mode
+int issue_qos_nulldata(_adapter *padapter, unsigned char *da, u16 tid, int try_cnt, int wait_ms)
+{
+	int ret;
+	int i = 0;
+	u32 start = rtw_get_current_time();
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	/* da == NULL, assum it's null data for sta to ap*/
+	if (da == NULL)
+		da = get_my_bssid(&(pmlmeinfo->network));
+
+	do
+	{
+		ret = _issue_qos_nulldata(padapter, da, tid, wait_ms>0?_TRUE:_FALSE);
+
+		i++;
+
+		if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
+			break;
+
+		if(i < try_cnt && wait_ms > 0 && ret==_FAIL)
+			rtw_msleep_os(wait_ms);
+
+	}while((i<try_cnt) && ((ret==_FAIL)||(wait_ms==0)));
+
+	if (ret != _FAIL) {
+		ret = _SUCCESS;
+		#ifndef DBG_XMIT_ACK
+		goto exit;
+		#endif
+	}
+
+	if (try_cnt && wait_ms) {
+		if (da)
+			DBG_871X(FUNC_ADPT_FMT" to "MAC_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(padapter), MAC_ARG(da), rtw_get_oper_ch(padapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+		else
+			DBG_871X(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+	}
+exit:
+	return ret;
+}
+
+static int _issue_deauth(_adapter *padapter, unsigned char *da, unsigned short reason, u8 wait_ack)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	int ret = _FAIL;
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+#endif //CONFIG_P2P
+
+	//DBG_871X("%s to "MAC_FMT"\n", __func__, MAC_ARG(da));
+
+#ifdef CONFIG_P2P
+	if ( !( rtw_p2p_chk_state( pwdinfo, P2P_STATE_NONE ) ) && ( pwdinfo->rx_invitereq_info.scan_op_ch_only ) )
+	{
+		_cancel_timer_ex( &pwdinfo->reset_ch_sitesurvey );
+		_set_timer( &pwdinfo->reset_ch_sitesurvey, 10 );
+	}
+#endif //CONFIG_P2P
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		goto exit;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+	pattrib->retry_ctrl = _FALSE;
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_DEAUTH);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	reason = cpu_to_le16(reason);
+	pframe = rtw_set_fixed_ie(pframe, _RSON_CODE_ , (unsigned char *)&reason, &(pattrib->pktlen));
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+
+	if(wait_ack)
+	{
+		ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
+	}
+	else
+	{
+		dump_mgntframe(padapter, pmgntframe);
+		ret = _SUCCESS;
+	}
+
+exit:
+	return ret;
+}
+
+int issue_deauth(_adapter *padapter, unsigned char *da, unsigned short reason)
+{
+	DBG_871X("%s to "MAC_FMT"\n", __func__, MAC_ARG(da));
+	return _issue_deauth(padapter, da, reason, _FALSE);
+}
+
+int issue_deauth_ex(_adapter *padapter, u8 *da, unsigned short reason, int try_cnt,
+	int wait_ms)
+{
+	int ret;
+	int i = 0;
+	u32 start = rtw_get_current_time();
+
+	do
+	{
+		ret = _issue_deauth(padapter, da, reason, wait_ms>0?_TRUE:_FALSE);
+
+		i++;
+
+		if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
+			break;
+
+		if(i < try_cnt && wait_ms > 0 && ret==_FAIL)
+			rtw_msleep_os(wait_ms);
+
+	}while((i<try_cnt) && ((ret==_FAIL)||(wait_ms==0)));
+
+	if (ret != _FAIL) {
+		ret = _SUCCESS;
+		#ifndef DBG_XMIT_ACK
+		goto exit;
+		#endif
+	}
+
+	if (try_cnt && wait_ms) {
+		if (da)
+			DBG_871X(FUNC_ADPT_FMT" to "MAC_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(padapter), MAC_ARG(da), rtw_get_oper_ch(padapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+		else
+			DBG_871X(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
+				FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
+				ret==_SUCCESS?", acked":"", i, try_cnt, rtw_get_passing_time_ms(start));
+	}
+exit:
+	return ret;
+}
+
+void issue_action_spct_ch_switch(_adapter *padapter, u8 *ra, u8 new_ch, u8 ch_offset)
+{
+	_irqL	irqL;
+	_list		*plist, *phead;
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char				*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short			*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+
+	DBG_871X(FUNC_NDEV_FMT" ra="MAC_FMT", ch:%u, offset:%u\n",
+		FUNC_NDEV_ARG(padapter->pnetdev), MAC_ARG(ra), new_ch, ch_offset);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+		return;
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, ra, ETH_ALEN); /* RA */
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN); /* TA */
+	_rtw_memcpy(pwlanhdr->addr3, ra, ETH_ALEN); /* DA = RA */
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	/* category, action */
+	{
+		u8 category, action;
+		category = RTW_WLAN_CATEGORY_SPECTRUM_MGMT;
+		action = RTW_WLAN_ACTION_SPCT_CHL_SWITCH;
+
+		pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+		pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	}
+
+	pframe = rtw_set_ie_ch_switch(pframe, &(pattrib->pktlen), 0, new_ch, 0);
+	pframe = rtw_set_ie_secondary_ch_offset(pframe, &(pattrib->pktlen),
+		hal_ch_offset_to_secondary_ch_offset(ch_offset));
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+}
+
+#ifdef CONFIG_IEEE80211W
+void issue_action_SA_Query(_adapter *padapter, unsigned char *raddr, unsigned char action, unsigned short tid)
+{
+	u8	category = RTW_WLAN_CATEGORY_SA_QUERY;
+	u16	reason_code;
+	struct xmit_frame		*pmgntframe;
+	struct pkt_attrib		*pattrib;
+	u8					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	u16					*fctrl;
+	struct xmit_priv		*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct sta_info		*psta;
+	struct sta_priv		*pstapriv = &padapter->stapriv;
+	struct registry_priv	 	*pregpriv = &padapter->registrypriv;
+
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		DBG_871X("%s: alloc_mgtxmitframe fail\n", __FUNCTION__);
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	if(raddr)
+		_rtw_memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
+	else
+		_rtw_memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &category, &pattrib->pktlen);
+	pframe = rtw_set_fixed_ie(pframe, 1, &action, &pattrib->pktlen);
+
+	switch (action)
+	{
+		case 0: //SA Query req
+			pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)&pmlmeext->sa_query_seq, &pattrib->pktlen);
+			pmlmeext->sa_query_seq++;
+			//send sa query request to AP, AP should reply sa query response in 1 second
+			set_sa_query_timer(pmlmeext, 1000);
+			break;
+
+		case 1: //SA Query rsp
+			tid = cpu_to_le16(tid);
+			pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)&tid, &pattrib->pktlen);
+			break;
+		default:
+			break;
+	}
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+}
+#endif //CONFIG_IEEE80211W
+
+void issue_action_BA(_adapter *padapter, unsigned char *raddr, unsigned char action, unsigned short status)
+{
+	u8	category = RTW_WLAN_CATEGORY_BACK;
+	u16	start_seq;
+	u16	BA_para_set;
+	u16	reason_code;
+	u16	BA_timeout_value;
+	u16	BA_starting_seqctrl;
+	struct xmit_frame		*pmgntframe;
+	struct pkt_attrib		*pattrib;
+	u8					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	u16					*fctrl;
+	struct xmit_priv		*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct sta_info		*psta;
+	struct sta_priv		*pstapriv = &padapter->stapriv;
+	struct registry_priv	 	*pregpriv = &padapter->registrypriv;
+
+
+	DBG_871X("%s, category=%d, action=%d, status=%d\n", __FUNCTION__, category, action, status);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	//_rtw_memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+
+      status = cpu_to_le16(status);
+
+
+	if (category == 3)
+	{
+		switch (action)
+		{
+			case 0: //ADDBA req
+				do {
+					pmlmeinfo->dialogToken++;
+				} while (pmlmeinfo->dialogToken == 0);
+				pframe = rtw_set_fixed_ie(pframe, 1, &(pmlmeinfo->dialogToken), &(pattrib->pktlen));
+
+				BA_para_set = (0x1002 | ((status & 0xf) << 2)); //immediate ack & 64 buffer size
+				//sys_mib.BA_para_set = 0x0802; //immediate ack & 32 buffer size
+				BA_para_set = cpu_to_le16(BA_para_set);
+				pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(BA_para_set)), &(pattrib->pktlen));
+
+				//BA_timeout_value = 0xffff;//max: 65535 TUs(~ 65 ms)
+				BA_timeout_value = 5000;//~ 5ms
+				BA_timeout_value = cpu_to_le16(BA_timeout_value);
+				pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(BA_timeout_value)), &(pattrib->pktlen));
+
+				//if ((psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.MacAddress)) != NULL)
+				if ((psta = rtw_get_stainfo(pstapriv, raddr)) != NULL)
+				{
+					start_seq = (psta->sta_xmitpriv.txseq_tid[status & 0x07]&0xfff) + 1;
+
+					DBG_871X("BA_starting_seqctrl = %d for TID=%d\n", start_seq, status & 0x07);
+
+					psta->BA_starting_seqctrl[status & 0x07] = start_seq;
+
+					BA_starting_seqctrl = start_seq << 4;
+				}
+
+				BA_starting_seqctrl = cpu_to_le16(BA_starting_seqctrl);
+				pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(BA_starting_seqctrl)), &(pattrib->pktlen));
+				break;
+
+			case 1: //ADDBA rsp
+				pframe = rtw_set_fixed_ie(pframe, 1, &(pmlmeinfo->ADDBA_req.dialog_token), &(pattrib->pktlen));
+				pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&status), &(pattrib->pktlen));
+
+				//BA_para_set = cpu_to_le16((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x1000); //64 buffer size
+				BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x1000); //64 buffer size
+
+				if(pregpriv->ampdu_amsdu==0)//disabled
+					BA_para_set = cpu_to_le16(BA_para_set & ~BIT(0));
+				else if(pregpriv->ampdu_amsdu==1)//enabled
+					BA_para_set = cpu_to_le16(BA_para_set | BIT(0));
+				else //auto
+					BA_para_set = cpu_to_le16(BA_para_set);
+
+				pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(BA_para_set)), &(pattrib->pktlen));
+				pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(pmlmeinfo->ADDBA_req.BA_timeout_value)), &(pattrib->pktlen));
+				break;
+			case 2://DELBA
+				BA_para_set = (status & 0x1F) << 3;
+				BA_para_set = cpu_to_le16(BA_para_set);
+				pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(BA_para_set)), &(pattrib->pktlen));
+
+				reason_code = 37;//Requested from peer STA as it does not want to use the mechanism
+				reason_code = cpu_to_le16(reason_code);
+				pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(reason_code)), &(pattrib->pktlen));
+				break;
+			default:
+				break;
+		}
+	}
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+}
+
+static void issue_action_BSSCoexistPacket(_adapter *padapter)
+{
+	_irqL	irqL;
+	_list		*plist, *phead;
+	unsigned char category, action;
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char				*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short			*fctrl;
+	struct	wlan_network	*pnetwork = NULL;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	_queue		*queue	= &(pmlmepriv->scanned_queue);
+	u8 InfoContent[16] = {0};
+	u8 ICS[8][15];
+
+	if((pmlmepriv->num_FortyMHzIntolerant==0) || (pmlmepriv->num_sta_no_ht==0))
+		return;
+
+	if(_TRUE == pmlmeinfo->bwmode_updated)
+		return;
+
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+
+	category = RTW_WLAN_CATEGORY_PUBLIC;
+	action = ACT_PUBLIC_BSSCOEXIST;
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+
+
+	//
+	if(pmlmepriv->num_FortyMHzIntolerant>0)
+	{
+		u8 iedata=0;
+
+		iedata |= BIT(2);//20 MHz BSS Width Request
+
+		pframe = rtw_set_ie(pframe, EID_BSSCoexistence,  1, &iedata, &(pattrib->pktlen));
+
+	}
+
+
+	//
+	_rtw_memset(ICS, 0, sizeof(ICS));
+	if(pmlmepriv->num_sta_no_ht>0)
+	{
+		int i;
+
+		_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+		phead = get_list_head(queue);
+		plist = get_next(phead);
+
+		while(1)
+		{
+			int len;
+			u8 *p;
+			WLAN_BSSID_EX *pbss_network;
+
+			if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+				break;
+
+			pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+
+			plist = get_next(plist);
+
+			pbss_network = (WLAN_BSSID_EX *)&pnetwork->network;
+
+			p = rtw_get_ie(pbss_network->IEs + _FIXED_IE_LENGTH_, _HT_CAPABILITY_IE_, &len, pbss_network->IELength - _FIXED_IE_LENGTH_);
+			if((p==NULL) || (len==0))//non-HT
+			{
+				if((pbss_network->Configuration.DSConfig<=0) || (pbss_network->Configuration.DSConfig>14))
+					continue;
+
+				ICS[0][pbss_network->Configuration.DSConfig]=1;
+
+				if(ICS[0][0] == 0)
+					ICS[0][0] = 1;
+			}
+
+		}
+
+		_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+
+		for(i= 0;i<8;i++)
+		{
+			if(ICS[i][0] == 1)
+			{
+				int j, k = 0;
+
+				InfoContent[k] = i;
+				//SET_BSS_INTOLERANT_ELE_REG_CLASS(InfoContent,i);
+				k++;
+
+				for(j=1;j<=14;j++)
+				{
+					if(ICS[i][j]==1)
+					{
+						if(k<16)
+						{
+							InfoContent[k] = j; //channel number
+							//SET_BSS_INTOLERANT_ELE_CHANNEL(InfoContent+k, j);
+							k++;
+						}
+					}
+				}
+
+				pframe = rtw_set_ie(pframe, EID_BSSIntolerantChlReport, k, InfoContent, &(pattrib->pktlen));
+
+			}
+
+		}
+
+
+	}
+
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+}
+
+unsigned int send_delba(_adapter *padapter, u8 initiator, u8 *addr)
+{
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct sta_info *psta = NULL;
+	//struct recv_reorder_ctrl *preorder_ctrl;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u16 tid;
+
+	if((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
+		if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
+			return _SUCCESS;
+
+	psta = rtw_get_stainfo(pstapriv, addr);
+	if(psta==NULL)
+		return _SUCCESS;
+
+	//DBG_871X("%s:%s\n", __FUNCTION__, (initiator==0)?"RX_DIR":"TX_DIR");
+
+	if(initiator==0) // recipient
+	{
+		for(tid = 0;tid<MAXTID;tid++)
+		{
+			if(psta->recvreorder_ctrl[tid].enable == _TRUE)
+			{
+				DBG_871X("rx agg disable tid(%d)\n",tid);
+				issue_action_BA(padapter, addr, RTW_WLAN_ACTION_DELBA, (((tid <<1) |initiator)&0x1F));
+				psta->recvreorder_ctrl[tid].enable = _FALSE;
+				psta->recvreorder_ctrl[tid].indicate_seq = 0xffff;
+				#ifdef DBG_RX_SEQ
+				DBG_871X("DBG_RX_SEQ %s:%d indicate_seq:%u \n", __FUNCTION__, __LINE__,
+					psta->recvreorder_ctrl[tid].indicate_seq);
+				#endif
+			}
+		}
+	}
+	else if(initiator == 1)// originator
+	{
+		//DBG_871X("tx agg_enable_bitmap(0x%08x)\n", psta->htpriv.agg_enable_bitmap);
+		for(tid = 0;tid<MAXTID;tid++)
+		{
+			if(psta->htpriv.agg_enable_bitmap & BIT(tid))
+			{
+				DBG_871X("tx agg disable tid(%d)\n",tid);
+				issue_action_BA(padapter, addr, RTW_WLAN_ACTION_DELBA, (((tid <<1) |initiator)&0x1F) );
+				psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
+				psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
+
+			}
+		}
+	}
+
+	return _SUCCESS;
+
+}
+
+unsigned int send_beacon(_adapter *padapter)
+{
+	u8	bxmitok = _FALSE;
+	int	issue=0;
+	int poll = 0;
+//#ifdef CONFIG_CONCURRENT_MODE
+	//struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	//struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	//_adapter *pbuddy_adapter = padapter->pbuddy_adapter;
+	//struct mlme_priv *pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+//#endif
+
+#ifdef CONFIG_PCI_HCI
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	issue_beacon(padapter);
+
+	return _SUCCESS;
+
+#endif
+
+#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI) || defined(CONFIG_GSPI_HCI)
+	u32 start = rtw_get_current_time();
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_BCN_VALID, NULL);
+	do{
+		issue_beacon(padapter);
+		issue++;
+		do {
+			rtw_yield_os();
+			rtw_hal_get_hwreg(padapter, HW_VAR_BCN_VALID, (u8 *)(&bxmitok));
+			poll++;
+		}while((poll%10)!=0 && _FALSE == bxmitok && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
+
+	}while(_FALSE == bxmitok && issue<100 && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
+
+	if(padapter->bSurpriseRemoved || padapter->bDriverStopped)
+	{
+		return _FAIL;
+	}
+	if(_FALSE == bxmitok)
+	{
+		DBG_871X("%s fail! %u ms\n", __FUNCTION__, rtw_get_passing_time_ms(start));
+		return _FAIL;
+	}
+	else
+	{
+		u32 passing_time = rtw_get_passing_time_ms(start);
+
+		if(passing_time > 100 || issue > 3)
+			DBG_871X("%s success, issue:%d, poll:%d, %u ms\n", __FUNCTION__, issue, poll, rtw_get_passing_time_ms(start));
+		//else
+		//	DBG_871X("%s success, issue:%d, poll:%d, %u ms\n", __FUNCTION__, issue, poll, rtw_get_passing_time_ms(start));
+
+		return _SUCCESS;
+	}
+
+#endif
+
+}
+
+/****************************************************************************
+
+Following are some utitity fuctions for WiFi MLME
+
+*****************************************************************************/
+
+BOOLEAN IsLegal5GChannel(
+	IN PADAPTER			Adapter,
+	IN u8			channel)
+{
+
+	int i=0;
+	u8 Channel_5G[45] = {36,38,40,42,44,46,48,50,52,54,56,58,
+		60,62,64,100,102,104,106,108,110,112,114,116,118,120,122,
+		124,126,128,130,132,134,136,138,140,149,151,153,155,157,159,
+		161,163,165};
+	for(i=0;i<sizeof(Channel_5G);i++)
+		if(channel == Channel_5G[i])
+			return _TRUE;
+	return _FALSE;
+}
+
+void site_survey(_adapter *padapter)
+{
+	unsigned char		survey_channel = 0, val8;
+	RT_SCAN_TYPE	ScanType = SCAN_PASSIVE;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u32 initialgain = 0;
+	u8 restore_initial_gain = 1;
+
+#ifdef CONFIG_P2P
+
+#ifdef CONFIG_CONCURRENT_MODE
+
+#ifdef CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+	u8 stay_buddy_ch = 0;
+#endif //CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+#endif //CONFIG_CONCURRENT_MODE
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+	static unsigned char  prev_survey_channel = 0;
+	static unsigned int p2p_scan_count = 0;
+
+
+	if ( ( pwdinfo->rx_invitereq_info.scan_op_ch_only ) || ( pwdinfo->p2p_info.scan_op_ch_only ) )
+	{
+		if ( pwdinfo->rx_invitereq_info.scan_op_ch_only )
+		{
+			survey_channel = pwdinfo->rx_invitereq_info.operation_ch[pmlmeext->sitesurvey_res.channel_idx];
+		}
+		else
+		{
+			survey_channel = pwdinfo->p2p_info.operation_ch[pmlmeext->sitesurvey_res.channel_idx];
+		}
+		ScanType = SCAN_ACTIVE;
+	}
+	else if(rtw_p2p_findphase_ex_is_social(pwdinfo))
+	{
+		//	Commented by Albert 2011/06/03
+		//	The driver is in the find phase, it should go through the social channel.
+		int ch_set_idx;
+		survey_channel = pwdinfo->social_chan[pmlmeext->sitesurvey_res.channel_idx];
+		ch_set_idx = rtw_ch_set_search_ch(pmlmeext->channel_set, survey_channel);
+		if (ch_set_idx >= 0)
+			ScanType = pmlmeext->channel_set[ch_set_idx].ScanType;
+		else
+			ScanType = SCAN_ACTIVE;
+	}
+	else
+#endif //CONFIG_P2P
+	{
+		struct rtw_ieee80211_channel *ch;
+		if (pmlmeext->sitesurvey_res.channel_idx < pmlmeext->sitesurvey_res.ch_num) {
+			ch = &pmlmeext->sitesurvey_res.ch[pmlmeext->sitesurvey_res.channel_idx];
+			survey_channel = ch->hw_value;
+			ScanType = (ch->flags & RTW_IEEE80211_CHAN_PASSIVE_SCAN) ? SCAN_PASSIVE : SCAN_ACTIVE;
+		}
+	}
+
+	if (0)
+	DBG_871X(FUNC_ADPT_FMT" ch:%u(cnt:%u,idx:%d) at %dms, %c%c%c\n"
+		, FUNC_ADPT_ARG(padapter)
+		, survey_channel
+		, pwdinfo->find_phase_state_exchange_cnt, pmlmeext->sitesurvey_res.channel_idx
+		, rtw_get_passing_time_ms(padapter->mlmepriv.scan_start_time)
+		, ScanType?'A':'P', pmlmeext->sitesurvey_res.scan_mode?'A':'P'
+		, pmlmeext->sitesurvey_res.ssid[0].SsidLength?'S':' '
+	);
+
+	if(survey_channel != 0)
+	{
+		//PAUSE 4-AC Queue when site_survey
+		//rtw_hal_get_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8));
+		//val8 |= 0x0f;
+		//rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8));
+#ifdef CONFIG_CONCURRENT_MODE
+#ifdef CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+		if((padapter->pbuddy_adapter->mlmeextpriv.mlmext_info.state&0x03) == WIFI_FW_AP_STATE)
+		{
+			if( pmlmeinfo->scan_cnt == RTW_SCAN_NUM_OF_CH )
+			{
+				pmlmeinfo->scan_cnt = 0;
+				survey_channel = pbuddy_mlmeext->cur_channel;
+				stay_buddy_ch = 1;
+			}
+			else
+			{
+				if( pmlmeinfo->scan_cnt == 0 )
+					stay_buddy_ch = 2;
+				pmlmeinfo->scan_cnt++;
+			}
+		}
+#endif //CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+#endif //CONFIG_CONCURRENT_MODE
+		if(pmlmeext->sitesurvey_res.channel_idx == 0)
+		{
+			set_channel_bwmode(padapter, survey_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+		}
+		else
+		{
+			SelectChannel(padapter, survey_channel);
+		}
+
+#ifdef CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+		if( stay_buddy_ch == 1 )
+		{
+			val8 = 0; //survey done
+			rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+
+			if(check_buddy_mlmeinfo_state(padapter, WIFI_FW_AP_STATE) &&
+				check_buddy_fwstate(padapter, _FW_LINKED))
+			{
+				update_beacon(padapter->pbuddy_adapter, 0, NULL, _TRUE);
+			}
+		}
+		else if( stay_buddy_ch == 2 )
+		{
+			val8 = 1; //under site survey
+			rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+		}
+#endif //CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+
+		if(ScanType == SCAN_ACTIVE) //obey the channel plan setting...
+		{
+			#ifdef CONFIG_P2P
+			if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_SCAN) ||
+				rtw_p2p_chk_state(pwdinfo, P2P_STATE_FIND_PHASE_SEARCH)
+			)
+			{
+				issue_probereq_p2p(padapter, NULL);
+				issue_probereq_p2p(padapter, NULL);
+				issue_probereq_p2p(padapter, NULL);
+			}
+			else
+			#endif //CONFIG_P2P
+			{
+				int i;
+				for(i=0;i<RTW_SSID_SCAN_AMOUNT;i++){
+					if(pmlmeext->sitesurvey_res.ssid[i].SsidLength) {
+						//todo: to issue two probe req???
+						issue_probereq(padapter, &(pmlmeext->sitesurvey_res.ssid[i]), NULL);
+						//rtw_msleep_os(SURVEY_TO>>1);
+						issue_probereq(padapter, &(pmlmeext->sitesurvey_res.ssid[i]), NULL);
+					} else {
+						break;
+					}
+				}
+
+				if(pmlmeext->sitesurvey_res.scan_mode == SCAN_ACTIVE) {
+					//todo: to issue two probe req???
+					issue_probereq(padapter, NULL, NULL);
+					//rtw_msleep_os(SURVEY_TO>>1);
+					issue_probereq(padapter, NULL, NULL);
+				}
+			}
+		}
+
+#ifdef CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+		if( stay_buddy_ch == 1 )
+			set_survey_timer(pmlmeext, pmlmeext->chan_scan_time * RTW_STAY_AP_CH_MILLISECOND );
+		else
+#endif //CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+			set_survey_timer(pmlmeext, pmlmeext->chan_scan_time);
+
+	}
+	else
+	{
+
+		//	channel number is 0 or this channel is not valid.
+
+#ifdef CONFIG_CONCURRENT_MODE
+		u8 cur_channel;
+		u8 cur_bwmode;
+		u8 cur_ch_offset;
+
+		if (rtw_get_ch_setting_union(padapter, &cur_channel, &cur_bwmode, &cur_ch_offset) != 0)
+		{
+			if (0)
+			DBG_871X(FUNC_ADPT_FMT" back to linked union - ch:%u, bw:%u, offset:%u\n",
+				FUNC_ADPT_ARG(padapter), cur_channel, cur_bwmode, cur_ch_offset);
+		}
+		#ifdef CONFIG_IOCTL_CFG80211
+		else if(padapter->pbuddy_adapter
+			&& pbuddy_adapter->wdinfo.driver_interface == DRIVER_CFG80211
+			&& wdev_to_priv(pbuddy_adapter->rtw_wdev)->p2p_enabled
+			&& rtw_p2p_chk_state(&pbuddy_adapter->wdinfo, P2P_STATE_LISTEN)
+			)
+		{
+			cur_channel = pbuddy_adapter->wdinfo.listen_channel;
+			cur_bwmode = pbuddy_mlmeext->cur_bwmode;
+			cur_ch_offset = pbuddy_mlmeext->cur_ch_offset;
+		}
+		#endif
+		else
+		{
+			cur_channel = pmlmeext->cur_channel;
+			cur_bwmode = pmlmeext->cur_bwmode;
+			cur_ch_offset = pmlmeext->cur_ch_offset;
+		}
+#endif
+
+
+#ifdef CONFIG_P2P
+		if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_SCAN) || rtw_p2p_chk_state(pwdinfo, P2P_STATE_FIND_PHASE_SEARCH))
+		{
+			if( ( pwdinfo->rx_invitereq_info.scan_op_ch_only ) || ( pwdinfo->p2p_info.scan_op_ch_only ) )
+			{
+				//	Set the find_phase_state_exchange_cnt to P2P_FINDPHASE_EX_CNT.
+				//	This will let the following flow to run the scanning end.
+				rtw_p2p_findphase_ex_set(pwdinfo, P2P_FINDPHASE_EX_MAX);
+			}
+			#ifdef CONFIG_DBG_P2P
+			DBG_871X( "[%s] find phase exchange cnt = %d\n", __FUNCTION__, pwdinfo->find_phase_state_exchange_cnt );
+			#endif
+		}
+
+		if(rtw_p2p_findphase_ex_is_needed(pwdinfo))
+		{
+			//	Set the P2P State to the listen state of find phase and set the current channel to the listen channel
+			set_channel_bwmode(padapter, pwdinfo->listen_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_FIND_PHASE_LISTEN);
+			pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
+
+			//turn on dynamic functions
+			Restore_DM_Func_Flag(padapter);
+			//Switch_DM_Func(padapter, DYNAMIC_FUNC_DIG|DYNAMIC_FUNC_HP|DYNAMIC_FUNC_SS, _TRUE);
+
+			_set_timer( &pwdinfo->find_phase_timer, ( u32 ) ( ( u32 ) ( pwdinfo->listen_dwell ) * 100 ) );
+		}
+		else
+#endif //CONFIG_P2P
+		{
+
+#ifdef CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+			pmlmeinfo->scan_cnt = 0;
+#endif //CONFIG_DMP_STA_NODE_SCAN_UNDER_AP_MODE
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+			// 20100721:Interrupt scan operation here.
+			// For SW antenna diversity before link, it needs to switch to another antenna and scan again.
+			// It compares the scan result and select beter one to do connection.
+			if(rtw_hal_antdiv_before_linked(padapter))
+			{
+				pmlmeext->sitesurvey_res.bss_cnt = 0;
+				pmlmeext->sitesurvey_res.channel_idx = -1;
+				pmlmeext->chan_scan_time = SURVEY_TO /2;
+				set_survey_timer(pmlmeext, pmlmeext->chan_scan_time);
+				return;
+			}
+#endif
+
+#ifdef CONFIG_P2P
+			if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_SCAN) || rtw_p2p_chk_state(pwdinfo, P2P_STATE_FIND_PHASE_SEARCH))
+			{
+			#ifdef CONFIG_CONCURRENT_MODE
+				if( pwdinfo->driver_interface == DRIVER_WEXT )
+				{
+					if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+					{
+						_set_timer( &pwdinfo->ap_p2p_switch_timer, 500 );
+					}
+				}
+				rtw_p2p_set_state(pwdinfo, rtw_p2p_pre_state(pwdinfo));
+			#else
+				rtw_p2p_set_state(pwdinfo, rtw_p2p_pre_state(pwdinfo));
+			#endif
+			}
+			rtw_p2p_findphase_ex_set(pwdinfo, P2P_FINDPHASE_EX_NONE);
+#endif //CONFIG_P2P
+
+			pmlmeext->sitesurvey_res.state = SCAN_COMPLETE;
+
+			//switch back to the original channel
+			//SelectChannel(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset);
+
+			{
+#ifdef CONFIG_CONCURRENT_MODE
+				set_channel_bwmode(padapter, cur_channel, cur_ch_offset, cur_bwmode);
+#else
+#ifdef CONFIG_DUALMAC_CONCURRENT
+				dc_set_channel_bwmode_survey_done(padapter);
+#else
+				if( pwdinfo->driver_interface == DRIVER_WEXT )
+				{
+					if( rtw_p2p_chk_state(pwdinfo, P2P_STATE_LISTEN) )
+					{
+						set_channel_bwmode(padapter, pwdinfo->listen_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+					}
+					else
+						set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+				}
+				else if( pwdinfo->driver_interface == DRIVER_CFG80211 )
+				{
+					set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+				}
+#endif //CONFIG_DUALMAC_CONCURRENT
+#endif //CONFIG_CONCURRENT_MODE
+			}
+
+			//flush 4-AC Queue after site_survey
+			//val8 = 0;
+			//rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8));
+
+			val8 = 0; //survey done
+			rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+
+			//config MSR
+			Set_MSR(padapter, (pmlmeinfo->state & 0x3));
+
+
+#ifdef CONFIG_IOCTL_CFG80211
+			if((wdev_to_priv(padapter->rtw_wdev))->p2p_enabled == _TRUE)
+			{
+				restore_initial_gain = 0;
+			}
+#endif //CONFIG_IOCTL_CFG80211
+
+			if(restore_initial_gain == 1)
+			{
+				initialgain = 0xff; //restore RX GAIN
+				rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
+			}
+
+			//turn on dynamic functions
+			Restore_DM_Func_Flag(padapter);
+			//Switch_DM_Func(padapter, DYNAMIC_FUNC_DIG|DYNAMIC_FUNC_HP|DYNAMIC_FUNC_SS, _TRUE);
+
+			if (is_client_associated_to_ap(padapter) == _TRUE)
+			{
+				issue_nulldata(padapter, NULL, 0, 3, 500);
+
+#ifdef CONFIG_CONCURRENT_MODE
+				if(is_client_associated_to_ap(padapter->pbuddy_adapter) == _TRUE)
+				{
+					DBG_871X("adapter is surveydone(buddy_adapter is linked), issue nulldata(pwrbit=0)\n");
+
+					issue_nulldata(padapter->pbuddy_adapter, NULL, 0, 3, 500);
+				}
+#endif
+			}
+#ifdef CONFIG_CONCURRENT_MODE
+			else if(is_client_associated_to_ap(padapter->pbuddy_adapter) == _TRUE)
+			{
+				issue_nulldata(padapter->pbuddy_adapter, NULL, 0, 3, 500);
+			}
+#endif
+
+			report_surveydone_event(padapter);
+
+			pmlmeext->chan_scan_time = SURVEY_TO;
+			pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
+
+			issue_action_BSSCoexistPacket(padapter);
+			issue_action_BSSCoexistPacket(padapter);
+			issue_action_BSSCoexistPacket(padapter);
+
+		}
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if(check_buddy_mlmeinfo_state(padapter, WIFI_FW_AP_STATE) &&
+			check_buddy_fwstate(padapter, _FW_LINKED))
+		{
+
+			DBG_871X("survey done, current CH=%d, BW=%d, offset=%d\n", cur_channel, cur_bwmode, cur_ch_offset);
+
+			DBG_871X("restart pbuddy_adapter's beacon\n");
+
+			update_beacon(padapter->pbuddy_adapter, 0, NULL, _TRUE);
+		}
+#endif
+
+	}
+
+	return;
+
+}
+
+//collect bss info from Beacon and Probe response frames.
+u8 collect_bss_info(_adapter *padapter, union recv_frame *precv_frame, WLAN_BSSID_EX *bssid)
+{
+	int	i;
+	u32	len;
+	u8	*p;
+	u16	val16, subtype;
+	u8	*pframe = precv_frame->u.hdr.rx_data;
+	u32	packet_len = precv_frame->u.hdr.len;
+	struct registry_priv 	*pregistrypriv = &padapter->registrypriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	len = packet_len - sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	if (len > MAX_IE_SZ)
+	{
+		//DBG_871X("IE too long for survey event\n");
+		return _FAIL;
+	}
+
+	_rtw_memset(bssid, 0, sizeof(WLAN_BSSID_EX));
+
+	subtype = GetFrameSubType(pframe);
+
+	if(subtype==WIFI_BEACON)
+		bssid->Reserved[0] = 1;
+	else
+		bssid->Reserved[0] = 0;
+
+	bssid->Length = sizeof(WLAN_BSSID_EX) - MAX_IE_SZ + len;
+
+	//below is to copy the information element
+	bssid->IELength = len;
+	_rtw_memcpy(bssid->IEs, (pframe + sizeof(struct rtw_ieee80211_hdr_3addr)), bssid->IELength);
+
+	//get the signal strength
+	bssid->PhyInfo.SignalQuality = precv_frame->u.hdr.attrib.signal_qual;//in percentage
+	bssid->PhyInfo.SignalStrength = precv_frame->u.hdr.attrib.signal_strength;//in percentage
+	bssid->Rssi = precv_frame->u.hdr.attrib.RecvSignalPower; // in dBM.raw data
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+	//rtw_hal_get_hwreg(padapter, HW_VAR_CURRENT_ANTENNA, (u8 *)(&bssid->PhyInfo.Optimum_antenna));
+	rtw_hal_get_def_var(padapter, HAL_DEF_CURRENT_ANTENNA,  &bssid->PhyInfo.Optimum_antenna);
+#endif
+
+	// checking SSID
+	if ((p = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _SSID_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_)) == NULL)
+	{
+		DBG_871X("marc: cannot find SSID for survey event\n");
+		return _FAIL;
+	}
+
+	if (*(p + 1))
+	{
+		if (len > NDIS_802_11_LENGTH_SSID)
+		{
+			DBG_871X("%s()-%d: IE too long (%d) for survey event\n", __FUNCTION__, __LINE__, len);
+			return _FAIL;
+		}
+		_rtw_memcpy(bssid->Ssid.Ssid, (p + 2), *(p + 1));
+		bssid->Ssid.SsidLength = *(p + 1);
+	}
+	else
+	{
+		bssid->Ssid.SsidLength = 0;
+	}
+
+	_rtw_memset(bssid->SupportedRates, 0, NDIS_802_11_LENGTH_RATES_EX);
+
+	//checking rate info...
+	i = 0;
+	p = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _SUPPORTEDRATES_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
+	if (p != NULL)
+	{
+		if (len > NDIS_802_11_LENGTH_RATES_EX)
+		{
+			DBG_871X("%s()-%d: IE too long (%d) for survey event\n", __FUNCTION__, __LINE__, len);
+			return _FAIL;
+		}
+		_rtw_memcpy(bssid->SupportedRates, (p + 2), len);
+		i = len;
+	}
+
+	p = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _EXT_SUPPORTEDRATES_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
+	if (p != NULL)
+	{
+		if (len > (NDIS_802_11_LENGTH_RATES_EX-i))
+		{
+			DBG_871X("%s()-%d: IE too long (%d) for survey event\n", __FUNCTION__, __LINE__, len);
+			return _FAIL;
+		}
+		_rtw_memcpy(bssid->SupportedRates + i, (p + 2), len);
+	}
+
+	//todo:
+#if 0
+	if (judge_network_type(bssid->SupportedRates, (len + i)) == WIRELESS_11B)
+	{
+		bssid->NetworkTypeInUse = Ndis802_11DS;
+	}
+	else
+#endif
+	{
+		bssid->NetworkTypeInUse = Ndis802_11OFDM24;
+	}
+
+	if (bssid->IELength < 12)
+		return _FAIL;
+
+	// Checking for DSConfig
+	p = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _DSSET_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
+
+	bssid->Configuration.DSConfig = 0;
+	bssid->Configuration.Length = 0;
+
+	if (p)
+	{
+		bssid->Configuration.DSConfig = *(p + 2);
+	}
+	else
+	{// In 5G, some ap do not have DSSET IE
+		// checking HT info for channel
+		p = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _HT_ADD_INFO_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
+		if(p)
+		{
+			struct HT_info_element *HT_info = (struct HT_info_element *)(p + 2);
+			bssid->Configuration.DSConfig = HT_info->primary_channel;
+		}
+		else
+		{ // use current channel
+			bssid->Configuration.DSConfig = rtw_get_oper_ch(padapter);
+		}
+	}
+
+	_rtw_memcpy(&bssid->Configuration.BeaconPeriod, rtw_get_beacon_interval_from_ie(bssid->IEs), 2);
+	bssid->Configuration.BeaconPeriod = le32_to_cpu(bssid->Configuration.BeaconPeriod);
+
+	val16 = rtw_get_capability((WLAN_BSSID_EX *)bssid);
+
+	if (val16 & BIT(0))
+	{
+		bssid->InfrastructureMode = Ndis802_11Infrastructure;
+		_rtw_memcpy(bssid->MacAddress, GetAddr2Ptr(pframe), ETH_ALEN);
+	}
+	else
+	{
+		bssid->InfrastructureMode = Ndis802_11IBSS;
+		_rtw_memcpy(bssid->MacAddress, GetAddr3Ptr(pframe), ETH_ALEN);
+	}
+
+	if (val16 & BIT(4))
+		bssid->Privacy = 1;
+	else
+		bssid->Privacy = 0;
+
+	bssid->Configuration.ATIMWindow = 0;
+
+	//20/40 BSS Coexistence check
+	if((pregistrypriv->wifi_spec==1) && (_FALSE == pmlmeinfo->bwmode_updated))
+	{
+		struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+		p = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _HT_CAPABILITY_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
+		if(p && len>0)
+		{
+			struct HT_caps_element	*pHT_caps;
+			pHT_caps = (struct HT_caps_element	*)(p + 2);
+
+			if(pHT_caps->u.HT_cap_element.HT_caps_info&BIT(14))
+			{
+				pmlmepriv->num_FortyMHzIntolerant++;
+			}
+		}
+		else
+		{
+			pmlmepriv->num_sta_no_ht++;
+		}
+
+	}
+
+#ifdef CONFIG_INTEL_WIDI
+	//process_intel_widi_query_or_tigger(padapter, bssid);
+	if(process_intel_widi_query_or_tigger(padapter, bssid))
+	{
+		return _FAIL;
+	}
+#endif // CONFIG_INTEL_WIDI
+
+	#if defined(DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED) & 1
+	if(strcmp(bssid->Ssid.Ssid, DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED) == 0) {
+		DBG_871X("Receiving %s("MAC_FMT", DSConfig:%u) from ch%u with ss:%3u, sq:%3u, RawRSSI:%3ld\n"
+			, bssid->Ssid.Ssid, MAC_ARG(bssid->MacAddress), bssid->Configuration.DSConfig
+			, rtw_get_oper_ch(padapter)
+			, bssid->PhyInfo.SignalStrength, bssid->PhyInfo.SignalQuality, bssid->Rssi
+		);
+	}
+	#endif
+
+	// mark bss info receving from nearby channel as SignalQuality 101
+	if(bssid->Configuration.DSConfig != rtw_get_oper_ch(padapter))
+	{
+		bssid->PhyInfo.SignalQuality= 101;
+	}
+
+	return _SUCCESS;
+}
+
+void start_create_ibss(_adapter* padapter)
+{
+	unsigned short	caps;
+	u8	val8;
+	u8	join_type;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX		*pnetwork = (WLAN_BSSID_EX*)(&(pmlmeinfo->network));
+	pmlmeext->cur_channel = (u8)pnetwork->Configuration.DSConfig;
+	pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
+
+	//update wireless mode
+	update_wireless_mode(padapter);
+
+	//udpate capability
+	caps = rtw_get_capability((WLAN_BSSID_EX *)pnetwork);
+	update_capinfo(padapter, caps);
+	if(caps&cap_IBSS)//adhoc master
+	{
+		//set_opmode_cmd(padapter, adhoc);//removed
+
+		val8 = 0xcf;
+		rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
+
+		//switch channel
+		//SelectChannel(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE);
+		set_channel_bwmode(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+
+		beacon_timing_control(padapter);
+
+		//set msr to WIFI_FW_ADHOC_STATE
+		pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
+		Set_MSR(padapter, (pmlmeinfo->state & 0x3));
+
+		//issue beacon
+		if(send_beacon(padapter)==_FAIL)
+		{
+			RT_TRACE(_module_rtl871x_mlme_c_,_drv_err_,("issuing beacon frame fail....\n"));
+
+			report_join_res(padapter, -1);
+			pmlmeinfo->state = WIFI_FW_NULL_STATE;
+		}
+		else
+		{
+			rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, padapter->registrypriv.dev_network.MacAddress);
+			join_type = 0;
+			rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
+
+			report_join_res(padapter, 1);
+			pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
+		}
+	}
+	else
+	{
+		DBG_871X("start_create_ibss, invalid cap:%x\n", caps);
+		return;
+	}
+
+}
+
+void start_clnt_join(_adapter* padapter)
+{
+	unsigned short	caps;
+	u8	val8;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX		*pnetwork = (WLAN_BSSID_EX*)(&(pmlmeinfo->network));
+
+	//update wireless mode
+	update_wireless_mode(padapter);
+
+	//udpate capability
+	caps = rtw_get_capability((WLAN_BSSID_EX *)pnetwork);
+	update_capinfo(padapter, caps);
+	if (caps&cap_ESS)
+	{
+		Set_MSR(padapter, WIFI_FW_STATION_STATE);
+
+		val8 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_8021X)? 0xcc: 0xcf;
+		rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
+
+		#ifdef CONFIG_DEAUTH_BEFORE_CONNECT
+		// Because of AP's not receiving deauth before
+		// AP may: 1)not response auth or 2)deauth us after link is complete
+		// issue deauth before issuing auth to deal with the situation
+
+		//	Commented by Albert 2012/07/21
+		//	For the Win8 P2P connection, it will be hard to have a successful connection if this Wi-Fi doesn't connect to it.
+		{
+			#ifdef CONFIG_P2P
+			_queue *queue = &(padapter->mlmepriv.scanned_queue);
+			_list	*head = get_list_head(queue);
+			_list *pos = get_next(head);
+			struct wlan_network *scanned = NULL;
+			u8 ie_offset = 0;
+			_irqL irqL;
+			bool has_p2p_ie = _FALSE;
+
+			_enter_critical_bh(&(padapter->mlmepriv.scanned_queue.lock), &irqL);
+
+			for (pos = get_next(head);!rtw_end_of_queue_search(head, pos); pos = get_next(pos)) {
+
+				scanned = LIST_CONTAINOR(pos, struct wlan_network, list);
+				if(scanned==NULL)
+					rtw_warn_on(1);
+
+				if (_rtw_memcmp(&(scanned->network.Ssid), &(pnetwork->Ssid), sizeof(NDIS_802_11_SSID)) == _TRUE
+					&& _rtw_memcmp(scanned->network.MacAddress, pnetwork->MacAddress, sizeof(NDIS_802_11_MAC_ADDRESS)) == _TRUE
+				) {
+					ie_offset = (scanned->network.Reserved[0] == 2? 0:12);
+					if (rtw_get_p2p_ie(scanned->network.IEs+ie_offset, scanned->network.IELength-ie_offset, NULL, NULL))
+						has_p2p_ie = _TRUE;
+					break;
+				}
+			}
+
+			_exit_critical_bh(&(padapter->mlmepriv.scanned_queue.lock), &irqL);
+
+			if (scanned == NULL || rtw_end_of_queue_search(head, pos) || has_p2p_ie == _FALSE)
+			#endif /* CONFIG_P2P */
+				issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, 5, 100);
+		}
+		#endif /* CONFIG_DEAUTH_BEFORE_CONNECT */
+
+		//here wait for receiving the beacon to start auth
+		//and enable a timer
+		set_link_timer(pmlmeext, decide_wait_for_beacon_timeout(pmlmeinfo->bcn_interval));
+
+		pmlmeinfo->state = WIFI_FW_AUTH_NULL | WIFI_FW_STATION_STATE;
+	}
+	else if (caps&cap_IBSS) //adhoc client
+	{
+		Set_MSR(padapter, WIFI_FW_ADHOC_STATE);
+
+		val8 = 0xcf;
+		rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
+
+		//switch channel
+		set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+
+		beacon_timing_control(padapter);
+
+		pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
+
+		report_join_res(padapter, 1);
+	}
+	else
+	{
+		//DBG_871X("marc: invalid cap:%x\n", caps);
+		return;
+	}
+
+}
+
+void start_clnt_auth(_adapter* padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	_cancel_timer_ex(&pmlmeext->link_timer);
+
+	pmlmeinfo->state &= (~WIFI_FW_AUTH_NULL);
+	pmlmeinfo->state |= WIFI_FW_AUTH_STATE;
+
+	pmlmeinfo->auth_seq = 1;
+	pmlmeinfo->reauth_count = 0;
+	pmlmeinfo->reassoc_count = 0;
+	pmlmeinfo->link_count = 0;
+	pmlmeext->retry = 0;
+
+
+	issue_auth(padapter, NULL, 0);
+
+	set_link_timer(pmlmeext, REAUTH_TO);
+
+}
+
+
+void start_clnt_assoc(_adapter* padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	_cancel_timer_ex(&pmlmeext->link_timer);
+
+	pmlmeinfo->state &= (~(WIFI_FW_AUTH_NULL | WIFI_FW_AUTH_STATE));
+	pmlmeinfo->state |= (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE);
+
+	issue_assocreq(padapter);
+
+	set_link_timer(pmlmeext, REASSOC_TO);
+}
+
+unsigned int receive_disconnect(_adapter *padapter, unsigned char *MacAddr, unsigned short reason)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	//check A3
+	if (!(_rtw_memcmp(MacAddr, get_my_bssid(&pmlmeinfo->network), ETH_ALEN)))
+		return _SUCCESS;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	if((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
+	{
+		if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)
+		{
+			pmlmeinfo->state = WIFI_FW_NULL_STATE;
+			report_del_sta_event(padapter, MacAddr, reason);
+
+		}
+		else if (pmlmeinfo->state & WIFI_FW_LINKING_STATE)
+		{
+			pmlmeinfo->state = WIFI_FW_NULL_STATE;
+			report_join_res(padapter, -2);
+		}
+	}
+
+	return _SUCCESS;
+}
+
+#ifdef CONFIG_80211D
+static void process_80211d(PADAPTER padapter, WLAN_BSSID_EX *bssid)
+{
+	struct registry_priv *pregistrypriv;
+	struct mlme_ext_priv *pmlmeext;
+	RT_CHANNEL_INFO *chplan_new;
+	u8 channel;
+	u8 i;
+
+
+	pregistrypriv = &padapter->registrypriv;
+	pmlmeext = &padapter->mlmeextpriv;
+
+	// Adjust channel plan by AP Country IE
+	if (pregistrypriv->enable80211d &&
+		(!pmlmeext->update_channel_plan_by_ap_done))
+	{
+		u8 *ie, *p;
+		u32 len;
+		RT_CHANNEL_PLAN chplan_ap;
+		RT_CHANNEL_INFO chplan_sta[MAX_CHANNEL_NUM];
+		u8 country[4];
+		u8 fcn; // first channel number
+		u8 noc; // number of channel
+		u8 j, k;
+
+		ie = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _COUNTRY_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
+		if (!ie) return;
+		if (len < 6) return;
+
+		ie += 2;
+		p = ie;
+		ie += len;
+
+		_rtw_memset(country, 0, 4);
+		_rtw_memcpy(country, p, 3);
+		p += 3;
+		RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
+				("%s: 802.11d country=%s\n", __FUNCTION__, country));
+
+		i = 0;
+		while ((ie - p) >= 3)
+		{
+			fcn = *(p++);
+			noc = *(p++);
+			p++;
+
+			for (j = 0; j < noc; j++)
+			{
+				if (fcn <= 14) channel = fcn + j; // 2.4 GHz
+				else channel = fcn + j*4; // 5 GHz
+
+				chplan_ap.Channel[i++] = channel;
+			}
+		}
+		chplan_ap.Len = i;
+
+#ifdef CONFIG_DEBUG_RTL871X
+#ifdef PLATFORM_LINUX
+		i = 0;
+		printk("%s: AP[%s] channel plan {", __func__, bssid->Ssid.Ssid);
+		while ((i < chplan_ap.Len) && (chplan_ap.Channel[i] != 0))
+		{
+			printk("%02d,", chplan_ap.Channel[i]);
+			i++;
+		}
+		printk("}\n");
+#endif
+#endif
+
+		_rtw_memcpy(chplan_sta, pmlmeext->channel_set, sizeof(chplan_sta));
+#ifdef CONFIG_DEBUG_RTL871X
+#ifdef PLATFORM_LINUX
+		i = 0;
+		printk("%s: STA channel plan {", __func__);
+		while ((i < MAX_CHANNEL_NUM) && (chplan_sta[i].ChannelNum != 0))
+		{
+			printk("%02d(%c),", chplan_sta[i].ChannelNum, chplan_sta[i].ScanType==SCAN_PASSIVE?'p':'a');
+			i++;
+		}
+		printk("}\n");
+#endif
+#endif
+
+		_rtw_memset(pmlmeext->channel_set, 0, sizeof(pmlmeext->channel_set));
+		chplan_new = pmlmeext->channel_set;
+
+		i = j = k = 0;
+		if (pregistrypriv->wireless_mode & WIRELESS_11G)
+		{
+			do {
+				if ((i == MAX_CHANNEL_NUM) ||
+					(chplan_sta[i].ChannelNum == 0) ||
+					(chplan_sta[i].ChannelNum > 14))
+					break;
+
+				if ((j == chplan_ap.Len) || (chplan_ap.Channel[j] > 14))
+					break;
+
+				if (chplan_sta[i].ChannelNum == chplan_ap.Channel[j])
+				{
+					chplan_new[k].ChannelNum = chplan_ap.Channel[j];
+					chplan_new[k].ScanType = SCAN_ACTIVE;
+					i++;
+					j++;
+					k++;
+				}
+				else if (chplan_sta[i].ChannelNum < chplan_ap.Channel[j])
+				{
+					chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
+//					chplan_new[k].ScanType = chplan_sta[i].ScanType;
+					chplan_new[k].ScanType = SCAN_PASSIVE;
+					i++;
+					k++;
+				}
+				else if (chplan_sta[i].ChannelNum > chplan_ap.Channel[j])
+				{
+					chplan_new[k].ChannelNum = chplan_ap.Channel[j];
+					chplan_new[k].ScanType = SCAN_ACTIVE;
+					j++;
+					k++;
+				}
+			} while (1);
+
+			// change AP not support channel to Passive scan
+			while ((i < MAX_CHANNEL_NUM) &&
+				(chplan_sta[i].ChannelNum != 0) &&
+				(chplan_sta[i].ChannelNum <= 14))
+			{
+				chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
+//				chplan_new[k].ScanType = chplan_sta[i].ScanType;
+				chplan_new[k].ScanType = SCAN_PASSIVE;
+				i++;
+				k++;
+			}
+
+			// add channel AP supported
+			while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14))
+			{
+				chplan_new[k].ChannelNum = chplan_ap.Channel[j];
+				chplan_new[k].ScanType = SCAN_ACTIVE;
+				j++;
+				k++;
+			}
+		}
+		else
+		{
+			// keep original STA 2.4G channel plan
+			while ((i < MAX_CHANNEL_NUM) &&
+				(chplan_sta[i].ChannelNum != 0) &&
+				(chplan_sta[i].ChannelNum <= 14))
+			{
+				chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
+				chplan_new[k].ScanType = chplan_sta[i].ScanType;
+				i++;
+				k++;
+			}
+
+			// skip AP 2.4G channel plan
+			while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14))
+			{
+				j++;
+			}
+		}
+
+		if (pregistrypriv->wireless_mode & WIRELESS_11A)
+		{
+			do {
+				if ((i == MAX_CHANNEL_NUM) ||
+					(chplan_sta[i].ChannelNum == 0))
+					break;
+
+				if ((j == chplan_ap.Len) || (chplan_ap.Channel[j] == 0))
+					break;
+
+				if (chplan_sta[i].ChannelNum == chplan_ap.Channel[j])
+				{
+					chplan_new[k].ChannelNum = chplan_ap.Channel[j];
+					chplan_new[k].ScanType = SCAN_ACTIVE;
+					i++;
+					j++;
+					k++;
+				}
+				else if (chplan_sta[i].ChannelNum < chplan_ap.Channel[j])
+				{
+					chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
+//					chplan_new[k].ScanType = chplan_sta[i].ScanType;
+					chplan_new[k].ScanType = SCAN_PASSIVE;
+					i++;
+					k++;
+				}
+				else if (chplan_sta[i].ChannelNum > chplan_ap.Channel[j])
+				{
+					chplan_new[k].ChannelNum = chplan_ap.Channel[j];
+					chplan_new[k].ScanType = SCAN_ACTIVE;
+					j++;
+					k++;
+				}
+			} while (1);
+
+			// change AP not support channel to Passive scan
+			while ((i < MAX_CHANNEL_NUM) && (chplan_sta[i].ChannelNum != 0))
+			{
+				chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
+//				chplan_new[k].ScanType = chplan_sta[i].ScanType;
+				chplan_new[k].ScanType = SCAN_PASSIVE;
+				i++;
+				k++;
+			}
+
+			// add channel AP supported
+			while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] != 0))
+			{
+				chplan_new[k].ChannelNum = chplan_ap.Channel[j];
+				chplan_new[k].ScanType = SCAN_ACTIVE;
+				j++;
+				k++;
+			}
+		}
+		else
+		{
+			// keep original STA 5G channel plan
+			while ((i < MAX_CHANNEL_NUM) && (chplan_sta[i].ChannelNum != 0))
+			{
+				chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
+				chplan_new[k].ScanType = chplan_sta[i].ScanType;
+				i++;
+				k++;
+			}
+		}
+
+		pmlmeext->update_channel_plan_by_ap_done = 1;
+
+#ifdef CONFIG_DEBUG_RTL871X
+#ifdef PLATFORM_LINUX
+		k = 0;
+		printk("%s: new STA channel plan {", __func__);
+		while ((k < MAX_CHANNEL_NUM) && (chplan_new[k].ChannelNum != 0))
+		{
+			printk("%02d(%c),", chplan_new[k].ChannelNum, chplan_new[k].ScanType==SCAN_PASSIVE?'p':'c');
+			k++;
+		}
+		printk("}\n");
+#endif
+#endif
+
+#if 0
+		// recover the right channel index
+		channel = chplan_sta[pmlmeext->sitesurvey_res.channel_idx].ChannelNum;
+		k = 0;
+		while ((k < MAX_CHANNEL_NUM) && (chplan_new[k].ChannelNum != 0))
+		{
+			if (chplan_new[k].ChannelNum == channel) {
+				RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
+						 ("%s: change mlme_ext sitesurvey channel index from %d to %d\n",
+						  __FUNCTION__, pmlmeext->sitesurvey_res.channel_idx, k));
+				pmlmeext->sitesurvey_res.channel_idx = k;
+				break;
+			}
+			k++;
+		}
+#endif
+	}
+
+	// If channel is used by AP, set channel scan type to active
+	channel = bssid->Configuration.DSConfig;
+	chplan_new = pmlmeext->channel_set;
+	i = 0;
+	while ((i < MAX_CHANNEL_NUM) && (chplan_new[i].ChannelNum != 0))
+	{
+		if (chplan_new[i].ChannelNum == channel)
+		{
+			if (chplan_new[i].ScanType == SCAN_PASSIVE)
+			{
+				//5G Bnad 2, 3 (DFS) doesn't change to active scan
+				if(channel >= 52 && channel <= 144)
+					break;
+
+				chplan_new[i].ScanType = SCAN_ACTIVE;
+				RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
+						 ("%s: change channel %d scan type from passive to active\n",
+						  __FUNCTION__, channel));
+			}
+			break;
+		}
+		i++;
+	}
+}
+#endif
+
+/****************************************************************************
+
+Following are the functions to report events
+
+*****************************************************************************/
+
+void report_survey_event(_adapter *padapter, union recv_frame *precv_frame)
+{
+	struct cmd_obj *pcmd_obj;
+	u8	*pevtcmd;
+	u32 cmdsz;
+	struct survey_event	*psurvey_evt;
+	struct C2HEvent_Header *pc2h_evt_hdr;
+	struct mlme_ext_priv *pmlmeext;
+	struct cmd_priv *pcmdpriv;
+	//u8 *pframe = precv_frame->u.hdr.rx_data;
+	//uint len = precv_frame->u.hdr.len;
+
+	if(!padapter)
+		return;
+
+	pmlmeext = &padapter->mlmeextpriv;
+	pcmdpriv = &padapter->cmdpriv;
+
+
+	if ((pcmd_obj = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj))) == NULL)
+	{
+		return;
+	}
+
+	cmdsz = (sizeof(struct survey_event) + sizeof(struct C2HEvent_Header));
+	if ((pevtcmd = (u8*)rtw_zmalloc(cmdsz)) == NULL)
+	{
+		rtw_mfree((u8 *)pcmd_obj, sizeof(struct cmd_obj));
+		return;
+	}
+
+	_rtw_init_listhead(&pcmd_obj->list);
+
+	pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
+	pcmd_obj->cmdsz = cmdsz;
+	pcmd_obj->parmbuf = pevtcmd;
+
+	pcmd_obj->rsp = NULL;
+	pcmd_obj->rspsz  = 0;
+
+	pc2h_evt_hdr = (struct C2HEvent_Header*)(pevtcmd);
+	pc2h_evt_hdr->len = sizeof(struct survey_event);
+	pc2h_evt_hdr->ID = GEN_EVT_CODE(_Survey);
+	pc2h_evt_hdr->seq = ATOMIC_INC_RETURN(&pmlmeext->event_seq);
+
+	psurvey_evt = (struct survey_event*)(pevtcmd + sizeof(struct C2HEvent_Header));
+
+	if (collect_bss_info(padapter, precv_frame, (WLAN_BSSID_EX *)&psurvey_evt->bss) == _FAIL)
+	{
+		rtw_mfree((u8 *)pcmd_obj, sizeof(struct cmd_obj));
+		rtw_mfree((u8 *)pevtcmd, cmdsz);
+		return;
+	}
+
+#ifdef CONFIG_80211D
+	process_80211d(padapter, &psurvey_evt->bss);
+#endif
+
+	rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
+
+	pmlmeext->sitesurvey_res.bss_cnt++;
+
+	return;
+
+}
+
+void report_surveydone_event(_adapter *padapter)
+{
+	struct cmd_obj *pcmd_obj;
+	u8	*pevtcmd;
+	u32 cmdsz;
+	struct surveydone_event *psurveydone_evt;
+	struct C2HEvent_Header	*pc2h_evt_hdr;
+	struct mlme_ext_priv		*pmlmeext = &padapter->mlmeextpriv;
+	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
+
+	if ((pcmd_obj = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj))) == NULL)
+	{
+		return;
+	}
+
+	cmdsz = (sizeof(struct surveydone_event) + sizeof(struct C2HEvent_Header));
+	if ((pevtcmd = (u8*)rtw_zmalloc(cmdsz)) == NULL)
+	{
+		rtw_mfree((u8 *)pcmd_obj, sizeof(struct cmd_obj));
+		return;
+	}
+
+	_rtw_init_listhead(&pcmd_obj->list);
+
+	pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
+	pcmd_obj->cmdsz = cmdsz;
+	pcmd_obj->parmbuf = pevtcmd;
+
+	pcmd_obj->rsp = NULL;
+	pcmd_obj->rspsz  = 0;
+
+	pc2h_evt_hdr = (struct C2HEvent_Header*)(pevtcmd);
+	pc2h_evt_hdr->len = sizeof(struct surveydone_event);
+	pc2h_evt_hdr->ID = GEN_EVT_CODE(_SurveyDone);
+	pc2h_evt_hdr->seq = ATOMIC_INC_RETURN(&pmlmeext->event_seq);
+
+	psurveydone_evt = (struct surveydone_event*)(pevtcmd + sizeof(struct C2HEvent_Header));
+	psurveydone_evt->bss_cnt = pmlmeext->sitesurvey_res.bss_cnt;
+
+	DBG_871X("survey done event(%x) band:%d for "ADPT_FMT"\n", psurveydone_evt->bss_cnt, padapter->setband, ADPT_ARG(padapter));
+
+	rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
+
+	return;
+
+}
+
+void report_join_res(_adapter *padapter, int res)
+{
+	struct cmd_obj *pcmd_obj;
+	u8	*pevtcmd;
+	u32 cmdsz;
+	struct joinbss_event		*pjoinbss_evt;
+	struct C2HEvent_Header	*pc2h_evt_hdr;
+	struct mlme_ext_priv		*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
+
+	if ((pcmd_obj = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj))) == NULL)
+	{
+		return;
+	}
+
+	cmdsz = (sizeof(struct joinbss_event) + sizeof(struct C2HEvent_Header));
+	if ((pevtcmd = (u8*)rtw_zmalloc(cmdsz)) == NULL)
+	{
+		rtw_mfree((u8 *)pcmd_obj, sizeof(struct cmd_obj));
+		return;
+	}
+
+	_rtw_init_listhead(&pcmd_obj->list);
+
+	pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
+	pcmd_obj->cmdsz = cmdsz;
+	pcmd_obj->parmbuf = pevtcmd;
+
+	pcmd_obj->rsp = NULL;
+	pcmd_obj->rspsz  = 0;
+
+	pc2h_evt_hdr = (struct C2HEvent_Header*)(pevtcmd);
+	pc2h_evt_hdr->len = sizeof(struct joinbss_event);
+	pc2h_evt_hdr->ID = GEN_EVT_CODE(_JoinBss);
+	pc2h_evt_hdr->seq = ATOMIC_INC_RETURN(&pmlmeext->event_seq);
+
+	pjoinbss_evt = (struct joinbss_event*)(pevtcmd + sizeof(struct C2HEvent_Header));
+	_rtw_memcpy((unsigned char *)(&(pjoinbss_evt->network.network)), &(pmlmeinfo->network), sizeof(WLAN_BSSID_EX));
+	pjoinbss_evt->network.join_res 	= pjoinbss_evt->network.aid = res;
+
+	DBG_871X("report_join_res(%d)\n", res);
+
+
+	rtw_joinbss_event_prehandle(padapter, (u8 *)&pjoinbss_evt->network);
+
+
+	rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
+
+	return;
+
+}
+
+void report_del_sta_event(_adapter *padapter, unsigned char* MacAddr, unsigned short reason)
+{
+	struct cmd_obj *pcmd_obj;
+	u8	*pevtcmd;
+	u32 cmdsz;
+	struct sta_info *psta;
+	int	mac_id;
+	struct stadel_event			*pdel_sta_evt;
+	struct C2HEvent_Header	*pc2h_evt_hdr;
+	struct mlme_ext_priv		*pmlmeext = &padapter->mlmeextpriv;
+	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
+
+	if ((pcmd_obj = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj))) == NULL)
+	{
+		return;
+	}
+
+	cmdsz = (sizeof(struct stadel_event) + sizeof(struct C2HEvent_Header));
+	if ((pevtcmd = (u8*)rtw_zmalloc(cmdsz)) == NULL)
+	{
+		rtw_mfree((u8 *)pcmd_obj, sizeof(struct cmd_obj));
+		return;
+	}
+
+	_rtw_init_listhead(&pcmd_obj->list);
+
+	pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
+	pcmd_obj->cmdsz = cmdsz;
+	pcmd_obj->parmbuf = pevtcmd;
+
+	pcmd_obj->rsp = NULL;
+	pcmd_obj->rspsz  = 0;
+
+	pc2h_evt_hdr = (struct C2HEvent_Header*)(pevtcmd);
+	pc2h_evt_hdr->len = sizeof(struct stadel_event);
+	pc2h_evt_hdr->ID = GEN_EVT_CODE(_DelSTA);
+	pc2h_evt_hdr->seq = ATOMIC_INC_RETURN(&pmlmeext->event_seq);
+
+	pdel_sta_evt = (struct stadel_event*)(pevtcmd + sizeof(struct C2HEvent_Header));
+	_rtw_memcpy((unsigned char *)(&(pdel_sta_evt->macaddr)), MacAddr, ETH_ALEN);
+	_rtw_memcpy((unsigned char *)(pdel_sta_evt->rsvd),(unsigned char *)(&reason),2);
+
+
+	psta = rtw_get_stainfo(&padapter->stapriv, MacAddr);
+	if(psta)
+		mac_id = (int)psta->mac_id;
+	else
+		mac_id = (-1);
+
+	pdel_sta_evt->mac_id = mac_id;
+
+	DBG_871X("report_del_sta_event: delete STA, mac_id=%d\n", mac_id);
+
+	rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
+
+	return;
+}
+
+void report_add_sta_event(_adapter *padapter, unsigned char* MacAddr, int cam_idx)
+{
+	struct cmd_obj *pcmd_obj;
+	u8	*pevtcmd;
+	u32 cmdsz;
+	struct stassoc_event		*padd_sta_evt;
+	struct C2HEvent_Header	*pc2h_evt_hdr;
+	struct mlme_ext_priv		*pmlmeext = &padapter->mlmeextpriv;
+	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
+
+	if ((pcmd_obj = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj))) == NULL)
+	{
+		return;
+	}
+
+	cmdsz = (sizeof(struct stassoc_event) + sizeof(struct C2HEvent_Header));
+	if ((pevtcmd = (u8*)rtw_zmalloc(cmdsz)) == NULL)
+	{
+		rtw_mfree((u8 *)pcmd_obj, sizeof(struct cmd_obj));
+		return;
+	}
+
+	_rtw_init_listhead(&pcmd_obj->list);
+
+	pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
+	pcmd_obj->cmdsz = cmdsz;
+	pcmd_obj->parmbuf = pevtcmd;
+
+	pcmd_obj->rsp = NULL;
+	pcmd_obj->rspsz  = 0;
+
+	pc2h_evt_hdr = (struct C2HEvent_Header*)(pevtcmd);
+	pc2h_evt_hdr->len = sizeof(struct stassoc_event);
+	pc2h_evt_hdr->ID = GEN_EVT_CODE(_AddSTA);
+	pc2h_evt_hdr->seq = ATOMIC_INC_RETURN(&pmlmeext->event_seq);
+
+	padd_sta_evt = (struct stassoc_event*)(pevtcmd + sizeof(struct C2HEvent_Header));
+	_rtw_memcpy((unsigned char *)(&(padd_sta_evt->macaddr)), MacAddr, ETH_ALEN);
+	padd_sta_evt->cam_id = cam_idx;
+
+	DBG_871X("report_add_sta_event: add STA\n");
+
+	rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
+
+	return;
+}
+
+
+/****************************************************************************
+
+Following are the event callback functions
+
+*****************************************************************************/
+
+//for sta/adhoc mode
+void update_sta_info(_adapter *padapter, struct sta_info *psta)
+{
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	//ERP
+	VCS_update(padapter, psta);
+
+
+	//HT
+	if(pmlmepriv->htpriv.ht_option)
+	{
+		psta->htpriv.ht_option = _TRUE;
+
+		psta->htpriv.ampdu_enable = pmlmepriv->htpriv.ampdu_enable;
+
+		if (support_short_GI(padapter, &(pmlmeinfo->HT_caps)))
+			psta->htpriv.sgi = _TRUE;
+
+		psta->qos_option = _TRUE;
+
+	}
+	else
+	{
+		psta->htpriv.ht_option = _FALSE;
+
+		psta->htpriv.ampdu_enable = _FALSE;
+
+		psta->htpriv.sgi = _FALSE;
+
+		psta->qos_option = _FALSE;
+
+	}
+
+	psta->htpriv.bwmode = pmlmeext->cur_bwmode;
+	psta->htpriv.ch_offset = pmlmeext->cur_ch_offset;
+
+	psta->htpriv.agg_enable_bitmap = 0x0;//reset
+	psta->htpriv.candidate_tid_bitmap = 0x0;//reset
+
+
+	//QoS
+	if(pmlmepriv->qospriv.qos_option)
+		psta->qos_option = _TRUE;
+
+
+	psta->state = _FW_LINKED;
+
+}
+
+void mlmeext_joinbss_event_callback(_adapter *padapter, int join_res)
+{
+	struct sta_info		*psta, *psta_bmc;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+	struct sta_priv		*pstapriv = &padapter->stapriv;
+	u8	join_type;
+
+	if(join_res < 0)
+	{
+		join_type = 1;
+		rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
+		rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
+
+		//restore to initial setting.
+		update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
+#if 0 //temply remove
+#ifdef CONFIG_INTEL_WIDI
+#ifdef DBG_CONFIG_ERROR_DETECT
+		DBG_871X("%s(): do silentreset\n",__FUNCTION__);
+		rtw_hal_sreset_reset(padapter);
+#endif
+#endif
+#endif
+		goto exit_mlmeext_joinbss_event_callback;
+	}
+
+	if((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE)
+	{
+		//for bc/mc
+		psta_bmc = rtw_get_bcmc_stainfo(padapter);
+		if(psta_bmc)
+		{
+			pmlmeinfo->FW_sta_info[psta_bmc->mac_id].psta = psta_bmc;
+			update_bmc_sta_support_rate(padapter, psta_bmc->mac_id);
+			Update_RA_Entry(padapter, psta_bmc->mac_id);
+		}
+	}
+
+
+	//turn on dynamic functions
+	Switch_DM_Func(padapter, DYNAMIC_FUNC_DIG|DYNAMIC_FUNC_HP|DYNAMIC_FUNC_SS, _TRUE);
+
+	// update IOT-releated issue
+	update_IOT_info(padapter);
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_BASIC_RATE, cur_network->SupportedRates);
+
+	//BCN interval
+	rtw_hal_set_hwreg(padapter, HW_VAR_BEACON_INTERVAL, (u8 *)(&pmlmeinfo->bcn_interval));
+
+	//udpate capability
+	update_capinfo(padapter, pmlmeinfo->capability);
+
+	//WMM, Update EDCA param
+	WMMOnAssocRsp(padapter);
+
+	//HT
+	HTOnAssocRsp(padapter);
+
+#ifndef CONFIG_CONCURRENT_MODE
+	//	Call set_channel_bwmode when the CONFIG_CONCURRENT_MODE doesn't be defined.
+	//Set cur_channel&cur_bwmode&cur_ch_offset
+	set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+#endif
+
+	psta = rtw_get_stainfo(pstapriv, cur_network->MacAddress);
+	if (psta) //only for infra. mode
+	{
+		pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
+
+		//DBG_871X("set_sta_rate\n");
+
+		//set per sta rate after updating HT cap.
+		set_sta_rate(padapter, psta);
+	}
+
+	join_type = 2;
+	rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
+
+	if((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
+	{
+		// correcting TSF
+		correct_TSF(padapter, pmlmeext);
+
+		//set_link_timer(pmlmeext, DISCONNECT_TO);
+	}
+
+#ifdef CONFIG_LPS
+	rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_CONNECT, 0);
+#endif
+
+exit_mlmeext_joinbss_event_callback:
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	dc_handle_join_done(padapter, join_res);
+#endif
+#ifdef CONFIG_CONCURRENT_MODE
+	concurrent_chk_joinbss_done(padapter, join_res);
+#endif
+
+	DBG_871X("=>%s\n", __FUNCTION__);
+
+}
+
+void mlmeext_sta_add_event_callback(_adapter *padapter, struct sta_info *psta)
+{
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8	join_type;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	if((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE)
+	{
+		if(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)//adhoc master or sta_count>1
+		{
+			//nothing to do
+		}
+		else//adhoc client
+		{
+			//update TSF Value
+			//update_TSF(pmlmeext, pframe, len);
+
+			// correcting TSF
+			correct_TSF(padapter, pmlmeext);
+
+			//start beacon
+			if(send_beacon(padapter)==_FAIL)
+			{
+				pmlmeinfo->FW_sta_info[psta->mac_id].status = 0;
+
+				pmlmeinfo->state ^= WIFI_FW_ADHOC_STATE;
+
+				return;
+			}
+
+			pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
+
+		}
+
+		join_type = 2;
+		rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
+	}
+
+	pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
+
+	//rate radaptive
+	Update_RA_Entry(padapter, psta->mac_id);
+
+	//update adhoc sta_info
+	update_sta_info(padapter, psta);
+
+}
+
+void mlmeext_sta_del_event_callback(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if (is_client_associated_to_ap(padapter) || is_IBSS_empty(padapter))
+	{
+		//set_opmode_cmd(padapter, infra_client_with_mlme);
+
+		rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, 0);
+		rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
+
+		//restore to initial setting.
+		update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+		dc_set_channel_bwmode_disconnect(padapter);
+#else
+#ifdef CONFIG_CONCURRENT_MODE
+		if((check_buddy_fwstate(padapter, _FW_LINKED)) != _TRUE)
+		{
+#endif //CONFIG_CONCURRENT_MODE
+
+		//switch to the 20M Hz mode after disconnect
+		pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
+		pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+		//SelectChannel(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset);
+		set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+
+#ifdef CONFIG_CONCURRENT_MODE
+		}
+#endif //CONFIG_CONCURRENT_MODE
+#endif //CONFIG_DUALMAC_CONCURRENT
+
+		flush_all_cam_entry(padapter);
+
+		pmlmeinfo->state = WIFI_FW_NULL_STATE;
+
+		//set MSR to no link state -> infra. mode
+		Set_MSR(padapter, _HW_STATE_STATION_);
+
+		_cancel_timer_ex(&pmlmeext->link_timer);
+
+	}
+
+}
+
+/****************************************************************************
+
+Following are the functions for the timer handlers
+
+*****************************************************************************/
+void _linked_rx_signal_strehgth_display(_adapter *padapter);
+void _linked_rx_signal_strehgth_display(_adapter *padapter)
+{
+	int	UndecoratedSmoothedPWDB;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	DBG_871X("============ pbuddy_adapter linked status check ===================\n");
+	DBG_871X("buddy_adapter_type=%d\n", pbuddy_adapter->adapter_type);
+	DBG_871X("pbuddy_adapter pathA Rx SNRdb:%d\n",pbuddy_adapter->recvpriv.RxSNRdB[0]);
+	DBG_871X("pbuddy_adapter pathA Rx PWDB:%d\n",pbuddy_adapter->recvpriv.rxpwdb);
+	DBG_871X("pbuddy_adapter pathA Rx RSSI:%d,pathB Rx RSSI:%d\n"
+	,pbuddy_adapter->recvpriv.RxRssi[0],pbuddy_adapter->recvpriv.RxRssi[1]);
+	rtw_hal_get_def_var(pbuddy_adapter, HAL_DEF_UNDERCORATEDSMOOTHEDPWDB, &UndecoratedSmoothedPWDB);
+	DBG_871X("pbuddy_adapter UndecoratedSmoothedPWDB:%d\n",UndecoratedSmoothedPWDB);
+	DBG_871X("Rx RSSI:%d\n",pbuddy_adapter->recvpriv.rssi);
+	DBG_871X("Rx Signal_strength:%d\n",pbuddy_adapter->recvpriv.signal_strength);
+	DBG_871X("Rx Signal_qual:%d \n",pbuddy_adapter->recvpriv.signal_qual);
+	DBG_871X("============ linked status check ===================\n");
+	DBG_871X("adapter_type=%d\n", padapter->adapter_type);
+#else //CONFIG_CONCURRENT_MODE
+	DBG_871X("============ linked status check ===================\n");
+#endif //CONFIG_CONCURRENT_MODE
+	DBG_871X("pathA Rx SNRdb:%d, pathB Rx SNRdb:%d\n",padapter->recvpriv.RxSNRdB[0], padapter->recvpriv.RxSNRdB[1]);
+	DBG_871X("pathA Rx PWDB:%d\n",padapter->recvpriv.rxpwdb);
+	DBG_871X("pathA Rx RSSI:%d,pathB Rx RSSI:%d\n",padapter->recvpriv.RxRssi[0],padapter->recvpriv.RxRssi[1]);
+	rtw_hal_get_def_var(padapter, HAL_DEF_UNDERCORATEDSMOOTHEDPWDB, &UndecoratedSmoothedPWDB);
+	DBG_871X("UndecoratedSmoothedPWDB:%d\n",UndecoratedSmoothedPWDB);
+	DBG_871X("Rx RSSI:%d\n",padapter->recvpriv.rssi);
+	DBG_871X("Rx Signal_strength:%d\n",padapter->recvpriv.signal_strength);
+	DBG_871X("Rx Signal_qual:%d \n",padapter->recvpriv.signal_qual);
+	if ( check_fwstate( &padapter->mlmepriv,  _FW_LINKED ))
+	{
+		DBG_871X("bw mode: %d, channel: %d\n", padapter->mlmeextpriv.cur_bwmode, padapter->mlmeextpriv.cur_channel );
+		DBG_871X("received bytes = %d\n", (u32) (padapter->recvpriv.rx_bytes - padapter->recvpriv.last_rx_bytes ) );
+	}
+	DBG_871X("============ linked status check ===================\n");
+	DBG_871X(" DIG PATH-A(0x%02x), PATH-B(0x%02x)\n",rtw_read8(padapter,0xc50),rtw_read8(padapter,0xc58));
+	DBG_871X(" OFDM -Alarm DA2(0x%04x),DA4(0x%04x),DA6(0x%04x),DA8(0x%04x)\n",
+		rtw_read16(padapter,0xDA2),rtw_read16(padapter,0xDA4),rtw_read16(padapter,0xDA6),rtw_read16(padapter,0xDA8));
+
+	DBG_871X(" CCK -Alarm A5B(0x%02x),A5C(0x%02x)\n",rtw_read8(padapter,0xA5B),rtw_read8(padapter,0xA5C));
+	DBG_871X(" FalseAlmCnt_all(%d)\n",padapter->recvpriv.FalseAlmCnt_all);
+
+}
+
+u8 chk_ap_is_alive(_adapter *padapter, struct sta_info *psta)
+{
+	u8 ret = _FALSE;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	#ifdef DBG_EXPIRATION_CHK
+	DBG_871X(FUNC_ADPT_FMT" rx:"STA_PKTS_FMT", beacon:%llu, probersp_to_self:%llu"
+				/*", probersp_bm:%llu, probersp_uo:%llu, probereq:%llu, BI:%u"*/
+				", retry:%u\n"
+		, FUNC_ADPT_ARG(padapter)
+		, STA_RX_PKTS_DIFF_ARG(psta)
+		, psta->sta_stats.rx_beacon_pkts - psta->sta_stats.last_rx_beacon_pkts
+		, psta->sta_stats.rx_probersp_pkts - psta->sta_stats.last_rx_probersp_pkts
+		/*, psta->sta_stats.rx_probersp_bm_pkts - psta->sta_stats.last_rx_probersp_bm_pkts
+		, psta->sta_stats.rx_probersp_uo_pkts - psta->sta_stats.last_rx_probersp_uo_pkts
+		, psta->sta_stats.rx_probereq_pkts - psta->sta_stats.last_rx_probereq_pkts
+		, pmlmeinfo->bcn_interval*/
+		, pmlmeext->retry
+	);
+
+	DBG_871X(FUNC_ADPT_FMT" tx_pkts:%llu, link_count:%u\n", FUNC_ADPT_ARG(padapter)
+		, padapter->xmitpriv.tx_pkts
+		, pmlmeinfo->link_count
+	);
+	#endif
+
+	if((sta_rx_data_pkts(psta) == sta_last_rx_data_pkts(psta))
+		&& sta_rx_beacon_pkts(psta) == sta_last_rx_beacon_pkts(psta)
+		&& sta_rx_probersp_pkts(psta) == sta_last_rx_probersp_pkts(psta)
+	)
+	{
+		ret = _FALSE;
+	}
+	else
+	{
+		ret = _TRUE;
+	}
+
+	sta_update_last_rx_pkts(psta);
+
+	return ret;
+}
+
+void linked_status_chk(_adapter *padapter)
+{
+	u32	i;
+	struct sta_info		*psta;
+	struct xmit_priv		*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct sta_priv		*pstapriv = &padapter->stapriv;
+
+	if(padapter->bRxRSSIDisplay)
+		 _linked_rx_signal_strehgth_display(padapter);
+
+	#ifdef DBG_CONFIG_ERROR_DETECT
+	rtw_hal_sreset_linked_status_check(padapter);
+	#endif
+
+	if (is_client_associated_to_ap(padapter))
+	{
+		//linked infrastructure client mode
+
+		int tx_chk = _SUCCESS, rx_chk = _SUCCESS;
+		int rx_chk_limit;
+
+		#if defined(DBG_ROAMING_TEST)
+		rx_chk_limit = 1;
+		#elif defined(CONFIG_ACTIVE_KEEP_ALIVE_CHECK)
+		rx_chk_limit = 4;
+		#else
+		rx_chk_limit = 8;
+		#endif
+
+		// Marked by Kurt 20130715
+		// For WiDi 3.5 and later on, they don't ask WiDi sink to do roaming, so we could not check rx limit that strictly.
+		// todo: To check why rx_chk would be _FALSE under miracast session.
+		//#ifdef CONFIG_INTEL_WIDI
+		//if (padapter->mlmepriv.widi_state != INTEL_WIDI_STATE_NONE)
+		//	rx_chk_limit = 1;
+		//#endif
+
+		if ((psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.MacAddress)) != NULL)
+		{
+			bool is_p2p_enable = _FALSE;
+			#ifdef CONFIG_P2P
+			is_p2p_enable = !rtw_p2p_chk_state(&padapter->wdinfo, P2P_STATE_NONE);
+			#endif
+
+			if (chk_ap_is_alive(padapter, psta) == _FALSE)
+				rx_chk = _FAIL;
+
+			if (pxmitpriv->last_tx_pkts == pxmitpriv->tx_pkts)
+				tx_chk = _FAIL;
+
+			#ifdef CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+			if (pmlmeext->active_keep_alive_check && (rx_chk == _FAIL || tx_chk == _FAIL)) {
+				u8 backup_oper_channel=0;
+
+				/* switch to correct channel of current network  before issue keep-alive frames */
+				if (rtw_get_oper_ch(padapter) != pmlmeext->cur_channel) {
+					backup_oper_channel = rtw_get_oper_ch(padapter);
+					SelectChannel(padapter, pmlmeext->cur_channel);
+				}
+
+				if (rx_chk != _SUCCESS)
+					issue_probereq_ex(padapter, &pmlmeinfo->network.Ssid, psta->hwaddr, 3, 1);
+
+				if ((tx_chk != _SUCCESS && pmlmeinfo->link_count++ == 0xf) || rx_chk != _SUCCESS) {
+					tx_chk = issue_nulldata(padapter, psta->hwaddr, 0, 3, 1);
+					/* if tx acked and p2p disabled, set rx_chk _SUCCESS to reset retry count */
+					if (tx_chk == _SUCCESS && !is_p2p_enable)
+						rx_chk = _SUCCESS;
+				}
+
+				/* back to the original operation channel */
+				if(backup_oper_channel>0)
+					SelectChannel(padapter, backup_oper_channel);
+
+			}
+			else
+			#endif /* CONFIG_ACTIVE_KEEP_ALIVE_CHECK */
+			{
+				if (rx_chk != _SUCCESS) {
+					if (pmlmeext->retry == 0) {
+						#ifdef DBG_EXPIRATION_CHK
+						DBG_871X("issue_probereq to trigger probersp, retry=%d\n", pmlmeext->retry);
+						#endif
+						issue_probereq(padapter, &pmlmeinfo->network.Ssid, pmlmeinfo->network.MacAddress);
+						issue_probereq(padapter, &pmlmeinfo->network.Ssid, pmlmeinfo->network.MacAddress);
+						issue_probereq(padapter, &pmlmeinfo->network.Ssid, pmlmeinfo->network.MacAddress);
+					}
+				}
+
+				if (tx_chk != _SUCCESS && pmlmeinfo->link_count++ == 0xf) {
+					#ifdef DBG_EXPIRATION_CHK
+					DBG_871X("%s issue_nulldata 0\n", __FUNCTION__);
+					#endif
+					tx_chk = issue_nulldata(padapter, NULL, 0, 1, 0);
+				}
+			}
+
+			if (rx_chk == _FAIL) {
+				pmlmeext->retry++;
+				if (pmlmeext->retry > rx_chk_limit) {
+					DBG_871X(FUNC_ADPT_FMT" disconnect or roaming\n",
+						FUNC_ADPT_ARG(padapter));
+					receive_disconnect(padapter, pmlmeinfo->network.MacAddress
+						, WLAN_REASON_EXPIRATION_CHK);
+					return;
+				}
+			} else {
+				pmlmeext->retry = 0;
+			}
+
+			if (tx_chk == _FAIL) {
+				pmlmeinfo->link_count &= 0xf;
+			} else {
+				pxmitpriv->last_tx_pkts = pxmitpriv->tx_pkts;
+				pmlmeinfo->link_count = 0;
+			}
+
+		} //end of if ((psta = rtw_get_stainfo(pstapriv, passoc_res->network.MacAddress)) != NULL)
+	}
+	else if (is_client_associated_to_ibss(padapter))
+	{
+		//linked IBSS mode
+		//for each assoc list entry to check the rx pkt counter
+		for (i = IBSS_START_MAC_ID; i < NUM_STA; i++)
+		{
+			if (pmlmeinfo->FW_sta_info[i].status == 1)
+			{
+				psta = pmlmeinfo->FW_sta_info[i].psta;
+
+				if(NULL==psta) continue;
+
+				if (pmlmeinfo->FW_sta_info[i].rx_pkt == sta_rx_pkts(psta))
+				{
+
+					if(pmlmeinfo->FW_sta_info[i].retry<3)
+					{
+						pmlmeinfo->FW_sta_info[i].retry++;
+					}
+					else
+					{
+						pmlmeinfo->FW_sta_info[i].retry = 0;
+						pmlmeinfo->FW_sta_info[i].status = 0;
+						report_del_sta_event(padapter, psta->hwaddr
+							, 65535// indicate disconnect caused by no rx
+						);
+					}
+				}
+				else
+				{
+					pmlmeinfo->FW_sta_info[i].retry = 0;
+					pmlmeinfo->FW_sta_info[i].rx_pkt = (u32)sta_rx_pkts(psta);
+				}
+			}
+		}
+
+		//set_link_timer(pmlmeext, DISCONNECT_TO);
+
+	}
+
+}
+
+void survey_timer_hdl(_adapter *padapter)
+{
+	struct cmd_obj	*ph2c;
+	struct sitesurvey_parm	*psurveyPara;
+	struct cmd_priv					*pcmdpriv=&padapter->cmdpriv;
+	struct mlme_ext_priv 		*pmlmeext = &padapter->mlmeextpriv;
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+#endif
+
+	//DBG_871X("marc: survey timer\n");
+#ifdef PLATFORM_FREEBSD
+	rtw_mtx_lock(NULL);
+	 if (callout_pending(&padapter->mlmeextpriv.survey_timer.callout)) {
+		 /* callout was reset */
+		 //mtx_unlock(&sc->sc_mtx);
+		 rtw_mtx_unlock(NULL);
+		 return;
+	 }
+	 if (!callout_active(&padapter->mlmeextpriv.survey_timer.callout)) {
+		 /* callout was stopped */
+		 //mtx_unlock(&sc->sc_mtx);
+		 rtw_mtx_unlock(NULL);
+		 return;
+	 }
+	 callout_deactivate(&padapter->mlmeextpriv.survey_timer.callout);
+
+
+#endif
+
+	//issue rtw_sitesurvey_cmd
+	if (pmlmeext->sitesurvey_res.state > SCAN_START)
+	{
+		if(pmlmeext->sitesurvey_res.state ==  SCAN_PROCESS)
+		{
+#ifdef CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+			if( padapter->mlmeextpriv.mlmext_info.scan_cnt != RTW_SCAN_NUM_OF_CH )
+#endif //CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+				pmlmeext->sitesurvey_res.channel_idx++;
+		}
+
+		if(pmlmeext->scan_abort == _TRUE)
+		{
+			#ifdef CONFIG_P2P
+			if(!rtw_p2p_chk_state(&padapter->wdinfo, P2P_STATE_NONE))
+			{
+				rtw_p2p_findphase_ex_set(pwdinfo, P2P_FINDPHASE_EX_MAX);
+				pmlmeext->sitesurvey_res.channel_idx = 3;
+				DBG_871X("%s idx:%d, cnt:%u\n", __FUNCTION__
+					, pmlmeext->sitesurvey_res.channel_idx
+					, pwdinfo->find_phase_state_exchange_cnt
+				);
+			}
+			else
+			#endif
+			{
+				pmlmeext->sitesurvey_res.channel_idx = pmlmeext->sitesurvey_res.ch_num;
+				DBG_871X("%s idx:%d\n", __FUNCTION__
+					, pmlmeext->sitesurvey_res.channel_idx
+				);
+			}
+
+			pmlmeext->scan_abort = _FALSE;//reset
+		}
+
+		if ((ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj))) == NULL)
+		{
+			goto exit_survey_timer_hdl;
+		}
+
+		if ((psurveyPara = (struct sitesurvey_parm*)rtw_zmalloc(sizeof(struct sitesurvey_parm))) == NULL)
+		{
+			rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+			goto exit_survey_timer_hdl;
+		}
+
+		init_h2fwcmd_w_parm_no_rsp(ph2c, psurveyPara, GEN_CMD_CODE(_SiteSurvey));
+		rtw_enqueue_cmd(pcmdpriv, ph2c);
+	}
+
+
+exit_survey_timer_hdl:
+#ifdef PLATFORM_FREEBSD
+		rtw_mtx_unlock(NULL);
+#endif
+
+	return;
+}
+
+void link_timer_hdl(_adapter *padapter)
+{
+	//static unsigned int		rx_pkt = 0;
+	//static u64				tx_cnt = 0;
+	//struct xmit_priv		*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	//struct sta_priv		*pstapriv = &padapter->stapriv;
+
+#ifdef PLATFORM_FREEBSD
+	rtw_mtx_lock(NULL);
+	 if (callout_pending(&padapter->mlmeextpriv.survey_timer.callout)) {
+		 /* callout was reset */
+		 //mtx_unlock(&sc->sc_mtx);
+		 rtw_mtx_unlock(NULL);
+		 return;
+	 }
+	 if (!callout_active(&padapter->mlmeextpriv.survey_timer.callout)) {
+		 /* callout was stopped */
+		 //mtx_unlock(&sc->sc_mtx);
+		 rtw_mtx_unlock(NULL);
+		 return;
+	 }
+	 callout_deactivate(&padapter->mlmeextpriv.survey_timer.callout);
+
+
+#endif
+
+	if (pmlmeinfo->state & WIFI_FW_AUTH_NULL)
+	{
+		DBG_871X("link_timer_hdl:no beacon while connecting\n");
+		pmlmeinfo->state = WIFI_FW_NULL_STATE;
+		report_join_res(padapter, -3);
+	}
+	else if (pmlmeinfo->state & WIFI_FW_AUTH_STATE)
+	{
+		//re-auth timer
+		if (++pmlmeinfo->reauth_count > REAUTH_LIMIT)
+		{
+			//if (pmlmeinfo->auth_algo != dot11AuthAlgrthm_Auto)
+			//{
+				pmlmeinfo->state = 0;
+				report_join_res(padapter, -1);
+				return;
+			//}
+			//else
+			//{
+			//	pmlmeinfo->auth_algo = dot11AuthAlgrthm_Shared;
+			//	pmlmeinfo->reauth_count = 0;
+			//}
+		}
+
+		DBG_871X("link_timer_hdl: auth timeout and try again\n");
+		pmlmeinfo->auth_seq = 1;
+		issue_auth(padapter, NULL, 0);
+		set_link_timer(pmlmeext, REAUTH_TO);
+	}
+	else if (pmlmeinfo->state & WIFI_FW_ASSOC_STATE)
+	{
+		//re-assoc timer
+		if (++pmlmeinfo->reassoc_count > REASSOC_LIMIT)
+		{
+			pmlmeinfo->state = WIFI_FW_NULL_STATE;
+			report_join_res(padapter, -2);
+			return;
+		}
+
+		DBG_871X("link_timer_hdl: assoc timeout and try again\n");
+		issue_assocreq(padapter);
+		set_link_timer(pmlmeext, REASSOC_TO);
+	}
+#if 0
+	else if (is_client_associated_to_ap(padapter))
+	{
+		//linked infrastructure client mode
+		if ((psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.MacAddress)) != NULL)
+		{
+			/*to monitor whether the AP is alive or not*/
+			if (rx_pkt == psta->sta_stats.rx_pkts)
+			{
+				receive_disconnect(padapter, pmlmeinfo->network.MacAddress);
+				return;
+			}
+			else
+			{
+				rx_pkt = psta->sta_stats.rx_pkts;
+				set_link_timer(pmlmeext, DISCONNECT_TO);
+			}
+
+			//update the EDCA paramter according to the Tx/RX mode
+			update_EDCA_param(padapter);
+
+			/*to send the AP a nulldata if no frame is xmitted in order to keep alive*/
+			if (pmlmeinfo->link_count++ == 0)
+			{
+				tx_cnt = pxmitpriv->tx_pkts;
+			}
+			else if ((pmlmeinfo->link_count & 0xf) == 0)
+			{
+				if (tx_cnt == pxmitpriv->tx_pkts)
+				{
+					issue_nulldata(padapter, NULL, 0, 0, 0);
+				}
+
+				tx_cnt = pxmitpriv->tx_pkts;
+			}
+		} //end of if ((psta = rtw_get_stainfo(pstapriv, passoc_res->network.MacAddress)) != NULL)
+	}
+	else if (is_client_associated_to_ibss(padapter))
+	{
+		//linked IBSS mode
+		//for each assoc list entry to check the rx pkt counter
+		for (i = IBSS_START_MAC_ID; i < NUM_STA; i++)
+		{
+			if (pmlmeinfo->FW_sta_info[i].status == 1)
+			{
+				psta = pmlmeinfo->FW_sta_info[i].psta;
+
+				if (pmlmeinfo->FW_sta_info[i].rx_pkt == psta->sta_stats.rx_pkts)
+				{
+					pmlmeinfo->FW_sta_info[i].status = 0;
+					report_del_sta_event(padapter, psta->hwaddr);
+				}
+				else
+				{
+					pmlmeinfo->FW_sta_info[i].rx_pkt = psta->sta_stats.rx_pkts;
+				}
+			}
+		}
+
+		set_link_timer(pmlmeext, DISCONNECT_TO);
+	}
+#endif
+
+#ifdef PLATFORM_FREEBSD
+	rtw_mtx_unlock(NULL);
+#endif
+
+	return;
+}
+
+void addba_timer_hdl(struct sta_info *psta)
+{
+	struct ht_priv	*phtpriv;
+
+	if(!psta)
+		return;
+
+	phtpriv = &psta->htpriv;
+
+	if((phtpriv->ht_option==_TRUE) && (phtpriv->ampdu_enable==_TRUE))
+	{
+		if(phtpriv->candidate_tid_bitmap)
+			phtpriv->candidate_tid_bitmap=0x0;
+
+	}
+}
+
+#ifdef CONFIG_IEEE80211W
+void sa_query_timer_hdl(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_priv * pmlmepriv = &padapter->mlmepriv;
+	_irqL irqL;
+	//disconnect
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+	{
+		rtw_disassoc_cmd(padapter, 0, _TRUE);
+		rtw_indicate_disconnect(padapter);
+		rtw_free_assoc_resources(padapter, 1);
+	}
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+	DBG_871X("SA query timeout disconnect\n");
+}
+#endif //CONFIG_IEEE80211W
+
+u8 NULL_hdl(_adapter *padapter, u8 *pbuf)
+{
+	return H2C_SUCCESS;
+}
+
+#ifdef CONFIG_AUTO_AP_MODE
+void rtw_start_auto_ap(_adapter *adapter)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+
+	rtw_set_802_11_infrastructure_mode(adapter, Ndis802_11APMode);
+
+	rtw_setopmode_cmd(adapter, Ndis802_11APMode);
+}
+
+static int rtw_auto_ap_start_beacon(_adapter *adapter)
+{
+	int ret=0;
+	u8 *pbuf = NULL;
+	uint len;
+	u8	supportRate[16];
+	int 	sz = 0, rateLen;
+	u8 *	ie;
+	u8	wireless_mode, oper_channel;
+	u8 ssid[3] = {0}; //hidden ssid
+	u32 ssid_len = sizeof(ssid);
+	struct mlme_priv *pmlmepriv = &(adapter->mlmepriv);
+
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EINVAL;
+
+
+	len = 128;
+	pbuf = rtw_zmalloc(len);
+	if(!pbuf)
+		return -ENOMEM;
+
+
+	//generate beacon
+	ie = pbuf;
+
+	//timestamp will be inserted by hardware
+	sz += 8;
+	ie += sz;
+
+	//beacon interval : 2bytes
+	*(u16*)ie = cpu_to_le16((u16)100);//BCN_INTERVAL=100;
+	sz += 2;
+	ie += 2;
+
+	//capability info
+	*(u16*)ie = 0;
+	*(u16*)ie |= cpu_to_le16(cap_ESS);
+	*(u16*)ie |= cpu_to_le16(cap_ShortPremble);
+	//*(u16*)ie |= cpu_to_le16(cap_Privacy);
+	sz += 2;
+	ie += 2;
+
+	//SSID
+	ie = rtw_set_ie(ie, _SSID_IE_, ssid_len, ssid, &sz);
+
+	//supported rates
+	wireless_mode = WIRELESS_11BG_24N;
+	rtw_set_supported_rate(supportRate, wireless_mode) ;
+	rateLen = rtw_get_rateset_len(supportRate);
+	if (rateLen > 8)
+	{
+		ie = rtw_set_ie(ie, _SUPPORTEDRATES_IE_, 8, supportRate, &sz);
+	}
+	else
+	{
+		ie = rtw_set_ie(ie, _SUPPORTEDRATES_IE_, rateLen, supportRate, &sz);
+	}
+
+
+	//DS parameter set
+	if(check_buddy_fwstate(adapter, _FW_LINKED) &&
+		check_buddy_fwstate(adapter, WIFI_STATION_STATE))
+	{
+		PADAPTER pbuddy_adapter = adapter->pbuddy_adapter;
+		struct mlme_ext_priv *pbuddy_mlmeext  = &pbuddy_adapter->mlmeextpriv;
+
+		oper_channel = pbuddy_mlmeext->cur_channel;
+	}
+	else
+	{
+		oper_channel = adapter_to_dvobj(adapter)->oper_channel;
+	}
+	ie = rtw_set_ie(ie, _DSSET_IE_, 1, &oper_channel, &sz);
+
+	//ext supported rates
+	if (rateLen > 8)
+	{
+		ie = rtw_set_ie(ie, _EXT_SUPPORTEDRATES_IE_, (rateLen - 8), (supportRate + 8), &sz);
+	}
+
+	DBG_871X("%s, start auto ap beacon sz=%d\n", __FUNCTION__, sz);
+
+	//lunch ap mode & start to issue beacon
+	if(rtw_check_beacon_data(adapter, pbuf,  sz) == _SUCCESS)
+	{
+
+	}
+	else
+	{
+		ret = -EINVAL;
+	}
+
+
+	rtw_mfree(pbuf, len);
+
+	return ret;
+
+}
+#endif//CONFIG_AUTO_AP_MODE
+
+u8 setopmode_hdl(_adapter *padapter, u8 *pbuf)
+{
+	u8	type;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct setopmode_parm *psetop = (struct setopmode_parm *)pbuf;
+
+	if(psetop->mode == Ndis802_11APMode)
+	{
+		pmlmeinfo->state = WIFI_FW_AP_STATE;
+		type = _HW_STATE_AP_;
+#ifdef CONFIG_NATIVEAP_MLME
+		//start_ap_mode(padapter);
+#endif
+	}
+	else if(psetop->mode == Ndis802_11Infrastructure)
+	{
+		pmlmeinfo->state &= ~(BIT(0)|BIT(1));// clear state
+		pmlmeinfo->state |= WIFI_FW_STATION_STATE;//set to 	STATION_STATE
+		type = _HW_STATE_STATION_;
+	}
+	else if(psetop->mode == Ndis802_11IBSS)
+	{
+		type = _HW_STATE_ADHOC_;
+	}
+	else
+	{
+		type = _HW_STATE_NOLINK_;
+	}
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_SET_OPMODE, (u8 *)(&type));
+	//Set_NETYPE0_MSR(padapter, type);
+
+#ifdef CONFIG_AUTO_AP_MODE
+	if(psetop->mode == Ndis802_11APMode)
+		rtw_auto_ap_start_beacon(padapter);
+#endif
+
+	return H2C_SUCCESS;
+
+}
+
+u8 createbss_hdl(_adapter *padapter, u8 *pbuf)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX	*pnetwork = (WLAN_BSSID_EX*)(&(pmlmeinfo->network));
+	struct joinbss_parm *pparm = (struct joinbss_parm *)pbuf;
+	u32	initialgain;
+
+
+	if(pparm->network.InfrastructureMode == Ndis802_11APMode)
+	{
+#ifdef CONFIG_AP_MODE
+
+		if(pmlmeinfo->state == WIFI_FW_AP_STATE)
+		{
+			//todo:
+			return H2C_SUCCESS;
+		}
+#endif
+	}
+
+	//below is for ad-hoc master
+	if(pparm->network.InfrastructureMode == Ndis802_11IBSS)
+	{
+		rtw_joinbss_reset(padapter);
+
+		pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
+		pmlmeext->cur_ch_offset= HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+		pmlmeinfo->ERP_enable = 0;
+		pmlmeinfo->WMM_enable = 0;
+		pmlmeinfo->HT_enable = 0;
+		pmlmeinfo->HT_caps_enable = 0;
+		pmlmeinfo->HT_info_enable = 0;
+		pmlmeinfo->agg_enable_bitmap = 0;
+		pmlmeinfo->candidate_tid_bitmap = 0;
+
+		//disable dynamic functions, such as high power, DIG
+		Save_DM_Func_Flag(padapter);
+		Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, _FALSE);
+
+		//config the initial gain under linking, need to write the BB registers
+		initialgain = 0x1E;
+		rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
+
+		//cancel link timer
+		_cancel_timer_ex(&pmlmeext->link_timer);
+
+		//clear CAM
+		flush_all_cam_entry(padapter);
+
+		_rtw_memcpy(pnetwork, pbuf, FIELD_OFFSET(WLAN_BSSID_EX, IELength));
+		pnetwork->IELength = ((WLAN_BSSID_EX *)pbuf)->IELength;
+
+		if(pnetwork->IELength>MAX_IE_SZ)//Check pbuf->IELength
+			return H2C_PARAMETERS_ERROR;
+
+		_rtw_memcpy(pnetwork->IEs, ((WLAN_BSSID_EX *)pbuf)->IEs, pnetwork->IELength);
+
+		start_create_ibss(padapter);
+
+	}
+
+	return H2C_SUCCESS;
+
+}
+
+u8 join_cmd_hdl(_adapter *padapter, u8 *pbuf)
+{
+	u8	join_type;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX		*pnetwork = (WLAN_BSSID_EX*)(&(pmlmeinfo->network));
+#ifdef CONFIG_ANTENNA_DIVERSITY
+	struct joinbss_parm	*pparm = (struct joinbss_parm *)pbuf;
+#endif //CONFIG_ANTENNA_DIVERSITY
+	u32	initialgain, i;
+	u8 cbw40_enable=0;
+	//u32	acparm;
+
+	//check already connecting to AP or not
+	if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)
+	{
+		if (pmlmeinfo->state & WIFI_FW_STATION_STATE)
+		{
+			issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, 5, 100);
+		}
+
+		pmlmeinfo->state = WIFI_FW_NULL_STATE;
+
+		//clear CAM
+		flush_all_cam_entry(padapter);
+
+		_cancel_timer_ex(&pmlmeext->link_timer);
+
+		//set MSR to nolink -> infra. mode
+		//Set_MSR(padapter, _HW_STATE_NOLINK_);
+		Set_MSR(padapter, _HW_STATE_STATION_);
+
+
+		rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, 0);
+	}
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+	rtw_antenna_select_cmd(padapter, pparm->network.PhyInfo.Optimum_antenna, _FALSE);
+#endif
+
+	rtw_joinbss_reset(padapter);
+
+	pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
+	pmlmeext->cur_ch_offset= HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+	pmlmeinfo->ERP_enable = 0;
+	pmlmeinfo->WMM_enable = 0;
+	pmlmeinfo->HT_enable = 0;
+	pmlmeinfo->HT_caps_enable = 0;
+	pmlmeinfo->HT_info_enable = 0;
+	pmlmeinfo->agg_enable_bitmap = 0;
+	pmlmeinfo->candidate_tid_bitmap = 0;
+	pmlmeinfo->bwmode_updated = _FALSE;
+	//pmlmeinfo->assoc_AP_vendor = maxAP;
+
+	_rtw_memcpy(pnetwork, pbuf, FIELD_OFFSET(WLAN_BSSID_EX, IELength));
+	pnetwork->IELength = ((WLAN_BSSID_EX *)pbuf)->IELength;
+
+	if(pnetwork->IELength>MAX_IE_SZ)//Check pbuf->IELength
+		return H2C_PARAMETERS_ERROR;
+
+	_rtw_memcpy(pnetwork->IEs, ((WLAN_BSSID_EX *)pbuf)->IEs, pnetwork->IELength);
+
+	pmlmeext->cur_channel = (u8)pnetwork->Configuration.DSConfig;
+	pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
+
+	//Check AP vendor to move rtw_joinbss_cmd()
+	//pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pnetwork->IEs, pnetwork->IELength);
+
+	for (i = sizeof(NDIS_802_11_FIXED_IEs); i < pnetwork->IELength;)
+	{
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(pnetwork->IEs + i);
+
+		switch (pIE->ElementID)
+		{
+			case _VENDOR_SPECIFIC_IE_://Get WMM IE.
+				if ( _rtw_memcmp(pIE->data, WMM_OUI, 4) )
+				{
+					pmlmeinfo->WMM_enable = 1;
+				}
+				break;
+
+			case _HT_CAPABILITY_IE_:	//Get HT Cap IE.
+				pmlmeinfo->HT_caps_enable = 1;
+				break;
+
+			case _HT_EXTRA_INFO_IE_:	//Get HT Info IE.
+				pmlmeinfo->HT_info_enable = 1;
+
+				//spec case only for cisco's ap because cisco's ap issue assoc rsp using mcs rate @40MHz or @20MHz
+//#if !defined(CONFIG_CONCURRENT_MODE) && !defined(CONFIG_DUALMAC_CONCURRENT)
+//				if(pmlmeinfo->assoc_AP_vendor == ciscoAP)
+//#endif
+				{
+					struct HT_info_element *pht_info = (struct HT_info_element *)(pIE->data);
+
+					if( pnetwork->Configuration.DSConfig > 14 )
+					{
+						if( pregpriv->cbw40_enable & BIT(1) )
+							cbw40_enable = 1;
+					}
+					else
+						if( pregpriv->cbw40_enable & BIT(0) )
+							cbw40_enable = 1;
+
+					if ((cbw40_enable) &&	 (pht_info->infos[0] & BIT(2)))
+					{
+						//switch to the 40M Hz mode according to the AP
+						pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+						switch (pht_info->infos[0] & 0x3)
+						{
+							case 1:
+								pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+								break;
+
+							case 3:
+								pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+								break;
+
+							default:
+								pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+								break;
+						}
+
+						DBG_871X("set ch/bw before connected\n");
+					}
+				}
+				break;
+
+			default:
+				break;
+		}
+
+		i += (pIE->Length + 2);
+	}
+#if 0
+	if (padapter->registrypriv.wifi_spec) {
+		// for WiFi test, follow WMM test plan spec
+		acparm = 0x002F431C; // VO
+		rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_VO, (u8 *)(&acparm));
+		acparm = 0x005E541C; // VI
+		rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_VI, (u8 *)(&acparm));
+		acparm = 0x0000A525; // BE
+		rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_BE, (u8 *)(&acparm));
+		acparm = 0x0000A549; // BK
+		rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_BK, (u8 *)(&acparm));
+
+		// for WiFi test, mixed mode with intel STA under bg mode throughput issue
+		if (padapter->mlmepriv.htpriv.ht_option == _FALSE){
+			acparm = 0x00004320;
+			rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_BE, (u8 *)(&acparm));
+		}
+	}
+	else {
+		acparm = 0x002F3217; // VO
+		rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_VO, (u8 *)(&acparm));
+		acparm = 0x005E4317; // VI
+		rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_VI, (u8 *)(&acparm));
+		acparm = 0x00105320; // BE
+		rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_BE, (u8 *)(&acparm));
+		acparm = 0x0000A444; // BK
+		rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_BK, (u8 *)(&acparm));
+	}
+#endif
+
+	/* check channel, bandwidth, offset and switch */
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	if(dc_handle_join_request(padapter) == _FAIL) {
+		DBG_871X("dc_handle_join_request fail !!!\n");
+		return H2C_SUCCESS;
+	}
+	set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+#else //NON CONFIG_DUALMAC_CONCURRENT
+	if(rtw_chk_start_clnt_join(padapter) == _FAIL) {
+		report_join_res(padapter, (-4));
+		return H2C_SUCCESS;
+	}
+#endif
+
+	//disable dynamic functions, such as high power, DIG
+	//Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, _FALSE);
+
+	//config the initial gain under linking, need to write the BB registers
+
+	initialgain = 0x1E;
+	rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
+
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, pmlmeinfo->network.MacAddress);
+	join_type = 0;
+	rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
+
+	//cancel link timer
+	_cancel_timer_ex(&pmlmeext->link_timer);
+
+	start_clnt_join(padapter);
+
+	return H2C_SUCCESS;
+
+}
+
+u8 disconnect_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	struct disconnect_parm *param = (struct disconnect_parm *)pbuf;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX		*pnetwork = (WLAN_BSSID_EX*)(&(pmlmeinfo->network));
+	u8	val8;
+
+	if (is_client_associated_to_ap(padapter))
+	{
+		issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, param->deauth_timeout_ms/100, 100);
+	}
+
+	//set_opmode_cmd(padapter, infra_client_with_mlme);
+
+	//pmlmeinfo->state = WIFI_FW_NULL_STATE;
+
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, 0);
+	rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
+
+	//restore to initial setting.
+	update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
+
+	if(((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE))
+	{
+		//Stop BCN
+		val8 = 0;
+		rtw_hal_set_hwreg(padapter, HW_VAR_BCN_FUNC, (u8 *)(&val8));
+	}
+
+
+	//set MSR to no link state -> infra. mode
+	Set_MSR(padapter, _HW_STATE_STATION_);
+
+	pmlmeinfo->state = WIFI_FW_NULL_STATE;
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	dc_set_channel_bwmode_disconnect(padapter);
+#else
+#ifdef CONFIG_CONCURRENT_MODE
+	if((check_buddy_fwstate(padapter, _FW_LINKED)) != _TRUE)
+	{
+#endif //CONFIG_CONCURRENT_MODE
+		//switch to the 20M Hz mode after disconnect
+		pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
+		pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+		set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+#ifdef CONFIG_CONCURRENT_MODE
+	}
+#endif //CONFIG_CONCURRENT_MODE
+#endif //CONFIG_DUALMAC_CONCURRENT
+
+	flush_all_cam_entry(padapter);
+
+	_cancel_timer_ex(&pmlmeext->link_timer);
+
+	rtw_free_uc_swdec_pending_queue(padapter);
+
+	return 	H2C_SUCCESS;
+}
+
+int rtw_scan_ch_decision(_adapter *padapter, struct rtw_ieee80211_channel *out,
+	u32 out_num, struct rtw_ieee80211_channel *in, u32 in_num)
+{
+	int i, j;
+	int scan_ch_num = 0;
+	int set_idx;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+
+	/* clear first */
+	_rtw_memset(out, 0, sizeof(struct rtw_ieee80211_channel)*out_num);
+
+	/* acquire channels from in */
+	j = 0;
+	for (i=0;i<in_num;i++) {
+
+		if (0)
+		DBG_871X(FUNC_ADPT_FMT" "CHAN_FMT"\n", FUNC_ADPT_ARG(padapter), CHAN_ARG(&in[i]));
+
+		if(in[i].hw_value && !(in[i].flags & RTW_IEEE80211_CHAN_DISABLED)
+			&& (set_idx=rtw_ch_set_search_ch(pmlmeext->channel_set, in[i].hw_value)) >=0
+			&& rtw_mlme_band_check(padapter, in[i].hw_value) == _TRUE
+		)
+		{
+			if (j >= out_num) {
+				DBG_871X_LEVEL(_drv_always_, FUNC_ADPT_FMT" out_num:%u not enough\n",
+					FUNC_ADPT_ARG(padapter), out_num);
+				break;
+			}
+
+			_rtw_memcpy(&out[j], &in[i], sizeof(struct rtw_ieee80211_channel));
+
+			if(pmlmeext->channel_set[set_idx].ScanType == SCAN_PASSIVE)
+				out[j].flags &= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
+
+			j++;
+		}
+		if(j>=out_num)
+			break;
+	}
+
+	/* if out is empty, use channel_set as default */
+	if(j == 0) {
+		for (i=0;i<pmlmeext->max_chan_nums;i++) {
+
+			if (0)
+			DBG_871X(FUNC_ADPT_FMT" ch:%u\n", FUNC_ADPT_ARG(padapter), pmlmeext->channel_set[i].ChannelNum);
+
+			if (rtw_mlme_band_check(padapter, pmlmeext->channel_set[i].ChannelNum) == _TRUE) {
+
+				if (j >= out_num) {
+					DBG_871X_LEVEL(_drv_always_, FUNC_ADPT_FMT" out_num:%u not enough\n",
+						FUNC_ADPT_ARG(padapter), out_num);
+					break;
+				}
+
+				out[j].hw_value = pmlmeext->channel_set[i].ChannelNum;
+
+				if(pmlmeext->channel_set[i].ScanType == SCAN_PASSIVE)
+					out[j].flags &= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
+
+				j++;
+			}
+		}
+	}
+
+	return j;
+}
+
+u8 sitesurvey_cmd_hdl(_adapter *padapter, u8 *pbuf)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct sitesurvey_parm	*pparm = (struct sitesurvey_parm *)pbuf;
+	u8	bdelayscan = _FALSE;
+	u8	val8;
+	u32	initialgain;
+	u32	i;
+	u8	write_initial_gain = 1;
+
+#ifdef CONFIG_P2P
+	struct wifidirect_info*	pwdinfo = &padapter->wdinfo;
+#endif
+
+	if (pmlmeext->sitesurvey_res.state == SCAN_DISABLE)
+	{
+#ifdef CONFIG_CONCURRENT_MODE
+		//for first time sitesurvey_cmd
+		rtw_hal_set_hwreg(padapter, HW_VAR_CHECK_TXBUF, 0);
+#endif //CONFIG_CONCURRENT_MODE
+
+		pmlmeext->sitesurvey_res.state = SCAN_START;
+		pmlmeext->sitesurvey_res.bss_cnt = 0;
+		pmlmeext->sitesurvey_res.channel_idx = 0;
+
+		for(i=0;i<RTW_SSID_SCAN_AMOUNT;i++){
+			if(pparm->ssid[i].SsidLength) {
+				_rtw_memcpy(pmlmeext->sitesurvey_res.ssid[i].Ssid, pparm->ssid[i].Ssid, IW_ESSID_MAX_SIZE);
+				pmlmeext->sitesurvey_res.ssid[i].SsidLength= pparm->ssid[i].SsidLength;
+			} else {
+				pmlmeext->sitesurvey_res.ssid[i].SsidLength= 0;
+			}
+		}
+
+		pmlmeext->sitesurvey_res.ch_num = rtw_scan_ch_decision(padapter
+			, pmlmeext->sitesurvey_res.ch, RTW_CHANNEL_SCAN_AMOUNT
+			, pparm->ch, pparm->ch_num
+		);
+
+		pmlmeext->sitesurvey_res.scan_mode = pparm->scan_mode;
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+		bdelayscan = dc_handle_site_survey(padapter);
+#endif
+
+		//issue null data if associating to the AP
+		if (is_client_associated_to_ap(padapter) == _TRUE)
+		{
+			pmlmeext->sitesurvey_res.state = SCAN_TXNULL;
+
+			issue_nulldata(padapter, NULL, 1, 3, 500);
+
+#ifdef CONFIG_CONCURRENT_MODE
+			if(is_client_associated_to_ap(padapter->pbuddy_adapter) == _TRUE)
+			{
+				DBG_871X("adapter is scanning(buddy_adapter is linked), issue nulldata(pwrbit=1)\n");
+
+				issue_nulldata(padapter->pbuddy_adapter, NULL, 1, 3, 500);
+			}
+#endif
+			bdelayscan = _TRUE;
+		}
+#ifdef CONFIG_CONCURRENT_MODE
+		else if(is_client_associated_to_ap(padapter->pbuddy_adapter) == _TRUE)
+		{
+			#ifdef CONFIG_TDLS
+			if(padapter->pbuddy_adapter->wdinfo.wfd_tdls_enable == 1)
+			{
+				issue_tunneled_probe_req(padapter->pbuddy_adapter);
+			}
+			#endif //CONFIG_TDLS
+
+			pmlmeext->sitesurvey_res.state = SCAN_TXNULL;
+
+			issue_nulldata(padapter->pbuddy_adapter, NULL, 1, 3, 500);
+
+			bdelayscan = _TRUE;
+		}
+#endif
+		if(bdelayscan)
+		{
+			//delay 50ms to protect nulldata(1).
+			set_survey_timer(pmlmeext, 50);
+			return H2C_SUCCESS;
+		}
+	}
+
+	if ((pmlmeext->sitesurvey_res.state == SCAN_START) || (pmlmeext->sitesurvey_res.state == SCAN_TXNULL))
+	{
+#ifdef CONFIG_FIND_BEST_CHANNEL
+#if 0
+		for (i=0; pmlmeext->channel_set[i].ChannelNum !=0; i++) {
+			pmlmeext->channel_set[i].rx_count = 0;
+		}
+#endif
+#endif /* CONFIG_FIND_BEST_CHANNEL */
+
+		//disable dynamic functions, such as high power, DIG
+		Save_DM_Func_Flag(padapter);
+		Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, _FALSE);
+
+		//config the initial gain under scaning, need to write the BB registers
+
+#ifdef CONFIG_P2P
+#ifdef CONFIG_IOCTL_CFG80211
+		if((wdev_to_priv(padapter->rtw_wdev))->p2p_enabled == _TRUE && pwdinfo->driver_interface == DRIVER_CFG80211 )
+		{
+			write_initial_gain = 0;
+		}
+		else
+#endif //CONFIG_IOCTL_CFG80211
+		if ( !rtw_p2p_chk_state( pwdinfo, P2P_STATE_NONE ) )
+			initialgain = 0x28;
+		else
+#endif //CONFIG_P2P
+			initialgain = 0x17;
+
+		if(write_initial_gain == 1)
+			rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
+
+		//set MSR to no link state
+		Set_MSR(padapter, _HW_STATE_NOLINK_);
+
+		val8 = 1; //under site survey
+		rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+
+		pmlmeext->sitesurvey_res.state = SCAN_PROCESS;
+	}
+
+	site_survey(padapter);
+
+	return H2C_SUCCESS;
+
+}
+
+u8 setauth_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	struct setauth_parm		*pparm = (struct setauth_parm *)pbuf;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if (pparm->mode < 4)
+	{
+		pmlmeinfo->auth_algo = pparm->mode;
+	}
+
+	return 	H2C_SUCCESS;
+}
+
+u8 setkey_hdl(_adapter *padapter, u8 *pbuf)
+{
+	unsigned short				ctrl;
+	struct setkey_parm		*pparm = (struct setkey_parm *)pbuf;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	unsigned char					null_sta[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+	//main tx key for wep.
+	if(pparm->set_tx)
+		pmlmeinfo->key_index = pparm->keyid;
+
+	//write cam
+	ctrl = BIT(15) | ((pparm->algorithm) << 2) | pparm->keyid;
+
+	write_cam(padapter, pparm->keyid, ctrl, null_sta, pparm->key);
+
+	//allow multicast packets to driver
+	rtw_hal_set_hwreg(padapter, HW_VAR_ON_RCR_AM, null_addr);
+
+	return H2C_SUCCESS;
+}
+
+u8 set_stakey_hdl(_adapter *padapter, u8 *pbuf)
+{
+	u16 ctrl=0;
+	u8 cam_id=0;//cam_entry
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct set_stakey_parm	*pparm = (struct set_stakey_parm *)pbuf;
+#ifdef CONFIG_TDLS
+	struct tdls_info	*ptdlsinfo = &padapter->tdlsinfo;
+	struct sta_priv	*pstapriv = &padapter->stapriv;
+	struct sta_info	*psta;
+#endif //CONFIG_TDLS
+
+	//cam_entry:
+	//0~3 for default key
+
+	//for concurrent mode (ap+sta):
+	//default key is disable, using sw encrypt/decrypt
+	//cam_entry = 4 //for sta mode (macid=0)
+	//cam_entry(macid+3) = 5 ~ N//for ap mode (aid=1~N, macid=2 ~N)
+
+	//for concurrent mode (sta+sta):
+	//default key is disable, using sw encrypt/decrypt
+	//cam_entry = 4 //mapping to macid=0
+	//cam_entry = 5 //mapping to macid=2
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
+	{
+		struct sta_priv	*pstapriv = &padapter->stapriv;
+		struct sta_info	*psta;
+
+		psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.MacAddress);
+
+		if(psta && psta->mac_id==2)
+		{
+			cam_id = 5;
+		}
+		else
+		{
+			cam_id = 4;
+		}
+/*
+		if(padapter->iface_type > PRIMARY_IFACE)
+		{
+			cam_id = 5;
+		}
+		else
+		{
+			cam_id = 4;
+		}
+*/
+	}
+#else
+	cam_id = 4;
+#endif
+
+
+	if((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
+	{
+
+		struct sta_info *psta;
+		struct sta_priv *pstapriv = &padapter->stapriv;
+
+		if(pparm->algorithm == _NO_PRIVACY_)	// clear cam entry
+		{
+			clear_cam_entry(padapter, pparm->id);
+			return H2C_SUCCESS_RSP;
+		}
+
+		psta = rtw_get_stainfo(pstapriv, pparm->addr);
+		if(psta)
+		{
+			ctrl = (BIT(15) | ((pparm->algorithm) << 2));
+
+			DBG_871X("r871x_set_stakey_hdl(): enc_algorithm=%d\n", pparm->algorithm);
+
+			if((psta->mac_id<1) || (psta->mac_id>(NUM_STA-4)))
+			{
+				DBG_871X("r871x_set_stakey_hdl():set_stakey failed, mac_id(aid)=%d\n", psta->mac_id);
+				return H2C_REJECTED;
+			}
+
+			cam_id = (psta->mac_id + 3);//0~3 for default key, cmd_id=macid + 3, macid=aid+1;
+
+			DBG_871X("Write CAM, mac_addr=%x:%x:%x:%x:%x:%x, cam_entry=%d\n", pparm->addr[0],
+						pparm->addr[1], pparm->addr[2], pparm->addr[3], pparm->addr[4],
+						pparm->addr[5], cam_id);
+
+			write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
+
+			return H2C_SUCCESS_RSP;
+
+		}
+		else
+		{
+			DBG_871X("r871x_set_stakey_hdl(): sta has been free\n");
+			return H2C_REJECTED;
+		}
+
+	}
+
+	//below for sta mode
+
+	if(pparm->algorithm == _NO_PRIVACY_)	// clear cam entry
+	{
+		clear_cam_entry(padapter, pparm->id);
+		return H2C_SUCCESS;
+	}
+
+	ctrl = BIT(15) | ((pparm->algorithm) << 2);
+
+#ifdef CONFIG_TDLS
+	if(ptdlsinfo->clear_cam!=0){
+		clear_cam_entry(padapter, ptdlsinfo->clear_cam);
+		ptdlsinfo->clear_cam=0;
+
+		return H2C_SUCCESS;
+	}
+
+	psta = rtw_get_stainfo(pstapriv, pparm->addr);//Get TDLS Peer STA
+	if( psta->tdls_sta_state&TDLS_LINKED_STATE ){
+		write_cam(padapter, psta->mac_id, ctrl, pparm->addr, pparm->key);
+	}
+	else
+#endif //CONFIG_TDLS
+	write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
+
+	pmlmeinfo->enc_algo = pparm->algorithm;
+
+	return H2C_SUCCESS;
+}
+
+u8 add_ba_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	struct addBaReq_parm 	*pparm = (struct addBaReq_parm *)pbuf;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, pparm->addr);
+
+	if(!psta)
+		return 	H2C_SUCCESS;
+
+
+	if (((pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) && (pmlmeinfo->HT_enable)) ||
+		((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE))
+	{
+		//pmlmeinfo->ADDBA_retry_count = 0;
+		//pmlmeinfo->candidate_tid_bitmap |= (0x1 << pparm->tid);
+		//psta->htpriv.candidate_tid_bitmap |= BIT(pparm->tid);
+		issue_action_BA(padapter, pparm->addr, RTW_WLAN_ACTION_ADDBA_REQ, (u16)pparm->tid);
+		//_set_timer(&pmlmeext->ADDBA_timer, ADDBA_TO);
+		_set_timer(&psta->addba_retry_timer, ADDBA_TO);
+	}
+#ifdef CONFIG_TDLS
+	else if((psta->tdls_sta_state & TDLS_LINKED_STATE)&&
+		(psta->htpriv.ht_option==_TRUE) &&
+		(psta->htpriv.ampdu_enable==_TRUE) )
+	{
+		issue_action_BA(padapter, pparm->addr, RTW_WLAN_ACTION_ADDBA_REQ, (u16)pparm->tid);
+		//_set_timer(&pmlmeext->ADDBA_timer, ADDBA_TO);
+		_set_timer(&psta->addba_retry_timer, ADDBA_TO);
+	}
+#endif //CONFIG
+	else
+	{
+		psta->htpriv.candidate_tid_bitmap &= ~BIT(pparm->tid);
+	}
+
+	return 	H2C_SUCCESS;
+}
+
+u8 set_tx_beacon_cmd(_adapter* padapter)
+{
+	struct cmd_obj	*ph2c;
+	struct Tx_Beacon_param 	*ptxBeacon_parm;
+	struct cmd_priv	*pcmdpriv = &(padapter->cmdpriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8	res = _SUCCESS;
+	int len_diff = 0;
+
+_func_enter_;
+
+	if ((ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj))) == NULL)
+	{
+		res= _FAIL;
+		goto exit;
+	}
+
+	if ((ptxBeacon_parm = (struct Tx_Beacon_param *)rtw_zmalloc(sizeof(struct Tx_Beacon_param))) == NULL)
+	{
+		rtw_mfree((unsigned char *)ph2c, sizeof(struct	cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	_rtw_memcpy(&(ptxBeacon_parm->network), &(pmlmeinfo->network), sizeof(WLAN_BSSID_EX));
+
+	len_diff = update_hidden_ssid(
+		ptxBeacon_parm->network.IEs+_BEACON_IE_OFFSET_
+		, ptxBeacon_parm->network.IELength-_BEACON_IE_OFFSET_
+		, pmlmeinfo->hidden_ssid_mode
+	);
+	ptxBeacon_parm->network.IELength += len_diff;
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, ptxBeacon_parm, GEN_CMD_CODE(_TX_Beacon));
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+
+u8 mlme_evt_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	u8 evt_code, evt_seq;
+	u16 evt_sz;
+	uint 	*peventbuf;
+	void (*event_callback)(_adapter *dev, u8 *pbuf);
+	struct evt_priv *pevt_priv = &(padapter->evtpriv);
+
+	peventbuf = (uint*)pbuf;
+	evt_sz = (u16)(*peventbuf&0xffff);
+	evt_seq = (u8)((*peventbuf>>24)&0x7f);
+	evt_code = (u8)((*peventbuf>>16)&0xff);
+
+
+	#ifdef CHECK_EVENT_SEQ
+	// checking event sequence...
+	if (evt_seq != (ATOMIC_READ(&pevt_priv->event_seq) & 0x7f) )
+	{
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_info_,("Evetn Seq Error! %d vs %d\n", (evt_seq & 0x7f), (ATOMIC_READ(&pevt_priv->event_seq) & 0x7f)));
+
+		pevt_priv->event_seq = (evt_seq+1)&0x7f;
+
+		goto _abort_event_;
+	}
+	#endif
+
+	// checking if event code is valid
+	if (evt_code >= MAX_C2HEVT)
+	{
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\nEvent Code(%d) mismatch!\n", evt_code));
+		goto _abort_event_;
+	}
+
+	// checking if event size match the event parm size
+	if ((wlanevents[evt_code].parmsize != 0) &&
+			(wlanevents[evt_code].parmsize != evt_sz))
+	{
+
+		RT_TRACE(_module_rtl871x_cmd_c_,_drv_err_,("\nEvent(%d) Parm Size mismatch (%d vs %d)!\n",
+			evt_code, wlanevents[evt_code].parmsize, evt_sz));
+		goto _abort_event_;
+
+	}
+
+	ATOMIC_INC(&pevt_priv->event_seq);
+
+	peventbuf += 2;
+
+	if(peventbuf)
+	{
+		event_callback = wlanevents[evt_code].event_callback;
+		event_callback(padapter, (u8*)peventbuf);
+
+		pevt_priv->evt_done_cnt++;
+	}
+
+
+_abort_event_:
+
+
+	return H2C_SUCCESS;
+
+}
+
+u8 h2c_msg_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	if(!pbuf)
+		return H2C_PARAMETERS_ERROR;
+
+	return H2C_SUCCESS;
+}
+
+u8 tx_beacon_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	if(send_beacon(padapter)==_FAIL)
+	{
+		DBG_871X("issue_beacon, fail!\n");
+		return H2C_PARAMETERS_ERROR;
+	}
+#ifdef CONFIG_AP_MODE
+	else //tx bc/mc frames after update TIM
+	{
+		_irqL irqL;
+		struct sta_info *psta_bmc;
+		_list	*xmitframe_plist, *xmitframe_phead;
+		struct xmit_frame *pxmitframe=NULL;
+		struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+		struct sta_priv  *pstapriv = &padapter->stapriv;
+
+		//for BC/MC Frames
+		psta_bmc = rtw_get_bcmc_stainfo(padapter);
+		if(!psta_bmc)
+			return H2C_SUCCESS;
+
+		if((pstapriv->tim_bitmap&BIT(0)) && (psta_bmc->sleepq_len>0))
+		{
+#ifndef CONFIG_PCI_HCI
+			rtw_msleep_os(10);// 10ms, ATIM(HIQ) Windows
+#endif
+			//_enter_critical_bh(&psta_bmc->sleep_q.lock, &irqL);
+			_enter_critical_bh(&pxmitpriv->lock, &irqL);
+
+			xmitframe_phead = get_list_head(&psta_bmc->sleep_q);
+			xmitframe_plist = get_next(xmitframe_phead);
+
+			while ((rtw_end_of_queue_search(xmitframe_phead, xmitframe_plist)) == _FALSE)
+			{
+				pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
+
+				xmitframe_plist = get_next(xmitframe_plist);
+
+				rtw_list_delete(&pxmitframe->list);
+
+				psta_bmc->sleepq_len--;
+				if(psta_bmc->sleepq_len>0)
+					pxmitframe->attrib.mdata = 1;
+				else
+					pxmitframe->attrib.mdata = 0;
+
+				pxmitframe->attrib.triggered=1;
+
+				pxmitframe->attrib.qsel = 0x11;//HIQ
+
+#if 0
+				_exit_critical_bh(&psta_bmc->sleep_q.lock, &irqL);
+				if(rtw_hal_xmit(padapter, pxmitframe) == _TRUE)
+				{
+					rtw_os_xmit_complete(padapter, pxmitframe);
+				}
+				_enter_critical_bh(&psta_bmc->sleep_q.lock, &irqL);
+
+#endif
+				rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
+
+				//pstapriv->tim_bitmap &= ~BIT(0);
+
+			}
+
+			//_exit_critical_bh(&psta_bmc->sleep_q.lock, &irqL);
+	               _exit_critical_bh(&pxmitpriv->lock, &irqL);
+
+		}
+
+	}
+#endif
+
+	return H2C_SUCCESS;
+
+}
+
+void change_band_update_ie(_adapter *padapter, WLAN_BSSID_EX *pnetwork)
+{
+	u8	network_type,rate_len, total_rate_len,remainder_rate_len;
+	struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8	erpinfo=0x4;
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	if(pmlmeext->cur_channel >= 36)
+	{
+		network_type = WIRELESS_11A;
+		total_rate_len = IEEE80211_NUM_OFDM_RATESLEN;
+		DBG_871X("%s(): change to 5G Band\n",__FUNCTION__);
+		rtw_remove_bcn_ie(padapter, pnetwork, _ERPINFO_IE_);
+	}
+	else
+	{
+		network_type = WIRELESS_11BG;
+		total_rate_len = IEEE80211_CCK_RATE_LEN+IEEE80211_NUM_OFDM_RATESLEN;
+		DBG_871X("%s(): change to 2.4G Band\n",__FUNCTION__);
+		rtw_add_bcn_ie(padapter, pnetwork, _ERPINFO_IE_, &erpinfo, 1);
+	}
+
+	rtw_set_supported_rate(pnetwork->SupportedRates, network_type);
+
+	UpdateBrateTbl(padapter, pnetwork->SupportedRates);
+	rtw_hal_set_hwreg(padapter, HW_VAR_BASIC_RATE, pnetwork->SupportedRates);
+
+	if(total_rate_len > 8)
+	{
+		rate_len = 8;
+		remainder_rate_len = total_rate_len - 8;
+	}
+	else
+	{
+		rate_len = total_rate_len;
+		remainder_rate_len = 0;
+	}
+
+	rtw_add_bcn_ie(padapter, pnetwork, _SUPPORTEDRATES_IE_, pnetwork->SupportedRates, rate_len);
+
+	if(remainder_rate_len)
+	{
+		rtw_add_bcn_ie(padapter, pnetwork, _EXT_SUPPORTEDRATES_IE_, (pnetwork->SupportedRates+8), remainder_rate_len);
+	}
+	else
+	{
+		rtw_remove_bcn_ie(padapter, pnetwork, _EXT_SUPPORTEDRATES_IE_);
+	}
+}
+
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+void dc_SelectChannel(_adapter *padapter, unsigned char channel)
+{
+	PADAPTER ptarget_adapter;
+
+	if( (padapter->pbuddy_adapter != NULL) &&
+		(padapter->DualMacConcurrent == _TRUE) &&
+		(padapter->adapter_type == SECONDARY_ADAPTER))
+	{
+		// only mac0 could control BB&RF
+		ptarget_adapter = padapter->pbuddy_adapter;
+	}
+	else
+	{
+		ptarget_adapter = padapter;
+	}
+
+	_enter_critical_mutex(&(adapter_to_dvobj(ptarget_adapter)->setch_mutex), NULL);
+
+	rtw_hal_set_chan(ptarget_adapter, channel);
+
+	_exit_critical_mutex(&(adapter_to_dvobj(ptarget_adapter)->setch_mutex), NULL);
+}
+
+void dc_SetBWMode(_adapter *padapter, unsigned short bwmode, unsigned char channel_offset)
+{
+	PADAPTER ptarget_adapter;
+
+	if( (padapter->pbuddy_adapter != NULL) &&
+		(padapter->DualMacConcurrent == _TRUE) &&
+		(padapter->adapter_type == SECONDARY_ADAPTER))
+	{
+		// only mac0 could control BB&RF
+		ptarget_adapter = padapter->pbuddy_adapter;
+	}
+	else
+	{
+		ptarget_adapter = padapter;
+	}
+
+	_enter_critical_mutex(&(adapter_to_dvobj(ptarget_adapter)->setbw_mutex), NULL);
+
+	rtw_hal_set_bwmode(ptarget_adapter, (HT_CHANNEL_WIDTH)bwmode, channel_offset);
+
+	_exit_critical_mutex(&(adapter_to_dvobj(ptarget_adapter)->setbw_mutex), NULL);
+}
+
+void dc_set_channel_bwmode_disconnect(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_priv *pbuddy_mlmepriv = NULL;
+
+	if(pbuddy_adapter != NULL &&
+		padapter->DualMacConcurrent == _TRUE)
+	{
+		pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+		if((check_fwstate(pbuddy_mlmepriv, _FW_LINKED)) != _TRUE)
+		{
+			//switch to the 20M Hz mode after disconnect
+			pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
+			pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+			set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+		}
+	}
+	else
+	{
+		//switch to the 20M Hz mode after disconnect
+		pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
+		pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+		set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+	}
+}
+
+u8 dc_handle_join_request(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX		*pnetwork = (WLAN_BSSID_EX*)(&(pmlmeinfo->network));
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_ext_priv *pbuddy_mlmeext = NULL;
+	struct mlme_priv	*pbuddy_mlmepriv = NULL;
+	u8	ret = _SUCCESS;
+
+	if(pbuddy_adapter != NULL &&
+		padapter->DualMacConcurrent == _TRUE)
+	{
+		pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+		pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+
+		if(pmlmeext->cur_channel != pbuddy_mlmeext->cur_channel ||
+			pmlmeext->cur_bwmode != pbuddy_mlmeext->cur_bwmode ||
+			pmlmeext->cur_ch_offset != pbuddy_mlmeext->cur_ch_offset)
+		{
+			if((check_fwstate(pbuddy_mlmepriv, WIFI_AP_STATE)) == _TRUE)
+			{
+				//issue deauth to all stas if if2 is at ap mode
+				rtw_sta_flush(pbuddy_adapter);
+
+				//rtw_hal_set_hwreg(padapter, HW_VAR_CHECK_TXBUF, 0);
+				rtw_hal_set_hwreg(pbuddy_adapter, HW_VAR_CHECK_TXBUF, 0);
+			}
+			else if(check_fwstate(pbuddy_mlmepriv, _FW_LINKED) == _TRUE)
+			{
+				if(pmlmeext->cur_channel == pbuddy_mlmeext->cur_channel)
+				{
+					// HT_CHANNEL_WIDTH_40 or HT_CHANNEL_WIDTH_20 but channel offset is different
+					if((pmlmeext->cur_bwmode == pbuddy_mlmeext->cur_bwmode) &&
+						(pmlmeext->cur_ch_offset != pbuddy_mlmeext->cur_ch_offset) )
+					{
+						report_join_res(padapter, -4);
+						ret = _FAIL;
+					}
+				}
+				else
+				{
+					report_join_res(padapter, -4);
+					ret = _FAIL;
+				}
+			}
+		}
+		else	 if (is_client_associated_to_ap(pbuddy_adapter) == _TRUE)
+		{
+			issue_nulldata(pbuddy_adapter, NULL, 1, 0, 0);
+		}
+	}
+
+	return ret;
+}
+
+void dc_handle_join_done(_adapter *padapter, u8 join_res)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_priv *pbuddy_mlmepriv = NULL;
+	struct mlme_ext_priv *pbuddy_mlmeext = NULL;
+	struct mlme_ext_info *pbuddy_mlmeinfo = NULL;
+	WLAN_BSSID_EX *pbuddy_network_mlmeext = NULL;
+	u8	change_band = _FALSE;
+
+
+	if(pbuddy_adapter != NULL &&
+		padapter->DualMacConcurrent == _TRUE)
+	{
+		pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+		pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+		pbuddy_mlmeinfo = &(pbuddy_mlmeext->mlmext_info);
+		pbuddy_network_mlmeext = &(pbuddy_mlmeinfo->network);
+
+		if(((pbuddy_mlmeinfo->state&0x03) == WIFI_FW_AP_STATE) &&
+				check_fwstate(pbuddy_mlmepriv, _FW_LINKED))
+		{
+			//restart and update beacon
+			DBG_871X("after join, current adapter, CH=%d, BW=%d, offset=%d\n", pmlmeext->cur_channel, pmlmeext->cur_bwmode, pmlmeext->cur_ch_offset);
+
+			if(join_res >= 0)
+			{
+				u8 *p;
+				int	ie_len;
+				struct HT_info_element *pht_info=NULL;
+
+				if((pbuddy_mlmeext->cur_channel <= 14 && pmlmeext->cur_channel >= 36) ||
+					(pbuddy_mlmeext->cur_channel >= 36 && pmlmeext->cur_channel <= 14))
+				{
+					change_band = _TRUE;
+				}
+
+				//sync channel/bwmode/ch_offset with another adapter
+				pbuddy_mlmeext->cur_channel = pmlmeext->cur_channel;
+
+				if(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40)
+				{
+					p = rtw_get_ie((pbuddy_network_mlmeext->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _HT_ADD_INFO_IE_, &ie_len, (pbuddy_network_mlmeext->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+					if( p && ie_len)
+					{
+						pht_info = (struct HT_info_element *)(p+2);
+						pht_info->infos[0] &= ~(BIT(0)|BIT(1)); //no secondary channel is present
+					}
+
+					if(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40)
+					{
+						pbuddy_mlmeext->cur_ch_offset = pmlmeext->cur_ch_offset;
+
+						//to update cur_ch_offset value in beacon
+						if( pht_info )
+						{
+							switch(pmlmeext->cur_ch_offset)
+							{
+								case HAL_PRIME_CHNL_OFFSET_LOWER:
+									pht_info->infos[0] |= 0x1;
+									break;
+								case HAL_PRIME_CHNL_OFFSET_UPPER:
+									pht_info->infos[0] |= 0x3;
+									break;
+								case HAL_PRIME_CHNL_OFFSET_DONT_CARE:
+								default:
+									break;
+							}
+						}
+					}
+					else if(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_20)
+					{
+						pbuddy_mlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
+						pbuddy_mlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+						if(pmlmeext->cur_channel>0 && pmlmeext->cur_channel<5)
+						{
+							if(pht_info)
+								pht_info->infos[0] |= 0x1;
+
+							pbuddy_mlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+							pbuddy_mlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+						}
+
+						if(pmlmeext->cur_channel>7 && pmlmeext->cur_channel<(14+1))
+						{
+							if(pht_info)
+								pht_info->infos[0] |= 0x3;
+
+							pbuddy_mlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+							pbuddy_mlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+						}
+
+						set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+					}
+				}
+
+				// to update channel value in beacon
+				pbuddy_network_mlmeext->Configuration.DSConfig = pmlmeext->cur_channel;
+				p = rtw_get_ie((pbuddy_network_mlmeext->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _DSSET_IE_, &ie_len, (pbuddy_network_mlmeext->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+				if(p && ie_len>0)
+					*(p + 2) = pmlmeext->cur_channel;
+
+				p = rtw_get_ie((pbuddy_network_mlmeext->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _HT_ADD_INFO_IE_, &ie_len, (pbuddy_network_mlmeext->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+				if( p && ie_len)
+				{
+					pht_info = (struct HT_info_element *)(p+2);
+					pht_info->primary_channel = pmlmeext->cur_channel;
+				}
+
+				// update mlmepriv's cur_network
+				_rtw_memcpy(&pbuddy_mlmepriv->cur_network.network, pbuddy_network_mlmeext, pbuddy_network_mlmeext->Length);
+			}
+			else
+			{
+				// switch back to original channel/bwmode/ch_offset;
+				set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+			}
+
+			DBG_871X("after join, another adapter, CH=%d, BW=%d, offset=%d\n", pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_bwmode, pbuddy_mlmeext->cur_ch_offset);
+
+			if(change_band == _TRUE)
+				change_band_update_ie(pbuddy_adapter, pbuddy_network_mlmeext);
+
+			DBG_871X("update pbuddy_adapter's beacon\n");
+
+			update_beacon(pbuddy_adapter, 0, NULL, _TRUE);
+		}
+		else	 if (is_client_associated_to_ap(pbuddy_adapter) == _TRUE)
+		{
+			if((pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40) &&
+				(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_20))
+			{
+				set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+			}
+
+			issue_nulldata(pbuddy_adapter, NULL, 0, 0, 0);
+		}
+	}
+}
+
+sint	dc_check_fwstate(_adapter *padapter, sint fw_state)
+{
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_priv *pbuddy_mlmepriv = NULL;
+
+	if(padapter->pbuddy_adapter != NULL &&
+		padapter->DualMacConcurrent == _TRUE)
+
+	{
+		pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+
+		return check_fwstate(pbuddy_mlmepriv, fw_state);
+	}
+
+	return _FALSE;
+}
+
+u8 dc_handle_site_survey(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+
+	// only mac0 can do scan request, help issue nulldata(1) for mac1
+	if(pbuddy_adapter != NULL &&
+		padapter->DualMacConcurrent == _TRUE)
+	{
+		if (is_client_associated_to_ap(pbuddy_adapter) == _TRUE)
+		{
+			pmlmeext->sitesurvey_res.state = SCAN_TXNULL;
+
+			issue_nulldata(pbuddy_adapter, NULL, 1, 2, 0);
+
+			return _TRUE;
+		}
+	}
+
+	return _FALSE;
+}
+
+void	dc_report_survey_event(_adapter *padapter, union recv_frame *precv_frame)
+{
+	if(padapter->pbuddy_adapter != NULL &&
+		padapter->DualMacConcurrent == _TRUE)
+	{
+		report_survey_event(padapter->pbuddy_adapter, precv_frame);
+	}
+}
+
+void dc_set_channel_bwmode_survey_done(_adapter *padapter)
+{
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_priv *pbuddy_mlmepriv = NULL;
+	struct mlme_ext_priv *pbuddy_mlmeext = NULL;
+	struct mlme_ext_info *pbuddy_mlmeinfo = NULL;
+	u8 cur_channel;
+	u8 cur_bwmode;
+	u8 cur_ch_offset;
+
+	if(pbuddy_adapter != NULL &&
+		padapter->DualMacConcurrent == _TRUE)
+	{
+		pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+		pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+		pbuddy_mlmeinfo = &(pbuddy_mlmeext->mlmext_info);
+
+		if(check_fwstate(pbuddy_mlmepriv, _FW_LINKED))
+		{
+			if(check_fwstate(pmlmepriv, _FW_LINKED) &&
+				(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40))
+			{
+				cur_channel = pmlmeext->cur_channel;
+				cur_bwmode = pmlmeext->cur_bwmode;
+				cur_ch_offset = pmlmeext->cur_ch_offset;
+			}
+			else
+			{
+				cur_channel = pbuddy_mlmeext->cur_channel;
+				cur_bwmode = pbuddy_mlmeext->cur_bwmode;
+				cur_ch_offset = pbuddy_mlmeext->cur_ch_offset;
+			}
+		}
+		else
+		{
+			cur_channel = pmlmeext->cur_channel;
+			cur_bwmode = pmlmeext->cur_bwmode;
+			cur_ch_offset = pmlmeext->cur_ch_offset;
+		}
+
+		set_channel_bwmode(padapter, cur_channel, cur_ch_offset, cur_bwmode);
+
+		if (is_client_associated_to_ap(pbuddy_adapter) == _TRUE)
+		{
+			//issue null data
+			issue_nulldata(pbuddy_adapter, NULL, 0, 0, 0);
+		}
+
+		if(((pbuddy_mlmeinfo->state&0x03) == WIFI_FW_AP_STATE) &&
+			check_fwstate(pbuddy_mlmepriv, _FW_LINKED))
+		{
+
+			DBG_871X("survey done, current CH=%d, BW=%d, offset=%d\n", cur_channel, cur_bwmode, cur_ch_offset);
+
+			DBG_871X("restart pbuddy_adapter's beacon\n");
+
+			update_beacon(pbuddy_adapter, 0, NULL, _TRUE);
+		}
+	}
+	else
+	{
+		set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+	}
+}
+
+void dc_set_ap_channel_bandwidth(_adapter *padapter, u8 channel, u8 channel_offset, u8 bwmode)
+{
+	u8	*p;
+	u8	val8, cur_channel, cur_bwmode, cur_ch_offset, change_band;
+	int	ie_len;
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	struct mlme_priv		*pmlmepriv = &(padapter->mlmepriv);
+	WLAN_BSSID_EX		*pnetwork = (WLAN_BSSID_EX *)&pmlmepriv->cur_network.network;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct HT_info_element	*pht_info=NULL;
+	_adapter	*pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_priv	*pbuddy_mlmepriv = NULL;
+	struct mlme_ext_priv	*pbuddy_mlmeext = NULL;
+
+	DBG_871X("dualmac_concurrent_ap_set_channel_bwmode ==>\n");
+
+	cur_channel = channel;
+	cur_bwmode = bwmode;
+	cur_ch_offset = channel_offset;
+	change_band = _FALSE;
+
+	p = rtw_get_ie((pnetwork->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _HT_ADD_INFO_IE_, &ie_len, (pnetwork->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+	if( p && ie_len)
+	{
+		pht_info = (struct HT_info_element *)(p+2);
+	}
+
+	if(pbuddy_adapter != NULL &&
+		padapter->DualMacConcurrent == _TRUE)
+	{
+		pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+		pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+		if(!check_fwstate(pbuddy_mlmepriv, _FW_LINKED|_FW_UNDER_LINKING|_FW_UNDER_SURVEY))
+		{
+			set_channel_bwmode(padapter, cur_channel, cur_ch_offset, cur_bwmode);
+		}
+		else if(check_fwstate(pbuddy_mlmepriv, _FW_LINKED)==_TRUE)
+		{
+			//To sync cur_channel/cur_bwmode/cur_ch_offset with another adapter
+			DBG_871X("Another iface is at linked state, sync cur_channel/cur_bwmode/cur_ch_offset\n");
+			DBG_871X("Another adapter, CH=%d, BW=%d, offset=%d\n", pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_bwmode, pbuddy_mlmeext->cur_ch_offset);
+			DBG_871X("Current adapter, CH=%d, BW=%d, offset=%d\n", cur_channel, cur_bwmode, cur_ch_offset);
+
+			cur_channel = pbuddy_mlmeext->cur_channel;
+			if(cur_bwmode == HT_CHANNEL_WIDTH_40)
+			{
+				if(pht_info)
+					pht_info->infos[0] &= ~(BIT(0)|BIT(1));
+
+				if(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40)
+				{
+					cur_ch_offset = pbuddy_mlmeext->cur_ch_offset;
+
+					//to update cur_ch_offset value in beacon
+					if(pht_info)
+					{
+						switch(cur_ch_offset)
+						{
+							case HAL_PRIME_CHNL_OFFSET_LOWER:
+								pht_info->infos[0] |= 0x1;
+								break;
+							case HAL_PRIME_CHNL_OFFSET_UPPER:
+								pht_info->infos[0] |= 0x3;
+								break;
+							case HAL_PRIME_CHNL_OFFSET_DONT_CARE:
+							default:
+								break;
+						}
+					}
+				}
+				else if(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_20)
+				{
+					cur_bwmode = HT_CHANNEL_WIDTH_20;
+					cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+					if(cur_channel>0 && cur_channel<5)
+					{
+						if(pht_info)
+							pht_info->infos[0] |= 0x1;
+
+						cur_bwmode = HT_CHANNEL_WIDTH_40;
+						cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+					}
+
+					if(cur_channel>7 && cur_channel<(14+1))
+					{
+						if(pht_info)
+							pht_info->infos[0] |= 0x3;
+
+						cur_bwmode = HT_CHANNEL_WIDTH_40;
+						cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+					}
+
+					set_channel_bwmode(padapter, cur_channel, cur_ch_offset, cur_bwmode);
+				}
+			}
+
+			// to update channel value in beacon
+			pnetwork->Configuration.DSConfig = cur_channel;
+			p = rtw_get_ie((pnetwork->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _DSSET_IE_, &ie_len, (pnetwork->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+			if(p && ie_len>0)
+				*(p + 2) = cur_channel;
+
+			if(pht_info)
+				pht_info->primary_channel = cur_channel;
+		}
+	}
+	else
+	{
+		set_channel_bwmode(padapter, cur_channel, cur_ch_offset, cur_bwmode);
+	}
+
+	DBG_871X("CH=%d, BW=%d, offset=%d\n", cur_channel, cur_bwmode, cur_ch_offset);
+
+	if((channel <= 14 && cur_channel >= 36) ||
+		(channel >= 36 && cur_channel <= 14))
+	{
+		change_band = _TRUE;
+	}
+
+	pmlmeext->cur_channel = cur_channel;
+	pmlmeext->cur_bwmode = cur_bwmode;
+	pmlmeext->cur_ch_offset = cur_ch_offset;
+
+	if(change_band == _TRUE)
+		change_band_update_ie(padapter, pnetwork);
+
+	DBG_871X("dualmac_concurrent_ap_set_channel_bwmode <==\n");
+}
+
+void dc_resume_xmit(_adapter *padapter)
+{
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+
+	if(pbuddy_adapter != NULL &&
+		padapter->DualMacConcurrent == _TRUE)
+	{
+		DBG_871X("dc_resume_xmit,  resume pbuddy_adapter Tx\n");
+		rtw_os_xmit_schedule(pbuddy_adapter);
+	}
+}
+
+u8	dc_check_xmit(_adapter *padapter)
+{
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_priv *pbuddy_mlmepriv = NULL;
+
+	if(pbuddy_adapter != NULL &&
+		padapter->DualMacConcurrent == _TRUE)
+	{
+		pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+		if (check_fwstate(pbuddy_mlmepriv, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE)
+		{
+			DBG_871X("dc_check_xmit  pbuddy_adapter is under survey or under linking\n");
+			return _FALSE;
+		}
+	}
+
+	return _TRUE;
+}
+#endif
+
+#ifdef CONFIG_CONCURRENT_MODE
+sint check_buddy_mlmeinfo_state(_adapter *padapter, u32 state)
+{
+	PADAPTER pbuddy_adapter;
+	struct mlme_ext_priv *pbuddy_mlmeext;
+	struct mlme_ext_info *pbuddy_mlmeinfo;
+
+	if(padapter == NULL)
+		return _FALSE;
+
+	pbuddy_adapter = padapter->pbuddy_adapter;
+
+	if(pbuddy_adapter == NULL)
+		return _FALSE;
+
+
+	pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+	pbuddy_mlmeinfo = &(pbuddy_mlmeext->mlmext_info);
+
+	if((pbuddy_mlmeinfo->state&0x03) == state)
+		return _TRUE;
+
+	return _FALSE;
+
+}
+
+void concurrent_chk_joinbss_done(_adapter *padapter, int join_res)
+{
+	struct mlme_ext_priv	*pmlmeext;
+	struct mlme_ext_info	*pmlmeinfo;
+	PADAPTER pbuddy_adapter;
+	struct mlme_priv *pbuddy_mlmepriv;
+	struct mlme_ext_priv *pbuddy_mlmeext;
+	struct mlme_ext_info *pbuddy_mlmeinfo;
+	WLAN_BSSID_EX *pbuddy_network_mlmeext;
+
+	pmlmeext = &padapter->mlmeextpriv;
+	pmlmeinfo = &(pmlmeext->mlmext_info);
+
+
+	if(!rtw_buddy_adapter_up(padapter))
+	{
+		set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+		return;
+	}
+
+	pbuddy_adapter = padapter->pbuddy_adapter;
+	pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+	pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+	pbuddy_mlmeinfo = &(pbuddy_mlmeext->mlmext_info);
+	pbuddy_network_mlmeext = &(pbuddy_mlmeinfo->network);
+
+	if(((pbuddy_mlmeinfo->state&0x03) == WIFI_FW_AP_STATE) &&
+			check_fwstate(pbuddy_mlmepriv, _FW_LINKED))
+	{
+		//restart and update beacon
+
+		DBG_871X("after join,primary adapter, CH=%d, BW=%d, offset=%d\n"
+			, pmlmeext->cur_channel, pmlmeext->cur_bwmode, pmlmeext->cur_ch_offset);
+
+
+		if(join_res >= 0)
+		{
+			u8 *p;
+			int	ie_len;
+			u8	change_band = _FALSE;
+			struct HT_info_element *pht_info=NULL;
+
+			if((pmlmeext->cur_channel <= 14 && pbuddy_mlmeext->cur_channel >= 36) ||
+				(pmlmeext->cur_channel >= 36 && pbuddy_mlmeext->cur_channel <= 14))
+				change_band = _TRUE;
+
+			//sync channel/bwmode/ch_offset with primary adapter
+			pbuddy_mlmeext->cur_channel = pmlmeext->cur_channel;
+			if(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40)
+			{
+				p = rtw_get_ie((pbuddy_network_mlmeext->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _HT_ADD_INFO_IE_, &ie_len, (pbuddy_network_mlmeext->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+				if( p && ie_len)
+				{
+					pht_info = (struct HT_info_element *)(p+2);
+					pht_info->infos[0] &= ~(BIT(0)|BIT(1)); //no secondary channel is present
+				}
+
+				if(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40)
+				{
+					pbuddy_mlmeext->cur_ch_offset = pmlmeext->cur_ch_offset;
+
+					//to update cur_ch_offset value in beacon
+					if( pht_info )
+					{
+						switch(pmlmeext->cur_ch_offset)
+						{
+							case HAL_PRIME_CHNL_OFFSET_LOWER:
+								pht_info->infos[0] |= 0x1;
+								break;
+							case HAL_PRIME_CHNL_OFFSET_UPPER:
+								pht_info->infos[0] |= 0x3;
+								break;
+							case HAL_PRIME_CHNL_OFFSET_DONT_CARE:
+							default:
+								break;
+						}
+
+					}
+
+				}
+				else if(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_20)
+				{
+					if(pmlmeext->cur_channel>=1 && pmlmeext->cur_channel<=4)
+					{
+						if(pht_info)
+							pht_info->infos[0] |= HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE;
+
+						pbuddy_mlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+						pbuddy_mlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+					}
+					else if(pmlmeext->cur_channel>=5 && pmlmeext->cur_channel<=14)
+					{
+						if(pht_info)
+							pht_info->infos[0] |= HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW;
+
+						pbuddy_mlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+						pbuddy_mlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+					}
+					else
+					{
+						switch(pmlmeext->cur_channel)
+						{
+							case 36:
+							case 44:
+							case 52:
+							case 60:
+							case 100:
+							case 108:
+							case 116:
+							case 124:
+							case 132:
+							case 149:
+							case 157:
+							{
+								if(pht_info)
+									pht_info->infos[0] |= HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE;
+								pbuddy_mlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+								pbuddy_mlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+								break;
+							}
+							case 40:
+							case 48:
+							case 56:
+							case 64:
+							case 104:
+							case 112:
+							case 120:
+							case 128:
+							case 136:
+							case 153:
+							case 161:
+							{
+								if(pht_info)
+									pht_info->infos[0] |= HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW;
+
+								pbuddy_mlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+								pbuddy_mlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+								break;
+							}
+							default:
+								if(pht_info)
+									pht_info->infos[0] &= ~HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW;
+								pbuddy_mlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
+								pbuddy_mlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+								break;
+
+						}
+
+					}
+
+				}
+
+				set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+
+			}
+			else
+			{
+				set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+			}
+
+
+			// to update channel value in beacon
+			pbuddy_network_mlmeext->Configuration.DSConfig = pmlmeext->cur_channel;
+			p = rtw_get_ie((pbuddy_network_mlmeext->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _DSSET_IE_, &ie_len, (pbuddy_network_mlmeext->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+			if(p && ie_len>0)
+				*(p + 2) = pmlmeext->cur_channel;
+
+			p = rtw_get_ie((pbuddy_network_mlmeext->IEs + sizeof(NDIS_802_11_FIXED_IEs)), _HT_ADD_INFO_IE_, &ie_len, (pbuddy_network_mlmeext->IELength - sizeof(NDIS_802_11_FIXED_IEs)));
+			if( p && ie_len)
+			{
+				pht_info = (struct HT_info_element *)(p+2);
+				pht_info->primary_channel = pmlmeext->cur_channel;
+			}
+
+			//buddy interface band is different from current interface, update ERP, support rate, ext support rate IE
+			if(change_band == _TRUE)
+				change_band_update_ie(pbuddy_adapter, pbuddy_network_mlmeext);
+		}
+		else
+		{
+			// switch back to original channel/bwmode/ch_offset;
+			set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+		}
+
+		DBG_871X("after join, second adapter, CH=%d, BW=%d, offset=%d\n", pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_bwmode, pbuddy_mlmeext->cur_ch_offset);
+
+		DBG_871X("update pbuddy_adapter's beacon\n");
+
+		update_beacon(pbuddy_adapter, 0, NULL, _TRUE);
+
+	}
+	else if(((pbuddy_mlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) &&
+			check_fwstate(pbuddy_mlmepriv, _FW_LINKED))
+	{
+		if(join_res >= 0)
+		{
+			pbuddy_mlmeext->cur_channel = pmlmeext->cur_channel;
+			if(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40)
+				set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+			else if(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40)
+				set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+			else
+				set_channel_bwmode(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+		}
+		else
+		{
+			// switch back to original channel/bwmode/ch_offset;
+			set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+		}
+	}
+	else
+	{
+		set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+	}
+
+}
+#endif //CONFIG_CONCURRENT_MODE
+
+int rtw_chk_start_clnt_join(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	unsigned char	cur_ch = pmlmeext->cur_channel;
+	unsigned char	cur_bw = pmlmeext->cur_bwmode;
+	unsigned char	cur_ch_offset = pmlmeext->cur_ch_offset;
+	bool chbw_allow = _TRUE;
+	bool connect_allow = _TRUE;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	PADAPTER pbuddy_adapter;
+	struct mlme_ext_priv *pbuddy_mlmeext;
+	struct mlme_ext_info	*pbuddy_pmlmeinfo;
+	struct mlme_priv *pbuddy_mlmepriv;
+
+	if (!rtw_buddy_adapter_up(padapter)) {
+		goto start_join_set_ch_bw;
+	}
+
+	pbuddy_adapter = padapter->pbuddy_adapter;
+	pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+	pbuddy_pmlmeinfo = &(pbuddy_mlmeext->mlmext_info);
+	pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+
+	if((pbuddy_pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)//for AP MODE
+	{
+		DBG_871X("start_clnt_join: "ADPT_FMT"(ch=%d, bw=%d, ch_offset=%d)"
+			", "ADPT_FMT" AP mode(ch=%d, bw=%d, ch_offset=%d)\n",
+			ADPT_ARG(padapter), pmlmeext->cur_channel, pmlmeext->cur_bwmode, pmlmeext->cur_ch_offset,
+			ADPT_ARG(pbuddy_adapter), pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_bwmode, pbuddy_mlmeext->cur_ch_offset);
+
+		if(pmlmeext->cur_channel != pbuddy_mlmeext->cur_channel)
+		{
+			chbw_allow = _FALSE;
+		}
+		else if((pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40) &&
+			(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40) &&
+			(pmlmeext->cur_ch_offset != pbuddy_mlmeext->cur_ch_offset))
+		{
+			chbw_allow = _FALSE;
+		}
+		else if((pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_20) &&
+			(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40))
+		{
+			cur_ch = pmlmeext->cur_channel;
+			cur_bw = pbuddy_mlmeext->cur_bwmode;
+			cur_ch_offset = pbuddy_mlmeext->cur_ch_offset;
+		}
+
+		DBG_871X("start_clnt_join: connect_allow:%d, chbw_allow:%d\n", connect_allow, chbw_allow);
+		if (chbw_allow == _FALSE) {
+			#ifdef CONFIG_SPCT_CH_SWITCH
+			if (1) {
+				rtw_ap_inform_ch_switch(pbuddy_adapter, pmlmeext->cur_channel , pmlmeext->cur_ch_offset);
+			} else
+			#endif
+			{
+				//issue deauth to all stas if if2 is at ap mode
+				rtw_sta_flush(pbuddy_adapter);
+			}
+			rtw_hal_set_hwreg(padapter, HW_VAR_CHECK_TXBUF, 0);
+		}
+	}
+	else if(check_fwstate(pbuddy_mlmepriv, _FW_LINKED) == _TRUE &&
+		check_fwstate(pbuddy_mlmepriv, WIFI_STATION_STATE) == _TRUE) //for Client Mode/p2p client
+	{
+		DBG_871X("start_clnt_join: "ADPT_FMT"(ch=%d, bw=%d, ch_offset=%d)"
+			", "ADPT_FMT" STA mode(ch=%d, bw=%d, ch_offset=%d)\n",
+			ADPT_ARG(padapter), pmlmeext->cur_channel, pmlmeext->cur_bwmode, pmlmeext->cur_ch_offset,
+			ADPT_ARG(pbuddy_adapter), pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_bwmode, pbuddy_mlmeext->cur_ch_offset);
+
+		if(pmlmeext->cur_channel != pbuddy_mlmeext->cur_channel)
+		{
+			chbw_allow = _FALSE;
+		}
+		else if((pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_20) &&
+			(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40))
+		{
+			cur_bw = HT_CHANNEL_WIDTH_40;
+			cur_ch_offset = pbuddy_mlmeext->cur_ch_offset;
+		}
+		else if((pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40) &&
+			(pbuddy_mlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40) &&
+			(pmlmeext->cur_ch_offset != pbuddy_mlmeext->cur_ch_offset))
+		{
+			chbw_allow = _FALSE;
+		}
+
+		connect_allow = chbw_allow;
+
+		#if defined(CONFIG_P2P) && defined(CONFIG_IOCTL_CFG80211)
+		/* wlan0-sta mode has higher priority than p2p0-p2p client */
+		if (!rtw_p2p_chk_state(&(pbuddy_adapter->wdinfo), P2P_STATE_NONE)
+			&& pbuddy_adapter->wdinfo.driver_interface == DRIVER_CFG80211)
+		{
+			connect_allow = _TRUE;
+		}
+		#endif /* CONFIG_P2P && CONFIG_IOCTL_CFG80211 */
+
+		DBG_871X("start_clnt_join: connect_allow:%d, chbw_allow:%d\n", connect_allow, chbw_allow);
+		if (connect_allow == _TRUE && chbw_allow == _FALSE) {
+			/* disconnect buddy's connection */
+			rtw_disassoc_cmd(pbuddy_adapter, 500, _FALSE);
+			rtw_indicate_disconnect(pbuddy_adapter);
+			rtw_free_assoc_resources(pbuddy_adapter, 1);
+		}
+	}
+
+start_join_set_ch_bw:
+#endif /* CONFIG_CONCURRENT_MODE */
+
+	if (connect_allow == _TRUE) {
+		DBG_871X("start_join_set_ch_bw: ch=%d, bwmode=%d, ch_offset=%d\n", cur_ch, cur_bw, cur_ch_offset);
+		set_channel_bwmode(padapter, cur_ch, cur_ch_offset, cur_bw);
+	}
+
+	return connect_allow == _TRUE ? _SUCCESS : _FAIL;
+}
+
+/* Find union about ch, bw, ch_offset of all linked interfaces */
+int rtw_get_ch_setting_union(_adapter *adapter, u8 *ch, u8 *bw, u8 *offset)
+{
+	struct dvobj_priv *dvobj = adapter_to_dvobj(adapter);
+	_adapter *iface;
+	struct mlme_ext_priv *mlmeext;
+	int i;
+	u8 ch_ret = 0;
+	u8 bw_ret = HT_CHANNEL_WIDTH_20;
+	u8 offset_ret = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+	int num = 0;
+
+	if (ch) *ch = 0;
+	if (bw) *bw = HT_CHANNEL_WIDTH_20;
+	if (offset) *offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+	for (i = 0; i<dvobj->iface_nums; i++) {
+		iface = dvobj->padapters[i];
+		mlmeext = &iface->mlmeextpriv;
+
+		if (!check_fwstate(&iface->mlmepriv, _FW_LINKED))
+			continue;
+
+		if (num == 0) {
+			ch_ret = mlmeext->cur_channel;
+			bw_ret = mlmeext->cur_bwmode;
+			offset_ret = mlmeext->cur_ch_offset;
+			num++;
+			continue;
+		}
+
+		if (ch_ret != mlmeext->cur_channel) {
+			num = 0;
+			break;
+		}
+
+		if (bw_ret < mlmeext->cur_bwmode) {
+			bw_ret = mlmeext->cur_bwmode;
+			offset_ret = mlmeext->cur_ch_offset;
+		} else if (bw_ret == mlmeext->cur_bwmode && offset_ret != mlmeext->cur_ch_offset) {
+			num = 0;
+			break;
+		}
+
+		num++;
+	}
+
+	if (num) {
+		if (ch) *ch = ch_ret;
+		if (bw) *bw = bw_ret;
+		if (offset) *offset = offset_ret;
+	}
+
+	return num;
+}
+
+u8 set_ch_hdl(_adapter *padapter, u8 *pbuf)
+{
+	struct set_ch_parm *set_ch_parm;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+
+	if(!pbuf)
+		return H2C_PARAMETERS_ERROR;
+
+	set_ch_parm = (struct set_ch_parm *)pbuf;
+
+	DBG_871X(FUNC_NDEV_FMT" ch:%u, bw:%u, ch_offset:%u\n",
+		FUNC_NDEV_ARG(padapter->pnetdev),
+		set_ch_parm->ch, set_ch_parm->bw, set_ch_parm->ch_offset);
+
+	pmlmeext->cur_channel = set_ch_parm->ch;
+	pmlmeext->cur_ch_offset = set_ch_parm->ch_offset;
+	pmlmeext->cur_bwmode = set_ch_parm->bw;
+
+	set_channel_bwmode(padapter, set_ch_parm->ch, set_ch_parm->ch_offset, set_ch_parm->bw);
+
+	return 	H2C_SUCCESS;
+}
+
+u8 set_chplan_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	struct SetChannelPlan_param *setChannelPlan_param;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+
+	if(!pbuf)
+		return H2C_PARAMETERS_ERROR;
+
+	setChannelPlan_param = (struct SetChannelPlan_param *)pbuf;
+
+	pmlmeext->max_chan_nums = init_channel_set(padapter, setChannelPlan_param->channel_plan, pmlmeext->channel_set);
+	init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
+
+	return 	H2C_SUCCESS;
+}
+
+u8 led_blink_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	struct LedBlink_param *ledBlink_param;
+
+	if(!pbuf)
+		return H2C_PARAMETERS_ERROR;
+
+	ledBlink_param = (struct LedBlink_param *)pbuf;
+
+	#ifdef CONFIG_LED_HANDLED_BY_CMD_THREAD
+	BlinkHandler(ledBlink_param->pLed);
+	#endif
+
+	return 	H2C_SUCCESS;
+}
+
+u8 set_csa_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+#ifdef CONFIG_DFS
+	struct SetChannelSwitch_param *setChannelSwitch_param;
+	struct SetChannelPlan_param *setChannelPlan_param;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
+	u8 new_ch_no;
+	u8 gval8 = 0x00, sval8 = 0xff;
+
+	if(!pbuf)
+		return H2C_PARAMETERS_ERROR;
+
+	setChannelSwitch_param = (struct SetChannelSwitch_param *)pbuf;
+	new_ch_no = setChannelSwitch_param->new_ch_no;
+
+	rtw_hal_get_hwreg(padapter, HW_VAR_TXPAUSE, &gval8);
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, &sval8);
+
+	DBG_871X("DFS detected! Swiching channel to %d!\n", new_ch_no);
+	SelectChannel(padapter, new_ch_no);
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, &gval8);
+
+	rtw_free_network_queue(padapter, _TRUE);
+	rtw_indicate_disconnect(padapter);
+
+	if ( ((new_ch_no >= 52) && (new_ch_no <= 64)) ||((new_ch_no >= 100) && (new_ch_no <= 140)) ) {
+		DBG_871X("Switched to DFS band (ch %02x) again!!\n", new_ch_no);
+	}
+
+	return 	H2C_SUCCESS;
+#else
+	return	H2C_REJECTED;
+#endif //CONFIG_DFS
+
+}
+
+// TDLS_WRCR		: write RCR DATA BIT
+// TDLS_SD_PTI		: issue peer traffic indication
+// TDLS_CS_OFF		: go back to the channel linked with AP, terminating channel switch procedure
+// TDLS_INIT_CH_SEN	: init channel sensing, receive all data and mgnt frame
+// TDLS_DONE_CH_SEN: channel sensing and report candidate channel
+// TDLS_OFF_CH		: first time set channel to off channel
+// TDLS_BASE_CH		: go back tp the channel linked with AP when set base channel as target channel
+// TDLS_P_OFF_CH	: periodically go to off channel
+// TDLS_P_BASE_CH	: periodically go back to base channel
+// TDLS_RS_RCR		: restore RCR
+// TDLS_CKALV_PH1	: check alive timer phase1
+// TDLS_CKALV_PH2	: check alive timer phase2
+// TDLS_FREE_STA	: free tdls sta
+u8 tdls_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+#ifdef CONFIG_TDLS
+	_irqL irqL;
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	struct TDLSoption_param *TDLSoption;
+	struct sta_info *ptdls_sta;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
+	u8 survey_channel, i, min, option;
+
+	if(!pbuf)
+		return H2C_PARAMETERS_ERROR;
+
+	TDLSoption = (struct TDLSoption_param *)pbuf;
+
+	ptdls_sta = rtw_get_stainfo( &(padapter->stapriv), TDLSoption->addr );
+	option = TDLSoption->option;
+
+	if( ptdls_sta == NULL )
+	{
+		if( option != TDLS_RS_RCR )
+			return H2C_REJECTED;
+	}
+
+	//_enter_critical_bh(&(ptdlsinfo->hdl_lock), &irqL);
+	DBG_871X("[%s] option:%d\n", __FUNCTION__, option);
+
+	switch(option){
+		case TDLS_WRCR:
+			//As long as TDLS handshake success, we should set RCR_CBSSID_DATA bit to 0
+			//such we can receive all kinds of data frames.
+			rtw_hal_set_hwreg(padapter, HW_VAR_TDLS_WRCR, 0);
+			DBG_871X("TDLS with "MAC_FMT"\n", MAC_ARG(ptdls_sta->hwaddr));
+
+			pmlmeinfo->FW_sta_info[ptdls_sta->mac_id].psta = ptdls_sta;
+			//set TDLS sta rate.
+			set_sta_rate(padapter, ptdls_sta);
+			break;
+		case TDLS_SD_PTI:
+			issue_tdls_peer_traffic_indication(padapter, ptdls_sta);
+			break;
+		case TDLS_CS_OFF:
+			_cancel_timer_ex(&ptdls_sta->base_ch_timer);
+			_cancel_timer_ex(&ptdls_sta->off_ch_timer);
+			SelectChannel(padapter, pmlmeext->cur_channel);
+			ptdls_sta->tdls_sta_state &= ~(TDLS_CH_SWITCH_ON_STATE |
+								TDLS_PEER_AT_OFF_STATE |
+								TDLS_AT_OFF_CH_STATE);
+			DBG_871X("go back to base channel\n ");
+			issue_nulldata(padapter, NULL, 0, 0, 0);
+			break;
+		case TDLS_INIT_CH_SEN:
+			rtw_hal_set_hwreg(padapter, HW_VAR_TDLS_INIT_CH_SEN, 0);
+			pmlmeext->sitesurvey_res.channel_idx = 0;
+			ptdls_sta->option = TDLS_DONE_CH_SEN;
+			rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_DONE_CH_SEN);
+			break;
+		case TDLS_DONE_CH_SEN:
+			survey_channel = pmlmeext->channel_set[pmlmeext->sitesurvey_res.channel_idx].ChannelNum;
+			if(survey_channel){
+				SelectChannel(padapter, survey_channel);
+				ptdlsinfo->cur_channel = survey_channel;
+				pmlmeext->sitesurvey_res.channel_idx++;
+				_set_timer(&ptdls_sta->option_timer, SURVEY_TO);
+			}else{
+				SelectChannel(padapter, pmlmeext->cur_channel);
+
+				rtw_hal_set_hwreg(padapter, HW_VAR_TDLS_DONE_CH_SEN, 0);
+
+				if(ptdlsinfo->ch_sensing==1){
+					ptdlsinfo->ch_sensing=0;
+					ptdlsinfo->cur_channel=1;
+					min=ptdlsinfo->collect_pkt_num[0];
+					for(i=1; i<MAX_CHANNEL_NUM-1; i++){
+						if(min > ptdlsinfo->collect_pkt_num[i]){
+							ptdlsinfo->cur_channel=i+1;
+							min=ptdlsinfo->collect_pkt_num[i];
+						}
+						ptdlsinfo->collect_pkt_num[i]=0;
+					}
+					ptdlsinfo->collect_pkt_num[0]=0;
+					ptdlsinfo->candidate_ch=ptdlsinfo->cur_channel;
+					DBG_871X("TDLS channel sensing done, candidate channel: %02x\n", ptdlsinfo->candidate_ch);
+					ptdlsinfo->cur_channel=0;
+
+				}
+
+				if(ptdls_sta->tdls_sta_state & TDLS_PEER_SLEEP_STATE){
+					ptdls_sta->tdls_sta_state |= TDLS_APSD_CHSW_STATE;
+				}else{
+					//send null data with pwrbit==1 before send ch_switching_req to peer STA.
+					issue_nulldata(padapter, NULL, 1, 0, 0);
+
+					ptdls_sta->tdls_sta_state |= TDLS_CH_SW_INITIATOR_STATE;
+
+					issue_tdls_ch_switch_req(padapter, ptdls_sta->hwaddr);
+					DBG_871X("issue tdls ch switch req\n");
+				}
+			}
+			break;
+		case TDLS_OFF_CH:
+			issue_nulldata(padapter, NULL, 1, 0, 0);
+			SelectChannel(padapter, ptdls_sta->off_ch);
+
+			DBG_871X("change channel to tar ch:%02x\n", ptdls_sta->off_ch);
+			ptdls_sta->tdls_sta_state |= TDLS_AT_OFF_CH_STATE;
+			ptdls_sta->tdls_sta_state &= ~(TDLS_PEER_AT_OFF_STATE);
+			_set_timer(&ptdls_sta->option_timer, (u32)ptdls_sta->ch_switch_time);
+			break;
+		case TDLS_BASE_CH:
+			_cancel_timer_ex(&ptdls_sta->base_ch_timer);
+			_cancel_timer_ex(&ptdls_sta->off_ch_timer);
+			SelectChannel(padapter, pmlmeext->cur_channel);
+			ptdls_sta->tdls_sta_state &= ~(TDLS_CH_SWITCH_ON_STATE |
+								TDLS_PEER_AT_OFF_STATE |
+								TDLS_AT_OFF_CH_STATE);
+			DBG_871X("go back to base channel\n ");
+			issue_nulldata(padapter, NULL, 0, 0, 0);
+			_set_timer(&ptdls_sta->option_timer, (u32)ptdls_sta->ch_switch_time);
+			break;
+		case TDLS_P_OFF_CH:
+			SelectChannel(padapter, pmlmeext->cur_channel);
+			issue_nulldata(padapter, NULL, 0, 0, 0);
+			DBG_871X("change channel to base ch:%02x\n", pmlmeext->cur_channel);
+			ptdls_sta->tdls_sta_state &= ~(TDLS_PEER_AT_OFF_STATE| TDLS_AT_OFF_CH_STATE);
+			_set_timer(&ptdls_sta->off_ch_timer, TDLS_STAY_TIME);
+			break;
+		case TDLS_P_BASE_CH:
+			issue_nulldata(ptdls_sta->padapter, NULL, 1, 0, 0);
+			SelectChannel(padapter, ptdls_sta->off_ch);
+			DBG_871X("change channel to off ch:%02x\n", ptdls_sta->off_ch);
+			ptdls_sta->tdls_sta_state |= TDLS_AT_OFF_CH_STATE;
+			if((ptdls_sta->tdls_sta_state & TDLS_PEER_AT_OFF_STATE) != TDLS_PEER_AT_OFF_STATE){
+				issue_nulldata_to_TDLS_peer_STA(padapter, ptdls_sta, 0);
+			}
+			_set_timer(&ptdls_sta->base_ch_timer, TDLS_STAY_TIME);
+			break;
+		case TDLS_RS_RCR:
+			rtw_hal_set_hwreg(padapter, HW_VAR_TDLS_RS_RCR, 0);
+			DBG_871X("wirte REG_RCR, set bit6 on\n");
+			break;
+		case TDLS_CKALV_PH1:
+			_set_timer(&ptdls_sta->alive_timer2, TDLS_ALIVE_TIMER_PH2);
+			break;
+		case TDLS_CKALV_PH2:
+			_set_timer(&ptdls_sta->alive_timer1, TDLS_ALIVE_TIMER_PH1);
+			break;
+		case TDLS_FREE_STA:
+			free_tdls_sta(padapter, ptdls_sta);
+			break;
+
+	}
+
+	//_exit_critical_bh(&(ptdlsinfo->hdl_lock), &irqL);
+
+	return H2C_SUCCESS;
+#else
+	return H2C_REJECTED;
+#endif //CONFIG_TDLS
+
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mp.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mp.c
new file mode 100644
index 000000000000..269542526a70
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mp.c
@@ -0,0 +1,1323 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_MP_C_
+
+#include <drv_types.h>
+
+#ifdef PLATFORM_FREEBSD
+#include <sys/unistd.h>		/* for RFHIGHPID */
+#endif
+
+#ifdef CONFIG_RTL8712
+#include <rtw_mp_phy_regdef.h>
+#endif
+#ifdef CONFIG_RTL8192C
+#include <rtl8192c_hal.h>
+#endif
+#ifdef CONFIG_RTL8192D
+#include <rtl8192d_hal.h>
+#endif
+#ifdef CONFIG_RTL8723A
+#include <rtl8723a_hal.h>
+#endif
+
+
+#ifdef CONFIG_MP_INCLUDED
+
+u32 read_macreg(_adapter *padapter, u32 addr, u32 sz)
+{
+	u32 val = 0;
+
+	switch(sz)
+	{
+		case 1:
+			val = rtw_read8(padapter, addr);
+			break;
+		case 2:
+			val = rtw_read16(padapter, addr);
+			break;
+		case 4:
+			val = rtw_read32(padapter, addr);
+			break;
+		default:
+			val = 0xffffffff;
+			break;
+	}
+
+	return val;
+
+}
+
+void write_macreg(_adapter *padapter, u32 addr, u32 val, u32 sz)
+{
+	switch(sz)
+	{
+		case 1:
+			rtw_write8(padapter, addr, (u8)val);
+			break;
+		case 2:
+			rtw_write16(padapter, addr, (u16)val);
+			break;
+		case 4:
+			rtw_write32(padapter, addr, val);
+			break;
+		default:
+			break;
+	}
+
+}
+
+u32 read_bbreg(_adapter *padapter, u32 addr, u32 bitmask)
+{
+	return rtw_hal_read_bbreg(padapter, addr, bitmask);
+}
+
+void write_bbreg(_adapter *padapter, u32 addr, u32 bitmask, u32 val)
+{
+	rtw_hal_write_bbreg(padapter, addr, bitmask, val);
+}
+
+u32 _read_rfreg(PADAPTER padapter, u8 rfpath, u32 addr, u32 bitmask)
+{
+	return rtw_hal_read_rfreg(padapter, (RF_RADIO_PATH_E)rfpath, addr, bitmask);
+}
+
+void _write_rfreg(PADAPTER padapter, u8 rfpath, u32 addr, u32 bitmask, u32 val)
+{
+	rtw_hal_write_rfreg(padapter, (RF_RADIO_PATH_E)rfpath, addr, bitmask, val);
+}
+
+u32 read_rfreg(PADAPTER padapter, u8 rfpath, u32 addr)
+{
+	return _read_rfreg(padapter, (RF_RADIO_PATH_E)rfpath, addr, bRFRegOffsetMask);
+}
+
+void write_rfreg(PADAPTER padapter, u8 rfpath, u32 addr, u32 val)
+{
+	_write_rfreg(padapter, (RF_RADIO_PATH_E)rfpath, addr, bRFRegOffsetMask, val);
+}
+
+static void _init_mp_priv_(struct mp_priv *pmp_priv)
+{
+	WLAN_BSSID_EX *pnetwork;
+
+	_rtw_memset(pmp_priv, 0, sizeof(struct mp_priv));
+
+	pmp_priv->mode = MP_OFF;
+
+	pmp_priv->channel = 1;
+	pmp_priv->bandwidth = HT_CHANNEL_WIDTH_20;
+	pmp_priv->prime_channel_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+	pmp_priv->rateidx = MPT_RATE_1M;
+	pmp_priv->txpoweridx = 0x2A;
+
+	pmp_priv->antenna_tx = ANTENNA_A;
+	pmp_priv->antenna_rx = ANTENNA_AB;
+
+	pmp_priv->check_mp_pkt = 0;
+
+	pmp_priv->tx_pktcount = 0;
+
+	pmp_priv->rx_pktcount = 0;
+	pmp_priv->rx_crcerrpktcount = 0;
+
+	pmp_priv->network_macaddr[0] = 0x00;
+	pmp_priv->network_macaddr[1] = 0xE0;
+	pmp_priv->network_macaddr[2] = 0x4C;
+	pmp_priv->network_macaddr[3] = 0x87;
+	pmp_priv->network_macaddr[4] = 0x66;
+	pmp_priv->network_macaddr[5] = 0x55;
+
+	pnetwork = &pmp_priv->mp_network.network;
+	_rtw_memcpy(pnetwork->MacAddress, pmp_priv->network_macaddr, ETH_ALEN);
+
+	pnetwork->Ssid.SsidLength = 8;
+	_rtw_memcpy(pnetwork->Ssid.Ssid, "mp_871x", pnetwork->Ssid.SsidLength);
+}
+
+#ifdef PLATFORM_WINDOWS
+/*
+void mp_wi_callback(
+	IN NDIS_WORK_ITEM*	pwk_item,
+	IN PVOID			cntx
+	)
+{
+	_adapter* padapter =(_adapter *)cntx;
+	struct mp_priv *pmppriv=&padapter->mppriv;
+	struct mp_wi_cntx	*pmp_wi_cntx=&pmppriv->wi_cntx;
+
+	// Execute specified action.
+	if(pmp_wi_cntx->curractfunc != NULL)
+	{
+		LARGE_INTEGER	cur_time;
+		ULONGLONG start_time, end_time;
+		NdisGetCurrentSystemTime(&cur_time);	// driver version
+		start_time = cur_time.QuadPart/10; // The return value is in microsecond
+
+		pmp_wi_cntx->curractfunc(padapter);
+
+		NdisGetCurrentSystemTime(&cur_time);	// driver version
+		end_time = cur_time.QuadPart/10; // The return value is in microsecond
+
+		RT_TRACE(_module_mp_, _drv_info_,
+			 ("WorkItemActType: %d, time spent: %I64d us\n",
+			  pmp_wi_cntx->param.act_type, (end_time-start_time)));
+	}
+
+	NdisAcquireSpinLock(&(pmp_wi_cntx->mp_wi_lock));
+	pmp_wi_cntx->bmp_wi_progress= _FALSE;
+	NdisReleaseSpinLock(&(pmp_wi_cntx->mp_wi_lock));
+
+	if (pmp_wi_cntx->bmpdrv_unload)
+	{
+		NdisSetEvent(&(pmp_wi_cntx->mp_wi_evt));
+	}
+
+}
+*/
+
+static int init_mp_priv_by_os(struct mp_priv *pmp_priv)
+{
+	struct mp_wi_cntx *pmp_wi_cntx;
+
+	if (pmp_priv == NULL) return _FAIL;
+
+	pmp_priv->rx_testcnt = 0;
+	pmp_priv->rx_testcnt1 = 0;
+	pmp_priv->rx_testcnt2 = 0;
+
+	pmp_priv->tx_testcnt = 0;
+	pmp_priv->tx_testcnt1 = 0;
+
+	pmp_wi_cntx = &pmp_priv->wi_cntx
+	pmp_wi_cntx->bmpdrv_unload = _FALSE;
+	pmp_wi_cntx->bmp_wi_progress = _FALSE;
+	pmp_wi_cntx->curractfunc = NULL;
+
+	return _SUCCESS;
+}
+#endif
+
+#ifdef PLATFORM_LINUX
+static int init_mp_priv_by_os(struct mp_priv *pmp_priv)
+{
+	int i, res;
+	struct mp_xmit_frame *pmp_xmitframe;
+
+	if (pmp_priv == NULL) return _FAIL;
+
+	_rtw_init_queue(&pmp_priv->free_mp_xmitqueue);
+
+	pmp_priv->pallocated_mp_xmitframe_buf = NULL;
+	pmp_priv->pallocated_mp_xmitframe_buf = rtw_zmalloc(NR_MP_XMITFRAME * sizeof(struct mp_xmit_frame) + 4);
+	if (pmp_priv->pallocated_mp_xmitframe_buf == NULL) {
+		res = _FAIL;
+		goto _exit_init_mp_priv;
+	}
+
+	pmp_priv->pmp_xmtframe_buf = pmp_priv->pallocated_mp_xmitframe_buf + 4 - ((uint) (pmp_priv->pallocated_mp_xmitframe_buf) & 3);
+
+	pmp_xmitframe = (struct mp_xmit_frame*)pmp_priv->pmp_xmtframe_buf;
+
+	for (i = 0; i < NR_MP_XMITFRAME; i++)
+	{
+		_rtw_init_listhead(&pmp_xmitframe->list);
+		rtw_list_insert_tail(&pmp_xmitframe->list, &pmp_priv->free_mp_xmitqueue.queue);
+
+		pmp_xmitframe->pkt = NULL;
+		pmp_xmitframe->frame_tag = MP_FRAMETAG;
+		pmp_xmitframe->padapter = pmp_priv->papdater;
+
+		pmp_xmitframe++;
+	}
+
+	pmp_priv->free_mp_xmitframe_cnt = NR_MP_XMITFRAME;
+
+	res = _SUCCESS;
+
+_exit_init_mp_priv:
+
+	return res;
+}
+#endif
+
+static void mp_init_xmit_attrib(struct mp_tx *pmptx, PADAPTER padapter)
+{
+	struct pkt_attrib *pattrib;
+	struct tx_desc *desc;
+
+	// init xmitframe attribute
+	pattrib = &pmptx->attrib;
+	_rtw_memset(pattrib, 0, sizeof(struct pkt_attrib));
+	desc = &pmptx->desc;
+	_rtw_memset(desc, 0, TXDESC_SIZE);
+
+	pattrib->ether_type = 0x8712;
+	//_rtw_memcpy(pattrib->src, padapter->eeprompriv.mac_addr, ETH_ALEN);
+//	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+	_rtw_memset(pattrib->dst, 0xFF, ETH_ALEN);
+//	pattrib->pctrl = 0;
+//	pattrib->dhcp_pkt = 0;
+//	pattrib->pktlen = 0;
+	pattrib->ack_policy = 0;
+//	pattrib->pkt_hdrlen = ETH_HLEN;
+	pattrib->hdrlen = WLAN_HDR_A3_LEN;
+	pattrib->subtype = WIFI_DATA;
+	pattrib->priority = 0;
+	pattrib->qsel = pattrib->priority;
+//	do_queue_select(padapter, pattrib);
+	pattrib->nr_frags = 1;
+	pattrib->encrypt = 0;
+	pattrib->bswenc = _FALSE;
+	pattrib->qos_en = _FALSE;
+}
+
+s32 init_mp_priv(PADAPTER padapter)
+{
+	struct mp_priv *pmppriv = &padapter->mppriv;
+
+	_init_mp_priv_(pmppriv);
+	pmppriv->papdater = padapter;
+
+	pmppriv->tx.stop = 1;
+	mp_init_xmit_attrib(&pmppriv->tx, padapter);
+
+	switch (padapter->registrypriv.rf_config) {
+		case RF_1T1R:
+			pmppriv->antenna_tx = ANTENNA_A;
+			pmppriv->antenna_rx = ANTENNA_A;
+			break;
+		case RF_1T2R:
+		default:
+			pmppriv->antenna_tx = ANTENNA_A;
+			pmppriv->antenna_rx = ANTENNA_AB;
+			break;
+		case RF_2T2R:
+		case RF_2T2R_GREEN:
+			pmppriv->antenna_tx = ANTENNA_AB;
+			pmppriv->antenna_rx = ANTENNA_AB;
+			break;
+		case RF_2T4R:
+			pmppriv->antenna_tx = ANTENNA_AB;
+			pmppriv->antenna_rx = ANTENNA_ABCD;
+			break;
+	}
+
+	return _SUCCESS;
+}
+
+void free_mp_priv(struct mp_priv *pmp_priv)
+{
+	if (pmp_priv->pallocated_mp_xmitframe_buf) {
+		rtw_mfree(pmp_priv->pallocated_mp_xmitframe_buf, 0);
+		pmp_priv->pallocated_mp_xmitframe_buf = NULL;
+	}
+	pmp_priv->pmp_xmtframe_buf = NULL;
+}
+
+#ifdef CONFIG_RTL8192C
+#define PHY_IQCalibrate(a,b)	rtl8192c_PHY_IQCalibrate(a,b)
+#define PHY_LCCalibrate(a)	rtl8192c_PHY_LCCalibrate(a)
+#define dm_CheckTXPowerTracking(a)	rtl8192c_dm_CheckTXPowerTracking(a)
+#define PHY_SetRFPathSwitch(a,b)	rtl8192c_PHY_SetRFPathSwitch(a,b)
+#endif
+
+#ifdef CONFIG_RTL8192D
+#define PHY_IQCalibrate(a)	rtl8192d_PHY_IQCalibrate(a)
+#define PHY_LCCalibrate(a)	rtl8192d_PHY_LCCalibrate(a)
+#define dm_CheckTXPowerTracking(a)	rtl8192d_dm_CheckTXPowerTracking(a)
+#define PHY_SetRFPathSwitch(a,b)	rtl8192d_PHY_SetRFPathSwitch(a,b)
+#endif
+
+s32
+MPT_InitializeAdapter(
+	IN	PADAPTER			pAdapter,
+	IN	u8				Channel
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	s32		rtStatus = _SUCCESS;
+	PMPT_CONTEXT	pMptCtx = &pAdapter->mppriv.MptCtx;
+	u32		ledsetting;
+
+	//-------------------------------------------------------------------------
+	// HW Initialization for 8190 MPT.
+	//-------------------------------------------------------------------------
+	//-------------------------------------------------------------------------
+	// SW Initialization for 8190 MP.
+	//-------------------------------------------------------------------------
+	pMptCtx->bMptDrvUnload = _FALSE;
+	pMptCtx->bMassProdTest = _FALSE;
+	pMptCtx->bMptIndexEven = _TRUE;	//default gain index is -6.0db
+
+	/* Init mpt event. */
+#if 0 // for Windows
+	NdisInitializeEvent( &(pMptCtx->MptWorkItemEvent) );
+	NdisAllocateSpinLock( &(pMptCtx->MptWorkItemSpinLock) );
+
+	PlatformInitializeWorkItem(
+		Adapter,
+		&(pMptCtx->MptWorkItem),
+		(RT_WORKITEM_CALL_BACK)MPT_WorkItemCallback,
+		(PVOID)Adapter,
+		"MptWorkItem");
+#endif
+	pMptCtx->bMptWorkItemInProgress = _FALSE;
+	pMptCtx->CurrMptAct = NULL;
+	//-------------------------------------------------------------------------
+
+#if 1
+	// Don't accept any packets
+	rtw_write32(pAdapter, REG_RCR, 0);
+#else
+	// Accept CRC error and destination address
+	pHalData->ReceiveConfig |= (RCR_ACRC32|RCR_AAP);
+	rtw_write32(pAdapter, REG_RCR, pHalData->ReceiveConfig);
+#endif
+
+#if 0
+	// If EEPROM or EFUSE is empty,we assign as RF 2T2R for MP.
+	if (pHalData->AutoloadFailFlag == TRUE)
+	{
+		pHalData->RF_Type = RF_2T2R;
+	}
+#endif
+	ledsetting = rtw_read32(pAdapter, REG_LEDCFG0);
+	rtw_write32(pAdapter, REG_LEDCFG0, ledsetting & ~LED0DIS);
+
+#ifdef CONFIG_RTL8192C
+	PHY_IQCalibrate(pAdapter, _FALSE);
+	dm_CheckTXPowerTracking(pAdapter);	//trigger thermal meter
+	PHY_LCCalibrate(pAdapter);
+#endif
+
+#ifdef CONFIG_RTL8192D
+	PHY_IQCalibrate(pAdapter);
+	dm_CheckTXPowerTracking(pAdapter);	//trigger thermal meter
+	PHY_LCCalibrate(pAdapter);
+#endif
+
+#ifdef CONFIG_PCI_HCI
+	PHY_SetRFPathSwitch(pAdapter, 1/*pHalData->bDefaultAntenna*/);	//Wifi default use Main
+#else
+
+#ifdef CONFIG_RTL8192C
+#if 1
+	if (pHalData->BoardType == BOARD_MINICARD)
+		PHY_SetRFPathSwitch(pAdapter, 1/*pHalData->bDefaultAntenna*/); //default use Main
+#else
+	if(pAdapter->HalFunc.GetInterfaceSelectionHandler(pAdapter) == INTF_SEL2_MINICARD )
+		PHY_SetRFPathSwitch(Adapter, pAdapter->MgntInfo.bDefaultAntenna); //default use Main
+#endif
+
+#endif
+
+#endif
+
+	pMptCtx->backup0xc50 = (u1Byte)PHY_QueryBBReg(pAdapter, rOFDM0_XAAGCCore1, bMaskByte0);
+	pMptCtx->backup0xc58 = (u1Byte)PHY_QueryBBReg(pAdapter, rOFDM0_XBAGCCore1, bMaskByte0);
+	pMptCtx->backup0xc30 = (u1Byte)PHY_QueryBBReg(pAdapter, rOFDM0_RxDetector1, bMaskByte0);
+
+	return	rtStatus;
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	MPT_DeInitAdapter()
+ *
+ * Overview:	Extra DeInitialization for Mass Production Test.
+ *
+ * Input:		PADAPTER	pAdapter
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	05/08/2007	MHC		Create Version 0.
+ *	05/18/2007	MHC		Add normal driver MPHalt code.
+ *
+ *---------------------------------------------------------------------------*/
+VOID
+MPT_DeInitAdapter(
+	IN	PADAPTER	pAdapter
+	)
+{
+	PMPT_CONTEXT		pMptCtx = &pAdapter->mppriv.MptCtx;
+
+	pMptCtx->bMptDrvUnload = _TRUE;
+#if 0 // for Windows
+	PlatformFreeWorkItem( &(pMptCtx->MptWorkItem) );
+
+	while(pMptCtx->bMptWorkItemInProgress)
+	{
+		if(NdisWaitEvent(&(pMptCtx->MptWorkItemEvent), 50))
+		{
+			break;
+		}
+	}
+	NdisFreeSpinLock( &(pMptCtx->MptWorkItemSpinLock) );
+#endif
+}
+
+static u8 mpt_ProStartTest(PADAPTER padapter)
+{
+	PMPT_CONTEXT pMptCtx = &padapter->mppriv.MptCtx;
+
+	pMptCtx->bMassProdTest = _TRUE;
+	pMptCtx->bStartContTx = _FALSE;
+	pMptCtx->bCckContTx = _FALSE;
+	pMptCtx->bOfdmContTx = _FALSE;
+	pMptCtx->bSingleCarrier = _FALSE;
+	pMptCtx->bCarrierSuppression = _FALSE;
+	pMptCtx->bSingleTone = _FALSE;
+
+	return _SUCCESS;
+}
+
+/*
+ * General use
+ */
+s32 SetPowerTracking(PADAPTER padapter, u8 enable)
+{
+
+	Hal_SetPowerTracking( padapter, enable );
+	return 0;
+}
+
+void GetPowerTracking(PADAPTER padapter, u8 *enable)
+{
+	Hal_GetPowerTracking( padapter, enable );
+}
+
+static void disable_dm(PADAPTER padapter)
+{
+#ifndef CONFIG_RTL8723A
+	u8 v8;
+#endif
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+
+	//3 1. disable firmware dynamic mechanism
+	// disable Power Training, Rate Adaptive
+#ifdef CONFIG_RTL8723A
+	SetBcnCtrlReg(padapter, 0, EN_BCN_FUNCTION);
+#else
+	v8 = rtw_read8(padapter, REG_BCN_CTRL);
+	v8 &= ~EN_BCN_FUNCTION;
+	rtw_write8(padapter, REG_BCN_CTRL, v8);
+#endif
+
+	//3 2. disable driver dynamic mechanism
+	// disable Dynamic Initial Gain
+	// disable High Power
+	// disable Power Tracking
+	Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, _FALSE);
+
+	// enable APK, LCK and IQK but disable power tracking
+	pdmpriv->TxPowerTrackControl = _FALSE;
+	Switch_DM_Func(padapter, DYNAMIC_FUNC_SS, _TRUE);
+}
+
+//This function initializes the DUT to the MP test mode
+s32 mp_start_test(PADAPTER padapter)
+{
+	WLAN_BSSID_EX bssid;
+	struct sta_info *psta;
+	u32 length;
+	u8 val8;
+
+	_irqL irqL;
+	s32 res = _SUCCESS;
+
+	struct mp_priv *pmppriv = &padapter->mppriv;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct wlan_network *tgt_network = &pmlmepriv->cur_network;
+
+
+	//3 disable dynamic mechanism
+	disable_dm(padapter);
+
+	//3 0. update mp_priv
+#if  defined (CONFIG_RTL8192C)  ||  defined (CONFIG_RTL8192D)
+	if (padapter->registrypriv.rf_config == RF_819X_MAX_TYPE) {
+//		HAL_DATA_TYPE *phal = GET_HAL_DATA(padapter);
+//		switch (phal->rf_type) {
+		switch (GET_RF_TYPE(padapter)) {
+			case RF_1T1R:
+				pmppriv->antenna_tx = ANTENNA_A;
+				pmppriv->antenna_rx = ANTENNA_A;
+				break;
+			case RF_1T2R:
+			default:
+				pmppriv->antenna_tx = ANTENNA_A;
+				pmppriv->antenna_rx = ANTENNA_AB;
+				break;
+			case RF_2T2R:
+			case RF_2T2R_GREEN:
+				pmppriv->antenna_tx = ANTENNA_AB;
+				pmppriv->antenna_rx = ANTENNA_AB;
+				break;
+			case RF_2T4R:
+				pmppriv->antenna_tx = ANTENNA_AB;
+				pmppriv->antenna_rx = ANTENNA_ABCD;
+				break;
+		}
+	}
+#endif
+	mpt_ProStartTest(padapter);
+
+	//3 1. initialize a new WLAN_BSSID_EX
+//	_rtw_memset(&bssid, 0, sizeof(WLAN_BSSID_EX));
+	_rtw_memcpy(bssid.MacAddress, pmppriv->network_macaddr, ETH_ALEN);
+	bssid.Ssid.SsidLength = strlen("mp_pseudo_adhoc");
+	_rtw_memcpy(bssid.Ssid.Ssid, (u8*)"mp_pseudo_adhoc", bssid.Ssid.SsidLength);
+	bssid.InfrastructureMode = Ndis802_11IBSS;
+	bssid.NetworkTypeInUse = Ndis802_11DS;
+	bssid.IELength = 0;
+
+	length = get_WLAN_BSSID_EX_sz(&bssid);
+	if (length % 4)
+		bssid.Length = ((length >> 2) + 1) << 2; //round up to multiple of 4 bytes.
+	else
+		bssid.Length = length;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	if (check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE)
+		goto end_of_mp_start_test;
+
+	//init mp_start_test status
+	if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) {
+		rtw_disassoc_cmd(padapter, 500, _TRUE);
+		rtw_indicate_disconnect(padapter);
+		rtw_free_assoc_resources(padapter, 1);
+	}
+	pmppriv->prev_fw_state = get_fwstate(pmlmepriv);
+	pmlmepriv->fw_state = WIFI_MP_STATE;
+#if 0
+	if (pmppriv->mode == _LOOPBOOK_MODE_) {
+		set_fwstate(pmlmepriv, WIFI_MP_LPBK_STATE); //append txdesc
+		RT_TRACE(_module_mp_, _drv_notice_, ("+start mp in Lookback mode\n"));
+	} else {
+		RT_TRACE(_module_mp_, _drv_notice_, ("+start mp in normal mode\n"));
+	}
+#endif
+	set_fwstate(pmlmepriv, _FW_UNDER_LINKING);
+
+	//3 2. create a new psta for mp driver
+	//clear psta in the cur_network, if any
+	psta = rtw_get_stainfo(&padapter->stapriv, tgt_network->network.MacAddress);
+	if (psta) rtw_free_stainfo(padapter, psta);
+
+	psta = rtw_alloc_stainfo(&padapter->stapriv, bssid.MacAddress);
+	if (psta == NULL) {
+		RT_TRACE(_module_mp_, _drv_err_, ("mp_start_test: Can't alloc sta_info!\n"));
+		pmlmepriv->fw_state = pmppriv->prev_fw_state;
+		res = _FAIL;
+		goto end_of_mp_start_test;
+	}
+
+	//3 3. join psudo AdHoc
+	tgt_network->join_res = 1;
+	tgt_network->aid = psta->aid = 1;
+	_rtw_memcpy(&tgt_network->network, &bssid, length);
+
+	rtw_indicate_connect(padapter);
+	_clr_fwstate_(pmlmepriv, _FW_UNDER_LINKING);
+
+end_of_mp_start_test:
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+	if (res == _SUCCESS)
+	{
+		// set MSR to WIFI_FW_ADHOC_STATE
+#if  defined (CONFIG_RTL8192C)  ||  defined (CONFIG_RTL8192D)
+		val8 = rtw_read8(padapter, MSR) & 0xFC; // 0x0102
+		val8 |= WIFI_FW_ADHOC_STATE;
+		rtw_write8(padapter, MSR, val8); // Link in ad hoc network
+#endif
+
+#if  !defined (CONFIG_RTL8192C)  &&  !defined (CONFIG_RTL8192D)
+		rtw_write8(padapter, MSR, 1); // Link in ad hoc network
+		rtw_write8(padapter, RCR, 0); // RCR : disable all pkt, 0x10250048
+		rtw_write8(padapter, RCR+2, 0x57); // RCR disable Check BSSID, 0x1025004a
+
+		// disable RX filter map , mgt frames will put in RX FIFO 0
+		rtw_write16(padapter, RXFLTMAP0, 0x0); // 0x10250116
+
+		val8 = rtw_read8(padapter, EE_9346CR); // 0x1025000A
+		if (!(val8 & _9356SEL))//boot from EFUSE
+			efuse_change_max_size(padapter);
+#endif
+	}
+
+	return res;
+}
+//------------------------------------------------------------------------------
+//This function change the DUT from the MP test mode into normal mode
+void mp_stop_test(PADAPTER padapter)
+{
+	struct mp_priv *pmppriv = &padapter->mppriv;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct wlan_network *tgt_network = &pmlmepriv->cur_network;
+	struct sta_info *psta;
+
+	_irqL irqL;
+
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	if (check_fwstate(pmlmepriv, WIFI_MP_STATE) == _FALSE)
+		goto end_of_mp_stop_test;
+
+	//3 1. disconnect psudo AdHoc
+	rtw_indicate_disconnect(padapter);
+
+	//3 2. clear psta used in mp test mode.
+//	rtw_free_assoc_resources(padapter, 1);
+	psta = rtw_get_stainfo(&padapter->stapriv, tgt_network->network.MacAddress);
+	if (psta) rtw_free_stainfo(padapter, psta);
+
+	//3 3. return to normal state (default:station mode)
+	pmlmepriv->fw_state = pmppriv->prev_fw_state; // WIFI_STATION_STATE;
+
+	//flush the cur_network
+	_rtw_memset(tgt_network, 0, sizeof(struct wlan_network));
+
+	_clr_fwstate_(pmlmepriv, WIFI_MP_STATE);
+
+end_of_mp_stop_test:
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+}
+/*---------------------------hal\rtl8192c\MPT_Phy.c---------------------------*/
+#if 0
+//#ifdef CONFIG_USB_HCI
+static VOID mpt_AdjustRFRegByRateByChan92CU(PADAPTER pAdapter, u8 RateIdx, u8 Channel, u8 BandWidthID)
+{
+	u8		eRFPath;
+	u32		rfReg0x26;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+
+
+	if (RateIdx < MPT_RATE_6M) {	// CCK rate,for 88cu
+		rfReg0x26 = 0xf400;
+	}
+	else if ((RateIdx >= MPT_RATE_6M) && (RateIdx <= MPT_RATE_54M)) {// OFDM rate,for 88cu
+		if ((4 == Channel) || (8 == Channel) || (12 == Channel))
+			rfReg0x26 = 0xf000;
+		else if ((5 == Channel) || (7 == Channel) || (13 == Channel) || (14 == Channel))
+			rfReg0x26 = 0xf400;
+		else
+			rfReg0x26 = 0x4f200;
+	}
+	else if ((RateIdx >= MPT_RATE_MCS0) && (RateIdx <= MPT_RATE_MCS15)) {// MCS 20M ,for 88cu // MCS40M rate,for 88cu
+
+		if (HT_CHANNEL_WIDTH_20 == BandWidthID) {
+			if ((4 == Channel) || (8 == Channel))
+				rfReg0x26 = 0xf000;
+			else if ((5 == Channel) || (7 == Channel) || (13 == Channel) || (14 == Channel))
+				rfReg0x26 = 0xf400;
+			else
+				rfReg0x26 = 0x4f200;
+		}
+		else{
+			if ((4 == Channel) || (8 == Channel))
+				rfReg0x26 = 0xf000;
+			else if ((5 == Channel) || (7 == Channel))
+				rfReg0x26 = 0xf400;
+			else
+				rfReg0x26 = 0x4f200;
+		}
+	}
+
+//	RT_TRACE(COMP_CMD, DBG_LOUD, ("\n mpt_AdjustRFRegByRateByChan92CU():Chan:%d Rate=%d rfReg0x26:0x%08x\n",Channel, RateIdx,rfReg0x26));
+	for (eRFPath = 0; eRFPath < pHalData->NumTotalRFPath; eRFPath++) {
+		write_rfreg(pAdapter, eRFPath, RF_SYN_G2, rfReg0x26);
+	}
+}
+#endif
+/*-----------------------------------------------------------------------------
+ * Function:	mpt_SwitchRfSetting
+ *
+ * Overview:	Change RF Setting when we siwthc channel/rate/BW for MP.
+ *
+ * Input:       IN	PADAPTER				pAdapter
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 01/08/2009	MHC		Suggestion from SD3 Willis for 92S series.
+ * 01/09/2009	MHC		Add CCK modification for 40MHZ. Suggestion from SD3.
+ *
+ *---------------------------------------------------------------------------*/
+static void mpt_SwitchRfSetting(PADAPTER pAdapter)
+{
+	Hal_mpt_SwitchRfSetting(pAdapter);
+    }
+
+/*---------------------------hal\rtl8192c\MPT_Phy.c---------------------------*/
+/*---------------------------hal\rtl8192c\MPT_HelperFunc.c---------------------------*/
+static void MPT_CCKTxPowerAdjust(PADAPTER Adapter, BOOLEAN bInCH14)
+{
+	Hal_MPT_CCKTxPowerAdjust(Adapter,bInCH14);
+}
+
+static void MPT_CCKTxPowerAdjustbyIndex(PADAPTER pAdapter, BOOLEAN beven)
+{
+	Hal_MPT_CCKTxPowerAdjustbyIndex(pAdapter,beven);
+	}
+
+/*---------------------------hal\rtl8192c\MPT_HelperFunc.c---------------------------*/
+
+/*
+ * SetChannel
+ * Description
+ *	Use H2C command to change channel,
+ *	not only modify rf register, but also other setting need to be done.
+ */
+void SetChannel(PADAPTER pAdapter)
+{
+	Hal_SetChannel(pAdapter);
+
+}
+
+/*
+ * Notice
+ *	Switch bandwitdth may change center frequency(channel)
+ */
+void SetBandwidth(PADAPTER pAdapter)
+{
+	Hal_SetBandwidth(pAdapter);
+
+}
+
+static void SetCCKTxPower(PADAPTER pAdapter, u8 *TxPower)
+{
+	Hal_SetCCKTxPower(pAdapter,TxPower);
+}
+
+static void SetOFDMTxPower(PADAPTER pAdapter, u8 *TxPower)
+{
+	Hal_SetOFDMTxPower(pAdapter,TxPower);
+	}
+
+
+void SetAntenna(PADAPTER pAdapter)
+	{
+	Hal_SetAntenna(pAdapter);
+}
+
+void	SetAntennaPathPower(PADAPTER pAdapter)
+{
+	Hal_SetAntennaPathPower(pAdapter);
+}
+
+void SetTxPower(PADAPTER pAdapter)
+{
+	Hal_SetTxPower(pAdapter);
+	}
+
+void SetTxAGCOffset(PADAPTER pAdapter, u32 ulTxAGCOffset)
+{
+	u32 TxAGCOffset_B, TxAGCOffset_C, TxAGCOffset_D,tmpAGC;
+
+	TxAGCOffset_B = (ulTxAGCOffset&0x000000ff);
+	TxAGCOffset_C = ((ulTxAGCOffset&0x0000ff00)>>8);
+	TxAGCOffset_D = ((ulTxAGCOffset&0x00ff0000)>>16);
+
+	tmpAGC = (TxAGCOffset_D<<8 | TxAGCOffset_C<<4 | TxAGCOffset_B);
+	write_bbreg(pAdapter, rFPGA0_TxGainStage,
+			(bXBTxAGC|bXCTxAGC|bXDTxAGC), tmpAGC);
+}
+
+void SetDataRate(PADAPTER pAdapter)
+{
+	Hal_SetDataRate(pAdapter);
+}
+
+#if  !defined (CONFIG_RTL8192C)  &&  !defined (CONFIG_RTL8192D)
+/*------------------------------Define structure----------------------------*/
+typedef struct _R_ANTENNA_SELECT_OFDM {
+	u32	r_tx_antenna:4;
+	u32	r_ant_l:4;
+	u32	r_ant_non_ht:4;
+	u32	r_ant_ht1:4;
+	u32	r_ant_ht2:4;
+	u32	r_ant_ht_s1:4;
+	u32	r_ant_non_ht_s1:4;
+	u32	OFDM_TXSC:2;
+	u32	Reserved:2;
+}R_ANTENNA_SELECT_OFDM;
+
+typedef struct _R_ANTENNA_SELECT_CCK {
+	u8	r_cckrx_enable_2:2;
+	u8	r_cckrx_enable:2;
+	u8	r_ccktx_enable:4;
+}R_ANTENNA_SELECT_CCK;
+#endif
+
+s32 SetThermalMeter(PADAPTER pAdapter, u8 target_ther)
+{
+	return Hal_SetThermalMeter( pAdapter, target_ther);
+}
+
+static void TriggerRFThermalMeter(PADAPTER pAdapter)
+{
+	Hal_TriggerRFThermalMeter(pAdapter);
+}
+
+static u8 ReadRFThermalMeter(PADAPTER pAdapter)
+{
+	return Hal_ReadRFThermalMeter(pAdapter);
+}
+
+void GetThermalMeter(PADAPTER pAdapter, u8 *value)
+{
+	Hal_GetThermalMeter(pAdapter,value);
+}
+
+void SetSingleCarrierTx(PADAPTER pAdapter, u8 bStart)
+{
+	Hal_SetSingleCarrierTx(pAdapter,bStart);
+}
+
+void SetSingleToneTx(PADAPTER pAdapter, u8 bStart)
+{
+	Hal_SetSingleToneTx(pAdapter,bStart);
+}
+
+void SetCarrierSuppressionTx(PADAPTER pAdapter, u8 bStart)
+{
+	Hal_SetCarrierSuppressionTx(pAdapter, bStart);
+}
+
+void SetCCKContinuousTx(PADAPTER pAdapter, u8 bStart)
+		{
+	Hal_SetCCKContinuousTx(pAdapter,bStart);
+		}
+
+void SetOFDMContinuousTx(PADAPTER pAdapter, u8 bStart)
+        {
+   Hal_SetOFDMContinuousTx( pAdapter, bStart);
+}/* mpt_StartOfdmContTx */
+
+void SetContinuousTx(PADAPTER pAdapter, u8 bStart)
+{
+	Hal_SetContinuousTx(pAdapter,bStart);
+}
+
+//------------------------------------------------------------------------------
+static void dump_mpframe(PADAPTER padapter, struct xmit_frame *pmpframe)
+{
+	rtw_hal_mgnt_xmit(padapter, pmpframe);
+}
+
+static struct xmit_frame *alloc_mp_xmitframe(struct xmit_priv *pxmitpriv)
+{
+	struct xmit_frame	*pmpframe;
+	struct xmit_buf	*pxmitbuf;
+
+	if ((pmpframe = rtw_alloc_xmitframe(pxmitpriv)) == NULL)
+	{
+		return NULL;
+	}
+
+	if ((pxmitbuf = rtw_alloc_xmitbuf(pxmitpriv)) == NULL)
+	{
+		rtw_free_xmitframe(pxmitpriv, pmpframe);
+		return NULL;
+	}
+
+	pmpframe->frame_tag = MP_FRAMETAG;
+
+	pmpframe->pxmitbuf = pxmitbuf;
+
+	pmpframe->buf_addr = pxmitbuf->pbuf;
+
+	pxmitbuf->priv_data = pmpframe;
+
+	return pmpframe;
+
+}
+
+static thread_return mp_xmit_packet_thread(thread_context context)
+{
+	struct xmit_frame	*pxmitframe;
+	struct mp_tx		*pmptx;
+	struct mp_priv	*pmp_priv;
+	struct xmit_priv	*pxmitpriv;
+	PADAPTER padapter;
+
+	pmp_priv = (struct mp_priv *)context;
+	pmptx = &pmp_priv->tx;
+	padapter = pmp_priv->papdater;
+	pxmitpriv = &(padapter->xmitpriv);
+
+	thread_enter("RTW_MP_THREAD");
+
+	DBG_871X("%s:pkTx Start\n", __func__);
+	while (1) {
+		pxmitframe = alloc_mp_xmitframe(pxmitpriv);
+		if (pxmitframe == NULL) {
+			if (pmptx->stop ||
+			    padapter->bSurpriseRemoved ||
+			    padapter->bDriverStopped) {
+				goto exit;
+			}
+			else {
+				rtw_msleep_os(1);
+				continue;
+			}
+		}
+
+		_rtw_memcpy((u8 *)(pxmitframe->buf_addr+TXDESC_OFFSET), pmptx->buf, pmptx->write_size);
+		_rtw_memcpy(&(pxmitframe->attrib), &(pmptx->attrib), sizeof(struct pkt_attrib));
+
+		dump_mpframe(padapter, pxmitframe);
+
+		pmptx->sended++;
+		pmp_priv->tx_pktcount++;
+
+		if (pmptx->stop ||
+		    padapter->bSurpriseRemoved ||
+		    padapter->bDriverStopped)
+			goto exit;
+		if ((pmptx->count != 0) &&
+		    (pmptx->count == pmptx->sended))
+			goto exit;
+
+		flush_signals_thread();
+	}
+
+exit:
+	//DBG_871X("%s:pkTx Exit\n", __func__);
+	rtw_mfree(pmptx->pallocated_buf, pmptx->buf_size);
+	pmptx->pallocated_buf = NULL;
+	pmptx->stop = 1;
+
+	thread_exit();
+}
+
+void fill_txdesc_for_mp(PADAPTER padapter, struct tx_desc *ptxdesc)
+{
+	struct mp_priv *pmp_priv = &padapter->mppriv;
+	_rtw_memcpy(ptxdesc, &(pmp_priv->tx.desc), TXDESC_SIZE);
+}
+
+void SetPacketTx(PADAPTER padapter)
+{
+	u8 *ptr, *pkt_start, *pkt_end;
+	u32 pkt_size;
+	struct tx_desc *desc;
+	struct rtw_ieee80211_hdr *hdr;
+	u8 payload;
+	s32 bmcast;
+	struct pkt_attrib *pattrib;
+	struct mp_priv *pmp_priv;
+
+
+	pmp_priv = &padapter->mppriv;
+	if (pmp_priv->tx.stop) return;
+	pmp_priv->tx.sended = 0;
+	pmp_priv->tx.stop = 0;
+	pmp_priv->tx_pktcount = 0;
+
+	//3 1. update_attrib()
+	pattrib = &pmp_priv->tx.attrib;
+	_rtw_memcpy(pattrib->src, padapter->eeprompriv.mac_addr, ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+	_rtw_memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
+	bmcast = IS_MCAST(pattrib->ra);
+	if (bmcast) {
+		pattrib->mac_id = 1;
+		pattrib->psta = rtw_get_bcmc_stainfo(padapter);
+	} else {
+		pattrib->mac_id = 0;
+		pattrib->psta = rtw_get_stainfo(&padapter->stapriv, get_bssid(&padapter->mlmepriv));
+	}
+
+	pattrib->last_txcmdsz = pattrib->hdrlen + pattrib->pktlen;
+
+	//3 2. allocate xmit buffer
+	pkt_size = pattrib->last_txcmdsz;
+
+	if (pmp_priv->tx.pallocated_buf)
+		rtw_mfree(pmp_priv->tx.pallocated_buf, pmp_priv->tx.buf_size);
+	pmp_priv->tx.write_size = pkt_size;
+	pmp_priv->tx.buf_size = pkt_size + XMITBUF_ALIGN_SZ;
+	pmp_priv->tx.pallocated_buf = rtw_zmalloc(pmp_priv->tx.buf_size);
+	if (pmp_priv->tx.pallocated_buf == NULL) {
+		DBG_871X("%s: malloc(%d) fail!!\n", __func__, pmp_priv->tx.buf_size);
+		return;
+	}
+	pmp_priv->tx.buf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pmp_priv->tx.pallocated_buf), XMITBUF_ALIGN_SZ);
+	ptr = pmp_priv->tx.buf;
+
+	desc = &(pmp_priv->tx.desc);
+	_rtw_memset(desc, 0, TXDESC_SIZE);
+	pkt_start = ptr;
+	pkt_end = pkt_start + pkt_size;
+
+	//3 3. init TX descriptor
+	// offset 0
+	//desc->txdw0 |= cpu_to_le32(pkt_size & 0x0000FFFF); // packet size
+	//desc->txdw0 |= cpu_to_le32(OWN | FSG | LSG);
+	//desc->txdw0 |= cpu_to_le32(((TXDESC_SIZE + OFFSET_SZ) << OFFSET_SHT) & 0x00FF0000); //32 bytes for TX Desc
+	//if (bmcast) desc->txdw0 |= cpu_to_le32(BMC); // broadcast packet
+
+	// offset 4
+	desc->txdw1 |= cpu_to_le32(BK); // don't aggregate(AMPDU)
+	desc->txdw1 |= cpu_to_le32((pattrib->mac_id) & 0x1F); //CAM_ID(MAC_ID)
+	desc->txdw1 |= cpu_to_le32((pattrib->qsel << QSEL_SHT) & 0x00001F00); // Queue Select, TID
+	desc->txdw1 |= cpu_to_le32((pattrib->raid << Rate_ID_SHT) & 0x000F0000); // Rate Adaptive ID
+
+	// offset 8
+	// offset 12
+	//desc->txdw3 |= cpu_to_le32((pattrib->seqnum << SEQ_SHT) & 0xffff0000);
+
+	// offset 16
+	//desc->txdw4 |= cpu_to_le32(QoS);
+	desc->txdw4 |= cpu_to_le32(HW_SEQ_EN);
+	desc->txdw4 |= cpu_to_le32(USERATE);
+	desc->txdw4 |= cpu_to_le32(DISDATAFB);
+
+	if( pmp_priv->preamble ){
+		if (pmp_priv->rateidx <=  MPT_RATE_54M)
+			desc->txdw4 |= cpu_to_le32(DATA_SHORT); // CCK Short Preamble
+	}
+	if (pmp_priv->bandwidth == HT_CHANNEL_WIDTH_40)
+		desc->txdw4 |= cpu_to_le32(DATA_BW);
+
+	// offset 20
+	desc->txdw5 |= cpu_to_le32(pmp_priv->rateidx & 0x0000001F);
+
+	if( pmp_priv->preamble ){
+		if (pmp_priv->rateidx > MPT_RATE_54M)
+			desc->txdw5 |= cpu_to_le32(SGI); // MCS Short Guard Interval
+	}
+	desc->txdw5 |= cpu_to_le32(0x0001FF00); // DATA/RTS Rate Fallback Limit
+
+	//3 4. make wlan header, make_wlanhdr()
+	hdr = (struct rtw_ieee80211_hdr *)pkt_start;
+	SetFrameSubType(&hdr->frame_ctl, pattrib->subtype);
+	_rtw_memcpy(hdr->addr1, pattrib->dst, ETH_ALEN); // DA
+	_rtw_memcpy(hdr->addr2, pattrib->src, ETH_ALEN); // SA
+	_rtw_memcpy(hdr->addr3, get_bssid(&padapter->mlmepriv), ETH_ALEN); // RA, BSSID
+
+	//3 5. make payload
+	ptr = pkt_start + pattrib->hdrlen;
+
+	switch (pmp_priv->tx.payload) {
+		case 0:
+			payload = 0x00;
+			break;
+		case 1:
+			payload = 0x5a;
+			break;
+		case 2:
+			payload = 0xa5;
+			break;
+		case 3:
+			payload = 0xff;
+			break;
+		default:
+			payload = 0x00;
+			break;
+	}
+
+	_rtw_memset(ptr, payload, pkt_end - ptr);
+
+	//3 6. start thread
+#ifdef PLATFORM_LINUX
+	pmp_priv->tx.PktTxThread = kthread_run(mp_xmit_packet_thread, pmp_priv, "RTW_MP_THREAD");
+	if (IS_ERR(pmp_priv->tx.PktTxThread))
+		DBG_871X("Create PktTx Thread Fail !!!!!\n");
+#endif
+#ifdef PLATFORM_FREEBSD
+{
+	struct proc *p;
+	struct thread *td;
+	pmp_priv->tx.PktTxThread = kproc_kthread_add(mp_xmit_packet_thread, pmp_priv,
+					&p, &td, RFHIGHPID, 0, "MPXmitThread", "MPXmitThread");
+
+	if (pmp_priv->tx.PktTxThread < 0)
+		DBG_871X("Create PktTx Thread Fail !!!!!\n");
+}
+#endif
+}
+
+void SetPacketRx(PADAPTER pAdapter, u8 bStartRx)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+
+	if(bStartRx)
+	{
+		pHalData->ReceiveConfig = AAP | APM | AM | AB | APP_ICV | ADF | AMF | HTC_LOC_CTRL | APP_MIC | APP_PHYSTS;
+
+		pHalData->ReceiveConfig |= ACRC32;
+
+		rtw_write32(pAdapter, REG_RCR, pHalData->ReceiveConfig);
+
+		// Accept all data frames
+		rtw_write16(pAdapter, REG_RXFLTMAP2, 0xFFFF);
+	}
+	else
+	{
+		rtw_write32(pAdapter, REG_RCR, 0);
+	}
+}
+
+void ResetPhyRxPktCount(PADAPTER pAdapter)
+{
+	u32 i, phyrx_set = 0;
+
+	for (i = 0; i <= 0xF; i++) {
+		phyrx_set = 0;
+		phyrx_set |= _RXERR_RPT_SEL(i);	//select
+		phyrx_set |= RXERR_RPT_RST;	// set counter to zero
+		rtw_write32(pAdapter, REG_RXERR_RPT, phyrx_set);
+	}
+}
+
+static u32 GetPhyRxPktCounts(PADAPTER pAdapter, u32 selbit)
+{
+	//selection
+	u32 phyrx_set = 0, count = 0;
+
+	phyrx_set = _RXERR_RPT_SEL(selbit & 0xF);
+	rtw_write32(pAdapter, REG_RXERR_RPT, phyrx_set);
+
+	//Read packet count
+	count = rtw_read32(pAdapter, REG_RXERR_RPT) & RXERR_COUNTER_MASK;
+
+	return count;
+}
+
+u32 GetPhyRxPktReceived(PADAPTER pAdapter)
+{
+	u32 OFDM_cnt = 0, CCK_cnt = 0, HT_cnt = 0;
+
+	OFDM_cnt = GetPhyRxPktCounts(pAdapter, RXERR_TYPE_OFDM_MPDU_OK);
+	CCK_cnt = GetPhyRxPktCounts(pAdapter, RXERR_TYPE_CCK_MPDU_OK);
+	HT_cnt = GetPhyRxPktCounts(pAdapter, RXERR_TYPE_HT_MPDU_OK);
+
+	return OFDM_cnt + CCK_cnt + HT_cnt;
+}
+
+u32 GetPhyRxPktCRC32Error(PADAPTER pAdapter)
+{
+	u32 OFDM_cnt = 0, CCK_cnt = 0, HT_cnt = 0;
+
+	OFDM_cnt = GetPhyRxPktCounts(pAdapter, RXERR_TYPE_OFDM_MPDU_FAIL);
+	CCK_cnt = GetPhyRxPktCounts(pAdapter, RXERR_TYPE_CCK_MPDU_FAIL);
+	HT_cnt = GetPhyRxPktCounts(pAdapter, RXERR_TYPE_HT_MPDU_FAIL);
+
+	return OFDM_cnt + CCK_cnt + HT_cnt;
+}
+
+//reg 0x808[9:0]: FFT data x
+//reg 0x808[22]:  0  -->  1  to get 1 FFT data y
+//reg 0x8B4[15:0]: FFT data y report
+static u32 GetPSDData(PADAPTER pAdapter, u32 point)
+{
+	int psd_val;
+
+
+	psd_val = rtw_read32(pAdapter, 0x808);
+	psd_val &= 0xFFBFFC00;
+	psd_val |= point;
+
+	rtw_write32(pAdapter, 0x808, psd_val);
+	rtw_mdelay_os(1);
+	psd_val |= 0x00400000;
+
+	rtw_write32(pAdapter, 0x808, psd_val);
+	rtw_mdelay_os(1);
+	psd_val = rtw_read32(pAdapter, 0x8B4);
+
+	psd_val &= 0x0000FFFF;
+
+	return psd_val;
+}
+
+/*
+ * pts	start_point_min		stop_point_max
+ * 128	64			64 + 128 = 192
+ * 256	128			128 + 256 = 384
+ * 512	256			256 + 512 = 768
+ * 1024	512			512 + 1024 = 1536
+ *
+ */
+u32 mp_query_psd(PADAPTER pAdapter, u8 *data)
+{
+	u32 i, psd_pts=0, psd_start=0, psd_stop=0;
+	u32 psd_data=0;
+
+#ifdef PLATFORM_LINUX
+	if (!netif_running(pAdapter->pnetdev)) {
+		RT_TRACE(_module_mp_, _drv_warning_, ("mp_query_psd: Fail! interface not opened!\n"));
+		return 0;
+	}
+#endif
+
+	if (check_fwstate(&pAdapter->mlmepriv, WIFI_MP_STATE) == _FALSE) {
+		RT_TRACE(_module_mp_, _drv_warning_, ("mp_query_psd: Fail! not in MP mode!\n"));
+		return 0;
+	}
+
+	if (strlen(data) == 0) { //default value
+		psd_pts = 128;
+		psd_start = 64;
+		psd_stop = 128;
+	} else {
+		sscanf(data, "pts=%d,start=%d,stop=%d", &psd_pts, &psd_start, &psd_stop);
+	}
+
+	_rtw_memset(data, '\0', sizeof(data));
+
+	i = psd_start;
+	while (i < psd_stop)
+	{
+		if (i >= psd_pts) {
+			psd_data = GetPSDData(pAdapter, i-psd_pts);
+		} else {
+			psd_data = GetPSDData(pAdapter, i);
+		}
+		sprintf(data, "%s%x ", data, psd_data);
+		i++;
+	}
+
+	#ifdef CONFIG_LONG_DELAY_ISSUE
+	rtw_msleep_os(100);
+	#else
+	rtw_mdelay_os(100);
+	#endif
+
+	return strlen(data)+1;
+}
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mp_ioctl.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mp_ioctl.c
new file mode 100644
index 000000000000..a0d8680ea830
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_mp_ioctl.c
@@ -0,0 +1,2953 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_MP_IOCTL_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <mlme_osdep.h>
+
+//#include <rtw_mp.h>
+#include <rtw_mp_ioctl.h>
+
+
+//****************  oid_rtl_seg_81_85   section start ****************
+NDIS_STATUS oid_rt_wireless_mode_hdl(struct oid_par_priv *poid_par_priv)
+{
+	NDIS_STATUS status = NDIS_STATUS_SUCCESS;
+	PADAPTER Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->information_buf_len < sizeof(u8))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	if (poid_par_priv->type_of_oid == SET_OID) {
+		Adapter->registrypriv.wireless_mode = *(u8*)poid_par_priv->information_buf;
+	} else if (poid_par_priv->type_of_oid == QUERY_OID) {
+		*(u8*)poid_par_priv->information_buf = Adapter->registrypriv.wireless_mode;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+		 RT_TRACE(_module_mp_, _drv_info_, ("-query Wireless Mode=%d\n", Adapter->registrypriv.wireless_mode));
+	} else {
+		status = NDIS_STATUS_NOT_ACCEPTED;
+	}
+
+_func_exit_;
+
+	return status;
+}
+//****************  oid_rtl_seg_81_87_80   section start ****************
+NDIS_STATUS oid_rt_pro_write_bb_reg_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL oldirql;
+#endif
+	struct bb_reg_param *pbbreg;
+	u16 offset;
+	u32 value;
+	NDIS_STATUS status = NDIS_STATUS_SUCCESS;
+	PADAPTER Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_write_bb_reg_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(struct bb_reg_param))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	pbbreg = (struct bb_reg_param *)(poid_par_priv->information_buf);
+
+	offset = (u16)(pbbreg->offset) & 0xFFF; //0ffset :0x800~0xfff
+	if (offset < BB_REG_BASE_ADDR) offset |= BB_REG_BASE_ADDR;
+
+	value = pbbreg->value;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("oid_rt_pro_write_bb_reg_hdl: offset=0x%03X value=0x%08X\n",
+		  offset, value));
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	write_bbreg(Adapter, offset, 0xFFFFFFFF, value);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_read_bb_reg_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL oldirql;
+#endif
+	struct bb_reg_param *pbbreg;
+	u16 offset;
+	u32 value;
+	NDIS_STATUS status = NDIS_STATUS_SUCCESS;
+	PADAPTER Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_read_bb_reg_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(struct bb_reg_param))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	pbbreg = (struct bb_reg_param *)(poid_par_priv->information_buf);
+
+	offset = (u16)(pbbreg->offset) & 0xFFF; //0ffset :0x800~0xfff
+	if (offset < BB_REG_BASE_ADDR) offset |= BB_REG_BASE_ADDR;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	value = read_bbreg(Adapter, offset, 0xFFFFFFFF);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	pbbreg->value = value;
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("-oid_rt_pro_read_bb_reg_hdl: offset=0x%03X value:0x%08X\n",
+		  offset, value));
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_write_rf_reg_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL oldirql;
+#endif
+	struct rf_reg_param *pbbreg;
+	u8 path;
+	u8 offset;
+	u32 value;
+	NDIS_STATUS status = NDIS_STATUS_SUCCESS;
+	PADAPTER Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_write_rf_reg_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(struct rf_reg_param))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	pbbreg = (struct rf_reg_param *)(poid_par_priv->information_buf);
+
+	if (pbbreg->path >= MAX_RF_PATH_NUMS)
+		return NDIS_STATUS_NOT_ACCEPTED;
+	if (pbbreg->offset > 0xFF)
+		return NDIS_STATUS_NOT_ACCEPTED;
+	if (pbbreg->value > 0xFFFFF)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	path = (u8)pbbreg->path;
+	offset = (u8)pbbreg->offset;
+	value = pbbreg->value;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("oid_rt_pro_write_rf_reg_hdl: path=%d offset=0x%02X value=0x%05X\n",
+		  path, offset, value));
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	write_rfreg(Adapter, path, offset, value);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_read_rf_reg_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL oldirql;
+#endif
+	struct rf_reg_param *pbbreg;
+	u8 path;
+	u8 offset;
+	u32 value;
+	PADAPTER Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+	NDIS_STATUS status = NDIS_STATUS_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_read_rf_reg_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(struct rf_reg_param))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	pbbreg = (struct rf_reg_param *)(poid_par_priv->information_buf);
+
+	if (pbbreg->path >= MAX_RF_PATH_NUMS)
+		return NDIS_STATUS_NOT_ACCEPTED;
+	if (pbbreg->offset > 0xFF)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	path = (u8)pbbreg->path;
+	offset = (u8)pbbreg->offset;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	value = read_rfreg(Adapter, path, offset);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	pbbreg->value = value;
+
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("-oid_rt_pro_read_rf_reg_hdl: path=%d offset=0x%02X value=0x%05X\n",
+		  path, offset, value));
+
+_func_exit_;
+
+	return status;
+}
+//****************  oid_rtl_seg_81_87_00   section end****************
+//------------------------------------------------------------------------------
+
+//****************  oid_rtl_seg_81_80_00   section start ****************
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_set_data_rate_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32		ratevalue;//4
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("+oid_rt_pro_set_data_rate_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len != sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	ratevalue = *((u32*)poid_par_priv->information_buf);//4
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("oid_rt_pro_set_data_rate_hdl: data rate idx=%d\n", ratevalue));
+	if (ratevalue >= MPT_RATE_LAST)
+		return NDIS_STATUS_INVALID_DATA;
+
+	Adapter->mppriv.rateidx = ratevalue;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	SetDataRate(Adapter);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_start_test_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32		mode;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_start_test_hdl\n"));
+
+	if (Adapter->registrypriv.mp_mode == 0)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	//IQCalibrateBcut(Adapter);
+
+	mode = *((u32*)poid_par_priv->information_buf);
+	Adapter->mppriv.mode = mode;// 1 for loopback
+
+	if (mp_start_test(Adapter) == _FAIL) {
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		goto exit;
+	}
+
+exit:
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("-oid_rt_pro_start_test_hdl: mp_mode=%d\n", Adapter->mppriv.mode));
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_stop_test_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+Set OID_RT_PRO_STOP_TEST\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	mp_stop_test(Adapter);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("-Set OID_RT_PRO_STOP_TEST\n"));
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_set_channel_direct_call_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32		Channel;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_set_channel_direct_call_hdl\n"));
+
+	if (poid_par_priv->information_buf_len != sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	if (poid_par_priv->type_of_oid == QUERY_OID) {
+		*((u32*)poid_par_priv->information_buf) = Adapter->mppriv.channel;
+		return NDIS_STATUS_SUCCESS;
+	}
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	Channel = *((u32*)poid_par_priv->information_buf);
+	RT_TRACE(_module_mp_, _drv_notice_, ("oid_rt_pro_set_channel_direct_call_hdl: Channel=%d\n", Channel));
+	if (Channel > 14)
+		return NDIS_STATUS_NOT_ACCEPTED;
+	Adapter->mppriv.channel = Channel;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	SetChannel(Adapter);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_set_bandwidth_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u16		bandwidth;
+	u16		channel_offset;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("+oid_rt_set_bandwidth_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	bandwidth = *((u32*)poid_par_priv->information_buf);//4
+	channel_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+	if (bandwidth != HT_CHANNEL_WIDTH_40)
+		bandwidth = HT_CHANNEL_WIDTH_20;
+	padapter->mppriv.bandwidth = (u8)bandwidth;
+	padapter->mppriv.prime_channel_offset = (u8)channel_offset;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	SetBandwidth(padapter);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("-oid_rt_set_bandwidth_hdl: bandwidth=%d channel_offset=%d\n",
+		  bandwidth, channel_offset));
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_set_antenna_bb_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32		antenna;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_set_antenna_bb_hdl\n"));
+
+	if (poid_par_priv->information_buf_len != sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	if (poid_par_priv->type_of_oid == SET_OID)
+	{
+		antenna = *(u32*)poid_par_priv->information_buf;
+
+		Adapter->mppriv.antenna_tx = (u16)((antenna & 0xFFFF0000) >> 16);
+		Adapter->mppriv.antenna_rx = (u16)(antenna & 0x0000FFFF);
+		RT_TRACE(_module_mp_, _drv_notice_,
+			 ("oid_rt_pro_set_antenna_bb_hdl: tx_ant=0x%04x rx_ant=0x%04x\n",
+			  Adapter->mppriv.antenna_tx, Adapter->mppriv.antenna_rx));
+
+		_irqlevel_changed_(&oldirql, LOWER);
+		SetAntenna(Adapter);
+		_irqlevel_changed_(&oldirql, RAISE);
+	} else {
+		antenna = (Adapter->mppriv.antenna_tx << 16)|Adapter->mppriv.antenna_rx;
+		*(u32*)poid_par_priv->information_buf = antenna;
+	}
+
+_func_exit_;
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_pro_set_tx_power_control_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32		tx_pwr_idx;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("+oid_rt_pro_set_tx_power_control_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len != sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	tx_pwr_idx = *((u32*)poid_par_priv->information_buf);
+	if (tx_pwr_idx > MAX_TX_PWR_INDEX_N_MODE)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	Adapter->mppriv.txpoweridx = (u8)tx_pwr_idx;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("oid_rt_pro_set_tx_power_control_hdl: idx=0x%2x\n",
+		  Adapter->mppriv.txpoweridx));
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	SetTxPower(Adapter);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+
+//------------------------------------------------------------------------------
+//****************  oid_rtl_seg_81_80_20   section start ****************
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_query_tx_packet_sent_hdl(struct oid_par_priv *poid_par_priv)
+{
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid !=QUERY_OID) {
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	if (poid_par_priv->information_buf_len == sizeof(ULONG)) {
+		*(ULONG*)poid_par_priv->information_buf =  Adapter->mppriv.tx_pktcount;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	} else {
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_query_rx_packet_received_hdl(struct oid_par_priv *poid_par_priv)
+{
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID) {
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	RT_TRACE(_module_mp_, _drv_alert_, ("===> oid_rt_pro_query_rx_packet_received_hdl.\n"));
+	if (poid_par_priv->information_buf_len == sizeof(ULONG)) {
+		*(ULONG*)poid_par_priv->information_buf =  Adapter->mppriv.rx_pktcount;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+		RT_TRACE(_module_mp_, _drv_alert_, ("recv_ok:%d \n",Adapter->mppriv.rx_pktcount));
+	} else {
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_query_rx_packet_crc32_error_hdl(struct oid_par_priv *poid_par_priv)
+{
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID) {
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	RT_TRACE(_module_mp_, _drv_alert_, ("===> oid_rt_pro_query_rx_packet_crc32_error_hdl.\n"));
+	if (poid_par_priv->information_buf_len == sizeof(ULONG)) {
+		*(ULONG*)poid_par_priv->information_buf =  Adapter->mppriv.rx_crcerrpktcount;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+		RT_TRACE(_module_mp_, _drv_alert_, ("recv_err:%d \n",Adapter->mppriv.rx_crcerrpktcount));
+	} else {
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+
+NDIS_STATUS oid_rt_pro_reset_tx_packet_sent_hdl(struct oid_par_priv *poid_par_priv)
+{
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID) {
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	RT_TRACE(_module_mp_, _drv_alert_, ("===> oid_rt_pro_reset_tx_packet_sent_hdl.\n"));
+	Adapter->mppriv.tx_pktcount = 0;
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_reset_rx_packet_received_hdl(struct oid_par_priv *poid_par_priv)
+{
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+	{
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	if (poid_par_priv->information_buf_len == sizeof(ULONG)) {
+		Adapter->mppriv.rx_pktcount = 0;
+		Adapter->mppriv.rx_crcerrpktcount = 0;
+	} else {
+		status = NDIS_STATUS_INVALID_LENGTH;
+	}
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_reset_phy_rx_packet_count_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID) {
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	ResetPhyRxPktCount(Adapter);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_phy_rx_packet_received_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("+oid_rt_get_phy_rx_packet_received_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len != sizeof(ULONG))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	*(ULONG*)poid_par_priv->information_buf = GetPhyRxPktReceived(Adapter);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("-oid_rt_get_phy_rx_packet_received_hdl: recv_ok=%d\n", *(ULONG*)poid_par_priv->information_buf));
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_phy_rx_packet_crc32_error_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("+oid_rt_get_phy_rx_packet_crc32_error_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+
+	if (poid_par_priv->information_buf_len != sizeof(ULONG))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	*(ULONG*)poid_par_priv->information_buf = GetPhyRxPktCRC32Error(Adapter);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("-oid_rt_get_phy_rx_packet_crc32_error_hdl: recv_err=%d\n", *(ULONG*)poid_par_priv->information_buf));
+
+_func_exit_;
+
+	return status;
+}
+//****************  oid_rtl_seg_81_80_20   section end ****************
+NDIS_STATUS oid_rt_pro_set_continuous_tx_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32		bStartTest;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_set_continuous_tx_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	bStartTest = *((u32*)poid_par_priv->information_buf);
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	SetContinuousTx(Adapter,(u8)bStartTest);
+	if (bStartTest) {
+		struct mp_priv *pmp_priv = &Adapter->mppriv;
+		if (pmp_priv->tx.stop == 0) {
+			pmp_priv->tx.stop = 1;
+			DBG_871X("%s: pkt tx is running...\n", __func__);
+			rtw_msleep_os(5);
+		}
+		pmp_priv->tx.stop = 0;
+		pmp_priv->tx.count = 1;
+		SetPacketTx(Adapter);
+	}
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_pro_set_single_carrier_tx_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32		bStartTest;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_alert_, ("+oid_rt_pro_set_single_carrier_tx_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	bStartTest = *((u32*)poid_par_priv->information_buf);
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	SetSingleCarrierTx(Adapter, (u8)bStartTest);
+	if (bStartTest) {
+		struct mp_priv *pmp_priv = &Adapter->mppriv;
+		if (pmp_priv->tx.stop == 0) {
+			pmp_priv->tx.stop = 1;
+			DBG_871X("%s: pkt tx is running...\n", __func__);
+			rtw_msleep_os(5);
+		}
+		pmp_priv->tx.stop = 0;
+		pmp_priv->tx.count = 1;
+		SetPacketTx(Adapter);
+	}
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_pro_set_carrier_suppression_tx_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32		bStartTest;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_set_carrier_suppression_tx_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	bStartTest = *((u32*)poid_par_priv->information_buf);
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	SetCarrierSuppressionTx(Adapter, (u8)bStartTest);
+	if (bStartTest) {
+		struct mp_priv *pmp_priv = &Adapter->mppriv;
+		if (pmp_priv->tx.stop == 0) {
+			pmp_priv->tx.stop = 1;
+			DBG_871X("%s: pkt tx is running...\n", __func__);
+			rtw_msleep_os(5);
+		}
+		pmp_priv->tx.stop = 0;
+		pmp_priv->tx.count = 1;
+		SetPacketTx(Adapter);
+	}
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_pro_set_single_tone_tx_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32 		bStartTest;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_alert_, ("+oid_rt_pro_set_single_tone_tx_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	bStartTest = *((u32*)poid_par_priv->information_buf);
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	SetSingleToneTx(Adapter,(u8)bStartTest);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_pro_set_modulation_hdl(struct oid_par_priv* poid_par_priv)
+{
+	return 0;
+}
+
+NDIS_STATUS oid_rt_pro_trigger_gpio_hdl(struct oid_par_priv *poid_par_priv)
+{
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	rtw_hal_set_hwreg(Adapter, HW_VAR_TRIGGER_GPIO_0, 0);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//****************  oid_rtl_seg_81_80_00   section end ****************
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro8711_join_bss_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	PNDIS_802_11_SSID pssid;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	*poid_par_priv->bytes_needed = (u32)sizeof(NDIS_802_11_SSID);
+	*poid_par_priv->bytes_rw = 0;
+	if (poid_par_priv->information_buf_len < *poid_par_priv->bytes_needed)
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	pssid = (PNDIS_802_11_SSID)poid_par_priv->information_buf;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	if (mp_start_joinbss(Adapter, pssid) == _FAIL)
+		status = NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	*poid_par_priv->bytes_rw = sizeof(NDIS_802_11_SSID);
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_read_register_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	pRW_Reg 	RegRWStruct;
+	u32		offset, width;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("+oid_rt_pro_read_register_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	RegRWStruct = (pRW_Reg)poid_par_priv->information_buf;
+	offset = RegRWStruct->offset;
+	width = RegRWStruct->width;
+
+	if (offset > 0xFFF)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	switch (width) {
+		case 1:
+			RegRWStruct->value = rtw_read8(Adapter, offset);
+			break;
+		case 2:
+			RegRWStruct->value = rtw_read16(Adapter, offset);
+			break;
+		default:
+			width = 4;
+			RegRWStruct->value = rtw_read32(Adapter, offset);
+			break;
+	}
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("oid_rt_pro_read_register_hdl: offset:0x%04X value:0x%X\n",
+		  offset, RegRWStruct->value));
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	*poid_par_priv->bytes_rw = width;
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_write_register_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	pRW_Reg 	RegRWStruct;
+	u32		offset, width, value;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("+oid_rt_pro_write_register_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	RegRWStruct = (pRW_Reg)poid_par_priv->information_buf;
+	offset = RegRWStruct->offset;
+	width = RegRWStruct->width;
+	value = RegRWStruct->value;
+
+	if (offset > 0xFFF)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	switch (RegRWStruct->width)
+	{
+		case 1:
+			if (value > 0xFF) {
+				status = NDIS_STATUS_NOT_ACCEPTED;
+				break;
+			}
+			rtw_write8(padapter, offset, (u8)value);
+			break;
+		case 2:
+			if (value > 0xFFFF) {
+				status = NDIS_STATUS_NOT_ACCEPTED;
+				break;
+			}
+			rtw_write16(padapter, offset, (u16)value);
+			break;
+		case 4:
+			rtw_write32(padapter, offset, value);
+			break;
+		default:
+			status = NDIS_STATUS_NOT_ACCEPTED;
+			break;
+	}
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("-oid_rt_pro_write_register_hdl: offset=0x%08X width=%d value=0x%X\n",
+		  offset, width, value));
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_burst_read_register_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	pBurst_RW_Reg	pBstRwReg;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_burst_read_register_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	pBstRwReg = (pBurst_RW_Reg)poid_par_priv->information_buf;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	rtw_read_mem(padapter, pBstRwReg->offset, (u32)pBstRwReg->len, pBstRwReg->Data);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("-oid_rt_pro_burst_read_register_hdl\n"));
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_burst_write_register_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	pBurst_RW_Reg	pBstRwReg;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_burst_write_register_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	pBstRwReg = (pBurst_RW_Reg)poid_par_priv->information_buf;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	rtw_write_mem(padapter, pBstRwReg->offset, (u32)pBstRwReg->len, pBstRwReg->Data);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	RT_TRACE(_module_mp_, _drv_info_, ("-oid_rt_pro_burst_write_register_hdl\n"));
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_write_txcmd_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	PADAPTER	Adapter = (PADAPTER)( poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+
+	TX_CMD_Desc	*TxCmd_Info;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("+Set OID_RT_PRO_WRITE_TXCMD\n"));
+
+	TxCmd_Info=(TX_CMD_Desc*)poid_par_priv->information_buf;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("WRITE_TXCMD:Addr=%.8X\n", TxCmd_Info->offset));
+	RT_TRACE(_module_mp_, _drv_info_, ("WRITE_TXCMD:1.)%.8X\n", (ULONG)TxCmd_Info->TxCMD.value[0]));
+	RT_TRACE(_module_mp_, _drv_info_, ("WRITE_TXCMD:2.)%.8X\n", (ULONG)TxCmd_Info->TxCMD.value[1]));
+	RT_TRACE(_module_mp_, _drv_info_, (("WRITE_TXCMD:3.)%.8X\n", (ULONG)TxCmd_Info->TxCMD.value[2]));
+	RT_TRACE(_module_mp_, _drv_info_, ("WRITE_TXCMD:4.)%.8X\n", (ULONG)TxCmd_Info->TxCMD.value[3]));
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	rtw_write32(Adapter, TxCmd_Info->offset + 0, (unsigned int)TxCmd_Info->TxCMD.value[0]);
+	rtw_write32(Adapter, TxCmd_Info->offset + 4, (unsigned int)TxCmd_Info->TxCMD.value[1]);
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("-Set OID_RT_PRO_WRITE_TXCMD: status=0x%08X\n", status));
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_read16_eeprom_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	pEEPROM_RWParam pEEPROM;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("+Query OID_RT_PRO_READ16_EEPROM\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	pEEPROM = (pEEPROM_RWParam)poid_par_priv->information_buf;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	pEEPROM->value = eeprom_read16(padapter, (u16)(pEEPROM->offset >> 1));
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	RT_TRACE(_module_mp_,  _drv_notice_,
+		 ("-Query OID_RT_PRO_READ16_EEPROM: offset=0x%x value=0x%x\n",
+		  pEEPROM->offset, pEEPROM->value));
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_write16_eeprom_hdl (struct oid_par_priv *poid_par_priv)
+{
+#if 0
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	pEEPROM_RWParam pEEPROM;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+Set OID_RT_PRO_WRITE16_EEPROM\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	pEEPROM = (pEEPROM_RWParam)poid_par_priv->information_buf;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	eeprom_write16(padapter, (u16)(pEEPROM->offset >> 1), pEEPROM->value);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro8711_wi_poll_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)( poid_par_priv->adapter_context);
+
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	struct mp_wiparam *pwi_param;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(struct mp_wiparam))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	if (Adapter->mppriv.workparam.bcompleted == _FALSE)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	pwi_param = (struct mp_wiparam *)poid_par_priv->information_buf;
+
+	_rtw_memcpy(pwi_param, &Adapter->mppriv.workparam, sizeof(struct mp_wiparam));
+	Adapter->mppriv.act_in_progress = _FALSE;
+//	RT_TRACE(_module_mp_, _drv_info_, ("rf:%x\n", pwiparam->IoValue));
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro8711_pkt_loss_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)( poid_par_priv->adapter_context);
+
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro8711_pkt_loss_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(uint)*2) {
+		RT_TRACE(_module_mp_, _drv_err_, ("-oid_rt_pro8711_pkt_loss_hdl: buf_len=%d\n", (int)poid_par_priv->information_buf_len));
+		return NDIS_STATUS_INVALID_LENGTH;
+	}
+
+	if (*(uint*)poid_par_priv->information_buf == 1)//init==1
+		Adapter->mppriv.rx_pktloss = 0;
+
+	*((uint*)poid_par_priv->information_buf+1) = Adapter->mppriv.rx_pktloss;
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_rd_attrib_mem_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)( poid_par_priv->adapter_context);
+	struct io_queue *pio_queue = (struct io_queue *)Adapter->pio_queue;
+	struct intf_hdl	*pintfhdl = &pio_queue->intf;
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+#ifdef CONFIG_SDIO_HCI
+	void (*_attrib_read)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+#endif
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+Query OID_RT_RD_ATTRIB_MEM\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+#ifdef CONFIG_SDIO_HCI
+	_irqlevel_changed_(&oldirql, LOWER);
+{
+	u32 *plmem = (u32*)poid_par_priv->information_buf+2;
+	_attrib_read = pintfhdl->io_ops._attrib_read;
+	_attrib_read(pintfhdl, *((u32*)poid_par_priv->information_buf),
+				*((u32*)poid_par_priv->information_buf+1), (u8*)plmem);
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+}
+	_irqlevel_changed_(&oldirql, RAISE);
+#endif
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_wr_attrib_mem_hdl (struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+	struct io_queue *pio_queue = (struct io_queue *)Adapter->pio_queue;
+	struct intf_hdl	*pintfhdl = &pio_queue->intf;
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+#ifdef CONFIG_SDIO_HCI
+	void (*_attrib_write)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+#endif
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+#ifdef CONFIG_SDIO_HCI
+	_irqlevel_changed_(&oldirql, LOWER);
+{
+	u32 *plmem = (u32*)poid_par_priv->information_buf + 2;
+	_attrib_write = pintfhdl->io_ops._attrib_write;
+	_attrib_write(pintfhdl, *(u32*)poid_par_priv->information_buf,
+				*((u32*)poid_par_priv->information_buf+1), (u8*)plmem);
+}
+	_irqlevel_changed_(&oldirql, RAISE);
+#endif
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS  oid_rt_pro_set_rf_intfs_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+OID_RT_PRO_SET_RF_INTFS\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	if (rtw_setrfintfs_cmd(Adapter, *(unsigned char*)poid_par_priv->information_buf) == _FAIL)
+		status = NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_poll_rx_status_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	_rtw_memcpy(poid_par_priv->information_buf, (unsigned char*)&Adapter->mppriv.rxstat, sizeof(struct recv_stat));
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_cfg_debug_message_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	PCFG_DBG_MSG_STRUCT pdbg_msg;
+
+_func_enter_;
+
+//	RT_TRACE(0xffffffffff,_drv_alert_,("===> oid_rt_pro_cfg_debug_message_hdl.\n"));
+
+#if 0//#ifdef CONFIG_DEBUG_RTL871X
+
+	pdbg_msg = (PCFG_DBG_MSG_STRUCT)(poid_par_priv->information_buf);
+
+	if (poid_par_priv->type_of_oid == SET_OID) {
+		RT_TRACE(0xffffffffff, _drv_alert_,
+			 ("===>Set level :0x%08x, H32:0x%08x L32:0x%08x\n",
+			  pdbg_msg->DebugLevel, pdbg_msg->DebugComponent_H32, pdbg_msg->DebugComponent_L32));
+
+		GlobalDebugLevel = pdbg_msg->DebugLevel;
+		GlobalDebugComponents = (pdbg_msg->DebugComponent_H32 << 32) | pdbg_msg->DebugComponent_L32;
+		RT_TRACE(0xffffffffff, _drv_alert_,
+			 ("===> Set level :0x%08x, component:0x%016x\n",
+			  GlobalDebugLevel, (u32)GlobalDebugComponents));
+	} else {
+		pdbg_msg->DebugLevel = GlobalDebugLevel;
+		pdbg_msg->DebugComponent_H32 = (u32)(GlobalDebugComponents >> 32);
+		pdbg_msg->DebugComponent_L32 = (u32)GlobalDebugComponents;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+		RT_TRACE(0xffffffffff, _drv_alert_,
+			 ("===>Query level:0x%08x H32:0x%08x L32:0x%08x\n",
+			  (u32)pdbg_msg->DebugLevel, (u32)pdbg_msg->DebugComponent_H32, (u32)pdbg_msg->DebugComponent_L32));
+	}
+
+#endif
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_set_data_rate_ex_hdl(struct oid_par_priv *poid_par_priv)
+{
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+OID_RT_PRO_SET_DATA_RATE_EX\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	if (rtw_setdatarate_cmd(Adapter, poid_par_priv->information_buf) !=_SUCCESS)
+		status = NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//-----------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_thermal_meter_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	u8 thermal = 0;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_get_thermal_meter_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	GetThermalMeter(Adapter, &thermal);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	*(u32*)poid_par_priv->information_buf = (u32)thermal;
+	*poid_par_priv->bytes_rw = sizeof(u32);
+
+_func_exit_;
+
+	return status;
+}
+//-----------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_read_tssi_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_read_tssi_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (Adapter->mppriv.act_in_progress == _TRUE)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(u8))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	//init workparam
+	Adapter->mppriv.act_in_progress = _TRUE;
+	Adapter->mppriv.workparam.bcompleted = _FALSE;
+	Adapter->mppriv.workparam.act_type = MPT_READ_TSSI;
+	Adapter->mppriv.workparam.io_offset = 0;
+	Adapter->mppriv.workparam.io_value = 0xFFFFFFFF;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	if (!rtw_gettssi_cmd(Adapter,0, (u8*)&Adapter->mppriv.workparam.io_value))
+		status = NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_set_power_tracking_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+
+_func_enter_;
+
+//	if (poid_par_priv->type_of_oid != SET_OID)
+//		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(u8))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	if (poid_par_priv->type_of_oid == SET_OID) {
+		u8 enable;
+
+		enable = *(u8*)poid_par_priv->information_buf;
+		RT_TRACE(_module_mp_, _drv_notice_,
+			 ("+oid_rt_pro_set_power_tracking_hdl: enable=%d\n", enable));
+
+		SetPowerTracking(Adapter, enable);
+	} else {
+		GetPowerTracking(Adapter, (u8*)poid_par_priv->information_buf);
+	}
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//-----------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_set_basic_rate_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u32 ratevalue;
+	u8 datarates[NumRates];
+	int i;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("+OID_RT_PRO_SET_BASIC_RATE\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+#if 0
+	ratevalue = *((u32*)poid_par_priv->information_buf);
+
+	for (i = 0; i < NumRates; i++) {
+		if (ratevalue == mpdatarate[i])
+			datarates[i] = mpdatarate[i];
+		else
+			datarates[i] = 0xff;
+		RT_TRACE(_module_rtl871x_ioctl_c_, _drv_info_, ("basicrate_inx=%d\n", datarates[i]));
+	}
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	if (rtw_setbasicrate_cmd(padapter, datarates) != _SUCCESS)
+		status = NDIS_STATUS_NOT_ACCEPTED;
+
+	_irqlevel_changed_(&oldirql, RAISE);
+#endif
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("-OID_RT_PRO_SET_BASIC_RATE: status=0x%08X\n", status));
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_qry_pwrstate_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < 8)
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	*poid_par_priv->bytes_rw = 8;
+	_rtw_memcpy(poid_par_priv->information_buf, &(Adapter->pwrctrlpriv.pwr_mode), 8);
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("-oid_rt_pro_qry_pwrstate_hdl: pwr_mode=%d smart_ps=%d\n",
+		  Adapter->pwrctrlpriv.pwr_mode, Adapter->pwrctrlpriv.smart_ps));
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_set_pwrstate_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	uint pwr_mode, smart_ps;
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+Set OID_RT_PRO_SET_PWRSTATE\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	*poid_par_priv->bytes_rw = 0;
+	*poid_par_priv->bytes_needed = 8;
+
+	if (poid_par_priv->information_buf_len < 8)
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	pwr_mode = *(uint *)(poid_par_priv->information_buf);
+	smart_ps = *(uint *)((int)poid_par_priv->information_buf + 4);
+
+	*poid_par_priv->bytes_rw = 8;
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_h2c_set_rate_table_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	struct setratable_parm *prate_table;
+	u8		res;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	*poid_par_priv->bytes_needed  = sizeof(struct setratable_parm);
+	if (poid_par_priv->information_buf_len < sizeof(struct setratable_parm))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	prate_table = (struct setratable_parm*)poid_par_priv->information_buf;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	res = rtw_setrttbl_cmd(Adapter, prate_table);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	if (res == _FAIL)
+		status = NDIS_STATUS_FAILURE;
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_h2c_get_rate_table_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	#if 0
+			struct mp_wi_cntx *pmp_wi_cntx=&(Adapter->mppriv.wi_cntx);
+			u8 res=_SUCCESS;
+			DEBUG_INFO(("===> Set OID_RT_PRO_H2C_GET_RATE_TABLE.\n"));
+
+			if(pmp_wi_cntx->bmp_wi_progress ==_TRUE){
+				DEBUG_ERR(("\n mp workitem is progressing, not allow to set another workitem right now!!!\n"));
+				Status = NDIS_STATUS_NOT_ACCEPTED;
+				break;
+			}
+			else{
+				pmp_wi_cntx->bmp_wi_progress=_TRUE;
+				pmp_wi_cntx->param.bcompleted=_FALSE;
+				pmp_wi_cntx->param.act_type=MPT_GET_RATE_TABLE;
+				pmp_wi_cntx->param.io_offset=0x0;
+				pmp_wi_cntx->param.bytes_cnt=sizeof(struct getratable_rsp);
+				pmp_wi_cntx->param.io_value=0xffffffff;
+
+				res=rtw_getrttbl_cmd(Adapter,(struct getratable_rsp *)pmp_wi_cntx->param.data);
+				*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+				if(res != _SUCCESS)
+				{
+					Status = NDIS_STATUS_NOT_ACCEPTED;
+				}
+			}
+			DEBUG_INFO(("\n <=== Set OID_RT_PRO_H2C_GET_RATE_TABLE.\n"));
+	#endif
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+
+//****************  oid_rtl_seg_87_12_00   section start ****************
+NDIS_STATUS oid_rt_pro_encryption_ctrl_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+	struct security_priv *psecuritypriv = &Adapter->securitypriv;
+
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	ENCRY_CTRL_STATE encry_mode;
+
+
+	*poid_par_priv->bytes_needed = sizeof(u8);
+	if (poid_par_priv->information_buf_len < *poid_par_priv->bytes_needed)
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	if (poid_par_priv->type_of_oid == SET_OID)
+	{
+		encry_mode = *((u8*)poid_par_priv->information_buf);
+		switch (encry_mode)
+		{
+			case HW_CONTROL:
+				#if 0
+				Adapter->registrypriv.software_decrypt=_FALSE;
+				Adapter->registrypriv.software_encrypt=_FALSE;
+				#else
+				psecuritypriv->sw_decrypt = _FALSE;
+				psecuritypriv->sw_encrypt = _FALSE;
+				#endif
+				break;
+			case SW_CONTROL:
+				#if 0
+				Adapter->registrypriv.software_decrypt=_TRUE;
+				Adapter->registrypriv.software_encrypt=_TRUE;
+				#else
+				psecuritypriv->sw_decrypt = _TRUE;
+				psecuritypriv->sw_encrypt = _TRUE;
+				#endif
+				break;
+			case HW_ENCRY_SW_DECRY:
+				#if 0
+				Adapter->registrypriv.software_decrypt=_TRUE;
+				Adapter->registrypriv.software_encrypt=_FALSE;
+				#else
+				psecuritypriv->sw_decrypt = _TRUE;
+				psecuritypriv->sw_encrypt = _FALSE;
+				#endif
+				break;
+			case SW_ENCRY_HW_DECRY:
+				#if 0
+				Adapter->registrypriv.software_decrypt=_FALSE;
+				Adapter->registrypriv.software_encrypt=_TRUE;
+				#else
+				psecuritypriv->sw_decrypt = _FALSE;
+				psecuritypriv->sw_encrypt = _TRUE;
+				#endif
+				break;
+		}
+
+		RT_TRACE(_module_rtl871x_ioctl_c_, _drv_notice_,
+			 ("-oid_rt_pro_encryption_ctrl_hdl: SET encry_mode=0x%x sw_encrypt=0x%x sw_decrypt=0x%x\n",
+			  encry_mode, psecuritypriv->sw_encrypt, psecuritypriv->sw_decrypt));
+	}
+	else {
+		#if 0
+		if (Adapter->registrypriv.software_encrypt == _FALSE) {
+			if (Adapter->registrypriv.software_decrypt == _FALSE)
+				encry_mode = HW_CONTROL;
+			else
+				encry_mode = HW_ENCRY_SW_DECRY;
+		}
+		else {
+			if (Adapter->registrypriv.software_decrypt == _FALSE)
+				encry_mode = SW_ENCRY_HW_DECRY;
+			else
+				encry_mode = SW_CONTROL;
+		}
+		#else
+
+		if ((psecuritypriv->sw_encrypt == _FALSE) && (psecuritypriv->sw_decrypt == _FALSE))
+			encry_mode = HW_CONTROL;
+		else if ((psecuritypriv->sw_encrypt == _FALSE) && (psecuritypriv->sw_decrypt == _TRUE))
+			encry_mode = HW_ENCRY_SW_DECRY;
+		else if ((psecuritypriv->sw_encrypt == _TRUE) && (psecuritypriv->sw_decrypt == _FALSE))
+			encry_mode = SW_ENCRY_HW_DECRY;
+		else if ((psecuritypriv->sw_encrypt == _TRUE) && (psecuritypriv->sw_decrypt == _TRUE))
+			encry_mode = SW_CONTROL;
+
+		#endif
+
+		*(u8*)poid_par_priv->information_buf =  encry_mode;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+		RT_TRACE(_module_mp_, _drv_notice_,
+			 ("-oid_rt_pro_encryption_ctrl_hdl: QUERY encry_mode=0x%x\n",
+			  encry_mode));
+	}
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_add_sta_info_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	struct sta_info *psta = NULL;
+	UCHAR 		*macaddr;
+
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	*poid_par_priv->bytes_needed = ETH_ALEN;
+	if (poid_par_priv->information_buf_len < *poid_par_priv->bytes_needed)
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	macaddr = (UCHAR *) poid_par_priv->information_buf ;
+
+	RT_TRACE(_module_rtl871x_ioctl_c_,_drv_notice_,
+		 ("OID_RT_PRO_ADD_STA_INFO: addr="MAC_FMT"\n", MAC_ARG(macaddr) ));
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	psta = rtw_get_stainfo(&Adapter->stapriv, macaddr);
+
+	if (psta == NULL) { // the sta have been in sta_info_queue => do nothing
+		psta = rtw_alloc_stainfo(&Adapter->stapriv, macaddr);
+
+		if (psta == NULL) {
+			RT_TRACE(_module_rtl871x_ioctl_c_,_drv_err_,("Can't alloc sta_info when OID_RT_PRO_ADD_STA_INFO\n"));
+			status = NDIS_STATUS_FAILURE;
+		}
+	} else { //(between drv has received this event before and  fw have not yet to set key to CAM_ENTRY)
+		RT_TRACE(_module_rtl871x_ioctl_c_, _drv_err_,
+			("Error: OID_RT_PRO_ADD_STA_INFO: sta has been in sta_hash_queue \n"));
+	}
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_dele_sta_info_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	struct sta_info *psta = NULL;
+	UCHAR		*macaddr;
+
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	*poid_par_priv->bytes_needed = ETH_ALEN;
+	if (poid_par_priv->information_buf_len < *poid_par_priv->bytes_needed)
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	macaddr = (UCHAR *) poid_par_priv->information_buf ;
+	RT_TRACE(_module_rtl871x_ioctl_c_,_drv_notice_,
+		 ("+OID_RT_PRO_ADD_STA_INFO: addr="MAC_FMT"\n", MAC_ARG(macaddr) ));
+
+	psta = rtw_get_stainfo(&Adapter->stapriv, macaddr);
+	if (psta != NULL) {
+		_enter_critical(&(Adapter->stapriv.sta_hash_lock), &irqL);
+		rtw_free_stainfo(Adapter, psta);
+		_exit_critical(&(Adapter->stapriv.sta_hash_lock), &irqL);
+	}
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+#if 0
+#include <sdio_osintf.h>
+static u32 mp_query_drv_var(_adapter *padapter, u8 offset, u32 var)
+{
+#ifdef CONFIG_SDIO_HCI
+
+	if (offset == 1) {
+		u16 tmp_blk_num;
+		tmp_blk_num = rtw_read16(padapter, SDIO_RX0_RDYBLK_NUM);
+		RT_TRACE(_module_mp_, _drv_err_, ("Query Information, mp_query_drv_var  SDIO_RX0_RDYBLK_NUM=0x%x   adapter_to_dvobj(padapter)->rxblknum=0x%x\n", tmp_blk_num, adapter_to_dvobj(padapter)->rxblknum));
+		if (adapter_to_dvobj(padapter)->rxblknum != tmp_blk_num) {
+			RT_TRACE(_module_mp_,_drv_err_, ("Query Information, mp_query_drv_var  call recv rx\n"));
+		//	sd_recv_rxfifo(padapter);
+		}
+	}
+
+#if 0
+	if(offset <=100){  //For setting data rate and query data rate
+		if(offset==100){ //For query data rate
+			RT_TRACE(_module_mp_, _drv_emerg_, ("\n mp_query_drv_var: offset(%d): query rate=0x%.2x \n",offset,padapter->registrypriv.tx_rate));
+			var=padapter->registrypriv.tx_rate;
+
+		}
+		else if(offset<0x1d){  //For setting data rate
+			padapter->registrypriv.tx_rate=offset;
+			var=padapter->registrypriv.tx_rate;
+			padapter->registrypriv.use_rate=_TRUE;
+			RT_TRACE(_module_mp_, _drv_emerg_, ("\n mp_query_drv_var: offset(%d): set rate=0x%.2x \n",offset,padapter->registrypriv.tx_rate));
+		}
+		else{ //not use the data rate
+			padapter->registrypriv.use_rate=_FALSE;
+			RT_TRACE(_module_mp_, _drv_emerg_, ("\n mp_query_drv_var: offset(%d) out of rate range\n",offset));
+		}
+	}
+	else if (offset<=110){  //for setting debug level
+		RT_TRACE(_module_mp_, _drv_emerg_, (" mp_query_drv_var: offset(%d) for set debug level\n",offset));
+		if(offset==110){ //For query data rate
+			RT_TRACE(_module_mp_, _drv_emerg_, (" mp_query_drv_var: offset(%d): query dbg level=0x%.2x \n",offset,padapter->registrypriv.dbg_level));
+			padapter->registrypriv.dbg_level=GlobalDebugLevel;
+			var=padapter->registrypriv.dbg_level;
+		}
+		else if(offset<110 && offset>100){
+			RT_TRACE(_module_mp_, _drv_emerg_, (" mp_query_drv_var: offset(%d): set dbg level=0x%.2x \n",offset,offset-100));
+			padapter->registrypriv.dbg_level=GlobalDebugLevel=offset-100;
+			var=padapter->registrypriv.dbg_level;
+			RT_TRACE(_module_mp_, _drv_emerg_, (" mp_query_drv_var(_drv_emerg_): offset(%d): set dbg level=0x%.2x \n",offset,GlobalDebugLevel));
+			RT_TRACE(_module_mp_, _drv_alert_, (" mp_query_drv_var(_drv_alert_): offset(%d): set dbg level=0x%.2x \n",offset,GlobalDebugLevel));
+			RT_TRACE(_module_mp_, _drv_crit_, (" mp_query_drv_var(_drv_crit_): offset(%d): set dbg level=0x%.2x \n",offset,GlobalDebugLevel));
+			RT_TRACE(_module_mp_, _drv_err_, (" mp_query_drv_var(_drv_err_): offset(%d): set dbg level=0x%.2x \n",offset,GlobalDebugLevel));
+			RT_TRACE(_module_mp_, _drv_warning_, (" mp_query_drv_var(_drv_warning_): offset(%d): set dbg level=0x%.2x \n",offset,GlobalDebugLevel));
+			RT_TRACE(_module_mp_, _drv_notice_, (" mp_query_drv_var(_drv_notice_): offset(%d): set dbg level=0x%.2x \n",offset,GlobalDebugLevel));
+			RT_TRACE(_module_mp_, _drv_info_, (" mp_query_drv_var(_drv_info_): offset(%d): set dbg level=0x%.2x \n",offset,GlobalDebugLevel));
+			RT_TRACE(_module_mp_, _drv_debug_, (" mp_query_drv_var(_drv_debug_): offset(%d): set dbg level=0x%.2x \n",offset,GlobalDebugLevel));
+
+		}
+	}
+	else if(offset >110 &&offset <116){
+		if(115==offset){
+			RT_TRACE(_module_mp_, _drv_emerg_, (" mp_query_drv_var(_drv_emerg_): offset(%d): query TRX access type: [tx_block_mode=%x,rx_block_mode=%x]\n",\
+															offset, adapter_to_dvobj(padapter)->tx_block_mode, adapter_to_dvobj(padapter)->rx_block_mode));
+		}
+		else {
+			switch(offset){
+				case 111:
+					adapter_to_dvobj(padapter)->tx_block_mode=1;
+					adapter_to_dvobj(padapter)->rx_block_mode=1;
+					RT_TRACE(_module_mp_, _drv_emerg_, \
+						(" mp_query_drv_var(_drv_emerg_): offset(%d): SET TRX access type:(TX block/RX block) [tx_block_mode=%x,rx_block_mode=%x]\n",\
+						offset, adapter_to_dvobj(padapter)->tx_block_mode, adapter_to_dvobj(padapter)->rx_block_mode));
+					break;
+				case 112:
+					adapter_to_dvobj(padapter)->tx_block_mode=1;
+					adapter_to_dvobj(padapter)->rx_block_mode=0;
+					RT_TRACE(_module_mp_, _drv_emerg_, \
+						(" mp_query_drv_var(_drv_emerg_): offset(%d): SET TRX access type:(TX block/RX byte) [tx_block_mode=%x,rx_block_mode=%x]\n",\
+						offset, adapter_to_dvobj(padapter)->tx_block_mode, adapter_to_dvobj(padapter)->rx_block_mode));
+					break;
+				case 113:
+					adapter_to_dvobj(padapter)->tx_block_mode=0;
+					adapter_to_dvobj(padapter)->rx_block_mode=1;
+					RT_TRACE(_module_mp_, _drv_emerg_, \
+						(" mp_query_drv_var(_drv_emerg_): offset(%d): SET TRX access type:(TX byte/RX block) [tx_block_mode=%x,rx_block_mode=%x]\n",\
+						offset, adapter_to_dvobj(padapter)->tx_block_mode, adapter_to_dvobj(padapter)->rx_block_mode));
+					break;
+				case 114:
+					adapter_to_dvobj(padapter)->tx_block_mode=0;
+					adapter_to_dvobj(padapter)->rx_block_mode=0;
+					RT_TRACE(_module_mp_, _drv_emerg_, \
+						(" mp_query_drv_var(_drv_emerg_): offset(%d): SET TRX access type:(TX byte/RX byte) [tx_block_mode=%x,rx_block_mode=%x]\n",\
+						offset, adapter_to_dvobj(padapter)->tx_block_mode, adapter_to_dvobj(padapter)->rx_block_mode));
+					break;
+				default :
+					break;
+
+			}
+
+		}
+
+	}
+	else if(offset>=127){
+		u64	prnt_dbg_comp;
+		u8   chg_idx;
+		u64	tmp_dbg_comp;
+		chg_idx=offset-0x80;
+		tmp_dbg_comp=BIT(chg_idx);
+		prnt_dbg_comp=padapter->registrypriv.dbg_component= GlobalDebugComponents;
+		RT_TRACE(_module_mp_, _drv_emerg_, (" 1: mp_query_drv_var: offset(%d;0x%x):for dbg conpoment prnt_dbg_comp=0x%.16x GlobalDebugComponents=0x%.16x padapter->registrypriv.dbg_component=0x%.16x\n",offset,offset,prnt_dbg_comp,GlobalDebugComponents,padapter->registrypriv.dbg_component));
+		if(offset==127){
+	//		prnt_dbg_comp=padapter->registrypriv.dbg_component= GlobalDebugComponents;
+			var=(u32)(padapter->registrypriv.dbg_component);
+			RT_TRACE(0xffffffff, _drv_emerg_, ("2: mp_query_drv_var: offset(%d;0x%x):for query dbg conpoment=0x%x(l) 0x%x(h)  GlobalDebugComponents=0x%x(l) 0x%x(h) \n",offset,offset,padapter->registrypriv.dbg_component,prnt_dbg_comp));
+			prnt_dbg_comp=GlobalDebugComponents;
+			RT_TRACE(0xffffffff, _drv_emerg_, ("2-1: mp_query_drv_var: offset(%d;0x%x):for query dbg conpoment=0x%x(l) 0x%x(h)  GlobalDebugComponents=0x%x(l) 0x%x(h)\n",offset,offset,padapter->registrypriv.dbg_component,prnt_dbg_comp));
+			prnt_dbg_comp=GlobalDebugComponents=padapter->registrypriv.dbg_component;
+			RT_TRACE(0xffffffff, _drv_emerg_, ("2-2: mp_query_drv_var: offset(%d;0x%x):for query dbg conpoment=0x%x(l) 0x%x(h)  GlobalDebugComponents=0x%x(l) 0x%x(h)\n",offset,offset,padapter->registrypriv.dbg_component,prnt_dbg_comp));
+
+		}
+		else{
+			RT_TRACE(0xffffffff, _drv_emerg_, ("3: mp_query_drv_var: offset(%d;0x%x):for query dbg conpoment=0x%x(l) 0x%x(h) GlobalDebugComponents=0x%x(l) 0x%x(h) chg_idx=%d\n",offset,offset,padapter->registrypriv.dbg_component,prnt_dbg_comp,chg_idx));
+			prnt_dbg_comp=GlobalDebugComponents;
+			RT_TRACE(0xffffffff, _drv_emerg_,("3-1: mp_query_drv_var: offset(%d;0x%x):for query dbg conpoment=0x%x(l) 0x%x(h)  GlobalDebugComponents=0x%x(l) 0x%x(h) chg_idx=%d\n",offset,offset,padapter->registrypriv.dbg_component,prnt_dbg_comp,chg_idx));// ("3-1: mp_query_drv_var: offset(%d;0x%x):before set dbg conpoment=0x%x chg_idx=%d or0x%x BIT(chg_idx[%d]=0x%x)\n",offset,offset,prnt_dbg_comp,chg_idx,chg_idx,(chg_idx),tmp_dbg_comp)
+			prnt_dbg_comp=GlobalDebugComponents=padapter->registrypriv.dbg_component;
+			RT_TRACE(0xffffffff, _drv_emerg_, ("3-2: mp_query_drv_var: offset(%d;0x%x):for query dbg conpoment=0x%x(l) 0x%x(h)  GlobalDebugComponents=0x%x(l) 0x%x(h)\n",offset,offset,padapter->registrypriv.dbg_component,prnt_dbg_comp));
+
+			if(GlobalDebugComponents&tmp_dbg_comp){
+				//this bit is already set, now clear it
+				GlobalDebugComponents=GlobalDebugComponents&(~tmp_dbg_comp);
+			}
+			else{
+				//this bit is not set, now set it.
+				GlobalDebugComponents =GlobalDebugComponents|tmp_dbg_comp;
+			}
+			RT_TRACE(0xffffffff, _drv_emerg_, ("4: mp_query_drv_var: offset(%d;0x%x):before set dbg conpoment tmp_dbg_comp=0x%x GlobalDebugComponents=0x%x(l) 0x%x(h)",offset,offset,tmp_dbg_comp,prnt_dbg_comp));
+			prnt_dbg_comp=GlobalDebugComponents;
+			RT_TRACE(0xffffffff, _drv_emerg_, ("4-1: mp_query_drv_var: offset(%d;0x%x):before set dbg conpoment tmp_dbg_comp=0x%x GlobalDebugComponents=0x%x(l) 0x%x(h)",offset,offset,tmp_dbg_comp,prnt_dbg_comp));
+
+			RT_TRACE(_module_rtl871x_xmit_c_, _drv_emerg_, ("0: mp_query_drv_var(_module_rtl871x_xmit_c_:0): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,prnt_dbg_comp));
+			RT_TRACE(_module_xmit_osdep_c_, _drv_emerg_, ("1: mp_query_drv_var(_module_xmit_osdep_c_:1): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_emerg_, ("2: mp_query_drv_var(_module_rtl871x_recv_c_:2): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_recv_osdep_c_, _drv_emerg_, ("3: mp_query_drv_var(_module_recv_osdep_c_:3): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_mlme_c_, _drv_emerg_, ("4: mp_query_drv_var(_module_rtl871x_mlme_c_:4): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_mlme_osdep_c_, _drv_emerg_, (" 5:mp_query_drv_var(_module_mlme_osdep_c_:5): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_sta_mgt_c_, _drv_emerg_, ("6: mp_query_drv_var(_module_rtl871x_sta_mgt_c_:6): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_cmd_c_, _drv_emerg_, ("7: mp_query_drv_var(_module_rtl871x_cmd_c_:7): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_cmd_osdep_c_, _drv_emerg_, ("8: mp_query_drv_var(_module_cmd_osdep_c_:8): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_io_c_, _drv_emerg_, ("9: mp_query_drv_var(_module_rtl871x_io_c_:9): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_io_osdep_c_, _drv_emerg_, ("10: mp_query_drv_var(_module_io_osdep_c_:10): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_os_intfs_c_, _drv_emerg_, ("11: mp_query_drv_var(_module_os_intfs_c_:11): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_security_c_, _drv_emerg_, ("12: mp_query_drv_var(_module_rtl871x_security_c_:12): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_eeprom_c_, _drv_emerg_, ("13: mp_query_drv_var(_module_rtl871x_eeprom_c_:13): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_hal_init_c_, _drv_emerg_, ("14: mp_query_drv_var(_module_hal_init_c_:14): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_hci_hal_init_c_, _drv_emerg_, ("15: mp_query_drv_var(_module_hci_hal_init_c_:15): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_ioctl_c_, _drv_emerg_, ("16: mp_query_drv_var(_module_rtl871x_ioctl_c_:16): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_emerg_, ("17: mp_query_drv_var(_module_rtl871x_ioctl_set_c_:17): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_ioctl_query_c_, _drv_emerg_, ("18: mp_query_drv_var(_module_rtl871x_ioctl_query_c_:18): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_emerg_, ("19: mp_query_drv_var(_module_rtl871x_pwrctrl_c_:19): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_hci_intfs_c_, _drv_emerg_, ("20: mp_query_drv_var(_module_hci_intfs_c_:20): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_hci_ops_c_, _drv_emerg_, ("21: mp_query_drv_var(_module_hci_ops_c_:21): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_osdep_service_c_, _drv_emerg_, ("22: mp_query_drv_var(_module_osdep_service_c_:22): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_mp_, _drv_emerg_, ("23: mp_query_drv_var(_module_mp_:23): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			RT_TRACE(_module_hci_ops_os_c_, _drv_emerg_, ("24: mp_query_drv_var(_module_hci_ops_os_c_:24): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+			var=(u32)(GlobalDebugComponents);
+			//GlobalDebugComponents=padapter->registrypriv.dbg_component;
+			RT_TRACE(0xffffffff, _drv_emerg_, (" ==mp_query_drv_var(_module_mp_): offset(%d;0x%x):before set dbg conpoment=0x%x(l) 0x%x(h)\n",offset,offset,GlobalDebugComponents));
+
+		}
+	}
+	else{
+		RT_TRACE(_module_mp_, _drv_emerg_, ("\n mp_query_drv_var: offset(%d) >110\n",offset));
+	}
+#endif
+#endif
+
+	return var;
+}
+#endif
+
+NDIS_STATUS oid_rt_pro_query_dr_variable_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER		Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL			oldirql;
+#endif
+	NDIS_STATUS		status = NDIS_STATUS_SUCCESS;
+
+	DR_VARIABLE_STRUCT	*pdrv_var;
+
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	*poid_par_priv->bytes_needed = sizeof(DR_VARIABLE_STRUCT);
+	if (poid_par_priv->information_buf_len < *poid_par_priv->bytes_needed)
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+Query Information, OID_RT_PRO_QUERY_DR_VARIABLE\n"));
+
+	pdrv_var = (struct _DR_VARIABLE_STRUCT_ *)poid_par_priv->information_buf;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	pdrv_var->variable = mp_query_drv_var(Adapter, pdrv_var->offset, pdrv_var->variable);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("-oid_rt_pro_query_dr_variable_hdl: offset=0x%x valule=0x%x\n",
+		  pdrv_var->offset, pdrv_var->variable));
+
+	return status;
+#else
+	return 0;
+#endif
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_rx_packet_type_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	RT_TRACE(_module_mp_, _drv_err_, ("oid_rt_pro_rx_packet_type_hdl...................\n"));
+
+	if (poid_par_priv->information_buf_len < sizeof (UCHAR)) {
+		status = NDIS_STATUS_INVALID_LENGTH;
+		*poid_par_priv->bytes_needed = sizeof(UCHAR);
+		return status;
+	}
+
+	if (poid_par_priv->type_of_oid == SET_OID) {
+		Adapter->mppriv.rx_with_status = *(UCHAR *) poid_par_priv->information_buf;
+		RT_TRACE(_module_rtl871x_ioctl_c_,_drv_err_, ("Query Information, OID_RT_PRO_RX_PACKET_TYPE:%d \n",\
+												Adapter->mppriv.rx_with_status));
+
+		//*(u32 *)&Adapter->eeprompriv.mac_addr[0]=rtw_read32(Adapter, 0x10250050);
+		//*(u16 *)&Adapter->eeprompriv.mac_addr[4]=rtw_read16(Adapter, 0x10250054);
+		RT_TRACE(_module_rtl871x_ioctl_c_,_drv_err_,("MAC addr=0x%x:0x%x:0x%x:0x%x:0x%x:0x%x  \n",
+			Adapter->eeprompriv.mac_addr[0],Adapter->eeprompriv.mac_addr[1],Adapter->eeprompriv.mac_addr[2],\
+			Adapter->eeprompriv.mac_addr[3],Adapter->eeprompriv.mac_addr[4],Adapter->eeprompriv.mac_addr[5]));
+
+	}
+	else {
+		*(UCHAR *) poid_par_priv->information_buf = Adapter->mppriv.rx_with_status;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+		RT_TRACE(_module_rtl871x_ioctl_c_,_drv_err_, ("Query Information, OID_RT_PRO_RX_PACKET_TYPE:%d \n", \
+												Adapter->mppriv.rx_with_status));
+
+		//*(u32 *)&Adapter->eeprompriv.mac_addr[0]=rtw_read32(Adapter, 0x10250050);
+		//*(u16 *)&Adapter->eeprompriv.mac_addr[4]=rtw_read16(Adapter, 0x10250054);
+		RT_TRACE(_module_rtl871x_ioctl_c_,_drv_err_,("MAC addr=0x%x:0x%x:0x%x:0x%x:0x%x:0x%x  \n",
+			Adapter->eeprompriv.mac_addr[0],Adapter->eeprompriv.mac_addr[1],Adapter->eeprompriv.mac_addr[2],\
+			Adapter->eeprompriv.mac_addr[3],Adapter->eeprompriv.mac_addr[4],Adapter->eeprompriv.mac_addr[5]));
+	}
+#endif
+
+	return NDIS_STATUS_SUCCESS;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_read_efuse_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL oldirql;
+#endif
+	PEFUSE_ACCESS_STRUCT pefuse;
+	u8 *data;
+	u16 addr = 0, cnts = 0, max_available_size = 0;
+	NDIS_STATUS status = NDIS_STATUS_SUCCESS;
+	PADAPTER Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(EFUSE_ACCESS_STRUCT))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	pefuse = (PEFUSE_ACCESS_STRUCT)poid_par_priv->information_buf;
+	addr = pefuse->start_addr;
+	cnts = pefuse->cnts;
+	data = pefuse->data;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		("+oid_rt_pro_read_efuse_hd: buf_len=%ld addr=%d cnts=%d\n",
+		 poid_par_priv->information_buf_len, addr, cnts));
+
+	EFUSE_GetEfuseDefinition(Adapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+
+	if ((addr + cnts) > max_available_size) {
+		RT_TRACE(_module_mp_, _drv_err_, ("!oid_rt_pro_read_efuse_hdl: parameter error!\n"));
+		return NDIS_STATUS_NOT_ACCEPTED;
+	}
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	if (rtw_efuse_access(Adapter, _FALSE, addr, cnts, data) == _FAIL) {
+		RT_TRACE(_module_mp_, _drv_err_, ("!oid_rt_pro_read_efuse_hdl: rtw_efuse_access FAIL!\n"));
+		status = NDIS_STATUS_FAILURE;
+	} else
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_write_efuse_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL oldirql;
+#endif
+	PEFUSE_ACCESS_STRUCT pefuse;
+	u8 *data;
+	u16 addr = 0, cnts = 0, max_available_size = 0;
+	NDIS_STATUS status = NDIS_STATUS_SUCCESS;
+	PADAPTER Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	pefuse = (PEFUSE_ACCESS_STRUCT)poid_par_priv->information_buf;
+	addr = pefuse->start_addr;
+	cnts = pefuse->cnts;
+	data = pefuse->data;
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("+oid_rt_pro_write_efuse_hdl: buf_len=%ld addr=0x%04x cnts=%d\n",
+		  poid_par_priv->information_buf_len, addr, cnts));
+
+	EFUSE_GetEfuseDefinition(Adapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+
+	if ((addr + cnts) > max_available_size) {
+		RT_TRACE(_module_mp_, _drv_err_, ("!oid_rt_pro_write_efuse_hdl: parameter error"));
+		return NDIS_STATUS_NOT_ACCEPTED;
+	}
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	if (rtw_efuse_access(Adapter, _TRUE, addr, cnts, data) == _FAIL)
+		status = NDIS_STATUS_FAILURE;
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_rw_efuse_pgpkt_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	PPGPKT_STRUCT	ppgpkt;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+//	RT_TRACE(_module_mp_, _drv_info_, ("+oid_rt_pro_rw_efuse_pgpkt_hdl\n"));
+
+	*poid_par_priv->bytes_rw = 0;
+
+	if (poid_par_priv->information_buf_len < sizeof(PGPKT_STRUCT))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	ppgpkt = (PPGPKT_STRUCT)poid_par_priv->information_buf;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	if (poid_par_priv->type_of_oid == QUERY_OID)
+	{
+		RT_TRACE(_module_mp_, _drv_notice_,
+			("oid_rt_pro_rw_efuse_pgpkt_hdl: Read offset=0x%x\n",\
+			ppgpkt->offset));
+
+		Efuse_PowerSwitch(Adapter, _FALSE, _TRUE);
+		if (Efuse_PgPacketRead(Adapter, ppgpkt->offset, ppgpkt->data, _FALSE) == _TRUE)
+			*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+		else
+			status = NDIS_STATUS_FAILURE;
+		Efuse_PowerSwitch(Adapter, _FALSE, _FALSE);
+	} else {
+		RT_TRACE(_module_mp_, _drv_notice_,
+			("oid_rt_pro_rw_efuse_pgpkt_hdl: Write offset=0x%x word_en=0x%x\n",\
+			ppgpkt->offset, ppgpkt->word_en));
+
+		Efuse_PowerSwitch(Adapter, _TRUE, _TRUE);
+		if (Efuse_PgPacketWrite(Adapter, ppgpkt->offset, ppgpkt->word_en, ppgpkt->data, _FALSE) == _TRUE)
+			*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+		else
+			status = NDIS_STATUS_FAILURE;
+		Efuse_PowerSwitch(Adapter, _TRUE, _FALSE);
+	}
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("-oid_rt_pro_rw_efuse_pgpkt_hdl: status=0x%08X\n", status));
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_efuse_current_size_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u16 size;
+	u8 ret;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len <sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	ret = efuse_GetCurrentSize(Adapter, &size);
+	_irqlevel_changed_(&oldirql, RAISE);
+	if (ret == _SUCCESS) {
+		*(u32*)poid_par_priv->information_buf = size;
+		*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+	} else
+		status = NDIS_STATUS_FAILURE;
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_efuse_max_size_hdl(struct oid_par_priv *poid_par_priv)
+{
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	*(u32*)poid_par_priv->information_buf = efuse_GetMaxSize(Adapter);
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("-oid_rt_get_efuse_max_size_hdl: size=%d status=0x%08X\n",
+		  *(int*)poid_par_priv->information_buf, status));
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_efuse_hdl(struct oid_par_priv *poid_par_priv)
+{
+	NDIS_STATUS	status;
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_info_, ("+oid_rt_pro_efuse_hdl\n"));
+
+	if (poid_par_priv->type_of_oid == QUERY_OID)
+		status = oid_rt_pro_read_efuse_hdl(poid_par_priv);
+	else
+		status = oid_rt_pro_write_efuse_hdl(poid_par_priv);
+
+	RT_TRACE(_module_mp_, _drv_info_, ("-oid_rt_pro_efuse_hdl: status=0x%08X\n", status));
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_pro_efuse_map_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u8		*data;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+	u16	mapLen=0;
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_pro_efuse_map_hdl\n"));
+
+	EFUSE_GetEfuseDefinition(Adapter, EFUSE_WIFI, TYPE_EFUSE_MAP_LEN, (PVOID)&mapLen, _FALSE);
+
+	*poid_par_priv->bytes_rw = 0;
+
+	if (poid_par_priv->information_buf_len < mapLen)
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	data = (u8*)poid_par_priv->information_buf;
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	if (poid_par_priv->type_of_oid == QUERY_OID)
+	{
+		RT_TRACE(_module_mp_, _drv_info_,
+			("oid_rt_pro_efuse_map_hdl: READ\n"));
+
+		if (rtw_efuse_map_read(Adapter, 0, mapLen, data) == _SUCCESS)
+			*poid_par_priv->bytes_rw = mapLen;
+		else {
+			RT_TRACE(_module_mp_, _drv_err_,
+				("oid_rt_pro_efuse_map_hdl: READ fail\n"));
+			status = NDIS_STATUS_FAILURE;
+		}
+	} else {
+		// SET_OID
+		RT_TRACE(_module_mp_, _drv_info_,
+			("oid_rt_pro_efuse_map_hdl: WRITE\n"));
+
+		if (rtw_efuse_map_write(Adapter, 0, mapLen, data) == _SUCCESS)
+			*poid_par_priv->bytes_rw = mapLen;
+		else {
+			RT_TRACE(_module_mp_, _drv_err_,
+				("oid_rt_pro_efuse_map_hdl: WRITE fail\n"));
+			status = NDIS_STATUS_FAILURE;
+		}
+	}
+
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("-oid_rt_pro_efuse_map_hdl: status=0x%08X\n", status));
+
+_func_exit_;
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_set_crystal_cap_hdl(struct oid_par_priv *poid_par_priv)
+{
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+
+	u32		crystal_cap = 0;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len <sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	crystal_cap = *((u32*)poid_par_priv->information_buf);//4
+	if (crystal_cap > 0xf)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	Adapter->mppriv.curr_crystalcap = crystal_cap;
+
+	_irqlevel_changed_(&oldirql,LOWER);
+	SetCrystalCap(Adapter);
+	_irqlevel_changed_(&oldirql,RAISE);
+
+_func_exit_;
+
+#endif
+	return status;
+}
+
+NDIS_STATUS oid_rt_set_rx_packet_type_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u8		rx_pkt_type;
+//	u32		rcr_val32;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+//	PADAPTER	padapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+_func_enter_;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+oid_rt_set_rx_packet_type_hdl\n"));
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(u8))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	rx_pkt_type = *((u8*)poid_par_priv->information_buf);//4
+
+	RT_TRACE(_module_mp_, _drv_info_, ("rx_pkt_type: %x\n",rx_pkt_type ));
+#if 0
+	_irqlevel_changed_(&oldirql, LOWER);
+#if 0
+	rcr_val8 = rtw_read8(Adapter, 0x10250048);//RCR
+	rcr_val8 &= ~(RCR_AB|RCR_AM|RCR_APM|RCR_AAP);
+
+	if(rx_pkt_type == RX_PKT_BROADCAST){
+		rcr_val8 |= (RCR_AB | RCR_ACRC32 );
+	}
+	else if(rx_pkt_type == RX_PKT_DEST_ADDR){
+		rcr_val8 |= (RCR_AAP| RCR_AM |RCR_ACRC32);
+	}
+	else if(rx_pkt_type == RX_PKT_PHY_MATCH){
+		rcr_val8 |= (RCR_APM|RCR_ACRC32);
+	}
+	else{
+		rcr_val8 &= ~(RCR_AAP|RCR_APM|RCR_AM|RCR_AB|RCR_ACRC32);
+	}
+	rtw_write8(padapter, 0x10250048,rcr_val8);
+#else
+	rcr_val32 = rtw_read32(padapter, RCR);//RCR = 0x10250048
+	rcr_val32 &= ~(RCR_CBSSID|RCR_AB|RCR_AM|RCR_APM|RCR_AAP);
+#if 0
+	if(rx_pkt_type == RX_PKT_BROADCAST){
+		rcr_val32 |= (RCR_AB|RCR_AM|RCR_APM|RCR_AAP|RCR_ACRC32);
+	}
+	else if(rx_pkt_type == RX_PKT_DEST_ADDR){
+		//rcr_val32 |= (RCR_CBSSID|RCR_AAP|RCR_AM|RCR_ACRC32);
+		rcr_val32 |= (RCR_CBSSID|RCR_APM|RCR_ACRC32);
+	}
+	else if(rx_pkt_type == RX_PKT_PHY_MATCH){
+		rcr_val32 |= (RCR_APM|RCR_ACRC32);
+		//rcr_val32 |= (RCR_AAP|RCR_ACRC32);
+	}
+	else{
+		rcr_val32 &= ~(RCR_AAP|RCR_APM|RCR_AM|RCR_AB|RCR_ACRC32);
+	}
+#else
+	switch (rx_pkt_type)
+	{
+		case RX_PKT_BROADCAST :
+			rcr_val32 |= (RCR_AB|RCR_AM|RCR_APM|RCR_AAP|RCR_ACRC32);
+			break;
+		case RX_PKT_DEST_ADDR :
+			rcr_val32 |= (RCR_AB|RCR_AM|RCR_APM|RCR_AAP|RCR_ACRC32);
+			break;
+		case RX_PKT_PHY_MATCH:
+			rcr_val32 |= (RCR_APM|RCR_ACRC32);
+			break;
+		default:
+			rcr_val32 &= ~(RCR_AAP|RCR_APM|RCR_AM|RCR_AB|RCR_ACRC32);
+			break;
+	}
+
+	if (rx_pkt_type == RX_PKT_DEST_ADDR) {
+		padapter->mppriv.check_mp_pkt = 1;
+	} else {
+		padapter->mppriv.check_mp_pkt = 0;
+	}
+#endif
+	rtw_write32(padapter, RCR, rcr_val32);
+
+#endif
+	_irqlevel_changed_(&oldirql, RAISE);
+#endif
+_func_exit_;
+
+	return status;
+}
+
+NDIS_STATUS oid_rt_pro_set_tx_agc_offset_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+
+	u32 		txagc;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len < sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	txagc = *(u32*)poid_par_priv->information_buf;
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("oid_rt_pro_set_tx_agc_offset_hdl: 0x%08x\n", txagc));
+
+	_irqlevel_changed_(&oldirql, LOWER);
+	SetTxAGCOffset(Adapter, txagc);
+	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+
+NDIS_STATUS oid_rt_pro_set_pkt_test_mode_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	PADAPTER		Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+
+	NDIS_STATUS		status = NDIS_STATUS_SUCCESS;
+
+	struct mlme_priv	*pmlmepriv = &Adapter->mlmepriv;
+	struct mp_priv		*pmppriv = &Adapter->mppriv;
+	u32 			type;
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID)
+		return NDIS_STATUS_NOT_ACCEPTED;
+
+	if (poid_par_priv->information_buf_len <sizeof(u32))
+		return NDIS_STATUS_INVALID_LENGTH;
+
+	type = *(u32*)poid_par_priv->information_buf;
+
+	if (_LOOPBOOK_MODE_ == type) {
+		pmppriv->mode = type;
+		set_fwstate(pmlmepriv, WIFI_MP_LPBK_STATE); //append txdesc
+		RT_TRACE(_module_mp_, _drv_info_, ("test mode change to loopback mode:0x%08x.\n", get_fwstate(pmlmepriv)));
+	} else if (_2MAC_MODE_ == type){
+		pmppriv->mode = type;
+		_clr_fwstate_(pmlmepriv, WIFI_MP_LPBK_STATE);
+		RT_TRACE(_module_mp_, _drv_info_, ("test mode change to 2mac mode:0x%08x.\n", get_fwstate(pmlmepriv)));
+	} else
+		status = NDIS_STATUS_NOT_ACCEPTED;
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
+
+unsigned int mp_ioctl_xmit_packet_hdl(struct oid_par_priv *poid_par_priv)
+{
+	PMP_XMIT_PARM pparm;
+	PADAPTER padapter;
+	struct mp_priv *pmp_priv;
+	struct pkt_attrib *pattrib;
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("+%s\n", __func__));
+
+	pparm = (PMP_XMIT_PARM)poid_par_priv->information_buf;
+	padapter = (PADAPTER)poid_par_priv->adapter_context;
+	pmp_priv = &padapter->mppriv;
+
+	if (poid_par_priv->type_of_oid == QUERY_OID) {
+		pparm->enable = !pmp_priv->tx.stop;
+		pparm->count = pmp_priv->tx.sended;
+	} else {
+		if (pparm->enable == 0) {
+			pmp_priv->tx.stop = 1;
+		} else if (pmp_priv->tx.stop == 1) {
+			pmp_priv->tx.stop = 0;
+			pmp_priv->tx.count = pparm->count;
+			pmp_priv->tx.payload = pparm->payload_type;
+			pattrib = &pmp_priv->tx.attrib;
+			pattrib->pktlen = pparm->length;
+			_rtw_memcpy(pattrib->dst, pparm->da, ETH_ALEN);
+			SetPacketTx(padapter);
+		} else
+			return NDIS_STATUS_FAILURE;
+	}
+
+	return NDIS_STATUS_SUCCESS;
+}
+
+#if 0
+unsigned int mp_ioctl_xmit_packet_hdl(struct oid_par_priv *poid_par_priv)
+{
+	unsigned char *pframe, *pmp_pkt;
+	struct ethhdr *pethhdr;
+	struct pkt_attrib *pattrib;
+	struct rtw_ieee80211_hdr *pwlanhdr;
+	unsigned short *fctrl;
+	int llc_sz, payload_len;
+	struct mp_xmit_frame *pxframe=  NULL;
+	struct mp_xmit_packet *pmp_xmitpkt = (struct mp_xmit_packet*)param;
+	u8 addr3[] = {0x02, 0xE0, 0x4C, 0x87, 0x66, 0x55};
+
+//	DBG_871X("+mp_ioctl_xmit_packet_hdl\n");
+
+	pxframe = alloc_mp_xmitframe(&padapter->mppriv);
+	if (pxframe == NULL)
+	{
+		DEBUG_ERR(("Can't alloc pmpframe %d:%s\n", __LINE__, __FILE__));
+		return -1;
+	}
+
+	//mp_xmit_pkt
+	payload_len = pmp_xmitpkt->len - 14;
+	pmp_pkt = (unsigned char*)pmp_xmitpkt->mem;
+	pethhdr = (struct ethhdr *)pmp_pkt;
+
+	//DBG_871X("payload_len=%d, pkt_mem=0x%x\n", pmp_xmitpkt->len, (void*)pmp_xmitpkt->mem);
+
+	//DBG_871X("pxframe=0x%x\n", (void*)pxframe);
+	//DBG_871X("pxframe->mem=0x%x\n", (void*)pxframe->mem);
+
+	//update attribute
+	pattrib = &pxframe->attrib;
+	memset((u8 *)(pattrib), 0, sizeof (struct pkt_attrib));
+	pattrib->pktlen = pmp_xmitpkt->len;
+	pattrib->ether_type = ntohs(pethhdr->h_proto);
+	pattrib->hdrlen = 24;
+	pattrib->nr_frags = 1;
+	pattrib->priority = 0;
+#ifndef CONFIG_MP_LINUX
+	if(IS_MCAST(pethhdr->h_dest))
+		pattrib->mac_id = 4;
+	else
+		pattrib->mac_id = 5;
+#else
+	pattrib->mac_id = 5;
+#endif
+
+	//
+	memset(pxframe->mem, 0 , WLANHDR_OFFSET);
+	pframe = (u8 *)(pxframe->mem) + WLANHDR_OFFSET;
+
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+	SetFrameSubType(pframe, WIFI_DATA);
+
+	_rtw_memcpy(pwlanhdr->addr1, pethhdr->h_dest, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, pethhdr->h_source, ETH_ALEN);
+
+	_rtw_memcpy(pwlanhdr->addr3, addr3, ETH_ALEN);
+
+	pwlanhdr->seq_ctl = 0;
+	pframe += pattrib->hdrlen;
+
+	llc_sz= rtw_put_snap(pframe, pattrib->ether_type);
+	pframe += llc_sz;
+
+	_rtw_memcpy(pframe, (void*)(pmp_pkt+14),  payload_len);
+
+	pattrib->last_txcmdsz = pattrib->hdrlen + llc_sz + payload_len;
+
+	DEBUG_INFO(("issuing mp_xmit_frame, tx_len=%d, ether_type=0x%x\n", pattrib->last_txcmdsz, pattrib->ether_type));
+	xmit_mp_frame(padapter, pxframe);
+
+	return _SUCCESS;
+}
+#endif
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_set_power_down_hdl(struct oid_par_priv *poid_par_priv)
+{
+#ifdef PLATFORM_OS_XP
+	_irqL		oldirql;
+#endif
+	u8		bpwrup;
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+#ifdef PLATFORM_LINUX
+#ifdef CONFIG_SDIO_HCI
+	PADAPTER	padapter = (PADAPTER)(poid_par_priv->adapter_context);
+#endif
+#endif
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != SET_OID) {
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("\n ===> Setoid_rt_set_power_down_hdl.\n"));
+
+	_irqlevel_changed_(&oldirql, LOWER);
+
+	bpwrup = *(u8 *)poid_par_priv->information_buf;
+	//CALL  the power_down function
+#ifdef PLATFORM_LINUX
+#ifdef CONFIG_SDIO_HCI
+	dev_power_down(padapter,bpwrup);
+#endif
+#endif
+	_irqlevel_changed_(&oldirql, RAISE);
+
+	//DEBUG_ERR(("\n <=== Query OID_RT_PRO_READ_REGISTER.
+	//	Add:0x%08x Width:%d Value:0x%08x\n",RegRWStruct->offset,RegRWStruct->width,RegRWStruct->value));
+
+_func_exit_;
+
+	return status;
+}
+//------------------------------------------------------------------------------
+NDIS_STATUS oid_rt_get_power_mode_hdl(struct oid_par_priv *poid_par_priv)
+{
+#if 0
+	NDIS_STATUS	status = NDIS_STATUS_SUCCESS;
+	PADAPTER	Adapter = (PADAPTER)(poid_par_priv->adapter_context);
+//#ifdef PLATFORM_OS_XP
+//	_irqL		oldirql;
+//#endif
+
+_func_enter_;
+
+	if (poid_par_priv->type_of_oid != QUERY_OID) {
+		status = NDIS_STATUS_NOT_ACCEPTED;
+		return status;
+	}
+	if (poid_par_priv->information_buf_len < sizeof(u32)) {
+		status = NDIS_STATUS_INVALID_LENGTH;
+		return status;
+	}
+
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("\n ===> oid_rt_get_power_mode_hdl.\n"));
+
+//	_irqlevel_changed_(&oldirql, LOWER);
+	*(int*)poid_par_priv->information_buf = Adapter->registrypriv.low_power ? POWER_LOW : POWER_NORMAL;
+	*poid_par_priv->bytes_rw = poid_par_priv->information_buf_len;
+//	_irqlevel_changed_(&oldirql, RAISE);
+
+_func_exit_;
+
+	return status;
+#else
+	return 0;
+#endif
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_p2p.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_p2p.c
new file mode 100644
index 000000000000..0fe04435bffb
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_p2p.c
@@ -0,0 +1,5293 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_P2P_C_
+
+#include <drv_types.h>
+#include <rtw_p2p.h>
+#include <wifi.h>
+
+#ifdef CONFIG_P2P
+
+int rtw_p2p_is_channel_list_ok( u8 desired_ch, u8* ch_list, u8 ch_cnt )
+{
+	int found = 0, i = 0;
+
+	for( i = 0; i < ch_cnt; i++ )
+	{
+		if ( ch_list[ i ] == desired_ch )
+		{
+			found = 1;
+			break;
+		}
+	}
+	return( found );
+}
+
+int is_any_client_associated(_adapter *padapter)
+{
+	return padapter->stapriv.asoc_list_cnt ? _TRUE : _FALSE;
+}
+
+static u32 go_add_group_info_attr(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	_irqL irqL;
+	_list	*phead, *plist;
+	u32 len=0;
+	u16 attr_len = 0;
+	u8 tmplen, *pdata_attr, *pstart, *pcur;
+	struct sta_info *psta = NULL;
+	_adapter *padapter = pwdinfo->padapter;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	pdata_attr = rtw_zmalloc(MAX_P2P_IE_LEN);
+
+	pstart = pdata_attr;
+	pcur = pdata_attr;
+
+	_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+	phead = &pstapriv->asoc_list;
+	plist = get_next(phead);
+
+	//look up sta asoc_queue
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+	{
+		psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
+
+		plist = get_next(plist);
+
+
+		if(psta->is_p2p_device)
+		{
+			tmplen = 0;
+
+			pcur++;
+
+			//P2P device address
+			_rtw_memcpy(pcur, psta->dev_addr, ETH_ALEN);
+			pcur += ETH_ALEN;
+
+			//P2P interface address
+			_rtw_memcpy(pcur, psta->hwaddr, ETH_ALEN);
+			pcur += ETH_ALEN;
+
+			*pcur = psta->dev_cap;
+			pcur++;
+
+			//*(u16*)(pcur) = cpu_to_be16(psta->config_methods);
+			RTW_PUT_BE16(pcur, psta->config_methods);
+			pcur += 2;
+
+			_rtw_memcpy(pcur, psta->primary_dev_type, 8);
+			pcur += 8;
+
+			*pcur = psta->num_of_secdev_type;
+			pcur++;
+
+			_rtw_memcpy(pcur, psta->secdev_types_list, psta->num_of_secdev_type*8);
+			pcur += psta->num_of_secdev_type*8;
+
+			if(psta->dev_name_len>0)
+			{
+				//*(u16*)(pcur) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+				RTW_PUT_BE16(pcur, WPS_ATTR_DEVICE_NAME);
+				pcur += 2;
+
+				//*(u16*)(pcur) = cpu_to_be16( psta->dev_name_len );
+				RTW_PUT_BE16(pcur, psta->dev_name_len);
+				pcur += 2;
+
+				_rtw_memcpy(pcur, psta->dev_name, psta->dev_name_len);
+				pcur += psta->dev_name_len;
+			}
+
+
+			tmplen = (u8)(pcur-pstart);
+
+			*pstart = (tmplen-1);
+
+			attr_len += tmplen;
+
+			//pstart += tmplen;
+			pstart = pcur;
+
+		}
+
+
+	}
+	_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	if(attr_len>0)
+	{
+		len = rtw_set_p2p_attr_content(pbuf, P2P_ATTR_GROUP_INFO, attr_len, pdata_attr);
+	}
+
+	rtw_mfree(pdata_attr, MAX_P2P_IE_LEN);
+
+	return len;
+
+}
+
+static void issue_group_disc_req(struct wifidirect_info *pwdinfo, u8 *da)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	_adapter *padapter = pwdinfo->padapter;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	unsigned char category = RTW_WLAN_CATEGORY_P2P;//P2P action frame
+	u32	p2poui = cpu_to_be32(P2POUI);
+	u8	oui_subtype = P2P_GO_DISC_REQUEST;
+	u8	dialogToken=0;
+
+	DBG_871X("[%s]\n", __FUNCTION__);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, pwdinfo->interface_addr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, pwdinfo->interface_addr, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	//Build P2P action frame header
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialogToken), &(pattrib->pktlen));
+
+	//there is no IE in this P2P action frame
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+}
+
+static void issue_p2p_devdisc_resp(struct wifidirect_info *pwdinfo, u8 *da, u8 status, u8 dialogToken)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	_adapter *padapter = pwdinfo->padapter;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	unsigned char category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8			action = P2P_PUB_ACTION_ACTION;
+	u32			p2poui = cpu_to_be32(P2POUI);
+	u8			oui_subtype = P2P_DEVDISC_RESP;
+	u8 p2pie[8] = { 0x00 };
+	u32 p2pielen = 0;
+
+	DBG_871X("[%s]\n", __FUNCTION__);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, pwdinfo->device_addr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, pwdinfo->device_addr, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	//Build P2P public action frame header
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialogToken), &(pattrib->pktlen));
+
+
+	//Build P2P IE
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	// P2P_ATTR_STATUS
+	p2pielen += rtw_set_p2p_attr_content(&p2pie[p2pielen], P2P_ATTR_STATUS, 1, &status);
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, p2pie, &pattrib->pktlen);
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+}
+
+static void issue_p2p_provision_resp(struct wifidirect_info *pwdinfo, u8* raddr, u8* frame_body, u16 config_method)
+{
+	_adapter *padapter = pwdinfo->padapter;
+	unsigned char category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8			action = P2P_PUB_ACTION_ACTION;
+	u8			dialogToken = frame_body[7];	//	The Dialog Token of provisioning discovery request frame.
+	u32			p2poui = cpu_to_be32(P2POUI);
+	u8			oui_subtype = P2P_PROVISION_DISC_RESP;
+	u8			wpsie[ 100 ] = { 0x00 };
+	u8			wpsielen = 0;
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialogToken), &(pattrib->pktlen));
+
+	wpsielen = 0;
+	//	WPS OUI
+	//*(u32*) ( wpsie ) = cpu_to_be32( WPSOUI );
+	RTW_PUT_BE32(wpsie, WPSOUI);
+	wpsielen += 4;
+
+#if 0
+	//	WPS version
+	//	Type:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_VER1 );
+	wpsielen += 2;
+
+	//	Length:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+	wpsielen += 2;
+
+	//	Value:
+	wpsie[wpsielen++] = WPS_VERSION_1;	//	Version 1.0
+#endif
+
+	//	Config Method
+	//	Type:
+	//*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_CONF_METHOD );
+	RTW_PUT_BE16(wpsie + wpsielen, WPS_ATTR_CONF_METHOD);
+	wpsielen += 2;
+
+	//	Length:
+	//*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0002 );
+	RTW_PUT_BE16(wpsie + wpsielen, 0x0002);
+	wpsielen += 2;
+
+	//	Value:
+	//*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( config_method );
+	RTW_PUT_BE16(wpsie + wpsielen, config_method);
+	wpsielen += 2;
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, wpsielen, (unsigned char *) wpsie, &pattrib->pktlen );
+
+#ifdef CONFIG_WFD
+	wfdielen = build_provdisc_resp_wfd_ie(pwdinfo, pframe);
+	pframe += wfdielen;
+	pattrib->pktlen += wfdielen;
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+
+}
+
+static void issue_p2p_presence_resp(struct wifidirect_info *pwdinfo, u8 *da, u8 status, u8 dialogToken)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	_adapter *padapter = pwdinfo->padapter;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	unsigned char category = RTW_WLAN_CATEGORY_P2P;//P2P action frame
+	u32	p2poui = cpu_to_be32(P2POUI);
+	u8	oui_subtype = P2P_PRESENCE_RESPONSE;
+	u8 p2pie[ MAX_P2P_IE_LEN] = { 0x00 };
+	u8 noa_attr_content[32] = { 0x00 };
+	u32 p2pielen = 0;
+
+	DBG_871X("[%s]\n", __FUNCTION__);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, pwdinfo->interface_addr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, pwdinfo->interface_addr, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	//Build P2P action frame header
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialogToken), &(pattrib->pktlen));
+
+
+	//Add P2P IE header
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	//Add Status attribute in P2P IE
+	p2pielen += rtw_set_p2p_attr_content(&p2pie[p2pielen], P2P_ATTR_STATUS, 1, &status);
+
+	//Add NoA attribute in P2P IE
+	noa_attr_content[0] = 0x1;//index
+	noa_attr_content[1] = 0x0;//CTWindow and OppPS Parameters
+
+	//todo: Notice of Absence Descriptor(s)
+
+	p2pielen += rtw_set_p2p_attr_content(&p2pie[p2pielen], P2P_ATTR_NOA, 2, noa_attr_content);
+
+
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, p2pie, &(pattrib->pktlen));
+
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+}
+
+u32 build_beacon_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 p2pie[ MAX_P2P_IE_LEN] = { 0x00 };
+	u16 capability=0;
+	u32 len=0, p2pielen = 0;
+
+
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+
+	//	According to the P2P Specification, the beacon frame should contain 3 P2P attributes
+	//	1. P2P Capability
+	//	2. P2P Device ID
+	//	3. Notice of Absence ( NOA )
+
+	//	P2P Capability ATTR
+	//	Type:
+	//	Length:
+	//	Value:
+	//	Device Capability Bitmap, 1 byte
+	//	Be able to participate in additional P2P Groups and
+	//	support the P2P Invitation Procedure
+	//	Group Capability Bitmap, 1 byte
+	capability = P2P_DEVCAP_INVITATION_PROC|P2P_DEVCAP_CLIENT_DISCOVERABILITY;
+	capability |=  ((P2P_GRPCAP_GO | P2P_GRPCAP_INTRABSS) << 8);
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_PROVISIONING_ING))
+		capability |= (P2P_GRPCAP_GROUP_FORMATION<<8);
+
+	capability = cpu_to_le16(capability);
+
+	p2pielen += rtw_set_p2p_attr_content(&p2pie[p2pielen], P2P_ATTR_CAPABILITY, 2, (u8*)&capability);
+
+
+	// P2P Device ID ATTR
+	p2pielen += rtw_set_p2p_attr_content(&p2pie[p2pielen], P2P_ATTR_DEVICE_ID, ETH_ALEN, pwdinfo->device_addr);
+
+
+	// Notice of Absence ATTR
+	//	Type:
+	//	Length:
+	//	Value:
+
+	//go_add_noa_attr(pwdinfo);
+
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &len);
+
+
+	return len;
+
+}
+
+#ifdef CONFIG_WFD
+u32 build_beacon_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110812
+	//	According to the WFD Specification, the beacon frame should contain 4 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID
+	//	3. Coupled Sink Information
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+
+	if ( P2P_ROLE_GO == pwdinfo->role )
+	{
+		if ( is_any_client_associated( pwdinfo->padapter ) )
+		{
+			//	WFD primary sink + WiFi Direct mode + WSD (WFD Service Discovery)
+			RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_WSD );
+		}
+		else
+		{
+			//	WFD primary sink + available for WFD session + WiFi Direct mode + WSD (WFD Service Discovery)
+			RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD );
+		}
+
+	}
+	else
+	{
+		//	WFD primary sink + available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+		RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD );
+	}
+
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+
+}
+
+u32 build_probe_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110812
+	//	According to the WFD Specification, the probe request frame should contain 4 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID
+	//	3. Coupled Sink Information
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+
+	if ( 1 == pwdinfo->wfd_tdls_enable )
+	{
+		//	WFD primary sink + available for WFD session + WiFi TDLS mode + WSC ( WFD Service Discovery )
+		RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type |
+						WFD_DEVINFO_SESSION_AVAIL |
+						WFD_DEVINFO_WSD |
+						WFD_DEVINFO_PC_TDLS );
+	}
+	else
+	{
+		//	WFD primary sink + available for WFD session + WiFi Direct mode + WSC ( WFD Service Discovery )
+		RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type |
+						WFD_DEVINFO_SESSION_AVAIL |
+						WFD_DEVINFO_WSD );
+	}
+
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+
+}
+
+u32 build_probe_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf, u8 tunneled)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110812
+	//	According to the WFD Specification, the probe response frame should contain 4 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID
+	//	3. Coupled Sink Information
+	//	4. WFD Session Information
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + available for WFD session + WiFi Direct mode
+
+	if (  _TRUE == pwdinfo->session_available )
+	{
+		if ( P2P_ROLE_GO == pwdinfo->role )
+		{
+			if ( is_any_client_associated( pwdinfo->padapter ) )
+			{
+				if ( pwdinfo->wfd_tdls_enable )
+				{
+					//	TDLS mode + WSD ( WFD Service Discovery )
+					RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_WSD | WFD_DEVINFO_PC_TDLS | WFD_DEVINFO_HDCP_SUPPORT);
+				}
+				else
+				{
+					//	WiFi Direct mode + WSD ( WFD Service Discovery )
+					RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_WSD | WFD_DEVINFO_HDCP_SUPPORT);
+				}
+			}
+			else
+			{
+				if ( pwdinfo->wfd_tdls_enable )
+				{
+					//	available for WFD session + TDLS mode + WSD ( WFD Service Discovery )
+					RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD | WFD_DEVINFO_PC_TDLS | WFD_DEVINFO_HDCP_SUPPORT);
+				}
+				else
+				{
+					//	available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+					RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD | WFD_DEVINFO_HDCP_SUPPORT);
+				}
+			}
+		}
+		else
+		{
+			if ( pwdinfo->wfd_tdls_enable )
+			{
+				//	available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+				RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD | WFD_DEVINFO_PC_TDLS | WFD_DEVINFO_HDCP_SUPPORT);
+			}
+			else
+			{
+
+				//	available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+				RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD | WFD_DEVINFO_HDCP_SUPPORT);
+			}
+		}
+	}
+	else
+	{
+		if ( pwdinfo->wfd_tdls_enable )
+		{
+			RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_WSD |WFD_DEVINFO_PC_TDLS | WFD_DEVINFO_HDCP_SUPPORT);
+		}
+		else
+		{
+			RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_WSD | WFD_DEVINFO_HDCP_SUPPORT);
+		}
+
+	}
+
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+	if ( P2P_ROLE_GO == pwdinfo->role )
+	{
+		//	WFD Session Information ATTR
+		//	Type:
+		wfdie[ wfdielen++ ] = WFD_ATTR_SESSION_INFO;
+
+		//	Length:
+		//	Note: In the WFD specification, the size of length field is 2.
+		RTW_PUT_BE16(wfdie + wfdielen, 0x0000);
+		wfdielen += 2;
+
+		//	Todo: to add the list of WFD device info descriptor in WFD group.
+
+	}
+#ifdef CONFIG_CONCURRENT_MODE
+#ifdef CONFIG_TDLS
+	if ( ( tunneled == 0 ) && ( padapter->pbuddy_adapter->wdinfo.wfd_tdls_enable == 1 ) )
+	{
+		//	Alternative MAC Address ATTR
+		//	Type:
+		wfdie[ wfdielen++ ] = WFD_ATTR_ALTER_MAC;
+
+		//	Length:
+		//	Note: In the WFD specification, the size of length field is 2.
+		RTW_PUT_BE16(wfdie + wfdielen,  ETH_ALEN );
+		wfdielen += 2;
+
+		//	Value:
+		//	Alternative MAC Address
+		_rtw_memcpy( wfdie + wfdielen, &padapter->pbuddy_adapter->eeprompriv.mac_addr[ 0 ], ETH_ALEN );
+		//	This mac address is used to make the WFD session when TDLS is enable.
+
+		wfdielen += ETH_ALEN;
+	}
+#endif // CONFIG_TDLS
+#endif // CONFIG_CONCURRENT_MODE
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+
+}
+
+u32 build_assoc_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter 					*padapter = NULL;
+	struct mlme_priv			*pmlmepriv = NULL;
+	struct wifi_display_info		*pwfd_info = NULL;
+
+	//	WFD OUI
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE) || rtw_p2p_chk_state(pwdinfo, P2P_STATE_IDLE))
+	{
+		return 0;
+	}
+
+	padapter = pwdinfo->padapter;
+	pmlmepriv = &padapter->mlmepriv;
+	pwfd_info = padapter->wdinfo.wfd_info;
+
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110812
+	//	According to the WFD Specification, the probe request frame should contain 4 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID
+	//	3. Coupled Sink Information
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD );
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+
+}
+
+u32 build_assoc_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110812
+	//	According to the WFD Specification, the probe request frame should contain 4 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID
+	//	3. Coupled Sink Information
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD );
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+
+}
+
+u32 build_nego_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110825
+	//	According to the WFD Specification, the negotiation request frame should contain 3 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID ( Optional )
+	//	3. Local IP Adress ( Optional )
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + WiFi Direct mode + WSD ( WFD Service Discovery ) + WFD Session Available
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_WSD | WFD_DEVINFO_SESSION_AVAIL);
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+
+}
+
+u32 build_nego_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110825
+	//	According to the WFD Specification, the negotiation request frame should contain 3 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID ( Optional )
+	//	3. Local IP Adress ( Optional )
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + WiFi Direct mode + WSD ( WFD Service Discovery ) + WFD Session Available
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_WSD | WFD_DEVINFO_SESSION_AVAIL);
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+
+}
+
+u32 build_nego_confirm_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110825
+	//	According to the WFD Specification, the negotiation request frame should contain 3 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID ( Optional )
+	//	3. Local IP Adress ( Optional )
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + WiFi Direct mode + WSD ( WFD Service Discovery ) + WFD Session Available
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_WSD | WFD_DEVINFO_SESSION_AVAIL);
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+
+}
+
+u32 build_invitation_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110825
+	//	According to the WFD Specification, the provision discovery request frame should contain 3 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID ( Optional )
+	//	3. Local IP Adress ( Optional )
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD );
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+	if ( P2P_ROLE_GO == pwdinfo->role )
+	{
+		//	WFD Session Information ATTR
+		//	Type:
+		wfdie[ wfdielen++ ] = WFD_ATTR_SESSION_INFO;
+
+		//	Length:
+		//	Note: In the WFD specification, the size of length field is 2.
+		RTW_PUT_BE16(wfdie + wfdielen, 0x0000);
+		wfdielen += 2;
+
+		//	Todo: to add the list of WFD device info descriptor in WFD group.
+
+	}
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+
+}
+
+u32 build_invitation_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110825
+	//	According to the WFD Specification, the provision discovery request frame should contain 3 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID ( Optional )
+	//	3. Local IP Adress ( Optional )
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD );
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+	if ( P2P_ROLE_GO == pwdinfo->role )
+	{
+		//	WFD Session Information ATTR
+		//	Type:
+		wfdie[ wfdielen++ ] = WFD_ATTR_SESSION_INFO;
+
+		//	Length:
+		//	Note: In the WFD specification, the size of length field is 2.
+		RTW_PUT_BE16(wfdie + wfdielen, 0x0000);
+		wfdielen += 2;
+
+		//	Todo: to add the list of WFD device info descriptor in WFD group.
+
+	}
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+
+}
+
+u32 build_provdisc_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110825
+	//	According to the WFD Specification, the provision discovery request frame should contain 3 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID ( Optional )
+	//	3. Local IP Adress ( Optional )
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD );
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+
+}
+
+u32 build_provdisc_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 len=0, wfdielen = 0;
+	_adapter *padapter = pwdinfo->padapter;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info*	pwfd_info = padapter->wdinfo.wfd_info;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110825
+	//	According to the WFD Specification, the provision discovery response frame should contain 3 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID ( Optional )
+	//	3. Local IP Adress ( Optional )
+
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	WFD primary sink + available for WFD session + WiFi Direct mode + WSD ( WFD Service Discovery )
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL | WFD_DEVINFO_WSD );
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	wfdielen += ETH_ALEN;
+
+	//	Coupled Sink Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_COUPLED_SINK_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0007);
+	wfdielen += 2;
+
+	//	Value:
+	//	Coupled Sink Status bitmap
+	//	Not coupled/available for Coupling
+	wfdie[ wfdielen++ ] = 0;
+	//  MAC Addr.
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+	wfdie[ wfdielen++ ] = 0;
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, &len);
+
+	return len;
+
+}
+
+#endif //CONFIG_WFD
+
+u32 build_probe_resp_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u8 p2pie[ MAX_P2P_IE_LEN] = { 0x00 };
+	u32 len=0, p2pielen = 0;
+#ifdef CONFIG_INTEL_WIDI
+	struct mlme_priv *pmlmepriv = &(pwdinfo->padapter->mlmepriv);
+	u8 zero_array_check[L2SDTA_SERVICE_VE_LEN] = { 0x00 };
+	u8 widi_version = 0, i = 0;
+
+	if( _rtw_memcmp( pmlmepriv->sa_ext, zero_array_check, L2SDTA_SERVICE_VE_LEN ) == _FALSE )
+	{
+		widi_version = 35;
+	}
+	else if( pmlmepriv->num_p2p_sdt != 0 )
+	{
+		widi_version = 40;
+	}
+#endif //CONFIG_INTEL_WIDI
+
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	//	Commented by Albert 20100907
+	//	According to the P2P Specification, the probe response frame should contain 5 P2P attributes
+	//	1. P2P Capability
+	//	2. Extended Listen Timing
+	//	3. Notice of Absence ( NOA )	( Only GO needs this )
+	//	4. Device Info
+	//	5. Group Info	( Only GO need this )
+
+	//	P2P Capability ATTR
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CAPABILITY;
+
+	//	Length:
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	RTW_PUT_LE16(p2pie + p2pielen, 0x0002);
+	p2pielen += 2;
+
+	//	Value:
+	//	Device Capability Bitmap, 1 byte
+	p2pie[ p2pielen++ ] = DMP_P2P_DEVCAP_SUPPORT;
+
+	//	Group Capability Bitmap, 1 byte
+	if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+	{
+		p2pie[ p2pielen ] = (P2P_GRPCAP_GO | P2P_GRPCAP_INTRABSS);
+
+		if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_PROVISIONING_ING))
+			p2pie[ p2pielen ] |= P2P_GRPCAP_GROUP_FORMATION;
+
+		p2pielen++;
+	}
+	else if ( rtw_p2p_chk_role(pwdinfo, P2P_ROLE_DEVICE) )
+	{
+		//	Group Capability Bitmap, 1 byte
+		if ( pwdinfo->persistent_supported )
+			p2pie[ p2pielen++ ] = P2P_GRPCAP_PERSISTENT_GROUP | DMP_P2P_GRPCAP_SUPPORT;
+		else
+			p2pie[ p2pielen++ ] = DMP_P2P_GRPCAP_SUPPORT;
+
+	}
+
+	//	Extended Listen Timing ATTR
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_EX_LISTEN_TIMING;
+
+	//	Length:
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0004 );
+	RTW_PUT_LE16(p2pie + p2pielen, 0x0004);
+	p2pielen += 2;
+
+	//	Value:
+	//	Availability Period
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0xFFFF );
+	RTW_PUT_LE16(p2pie + p2pielen, 0xFFFF);
+	p2pielen += 2;
+
+	//	Availability Interval
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0xFFFF );
+	RTW_PUT_LE16(p2pie + p2pielen, 0xFFFF);
+	p2pielen += 2;
+
+
+	// Notice of Absence ATTR
+	//	Type:
+	//	Length:
+	//	Value:
+	if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+	{
+		//go_add_noa_attr(pwdinfo);
+	}
+
+	//	Device Info ATTR
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	21 -> P2P Device Address (6bytes) + Config Methods (2bytes) + Primary Device Type (8bytes)
+	//	+ NumofSecondDevType (1byte) + WPS Device Name ID field (2bytes) + WPS Device Name Len field (2bytes)
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 21 + pwdinfo->device_name_len );
+#ifdef CONFIG_INTEL_WIDI
+	if( widi_version == 35 )
+	{
+		RTW_PUT_LE16(p2pie + p2pielen, 21 + 8 + pwdinfo->device_name_len);
+	}
+	else if( widi_version == 40 )
+	{
+		RTW_PUT_LE16(p2pie + p2pielen, 21 + 8 * pmlmepriv->num_p2p_sdt + pwdinfo->device_name_len);
+	}
+	else
+#endif //CONFIG_INTEL_WIDI
+	RTW_PUT_LE16(p2pie + p2pielen, 21 + pwdinfo->device_name_len);
+	p2pielen += 2;
+
+	//	Value:
+	//	P2P Device Address
+	_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_addr, ETH_ALEN );
+	p2pielen += ETH_ALEN;
+
+	//	Config Method
+	//	This field should be big endian. Noted by P2P specification.
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( pwdinfo->supported_wps_cm );
+	RTW_PUT_BE16(p2pie + p2pielen, pwdinfo->supported_wps_cm);
+	p2pielen += 2;
+
+#ifdef CONFIG_INTEL_WIDI
+	if( widi_version == 40 )
+	{
+		//	Primary Device Type
+		//	Category ID
+		//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_CID_MULIT_MEDIA );
+		RTW_PUT_BE16(p2pie + p2pielen, pmlmepriv->p2p_pdt_cid );
+		p2pielen += 2;
+
+		//	OUI
+		//*(u32*) ( p2pie + p2pielen ) = cpu_to_be32( WPSOUI );
+		RTW_PUT_BE32(p2pie + p2pielen, WPSOUI);
+		p2pielen += 4;
+
+		//	Sub Category ID
+		//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_SCID_MEDIA_SERVER );
+		RTW_PUT_BE16(p2pie + p2pielen, pmlmepriv->p2p_pdt_scid);
+		p2pielen += 2;
+	}
+	else
+#endif //CONFIG_INTEL_WIDI
+	{
+		//	Primary Device Type
+		//	Category ID
+		//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_CID_MULIT_MEDIA );
+		RTW_PUT_BE16(p2pie + p2pielen, WPS_PDT_CID_MULIT_MEDIA);
+		p2pielen += 2;
+
+		//	OUI
+		//*(u32*) ( p2pie + p2pielen ) = cpu_to_be32( WPSOUI );
+		RTW_PUT_BE32(p2pie + p2pielen, WPSOUI);
+		p2pielen += 4;
+
+		//	Sub Category ID
+		//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_SCID_MEDIA_SERVER );
+		RTW_PUT_BE16(p2pie + p2pielen, WPS_PDT_SCID_MEDIA_SERVER);
+		p2pielen += 2;
+	}
+
+	//	Number of Secondary Device Types
+#ifdef CONFIG_INTEL_WIDI
+	if( widi_version == 35 )
+	{
+		p2pie[ p2pielen++ ] = 0x01;
+
+		RTW_PUT_BE16(p2pie + p2pielen, WPS_PDT_CID_DISPLAYS);
+		p2pielen += 2;
+
+		RTW_PUT_BE32(p2pie + p2pielen, INTEL_DEV_TYPE_OUI);
+		p2pielen += 4;
+
+		RTW_PUT_BE16(p2pie + p2pielen, P2P_SCID_WIDI_CONSUMER_SINK);
+		p2pielen += 2;
+	}
+	else if( widi_version == 40 )
+	{
+		p2pie[ p2pielen++ ] = pmlmepriv->num_p2p_sdt;
+		for( ; i < pmlmepriv->num_p2p_sdt; i++ )
+		{
+			RTW_PUT_BE16(p2pie + p2pielen, pmlmepriv->p2p_sdt_cid[i]);
+			p2pielen += 2;
+
+			RTW_PUT_BE32(p2pie + p2pielen, INTEL_DEV_TYPE_OUI);
+			p2pielen += 4;
+
+			RTW_PUT_BE16(p2pie + p2pielen, pmlmepriv->p2p_sdt_scid[i]);
+			p2pielen += 2;
+		}
+	}
+	else
+#endif //CONFIG_INTEL_WIDI
+	p2pie[ p2pielen++ ] = 0x00;	//	No Secondary Device Type List
+
+	//	Device Name
+	//	Type:
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+	RTW_PUT_BE16(p2pie + p2pielen, WPS_ATTR_DEVICE_NAME);
+	p2pielen += 2;
+
+	//	Length:
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( pwdinfo->device_name_len );
+	RTW_PUT_BE16(p2pie + p2pielen, pwdinfo->device_name_len);
+	p2pielen += 2;
+
+	//	Value:
+	_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_name, pwdinfo->device_name_len );
+	p2pielen += pwdinfo->device_name_len;
+
+	// Group Info ATTR
+	//	Type:
+	//	Length:
+	//	Value:
+	if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+	{
+		p2pielen += go_add_group_info_attr(pwdinfo, p2pie + p2pielen);
+	}
+
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &len);
+
+
+	return len;
+
+}
+
+u32 build_prov_disc_request_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf, u8* pssid, u8 ussidlen, u8* pdev_raddr )
+{
+	u8 p2pie[ MAX_P2P_IE_LEN] = { 0x00 };
+	u32 len=0, p2pielen = 0;
+
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	//	Commented by Albert 20110301
+	//	According to the P2P Specification, the provision discovery request frame should contain 3 P2P attributes
+	//	1. P2P Capability
+	//	2. Device Info
+	//	3. Group ID ( When joining an operating P2P Group )
+
+	//	P2P Capability ATTR
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_CAPABILITY;
+
+	//	Length:
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	RTW_PUT_LE16(p2pie + p2pielen, 0x0002);
+	p2pielen += 2;
+
+	//	Value:
+	//	Device Capability Bitmap, 1 byte
+	p2pie[ p2pielen++ ] = DMP_P2P_DEVCAP_SUPPORT;
+
+	//	Group Capability Bitmap, 1 byte
+	if ( pwdinfo->persistent_supported )
+		p2pie[ p2pielen++ ] = P2P_GRPCAP_PERSISTENT_GROUP | DMP_P2P_GRPCAP_SUPPORT;
+	else
+		p2pie[ p2pielen++ ] = DMP_P2P_GRPCAP_SUPPORT;
+
+
+	//	Device Info ATTR
+	//	Type:
+	p2pie[ p2pielen++ ] = P2P_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	21 -> P2P Device Address (6bytes) + Config Methods (2bytes) + Primary Device Type (8bytes)
+	//	+ NumofSecondDevType (1byte) + WPS Device Name ID field (2bytes) + WPS Device Name Len field (2bytes)
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 21 + pwdinfo->device_name_len );
+	RTW_PUT_LE16(p2pie + p2pielen, 21 + pwdinfo->device_name_len);
+	p2pielen += 2;
+
+	//	Value:
+	//	P2P Device Address
+	_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_addr, ETH_ALEN );
+	p2pielen += ETH_ALEN;
+
+	//	Config Method
+	//	This field should be big endian. Noted by P2P specification.
+	if ( pwdinfo->ui_got_wps_info == P2P_GOT_WPSINFO_PBC )
+	{
+		//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_CONFIG_METHOD_PBC );
+		RTW_PUT_BE16(p2pie + p2pielen, WPS_CONFIG_METHOD_PBC);
+	}
+	else
+	{
+		//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_CONFIG_METHOD_DISPLAY );
+		RTW_PUT_BE16(p2pie + p2pielen, WPS_CONFIG_METHOD_DISPLAY);
+	}
+
+	p2pielen += 2;
+
+	//	Primary Device Type
+	//	Category ID
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_CID_MULIT_MEDIA );
+	RTW_PUT_BE16(p2pie + p2pielen, WPS_PDT_CID_MULIT_MEDIA);
+	p2pielen += 2;
+
+	//	OUI
+	//*(u32*) ( p2pie + p2pielen ) = cpu_to_be32( WPSOUI );
+	RTW_PUT_BE32(p2pie + p2pielen, WPSOUI);
+	p2pielen += 4;
+
+	//	Sub Category ID
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_PDT_SCID_MEDIA_SERVER );
+	RTW_PUT_BE16(p2pie + p2pielen, WPS_PDT_SCID_MEDIA_SERVER);
+	p2pielen += 2;
+
+	//	Number of Secondary Device Types
+	p2pie[ p2pielen++ ] = 0x00;	//	No Secondary Device Type List
+
+	//	Device Name
+	//	Type:
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( WPS_ATTR_DEVICE_NAME );
+	RTW_PUT_BE16(p2pie + p2pielen, WPS_ATTR_DEVICE_NAME);
+	p2pielen += 2;
+
+	//	Length:
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_be16( pwdinfo->device_name_len );
+	RTW_PUT_BE16(p2pie + p2pielen, pwdinfo->device_name_len);
+	p2pielen += 2;
+
+	//	Value:
+	_rtw_memcpy( p2pie + p2pielen, pwdinfo->device_name, pwdinfo->device_name_len );
+	p2pielen += pwdinfo->device_name_len;
+
+	if ( rtw_p2p_chk_role(pwdinfo, P2P_ROLE_CLIENT) )
+	{
+		//	Added by Albert 2011/05/19
+		//	In this case, the pdev_raddr is the device address of the group owner.
+
+		//	P2P Group ID ATTR
+		//	Type:
+		p2pie[ p2pielen++ ] = P2P_ATTR_GROUP_ID;
+
+		//	Length:
+		//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( ETH_ALEN + ussidlen );
+		RTW_PUT_LE16(p2pie + p2pielen, ETH_ALEN + ussidlen);
+		p2pielen += 2;
+
+		//	Value:
+		_rtw_memcpy( p2pie + p2pielen, pdev_raddr, ETH_ALEN );
+		p2pielen += ETH_ALEN;
+
+		_rtw_memcpy( p2pie + p2pielen, pssid, ussidlen );
+		p2pielen += ussidlen;
+
+	}
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &len);
+
+
+	return len;
+
+}
+
+
+u32 build_assoc_resp_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf, u8 status_code)
+{
+	u8 p2pie[ MAX_P2P_IE_LEN] = { 0x00 };
+	u32 len=0, p2pielen = 0;
+
+	//	P2P OUI
+	p2pielen = 0;
+	p2pie[ p2pielen++ ] = 0x50;
+	p2pie[ p2pielen++ ] = 0x6F;
+	p2pie[ p2pielen++ ] = 0x9A;
+	p2pie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	// According to the P2P Specification, the Association response frame should contain 2 P2P attributes
+	//	1. Status
+	//	2. Extended Listen Timing (optional)
+
+
+	//	Status ATTR
+	p2pielen += rtw_set_p2p_attr_content(&p2pie[p2pielen], P2P_ATTR_STATUS, 1, &status_code);
+
+
+	// Extended Listen Timing ATTR
+	//	Type:
+	//	Length:
+	//	Value:
+
+
+	pbuf = rtw_set_ie(pbuf, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2pie, &len);
+
+	return len;
+
+}
+
+u32 build_deauth_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf)
+{
+	u32 len=0;
+
+	return len;
+}
+
+u32 process_probe_req_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pframe, uint len)
+{
+	u8 *p;
+	u32 ret=_FALSE;
+	u8 *p2pie;
+	u32	p2pielen = 0;
+	int ssid_len=0, rate_cnt = 0;
+
+	p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, _SUPPORTEDRATES_IE_, (int *)&rate_cnt,
+			len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);
+
+	if ( rate_cnt <= 4 )
+	{
+		int i, g_rate =0;
+
+		for( i = 0; i < rate_cnt; i++ )
+		{
+			if ( ( ( *( p + 2 + i ) & 0xff ) != 0x02 ) &&
+				( ( *( p + 2 + i ) & 0xff ) != 0x04 ) &&
+				( ( *( p + 2 + i ) & 0xff ) != 0x0B ) &&
+				( ( *( p + 2 + i ) & 0xff ) != 0x16 ) )
+			{
+				g_rate = 1;
+			}
+		}
+
+		if ( g_rate == 0 )
+		{
+			//	There is no OFDM rate included in SupportedRates IE of this probe request frame
+			//	The driver should response this probe request.
+			return ret;
+		}
+	}
+	else
+	{
+		//	rate_cnt > 4 means the SupportRates IE contains the OFDM rate because the count of CCK rates are 4.
+		//	We should proceed the following check for this probe request.
+	}
+
+	//	Added comments by Albert 20100906
+	//	There are several items we should check here.
+	//	1. This probe request frame must contain the P2P IE. (Done)
+	//	2. This probe request frame must contain the wildcard SSID. (Done)
+	//	3. Wildcard BSSID. (Todo)
+	//	4. Destination Address. ( Done in mgt_dispatcher function )
+	//	5. Requested Device Type in WSC IE. (Todo)
+	//	6. Device ID attribute in P2P IE. (Todo)
+
+	p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, _SSID_IE_, (int *)&ssid_len,
+			len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);
+
+	ssid_len &= 0xff;	//	Just last 1 byte is valid for ssid len of the probe request
+	if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_DEVICE) || rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+	{
+		if((p2pie=rtw_get_p2p_ie( pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_ , len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_ , NULL, &p2pielen)))
+		{
+			if ( (p != NULL) && _rtw_memcmp( ( void * ) ( p+2 ), ( void * ) pwdinfo->p2p_wildcard_ssid , 7 ))
+			{
+				//todo:
+				//Check Requested Device Type attributes in WSC IE.
+				//Check Device ID attribute in P2P IE
+
+				ret = _TRUE;
+			}
+			else if ( (p != NULL) && ( ssid_len == 0 ) )
+			{
+				ret = _TRUE;
+			}
+		}
+		else
+		{
+			//non -p2p device
+		}
+
+	}
+
+
+	return ret;
+
+}
+
+u32 process_assoc_req_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pframe, uint len, struct sta_info *psta)
+{
+	u8 status_code = P2P_STATUS_SUCCESS;
+	u8 *pbuf, *pattr_content=NULL;
+	u32 attr_contentlen = 0;
+	u16 cap_attr=0;
+	unsigned short	frame_type, ie_offset=0;
+	u8 * ies;
+	u32 ies_len;
+	u8 * p2p_ie;
+	u32	p2p_ielen = 0;
+
+	if(!rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+		return P2P_STATUS_FAIL_REQUEST_UNABLE;
+
+	frame_type = GetFrameSubType(pframe);
+	if (frame_type == WIFI_ASSOCREQ)
+	{
+		ie_offset = _ASOCREQ_IE_OFFSET_;
+	}
+	else // WIFI_REASSOCREQ
+	{
+		ie_offset = _REASOCREQ_IE_OFFSET_;
+	}
+
+	ies = pframe + WLAN_HDR_A3_LEN + ie_offset;
+	ies_len = len - WLAN_HDR_A3_LEN - ie_offset;
+
+	p2p_ie = rtw_get_p2p_ie(ies , ies_len , NULL, &p2p_ielen);
+
+	if ( !p2p_ie )
+	{
+		DBG_8192C( "[%s] P2P IE not Found!!\n", __FUNCTION__ );
+		status_code =  P2P_STATUS_FAIL_INVALID_PARAM;
+	}
+	else
+	{
+		DBG_8192C( "[%s] P2P IE Found!!\n", __FUNCTION__ );
+	}
+
+	while ( p2p_ie )
+	{
+		//Check P2P Capability ATTR
+		if( rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_CAPABILITY, (u8*)&cap_attr, (uint*) &attr_contentlen) )
+		{
+			DBG_8192C( "[%s] Got P2P Capability Attr!!\n", __FUNCTION__ );
+			cap_attr = le16_to_cpu(cap_attr);
+			psta->dev_cap = cap_attr&0xff;
+		}
+
+		//Check Extended Listen Timing ATTR
+
+
+		//Check P2P Device Info ATTR
+		if(rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_DEVICE_INFO, NULL, (uint*)&attr_contentlen))
+		{
+			DBG_8192C( "[%s] Got P2P DEVICE INFO Attr!!\n", __FUNCTION__ );
+			pattr_content = pbuf = rtw_zmalloc(attr_contentlen);
+			if(pattr_content)
+			{
+				u8 num_of_secdev_type;
+				u16 dev_name_len;
+
+
+				rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_DEVICE_INFO , pattr_content, (uint*)&attr_contentlen);
+
+				_rtw_memcpy(psta->dev_addr, 	pattr_content, ETH_ALEN);//P2P Device Address
+
+				pattr_content += ETH_ALEN;
+
+				_rtw_memcpy(&psta->config_methods, pattr_content, 2);//Config Methods
+				psta->config_methods = be16_to_cpu(psta->config_methods);
+
+				pattr_content += 2;
+
+				_rtw_memcpy(psta->primary_dev_type, pattr_content, 8);
+
+				pattr_content += 8;
+
+				num_of_secdev_type = *pattr_content;
+				pattr_content += 1;
+
+				if(num_of_secdev_type==0)
+				{
+					psta->num_of_secdev_type = 0;
+				}
+				else
+				{
+					u32 len;
+
+					psta->num_of_secdev_type = num_of_secdev_type;
+
+					len = (sizeof(psta->secdev_types_list)<(num_of_secdev_type*8)) ? (sizeof(psta->secdev_types_list)) : (num_of_secdev_type*8);
+
+					_rtw_memcpy(psta->secdev_types_list, pattr_content, len);
+
+					pattr_content += (num_of_secdev_type*8);
+				}
+
+
+				//dev_name_len = attr_contentlen - ETH_ALEN - 2 - 8 - 1 - (num_of_secdev_type*8);
+				psta->dev_name_len=0;
+				if(WPS_ATTR_DEVICE_NAME == be16_to_cpu(*(u16*)pattr_content))
+				{
+					dev_name_len = be16_to_cpu(*(u16*)(pattr_content+2));
+
+					psta->dev_name_len = (sizeof(psta->dev_name)<dev_name_len) ? sizeof(psta->dev_name):dev_name_len;
+
+					_rtw_memcpy(psta->dev_name, pattr_content+4, psta->dev_name_len);
+				}
+
+				rtw_mfree(pbuf, attr_contentlen);
+
+			}
+
+		}
+
+		//Get the next P2P IE
+		p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+
+	}
+
+	return status_code;
+
+}
+
+u32 process_p2p_devdisc_req(struct wifidirect_info *pwdinfo, u8 *pframe, uint len)
+{
+	u8 *frame_body;
+	u8 status, dialogToken;
+	struct sta_info *psta = NULL;
+	_adapter *padapter = pwdinfo->padapter;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	u8 *p2p_ie;
+	u32	p2p_ielen = 0;
+
+	frame_body = (unsigned char *)(pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
+
+	dialogToken = frame_body[7];
+	status = P2P_STATUS_FAIL_UNKNOWN_P2PGROUP;
+
+	if ( (p2p_ie=rtw_get_p2p_ie( frame_body + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_, NULL, &p2p_ielen)) )
+	{
+		u8 groupid[ 38 ] = { 0x00 };
+		u8 dev_addr[ETH_ALEN] = { 0x00 };
+		u32	attr_contentlen = 0;
+
+		if(rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_GROUP_ID, groupid, &attr_contentlen))
+		{
+			if(_rtw_memcmp(pwdinfo->device_addr, groupid, ETH_ALEN) &&
+				_rtw_memcmp(pwdinfo->p2p_group_ssid, groupid+ETH_ALEN, pwdinfo->p2p_group_ssid_len))
+			{
+				attr_contentlen=0;
+				if(rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_DEVICE_ID, dev_addr, &attr_contentlen))
+				{
+					_irqL irqL;
+					_list	*phead, *plist;
+
+					_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+					phead = &pstapriv->asoc_list;
+					plist = get_next(phead);
+
+					//look up sta asoc_queue
+					while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+					{
+						psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
+
+						plist = get_next(plist);
+
+						if(psta->is_p2p_device && (psta->dev_cap&P2P_DEVCAP_CLIENT_DISCOVERABILITY) &&
+							_rtw_memcmp(psta->dev_addr, dev_addr, ETH_ALEN))
+						{
+
+							//_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+							//issue GO Discoverability Request
+							issue_group_disc_req(pwdinfo, psta->hwaddr);
+							//_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+							status = P2P_STATUS_SUCCESS;
+
+							break;
+						}
+						else
+						{
+							status = P2P_STATUS_FAIL_INFO_UNAVAILABLE;
+						}
+
+					}
+					_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+				}
+				else
+				{
+					status = P2P_STATUS_FAIL_INVALID_PARAM;
+				}
+
+			}
+			else
+			{
+				status = P2P_STATUS_FAIL_INVALID_PARAM;
+			}
+
+		}
+
+	}
+
+
+	//issue Device Discoverability Response
+	issue_p2p_devdisc_resp(pwdinfo, GetAddr2Ptr(pframe), status, dialogToken);
+
+
+	return (status==P2P_STATUS_SUCCESS) ? _TRUE:_FALSE;
+
+}
+
+u32 process_p2p_devdisc_resp(struct wifidirect_info *pwdinfo, u8 *pframe, uint len)
+{
+	return _TRUE;
+}
+
+u8 process_p2p_provdisc_req(struct wifidirect_info *pwdinfo,  u8 *pframe, uint len )
+{
+	u8 *frame_body;
+	u8 *wpsie;
+	uint	wps_ielen = 0, attr_contentlen = 0;
+	u16	uconfig_method = 0;
+
+
+	frame_body = (pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
+
+	if ( (wpsie=rtw_get_wps_ie( frame_body + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_, NULL, &wps_ielen)) )
+	{
+		if ( rtw_get_wps_attr_content( wpsie, wps_ielen, WPS_ATTR_CONF_METHOD , ( u8* ) &uconfig_method, &attr_contentlen) )
+		{
+			uconfig_method = be16_to_cpu( uconfig_method );
+			switch( uconfig_method )
+			{
+				case WPS_CM_DISPLYA:
+				{
+					_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "dis", 3 );
+					break;
+				}
+				case WPS_CM_LABEL:
+				{
+					_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "lab", 3 );
+					break;
+				}
+				case WPS_CM_PUSH_BUTTON:
+				{
+					_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "pbc", 3 );
+					break;
+				}
+				case WPS_CM_KEYPAD:
+				{
+					_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "pad", 3 );
+					break;
+				}
+			}
+			issue_p2p_provision_resp( pwdinfo, GetAddr2Ptr(pframe), frame_body, uconfig_method);
+		}
+	}
+	DBG_871X( "[%s] config method = %s\n", __FUNCTION__, pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req );
+	return _TRUE;
+
+}
+
+u8 process_p2p_provdisc_resp(struct wifidirect_info *pwdinfo,  u8 *pframe)
+{
+
+	return _TRUE;
+}
+
+u8 rtw_p2p_get_peer_ch_list(struct wifidirect_info *pwdinfo, u8 *ch_content, u8 ch_cnt, u8 *peer_ch_list)
+{
+	u8 i = 0, j = 0;
+	u8 temp = 0;
+	u8 ch_no = 0;
+	ch_content += 3;
+	ch_cnt -= 3;
+
+	while( ch_cnt > 0)
+	{
+		ch_content += 1;
+		ch_cnt -= 1;
+		temp = *ch_content;
+		for( i = 0 ; i < temp ; i++, j++ )
+		{
+			peer_ch_list[j] = *( ch_content + 1 + i );
+		}
+		ch_content += (temp + 1);
+		ch_cnt -= (temp + 1);
+		ch_no += temp ;
+	}
+
+	return ch_no;
+}
+
+u8 rtw_p2p_check_peer_oper_ch(struct mlme_ext_priv *pmlmeext, u8 ch)
+{
+	u8 i = 0;
+
+	for( i = 0; i < pmlmeext->max_chan_nums; i++ )
+	{
+		if ( pmlmeext->channel_set[ i ].ChannelNum == ch )
+		{
+			return _SUCCESS;
+		}
+	}
+
+	return _FAIL;
+}
+
+u8 rtw_p2p_ch_inclusion(struct mlme_ext_priv *pmlmeext, u8 *peer_ch_list, u8 peer_ch_num, u8 *ch_list_inclusioned)
+{
+	int	i = 0, j = 0, temp = 0;
+	u8 ch_no = 0;
+
+	for( i = 0; i < peer_ch_num; i++ )
+	{
+		for( j = temp; j < pmlmeext->max_chan_nums; j++ )
+		{
+			if( *( peer_ch_list + i ) == pmlmeext->channel_set[ j ].ChannelNum )
+			{
+				ch_list_inclusioned[ ch_no++ ] = *( peer_ch_list + i );
+				temp = j;
+				break;
+			}
+		}
+	}
+
+	return ch_no;
+}
+
+u8 process_p2p_group_negotation_req( struct wifidirect_info *pwdinfo, u8 *pframe, uint len )
+{
+	_adapter *padapter = pwdinfo->padapter;
+	u8	result = P2P_STATUS_SUCCESS;
+	u32	p2p_ielen = 0, wps_ielen = 0;
+	u8 * ies;
+	u32 ies_len;
+	u8 *p2p_ie;
+	u8 *wpsie;
+	u16		wps_devicepassword_id = 0x0000;
+	uint	wps_devicepassword_id_len = 0;
+#ifdef CONFIG_WFD
+	u8	wfd_ie[ 128 ] = { 0x00 };
+	u32	wfd_ielen = 0;
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+#endif // CONFIG_TDLS
+#endif // CONFIG_WFD
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter				*pbuddy_adapter = pwdinfo->padapter->pbuddy_adapter;
+	struct wifidirect_info	*pbuddy_wdinfo = &pbuddy_adapter->wdinfo;
+	struct mlme_priv		*pbuddy_mlmepriv = &pbuddy_adapter->mlmepriv;
+	struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+#endif
+
+	if ( (wpsie=rtw_get_wps_ie( pframe + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_, NULL, &wps_ielen)) )
+	{
+		//	Commented by Kurt 20120113
+		//	If some device wants to do p2p handshake without sending prov_disc_req
+		//	We have to get peer_req_cm from here.
+		if(_rtw_memcmp( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "000", 3) )
+		{
+			rtw_get_wps_attr_content( wpsie, wps_ielen, WPS_ATTR_DEVICE_PWID, (u8*) &wps_devicepassword_id, &wps_devicepassword_id_len);
+			wps_devicepassword_id = be16_to_cpu( wps_devicepassword_id );
+
+			if ( wps_devicepassword_id == WPS_DPID_USER_SPEC )
+			{
+				_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "dis", 3 );
+			}
+			else if ( wps_devicepassword_id == WPS_DPID_REGISTRAR_SPEC )
+			{
+				_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "pad", 3 );
+			}
+			else
+			{
+				_rtw_memcpy( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, "pbc", 3 );
+			}
+		}
+	}
+	else
+	{
+		DBG_871X( "[%s] WPS IE not Found!!\n", __FUNCTION__ );
+		result = P2P_STATUS_FAIL_INCOMPATIBLE_PARAM;
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+		return( result );
+	}
+
+	if ( pwdinfo->ui_got_wps_info == P2P_NO_WPSINFO )
+	{
+		result = P2P_STATUS_FAIL_INFO_UNAVAILABLE;
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_TX_INFOR_NOREADY);
+		return( result );
+	}
+
+	ies = pframe + _PUBLIC_ACTION_IE_OFFSET_;
+	ies_len = len - _PUBLIC_ACTION_IE_OFFSET_;
+
+	p2p_ie = rtw_get_p2p_ie( ies, ies_len, NULL, &p2p_ielen );
+
+	if ( !p2p_ie )
+	{
+		DBG_871X( "[%s] P2P IE not Found!!\n", __FUNCTION__ );
+		result = P2P_STATUS_FAIL_INCOMPATIBLE_PARAM;
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+	}
+
+	while ( p2p_ie )
+	{
+		u8	attr_content = 0x00;
+		u32	attr_contentlen = 0;
+		u8	ch_content[100] = { 0x00 };
+		uint	ch_cnt = 0;
+		u8	peer_ch_list[100] = { 0x00 };
+		u8	peer_ch_num = 0;
+		u8	ch_list_inclusioned[100] = { 0x00 };
+		u8	ch_num_inclusioned = 0;
+		u16	cap_attr;
+
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_ING);
+
+		//Check P2P Capability ATTR
+		if(rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CAPABILITY, (u8*)&cap_attr, (uint*)&attr_contentlen) )
+		{
+			cap_attr = le16_to_cpu(cap_attr);
+
+#if defined(CONFIG_WFD) && defined(CONFIG_TDLS)
+			if(!(cap_attr & P2P_GRPCAP_INTRABSS) )
+				ptdlsinfo->ap_prohibited = _TRUE;
+#endif //defined(CONFIG_WFD) && defined(CONFIG_TDLS)
+		}
+
+		if ( rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_GO_INTENT , &attr_content, &attr_contentlen) )
+		{
+			DBG_871X( "[%s] GO Intent = %d, tie = %d\n", __FUNCTION__, attr_content >> 1, attr_content & 0x01 );
+			pwdinfo->peer_intent = attr_content;	//	include both intent and tie breaker values.
+
+			if ( pwdinfo->intent == ( pwdinfo->peer_intent >> 1 ) )
+			{
+				//	Try to match the tie breaker value
+				if ( pwdinfo->intent == P2P_MAX_INTENT )
+				{
+					rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+					result = P2P_STATUS_FAIL_BOTH_GOINTENT_15;
+				}
+				else
+				{
+					if ( attr_content & 0x01 )
+					{
+						rtw_p2p_set_role(pwdinfo, P2P_ROLE_CLIENT);
+					}
+					else
+					{
+						rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO);
+					}
+				}
+			}
+			else if ( pwdinfo->intent > ( pwdinfo->peer_intent >> 1 ) )
+			{
+				rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO);
+			}
+			else
+			{
+				rtw_p2p_set_role(pwdinfo, P2P_ROLE_CLIENT);
+			}
+
+			if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+			{
+				//	Store the group id information.
+				_rtw_memcpy( pwdinfo->groupid_info.go_device_addr, pwdinfo->device_addr, ETH_ALEN );
+				_rtw_memcpy( pwdinfo->groupid_info.ssid, pwdinfo->nego_ssid, pwdinfo->nego_ssidlen );
+			}
+		}
+
+
+		attr_contentlen = 0;
+		if ( rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_INTENTED_IF_ADDR, pwdinfo->p2p_peer_interface_addr, &attr_contentlen ) )
+		{
+			if ( attr_contentlen != ETH_ALEN )
+			{
+				_rtw_memset( pwdinfo->p2p_peer_interface_addr, 0x00, ETH_ALEN );
+			}
+		}
+
+		if ( rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CH_LIST, ch_content, &ch_cnt) )
+		{
+			peer_ch_num = rtw_p2p_get_peer_ch_list(pwdinfo, ch_content, ch_cnt, peer_ch_list);
+			ch_num_inclusioned = rtw_p2p_ch_inclusion(&padapter->mlmeextpriv, peer_ch_list, peer_ch_num, ch_list_inclusioned);
+
+			if( ch_num_inclusioned == 0)
+			{
+				DBG_871X( "[%s] No common channel in channel list!\n", __FUNCTION__ );
+				result = P2P_STATUS_FAIL_NO_COMMON_CH;
+				rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+				break;
+			}
+
+			if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+			{
+				if ( !rtw_p2p_is_channel_list_ok( pwdinfo->operating_channel,
+												ch_list_inclusioned, ch_num_inclusioned) )
+				{
+#ifdef CONFIG_CONCURRENT_MODE
+					if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+					{
+						DBG_871X( "[%s] desired channel NOT Found!\n", __FUNCTION__ );
+						result = P2P_STATUS_FAIL_NO_COMMON_CH;
+						rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+						break;
+					}
+					else
+#endif //CONFIG_CONCURRENT_MODE
+					{
+						u8 operatingch_info[5] = { 0x00 }, peer_operating_ch = 0;
+						attr_contentlen = 0;
+
+						if ( rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, operatingch_info, &attr_contentlen) )
+						{
+							peer_operating_ch = operatingch_info[4];
+						}
+
+						if ( rtw_p2p_is_channel_list_ok( peer_operating_ch,
+														ch_list_inclusioned, ch_num_inclusioned) )
+						{
+							/**
+							 *	Change our operating channel as peer's for compatibility.
+							 */
+							pwdinfo->operating_channel = peer_operating_ch;
+							DBG_871X( "[%s] Change op ch to %02x as peer's\n", __FUNCTION__, pwdinfo->operating_channel);
+						}
+						else
+						{
+							// Take first channel of ch_list_inclusioned as operating channel
+							pwdinfo->operating_channel = ch_list_inclusioned[0];
+							DBG_871X( "[%s] Change op ch to %02x\n", __FUNCTION__, pwdinfo->operating_channel);
+						}
+					}
+
+				}
+			}
+		}
+
+		//Get the next P2P IE
+		p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+	}
+
+#ifdef CONFIG_WFD
+	//	Added by Albert 20110823
+	//	Try to get the TCP port information when receiving the negotiation request.
+	if ( rtw_get_wfd_ie( pframe + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_, wfd_ie, &wfd_ielen ) )
+	{
+		u8	attr_content[ 10 ] = { 0x00 };
+		u32	attr_contentlen = 0;
+
+		DBG_871X( "[%s] WFD IE Found!!\n", __FUNCTION__ );
+		rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_DEVICE_INFO, attr_content, &attr_contentlen);
+		if ( attr_contentlen )
+		{
+			pwdinfo->wfd_info->peer_rtsp_ctrlport = RTW_GET_BE16( attr_content + 2 );
+			DBG_871X( "[%s] Peer PORT NUM = %d\n", __FUNCTION__, pwdinfo->wfd_info->peer_rtsp_ctrlport );
+		}
+	}
+#endif // CONFIG_WFD
+
+	return( result );
+}
+
+u8 process_p2p_group_negotation_resp( struct wifidirect_info *pwdinfo, u8 *pframe, uint len )
+{
+	_adapter *padapter = pwdinfo->padapter;
+	u8	result = P2P_STATUS_SUCCESS;
+	u32	p2p_ielen, wps_ielen;
+	u8 * ies;
+	u32 ies_len;
+	u8 * p2p_ie;
+#ifdef CONFIG_WFD
+	u8	wfd_ie[ 128 ] = { 0x00 };
+	u32	wfd_ielen = 0;
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+#endif // CONFIG_TDLS
+#endif // CONFIG_WFD
+
+	ies = pframe + _PUBLIC_ACTION_IE_OFFSET_;
+	ies_len = len - _PUBLIC_ACTION_IE_OFFSET_;
+
+	//	Be able to know which one is the P2P GO and which one is P2P client.
+
+	if ( rtw_get_wps_ie( ies, ies_len, NULL, &wps_ielen) )
+	{
+
+	}
+	else
+	{
+		DBG_871X( "[%s] WPS IE not Found!!\n", __FUNCTION__ );
+		result = P2P_STATUS_FAIL_INCOMPATIBLE_PARAM;
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+	}
+
+	p2p_ie = rtw_get_p2p_ie( ies, ies_len, NULL, &p2p_ielen );
+	if ( !p2p_ie )
+	{
+		rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+		result = P2P_STATUS_FAIL_INCOMPATIBLE_PARAM;
+	}
+	else
+	{
+
+		u8	attr_content = 0x00;
+		u32	attr_contentlen = 0;
+		u8	operatingch_info[5] = { 0x00 };
+		uint	ch_cnt = 0;
+		u8	ch_content[100] = { 0x00 };
+		u8	groupid[ 38 ];
+		u16	cap_attr;
+		u8	peer_ch_list[100] = { 0x00 };
+		u8	peer_ch_num = 0;
+		u8	ch_list_inclusioned[100] = { 0x00 };
+		u8	ch_num_inclusioned = 0;
+
+		while ( p2p_ie )	//	Found the P2P IE.
+		{
+
+			//Check P2P Capability ATTR
+			if(rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CAPABILITY, (u8*)&cap_attr, (uint*)&attr_contentlen) )
+			{
+				cap_attr = le16_to_cpu(cap_attr);
+#if defined(CONFIG_WFD) && defined(CONFIG_TDLS)
+			if(!(cap_attr & P2P_GRPCAP_INTRABSS) )
+				ptdlsinfo->ap_prohibited = _TRUE;
+#endif //defined(CONFIG_WFD) && defined(CONFIG_TDLS)
+			}
+
+			rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_STATUS, &attr_content, &attr_contentlen);
+			if ( attr_contentlen == 1 )
+			{
+				DBG_871X( "[%s] Status = %d\n", __FUNCTION__, attr_content );
+				if ( attr_content == P2P_STATUS_SUCCESS )
+				{
+					//	Do nothing.
+				}
+				else
+				{
+					if ( P2P_STATUS_FAIL_INFO_UNAVAILABLE == attr_content ) {
+						rtw_p2p_set_state(pwdinfo, P2P_STATE_RX_INFOR_NOREADY);
+					} else {
+						rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+					}
+					rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+					result = attr_content;
+					break;
+				}
+			}
+
+			//	Try to get the peer's interface address
+			attr_contentlen = 0;
+			if ( rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_INTENTED_IF_ADDR, pwdinfo->p2p_peer_interface_addr, &attr_contentlen ) )
+			{
+				if ( attr_contentlen != ETH_ALEN )
+				{
+					_rtw_memset( pwdinfo->p2p_peer_interface_addr, 0x00, ETH_ALEN );
+				}
+			}
+
+			//	Try to get the peer's intent and tie breaker value.
+			attr_content = 0x00;
+			attr_contentlen = 0;
+			if ( rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_GO_INTENT , &attr_content, &attr_contentlen) )
+			{
+				DBG_871X( "[%s] GO Intent = %d, tie = %d\n", __FUNCTION__, attr_content >> 1, attr_content & 0x01 );
+				pwdinfo->peer_intent = attr_content;	//	include both intent and tie breaker values.
+
+				if ( pwdinfo->intent == ( pwdinfo->peer_intent >> 1 ) )
+				{
+					//	Try to match the tie breaker value
+					if ( pwdinfo->intent == P2P_MAX_INTENT )
+					{
+						rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+						result = P2P_STATUS_FAIL_BOTH_GOINTENT_15;
+						rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+					}
+					else
+					{
+						rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_OK);
+						rtw_p2p_set_pre_state(pwdinfo, P2P_STATE_GONEGO_OK);
+						if ( attr_content & 0x01 )
+						{
+							rtw_p2p_set_role(pwdinfo, P2P_ROLE_CLIENT);
+						}
+						else
+						{
+							rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO);
+						}
+					}
+				}
+				else if ( pwdinfo->intent > ( pwdinfo->peer_intent >> 1 ) )
+				{
+					rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_OK);
+					rtw_p2p_set_pre_state(pwdinfo, P2P_STATE_GONEGO_OK);
+					rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO);
+				}
+				else
+				{
+					rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_OK);
+					rtw_p2p_set_pre_state(pwdinfo, P2P_STATE_GONEGO_OK);
+					rtw_p2p_set_role(pwdinfo, P2P_ROLE_CLIENT);
+				}
+
+				if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+				{
+					//	Store the group id information.
+					_rtw_memcpy( pwdinfo->groupid_info.go_device_addr, pwdinfo->device_addr, ETH_ALEN );
+					_rtw_memcpy( pwdinfo->groupid_info.ssid, pwdinfo->nego_ssid, pwdinfo->nego_ssidlen );
+
+				}
+			}
+
+			//	Try to get the operation channel information
+
+			attr_contentlen = 0;
+			if ( rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, operatingch_info, &attr_contentlen))
+			{
+				DBG_871X( "[%s] Peer's operating channel = %d\n", __FUNCTION__, operatingch_info[4] );
+				pwdinfo->peer_operating_ch = operatingch_info[4];
+			}
+
+			//	Try to get the channel list information
+			if ( rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CH_LIST, pwdinfo->channel_list_attr, &pwdinfo->channel_list_attr_len ) )
+			{
+				DBG_871X( "[%s] channel list attribute found, len = %d\n", __FUNCTION__,  pwdinfo->channel_list_attr_len );
+
+				peer_ch_num = rtw_p2p_get_peer_ch_list(pwdinfo, pwdinfo->channel_list_attr, pwdinfo->channel_list_attr_len, peer_ch_list);
+				ch_num_inclusioned = rtw_p2p_ch_inclusion(&padapter->mlmeextpriv, peer_ch_list, peer_ch_num, ch_list_inclusioned);
+
+				if( ch_num_inclusioned == 0)
+				{
+					DBG_871X( "[%s] No common channel in channel list!\n", __FUNCTION__ );
+					result = P2P_STATUS_FAIL_NO_COMMON_CH;
+					rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+					break;
+				}
+
+				if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+				{
+					if ( !rtw_p2p_is_channel_list_ok( pwdinfo->operating_channel,
+													ch_list_inclusioned, ch_num_inclusioned) )
+					{
+#ifdef CONFIG_CONCURRENT_MODE
+						if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+						{
+							DBG_871X( "[%s] desired channel NOT Found!\n", __FUNCTION__ );
+							result = P2P_STATUS_FAIL_NO_COMMON_CH;
+							rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+							break;
+						}
+						else
+#endif //CONFIG_CONCURRENT_MODE
+						{
+							u8 operatingch_info[5] = { 0x00 }, peer_operating_ch = 0;
+							attr_contentlen = 0;
+
+							if ( rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, operatingch_info, &attr_contentlen) )
+							{
+								peer_operating_ch = operatingch_info[4];
+							}
+
+							if ( rtw_p2p_is_channel_list_ok( peer_operating_ch,
+															ch_list_inclusioned, ch_num_inclusioned) )
+							{
+								/**
+								 *	Change our operating channel as peer's for compatibility.
+								 */
+								pwdinfo->operating_channel = peer_operating_ch;
+								DBG_871X( "[%s] Change op ch to %02x as peer's\n", __FUNCTION__, pwdinfo->operating_channel);
+							}
+							else
+							{
+								// Take first channel of ch_list_inclusioned as operating channel
+								pwdinfo->operating_channel = ch_list_inclusioned[0];
+								DBG_871X( "[%s] Change op ch to %02x\n", __FUNCTION__, pwdinfo->operating_channel);
+							}
+						}
+
+					}
+				}
+
+			}
+			else
+			{
+				DBG_871X( "[%s] channel list attribute not found!\n", __FUNCTION__);
+			}
+
+			//	Try to get the group id information if peer is GO
+			attr_contentlen = 0;
+			_rtw_memset( groupid, 0x00, 38 );
+			if ( rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_GROUP_ID, groupid, &attr_contentlen) )
+			{
+				_rtw_memcpy( pwdinfo->groupid_info.go_device_addr, &groupid[0], ETH_ALEN );
+				_rtw_memcpy( pwdinfo->groupid_info.ssid, &groupid[6], attr_contentlen - ETH_ALEN );
+			}
+
+			//Get the next P2P IE
+			p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+		}
+
+	}
+
+#ifdef CONFIG_WFD
+	//	Added by Albert 20111122
+	//	Try to get the TCP port information when receiving the negotiation response.
+	if ( rtw_get_wfd_ie( pframe + _PUBLIC_ACTION_IE_OFFSET_, len - _PUBLIC_ACTION_IE_OFFSET_, wfd_ie, &wfd_ielen ) )
+	{
+		u8	attr_content[ 10 ] = { 0x00 };
+		u32	attr_contentlen = 0;
+
+		DBG_8192C( "[%s] WFD IE Found!!\n", __FUNCTION__ );
+		rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_DEVICE_INFO, attr_content, &attr_contentlen);
+		if ( attr_contentlen )
+		{
+			pwdinfo->wfd_info->peer_rtsp_ctrlport = RTW_GET_BE16( attr_content + 2 );
+			DBG_8192C( "[%s] Peer PORT NUM = %d\n", __FUNCTION__, pwdinfo->wfd_info->peer_rtsp_ctrlport );
+		}
+	}
+#endif // CONFIG_WFD
+
+	return( result );
+
+}
+
+u8 process_p2p_group_negotation_confirm( struct wifidirect_info *pwdinfo, u8 *pframe, uint len )
+{
+	u8 * ies;
+	u32 ies_len;
+	u8 * p2p_ie;
+	u32	p2p_ielen = 0;
+	u8	result = P2P_STATUS_SUCCESS;
+	ies = pframe + _PUBLIC_ACTION_IE_OFFSET_;
+	ies_len = len - _PUBLIC_ACTION_IE_OFFSET_;
+
+	p2p_ie = rtw_get_p2p_ie( ies, ies_len, NULL, &p2p_ielen );
+	while ( p2p_ie )	//	Found the P2P IE.
+	{
+		u8	attr_content = 0x00, operatingch_info[5] = { 0x00 };
+		u8	groupid[ 38 ] = { 0x00 };
+		u32	attr_contentlen = 0;
+
+		pwdinfo->negotiation_dialog_token = 1;
+		rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_STATUS, &attr_content, &attr_contentlen);
+		if ( attr_contentlen == 1 )
+		{
+			DBG_871X( "[%s] Status = %d\n", __FUNCTION__, attr_content );
+			result = attr_content;
+
+			if ( attr_content == P2P_STATUS_SUCCESS )
+			{
+				u8	bcancelled = 0;
+
+				_cancel_timer( &pwdinfo->restore_p2p_state_timer, &bcancelled );
+
+				//	Commented by Albert 20100911
+				//	Todo: Need to handle the case which both Intents are the same.
+				rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_OK);
+				rtw_p2p_set_pre_state(pwdinfo, P2P_STATE_GONEGO_OK);
+				if ( ( pwdinfo->intent ) > ( pwdinfo->peer_intent >> 1 ) )
+				{
+					rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO);
+				}
+				else if ( ( pwdinfo->intent ) < ( pwdinfo->peer_intent >> 1 ) )
+				{
+					rtw_p2p_set_role(pwdinfo, P2P_ROLE_CLIENT);
+				}
+				else
+				{
+					//	Have to compare the Tie Breaker
+					if ( pwdinfo->peer_intent & 0x01 )
+					{
+						rtw_p2p_set_role(pwdinfo, P2P_ROLE_CLIENT);
+					}
+					else
+					{
+						rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO);
+					}
+				}
+
+#ifdef CONFIG_CONCURRENT_MODE
+				if ( check_buddy_fwstate(pwdinfo->padapter , _FW_LINKED ) )
+				{
+					//	Switch back to the AP channel soon.
+					_set_timer( &pwdinfo->ap_p2p_switch_timer, 100 );
+				}
+#endif
+			}
+			else
+			{
+				rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+				rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_FAIL);
+				break;
+			}
+		}
+
+		//	Try to get the group id information
+		attr_contentlen = 0;
+		_rtw_memset( groupid, 0x00, 38 );
+		if ( rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_GROUP_ID, groupid, &attr_contentlen) )
+		{
+			DBG_871X( "[%s] Ssid = %s, ssidlen = %d\n", __FUNCTION__, &groupid[ETH_ALEN], (u32)strlen(&groupid[ETH_ALEN]) );
+			_rtw_memcpy( pwdinfo->groupid_info.go_device_addr, &groupid[0], ETH_ALEN );
+			_rtw_memcpy( pwdinfo->groupid_info.ssid, &groupid[6], attr_contentlen - ETH_ALEN );
+		}
+
+		attr_contentlen = 0;
+		if ( rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, operatingch_info, &attr_contentlen) )
+		{
+			DBG_871X( "[%s] Peer's operating channel = %d\n", __FUNCTION__, operatingch_info[4] );
+			pwdinfo->peer_operating_ch = operatingch_info[4];
+		}
+
+		//Get the next P2P IE
+		p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+
+	}
+
+	return( result );
+}
+
+u8 process_p2p_presence_req(struct wifidirect_info *pwdinfo, u8 *pframe, uint len)
+{
+	u8 *frame_body;
+	u8 dialogToken=0;
+	u8 status = P2P_STATUS_SUCCESS;
+
+	frame_body = (unsigned char *)(pframe + sizeof(struct rtw_ieee80211_hdr_3addr));
+
+	dialogToken = frame_body[6];
+
+	//todo: check NoA attribute
+
+	issue_p2p_presence_resp(pwdinfo, GetAddr2Ptr(pframe), status, dialogToken);
+
+	return _TRUE;
+}
+
+void find_phase_handler( _adapter*	padapter )
+{
+	struct wifidirect_info  *pwdinfo = &padapter->wdinfo;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	NDIS_802_11_SSID 	ssid;
+	_irqL				irqL;
+	u8					_status = 0;
+
+_func_enter_;
+
+	_rtw_memset((unsigned char*)&ssid, 0, sizeof(NDIS_802_11_SSID));
+	_rtw_memcpy(ssid.Ssid, pwdinfo->p2p_wildcard_ssid, P2P_WILDCARD_SSID_LEN );
+	ssid.SsidLength = P2P_WILDCARD_SSID_LEN;
+
+	rtw_p2p_set_state(pwdinfo, P2P_STATE_FIND_PHASE_SEARCH);
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	_status = rtw_sitesurvey_cmd(padapter, &ssid, 1, NULL, 0);
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+
+_func_exit_;
+}
+
+void p2p_concurrent_handler(  _adapter* padapter );
+
+void restore_p2p_state_handler( _adapter*	padapter )
+{
+	struct wifidirect_info  *pwdinfo = &padapter->wdinfo;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+
+_func_enter_;
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_ING) || rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_FAIL))
+	{
+		rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+	}
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+	{
+		_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+		struct mlme_priv		*pbuddy_mlmepriv = &pbuddy_adapter->mlmepriv;
+		struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+		if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_TX_PROVISION_DIS_REQ) || rtw_p2p_chk_state(pwdinfo, P2P_STATE_RX_PROVISION_DIS_RSP))
+		{
+			set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+
+			issue_nulldata(pbuddy_adapter, NULL, 0, 3, 500);
+		}
+	}
+#endif
+
+	rtw_p2p_set_state(pwdinfo, rtw_p2p_pre_state(pwdinfo));
+
+	if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_DEVICE))
+	{
+#ifdef CONFIG_CONCURRENT_MODE
+		p2p_concurrent_handler( padapter );
+#else
+		//	In the P2P client mode, the driver should not switch back to its listen channel
+		//	because this P2P client should stay at the operating channel of P2P GO.
+		set_channel_bwmode( padapter, pwdinfo->listen_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+#endif
+	}
+_func_exit_;
+}
+
+void pre_tx_invitereq_handler( _adapter*	padapter )
+{
+	struct wifidirect_info  *pwdinfo = &padapter->wdinfo;
+	u8	val8 = 1;
+_func_enter_;
+
+	set_channel_bwmode(padapter, pwdinfo->invitereq_info.peer_ch, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+	rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+	issue_probereq_p2p(padapter, NULL);
+	_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+
+_func_exit_;
+}
+
+void pre_tx_provdisc_handler( _adapter*	padapter )
+{
+	struct wifidirect_info  *pwdinfo = &padapter->wdinfo;
+	u8	val8 = 1;
+_func_enter_;
+
+	set_channel_bwmode(padapter, pwdinfo->tx_prov_disc_info.peer_channel_num[0], HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+	rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+	issue_probereq_p2p(padapter, NULL);
+	_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+
+_func_exit_;
+}
+
+void pre_tx_negoreq_handler( _adapter*	padapter )
+{
+	struct wifidirect_info  *pwdinfo = &padapter->wdinfo;
+	u8	val8 = 1;
+_func_enter_;
+
+	set_channel_bwmode(padapter, pwdinfo->nego_req_info.peer_channel_num[0], HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+	rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+	issue_probereq_p2p(padapter, NULL);
+	_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+
+_func_exit_;
+}
+
+#ifdef CONFIG_CONCURRENT_MODE
+void p2p_concurrent_handler( _adapter*	padapter )
+{
+	struct wifidirect_info	*pwdinfo = &padapter->wdinfo;
+	//_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+	//struct wifidirect_info	*pbuddy_wdinfo = &pbuddy_adapter->wdinfo;
+	//struct mlme_priv		*pbuddy_mlmepriv = &pbuddy_adapter->mlmepriv;
+	//struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+	u8					val8;
+_func_enter_;
+
+	if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+	{
+		PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+		struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+		pwdinfo->operating_channel = pbuddy_mlmeext->cur_channel;
+
+		if( pwdinfo->driver_interface == DRIVER_CFG80211 )
+		{
+			DBG_871X("%s, switch ch back to buddy's cur_channel=%d\n", __func__, pbuddy_mlmeext->cur_channel);
+
+			set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+
+			issue_nulldata(pbuddy_adapter, NULL, 0, 3, 500);
+		}
+		else if( pwdinfo->driver_interface == DRIVER_WEXT )
+		{
+			if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_IDLE))
+			{
+				//	Now, the driver stays on the AP's channel.
+				//	If the pwdinfo->ext_listen_period = 0, that means the P2P listen state is not available on listen channel.
+				if ( pwdinfo->ext_listen_period > 0 )
+				{
+					DBG_8192C( "[%s] P2P_STATE_IDLE, ext_listen_period = %d\n", __FUNCTION__, pwdinfo->ext_listen_period );
+
+					if ( pbuddy_mlmeext->cur_channel != pwdinfo->listen_channel )
+					{
+						//	Will switch to listen channel so that need to send the NULL data with PW bit to AP.
+						issue_nulldata(pbuddy_adapter, NULL, 1, 3, 500);
+						set_channel_bwmode(padapter, pwdinfo->listen_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+					}
+
+					rtw_p2p_set_state(pwdinfo, P2P_STATE_LISTEN);
+					val8 = 1;
+					rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+
+					//	Todo: To check the value of pwdinfo->ext_listen_period is equal to 0 or not.
+					_set_timer( &pwdinfo->ap_p2p_switch_timer, pwdinfo->ext_listen_period );
+				}
+			}
+			else if ( rtw_p2p_chk_state(pwdinfo, P2P_STATE_LISTEN) ||
+					rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_FAIL) ||
+					( rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_ING) && pwdinfo->nego_req_info.benable == _FALSE ) ||
+					rtw_p2p_chk_state(pwdinfo, P2P_STATE_RX_PROVISION_DIS_REQ) )
+			{
+				//	Now, the driver is in the listen state of P2P mode.
+				DBG_8192C( "[%s] P2P_STATE_IDLE, ext_listen_interval = %d\n", __FUNCTION__, pwdinfo->ext_listen_interval );
+
+				//	Commented by Albert 2012/11/01
+				//	If the AP's channel is the same as the listen channel, we should still be in the listen state
+				//	Other P2P device is still able to find this device out even this device is in the AP's channel.
+				//	So, configure this device to be able to receive the probe request frame and set it to listen state.
+				if ( pbuddy_mlmeext->cur_channel != pwdinfo->listen_channel )
+				{
+					set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+					val8 = 0;
+					padapter->HalFunc.SetHwRegHandler(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+					rtw_p2p_set_state(pwdinfo, P2P_STATE_IDLE);
+					issue_nulldata(pbuddy_adapter, NULL, 0, 3, 500);
+				}
+
+				//	Todo: To check the value of pwdinfo->ext_listen_interval is equal to 0 or not.
+				_set_timer( &pwdinfo->ap_p2p_switch_timer, pwdinfo->ext_listen_interval );
+			}
+			else if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_OK))
+			{
+				//	The driver had finished the P2P handshake successfully.
+				val8 = 0;
+				rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+				set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+				issue_nulldata(pbuddy_adapter, NULL, 0, 3, 500);
+			}
+			else if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_TX_PROVISION_DIS_REQ))
+			{
+				val8 = 1;
+				set_channel_bwmode(padapter, pwdinfo->tx_prov_disc_info.peer_channel_num[0], HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+				rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+				issue_probereq_p2p(padapter, NULL);
+				_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+			}
+			else if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_ING) && pwdinfo->nego_req_info.benable == _TRUE)
+			{
+				val8 = 1;
+				set_channel_bwmode(padapter, pwdinfo->nego_req_info.peer_channel_num[0], HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+				rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+				issue_probereq_p2p(padapter, NULL);
+				_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+			}
+			else if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_TX_INVITE_REQ ) && pwdinfo->invitereq_info.benable == _TRUE)
+			{
+				/*
+				val8 = 1;
+				set_channel_bwmode(padapter, , HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+				rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
+				issue_probereq_p2p(padapter, NULL);
+				_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+				*/
+			}
+		}
+	}
+	else
+	{
+		set_channel_bwmode( padapter, pwdinfo->listen_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+	}
+
+_func_exit_;
+}
+#endif
+
+#ifdef CONFIG_IOCTL_CFG80211
+static void ro_ch_handler(_adapter *padapter)
+{
+	struct cfg80211_wifidirect_info *pcfg80211_wdinfo = &padapter->cfg80211_wdinfo;
+	struct wifidirect_info *pwdinfo = &padapter->wdinfo;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	u8 ch, bw, offset;
+_func_enter_;
+
+	if (rtw_get_ch_setting_union(padapter, &ch, &bw, &offset) != 0) {
+		if (0)
+		DBG_871X(FUNC_ADPT_FMT" back to linked union - ch:%u, bw:%u, offset:%u\n",
+			FUNC_ADPT_ARG(padapter), ch, bw, offset);
+	}
+	else if (wdev_to_priv(padapter->rtw_wdev)->p2p_enabled && pwdinfo->listen_channel) {
+		ch = pwdinfo->listen_channel;
+		bw = HT_CHANNEL_WIDTH_20;
+		offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+		if (0)
+		DBG_871X(FUNC_ADPT_FMT" back to listen ch - ch:%u, bw:%u, offset:%u\n",
+			FUNC_ADPT_ARG(padapter), ch, bw, offset);
+	}
+	else {
+		ch = pcfg80211_wdinfo->restore_channel;
+		bw = HT_CHANNEL_WIDTH_20;
+		offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+		if (0)
+		DBG_871X(FUNC_ADPT_FMT" back to restore ch - ch:%u, bw:%u, offset:%u\n",
+			FUNC_ADPT_ARG(padapter), ch, bw, offset);
+	}
+
+	set_channel_bwmode(padapter, ch, offset, bw);
+
+	rtw_p2p_set_state(pwdinfo, rtw_p2p_pre_state(pwdinfo));
+#ifdef CONFIG_DEBUG_CFG80211
+	DBG_871X("%s, role=%d, p2p_state=%d\n", __func__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo));
+#endif
+
+	pcfg80211_wdinfo->is_ro_ch = _FALSE;
+
+	DBG_871X("cfg80211_remain_on_channel_expired\n");
+
+	rtw_cfg80211_remain_on_channel_expired(padapter,
+		pcfg80211_wdinfo->remain_on_ch_cookie,
+		&pcfg80211_wdinfo->remain_on_ch_channel,
+		pcfg80211_wdinfo->remain_on_ch_type, GFP_KERNEL);
+
+_func_exit_;
+}
+
+static void ro_ch_timer_process (void *FunctionContext)
+{
+	_adapter *adapter = (_adapter *)FunctionContext;
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(adapter->rtw_wdev);
+
+	//printk("%s \n", __FUNCTION__);
+
+#ifdef	CONFIG_CONCURRENT_MODE
+	ATOMIC_SET(&pwdev_priv->ro_ch_to, 1);
+#endif
+
+	p2p_protocol_wk_cmd( adapter, P2P_RO_CH_WK);
+}
+
+static void rtw_change_p2pie_op_ch(_adapter *padapter, const u8 *frame_body, u32 len, u8 ch)
+{
+	u8 *ies, *p2p_ie;
+	u32 ies_len, p2p_ielen;
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+	ies = (u8*)(frame_body + _PUBLIC_ACTION_IE_OFFSET_);
+	ies_len = len - _PUBLIC_ACTION_IE_OFFSET_;
+
+	p2p_ie = rtw_get_p2p_ie( ies, ies_len, NULL, &p2p_ielen );
+
+	while ( p2p_ie ) {
+		u32	attr_contentlen = 0;
+		u8 *pattr = NULL;
+
+		//Check P2P_ATTR_OPERATING_CH
+		attr_contentlen = 0;
+		pattr = NULL;
+		if((pattr = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, NULL, (uint*)&attr_contentlen))!=NULL)
+		{
+			*(pattr+4) = ch;
+		}
+
+		//Get the next P2P IE
+		p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+	}
+}
+
+static void rtw_change_p2pie_ch_list(_adapter *padapter, const u8 *frame_body, u32 len, u8 ch)
+{
+	u8 *ies, *p2p_ie;
+	u32 ies_len, p2p_ielen;
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+	ies = (u8*)(frame_body + _PUBLIC_ACTION_IE_OFFSET_);
+	ies_len = len - _PUBLIC_ACTION_IE_OFFSET_;
+
+	p2p_ie = rtw_get_p2p_ie( ies, ies_len, NULL, &p2p_ielen );
+
+	while (p2p_ie) {
+		u32	attr_contentlen = 0;
+		u8 *pattr = NULL;
+
+		//Check P2P_ATTR_CH_LIST
+		if ((pattr=rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CH_LIST, NULL, (uint*)&attr_contentlen))!=NULL) {
+			int i;
+			u32 num_of_ch;
+			u8 *pattr_temp = pattr + 3 ;
+
+			attr_contentlen -= 3;
+
+			while (attr_contentlen>0) {
+				num_of_ch = *(pattr_temp+1);
+
+				for(i=0; i<num_of_ch; i++)
+					*(pattr_temp+2+i) = ch;
+
+				pattr_temp += (2+num_of_ch);
+				attr_contentlen -= (2+num_of_ch);
+			}
+		}
+
+		//Get the next P2P IE
+		p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+	}
+}
+
+static bool rtw_chk_p2pie_ch_list_with_buddy(_adapter *padapter, const u8 *frame_body, u32 len)
+{
+	bool fit = _FALSE;
+#ifdef CONFIG_CONCURRENT_MODE
+	u8 *ies, *p2p_ie;
+	u32 ies_len, p2p_ielen;
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+	u8 buddy_ch = pbuddy_mlmeext->cur_channel;
+
+	ies = (u8*)(frame_body + _PUBLIC_ACTION_IE_OFFSET_);
+	ies_len = len - _PUBLIC_ACTION_IE_OFFSET_;
+
+	p2p_ie = rtw_get_p2p_ie( ies, ies_len, NULL, &p2p_ielen );
+
+	while (p2p_ie) {
+		u32	attr_contentlen = 0;
+		u8 *pattr = NULL;
+
+		//Check P2P_ATTR_CH_LIST
+		if ((pattr=rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CH_LIST, NULL, (uint*)&attr_contentlen))!=NULL) {
+			int i;
+			u32 num_of_ch;
+			u8 *pattr_temp = pattr + 3 ;
+
+			attr_contentlen -= 3;
+
+			while (attr_contentlen>0) {
+				num_of_ch = *(pattr_temp+1);
+
+				for(i=0; i<num_of_ch; i++) {
+					if (*(pattr_temp+2+i) == buddy_ch) {
+						DBG_871X(FUNC_ADPT_FMT" ch_list fit buddy_ch:%u\n", FUNC_ADPT_ARG(padapter), buddy_ch);
+						fit = _TRUE;
+						break;
+					}
+				}
+
+				pattr_temp += (2+num_of_ch);
+				attr_contentlen -= (2+num_of_ch);
+			}
+		}
+
+		//Get the next P2P IE
+		p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+	}
+#endif
+	return fit;
+}
+
+static bool rtw_chk_p2pie_op_ch_with_buddy(_adapter *padapter, const u8 *frame_body, u32 len)
+{
+	bool fit = _FALSE;
+#ifdef CONFIG_CONCURRENT_MODE
+	u8 *ies, *p2p_ie;
+	u32 ies_len, p2p_ielen;
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+	u8 buddy_ch = pbuddy_mlmeext->cur_channel;
+
+	ies = (u8*)(frame_body + _PUBLIC_ACTION_IE_OFFSET_);
+	ies_len = len - _PUBLIC_ACTION_IE_OFFSET_;
+
+	p2p_ie = rtw_get_p2p_ie( ies, ies_len, NULL, &p2p_ielen );
+
+	while (p2p_ie) {
+		u32	attr_contentlen = 0;
+		u8 *pattr = NULL;
+
+		//Check P2P_ATTR_OPERATING_CH
+		attr_contentlen = 0;
+		pattr = NULL;
+		if((pattr = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, NULL, (uint*)&attr_contentlen))!=NULL) {
+			if (*(pattr+4) == buddy_ch) {
+				DBG_871X(FUNC_ADPT_FMT" op_ch fit buddy_ch:%u\n", FUNC_ADPT_ARG(padapter), buddy_ch);
+				fit = _TRUE;
+				break;
+			}
+		}
+
+		//Get the next P2P IE
+		p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+	}
+#endif
+	return fit;
+}
+
+static void rtw_cfg80211_adjust_p2pie_channel(_adapter *padapter, const u8 *frame_body, u32 len)
+{
+#ifdef CONFIG_CONCURRENT_MODE
+	u8 *ies, *p2p_ie;
+	u32 ies_len, p2p_ielen;
+	PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+	ies = (u8*)(frame_body + _PUBLIC_ACTION_IE_OFFSET_);
+	ies_len = len - _PUBLIC_ACTION_IE_OFFSET_;
+
+	p2p_ie = rtw_get_p2p_ie( ies, ies_len, NULL, &p2p_ielen );
+
+	while ( p2p_ie )
+	{
+		u32	attr_contentlen = 0;
+		u8 *pattr = NULL;
+
+		//Check P2P_ATTR_CH_LIST
+		if((pattr=rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CH_LIST, NULL, (uint*)&attr_contentlen))!=NULL)
+		{
+			int i;
+			u32 num_of_ch;
+			u8 *pattr_temp = pattr + 3 ;
+
+			attr_contentlen -= 3;
+
+			while(attr_contentlen>0)
+			{
+				num_of_ch = *(pattr_temp+1);
+
+				for(i=0; i<num_of_ch; i++)
+					*(pattr_temp+2+i) = pbuddy_mlmeext->cur_channel;//forcing to the same channel
+
+				pattr_temp += (2+num_of_ch);
+				attr_contentlen -= (2+num_of_ch);
+			}
+		}
+
+		//Check P2P_ATTR_OPERATING_CH
+		attr_contentlen = 0;
+		pattr = NULL;
+		if((pattr = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, NULL, (uint*)&attr_contentlen))!=NULL)
+		{
+			*(pattr+4) = pbuddy_mlmeext->cur_channel;//forcing to the same channel
+		}
+
+		//Get the next P2P IE
+		p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+
+	}
+
+#endif
+}
+
+#ifdef CONFIG_WFD
+void rtw_append_wfd_ie(_adapter *padapter, u8 *buf, u32* len)
+{
+	unsigned char	*frame_body;
+	u8 category, action, OUI_Subtype, dialogToken=0;
+	u32	wfdielen = 0;
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(padapter->rtw_wdev);
+
+	frame_body = (unsigned char *)(buf + sizeof(struct rtw_ieee80211_hdr_3addr));
+	category = frame_body[0];
+
+	if(category == RTW_WLAN_CATEGORY_PUBLIC)
+	{
+		action = frame_body[1];
+		if (action == ACT_PUBLIC_VENDOR
+			&& _rtw_memcmp(frame_body+2, P2P_OUI, 4) == _TRUE
+		)
+		{
+			OUI_Subtype = frame_body[6];
+			dialogToken = frame_body[7];
+			switch( OUI_Subtype )//OUI Subtype
+			{
+				case P2P_GO_NEGO_REQ:
+				{
+					wfdielen = build_nego_req_wfd_ie( &padapter->wdinfo, buf + ( *len ) );
+					(*len) += wfdielen;
+					break;
+				}
+				case P2P_GO_NEGO_RESP:
+				{
+					wfdielen = build_nego_resp_wfd_ie( &padapter->wdinfo, buf + ( *len ) );
+					(*len) += wfdielen;
+					break;
+				}
+				case P2P_GO_NEGO_CONF:
+				{
+					wfdielen = build_nego_confirm_wfd_ie( &padapter->wdinfo, buf + ( *len ) );
+					(*len) += wfdielen;
+					break;
+				}
+				case P2P_INVIT_REQ:
+				{
+					wfdielen = build_invitation_req_wfd_ie( &padapter->wdinfo, buf + ( *len ) );
+					(*len) += wfdielen;
+					break;
+				}
+				case P2P_INVIT_RESP:
+				{
+					wfdielen = build_invitation_resp_wfd_ie( &padapter->wdinfo, buf + ( *len ) );
+					(*len) += wfdielen;
+					break;
+				}
+				case P2P_DEVDISC_REQ:
+					break;
+				case P2P_DEVDISC_RESP:
+
+					break;
+				case P2P_PROVISION_DISC_REQ:
+				{
+					wfdielen = build_provdisc_req_wfd_ie( &padapter->wdinfo, buf + ( *len ) );
+					(*len) += wfdielen;
+					break;
+				}
+				case P2P_PROVISION_DISC_RESP:
+				{
+					wfdielen = build_provdisc_resp_wfd_ie( &padapter->wdinfo, buf + ( *len ) );
+					(*len) += wfdielen;
+					break;
+				}
+				default:
+
+					break;
+			}
+
+		}
+
+	}
+	else if(category == RTW_WLAN_CATEGORY_P2P)
+	{
+		OUI_Subtype = frame_body[5];
+		dialogToken = frame_body[6];
+
+#ifdef CONFIG_DEBUG_CFG80211
+		DBG_871X("ACTION_CATEGORY_P2P: OUI=0x%x, OUI_Subtype=%d, dialogToken=%d\n",
+					cpu_to_be32( *( ( u32* ) ( frame_body + 1 ) ) ), OUI_Subtype, dialogToken);
+#endif
+
+		switch(OUI_Subtype)
+		{
+			case P2P_NOTICE_OF_ABSENCE:
+
+				break;
+			case P2P_PRESENCE_REQUEST:
+
+				break;
+			case P2P_PRESENCE_RESPONSE:
+
+				break;
+			case P2P_GO_DISC_REQUEST:
+
+				break;
+			default:
+
+				break;
+		}
+
+	}
+	else
+	{
+		DBG_871X("%s, action frame category=%d\n", __func__, category);
+		//is_p2p_frame = (-1);
+	}
+
+	return;
+}
+#endif
+
+u8 *dump_p2p_attr_ch_list(u8 *p2p_ie, uint p2p_ielen, u8 *buf, u32 buf_len)
+{
+	uint attr_contentlen = 0;
+	u8 *pattr = NULL;
+	int w_sz = 0;
+	u8 ch_cnt = 0;
+	u8 ch_list[40];
+	bool continuous = _FALSE;
+
+	if ((pattr=rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_CH_LIST, NULL, &attr_contentlen))!=NULL) {
+		int i, j;
+		u32 num_of_ch;
+		u8 *pattr_temp = pattr + 3 ;
+
+		attr_contentlen -= 3;
+
+		_rtw_memset(ch_list, 0, 40);
+
+		while (attr_contentlen>0) {
+			num_of_ch = *(pattr_temp+1);
+
+			for(i=0; i<num_of_ch; i++) {
+				for (j=0;j<ch_cnt;j++) {
+					if (ch_list[j] == *(pattr_temp+2+i))
+						break;
+				}
+				if (j>=ch_cnt)
+					ch_list[ch_cnt++] = *(pattr_temp+2+i);
+
+			}
+
+			pattr_temp += (2+num_of_ch);
+			attr_contentlen -= (2+num_of_ch);
+		}
+
+		for (j=0;j<ch_cnt;j++) {
+			if (j == 0) {
+				w_sz += snprintf(buf+w_sz, buf_len-w_sz, "%u", ch_list[j]);
+			} else if (ch_list[j] - ch_list[j-1] != 1) {
+				w_sz += snprintf(buf+w_sz, buf_len-w_sz, ", %u", ch_list[j]);
+			} else if (j != ch_cnt-1 && ch_list[j+1] - ch_list[j] == 1) {
+				/* empty */
+			} else {
+				w_sz += snprintf(buf+w_sz, buf_len-w_sz, "-%u", ch_list[j]);
+			}
+		}
+	}
+	return buf;
+}
+
+/*
+ * return _TRUE if requester is GO, _FALSE if responder is GO
+ */
+bool rtw_p2p_nego_intent_compare(u8 req, u8 resp)
+{
+	if (req>>1 == resp >>1)
+		return  req&0x01 ? _TRUE : _FALSE;
+	else if (req>>1 > resp>>1)
+		return _TRUE;
+	else
+		return _FALSE;
+}
+
+int rtw_p2p_check_frames(_adapter *padapter, const u8 *buf, u32 len, u8 tx)
+{
+	int is_p2p_frame = (-1);
+	unsigned char	*frame_body;
+	u8 category, action, OUI_Subtype, dialogToken=0;
+	u8 *p2p_ie = NULL;
+	uint p2p_ielen = 0;
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(padapter->rtw_wdev);
+	int status = -1;
+	u8 ch_list_buf[128] = {'\0'};
+	int op_ch = -1;
+	int listen_ch = -1;
+	u8 intent = 0;
+
+	frame_body = (unsigned char *)(buf + sizeof(struct rtw_ieee80211_hdr_3addr));
+	category = frame_body[0];
+	//just for check
+	if(category == RTW_WLAN_CATEGORY_PUBLIC)
+	{
+		action = frame_body[1];
+		if (action == ACT_PUBLIC_VENDOR
+			&& _rtw_memcmp(frame_body+2, P2P_OUI, 4) == _TRUE
+		)
+		{
+			OUI_Subtype = frame_body[6];
+			dialogToken = frame_body[7];
+			is_p2p_frame = OUI_Subtype;
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_871X("ACTION_CATEGORY_PUBLIC: ACT_PUBLIC_VENDOR, OUI=0x%x, OUI_Subtype=%d, dialogToken=%d\n",
+				cpu_to_be32( *( ( u32* ) ( frame_body + 2 ) ) ), OUI_Subtype, dialogToken);
+			#endif
+
+			p2p_ie = rtw_get_p2p_ie(
+				(u8 *)buf+sizeof(struct rtw_ieee80211_hdr_3addr)+_PUBLIC_ACTION_IE_OFFSET_,
+				len-sizeof(struct rtw_ieee80211_hdr_3addr)-_PUBLIC_ACTION_IE_OFFSET_,
+				NULL, &p2p_ielen);
+
+			switch( OUI_Subtype )//OUI Subtype
+			{
+				u8 *cont;
+				uint cont_len;
+				case P2P_GO_NEGO_REQ:
+				{
+					struct rtw_wdev_nego_info* nego_info = &pwdev_priv->nego_info;
+
+					if (tx) {
+						#ifdef CONFIG_DRV_ISSUE_PROV_REQ // IOT FOR S2
+						if(pwdev_priv->provdisc_req_issued == _FALSE) {
+							rtw_cfg80211_issue_p2p_provision_request(padapter, buf, len);
+							pwdev_priv->provdisc_req_issued = _TRUE;
+							rtw_msleep_os(200);
+						}
+						#endif //CONFIG_DRV_ISSUE_PROV_REQ
+
+						#ifdef CONFIG_CONCURRENT_MODE
+						if(check_buddy_fwstate(padapter, _FW_LINKED))
+							rtw_cfg80211_adjust_p2pie_channel(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr));
+						#endif
+					}
+
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, NULL, &cont_len)))
+						op_ch = *(cont+4);
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_LISTEN_CH, NULL, &cont_len)))
+						listen_ch = *(cont+4);
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_GO_INTENT, NULL, &cont_len)))
+						intent = *cont;
+
+					if (nego_info->token != dialogToken)
+						rtw_wdev_nego_info_init(nego_info);
+
+					_rtw_memcpy(nego_info->peer_mac, tx ? GetAddr1Ptr(buf) : GetAddr2Ptr(buf), ETH_ALEN);
+					nego_info->active = tx ? 1 : 0;
+					nego_info->token = dialogToken;
+					nego_info->req_op_ch = op_ch;
+					nego_info->req_listen_ch = listen_ch;
+					nego_info->req_intent = intent;
+					nego_info->state = 0;
+
+					dump_p2p_attr_ch_list(p2p_ie, p2p_ielen, ch_list_buf, 128);
+					DBG_871X("RTW_%s:P2P_GO_NEGO_REQ, dialogToken=%d, intent:%u%s, listen_ch:%d, op_ch:%d, ch_list:%s\n",
+							(tx==_TRUE)?"Tx":"Rx", dialogToken, (intent>>1), intent&0x1 ? "+" : "-", listen_ch, op_ch, ch_list_buf);
+
+					if (!tx) {
+						#ifdef CONFIG_CONCURRENT_MODE
+						if(check_buddy_fwstate(padapter, _FW_LINKED)
+							&& rtw_chk_p2pie_ch_list_with_buddy(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr)) == _FALSE)
+						{
+							DBG_871X(FUNC_ADPT_FMT" ch_list has no intersect with buddy\n", FUNC_ADPT_ARG(padapter));
+							rtw_change_p2pie_ch_list(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr), 0);
+						}
+						#endif
+					}
+
+					break;
+				}
+				case P2P_GO_NEGO_RESP:
+				{
+					struct rtw_wdev_nego_info* nego_info = &pwdev_priv->nego_info;
+
+					if (tx) {
+						#ifdef CONFIG_CONCURRENT_MODE
+						if(check_buddy_fwstate(padapter, _FW_LINKED))
+							rtw_cfg80211_adjust_p2pie_channel(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr));
+						#endif
+					}
+
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, NULL, &cont_len)))
+						op_ch = *(cont+4);
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_GO_INTENT, NULL, &cont_len)))
+						intent = *cont;
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_STATUS, NULL, &cont_len)))
+						status = *cont;
+
+					if (nego_info->token == dialogToken && nego_info->state == 0
+						&& _rtw_memcmp(nego_info->peer_mac, tx ? GetAddr1Ptr(buf) : GetAddr2Ptr(buf), ETH_ALEN) == _TRUE
+					) {
+						nego_info->status = (status==-1) ? 0xff : status;
+						nego_info->rsp_op_ch= op_ch;
+						nego_info->rsp_intent = intent;
+						nego_info->state = 1;
+						if (status != 0)
+							nego_info->token = 0; /* init */
+					}
+
+					dump_p2p_attr_ch_list(p2p_ie, p2p_ielen, ch_list_buf, 128);
+					DBG_871X("RTW_%s:P2P_GO_NEGO_RESP, dialogToken=%d, intent:%u%s, status:%d, op_ch:%d, ch_list:%s\n",
+							(tx==_TRUE)?"Tx":"Rx", dialogToken, (intent>>1), intent&0x1 ? "+" : "-", status, op_ch, ch_list_buf);
+
+					if (!tx) {
+						pwdev_priv->provdisc_req_issued = _FALSE;
+						#ifdef CONFIG_CONCURRENT_MODE
+						if(check_buddy_fwstate(padapter, _FW_LINKED)
+							&& rtw_chk_p2pie_ch_list_with_buddy(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr)) == _FALSE)
+						{
+							DBG_871X(FUNC_ADPT_FMT" ch_list has no intersect with buddy\n", FUNC_ADPT_ARG(padapter));
+							rtw_change_p2pie_ch_list(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr), 0);
+						}
+						#endif
+					}
+
+					break;
+				}
+				case P2P_GO_NEGO_CONF:
+				{
+					struct rtw_wdev_nego_info* nego_info = &pwdev_priv->nego_info;
+					bool is_go = _FALSE;
+
+					if (tx) {
+						#ifdef CONFIG_CONCURRENT_MODE
+						if(check_buddy_fwstate(padapter, _FW_LINKED))
+							rtw_cfg80211_adjust_p2pie_channel(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr));
+						#endif
+					}
+
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, NULL, &cont_len)))
+						op_ch = *(cont+4);
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_STATUS, NULL, &cont_len)))
+						status = *cont;
+
+					if (nego_info->token == dialogToken && nego_info->state == 1
+						&& _rtw_memcmp(nego_info->peer_mac, tx ? GetAddr1Ptr(buf) : GetAddr2Ptr(buf), ETH_ALEN) == _TRUE
+					) {
+						nego_info->status = (status==-1) ? 0xff : status;
+						nego_info->conf_op_ch = (op_ch==-1) ? 0 : op_ch;
+						nego_info->state = 2;
+
+						if (status == 0) {
+							if (rtw_p2p_nego_intent_compare(nego_info->req_intent, nego_info->rsp_intent) && tx)
+								is_go = _TRUE;
+						}
+
+						nego_info->token = 0; /* init */
+					}
+
+					dump_p2p_attr_ch_list(p2p_ie, p2p_ielen, ch_list_buf, 128);
+					DBG_871X("RTW_%s:P2P_GO_NEGO_CONF, dialogToken=%d, status:%d, op_ch:%d, ch_list:%s\n",
+						(tx==_TRUE)?"Tx":"Rx", dialogToken, status, op_ch, ch_list_buf);
+
+					if (!tx) {
+					}
+
+					break;
+				}
+				case P2P_INVIT_REQ:
+				{
+					struct rtw_wdev_invit_info* invit_info = &pwdev_priv->invit_info;
+					int flags = -1;
+
+					if (tx) {
+						#ifdef CONFIG_CONCURRENT_MODE
+						if(check_buddy_fwstate(padapter, _FW_LINKED))
+							rtw_cfg80211_adjust_p2pie_channel(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr));
+						#endif
+					}
+
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_INVITATION_FLAGS, NULL, &cont_len)))
+						flags = *cont;
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, NULL, &cont_len)))
+						op_ch = *(cont+4);
+
+					if (invit_info->token != dialogToken)
+						rtw_wdev_invit_info_init(invit_info);
+
+					_rtw_memcpy(invit_info->peer_mac, tx ? GetAddr1Ptr(buf) : GetAddr2Ptr(buf), ETH_ALEN);
+					invit_info->active = tx ? 1 : 0;
+					invit_info->token = dialogToken;
+					invit_info->flags = (flags==-1) ? 0x0 : flags;
+					invit_info->req_op_ch= op_ch;
+					invit_info->state = 0;
+
+					dump_p2p_attr_ch_list(p2p_ie, p2p_ielen, ch_list_buf, 128);
+					DBG_871X("RTW_%s:P2P_INVIT_REQ, dialogToken=%d, flags:0x%02x, op_ch:%d, ch_list:%s\n",
+							(tx==_TRUE)?"Tx":"Rx", dialogToken, flags, op_ch, ch_list_buf);
+
+					if (!tx) {
+						#ifdef CONFIG_CONCURRENT_MODE
+						if(check_buddy_fwstate(padapter, _FW_LINKED)) {
+							if (op_ch != -1 && rtw_chk_p2pie_op_ch_with_buddy(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr)) == _FALSE) {
+								DBG_871X(FUNC_ADPT_FMT" op_ch:%u has no intersect with buddy\n", FUNC_ADPT_ARG(padapter), op_ch);
+								rtw_change_p2pie_ch_list(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr), 0);
+							} else if (rtw_chk_p2pie_ch_list_with_buddy(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr)) == _FALSE) {
+								DBG_871X(FUNC_ADPT_FMT" ch_list has no intersect with buddy\n", FUNC_ADPT_ARG(padapter));
+								rtw_change_p2pie_ch_list(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr), 0);
+							}
+						}
+						#endif
+					}
+
+					break;
+				}
+				case P2P_INVIT_RESP:
+				{
+					struct rtw_wdev_invit_info* invit_info = &pwdev_priv->invit_info;
+
+					if (tx) {
+						#ifdef CONFIG_CONCURRENT_MODE
+						if(check_buddy_fwstate(padapter, _FW_LINKED))
+							rtw_cfg80211_adjust_p2pie_channel(padapter, frame_body, len-sizeof(struct rtw_ieee80211_hdr_3addr));
+						#endif
+					}
+
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_STATUS, NULL, &cont_len)))
+					{
+#ifdef CONFIG_P2P_INVITE_IOT
+						if(tx && *cont==7)
+						{
+							DBG_871X("TX_P2P_INVITE_RESP, status is no common channel, change to unknown group\n");
+							*cont = 8; //unknow group status
+						}
+#endif //CONFIG_P2P_INVITE_IOT
+						status = *cont;
+					}
+					if ((cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_OPERATING_CH, NULL, &cont_len)))
+						op_ch = *(cont+4);
+
+					if (invit_info->token == dialogToken && invit_info->state == 0
+						&& _rtw_memcmp(invit_info->peer_mac, tx ? GetAddr1Ptr(buf) : GetAddr2Ptr(buf), ETH_ALEN) == _TRUE
+					) {
+						invit_info->status = (status==-1) ? 0xff : status;
+						invit_info->rsp_op_ch= op_ch;
+						invit_info->state = 1;
+						invit_info->token = 0; /* init */
+					}
+
+					dump_p2p_attr_ch_list(p2p_ie, p2p_ielen, ch_list_buf, 128);
+					DBG_871X("RTW_%s:P2P_INVIT_RESP, dialogToken=%d, status:%d, op_ch:%d, ch_list:%s\n",
+							(tx==_TRUE)?"Tx":"Rx", dialogToken, status, op_ch, ch_list_buf);
+
+					if (!tx) {
+					}
+
+					break;
+				}
+				case P2P_DEVDISC_REQ:
+					DBG_871X("RTW_%s:P2P_DEVDISC_REQ, dialogToken=%d\n", (tx==_TRUE)?"Tx":"Rx", dialogToken);
+					break;
+				case P2P_DEVDISC_RESP:
+					cont = rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_STATUS, NULL, &cont_len);
+					DBG_871X("RTW_%s:P2P_DEVDISC_RESP, dialogToken=%d, status:%d\n", (tx==_TRUE)?"Tx":"Rx", dialogToken, cont?*cont:-1);
+					break;
+				case P2P_PROVISION_DISC_REQ:
+				{
+					size_t frame_body_len = len - sizeof(struct rtw_ieee80211_hdr_3addr);
+					u8 *p2p_ie;
+					uint p2p_ielen = 0;
+					uint contentlen = 0;
+
+					DBG_871X("RTW_%s:P2P_PROVISION_DISC_REQ, dialogToken=%d\n", (tx==_TRUE)?"Tx":"Rx", dialogToken);
+
+					//if(tx)
+					{
+						pwdev_priv->provdisc_req_issued = _FALSE;
+
+						if( (p2p_ie=rtw_get_p2p_ie( frame_body + _PUBLIC_ACTION_IE_OFFSET_, frame_body_len - _PUBLIC_ACTION_IE_OFFSET_, NULL, &p2p_ielen)))
+						{
+
+							if(rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_GROUP_ID, NULL, &contentlen))
+							{
+								pwdev_priv->provdisc_req_issued = _FALSE;//case: p2p_client join p2p GO
+							}
+							else
+							{
+								#ifdef CONFIG_DEBUG_CFG80211
+								DBG_871X("provdisc_req_issued is _TRUE\n");
+								#endif //CONFIG_DEBUG_CFG80211
+								pwdev_priv->provdisc_req_issued = _TRUE;//case: p2p_devices connection before Nego req.
+							}
+
+						}
+					}
+				}
+					break;
+				case P2P_PROVISION_DISC_RESP:
+					DBG_871X("RTW_%s:P2P_PROVISION_DISC_RESP, dialogToken=%d\n", (tx==_TRUE)?"Tx":"Rx", dialogToken);
+					break;
+				default:
+					DBG_871X("RTW_%s:OUI_Subtype=%d, dialogToken=%d\n", (tx==_TRUE)?"Tx":"Rx", OUI_Subtype, dialogToken);
+					break;
+			}
+
+		}
+
+	}
+	else if(category == RTW_WLAN_CATEGORY_P2P)
+	{
+		OUI_Subtype = frame_body[5];
+		dialogToken = frame_body[6];
+
+		#ifdef CONFIG_DEBUG_CFG80211
+		DBG_871X("ACTION_CATEGORY_P2P: OUI=0x%x, OUI_Subtype=%d, dialogToken=%d\n",
+			cpu_to_be32( *( ( u32* ) ( frame_body + 1 ) ) ), OUI_Subtype, dialogToken);
+		#endif
+
+		is_p2p_frame = OUI_Subtype;
+
+		switch(OUI_Subtype)
+		{
+			case P2P_NOTICE_OF_ABSENCE:
+				DBG_871X("RTW_%s:P2P_NOTICE_OF_ABSENCE, dialogToken=%d\n", (tx==_TRUE)?"TX":"RX", dialogToken);
+				break;
+			case P2P_PRESENCE_REQUEST:
+				DBG_871X("RTW_%s:P2P_PRESENCE_REQUEST, dialogToken=%d\n", (tx==_TRUE)?"TX":"RX", dialogToken);
+				break;
+			case P2P_PRESENCE_RESPONSE:
+				DBG_871X("RTW_%s:P2P_PRESENCE_RESPONSE, dialogToken=%d\n", (tx==_TRUE)?"TX":"RX", dialogToken);
+				break;
+			case P2P_GO_DISC_REQUEST:
+				DBG_871X("RTW_%s:P2P_GO_DISC_REQUEST, dialogToken=%d\n", (tx==_TRUE)?"TX":"RX", dialogToken);
+				break;
+			default:
+				DBG_871X("RTW_%s:OUI_Subtype=%d, dialogToken=%d\n", (tx==_TRUE)?"TX":"RX", OUI_Subtype, dialogToken);
+				break;
+		}
+
+	}
+	else
+	{
+		DBG_871X("RTW_%s:action frame category=%d\n", (tx==_TRUE)?"TX":"RX", category);
+	}
+
+	return is_p2p_frame;
+}
+
+void rtw_init_cfg80211_wifidirect_info( _adapter*	padapter)
+{
+	struct cfg80211_wifidirect_info *pcfg80211_wdinfo = &padapter->cfg80211_wdinfo;
+
+	_rtw_memset(pcfg80211_wdinfo, 0x00, sizeof(struct cfg80211_wifidirect_info) );
+
+	_init_timer( &pcfg80211_wdinfo->remain_on_ch_timer, padapter->pnetdev, ro_ch_timer_process, padapter );
+}
+#endif //CONFIG_IOCTL_CFG80211
+
+void p2p_protocol_wk_hdl(_adapter *padapter, int intCmdType)
+{
+	struct wifidirect_info	*pwdinfo= &(padapter->wdinfo);
+
+_func_enter_;
+
+	switch(intCmdType)
+	{
+		case P2P_FIND_PHASE_WK:
+		{
+			find_phase_handler( padapter );
+			break;
+		}
+		case P2P_RESTORE_STATE_WK:
+		{
+			restore_p2p_state_handler( padapter );
+			break;
+		}
+		case P2P_PRE_TX_PROVDISC_PROCESS_WK:
+		{
+#ifdef CONFIG_CONCURRENT_MODE
+			if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+			{
+				p2p_concurrent_handler( padapter );
+			}
+			else
+			{
+				pre_tx_provdisc_handler( padapter );
+			}
+#else
+			pre_tx_provdisc_handler( padapter );
+#endif
+			break;
+		}
+		case P2P_PRE_TX_INVITEREQ_PROCESS_WK:
+		{
+#ifdef CONFIG_CONCURRENT_MODE
+			if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+			{
+				p2p_concurrent_handler( padapter );
+			}
+			else
+			{
+				pre_tx_invitereq_handler( padapter );
+			}
+#else
+			pre_tx_invitereq_handler( padapter );
+#endif
+			break;
+		}
+		case P2P_PRE_TX_NEGOREQ_PROCESS_WK:
+		{
+#ifdef CONFIG_CONCURRENT_MODE
+			if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+			{
+				p2p_concurrent_handler( padapter );
+			}
+			else
+			{
+				pre_tx_negoreq_handler( padapter );
+			}
+#else
+			pre_tx_negoreq_handler( padapter );
+#endif
+			break;
+		}
+#ifdef CONFIG_P2P
+#ifdef CONFIG_CONCURRENT_MODE
+		case P2P_AP_P2P_CH_SWITCH_PROCESS_WK:
+		{
+			p2p_concurrent_handler( padapter );
+			break;
+		}
+#endif
+#endif
+#ifdef CONFIG_IOCTL_CFG80211
+		case P2P_RO_CH_WK:
+		{
+			ro_ch_handler( padapter );
+			break;
+		}
+#endif //CONFIG_IOCTL_CFG80211
+
+	}
+
+_func_exit_;
+}
+
+#ifdef CONFIG_P2P_PS
+void process_p2p_ps_ie(PADAPTER padapter, u8 *IEs, u32 IELength)
+{
+	u8 * ies;
+	u32 ies_len;
+	u8 * p2p_ie;
+	u32	p2p_ielen = 0;
+	u8	noa_attr[MAX_P2P_IE_LEN] = { 0x00 };// NoA length should be n*(13) + 2
+	u32	attr_contentlen = 0;
+
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+	u8	find_p2p = _FALSE, find_p2p_ps = _FALSE;
+	u8	noa_offset, noa_num, noa_index;
+
+_func_enter_;
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		return;
+	}
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->iface_type != IFACE_PORT0)
+		return;
+#endif
+	if(IELength <= _BEACON_IE_OFFSET_)
+		return;
+
+	ies = IEs + _BEACON_IE_OFFSET_;
+	ies_len = IELength - _BEACON_IE_OFFSET_;
+
+	p2p_ie = rtw_get_p2p_ie( ies, ies_len, NULL, &p2p_ielen);
+
+	while(p2p_ie)
+	{
+		find_p2p = _TRUE;
+		// Get Notice of Absence IE.
+		if(rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_NOA, noa_attr, &attr_contentlen))
+		{
+			find_p2p_ps = _TRUE;
+			noa_index = noa_attr[0];
+
+			if( (pwdinfo->p2p_ps_mode == P2P_PS_NONE) ||
+				(noa_index != pwdinfo->noa_index) )// if index change, driver should reconfigure related setting.
+			{
+				pwdinfo->noa_index = noa_index;
+				pwdinfo->opp_ps = noa_attr[1] >> 7;
+				pwdinfo->ctwindow = noa_attr[1] & 0x7F;
+
+				noa_offset = 2;
+				noa_num = 0;
+				// NoA length should be n*(13) + 2
+				if(attr_contentlen > 2)
+				{
+					while(noa_offset < attr_contentlen)
+					{
+						//_rtw_memcpy(&wifidirect_info->noa_count[noa_num], &noa_attr[noa_offset], 1);
+						pwdinfo->noa_count[noa_num] = noa_attr[noa_offset];
+						noa_offset += 1;
+
+						_rtw_memcpy(&pwdinfo->noa_duration[noa_num], &noa_attr[noa_offset], 4);
+						noa_offset += 4;
+
+						_rtw_memcpy(&pwdinfo->noa_interval[noa_num], &noa_attr[noa_offset], 4);
+						noa_offset += 4;
+
+						_rtw_memcpy(&pwdinfo->noa_start_time[noa_num], &noa_attr[noa_offset], 4);
+						noa_offset += 4;
+
+						noa_num++;
+					}
+				}
+				pwdinfo->noa_num = noa_num;
+
+				if( pwdinfo->opp_ps == 1 )
+				{
+					pwdinfo->p2p_ps_mode = P2P_PS_CTWINDOW;
+					// driver should wait LPS for entering CTWindow
+					if(padapter->pwrctrlpriv.bFwCurrentInPSMode == _TRUE)
+					{
+						p2p_ps_wk_cmd(padapter, P2P_PS_ENABLE, 1);
+					}
+				}
+				else if( pwdinfo->noa_num > 0 )
+				{
+					pwdinfo->p2p_ps_mode = P2P_PS_NOA;
+					p2p_ps_wk_cmd(padapter, P2P_PS_ENABLE, 1);
+				}
+				else if( pwdinfo->p2p_ps_mode > P2P_PS_NONE)
+				{
+					p2p_ps_wk_cmd(padapter, P2P_PS_DISABLE, 1);
+				}
+			}
+
+			break; // find target, just break.
+		}
+
+		//Get the next P2P IE
+		p2p_ie = rtw_get_p2p_ie(p2p_ie+p2p_ielen, ies_len -(p2p_ie -ies + p2p_ielen), NULL, &p2p_ielen);
+
+	}
+
+	if(find_p2p == _TRUE)
+	{
+		if( (pwdinfo->p2p_ps_mode > P2P_PS_NONE) && (find_p2p_ps == _FALSE) )
+		{
+			p2p_ps_wk_cmd(padapter, P2P_PS_DISABLE, 1);
+		}
+	}
+
+_func_exit_;
+}
+
+void p2p_ps_wk_hdl(_adapter *padapter, u8 p2p_ps_state)
+{
+	struct pwrctrl_priv		*pwrpriv = &padapter->pwrctrlpriv;
+	struct wifidirect_info	*pwdinfo= &(padapter->wdinfo);
+
+_func_enter_;
+
+	switch(p2p_ps_state)
+	{
+		case P2P_PS_DISABLE:
+			pwdinfo->p2p_ps_state = p2p_ps_state;
+
+			rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_P2P_PS_OFFLOAD, (u8 *)(&p2p_ps_state));
+
+			pwdinfo->noa_index = 0;
+			pwdinfo->ctwindow = 0;
+			pwdinfo->opp_ps = 0;
+			pwdinfo->noa_num = 0;
+			pwdinfo->p2p_ps_mode = P2P_PS_NONE;
+			if(padapter->pwrctrlpriv.bFwCurrentInPSMode == _TRUE)
+			{
+				if(pwrpriv->smart_ps == 0)
+				{
+					pwrpriv->smart_ps = 2;
+					rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_PWRMODE, (u8 *)(&(padapter->pwrctrlpriv.pwr_mode)));
+				}
+			}
+			break;
+		case P2P_PS_ENABLE:
+			if (pwdinfo->p2p_ps_mode > P2P_PS_NONE) {
+				pwdinfo->p2p_ps_state = p2p_ps_state;
+
+				if( pwdinfo->ctwindow > 0 )
+				{
+					if(pwrpriv->smart_ps != 0)
+					{
+						pwrpriv->smart_ps = 0;
+						DBG_871X("%s(): Enter CTW, change SmartPS\n", __FUNCTION__);
+						rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_PWRMODE, (u8 *)(&(padapter->pwrctrlpriv.pwr_mode)));
+					}
+				}
+				rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_P2P_PS_OFFLOAD, (u8 *)(&p2p_ps_state));
+			}
+			break;
+		case P2P_PS_SCAN:
+		case P2P_PS_SCAN_DONE:
+		case P2P_PS_ALLSTASLEEP:
+			if (pwdinfo->p2p_ps_mode > P2P_PS_NONE) {
+				pwdinfo->p2p_ps_state = p2p_ps_state;
+				rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_P2P_PS_OFFLOAD, (u8 *)(&p2p_ps_state));
+			}
+			break;
+		default:
+			break;
+	}
+
+_func_exit_;
+}
+
+u8 p2p_ps_wk_cmd(_adapter*padapter, u8 p2p_ps_state, u8 enqueue)
+{
+	struct cmd_obj	*ph2c;
+	struct drvextra_cmd_parm	*pdrvextra_cmd_parm;
+	struct wifidirect_info	*pwdinfo= &(padapter->wdinfo);
+	struct cmd_priv	*pcmdpriv = &padapter->cmdpriv;
+	u8	res = _SUCCESS;
+
+_func_enter_;
+
+	if ( rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE)
+#ifdef CONFIG_CONCURRENT_MODE
+		|| (padapter->iface_type != IFACE_PORT0)
+#endif
+		)
+	{
+		return res;
+	}
+
+	if(enqueue)
+	{
+		ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+		if(ph2c==NULL){
+			res= _FAIL;
+			goto exit;
+		}
+
+		pdrvextra_cmd_parm = (struct drvextra_cmd_parm*)rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
+		if(pdrvextra_cmd_parm==NULL){
+			rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+			res= _FAIL;
+			goto exit;
+		}
+
+		pdrvextra_cmd_parm->ec_id = P2P_PS_WK_CID;
+		pdrvextra_cmd_parm->type_size = p2p_ps_state;
+		pdrvextra_cmd_parm->pbuf = NULL;
+
+		init_h2fwcmd_w_parm_no_rsp(ph2c, pdrvextra_cmd_parm, GEN_CMD_CODE(_Set_Drv_Extra));
+
+		res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+	}
+	else
+	{
+		p2p_ps_wk_hdl(padapter, p2p_ps_state);
+	}
+
+exit:
+
+_func_exit_;
+
+	return res;
+
+}
+#endif // CONFIG_P2P_PS
+
+static void reset_ch_sitesurvey_timer_process (void *FunctionContext)
+{
+	_adapter *adapter = (_adapter *)FunctionContext;
+	struct	wifidirect_info		*pwdinfo = &adapter->wdinfo;
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		return;
+
+	DBG_871X( "[%s] In\n", __FUNCTION__ );
+	//	Reset the operation channel information
+	pwdinfo->rx_invitereq_info.operation_ch[0] = 0;
+#ifdef P2P_OP_CHECK_SOCIAL_CH
+	pwdinfo->rx_invitereq_info.operation_ch[1] = 0;
+	pwdinfo->rx_invitereq_info.operation_ch[2] = 0;
+	pwdinfo->rx_invitereq_info.operation_ch[3] = 0;
+#endif //P2P_OP_CHECK_SOCIAL_CH
+	pwdinfo->rx_invitereq_info.scan_op_ch_only = 0;
+}
+
+static void reset_ch_sitesurvey_timer_process2 (void *FunctionContext)
+{
+	_adapter *adapter = (_adapter *)FunctionContext;
+	struct	wifidirect_info		*pwdinfo = &adapter->wdinfo;
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		return;
+
+	DBG_871X( "[%s] In\n", __FUNCTION__ );
+	//	Reset the operation channel information
+	pwdinfo->p2p_info.operation_ch[0] = 0;
+#ifdef P2P_OP_CHECK_SOCIAL_CH
+	pwdinfo->p2p_info.operation_ch[1] = 0;
+	pwdinfo->p2p_info.operation_ch[2] = 0;
+	pwdinfo->p2p_info.operation_ch[3] = 0;
+#endif //P2P_OP_CHECK_SOCIAL_CH
+	pwdinfo->p2p_info.scan_op_ch_only = 0;
+}
+
+static void restore_p2p_state_timer_process (void *FunctionContext)
+{
+	_adapter *adapter = (_adapter *)FunctionContext;
+	struct	wifidirect_info		*pwdinfo = &adapter->wdinfo;
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		return;
+
+	p2p_protocol_wk_cmd( adapter, P2P_RESTORE_STATE_WK );
+}
+
+static void pre_tx_scan_timer_process (void *FunctionContext)
+{
+	_adapter 							*adapter = (_adapter *) FunctionContext;
+	struct	wifidirect_info				*pwdinfo = &adapter->wdinfo;
+	_irqL							irqL;
+	struct mlme_priv					*pmlmepriv = &adapter->mlmepriv;
+	u8								_status = 0;
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		return;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+	//	Commented by Albert 20110805
+	//	Todo: Use the issuing probe request directly instead of using the rtw_sitesurvey_cmd!!
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_TX_PROVISION_DIS_REQ))
+	{
+		if ( _TRUE == pwdinfo->tx_prov_disc_info.benable )	//	the provision discovery request frame is trigger to send or not
+		{
+			p2p_protocol_wk_cmd( adapter, P2P_PRE_TX_PROVDISC_PROCESS_WK );
+			//issue_probereq_p2p(adapter, NULL);
+			//_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+		}
+	}
+	else if (rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_ING))
+	{
+		if ( _TRUE == pwdinfo->nego_req_info.benable )
+		{
+			p2p_protocol_wk_cmd( adapter, P2P_PRE_TX_NEGOREQ_PROCESS_WK );
+			//issue_probereq_p2p(adapter, NULL);
+			//_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+		}
+	}
+	else if ( rtw_p2p_chk_state(pwdinfo, P2P_STATE_TX_INVITE_REQ ) )
+	{
+		if ( _TRUE == pwdinfo->invitereq_info.benable )
+		{
+			p2p_protocol_wk_cmd( adapter, P2P_PRE_TX_INVITEREQ_PROCESS_WK );
+		}
+	}
+	else
+	{
+		DBG_8192C( "[%s] p2p_state is %d, ignore!!\n", __FUNCTION__, rtw_p2p_state(pwdinfo) );
+	}
+
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+}
+
+static void find_phase_timer_process (void *FunctionContext)
+{
+	_adapter *adapter = (_adapter *)FunctionContext;
+	struct	wifidirect_info		*pwdinfo = &adapter->wdinfo;
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		return;
+
+	adapter->wdinfo.find_phase_state_exchange_cnt++;
+
+	p2p_protocol_wk_cmd( adapter, P2P_FIND_PHASE_WK );
+}
+
+#ifdef CONFIG_CONCURRENT_MODE
+void ap_p2p_switch_timer_process (void *FunctionContext)
+{
+	_adapter *adapter = (_adapter *)FunctionContext;
+	struct	wifidirect_info		*pwdinfo = &adapter->wdinfo;
+#ifdef CONFIG_IOCTL_CFG80211
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(adapter->rtw_wdev);
+#endif
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		return;
+
+#ifdef CONFIG_IOCTL_CFG80211
+	ATOMIC_SET(&pwdev_priv->switch_ch_to, 1);
+#endif
+
+	p2p_protocol_wk_cmd( adapter, P2P_AP_P2P_CH_SWITCH_PROCESS_WK );
+}
+#endif
+
+void reset_global_wifidirect_info( _adapter* padapter )
+{
+	struct wifidirect_info	*pwdinfo;
+
+	pwdinfo = &padapter->wdinfo;
+	pwdinfo->persistent_supported = 0;
+	pwdinfo->session_available = _TRUE;
+	pwdinfo->wfd_tdls_enable = 0;
+	pwdinfo->wfd_tdls_weaksec = 0;
+}
+
+#ifdef CONFIG_WFD
+int rtw_init_wifi_display_info(_adapter* padapter)
+{
+	int	res = _SUCCESS;
+	struct wifi_display_info *pwfd_info = &padapter->wfd_info;
+
+	// Used in P2P and TDLS
+	pwfd_info->rtsp_ctrlport = 554;
+	pwfd_info->peer_rtsp_ctrlport = 0;	//	Reset to 0
+	pwfd_info->wfd_enable = _FALSE;
+	pwfd_info->wfd_device_type = WFD_DEVINFO_PSINK;
+	pwfd_info->scan_result_type = SCAN_RESULT_P2P_ONLY;
+
+	// Used in P2P
+	pwfd_info->peer_session_avail = _TRUE;
+	pwfd_info->wfd_pc = _FALSE;
+
+	// Used in TDLS
+	_rtw_memset( pwfd_info->ip_address, 0x00, 4 );
+	_rtw_memset( pwfd_info->peer_ip_address, 0x00, 4 );
+	return res;
+
+}
+#endif //CONFIG_WFD
+
+void rtw_init_wifidirect_timers(_adapter* padapter)
+{
+	struct wifidirect_info *pwdinfo = &padapter->wdinfo;
+
+	_init_timer( &pwdinfo->find_phase_timer, padapter->pnetdev, find_phase_timer_process, padapter );
+	_init_timer( &pwdinfo->restore_p2p_state_timer, padapter->pnetdev, restore_p2p_state_timer_process, padapter );
+	_init_timer( &pwdinfo->pre_tx_scan_timer, padapter->pnetdev, pre_tx_scan_timer_process, padapter );
+	_init_timer( &pwdinfo->reset_ch_sitesurvey, padapter->pnetdev, reset_ch_sitesurvey_timer_process, padapter );
+	_init_timer( &pwdinfo->reset_ch_sitesurvey2, padapter->pnetdev, reset_ch_sitesurvey_timer_process2, padapter );
+#ifdef CONFIG_CONCURRENT_MODE
+	_init_timer( &pwdinfo->ap_p2p_switch_timer, padapter->pnetdev, ap_p2p_switch_timer_process, padapter );
+#endif
+}
+
+void rtw_init_wifidirect_addrs(_adapter* padapter, u8 *dev_addr, u8 *iface_addr)
+{
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo = &padapter->wdinfo;
+
+	/*init device&interface address */
+	if (dev_addr) {
+		_rtw_memcpy(pwdinfo->device_addr, dev_addr, ETH_ALEN);
+	}
+	if (iface_addr) {
+		_rtw_memcpy(pwdinfo->interface_addr, iface_addr, ETH_ALEN);
+	}
+#endif
+}
+
+void init_wifidirect_info( _adapter* padapter, enum P2P_ROLE role)
+{
+	struct wifidirect_info	*pwdinfo;
+#ifdef CONFIG_WFD
+	struct wifi_display_info	*pwfd_info = &padapter->wfd_info;
+#endif
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+	struct wifidirect_info	*pbuddy_wdinfo = NULL;
+	struct mlme_priv		*pbuddy_mlmepriv = NULL;
+	struct mlme_ext_priv	*pbuddy_mlmeext = NULL;
+#endif
+
+	pwdinfo = &padapter->wdinfo;
+
+	pwdinfo->padapter = padapter;
+
+	//	1, 6, 11 are the social channel defined in the WiFi Direct specification.
+	pwdinfo->social_chan[0] = 1;
+	pwdinfo->social_chan[1] = 6;
+	pwdinfo->social_chan[2] = 11;
+	pwdinfo->social_chan[3] = 0;	//	channel 0 for scanning ending in site survey function.
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (pbuddy_adapter) {
+		pbuddy_wdinfo = &pbuddy_adapter->wdinfo;
+		pbuddy_mlmepriv = &pbuddy_adapter->mlmepriv;
+		pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+	}
+
+	if ( ( check_buddy_fwstate(padapter, _FW_LINKED ) == _TRUE ) &&
+	      ( ( pbuddy_mlmeext->cur_channel == 1) || ( pbuddy_mlmeext->cur_channel == 6 ) || ( pbuddy_mlmeext->cur_channel == 11 ) )
+	   )
+	{
+		//	Use the AP's channel as the listen channel
+		//	This will avoid the channel switch between AP's channel and listen channel.
+		pwdinfo->listen_channel = pbuddy_mlmeext->cur_channel;
+	}
+	else
+#endif //CONFIG_CONCURRENT_MODE
+	{
+		//	Use the channel 11 as the listen channel
+		pwdinfo->listen_channel = 11;
+	}
+
+	if (role == P2P_ROLE_DEVICE)
+	{
+		rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+		#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) == _TRUE )
+		{
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_IDLE);
+		}
+		else
+		#endif
+		{
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_LISTEN);
+		}
+		pwdinfo->intent = 1;
+		rtw_p2p_set_pre_state(pwdinfo, P2P_STATE_LISTEN);
+	}
+	else if (role == P2P_ROLE_CLIENT)
+	{
+		rtw_p2p_set_role(pwdinfo, P2P_ROLE_CLIENT);
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_OK);
+		pwdinfo->intent = 1;
+		rtw_p2p_set_pre_state(pwdinfo, P2P_STATE_GONEGO_OK);
+	}
+	else if (role == P2P_ROLE_GO)
+	{
+		rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO);
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_OK);
+		pwdinfo->intent = 15;
+		rtw_p2p_set_pre_state(pwdinfo, P2P_STATE_GONEGO_OK);
+	}
+
+//	Use the OFDM rate in the P2P probe response frame. ( 6(B), 9(B), 12, 18, 24, 36, 48, 54 )
+	pwdinfo->support_rate[0] = 0x8c;	//	6(B)
+	pwdinfo->support_rate[1] = 0x92;	//	9(B)
+	pwdinfo->support_rate[2] = 0x18;	//	12
+	pwdinfo->support_rate[3] = 0x24;	//	18
+	pwdinfo->support_rate[4] = 0x30;	//	24
+	pwdinfo->support_rate[5] = 0x48;	//	36
+	pwdinfo->support_rate[6] = 0x60;	//	48
+	pwdinfo->support_rate[7] = 0x6c;	//	54
+
+	_rtw_memcpy( ( void* ) pwdinfo->p2p_wildcard_ssid, "DIRECT-", 7 );
+
+	_rtw_memset( pwdinfo->device_name, 0x00, WPS_MAX_DEVICE_NAME_LEN );
+	pwdinfo->device_name_len = 0;
+
+	_rtw_memset( &pwdinfo->invitereq_info, 0x00, sizeof( struct tx_invite_req_info ) );
+	pwdinfo->invitereq_info.token = 3;	//	Token used for P2P invitation request frame.
+
+	_rtw_memset( &pwdinfo->inviteresp_info, 0x00, sizeof( struct tx_invite_resp_info ) );
+	pwdinfo->inviteresp_info.token = 0;
+
+	pwdinfo->profileindex = 0;
+	_rtw_memset( &pwdinfo->profileinfo[ 0 ], 0x00, sizeof( struct profile_info ) * P2P_MAX_PERSISTENT_GROUP_NUM );
+
+	rtw_p2p_findphase_ex_set(pwdinfo, P2P_FINDPHASE_EX_NONE);
+
+	pwdinfo->listen_dwell = ( u8 ) (( rtw_get_current_time() % 3 ) + 1);
+	//DBG_8192C( "[%s] listen_dwell time is %d00ms\n", __FUNCTION__, pwdinfo->listen_dwell );
+
+	_rtw_memset( &pwdinfo->tx_prov_disc_info, 0x00, sizeof( struct tx_provdisc_req_info ) );
+	pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_NONE;
+
+	_rtw_memset( &pwdinfo->nego_req_info, 0x00, sizeof( struct tx_nego_req_info ) );
+
+	pwdinfo->device_password_id_for_nego = WPS_DPID_PBC;
+	pwdinfo->negotiation_dialog_token = 1;
+
+	_rtw_memset( pwdinfo->nego_ssid, 0x00, WLAN_SSID_MAXLEN );
+	pwdinfo->nego_ssidlen = 0;
+
+	pwdinfo->ui_got_wps_info = P2P_NO_WPSINFO;
+#ifdef CONFIG_WFD
+	pwdinfo->supported_wps_cm = WPS_CONFIG_METHOD_DISPLAY  | WPS_CONFIG_METHOD_PBC;
+	pwdinfo->wfd_info = pwfd_info;
+#else
+	pwdinfo->supported_wps_cm = WPS_CONFIG_METHOD_DISPLAY | WPS_CONFIG_METHOD_PBC | WPS_CONFIG_METHOD_KEYPAD;
+#endif //CONFIG_WFD
+	pwdinfo->channel_list_attr_len = 0;
+	_rtw_memset( pwdinfo->channel_list_attr, 0x00, 100 );
+
+	_rtw_memset( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, 0x00, 4 );
+	_rtw_memset( pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req, '0', 3 );
+	_rtw_memset( &pwdinfo->groupid_info, 0x00, sizeof( struct group_id_info ) );
+#ifdef CONFIG_CONCURRENT_MODE
+#ifdef CONFIG_IOCTL_CFG80211
+	pwdinfo->ext_listen_interval = 1000; //The interval to be available with legacy AP during p2p0-find/scan
+	pwdinfo->ext_listen_period = 3000; //The time period to be available for P2P during nego
+#else //!CONFIG_IOCTL_CFG80211
+	//pwdinfo->ext_listen_interval = 3000;
+	//pwdinfo->ext_listen_period = 400;
+	pwdinfo->ext_listen_interval = 1000;
+	pwdinfo->ext_listen_period = 1000;
+#endif //!CONFIG_IOCTL_CFG80211
+#endif
+
+// Commented by Kurt 20130319
+// For WiDi purpose: Use CFG80211 interface but controled WFD/RDS frame by driver itself.
+#ifdef CONFIG_IOCTL_CFG80211
+	pwdinfo->driver_interface = DRIVER_CFG80211;
+#else
+	pwdinfo->driver_interface = DRIVER_WEXT;
+#endif //CONFIG_IOCTL_CFG80211
+
+	pwdinfo->wfd_tdls_enable = 0;
+	_rtw_memset( pwdinfo->p2p_peer_interface_addr, 0x00, ETH_ALEN );
+	_rtw_memset( pwdinfo->p2p_peer_device_addr, 0x00, ETH_ALEN );
+
+	pwdinfo->rx_invitereq_info.operation_ch[0] = 0;
+	pwdinfo->rx_invitereq_info.operation_ch[1] = 0;	//	Used to indicate the scan end in site survey function
+#ifdef P2P_OP_CHECK_SOCIAL_CH
+	pwdinfo->rx_invitereq_info.operation_ch[2] = 0;
+	pwdinfo->rx_invitereq_info.operation_ch[3] = 0;
+	pwdinfo->rx_invitereq_info.operation_ch[4] = 0;
+#endif //P2P_OP_CHECK_SOCIAL_CH
+	pwdinfo->rx_invitereq_info.scan_op_ch_only = 0;
+	pwdinfo->p2p_info.operation_ch[0] = 0;
+	pwdinfo->p2p_info.operation_ch[1] = 0;			//	Used to indicate the scan end in site survey function
+#ifdef P2P_OP_CHECK_SOCIAL_CH
+	pwdinfo->p2p_info.operation_ch[2] = 0;
+	pwdinfo->p2p_info.operation_ch[3] = 0;
+	pwdinfo->p2p_info.operation_ch[4] = 0;
+#endif //P2P_OP_CHECK_SOCIAL_CH
+	pwdinfo->p2p_info.scan_op_ch_only = 0;
+}
+
+#ifdef CONFIG_DBG_P2P
+
+/**
+ * rtw_p2p_role_txt - Get the p2p role name as a text string
+ * @role: P2P role
+ * Returns: The state name as a printable text string
+ */
+const char * rtw_p2p_role_txt(enum P2P_ROLE role)
+{
+	switch (role) {
+	case P2P_ROLE_DISABLE:
+		return "P2P_ROLE_DISABLE";
+	case P2P_ROLE_DEVICE:
+		return "P2P_ROLE_DEVICE";
+	case P2P_ROLE_CLIENT:
+		return "P2P_ROLE_CLIENT";
+	case P2P_ROLE_GO:
+		return "P2P_ROLE_GO";
+	default:
+		return "UNKNOWN";
+	}
+}
+
+/**
+ * rtw_p2p_state_txt - Get the p2p state name as a text string
+ * @state: P2P state
+ * Returns: The state name as a printable text string
+ */
+const char * rtw_p2p_state_txt(enum P2P_STATE state)
+{
+	switch (state) {
+	case P2P_STATE_NONE:
+		return "P2P_STATE_NONE";
+	case P2P_STATE_IDLE:
+		return "P2P_STATE_IDLE";
+	case P2P_STATE_LISTEN:
+		return "P2P_STATE_LISTEN";
+	case P2P_STATE_SCAN:
+		return "P2P_STATE_SCAN";
+	case P2P_STATE_FIND_PHASE_LISTEN:
+		return "P2P_STATE_FIND_PHASE_LISTEN";
+	case P2P_STATE_FIND_PHASE_SEARCH:
+		return "P2P_STATE_FIND_PHASE_SEARCH";
+	case P2P_STATE_TX_PROVISION_DIS_REQ:
+		return "P2P_STATE_TX_PROVISION_DIS_REQ";
+	case P2P_STATE_RX_PROVISION_DIS_RSP:
+		return "P2P_STATE_RX_PROVISION_DIS_RSP";
+	case P2P_STATE_RX_PROVISION_DIS_REQ:
+		return "P2P_STATE_RX_PROVISION_DIS_REQ";
+	case P2P_STATE_GONEGO_ING:
+		return "P2P_STATE_GONEGO_ING";
+	case P2P_STATE_GONEGO_OK:
+		return "P2P_STATE_GONEGO_OK";
+	case P2P_STATE_GONEGO_FAIL:
+		return "P2P_STATE_GONEGO_FAIL";
+	case P2P_STATE_RECV_INVITE_REQ_MATCH:
+		return "P2P_STATE_RECV_INVITE_REQ_MATCH";
+	case P2P_STATE_PROVISIONING_ING:
+		return "P2P_STATE_PROVISIONING_ING";
+	case P2P_STATE_PROVISIONING_DONE:
+		return "P2P_STATE_PROVISIONING_DONE";
+	case P2P_STATE_TX_INVITE_REQ:
+		return "P2P_STATE_TX_INVITE_REQ";
+	case P2P_STATE_RX_INVITE_RESP_OK:
+		return "P2P_STATE_RX_INVITE_RESP_OK";
+	case P2P_STATE_RECV_INVITE_REQ_DISMATCH:
+		return "P2P_STATE_RECV_INVITE_REQ_DISMATCH";
+	case P2P_STATE_RECV_INVITE_REQ_GO:
+		return "P2P_STATE_RECV_INVITE_REQ_GO";
+	case P2P_STATE_RECV_INVITE_REQ_JOIN:
+		return "P2P_STATE_RECV_INVITE_REQ_JOIN";
+	case P2P_STATE_RX_INVITE_RESP_FAIL:
+		return "P2P_STATE_RX_INVITE_RESP_FAIL";
+	case P2P_STATE_RX_INFOR_NOREADY:
+		return "P2P_STATE_RX_INFOR_NOREADY";
+	case P2P_STATE_TX_INFOR_NOREADY:
+		return "P2P_STATE_TX_INFOR_NOREADY";
+	default:
+		return "UNKNOWN";
+	}
+}
+
+void dbg_rtw_p2p_set_state(struct wifidirect_info *wdinfo, enum P2P_STATE state, const char *caller, int line)
+{
+	if(!_rtw_p2p_chk_state(wdinfo, state)) {
+		enum P2P_STATE old_state = _rtw_p2p_state(wdinfo);
+		_rtw_p2p_set_state(wdinfo, state);
+		DBG_871X("[CONFIG_DBG_P2P]%s:%d set_state from %s to %s\n", caller, line
+			, rtw_p2p_state_txt(old_state), rtw_p2p_state_txt(_rtw_p2p_state(wdinfo))
+		);
+	} else {
+		DBG_871X("[CONFIG_DBG_P2P]%s:%d set_state to same state %s\n", caller, line
+			, rtw_p2p_state_txt(_rtw_p2p_state(wdinfo))
+		);
+	}
+}
+void dbg_rtw_p2p_set_pre_state(struct wifidirect_info *wdinfo, enum P2P_STATE state, const char *caller, int line)
+{
+	if(_rtw_p2p_pre_state(wdinfo) != state) {
+		enum P2P_STATE old_state = _rtw_p2p_pre_state(wdinfo);
+		_rtw_p2p_set_pre_state(wdinfo, state);
+		DBG_871X("[CONFIG_DBG_P2P]%s:%d set_pre_state from %s to %s\n", caller, line
+			, rtw_p2p_state_txt(old_state), rtw_p2p_state_txt(_rtw_p2p_pre_state(wdinfo))
+		);
+	} else {
+		DBG_871X("[CONFIG_DBG_P2P]%s:%d set_pre_state to same state %s\n", caller, line
+			, rtw_p2p_state_txt(_rtw_p2p_pre_state(wdinfo))
+		);
+	}
+}
+#if 0
+void dbg_rtw_p2p_restore_state(struct wifidirect_info *wdinfo, const char *caller, int line)
+{
+	if(wdinfo->pre_p2p_state != -1) {
+		DBG_871X("[CONFIG_DBG_P2P]%s:%d restore from %s to %s\n", caller, line
+			, p2p_state_str[wdinfo->p2p_state], p2p_state_str[wdinfo->pre_p2p_state]
+		);
+		_rtw_p2p_restore_state(wdinfo);
+	} else {
+		DBG_871X("[CONFIG_DBG_P2P]%s:%d restore no pre state, cur state %s\n", caller, line
+			, p2p_state_str[wdinfo->p2p_state]
+		);
+	}
+}
+#endif
+void dbg_rtw_p2p_set_role(struct wifidirect_info *wdinfo, enum P2P_ROLE role, const char *caller, int line)
+{
+	if(wdinfo->role != role) {
+		enum P2P_ROLE old_role = wdinfo->role;
+		_rtw_p2p_set_role(wdinfo, role);
+		DBG_871X("[CONFIG_DBG_P2P]%s:%d set_role from %s to %s\n", caller, line
+			, rtw_p2p_role_txt(old_role), rtw_p2p_role_txt(wdinfo->role)
+		);
+	} else {
+		DBG_871X("[CONFIG_DBG_P2P]%s:%d set_role to same role %s\n", caller, line
+			, rtw_p2p_role_txt(wdinfo->role)
+		);
+	}
+}
+#endif //CONFIG_DBG_P2P
+
+
+int rtw_p2p_enable(_adapter *padapter, enum P2P_ROLE role)
+{
+	int ret = _SUCCESS;
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+
+	if (role == P2P_ROLE_DEVICE || role == P2P_ROLE_CLIENT|| role == P2P_ROLE_GO)
+	{
+		u8 channel, ch_offset;
+		u16 bwmode;
+
+#ifdef CONFIG_CONCURRENT_MODE
+		_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+		struct wifidirect_info	*pbuddy_wdinfo = &pbuddy_adapter->wdinfo;
+		//	Commented by Albert 2011/12/30
+		//	The driver just supports 1 P2P group operation.
+		//	So, this function will do nothing if the buddy adapter had enabled the P2P function.
+		if(!rtw_p2p_chk_state(pbuddy_wdinfo, P2P_STATE_NONE))
+		{
+			//	The buddy adapter had enabled the P2P function.
+			return ret;
+		}
+#endif //CONFIG_CONCURRENT_MODE
+
+		//leave IPS/Autosuspend
+		if (_FAIL == rtw_pwr_wakeup(padapter)) {
+			ret = _FAIL;
+			goto exit;
+		}
+
+
+		//	Added by Albert 2011/03/22
+		//	In the P2P mode, the driver should not support the b mode.
+		//	So, the Tx packet shouldn't use the CCK rate
+		update_tx_basic_rate(padapter, WIRELESS_11AGN);
+
+		//Enable P2P function
+		init_wifidirect_info(padapter, role);
+	}
+	else if (role == P2P_ROLE_DISABLE)
+	{
+#ifdef CONFIG_INTEL_WIDI
+		if( padapter->mlmepriv.p2p_reject_disable == _TRUE )
+			return ret;
+#endif //CONFIG_INTEL_WIDI
+
+		if (_FAIL == rtw_pwr_wakeup(padapter)) {
+			ret = _FAIL;
+			goto exit;
+		}
+
+		//Disable P2P function
+		if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		{
+			_cancel_timer_ex( &pwdinfo->find_phase_timer );
+			_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+			_cancel_timer_ex( &pwdinfo->pre_tx_scan_timer);
+			_cancel_timer_ex( &pwdinfo->reset_ch_sitesurvey);
+			_cancel_timer_ex( &pwdinfo->reset_ch_sitesurvey2);
+			reset_ch_sitesurvey_timer_process( padapter );
+			reset_ch_sitesurvey_timer_process2( padapter );
+			#ifdef CONFIG_CONCURRENT_MODE
+			_cancel_timer_ex( &pwdinfo->ap_p2p_switch_timer);
+			#endif
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_NONE);
+			rtw_p2p_set_role(pwdinfo, P2P_ROLE_DISABLE);
+			_rtw_memset(&pwdinfo->rx_prov_disc_info, 0x00, sizeof(struct rx_provdisc_req_info));
+		}
+
+		//Restore to initial setting.
+		update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
+
+#ifdef CONFIG_INTEL_WIDI
+		rtw_reset_widi_info(padapter);
+#endif //CONFIG_INTEL_WIDI
+
+		//For WiDi purpose.
+#ifdef CONFIG_IOCTL_CFG80211
+		pwdinfo->driver_interface = DRIVER_CFG80211;
+#else
+		pwdinfo->driver_interface = DRIVER_WEXT;
+#endif //CONFIG_IOCTL_CFG80211
+
+	}
+
+exit:
+	return ret;
+}
+
+#endif //CONFIG_P2P
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_pwrctrl.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_pwrctrl.c
new file mode 100644
index 000000000000..63f865581970
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_pwrctrl.c
@@ -0,0 +1,1538 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_PWRCTRL_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <osdep_intf.h>
+
+
+#ifdef CONFIG_IPS
+void _ips_enter(_adapter * padapter)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+
+	pwrpriv->bips_processing = _TRUE;
+
+	// syn ips_mode with request
+	pwrpriv->ips_mode = pwrpriv->ips_mode_req;
+
+	pwrpriv->ips_enter_cnts++;
+	DBG_871X("==>ips_enter cnts:%d\n",pwrpriv->ips_enter_cnts);
+
+	if(rf_off == pwrpriv->change_rfpwrstate)
+	{
+		if(pwrpriv->ips_mode == IPS_LEVEL_2)
+			pwrpriv->bkeepfwalive = _TRUE;
+
+		rtw_ips_pwr_down(padapter);
+		pwrpriv->rf_pwrstate = rf_off;
+	}
+	pwrpriv->bips_processing = _FALSE;
+
+}
+
+void ips_enter(_adapter * padapter)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+
+	_enter_pwrlock(&pwrpriv->lock);
+	_ips_enter(padapter);
+	_exit_pwrlock(&pwrpriv->lock);
+}
+
+int _ips_leave(_adapter * padapter)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	int result = _SUCCESS;
+
+	if((pwrpriv->rf_pwrstate == rf_off) &&(!pwrpriv->bips_processing))
+	{
+		pwrpriv->bips_processing = _TRUE;
+		pwrpriv->change_rfpwrstate = rf_on;
+		pwrpriv->ips_leave_cnts++;
+		DBG_871X("==>ips_leave cnts:%d\n",pwrpriv->ips_leave_cnts);
+
+		if ((result = rtw_ips_pwr_up(padapter)) == _SUCCESS) {
+			pwrpriv->rf_pwrstate = rf_on;
+		}
+
+		DBG_871X("==> ips_leave.....LED(0x%08x)...\n",rtw_read32(padapter,0x4c));
+		pwrpriv->bips_processing = _FALSE;
+
+		pwrpriv->bkeepfwalive = _FALSE;
+	}
+
+	return result;
+}
+
+int ips_leave(_adapter * padapter)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	int ret;
+
+	_enter_pwrlock(&pwrpriv->lock);
+	ret = _ips_leave(padapter);
+	_exit_pwrlock(&pwrpriv->lock);
+
+	return ret;
+}
+#endif /* CONFIG_IPS */
+
+#ifdef CONFIG_AUTOSUSPEND
+extern void autosuspend_enter(_adapter* padapter);
+extern int autoresume_enter(_adapter* padapter);
+#endif
+
+#ifdef SUPPORT_HW_RFOFF_DETECTED
+int rtw_hw_suspend(_adapter *padapter );
+int rtw_hw_resume(_adapter *padapter);
+#endif
+
+bool rtw_pwr_unassociated_idle(_adapter *adapter)
+{
+	_adapter *buddy = adapter->pbuddy_adapter;
+	struct mlme_priv *pmlmepriv = &(adapter->mlmepriv);
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &(adapter->wdinfo);
+#ifdef CONFIG_IOCTL_CFG80211
+	struct cfg80211_wifidirect_info *pcfg80211_wdinfo = &adapter->cfg80211_wdinfo;
+#endif
+#endif
+
+	bool ret = _FALSE;
+
+	if (adapter->pwrctrlpriv.ips_deny_time >= rtw_get_current_time()) {
+		//DBG_871X("%s ips_deny_time\n", __func__);
+		goto exit;
+	}
+
+	if (check_fwstate(pmlmepriv, WIFI_ASOC_STATE|WIFI_SITE_MONITOR)
+		|| check_fwstate(pmlmepriv, WIFI_UNDER_LINKING|WIFI_UNDER_WPS)
+		|| check_fwstate(pmlmepriv, WIFI_AP_STATE)
+		|| check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE|WIFI_ADHOC_STATE)
+		#if defined(CONFIG_P2P) && defined(CONFIG_IOCTL_CFG80211) && defined(CONFIG_P2P_IPS)
+		|| pcfg80211_wdinfo->is_ro_ch
+		#elif defined(CONFIG_P2P)
+		|| !rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE)
+		#endif
+	) {
+		goto exit;
+	}
+
+	/* consider buddy, if exist */
+	if (buddy) {
+		struct mlme_priv *b_pmlmepriv = &(buddy->mlmepriv);
+		#ifdef CONFIG_P2P
+		struct wifidirect_info *b_pwdinfo = &(buddy->wdinfo);
+		#ifdef CONFIG_IOCTL_CFG80211
+		struct cfg80211_wifidirect_info *b_pcfg80211_wdinfo = &buddy->cfg80211_wdinfo;
+		#endif
+		#endif
+
+		if (check_fwstate(b_pmlmepriv, WIFI_ASOC_STATE|WIFI_SITE_MONITOR)
+			|| check_fwstate(b_pmlmepriv, WIFI_UNDER_LINKING|WIFI_UNDER_WPS)
+			|| check_fwstate(b_pmlmepriv, WIFI_AP_STATE)
+			|| check_fwstate(b_pmlmepriv, WIFI_ADHOC_MASTER_STATE|WIFI_ADHOC_STATE)
+			#if defined(CONFIG_P2P) && defined(CONFIG_IOCTL_CFG80211) && defined(CONFIG_P2P_IPS)
+			|| b_pcfg80211_wdinfo->is_ro_ch
+			#elif defined(CONFIG_P2P)
+			|| !rtw_p2p_chk_state(b_pwdinfo, P2P_STATE_NONE)
+			#endif
+		) {
+			goto exit;
+		}
+	}
+
+#ifdef CONFIG_INTEL_PROXIM
+	if(adapter->proximity.proxim_on==_TRUE){
+		return;
+	}
+#endif
+
+	ret = _TRUE;
+
+exit:
+	return ret;
+}
+
+#if defined (PLATFORM_LINUX)||defined (PLATFORM_FREEBSD)
+void rtw_ps_processor(_adapter*padapter)
+{
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+#endif //CONFIG_P2P
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+#ifdef SUPPORT_HW_RFOFF_DETECTED
+	rt_rf_power_state rfpwrstate;
+#endif //SUPPORT_HW_RFOFF_DETECTED
+
+	pwrpriv->ps_processing = _TRUE;
+
+#ifdef SUPPORT_HW_RFOFF_DETECTED
+	if(pwrpriv->bips_processing == _TRUE)
+		goto exit;
+
+	//DBG_871X("==> fw report state(0x%x)\n",rtw_read8(padapter,0x1ca));
+	if(padapter->pwrctrlpriv.bHWPwrPindetect)
+	{
+	#ifdef CONFIG_AUTOSUSPEND
+		if(padapter->registrypriv.usbss_enable)
+		{
+			if(pwrpriv->rf_pwrstate == rf_on)
+			{
+				if(padapter->net_closed == _TRUE)
+					pwrpriv->ps_flag = _TRUE;
+
+				rfpwrstate = RfOnOffDetect(padapter);
+				DBG_871X("@@@@- #1  %s==> rfstate:%s \n",__FUNCTION__,(rfpwrstate==rf_on)?"rf_on":"rf_off");
+				if(rfpwrstate!= pwrpriv->rf_pwrstate)
+				{
+					if(rfpwrstate == rf_off)
+					{
+						pwrpriv->change_rfpwrstate = rf_off;
+
+						pwrpriv->bkeepfwalive = _TRUE;
+						pwrpriv->brfoffbyhw = _TRUE;
+
+						autosuspend_enter(padapter);
+					}
+				}
+			}
+		}
+		else
+	#endif //CONFIG_AUTOSUSPEND
+		{
+			rfpwrstate = RfOnOffDetect(padapter);
+			DBG_871X("@@@@- #2  %s==> rfstate:%s \n",__FUNCTION__,(rfpwrstate==rf_on)?"rf_on":"rf_off");
+
+			if(rfpwrstate!= pwrpriv->rf_pwrstate)
+			{
+				if(rfpwrstate == rf_off)
+				{
+					pwrpriv->change_rfpwrstate = rf_off;
+					pwrpriv->brfoffbyhw = _TRUE;
+					padapter->bCardDisableWOHSM = _TRUE;
+					rtw_hw_suspend(padapter );
+				}
+				else
+				{
+					pwrpriv->change_rfpwrstate = rf_on;
+					rtw_hw_resume(padapter );
+				}
+				DBG_871X("current rf_pwrstate(%s)\n",(pwrpriv->rf_pwrstate == rf_off)?"rf_off":"rf_on");
+			}
+		}
+		pwrpriv->pwr_state_check_cnts ++;
+	}
+#endif //SUPPORT_HW_RFOFF_DETECTED
+
+	if (pwrpriv->ips_mode_req == IPS_NONE
+		#ifdef CONFIG_CONCURRENT_MODE
+		|| padapter->pbuddy_adapter->pwrctrlpriv.ips_mode_req == IPS_NONE
+		#endif
+	)
+		goto exit;
+
+	if (rtw_pwr_unassociated_idle(padapter) == _FALSE)
+		goto exit;
+
+	if((pwrpriv->rf_pwrstate == rf_on) && ((pwrpriv->pwr_state_check_cnts%4)==0))
+	{
+		DBG_871X("==>%s .fw_state(%x)\n",__FUNCTION__,get_fwstate(pmlmepriv));
+		pwrpriv->change_rfpwrstate = rf_off;
+
+		#ifdef CONFIG_AUTOSUSPEND
+		if(padapter->registrypriv.usbss_enable)
+		{
+			if(pwrpriv->bHWPwrPindetect)
+				pwrpriv->bkeepfwalive = _TRUE;
+
+			if(padapter->net_closed == _TRUE)
+				pwrpriv->ps_flag = _TRUE;
+
+			padapter->bCardDisableWOHSM = _TRUE;
+			autosuspend_enter(padapter);
+		}
+		else if(pwrpriv->bHWPwrPindetect)
+		{
+		}
+		else
+		#endif //CONFIG_AUTOSUSPEND
+		{
+			#ifdef CONFIG_IPS
+			ips_enter(padapter);
+			#endif
+		}
+	}
+exit:
+	rtw_set_pwr_state_check_timer(&padapter->pwrctrlpriv);
+	pwrpriv->ps_processing = _FALSE;
+	return;
+}
+
+void pwr_state_check_handler(void *FunctionContext);
+void pwr_state_check_handler(void *FunctionContext)
+{
+	_adapter *padapter = (_adapter *)FunctionContext;
+	rtw_ps_cmd(padapter);
+}
+#endif
+
+
+#ifdef CONFIG_LPS
+/*
+ *
+ * Parameters
+ *	padapter
+ *	pslv			power state level, only could be PS_STATE_S0 ~ PS_STATE_S4
+ *
+ */
+void rtw_set_rpwm(PADAPTER padapter, u8 pslv)
+{
+	u8	rpwm;
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+
+_func_enter_;
+
+	pslv = PS_STATE(pslv);
+
+	if (pwrpriv->rpwm == pslv) {
+		RT_TRACE(_module_rtl871x_pwrctrl_c_,_drv_err_,
+			("%s: Already set rpwm[0x%02x]!\n", __FUNCTION__, pslv));
+		return;
+	}
+
+	if ((padapter->bDriverStopped == _TRUE) ||
+		(padapter->bSurpriseRemoved == _TRUE)) {
+		RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_err_,
+				 ("%s: bDriverStopped(%d) bSurpriseRemoved(%d)\n",
+				  __FUNCTION__, padapter->bDriverStopped, padapter->bSurpriseRemoved));
+		return;
+	}
+
+	rpwm = pslv | pwrpriv->tog;
+#ifdef CONFIG_LPS_LCLK
+	if ((pwrpriv->cpwm < PS_STATE_S2) && (pslv >= PS_STATE_S2))
+		rpwm |= PS_ACK;
+#endif
+	RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+			 ("rtw_set_rpwm: rpwm=0x%02x cpwm=0x%02x\n", rpwm, pwrpriv->cpwm));
+
+	pwrpriv->rpwm = pslv;
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_SET_RPWM, (u8 *)(&rpwm));
+
+	pwrpriv->tog += 0x80;
+
+	if (!(rpwm & PS_ACK)) pwrpriv->cpwm = pslv;
+
+_func_exit_;
+}
+
+u8 PS_RDY_CHECK(_adapter * padapter);
+u8 PS_RDY_CHECK(_adapter * padapter)
+{
+	u32 curr_time, delta_time;
+	struct pwrctrl_priv	*pwrpriv = &padapter->pwrctrlpriv;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+
+	curr_time = rtw_get_current_time();
+
+	delta_time = curr_time -pwrpriv->DelayLPSLastTimeStamp;
+
+	if(delta_time < LPS_DELAY_TIME)
+	{
+		return _FALSE;
+	}
+
+	if ((check_fwstate(pmlmepriv, _FW_LINKED) == _FALSE) ||
+		(check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_UNDER_WPS) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE) )
+		return _FALSE;
+
+	if(_TRUE == pwrpriv->bInSuspend )
+		return _FALSE;
+
+	if( (padapter->securitypriv.dot11AuthAlgrthm == dot11AuthAlgrthm_8021X) && (padapter->securitypriv.binstallGrpkey == _FALSE) )
+	{
+		DBG_871X("Group handshake still in progress !!!\n");
+		return _FALSE;
+	}
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if (!rtw_cfg80211_pwr_mgmt(padapter))
+		return _FALSE;
+#endif
+
+	return _TRUE;
+}
+
+void rtw_set_ps_mode(PADAPTER padapter, u8 ps_mode, u8 smart_ps)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+#endif //CONFIG_P2P
+#ifdef CONFIG_TDLS
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	_irqL irqL;
+	int i, j;
+	_list	*plist, *phead;
+	struct sta_info *ptdls_sta;
+#endif //CONFIG_TDLS
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+			 ("%s: PowerMode=%d Smart_PS=%d\n",
+			  __FUNCTION__, ps_mode, smart_ps));
+
+	if(ps_mode > PM_Card_Disable) {
+		RT_TRACE(_module_rtl871x_pwrctrl_c_,_drv_err_,("ps_mode:%d error\n", ps_mode));
+		return;
+	}
+
+	if((pwrpriv->pwr_mode == ps_mode) &&
+		(pwrpriv->smart_ps == smart_ps)){
+		return;
+	}
+
+	//if(pwrpriv->pwr_mode == PS_MODE_ACTIVE)
+	if(ps_mode == PS_MODE_ACTIVE)
+	{
+#ifdef CONFIG_P2P_PS
+		if(pwdinfo->opp_ps == 0)
+#endif // CONFIG_P2P_PS
+		{
+#ifdef CONFIG_LPS_LCLK
+			_enter_pwrlock(&pwrpriv->lock);
+#endif
+			DBG_871X("rtw_set_ps_mode(): Busy Traffic , Leave 802.11 power save..\n");
+
+#ifdef CONFIG_TDLS
+			_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+			for(i=0; i< NUM_STA; i++)
+			{
+				phead = &(pstapriv->sta_hash[i]);
+				plist = get_next(phead);
+
+				while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+				{
+					ptdls_sta = LIST_CONTAINOR(plist, struct sta_info, hash_list);
+
+					if( ptdls_sta->tdls_sta_state & TDLS_LINKED_STATE )
+						issue_nulldata_to_TDLS_peer_STA(padapter, ptdls_sta, 0);
+					plist = get_next(plist);
+				}
+			}
+
+			_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+#endif //CONFIG_TDLS
+
+			pwrpriv->smart_ps = smart_ps;
+			pwrpriv->pwr_mode = ps_mode;
+
+			rtw_set_rpwm(padapter, PS_STATE_S4);
+#ifdef CONFIG_LPS_LCLK
+{
+			u32 n = 0;
+			while (pwrpriv->cpwm != PS_STATE_S4) {
+				n++;
+				if (n == 10000) break;
+				if (padapter->bSurpriseRemoved == _TRUE) break;
+				rtw_msleep_os(1);
+			}
+			if (n == 10000)
+				printk(KERN_ERR "%s: wait CPWM to S4 too long! cpwm=0x%02x\n", __func__, pwrpriv->cpwm);
+}
+#endif
+			rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_PWRMODE, (u8 *)(&ps_mode));
+			pwrpriv->bFwCurrentInPSMode = _FALSE;
+#ifdef CONFIG_LPS_LCLK
+			_exit_pwrlock(&pwrpriv->lock);
+#endif
+		}
+	}
+	else
+	{
+		if(PS_RDY_CHECK(padapter))
+		{
+#ifdef CONFIG_LPS_LCLK
+			_enter_pwrlock(&pwrpriv->lock);
+#endif
+			DBG_871X("rtw_set_ps_mode(): Enter 802.11 power save mode...\n");
+
+#ifdef CONFIG_TDLS
+			_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+			for(i=0; i< NUM_STA; i++)
+			{
+				phead = &(pstapriv->sta_hash[i]);
+				plist = get_next(phead);
+
+				while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+				{
+					ptdls_sta = LIST_CONTAINOR(plist, struct sta_info, hash_list);
+
+					if( ptdls_sta->tdls_sta_state & TDLS_LINKED_STATE )
+						issue_nulldata_to_TDLS_peer_STA(padapter, ptdls_sta, 1);
+					plist = get_next(plist);
+				}
+			}
+
+			_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+#endif //CONFIG_TDLS
+
+			pwrpriv->smart_ps = smart_ps;
+			pwrpriv->pwr_mode = ps_mode;
+			pwrpriv->bFwCurrentInPSMode = _TRUE;
+			rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_PWRMODE, (u8 *)(&ps_mode));
+#ifdef CONFIG_P2P_PS
+			// Set CTWindow after LPS
+			if(pwdinfo->opp_ps == 1)
+				p2p_ps_wk_cmd(padapter, P2P_PS_ENABLE, 0);
+#endif // CONFIG_P2P_PS
+#ifdef CONFIG_LPS_LCLK
+			if (pwrpriv->alives == 0)
+				rtw_set_rpwm(padapter, PS_STATE_S0);
+#else
+			rtw_set_rpwm(padapter, PS_STATE_S2);
+#endif
+#ifdef CONFIG_LPS_LCLK
+			_exit_pwrlock(&pwrpriv->lock);
+#endif
+		}
+		//else
+		//{
+		//	pwrpriv->pwr_mode = PS_MODE_ACTIVE;
+		//}
+	}
+
+_func_exit_;
+}
+
+
+//
+//	Description:
+//		Enter the leisure power save mode.
+//
+void LPS_Enter(PADAPTER padapter)
+{
+	struct pwrctrl_priv	*pwrpriv = &padapter->pwrctrlpriv;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	_adapter *buddy = padapter->pbuddy_adapter;
+
+_func_enter_;
+
+//	DBG_871X("+LeisurePSEnter\n");
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (padapter->iface_type != IFACE_PORT0)
+		return; /* Skip power saving for concurrent mode port 1*/
+
+	/* consider buddy, if exist */
+	if (buddy) {
+		struct mlme_priv *b_pmlmepriv = &(buddy->mlmepriv);
+		#ifdef CONFIG_P2P
+		struct wifidirect_info *b_pwdinfo = &(buddy->wdinfo);
+		#ifdef CONFIG_IOCTL_CFG80211
+		struct cfg80211_wifidirect_info *b_pcfg80211_wdinfo = &buddy->cfg80211_wdinfo;
+		#endif
+		#endif
+
+		if (check_fwstate(b_pmlmepriv, WIFI_ASOC_STATE|WIFI_SITE_MONITOR)
+			|| check_fwstate(b_pmlmepriv, WIFI_UNDER_LINKING|WIFI_UNDER_WPS)
+			|| check_fwstate(b_pmlmepriv, WIFI_AP_STATE)
+			|| check_fwstate(b_pmlmepriv, WIFI_ADHOC_MASTER_STATE|WIFI_ADHOC_STATE)
+			#if defined(CONFIG_P2P) && defined(CONFIG_IOCTL_CFG80211) && defined(CONFIG_P2P_IPS)
+			|| b_pcfg80211_wdinfo->is_ro_ch
+			#elif defined(CONFIG_P2P)
+			|| !rtw_p2p_chk_state(b_pwdinfo, P2P_STATE_NONE)
+			#endif
+			|| rtw_is_scan_deny(buddy)
+		) {
+			return;
+		}
+	}
+#endif
+
+#ifdef CONFIG_INTEL_PROXIM
+	if(padapter->proximity.proxim_on==_TRUE){
+		return;
+	}
+#endif
+	if (	(check_fwstate(pmlmepriv, _FW_LINKED) == _FALSE) ||
+		(check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE) )
+		return;
+
+	if(_TRUE == pwrpriv->bInSuspend )
+		return ;
+
+	if (pwrpriv->bLeisurePs)
+	{
+		// Idle for a while if we connect to AP a while ago.
+		if(pwrpriv->LpsIdleCount >= 2) //  4 Sec
+		{
+			if(pwrpriv->pwr_mode == PS_MODE_ACTIVE)
+			{
+				rtw_set_ps_mode(padapter, pwrpriv->power_mgnt, 2);
+			}
+		}
+		else
+			pwrpriv->LpsIdleCount++;
+	}
+
+//	DBG_871X("-LeisurePSEnter\n");
+
+_func_exit_;
+}
+
+
+//
+//	Description:
+//		Leave the leisure power save mode.
+//
+void LPS_Leave(PADAPTER padapter)
+{
+#define LPS_LEAVE_TIMEOUT_MS 100
+
+	struct pwrctrl_priv	*pwrpriv = &padapter->pwrctrlpriv;
+	u32 start_time;
+	BOOLEAN bAwake = _FALSE;
+
+_func_enter_;
+
+//	DBG_871X("+LeisurePSLeave\n");
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (padapter->iface_type != IFACE_PORT0)
+		return; /* Skip power saving for concurrent mode port 1*/
+#endif
+
+	if (pwrpriv->bLeisurePs)
+	{
+		if(pwrpriv->pwr_mode != PS_MODE_ACTIVE)
+		{
+			rtw_set_ps_mode(padapter, PS_MODE_ACTIVE, 0);
+
+			if(pwrpriv->pwr_mode == PS_MODE_ACTIVE)
+			{
+				start_time = rtw_get_current_time();
+				while(1)
+				{
+					rtw_hal_get_hwreg(padapter, HW_VAR_FWLPS_RF_ON, (u8 *)(&bAwake));
+
+					if(bAwake || padapter->bSurpriseRemoved)
+						break;
+
+					if(rtw_get_passing_time_ms(start_time)>LPS_LEAVE_TIMEOUT_MS)
+					{
+						DBG_871X("Wait for FW LPS leave more than %u ms!!!\n", LPS_LEAVE_TIMEOUT_MS);
+						break;
+					}
+					rtw_usleep_os(100);
+				}
+			}
+		}
+	}
+
+
+//	DBG_871X("-LeisurePSLeave\n");
+
+_func_exit_;
+}
+
+#endif
+
+//
+// Description: Leave all power save mode: LPS, FwLPS, IPS if needed.
+// Move code to function by tynli. 2010.03.26.
+//
+void LeaveAllPowerSaveMode(IN PADAPTER Adapter)
+{
+	struct mlme_priv	*pmlmepriv = &(Adapter->mlmepriv);
+
+_func_enter_;
+
+	//DBG_871X("%s.....\n",__FUNCTION__);
+	if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+	{ //connect
+#ifdef CONFIG_P2P_PS
+		p2p_ps_wk_cmd(Adapter, P2P_PS_DISABLE, 0);
+#endif // CONFIG_P2P_PS
+#ifdef CONFIG_LPS
+		//DBG_871X("==> leave LPS.......\n");
+		LPS_Leave(Adapter);
+#endif
+	}
+	else
+	{
+		if(Adapter->pwrctrlpriv.rf_pwrstate== rf_off)
+		{
+			#ifdef CONFIG_AUTOSUSPEND
+			if(Adapter->registrypriv.usbss_enable)
+			{
+				#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+				usb_disable_autosuspend(adapter_to_dvobj(Adapter)->pusbdev);
+				#elif (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,22) && LINUX_VERSION_CODE<=KERNEL_VERSION(2,6,34))
+				adapter_to_dvobj(Adapter)->pusbdev->autosuspend_disabled = Adapter->bDisableAutosuspend;//autosuspend disabled by the user
+				#endif
+			}
+			else
+			#endif
+			{
+			/*
+				#ifdef CONFIG_IPS
+				if(_FALSE == ips_leave(Adapter))
+				{
+					DBG_871X("======> ips_leave fail.............\n");
+				}
+				#endif
+			*/
+			}
+		}
+	}
+
+_func_exit_;
+}
+
+#ifdef CONFIG_LPS_LCLK
+/*
+ * Caller:ISR handler...
+ *
+ * This will be called when CPWM interrupt is up.
+ *
+ * using to update cpwn of drv; and drv willl make a decision to up or down pwr level
+ */
+void cpwm_int_hdl(
+	PADAPTER padapter,
+	struct reportpwrstate_parm *preportpwrstate)
+{
+	struct pwrctrl_priv *pwrpriv;
+
+
+_func_enter_;
+
+	pwrpriv = &padapter->pwrctrlpriv;
+#if 0
+	if (pwrpriv->cpwm_tog == (preportpwrstate->state & PS_TOGGLE)) {
+		RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_err_,
+				 ("cpwm_int_hdl: tog(old)=0x%02x cpwm(new)=0x%02x toggle bit didn't change!?\n",
+				  pwrpriv->cpwm_tog, preportpwrstate->state));
+		goto exit;
+	}
+#endif
+//	_enter_pwrlock(&pwrpriv->lock);
+
+	pwrpriv->cpwm = PS_STATE(preportpwrstate->state);
+	pwrpriv->cpwm_tog = preportpwrstate->state & PS_TOGGLE;
+
+	if (pwrpriv->cpwm >= PS_STATE_S2) {
+		if (pwrpriv->alives & CMD_ALIVE)
+			_rtw_up_sema(&padapter->cmdpriv.cmd_queue_sema);
+
+		if (pwrpriv->alives & XMIT_ALIVE)
+			_rtw_up_sema(&padapter->xmitpriv.xmit_sema);
+	}
+
+//	_exit_pwrlock(&pwrpriv->lock);
+
+exit:
+	RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+			 ("cpwm_int_hdl: cpwm=0x%02x\n", pwrpriv->cpwm));
+
+_func_exit_;
+}
+
+__inline static void register_task_alive(struct pwrctrl_priv *pwrctrl, u32 tag)
+{
+	pwrctrl->alives |= tag;
+}
+
+__inline static void unregister_task_alive(struct pwrctrl_priv *pwrctrl, u32 tag)
+{
+	pwrctrl->alives &= ~tag;
+}
+
+/*
+ * Caller: rtw_xmit_thread
+ *
+ * Check if the fw_pwrstate is okay for xmit.
+ * If not (cpwm is less than S3), then the sub-routine
+ * will raise the cpwm to be greater than or equal to S3.
+ *
+ * Calling Context: Passive
+ *
+ * Return Value:
+ *	 _SUCCESS	rtw_xmit_thread can write fifo/txcmd afterwards.
+ *	 _FAIL		rtw_xmit_thread can not do anything.
+ */
+s32 rtw_register_tx_alive(PADAPTER padapter)
+{
+	s32 res;
+	struct pwrctrl_priv *pwrctrl;
+
+_func_enter_;
+
+	res = _SUCCESS;
+	pwrctrl = &padapter->pwrctrlpriv;
+
+	_enter_pwrlock(&pwrctrl->lock);
+
+	register_task_alive(pwrctrl, XMIT_ALIVE);
+
+	if (pwrctrl->bFwCurrentInPSMode == _TRUE)
+	{
+		RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_err_,
+				 ("rtw_register_tx_alive: cpwm=0x%02x alives=0x%08x\n",
+				  pwrctrl->cpwm, pwrctrl->alives));
+
+		if (pwrctrl->cpwm < PS_STATE_S2) {
+			if (pwrctrl->rpwm < PS_STATE_S2)
+				rtw_set_rpwm(padapter, PS_STATE_S2);
+			res = _FAIL;
+		}
+	}
+
+	_exit_pwrlock(&pwrctrl->lock);
+
+_func_exit_;
+
+	return res;
+}
+
+/*
+ * Caller: rtw_cmd_thread
+ *
+ * Check if the fw_pwrstate is okay for issuing cmd.
+ * If not (cpwm should be is less than S2), then the sub-routine
+ * will raise the cpwm to be greater than or equal to S2.
+ *
+ * Calling Context: Passive
+ *
+ * Return Value:
+ *	_SUCCESS	rtw_cmd_thread can issue cmds to firmware afterwards.
+ *	_FAIL		rtw_cmd_thread can not do anything.
+ */
+s32 rtw_register_cmd_alive(PADAPTER padapter)
+{
+	s32 res;
+	struct pwrctrl_priv *pwrctrl;
+
+_func_enter_;
+
+	res = _SUCCESS;
+	pwrctrl = &padapter->pwrctrlpriv;
+
+	_enter_pwrlock(&pwrctrl->lock);
+
+	register_task_alive(pwrctrl, CMD_ALIVE);
+
+	if (pwrctrl->bFwCurrentInPSMode == _TRUE)
+	{
+		RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+				 ("rtw_register_cmd_alive: cpwm=0x%02x alives=0x%08x\n",
+				  pwrctrl->cpwm, pwrctrl->alives));
+
+		if (pwrctrl->cpwm < PS_STATE_S2) {
+			if (pwrctrl->rpwm < PS_STATE_S2)
+				rtw_set_rpwm(padapter, PS_STATE_S2);
+			res = _FAIL;
+		}
+	}
+
+	_exit_pwrlock(&pwrctrl->lock);
+
+_func_exit_;
+
+	return res;
+}
+
+/*
+ * Caller: rx_isr
+ *
+ * Calling Context: Dispatch/ISR
+ *
+ * Return Value:
+ *	_SUCCESS
+ *	_FAIL
+ */
+s32 rtw_register_rx_alive(PADAPTER padapter)
+{
+	struct pwrctrl_priv *pwrctrl;
+
+_func_enter_;
+
+	pwrctrl = &padapter->pwrctrlpriv;
+
+	_enter_pwrlock(&pwrctrl->lock);
+
+	register_task_alive(pwrctrl, RECV_ALIVE);
+	RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+			 ("rtw_register_rx_alive: cpwm=0x%02x alives=0x%08x\n",
+			  pwrctrl->cpwm, pwrctrl->alives));
+
+	_exit_pwrlock(&pwrctrl->lock);
+
+_func_exit_;
+
+	return _SUCCESS;
+}
+
+/*
+ * Caller: evt_isr or evt_thread
+ *
+ * Calling Context: Dispatch/ISR or Passive
+ *
+ * Return Value:
+ *	_SUCCESS
+ *	_FAIL
+ */
+s32 rtw_register_evt_alive(PADAPTER padapter)
+{
+	struct pwrctrl_priv *pwrctrl;
+
+_func_enter_;
+
+	pwrctrl = &padapter->pwrctrlpriv;
+
+	_enter_pwrlock(&pwrctrl->lock);
+
+	register_task_alive(pwrctrl, EVT_ALIVE);
+	RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+			 ("rtw_register_evt_alive: cpwm=0x%02x alives=0x%08x\n",
+			  pwrctrl->cpwm, pwrctrl->alives));
+
+	_exit_pwrlock(&pwrctrl->lock);
+
+_func_exit_;
+
+	return _SUCCESS;
+}
+
+/*
+ * Caller: ISR
+ *
+ * If ISR's txdone,
+ * No more pkts for TX,
+ * Then driver shall call this fun. to power down firmware again.
+ */
+void rtw_unregister_tx_alive(PADAPTER padapter)
+{
+	struct pwrctrl_priv *pwrctrl;
+
+_func_enter_;
+
+	pwrctrl = &padapter->pwrctrlpriv;
+
+	_enter_pwrlock(&pwrctrl->lock);
+
+	unregister_task_alive(pwrctrl, XMIT_ALIVE);
+
+	if ((pwrctrl->pwr_mode != PS_MODE_ACTIVE) &&
+		(pwrctrl->bFwCurrentInPSMode == _TRUE))
+	{
+		if ((pwrctrl->alives == 0) &&
+			(pwrctrl->cpwm > PS_STATE_S0))
+		{
+			rtw_set_rpwm(padapter, PS_STATE_S0);
+		}
+
+		RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+				 ("rtw_unregister_tx_alive: cpwm=0x%02x alives=0x%08x\n",
+				  pwrctrl->cpwm, pwrctrl->alives));
+	}
+
+	_exit_pwrlock(&pwrctrl->lock);
+
+_func_exit_;
+}
+
+/*
+ * Caller: ISR
+ *
+ * If all commands have been done,
+ * and no more command to do,
+ * then driver shall call this fun. to power down firmware again.
+ */
+void rtw_unregister_cmd_alive(PADAPTER padapter)
+{
+	struct pwrctrl_priv *pwrctrl;
+
+_func_enter_;
+
+	pwrctrl = &padapter->pwrctrlpriv;
+
+	_enter_pwrlock(&pwrctrl->lock);
+
+	unregister_task_alive(pwrctrl, CMD_ALIVE);
+
+	if ((pwrctrl->pwr_mode != PS_MODE_ACTIVE) &&
+		(pwrctrl->bFwCurrentInPSMode == _TRUE))
+	{
+		if ((pwrctrl->alives == 0) &&
+			(pwrctrl->cpwm > PS_STATE_S0))
+		{
+			rtw_set_rpwm(padapter, PS_STATE_S0);
+		}
+
+		RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+				 ("rtw_unregister_cmd_alive: cpwm=0x%02x alives=0x%08x\n",
+				  pwrctrl->cpwm, pwrctrl->alives));
+	}
+
+	_exit_pwrlock(&pwrctrl->lock);
+
+_func_exit_;
+}
+
+/*
+ * Caller: ISR
+ */
+void rtw_unregister_rx_alive(PADAPTER padapter)
+{
+	struct pwrctrl_priv *pwrctrl;
+
+_func_enter_;
+
+	pwrctrl = &padapter->pwrctrlpriv;
+
+	_enter_pwrlock(&pwrctrl->lock);
+
+	unregister_task_alive(pwrctrl, RECV_ALIVE);
+
+	RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+			 ("rtw_unregister_rx_alive: cpwm=0x%02x alives=0x%08x\n",
+			  pwrctrl->cpwm, pwrctrl->alives));
+
+	_exit_pwrlock(&pwrctrl->lock);
+
+_func_exit_;
+}
+
+void rtw_unregister_evt_alive(PADAPTER padapter)
+{
+	struct pwrctrl_priv *pwrctrl;
+
+_func_enter_;
+
+	pwrctrl = &padapter->pwrctrlpriv;
+
+	unregister_task_alive(pwrctrl, EVT_ALIVE);
+
+	RT_TRACE(_module_rtl871x_pwrctrl_c_, _drv_notice_,
+			 ("rtw_unregister_evt_alive: cpwm=0x%02x alives=0x%08x\n",
+			  pwrctrl->cpwm, pwrctrl->alives));
+
+	_exit_pwrlock(&pwrctrl->lock);
+
+_func_exit_;
+}
+#endif	/* CONFIG_LPS_LCLK */
+
+#ifdef CONFIG_RESUME_IN_WORKQUEUE
+static void resume_workitem_callback(struct work_struct *work);
+#endif //CONFIG_RESUME_IN_WORKQUEUE
+
+void rtw_init_pwrctrl_priv(PADAPTER padapter)
+{
+	struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv;
+
+_func_enter_;
+
+#ifdef PLATFORM_WINDOWS
+	pwrctrlpriv->pnp_current_pwr_state=NdisDeviceStateD0;
+#endif
+
+	_init_pwrlock(&pwrctrlpriv->lock);
+	pwrctrlpriv->rf_pwrstate = rf_on;
+	pwrctrlpriv->ips_enter_cnts=0;
+	pwrctrlpriv->ips_leave_cnts=0;
+
+	pwrctrlpriv->ips_mode = padapter->registrypriv.ips_mode;
+	pwrctrlpriv->ips_mode_req = padapter->registrypriv.ips_mode;
+
+	pwrctrlpriv->pwr_state_check_interval = RTW_PWR_STATE_CHK_INTERVAL;
+	pwrctrlpriv->pwr_state_check_cnts = 0;
+	pwrctrlpriv->bInternalAutoSuspend = _FALSE;
+	pwrctrlpriv->bInSuspend = _FALSE;
+	pwrctrlpriv->bkeepfwalive = _FALSE;
+
+#ifdef CONFIG_AUTOSUSPEND
+#ifdef SUPPORT_HW_RFOFF_DETECTED
+	pwrctrlpriv->pwr_state_check_interval = (pwrctrlpriv->bHWPwrPindetect) ?1000:2000;
+#endif
+#endif
+
+	pwrctrlpriv->LpsIdleCount = 0;
+	//pwrctrlpriv->FWCtrlPSMode =padapter->registrypriv.power_mgnt;// PS_MODE_MIN;
+	pwrctrlpriv->power_mgnt =padapter->registrypriv.power_mgnt;// PS_MODE_MIN;
+	pwrctrlpriv->bLeisurePs = (PS_MODE_ACTIVE != pwrctrlpriv->power_mgnt)?_TRUE:_FALSE;
+
+	pwrctrlpriv->bFwCurrentInPSMode = _FALSE;
+
+	pwrctrlpriv->cpwm = PS_STATE_S4;
+
+	pwrctrlpriv->pwr_mode = PS_MODE_ACTIVE;
+
+
+	pwrctrlpriv->smart_ps = 0;
+
+	pwrctrlpriv->tog = 0x80;
+
+#ifdef PLATFORM_LINUX
+	_init_timer(&(pwrctrlpriv->pwr_state_check_timer), padapter->pnetdev, pwr_state_check_handler, (u8 *)padapter);
+#endif
+
+	#ifdef CONFIG_RESUME_IN_WORKQUEUE
+	_init_workitem(&pwrctrlpriv->resume_work, resume_workitem_callback, NULL);
+	pwrctrlpriv->rtw_workqueue = create_singlethread_workqueue("rtw_workqueue");
+	#endif //CONFIG_RESUME_IN_WORKQUEUE
+
+	#if defined(CONFIG_HAS_EARLYSUSPEND) || defined(CONFIG_ANDROID_POWER)
+	pwrctrlpriv->early_suspend.suspend = NULL;
+	rtw_register_early_suspend(pwrctrlpriv);
+	#endif //CONFIG_HAS_EARLYSUSPEND || CONFIG_ANDROID_POWER
+
+
+_func_exit_;
+
+}
+
+
+void rtw_free_pwrctrl_priv(PADAPTER adapter)
+{
+	struct pwrctrl_priv *pwrctrlpriv = &adapter->pwrctrlpriv;
+
+_func_enter_;
+
+	//_rtw_memset((unsigned char *)pwrctrlpriv, 0, sizeof(struct pwrctrl_priv));
+
+
+	#ifdef CONFIG_RESUME_IN_WORKQUEUE
+	if (pwrctrlpriv->rtw_workqueue) {
+		flush_workqueue(pwrctrlpriv->rtw_workqueue);
+		destroy_workqueue(pwrctrlpriv->rtw_workqueue);
+	}
+	#endif
+
+
+	#if defined(CONFIG_HAS_EARLYSUSPEND) || defined(CONFIG_ANDROID_POWER)
+	rtw_unregister_early_suspend(pwrctrlpriv);
+	#endif //CONFIG_HAS_EARLYSUSPEND || CONFIG_ANDROID_POWER
+
+	_free_pwrlock(&pwrctrlpriv->lock);
+
+_func_exit_;
+}
+
+#ifdef CONFIG_RESUME_IN_WORKQUEUE
+#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI)
+extern int rtw_resume_process(_adapter *padapter);
+#endif
+static void resume_workitem_callback(struct work_struct *work)
+{
+	struct pwrctrl_priv *pwrpriv = container_of(work, struct pwrctrl_priv, resume_work);
+	_adapter *adapter = container_of(pwrpriv, _adapter, pwrctrlpriv);
+
+	DBG_871X("%s\n",__FUNCTION__);
+
+	#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI)
+	rtw_resume_process(adapter);
+	#endif
+
+}
+
+void rtw_resume_in_workqueue(struct pwrctrl_priv *pwrpriv)
+{
+	// accquire system's suspend lock preventing from falliing asleep while resume in workqueue
+	rtw_lock_suspend();
+
+	#if 1
+	queue_work(pwrpriv->rtw_workqueue, &pwrpriv->resume_work);
+	#else
+	_set_workitem(&pwrpriv->resume_work);
+	#endif
+}
+#endif //CONFIG_RESUME_IN_WORKQUEUE
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) || defined(CONFIG_ANDROID_POWER)
+inline bool rtw_is_earlysuspend_registered(struct pwrctrl_priv *pwrpriv)
+{
+	return (pwrpriv->early_suspend.suspend) ? _TRUE : _FALSE;
+}
+
+inline bool rtw_is_do_late_resume(struct pwrctrl_priv *pwrpriv)
+{
+	return (pwrpriv->do_late_resume) ? _TRUE : _FALSE;
+}
+
+inline void rtw_set_do_late_resume(struct pwrctrl_priv *pwrpriv, bool enable)
+{
+	pwrpriv->do_late_resume = enable;
+}
+#endif
+
+#ifdef CONFIG_HAS_EARLYSUSPEND
+#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI)
+extern int rtw_resume_process(_adapter *padapter);
+#endif
+static void rtw_early_suspend(struct early_suspend *h)
+{
+	struct pwrctrl_priv *pwrpriv = container_of(h, struct pwrctrl_priv, early_suspend);
+	DBG_871X("%s\n",__FUNCTION__);
+
+	rtw_set_do_late_resume(pwrpriv, _FALSE);
+}
+
+static void rtw_late_resume(struct early_suspend *h)
+{
+	struct pwrctrl_priv *pwrpriv = container_of(h, struct pwrctrl_priv, early_suspend);
+	_adapter *adapter = container_of(pwrpriv, _adapter, pwrctrlpriv);
+
+	DBG_871X("%s\n",__FUNCTION__);
+	if(pwrpriv->do_late_resume) {
+		#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI)
+		rtw_set_do_late_resume(pwrpriv, _FALSE);
+		rtw_resume_process(adapter);
+		#endif
+	}
+}
+
+void rtw_register_early_suspend(struct pwrctrl_priv *pwrpriv)
+{
+	_adapter *adapter = container_of(pwrpriv, _adapter, pwrctrlpriv);
+
+#if defined(CONFIG_CONCURRENT_MODE)
+	if (adapter->adapter_type != PRIMARY_ADAPTER)
+		return;
+#endif
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	//jeff: set the early suspend level before blank screen, so we wll do late resume after scree is lit
+	pwrpriv->early_suspend.level = EARLY_SUSPEND_LEVEL_BLANK_SCREEN - 20;
+	pwrpriv->early_suspend.suspend = rtw_early_suspend;
+	pwrpriv->early_suspend.resume = rtw_late_resume;
+	register_early_suspend(&pwrpriv->early_suspend);
+
+
+}
+
+void rtw_unregister_early_suspend(struct pwrctrl_priv *pwrpriv)
+{
+	_adapter *adapter = container_of(pwrpriv, _adapter, pwrctrlpriv);
+
+#if defined(CONFIG_CONCURRENT_MODE)
+	if (adapter->adapter_type != PRIMARY_ADAPTER)
+		return;
+#endif
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	rtw_set_do_late_resume(pwrpriv, _FALSE);
+
+	if (pwrpriv->early_suspend.suspend)
+		unregister_early_suspend(&pwrpriv->early_suspend);
+
+	pwrpriv->early_suspend.suspend = NULL;
+	pwrpriv->early_suspend.resume = NULL;
+}
+#endif //CONFIG_HAS_EARLYSUSPEND
+
+#ifdef CONFIG_ANDROID_POWER
+#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI)
+extern int rtw_resume_process(PADAPTER padapter);
+#endif
+static void rtw_early_suspend(android_early_suspend_t *h)
+{
+	struct pwrctrl_priv *pwrpriv = container_of(h, struct pwrctrl_priv, early_suspend);
+	DBG_871X("%s\n",__FUNCTION__);
+
+	rtw_set_do_late_resume(pwrpriv, _FALSE);
+}
+
+static void rtw_late_resume(android_early_suspend_t *h)
+{
+	struct pwrctrl_priv *pwrpriv = container_of(h, struct pwrctrl_priv, early_suspend);
+	_adapter *adapter = container_of(pwrpriv, _adapter, pwrctrlpriv);
+
+	DBG_871X("%s\n",__FUNCTION__);
+	if(pwrpriv->do_late_resume) {
+		#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI)
+		rtw_set_do_late_resume(pwrpriv, _FALSE);
+		rtw_resume_process(adapter);
+		#endif
+	}
+}
+
+void rtw_register_early_suspend(struct pwrctrl_priv *pwrpriv)
+{
+	_adapter *adapter = container_of(pwrpriv, _adapter, pwrctrlpriv);
+
+#if defined(CONFIG_CONCURRENT_MODE)
+	if (adapter->adapter_type != PRIMARY_ADAPTER)
+		return;
+#endif
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	//jeff: set the early suspend level before blank screen, so we wll do late resume after scree is lit
+	pwrpriv->early_suspend.level = ANDROID_EARLY_SUSPEND_LEVEL_BLANK_SCREEN - 20;
+	pwrpriv->early_suspend.suspend = rtw_early_suspend;
+	pwrpriv->early_suspend.resume = rtw_late_resume;
+	android_register_early_suspend(&pwrpriv->early_suspend);
+}
+
+void rtw_unregister_early_suspend(struct pwrctrl_priv *pwrpriv)
+{
+	_adapter *adapter = container_of(pwrpriv, _adapter, pwrctrlpriv);
+
+#if defined(CONFIG_CONCURRENT_MODE)
+	if (adapter->adapter_type != PRIMARY_ADAPTER)
+		return;
+#endif
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	rtw_set_do_late_resume(pwrpriv, _FALSE);
+
+	if (pwrpriv->early_suspend.suspend)
+		android_unregister_early_suspend(&pwrpriv->early_suspend);
+
+	pwrpriv->early_suspend.suspend = NULL;
+	pwrpriv->early_suspend.resume = NULL;
+}
+#endif //CONFIG_ANDROID_POWER
+
+u8 rtw_interface_ps_func(_adapter *padapter,HAL_INTF_PS_FUNC efunc_id,u8* val)
+{
+	u8 bResult = _TRUE;
+
+	rtw_hal_intf_ps_func(padapter,efunc_id,val);
+
+	return bResult;
+}
+
+
+inline void rtw_set_ips_deny(_adapter *padapter, u32 ms)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	pwrpriv->ips_deny_time = rtw_get_current_time() + rtw_ms_to_systime(ms);
+}
+
+/*
+* rtw_pwr_wakeup - Wake the NIC up from: 1)IPS. 2)USB autosuspend
+* @adapter: pointer to _adapter structure
+* @ips_deffer_ms: the ms wiil prevent from falling into IPS after wakeup
+* Return _SUCCESS or _FAIL
+*/
+int _rtw_pwr_wakeup(_adapter *padapter, u32 ips_deffer_ms, const char *caller)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	int ret = _SUCCESS;
+	u32 start = rtw_get_current_time();
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (padapter->pbuddy_adapter)
+		LeaveAllPowerSaveMode(padapter->pbuddy_adapter);
+
+	if ((padapter->isprimary == _FALSE) && padapter->pbuddy_adapter){
+		padapter = padapter->pbuddy_adapter;
+		pwrpriv = &padapter->pwrctrlpriv;
+		pmlmepriv = &padapter->mlmepriv;
+	}
+#endif
+
+	if (pwrpriv->ips_deny_time < rtw_get_current_time() + rtw_ms_to_systime(ips_deffer_ms))
+		pwrpriv->ips_deny_time = rtw_get_current_time() + rtw_ms_to_systime(ips_deffer_ms);
+
+	if (pwrpriv->ps_processing) {
+		DBG_871X("%s wait ps_processing...\n", __func__);
+		while (pwrpriv->ps_processing && rtw_get_passing_time_ms(start) <= 3000)
+			rtw_msleep_os(10);
+		if (pwrpriv->ps_processing)
+			DBG_871X("%s wait ps_processing timeout\n", __func__);
+		else
+			DBG_871X("%s wait ps_processing done\n", __func__);
+	}
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+	if (rtw_hal_sreset_inprogress(padapter)) {
+		DBG_871X("%s wait sreset_inprogress...\n", __func__);
+		while (rtw_hal_sreset_inprogress(padapter) && rtw_get_passing_time_ms(start) <= 4000)
+			rtw_msleep_os(10);
+		if (rtw_hal_sreset_inprogress(padapter))
+			DBG_871X("%s wait sreset_inprogress timeout\n", __func__);
+		else
+			DBG_871X("%s wait sreset_inprogress done\n", __func__);
+	}
+#endif
+
+	if (pwrpriv->bInternalAutoSuspend == _FALSE && pwrpriv->bInSuspend) {
+		DBG_871X("%s wait bInSuspend...\n", __func__);
+		while (pwrpriv->bInSuspend
+			&& ((rtw_get_passing_time_ms(start) <= 3000 && !rtw_is_do_late_resume(pwrpriv))
+				|| (rtw_get_passing_time_ms(start) <= 500 && rtw_is_do_late_resume(pwrpriv)))
+		) {
+			rtw_msleep_os(10);
+		}
+		if (pwrpriv->bInSuspend)
+			DBG_871X("%s wait bInSuspend timeout\n", __func__);
+		else
+			DBG_871X("%s wait bInSuspend done\n", __func__);
+	}
+
+	//System suspend is not allowed to wakeup
+	if((pwrpriv->bInternalAutoSuspend == _FALSE) && (_TRUE == pwrpriv->bInSuspend )){
+		ret = _FAIL;
+		goto exit;
+	}
+
+	//block???
+	if((pwrpriv->bInternalAutoSuspend == _TRUE)  && (padapter->net_closed == _TRUE)) {
+		ret = _FAIL;
+		goto exit;
+	}
+
+	//I think this should be check in IPS, LPS, autosuspend functions...
+	if (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+	{
+		ret = _SUCCESS;
+		goto exit;
+	}
+
+	if(rf_off == pwrpriv->rf_pwrstate )
+	{
+#ifdef CONFIG_USB_HCI
+#ifdef CONFIG_AUTOSUSPEND
+		 if(pwrpriv->brfoffbyhw==_TRUE)
+		{
+			DBG_8192C("hw still in rf_off state ...........\n");
+			ret = _FAIL;
+			goto exit;
+		}
+		else if(padapter->registrypriv.usbss_enable)
+		{
+			DBG_8192C("%s call autoresume_enter....\n",__FUNCTION__);
+			if(_FAIL ==  autoresume_enter(padapter))
+			{
+				DBG_8192C("======> autoresume fail.............\n");
+				ret = _FAIL;
+				goto exit;
+			}
+		}
+		else
+#endif
+#endif
+		{
+#ifdef CONFIG_IPS
+			DBG_8192C("%s call ips_leave....\n",__FUNCTION__);
+			if(_FAIL ==  ips_leave(padapter))
+			{
+				DBG_8192C("======> ips_leave fail.............\n");
+				ret = _FAIL;
+				goto exit;
+			}
+#endif
+		}
+	}
+
+	//TODO: the following checking need to be merged...
+	if(padapter->bDriverStopped
+		|| !padapter->bup
+		|| !padapter->hw_init_completed
+	){
+		DBG_8192C("%s: bDriverStopped=%d, bup=%d, hw_init_completed=%u\n"
+			, caller
+			, padapter->bDriverStopped
+			, padapter->bup
+			, padapter->hw_init_completed);
+		ret= _FALSE;
+		goto exit;
+	}
+
+exit:
+	if (pwrpriv->ips_deny_time < rtw_get_current_time() + rtw_ms_to_systime(ips_deffer_ms))
+		pwrpriv->ips_deny_time = rtw_get_current_time() + rtw_ms_to_systime(ips_deffer_ms);
+	return ret;
+
+}
+
+int rtw_pm_set_lps(_adapter *padapter, u8 mode)
+{
+	int	ret = 0;
+	struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv;
+
+	if ( mode < PS_MODE_NUM )
+	{
+		if(pwrctrlpriv->power_mgnt !=mode)
+		{
+			if(PS_MODE_ACTIVE == mode)
+			{
+				LeaveAllPowerSaveMode(padapter);
+			}
+			else
+			{
+				pwrctrlpriv->LpsIdleCount = 2;
+			}
+			pwrctrlpriv->power_mgnt = mode;
+			pwrctrlpriv->bLeisurePs = (PS_MODE_ACTIVE != pwrctrlpriv->power_mgnt)?_TRUE:_FALSE;
+		}
+	}
+	else
+	{
+		ret = -EINVAL;
+	}
+
+	return ret;
+}
+
+int rtw_pm_set_ips(_adapter *padapter, u8 mode)
+{
+	struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv;
+
+	if( mode == IPS_NORMAL || mode == IPS_LEVEL_2 ) {
+		rtw_ips_mode_req(pwrctrlpriv, mode);
+		DBG_871X("%s %s\n", __FUNCTION__, mode == IPS_NORMAL?"IPS_NORMAL":"IPS_LEVEL_2");
+		return 0;
+	}
+	else if(mode ==IPS_NONE){
+		rtw_ips_mode_req(pwrctrlpriv, mode);
+		DBG_871X("%s %s\n", __FUNCTION__, "IPS_NONE");
+		if((padapter->bSurpriseRemoved ==0)&&(_FAIL == rtw_pwr_wakeup(padapter)) )
+			return -EFAULT;
+	}
+	else {
+		return -EINVAL;
+	}
+	return 0;
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_recv.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_recv.c
new file mode 100644
index 000000000000..1b14673d4939
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_recv.c
@@ -0,0 +1,4285 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_RECV_C_
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#include <mlme_osdep.h>
+#include <ip.h>
+#include <if_ether.h>
+#include <ethernet.h>
+
+#ifdef CONFIG_USB_HCI
+#include <usb_ops.h>
+#endif
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+
+#error "Shall be Linux or Windows, but not both!\n"
+
+#endif
+
+#include <wifi.h>
+#include <circ_buf.h>
+
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+void rtw_signal_stat_timer_hdl(RTW_TIMER_HDL_ARGS);
+#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+
+
+void _rtw_init_sta_recv_priv(struct sta_recv_priv *psta_recvpriv)
+{
+
+
+_func_enter_;
+
+	_rtw_memset((u8 *)psta_recvpriv, 0, sizeof (struct sta_recv_priv));
+
+	_rtw_spinlock_init(&psta_recvpriv->lock);
+
+	//for(i=0; i<MAX_RX_NUMBLKS; i++)
+	//	_rtw_init_queue(&psta_recvpriv->blk_strms[i]);
+
+	_rtw_init_queue(&psta_recvpriv->defrag_q);
+
+_func_exit_;
+
+}
+
+sint _rtw_init_recv_priv(struct recv_priv *precvpriv, _adapter *padapter)
+{
+	sint i;
+
+	union recv_frame *precvframe;
+
+	sint	res=_SUCCESS;
+
+_func_enter_;
+
+	// We don't need to memset padapter->XXX to zero, because adapter is allocated by rtw_zvmalloc().
+	//_rtw_memset((unsigned char *)precvpriv, 0, sizeof (struct  recv_priv));
+
+	_rtw_spinlock_init(&precvpriv->lock);
+
+	_rtw_init_queue(&precvpriv->free_recv_queue);
+	_rtw_init_queue(&precvpriv->recv_pending_queue);
+	_rtw_init_queue(&precvpriv->uc_swdec_pending_queue);
+
+	precvpriv->adapter = padapter;
+
+	precvpriv->free_recvframe_cnt = NR_RECVFRAME;
+
+	rtw_os_recv_resource_init(precvpriv, padapter);
+
+	precvpriv->pallocated_frame_buf = rtw_zvmalloc(NR_RECVFRAME * sizeof(union recv_frame) + RXFRAME_ALIGN_SZ);
+
+	if(precvpriv->pallocated_frame_buf==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+	//_rtw_memset(precvpriv->pallocated_frame_buf, 0, NR_RECVFRAME * sizeof(union recv_frame) + RXFRAME_ALIGN_SZ);
+
+	precvpriv->precv_frame_buf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(precvpriv->pallocated_frame_buf), RXFRAME_ALIGN_SZ);
+	//precvpriv->precv_frame_buf = precvpriv->pallocated_frame_buf + RXFRAME_ALIGN_SZ -
+	//						((SIZE_PTR) (precvpriv->pallocated_frame_buf) &(RXFRAME_ALIGN_SZ-1));
+
+	precvframe = (union recv_frame*) precvpriv->precv_frame_buf;
+
+
+	for(i=0; i < NR_RECVFRAME ; i++)
+	{
+		_rtw_init_listhead(&(precvframe->u.list));
+
+		rtw_list_insert_tail(&(precvframe->u.list), &(precvpriv->free_recv_queue.queue));
+
+		res = rtw_os_recv_resource_alloc(padapter, precvframe);
+
+		precvframe->u.hdr.adapter =padapter;
+		precvframe++;
+
+	}
+
+#ifdef CONFIG_USB_HCI
+
+	precvpriv->rx_pending_cnt=1;
+
+	_rtw_init_sema(&precvpriv->allrxreturnevt, 0);
+
+#endif
+
+	res = rtw_hal_init_recv_priv(padapter);
+
+	precvpriv->recvbuf_skb_alloc_fail_cnt = 0;
+	precvpriv->recvbuf_null_cnt = 0;
+	precvpriv->read_port_complete_EINPROGRESS_cnt = 0;
+	precvpriv->read_port_complete_other_urb_err_cnt = 0;
+
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	#ifdef PLATFORM_LINUX
+	_init_timer(&precvpriv->signal_stat_timer, padapter->pnetdev, RTW_TIMER_HDL_NAME(signal_stat), padapter);
+	#elif defined(PLATFORM_OS_CE) || defined(PLATFORM_WINDOWS)
+	_init_timer(&precvpriv->signal_stat_timer, padapter->hndis_adapter, RTW_TIMER_HDL_NAME(signal_stat), padapter);
+	#endif
+
+	precvpriv->signal_stat_sampling_interval = 1000; //ms
+	//precvpriv->signal_stat_converging_constant = 5000; //ms
+
+	rtw_set_signal_stat_timer(precvpriv);
+#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+
+exit:
+
+_func_exit_;
+
+	return res;
+
+}
+
+void rtw_mfree_recv_priv_lock(struct recv_priv *precvpriv);
+void rtw_mfree_recv_priv_lock(struct recv_priv *precvpriv)
+{
+	_rtw_spinlock_free(&precvpriv->lock);
+#ifdef CONFIG_RECV_THREAD_MODE
+	_rtw_free_sema(&precvpriv->recv_sema);
+	_rtw_free_sema(&precvpriv->terminate_recvthread_sema);
+#endif
+
+	_rtw_spinlock_free(&precvpriv->free_recv_queue.lock);
+	_rtw_spinlock_free(&precvpriv->recv_pending_queue.lock);
+
+	_rtw_spinlock_free(&precvpriv->free_recv_buf_queue.lock);
+
+#ifdef CONFIG_USE_USB_BUFFER_ALLOC_RX
+	_rtw_spinlock_free(&precvpriv->recv_buf_pending_queue.lock);
+#endif	// CONFIG_USE_USB_BUFFER_ALLOC_RX
+}
+
+void _rtw_free_recv_priv (struct recv_priv *precvpriv)
+{
+	_adapter	*padapter = precvpriv->adapter;
+
+_func_enter_;
+
+	rtw_free_uc_swdec_pending_queue(padapter);
+
+	rtw_mfree_recv_priv_lock(precvpriv);
+
+	rtw_os_recv_resource_free(precvpriv);
+
+	if(precvpriv->pallocated_frame_buf) {
+		rtw_vmfree(precvpriv->pallocated_frame_buf, NR_RECVFRAME * sizeof(union recv_frame) + RXFRAME_ALIGN_SZ);
+	}
+
+	rtw_hal_free_recv_priv(padapter);
+
+_func_exit_;
+
+}
+
+union recv_frame *_rtw_alloc_recvframe (_queue *pfree_recv_queue)
+{
+
+	union recv_frame  *precvframe;
+	_list	*plist, *phead;
+	_adapter *padapter;
+	struct recv_priv *precvpriv;
+_func_enter_;
+
+	if(_rtw_queue_empty(pfree_recv_queue) == _TRUE)
+	{
+		precvframe = NULL;
+	}
+	else
+	{
+		phead = get_list_head(pfree_recv_queue);
+
+		plist = get_next(phead);
+
+		precvframe = LIST_CONTAINOR(plist, union recv_frame, u);
+
+		rtw_list_delete(&precvframe->u.hdr.list);
+		padapter=precvframe->u.hdr.adapter;
+		if(padapter !=NULL){
+			precvpriv=&padapter->recvpriv;
+			if(pfree_recv_queue == &precvpriv->free_recv_queue)
+				precvpriv->free_recvframe_cnt--;
+		}
+	}
+
+_func_exit_;
+
+	return precvframe;
+
+}
+
+union recv_frame *rtw_alloc_recvframe (_queue *pfree_recv_queue)
+{
+	_irqL irqL;
+	union recv_frame  *precvframe;
+
+	_enter_critical_bh(&pfree_recv_queue->lock, &irqL);
+
+	precvframe = _rtw_alloc_recvframe(pfree_recv_queue);
+
+	_exit_critical_bh(&pfree_recv_queue->lock, &irqL);
+
+	return precvframe;
+}
+
+void rtw_init_recvframe(union recv_frame *precvframe, struct recv_priv *precvpriv)
+{
+	/* Perry: This can be removed */
+	_rtw_init_listhead(&precvframe->u.hdr.list);
+
+	precvframe->u.hdr.len=0;
+}
+
+int rtw_free_recvframe(union recv_frame *precvframe, _queue *pfree_recv_queue)
+{
+	_irqL irqL;
+	_adapter *padapter=precvframe->u.hdr.adapter;
+	struct recv_priv *precvpriv = &padapter->recvpriv;
+
+_func_enter_;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->adapter_type > PRIMARY_ADAPTER)
+	{
+		padapter = padapter->pbuddy_adapter;//get primary_padapter
+		precvpriv = &padapter->recvpriv;
+		pfree_recv_queue = &precvpriv->free_recv_queue;
+		precvframe->u.hdr.adapter = padapter;
+	}
+#endif
+
+
+#ifdef PLATFORM_WINDOWS
+	rtw_os_read_port(padapter, precvframe->u.hdr.precvbuf);
+#endif
+
+#if defined(PLATFORM_LINUX) || defined(PLATFORM_FREEBSD)
+
+	if(precvframe->u.hdr.pkt)
+	{
+#ifdef CONFIG_BSD_RX_USE_MBUF
+		m_freem(precvframe->u.hdr.pkt);
+#else	// CONFIG_BSD_RX_USE_MBUF
+		rtw_skb_free(precvframe->u.hdr.pkt);//free skb by driver
+#endif	// CONFIG_BSD_RX_USE_MBUF
+		precvframe->u.hdr.pkt = NULL;
+	}
+
+#endif //defined(PLATFORM_LINUX) || defined(PLATFORM_FREEBSD)
+
+	_enter_critical_bh(&pfree_recv_queue->lock, &irqL);
+
+	rtw_list_delete(&(precvframe->u.hdr.list));
+
+	rtw_list_insert_tail(&(precvframe->u.hdr.list), get_list_head(pfree_recv_queue));
+
+	if(padapter !=NULL){
+		if(pfree_recv_queue == &precvpriv->free_recv_queue)
+				precvpriv->free_recvframe_cnt++;
+	}
+
+      _exit_critical_bh(&pfree_recv_queue->lock, &irqL);
+
+_func_exit_;
+
+	return _SUCCESS;
+
+}
+
+
+
+
+sint _rtw_enqueue_recvframe(union recv_frame *precvframe, _queue *queue)
+{
+
+	_adapter *padapter=precvframe->u.hdr.adapter;
+	struct recv_priv *precvpriv = &padapter->recvpriv;
+
+_func_enter_;
+
+	//_rtw_init_listhead(&(precvframe->u.hdr.list));
+	rtw_list_delete(&(precvframe->u.hdr.list));
+
+
+	rtw_list_insert_tail(&(precvframe->u.hdr.list), get_list_head(queue));
+
+	if (padapter != NULL) {
+		if (queue == &precvpriv->free_recv_queue)
+			precvpriv->free_recvframe_cnt++;
+	}
+
+_func_exit_;
+
+	return _SUCCESS;
+}
+
+sint rtw_enqueue_recvframe(union recv_frame *precvframe, _queue *queue)
+{
+	sint ret;
+	_irqL irqL;
+
+	//_spinlock(&pfree_recv_queue->lock);
+	_enter_critical_bh(&queue->lock, &irqL);
+	ret = _rtw_enqueue_recvframe(precvframe, queue);
+	//_rtw_spinunlock(&pfree_recv_queue->lock);
+	_exit_critical_bh(&queue->lock, &irqL);
+
+	return ret;
+}
+
+/*
+sint	rtw_enqueue_recvframe(union recv_frame *precvframe, _queue *queue)
+{
+	return rtw_free_recvframe(precvframe, queue);
+}
+*/
+
+
+
+
+/*
+caller : defrag ; recvframe_chk_defrag in recv_thread  (passive)
+pframequeue: defrag_queue : will be accessed in recv_thread  (passive)
+
+using spinlock to protect
+
+*/
+
+void rtw_free_recvframe_queue(_queue *pframequeue,  _queue *pfree_recv_queue)
+{
+	union	recv_frame 	*precvframe;
+	_list	*plist, *phead;
+
+_func_enter_;
+	_rtw_spinlock(&pframequeue->lock);
+
+	phead = get_list_head(pframequeue);
+	plist = get_next(phead);
+
+	while(rtw_end_of_queue_search(phead, plist) == _FALSE)
+	{
+		precvframe = LIST_CONTAINOR(plist, union recv_frame, u);
+
+		plist = get_next(plist);
+
+		//rtw_list_delete(&precvframe->u.hdr.list); // will do this in rtw_free_recvframe()
+
+		rtw_free_recvframe(precvframe, pfree_recv_queue);
+	}
+
+	_rtw_spinunlock(&pframequeue->lock);
+
+_func_exit_;
+
+}
+
+u32 rtw_free_uc_swdec_pending_queue(_adapter *adapter)
+{
+	u32 cnt = 0;
+	union recv_frame *pending_frame;
+	while((pending_frame=rtw_alloc_recvframe(&adapter->recvpriv.uc_swdec_pending_queue))) {
+		rtw_free_recvframe(pending_frame, &adapter->recvpriv.free_recv_queue);
+		DBG_871X("%s: dequeue uc_swdec_pending_queue\n", __func__);
+		cnt++;
+	}
+
+	return cnt;
+}
+
+
+sint rtw_enqueue_recvbuf_to_head(struct recv_buf *precvbuf, _queue *queue)
+{
+	_irqL irqL;
+
+	_enter_critical(&queue->lock, &irqL);
+
+	rtw_list_delete(&precvbuf->list);
+	rtw_list_insert_head(&precvbuf->list, get_list_head(queue));
+
+	_exit_critical(&queue->lock, &irqL);
+
+	return _SUCCESS;
+}
+
+sint rtw_enqueue_recvbuf(struct recv_buf *precvbuf, _queue *queue)
+{
+	_irqL irqL;
+
+	_enter_critical(&queue->lock, &irqL);
+
+	rtw_list_delete(&precvbuf->list);
+
+	rtw_list_insert_tail(&precvbuf->list, get_list_head(queue));
+
+	_exit_critical(&queue->lock, &irqL);
+
+
+	return _SUCCESS;
+
+}
+
+struct recv_buf *rtw_dequeue_recvbuf (_queue *queue)
+{
+	_irqL irqL;
+	struct recv_buf *precvbuf;
+	_list	*plist, *phead;
+
+	_enter_critical(&queue->lock, &irqL);
+
+	if(_rtw_queue_empty(queue) == _TRUE)
+	{
+		precvbuf = NULL;
+	}
+	else
+	{
+		phead = get_list_head(queue);
+
+		plist = get_next(phead);
+
+		precvbuf = LIST_CONTAINOR(plist, struct recv_buf, list);
+
+		rtw_list_delete(&precvbuf->list);
+
+	}
+
+	_exit_critical(&queue->lock, &irqL);
+
+
+	return precvbuf;
+
+}
+
+sint recvframe_chkmic(_adapter *adapter,  union recv_frame *precvframe);
+sint recvframe_chkmic(_adapter *adapter,  union recv_frame *precvframe){
+
+	sint	i,res=_SUCCESS;
+	u32	datalen;
+	u8	miccode[8];
+	u8	bmic_err=_FALSE,brpt_micerror = _TRUE;
+	u8	*pframe, *payload,*pframemic;
+	u8	*mickey;
+	//u8	*iv,rxdata_key_idx=0;
+	struct	sta_info		*stainfo;
+	struct	rx_pkt_attrib	*prxattrib=&precvframe->u.hdr.attrib;
+	struct 	security_priv	*psecuritypriv=&adapter->securitypriv;
+
+	struct mlme_ext_priv	*pmlmeext = &adapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+_func_enter_;
+
+	stainfo=rtw_get_stainfo(&adapter->stapriv ,&prxattrib->ta[0]);
+
+	if(prxattrib->encrypt ==_TKIP_)
+	{
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("\n recvframe_chkmic:prxattrib->encrypt ==_TKIP_\n"));
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("\n recvframe_chkmic:da=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+			prxattrib->ra[0],prxattrib->ra[1],prxattrib->ra[2],prxattrib->ra[3],prxattrib->ra[4],prxattrib->ra[5]));
+
+		//calculate mic code
+		if(stainfo!= NULL)
+		{
+			if(IS_MCAST(prxattrib->ra))
+			{
+				//mickey=&psecuritypriv->dot118021XGrprxmickey.skey[0];
+				//iv = precvframe->u.hdr.rx_data+prxattrib->hdrlen;
+				//rxdata_key_idx =( ((iv[3])>>6)&0x3) ;
+				mickey=&psecuritypriv->dot118021XGrprxmickey[prxattrib->key_index].skey[0];
+
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("\n recvframe_chkmic: bcmc key \n"));
+				//DBG_871X("\n recvframe_chkmic: bcmc key psecuritypriv->dot118021XGrpKeyid(%d),pmlmeinfo->key_index(%d) ,recv key_id(%d)\n",
+				//								psecuritypriv->dot118021XGrpKeyid,pmlmeinfo->key_index,rxdata_key_idx);
+
+				if(psecuritypriv->binstallGrpkey==_FALSE)
+				{
+					res=_FAIL;
+					RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("\n recvframe_chkmic:didn't install group key!!!!!!!!!!\n"));
+					DBG_871X("\n recvframe_chkmic:didn't install group key!!!!!!!!!!\n");
+					goto exit;
+				}
+			}
+			else{
+				mickey=&stainfo->dot11tkiprxmickey.skey[0];
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("\n recvframe_chkmic: unicast key \n"));
+			}
+
+			datalen=precvframe->u.hdr.len-prxattrib->hdrlen-prxattrib->iv_len-prxattrib->icv_len-8;//icv_len included the mic code
+			pframe=precvframe->u.hdr.rx_data;
+			payload=pframe+prxattrib->hdrlen+prxattrib->iv_len;
+
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("\n prxattrib->iv_len=%d prxattrib->icv_len=%d\n",prxattrib->iv_len,prxattrib->icv_len));
+
+			//rtw_seccalctkipmic(&stainfo->dot11tkiprxmickey.skey[0],pframe,payload, datalen ,&miccode[0],(unsigned char)prxattrib->priority); //care the length of the data
+
+			rtw_seccalctkipmic(mickey,pframe,payload, datalen ,&miccode[0],(unsigned char)prxattrib->priority); //care the length of the data
+
+			pframemic=payload+datalen;
+
+			bmic_err=_FALSE;
+
+			for(i=0;i<8;i++){
+				if(miccode[i] != *(pframemic+i)){
+					RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvframe_chkmic:miccode[%d](%02x) != *(pframemic+%d)(%02x) ",i,miccode[i],i,*(pframemic+i)));
+					bmic_err=_TRUE;
+				}
+			}
+
+
+			if(bmic_err==_TRUE){
+
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("\n *(pframemic-8)-*(pframemic-1)=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+					*(pframemic-8),*(pframemic-7),*(pframemic-6),*(pframemic-5),*(pframemic-4),*(pframemic-3),*(pframemic-2),*(pframemic-1)));
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("\n *(pframemic-16)-*(pframemic-9)=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
+					*(pframemic-16),*(pframemic-15),*(pframemic-14),*(pframemic-13),*(pframemic-12),*(pframemic-11),*(pframemic-10),*(pframemic-9)));
+
+				{
+					uint i;
+					RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("\n ======demp packet (len=%d)======\n",precvframe->u.hdr.len));
+					for(i=0;i<precvframe->u.hdr.len;i=i+8){
+						RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x",
+							*(precvframe->u.hdr.rx_data+i),*(precvframe->u.hdr.rx_data+i+1),
+							*(precvframe->u.hdr.rx_data+i+2),*(precvframe->u.hdr.rx_data+i+3),
+							*(precvframe->u.hdr.rx_data+i+4),*(precvframe->u.hdr.rx_data+i+5),
+							*(precvframe->u.hdr.rx_data+i+6),*(precvframe->u.hdr.rx_data+i+7)));
+					}
+					RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("\n ======demp packet end [len=%d]======\n",precvframe->u.hdr.len));
+					RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("\n hrdlen=%d, \n",prxattrib->hdrlen));
+				}
+
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("ra=0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x psecuritypriv->binstallGrpkey=%d ",
+					prxattrib->ra[0],prxattrib->ra[1],prxattrib->ra[2],
+					prxattrib->ra[3],prxattrib->ra[4],prxattrib->ra[5],psecuritypriv->binstallGrpkey));
+
+				// double check key_index for some timing issue ,
+				// cannot compare with psecuritypriv->dot118021XGrpKeyid also cause timing issue
+				if((IS_MCAST(prxattrib->ra)==_TRUE)  && (prxattrib->key_index != pmlmeinfo->key_index ))
+					brpt_micerror = _FALSE;
+
+				if(brpt_micerror == _TRUE)
+				{
+					rtw_handle_tkip_mic_err(adapter,(u8)IS_MCAST(prxattrib->ra));
+					RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,(" mic error :prxattrib->bdecrypted=%d \n", brpt_micerror));
+					DBG_871X(" mic error :brpt_micerror=%d\n", brpt_micerror);
+				}
+
+				res=_FAIL;
+
+			}
+			else{
+				//mic checked ok
+				if((psecuritypriv->bcheck_grpkey ==_FALSE)&&(IS_MCAST(prxattrib->ra)==_TRUE)){
+					psecuritypriv->bcheck_grpkey =_TRUE;
+					RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("psecuritypriv->bcheck_grpkey =_TRUE"));
+				}
+			}
+
+		}
+		else
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvframe_chkmic: rtw_get_stainfo==NULL!!!\n"));
+		}
+
+		recvframe_pull_tail(precvframe, 8);
+
+	}
+
+exit:
+
+_func_exit_;
+
+	return res;
+
+}
+
+//decrypt and set the ivlen,icvlen of the recv_frame
+union recv_frame * decryptor(_adapter *padapter,union recv_frame *precv_frame);
+union recv_frame * decryptor(_adapter *padapter,union recv_frame *precv_frame)
+{
+
+	struct rx_pkt_attrib *prxattrib = &precv_frame->u.hdr.attrib;
+	struct security_priv *psecuritypriv=&padapter->securitypriv;
+	union recv_frame *return_packet=precv_frame;
+	u32	 res=_SUCCESS;
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("prxstat->decrypted=%x prxattrib->encrypt = 0x%03x\n",prxattrib->bdecrypted,prxattrib->encrypt));
+
+	if(prxattrib->encrypt>0)
+	{
+		u8 *iv = precv_frame->u.hdr.rx_data+prxattrib->hdrlen;
+		prxattrib->key_index = ( ((iv[3])>>6)&0x3) ;
+
+		if(prxattrib->key_index > WEP_KEYS)
+		{
+			DBG_871X("prxattrib->key_index(%d) > WEP_KEYS \n", prxattrib->key_index);
+
+			switch(prxattrib->encrypt){
+				case _WEP40_:
+				case _WEP104_:
+					prxattrib->key_index = psecuritypriv->dot11PrivacyKeyIndex;
+					break;
+				case _TKIP_:
+				case _AES_:
+				default:
+					prxattrib->key_index = psecuritypriv->dot118021XGrpKeyid;
+					break;
+			}
+		}
+	}
+
+	if((prxattrib->encrypt>0) && ((prxattrib->bdecrypted==0) ||(psecuritypriv->sw_decrypt==_TRUE)))
+	{
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if(!IS_MCAST(prxattrib->ra))//bc/mc packets use sw decryption for concurrent mode
+#endif
+		psecuritypriv->hw_decrypted=_FALSE;
+
+		#ifdef DBG_RX_DECRYPTOR
+		DBG_871X("prxstat->bdecrypted:%d,  prxattrib->encrypt:%d,  Setting psecuritypriv->hw_decrypted = %d\n"
+			, prxattrib->bdecrypted ,prxattrib->encrypt, psecuritypriv->hw_decrypted);
+		#endif
+
+		switch(prxattrib->encrypt){
+		case _WEP40_:
+		case _WEP104_:
+			rtw_wep_decrypt(padapter, (u8 *)precv_frame);
+			break;
+		case _TKIP_:
+			res = rtw_tkip_decrypt(padapter, (u8 *)precv_frame);
+			break;
+		case _AES_:
+			res = rtw_aes_decrypt(padapter, (u8 * )precv_frame);
+			break;
+		default:
+				break;
+		}
+	}
+	else if(prxattrib->bdecrypted==1
+		&& prxattrib->encrypt >0
+		&& (psecuritypriv->busetkipkey==1 || prxattrib->encrypt !=_TKIP_ )
+		)
+	{
+#if 0
+		if((prxstat->icv==1)&&(prxattrib->encrypt!=_AES_))
+		{
+			psecuritypriv->hw_decrypted=_FALSE;
+
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("psecuritypriv->hw_decrypted=_FALSE"));
+
+			rtw_free_recvframe(precv_frame, &padapter->recvpriv.free_recv_queue);
+
+			return_packet=NULL;
+
+		}
+		else
+#endif
+		{
+			psecuritypriv->hw_decrypted=_TRUE;
+			#ifdef DBG_RX_DECRYPTOR
+			DBG_871X("prxstat->bdecrypted:%d,  prxattrib->encrypt:%d,  Setting psecuritypriv->hw_decrypted = %d\n"
+			, prxattrib->bdecrypted ,prxattrib->encrypt, psecuritypriv->hw_decrypted);
+			#endif
+
+		}
+	}
+	else {
+		#ifdef DBG_RX_DECRYPTOR
+		DBG_871X("prxstat->bdecrypted:%d,  prxattrib->encrypt:%d,  psecuritypriv->hw_decrypted:%d\n"
+		, prxattrib->bdecrypted ,prxattrib->encrypt, psecuritypriv->hw_decrypted);
+		#endif
+	}
+
+	if(res == _FAIL)
+	{
+		rtw_free_recvframe(return_packet,&padapter->recvpriv.free_recv_queue);
+		return_packet = NULL;
+
+	}
+	//recvframe_chkmic(adapter, precv_frame);   //move to recvframme_defrag function
+
+_func_exit_;
+
+	return return_packet;
+
+}
+//###set the security information in the recv_frame
+union recv_frame * portctrl(_adapter *adapter,union recv_frame * precv_frame);
+union recv_frame * portctrl(_adapter *adapter,union recv_frame * precv_frame)
+{
+	u8   *psta_addr,*ptr;
+	uint  auth_alg;
+	struct recv_frame_hdr *pfhdr;
+	struct sta_info * psta;
+	struct sta_priv *pstapriv ;
+	union recv_frame * prtnframe;
+	u16	ether_type=0;
+	u16  eapol_type = 0x888e;//for Funia BD's WPA issue
+	struct rx_pkt_attrib *pattrib = & precv_frame->u.hdr.attrib;
+
+_func_enter_;
+
+	pstapriv = &adapter->stapriv;
+	ptr = get_recvframe_data(precv_frame);
+	pfhdr = &precv_frame->u.hdr;
+	psta_addr = pfhdr->attrib.ta;
+	psta = rtw_get_stainfo(pstapriv, psta_addr);
+
+	auth_alg = adapter->securitypriv.dot11AuthAlgrthm;
+
+	RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("########portctrl:adapter->securitypriv.dot11AuthAlgrthm= 0x%d\n",adapter->securitypriv.dot11AuthAlgrthm));
+
+	if(auth_alg==2)
+	{
+		if ((psta!=NULL) && (psta->ieee8021x_blocked))
+		{
+			//blocked
+			//only accept EAPOL frame
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("########portctrl:psta->ieee8021x_blocked==1\n"));
+
+			prtnframe=precv_frame;
+
+			//get ether_type
+			ptr=ptr+pfhdr->attrib.hdrlen+pfhdr->attrib.iv_len+LLC_HEADER_SIZE;
+			_rtw_memcpy(&ether_type,ptr, 2);
+			ether_type= ntohs((unsigned short )ether_type);
+
+		        if (ether_type == eapol_type) {
+				prtnframe=precv_frame;
+			}
+			else {
+				//free this frame
+				rtw_free_recvframe(precv_frame, &adapter->recvpriv.free_recv_queue);
+				prtnframe=NULL;
+			}
+		}
+		else
+		{
+			//allowed
+			//check decryption status, and decrypt the frame if needed
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("########portctrl:psta->ieee8021x_blocked==0\n"));
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("portctrl:precv_frame->hdr.attrib.privacy=%x\n",precv_frame->u.hdr.attrib.privacy));
+
+			if(pattrib->bdecrypted==0)
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("portctrl:prxstat->decrypted=%x\n", pattrib->bdecrypted));
+
+			prtnframe=precv_frame;
+			//check is the EAPOL frame or not (Rekey)
+			if(ether_type == eapol_type){
+
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("########portctrl:ether_type == 0x888e\n"));
+				//check Rekey
+
+				prtnframe=precv_frame;
+			}
+			else{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("########portctrl:ether_type = 0x%.4x\n",ether_type));
+			}
+		}
+	}
+	else
+	{
+		prtnframe=precv_frame;
+	}
+
+_func_exit_;
+
+		return prtnframe;
+
+}
+
+sint recv_decache(union recv_frame *precv_frame, u8 bretry, struct stainfo_rxcache *prxcache);
+sint recv_decache(union recv_frame *precv_frame, u8 bretry, struct stainfo_rxcache *prxcache)
+{
+	sint tid = precv_frame->u.hdr.attrib.priority;
+
+	u16 seq_ctrl = ( (precv_frame->u.hdr.attrib.seq_num&0xffff) << 4) |
+		(precv_frame->u.hdr.attrib.frag_num & 0xf);
+
+_func_enter_;
+
+	if(tid>15)
+	{
+		RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("recv_decache, (tid>15)! seq_ctrl=0x%x, tid=0x%x\n", seq_ctrl, tid));
+
+		return _FAIL;
+	}
+
+	if(1)//if(bretry)
+	{
+		if(seq_ctrl == prxcache->tid_rxseq[tid])
+		{
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("recv_decache, seq_ctrl=0x%x, tid=0x%x, tid_rxseq=0x%x\n", seq_ctrl, tid, prxcache->tid_rxseq[tid]));
+
+			return _FAIL;
+		}
+	}
+
+	prxcache->tid_rxseq[tid] = seq_ctrl;
+
+_func_exit_;
+
+	return _SUCCESS;
+
+}
+
+void process_pwrbit_data(_adapter *padapter, union recv_frame *precv_frame);
+void process_pwrbit_data(_adapter *padapter, union recv_frame *precv_frame)
+{
+#ifdef CONFIG_AP_MODE
+	unsigned char pwrbit;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct sta_info *psta=NULL;
+
+	psta = rtw_get_stainfo(pstapriv, pattrib->src);
+
+	pwrbit = GetPwrMgt(ptr);
+
+	if(psta)
+	{
+		if(pwrbit)
+		{
+			if(!(psta->state & WIFI_SLEEP_STATE))
+			{
+				//psta->state |= WIFI_SLEEP_STATE;
+				//pstapriv->sta_dz_bitmap |= BIT(psta->aid);
+
+				stop_sta_xmit(padapter, psta);
+
+				//DBG_871X("to sleep, sta_dz_bitmap=%x\n", pstapriv->sta_dz_bitmap);
+			}
+		}
+		else
+		{
+			if(psta->state & WIFI_SLEEP_STATE)
+			{
+				//psta->state ^= WIFI_SLEEP_STATE;
+				//pstapriv->sta_dz_bitmap &= ~BIT(psta->aid);
+
+				wakeup_sta_to_xmit(padapter, psta);
+
+				//DBG_871X("to wakeup, sta_dz_bitmap=%x\n", pstapriv->sta_dz_bitmap);
+			}
+		}
+
+	}
+
+#endif
+}
+
+void process_wmmps_data(_adapter *padapter, union recv_frame *precv_frame);
+void process_wmmps_data(_adapter *padapter, union recv_frame *precv_frame)
+{
+#ifdef CONFIG_AP_MODE
+	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct sta_info *psta=NULL;
+
+	psta = rtw_get_stainfo(pstapriv, pattrib->src);
+
+	if(!psta) return;
+
+#ifdef CONFIG_TDLS
+	if( !(psta->tdls_sta_state & TDLS_LINKED_STATE ) )
+	{
+#endif //CONFIG_TDLS
+
+	if(!psta->qos_option)
+		return;
+
+	if(!(psta->qos_info&0xf))
+		return;
+
+#ifdef CONFIG_TDLS
+	}
+#endif //CONFIG_TDLS
+
+	if(psta->state&WIFI_SLEEP_STATE)
+	{
+		u8 wmmps_ac=0;
+
+		switch(pattrib->priority)
+		{
+			case 1:
+			case 2:
+				wmmps_ac = psta->uapsd_bk&BIT(1);
+				break;
+			case 4:
+			case 5:
+				wmmps_ac = psta->uapsd_vi&BIT(1);
+				break;
+			case 6:
+			case 7:
+				wmmps_ac = psta->uapsd_vo&BIT(1);
+				break;
+			case 0:
+			case 3:
+			default:
+				wmmps_ac = psta->uapsd_be&BIT(1);
+				break;
+		}
+
+		if(wmmps_ac)
+		{
+			if(psta->sleepq_ac_len>0)
+			{
+				//process received triggered frame
+				xmit_delivery_enabled_frames(padapter, psta);
+			}
+			else
+			{
+				//issue one qos null frame with More data bit = 0 and the EOSP bit set (=1)
+				issue_qos_nulldata(padapter, psta->hwaddr, (u16)pattrib->priority, 0, 0);
+			}
+		}
+
+	}
+
+
+#endif
+
+}
+
+#ifdef CONFIG_TDLS
+sint OnTDLS(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct rx_pkt_attrib	*pattrib = & precv_frame->u.hdr.attrib;
+	sint ret = _SUCCESS;
+	u8 *paction = get_recvframe_data(precv_frame);
+	u8 category_field = 1;
+#ifdef CONFIG_WFD
+	u8 WFA_OUI[3] = { 0x50, 0x6f, 0x9a };
+#endif //CONFIG_WFD
+	struct tdls_info *ptdlsinfo = &(adapter->tdlsinfo);
+
+	//point to action field
+	paction+=pattrib->hdrlen
+			+ pattrib->iv_len
+			+ SNAP_SIZE
+			+ ETH_TYPE_LEN
+			+ PAYLOAD_TYPE_LEN
+			+ category_field;
+
+	if(ptdlsinfo->enable == 0)
+	{
+		DBG_871X("recv tdls frame, "
+				"but tdls haven't enabled\n");
+		ret = _FAIL;
+		return ret;
+	}
+
+	switch(*paction){
+		case TDLS_SETUP_REQUEST:
+			DBG_871X("recv tdls setup request frame\n");
+			ret=On_TDLS_Setup_Req(adapter, precv_frame);
+			break;
+		case TDLS_SETUP_RESPONSE:
+			DBG_871X("recv tdls setup response frame\n");
+			ret=On_TDLS_Setup_Rsp(adapter, precv_frame);
+			break;
+		case TDLS_SETUP_CONFIRM:
+			DBG_871X("recv tdls setup confirm frame\n");
+			ret=On_TDLS_Setup_Cfm(adapter, precv_frame);
+			break;
+		case TDLS_TEARDOWN:
+			DBG_871X("recv tdls teardown, free sta_info\n");
+			ret=On_TDLS_Teardown(adapter, precv_frame);
+			break;
+		case TDLS_DISCOVERY_REQUEST:
+			DBG_871X("recv tdls discovery request frame\n");
+			ret=On_TDLS_Dis_Req(adapter, precv_frame);
+			break;
+		case TDLS_PEER_TRAFFIC_RESPONSE:
+			DBG_871X("recv tdls peer traffic response frame\n");
+			ret=On_TDLS_Peer_Traffic_Rsp(adapter, precv_frame);
+			break;
+		case TDLS_CHANNEL_SWITCH_REQUEST:
+			DBG_871X("recv tdls channel switch request frame\n");
+			ret=On_TDLS_Ch_Switch_Req(adapter, precv_frame);
+			break;
+		case TDLS_CHANNEL_SWITCH_RESPONSE:
+			DBG_871X("recv tdls channel switch response frame\n");
+			ret=On_TDLS_Ch_Switch_Rsp(adapter, precv_frame);
+			break;
+#ifdef CONFIG_WFD
+		case 0x50:	//First byte of WFA OUI
+			if( _rtw_memcmp(WFA_OUI, (paction), 3) )
+			{
+				if( *(paction + 3) == 0x04)	//Probe request frame
+				{
+					//WFDTDLS: for sigma test, do not setup direct link automatically
+					ptdlsinfo->dev_discovered = 1;
+					DBG_871X("recv tunneled probe request frame\n");
+					issue_tunneled_probe_rsp(adapter, precv_frame);
+				}
+				if( *(paction + 3) == 0x05)	//Probe response frame
+				{
+					//WFDTDLS: for sigma test, do not setup direct link automatically
+					ptdlsinfo->dev_discovered = 1;
+					DBG_871X("recv tunneled probe response frame\n");
+				}
+			}
+			break;
+#endif //CONFIG_WFD
+		default:
+			DBG_871X("receive TDLS frame but not supported\n");
+			ret=_FAIL;
+			break;
+	}
+
+exit:
+	return ret;
+
+}
+#endif //CONFIG_TDLS
+
+void count_rx_stats(_adapter *padapter, union recv_frame *prframe, struct sta_info*sta);
+void count_rx_stats(_adapter *padapter, union recv_frame *prframe, struct sta_info*sta)
+{
+	int	sz;
+	struct sta_info		*psta = NULL;
+	struct stainfo_stats	*pstats = NULL;
+	struct rx_pkt_attrib	*pattrib = & prframe->u.hdr.attrib;
+	struct recv_priv		*precvpriv = &padapter->recvpriv;
+
+	sz = get_recvframe_len(prframe);
+	precvpriv->rx_bytes += sz;
+
+	padapter->mlmepriv.LinkDetectInfo.NumRxOkInPeriod++;
+
+	if( (!MacAddr_isBcst(pattrib->dst)) && (!IS_MCAST(pattrib->dst))){
+		padapter->mlmepriv.LinkDetectInfo.NumRxUnicastOkInPeriod++;
+	}
+
+	if(sta)
+		psta = sta;
+	else
+		psta = prframe->u.hdr.psta;
+
+	if(psta)
+	{
+		pstats = &psta->sta_stats;
+
+		pstats->rx_data_pkts++;
+		pstats->rx_bytes += sz;
+	}
+
+}
+
+sint sta2sta_data_frame(
+	_adapter *adapter,
+	union recv_frame *precv_frame,
+	struct sta_info**psta
+);
+sint sta2sta_data_frame(
+	_adapter *adapter,
+	union recv_frame *precv_frame,
+	struct sta_info**psta
+)
+{
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	sint ret = _SUCCESS;
+	struct rx_pkt_attrib *pattrib = & precv_frame->u.hdr.attrib;
+	struct	sta_priv 		*pstapriv = &adapter->stapriv;
+	struct	mlme_priv	*pmlmepriv = &adapter->mlmepriv;
+	u8 *mybssid  = get_bssid(pmlmepriv);
+	u8 *myhwaddr = myid(&adapter->eeprompriv);
+	u8 * sta_addr = NULL;
+	sint bmcast = IS_MCAST(pattrib->dst);
+
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &adapter->tdlsinfo;
+	struct sta_info *ptdls_sta=NULL;
+	u8 *psnap_type=ptr+pattrib->hdrlen + pattrib->iv_len+SNAP_SIZE;
+	u8 *pframe_body = psnap_type + ETH_TYPE_LEN + PAYLOAD_TYPE_LEN;
+#endif //CONFIG_TDLS
+
+_func_enter_;
+
+	if ((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE))
+	{
+
+		// filter packets that SA is myself or multicast or broadcast
+		if (_rtw_memcmp(myhwaddr, pattrib->src, ETH_ALEN)){
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,(" SA==myself \n"));
+			ret= _FAIL;
+			goto exit;
+		}
+
+		if( (!_rtw_memcmp(myhwaddr, pattrib->dst, ETH_ALEN))	&& (!bmcast) ){
+			ret= _FAIL;
+			goto exit;
+		}
+
+		if( _rtw_memcmp(pattrib->bssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
+		   _rtw_memcmp(mybssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
+		   (!_rtw_memcmp(pattrib->bssid, mybssid, ETH_ALEN)) ) {
+			ret= _FAIL;
+			goto exit;
+		}
+
+		sta_addr = pattrib->src;
+
+	}
+	else if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE)
+	{
+#ifdef CONFIG_TDLS
+		//direct link data transfer
+		if(ptdlsinfo->setup_state == TDLS_LINKED_STATE){
+			ptdls_sta = rtw_get_stainfo(pstapriv, pattrib->src);
+			if(ptdls_sta==NULL)
+			{
+				ret=_FAIL;
+				goto exit;
+			}
+			else if(ptdls_sta->tdls_sta_state&TDLS_LINKED_STATE)
+			{
+				//drop QoS-SubType Data, including QoS NULL, excluding QoS-Data
+				if( (GetFrameSubType(ptr) & WIFI_QOS_DATA_TYPE )== WIFI_QOS_DATA_TYPE)
+				{
+					if(GetFrameSubType(ptr)&(BIT(4)|BIT(5)|BIT(6)))
+					{
+						DBG_871X("drop QoS-Sybtype Data\n");
+						ret= _FAIL;
+						goto exit;
+					}
+				}
+				// filter packets that SA is myself or multicast or broadcast
+				if (_rtw_memcmp(myhwaddr, pattrib->src, ETH_ALEN)){
+					ret= _FAIL;
+					goto exit;
+				}
+				// da should be for me
+				if((!_rtw_memcmp(myhwaddr, pattrib->dst, ETH_ALEN))&& (!bmcast))
+				{
+					ret= _FAIL;
+					goto exit;
+				}
+				// check BSSID
+				if( _rtw_memcmp(pattrib->bssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
+				     _rtw_memcmp(mybssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
+				     (!_rtw_memcmp(pattrib->bssid, mybssid, ETH_ALEN)) )
+				{
+					ret= _FAIL;
+					goto exit;
+				}
+
+				//process UAPSD tdls sta
+				process_pwrbit_data(adapter, precv_frame);
+
+				// if NULL-frame, check pwrbit
+				if ((GetFrameSubType(ptr)) == WIFI_DATA_NULL)
+				{
+					//NULL-frame with pwrbit=1, buffer_STA should buffer frames for sleep_STA
+					if(GetPwrMgt(ptr))
+					{
+						DBG_871X("TDLS: recv peer null frame with pwr bit 1\n");
+						ptdls_sta->tdls_sta_state|=TDLS_PEER_SLEEP_STATE;
+					}
+					// it would be triggered when we are off channel and receiving NULL DATA
+					// we can confirm that peer STA is at off channel
+					else if(ptdls_sta->tdls_sta_state&TDLS_CH_SWITCH_ON_STATE)
+					{
+						if((ptdls_sta->tdls_sta_state & TDLS_PEER_AT_OFF_STATE) != TDLS_PEER_AT_OFF_STATE)
+						{
+							issue_nulldata_to_TDLS_peer_STA(adapter, ptdls_sta, 0);
+							ptdls_sta->tdls_sta_state |= TDLS_PEER_AT_OFF_STATE;
+							On_TDLS_Peer_Traffic_Rsp(adapter, precv_frame);
+						}
+					}
+
+					ret= _FAIL;
+					goto exit;
+				}
+				//receive some of all TDLS management frames, process it at ON_TDLS
+				if((_rtw_memcmp(psnap_type, SNAP_ETH_TYPE_TDLS, 2))){
+					ret= OnTDLS(adapter, precv_frame);
+					goto exit;
+				}
+
+			}
+
+			sta_addr = pattrib->src;
+
+		}
+		else
+#endif //CONFIG_TDLS
+		{
+			// For Station mode, sa and bssid should always be BSSID, and DA is my mac-address
+			if(!_rtw_memcmp(pattrib->bssid, pattrib->src, ETH_ALEN) )
+			{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("bssid != TA under STATION_MODE; drop pkt\n"));
+				ret= _FAIL;
+				goto exit;
+			}
+
+			sta_addr = pattrib->bssid;
+		}
+	}
+	else if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+		if (bmcast)
+		{
+			// For AP mode, if DA == MCAST, then BSSID should be also MCAST
+			if (!IS_MCAST(pattrib->bssid)){
+					ret= _FAIL;
+					goto exit;
+			}
+		}
+		else // not mc-frame
+		{
+			// For AP mode, if DA is non-MCAST, then it must be BSSID, and bssid == BSSID
+			if(!_rtw_memcmp(pattrib->bssid, pattrib->dst, ETH_ALEN)) {
+				ret= _FAIL;
+				goto exit;
+			}
+
+			sta_addr = pattrib->src;
+		}
+
+	}
+	else if(check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE)
+	{
+		_rtw_memcpy(pattrib->dst, GetAddr1Ptr(ptr), ETH_ALEN);
+		_rtw_memcpy(pattrib->src, GetAddr2Ptr(ptr), ETH_ALEN);
+		_rtw_memcpy(pattrib->bssid, GetAddr3Ptr(ptr), ETH_ALEN);
+		_rtw_memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
+		_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+		sta_addr = mybssid;
+	}
+	else
+	{
+		ret  = _FAIL;
+	}
+
+
+
+	if(bmcast)
+		*psta = rtw_get_bcmc_stainfo(adapter);
+	else
+		*psta = rtw_get_stainfo(pstapriv, sta_addr); // get ap_info
+
+#ifdef CONFIG_TDLS
+	if(ptdls_sta != NULL)
+		*psta = ptdls_sta;
+#endif //CONFIG_TDLS
+
+
+	if (*psta == NULL) {
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("can't get psta under sta2sta_data_frame ; drop pkt\n"));
+#ifdef CONFIG_MP_INCLUDED
+		if(check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE)
+		adapter->mppriv.rx_pktloss++;
+#endif
+		ret= _FAIL;
+		goto exit;
+	}
+
+exit:
+_func_exit_;
+	return ret;
+
+}
+
+sint ap2sta_data_frame(
+	_adapter *adapter,
+	union recv_frame *precv_frame,
+	struct sta_info**psta );
+sint ap2sta_data_frame(
+	_adapter *adapter,
+	union recv_frame *precv_frame,
+	struct sta_info**psta )
+{
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	struct rx_pkt_attrib *pattrib = & precv_frame->u.hdr.attrib;
+	sint ret = _SUCCESS;
+	struct	sta_priv 		*pstapriv = &adapter->stapriv;
+	struct	mlme_priv	*pmlmepriv = &adapter->mlmepriv;
+	u8 *mybssid  = get_bssid(pmlmepriv);
+	u8 *myhwaddr = myid(&adapter->eeprompriv);
+	sint bmcast = IS_MCAST(pattrib->dst);
+
+_func_enter_;
+
+	if ((check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE)
+		&& (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE
+			|| check_fwstate(pmlmepriv, _FW_UNDER_LINKING) == _TRUE	)
+		)
+	{
+
+		// filter packets that SA is myself or multicast or broadcast
+		if (_rtw_memcmp(myhwaddr, pattrib->src, ETH_ALEN)){
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,(" SA==myself \n"));
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s SA=%x:%x:%x:%x:%x:%x, myhwaddr= %x:%x:%x:%x:%x:%x\n", __FUNCTION__,
+				pattrib->src[0], pattrib->src[1], pattrib->src[2],
+				pattrib->src[3], pattrib->src[4], pattrib->src[5],
+				*(myhwaddr), *(myhwaddr+1), *(myhwaddr+2),
+				*(myhwaddr+3), *(myhwaddr+4), *(myhwaddr+5));
+			#endif
+			ret= _FAIL;
+			goto exit;
+		}
+
+		// da should be for me
+		if((!_rtw_memcmp(myhwaddr, pattrib->dst, ETH_ALEN))&& (!bmcast))
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,
+				(" ap2sta_data_frame:  compare DA fail; DA="MAC_FMT"\n", MAC_ARG(pattrib->dst)));
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s DA="MAC_FMT"\n", __func__, MAC_ARG(pattrib->dst));
+			#endif
+			ret= _FAIL;
+			goto exit;
+		}
+
+
+		// check BSSID
+		if( _rtw_memcmp(pattrib->bssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
+		     _rtw_memcmp(mybssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
+		     (!_rtw_memcmp(pattrib->bssid, mybssid, ETH_ALEN)) )
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,
+				(" ap2sta_data_frame:  compare BSSID fail ; BSSID="MAC_FMT"\n", MAC_ARG(pattrib->bssid)));
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("mybssid="MAC_FMT"\n", MAC_ARG(mybssid)));
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s BSSID="MAC_FMT", mybssid="MAC_FMT"\n",
+				__FUNCTION__, MAC_ARG(pattrib->bssid), MAC_ARG(mybssid));
+			DBG_871X( "this adapter = %d, buddy adapter = %d\n", adapter->adapter_type, adapter->pbuddy_adapter->adapter_type );
+			#endif
+
+			if(!bmcast)
+			{
+				DBG_871X("issue_deauth to the nonassociated ap=" MAC_FMT " for the reason(7)\n", MAC_ARG(pattrib->bssid));
+				issue_deauth(adapter, pattrib->bssid, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
+			}
+
+			ret= _FAIL;
+			goto exit;
+		}
+
+		if(bmcast)
+			*psta = rtw_get_bcmc_stainfo(adapter);
+		else
+			*psta = rtw_get_stainfo(pstapriv, pattrib->bssid); // get ap_info
+
+		if (*psta == NULL) {
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("ap2sta: can't get psta under STATION_MODE ; drop pkt\n"));
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s can't get psta under STATION_MODE ; drop pkt\n", __FUNCTION__);
+			#endif
+			ret= _FAIL;
+			goto exit;
+		}
+
+		if ((GetFrameSubType(ptr) & WIFI_QOS_DATA_TYPE) == WIFI_QOS_DATA_TYPE) {
+		}
+
+		if (GetFrameSubType(ptr) & BIT(6)) {
+			/* No data, will not indicate to upper layer, temporily count it here */
+			count_rx_stats(adapter, precv_frame, *psta);
+			ret = RTW_RX_HANDLED;
+			goto exit;
+		}
+
+	}
+	else if ((check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE) &&
+		     (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) )
+	{
+		_rtw_memcpy(pattrib->dst, GetAddr1Ptr(ptr), ETH_ALEN);
+		_rtw_memcpy(pattrib->src, GetAddr2Ptr(ptr), ETH_ALEN);
+		_rtw_memcpy(pattrib->bssid, GetAddr3Ptr(ptr), ETH_ALEN);
+		_rtw_memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
+		_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+		//
+		_rtw_memcpy(pattrib->bssid,  mybssid, ETH_ALEN);
+
+
+		*psta = rtw_get_stainfo(pstapriv, pattrib->bssid); // get sta_info
+		if (*psta == NULL) {
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("can't get psta under MP_MODE ; drop pkt\n"));
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s can't get psta under WIFI_MP_STATE ; drop pkt\n", __FUNCTION__);
+			#endif
+			ret= _FAIL;
+			goto exit;
+		}
+
+
+	}
+	else if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+		/* Special case */
+		ret = RTW_RX_HANDLED;
+		goto exit;
+	}
+	else
+	{
+		if(_rtw_memcmp(myhwaddr, pattrib->dst, ETH_ALEN)&& (!bmcast))
+		{
+			*psta = rtw_get_stainfo(pstapriv, pattrib->bssid); // get sta_info
+			if (*psta == NULL)
+			{
+				DBG_871X("issue_deauth to the ap=" MAC_FMT " for the reason(7)\n", MAC_ARG(pattrib->bssid));
+
+				issue_deauth(adapter, pattrib->bssid, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
+			}
+		}
+
+		ret = _FAIL;
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("DBG_RX_DROP_FRAME %s fw_state:0x%x\n", __FUNCTION__, get_fwstate(pmlmepriv));
+		#endif
+	}
+
+exit:
+
+_func_exit_;
+
+	return ret;
+
+}
+
+sint sta2ap_data_frame(
+	_adapter *adapter,
+	union recv_frame *precv_frame,
+	struct sta_info**psta );
+sint sta2ap_data_frame(
+	_adapter *adapter,
+	union recv_frame *precv_frame,
+	struct sta_info**psta )
+{
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	struct rx_pkt_attrib *pattrib = & precv_frame->u.hdr.attrib;
+	struct	sta_priv 		*pstapriv = &adapter->stapriv;
+	struct	mlme_priv	*pmlmepriv = &adapter->mlmepriv;
+	unsigned char *mybssid  = get_bssid(pmlmepriv);
+	sint ret=_SUCCESS;
+
+_func_enter_;
+
+	if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+		//For AP mode, RA=BSSID, TX=STA(SRC_ADDR), A3=DST_ADDR
+		if(!_rtw_memcmp(pattrib->bssid, mybssid, ETH_ALEN))
+		{
+			ret= _FAIL;
+			goto exit;
+		}
+
+		*psta = rtw_get_stainfo(pstapriv, pattrib->src);
+		if (*psta == NULL)
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("can't get psta under AP_MODE; drop pkt\n"));
+			DBG_871X("issue_deauth to sta=" MAC_FMT " for the reason(7)\n", MAC_ARG(pattrib->src));
+
+			issue_deauth(adapter, pattrib->src, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
+
+			ret = RTW_RX_HANDLED;
+			goto exit;
+		}
+
+		process_pwrbit_data(adapter, precv_frame);
+
+		if ((GetFrameSubType(ptr) & WIFI_QOS_DATA_TYPE) == WIFI_QOS_DATA_TYPE) {
+			process_wmmps_data(adapter, precv_frame);
+		}
+
+		if (GetFrameSubType(ptr) & BIT(6)) {
+			/* No data, will not indicate to upper layer, temporily count it here */
+			count_rx_stats(adapter, precv_frame, *psta);
+			ret = RTW_RX_HANDLED;
+			goto exit;
+		}
+	}
+	else {
+		u8 *myhwaddr = myid(&adapter->eeprompriv);
+		if (!_rtw_memcmp(pattrib->ra, myhwaddr, ETH_ALEN)) {
+			ret = RTW_RX_HANDLED;
+			goto exit;
+		}
+		DBG_871X("issue_deauth to sta=" MAC_FMT " for the reason(7)\n", MAC_ARG(pattrib->src));
+		issue_deauth(adapter, pattrib->src, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
+		ret = RTW_RX_HANDLED;
+		goto exit;
+	}
+
+exit:
+
+_func_exit_;
+
+	return ret;
+
+}
+
+sint validate_recv_ctrl_frame(_adapter *padapter, union recv_frame *precv_frame);
+sint validate_recv_ctrl_frame(_adapter *padapter, union recv_frame *precv_frame)
+{
+#ifdef CONFIG_AP_MODE
+	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	u8 *pframe = precv_frame->u.hdr.rx_data;
+	//uint len = precv_frame->u.hdr.len;
+
+	//DBG_871X("+validate_recv_ctrl_frame\n");
+
+	if (GetFrameType(pframe) != WIFI_CTRL_TYPE)
+	{
+		return _FAIL;
+	}
+
+	//receive the frames that ra(a1) is my address
+	if (!_rtw_memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN))
+	{
+		return _FAIL;
+	}
+
+	//only handle ps-poll
+	if(GetFrameSubType(pframe) == WIFI_PSPOLL)
+	{
+		u16 aid;
+		u8 wmmps_ac=0;
+		struct sta_info *psta=NULL;
+
+		aid = GetAid(pframe);
+		psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
+
+		if((psta==NULL) || (psta->aid!=aid))
+		{
+			return _FAIL;
+		}
+
+		//for rx pkt statistics
+		psta->sta_stats.rx_ctrl_pkts++;
+
+		switch(pattrib->priority)
+		{
+			case 1:
+			case 2:
+				wmmps_ac = psta->uapsd_bk&BIT(0);
+				break;
+			case 4:
+			case 5:
+				wmmps_ac = psta->uapsd_vi&BIT(0);
+				break;
+			case 6:
+			case 7:
+				wmmps_ac = psta->uapsd_vo&BIT(0);
+				break;
+			case 0:
+			case 3:
+			default:
+				wmmps_ac = psta->uapsd_be&BIT(0);
+				break;
+		}
+
+		if(wmmps_ac)
+			return _FAIL;
+
+		if(psta->state & WIFI_STA_ALIVE_CHK_STATE)
+		{
+			DBG_871X("%s alive check-rx ps-poll\n", __func__);
+			psta->expire_to = pstapriv->expire_to;
+			psta->state ^= WIFI_STA_ALIVE_CHK_STATE;
+		}
+
+		if((psta->state&WIFI_SLEEP_STATE) && (pstapriv->sta_dz_bitmap&BIT(psta->aid)))
+		{
+			_irqL irqL;
+			_list	*xmitframe_plist, *xmitframe_phead;
+			struct xmit_frame *pxmitframe=NULL;
+			struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+
+			//_enter_critical_bh(&psta->sleep_q.lock, &irqL);
+			_enter_critical_bh(&pxmitpriv->lock, &irqL);
+
+			xmitframe_phead = get_list_head(&psta->sleep_q);
+			xmitframe_plist = get_next(xmitframe_phead);
+
+			if ((rtw_end_of_queue_search(xmitframe_phead, xmitframe_plist)) == _FALSE)
+			{
+				pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
+
+				xmitframe_plist = get_next(xmitframe_plist);
+
+				rtw_list_delete(&pxmitframe->list);
+
+				psta->sleepq_len--;
+
+				if(psta->sleepq_len>0)
+					pxmitframe->attrib.mdata = 1;
+                                else
+					pxmitframe->attrib.mdata = 0;
+
+				pxmitframe->attrib.triggered = 1;
+
+	                        //DBG_871X("handling ps-poll, q_len=%d, tim=%x\n", psta->sleepq_len, pstapriv->tim_bitmap);
+
+#if 0
+				_exit_critical_bh(&psta->sleep_q.lock, &irqL);
+				if(rtw_hal_xmit(padapter, pxmitframe) == _TRUE)
+				{
+					rtw_os_xmit_complete(padapter, pxmitframe);
+				}
+				_enter_critical_bh(&psta->sleep_q.lock, &irqL);
+#endif
+				rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
+
+				if(psta->sleepq_len==0)
+				{
+					pstapriv->tim_bitmap &= ~BIT(psta->aid);
+
+					//DBG_871X("after handling ps-poll, tim=%x\n", pstapriv->tim_bitmap);
+
+					//upate BCN for TIM IE
+					//update_BCNTIM(padapter);
+					update_beacon(padapter, _TIM_IE_, NULL, _FALSE);
+				}
+
+				//_exit_critical_bh(&psta->sleep_q.lock, &irqL);
+				_exit_critical_bh(&pxmitpriv->lock, &irqL);
+
+			}
+			else
+			{
+				//_exit_critical_bh(&psta->sleep_q.lock, &irqL);
+				_exit_critical_bh(&pxmitpriv->lock, &irqL);
+
+				//DBG_871X("no buffered packets to xmit\n");
+				if(pstapriv->tim_bitmap&BIT(psta->aid))
+				{
+					if(psta->sleepq_len==0)
+					{
+						DBG_871X("no buffered packets to xmit\n");
+
+						//issue nulldata with More data bit = 0 to indicate we have no buffered packets
+						issue_nulldata(padapter, psta->hwaddr, 0, 0, 0);
+					}
+					else
+					{
+						DBG_871X("error!psta->sleepq_len=%d\n", psta->sleepq_len);
+						psta->sleepq_len=0;
+					}
+
+					pstapriv->tim_bitmap &= ~BIT(psta->aid);
+
+					//upate BCN for TIM IE
+					//update_BCNTIM(padapter);
+					update_beacon(padapter, _TIM_IE_, NULL, _FALSE);
+				}
+
+			}
+
+		}
+
+	}
+
+#endif
+
+	return _FAIL;
+
+}
+
+union recv_frame* recvframe_chk_defrag(PADAPTER padapter, union recv_frame *precv_frame);
+sint validate_recv_mgnt_frame(PADAPTER padapter, union recv_frame *precv_frame);
+sint validate_recv_mgnt_frame(PADAPTER padapter, union recv_frame *precv_frame)
+{
+	//struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
+
+	RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("+validate_recv_mgnt_frame\n"));
+
+#if 0
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+#ifdef CONFIG_NATIVEAP_MLME
+		mgt_dispatcher(padapter, precv_frame);
+#else
+		rtw_hostapd_mlme_rx(padapter, precv_frame);
+#endif
+	}
+	else
+	{
+		mgt_dispatcher(padapter, precv_frame);
+	}
+#endif
+
+	precv_frame = recvframe_chk_defrag(padapter, precv_frame);
+	if (precv_frame == NULL) {
+		RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_,("%s: fragment packet\n",__FUNCTION__));
+		return _SUCCESS;
+	}
+
+	{
+		//for rx pkt statistics
+		struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, GetAddr2Ptr(precv_frame->u.hdr.rx_data));
+		if (psta) {
+			psta->sta_stats.rx_mgnt_pkts++;
+			if (GetFrameSubType(precv_frame->u.hdr.rx_data) == WIFI_BEACON)
+				psta->sta_stats.rx_beacon_pkts++;
+			else if (GetFrameSubType(precv_frame->u.hdr.rx_data) == WIFI_PROBEREQ)
+				psta->sta_stats.rx_probereq_pkts++;
+			else if (GetFrameSubType(precv_frame->u.hdr.rx_data) == WIFI_PROBERSP) {
+				if (_rtw_memcmp(padapter->eeprompriv.mac_addr, GetAddr1Ptr(precv_frame->u.hdr.rx_data), ETH_ALEN) == _TRUE)
+					psta->sta_stats.rx_probersp_pkts++;
+				else if (is_broadcast_mac_addr(GetAddr1Ptr(precv_frame->u.hdr.rx_data))
+					|| is_multicast_mac_addr(GetAddr1Ptr(precv_frame->u.hdr.rx_data)))
+					psta->sta_stats.rx_probersp_bm_pkts++;
+				else
+					psta->sta_stats.rx_probersp_uo_pkts++;
+			}
+		}
+	}
+
+#ifdef CONFIG_INTEL_PROXIM
+	if(padapter->proximity.proxim_on==_TRUE)
+	{
+		struct rx_pkt_attrib * pattrib=&precv_frame->u.hdr.attrib;
+		 struct recv_stat* prxstat=( struct recv_stat * )  precv_frame->u.hdr.rx_head ;
+		 u8 * pda,*psa,*pbssid,*ptr;
+		 ptr=precv_frame->u.hdr.rx_data;
+		pda = get_da(ptr);
+		psa = get_sa(ptr);
+		pbssid = get_hdr_bssid(ptr);
+
+
+		_rtw_memcpy(pattrib->dst, pda, ETH_ALEN);
+		_rtw_memcpy(pattrib->src, psa, ETH_ALEN);
+
+		_rtw_memcpy(pattrib->bssid, pbssid, ETH_ALEN);
+
+	switch(pattrib->to_fr_ds)
+	{
+		case 0:
+			_rtw_memcpy(pattrib->ra, pda, ETH_ALEN);
+			_rtw_memcpy(pattrib->ta, psa, ETH_ALEN);
+			break;
+
+		case 1:
+			_rtw_memcpy(pattrib->ra, pda, ETH_ALEN);
+			_rtw_memcpy(pattrib->ta, pbssid, ETH_ALEN);
+			break;
+
+		case 2:
+			_rtw_memcpy(pattrib->ra, pbssid, ETH_ALEN);
+			_rtw_memcpy(pattrib->ta, psa, ETH_ALEN);
+			break;
+
+		case 3:
+			_rtw_memcpy(pattrib->ra, GetAddr1Ptr(ptr), ETH_ALEN);
+			_rtw_memcpy(pattrib->ta, GetAddr2Ptr(ptr), ETH_ALEN);
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,(" case 3\n"));
+			break;
+
+		default:
+			break;
+
+		}
+			pattrib->priority=0;
+			pattrib->hdrlen = pattrib->to_fr_ds==3 ? 30 : 24;
+
+		 padapter->proximity.proxim_rx(padapter,precv_frame);
+	}
+#endif
+	mgt_dispatcher(padapter, precv_frame);
+
+	return _SUCCESS;
+
+}
+
+sint validate_recv_data_frame(_adapter *adapter, union recv_frame *precv_frame);
+sint validate_recv_data_frame(_adapter *adapter, union recv_frame *precv_frame)
+{
+	u8 bretry;
+	u8 *psa, *pda, *pbssid;
+	struct sta_info *psta = NULL;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	struct rx_pkt_attrib	*pattrib = & precv_frame->u.hdr.attrib;
+	struct security_priv	*psecuritypriv = &adapter->securitypriv;
+	sint ret = _SUCCESS;
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &adapter->tdlsinfo;
+#endif //CONFIG_TDLS
+
+_func_enter_;
+
+	bretry = GetRetry(ptr);
+	pda = get_da(ptr);
+	psa = get_sa(ptr);
+	pbssid = get_hdr_bssid(ptr);
+
+	if(pbssid == NULL){
+		ret= _FAIL;
+		goto exit;
+	}
+
+	_rtw_memcpy(pattrib->dst, pda, ETH_ALEN);
+	_rtw_memcpy(pattrib->src, psa, ETH_ALEN);
+
+	_rtw_memcpy(pattrib->bssid, pbssid, ETH_ALEN);
+
+	switch(pattrib->to_fr_ds)
+	{
+		case 0:
+			_rtw_memcpy(pattrib->ra, pda, ETH_ALEN);
+			_rtw_memcpy(pattrib->ta, psa, ETH_ALEN);
+			ret = sta2sta_data_frame(adapter, precv_frame, &psta);
+			break;
+
+		case 1:
+			_rtw_memcpy(pattrib->ra, pda, ETH_ALEN);
+			_rtw_memcpy(pattrib->ta, pbssid, ETH_ALEN);
+			ret = ap2sta_data_frame(adapter, precv_frame, &psta);
+			break;
+
+		case 2:
+			_rtw_memcpy(pattrib->ra, pbssid, ETH_ALEN);
+			_rtw_memcpy(pattrib->ta, psa, ETH_ALEN);
+			ret = sta2ap_data_frame(adapter, precv_frame, &psta);
+			break;
+
+		case 3:
+			_rtw_memcpy(pattrib->ra, GetAddr1Ptr(ptr), ETH_ALEN);
+			_rtw_memcpy(pattrib->ta, GetAddr2Ptr(ptr), ETH_ALEN);
+			ret =_FAIL;
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,(" case 3\n"));
+			break;
+
+		default:
+			ret =_FAIL;
+			break;
+
+	}
+
+	if(ret ==_FAIL){
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("DBG_RX_DROP_FRAME %s case:%d, res:%d\n", __FUNCTION__, pattrib->to_fr_ds, ret);
+		#endif
+		goto exit;
+	} else if (ret == RTW_RX_HANDLED) {
+		goto exit;
+	}
+
+
+	if(psta==NULL){
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,(" after to_fr_ds_chk; psta==NULL \n"));
+		ret= _FAIL;
+		goto exit;
+	}
+
+	//psta->rssi = prxcmd->rssi;
+	//psta->signal_quality= prxcmd->sq;
+	precv_frame->u.hdr.psta = psta;
+
+
+	pattrib->amsdu=0;
+	pattrib->ack_policy = 0;
+	//parsing QC field
+	if(pattrib->qos == 1)
+	{
+		pattrib->priority = GetPriority((ptr + 24));
+		pattrib->ack_policy = GetAckpolicy((ptr + 24));
+		pattrib->amsdu = GetAMsdu((ptr + 24));
+		pattrib->hdrlen = pattrib->to_fr_ds==3 ? 32 : 26;
+
+		if(pattrib->priority!=0 && pattrib->priority!=3)
+		{
+			adapter->recvpriv.bIsAnyNonBEPkts = _TRUE;
+		}
+	}
+	else
+	{
+		pattrib->priority=0;
+		pattrib->hdrlen = pattrib->to_fr_ds==3 ? 30 : 24;
+	}
+
+
+	if(pattrib->order)//HT-CTRL 11n
+	{
+		pattrib->hdrlen += 4;
+	}
+
+	precv_frame->u.hdr.preorder_ctrl = &psta->recvreorder_ctrl[pattrib->priority];
+
+	// decache, drop duplicate recv packets
+	if(recv_decache(precv_frame, bretry, &psta->sta_recvpriv.rxcache) == _FAIL)
+	{
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("decache : drop pkt\n"));
+		ret= _FAIL;
+		goto exit;
+	}
+
+#if 0
+	if(psta->tdls_sta_state & TDLS_LINKED_STATE )
+	{
+		if(psta->dot118021XPrivacy==_AES_)
+			pattrib->encrypt=psta->dot118021XPrivacy;
+	}
+#endif //CONFIG_TDLS
+
+	if(pattrib->privacy){
+
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("validate_recv_data_frame:pattrib->privacy=%x\n", pattrib->privacy));
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("\n ^^^^^^^^^^^IS_MCAST(pattrib->ra(0x%02x))=%d^^^^^^^^^^^^^^^6\n", pattrib->ra[0],IS_MCAST(pattrib->ra)));
+
+#ifdef CONFIG_TDLS
+		if((psta->tdls_sta_state & TDLS_LINKED_STATE) && (psta->dot118021XPrivacy==_AES_))
+		{
+				pattrib->encrypt=psta->dot118021XPrivacy;
+		}
+		else
+#endif //CONFIG_TDLS
+		GET_ENCRY_ALGO(psecuritypriv, psta, pattrib->encrypt, IS_MCAST(pattrib->ra));
+
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("\n pattrib->encrypt=%d\n",pattrib->encrypt));
+
+		SET_ICE_IV_LEN(pattrib->iv_len, pattrib->icv_len, pattrib->encrypt);
+	}
+	else
+	{
+		pattrib->encrypt = 0;
+		pattrib->iv_len = pattrib->icv_len = 0;
+	}
+
+exit:
+
+_func_exit_;
+
+	return ret;
+}
+
+#ifdef CONFIG_IEEE80211W
+static sint validate_80211w_mgmt(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
+	struct rx_pkt_attrib *pattrib = & precv_frame->u.hdr.attrib;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	u8 type;
+	u8 subtype;
+
+	type =  GetFrameType(ptr);
+	subtype = GetFrameSubType(ptr); //bit(7)~bit(2)
+
+	//only support station mode
+	if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) && check_fwstate(pmlmepriv, _FW_LINKED)
+		&& adapter->securitypriv.binstallBIPkey == _TRUE)
+	{
+		//unicast management frame decrypt
+		if(pattrib->privacy && !(IS_MCAST(GetAddr1Ptr(ptr))) &&
+			(subtype == WIFI_DEAUTH || subtype == WIFI_DISASSOC || subtype == WIFI_ACTION))
+		{
+			u8 *ppp, *mgmt_DATA;
+			u32 data_len=0;
+			ppp = GetAddr2Ptr(ptr);
+
+			pattrib->bdecrypted = 0;
+			pattrib->encrypt = _AES_;
+			pattrib->hdrlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+			//set iv and icv length
+			SET_ICE_IV_LEN(pattrib->iv_len, pattrib->icv_len, pattrib->encrypt);
+			_rtw_memcpy(pattrib->ra, GetAddr1Ptr(ptr), ETH_ALEN);
+			_rtw_memcpy(pattrib->ta, GetAddr2Ptr(ptr), ETH_ALEN);
+			//actual management data frame body
+			data_len = pattrib->pkt_len - pattrib->hdrlen - pattrib->iv_len - pattrib->icv_len;
+			mgmt_DATA = rtw_zmalloc(data_len);
+			if(mgmt_DATA == NULL)
+			{
+				DBG_871X("%s mgmt allocate fail  !!!!!!!!!\n", __FUNCTION__);
+				goto validate_80211w_fail;
+			}
+			/*//dump the packet content before decrypt
+			{
+				int pp;
+				printk("pattrib->pktlen = %d =>", pattrib->pkt_len);
+				for(pp=0;pp< pattrib->pkt_len; pp++)
+					printk(" %02x ", ptr[pp]);
+				printk("\n");
+			}*/
+
+			precv_frame = decryptor(adapter, precv_frame);
+			//save actual management data frame body
+			_rtw_memcpy(mgmt_DATA, ptr+pattrib->hdrlen+pattrib->iv_len, data_len);
+			//overwrite the iv field
+			_rtw_memcpy(ptr+pattrib->hdrlen, mgmt_DATA, data_len);
+			//remove the iv and icv length
+			pattrib->pkt_len = pattrib->pkt_len - pattrib->iv_len - pattrib->icv_len;
+			rtw_mfree(mgmt_DATA, data_len);
+			/*//print packet content after decryption
+			{
+				int pp;
+				printk("after decryption pattrib->pktlen = %d @@=>", pattrib->pkt_len);
+				for(pp=0;pp< pattrib->pkt_len; pp++)
+					printk(" %02x ", ptr[pp]);
+				printk("\n");
+			}*/
+			if(!precv_frame)
+			{
+				DBG_871X("%s mgmt descrypt fail  !!!!!!!!!\n", __FUNCTION__);
+				goto validate_80211w_fail;
+			}
+		}
+		else if(IS_MCAST(GetAddr1Ptr(ptr)) &&
+			(subtype == WIFI_DEAUTH || subtype == WIFI_DISASSOC))
+		{
+			sint BIP_ret = _SUCCESS;
+			//verify BIP MME IE of broadcast/multicast de-auth/disassoc packet
+			BIP_ret = rtw_BIP_verify(adapter, (u8 * )precv_frame);
+			if(BIP_ret == _FAIL)
+			{
+				//DBG_871X("802.11w BIP verify fail\n");
+				goto validate_80211w_fail;
+			}
+			else if(BIP_ret == RTW_RX_HANDLED)
+			{
+				//DBG_871X("802.11w recv none protected packet\n");
+				//issue sa query request
+				issue_action_SA_Query(adapter, NULL, 0, 0);
+				goto validate_80211w_fail;
+			}
+		}//802.11w protect
+		else
+		{
+			if(subtype == WIFI_ACTION)
+			{
+				//according 802.11-2012 standard, these five types are not robust types
+				if( ptr[WLAN_HDR_A3_LEN] != RTW_WLAN_CATEGORY_PUBLIC          &&
+					ptr[WLAN_HDR_A3_LEN] != RTW_WLAN_CATEGORY_HT              &&
+					ptr[WLAN_HDR_A3_LEN] != RTW_WLAN_CATEGORY_UNPROTECTED_WNM &&
+					ptr[WLAN_HDR_A3_LEN] != RTW_WLAN_CATEGORY_SELF_PROTECTED  &&
+					ptr[WLAN_HDR_A3_LEN] != RTW_WLAN_CATEGORY_P2P)
+				{
+					DBG_871X("action frame category=%d should robust\n", ptr[WLAN_HDR_A3_LEN]);
+					goto validate_80211w_fail;
+				}
+			}
+			else if(subtype == WIFI_DEAUTH || subtype == WIFI_DISASSOC)
+			{
+				DBG_871X("802.11w recv none protected packet\n");
+				//issue sa query request
+				issue_action_SA_Query(adapter, NULL, 0, 0);
+				goto validate_80211w_fail;
+			}
+		}
+	}
+	return _SUCCESS;
+
+validate_80211w_fail:
+	return _FAIL;
+
+}
+#endif //CONFIG_IEEE80211W
+
+sint validate_recv_frame(_adapter *adapter, union recv_frame *precv_frame);
+sint validate_recv_frame(_adapter *adapter, union recv_frame *precv_frame)
+{
+	//shall check frame subtype, to / from ds, da, bssid
+
+	//then call check if rx seq/frag. duplicated.
+
+	u8 type;
+	u8 subtype;
+	sint retval = _SUCCESS;
+
+	struct rx_pkt_attrib *pattrib = & precv_frame->u.hdr.attrib;
+
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	u8  ver =(unsigned char) (*ptr)&0x3 ;
+#ifdef CONFIG_FIND_BEST_CHANNEL
+	struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
+#endif
+
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &adapter->tdlsinfo;
+#endif //CONFIG_TDLS
+
+_func_enter_;
+
+
+#ifdef CONFIG_FIND_BEST_CHANNEL
+	if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
+		int ch_set_idx = rtw_ch_set_search_ch(pmlmeext->channel_set, rtw_get_oper_ch(adapter));
+		if (ch_set_idx >= 0)
+			pmlmeext->channel_set[ch_set_idx].rx_count++;
+	}
+#endif
+
+#ifdef CONFIG_TDLS
+	if(ptdlsinfo->ch_sensing==1 && ptdlsinfo->cur_channel !=0){
+		ptdlsinfo->collect_pkt_num[ptdlsinfo->cur_channel-1]++;
+	}
+#endif //CONFIG_TDLS
+
+#ifdef RTK_DMP_PLATFORM
+	if ( 0 )
+	{
+		DBG_871X("++\n");
+		{
+			int i;
+			for(i=0; i<64;i=i+8)
+				DBG_871X("%02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X:", *(ptr+i),
+				*(ptr+i+1), *(ptr+i+2) ,*(ptr+i+3) ,*(ptr+i+4),*(ptr+i+5), *(ptr+i+6), *(ptr+i+7));
+
+		}
+		DBG_871X("--\n");
+	}
+#endif //RTK_DMP_PLATFORM
+
+	//add version chk
+	if(ver!=0){
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("validate_recv_data_frame fail! (ver!=0)\n"));
+		retval= _FAIL;
+		goto exit;
+	}
+
+	type =  GetFrameType(ptr);
+	subtype = GetFrameSubType(ptr); //bit(7)~bit(2)
+
+	pattrib->to_fr_ds = get_tofr_ds(ptr);
+
+	pattrib->frag_num = GetFragNum(ptr);
+	pattrib->seq_num = GetSequence(ptr);
+
+	pattrib->pw_save = GetPwrMgt(ptr);
+	pattrib->mfrag = GetMFrag(ptr);
+	pattrib->mdata = GetMData(ptr);
+	pattrib->privacy = GetPrivacy(ptr);
+	pattrib->order = GetOrder(ptr);
+#if 0 //for debug
+
+if(pHalData->bDumpRxPkt ==1){
+	int i;
+	DBG_871X("############################# \n");
+
+	for(i=0; i<64;i=i+8)
+		DBG_871X("%02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X:\n", *(ptr+i),
+		*(ptr+i+1), *(ptr+i+2) ,*(ptr+i+3) ,*(ptr+i+4),*(ptr+i+5), *(ptr+i+6), *(ptr+i+7));
+	DBG_871X("############################# \n");
+}
+else if(pHalData->bDumpRxPkt ==2){
+	if(type== WIFI_MGT_TYPE){
+		int i;
+		DBG_871X("############################# \n");
+
+		for(i=0; i<64;i=i+8)
+			DBG_871X("%02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X:\n", *(ptr+i),
+			*(ptr+i+1), *(ptr+i+2) ,*(ptr+i+3) ,*(ptr+i+4),*(ptr+i+5), *(ptr+i+6), *(ptr+i+7));
+		DBG_871X("############################# \n");
+	}
+}
+else if(pHalData->bDumpRxPkt ==3){
+	if(type== WIFI_DATA_TYPE){
+		int i;
+		DBG_871X("############################# \n");
+
+		for(i=0; i<64;i=i+8)
+			DBG_871X("%02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X:\n", *(ptr+i),
+			*(ptr+i+1), *(ptr+i+2) ,*(ptr+i+3) ,*(ptr+i+4),*(ptr+i+5), *(ptr+i+6), *(ptr+i+7));
+		DBG_871X("############################# \n");
+	}
+}
+
+#endif
+	switch (type)
+	{
+		case WIFI_MGT_TYPE: //mgnt
+#ifdef CONFIG_IEEE80211W
+			if(validate_80211w_mgmt(adapter, precv_frame) == _FAIL)
+			{
+				retval = _FAIL;
+				break;
+			}
+#endif //CONFIG_IEEE80211W
+
+			retval = validate_recv_mgnt_frame(adapter, precv_frame);
+			if (retval == _FAIL)
+			{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("validate_recv_mgnt_frame fail\n"));
+			}
+			retval = _FAIL; // only data frame return _SUCCESS
+			break;
+		case WIFI_CTRL_TYPE: //ctrl
+			retval = validate_recv_ctrl_frame(adapter, precv_frame);
+			if (retval == _FAIL)
+			{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("validate_recv_ctrl_frame fail\n"));
+			}
+			retval = _FAIL; // only data frame return _SUCCESS
+			break;
+		case WIFI_DATA_TYPE: //data
+			rtw_led_control(adapter, LED_CTL_RX);
+			pattrib->qos = (subtype & BIT(7))? 1:0;
+			retval = validate_recv_data_frame(adapter, precv_frame);
+			if (retval == _FAIL)
+			{
+				struct recv_priv *precvpriv = &adapter->recvpriv;
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("validate_recv_data_frame fail\n"));
+				precvpriv->rx_drop++;
+			}
+			break;
+		default:
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("validate_recv_data_frame fail! type=0x%x\n", type));
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME validate_recv_data_frame fail! type=0x%x\n", type);
+			#endif
+			retval = _FAIL;
+			break;
+	}
+
+exit:
+
+_func_exit_;
+
+	return retval;
+}
+
+
+//remove the wlanhdr and add the eth_hdr
+#if 1
+
+sint wlanhdr_to_ethhdr ( union recv_frame *precvframe);
+sint wlanhdr_to_ethhdr ( union recv_frame *precvframe)
+{
+	sint	rmv_len;
+	u16	eth_type, len;
+	u8	bsnaphdr;
+	u8	*psnap_type;
+	struct ieee80211_snap_hdr	*psnap;
+
+	sint ret=_SUCCESS;
+	_adapter			*adapter =precvframe->u.hdr.adapter;
+	struct mlme_priv	*pmlmepriv = &adapter->mlmepriv;
+
+	u8	*ptr = get_recvframe_data(precvframe) ; // point to frame_ctrl field
+	struct rx_pkt_attrib *pattrib = & precvframe->u.hdr.attrib;
+
+_func_enter_;
+
+	if(pattrib->encrypt){
+		recvframe_pull_tail(precvframe, pattrib->icv_len);
+	}
+
+	psnap=(struct ieee80211_snap_hdr	*)(ptr+pattrib->hdrlen + pattrib->iv_len);
+	psnap_type=ptr+pattrib->hdrlen + pattrib->iv_len+SNAP_SIZE;
+	/* convert hdr + possible LLC headers into Ethernet header */
+	//eth_type = (psnap_type[0] << 8) | psnap_type[1];
+	if((_rtw_memcmp(psnap, rtw_rfc1042_header, SNAP_SIZE) &&
+		(_rtw_memcmp(psnap_type, SNAP_ETH_TYPE_IPX, 2) == _FALSE) &&
+		(_rtw_memcmp(psnap_type, SNAP_ETH_TYPE_APPLETALK_AARP, 2)==_FALSE) )||
+		//eth_type != ETH_P_AARP && eth_type != ETH_P_IPX) ||
+		 _rtw_memcmp(psnap, rtw_bridge_tunnel_header, SNAP_SIZE)){
+		/* remove RFC1042 or Bridge-Tunnel encapsulation and replace EtherType */
+		bsnaphdr = _TRUE;
+	}
+	else {
+		/* Leave Ethernet header part of hdr and full payload */
+		bsnaphdr = _FALSE;
+	}
+
+	rmv_len = pattrib->hdrlen + pattrib->iv_len +(bsnaphdr?SNAP_SIZE:0);
+	len = precvframe->u.hdr.len - rmv_len;
+
+	RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("\n===pattrib->hdrlen: %x,  pattrib->iv_len:%x ===\n\n", pattrib->hdrlen,  pattrib->iv_len));
+
+	_rtw_memcpy(&eth_type, ptr+rmv_len, 2);
+	eth_type= ntohs((unsigned short )eth_type); //pattrib->ether_type
+	pattrib->eth_type = eth_type;
+
+	if ((check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE))
+	{
+		ptr += rmv_len ;
+		*ptr = 0x87;
+		*(ptr+1) = 0x12;
+
+		eth_type = 0x8712;
+		// append rx status for mp test packets
+		ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr)+2)-24);
+		_rtw_memcpy(ptr, get_rxmem(precvframe), 24);
+		ptr+=24;
+	}
+	else {
+		ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr)+ (bsnaphdr?2:0)));
+	}
+
+	_rtw_memcpy(ptr, pattrib->dst, ETH_ALEN);
+	_rtw_memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN);
+
+	if(!bsnaphdr) {
+		len = htons(len);
+		_rtw_memcpy(ptr+12, &len, 2);
+	}
+
+_func_exit_;
+	return ret;
+
+}
+
+#else
+
+sint wlanhdr_to_ethhdr ( union recv_frame *precvframe)
+{
+	sint rmv_len;
+	u16 eth_type;
+	u8	bsnaphdr;
+	u8	*psnap_type;
+	struct ieee80211_snap_hdr	*psnap;
+
+	sint ret=_SUCCESS;
+	_adapter	*adapter =precvframe->u.hdr.adapter;
+	struct	mlme_priv	*pmlmepriv = &adapter->mlmepriv;
+
+	u8* ptr = get_recvframe_data(precvframe) ; // point to frame_ctrl field
+	struct rx_pkt_attrib *pattrib = & precvframe->u.hdr.attrib;
+	struct _vlan *pvlan = NULL;
+
+_func_enter_;
+
+	psnap=(struct ieee80211_snap_hdr	*)(ptr+pattrib->hdrlen + pattrib->iv_len);
+	psnap_type=ptr+pattrib->hdrlen + pattrib->iv_len+SNAP_SIZE;
+	if (psnap->dsap==0xaa && psnap->ssap==0xaa && psnap->ctrl==0x03)
+	{
+		if (_rtw_memcmp(psnap->oui, oui_rfc1042, WLAN_IEEE_OUI_LEN))
+			bsnaphdr=_TRUE;//wlan_pkt_format = WLAN_PKT_FORMAT_SNAP_RFC1042;
+		else if (_rtw_memcmp(psnap->oui, SNAP_HDR_APPLETALK_DDP, WLAN_IEEE_OUI_LEN) &&
+			_rtw_memcmp(psnap_type, SNAP_ETH_TYPE_APPLETALK_DDP, 2) )
+			bsnaphdr=_TRUE;	//wlan_pkt_format = WLAN_PKT_FORMAT_APPLETALK;
+		else if (_rtw_memcmp( psnap->oui, oui_8021h, WLAN_IEEE_OUI_LEN))
+			bsnaphdr=_TRUE;	//wlan_pkt_format = WLAN_PKT_FORMAT_SNAP_TUNNEL;
+		else {
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("drop pkt due to invalid frame format!\n"));
+			ret= _FAIL;
+			goto exit;
+		}
+
+	} else
+		bsnaphdr=_FALSE;//wlan_pkt_format = WLAN_PKT_FORMAT_OTHERS;
+
+	rmv_len = pattrib->hdrlen + pattrib->iv_len +(bsnaphdr?SNAP_SIZE:0);
+	RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("===pattrib->hdrlen: %x,  pattrib->iv_len:%x ===\n", pattrib->hdrlen,  pattrib->iv_len));
+
+	if (check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE)
+	{
+		ptr += rmv_len ;
+		*ptr = 0x87;
+		*(ptr+1) = 0x12;
+
+		//back to original pointer
+		ptr -= rmv_len;
+	}
+
+	ptr += rmv_len ;
+
+	_rtw_memcpy(&eth_type, ptr, 2);
+	eth_type= ntohs((unsigned short )eth_type); //pattrib->ether_type
+	ptr +=2;
+
+	if(pattrib->encrypt){
+		recvframe_pull_tail(precvframe, pattrib->icv_len);
+	}
+
+	if(eth_type == 0x8100) //vlan
+	{
+		pvlan = (struct _vlan *) ptr;
+
+		//eth_type = get_vlan_encap_proto(pvlan);
+		//eth_type = pvlan->h_vlan_encapsulated_proto;//?
+		rmv_len += 4;
+		ptr+=4;
+	}
+
+	if(eth_type==0x0800)//ip
+	{
+		//struct iphdr*  piphdr = (struct iphdr*) ptr;
+		//__u8 tos = (unsigned char)(pattrib->priority & 0xff);
+
+		//piphdr->tos = tos;
+
+		//if (piphdr->protocol == 0x06)
+		//{
+		//	RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("@@@===recv tcp len:%d @@@===\n", precvframe->u.hdr.len));
+		//}
+	}
+	else if(eth_type==0x8712)// append rx status for mp test packets
+	{
+		//ptr -= 16;
+		//_rtw_memcpy(ptr, get_rxmem(precvframe), 16);
+	}
+	else
+	{
+#ifdef PLATFORM_OS_XP
+		NDIS_PACKET_8021Q_INFO VlanPriInfo;
+		UINT32 UserPriority = precvframe->u.hdr.attrib.priority;
+		UINT32 VlanID = (pvlan!=NULL ? get_vlan_id(pvlan) : 0 );
+
+		VlanPriInfo.Value =          // Get current value.
+				NDIS_PER_PACKET_INFO_FROM_PACKET(precvframe->u.hdr.pkt, Ieee8021QInfo);
+
+		VlanPriInfo.TagHeader.UserPriority = UserPriority;
+		VlanPriInfo.TagHeader.VlanId =  VlanID ;
+
+		VlanPriInfo.TagHeader.CanonicalFormatId = 0; // Should be zero.
+		VlanPriInfo.TagHeader.Reserved = 0; // Should be zero.
+		NDIS_PER_PACKET_INFO_FROM_PACKET(precvframe->u.hdr.pkt, Ieee8021QInfo) = VlanPriInfo.Value;
+#endif
+	}
+
+	if(eth_type==0x8712)// append rx status for mp test packets
+	{
+		ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr)+2)-24);
+		_rtw_memcpy(ptr, get_rxmem(precvframe), 24);
+		ptr+=24;
+	}
+	else
+		ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr)+2));
+
+	_rtw_memcpy(ptr, pattrib->dst, ETH_ALEN);
+	_rtw_memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN);
+
+	eth_type = htons((unsigned short)eth_type) ;
+	_rtw_memcpy(ptr+12, &eth_type, 2);
+
+exit:
+
+_func_exit_;
+
+	return ret;
+}
+#endif
+
+
+#ifdef CONFIG_SDIO_HCI
+#ifdef PLATFORM_LINUX
+static void recvframe_expand_pkt(
+	PADAPTER padapter,
+	union recv_frame *prframe)
+{
+	struct recv_frame_hdr *pfhdr;
+	_pkt *ppkt;
+	u8 shift_sz;
+	u32 alloc_sz;
+
+
+	pfhdr = &prframe->u.hdr;
+
+	//	6 is for IP header 8 bytes alignment in QoS packet case.
+	if (pfhdr->attrib.qos)
+		shift_sz = 6;
+	else
+		shift_sz = 0;
+
+	// for first fragment packet, need to allocate
+	// (1536 + RXDESC_SIZE + drvinfo_sz) to reassemble packet
+	//	8 is for skb->data 8 bytes alignment.
+//	alloc_sz = _RND(1536 + RXDESC_SIZE + pfhdr->attrib.drvinfosize + shift_sz + 8, 128);
+	alloc_sz = 1664; // round (1536 + 24 + 32 + shift_sz + 8) to 128 bytes alignment
+
+	//3 1. alloc new skb
+	// prepare extra space for 4 bytes alignment
+	ppkt = rtw_skb_alloc(alloc_sz);
+
+	if (!ppkt) return; // no way to expand
+
+	//3 2. Prepare new skb to replace & release old skb
+	// force ppkt->data at 8-byte alignment address
+	skb_reserve(ppkt, 8 - ((SIZE_PTR)ppkt->data & 7));
+	// force ip_hdr at 8-byte alignment address according to shift_sz
+	skb_reserve(ppkt, shift_sz);
+
+	// copy data to new pkt
+	_rtw_memcpy(skb_put(ppkt, pfhdr->len), pfhdr->rx_data, pfhdr->len);
+
+	rtw_skb_free(pfhdr->pkt);
+
+	// attach new pkt to recvframe
+	pfhdr->pkt = ppkt;
+	pfhdr->rx_head = ppkt->head;
+	pfhdr->rx_data = ppkt->data;
+	pfhdr->rx_tail = skb_tail_pointer(ppkt);
+	pfhdr->rx_end = skb_end_pointer(ppkt);
+}
+#else
+#warning "recvframe_expand_pkt not implement, defrag may crash system"
+#endif
+#endif
+
+//perform defrag
+union recv_frame * recvframe_defrag(_adapter *adapter,_queue *defrag_q);
+union recv_frame * recvframe_defrag(_adapter *adapter,_queue *defrag_q)
+{
+	_list	 *plist, *phead;
+	u8	*data,wlanhdr_offset;
+	u8	curfragnum;
+	struct recv_frame_hdr *pfhdr,*pnfhdr;
+	union recv_frame* prframe, *pnextrframe;
+	_queue	*pfree_recv_queue;
+
+_func_enter_;
+
+	curfragnum=0;
+	pfree_recv_queue=&adapter->recvpriv.free_recv_queue;
+
+	phead = get_list_head(defrag_q);
+	plist = get_next(phead);
+	prframe = LIST_CONTAINOR(plist, union recv_frame, u);
+	pfhdr=&prframe->u.hdr;
+	rtw_list_delete(&(prframe->u.list));
+
+	if(curfragnum!=pfhdr->attrib.frag_num)
+	{
+		//the first fragment number must be 0
+		//free the whole queue
+		rtw_free_recvframe(prframe, pfree_recv_queue);
+		rtw_free_recvframe_queue(defrag_q, pfree_recv_queue);
+
+		return NULL;
+	}
+
+#ifdef CONFIG_SDIO_HCI
+	recvframe_expand_pkt(adapter, prframe);
+#endif
+
+	curfragnum++;
+
+	plist= get_list_head(defrag_q);
+
+	plist = get_next(plist);
+
+	data=get_recvframe_data(prframe);
+
+	while(rtw_end_of_queue_search(phead, plist) == _FALSE)
+	{
+		pnextrframe = LIST_CONTAINOR(plist, union recv_frame , u);
+		pnfhdr=&pnextrframe->u.hdr;
+
+
+		//check the fragment sequence  (2nd ~n fragment frame)
+
+		if(curfragnum!=pnfhdr->attrib.frag_num)
+		{
+			//the fragment number must be increasing  (after decache)
+			//release the defrag_q & prframe
+			rtw_free_recvframe(prframe, pfree_recv_queue);
+			rtw_free_recvframe_queue(defrag_q, pfree_recv_queue);
+			return NULL;
+		}
+
+		curfragnum++;
+
+		//copy the 2nd~n fragment frame's payload to the first fragment
+		//get the 2nd~last fragment frame's payload
+
+		wlanhdr_offset = pnfhdr->attrib.hdrlen + pnfhdr->attrib.iv_len;
+
+		recvframe_pull(pnextrframe, wlanhdr_offset);
+
+		//append  to first fragment frame's tail (if privacy frame, pull the ICV)
+		recvframe_pull_tail(prframe, pfhdr->attrib.icv_len);
+
+		//memcpy
+		_rtw_memcpy(pfhdr->rx_tail, pnfhdr->rx_data, pnfhdr->len);
+
+		recvframe_put(prframe, pnfhdr->len);
+
+		pfhdr->attrib.icv_len=pnfhdr->attrib.icv_len;
+		plist = get_next(plist);
+
+	};
+
+	//free the defrag_q queue and return the prframe
+	rtw_free_recvframe_queue(defrag_q, pfree_recv_queue);
+
+	RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("Performance defrag!!!!!\n"));
+
+_func_exit_;
+
+	return prframe;
+}
+
+//check if need to defrag, if needed queue the frame to defrag_q
+union recv_frame* recvframe_chk_defrag(PADAPTER padapter, union recv_frame *precv_frame)
+{
+	u8	ismfrag;
+	u8	fragnum;
+	u8	*psta_addr;
+	struct recv_frame_hdr *pfhdr;
+	struct sta_info *psta;
+	struct sta_priv *pstapriv;
+	_list *phead;
+	union recv_frame *prtnframe = NULL;
+	_queue *pfree_recv_queue, *pdefrag_q;
+
+_func_enter_;
+
+	pstapriv = &padapter->stapriv;
+
+	pfhdr = &precv_frame->u.hdr;
+
+	pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
+
+	//need to define struct of wlan header frame ctrl
+	ismfrag = pfhdr->attrib.mfrag;
+	fragnum = pfhdr->attrib.frag_num;
+
+	psta_addr = pfhdr->attrib.ta;
+	psta = rtw_get_stainfo(pstapriv, psta_addr);
+	if (psta == NULL)
+	{
+		u8 type = GetFrameType(pfhdr->rx_data);
+		if (type != WIFI_DATA_TYPE) {
+			psta = rtw_get_bcmc_stainfo(padapter);
+			pdefrag_q = &psta->sta_recvpriv.defrag_q;
+		} else
+			pdefrag_q = NULL;
+	}
+	else
+		pdefrag_q = &psta->sta_recvpriv.defrag_q;
+
+	if ((ismfrag==0) && (fragnum==0))
+	{
+		prtnframe = precv_frame;//isn't a fragment frame
+	}
+
+	if (ismfrag==1)
+	{
+		//0~(n-1) fragment frame
+		//enqueue to defraf_g
+		if(pdefrag_q != NULL)
+		{
+			if(fragnum==0)
+			{
+				//the first fragment
+				if(_rtw_queue_empty(pdefrag_q) == _FALSE)
+				{
+					//free current defrag_q
+					rtw_free_recvframe_queue(pdefrag_q, pfree_recv_queue);
+				}
+			}
+
+
+			//Then enqueue the 0~(n-1) fragment into the defrag_q
+
+			//_rtw_spinlock(&pdefrag_q->lock);
+			phead = get_list_head(pdefrag_q);
+			rtw_list_insert_tail(&pfhdr->list, phead);
+			//_rtw_spinunlock(&pdefrag_q->lock);
+
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("Enqueuq: ismfrag = %d, fragnum= %d\n", ismfrag,fragnum));
+
+			prtnframe=NULL;
+
+		}
+		else
+		{
+			//can't find this ta's defrag_queue, so free this recv_frame
+			rtw_free_recvframe(precv_frame, pfree_recv_queue);
+			prtnframe=NULL;
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("Free because pdefrag_q ==NULL: ismfrag = %d, fragnum= %d\n", ismfrag, fragnum));
+		}
+
+	}
+
+	if((ismfrag==0)&&(fragnum!=0))
+	{
+		//the last fragment frame
+		//enqueue the last fragment
+		if(pdefrag_q != NULL)
+		{
+			//_rtw_spinlock(&pdefrag_q->lock);
+			phead = get_list_head(pdefrag_q);
+			rtw_list_insert_tail(&pfhdr->list,phead);
+			//_rtw_spinunlock(&pdefrag_q->lock);
+
+			//call recvframe_defrag to defrag
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("defrag: ismfrag = %d, fragnum= %d\n", ismfrag, fragnum));
+			precv_frame = recvframe_defrag(padapter, pdefrag_q);
+			prtnframe=precv_frame;
+
+		}
+		else
+		{
+			//can't find this ta's defrag_queue, so free this recv_frame
+			rtw_free_recvframe(precv_frame, pfree_recv_queue);
+			prtnframe=NULL;
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("Free because pdefrag_q ==NULL: ismfrag = %d, fragnum= %d\n", ismfrag,fragnum));
+		}
+
+	}
+
+
+	if((prtnframe!=NULL)&&(prtnframe->u.hdr.attrib.privacy))
+	{
+		//after defrag we must check tkip mic code
+		if(recvframe_chkmic(padapter,  prtnframe)==_FAIL)
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvframe_chkmic(padapter,  prtnframe)==_FAIL\n"));
+			rtw_free_recvframe(prtnframe,pfree_recv_queue);
+			prtnframe=NULL;
+		}
+	}
+
+_func_exit_;
+
+	return prtnframe;
+
+}
+
+#define ENDIAN_FREE 1
+
+int amsdu_to_msdu(_adapter *padapter, union recv_frame *prframe);
+int amsdu_to_msdu(_adapter *padapter, union recv_frame *prframe)
+{
+#if defined (PLATFORM_LINUX) || defined (PLATFORM_FREEBSD)  //for amsdu TP improvement,Creator: Thomas
+	int	a_len, padding_len;
+	u16	eth_type, nSubframe_Length;
+	u8	nr_subframes, i;
+	unsigned char *pdata;
+	struct rx_pkt_attrib *pattrib;
+#ifndef PLATFORM_FREEBSD
+	unsigned char *data_ptr;
+	_pkt *sub_skb,*subframes[MAX_SUBFRAME_COUNT];
+#endif //PLATFORM_FREEBSD
+	struct recv_priv *precvpriv = &padapter->recvpriv;
+	_queue *pfree_recv_queue = &(precvpriv->free_recv_queue);
+	int	ret = _SUCCESS;
+#ifdef PLATFORM_FREEBSD
+	struct mbuf *sub_m=NULL, *subframes[MAX_SUBFRAME_COUNT];
+	u8 *ptr,offset;
+#endif //PLATFORM_FREEBSD
+	nr_subframes = 0;
+
+	pattrib = &prframe->u.hdr.attrib;
+
+	recvframe_pull(prframe, prframe->u.hdr.attrib.hdrlen);
+
+	if(prframe->u.hdr.attrib.iv_len >0)
+	{
+		recvframe_pull(prframe, prframe->u.hdr.attrib.iv_len);
+	}
+
+	a_len = prframe->u.hdr.len;
+
+	pdata = prframe->u.hdr.rx_data;
+
+	while(a_len > ETH_HLEN) {
+
+		/* Offset 12 denote 2 mac address */
+#ifdef ENDIAN_FREE
+		//nSubframe_Length = ntohs(*((u16*)(pdata + 12)));
+		nSubframe_Length = RTW_GET_BE16(pdata + 12);
+#else // ENDIAN_FREE
+		nSubframe_Length = *((u16*)(pdata + 12));
+		//==m==>change the length order
+		nSubframe_Length = (nSubframe_Length>>8) + (nSubframe_Length<<8);
+		//ntohs(nSubframe_Length);
+#endif // ENDIAN_FREE
+
+		if( a_len < (ETHERNET_HEADER_SIZE + nSubframe_Length) ) {
+			DBG_871X("nRemain_Length is %d and nSubframe_Length is : %d\n",a_len,nSubframe_Length);
+			goto exit;
+		}
+
+#ifndef PLATFORM_FREEBSD
+		/* move the data point to data content */
+		pdata += ETH_HLEN;
+		a_len -= ETH_HLEN;
+
+		/* Allocate new skb for releasing to upper layer */
+#ifdef CONFIG_SKB_COPY
+		sub_skb = rtw_skb_alloc(nSubframe_Length + 12);
+		if(sub_skb)
+		{
+			skb_reserve(sub_skb, 12);
+			data_ptr = (u8 *)skb_put(sub_skb, nSubframe_Length);
+			_rtw_memcpy(data_ptr, pdata, nSubframe_Length);
+		}
+		else
+#endif // CONFIG_SKB_COPY
+		{
+			sub_skb = rtw_skb_clone(prframe->u.hdr.pkt);
+			if(sub_skb)
+			{
+				sub_skb->data = pdata;
+				sub_skb->len = nSubframe_Length;
+				skb_set_tail_pointer(sub_skb, nSubframe_Length);
+			}
+			else
+			{
+				DBG_871X("rtw_skb_clone() Fail!!! , nr_subframes = %d\n",nr_subframes);
+				break;
+			}
+		}
+
+#else   // PLATFORM_FREEBSD
+
+		//PLATFORM_FREEBSD
+		//Allocate a mbuff,
+		//sub_m =m_devget(pdata, nSubframe_Length+12, 12, padapter->pifp,NULL);
+		sub_m =m_devget(pdata, nSubframe_Length+ETH_HLEN, ETHER_ALIGN, padapter->pifp,NULL);
+
+		pdata += ETH_HLEN;
+		a_len -= ETH_HLEN;
+#endif	// PLATFORM_FREEBSD
+
+#ifndef PLATFORM_FREEBSD
+		//sub_skb->dev = padapter->pnetdev;
+		subframes[nr_subframes++] = sub_skb;
+#else  //PLATFORM_FREEBSD
+		//PLATFORM_FREEBSD
+		subframes[nr_subframes++] = sub_m;
+#endif  //PLATFORM_FREEBSD
+
+		if(nr_subframes >= MAX_SUBFRAME_COUNT) {
+			DBG_871X("ParseSubframe(): Too many Subframes! Packets dropped!\n");
+			break;
+		}
+
+		pdata += nSubframe_Length;
+		a_len -= nSubframe_Length;
+		if(a_len != 0) {
+			padding_len = 4 - ((nSubframe_Length + ETH_HLEN) & (4-1));
+			if(padding_len == 4) {
+				padding_len = 0;
+			}
+
+			if(a_len < padding_len) {
+				goto exit;
+			}
+			pdata += padding_len;
+			a_len -= padding_len;
+		}
+	}
+
+	for(i=0; i<nr_subframes; i++){
+#ifndef PLATFORM_FREEBSD
+		sub_skb = subframes[i];
+		/* convert hdr + possible LLC headers into Ethernet header */
+#ifdef ENDIAN_FREE
+		//eth_type = ntohs(*(u16*)&sub_skb->data[6]);
+		eth_type = RTW_GET_BE16(&sub_skb->data[6]);
+#else // ENDIAN_FREE
+		eth_type = (sub_skb->data[6] << 8) | sub_skb->data[7];
+#endif // ENDIAN_FREE
+		if (sub_skb->len >= 8 &&
+			((_rtw_memcmp(sub_skb->data, rtw_rfc1042_header, SNAP_SIZE) &&
+			  eth_type != ETH_P_AARP && eth_type != ETH_P_IPX) ||
+			 _rtw_memcmp(sub_skb->data, rtw_bridge_tunnel_header, SNAP_SIZE) )) {
+			/* remove RFC1042 or Bridge-Tunnel encapsulation and replace EtherType */
+			skb_pull(sub_skb, SNAP_SIZE);
+			_rtw_memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->src, ETH_ALEN);
+			_rtw_memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->dst, ETH_ALEN);
+		} else {
+			u16 len;
+			/* Leave Ethernet header part of hdr and full payload */
+			len = htons(sub_skb->len);
+			_rtw_memcpy(skb_push(sub_skb, 2), &len, 2);
+			_rtw_memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->src, ETH_ALEN);
+			_rtw_memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->dst, ETH_ALEN);
+		}
+
+		/* Indicat the packets to upper layer */
+		if (sub_skb) {
+			//memset(sub_skb->cb, 0, sizeof(sub_skb->cb));
+
+#ifdef CONFIG_BR_EXT
+			// Insert NAT2.5 RX here!
+			struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+			void *br_port = NULL;
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+			br_port = padapter->pnetdev->br_port;
+#else   // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+			rcu_read_lock();
+			br_port = rcu_dereference(padapter->pnetdev->rx_handler_data);
+			rcu_read_unlock();
+#endif  // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+
+
+			if( br_port && (check_fwstate(pmlmepriv, WIFI_STATION_STATE|WIFI_ADHOC_STATE) == _TRUE) )
+			{
+				int nat25_handle_frame(_adapter *priv, struct sk_buff *skb);
+				if (nat25_handle_frame(padapter, sub_skb) == -1) {
+					//priv->ext_stats.rx_data_drops++;
+					//DEBUG_ERR("RX DROP: nat25_handle_frame fail!\n");
+					//return FAIL;
+
+#if 1
+					// bypass this frame to upper layer!!
+#else
+					rtw_skb_free(sub_skb);
+					continue;
+#endif
+				}
+			}
+#endif	// CONFIG_BR_EXT
+
+			sub_skb->protocol = eth_type_trans(sub_skb, padapter->pnetdev);
+			sub_skb->dev = padapter->pnetdev;
+
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_RX
+			if ( (pattrib->tcpchk_valid == 1) && (pattrib->tcp_chkrpt == 1) ) {
+				sub_skb->ip_summed = CHECKSUM_UNNECESSARY;
+			} else {
+				sub_skb->ip_summed = CHECKSUM_NONE;
+			}
+#else /* !CONFIG_TCP_CSUM_OFFLOAD_RX */
+			sub_skb->ip_summed = CHECKSUM_NONE;
+#endif //CONFIG_TCP_CSUM_OFFLOAD_RX
+
+			rtw_netif_rx(padapter->pnetdev, sub_skb);
+		}
+#else //PLATFORM_FREEBSD
+
+		//PLATFORM_FREEBSD
+		sub_m = subframes[i];
+		ptr=mtod(sub_m, u8 *);
+		offset=ETH_HLEN;
+		/* convert hdr + possible LLC headers into Ethernet header */
+#ifdef ENDIAN_FREE
+		eth_type = ntohs(*(u16*)&ptr[offset+6]);
+#else // ENDIAN_FREE
+		eth_type = (  ptr[offset+6] << 8) | ptr[offset+7];
+#endif // ENDIAN_FREE
+		if (sub_m->m_pkthdr.len >= ETH_HLEN+8 &&
+			((_rtw_memcmp(ptr+ETH_HLEN, rtw_rfc1042_header, SNAP_SIZE) &&
+			  eth_type != ETH_P_AARP && eth_type != ETH_P_IPX) ||
+			 _rtw_memcmp(ptr+ETH_HLEN, rtw_bridge_tunnel_header, SNAP_SIZE) )) {
+			/* remove RFC1042 or Bridge-Tunnel encapsulation and replace EtherType */
+			offset+=SNAP_SIZE;
+			_rtw_memcpy(&ptr[offset-ETH_ALEN], pattrib->src, ETH_ALEN);
+			offset-=ETH_ALEN;
+			_rtw_memcpy(&ptr[offset-ETH_ALEN], pattrib->dst, ETH_ALEN);
+			offset-=ETH_ALEN;
+		} else {
+			u16 len;
+			/* Leave Ethernet header part of hdr and full payload */
+			len = htons(sub_m->m_pkthdr.len-offset);
+			_rtw_memcpy(&ptr[offset- 2], &len, 2);
+			offset-=2;
+			_rtw_memcpy(&ptr[offset-ETH_ALEN], pattrib->src, ETH_ALEN);
+			offset-=ETH_ALEN;
+			_rtw_memcpy(&ptr[offset-ETH_ALEN], pattrib->dst, ETH_ALEN);
+			offset-=ETH_ALEN;
+		}
+
+		m_adj(sub_m,offset);
+
+		/* Indicat the packets to upper layer */
+		if (sub_m) {
+
+#if 0
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_RX
+			if ( (pattrib->tcpchk_valid == 1) && (pattrib->tcp_chkrpt == 1) ) {
+				sub_skb->ip_summed = CHECKSUM_UNNECESSARY;
+			} else {
+				sub_skb->ip_summed = CHECKSUM_NONE;
+			}
+#else /* !CONFIG_TCP_CSUM_OFFLOAD_RX */
+			sub_skb->ip_summed = CHECKSUM_NONE;
+#endif //CONFIG_TCP_CSUM_OFFLOAD_RX
+#endif //0
+
+			if ( ((u32)(mtod(sub_m, caddr_t) + 14) % 4) != 0)
+				printf("%s()-%d: mtod(sub_m) = %p\n", __FUNCTION__, __LINE__, mtod(sub_m, caddr_t));
+#ifdef CONFIG_RX_INDICATE_QUEUE
+			IF_ENQUEUE(&precvpriv->rx_indicate_queue, sub_m);
+			if (_IF_QLEN(&precvpriv->rx_indicate_queue) <= 1) {
+				taskqueue_enqueue(taskqueue_thread, &precvpriv->rx_indicate_tasklet);
+			}
+#else	// CONFIG_RX_INDICATE_QUEUE
+			(*padapter->pifp->if_input)(padapter->pifp, sub_m);
+#endif	// CONFIG_RX_INDICATE_QUEUE
+		}
+
+#endif //PLATFORM_FREEBSD
+	}
+
+exit:
+
+	prframe->u.hdr.len=0;
+	rtw_free_recvframe(prframe, pfree_recv_queue);//free this recv_frame
+
+	return ret;
+#else  // || defined (PLATFORM_LINUX) || defined (PLATFORM_FREEBSD)
+#ifdef PLATFORM_WINDOWS
+	_irqL irql;
+#endif //PLATFORM_WINDOWS
+	unsigned char *ptr, *pdata, *pbuf, *psnap_type;
+	union recv_frame *pnrframe, *pnrframe_new;
+	int a_len, mv_len, padding_len;
+	u16 eth_type, type_len;
+	u8 bsnaphdr;
+	struct ieee80211_snap_hdr	*psnap;
+	struct _vlan *pvlan;
+	struct recv_priv *precvpriv = &padapter->recvpriv;
+	_queue *pfree_recv_queue = &(precvpriv->free_recv_queue);
+	int ret = _SUCCESS;
+#ifdef PLATFORM_WINDOWS
+	struct recv_buf *precvbuf = prframe->u.hdr.precvbuf;
+#endif //PLATFORM_WINDOWS
+	a_len = prframe->u.hdr.len - prframe->u.hdr.attrib.hdrlen;
+
+	recvframe_pull(prframe, prframe->u.hdr.attrib.hdrlen);
+
+	if(prframe->u.hdr.attrib.iv_len >0)
+	{
+		recvframe_pull(prframe, prframe->u.hdr.attrib.iv_len);
+	}
+
+	pdata = prframe->u.hdr.rx_data;
+
+	prframe->u.hdr.len=0;
+
+	pnrframe = prframe;
+
+
+	do{
+
+		mv_len=0;
+		pnrframe->u.hdr.rx_data = pnrframe->u.hdr.rx_tail = pdata;
+		ptr = pdata;
+
+
+		_rtw_memcpy(pnrframe->u.hdr.attrib.dst, ptr, ETH_ALEN);
+		ptr+=ETH_ALEN;
+		_rtw_memcpy(pnrframe->u.hdr.attrib.src, ptr, ETH_ALEN);
+		ptr+=ETH_ALEN;
+
+		_rtw_memcpy(&type_len, ptr, 2);
+		type_len= ntohs((unsigned short )type_len);
+		ptr +=2;
+		mv_len += ETH_HLEN;
+
+		recvframe_put(pnrframe, type_len+ETH_HLEN);//update tail;
+
+		if(pnrframe->u.hdr.rx_data >= pnrframe->u.hdr.rx_tail || type_len<8)
+		{
+			//panic("pnrframe->u.hdr.rx_data >= pnrframe->u.hdr.rx_tail || type_len<8\n");
+
+			rtw_free_recvframe(pnrframe, pfree_recv_queue);
+
+			goto exit;
+		}
+
+		psnap=(struct ieee80211_snap_hdr *)(ptr);
+		psnap_type=ptr+SNAP_SIZE;
+		if (psnap->dsap==0xaa && psnap->ssap==0xaa && psnap->ctrl==0x03)
+		{
+			if ( _rtw_memcmp(psnap->oui, oui_rfc1042, WLAN_IEEE_OUI_LEN))
+			{
+				bsnaphdr=_TRUE;//wlan_pkt_format = WLAN_PKT_FORMAT_SNAP_RFC1042;
+			}
+			else if (_rtw_memcmp(psnap->oui, SNAP_HDR_APPLETALK_DDP, WLAN_IEEE_OUI_LEN) &&
+					_rtw_memcmp(psnap_type, SNAP_ETH_TYPE_APPLETALK_DDP, 2) )
+			{
+				bsnaphdr=_TRUE;	//wlan_pkt_format = WLAN_PKT_FORMAT_APPLETALK;
+			}
+			else if (_rtw_memcmp( psnap->oui, oui_8021h, WLAN_IEEE_OUI_LEN))
+			{
+				bsnaphdr=_TRUE;	//wlan_pkt_format = WLAN_PKT_FORMAT_SNAP_TUNNEL;
+			}
+			else
+			{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("drop pkt due to invalid frame format!\n"));
+
+				//KeBugCheckEx(0x87123333, 0xe0, 0x4c, 0x87, 0xdd);
+
+				//panic("0x87123333, 0xe0, 0x4c, 0x87, 0xdd\n");
+
+				rtw_free_recvframe(pnrframe, pfree_recv_queue);
+
+				goto exit;
+			}
+
+		}
+		else
+		{
+			bsnaphdr=_FALSE;//wlan_pkt_format = WLAN_PKT_FORMAT_OTHERS;
+		}
+
+		ptr += (bsnaphdr?SNAP_SIZE:0);
+		_rtw_memcpy(&eth_type, ptr, 2);
+		eth_type= ntohs((unsigned short )eth_type); //pattrib->ether_type
+
+		mv_len+= 2+(bsnaphdr?SNAP_SIZE:0);
+		ptr += 2;//now move to iphdr;
+
+		pvlan = NULL;
+		if(eth_type == 0x8100) //vlan
+		{
+			pvlan = (struct _vlan *)ptr;
+			ptr+=4;
+			mv_len+=4;
+		}
+
+		if(eth_type==0x0800)//ip
+		{
+			struct iphdr*  piphdr = (struct iphdr*)ptr;
+
+
+			if (piphdr->protocol == 0x06)
+			{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("@@@===recv tcp len:%d @@@===\n", pnrframe->u.hdr.len));
+			}
+		}
+#ifdef PLATFORM_OS_XP
+		else
+		{
+			NDIS_PACKET_8021Q_INFO VlanPriInfo;
+			UINT32 UserPriority = pnrframe->u.hdr.attrib.priority;
+			UINT32 VlanID = (pvlan!=NULL ? get_vlan_id(pvlan) : 0 );
+
+			VlanPriInfo.Value =          // Get current value.
+					NDIS_PER_PACKET_INFO_FROM_PACKET(pnrframe->u.hdr.pkt, Ieee8021QInfo);
+
+			VlanPriInfo.TagHeader.UserPriority = UserPriority;
+			VlanPriInfo.TagHeader.VlanId =  VlanID;
+
+			VlanPriInfo.TagHeader.CanonicalFormatId = 0; // Should be zero.
+			VlanPriInfo.TagHeader.Reserved = 0; // Should be zero.
+			NDIS_PER_PACKET_INFO_FROM_PACKET(pnrframe->u.hdr.pkt, Ieee8021QInfo) = VlanPriInfo.Value;
+
+		}
+#endif //PLATFORM_OS_XP
+
+		pbuf = recvframe_pull(pnrframe, (mv_len-sizeof(struct ethhdr)));
+
+		_rtw_memcpy(pbuf, pnrframe->u.hdr.attrib.dst, ETH_ALEN);
+		_rtw_memcpy(pbuf+ETH_ALEN, pnrframe->u.hdr.attrib.src, ETH_ALEN);
+
+		eth_type = htons((unsigned short)eth_type) ;
+		_rtw_memcpy(pbuf+12, &eth_type, 2);
+
+		padding_len = (4) - ((type_len + ETH_HLEN)&(4-1));
+
+		a_len -= (type_len + ETH_HLEN + padding_len) ;
+
+
+#if 0
+
+	if(a_len > ETH_HLEN)
+	{
+		pnrframe_new = rtw_alloc_recvframe(pfree_recv_queue);
+		if(pnrframe_new)
+		{
+			_pkt *pskb_copy;
+			unsigned int copy_len  = pnrframe->u.hdr.len;
+
+			_rtw_init_listhead(&pnrframe_new->u.hdr.list);
+
+			pskb_copy = rtw_skb_alloc(copy_len+64);
+
+			if(pskb_copy==NULL)
+			{
+				DBG_871X("amsdu_to_msdu:can not all(ocate memory for skb copy\n");
+			}
+
+			pnrframe_new->u.hdr.pkt = pskb_copy;
+
+			_rtw_memcpy(pskb_copy->data, pnrframe->u.hdr.rx_data, copy_len);
+
+			pnrframe_new->u.hdr.rx_data = pnrframe->u.hdr.rx_data;
+			pnrframe_new->u.hdr.rx_tail = pnrframe->u.hdr.rx_data + copy_len;
+
+
+			if ((padapter->bDriverStopped ==_FALSE)&&( padapter->bSurpriseRemoved==_FALSE))
+			{
+				rtw_recv_indicatepkt(padapter, pnrframe_new);//indicate this recv_frame
+			}
+			else
+			{
+				rtw_free_recvframe(pnrframe_new, pfree_recv_queue);//free this recv_frame
+			}
+
+		}
+		else
+		{
+			DBG_871X("amsdu_to_msdu:can not allocate memory for pnrframe_new\n");
+		}
+
+	}
+	else
+	{
+		if ((padapter->bDriverStopped ==_FALSE)&&( padapter->bSurpriseRemoved==_FALSE))
+		{
+			rtw_recv_indicatepkt(padapter, pnrframe);//indicate this recv_frame
+		}
+		else
+		{
+			rtw_free_recvframe(pnrframe, pfree_recv_queue);//free this recv_frame
+		}
+
+		pnrframe = NULL;
+
+	}
+
+#else // 0
+
+		//padding_len = (4) - ((type_len + ETH_HLEN)&(4-1));
+
+		//a_len -= (type_len + ETH_HLEN + padding_len) ;
+
+		pnrframe_new = NULL;
+
+
+		if(a_len > ETH_HLEN)
+		{
+			pnrframe_new = rtw_alloc_recvframe(pfree_recv_queue);
+
+			if(pnrframe_new)
+			{
+
+
+				//pnrframe_new->u.hdr.precvbuf = precvbuf;//precvbuf is assigned before call rtw_init_recvframe()
+				//rtw_init_recvframe(pnrframe_new, precvpriv);
+				{
+#ifdef PLATFORM_LINUX
+						_pkt *pskb = pnrframe->u.hdr.pkt;
+#endif //PLATFORM_LINUX
+						_rtw_init_listhead(&pnrframe_new->u.hdr.list);
+
+						pnrframe_new->u.hdr.len=0;
+
+#ifdef PLATFORM_LINUX
+						if(pskb)
+						{
+							pnrframe_new->u.hdr.pkt = rtw_skb_clone(pskb);
+						}
+#endif //PLATFORM_LINUX
+
+				}
+
+				pdata += (type_len + ETH_HLEN + padding_len);
+				pnrframe_new->u.hdr.rx_head = pnrframe_new->u.hdr.rx_data = pnrframe_new->u.hdr.rx_tail = pdata;
+				pnrframe_new->u.hdr.rx_end = pdata + a_len + padding_len;//
+
+#ifdef PLATFORM_WINDOWS
+				pnrframe_new->u.hdr.precvbuf=precvbuf;
+				_enter_critical_bh(&precvbuf->recvbuf_lock, &irql);
+				precvbuf->ref_cnt++;
+				_exit_critical_bh(&precvbuf->recvbuf_lock, &irql);
+#endif //PLATFORM_WINDOWS
+
+			}
+			else
+			{
+				//panic("pnrframe_new=%x\n", pnrframe_new);
+			}
+		}
+
+
+		if ((padapter->bDriverStopped ==_FALSE)&&( padapter->bSurpriseRemoved==_FALSE) )
+		{
+			rtw_recv_indicatepkt(padapter, pnrframe);//indicate this recv_frame
+		}
+		else
+		{
+			rtw_free_recvframe(pnrframe, pfree_recv_queue);//free this recv_frame
+		}
+
+
+		pnrframe = NULL;
+		if(pnrframe_new)
+		{
+			pnrframe = pnrframe_new;
+		}
+
+
+#endif // end defined (PLATFORM_LINUX) || defined (PLATFORM_FREEBSD)
+
+	}while(pnrframe);
+
+exit:
+
+	return ret;
+#endif
+}
+
+int check_indicate_seq(struct recv_reorder_ctrl *preorder_ctrl, u16 seq_num);
+int check_indicate_seq(struct recv_reorder_ctrl *preorder_ctrl, u16 seq_num)
+{
+	u8	wsize = preorder_ctrl->wsize_b;
+	u16	wend = (preorder_ctrl->indicate_seq + wsize -1) & 0xFFF;//% 4096;
+
+	// Rx Reorder initialize condition.
+	if (preorder_ctrl->indicate_seq == 0xFFFF)
+	{
+		preorder_ctrl->indicate_seq = seq_num;
+		#ifdef DBG_RX_SEQ
+		DBG_871X("DBG_RX_SEQ %s:%d init IndicateSeq: %d, NewSeq: %d\n", __FUNCTION__, __LINE__,
+			preorder_ctrl->indicate_seq, seq_num);
+		#endif
+
+		//DbgPrint("check_indicate_seq, 1st->indicate_seq=%d\n", precvpriv->indicate_seq);
+	}
+
+	//DbgPrint("enter->check_indicate_seq(): IndicateSeq: %d, NewSeq: %d\n", precvpriv->indicate_seq, seq_num);
+
+	// Drop out the packet which SeqNum is smaller than WinStart
+	if( SN_LESS(seq_num, preorder_ctrl->indicate_seq) )
+	{
+		//RT_TRACE(COMP_RX_REORDER, DBG_LOUD, ("CheckRxTsIndicateSeq(): Packet Drop! IndicateSeq: %d, NewSeq: %d\n", pTS->RxIndicateSeq, NewSeqNum));
+		//DbgPrint("CheckRxTsIndicateSeq(): Packet Drop! IndicateSeq: %d, NewSeq: %d\n", precvpriv->indicate_seq, seq_num);
+
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("%s IndicateSeq: %d > NewSeq: %d\n", __FUNCTION__,
+			preorder_ctrl->indicate_seq, seq_num);
+		#endif
+
+
+		return _FALSE;
+	}
+
+	//
+	// Sliding window manipulation. Conditions includes:
+	// 1. Incoming SeqNum is equal to WinStart =>Window shift 1
+	// 2. Incoming SeqNum is larger than the WinEnd => Window shift N
+	//
+	if( SN_EQUAL(seq_num, preorder_ctrl->indicate_seq) )
+	{
+		preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1) & 0xFFF;
+		#ifdef DBG_RX_SEQ
+		DBG_871X("DBG_RX_SEQ %s:%d SN_EQUAL IndicateSeq: %d, NewSeq: %d\n", __FUNCTION__, __LINE__,
+			preorder_ctrl->indicate_seq, seq_num);
+		#endif
+	}
+	else if(SN_LESS(wend, seq_num))
+	{
+		//RT_TRACE(COMP_RX_REORDER, DBG_LOUD, ("CheckRxTsIndicateSeq(): Window Shift! IndicateSeq: %d, NewSeq: %d\n", pTS->RxIndicateSeq, NewSeqNum));
+		//DbgPrint("CheckRxTsIndicateSeq(): Window Shift! IndicateSeq: %d, NewSeq: %d\n", precvpriv->indicate_seq, seq_num);
+
+		// boundary situation, when seq_num cross 0xFFF
+		if(seq_num >= (wsize - 1))
+			preorder_ctrl->indicate_seq = seq_num + 1 -wsize;
+		else
+			preorder_ctrl->indicate_seq = 0xFFF - (wsize - (seq_num + 1)) + 1;
+
+		#ifdef DBG_RX_SEQ
+		DBG_871X("DBG_RX_SEQ %s:%d SN_LESS(wend, seq_num) IndicateSeq: %d, NewSeq: %d\n", __FUNCTION__, __LINE__,
+			preorder_ctrl->indicate_seq, seq_num);
+		#endif
+	}
+
+	//DbgPrint("exit->check_indicate_seq(): IndicateSeq: %d, NewSeq: %d\n", precvpriv->indicate_seq, seq_num);
+
+	return _TRUE;
+}
+
+int enqueue_reorder_recvframe(struct recv_reorder_ctrl *preorder_ctrl, union recv_frame *prframe);
+int enqueue_reorder_recvframe(struct recv_reorder_ctrl *preorder_ctrl, union recv_frame *prframe)
+{
+	struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
+	_queue *ppending_recvframe_queue = &preorder_ctrl->pending_recvframe_queue;
+	_list	*phead, *plist;
+	union recv_frame *pnextrframe;
+	struct rx_pkt_attrib *pnextattrib;
+
+	//DbgPrint("+enqueue_reorder_recvframe()\n");
+
+	//_enter_critical_ex(&ppending_recvframe_queue->lock, &irql);
+	//_rtw_spinlock_ex(&ppending_recvframe_queue->lock);
+
+
+	phead = get_list_head(ppending_recvframe_queue);
+	plist = get_next(phead);
+
+	while(rtw_end_of_queue_search(phead, plist) == _FALSE)
+	{
+		pnextrframe = LIST_CONTAINOR(plist, union recv_frame, u);
+		pnextattrib = &pnextrframe->u.hdr.attrib;
+
+		if(SN_LESS(pnextattrib->seq_num, pattrib->seq_num))
+		{
+			plist = get_next(plist);
+		}
+		else if( SN_EQUAL(pnextattrib->seq_num, pattrib->seq_num))
+		{
+			//Duplicate entry is found!! Do not insert current entry.
+			//RT_TRACE(COMP_RX_REORDER, DBG_TRACE, ("InsertRxReorderList(): Duplicate packet is dropped!! IndicateSeq: %d, NewSeq: %d\n", pTS->RxIndicateSeq, SeqNum));
+
+			//_exit_critical_ex(&ppending_recvframe_queue->lock, &irql);
+
+			return _FALSE;
+		}
+		else
+		{
+			break;
+		}
+
+		//DbgPrint("enqueue_reorder_recvframe():while\n");
+
+	}
+
+
+	//_enter_critical_ex(&ppending_recvframe_queue->lock, &irql);
+	//_rtw_spinlock_ex(&ppending_recvframe_queue->lock);
+
+	rtw_list_delete(&(prframe->u.hdr.list));
+
+	rtw_list_insert_tail(&(prframe->u.hdr.list), plist);
+
+	//_rtw_spinunlock_ex(&ppending_recvframe_queue->lock);
+	//_exit_critical_ex(&ppending_recvframe_queue->lock, &irql);
+
+
+	//RT_TRACE(COMP_RX_REORDER, DBG_TRACE, ("InsertRxReorderList(): Pkt insert into buffer!! IndicateSeq: %d, NewSeq: %d\n", pTS->RxIndicateSeq, SeqNum));
+	return _TRUE;
+
+}
+
+int recv_indicatepkts_in_order(_adapter *padapter, struct recv_reorder_ctrl *preorder_ctrl, int bforced);
+int recv_indicatepkts_in_order(_adapter *padapter, struct recv_reorder_ctrl *preorder_ctrl, int bforced)
+{
+	//_irqL irql;
+	//u8 bcancelled;
+	_list	*phead, *plist;
+	union recv_frame *prframe;
+	struct rx_pkt_attrib *pattrib;
+	//u8 index = 0;
+	int bPktInBuf = _FALSE;
+	struct recv_priv *precvpriv = &padapter->recvpriv;
+	_queue *ppending_recvframe_queue = &preorder_ctrl->pending_recvframe_queue;
+
+	//DbgPrint("+recv_indicatepkts_in_order\n");
+
+	//_enter_critical_ex(&ppending_recvframe_queue->lock, &irql);
+	//_rtw_spinlock_ex(&ppending_recvframe_queue->lock);
+
+	phead = 	get_list_head(ppending_recvframe_queue);
+	plist = get_next(phead);
+
+#if 0
+	// Check if there is any other indication thread running.
+	if(pTS->RxIndicateState == RXTS_INDICATE_PROCESSING)
+		return;
+#endif
+
+	// Handling some condition for forced indicate case.
+	if(bforced==_TRUE)
+	{
+		if(rtw_is_list_empty(phead))
+		{
+			// _exit_critical_ex(&ppending_recvframe_queue->lock, &irql);
+			//_rtw_spinunlock_ex(&ppending_recvframe_queue->lock);
+			return _TRUE;
+		}
+
+		 prframe = LIST_CONTAINOR(plist, union recv_frame, u);
+	        pattrib = &prframe->u.hdr.attrib;
+		preorder_ctrl->indicate_seq = pattrib->seq_num;
+		#ifdef DBG_RX_SEQ
+		DBG_871X("DBG_RX_SEQ %s:%d IndicateSeq: %d, NewSeq: %d\n", __FUNCTION__, __LINE__,
+			preorder_ctrl->indicate_seq, pattrib->seq_num);
+		#endif
+	}
+
+	// Prepare indication list and indication.
+	// Check if there is any packet need indicate.
+	while(!rtw_is_list_empty(phead))
+	{
+
+		prframe = LIST_CONTAINOR(plist, union recv_frame, u);
+		pattrib = &prframe->u.hdr.attrib;
+
+		if(!SN_LESS(preorder_ctrl->indicate_seq, pattrib->seq_num))
+		{
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_,
+				 ("recv_indicatepkts_in_order: indicate=%d seq=%d amsdu=%d\n",
+				  preorder_ctrl->indicate_seq, pattrib->seq_num, pattrib->amsdu));
+
+#if 0
+			// This protect buffer from overflow.
+			if(index >= REORDER_WIN_SIZE)
+			{
+				RT_ASSERT(FALSE, ("IndicateRxReorderList(): Buffer overflow!! \n"));
+				bPktInBuf = TRUE;
+				break;
+			}
+#endif
+
+			plist = get_next(plist);
+			rtw_list_delete(&(prframe->u.hdr.list));
+
+			if(SN_EQUAL(preorder_ctrl->indicate_seq, pattrib->seq_num))
+			{
+				preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1) & 0xFFF;
+				#ifdef DBG_RX_SEQ
+				DBG_871X("DBG_RX_SEQ %s:%d IndicateSeq: %d, NewSeq: %d\n", __FUNCTION__, __LINE__,
+					preorder_ctrl->indicate_seq, pattrib->seq_num);
+				#endif
+			}
+
+#if 0
+			index++;
+			if(index==1)
+			{
+				//Cancel previous pending timer.
+				//PlatformCancelTimer(Adapter, &pTS->RxPktPendingTimer);
+				if(bforced!=_TRUE)
+				{
+					//DBG_871X("_cancel_timer(&preorder_ctrl->reordering_ctrl_timer, &bcancelled);\n");
+					_cancel_timer(&preorder_ctrl->reordering_ctrl_timer, &bcancelled);
+				}
+			}
+#endif
+
+			//Set this as a lock to make sure that only one thread is indicating packet.
+			//pTS->RxIndicateState = RXTS_INDICATE_PROCESSING;
+
+			// Indicate packets
+			//RT_ASSERT((index<=REORDER_WIN_SIZE), ("RxReorderIndicatePacket(): Rx Reorder buffer full!! \n"));
+
+
+			//indicate this recv_frame
+			//DbgPrint("recv_indicatepkts_in_order, indicate_seq=%d, seq_num=%d\n", precvpriv->indicate_seq, pattrib->seq_num);
+			if(!pattrib->amsdu)
+			{
+				//DBG_871X("recv_indicatepkts_in_order, amsdu!=1, indicate_seq=%d, seq_num=%d\n", preorder_ctrl->indicate_seq, pattrib->seq_num);
+
+				if ((padapter->bDriverStopped == _FALSE) &&
+				    (padapter->bSurpriseRemoved == _FALSE))
+				{
+
+					rtw_recv_indicatepkt(padapter, prframe);//indicate this recv_frame
+
+				}
+			}
+			else if(pattrib->amsdu==1)
+			{
+				if(amsdu_to_msdu(padapter, prframe)!=_SUCCESS)
+				{
+					rtw_free_recvframe(prframe, &precvpriv->free_recv_queue);
+				}
+			}
+			else
+			{
+				//error condition;
+			}
+
+
+			//Update local variables.
+			bPktInBuf = _FALSE;
+
+		}
+		else
+		{
+			bPktInBuf = _TRUE;
+			break;
+		}
+
+		//DbgPrint("recv_indicatepkts_in_order():while\n");
+
+	}
+
+	//_rtw_spinunlock_ex(&ppending_recvframe_queue->lock);
+	//_exit_critical_ex(&ppending_recvframe_queue->lock, &irql);
+
+/*
+	//Release the indication lock and set to new indication step.
+	if(bPktInBuf)
+	{
+		// Set new pending timer.
+		//pTS->RxIndicateState = RXTS_INDICATE_REORDER;
+		//PlatformSetTimer(Adapter, &pTS->RxPktPendingTimer, pHTInfo->RxReorderPendingTime);
+		//DBG_871X("_set_timer(&preorder_ctrl->reordering_ctrl_timer, REORDER_WAIT_TIME)\n");
+		_set_timer(&preorder_ctrl->reordering_ctrl_timer, REORDER_WAIT_TIME);
+	}
+	else
+	{
+		//pTS->RxIndicateState = RXTS_INDICATE_IDLE;
+	}
+*/
+	//_exit_critical_ex(&ppending_recvframe_queue->lock, &irql);
+
+	//return _TRUE;
+	return bPktInBuf;
+
+}
+
+int recv_indicatepkt_reorder(_adapter *padapter, union recv_frame *prframe);
+int recv_indicatepkt_reorder(_adapter *padapter, union recv_frame *prframe)
+{
+	_irqL irql;
+	int retval = _SUCCESS;
+	struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
+	struct recv_reorder_ctrl *preorder_ctrl = prframe->u.hdr.preorder_ctrl;
+	_queue *ppending_recvframe_queue = &preorder_ctrl->pending_recvframe_queue;
+
+	if(!pattrib->amsdu)
+	{
+		//s1.
+		wlanhdr_to_ethhdr(prframe);
+
+		//if ((pattrib->qos!=1) /*|| pattrib->priority!=0 || IS_MCAST(pattrib->ra)*/
+		//	|| (pattrib->eth_type==0x0806) || (pattrib->ack_policy!=0))
+		if (pattrib->qos!=1)
+		{
+			if ((padapter->bDriverStopped == _FALSE) &&
+			    (padapter->bSurpriseRemoved == _FALSE))
+			{
+				RT_TRACE(_module_rtl871x_recv_c_, _drv_alert_, ("@@@@  recv_indicatepkt_reorder -recv_func recv_indicatepkt\n" ));
+
+				rtw_recv_indicatepkt(padapter, prframe);
+				return _SUCCESS;
+
+			}
+
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s pattrib->qos !=1\n", __FUNCTION__);
+			#endif
+
+			return _FAIL;
+
+		}
+
+		if (preorder_ctrl->enable == _FALSE)
+		{
+			//indicate this recv_frame
+			preorder_ctrl->indicate_seq = pattrib->seq_num;
+			#ifdef DBG_RX_SEQ
+			DBG_871X("DBG_RX_SEQ %s:%d IndicateSeq: %d, NewSeq: %d\n", __FUNCTION__, __LINE__,
+				preorder_ctrl->indicate_seq, pattrib->seq_num);
+			#endif
+
+			rtw_recv_indicatepkt(padapter, prframe);
+
+			preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1)%4096;
+			#ifdef DBG_RX_SEQ
+			DBG_871X("DBG_RX_SEQ %s:%d IndicateSeq: %d, NewSeq: %d\n", __FUNCTION__, __LINE__,
+				preorder_ctrl->indicate_seq, pattrib->seq_num);
+			#endif
+
+			return _SUCCESS;
+		}
+
+#ifndef CONFIG_RECV_REORDERING_CTRL
+		//indicate this recv_frame
+		rtw_recv_indicatepkt(padapter, prframe);
+		return _SUCCESS;
+#endif
+
+	}
+	else if(pattrib->amsdu==1) //temp filter -> means didn't support A-MSDUs in a A-MPDU
+	{
+		if (preorder_ctrl->enable == _FALSE)
+		{
+			preorder_ctrl->indicate_seq = pattrib->seq_num;
+			#ifdef DBG_RX_SEQ
+			DBG_871X("DBG_RX_SEQ %s:%d IndicateSeq: %d, NewSeq: %d\n", __FUNCTION__, __LINE__,
+				preorder_ctrl->indicate_seq, pattrib->seq_num);
+			#endif
+
+			retval = amsdu_to_msdu(padapter, prframe);
+
+			preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1)%4096;
+			#ifdef DBG_RX_SEQ
+			DBG_871X("DBG_RX_SEQ %s:%d IndicateSeq: %d, NewSeq: %d\n", __FUNCTION__, __LINE__,
+				preorder_ctrl->indicate_seq, pattrib->seq_num);
+			#endif
+
+			if(retval != _SUCCESS){
+				#ifdef DBG_RX_DROP_FRAME
+				DBG_871X("DBG_RX_DROP_FRAME %s amsdu_to_msdu fail\n", __FUNCTION__);
+				#endif
+			}
+
+			return retval;
+		}
+	}
+	else
+	{
+
+	}
+
+	_enter_critical_bh(&ppending_recvframe_queue->lock, &irql);
+
+	RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_,
+		 ("recv_indicatepkt_reorder: indicate=%d seq=%d\n",
+		  preorder_ctrl->indicate_seq, pattrib->seq_num));
+
+	//s2. check if winstart_b(indicate_seq) needs to been updated
+	if(!check_indicate_seq(preorder_ctrl, pattrib->seq_num))
+	{
+		//pHTInfo->RxReorderDropCounter++;
+		//ReturnRFDList(Adapter, pRfd);
+		//RT_TRACE(COMP_RX_REORDER, DBG_TRACE, ("RxReorderIndicatePacket() ==> Packet Drop!!\n"));
+		//_exit_critical_ex(&ppending_recvframe_queue->lock, &irql);
+		//return _FAIL;
+
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("DBG_RX_DROP_FRAME %s check_indicate_seq fail\n", __FUNCTION__);
+		#endif
+#if 0
+		rtw_recv_indicatepkt(padapter, prframe);
+
+		_exit_critical_bh(&ppending_recvframe_queue->lock, &irql);
+
+		goto _success_exit;
+#else
+		goto _err_exit;
+#endif
+	}
+
+
+	//s3. Insert all packet into Reorder Queue to maintain its ordering.
+	if(!enqueue_reorder_recvframe(preorder_ctrl, prframe))
+	{
+		//DbgPrint("recv_indicatepkt_reorder, enqueue_reorder_recvframe fail!\n");
+		//_exit_critical_ex(&ppending_recvframe_queue->lock, &irql);
+		//return _FAIL;
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("DBG_RX_DROP_FRAME %s enqueue_reorder_recvframe fail\n", __FUNCTION__);
+		#endif
+		goto _err_exit;
+	}
+
+
+	//s4.
+	// Indication process.
+	// After Packet dropping and Sliding Window shifting as above, we can now just indicate the packets
+	// with the SeqNum smaller than latest WinStart and buffer other packets.
+	//
+	// For Rx Reorder condition:
+	// 1. All packets with SeqNum smaller than WinStart => Indicate
+	// 2. All packets with SeqNum larger than or equal to WinStart => Buffer it.
+	//
+
+	//recv_indicatepkts_in_order(padapter, preorder_ctrl, _TRUE);
+	if(recv_indicatepkts_in_order(padapter, preorder_ctrl, _FALSE)==_TRUE)
+	{
+		_set_timer(&preorder_ctrl->reordering_ctrl_timer, REORDER_WAIT_TIME);
+		_exit_critical_bh(&ppending_recvframe_queue->lock, &irql);
+	}
+	else
+	{
+		_exit_critical_bh(&ppending_recvframe_queue->lock, &irql);
+		_cancel_timer_ex(&preorder_ctrl->reordering_ctrl_timer);
+	}
+
+
+_success_exit:
+
+	return _SUCCESS;
+
+_err_exit:
+
+        _exit_critical_bh(&ppending_recvframe_queue->lock, &irql);
+
+	return _FAIL;
+}
+
+
+void rtw_reordering_ctrl_timeout_handler(void *pcontext)
+{
+	_irqL irql;
+	struct recv_reorder_ctrl *preorder_ctrl = (struct recv_reorder_ctrl *)pcontext;
+	_adapter *padapter = preorder_ctrl->padapter;
+	_queue *ppending_recvframe_queue = &preorder_ctrl->pending_recvframe_queue;
+
+
+	if(padapter->bDriverStopped ||padapter->bSurpriseRemoved)
+	{
+		return;
+	}
+
+	//DBG_871X("+rtw_reordering_ctrl_timeout_handler()=>\n");
+
+	_enter_critical_bh(&ppending_recvframe_queue->lock, &irql);
+
+	if(recv_indicatepkts_in_order(padapter, preorder_ctrl, _TRUE)==_TRUE)
+	{
+		_set_timer(&preorder_ctrl->reordering_ctrl_timer, REORDER_WAIT_TIME);
+	}
+
+	_exit_critical_bh(&ppending_recvframe_queue->lock, &irql);
+
+}
+
+int process_recv_indicatepkts(_adapter *padapter, union recv_frame *prframe);
+int process_recv_indicatepkts(_adapter *padapter, union recv_frame *prframe)
+{
+	int retval = _SUCCESS;
+	//struct recv_priv *precvpriv = &padapter->recvpriv;
+	//struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+#ifdef CONFIG_TDLS
+	struct sta_info *psta = prframe->u.hdr.psta;
+#endif //CONFIG_TDLS
+
+#ifdef CONFIG_80211N_HT
+
+	struct ht_priv	*phtpriv = &pmlmepriv->htpriv;
+
+#ifdef CONFIG_TDLS
+	if( (phtpriv->ht_option==_TRUE) ||
+		((psta->tdls_sta_state & TDLS_LINKED_STATE) &&
+		 (psta->htpriv.ht_option==_TRUE) &&
+		 (psta->htpriv.ampdu_enable==_TRUE))) //B/G/N Mode
+#else
+	if(phtpriv->ht_option==_TRUE)  //B/G/N Mode
+#endif //CONFIG_TDLS
+	{
+		//prframe->u.hdr.preorder_ctrl = &precvpriv->recvreorder_ctrl[pattrib->priority];
+
+		if(recv_indicatepkt_reorder(padapter, prframe)!=_SUCCESS)// including perform A-MPDU Rx Ordering Buffer Control
+		{
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s recv_indicatepkt_reorder error!\n", __FUNCTION__);
+			#endif
+
+			if ((padapter->bDriverStopped == _FALSE) &&
+			    (padapter->bSurpriseRemoved == _FALSE))
+			{
+				retval = _FAIL;
+				return retval;
+			}
+		}
+	}
+	else //B/G mode
+#endif
+	{
+		retval=wlanhdr_to_ethhdr (prframe);
+		if(retval != _SUCCESS)
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("wlanhdr_to_ethhdr: drop pkt \n"));
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s wlanhdr_to_ethhdr error!\n", __FUNCTION__);
+			#endif
+			return retval;
+		}
+
+		if ((padapter->bDriverStopped ==_FALSE)&&( padapter->bSurpriseRemoved==_FALSE))
+		{
+			//indicate this recv_frame
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("@@@@ process_recv_indicatepkts- recv_func recv_indicatepkt\n" ));
+			rtw_recv_indicatepkt(padapter, prframe);
+
+
+		}
+		else
+		{
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("@@@@ process_recv_indicatepkts- recv_func free_indicatepkt\n" ));
+
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("recv_func:bDriverStopped(%d) OR bSurpriseRemoved(%d)", padapter->bDriverStopped, padapter->bSurpriseRemoved));
+			retval = _FAIL;
+			return retval;
+		}
+
+	}
+
+	return retval;
+
+}
+
+static int recv_func_prehandle(_adapter *padapter, union recv_frame *rframe)
+{
+	int ret = _SUCCESS;
+	struct rx_pkt_attrib *pattrib = &rframe->u.hdr.attrib;
+	struct recv_priv *precvpriv = &padapter->recvpriv;
+	_queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
+
+#ifdef CONFIG_MP_INCLUDED
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+#endif //CONFIG_MP_INCLUDED
+
+#ifdef CONFIG_MP_INCLUDED
+	if ((check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE))//&&(padapter->mppriv.check_mp_pkt == 0))
+	{
+		if (pattrib->crc_err == 1)
+			padapter->mppriv.rx_crcerrpktcount++;
+		else
+			padapter->mppriv.rx_pktcount++;
+
+		if (check_fwstate(pmlmepriv, WIFI_MP_LPBK_STATE) == _FALSE) {
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_alert_, ("MP - Not in loopback mode , drop pkt \n"));
+			ret = _FAIL;
+			rtw_free_recvframe(rframe, pfree_recv_queue);//free this recv_frame
+			goto exit;
+		}
+	}
+#endif
+
+	//check the frame crtl field and decache
+	ret = validate_recv_frame(padapter, rframe);
+	if (ret != _SUCCESS)
+	{
+		RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("recv_func: validate_recv_frame fail! drop pkt\n"));
+		rtw_free_recvframe(rframe, pfree_recv_queue);//free this recv_frame
+		goto exit;
+	}
+
+exit:
+	return ret;
+}
+
+static int recv_func_posthandle(_adapter *padapter, union recv_frame *prframe)
+{
+	int ret = _SUCCESS;
+	union recv_frame *orig_prframe = prframe;
+	struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
+	struct recv_priv *precvpriv = &padapter->recvpriv;
+	_queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
+
+#ifdef CONFIG_MP_INCLUDED
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+#endif //CONFIG_MP_INCLUDED
+
+#ifdef CONFIG_TDLS
+	u8 *psnap_type, *pcategory;
+	struct sta_info *ptdls_sta = NULL;
+#endif //CONFIG_TDLS
+
+
+	// DATA FRAME
+	rtw_led_control(padapter, LED_CTL_RX);
+
+	prframe = decryptor(padapter, prframe);
+	if (prframe == NULL) {
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("decryptor: drop pkt\n"));
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("DBG_RX_DROP_FRAME %s decryptor: drop pkt\n", __FUNCTION__);
+		#endif
+		ret = _FAIL;
+		goto _recv_data_drop;
+	}
+
+#if 0
+	if ( padapter->adapter_type == PRIMARY_ADAPTER )
+	{
+		DBG_871X("+++\n");
+		{
+			int i;
+			u8	*ptr = get_recvframe_data(prframe);
+			for(i=0; i<140;i=i+8)
+				DBG_871X("%02X:%02X:%02X:%02X:%02X:%02X:%02X:%02X:", *(ptr+i),
+				*(ptr+i+1), *(ptr+i+2) ,*(ptr+i+3) ,*(ptr+i+4),*(ptr+i+5), *(ptr+i+6), *(ptr+i+7));
+
+		}
+		DBG_871X("---\n");
+	}
+#endif //RTK_DMP_PLATFORM
+
+#ifdef CONFIG_TDLS
+	//check TDLS frame
+	psnap_type = get_recvframe_data(orig_prframe);
+	psnap_type+=pattrib->hdrlen + pattrib->iv_len+SNAP_SIZE;
+	pcategory = psnap_type + ETH_TYPE_LEN + PAYLOAD_TYPE_LEN;
+
+	if((_rtw_memcmp(psnap_type, SNAP_ETH_TYPE_TDLS, ETH_TYPE_LEN)) &&
+		((*pcategory==RTW_WLAN_CATEGORY_TDLS) || (*pcategory==RTW_WLAN_CATEGORY_P2P))){
+		ret = OnTDLS(padapter, prframe);	//all of functions will return _FAIL
+		goto _exit_recv_func;
+	}
+#endif //CONFIG_TDLS
+
+	prframe = recvframe_chk_defrag(padapter, prframe);
+	if(prframe==NULL)	{
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvframe_chk_defrag: drop pkt\n"));
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("DBG_RX_DROP_FRAME %s recvframe_chk_defrag: drop pkt\n", __FUNCTION__);
+		#endif
+		goto _recv_data_drop;
+	}
+
+	prframe=portctrl(padapter, prframe);
+	if (prframe == NULL) {
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("portctrl: drop pkt \n"));
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("DBG_RX_DROP_FRAME %s portctrl: drop pkt\n", __FUNCTION__);
+		#endif
+		ret = _FAIL;
+		goto _recv_data_drop;
+	}
+
+#ifdef CONFIG_TDLS
+	if(padapter->tdlsinfo.setup_state == TDLS_LINKED_STATE)
+		ptdls_sta = rtw_get_stainfo(&padapter->stapriv, pattrib->src);
+	count_rx_stats(padapter, prframe, ptdls_sta);
+#else
+	count_rx_stats(padapter, prframe, NULL);
+#endif //CONFIG_TDLS
+
+#ifdef CONFIG_80211N_HT
+
+	ret = process_recv_indicatepkts(padapter, prframe);
+	if (ret != _SUCCESS)
+	{
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recv_func: process_recv_indicatepkts fail! \n"));
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("DBG_RX_DROP_FRAME %s recv_func: process_recv_indicatepkts fail!\n", __FUNCTION__);
+		#endif
+		rtw_free_recvframe(orig_prframe, pfree_recv_queue);//free this recv_frame
+		goto _recv_data_drop;
+	}
+
+#else // CONFIG_80211N_HT
+
+	if (!pattrib->amsdu)
+	{
+		ret = wlanhdr_to_ethhdr (prframe);
+		if (ret != _SUCCESS)
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("wlanhdr_to_ethhdr: drop pkt \n"));
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s wlanhdr_to_ethhdr: drop pkt\n", __FUNCTION__);
+			#endif
+			rtw_free_recvframe(orig_prframe, pfree_recv_queue);//free this recv_frame
+			goto _recv_data_drop;
+		}
+
+		if ((padapter->bDriverStopped == _FALSE) && (padapter->bSurpriseRemoved == _FALSE))
+		{
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_alert_, ("@@@@ recv_func: recv_func rtw_recv_indicatepkt\n" ));
+			//indicate this recv_frame
+			ret = rtw_recv_indicatepkt(padapter, prframe);
+			if (ret != _SUCCESS)
+			{
+				#ifdef DBG_RX_DROP_FRAME
+				DBG_871X("DBG_RX_DROP_FRAME %s rtw_recv_indicatepkt fail!\n", __FUNCTION__);
+				#endif
+				goto _recv_data_drop;
+			}
+		}
+		else
+		{
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_alert_, ("@@@@  recv_func: rtw_free_recvframe\n" ));
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_debug_, ("recv_func:bDriverStopped(%d) OR bSurpriseRemoved(%d)", padapter->bDriverStopped, padapter->bSurpriseRemoved));
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s ecv_func:bDriverStopped(%d) OR bSurpriseRemoved(%d)\n", __FUNCTION__,
+				padapter->bDriverStopped, padapter->bSurpriseRemoved);
+			#endif
+			ret = _FAIL;
+			rtw_free_recvframe(orig_prframe, pfree_recv_queue); //free this recv_frame
+		}
+
+	}
+	else if(pattrib->amsdu==1)
+	{
+
+		ret = amsdu_to_msdu(padapter, prframe);
+		if(ret != _SUCCESS)
+		{
+			#ifdef DBG_RX_DROP_FRAME
+			DBG_871X("DBG_RX_DROP_FRAME %s amsdu_to_msdu fail\n", __FUNCTION__);
+			#endif
+			rtw_free_recvframe(orig_prframe, pfree_recv_queue);
+			goto _recv_data_drop;
+		}
+	}
+	else
+	{
+		#ifdef DBG_RX_DROP_FRAME
+		DBG_871X("DBG_RX_DROP_FRAME %s what is this condition??\n", __FUNCTION__);
+		#endif
+		goto _recv_data_drop;
+	}
+#endif // CONFIG_80211N_HT
+
+_exit_recv_func:
+	return ret;
+
+_recv_data_drop:
+	precvpriv->rx_drop++;
+	return ret;
+}
+
+
+static int recv_func(_adapter *padapter, union recv_frame *rframe)
+{
+	int ret;
+	struct rx_pkt_attrib *prxattrib = &rframe->u.hdr.attrib;
+	struct recv_priv *recvpriv = &padapter->recvpriv;
+	struct security_priv *psecuritypriv=&padapter->securitypriv;
+	struct mlme_priv *mlmepriv = &padapter->mlmepriv;
+
+	/* check if need to handle uc_swdec_pending_queue*/
+	if (check_fwstate(mlmepriv, WIFI_STATION_STATE) && psecuritypriv->busetkipkey)
+	{
+		union recv_frame *pending_frame;
+		_irqL irqL;
+
+		while((pending_frame=rtw_alloc_recvframe(&padapter->recvpriv.uc_swdec_pending_queue))) {
+			if (recv_func_posthandle(padapter, pending_frame) == _SUCCESS)
+				DBG_871X("%s: dequeue uc_swdec_pending_queue\n", __func__);
+		}
+	}
+
+	ret = recv_func_prehandle(padapter, rframe);
+
+	if(ret == _SUCCESS) {
+
+		/* check if need to enqueue into uc_swdec_pending_queue*/
+		if (check_fwstate(mlmepriv, WIFI_STATION_STATE) &&
+			!IS_MCAST(prxattrib->ra) && prxattrib->encrypt>0 &&
+			(prxattrib->bdecrypted == 0 ||psecuritypriv->sw_decrypt == _TRUE) &&
+			!is_wep_enc(psecuritypriv->dot11PrivacyAlgrthm) &&
+			!psecuritypriv->busetkipkey) {
+			rtw_enqueue_recvframe(rframe, &padapter->recvpriv.uc_swdec_pending_queue);
+			DBG_871X("%s: no key, enqueue uc_swdec_pending_queue\n", __func__);
+			goto exit;
+		}
+
+		ret = recv_func_posthandle(padapter, rframe);
+	}
+
+exit:
+	return ret;
+}
+
+
+s32 rtw_recv_entry(union recv_frame *precvframe)
+{
+	_adapter *padapter;
+	struct recv_priv *precvpriv;
+	s32 ret=_SUCCESS;
+
+_func_enter_;
+
+//	RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("+rtw_recv_entry\n"));
+
+	padapter = precvframe->u.hdr.adapter;
+
+	precvpriv = &padapter->recvpriv;
+
+
+	if ((ret = recv_func(padapter, precvframe)) == _FAIL)
+	{
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("rtw_recv_entry: recv_func return fail!!!\n"));
+		goto _recv_entry_drop;
+	}
+
+
+	precvpriv->rx_pkts++;
+
+_func_exit_;
+
+	return ret;
+
+_recv_entry_drop:
+
+#ifdef CONFIG_MP_INCLUDED
+	padapter->mppriv.rx_pktloss = precvpriv->rx_drop;
+#endif
+
+	//RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("_recv_entry_drop\n"));
+
+_func_exit_;
+
+	return ret;
+}
+
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+void rtw_signal_stat_timer_hdl(RTW_TIMER_HDL_ARGS){
+	_adapter *adapter = (_adapter *)FunctionContext;
+	struct recv_priv *recvpriv = &adapter->recvpriv;
+
+	u32 tmp_s, tmp_q;
+	u8 avg_signal_strength = 0;
+	u8 avg_signal_qual = 0;
+	u32 num_signal_strength = 0;
+	u32 num_signal_qual = 0;
+	u8 _alpha = 3; // this value is based on converging_constant = 5000 and sampling_interval = 1000
+
+	if(adapter->recvpriv.is_signal_dbg) {
+		//update the user specific value, signal_strength_dbg, to signal_strength, rssi
+		adapter->recvpriv.signal_strength= adapter->recvpriv.signal_strength_dbg;
+		adapter->recvpriv.rssi=(s8)translate_percentage_to_dbm((u8)adapter->recvpriv.signal_strength_dbg);
+	} else {
+
+		if(recvpriv->signal_strength_data.update_req == 0) {// update_req is clear, means we got rx
+			avg_signal_strength = recvpriv->signal_strength_data.avg_val;
+			num_signal_strength = recvpriv->signal_strength_data.total_num;
+			// after avg_vals are accquired, we can re-stat the signal values
+			recvpriv->signal_strength_data.update_req = 1;
+		}
+
+		if(recvpriv->signal_qual_data.update_req == 0) {// update_req is clear, means we got rx
+			avg_signal_qual = recvpriv->signal_qual_data.avg_val;
+			num_signal_qual = recvpriv->signal_qual_data.total_num;
+			// after avg_vals are accquired, we can re-stat the signal values
+			recvpriv->signal_qual_data.update_req = 1;
+		}
+
+		if (num_signal_strength == 0) {
+			if (rtw_get_on_cur_ch_time(adapter) == 0
+				|| rtw_get_passing_time_ms(rtw_get_on_cur_ch_time(adapter)) < 2 * adapter->mlmeextpriv.mlmext_info.bcn_interval
+			) {
+				goto set_timer;
+			}
+		}
+
+		if(check_fwstate(&adapter->mlmepriv, _FW_UNDER_SURVEY) == _TRUE
+			|| check_fwstate(&adapter->mlmepriv, _FW_LINKED) == _FALSE
+		) {
+			goto set_timer;
+		}
+
+		#ifdef CONFIG_CONCURRENT_MODE
+		if (check_buddy_fwstate(adapter, _FW_UNDER_SURVEY) == _TRUE)
+			goto set_timer;
+		#endif
+
+		//update value of signal_strength, rssi, signal_qual
+		tmp_s = (avg_signal_strength+(_alpha-1)*recvpriv->signal_strength);
+		if(tmp_s %_alpha)
+			tmp_s = tmp_s/_alpha + 1;
+		else
+			tmp_s = tmp_s/_alpha;
+		if(tmp_s>100)
+			tmp_s = 100;
+
+		tmp_q = (avg_signal_qual+(_alpha-1)*recvpriv->signal_qual);
+		if(tmp_q %_alpha)
+			tmp_q = tmp_q/_alpha + 1;
+		else
+			tmp_q = tmp_q/_alpha;
+		if(tmp_q>100)
+			tmp_q = 100;
+
+		recvpriv->signal_strength = tmp_s;
+		recvpriv->rssi = (s8)translate_percentage_to_dbm(tmp_s);
+		recvpriv->signal_qual = tmp_q;
+
+		#if defined(DBG_RX_SIGNAL_DISPLAY_PROCESSING) && 1
+		DBG_871X(FUNC_ADPT_FMT" signal_strength:%3u, rssi:%3d, signal_qual:%3u"
+			", num_signal_strength:%u, num_signal_qual:%u"
+			", on_cur_ch_ms:%d"
+			"\n"
+			, FUNC_ADPT_ARG(adapter)
+			, recvpriv->signal_strength
+			, recvpriv->rssi
+			, recvpriv->signal_qual
+			, num_signal_strength, num_signal_qual
+			, rtw_get_on_cur_ch_time(adapter) ? rtw_get_passing_time_ms(rtw_get_on_cur_ch_time(adapter)) : 0
+		);
+		#endif
+	}
+
+set_timer:
+	rtw_set_signal_stat_timer(recvpriv);
+
+}
+#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_rf.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_rf.c
new file mode 100644
index 000000000000..52234bd2d0ec
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_rf.c
@@ -0,0 +1,94 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_RF_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#include <xmit_osdep.h>
+
+
+struct ch_freq {
+	u32 channel;
+	u32 frequency;
+};
+
+struct ch_freq ch_freq_map[] = {
+	{1, 2412},{2, 2417},{3, 2422},{4, 2427},{5, 2432},
+	{6, 2437},{7, 2442},{8, 2447},{9, 2452},{10, 2457},
+	{11, 2462},{12, 2467},{13, 2472},{14, 2484},
+	/*  UNII */
+	{36, 5180},{40, 5200},{44, 5220},{48, 5240},{52, 5260},
+	{56, 5280},{60, 5300},{64, 5320},{149, 5745},{153, 5765},
+	{157, 5785},{161, 5805},{165, 5825},{167, 5835},{169, 5845},
+	{171, 5855},{173, 5865},
+	/* HiperLAN2 */
+	{100, 5500},{104, 5520},{108, 5540},{112, 5560},{116, 5580},
+	{120, 5600},{124, 5620},{128, 5640},{132, 5660},{136, 5680},
+	{140, 5700},
+	/* Japan MMAC */
+	{34, 5170},{38, 5190},{42, 5210},{46, 5230},
+	/*  Japan */
+	{184, 4920},{188, 4940},{192, 4960},{196, 4980},
+	{208, 5040},/* Japan, means J08 */
+	{212, 5060},/* Japan, means J12 */
+	{216, 5080},/* Japan, means J16 */
+};
+
+int ch_freq_map_num = (sizeof(ch_freq_map) / sizeof(struct ch_freq));
+
+u32 rtw_ch2freq(u32 channel)
+{
+	u8	i;
+	u32	freq = 0;
+
+	for (i = 0; i < ch_freq_map_num; i++)
+	{
+		if (channel == ch_freq_map[i].channel)
+		{
+			freq = ch_freq_map[i].frequency;
+				break;
+		}
+	}
+	if (i == ch_freq_map_num)
+		freq = 2412;
+
+	return freq;
+}
+
+u32 rtw_freq2ch(u32 freq)
+{
+	u8	i;
+	u32	ch = 0;
+
+	for (i = 0; i < ch_freq_map_num; i++)
+	{
+		if (freq == ch_freq_map[i].frequency)
+		{
+			ch = ch_freq_map[i].channel;
+				break;
+		}
+	}
+	if (i == ch_freq_map_num)
+		ch = 1;
+
+	return ch;
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_security.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_security.c
new file mode 100644
index 000000000000..26b1d0e0f8f3
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_security.c
@@ -0,0 +1,3114 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define  _RTW_SECURITY_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <wifi.h>
+#include <osdep_intf.h>
+
+
+//=====WEP related=====
+
+#define CRC32_POLY 0x04c11db7
+
+struct arc4context
+{
+	u32 x;
+	u32 y;
+	u8 state[256];
+};
+
+
+static void arcfour_init(struct arc4context 	*parc4ctx, u8 * key,u32	key_len)
+{
+	u32	t, u;
+	u32	keyindex;
+	u32	stateindex;
+	u8 * state;
+	u32	counter;
+_func_enter_;
+	state = parc4ctx->state;
+	parc4ctx->x = 0;
+	parc4ctx->y = 0;
+	for (counter = 0; counter < 256; counter++)
+		state[counter] = (u8)counter;
+	keyindex = 0;
+	stateindex = 0;
+	for (counter = 0; counter < 256; counter++)
+	{
+		t = state[counter];
+		stateindex = (stateindex + key[keyindex] + t) & 0xff;
+		u = state[stateindex];
+		state[stateindex] = (u8)t;
+		state[counter] = (u8)u;
+		if (++keyindex >= key_len)
+			keyindex = 0;
+	}
+_func_exit_;
+}
+static u32 arcfour_byte(	struct arc4context	*parc4ctx)
+{
+	u32 x;
+	u32 y;
+	u32 sx, sy;
+	u8 * state;
+_func_enter_;
+	state = parc4ctx->state;
+	x = (parc4ctx->x + 1) & 0xff;
+	sx = state[x];
+	y = (sx + parc4ctx->y) & 0xff;
+	sy = state[y];
+	parc4ctx->x = x;
+	parc4ctx->y = y;
+	state[y] = (u8)sx;
+	state[x] = (u8)sy;
+_func_exit_;
+	return state[(sx + sy) & 0xff];
+}
+
+
+static void arcfour_encrypt(	struct arc4context	*parc4ctx,
+	u8 * dest,
+	u8 * src,
+	u32 len)
+{
+	u32	i;
+_func_enter_;
+	for (i = 0; i < len; i++)
+		dest[i] = src[i] ^ (unsigned char)arcfour_byte(parc4ctx);
+_func_exit_;
+}
+
+static sint bcrc32initialized = 0;
+static u32 crc32_table[256];
+
+
+static u8 crc32_reverseBit( u8 data)
+{
+	return( (u8)((data<<7)&0x80) | ((data<<5)&0x40) | ((data<<3)&0x20) | ((data<<1)&0x10) | ((data>>1)&0x08) | ((data>>3)&0x04) | ((data>>5)&0x02) | ((data>>7)&0x01) );
+}
+
+static void crc32_init(void)
+{
+_func_enter_;
+	if (bcrc32initialized == 1)
+		goto exit;
+	else{
+		sint i, j;
+		u32 c;
+		u8 *p=(u8 *)&c, *p1;
+		u8 k;
+
+		c = 0x12340000;
+
+		for (i = 0; i < 256; ++i)
+		{
+			k = crc32_reverseBit((u8)i);
+			for (c = ((u32)k) << 24, j = 8; j > 0; --j){
+				c = c & 0x80000000 ? (c << 1) ^ CRC32_POLY : (c << 1);
+			}
+			p1 = (u8 *)&crc32_table[i];
+
+			p1[0] = crc32_reverseBit(p[3]);
+			p1[1] = crc32_reverseBit(p[2]);
+			p1[2] = crc32_reverseBit(p[1]);
+			p1[3] = crc32_reverseBit(p[0]);
+		}
+		bcrc32initialized= 1;
+	}
+exit:
+_func_exit_;
+}
+
+static u32 getcrc32(u8 *buf, sint len)
+{
+	u8 *p;
+	u32  crc;
+_func_enter_;
+	if (bcrc32initialized == 0) crc32_init();
+
+	crc = 0xffffffff;       /* preload shift register, per CRC-32 spec */
+
+	for (p = buf; len > 0; ++p, --len)
+	{
+		crc = crc32_table[ (crc ^ *p) & 0xff] ^ (crc >> 8);
+	}
+_func_exit_;
+	return ~crc;    /* transmit complement, per CRC-32 spec */
+}
+
+
+/*
+	Need to consider the fragment  situation
+*/
+void rtw_wep_encrypt(_adapter *padapter, u8 *pxmitframe)
+{																	// exclude ICV
+
+	unsigned char	crc[4];
+	struct arc4context	 mycontext;
+
+	sint	curfragnum,length;
+	u32	keylength;
+
+	u8	*pframe, *payload,*iv;    //,*wepkey
+	u8	wepkey[16];
+	struct	pkt_attrib	 *pattrib = &((struct xmit_frame*)pxmitframe)->attrib;
+	struct 	security_priv	*psecuritypriv=&padapter->securitypriv;
+	struct	xmit_priv		*pxmitpriv=&padapter->xmitpriv;
+
+_func_enter_;
+
+
+	if(((struct xmit_frame*)pxmitframe)->buf_addr==NULL)
+		return;
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+	pframe = ((struct xmit_frame*)pxmitframe)->buf_addr + TXDESC_SIZE +
+		 (((struct xmit_frame*)pxmitframe)->pkt_offset * PACKET_OFFSET_SZ);
+#else
+	pframe = ((struct xmit_frame*)pxmitframe)->buf_addr + TXDESC_OFFSET;
+#endif
+
+	//start to encrypt each fragment
+	if((pattrib->encrypt==_WEP40_)||(pattrib->encrypt==_WEP104_))
+	{
+		keylength=psecuritypriv->dot11DefKeylen[psecuritypriv->dot11PrivacyKeyIndex];
+
+		for(curfragnum=0;curfragnum<pattrib->nr_frags;curfragnum++)
+		{
+			iv=pframe+pattrib->hdrlen;
+			_rtw_memcpy(&wepkey[0], iv, 3);
+			_rtw_memcpy(&wepkey[3], &psecuritypriv->dot11DefKey[psecuritypriv->dot11PrivacyKeyIndex].skey[0],keylength);
+			payload=pframe+pattrib->iv_len+pattrib->hdrlen;
+
+			if((curfragnum+1)==pattrib->nr_frags)
+			{	//the last fragment
+
+				length=pattrib->last_txcmdsz-pattrib->hdrlen-pattrib->iv_len- pattrib->icv_len;
+
+				*((u32 *)crc)=cpu_to_le32(getcrc32(payload,length));
+
+				arcfour_init(&mycontext, wepkey,3+keylength);
+				arcfour_encrypt(&mycontext, payload, payload, length);
+				arcfour_encrypt(&mycontext, payload+length, crc, 4);
+
+			}
+			else
+			{
+			length=pxmitpriv->frag_len-pattrib->hdrlen-pattrib->iv_len-pattrib->icv_len ;
+				*((u32 *)crc)=cpu_to_le32(getcrc32(payload,length));
+				arcfour_init(&mycontext, wepkey,3+keylength);
+				arcfour_encrypt(&mycontext, payload, payload, length);
+				arcfour_encrypt(&mycontext, payload+length, crc, 4);
+
+			pframe+=pxmitpriv->frag_len;
+			pframe=(u8 *)RND4((SIZE_PTR)(pframe));
+
+			}
+
+		}
+
+	}
+
+_func_exit_;
+
+}
+
+void rtw_wep_decrypt(_adapter  *padapter, u8 *precvframe)
+{
+	// exclude ICV
+	u8	crc[4];
+	struct arc4context	 mycontext;
+	sint 	length;
+	u32	keylength;
+	u8	*pframe, *payload,*iv,wepkey[16];
+	u8	 keyindex;
+	struct	rx_pkt_attrib	 *prxattrib = &(((union recv_frame*)precvframe)->u.hdr.attrib);
+	struct 	security_priv	*psecuritypriv=&padapter->securitypriv;
+
+_func_enter_;
+
+	pframe=(unsigned char *)((union recv_frame*)precvframe)->u.hdr.rx_data;
+
+	//start to decrypt recvframe
+	if((prxattrib->encrypt==_WEP40_)||(prxattrib->encrypt==_WEP104_))
+	{
+		iv=pframe+prxattrib->hdrlen;
+		//keyindex=(iv[3]&0x3);
+		keyindex = prxattrib->key_index;
+		keylength=psecuritypriv->dot11DefKeylen[keyindex];
+		_rtw_memcpy(&wepkey[0], iv, 3);
+		//_rtw_memcpy(&wepkey[3], &psecuritypriv->dot11DefKey[psecuritypriv->dot11PrivacyKeyIndex].skey[0],keylength);
+		_rtw_memcpy(&wepkey[3], &psecuritypriv->dot11DefKey[keyindex].skey[0],keylength);
+		length= ((union recv_frame *)precvframe)->u.hdr.len-prxattrib->hdrlen-prxattrib->iv_len;
+
+		payload=pframe+prxattrib->iv_len+prxattrib->hdrlen;
+
+		//decrypt payload include icv
+		arcfour_init(&mycontext, wepkey,3+keylength);
+		arcfour_encrypt(&mycontext, payload, payload,  length);
+
+		//calculate icv and compare the icv
+		*((u32 *)crc)=le32_to_cpu(getcrc32(payload,length-4));
+
+		if(crc[3]!=payload[length-1] || crc[2]!=payload[length-2] || crc[1]!=payload[length-3] || crc[0]!=payload[length-4])
+		{
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_wep_decrypt:icv error crc[3](%x)!=payload[length-1](%x) || crc[2](%x)!=payload[length-2](%x) || crc[1](%x)!=payload[length-3](%x) || crc[0](%x)!=payload[length-4](%x)\n",
+						crc[3],payload[length-1],crc[2],payload[length-2],crc[1],payload[length-3],crc[0],payload[length-4]));
+		}
+
+	}
+
+_func_exit_;
+
+	return;
+
+}
+
+//3 		=====TKIP related=====
+
+static u32 secmicgetuint32( u8 * p )
+// Convert from Byte[] to Us4Byte32 in a portable way
+{
+	s32 i;
+	u32 res = 0;
+_func_enter_;
+	for( i=0; i<4; i++ )
+	{
+		res |= ((u32)(*p++)) << (8*i);
+	}
+_func_exit_;
+	return res;
+}
+
+static void secmicputuint32( u8 * p, u32 val )
+// Convert from Us4Byte32 to Byte[] in a portable way
+{
+	long i;
+_func_enter_;
+	for( i=0; i<4; i++ )
+	{
+		*p++ = (u8) (val & 0xff);
+		val >>= 8;
+	}
+_func_exit_;
+}
+
+static void secmicclear(struct mic_data *pmicdata)
+{
+// Reset the state to the empty message.
+_func_enter_;
+	pmicdata->L = pmicdata->K0;
+	pmicdata->R = pmicdata->K1;
+	pmicdata->nBytesInM = 0;
+	pmicdata->M = 0;
+_func_exit_;
+}
+
+void rtw_secmicsetkey(struct mic_data *pmicdata, u8 * key )
+{
+	// Set the key
+_func_enter_;
+	pmicdata->K0 = secmicgetuint32( key );
+	pmicdata->K1 = secmicgetuint32( key + 4 );
+	// and reset the message
+	secmicclear(pmicdata);
+_func_exit_;
+}
+
+void rtw_secmicappendbyte(struct mic_data *pmicdata, u8 b )
+{
+_func_enter_;
+	// Append the byte to our word-sized buffer
+	pmicdata->M |= ((unsigned long)b) << (8*pmicdata->nBytesInM);
+	pmicdata->nBytesInM++;
+	// Process the word if it is full.
+	if( pmicdata->nBytesInM >= 4 )
+	{
+		pmicdata->L ^= pmicdata->M;
+		pmicdata->R ^= ROL32( pmicdata->L, 17 );
+		pmicdata->L += pmicdata->R;
+		pmicdata->R ^= ((pmicdata->L & 0xff00ff00) >> 8) | ((pmicdata->L & 0x00ff00ff) << 8);
+		pmicdata->L += pmicdata->R;
+		pmicdata->R ^= ROL32( pmicdata->L, 3 );
+		pmicdata->L += pmicdata->R;
+		pmicdata->R ^= ROR32( pmicdata->L, 2 );
+		pmicdata->L += pmicdata->R;
+		// Clear the buffer
+		pmicdata->M = 0;
+		pmicdata->nBytesInM = 0;
+	}
+_func_exit_;
+}
+
+void rtw_secmicappend(struct mic_data *pmicdata, u8 * src, u32 nbytes )
+{
+_func_enter_;
+	// This is simple
+	while( nbytes > 0 )
+	{
+		rtw_secmicappendbyte(pmicdata, *src++ );
+		nbytes--;
+	}
+_func_exit_;
+}
+
+void rtw_secgetmic(struct mic_data *pmicdata, u8 * dst )
+{
+_func_enter_;
+	// Append the minimum padding
+	rtw_secmicappendbyte(pmicdata, 0x5a );
+	rtw_secmicappendbyte(pmicdata, 0 );
+	rtw_secmicappendbyte(pmicdata, 0 );
+	rtw_secmicappendbyte(pmicdata, 0 );
+	rtw_secmicappendbyte(pmicdata, 0 );
+	// and then zeroes until the length is a multiple of 4
+	while( pmicdata->nBytesInM != 0 )
+	{
+		rtw_secmicappendbyte(pmicdata, 0 );
+	}
+	// The appendByte function has already computed the result.
+	secmicputuint32( dst, pmicdata->L );
+	secmicputuint32( dst+4, pmicdata->R );
+	// Reset to the empty message.
+	secmicclear(pmicdata);
+_func_exit_;
+}
+
+
+void rtw_seccalctkipmic(u8 * key,u8 *header,u8 *data,u32 data_len,u8 *mic_code, u8 pri)
+{
+
+	struct mic_data	micdata;
+	u8 priority[4]={0x0,0x0,0x0,0x0};
+_func_enter_;
+	rtw_secmicsetkey(&micdata, key);
+	priority[0]=pri;
+
+	/* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */
+	if(header[1]&1){   //ToDS==1
+			rtw_secmicappend(&micdata, &header[16], 6);  //DA
+		if(header[1]&2)  //From Ds==1
+			rtw_secmicappend(&micdata, &header[24], 6);
+		else
+			rtw_secmicappend(&micdata, &header[10], 6);
+	}
+	else{	//ToDS==0
+		rtw_secmicappend(&micdata, &header[4], 6);   //DA
+		if(header[1]&2)  //From Ds==1
+			rtw_secmicappend(&micdata, &header[16], 6);
+		else
+			rtw_secmicappend(&micdata, &header[10], 6);
+
+	}
+	rtw_secmicappend(&micdata, &priority[0], 4);
+
+
+	rtw_secmicappend(&micdata, data, data_len);
+
+	rtw_secgetmic(&micdata,mic_code);
+_func_exit_;
+}
+
+
+
+
+/* macros for extraction/creation of unsigned char/unsigned short values  */
+#define RotR1(v16)   ((((v16) >> 1) & 0x7FFF) ^ (((v16) & 1) << 15))
+#define   Lo8(v16)   ((u8)( (v16)       & 0x00FF))
+#define   Hi8(v16)   ((u8)(((v16) >> 8) & 0x00FF))
+#define  Lo16(v32)   ((u16)( (v32)       & 0xFFFF))
+#define  Hi16(v32)   ((u16)(((v32) >>16) & 0xFFFF))
+#define  Mk16(hi,lo) ((lo) ^ (((u16)(hi)) << 8))
+
+/* select the Nth 16-bit word of the temporal key unsigned char array TK[]   */
+#define  TK16(N)     Mk16(tk[2*(N)+1],tk[2*(N)])
+
+/* S-box lookup: 16 bits --> 16 bits */
+#define _S_(v16)     (Sbox1[0][Lo8(v16)] ^ Sbox1[1][Hi8(v16)])
+
+/* fixed algorithm "parameters" */
+#define PHASE1_LOOP_CNT   8    /* this needs to be "big enough"     */
+#define TA_SIZE           6    /*  48-bit transmitter address       */
+#define TK_SIZE          16    /* 128-bit temporal key              */
+#define P1K_SIZE         10    /*  80-bit Phase1 key                */
+#define RC4_KEY_SIZE     16    /* 128-bit RC4KEY (104 bits unknown) */
+
+
+/* 2-unsigned char by 2-unsigned char subset of the full AES S-box table */
+static const unsigned short Sbox1[2][256]=       /* Sbox for hash (can be in ROM)     */
+{ {
+   0xC6A5,0xF884,0xEE99,0xF68D,0xFF0D,0xD6BD,0xDEB1,0x9154,
+   0x6050,0x0203,0xCEA9,0x567D,0xE719,0xB562,0x4DE6,0xEC9A,
+   0x8F45,0x1F9D,0x8940,0xFA87,0xEF15,0xB2EB,0x8EC9,0xFB0B,
+   0x41EC,0xB367,0x5FFD,0x45EA,0x23BF,0x53F7,0xE496,0x9B5B,
+   0x75C2,0xE11C,0x3DAE,0x4C6A,0x6C5A,0x7E41,0xF502,0x834F,
+   0x685C,0x51F4,0xD134,0xF908,0xE293,0xAB73,0x6253,0x2A3F,
+   0x080C,0x9552,0x4665,0x9D5E,0x3028,0x37A1,0x0A0F,0x2FB5,
+   0x0E09,0x2436,0x1B9B,0xDF3D,0xCD26,0x4E69,0x7FCD,0xEA9F,
+   0x121B,0x1D9E,0x5874,0x342E,0x362D,0xDCB2,0xB4EE,0x5BFB,
+   0xA4F6,0x764D,0xB761,0x7DCE,0x527B,0xDD3E,0x5E71,0x1397,
+   0xA6F5,0xB968,0x0000,0xC12C,0x4060,0xE31F,0x79C8,0xB6ED,
+   0xD4BE,0x8D46,0x67D9,0x724B,0x94DE,0x98D4,0xB0E8,0x854A,
+   0xBB6B,0xC52A,0x4FE5,0xED16,0x86C5,0x9AD7,0x6655,0x1194,
+   0x8ACF,0xE910,0x0406,0xFE81,0xA0F0,0x7844,0x25BA,0x4BE3,
+   0xA2F3,0x5DFE,0x80C0,0x058A,0x3FAD,0x21BC,0x7048,0xF104,
+   0x63DF,0x77C1,0xAF75,0x4263,0x2030,0xE51A,0xFD0E,0xBF6D,
+   0x814C,0x1814,0x2635,0xC32F,0xBEE1,0x35A2,0x88CC,0x2E39,
+   0x9357,0x55F2,0xFC82,0x7A47,0xC8AC,0xBAE7,0x322B,0xE695,
+   0xC0A0,0x1998,0x9ED1,0xA37F,0x4466,0x547E,0x3BAB,0x0B83,
+   0x8CCA,0xC729,0x6BD3,0x283C,0xA779,0xBCE2,0x161D,0xAD76,
+   0xDB3B,0x6456,0x744E,0x141E,0x92DB,0x0C0A,0x486C,0xB8E4,
+   0x9F5D,0xBD6E,0x43EF,0xC4A6,0x39A8,0x31A4,0xD337,0xF28B,
+   0xD532,0x8B43,0x6E59,0xDAB7,0x018C,0xB164,0x9CD2,0x49E0,
+   0xD8B4,0xACFA,0xF307,0xCF25,0xCAAF,0xF48E,0x47E9,0x1018,
+   0x6FD5,0xF088,0x4A6F,0x5C72,0x3824,0x57F1,0x73C7,0x9751,
+   0xCB23,0xA17C,0xE89C,0x3E21,0x96DD,0x61DC,0x0D86,0x0F85,
+   0xE090,0x7C42,0x71C4,0xCCAA,0x90D8,0x0605,0xF701,0x1C12,
+   0xC2A3,0x6A5F,0xAEF9,0x69D0,0x1791,0x9958,0x3A27,0x27B9,
+   0xD938,0xEB13,0x2BB3,0x2233,0xD2BB,0xA970,0x0789,0x33A7,
+   0x2DB6,0x3C22,0x1592,0xC920,0x8749,0xAAFF,0x5078,0xA57A,
+   0x038F,0x59F8,0x0980,0x1A17,0x65DA,0xD731,0x84C6,0xD0B8,
+   0x82C3,0x29B0,0x5A77,0x1E11,0x7BCB,0xA8FC,0x6DD6,0x2C3A,
+  },
+
+
+  {  /* second half of table is unsigned char-reversed version of first! */
+   0xA5C6,0x84F8,0x99EE,0x8DF6,0x0DFF,0xBDD6,0xB1DE,0x5491,
+   0x5060,0x0302,0xA9CE,0x7D56,0x19E7,0x62B5,0xE64D,0x9AEC,
+   0x458F,0x9D1F,0x4089,0x87FA,0x15EF,0xEBB2,0xC98E,0x0BFB,
+   0xEC41,0x67B3,0xFD5F,0xEA45,0xBF23,0xF753,0x96E4,0x5B9B,
+   0xC275,0x1CE1,0xAE3D,0x6A4C,0x5A6C,0x417E,0x02F5,0x4F83,
+   0x5C68,0xF451,0x34D1,0x08F9,0x93E2,0x73AB,0x5362,0x3F2A,
+   0x0C08,0x5295,0x6546,0x5E9D,0x2830,0xA137,0x0F0A,0xB52F,
+   0x090E,0x3624,0x9B1B,0x3DDF,0x26CD,0x694E,0xCD7F,0x9FEA,
+   0x1B12,0x9E1D,0x7458,0x2E34,0x2D36,0xB2DC,0xEEB4,0xFB5B,
+   0xF6A4,0x4D76,0x61B7,0xCE7D,0x7B52,0x3EDD,0x715E,0x9713,
+   0xF5A6,0x68B9,0x0000,0x2CC1,0x6040,0x1FE3,0xC879,0xEDB6,
+   0xBED4,0x468D,0xD967,0x4B72,0xDE94,0xD498,0xE8B0,0x4A85,
+   0x6BBB,0x2AC5,0xE54F,0x16ED,0xC586,0xD79A,0x5566,0x9411,
+   0xCF8A,0x10E9,0x0604,0x81FE,0xF0A0,0x4478,0xBA25,0xE34B,
+   0xF3A2,0xFE5D,0xC080,0x8A05,0xAD3F,0xBC21,0x4870,0x04F1,
+   0xDF63,0xC177,0x75AF,0x6342,0x3020,0x1AE5,0x0EFD,0x6DBF,
+   0x4C81,0x1418,0x3526,0x2FC3,0xE1BE,0xA235,0xCC88,0x392E,
+   0x5793,0xF255,0x82FC,0x477A,0xACC8,0xE7BA,0x2B32,0x95E6,
+   0xA0C0,0x9819,0xD19E,0x7FA3,0x6644,0x7E54,0xAB3B,0x830B,
+   0xCA8C,0x29C7,0xD36B,0x3C28,0x79A7,0xE2BC,0x1D16,0x76AD,
+   0x3BDB,0x5664,0x4E74,0x1E14,0xDB92,0x0A0C,0x6C48,0xE4B8,
+   0x5D9F,0x6EBD,0xEF43,0xA6C4,0xA839,0xA431,0x37D3,0x8BF2,
+   0x32D5,0x438B,0x596E,0xB7DA,0x8C01,0x64B1,0xD29C,0xE049,
+   0xB4D8,0xFAAC,0x07F3,0x25CF,0xAFCA,0x8EF4,0xE947,0x1810,
+   0xD56F,0x88F0,0x6F4A,0x725C,0x2438,0xF157,0xC773,0x5197,
+   0x23CB,0x7CA1,0x9CE8,0x213E,0xDD96,0xDC61,0x860D,0x850F,
+   0x90E0,0x427C,0xC471,0xAACC,0xD890,0x0506,0x01F7,0x121C,
+   0xA3C2,0x5F6A,0xF9AE,0xD069,0x9117,0x5899,0x273A,0xB927,
+   0x38D9,0x13EB,0xB32B,0x3322,0xBBD2,0x70A9,0x8907,0xA733,
+   0xB62D,0x223C,0x9215,0x20C9,0x4987,0xFFAA,0x7850,0x7AA5,
+   0x8F03,0xF859,0x8009,0x171A,0xDA65,0x31D7,0xC684,0xB8D0,
+   0xC382,0xB029,0x775A,0x111E,0xCB7B,0xFCA8,0xD66D,0x3A2C,
+  }
+};
+
+ /*
+**********************************************************************
+* Routine: Phase 1 -- generate P1K, given TA, TK, IV32
+*
+* Inputs:
+*     tk[]      = temporal key                         [128 bits]
+*     ta[]      = transmitter's MAC address            [ 48 bits]
+*     iv32      = upper 32 bits of IV                  [ 32 bits]
+* Output:
+*     p1k[]     = Phase 1 key                          [ 80 bits]
+*
+* Note:
+*     This function only needs to be called every 2**16 packets,
+*     although in theory it could be called every packet.
+*
+**********************************************************************
+*/
+static void phase1(u16 *p1k,const u8 *tk,const u8 *ta,u32 iv32)
+{
+	sint  i;
+_func_enter_;
+	/* Initialize the 80 bits of P1K[] from IV32 and TA[0..5]     */
+	p1k[0]      = Lo16(iv32);
+	p1k[1]      = Hi16(iv32);
+	p1k[2]      = Mk16(ta[1],ta[0]); /* use TA[] as little-endian */
+	p1k[3]      = Mk16(ta[3],ta[2]);
+	p1k[4]      = Mk16(ta[5],ta[4]);
+
+	/* Now compute an unbalanced Feistel cipher with 80-bit block */
+	/* size on the 80-bit block P1K[], using the 128-bit key TK[] */
+	for (i=0; i < PHASE1_LOOP_CNT ;i++)
+	{                 /* Each add operation here is mod 2**16 */
+		p1k[0] += _S_(p1k[4] ^ TK16((i&1)+0));
+		p1k[1] += _S_(p1k[0] ^ TK16((i&1)+2));
+		p1k[2] += _S_(p1k[1] ^ TK16((i&1)+4));
+		p1k[3] += _S_(p1k[2] ^ TK16((i&1)+6));
+		p1k[4] += _S_(p1k[3] ^ TK16((i&1)+0));
+		p1k[4] +=  (unsigned short)i;                    /* avoid "slide attacks" */
+        }
+_func_exit_;
+}
+
+
+/*
+**********************************************************************
+* Routine: Phase 2 -- generate RC4KEY, given TK, P1K, IV16
+*
+* Inputs:
+*     tk[]      = Temporal key                         [128 bits]
+*     p1k[]     = Phase 1 output key                   [ 80 bits]
+*     iv16      = low 16 bits of IV counter            [ 16 bits]
+* Output:
+*     rc4key[]  = the key used to encrypt the packet   [128 bits]
+*
+* Note:
+*     The value {TA,IV32,IV16} for Phase1/Phase2 must be unique
+*     across all packets using the same key TK value. Then, for a
+*     given value of TK[], this TKIP48 construction guarantees that
+*     the final RC4KEY value is unique across all packets.
+*
+* Suggested implementation optimization: if PPK[] is "overlaid"
+*     appropriately on RC4KEY[], there is no need for the final
+*     for loop below that copies the PPK[] result into RC4KEY[].
+*
+**********************************************************************
+*/
+static void phase2(u8 *rc4key,const u8 *tk,const u16 *p1k,u16 iv16)
+{
+	sint  i;
+	u16 PPK[6];                          /* temporary key for mixing    */
+_func_enter_;
+	/* Note: all adds in the PPK[] equations below are mod 2**16         */
+	for (i=0;i<5;i++) PPK[i]=p1k[i];      /* first, copy P1K to PPK      */
+		PPK[5]  =  p1k[4] +iv16;             /* next,  add in IV16          */
+
+	/* Bijective non-linear mixing of the 96 bits of PPK[0..5]           */
+	PPK[0] +=    _S_(PPK[5] ^ TK16(0));   /* Mix key in each "round"     */
+	PPK[1] +=    _S_(PPK[0] ^ TK16(1));
+	PPK[2] +=    _S_(PPK[1] ^ TK16(2));
+	PPK[3] +=    _S_(PPK[2] ^ TK16(3));
+	PPK[4] +=    _S_(PPK[3] ^ TK16(4));
+	PPK[5] +=    _S_(PPK[4] ^ TK16(5));   /* Total # S-box lookups == 6  */
+
+	/* Final sweep: bijective, "linear". Rotates kill LSB correlations   */
+	PPK[0] +=  RotR1(PPK[5] ^ TK16(6));
+	PPK[1] +=  RotR1(PPK[0] ^ TK16(7));   /* Use all of TK[] in Phase2   */
+	PPK[2] +=  RotR1(PPK[1]);
+	PPK[3] +=  RotR1(PPK[2]);
+	PPK[4] +=  RotR1(PPK[3]);
+	PPK[5] +=  RotR1(PPK[4]);
+	/* Note: At this point, for a given key TK[0..15], the 96-bit output */
+	/*       value PPK[0..5] is guaranteed to be unique, as a function   */
+	/*       of the 96-bit "input" value   {TA,IV32,IV16}. That is, P1K  */
+	/*       is now a keyed permutation of {TA,IV32,IV16}.               */
+
+	/* Set RC4KEY[0..3], which includes "cleartext" portion of RC4 key   */
+	rc4key[0] = Hi8(iv16);                /* RC4KEY[0..2] is the WEP IV  */
+	rc4key[1] =(Hi8(iv16) | 0x20) & 0x7F; /* Help avoid weak (FMS) keys  */
+	rc4key[2] = Lo8(iv16);
+	rc4key[3] = Lo8((PPK[5] ^ TK16(0)) >> 1);
+
+
+	/* Copy 96 bits of PPK[0..5] to RC4KEY[4..15]  (little-endian)       */
+	for (i=0;i<6;i++)
+	{
+		rc4key[4+2*i] = Lo8(PPK[i]);
+		rc4key[5+2*i] = Hi8(PPK[i]);
+	}
+_func_exit_;
+}
+
+
+//The hlen isn't include the IV
+u32	rtw_tkip_encrypt(_adapter *padapter, u8 *pxmitframe)
+{																	// exclude ICV
+	u16	pnl;
+	u32	pnh;
+	u8	rc4key[16];
+	u8   ttkey[16];
+	u8	crc[4];
+	struct arc4context mycontext;
+	sint 			curfragnum,length;
+	u32	prwskeylen;
+
+	u8	*pframe, *payload,*iv,*prwskey;
+	union pn48 dot11txpn;
+	struct	sta_info		*stainfo;
+	struct	pkt_attrib	 *pattrib = &((struct xmit_frame *)pxmitframe)->attrib;
+	struct 	security_priv	*psecuritypriv=&padapter->securitypriv;
+	struct	xmit_priv		*pxmitpriv=&padapter->xmitpriv;
+	u32	res=_SUCCESS;
+_func_enter_;
+
+	if(((struct xmit_frame*)pxmitframe)->buf_addr==NULL)
+		return _FAIL;
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+	pframe = ((struct xmit_frame*)pxmitframe)->buf_addr + TXDESC_SIZE +
+		 (((struct xmit_frame*)pxmitframe)->pkt_offset * PACKET_OFFSET_SZ);
+#else
+	pframe = ((struct xmit_frame*)pxmitframe)->buf_addr + TXDESC_OFFSET;
+#endif
+
+	//4 start to encrypt each fragment
+	if(pattrib->encrypt==_TKIP_){
+
+		if(pattrib->psta)
+		{
+			stainfo = pattrib->psta;
+		}
+		else
+		{
+			DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+			stainfo=rtw_get_stainfo(&padapter->stapriv ,&pattrib->ra[0] );
+		}
+
+		if (stainfo!=NULL){
+
+			if(!(stainfo->state &_FW_LINKED))
+			{
+				DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, stainfo->state);
+				return _FAIL;
+			}
+
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_tkip_encrypt: stainfo!=NULL!!!\n"));
+
+			if(IS_MCAST(pattrib->ra))
+			{
+				prwskey=psecuritypriv->dot118021XGrpKey[psecuritypriv->dot118021XGrpKeyid].skey;
+			}
+			else
+			{
+				prwskey=&stainfo->dot118021x_UncstKey.skey[0];
+			}
+
+			prwskeylen=16;
+
+			for(curfragnum=0;curfragnum<pattrib->nr_frags;curfragnum++){
+				iv=pframe+pattrib->hdrlen;
+				payload=pframe+pattrib->iv_len+pattrib->hdrlen;
+
+				GET_TKIP_PN(iv, dot11txpn);
+
+				pnl=(u16)(dot11txpn.val);
+				pnh=(u32)(dot11txpn.val>>16);
+
+				phase1((u16 *)&ttkey[0],prwskey,&pattrib->ta[0],pnh);
+
+				phase2(&rc4key[0],prwskey,(u16 *)&ttkey[0],pnl);
+
+				if((curfragnum+1)==pattrib->nr_frags){	//4 the last fragment
+					length=pattrib->last_txcmdsz-pattrib->hdrlen-pattrib->iv_len- pattrib->icv_len;
+					RT_TRACE(_module_rtl871x_security_c_,_drv_info_,("pattrib->iv_len =%x, pattrib->icv_len =%x\n", pattrib->iv_len,pattrib->icv_len));
+					*((u32 *)crc)=cpu_to_le32(getcrc32(payload,length));/* modified by Amy*/
+
+					arcfour_init(&mycontext, rc4key,16);
+					arcfour_encrypt(&mycontext, payload, payload, length);
+					arcfour_encrypt(&mycontext, payload+length, crc, 4);
+
+				}
+				else{
+					length=pxmitpriv->frag_len-pattrib->hdrlen-pattrib->iv_len-pattrib->icv_len ;
+					*((u32 *)crc)=cpu_to_le32(getcrc32(payload,length));/* modified by Amy*/
+					arcfour_init(&mycontext,rc4key,16);
+					arcfour_encrypt(&mycontext, payload, payload, length);
+					arcfour_encrypt(&mycontext, payload+length, crc, 4);
+
+				pframe+=pxmitpriv->frag_len;
+				pframe=(u8 *)RND4((SIZE_PTR)(pframe));
+
+				}
+			}
+
+
+		}
+		else{
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_tkip_encrypt: stainfo==NULL!!!\n"));
+                        DBG_871X("%s, psta==NUL\n", __func__);
+			res=_FAIL;
+		}
+
+	}
+_func_exit_;
+	return res;
+
+}
+
+
+//The hlen isn't include the IV
+u32 rtw_tkip_decrypt(_adapter *padapter, u8 *precvframe)
+{																	// exclude ICV
+	u16 pnl;
+	u32 pnh;
+	u8   rc4key[16];
+	u8   ttkey[16];
+	u8	crc[4];
+	struct arc4context mycontext;
+	sint 			length;
+	u32	prwskeylen;
+
+	u8	*pframe, *payload,*iv,*prwskey;
+	union pn48 dot11txpn;
+	struct	sta_info		*stainfo;
+	struct	rx_pkt_attrib	 *prxattrib = &((union recv_frame *)precvframe)->u.hdr.attrib;
+	struct 	security_priv	*psecuritypriv=&padapter->securitypriv;
+//	struct	recv_priv		*precvpriv=&padapter->recvpriv;
+	u32		res=_SUCCESS;
+
+_func_enter_;
+
+	pframe=(unsigned char *)((union recv_frame*)precvframe)->u.hdr.rx_data;
+
+	//4 start to decrypt recvframe
+	if(prxattrib->encrypt==_TKIP_){
+
+		stainfo=rtw_get_stainfo(&padapter->stapriv ,&prxattrib->ta[0] );
+		if (stainfo!=NULL){
+
+			if(IS_MCAST(prxattrib->ra))
+			{
+				static u32 start = 0;
+				static u32 no_gkey_bc_cnt = 0;
+				static u32 no_gkey_mc_cnt = 0;
+
+				if(psecuritypriv->binstallGrpkey==_FALSE)
+				{
+					res=_FAIL;
+
+					if (start == 0)
+						start = rtw_get_current_time();
+
+					if (is_broadcast_mac_addr(prxattrib->ra))
+						no_gkey_bc_cnt++;
+					else
+						no_gkey_mc_cnt++;
+
+					if (rtw_get_passing_time_ms(start) > 1000) {
+						if (no_gkey_bc_cnt || no_gkey_mc_cnt) {
+							DBG_871X_LEVEL(_drv_always_, FUNC_ADPT_FMT" no_gkey_bc_cnt:%u, no_gkey_mc_cnt:%u\n",
+								FUNC_ADPT_ARG(padapter), no_gkey_bc_cnt, no_gkey_mc_cnt);
+						}
+						start = rtw_get_current_time();
+						no_gkey_bc_cnt = 0;
+						no_gkey_mc_cnt = 0;
+					}
+					goto exit;
+				}
+
+				if (no_gkey_bc_cnt || no_gkey_mc_cnt) {
+					DBG_871X_LEVEL(_drv_always_, FUNC_ADPT_FMT" gkey installed. no_gkey_bc_cnt:%u, no_gkey_mc_cnt:%u\n",
+						FUNC_ADPT_ARG(padapter), no_gkey_bc_cnt, no_gkey_mc_cnt);
+				}
+				start = 0;
+				no_gkey_bc_cnt = 0;
+				no_gkey_mc_cnt = 0;
+
+				//DBG_871X("rx bc/mc packets, to perform sw rtw_tkip_decrypt\n");
+				//prwskey = psecuritypriv->dot118021XGrpKey[psecuritypriv->dot118021XGrpKeyid].skey;
+				prwskey = psecuritypriv->dot118021XGrpKey[prxattrib->key_index].skey;
+				prwskeylen=16;
+			}
+			else
+			{
+			        RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_tkip_decrypt: stainfo!=NULL!!!\n"));
+				prwskey=&stainfo->dot118021x_UncstKey.skey[0];
+				prwskeylen=16;
+			}
+
+			iv=pframe+prxattrib->hdrlen;
+			payload=pframe+prxattrib->iv_len+prxattrib->hdrlen;
+			length= ((union recv_frame *)precvframe)->u.hdr.len-prxattrib->hdrlen-prxattrib->iv_len;
+
+			GET_TKIP_PN(iv, dot11txpn);
+
+			pnl=(u16)(dot11txpn.val);
+			pnh=(u32)(dot11txpn.val>>16);
+
+			phase1((u16 *)&ttkey[0],prwskey,&prxattrib->ta[0],pnh);
+			phase2(&rc4key[0],prwskey,(unsigned short *)&ttkey[0],pnl);
+
+			//4 decrypt payload include icv
+
+			arcfour_init(&mycontext, rc4key,16);
+			arcfour_encrypt(&mycontext, payload, payload, length);
+
+			*((u32 *)crc)=le32_to_cpu(getcrc32(payload,length-4));
+
+			if(crc[3]!=payload[length-1] || crc[2]!=payload[length-2] || crc[1]!=payload[length-3] || crc[0]!=payload[length-4])
+			{
+			    RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_wep_decrypt:icv error crc[3](%x)!=payload[length-1](%x) || crc[2](%x)!=payload[length-2](%x) || crc[1](%x)!=payload[length-3](%x) || crc[0](%x)!=payload[length-4](%x)\n",
+						crc[3],payload[length-1],crc[2],payload[length-2],crc[1],payload[length-3],crc[0],payload[length-4]));
+				res=_FAIL;
+			}
+
+
+		}
+		else{
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_tkip_decrypt: stainfo==NULL!!!\n"));
+			res=_FAIL;
+		}
+
+	}
+_func_exit_;
+exit:
+	return res;
+
+}
+
+
+//3			=====AES related=====
+
+
+
+#define MAX_MSG_SIZE	2048
+/*****************************/
+/******** SBOX Table *********/
+/*****************************/
+
+  static  u8 sbox_table[256] =
+    {
+        0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5,
+        0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
+        0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0,
+        0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
+        0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc,
+        0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
+        0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a,
+        0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
+        0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0,
+        0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
+        0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b,
+        0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
+        0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85,
+        0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
+        0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5,
+        0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
+        0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17,
+        0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
+        0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88,
+        0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
+        0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c,
+        0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
+        0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9,
+        0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
+        0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6,
+        0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
+        0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e,
+        0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
+        0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94,
+        0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
+        0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68,
+        0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16
+    };
+
+/*****************************/
+/**** Function Prototypes ****/
+/*****************************/
+
+static void bitwise_xor(u8 *ina, u8 *inb, u8 *out);
+static void construct_mic_iv(
+                        u8 *mic_header1,
+                        sint qc_exists,
+                        sint a4_exists,
+                        u8 *mpdu,
+                        uint payload_length,
+                        u8 * pn_vector,
+                        uint frtype);// add for CONFIG_IEEE80211W, none 11w also can use
+static void construct_mic_header1(
+                        u8 *mic_header1,
+                        sint header_length,
+                        u8 *mpdu,
+                        uint frtype);// add for CONFIG_IEEE80211W, none 11w also can use
+static void construct_mic_header2(
+                    u8 *mic_header2,
+                    u8 *mpdu,
+                    sint a4_exists,
+                    sint qc_exists);
+static void construct_ctr_preload(
+                        u8 *ctr_preload,
+                        sint a4_exists,
+                        sint qc_exists,
+                        u8 *mpdu,
+                        u8 *pn_vector,
+                        sint c,
+                        uint frtype);// add for CONFIG_IEEE80211W, none 11w also can use
+static void xor_128(u8 *a, u8 *b, u8 *out);
+static void xor_32(u8 *a, u8 *b, u8 *out);
+static u8 sbox(u8 a);
+static void next_key(u8 *key, sint round);
+static void byte_sub(u8 *in, u8 *out);
+static void shift_row(u8 *in, u8 *out);
+static void mix_column(u8 *in, u8 *out);
+#ifndef PLATFORM_FREEBSD
+static void add_round_key( u8 *shiftrow_in,
+                    u8 *mcol_in,
+                    u8 *block_in,
+                    sint round,
+                    u8 *out);
+#endif //PLATFORM_FREEBSD
+static void aes128k128d(u8 *key, u8 *data, u8 *ciphertext);
+
+
+/****************************************/
+/* aes128k128d()                        */
+/* Performs a 128 bit AES encrypt with  */
+/* 128 bit data.                        */
+/****************************************/
+static void xor_128(u8 *a, u8 *b, u8 *out)
+{
+    sint i;
+_func_enter_;
+    for (i=0;i<16; i++)
+    {
+        out[i] = a[i] ^ b[i];
+    }
+_func_exit_;
+}
+
+
+static void xor_32(u8 *a, u8 *b, u8 *out)
+{
+    sint i;
+_func_enter_;
+    for (i=0;i<4; i++)
+    {
+        out[i] = a[i] ^ b[i];
+    }
+_func_exit_;
+}
+
+
+static u8 sbox(u8 a)
+{
+    return sbox_table[(sint)a];
+}
+
+
+static void next_key(u8 *key, sint round)
+{
+    u8 rcon;
+    u8 sbox_key[4];
+    u8 rcon_table[12] =
+    {
+        0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80,
+        0x1b, 0x36, 0x36, 0x36
+    };
+_func_enter_;
+    sbox_key[0] = sbox(key[13]);
+    sbox_key[1] = sbox(key[14]);
+    sbox_key[2] = sbox(key[15]);
+    sbox_key[3] = sbox(key[12]);
+
+    rcon = rcon_table[round];
+
+    xor_32(&key[0], sbox_key, &key[0]);
+    key[0] = key[0] ^ rcon;
+
+    xor_32(&key[4], &key[0], &key[4]);
+    xor_32(&key[8], &key[4], &key[8]);
+    xor_32(&key[12], &key[8], &key[12]);
+_func_exit_;
+}
+
+
+static void byte_sub(u8 *in, u8 *out)
+{
+    sint i;
+_func_enter_;
+    for (i=0; i< 16; i++)
+    {
+        out[i] = sbox(in[i]);
+    }
+_func_exit_;
+}
+
+
+static void shift_row(u8 *in, u8 *out)
+{
+_func_enter_;
+    out[0] =  in[0];
+    out[1] =  in[5];
+    out[2] =  in[10];
+    out[3] =  in[15];
+    out[4] =  in[4];
+    out[5] =  in[9];
+    out[6] =  in[14];
+    out[7] =  in[3];
+    out[8] =  in[8];
+    out[9] =  in[13];
+    out[10] = in[2];
+    out[11] = in[7];
+    out[12] = in[12];
+    out[13] = in[1];
+    out[14] = in[6];
+    out[15] = in[11];
+_func_exit_;
+}
+
+
+static void mix_column(u8 *in, u8 *out)
+{
+    sint i;
+    u8 add1b[4];
+    u8 add1bf7[4];
+    u8 rotl[4];
+    u8 swap_halfs[4];
+    u8 andf7[4];
+    u8 rotr[4];
+    u8 temp[4];
+    u8 tempb[4];
+_func_enter_;
+    for (i=0 ; i<4; i++)
+    {
+        if ((in[i] & 0x80)== 0x80)
+            add1b[i] = 0x1b;
+        else
+            add1b[i] = 0x00;
+    }
+
+    swap_halfs[0] = in[2];    /* Swap halfs */
+    swap_halfs[1] = in[3];
+    swap_halfs[2] = in[0];
+    swap_halfs[3] = in[1];
+
+    rotl[0] = in[3];        /* Rotate left 8 bits */
+    rotl[1] = in[0];
+    rotl[2] = in[1];
+    rotl[3] = in[2];
+
+    andf7[0] = in[0] & 0x7f;
+    andf7[1] = in[1] & 0x7f;
+    andf7[2] = in[2] & 0x7f;
+    andf7[3] = in[3] & 0x7f;
+
+    for (i = 3; i>0; i--)    /* logical shift left 1 bit */
+    {
+        andf7[i] = andf7[i] << 1;
+        if ((andf7[i-1] & 0x80) == 0x80)
+        {
+            andf7[i] = (andf7[i] | 0x01);
+        }
+    }
+    andf7[0] = andf7[0] << 1;
+    andf7[0] = andf7[0] & 0xfe;
+
+    xor_32(add1b, andf7, add1bf7);
+
+    xor_32(in, add1bf7, rotr);
+
+    temp[0] = rotr[0];         /* Rotate right 8 bits */
+    rotr[0] = rotr[1];
+    rotr[1] = rotr[2];
+    rotr[2] = rotr[3];
+    rotr[3] = temp[0];
+
+    xor_32(add1bf7, rotr, temp);
+    xor_32(swap_halfs, rotl,tempb);
+    xor_32(temp, tempb, out);
+_func_exit_;
+}
+
+
+static void aes128k128d(u8 *key, u8 *data, u8 *ciphertext)
+{
+    sint round;
+    sint i;
+    u8 intermediatea[16];
+    u8 intermediateb[16];
+    u8 round_key[16];
+_func_enter_;
+    for(i=0; i<16; i++) round_key[i] = key[i];
+
+    for (round = 0; round < 11; round++)
+    {
+        if (round == 0)
+        {
+            xor_128(round_key, data, ciphertext);
+            next_key(round_key, round);
+        }
+        else if (round == 10)
+        {
+            byte_sub(ciphertext, intermediatea);
+            shift_row(intermediatea, intermediateb);
+            xor_128(intermediateb, round_key, ciphertext);
+        }
+        else    /* 1 - 9 */
+        {
+            byte_sub(ciphertext, intermediatea);
+            shift_row(intermediatea, intermediateb);
+            mix_column(&intermediateb[0], &intermediatea[0]);
+            mix_column(&intermediateb[4], &intermediatea[4]);
+            mix_column(&intermediateb[8], &intermediatea[8]);
+            mix_column(&intermediateb[12], &intermediatea[12]);
+            xor_128(intermediatea, round_key, ciphertext);
+            next_key(round_key, round);
+        }
+    }
+_func_exit_;
+}
+
+
+/************************************************/
+/* construct_mic_iv()                           */
+/* Builds the MIC IV from header fields and PN  */
+/* Baron think the function is construct CCM    */
+/* nonce                                        */
+/************************************************/
+static void construct_mic_iv(
+                        u8 *mic_iv,
+                        sint qc_exists,
+                        sint a4_exists,
+                        u8 *mpdu,
+                        uint payload_length,
+                        u8 *pn_vector,
+                        uint frtype// add for CONFIG_IEEE80211W, none 11w also can use
+                        )
+{
+    sint i;
+_func_enter_;
+    mic_iv[0] = 0x59;
+    if (qc_exists && a4_exists) mic_iv[1] = mpdu[30] & 0x0f;    /* QoS_TC           */
+    if (qc_exists && !a4_exists) mic_iv[1] = mpdu[24] & 0x0f;   /* mute bits 7-4    */
+    if (!qc_exists) mic_iv[1] = 0x00;
+#ifdef CONFIG_IEEE80211W
+	//802.11w management frame should set management bit(4)
+    if(frtype == WIFI_MGT_TYPE)
+		mic_iv[1] |= BIT(4);
+#endif //CONFIG_IEEE80211W
+    for (i = 2; i < 8; i++)
+        mic_iv[i] = mpdu[i + 8];                    /* mic_iv[2:7] = A2[0:5] = mpdu[10:15] */
+    #ifdef CONSISTENT_PN_ORDER
+        for (i = 8; i < 14; i++)
+            mic_iv[i] = pn_vector[i - 8];           /* mic_iv[8:13] = PN[0:5] */
+    #else
+        for (i = 8; i < 14; i++)
+            mic_iv[i] = pn_vector[13 - i];          /* mic_iv[8:13] = PN[5:0] */
+    #endif
+    mic_iv[14] = (unsigned char) (payload_length / 256);
+    mic_iv[15] = (unsigned char) (payload_length % 256);
+_func_exit_;
+}
+
+
+/************************************************/
+/* construct_mic_header1()                      */
+/* Builds the first MIC header block from       */
+/* header fields.                               */
+/* Build AAD SC,A1,A2                           */
+/************************************************/
+static void construct_mic_header1(
+                        u8 *mic_header1,
+                        sint header_length,
+                        u8 *mpdu,
+                        uint frtype// add for CONFIG_IEEE80211W, none 11w also can use
+                        )
+{
+_func_enter_;
+    mic_header1[0] = (u8)((header_length - 2) / 256);
+    mic_header1[1] = (u8)((header_length - 2) % 256);
+#ifdef CONFIG_IEEE80211W
+    //802.11w management frame don't AND subtype bits 4,5,6 of frame control field
+    if(frtype == WIFI_MGT_TYPE)
+		mic_header1[2] = mpdu[0];
+	else
+#endif //CONFIG_IEEE80211W
+		mic_header1[2] = mpdu[0] & 0xcf;    /* Mute CF poll & CF ack bits */
+
+    mic_header1[3] = mpdu[1] & 0xc7;    /* Mute retry, more data and pwr mgt bits */
+    mic_header1[4] = mpdu[4];       /* A1 */
+    mic_header1[5] = mpdu[5];
+    mic_header1[6] = mpdu[6];
+    mic_header1[7] = mpdu[7];
+    mic_header1[8] = mpdu[8];
+    mic_header1[9] = mpdu[9];
+    mic_header1[10] = mpdu[10];     /* A2 */
+    mic_header1[11] = mpdu[11];
+    mic_header1[12] = mpdu[12];
+    mic_header1[13] = mpdu[13];
+    mic_header1[14] = mpdu[14];
+    mic_header1[15] = mpdu[15];
+_func_exit_;
+}
+
+
+/************************************************/
+/* construct_mic_header2()                      */
+/* Builds the last MIC header block from        */
+/* header fields.                               */
+/************************************************/
+static void construct_mic_header2(
+                u8 *mic_header2,
+                u8 *mpdu,
+                sint a4_exists,
+                sint qc_exists
+                )
+{
+    sint i;
+_func_enter_;
+    for (i = 0; i<16; i++) mic_header2[i]=0x00;
+
+    mic_header2[0] = mpdu[16];    /* A3 */
+    mic_header2[1] = mpdu[17];
+    mic_header2[2] = mpdu[18];
+    mic_header2[3] = mpdu[19];
+    mic_header2[4] = mpdu[20];
+    mic_header2[5] = mpdu[21];
+
+    //mic_header2[6] = mpdu[22] & 0xf0;   /* SC */
+    mic_header2[6] = 0x00;
+    mic_header2[7] = 0x00; /* mpdu[23]; */
+
+
+    if (!qc_exists && a4_exists)
+    {
+        for (i=0;i<6;i++) mic_header2[8+i] = mpdu[24+i];   /* A4 */
+
+    }
+
+    if (qc_exists && !a4_exists)
+    {
+        mic_header2[8] = mpdu[24] & 0x0f; /* mute bits 15 - 4 */
+        mic_header2[9] = mpdu[25] & 0x00;
+    }
+
+    if (qc_exists && a4_exists)
+    {
+        for (i=0;i<6;i++) mic_header2[8+i] = mpdu[24+i];   /* A4 */
+
+        mic_header2[14] = mpdu[30] & 0x0f;
+        mic_header2[15] = mpdu[31] & 0x00;
+    }
+
+_func_exit_;
+}
+
+
+/************************************************/
+/* construct_mic_header2()                      */
+/* Builds the last MIC header block from        */
+/* header fields.                               */
+/* Baron think the function is construct CCM    */
+/* nonce                                        */
+/************************************************/
+static void construct_ctr_preload(
+                        u8 *ctr_preload,
+                        sint a4_exists,
+                        sint qc_exists,
+                        u8 *mpdu,
+                        u8 *pn_vector,
+                        sint c,
+                        uint frtype // add for CONFIG_IEEE80211W, none 11w also can use
+                        )
+{
+    sint i = 0;
+_func_enter_;
+    for (i=0; i<16; i++) ctr_preload[i] = 0x00;
+    i = 0;
+
+    ctr_preload[0] = 0x01;                                  /* flag */
+    if (qc_exists && a4_exists)
+		ctr_preload[1] = mpdu[30] & 0x0f;   /* QoC_Control */
+    if (qc_exists && !a4_exists)
+		ctr_preload[1] = mpdu[24] & 0x0f;
+#ifdef CONFIG_IEEE80211W
+	//802.11w management frame should set management bit(4)
+	if(frtype == WIFI_MGT_TYPE)
+		ctr_preload[1] |= BIT(4);
+#endif //CONFIG_IEEE80211W
+    for (i = 2; i < 8; i++)
+        ctr_preload[i] = mpdu[i + 8];                       /* ctr_preload[2:7] = A2[0:5] = mpdu[10:15] */
+    #ifdef CONSISTENT_PN_ORDER
+      for (i = 8; i < 14; i++)
+            ctr_preload[i] =    pn_vector[i - 8];           /* ctr_preload[8:13] = PN[0:5] */
+    #else
+      for (i = 8; i < 14; i++)
+            ctr_preload[i] =    pn_vector[13 - i];          /* ctr_preload[8:13] = PN[5:0] */
+    #endif
+    ctr_preload[14] =  (unsigned char) (c / 256); /* Ctr */
+    ctr_preload[15] =  (unsigned char) (c % 256);
+_func_exit_;
+}
+
+
+/************************************/
+/* bitwise_xor()                    */
+/* A 128 bit, bitwise exclusive or  */
+/************************************/
+static void bitwise_xor(u8 *ina, u8 *inb, u8 *out)
+{
+    sint i;
+_func_enter_;
+    for (i=0; i<16; i++)
+    {
+        out[i] = ina[i] ^ inb[i];
+    }
+_func_exit_;
+}
+
+
+static sint aes_cipher(u8 *key, uint	hdrlen,
+			u8 *pframe, uint plen)
+{
+//	/*static*/ unsigned char	message[MAX_MSG_SIZE];
+	uint	qc_exists, a4_exists, i, j, payload_remainder,
+		num_blocks, payload_index;
+
+	u8 pn_vector[6];
+	u8 mic_iv[16];
+	u8 mic_header1[16];
+	u8 mic_header2[16];
+	u8 ctr_preload[16];
+
+	/* Intermediate Buffers */
+	u8 chain_buffer[16];
+	u8 aes_out[16];
+	u8 padded_buffer[16];
+	u8 mic[8];
+//	uint	offset = 0;
+	uint	frtype  = GetFrameType(pframe);
+	uint	frsubtype  = GetFrameSubType(pframe);
+
+_func_enter_;
+	frsubtype=frsubtype>>4;
+
+
+	_rtw_memset((void *)mic_iv, 0, 16);
+	_rtw_memset((void *)mic_header1, 0, 16);
+	_rtw_memset((void *)mic_header2, 0, 16);
+	_rtw_memset((void *)ctr_preload, 0, 16);
+	_rtw_memset((void *)chain_buffer, 0, 16);
+	_rtw_memset((void *)aes_out, 0, 16);
+	_rtw_memset((void *)padded_buffer, 0, 16);
+
+	if ((hdrlen == WLAN_HDR_A3_LEN )||(hdrlen ==  WLAN_HDR_A3_QOS_LEN))
+		a4_exists = 0;
+	else
+		a4_exists = 1;
+
+	if (
+		((frtype|frsubtype) == WIFI_DATA_CFACK) ||
+		((frtype|frsubtype) == WIFI_DATA_CFPOLL)||
+		((frtype|frsubtype) == WIFI_DATA_CFACKPOLL))
+		{
+			qc_exists = 1;
+					if(hdrlen !=  WLAN_HDR_A3_QOS_LEN){
+
+					hdrlen += 2;
+			}
+		}
+	// add for CONFIG_IEEE80211W, none 11w also can use
+	else if ((frtype == WIFI_DATA) &&
+		((frsubtype == 0x08) ||
+		(frsubtype == 0x09)||
+		(frsubtype == 0x0a)||
+		(frsubtype == 0x0b)))
+		{
+			if(hdrlen !=  WLAN_HDR_A3_QOS_LEN){
+
+					hdrlen += 2;
+			}
+			qc_exists = 1;
+		}
+	else
+		qc_exists = 0;
+
+	pn_vector[0]=pframe[hdrlen];
+	pn_vector[1]=pframe[hdrlen+1];
+	pn_vector[2]=pframe[hdrlen+4];
+	pn_vector[3]=pframe[hdrlen+5];
+	pn_vector[4]=pframe[hdrlen+6];
+	pn_vector[5]=pframe[hdrlen+7];
+
+	construct_mic_iv(
+                        mic_iv,
+                        qc_exists,
+                        a4_exists,
+                        pframe,	 //message,
+                        plen,
+                        pn_vector,
+                        frtype // add for CONFIG_IEEE80211W, none 11w also can use
+                        );
+
+    construct_mic_header1(
+                            mic_header1,
+                            hdrlen,
+                            pframe,	//message
+                            frtype // add for CONFIG_IEEE80211W, none 11w also can use
+                            );
+    construct_mic_header2(
+                            mic_header2,
+                            pframe,	//message,
+                            a4_exists,
+                            qc_exists
+                            );
+
+
+	payload_remainder = plen % 16;
+    num_blocks = plen / 16;
+
+    /* Find start of payload */
+    payload_index = (hdrlen + 8);
+
+    /* Calculate MIC */
+    aes128k128d(key, mic_iv, aes_out);
+    bitwise_xor(aes_out, mic_header1, chain_buffer);
+    aes128k128d(key, chain_buffer, aes_out);
+    bitwise_xor(aes_out, mic_header2, chain_buffer);
+    aes128k128d(key, chain_buffer, aes_out);
+
+    for (i = 0; i < num_blocks; i++)
+    {
+        bitwise_xor(aes_out, &pframe[payload_index], chain_buffer);//bitwise_xor(aes_out, &message[payload_index], chain_buffer);
+
+        payload_index += 16;
+        aes128k128d(key, chain_buffer, aes_out);
+    }
+
+    /* Add on the final payload block if it needs padding */
+    if (payload_remainder > 0)
+    {
+        for (j = 0; j < 16; j++) padded_buffer[j] = 0x00;
+        for (j = 0; j < payload_remainder; j++)
+        {
+            padded_buffer[j] = pframe[payload_index++];//padded_buffer[j] = message[payload_index++];
+        }
+        bitwise_xor(aes_out, padded_buffer, chain_buffer);
+        aes128k128d(key, chain_buffer, aes_out);
+
+    }
+
+    for (j = 0 ; j < 8; j++) mic[j] = aes_out[j];
+
+    /* Insert MIC into payload */
+    for (j = 0; j < 8; j++)
+	pframe[payload_index+j] = mic[j];	//message[payload_index+j] = mic[j];
+
+    payload_index = hdrlen + 8;
+    for (i=0; i< num_blocks; i++)
+    {
+        construct_ctr_preload(
+                                ctr_preload,
+                                a4_exists,
+                                qc_exists,
+                                pframe,	//message,
+                                pn_vector,
+                                i+1,
+                                frtype); // add for CONFIG_IEEE80211W, none 11w also can use
+        aes128k128d(key, ctr_preload, aes_out);
+        bitwise_xor(aes_out, &pframe[payload_index], chain_buffer);//bitwise_xor(aes_out, &message[payload_index], chain_buffer);
+        for (j=0; j<16;j++) pframe[payload_index++] = chain_buffer[j];//for (j=0; j<16;j++) message[payload_index++] = chain_buffer[j];
+    }
+
+    if (payload_remainder > 0)          /* If there is a short final block, then pad it,*/
+    {                                   /* encrypt it and copy the unpadded part back   */
+        construct_ctr_preload(
+                                ctr_preload,
+                                a4_exists,
+                                qc_exists,
+                                pframe,	//message,
+                                pn_vector,
+                                num_blocks+1,
+                                frtype); // add for CONFIG_IEEE80211W, none 11w also can use
+
+        for (j = 0; j < 16; j++) padded_buffer[j] = 0x00;
+        for (j = 0; j < payload_remainder; j++)
+        {
+            padded_buffer[j] = pframe[payload_index+j];//padded_buffer[j] = message[payload_index+j];
+        }
+        aes128k128d(key, ctr_preload, aes_out);
+        bitwise_xor(aes_out, padded_buffer, chain_buffer);
+        for (j=0; j<payload_remainder;j++) pframe[payload_index++] = chain_buffer[j];//for (j=0; j<payload_remainder;j++) message[payload_index++] = chain_buffer[j];
+    }
+
+    /* Encrypt the MIC */
+    construct_ctr_preload(
+                        ctr_preload,
+                        a4_exists,
+                        qc_exists,
+                        pframe,	//message,
+                        pn_vector,
+                        0,
+                        frtype); // add for CONFIG_IEEE80211W, none 11w also can use
+
+    for (j = 0; j < 16; j++) padded_buffer[j] = 0x00;
+    for (j = 0; j < 8; j++)
+    {
+        padded_buffer[j] = pframe[j+hdrlen+8+plen];//padded_buffer[j] = message[j+hdrlen+8+plen];
+    }
+
+    aes128k128d(key, ctr_preload, aes_out);
+    bitwise_xor(aes_out, padded_buffer, chain_buffer);
+    for (j=0; j<8;j++) pframe[payload_index++] = chain_buffer[j];//for (j=0; j<8;j++) message[payload_index++] = chain_buffer[j];
+_func_exit_;
+	return _SUCCESS;
+}
+
+
+
+
+u32	rtw_aes_encrypt(_adapter *padapter, u8 *pxmitframe)
+{	// exclude ICV
+
+
+	/*static*/
+//	unsigned char	message[MAX_MSG_SIZE];
+
+	/* Intermediate Buffers */
+	sint 	curfragnum,length;
+	u32	prwskeylen;
+	u8	*pframe,*prwskey;	//, *payload,*iv
+	struct	sta_info		*stainfo=NULL;
+	struct	pkt_attrib	 *pattrib = &((struct xmit_frame *)pxmitframe)->attrib;
+	struct 	security_priv	*psecuritypriv=&padapter->securitypriv;
+	struct	xmit_priv		*pxmitpriv=&padapter->xmitpriv;
+
+//	uint	offset = 0;
+	u32 res=_SUCCESS;
+_func_enter_;
+
+	if(((struct xmit_frame*)pxmitframe)->buf_addr==NULL)
+		return _FAIL;
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+	pframe = ((struct xmit_frame*)pxmitframe)->buf_addr + TXDESC_SIZE +
+		 (((struct xmit_frame*)pxmitframe)->pkt_offset * PACKET_OFFSET_SZ);
+#else
+	pframe = ((struct xmit_frame*)pxmitframe)->buf_addr + TXDESC_OFFSET;
+#endif
+
+	//4 start to encrypt each fragment
+	if((pattrib->encrypt==_AES_)){
+
+		if(pattrib->psta)
+		{
+			stainfo = pattrib->psta;
+		}
+		else
+		{
+			DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+			stainfo=rtw_get_stainfo(&padapter->stapriv ,&pattrib->ra[0] );
+		}
+
+		if (stainfo!=NULL){
+
+			if(!(stainfo->state &_FW_LINKED))
+			{
+				DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, stainfo->state);
+				return _FAIL;
+			}
+
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_aes_encrypt: stainfo!=NULL!!!\n"));
+
+			if(IS_MCAST(pattrib->ra))
+			{
+				prwskey=psecuritypriv->dot118021XGrpKey[psecuritypriv->dot118021XGrpKeyid].skey;
+			}
+			else
+			{
+				prwskey=&stainfo->dot118021x_UncstKey.skey[0];
+			}
+
+#ifdef CONFIG_TDLS	//swencryption
+			{
+				struct	sta_info		*ptdls_sta;
+				ptdls_sta=rtw_get_stainfo(&padapter->stapriv ,&pattrib->dst[0] );
+				if((ptdls_sta != NULL) && (ptdls_sta->tdls_sta_state & TDLS_LINKED_STATE) )
+				{
+					DBG_871X("[%s] for tdls link\n", __FUNCTION__);
+					prwskey=&ptdls_sta->tpk.tk[0];
+				}
+			}
+#endif //CONFIG_TDLS
+
+			prwskeylen=16;
+
+			for(curfragnum=0;curfragnum<pattrib->nr_frags;curfragnum++){
+
+				if((curfragnum+1)==pattrib->nr_frags){	//4 the last fragment
+					length=pattrib->last_txcmdsz-pattrib->hdrlen-pattrib->iv_len- pattrib->icv_len;
+
+					aes_cipher(prwskey,pattrib->hdrlen,pframe, length);
+				}
+				else{
+					length=pxmitpriv->frag_len-pattrib->hdrlen-pattrib->iv_len-pattrib->icv_len ;
+
+					aes_cipher(prwskey,pattrib->hdrlen,pframe, length);
+				pframe+=pxmitpriv->frag_len;
+				pframe=(u8*)RND4((SIZE_PTR)(pframe));
+
+				}
+			}
+
+
+		}
+		else{
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_aes_encrypt: stainfo==NULL!!!\n"));
+                        DBG_871X("%s, psta==NUL\n", __func__);
+			res=_FAIL;
+		}
+
+	}
+
+
+
+_func_exit_;
+		return res;
+}
+
+static sint aes_decipher(u8 *key, uint	hdrlen,
+			u8 *pframe, uint plen)
+{
+	static u8	message[MAX_MSG_SIZE];
+	uint	qc_exists, a4_exists, i, j, payload_remainder,
+			num_blocks, payload_index;
+	sint res = _SUCCESS;
+	u8 pn_vector[6];
+	u8 mic_iv[16];
+	u8 mic_header1[16];
+	u8 mic_header2[16];
+	u8 ctr_preload[16];
+
+    /* Intermediate Buffers */
+	u8 chain_buffer[16];
+	u8 aes_out[16];
+	u8 padded_buffer[16];
+	u8 mic[8];
+
+
+//	uint	offset = 0;
+	uint	frtype  = GetFrameType(pframe);
+	uint	frsubtype  = GetFrameSubType(pframe);
+_func_enter_;
+	frsubtype=frsubtype>>4;
+
+
+	_rtw_memset((void *)mic_iv, 0, 16);
+	_rtw_memset((void *)mic_header1, 0, 16);
+	_rtw_memset((void *)mic_header2, 0, 16);
+	_rtw_memset((void *)ctr_preload, 0, 16);
+	_rtw_memset((void *)chain_buffer, 0, 16);
+	_rtw_memset((void *)aes_out, 0, 16);
+	_rtw_memset((void *)padded_buffer, 0, 16);
+
+	//start to decrypt the payload
+
+	num_blocks = (plen-8) / 16; //(plen including LLC, payload_length and mic )
+
+	payload_remainder = (plen-8) % 16;
+
+	pn_vector[0]  = pframe[hdrlen];
+	pn_vector[1]  = pframe[hdrlen+1];
+	pn_vector[2]  = pframe[hdrlen+4];
+	pn_vector[3]  = pframe[hdrlen+5];
+	pn_vector[4]  = pframe[hdrlen+6];
+	pn_vector[5]  = pframe[hdrlen+7];
+
+	if ((hdrlen == WLAN_HDR_A3_LEN )||(hdrlen ==  WLAN_HDR_A3_QOS_LEN))
+		a4_exists = 0;
+	else
+		a4_exists = 1;
+
+	if (
+		((frtype|frsubtype) == WIFI_DATA_CFACK) ||
+		((frtype|frsubtype) == WIFI_DATA_CFPOLL)||
+		((frtype|frsubtype) == WIFI_DATA_CFACKPOLL))
+		{
+			qc_exists = 1;
+					if(hdrlen !=  WLAN_HDR_A3_QOS_LEN){
+
+					hdrlen += 2;
+			}
+		}//only for data packet . add for CONFIG_IEEE80211W, none 11w also can use
+	else if ((frtype == WIFI_DATA) &&
+		((frsubtype == 0x08) ||
+		(frsubtype == 0x09)||
+		(frsubtype == 0x0a)||
+		(frsubtype == 0x0b)))
+		{
+			if(hdrlen !=  WLAN_HDR_A3_QOS_LEN){
+
+					hdrlen += 2;
+			}
+			qc_exists = 1;
+		}
+	else
+		qc_exists = 0;
+
+
+	// now, decrypt pframe with hdrlen offset and plen long
+
+	payload_index = hdrlen + 8; // 8 is for extiv
+
+	for (i=0; i< num_blocks; i++)
+    {
+        construct_ctr_preload(
+                                ctr_preload,
+                                a4_exists,
+                                qc_exists,
+                                pframe,
+                                pn_vector,
+                                i+1,
+                                frtype // add for CONFIG_IEEE80211W, none 11w also can use
+                            );
+
+        aes128k128d(key, ctr_preload, aes_out);
+        bitwise_xor(aes_out, &pframe[payload_index], chain_buffer);
+
+        for (j=0; j<16;j++) pframe[payload_index++] = chain_buffer[j];
+    }
+
+    if (payload_remainder > 0)          /* If there is a short final block, then pad it,*/
+    {                                   /* encrypt it and copy the unpadded part back   */
+        construct_ctr_preload(
+                                ctr_preload,
+                                a4_exists,
+                                qc_exists,
+                                pframe,
+                                pn_vector,
+                                num_blocks+1,
+                                frtype // add for CONFIG_IEEE80211W, none 11w also can use
+                            );
+
+        for (j = 0; j < 16; j++) padded_buffer[j] = 0x00;
+        for (j = 0; j < payload_remainder; j++)
+        {
+            padded_buffer[j] = pframe[payload_index+j];
+        }
+        aes128k128d(key, ctr_preload, aes_out);
+        bitwise_xor(aes_out, padded_buffer, chain_buffer);
+        for (j=0; j<payload_remainder;j++) pframe[payload_index++] = chain_buffer[j];
+    }
+
+	//start to calculate the mic
+
+	_rtw_memcpy((void *)message, pframe, (hdrlen +plen+8)); //8 is for ext iv len
+
+
+	pn_vector[0]=pframe[hdrlen];
+	pn_vector[1]=pframe[hdrlen+1];
+	pn_vector[2]=pframe[hdrlen+4];
+	pn_vector[3]=pframe[hdrlen+5];
+	pn_vector[4]=pframe[hdrlen+6];
+	pn_vector[5]=pframe[hdrlen+7];
+
+
+
+	construct_mic_iv(
+                        mic_iv,
+                        qc_exists,
+                        a4_exists,
+                        message,
+                        plen-8,
+                        pn_vector,
+                        frtype // add for CONFIG_IEEE80211W, none 11w also can use
+                        );
+
+    construct_mic_header1(
+                            mic_header1,
+                            hdrlen,
+                            message,
+                            frtype // add for CONFIG_IEEE80211W, none 11w also can use
+                            );
+    construct_mic_header2(
+                            mic_header2,
+                            message,
+                            a4_exists,
+                            qc_exists
+                            );
+
+
+	payload_remainder = (plen-8) % 16;
+    num_blocks = (plen-8) / 16;
+
+    /* Find start of payload */
+    payload_index = (hdrlen + 8);
+
+    /* Calculate MIC */
+    aes128k128d(key, mic_iv, aes_out);
+    bitwise_xor(aes_out, mic_header1, chain_buffer);
+    aes128k128d(key, chain_buffer, aes_out);
+    bitwise_xor(aes_out, mic_header2, chain_buffer);
+    aes128k128d(key, chain_buffer, aes_out);
+
+	for (i = 0; i < num_blocks; i++)
+    {
+        bitwise_xor(aes_out, &message[payload_index], chain_buffer);
+
+        payload_index += 16;
+        aes128k128d(key, chain_buffer, aes_out);
+    }
+
+    /* Add on the final payload block if it needs padding */
+    if (payload_remainder > 0)
+    {
+        for (j = 0; j < 16; j++) padded_buffer[j] = 0x00;
+        for (j = 0; j < payload_remainder; j++)
+        {
+            padded_buffer[j] = message[payload_index++];
+        }
+        bitwise_xor(aes_out, padded_buffer, chain_buffer);
+        aes128k128d(key, chain_buffer, aes_out);
+
+    }
+
+    for (j = 0 ; j < 8; j++) mic[j] = aes_out[j];
+
+    /* Insert MIC into payload */
+    for (j = 0; j < 8; j++)
+	message[payload_index+j] = mic[j];
+
+    payload_index = hdrlen + 8;
+    for (i=0; i< num_blocks; i++)
+    {
+        construct_ctr_preload(
+                                ctr_preload,
+                                a4_exists,
+                                qc_exists,
+                                message,
+                                pn_vector,
+                                i+1,
+                                frtype); // add for CONFIG_IEEE80211W, none 11w also can use
+        aes128k128d(key, ctr_preload, aes_out);
+        bitwise_xor(aes_out, &message[payload_index], chain_buffer);
+        for (j=0; j<16;j++) message[payload_index++] = chain_buffer[j];
+    }
+
+    if (payload_remainder > 0)          /* If there is a short final block, then pad it,*/
+    {                                   /* encrypt it and copy the unpadded part back   */
+        construct_ctr_preload(
+                                ctr_preload,
+                                a4_exists,
+                                qc_exists,
+                                message,
+                                pn_vector,
+                                num_blocks+1,
+                                frtype); // add for CONFIG_IEEE80211W, none 11w also can use
+
+        for (j = 0; j < 16; j++) padded_buffer[j] = 0x00;
+        for (j = 0; j < payload_remainder; j++)
+        {
+            padded_buffer[j] = message[payload_index+j];
+        }
+        aes128k128d(key, ctr_preload, aes_out);
+        bitwise_xor(aes_out, padded_buffer, chain_buffer);
+        for (j=0; j<payload_remainder;j++) message[payload_index++] = chain_buffer[j];
+    }
+
+    /* Encrypt the MIC */
+    construct_ctr_preload(
+                        ctr_preload,
+                        a4_exists,
+                        qc_exists,
+                        message,
+                        pn_vector,
+                        0,
+                        frtype); // add for CONFIG_IEEE80211W, none 11w also can use
+
+    for (j = 0; j < 16; j++) padded_buffer[j] = 0x00;
+    for (j = 0; j < 8; j++)
+    {
+        padded_buffer[j] = message[j+hdrlen+8+plen-8];
+    }
+
+    aes128k128d(key, ctr_preload, aes_out);
+    bitwise_xor(aes_out, padded_buffer, chain_buffer);
+    for (j=0; j<8;j++) message[payload_index++] = chain_buffer[j];
+
+	//compare the mic
+	for(i=0;i<8;i++){
+		if(pframe[hdrlen+8+plen-8+i] != message[hdrlen+8+plen-8+i])
+		{
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("aes_decipher:mic check error mic[%d]: pframe(%x) != message(%x) \n",
+						i,pframe[hdrlen+8+plen-8+i],message[hdrlen+8+plen-8+i]));
+			DBG_871X("aes_decipher:mic check error mic[%d]: pframe(%x) != message(%x) \n",
+						i,pframe[hdrlen+8+plen-8+i],message[hdrlen+8+plen-8+i]);
+			res = _FAIL;
+		}
+	}
+
+	if(res == _FAIL)
+	{
+		int gg=0;
+		for(gg=0; gg < 32; gg++)
+			DBG_871X(" [%d]=%02x ", gg, pframe[gg]);
+		DBG_871X("error packet header \n");
+	}
+
+_func_exit_;
+	return res;
+}
+
+u32	rtw_aes_decrypt(_adapter *padapter, u8 *precvframe)
+{	// exclude ICV
+
+
+	/*static*/
+//	unsigned char	message[MAX_MSG_SIZE];
+
+
+	/* Intermediate Buffers */
+
+
+	sint 		length;
+	u8	*pframe,*prwskey;	//, *payload,*iv
+	struct	sta_info		*stainfo;
+	struct	rx_pkt_attrib	 *prxattrib = &((union recv_frame *)precvframe)->u.hdr.attrib;
+	struct 	security_priv	*psecuritypriv=&padapter->securitypriv;
+//	struct	recv_priv		*precvpriv=&padapter->recvpriv;
+	u32	res=_SUCCESS;
+_func_enter_;
+	pframe=(unsigned char *)((union recv_frame*)precvframe)->u.hdr.rx_data;
+	//4 start to encrypt each fragment
+	if((prxattrib->encrypt==_AES_)){
+
+		stainfo=rtw_get_stainfo(&padapter->stapriv ,&prxattrib->ta[0] );
+		if (stainfo!=NULL){
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_aes_decrypt: stainfo!=NULL!!!\n"));
+
+			if(IS_MCAST(prxattrib->ra))
+			{
+				//in concurrent we should use sw descrypt in group key, so we remove this message
+				//DBG_871X("rx bc/mc packets, to perform sw rtw_aes_decrypt\n");
+				//prwskey = psecuritypriv->dot118021XGrpKey[psecuritypriv->dot118021XGrpKeyid].skey;
+				if(psecuritypriv->binstallGrpkey==_FALSE)
+				{
+					res=_FAIL;
+					DBG_8192C("%s:rx bc/mc packets,but didn't install group key!!!!!!!!!!\n",__FUNCTION__);
+					goto exit;
+				}
+				prwskey = psecuritypriv->dot118021XGrpKey[prxattrib->key_index].skey;
+
+				if(psecuritypriv->dot118021XGrpKeyid != prxattrib->key_index)
+				{
+					DBG_871X("not match packet_index=%d, install_index=%d \n"
+					, prxattrib->key_index, psecuritypriv->dot118021XGrpKeyid);
+					res=_FAIL;
+					goto exit;
+				}
+			}
+			else
+			{
+				prwskey=&stainfo->dot118021x_UncstKey.skey[0];
+			}
+
+			length= ((union recv_frame *)precvframe)->u.hdr.len-prxattrib->hdrlen-prxattrib->iv_len;
+			/*// add for CONFIG_IEEE80211W, debug
+			if(0)
+			printk("@@@@@@@@@@@@@@@@@@ length=%d, prxattrib->hdrlen=%d, prxattrib->pkt_len=%d \n"
+			, length, prxattrib->hdrlen, prxattrib->pkt_len);
+			if(0)
+			{
+				int no;
+				//test print PSK
+				printk("PSK key below:\n");
+				for(no=0;no<16;no++)
+					printk(" %02x ", prwskey[no]);
+				printk("\n");
+			}
+			if(0)
+			{
+				int no;
+				//test print PSK
+				printk("frame:\n");
+				for(no=0;no<prxattrib->pkt_len;no++)
+					printk(" %02x ", pframe[no]);
+				printk("\n");
+			}*/
+
+			res= aes_decipher(prwskey,prxattrib->hdrlen,pframe, length);
+		}
+		else{
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("rtw_aes_encrypt: stainfo==NULL!!!\n"));
+			res=_FAIL;
+		}
+
+	}
+_func_exit_;
+exit:
+	return res;
+}
+
+#ifdef CONFIG_IEEE80211W
+u32	rtw_BIP_verify(_adapter *padapter, u8 *precvframe)
+{
+	struct rx_pkt_attrib *pattrib = &((union recv_frame *)precvframe)->u.hdr.attrib;
+	u8 *pframe;
+	u8 *BIP_AAD, *p;
+	u32	res=_FAIL;
+	uint len, ori_len;
+	struct rtw_ieee80211_hdr *pwlanhdr;
+	u8 mic[16];
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	ori_len = pattrib->pkt_len-WLAN_HDR_A3_LEN+BIP_AAD_SIZE;
+	BIP_AAD = rtw_zmalloc(ori_len);
+
+	if(BIP_AAD == NULL)
+	{
+		DBG_871X("BIP AAD allocate fail\n");
+		return _FAIL;
+	}
+	//PKT start
+	pframe=(unsigned char *)((union recv_frame*)precvframe)->u.hdr.rx_data;
+	//mapping to wlan header
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+	//save the frame body + MME
+	_rtw_memcpy(BIP_AAD+BIP_AAD_SIZE, pframe+WLAN_HDR_A3_LEN, pattrib->pkt_len-WLAN_HDR_A3_LEN);
+	//find MME IE pointer
+	p = rtw_get_ie(BIP_AAD+BIP_AAD_SIZE, _MME_IE_, &len, pattrib->pkt_len-WLAN_HDR_A3_LEN);
+	//Baron
+	if(p)
+	{
+		u16 keyid=0;
+		u64 temp_ipn=0;
+		//save packet number
+		_rtw_memcpy(&temp_ipn, p+4, 6);
+		temp_ipn = le64_to_cpu(temp_ipn);
+		//BIP packet number should bigger than previous BIP packet
+		if(temp_ipn <= pmlmeext->mgnt_80211w_IPN_rx)
+		{
+			DBG_871X("replay BIP packet\n");
+			goto BIP_exit;
+		}
+		//copy key index
+		_rtw_memcpy(&keyid, p+2, 2);
+		keyid = le16_to_cpu(keyid);
+		if(keyid != padapter->securitypriv.dot11wBIPKeyid)
+		{
+			DBG_871X("BIP key index error!\n");
+			goto BIP_exit;
+		}
+		//clear the MIC field of MME to zero
+		_rtw_memset(p+2+len-8, 0, 8);
+
+		//conscruct AAD, copy frame control field
+		_rtw_memcpy(BIP_AAD, &pwlanhdr->frame_ctl, 2);
+		ClearRetry(BIP_AAD);
+		ClearPwrMgt(BIP_AAD);
+		ClearMData(BIP_AAD);
+		//conscruct AAD, copy address 1 to address 3
+		_rtw_memcpy(BIP_AAD+2, pwlanhdr->addr1, 18);
+
+		if(omac1_aes_128(padapter->securitypriv.dot11wBIPKey[padapter->securitypriv.dot11wBIPKeyid].skey
+			, BIP_AAD, ori_len, mic))
+			goto BIP_exit;
+
+		/*//management packet content
+		{
+			int pp;
+			DBG_871X("pkt: ");
+			for(pp=0;pp< pattrib->pkt_len; pp++)
+				printk(" %02x ", pframe[pp]);
+			DBG_871X("\n");
+			//BIP AAD + management frame body + MME(MIC is zero)
+			DBG_871X("AAD+PKT: ");
+			for(pp=0;pp< ori_len; pp++)
+				DBG_871X(" %02x ", BIP_AAD[pp]);
+			DBG_871X("\n");
+			//show the MIC result
+			DBG_871X("mic: ");
+			for(pp=0;pp<16; pp++)
+				DBG_871X(" %02x ", mic[pp]);
+			DBG_871X("\n");
+		}
+		*/
+		//MIC field should be last 8 bytes of packet (packet without FCS)
+		if(_rtw_memcmp(mic, pframe+pattrib->pkt_len-8, 8))
+		{
+			pmlmeext->mgnt_80211w_IPN_rx = temp_ipn;
+			res=_SUCCESS;
+		}
+		else
+			DBG_871X("BIP MIC error!\n");
+
+	}
+	else
+		res = RTW_RX_HANDLED;
+BIP_exit:
+
+	rtw_mfree(BIP_AAD, ori_len);
+	return res;
+}
+#endif //CONFIG_IEEE80211W
+
+#ifndef PLATFORM_FREEBSD
+/* compress 512-bits */
+static int sha256_compress(struct sha256_state *md, unsigned char *buf)
+{
+	u32 S[8], W[64], t0, t1;
+	u32 t;
+	int i;
+
+	/* copy state into S */
+	for (i = 0; i < 8; i++) {
+		S[i] = md->state[i];
+	}
+
+	/* copy the state into 512-bits into W[0..15] */
+	for (i = 0; i < 16; i++)
+		W[i] = WPA_GET_BE32(buf + (4 * i));
+
+	/* fill W[16..63] */
+	for (i = 16; i < 64; i++) {
+		W[i] = Gamma1(W[i - 2]) + W[i - 7] + Gamma0(W[i - 15]) +
+			W[i - 16];
+	}
+
+	/* Compress */
+#define RND(a,b,c,d,e,f,g,h,i)                          \
+	t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i];	\
+	t1 = Sigma0(a) + Maj(a, b, c);			\
+	d += t0;					\
+	h  = t0 + t1;
+
+	for (i = 0; i < 64; ++i) {
+		RND(S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7], i);
+		t = S[7]; S[7] = S[6]; S[6] = S[5]; S[5] = S[4];
+		S[4] = S[3]; S[3] = S[2]; S[2] = S[1]; S[1] = S[0]; S[0] = t;
+	}
+
+	/* feedback */
+	for (i = 0; i < 8; i++) {
+		md->state[i] = md->state[i] + S[i];
+	}
+	return 0;
+}
+
+/* Initialize the hash state */
+static void sha256_init(struct sha256_state *md)
+{
+	md->curlen = 0;
+	md->length = 0;
+	md->state[0] = 0x6A09E667UL;
+	md->state[1] = 0xBB67AE85UL;
+	md->state[2] = 0x3C6EF372UL;
+	md->state[3] = 0xA54FF53AUL;
+	md->state[4] = 0x510E527FUL;
+	md->state[5] = 0x9B05688CUL;
+	md->state[6] = 0x1F83D9ABUL;
+	md->state[7] = 0x5BE0CD19UL;
+}
+
+/**
+   Process a block of memory though the hash
+   @param md     The hash state
+   @param in     The data to hash
+   @param inlen  The length of the data (octets)
+   @return CRYPT_OK if successful
+*/
+static int sha256_process(struct sha256_state *md, unsigned char *in,
+			  unsigned long inlen)
+{
+	unsigned long n;
+#define block_size 64
+
+	if (md->curlen > sizeof(md->buf))
+		return -1;
+
+	while (inlen > 0) {
+		if (md->curlen == 0 && inlen >= block_size) {
+			if (sha256_compress(md, (unsigned char *) in) < 0)
+				return -1;
+			md->length += block_size * 8;
+			in += block_size;
+			inlen -= block_size;
+		} else {
+			n = MIN(inlen, (block_size - md->curlen));
+			_rtw_memcpy(md->buf + md->curlen, in, n);
+			md->curlen += n;
+			in += n;
+			inlen -= n;
+			if (md->curlen == block_size) {
+				if (sha256_compress(md, md->buf) < 0)
+					return -1;
+				md->length += 8 * block_size;
+				md->curlen = 0;
+			}
+		}
+	}
+
+	return 0;
+}
+
+
+/**
+   Terminate the hash to get the digest
+   @param md  The hash state
+   @param out [out] The destination of the hash (32 bytes)
+   @return CRYPT_OK if successful
+*/
+static int sha256_done(struct sha256_state *md, unsigned char *out)
+{
+	int i;
+
+	if (md->curlen >= sizeof(md->buf))
+		return -1;
+
+	/* increase the length of the message */
+	md->length += md->curlen * 8;
+
+	/* append the '1' bit */
+	md->buf[md->curlen++] = (unsigned char) 0x80;
+
+	/* if the length is currently above 56 bytes we append zeros
+	 * then compress.  Then we can fall back to padding zeros and length
+	 * encoding like normal.
+	 */
+	if (md->curlen > 56) {
+		while (md->curlen < 64) {
+			md->buf[md->curlen++] = (unsigned char) 0;
+		}
+		sha256_compress(md, md->buf);
+		md->curlen = 0;
+	}
+
+	/* pad upto 56 bytes of zeroes */
+	while (md->curlen < 56) {
+		md->buf[md->curlen++] = (unsigned char) 0;
+	}
+
+	/* store length */
+	WPA_PUT_BE64(md->buf + 56, md->length);
+	sha256_compress(md, md->buf);
+
+	/* copy output */
+	for (i = 0; i < 8; i++)
+		WPA_PUT_BE32(out + (4 * i), md->state[i]);
+
+	return 0;
+}
+
+/**
+ * sha256_vector - SHA256 hash for data vector
+ * @num_elem: Number of elements in the data vector
+ * @addr: Pointers to the data areas
+ * @len: Lengths of the data blocks
+ * @mac: Buffer for the hash
+ * Returns: 0 on success, -1 of failure
+ */
+static int sha256_vector(size_t num_elem, u8 *addr[], size_t *len,
+		  u8 *mac)
+{
+	struct sha256_state ctx;
+	size_t i;
+
+	sha256_init(&ctx);
+	for (i = 0; i < num_elem; i++)
+		if (sha256_process(&ctx, addr[i], len[i]))
+			return -1;
+	if (sha256_done(&ctx, mac))
+		return -1;
+	return 0;
+}
+
+static u8 os_strlen(const char *s)
+{
+	const char *p = s;
+	while (*p)
+		p++;
+	return p - s;
+}
+
+static int os_memcmp(void *s1, void *s2, u8 n)
+{
+	unsigned char *p1 = s1, *p2 = s2;
+
+	if (n == 0)
+		return 0;
+
+	while (*p1 == *p2) {
+		p1++;
+		p2++;
+		n--;
+		if (n == 0)
+			return 0;
+	}
+
+	return *p1 - *p2;
+}
+
+/**
+ * hmac_sha256_vector - HMAC-SHA256 over data vector (RFC 2104)
+ * @key: Key for HMAC operations
+ * @key_len: Length of the key in bytes
+ * @num_elem: Number of elements in the data vector
+ * @addr: Pointers to the data areas
+ * @len: Lengths of the data blocks
+ * @mac: Buffer for the hash (32 bytes)
+ */
+static void hmac_sha256_vector(u8 *key, size_t key_len, size_t num_elem,
+			u8 *addr[], size_t *len, u8 *mac)
+{
+	unsigned char k_pad[64]; /* padding - key XORd with ipad/opad */
+	unsigned char tk[32];
+	u8 *_addr[6];
+	size_t _len[6], i;
+
+	if (num_elem > 5) {
+		/*
+		 * Fixed limit on the number of fragments to avoid having to
+		 * allocate memory (which could fail).
+		 */
+		return;
+	}
+
+        /* if key is longer than 64 bytes reset it to key = SHA256(key) */
+        if (key_len > 64) {
+		sha256_vector(1, &key, &key_len, tk);
+		key = tk;
+		key_len = 32;
+        }
+
+	/* the HMAC_SHA256 transform looks like:
+	 *
+	 * SHA256(K XOR opad, SHA256(K XOR ipad, text))
+	 *
+	 * where K is an n byte key
+	 * ipad is the byte 0x36 repeated 64 times
+	 * opad is the byte 0x5c repeated 64 times
+	 * and text is the data being protected */
+
+	/* start out by storing key in ipad */
+	_rtw_memset(k_pad, 0, sizeof(k_pad));
+	_rtw_memcpy(k_pad, key, key_len);
+	/* XOR key with ipad values */
+	for (i = 0; i < 64; i++)
+		k_pad[i] ^= 0x36;
+
+	/* perform inner SHA256 */
+	_addr[0] = k_pad;
+	_len[0] = 64;
+	for (i = 0; i < num_elem; i++) {
+		_addr[i + 1] = addr[i];
+		_len[i + 1] = len[i];
+	}
+	sha256_vector(1 + num_elem, _addr, _len, mac);
+
+	_rtw_memset(k_pad, 0, sizeof(k_pad));
+	_rtw_memcpy(k_pad, key, key_len);
+	/* XOR key with opad values */
+	for (i = 0; i < 64; i++)
+		k_pad[i] ^= 0x5c;
+
+	/* perform outer SHA256 */
+	_addr[0] = k_pad;
+	_len[0] = 64;
+	_addr[1] = mac;
+	_len[1] = 32;
+	sha256_vector(2, _addr, _len, mac);
+}
+#endif //PLATFORM_FREEBSD
+/**
+ * sha256_prf - SHA256-based Pseudo-Random Function (IEEE 802.11r, 8.5.1.5.2)
+ * @key: Key for PRF
+ * @key_len: Length of the key in bytes
+ * @label: A unique label for each purpose of the PRF
+ * @data: Extra data to bind into the key
+ * @data_len: Length of the data
+ * @buf: Buffer for the generated pseudo-random key
+ * @buf_len: Number of bytes of key to generate
+ *
+ * This function is used to derive new, cryptographically separate keys from a
+ * given key.
+ */
+#ifndef PLATFORM_FREEBSD //Baron
+static void sha256_prf(u8 *key, size_t key_len, char *label,
+		u8 *data, size_t data_len, u8 *buf, size_t buf_len)
+{
+	u16 counter = 1;
+	size_t pos, plen;
+	u8 hash[SHA256_MAC_LEN];
+	u8 *addr[4];
+	size_t len[4];
+	u8 counter_le[2], length_le[2];
+
+	addr[0] = counter_le;
+	len[0] = 2;
+	addr[1] = (u8 *) label;
+	len[1] = os_strlen(label);
+	addr[2] = data;
+	len[2] = data_len;
+	addr[3] = length_le;
+	len[3] = sizeof(length_le);
+
+	WPA_PUT_LE16(length_le, buf_len * 8);
+	pos = 0;
+	while (pos < buf_len) {
+		plen = buf_len - pos;
+		WPA_PUT_LE16(counter_le, counter);
+		if (plen >= SHA256_MAC_LEN) {
+			hmac_sha256_vector(key, key_len, 4, addr, len,
+					   &buf[pos]);
+			pos += SHA256_MAC_LEN;
+		} else {
+			hmac_sha256_vector(key, key_len, 4, addr, len, hash);
+			_rtw_memcpy(&buf[pos], hash, plen);
+			break;
+		}
+		counter++;
+	}
+}
+#endif //PLATFORM_FREEBSD Baron
+
+/* AES tables*/
+const u32 Te0[256] = {
+    0xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
+    0xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
+    0x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
+    0xe7fefe19U, 0xb5d7d762U, 0x4dababe6U, 0xec76769aU,
+    0x8fcaca45U, 0x1f82829dU, 0x89c9c940U, 0xfa7d7d87U,
+    0xeffafa15U, 0xb25959ebU, 0x8e4747c9U, 0xfbf0f00bU,
+    0x41adadecU, 0xb3d4d467U, 0x5fa2a2fdU, 0x45afafeaU,
+    0x239c9cbfU, 0x53a4a4f7U, 0xe4727296U, 0x9bc0c05bU,
+    0x75b7b7c2U, 0xe1fdfd1cU, 0x3d9393aeU, 0x4c26266aU,
+    0x6c36365aU, 0x7e3f3f41U, 0xf5f7f702U, 0x83cccc4fU,
+    0x6834345cU, 0x51a5a5f4U, 0xd1e5e534U, 0xf9f1f108U,
+    0xe2717193U, 0xabd8d873U, 0x62313153U, 0x2a15153fU,
+    0x0804040cU, 0x95c7c752U, 0x46232365U, 0x9dc3c35eU,
+    0x30181828U, 0x379696a1U, 0x0a05050fU, 0x2f9a9ab5U,
+    0x0e070709U, 0x24121236U, 0x1b80809bU, 0xdfe2e23dU,
+    0xcdebeb26U, 0x4e272769U, 0x7fb2b2cdU, 0xea75759fU,
+    0x1209091bU, 0x1d83839eU, 0x582c2c74U, 0x341a1a2eU,
+    0x361b1b2dU, 0xdc6e6eb2U, 0xb45a5aeeU, 0x5ba0a0fbU,
+    0xa45252f6U, 0x763b3b4dU, 0xb7d6d661U, 0x7db3b3ceU,
+    0x5229297bU, 0xdde3e33eU, 0x5e2f2f71U, 0x13848497U,
+    0xa65353f5U, 0xb9d1d168U, 0x00000000U, 0xc1eded2cU,
+    0x40202060U, 0xe3fcfc1fU, 0x79b1b1c8U, 0xb65b5bedU,
+    0xd46a6abeU, 0x8dcbcb46U, 0x67bebed9U, 0x7239394bU,
+    0x944a4adeU, 0x984c4cd4U, 0xb05858e8U, 0x85cfcf4aU,
+    0xbbd0d06bU, 0xc5efef2aU, 0x4faaaae5U, 0xedfbfb16U,
+    0x864343c5U, 0x9a4d4dd7U, 0x66333355U, 0x11858594U,
+    0x8a4545cfU, 0xe9f9f910U, 0x04020206U, 0xfe7f7f81U,
+    0xa05050f0U, 0x783c3c44U, 0x259f9fbaU, 0x4ba8a8e3U,
+    0xa25151f3U, 0x5da3a3feU, 0x804040c0U, 0x058f8f8aU,
+    0x3f9292adU, 0x219d9dbcU, 0x70383848U, 0xf1f5f504U,
+    0x63bcbcdfU, 0x77b6b6c1U, 0xafdada75U, 0x42212163U,
+    0x20101030U, 0xe5ffff1aU, 0xfdf3f30eU, 0xbfd2d26dU,
+    0x81cdcd4cU, 0x180c0c14U, 0x26131335U, 0xc3ecec2fU,
+    0xbe5f5fe1U, 0x359797a2U, 0x884444ccU, 0x2e171739U,
+    0x93c4c457U, 0x55a7a7f2U, 0xfc7e7e82U, 0x7a3d3d47U,
+    0xc86464acU, 0xba5d5de7U, 0x3219192bU, 0xe6737395U,
+    0xc06060a0U, 0x19818198U, 0x9e4f4fd1U, 0xa3dcdc7fU,
+    0x44222266U, 0x542a2a7eU, 0x3b9090abU, 0x0b888883U,
+    0x8c4646caU, 0xc7eeee29U, 0x6bb8b8d3U, 0x2814143cU,
+    0xa7dede79U, 0xbc5e5ee2U, 0x160b0b1dU, 0xaddbdb76U,
+    0xdbe0e03bU, 0x64323256U, 0x743a3a4eU, 0x140a0a1eU,
+    0x924949dbU, 0x0c06060aU, 0x4824246cU, 0xb85c5ce4U,
+    0x9fc2c25dU, 0xbdd3d36eU, 0x43acacefU, 0xc46262a6U,
+    0x399191a8U, 0x319595a4U, 0xd3e4e437U, 0xf279798bU,
+    0xd5e7e732U, 0x8bc8c843U, 0x6e373759U, 0xda6d6db7U,
+    0x018d8d8cU, 0xb1d5d564U, 0x9c4e4ed2U, 0x49a9a9e0U,
+    0xd86c6cb4U, 0xac5656faU, 0xf3f4f407U, 0xcfeaea25U,
+    0xca6565afU, 0xf47a7a8eU, 0x47aeaee9U, 0x10080818U,
+    0x6fbabad5U, 0xf0787888U, 0x4a25256fU, 0x5c2e2e72U,
+    0x381c1c24U, 0x57a6a6f1U, 0x73b4b4c7U, 0x97c6c651U,
+    0xcbe8e823U, 0xa1dddd7cU, 0xe874749cU, 0x3e1f1f21U,
+    0x964b4bddU, 0x61bdbddcU, 0x0d8b8b86U, 0x0f8a8a85U,
+    0xe0707090U, 0x7c3e3e42U, 0x71b5b5c4U, 0xcc6666aaU,
+    0x904848d8U, 0x06030305U, 0xf7f6f601U, 0x1c0e0e12U,
+    0xc26161a3U, 0x6a35355fU, 0xae5757f9U, 0x69b9b9d0U,
+    0x17868691U, 0x99c1c158U, 0x3a1d1d27U, 0x279e9eb9U,
+    0xd9e1e138U, 0xebf8f813U, 0x2b9898b3U, 0x22111133U,
+    0xd26969bbU, 0xa9d9d970U, 0x078e8e89U, 0x339494a7U,
+    0x2d9b9bb6U, 0x3c1e1e22U, 0x15878792U, 0xc9e9e920U,
+    0x87cece49U, 0xaa5555ffU, 0x50282878U, 0xa5dfdf7aU,
+    0x038c8c8fU, 0x59a1a1f8U, 0x09898980U, 0x1a0d0d17U,
+    0x65bfbfdaU, 0xd7e6e631U, 0x844242c6U, 0xd06868b8U,
+    0x824141c3U, 0x299999b0U, 0x5a2d2d77U, 0x1e0f0f11U,
+    0x7bb0b0cbU, 0xa85454fcU, 0x6dbbbbd6U, 0x2c16163aU,
+};
+const u32 Td0[256] = {
+    0x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
+    0x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
+    0x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
+    0x4fe5d7fcU, 0xc52acbd7U, 0x26354480U, 0xb562a38fU,
+    0xdeb15a49U, 0x25ba1b67U, 0x45ea0e98U, 0x5dfec0e1U,
+    0xc32f7502U, 0x814cf012U, 0x8d4697a3U, 0x6bd3f9c6U,
+    0x038f5fe7U, 0x15929c95U, 0xbf6d7aebU, 0x955259daU,
+    0xd4be832dU, 0x587421d3U, 0x49e06929U, 0x8ec9c844U,
+    0x75c2896aU, 0xf48e7978U, 0x99583e6bU, 0x27b971ddU,
+    0xbee14fb6U, 0xf088ad17U, 0xc920ac66U, 0x7dce3ab4U,
+    0x63df4a18U, 0xe51a3182U, 0x97513360U, 0x62537f45U,
+    0xb16477e0U, 0xbb6bae84U, 0xfe81a01cU, 0xf9082b94U,
+    0x70486858U, 0x8f45fd19U, 0x94de6c87U, 0x527bf8b7U,
+    0xab73d323U, 0x724b02e2U, 0xe31f8f57U, 0x6655ab2aU,
+    0xb2eb2807U, 0x2fb5c203U, 0x86c57b9aU, 0xd33708a5U,
+    0x302887f2U, 0x23bfa5b2U, 0x02036abaU, 0xed16825cU,
+    0x8acf1c2bU, 0xa779b492U, 0xf307f2f0U, 0x4e69e2a1U,
+    0x65daf4cdU, 0x0605bed5U, 0xd134621fU, 0xc4a6fe8aU,
+    0x342e539dU, 0xa2f355a0U, 0x058ae132U, 0xa4f6eb75U,
+    0x0b83ec39U, 0x4060efaaU, 0x5e719f06U, 0xbd6e1051U,
+    0x3e218af9U, 0x96dd063dU, 0xdd3e05aeU, 0x4de6bd46U,
+    0x91548db5U, 0x71c45d05U, 0x0406d46fU, 0x605015ffU,
+    0x1998fb24U, 0xd6bde997U, 0x894043ccU, 0x67d99e77U,
+    0xb0e842bdU, 0x07898b88U, 0xe7195b38U, 0x79c8eedbU,
+    0xa17c0a47U, 0x7c420fe9U, 0xf8841ec9U, 0x00000000U,
+    0x09808683U, 0x322bed48U, 0x1e1170acU, 0x6c5a724eU,
+    0xfd0efffbU, 0x0f853856U, 0x3daed51eU, 0x362d3927U,
+    0x0a0fd964U, 0x685ca621U, 0x9b5b54d1U, 0x24362e3aU,
+    0x0c0a67b1U, 0x9357e70fU, 0xb4ee96d2U, 0x1b9b919eU,
+    0x80c0c54fU, 0x61dc20a2U, 0x5a774b69U, 0x1c121a16U,
+    0xe293ba0aU, 0xc0a02ae5U, 0x3c22e043U, 0x121b171dU,
+    0x0e090d0bU, 0xf28bc7adU, 0x2db6a8b9U, 0x141ea9c8U,
+    0x57f11985U, 0xaf75074cU, 0xee99ddbbU, 0xa37f60fdU,
+    0xf701269fU, 0x5c72f5bcU, 0x44663bc5U, 0x5bfb7e34U,
+    0x8b432976U, 0xcb23c6dcU, 0xb6edfc68U, 0xb8e4f163U,
+    0xd731dccaU, 0x42638510U, 0x13972240U, 0x84c61120U,
+    0x854a247dU, 0xd2bb3df8U, 0xaef93211U, 0xc729a16dU,
+    0x1d9e2f4bU, 0xdcb230f3U, 0x0d8652ecU, 0x77c1e3d0U,
+    0x2bb3166cU, 0xa970b999U, 0x119448faU, 0x47e96422U,
+    0xa8fc8cc4U, 0xa0f03f1aU, 0x567d2cd8U, 0x223390efU,
+    0x87494ec7U, 0xd938d1c1U, 0x8ccaa2feU, 0x98d40b36U,
+    0xa6f581cfU, 0xa57ade28U, 0xdab78e26U, 0x3fadbfa4U,
+    0x2c3a9de4U, 0x5078920dU, 0x6a5fcc9bU, 0x547e4662U,
+    0xf68d13c2U, 0x90d8b8e8U, 0x2e39f75eU, 0x82c3aff5U,
+    0x9f5d80beU, 0x69d0937cU, 0x6fd52da9U, 0xcf2512b3U,
+    0xc8ac993bU, 0x10187da7U, 0xe89c636eU, 0xdb3bbb7bU,
+    0xcd267809U, 0x6e5918f4U, 0xec9ab701U, 0x834f9aa8U,
+    0xe6956e65U, 0xaaffe67eU, 0x21bccf08U, 0xef15e8e6U,
+    0xbae79bd9U, 0x4a6f36ceU, 0xea9f09d4U, 0x29b07cd6U,
+    0x31a4b2afU, 0x2a3f2331U, 0xc6a59430U, 0x35a266c0U,
+    0x744ebc37U, 0xfc82caa6U, 0xe090d0b0U, 0x33a7d815U,
+    0xf104984aU, 0x41ecdaf7U, 0x7fcd500eU, 0x1791f62fU,
+    0x764dd68dU, 0x43efb04dU, 0xccaa4d54U, 0xe49604dfU,
+    0x9ed1b5e3U, 0x4c6a881bU, 0xc12c1fb8U, 0x4665517fU,
+    0x9d5eea04U, 0x018c355dU, 0xfa877473U, 0xfb0b412eU,
+    0xb3671d5aU, 0x92dbd252U, 0xe9105633U, 0x6dd64713U,
+    0x9ad7618cU, 0x37a10c7aU, 0x59f8148eU, 0xeb133c89U,
+    0xcea927eeU, 0xb761c935U, 0xe11ce5edU, 0x7a47b13cU,
+    0x9cd2df59U, 0x55f2733fU, 0x1814ce79U, 0x73c737bfU,
+    0x53f7cdeaU, 0x5ffdaa5bU, 0xdf3d6f14U, 0x7844db86U,
+    0xcaaff381U, 0xb968c43eU, 0x3824342cU, 0xc2a3405fU,
+    0x161dc372U, 0xbce2250cU, 0x283c498bU, 0xff0d9541U,
+    0x39a80171U, 0x080cb3deU, 0xd8b4e49cU, 0x6456c190U,
+    0x7bcb8461U, 0xd532b670U, 0x486c5c74U, 0xd0b85742U,
+};
+const u8 Td4s[256] = {
+    0x52U, 0x09U, 0x6aU, 0xd5U, 0x30U, 0x36U, 0xa5U, 0x38U,
+    0xbfU, 0x40U, 0xa3U, 0x9eU, 0x81U, 0xf3U, 0xd7U, 0xfbU,
+    0x7cU, 0xe3U, 0x39U, 0x82U, 0x9bU, 0x2fU, 0xffU, 0x87U,
+    0x34U, 0x8eU, 0x43U, 0x44U, 0xc4U, 0xdeU, 0xe9U, 0xcbU,
+    0x54U, 0x7bU, 0x94U, 0x32U, 0xa6U, 0xc2U, 0x23U, 0x3dU,
+    0xeeU, 0x4cU, 0x95U, 0x0bU, 0x42U, 0xfaU, 0xc3U, 0x4eU,
+    0x08U, 0x2eU, 0xa1U, 0x66U, 0x28U, 0xd9U, 0x24U, 0xb2U,
+    0x76U, 0x5bU, 0xa2U, 0x49U, 0x6dU, 0x8bU, 0xd1U, 0x25U,
+    0x72U, 0xf8U, 0xf6U, 0x64U, 0x86U, 0x68U, 0x98U, 0x16U,
+    0xd4U, 0xa4U, 0x5cU, 0xccU, 0x5dU, 0x65U, 0xb6U, 0x92U,
+    0x6cU, 0x70U, 0x48U, 0x50U, 0xfdU, 0xedU, 0xb9U, 0xdaU,
+    0x5eU, 0x15U, 0x46U, 0x57U, 0xa7U, 0x8dU, 0x9dU, 0x84U,
+    0x90U, 0xd8U, 0xabU, 0x00U, 0x8cU, 0xbcU, 0xd3U, 0x0aU,
+    0xf7U, 0xe4U, 0x58U, 0x05U, 0xb8U, 0xb3U, 0x45U, 0x06U,
+    0xd0U, 0x2cU, 0x1eU, 0x8fU, 0xcaU, 0x3fU, 0x0fU, 0x02U,
+    0xc1U, 0xafU, 0xbdU, 0x03U, 0x01U, 0x13U, 0x8aU, 0x6bU,
+    0x3aU, 0x91U, 0x11U, 0x41U, 0x4fU, 0x67U, 0xdcU, 0xeaU,
+    0x97U, 0xf2U, 0xcfU, 0xceU, 0xf0U, 0xb4U, 0xe6U, 0x73U,
+    0x96U, 0xacU, 0x74U, 0x22U, 0xe7U, 0xadU, 0x35U, 0x85U,
+    0xe2U, 0xf9U, 0x37U, 0xe8U, 0x1cU, 0x75U, 0xdfU, 0x6eU,
+    0x47U, 0xf1U, 0x1aU, 0x71U, 0x1dU, 0x29U, 0xc5U, 0x89U,
+    0x6fU, 0xb7U, 0x62U, 0x0eU, 0xaaU, 0x18U, 0xbeU, 0x1bU,
+    0xfcU, 0x56U, 0x3eU, 0x4bU, 0xc6U, 0xd2U, 0x79U, 0x20U,
+    0x9aU, 0xdbU, 0xc0U, 0xfeU, 0x78U, 0xcdU, 0x5aU, 0xf4U,
+    0x1fU, 0xddU, 0xa8U, 0x33U, 0x88U, 0x07U, 0xc7U, 0x31U,
+    0xb1U, 0x12U, 0x10U, 0x59U, 0x27U, 0x80U, 0xecU, 0x5fU,
+    0x60U, 0x51U, 0x7fU, 0xa9U, 0x19U, 0xb5U, 0x4aU, 0x0dU,
+    0x2dU, 0xe5U, 0x7aU, 0x9fU, 0x93U, 0xc9U, 0x9cU, 0xefU,
+    0xa0U, 0xe0U, 0x3bU, 0x4dU, 0xaeU, 0x2aU, 0xf5U, 0xb0U,
+    0xc8U, 0xebU, 0xbbU, 0x3cU, 0x83U, 0x53U, 0x99U, 0x61U,
+    0x17U, 0x2bU, 0x04U, 0x7eU, 0xbaU, 0x77U, 0xd6U, 0x26U,
+    0xe1U, 0x69U, 0x14U, 0x63U, 0x55U, 0x21U, 0x0cU, 0x7dU,
+};
+const u8 rcons[] = {
+	0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1B, 0x36
+	/* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
+};
+
+/**
+ * Expand the cipher key into the encryption key schedule.
+ *
+ * @return	the number of rounds for the given cipher key size.
+ */
+#ifndef PLATFORM_FREEBSD //Baron
+static void rijndaelKeySetupEnc(u32 rk[/*44*/], const u8 cipherKey[])
+{
+	int i;
+	u32 temp;
+
+	rk[0] = GETU32(cipherKey     );
+	rk[1] = GETU32(cipherKey +  4);
+	rk[2] = GETU32(cipherKey +  8);
+	rk[3] = GETU32(cipherKey + 12);
+	for (i = 0; i < 10; i++) {
+		temp  = rk[3];
+		rk[4] = rk[0] ^
+			TE421(temp) ^ TE432(temp) ^ TE443(temp) ^ TE414(temp) ^
+			RCON(i);
+		rk[5] = rk[1] ^ rk[4];
+		rk[6] = rk[2] ^ rk[5];
+		rk[7] = rk[3] ^ rk[6];
+		rk += 4;
+	}
+}
+
+static void rijndaelEncrypt(u32 rk[/*44*/], u8 pt[16], u8 ct[16])
+{
+	u32 s0, s1, s2, s3, t0, t1, t2, t3;
+	int Nr = 10;
+#ifndef FULL_UNROLL
+	int r;
+#endif /* ?FULL_UNROLL */
+
+	/*
+	 * map byte array block to cipher state
+	 * and add initial round key:
+	 */
+	s0 = GETU32(pt     ) ^ rk[0];
+	s1 = GETU32(pt +  4) ^ rk[1];
+	s2 = GETU32(pt +  8) ^ rk[2];
+	s3 = GETU32(pt + 12) ^ rk[3];
+
+#define ROUND(i,d,s) \
+d##0 = TE0(s##0) ^ TE1(s##1) ^ TE2(s##2) ^ TE3(s##3) ^ rk[4 * i]; \
+d##1 = TE0(s##1) ^ TE1(s##2) ^ TE2(s##3) ^ TE3(s##0) ^ rk[4 * i + 1]; \
+d##2 = TE0(s##2) ^ TE1(s##3) ^ TE2(s##0) ^ TE3(s##1) ^ rk[4 * i + 2]; \
+d##3 = TE0(s##3) ^ TE1(s##0) ^ TE2(s##1) ^ TE3(s##2) ^ rk[4 * i + 3]
+
+#ifdef FULL_UNROLL
+
+	ROUND(1,t,s);
+	ROUND(2,s,t);
+	ROUND(3,t,s);
+	ROUND(4,s,t);
+	ROUND(5,t,s);
+	ROUND(6,s,t);
+	ROUND(7,t,s);
+	ROUND(8,s,t);
+	ROUND(9,t,s);
+
+	rk += Nr << 2;
+
+#else  /* !FULL_UNROLL */
+
+	/* Nr - 1 full rounds: */
+	r = Nr >> 1;
+	for (;;) {
+		ROUND(1,t,s);
+		rk += 8;
+		if (--r == 0)
+			break;
+		ROUND(0,s,t);
+	}
+
+#endif /* ?FULL_UNROLL */
+
+#undef ROUND
+
+	/*
+	 * apply last round and
+	 * map cipher state to byte array block:
+	 */
+	s0 = TE41(t0) ^ TE42(t1) ^ TE43(t2) ^ TE44(t3) ^ rk[0];
+	PUTU32(ct     , s0);
+	s1 = TE41(t1) ^ TE42(t2) ^ TE43(t3) ^ TE44(t0) ^ rk[1];
+	PUTU32(ct +  4, s1);
+	s2 = TE41(t2) ^ TE42(t3) ^ TE43(t0) ^ TE44(t1) ^ rk[2];
+	PUTU32(ct +  8, s2);
+	s3 = TE41(t3) ^ TE42(t0) ^ TE43(t1) ^ TE44(t2) ^ rk[3];
+	PUTU32(ct + 12, s3);
+}
+
+static void * aes_encrypt_init(u8 *key, size_t len)
+{
+	u32 *rk;
+	if (len != 16)
+		return NULL;
+	rk = (u32*)rtw_malloc(AES_PRIV_SIZE);
+	if (rk == NULL)
+		return NULL;
+	rijndaelKeySetupEnc(rk, key);
+	return rk;
+}
+
+static void aes_128_encrypt(void *ctx, u8 *plain, u8 *crypt)
+{
+	rijndaelEncrypt(ctx, plain, crypt);
+}
+
+
+static void gf_mulx(u8 *pad)
+{
+	int i, carry;
+
+	carry = pad[0] & 0x80;
+	for (i = 0; i < AES_BLOCK_SIZE - 1; i++)
+		pad[i] = (pad[i] << 1) | (pad[i + 1] >> 7);
+	pad[AES_BLOCK_SIZE - 1] <<= 1;
+	if (carry)
+		pad[AES_BLOCK_SIZE - 1] ^= 0x87;
+}
+
+static void aes_encrypt_deinit(void *ctx)
+{
+	_rtw_memset(ctx, 0, AES_PRIV_SIZE);
+	rtw_mfree(ctx, AES_PRIV_SIZE);
+}
+
+
+/**
+ * omac1_aes_128_vector - One-Key CBC MAC (OMAC1) hash with AES-128
+ * @key: 128-bit key for the hash operation
+ * @num_elem: Number of elements in the data vector
+ * @addr: Pointers to the data areas
+ * @len: Lengths of the data blocks
+ * @mac: Buffer for MAC (128 bits, i.e., 16 bytes)
+ * Returns: 0 on success, -1 on failure
+ *
+ * This is a mode for using block cipher (AES in this case) for authentication.
+ * OMAC1 was standardized with the name CMAC by NIST in a Special Publication
+ * (SP) 800-38B.
+ */
+static int omac1_aes_128_vector(u8 *key, size_t num_elem,
+							 u8 *addr[], size_t *len, u8 *mac)
+{
+	void *ctx;
+	u8 cbc[AES_BLOCK_SIZE], pad[AES_BLOCK_SIZE];
+	u8 *pos, *end;
+	size_t i, e, left, total_len;
+
+	ctx = aes_encrypt_init(key, 16);
+	if (ctx == NULL)
+		return -1;
+	_rtw_memset(cbc, 0, AES_BLOCK_SIZE);
+
+	total_len = 0;
+	for (e = 0; e < num_elem; e++)
+		total_len += len[e];
+	left = total_len;
+
+	e = 0;
+	pos = addr[0];
+	end = pos + len[0];
+
+	while (left >= AES_BLOCK_SIZE) {
+		for (i = 0; i < AES_BLOCK_SIZE; i++) {
+			cbc[i] ^= *pos++;
+			if (pos >= end) {
+				e++;
+				pos = addr[e];
+				end = pos + len[e];
+			}
+		}
+		if (left > AES_BLOCK_SIZE)
+			aes_128_encrypt(ctx, cbc, cbc);
+		left -= AES_BLOCK_SIZE;
+	}
+
+	_rtw_memset(pad, 0, AES_BLOCK_SIZE);
+	aes_128_encrypt(ctx, pad, pad);
+	gf_mulx(pad);
+
+	if (left || total_len == 0) {
+		for (i = 0; i < left; i++) {
+			cbc[i] ^= *pos++;
+			if (pos >= end) {
+				e++;
+				pos = addr[e];
+				end = pos + len[e];
+			}
+		}
+		cbc[left] ^= 0x80;
+		gf_mulx(pad);
+	}
+
+	for (i = 0; i < AES_BLOCK_SIZE; i++)
+		pad[i] ^= cbc[i];
+	aes_128_encrypt(ctx, pad, mac);
+	aes_encrypt_deinit(ctx);
+	return 0;
+}
+
+
+/**
+ * omac1_aes_128 - One-Key CBC MAC (OMAC1) hash with AES-128 (aka AES-CMAC)
+ * @key: 128-bit key for the hash operation
+ * @data: Data buffer for which a MAC is determined
+ * @data_len: Length of data buffer in bytes
+ * @mac: Buffer for MAC (128 bits, i.e., 16 bytes)
+ * Returns: 0 on success, -1 on failure
+ *
+ * This is a mode for using block cipher (AES in this case) for authentication.
+ * OMAC1 was standardized with the name CMAC by NIST in a Special Publication
+ * (SP) 800-38B.
+ */ //modify for CONFIG_IEEE80211W
+int omac1_aes_128(u8 *key, u8 *data, size_t data_len, u8 *mac)
+{
+	return omac1_aes_128_vector(key, 1, &data, &data_len, mac);
+}
+#endif //PLATFORM_FREEBSD Baron
+
+#ifdef CONFIG_TDLS
+void wpa_tdls_generate_tpk(_adapter *padapter, struct sta_info *psta)
+{
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	u8 *SNonce = psta->SNonce;
+	u8 *ANonce = psta->ANonce;
+
+	u8 key_input[SHA256_MAC_LEN];
+	u8 *nonce[2];
+	size_t len[2];
+	u8 data[3 * ETH_ALEN];
+
+	/* IEEE Std 802.11z-2010 8.5.9.1:
+	 * TPK-Key-Input = SHA-256(min(SNonce, ANonce) || max(SNonce, ANonce))
+	 */
+	len[0] = 32;
+	len[1] = 32;
+	if (os_memcmp(SNonce, ANonce, 32) < 0) {
+		nonce[0] = SNonce;
+		nonce[1] = ANonce;
+	} else {
+		nonce[0] = ANonce;
+		nonce[1] = SNonce;
+	}
+
+	sha256_vector(2, nonce, len, key_input);
+
+	/*
+	 * TPK-Key-Data = KDF-N_KEY(TPK-Key-Input, "TDLS PMK",
+	 *	min(MAC_I, MAC_R) || max(MAC_I, MAC_R) || BSSID || N_KEY)
+	 * TODO: is N_KEY really included in KDF Context and if so, in which
+	 * presentation format (little endian 16-bit?) is it used? It gets
+	 * added by the KDF anyway..
+	 */
+
+	if (os_memcmp(myid(&(padapter->eeprompriv)), psta->hwaddr, ETH_ALEN) < 0) {
+		_rtw_memcpy(data, myid(&(padapter->eeprompriv)), ETH_ALEN);
+		_rtw_memcpy(data + ETH_ALEN, psta->hwaddr, ETH_ALEN);
+	} else {
+		_rtw_memcpy(data, psta->hwaddr, ETH_ALEN);
+		_rtw_memcpy(data + ETH_ALEN, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	}
+	_rtw_memcpy(data + 2 * ETH_ALEN, get_bssid(pmlmepriv), ETH_ALEN);
+
+	sha256_prf(key_input, SHA256_MAC_LEN, "TDLS PMK", data, sizeof(data), (u8 *) &psta->tpk, sizeof(psta->tpk));
+
+
+}
+
+/**
+ * wpa_tdls_ftie_mic - Calculate TDLS FTIE MIC
+ * @kck: TPK-KCK
+ * @lnkid: Pointer to the beginning of Link Identifier IE
+ * @rsnie: Pointer to the beginning of RSN IE used for handshake
+ * @timeoutie: Pointer to the beginning of Timeout IE used for handshake
+ * @ftie: Pointer to the beginning of FT IE
+ * @mic: Pointer for writing MIC
+ *
+ * Calculate MIC for TDLS frame.
+ */
+int wpa_tdls_ftie_mic(u8 *kck, u8 trans_seq,
+							u8 *lnkid, u8 *rsnie, u8 *timeoutie, u8 *ftie,
+							u8 *mic)
+{
+	u8 *buf, *pos;
+	struct wpa_tdls_ftie *_ftie;
+	struct wpa_tdls_lnkid *_lnkid;
+	int ret;
+	int len = 2 * ETH_ALEN + 1 + 2 + lnkid[1] + 2 + rsnie[1] +
+		2 + timeoutie[1] + 2 + ftie[1];
+	buf = rtw_zmalloc(len);
+	if (!buf) {
+		DBG_871X("TDLS: No memory for MIC calculation\n");
+		return -1;
+	}
+
+	pos = buf;
+	_lnkid = (struct wpa_tdls_lnkid *) lnkid;
+	/* 1) TDLS initiator STA MAC address */
+	_rtw_memcpy(pos, _lnkid->init_sta, ETH_ALEN);
+	pos += ETH_ALEN;
+	/* 2) TDLS responder STA MAC address */
+	_rtw_memcpy(pos, _lnkid->resp_sta, ETH_ALEN);
+	pos += ETH_ALEN;
+	/* 3) Transaction Sequence number */
+	*pos++ = trans_seq;
+	/* 4) Link Identifier IE */
+	_rtw_memcpy(pos, lnkid, 2 + lnkid[1]);
+	pos += 2 + lnkid[1];
+	/* 5) RSN IE */
+	_rtw_memcpy(pos, rsnie, 2 + rsnie[1]);
+	pos += 2 + rsnie[1];
+	/* 6) Timeout Interval IE */
+	_rtw_memcpy(pos, timeoutie, 2 + timeoutie[1]);
+	pos += 2 + timeoutie[1];
+	/* 7) FTIE, with the MIC field of the FTIE set to 0 */
+	_rtw_memcpy(pos, ftie, 2 + ftie[1]);
+	_ftie = (struct wpa_tdls_ftie *) pos;
+	_rtw_memset(_ftie->mic, 0, TDLS_MIC_LEN);
+	pos += 2 + ftie[1];
+
+	ret = omac1_aes_128(kck, buf, pos - buf, mic);
+	rtw_mfree(buf, len);
+	return ret;
+
+}
+
+int tdls_verify_mic(u8 *kck, u8 trans_seq,
+							u8 *lnkid, u8 *rsnie, u8 *timeoutie, u8 *ftie)
+{
+	u8 *buf, *pos;
+	int len;
+	u8 mic[16];
+	int ret;
+	u8 *rx_ftie, *tmp_ftie;
+
+	if (lnkid == NULL || rsnie == NULL ||
+	    timeoutie == NULL || ftie == NULL){
+		return 0;
+	}
+
+	len = 2 * ETH_ALEN + 1 + 2 + 18 + 2 + *(rsnie+1) + 2 + *(timeoutie+1) + 2 + *(ftie+1);
+
+	buf = rtw_zmalloc(len);
+	if (buf == NULL)
+		return 0;
+
+	pos = buf;
+	/* 1) TDLS initiator STA MAC address */
+	_rtw_memcpy(pos, lnkid + ETH_ALEN + 2, ETH_ALEN);
+	pos += ETH_ALEN;
+	/* 2) TDLS responder STA MAC address */
+	_rtw_memcpy(pos, lnkid + 2 * ETH_ALEN + 2, ETH_ALEN);
+	pos += ETH_ALEN;
+	/* 3) Transaction Sequence number */
+	*pos++ = trans_seq;
+	/* 4) Link Identifier IE */
+	_rtw_memcpy(pos, lnkid, 2 + 18);
+	pos += 2 + 18;
+	/* 5) RSN IE */
+	_rtw_memcpy(pos, rsnie, 2 + *(rsnie+1));
+	pos += 2 + *(rsnie+1);
+	/* 6) Timeout Interval IE */
+	_rtw_memcpy(pos, timeoutie, 2 + *(timeoutie+1));
+	pos += 2 + *(timeoutie+1);
+	/* 7) FTIE, with the MIC field of the FTIE set to 0 */
+	_rtw_memcpy(pos, ftie, 2 + *(ftie+1));
+	pos += 2;
+	tmp_ftie = (u8 *) (pos+2);
+	_rtw_memset(tmp_ftie, 0, 16);
+	pos += *(ftie+1);
+
+	ret = omac1_aes_128(kck, buf, pos - buf, mic);
+	rtw_mfree(buf, len);
+	if (ret)
+		return 0;
+	rx_ftie = ftie+4;
+
+	if (os_memcmp(mic, rx_ftie, 16) == 0) {
+		//Valid MIC
+		return 1;
+	}
+
+	//Invalid MIC
+	DBG_871X( "[%s] Invalid MIC\n", __FUNCTION__);
+	return 0;
+
+}
+#endif //CONFIG_TDLS
+
+#ifdef PLATFORM_WINDOWS
+void rtw_use_tkipkey_handler (
+	IN	PVOID					SystemSpecific1,
+	IN	PVOID					FunctionContext,
+	IN	PVOID					SystemSpecific2,
+	IN	PVOID					SystemSpecific3
+	)
+#endif
+#ifdef PLATFORM_LINUX
+void rtw_use_tkipkey_handler(void *FunctionContext)
+#endif
+#ifdef PLATFORM_FREEBSD
+void rtw_use_tkipkey_handler(void *FunctionContext)
+#endif
+{
+        _adapter *padapter = (_adapter *)FunctionContext;
+
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("^^^rtw_use_tkipkey_handler ^^^\n"));
+
+/*
+	if(padapter->bDriverStopped ||padapter->bSurpriseRemoved){
+			RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("^^^rtw_use_tkipkey_handler (padapter->bDriverStopped %d)(padapter->bSurpriseRemoved %d)^^^\n",padapter->bDriverStopped,padapter->bSurpriseRemoved));
+
+		return;
+	}
+	*/
+
+	padapter->securitypriv.busetkipkey=_TRUE;
+
+	RT_TRACE(_module_rtl871x_security_c_,_drv_err_,("^^^rtw_use_tkipkey_handler padapter->securitypriv.busetkipkey=%d^^^\n",padapter->securitypriv.busetkipkey));
+
+_func_exit_;
+
+}
+
+/* Restore HW wep key setting according to key_mask */
+void rtw_sec_restore_wep_key(_adapter *adapter)
+{
+	struct security_priv* securitypriv=&(adapter->securitypriv);
+	sint keyid;
+
+	if((_WEP40_ == securitypriv->dot11PrivacyAlgrthm) ||(_WEP104_ == securitypriv->dot11PrivacyAlgrthm)) {
+		for(keyid=0;keyid<4;keyid++){
+			if(securitypriv->key_mask & BIT(keyid)){
+				if(keyid == securitypriv->dot11PrivacyKeyIndex)
+					rtw_set_key(adapter,securitypriv, keyid, 1);
+				else
+					rtw_set_key(adapter,securitypriv, keyid, 0);
+			}
+		}
+	}
+}
+
+u8 rtw_handle_tkip_countermeasure(_adapter* adapter, const char *caller)
+{
+	struct security_priv* securitypriv=&(adapter->securitypriv);
+	u8 status = _SUCCESS;
+
+	if (securitypriv->btkip_countermeasure == _TRUE) {
+		u32 passing_ms = rtw_get_passing_time_ms(securitypriv->btkip_countermeasure_time);
+		if (passing_ms > 60*1000) {
+			LOG_LEVEL(_drv_info_, "%s("ADPT_FMT") countermeasure time:%ds > 60s \n",
+				caller, ADPT_ARG(adapter), passing_ms/1000);
+			securitypriv->btkip_countermeasure = _FALSE;
+			securitypriv->btkip_countermeasure_time = 0;
+		} else {
+			LOG_LEVEL(_drv_warning_, "%s("ADPT_FMT") countermeasure time:%ds < 60s \n",
+				caller, ADPT_ARG(adapter), passing_ms/1000);
+			status = _FAIL;
+		}
+	}
+
+	return status;
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_sreset.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_sreset.c
new file mode 100644
index 000000000000..9d3dd7c02a79
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_sreset.c
@@ -0,0 +1,351 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#include<rtw_sreset.h>
+
+void sreset_init_value(_adapter *padapter)
+{
+#if defined(DBG_CONFIG_ERROR_DETECT)
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct sreset_priv *psrtpriv = &pHalData->srestpriv;
+
+	_rtw_mutex_init(&psrtpriv->silentreset_mutex);
+	psrtpriv->silent_reset_inprogress = _FALSE;
+	psrtpriv->Wifi_Error_Status = WIFI_STATUS_SUCCESS;
+	psrtpriv->last_tx_time =0;
+	psrtpriv->last_tx_complete_time =0;
+#endif
+}
+void sreset_reset_value(_adapter *padapter)
+{
+#if defined(DBG_CONFIG_ERROR_DETECT)
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct sreset_priv *psrtpriv = &pHalData->srestpriv;
+
+	psrtpriv->silent_reset_inprogress = _FALSE;
+	psrtpriv->Wifi_Error_Status = WIFI_STATUS_SUCCESS;
+	psrtpriv->last_tx_time =0;
+	psrtpriv->last_tx_complete_time =0;
+#endif
+}
+
+u8 sreset_get_wifi_status(_adapter *padapter)
+{
+#if defined(DBG_CONFIG_ERROR_DETECT)
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct sreset_priv *psrtpriv = &pHalData->srestpriv;
+
+	u8 status = WIFI_STATUS_SUCCESS;
+	u32 val32 = 0;
+	_irqL irqL;
+	if(psrtpriv->silent_reset_inprogress == _TRUE)
+        {
+		return status;
+	}
+	val32 =rtw_read32(padapter,REG_TXDMA_STATUS);
+	if(val32==0xeaeaeaea){
+		psrtpriv->Wifi_Error_Status = WIFI_IF_NOT_EXIST;
+	}
+	else if(val32!=0){
+		DBG_8192C("txdmastatu(%x)\n",val32);
+		psrtpriv->Wifi_Error_Status = WIFI_MAC_TXDMA_ERROR;
+	}
+
+	if(WIFI_STATUS_SUCCESS !=psrtpriv->Wifi_Error_Status)
+	{
+		DBG_8192C("==>%s error_status(0x%x) \n",__FUNCTION__,psrtpriv->Wifi_Error_Status);
+		status = (psrtpriv->Wifi_Error_Status &( ~(USB_READ_PORT_FAIL|USB_WRITE_PORT_FAIL)));
+	}
+	DBG_8192C("==> %s wifi_status(0x%x)\n",__FUNCTION__,status);
+
+	//status restore
+	psrtpriv->Wifi_Error_Status = WIFI_STATUS_SUCCESS;
+
+	return status;
+#else
+	return WIFI_STATUS_SUCCESS;
+#endif
+}
+
+void sreset_set_wifi_error_status(_adapter *padapter, u32 status)
+{
+#if defined(DBG_CONFIG_ERROR_DETECT)
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	pHalData->srestpriv.Wifi_Error_Status = status;
+#endif
+}
+
+void sreset_set_trigger_point(_adapter *padapter, s32 tgp)
+{
+#if defined(DBG_CONFIG_ERROR_DETECT)
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	pHalData->srestpriv.dbg_trigger_point = tgp;
+#endif
+}
+
+bool sreset_inprogress(_adapter *padapter)
+{
+#if defined(DBG_CONFIG_ERROR_RESET)
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	return pHalData->srestpriv.silent_reset_inprogress;
+#else
+	return _FALSE;
+#endif
+}
+
+void sreset_restore_security_station(_adapter *padapter)
+{
+	u8 EntryId = 0;
+	struct mlme_priv *mlmepriv = &padapter->mlmepriv;
+	struct sta_priv * pstapriv = &padapter->stapriv;
+	struct sta_info *psta;
+	struct security_priv* psecuritypriv=&(padapter->securitypriv);
+	struct mlme_ext_info	*pmlmeinfo = &padapter->mlmeextpriv.mlmext_info;
+
+	{
+		u8 val8;
+
+		if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_8021X) {
+			val8 = 0xcc;
+		#ifdef CONFIG_WAPI_SUPPORT
+		} else if (padapter->wapiInfo.bWapiEnable && pmlmeinfo->auth_algo == dot11AuthAlgrthm_WAPI) {
+			//Disable TxUseDefaultKey, RxUseDefaultKey, RxBroadcastUseDefaultKey.
+			val8 = 0x4c;
+		#endif
+		} else {
+			val8 = 0xcf;
+		}
+		rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
+	}
+
+	#if 0
+	if (	( padapter->securitypriv.dot11PrivacyAlgrthm == _WEP40_ ) ||
+		( padapter->securitypriv.dot11PrivacyAlgrthm == _WEP104_ ))
+	{
+
+		for(EntryId=0; EntryId<4; EntryId++)
+		{
+			if(EntryId == psecuritypriv->dot11PrivacyKeyIndex)
+				rtw_set_key(padapter,&padapter->securitypriv, EntryId, 1);
+			else
+				rtw_set_key(padapter,&padapter->securitypriv, EntryId, 0);
+		}
+
+	}
+	else
+	#endif
+	if((padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_) ||
+		(padapter->securitypriv.dot11PrivacyAlgrthm == _AES_))
+	{
+		psta = rtw_get_stainfo(pstapriv, get_bssid(mlmepriv));
+		if (psta == NULL) {
+			//DEBUG_ERR( ("Set wpa_set_encryption: Obtain Sta_info fail \n"));
+		}
+		else
+		{
+			//pairwise key
+			rtw_setstakey_cmd(padapter, (unsigned char *)psta, _TRUE);
+			//group key
+			rtw_set_key(padapter,&padapter->securitypriv,padapter->securitypriv.dot118021XGrpKeyid, 0);
+		}
+	}
+}
+
+void sreset_restore_network_station(_adapter *padapter)
+{
+	struct mlme_priv *mlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	#if 0
+	{
+	//=======================================================
+	// reset related register of Beacon control
+
+	//set MSR to nolink
+	Set_MSR(padapter, _HW_STATE_NOLINK_);
+	// reject all data frame
+	rtw_write16(padapter, REG_RXFLTMAP2,0x00);
+	//reset TSF
+	rtw_write8(padapter, REG_DUAL_TSF_RST, (BIT(0)|BIT(1)));
+
+	// disable update TSF
+	SetBcnCtrlReg(padapter, BIT(4), 0);
+
+	//=======================================================
+	}
+	#endif
+
+	rtw_setopmode_cmd(padapter, Ndis802_11Infrastructure);
+
+	{
+		u8 threshold;
+		#ifdef CONFIG_USB_HCI
+		// TH=1 => means that invalidate usb rx aggregation
+		// TH=0 => means that validate usb rx aggregation, use init value.
+		if(mlmepriv->htpriv.ht_option) {
+			if(padapter->registrypriv.wifi_spec==1)
+				threshold = 1;
+			else
+				threshold = 0;
+			rtw_hal_set_hwreg(padapter, HW_VAR_RXDMA_AGG_PG_TH, (u8 *)(&threshold));
+		} else {
+			threshold = 1;
+			rtw_hal_set_hwreg(padapter, HW_VAR_RXDMA_AGG_PG_TH, (u8 *)(&threshold));
+		}
+		#endif
+	}
+
+	set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+
+	//disable dynamic functions, such as high power, DIG
+	//Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, _FALSE);
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, pmlmeinfo->network.MacAddress);
+
+	{
+		u8	join_type = 0;
+		rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
+	}
+
+	Set_MSR(padapter, (pmlmeinfo->state & 0x3));
+
+	mlmeext_joinbss_event_callback(padapter, 1);
+	//restore Sequence No.
+	rtw_write8(padapter,0x4dc,padapter->xmitpriv.nqos_ssn);
+
+	sreset_restore_security_station(padapter);
+}
+
+void sreset_restore_network_status(_adapter *padapter)
+{
+	struct mlme_priv *mlmepriv = &padapter->mlmepriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if (check_fwstate(mlmepriv, WIFI_STATION_STATE)) {
+		DBG_871X(FUNC_ADPT_FMT" fwstate:0x%08x - WIFI_STATION_STATE\n", FUNC_ADPT_ARG(padapter), get_fwstate(mlmepriv));
+		sreset_restore_network_station(padapter);
+	} else if (check_fwstate(mlmepriv, WIFI_AP_STATE)) {
+		DBG_871X(FUNC_ADPT_FMT" fwstate:0x%08x - WIFI_AP_STATE\n", FUNC_ADPT_ARG(padapter), get_fwstate(mlmepriv));
+		rtw_ap_restore_network(padapter);
+	} else if (check_fwstate(mlmepriv, WIFI_ADHOC_STATE)) {
+		DBG_871X(FUNC_ADPT_FMT" fwstate:0x%08x - WIFI_ADHOC_STATE\n", FUNC_ADPT_ARG(padapter), get_fwstate(mlmepriv));
+	} else {
+		DBG_871X(FUNC_ADPT_FMT" fwstate:0x%08x - ???\n", FUNC_ADPT_ARG(padapter), get_fwstate(mlmepriv));
+	}
+}
+
+void sreset_stop_adapter(_adapter *padapter)
+{
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+
+	if (padapter == NULL)
+		return;
+
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+
+	if (!rtw_netif_queue_stopped(padapter->pnetdev))
+		rtw_netif_stop_queue(padapter->pnetdev);
+
+	rtw_cancel_all_timer(padapter);
+
+	/* TODO: OS and HCI independent */
+	#if defined(PLATFORM_LINUX) && defined(CONFIG_USB_HCI)
+	tasklet_kill(&pxmitpriv->xmit_tasklet);
+	#endif
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY))
+		rtw_scan_abort(padapter);
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING))
+		_rtw_join_timeout_handler(padapter);
+
+}
+
+void sreset_start_adapter(_adapter *padapter)
+{
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+
+	if (padapter == NULL)
+		return;
+
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+
+	if (check_fwstate(pmlmepriv, _FW_LINKED)) {
+		sreset_restore_network_status(padapter);
+	}
+
+	/* TODO: OS and HCI independent */
+	#if defined(PLATFORM_LINUX) && defined(CONFIG_USB_HCI)
+	tasklet_hi_schedule(&pxmitpriv->xmit_tasklet);
+	#endif
+
+	_set_timer(&padapter->mlmepriv.dynamic_chk_timer, 2000);
+
+	if (rtw_netif_queue_stopped(padapter->pnetdev))
+		rtw_netif_wake_queue(padapter->pnetdev);
+
+}
+
+void sreset_reset(_adapter *padapter)
+{
+#ifdef DBG_CONFIG_ERROR_RESET
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct sreset_priv *psrtpriv = &pHalData->srestpriv;
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+	_irqL irqL;
+	u32 start = rtw_get_current_time();
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	psrtpriv->Wifi_Error_Status = WIFI_STATUS_SUCCESS;
+
+	_enter_pwrlock(&pwrpriv->lock);
+
+	psrtpriv->silent_reset_inprogress = _TRUE;
+	pwrpriv->change_rfpwrstate = rf_off;
+
+	sreset_stop_adapter(padapter);
+	#ifdef CONFIG_CONCURRENT_MODE
+	sreset_stop_adapter(padapter->pbuddy_adapter);
+	#endif
+
+	#ifdef CONFIG_IPS
+	_ips_enter(padapter);
+	_ips_leave(padapter);
+	#endif
+
+	sreset_start_adapter(padapter);
+	#ifdef CONFIG_CONCURRENT_MODE
+	sreset_start_adapter(padapter->pbuddy_adapter);
+	#endif
+
+	psrtpriv->silent_reset_inprogress = _FALSE;
+
+	_exit_pwrlock(&pwrpriv->lock);
+
+	DBG_871X("%s done in %d ms\n", __FUNCTION__, rtw_get_passing_time_ms(start));
+#endif
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_sta_mgt.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_sta_mgt.c
new file mode 100644
index 000000000000..23ccadfb3e8a
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_sta_mgt.c
@@ -0,0 +1,847 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_STA_MGT_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#include <xmit_osdep.h>
+#include <mlme_osdep.h>
+
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+
+#error "Shall be Linux or Windows, but not both!\n"
+
+#endif
+
+#include <sta_info.h>
+
+void _rtw_init_stainfo(struct sta_info *psta);
+void _rtw_init_stainfo(struct sta_info *psta)
+{
+
+_func_enter_;
+
+	_rtw_memset((u8 *)psta, 0, sizeof (struct sta_info));
+
+	 _rtw_spinlock_init(&psta->lock);
+	_rtw_init_listhead(&psta->list);
+	_rtw_init_listhead(&psta->hash_list);
+	//_rtw_init_listhead(&psta->asoc_list);
+	//_rtw_init_listhead(&psta->sleep_list);
+	//_rtw_init_listhead(&psta->wakeup_list);
+
+	_rtw_init_queue(&psta->sleep_q);
+	psta->sleepq_len = 0;
+
+	_rtw_init_sta_xmit_priv(&psta->sta_xmitpriv);
+	_rtw_init_sta_recv_priv(&psta->sta_recvpriv);
+
+#ifdef CONFIG_AP_MODE
+
+	_rtw_init_listhead(&psta->asoc_list);
+
+	_rtw_init_listhead(&psta->auth_list);
+
+	psta->expire_to = 0;
+
+	psta->flags = 0;
+
+	psta->capability = 0;
+
+	psta->bpairwise_key_installed = _FALSE;
+
+
+#ifdef CONFIG_NATIVEAP_MLME
+	psta->nonerp_set = 0;
+	psta->no_short_slot_time_set = 0;
+	psta->no_short_preamble_set = 0;
+	psta->no_ht_gf_set = 0;
+	psta->no_ht_set = 0;
+	psta->ht_20mhz_set = 0;
+#endif
+
+#ifdef CONFIG_TX_MCAST2UNI
+	psta->under_exist_checking = 0;
+#endif	// CONFIG_TX_MCAST2UNI
+
+	psta->keep_alive_trycnt = 0;
+
+#endif	// CONFIG_AP_MODE
+
+_func_exit_;
+
+}
+
+u32	_rtw_init_sta_priv(struct	sta_priv *pstapriv)
+{
+	struct sta_info *psta;
+	s32 i;
+
+_func_enter_;
+
+	pstapriv->pallocated_stainfo_buf = rtw_zvmalloc (sizeof(struct sta_info) * NUM_STA+ 4);
+
+	if(!pstapriv->pallocated_stainfo_buf)
+		return _FAIL;
+
+	pstapriv->pstainfo_buf = pstapriv->pallocated_stainfo_buf + 4 -
+		((SIZE_PTR)(pstapriv->pallocated_stainfo_buf ) & 3);
+
+	_rtw_init_queue(&pstapriv->free_sta_queue);
+
+	_rtw_spinlock_init(&pstapriv->sta_hash_lock);
+
+	//_rtw_init_queue(&pstapriv->asoc_q);
+	pstapriv->asoc_sta_count = 0;
+	_rtw_init_queue(&pstapriv->sleep_q);
+	_rtw_init_queue(&pstapriv->wakeup_q);
+
+	psta = (struct sta_info *)(pstapriv->pstainfo_buf);
+
+
+	for(i = 0; i < NUM_STA; i++)
+	{
+		_rtw_init_stainfo(psta);
+
+		_rtw_init_listhead(&(pstapriv->sta_hash[i]));
+
+		rtw_list_insert_tail(&psta->list, get_list_head(&pstapriv->free_sta_queue));
+
+		psta++;
+	}
+
+
+
+#ifdef CONFIG_AP_MODE
+
+	pstapriv->sta_dz_bitmap = 0;
+	pstapriv->tim_bitmap = 0;
+
+	_rtw_init_listhead(&pstapriv->asoc_list);
+	_rtw_init_listhead(&pstapriv->auth_list);
+	_rtw_spinlock_init(&pstapriv->asoc_list_lock);
+	_rtw_spinlock_init(&pstapriv->auth_list_lock);
+	pstapriv->asoc_list_cnt = 0;
+	pstapriv->auth_list_cnt = 0;
+
+	pstapriv->auth_to = 3; // 3*2 = 6 sec
+	pstapriv->assoc_to = 3;
+	//pstapriv->expire_to = 900;// 900*2 = 1800 sec = 30 min, expire after no any traffic.
+	//pstapriv->expire_to = 30;// 30*2 = 60 sec = 1 min, expire after no any traffic.
+#ifdef CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+	pstapriv->expire_to = 3; // 3*2 = 6 sec
+#else
+	pstapriv->expire_to = 60;// 60*2 = 120 sec = 2 min, expire after no any traffic.
+#endif
+	pstapriv->max_num_sta = NUM_STA;
+
+#endif
+
+_func_exit_;
+
+	return _SUCCESS;
+
+}
+
+inline int rtw_stainfo_offset(struct sta_priv *stapriv, struct sta_info *sta)
+{
+	int offset = (((u8 *)sta) - stapriv->pstainfo_buf)/sizeof(struct sta_info);
+
+	if (!stainfo_offset_valid(offset))
+		DBG_871X("%s invalid offset(%d), out of range!!!", __func__, offset);
+
+	return offset;
+}
+
+inline struct sta_info *rtw_get_stainfo_by_offset(struct sta_priv *stapriv, int offset)
+{
+	if (!stainfo_offset_valid(offset))
+		DBG_871X("%s invalid offset(%d), out of range!!!", __func__, offset);
+
+	return (struct sta_info *)(stapriv->pstainfo_buf + offset * sizeof(struct sta_info));
+}
+
+void	_rtw_free_sta_xmit_priv_lock(struct sta_xmit_priv *psta_xmitpriv);
+void	_rtw_free_sta_xmit_priv_lock(struct sta_xmit_priv *psta_xmitpriv)
+{
+_func_enter_;
+
+	_rtw_spinlock_free(&psta_xmitpriv->lock);
+
+	_rtw_spinlock_free(&(psta_xmitpriv->be_q.sta_pending.lock));
+	_rtw_spinlock_free(&(psta_xmitpriv->bk_q.sta_pending.lock));
+	_rtw_spinlock_free(&(psta_xmitpriv->vi_q.sta_pending.lock));
+	_rtw_spinlock_free(&(psta_xmitpriv->vo_q.sta_pending.lock));
+_func_exit_;
+}
+
+static void	_rtw_free_sta_recv_priv_lock(struct sta_recv_priv *psta_recvpriv)
+{
+_func_enter_;
+
+	_rtw_spinlock_free(&psta_recvpriv->lock);
+
+	_rtw_spinlock_free(&(psta_recvpriv->defrag_q.lock));
+
+_func_exit_;
+
+}
+
+void rtw_mfree_stainfo(struct sta_info *psta);
+void rtw_mfree_stainfo(struct sta_info *psta)
+{
+_func_enter_;
+
+	if(&psta->lock != NULL)
+		 _rtw_spinlock_free(&psta->lock);
+
+	_rtw_free_sta_xmit_priv_lock(&psta->sta_xmitpriv);
+	_rtw_free_sta_recv_priv_lock(&psta->sta_recvpriv);
+
+_func_exit_;
+}
+
+
+// this function is used to free the memory of lock || sema for all stainfos
+void rtw_mfree_all_stainfo(struct sta_priv *pstapriv );
+void rtw_mfree_all_stainfo(struct sta_priv *pstapriv )
+{
+	_irqL	 irqL;
+	_list	*plist, *phead;
+	struct sta_info *psta = NULL;
+
+_func_enter_;
+
+	_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+	phead = get_list_head(&pstapriv->free_sta_queue);
+	plist = get_next(phead);
+
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+	{
+		psta = LIST_CONTAINOR(plist, struct sta_info ,list);
+		plist = get_next(plist);
+
+		rtw_mfree_stainfo(psta);
+	}
+
+	_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+_func_exit_;
+
+}
+
+void rtw_mfree_sta_priv_lock(struct	sta_priv *pstapriv);
+void rtw_mfree_sta_priv_lock(struct	sta_priv *pstapriv)
+{
+#ifdef CONFIG_AP_MODE
+	struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
+#endif
+
+	 rtw_mfree_all_stainfo(pstapriv); //be done before free sta_hash_lock
+
+	_rtw_spinlock_free(&pstapriv->free_sta_queue.lock);
+
+	_rtw_spinlock_free(&pstapriv->sta_hash_lock);
+	_rtw_spinlock_free(&pstapriv->wakeup_q.lock);
+	_rtw_spinlock_free(&pstapriv->sleep_q.lock);
+
+#ifdef CONFIG_AP_MODE
+	_rtw_spinlock_free(&pstapriv->asoc_list_lock);
+	_rtw_spinlock_free(&pstapriv->auth_list_lock);
+	_rtw_spinlock_free(&pacl_list->acl_node_q.lock);
+#endif
+
+}
+
+u32	_rtw_free_sta_priv(struct	sta_priv *pstapriv)
+{
+	_irqL 	irqL;
+	_list	*phead, *plist;
+	struct sta_info *psta = NULL;
+	struct recv_reorder_ctrl *preorder_ctrl;
+	int 	index;
+
+_func_enter_;
+	if(pstapriv){
+
+		/*	delete all reordering_ctrl_timer		*/
+		_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+		for(index = 0; index < NUM_STA; index++)
+		{
+			phead = &(pstapriv->sta_hash[index]);
+			plist = get_next(phead);
+
+			while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+			{
+				int i;
+				psta = LIST_CONTAINOR(plist, struct sta_info ,hash_list);
+				plist = get_next(plist);
+
+				for(i=0; i < 16 ; i++)
+				{
+					preorder_ctrl = &psta->recvreorder_ctrl[i];
+					_cancel_timer_ex(&preorder_ctrl->reordering_ctrl_timer);
+				}
+			}
+		}
+		_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+		/*===============================*/
+
+		rtw_mfree_sta_priv_lock(pstapriv);
+
+		if(pstapriv->pallocated_stainfo_buf) {
+			rtw_vmfree(pstapriv->pallocated_stainfo_buf, sizeof(struct sta_info)*NUM_STA+4);
+		}
+	}
+
+_func_exit_;
+	return _SUCCESS;
+}
+
+
+//struct	sta_info *rtw_alloc_stainfo(_queue *pfree_sta_queue, unsigned char *hwaddr)
+struct	sta_info *rtw_alloc_stainfo(struct	sta_priv *pstapriv, u8 *hwaddr)
+{
+	_irqL irqL, irqL2;
+	uint tmp_aid;
+	s32	index;
+	_list	*phash_list;
+	struct sta_info	*psta;
+	_queue *pfree_sta_queue;
+	struct recv_reorder_ctrl *preorder_ctrl;
+	int i = 0;
+	u16  wRxSeqInitialValue = 0xffff;
+
+_func_enter_;
+
+	pfree_sta_queue = &pstapriv->free_sta_queue;
+
+	//_enter_critical_bh(&(pfree_sta_queue->lock), &irqL);
+	_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL2);
+
+	if (_rtw_queue_empty(pfree_sta_queue) == _TRUE)
+	{
+		//_exit_critical_bh(&(pfree_sta_queue->lock), &irqL);
+		_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL2);
+		psta = NULL;
+	}
+	else
+	{
+		psta = LIST_CONTAINOR(get_next(&pfree_sta_queue->queue), struct sta_info, list);
+
+		rtw_list_delete(&(psta->list));
+
+		//_exit_critical_bh(&(pfree_sta_queue->lock), &irqL);
+
+		tmp_aid = psta->aid;
+
+		_rtw_init_stainfo(psta);
+
+		_rtw_memcpy(psta->hwaddr, hwaddr, ETH_ALEN);
+
+		index = wifi_mac_hash(hwaddr);
+
+		RT_TRACE(_module_rtl871x_sta_mgt_c_,_drv_info_,("rtw_alloc_stainfo: index  = %x", index));
+
+		if(index >= NUM_STA){
+			RT_TRACE(_module_rtl871x_sta_mgt_c_,_drv_err_,("ERROR=> rtw_alloc_stainfo: index >= NUM_STA"));
+			psta= NULL;
+			goto exit;
+		}
+		phash_list = &(pstapriv->sta_hash[index]);
+
+		//_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL2);
+
+		rtw_list_insert_tail(&psta->hash_list, phash_list);
+
+		pstapriv->asoc_sta_count ++ ;
+
+		//_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL2);
+
+// Commented by Albert 2009/08/13
+// For the SMC router, the sequence number of first packet of WPS handshake will be 0.
+// In this case, this packet will be dropped by recv_decache function if we use the 0x00 as the default value for tid_rxseq variable.
+// So, we initialize the tid_rxseq variable as the 0xffff.
+
+		for( i = 0; i < 16; i++ )
+		{
+                     _rtw_memcpy( &psta->sta_recvpriv.rxcache.tid_rxseq[ i ], &wRxSeqInitialValue, 2 );
+		}
+
+		RT_TRACE(_module_rtl871x_sta_mgt_c_,_drv_info_,("alloc number_%d stainfo  with hwaddr = %x %x %x %x %x %x  \n",
+		pstapriv->asoc_sta_count , hwaddr[0], hwaddr[1], hwaddr[2],hwaddr[3],hwaddr[4],hwaddr[5]));
+
+		init_addba_retry_timer(pstapriv->padapter, psta);
+
+#ifdef CONFIG_TDLS
+		psta->padapter = pstapriv->padapter;
+		init_TPK_timer(pstapriv->padapter, psta);
+		init_ch_switch_timer(pstapriv->padapter, psta);
+		init_base_ch_timer(pstapriv->padapter, psta);
+		init_off_ch_timer(pstapriv->padapter, psta);
+		init_handshake_timer(pstapriv->padapter, psta);
+		init_tdls_alive_timer(pstapriv->padapter, psta);
+#endif //CONFIG_TDLS
+
+		//for A-MPDU Rx reordering buffer control
+		for(i=0; i < 16 ; i++)
+		{
+			preorder_ctrl = &psta->recvreorder_ctrl[i];
+
+			preorder_ctrl->padapter = pstapriv->padapter;
+
+			preorder_ctrl->enable = _FALSE;
+
+			preorder_ctrl->indicate_seq = 0xffff;
+			#ifdef DBG_RX_SEQ
+			DBG_871X("DBG_RX_SEQ %s:%d IndicateSeq: %d\n", __FUNCTION__, __LINE__,
+				preorder_ctrl->indicate_seq);
+			#endif
+			preorder_ctrl->wend_b= 0xffff;
+			//preorder_ctrl->wsize_b = (NR_RECVBUFF-2);
+			preorder_ctrl->wsize_b = 64;//64;
+
+			_rtw_init_queue(&preorder_ctrl->pending_recvframe_queue);
+
+			rtw_init_recv_timer(preorder_ctrl);
+		}
+
+
+		//init for DM
+		psta->rssi_stat.UndecoratedSmoothedPWDB = 0;
+		psta->rssi_stat.UndecoratedSmoothedCCK = (-1);
+
+		/* init for the sequence number of received management frame */
+		psta->RxMgmtFrameSeqNum = 0xffff;
+	}
+
+exit:
+
+	_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL2);
+
+_func_exit_;
+
+	return psta;
+
+
+}
+
+
+// using pstapriv->sta_hash_lock to protect
+u32	rtw_free_stainfo(_adapter *padapter , struct sta_info *psta)
+{
+	int i;
+	_irqL irqL0;
+	_queue *pfree_sta_queue;
+	struct recv_reorder_ctrl *preorder_ctrl;
+	struct	sta_xmit_priv	*pstaxmitpriv;
+	struct	xmit_priv	*pxmitpriv= &padapter->xmitpriv;
+	struct	sta_priv *pstapriv = &padapter->stapriv;
+	struct hw_xmit *phwxmit;
+
+
+_func_enter_;
+
+	if (psta == NULL)
+		goto exit;
+
+
+	_enter_critical_bh(&psta->lock, &irqL0);
+	psta->state &= ~_FW_LINKED;
+	_exit_critical_bh(&psta->lock, &irqL0);
+
+	pfree_sta_queue = &pstapriv->free_sta_queue;
+
+
+	pstaxmitpriv = &psta->sta_xmitpriv;
+
+	//rtw_list_delete(&psta->sleep_list);
+
+	//rtw_list_delete(&psta->wakeup_list);
+
+	_enter_critical_bh(&pxmitpriv->lock, &irqL0);
+
+	rtw_free_xmitframe_queue(pxmitpriv, &psta->sleep_q);
+	psta->sleepq_len = 0;
+
+	//vo
+	//_enter_critical_bh(&(pxmitpriv->vo_pending.lock), &irqL0);
+	rtw_free_xmitframe_queue( pxmitpriv, &pstaxmitpriv->vo_q.sta_pending);
+	rtw_list_delete(&(pstaxmitpriv->vo_q.tx_pending));
+	phwxmit = pxmitpriv->hwxmits;
+	phwxmit->accnt -= pstaxmitpriv->vo_q.qcnt;
+	pstaxmitpriv->vo_q.qcnt = 0;
+	//_exit_critical_bh(&(pxmitpriv->vo_pending.lock), &irqL0);
+
+	//vi
+	//_enter_critical_bh(&(pxmitpriv->vi_pending.lock), &irqL0);
+	rtw_free_xmitframe_queue( pxmitpriv, &pstaxmitpriv->vi_q.sta_pending);
+	rtw_list_delete(&(pstaxmitpriv->vi_q.tx_pending));
+	phwxmit = pxmitpriv->hwxmits+1;
+	phwxmit->accnt -= pstaxmitpriv->vi_q.qcnt;
+	pstaxmitpriv->vi_q.qcnt = 0;
+	//_exit_critical_bh(&(pxmitpriv->vi_pending.lock), &irqL0);
+
+	//be
+	//_enter_critical_bh(&(pxmitpriv->be_pending.lock), &irqL0);
+	rtw_free_xmitframe_queue( pxmitpriv, &pstaxmitpriv->be_q.sta_pending);
+	rtw_list_delete(&(pstaxmitpriv->be_q.tx_pending));
+	phwxmit = pxmitpriv->hwxmits+2;
+	phwxmit->accnt -= pstaxmitpriv->be_q.qcnt;
+	pstaxmitpriv->be_q.qcnt = 0;
+	//_exit_critical_bh(&(pxmitpriv->be_pending.lock), &irqL0);
+
+	//bk
+	//_enter_critical_bh(&(pxmitpriv->bk_pending.lock), &irqL0);
+	rtw_free_xmitframe_queue( pxmitpriv, &pstaxmitpriv->bk_q.sta_pending);
+	rtw_list_delete(&(pstaxmitpriv->bk_q.tx_pending));
+	phwxmit = pxmitpriv->hwxmits+3;
+	phwxmit->accnt -= pstaxmitpriv->bk_q.qcnt;
+	pstaxmitpriv->bk_q.qcnt = 0;
+	//_exit_critical_bh(&(pxmitpriv->bk_pending.lock), &irqL0);
+
+	_exit_critical_bh(&pxmitpriv->lock, &irqL0);
+
+	rtw_list_delete(&psta->hash_list);
+	RT_TRACE(_module_rtl871x_sta_mgt_c_,_drv_err_,("\n free number_%d stainfo  with hwaddr = 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x  \n",pstapriv->asoc_sta_count , psta->hwaddr[0], psta->hwaddr[1], psta->hwaddr[2],psta->hwaddr[3],psta->hwaddr[4],psta->hwaddr[5]));
+	pstapriv->asoc_sta_count --;
+
+
+	// re-init sta_info; 20061114 // will be init in alloc_stainfo
+	//_rtw_init_sta_xmit_priv(&psta->sta_xmitpriv);
+	//_rtw_init_sta_recv_priv(&psta->sta_recvpriv);
+
+	_cancel_timer_ex(&psta->addba_retry_timer);
+
+#ifdef CONFIG_TDLS
+	_cancel_timer_ex(&psta->TPK_timer);
+	_cancel_timer_ex(&psta->option_timer);
+	_cancel_timer_ex(&psta->base_ch_timer);
+	_cancel_timer_ex(&psta->off_ch_timer);
+	_cancel_timer_ex(&psta->alive_timer1);
+	_cancel_timer_ex(&psta->alive_timer2);
+#endif //CONFIG_TDLS
+
+	//for A-MPDU Rx reordering buffer control, cancel reordering_ctrl_timer
+	for(i=0; i < 16 ; i++)
+	{
+		_irqL irqL;
+		_list	*phead, *plist;
+		union recv_frame *prframe;
+		_queue *ppending_recvframe_queue;
+		_queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
+
+		preorder_ctrl = &psta->recvreorder_ctrl[i];
+
+		_cancel_timer_ex(&preorder_ctrl->reordering_ctrl_timer);
+
+
+		ppending_recvframe_queue = &preorder_ctrl->pending_recvframe_queue;
+
+		_enter_critical_bh(&ppending_recvframe_queue->lock, &irqL);
+
+		phead = 	get_list_head(ppending_recvframe_queue);
+		plist = get_next(phead);
+
+		while(!rtw_is_list_empty(phead))
+		{
+			prframe = LIST_CONTAINOR(plist, union recv_frame, u);
+
+			plist = get_next(plist);
+
+			rtw_list_delete(&(prframe->u.hdr.list));
+
+			rtw_free_recvframe(prframe, pfree_recv_queue);
+		}
+
+		_exit_critical_bh(&ppending_recvframe_queue->lock, &irqL);
+
+	}
+
+
+#ifdef CONFIG_AP_MODE
+
+/*
+	_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL0);
+	rtw_list_delete(&psta->asoc_list);
+	_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL0);
+*/
+	_enter_critical_bh(&pstapriv->auth_list_lock, &irqL0);
+	if (!rtw_is_list_empty(&psta->auth_list)) {
+		rtw_list_delete(&psta->auth_list);
+		pstapriv->auth_list_cnt--;
+	}
+	_exit_critical_bh(&pstapriv->auth_list_lock, &irqL0);
+
+	psta->expire_to = 0;
+
+	psta->sleepq_ac_len = 0;
+	psta->qos_info = 0;
+
+	psta->max_sp_len = 0;
+	psta->uapsd_bk = 0;
+	psta->uapsd_be = 0;
+	psta->uapsd_vi = 0;
+	psta->uapsd_vo = 0;
+
+	psta->has_legacy_ac = 0;
+
+#ifdef CONFIG_NATIVEAP_MLME
+
+	pstapriv->sta_dz_bitmap &=~BIT(psta->aid);
+	pstapriv->tim_bitmap &=~BIT(psta->aid);
+
+	//rtw_indicate_sta_disassoc_event(padapter, psta);
+
+	if ((psta->aid >0)&&(pstapriv->sta_aid[psta->aid - 1] == psta))
+	{
+		pstapriv->sta_aid[psta->aid - 1] = NULL;
+		psta->aid = 0;
+	}
+
+#endif	// CONFIG_NATIVEAP_MLME
+
+#ifdef CONFIG_TX_MCAST2UNI
+	psta->under_exist_checking = 0;
+#endif	// CONFIG_TX_MCAST2UNI
+
+#endif	// CONFIG_AP_MODE
+
+	 _rtw_spinlock_free(&psta->lock);
+
+	//_enter_critical_bh(&(pfree_sta_queue->lock), &irqL0);
+	rtw_list_insert_tail(&psta->list, get_list_head(pfree_sta_queue));
+	//_exit_critical_bh(&(pfree_sta_queue->lock), &irqL0);
+
+exit:
+
+_func_exit_;
+
+	return _SUCCESS;
+
+}
+
+// free all stainfo which in sta_hash[all]
+void rtw_free_all_stainfo(_adapter *padapter)
+{
+	_irqL	 irqL;
+	_list	*plist, *phead;
+	s32	index;
+	struct sta_info *psta = NULL;
+	struct	sta_priv *pstapriv = &padapter->stapriv;
+	struct sta_info* pbcmc_stainfo =rtw_get_bcmc_stainfo( padapter);
+
+_func_enter_;
+
+	if(pstapriv->asoc_sta_count==1)
+		goto exit;
+
+	_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+	for(index=0; index< NUM_STA; index++)
+	{
+		phead = &(pstapriv->sta_hash[index]);
+		plist = get_next(phead);
+
+		while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+		{
+			psta = LIST_CONTAINOR(plist, struct sta_info ,hash_list);
+
+			plist = get_next(plist);
+
+			if(pbcmc_stainfo!=psta)
+				rtw_free_stainfo(padapter , psta);
+
+		}
+	}
+
+	_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+exit:
+
+_func_exit_;
+
+}
+
+/* any station allocated can be searched by hash list */
+struct sta_info *rtw_get_stainfo(struct sta_priv *pstapriv, const u8 *hwaddr)
+{
+
+	_irqL	 irqL;
+
+	_list	*plist, *phead;
+
+	struct sta_info *psta = NULL;
+
+	u32	index;
+
+	const u8 *addr;
+
+	u8 bc_addr[ETH_ALEN] = {0xff,0xff,0xff,0xff,0xff,0xff};
+
+_func_enter_;
+
+	if(hwaddr==NULL)
+		return NULL;
+
+	if(IS_MCAST(hwaddr))
+	{
+		addr = bc_addr;
+	}
+	else
+	{
+		addr = hwaddr;
+	}
+
+	index = wifi_mac_hash(addr);
+
+	_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+	phead = &(pstapriv->sta_hash[index]);
+	plist = get_next(phead);
+
+
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+	{
+
+		psta = LIST_CONTAINOR(plist, struct sta_info, hash_list);
+
+		if ((_rtw_memcmp(psta->hwaddr, addr, ETH_ALEN))== _TRUE)
+		{ // if found the matched address
+			break;
+		}
+		psta=NULL;
+		plist = get_next(plist);
+	}
+
+	_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+_func_exit_;
+	return psta;
+
+}
+
+u32 rtw_init_bcmc_stainfo(_adapter* padapter)
+{
+
+	struct sta_info 	*psta;
+	struct tx_servq	*ptxservq;
+	u32 res=_SUCCESS;
+	NDIS_802_11_MAC_ADDRESS	bcast_addr= {0xff,0xff,0xff,0xff,0xff,0xff};
+
+	struct	sta_priv *pstapriv = &padapter->stapriv;
+	//_queue	*pstapending = &padapter->xmitpriv.bm_pending;
+
+_func_enter_;
+
+	psta = rtw_alloc_stainfo(pstapriv, bcast_addr);
+
+	if(psta==NULL){
+		res=_FAIL;
+		RT_TRACE(_module_rtl871x_sta_mgt_c_,_drv_err_,("rtw_alloc_stainfo fail"));
+		goto exit;
+	}
+
+	// default broadcast & multicast use macid 1
+	psta->mac_id = 1;
+
+	ptxservq= &(psta->sta_xmitpriv.be_q);
+
+/*
+	_enter_critical(&pstapending->lock, &irqL0);
+
+	if (rtw_is_list_empty(&ptxservq->tx_pending))
+		rtw_list_insert_tail(&ptxservq->tx_pending, get_list_head(pstapending));
+
+	_exit_critical(&pstapending->lock, &irqL0);
+*/
+
+exit:
+_func_exit_;
+	return _SUCCESS;
+
+}
+
+
+struct sta_info* rtw_get_bcmc_stainfo(_adapter* padapter)
+{
+	struct sta_info 	*psta;
+	struct sta_priv 	*pstapriv = &padapter->stapriv;
+	u8 bc_addr[ETH_ALEN] = {0xff,0xff,0xff,0xff,0xff,0xff};
+_func_enter_;
+	 psta = rtw_get_stainfo(pstapriv, bc_addr);
+_func_exit_;
+	return psta;
+
+}
+
+u8 rtw_access_ctrl(_adapter *padapter, u8 *mac_addr)
+{
+	u8 res = _TRUE;
+#ifdef  CONFIG_AP_MODE
+	_irqL irqL;
+	_list	*plist, *phead;
+	struct rtw_wlan_acl_node *paclnode;
+	u8 match = _FALSE;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct wlan_acl_pool *pacl_list = &pstapriv->acl_list;
+	_queue	*pacl_node_q =&pacl_list->acl_node_q;
+
+	_enter_critical_bh(&(pacl_node_q->lock), &irqL);
+	phead = get_list_head(pacl_node_q);
+	plist = get_next(phead);
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+	{
+		paclnode = LIST_CONTAINOR(plist, struct rtw_wlan_acl_node, list);
+		plist = get_next(plist);
+
+		if(_rtw_memcmp(paclnode->addr, mac_addr, ETH_ALEN))
+		{
+			if(paclnode->valid == _TRUE)
+			{
+				match = _TRUE;
+				break;
+			}
+		}
+	}
+	_exit_critical_bh(&(pacl_node_q->lock), &irqL);
+
+
+	if(pacl_list->mode == 1)//accept unless in deny list
+	{
+		res = (match == _TRUE) ?  _FALSE:_TRUE;
+	}
+	else if(pacl_list->mode == 2)//deny unless in accept list
+	{
+		res = (match == _TRUE) ?  _TRUE:_FALSE;
+	}
+	else
+	{
+		 res = _TRUE;
+	}
+
+#endif
+
+	return res;
+
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_tdls.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_tdls.c
new file mode 100644
index 000000000000..c99fc01d2f5b
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_tdls.c
@@ -0,0 +1,2940 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_TDLS_C_
+
+#include <drv_types.h>
+#include <ethernet.h>
+#include <rtw_tdls.h>
+#include <wifi.h>
+
+#ifdef CONFIG_TDLS
+extern unsigned char MCS_rate_2R[16];
+extern unsigned char MCS_rate_1R[16];
+extern void process_wmmps_data(_adapter *padapter, union recv_frame *precv_frame);
+extern s32 rtw_dump_xframe(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+void rtw_reset_tdls_info(_adapter* padapter)
+{
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+
+	ptdlsinfo->ap_prohibited = _FALSE;
+	ptdlsinfo->setup_state = TDLS_STATE_NONE;
+	ptdlsinfo->sta_cnt = 0;
+	ptdlsinfo->sta_maximum = _FALSE;
+	ptdlsinfo->macid_index= 6;
+	ptdlsinfo->clear_cam= 0;
+	ptdlsinfo->ch_sensing = 0;
+	ptdlsinfo->cur_channel = 0;
+	ptdlsinfo->candidate_ch = 1;	//when inplement channel switching, default candidate channel is 1
+	ptdlsinfo->watchdog_count = 0;
+	ptdlsinfo->dev_discovered = 0;
+
+#ifdef CONFIG_WFD
+	ptdlsinfo->wfd_info = &padapter->wfd_info;
+#endif //CONFIG_WFD
+}
+
+int rtw_init_tdls_info(_adapter* padapter)
+{
+	int	res = _SUCCESS;
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+
+	ptdlsinfo->enable = 1;
+	rtw_reset_tdls_info(padapter);
+
+	_rtw_spinlock_init(&ptdlsinfo->cmd_lock);
+	_rtw_spinlock_init(&ptdlsinfo->hdl_lock);
+
+	return res;
+
+}
+
+void rtw_free_tdls_info(struct tdls_info *ptdlsinfo)
+{
+	_rtw_spinlock_free(&ptdlsinfo->cmd_lock);
+	_rtw_spinlock_free(&ptdlsinfo->hdl_lock);
+
+	_rtw_memset(ptdlsinfo, 0, sizeof(struct tdls_info) );
+
+}
+
+void issue_nulldata_to_TDLS_peer_STA(_adapter *padapter, struct sta_info *ptdls_sta, unsigned int power_mode)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+//	SetToDs(fctrl);
+	if (power_mode)
+	{
+		SetPwrMgt(fctrl);
+	}
+
+	_rtw_memcpy(pwlanhdr->addr1, ptdls_sta->hwaddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	ptdls_sta->sta_xmitpriv.txseq_tid[pattrib->priority]++;
+	ptdls_sta->sta_xmitpriv.txseq_tid[pattrib->priority] &= 0xFFF;
+	pattrib->seqnum = ptdls_sta->sta_xmitpriv.txseq_tid[pattrib->priority];
+	SetSeqNum(pwlanhdr, pattrib->seqnum);
+
+	SetFrameSubType(pframe, WIFI_DATA_NULL);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+}
+
+s32 update_tdls_attrib(_adapter *padapter, struct pkt_attrib *pattrib)
+{
+
+	struct sta_info *psta = NULL;
+	struct sta_priv		*pstapriv = &padapter->stapriv;
+	struct security_priv	*psecuritypriv = &padapter->securitypriv;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct qos_priv		*pqospriv= &pmlmepriv->qospriv;
+
+	s32 res=_SUCCESS;
+	sint bmcast;
+
+	bmcast = IS_MCAST(pattrib->ra);
+
+	psta = rtw_get_stainfo(pstapriv, pattrib->ra);
+	if (psta == NULL)	{
+		res =_FAIL;
+		goto exit;
+	}
+
+	pattrib->mac_id = psta->mac_id;
+
+	pattrib->psta = psta;
+
+	pattrib->ack_policy = 0;
+	// get ether_hdr_len
+	pattrib->pkt_hdrlen = ETH_HLEN;//(pattrib->ether_type == 0x8100) ? (14 + 4 ): 14; //vlan tag
+
+	if (pqospriv->qos_option &&  psta->qos_option) {
+		pattrib->priority = 1;	//tdls management frame should be AC_BK
+		pattrib->hdrlen = WLAN_HDR_A3_QOS_LEN;
+		pattrib->subtype = WIFI_QOS_DATA_TYPE;
+	} else {
+		pattrib->hdrlen = WLAN_HDR_A3_LEN;
+		pattrib->subtype = WIFI_DATA_TYPE;
+		pattrib->priority = 0;
+	}
+
+	if (psta->ieee8021x_blocked == _TRUE)
+	{
+		pattrib->encrypt = 0;
+	}
+	else
+	{
+		GET_ENCRY_ALGO(psecuritypriv, psta, pattrib->encrypt, bmcast);
+
+		switch(psecuritypriv->dot11AuthAlgrthm)
+		{
+			case dot11AuthAlgrthm_Open:
+			case dot11AuthAlgrthm_Shared:
+			case dot11AuthAlgrthm_Auto:
+				pattrib->key_idx = (u8)psecuritypriv->dot11PrivacyKeyIndex;
+				break;
+			case dot11AuthAlgrthm_8021X:
+				pattrib->key_idx = 0;
+				break;
+			default:
+				pattrib->key_idx = 0;
+				break;
+		}
+	}
+
+	switch (pattrib->encrypt)
+	{
+		case _WEP40_:
+		case _WEP104_:
+			pattrib->iv_len = 4;
+			pattrib->icv_len = 4;
+			break;
+		case _TKIP_:
+			pattrib->iv_len = 8;
+			pattrib->icv_len = 4;
+			if(padapter->securitypriv.busetkipkey==_FAIL)
+			{
+				res =_FAIL;
+				goto exit;
+			}
+			break;
+		case _AES_:
+			pattrib->iv_len = 8;
+			pattrib->icv_len = 8;
+			break;
+		default:
+			pattrib->iv_len = 0;
+			pattrib->icv_len = 0;
+			break;
+	}
+
+	if (pattrib->encrypt &&
+	    ((padapter->securitypriv.sw_encrypt == _TRUE) || (psecuritypriv->hw_decrypted == _FALSE)))
+	{
+		pattrib->bswenc = _TRUE;
+	} else {
+		pattrib->bswenc = _FALSE;
+	}
+
+	//qos_en, ht_en, init rate, ,bw, ch_offset, sgi
+	pattrib->qos_en = psta->qos_option;
+	pattrib->ht_en = psta->htpriv.ht_option;
+	pattrib->raid = psta->raid;
+	pattrib->bwmode = psta->htpriv.bwmode;
+	pattrib->ch_offset = psta->htpriv.ch_offset;
+	pattrib->sgi= psta->htpriv.sgi;
+	pattrib->ampdu_en = _FALSE;
+
+	//if(pattrib->ht_en && psta->htpriv.ampdu_enable)
+	//{
+	//	if(psta->htpriv.agg_enable_bitmap & BIT(pattrib->priority))
+	//		pattrib->ampdu_en = _TRUE;
+	//}
+
+exit:
+
+	return res;
+}
+
+void free_tdls_sta(_adapter *padapter, struct sta_info *ptdls_sta)
+{
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	_irqL irqL;
+
+	//free peer sta_info
+	_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+	if(ptdlsinfo->sta_cnt != 0)
+		ptdlsinfo->sta_cnt--;
+	_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+	if( ptdlsinfo->sta_cnt < (NUM_STA - 2) )	// -2: AP + BC/MC sta
+	{
+		ptdlsinfo->sta_maximum = _FALSE;
+		_rtw_memset( &ptdlsinfo->ss_record, 0x00, sizeof(struct tdls_ss_record) );
+	}
+	//ready to clear cam
+	if(ptdls_sta->mac_id!=0){
+		ptdlsinfo->clear_cam=ptdls_sta->mac_id;
+		rtw_setstakey_cmd(padapter, (u8 *)ptdls_sta, _TRUE);
+	}
+
+	if(ptdlsinfo->sta_cnt==0){
+		rtw_tdls_cmd(padapter, myid(&(padapter->eeprompriv)), TDLS_RS_RCR);
+		ptdlsinfo->setup_state=TDLS_STATE_NONE;
+	}
+	else
+		DBG_871X("Remain tdls sta:%02x\n", ptdlsinfo->sta_cnt);
+
+	rtw_free_stainfo(padapter,  ptdls_sta);
+
+}
+
+// cam entry will be the same as mac_id
+void rtw_tdls_set_mac_id(struct tdls_info *ptdlsinfo, struct sta_info *ptdls_sta)
+{
+	if(ptdls_sta->mac_id==0)
+	{
+		ptdls_sta->mac_id = ptdlsinfo->macid_index;
+		if( (++ptdlsinfo->macid_index) > (NUM_STA -2) )
+			ptdlsinfo->macid_index= TDLS_INI_MACID_ENTRY;
+	}
+}
+
+//TDLS encryption(if needed) will always be CCMP
+void rtw_tdls_set_key(_adapter *adapter, struct rx_pkt_attrib *prx_pkt_attrib, struct sta_info *ptdls_sta)
+{
+	if(prx_pkt_attrib->encrypt)
+	{
+		ptdls_sta->dot118021XPrivacy=_AES_;
+		rtw_setstakey_cmd(adapter, (u8*)ptdls_sta, _TRUE);
+	}
+}
+
+void rtw_tdls_process_ht_cap(_adapter *adapter, struct sta_info *ptdls_sta, u8 *data, u8 Length)
+{
+	/* save HT capabilities in the sta object */
+	_rtw_memset(&ptdls_sta->htpriv.ht_cap, 0, sizeof(struct rtw_ieee80211_ht_cap));
+	if (data && Length >= sizeof(struct rtw_ieee80211_ht_cap) )
+	{
+		ptdls_sta->flags |= WLAN_STA_HT;
+
+		ptdls_sta->flags |= WLAN_STA_WME;
+
+		_rtw_memcpy(&ptdls_sta->htpriv.ht_cap, data, sizeof(struct rtw_ieee80211_ht_cap));
+
+	} else
+		ptdls_sta->flags &= ~WLAN_STA_HT;
+
+	if(ptdls_sta->flags & WLAN_STA_HT)
+	{
+		if(adapter->registrypriv.ht_enable == _TRUE)
+		{
+			ptdls_sta->htpriv.ht_option = _TRUE;
+		}
+		else
+		{
+			ptdls_sta->htpriv.ht_option = _FALSE;
+			ptdls_sta->stat_code = _STATS_FAILURE_;
+		}
+	}
+
+	//HT related cap
+	if(ptdls_sta->htpriv.ht_option)
+	{
+		//check if sta supports rx ampdu
+		if(adapter->registrypriv.ampdu_enable==1)
+			ptdls_sta->htpriv.ampdu_enable = _TRUE;
+
+		//check if sta support s Short GI
+		if(ptdls_sta->htpriv.ht_cap.cap_info & cpu_to_le16(IEEE80211_HT_CAP_SGI_20|IEEE80211_HT_CAP_SGI_40))
+		{
+			ptdls_sta->htpriv.sgi = _TRUE;
+		}
+
+		// bwmode would still followed AP's setting
+		if(ptdls_sta->htpriv.ht_cap.cap_info & cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH))
+		{
+			ptdls_sta->htpriv.bwmode = adapter->mlmeextpriv.cur_bwmode;
+			ptdls_sta->htpriv.ch_offset = adapter->mlmeextpriv.cur_ch_offset;
+		}
+	}
+}
+
+u8 *rtw_tdls_set_ht_cap(_adapter *padapter, u8 *pframe, struct pkt_attrib *pattrib)
+{
+	struct rtw_ieee80211_ht_cap ht_capie;
+	u8 rf_type;
+
+	//HT capabilities
+	_rtw_memset(&ht_capie, 0, sizeof(struct rtw_ieee80211_ht_cap));
+
+	ht_capie.cap_info = IEEE80211_HT_CAP_SUP_WIDTH |IEEE80211_HT_CAP_SGI_20 |IEEE80211_HT_CAP_SM_PS |
+						IEEE80211_HT_CAP_SGI_40 | IEEE80211_HT_CAP_TX_STBC |IEEE80211_HT_CAP_DSSSCCK40;
+
+	{
+		u32 rx_packet_offset, max_recvbuf_sz;
+		rtw_hal_get_def_var(padapter, HAL_DEF_RX_PACKET_OFFSET, &rx_packet_offset);
+		rtw_hal_get_def_var(padapter, HAL_DEF_MAX_RECVBUF_SZ, &max_recvbuf_sz);
+		if(max_recvbuf_sz-rx_packet_offset>(8191-256))
+			ht_capie.cap_info = ht_capie.cap_info |IEEE80211_HT_CAP_MAX_AMSDU;
+	}
+
+	ht_capie.ampdu_params_info = (IEEE80211_HT_CAP_AMPDU_FACTOR&0x03);
+
+	rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+	switch(rf_type)
+	{
+		case RF_1T1R:
+			ht_capie.cap_info |= 0x0100;//RX STBC One spatial stream
+			_rtw_memcpy(ht_capie.supp_mcs_set, MCS_rate_1R, 16);
+			break;
+
+		case RF_2T2R:
+		case RF_1T2R:
+		default:
+			ht_capie.cap_info|= 0x0200;//RX STBC two spatial stream
+			_rtw_memcpy(ht_capie.supp_mcs_set, MCS_rate_2R, 16);
+			break;
+	}
+
+	return(rtw_set_ie(pframe, _HT_CAPABILITY_IE_,
+						sizeof(struct rtw_ieee80211_ht_cap), (unsigned char*)&ht_capie, &(pattrib->pktlen)));
+}
+
+u8 *rtw_tdls_set_sup_ch(struct mlme_ext_priv *pmlmeext, u8 *pframe, struct pkt_attrib *pattrib)
+{
+	u8 sup_ch[ 30 * 2 ] = { 0x00 }, sup_ch_idx = 0, idx_5g = 2;	//For supported channel
+	do{
+		if( pmlmeext->channel_set[sup_ch_idx].ChannelNum <= 14 )
+		{
+			sup_ch[0] = 1;	//First channel number
+			sup_ch[1] = pmlmeext->channel_set[sup_ch_idx].ChannelNum;	//Number of channel
+		}
+		else
+		{
+			sup_ch[idx_5g++] = pmlmeext->channel_set[sup_ch_idx].ChannelNum;
+			sup_ch[idx_5g++] = 1;
+		}
+
+		sup_ch_idx++;
+	}
+	while( pmlmeext->channel_set[sup_ch_idx].ChannelNum != 0 );
+	return(rtw_set_ie(pframe, _SUPPORTED_CH_IE_, idx_5g, sup_ch, &(pattrib->pktlen)));
+}
+
+#ifdef CONFIG_WFD
+void rtw_tdls_process_wfd_ie(struct tdls_info *ptdlsinfo, u8 *ptr, u8 length)
+{
+	u8	wfd_ie[ 128 ] = { 0x00 };
+	u32	wfd_ielen = 0;
+	u32	wfd_offset = 0;
+	//	Try to get the TCP port information when receiving the negotiation response.
+	//
+
+	wfd_offset = 0;
+	wfd_offset = rtw_get_wfd_ie( ptr + wfd_offset, length - wfd_offset, wfd_ie, &wfd_ielen );
+	while( wfd_offset )
+	{
+		u8	attr_content[ 10 ] = { 0x00 };
+		u32	attr_contentlen = 0;
+		int	i;
+
+		DBG_871X( "[%s] WFD IE Found!!\n", __FUNCTION__ );
+		rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_DEVICE_INFO, attr_content, &attr_contentlen);
+		if ( attr_contentlen )
+		{
+			ptdlsinfo->wfd_info->peer_rtsp_ctrlport = RTW_GET_BE16( attr_content + 2 );
+			DBG_871X( "[%s] Peer PORT NUM = %d\n", __FUNCTION__, ptdlsinfo->wfd_info->peer_rtsp_ctrlport );
+		}
+
+		_rtw_memset( attr_content, 0x00, 10);
+		attr_contentlen = 0;
+		rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_LOCAL_IP_ADDR, attr_content, &attr_contentlen);
+		if ( attr_contentlen )
+		{
+			_rtw_memcpy(ptdlsinfo->wfd_info->peer_ip_address, ( attr_content + 1 ), 4);
+			DBG_871X( "[%s] Peer IP = %02u.%02u.%02u.%02u \n", __FUNCTION__,
+				ptdlsinfo->wfd_info->peer_ip_address[0], ptdlsinfo->wfd_info->peer_ip_address[1],
+				ptdlsinfo->wfd_info->peer_ip_address[2], ptdlsinfo->wfd_info->peer_ip_address[3]
+				);
+		}
+		wfd_offset = rtw_get_wfd_ie( ptr + wfd_offset, length - wfd_offset, wfd_ie, &wfd_ielen );
+	}
+}
+
+void issue_tunneled_probe_req(_adapter *padapter)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	u8 baddr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+
+	DBG_871X("[%s]\n", __FUNCTION__);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;
+
+	_rtw_memcpy(pattrib->dst, baddr, ETH_ALEN);
+
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	update_tdls_attrib(padapter, pattrib);
+	pattrib->qsel=pattrib->priority;
+	if (rtw_xmit_tdls_coalesce(padapter, pmgntframe, TUNNELED_PROBE_REQ) != _SUCCESS) {
+		rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;
+	}
+	rtw_dump_xframe(padapter, pmgntframe);
+
+exit:
+
+	return;
+}
+
+void issue_tunneled_probe_rsp(_adapter *padapter, union recv_frame *precv_frame)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct rx_pkt_attrib	*rx_pkt_pattrib = &precv_frame->u.hdr.attrib;
+
+	DBG_871X("[%s]\n", __FUNCTION__);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;
+
+	_rtw_memcpy(pattrib->dst, rx_pkt_pattrib->src, ETH_ALEN);
+
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	update_tdls_attrib(padapter, pattrib);
+	pattrib->qsel=pattrib->priority;
+	if (rtw_xmit_tdls_coalesce(padapter, pmgntframe, TUNNELED_PROBE_RSP) != _SUCCESS) {
+		rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;
+	}
+	rtw_dump_xframe(padapter, pmgntframe);
+
+exit:
+
+	return;
+}
+#endif //CONFIG_WFD
+
+void issue_tdls_setup_req(_adapter *padapter, u8 *mac_addr)
+{
+	struct tdls_info	*ptdlsinfo = &padapter->tdlsinfo;
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct sta_info *ptdls_sta= NULL;
+	_irqL irqL;
+	static u8 dialogtoken = 0;
+	u32 timeout_interval= TPK_RESEND_COUNT * 1000;	//retry timer should set at least 301 sec, using TPK_count counting 301 times.
+
+	if(ptdlsinfo->ap_prohibited == _TRUE)
+		goto exit;
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;
+
+	_rtw_memcpy(pattrib->dst, mac_addr, ETH_ALEN);
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	update_tdls_attrib(padapter, pattrib);
+
+	//init peer sta_info
+	ptdls_sta = rtw_get_stainfo(pstapriv, mac_addr);
+	if(ptdls_sta==NULL)
+	{
+		ptdls_sta = rtw_alloc_stainfo(pstapriv, mac_addr);
+		if(ptdls_sta)
+		{
+			_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+			if(!(ptdls_sta->tdls_sta_state & TDLS_LINKED_STATE))
+				ptdlsinfo->sta_cnt++;
+			_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+			if( ptdlsinfo->sta_cnt == (NUM_STA - 2) )	// -2: AP + BC/MC sta
+			{
+				ptdlsinfo->sta_maximum  = _TRUE;
+			}
+		}
+		else
+		{
+			rtw_free_xmitbuf(pxmitpriv,pmgntframe->pxmitbuf);
+			rtw_free_xmitframe(pxmitpriv, pmgntframe);
+			goto exit;
+		}
+	}
+
+	if(ptdls_sta){
+		ptdls_sta->tdls_sta_state |= TDLS_RESPONDER_STATE;
+		//for tdls; ptdls_sta->aid is used to fill dialogtoken
+		ptdls_sta->dialog = dialogtoken;
+		dialogtoken = (dialogtoken+1)%256;
+		ptdls_sta->TDLS_PeerKey_Lifetime = timeout_interval;
+		_set_timer( &ptdls_sta->handshake_timer, TDLS_HANDSHAKE_TIME );
+	}
+
+	pattrib->qsel=pattrib->priority;
+	if(rtw_xmit_tdls_coalesce(padapter, pmgntframe, TDLS_SETUP_REQUEST) !=_SUCCESS ){
+		rtw_free_xmitbuf(pxmitpriv,pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;
+	}
+	rtw_dump_xframe(padapter, pmgntframe);
+
+exit:
+
+	return;
+}
+
+void issue_tdls_teardown(_adapter *padapter, u8 *mac_addr)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct sta_info	*ptdls_sta=NULL;
+	_irqL irqL;
+
+	ptdls_sta = rtw_get_stainfo(pstapriv, mac_addr);
+	if(ptdls_sta==NULL){
+		DBG_871X("issue tdls teardown unsuccessful\n");
+		return;
+	}else{
+		ptdls_sta->tdls_sta_state=TDLS_STATE_NONE;
+	}
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;
+
+	_rtw_memcpy(pattrib->dst, mac_addr, ETH_ALEN);
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	update_tdls_attrib(padapter, pattrib);
+	pattrib->qsel=pattrib->priority;
+	if (rtw_xmit_tdls_coalesce(padapter, pmgntframe, TDLS_TEARDOWN) != _SUCCESS) {
+		rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;
+	}
+	rtw_dump_xframe(padapter, pmgntframe);
+
+	if(ptdls_sta->tdls_sta_state & TDLS_CH_SWITCH_ON_STATE){
+		rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_CS_OFF);
+	}
+
+	if( ptdls_sta->timer_flag == 1 )
+	{
+		_enter_critical_bh(&(padapter->tdlsinfo.hdl_lock), &irqL);
+		ptdls_sta->timer_flag = 2;
+		_exit_critical_bh(&(padapter->tdlsinfo.hdl_lock), &irqL);
+	}
+	else
+		rtw_tdls_cmd(padapter, mac_addr, TDLS_FREE_STA );
+
+
+exit:
+
+	return;
+}
+
+void issue_tdls_dis_req(_adapter *padapter, u8 *mac_addr)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	u8 baddr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;
+
+	if(mac_addr == NULL)
+		_rtw_memcpy(pattrib->dst, baddr, ETH_ALEN);
+	else
+		_rtw_memcpy(pattrib->dst, mac_addr, ETH_ALEN);
+
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	update_tdls_attrib(padapter, pattrib);
+	pattrib->qsel=pattrib->priority;
+	if (rtw_xmit_tdls_coalesce(padapter, pmgntframe, TDLS_DISCOVERY_REQUEST) != _SUCCESS) {
+		rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;
+	}
+	rtw_dump_xframe(padapter, pmgntframe);
+	DBG_871X("issue tdls dis req\n");
+
+exit:
+
+	return;
+}
+
+void issue_tdls_setup_rsp(_adapter *padapter, union recv_frame *precv_frame)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct rx_pkt_attrib	*rx_pkt_pattrib = &precv_frame->u.hdr.attrib;
+	_irqL irqL;
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;
+
+	_rtw_memcpy(pattrib->dst, rx_pkt_pattrib->src, ETH_ALEN);
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, rx_pkt_pattrib->bssid, ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	update_tdls_attrib(padapter, pattrib);
+	pattrib->qsel=pattrib->priority;
+	if (rtw_xmit_tdls_coalesce(padapter, pmgntframe, TDLS_SETUP_RESPONSE) != _SUCCESS) {
+		rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;
+	}
+	rtw_dump_xframe(padapter, pmgntframe);
+
+exit:
+
+	return;
+
+}
+
+void issue_tdls_setup_cfm(_adapter *padapter, union recv_frame *precv_frame)
+{
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct sta_info		*ptdls_sta=NULL;
+	_irqL irqL;
+
+	struct rx_pkt_attrib	*rx_pkt_pattrib = & precv_frame->u.hdr.attrib;
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;
+
+	_rtw_memcpy(pattrib->dst, rx_pkt_pattrib->src, ETH_ALEN);
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, rx_pkt_pattrib->bssid, ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	update_tdls_attrib(padapter, pattrib);
+	pattrib->qsel=pattrib->priority;
+	if (rtw_xmit_tdls_coalesce(padapter, pmgntframe, TDLS_SETUP_CONFIRM) != _SUCCESS) {
+		rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;
+	}
+
+	rtw_dump_xframe(padapter, pmgntframe);
+
+exit:
+
+	return;
+
+}
+
+//TDLS Discovery Response frame is a management action frame
+void issue_tdls_dis_rsp(_adapter *padapter, union recv_frame *precv_frame, u8 dialog)
+{
+	struct xmit_frame		*pmgntframe;
+	struct pkt_attrib		*pattrib;
+	unsigned char			*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short		*fctrl;
+	struct xmit_priv		*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+
+	struct rx_pkt_attrib	*rx_pkt_pattrib = &precv_frame->u.hdr.attrib;
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	//	unicast probe request frame
+	_rtw_memcpy(pwlanhdr->addr1, rx_pkt_pattrib->src, ETH_ALEN);
+	_rtw_memcpy(pattrib->dst, pwlanhdr->addr1, ETH_ALEN);
+
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pattrib->src, pwlanhdr->addr2, ETH_ALEN);
+
+	_rtw_memcpy(pwlanhdr->addr3, rx_pkt_pattrib->bssid, ETH_ALEN);
+	_rtw_memcpy(pattrib->ra, pwlanhdr->addr3, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof (struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof (struct rtw_ieee80211_hdr_3addr);
+
+	rtw_build_tdls_dis_rsp_ies(padapter, pmgntframe, pframe, dialog);
+
+	pattrib->nr_frags = 1;
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	dump_mgntframe(padapter, pmgntframe);
+
+	return;
+}
+
+void issue_tdls_peer_traffic_indication(_adapter *padapter, struct sta_info *ptdls_sta)
+{
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+
+	static u8 dialogtoken=0;
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;
+
+	_rtw_memcpy(pattrib->dst, ptdls_sta->hwaddr, ETH_ALEN);
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	//for tdls; pattrib->nr_frags is used to fill dialogtoken
+	ptdls_sta->dialog = dialogtoken;
+	dialogtoken = (dialogtoken+1)%256;
+	//PTI frame's priority should be AC_VO
+	pattrib->priority = 7;
+
+	update_tdls_attrib(padapter, pattrib);
+	pattrib->qsel=pattrib->priority;
+	if (rtw_xmit_tdls_coalesce(padapter, pmgntframe, TDLS_PEER_TRAFFIC_INDICATION) != _SUCCESS) {
+		rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;
+	}
+	rtw_dump_xframe(padapter, pmgntframe);
+
+exit:
+
+	return;
+}
+
+void issue_tdls_ch_switch_req(_adapter *padapter, u8 *mac_addr)
+{
+	struct xmit_frame	*pmgntframe;
+	struct pkt_attrib	*pattrib;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv	*pxmitpriv = &(padapter->xmitpriv);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;
+
+	_rtw_memcpy(pattrib->dst, mac_addr, ETH_ALEN);
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	update_tdls_attrib(padapter, pattrib);
+
+	pattrib->qsel=pattrib->priority;
+	if(rtw_xmit_tdls_coalesce(padapter, pmgntframe, TDLS_CHANNEL_SWITCH_REQUEST) !=_SUCCESS ){
+		rtw_free_xmitbuf(pxmitpriv,pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;
+	}
+	rtw_dump_xframe(padapter, pmgntframe);
+
+exit:
+
+	return;
+}
+
+void issue_tdls_ch_switch_rsp(_adapter *padapter, u8 *mac_addr)
+{
+	struct xmit_frame	*pmgntframe;
+	struct pkt_attrib	*pattrib;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv	*pxmitpriv = &(padapter->xmitpriv);
+
+        _irqL irqL;
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+
+	pmgntframe->frame_tag = DATA_FRAMETAG;
+	pattrib->ether_type = 0x890d;
+	pattrib->pctrl =0;
+
+	_rtw_memcpy(pattrib->dst, mac_addr, ETH_ALEN);
+	_rtw_memcpy(pattrib->src, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	_rtw_memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+
+	update_tdls_attrib(padapter, pattrib);
+
+	pattrib->qsel=pattrib->priority;
+/*
+	_enter_critical_bh(&pxmitpriv->lock, &irqL);
+	if(xmitframe_enqueue_for_tdls_sleeping_sta(padapter, pmgntframe)==_TRUE){
+		_exit_critical_bh(&pxmitpriv->lock, &irqL);
+		return _FALSE;
+	}
+*/
+	if(rtw_xmit_tdls_coalesce(padapter, pmgntframe, TDLS_CHANNEL_SWITCH_RESPONSE) !=_SUCCESS ){
+		rtw_free_xmitbuf(pxmitpriv,pmgntframe->pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pmgntframe);
+		goto exit;
+	}
+	rtw_dump_xframe(padapter, pmgntframe);
+
+exit:
+
+	return;
+}
+
+sint On_TDLS_Dis_Rsp(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct sta_info *ptdls_sta = NULL, *psta = rtw_get_stainfo(&(adapter->stapriv), get_bssid(&(adapter->mlmepriv)));
+	struct recv_priv *precvpriv = &(adapter->recvpriv);
+	u8 *ptr = precv_frame->u.hdr.rx_data, *psa;
+	struct rx_pkt_attrib *pattrib = &(precv_frame->u.hdr.attrib);
+	struct tdls_info *ptdlsinfo = &(adapter->tdlsinfo);
+	u8 empty_addr[ETH_ALEN] = { 0x00 };
+	int UndecoratedSmoothedPWDB;
+
+
+	//WFDTDLS: for sigma test, not to setup direct link automatically
+	ptdlsinfo->dev_discovered = 1;
+
+#ifdef CONFIG_TDLS_AUTOSETUP
+	psa = get_sa(ptr);
+	ptdls_sta = rtw_get_stainfo(&(adapter->stapriv), psa);
+
+	if(ptdls_sta != NULL)
+	{
+		ptdls_sta->tdls_sta_state |= TDLS_ALIVE_STATE;
+
+		//Record the tdls sta with lowest signal strength
+		if( (ptdlsinfo->sta_maximum == _TRUE) && (ptdls_sta->alive_count >= 1) )
+		{
+			if( _rtw_memcmp(ptdlsinfo->ss_record.macaddr, empty_addr, ETH_ALEN) )
+			{
+				_rtw_memcpy(ptdlsinfo->ss_record.macaddr, psa, ETH_ALEN);
+				ptdlsinfo->ss_record.RxPWDBAll = pattrib->RxPWDBAll;
+			}
+			else
+			{
+				if( ptdlsinfo->ss_record.RxPWDBAll < pattrib->RxPWDBAll )
+				{
+					_rtw_memcpy(ptdlsinfo->ss_record.macaddr, psa, ETH_ALEN);
+					ptdlsinfo->ss_record.RxPWDBAll = pattrib->RxPWDBAll;
+				}
+			}
+	}
+
+	}
+	else
+	{
+		if( ptdlsinfo->sta_maximum == _TRUE)
+		{
+			if( _rtw_memcmp( ptdlsinfo->ss_record.macaddr, empty_addr, ETH_ALEN ) )
+			{
+				//All traffics are busy, do not set up another direct link.
+				return _FAIL;
+			}
+			else
+			{
+				if( pattrib->RxPWDBAll > ptdlsinfo->ss_record.RxPWDBAll )
+				{
+					issue_tdls_teardown(adapter, ptdlsinfo->ss_record.macaddr);
+				}
+				else
+				{
+					return _FAIL;
+				}
+			}
+		}
+
+		rtw_hal_get_def_var(adapter, HAL_DEF_UNDERCORATEDSMOOTHEDPWDB, &UndecoratedSmoothedPWDB);
+
+		if( pattrib->RxPWDBAll + TDLS_SIGNAL_THRESH >= UndecoratedSmoothedPWDB);
+		{
+			DBG_871X("pattrib->RxPWDBAll=%d, pdmpriv->UndecoratedSmoothedPWDB=%d\n", pattrib->RxPWDBAll, UndecoratedSmoothedPWDB);
+			issue_tdls_setup_req(adapter, psa);
+		}
+	}
+#endif //CONFIG_TDLS_AUTOSETUP
+
+	return _SUCCESS;
+}
+
+sint On_TDLS_Setup_Req(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct tdls_info *ptdlsinfo = &adapter->tdlsinfo;
+	u8 *psa, *pmyid;
+	struct sta_info *ptdls_sta= NULL;
+	struct sta_priv *pstapriv = &adapter->stapriv;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	struct mlme_priv *pmlmepriv = &(adapter->mlmepriv);
+	struct security_priv *psecuritypriv = &adapter->securitypriv;
+	_irqL irqL;
+	struct rx_pkt_attrib	*prx_pkt_attrib = &precv_frame->u.hdr.attrib;
+	u8 *prsnie, *ppairwise_cipher;
+	u8 i, k, pairwise_count;
+	u8 ccmp_have=0, rsnie_have=0;
+	u16 j;
+	u8 SNonce[32];
+	u32 *timeout_interval;
+	sint parsing_length;	//frame body length, without icv_len
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8 FIXED_IE = 5;
+	unsigned char		supportRate[16];
+	int				supportRateNum = 0;
+
+	psa = get_sa(ptr);
+	ptdls_sta = rtw_get_stainfo(pstapriv, psa);
+
+	pmyid=myid(&(adapter->eeprompriv));
+	ptr +=prx_pkt_attrib->hdrlen + prx_pkt_attrib->iv_len+LLC_HEADER_SIZE+TYPE_LENGTH_FIELD_SIZE+1;
+	parsing_length= ((union recv_frame *)precv_frame)->u.hdr.len
+			-prx_pkt_attrib->hdrlen
+			-prx_pkt_attrib->iv_len
+			-prx_pkt_attrib->icv_len
+			-LLC_HEADER_SIZE
+			-ETH_TYPE_LEN
+			-PAYLOAD_TYPE_LEN
+			-FIXED_IE;
+
+	if(ptdlsinfo->ap_prohibited == _TRUE)
+	{
+		goto exit;
+	}
+
+	if(ptdls_sta==NULL){
+		ptdls_sta = rtw_alloc_stainfo(pstapriv, psa);
+	}else{
+		if(ptdls_sta->tdls_sta_state & TDLS_LINKED_STATE){
+			//If the direct link is already set up
+			//Process as re-setup after tear down
+			DBG_871X("re-setup a direct link\n");
+		}
+		//already receiving TDLS setup request
+		else if(ptdls_sta->tdls_sta_state & TDLS_INITIATOR_STATE){
+			DBG_871X("receive duplicated TDLS setup request frame in handshaking\n");
+			goto exit;
+		}
+		//When receiving and sending setup_req to the same link at the same time, STA with higher MAC_addr would be initiator
+		//following is to check out MAC_addr
+		else if(ptdls_sta->tdls_sta_state & TDLS_RESPONDER_STATE){
+			DBG_871X("receive setup_req after sending setup_req\n");
+			for (i=0;i<6;i++){
+				if(*(pmyid+i)==*(psa+i)){
+				}
+				else if(*(pmyid+i)>*(psa+i)){
+					goto exit;
+				}else if(*(pmyid+i)<*(psa+i)){
+					ptdls_sta->tdls_sta_state=TDLS_INITIATOR_STATE;
+					break;
+				}
+			}
+		}
+	}
+
+	if(ptdls_sta)
+	{
+		ptdls_sta->dialog = *(ptr+2);	//copy dialog token
+		ptdls_sta->stat_code = 0;
+
+		//parsing information element
+		for(j=FIXED_IE; j<parsing_length;){
+
+			pIE = (PNDIS_802_11_VARIABLE_IEs)(ptr+ j);
+
+			switch (pIE->ElementID)
+			{
+				case _SUPPORTEDRATES_IE_:
+					_rtw_memcpy(supportRate, pIE->data, pIE->Length);
+					supportRateNum = pIE->Length;
+					break;
+				case _COUNTRY_IE_:
+					break;
+				case _EXT_SUPPORTEDRATES_IE_:
+					if(supportRateNum<=sizeof(supportRate))
+					{
+						_rtw_memcpy(supportRate+supportRateNum, pIE->data, pIE->Length);
+						supportRateNum += pIE->Length;
+					}
+					break;
+				case _SUPPORTED_CH_IE_:
+					break;
+				case _RSN_IE_2_:
+					rsnie_have=1;
+					if(prx_pkt_attrib->encrypt){
+						prsnie=(u8*)pIE;
+						//check whether initiator STA has CCMP pairwise_cipher.
+						ppairwise_cipher=prsnie+10;
+						_rtw_memcpy(&pairwise_count, (u16*)(ppairwise_cipher-2), 1);
+						for(k=0;k<pairwise_count;k++){
+							if(_rtw_memcmp( ppairwise_cipher+4*k, RSN_CIPHER_SUITE_CCMP, 4)==_TRUE)
+								ccmp_have=1;
+						}
+						if(ccmp_have==0){
+							//invalid contents of RSNIE
+							ptdls_sta->stat_code=72;
+						}
+					}
+					break;
+				case _EXT_CAP_IE_:
+					break;
+				case _VENDOR_SPECIFIC_IE_:
+					break;
+				case _FTIE_:
+					if(prx_pkt_attrib->encrypt)
+						_rtw_memcpy(SNonce, (ptr+j+52), 32);
+					break;
+				case _TIMEOUT_ITVL_IE_:
+					if(prx_pkt_attrib->encrypt)
+						timeout_interval = (u32 *)(ptr+j+3);
+					break;
+				case _RIC_Descriptor_IE_:
+					break;
+				case _HT_CAPABILITY_IE_:
+					rtw_tdls_process_ht_cap(adapter, ptdls_sta, pIE->data, pIE->Length);
+					break;
+				case EID_BSSCoexistence:
+					break;
+				case _LINK_ID_IE_:
+					if(_rtw_memcmp(get_bssid(pmlmepriv), pIE->data, 6) == _FALSE)
+					{
+						//not in the same BSS
+						ptdls_sta->stat_code=7;
+					}
+					break;
+				default:
+					break;
+			}
+
+			j += (pIE->Length + 2);
+
+		}
+
+		//update station supportRate
+		ptdls_sta->bssratelen = supportRateNum;
+		_rtw_memcpy(ptdls_sta->bssrateset, supportRate, supportRateNum);
+
+		//check status code
+		//if responder STA has/hasn't security on AP, but request hasn't/has RSNIE, it should reject
+		if(ptdls_sta->stat_code == 0 )
+		{
+			if(rsnie_have && (prx_pkt_attrib->encrypt==0)){
+				//security disabled
+				ptdls_sta->stat_code = 5;
+			}else if(rsnie_have==0 && (prx_pkt_attrib->encrypt)){
+				//request haven't RSNIE
+				ptdls_sta->stat_code = 38;
+			}
+
+#ifdef CONFIG_WFD
+			//WFD test plan version 0.18.2 test item 5.1.5
+			//SoUT does not use TDLS if AP uses weak security
+			if ( adapter->wdinfo.wfd_tdls_enable )
+			{
+				if(rsnie_have && (prx_pkt_attrib->encrypt != _AES_))
+				{
+					ptdls_sta->stat_code = 5;
+				}
+			}
+#endif //CONFIG_WFD
+		}
+
+		ptdls_sta->tdls_sta_state|= TDLS_INITIATOR_STATE;
+		if(prx_pkt_attrib->encrypt){
+			_rtw_memcpy(ptdls_sta->SNonce, SNonce, 32);
+			_rtw_memcpy(&(ptdls_sta->TDLS_PeerKey_Lifetime), timeout_interval, 4);
+		}
+		_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+		if(!(ptdls_sta->tdls_sta_state & TDLS_LINKED_STATE))
+			ptdlsinfo->sta_cnt++;
+		_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+		if( ptdlsinfo->sta_cnt == (NUM_STA - 2) )	// -2: AP + BC/MC sta
+		{
+			ptdlsinfo->sta_maximum = _TRUE;
+		}
+
+#ifdef CONFIG_WFD
+		rtw_tdls_process_wfd_ie(ptdlsinfo, ptr + FIXED_IE, parsing_length - FIXED_IE);
+#endif // CONFIG_WFD
+
+	}
+	else
+	{
+		goto exit;
+	}
+
+	issue_tdls_setup_rsp(adapter, precv_frame);
+
+	if(ptdls_sta->stat_code==0)
+	{
+		_set_timer( &ptdls_sta->handshake_timer, TDLS_HANDSHAKE_TIME);
+	}
+	else		//status code!=0 ; setup unsuccess
+	{
+		free_tdls_sta(adapter, ptdls_sta);
+	}
+
+exit:
+
+	return _FAIL;
+}
+
+sint On_TDLS_Setup_Rsp(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct tdls_info *ptdlsinfo = &adapter->tdlsinfo;
+	struct sta_info *ptdls_sta= NULL;
+	struct sta_priv *pstapriv = &adapter->stapriv;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	_irqL irqL;
+	struct rx_pkt_attrib	*prx_pkt_attrib = &precv_frame->u.hdr.attrib;
+	u8 *psa;
+	u16 stat_code;
+	sint parsing_length;	//frame body length, without icv_len
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8 FIXED_IE =7;
+	u8  *pftie, *ptimeout_ie, *plinkid_ie, *prsnie, *pftie_mic, *ppairwise_cipher;
+	u16 pairwise_count, j, k;
+	u8 verify_ccmp=0;
+	unsigned char		supportRate[16];
+	int				supportRateNum = 0;
+
+	psa = get_sa(ptr);
+	ptdls_sta = rtw_get_stainfo(pstapriv, psa);
+
+	if ( NULL == ptdls_sta )
+	{
+		return _FAIL;
+	}
+
+	ptr +=prx_pkt_attrib->hdrlen + prx_pkt_attrib->iv_len+LLC_HEADER_SIZE+TYPE_LENGTH_FIELD_SIZE+1;
+	parsing_length= ((union recv_frame *)precv_frame)->u.hdr.len
+			-prx_pkt_attrib->hdrlen
+			-prx_pkt_attrib->iv_len
+			-prx_pkt_attrib->icv_len
+			-LLC_HEADER_SIZE
+			-TYPE_LENGTH_FIELD_SIZE
+			-1
+			-FIXED_IE;
+
+	_rtw_memcpy(&stat_code, ptr+2, 2);
+
+	if(stat_code!=0)
+	{
+		DBG_871X( "[%s] status_code = %d, free_tdls_sta\n", __FUNCTION__, stat_code );
+		free_tdls_sta(adapter, ptdls_sta);
+		return _FAIL;
+	}
+
+	stat_code = 0;
+
+	//parsing information element
+	for(j=FIXED_IE; j<parsing_length;)
+	{
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(ptr+ j);
+
+		switch (pIE->ElementID)
+		{
+			case _SUPPORTEDRATES_IE_:
+				_rtw_memcpy(supportRate, pIE->data, pIE->Length);
+				supportRateNum = pIE->Length;
+				break;
+			case _COUNTRY_IE_:
+				break;
+			case _EXT_SUPPORTEDRATES_IE_:
+				if(supportRateNum<=sizeof(supportRate))
+				{
+					_rtw_memcpy(supportRate+supportRateNum, pIE->data, pIE->Length);
+					supportRateNum += pIE->Length;
+				}
+				break;
+			case _SUPPORTED_CH_IE_:
+				break;
+			case _RSN_IE_2_:
+				prsnie=(u8*)pIE;
+				//check whether responder STA has CCMP pairwise_cipher.
+				ppairwise_cipher=prsnie+10;
+				_rtw_memcpy(&pairwise_count, (u16*)(ppairwise_cipher-2), 2);
+				for(k=0;k<pairwise_count;k++){
+					if(_rtw_memcmp( ppairwise_cipher+4*k, RSN_CIPHER_SUITE_CCMP, 4)==_TRUE)
+						verify_ccmp=1;
+				}
+			case _EXT_CAP_IE_:
+				break;
+			case _VENDOR_SPECIFIC_IE_:
+				break;
+			case _FTIE_:
+				pftie=(u8*)pIE;
+				_rtw_memcpy(ptdls_sta->ANonce, (ptr+j+20), 32);
+				break;
+			case _TIMEOUT_ITVL_IE_:
+				ptimeout_ie=(u8*)pIE;
+				break;
+			case _RIC_Descriptor_IE_:
+				break;
+			case _HT_CAPABILITY_IE_:
+				rtw_tdls_process_ht_cap(adapter, ptdls_sta, pIE->data, pIE->Length);
+				break;
+			case EID_BSSCoexistence:
+				break;
+			case _LINK_ID_IE_:
+				plinkid_ie=(u8*)pIE;
+				break;
+			default:
+				break;
+		}
+
+		j += (pIE->Length + 2);
+
+	}
+
+	//update station supportRate
+	ptdls_sta->bssratelen = supportRateNum;
+	_rtw_memcpy(ptdls_sta->bssrateset, supportRate, supportRateNum);
+
+#ifdef CONFIG_WFD
+	rtw_tdls_process_wfd_ie(ptdlsinfo, ptr + FIXED_IE, parsing_length - FIXED_IE);
+#endif // CONFIG_WFD
+
+	if(stat_code != 0)
+	{
+		ptdls_sta->stat_code = stat_code;
+	}
+	else
+	{
+		if(prx_pkt_attrib->encrypt)
+		{
+			if(verify_ccmp==1)
+			{
+				wpa_tdls_generate_tpk(adapter, ptdls_sta);
+				ptdls_sta->stat_code=0;
+				if(tdls_verify_mic(ptdls_sta->tpk.kck, 2, plinkid_ie, prsnie, ptimeout_ie, pftie)==0)	//0: Invalid, 1: valid
+				{
+					free_tdls_sta(adapter, ptdls_sta);
+					return _FAIL;
+				}
+			}
+			else
+			{
+				ptdls_sta->stat_code=72;	//invalide contents of RSNIE
+			}
+
+		}else{
+			ptdls_sta->stat_code=0;
+		}
+	}
+
+	DBG_871X("issue_tdls_setup_cfm\n");
+	issue_tdls_setup_cfm(adapter, precv_frame);
+
+	if(ptdls_sta->stat_code==0)
+	{
+		ptdlsinfo->setup_state = TDLS_LINKED_STATE;
+
+		if( ptdls_sta->tdls_sta_state & TDLS_RESPONDER_STATE )
+		{
+			ptdls_sta->tdls_sta_state |= TDLS_LINKED_STATE;
+			_cancel_timer_ex( &ptdls_sta->handshake_timer);
+#ifdef CONFIG_TDLS_AUTOCHECKALIVE
+			_set_timer( &ptdls_sta->alive_timer1, TDLS_ALIVE_TIMER_PH1);
+#endif //CONFIG_TDLS_AUTOSETUP
+		}
+
+		rtw_tdls_set_mac_id(ptdlsinfo, ptdls_sta);
+		rtw_tdls_set_key(adapter, prx_pkt_attrib, ptdls_sta);
+
+		rtw_tdls_cmd(adapter, ptdls_sta->hwaddr, TDLS_WRCR);
+
+	}
+	else //status code!=0 ; setup unsuccessful
+	{
+		free_tdls_sta(adapter, ptdls_sta);
+	}
+
+	return _FAIL;
+
+}
+
+sint On_TDLS_Setup_Cfm(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct tdls_info *ptdlsinfo = &adapter->tdlsinfo;
+	struct sta_info *ptdls_sta= NULL;
+	struct sta_priv *pstapriv = &adapter->stapriv;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	_irqL irqL;
+	struct rx_pkt_attrib	*prx_pkt_attrib = &precv_frame->u.hdr.attrib;
+	u8 *psa;
+	u16 stat_code;
+	sint parsing_length;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8 FIXED_IE =5;
+	u8  *pftie, *ptimeout_ie, *plinkid_ie, *prsnie, *pftie_mic, *ppairwise_cipher;
+	u16 j, pairwise_count;
+
+	psa = get_sa(ptr);
+	ptdls_sta = rtw_get_stainfo(pstapriv, psa);
+
+	ptr +=prx_pkt_attrib->hdrlen + prx_pkt_attrib->iv_len+LLC_HEADER_SIZE+TYPE_LENGTH_FIELD_SIZE+1;
+	parsing_length= ((union recv_frame *)precv_frame)->u.hdr.len
+			-prx_pkt_attrib->hdrlen
+			-prx_pkt_attrib->iv_len
+			-prx_pkt_attrib->icv_len
+			-LLC_HEADER_SIZE
+			-ETH_TYPE_LEN
+			-PAYLOAD_TYPE_LEN
+			-FIXED_IE;
+	_rtw_memcpy(&stat_code, ptr+2, 2);
+
+	if(stat_code!=0){
+		DBG_871X( "[%s] stat_code = %d\n, free_tdls_sta", __FUNCTION__, stat_code );
+		free_tdls_sta(adapter, ptdls_sta);
+		return _FAIL;
+	}
+
+	if(prx_pkt_attrib->encrypt){
+		//parsing information element
+		for(j=FIXED_IE; j<parsing_length;){
+
+			pIE = (PNDIS_802_11_VARIABLE_IEs)(ptr+ j);
+
+			switch (pIE->ElementID)
+			{
+				case _RSN_IE_2_:
+					prsnie=(u8*)pIE;
+					break;
+				case _VENDOR_SPECIFIC_IE_:
+					break;
+				case _FTIE_:
+					pftie=(u8*)pIE;
+					break;
+				case _TIMEOUT_ITVL_IE_:
+					ptimeout_ie=(u8*)pIE;
+					break;
+				case _HT_EXTRA_INFO_IE_:
+					break;
+				case _LINK_ID_IE_:
+					plinkid_ie=(u8*)pIE;
+					break;
+				default:
+					break;
+			}
+
+			j += (pIE->Length + 2);
+
+		}
+
+		//verify mic in FTIE MIC field
+		if(tdls_verify_mic(ptdls_sta->tpk.kck, 3, plinkid_ie, prsnie, ptimeout_ie, pftie)==0){	//0: Invalid, 1: Valid
+			free_tdls_sta(adapter, ptdls_sta);
+			return _FAIL;
+		}
+
+	}
+
+	ptdlsinfo->setup_state = TDLS_LINKED_STATE;
+	if( ptdls_sta->tdls_sta_state & TDLS_INITIATOR_STATE )
+	{
+		ptdls_sta->tdls_sta_state|=TDLS_LINKED_STATE;
+		_cancel_timer_ex( &ptdls_sta->handshake_timer);
+#ifdef CONFIG_TDLS_AUTOCHECKALIVE
+		_set_timer( &ptdls_sta->alive_timer1, TDLS_ALIVE_TIMER_PH1);
+#endif //CONFIG_TDLS_AUTOCHECKALIVE
+	}
+
+	rtw_tdls_set_mac_id(ptdlsinfo, ptdls_sta);
+	rtw_tdls_set_key(adapter, prx_pkt_attrib, ptdls_sta);
+
+	rtw_tdls_cmd(adapter, ptdls_sta->hwaddr, TDLS_WRCR);
+
+	return _FAIL;
+
+}
+
+sint On_TDLS_Dis_Req(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct rx_pkt_attrib	*prx_pkt_attrib = &precv_frame->u.hdr.attrib;
+	struct sta_priv *pstapriv = &adapter->stapriv;
+	struct sta_info *psta_ap;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	sint parsing_length;	//frame body length, without icv_len
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8 FIXED_IE = 3, *dst, *pdialog = NULL;
+	u16 j;
+
+	ptr +=prx_pkt_attrib->hdrlen + prx_pkt_attrib->iv_len + LLC_HEADER_SIZE+TYPE_LENGTH_FIELD_SIZE + 1;
+	pdialog=ptr+2;
+
+	parsing_length= ((union recv_frame *)precv_frame)->u.hdr.len
+			-prx_pkt_attrib->hdrlen
+			-prx_pkt_attrib->iv_len
+			-prx_pkt_attrib->icv_len
+			-LLC_HEADER_SIZE
+			-TYPE_LENGTH_FIELD_SIZE
+			-1
+			-FIXED_IE;
+
+	//parsing information element
+	for(j=FIXED_IE; j<parsing_length;){
+
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(ptr+ j);
+
+		switch (pIE->ElementID)
+		{
+			case _LINK_ID_IE_:
+				psta_ap = rtw_get_stainfo(pstapriv, pIE->data);
+				if(psta_ap == NULL)
+				{
+					goto exit;
+				}
+				dst = pIE->data + 12;
+				if( (MacAddr_isBcst(dst) == _FALSE) && (_rtw_memcmp(myid(&(adapter->eeprompriv)), dst, 6) == _FALSE) )
+				{
+					goto exit;
+				}
+				break;
+			default:
+				break;
+		}
+
+		j += (pIE->Length + 2);
+
+	}
+
+	//check frame contents
+
+	issue_tdls_dis_rsp(adapter, precv_frame, *(pdialog) );
+
+exit:
+
+	return _FAIL;
+
+}
+
+sint On_TDLS_Teardown(_adapter *adapter, union recv_frame *precv_frame)
+{
+	u8 *psa;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	struct rx_pkt_attrib	*prx_pkt_attrib = &precv_frame->u.hdr.attrib;
+	struct mlme_ext_priv	*pmlmeext = &(adapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct sta_priv 	*pstapriv = &adapter->stapriv;
+	struct sta_info *ptdls_sta= NULL;
+	_irqL irqL;
+
+	psa = get_sa(ptr);
+
+	ptdls_sta = rtw_get_stainfo(pstapriv, psa);
+	if(ptdls_sta!=NULL){
+		if(ptdls_sta->tdls_sta_state & TDLS_CH_SWITCH_ON_STATE){
+			rtw_tdls_cmd(adapter, ptdls_sta->hwaddr, TDLS_CS_OFF);
+		}
+		free_tdls_sta(adapter, ptdls_sta);
+	}
+
+	return _FAIL;
+
+}
+
+u8 TDLS_check_ch_state(uint state){
+	if(	(state & TDLS_CH_SWITCH_ON_STATE) &&
+		(state & TDLS_AT_OFF_CH_STATE) &&
+		(state & TDLS_PEER_AT_OFF_STATE) ){
+
+		if(state & TDLS_PEER_SLEEP_STATE)
+			return 2;	//U-APSD + ch. switch
+		else
+			return 1;	//ch. switch
+	}else
+		return 0;
+}
+
+//we process buffered data for 1. U-APSD, 2. ch. switch, 3. U-APSD + ch. switch here
+sint On_TDLS_Peer_Traffic_Rsp(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct tdls_info *ptdlsinfo = &adapter->tdlsinfo;
+	struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
+	struct rx_pkt_attrib	*pattrib = & precv_frame->u.hdr.attrib;
+	struct sta_priv *pstapriv = &adapter->stapriv;
+	//get peer sta infomation
+	struct sta_info *ptdls_sta = rtw_get_stainfo(pstapriv, pattrib->src);
+	u8 wmmps_ac=0, state=TDLS_check_ch_state(ptdls_sta->tdls_sta_state);
+	int i;
+
+	ptdls_sta->sta_stats.rx_data_pkts++;
+
+	//receive peer traffic response frame, sleeping STA wakes up
+	//ptdls_sta->tdls_sta_state &= ~(TDLS_PEER_SLEEP_STATE);
+	process_wmmps_data( adapter, precv_frame);
+
+	// if noticed peer STA wakes up by receiving peer traffic response
+	// and we want to do channel swtiching, then we will transmit channel switch request first
+	if(ptdls_sta->tdls_sta_state & TDLS_APSD_CHSW_STATE){
+		issue_tdls_ch_switch_req(adapter, pattrib->src);
+		ptdls_sta->tdls_sta_state &= ~(TDLS_APSD_CHSW_STATE);
+		return  _FAIL;
+	}
+
+	//check 4-AC queue bit
+	if(ptdls_sta->uapsd_vo || ptdls_sta->uapsd_vi || ptdls_sta->uapsd_be || ptdls_sta->uapsd_bk)
+		wmmps_ac=1;
+
+	//if it's a direct link and have buffered frame
+	if(ptdls_sta->tdls_sta_state & TDLS_LINKED_STATE){
+		if(wmmps_ac && state)
+		{
+			_irqL irqL;
+			_list	*xmitframe_plist, *xmitframe_phead;
+			struct xmit_frame *pxmitframe=NULL;
+
+			_enter_critical_bh(&ptdls_sta->sleep_q.lock, &irqL);
+
+			xmitframe_phead = get_list_head(&ptdls_sta->sleep_q);
+			xmitframe_plist = get_next(xmitframe_phead);
+
+			//transmit buffered frames
+			while ((rtw_end_of_queue_search(xmitframe_phead, xmitframe_plist)) == _FALSE)
+			{
+				pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
+				xmitframe_plist = get_next(xmitframe_plist);
+				rtw_list_delete(&pxmitframe->list);
+
+				ptdls_sta->sleepq_len--;
+				if(ptdls_sta->sleepq_len>0){
+					pxmitframe->attrib.mdata = 1;
+					pxmitframe->attrib.eosp = 0;
+				}else{
+					pxmitframe->attrib.mdata = 0;
+					pxmitframe->attrib.eosp = 1;
+				}
+				//pxmitframe->attrib.triggered = 1;	//maybe doesn't need in TDLS
+				if(rtw_hal_xmit(adapter, pxmitframe) == _TRUE)
+				{
+					rtw_os_xmit_complete(adapter, pxmitframe);
+				}
+
+			}
+
+			if(ptdls_sta->sleepq_len==0)
+			{
+				DBG_871X("no buffered packets for tdls to xmit\n");
+				//on U-APSD + CH. switch state, when there is no buffered date to xmit,
+				// we should go back to base channel
+				if(state==2){
+					rtw_tdls_cmd(adapter, ptdls_sta->hwaddr, TDLS_CS_OFF);
+				}else if(ptdls_sta->tdls_sta_state&TDLS_SW_OFF_STATE){
+						ptdls_sta->tdls_sta_state &= ~(TDLS_SW_OFF_STATE);
+						ptdlsinfo->candidate_ch= pmlmeext->cur_channel;
+						issue_tdls_ch_switch_req(adapter, pattrib->src);
+						DBG_871X("issue tdls ch switch req back to base channel\n");
+				}
+
+			}
+			else
+			{
+				DBG_871X("error!psta->sleepq_len=%d\n", ptdls_sta->sleepq_len);
+				ptdls_sta->sleepq_len=0;
+			}
+
+			_exit_critical_bh(&ptdls_sta->sleep_q.lock, &irqL);
+
+		}
+
+	}
+
+	return _FAIL;
+}
+
+sint On_TDLS_Ch_Switch_Req(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct sta_info *ptdls_sta= NULL;
+	struct sta_priv *pstapriv = &adapter->stapriv;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	struct rx_pkt_attrib	*prx_pkt_attrib = &precv_frame->u.hdr.attrib;
+	u8 *psa;
+	sint parsing_length;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8 FIXED_IE =3;
+	u16 j;
+	struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
+
+	psa = get_sa(ptr);
+	ptdls_sta = rtw_get_stainfo(pstapriv, psa);
+
+	ptr +=prx_pkt_attrib->hdrlen + prx_pkt_attrib->iv_len+LLC_HEADER_SIZE+TYPE_LENGTH_FIELD_SIZE+1;
+	parsing_length= ((union recv_frame *)precv_frame)->u.hdr.len
+			-prx_pkt_attrib->hdrlen
+			-prx_pkt_attrib->iv_len
+			-prx_pkt_attrib->icv_len
+			-LLC_HEADER_SIZE
+			-ETH_TYPE_LEN
+			-PAYLOAD_TYPE_LEN
+			-FIXED_IE;
+
+	ptdls_sta->off_ch = *(ptr+2);
+
+	//parsing information element
+	for(j=FIXED_IE; j<parsing_length;){
+
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(ptr+ j);
+
+		switch (pIE->ElementID)
+		{
+			case _COUNTRY_IE_:
+				break;
+			case _CH_SWTICH_ANNOUNCE_:
+				break;
+			case _LINK_ID_IE_:
+				break;
+			case _CH_SWITCH_TIMING_:
+				_rtw_memcpy(&ptdls_sta->ch_switch_time, pIE->data, 2);
+				_rtw_memcpy(&ptdls_sta->ch_switch_timeout, pIE->data+2, 2);
+			default:
+				break;
+		}
+
+		j += (pIE->Length + 2);
+
+	}
+
+	//todo: check status
+	ptdls_sta->stat_code=0;
+	ptdls_sta->tdls_sta_state |= TDLS_CH_SWITCH_ON_STATE;
+
+	issue_nulldata(adapter, NULL, 1, 0, 0);
+
+	issue_tdls_ch_switch_rsp(adapter, psa);
+
+	DBG_871X("issue tdls channel switch response\n");
+
+	if((ptdls_sta->tdls_sta_state & TDLS_CH_SWITCH_ON_STATE) && ptdls_sta->off_ch==pmlmeext->cur_channel){
+		DBG_871X("back to base channel %x\n", pmlmeext->cur_channel);
+		ptdls_sta->option=7;
+		rtw_tdls_cmd(adapter, ptdls_sta->hwaddr, TDLS_BASE_CH);
+	}else{
+		ptdls_sta->option=6;
+		rtw_tdls_cmd(adapter, ptdls_sta->hwaddr, TDLS_OFF_CH);
+	}
+	return _FAIL;
+}
+
+sint On_TDLS_Ch_Switch_Rsp(_adapter *adapter, union recv_frame *precv_frame)
+{
+	struct sta_info *ptdls_sta= NULL;
+	struct sta_priv *pstapriv = &adapter->stapriv;
+	u8 *ptr = precv_frame->u.hdr.rx_data;
+	struct rx_pkt_attrib	*prx_pkt_attrib = &precv_frame->u.hdr.attrib;
+	u8 *psa;
+	sint parsing_length;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8 FIXED_IE =4;
+	u16 stat_code, j, switch_time, switch_timeout;
+	struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
+
+	psa = get_sa(ptr);
+	ptdls_sta = rtw_get_stainfo(pstapriv, psa);
+
+	//if channel switch is running and receiving Unsolicited TDLS Channel Switch Response,
+	//it will go back to base channel and terminate this channel switch procedure
+	if(ptdls_sta->tdls_sta_state & TDLS_CH_SWITCH_ON_STATE ){
+		if(pmlmeext->cur_channel==ptdls_sta->off_ch){
+			DBG_871X("back to base channel %x\n", pmlmeext->cur_channel);
+			ptdls_sta->option=7;
+			rtw_tdls_cmd(adapter, ptdls_sta->hwaddr, TDLS_OFF_CH);
+		}else{
+			DBG_871X("receive unsolicited channel switch response \n");
+			rtw_tdls_cmd(adapter, ptdls_sta->hwaddr, TDLS_CS_OFF);
+		}
+		return _FAIL;
+	}
+
+	//avoiding duplicated or unconditional ch. switch. rsp
+	if((ptdls_sta->tdls_sta_state & TDLS_CH_SW_INITIATOR_STATE) != TDLS_CH_SW_INITIATOR_STATE)
+		return _FAIL;
+
+	ptr +=prx_pkt_attrib->hdrlen + prx_pkt_attrib->iv_len+LLC_HEADER_SIZE+TYPE_LENGTH_FIELD_SIZE+1;
+	parsing_length= ((union recv_frame *)precv_frame)->u.hdr.len
+			-prx_pkt_attrib->hdrlen
+			-prx_pkt_attrib->iv_len
+			-prx_pkt_attrib->icv_len
+			-LLC_HEADER_SIZE
+			-ETH_TYPE_LEN
+			-PAYLOAD_TYPE_LEN
+			-FIXED_IE;
+
+	_rtw_memcpy(&stat_code, ptr+2, 2);
+
+	if(stat_code!=0){
+		return _FAIL;
+	}
+
+	//parsing information element
+	for(j=FIXED_IE; j<parsing_length;){
+
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(ptr+ j);
+
+		switch (pIE->ElementID)
+		{
+			case _LINK_ID_IE_:
+				break;
+			case _CH_SWITCH_TIMING_:
+				_rtw_memcpy(&switch_time, pIE->data, 2);
+				if(switch_time > ptdls_sta->ch_switch_time)
+					_rtw_memcpy(&ptdls_sta->ch_switch_time, &switch_time, 2);
+
+				_rtw_memcpy(&switch_timeout, pIE->data+2, 2);
+				if(switch_timeout > ptdls_sta->ch_switch_timeout)
+					_rtw_memcpy(&ptdls_sta->ch_switch_timeout, &switch_timeout, 2);
+
+			default:
+				break;
+		}
+
+		j += (pIE->Length + 2);
+
+	}
+
+	ptdls_sta->tdls_sta_state &= ~(TDLS_CH_SW_INITIATOR_STATE);
+	ptdls_sta->tdls_sta_state |=TDLS_CH_SWITCH_ON_STATE;
+
+	//goto set_channel_workitem_callback()
+	ptdls_sta->option=6;
+	rtw_tdls_cmd(adapter, ptdls_sta->hwaddr, TDLS_OFF_CH);
+
+	return _FAIL;
+}
+
+#ifdef CONFIG_WFD
+void wfd_ie_tdls(_adapter * padapter, u8 *pframe, u32 *pktlen )
+{
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wifi_display_info	*pwfd_info = padapter->tdlsinfo.wfd_info;
+	u8 wfdie[ MAX_WFD_IE_LEN] = { 0x00 };
+	u32 wfdielen = 0;
+
+	//	WFD OUI
+	wfdielen = 0;
+	wfdie[ wfdielen++ ] = 0x50;
+	wfdie[ wfdielen++ ] = 0x6F;
+	wfdie[ wfdielen++ ] = 0x9A;
+	wfdie[ wfdielen++ ] = 0x0A;	//	WFA WFD v1.0
+
+	//	Commented by Albert 20110825
+	//	According to the WFD Specification, the negotiation request frame should contain 3 WFD attributes
+	//	1. WFD Device Information
+	//	2. Associated BSSID ( Optional )
+	//	3. Local IP Adress ( Optional )
+
+	//	WFD Device Information ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value1:
+	//	WFD device information
+	//	available for WFD session + Preferred TDLS + WSD ( WFD Service Discovery )
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->wfd_device_type | WFD_DEVINFO_SESSION_AVAIL
+								| WFD_DEVINFO_PC_TDLS | WFD_DEVINFO_WSD);
+	wfdielen += 2;
+
+	//	Value2:
+	//	Session Management Control Port
+	//	Default TCP port for RTSP messages is 554
+	RTW_PUT_BE16(wfdie + wfdielen, pwfd_info->rtsp_ctrlport );
+	wfdielen += 2;
+
+	//	Value3:
+	//	WFD Device Maximum Throughput
+	//	300Mbps is the maximum throughput
+	RTW_PUT_BE16(wfdie + wfdielen, 300);
+	wfdielen += 2;
+
+	//	Associated BSSID ATTR
+	//	Type:
+	wfdie[ wfdielen++ ] = WFD_ATTR_ASSOC_BSSID;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0006);
+	wfdielen += 2;
+
+	//	Value:
+	//	Associated BSSID
+	if ( check_fwstate( pmlmepriv, _FW_LINKED) == _TRUE )
+	{
+		_rtw_memcpy( wfdie + wfdielen, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+	}
+	else
+	{
+		_rtw_memset( wfdie + wfdielen, 0x00, ETH_ALEN );
+	}
+
+	//	Local IP Address ATTR
+	wfdie[ wfdielen++ ] = WFD_ATTR_LOCAL_IP_ADDR;
+
+	//	Length:
+	//	Note: In the WFD specification, the size of length field is 2.
+	RTW_PUT_BE16(wfdie + wfdielen, 0x0005);
+	wfdielen += 2;
+
+	//	Version:
+	//	0x01: Version1;IPv4
+	wfdie[ wfdielen++ ] = 0x01;
+
+	//	IPv4 Address
+	_rtw_memcpy( wfdie + wfdielen, pwfd_info->ip_address, 4 );
+	wfdielen += 4;
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, wfdielen, (unsigned char *) wfdie, pktlen);
+
+}
+#endif //CONFIG_WFD
+
+void rtw_build_tdls_setup_req_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &pmlmeext->mlmext_info;
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	struct registry_priv	*pregistrypriv = &padapter->registrypriv;
+	struct sta_info *ptdls_sta=rtw_get_stainfo( (&padapter->stapriv) , pattrib->dst);
+
+	u8 payload_type = 0x02;
+	u8 category = RTW_WLAN_CATEGORY_TDLS;
+	u8 action = TDLS_SETUP_REQUEST;
+	u8 bssrate[NDIS_802_11_LENGTH_RATES_EX]; //Use NDIS_802_11_LENGTH_RATES_EX in order to call func.rtw_set_supported_rate
+	int	bssrate_len = 0, i = 0 ;
+	u8 more_supportedrates = 0;
+	unsigned int ie_len;
+	u8 *p;
+	struct mlme_priv 		*pmlmepriv = &padapter->mlmepriv;
+	u8 link_id_addr[18] = {0};
+	u8 iedata=0;
+	u8 sup_ch[ 30 * 2 ] = {0x00 }, sup_ch_idx = 0, idx_5g = 2;	//For supported channel
+	u8 timeout_itvl[5];	//set timeout interval to maximum value
+	u32 time;
+
+	//SNonce
+	if(pattrib->encrypt){
+		for(i=0;i<8;i++){
+			time=rtw_get_current_time();
+			_rtw_memcpy(&ptdls_sta->SNonce[4*i], (u8 *)&time, 4);
+		}
+	}
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));
+	//category, action, dialog token
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(ptdls_sta->dialog), &(pattrib->pktlen));
+
+	//capability
+	_rtw_memcpy(pframe, rtw_get_capability_from_ie(pmlmeinfo->network.IEs), 2);
+
+	if(pattrib->encrypt)
+		*pframe =*pframe | BIT(4);
+	pframe += 2;
+	pattrib->pktlen += 2;
+
+	//supported rates
+	rtw_set_supported_rate(bssrate, WIRELESS_11BG_24N);
+	bssrate_len = IEEE80211_CCK_RATE_LEN + IEEE80211_NUM_OFDM_RATESLEN;
+
+	if (bssrate_len > 8)
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , 8, bssrate, &(pattrib->pktlen));
+		more_supportedrates = 1;
+	}
+	else
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , bssrate_len , bssrate, &(pattrib->pktlen));
+	}
+
+	//country(optional)
+	//extended supported rates
+	if(more_supportedrates==1){
+		pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_ , (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
+	}
+
+	//supported channels
+	pframe = rtw_tdls_set_sup_ch(pmlmeext, pframe, pattrib);
+
+	//	SRC IE
+	pframe = rtw_set_ie( pframe, _SRC_IE_, 16, TDLS_SRC, &(pattrib->pktlen));
+
+	//RSNIE
+	if(pattrib->encrypt)
+		pframe = rtw_set_ie(pframe, _RSN_IE_2_, 20, TDLS_RSNIE, &(pattrib->pktlen));
+
+	//extended capabilities
+	pframe = rtw_set_ie(pframe, _EXT_CAP_IE_ , 5, TDLS_EXT_CAPIE, &(pattrib->pktlen));
+
+	//QoS capability(WMM_IE)
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 7, TDLS_WMMIE,  &(pattrib->pktlen));
+
+
+	if(pattrib->encrypt){
+		//FTIE
+		_rtw_memset(pframe, 0, 84);	//All fields except SNonce shall be set to 0
+		_rtw_memset(pframe, _FTIE_, 1);	//version
+		_rtw_memset((pframe+1), 82, 1);	//length
+		_rtw_memcpy((pframe+52), ptdls_sta->SNonce, 32);
+		pframe += 84;
+		pattrib->pktlen += 84;
+
+		//Timeout interval
+		timeout_itvl[0]=0x02;
+		_rtw_memcpy(timeout_itvl+1, (u8 *)(&ptdls_sta->TDLS_PeerKey_Lifetime), 4);
+		pframe = rtw_set_ie(pframe, _TIMEOUT_ITVL_IE_, 5, timeout_itvl,  &(pattrib->pktlen));
+	}
+
+	//Sup_reg_classes(optional)
+	//HT capabilities
+	pframe = rtw_tdls_set_ht_cap(padapter, pframe, pattrib);
+
+	//20/40 BSS coexistence
+	if(pmlmepriv->num_FortyMHzIntolerant>0)
+		iedata |= BIT(2);//20 MHz BSS Width Request
+	pframe = rtw_set_ie(pframe, EID_BSSCoexistence,  1, &iedata, &(pattrib->pktlen));
+
+	//Link identifier
+	_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+	_rtw_memcpy((link_id_addr+6), pattrib->src, 6);
+	_rtw_memcpy((link_id_addr+12), pattrib->dst, 6);
+	pframe = rtw_set_ie(pframe, _LINK_ID_IE_,  18, link_id_addr, &(pattrib->pktlen));
+
+#ifdef CONFIG_WFD
+	wfd_ie_tdls( padapter, pframe, &(pattrib->pktlen) );
+#endif //CONFIG_WFD
+
+}
+
+void rtw_build_tdls_setup_rsp_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	struct sta_info *ptdls_sta;
+	struct registry_priv	*pregistrypriv = &padapter->registrypriv;
+
+	u8 payload_type = 0x02;
+	unsigned char category = RTW_WLAN_CATEGORY_TDLS;
+	unsigned char action = TDLS_SETUP_RESPONSE;
+	unsigned char	bssrate[NDIS_802_11_LENGTH_RATES_EX];
+	int	bssrate_len = 0;
+	u8 more_supportedrates = 0;
+	unsigned int ie_len;
+	unsigned char *p;
+	struct mlme_priv 		*pmlmepriv = &padapter->mlmepriv;
+	u8 link_id_addr[18] = {0};
+	u8 iedata=0;
+	u8 timeout_itvl[5];	//setup response timeout interval will copy from request
+	u8 ANonce[32];	//maybe it can put in ontdls_req
+	u8 k;		//for random ANonce
+	u8  *pftie, *ptimeout_ie, *plinkid_ie, *prsnie, *pftie_mic;
+	u32 time;
+
+	ptdls_sta = rtw_get_stainfo( &(padapter->stapriv) , pattrib->dst);
+
+	if(ptdls_sta == NULL )
+	{
+		DBG_871X("[%s] %d\n", __FUNCTION__, __LINE__);
+		return;
+	}
+
+	if(pattrib->encrypt){
+		for(k=0;k<8;k++){
+			time=rtw_get_current_time();
+			_rtw_memcpy(&ptdls_sta->ANonce[4*k], (u8*)&time, 4);
+		}
+	}
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));
+	//category, action, status code
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 2, (u8 *)&ptdls_sta->stat_code, &(pattrib->pktlen));
+
+	if(ptdls_sta->stat_code!=0)	//invalid setup request
+	{
+		DBG_871X("ptdls_sta->stat_code:%04x \n", ptdls_sta->stat_code);
+		return;
+	}
+
+	//dialog token
+	pframe = rtw_set_fixed_ie(pframe, 1, &(ptdls_sta->dialog), &(pattrib->pktlen));
+
+	//capability
+	_rtw_memcpy(pframe, rtw_get_capability_from_ie(pmlmeinfo->network.IEs), 2);
+
+	if(pattrib->encrypt )
+		*pframe =*pframe | BIT(4);
+	pframe += 2;
+	pattrib->pktlen += 2;
+
+	//supported rates
+	rtw_set_supported_rate(bssrate, WIRELESS_11BG_24N);
+	bssrate_len = IEEE80211_CCK_RATE_LEN + IEEE80211_NUM_OFDM_RATESLEN;
+
+	if (bssrate_len > 8)
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , 8, bssrate, &(pattrib->pktlen));
+		more_supportedrates = 1;
+	}
+	else
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , bssrate_len , bssrate, &(pattrib->pktlen));
+	}
+
+	//country(optional)
+	//extended supported rates
+	if(more_supportedrates==1){
+		pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_ , (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
+	}
+
+	//supported channels
+	pframe = rtw_tdls_set_sup_ch(pmlmeext, pframe, pattrib);
+
+	// SRC IE
+	pframe = rtw_set_ie(pframe, _SRC_IE_ , 16, TDLS_SRC, &(pattrib->pktlen));
+
+	//RSNIE
+	if(pattrib->encrypt){
+		prsnie = pframe;
+		pframe = rtw_set_ie(pframe, _RSN_IE_2_, 20, TDLS_RSNIE, &(pattrib->pktlen));
+	}
+
+	//extended capabilities
+	pframe = rtw_set_ie(pframe, _EXT_CAP_IE_ , 5, TDLS_EXT_CAPIE, &(pattrib->pktlen));
+
+	//QoS capability(WMM_IE)
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 7, TDLS_WMMIE,  &(pattrib->pktlen));
+
+	if(pattrib->encrypt){
+		wpa_tdls_generate_tpk(padapter, ptdls_sta);
+
+		//FTIE
+		pftie = pframe;
+		pftie_mic = pframe+4;
+		_rtw_memset(pframe, 0, 84);	//All fields except SNonce shall be set to 0
+		_rtw_memset(pframe, _FTIE_, 1);	//version
+		_rtw_memset((pframe+1), 82, 1);	//length
+		_rtw_memcpy((pframe+20), ptdls_sta->ANonce, 32);
+		_rtw_memcpy((pframe+52), ptdls_sta->SNonce, 32);
+		pframe += 84;
+		pattrib->pktlen += 84;
+
+		//Timeout interval
+		ptimeout_ie = pframe;
+		timeout_itvl[0]=0x02;
+		_rtw_memcpy(timeout_itvl+1, (u8 *)(&ptdls_sta->TDLS_PeerKey_Lifetime), 4);
+		pframe = rtw_set_ie(pframe, _TIMEOUT_ITVL_IE_, 5, timeout_itvl,  &(pattrib->pktlen));
+	}
+
+	//Sup_reg_classes(optional)
+	//HT capabilities
+	pframe = rtw_tdls_set_ht_cap(padapter, pframe, pattrib);
+
+	//20/40 BSS coexistence
+	if(pmlmepriv->num_FortyMHzIntolerant>0)
+		iedata |= BIT(2);//20 MHz BSS Width Request
+	pframe = rtw_set_ie(pframe, EID_BSSCoexistence,  1, &iedata, &(pattrib->pktlen));
+
+	//Link identifier
+	plinkid_ie = pframe;
+	_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+	_rtw_memcpy((link_id_addr+6), pattrib->dst, 6);
+	_rtw_memcpy((link_id_addr+12), pattrib->src, 6);
+	pframe = rtw_set_ie(pframe, _LINK_ID_IE_,  18, link_id_addr, &(pattrib->pktlen));
+
+	//fill FTIE mic
+	if(pattrib->encrypt)
+		wpa_tdls_ftie_mic(ptdls_sta->tpk.kck, 2, plinkid_ie, prsnie, ptimeout_ie, pftie, pftie_mic);
+
+#ifdef CONFIG_WFD
+	wfd_ie_tdls( padapter, pframe, &(pattrib->pktlen) );
+#endif //CONFIG_WFD
+
+}
+
+void rtw_build_tdls_setup_cfm_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	struct sta_info *ptdls_sta=rtw_get_stainfo( (&padapter->stapriv) , pattrib->dst);
+
+	u8 payload_type = 0x02;
+	unsigned char category = RTW_WLAN_CATEGORY_TDLS;
+	unsigned char action = TDLS_SETUP_CONFIRM;
+	u8 more_supportedrates = 0;
+	unsigned int ie_len;
+	unsigned char *p;
+	u8 timeout_itvl[5];	//set timeout interval to maximum value
+	struct mlme_priv 		*pmlmepriv = &padapter->mlmepriv;
+	u8	link_id_addr[18] = {0};
+	u8  *pftie, *ptimeout_ie, *plinkid_ie, *prsnie, *pftie_mic;
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));
+	//category, action, status code, dialog token
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 2, (u8 *)&ptdls_sta->stat_code, &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(ptdls_sta->dialog), &(pattrib->pktlen));
+
+	if(ptdls_sta->stat_code!=0)	//invalid setup request
+		return;
+
+	//RSNIE
+	if(pattrib->encrypt){
+		prsnie = pframe;
+		pframe = rtw_set_ie(pframe, _RSN_IE_2_, 20, TDLS_RSNIE, &(pattrib->pktlen));
+	}
+
+	//EDCA param set; WMM param ele.
+	if(pattrib->encrypt){
+		//FTIE
+		pftie = pframe;
+		pftie_mic = pframe+4;
+		_rtw_memset(pframe, 0, 84);	//All fields except SNonce shall be set to 0
+		_rtw_memset(pframe, _FTIE_, 1);	//version
+		_rtw_memset((pframe+1), 82, 1);	//length
+		_rtw_memcpy((pframe+20), ptdls_sta->ANonce, 32);
+		_rtw_memcpy((pframe+52), ptdls_sta->SNonce, 32);
+		pframe += 84;
+		pattrib->pktlen += 84;
+
+		//Timeout interval
+		ptimeout_ie = pframe;
+		timeout_itvl[0]=0x02;
+		_rtw_memcpy(timeout_itvl+1, (u8 *)(&ptdls_sta->TDLS_PeerKey_Lifetime), 4);
+		ptdls_sta->TPK_count=0;
+		_set_timer(&ptdls_sta->TPK_timer, ptdls_sta->TDLS_PeerKey_Lifetime/TPK_RESEND_COUNT);
+		pframe = rtw_set_ie(pframe, _TIMEOUT_ITVL_IE_, 5, timeout_itvl,  &(pattrib->pktlen));
+	}
+
+	//HT operation; todo
+	//Link identifier
+	plinkid_ie = pframe;
+	_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+	_rtw_memcpy((link_id_addr+6), pattrib->src, 6);
+	_rtw_memcpy((link_id_addr+12), pattrib->dst, 6);
+	pframe = rtw_set_ie(pframe, _LINK_ID_IE_,  18, link_id_addr, &(pattrib->pktlen));
+
+	//fill FTIE mic
+	if(pattrib->encrypt)
+		wpa_tdls_ftie_mic(ptdls_sta->tpk.kck, 3, plinkid_ie, prsnie, ptimeout_ie, pftie, pftie_mic);
+
+}
+
+void rtw_build_tdls_teardown_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	u8 payload_type = 0x02;
+	unsigned char category = RTW_WLAN_CATEGORY_TDLS;
+	unsigned char action = TDLS_TEARDOWN;
+	u8	link_id_addr[18] = {0};
+
+	struct sta_info *ptdls_sta = rtw_get_stainfo( &(padapter->stapriv) , pattrib->dst);
+	struct sta_priv 	*pstapriv = &padapter->stapriv;
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));
+	//category, action, reason code
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, (u8 *)&ptdls_sta->stat_code, &(pattrib->pktlen));
+
+	//Link identifier
+	if(ptdls_sta->tdls_sta_state & TDLS_INITIATOR_STATE){
+		_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+		_rtw_memcpy((link_id_addr+6), pattrib->src, 6);
+		_rtw_memcpy((link_id_addr+12), pattrib->dst, 6);
+	}else  if(ptdls_sta->tdls_sta_state & TDLS_RESPONDER_STATE){
+		_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+		_rtw_memcpy((link_id_addr+6), pattrib->dst, 6);
+		_rtw_memcpy((link_id_addr+12), pattrib->src, 6);
+	}
+	pframe = rtw_set_ie(pframe, _LINK_ID_IE_,  18, link_id_addr, &(pattrib->pktlen));
+
+}
+
+void rtw_build_tdls_dis_req_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	u8 payload_type = 0x02;
+	u8 category = RTW_WLAN_CATEGORY_TDLS;
+	u8 action = TDLS_DISCOVERY_REQUEST;
+	u8	link_id_addr[18] = {0};
+	static u8 dialogtoken=0;
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));
+	//category, action, reason code
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialogtoken), &(pattrib->pktlen));
+	dialogtoken = (dialogtoken+1)%256;
+
+	//Link identifier
+	_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+	_rtw_memcpy((link_id_addr+6), pattrib->src, 6);
+	_rtw_memcpy((link_id_addr+12), pattrib->dst, 6);
+	pframe = rtw_set_ie(pframe, _LINK_ID_IE_,  18, link_id_addr, &(pattrib->pktlen));
+
+}
+
+void rtw_build_tdls_dis_rsp_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe, u8 dialog)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &pmlmeext->mlmext_info;
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	struct registry_priv	*pregistrypriv = &padapter->registrypriv;
+
+	u8 category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8 action = TDLS_DISCOVERY_RESPONSE;
+	u8 bssrate[NDIS_802_11_LENGTH_RATES_EX];
+	int bssrate_len = 0;
+	u8 more_supportedrates = 0;
+	u8 *p;
+	struct mlme_priv 		*pmlmepriv = &padapter->mlmepriv;
+	u8 link_id_addr[18] = {0};
+	u8 iedata=0;
+	u8 timeout_itvl[5];	//set timeout interval to maximum value
+	u32 timeout_interval= TPK_RESEND_COUNT * 1000;
+
+	//category, action, dialog token
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialog), &(pattrib->pktlen));
+
+	//capability
+	_rtw_memcpy(pframe, rtw_get_capability_from_ie(pmlmeinfo->network.IEs), 2);
+
+	if(pattrib->encrypt)
+		*pframe =*pframe | BIT(4);
+	pframe += 2;
+	pattrib->pktlen += 2;
+
+	//supported rates
+	rtw_set_supported_rate(bssrate, WIRELESS_11BG_24N);
+	bssrate_len = IEEE80211_CCK_RATE_LEN + IEEE80211_NUM_OFDM_RATESLEN;
+
+	if (bssrate_len > 8)
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , 8, bssrate, &(pattrib->pktlen));
+		more_supportedrates = 1;
+	}
+	else
+	{
+		pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , bssrate_len , bssrate, &(pattrib->pktlen));
+	}
+
+	//extended supported rates
+	if(more_supportedrates==1){
+		pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_ , (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
+	}
+
+	//supported channels
+	pframe = rtw_tdls_set_sup_ch(pmlmeext, pframe, pattrib);
+
+	//RSNIE
+	if(pattrib->encrypt)
+		pframe = rtw_set_ie(pframe, _RSN_IE_2_, 20, TDLS_RSNIE, &(pattrib->pktlen));
+
+	//extended capability
+	pframe = rtw_set_ie(pframe, _EXT_CAP_IE_ , 5, TDLS_EXT_CAPIE, &(pattrib->pktlen));
+
+	if(pattrib->encrypt){
+		//FTIE
+		_rtw_memset(pframe, 0, 84);	//All fields shall be set to 0
+		_rtw_memset(pframe, _FTIE_, 1);	//version
+		_rtw_memset((pframe+1), 82, 1);	//length
+		pframe += 84;
+		pattrib->pktlen += 84;
+
+		//Timeout interval
+		timeout_itvl[0]=0x02;
+		_rtw_memcpy(timeout_itvl+1, &timeout_interval, 4);
+		pframe = rtw_set_ie(pframe, _TIMEOUT_ITVL_IE_, 5, timeout_itvl,  &(pattrib->pktlen));
+	}
+
+	//Sup_reg_classes(optional)
+	//HT capabilities
+	pframe = rtw_tdls_set_ht_cap(padapter, pframe, pattrib);
+
+	//20/40 BSS coexistence
+	if(pmlmepriv->num_FortyMHzIntolerant>0)
+		iedata |= BIT(2);//20 MHz BSS Width Request
+	pframe = rtw_set_ie(pframe, EID_BSSCoexistence, 1, &iedata, &(pattrib->pktlen));
+
+	//Link identifier
+	_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+	_rtw_memcpy((link_id_addr+6), pattrib->dst, 6);
+	_rtw_memcpy((link_id_addr+12), pattrib->src, 6);
+	pframe = rtw_set_ie(pframe, _LINK_ID_IE_, 18, link_id_addr, &(pattrib->pktlen));
+
+}
+
+void rtw_build_tdls_peer_traffic_indication_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	u8 payload_type = 0x02;
+	unsigned char category = RTW_WLAN_CATEGORY_TDLS;
+	unsigned char action = TDLS_PEER_TRAFFIC_INDICATION;
+
+	u8	link_id_addr[18] = {0};
+	u8 AC_queue=0;
+	struct sta_priv 	*pstapriv = &padapter->stapriv;
+	struct sta_info *ptdls_sta = rtw_get_stainfo(pstapriv, pattrib->dst);
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));
+	//category, action, reason code
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(ptdls_sta->dialog), &(pattrib->pktlen));
+
+	//Link identifier
+	_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+	_rtw_memcpy((link_id_addr+6), pattrib->src, 6);
+	_rtw_memcpy((link_id_addr+12), pattrib->dst, 6);
+	pframe = rtw_set_ie(pframe, _LINK_ID_IE_,  18, link_id_addr, &(pattrib->pktlen));
+
+	//PTI control
+	//PU buffer status
+	if(ptdls_sta->uapsd_bk&BIT(1))
+		AC_queue=BIT(0);
+	if(ptdls_sta->uapsd_be&BIT(1))
+		AC_queue=BIT(1);
+	if(ptdls_sta->uapsd_vi&BIT(1))
+		AC_queue=BIT(2);
+	if(ptdls_sta->uapsd_vo&BIT(1))
+		AC_queue=BIT(3);
+	pframe = rtw_set_ie(pframe, _PTI_BUFFER_STATUS_, 1, &AC_queue, &(pattrib->pktlen));
+
+}
+
+void rtw_build_tdls_ch_switch_req_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	u8 payload_type = 0x02;
+	unsigned char category = RTW_WLAN_CATEGORY_TDLS;
+	unsigned char action = TDLS_CHANNEL_SWITCH_REQUEST;
+	u8	link_id_addr[18] = {0};
+	struct sta_priv 	*pstapriv = &padapter->stapriv;
+	struct sta_info *ptdls_sta = rtw_get_stainfo(pstapriv, pattrib->dst);
+	u8 ch_switch_timing[4] = {0};
+	u16 switch_time= CH_SWITCH_TIME, switch_timeout=CH_SWITCH_TIMEOUT;
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));
+	//category, action, target_ch
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(ptdlsinfo->candidate_ch), &(pattrib->pktlen));
+
+	//Link identifier
+	_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+	_rtw_memcpy((link_id_addr+6), pattrib->src, 6);
+	_rtw_memcpy((link_id_addr+12), pattrib->dst, 6);
+	pframe = rtw_set_ie(pframe, _LINK_ID_IE_,  18, link_id_addr, &(pattrib->pktlen));
+
+	//ch switch timing
+	_rtw_memcpy(ch_switch_timing, &switch_time, 2);
+	_rtw_memcpy(ch_switch_timing+2, &switch_timeout, 2);
+	pframe = rtw_set_ie(pframe, _CH_SWITCH_TIMING_,  4, ch_switch_timing, &(pattrib->pktlen));
+
+	//update ch switch attrib to sta_info
+	ptdls_sta->off_ch=ptdlsinfo->candidate_ch;
+	ptdls_sta->ch_switch_time=switch_time;
+	ptdls_sta->ch_switch_timeout=switch_timeout;
+
+}
+
+void rtw_build_tdls_ch_switch_rsp_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	u8 payload_type = 0x02;
+	unsigned char category = RTW_WLAN_CATEGORY_TDLS;
+	unsigned char action = TDLS_CHANNEL_SWITCH_RESPONSE;
+	u8	link_id_addr[18] = {0};
+	struct sta_priv 	*pstapriv = &padapter->stapriv;
+	struct sta_info *ptdls_sta = rtw_get_stainfo(pstapriv, pattrib->dst);
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
+	u8 ch_switch_timing[4] = {0};
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));
+	//category, action, status_code
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 2, (u8 *)&ptdls_sta->stat_code, &(pattrib->pktlen));
+
+	//Link identifier
+	_rtw_memcpy(link_id_addr, pattrib->ra, 6);
+	_rtw_memcpy((link_id_addr+6), pattrib->src, 6);
+	_rtw_memcpy((link_id_addr+12), pattrib->dst, 6);
+	pframe = rtw_set_ie(pframe, _LINK_ID_IE_,  18, link_id_addr, &(pattrib->pktlen));
+
+	//ch switch timing
+	_rtw_memcpy(ch_switch_timing, &ptdls_sta->ch_switch_time, 2);
+	_rtw_memcpy(ch_switch_timing+2, &ptdls_sta->ch_switch_timeout, 2);
+	pframe = rtw_set_ie(pframe, _CH_SWITCH_TIMING_,  4, ch_switch_timing, &(pattrib->pktlen));
+
+}
+
+#ifdef CONFIG_WFD
+void rtw_build_tunneled_probe_req_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	struct wifidirect_info *pwdinfo = &padapter->wdinfo;
+	struct wifidirect_info *pbuddy_wdinfo = &padapter->pbuddy_adapter->wdinfo;
+	u8 payload_type = 0x02;
+	u8 category = RTW_WLAN_CATEGORY_P2P;
+	u8 WFA_OUI[3] = { 0x50, 0x6f, 0x9a};
+	u8 probe_req = 4;
+	u8 wfdielen = 0;
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));
+	//category, OUI, frame_body_type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 3, WFA_OUI, &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(probe_req), &(pattrib->pktlen));
+
+	if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		wfdielen = build_probe_req_wfd_ie(pwdinfo, pframe);
+		pframe += wfdielen;
+		pattrib->pktlen += wfdielen;
+	}
+	else if(!rtw_p2p_chk_state(pbuddy_wdinfo, P2P_STATE_NONE))
+	{
+		wfdielen = build_probe_req_wfd_ie(pbuddy_wdinfo, pframe);
+		pframe += wfdielen;
+		pattrib->pktlen += wfdielen;
+	}
+
+}
+
+void rtw_build_tunneled_probe_rsp_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe)
+{
+
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	struct wifidirect_info *pwdinfo = &padapter->wdinfo;
+	struct wifidirect_info *pbuddy_wdinfo = &padapter->pbuddy_adapter->wdinfo;
+	u8 payload_type = 0x02;
+	u8 category = RTW_WLAN_CATEGORY_P2P;
+	u8 WFA_OUI[3] = { 0x50, 0x6f, 0x9a};
+	u8 probe_rsp = 5;
+	u8 wfdielen = 0;
+
+	//payload type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(payload_type), &(pattrib->pktlen));
+	//category, OUI, frame_body_type
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 3, WFA_OUI, &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(probe_rsp), &(pattrib->pktlen));
+
+	if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		wfdielen = build_probe_resp_wfd_ie(pwdinfo, pframe, 1);
+		pframe += wfdielen;
+		pattrib->pktlen += wfdielen;
+	}
+	else if(!rtw_p2p_chk_state(pbuddy_wdinfo, P2P_STATE_NONE))
+	{
+		wfdielen = build_probe_resp_wfd_ie(pbuddy_wdinfo, pframe, 1);
+		pframe += wfdielen;
+		pattrib->pktlen += wfdielen;
+	}
+
+}
+#endif //CONFIG_WFD
+
+void _TPK_timer_hdl(void *FunctionContext)
+{
+	struct sta_info *ptdls_sta = (struct sta_info *)FunctionContext;
+
+	ptdls_sta->TPK_count++;
+	//TPK_timer set 1000 as default
+	//retry timer should set at least 301 sec.
+	if(ptdls_sta->TPK_count==TPK_RESEND_COUNT){
+		ptdls_sta->TPK_count=0;
+		issue_tdls_setup_req(ptdls_sta->padapter, ptdls_sta->hwaddr);
+	}
+
+	_set_timer(&ptdls_sta->TPK_timer, ptdls_sta->TDLS_PeerKey_Lifetime/TPK_RESEND_COUNT);
+}
+
+void init_TPK_timer(_adapter *padapter, struct sta_info *psta)
+{
+	psta->padapter=padapter;
+
+	_init_timer(&psta->TPK_timer, padapter->pnetdev, _TPK_timer_hdl, psta);
+}
+
+// TDLS_DONE_CH_SEN: channel sensing and report candidate channel
+// TDLS_OFF_CH: first time set channel to off channel
+// TDLS_BASE_CH: when go back to the channel linked with AP, send null data to peer STA as an indication
+void _ch_switch_timer_hdl(void *FunctionContext)
+{
+
+	struct sta_info *ptdls_sta = (struct sta_info *)FunctionContext;
+	_adapter *padapter = ptdls_sta->padapter;
+
+	if( ptdls_sta->option == TDLS_DONE_CH_SEN ){
+		rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_DONE_CH_SEN);
+	}else if( ptdls_sta->option == TDLS_OFF_CH ){
+		issue_nulldata_to_TDLS_peer_STA(ptdls_sta->padapter, ptdls_sta, 0);
+		_set_timer(&ptdls_sta->base_ch_timer, 500);
+	}else if( ptdls_sta->option == TDLS_BASE_CH){
+		issue_nulldata_to_TDLS_peer_STA(ptdls_sta->padapter, ptdls_sta, 0);
+	}
+}
+
+void init_ch_switch_timer(_adapter *padapter, struct sta_info *psta)
+{
+	psta->padapter=padapter;
+	_init_timer(&psta->option_timer, padapter->pnetdev, _ch_switch_timer_hdl, psta);
+}
+
+void _base_ch_timer_hdl(void *FunctionContext)
+{
+	struct sta_info *ptdls_sta = (struct sta_info *)FunctionContext;
+	rtw_tdls_cmd(ptdls_sta->padapter, ptdls_sta->hwaddr, TDLS_P_OFF_CH);
+}
+
+void init_base_ch_timer(_adapter *padapter, struct sta_info *psta)
+{
+	psta->padapter=padapter;
+	_init_timer(&psta->base_ch_timer, padapter->pnetdev, _base_ch_timer_hdl, psta);
+}
+
+void _off_ch_timer_hdl(void *FunctionContext)
+{
+	struct sta_info *ptdls_sta = (struct sta_info *)FunctionContext;
+	rtw_tdls_cmd(ptdls_sta->padapter, ptdls_sta->hwaddr, TDLS_P_BASE_CH );
+}
+
+void init_off_ch_timer(_adapter *padapter, struct sta_info *psta)
+{
+	psta->padapter=padapter;
+	_init_timer(&psta->off_ch_timer, padapter->pnetdev, _off_ch_timer_hdl, psta);
+}
+
+void _tdls_handshake_timer_hdl(void *FunctionContext)
+{
+	struct sta_info *ptdls_sta = (struct sta_info *)FunctionContext;
+
+	if(ptdls_sta != NULL)
+	{
+		if( !(ptdls_sta->tdls_sta_state & TDLS_LINKED_STATE) )
+		{
+			DBG_871X("tdls handshake time out\n");
+			free_tdls_sta(ptdls_sta->padapter, ptdls_sta);
+		}
+	}
+}
+
+void init_handshake_timer(_adapter *padapter, struct sta_info *psta)
+{
+	psta->padapter=padapter;
+	_init_timer(&psta->handshake_timer, padapter->pnetdev, _tdls_handshake_timer_hdl, psta);
+}
+
+//Check tdls peer sta alive.
+void _tdls_alive_timer_phase1_hdl(void *FunctionContext)
+{
+	_irqL irqL;
+	struct sta_info *ptdls_sta = (struct sta_info *)FunctionContext;
+	_adapter *padapter = ptdls_sta->padapter;
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+
+	_enter_critical_bh(&ptdlsinfo->hdl_lock, &irqL);
+	ptdls_sta->timer_flag = 1;
+	_exit_critical_bh(&ptdlsinfo->hdl_lock, &irqL);
+
+	ptdls_sta->tdls_sta_state &= (~TDLS_ALIVE_STATE);
+
+	DBG_871X("issue_tdls_dis_req to check alive\n");
+	issue_tdls_dis_req( padapter, ptdls_sta->hwaddr);
+	rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_CKALV_PH1);
+	sta_update_last_rx_pkts(ptdls_sta);
+
+	if (	ptdls_sta->timer_flag == 2 )
+		rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_FREE_STA);
+	else
+	{
+		_enter_critical_bh(&ptdlsinfo->hdl_lock, &irqL);
+		ptdls_sta->timer_flag = 0;
+		_exit_critical_bh(&ptdlsinfo->hdl_lock, &irqL);
+	}
+
+}
+
+void _tdls_alive_timer_phase2_hdl(void *FunctionContext)
+{
+	_irqL irqL;
+	struct sta_info *ptdls_sta = (struct sta_info *)FunctionContext;
+	_adapter *padapter = ptdls_sta->padapter;
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+
+	_enter_critical_bh(&(ptdlsinfo->hdl_lock), &irqL);
+	ptdls_sta->timer_flag = 1;
+	_exit_critical_bh(&ptdlsinfo->hdl_lock, &irqL);
+
+	if( (ptdls_sta->tdls_sta_state & TDLS_ALIVE_STATE) &&
+		(sta_last_rx_pkts(ptdls_sta) + 3 <= sta_rx_pkts(ptdls_sta)) )
+	{
+		DBG_871X("TDLS STA ALIVE, ptdls_sta->sta_stats.last_rx_pkts:%llu, ptdls_sta->sta_stats.rx_pkts:%llu\n",
+			sta_last_rx_pkts(ptdls_sta), sta_rx_pkts(ptdls_sta));
+
+		ptdls_sta->alive_count = 0;
+		rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_CKALV_PH2);
+	}
+	else
+	{
+		if( !(ptdls_sta->tdls_sta_state & TDLS_ALIVE_STATE) )
+			DBG_871X("TDLS STA TOO FAR\n");
+		if( !(sta_last_rx_pkts(ptdls_sta) + 3 <= sta_rx_pkts(ptdls_sta)))
+			DBG_871X("TDLS LINK WITH LOW TRAFFIC, ptdls_sta->sta_stats.last_rx_pkts:%llu, ptdls_sta->sta_stats.rx_pkts:%llu\n",
+				sta_last_rx_pkts(ptdls_sta), sta_rx_pkts(ptdls_sta));
+
+		ptdls_sta->alive_count++;
+		if( ptdls_sta->alive_count == TDLS_ALIVE_COUNT )
+		{
+			ptdls_sta->stat_code = _RSON_TDLS_TEAR_TOOFAR_;
+			issue_tdls_teardown(padapter, ptdls_sta->hwaddr);
+		}
+		else
+		{
+			rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_CKALV_PH2);
+		}
+	}
+
+	if (	ptdls_sta->timer_flag == 2 )
+		rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_FREE_STA);
+	else
+	{
+		_enter_critical_bh(&(ptdlsinfo->hdl_lock), &irqL);
+		ptdls_sta->timer_flag = 0;
+		_exit_critical_bh(&ptdlsinfo->hdl_lock, &irqL);
+}
+
+}
+
+void init_tdls_alive_timer(_adapter *padapter, struct sta_info *psta)
+{
+	psta->padapter=padapter;
+	_init_timer(&psta->alive_timer1, padapter->pnetdev, _tdls_alive_timer_phase1_hdl, psta);
+	_init_timer(&psta->alive_timer2, padapter->pnetdev, _tdls_alive_timer_phase2_hdl, psta);
+}
+
+int update_sgi_tdls(_adapter *padapter, struct sta_info *psta)
+{
+	struct ht_priv	*psta_ht = NULL;
+	psta_ht = &psta->htpriv;
+
+	if(psta_ht->ht_option)
+	{
+		return psta_ht->sgi;
+	}
+	else
+		return _FALSE;
+}
+
+u32 update_mask_tdls(_adapter *padapter, struct sta_info *psta)
+{
+	int i;
+	u8 rf_type, id;
+	unsigned char sta_band = 0;
+	unsigned char limit;
+	unsigned int tx_ra_bitmap=0;
+	struct ht_priv	*psta_ht = NULL;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	WLAN_BSSID_EX *pcur_network = (WLAN_BSSID_EX *)&pmlmepriv->cur_network.network;
+
+	psta_ht = &psta->htpriv;
+	//b/g mode ra_bitmap
+	for (i=0; i<sizeof(psta->bssrateset); i++)
+	{
+		if (psta->bssrateset[i])
+			tx_ra_bitmap |= rtw_get_bit_value_from_ieee_value(psta->bssrateset[i]&0x7f);
+	}
+
+	//n mode ra_bitmap
+	if(psta_ht->ht_option)
+	{
+		rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+		if(rf_type == RF_2T2R)
+			limit=16;// 2R
+		else
+			limit=8;//  1R
+
+		for (i=0; i<limit; i++) {
+			if (psta_ht->ht_cap.supp_mcs_set[i/8] & BIT(i%8))
+				tx_ra_bitmap |= BIT(i+12);
+		}
+	}
+
+	if ( pcur_network->Configuration.DSConfig > 14 ) {
+		// 5G band
+		if (tx_ra_bitmap & 0xffff000)
+			sta_band |= WIRELESS_11_5N | WIRELESS_11A;
+		else
+			sta_band |= WIRELESS_11A;
+	} else {
+		if (tx_ra_bitmap & 0xffff000)
+			sta_band |= WIRELESS_11_24N | WIRELESS_11G | WIRELESS_11B;
+		else if (tx_ra_bitmap & 0xff0)
+			sta_band |= WIRELESS_11G |WIRELESS_11B;
+		else
+			sta_band |= WIRELESS_11B;
+	}
+
+	id = networktype_to_raid(sta_band);
+	tx_ra_bitmap |= ((id<<28)&0xf0000000);
+	return tx_ra_bitmap;
+}
+
+#endif //CONFIG_TDLS
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_wlan_util.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_wlan_util.c
new file mode 100644
index 000000000000..c977cd1eedef
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_wlan_util.c
@@ -0,0 +1,2304 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_WLAN_UTIL_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <wifi.h>
+
+
+unsigned char ARTHEROS_OUI1[] = {0x00, 0x03, 0x7f};
+unsigned char ARTHEROS_OUI2[] = {0x00, 0x13, 0x74};
+
+unsigned char BROADCOM_OUI1[] = {0x00, 0x10, 0x18};
+unsigned char BROADCOM_OUI2[] = {0x00, 0x0a, 0xf7};
+unsigned char BROADCOM_OUI3[] = {0x00, 0x05, 0xb5};
+
+unsigned char CISCO_OUI[] = {0x00, 0x40, 0x96};
+unsigned char MARVELL_OUI[] = {0x00, 0x50, 0x43};
+unsigned char RALINK_OUI[] = {0x00, 0x0c, 0x43};
+unsigned char REALTEK_OUI[] = {0x00, 0xe0, 0x4c};
+unsigned char AIRGOCAP_OUI[] = {0x00, 0x0a, 0xf5};
+
+unsigned char REALTEK_96B_IE[] = {0x00, 0xe0, 0x4c, 0x02, 0x01, 0x20};
+
+extern unsigned char	MCS_rate_2R[16];
+#ifdef CONFIG_DISABLE_MCS13TO15
+extern unsigned char	MCS_rate_2R_MCS13TO15_OFF[16];
+#endif //CONFIG_DISABLE_MCS13TO15
+extern unsigned char	MCS_rate_1R[16];
+extern unsigned char RTW_WPA_OUI[];
+extern unsigned char WPA_TKIP_CIPHER[4];
+extern unsigned char RSN_TKIP_CIPHER[4];
+
+#define R2T_PHY_DELAY	(0)
+
+//#define WAIT_FOR_BCN_TO_MIN	(3000)
+#define WAIT_FOR_BCN_TO_MIN	(6000)
+#define WAIT_FOR_BCN_TO_MAX	(20000)
+
+static u8 rtw_basic_rate_cck[4] = {
+	IEEE80211_CCK_RATE_1MB|IEEE80211_BASIC_RATE_MASK, IEEE80211_CCK_RATE_2MB|IEEE80211_BASIC_RATE_MASK,
+	IEEE80211_CCK_RATE_5MB|IEEE80211_BASIC_RATE_MASK, IEEE80211_CCK_RATE_11MB|IEEE80211_BASIC_RATE_MASK
+};
+
+static u8 rtw_basic_rate_ofdm[3] = {
+	IEEE80211_OFDM_RATE_6MB|IEEE80211_BASIC_RATE_MASK, IEEE80211_OFDM_RATE_12MB|IEEE80211_BASIC_RATE_MASK,
+	IEEE80211_OFDM_RATE_24MB|IEEE80211_BASIC_RATE_MASK
+};
+
+static u8 rtw_basic_rate_mix[7] = {
+	IEEE80211_CCK_RATE_1MB|IEEE80211_BASIC_RATE_MASK, IEEE80211_CCK_RATE_2MB|IEEE80211_BASIC_RATE_MASK,
+	IEEE80211_CCK_RATE_5MB|IEEE80211_BASIC_RATE_MASK, IEEE80211_CCK_RATE_11MB|IEEE80211_BASIC_RATE_MASK,
+	IEEE80211_OFDM_RATE_6MB|IEEE80211_BASIC_RATE_MASK, IEEE80211_OFDM_RATE_12MB|IEEE80211_BASIC_RATE_MASK,
+	IEEE80211_OFDM_RATE_24MB|IEEE80211_BASIC_RATE_MASK
+};
+
+
+int cckrates_included(unsigned char *rate, int ratelen)
+{
+	int	i;
+
+	for(i = 0; i < ratelen; i++)
+	{
+		if  (  (((rate[i]) & 0x7f) == 2)	|| (((rate[i]) & 0x7f) == 4) ||
+			   (((rate[i]) & 0x7f) == 11)  || (((rate[i]) & 0x7f) == 22) )
+		return _TRUE;
+	}
+
+	return _FALSE;
+
+}
+
+int cckratesonly_included(unsigned char *rate, int ratelen)
+{
+	int	i;
+
+	for(i = 0; i < ratelen; i++)
+	{
+		if  ( (((rate[i]) & 0x7f) != 2) && (((rate[i]) & 0x7f) != 4) &&
+			   (((rate[i]) & 0x7f) != 11)  && (((rate[i]) & 0x7f) != 22) )
+		return _FALSE;
+	}
+
+	return _TRUE;
+}
+
+unsigned char networktype_to_raid(unsigned char network_type)
+{
+	unsigned char raid;
+
+	switch(network_type)
+	{
+		case WIRELESS_11B:
+			raid = 6;
+			break;
+		case WIRELESS_11A:
+		case WIRELESS_11G:
+			raid = 5;
+			break;
+		case WIRELESS_11BG:
+			raid = 4;
+			break;
+		case WIRELESS_11_24N:
+		case WIRELESS_11_5N:
+			raid = 3;
+			break;
+		case WIRELESS_11A_5N:
+		case WIRELESS_11G_24N:
+			raid = 1;
+			break;
+		case WIRELESS_11BG_24N:
+			raid = 0;
+			break;
+		default:
+			raid = 4;
+			break;
+
+	}
+
+	return raid;
+
+}
+
+int judge_network_type(_adapter *padapter, unsigned char *rate, int ratelen)
+{
+	int network_type = 0;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+
+	if(pmlmeext->cur_channel > 14)
+	{
+		if (pmlmeinfo->HT_enable)
+		{
+			network_type = WIRELESS_11_5N;
+		}
+
+		network_type |= WIRELESS_11A;
+	}
+	else
+	{
+		if (pmlmeinfo->HT_enable)
+		{
+			network_type = WIRELESS_11_24N;
+		}
+
+		if ((cckratesonly_included(rate, ratelen)) == _TRUE)
+		{
+			network_type |= WIRELESS_11B;
+		}
+		else if((cckrates_included(rate, ratelen)) == _TRUE)
+		{
+			network_type |= WIRELESS_11BG;
+		}
+		else
+		{
+			network_type |= WIRELESS_11G;
+		}
+	}
+
+	return 	network_type;
+}
+
+unsigned char ratetbl_val_2wifirate(unsigned char rate);
+unsigned char ratetbl_val_2wifirate(unsigned char rate)
+{
+	unsigned char val = 0;
+
+	switch (rate & 0x7f)
+	{
+		case 0:
+			val = IEEE80211_CCK_RATE_1MB;
+			break;
+
+		case 1:
+			val = IEEE80211_CCK_RATE_2MB;
+			break;
+
+		case 2:
+			val = IEEE80211_CCK_RATE_5MB;
+			break;
+
+		case 3:
+			val = IEEE80211_CCK_RATE_11MB;
+			break;
+
+		case 4:
+			val = IEEE80211_OFDM_RATE_6MB;
+			break;
+
+		case 5:
+			val = IEEE80211_OFDM_RATE_9MB;
+			break;
+
+		case 6:
+			val = IEEE80211_OFDM_RATE_12MB;
+			break;
+
+		case 7:
+			val = IEEE80211_OFDM_RATE_18MB;
+			break;
+
+		case 8:
+			val = IEEE80211_OFDM_RATE_24MB;
+			break;
+
+		case 9:
+			val = IEEE80211_OFDM_RATE_36MB;
+			break;
+
+		case 10:
+			val = IEEE80211_OFDM_RATE_48MB;
+			break;
+
+		case 11:
+			val = IEEE80211_OFDM_RATE_54MB;
+			break;
+
+	}
+
+	return val;
+
+}
+
+int is_basicrate(_adapter *padapter, unsigned char rate);
+int is_basicrate(_adapter *padapter, unsigned char rate)
+{
+	int i;
+	unsigned char val;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+
+	for(i = 0; i < NumRates; i++)
+	{
+		val = pmlmeext->basicrate[i];
+
+		if ((val != 0xff) && (val != 0xfe))
+		{
+			if (rate == ratetbl_val_2wifirate(val))
+			{
+				return _TRUE;
+			}
+		}
+	}
+
+	return _FALSE;
+}
+
+unsigned int ratetbl2rateset(_adapter *padapter, unsigned char *rateset);
+unsigned int ratetbl2rateset(_adapter *padapter, unsigned char *rateset)
+{
+	int i;
+	unsigned char rate;
+	unsigned int	len = 0;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+
+	for (i = 0; i < NumRates; i++)
+	{
+		rate = pmlmeext->datarate[i];
+
+		switch (rate)
+		{
+			case 0xff:
+				return len;
+
+			case 0xfe:
+				continue;
+
+			default:
+				rate = ratetbl_val_2wifirate(rate);
+
+				if (is_basicrate(padapter, rate) == _TRUE)
+				{
+					rate |= IEEE80211_BASIC_RATE_MASK;
+				}
+
+				rateset[len] = rate;
+				len++;
+				break;
+		}
+	}
+	return len;
+}
+
+
+void get_rate_set(_adapter *padapter, unsigned char *pbssrate, int *bssrate_len)
+{
+	unsigned char supportedrates[NumRates];
+
+	_rtw_memset(supportedrates, 0, NumRates);
+	*bssrate_len = ratetbl2rateset(padapter, supportedrates);
+	_rtw_memcpy(pbssrate, supportedrates, *bssrate_len);
+}
+
+void UpdateBrateTbl(
+	IN PADAPTER		Adapter,
+	IN u8			*mBratesOS
+)
+{
+	u8	i;
+	u8	rate;
+
+	// 1M, 2M, 5.5M, 11M, 6M, 12M, 24M are mandatory.
+	for(i=0;i<NDIS_802_11_LENGTH_RATES_EX;i++)
+	{
+		rate = mBratesOS[i] & 0x7f;
+		switch(rate)
+		{
+			case IEEE80211_CCK_RATE_1MB:
+			case IEEE80211_CCK_RATE_2MB:
+			case IEEE80211_CCK_RATE_5MB:
+			case IEEE80211_CCK_RATE_11MB:
+			case IEEE80211_OFDM_RATE_6MB:
+			case IEEE80211_OFDM_RATE_12MB:
+			case IEEE80211_OFDM_RATE_24MB:
+				mBratesOS[i] |= IEEE80211_BASIC_RATE_MASK;
+				break;
+		}
+	}
+
+}
+
+void UpdateBrateTblForSoftAP(u8 *bssrateset, u32 bssratelen)
+{
+	u8	i;
+	u8	rate;
+
+	for(i=0;i<bssratelen;i++)
+	{
+		rate = bssrateset[i] & 0x7f;
+		switch(rate)
+		{
+			case IEEE80211_CCK_RATE_1MB:
+			case IEEE80211_CCK_RATE_2MB:
+			case IEEE80211_CCK_RATE_5MB:
+			case IEEE80211_CCK_RATE_11MB:
+				bssrateset[i] |= IEEE80211_BASIC_RATE_MASK;
+				break;
+		}
+	}
+
+}
+
+void Save_DM_Func_Flag(_adapter *padapter)
+{
+	u8	bSaveFlag = _TRUE;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter *pbuddy_adapter = padapter->pbuddy_adapter;
+	if(pbuddy_adapter)
+	rtw_hal_set_hwreg(pbuddy_adapter, HW_VAR_DM_FUNC_OP, (u8 *)(&bSaveFlag));
+#endif
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_DM_FUNC_OP, (u8 *)(&bSaveFlag));
+
+}
+
+void Restore_DM_Func_Flag(_adapter *padapter)
+{
+	u8	bSaveFlag = _FALSE;
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter *pbuddy_adapter = padapter->pbuddy_adapter;
+	if(pbuddy_adapter)
+	rtw_hal_set_hwreg(pbuddy_adapter, HW_VAR_DM_FUNC_OP, (u8 *)(&bSaveFlag));
+#endif
+	rtw_hal_set_hwreg(padapter, HW_VAR_DM_FUNC_OP, (u8 *)(&bSaveFlag));
+}
+
+void Switch_DM_Func(_adapter *padapter, u8 mode, u8 enable)
+{
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter *pbuddy_adapter = padapter->pbuddy_adapter;
+#endif
+
+	if(enable == _TRUE)
+	{
+#ifdef CONFIG_CONCURRENT_MODE
+		if(pbuddy_adapter)
+		rtw_hal_set_hwreg(pbuddy_adapter, HW_VAR_DM_FUNC_SET, (u8 *)(&mode));
+#endif
+		rtw_hal_set_hwreg(padapter, HW_VAR_DM_FUNC_SET, (u8 *)(&mode));
+	}
+	else
+	{
+#ifdef CONFIG_CONCURRENT_MODE
+		if(pbuddy_adapter)
+		rtw_hal_set_hwreg(pbuddy_adapter, HW_VAR_DM_FUNC_CLR, (u8 *)(&mode));
+#endif
+		rtw_hal_set_hwreg(padapter, HW_VAR_DM_FUNC_CLR, (u8 *)(&mode));
+	}
+
+#if 0
+	u8 val8;
+
+	val8 = rtw_read8(padapter, FW_DYNAMIC_FUN_SWITCH);
+
+	if(enable == _TRUE)
+	{
+		rtw_write8(padapter, FW_DYNAMIC_FUN_SWITCH, (val8 | mode));
+	}
+	else
+	{
+		rtw_write8(padapter, FW_DYNAMIC_FUN_SWITCH, (val8 & mode));
+	}
+#endif
+
+}
+
+static void Set_NETYPE1_MSR(_adapter *padapter, u8 type)
+{
+	rtw_hal_set_hwreg(padapter, HW_VAR_MEDIA_STATUS1, (u8 *)(&type));
+}
+
+static void Set_NETYPE0_MSR(_adapter *padapter, u8 type)
+{
+	rtw_hal_set_hwreg(padapter, HW_VAR_MEDIA_STATUS, (u8 *)(&type));
+}
+
+void Set_MSR(_adapter *padapter, u8 type)
+{
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->iface_type == IFACE_PORT1)
+	{
+		Set_NETYPE1_MSR(padapter, type);
+	}
+	else
+#endif
+	{
+		Set_NETYPE0_MSR(padapter, type);
+	}
+}
+
+inline u8 rtw_get_oper_ch(_adapter *adapter)
+{
+	return adapter_to_dvobj(adapter)->oper_channel;
+}
+
+inline void rtw_set_oper_ch(_adapter *adapter, u8 ch)
+{
+	if (adapter_to_dvobj(adapter)->oper_channel != ch)
+		adapter_to_dvobj(adapter)->on_oper_ch_time = rtw_get_current_time();
+
+	adapter_to_dvobj(adapter)->oper_channel = ch;
+}
+
+inline u8 rtw_get_oper_bw(_adapter *adapter)
+{
+	return adapter_to_dvobj(adapter)->oper_bwmode;
+}
+
+inline void rtw_set_oper_bw(_adapter *adapter, u8 bw)
+{
+	adapter_to_dvobj(adapter)->oper_bwmode = bw;
+}
+
+inline u8 rtw_get_oper_choffset(_adapter *adapter)
+{
+	return adapter_to_dvobj(adapter)->oper_ch_offset;
+}
+
+inline void rtw_set_oper_choffset(_adapter *adapter, u8 offset)
+{
+	adapter_to_dvobj(adapter)->oper_ch_offset = offset;
+}
+
+inline u32 rtw_get_on_oper_ch_time(_adapter *adapter)
+{
+	return adapter_to_dvobj(adapter)->on_oper_ch_time;
+}
+
+inline u32 rtw_get_on_cur_ch_time(_adapter *adapter)
+{
+	if (adapter->mlmeextpriv.cur_channel == adapter_to_dvobj(adapter)->oper_channel)
+		return adapter_to_dvobj(adapter)->on_oper_ch_time;
+	else
+		return 0;
+}
+
+void SelectChannel(_adapter *padapter, unsigned char channel)
+{
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	//saved channel info
+	rtw_set_oper_ch(padapter, channel);
+	dc_SelectChannel(padapter, channel);
+#else //CONFIG_DUALMAC_CONCURRENT
+
+	_enter_critical_mutex(&(adapter_to_dvobj(padapter)->setch_mutex), NULL);
+
+	//saved channel info
+	rtw_set_oper_ch(padapter, channel);
+
+	rtw_hal_set_chan(padapter, channel);
+
+	_exit_critical_mutex(&(adapter_to_dvobj(padapter)->setch_mutex), NULL);
+
+#endif // CONFIG_DUALMAC_CONCURRENT
+}
+
+void SetBWMode(_adapter *padapter, unsigned short bwmode, unsigned char channel_offset)
+{
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	//saved bw info
+	rtw_set_oper_bw(padapter, bwmode);
+	rtw_set_oper_choffset(padapter, channel_offset);
+	dc_SetBWMode(padapter, bwmode, channel_offset);
+#else //CONFIG_DUALMAC_CONCURRENT
+
+	_enter_critical_mutex(&(adapter_to_dvobj(padapter)->setbw_mutex), NULL);
+
+	//saved bw info
+	rtw_set_oper_bw(padapter, bwmode);
+	rtw_set_oper_choffset(padapter, channel_offset);
+
+	rtw_hal_set_bwmode(padapter, (HT_CHANNEL_WIDTH)bwmode, channel_offset);
+
+	_exit_critical_mutex(&(adapter_to_dvobj(padapter)->setbw_mutex), NULL);
+
+#endif // CONFIG_DUALMAC_CONCURRENT
+}
+
+void set_channel_bwmode(_adapter *padapter, unsigned char channel, unsigned char channel_offset, unsigned short bwmode)
+{
+	u8 center_ch;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+
+	if ( padapter->bNotifyChannelChange )
+	{
+		DBG_871X( "[%s] ch = %d, offset = %d, bwmode = %d\n", __FUNCTION__, channel, channel_offset, bwmode );
+	}
+
+	if((bwmode == HT_CHANNEL_WIDTH_20)||(channel_offset == HAL_PRIME_CHNL_OFFSET_DONT_CARE))
+	{
+		//SelectChannel(padapter, channel);
+		center_ch = channel;
+	}
+	else
+	{
+		//switch to the proper channel
+		if (channel_offset == HAL_PRIME_CHNL_OFFSET_LOWER)
+		{
+			//SelectChannel(padapter, channel + 2);
+			center_ch = channel + 2;
+		}
+		else
+		{
+			//SelectChannel(padapter, channel - 2);
+			center_ch = channel - 2;
+		}
+	}
+
+	//set Channel , must be independant for correct co_ch value/
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	//saved channel/bw info
+	rtw_set_oper_ch(padapter, channel);
+	rtw_set_oper_bw(padapter, bwmode);
+	rtw_set_oper_choffset(padapter, channel_offset);
+	dc_SelectChannel(padapter, center_ch);// set center channel
+#else //CONFIG_DUALMAC_CONCURRENT
+
+	_enter_critical_mutex(&(adapter_to_dvobj(padapter)->setch_mutex), NULL);
+
+	//saved channel/bw info
+	rtw_set_oper_ch(padapter, channel);
+	rtw_set_oper_bw(padapter, bwmode);
+	rtw_set_oper_choffset(padapter, channel_offset);
+
+	rtw_hal_set_chan(padapter, center_ch);
+
+        _exit_critical_mutex(&(adapter_to_dvobj(padapter)->setch_mutex), NULL);
+
+#endif // CONFIG_DUALMAC_CONCURRENT
+
+
+	//set BandWidth
+	SetBWMode(padapter, bwmode, channel_offset);
+
+}
+
+int get_bsstype(unsigned short capability)
+{
+	if (capability & BIT(0))
+	{
+		return WIFI_FW_AP_STATE;
+	}
+	else if (capability & BIT(1))
+	{
+		return WIFI_FW_ADHOC_STATE;
+	}
+	else
+	{
+		return 0;
+	}
+}
+
+__inline u8 *get_my_bssid(WLAN_BSSID_EX *pnetwork)
+{
+	return (pnetwork->MacAddress);
+}
+
+u16 get_beacon_interval(WLAN_BSSID_EX *bss)
+{
+	unsigned short val;
+	_rtw_memcpy((unsigned char *)&val, rtw_get_beacon_interval_from_ie(bss->IEs), 2);
+
+	return le16_to_cpu(val);
+
+}
+
+int is_client_associated_to_ap(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext;
+	struct mlme_ext_info	*pmlmeinfo;
+
+	if(!padapter)
+		return _FAIL;
+
+	pmlmeext = &padapter->mlmeextpriv;
+	pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if ((pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) && ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE))
+	{
+		return _TRUE;
+	}
+	else
+	{
+		return _FAIL;
+	}
+}
+
+int is_client_associated_to_ibss(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if ((pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) && ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE))
+	{
+		return _TRUE;
+	}
+	else
+	{
+		return _FAIL;
+	}
+}
+
+int is_IBSS_empty(_adapter *padapter)
+{
+	unsigned int i;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	for (i = IBSS_START_MAC_ID; i < NUM_STA; i++)
+	{
+		if (pmlmeinfo->FW_sta_info[i].status == 1)
+		{
+			return _FAIL;
+		}
+	}
+
+	return _TRUE;
+
+}
+
+unsigned int decide_wait_for_beacon_timeout(unsigned int bcn_interval)
+{
+	if ((bcn_interval << 2) < WAIT_FOR_BCN_TO_MIN)
+	{
+		return WAIT_FOR_BCN_TO_MIN;
+	}
+	else if ((bcn_interval << 2) > WAIT_FOR_BCN_TO_MAX)
+	{
+		return WAIT_FOR_BCN_TO_MAX;
+	}
+	else
+	{
+		return ((bcn_interval << 2));
+	}
+}
+
+void CAM_empty_entry(
+	PADAPTER     	Adapter,
+	u8 			ucIndex
+)
+{
+	rtw_hal_set_hwreg(Adapter, HW_VAR_CAM_EMPTY_ENTRY, (u8 *)(&ucIndex));
+}
+
+void invalidate_cam_all(_adapter *padapter)
+{
+	rtw_hal_set_hwreg(padapter, HW_VAR_CAM_INVALID_ALL, 0);
+}
+#if 0
+static u32 _ReadCAM(_adapter *padapter ,u32 addr)
+{
+	u32 count = 0, cmd;
+	cmd = CAM_POLLINIG |addr ;
+	rtw_write32(padapter, RWCAM, cmd);
+
+	do{
+		if(0 == (rtw_read32(padapter,REG_CAMCMD) & CAM_POLLINIG)){
+			break;
+		}
+	}while(count++ < 100);
+
+	return rtw_read32(padapter,REG_CAMREAD);
+}
+void read_cam(_adapter *padapter ,u8 entry)
+{
+	u32	j,count = 0, addr, cmd;
+	addr = entry << 3;
+
+	printk("********* DUMP CAM Entry_#%02d***************\n",entry);
+	for (j = 0; j < 6; j++)
+	{
+		cmd = _ReadCAM(padapter ,addr+j);
+		printk("offset:0x%02x => 0x%08x \n",addr+j,cmd);
+	}
+	printk("*********************************\n");
+}
+#endif
+
+void write_cam(_adapter *padapter, u8 entry, u16 ctrl, u8 *mac, u8 *key)
+{
+	unsigned int	i, val, addr;
+	//unsigned int    cmd;
+	int j;
+	u32	cam_val[2];
+
+	addr = entry << 3;
+
+	for (j = 5; j >= 0; j--)
+	{
+		switch (j)
+		{
+			case 0:
+				val = (ctrl | (mac[0] << 16) | (mac[1] << 24) );
+				break;
+
+			case 1:
+				val = (mac[2] | ( mac[3] << 8) | (mac[4] << 16) | (mac[5] << 24));
+				break;
+
+			default:
+				i = (j - 2) << 2;
+				val = (key[i] | (key[i+1] << 8) | (key[i+2] << 16) | (key[i+3] << 24));
+				break;
+
+		}
+
+		cam_val[0] = val;
+		cam_val[1] = addr + (unsigned int)j;
+
+		rtw_hal_set_hwreg(padapter, HW_VAR_CAM_WRITE, (u8 *)cam_val);
+
+		//rtw_write32(padapter, WCAMI, val);
+
+		//cmd = CAM_POLLINIG | CAM_WRITE | (addr + j);
+		//rtw_write32(padapter, RWCAM, cmd);
+
+		//DBG_871X("%s=> cam write: %x, %x\n",__FUNCTION__, cmd, val);
+
+	}
+
+}
+
+void clear_cam_entry(_adapter *padapter, u8 entry)
+{
+#if 0
+	u32	addr, val=0;
+	u32	cam_val[2];
+
+	addr = entry << 3;
+
+
+	cam_val[0] = val;
+	cam_val[1] = addr + (unsigned int)0;
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_CAM_WRITE, (u8 *)cam_val);
+
+
+
+	cam_val[0] = val;
+	cam_val[1] = addr + (unsigned int)1;
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_CAM_WRITE, (u8 *)cam_val);
+#else
+
+	unsigned char null_sta[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+	unsigned char null_key[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00};
+
+	write_cam(padapter, entry, 0, null_sta, null_key);
+
+#endif
+}
+
+int allocate_fw_sta_entry(_adapter *padapter)
+{
+	unsigned int mac_id;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	for (mac_id = IBSS_START_MAC_ID; mac_id < NUM_STA; mac_id++)
+	{
+		if (pmlmeinfo->FW_sta_info[mac_id].status == 0)
+		{
+			pmlmeinfo->FW_sta_info[mac_id].status = 1;
+			pmlmeinfo->FW_sta_info[mac_id].retry = 0;
+			break;
+		}
+	}
+
+	return mac_id;
+}
+
+void flush_all_cam_entry(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+#ifdef CONFIG_CONCURRENT_MODE
+
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+	//if(check_buddy_mlmeinfo_state(padapter, _HW_STATE_NOLINK_))
+	if(check_buddy_fwstate(padapter, _FW_LINKED) == _FALSE)
+	{
+		rtw_hal_set_hwreg(padapter, HW_VAR_CAM_INVALID_ALL, 0);
+	}
+	else
+	{
+		if(check_fwstate(pmlmepriv, WIFI_STATION_STATE))
+		{
+			struct sta_priv	*pstapriv = &padapter->stapriv;
+			struct sta_info	*psta;
+			u8 cam_id=0;//cam_entry
+
+			psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.MacAddress);
+			if(psta) {
+				if(psta->state & WIFI_AP_STATE)
+				{}   //clear cam when ap free per sta_info
+				else {
+					if(psta->mac_id==2)
+						cam_id = 5;
+					else
+						cam_id = 4;
+				}
+				//clear_cam_entry(padapter, cam_id);
+				rtw_clearstakey_cmd(padapter, (u8*)psta, cam_id, _FALSE);
+			}
+		}
+		else if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+		{
+			//clear cam when ap free per sta_info
+		}
+	}
+#else //CONFIG_CONCURRENT_MODE
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_CAM_INVALID_ALL, 0);
+
+#endif //CONFIG_CONCURRENT_MODE
+
+	_rtw_memset((u8 *)(pmlmeinfo->FW_sta_info), 0, sizeof(pmlmeinfo->FW_sta_info));
+
+}
+
+#if defined(CONFIG_P2P) && defined(CONFIG_WFD)
+int WFD_info_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs	pIE)
+{
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct wifidirect_info	*pwdinfo;
+	u8	wfd_ie[ 128 ] = { 0x00 };
+	u32	wfd_ielen = 0;
+
+
+	pwdinfo = &padapter->wdinfo;
+	if ( rtw_get_wfd_ie( ( u8* ) pIE, pIE->Length, wfd_ie, &wfd_ielen ) )
+	{
+		u8	attr_content[ 10 ] = { 0x00 };
+		u32	attr_contentlen = 0;
+
+		printk( "[%s] Found WFD IE\n", __FUNCTION__ );
+		rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_DEVICE_INFO, attr_content, &attr_contentlen);
+		if ( attr_contentlen )
+		{
+			pwdinfo->wfd_info->peer_rtsp_ctrlport = RTW_GET_BE16( attr_content + 2 );
+			DBG_8192C( "[%s] Peer PORT NUM = %d\n", __FUNCTION__, pwdinfo->wfd_info->peer_rtsp_ctrlport );
+			return( _TRUE );
+		}
+	}
+	else
+	{
+		printk( "[%s] NO WFD IE\n", __FUNCTION__ );
+
+	}
+	return( _FAIL );
+}
+#endif
+
+int WMM_param_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs	pIE)
+{
+	//struct registry_priv	*pregpriv = &padapter->registrypriv;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if(pmlmepriv->qospriv.qos_option==0)
+	{
+		pmlmeinfo->WMM_enable = 0;
+		return _FAIL;
+	}
+
+	pmlmeinfo->WMM_enable = 1;
+	_rtw_memcpy(&(pmlmeinfo->WMM_param), (pIE->data + 6), sizeof(struct WMM_para_element));
+	return _TRUE;
+
+	/*if (pregpriv->wifi_spec == 1)
+	{
+		if (pmlmeinfo->WMM_enable == 1)
+		{
+			//todo: compare the parameter set count & decide wheher to update or not
+			return _FAIL;
+		}
+		else
+		{
+			pmlmeinfo->WMM_enable = 1;
+			_rtw_rtw_memcpy(&(pmlmeinfo->WMM_param), (pIE->data + 6), sizeof(struct WMM_para_element));
+			return _TRUE;
+		}
+	}
+	else
+	{
+		pmlmeinfo->WMM_enable = 0;
+		return _FAIL;
+	}*/
+
+}
+
+void WMMOnAssocRsp(_adapter *padapter)
+{
+	u8	ACI, ACM, AIFS, ECWMin, ECWMax, aSifsTime;
+	u8	acm_mask;
+	u16	TXOP;
+	u32	acParm, i;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if (pmlmeinfo->WMM_enable == 0)
+	{
+		padapter->mlmepriv.acm_mask = 0;
+		return;
+	}
+
+	acm_mask = 0;
+
+	if( pmlmeext->cur_wireless_mode == WIRELESS_11B)
+		aSifsTime = 10;
+	else
+		aSifsTime = 16;
+
+	for (i = 0; i < 4; i++)
+	{
+		ACI = (pmlmeinfo->WMM_param.ac_param[i].ACI_AIFSN >> 5) & 0x03;
+		ACM = (pmlmeinfo->WMM_param.ac_param[i].ACI_AIFSN >> 4) & 0x01;
+
+		//AIFS = AIFSN * slot time + SIFS - r2t phy delay
+		AIFS = (pmlmeinfo->WMM_param.ac_param[i].ACI_AIFSN & 0x0f) * pmlmeinfo->slotTime + aSifsTime;
+
+		ECWMin = (pmlmeinfo->WMM_param.ac_param[i].CW & 0x0f);
+		ECWMax = (pmlmeinfo->WMM_param.ac_param[i].CW & 0xf0) >> 4;
+		TXOP = le16_to_cpu(pmlmeinfo->WMM_param.ac_param[i].TXOP_limit);
+
+		acParm = AIFS | (ECWMin << 8) | (ECWMax << 12) | (TXOP << 16);
+
+		switch (ACI)
+		{
+			case 0x0:
+				rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_BE, (u8 *)(&acParm));
+				acm_mask |= (ACM? BIT(1):0);
+				break;
+
+			case 0x1:
+				rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_BK, (u8 *)(&acParm));
+				//acm_mask |= (ACM? BIT(0):0);
+				break;
+
+			case 0x2:
+				rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_VI, (u8 *)(&acParm));
+				acm_mask |= (ACM? BIT(2):0);
+				break;
+
+			case 0x3:
+				rtw_hal_set_hwreg(padapter, HW_VAR_AC_PARAM_VO, (u8 *)(&acParm));
+				acm_mask |= (ACM? BIT(3):0);
+				break;
+		}
+
+		DBG_871X("WMM(%x): %x, %x\n", ACI, ACM, acParm);
+	}
+
+	if(padapter->registrypriv.acm_method == 1)
+		rtw_hal_set_hwreg(padapter, HW_VAR_ACM_CTRL, (u8 *)(&acm_mask));
+	else
+		padapter->mlmepriv.acm_mask = acm_mask;
+
+	return;
+}
+
+static void bwmode_update_check(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs pIE)
+{
+	unsigned char	 new_bwmode;
+	unsigned char  new_ch_offset;
+	struct HT_info_element	 *pHT_info;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct registry_priv *pregistrypriv = &padapter->registrypriv;
+	struct ht_priv			*phtpriv = &pmlmepriv->htpriv;
+	u8 cbw40_enable=0;
+
+	if(!pIE)
+		return;
+
+	if(phtpriv->ht_option == _FALSE)	return;
+
+	if(pIE->Length > sizeof(struct HT_info_element))
+		return;
+
+	pHT_info = (struct HT_info_element *)pIE->data;
+
+	if (pmlmeext->cur_channel > 14) {
+		if (pregistrypriv->cbw40_enable & BIT(1))
+			cbw40_enable = 1;
+	} else {
+		if (pregistrypriv->cbw40_enable & BIT(0))
+			cbw40_enable = 1;
+	}
+
+	if((pHT_info->infos[0] & BIT(2)) && cbw40_enable )
+	{
+		new_bwmode = HT_CHANNEL_WIDTH_40;
+
+		switch (pHT_info->infos[0] & 0x3)
+		{
+			case 1:
+				new_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+				break;
+
+			case 3:
+				new_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+				break;
+
+			default:
+				new_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+				break;
+		}
+	}
+	else
+	{
+		new_bwmode = HT_CHANNEL_WIDTH_20;
+		new_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+	}
+
+
+	if((new_bwmode!= pmlmeext->cur_bwmode) || (new_ch_offset!=pmlmeext->cur_ch_offset))
+	{
+		pmlmeinfo->bwmode_updated = _TRUE;
+
+		pmlmeext->cur_bwmode = new_bwmode;
+		pmlmeext->cur_ch_offset = new_ch_offset;
+
+		//update HT info also
+		HT_info_handler(padapter, pIE);
+	}
+	else
+	{
+		pmlmeinfo->bwmode_updated = _FALSE;
+	}
+
+
+	if(_TRUE == pmlmeinfo->bwmode_updated)
+	{
+		struct sta_info *psta;
+		WLAN_BSSID_EX 	*cur_network = &(pmlmeinfo->network);
+		struct sta_priv	*pstapriv = &padapter->stapriv;
+
+		//set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+
+
+		//update ap's stainfo
+		psta = rtw_get_stainfo(pstapriv, cur_network->MacAddress);
+		if(psta)
+		{
+			struct ht_priv	*phtpriv_sta = &psta->htpriv;
+
+			if(phtpriv_sta->ht_option)
+			{
+				// bwmode
+				phtpriv_sta->bwmode = pmlmeext->cur_bwmode;
+				phtpriv_sta->ch_offset = pmlmeext->cur_ch_offset;
+			}
+			else
+			{
+				phtpriv_sta->bwmode = HT_CHANNEL_WIDTH_20;
+				phtpriv_sta->ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+			}
+
+		}
+
+		//pmlmeinfo->bwmode_updated = _FALSE;//bwmode_updated done, reset it!
+
+	}
+
+}
+
+void HT_caps_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs pIE)
+{
+	unsigned int	i;
+	u8	rf_type;
+	u8	max_AMPDU_len, min_MPDU_spacing;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct mlme_priv 		*pmlmepriv = &padapter->mlmepriv;
+	struct ht_priv			*phtpriv = &pmlmepriv->htpriv;
+	struct registry_priv 	*pregistrypriv = &padapter->registrypriv;
+
+	if(pIE==NULL) return;
+
+	if(phtpriv->ht_option == _FALSE)	return;
+
+	pmlmeinfo->HT_caps_enable = 1;
+
+	for (i = 0; i < (pIE->Length); i++)
+	{
+		if (i != 2)
+		{
+			//	Commented by Albert 2010/07/12
+			//	Got the endian issue here.
+			pmlmeinfo->HT_caps.u.HT_cap[i] &= (pIE->data[i]);
+		}
+		else
+		{
+			//modify from  fw by Thomas 2010/11/17
+			if ((pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para & 0x3) > (pIE->data[i] & 0x3))
+			{
+				max_AMPDU_len = (pIE->data[i] & 0x3);
+			}
+			else
+			{
+				max_AMPDU_len = (pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para & 0x3);
+			}
+
+			if ((pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para & 0x1c) > (pIE->data[i] & 0x1c))
+			{
+				min_MPDU_spacing = (pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para & 0x1c);
+			}
+			else
+			{
+				min_MPDU_spacing = (pIE->data[i] & 0x1c);
+			}
+
+			pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para = max_AMPDU_len | min_MPDU_spacing;
+		}
+	}
+
+	//	Commented by Albert 2010/07/12
+	//	Have to handle the endian issue after copying.
+	//	HT_ext_caps didn't be used yet.
+	pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info = le16_to_cpu( pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info );
+	pmlmeinfo->HT_caps.u.HT_cap_element.HT_ext_caps = le16_to_cpu( pmlmeinfo->HT_caps.u.HT_cap_element.HT_ext_caps );
+
+	rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+
+	//update the MCS rates
+	for (i = 0; i < 16; i++)
+	{
+		if((rf_type == RF_1T1R) || (rf_type == RF_1T2R))
+		{
+			pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_1R[i];
+		}
+		else
+		{
+			#ifdef CONFIG_DISABLE_MCS13TO15
+			if(pmlmeext->cur_bwmode == HT_CHANNEL_WIDTH_40 && (pregistrypriv->wifi_spec!=1))
+				pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_2R_MCS13TO15_OFF[i];
+			else
+			pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_2R[i];
+			#else
+			pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_2R[i];
+			#endif //CONFIG_DISABLE_MCS13TO15
+		}
+	        #ifdef RTL8192C_RECONFIG_TO_1T1R
+		{
+			pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_1R[i];
+		}
+		#endif
+
+		if(pregistrypriv->special_rf_path)
+			pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate[i] &= MCS_rate_1R[i];
+
+	}
+
+	return;
+}
+
+void HT_info_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs pIE)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct mlme_priv 		*pmlmepriv = &padapter->mlmepriv;
+	struct ht_priv			*phtpriv = &pmlmepriv->htpriv;
+
+	if(pIE==NULL) return;
+
+	if(phtpriv->ht_option == _FALSE)	return;
+
+
+	if(pIE->Length > sizeof(struct HT_info_element))
+		return;
+
+	pmlmeinfo->HT_info_enable = 1;
+	_rtw_memcpy(&(pmlmeinfo->HT_info), pIE->data, pIE->Length);
+
+	return;
+}
+
+void HTOnAssocRsp(_adapter *padapter)
+{
+	unsigned char		max_AMPDU_len;
+	unsigned char		min_MPDU_spacing;
+	//struct registry_priv	 *pregpriv = &padapter->registrypriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	if ((pmlmeinfo->HT_info_enable) && (pmlmeinfo->HT_caps_enable))
+	{
+		pmlmeinfo->HT_enable = 1;
+	}
+	else
+	{
+		pmlmeinfo->HT_enable = 0;
+		//set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+		return;
+	}
+
+	//handle A-MPDU parameter field
+	/*
+		AMPDU_para [1:0]:Max AMPDU Len => 0:8k , 1:16k, 2:32k, 3:64k
+		AMPDU_para [4:2]:Min MPDU Start Spacing
+	*/
+	max_AMPDU_len = pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para & 0x03;
+
+	min_MPDU_spacing = (pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para & 0x1c) >> 2;
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_AMPDU_MIN_SPACE, (u8 *)(&min_MPDU_spacing));
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_AMPDU_FACTOR, (u8 *)(&max_AMPDU_len));
+
+#if 0 //move to rtw_update_ht_cap()
+	if ((pregpriv->cbw40_enable) &&
+		(pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info & BIT(1)) &&
+		(pmlmeinfo->HT_info.infos[0] & BIT(2)))
+	{
+		//switch to the 40M Hz mode accoring to the AP
+		pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
+		switch ((pmlmeinfo->HT_info.infos[0] & 0x3))
+		{
+			case HT_EXTCHNL_OFFSET_UPPER:
+				pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+				break;
+
+			case HT_EXTCHNL_OFFSET_LOWER:
+				pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+				break;
+
+			default:
+				pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+				break;
+		}
+
+		//SelectChannel(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset);
+	}
+#endif
+
+	//set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
+
+#if 0 //move to rtw_update_ht_cap()
+	//
+	// Config SM Power Save setting
+	//
+	pmlmeinfo->SM_PS = (pmlmeinfo->HT_caps.u.HT_cap_element.HT_caps_info & 0x0C) >> 2;
+	if(pmlmeinfo->SM_PS == WLAN_HT_CAP_SM_PS_STATIC)
+	{
+		/*u8 i;
+		//update the MCS rates
+		for (i = 0; i < 16; i++)
+		{
+			pmlmeinfo->HT_caps.HT_cap_element.MCS_rate[i] &= MCS_rate_1R[i];
+		}*/
+		DBG_871X("%s(): WLAN_HT_CAP_SM_PS_STATIC\n",__FUNCTION__);
+	}
+
+	//
+	// Config current HT Protection mode.
+	//
+	pmlmeinfo->HT_protection = pmlmeinfo->HT_info.infos[1] & 0x3;
+#endif
+
+}
+
+void ERP_IE_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs pIE)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if(pIE->Length>1)
+		return;
+
+	pmlmeinfo->ERP_enable = 1;
+	_rtw_memcpy(&(pmlmeinfo->ERP_IE), pIE->data, pIE->Length);
+}
+
+void VCS_update(_adapter *padapter, struct sta_info *psta)
+{
+	struct registry_priv	 *pregpriv = &padapter->registrypriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	switch (pregpriv->vrtl_carrier_sense)/* 0:off 1:on 2:auto */
+	{
+		case 0: //off
+			psta->rtsen = 0;
+			psta->cts2self = 0;
+			break;
+
+		case 1: //on
+			if (pregpriv->vcs_type == 1) /* 1:RTS/CTS 2:CTS to self */
+			{
+				psta->rtsen = 1;
+				psta->cts2self = 0;
+			}
+			else
+			{
+				psta->rtsen = 0;
+				psta->cts2self = 1;
+			}
+			break;
+
+		case 2: //auto
+		default:
+			if ((pmlmeinfo->ERP_enable) && (pmlmeinfo->ERP_IE & BIT(1)))
+			{
+				if (pregpriv->vcs_type == 1)
+				{
+					psta->rtsen = 1;
+					psta->cts2self = 0;
+				}
+				else
+				{
+					psta->rtsen = 0;
+					psta->cts2self = 1;
+				}
+			}
+			else
+			{
+				psta->rtsen = 0;
+				psta->cts2self = 0;
+			}
+			break;
+	}
+}
+
+#ifdef CONFIG_TDLS
+int check_ap_tdls_prohibited(u8 *pframe, u8 pkt_len)
+{
+	u8 tdls_prohibited_bit = 0x40; //bit(38); TDLS_prohibited
+
+	if(pkt_len < 5)
+	{
+		return _FALSE;
+	}
+
+	pframe += 4;
+	if( (*pframe) & tdls_prohibited_bit )
+		return _TRUE;
+
+	return _FALSE;
+}
+#endif //CONFIG_TDLS
+
+void update_beacon_info(_adapter *padapter, u8 *pframe, uint pkt_len, struct sta_info *psta)
+{
+	unsigned int i;
+	unsigned int len;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	u8 tdls_prohibited[] = { 0x00, 0x00, 0x00, 0x00, 0x10 }; //bit(38): TDLS_prohibited
+#endif //CONFIG_TDLS
+
+	len = pkt_len - (_BEACON_IE_OFFSET_ + WLAN_HDR_A3_LEN);
+
+	for (i = 0; i < len;)
+	{
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(pframe + (_BEACON_IE_OFFSET_ + WLAN_HDR_A3_LEN) + i);
+
+		switch (pIE->ElementID)
+		{
+#if 0
+			case _VENDOR_SPECIFIC_IE_:
+				//todo: to update WMM paramter set while receiving beacon
+				if (_rtw_memcmp(pIE->data, WMM_PARA_OUI, 6))	//WMM
+				{
+					(WMM_param_handler(padapter, pIE))? WMMOnAssocRsp(padapter): 0;
+				}
+				break;
+#endif
+
+			case _HT_EXTRA_INFO_IE_:	//HT info
+				//HT_info_handler(padapter, pIE);
+				bwmode_update_check(padapter, pIE);
+				break;
+
+			case _ERPINFO_IE_:
+				ERP_IE_handler(padapter, pIE);
+				VCS_update(padapter, psta);
+				break;
+
+#ifdef CONFIG_TDLS
+			case _EXT_CAP_IE_:
+				if( check_ap_tdls_prohibited(pIE->data, pIE->Length) == _TRUE )
+					ptdlsinfo->ap_prohibited = _TRUE;
+				break;
+#endif //CONFIG_TDLS
+			default:
+				break;
+		}
+
+		i += (pIE->Length + 2);
+	}
+}
+
+#ifdef CONFIG_DFS
+void process_csa_ie(_adapter *padapter, u8 *pframe, uint pkt_len)
+{
+	unsigned int i;
+	unsigned int len;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	u8 new_ch_no = 0;
+
+	len = pkt_len - (_BEACON_IE_OFFSET_ + WLAN_HDR_A3_LEN);
+
+	for (i = 0; i < len;)
+	{
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(pframe + (_BEACON_IE_OFFSET_ + WLAN_HDR_A3_LEN) + i);
+
+		switch (pIE->ElementID)
+		{
+			case _CH_SWTICH_ANNOUNCE_:
+				_rtw_memcpy(&new_ch_no, pIE->data+1, 1);
+				rtw_set_csa_cmd(padapter, new_ch_no);
+				break;
+
+			default:
+				break;
+		}
+
+		i += (pIE->Length + 2);
+	}
+}
+#endif //CONFIG_DFS
+
+unsigned int is_ap_in_tkip(_adapter *padapter)
+{
+	u32 i;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+
+	if (rtw_get_capability((WLAN_BSSID_EX *)cur_network) & WLAN_CAPABILITY_PRIVACY)
+	{
+		for (i = sizeof(NDIS_802_11_FIXED_IEs); i < pmlmeinfo->network.IELength;)
+		{
+			pIE = (PNDIS_802_11_VARIABLE_IEs)(pmlmeinfo->network.IEs + i);
+
+			switch (pIE->ElementID)
+			{
+				case _VENDOR_SPECIFIC_IE_:
+					if ((_rtw_memcmp(pIE->data, RTW_WPA_OUI, 4)) && (_rtw_memcmp((pIE->data + 12), WPA_TKIP_CIPHER, 4)))
+					{
+						return _TRUE;
+					}
+					break;
+
+				case _RSN_IE_2_:
+					if (_rtw_memcmp((pIE->data + 8), RSN_TKIP_CIPHER, 4))
+					{
+						return _TRUE;
+					}
+
+				default:
+					break;
+			}
+
+			i += (pIE->Length + 2);
+		}
+
+		return _FALSE;
+	}
+	else
+	{
+		return _FALSE;
+	}
+
+}
+
+int wifirate2_ratetbl_inx(unsigned char rate);
+int wifirate2_ratetbl_inx(unsigned char rate)
+{
+	int	inx = 0;
+	rate = rate & 0x7f;
+
+	switch (rate)
+	{
+		case 54*2:
+			inx = 11;
+			break;
+
+		case 48*2:
+			inx = 10;
+			break;
+
+		case 36*2:
+			inx = 9;
+			break;
+
+		case 24*2:
+			inx = 8;
+			break;
+
+		case 18*2:
+			inx = 7;
+			break;
+
+		case 12*2:
+			inx = 6;
+			break;
+
+		case 9*2:
+			inx = 5;
+			break;
+
+		case 6*2:
+			inx = 4;
+			break;
+
+		case 11*2:
+			inx = 3;
+			break;
+		case 11:
+			inx = 2;
+			break;
+
+		case 2*2:
+			inx = 1;
+			break;
+
+		case 1*2:
+			inx = 0;
+			break;
+
+	}
+	return inx;
+}
+
+unsigned int update_basic_rate(unsigned char *ptn, unsigned int ptn_sz)
+{
+	unsigned int i, num_of_rate;
+	unsigned int mask = 0;
+
+	num_of_rate = (ptn_sz > NumRates)? NumRates: ptn_sz;
+
+	for (i = 0; i < num_of_rate; i++)
+	{
+		if ((*(ptn + i)) & 0x80)
+		{
+			mask |= 0x1 << wifirate2_ratetbl_inx(*(ptn + i));
+		}
+	}
+	return mask;
+}
+
+unsigned int update_supported_rate(unsigned char *ptn, unsigned int ptn_sz)
+{
+	unsigned int i, num_of_rate;
+	unsigned int mask = 0;
+
+	num_of_rate = (ptn_sz > NumRates)? NumRates: ptn_sz;
+
+	for (i = 0; i < num_of_rate; i++)
+	{
+		mask |= 0x1 << wifirate2_ratetbl_inx(*(ptn + i));
+	}
+
+	return mask;
+}
+
+unsigned int update_MSC_rate(struct HT_caps_element *pHT_caps)
+{
+	unsigned int mask = 0;
+
+	mask = ((pHT_caps->u.HT_cap_element.MCS_rate[0] << 12) | (pHT_caps->u.HT_cap_element.MCS_rate[1] << 20));
+
+	return mask;
+}
+
+int support_short_GI(_adapter *padapter, struct HT_caps_element *pHT_caps)
+{
+	unsigned char					bit_offset;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if (!(pmlmeinfo->HT_enable))
+		return _FAIL;
+
+	if ((pmlmeinfo->assoc_AP_vendor == ralinkAP))
+		return _FAIL;
+
+	bit_offset = (pmlmeext->cur_bwmode & HT_CHANNEL_WIDTH_40)? 6: 5;
+
+	if (pHT_caps->u.HT_cap_element.HT_caps_info & (0x1 << bit_offset))
+	{
+		return _SUCCESS;
+	}
+	else
+	{
+		return _FAIL;
+	}
+}
+
+unsigned char get_highest_rate_idx(u32 mask)
+{
+	int i;
+	unsigned char rate_idx=0;
+
+	for(i=27; i>=0; i--)
+	{
+		if(mask & BIT(i))
+		{
+			rate_idx = i;
+			break;
+		}
+	}
+
+	return rate_idx;
+}
+
+unsigned char get_highest_mcs_rate(struct HT_caps_element *pHT_caps);
+unsigned char get_highest_mcs_rate(struct HT_caps_element *pHT_caps)
+{
+	int i, mcs_rate;
+
+	mcs_rate = (pHT_caps->u.HT_cap_element.MCS_rate[0] | (pHT_caps->u.HT_cap_element.MCS_rate[1] << 8));
+
+	for (i = 15; i >= 0; i--)
+	{
+		if (mcs_rate & (0x1 << i))
+		{
+			break;
+		}
+	}
+
+	return i;
+}
+
+void Update_RA_Entry(_adapter *padapter, u32 mac_id)
+{
+	rtw_hal_update_ra_mask(padapter, mac_id);
+}
+
+void enable_rate_adaptive(_adapter *padapter, u32 mac_id);
+void enable_rate_adaptive(_adapter *padapter, u32 mac_id)
+{
+	Update_RA_Entry(padapter, mac_id);
+}
+
+void set_sta_rate(_adapter *padapter, struct sta_info *psta)
+{
+	//rate adaptive
+	enable_rate_adaptive(padapter, psta->mac_id);
+}
+
+// Update RRSR and Rate for USERATE
+void update_tx_basic_rate(_adapter *padapter, u8 wirelessmode)
+{
+	NDIS_802_11_RATES_EX	supported_rates;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+#ifdef CONFIG_P2P
+	struct wifidirect_info*	pwdinfo = &padapter->wdinfo;
+
+	//	Added by Albert 2011/03/22
+	//	In the P2P mode, the driver should not support the b mode.
+	//	So, the Tx packet shouldn't use the CCK rate
+	if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		return;
+#endif //CONFIG_P2P
+#ifdef CONFIG_INTEL_WIDI
+	if (padapter->mlmepriv.widi_state != INTEL_WIDI_STATE_NONE)
+		return;
+#endif //CONFIG_INTEL_WIDI
+
+	_rtw_memset(supported_rates, 0, NDIS_802_11_LENGTH_RATES_EX);
+
+	//clear B mod if current channel is in 5G band, avoid tx cck rate in 5G band.
+	if(pmlmeext->cur_channel > 14)
+		wirelessmode &= ~(WIRELESS_11B);
+
+	if ((wirelessmode & WIRELESS_11B) && (wirelessmode == WIRELESS_11B)) {
+		_rtw_memcpy(supported_rates, rtw_basic_rate_cck, 4);
+	} else if (wirelessmode & WIRELESS_11B) {
+		_rtw_memcpy(supported_rates, rtw_basic_rate_mix, 7);
+	} else {
+		_rtw_memcpy(supported_rates, rtw_basic_rate_ofdm, 3);
+	}
+
+	if (wirelessmode & WIRELESS_11B)
+		update_mgnt_tx_rate(padapter, IEEE80211_CCK_RATE_1MB);
+	else
+		update_mgnt_tx_rate(padapter, IEEE80211_OFDM_RATE_6MB);
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_BASIC_RATE, supported_rates);
+}
+
+unsigned char check_assoc_AP(u8 *pframe, uint len)
+{
+	unsigned int	i;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+
+	for (i = sizeof(NDIS_802_11_FIXED_IEs); i < len;)
+	{
+		pIE = (PNDIS_802_11_VARIABLE_IEs)(pframe + i);
+
+		switch (pIE->ElementID)
+		{
+			case _VENDOR_SPECIFIC_IE_:
+				if ((_rtw_memcmp(pIE->data, ARTHEROS_OUI1, 3)) || (_rtw_memcmp(pIE->data, ARTHEROS_OUI2, 3)))
+				{
+					DBG_871X("link to Artheros AP\n");
+					return atherosAP;
+				}
+				else if ((_rtw_memcmp(pIE->data, BROADCOM_OUI1, 3))
+							|| (_rtw_memcmp(pIE->data, BROADCOM_OUI2, 3))
+							|| (_rtw_memcmp(pIE->data, BROADCOM_OUI2, 3)))
+				{
+					DBG_871X("link to Broadcom AP\n");
+					return broadcomAP;
+				}
+				else if (_rtw_memcmp(pIE->data, MARVELL_OUI, 3))
+				{
+					DBG_871X("link to Marvell AP\n");
+					return marvellAP;
+				}
+				else if (_rtw_memcmp(pIE->data, RALINK_OUI, 3))
+				{
+					DBG_871X("link to Ralink AP\n");
+					return ralinkAP;
+				}
+				else if (_rtw_memcmp(pIE->data, CISCO_OUI, 3))
+				{
+					DBG_871X("link to Cisco AP\n");
+					return ciscoAP;
+				}
+				else if (_rtw_memcmp(pIE->data, REALTEK_OUI, 3))
+				{
+					DBG_871X("link to Realtek 96B\n");
+					return realtekAP;
+				}
+				else if (_rtw_memcmp(pIE->data, AIRGOCAP_OUI,3))
+				{
+					DBG_871X("link to Airgo Cap\n");
+					return airgocapAP;
+				}
+				else
+				{
+					break;
+				}
+
+			default:
+				break;
+		}
+
+		i += (pIE->Length + 2);
+	}
+
+	DBG_871X("link to new AP\n");
+	return unknownAP;
+}
+
+void update_IOT_info(_adapter *padapter)
+{
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	switch (pmlmeinfo->assoc_AP_vendor)
+	{
+		case marvellAP:
+			pmlmeinfo->turboMode_cts2self = 1;
+			pmlmeinfo->turboMode_rtsen = 0;
+			break;
+
+		case ralinkAP:
+			pmlmeinfo->turboMode_cts2self = 0;
+			pmlmeinfo->turboMode_rtsen = 1;
+			//disable high power
+			Switch_DM_Func(padapter, (~DYNAMIC_FUNC_HP), _FALSE);
+			break;
+		case realtekAP:
+			//rtw_write16(padapter, 0x4cc, 0xffff);
+			//rtw_write16(padapter, 0x546, 0x01c0);
+			//disable high power
+			Switch_DM_Func(padapter, (~DYNAMIC_FUNC_HP), _FALSE);
+			break;
+		default:
+			pmlmeinfo->turboMode_cts2self = 0;
+			pmlmeinfo->turboMode_rtsen = 1;
+			break;
+	}
+
+}
+
+void update_capinfo(PADAPTER Adapter, u16 updateCap)
+{
+	struct mlme_ext_priv	*pmlmeext = &Adapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	BOOLEAN		ShortPreamble;
+
+	// Check preamble mode, 2005.01.06, by rcnjko.
+	// Mark to update preamble value forever, 2008.03.18 by lanhsin
+	//if( pMgntInfo->RegPreambleMode == PREAMBLE_AUTO )
+	{
+
+		if(updateCap & cShortPreamble)
+		{ // Short Preamble
+			if(pmlmeinfo->preamble_mode != PREAMBLE_SHORT) // PREAMBLE_LONG or PREAMBLE_AUTO
+			{
+				ShortPreamble = _TRUE;
+				pmlmeinfo->preamble_mode = PREAMBLE_SHORT;
+				rtw_hal_set_hwreg( Adapter, HW_VAR_ACK_PREAMBLE, (u8 *)&ShortPreamble );
+			}
+		}
+		else
+		{ // Long Preamble
+			if(pmlmeinfo->preamble_mode != PREAMBLE_LONG)  // PREAMBLE_SHORT or PREAMBLE_AUTO
+			{
+				ShortPreamble = _FALSE;
+				pmlmeinfo->preamble_mode = PREAMBLE_LONG;
+				rtw_hal_set_hwreg( Adapter, HW_VAR_ACK_PREAMBLE, (u8 *)&ShortPreamble );
+			}
+		}
+	}
+
+	if ( updateCap & cIBSS ) {
+		//Filen: See 802.11-2007 p.91
+		pmlmeinfo->slotTime = NON_SHORT_SLOT_TIME;
+	}
+	else
+	{
+		//Filen: See 802.11-2007 p.90
+		if( pmlmeext->cur_wireless_mode & (WIRELESS_11G | WIRELESS_11_24N))
+		{
+			if( (updateCap & cShortSlotTime) /* && (!(pMgntInfo->pHTInfo->RT2RT_HT_Mode & RT_HT_CAP_USE_LONG_PREAMBLE)) */)
+			{ // Short Slot Time
+				if(pmlmeinfo->slotTime != SHORT_SLOT_TIME)
+				{
+					pmlmeinfo->slotTime = SHORT_SLOT_TIME;
+				}
+			}
+			else
+			{ // Long Slot Time
+				if(pmlmeinfo->slotTime != NON_SHORT_SLOT_TIME)
+				{
+					pmlmeinfo->slotTime = NON_SHORT_SLOT_TIME;
+				}
+			}
+		}
+		else if( pmlmeext->cur_wireless_mode & (WIRELESS_11A | WIRELESS_11_5N))
+		{
+			pmlmeinfo->slotTime = SHORT_SLOT_TIME;
+		}
+		else
+		{
+			//B Mode
+			pmlmeinfo->slotTime = NON_SHORT_SLOT_TIME;
+		}
+	}
+
+	rtw_hal_set_hwreg( Adapter, HW_VAR_SLOT_TIME, &pmlmeinfo->slotTime );
+
+}
+
+void update_wireless_mode(_adapter *padapter)
+{
+	u8	init_rate=0;
+	int	ratelen, network_type = 0;
+	u32	SIFS_Timer, mask;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+	unsigned char			*rate = cur_network->SupportedRates;
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter *pbuddy_adapter = padapter->pbuddy_adapter;
+#endif //CONFIG_CONCURRENT_MODE
+
+	ratelen = rtw_get_rateset_len(cur_network->SupportedRates);
+
+	if ((pmlmeinfo->HT_info_enable) && (pmlmeinfo->HT_caps_enable))
+	{
+		pmlmeinfo->HT_enable = 1;
+	}
+
+	if(pmlmeext->cur_channel > 14)
+	{
+		if (pmlmeinfo->HT_enable)
+		{
+			network_type = WIRELESS_11_5N;
+		}
+
+		network_type |= WIRELESS_11A;
+	}
+	else
+	{
+		if (pmlmeinfo->HT_enable)
+		{
+			network_type = WIRELESS_11_24N;
+		}
+
+		if ((cckratesonly_included(rate, ratelen)) == _TRUE)
+		{
+			network_type |= WIRELESS_11B;
+		}
+		else if((cckrates_included(rate, ratelen)) == _TRUE)
+		{
+			network_type |= WIRELESS_11BG;
+		}
+		else
+		{
+			network_type |= WIRELESS_11G;
+		}
+	}
+
+	pmlmeext->cur_wireless_mode = network_type & padapter->registrypriv.wireless_mode;
+
+	//For STA mode, driver need to modify initial data rate, or MAC will use wrong tx rate.
+	//Modified by Thomas 2012-12-3
+	mask = update_supported_rate(cur_network->SupportedRates, ratelen);
+	init_rate = get_highest_rate_idx(mask)&0x3f;
+	rtw_hal_set_hwreg( padapter, HW_VAR_INIT_DATA_RATE,  (u8 *)&init_rate);
+
+/*
+	if((pmlmeext->cur_wireless_mode==WIRELESS_11G) ||
+		(pmlmeext->cur_wireless_mode==WIRELESS_11BG))//WIRELESS_MODE_G)
+		SIFS_Timer = 0x0a0a;//CCK
+	else
+		SIFS_Timer = 0x0e0e;//pHalData->SifsTime; //OFDM
+*/
+
+	SIFS_Timer = 0x0a0a0808; //0x0808 -> for CCK, 0x0a0a -> for OFDM
+                             //change this value if having IOT issues.
+
+	rtw_hal_set_hwreg( padapter, HW_VAR_RESP_SIFS,  (u8 *)&SIFS_Timer);
+
+	if (pmlmeext->cur_wireless_mode & WIRELESS_11B)
+		update_mgnt_tx_rate(padapter, IEEE80211_CCK_RATE_1MB);
+	else
+	{
+		update_mgnt_tx_rate(padapter, IEEE80211_OFDM_RATE_6MB);
+#ifdef CONFIG_CONCURRENT_MODE
+		if(pbuddy_adapter && (pmlmeext->cur_wireless_mode & WIRELESS_11A))
+			update_mgnt_tx_rate(pbuddy_adapter, IEEE80211_OFDM_RATE_6MB);
+#endif //CONFIG_CONCURRENT_MODE
+	}
+}
+
+void fire_write_MAC_cmd(_adapter *padapter, unsigned int addr, unsigned int value);
+void fire_write_MAC_cmd(_adapter *padapter, unsigned int addr, unsigned int value)
+{
+#if 0
+	struct cmd_obj					*ph2c;
+	struct reg_rw_parm			*pwriteMacPara;
+	struct cmd_priv					*pcmdpriv = &(padapter->cmdpriv);
+
+	if ((ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj))) == NULL)
+	{
+		return;
+	}
+
+	if ((pwriteMacPara = (struct reg_rw_parm*)rtw_malloc(sizeof(struct reg_rw_parm))) == NULL)
+	{
+		rtw_mfree((unsigned char *)ph2c, sizeof(struct cmd_obj));
+		return;
+	}
+
+	pwriteMacPara->rw = 1;
+	pwriteMacPara->addr = addr;
+	pwriteMacPara->value = value;
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, pwriteMacPara, GEN_CMD_CODE(_Write_MACREG));
+	rtw_enqueue_cmd(pcmdpriv, ph2c);
+#endif
+}
+
+void update_bmc_sta_support_rate(_adapter *padapter, u32 mac_id)
+{
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	if(pmlmeext->cur_wireless_mode & WIRELESS_11B)
+	{
+		// Only B, B/G, and B/G/N AP could use CCK rate
+		_rtw_memcpy((pmlmeinfo->FW_sta_info[mac_id].SupportedRates), rtw_basic_rate_cck, 4);
+	}
+	else
+	{
+		_rtw_memcpy((pmlmeinfo->FW_sta_info[mac_id].SupportedRates), rtw_basic_rate_ofdm, 3);
+	}
+}
+
+int update_sta_support_rate(_adapter *padapter, u8* pvar_ie, uint var_ie_len, int cam_idx)
+{
+	unsigned int	ie_len;
+	PNDIS_802_11_VARIABLE_IEs	pIE;
+	int	supportRateNum = 0;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	pIE = (PNDIS_802_11_VARIABLE_IEs)rtw_get_ie(pvar_ie, _SUPPORTEDRATES_IE_, &ie_len, var_ie_len);
+	if (pIE == NULL)
+	{
+		return _FAIL;
+	}
+
+	_rtw_memcpy(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates, pIE->data, ie_len);
+	supportRateNum = ie_len;
+
+	pIE = (PNDIS_802_11_VARIABLE_IEs)rtw_get_ie(pvar_ie, _EXT_SUPPORTEDRATES_IE_, &ie_len, var_ie_len);
+	if (pIE)
+	{
+		_rtw_memcpy((pmlmeinfo->FW_sta_info[cam_idx].SupportedRates + supportRateNum), pIE->data, ie_len);
+	}
+
+	return _SUCCESS;
+
+}
+
+void process_addba_req(_adapter *padapter, u8 *paddba_req, u8 *addr)
+{
+	struct sta_info *psta;
+	u16 tid, start_seq, param;
+	struct recv_reorder_ctrl *preorder_ctrl;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct ADDBA_request	*preq = (struct ADDBA_request*)paddba_req;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	psta = rtw_get_stainfo(pstapriv, addr);
+
+	if(psta)
+	{
+		start_seq = le16_to_cpu(preq->BA_starting_seqctrl) >> 4;
+
+		param = le16_to_cpu(preq->BA_para_set);
+		tid = (param>>2)&0x0f;
+
+		preorder_ctrl = &psta->recvreorder_ctrl[tid];
+
+		#ifdef CONFIG_UPDATE_INDICATE_SEQ_WHILE_PROCESS_ADDBA_REQ
+		preorder_ctrl->indicate_seq = start_seq;
+		#ifdef DBG_RX_SEQ
+		DBG_871X("DBG_RX_SEQ %s:%d IndicateSeq: %d, start_seq: %d\n", __FUNCTION__, __LINE__,
+			preorder_ctrl->indicate_seq, start_seq);
+		#endif
+		#else
+		preorder_ctrl->indicate_seq = 0xffff;
+		#endif
+
+		preorder_ctrl->enable =(pmlmeinfo->bAcceptAddbaReq == _TRUE)? _TRUE :_FALSE;
+	}
+
+}
+
+void update_TSF(struct mlme_ext_priv *pmlmeext, u8 *pframe, uint len)
+{
+	u8* pIE;
+	u32 *pbuf;
+
+	pIE = pframe + sizeof(struct rtw_ieee80211_hdr_3addr);
+	pbuf = (u32*)pIE;
+
+	pmlmeext->TSFValue = le32_to_cpu(*(pbuf+1));
+
+	pmlmeext->TSFValue = pmlmeext->TSFValue << 32;
+
+	pmlmeext->TSFValue |= le32_to_cpu(*pbuf);
+}
+
+void correct_TSF(_adapter *padapter, struct mlme_ext_priv *pmlmeext)
+{
+	rtw_hal_set_hwreg(padapter, HW_VAR_CORRECT_TSF, 0);
+}
+
+void beacon_timing_control(_adapter *padapter)
+{
+	rtw_hal_bcn_related_reg_setting(padapter);
+}
+
+#if 0
+unsigned int setup_beacon_frame(_adapter *padapter, unsigned char *beacon_frame)
+{
+	unsigned short				ATIMWindow;
+	unsigned char					*pframe;
+	struct tx_desc 				*ptxdesc;
+	struct rtw_ieee80211_hdr 	*pwlanhdr;
+	unsigned short				*fctrl;
+	unsigned int					rate_len, len = 0;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+	u8	bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+
+	_rtw_memset(beacon_frame, 0, 256);
+
+	pframe = beacon_frame + TXDESC_SIZE;
+
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, bc_addr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(cur_network), ETH_ALEN);
+
+	SetFrameSubType(pframe, WIFI_BEACON);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	len = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	//timestamp will be inserted by hardware
+	pframe += 8;
+	len += 8;
+
+	// beacon interval: 2 bytes
+	_rtw_memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->IEs)), 2);
+
+	pframe += 2;
+	len += 2;
+
+	// capability info: 2 bytes
+	_rtw_memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->IEs)), 2);
+
+	pframe += 2;
+	len += 2;
+
+	// SSID
+	pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &len);
+
+	// supported rates...
+	rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
+	pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, ((rate_len > 8)? 8: rate_len), cur_network->SupportedRates, &len);
+
+	// DS parameter set
+	pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &len);
+
+	// IBSS Parameter Set...
+	//ATIMWindow = cur->Configuration.ATIMWindow;
+	ATIMWindow = 0;
+	pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &len);
+
+	//todo: ERP IE
+
+	// EXTERNDED SUPPORTED RATE
+	if (rate_len > 8)
+	{
+		pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &len);
+	}
+
+	if ((len + TXDESC_SIZE) > 256)
+	{
+		//DBG_871X("marc: beacon frame too large\n");
+		return 0;
+	}
+
+	//fill the tx descriptor
+	ptxdesc = (struct tx_desc *)beacon_frame;
+
+	//offset 0
+	ptxdesc->txdw0 |= cpu_to_le32(len & 0x0000ffff);
+	ptxdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE + OFFSET_SZ) << OFFSET_SHT) & 0x00ff0000); //default = 32 bytes for TX Desc
+
+	//offset 4
+	ptxdesc->txdw1 |= cpu_to_le32((0x10 << QSEL_SHT) & 0x00001f00);
+
+	//offset 8
+	ptxdesc->txdw2 |= cpu_to_le32(BMC);
+	ptxdesc->txdw2 |= cpu_to_le32(BK);
+
+	//offset 16
+	ptxdesc->txdw4 = 0x80000000;
+
+	//offset 20
+	ptxdesc->txdw5 = 0x00000000; //1M
+
+	return (len + TXDESC_SIZE);
+}
+#endif
+
+static _adapter *pbuddy_padapter = NULL;
+
+int rtw_handle_dualmac(_adapter *adapter, bool init)
+{
+	int status = _SUCCESS;
+	struct dvobj_priv *dvobj = adapter_to_dvobj(adapter);
+
+	if (!IS_HARDWARE_TYPE_8192D(adapter))
+		goto exit;
+
+	if (init) {
+		rtw_hal_get_def_var(adapter, HAL_DEF_DUAL_MAC_MODE, &dvobj->DualMacMode);
+		if (dvobj->DualMacMode == _TRUE) {
+			// temply disable IPS For 92D-VC
+			adapter->registrypriv.ips_mode = IPS_NONE;
+		}
+
+		/* For SMSP on 92DU-VC, driver do not probe another Interface. */
+		if ((dvobj->DualMacMode != _TRUE) && (dvobj->InterfaceNumber != 0)) {
+			DBG_871X("%s(): Do not init another Interface because SMSP\n",__FUNCTION__);
+			status = _FAIL;
+			goto exit;
+		}
+
+#ifndef CONFIG_CONCURRENT_MODE
+		if (dvobj->DualMacMode == _TRUE) {
+			if (pbuddy_padapter == NULL) {
+				pbuddy_padapter = adapter;
+				DBG_871X("%s(): pbuddy_padapter == NULL, Set pbuddy_padapter\n",__FUNCTION__);
+			} else {
+				adapter->pbuddy_adapter = pbuddy_padapter;
+				pbuddy_padapter->pbuddy_adapter = adapter;
+				// clear global value
+				pbuddy_padapter = NULL;
+				DBG_871X("%s(): pbuddy_padapter exist, Exchange Information\n",__FUNCTION__);
+			}
+		}
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+		if (dvobj->InterfaceNumber == 0) {
+			//set adapter_type/iface type
+			adapter->isprimary = _TRUE;
+			adapter->adapter_type = PRIMARY_ADAPTER;
+			adapter->iface_type = IFACE_PORT0;
+			DBG_871X("%s(): PRIMARY_ADAPTER\n",__FUNCTION__);
+		} else {
+			//set adapter_type/iface type
+			adapter->isprimary = _FALSE;
+			adapter->adapter_type = SECONDARY_ADAPTER;
+			adapter->iface_type = IFACE_PORT1;
+			DBG_871X("%s(): SECONDARY_ADAPTER\n",__FUNCTION__);
+		}
+#endif
+#endif
+	}else {
+		pbuddy_padapter = NULL;
+	}
+exit:
+	return status;
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/core/rtw_xmit.c b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_xmit.c
new file mode 100644
index 000000000000..c0695435e499
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/core/rtw_xmit.c
@@ -0,0 +1,4155 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTW_XMIT_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_byteorder.h>
+#include <wifi.h>
+#include <osdep_intf.h>
+#include <circ_buf.h>
+#include <ip.h>
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+#error "Shall be Linux or Windows, but not both!\n"
+#endif
+
+#ifdef PLATFORM_WINDOWS
+#include <if_ether.h>
+#endif
+
+#ifdef CONFIG_USB_HCI
+#include <usb_ops.h>
+#endif
+
+
+static u8 P802_1H_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0xf8 };
+static u8 RFC1042_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0x00 };
+
+static void _init_txservq(struct tx_servq *ptxservq)
+{
+_func_enter_;
+	_rtw_init_listhead(&ptxservq->tx_pending);
+	_rtw_init_queue(&ptxservq->sta_pending);
+	ptxservq->qcnt = 0;
+_func_exit_;
+}
+
+
+void	_rtw_init_sta_xmit_priv(struct sta_xmit_priv *psta_xmitpriv)
+{
+
+_func_enter_;
+
+	_rtw_memset((unsigned char *)psta_xmitpriv, 0, sizeof (struct sta_xmit_priv));
+
+	_rtw_spinlock_init(&psta_xmitpriv->lock);
+
+	//for(i = 0 ; i < MAX_NUMBLKS; i++)
+	//	_init_txservq(&(psta_xmitpriv->blk_q[i]));
+
+	_init_txservq(&psta_xmitpriv->be_q);
+	_init_txservq(&psta_xmitpriv->bk_q);
+	_init_txservq(&psta_xmitpriv->vi_q);
+	_init_txservq(&psta_xmitpriv->vo_q);
+	_rtw_init_listhead(&psta_xmitpriv->legacy_dz);
+	_rtw_init_listhead(&psta_xmitpriv->apsd);
+
+_func_exit_;
+
+}
+
+s32	_rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, _adapter *padapter)
+{
+	int i;
+	struct xmit_buf *pxmitbuf;
+	struct xmit_frame *pxframe;
+	sint	res=_SUCCESS;
+
+_func_enter_;
+
+	// We don't need to memset padapter->XXX to zero, because adapter is allocated by rtw_zvmalloc().
+	//_rtw_memset((unsigned char *)pxmitpriv, 0, sizeof(struct xmit_priv));
+
+	_rtw_spinlock_init(&pxmitpriv->lock);
+	_rtw_spinlock_init(&pxmitpriv->lock_sctx);
+	_rtw_init_sema(&pxmitpriv->xmit_sema, 0);
+	_rtw_init_sema(&pxmitpriv->terminate_xmitthread_sema, 0);
+
+	/*
+	Please insert all the queue initializaiton using _rtw_init_queue below
+	*/
+
+	pxmitpriv->adapter = padapter;
+
+	//for(i = 0 ; i < MAX_NUMBLKS; i++)
+	//	_rtw_init_queue(&pxmitpriv->blk_strms[i]);
+
+	_rtw_init_queue(&pxmitpriv->be_pending);
+	_rtw_init_queue(&pxmitpriv->bk_pending);
+	_rtw_init_queue(&pxmitpriv->vi_pending);
+	_rtw_init_queue(&pxmitpriv->vo_pending);
+	_rtw_init_queue(&pxmitpriv->bm_pending);
+
+	//_rtw_init_queue(&pxmitpriv->legacy_dz_queue);
+	//_rtw_init_queue(&pxmitpriv->apsd_queue);
+
+	_rtw_init_queue(&pxmitpriv->free_xmit_queue);
+
+	/*
+	Please allocate memory with the sz = (struct xmit_frame) * NR_XMITFRAME,
+	and initialize free_xmit_frame below.
+	Please also apply  free_txobj to link_up all the xmit_frames...
+	*/
+
+	pxmitpriv->pallocated_frame_buf = rtw_zvmalloc(NR_XMITFRAME * sizeof(struct xmit_frame) + 4);
+
+	if (pxmitpriv->pallocated_frame_buf  == NULL){
+		pxmitpriv->pxmit_frame_buf =NULL;
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("alloc xmit_frame fail!\n"));
+		res= _FAIL;
+		goto exit;
+	}
+	pxmitpriv->pxmit_frame_buf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitpriv->pallocated_frame_buf), 4);
+	//pxmitpriv->pxmit_frame_buf = pxmitpriv->pallocated_frame_buf + 4 -
+	//						((SIZE_PTR) (pxmitpriv->pallocated_frame_buf) &3);
+
+	pxframe = (struct xmit_frame*) pxmitpriv->pxmit_frame_buf;
+
+	for (i = 0; i < NR_XMITFRAME; i++)
+	{
+		_rtw_init_listhead(&(pxframe->list));
+
+		pxframe->padapter = padapter;
+		pxframe->frame_tag = NULL_FRAMETAG;
+
+		pxframe->pkt = NULL;
+
+		pxframe->buf_addr = NULL;
+		pxframe->pxmitbuf = NULL;
+
+		rtw_list_insert_tail(&(pxframe->list), &(pxmitpriv->free_xmit_queue.queue));
+
+		pxframe++;
+	}
+
+	pxmitpriv->free_xmitframe_cnt = NR_XMITFRAME;
+
+	pxmitpriv->frag_len = MAX_FRAG_THRESHOLD;
+
+
+	//init xmit_buf
+	_rtw_init_queue(&pxmitpriv->free_xmitbuf_queue);
+	_rtw_init_queue(&pxmitpriv->pending_xmitbuf_queue);
+
+	pxmitpriv->pallocated_xmitbuf = rtw_zvmalloc(NR_XMITBUFF * sizeof(struct xmit_buf) + 4);
+
+	if (pxmitpriv->pallocated_xmitbuf  == NULL){
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("alloc xmit_buf fail!\n"));
+		res= _FAIL;
+		goto exit;
+	}
+
+	pxmitpriv->pxmitbuf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitpriv->pallocated_xmitbuf), 4);
+	//pxmitpriv->pxmitbuf = pxmitpriv->pallocated_xmitbuf + 4 -
+	//						((SIZE_PTR) (pxmitpriv->pallocated_xmitbuf) &3);
+
+	pxmitbuf = (struct xmit_buf*)pxmitpriv->pxmitbuf;
+
+	for (i = 0; i < NR_XMITBUFF; i++)
+	{
+		_rtw_init_listhead(&pxmitbuf->list);
+
+		pxmitbuf->priv_data = NULL;
+		pxmitbuf->padapter = padapter;
+		pxmitbuf->ext_tag = _FALSE;
+
+/*
+		pxmitbuf->pallocated_buf = rtw_zmalloc(MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ);
+		if (pxmitbuf->pallocated_buf == NULL)
+		{
+			res = _FAIL;
+			goto exit;
+		}
+
+		pxmitbuf->pbuf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitbuf->pallocated_buf), XMITBUF_ALIGN_SZ);
+		//pxmitbuf->pbuf = pxmitbuf->pallocated_buf + XMITBUF_ALIGN_SZ -((SIZE_PTR) (pxmitbuf->pallocated_buf) &(XMITBUF_ALIGN_SZ-1));
+*/
+
+		if((res=rtw_os_xmit_resource_alloc(padapter, pxmitbuf,(MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ))) == _FAIL) {
+			res= _FAIL;
+			goto exit;
+		}
+
+#ifdef CONFIG_SDIO_HCI
+		pxmitbuf->phead = pxmitbuf->pbuf;
+		pxmitbuf->pend = pxmitbuf->pbuf + MAX_XMITBUF_SZ;
+		pxmitbuf->len = 0;
+		pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
+#endif
+
+		pxmitbuf->flags = XMIT_VO_QUEUE;
+
+		rtw_list_insert_tail(&pxmitbuf->list, &(pxmitpriv->free_xmitbuf_queue.queue));
+		#ifdef DBG_XMIT_BUF
+		pxmitbuf->no=i;
+		#endif
+
+		pxmitbuf++;
+
+	}
+
+	pxmitpriv->free_xmitbuf_cnt = NR_XMITBUFF;
+
+	/* init xframe_ext queue,  the same count as extbuf  */
+	_rtw_init_queue(&pxmitpriv->free_xframe_ext_queue);
+
+	pxmitpriv->xframe_ext_alloc_addr = rtw_zvmalloc(NR_XMIT_EXTBUFF * sizeof(struct xmit_frame) + 4);
+
+	if (pxmitpriv->xframe_ext_alloc_addr  == NULL){
+		pxmitpriv->xframe_ext = NULL;
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("alloc xframe_ext fail!\n"));
+		res= _FAIL;
+		goto exit;
+	}
+	pxmitpriv->xframe_ext = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitpriv->xframe_ext_alloc_addr), 4);
+	pxframe = (struct xmit_frame*)pxmitpriv->xframe_ext;
+
+	for (i = 0; i < NR_XMIT_EXTBUFF; i++) {
+		_rtw_init_listhead(&(pxframe->list));
+
+		pxframe->padapter = padapter;
+		pxframe->frame_tag = NULL_FRAMETAG;
+
+		pxframe->pkt = NULL;
+
+		pxframe->buf_addr = NULL;
+		pxframe->pxmitbuf = NULL;
+
+		pxframe->ext_tag = 1;
+
+		rtw_list_insert_tail(&(pxframe->list), &(pxmitpriv->free_xframe_ext_queue.queue));
+
+		pxframe++;
+	}
+	pxmitpriv->free_xframe_ext_cnt = NR_XMIT_EXTBUFF;
+
+	// Init xmit extension buff
+	_rtw_init_queue(&pxmitpriv->free_xmit_extbuf_queue);
+
+	pxmitpriv->pallocated_xmit_extbuf = rtw_zvmalloc(NR_XMIT_EXTBUFF * sizeof(struct xmit_buf) + 4);
+
+	if (pxmitpriv->pallocated_xmit_extbuf  == NULL){
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("alloc xmit_extbuf fail!\n"));
+		res= _FAIL;
+		goto exit;
+	}
+
+	pxmitpriv->pxmit_extbuf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitpriv->pallocated_xmit_extbuf), 4);
+
+	pxmitbuf = (struct xmit_buf*)pxmitpriv->pxmit_extbuf;
+
+	for (i = 0; i < NR_XMIT_EXTBUFF; i++)
+	{
+		_rtw_init_listhead(&pxmitbuf->list);
+
+		pxmitbuf->priv_data = NULL;
+		pxmitbuf->padapter = padapter;
+		pxmitbuf->ext_tag = _TRUE;
+
+/*
+		pxmitbuf->pallocated_buf = rtw_zmalloc(MAX_XMIT_EXTBUF_SZ);
+		if (pxmitbuf->pallocated_buf == NULL)
+		{
+			res = _FAIL;
+			goto exit;
+		}
+
+		pxmitbuf->pbuf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitbuf->pallocated_buf), 4);
+*/
+
+		if((res=rtw_os_xmit_resource_alloc(padapter, pxmitbuf,MAX_XMIT_EXTBUF_SZ + XMITBUF_ALIGN_SZ)) == _FAIL) {
+			res= _FAIL;
+			goto exit;
+		}
+
+#ifdef CONFIG_SDIO_HCI
+		pxmitbuf->phead = pxmitbuf->pbuf;
+		pxmitbuf->pend = pxmitbuf->pbuf + MAX_XMIT_EXTBUF_SZ;
+		pxmitbuf->len = 0;
+		pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
+#endif
+
+		rtw_list_insert_tail(&pxmitbuf->list, &(pxmitpriv->free_xmit_extbuf_queue.queue));
+		#ifdef DBG_XMIT_BUF
+		pxmitbuf->no=i;
+		#endif
+		pxmitbuf++;
+
+	}
+
+	pxmitpriv->free_xmit_extbuf_cnt = NR_XMIT_EXTBUFF;
+
+	rtw_alloc_hwxmits(padapter);
+	rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
+
+#ifdef CONFIG_USB_HCI
+	pxmitpriv->txirp_cnt=1;
+
+	_rtw_init_sema(&(pxmitpriv->tx_retevt), 0);
+
+	//per AC pending irp
+	pxmitpriv->beq_cnt = 0;
+	pxmitpriv->bkq_cnt = 0;
+	pxmitpriv->viq_cnt = 0;
+	pxmitpriv->voq_cnt = 0;
+#endif
+
+
+#ifdef CONFIG_XMIT_ACK
+	pxmitpriv->ack_tx = _FALSE;
+	_rtw_mutex_init(&pxmitpriv->ack_tx_mutex);
+	rtw_sctx_init(&pxmitpriv->ack_tx_ops, 0);
+#endif
+
+	rtw_hal_init_xmit_priv(padapter);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+void  rtw_mfree_xmit_priv_lock (struct xmit_priv *pxmitpriv);
+void  rtw_mfree_xmit_priv_lock (struct xmit_priv *pxmitpriv)
+{
+	_rtw_spinlock_free(&pxmitpriv->lock);
+	_rtw_free_sema(&pxmitpriv->xmit_sema);
+	_rtw_free_sema(&pxmitpriv->terminate_xmitthread_sema);
+
+	_rtw_spinlock_free(&pxmitpriv->be_pending.lock);
+	_rtw_spinlock_free(&pxmitpriv->bk_pending.lock);
+	_rtw_spinlock_free(&pxmitpriv->vi_pending.lock);
+	_rtw_spinlock_free(&pxmitpriv->vo_pending.lock);
+	_rtw_spinlock_free(&pxmitpriv->bm_pending.lock);
+
+	//_rtw_spinlock_free(&pxmitpriv->legacy_dz_queue.lock);
+	//_rtw_spinlock_free(&pxmitpriv->apsd_queue.lock);
+
+	_rtw_spinlock_free(&pxmitpriv->free_xmit_queue.lock);
+	_rtw_spinlock_free(&pxmitpriv->free_xmitbuf_queue.lock);
+	_rtw_spinlock_free(&pxmitpriv->pending_xmitbuf_queue.lock);
+}
+
+
+void _rtw_free_xmit_priv (struct xmit_priv *pxmitpriv)
+{
+       int i;
+      _adapter *padapter = pxmitpriv->adapter;
+	struct xmit_frame	*pxmitframe = (struct xmit_frame*) pxmitpriv->pxmit_frame_buf;
+	struct xmit_buf *pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf;
+
+ _func_enter_;
+
+	rtw_hal_free_xmit_priv(padapter);
+
+	rtw_mfree_xmit_priv_lock(pxmitpriv);
+
+	if(pxmitpriv->pxmit_frame_buf==NULL)
+		goto out;
+
+	for(i=0; i<NR_XMITFRAME; i++)
+	{
+		rtw_os_xmit_complete(padapter, pxmitframe);
+
+		pxmitframe++;
+	}
+
+	for(i=0; i<NR_XMITBUFF; i++)
+	{
+		rtw_os_xmit_resource_free(padapter, pxmitbuf,(MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ));
+
+		//if(pxmitbuf->pallocated_buf)
+		//	rtw_mfree(pxmitbuf->pallocated_buf, MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ);
+
+		pxmitbuf++;
+	}
+
+	if(pxmitpriv->pallocated_frame_buf) {
+		rtw_vmfree(pxmitpriv->pallocated_frame_buf, NR_XMITFRAME * sizeof(struct xmit_frame) + 4);
+	}
+
+
+	if(pxmitpriv->pallocated_xmitbuf) {
+		rtw_vmfree(pxmitpriv->pallocated_xmitbuf, NR_XMITBUFF * sizeof(struct xmit_buf) + 4);
+	}
+
+	/* free xframe_ext queue,  the same count as extbuf  */
+	if ((pxmitframe = (struct xmit_frame*)pxmitpriv->xframe_ext)) {
+		for (i=0; i<NR_XMIT_EXTBUFF; i++) {
+			rtw_os_xmit_complete(padapter, pxmitframe);
+			pxmitframe++;
+		}
+	}
+	if (pxmitpriv->xframe_ext_alloc_addr)
+		rtw_vmfree(pxmitpriv->xframe_ext_alloc_addr, NR_XMIT_EXTBUFF * sizeof(struct xmit_frame) + 4);
+	_rtw_spinlock_free(&pxmitpriv->free_xframe_ext_queue.lock);
+
+	// free xmit extension buff
+	_rtw_spinlock_free(&pxmitpriv->free_xmit_extbuf_queue.lock);
+
+	pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmit_extbuf;
+	for(i=0; i<NR_XMIT_EXTBUFF; i++)
+	{
+		rtw_os_xmit_resource_free(padapter, pxmitbuf,(MAX_XMIT_EXTBUF_SZ + XMITBUF_ALIGN_SZ));
+
+		//if(pxmitbuf->pallocated_buf)
+		//	rtw_mfree(pxmitbuf->pallocated_buf, MAX_XMIT_EXTBUF_SZ);
+
+		pxmitbuf++;
+	}
+
+	if(pxmitpriv->pallocated_xmit_extbuf) {
+		rtw_vmfree(pxmitpriv->pallocated_xmit_extbuf, NR_XMIT_EXTBUFF * sizeof(struct xmit_buf) + 4);
+	}
+
+	rtw_free_hwxmits(padapter);
+
+#ifdef CONFIG_XMIT_ACK
+	_rtw_mutex_free(&pxmitpriv->ack_tx_mutex);
+#endif
+
+out:
+
+_func_exit_;
+
+}
+
+static void update_attrib_vcs_info(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	u32	sz;
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	struct sta_info	*psta = pattrib->psta;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+        if(pattrib->psta)
+	{
+		psta = pattrib->psta;
+	}
+	else
+	{
+		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+		psta=rtw_get_stainfo(&padapter->stapriv ,&pattrib->ra[0] );
+	}
+
+        if(psta==NULL)
+	{
+		DBG_871X("%s, psta==NUL\n", __func__);
+		return;
+	}
+
+	if(!(psta->state &_FW_LINKED))
+	{
+		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
+		return;
+	}
+
+	if (pattrib->nr_frags != 1)
+	{
+		sz = padapter->xmitpriv.frag_len;
+	}
+	else //no frag
+	{
+		sz = pattrib->last_txcmdsz;
+	}
+
+	// (1) RTS_Threshold is compared to the MPDU, not MSDU.
+	// (2) If there are more than one frag in  this MSDU, only the first frag uses protection frame.
+	//		Other fragments are protected by previous fragment.
+	//		So we only need to check the length of first fragment.
+	if(pmlmeext->cur_wireless_mode < WIRELESS_11_24N  || padapter->registrypriv.wifi_spec)
+	{
+		if(sz > padapter->registrypriv.rts_thresh)
+		{
+			pattrib->vcs_mode = RTS_CTS;
+		}
+		else
+		{
+			if(psta->rtsen)
+				pattrib->vcs_mode = RTS_CTS;
+			else if(psta->cts2self)
+				pattrib->vcs_mode = CTS_TO_SELF;
+			else
+				pattrib->vcs_mode = NONE_VCS;
+		}
+	}
+	else
+	{
+		while (_TRUE)
+		{
+#if 0 //Todo
+			//check IOT action
+			if(pHTInfo->IOTAction & HT_IOT_ACT_FORCED_CTS2SELF)
+			{
+				pattrib->vcs_mode = CTS_TO_SELF;
+				pattrib->rts_rate = MGN_24M;
+				break;
+			}
+			else if(pHTInfo->IOTAction & (HT_IOT_ACT_FORCED_RTS|HT_IOT_ACT_PURE_N_MODE))
+			{
+				pattrib->vcs_mode = RTS_CTS;
+				pattrib->rts_rate = MGN_24M;
+				break;
+			}
+#endif
+
+			//IOT action
+			if((pmlmeinfo->assoc_AP_vendor == atherosAP) && (pattrib->ampdu_en==_TRUE) &&
+				(padapter->securitypriv.dot11PrivacyAlgrthm == _AES_ ))
+			{
+				pattrib->vcs_mode = CTS_TO_SELF;
+				break;
+			}
+
+
+			//check ERP protection
+			if(psta->rtsen || psta->cts2self)
+			{
+				if(psta->rtsen)
+					pattrib->vcs_mode = RTS_CTS;
+				else if(psta->cts2self)
+					pattrib->vcs_mode = CTS_TO_SELF;
+
+				break;
+			}
+
+			//check HT op mode
+			if(pattrib->ht_en)
+			{
+				u8 HTOpMode = pmlmeinfo->HT_protection;
+				if((pmlmeext->cur_bwmode && (HTOpMode == 2 || HTOpMode == 3)) ||
+					(!pmlmeext->cur_bwmode && HTOpMode == 3) )
+				{
+					pattrib->vcs_mode = RTS_CTS;
+					break;
+				}
+			}
+
+			//check rts
+			if(sz > padapter->registrypriv.rts_thresh)
+			{
+				pattrib->vcs_mode = RTS_CTS;
+				break;
+			}
+
+			//to do list: check MIMO power save condition.
+
+			//check AMPDU aggregation for TXOP
+			if(pattrib->ampdu_en==_TRUE)
+			{
+				pattrib->vcs_mode = RTS_CTS;
+				break;
+			}
+
+			pattrib->vcs_mode = NONE_VCS;
+			break;
+		}
+	}
+}
+
+static void update_attrib_phy_info(struct pkt_attrib *pattrib, struct sta_info *psta)
+{
+	/*if(psta->rtsen)
+		pattrib->vcs_mode = RTS_CTS;
+	else if(psta->cts2self)
+		pattrib->vcs_mode = CTS_TO_SELF;
+	else
+		pattrib->vcs_mode = NONE_VCS;*/
+
+	pattrib->mdata = 0;
+	pattrib->eosp = 0;
+	pattrib->triggered=0;
+
+	//qos_en, ht_en, init rate, ,bw, ch_offset, sgi
+	pattrib->qos_en = psta->qos_option;
+	pattrib->ht_en = psta->htpriv.ht_option;
+	pattrib->raid = psta->raid;
+	pattrib->bwmode = psta->htpriv.bwmode;
+	pattrib->ch_offset = psta->htpriv.ch_offset;
+	pattrib->sgi= psta->htpriv.sgi;
+	pattrib->ampdu_en = _FALSE;
+
+	//if(pattrib->ht_en && psta->htpriv.ampdu_enable)
+	//{
+	//	if(psta->htpriv.agg_enable_bitmap & BIT(pattrib->priority))
+	//		pattrib->ampdu_en = _TRUE;
+	//}
+
+
+	pattrib->retry_ctrl = _FALSE;
+
+}
+
+u8	qos_acm(u8 acm_mask, u8 priority)
+{
+	u8	change_priority = priority;
+
+	switch (priority)
+	{
+		case 0:
+		case 3:
+			if(acm_mask & BIT(1))
+				change_priority = 1;
+			break;
+		case 1:
+		case 2:
+			break;
+		case 4:
+		case 5:
+			if(acm_mask & BIT(2))
+				change_priority = 0;
+			break;
+		case 6:
+		case 7:
+			if(acm_mask & BIT(3))
+				change_priority = 5;
+			break;
+		default:
+			DBG_871X("qos_acm(): invalid pattrib->priority: %d!!!\n", priority);
+			break;
+	}
+
+	return change_priority;
+}
+
+static void set_qos(struct pkt_file *ppktfile, struct pkt_attrib *pattrib)
+{
+	struct ethhdr etherhdr;
+	struct iphdr ip_hdr;
+	s32 UserPriority = 0;
+
+
+	_rtw_open_pktfile(ppktfile->pkt, ppktfile);
+	_rtw_pktfile_read(ppktfile, (unsigned char*)&etherhdr, ETH_HLEN);
+
+	// get UserPriority from IP hdr
+	if (pattrib->ether_type == 0x0800) {
+		_rtw_pktfile_read(ppktfile, (u8*)&ip_hdr, sizeof(ip_hdr));
+//		UserPriority = (ntohs(ip_hdr.tos) >> 5) & 0x3;
+		UserPriority = ip_hdr.tos >> 5;
+	} else if (pattrib->ether_type == 0x888e) {
+		// "When priority processing of data frames is supported,
+		// a STA's SME should send EAPOL-Key frames at the highest priority."
+		UserPriority = 7;
+	}
+
+	pattrib->priority = UserPriority;
+	pattrib->hdrlen = WLAN_HDR_A3_QOS_LEN;
+	pattrib->subtype = WIFI_QOS_DATA_TYPE;
+}
+
+static s32 update_attrib(_adapter *padapter, _pkt *pkt, struct pkt_attrib *pattrib)
+{
+	uint i;
+	struct pkt_file pktfile;
+	struct sta_info *psta = NULL;
+	struct ethhdr etherhdr;
+
+	sint bmcast;
+	struct sta_priv		*pstapriv = &padapter->stapriv;
+	struct security_priv	*psecuritypriv = &padapter->securitypriv;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct qos_priv		*pqospriv= &pmlmepriv->qospriv;
+	sint res = _SUCCESS;
+
+ _func_enter_;
+
+	_rtw_open_pktfile(pkt, &pktfile);
+	i = _rtw_pktfile_read(&pktfile, (u8*)&etherhdr, ETH_HLEN);
+
+	pattrib->ether_type = ntohs(etherhdr.h_proto);
+
+
+	_rtw_memcpy(pattrib->dst, &etherhdr.h_dest, ETH_ALEN);
+	_rtw_memcpy(pattrib->src, &etherhdr.h_source, ETH_ALEN);
+
+	pattrib->pctrl = 0;
+
+	if ((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE)) {
+		_rtw_memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
+		_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+	}
+	else if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
+		_rtw_memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
+		_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+	}
+	else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
+		_rtw_memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
+		_rtw_memcpy(pattrib->ta, get_bssid(pmlmepriv), ETH_ALEN);
+	}
+
+	pattrib->pktlen = pktfile.pkt_len;
+
+	if (ETH_P_IP == pattrib->ether_type)
+	{
+		// The following is for DHCP and ARP packet, we use cck1M to tx these packets and let LPS awake some time
+		// to prevent DHCP protocol fail
+		u8 tmp[24];
+		_rtw_pktfile_read(&pktfile, &tmp[0], 24);
+		pattrib->dhcp_pkt = 0;
+		if (pktfile.pkt_len > 282) {//MINIMUM_DHCP_PACKET_SIZE) {
+			if (ETH_P_IP == pattrib->ether_type) {// IP header
+				if (((tmp[21] == 68) && (tmp[23] == 67)) ||
+					((tmp[21] == 67) && (tmp[23] == 68))) {
+					// 68 : UDP BOOTP client
+					// 67 : UDP BOOTP server
+					RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("======================update_attrib: get DHCP Packet \n"));
+					// Use low rate to send DHCP packet.
+					//if(pMgntInfo->IOTAction & HT_IOT_ACT_WA_IOT_Broadcom)
+					//{
+					//	tcb_desc->DataRate = MgntQuery_TxRateExcludeCCKRates(ieee);//0xc;//ofdm 6m
+					//	tcb_desc->bTxDisableRateFallBack = false;
+					//}
+					//else
+					//	pTcb->DataRate = Adapter->MgntInfo.LowestBasicRate;
+					//RTPRINT(FDM, WA_IOT, ("DHCP TranslateHeader(), pTcb->DataRate = 0x%x\n", pTcb->DataRate));
+					pattrib->dhcp_pkt = 1;
+				}
+			}
+		}
+	}
+
+	if ( (pattrib->ether_type == 0x888e) || (pattrib->dhcp_pkt == 1) )
+	{
+		rtw_set_scan_deny(padapter, 3000);
+	}
+
+#ifdef CONFIG_LPS
+	// If EAPOL , ARP , OR DHCP packet, driver must be in active mode.
+	if ( (pattrib->ether_type == 0x0806) || (pattrib->ether_type == 0x888e) || (pattrib->dhcp_pkt == 1) )
+	{
+		rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_SPECIAL_PACKET, 1);
+	}
+#endif
+
+	bmcast = IS_MCAST(pattrib->ra);
+
+	// get sta_info
+	if (bmcast) {
+		psta = rtw_get_bcmc_stainfo(padapter);
+	} else {
+		psta = rtw_get_stainfo(pstapriv, pattrib->ra);
+		if (psta == NULL)	{ // if we cannot get psta => drrp the pkt
+			RT_TRACE(_module_rtl871x_xmit_c_, _drv_alert_, ("\nupdate_attrib => get sta_info fail, ra:" MAC_FMT"\n", MAC_ARG(pattrib->ra)));
+			#ifdef DBG_TX_DROP_FRAME
+			DBG_871X("DBG_TX_DROP_FRAME %s get sta_info fail, ra:" MAC_FMT"\n", __FUNCTION__, MAC_ARG(pattrib->ra));
+			#endif
+			res =_FAIL;
+			goto exit;
+		}
+		else if((check_fwstate(pmlmepriv, WIFI_AP_STATE)==_TRUE)&&(!(psta->state & _FW_LINKED)))
+		{
+			res =_FAIL;
+			goto exit;
+		}
+	}
+
+	if (psta)
+	{
+		pattrib->mac_id = psta->mac_id;
+		pattrib->psta = psta;
+	}
+	else
+	{
+		// if we cannot get psta => drop the pkt
+		RT_TRACE(_module_rtl871x_xmit_c_, _drv_alert_, ("\nupdate_attrib => get sta_info fail, ra:" MAC_FMT "\n", MAC_ARG(pattrib->ra)));
+		#ifdef DBG_TX_DROP_FRAME
+		DBG_871X("DBG_TX_DROP_FRAME %s get sta_info fail, ra:" MAC_FMT"\n", __FUNCTION__, MAC_ARG(pattrib->ra));
+		#endif
+		res = _FAIL;
+		goto exit;
+	}
+
+	pattrib->ack_policy = 0;
+	// get ether_hdr_len
+	pattrib->pkt_hdrlen = ETH_HLEN;//(pattrib->ether_type == 0x8100) ? (14 + 4 ): 14; //vlan tag
+
+	pattrib->hdrlen = WLAN_HDR_A3_LEN;
+	pattrib->subtype = WIFI_DATA_TYPE;
+	pattrib->priority = 0;
+
+	if (check_fwstate(pmlmepriv, WIFI_AP_STATE|WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE))
+	{
+		if(psta->qos_option)
+			set_qos(&pktfile, pattrib);
+	}
+	else
+	{
+		if(pqospriv->qos_option)
+		{
+			set_qos(&pktfile, pattrib);
+
+			if(pmlmepriv->acm_mask != 0)
+			{
+				pattrib->priority = qos_acm(pmlmepriv->acm_mask, pattrib->priority);
+			}
+		}
+	}
+
+	//pattrib->priority = 5; //force to used VI queue, for testing
+
+	if (psta->ieee8021x_blocked == _TRUE)
+	{
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("\n psta->ieee8021x_blocked == _TRUE \n"));
+
+		pattrib->encrypt = 0;
+
+		if((pattrib->ether_type != 0x888e) && (check_fwstate(pmlmepriv, WIFI_MP_STATE) == _FALSE))
+		{
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("\npsta->ieee8021x_blocked == _TRUE,  pattrib->ether_type(%.4x) != 0x888e\n",pattrib->ether_type));
+			#ifdef DBG_TX_DROP_FRAME
+			DBG_871X("DBG_TX_DROP_FRAME %s psta->ieee8021x_blocked == _TRUE,  pattrib->ether_type(%.4x) != 0x888e\n", __FUNCTION__,pattrib->ether_type);
+			#endif
+			res = _FAIL;
+			goto exit;
+		}
+	}
+	else
+	{
+		GET_ENCRY_ALGO(psecuritypriv, psta, pattrib->encrypt, bmcast);
+
+		switch(psecuritypriv->dot11AuthAlgrthm)
+		{
+			case dot11AuthAlgrthm_Open:
+			case dot11AuthAlgrthm_Shared:
+			case dot11AuthAlgrthm_Auto:
+				pattrib->key_idx = (u8)psecuritypriv->dot11PrivacyKeyIndex;
+				break;
+			case dot11AuthAlgrthm_8021X:
+				if(bmcast)
+					pattrib->key_idx = (u8)psecuritypriv->dot118021XGrpKeyid;
+				else
+					pattrib->key_idx = 0;
+				break;
+			default:
+				pattrib->key_idx = 0;
+				break;
+		}
+
+
+	}
+
+	switch (pattrib->encrypt)
+	{
+		case _WEP40_:
+		case _WEP104_:
+			pattrib->iv_len = 4;
+			pattrib->icv_len = 4;
+			break;
+
+		case _TKIP_:
+			pattrib->iv_len = 8;
+			pattrib->icv_len = 4;
+
+			if(padapter->securitypriv.busetkipkey==_FAIL)
+			{
+				RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("\npadapter->securitypriv.busetkipkey(%d)==_FAIL drop packet\n", padapter->securitypriv.busetkipkey));
+				#ifdef DBG_TX_DROP_FRAME
+				DBG_871X("DBG_TX_DROP_FRAME %s padapter->securitypriv.busetkipkey(%d)==_FAIL drop packet\n", __FUNCTION__, padapter->securitypriv.busetkipkey);
+				#endif
+				res =_FAIL;
+				goto exit;
+			}
+
+			break;
+		case _AES_:
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("\n pattrib->encrypt=%d  (_AES_)\n",pattrib->encrypt));
+			pattrib->iv_len = 8;
+			pattrib->icv_len = 8;
+			break;
+
+		default:
+			pattrib->iv_len = 0;
+			pattrib->icv_len = 0;
+			break;
+	}
+
+	RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_,
+		 ("update_attrib: encrypt=%d  securitypriv.sw_encrypt=%d\n",
+		  pattrib->encrypt, padapter->securitypriv.sw_encrypt));
+
+	if (pattrib->encrypt &&
+	    ((padapter->securitypriv.sw_encrypt == _TRUE) || (psecuritypriv->hw_decrypted == _FALSE)))
+	{
+		pattrib->bswenc = _TRUE;
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,
+			 ("update_attrib: encrypt=%d securitypriv.hw_decrypted=%d bswenc=_TRUE\n",
+			  pattrib->encrypt, padapter->securitypriv.sw_encrypt));
+	} else {
+		pattrib->bswenc = _FALSE;
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("update_attrib: bswenc=_FALSE\n"));
+	}
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if((pattrib->encrypt && bmcast) || (pattrib->encrypt ==_WEP40_) || (pattrib->encrypt ==_WEP104_))
+	{
+		pattrib->bswenc = _TRUE;//force using sw enc.
+	}
+#endif
+
+	rtw_set_tx_chksum_offload(pkt, pattrib);
+
+	update_attrib_phy_info(pattrib, psta);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+static s32 xmitframe_addmic(_adapter *padapter, struct xmit_frame *pxmitframe){
+	sint 			curfragnum,length;
+	u8	*pframe, *payload,mic[8];
+	struct	mic_data		micdata;
+	struct	sta_info		*stainfo;
+	struct	qos_priv   *pqospriv= &(padapter->mlmepriv.qospriv);
+	struct	pkt_attrib	 *pattrib = &pxmitframe->attrib;
+	struct 	security_priv	*psecuritypriv=&padapter->securitypriv;
+	struct	xmit_priv		*pxmitpriv=&padapter->xmitpriv;
+	u8 priority[4]={0x0,0x0,0x0,0x0};
+	sint bmcst = IS_MCAST(pattrib->ra);
+
+	if(pattrib->psta)
+	{
+		stainfo = pattrib->psta;
+	}
+	else
+	{
+		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+		stainfo=rtw_get_stainfo(&padapter->stapriv ,&pattrib->ra[0]);
+	}
+
+	if(stainfo==NULL)
+	{
+		DBG_871X("%s, psta==NUL\n", __func__);
+		return _FAIL;
+	}
+
+	if(!(stainfo->state &_FW_LINKED))
+	{
+		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, stainfo->state);
+		return _FAIL;
+	}
+
+_func_enter_;
+
+	if(pattrib->encrypt ==_TKIP_)//if(psecuritypriv->dot11PrivacyAlgrthm==_TKIP_PRIVACY_)
+	{
+		//encode mic code
+		if(stainfo!= NULL){
+			u8 null_key[16]={0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0};
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+			pframe = pxmitframe->buf_addr + TXDESC_SIZE + (pxmitframe->pkt_offset * PACKET_OFFSET_SZ);
+#else
+			pframe = pxmitframe->buf_addr + TXDESC_OFFSET;
+#endif
+
+			if(bmcst)
+			{
+				if(_rtw_memcmp(psecuritypriv->dot118021XGrptxmickey[psecuritypriv->dot118021XGrpKeyid].skey, null_key, 16)==_TRUE){
+					//DbgPrint("\nxmitframe_addmic:stainfo->dot11tkiptxmickey==0\n");
+					//rtw_msleep_os(10);
+					return _FAIL;
+				}
+				//start to calculate the mic code
+				rtw_secmicsetkey(&micdata, psecuritypriv->dot118021XGrptxmickey[psecuritypriv->dot118021XGrpKeyid].skey);
+			}
+			else
+			{
+				if(_rtw_memcmp(&stainfo->dot11tkiptxmickey.skey[0],null_key, 16)==_TRUE){
+					//DbgPrint("\nxmitframe_addmic:stainfo->dot11tkiptxmickey==0\n");
+					//rtw_msleep_os(10);
+					return _FAIL;
+				}
+				//start to calculate the mic code
+				rtw_secmicsetkey(&micdata, &stainfo->dot11tkiptxmickey.skey[0]);
+			}
+
+			if(pframe[1]&1){   //ToDS==1
+				rtw_secmicappend(&micdata, &pframe[16], 6);  //DA
+				if(pframe[1]&2)  //From Ds==1
+					rtw_secmicappend(&micdata, &pframe[24], 6);
+				else
+				rtw_secmicappend(&micdata, &pframe[10], 6);
+			}
+			else{	//ToDS==0
+				rtw_secmicappend(&micdata, &pframe[4], 6);   //DA
+				if(pframe[1]&2)  //From Ds==1
+					rtw_secmicappend(&micdata, &pframe[16], 6);
+				else
+					rtw_secmicappend(&micdata, &pframe[10], 6);
+
+			}
+
+                    //if(pqospriv->qos_option==1)
+                    if(pattrib->qos_en)
+				priority[0]=(u8)pxmitframe->attrib.priority;
+
+
+			rtw_secmicappend(&micdata, &priority[0], 4);
+
+			payload=pframe;
+
+			for(curfragnum=0;curfragnum<pattrib->nr_frags;curfragnum++){
+				payload=(u8 *)RND4((SIZE_PTR)(payload));
+				RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("===curfragnum=%d, pframe= 0x%.2x, 0x%.2x, 0x%.2x, 0x%.2x, 0x%.2x, 0x%.2x, 0x%.2x, 0x%.2x,!!!\n",
+					curfragnum,*payload, *(payload+1),*(payload+2),*(payload+3),*(payload+4),*(payload+5),*(payload+6),*(payload+7)));
+
+				payload=payload+pattrib->hdrlen+pattrib->iv_len;
+				RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("curfragnum=%d pattrib->hdrlen=%d pattrib->iv_len=%d",curfragnum,pattrib->hdrlen,pattrib->iv_len));
+				if((curfragnum+1)==pattrib->nr_frags){
+					length=pattrib->last_txcmdsz-pattrib->hdrlen-pattrib->iv_len-( (pattrib->bswenc) ? pattrib->icv_len : 0);
+					rtw_secmicappend(&micdata, payload,length);
+					payload=payload+length;
+				}
+				else{
+					length=pxmitpriv->frag_len-pattrib->hdrlen-pattrib->iv_len-( (pattrib->bswenc) ? pattrib->icv_len : 0);
+					rtw_secmicappend(&micdata, payload, length);
+					payload=payload+length+pattrib->icv_len;
+					RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("curfragnum=%d length=%d pattrib->icv_len=%d",curfragnum,length,pattrib->icv_len));
+				}
+			}
+			rtw_secgetmic(&micdata,&(mic[0]));
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("xmitframe_addmic: before add mic code!!!\n"));
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("xmitframe_addmic: pattrib->last_txcmdsz=%d!!!\n",pattrib->last_txcmdsz));
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("xmitframe_addmic: mic[0]=0x%.2x ,mic[1]=0x%.2x ,mic[2]=0x%.2x ,mic[3]=0x%.2x \n\
+  mic[4]=0x%.2x ,mic[5]=0x%.2x ,mic[6]=0x%.2x ,mic[7]=0x%.2x !!!!\n",
+				mic[0],mic[1],mic[2],mic[3],mic[4],mic[5],mic[6],mic[7]));
+			//add mic code  and add the mic code length in last_txcmdsz
+
+			_rtw_memcpy(payload, &(mic[0]),8);
+			pattrib->last_txcmdsz+=8;
+
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("\n ========last pkt========\n"));
+			payload=payload-pattrib->last_txcmdsz+8;
+			for(curfragnum=0;curfragnum<pattrib->last_txcmdsz;curfragnum=curfragnum+8)
+					RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,(" %.2x,  %.2x,  %.2x,  %.2x,  %.2x,  %.2x,  %.2x,  %.2x ",
+					*(payload+curfragnum), *(payload+curfragnum+1), *(payload+curfragnum+2),*(payload+curfragnum+3),
+					*(payload+curfragnum+4),*(payload+curfragnum+5),*(payload+curfragnum+6),*(payload+curfragnum+7)));
+			}
+			else{
+				RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("xmitframe_addmic: rtw_get_stainfo==NULL!!!\n"));
+			}
+	}
+
+_func_exit_;
+
+	return _SUCCESS;
+}
+
+static s32 xmitframe_swencrypt(_adapter *padapter, struct xmit_frame *pxmitframe){
+
+	struct	pkt_attrib	 *pattrib = &pxmitframe->attrib;
+	//struct 	security_priv	*psecuritypriv=&padapter->securitypriv;
+
+_func_enter_;
+
+	//if((psecuritypriv->sw_encrypt)||(pattrib->bswenc))
+	if(pattrib->bswenc)
+	{
+		//DBG_871X("start xmitframe_swencrypt\n");
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_alert_,("### xmitframe_swencrypt\n"));
+		switch(pattrib->encrypt){
+		case _WEP40_:
+		case _WEP104_:
+			rtw_wep_encrypt(padapter, (u8 *)pxmitframe);
+			break;
+		case _TKIP_:
+			rtw_tkip_encrypt(padapter, (u8 *)pxmitframe);
+			break;
+		case _AES_:
+			rtw_aes_encrypt(padapter, (u8 * )pxmitframe);
+			break;
+		default:
+				break;
+		}
+
+	} else {
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_notice_,("### xmitframe_hwencrypt\n"));
+	}
+
+_func_exit_;
+
+	return _SUCCESS;
+}
+
+s32 rtw_make_wlanhdr (_adapter *padapter , u8 *hdr, struct pkt_attrib *pattrib)
+{
+	u16 *qc;
+
+	struct rtw_ieee80211_hdr *pwlanhdr = (struct rtw_ieee80211_hdr *)hdr;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct qos_priv *pqospriv = &pmlmepriv->qospriv;
+	u8 qos_option = _FALSE;
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	struct sta_priv 	*pstapriv = &padapter->stapriv;
+	struct sta_info *ptdls_sta=NULL, *psta_backup=NULL;
+	u8 direct_link=0;
+#endif //CONFIG_TDLS
+
+	sint res = _SUCCESS;
+	u16 *fctrl = &pwlanhdr->frame_ctl;
+
+	struct sta_info *psta;
+
+	sint bmcst = IS_MCAST(pattrib->ra);
+
+_func_enter_;
+
+	if (pattrib->psta) {
+		psta = pattrib->psta;
+	} else {
+		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+		if(bmcst) {
+			psta = rtw_get_bcmc_stainfo(padapter);
+		} else {
+			psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
+		}
+	}
+
+	if(psta==NULL)
+	{
+		DBG_871X("%s, psta==NUL\n", __func__);
+		return _FAIL;
+	}
+
+	if(!(psta->state &_FW_LINKED))
+	{
+		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
+		return _FAIL;
+	}
+
+	_rtw_memset(hdr, 0, WLANHDR_OFFSET);
+
+	SetFrameSubType(fctrl, pattrib->subtype);
+
+	if (pattrib->subtype & WIFI_DATA_TYPE)
+	{
+		if ((check_fwstate(pmlmepriv,  WIFI_STATION_STATE) == _TRUE)) {
+			//to_ds = 1, fr_ds = 0;
+#ifdef CONFIG_TDLS
+			if((ptdlsinfo->setup_state == TDLS_LINKED_STATE)){
+				ptdls_sta = rtw_get_stainfo(pstapriv, pattrib->dst);
+				if((ptdls_sta!=NULL)&&(ptdls_sta->tdls_sta_state & TDLS_LINKED_STATE)&&(pattrib->ether_type!=0x0806)){
+					//TDLS data transfer, ToDS=0, FrDs=0
+					_rtw_memcpy(pwlanhdr->addr1, pattrib->dst, ETH_ALEN);
+					_rtw_memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
+					_rtw_memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN);
+					direct_link=1;
+				}else{
+					// 1.Data transfer to AP
+					// 2.Arp pkt will relayed by AP
+					SetToDs(fctrl);
+					_rtw_memcpy(pwlanhdr->addr1, get_bssid(pmlmepriv), ETH_ALEN);
+					_rtw_memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
+					_rtw_memcpy(pwlanhdr->addr3, pattrib->dst, ETH_ALEN);
+				}
+			}else
+#endif //CONFIG_TDLS
+			{
+				//Data transfer to AP
+				SetToDs(fctrl);
+				_rtw_memcpy(pwlanhdr->addr1, get_bssid(pmlmepriv), ETH_ALEN);
+				_rtw_memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
+				_rtw_memcpy(pwlanhdr->addr3, pattrib->dst, ETH_ALEN);
+			}
+
+			if (pqospriv->qos_option)
+				qos_option = _TRUE;
+
+		}
+		else if ((check_fwstate(pmlmepriv,  WIFI_AP_STATE) == _TRUE) ) {
+			//to_ds = 0, fr_ds = 1;
+			SetFrDs(fctrl);
+			_rtw_memcpy(pwlanhdr->addr1, pattrib->dst, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr2, get_bssid(pmlmepriv), ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr3, pattrib->src, ETH_ALEN);
+
+			if(psta->qos_option)
+				qos_option = _TRUE;
+		}
+		else if ((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE)) {
+			_rtw_memcpy(pwlanhdr->addr1, pattrib->dst, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN);
+
+			if(psta->qos_option)
+				qos_option = _TRUE;
+		}
+		else {
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("fw_state:%x is not allowed to xmit frame\n", get_fwstate(pmlmepriv)));
+			res = _FAIL;
+			goto exit;
+		}
+
+		if(pattrib->mdata)
+			SetMData(fctrl);
+
+		if (pattrib->encrypt)
+			SetPrivacy(fctrl);
+
+		if (qos_option)
+		{
+			qc = (unsigned short *)(hdr + pattrib->hdrlen - 2);
+
+			if (pattrib->priority)
+				SetPriority(qc, pattrib->priority);
+
+			SetEOSP(qc, pattrib->eosp);
+
+			SetAckpolicy(qc, pattrib->ack_policy);
+		}
+
+		//TODO: fill HT Control Field
+
+		//Update Seq Num will be handled by f/w
+		{
+			if(psta){
+#ifdef CONFIG_TDLS
+				if(direct_link==1)
+				{
+					psta_backup = psta;
+					psta = ptdls_sta;
+				}
+#endif //CONFIG_TDLS
+
+				psta->sta_xmitpriv.txseq_tid[pattrib->priority]++;
+				psta->sta_xmitpriv.txseq_tid[pattrib->priority] &= 0xFFF;
+
+				pattrib->seqnum = psta->sta_xmitpriv.txseq_tid[pattrib->priority];
+
+				SetSeqNum(hdr, pattrib->seqnum);
+
+
+				//check if enable ampdu
+				if(pattrib->ht_en && psta->htpriv.ampdu_enable)
+				{
+					if(psta->htpriv.agg_enable_bitmap & BIT(pattrib->priority))
+					pattrib->ampdu_en = _TRUE;
+				}
+
+				//re-check if enable ampdu by BA_starting_seqctrl
+				if(pattrib->ampdu_en == _TRUE)
+				{
+					u16 tx_seq;
+
+					tx_seq = psta->BA_starting_seqctrl[pattrib->priority & 0x0f];
+
+					//check BA_starting_seqctrl
+					if(SN_LESS(pattrib->seqnum, tx_seq))
+					{
+						//DBG_871X("tx ampdu seqnum(%d) < tx_seq(%d)\n", pattrib->seqnum, tx_seq);
+						pattrib->ampdu_en = _FALSE;//AGG BK
+					}
+					else if(SN_EQUAL(pattrib->seqnum, tx_seq))
+					{
+						psta->BA_starting_seqctrl[pattrib->priority & 0x0f] = (tx_seq+1)&0xfff;
+
+						pattrib->ampdu_en = _TRUE;//AGG EN
+					}
+					else
+					{
+						//DBG_871X("tx ampdu over run\n");
+						psta->BA_starting_seqctrl[pattrib->priority & 0x0f] = (pattrib->seqnum+1)&0xfff;
+						pattrib->ampdu_en = _TRUE;//AGG EN
+					}
+
+				}
+
+#ifdef CONFIG_TDLS
+				if(direct_link==1)
+				{
+					if (pattrib->encrypt){
+						pattrib->encrypt= _AES_;
+						pattrib->iv_len=8;
+						pattrib->icv_len=8;
+					}
+
+					//qos_en, ht_en, init rate, ,bw, ch_offset, sgi
+					//pattrib->qos_en = ptdls_sta->qos_option;
+					pattrib->ht_en = ptdls_sta->htpriv.ht_option;
+					pattrib->raid = ptdls_sta->raid;
+					pattrib->bwmode = ptdls_sta->htpriv.bwmode;
+					pattrib->ch_offset = ptdls_sta->htpriv.ch_offset;
+					pattrib->sgi= ptdls_sta->htpriv.sgi;
+
+					pattrib->mac_id = ptdls_sta->mac_id;
+
+					psta = psta_backup;
+				}
+#endif //CONFIG_TDLS
+
+			}
+		}
+
+	}
+	else
+	{
+
+	}
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+s32 rtw_txframes_pending(_adapter *padapter)
+{
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+
+	return ((_rtw_queue_empty(&pxmitpriv->be_pending) == _FALSE) ||
+			 (_rtw_queue_empty(&pxmitpriv->bk_pending) == _FALSE) ||
+			 (_rtw_queue_empty(&pxmitpriv->vi_pending) == _FALSE) ||
+			 (_rtw_queue_empty(&pxmitpriv->vo_pending) == _FALSE));
+}
+
+s32 rtw_txframes_sta_ac_pending(_adapter *padapter, struct pkt_attrib *pattrib)
+{
+	struct sta_info *psta;
+	struct tx_servq *ptxservq;
+	int priority = pattrib->priority;
+
+	if(pattrib->psta)
+	{
+	psta = pattrib->psta;
+	}
+	else
+	{
+		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+		psta=rtw_get_stainfo(&padapter->stapriv ,&pattrib->ra[0]);
+	}
+
+	if(psta==NULL)
+	{
+		DBG_871X("%s, psta==NUL\n", __func__);
+		return 0;
+	}
+
+	if(!(psta->state &_FW_LINKED))
+	{
+		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
+		return 0;
+	}
+
+	switch(priority)
+	{
+			case 1:
+			case 2:
+				ptxservq = &(psta->sta_xmitpriv.bk_q);
+				break;
+			case 4:
+			case 5:
+				ptxservq = &(psta->sta_xmitpriv.vi_q);
+				break;
+			case 6:
+			case 7:
+				ptxservq = &(psta->sta_xmitpriv.vo_q);
+				break;
+			case 0:
+			case 3:
+			default:
+				ptxservq = &(psta->sta_xmitpriv.be_q);
+			break;
+
+	}
+
+	return ptxservq->qcnt;
+}
+
+#ifdef CONFIG_TDLS
+
+int rtw_build_tdls_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe, u8 action)
+{
+	int res=_SUCCESS;
+
+	switch(action){
+		case TDLS_SETUP_REQUEST:
+			rtw_build_tdls_setup_req_ies(padapter, pxmitframe, pframe);
+			break;
+		case TDLS_SETUP_RESPONSE:
+			rtw_build_tdls_setup_rsp_ies(padapter, pxmitframe, pframe);
+			break;
+		case TDLS_SETUP_CONFIRM:
+			rtw_build_tdls_setup_cfm_ies(padapter, pxmitframe, pframe);
+			break;
+		case TDLS_TEARDOWN:
+			rtw_build_tdls_teardown_ies(padapter, pxmitframe, pframe);
+			break;
+		case TDLS_DISCOVERY_REQUEST:
+			rtw_build_tdls_dis_req_ies(padapter, pxmitframe, pframe);
+			break;
+		case TDLS_PEER_TRAFFIC_INDICATION:
+			rtw_build_tdls_peer_traffic_indication_ies(padapter, pxmitframe, pframe);
+			break;
+		case TDLS_CHANNEL_SWITCH_REQUEST:
+			rtw_build_tdls_ch_switch_req_ies(padapter, pxmitframe, pframe);
+			break;
+		case TDLS_CHANNEL_SWITCH_RESPONSE:
+			rtw_build_tdls_ch_switch_rsp_ies(padapter, pxmitframe, pframe);
+			break;
+#ifdef CONFIG_WFD
+		case TUNNELED_PROBE_REQ:
+			rtw_build_tunneled_probe_req_ies(padapter, pxmitframe, pframe);
+			break;
+		case TUNNELED_PROBE_RSP:
+			rtw_build_tunneled_probe_rsp_ies(padapter, pxmitframe, pframe);
+			break;
+#endif //CONFIG_WFD
+		default:
+			res=_FAIL;
+			break;
+	}
+
+	return res;
+}
+
+s32 rtw_make_tdls_wlanhdr (_adapter *padapter , u8 *hdr, struct pkt_attrib *pattrib, u8 action)
+{
+	u16 *qc;
+	struct rtw_ieee80211_hdr *pwlanhdr = (struct rtw_ieee80211_hdr *)hdr;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct qos_priv *pqospriv = &pmlmepriv->qospriv;
+	struct sta_priv 	*pstapriv = &padapter->stapriv;
+	struct sta_info *psta=NULL, *ptdls_sta=NULL;
+	u8 tdls_seq=0, baddr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+
+	sint res = _SUCCESS;
+	u16 *fctrl = &pwlanhdr->frame_ctl;
+
+_func_enter_;
+
+	_rtw_memset(hdr, 0, WLANHDR_OFFSET);
+
+	SetFrameSubType(fctrl, pattrib->subtype);
+
+	switch(action){
+		case TDLS_SETUP_REQUEST:
+		case TDLS_SETUP_RESPONSE:
+		case TDLS_SETUP_CONFIRM:
+		case TDLS_TEARDOWN:	//directly to peer STA or via AP
+		case TDLS_PEER_TRAFFIC_INDICATION:
+		case TDLS_PEER_PSM_REQUEST:	//directly to peer STA or via AP
+		case TUNNELED_PROBE_REQ:
+		case TUNNELED_PROBE_RSP:
+			SetToDs(fctrl);
+			_rtw_memcpy(pwlanhdr->addr1, get_bssid(pmlmepriv), ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr3, pattrib->dst, ETH_ALEN);
+			break;
+		case TDLS_CHANNEL_SWITCH_REQUEST:
+		case TDLS_CHANNEL_SWITCH_RESPONSE:
+		case TDLS_PEER_PSM_RESPONSE:
+		case TDLS_PEER_TRAFFIC_RESPONSE:
+			_rtw_memcpy(pwlanhdr->addr1, pattrib->dst, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN);
+			tdls_seq=1;
+			break;
+		case TDLS_DISCOVERY_REQUEST:	//unicast: directly to peer sta, Bcast: via AP
+			if(_rtw_memcmp(pattrib->dst, baddr, ETH_ALEN) )
+			{
+				SetToDs(fctrl);
+				_rtw_memcpy(pwlanhdr->addr1, get_bssid(pmlmepriv), ETH_ALEN);
+				_rtw_memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
+				_rtw_memcpy(pwlanhdr->addr3, pattrib->dst, ETH_ALEN);
+			}
+			else
+			{
+				_rtw_memcpy(pwlanhdr->addr1, pattrib->dst, ETH_ALEN);
+				_rtw_memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
+				_rtw_memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN);
+				tdls_seq=1;
+			}
+			break;
+	}
+
+	if (pattrib->encrypt)
+		SetPrivacy(fctrl);
+
+	if (pqospriv->qos_option)
+	{
+		qc = (unsigned short *)(hdr + pattrib->hdrlen - 2);
+		if (pattrib->priority)
+			SetPriority(qc, pattrib->priority);
+		SetAckpolicy(qc, pattrib->ack_policy);
+	}
+
+	psta = pattrib->psta;
+
+	//  1. update seq_num per link by sta_info
+	//  2. rewrite encrypt to _AES_, also rewrite iv_len, icv_len
+	if(tdls_seq==1){
+		ptdls_sta=rtw_get_stainfo(pstapriv, pattrib->dst);
+		if(ptdls_sta){
+			ptdls_sta->sta_xmitpriv.txseq_tid[pattrib->priority]++;
+			ptdls_sta->sta_xmitpriv.txseq_tid[pattrib->priority] &= 0xFFF;
+			pattrib->seqnum = ptdls_sta->sta_xmitpriv.txseq_tid[pattrib->priority];
+			SetSeqNum(hdr, pattrib->seqnum);
+
+			if (pattrib->encrypt){
+				pattrib->encrypt= _AES_;
+				pattrib->iv_len=8;
+				pattrib->icv_len=8;
+			}
+		}else{
+			res=_FAIL;
+			goto exit;
+		}
+	}else if(psta){
+		psta->sta_xmitpriv.txseq_tid[pattrib->priority]++;
+		psta->sta_xmitpriv.txseq_tid[pattrib->priority] &= 0xFFF;
+		pattrib->seqnum = psta->sta_xmitpriv.txseq_tid[pattrib->priority];
+		SetSeqNum(hdr, pattrib->seqnum);
+	}
+
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+s32 rtw_xmit_tdls_coalesce(_adapter * padapter, struct xmit_frame * pxmitframe, u8 action)
+{
+	s32 llc_sz;
+
+	u8 *pframe, *mem_start;
+
+	struct sta_info		*psta;
+	struct sta_priv		*pstapriv = &padapter->stapriv;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	u8 *pbuf_start;
+	s32 bmcst = IS_MCAST(pattrib->ra);
+	s32 res = _SUCCESS;
+
+_func_enter_;
+
+	if (pattrib->psta) {
+		psta = pattrib->psta;
+	} else {
+		if(bmcst) {
+			psta = rtw_get_bcmc_stainfo(padapter);
+		} else {
+			psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
+	        }
+	}
+
+	if(psta==NULL)
+		return _FAIL;
+
+	if (pxmitframe->buf_addr == NULL)
+		return _FAIL;
+
+	pbuf_start = pxmitframe->buf_addr;
+	mem_start = pbuf_start + TXDESC_OFFSET;
+
+	if (rtw_make_tdls_wlanhdr(padapter, mem_start, pattrib, action) == _FAIL) {
+		res = _FAIL;
+		goto exit;
+	}
+
+	pframe = mem_start;
+	pframe += pattrib->hdrlen;
+
+	//adding icv, if necessary...
+	if (pattrib->iv_len)
+	{
+		if (psta != NULL)
+		{
+			switch(pattrib->encrypt)
+			{
+				case _WEP40_:
+				case _WEP104_:
+						WEP_IV(pattrib->iv, psta->dot11txpn, pattrib->key_idx);
+					break;
+				case _TKIP_:
+					if(bmcst)
+						TKIP_IV(pattrib->iv, psta->dot11txpn, pattrib->key_idx);
+					else
+						TKIP_IV(pattrib->iv, psta->dot11txpn, 0);
+					break;
+				case _AES_:
+					if(bmcst)
+						AES_IV(pattrib->iv, psta->dot11txpn, pattrib->key_idx);
+					else
+						AES_IV(pattrib->iv, psta->dot11txpn, 0);
+					break;
+			}
+		}
+
+		_rtw_memcpy(pframe, pattrib->iv, pattrib->iv_len);
+		pframe += pattrib->iv_len;
+
+	}
+
+	llc_sz = rtw_put_snap(pframe, pattrib->ether_type);
+	pframe += llc_sz;
+
+	//pattrib->pktlen will be counted in rtw_build_tdls_ies
+	pattrib->pktlen = 0;
+
+	rtw_build_tdls_ies(padapter, pxmitframe, pframe, action);
+
+	if ((pattrib->icv_len >0 )&& (pattrib->bswenc)) {
+		pframe += pattrib->pktlen;
+		_rtw_memcpy(pframe, pattrib->icv, pattrib->icv_len);
+		pframe += pattrib->icv_len;
+	}
+
+	pattrib->nr_frags = 1;
+	pattrib->last_txcmdsz = pattrib->hdrlen + pattrib->iv_len + llc_sz +
+			((pattrib->bswenc) ? pattrib->icv_len : 0) + pattrib->pktlen;
+
+	if (xmitframe_addmic(padapter, pxmitframe) == _FAIL)
+	{
+		goto exit;
+	}
+
+	xmitframe_swencrypt(padapter, pxmitframe);
+
+	update_attrib_vcs_info(padapter, pxmitframe);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+#endif //CONFIG_TDLS
+
+/*
+ * Calculate wlan 802.11 packet MAX size from pkt_attrib
+ * This function doesn't consider fragment case
+ */
+u32 rtw_calculate_wlan_pkt_size_by_attribue(struct pkt_attrib *pattrib)
+{
+	u32	len = 0;
+
+	len = pattrib->hdrlen + pattrib->iv_len; // WLAN Header and IV
+	len += SNAP_SIZE + sizeof(u16); // LLC
+	len += pattrib->pktlen;
+	if (pattrib->encrypt == _TKIP_) len += 8; // MIC
+	len += pattrib->icv_len; // ICV
+
+	return len;
+}
+
+/*
+
+This sub-routine will perform all the following:
+
+1. remove 802.3 header.
+2. create wlan_header, based on the info in pxmitframe
+3. append sta's iv/ext-iv
+4. append LLC
+5. move frag chunk from pframe to pxmitframe->mem
+6. apply sw-encrypt, if necessary.
+
+*/
+s32 rtw_xmitframe_coalesce(_adapter *padapter, _pkt *pkt, struct xmit_frame *pxmitframe)
+{
+	struct pkt_file pktfile;
+
+	s32 frg_inx, frg_len, mpdu_len, llc_sz, mem_sz;
+
+	SIZE_PTR addr;
+
+	u8 *pframe, *mem_start;
+
+	struct sta_info		*psta;
+	//struct sta_priv		*pstapriv = &padapter->stapriv;
+	//struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+
+	u8 *pbuf_start;
+
+	s32 bmcst = IS_MCAST(pattrib->ra);
+	s32 res = _SUCCESS;
+
+_func_enter_;
+
+	if (pattrib->psta)
+	{
+		psta = pattrib->psta;
+	} else
+	{
+		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+		psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
+	}
+
+	if(psta==NULL)
+        {
+
+		DBG_871X("%s, psta==NUL\n", __func__);
+		return _FAIL;
+	}
+
+
+	if(!(psta->state &_FW_LINKED))
+	{
+		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
+		return _FAIL;
+	}
+
+	if (pxmitframe->buf_addr == NULL){
+		DBG_8192C("==> %s buf_addr==NULL \n",__FUNCTION__);
+		return _FAIL;
+	}
+
+	pbuf_start = pxmitframe->buf_addr;
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+	mem_start = pbuf_start + TXDESC_SIZE + (pxmitframe->pkt_offset * PACKET_OFFSET_SZ);
+#else
+	mem_start = pbuf_start + TXDESC_OFFSET;
+#endif
+
+	if (rtw_make_wlanhdr(padapter, mem_start, pattrib) == _FAIL) {
+		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("rtw_xmitframe_coalesce: rtw_make_wlanhdr fail; drop pkt\n"));
+		res = _FAIL;
+		goto exit;
+	}
+
+	_rtw_open_pktfile(pkt, &pktfile);
+	_rtw_pktfile_read(&pktfile, NULL, pattrib->pkt_hdrlen);
+
+	frg_inx = 0;
+	frg_len = pxmitpriv->frag_len - 4;//2346-4 = 2342
+
+	while (1)
+	{
+		llc_sz = 0;
+
+		mpdu_len = frg_len;
+
+		pframe = mem_start;
+
+		SetMFrag(mem_start);
+
+		pframe += pattrib->hdrlen;
+		mpdu_len -= pattrib->hdrlen;
+
+		//adding icv, if necessary...
+		if (pattrib->iv_len)
+		{
+			//if (check_fwstate(pmlmepriv, WIFI_MP_STATE))
+			//	psta = rtw_get_stainfo(pstapriv, get_bssid(pmlmepriv));
+			//else
+			//	psta = rtw_get_stainfo(pstapriv, pattrib->ra);
+
+			if (psta != NULL)
+			{
+				switch(pattrib->encrypt)
+				{
+					case _WEP40_:
+					case _WEP104_:
+							WEP_IV(pattrib->iv, psta->dot11txpn, pattrib->key_idx);
+						break;
+					case _TKIP_:
+						if(bmcst)
+							TKIP_IV(pattrib->iv, psta->dot11txpn, pattrib->key_idx);
+						else
+							TKIP_IV(pattrib->iv, psta->dot11txpn, 0);
+						break;
+					case _AES_:
+						if(bmcst)
+							AES_IV(pattrib->iv, psta->dot11txpn, pattrib->key_idx);
+						else
+							AES_IV(pattrib->iv, psta->dot11txpn, 0);
+						break;
+				}
+			}
+
+			_rtw_memcpy(pframe, pattrib->iv, pattrib->iv_len);
+
+			RT_TRACE(_module_rtl871x_xmit_c_, _drv_notice_,
+				 ("rtw_xmitframe_coalesce: keyid=%d pattrib->iv[3]=%.2x pframe=%.2x %.2x %.2x %.2x\n",
+				  padapter->securitypriv.dot11PrivacyKeyIndex, pattrib->iv[3], *pframe, *(pframe+1), *(pframe+2), *(pframe+3)));
+
+			pframe += pattrib->iv_len;
+
+			mpdu_len -= pattrib->iv_len;
+		}
+
+		if (frg_inx == 0) {
+			llc_sz = rtw_put_snap(pframe, pattrib->ether_type);
+			pframe += llc_sz;
+			mpdu_len -= llc_sz;
+		}
+
+		if ((pattrib->icv_len >0) && (pattrib->bswenc)) {
+			mpdu_len -= pattrib->icv_len;
+		}
+
+
+		if (bmcst) {
+			// don't do fragment to broadcat/multicast packets
+			mem_sz = _rtw_pktfile_read(&pktfile, pframe, pattrib->pktlen);
+		} else {
+			mem_sz = _rtw_pktfile_read(&pktfile, pframe, mpdu_len);
+		}
+
+		pframe += mem_sz;
+
+		if ((pattrib->icv_len >0 )&& (pattrib->bswenc)) {
+			_rtw_memcpy(pframe, pattrib->icv, pattrib->icv_len);
+			pframe += pattrib->icv_len;
+		}
+
+		frg_inx++;
+
+		if (bmcst || (rtw_endofpktfile(&pktfile) == _TRUE))
+		{
+			pattrib->nr_frags = frg_inx;
+
+			pattrib->last_txcmdsz = pattrib->hdrlen + pattrib->iv_len + ((pattrib->nr_frags==1)? llc_sz:0) +
+					((pattrib->bswenc) ? pattrib->icv_len : 0) + mem_sz;
+
+			ClearMFrag(mem_start);
+
+			break;
+		} else {
+			RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("%s: There're still something in packet!\n", __FUNCTION__));
+		}
+
+		addr = (SIZE_PTR)(pframe);
+
+		mem_start = (unsigned char *)RND4(addr) + TXDESC_OFFSET;
+		_rtw_memcpy(mem_start, pbuf_start + TXDESC_OFFSET, pattrib->hdrlen);
+	}
+
+	if (xmitframe_addmic(padapter, pxmitframe) == _FAIL)
+	{
+		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("xmitframe_addmic(padapter, pxmitframe)==_FAIL\n"));
+		res = _FAIL;
+		goto exit;
+	}
+
+	xmitframe_swencrypt(padapter, pxmitframe);
+
+	if(bmcst == _FALSE)
+		update_attrib_vcs_info(padapter, pxmitframe);
+	else
+		pattrib->vcs_mode = NONE_VCS;
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+#ifdef CONFIG_IEEE80211W
+//broadcast or multicast management pkt use BIP, unicast management pkt use CCMP encryption
+s32 rtw_mgmt_xmitframe_coalesce(_adapter *padapter, _pkt *pkt, struct xmit_frame *pxmitframe)
+{
+	struct pkt_file pktfile;
+	s32 frg_inx, frg_len, mpdu_len, llc_sz, mem_sz;
+	SIZE_PTR addr;
+	u8 *pframe, *mem_start = NULL, *tmp_buf=NULL;
+	u8 hw_hdr_offset, subtype ;
+	struct sta_info		*psta = NULL;
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	u8 *pbuf_start;
+	s32 bmcst = IS_MCAST(pattrib->ra);
+	s32 res = _FAIL;
+	u8 *BIP_AAD=NULL;
+	u8 *MGMT_body=NULL;
+
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	u8 MME[_MME_IE_LENGTH_];
+
+	_irqL irqL;
+	u32	ori_len;
+	mem_start = pframe = (u8 *)(pxmitframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+_func_enter_;
+	ori_len = BIP_AAD_SIZE+pattrib->pktlen;
+	tmp_buf = BIP_AAD = rtw_zmalloc(ori_len);
+	subtype = GetFrameSubType(pframe); //bit(7)~bit(2)
+
+	if(BIP_AAD == NULL)
+		return _FAIL;
+
+	_enter_critical_bh(&padapter->security_key_mutex, &irqL);
+
+	//only support station mode
+	if(!check_fwstate(pmlmepriv, WIFI_STATION_STATE) || !check_fwstate(pmlmepriv, _FW_LINKED))
+		goto xmitframe_coalesce_success;
+
+	//IGTK key is not install, it may not support 802.11w
+	if(padapter->securitypriv.binstallBIPkey != _TRUE)
+	{
+		DBG_871X("no instll BIP key\n");
+		goto xmitframe_coalesce_success;
+	}
+	//station mode doesn't need TX BIP, just ready the code
+	if(bmcst)
+	{
+		int frame_body_len;
+		u8 mic[16];
+
+		_rtw_memset(MME, 0, 18);
+
+		//other types doesn't need the BIP
+		if(GetFrameSubType(pframe) != WIFI_DEAUTH && GetFrameSubType(pframe) != WIFI_DISASSOC)
+			goto xmitframe_coalesce_fail;
+
+		MGMT_body = pframe + sizeof(struct rtw_ieee80211_hdr_3addr);
+		pframe += pattrib->pktlen;
+
+		//octent 0 and 1 is key index ,BIP keyid is 4 or 5, LSB only need octent 0
+		MME[0]=padapter->securitypriv.dot11wBIPKeyid;
+		//copy packet number
+		_rtw_memcpy(&MME[2], &pmlmeext->mgnt_80211w_IPN, 6);
+		//increase the packet number
+		pmlmeext->mgnt_80211w_IPN++;
+
+		//add MME IE with MIC all zero, MME string doesn't include element id and length
+		pframe = rtw_set_ie(pframe, _MME_IE_ , 16 , MME, &(pattrib->pktlen));
+		pattrib->last_txcmdsz = pattrib->pktlen;
+		// total frame length - header length
+		frame_body_len = pattrib->pktlen - sizeof(struct rtw_ieee80211_hdr_3addr);
+
+		//conscruct AAD, copy frame control field
+		_rtw_memcpy(BIP_AAD, &pwlanhdr->frame_ctl, 2);
+		ClearRetry(BIP_AAD);
+		ClearPwrMgt(BIP_AAD);
+		ClearMData(BIP_AAD);
+		//conscruct AAD, copy address 1 to address 3
+		_rtw_memcpy(BIP_AAD+2, pwlanhdr->addr1, 18);
+		//copy management fram body
+		_rtw_memcpy(BIP_AAD+BIP_AAD_SIZE, MGMT_body, frame_body_len);
+		/*//dump total packet include MME with zero MIC
+		{
+			int i;
+			printk("Total packet: ");
+			for(i=0; i < BIP_AAD_SIZE+frame_body_len; i++)
+				printk(" %02x ", BIP_AAD[i]);
+			printk("\n");
+		}*/
+		//calculate mic
+		if(omac1_aes_128(padapter->securitypriv.dot11wBIPKey[padapter->securitypriv.dot11wBIPKeyid].skey
+			, BIP_AAD, BIP_AAD_SIZE+frame_body_len, mic))
+			goto xmitframe_coalesce_fail;
+
+		/*//dump calculated mic result
+		{
+			int i;
+			printk("Calculated mic result: ");
+			for(i=0; i<16; i++)
+				printk(" %02x ", mic[i]);
+			printk("\n");
+		}*/
+		//copy right BIP mic value, total is 128bits, we use the 0~63 bits
+		_rtw_memcpy(pframe-8, mic, 8);
+		/*/dump all packet after mic ok
+		{
+			int pp;
+			printk("pattrib->pktlen = %d \n", pattrib->pktlen);
+			for(pp=0;pp< pattrib->pktlen; pp++)
+				printk(" %02x ", mem_start[pp]);
+			printk("\n");
+		}*/
+	}
+	else //unicast mgmt frame TX
+	{
+		//start to encrypt mgmt frame
+		if(subtype == WIFI_DEAUTH || subtype == WIFI_DISASSOC ||
+			subtype == WIFI_REASSOCREQ || subtype == WIFI_ACTION)
+		{
+			if (pattrib->psta)
+				psta = pattrib->psta;
+			else
+			{
+				psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
+			}
+
+			if(psta==NULL)
+			{
+
+				DBG_871X("%s, psta==NUL\n", __func__);
+				goto xmitframe_coalesce_fail;
+			}
+
+			if(!(psta->state & _FW_LINKED) || pxmitframe->buf_addr==NULL)
+			{
+				DBG_871X("%s, not _FW_LINKED or addr null\n", __func__);
+				goto xmitframe_coalesce_fail;
+			}
+
+			//DBG_871X("%s, action frame category=%d \n", __func__, pframe[WLAN_HDR_A3_LEN]);
+			//according 802.11-2012 standard, these five types are not robust types
+			if(subtype == WIFI_ACTION &&
+			(pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_PUBLIC ||
+			pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_HT ||
+			pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_UNPROTECTED_WNM ||
+			pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_SELF_PROTECTED  ||
+			pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_P2P))
+				goto xmitframe_coalesce_fail;
+			//before encrypt dump the management packet content
+			/*{
+				int i;
+				printk("Management pkt: ");
+				for(i=0; i<pattrib->pktlen; i++)
+				printk(" %02x ", pframe[i]);
+				printk("=======\n");
+			}*/
+			if(pattrib->encrypt>0)
+				_rtw_memcpy(pattrib->dot118021x_UncstKey.skey, psta->dot118021x_UncstKey.skey, 16);
+			//bakeup original management packet
+			_rtw_memcpy(tmp_buf, pframe, pattrib->pktlen);
+			//move to data portion
+			pframe += pattrib->hdrlen;
+
+			//802.11w unicast management packet must be _AES_
+			pattrib->iv_len = 8;
+			//it's MIC of AES
+			pattrib->icv_len = 8;
+
+			switch(pattrib->encrypt)
+			{
+				case _AES_:
+						//set AES IV header
+						AES_IV(pattrib->iv, psta->dot11wtxpn, 0);
+					break;
+				default:
+					goto xmitframe_coalesce_fail;
+			}
+			//insert iv header into management frame
+			_rtw_memcpy(pframe, pattrib->iv, pattrib->iv_len);
+			pframe += pattrib->iv_len;
+			//copy mgmt data portion after CCMP header
+			_rtw_memcpy(pframe, tmp_buf+pattrib->hdrlen, pattrib->pktlen-pattrib->hdrlen);
+			//move pframe to end of mgmt pkt
+			pframe += pattrib->pktlen-pattrib->hdrlen;
+			//add 8 bytes CCMP IV header to length
+			pattrib->pktlen += pattrib->iv_len;
+			/*//dump management packet include AES IV header
+			{
+				int i;
+				printk("Management pkt + IV: ");
+				//for(i=0; i<pattrib->pktlen; i++)
+				//printk(" %02x ", mem_start[i]);
+				printk("@@@@@@@@@@@@@\n");
+			}*/
+
+			if ((pattrib->icv_len >0 )&& (pattrib->bswenc)) {
+				_rtw_memcpy(pframe, pattrib->icv, pattrib->icv_len);
+				pframe += pattrib->icv_len;
+			}
+			//add 8 bytes MIC
+			pattrib->pktlen += pattrib->icv_len;
+			//set final tx command size
+			pattrib->last_txcmdsz = pattrib->pktlen;
+
+			//set protected bit must be beofre SW encrypt
+			SetPrivacy(mem_start);
+			/*//dump management packet include AES header
+			{
+				int i;
+				printk("prepare to enc Management pkt + IV: ");
+				for(i=0; i<pattrib->pktlen; i++)
+				printk(" %02x ", mem_start[i]);
+				printk("@@@@@@@@@@@@@\n");
+			}*/
+			//software encrypt
+			xmitframe_swencrypt(padapter, pxmitframe);
+		}
+	}
+
+xmitframe_coalesce_success:
+	_exit_critical_bh(&padapter->security_key_mutex, &irqL);
+	rtw_mfree(BIP_AAD, ori_len);
+_func_exit_;
+	return _SUCCESS;
+
+xmitframe_coalesce_fail:
+	_exit_critical_bh(&padapter->security_key_mutex, &irqL);
+	rtw_mfree(BIP_AAD, ori_len);
+_func_exit_;
+
+	return _FAIL;
+}
+#endif //CONFIG_IEEE80211W
+
+/* Logical Link Control(LLC) SubNetwork Attachment Point(SNAP) header
+ * IEEE LLC/SNAP header contains 8 octets
+ * First 3 octets comprise the LLC portion
+ * SNAP portion, 5 octets, is divided into two fields:
+ *	Organizationally Unique Identifier(OUI), 3 octets,
+ *	type, defined by that organization, 2 octets.
+ */
+s32 rtw_put_snap(u8 *data, u16 h_proto)
+{
+	struct ieee80211_snap_hdr *snap;
+	u8 *oui;
+
+_func_enter_;
+
+	snap = (struct ieee80211_snap_hdr *)data;
+	snap->dsap = 0xaa;
+	snap->ssap = 0xaa;
+	snap->ctrl = 0x03;
+
+	if (h_proto == 0x8137 || h_proto == 0x80f3)
+		oui = P802_1H_OUI;
+	else
+		oui = RFC1042_OUI;
+
+	snap->oui[0] = oui[0];
+	snap->oui[1] = oui[1];
+	snap->oui[2] = oui[2];
+
+	*(u16 *)(data + SNAP_SIZE) = htons(h_proto);
+
+_func_exit_;
+
+	return SNAP_SIZE + sizeof(u16);
+}
+
+void rtw_update_protection(_adapter *padapter, u8 *ie, uint ie_len)
+{
+
+	uint	protection;
+	u8	*perp;
+	sint	 erp_len;
+	struct	xmit_priv *pxmitpriv = &padapter->xmitpriv;
+	struct	registry_priv *pregistrypriv = &padapter->registrypriv;
+
+_func_enter_;
+
+	switch(pxmitpriv->vcs_setting)
+	{
+		case DISABLE_VCS:
+			pxmitpriv->vcs = NONE_VCS;
+			break;
+
+		case ENABLE_VCS:
+			break;
+
+		case AUTO_VCS:
+		default:
+			perp = rtw_get_ie(ie, _ERPINFO_IE_, &erp_len, ie_len);
+			if(perp == NULL)
+			{
+				pxmitpriv->vcs = NONE_VCS;
+			}
+			else
+			{
+				protection = (*(perp + 2)) & BIT(1);
+				if (protection)
+				{
+					if(pregistrypriv->vcs_type == RTS_CTS)
+						pxmitpriv->vcs = RTS_CTS;
+					else
+						pxmitpriv->vcs = CTS_TO_SELF;
+				}
+				else
+					pxmitpriv->vcs = NONE_VCS;
+			}
+
+			break;
+
+	}
+
+_func_exit_;
+
+}
+
+void rtw_count_tx_stats(_adapter *padapter, struct xmit_frame *pxmitframe, int sz)
+{
+	struct sta_info *psta = NULL;
+	struct stainfo_stats *pstats = NULL;
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+
+	if((pxmitframe->frame_tag&0x0f) == DATA_FRAMETAG)
+	{
+		pxmitpriv->tx_bytes += sz;
+#ifdef CONFIG_USB_TX_AGGREGATION
+		pmlmepriv->LinkDetectInfo.NumTxOkInPeriod += pxmitframe->agg_num;
+#else
+		pmlmepriv->LinkDetectInfo.NumTxOkInPeriod++;
+#endif
+
+		psta = pxmitframe->attrib.psta;
+
+		if(psta)
+		{
+			pstats = &psta->sta_stats;
+#ifdef CONFIG_USB_TX_AGGREGATION
+			pstats->tx_pkts += pxmitframe->agg_num;
+#else
+			pstats->tx_pkts++;
+#endif
+			pstats->tx_bytes += sz;
+		}
+	}
+
+}
+
+struct xmit_buf *rtw_alloc_xmitbuf_ext(struct xmit_priv *pxmitpriv)
+{
+	_irqL irqL;
+	struct xmit_buf *pxmitbuf =  NULL;
+	_list *plist, *phead;
+	_queue *pfree_queue = &pxmitpriv->free_xmit_extbuf_queue;
+
+_func_enter_;
+
+	_enter_critical(&pfree_queue->lock, &irqL);
+
+	if(_rtw_queue_empty(pfree_queue) == _TRUE) {
+		pxmitbuf = NULL;
+	} else {
+
+		phead = get_list_head(pfree_queue);
+
+		plist = get_next(phead);
+
+		pxmitbuf = LIST_CONTAINOR(plist, struct xmit_buf, list);
+
+		rtw_list_delete(&(pxmitbuf->list));
+	}
+
+	if (pxmitbuf !=  NULL)
+	{
+		pxmitpriv->free_xmit_extbuf_cnt--;
+		#ifdef DBG_XMIT_BUF
+		DBG_871X("DBG_XMIT_BUF ALLOC no=%d,  free_xmit_extbuf_cnt=%d\n",pxmitbuf->no, pxmitpriv->free_xmit_extbuf_cnt);
+		#endif
+
+
+		pxmitbuf->priv_data = NULL;
+
+#ifdef CONFIG_SDIO_HCI
+		pxmitbuf->len = 0;
+		pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
+#endif
+#ifdef CONFIG_PCI_HCI
+		pxmitbuf->len = 0;
+#endif
+
+		if (pxmitbuf->sctx) {
+			DBG_871X("%s pxmitbuf->sctx is not NULL\n", __func__);
+			rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_BUF_ALLOC);
+		}
+
+	}
+
+	_exit_critical(&pfree_queue->lock, &irqL);
+
+_func_exit_;
+
+	return pxmitbuf;
+}
+
+s32 rtw_free_xmitbuf_ext(struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf)
+{
+	_irqL irqL;
+	_queue *pfree_queue = &pxmitpriv->free_xmit_extbuf_queue;
+
+_func_enter_;
+
+	if(pxmitbuf==NULL)
+	{
+		return _FAIL;
+	}
+
+	_enter_critical(&pfree_queue->lock, &irqL);
+
+	rtw_list_delete(&pxmitbuf->list);
+
+	rtw_list_insert_tail(&(pxmitbuf->list), get_list_head(pfree_queue));
+	pxmitpriv->free_xmit_extbuf_cnt++;
+	#ifdef DBG_XMIT_BUF
+	DBG_871X("DBG_XMIT_BUF FREE no=%d, free_xmit_extbuf_cnt=%d\n",pxmitbuf->no ,pxmitpriv->free_xmit_extbuf_cnt);
+	#endif
+
+	_exit_critical(&pfree_queue->lock, &irqL);
+
+_func_exit_;
+
+	return _SUCCESS;
+}
+
+struct xmit_buf *rtw_alloc_xmitbuf(struct xmit_priv *pxmitpriv)
+{
+	_irqL irqL;
+	struct xmit_buf *pxmitbuf =  NULL;
+	_list *plist, *phead;
+	_queue *pfree_xmitbuf_queue = &pxmitpriv->free_xmitbuf_queue;
+
+_func_enter_;
+
+	//DBG_871X("+rtw_alloc_xmitbuf\n");
+
+	_enter_critical(&pfree_xmitbuf_queue->lock, &irqL);
+
+	if(_rtw_queue_empty(pfree_xmitbuf_queue) == _TRUE) {
+		pxmitbuf = NULL;
+	} else {
+
+		phead = get_list_head(pfree_xmitbuf_queue);
+
+		plist = get_next(phead);
+
+		pxmitbuf = LIST_CONTAINOR(plist, struct xmit_buf, list);
+
+		rtw_list_delete(&(pxmitbuf->list));
+	}
+
+	if (pxmitbuf !=  NULL)
+	{
+		pxmitpriv->free_xmitbuf_cnt--;
+		#ifdef DBG_XMIT_BUF
+		DBG_871X("DBG_XMIT_BUF ALLOC no=%d,  free_xmitbuf_cnt=%d\n",pxmitbuf->no, pxmitpriv->free_xmitbuf_cnt);
+		#endif
+		//DBG_871X("alloc, free_xmitbuf_cnt=%d\n", pxmitpriv->free_xmitbuf_cnt);
+
+		pxmitbuf->priv_data = NULL;
+
+#ifdef CONFIG_SDIO_HCI
+		pxmitbuf->len = 0;
+		pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
+#endif
+#ifdef CONFIG_PCI_HCI
+		pxmitbuf->len = 0;
+#endif
+
+		if (pxmitbuf->sctx) {
+			DBG_871X("%s pxmitbuf->sctx is not NULL\n", __func__);
+			rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_BUF_ALLOC);
+		}
+	}
+	#ifdef DBG_XMIT_BUF
+	else
+	{
+		DBG_871X("DBG_XMIT_BUF rtw_alloc_xmitbuf return NULL\n");
+	}
+	#endif
+
+	_exit_critical(&pfree_xmitbuf_queue->lock, &irqL);
+
+_func_exit_;
+
+	return pxmitbuf;
+}
+
+s32 rtw_free_xmitbuf(struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf)
+{
+	_irqL irqL;
+	_queue *pfree_xmitbuf_queue = &pxmitpriv->free_xmitbuf_queue;
+
+_func_enter_;
+
+	//DBG_871X("+rtw_free_xmitbuf\n");
+
+	if(pxmitbuf==NULL)
+	{
+		return _FAIL;
+	}
+
+	if (pxmitbuf->sctx) {
+		DBG_871X("%s pxmitbuf->sctx is not NULL\n", __func__);
+		rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_BUF_FREE);
+	}
+
+	if(pxmitbuf->ext_tag)
+	{
+		rtw_free_xmitbuf_ext(pxmitpriv, pxmitbuf);
+	}
+	else
+	{
+		_enter_critical(&pfree_xmitbuf_queue->lock, &irqL);
+
+		rtw_list_delete(&pxmitbuf->list);
+
+		rtw_list_insert_tail(&(pxmitbuf->list), get_list_head(pfree_xmitbuf_queue));
+
+		pxmitpriv->free_xmitbuf_cnt++;
+		//DBG_871X("FREE, free_xmitbuf_cnt=%d\n", pxmitpriv->free_xmitbuf_cnt);
+		#ifdef DBG_XMIT_BUF
+		DBG_871X("DBG_XMIT_BUF FREE no=%d, free_xmitbuf_cnt=%d\n",pxmitbuf->no ,pxmitpriv->free_xmitbuf_cnt);
+		#endif
+		_exit_critical(&pfree_xmitbuf_queue->lock, &irqL);
+	}
+
+_func_exit_;
+
+	return _SUCCESS;
+}
+
+void rtw_init_xmitframe(struct xmit_frame *pxframe)
+{
+	if (pxframe !=  NULL)//default value setting
+	{
+		pxframe->buf_addr = NULL;
+		pxframe->pxmitbuf = NULL;
+
+		_rtw_memset(&pxframe->attrib, 0, sizeof(struct pkt_attrib));
+		//pxframe->attrib.psta = NULL;
+
+		pxframe->frame_tag = DATA_FRAMETAG;
+
+#ifdef CONFIG_USB_HCI
+		pxframe->pkt = NULL;
+		pxframe->pkt_offset = 1;//default use pkt_offset to fill tx desc
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+		pxframe->agg_num = 1;
+#endif
+
+#endif //#ifdef CONFIG_USB_HCI
+
+#if defined(CONFIG_SDIO_HCI) || defined(CONFIG_GSPI_HCI)
+		pxframe->pg_num = 1;
+		pxframe->agg_num = 1;
+#endif
+
+#ifdef CONFIG_XMIT_ACK
+		pxframe->ack_report = 0;
+#endif
+
+	}
+}
+
+/*
+Calling context:
+1. OS_TXENTRY
+2. RXENTRY (rx_thread or RX_ISR/RX_CallBack)
+
+If we turn on USE_RXTHREAD, then, no need for critical section.
+Otherwise, we must use _enter/_exit critical to protect free_xmit_queue...
+
+Must be very very cautious...
+
+*/
+struct xmit_frame *rtw_alloc_xmitframe(struct xmit_priv *pxmitpriv)//(_queue *pfree_xmit_queue)
+{
+	/*
+		Please remember to use all the osdep_service api,
+		and lock/unlock or _enter/_exit critical to protect
+		pfree_xmit_queue
+	*/
+
+	_irqL irqL;
+	struct xmit_frame *pxframe = NULL;
+	_list *plist, *phead;
+	_queue *pfree_xmit_queue = &pxmitpriv->free_xmit_queue;
+#ifdef PLATFORM_LINUX
+	_adapter *padapter = pxmitpriv->adapter;
+#endif //PLATFORM_LINUX
+
+_func_enter_;
+
+	_enter_critical_bh(&pfree_xmit_queue->lock, &irqL);
+
+	if (_rtw_queue_empty(pfree_xmit_queue) == _TRUE) {
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_alloc_xmitframe:%d\n", pxmitpriv->free_xmitframe_cnt));
+		pxframe =  NULL;
+	} else {
+		phead = get_list_head(pfree_xmit_queue);
+
+		plist = get_next(phead);
+
+		pxframe = LIST_CONTAINOR(plist, struct xmit_frame, list);
+
+		rtw_list_delete(&(pxframe->list));
+		pxmitpriv->free_xmitframe_cnt--;
+		RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_, ("rtw_alloc_xmitframe():free_xmitframe_cnt=%d\n", pxmitpriv->free_xmitframe_cnt));
+	}
+
+#ifdef PLATFORM_LINUX
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35))
+		if(pxmitpriv->free_xmitframe_cnt==1)
+		{
+			if (!rtw_netif_queue_stopped(padapter->pnetdev))
+				rtw_netif_stop_queue(padapter->pnetdev);
+		}
+#endif
+#endif
+
+	_exit_critical_bh(&pfree_xmit_queue->lock, &irqL);
+
+	rtw_init_xmitframe(pxframe);
+
+_func_exit_;
+
+	return pxframe;
+}
+
+struct xmit_frame *rtw_alloc_xmitframe_ext(struct xmit_priv *pxmitpriv)
+{
+	_irqL irqL;
+	struct xmit_frame *pxframe = NULL;
+	_list *plist, *phead;
+	_queue *queue = &pxmitpriv->free_xframe_ext_queue;
+
+_func_enter_;
+
+	_enter_critical_bh(&queue->lock, &irqL);
+
+	if (_rtw_queue_empty(queue) == _TRUE) {
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_alloc_xmitframe_ext:%d\n", pxmitpriv->free_xframe_ext_cnt));
+		pxframe =  NULL;
+	} else {
+		phead = get_list_head(queue);
+		plist = get_next(phead);
+		pxframe = LIST_CONTAINOR(plist, struct xmit_frame, list);
+
+		rtw_list_delete(&(pxframe->list));
+		pxmitpriv->free_xframe_ext_cnt--;
+		RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_, ("rtw_alloc_xmitframe_ext():free_xmitframe_cnt=%d\n", pxmitpriv->free_xframe_ext_cnt));
+	}
+
+	_exit_critical_bh(&queue->lock, &irqL);
+
+	rtw_init_xmitframe(pxframe);
+
+_func_exit_;
+
+	return pxframe;
+}
+
+struct xmit_frame *rtw_alloc_xmitframe_once(struct xmit_priv *pxmitpriv)
+{
+	struct xmit_frame *pxframe = NULL;
+	u8 *alloc_addr;
+
+	alloc_addr = rtw_zmalloc(sizeof(struct xmit_frame) + 4);
+
+	if (alloc_addr == NULL)
+		goto exit;
+
+	pxframe = (struct xmit_frame *)N_BYTE_ALIGMENT((SIZE_PTR)(alloc_addr), 4);
+	pxframe->alloc_addr = alloc_addr;
+
+	pxframe->padapter = pxmitpriv->adapter;
+	pxframe->frame_tag = NULL_FRAMETAG;
+
+	pxframe->pkt = NULL;
+
+	pxframe->buf_addr = NULL;
+	pxframe->pxmitbuf = NULL;
+
+	rtw_init_xmitframe(pxframe);
+
+	DBG_871X("################## %s ##################\n", __func__);
+
+exit:
+	return pxframe;
+}
+
+s32 rtw_free_xmitframe(struct xmit_priv *pxmitpriv, struct xmit_frame *pxmitframe)
+{
+	_irqL irqL;
+	_queue *queue = NULL;
+	_adapter *padapter = pxmitpriv->adapter;
+	_pkt *pndis_pkt = NULL;
+
+_func_enter_;
+
+	if (pxmitframe == NULL) {
+		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("======rtw_free_xmitframe():pxmitframe==NULL!!!!!!!!!!\n"));
+		goto exit;
+	}
+
+	if (pxmitframe->pkt){
+		pndis_pkt = pxmitframe->pkt;
+		pxmitframe->pkt = NULL;
+	}
+
+	if (pxmitframe->alloc_addr) {
+		DBG_871X("################## %s with alloc_addr ##################\n", __func__);
+		rtw_mfree(pxmitframe->alloc_addr, sizeof(struct xmit_frame) + 4);
+		goto check_pkt_complete;
+	}
+
+	if (pxmitframe->ext_tag == 0)
+		queue = &pxmitpriv->free_xmit_queue;
+	else if(pxmitframe->ext_tag == 1)
+		queue = &pxmitpriv->free_xframe_ext_queue;
+	else
+	{}
+
+	_enter_critical_bh(&queue->lock, &irqL);
+
+	rtw_list_delete(&pxmitframe->list);
+	rtw_list_insert_tail(&pxmitframe->list, get_list_head(queue));
+	if (pxmitframe->ext_tag == 0) {
+		pxmitpriv->free_xmitframe_cnt++;
+		RT_TRACE(_module_rtl871x_xmit_c_, _drv_debug_, ("rtw_free_xmitframe():free_xmitframe_cnt=%d\n", pxmitpriv->free_xmitframe_cnt));
+	} else if(pxmitframe->ext_tag == 1) {
+		pxmitpriv->free_xframe_ext_cnt++;
+		RT_TRACE(_module_rtl871x_xmit_c_, _drv_debug_, ("rtw_free_xmitframe():free_xframe_ext_cnt=%d\n", pxmitpriv->free_xframe_ext_cnt));
+	} else {
+	}
+
+	_exit_critical_bh(&queue->lock, &irqL);
+
+check_pkt_complete:
+
+	if(pndis_pkt)
+		rtw_os_pkt_complete(padapter, pndis_pkt);
+
+exit:
+
+_func_exit_;
+
+	return _SUCCESS;
+}
+
+void rtw_free_xmitframe_queue(struct xmit_priv *pxmitpriv, _queue *pframequeue)
+{
+	_irqL irqL;
+	_list	*plist, *phead;
+	struct	xmit_frame 	*pxmitframe;
+
+_func_enter_;
+
+	_enter_critical_bh(&(pframequeue->lock), &irqL);
+
+	phead = get_list_head(pframequeue);
+	plist = get_next(phead);
+
+	while (rtw_end_of_queue_search(phead, plist) == _FALSE)
+	{
+
+		pxmitframe = LIST_CONTAINOR(plist, struct xmit_frame, list);
+
+		plist = get_next(plist);
+
+		rtw_free_xmitframe(pxmitpriv,pxmitframe);
+
+	}
+	_exit_critical_bh(&(pframequeue->lock), &irqL);
+
+_func_exit_;
+}
+
+s32 rtw_xmitframe_enqueue(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	if (rtw_xmit_classifier(padapter, pxmitframe) == _FAIL)
+	{
+		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_,
+			 ("rtw_xmitframe_enqueue: drop xmit pkt for classifier fail\n"));
+//		pxmitframe->pkt = NULL;
+		return _FAIL;
+	}
+
+	return _SUCCESS;
+}
+
+static struct xmit_frame *dequeue_one_xmitframe(struct xmit_priv *pxmitpriv, struct hw_xmit *phwxmit, struct tx_servq *ptxservq, _queue *pframe_queue)
+{
+	_list	*xmitframe_plist, *xmitframe_phead;
+	struct	xmit_frame	*pxmitframe=NULL;
+
+	xmitframe_phead = get_list_head(pframe_queue);
+	xmitframe_plist = get_next(xmitframe_phead);
+
+	while ((rtw_end_of_queue_search(xmitframe_phead, xmitframe_plist)) == _FALSE)
+	{
+		pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
+
+		xmitframe_plist = get_next(xmitframe_plist);
+
+/*#ifdef RTK_DMP_PLATFORM
+#ifdef CONFIG_USB_TX_AGGREGATION
+		if((ptxservq->qcnt>0) && (ptxservq->qcnt<=2))
+		{
+			pxmitframe = NULL;
+
+			tasklet_schedule(&pxmitpriv->xmit_tasklet);
+
+			break;
+		}
+#endif
+#endif*/
+		rtw_list_delete(&pxmitframe->list);
+
+		ptxservq->qcnt--;
+
+			break;
+
+		pxmitframe = NULL;
+
+	}
+
+	return pxmitframe;
+}
+
+struct xmit_frame* rtw_dequeue_xframe(struct xmit_priv *pxmitpriv, struct hw_xmit *phwxmit_i, sint entry)
+{
+	_irqL irqL0;
+	_list *sta_plist, *sta_phead;
+	struct hw_xmit *phwxmit;
+	struct tx_servq *ptxservq = NULL;
+	_queue *pframe_queue = NULL;
+	struct xmit_frame *pxmitframe = NULL;
+	_adapter *padapter = pxmitpriv->adapter;
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	int i, inx[4];
+#ifdef CONFIG_USB_HCI
+//	int j, tmp, acirp_cnt[4];
+#endif
+
+_func_enter_;
+
+	inx[0] = 0; inx[1] = 1; inx[2] = 2; inx[3] = 3;
+
+	if(pregpriv->wifi_spec==1)
+	{
+		int j, tmp, acirp_cnt[4];
+#if 0
+		if(flags<XMIT_QUEUE_ENTRY)
+		{
+			//priority exchange according to the completed xmitbuf flags.
+			inx[flags] = 0;
+			inx[0] = flags;
+		}
+#endif
+
+#ifdef CONFIG_USB_HCI
+		//entry indx: 0->vo, 1->vi, 2->be, 3->bk.
+		acirp_cnt[0] = pxmitpriv->voq_cnt;
+		acirp_cnt[1] = pxmitpriv->viq_cnt;
+		acirp_cnt[2] = pxmitpriv->beq_cnt;
+		acirp_cnt[3] = pxmitpriv->bkq_cnt;
+
+		for(i=0; i<4; i++)
+		{
+			for(j=i+1; j<4; j++)
+			{
+				if(acirp_cnt[j]<acirp_cnt[i])
+				{
+					tmp = acirp_cnt[i];
+					acirp_cnt[i] = acirp_cnt[j];
+					acirp_cnt[j] = tmp;
+
+					tmp = inx[i];
+					inx[i] = inx[j];
+					inx[j] = tmp;
+				}
+			}
+		}
+#endif
+	}
+
+	_enter_critical_bh(&pxmitpriv->lock, &irqL0);
+
+	for(i = 0; i < entry; i++)
+	{
+		phwxmit = phwxmit_i + inx[i];
+
+		//_enter_critical_ex(&phwxmit->sta_queue->lock, &irqL0);
+
+		sta_phead = get_list_head(phwxmit->sta_queue);
+		sta_plist = get_next(sta_phead);
+
+		while ((rtw_end_of_queue_search(sta_phead, sta_plist)) == _FALSE)
+		{
+
+			ptxservq= LIST_CONTAINOR(sta_plist, struct tx_servq, tx_pending);
+
+			pframe_queue = &ptxservq->sta_pending;
+
+			pxmitframe = dequeue_one_xmitframe(pxmitpriv, phwxmit, ptxservq, pframe_queue);
+
+			if(pxmitframe)
+			{
+				phwxmit->accnt--;
+
+				//Remove sta node when there is no pending packets.
+				if(_rtw_queue_empty(pframe_queue)) //must be done after get_next and before break
+					rtw_list_delete(&ptxservq->tx_pending);
+
+				//_exit_critical_ex(&phwxmit->sta_queue->lock, &irqL0);
+
+				goto exit;
+			}
+
+			sta_plist = get_next(sta_plist);
+
+		}
+
+		//_exit_critical_ex(&phwxmit->sta_queue->lock, &irqL0);
+
+	}
+
+exit:
+
+	_exit_critical_bh(&pxmitpriv->lock, &irqL0);
+
+_func_exit_;
+
+	return pxmitframe;
+}
+
+#if 1
+struct tx_servq *rtw_get_sta_pending(_adapter *padapter, struct sta_info *psta, sint up, u8 *ac)
+{
+	struct tx_servq *ptxservq=NULL;
+
+_func_enter_;
+
+	switch (up)
+	{
+		case 1:
+		case 2:
+			ptxservq = &(psta->sta_xmitpriv.bk_q);
+			*(ac) = 3;
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_get_sta_pending : BK \n"));
+			break;
+
+		case 4:
+		case 5:
+			ptxservq = &(psta->sta_xmitpriv.vi_q);
+			*(ac) = 1;
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_get_sta_pending : VI\n"));
+			break;
+
+		case 6:
+		case 7:
+			ptxservq = &(psta->sta_xmitpriv.vo_q);
+			*(ac) = 0;
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_get_sta_pending : VO \n"));
+			break;
+
+		case 0:
+		case 3:
+		default:
+			ptxservq = &(psta->sta_xmitpriv.be_q);
+			*(ac) = 2;
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_get_sta_pending : BE \n"));
+		break;
+
+	}
+
+_func_exit_;
+
+	return ptxservq;
+}
+#else
+__inline static struct tx_servq *rtw_get_sta_pending
+	(_adapter *padapter, _queue **ppstapending, struct sta_info *psta, sint up)
+{
+	struct tx_servq *ptxservq;
+	struct hw_xmit *phwxmits =  padapter->xmitpriv.hwxmits;
+
+_func_enter_;
+
+#ifdef CONFIG_RTL8711
+
+	if(IS_MCAST(psta->hwaddr))
+	{
+		ptxservq = &(psta->sta_xmitpriv.be_q); // we will use be_q to queue bc/mc frames in BCMC_stainfo
+		*ppstapending = &padapter->xmitpriv.bm_pending;
+	}
+	else
+#endif
+	{
+		switch (up)
+		{
+			case 1:
+			case 2:
+				ptxservq = &(psta->sta_xmitpriv.bk_q);
+				*ppstapending = &padapter->xmitpriv.bk_pending;
+				(phwxmits+3)->accnt++;
+				RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_get_sta_pending : BK \n"));
+				break;
+
+			case 4:
+			case 5:
+				ptxservq = &(psta->sta_xmitpriv.vi_q);
+				*ppstapending = &padapter->xmitpriv.vi_pending;
+				(phwxmits+1)->accnt++;
+				RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_get_sta_pending : VI\n"));
+				break;
+
+			case 6:
+			case 7:
+				ptxservq = &(psta->sta_xmitpriv.vo_q);
+				*ppstapending = &padapter->xmitpriv.vo_pending;
+				(phwxmits+0)->accnt++;
+				RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_get_sta_pending : VO \n"));
+				break;
+
+			case 0:
+			case 3:
+			default:
+				ptxservq = &(psta->sta_xmitpriv.be_q);
+				*ppstapending = &padapter->xmitpriv.be_pending;
+				(phwxmits+2)->accnt++;
+				RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_get_sta_pending : BE \n"));
+			break;
+
+		}
+
+	}
+
+_func_exit_;
+
+	return ptxservq;
+}
+#endif
+
+/*
+ * Will enqueue pxmitframe to the proper queue,
+ * and indicate it to xx_pending list.....
+ */
+s32 rtw_xmit_classifier(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	//_irqL irqL0;
+	u8	ac_index;
+	struct sta_info	*psta;
+	struct tx_servq	*ptxservq;
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	struct sta_priv	*pstapriv = &padapter->stapriv;
+	struct hw_xmit	*phwxmits =  padapter->xmitpriv.hwxmits;
+	sint res = _SUCCESS;
+
+_func_enter_;
+
+	if (pattrib->psta) {
+		psta = pattrib->psta;
+	} else {
+		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+		psta = rtw_get_stainfo(pstapriv, pattrib->ra);
+	}
+
+	if (psta == NULL) {
+		res = _FAIL;
+		DBG_8192C("rtw_xmit_classifier: psta == NULL\n");
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("rtw_xmit_classifier: psta == NULL\n"));
+		goto exit;
+	}
+
+	if(!(psta->state &_FW_LINKED))
+	{
+		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
+		return _FAIL;
+	}
+
+	ptxservq = rtw_get_sta_pending(padapter, psta, pattrib->priority, (u8 *)(&ac_index));
+
+	//_enter_critical(&pstapending->lock, &irqL0);
+
+	if (rtw_is_list_empty(&ptxservq->tx_pending)) {
+		rtw_list_insert_tail(&ptxservq->tx_pending, get_list_head(phwxmits[ac_index].sta_queue));
+	}
+
+	//_enter_critical(&ptxservq->sta_pending.lock, &irqL1);
+
+	rtw_list_insert_tail(&pxmitframe->list, get_list_head(&ptxservq->sta_pending));
+	ptxservq->qcnt++;
+	phwxmits[ac_index].accnt++;
+
+	//_exit_critical(&ptxservq->sta_pending.lock, &irqL1);
+
+	//_exit_critical(&pstapending->lock, &irqL0);
+
+exit:
+
+_func_exit_;
+
+	return res;
+}
+
+void rtw_alloc_hwxmits(_adapter *padapter)
+{
+	struct hw_xmit *hwxmits;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+
+	pxmitpriv->hwxmit_entry = HWXMIT_ENTRY;
+
+	pxmitpriv->hwxmits = (struct hw_xmit *)rtw_zmalloc(sizeof (struct hw_xmit) * pxmitpriv->hwxmit_entry);
+
+	hwxmits = pxmitpriv->hwxmits;
+
+	if(pxmitpriv->hwxmit_entry == 5)
+	{
+		//pxmitpriv->bmc_txqueue.head = 0;
+		//hwxmits[0] .phwtxqueue = &pxmitpriv->bmc_txqueue;
+		hwxmits[0] .sta_queue = &pxmitpriv->bm_pending;
+
+		//pxmitpriv->vo_txqueue.head = 0;
+		//hwxmits[1] .phwtxqueue = &pxmitpriv->vo_txqueue;
+		hwxmits[1] .sta_queue = &pxmitpriv->vo_pending;
+
+		//pxmitpriv->vi_txqueue.head = 0;
+		//hwxmits[2] .phwtxqueue = &pxmitpriv->vi_txqueue;
+		hwxmits[2] .sta_queue = &pxmitpriv->vi_pending;
+
+		//pxmitpriv->bk_txqueue.head = 0;
+		//hwxmits[3] .phwtxqueue = &pxmitpriv->bk_txqueue;
+		hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
+
+		//pxmitpriv->be_txqueue.head = 0;
+		//hwxmits[4] .phwtxqueue = &pxmitpriv->be_txqueue;
+		hwxmits[4] .sta_queue = &pxmitpriv->be_pending;
+
+	}
+	else if(pxmitpriv->hwxmit_entry == 4)
+	{
+
+		//pxmitpriv->vo_txqueue.head = 0;
+		//hwxmits[0] .phwtxqueue = &pxmitpriv->vo_txqueue;
+		hwxmits[0] .sta_queue = &pxmitpriv->vo_pending;
+
+		//pxmitpriv->vi_txqueue.head = 0;
+		//hwxmits[1] .phwtxqueue = &pxmitpriv->vi_txqueue;
+		hwxmits[1] .sta_queue = &pxmitpriv->vi_pending;
+
+		//pxmitpriv->be_txqueue.head = 0;
+		//hwxmits[2] .phwtxqueue = &pxmitpriv->be_txqueue;
+		hwxmits[2] .sta_queue = &pxmitpriv->be_pending;
+
+		//pxmitpriv->bk_txqueue.head = 0;
+		//hwxmits[3] .phwtxqueue = &pxmitpriv->bk_txqueue;
+		hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
+	}
+	else
+	{
+
+
+	}
+
+
+}
+
+void rtw_free_hwxmits(_adapter *padapter)
+{
+	struct hw_xmit *hwxmits;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+
+	hwxmits = pxmitpriv->hwxmits;
+	if(hwxmits)
+		rtw_mfree((u8 *)hwxmits, (sizeof (struct hw_xmit) * pxmitpriv->hwxmit_entry));
+}
+
+void rtw_init_hwxmits(struct hw_xmit *phwxmit, sint entry)
+{
+	sint i;
+_func_enter_;
+	for(i = 0; i < entry; i++, phwxmit++)
+	{
+		//_rtw_spinlock_init(&phwxmit->xmit_lock);
+		//_rtw_init_listhead(&phwxmit->pending);
+		//phwxmit->txcmdcnt = 0;
+		phwxmit->accnt = 0;
+	}
+_func_exit_;
+}
+
+#ifdef CONFIG_BR_EXT
+int rtw_br_client_tx(_adapter *padapter, struct sk_buff **pskb)
+{
+	struct sk_buff *skb = *pskb;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+	_irqL irqL;
+	//if(check_fwstate(pmlmepriv, WIFI_STATION_STATE|WIFI_ADHOC_STATE) == _TRUE)
+	{
+		void dhcp_flag_bcast(_adapter *priv, struct sk_buff *skb);
+		int res, is_vlan_tag=0, i, do_nat25=1;
+		unsigned short vlan_hdr=0;
+		void *br_port = NULL;
+
+		//mac_clone_handle_frame(priv, skb);
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+		br_port = padapter->pnetdev->br_port;
+#else   // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+		rcu_read_lock();
+		br_port = rcu_dereference(padapter->pnetdev->rx_handler_data);
+		rcu_read_unlock();
+#endif  // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+		_enter_critical_bh(&padapter->br_ext_lock, &irqL);
+		if (	!(skb->data[0] & 1) &&
+				br_port &&
+				memcmp(skb->data+MACADDRLEN, padapter->br_mac, MACADDRLEN) &&
+				*((unsigned short *)(skb->data+MACADDRLEN*2)) != __constant_htons(ETH_P_8021Q) &&
+				*((unsigned short *)(skb->data+MACADDRLEN*2)) == __constant_htons(ETH_P_IP) &&
+				!memcmp(padapter->scdb_mac, skb->data+MACADDRLEN, MACADDRLEN) && padapter->scdb_entry) {
+			memcpy(skb->data+MACADDRLEN, GET_MY_HWADDR(padapter), MACADDRLEN);
+			padapter->scdb_entry->ageing_timer = jiffies;
+			_exit_critical_bh(&padapter->br_ext_lock, &irqL);
+		}
+		else
+		//if (!priv->pmib->ethBrExtInfo.nat25_disable)
+		{
+//			if (priv->dev->br_port &&
+//				 !memcmp(skb->data+MACADDRLEN, priv->br_mac, MACADDRLEN)) {
+#if 1
+			if (*((unsigned short *)(skb->data+MACADDRLEN*2)) == __constant_htons(ETH_P_8021Q)) {
+				is_vlan_tag = 1;
+				vlan_hdr = *((unsigned short *)(skb->data+MACADDRLEN*2+2));
+				for (i=0; i<6; i++)
+					*((unsigned short *)(skb->data+MACADDRLEN*2+2-i*2)) = *((unsigned short *)(skb->data+MACADDRLEN*2-2-i*2));
+				skb_pull(skb, 4);
+			}
+			//if SA == br_mac && skb== IP  => copy SIP to br_ip ?? why
+			if (!memcmp(skb->data+MACADDRLEN, padapter->br_mac, MACADDRLEN) &&
+				(*((unsigned short *)(skb->data+MACADDRLEN*2)) == __constant_htons(ETH_P_IP)))
+				memcpy(padapter->br_ip, skb->data+WLAN_ETHHDR_LEN+12, 4);
+
+			if (*((unsigned short *)(skb->data+MACADDRLEN*2)) == __constant_htons(ETH_P_IP)) {
+				if (memcmp(padapter->scdb_mac, skb->data+MACADDRLEN, MACADDRLEN)) {
+					void *scdb_findEntry(_adapter *priv, unsigned char *macAddr, unsigned char *ipAddr);
+
+					if ((padapter->scdb_entry = (struct nat25_network_db_entry *)scdb_findEntry(padapter,
+								skb->data+MACADDRLEN, skb->data+WLAN_ETHHDR_LEN+12)) != NULL) {
+						memcpy(padapter->scdb_mac, skb->data+MACADDRLEN, MACADDRLEN);
+						memcpy(padapter->scdb_ip, skb->data+WLAN_ETHHDR_LEN+12, 4);
+						padapter->scdb_entry->ageing_timer = jiffies;
+						do_nat25 = 0;
+					}
+				}
+				else {
+					if (padapter->scdb_entry) {
+						padapter->scdb_entry->ageing_timer = jiffies;
+						do_nat25 = 0;
+					}
+					else {
+						memset(padapter->scdb_mac, 0, MACADDRLEN);
+						memset(padapter->scdb_ip, 0, 4);
+					}
+				}
+			}
+			_exit_critical_bh(&padapter->br_ext_lock, &irqL);
+#endif // 1
+			if (do_nat25)
+			{
+				int nat25_db_handle(_adapter *priv, struct sk_buff *skb, int method);
+				if (nat25_db_handle(padapter, skb, NAT25_CHECK) == 0) {
+					struct sk_buff *newskb;
+
+					if (is_vlan_tag) {
+						skb_push(skb, 4);
+						for (i=0; i<6; i++)
+							*((unsigned short *)(skb->data+i*2)) = *((unsigned short *)(skb->data+4+i*2));
+						*((unsigned short *)(skb->data+MACADDRLEN*2)) = __constant_htons(ETH_P_8021Q);
+						*((unsigned short *)(skb->data+MACADDRLEN*2+2)) = vlan_hdr;
+					}
+
+					newskb = rtw_skb_copy(skb);
+					if (newskb == NULL) {
+						//priv->ext_stats.tx_drops++;
+						DEBUG_ERR("TX DROP: rtw_skb_copy fail!\n");
+						//goto stop_proc;
+						return -1;
+					}
+					rtw_skb_free(skb);
+
+					*pskb = skb = newskb;
+					if (is_vlan_tag) {
+						vlan_hdr = *((unsigned short *)(skb->data+MACADDRLEN*2+2));
+						for (i=0; i<6; i++)
+							*((unsigned short *)(skb->data+MACADDRLEN*2+2-i*2)) = *((unsigned short *)(skb->data+MACADDRLEN*2-2-i*2));
+						skb_pull(skb, 4);
+					}
+				}
+
+				if (skb_is_nonlinear(skb))
+					DEBUG_ERR("%s(): skb_is_nonlinear!!\n", __FUNCTION__);
+
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18))
+				res = skb_linearize(skb, GFP_ATOMIC);
+#else	// (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18))
+				res = skb_linearize(skb);
+#endif	// (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18))
+				if (res < 0) {
+						DEBUG_ERR("TX DROP: skb_linearize fail!\n");
+						//goto free_and_stop;
+						return -1;
+				}
+
+				res = nat25_db_handle(padapter, skb, NAT25_INSERT);
+				if (res < 0) {
+					if (res == -2) {
+						//priv->ext_stats.tx_drops++;
+						DEBUG_ERR("TX DROP: nat25_db_handle fail!\n");
+						//goto free_and_stop;
+						return -1;
+
+					}
+					// we just print warning message and let it go
+					//DEBUG_WARN("%s()-%d: nat25_db_handle INSERT Warning!\n", __FUNCTION__, __LINE__);
+					//return -1; // return -1 will cause system crash on 2011/08/30!
+					return 0;
+				}
+			}
+
+			memcpy(skb->data+MACADDRLEN, GET_MY_HWADDR(padapter), MACADDRLEN);
+
+			dhcp_flag_bcast(padapter, skb);
+
+			if (is_vlan_tag) {
+				skb_push(skb, 4);
+				for (i=0; i<6; i++)
+					*((unsigned short *)(skb->data+i*2)) = *((unsigned short *)(skb->data+4+i*2));
+				*((unsigned short *)(skb->data+MACADDRLEN*2)) = __constant_htons(ETH_P_8021Q);
+				*((unsigned short *)(skb->data+MACADDRLEN*2+2)) = vlan_hdr;
+			}
+		}
+#if 0
+		else{
+			if (*((unsigned short *)(skb->data+MACADDRLEN*2)) == __constant_htons(ETH_P_8021Q)) {
+				is_vlan_tag = 1;
+			}
+
+			if(is_vlan_tag){
+				if(ICMPV6_MCAST_MAC(skb->data) && ICMPV6_PROTO1A_VALN(skb->data)){
+                                        memcpy(skb->data+MACADDRLEN, GET_MY_HWADDR(padapter), MACADDRLEN);
+				}
+			}else
+			{
+				if(ICMPV6_MCAST_MAC(skb->data) && ICMPV6_PROTO1A(skb->data)){
+                                        memcpy(skb->data+MACADDRLEN, GET_MY_HWADDR(padapter), MACADDRLEN);
+				}
+			}
+		}
+#endif	// 0
+
+		// check if SA is equal to our MAC
+		if (memcmp(skb->data+MACADDRLEN, GET_MY_HWADDR(padapter), MACADDRLEN)) {
+			//priv->ext_stats.tx_drops++;
+			DEBUG_ERR("TX DROP: untransformed frame SA:%02X%02X%02X%02X%02X%02X!\n",
+				skb->data[6],skb->data[7],skb->data[8],skb->data[9],skb->data[10],skb->data[11]);
+			//goto free_and_stop;
+			return -1;
+		}
+	}
+	return 0;
+}
+#endif	// CONFIG_BR_EXT
+
+static void do_queue_select(_adapter	*padapter, struct pkt_attrib *pattrib)
+{
+	u8 qsel;
+
+	qsel = pattrib->priority;
+	RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("### do_queue_select priority=%d ,qsel = %d\n",pattrib->priority ,qsel));
+
+#ifdef CONFIG_CONCURRENT_MODE
+//	if (check_fwstate(&padapter->mlmepriv, WIFI_AP_STATE) == _TRUE)
+//		qsel = 7;//
+#endif
+
+	pattrib->qsel = qsel;
+}
+
+/*
+ * The main transmit(tx) entry
+ *
+ * Return
+ *	1	enqueue
+ *	0	success, hardware will handle this xmit frame(packet)
+ *	<0	fail
+ */
+s32 rtw_xmit(_adapter *padapter, _pkt **ppkt)
+{
+	static u32 start = 0;
+	static u32 drop_cnt = 0;
+#ifdef CONFIG_AP_MODE
+	_irqL irqL0;
+#endif
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+	struct xmit_frame *pxmitframe = NULL;
+#ifdef CONFIG_BR_EXT
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	void *br_port = NULL;
+#endif	// CONFIG_BR_EXT
+
+	s32 res;
+
+	if (start == 0)
+		start = rtw_get_current_time();
+
+	pxmitframe = rtw_alloc_xmitframe(pxmitpriv);
+
+	if (rtw_get_passing_time_ms(start) > 2000) {
+		if (drop_cnt)
+			DBG_871X("DBG_TX_DROP_FRAME %s no more pxmitframe, drop_cnt:%u\n", __FUNCTION__, drop_cnt);
+		start = rtw_get_current_time();
+		drop_cnt = 0;
+	}
+
+	if (pxmitframe == NULL) {
+		drop_cnt ++;
+		RT_TRACE(_module_xmit_osdep_c_, _drv_err_, ("rtw_xmit: no more pxmitframe\n"));
+		return -1;
+	}
+
+#ifdef CONFIG_BR_EXT
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+	br_port = padapter->pnetdev->br_port;
+#else   // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+	rcu_read_lock();
+	br_port = rcu_dereference(padapter->pnetdev->rx_handler_data);
+	rcu_read_unlock();
+#endif  // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+
+	if( br_port	&& check_fwstate(pmlmepriv, WIFI_STATION_STATE|WIFI_ADHOC_STATE) == _TRUE)
+	{
+		res = rtw_br_client_tx(padapter, ppkt);
+		if (res == -1)
+		{
+			rtw_free_xmitframe(pxmitpriv, pxmitframe);
+			return -1;
+		}
+	}
+
+#endif	// CONFIG_BR_EXT
+
+	res = update_attrib(padapter, *ppkt, &pxmitframe->attrib);
+	if (res == _FAIL) {
+		RT_TRACE(_module_xmit_osdep_c_, _drv_err_, ("rtw_xmit: update attrib fail\n"));
+		#ifdef DBG_TX_DROP_FRAME
+		DBG_871X("DBG_TX_DROP_FRAME %s update attrib fail\n", __FUNCTION__);
+		#endif
+		rtw_free_xmitframe(pxmitpriv, pxmitframe);
+		return -1;
+	}
+	pxmitframe->pkt = *ppkt;
+
+	rtw_led_control(padapter, LED_CTL_TX);
+
+	do_queue_select(padapter, &pxmitframe->attrib);
+
+#if defined(CONFIG_AP_MODE) || defined(CONFIG_TDLS)
+	_enter_critical_bh(&pxmitpriv->lock, &irqL0);
+	if(xmitframe_enqueue_for_sleeping_sta(padapter, pxmitframe) == _TRUE)
+	{
+		_exit_critical_bh(&pxmitpriv->lock, &irqL0);
+		return 1;
+	}
+	_exit_critical_bh(&pxmitpriv->lock, &irqL0);
+#endif
+
+	if (rtw_hal_xmit(padapter, pxmitframe) == _FALSE)
+		return 1;
+
+	return 0;
+}
+
+#ifdef CONFIG_TDLS
+sint xmitframe_enqueue_for_tdls_sleeping_sta(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	sint ret=_FALSE;
+
+	_irqL irqL;
+	struct sta_info *ptdls_sta=NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct pkt_attrib *pattrib = &pxmitframe->attrib;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	int i;
+
+	ptdls_sta=rtw_get_stainfo(pstapriv, pattrib->dst);
+	if(ptdls_sta==NULL){
+		return ret;
+	}else if(ptdls_sta->tdls_sta_state&TDLS_LINKED_STATE){
+
+		if(pattrib->triggered==1)
+		{
+			ret = _TRUE;
+			return ret;
+			}
+
+		_enter_critical_bh(&ptdls_sta->sleep_q.lock, &irqL);
+
+		if(ptdls_sta->state&WIFI_SLEEP_STATE)
+		{
+			rtw_list_delete(&pxmitframe->list);
+
+			//_enter_critical_bh(&psta->sleep_q.lock, &irqL);
+
+			rtw_list_insert_tail(&pxmitframe->list, get_list_head(&ptdls_sta->sleep_q));
+
+			ptdls_sta->sleepq_len++;
+			ptdls_sta->sleepq_ac_len++;
+
+			//indicate 4-AC queue bit in TDLS peer traffic indication
+			switch(pattrib->priority)
+			{
+				case 1:
+				case 2:
+					ptdls_sta->uapsd_bk = ptdls_sta->uapsd_bk | BIT(1);
+					break;
+				case 4:
+				case 5:
+					ptdls_sta->uapsd_vi = ptdls_sta->uapsd_vi | BIT(1);
+					break;
+				case 6:
+				case 7:
+					ptdls_sta->uapsd_vo = ptdls_sta->uapsd_vo | BIT(1);
+					break;
+				case 0:
+				case 3:
+				default:
+					ptdls_sta->uapsd_be = ptdls_sta->uapsd_be | BIT(1);
+					break;
+			}
+
+			if(ptdls_sta->sleepq_len==1)
+			{
+				//transmit TDLS PTI via AP
+				rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_SD_PTI);
+			}
+			ret = _TRUE;
+
+		}
+
+		_exit_critical_bh(&ptdls_sta->sleep_q.lock, &irqL);
+	}
+
+	return ret;
+
+}
+#endif //CONFIG_TDLS
+
+#if defined(CONFIG_AP_MODE) || defined(CONFIG_TDLS)
+
+sint xmitframe_enqueue_for_sleeping_sta(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	_irqL irqL;
+	sint ret=_FALSE;
+	struct sta_info *psta=NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct pkt_attrib *pattrib = &pxmitframe->attrib;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	sint bmcst = IS_MCAST(pattrib->ra);
+#ifdef CONFIG_TDLS
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+
+	if( ptdlsinfo->setup_state == TDLS_LINKED_STATE )
+	{
+		ret = xmitframe_enqueue_for_tdls_sleeping_sta(padapter, pxmitframe);
+		return ret;
+	}
+#endif //CONFIG_TDLS
+
+	if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == _FALSE)
+	    return ret;
+
+	if(pattrib->psta)
+	{
+		psta = pattrib->psta;
+	}
+	else
+	{
+		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
+		psta=rtw_get_stainfo(pstapriv, pattrib->ra);
+	}
+
+	if(psta==NULL)
+	{
+		DBG_871X("%s, psta==NUL\n", __func__);
+		return _FALSE;
+	}
+
+	if(!(psta->state &_FW_LINKED))
+	{
+		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
+		return _FALSE;
+	}
+
+	if(pattrib->triggered==1)
+	{
+		//DBG_871X("directly xmit pspoll_triggered packet\n");
+
+		//pattrib->triggered=0;
+
+		if(bmcst)
+			pattrib->qsel = 0x11;//HIQ
+
+
+		return ret;
+	}
+
+
+	if(bmcst)
+	{
+		_enter_critical_bh(&psta->sleep_q.lock, &irqL);
+
+		if(pstapriv->sta_dz_bitmap)//if anyone sta is in ps mode
+		{
+			//pattrib->qsel = 0x11;//HIQ
+
+			rtw_list_delete(&pxmitframe->list);
+
+			//_enter_critical_bh(&psta->sleep_q.lock, &irqL);
+
+			rtw_list_insert_tail(&pxmitframe->list, get_list_head(&psta->sleep_q));
+
+			psta->sleepq_len++;
+
+			pstapriv->tim_bitmap |= BIT(0);//
+			pstapriv->sta_dz_bitmap |= BIT(0);
+
+			//DBG_871X("enqueue, sq_len=%d, tim=%x\n", psta->sleepq_len, pstapriv->tim_bitmap);
+
+			update_beacon(padapter, _TIM_IE_, NULL, _FALSE);//tx bc/mc packets after upate bcn
+
+			//_exit_critical_bh(&psta->sleep_q.lock, &irqL);
+
+			ret = _TRUE;
+
+		}
+
+		_exit_critical_bh(&psta->sleep_q.lock, &irqL);
+
+		return ret;
+
+	}
+
+
+	_enter_critical_bh(&psta->sleep_q.lock, &irqL);
+
+	if(psta->state&WIFI_SLEEP_STATE)
+	{
+		u8 wmmps_ac=0;
+
+		if(pstapriv->sta_dz_bitmap&BIT(psta->aid))
+		{
+			rtw_list_delete(&pxmitframe->list);
+
+			//_enter_critical_bh(&psta->sleep_q.lock, &irqL);
+
+			rtw_list_insert_tail(&pxmitframe->list, get_list_head(&psta->sleep_q));
+
+			psta->sleepq_len++;
+
+			switch(pattrib->priority)
+			{
+				case 1:
+				case 2:
+					wmmps_ac = psta->uapsd_bk&BIT(0);
+					break;
+				case 4:
+				case 5:
+					wmmps_ac = psta->uapsd_vi&BIT(0);
+					break;
+				case 6:
+				case 7:
+					wmmps_ac = psta->uapsd_vo&BIT(0);
+					break;
+				case 0:
+				case 3:
+				default:
+					wmmps_ac = psta->uapsd_be&BIT(0);
+					break;
+			}
+
+			if(wmmps_ac)
+				psta->sleepq_ac_len++;
+
+			if(((psta->has_legacy_ac) && (!wmmps_ac)) ||((!psta->has_legacy_ac)&&(wmmps_ac)))
+			{
+				pstapriv->tim_bitmap |= BIT(psta->aid);
+
+				//DBG_871X("enqueue, sq_len=%d, tim=%x\n", psta->sleepq_len, pstapriv->tim_bitmap);
+
+				if(psta->sleepq_len==1)
+				{
+					//DBG_871X("sleepq_len==1, update BCNTIM\n");
+					//upate BCN for TIM IE
+					update_beacon(padapter, _TIM_IE_, NULL, _FALSE);
+				}
+			}
+
+			//_exit_critical_bh(&psta->sleep_q.lock, &irqL);
+
+			//if(psta->sleepq_len > (NR_XMITFRAME>>3))
+			//{
+			//	wakeup_sta_to_xmit(padapter, psta);
+			//}
+
+			ret = _TRUE;
+
+		}
+
+	}
+
+	_exit_critical_bh(&psta->sleep_q.lock, &irqL);
+
+	return ret;
+
+}
+
+static void dequeue_xmitframes_to_sleeping_queue(_adapter *padapter, struct sta_info *psta, _queue *pframequeue)
+{
+	sint ret;
+	_list	*plist, *phead;
+	u8	ac_index;
+	struct tx_servq	*ptxservq;
+	struct pkt_attrib	*pattrib;
+	struct xmit_frame 	*pxmitframe;
+	struct hw_xmit *phwxmits =  padapter->xmitpriv.hwxmits;
+
+	phead = get_list_head(pframequeue);
+	plist = get_next(phead);
+
+	while (rtw_end_of_queue_search(phead, plist) == _FALSE)
+	{
+		pxmitframe = LIST_CONTAINOR(plist, struct xmit_frame, list);
+
+		plist = get_next(plist);
+
+		ret = xmitframe_enqueue_for_sleeping_sta(padapter, pxmitframe);
+
+		if(_TRUE == ret)
+		{
+		pattrib = &pxmitframe->attrib;
+
+		ptxservq = rtw_get_sta_pending(padapter, psta, pattrib->priority, (u8 *)(&ac_index));
+
+		ptxservq->qcnt--;
+		phwxmits[ac_index].accnt--;
+	}
+		else
+		{
+			//DBG_871X("xmitframe_enqueue_for_sleeping_sta return _FALSE\n");
+		}
+
+	}
+
+}
+
+void stop_sta_xmit(_adapter *padapter, struct sta_info *psta)
+{
+	_irqL irqL0;
+	struct sta_info *psta_bmc;
+	struct sta_xmit_priv *pstaxmitpriv;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+
+	pstaxmitpriv = &psta->sta_xmitpriv;
+
+	//for BC/MC Frames
+	psta_bmc = rtw_get_bcmc_stainfo(padapter);
+
+
+	_enter_critical_bh(&pxmitpriv->lock, &irqL0);
+
+	psta->state |= WIFI_SLEEP_STATE;
+
+#ifdef CONFIG_TDLS
+	if( !(psta->tdls_sta_state & TDLS_LINKED_STATE) )
+#endif //CONFIG_TDLS
+	pstapriv->sta_dz_bitmap |= BIT(psta->aid);
+
+
+
+	dequeue_xmitframes_to_sleeping_queue(padapter, psta, &pstaxmitpriv->vo_q.sta_pending);
+	rtw_list_delete(&(pstaxmitpriv->vo_q.tx_pending));
+
+
+	dequeue_xmitframes_to_sleeping_queue(padapter, psta, &pstaxmitpriv->vi_q.sta_pending);
+	rtw_list_delete(&(pstaxmitpriv->vi_q.tx_pending));
+
+
+	dequeue_xmitframes_to_sleeping_queue(padapter, psta, &pstaxmitpriv->be_q.sta_pending);
+	rtw_list_delete(&(pstaxmitpriv->be_q.tx_pending));
+
+
+	dequeue_xmitframes_to_sleeping_queue(padapter, psta, &pstaxmitpriv->bk_q.sta_pending);
+	rtw_list_delete(&(pstaxmitpriv->bk_q.tx_pending));
+
+#ifdef CONFIG_TDLS
+	if( !(psta->tdls_sta_state & TDLS_LINKED_STATE) )
+	{
+		if( psta_bmc != NULL )
+		{
+#endif //CONFIG_TDLS
+
+
+	//for BC/MC Frames
+	pstaxmitpriv = &psta_bmc->sta_xmitpriv;
+	dequeue_xmitframes_to_sleeping_queue(padapter, psta_bmc, &pstaxmitpriv->be_q.sta_pending);
+	rtw_list_delete(&(pstaxmitpriv->be_q.tx_pending));
+
+
+#ifdef CONFIG_TDLS
+		}
+	}
+#endif //CONFIG_TDLS
+	_exit_critical_bh(&pxmitpriv->lock, &irqL0);
+
+
+}
+
+void wakeup_sta_to_xmit(_adapter *padapter, struct sta_info *psta)
+{
+	_irqL irqL;
+	u8 update_mask=0, wmmps_ac=0;
+	struct sta_info *psta_bmc;
+	_list	*xmitframe_plist, *xmitframe_phead;
+	struct xmit_frame *pxmitframe=NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+
+	psta_bmc = rtw_get_bcmc_stainfo(padapter);
+
+
+	//_enter_critical_bh(&psta->sleep_q.lock, &irqL);
+	_enter_critical_bh(&pxmitpriv->lock, &irqL);
+
+	xmitframe_phead = get_list_head(&psta->sleep_q);
+	xmitframe_plist = get_next(xmitframe_phead);
+
+	while ((rtw_end_of_queue_search(xmitframe_phead, xmitframe_plist)) == _FALSE)
+	{
+		pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
+
+		xmitframe_plist = get_next(xmitframe_plist);
+
+		rtw_list_delete(&pxmitframe->list);
+
+		switch(pxmitframe->attrib.priority)
+		{
+			case 1:
+			case 2:
+				wmmps_ac = psta->uapsd_bk&BIT(1);
+				break;
+			case 4:
+			case 5:
+				wmmps_ac = psta->uapsd_vi&BIT(1);
+				break;
+			case 6:
+			case 7:
+				wmmps_ac = psta->uapsd_vo&BIT(1);
+				break;
+			case 0:
+			case 3:
+			default:
+				wmmps_ac = psta->uapsd_be&BIT(1);
+				break;
+		}
+
+		psta->sleepq_len--;
+		if(psta->sleepq_len>0)
+			pxmitframe->attrib.mdata = 1;
+		else
+			pxmitframe->attrib.mdata = 0;
+
+		if(wmmps_ac)
+		{
+			psta->sleepq_ac_len--;
+			if(psta->sleepq_ac_len>0)
+			{
+				pxmitframe->attrib.mdata = 1;
+				pxmitframe->attrib.eosp = 0;
+			}
+			else
+			{
+				pxmitframe->attrib.mdata = 0;
+				pxmitframe->attrib.eosp = 1;
+			}
+		}
+
+		pxmitframe->attrib.triggered = 1;
+
+/*
+		_exit_critical_bh(&psta->sleep_q.lock, &irqL);
+		if(rtw_hal_xmit(padapter, pxmitframe) == _TRUE)
+		{
+			rtw_os_xmit_complete(padapter, pxmitframe);
+		}
+		_enter_critical_bh(&psta->sleep_q.lock, &irqL);
+*/
+		rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
+
+
+	}
+
+	//for BC/MC Frames
+	if(!psta_bmc)
+		goto _exit;
+
+	if((pstapriv->sta_dz_bitmap&0xfffe) == 0x0)//no any sta in ps mode
+	{
+		xmitframe_phead = get_list_head(&psta_bmc->sleep_q);
+		xmitframe_plist = get_next(xmitframe_phead);
+
+		while ((rtw_end_of_queue_search(xmitframe_phead, xmitframe_plist)) == _FALSE)
+		{
+			pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
+
+			xmitframe_plist = get_next(xmitframe_plist);
+
+			rtw_list_delete(&pxmitframe->list);
+
+			psta_bmc->sleepq_len--;
+			if(psta_bmc->sleepq_len>0)
+				pxmitframe->attrib.mdata = 1;
+			else
+				pxmitframe->attrib.mdata = 0;
+
+
+			pxmitframe->attrib.triggered = 1;
+/*
+			_exit_critical_bh(&psta_bmc->sleep_q.lock, &irqL);
+			if(rtw_hal_xmit(padapter, pxmitframe) == _TRUE)
+			{
+				rtw_os_xmit_complete(padapter, pxmitframe);
+			}
+			_enter_critical_bh(&psta_bmc->sleep_q.lock, &irqL);
+
+*/
+			rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
+
+		}
+
+		if(psta_bmc->sleepq_len==0)
+		{
+			pstapriv->tim_bitmap &= ~BIT(0);
+			pstapriv->sta_dz_bitmap &= ~BIT(0);
+
+			//DBG_871X("wakeup to xmit, qlen==0, update_BCNTIM, tim=%x\n", pstapriv->tim_bitmap);
+			//upate BCN for TIM IE
+			//update_BCNTIM(padapter);
+			update_mask |= BIT(1);
+		}
+
+	}
+
+	if(psta->sleepq_len==0)
+	{
+#ifdef CONFIG_TDLS
+		if( psta->tdls_sta_state & TDLS_LINKED_STATE )
+		{
+			if(psta->state&WIFI_SLEEP_STATE)
+				psta->state ^= WIFI_SLEEP_STATE;
+
+			goto _exit;
+	}
+#endif //CONFIG_TDLS
+		pstapriv->tim_bitmap &= ~BIT(psta->aid);
+
+		//DBG_871X("wakeup to xmit, qlen==0, update_BCNTIM, tim=%x\n", pstapriv->tim_bitmap);
+		//upate BCN for TIM IE
+		//update_BCNTIM(padapter);
+		update_mask = BIT(0);
+
+		if(psta->state&WIFI_SLEEP_STATE)
+			psta->state ^= WIFI_SLEEP_STATE;
+
+		if(psta->state & WIFI_STA_ALIVE_CHK_STATE)
+		{
+			psta->expire_to = pstapriv->expire_to;
+			psta->state ^= WIFI_STA_ALIVE_CHK_STATE;
+		}
+
+		pstapriv->sta_dz_bitmap &= ~BIT(psta->aid);
+	}
+
+_exit:
+
+	//_exit_critical_bh(&psta_bmc->sleep_q.lock, &irqL);
+	_exit_critical_bh(&pxmitpriv->lock, &irqL);
+
+	if(update_mask)
+	{
+		//update_BCNTIM(padapter);
+		//printk("%s => call update_beacon\n",__FUNCTION__);
+		update_beacon(padapter, _TIM_IE_, NULL, _FALSE);
+	}
+
+}
+
+void xmit_delivery_enabled_frames(_adapter *padapter, struct sta_info *psta)
+{
+	_irqL irqL;
+	u8 wmmps_ac=0;
+	_list	*xmitframe_plist, *xmitframe_phead;
+	struct xmit_frame *pxmitframe=NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+
+
+	//_enter_critical_bh(&psta->sleep_q.lock, &irqL);
+	_enter_critical_bh(&pxmitpriv->lock, &irqL);
+
+	xmitframe_phead = get_list_head(&psta->sleep_q);
+	xmitframe_plist = get_next(xmitframe_phead);
+
+	while ((rtw_end_of_queue_search(xmitframe_phead, xmitframe_plist)) == _FALSE)
+	{
+		pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
+
+		xmitframe_plist = get_next(xmitframe_plist);
+
+		switch(pxmitframe->attrib.priority)
+		{
+			case 1:
+			case 2:
+				wmmps_ac = psta->uapsd_bk&BIT(1);
+				break;
+			case 4:
+			case 5:
+				wmmps_ac = psta->uapsd_vi&BIT(1);
+				break;
+			case 6:
+			case 7:
+				wmmps_ac = psta->uapsd_vo&BIT(1);
+				break;
+			case 0:
+			case 3:
+			default:
+				wmmps_ac = psta->uapsd_be&BIT(1);
+				break;
+		}
+
+		if(!wmmps_ac)
+			continue;
+
+		rtw_list_delete(&pxmitframe->list);
+
+		psta->sleepq_len--;
+		psta->sleepq_ac_len--;
+
+		if(psta->sleepq_ac_len>0)
+		{
+			pxmitframe->attrib.mdata = 1;
+			pxmitframe->attrib.eosp = 0;
+		}
+		else
+		{
+			pxmitframe->attrib.mdata = 0;
+			pxmitframe->attrib.eosp = 1;
+		}
+
+		pxmitframe->attrib.triggered = 1;
+
+/*
+		if(rtw_hal_xmit(padapter, pxmitframe) == _TRUE)
+		{
+			rtw_os_xmit_complete(padapter, pxmitframe);
+		}
+*/
+		rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
+
+		if((psta->sleepq_ac_len==0) && (!psta->has_legacy_ac) && (wmmps_ac))
+		{
+#ifdef CONFIG_TDLS
+			if(psta->tdls_sta_state & TDLS_LINKED_STATE )
+			{
+				//_exit_critical_bh(&psta->sleep_q.lock, &irqL);
+				_exit_critical_bh(&pxmitpriv->lock, &irqL);
+				return;
+			}
+#endif //CONFIG_TDLS
+			pstapriv->tim_bitmap &= ~BIT(psta->aid);
+
+			//DBG_871X("wakeup to xmit, qlen==0, update_BCNTIM, tim=%x\n", pstapriv->tim_bitmap);
+			//upate BCN for TIM IE
+			//update_BCNTIM(padapter);
+			update_beacon(padapter, _TIM_IE_, NULL, _FALSE);
+			//update_mask = BIT(0);
+		}
+
+	}
+
+	//_exit_critical_bh(&psta->sleep_q.lock, &irqL);
+	_exit_critical_bh(&pxmitpriv->lock, &irqL);
+
+}
+
+#endif
+
+void rtw_sctx_init(struct submit_ctx *sctx, int timeout_ms)
+{
+	sctx->timeout_ms = timeout_ms;
+	sctx->submit_time= rtw_get_current_time();
+#ifdef PLATFORM_LINUX /* TODO: add condition wating interface for other os */
+	init_completion(&sctx->done);
+#endif
+	sctx->status = RTW_SCTX_SUBMITTED;
+}
+
+int rtw_sctx_wait(struct submit_ctx *sctx)
+{
+	int ret = _FAIL;
+	unsigned long expire;
+	int status = 0;
+
+#ifdef PLATFORM_LINUX
+	expire= sctx->timeout_ms ? msecs_to_jiffies(sctx->timeout_ms) : MAX_SCHEDULE_TIMEOUT;
+	if (!wait_for_completion_timeout(&sctx->done, expire)) {
+		/* timeout, do something?? */
+		status = RTW_SCTX_DONE_TIMEOUT;
+		DBG_871X("%s timeout\n", __func__);
+	} else {
+		status = sctx->status;
+	}
+#endif
+
+	if (status == RTW_SCTX_DONE_SUCCESS) {
+		ret = _SUCCESS;
+	}
+
+	return ret;
+}
+
+bool rtw_sctx_chk_waring_status(int status)
+{
+	switch(status) {
+	case RTW_SCTX_DONE_UNKNOWN:
+	case RTW_SCTX_DONE_BUF_ALLOC:
+	case RTW_SCTX_DONE_BUF_FREE:
+
+	case RTW_SCTX_DONE_DRV_STOP:
+	case RTW_SCTX_DONE_DEV_REMOVE:
+		return _TRUE;
+	default:
+		return _FALSE;
+	}
+}
+
+void rtw_sctx_done_err(struct submit_ctx **sctx, int status)
+{
+	if (*sctx) {
+		if (rtw_sctx_chk_waring_status(status))
+			DBG_871X("%s status:%d\n", __func__, status);
+		(*sctx)->status = status;
+		#ifdef PLATFORM_LINUX
+		complete(&((*sctx)->done));
+		#endif
+		*sctx = NULL;
+	}
+}
+
+void rtw_sctx_done(struct submit_ctx **sctx)
+{
+	rtw_sctx_done_err(sctx, RTW_SCTX_DONE_SUCCESS);
+}
+
+#ifdef CONFIG_XMIT_ACK
+
+#ifdef CONFIG_XMIT_ACK_POLLING
+s32 c2h_evt_hdl(_adapter *adapter, struct c2h_evt_hdr *c2h_evt, c2h_id_filter filter);
+
+/**
+ * rtw_ack_tx_polling -
+ * @pxmitpriv: xmit_priv to address ack_tx_ops
+ * @timeout_ms: timeout msec
+ *
+ * Init ack_tx_ops and then do c2h_evt_hdl() and polling ack_tx_ops repeatedly
+ * till tx report or timeout
+ * Returns: _SUCCESS if TX report ok, _FAIL for others
+ */
+int rtw_ack_tx_polling(struct xmit_priv *pxmitpriv, u32 timeout_ms)
+{
+	int ret = _FAIL;
+	struct submit_ctx *pack_tx_ops = &pxmitpriv->ack_tx_ops;
+	_adapter *adapter = container_of(pxmitpriv, _adapter, xmitpriv);
+
+	pack_tx_ops->submit_time = rtw_get_current_time();
+	pack_tx_ops->timeout_ms = timeout_ms;
+	pack_tx_ops->status = RTW_SCTX_SUBMITTED;
+
+	do {
+		c2h_evt_hdl(adapter, NULL, rtw_hal_c2h_id_filter_ccx(adapter));
+		if (pack_tx_ops->status != RTW_SCTX_SUBMITTED)
+			break;
+
+		if (adapter->bDriverStopped) {
+			pack_tx_ops->status = RTW_SCTX_DONE_DRV_STOP;
+			break;
+		}
+		if (adapter->bSurpriseRemoved) {
+			pack_tx_ops->status = RTW_SCTX_DONE_DEV_REMOVE;
+			break;
+		}
+
+		rtw_msleep_os(10);
+	} while (rtw_get_passing_time_ms(pack_tx_ops->submit_time) < timeout_ms);
+
+	if (pack_tx_ops->status == RTW_SCTX_SUBMITTED) {
+		pack_tx_ops->status = RTW_SCTX_DONE_TIMEOUT;
+		DBG_871X("%s timeout\n", __func__);
+	}
+
+	if (pack_tx_ops->status == RTW_SCTX_DONE_SUCCESS)
+		ret = _SUCCESS;
+
+	return ret;
+}
+#endif
+
+int rtw_ack_tx_wait(struct xmit_priv *pxmitpriv, u32 timeout_ms)
+{
+#ifdef CONFIG_XMIT_ACK_POLLING
+	return rtw_ack_tx_polling(pxmitpriv, timeout_ms);
+#else
+	struct submit_ctx *pack_tx_ops = &pxmitpriv->ack_tx_ops;
+
+	pack_tx_ops->submit_time = rtw_get_current_time();
+	pack_tx_ops->timeout_ms = timeout_ms;
+	pack_tx_ops->status = RTW_SCTX_SUBMITTED;
+
+	return rtw_sctx_wait(pack_tx_ops);
+#endif
+}
+
+void rtw_ack_tx_done(struct xmit_priv *pxmitpriv, int status)
+{
+	struct submit_ctx *pack_tx_ops = &pxmitpriv->ack_tx_ops;
+
+	if (pxmitpriv->ack_tx) {
+		rtw_sctx_done_err(&pack_tx_ops, status);
+	} else {
+		DBG_871X("%s ack_tx not set\n", __func__);
+	}
+}
+#endif //CONFIG_XMIT_ACK
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/HalPwrSeqCmd.c b/drivers/net/wireless/realtek/rtl8192cu/hal/HalPwrSeqCmd.c
new file mode 100644
index 000000000000..4ecf2290cd10
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/HalPwrSeqCmd.c
@@ -0,0 +1,175 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*++
+Copyright (c) Realtek Semiconductor Corp. All rights reserved.
+
+Module Name:
+	HalPwrSeqCmd.c
+
+Abstract:
+	Implement HW Power sequence configuration CMD handling routine for Realtek devices.
+
+Major Change History:
+	When       Who               What
+	---------- ---------------   -------------------------------
+	2011-10-26 Lucas            Modify to be compatible with SD4-CE driver.
+	2011-07-07 Roger            Create.
+
+--*/
+#include <HalPwrSeqCmd.h>
+#include <sdio_ops.h>
+
+
+//
+//	Description:
+//		This routine deal with the Power Configuration CMDs parsing for RTL8723/RTL8188E Series IC.
+//
+//	Assumption:
+//		We should follow specific format which was released from HW SD.
+//
+//	2011.07.07, added by Roger.
+//
+u8 HalPwrSeqCmdParsing(
+	PADAPTER		padapter,
+	u8				CutVersion,
+	u8				FabVersion,
+	u8				InterfaceType,
+	WLAN_PWR_CFG	PwrSeqCmd[])
+{
+	WLAN_PWR_CFG 	PwrCfgCmd = {0};
+	u8				bPollingBit = _FALSE;
+	u32				AryIdx = 0;
+	u8				value = 0;
+	u32				offset = 0;
+	u32				pollingCount = 0; // polling autoload done.
+	u32				maxPollingCnt = 5000;
+
+	do {
+		PwrCfgCmd = PwrSeqCmd[AryIdx];
+
+		RT_TRACE(_module_hal_init_c_ , _drv_info_,
+				 ("HalPwrSeqCmdParsing: offset(%#x) cut_msk(%#x) fab_msk(%#x) interface_msk(%#x) base(%#x) cmd(%#x) msk(%#x) value(%#x)\n",
+					GET_PWR_CFG_OFFSET(PwrCfgCmd),
+					GET_PWR_CFG_CUT_MASK(PwrCfgCmd),
+					GET_PWR_CFG_FAB_MASK(PwrCfgCmd),
+					GET_PWR_CFG_INTF_MASK(PwrCfgCmd),
+					GET_PWR_CFG_BASE(PwrCfgCmd),
+					GET_PWR_CFG_CMD(PwrCfgCmd),
+					GET_PWR_CFG_MASK(PwrCfgCmd),
+					GET_PWR_CFG_VALUE(PwrCfgCmd)));
+
+		//2 Only Handle the command whose FAB, CUT, and Interface are matched
+		if ((GET_PWR_CFG_FAB_MASK(PwrCfgCmd) & FabVersion) &&
+			(GET_PWR_CFG_CUT_MASK(PwrCfgCmd) & CutVersion) &&
+			(GET_PWR_CFG_INTF_MASK(PwrCfgCmd) & InterfaceType))
+		{
+			switch (GET_PWR_CFG_CMD(PwrCfgCmd))
+			{
+				case PWR_CMD_READ:
+					RT_TRACE(_module_hal_init_c_ , _drv_info_, ("HalPwrSeqCmdParsing: PWR_CMD_READ\n"));
+					break;
+
+				case PWR_CMD_WRITE:
+					RT_TRACE(_module_hal_init_c_ , _drv_info_, ("HalPwrSeqCmdParsing: PWR_CMD_WRITE\n"));
+					offset = GET_PWR_CFG_OFFSET(PwrCfgCmd);
+
+#ifdef CONFIG_SDIO_HCI
+					//
+					// <Roger_Notes> We should deal with interface specific address mapping for some interfaces, e.g., SDIO interface
+					// 2011.07.07.
+					//
+					if (GET_PWR_CFG_BASE(PwrCfgCmd) == PWR_BASEADDR_SDIO)
+					{
+						// Read Back SDIO Local value
+						value = SdioLocalCmd52Read1Byte(padapter, offset);
+
+						value &= ~(GET_PWR_CFG_MASK(PwrCfgCmd));
+						value |= (GET_PWR_CFG_VALUE(PwrCfgCmd) & GET_PWR_CFG_MASK(PwrCfgCmd));
+
+						// Write Back SDIO Local value
+						SdioLocalCmd52Write1Byte(padapter, offset, value);
+					}
+					else
+#endif
+					{
+						// Read the value from system register
+						value = rtw_read8(padapter, offset);
+
+						value &= ~(GET_PWR_CFG_MASK(PwrCfgCmd));
+						value |= (GET_PWR_CFG_VALUE(PwrCfgCmd) & GET_PWR_CFG_MASK(PwrCfgCmd));
+
+						// Write the value back to sytem register
+						rtw_write8(padapter, offset, value);
+					}
+					break;
+
+				case PWR_CMD_POLLING:
+					RT_TRACE(_module_hal_init_c_ , _drv_info_, ("HalPwrSeqCmdParsing: PWR_CMD_POLLING\n"));
+
+					bPollingBit = _FALSE;
+					offset = GET_PWR_CFG_OFFSET(PwrCfgCmd);
+
+					do {
+#ifdef CONFIG_SDIO_HCI
+						if (GET_PWR_CFG_BASE(PwrCfgCmd) == PWR_BASEADDR_SDIO)
+							value = SdioLocalCmd52Read1Byte(padapter, offset);
+						else
+#endif
+							value = rtw_read8(padapter, offset);
+
+						value &= GET_PWR_CFG_MASK(PwrCfgCmd);
+						if (value == (GET_PWR_CFG_VALUE(PwrCfgCmd) & GET_PWR_CFG_MASK(PwrCfgCmd)))
+							bPollingBit = _TRUE;
+						else
+							rtw_udelay_os(10);
+
+						if (pollingCount++ > maxPollingCnt) {
+							RT_TRACE(_module_hal_init_c_ , _drv_err_, ("Fail to polling Offset[%#x]\n", offset));
+							return _FALSE;
+						}
+					} while (!bPollingBit);
+
+					break;
+
+				case PWR_CMD_DELAY:
+					RT_TRACE(_module_hal_init_c_ , _drv_info_, ("HalPwrSeqCmdParsing: PWR_CMD_DELAY\n"));
+					if (GET_PWR_CFG_VALUE(PwrCfgCmd) == PWRSEQ_DELAY_US)
+						rtw_udelay_os(GET_PWR_CFG_OFFSET(PwrCfgCmd));
+					else
+						rtw_udelay_os(GET_PWR_CFG_OFFSET(PwrCfgCmd)*1000);
+					break;
+
+				case PWR_CMD_END:
+					// When this command is parsed, end the process
+					RT_TRACE(_module_hal_init_c_ , _drv_info_, ("HalPwrSeqCmdParsing: PWR_CMD_END\n"));
+					return _TRUE;
+					break;
+
+				default:
+					RT_TRACE(_module_hal_init_c_ , _drv_err_, ("HalPwrSeqCmdParsing: Unknown CMD!!\n"));
+					break;
+			}
+		}
+
+		AryIdx++;//Add Array Index
+	}while(1);
+
+	return _TRUE;
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/dm.c b/drivers/net/wireless/realtek/rtl8192cu/hal/dm.c
new file mode 100644
index 000000000000..807dfd18e738
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/dm.c
@@ -0,0 +1,313 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2013 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#ifdef CONFIG_RTL8192C
+#include <rtl8192c_hal.h>
+#endif
+
+#ifdef CONFIG_RTL8192D
+#include <rtl8192d_hal.h>
+#endif
+
+bool rtw_adapter_linked(_adapter *adapter)
+{
+	bool linked = _FALSE;
+	struct mlme_priv	*mlmepriv = &adapter->mlmepriv;
+
+	if(	(check_fwstate(mlmepriv, WIFI_AP_STATE) == _TRUE) ||
+		(check_fwstate(mlmepriv, WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE) == _TRUE))
+	{
+		if(adapter->stapriv.asoc_sta_count > 2)
+			linked = _TRUE;
+	}
+	else{//Station mode
+		if(check_fwstate(mlmepriv, _FW_LINKED)== _TRUE)
+			linked = _TRUE;
+	}
+
+	return linked;
+}
+
+bool dm_linked(_adapter *adapter)
+{
+	bool linked;
+
+	if ((linked = rtw_adapter_linked(adapter)))
+		goto exit;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if ((adapter =  adapter->pbuddy_adapter) == NULL)
+		goto exit;
+	linked = rtw_adapter_linked(adapter);
+#endif
+
+exit:
+	return linked;
+}
+
+#if 0
+void dm_enable_EDCCA(_adapter *adapter)
+{
+	// Enable EDCCA. The value is suggested by SD3 Wilson.
+
+	//
+	// Revised for ASUS 11b/g performance issues, suggested by BB Neil, 2012.04.13.
+	//
+	/*if((pDM_Odm->SupportICType == ODM_RTL8723A)&&(IS_WIRELESS_MODE_G(pAdapter)))
+	{
+		rtw_write8(adapter,rOFDM0_ECCAThreshold,0x00);
+		rtw_write8(adapter,rOFDM0_ECCAThreshold+2,0xFD);
+
+	}
+	else*/
+	{
+		rtw_write8(adapter,rOFDM0_ECCAThreshold,0x03);
+		rtw_write8(adapter,rOFDM0_ECCAThreshold+2,0x00);
+	}
+}
+
+void dm_disable_EDCCA(_adapter *adapter)
+{
+	// Disable EDCCA..
+	rtw_write8(adapter, rOFDM0_ECCAThreshold, 0x7f);
+	rtw_write8(adapter, rOFDM0_ECCAThreshold+2, 0x7f);
+}
+
+//
+// Description: According to initial gain value to determine to enable or disable EDCCA.
+//
+// Suggested by SD3 Wilson. Added by tynli. 2011.11.25.
+//
+void dm_dynamic_EDCCA(_adapter *pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv *dmpriv = &pHalData->dmpriv;
+	u8 RegC50, RegC58;
+
+	RegC50 = (u8)PHY_QueryBBReg(pAdapter, rOFDM0_XAAGCCore1, bMaskByte0);
+	RegC58 = (u8)PHY_QueryBBReg(pAdapter, rOFDM0_XBAGCCore1, bMaskByte0);
+
+
+	if((RegC50 > 0x28 && RegC58 > 0x28)
+		/*|| ((pDM_Odm->SupportICType == ODM_RTL8723A && IS_WIRELESS_MODE_G(pAdapter) && RegC50>0x26))
+		|| (pDM_Odm->SupportICType == ODM_RTL8188E && RegC50 > 0x28)*/
+	)
+	{
+		if(!dmpriv->bPreEdccaEnable)
+		{
+			dm_enable_EDCCA(pAdapter);
+			dmpriv->bPreEdccaEnable = _TRUE;
+		}
+
+	}
+	else if((RegC50 < 0x25 && RegC58 < 0x25)
+		/*|| (pDM_Odm->SupportICType == ODM_RTL8188E && RegC50 < 0x25)*/
+	)
+	{
+		if(dmpriv->bPreEdccaEnable)
+		{
+			dm_disable_EDCCA(pAdapter);
+			dmpriv->bPreEdccaEnable = _FALSE;
+		}
+	}
+}
+#endif
+
+#define DM_ADAPTIVITY_VER "ADAPTIVITY_V001"
+
+int dm_adaptivity_get_parm_str(_adapter *pAdapter, char *buf, int len)
+{
+#ifdef CONFIG_DM_ADAPTIVITY
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv *dmpriv = &pHalData->dmpriv;
+
+	return snprintf(buf, len, DM_ADAPTIVITY_VER"\n"
+		"TH_L2H_ini\tTH_EDCCA_HL_diff\tIGI_Base\tForceEDCCA\tAdapEn_RSSI\tIGI_LowerBound\n"
+		"0x%02x\t%d\t0x%02x\t%d\t%u\t%u\n",
+		(u8)dmpriv->TH_L2H_ini,
+		dmpriv->TH_EDCCA_HL_diff,
+		dmpriv->IGI_Base,
+		dmpriv->ForceEDCCA,
+		dmpriv->AdapEn_RSSI,
+		dmpriv->IGI_LowerBound
+	);
+#endif /* CONFIG_DM_ADAPTIVITY */
+	return 0;
+}
+
+void dm_adaptivity_set_parm(_adapter *pAdapter, s8 TH_L2H_ini, s8 TH_EDCCA_HL_diff,
+	s8 IGI_Base, bool ForceEDCCA, u8 AdapEn_RSSI, u8 IGI_LowerBound)
+{
+#ifdef CONFIG_DM_ADAPTIVITY
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv *dmpriv = &pHalData->dmpriv;
+
+	dmpriv->TH_L2H_ini = TH_L2H_ini;
+	dmpriv->TH_EDCCA_HL_diff = TH_EDCCA_HL_diff;
+	dmpriv->IGI_Base = IGI_Base;
+	dmpriv->ForceEDCCA = ForceEDCCA;
+	dmpriv->AdapEn_RSSI = AdapEn_RSSI;
+	dmpriv->IGI_LowerBound = IGI_LowerBound;
+
+#endif /* CONFIG_DM_ADAPTIVITY */
+}
+
+void dm_adaptivity_init(_adapter *pAdapter)
+{
+#ifdef CONFIG_DM_ADAPTIVITY
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv *dmpriv = &pHalData->dmpriv;
+
+	/*
+	if(pDM_Odm->SupportICType == ODM_RTL8723B)
+	{
+		pDM_Odm->TH_L2H_ini = 0xf8; // -8
+	}
+	if((pDM_Odm->SupportICType == ODM_RTL8192E)&&(pDM_Odm->SupportInterface == ODM_ITRF_PCIE))
+	{
+		pDM_Odm->TH_L2H_ini = 0xf0; // -16
+	}
+	else */
+	{
+		dmpriv->TH_L2H_ini = 0xf9; // -7
+	}
+
+	dmpriv->TH_EDCCA_HL_diff = 7;
+	dmpriv->IGI_Base = 0x32;
+	dmpriv->IGI_target = 0x1c;
+	dmpriv->ForceEDCCA = 0;
+	dmpriv->AdapEn_RSSI = 20;
+	dmpriv->IGI_LowerBound = 0;
+
+	//Reg524[11]=0 is easily to transmit packets during adaptivity test
+	PHY_SetBBReg(pAdapter, 0x524, BIT11, 1); // stop counting if EDCCA is asserted
+
+#endif /* CONFIG_DM_ADAPTIVITY */
+}
+
+void dm_adaptivity(_adapter *pAdapter)
+{
+#ifdef CONFIG_DM_ADAPTIVITY
+	s8 TH_L2H_dmc, TH_H2L_dmc;
+	s8 TH_L2H, TH_H2L, Diff, IGI_target;
+	u32 value32;
+	BOOLEAN EDCCA_State;
+
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv *dmpriv = &pHalData->dmpriv;
+	DIG_T *pDigTable = &dmpriv->DM_DigTable;
+	u8 IGI = pDigTable->CurIGValue;
+	u8 RSSI_Min = pDigTable->Rssi_val_min;
+	HT_CHANNEL_WIDTH BandWidth = pHalData->CurrentChannelBW;
+
+	if (!(dmpriv->DMFlag & DYNAMIC_FUNC_ADAPTIVITY))
+	{
+		LOG_LEVEL(_drv_info_, "Go to odm_DynamicEDCCA() \n");
+		// Add by Neil Chen to enable edcca to MP Platform
+		// Adjust EDCCA.
+		/*if(pDM_Odm->SupportICType & ODM_IC_11N_SERIES)
+			dm_dynamic_EDCCA(pAdapter);
+		*/
+		return;
+	}
+	LOG_LEVEL(_drv_info_, "odm_Adaptivity() =====> \n");
+
+	LOG_LEVEL(_drv_info_, "ForceEDCCA=%d, IGI_Base=0x%x, TH_L2H_ini = %d, TH_EDCCA_HL_diff = %d, AdapEn_RSSI = %d\n",
+		dmpriv->ForceEDCCA, dmpriv->IGI_Base, dmpriv->TH_L2H_ini, dmpriv->TH_EDCCA_HL_diff, dmpriv->AdapEn_RSSI);
+
+	/*if(pDM_Odm->SupportICType & ODM_IC_11AC_SERIES)
+		PHY_SetBBReg(0x800, BIT10, 0); //ADC_mask enable
+	*/
+
+	if(!dm_linked(pAdapter) || pHalData->CurrentChannel > 149) /* Band4 doesn't need adaptivity */
+	{
+		/*if(pDM_Odm->SupportICType & ODM_IC_11N_SERIES)*/
+		{
+			PHY_SetBBReg(pAdapter,rOFDM0_ECCAThreshold, bMaskByte0, 0x7f);
+			PHY_SetBBReg(pAdapter,rOFDM0_ECCAThreshold, bMaskByte2, 0x7f);
+		}
+		/*else
+		{
+			ODM_SetBBReg(pDM_Odm, rFPGA0_XB_LSSIReadBack, 0xFFFF, (0x7f<<8) | 0x7f);
+		}*/
+		return;
+	}
+
+	if(!dmpriv->ForceEDCCA)
+	{
+		if(RSSI_Min > dmpriv->AdapEn_RSSI)
+			EDCCA_State = 1;
+		else if(RSSI_Min < (dmpriv->AdapEn_RSSI - 5))
+			EDCCA_State = 0;
+	}
+	else
+		EDCCA_State = 1;
+	//if((pDM_Odm->SupportICType & ODM_IC_11AC_SERIES) && (*pDM_Odm->pBandType == BAND_ON_5G))
+		//IGI_target = pDM_Odm->IGI_Base;
+	//else
+	{
+
+		if(BandWidth == HT_CHANNEL_WIDTH_20) //CHANNEL_WIDTH_20
+			IGI_target = dmpriv->IGI_Base;
+		else if(BandWidth == HT_CHANNEL_WIDTH_40)
+			IGI_target = dmpriv->IGI_Base + 2;
+		/*else if(*pDM_Odm->pBandWidth == ODM_BW80M)
+			IGI_target = pDM_Odm->IGI_Base + 6;*/
+		else
+			IGI_target = dmpriv->IGI_Base;
+	}
+
+	dmpriv->IGI_target = (u8)IGI_target;
+
+	LOG_LEVEL(_drv_info_, "BandWidth=%s, IGI_target=0x%x, EDCCA_State=%d\n",
+		(BandWidth==HT_CHANNEL_WIDTH_40)?"40M":"20M", IGI_target, EDCCA_State);
+
+	if(EDCCA_State == 1)
+	{
+		Diff = IGI_target -(s8)IGI;
+		TH_L2H_dmc = dmpriv->TH_L2H_ini + Diff;
+		if(TH_L2H_dmc > 10) 	TH_L2H_dmc = 10;
+		TH_H2L_dmc = TH_L2H_dmc - dmpriv->TH_EDCCA_HL_diff;
+	}
+	else
+	{
+		TH_L2H_dmc = 0x7f;
+		TH_H2L_dmc = 0x7f;
+	}
+
+	LOG_LEVEL(_drv_info_, "IGI=0x%x, TH_L2H_dmc = %d, TH_H2L_dmc = %d\n",
+		IGI, TH_L2H_dmc, TH_H2L_dmc);
+
+	/*if(pDM_Odm->SupportICType & ODM_IC_11N_SERIES)*/
+	{
+		PHY_SetBBReg(pAdapter,rOFDM0_ECCAThreshold, bMaskByte0, (u8)TH_L2H_dmc);
+		PHY_SetBBReg(pAdapter,rOFDM0_ECCAThreshold, bMaskByte2, (u8)TH_H2L_dmc);
+	}
+	/*else
+		PHY_SetBBReg(pAdapter, rFPGA0_XB_LSSIReadBack, 0xFFFF, ((u8)TH_H2L_dmc<<8) | (u8)TH_L2H_dmc);*/
+
+skip_dm:
+	return;
+#endif /* CONFIG_DM_ADAPTIVITY */
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/dm.h b/drivers/net/wireless/realtek/rtl8192cu/hal/dm.h
new file mode 100644
index 000000000000..cacd58fbf24c
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/dm.h
@@ -0,0 +1,30 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2013 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+ #ifndef	__DM_H__
+#define __DM_H__
+
+int dm_adaptivity_get_parm_str(_adapter *pAdapter, char *buf, int len);
+void dm_adaptivity_set_parm(_adapter *pAdapter, s8 TH_L2H_ini, s8 TH_EDCCA_HL_diff,
+	s8 IGI_Base, bool ForceEDCCA, u8 AdapEn_RSSI, u8 IGI_LowerBound);
+void dm_adaptivity_init(_adapter *pAdapter);
+void dm_adaptivity(_adapter *pAdapter);
+
+#endif /* __DM_H__ */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/hal_com.c b/drivers/net/wireless/realtek/rtl8192cu/hal/hal_com.c
new file mode 100644
index 000000000000..b9e4dad4e071
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/hal_com.c
@@ -0,0 +1,370 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_byteorder.h>
+
+#include <hal_intf.h>
+#include <hal_com.h>
+
+#ifdef CONFIG_RTL8192C
+#include <rtl8192c_hal.h>
+#endif
+#ifdef CONFIG_RTL8192D
+#include <rtl8192d_hal.h>
+#endif
+
+#define _HAL_COM_C_
+
+//============================================================
+// Global var
+//============================================================
+u32 OFDMSwingTable[OFDM_TABLE_SIZE_92D] = {
+	0x7f8001fe, // 0, +6.0dB
+	0x788001e2, // 1, +5.5dB
+	0x71c001c7, // 2, +5.0dB
+	0x6b8001ae, // 3, +4.5dB
+	0x65400195, // 4, +4.0dB
+	0x5fc0017f, // 5, +3.5dB
+	0x5a400169, // 6, +3.0dB
+	0x55400155, // 7, +2.5dB
+	0x50800142, // 8, +2.0dB
+	0x4c000130, // 9, +1.5dB
+	0x47c0011f, // 10, +1.0dB
+	0x43c0010f, // 11, +0.5dB
+	0x40000100, // 12, +0dB
+	0x3c8000f2, // 13, -0.5dB
+	0x390000e4, // 14, -1.0dB
+	0x35c000d7, // 15, -1.5dB
+	0x32c000cb, // 16, -2.0dB
+	0x300000c0, // 17, -2.5dB
+	0x2d4000b5, // 18, -3.0dB
+	0x2ac000ab, // 19, -3.5dB
+	0x288000a2, // 20, -4.0dB
+	0x26000098, // 21, -4.5dB
+	0x24000090, // 22, -5.0dB
+	0x22000088, // 23, -5.5dB
+	0x20000080, // 24, -6.0dB
+	0x1e400079, // 25, -6.5dB
+	0x1c800072, // 26, -7.0dB
+	0x1b00006c, // 27. -7.5dB
+	0x19800066, // 28, -8.0dB
+	0x18000060, // 29, -8.5dB
+	0x16c0005b, // 30, -9.0dB
+	0x15800056, // 31, -9.5dB
+	0x14400051, // 32, -10.0dB
+	0x1300004c, // 33, -10.5dB
+	0x12000048, // 34, -11.0dB
+	0x11000044, // 35, -11.5dB
+	0x10000040, // 36, -12.0dB
+	0x0f00003c,// 37, -12.5dB
+	0x0e400039,// 38, -13.0dB
+	0x0d800036,// 39, -13.5dB
+	0x0cc00033,// 40, -14.0dB
+	0x0c000030,// 41, -14.5dB
+	0x0b40002d,// 42, -15.0dB
+};
+
+
+u8 CCKSwingTable_Ch1_Ch13[CCK_TABLE_SIZE][8] = {
+	{0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04},	// 0, +0dB
+	{0x33, 0x32, 0x2b, 0x23, 0x1a, 0x11, 0x08, 0x04},	// 1, -0.5dB
+	{0x30, 0x2f, 0x29, 0x21, 0x19, 0x10, 0x08, 0x03},	// 2, -1.0dB
+	{0x2d, 0x2d, 0x27, 0x1f, 0x18, 0x0f, 0x08, 0x03},	// 3, -1.5dB
+	{0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03},	// 4, -2.0dB
+	{0x28, 0x28, 0x22, 0x1c, 0x15, 0x0d, 0x07, 0x03},	// 5, -2.5dB
+	{0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03},	// 6, -3.0dB
+	{0x24, 0x23, 0x1f, 0x19, 0x13, 0x0c, 0x06, 0x03},	// 7, -3.5dB
+	{0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02},	// 8, -4.0dB
+	{0x20, 0x20, 0x1b, 0x16, 0x11, 0x08, 0x05, 0x02},	// 9, -4.5dB
+	{0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02},	// 10, -5.0dB
+	{0x1d, 0x1c, 0x18, 0x14, 0x0f, 0x0a, 0x05, 0x02},	// 11, -5.5dB
+	{0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02},	// 12, -6.0dB
+	{0x1a, 0x19, 0x16, 0x12, 0x0d, 0x09, 0x04, 0x02},	// 13, -6.5dB
+	{0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02},	// 14, -7.0dB
+	{0x17, 0x16, 0x13, 0x10, 0x0c, 0x08, 0x04, 0x02},	// 15, -7.5dB
+	{0x16, 0x15, 0x12, 0x0f, 0x0b, 0x07, 0x04, 0x01},	// 16, -8.0dB
+	{0x14, 0x14, 0x11, 0x0e, 0x0b, 0x07, 0x03, 0x02},	// 17, -8.5dB
+	{0x13, 0x13, 0x10, 0x0d, 0x0a, 0x06, 0x03, 0x01},	// 18, -9.0dB
+	{0x12, 0x12, 0x0f, 0x0c, 0x09, 0x06, 0x03, 0x01},	// 19, -9.5dB
+	{0x11, 0x11, 0x0f, 0x0c, 0x09, 0x06, 0x03, 0x01},	// 20, -10.0dB
+	{0x10, 0x10, 0x0e, 0x0b, 0x08, 0x05, 0x03, 0x01},	// 21, -10.5dB
+	{0x0f, 0x0f, 0x0d, 0x0b, 0x08, 0x05, 0x03, 0x01},	// 22, -11.0dB
+	{0x0e, 0x0e, 0x0c, 0x0a, 0x08, 0x05, 0x02, 0x01},	// 23, -11.5dB
+	{0x0d, 0x0d, 0x0c, 0x0a, 0x07, 0x05, 0x02, 0x01},	// 24, -12.0dB
+	{0x0d, 0x0c, 0x0b, 0x09, 0x07, 0x04, 0x02, 0x01},	// 25, -12.5dB
+	{0x0c, 0x0c, 0x0a, 0x09, 0x06, 0x04, 0x02, 0x01},	// 26, -13.0dB
+	{0x0b, 0x0b, 0x0a, 0x08, 0x06, 0x04, 0x02, 0x01},	// 27, -13.5dB
+	{0x0b, 0x0a, 0x09, 0x08, 0x06, 0x04, 0x02, 0x01},	// 28, -14.0dB
+	{0x0a, 0x0a, 0x09, 0x07, 0x05, 0x03, 0x02, 0x01},	// 29, -14.5dB
+	{0x0a, 0x09, 0x08, 0x07, 0x05, 0x03, 0x02, 0x01},	// 30, -15.0dB
+	{0x09, 0x09, 0x08, 0x06, 0x05, 0x03, 0x01, 0x01},	// 31, -15.5dB
+	{0x09, 0x08, 0x07, 0x06, 0x04, 0x03, 0x01, 0x01}	// 32, -16.0dB
+};
+
+
+u8 CCKSwingTable_Ch14 [CCK_TABLE_SIZE][8]= {
+	{0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00},	// 0, +0dB
+	{0x33, 0x32, 0x2b, 0x19, 0x00, 0x00, 0x00, 0x00},	// 1, -0.5dB
+	{0x30, 0x2f, 0x29, 0x18, 0x00, 0x00, 0x00, 0x00},	// 2, -1.0dB
+	{0x2d, 0x2d, 0x17, 0x17, 0x00, 0x00, 0x00, 0x00},	// 3, -1.5dB
+	{0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00},	// 4, -2.0dB
+	{0x28, 0x28, 0x24, 0x14, 0x00, 0x00, 0x00, 0x00},	// 5, -2.5dB
+	{0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00},	// 6, -3.0dB
+	{0x24, 0x23, 0x1f, 0x12, 0x00, 0x00, 0x00, 0x00},	// 7, -3.5dB
+	{0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00},	// 8, -4.0dB
+	{0x20, 0x20, 0x1b, 0x10, 0x00, 0x00, 0x00, 0x00},	// 9, -4.5dB
+	{0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00},	// 10, -5.0dB
+	{0x1d, 0x1c, 0x18, 0x0e, 0x00, 0x00, 0x00, 0x00},	// 11, -5.5dB
+	{0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00},	// 12, -6.0dB
+	{0x1a, 0x19, 0x16, 0x0d, 0x00, 0x00, 0x00, 0x00},	// 13, -6.5dB
+	{0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00},	// 14, -7.0dB
+	{0x17, 0x16, 0x13, 0x0b, 0x00, 0x00, 0x00, 0x00},	// 15, -7.5dB
+	{0x16, 0x15, 0x12, 0x0b, 0x00, 0x00, 0x00, 0x00},	// 16, -8.0dB
+	{0x14, 0x14, 0x11, 0x0a, 0x00, 0x00, 0x00, 0x00},	// 17, -8.5dB
+	{0x13, 0x13, 0x10, 0x0a, 0x00, 0x00, 0x00, 0x00},	// 18, -9.0dB
+	{0x12, 0x12, 0x0f, 0x09, 0x00, 0x00, 0x00, 0x00},	// 19, -9.5dB
+	{0x11, 0x11, 0x0f, 0x09, 0x00, 0x00, 0x00, 0x00},	// 20, -10.0dB
+	{0x10, 0x10, 0x0e, 0x08, 0x00, 0x00, 0x00, 0x00},	// 21, -10.5dB
+	{0x0f, 0x0f, 0x0d, 0x08, 0x00, 0x00, 0x00, 0x00},	// 22, -11.0dB
+	{0x0e, 0x0e, 0x0c, 0x07, 0x00, 0x00, 0x00, 0x00},	// 23, -11.5dB
+	{0x0d, 0x0d, 0x0c, 0x07, 0x00, 0x00, 0x00, 0x00},	// 24, -12.0dB
+	{0x0d, 0x0c, 0x0b, 0x06, 0x00, 0x00, 0x00, 0x00},	// 25, -12.5dB
+	{0x0c, 0x0c, 0x0a, 0x06, 0x00, 0x00, 0x00, 0x00},	// 26, -13.0dB
+	{0x0b, 0x0b, 0x0a, 0x06, 0x00, 0x00, 0x00, 0x00},	// 27, -13.5dB
+	{0x0b, 0x0a, 0x09, 0x05, 0x00, 0x00, 0x00, 0x00},	// 28, -14.0dB
+	{0x0a, 0x0a, 0x09, 0x05, 0x00, 0x00, 0x00, 0x00},	// 29, -14.5dB
+	{0x0a, 0x09, 0x08, 0x05, 0x00, 0x00, 0x00, 0x00},	// 30, -15.0dB
+	{0x09, 0x09, 0x08, 0x05, 0x00, 0x00, 0x00, 0x00},	// 31, -15.5dB
+	{0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00}	// 32, -16.0dB
+};
+
+
+#ifdef CONFIG_CHIP_VER_INTEGRATION
+void dump_chip_info(HAL_VERSION	ChipVersion)
+{
+	if(IS_81XXC(ChipVersion)){
+		DBG_871X("Chip Version Info: %s_",IS_92C_SERIAL(ChipVersion)?"CHIP_8192C":"CHIP_8188C");
+	}
+	else if(IS_92D(ChipVersion)){
+		DBG_871X("Chip Version Info: CHIP_8192D_");
+	}
+	else if(IS_8723_SERIES(ChipVersion)){
+		DBG_871X("Chip Version Info: CHIP_8723A_");
+	}
+	else if(IS_8188E(ChipVersion)){
+		DBG_871X("Chip Version Info: CHIP_8188E_");
+	}
+
+	DBG_871X("%s_",IS_NORMAL_CHIP(ChipVersion)?"Normal_Chip":"Test_Chip");
+	DBG_871X("%s_",IS_CHIP_VENDOR_TSMC(ChipVersion)?"TSMC":"UMC");
+	if(IS_A_CUT(ChipVersion)) DBG_871X("A_CUT_");
+	else if(IS_B_CUT(ChipVersion)) DBG_871X("B_CUT_");
+	else if(IS_C_CUT(ChipVersion)) DBG_871X("C_CUT_");
+	else if(IS_D_CUT(ChipVersion)) DBG_871X("D_CUT_");
+	else if(IS_E_CUT(ChipVersion)) DBG_871X("E_CUT_");
+	else DBG_871X("UNKNOWN_CUT(%d)_",ChipVersion.CUTVersion);
+
+	if(IS_1T1R(ChipVersion))	DBG_871X("1T1R_");
+	else if(IS_1T2R(ChipVersion))	DBG_871X("1T2R_");
+	else if(IS_2T2R(ChipVersion))	DBG_871X("2T2R_");
+	else DBG_871X("UNKNOWN_RFTYPE(%d)_",ChipVersion.RFType);
+
+
+	DBG_871X("RomVer(%d)\n",ChipVersion.ROMVer);
+}
+
+#endif
+
+#define	EEPROM_CHANNEL_PLAN_BY_HW_MASK	0x80
+
+u8	//return the final channel plan decision
+hal_com_get_channel_plan(
+	IN	PADAPTER	padapter,
+	IN	u8			hw_channel_plan,	//channel plan from HW (efuse/eeprom)
+	IN	u8			sw_channel_plan,	//channel plan from SW (registry/module param)
+	IN	u8			def_channel_plan,	//channel plan used when the former two is invalid
+	IN	BOOLEAN		AutoLoadFail
+	)
+{
+	u8 swConfig;
+	u8 chnlPlan;
+
+	swConfig = _TRUE;
+	if (!AutoLoadFail)
+	{
+		if (!rtw_is_channel_plan_valid(sw_channel_plan))
+			swConfig = _FALSE;
+		if (hw_channel_plan & EEPROM_CHANNEL_PLAN_BY_HW_MASK)
+			swConfig = _FALSE;
+	}
+
+	if (swConfig == _TRUE)
+		chnlPlan = sw_channel_plan;
+	else
+		chnlPlan = hw_channel_plan & (~EEPROM_CHANNEL_PLAN_BY_HW_MASK);
+
+	if (!rtw_is_channel_plan_valid(chnlPlan))
+		chnlPlan = def_channel_plan;
+
+	return chnlPlan;
+}
+
+u8	MRateToHwRate(u8 rate)
+{
+	u8	ret = DESC_RATE1M;
+
+	switch(rate)
+	{
+		// CCK and OFDM non-HT rates
+	case IEEE80211_CCK_RATE_1MB:	ret = DESC_RATE1M;	break;
+	case IEEE80211_CCK_RATE_2MB:	ret = DESC_RATE2M;	break;
+	case IEEE80211_CCK_RATE_5MB:	ret = DESC_RATE5_5M;	break;
+	case IEEE80211_CCK_RATE_11MB:	ret = DESC_RATE11M;	break;
+	case IEEE80211_OFDM_RATE_6MB:	ret = DESC_RATE6M;	break;
+	case IEEE80211_OFDM_RATE_9MB:	ret = DESC_RATE9M;	break;
+	case IEEE80211_OFDM_RATE_12MB:	ret = DESC_RATE12M;	break;
+	case IEEE80211_OFDM_RATE_18MB:	ret = DESC_RATE18M;	break;
+	case IEEE80211_OFDM_RATE_24MB:	ret = DESC_RATE24M;	break;
+	case IEEE80211_OFDM_RATE_36MB:	ret = DESC_RATE36M;	break;
+	case IEEE80211_OFDM_RATE_48MB:	ret = DESC_RATE48M;	break;
+	case IEEE80211_OFDM_RATE_54MB:	ret = DESC_RATE54M;	break;
+
+		// HT rates since here
+	//case MGN_MCS0:		ret = DESC_RATEMCS0;	break;
+	//case MGN_MCS1:		ret = DESC_RATEMCS1;	break;
+	//case MGN_MCS2:		ret = DESC_RATEMCS2;	break;
+	//case MGN_MCS3:		ret = DESC_RATEMCS3;	break;
+	//case MGN_MCS4:		ret = DESC_RATEMCS4;	break;
+	//case MGN_MCS5:		ret = DESC_RATEMCS5;	break;
+	//case MGN_MCS6:		ret = DESC_RATEMCS6;	break;
+	//case MGN_MCS7:		ret = DESC_RATEMCS7;	break;
+
+	default:		break;
+	}
+
+	return ret;
+}
+
+void	HalSetBrateCfg(
+	IN PADAPTER		Adapter,
+	IN u8			*mBratesOS,
+	OUT u16			*pBrateCfg)
+{
+	u8	i, is_brate, brate;
+
+	for(i=0;i<NDIS_802_11_LENGTH_RATES_EX;i++)
+	{
+		is_brate = mBratesOS[i] & IEEE80211_BASIC_RATE_MASK;
+		brate = mBratesOS[i] & 0x7f;
+
+		if( is_brate )
+		{
+			switch(brate)
+			{
+				case IEEE80211_CCK_RATE_1MB:	*pBrateCfg |= RATE_1M;	break;
+				case IEEE80211_CCK_RATE_2MB:	*pBrateCfg |= RATE_2M;	break;
+				case IEEE80211_CCK_RATE_5MB:	*pBrateCfg |= RATE_5_5M;break;
+				case IEEE80211_CCK_RATE_11MB:	*pBrateCfg |= RATE_11M;	break;
+				case IEEE80211_OFDM_RATE_6MB:	*pBrateCfg |= RATE_6M;	break;
+				case IEEE80211_OFDM_RATE_9MB:	*pBrateCfg |= RATE_9M;	break;
+				case IEEE80211_OFDM_RATE_12MB:	*pBrateCfg |= RATE_12M;	break;
+				case IEEE80211_OFDM_RATE_18MB:	*pBrateCfg |= RATE_18M;	break;
+				case IEEE80211_OFDM_RATE_24MB:	*pBrateCfg |= RATE_24M;	break;
+				case IEEE80211_OFDM_RATE_36MB:	*pBrateCfg |= RATE_36M;	break;
+				case IEEE80211_OFDM_RATE_48MB:	*pBrateCfg |= RATE_48M;	break;
+				case IEEE80211_OFDM_RATE_54MB:	*pBrateCfg |= RATE_54M;	break;
+			}
+		}
+	}
+}
+
+void hal_init_macaddr(_adapter *adapter)
+{
+	rtw_hal_set_hwreg(adapter, HW_VAR_MAC_ADDR, adapter->eeprompriv.mac_addr);
+#ifdef  CONFIG_CONCURRENT_MODE
+	if (adapter->pbuddy_adapter)
+		rtw_hal_set_hwreg(adapter->pbuddy_adapter, HW_VAR_MAC_ADDR, adapter->pbuddy_adapter->eeprompriv.mac_addr);
+#endif
+}
+
+/*
+* C2H event format:
+* Field	 TRIGGER		CONTENT	   CMD_SEQ 	CMD_LEN		 CMD_ID
+* BITS	 [127:120]	[119:16]      [15:8]		  [7:4]	 	   [3:0]
+*/
+
+void c2h_evt_clear(_adapter *adapter)
+{
+	rtw_write8(adapter, REG_C2HEVT_CLEAR, C2H_EVT_HOST_CLOSE);
+}
+
+s32 c2h_evt_read(_adapter *adapter, u8 *buf)
+{
+	s32 ret = _FAIL;
+	struct c2h_evt_hdr *c2h_evt;
+	int i;
+	u8 trigger;
+
+	if (buf == NULL)
+		goto exit;
+
+	trigger = rtw_read8(adapter, REG_C2HEVT_CLEAR);
+
+	if (trigger == C2H_EVT_HOST_CLOSE) {
+		goto exit; /* Not ready */
+	} else if (trigger != C2H_EVT_FW_CLOSE) {
+		goto clear_evt; /* Not a valid value */
+	}
+
+	c2h_evt = (struct c2h_evt_hdr *)buf;
+
+	_rtw_memset(c2h_evt, 0, 16);
+
+	*buf = rtw_read8(adapter, REG_C2HEVT_MSG_NORMAL);
+	*(buf+1) = rtw_read8(adapter, REG_C2HEVT_MSG_NORMAL + 1);
+
+	RT_PRINT_DATA(_module_hal_init_c_, _drv_info_, "c2h_evt_read(): ",
+		&c2h_evt , sizeof(c2h_evt));
+
+	if (0) {
+		DBG_871X("%s id:%u, len:%u, seq:%u, trigger:0x%02x\n", __func__
+			, c2h_evt->id, c2h_evt->plen, c2h_evt->seq, trigger);
+	}
+
+	/* Read the content */
+	for (i = 0; i < c2h_evt->plen; i++)
+		c2h_evt->payload[i] = rtw_read8(adapter, REG_C2HEVT_MSG_NORMAL + sizeof(*c2h_evt) + i);
+
+	RT_PRINT_DATA(_module_hal_init_c_, _drv_info_, "c2h_evt_read(): Command Content:\n",
+		c2h_evt->payload, c2h_evt->plen);
+
+	ret = _SUCCESS;
+
+clear_evt:
+	/*
+	* Clear event to notify FW we have read the command.
+	* If this field isn't clear, the FW won't update the next command message.
+	*/
+	c2h_evt_clear(adapter);
+exit:
+	return ret;
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/hal_intf.c b/drivers/net/wireless/realtek/rtl8192cu/hal/hal_intf.c
new file mode 100644
index 000000000000..fd1e888598b5
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/hal_intf.c
@@ -0,0 +1,545 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#define _HAL_INTF_C_
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_byteorder.h>
+
+#include <hal_intf.h>
+
+#ifdef CONFIG_SDIO_HCI
+	#include <sdio_hal.h>
+#elif defined(CONFIG_USB_HCI)
+	#include <usb_hal.h>
+#elif defined(CONFIG_GSPI_HCI)
+	#include <gspi_hal.h>
+#endif
+
+void rtw_hal_chip_configure(_adapter *padapter)
+{
+	if(padapter->HalFunc.intf_chip_configure)
+		padapter->HalFunc.intf_chip_configure(padapter);
+}
+
+void rtw_hal_read_chip_info(_adapter *padapter)
+{
+	if(padapter->HalFunc.read_adapter_info)
+		padapter->HalFunc.read_adapter_info(padapter);
+}
+
+void rtw_hal_read_chip_version(_adapter *padapter)
+{
+	if(padapter->HalFunc.read_chip_version)
+		padapter->HalFunc.read_chip_version(padapter);
+}
+
+void rtw_hal_def_value_init(_adapter *padapter)
+{
+	if(padapter->HalFunc.init_default_value)
+		padapter->HalFunc.init_default_value(padapter);
+}
+
+void rtw_hal_free_data(_adapter *padapter)
+{
+	if(padapter->HalFunc.free_hal_data)
+		padapter->HalFunc.free_hal_data(padapter);
+}
+
+void rtw_hal_dm_init(_adapter *padapter)
+{
+	if(padapter->HalFunc.dm_init)
+		padapter->HalFunc.dm_init(padapter);
+}
+
+void rtw_hal_dm_deinit(_adapter *padapter)
+{
+	// cancel dm  timer
+	if(padapter->HalFunc.dm_deinit)
+		padapter->HalFunc.dm_deinit(padapter);
+}
+
+void rtw_hal_sw_led_init(_adapter *padapter)
+{
+	if(padapter->HalFunc.InitSwLeds)
+		padapter->HalFunc.InitSwLeds(padapter);
+}
+
+void rtw_hal_sw_led_deinit(_adapter *padapter)
+{
+	if(padapter->HalFunc.DeInitSwLeds)
+		padapter->HalFunc.DeInitSwLeds(padapter);
+}
+
+uint	 rtw_hal_init(_adapter *padapter)
+{
+	uint	status = _SUCCESS;
+
+	if(padapter->hw_init_completed == _TRUE)
+	{
+		DBG_871X("rtw_hal_init: hw_init_completed == _TRUE\n");
+		goto success;
+	}
+#ifdef CONFIG_DEINIT_BEFORE_INIT
+	status = padapter->HalFunc.hal_deinit(padapter);
+	if(status != _SUCCESS){
+		DBG_871X("rtw_hal_init: hal_deinit before hal_init FAIL !!\n");
+		goto fail;
+	}
+#endif
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	// before init mac0, driver must init mac1 first to avoid usb rx error.
+	if((padapter->pbuddy_adapter != NULL) && (padapter->DualMacConcurrent == _TRUE)
+		&& (padapter->adapter_type == PRIMARY_ADAPTER))
+	{
+		if(padapter->pbuddy_adapter->hw_init_completed == _TRUE)
+		{
+			DBG_871X("rtw_hal_init: pbuddy_adapter hw_init_completed == _TRUE\n");
+		}
+		else
+		{
+#ifdef CONFIG_DEINIT_BEFORE_INIT
+			status = padapter->HalFunc.hal_deinit(padapter->pbuddy_adapter);
+			if(status != _SUCCESS){
+				DBG_871X("rtw_hal_init: hal_deinit before hal_init FAIL !!(pbuddy_adapter)\n");
+				goto fail;
+			}
+#endif
+			status = 	padapter->HalFunc.hal_init(padapter->pbuddy_adapter);
+			if(status == _SUCCESS){
+				padapter->pbuddy_adapter->hw_init_completed = _TRUE;
+			}
+			else{
+				padapter->pbuddy_adapter->hw_init_completed = _FALSE;
+				RT_TRACE(_module_hal_init_c_,_drv_err_,("rtw_hal_init: hal__init fail(pbuddy_adapter)\n"));
+				goto fail;
+			}
+		}
+	}
+#else
+	if(adapter_to_dvobj(padapter)->DualMacMode == _TRUE)
+	{
+		if(padapter->pbuddy_adapter != NULL) {
+			if(padapter->pbuddy_adapter->hw_init_completed == _FALSE)
+			{
+#ifdef CONFIG_DEINIT_BEFORE_INIT
+				status = padapter->HalFunc.hal_deinit(padapter->pbuddy_adapter);
+				if(status != _SUCCESS){
+					DBG_871X("rtw_hal_init: hal_deinit before hal_init FAIL !!(pbuddy_adapter)\n");
+					goto fail;
+				}
+#endif
+				status = padapter->HalFunc.hal_init(padapter->pbuddy_adapter);
+				if(status == _SUCCESS){
+					padapter->pbuddy_adapter->hw_init_completed = _TRUE;
+				}
+				else{
+					padapter->pbuddy_adapter->hw_init_completed = _FALSE;
+					RT_TRACE(_module_hal_init_c_,_drv_err_,("rtw_hal_init: hal__init fail for another interface\n"));
+				}
+			}
+		}
+	}
+#endif
+
+	padapter->hw_init_completed=_FALSE;
+
+	status = padapter->HalFunc.hal_init(padapter);
+
+	if(status == _SUCCESS){
+		padapter->hw_init_completed = _TRUE;
+	}
+	else{
+		padapter->hw_init_completed = _FALSE;
+		RT_TRACE(_module_hal_init_c_,_drv_err_,("rtw_hal_init: hal__init fail\n"));
+		goto fail;
+	}
+
+success:
+
+	if (padapter->registrypriv.notch_filter == 1)
+		rtw_hal_notch_filter(padapter, 1);
+
+	rtw_hal_reset_security_engine(padapter);
+
+	rtw_sec_restore_wep_key(padapter);
+
+	init_hw_mlme_ext(padapter);
+
+fail:
+
+	RT_TRACE(_module_hal_init_c_,_drv_err_,("-rtl871x_hal_init:status=0x%x\n",status));
+
+	return status;
+}
+
+uint rtw_hal_deinit(_adapter *padapter)
+{
+	uint	status = _SUCCESS;
+
+_func_enter_;
+
+	status = padapter->HalFunc.hal_deinit(padapter);
+
+	if(status == _SUCCESS){
+		padapter->hw_init_completed = _FALSE;
+	}
+	else
+	{
+		RT_TRACE(_module_hal_init_c_,_drv_err_,("\n rtw_hal_deinit: hal_init fail\n"));
+	}
+
+_func_exit_;
+
+	return status;
+}
+
+void rtw_hal_set_hwreg(_adapter *padapter, u8 variable, u8 *val)
+{
+	if (padapter->HalFunc.SetHwRegHandler)
+		padapter->HalFunc.SetHwRegHandler(padapter, variable, val);
+}
+
+void rtw_hal_get_hwreg(_adapter *padapter, u8 variable, u8 *val)
+{
+	if (padapter->HalFunc.GetHwRegHandler)
+		padapter->HalFunc.GetHwRegHandler(padapter, variable, val);
+}
+
+u8 rtw_hal_set_def_var(_adapter *padapter, HAL_DEF_VARIABLE eVariable, PVOID pValue)
+{
+	if(padapter->HalFunc.SetHalDefVarHandler)
+		return padapter->HalFunc.SetHalDefVarHandler(padapter,eVariable,pValue);
+	return _FAIL;
+}
+
+u8 rtw_hal_get_def_var(_adapter *padapter, HAL_DEF_VARIABLE eVariable, PVOID pValue)
+{
+	if(padapter->HalFunc.GetHalDefVarHandler)
+		return padapter->HalFunc.GetHalDefVarHandler(padapter,eVariable,pValue);
+	return _FAIL;
+}
+
+void rtw_hal_enable_interrupt(_adapter *padapter)
+{
+	if (padapter->HalFunc.enable_interrupt)
+		padapter->HalFunc.enable_interrupt(padapter);
+	else
+		DBG_871X("%s: HalFunc.enable_interrupt is NULL!\n", __FUNCTION__);
+
+}
+void rtw_hal_disable_interrupt(_adapter *padapter)
+{
+	if (padapter->HalFunc.disable_interrupt)
+		padapter->HalFunc.disable_interrupt(padapter);
+	else
+		DBG_871X("%s: HalFunc.disable_interrupt is NULL!\n", __FUNCTION__);
+
+}
+
+u32	rtw_hal_inirp_init(_adapter *padapter)
+{
+	u32 rst = _FAIL;
+	if(padapter->HalFunc.inirp_init)
+		rst = padapter->HalFunc.inirp_init(padapter);
+	else
+		DBG_871X(" %s HalFunc.inirp_init is NULL!!!\n",__FUNCTION__);
+	return rst;
+}
+
+u32	rtw_hal_inirp_deinit(_adapter *padapter)
+{
+
+	if(padapter->HalFunc.inirp_deinit)
+		return padapter->HalFunc.inirp_deinit(padapter);
+
+	return _FAIL;
+
+}
+
+u8 rtw_hal_intf_ps_func(_adapter *padapter,HAL_INTF_PS_FUNC efunc_id, u8* val)
+{
+	if(padapter->HalFunc.interface_ps_func)
+		return padapter->HalFunc.interface_ps_func(padapter,efunc_id,val);
+	return _FAIL;
+}
+
+s32	rtw_hal_xmitframe_enqueue(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	if(padapter->HalFunc.hal_xmitframe_enqueue)
+		return padapter->HalFunc.hal_xmitframe_enqueue(padapter, pxmitframe);
+
+	return _FALSE;
+}
+
+s32 rtw_hal_xmit(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	if(padapter->HalFunc.hal_xmit)
+		return padapter->HalFunc.hal_xmit(padapter, pxmitframe);
+
+	return _FALSE;
+}
+
+s32	rtw_hal_mgnt_xmit(_adapter *padapter, struct xmit_frame *pmgntframe)
+{
+	s32 ret = _FAIL;
+	unsigned char	*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+	_rtw_memcpy(pmgntframe->attrib.ra, pwlanhdr->addr1, ETH_ALEN);
+
+#ifdef CONFIG_IEEE80211W
+	if(padapter->securitypriv.binstallBIPkey == _TRUE)
+	{
+		if(IS_MCAST(pmgntframe->attrib.ra))
+		{
+			pmgntframe->attrib.encrypt = _BIP_;
+			//pmgntframe->attrib.bswenc = _TRUE;
+		}
+		else
+		{
+			pmgntframe->attrib.encrypt = _AES_;
+			pmgntframe->attrib.bswenc = _TRUE;
+		}
+		rtw_mgmt_xmitframe_coalesce(padapter, pmgntframe->pkt, pmgntframe);
+	}
+#endif //CONFIG_IEEE80211W
+
+	if(padapter->HalFunc.mgnt_xmit)
+		ret = padapter->HalFunc.mgnt_xmit(padapter, pmgntframe);
+	return ret;
+}
+
+s32 rtw_hal_init_xmit_priv(_adapter *padapter)
+{
+	if(padapter->HalFunc.init_xmit_priv != NULL)
+		return padapter->HalFunc.init_xmit_priv(padapter);
+	return _FAIL;
+}
+
+void rtw_hal_free_xmit_priv(_adapter *padapter)
+{
+	if(padapter->HalFunc.free_xmit_priv != NULL)
+		padapter->HalFunc.free_xmit_priv(padapter);
+}
+
+s32 rtw_hal_init_recv_priv(_adapter *padapter)
+{
+	if(padapter->HalFunc.init_recv_priv)
+		return padapter->HalFunc.init_recv_priv(padapter);
+
+	return _FAIL;
+}
+
+void rtw_hal_free_recv_priv(_adapter *padapter)
+{
+	if(padapter->HalFunc.free_recv_priv)
+		padapter->HalFunc.free_recv_priv(padapter);
+}
+
+void rtw_hal_update_ra_mask(_adapter *padapter, u32 mac_id)
+{
+	if(padapter->HalFunc.UpdateRAMaskHandler)
+		padapter->HalFunc.UpdateRAMaskHandler(padapter,mac_id);
+}
+
+void rtw_hal_add_ra_tid(_adapter *padapter, u32 bitmap, u8 arg)
+{
+	if(padapter->HalFunc.Add_RateATid)
+		padapter->HalFunc.Add_RateATid(padapter, bitmap, arg);
+}
+
+u32 rtw_hal_read_bbreg(_adapter *padapter, u32 RegAddr, u32 BitMask)
+{
+	u32 data = 0;
+	if (padapter->HalFunc.read_bbreg)
+		data = padapter->HalFunc.read_bbreg(padapter, RegAddr, BitMask);
+	return data;
+}
+
+void rtw_hal_write_bbreg(_adapter *padapter, u32 RegAddr, u32 BitMask, u32 Data)
+{
+	if (padapter->HalFunc.write_bbreg)
+		padapter->HalFunc.write_bbreg(padapter, RegAddr, BitMask, Data);
+}
+
+u32 rtw_hal_read_rfreg(_adapter *padapter, u32 eRFPath, u32 RegAddr, u32 BitMask)
+{
+	u32 data = 0;
+	if (padapter->HalFunc.read_rfreg)
+		data = padapter->HalFunc.read_rfreg(padapter, eRFPath, RegAddr, BitMask);
+	return data;
+}
+
+void rtw_hal_write_rfreg(_adapter *padapter, u32 eRFPath, u32 RegAddr, u32 BitMask, u32 Data)
+{
+	if (padapter->HalFunc.write_rfreg)
+		padapter->HalFunc.write_rfreg(padapter, eRFPath, RegAddr, BitMask, Data);
+}
+
+s32 rtw_hal_interrupt_handler(_adapter *padapter)
+{
+	if(padapter->HalFunc.interrupt_handler)
+		return padapter->HalFunc.interrupt_handler(padapter);
+	return _FAIL;
+}
+
+void rtw_hal_set_bwmode(_adapter *padapter, HT_CHANNEL_WIDTH Bandwidth, u8 Offset)
+{
+	if(padapter->HalFunc.set_bwmode_handler)
+		padapter->HalFunc.set_bwmode_handler(padapter, Bandwidth, Offset);
+}
+
+void rtw_hal_set_chan(_adapter *padapter, u8 channel)
+{
+	if(padapter->HalFunc.set_channel_handler)
+		padapter->HalFunc.set_channel_handler(padapter, channel);
+}
+
+void rtw_hal_dm_watchdog(_adapter *padapter)
+{
+	if(padapter->HalFunc.hal_dm_watchdog)
+		padapter->HalFunc.hal_dm_watchdog(padapter);
+}
+
+void rtw_hal_bcn_related_reg_setting(_adapter *padapter)
+{
+	if(padapter->HalFunc.SetBeaconRelatedRegistersHandler)
+		padapter->HalFunc.SetBeaconRelatedRegistersHandler(padapter);
+}
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+u8 rtw_hal_antdiv_before_linked(_adapter *padapter)
+{
+	if (padapter->HalFunc.AntDivBeforeLinkHandler)
+		return padapter->HalFunc.AntDivBeforeLinkHandler(padapter);
+	return _FALSE;
+}
+
+void rtw_hal_antdiv_rssi_compared(_adapter *padapter, WLAN_BSSID_EX *dst, WLAN_BSSID_EX *src)
+{
+	if (padapter->HalFunc.AntDivCompareHandler)
+		padapter->HalFunc.AntDivCompareHandler(padapter, dst, src);
+}
+#endif
+
+#ifdef CONFIG_HOSTAPD_MLME
+s32	rtw_hal_hostap_mgnt_xmit_entry(_adapter *padapter, _pkt *pkt)
+{
+	if (padapter->HalFunc.hostap_mgnt_xmit_entry)
+		return padapter->HalFunc.hostap_mgnt_xmit_entry(padapter, pkt);
+	return _FAIL;
+}
+#endif //CONFIG_HOSTAPD_MLME
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+void rtw_hal_sreset_init(_adapter *padapter)
+{
+	if(padapter->HalFunc.sreset_init_value)
+		padapter->HalFunc.sreset_init_value(padapter);
+}
+
+void rtw_hal_sreset_reset(_adapter *padapter)
+{
+	padapter = GET_PRIMARY_ADAPTER(padapter);
+
+	if(padapter->HalFunc.silentreset)
+		padapter->HalFunc.silentreset(padapter);
+}
+
+void rtw_hal_sreset_reset_value(_adapter *padapter)
+{
+	if(padapter->HalFunc.sreset_reset_value)
+		padapter->HalFunc.sreset_reset_value(padapter);
+}
+
+void rtw_hal_sreset_xmit_status_check(_adapter *padapter)
+{
+#ifdef CONFIG_CONCURRENT_MODE
+	if (padapter->adapter_type != PRIMARY_ADAPTER)
+		return;
+#endif
+	if(padapter->HalFunc.sreset_xmit_status_check)
+		padapter->HalFunc.sreset_xmit_status_check(padapter);
+}
+
+void rtw_hal_sreset_linked_status_check(_adapter *padapter)
+{
+	if(padapter->HalFunc.sreset_linked_status_check)
+		padapter->HalFunc.sreset_linked_status_check(padapter);
+}
+
+u8 rtw_hal_sreset_get_wifi_status(_adapter *padapter)
+{
+	u8 status = 0;
+	if(padapter->HalFunc.sreset_get_wifi_status)
+		status = padapter->HalFunc.sreset_get_wifi_status(padapter);
+	return status;
+}
+
+bool rtw_hal_sreset_inprogress(_adapter *padapter)
+{
+	bool inprogress = _FALSE;
+
+	padapter = GET_PRIMARY_ADAPTER(padapter);
+
+	if(padapter->HalFunc.sreset_inprogress)
+		inprogress = padapter->HalFunc.sreset_inprogress(padapter);
+	return inprogress;
+}
+#endif //DBG_CONFIG_ERROR_DETECT
+
+#ifdef CONFIG_IOL
+int rtw_hal_iol_cmd(ADAPTER *adapter, struct xmit_frame *xmit_frame, u32 max_wating_ms)
+{
+	if (adapter->HalFunc.IOL_exec_cmds_sync)
+		return adapter->HalFunc.IOL_exec_cmds_sync(adapter, xmit_frame, max_wating_ms);
+	return _FAIL;
+}
+#endif
+
+void rtw_hal_notch_filter(_adapter *adapter, bool enable)
+{
+	if(adapter->HalFunc.hal_notch_filter)
+		adapter->HalFunc.hal_notch_filter(adapter,enable);
+}
+
+void rtw_hal_reset_security_engine(_adapter * adapter)
+{
+	if(adapter->HalFunc.hal_reset_security_engine)
+		adapter->HalFunc.hal_reset_security_engine(adapter);
+}
+
+s32 rtw_hal_c2h_handler(_adapter *adapter, struct c2h_evt_hdr *c2h_evt)
+{
+	s32 ret = _FAIL;
+	if (adapter->HalFunc.c2h_handler)
+		ret = adapter->HalFunc.c2h_handler(adapter, c2h_evt);
+	return ret;
+}
+
+c2h_id_filter rtw_hal_c2h_id_filter_ccx(_adapter *adapter)
+{
+	return adapter->HalFunc.c2h_id_filter_ccx;
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_cmd.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_cmd.c
new file mode 100644
index 000000000000..27e8d54c0f63
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_cmd.c
@@ -0,0 +1,1154 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTL8192C_CMD_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#include <cmd_osdep.h>
+#include <mlme_osdep.h>
+#include <rtw_byteorder.h>
+#include <circ_buf.h>
+#include <rtw_ioctl_set.h>
+
+#include <rtl8192c_hal.h>
+
+
+#define RTL92C_MAX_H2C_BOX_NUMS	4
+#define RTL92C_MAX_CMD_LEN	5
+#define MESSAGE_BOX_SIZE		4
+#define EX_MESSAGE_BOX_SIZE	2
+
+static u8 _is_fw_read_cmd_down(_adapter* padapter, u8 msgbox_num)
+{
+	u8	read_down = _FALSE;
+	int 	retry_cnts = 100;
+
+	u8 valid;
+
+//	DBG_8192C(" _is_fw_read_cmd_down ,isnormal_chip(%x),reg_1cc(%x),msg_box(%d)...\n",isvern,rtw_read8(padapter,REG_HMETFR),msgbox_num);
+
+	do{
+		valid = rtw_read8(padapter,REG_HMETFR) & BIT(msgbox_num);
+		if(0 == valid ){
+			read_down = _TRUE;
+		}
+	}while( (!read_down) && (retry_cnts--));
+
+	return read_down;
+
+}
+
+
+/*****************************************
+* H2C Msg format :
+*| 31 - 8		|7		| 6 - 0	|
+*| h2c_msg 	|Ext_bit	|CMD_ID	|
+*
+******************************************/
+int rtl8192c_FillH2CCmd(_adapter* padapter, u8 ElementID, u32 CmdLen, u8* pCmdBuffer)
+{
+	u8	bcmd_down = _FALSE;
+	int 	retry_cnts = 100;
+	u8	h2c_box_num;
+	u32	msgbox_addr;
+	u32  msgbox_ex_addr;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	u32	h2c_cmd = 0;
+	u16	h2c_cmd_ex = 0;
+	int ret = _FAIL;
+
+_func_enter_;
+
+	padapter = GET_PRIMARY_ADAPTER(padapter);
+	pHalData = GET_HAL_DATA(padapter);
+
+	if(padapter->bFWReady == _FALSE)
+	{
+		DBG_8192C("FillH2CCmd(): return H2C cmd because fw is not ready\n");
+		return ret;
+	}
+
+	_enter_critical_mutex(&(adapter_to_dvobj(padapter)->h2c_fwcmd_mutex), NULL);
+
+	if(!pCmdBuffer){
+		goto exit;
+	}
+	if(CmdLen > RTL92C_MAX_CMD_LEN){
+		goto exit;
+	}
+	//pay attention to if  race condition happened in  H2C cmd setting.
+	do{
+		h2c_box_num = pHalData->LastHMEBoxNum;
+
+		if(!_is_fw_read_cmd_down(padapter, h2c_box_num)){
+			DBG_8192C(" fw read cmd failed...\n");
+			goto exit;
+		}
+
+		if(CmdLen<=3)
+		{
+			_rtw_memcpy((u8*)(&h2c_cmd)+1, pCmdBuffer, CmdLen );
+		}
+		else{
+			_rtw_memcpy((u8*)(&h2c_cmd_ex), pCmdBuffer, EX_MESSAGE_BOX_SIZE);
+			_rtw_memcpy((u8*)(&h2c_cmd)+1, pCmdBuffer+2,( CmdLen-EX_MESSAGE_BOX_SIZE));
+			*(u8*)(&h2c_cmd) |= BIT(7);
+		}
+
+		*(u8*)(&h2c_cmd) |= ElementID;
+
+		if(h2c_cmd & BIT(7)){
+			msgbox_ex_addr = REG_HMEBOX_EXT_0 + (h2c_box_num *EX_MESSAGE_BOX_SIZE);
+			h2c_cmd_ex = cpu_to_le16( h2c_cmd_ex );
+			rtw_write16(padapter, msgbox_ex_addr, h2c_cmd_ex);
+		}
+		msgbox_addr =REG_HMEBOX_0 + (h2c_box_num *MESSAGE_BOX_SIZE);
+		h2c_cmd = cpu_to_le32( h2c_cmd );
+		rtw_write32(padapter,msgbox_addr, h2c_cmd);
+
+		bcmd_down = _TRUE;
+
+	//	DBG_8192C("MSG_BOX:%d,CmdLen(%d), reg:0x%x =>h2c_cmd:0x%x, reg:0x%x =>h2c_cmd_ex:0x%x ..\n"
+	//	 	,pHalData->LastHMEBoxNum ,CmdLen,msgbox_addr,h2c_cmd,msgbox_ex_addr,h2c_cmd_ex);
+
+		 pHalData->LastHMEBoxNum = (h2c_box_num+1) % RTL92C_MAX_H2C_BOX_NUMS ;
+
+	}while((!bcmd_down) && (retry_cnts--));
+/*
+	if(bcmd_down)
+		DBG_8192C("H2C Cmd exe down. \n"	);
+	else
+		DBG_8192C("H2C Cmd exe failed. \n"	);
+*/
+	ret = _SUCCESS;
+
+exit:
+
+	_exit_critical_mutex(&(adapter_to_dvobj(padapter)->h2c_fwcmd_mutex), NULL);
+
+_func_exit_;
+
+	return ret;
+
+}
+
+u8 rtl8192c_h2c_msg_hdl(_adapter *padapter, unsigned char *pbuf)
+{
+	u8 ElementID, CmdLen;
+	u8 *pCmdBuffer;
+	struct cmd_msg_parm  *pcmdmsg;
+
+	if(!pbuf)
+		return H2C_PARAMETERS_ERROR;
+
+	pcmdmsg = (struct cmd_msg_parm*)pbuf;
+	ElementID = pcmdmsg->eid;
+	CmdLen = pcmdmsg->sz;
+	pCmdBuffer = pcmdmsg->buf;
+
+	rtl8192c_FillH2CCmd(padapter, ElementID, CmdLen, pCmdBuffer);
+
+	return H2C_SUCCESS;
+}
+
+#if defined(CONFIG_AUTOSUSPEND) && defined(SUPPORT_HW_RFOFF_DETECTED)
+u8 rtl8192c_set_FwSelectSuspend_cmd(_adapter *padapter ,u8 bfwpoll, u16 period)
+{
+	u8	res=_SUCCESS;
+	struct H2C_SS_RFOFF_PARAM param;
+	DBG_8192C("==>%s bfwpoll(%x)\n",__FUNCTION__,bfwpoll);
+	param.gpio_period = period;//Polling GPIO_11 period time
+	param.ROFOn = (_TRUE == bfwpoll)?1:0;
+	rtl8192c_FillH2CCmd(padapter, SELECTIVE_SUSPEND_ROF_CMD, sizeof(param), (u8*)(&param));
+	return res;
+}
+#endif //CONFIG_AUTOSUSPEND && SUPPORT_HW_RFOFF_DETECTED
+
+u8 rtl8192c_set_rssi_cmd(_adapter*padapter, u8 *param)
+{
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	*((u32*) param ) = cpu_to_le32( *((u32*) param ) );
+
+	rtl8192c_FillH2CCmd(padapter, RSSI_SETTING_EID, 3, param);
+
+_func_exit_;
+
+	return res;
+}
+
+u8 rtl8192c_set_raid_cmd(_adapter*padapter, u32 mask, u8 arg)
+{
+	u8	buf[5];
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	_rtw_memset(buf, 0, 5);
+	mask = cpu_to_le32( mask );
+	_rtw_memcpy(buf, &mask, 4);
+	buf[4]  = arg;
+
+	rtl8192c_FillH2CCmd(padapter, MACID_CONFIG_EID, 5, buf);
+
+_func_exit_;
+
+	return res;
+
+}
+
+//bitmap[0:27] = tx_rate_bitmap
+//bitmap[28:31]= Rate Adaptive id
+//arg[0:4] = macid
+//arg[5] = Short GI
+void rtl8192c_Add_RateATid(PADAPTER pAdapter, u32 bitmap, u8 arg)
+{
+
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+
+	if(pHalData->fw_ractrl == _TRUE)
+	{
+		rtl8192c_set_raid_cmd(pAdapter, bitmap, arg);
+	}
+	else
+	{
+		u8 macid, init_rate, shortGIrate=_FALSE;
+
+		init_rate = get_highest_rate_idx(bitmap&0x0fffffff)&0x3f;
+
+		macid = arg&0x1f;
+
+		shortGIrate = (arg&BIT(5)) ? _TRUE:_FALSE;
+
+		if (shortGIrate==_TRUE)
+			init_rate |= BIT(6);
+
+		rtw_write8(pAdapter, (REG_INIDATA_RATE_SEL+macid), (u8)init_rate);
+	}
+
+}
+
+void rtl8192c_set_FwPwrMode_cmd(_adapter*padapter, u8 Mode)
+{
+	SETPWRMODE_PARM H2CSetPwrMode;
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+
+_func_enter_;
+
+	DBG_871X("%s(): Mode = %d, SmartPS = %d\n", __FUNCTION__,Mode,pwrpriv->smart_ps);
+
+	H2CSetPwrMode.Mode = Mode;
+
+	H2CSetPwrMode.SmartPS = pwrpriv->smart_ps;
+
+	H2CSetPwrMode.BcnPassTime = 1;//pPSC->RegMaxLPSAwakeIntvl;
+
+	rtl8192c_FillH2CCmd(padapter, SET_PWRMODE_EID, sizeof(H2CSetPwrMode), (u8 *)&H2CSetPwrMode);
+
+_func_exit_;
+}
+
+void ConstructBeacon(_adapter *padapter, u8 *pframe, u32 *pLength)
+{
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	u16					*fctrl;
+	u32					rate_len, pktlen;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+	u8	bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, bc_addr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(cur_network), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, 0/*pmlmeext->mgnt_seq*/);
+	//pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_BEACON);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pktlen = sizeof (struct rtw_ieee80211_hdr_3addr);
+
+	//timestamp will be inserted by hardware
+	pframe += 8;
+	pktlen += 8;
+
+	// beacon interval: 2 bytes
+	_rtw_memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->IEs)), 2);
+
+	pframe += 2;
+	pktlen += 2;
+
+	// capability info: 2 bytes
+	_rtw_memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->IEs)), 2);
+
+	pframe += 2;
+	pktlen += 2;
+
+	if( (pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
+	{
+		//DBG_871X("ie len=%d\n", cur_network->IELength);
+		pktlen += cur_network->IELength - sizeof(NDIS_802_11_FIXED_IEs);
+		_rtw_memcpy(pframe, cur_network->IEs+sizeof(NDIS_802_11_FIXED_IEs), pktlen);
+
+		goto _ConstructBeacon;
+	}
+
+	//below for ad-hoc mode
+
+	// SSID
+	pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &pktlen);
+
+	// supported rates...
+	rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
+	pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, ((rate_len > 8)? 8: rate_len), cur_network->SupportedRates, &pktlen);
+
+	// DS parameter set
+	pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &pktlen);
+
+	if( (pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE)
+	{
+		u32 ATIMWindow;
+		// IBSS Parameter Set...
+		//ATIMWindow = cur->Configuration.ATIMWindow;
+		ATIMWindow = 0;
+		pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pktlen);
+	}
+
+
+	//todo: ERP IE
+
+
+	// EXTERNDED SUPPORTED RATE
+	if (rate_len > 8)
+	{
+		pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pktlen);
+	}
+
+
+	//todo:HT for adhoc
+
+_ConstructBeacon:
+
+	if ((pktlen + TXDESC_SIZE) > 512)
+	{
+		DBG_871X("beacon frame too large\n");
+		return;
+	}
+
+	*pLength = pktlen;
+
+	//DBG_871X("%s bcn_sz=%d\n", __FUNCTION__, pktlen);
+
+}
+
+void ConstructPSPoll(_adapter *padapter, u8 *pframe, u32 *pLength)
+{
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	u16					*fctrl;
+	u32					pktlen;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	// Frame control.
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+	SetPwrMgt(fctrl);
+	SetFrameSubType(pframe, WIFI_PSPOLL);
+
+	// AID.
+	SetDuration(pframe, (pmlmeinfo->aid | 0xc000));
+
+	// BSSID.
+	_rtw_memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	// TA.
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+
+	*pLength = 16;
+}
+
+void ConstructNullFunctionData(_adapter *padapter, u8 *pframe, u32 *pLength, u8 *StaAddr, BOOLEAN bForcePowerSave)
+{
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	u16					*fctrl;
+	u32					pktlen;
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	struct wlan_network	*cur_network = &pmlmepriv->cur_network;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	//DBG_871X("%s:%d\n", __FUNCTION__, bForcePowerSave);
+
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+	if (bForcePowerSave)
+	{
+		SetPwrMgt(fctrl);
+	}
+
+	switch(cur_network->network.InfrastructureMode)
+	{
+		case Ndis802_11Infrastructure:
+			SetToDs(fctrl);
+			_rtw_memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr3, StaAddr, ETH_ALEN);
+			break;
+		case Ndis802_11APMode:
+			SetFrDs(fctrl);
+			_rtw_memcpy(pwlanhdr->addr1, StaAddr, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr2, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr3, myid(&(padapter->eeprompriv)), ETH_ALEN);
+			break;
+		case Ndis802_11IBSS:
+		default:
+			_rtw_memcpy(pwlanhdr->addr1, StaAddr, ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+			_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+			break;
+	}
+
+	SetSeqNum(pwlanhdr, 0);
+
+	SetFrameSubType(pframe, WIFI_DATA_NULL);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	*pLength = pktlen;
+}
+
+void ConstructProbeRsp(_adapter *padapter, u8 *pframe, u32 *pLength, u8 *StaAddr, BOOLEAN bHideSSID)
+{
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	u16					*fctrl;
+	u8					*mac, *bssid;
+	u32					pktlen;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	mac = myid(&(padapter->eeprompriv));
+	bssid = cur_network->MacAddress;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+	_rtw_memcpy(pwlanhdr->addr1, StaAddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, bssid, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, 0);
+	SetFrameSubType(fctrl, WIFI_PROBERSP);
+
+	pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+	pframe += pktlen;
+
+	if(cur_network->IELength>MAX_IE_SZ)
+		return;
+
+	_rtw_memcpy(pframe, cur_network->IEs, cur_network->IELength);
+	pframe += cur_network->IELength;
+	pktlen += cur_network->IELength;
+
+	*pLength = pktlen;
+}
+
+//
+// Description: In normal chip, we should send some packet to Hw which will be used by Fw
+//			in FW LPS mode. The function is to fill the Tx descriptor of this packets, then
+//			Fw can tell Hw to send these packet derectly.
+// Added by tynli. 2009.10.15.
+//
+static VOID
+FillFakeTxDescriptor92C(
+	IN PADAPTER		Adapter,
+	IN u8*			pDesc,
+	IN u32			BufferLen,
+	IN BOOLEAN		IsPsPoll
+)
+{
+	struct tx_desc	*ptxdesc = (struct tx_desc *)pDesc;
+
+	// Clear all status
+	_rtw_memset(pDesc, 0, 32);
+
+	//offset 0
+	ptxdesc->txdw0 |= cpu_to_le32( OWN | FSG | LSG); //own, bFirstSeg, bLastSeg;
+
+	ptxdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE+OFFSET_SZ)<<OFFSET_SHT)&0x00ff0000); //32 bytes for TX Desc
+
+	ptxdesc->txdw0 |= cpu_to_le32(BufferLen&0x0000ffff); // Buffer size + command header
+
+	//offset 4
+	ptxdesc->txdw1 |= cpu_to_le32((QSLT_MGNT<<QSEL_SHT)&0x00001f00); // Fixed queue of Mgnt queue
+
+	//Set NAVUSEHDR to prevent Ps-poll AId filed to be changed to error vlaue by Hw.
+	if(IsPsPoll)
+	{
+		ptxdesc->txdw1 |= cpu_to_le32(NAVUSEHDR);
+	}
+	else
+	{
+		ptxdesc->txdw4 |= cpu_to_le32(BIT(7)); // Hw set sequence number
+		ptxdesc->txdw3 |= cpu_to_le32((8 <<28)); //set bit3 to 1. Suugested by TimChen. 2009.12.29.
+	}
+
+	//offset 16
+	ptxdesc->txdw4 |= cpu_to_le32(BIT(8));//driver uses rate
+
+#ifdef CONFIG_USB_HCI
+	// USB interface drop packet if the checksum of descriptor isn't correct.
+	// Using this checksum can let hardware recovery from packet bulk out error (e.g. Cancel URC, Bulk out error.).
+	rtl8192cu_cal_txdesc_chksum(ptxdesc);
+#endif
+
+	//RT_PRINT_DATA(COMP_CMD, DBG_TRACE, "TxFillCmdDesc8192C(): H2C Tx Cmd Content ----->\n", pDesc, TX_DESC_SIZE);
+}
+
+// To check if reserved page content is destroyed by beacon beacuse beacon is too large.
+// 2010.06.23. Added by tynli.
+VOID
+CheckFwRsvdPageContent(
+	IN	PADAPTER		Adapter
+)
+{
+	HAL_DATA_TYPE*	pHalData = GET_HAL_DATA(Adapter);
+	u32	MaxBcnPageNum;
+
+	if(pHalData->FwRsvdPageStartOffset != 0)
+	{
+		/*MaxBcnPageNum = PageNum_128(pMgntInfo->MaxBeaconSize);
+		RT_ASSERT((MaxBcnPageNum <= pHalData->FwRsvdPageStartOffset),
+			("CheckFwRsvdPageContent(): The reserved page content has been"\
+			"destroyed by beacon!!! MaxBcnPageNum(%d) FwRsvdPageStartOffset(%d)\n!",
+			MaxBcnPageNum, pHalData->FwRsvdPageStartOffset));*/
+	}
+}
+
+//
+// Description: Fill the reserved packets that FW will use to RSVD page.
+//			Now we just send 4 types packet to rsvd page.
+//			(1)Beacon, (2)Ps-poll, (3)Null data, (4)ProbeRsp.
+//	Input:
+//	    bDLFinished - FALSE: At the first time we will send all the packets as a large packet to Hw,
+//				 		so we need to set the packet length to total lengh.
+//			      TRUE: At the second time, we should send the first packet (default:beacon)
+//						to Hw again and set the lengh in descriptor to the real beacon lengh.
+// 2009.10.15 by tynli.
+static void SetFwRsvdPagePkt(PADAPTER Adapter, BOOLEAN bDLFinished)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct xmit_frame	*pmgntframe;
+	struct pkt_attrib	*pattrib;
+	struct xmit_priv	*pxmitpriv = &(Adapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(Adapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u32	BeaconLength, ProbeRspLength, PSPollLength, NullFunctionDataLength;
+	u8	*ReservedPagePacket;
+	u8	PageNum=0, U1bTmp, TxDescLen=0, TxDescOffset=0;
+	u16	BufIndex=0;
+	u32	TotalPacketLen;
+	RSVDPAGE_LOC	RsvdPageLoc;
+	BOOLEAN	bDLOK = _FALSE;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	ReservedPagePacket = (u8*)rtw_malloc(1000);
+	if(ReservedPagePacket == NULL){
+		DBG_871X("%s(): alloc ReservedPagePacket fail !!!\n", __FUNCTION__);
+		return;
+	}
+
+	_rtw_memset(ReservedPagePacket, 0, 1000);
+
+	TxDescLen = 32;//TX_DESC_SIZE;
+
+#ifdef CONFIG_USB_HCI
+	BufIndex = TXDESC_OFFSET;
+	TxDescOffset = TxDescLen+8; //Shift index for 8 bytes because the dummy bytes in the first descipstor.
+#else
+	BufIndex = 0;
+	TxDescOffset = 0;
+#endif
+
+	//(1) beacon
+	ConstructBeacon(Adapter,&ReservedPagePacket[BufIndex],&BeaconLength);
+
+	//DBG_8192C("SetFwRsvdPagePkt(): HW_VAR_SET_TX_CMD: BCN\n", &ReservedPagePacket[BufIndex], (BeaconLength+BufIndex));
+
+//--------------------------------------------------------------------
+
+	// When we count the first page size, we need to reserve description size for the RSVD
+	// packet, it will be filled in front of the packet in TXPKTBUF.
+	U1bTmp = (u8)PageNum_128(BeaconLength+TxDescLen);
+	PageNum += U1bTmp;
+	// To reserved 2 pages for beacon buffer. 2010.06.24.
+	if(PageNum == 1)
+		PageNum+=1;
+	pHalData->FwRsvdPageStartOffset = PageNum;
+
+	BufIndex = (PageNum*128) + TxDescOffset;
+
+	//(2) ps-poll
+	ConstructPSPoll(Adapter, &ReservedPagePacket[BufIndex],&PSPollLength);
+
+	FillFakeTxDescriptor92C(Adapter, &ReservedPagePacket[BufIndex-TxDescLen], PSPollLength, _TRUE);
+
+	//DBG_8192C("SetFwRsvdPagePkt(): HW_VAR_SET_TX_CMD: PS-POLL\n", &ReservedPagePacket[BufIndex-TxDescLen], (PSPollLength+TxDescLen));
+
+	RsvdPageLoc.LocPsPoll = PageNum;
+
+//------------------------------------------------------------------
+
+	U1bTmp = (u8)PageNum_128(PSPollLength+TxDescLen);
+	PageNum += U1bTmp;
+
+	BufIndex = (PageNum*128) + TxDescOffset;
+
+	//(3) null data
+	ConstructNullFunctionData(
+		Adapter,
+		&ReservedPagePacket[BufIndex],
+		&NullFunctionDataLength,
+		get_my_bssid(&(pmlmeinfo->network)),
+		_FALSE);
+
+	FillFakeTxDescriptor92C(Adapter, &ReservedPagePacket[BufIndex-TxDescLen], NullFunctionDataLength, _FALSE);
+
+	RsvdPageLoc.LocNullData = PageNum;
+
+	//DBG_8192C("SetFwRsvdPagePkt(): HW_VAR_SET_TX_CMD: NULL DATA \n", &ReservedPagePacket[BufIndex-TxDescLen], (NullFunctionDataLength+TxDescLen));
+//------------------------------------------------------------------
+
+	U1bTmp = (u8)PageNum_128(NullFunctionDataLength+TxDescLen);
+	PageNum += U1bTmp;
+
+	BufIndex = (PageNum*128) + TxDescOffset;
+
+	//(4) probe response
+	ConstructProbeRsp(
+		Adapter,
+		&ReservedPagePacket[BufIndex],
+		&ProbeRspLength,
+		get_my_bssid(&(pmlmeinfo->network)),
+		_FALSE);
+
+	FillFakeTxDescriptor92C(Adapter, &ReservedPagePacket[BufIndex-TxDescLen], ProbeRspLength, _FALSE);
+
+	RsvdPageLoc.LocProbeRsp = PageNum;
+
+	//DBG_8192C("SetFwRsvdPagePkt(): HW_VAR_SET_TX_CMD: PROBE RSP \n", &ReservedPagePacket[BufIndex-TxDescLen], (ProbeRspLength-TxDescLen));
+
+//------------------------------------------------------------------
+
+	U1bTmp = (u8)PageNum_128(ProbeRspLength+TxDescLen);
+
+	PageNum += U1bTmp;
+
+	TotalPacketLen = (PageNum*128);
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(Adapter, pattrib);
+	pattrib->qsel = 0x10;
+	pattrib->pktlen = pattrib->last_txcmdsz = TotalPacketLen - TxDescLen;
+	_rtw_memcpy(pmgntframe->buf_addr, ReservedPagePacket, TotalPacketLen);
+
+	rtw_hal_mgnt_xmit(Adapter, pmgntframe);
+
+	bDLOK = _TRUE;
+
+	if(bDLOK)
+	{
+		DBG_871X("Set RSVD page location to Fw.\n");
+		rtl8192c_FillH2CCmd(Adapter, RSVD_PAGE_EID, sizeof(RsvdPageLoc), (u8 *)&RsvdPageLoc);
+	}
+
+	rtw_mfree(ReservedPagePacket,1000);
+
+}
+
+void rtl8192c_set_FwJoinBssReport_cmd(_adapter* padapter, u8 mstatus)
+{
+	JOINBSSRPT_PARM	JoinBssRptParm;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+_func_enter_;
+
+	DBG_871X("%s mstatus(%x)\n", __FUNCTION__,mstatus);
+
+	if(mstatus == 1)
+	{
+		BOOLEAN bRecover = _FALSE;
+
+		// We should set AID, correct TSF, HW seq enable before set JoinBssReport to Fw in 88/92C.
+		// Suggested by filen. Added by tynli.
+		rtw_write16(padapter, REG_BCN_PSR_RPT, (0xC000|pmlmeinfo->aid));
+		// Do not set TSF again here or vWiFi beacon DMA INT will not work.
+		//correct_TSF(padapter, pmlmeext);
+		// Hw sequende enable by dedault. 2010.06.23. by tynli.
+		//rtw_write16(padapter, REG_NQOS_SEQ, ((pmlmeext->mgnt_seq+100)&0xFFF));
+		//rtw_write8(padapter, REG_HWSEQ_CTRL, 0xFF);
+
+		//set REG_CR bit 8
+		//U1bTmp = rtw_read8(padapter, REG_CR+1);
+		rtw_write8(padapter,  REG_CR+1, 0x03);
+
+		// Disable Hw protection for a time which revserd for Hw sending beacon.
+		// Fix download reserved page packet fail that access collision with the protection time.
+		// 2010.05.11. Added by tynli.
+		//SetBcnCtrlReg(padapter, 0, BIT3);
+		//SetBcnCtrlReg(padapter, BIT4, 0);
+		rtw_write8(padapter, REG_BCN_CTRL, rtw_read8(padapter, REG_BCN_CTRL)&(~BIT(3)));
+		rtw_write8(padapter, REG_BCN_CTRL, rtw_read8(padapter, REG_BCN_CTRL)|BIT(4));
+
+		// Set FWHW_TXQ_CTRL 0x422[6]=0 to tell Hw the packet is not a real beacon frame.
+		if(pHalData->RegFwHwTxQCtrl&BIT6)
+			bRecover = _TRUE;
+
+		// To tell Hw the packet is not a real beacon frame.
+		//U1bTmp = rtw_read8(padapter, REG_FWHW_TXQ_CTRL+2);
+		rtw_write8(padapter, REG_FWHW_TXQ_CTRL+2, (pHalData->RegFwHwTxQCtrl&(~BIT6)));
+		pHalData->RegFwHwTxQCtrl &= (~BIT6);
+		SetFwRsvdPagePkt(padapter, 0);
+
+		// 2010.05.11. Added by tynli.
+		//SetBcnCtrlReg(padapter, BIT3, 0);
+		//SetBcnCtrlReg(padapter, 0, BIT4);
+		rtw_write8(padapter, REG_BCN_CTRL, rtw_read8(padapter, REG_BCN_CTRL)|BIT(3));
+		rtw_write8(padapter, REG_BCN_CTRL, rtw_read8(padapter, REG_BCN_CTRL)&(~BIT(4)));
+
+		// To make sure that if there exists an adapter which would like to send beacon.
+		// If exists, the origianl value of 0x422[6] will be 1, we should check this to
+		// prevent from setting 0x422[6] to 0 after download reserved page, or it will cause
+		// the beacon cannot be sent by HW.
+		// 2010.06.23. Added by tynli.
+		if(bRecover)
+		{
+			rtw_write8(padapter, REG_FWHW_TXQ_CTRL+2, (pHalData->RegFwHwTxQCtrl|BIT6));
+			pHalData->RegFwHwTxQCtrl |= BIT6;
+		}
+
+		// Clear CR[8] or beacon packet will not be send to TxBuf anymore.
+		rtw_write8(padapter, REG_CR+1, 0x02);
+	}
+
+	JoinBssRptParm.OpMode = mstatus;
+
+	rtl8192c_FillH2CCmd(padapter, JOINBSS_RPT_EID, sizeof(JoinBssRptParm), (u8 *)&JoinBssRptParm);
+
+_func_exit_;
+}
+
+#ifdef CONFIG_P2P_PS
+void rtl8192c_set_p2p_ctw_period_cmd(_adapter* padapter, u8 ctwindow)
+{
+	struct P2P_PS_CTWPeriod_t p2p_ps_ctw;
+
+	p2p_ps_ctw.CTWPeriod = ctwindow;
+
+	rtl8192c_FillH2CCmd(padapter, P2P_PS_CTW_CMD_EID, 1, (u8 *)(&p2p_ps_ctw));
+
+}
+
+void rtl8192c_set_p2p_ps_offload_cmd(_adapter* padapter, u8 p2p_ps_state)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct pwrctrl_priv		*pwrpriv = &padapter->pwrctrlpriv;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+	struct P2P_PS_Offload_t	*p2p_ps_offload = &pHalData->p2p_ps_offload;
+	u8	i;
+	u16	ctwindow;
+	u32	start_time, tsf_low;
+
+_func_enter_;
+
+	switch(p2p_ps_state)
+	{
+		case P2P_PS_DISABLE:
+			DBG_8192C("P2P_PS_DISABLE \n");
+			_rtw_memset(p2p_ps_offload, 0 ,1);
+			break;
+		case P2P_PS_ENABLE:
+			DBG_8192C("P2P_PS_ENABLE \n");
+			// update CTWindow value.
+			if( pwdinfo->ctwindow > 0 )
+			{
+				p2p_ps_offload->CTWindow_En = 1;
+				ctwindow = pwdinfo->ctwindow;
+				if(IS_HARDWARE_TYPE_8723A(padapter))
+				{
+					//rtw_write16(padapter, REG_ATIMWND, ctwindow);
+				}
+				else
+				{
+					rtl8192c_set_p2p_ctw_period_cmd(padapter, ctwindow);
+				}
+			}
+
+			// hw only support 2 set of NoA
+			for( i=0 ; i<pwdinfo->noa_num ; i++)
+			{
+				// To control the register setting for which NOA
+				rtw_write8(padapter, 0x5CF, (i << 4));
+				if(i == 0)
+					p2p_ps_offload->NoA0_En = 1;
+				else
+					p2p_ps_offload->NoA1_En = 1;
+
+				// config P2P NoA Descriptor Register
+				rtw_write32(padapter, 0x5E0, pwdinfo->noa_duration[i]);
+
+				rtw_write32(padapter, 0x5E4, pwdinfo->noa_interval[i]);
+
+				//Get Current TSF value
+				tsf_low = rtw_read32(padapter, REG_TSFTR);
+
+				start_time = pwdinfo->noa_start_time[i];
+				if(pwdinfo->noa_count[i] != 1)
+				{
+					while( start_time <= (tsf_low+(50*1024) ) )
+					{
+						start_time += pwdinfo->noa_interval[i];
+						if(pwdinfo->noa_count[i] != 255)
+							pwdinfo->noa_count[i]--;
+					}
+				}
+				//DBG_8192C("%s(): start_time = %x\n",__FUNCTION__,start_time);
+				rtw_write32(padapter, 0x5E8, start_time);
+
+				rtw_write8(padapter, 0x5EC, pwdinfo->noa_count[i]);
+			}
+
+			if( (pwdinfo->opp_ps == 1) || (pwdinfo->noa_num > 0) )
+			{
+				// rst p2p circuit
+				rtw_write8(padapter, REG_DUAL_TSF_RST, BIT(4));
+
+				p2p_ps_offload->Offload_En = 1;
+
+				if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+				{
+					p2p_ps_offload->role= 1;
+					p2p_ps_offload->AllStaSleep = 0;
+				}
+				else
+				{
+					p2p_ps_offload->role= 0;
+				}
+
+				p2p_ps_offload->discovery = 0;
+			}
+			break;
+		case P2P_PS_SCAN:
+			DBG_8192C("P2P_PS_SCAN \n");
+			p2p_ps_offload->discovery = 1;
+			break;
+		case P2P_PS_SCAN_DONE:
+			DBG_8192C("P2P_PS_SCAN_DONE \n");
+			p2p_ps_offload->discovery = 0;
+			pwdinfo->p2p_ps_state = P2P_PS_ENABLE;
+			break;
+		default:
+			break;
+	}
+
+	rtl8192c_FillH2CCmd(padapter, P2P_PS_OFFLOAD_EID, 1, (u8 *)p2p_ps_offload);
+
+_func_exit_;
+
+}
+#endif // CONFIG_P2P_PS
+
+#ifdef CONFIG_IOL
+#include <rtw_iol.h>
+int rtl8192c_IOL_exec_cmds_sync(ADAPTER *adapter, struct xmit_frame *xmit_frame, u32 max_wating_ms)
+{
+	IO_OFFLOAD_LOC	IoOffloadLoc;
+	u32 start_time = rtw_get_current_time();
+	u32 passing_time_ms;
+	u8 polling_ret;
+	int ret = _FAIL;
+
+	if (rtw_IOL_append_END_cmd(xmit_frame) != _SUCCESS)
+		goto exit;
+
+	dump_mgntframe_and_wait(adapter, xmit_frame, max_wating_ms);
+
+	IoOffloadLoc.LocCmd = 0;
+	if(_SUCCESS != rtl8192c_FillH2CCmd(adapter, H2C_92C_IO_OFFLOAD, sizeof(IO_OFFLOAD_LOC), (u8 *)&IoOffloadLoc))
+		goto exit;
+
+	//polling if the IO offloading is done
+	while( (passing_time_ms=rtw_get_passing_time_ms(start_time)) <= max_wating_ms) {
+		#if 0 //C2H
+		if(0xff == rtw_read8(adapter, REG_C2HEVT_CLEAR))
+			break;
+		#else// 0x1c3
+		if(0x00 != (polling_ret=rtw_read8(adapter, 0x1c3)))
+			break;
+		#endif
+		rtw_msleep_os(5);
+	}
+	#if 0 //debug
+	DBG_871X("IOL %s, polling_ret:0x%02x, 0x1c0=0x%08x, 0x1c4=0x%08x, 0x1cc=0x%08x, 0x1e8=0x%08x, 0x130=0x%08x, 0x134=0x%08x\n"
+			, polling_ret==0xff?"success":"error"
+			, polling_ret
+			, rtw_read32(adapter, 0x1c0)
+			, rtw_read32(adapter, 0x1c4)
+			, rtw_read32(adapter, 0x1cc)
+			, rtw_read32(adapter, 0x1e8)
+			, rtw_read32(adapter, 0x130)
+			, rtw_read32(adapter, 0x134)
+	);
+	rtw_write32(adapter, 0x1c0, 0x0);
+	#endif
+
+	if(polling_ret == 0xff)
+		ret =_SUCCESS;
+	else {
+		DBG_871X("IOL %s, polling_ret:0x%02x\n"
+			//", 0x1c0=0x%08x, 0x1c4=0x%08x, 0x1cc=0x%08x, 0x1e8=0x%08x, 0x130=0x%08x, 0x134=0x%08x\n"
+			, polling_ret==0xff?"success":"error"
+			, polling_ret
+			//, rtw_read32(adapter, 0x1c0)
+			//, rtw_read32(adapter, 0x1c4)
+			//, rtw_read32(adapter, 0x1cc)
+			//, rtw_read32(adapter, 0x1e8)
+			//, rtw_read32(adapter, 0x130)
+			//, rtw_read32(adapter, 0x134)
+		);
+		#if 0 //debug
+		rtw_write16(adapter, 0x1c4, 0x0000);
+		rtw_msleep_os(10);
+		DBG_871X("after reset, 0x1c4=0x%08x\n", rtw_read32(adapter, 0x1c4));
+		#endif
+
+	}
+
+	{
+		#if 0 //C2H
+		u32 c2h_evt;
+		int i;
+		c2h_evt = rtw_read32(adapter, REG_C2HEVT_MSG_NORMAL);
+		DBG_871X("%s io-offloading complete, in %ums: 0x%08x\n", __FUNCTION__, passing_time_ms, c2h_evt);
+		rtw_write8(adapter, REG_C2HEVT_CLEAR, 0x0);
+		#else// 0x1c3
+		DBG_871X("IOL %s complete in %ums\n", __FUNCTION__, passing_time_ms);
+		rtw_write8(adapter, 0x1c3, 0x0);
+		#endif
+	}
+
+exit:
+	return ret;
+
+}
+#endif //CONFIG_IOL
+
+
+#ifdef CONFIG_BEACON_DISABLE_OFFLOAD
+/*
+ rtl8192c_dis_beacon_fun_cmd()
+	This function shall only be called by PORT1.
+	PORT0's beacon function can't be disabled, because it's used by RA function in FW/HW.
+
+	// Still has the REG_BCN_CTRL_1 modified by unknowned party issue in case of Primary Interface + PORT1 combination.
+*/
+u8 rtl8192c_dis_beacon_fun_cmd(_adapter* padapter)
+{
+	u8	buf[2];
+	u8	res=_SUCCESS;
+
+_func_enter_;
+
+	_rtw_memset(buf, 0, sizeof(buf));
+
+	if (padapter->iface_type == IFACE_PORT0) {
+		//buf[0] = 0x1;
+		DBG_871X("%s(): ERROR! padapter->iface_type = %d\n", __FUNCTION__, padapter->iface_type);
+		return _FAIL;
+	} else
+		buf[1] = 0x1;
+
+	rtl8192c_FillH2CCmd(padapter, H2C_92C_DISABLE_BCN_FUNC, 2, buf);
+
+_func_exit_;
+
+	return res;
+
+}
+#endif  // CONFIG_BEACON_DISABLE_OFFLOAD
+
+
+#ifdef CONFIG_TSF_RESET_OFFLOAD
+/*
+	ask FW to Reset sync register at Beacon early interrupt
+*/
+u8 rtl8192c_reset_tsf(_adapter *padapter, u8 reset_port )
+{
+	u8	buf[2];
+	u8	res=_SUCCESS;
+
+_func_enter_;
+	if (IFACE_PORT0==reset_port) {
+		buf[0] = 0x1; buf[1] = 0;
+
+	} else{
+		buf[0] = 0x0; buf[1] = 0x1;
+	}
+	rtl8192c_FillH2CCmd(padapter, H2C_92C_RESET_TSF, 2, buf);
+_func_exit_;
+
+	return res;
+}
+
+int reset_tsf(PADAPTER Adapter, u8 reset_port )
+{
+	u8 reset_cnt_before = 0, reset_cnt_after = 0, loop_cnt = 0;
+	u32 reg_reset_tsf_cnt = (IFACE_PORT0==reset_port) ?
+				REG_FW_RESET_TSF_CNT_0:REG_FW_RESET_TSF_CNT_1;
+
+	rtw_scan_abort(Adapter->pbuddy_adapter);	/*	site survey will cause reset_tsf fail	*/
+	reset_cnt_after = reset_cnt_before = rtw_read8(Adapter,reg_reset_tsf_cnt);
+	rtl8192c_reset_tsf(Adapter, reset_port);
+
+	while ((reset_cnt_after == reset_cnt_before ) && (loop_cnt < 10)) {
+		rtw_msleep_os(100);
+		loop_cnt++;
+		reset_cnt_after = rtw_read8(Adapter, reg_reset_tsf_cnt);
+	}
+
+	return(loop_cnt >= 10) ? _FAIL : _TRUE;
+}
+
+
+#endif	// CONFIG_TSF_RESET_OFFLOAD
+
+#ifdef CONFIG_WOWLAN
+
+void rtl8192c_set_wowlan_cmd(_adapter* padapter)
+{
+	u8	res=_SUCCESS;
+	SETWOWLAN_PARM pwowlan_parm;
+	struct pwrctrl_priv *pwrpriv=&padapter->pwrctrlpriv;
+
+_func_enter_;
+
+	pwowlan_parm.mode =0;
+	pwowlan_parm.gpio_index=0;
+	pwowlan_parm.gpio_duration=0;
+	pwowlan_parm.second_mode =0;
+	pwowlan_parm.reserve=0;
+
+	if(pwrpriv->wowlan_mode ==_TRUE){
+		pwowlan_parm.mode |=FW_WOWLAN_FUN_EN;
+		//printk("\n %s 1.pwowlan_parm.mode=0x%x \n",__FUNCTION__,pwowlan_parm.mode );
+		if(pwrpriv->wowlan_pattern ==_TRUE){
+			pwowlan_parm.mode |= FW_WOWLAN_PATTERN_MATCH;
+		//printk("\n %s 2.pwowlan_parm.mode=0x%x \n",__FUNCTION__,pwowlan_parm.mode );
+		}
+		if(pwrpriv->wowlan_magic ==_TRUE){
+			pwowlan_parm.mode |=FW_WOWLAN_MAGIC_PKT;
+		//printk("\n %s 3.pwowlan_parm.mode=0x%x \n",__FUNCTION__,pwowlan_parm.mode );
+		}
+		if(pwrpriv->wowlan_unicast ==_TRUE){
+			pwowlan_parm.mode |=FW_WOWLAN_UNICAST;
+		//printk("\n %s 4.pwowlan_parm.mode=0x%x \n",__FUNCTION__,pwowlan_parm.mode );
+		}
+		//WOWLAN_GPIO_ACTIVE means GPIO high active
+		//pwowlan_parm.mode |=FW_WOWLAN_GPIO_ACTIVE;
+		pwowlan_parm.mode |=FW_WOWLAN_REKEY_WAKEUP;
+		pwowlan_parm.mode |=FW_WOWLAN_DEAUTH_WAKEUP;
+
+		rtl8192c_set_FwJoinBssReport_cmd( padapter, 1);
+
+		//GPIO3
+		pwowlan_parm.gpio_index=3;
+
+		//duration unit is 64us
+		pwowlan_parm.gpio_duration=0xff;
+		//
+		pwowlan_parm.second_mode|=FW_WOWLAN_GPIO_WAKEUP_EN;
+		//printk("\n %s 5.pwowlan_parm.mode=0x%x \n",__FUNCTION__,pwowlan_parm.mode );
+		{	u8 *ptr=(u8 *)&pwowlan_parm;
+			printk("\n %s H2C_WO_WLAN=%x %02x:%02x:%02x:%02x:%02x \n",__FUNCTION__,H2C_WO_WLAN_CMD,ptr[0],ptr[1],ptr[2],ptr[3],ptr[4] );
+		}
+		rtl8192c_FillH2CCmd(padapter, H2C_WO_WLAN_CMD, 4, (u8 *)&pwowlan_parm);
+
+		//keep alive period = 3 * 10 BCN interval
+		pwowlan_parm.mode =3;
+		pwowlan_parm.gpio_index=3;
+		rtl8192c_FillH2CCmd(padapter, KEEP_ALIVE_CONTROL_CMD, 2, (u8 *)&pwowlan_parm);
+		printk("%s after KEEP_ALIVE_CONTROL_CMD register 0x81=%x \n",__FUNCTION__,rtw_read8(padapter, 0x81));
+
+		pwowlan_parm.mode =1;
+		pwowlan_parm.gpio_index=0;
+		pwowlan_parm.gpio_duration=0;
+		rtl8192c_FillH2CCmd(padapter, DISCONNECT_DECISION_CTRL_CMD, 3, (u8 *)&pwowlan_parm);
+		printk("%s after DISCONNECT_DECISION_CTRL_CMD register 0x81=%x \n",__FUNCTION__,rtw_read8(padapter, 0x81));
+
+		//enable GPIO wakeup
+		pwowlan_parm.mode =1;
+		pwowlan_parm.gpio_index=0;
+		pwowlan_parm.gpio_duration=0;
+		rtl8192c_FillH2CCmd(padapter, REMOTE_WAKE_CTRL_CMD, 3, (u8 *)&pwowlan_parm);
+	}
+	else
+		rtl8192c_FillH2CCmd(padapter, H2C_WO_WLAN_CMD, 3, (u8 *)&pwowlan_parm);
+
+
+_func_exit_;
+
+	return ;
+
+}
+
+#endif  //CONFIG_WOWLAN
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_dm.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_dm.c
new file mode 100644
index 000000000000..98d6f1439971
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_dm.c
@@ -0,0 +1,5055 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+//============================================================
+// Description:
+//
+// This file is for 92CE/92CU dynamic mechanism only
+//
+//
+//============================================================
+
+//============================================================
+// include files
+//============================================================
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_byteorder.h>
+
+#include <rtl8192c_hal.h>
+#include "../dm.h"
+#ifdef CONFIG_INTEL_PROXIM
+#include "../proxim/intel_proxim.h"
+#endif
+//============================================================
+// Global var
+//============================================================
+static u32 EDCAParam[maxAP][3] =
+{          // UL			DL
+	{0x5ea322, 0x00a630, 0x00a44f}, //atheros AP
+	{0x5ea32b, 0x5ea42b, 0x5e4322}, //broadcom AP
+	{0x3ea430, 0x00a630, 0x3ea44f}, //cisco AP
+	{0x5ea44f, 0x00a44f, 0x5ea42b}, //marvell AP
+	{0x5ea422, 0x00a44f, 0x00a44f}, //ralink AP
+	//{0x5ea44f, 0x5ea44f, 0x5ea44f}, //realtek AP
+	{0xa44f, 0x5ea44f, 0x5e431c}, //realtek AP
+	{0x5ea42b, 0xa630, 0x5e431c}, //airgocap AP
+	{0x5ea42b, 0x5ea42b, 0x5ea42b}, //unknown AP
+//	{0x5e4322, 0x00a44f, 0x5ea44f}, //unknown AP
+};
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	dm_DIGInit()
+ *
+ * Overview:	Set DIG scheme init value.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *
+ *---------------------------------------------------------------------------*/
+static void	dm_DIGInit(
+	IN	PADAPTER	pAdapter
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+
+
+	pDigTable->Dig_Enable_Flag = _TRUE;
+	pDigTable->Dig_Ext_Port_Stage = DIG_EXT_PORT_STAGE_MAX;
+
+	pDigTable->CurIGValue = 0x20;
+	pDigTable->PreIGValue = 0x0;
+
+	pDigTable->CurSTAConnectState = pDigTable->PreSTAConnectState = DIG_STA_DISCONNECT;
+	pDigTable->CurMultiSTAConnectState = DIG_MultiSTA_DISCONNECT;
+
+	pDigTable->RssiLowThresh 	= DM_DIG_THRESH_LOW;
+	pDigTable->RssiHighThresh 	= DM_DIG_THRESH_HIGH;
+
+	pDigTable->FALowThresh	= DM_FALSEALARM_THRESH_LOW;
+	pDigTable->FAHighThresh	= DM_FALSEALARM_THRESH_HIGH;
+
+
+	pDigTable->rx_gain_range_max = DM_DIG_MAX;
+	pDigTable->rx_gain_range_min = DM_DIG_MIN;
+	pDigTable->rx_gain_range_min_nolink = 0;
+
+	pDigTable->BackoffVal = DM_DIG_BACKOFF_DEFAULT;
+	pDigTable->BackoffVal_range_max = DM_DIG_BACKOFF_MAX;
+	pDigTable->BackoffVal_range_min = DM_DIG_BACKOFF_MIN;
+
+	pDigTable->PreCCKPDState = CCK_PD_STAGE_MAX;
+	pDigTable->CurCCKPDState = CCK_PD_STAGE_LowRssi;
+
+	pDigTable->ForbiddenIGI = DM_DIG_MIN;
+	pDigTable->LargeFAHit = 0;
+	pDigTable->Recover_cnt = 0;
+	pdmpriv->DIG_Dynamic_MIN  = 0x25; //for FUNAI_TV
+}
+
+
+static u8 dm_initial_gain_MinPWDB(
+	IN	PADAPTER	pAdapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T			*pDigTable = &pdmpriv->DM_DigTable;
+	int	Rssi_val_min = 0;
+
+	if((pDigTable->CurMultiSTAConnectState == DIG_MultiSTA_CONNECT) &&
+		(pDigTable->CurSTAConnectState == DIG_STA_CONNECT) )
+	{
+		if(pdmpriv->EntryMinUndecoratedSmoothedPWDB != 0)
+#ifdef CONFIG_CONCURRENT_MODE
+			Rssi_val_min  =  (pdmpriv->UndecoratedSmoothedPWDB+pdmpriv->EntryMinUndecoratedSmoothedPWDB)/2;
+#else
+			Rssi_val_min  =  (pdmpriv->EntryMinUndecoratedSmoothedPWDB > pdmpriv->UndecoratedSmoothedPWDB)?
+					pdmpriv->UndecoratedSmoothedPWDB:pdmpriv->EntryMinUndecoratedSmoothedPWDB;
+#endif //CONFIG_CONCURRENT_MODE
+		else
+			Rssi_val_min = pdmpriv->UndecoratedSmoothedPWDB;
+	}
+	else if(pDigTable->CurSTAConnectState == DIG_STA_CONNECT ||
+			pDigTable->CurSTAConnectState == DIG_STA_BEFORE_CONNECT)
+		Rssi_val_min = pdmpriv->UndecoratedSmoothedPWDB;
+	else if(pDigTable->CurMultiSTAConnectState == DIG_MultiSTA_CONNECT)
+		Rssi_val_min = pdmpriv->EntryMinUndecoratedSmoothedPWDB;
+
+	//printk("%s CurMultiSTAConnectState(0x%02x) UndecoratedSmoothedPWDB(%d),EntryMinUndecoratedSmoothedPWDB(%d)\n"
+	//,__FUNCTION__,pDigTable->CurSTAConnectState,
+	//pdmpriv->UndecoratedSmoothedPWDB,pdmpriv->EntryMinUndecoratedSmoothedPWDB);
+
+	return (u8)Rssi_val_min;
+}
+
+
+static VOID
+dm_FalseAlarmCounterStatistics(
+	IN	PADAPTER	Adapter
+	)
+{
+	u32 ret_value;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	PFALSE_ALARM_STATISTICS FalseAlmCnt = &(pdmpriv->FalseAlmCnt);
+#ifdef CONFIG_CONCURRENT_MODE
+	PADAPTER pbuddy_adapter = Adapter->pbuddy_adapter;
+#endif //CONFIG_CONCURRENT_MODE
+
+	ret_value = PHY_QueryBBReg(Adapter, rOFDM_PHYCounter1, bMaskDWord);
+       FalseAlmCnt->Cnt_Parity_Fail = ((ret_value&0xffff0000)>>16);
+
+       ret_value = PHY_QueryBBReg(Adapter, rOFDM_PHYCounter2, bMaskDWord);
+	FalseAlmCnt->Cnt_Rate_Illegal = (ret_value&0xffff);
+	FalseAlmCnt->Cnt_Crc8_fail = ((ret_value&0xffff0000)>>16);
+	ret_value = PHY_QueryBBReg(Adapter, rOFDM_PHYCounter3, bMaskDWord);
+	FalseAlmCnt->Cnt_Mcs_fail = (ret_value&0xffff);
+	ret_value = PHY_QueryBBReg(Adapter, rOFDM0_FrameSync, bMaskDWord);
+	FalseAlmCnt->Cnt_Fast_Fsync = (ret_value&0xffff);
+	FalseAlmCnt->Cnt_SB_Search_fail = ((ret_value&0xffff0000)>>16);
+
+	FalseAlmCnt->Cnt_Ofdm_fail = 	FalseAlmCnt->Cnt_Parity_Fail + FalseAlmCnt->Cnt_Rate_Illegal +
+								FalseAlmCnt->Cnt_Crc8_fail + FalseAlmCnt->Cnt_Mcs_fail+
+								FalseAlmCnt->Cnt_Fast_Fsync + FalseAlmCnt->Cnt_SB_Search_fail;
+
+
+	//hold cck counter
+	PHY_SetBBReg(Adapter, rCCK0_FalseAlarmReport, BIT(14), 1);
+
+	ret_value = PHY_QueryBBReg(Adapter, rCCK0_FACounterLower, bMaskByte0);
+	FalseAlmCnt->Cnt_Cck_fail = ret_value;
+
+	ret_value = PHY_QueryBBReg(Adapter, rCCK0_FACounterUpper, bMaskByte3);
+	FalseAlmCnt->Cnt_Cck_fail +=  (ret_value& 0xff)<<8;
+
+	FalseAlmCnt->Cnt_all = (	FalseAlmCnt->Cnt_Parity_Fail +
+						FalseAlmCnt->Cnt_Rate_Illegal +
+						FalseAlmCnt->Cnt_Crc8_fail +
+						FalseAlmCnt->Cnt_Mcs_fail +
+						FalseAlmCnt->Cnt_Cck_fail);
+
+	Adapter->recvpriv.FalseAlmCnt_all = FalseAlmCnt->Cnt_all;
+#ifdef CONFIG_CONCURRENT_MODE
+	if(pbuddy_adapter)
+		pbuddy_adapter->recvpriv.FalseAlmCnt_all = FalseAlmCnt->Cnt_all;
+#endif //CONFIG_CONCURRENT_MODE
+
+	//reset false alarm counter registers
+	PHY_SetBBReg(Adapter, rOFDM1_LSTF, 0x08000000, 1);
+	PHY_SetBBReg(Adapter, rOFDM1_LSTF, 0x08000000, 0);
+	//reset cck counter
+	PHY_SetBBReg(Adapter, rCCK0_FalseAlarmReport, 0x0000c000, 0);
+	//enable cck counter
+	PHY_SetBBReg(Adapter, rCCK0_FalseAlarmReport, 0x0000c000, 2);
+
+	//RT_TRACE(	COMP_DIG, DBG_LOUD, ("Cnt_Parity_Fail = %ld, Cnt_Rate_Illegal = %ld, Cnt_Crc8_fail = %ld, Cnt_Mcs_fail = %ld\n",
+	//			FalseAlmCnt->Cnt_Parity_Fail, FalseAlmCnt->Cnt_Rate_Illegal, FalseAlmCnt->Cnt_Crc8_fail, FalseAlmCnt->Cnt_Mcs_fail) );
+	//RT_TRACE(	COMP_DIG, DBG_LOUD, ("Cnt_Ofdm_fail = %ld, Cnt_Cck_fail = %ld, Cnt_all = %ld\n",
+	//			FalseAlmCnt->Cnt_Ofdm_fail, FalseAlmCnt->Cnt_Cck_fail, FalseAlmCnt->Cnt_all) );
+	//RT_TRACE(	COMP_DIG, DBG_LOUD, ("Cnt_Ofdm_fail = %ld, Cnt_Cck_fail = %ld, Cnt_all = %ld\n",
+	//			FalseAlmCnt->Cnt_Ofdm_fail, FalseAlmCnt->Cnt_Cck_fail, FalseAlmCnt->Cnt_all) );
+}
+
+
+static VOID
+DM_Write_DIG(
+	IN	PADAPTER	pAdapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(rtw_buddy_adapter_up(pAdapter))
+	{
+		PADAPTER pbuddy_adapter = pAdapter->pbuddy_adapter;
+		PHAL_DATA_TYPE	pbuddy_HalData = GET_HAL_DATA(pbuddy_adapter);
+		struct dm_priv *pbuddy_dmpriv = &pbuddy_HalData->dmpriv;
+		DIG_T	*pbuddy_DigTable = &pbuddy_dmpriv->DM_DigTable;
+
+		//sync IGValue
+		pbuddy_DigTable->PreIGValue = pDigTable->PreIGValue;
+		pbuddy_DigTable->CurIGValue = pDigTable->CurIGValue;
+	}
+#endif //CONFIG_CONCURRENT_MODE
+
+
+	//RT_TRACE(	COMP_DIG, DBG_LOUD, ("CurIGValue = 0x%lx, PreIGValue = 0x%lx, BackoffVal = %d\n",
+	//			DM_DigTable.CurIGValue, DM_DigTable.PreIGValue, DM_DigTable.BackoffVal));
+
+	if (pDigTable->Dig_Enable_Flag == _FALSE)
+	{
+		//RT_TRACE(	COMP_DIG, DBG_LOUD, ("DIG is disabled\n"));
+		pDigTable->PreIGValue = 0x17;
+		return;
+	}
+
+	if( (pDigTable->PreIGValue != pDigTable->CurIGValue) || ( pAdapter->bForceWriteInitGain ) )
+	{
+		// Set initial gain.
+		//PHY_SetBBReg(pAdapter, rOFDM0_XAAGCCore1, bMaskByte0, pDigTable->CurIGValue);
+		//PHY_SetBBReg(pAdapter, rOFDM0_XBAGCCore1, bMaskByte0, pDigTable->CurIGValue);
+		//printk("%s DIG(0x%02x)\n",__FUNCTION__,pDigTable->CurIGValue);
+
+#if defined CONFIG_WIDI_DIG_3E && defined CONFIG_INTEL_WIDI
+		if( pAdapter->mlmepriv.widi_enable == _TRUE )
+		{
+			PHY_SetBBReg(pAdapter, rOFDM0_XAAGCCore1, 0x7f, 0x3e);
+			PHY_SetBBReg(pAdapter, rOFDM0_XBAGCCore1, 0x7f, 0x3e);
+		}
+		else
+#endif //defined CONFIG_WIDI_DIG_3E && defined CONFIG_INTEL_WIDI
+		{
+			PHY_SetBBReg(pAdapter, rOFDM0_XAAGCCore1, 0x7f, pDigTable->CurIGValue);
+			PHY_SetBBReg(pAdapter, rOFDM0_XBAGCCore1, 0x7f, pDigTable->CurIGValue);
+		}
+		pDigTable->PreIGValue = pDigTable->CurIGValue;
+	}
+}
+
+
+static VOID
+dm_CtrlInitGainByFA(
+	IN	PADAPTER	pAdapter
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+	PFALSE_ALARM_STATISTICS FalseAlmCnt = &(pdmpriv->FalseAlmCnt);
+
+	u8	value_IGI = pDigTable->CurIGValue;
+
+	if(FalseAlmCnt->Cnt_all < DM_DIG_FA_TH0)
+		value_IGI --;
+	else if(FalseAlmCnt->Cnt_all < DM_DIG_FA_TH1)
+		value_IGI += 0;
+	else if(FalseAlmCnt->Cnt_all < DM_DIG_FA_TH2)
+		value_IGI ++;
+	else if(FalseAlmCnt->Cnt_all >= DM_DIG_FA_TH2)
+		value_IGI +=2;
+
+	if(value_IGI > DM_DIG_FA_UPPER)
+		value_IGI = DM_DIG_FA_UPPER;
+	if(value_IGI < DM_DIG_FA_LOWER)
+		value_IGI = DM_DIG_FA_LOWER;
+
+	if(FalseAlmCnt->Cnt_all > 10000)
+		value_IGI = DM_DIG_FA_UPPER;
+
+	pDigTable->CurIGValue = value_IGI;
+
+	DM_Write_DIG(pAdapter);
+
+}
+
+#ifdef CONFIG_SPECIAL_SETTING_FOR_FUNAI_TV
+VOID dm_CtrlInitGainByRssi( IN PADAPTER pAdapter)
+{
+
+	u32 isBT;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+	PFALSE_ALARM_STATISTICS FalseAlmCnt = &(pdmpriv->FalseAlmCnt);
+#ifdef CONFIG_DM_ADAPTIVITY
+	u8 Adap_IGI_Upper = pdmpriv->IGI_target + 30 + (u8) pdmpriv->TH_L2H_ini -(u8) pdmpriv->TH_EDCCA_HL_diff;
+#endif
+
+	 //modify DIG upper bound
+	if((pDigTable->Rssi_val_min + 20) > DM_DIG_MAX )
+		pDigTable->rx_gain_range_max = DM_DIG_MAX;
+	else
+		pDigTable->rx_gain_range_max = pDigTable->Rssi_val_min + 20;
+
+	//modify DIG lower bound
+	if((FalseAlmCnt->Cnt_all > 500)&&(pdmpriv->DIG_Dynamic_MIN < 0x25))
+		pdmpriv->DIG_Dynamic_MIN++;
+	if((FalseAlmCnt->Cnt_all < 500)&&(pdmpriv->DIG_Dynamic_MIN > DM_DIG_MIN))
+		pdmpriv->DIG_Dynamic_MIN--;
+	if((pDigTable->Rssi_val_min < 8) && (pdmpriv->DIG_Dynamic_MIN > DM_DIG_MIN))
+		pdmpriv->DIG_Dynamic_MIN--;
+
+	//modify DIG lower bound, deal with abnorally large false alarm
+	if(FalseAlmCnt->Cnt_all > 10000)
+	{
+		//RT_TRACE(COMP_DIG, DBG_LOUD, ("dm_DIG(): Abnornally false alarm case. \n"));
+		pDigTable->LargeFAHit++;
+		 if(pDigTable->ForbiddenIGI < pDigTable->CurIGValue)
+		{
+			pDigTable->ForbiddenIGI = pDigTable->CurIGValue;
+			pDigTable->LargeFAHit = 1;
+		}
+		if(pDigTable->LargeFAHit >= 3)
+		{
+			if((pDigTable->ForbiddenIGI+1) >pDigTable->rx_gain_range_max)
+				pDigTable->rx_gain_range_min = pDigTable->rx_gain_range_max;
+			else
+				pDigTable->rx_gain_range_min = (pDigTable->ForbiddenIGI + 1);
+			pDigTable->Recover_cnt = 3600; //3600=2hr
+		  }
+	 }
+	 else
+	 {
+	  //Recovery mechanism for IGI lower bound
+		if(pDigTable->Recover_cnt != 0){
+			pDigTable->Recover_cnt --;
+		}
+		else
+		{
+			if(pDigTable->LargeFAHit == 0 )
+			{
+				if((pDigTable->ForbiddenIGI -1) < pdmpriv->DIG_Dynamic_MIN) //DM_DIG_MIN)
+				{
+					pDigTable->ForbiddenIGI = pdmpriv->DIG_Dynamic_MIN; //DM_DIG_MIN;
+					pDigTable->rx_gain_range_min = pdmpriv->DIG_Dynamic_MIN; //DM_DIG_MIN;
+				}
+				else
+				{
+					pDigTable->ForbiddenIGI --;
+					pDigTable->rx_gain_range_min = (pDigTable->ForbiddenIGI + 1);
+				}
+			}
+			else if(pDigTable->LargeFAHit == 3 )
+			{
+				pDigTable->LargeFAHit = 0;
+			}
+		}
+	 }
+ #ifdef CONFIG_USB_HCI
+	if(FalseAlmCnt->Cnt_all < 250)
+	{
+#endif
+		//DBG_8192C("===> dm_CtrlInitGainByRssi, Enter DIG by SS mode\n");
+
+		isBT = rtw_read8(pAdapter, 0x4fd) & 0x01;
+
+		if(!isBT){
+
+			if(FalseAlmCnt->Cnt_all > pDigTable->FAHighThresh)
+			{
+				if((pDigTable->BackoffVal -2) < pDigTable->BackoffVal_range_min)
+					pDigTable->BackoffVal = pDigTable->BackoffVal_range_min;
+				else
+					pDigTable->BackoffVal -= 2;
+			}
+			else if(FalseAlmCnt->Cnt_all < pDigTable->FALowThresh)
+			{
+				if((pDigTable->BackoffVal+2) > pDigTable->BackoffVal_range_max)
+					pDigTable->BackoffVal = pDigTable->BackoffVal_range_max;
+				else
+					pDigTable->BackoffVal +=2;
+			}
+		}
+		else
+			pDigTable->BackoffVal = DM_DIG_BACKOFF_DEFAULT;
+
+		pDigTable->CurIGValue = pDigTable->Rssi_val_min+10-pDigTable->BackoffVal;
+
+		//DBG_8192C("Rssi_val_min = %x BackoffVal %x\n",pDigTable->Rssi_val_min, pDigTable->BackoffVal);
+#ifdef CONFIG_USB_HCI
+	}
+	else
+	{
+		//DBG_8192C("===> dm_CtrlInitGainByRssi, Enter DIG by FA mode\n");
+		//DBG_8192C("RSSI = 0x%x", pDigTable->Rssi_val_min);
+
+		//Adjust initial gain by false alarm
+		if(FalseAlmCnt->Cnt_all > 1000)
+			pDigTable->CurIGValue = pDigTable ->PreIGValue+2;
+		else if (FalseAlmCnt->Cnt_all > 750)
+			pDigTable->CurIGValue = pDigTable->PreIGValue+1;
+		else if(FalseAlmCnt->Cnt_all < 500)
+			pDigTable->CurIGValue = pDigTable->PreIGValue-1;
+	}
+#endif
+
+	//Check initial gain by upper/lower bound
+	if(pDigTable->CurIGValue >pDigTable->rx_gain_range_max)
+		pDigTable->CurIGValue = pDigTable->rx_gain_range_max;
+
+	if(pDigTable->CurIGValue < pDigTable->rx_gain_range_min)
+		pDigTable->CurIGValue = pDigTable->rx_gain_range_min;
+
+#ifdef CONFIG_DM_ADAPTIVITY
+	if(pdmpriv->DMFlag & DYNAMIC_FUNC_ADAPTIVITY)
+	{
+		if(pDigTable->CurIGValue > Adap_IGI_Upper)
+			pDigTable->CurIGValue = Adap_IGI_Upper;
+
+		if(pdmpriv->IGI_LowerBound != 0)
+		{
+			if(pDigTable->CurIGValue < pdmpriv->IGI_LowerBound)
+				pDigTable->CurIGValue = pdmpriv->IGI_LowerBound;
+		}
+		LOG_LEVEL(_drv_info_, FUNC_ADPT_FMT": pdmpriv->IGI_LowerBound = %d\n",
+			FUNC_ADPT_ARG(pAdapter), pdmpriv->IGI_LowerBound);
+	}
+#endif /* CONFIG_DM_ADAPTIVITY */
+
+	//printk("%s => rx_gain_range_max(0x%02x) rx_gain_range_min(0x%02x)\n",__FUNCTION__,
+	//	pDigTable->rx_gain_range_max,pDigTable->rx_gain_range_min);
+	//printk("%s CurIGValue(0x%02x)  <====\n",__FUNCTION__,pDigTable->CurIGValue );
+
+	DM_Write_DIG(pAdapter);
+
+}
+#else
+static VOID dm_CtrlInitGainByRssi(IN	PADAPTER	pAdapter)
+{
+	u32 isBT;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+	PFALSE_ALARM_STATISTICS FalseAlmCnt = &(pdmpriv->FalseAlmCnt);
+	u8 RSSI_tmp = dm_initial_gain_MinPWDB(pAdapter);
+#ifdef CONFIG_DM_ADAPTIVITY
+	u8 Adap_IGI_Upper = pdmpriv->IGI_target + 30 + (u8) pdmpriv->TH_L2H_ini -(u8) pdmpriv->TH_EDCCA_HL_diff;
+#endif
+
+	//modify DIG upper bound
+	if((pDigTable->Rssi_val_min + 20) > DM_DIG_MAX )
+		pDigTable->rx_gain_range_max = DM_DIG_MAX;
+	else
+		pDigTable->rx_gain_range_max = pDigTable->Rssi_val_min + 20;
+	//printk("%s Rssi_val_min(0x%02x),rx_gain_range_max(0x%02x)\n",__FUNCTION__,pDigTable->Rssi_val_min,pDigTable->rx_gain_range_max);
+	//modify DIG lower bound, deal with abnorally large false alarm
+	if(FalseAlmCnt->Cnt_all > 10000)
+	{
+		//RT_TRACE(COMP_DIG, DBG_LOUD, ("dm_DIG(): Abnornally false alarm case. \n"));
+
+		pDigTable->LargeFAHit++;
+		if(pDigTable->ForbiddenIGI < pDigTable->CurIGValue)
+		{
+			pDigTable->ForbiddenIGI = pDigTable->CurIGValue;
+			pDigTable->LargeFAHit = 1;
+		}
+
+		if(pDigTable->LargeFAHit >= 3)
+		{
+			if((pDigTable->ForbiddenIGI+1) > pDigTable->rx_gain_range_max)
+				pDigTable->rx_gain_range_min = pDigTable->rx_gain_range_max;
+			else
+				pDigTable->rx_gain_range_min = (pDigTable->ForbiddenIGI + 1);
+			pDigTable->Recover_cnt = 3600; //3600=2hr
+		}
+	}
+	else
+	{
+		//Recovery mechanism for IGI lower bound
+		if(pDigTable->Recover_cnt != 0)
+			pDigTable->Recover_cnt --;
+		else
+		{
+			if(pDigTable->LargeFAHit == 0 )
+			{
+				if((pDigTable->ForbiddenIGI -1) < DM_DIG_MIN)
+				{
+					pDigTable->ForbiddenIGI = DM_DIG_MIN;
+					pDigTable->rx_gain_range_min = DM_DIG_MIN;
+				}
+				else
+				{
+					pDigTable->ForbiddenIGI --;
+					pDigTable->rx_gain_range_min = (pDigTable->ForbiddenIGI + 1);
+				}
+			}
+			else if(pDigTable->LargeFAHit == 3 )
+			{
+				pDigTable->LargeFAHit = 0;
+			}
+		}
+	}
+
+	//RT_TRACE(COMP_DIG, DBG_LOUD, ("DM_DigTable.ForbiddenIGI = 0x%x, DM_DigTable.LargeFAHit = 0x%x\n",pDigTable->ForbiddenIGI, pDigTable->LargeFAHit));
+	//RT_TRACE(COMP_DIG, DBG_LOUD, ("DM_DigTable.rx_gain_range_max = 0x%x, DM_DigTable.rx_gain_range_min = 0x%x\n",pDigTable->rx_gain_range_max, pDigTable->rx_gain_range_min));
+
+#ifdef CONFIG_USB_HCI
+	if(FalseAlmCnt->Cnt_all < 250)
+	{
+#endif
+		//DBG_8192C("===> dm_CtrlInitGainByRssi, Enter DIG by SS mode\n");
+
+		isBT = rtw_read8(pAdapter, 0x4fd) & 0x01;
+
+		if(!isBT){
+
+			if(FalseAlmCnt->Cnt_all > pDigTable->FAHighThresh)
+			{
+				if((pDigTable->BackoffVal -2) < pDigTable->BackoffVal_range_min)
+					pDigTable->BackoffVal = pDigTable->BackoffVal_range_min;
+				else
+					pDigTable->BackoffVal -= 2;
+			}
+			else if(FalseAlmCnt->Cnt_all < pDigTable->FALowThresh)
+			{
+				if((pDigTable->BackoffVal+2) > pDigTable->BackoffVal_range_max)
+					pDigTable->BackoffVal = pDigTable->BackoffVal_range_max;
+				else
+					pDigTable->BackoffVal +=2;
+			}
+		}
+		else
+			pDigTable->BackoffVal = DM_DIG_BACKOFF_DEFAULT;
+
+		pDigTable->CurIGValue = pDigTable->Rssi_val_min+10-pDigTable->BackoffVal;
+
+		//DBG_8192C("Rssi_val_min = %x BackoffVal %x\n",pDigTable->Rssi_val_min, pDigTable->BackoffVal);
+#ifdef CONFIG_USB_HCI
+	}
+	else
+	{
+		//DBG_8192C("===> dm_CtrlInitGainByRssi, Enter DIG by FA mode\n");
+		//DBG_8192C("RSSI = 0x%x", pDigTable->Rssi_val_min);
+
+		//Adjust initial gain by false alarm
+		if(FalseAlmCnt->Cnt_all > 1000)
+			pDigTable->CurIGValue = pDigTable ->PreIGValue+2;
+		else if (FalseAlmCnt->Cnt_all > 750)
+			pDigTable->CurIGValue = pDigTable->PreIGValue+1;
+		else if(FalseAlmCnt->Cnt_all < 500)
+			pDigTable->CurIGValue = pDigTable->PreIGValue-1;
+	}
+#endif
+
+	if(RSSI_tmp <= DM_DIG_MIN)
+		pDigTable->rx_gain_range_min = DM_DIG_MIN;
+	else if(RSSI_tmp >= DM_DIG_MAX)
+		pDigTable->rx_gain_range_min = DM_DIG_MAX;
+	else
+		pDigTable->rx_gain_range_min = RSSI_tmp;
+
+
+	//Check initial gain by upper/lower bound
+	if(pDigTable->CurIGValue >pDigTable->rx_gain_range_max)
+		pDigTable->CurIGValue = pDigTable->rx_gain_range_max;
+
+	if(pDigTable->CurIGValue < pDigTable->rx_gain_range_min)
+		pDigTable->CurIGValue = pDigTable->rx_gain_range_min;
+
+#ifdef CONFIG_DM_ADAPTIVITY
+	if(pdmpriv->DMFlag & DYNAMIC_FUNC_ADAPTIVITY)
+	{
+		if(pDigTable->CurIGValue > Adap_IGI_Upper)
+			pDigTable->CurIGValue = Adap_IGI_Upper;
+
+		if(pdmpriv->IGI_LowerBound != 0)
+		{
+			if(pDigTable->CurIGValue < pdmpriv->IGI_LowerBound)
+				pDigTable->CurIGValue = pdmpriv->IGI_LowerBound;
+		}
+		LOG_LEVEL(_drv_info_, FUNC_ADPT_FMT": pdmpriv->IGI_LowerBound = %d\n",
+			FUNC_ADPT_ARG(pAdapter), pdmpriv->IGI_LowerBound);
+	}
+#endif /* CONFIG_DM_ADAPTIVITY */
+
+	//printk("%s => rx_gain_range_max(0x%02x) rx_gain_range_min(0x%02x)\n",__FUNCTION__,
+	//	pDigTable->rx_gain_range_max,pDigTable->rx_gain_range_min);
+	//printk("%s CurIGValue(0x%02x)  <====\n",__FUNCTION__,pDigTable->CurIGValue );
+
+	DM_Write_DIG(pAdapter);
+
+}
+#endif
+
+static VOID
+dm_initial_gain_Multi_STA(
+	IN	PADAPTER	pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	struct mlme_priv	*pmlmepriv = &(pAdapter->mlmepriv);
+	DIG_T			*pDigTable = &pdmpriv->DM_DigTable;
+	int				rssi_strength =  pdmpriv->EntryMinUndecoratedSmoothedPWDB;
+	BOOLEAN			bMulti_STA = _FALSE;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	//AP Mode
+	if(check_buddy_fwstate(pAdapter, WIFI_AP_STATE) == _TRUE && (rssi_strength !=0))
+	{
+		bMulti_STA = _TRUE;
+	}
+	else if(pDigTable->CurMultiSTAConnectState == DIG_MultiSTA_CONNECT && rssi_strength==0) //STA+STA MODE
+	{
+		bMulti_STA = _TRUE;
+		rssi_strength = pdmpriv->UndecoratedSmoothedPWDB;
+	}
+#endif //CONFIG_CONCURRENT_MODE
+
+
+	//ADHOC and AP Mode
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE|WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE) == _TRUE)
+	{
+		bMulti_STA = _TRUE;
+	}
+
+
+	if((bMulti_STA == _FALSE)
+		|| (pDigTable->CurSTAConnectState == DIG_STA_DISCONNECT))
+	{
+		pdmpriv->binitialized = _FALSE;
+		pDigTable->Dig_Ext_Port_Stage = DIG_EXT_PORT_STAGE_MAX;
+		return;
+	}
+	else if(pdmpriv->binitialized == _FALSE)
+	{
+		pdmpriv->binitialized = _TRUE;
+		pDigTable->Dig_Ext_Port_Stage = DIG_EXT_PORT_STAGE_0;
+		pDigTable->CurIGValue = 0x20;
+		DM_Write_DIG(pAdapter);
+	}
+
+	// Initial gain control by ap mode
+	if(pDigTable->CurMultiSTAConnectState == DIG_MultiSTA_CONNECT)
+	{
+		if (	(rssi_strength < pDigTable->RssiLowThresh) 	&&
+			(pDigTable->Dig_Ext_Port_Stage != DIG_EXT_PORT_STAGE_1))
+		{
+			// Set to dig value to 0x20 for Luke's opinion after disable dig
+			if(pDigTable->Dig_Ext_Port_Stage == DIG_EXT_PORT_STAGE_2)
+			{
+				pDigTable->CurIGValue = 0x20;
+				DM_Write_DIG(pAdapter);
+			}
+			pDigTable->Dig_Ext_Port_Stage = DIG_EXT_PORT_STAGE_1;
+		}
+		else if (rssi_strength > pDigTable->RssiHighThresh)
+		{
+			pDigTable->Dig_Ext_Port_Stage = DIG_EXT_PORT_STAGE_2;
+			dm_CtrlInitGainByFA(pAdapter);
+		}
+	}
+	else if(pDigTable->Dig_Ext_Port_Stage != DIG_EXT_PORT_STAGE_0)
+	{
+		pDigTable->Dig_Ext_Port_Stage = DIG_EXT_PORT_STAGE_0;
+		pDigTable->CurIGValue = 0x20;
+		DM_Write_DIG(pAdapter);
+	}
+
+	//RT_TRACE(	COMP_DIG, DBG_LOUD, ("CurMultiSTAConnectState = %x Dig_Ext_Port_Stage %x\n",
+	//			DM_DigTable.CurMultiSTAConnectState, DM_DigTable.Dig_Ext_Port_Stage));
+}
+
+static VOID
+dm_initial_gain_STA_beforelinked(
+	IN	PADAPTER	pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+	PFALSE_ALARM_STATISTICS pFalseAlmCnt = &(pdmpriv->FalseAlmCnt);
+
+	//CurrentIGI = pDM_DigTable->rx_gain_range_min;//pDM_DigTable->CurIGValue = pDM_DigTable->rx_gain_range_min
+	//ODM_RT_TRACE(pDM_Odm, ODM_COMP_DIG, ODM_DBG_LOUD, ("odm_DIG(): DIG BeforeLink\n"));
+	//2012.03.30 LukeLee: enable DIG before link but with very high thresholds
+	//	Updated by Albert 2012/09/27
+	//	Copy the same rule from 8192du code.
+	if( pFalseAlmCnt->Cnt_all > 2000 )
+		pDigTable->CurIGValue += 2;
+	else if ( ( pFalseAlmCnt->Cnt_all > 1000 ) && ( pFalseAlmCnt->Cnt_all <= 1000 ) )
+		pDigTable->CurIGValue += 1;
+	else if(pFalseAlmCnt->Cnt_all < 500)
+		 pDigTable->CurIGValue -= 1;
+
+	//Check initial gain by upper/lower bound
+	if(pDigTable->CurIGValue >pDigTable->rx_gain_range_max)
+		pDigTable->CurIGValue = pDigTable->rx_gain_range_max;
+
+	if(pDigTable->CurIGValue < pDigTable->rx_gain_range_min)
+		pDigTable->CurIGValue = pDigTable->rx_gain_range_min;
+
+	printk("%s ==> FalseAlmCnt->Cnt_all:%d CurIGValue:0x%02x \n",__FUNCTION__,pFalseAlmCnt->Cnt_all ,pDigTable->CurIGValue);
+}
+
+static VOID
+dm_initial_gain_STA(
+	IN	PADAPTER	pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+
+	//RT_TRACE(	COMP_DIG, DBG_LOUD, ("PreSTAConnectState = %x, CurSTAConnectState = %x\n",
+	//			DM_DigTable.PreSTAConnectState, DM_DigTable.CurSTAConnectState));
+
+
+	if(pDigTable->PreSTAConnectState == pDigTable->CurSTAConnectState||
+	   pDigTable->CurSTAConnectState == DIG_STA_BEFORE_CONNECT ||
+	   pDigTable->CurSTAConnectState == DIG_STA_CONNECT)
+	{
+		// beforeconnect -> beforeconnect or  connect -> connect
+		// (dis)connect -> beforeconnect
+		// disconnect -> connecct or beforeconnect -> connect
+		if(pDigTable->CurSTAConnectState != DIG_STA_DISCONNECT)
+		{
+			pDigTable->Rssi_val_min = dm_initial_gain_MinPWDB(pAdapter);
+			dm_CtrlInitGainByRssi(pAdapter);
+		}
+#if 0
+		else if((wdev_to_priv(pAdapter->rtw_wdev))->p2p_enabled == _TRUE
+				&& pAdapter->wdinfo.driver_interface == DRIVER_CFG80211)
+		{
+			//pDigTable->CurIGValue = 0x30;
+			DM_Write_DIG(pAdapter);
+		}
+#endif
+		else{ // pDigTable->CurSTAConnectState == DIG_STA_DISCONNECT
+		#ifdef CONFIG_BEFORE_LINKED_DIG
+			//printk("%s==> ##1 CurIGI(0x%02x),PreIGValue(0x%02x) \n",__FUNCTION__,pDigTable->CurIGValue,pDigTable->PreIGValue );
+			dm_initial_gain_STA_beforelinked(pAdapter);
+			DM_Write_DIG(pAdapter);
+		#endif //CONFIG_BEFORE_LINKED_DIG
+		}
+	}
+	else
+	{
+		// connect -> disconnect or beforeconnect -> disconnect
+		pDigTable->Rssi_val_min = 0;
+		pDigTable->Dig_Ext_Port_Stage = DIG_EXT_PORT_STAGE_MAX;
+		pDigTable->BackoffVal = DM_DIG_BACKOFF_DEFAULT;
+		pDigTable->CurIGValue = 0x20;
+		pDigTable->PreIGValue = 0;
+		#ifdef CONFIG_BEFORE_LINKED_DIG
+		//printk("%s==> ##2 CurIGI(0x%02x),PreIGValue(0x%02x) \n",__FUNCTION__,pDigTable->CurIGValue,pDigTable->PreIGValue );
+		dm_initial_gain_STA_beforelinked(pAdapter);
+		#endif //CONFIG_BEFORE_LINKED_DIG
+
+
+		DM_Write_DIG(pAdapter);
+	}
+
+}
+
+
+static void dm_CCK_PacketDetectionThresh(
+	IN	PADAPTER	pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	PFALSE_ALARM_STATISTICS FalseAlmCnt = &(pdmpriv->FalseAlmCnt);
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+
+	if(pDigTable->CurSTAConnectState == DIG_STA_CONNECT)
+	{
+		pDigTable->Rssi_val_min = dm_initial_gain_MinPWDB(pAdapter);
+		if(pDigTable->PreCCKPDState == CCK_PD_STAGE_LowRssi)
+		{
+			if(pDigTable->Rssi_val_min <= 25)
+				pDigTable->CurCCKPDState = CCK_PD_STAGE_LowRssi;
+			else
+				pDigTable->CurCCKPDState = CCK_PD_STAGE_HighRssi;
+		}
+		else{
+			if(pDigTable->Rssi_val_min <= 20)
+				pDigTable->CurCCKPDState = CCK_PD_STAGE_LowRssi;
+			else
+				pDigTable->CurCCKPDState = CCK_PD_STAGE_HighRssi;
+		}
+	}
+	else
+		pDigTable->CurCCKPDState=CCK_PD_STAGE_MAX;
+
+	if(pDigTable->PreCCKPDState != pDigTable->CurCCKPDState)
+	{
+		if((pDigTable->CurCCKPDState == CCK_PD_STAGE_LowRssi)||
+			(pDigTable->CurCCKPDState == CCK_PD_STAGE_MAX))
+		{
+			PHY_SetBBReg(pAdapter, rCCK0_CCA, bMaskByte2, 0x83);
+
+			//PHY_SetBBReg(pAdapter, rCCK0_System, bMaskByte1, 0x40);
+			//if(IS_92C_SERIAL(pHalData->VersionID))
+				//PHY_SetBBReg(pAdapter, rCCK0_FalseAlarmReport , bMaskByte2, 0xd7);
+		}
+		else
+		{
+			PHY_SetBBReg(pAdapter, rCCK0_CCA, bMaskByte2, 0xcd);
+			//PHY_SetBBReg(pAdapter,rCCK0_System, bMaskByte1, 0x47);
+			//if(IS_92C_SERIAL(pHalData->VersionID))
+				//PHY_SetBBReg(pAdapter, rCCK0_FalseAlarmReport , bMaskByte2, 0xd3);
+		}
+
+		pDigTable->PreCCKPDState = pDigTable->CurCCKPDState;
+	}
+
+	//RT_TRACE(	COMP_DIG, DBG_LOUD, ("CCKPDStage=%x\n",pDigTable->CurCCKPDState));
+	//RT_TRACE(	COMP_DIG, DBG_LOUD, ("is92C=%x\n",IS_92C_SERIAL(pHalData->VersionID)));
+
+}
+
+
+static	void
+dm_CtrlInitGainByTwoPort(
+	IN	PADAPTER	pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	struct mlme_priv	*pmlmepriv = &(pAdapter->mlmepriv);
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE)
+	{
+#ifdef CONFIG_IOCTL_CFG80211
+		if((wdev_to_priv(pAdapter->rtw_wdev))->p2p_enabled == _TRUE)
+		{
+		}
+		else
+#endif
+			return;
+	}
+
+	// Decide the current status and if modify initial gain or not
+	if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING) == _TRUE)
+	{
+		pDigTable->CurSTAConnectState = DIG_STA_BEFORE_CONNECT;
+	}
+	else if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+	{
+		pDigTable->CurSTAConnectState = DIG_STA_CONNECT;
+	}
+	else
+	{
+		pDigTable->CurSTAConnectState = DIG_STA_DISCONNECT;
+	}
+
+
+	pDigTable->CurMultiSTAConnectState = DIG_MultiSTA_DISCONNECT;
+	if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE) == _TRUE)
+	{
+		if((is_IBSS_empty(pAdapter)==_FAIL) && (pAdapter->stapriv.asoc_sta_count > 2))
+			pDigTable->CurMultiSTAConnectState = DIG_MultiSTA_CONNECT;
+	}
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+		if(pAdapter->stapriv.asoc_sta_count > 2)
+			pDigTable->CurMultiSTAConnectState = DIG_MultiSTA_CONNECT;
+	}
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(check_buddy_fwstate(pAdapter, WIFI_AP_STATE) == _TRUE)
+	{
+		PADAPTER pbuddy_adapter = pAdapter->pbuddy_adapter;
+
+		if(pbuddy_adapter->stapriv.asoc_sta_count > 2)
+		{
+			pDigTable->CurSTAConnectState = DIG_STA_CONNECT;
+			pDigTable->CurMultiSTAConnectState = DIG_MultiSTA_CONNECT;
+		}
+	}
+	else if(check_buddy_fwstate(pAdapter, WIFI_STATION_STATE) == _TRUE	&&
+		check_buddy_fwstate(pAdapter, _FW_LINKED) == _TRUE)
+	{
+		pDigTable->CurSTAConnectState = DIG_STA_CONNECT;
+
+	}
+#endif //CONFIG_CONCURRENT_MODE
+
+
+	dm_initial_gain_STA(pAdapter);
+	dm_initial_gain_Multi_STA(pAdapter);
+	//Baron temp DIG solution for DMP
+	//dm_CtrlInitGainByFA(pAdapter);
+
+	dm_CCK_PacketDetectionThresh(pAdapter);
+
+	pDigTable->PreSTAConnectState = pDigTable->CurSTAConnectState;
+
+}
+
+
+static void dm_DIG(
+	IN	PADAPTER	pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+
+	//Read 0x0c50; Initial gain
+	pDigTable->PreIGValue = (u8)PHY_QueryBBReg(pAdapter, rOFDM0_XAAGCCore1, bMaskByte0);
+
+	//RTPRINT(FDM, DM_Monitor, ("dm_DIG() ==>\n"));
+
+	if(pdmpriv->bDMInitialGainEnable == _FALSE)
+		return;
+
+	//if(pDigTable->Dig_Enable_Flag == _FALSE)
+	//	return;
+
+	if(!(pdmpriv->DMFlag & DYNAMIC_FUNC_DIG))
+		return;
+
+	//RTPRINT(FDM, DM_Monitor, ("dm_DIG() progress \n"));
+
+	dm_CtrlInitGainByTwoPort(pAdapter);
+
+	//RTPRINT(FDM, DM_Monitor, ("dm_DIG() <==\n"));
+}
+
+static void dm_SavePowerIndex(IN	PADAPTER	Adapter)
+{
+	u8			index;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	u32			Power_Index_REG[6] = {0xc90, 0xc91, 0xc92, 0xc98, 0xc99, 0xc9a};
+
+	for(index = 0; index< 6; index++)
+		pdmpriv->PowerIndex_backup[index] = rtw_read8(Adapter, Power_Index_REG[index]);
+}
+
+static void dm_RestorePowerIndex(IN	PADAPTER	Adapter)
+{
+	u8			index;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	u32			Power_Index_REG[6] = {0xc90, 0xc91, 0xc92, 0xc98, 0xc99, 0xc9a};
+
+	for(index = 0; index< 6; index++)
+		rtw_write8(Adapter, Power_Index_REG[index], pdmpriv->PowerIndex_backup[index]);
+}
+
+static void dm_WritePowerIndex(
+		IN	PADAPTER	Adapter,
+		IN 	u8		Value)
+{
+	u8			index;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u32			Power_Index_REG[6] = {0xc90, 0xc91, 0xc92, 0xc98, 0xc99, 0xc9a};
+
+	for(index = 0; index< 6; index++)
+		rtw_write8(Adapter, Power_Index_REG[index], Value);
+}
+
+static void dm_InitDynamicTxPower(IN	PADAPTER	Adapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+#ifdef CONFIG_USB_HCI
+#ifdef CONFIG_INTEL_PROXIM
+	if((pHalData->BoardType == BOARD_USB_High_PA)||(Adapter->proximity.proxim_support==_TRUE))
+#else
+	if(pHalData->BoardType == BOARD_USB_High_PA)
+#endif
+	{
+		dm_SavePowerIndex(Adapter);
+		pdmpriv->bDynamicTxPowerEnable = _TRUE;
+	}
+	else
+#else
+		pdmpriv->bDynamicTxPowerEnable = _FALSE;
+#endif
+
+	pdmpriv->LastDTPLvl = TxHighPwrLevel_Normal;
+	pdmpriv->DynamicTxHighPowerLvl = TxHighPwrLevel_Normal;
+}
+
+
+static void dm_DynamicTxPower(IN	PADAPTER	Adapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	struct mlme_priv	*pmlmepriv = &(Adapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &Adapter->mlmeextpriv;
+	int	UndecoratedSmoothedPWDB;
+
+	if(!pdmpriv->bDynamicTxPowerEnable)
+		return;
+
+	// If dynamic high power is disabled.
+	if(!(pdmpriv->DMFlag & DYNAMIC_FUNC_HP) )
+	{
+		pdmpriv->DynamicTxHighPowerLvl = TxHighPwrLevel_Normal;
+		return;
+	}
+
+	// STA not connected and AP not connected
+	if((check_fwstate(pmlmepriv, _FW_LINKED) != _TRUE) &&
+		(pdmpriv->EntryMinUndecoratedSmoothedPWDB == 0))
+	{
+		//RT_TRACE(COMP_HIPWR, DBG_LOUD, ("Not connected to any \n"));
+		pdmpriv->DynamicTxHighPowerLvl = TxHighPwrLevel_Normal;
+
+		//the LastDTPlvl should reset when disconnect,
+		//otherwise the tx power level wouldn't change when disconnect and connect again.
+		// Maddest 20091220.
+		pdmpriv->LastDTPLvl=TxHighPwrLevel_Normal;
+		return;
+	}
+#ifdef CONFIG_INTEL_PROXIM
+	if(Adapter->proximity.proxim_on== _TRUE){
+		struct proximity_priv *prox_priv=Adapter->proximity.proximity_priv;
+	// Intel set fixed tx power
+	printk("\n %s  Adapter->proximity.proxim_on=%d prox_priv->proxim_modeinfo->power_output=%d \n",__FUNCTION__,Adapter->proximity.proxim_on,prox_priv->proxim_modeinfo->power_output);
+	if(prox_priv!=NULL){
+	if(prox_priv->proxim_modeinfo->power_output> 0)
+
+	{
+		switch(prox_priv->proxim_modeinfo->power_output){
+			case 1:
+				pdmpriv->DynamicTxHighPowerLvl  = TxHighPwrLevel_100;
+				printk("TxHighPwrLevel_100\n");
+				break;
+			case 2:
+				pdmpriv->DynamicTxHighPowerLvl  = TxHighPwrLevel_70;
+				printk("TxHighPwrLevel_70\n");
+				break;
+			case 3:
+				pdmpriv->DynamicTxHighPowerLvl  = TxHighPwrLevel_50;
+				printk("TxHighPwrLevel_50\n");
+				break;
+			case 4:
+				pdmpriv->DynamicTxHighPowerLvl  = TxHighPwrLevel_35;
+				printk("TxHighPwrLevel_35\n");
+				break;
+			case 5:
+				pdmpriv->DynamicTxHighPowerLvl  = TxHighPwrLevel_15;
+				printk("TxHighPwrLevel_15\n");
+				break;
+			default:
+				pdmpriv->DynamicTxHighPowerLvl = TxHighPwrLevel_100;
+				printk("TxHighPwrLevel_100\n");
+				break;
+		}
+	}
+	}
+	}
+	else
+#endif
+{
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)	// Default port
+	{
+		//todo: AP Mode
+		if ((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE) ||
+		       (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE))
+		{
+			UndecoratedSmoothedPWDB = pdmpriv->EntryMinUndecoratedSmoothedPWDB;
+			//RT_TRACE(COMP_HIPWR, DBG_LOUD, ("AP Client PWDB = 0x%x \n", UndecoratedSmoothedPWDB));
+		}
+		else
+		{
+			UndecoratedSmoothedPWDB = pdmpriv->UndecoratedSmoothedPWDB;
+			//RT_TRACE(COMP_HIPWR, DBG_LOUD, ("STA Default Port PWDB = 0x%x \n", UndecoratedSmoothedPWDB));
+		}
+	}
+	else // associated entry pwdb
+	{
+		UndecoratedSmoothedPWDB = pdmpriv->EntryMinUndecoratedSmoothedPWDB;
+		//RT_TRACE(COMP_HIPWR, DBG_LOUD, ("AP Ext Port PWDB = 0x%x \n", UndecoratedSmoothedPWDB));
+	}
+
+	if(UndecoratedSmoothedPWDB >= TX_POWER_NEAR_FIELD_THRESH_LVL2)
+	{
+		pdmpriv->DynamicTxHighPowerLvl = TxHighPwrLevel_Level2;
+		//RT_TRACE(COMP_HIPWR, DBG_LOUD, ("TxHighPwrLevel_Level1 (TxPwr=0x0)\n"));
+	}
+	else if((UndecoratedSmoothedPWDB < (TX_POWER_NEAR_FIELD_THRESH_LVL2-3)) &&
+		(UndecoratedSmoothedPWDB >= TX_POWER_NEAR_FIELD_THRESH_LVL1) )
+	{
+		pdmpriv->DynamicTxHighPowerLvl = TxHighPwrLevel_Level1;
+		//RT_TRACE(COMP_HIPWR, DBG_LOUD, ("TxHighPwrLevel_Level1 (TxPwr=0x10)\n"));
+	}
+	else if(UndecoratedSmoothedPWDB < (TX_POWER_NEAR_FIELD_THRESH_LVL1-5))
+	{
+		pdmpriv->DynamicTxHighPowerLvl = TxHighPwrLevel_Normal;
+		//RT_TRACE(COMP_HIPWR, DBG_LOUD, ("TxHighPwrLevel_Normal\n"));
+	}
+}
+	if( (pdmpriv->DynamicTxHighPowerLvl != pdmpriv->LastDTPLvl) )
+	{
+		PHY_SetTxPowerLevel8192C(Adapter, pHalData->CurrentChannel);
+		if(pdmpriv->DynamicTxHighPowerLvl == TxHighPwrLevel_Normal) // HP1 -> Normal  or HP2 -> Normal
+			dm_RestorePowerIndex(Adapter);
+		else if(pdmpriv->DynamicTxHighPowerLvl == TxHighPwrLevel_Level1)
+			dm_WritePowerIndex(Adapter, 0x14);
+		else if(pdmpriv->DynamicTxHighPowerLvl == TxHighPwrLevel_Level2)
+			dm_WritePowerIndex(Adapter, 0x10);
+	}
+	pdmpriv->LastDTPLvl = pdmpriv->DynamicTxHighPowerLvl;
+
+}
+
+
+static VOID
+DM_ChangeDynamicInitGainThresh(
+	IN	PADAPTER	pAdapter,
+	IN	u32		DM_Type,
+	IN	u32		DM_Value)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+
+	if (DM_Type == DIG_TYPE_THRESH_HIGH)
+	{
+		pDigTable->RssiHighThresh = DM_Value;
+	}
+	else if (DM_Type == DIG_TYPE_THRESH_LOW)
+	{
+		pDigTable->RssiLowThresh = DM_Value;
+	}
+	else if (DM_Type == DIG_TYPE_ENABLE)
+	{
+		pDigTable->Dig_Enable_Flag = _TRUE;
+	}
+	else if (DM_Type == DIG_TYPE_DISABLE)
+	{
+		pDigTable->Dig_Enable_Flag = _FALSE;
+	}
+	else if (DM_Type == DIG_TYPE_BACKOFF)
+	{
+		if(DM_Value > 30)
+			DM_Value = 30;
+		pDigTable->BackoffVal = (u8)DM_Value;
+	}
+	else if(DM_Type == DIG_TYPE_RX_GAIN_MIN)
+	{
+		if(DM_Value == 0)
+			DM_Value = 0x1;
+		pDigTable->rx_gain_range_min = (u8)DM_Value;
+	}
+	else if(DM_Type == DIG_TYPE_RX_GAIN_MAX)
+	{
+		if(DM_Value > 0x50)
+			DM_Value = 0x50;
+		pDigTable->rx_gain_range_max = (u8)DM_Value;
+	}
+}	/* DM_ChangeDynamicInitGainThresh */
+
+
+static VOID PWDB_Monitor(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	int	i;
+	int	tmpEntryMaxPWDB=0, tmpEntryMinPWDB=0xff;
+	u8 	sta_cnt=0;
+	u32 PWDB_rssi[NUM_STA]={0};//[0~15]:MACID, [16~31]:PWDB_rssi
+
+	if(check_fwstate(&Adapter->mlmepriv, _FW_LINKED) != _TRUE)
+		return;
+
+
+	if(check_fwstate(&Adapter->mlmepriv, WIFI_AP_STATE|WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE) == _TRUE)
+	{
+		_irqL irqL;
+		_list	*plist, *phead;
+		struct sta_info *psta;
+		struct sta_priv *pstapriv = &Adapter->stapriv;
+		u8 bcast_addr[ETH_ALEN]= {0xff,0xff,0xff,0xff,0xff,0xff};
+
+		_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+		for(i=0; i< NUM_STA; i++)
+		{
+			phead = &(pstapriv->sta_hash[i]);
+			plist = get_next(phead);
+
+			while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+			{
+				psta = LIST_CONTAINOR(plist, struct sta_info, hash_list);
+
+				plist = get_next(plist);
+
+				if(_rtw_memcmp(psta	->hwaddr, bcast_addr, ETH_ALEN) ||
+					_rtw_memcmp(psta->hwaddr, myid(&Adapter->eeprompriv), ETH_ALEN))
+					continue;
+
+				if(psta->state & WIFI_ASOC_STATE)
+				{
+
+					if(psta->rssi_stat.UndecoratedSmoothedPWDB < tmpEntryMinPWDB)
+						tmpEntryMinPWDB = psta->rssi_stat.UndecoratedSmoothedPWDB;
+
+					if(psta->rssi_stat.UndecoratedSmoothedPWDB > tmpEntryMaxPWDB)
+						tmpEntryMaxPWDB = psta->rssi_stat.UndecoratedSmoothedPWDB;
+
+					PWDB_rssi[sta_cnt++] = (psta->mac_id | (psta->rssi_stat.UndecoratedSmoothedPWDB<<16));
+				}
+
+			}
+
+		}
+
+		_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+
+
+		if(pHalData->fw_ractrl == _TRUE)
+		{
+			// Report every sta's RSSI to FW
+			for(i=0; i< sta_cnt; i++)
+			{
+				rtl8192c_set_rssi_cmd(Adapter, (u8*)&PWDB_rssi[i]);
+			}
+		}
+
+	}
+
+
+
+	if(tmpEntryMaxPWDB != 0)	// If associated entry is found
+	{
+		pdmpriv->EntryMaxUndecoratedSmoothedPWDB = tmpEntryMaxPWDB;
+	}
+	else
+	{
+		pdmpriv->EntryMaxUndecoratedSmoothedPWDB = 0;
+	}
+
+	if(tmpEntryMinPWDB != 0xff) // If associated entry is found
+	{
+		pdmpriv->EntryMinUndecoratedSmoothedPWDB = tmpEntryMinPWDB;
+	}
+	else
+	{
+		pdmpriv->EntryMinUndecoratedSmoothedPWDB = 0;
+	}
+
+
+	if(check_fwstate(&Adapter->mlmepriv, WIFI_STATION_STATE) == _TRUE)
+	{
+
+		if(pHalData->fw_ractrl == _TRUE)
+		{
+			u32 param = (u32)(pdmpriv->UndecoratedSmoothedPWDB<<16);
+
+			param |= 0;//macid=0 for sta mode;
+
+			rtl8192c_set_rssi_cmd(Adapter, (u8*)&param);
+		}
+	}
+
+}
+
+
+static void
+DM_InitEdcaTurbo(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	pHalData->bCurrentTurboEDCA = _FALSE;
+	Adapter->recvpriv.bIsAnyNonBEPkts = _FALSE;
+
+}
+
+
+static void
+dm_CheckEdcaTurbo(
+	IN	PADAPTER	Adapter
+	)
+{
+	u32 	trafficIndex;
+	u32	edca_param;
+	u64	cur_tx_bytes = 0;
+	u64	cur_rx_bytes = 0;
+	u8	bbtchange = _FALSE;
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv		*pdmpriv = &pHalData->dmpriv;
+	struct xmit_priv		*pxmitpriv = &(Adapter->xmitpriv);
+	struct recv_priv		*precvpriv = &(Adapter->recvpriv);
+	struct registry_priv	*pregpriv = &Adapter->registrypriv;
+	struct mlme_ext_priv	*pmlmeext = &(Adapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+#ifdef CONFIG_BT_COEXIST
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+#endif
+
+
+	if ((pregpriv->wifi_spec == 1) || (pmlmeinfo->HT_enable == 0))
+	{
+		goto dm_CheckEdcaTurbo_EXIT;
+	}
+
+	if (pmlmeinfo->assoc_AP_vendor >= maxAP)
+	{
+		goto dm_CheckEdcaTurbo_EXIT;
+	}
+
+#ifdef CONFIG_BT_COEXIST
+	if(pbtpriv->BT_Coexist)
+	{
+		if( (pbtpriv->BT_EDCA[UP_LINK]!=0) ||  (pbtpriv->BT_EDCA[DOWN_LINK]!=0))
+		{
+			bbtchange = _TRUE;
+		}
+	}
+#endif
+
+	// Check if the status needs to be changed.
+	if((bbtchange) || (!precvpriv->bIsAnyNonBEPkts) )
+	{
+		cur_tx_bytes = pxmitpriv->tx_bytes - pxmitpriv->last_tx_bytes;
+		cur_rx_bytes = precvpriv->rx_bytes - precvpriv->last_rx_bytes;
+
+		//traffic, TX or RX
+		if((pmlmeinfo->assoc_AP_vendor == ralinkAP)||(pmlmeinfo->assoc_AP_vendor == atherosAP))
+		{
+			if (cur_tx_bytes > (cur_rx_bytes << 2))
+			{ // Uplink TP is present.
+				trafficIndex = UP_LINK;
+			}
+			else
+			{ // Balance TP is present.
+				trafficIndex = DOWN_LINK;
+			}
+		}
+		else
+		{
+			if (cur_rx_bytes > (cur_tx_bytes << 2))
+			{ // Downlink TP is present.
+				trafficIndex = DOWN_LINK;
+			}
+			else
+			{ // Balance TP is present.
+				trafficIndex = UP_LINK;
+			}
+		}
+
+		if ((pdmpriv->prv_traffic_idx != trafficIndex) || (!pHalData->bCurrentTurboEDCA))
+		{
+#ifdef CONFIG_BT_COEXIST
+			if(_TRUE == bbtchange)
+			{
+				edca_param = pbtpriv->BT_EDCA[trafficIndex];
+			}
+			else
+#endif
+			{
+#if 0
+				//adjust EDCA parameter for BE queue
+				edca_param = EDCAParam[pmlmeinfo->assoc_AP_vendor][trafficIndex];
+#else
+
+				if((pmlmeinfo->assoc_AP_vendor == ciscoAP) && (pmlmeext->cur_wireless_mode & WIRELESS_11_24N))
+				{
+					edca_param = EDCAParam[pmlmeinfo->assoc_AP_vendor][trafficIndex];
+				}
+				else
+				{
+					edca_param = EDCAParam[unknownAP][trafficIndex];
+				}
+#endif
+			}
+
+#ifdef CONFIG_PCI_HCI
+			if(IS_92C_SERIAL(pHalData->VersionID))
+			{
+				edca_param = 0x60a42b;
+			}
+			else
+			{
+				edca_param = 0x6ea42b;
+			}
+#endif
+			rtw_write32(Adapter, REG_EDCA_BE_PARAM, edca_param);
+
+			pdmpriv->prv_traffic_idx = trafficIndex;
+		}
+
+		pHalData->bCurrentTurboEDCA = _TRUE;
+	}
+	else
+	{
+		//
+		// Turn Off EDCA turbo here.
+		// Restore original EDCA according to the declaration of AP.
+		//
+		 if(pHalData->bCurrentTurboEDCA)
+		{
+			rtw_write32(Adapter, REG_EDCA_BE_PARAM, pHalData->AcParam_BE);
+			pHalData->bCurrentTurboEDCA = _FALSE;
+		}
+	}
+
+dm_CheckEdcaTurbo_EXIT:
+	// Set variables for next time.
+	precvpriv->bIsAnyNonBEPkts = _FALSE;
+	pxmitpriv->last_tx_bytes = pxmitpriv->tx_bytes;
+	precvpriv->last_rx_bytes = precvpriv->rx_bytes;
+
+}
+
+#define DPK_DELTA_MAPPING_NUM	13
+#define index_mapping_HP_NUM		15
+
+static	VOID
+dm_TXPowerTrackingCallback_ThermalMeter_92C(
+            IN PADAPTER	Adapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	u8			ThermalValue = 0, delta, delta_LCK, delta_IQK, delta_HP, TimeOut = 100;
+	int 			ele_A, ele_D, TempCCk, X, value32;
+	int			Y, ele_C;
+	s8			OFDM_index[2], CCK_index = 0, OFDM_index_old[2], CCK_index_old = 0;
+	int			i = 0;
+	BOOLEAN		is2T = IS_92C_SERIAL(pHalData->VersionID);
+
+#if MP_DRIVER == 1
+	PMPT_CONTEXT	pMptCtx = &(Adapter->mppriv.MptCtx);
+	u8			*TxPwrLevel = pMptCtx->TxPwrLevel;
+#endif
+	u8			OFDM_min_index = 6, rf; //OFDM BB Swing should be less than +3.0dB, which is required by Arthur
+#if 0
+	u32			DPK_delta_mapping[2][DPK_DELTA_MAPPING_NUM] = {
+					{0x1c, 0x1c, 0x1d, 0x1d, 0x1e,
+					 0x1f, 0x00, 0x00, 0x01, 0x01,
+					 0x02, 0x02, 0x03},
+					{0x1c, 0x1d, 0x1e, 0x1e, 0x1e,
+					 0x1f, 0x00, 0x00, 0x01, 0x02,
+					 0x02, 0x03, 0x03}};
+#endif
+#ifdef CONFIG_USB_HCI
+	u8			ThermalValue_HP_count = 0;
+	u32			ThermalValue_HP = 0;
+	s32			index_mapping_HP[index_mapping_HP_NUM] = {
+					0,	1,	3,	4,	6,
+					7,	9,	10,	12,	13,
+					15,	16,	18,	19,	21
+					};
+
+	s8			index_HP;
+#endif
+
+	pdmpriv->TXPowerTrackingCallbackCnt++;	//cosa add for debug
+	pdmpriv->bTXPowerTrackingInit = _TRUE;
+
+	if(pHalData->CurrentChannel == 14 && !pdmpriv->bCCKinCH14)
+		pdmpriv->bCCKinCH14 = _TRUE;
+	else if(pHalData->CurrentChannel != 14 && pdmpriv->bCCKinCH14)
+		pdmpriv->bCCKinCH14 = _FALSE;
+
+	//DBG_8192C("===>dm_TXPowerTrackingCallback_ThermalMeter_92C\n");
+
+	ThermalValue = (u8)PHY_QueryRFReg(Adapter, RF_PATH_A, RF_T_METER, 0x1f);	// 0x24: RF Reg[4:0]
+
+	//DBG_8192C("\n\nReadback Thermal Meter = 0x%x pre thermal meter 0x%x EEPROMthermalmeter 0x%x\n",ThermalValue,pdmpriv->ThermalValue,  pHalData->EEPROMThermalMeter);
+
+	rtl8192c_PHY_APCalibrate(Adapter, (ThermalValue - pHalData->EEPROMThermalMeter));
+
+	if(is2T)
+		rf = 2;
+	else
+		rf = 1;
+
+	if(ThermalValue)
+	{
+//		if(!pHalData->ThermalValue)
+		{
+			//Query OFDM path A default setting
+			ele_D = PHY_QueryBBReg(Adapter, rOFDM0_XATxIQImbalance, bMaskDWord)&bMaskOFDM_D;
+			for(i=0; i<OFDM_TABLE_SIZE_92C; i++)	//find the index
+			{
+				if(ele_D == (OFDMSwingTable[i]&bMaskOFDM_D))
+				{
+					OFDM_index_old[0] = (u8)i;
+					//DBG_8192C("Initial pathA ele_D reg0x%x = 0x%x, OFDM_index=0x%x\n", rOFDM0_XATxIQImbalance, ele_D, OFDM_index_old[0]);
+					break;
+				}
+			}
+
+			//Query OFDM path B default setting
+			if(is2T)
+			{
+				ele_D = PHY_QueryBBReg(Adapter, rOFDM0_XBTxIQImbalance, bMaskDWord)&bMaskOFDM_D;
+				for(i=0; i<OFDM_TABLE_SIZE_92C; i++)	//find the index
+				{
+					if(ele_D == (OFDMSwingTable[i]&bMaskOFDM_D))
+					{
+						OFDM_index_old[1] = (u8)i;
+						//DBG_8192C("Initial pathB ele_D reg0x%x = 0x%x, OFDM_index=0x%x\n",rOFDM0_XBTxIQImbalance, ele_D, OFDM_index_old[1]);
+						break;
+					}
+				}
+			}
+
+			//Query CCK default setting From 0xa24
+			TempCCk = PHY_QueryBBReg(Adapter, rCCK0_TxFilter2, bMaskDWord)&bMaskCCK;
+			for(i=0 ; i<CCK_TABLE_SIZE ; i++)
+			{
+				if(pdmpriv->bCCKinCH14)
+				{
+					if(_rtw_memcmp((void*)&TempCCk, (void*)&CCKSwingTable_Ch14[i][2], 4)==_TRUE)
+					{
+						CCK_index_old =(u8)i;
+						//DBG_8192C("Initial reg0x%x = 0x%x, CCK_index=0x%x, ch 14 %d\n", rCCK0_TxFilter2, TempCCk, CCK_index_old, pdmpriv->bCCKinCH14);
+						break;
+					}
+				}
+				else
+				{
+					if(_rtw_memcmp((void*)&TempCCk, (void*)&CCKSwingTable_Ch1_Ch13[i][2], 4)==_TRUE)
+					{
+						CCK_index_old =(u8)i;
+						//DBG_8192C("Initial reg0x%x = 0x%x, CCK_index=0x%x, ch14 %d\n", rCCK0_TxFilter2, TempCCk, CCK_index_old, pdmpriv->bCCKinCH14);
+						break;
+					}
+				}
+			}
+
+			if(!pdmpriv->ThermalValue)
+			{
+				pdmpriv->ThermalValue = pHalData->EEPROMThermalMeter;
+				pdmpriv->ThermalValue_LCK = ThermalValue;
+				pdmpriv->ThermalValue_IQK = ThermalValue;
+				pdmpriv->ThermalValue_DPK = pHalData->EEPROMThermalMeter;
+
+#ifdef CONFIG_USB_HCI
+				for(i = 0; i < rf; i++)
+					pdmpriv->OFDM_index_HP[i] = pdmpriv->OFDM_index[i] = OFDM_index_old[i];
+				pdmpriv->CCK_index_HP = pdmpriv->CCK_index = CCK_index_old;
+#else
+				for(i = 0; i < rf; i++)
+					pdmpriv->OFDM_index[i] = OFDM_index_old[i];
+				pdmpriv->CCK_index = CCK_index_old;
+#endif
+			}
+
+#ifdef CONFIG_USB_HCI
+			if(pHalData->BoardType == BOARD_USB_High_PA)
+			{
+				pdmpriv->ThermalValue_HP[pdmpriv->ThermalValue_HP_index] = ThermalValue;
+				pdmpriv->ThermalValue_HP_index++;
+				if(pdmpriv->ThermalValue_HP_index == HP_THERMAL_NUM)
+					pdmpriv->ThermalValue_HP_index = 0;
+
+				for(i = 0; i < HP_THERMAL_NUM; i++)
+				{
+					if(pdmpriv->ThermalValue_HP[i])
+					{
+						ThermalValue_HP += pdmpriv->ThermalValue_HP[i];
+						ThermalValue_HP_count++;
+					}
+				}
+
+				if(ThermalValue_HP_count)
+					ThermalValue = (u8)(ThermalValue_HP / ThermalValue_HP_count);
+			}
+#endif
+		}
+
+		delta = (ThermalValue > pdmpriv->ThermalValue)?(ThermalValue - pdmpriv->ThermalValue):(pdmpriv->ThermalValue - ThermalValue);
+#ifdef CONFIG_USB_HCI
+		if(pHalData->BoardType == BOARD_USB_High_PA)
+		{
+			if(pdmpriv->bDoneTxpower)
+				delta_HP = (ThermalValue > pdmpriv->ThermalValue)?(ThermalValue - pdmpriv->ThermalValue):(pdmpriv->ThermalValue - ThermalValue);
+			else
+				delta_HP = ThermalValue > pHalData->EEPROMThermalMeter?(ThermalValue - pHalData->EEPROMThermalMeter):(pHalData->EEPROMThermalMeter - ThermalValue);
+		}
+		else
+#endif
+		{
+			delta_HP = 0;
+		}
+		delta_LCK = (ThermalValue > pdmpriv->ThermalValue_LCK)?(ThermalValue - pdmpriv->ThermalValue_LCK):(pdmpriv->ThermalValue_LCK - ThermalValue);
+		delta_IQK = (ThermalValue > pdmpriv->ThermalValue_IQK)?(ThermalValue - pdmpriv->ThermalValue_IQK):(pdmpriv->ThermalValue_IQK - ThermalValue);
+
+		//DBG_8192C("Readback Thermal Meter = 0x%lx pre thermal meter 0x%lx EEPROMthermalmeter 0x%lx delta 0x%lx delta_LCK 0x%lx delta_IQK 0x%lx\n", ThermalValue, pHalData->ThermalValue, pHalData->EEPROMThermalMeter, delta, delta_LCK, delta_IQK);
+
+		if(delta_LCK > 1)
+		{
+			pdmpriv->ThermalValue_LCK = ThermalValue;
+			rtl8192c_PHY_LCCalibrate(Adapter);
+		}
+
+		if((delta > 0 || delta_HP > 0) && pdmpriv->TxPowerTrackControl)
+		{
+#ifdef CONFIG_USB_HCI
+			if(pHalData->BoardType == BOARD_USB_High_PA)
+			{
+				pdmpriv->bDoneTxpower = _TRUE;
+				delta_HP = ThermalValue > pHalData->EEPROMThermalMeter?(ThermalValue - pHalData->EEPROMThermalMeter):(pHalData->EEPROMThermalMeter - ThermalValue);
+
+				if(delta_HP > index_mapping_HP_NUM-1)
+					index_HP = index_mapping_HP[index_mapping_HP_NUM-1];
+				else
+					index_HP = index_mapping_HP[delta_HP];
+
+				if(ThermalValue > pHalData->EEPROMThermalMeter)	//set larger Tx power
+				{
+					for(i = 0; i < rf; i++)
+						OFDM_index[i] = pdmpriv->OFDM_index_HP[i] - index_HP;
+					CCK_index = pdmpriv->CCK_index_HP -index_HP;
+				}
+				else
+				{
+					for(i = 0; i < rf; i++)
+						OFDM_index[i] = pdmpriv->OFDM_index_HP[i] + index_HP;
+					CCK_index = pdmpriv->CCK_index_HP + index_HP;
+				}
+
+				delta_HP = (ThermalValue > pdmpriv->ThermalValue)?(ThermalValue - pdmpriv->ThermalValue):(pdmpriv->ThermalValue - ThermalValue);
+
+			}
+			else
+#endif
+			{
+				if(ThermalValue > pdmpriv->ThermalValue)
+				{
+					for(i = 0; i < rf; i++)
+						pdmpriv->OFDM_index[i] -= delta;
+					pdmpriv->CCK_index -= delta;
+				}
+				else
+				{
+					for(i = 0; i < rf; i++)
+						pdmpriv->OFDM_index[i] += delta;
+					pdmpriv->CCK_index += delta;
+				}
+			}
+
+			/*if(is2T)
+			{
+				DBG_8192C("temp OFDM_A_index=0x%x, OFDM_B_index=0x%x, CCK_index=0x%x\n",
+					pdmpriv->OFDM_index[0], pdmpriv->OFDM_index[1], pdmpriv->CCK_index);
+			}
+			else
+			{
+				DBG_8192C("temp OFDM_A_index=0x%x, CCK_index=0x%x\n",
+					pdmpriv->OFDM_index[0], pdmpriv->CCK_index);
+			}*/
+
+			//no adjust
+#ifdef CONFIG_USB_HCI
+			if(pHalData->BoardType != BOARD_USB_High_PA)
+#endif
+			{
+				if(ThermalValue > pHalData->EEPROMThermalMeter)
+				{
+					for(i = 0; i < rf; i++)
+						OFDM_index[i] = pdmpriv->OFDM_index[i]+1;
+					CCK_index = pdmpriv->CCK_index+1;
+				}
+				else
+				{
+					for(i = 0; i < rf; i++)
+						OFDM_index[i] = pdmpriv->OFDM_index[i];
+					CCK_index = pdmpriv->CCK_index;
+				}
+
+#if MP_DRIVER == 1
+				for(i = 0; i < rf; i++)
+				{
+					if(TxPwrLevel[i] >=0 && TxPwrLevel[i] <=26)
+					{
+						if(ThermalValue > pHalData->EEPROMThermalMeter)
+						{
+							if (delta < 5)
+								OFDM_index[i] -= 1;
+							else
+								OFDM_index[i] -= 2;
+						}
+						else if(delta > 5 && ThermalValue < pHalData->EEPROMThermalMeter)
+						{
+							OFDM_index[i] += 1;
+						}
+					}
+					else if (TxPwrLevel[i] >= 27 && TxPwrLevel[i] <= 32 && ThermalValue > pHalData->EEPROMThermalMeter)
+					{
+						if (delta < 5)
+							OFDM_index[i] -= 1;
+						else
+							OFDM_index[i] -= 2;
+					}
+					else if (TxPwrLevel[i] >= 32 && TxPwrLevel[i] <= 38 && ThermalValue > pHalData->EEPROMThermalMeter && delta > 5)
+					{
+						OFDM_index[i] -= 1;
+					}
+				}
+
+				{
+					if(TxPwrLevel[i] >=0 && TxPwrLevel[i] <=26)
+					{
+						if(ThermalValue > pHalData->EEPROMThermalMeter)
+						{
+							if (delta < 5)
+								CCK_index -= 1;
+							else
+								CCK_index -= 2;
+						}
+						else if(delta > 5 && ThermalValue < pHalData->EEPROMThermalMeter)
+						{
+							CCK_index += 1;
+						}
+					}
+					else if (TxPwrLevel[i] >= 27 && TxPwrLevel[i] <= 32 && ThermalValue > pHalData->EEPROMThermalMeter)
+					{
+						if (delta < 5)
+							CCK_index -= 1;
+						else
+							CCK_index -= 2;
+					}
+					else if (TxPwrLevel[i] >= 32 && TxPwrLevel[i] <= 38 && ThermalValue > pHalData->EEPROMThermalMeter && delta > 5)
+					{
+						CCK_index -= 1;
+					}
+				}
+#endif
+			}
+
+			for(i = 0; i < rf; i++)
+			{
+				if(OFDM_index[i] > (OFDM_TABLE_SIZE_92C-1))
+					OFDM_index[i] = (OFDM_TABLE_SIZE_92C-1);
+				else if (OFDM_index[i] < OFDM_min_index)
+					OFDM_index[i] = OFDM_min_index;
+			}
+
+			if(CCK_index > (CCK_TABLE_SIZE-1))
+				CCK_index = (CCK_TABLE_SIZE-1);
+			else if (CCK_index < 0)
+				CCK_index = 0;
+
+			/*if(is2T)
+			{
+				DBG_8192C("new OFDM_A_index=0x%x, OFDM_B_index=0x%x, CCK_index=0x%x\n",
+					OFDM_index[0], OFDM_index[1], CCK_index);
+			}
+			else
+			{
+				DBG_8192C("new OFDM_A_index=0x%x, CCK_index=0x%x\n",
+					OFDM_index[0], CCK_index);
+			}*/
+		}
+
+		if(pdmpriv->TxPowerTrackControl && (delta != 0 || delta_HP != 0))
+		{
+			//Adujst OFDM Ant_A according to IQK result
+			ele_D = (OFDMSwingTable[OFDM_index[0]] & 0xFFC00000)>>22;
+			X = pdmpriv->RegE94;
+			Y = pdmpriv->RegE9C;
+
+			if(X != 0)
+			{
+				if ((X & 0x00000200) != 0)
+					X = X | 0xFFFFFC00;
+				ele_A = ((X * ele_D)>>8)&0x000003FF;
+
+				//new element C = element D x Y
+				if ((Y & 0x00000200) != 0)
+					Y = Y | 0xFFFFFC00;
+				ele_C = ((Y * ele_D)>>8)&0x000003FF;
+
+				//wirte new elements A, C, D to regC80 and regC94, element B is always 0
+				value32 = (ele_D<<22)|((ele_C&0x3F)<<16)|ele_A;
+				PHY_SetBBReg(Adapter, rOFDM0_XATxIQImbalance, bMaskDWord, value32);
+
+				value32 = (ele_C&0x000003C0)>>6;
+				PHY_SetBBReg(Adapter, rOFDM0_XCTxAFE, bMaskH4Bits, value32);
+
+				value32 = ((X * ele_D)>>7)&0x01;
+				PHY_SetBBReg(Adapter, rOFDM0_ECCAThreshold, BIT31, value32);
+
+				value32 = ((Y * ele_D)>>7)&0x01;
+				PHY_SetBBReg(Adapter, rOFDM0_ECCAThreshold, BIT29, value32);
+
+			}
+			else
+			{
+				PHY_SetBBReg(Adapter, rOFDM0_XATxIQImbalance, bMaskDWord, OFDMSwingTable[OFDM_index[0]]);
+				PHY_SetBBReg(Adapter, rOFDM0_XCTxAFE, bMaskH4Bits, 0x00);
+				PHY_SetBBReg(Adapter, rOFDM0_ECCAThreshold, BIT31|BIT29, 0x00);
+			}
+
+			//RTPRINT(FINIT, INIT_IQK, ("TxPwrTracking path A: X = 0x%x, Y = 0x%x ele_A = 0x%x ele_C = 0x%x ele_D = 0x%x\n", X, Y, ele_A, ele_C, ele_D));
+
+			//Adjust CCK according to IQK result
+			if(!pdmpriv->bCCKinCH14){
+				rtw_write8(Adapter, 0xa22, CCKSwingTable_Ch1_Ch13[CCK_index][0]);
+				rtw_write8(Adapter, 0xa23, CCKSwingTable_Ch1_Ch13[CCK_index][1]);
+				rtw_write8(Adapter, 0xa24, CCKSwingTable_Ch1_Ch13[CCK_index][2]);
+				rtw_write8(Adapter, 0xa25, CCKSwingTable_Ch1_Ch13[CCK_index][3]);
+				rtw_write8(Adapter, 0xa26, CCKSwingTable_Ch1_Ch13[CCK_index][4]);
+				rtw_write8(Adapter, 0xa27, CCKSwingTable_Ch1_Ch13[CCK_index][5]);
+				rtw_write8(Adapter, 0xa28, CCKSwingTable_Ch1_Ch13[CCK_index][6]);
+				rtw_write8(Adapter, 0xa29, CCKSwingTable_Ch1_Ch13[CCK_index][7]);
+			}
+			else{
+				rtw_write8(Adapter, 0xa22, CCKSwingTable_Ch14[CCK_index][0]);
+				rtw_write8(Adapter, 0xa23, CCKSwingTable_Ch14[CCK_index][1]);
+				rtw_write8(Adapter, 0xa24, CCKSwingTable_Ch14[CCK_index][2]);
+				rtw_write8(Adapter, 0xa25, CCKSwingTable_Ch14[CCK_index][3]);
+				rtw_write8(Adapter, 0xa26, CCKSwingTable_Ch14[CCK_index][4]);
+				rtw_write8(Adapter, 0xa27, CCKSwingTable_Ch14[CCK_index][5]);
+				rtw_write8(Adapter, 0xa28, CCKSwingTable_Ch14[CCK_index][6]);
+				rtw_write8(Adapter, 0xa29, CCKSwingTable_Ch14[CCK_index][7]);
+			}
+
+			if(is2T)
+			{
+				ele_D = (OFDMSwingTable[(u8)OFDM_index[1]] & 0xFFC00000)>>22;
+
+				//new element A = element D x X
+				X = pdmpriv->RegEB4;
+				Y = pdmpriv->RegEBC;
+
+				if(X != 0){
+					if ((X & 0x00000200) != 0)	//consider minus
+						X = X | 0xFFFFFC00;
+					ele_A = ((X * ele_D)>>8)&0x000003FF;
+
+					//new element C = element D x Y
+					if ((Y & 0x00000200) != 0)
+						Y = Y | 0xFFFFFC00;
+					ele_C = ((Y * ele_D)>>8)&0x00003FF;
+
+					//wirte new elements A, C, D to regC88 and regC9C, element B is always 0
+					value32=(ele_D<<22)|((ele_C&0x3F)<<16) |ele_A;
+					PHY_SetBBReg(Adapter, rOFDM0_XBTxIQImbalance, bMaskDWord, value32);
+
+					value32 = (ele_C&0x000003C0)>>6;
+					PHY_SetBBReg(Adapter, rOFDM0_XDTxAFE, bMaskH4Bits, value32);
+
+					value32 = ((X * ele_D)>>7)&0x01;
+					PHY_SetBBReg(Adapter, rOFDM0_ECCAThreshold, BIT27, value32);
+
+					value32 = ((Y * ele_D)>>7)&0x01;
+					PHY_SetBBReg(Adapter, rOFDM0_ECCAThreshold, BIT25, value32);
+
+				}
+				else{
+					PHY_SetBBReg(Adapter, rOFDM0_XBTxIQImbalance, bMaskDWord, OFDMSwingTable[OFDM_index[1]]);
+					PHY_SetBBReg(Adapter, rOFDM0_XDTxAFE, bMaskH4Bits, 0x00);
+					PHY_SetBBReg(Adapter, rOFDM0_ECCAThreshold, BIT27|BIT25, 0x00);
+				}
+
+				//DBG_8192C("TxPwrTracking path B: X = 0x%x, Y = 0x%x ele_A = 0x%x ele_C = 0x%x ele_D = 0x%x\n", X, Y, ele_A, ele_C, ele_D);
+			}
+
+			/*
+			DBG_8192C("TxPwrTracking 0xc80 = 0x%x, 0xc94 = 0x%x RF 0x24 = 0x%x\n", \
+					PHY_QueryBBReg(Adapter, 0xc80, bMaskDWord),\
+					PHY_QueryBBReg(Adapter, 0xc94, bMaskDWord), \
+					PHY_QueryRFReg(Adapter, RF_PATH_A, 0x24, bMaskDWord));
+			*/
+		}
+
+#if MP_DRIVER == 1
+		if(delta_IQK > 1)
+#else
+		if(delta_IQK > 3)
+#endif
+		{
+			pdmpriv->ThermalValue_IQK = ThermalValue;
+			rtl8192c_PHY_IQCalibrate(Adapter,_FALSE);
+		}
+
+		//update thermal meter value
+		if(pdmpriv->TxPowerTrackControl)
+			pdmpriv->ThermalValue = ThermalValue;
+
+	}
+
+	//DBG_8192C("<===dm_TXPowerTrackingCallback_ThermalMeter_92C\n");
+
+	pdmpriv->TXPowercount = 0;
+
+}
+
+
+static	VOID
+dm_InitializeTXPowerTracking_ThermalMeter(
+	IN	PADAPTER		Adapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+	//pMgntInfo->bTXPowerTracking = _TRUE;
+	pdmpriv->TXPowercount = 0;
+	pdmpriv->bTXPowerTrackingInit = _FALSE;
+	pdmpriv->ThermalValue = 0;
+
+#if	(MP_DRIVER != 1)	//for mp driver, turn off txpwrtracking as default
+	pdmpriv->TxPowerTrackControl = _TRUE;
+#endif
+
+	MSG_8192C("pdmpriv->TxPowerTrackControl = %d\n", pdmpriv->TxPowerTrackControl);
+}
+
+
+static VOID
+DM_InitializeTXPowerTracking(
+	IN	PADAPTER		Adapter)
+{
+	dm_InitializeTXPowerTracking_ThermalMeter(Adapter);
+}
+
+//
+//	Description:
+//		- Dispatch TxPower Tracking direct call ONLY for 92s.
+//		- We shall NOT schedule Workitem within PASSIVE LEVEL, which will cause system resource
+//		   leakage under some platform.
+//
+//	Assumption:
+//		PASSIVE_LEVEL when this routine is called.
+//
+//	Added by Roger, 2009.06.18.
+//
+static VOID
+DM_TXPowerTracking92CDirectCall(
+            IN	PADAPTER		Adapter)
+{
+	dm_TXPowerTrackingCallback_ThermalMeter_92C(Adapter);
+}
+
+static VOID
+dm_CheckTXPowerTracking_ThermalMeter(
+	IN	PADAPTER		Adapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	//u1Byte					TxPowerCheckCnt = 5;	//10 sec
+
+	//if(!pMgntInfo->bTXPowerTracking /*|| (!pdmpriv->TxPowerTrackControl && pdmpriv->bAPKdone)*/)
+	if(!(pdmpriv->DMFlag & DYNAMIC_FUNC_SS))
+	{
+		return;
+	}
+
+	if(!pdmpriv->TM_Trigger)		//at least delay 1 sec
+	{
+		//pHalData->TxPowerCheckCnt++;	//cosa add for debug
+		PHY_SetRFReg(Adapter, RF_PATH_A, RF_T_METER, bRFRegOffsetMask, 0x60);
+		//DBG_8192C("Trigger 92C Thermal Meter!!\n");
+
+		pdmpriv->TM_Trigger = 1;
+		return;
+
+	}
+	else
+	{
+		//DBG_8192C("Schedule TxPowerTracking direct call!!\n");
+		DM_TXPowerTracking92CDirectCall(Adapter); //Using direct call is instead, added by Roger, 2009.06.18.
+		pdmpriv->TM_Trigger = 0;
+	}
+
+}
+
+
+VOID
+rtl8192c_dm_CheckTXPowerTracking(
+	IN	PADAPTER		Adapter)
+{
+	dm_CheckTXPowerTracking_ThermalMeter(Adapter);
+}
+
+#ifdef CONFIG_BT_COEXIST
+static BOOLEAN BT_BTStateChange(PADAPTER Adapter)
+{
+	PHAL_DATA_TYPE		pHalData = GET_HAL_DATA(Adapter);
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+	struct registry_priv	*registry_par = &Adapter->registrypriv;
+
+	struct mlme_priv *pmlmepriv = &(Adapter->mlmepriv);
+
+	u32 		Polling, Ratio_Tx, Ratio_PRI;
+	u32 			BT_Tx, BT_PRI;
+	u8			BT_State;
+	static u8		ServiceTypeCnt = 0;
+	u8			CurServiceType;
+	static u8		LastServiceType = BT_Idle;
+
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _FALSE)
+		return _FALSE;
+
+	BT_State = rtw_read8(Adapter, 0x4fd);
+/*
+	temp = PlatformEFIORead4Byte(Adapter, 0x488);
+	BT_Tx = (u2Byte)(((temp<<8)&0xff00)+((temp>>8)&0xff));
+	BT_PRI = (u2Byte)(((temp>>8)&0xff00)+((temp>>24)&0xff));
+
+	temp = PlatformEFIORead4Byte(Adapter, 0x48c);
+	Polling = ((temp<<8)&0xff000000) + ((temp>>8)&0x00ff0000) +
+			((temp<<8)&0x0000ff00) + ((temp>>8)&0x000000ff);
+
+*/
+	BT_Tx = rtw_read32(Adapter, 0x488);
+
+	DBG_8192C("Ratio 0x488  =%x\n", BT_Tx);
+	BT_Tx =BT_Tx & 0x00ffffff;
+	//RTPRINT(FBT, BT_TRACE, ("Ratio BT_Tx  =%x\n", BT_Tx));
+
+	BT_PRI = rtw_read32(Adapter, 0x48c);
+
+	DBG_8192C("Ratio 0x48c  =%x\n", BT_PRI);
+	BT_PRI =BT_PRI & 0x00ffffff;
+	//RTPRINT(FBT, BT_TRACE, ("Ratio BT_PRI  =%x\n", BT_PRI));
+
+
+	Polling = rtw_read32(Adapter, 0x490);
+	//RTPRINT(FBT, BT_TRACE, ("Ratio 0x490  =%x\n", Polling));
+
+
+	if(BT_Tx==0xffffffff && BT_PRI==0xffffffff && Polling==0xffffffff && BT_State==0xff)
+		return _FALSE;
+
+	BT_State &= BIT0;
+
+	if(BT_State != pbtpriv->BT_CUR_State)
+	{
+		pbtpriv->BT_CUR_State = BT_State;
+
+		if(registry_par->bt_sco == 3)
+		{
+			ServiceTypeCnt = 0;
+
+			pbtpriv->BT_Service = BT_Idle;
+
+			DBG_8192C("BT_%s\n", BT_State?"ON":"OFF");
+
+			BT_State = BT_State |
+					((pbtpriv->BT_Ant_isolation==1)?0:BIT1) |BIT2;
+
+			rtw_write8(Adapter, 0x4fd, BT_State);
+			DBG_8192C("BT set 0x4fd to %x\n", BT_State);
+		}
+
+		return _TRUE;
+	}
+	DBG_8192C("bRegBT_Sco =  %d\n",registry_par->bt_sco);
+
+	Ratio_Tx = BT_Tx*1000/Polling;
+	Ratio_PRI = BT_PRI*1000/Polling;
+
+	pbtpriv->Ratio_Tx=Ratio_Tx;
+	pbtpriv->Ratio_PRI=Ratio_PRI;
+
+	DBG_8192C("Ratio_Tx=%d\n", Ratio_Tx);
+	DBG_8192C("Ratio_PRI=%d\n", Ratio_PRI);
+
+
+	if(BT_State && registry_par->bt_sco==3)
+	{
+		DBG_8192C("bt_sco  ==3 Follow Counter\n");
+//		if(BT_Tx==0xffff && BT_PRI==0xffff && Polling==0xffffffff)
+//		{
+//			ServiceTypeCnt = 0;
+//			return FALSE;
+//		}
+//		else
+		{
+		/*
+			Ratio_Tx = BT_Tx*1000/Polling;
+			Ratio_PRI = BT_PRI*1000/Polling;
+
+			pHalData->bt_coexist.Ratio_Tx=Ratio_Tx;
+			pHalData->bt_coexist.Ratio_PRI=Ratio_PRI;
+
+			RTPRINT(FBT, BT_TRACE, ("Ratio_Tx=%d\n", Ratio_Tx));
+			RTPRINT(FBT, BT_TRACE, ("Ratio_PRI=%d\n", Ratio_PRI));
+
+		*/
+			if((Ratio_Tx < 30)  && (Ratio_PRI < 30))
+				CurServiceType = BT_Idle;
+			else if((Ratio_PRI > 110) && (Ratio_PRI < 250))
+				CurServiceType = BT_SCO;
+			else if((Ratio_Tx >= 200)&&(Ratio_PRI >= 200))
+				CurServiceType = BT_Busy;
+			else if((Ratio_Tx >=350) && (Ratio_Tx < 500))
+				CurServiceType = BT_OtherBusy;
+			else if(Ratio_Tx >=500)
+				CurServiceType = BT_PAN;
+			else
+				CurServiceType=BT_OtherAction;
+		}
+
+/*		if(pHalData->bt_coexist.bStopCount)
+		{
+			ServiceTypeCnt=0;
+			pHalData->bt_coexist.bStopCount=FALSE;
+		}
+*/
+//		if(CurServiceType == BT_OtherBusy)
+		{
+			ServiceTypeCnt=2;
+			LastServiceType=CurServiceType;
+		}
+#if 0
+		else if(CurServiceType == LastServiceType)
+		{
+			if(ServiceTypeCnt<3)
+				ServiceTypeCnt++;
+		}
+		else
+		{
+			ServiceTypeCnt = 0;
+			LastServiceType = CurServiceType;
+		}
+#endif
+
+		if(ServiceTypeCnt==2)
+		{
+			pbtpriv->BT_Service = LastServiceType;
+			BT_State = BT_State |
+					((pbtpriv->BT_Ant_isolation==1)?0:BIT1) |
+					//((pbtpriv->BT_Service==BT_SCO)?0:BIT2);
+					((pbtpriv->BT_Service!=BT_Idle)?0:BIT2);
+
+			//if(pbtpriv->BT_Service==BT_Busy)
+			//	BT_State&= ~(BIT2);
+
+			if(pbtpriv->BT_Service==BT_SCO)
+			{
+				DBG_8192C("BT TYPE Set to  ==> BT_SCO\n");
+			}
+			else if(pbtpriv->BT_Service==BT_Idle)
+			{
+				DBG_8192C("BT TYPE Set to  ==> BT_Idle\n");
+			}
+			else if(pbtpriv->BT_Service==BT_OtherAction)
+			{
+				DBG_8192C("BT TYPE Set to  ==> BT_OtherAction\n");
+			}
+			else if(pbtpriv->BT_Service==BT_Busy)
+			{
+				DBG_8192C("BT TYPE Set to  ==> BT_Busy\n");
+			}
+			else if(pbtpriv->BT_Service==BT_PAN)
+			{
+				DBG_8192C("BT TYPE Set to  ==> BT_PAN\n");
+			}
+			else
+			{
+				DBG_8192C("BT TYPE Set to ==> BT_OtherBusy\n");
+			}
+
+			//Add interrupt migration when bt is not in idel state (no traffic).
+			//suggestion by Victor.
+			if(pbtpriv->BT_Service!=BT_Idle)//EDCA_VI_PARAM modify
+			{
+
+				rtw_write16(Adapter, 0x504, 0x0ccc);
+				rtw_write8(Adapter, 0x506, 0x54);
+				rtw_write8(Adapter, 0x507, 0x54);
+
+			}
+			else
+			{
+				rtw_write8(Adapter, 0x506, 0x00);
+				rtw_write8(Adapter, 0x507, 0x00);
+			}
+
+			rtw_write8(Adapter, 0x4fd, BT_State);
+			DBG_8192C("BT_SCO set 0x4fd to %x\n", BT_State);
+			return _TRUE;
+		}
+	}
+
+	return _FALSE;
+
+}
+
+static BOOLEAN
+BT_WifiConnectChange(
+	IN	PADAPTER	Adapter
+	)
+{
+	struct mlme_priv *pmlmepriv = &(Adapter->mlmepriv);
+//	PMGNT_INFO		pMgntInfo = &Adapter->MgntInfo;
+	static BOOLEAN	bMediaConnect = _FALSE;
+
+	//if(!pMgntInfo->bMediaConnect || MgntRoamingInProgress(pMgntInfo))
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _FALSE)
+	{
+		bMediaConnect = _FALSE;
+	}
+	else
+	{
+		if(!bMediaConnect)
+		{
+			bMediaConnect = _TRUE;
+			return _TRUE;
+		}
+		bMediaConnect = _TRUE;
+	}
+
+	return _FALSE;
+}
+
+#define BT_RSSI_STATE_NORMAL_POWER	BIT0
+#define BT_RSSI_STATE_AMDPU_OFF		BIT1
+#define BT_RSSI_STATE_SPECIAL_LOW	BIT2
+#define BT_RSSI_STATE_BG_EDCA_LOW	BIT3
+
+static s32 GET_UNDECORATED_AVERAGE_RSSI(PADAPTER	Adapter)
+{
+	PHAL_DATA_TYPE	pHalData = GET_HAL_DATA(Adapter);
+	struct mlme_priv	*pmlmepriv = &(Adapter->mlmepriv);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	s32 	average_rssi;
+
+	if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE|WIFI_AP_STATE))
+	{
+		average_rssi = 	pdmpriv->EntryMinUndecoratedSmoothedPWDB;
+	}
+	else
+	{
+		average_rssi = 	pdmpriv->UndecoratedSmoothedPWDB;
+	}
+	return average_rssi;
+}
+
+static u8 BT_RssiStateChange(
+	IN	PADAPTER	Adapter
+	)
+{
+	PHAL_DATA_TYPE		pHalData = GET_HAL_DATA(Adapter);
+	struct mlme_priv		*pmlmepriv = &(Adapter->mlmepriv);
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+	struct dm_priv		*pdmpriv = &pHalData->dmpriv;
+	//PMGNT_INFO		pMgntInfo = &Adapter->MgntInfo;
+	s32			UndecoratedSmoothedPWDB;
+	u8			CurrBtRssiState = 0x00;
+
+
+
+
+	//if(pMgntInfo->bMediaConnect)	// Default port
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+	{
+		UndecoratedSmoothedPWDB = GET_UNDECORATED_AVERAGE_RSSI(Adapter);
+	}
+	else // associated entry pwdb
+	{
+		if(pdmpriv->EntryMinUndecoratedSmoothedPWDB == 0)
+			UndecoratedSmoothedPWDB = 100;	// No any RSSI information. Assume to be MAX.
+		else
+			UndecoratedSmoothedPWDB = pdmpriv->EntryMinUndecoratedSmoothedPWDB;
+	}
+
+	// Check RSSI to determine HighPower/NormalPower state for BT coexistence.
+	if(UndecoratedSmoothedPWDB >= 67)
+		CurrBtRssiState &= (~BT_RSSI_STATE_NORMAL_POWER);
+	else if(UndecoratedSmoothedPWDB < 62)
+		CurrBtRssiState |= BT_RSSI_STATE_NORMAL_POWER;
+
+	// Check RSSI to determine AMPDU setting for BT coexistence.
+	if(UndecoratedSmoothedPWDB >= 40)
+		CurrBtRssiState &= (~BT_RSSI_STATE_AMDPU_OFF);
+	else if(UndecoratedSmoothedPWDB <= 32)
+		CurrBtRssiState |= BT_RSSI_STATE_AMDPU_OFF;
+
+	// Marked RSSI state. It will be used to determine BT coexistence setting later.
+	if(UndecoratedSmoothedPWDB < 35)
+		CurrBtRssiState |=  BT_RSSI_STATE_SPECIAL_LOW;
+	else
+		CurrBtRssiState &= (~BT_RSSI_STATE_SPECIAL_LOW);
+
+	// Check BT state related to BT_Idle in B/G mode.
+	if(UndecoratedSmoothedPWDB < 15)
+		CurrBtRssiState |=  BT_RSSI_STATE_BG_EDCA_LOW;
+	else
+		CurrBtRssiState &= (~BT_RSSI_STATE_BG_EDCA_LOW);
+
+	if(CurrBtRssiState != pbtpriv->BtRssiState)
+	{
+		pbtpriv->BtRssiState = CurrBtRssiState;
+		return _TRUE;
+	}
+	else
+	{
+		return _FALSE;
+	}
+}
+
+static void dm_BTCoexist(PADAPTER Adapter )
+{
+	HAL_DATA_TYPE			*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv			*pdmpriv = &pHalData->dmpriv;
+	struct mlme_priv	 		*pmlmepriv = &(Adapter->mlmepriv);
+	struct mlme_ext_info		*pmlmeinfo = &Adapter->mlmeextpriv.mlmext_info;
+	struct mlme_ext_priv		*pmlmeext = &Adapter->mlmeextpriv;
+
+	struct btcoexist_priv		*pbtpriv = &(pHalData->bt_coexist);
+	//PMGNT_INFO				pMgntInfo = &Adapter->MgntInfo;
+	//PRT_HIGH_THROUGHPUT		pHTInfo = GET_HT_INFO(pMgntInfo);
+
+	//PRX_TS_RECORD	pRxTs = NULL;
+	u8			BT_gpio_mux;
+
+	BOOLEAN		bWifiConnectChange, bBtStateChange,bRssiStateChange;
+
+	if(pbtpriv->bCOBT == _FALSE)		return;
+
+	if(!( pdmpriv->DMFlag & DYNAMIC_FUNC_BT)) return;
+
+	if( (pbtpriv->BT_Coexist) &&(pbtpriv->BT_CoexistType == BT_CSR_BC4) && (check_fwstate(pmlmepriv, WIFI_AP_STATE) == _FALSE)	)
+	{
+		bWifiConnectChange = BT_WifiConnectChange(Adapter);
+		bBtStateChange	= BT_BTStateChange(Adapter);
+		bRssiStateChange 	= BT_RssiStateChange(Adapter);
+
+		DBG_8192C("bWifiConnectChange %d, bBtStateChange  %d,bRssiStateChange  %d\n",
+			bWifiConnectChange,bBtStateChange,bRssiStateChange);
+
+		// add by hpfan for debug message
+		BT_gpio_mux = rtw_read8(Adapter, REG_GPIO_MUXCFG);
+		DBG_8192C("BTCoexit Reg_0x40 (%2x)\n", BT_gpio_mux);
+
+		if( bWifiConnectChange ||bBtStateChange  ||bRssiStateChange )
+		{
+			if(pbtpriv->BT_CUR_State)
+			{
+
+				// Do not allow receiving A-MPDU aggregation.
+				if(pbtpriv->BT_Ampdu)// 0:Disable BT control A-MPDU, 1:Enable BT control A-MPDU.
+				{
+
+					if(pmlmeinfo->assoc_AP_vendor == ciscoAP)
+					{
+						if(pbtpriv->BT_Service!=BT_Idle)
+						{
+							if(pmlmeinfo->bAcceptAddbaReq)
+							{
+								DBG_8192C("BT_Disallow AMPDU \n");
+								pmlmeinfo->bAcceptAddbaReq = _FALSE;
+								send_delba(Adapter,0, get_my_bssid(&(pmlmeinfo->network)));
+							}
+						}
+						else
+						{
+							if(!pmlmeinfo->bAcceptAddbaReq)
+							{
+								DBG_8192C("BT_Allow AMPDU  RSSI >=40\n");
+								pmlmeinfo->bAcceptAddbaReq = _TRUE;
+							}
+						}
+					}
+					else
+					{
+						if(!pmlmeinfo->bAcceptAddbaReq)
+						{
+							DBG_8192C("BT_Allow AMPDU BT Idle\n");
+							pmlmeinfo->bAcceptAddbaReq = _TRUE;
+						}
+					}
+				}
+
+#if 0
+				else if((pHalData->bt_coexist.BT_Service==BT_SCO) || (pHalData->bt_coexist.BT_Service==BT_Busy))
+				{
+					if(pHalData->bt_coexist.BtRssiState & BT_RSSI_STATE_AMDPU_OFF)
+					{
+						if(pMgntInfo->bBT_Ampdu && pHTInfo->bAcceptAddbaReq)
+						{
+							RTPRINT(FBT, BT_TRACE, ("BT_Disallow AMPDU RSSI <=32\n"));
+							pHTInfo->bAcceptAddbaReq = FALSE;
+							if(GetTs(Adapter, (PTS_COMMON_INFO*)(&pRxTs), pMgntInfo->Bssid, 0, RX_DIR, FALSE))
+								TsInitDelBA(Adapter, (PTS_COMMON_INFO)pRxTs, RX_DIR);
+						}
+					}
+					else
+					{
+						if(pMgntInfo->bBT_Ampdu && !pHTInfo->bAcceptAddbaReq)
+						{
+							RTPRINT(FBT, BT_TRACE, ("BT_Allow AMPDU  RSSI >=40\n"));
+							pHTInfo->bAcceptAddbaReq = TRUE;
+						}
+					}
+				}
+				else
+				{
+					if(pMgntInfo->bBT_Ampdu && !pHTInfo->bAcceptAddbaReq)
+					{
+						RTPRINT(FBT, BT_TRACE, ("BT_Allow AMPDU BT not in SCO or BUSY\n"));
+						pHTInfo->bAcceptAddbaReq = TRUE;
+					}
+				}
+#endif
+
+				if(pbtpriv->BT_Ant_isolation)
+				{
+					DBG_8192C("BT_IsolationLow\n");
+
+// 20100427 Joseph: Do not adjust Rate adaptive for BT coexist suggested by SD3.
+#if 0
+					RTPRINT(FBT, BT_TRACE, ("BT_Update Rate table\n"));
+					if(pMgntInfo->bUseRAMask)
+					{
+						// 20100407 Joseph: Fix rate adaptive modification for BT coexist.
+						// This fix is not complete yet. It shall also consider VWifi and Adhoc case,
+						// which connect with multiple STAs.
+						Adapter->HalFunc.UpdateHalRAMaskHandler(
+												Adapter,
+												FALSE,
+												0,
+												NULL,
+												NULL,
+												pMgntInfo->RateAdaptive.RATRState,
+												RAMask_Normal);
+					}
+					else
+					{
+						Adapter->HalFunc.UpdateHalRATRTableHandler(
+									Adapter,
+									&pMgntInfo->dot11OperationalRateSet,
+									pMgntInfo->dot11HTOperationalRateSet,NULL);
+					}
+#endif
+
+					// 20100415 Joseph: Modify BT coexist mechanism suggested by Yaying.
+					// Now we only enable HW BT coexist when BT in "Busy" state.
+					if(1)//pMgntInfo->LinkDetectInfo.NumRecvDataInPeriod >= 20)
+					{
+						if((pmlmeinfo->assoc_AP_vendor == ciscoAP)	&&
+							pbtpriv->BT_Service==BT_OtherAction)
+						{
+							DBG_8192C("BT_Turn ON Coexist\n");
+							rtw_write8(Adapter, REG_GPIO_MUXCFG, 0xa0);
+						}
+						else
+						{
+							if((pbtpriv->BT_Service==BT_Busy) &&
+								(pbtpriv->BtRssiState & BT_RSSI_STATE_NORMAL_POWER))
+							{
+								DBG_8192C("BT_Turn ON Coexist\n");
+								rtw_write8(Adapter, REG_GPIO_MUXCFG, 0xa0);
+							}
+							else if((pbtpriv->BT_Service==BT_OtherAction) &&
+									(pbtpriv->BtRssiState & BT_RSSI_STATE_SPECIAL_LOW))
+							{
+								DBG_8192C("BT_Turn ON Coexist\n");
+								rtw_write8(Adapter, REG_GPIO_MUXCFG, 0xa0);
+							}
+							else if(pbtpriv->BT_Service==BT_PAN)
+							{
+								DBG_8192C("BT_Turn ON Coexist\n");
+								rtw_write8(Adapter, REG_GPIO_MUXCFG, 0x00);
+							}
+							else
+							{
+								DBG_8192C("BT_Turn OFF Coexist\n");
+								rtw_write8(Adapter, REG_GPIO_MUXCFG, 0x00);
+							}
+						}
+					}
+					else
+					{
+						DBG_8192C("BT: There is no Wifi traffic!! Turn off Coexist\n");
+						rtw_write8(Adapter, REG_GPIO_MUXCFG, 0x00);
+					}
+
+					if(1)//pMgntInfo->LinkDetectInfo.NumRecvDataInPeriod >= 20)
+					{
+						if(pbtpriv->BT_Service==BT_PAN)
+						{
+							DBG_8192C("BT_Turn ON Coexist(Reg0x44 = 0x10100)\n");
+							rtw_write32(Adapter, REG_GPIO_PIN_CTRL, 0x10100);
+						}
+						else
+						{
+							DBG_8192C("BT_Turn OFF Coexist(Reg0x44 = 0x0)\n");
+							rtw_write32(Adapter, REG_GPIO_PIN_CTRL, 0x0);
+						}
+					}
+					else
+					{
+						DBG_8192C("BT: There is no Wifi traffic!! Turn off Coexist(Reg0x44 = 0x0)\n");
+						rtw_write32(Adapter, REG_GPIO_PIN_CTRL, 0x0);
+					}
+
+					// 20100430 Joseph: Integrate the BT coexistence EDCA tuning here.
+					if(pbtpriv->BtRssiState & BT_RSSI_STATE_NORMAL_POWER)
+					{
+						if(pbtpriv->BT_Service==BT_OtherBusy)
+						{
+							//pbtpriv->BtEdcaUL = 0x5ea72b;
+							//pbtpriv->BtEdcaDL = 0x5ea72b;
+							pbtpriv->BT_EDCA[UP_LINK] = 0x5ea72b;
+							pbtpriv->BT_EDCA[DOWN_LINK] = 0x5ea72b;
+
+							DBG_8192C("BT in BT_OtherBusy state Tx (%d) >350 parameter(0x%x) = 0x%x\n", pbtpriv->Ratio_Tx ,REG_EDCA_BE_PARAM, 0x5ea72b);
+						}
+						else if(pbtpriv->BT_Service==BT_Busy)
+						{
+							//pbtpriv->BtEdcaUL = 0x5eb82f;
+							//pbtpriv->BtEdcaDL = 0x5eb82f;
+
+							pbtpriv->BT_EDCA[UP_LINK] = 0x5eb82f;
+							pbtpriv->BT_EDCA[DOWN_LINK] = 0x5eb82f;
+
+							DBG_8192C("BT in BT_Busy state parameter(0x%x) = 0x%x\n", REG_EDCA_BE_PARAM, 0x5eb82f);
+						}
+						else if(pbtpriv->BT_Service==BT_SCO)
+						{
+							if(pbtpriv->Ratio_Tx>160)
+							{
+								//pbtpriv->BtEdcaUL = 0x5ea72f;
+								//pbtpriv->BtEdcaDL = 0x5ea72f;
+								pbtpriv->BT_EDCA[UP_LINK] = 0x5ea72f;
+								pbtpriv->BT_EDCA[DOWN_LINK] = 0x5ea72f;
+								DBG_8192C("BT in BT_SCO state Tx (%d) >160 parameter(0x%x) = 0x%x\n",pbtpriv->Ratio_Tx, REG_EDCA_BE_PARAM, 0x5ea72f);
+							}
+							else
+							{
+								//pbtpriv->BtEdcaUL = 0x5ea32b;
+								//pbtpriv->BtEdcaDL = 0x5ea42b;
+
+								pbtpriv->BT_EDCA[UP_LINK] = 0x5ea32b;
+								pbtpriv->BT_EDCA[DOWN_LINK] = 0x5ea42b;
+
+								DBG_8192C("BT in BT_SCO state Tx (%d) <160 parameter(0x%x) = 0x%x\n", pbtpriv->Ratio_Tx,REG_EDCA_BE_PARAM, 0x5ea32f);
+							}
+						}
+						else
+						{
+							// BT coexistence mechanism does not control EDCA parameter.
+							//pbtpriv->BtEdcaUL = 0;
+							//pbtpriv->BtEdcaDL = 0;
+
+							pbtpriv->BT_EDCA[UP_LINK] = 0;
+							pbtpriv->BT_EDCA[DOWN_LINK] = 0;
+							DBG_8192C("BT in  State  %d  and parameter(0x%x) use original setting.\n",pbtpriv->BT_Service, REG_EDCA_BE_PARAM);
+						}
+
+						if((pbtpriv->BT_Service!=BT_Idle) &&
+							(pmlmeext->cur_wireless_mode  == WIRELESS_MODE_G) &&
+							(pbtpriv->BtRssiState & BT_RSSI_STATE_BG_EDCA_LOW))
+						{
+							//pbtpriv->BtEdcaUL = 0x5eb82b;
+							//pbtpriv->BtEdcaDL = 0x5eb82b;
+
+							pbtpriv->BT_EDCA[UP_LINK] = 0x5eb82b;
+							pbtpriv->BT_EDCA[DOWN_LINK] = 0x5eb82b;
+
+							DBG_8192C("BT set parameter(0x%x) = 0x%x\n", REG_EDCA_BE_PARAM, 0x5eb82b);
+						}
+					}
+					else
+					{
+						// BT coexistence mechanism does not control EDCA parameter.
+						//pbtpriv->BtEdcaUL = 0;
+						//pbtpriv->BtEdcaDL = 0;
+
+						pbtpriv->BT_EDCA[UP_LINK] = 0;
+						pbtpriv->BT_EDCA[DOWN_LINK] = 0;
+					}
+
+					// 20100415 Joseph: Set RF register 0x1E and 0x1F for BT coexist suggested by Yaying.
+					if(pbtpriv->BT_Service!=BT_Idle)
+					{
+						DBG_8192C("BT Set RfReg0x1E[7:4] = 0x%x \n", 0xf);
+						PHY_SetRFReg(Adapter, PathA, 0x1e, 0xf0, 0xf);
+						//RTPRINT(FBT, BT_TRACE, ("BT Set RfReg0x1E[7:4] = 0x%x \n", 0xf));
+						//PHY_SetRFReg(Adapter, PathA, 0x1f, 0xf0, 0xf);
+					}
+					else
+					{
+						DBG_8192C("BT Set RfReg0x1E[7:4] = 0x%x \n",pbtpriv->BtRfRegOrigin1E);
+						PHY_SetRFReg(Adapter, PathA, 0x1e, 0xf0, pbtpriv->BtRfRegOrigin1E);
+						//RTPRINT(FBT, BT_TRACE, ("BT Set RfReg0x1F[7:4] = 0x%x \n", pHalData->bt_coexist.BtRfRegOrigin1F));
+						//PHY_SetRFReg(Adapter, PathA, 0x1f, 0xf0, pHalData->bt_coexist.BtRfRegOrigin1F);
+					}
+				}
+				else
+				{
+					DBG_8192C("BT_IsolationHigh\n");
+					// Do nothing.
+				}
+			}
+			else
+			{
+
+				if(pbtpriv->BT_Ampdu && !pmlmeinfo->bAcceptAddbaReq)
+				{
+					DBG_8192C("BT_Allow AMPDU bt is off\n");
+					pmlmeinfo->bAcceptAddbaReq = _TRUE;
+				}
+
+				DBG_8192C("BT_Turn OFF Coexist bt is off \n");
+				rtw_write8(Adapter, REG_GPIO_MUXCFG, 0x00);
+
+				DBG_8192C("BT Set RfReg0x1E[7:4] = 0x%x \n", pbtpriv->BtRfRegOrigin1E);
+				PHY_SetRFReg(Adapter, PathA, 0x1e, 0xf0, pbtpriv->BtRfRegOrigin1E);
+				//RTPRINT(FBT, BT_TRACE, ("BT Set RfReg0x1F[7:4] = 0x%x \n", pHalData->bt_coexist.BtRfRegOrigin1F));
+				//PHY_SetRFReg(Adapter, PathA, 0x1f, 0xf0, pHalData->bt_coexist.BtRfRegOrigin1F);
+
+				// BT coexistence mechanism does not control EDCA parameter since BT is disabled.
+				//pbtpriv->BtEdcaUL = 0;
+				//pbtpriv->BtEdcaDL = 0;
+				pbtpriv->BT_EDCA[UP_LINK] = 0;
+				pbtpriv->BT_EDCA[DOWN_LINK] = 0;
+
+
+// 20100427 Joseph: Do not adjust Rate adaptive for BT coexist suggested by SD3.
+#if 0
+				RTPRINT(FBT, BT_TRACE, ("BT_Update Rate table\n"));
+				if(pMgntInfo->bUseRAMask)
+				{
+					// 20100407 Joseph: Fix rate adaptive modification for BT coexist.
+					// This fix is not complete yet. It shall also consider VWifi and Adhoc case,
+					// which connect with multiple STAs.
+					Adapter->HalFunc.UpdateHalRAMaskHandler(
+											Adapter,
+											FALSE,
+											0,
+											NULL,
+											NULL,
+											pMgntInfo->RateAdaptive.RATRState,
+											RAMask_Normal);
+				}
+				else
+				{
+					Adapter->HalFunc.UpdateHalRATRTableHandler(
+								Adapter,
+								&pMgntInfo->dot11OperationalRateSet,
+								pMgntInfo->dot11HTOperationalRateSet,NULL);
+				}
+#endif
+			}
+		}
+	}
+}
+
+static void dm_InitBtCoexistDM(	PADAPTER	Adapter)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+
+	if( !pbtpriv->BT_Coexist ) return;
+
+	pbtpriv->BtRfRegOrigin1E = (u8)PHY_QueryRFReg(Adapter, PathA, 0x1e, 0xf0);
+	pbtpriv->BtRfRegOrigin1F = (u8)PHY_QueryRFReg(Adapter, PathA, 0x1f, 0xf0);
+}
+
+void rtl8192c_set_dm_bt_coexist(_adapter *padapter, u8 bStart)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(padapter);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+
+	pbtpriv->bCOBT = bStart;
+	send_delba(padapter,0, get_my_bssid(&(pmlmeinfo->network)));
+	send_delba(padapter,1, get_my_bssid(&(pmlmeinfo->network)));
+
+}
+
+void rtl8192c_issue_delete_ba(_adapter *padapter, u8 dir)
+{
+	struct mlme_ext_info		*pmlmeinfo = &padapter->mlmeextpriv.mlmext_info;
+	DBG_8192C("issue_delete_ba : %s...\n",(dir==0)?"RX_DIR":"TX_DIR");
+	send_delba(padapter,dir, get_my_bssid(&(pmlmeinfo->network)));
+}
+
+#endif
+
+#if 0//def CONFIG_PCI_HCI
+
+BOOLEAN
+BT_BTStateChange(
+	IN	PADAPTER	Adapter
+	)
+{
+	PHAL_DATA_TYPE	pHalData = GET_HAL_DATA(Adapter);
+	PMGNT_INFO		pMgntInfo = &Adapter->MgntInfo;
+
+	u4Byte 			temp, Polling, Ratio_Tx, Ratio_PRI;
+	u4Byte 			BT_Tx, BT_PRI;
+	u1Byte			BT_State;
+	static u1Byte		ServiceTypeCnt = 0;
+	u1Byte			CurServiceType;
+	static u1Byte		LastServiceType = BT_Idle;
+
+	if(!pMgntInfo->bMediaConnect)
+		return FALSE;
+
+	BT_State = PlatformEFIORead1Byte(Adapter, 0x4fd);
+/*
+	temp = PlatformEFIORead4Byte(Adapter, 0x488);
+	BT_Tx = (u2Byte)(((temp<<8)&0xff00)+((temp>>8)&0xff));
+	BT_PRI = (u2Byte)(((temp>>8)&0xff00)+((temp>>24)&0xff));
+
+	temp = PlatformEFIORead4Byte(Adapter, 0x48c);
+	Polling = ((temp<<8)&0xff000000) + ((temp>>8)&0x00ff0000) +
+			((temp<<8)&0x0000ff00) + ((temp>>8)&0x000000ff);
+
+*/
+	BT_Tx = PlatformEFIORead4Byte(Adapter, 0x488);
+
+	RTPRINT(FBT, BT_TRACE, ("Ratio 0x488  =%x\n", BT_Tx));
+	BT_Tx =BT_Tx & 0x00ffffff;
+	//RTPRINT(FBT, BT_TRACE, ("Ratio BT_Tx  =%x\n", BT_Tx));
+
+	BT_PRI = PlatformEFIORead4Byte(Adapter, 0x48c);
+
+	RTPRINT(FBT, BT_TRACE, ("Ratio Ratio 0x48c  =%x\n", BT_PRI));
+	BT_PRI =BT_PRI & 0x00ffffff;
+	//RTPRINT(FBT, BT_TRACE, ("Ratio BT_PRI  =%x\n", BT_PRI));
+
+
+	Polling = PlatformEFIORead4Byte(Adapter, 0x490);
+	//RTPRINT(FBT, BT_TRACE, ("Ratio 0x490  =%x\n", Polling));
+
+
+	if(BT_Tx==0xffffffff && BT_PRI==0xffffffff && Polling==0xffffffffff && BT_State==0xff)
+		return FALSE;
+
+	BT_State &= BIT0;
+
+	if(BT_State != pHalData->bt_coexist.BT_CUR_State)
+	{
+		pHalData->bt_coexist.BT_CUR_State = BT_State;
+
+		if(pMgntInfo->bRegBT_Sco == 3)
+		{
+			ServiceTypeCnt = 0;
+
+			pHalData->bt_coexist.BT_Service = BT_Idle;
+
+			RTPRINT(FBT, BT_TRACE, ("BT_%s\n", BT_State?"ON":"OFF"));
+
+			BT_State = BT_State |
+					((pHalData->bt_coexist.BT_Ant_isolation==1)?0:BIT1) |BIT2;
+
+			PlatformEFIOWrite1Byte(Adapter, 0x4fd, BT_State);
+			RTPRINT(FBT, BT_TRACE, ("BT set 0x4fd to %x\n", BT_State));
+		}
+
+		return TRUE;
+	}
+	RTPRINT(FBT, BT_TRACE, ("bRegBT_Sco   %d\n", pMgntInfo->bRegBT_Sco));
+
+	Ratio_Tx = BT_Tx*1000/Polling;
+	Ratio_PRI = BT_PRI*1000/Polling;
+
+	pHalData->bt_coexist.Ratio_Tx=Ratio_Tx;
+	pHalData->bt_coexist.Ratio_PRI=Ratio_PRI;
+
+	RTPRINT(FBT, BT_TRACE, ("Ratio_Tx=%d\n", Ratio_Tx));
+	RTPRINT(FBT, BT_TRACE, ("Ratio_PRI=%d\n", Ratio_PRI));
+
+
+	if(BT_State && pMgntInfo->bRegBT_Sco==3)
+	{
+		RTPRINT(FBT, BT_TRACE, ("bRegBT_Sco  ==3 Follow Counter\n"));
+//		if(BT_Tx==0xffff && BT_PRI==0xffff && Polling==0xffffffff)
+//		{
+//			ServiceTypeCnt = 0;
+//			return FALSE;
+//		}
+//		else
+		{
+		/*
+			Ratio_Tx = BT_Tx*1000/Polling;
+			Ratio_PRI = BT_PRI*1000/Polling;
+
+			pHalData->bt_coexist.Ratio_Tx=Ratio_Tx;
+			pHalData->bt_coexist.Ratio_PRI=Ratio_PRI;
+
+			RTPRINT(FBT, BT_TRACE, ("Ratio_Tx=%d\n", Ratio_Tx));
+			RTPRINT(FBT, BT_TRACE, ("Ratio_PRI=%d\n", Ratio_PRI));
+
+		*/
+			if((Ratio_Tx <= 50)  && (Ratio_PRI <= 50))
+				CurServiceType = BT_Idle;
+			else if((Ratio_PRI > 150) && (Ratio_PRI < 200))
+				CurServiceType = BT_SCO;
+			else if((Ratio_Tx >= 200)&&(Ratio_PRI >= 200))
+				CurServiceType = BT_Busy;
+			else if(Ratio_Tx >= 350)
+				CurServiceType = BT_OtherBusy;
+			else
+				CurServiceType=BT_OtherAction;
+
+		}
+/*		if(pHalData->bt_coexist.bStopCount)
+		{
+			ServiceTypeCnt=0;
+			pHalData->bt_coexist.bStopCount=FALSE;
+		}
+*/
+		if(CurServiceType == BT_OtherBusy)
+		{
+			ServiceTypeCnt=2;
+			LastServiceType=CurServiceType;
+		}
+		else if(CurServiceType == LastServiceType)
+		{
+			if(ServiceTypeCnt<3)
+				ServiceTypeCnt++;
+		}
+		else
+		{
+			ServiceTypeCnt = 0;
+			LastServiceType = CurServiceType;
+		}
+
+		if(ServiceTypeCnt==2)
+		{
+			pHalData->bt_coexist.BT_Service = LastServiceType;
+			BT_State = BT_State |
+					((pHalData->bt_coexist.BT_Ant_isolation==1)?0:BIT1) |
+					((pHalData->bt_coexist.BT_Service==BT_SCO)?0:BIT2);
+
+			if(pHalData->bt_coexist.BT_Service==BT_Busy)
+				BT_State&= ~(BIT2);
+
+			if(pHalData->bt_coexist.BT_Service==BT_SCO)
+			{
+				RTPRINT(FBT, BT_TRACE, ("BT TYPE Set to  ==> BT_SCO\n"));
+			}
+			else if(pHalData->bt_coexist.BT_Service==BT_Idle)
+			{
+				RTPRINT(FBT, BT_TRACE, ("BT TYPE Set to  ==> BT_Idle\n"));
+			}
+			else if(pHalData->bt_coexist.BT_Service==BT_OtherAction)
+			{
+				RTPRINT(FBT, BT_TRACE, ("BT TYPE Set to  ==> BT_OtherAction\n"));
+			}
+			else if(pHalData->bt_coexist.BT_Service==BT_Busy)
+			{
+				RTPRINT(FBT, BT_TRACE, ("BT TYPE Set to  ==> BT_Busy\n"));
+			}
+			else
+			{
+				RTPRINT(FBT, BT_TRACE, ("BT TYPE Set to ==> BT_OtherBusy\n"));
+			}
+
+			//Add interrupt migration when bt is not in idel state (no traffic).
+			//suggestion by Victor.
+			if(pHalData->bt_coexist.BT_Service!=BT_Idle)
+			{
+
+				PlatformEFIOWrite2Byte(Adapter, 0x504, 0x0ccc);
+				PlatformEFIOWrite1Byte(Adapter, 0x506, 0x54);
+				PlatformEFIOWrite1Byte(Adapter, 0x507, 0x54);
+
+			}
+			else
+			{
+				PlatformEFIOWrite1Byte(Adapter, 0x506, 0x00);
+				PlatformEFIOWrite1Byte(Adapter, 0x507, 0x00);
+			}
+
+			PlatformEFIOWrite1Byte(Adapter, 0x4fd, BT_State);
+			RTPRINT(FBT, BT_TRACE, ("BT_SCO set 0x4fd to %x\n", BT_State));
+			return TRUE;
+		}
+	}
+
+	return FALSE;
+
+}
+
+BOOLEAN
+BT_WifiConnectChange(
+	IN	PADAPTER	Adapter
+	)
+{
+	PMGNT_INFO		pMgntInfo = &Adapter->MgntInfo;
+	static BOOLEAN	bMediaConnect = FALSE;
+
+	if(!pMgntInfo->bMediaConnect || MgntRoamingInProgress(pMgntInfo))
+	{
+		bMediaConnect = FALSE;
+	}
+	else
+	{
+		if(!bMediaConnect)
+		{
+			bMediaConnect = TRUE;
+			return TRUE;
+		}
+		bMediaConnect = TRUE;
+	}
+
+	return FALSE;
+}
+
+BOOLEAN
+BT_RSSIChangeWithAMPDU(
+	IN	PADAPTER	Adapter
+	)
+{
+	PMGNT_INFO		pMgntInfo = &Adapter->MgntInfo;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	if(!Adapter->pNdisCommon->bRegBT_Ampdu || !Adapter->pNdisCommon->bRegAcceptAddbaReq)
+		return FALSE;
+
+	RTPRINT(FBT, BT_TRACE, ("RSSI is %d\n",pHalData->UndecoratedSmoothedPWDB));
+
+	if((pHalData->UndecoratedSmoothedPWDB<=32) && pMgntInfo->pHTInfo->bAcceptAddbaReq)
+	{
+		RTPRINT(FBT, BT_TRACE, ("BT_Disallow AMPDU RSSI <=32  Need change\n"));
+		return TRUE;
+
+	}
+	else if((pHalData->UndecoratedSmoothedPWDB>=40) && !pMgntInfo->pHTInfo->bAcceptAddbaReq )
+	{
+		RTPRINT(FBT, BT_TRACE, ("BT_Allow AMPDU RSSI >=40, Need change\n"));
+		return TRUE;
+	}
+	else
+		return FALSE;
+
+}
+
+
+VOID
+dm_BTCoexist(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	PMGNT_INFO		pMgntInfo = &Adapter->MgntInfo;
+	static u1Byte		LastTxPowerLvl = 0xff;
+	PRX_TS_RECORD	pRxTs = NULL;
+
+	BOOLEAN			bWifiConnectChange, bBtStateChange,bRSSIChangeWithAMPDU;
+
+	if( (pHalData->bt_coexist.BluetoothCoexist) &&
+		(pHalData->bt_coexist.BT_CoexistType == BT_CSR_BC4) &&
+		(!ACTING_AS_AP(Adapter))	)
+	{
+		bWifiConnectChange = BT_WifiConnectChange(Adapter);
+		bBtStateChange = BT_BTStateChange(Adapter);
+		bRSSIChangeWithAMPDU = BT_RSSIChangeWithAMPDU(Adapter);
+		RTPRINT(FBT, BT_TRACE, ("bWifiConnectChange %d, bBtStateChange  %d,LastTxPowerLvl  %x,  DynamicTxHighPowerLvl  %x\n",
+			bWifiConnectChange,bBtStateChange,LastTxPowerLvl,pHalData->DynamicTxHighPowerLvl));
+		if( bWifiConnectChange ||bBtStateChange  ||
+			(LastTxPowerLvl != pHalData->DynamicTxHighPowerLvl)	||bRSSIChangeWithAMPDU)
+		{
+			LastTxPowerLvl = pHalData->DynamicTxHighPowerLvl;
+
+			if(pHalData->bt_coexist.BT_CUR_State)
+			{
+				// Do not allow receiving A-MPDU aggregation.
+				if((pHalData->bt_coexist.BT_Service==BT_SCO) || (pHalData->bt_coexist.BT_Service==BT_Busy))
+				{
+					if(pHalData->UndecoratedSmoothedPWDB<=32)
+					{
+						if(Adapter->pNdisCommon->bRegBT_Ampdu && Adapter->pNdisCommon->bRegAcceptAddbaReq)
+						{
+							RTPRINT(FBT, BT_TRACE, ("BT_Disallow AMPDU RSSI <=32\n"));
+							pMgntInfo->pHTInfo->bAcceptAddbaReq = FALSE;
+							if(GetTs(Adapter, (PTS_COMMON_INFO*)(&pRxTs), pMgntInfo->Bssid, 0, RX_DIR, FALSE))
+								TsInitDelBA(Adapter, (PTS_COMMON_INFO)pRxTs, RX_DIR);
+						}
+					}
+					else if(pHalData->UndecoratedSmoothedPWDB>=40)
+					{
+						if(Adapter->pNdisCommon->bRegBT_Ampdu && Adapter->pNdisCommon->bRegAcceptAddbaReq)
+						{
+							RTPRINT(FBT, BT_TRACE, ("BT_Allow AMPDU  RSSI >=40\n"));
+							pMgntInfo->pHTInfo->bAcceptAddbaReq = TRUE;
+						}
+					}
+				}
+				else
+				{
+					if(Adapter->pNdisCommon->bRegBT_Ampdu && Adapter->pNdisCommon->bRegAcceptAddbaReq)
+					{
+						RTPRINT(FBT, BT_TRACE, ("BT_Allow AMPDU BT not in SCO or BUSY\n"));
+						pMgntInfo->pHTInfo->bAcceptAddbaReq = TRUE;
+					}
+				}
+
+				if(pHalData->bt_coexist.BT_Ant_isolation)
+				{
+					RTPRINT(FBT, BT_TRACE, ("BT_IsolationLow\n"));
+					RTPRINT(FBT, BT_TRACE, ("BT_Update Rate table\n"));
+					Adapter->HalFunc.UpdateHalRATRTableHandler(
+								Adapter,
+								&pMgntInfo->dot11OperationalRateSet,
+								pMgntInfo->dot11HTOperationalRateSet,NULL);
+
+					if(pHalData->bt_coexist.BT_Service==BT_SCO)
+					{
+
+						RTPRINT(FBT, BT_TRACE, ("BT_Turn OFF Coexist with SCO \n"));
+						PlatformEFIOWrite1Byte(Adapter, REG_GPIO_MUXCFG, 0x14);
+					}
+					else if(pHalData->DynamicTxHighPowerLvl == TxHighPwrLevel_Normal)
+					{
+						RTPRINT(FBT, BT_TRACE, ("BT_Turn ON Coexist\n"));
+						PlatformEFIOWrite1Byte(Adapter, REG_GPIO_MUXCFG, 0xb4);
+					}
+					else
+					{
+						RTPRINT(FBT, BT_TRACE, ("BT_Turn OFF Coexist\n"));
+						PlatformEFIOWrite1Byte(Adapter, REG_GPIO_MUXCFG, 0x14);
+					}
+				}
+				else
+				{
+					RTPRINT(FBT, BT_TRACE, ("BT_IsolationHigh\n"));
+					// Do nothing.
+				}
+			}
+			else
+			{
+				if(Adapter->pNdisCommon->bRegBT_Ampdu && Adapter->pNdisCommon->bRegAcceptAddbaReq)
+				{
+					RTPRINT(FBT, BT_TRACE, ("BT_Allow AMPDU bt is off\n"));
+					pMgntInfo->pHTInfo->bAcceptAddbaReq = TRUE;
+				}
+
+				RTPRINT(FBT, BT_TRACE, ("BT_Turn OFF Coexist bt is off \n"));
+				PlatformEFIOWrite1Byte(Adapter, REG_GPIO_MUXCFG, 0x14);
+
+				RTPRINT(FBT, BT_TRACE, ("BT_Update Rate table\n"));
+				Adapter->HalFunc.UpdateHalRATRTableHandler(
+							Adapter,
+							&pMgntInfo->dot11OperationalRateSet,
+							pMgntInfo->dot11HTOperationalRateSet,NULL);
+			}
+		}
+	}
+}
+#endif
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	dm_CheckRfCtrlGPIO()
+ *
+ * Overview:	Copy 8187B template for 9xseries.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	01/10/2008	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+static VOID
+dm_CheckRfCtrlGPIO(
+	IN	PADAPTER	Adapter
+	)
+{
+#if 0
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+#if defined (CONFIG_USB_HCI) || defined (CONFIG_SDIO_HCI)
+	#ifdef CONFIG_USB_HCI
+		// 2010/08/12 MH Add for CU selective suspend.
+		PRT_USB_DEVICE		pDevice = GET_RT_USB_DEVICE(Adapter);
+	#else
+		PRT_SDIO_DEVICE	pDevice = GET_RT_SDIO_DEVICE(Adapter);
+	#endif
+#endif
+
+	if(!Adapter->MgntInfo.PowerSaveControl.bGpioRfSw)
+		return;
+
+	RTPRINT(FPWR, PWRHW, ("dm_CheckRfCtrlGPIO \n"));
+
+#if defined (CONFIG_USB_HCI) || defined (CONFIG_SDIO_HCI)
+	// Walk around for DTM test, we will not enable HW - radio on/off because r/w
+	// page 1 register before Lextra bus is enabled cause system fails when resuming
+	// from S4. 20080218, Emily
+	if(Adapter->bInHctTest)
+		return;
+
+//#if ((HAL_CODE_BASE == RTL8192_S) )
+	//Adapter->HalFunc.GPIOChangeRFHandler(Adapter, GPIORF_POLLING);
+//#else
+	// 2010/07/27 MH Only Minicard and support selective suspend, we can not turn off all MAC power to
+	// stop 8051. For dongle and minicard, we both support selective suspend mode.
+	//if(pDevice->RegUsbSS && Adapter->HalFunc.GetInterfaceSelectionHandler(Adapter) == INTF_SEL2_MINICARD)
+
+	//
+	// 2010/08/12 MH We support severl power consumption combination as below.
+	//
+	// Power consumption combination
+	//	SS Enable: (LPS disable + IPS + SW/HW radio off)
+	//	1. Dongle + PDN  (support HW radio off)
+	//	2. Dongle + Normal  (No HW radio off)
+	//	3. MiniCard + PDN (support HW radio off)
+	//	4. MiniCard + Normal (support HW radio off)
+	//
+	//	SS Disable: (LPS + IPS + SW/HW radio off)
+	//	1. Dongle + PDN  (support HW radio off)
+	//	2. Dongle + Normal  (No HW radio off)
+	//	3. MiniCard + PDN (support HW radio off)
+	//	4. MiniCard + Normal (support HW radio off)
+	//
+	//	For Power down module detection. We need to read power register no matter
+	//	dongle or minicard, we will add the item is the detection method.
+	//
+	//
+	//vivi add du case
+	if ((IS_HARDWARE_TYPE_8192CU(Adapter)||IS_HARDWARE_TYPE_8192DU(Adapter))
+		&& pDevice->RegUsbSS)
+	{
+		RT_TRACE(COMP_RF, DBG_LOUD, ("USB SS Enabled\n"));
+		if (SUPPORT_HW_RADIO_DETECT(Adapter))
+		{	// Support HW radio detection
+			RT_TRACE(COMP_RF, DBG_LOUD, ("USB Card Type 2/3/4 support GPIO Detect\n"));
+			GpioDetectTimerStart(Adapter);
+		}
+		else
+		{	// Dongle does not support HW radio detection.?? In the fufure??
+			RT_TRACE(COMP_RF, DBG_LOUD, ("USB DONGLE Non-GPIO-Detect\n"));
+		}
+	}
+	else if (IS_HARDWARE_TYPE_8192CU(Adapter) ||
+		IS_HARDWARE_TYPE_8723AU(Adapter)||
+		IS_HARDWARE_TYPE_8192DU(Adapter) ||
+		IS_HARDWARE_TYPE_8723AS(Adapter))
+	{	// Not support Selective suspend
+		RT_TRACE(COMP_RF, DBG_LOUD, ("USB SS Disable\n"));
+		if (SUPPORT_HW_RADIO_DETECT(Adapter))
+		{
+			RT_TRACE(COMP_RF, DBG_LOUD, ("USB Card Type 2/3/4 support GPIO Detect\n"));
+			PlatformScheduleWorkItem( &(pHalData->GPIOChangeRFWorkItem) );
+		}
+		else
+		{
+			RT_TRACE(COMP_RF, DBG_LOUD, ("USB DONGLE Non-GPIO-Detect\n"));
+		}
+	}
+	else
+	{	// CE only support noemal HW radio detection now. Support timers GPIO detection in SE/CU.
+		PlatformScheduleWorkItem( &(pHalData->GPIOChangeRFWorkItem) );
+	}
+//#endif
+#else if defined CONFIG_PCI_HCI
+	if(Adapter->bInHctTest)
+		return;
+
+	// CE only support noemal HW radio detection now. We support timers GPIO detection in SE.
+	PlatformScheduleWorkItem( &(pHalData->GPIOChangeRFWorkItem) );
+#endif
+#endif
+}	/* dm_CheckRfCtrlGPIO */
+
+static VOID
+dm_InitRateAdaptiveMask(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	PRATE_ADAPTIVE	pRA = (PRATE_ADAPTIVE)&pdmpriv->RateAdaptive;
+
+	pRA->RATRState = DM_RATR_STA_INIT;
+	pRA->PreRATRState = DM_RATR_STA_INIT;
+
+	if (pdmpriv->DM_Type == DM_Type_ByDriver)
+		pdmpriv->bUseRAMask = _TRUE;
+	else
+		pdmpriv->bUseRAMask = _FALSE;
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	dm_RefreshRateAdaptiveMask()
+ *
+ * Overview:	Update rate table mask according to rssi
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	05/27/2009	hpfan	Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+static VOID
+dm_RefreshRateAdaptiveMask(	IN	PADAPTER	pAdapter)
+{
+#if 0
+	PADAPTER 				pTargetAdapter;
+	HAL_DATA_TYPE			*pHalData = GET_HAL_DATA(pAdapter);
+	PMGNT_INFO				pMgntInfo = &(ADJUST_TO_ADAPTIVE_ADAPTER(pAdapter, TRUE)->MgntInfo);
+	PRATE_ADAPTIVE			pRA = (PRATE_ADAPTIVE)&pMgntInfo->RateAdaptive;
+	u4Byte					LowRSSIThreshForRA = 0, HighRSSIThreshForRA = 0;
+
+	if(pAdapter->bDriverStopped)
+	{
+		RT_TRACE(COMP_RATR, DBG_TRACE, ("<---- dm_RefreshRateAdaptiveMask(): driver is going to unload\n"));
+		return;
+	}
+
+	if(!pMgntInfo->bUseRAMask)
+	{
+		RT_TRACE(COMP_RATR, DBG_LOUD, ("<---- dm_RefreshRateAdaptiveMask(): driver does not control rate adaptive mask\n"));
+		return;
+	}
+
+	// if default port is connected, update RA table for default port (infrastructure mode only)
+	if(pAdapter->MgntInfo.mAssoc && (!ACTING_AS_AP(pAdapter)))
+	{
+
+		// decide rastate according to rssi
+		switch (pRA->PreRATRState)
+		{
+			case DM_RATR_STA_HIGH:
+				HighRSSIThreshForRA = 50;
+				LowRSSIThreshForRA = 20;
+				break;
+
+			case DM_RATR_STA_MIDDLE:
+				HighRSSIThreshForRA = 55;
+				LowRSSIThreshForRA = 20;
+				break;
+
+			case DM_RATR_STA_LOW:
+				HighRSSIThreshForRA = 50;
+				LowRSSIThreshForRA = 25;
+				break;
+
+			default:
+				HighRSSIThreshForRA = 50;
+				LowRSSIThreshForRA = 20;
+				break;
+		}
+
+		if(pHalData->UndecoratedSmoothedPWDB > (s4Byte)HighRSSIThreshForRA)
+			pRA->RATRState = DM_RATR_STA_HIGH;
+		else if(pHalData->UndecoratedSmoothedPWDB > (s4Byte)LowRSSIThreshForRA)
+			pRA->RATRState = DM_RATR_STA_MIDDLE;
+		else
+			pRA->RATRState = DM_RATR_STA_LOW;
+
+		if(pRA->PreRATRState != pRA->RATRState)
+		{
+			RT_PRINT_ADDR(COMP_RATR, DBG_LOUD, ("Target AP addr : "), pMgntInfo->Bssid);
+			RT_TRACE(COMP_RATR, DBG_LOUD, ("RSSI = %d\n", pHalData->UndecoratedSmoothedPWDB));
+			RT_TRACE(COMP_RATR, DBG_LOUD, ("RSSI_LEVEL = %d\n", pRA->RATRState));
+			RT_TRACE(COMP_RATR, DBG_LOUD, ("PreState = %d, CurState = %d\n", pRA->PreRATRState, pRA->RATRState));
+			pAdapter->HalFunc.UpdateHalRAMaskHandler(
+									pAdapter,
+									FALSE,
+									0,
+									NULL,
+									NULL,
+									pRA->RATRState);
+			pRA->PreRATRState = pRA->RATRState;
+		}
+	}
+
+	//
+	// The following part configure AP/VWifi/IBSS rate adaptive mask.
+	//
+	if(ACTING_AS_AP(pAdapter) || ACTING_AS_IBSS(pAdapter))
+	{
+		pTargetAdapter = pAdapter;
+	}
+	else
+	{
+		pTargetAdapter = ADJUST_TO_ADAPTIVE_ADAPTER(pAdapter, FALSE);
+		if(!ACTING_AS_AP(pTargetAdapter))
+			pTargetAdapter = NULL;
+	}
+
+	// if extension port (softap) is started, updaet RA table for more than one clients associate
+	if(pTargetAdapter != NULL)
+	{
+		int	i;
+		PRT_WLAN_STA	pEntry;
+		PRATE_ADAPTIVE     pEntryRA;
+
+		for(i = 0; i < ASSOCIATE_ENTRY_NUM; i++)
+		{
+			if(	pTargetAdapter->MgntInfo.AsocEntry[i].bUsed && pTargetAdapter->MgntInfo.AsocEntry[i].bAssociated)
+			{
+				pEntry = pTargetAdapter->MgntInfo.AsocEntry+i;
+				pEntryRA = &pEntry->RateAdaptive;
+
+				switch (pEntryRA->PreRATRState)
+				{
+					case DM_RATR_STA_HIGH:
+					{
+						HighRSSIThreshForRA = 50;
+						LowRSSIThreshForRA = 20;
+					}
+					break;
+
+					case DM_RATR_STA_MIDDLE:
+					{
+						HighRSSIThreshForRA = 55;
+						LowRSSIThreshForRA = 20;
+					}
+					break;
+
+					case DM_RATR_STA_LOW:
+					{
+						HighRSSIThreshForRA = 50;
+						LowRSSIThreshForRA = 25;
+					}
+					break;
+
+					default:
+					{
+						HighRSSIThreshForRA = 50;
+						LowRSSIThreshForRA = 20;
+					}
+				}
+
+				if(pEntry->rssi_stat.UndecoratedSmoothedPWDB > (s4Byte)HighRSSIThreshForRA)
+					pEntryRA->RATRState = DM_RATR_STA_HIGH;
+				else if(pEntry->rssi_stat.UndecoratedSmoothedPWDB > (s4Byte)LowRSSIThreshForRA)
+					pEntryRA->RATRState = DM_RATR_STA_MIDDLE;
+				else
+					pEntryRA->RATRState = DM_RATR_STA_LOW;
+
+				if(pEntryRA->PreRATRState != pEntryRA->RATRState)
+				{
+					RT_PRINT_ADDR(COMP_RATR, DBG_LOUD, ("AsocEntry addr : "), pEntry->MacAddr);
+					RT_TRACE(COMP_RATR, DBG_LOUD, ("RSSI = %d\n", pEntry->rssi_stat.UndecoratedSmoothedPWDB));
+					RT_TRACE(COMP_RATR, DBG_LOUD, ("RSSI_LEVEL = %d\n", pEntryRA->RATRState));
+					RT_TRACE(COMP_RATR, DBG_LOUD, ("PreState = %d, CurState = %d\n", pEntryRA->PreRATRState, pEntryRA->RATRState));
+					pAdapter->HalFunc.UpdateHalRAMaskHandler(
+											pTargetAdapter,
+											FALSE,
+											pEntry->AID+1,
+											pEntry->MacAddr,
+											pEntry,
+											pEntryRA->RATRState);
+					pEntryRA->PreRATRState = pEntryRA->RATRState;
+				}
+
+			}
+		}
+	}
+#endif
+}
+
+static VOID
+dm_CheckProtection(
+	IN	PADAPTER	Adapter
+	)
+{
+#if 0
+	PMGNT_INFO		pMgntInfo = &(Adapter->MgntInfo);
+	u1Byte			CurRate, RateThreshold;
+
+	if(pMgntInfo->pHTInfo->bCurBW40MHz)
+		RateThreshold = MGN_MCS1;
+	else
+		RateThreshold = MGN_MCS3;
+
+	if(Adapter->TxStats.CurrentInitTxRate <= RateThreshold)
+	{
+		pMgntInfo->bDmDisableProtect = TRUE;
+		DbgPrint("Forced disable protect: %x\n", Adapter->TxStats.CurrentInitTxRate);
+	}
+	else
+	{
+		pMgntInfo->bDmDisableProtect = FALSE;
+		DbgPrint("Enable protect: %x\n", Adapter->TxStats.CurrentInitTxRate);
+	}
+#endif
+}
+
+static VOID
+dm_CheckStatistics(
+	IN	PADAPTER	Adapter
+	)
+{
+#if 0
+	if(!Adapter->MgntInfo.bMediaConnect)
+		return;
+
+	//2008.12.10 tynli Add for getting Current_Tx_Rate_Reg flexibly.
+	rtw_hal_get_hwreg( Adapter, HW_VAR_INIT_TX_RATE, (pu1Byte)(&Adapter->TxStats.CurrentInitTxRate) );
+
+	// Calculate current Tx Rate(Successful transmited!!)
+
+	// Calculate current Rx Rate(Successful received!!)
+
+	//for tx tx retry count
+	rtw_hal_get_hwreg( Adapter, HW_VAR_RETRY_COUNT, (pu1Byte)(&Adapter->TxStats.NumTxRetryCount) );
+#endif
+}
+
+static void dm_CheckPbcGPIO(_adapter *padapter)
+{
+	u8	tmp1byte;
+	u8	bPbcPressed = _FALSE;
+	int i=0;
+
+	if(!padapter->registrypriv.hw_wps_pbc)
+		return;
+
+	do
+	{
+		i++;
+#ifdef CONFIG_USB_HCI
+	tmp1byte = rtw_read8(padapter, GPIO_IO_SEL);
+	tmp1byte |= (HAL_8192C_HW_GPIO_WPS_BIT);
+	rtw_write8(padapter, GPIO_IO_SEL, tmp1byte);	//enable GPIO[2] as output mode
+
+	tmp1byte &= ~(HAL_8192C_HW_GPIO_WPS_BIT);
+	rtw_write8(padapter,  GPIO_IN, tmp1byte);		//reset the floating voltage level
+
+	tmp1byte = rtw_read8(padapter, GPIO_IO_SEL);
+	tmp1byte &= ~(HAL_8192C_HW_GPIO_WPS_BIT);
+	rtw_write8(padapter, GPIO_IO_SEL, tmp1byte);	//enable GPIO[2] as input mode
+
+	tmp1byte =rtw_read8(padapter, GPIO_IN);
+
+	if (tmp1byte == 0xff)
+	{
+		bPbcPressed = _FALSE;
+		break ;
+	}
+
+	if (tmp1byte&HAL_8192C_HW_GPIO_WPS_BIT)
+	{
+		bPbcPressed = _TRUE;
+
+		if(i<=3)
+			rtw_msleep_os(50);
+	}
+#else
+	tmp1byte = rtw_read8(padapter, GPIO_IN);
+	//RT_TRACE(COMP_IO, DBG_TRACE, ("dm_CheckPbcGPIO - %x\n", tmp1byte));
+
+	if (tmp1byte == 0xff || padapter->init_adpt_in_progress)
+	{
+		bPbcPressed = _FALSE;
+		break ;
+	}
+
+	if((tmp1byte&HAL_8192C_HW_GPIO_WPS_BIT)==0)
+	{
+		bPbcPressed = _TRUE;
+
+		if(i<=3)
+			rtw_msleep_os(50);
+	}
+#endif
+
+	}while(i<=3 && bPbcPressed == _TRUE);
+
+	if( _TRUE == bPbcPressed)
+	{
+		// Here we only set bPbcPressed to true
+		// After trigger PBC, the variable will be set to false
+		DBG_8192C("CheckPbcGPIO - PBC is pressed, try_cnt=%d\n", i-1);
+
+#ifdef RTK_DMP_PLATFORM
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,12))
+		kobject_uevent(&padapter->pnetdev->dev.kobj, KOBJ_NET_PBC);
+#else
+		kobject_hotplug(&padapter->pnetdev->class_dev.kobj, KOBJ_NET_PBC);
+#endif
+#else
+
+		if ( padapter->pid[0] == 0 )
+		{	//	0 is the default value and it means the application monitors the HW PBC doesn't privde its pid to driver.
+			return;
+		}
+
+#ifdef PLATFORM_LINUX
+		rtw_signal_process(padapter->pid[0], SIGUSR1);
+#endif
+#endif
+	}
+}
+
+#ifdef CONFIG_PCI_HCI
+//
+//	Description:
+//		Perform interrupt migration dynamically to reduce CPU utilization.
+//
+//	Assumption:
+//		1. Do not enable migration under WIFI test.
+//
+//	Created by Roger, 2010.03.05.
+//
+VOID
+dm_InterruptMigration(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct mlme_priv	*pmlmepriv = &(Adapter->mlmepriv);
+	BOOLEAN			bCurrentIntMt, bCurrentACIntDisable;
+	BOOLEAN			IntMtToSet = _FALSE;
+	BOOLEAN			ACIntToSet = _FALSE;
+
+
+	// Retrieve current interrupt migration and Tx four ACs IMR settings first.
+	bCurrentIntMt = pHalData->bInterruptMigration;
+	bCurrentACIntDisable = pHalData->bDisableTxInt;
+
+	//
+	// <Roger_Notes> Currently we use busy traffic for reference instead of RxIntOK counts to prevent non-linear Rx statistics
+	// when interrupt migration is set before. 2010.03.05.
+	//
+	if(!Adapter->registrypriv.wifi_spec &&
+		(check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE) &&
+		pmlmepriv->LinkDetectInfo.bHigherBusyTraffic)
+	{
+		IntMtToSet = _TRUE;
+
+		// To check whether we should disable Tx interrupt or not.
+		if(pmlmepriv->LinkDetectInfo.bHigherBusyRxTraffic )
+			ACIntToSet = _TRUE;
+	}
+
+	//Update current settings.
+	if( bCurrentIntMt != IntMtToSet ){
+		DBG_8192C("%s(): Update interrrupt migration(%d)\n",__FUNCTION__,IntMtToSet);
+		if(IntMtToSet)
+		{
+			//
+			// <Roger_Notes> Set interrrupt migration timer and corresponging Tx/Rx counter.
+			// timer 25ns*0xfa0=100us for 0xf packets.
+			// 2010.03.05.
+			//
+			rtw_write32(Adapter, REG_INT_MIG, 0xff000fa0);// 0x306:Rx, 0x307:Tx
+			pHalData->bInterruptMigration = IntMtToSet;
+		}
+		else
+		{
+			// Reset all interrupt migration settings.
+			rtw_write32(Adapter, REG_INT_MIG, 0);
+			pHalData->bInterruptMigration = IntMtToSet;
+		}
+	}
+
+	/*if( bCurrentACIntDisable != ACIntToSet ){
+		DBG_8192C("%s(): Update AC interrrupt(%d)\n",__FUNCTION__,ACIntToSet);
+		if(ACIntToSet) // Disable four ACs interrupts.
+		{
+			//
+			// <Roger_Notes> Disable VO, VI, BE and BK four AC interrupts to gain more efficient CPU utilization.
+			// When extremely highly Rx OK occurs, we will disable Tx interrupts.
+			// 2010.03.05.
+			//
+			UpdateInterruptMask8192CE( Adapter, 0, RT_AC_INT_MASKS );
+			pHalData->bDisableTxInt = ACIntToSet;
+		}
+		else// Enable four ACs interrupts.
+		{
+			UpdateInterruptMask8192CE( Adapter, RT_AC_INT_MASKS, 0 );
+			pHalData->bDisableTxInt = ACIntToSet;
+		}
+	}*/
+
+}
+
+#endif
+
+//
+// Initialize GPIO setting registers
+//
+static void
+dm_InitGPIOSetting(
+	IN	PADAPTER	Adapter
+	)
+{
+	PHAL_DATA_TYPE		pHalData = GET_HAL_DATA(Adapter);
+
+	u8	tmp1byte;
+
+	tmp1byte = rtw_read8(Adapter, REG_GPIO_MUXCFG);
+	tmp1byte &= (GPIOSEL_GPIO | ~GPIOSEL_ENBT);
+
+#ifdef CONFIG_BT_COEXIST
+	// UMB-B cut bug. We need to support the modification.
+	if (IS_81xxC_VENDOR_UMC_B_CUT(pHalData->VersionID) &&
+		pHalData->bt_coexist.BT_Coexist)
+	{
+		tmp1byte |= (BIT5);
+	}
+#endif
+	rtw_write8(Adapter, REG_GPIO_MUXCFG, tmp1byte);
+
+}
+
+static void update_EDCA_param(_adapter *padapter)
+{
+	u32 	trafficIndex;
+	u32	edca_param;
+	u64	cur_tx_bytes = 0;
+	u64	cur_rx_bytes = 0;
+	PHAL_DATA_TYPE		pHalData = GET_HAL_DATA(padapter);
+	struct dm_priv		*pdmpriv = &pHalData->dmpriv;
+	struct xmit_priv		*pxmitpriv = &(padapter->xmitpriv);
+	struct recv_priv		*precvpriv = &(padapter->recvpriv);
+	struct registry_priv	*pregpriv = &padapter->registrypriv;
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+#ifdef CONFIG_BT_COEXIST
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+	u8	bbtchange = _FALSE;
+#endif
+
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	//associated AP
+	if ((pregpriv->wifi_spec == 1) || (pmlmeinfo->HT_enable == 0))
+	{
+		return;
+	}
+
+	if (pmlmeinfo->assoc_AP_vendor >= maxAP)
+	{
+		return;
+	}
+
+	cur_tx_bytes = pxmitpriv->tx_bytes - pxmitpriv->last_tx_bytes;
+	cur_rx_bytes = precvpriv->rx_bytes - precvpriv->last_rx_bytes;
+
+	//traffic, TX or RX
+	if((pmlmeinfo->assoc_AP_vendor == ralinkAP)||(pmlmeinfo->assoc_AP_vendor == atherosAP))
+	{
+		if (cur_tx_bytes > (cur_rx_bytes << 2))
+		{ // Uplink TP is present.
+			trafficIndex = UP_LINK;
+		}
+		else
+		{ // Balance TP is present.
+			trafficIndex = DOWN_LINK;
+		}
+	}
+	else
+	{
+		if (cur_rx_bytes > (cur_tx_bytes << 2))
+		{ // Downlink TP is present.
+			trafficIndex = DOWN_LINK;
+		}
+		else
+		{ // Balance TP is present.
+			trafficIndex = UP_LINK;
+		}
+	}
+
+#ifdef CONFIG_BT_COEXIST
+	if(pbtpriv->BT_Coexist)
+	{
+		if( (pbtpriv->BT_EDCA[UP_LINK]!=0) ||  (pbtpriv->BT_EDCA[DOWN_LINK]!=0))
+		{
+			bbtchange = _TRUE;
+		}
+	}
+#endif
+
+	if (pdmpriv->prv_traffic_idx != trafficIndex)
+	{
+#if 0
+#ifdef CONFIG_BT_COEXIST
+		if(_TRUE == bbtchange)
+			rtw_write32(padapter, REG_EDCA_BE_PARAM, pbtpriv->BT_EDCA[trafficIndex]);
+		else
+#endif
+		//adjust EDCA parameter for BE queue
+		//fire_write_MAC_cmd(padapter, EDCA_BE_PARAM, EDCAParam[pmlmeinfo->assoc_AP_vendor][trafficIndex]);
+		rtw_write32(padapter, REG_EDCA_BE_PARAM, EDCAParam[pmlmeinfo->assoc_AP_vendor][trafficIndex]);
+
+#else
+		if((pmlmeinfo->assoc_AP_vendor == ciscoAP) && (pmlmeext->cur_wireless_mode & WIRELESS_11_24N))
+		{
+			edca_param = EDCAParam[pmlmeinfo->assoc_AP_vendor][trafficIndex];
+		}
+		else if((pmlmeinfo->assoc_AP_vendor == airgocapAP) &&
+			((pmlmeext->cur_wireless_mode == WIRELESS_11G) ||(pmlmeext->cur_wireless_mode == WIRELESS_11BG)))
+		{
+			edca_param = EDCAParam[pmlmeinfo->assoc_AP_vendor][trafficIndex];
+		}
+		else
+		{
+			edca_param = EDCAParam[unknownAP][trafficIndex];
+		}
+
+#ifdef CONFIG_BT_COEXIST
+		if(_TRUE == bbtchange)
+			edca_param = pbtpriv->BT_EDCA[trafficIndex];
+#endif
+
+		rtw_write32(padapter, REG_EDCA_BE_PARAM, edca_param);
+#endif
+		pdmpriv->prv_traffic_idx = trafficIndex;
+	}
+
+//exit_update_EDCA_param:
+
+	pxmitpriv->last_tx_bytes = pxmitpriv->tx_bytes;
+	precvpriv->last_rx_bytes = precvpriv->rx_bytes;
+
+	return;
+}
+
+static void dm_InitDynamicBBPowerSaving(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	PS_T	*pPSTable = &pdmpriv->DM_PSTable;
+
+	pPSTable->PreCCAState = CCA_MAX;
+	pPSTable->CurCCAState = CCA_MAX;
+	pPSTable->PreRFState = RF_MAX;
+	pPSTable->CurRFState = RF_MAX;
+	pPSTable->Rssi_val_min = 0;
+}
+
+static void dm_1R_CCA(
+	IN	PADAPTER	pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	PS_T	*pPSTable = &pdmpriv->DM_PSTable;
+
+	if(pPSTable->Rssi_val_min != 0)
+	{
+		if(pPSTable->PreCCAState == CCA_2R)
+		{
+			if(pPSTable->Rssi_val_min >= 35)
+				pPSTable->CurCCAState = CCA_1R;
+			else
+				pPSTable->CurCCAState = CCA_2R;
+		}
+		else{
+			if(pPSTable->Rssi_val_min <= 30)
+				pPSTable->CurCCAState = CCA_2R;
+			else
+				pPSTable->CurCCAState = CCA_1R;
+		}
+	}
+	else
+		pPSTable->CurCCAState=CCA_MAX;
+
+	if(pPSTable->PreCCAState != pPSTable->CurCCAState)
+	{
+		if(pPSTable->CurCCAState == CCA_1R)
+		{
+			if(pHalData->rf_type == RF_2T2R)
+			{
+				PHY_SetBBReg(pAdapter, rOFDM0_TRxPathEnable  , bMaskByte0, 0x13);
+				PHY_SetBBReg(pAdapter, 0xe70, bMaskByte3, 0x20);
+			}
+			else
+			{
+				PHY_SetBBReg(pAdapter, rOFDM0_TRxPathEnable  , bMaskByte0, 0x23);
+				PHY_SetBBReg(pAdapter, 0xe70, 0x7fc00000, 0x10c); // Set RegE70[30:22] = 9b'100001100
+			}
+		}
+		else
+		{
+			PHY_SetBBReg(pAdapter, rOFDM0_TRxPathEnable, bMaskByte0, 0x33);
+			PHY_SetBBReg(pAdapter,0xe70, bMaskByte3, 0x63);
+		}
+		pPSTable->PreCCAState = pPSTable->CurCCAState;
+	}
+	//DBG_8192C("dm_1R_CCA(): CCAStage=%x\n", pPSTable->CurCCAState);
+}
+
+void
+rtl8192c_dm_RF_Saving(
+	IN	PADAPTER	pAdapter,
+	IN	u8	bForceInNormal
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	PS_T	*pPSTable = &pdmpriv->DM_PSTable;
+
+	if(pdmpriv->initialize == 0){
+		pdmpriv->rf_saving_Reg874 = (PHY_QueryBBReg(pAdapter, rFPGA0_XCD_RFInterfaceSW, bMaskDWord)&0x1CC000)>>14;
+		pdmpriv->rf_saving_RegC70 = (PHY_QueryBBReg(pAdapter, rOFDM0_AGCParameter1, bMaskDWord)&BIT3)>>3;
+		pdmpriv->rf_saving_Reg85C = (PHY_QueryBBReg(pAdapter, rFPGA0_XCD_SwitchControl, bMaskDWord)&0xFF000000)>>24;
+		pdmpriv->rf_saving_RegA74 = (PHY_QueryBBReg(pAdapter, 0xa74, bMaskDWord)&0xF000)>>12;
+		//Reg818 = PHY_QueryBBReg(pAdapter, 0x818, bMaskDWord);
+		pdmpriv->initialize = 1;
+	}
+
+	if(!bForceInNormal)
+	{
+		if(pPSTable->Rssi_val_min != 0)
+		{
+
+			if(pPSTable->PreRFState == RF_Normal)
+			{
+			#ifdef CONFIG_SPECIAL_SETTING_FOR_FUNAI_TV
+				if(pPSTable->Rssi_val_min >= 50)
+			#else
+				if(pPSTable->Rssi_val_min >= 30)
+			#endif
+					pPSTable->CurRFState = RF_Save;
+				else
+					pPSTable->CurRFState = RF_Normal;
+			}
+			else{
+			#ifdef CONFIG_SPECIAL_SETTING_FOR_FUNAI_TV
+				if(pPSTable->Rssi_val_min <= 45)
+			#else
+				if(pPSTable->Rssi_val_min <= 25)
+			#endif
+					pPSTable->CurRFState = RF_Normal;
+				else
+					pPSTable->CurRFState = RF_Save;
+			}
+		}
+		else
+			pPSTable->CurRFState=RF_MAX;
+	}
+	else
+	{
+		pPSTable->CurRFState = RF_Normal;
+	}
+
+	if(pPSTable->PreRFState != pPSTable->CurRFState)
+	{
+		if(pPSTable->CurRFState == RF_Save)
+		{
+			PHY_SetBBReg(pAdapter, rFPGA0_XCD_RFInterfaceSW  , 0x1C0000, 0x2); //Reg874[20:18]=3'b010
+			PHY_SetBBReg(pAdapter, rOFDM0_AGCParameter1, BIT3, 0); //RegC70[3]=1'b0
+			PHY_SetBBReg(pAdapter, rFPGA0_XCD_SwitchControl, 0xFF000000, 0x63); //Reg85C[31:24]=0x63
+			PHY_SetBBReg(pAdapter, rFPGA0_XCD_RFInterfaceSW, 0xC000, 0x2); //Reg874[15:14]=2'b10
+			PHY_SetBBReg(pAdapter, 0xa74, 0xF000, 0x3); //RegA75[7:4]=0x3
+			PHY_SetBBReg(pAdapter, 0x818, BIT28, 0x0); //Reg818[28]=1'b0
+			PHY_SetBBReg(pAdapter, 0x818, BIT28, 0x1); //Reg818[28]=1'b1
+			DBG_8192C("%s(): RF_Save\n", __FUNCTION__);
+		}
+		else
+		{
+			PHY_SetBBReg(pAdapter, rFPGA0_XCD_RFInterfaceSW  , 0x1CC000, pdmpriv->rf_saving_Reg874);
+			PHY_SetBBReg(pAdapter, rOFDM0_AGCParameter1, BIT3, pdmpriv->rf_saving_RegC70);
+			PHY_SetBBReg(pAdapter, rFPGA0_XCD_SwitchControl, 0xFF000000, pdmpriv->rf_saving_Reg85C);
+			PHY_SetBBReg(pAdapter, 0xa74, 0xF000, pdmpriv->rf_saving_RegA74);
+			PHY_SetBBReg(pAdapter, 0x818, BIT28, 0x0);
+			DBG_8192C("%s(): RF_Normal\n", __FUNCTION__);
+		}
+		pPSTable->PreRFState = pPSTable->CurRFState;
+	}
+}
+
+static void
+dm_DynamicBBPowerSaving(
+IN	PADAPTER	pAdapter
+	)
+{
+
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct mlme_priv	*pmlmepriv = &pAdapter->mlmepriv;
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	PS_T	*pPSTable = &pdmpriv->DM_PSTable;
+
+	//1 1.Determine the minimum RSSI
+	if((check_fwstate(pmlmepriv, _FW_LINKED) != _TRUE) &&
+		(pdmpriv->EntryMinUndecoratedSmoothedPWDB == 0))
+	{
+		pPSTable->Rssi_val_min = 0;
+		//RT_TRACE(COMP_BB_POWERSAVING, DBG_LOUD, ("Not connected to any \n"));
+	}
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)	// Default port
+	{
+		//if(ACTING_AS_AP(pAdapter) || pMgntInfo->mIbss)
+		 if ((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE) ||
+			       (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE))	//todo: AP Mode
+		{
+			pPSTable->Rssi_val_min = pdmpriv->EntryMinUndecoratedSmoothedPWDB;
+			//RT_TRACE(COMP_BB_POWERSAVING, DBG_LOUD, ("AP Client PWDB = 0x%lx \n", pPSTable->Rssi_val_min));
+		}
+		else
+		{
+			pPSTable->Rssi_val_min = pdmpriv->UndecoratedSmoothedPWDB;
+			//RT_TRACE(COMP_BB_POWERSAVING, DBG_LOUD, ("STA Default Port PWDB = 0x%lx \n", pPSTable->Rssi_val_min));
+		}
+	}
+	else // associated entry pwdb
+	{
+		pPSTable->Rssi_val_min = pdmpriv->EntryMinUndecoratedSmoothedPWDB;
+		//RT_TRACE(COMP_BB_POWERSAVING, DBG_LOUD, ("AP Ext Port PWDB = 0x%lx \n", pPSTable->Rssi_val_min));
+	}
+
+	//1 2.Power Saving for 92C
+	if(IS_92C_SERIAL(pHalData->VersionID))
+	{
+		//dm_1R_CCA(pAdapter);
+	}
+
+	// 20100628 Joseph: Turn off BB power save for 88CE because it makesthroughput unstable.
+	// 20100831 Joseph: Turn ON BB power save again after modifying AGC delay from 900ns to 600ns.
+	//1 3.Power Saving for 88C
+	else
+	{
+		rtl8192c_dm_RF_Saving(pAdapter, _FALSE);
+	}
+}
+
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+// Add new function to reset the state of antenna diversity before link.
+//
+void SwAntDivResetBeforeLink8192C(IN PADAPTER Adapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	SWAT_T *pDM_SWAT_Table = &pdmpriv->DM_SWAT_Table;
+
+	pDM_SWAT_Table->SWAS_NoLink_State = 0;
+}
+
+// Compare RSSI for deciding antenna
+void	SwAntDivCompare8192C(PADAPTER Adapter, WLAN_BSSID_EX *dst, WLAN_BSSID_EX *src)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	if((0 != pHalData->AntDivCfg) && (!IS_92C_SERIAL(pHalData->VersionID)) )
+	{
+		//DBG_8192C("update_network=> orgRSSI(%d)(%d),newRSSI(%d)(%d)\n",dst->Rssi,query_rx_pwr_percentage(dst->Rssi),
+		//	src->Rssi,query_rx_pwr_percentage(src->Rssi));
+		//select optimum_antenna for before linked =>For antenna diversity
+		if(dst->Rssi >=  src->Rssi )//keep org parameter
+		{
+			src->Rssi = dst->Rssi;
+			src->PhyInfo.Optimum_antenna = dst->PhyInfo.Optimum_antenna;
+		}
+	}
+}
+
+// Add new function to reset the state of antenna diversity before link.
+u8 SwAntDivBeforeLink8192C(IN PADAPTER Adapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	SWAT_T			*pDM_SWAT_Table = &pdmpriv->DM_SWAT_Table;
+	struct mlme_priv	*pmlmepriv = &(Adapter->mlmepriv);
+
+	// Condition that does not need to use antenna diversity.
+	if(IS_92C_SERIAL(pHalData->VersionID) ||(pHalData->AntDivCfg==0))
+	{
+		//DBG_8192C("SwAntDivBeforeLink8192C(): No AntDiv Mechanism.\n");
+		return _FALSE;
+	}
+
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+	{
+		pDM_SWAT_Table->SWAS_NoLink_State = 0;
+		return _FALSE;
+	}
+	// Since driver is going to set BB register, it shall check if there is another thread controlling BB/RF.
+/*
+	if(pHalData->eRFPowerState!=eRfOn || pMgntInfo->RFChangeInProgress || pMgntInfo->bMediaConnect)
+	{
+
+
+		RT_TRACE(COMP_SWAS, DBG_LOUD,
+				("SwAntDivCheckBeforeLink8192C(): RFChangeInProgress(%x), eRFPowerState(%x)\n",
+				pMgntInfo->RFChangeInProgress,
+				pHalData->eRFPowerState));
+
+		pDM_SWAT_Table->SWAS_NoLink_State = 0;
+
+		return FALSE;
+	}
+*/
+
+	if(pDM_SWAT_Table->SWAS_NoLink_State == 0){
+		//switch channel
+		pDM_SWAT_Table->SWAS_NoLink_State = 1;
+		pDM_SWAT_Table->CurAntenna = (pDM_SWAT_Table->CurAntenna==Antenna_A)?Antenna_B:Antenna_A;
+
+		//PHY_SetBBReg(Adapter, rFPGA0_XA_RFInterfaceOE, 0x300, pDM_SWAT_Table->CurAntenna);
+		rtw_antenna_select_cmd(Adapter, pDM_SWAT_Table->CurAntenna, _FALSE);
+		//DBG_8192C("%s change antenna to ANT_( %s ).....\n",__FUNCTION__, (pDM_SWAT_Table->CurAntenna==Antenna_A)?"A":"B");
+		return _TRUE;
+	}
+	else
+	{
+		pDM_SWAT_Table->SWAS_NoLink_State = 0;
+		return _FALSE;
+	}
+
+
+
+}
+#endif
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+//
+// 20100514 Luke/Joseph:
+// Add new function to reset antenna diversity state after link.
+//
+void
+SwAntDivRestAfterLink8192C(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	SWAT_T			*pDM_SWAT_Table = &pdmpriv->DM_SWAT_Table;
+
+	if(IS_92C_SERIAL(pHalData->VersionID) ||(pHalData->AntDivCfg==0))
+		return;
+
+	//DBG_8192C("======>   SwAntDivRestAfterLink <========== \n");
+	pHalData->RSSI_cnt_A= 0;
+	pHalData->RSSI_cnt_B= 0;
+	pHalData->RSSI_test = _FALSE;
+
+	pDM_SWAT_Table->try_flag = 0xff;
+	pDM_SWAT_Table->RSSI_Trying = 0;
+	pDM_SWAT_Table->SelectAntennaMap=0xAA;
+	pDM_SWAT_Table->CurAntenna = pHalData->CurAntenna;
+	pDM_SWAT_Table->PreAntenna = pHalData->CurAntenna;
+
+	pdmpriv->lastTxOkCnt=0;
+	pdmpriv->lastRxOkCnt=0;
+
+	pdmpriv->TXByteCnt_A=0;
+	pdmpriv->TXByteCnt_B=0;
+	pdmpriv->RXByteCnt_A=0;
+	pdmpriv->RXByteCnt_B=0;
+	pdmpriv->DoubleComfirm=0;
+	pdmpriv->TrafficLoad = TRAFFIC_LOW;
+
+}
+
+
+//
+// 20100514 Luke/Joseph:
+// Add new function for antenna diversity after link.
+// This is the main function of antenna diversity after link.
+// This function is called in HalDmWatchDog() and dm_SW_AntennaSwitchCallback().
+// HalDmWatchDog() calls this function with SWAW_STEP_PEAK to initialize the antenna test.
+// In SWAW_STEP_PEAK, another antenna and a 500ms timer will be set for testing.
+// After 500ms, dm_SW_AntennaSwitchCallback() calls this function to compare the signal just
+// listened on the air with the RSSI of original antenna.
+// It chooses the antenna with better RSSI.
+// There is also a aged policy for error trying. Each error trying will cost more 5 seconds waiting
+// penalty to get next try.
+//
+static VOID
+dm_SW_AntennaSwitch(
+	PADAPTER	Adapter,
+	u8			Step
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	SWAT_T	*pDM_SWAT_Table = &pdmpriv->DM_SWAT_Table;
+	s32			curRSSI=100, RSSI_A, RSSI_B;
+	u64			curTxOkCnt, curRxOkCnt;
+	u64			CurByteCnt = 0, PreByteCnt = 0;
+	u8		nextAntenna = 0;
+	u8			Score_A=0, Score_B=0;
+	u8			i;
+
+	// Condition that does not need to use antenna diversity.
+	if(IS_92C_SERIAL(pHalData->VersionID) ||(pHalData->AntDivCfg==0))
+	{
+		//RT_TRACE(COMP_SWAS, DBG_LOUD, ("dm_SW_AntennaSwitch(): No AntDiv Mechanism.\n"));
+		return;
+	}
+	// If dynamic ant_div is disabled.
+	if(!(pdmpriv->DMFlag & DYNAMIC_FUNC_ANT_DIV) )
+	{
+		return;
+	}
+
+	if (check_fwstate(&Adapter->mlmepriv, _FW_LINKED)	==_FALSE)
+		return;
+#if 0 //to do
+	// Radio off: Status reset to default and return.
+	if(pHalData->eRFPowerState==eRfOff)
+	{
+		SwAntDivRestAfterLink(Adapter);
+		return;
+	}
+#endif
+	//DBG_8192C("\n............................ %s.........................\n",__FUNCTION__);
+	// Handling step mismatch condition.
+	// Peak step is not finished at last time. Recover the variable and check again.
+	if( Step != pDM_SWAT_Table->try_flag	)
+	{
+		SwAntDivRestAfterLink8192C(Adapter);
+	}
+
+
+	if(pDM_SWAT_Table->try_flag == 0xff)
+	{
+#if 0
+		// Select RSSI checking target
+		if(pMgntInfo->mAssoc && !ACTING_AS_AP(Adapter))
+		{
+			// Target: Infrastructure mode AP.
+			pHalData->RSSI_target = NULL;
+			RT_TRACE(COMP_SWAS, DBG_LOUD, ("dm_SW_AntennaSwitch(): RSSI_target is DEF AP!\n"));
+		}
+		else
+		{
+			u8			index = 0;
+			PRT_WLAN_STA	pEntry = NULL;
+			PADAPTER		pTargetAdapter = NULL;
+
+			if(	pMgntInfo->mIbss || ACTING_AS_AP(Adapter) )
+			{
+				// Target: AP/IBSS peer.
+				pTargetAdapter = Adapter;
+			}
+			else if(ACTING_AS_AP(ADJUST_TO_ADAPTIVE_ADAPTER(Adapter, FALSE)))
+			{
+				// Target: VWIFI peer.
+				pTargetAdapter = ADJUST_TO_ADAPTIVE_ADAPTER(Adapter, FALSE);
+			}
+
+			if(pTargetAdapter != NULL)
+			{
+				for(index=0; index<ASSOCIATE_ENTRY_NUM; index++)
+				{
+					pEntry = AsocEntry_EnumStation(pTargetAdapter, index);
+					if(pEntry != NULL)
+					{
+						if(pEntry->bAssociated)
+							break;
+					}
+				}
+			}
+
+			if(pEntry == NULL)
+			{
+				SwAntDivRestAfterLink(Adapter);
+				RT_TRACE(COMP_SWAS, DBG_LOUD, ("dm_SW_AntennaSwitch(): No Link.\n"));
+				return;
+			}
+			else
+			{
+				pHalData->RSSI_target = pEntry;
+				RT_TRACE(COMP_SWAS, DBG_LOUD, ("dm_SW_AntennaSwitch(): RSSI_target is PEER STA\n"));
+			}
+		}
+
+
+#endif
+
+		pHalData->RSSI_cnt_A= 0;
+		pHalData->RSSI_cnt_B= 0;
+		pDM_SWAT_Table->try_flag = 0;
+	//	DBG_8192C("dm_SW_AntennaSwitch(): Set try_flag to 0 prepare for peak!\n");
+		return;
+	}
+	else
+	{
+		curTxOkCnt = Adapter->xmitpriv.tx_bytes - pdmpriv->lastTxOkCnt;
+		curRxOkCnt = Adapter->recvpriv.rx_bytes - pdmpriv->lastRxOkCnt;
+
+		pdmpriv->lastTxOkCnt = Adapter->xmitpriv.tx_bytes ;
+		pdmpriv->lastRxOkCnt = Adapter->recvpriv.rx_bytes ;
+
+		if(pDM_SWAT_Table->try_flag == 1)
+		{
+			if(pDM_SWAT_Table->CurAntenna == Antenna_A)
+		{
+				pdmpriv->TXByteCnt_A += curTxOkCnt;
+				pdmpriv->RXByteCnt_A += curRxOkCnt;
+				//DBG_8192C("#####  TXByteCnt_A(%lld) , RXByteCnt_A(%lld) ####\n",pdmpriv->TXByteCnt_A,pdmpriv->RXByteCnt_A);
+			}
+			else
+			{
+				pdmpriv->TXByteCnt_B += curTxOkCnt;
+				pdmpriv->RXByteCnt_B += curRxOkCnt;
+				//DBG_8192C("#####  TXByteCnt_B(%lld) , RXByteCnt_B(%lld) ####\n",pdmpriv->TXByteCnt_B,pdmpriv->RXByteCnt_B);
+			}
+
+			nextAntenna = (pDM_SWAT_Table->CurAntenna == Antenna_A)? Antenna_B : Antenna_A;
+			pDM_SWAT_Table->RSSI_Trying--;
+			//DBG_8192C("RSSI_Trying = %d\n",pDM_SWAT_Table->RSSI_Trying);
+
+			if(pDM_SWAT_Table->RSSI_Trying == 0)
+			{
+				CurByteCnt = (pDM_SWAT_Table->CurAntenna == Antenna_A)? (pdmpriv->TXByteCnt_A+pdmpriv->RXByteCnt_A) : (pdmpriv->TXByteCnt_B+pdmpriv->RXByteCnt_B);
+				PreByteCnt = (pDM_SWAT_Table->CurAntenna == Antenna_A)? (pdmpriv->TXByteCnt_B+pdmpriv->RXByteCnt_B) : (pdmpriv->TXByteCnt_A+pdmpriv->RXByteCnt_A);
+
+				//DBG_8192C("CurByteCnt = %lld\n", CurByteCnt);
+				//DBG_8192C("PreByteCnt = %lld\n",PreByteCnt);
+
+				if(pdmpriv->TrafficLoad == TRAFFIC_HIGH)
+				{
+					PreByteCnt = PreByteCnt*9;	//normalize:Cur=90ms:Pre=10ms
+				}
+				else if(pdmpriv->TrafficLoad == TRAFFIC_LOW)
+				{
+					//CurByteCnt = CurByteCnt/2;
+					CurByteCnt = CurByteCnt>>1;//normalize:100ms:50ms
+				}
+
+
+				//DBG_8192C("After DIV=>CurByteCnt = %lld\n", CurByteCnt);
+				//DBG_8192C("PreByteCnt = %lld\n",PreByteCnt);
+
+				if(pHalData->RSSI_cnt_A > 0)
+					RSSI_A = pHalData->RSSI_sum_A/pHalData->RSSI_cnt_A;
+				else
+					RSSI_A = 0;
+				if(pHalData->RSSI_cnt_B > 0)
+					RSSI_B = pHalData->RSSI_sum_B/pHalData->RSSI_cnt_B;
+				else
+					RSSI_B = 0;
+
+				curRSSI = (pDM_SWAT_Table->CurAntenna == Antenna_A)? RSSI_A : RSSI_B;
+				pDM_SWAT_Table->PreRSSI =  (pDM_SWAT_Table->CurAntenna == Antenna_A)? RSSI_B : RSSI_A;
+				//DBG_8192C("Luke:PreRSSI = %d, CurRSSI = %d\n",pDM_SWAT_Table->PreRSSI, curRSSI);
+				//DBG_8192C("SWAS: preAntenna= %s, curAntenna= %s \n",
+				//(pDM_SWAT_Table->PreAntenna == Antenna_A?"A":"B"), (pDM_SWAT_Table->CurAntenna == Antenna_A?"A":"B"));
+				//DBG_8192C("Luke:RSSI_A= %d, RSSI_cnt_A = %d, RSSI_B= %d, RSSI_cnt_B = %d\n",
+					//RSSI_A, pHalData->RSSI_cnt_A, RSSI_B, pHalData->RSSI_cnt_B);
+			}
+
+			}
+			else
+			{
+
+			if(pHalData->RSSI_cnt_A > 0)
+				RSSI_A = pHalData->RSSI_sum_A/pHalData->RSSI_cnt_A;
+			else
+				RSSI_A = 0;
+			if(pHalData->RSSI_cnt_B > 0)
+				RSSI_B = pHalData->RSSI_sum_B/pHalData->RSSI_cnt_B;
+			else
+				RSSI_B = 0;
+			curRSSI = (pDM_SWAT_Table->CurAntenna == Antenna_A)? RSSI_A : RSSI_B;
+			pDM_SWAT_Table->PreRSSI =  (pDM_SWAT_Table->PreAntenna == Antenna_A)? RSSI_A : RSSI_B;
+			//DBG_8192C("Ekul:PreRSSI = %d, CurRSSI = %d\n", pDM_SWAT_Table->PreRSSI, curRSSI);
+			//DBG_8192C("SWAS: preAntenna= %s, curAntenna= %s \n",
+			//(pDM_SWAT_Table->PreAntenna == Antenna_A?"A":"B"), (pDM_SWAT_Table->CurAntenna == Antenna_A?"A":"B"));
+
+			//DBG_8192C("Ekul:RSSI_A= %d, RSSI_cnt_A = %d, RSSI_B= %d, RSSI_cnt_B = %d\n",
+			//	RSSI_A, pHalData->RSSI_cnt_A, RSSI_B, pHalData->RSSI_cnt_B);
+			//RT_TRACE(COMP_SWAS, DBG_LOUD, ("Ekul:curTxOkCnt = %d\n", curTxOkCnt));
+			//RT_TRACE(COMP_SWAS, DBG_LOUD, ("Ekul:curRxOkCnt = %d\n", curRxOkCnt));
+			}
+
+		//1 Trying State
+		if((pDM_SWAT_Table->try_flag == 1)&&(pDM_SWAT_Table->RSSI_Trying == 0))
+		{
+
+			if(pDM_SWAT_Table->TestMode == TP_MODE)
+			{
+				//DBG_8192C("SWAS: TestMode = TP_MODE\n");
+				//DBG_8192C("TRY:CurByteCnt = %lld\n", CurByteCnt);
+				//DBG_8192C("TRY:PreByteCnt = %lld\n",PreByteCnt);
+				if(CurByteCnt < PreByteCnt)
+				{
+					if(pDM_SWAT_Table->CurAntenna == Antenna_A)
+						pDM_SWAT_Table->SelectAntennaMap=pDM_SWAT_Table->SelectAntennaMap<<1;
+					else
+						pDM_SWAT_Table->SelectAntennaMap=(pDM_SWAT_Table->SelectAntennaMap<<1)+1;
+				}
+				else
+				{
+					if(pDM_SWAT_Table->CurAntenna == Antenna_A)
+						pDM_SWAT_Table->SelectAntennaMap=(pDM_SWAT_Table->SelectAntennaMap<<1)+1;
+					else
+						pDM_SWAT_Table->SelectAntennaMap=pDM_SWAT_Table->SelectAntennaMap<<1;
+				}
+				for (i= 0; i<8; i++)
+				{
+					if(((pDM_SWAT_Table->SelectAntennaMap>>i)&BIT0) == 1)
+						Score_A++;
+					else
+						Score_B++;
+				}
+				//DBG_8192C("SelectAntennaMap=%x\n ",pDM_SWAT_Table->SelectAntennaMap);
+				//DBG_8192C("Score_A=%d, Score_B=%d\n", Score_A, Score_B);
+
+				if(pDM_SWAT_Table->CurAntenna == Antenna_A)
+				{
+					nextAntenna = (Score_A > Score_B)?Antenna_A:Antenna_B;
+				}
+				else
+				{
+					nextAntenna = (Score_B > Score_A)?Antenna_B:Antenna_A;
+				}
+				//RT_TRACE(COMP_SWAS, DBG_LOUD, ("nextAntenna=%s\n",(nextAntenna==Antenna_A)?"A":"B"));
+				//RT_TRACE(COMP_SWAS, DBG_LOUD, ("preAntenna= %s, curAntenna= %s \n",
+					//(DM_SWAT_Table.PreAntenna == Antenna_A?"A":"B"), (DM_SWAT_Table.CurAntenna == Antenna_A?"A":"B")));
+
+				if(nextAntenna != pDM_SWAT_Table->CurAntenna)
+				{
+					//DBG_8192C("SWAS: Switch back to another antenna\n");
+				}
+				else
+				{
+					//DBG_8192C("SWAS: current anntena is good\n");
+				}
+			}
+
+			if(pDM_SWAT_Table->TestMode == RSSI_MODE)
+			{
+				//DBG_8192C("SWAS: TestMode = RSSI_MODE\n");
+				pDM_SWAT_Table->SelectAntennaMap=0xAA;
+				if(curRSSI < pDM_SWAT_Table->PreRSSI) //Current antenna is worse than previous antenna
+				{
+					//DBG_8192C("SWAS: Switch back to another antenna\n");
+					nextAntenna = (pDM_SWAT_Table->CurAntenna == Antenna_A)? Antenna_B : Antenna_A;
+				}
+				else // current anntena is good
+				{
+					nextAntenna = pDM_SWAT_Table->CurAntenna;
+					//DBG_8192C("SWAS: current anntena is good\n");
+				}
+				}
+				pDM_SWAT_Table->try_flag = 0;
+				pHalData->RSSI_test = _FALSE;
+				pHalData->RSSI_sum_A = 0;
+				pHalData->RSSI_cnt_A = 0;
+				pHalData->RSSI_sum_B = 0;
+				pHalData->RSSI_cnt_B = 0;
+				pdmpriv->TXByteCnt_A = 0;
+				pdmpriv->TXByteCnt_B = 0;
+				pdmpriv->RXByteCnt_A = 0;
+				pdmpriv->RXByteCnt_B = 0;
+
+			}
+
+		//1 Normal State
+		else if(pDM_SWAT_Table->try_flag == 0)
+			{
+			if(pdmpriv->TrafficLoad == TRAFFIC_HIGH)
+				{
+				if(((curTxOkCnt+curRxOkCnt)>>1) > 1875000)
+					pdmpriv->TrafficLoad = TRAFFIC_HIGH;
+				else
+					pdmpriv->TrafficLoad = TRAFFIC_LOW;
+			}
+			else if(pdmpriv->TrafficLoad == TRAFFIC_LOW)
+				{
+				if(((curTxOkCnt+curRxOkCnt)>>1) > 1875000)
+					pdmpriv->TrafficLoad = TRAFFIC_HIGH;
+				else
+					pdmpriv->TrafficLoad = TRAFFIC_LOW;
+			}
+			if(pdmpriv->TrafficLoad == TRAFFIC_HIGH)
+				pDM_SWAT_Table->bTriggerAntennaSwitch = 0;
+			//DBG_8192C("Normal:TrafficLoad = %lld\n", curTxOkCnt+curRxOkCnt);
+
+			//Prepare To Try Antenna
+					nextAntenna = (pDM_SWAT_Table->CurAntenna == Antenna_A)? Antenna_B : Antenna_A;
+					pDM_SWAT_Table->try_flag = 1;
+					pHalData->RSSI_test = _TRUE;
+			if((curRxOkCnt+curTxOkCnt) > 1000)
+			{
+				pDM_SWAT_Table->RSSI_Trying = 4;
+				pDM_SWAT_Table->TestMode = TP_MODE;
+				}
+				else
+				{
+				pDM_SWAT_Table->RSSI_Trying = 2;
+				pDM_SWAT_Table->TestMode = RSSI_MODE;
+
+			}
+			//DBG_8192C("SWAS: Normal State -> Begin Trying! TestMode=%s\n",(pDM_SWAT_Table->TestMode == TP_MODE)?"TP":"RSSI");
+
+
+			pHalData->RSSI_sum_A = 0;
+			pHalData->RSSI_cnt_A = 0;
+			pHalData->RSSI_sum_B = 0;
+			pHalData->RSSI_cnt_B = 0;
+		}
+	}
+
+	//1 4.Change TRX antenna
+	if(nextAntenna != pDM_SWAT_Table->CurAntenna)
+	{
+		//DBG_8192C("@@@@@@@@ SWAS: Change TX Antenna!\n ");
+		rtw_antenna_select_cmd(Adapter, nextAntenna, 1);
+	}
+
+	//1 5.Reset Statistics
+	pDM_SWAT_Table->PreAntenna = pDM_SWAT_Table->CurAntenna;
+	pDM_SWAT_Table->CurAntenna = nextAntenna;
+	pDM_SWAT_Table->PreRSSI = curRSSI;
+
+
+	//1 6.Set next timer
+
+	if(pDM_SWAT_Table->RSSI_Trying == 0)
+		return;
+
+	if(pDM_SWAT_Table->RSSI_Trying%2 == 0)
+	{
+		if(pDM_SWAT_Table->TestMode == TP_MODE)
+		{
+			if(pdmpriv->TrafficLoad == TRAFFIC_HIGH)
+			{
+				_set_timer(&pdmpriv->SwAntennaSwitchTimer,10 ); //ms
+				//DBG_8192C("dm_SW_AntennaSwitch(): Test another antenna for 10 ms\n");
+			}
+			else if(pdmpriv->TrafficLoad == TRAFFIC_LOW)
+			{
+				_set_timer(&pdmpriv->SwAntennaSwitchTimer, 50 ); //ms
+				//DBG_8192C("dm_SW_AntennaSwitch(): Test another antenna for 50 ms\n");
+			}
+	}
+	else
+	{
+			_set_timer(&pdmpriv->SwAntennaSwitchTimer, 500 ); //ms
+			//DBG_8192C("dm_SW_AntennaSwitch(): Test another antenna for 500 ms\n");
+		}
+	}
+	else
+	{
+		if(pDM_SWAT_Table->TestMode == TP_MODE)
+		{
+			if(pdmpriv->TrafficLoad == TRAFFIC_HIGH)
+				_set_timer(&pdmpriv->SwAntennaSwitchTimer,90 ); //ms
+			else if(pdmpriv->TrafficLoad == TRAFFIC_LOW)
+				_set_timer(&pdmpriv->SwAntennaSwitchTimer,100 ); //ms
+		}
+		else
+		{
+			_set_timer(&pdmpriv->SwAntennaSwitchTimer,500 ); //ms
+			//DBG_8192C("dm_SW_AntennaSwitch(): Test another antenna for 500 ms\n");
+		}
+	}
+
+//	RT_TRACE(COMP_SWAS, DBG_LOUD, ("SWAS: -----The End-----\n "));
+
+}
+
+//
+// 20100514 Luke/Joseph:
+// Callback function for 500ms antenna test trying.
+//
+static void dm_SW_AntennaSwitchCallback(void *FunctionContext)
+{
+	_adapter *padapter = (_adapter *)FunctionContext;
+
+	if(padapter->net_closed == _TRUE)
+			return;
+	// Only
+	dm_SW_AntennaSwitch(padapter, SWAW_STEP_DETERMINE);
+}
+
+
+//
+// 20100722
+// This function is used to gather the RSSI information for antenna testing.
+// It selects the RSSI of the peer STA that we want to know.
+//
+void SwAntDivRSSICheck8192C(_adapter *padapter ,u32 RxPWDBAll)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+	SWAT_T	*pDM_SWAT_Table = &pdmpriv->DM_SWAT_Table;
+
+	if(IS_92C_SERIAL(pHalData->VersionID) ||pHalData->AntDivCfg==0)
+		return;
+
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+	{
+		if(pDM_SWAT_Table->CurAntenna == Antenna_A)
+		{
+			pHalData->RSSI_sum_A += RxPWDBAll;
+			pHalData->RSSI_cnt_A++;
+		}
+		else
+		{
+			pHalData->RSSI_sum_B+= RxPWDBAll;
+			pHalData->RSSI_cnt_B++;
+
+		}
+		//DBG_8192C("%s Ant_(%s),RSSI_sum(%d),RSSI_cnt(%d)\n",__FUNCTION__,(2==pHalData->CurAntenna)?"A":"B",pHalData->RSSI_sum,pHalData->RSSI_cnt);
+	}
+
+}
+
+
+
+static VOID
+dm_SW_AntennaSwitchInit(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	SWAT_T	*pDM_SWAT_Table = &pdmpriv->DM_SWAT_Table;
+
+	pHalData->RSSI_sum_A = 0;
+	pHalData->RSSI_sum_B = 0;
+	pHalData->RSSI_cnt_A = 0;
+	pHalData->RSSI_cnt_B = 0;
+
+	pDM_SWAT_Table->CurAntenna = pHalData->CurAntenna;
+	pDM_SWAT_Table->PreAntenna = pHalData->CurAntenna;
+	pDM_SWAT_Table->try_flag = 0xff;
+	pDM_SWAT_Table->PreRSSI = 0;
+	pDM_SWAT_Table->bTriggerAntennaSwitch = 0;
+	pDM_SWAT_Table->SelectAntennaMap=0xAA;
+
+	// Move the timer initialization to InitializeVariables function.
+	//PlatformInitializeTimer(Adapter, &pMgntInfo->SwAntennaSwitchTimer, (RT_TIMER_CALL_BACK)dm_SW_AntennaSwitchCallback, NULL, "SwAntennaSwitchTimer");
+}
+
+#endif
+
+//#define	RSSI_CCK	0
+//#define	RSSI_OFDM	1
+static void dm_RSSIMonitorInit(
+	IN	PADAPTER	Adapter
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	pdmpriv->OFDM_Pkt_Cnt = 0;
+	pdmpriv->RSSI_Select = RSSI_DEFAULT;
+}
+
+static void dm_RSSIMonitorCheck(
+	IN	PADAPTER	Adapter
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	struct mlme_priv *pmlmepriv = &Adapter->mlmepriv;
+
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _FALSE)
+		return;
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE |WIFI_ADHOC_STATE) == _TRUE )
+	{
+		if(Adapter->stapriv.asoc_sta_count < 2)
+			return;
+	}
+
+	if(pdmpriv->OFDM_Pkt_Cnt == 0)
+		pdmpriv->RSSI_Select = RSSI_CCK;
+	else
+		pdmpriv->RSSI_Select = RSSI_OFDM;
+
+	pdmpriv->OFDM_Pkt_Cnt = 0;
+	//DBG_8192C("RSSI_Select=%s OFDM_Pkt_Cnt(%d)\n",
+		//(pdmpriv->RSSI_Select == RSSI_OFDM)?"RSSI_OFDM":"RSSI_CCK",
+		//pdmpriv->OFDM_Pkt_Cnt);
+}
+
+//============================================================
+// functions
+//============================================================
+void rtl8192c_init_dm_priv(IN PADAPTER Adapter)
+{
+	PHAL_DATA_TYPE	pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+	//_rtw_memset(pdmpriv, 0, sizeof(struct dm_priv));
+
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+	_init_timer(&(pdmpriv->SwAntennaSwitchTimer),  Adapter->pnetdev , dm_SW_AntennaSwitchCallback, Adapter);
+#endif
+}
+
+void rtl8192c_deinit_dm_priv(IN PADAPTER Adapter)
+{
+	PHAL_DATA_TYPE	pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+	_cancel_timer_ex(&pdmpriv->SwAntennaSwitchTimer);
+#endif
+}
+#ifdef CONFIG_HW_ANTENNA_DIVERSITY
+void dm_InitHybridAntDiv(IN PADAPTER Adapter)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+
+	if(IS_92C_SERIAL(pHalData->VersionID) ||pHalData->AntDivCfg==0)
+		return;
+
+	//Set OFDM HW RX Antenna Diversity
+	PHY_SetBBReg(Adapter,0xc50, BIT7, 1); //Enable Hardware antenna switch
+	PHY_SetBBReg(Adapter,0x870, BIT9|BIT8, 0); //Enable hardware control of "ANT_SEL" & "ANT_SELB"
+	PHY_SetBBReg(Adapter,0xCA4, BIT11, 0); //Switch to another antenna by checking pwdb threshold
+	PHY_SetBBReg(Adapter,0xCA4, 0x7FF, 0x080); //Pwdb threshold=8dB
+	PHY_SetBBReg(Adapter,0xC54, BIT23, 1); //Decide final antenna by comparing 2 antennas' pwdb
+	PHY_SetBBReg(Adapter,0x874, BIT23, 0); //No update ANTSEL during GNT_BT=1
+	PHY_SetBBReg(Adapter,0x80C, BIT21, 1); //TX atenna selection from tx_info
+	//Set CCK HW RX Antenna Diversity
+	PHY_SetBBReg(Adapter,0xA00, BIT15, 1);//Enable antenna diversity
+	PHY_SetBBReg(Adapter,0xA0C, BIT4, 0); //Antenna diversity decision period = 32 sample
+	PHY_SetBBReg(Adapter,0xA0C, 0xf, 0xf); //Threshold for antenna diversity. Check another antenna power if input power < ANT_lim*4
+	PHY_SetBBReg(Adapter,0xA10, BIT13, 1); //polarity ana_A=1 and ana_B=0
+	PHY_SetBBReg(Adapter,0xA14, 0x1f, 0x8); //default antenna power = inpwr*(0.5 + r_ant_step/16)
+
+	pHalData->CCK_Ant1_Cnt = 0;
+	pHalData->CCK_Ant2_Cnt = 0;
+	pHalData->OFDM_Ant1_Cnt = 0;
+	pHalData->OFDM_Ant2_Cnt = 0;
+}
+
+
+#define 	RxDefaultAnt1		0x65a9
+#define	RxDefaultAnt2		0x569a
+
+void dm_SelectRXDefault(IN	PADAPTER	Adapter)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+
+	if(IS_92C_SERIAL(pHalData->VersionID) ||pHalData->AntDivCfg==0)
+		return;
+
+	//DbgPrint(" Ant1_Cnt=%d, Ant2_Cnt=%d\n", pHalData->Ant1_Cnt, pHalData->Ant2_Cnt);
+	//DBG_8192C(" CCK_Ant1_Cnt = %d,  CCK_Ant2_Cnt = %d\n", pHalData->CCK_Ant1_Cnt, pHalData->CCK_Ant2_Cnt);
+	//DBG_8192C(" OFDM_Ant1_Cnt = %d,  OFDM_Ant2_Cnt = %d\n", pHalData->OFDM_Ant1_Cnt, pHalData->OFDM_Ant2_Cnt);
+	if((pHalData->OFDM_Ant1_Cnt == 0) && (pHalData->OFDM_Ant2_Cnt == 0))
+	{
+		if((pHalData->CCK_Ant1_Cnt + pHalData->CCK_Ant2_Cnt) >=10 )
+		{
+			if(pHalData->CCK_Ant1_Cnt > (5*pHalData->CCK_Ant2_Cnt))
+			{
+				DBG_8192C(" RX Default = Ant1\n");
+				PHY_SetBBReg(Adapter, 0x858, 0xFFFF, RxDefaultAnt1);
+			}
+			else if(pHalData->CCK_Ant2_Cnt > (5*pHalData->CCK_Ant1_Cnt))
+			{
+				DBG_8192C(" RX Default = Ant2\n");
+				PHY_SetBBReg(Adapter, 0x858, 0xFFFF, RxDefaultAnt2);
+			}
+			else if(pHalData->CCK_Ant1_Cnt > pHalData->CCK_Ant2_Cnt)
+			{
+				DBG_8192C(" RX Default = Ant2\n");
+				PHY_SetBBReg(Adapter, 0x858, 0xFFFF, RxDefaultAnt2);
+			}
+			else
+			{
+				DBG_8192C(" RX Default = Ant1\n");
+				PHY_SetBBReg(Adapter, 0x858, 0xFFFF, RxDefaultAnt1);
+			}
+			pHalData->CCK_Ant1_Cnt = 0;
+			pHalData->CCK_Ant2_Cnt = 0;
+			pHalData->OFDM_Ant1_Cnt = 0;
+			pHalData->OFDM_Ant2_Cnt = 0;
+		}
+	}
+	else
+	{
+		if(pHalData->OFDM_Ant1_Cnt > pHalData->OFDM_Ant2_Cnt)
+		{
+			DBG_8192C(" RX Default = Ant1\n");
+			PHY_SetBBReg(Adapter, 0x858, 0xFFFF, RxDefaultAnt1);
+		}
+		else
+		{
+			DBG_8192C(" RX Default = Ant2\n");
+			PHY_SetBBReg(Adapter, 0x858, 0xFFFF, RxDefaultAnt2);
+		}
+		pHalData->CCK_Ant1_Cnt = 0;
+		pHalData->CCK_Ant2_Cnt = 0;
+		pHalData->OFDM_Ant1_Cnt = 0;
+		pHalData->OFDM_Ant2_Cnt = 0;
+	}
+
+
+}
+
+#endif
+
+void
+rtl8192c_InitHalDm(
+	IN	PADAPTER	Adapter
+	)
+{
+	PHAL_DATA_TYPE	pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	u8	i;
+
+#ifdef CONFIG_USB_HCI
+	dm_InitGPIOSetting(Adapter);
+#endif
+
+	pdmpriv->DM_Type = DM_Type_ByDriver;
+	pdmpriv->DMFlag = DYNAMIC_FUNC_DISABLE;
+	pdmpriv->UndecoratedSmoothedPWDB = (-1);
+	pdmpriv->UndecoratedSmoothedCCK = (-1);
+
+
+	//.1 DIG INIT
+	pdmpriv->bDMInitialGainEnable = _TRUE;
+	pdmpriv->DMFlag |= DYNAMIC_FUNC_DIG;
+	dm_DIGInit(Adapter);
+
+	//.2 DynamicTxPower INIT
+	pdmpriv->DMFlag |= DYNAMIC_FUNC_HP;
+	dm_InitDynamicTxPower(Adapter);
+
+	//.3
+	DM_InitEdcaTurbo(Adapter);
+
+	//.4 RateAdaptive INIT
+	dm_InitRateAdaptiveMask(Adapter);
+
+	//.5 Tx Power Tracking Init.
+	pdmpriv->DMFlag |= DYNAMIC_FUNC_SS;
+	DM_InitializeTXPowerTracking(Adapter);
+
+#ifdef CONFIG_BT_COEXIST
+	pdmpriv->DMFlag |= DYNAMIC_FUNC_BT;
+	dm_InitBtCoexistDM(Adapter);
+#endif
+
+	dm_InitDynamicBBPowerSaving(Adapter);
+
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+	pdmpriv->DMFlag |= DYNAMIC_FUNC_ANT_DIV;
+	dm_SW_AntennaSwitchInit(Adapter);
+#endif
+
+#ifdef CONFIG_HW_ANTENNA_DIVERSITY
+	pdmpriv->DMFlag |= DYNAMIC_FUNC_ANT_DIV;
+	dm_InitHybridAntDiv(Adapter);
+#endif
+
+	dm_RSSIMonitorInit(Adapter);
+
+	pdmpriv->DMFlag_tmp = pdmpriv->DMFlag;
+
+	// Save REG_INIDATA_RATE_SEL value for TXDESC.
+	for(i = 0 ; i<32 ; i++)
+	{
+		pdmpriv->INIDATA_RATE[i] = rtw_read8(Adapter, REG_INIDATA_RATE_SEL+i) & 0x3f;
+	}
+
+#ifdef CONFIG_DM_ADAPTIVITY
+	pdmpriv->DMFlag |= DYNAMIC_FUNC_ADAPTIVITY;
+	dm_adaptivity_init(Adapter);
+#endif
+
+}
+
+#ifdef CONFIG_CONCURRENT_MODE
+static void FindMinimumRSSI(PADAPTER Adapter)
+{
+	PHAL_DATA_TYPE	pbuddy_HalData;
+	struct dm_priv *pbuddy_dmpriv;
+	PHAL_DATA_TYPE	pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	PADAPTER pbuddy_adapter = Adapter->pbuddy_adapter;
+	struct mlme_priv *pmlmepriv = &Adapter->mlmepriv;
+
+	if(!rtw_buddy_adapter_up(Adapter))
+		return;
+
+	pbuddy_HalData = GET_HAL_DATA(pbuddy_adapter);
+	pbuddy_dmpriv = &pbuddy_HalData->dmpriv;
+
+	//get min. [PWDB] when both interfaces are connected
+	if((check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE
+		&& Adapter->stapriv.asoc_sta_count > 2
+		&& check_buddy_fwstate(Adapter, _FW_LINKED)) ||
+		(check_buddy_fwstate(Adapter, WIFI_AP_STATE) == _TRUE
+		&& pbuddy_adapter->stapriv.asoc_sta_count > 2
+		&& check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) ||
+		(check_fwstate(pmlmepriv, WIFI_STATION_STATE)
+		&& check_fwstate(pmlmepriv, _FW_LINKED)
+		&& check_buddy_fwstate(Adapter,WIFI_STATION_STATE)
+		&& check_buddy_fwstate(Adapter,_FW_LINKED)))
+	{
+		if(pdmpriv->UndecoratedSmoothedPWDB > pbuddy_dmpriv->UndecoratedSmoothedPWDB)
+			pdmpriv->UndecoratedSmoothedPWDB = pbuddy_dmpriv->UndecoratedSmoothedPWDB;
+	}//primary interface is not connected
+	else if((check_buddy_fwstate(Adapter, WIFI_AP_STATE) == _TRUE
+		&& pbuddy_adapter->stapriv.asoc_sta_count > 2) ||
+		(check_buddy_fwstate(Adapter,WIFI_STATION_STATE)
+		&& check_buddy_fwstate(Adapter,_FW_LINKED)))
+	{
+		pdmpriv->UndecoratedSmoothedPWDB = pbuddy_dmpriv->UndecoratedSmoothedPWDB;
+	}
+	//secondary is not connected
+	else if((check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE
+		&& Adapter->stapriv.asoc_sta_count > 2) ||
+		(check_fwstate(pmlmepriv, WIFI_STATION_STATE)
+		&& check_fwstate(pmlmepriv, _FW_LINKED)))
+	{
+		pbuddy_dmpriv->UndecoratedSmoothedPWDB = 0;
+	}
+	//both interfaces are not connected
+	else
+	{
+		pdmpriv->UndecoratedSmoothedPWDB = 0;
+		pbuddy_dmpriv->UndecoratedSmoothedPWDB = 0;
+	}
+
+	//primary interface is ap mode
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE && Adapter->stapriv.asoc_sta_count > 2)
+	{
+		pbuddy_dmpriv->EntryMinUndecoratedSmoothedPWDB = 0;
+	}//secondary interface is ap mode
+	else if(check_buddy_fwstate(Adapter, WIFI_AP_STATE) == _TRUE && pbuddy_adapter->stapriv.asoc_sta_count > 2)
+	{
+		pdmpriv->EntryMinUndecoratedSmoothedPWDB = pbuddy_dmpriv->EntryMinUndecoratedSmoothedPWDB;
+	}
+	else //both interfaces are not ap mode
+	{
+		pdmpriv->EntryMinUndecoratedSmoothedPWDB = pbuddy_dmpriv->EntryMinUndecoratedSmoothedPWDB = 0;
+	}
+
+}
+
+#endif //CONFIG_CONCURRENT_MODE
+
+VOID
+rtl8192c_HalDmWatchDog(
+	IN	PADAPTER	Adapter
+	)
+{
+	BOOLEAN		bFwCurrentInPSMode = _FALSE;
+	BOOLEAN		bFwPSAwake = _TRUE;
+	u8 hw_init_completed = _FALSE;
+	PHAL_DATA_TYPE	pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	struct mlme_priv	*pmlmepriv = &Adapter->mlmepriv;
+#ifdef CONFIG_CONCURRENT_MODE
+	PADAPTER pbuddy_adapter = Adapter->pbuddy_adapter;
+#endif //CONFIG_CONCURRENT_MODE
+
+	#if defined(CONFIG_CONCURRENT_MODE)
+	if (Adapter->isprimary == _FALSE && pbuddy_adapter) {
+		hw_init_completed = pbuddy_adapter->hw_init_completed;
+	} else
+	#endif
+	{
+		hw_init_completed = Adapter->hw_init_completed;
+	}
+
+	if (hw_init_completed == _FALSE)
+		goto skip_dm;
+
+#ifdef CONFIG_LPS
+	#if defined(CONFIG_CONCURRENT_MODE)
+	if (Adapter->iface_type != IFACE_PORT0 && pbuddy_adapter) {
+		bFwCurrentInPSMode = pbuddy_adapter->pwrctrlpriv.bFwCurrentInPSMode;
+		rtw_hal_get_hwreg(pbuddy_adapter, HW_VAR_FWLPS_RF_ON, (u8 *)(&bFwPSAwake));
+	} else
+	#endif
+	{
+		bFwCurrentInPSMode = Adapter->pwrctrlpriv.bFwCurrentInPSMode;
+		rtw_hal_get_hwreg(Adapter, HW_VAR_FWLPS_RF_ON, (u8 *)(&bFwPSAwake));
+	}
+#endif
+
+#ifdef CONFIG_P2P_PS
+	// Fw is under p2p powersaving mode, driver should stop dynamic mechanism.
+	// modifed by thomas. 2011.06.11.
+	if(Adapter->wdinfo.p2p_ps_mode)
+		bFwPSAwake = _FALSE;
+#endif // CONFIG_P2P_PS
+
+	// Stop dynamic mechanism when:
+	// 1. RF is OFF. (No need to do DM.)
+	// 2. Fw is under power saving mode for FwLPS. (Prevent from SW/FW I/O racing.)
+	// 3. IPS workitem is scheduled. (Prevent from IPS sequence to be swapped with DM.
+	//     Sometimes DM execution time is longer than 100ms such that the assertion
+	//     in MgntActSet_RF_State() called by InactivePsWorkItem will be triggered by
+	//     wating to long for RFChangeInProgress.)
+	// 4. RFChangeInProgress is TRUE. (Prevent from broken by IPS/HW/SW Rf off.)
+	// Noted by tynli. 2010.06.01.
+	//if(rfState == eRfOn)
+	if( (hw_init_completed == _TRUE)
+		&& ((!bFwCurrentInPSMode) && bFwPSAwake))
+	{
+		//
+		// Calculate Tx/Rx statistics.
+		//
+		dm_CheckStatistics(Adapter);
+
+		//
+		// For PWDB monitor and record some value for later use.
+		//
+		PWDB_Monitor(Adapter);
+
+		dm_RSSIMonitorCheck(Adapter);
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if(Adapter->adapter_type > PRIMARY_ADAPTER)
+			goto _record_initrate;
+
+		FindMinimumRSSI(Adapter);
+#endif
+
+		//
+		// Dynamic Initial Gain mechanism.
+		//
+		dm_FalseAlarmCounterStatistics(Adapter);
+		dm_DIG(Adapter);
+		dm_adaptivity(Adapter);
+
+		//
+		//Dynamic BB Power Saving Mechanism
+		//
+		dm_DynamicBBPowerSaving(Adapter);
+
+		//
+		// Dynamic Tx Power mechanism.
+		//
+		dm_DynamicTxPower(Adapter);
+
+		//
+		// Tx Power Tracking.
+		//
+#if MP_DRIVER == 0
+#ifdef CONFIG_BUSY_TRAFFIC_SKIP_PWR_TRACK
+		if(pmlmepriv->LinkDetectInfo.bBusyTraffic == _FALSE)
+#endif //CONFIG_BUSY_TRAFFIC_SKIP_PWR_TRACK
+#endif
+			rtl8192c_dm_CheckTXPowerTracking(Adapter);
+
+		//
+		// Rate Adaptive by Rx Signal Strength mechanism.
+		//
+		dm_RefreshRateAdaptiveMask(Adapter);
+
+#ifdef CONFIG_BT_COEXIST
+		//BT-Coexist
+		dm_BTCoexist(Adapter);
+#endif
+
+		// EDCA turbo
+		//update the EDCA paramter according to the Tx/RX mode
+		//update_EDCA_param(Adapter);
+		dm_CheckEdcaTurbo(Adapter);
+
+		//
+		// Dynamically switch RTS/CTS protection.
+		//
+		//dm_CheckProtection(Adapter);
+
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+		//
+		// Software Antenna diversity
+		//
+		dm_SW_AntennaSwitch(Adapter, SWAW_STEP_PEAK);
+#endif
+
+#ifdef CONFIG_HW_ANTENNA_DIVERSITY
+		//Hybrid Antenna Diversity
+		dm_SelectRXDefault(Adapter);
+#endif
+
+#ifdef CONFIG_PCI_HCI
+		// 20100630 Joseph: Disable Interrupt Migration mechanism temporarily because it degrades Rx throughput.
+		// Tx Migration settings.
+		//dm_InterruptMigration(Adapter);
+
+		//if(Adapter->HalFunc.TxCheckStuckHandler(Adapter))
+		//	PlatformScheduleWorkItem(&(GET_HAL_DATA(Adapter)->HalResetWorkItem));
+#endif
+
+
+_record_initrate:
+
+		// Read REG_INIDATA_RATE_SEL value for TXDESC.
+		if(check_fwstate(&Adapter->mlmepriv, WIFI_STATION_STATE) == _TRUE)
+		{
+			pdmpriv->INIDATA_RATE[0] = rtw_read8(Adapter, REG_INIDATA_RATE_SEL) & 0x3f;
+
+#ifdef CONFIG_TDLS
+			if(Adapter->tdlsinfo.setup_state == TDLS_LINKED_STATE)
+			{
+				u8 i=1;
+				for(; i < (Adapter->tdlsinfo.macid_index) ; i++)
+				{
+					pdmpriv->INIDATA_RATE[i] = rtw_read8(Adapter, (REG_INIDATA_RATE_SEL+i)) & 0x3f;
+				}
+			}
+#endif //CONFIG_TDLS
+
+		}
+		else
+		{
+			u8	i;
+			for(i=1 ; i < (Adapter->stapriv.asoc_sta_count + 1); i++)
+			{
+				pdmpriv->INIDATA_RATE[i] = rtw_read8(Adapter, (REG_INIDATA_RATE_SEL+i)) & 0x3f;
+			}
+		}
+	}
+
+skip_dm:
+
+	// Check GPIO to determine current RF on/off and Pbc status.
+	// Check Hardware Radio ON/OFF or not
+	//if(Adapter->MgntInfo.PowerSaveControl.bGpioRfSw)
+	//{
+		//RTPRINT(FPWR, PWRHW, ("dm_CheckRfCtrlGPIO \n"));
+	//	dm_CheckRfCtrlGPIO(Adapter);
+	//}
+
+#ifdef CONFIG_PCI_HCI
+	if(pHalData->bGpioHwWpsPbc)
+#endif
+	{
+		dm_CheckPbcGPIO(Adapter);				// Add by hpfan 2008-03-11
+	}
+
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_hal_init.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_hal_init.c
new file mode 100644
index 000000000000..bf5518f6e294
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_hal_init.c
@@ -0,0 +1,3627 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#define _RTL8192C_HAL_INIT_C_
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_byteorder.h>
+#include <rtw_efuse.h>
+
+#include <rtl8192c_hal.h>
+
+#ifdef CONFIG_USB_HCI
+#include <usb_hal.h>
+#endif
+
+#ifdef CONFIG_PCI_HCI
+#include <pci_hal.h>
+#endif
+
+static BOOLEAN
+hal_EfusePgPacketWrite2ByteHeader(
+	IN	PADAPTER		pAdapter,
+	IN	u8				efuseType,
+	IN	u16				*pAddr,
+	IN	PPGPKT_STRUCT	pTargetPkt,
+	IN	BOOLEAN			bPseudoTest);
+static BOOLEAN
+hal_EfusePgPacketWrite1ByteHeader(
+	IN	PADAPTER		pAdapter,
+	IN	u8				efuseType,
+	IN	u16				*pAddr,
+	IN	PPGPKT_STRUCT	pTargetPkt,
+	IN	BOOLEAN			bPseudoTest);
+static BOOLEAN
+hal_EfusePgPacketWriteData(
+	IN	PADAPTER		pAdapter,
+	IN	u8				efuseType,
+	IN	u16				*pAddr,
+	IN	PPGPKT_STRUCT	pTargetPkt,
+	IN	BOOLEAN			bPseudoTest);
+static BOOLEAN
+hal_EfusePgPacketWrite_BT(
+	IN	PADAPTER		pAdapter,
+	IN	u8				offset,
+	IN	u8				word_en,
+	IN	u8				*pData,
+	IN	BOOLEAN			bPseudoTest);
+
+static VOID
+_FWDownloadEnable(
+	IN	PADAPTER		Adapter,
+	IN	BOOLEAN			enable
+	)
+{
+	u8	tmp;
+
+	if(enable)
+	{
+		#ifdef DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE
+		{
+			u8 val;
+			if( (val=rtw_read8(Adapter, REG_MCUFWDL)))
+				DBG_871X("DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE %s:%d REG_MCUFWDL:0x%02x\n", __FUNCTION__, __LINE__, val);
+		}
+		#endif
+
+		// 8051 enable
+		tmp = rtw_read8(Adapter, REG_SYS_FUNC_EN+1);
+		rtw_write8(Adapter, REG_SYS_FUNC_EN+1, tmp|0x04);
+
+		// MCU firmware download enable.
+		tmp = rtw_read8(Adapter, REG_MCUFWDL);
+		rtw_write8(Adapter, REG_MCUFWDL, tmp|0x01);
+
+		// 8051 reset
+		tmp = rtw_read8(Adapter, REG_MCUFWDL+2);
+		rtw_write8(Adapter, REG_MCUFWDL+2, tmp&0xf7);
+	}
+	else
+	{
+		// MCU firmware download enable.
+		tmp = rtw_read8(Adapter, REG_MCUFWDL);
+		rtw_write8(Adapter, REG_MCUFWDL, tmp&0xfe);
+
+		// Reserved for fw extension.
+		rtw_write8(Adapter, REG_MCUFWDL+1, 0x00);
+	}
+}
+
+
+#define MAX_REG_BOLCK_SIZE	196
+#define MIN_REG_BOLCK_SIZE	8
+
+static int
+_BlockWrite(
+	IN		PADAPTER		Adapter,
+	IN		PVOID		buffer,
+	IN		u32			size
+	)
+{
+	int ret = _SUCCESS;
+
+#ifdef CONFIG_PCI_HCI
+	u32			blockSize	= sizeof(u32);	// Use 4-byte write to download FW
+	u8			*bufferPtr	= (u8 *)buffer;
+	u32			*pu4BytePtr	= (u32 *)buffer;
+	u32			i, offset, blockCount, remainSize;
+	u8			remainFW[4] = {0, 0, 0, 0};
+	u8			*p = NULL;
+
+	blockCount = size / blockSize;
+	remainSize = size % blockSize;
+
+	for(i = 0 ; i < blockCount ; i++){
+		offset = i * blockSize;
+		rtw_write32(Adapter, (FW_8192C_START_ADDRESS + offset), cpu_to_le32(*(pu4BytePtr + i)));
+	}
+
+	p = (u8*)((u32*)(bufferPtr + blockCount * blockSize));
+	if(remainSize){
+		switch (remainSize) {
+		case 0:
+			break;
+		case 3:
+			remainFW[2]=*(p+2);
+		case 2:
+			remainFW[1]=*(p+1);
+		case 1:
+			remainFW[0]=*(p);
+			ret = rtw_write32(Adapter, (FW_8192C_START_ADDRESS + blockCount * blockSize),
+				 le32_to_cpu(*(u32*)remainFW));
+		}
+		return ret;
+	}
+#else
+
+#ifdef SUPPORTED_BLOCK_IO
+	u32			blockSize	= MAX_REG_BOLCK_SIZE;	// Use 196-byte write to download FW
+	u32			blockSize2  	= MIN_REG_BOLCK_SIZE;
+#else
+	u32			blockSize	= sizeof(u32);	// Use 4-byte write to download FW
+	u32*		pu4BytePtr	= (u32*)buffer;
+	u32			blockSize2  	= sizeof(u8);
+#endif
+	u8*			bufferPtr	= (u8*)buffer;
+	u32			i, offset = 0, offset2, blockCount, remainSize, remainSize2;
+
+	blockCount = size / blockSize;
+	remainSize = size % blockSize;
+
+	for(i = 0 ; i < blockCount ; i++){
+		offset = i * blockSize;
+		#ifdef SUPPORTED_BLOCK_IO
+		ret = rtw_writeN(Adapter, (FW_8192C_START_ADDRESS + offset), blockSize, (bufferPtr + offset));
+		#else
+		ret = rtw_write32(Adapter, (FW_8192C_START_ADDRESS + offset), le32_to_cpu(*(pu4BytePtr + i)));
+		#endif
+
+		if(ret == _FAIL)
+			goto exit;
+	}
+
+	if(remainSize){
+		#if defined(SUPPORTED_BLOCK_IO) && defined(DBG_BLOCK_WRITE_ISSUE) //Can this be enabled?
+		offset = blockCount * blockSize;
+		ret = rtw_writeN(Adapter, (FW_8192C_START_ADDRESS + offset), remainSize, (bufferPtr + offset));
+		goto exit;
+		#endif
+		offset2 = blockCount * blockSize;
+		blockCount = remainSize / blockSize2;
+		remainSize2 = remainSize % blockSize2;
+
+		for(i = 0 ; i < blockCount ; i++){
+			offset = offset2 + i * blockSize2;
+			#ifdef SUPPORTED_BLOCK_IO
+			ret = rtw_writeN(Adapter, (FW_8192C_START_ADDRESS + offset), blockSize2, (bufferPtr + offset));
+			#else
+			ret = rtw_write8(Adapter, (FW_8192C_START_ADDRESS + offset ), *(bufferPtr + offset));
+			#endif
+
+			if(ret == _FAIL)
+				goto exit;
+		}
+
+		if(remainSize2)
+		{
+			offset += blockSize2;
+			bufferPtr += offset;
+
+			for(i = 0 ; i < remainSize2 ; i++){
+				ret = rtw_write8(Adapter, (FW_8192C_START_ADDRESS + offset + i), *(bufferPtr + i));
+
+				if(ret == _FAIL)
+					goto exit;
+			}
+		}
+	}
+#endif
+
+exit:
+	return ret;
+}
+
+static int
+_PageWrite(
+	IN		PADAPTER	Adapter,
+	IN		u32			page,
+	IN		PVOID		buffer,
+	IN		u32			size
+	)
+{
+	u8 value8;
+	u8 u8Page = (u8) (page & 0x07) ;
+
+	value8 = (rtw_read8(Adapter, REG_MCUFWDL+2)& 0xF8 ) | u8Page ;
+	rtw_write8(Adapter, REG_MCUFWDL+2,value8);
+	return _BlockWrite(Adapter,buffer,size);
+}
+
+static VOID
+_FillDummy(
+	u8*		pFwBuf,
+	u32*	pFwLen
+	)
+{
+	u32	FwLen = *pFwLen;
+	u8	remain = (u8)(FwLen%4);
+	remain = (remain==0)?0:(4-remain);
+
+	while(remain>0)
+	{
+		pFwBuf[FwLen] = 0;
+		FwLen++;
+		remain--;
+	}
+
+	*pFwLen = FwLen;
+}
+
+static int
+_WriteFW(
+	IN		PADAPTER		Adapter,
+	IN		PVOID			buffer,
+	IN		u32			size
+	)
+{
+	// Since we need dynamic decide method of dwonload fw, so we call this function to get chip version.
+	// We can remove _ReadChipVersion from ReadAdapterInfo8192C later.
+
+	int ret = _SUCCESS;
+	u32 	pageNums,remainSize ;
+	u32 	page,offset;
+	u8*	bufferPtr = (u8*)buffer;
+
+#ifdef CONFIG_PCI_HCI
+	// 20100120 Joseph: Add for 88CE normal chip.
+	// Fill in zero to make firmware image to dword alignment.
+//		_FillDummy(bufferPtr, &size);
+#endif
+
+	pageNums = size / MAX_PAGE_SIZE ;
+	//RT_ASSERT((pageNums <= 4), ("Page numbers should not greater then 4 \n"));
+	remainSize = size % MAX_PAGE_SIZE;
+
+	for(page = 0; page < pageNums;  page++){
+		offset = page *MAX_PAGE_SIZE;
+		ret = _PageWrite(Adapter,page, (bufferPtr+offset),MAX_PAGE_SIZE);
+
+		if(ret == _FAIL)
+			goto exit;
+	}
+	if(remainSize){
+		offset = pageNums *MAX_PAGE_SIZE;
+		page = pageNums;
+		ret = _PageWrite(Adapter,page, (bufferPtr+offset),remainSize);
+
+		if(ret == _FAIL)
+			goto exit;
+	}
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("_WriteFW Done- for Normal chip.\n"));
+
+exit:
+	return ret;
+}
+
+static int _FWFreeToGo(
+	IN		PADAPTER		Adapter
+	)
+{
+	u32			counter = 0;
+	u32			value32;
+	u32	restarted = _FALSE;
+
+	// polling CheckSum report
+	do{
+		value32 = rtw_read32(Adapter, REG_MCUFWDL);
+	}while((counter ++ < POLLING_READY_TIMEOUT_COUNT) && (!(value32 & FWDL_ChkSum_rpt)));
+
+	if(counter >= POLLING_READY_TIMEOUT_COUNT){
+		DBG_8192C("chksum report faill ! REG_MCUFWDL:0x%08x\n",value32);
+		return _FAIL;
+	} else {
+		//DBG_8192C("chksum report success ! REG_MCUFWDL:0x%08x, counter:%u\n",value32, counter);
+	}
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Checksum report OK ! REG_MCUFWDL:0x%08x .\n",value32));
+
+
+	value32 = rtw_read32(Adapter, REG_MCUFWDL);
+	value32 |= MCUFWDL_RDY;
+	value32 &= ~WINTINI_RDY;
+	rtw_write32(Adapter, REG_MCUFWDL, value32);
+
+
+POLLING_FW_READY:
+	// polling for FW ready
+	counter = 0;
+	do
+	{
+		if(rtw_read32(Adapter, REG_MCUFWDL) & WINTINI_RDY){
+			//RT_TRACE(COMP_INIT, DBG_SERIOUS, ("Polling FW ready success!! REG_MCUFWDL:0x%08x .\n",PlatformIORead4Byte(Adapter, REG_MCUFWDL)) );
+			return _SUCCESS;
+		}
+		rtw_udelay_os(5);
+	}while(counter++ < POLLING_READY_TIMEOUT_COUNT);
+
+	DBG_8192C("Polling FW ready fail!! REG_MCUFWDL:0x%08x .\n", rtw_read32(Adapter, REG_MCUFWDL));
+
+	if(restarted == _FALSE) {
+		u8 tmp = rtw_read8(Adapter, REG_SYS_FUNC_EN+1);
+		DBG_8192C("Reset 51 write8 REG_SYS_FUNC_EN:0x%04x\n", tmp & ~BIT2);
+		rtw_write8(Adapter, REG_SYS_FUNC_EN+1, tmp & ~BIT2);
+		DBG_8192C("Reset 51 write8 REG_SYS_FUNC_EN:0x%04x\n", tmp|BIT2);
+		rtw_write8(Adapter, REG_SYS_FUNC_EN+1, tmp|BIT2);
+		restarted = _TRUE;
+		goto POLLING_FW_READY;
+	}
+
+
+	return _FAIL;
+
+}
+
+
+VOID
+rtl8192c_FirmwareSelfReset(
+	IN		PADAPTER		Adapter
+)
+{
+	u8	u1bTmp;
+	u8	Delay = 100;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	if((pHalData->FirmwareVersion > 0x21) ||
+		(pHalData->FirmwareVersion == 0x21 &&
+		pHalData->FirmwareSubVersion >= 0x01)) // after 88C Fw v33.1
+	{
+		//0x1cf=0x20. Inform 8051 to reset. 2009.12.25. tynli_test
+		rtw_write8(Adapter, REG_HMETFR+3, 0x20);
+
+		u1bTmp = rtw_read8(Adapter, REG_SYS_FUNC_EN+1);
+		while(u1bTmp&BIT2)
+		{
+			Delay--;
+			if(Delay == 0)
+				break;
+			rtw_udelay_os(50);
+			u1bTmp = rtw_read8(Adapter, REG_SYS_FUNC_EN+1);
+		}
+
+		if((u1bTmp&BIT2) && (Delay == 0))
+		{
+			DBG_8192C("FirmwareDownload92C():fw reset by itself Fail!!!!!! 0x03 = %x\n", u1bTmp);
+			//RT_ASSERT(FALSE, ("PowerOffAdapter8192CE(): 0x03 = %x\n", u1bTmp));
+			#ifdef DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE
+			{
+				u8 val;
+				if( (val=rtw_read8(Adapter, REG_MCUFWDL)))
+					DBG_871X("DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE %s:%d REG_MCUFWDL:0x%02x\n", __FUNCTION__, __LINE__, val);
+			}
+			#endif
+			rtw_write8(Adapter,REG_SYS_FUNC_EN+1,(rtw_read8(Adapter, REG_SYS_FUNC_EN+1)&~BIT2));
+		}
+
+		DBG_8192C("%s =====> 8051 reset success (%d) .\n", __FUNCTION__ ,Delay);
+	}
+}
+
+#ifdef CONFIG_FILE_FWIMG
+extern char *rtw_fw_file_path;
+u8	FwBuffer8192C[FW_8192C_SIZE];
+#endif //CONFIG_FILE_FWIMG
+//
+//	Description:
+//		Download 8192C firmware code.
+//
+//
+int FirmwareDownload92C(
+	IN	PADAPTER			Adapter,
+	IN	BOOLEAN			bUsedWoWLANFw
+)
+{
+	int	rtStatus = _SUCCESS;
+	u8 writeFW_retry = 0;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	s8 			R92CFwImageFileName_TSMC[] ={RTL8192C_FW_TSMC_IMG};
+	s8 			R92CFwImageFileName_UMC[] ={RTL8192C_FW_UMC_IMG};
+	s8 			R92CFwImageFileName_UMC_B[] ={RTL8192C_FW_UMC_B_IMG};
+#ifdef CONFIG_WOWLAN
+	s8 			R92CFwImageFileName_TSMC_WW[] ={RTL8192C_FW_TSMC_WW_IMG};
+	s8 			R92CFwImageFileName_UMC_WW[] ={RTL8192C_FW_UMC_WW_IMG};
+	s8 			R92CFwImageFileName_UMC_B_WW[] ={RTL8192C_FW_UMC_B_WW_IMG};
+#endif //CONFIG_WOWLAN
+
+	//s8 			R8723FwImageFileName_UMC[] ={RTL8723_FW_UMC_IMG};
+	u8*			FwImage = NULL;
+	u32			FwImageLen = 0;
+	char*		pFwImageFileName;
+#ifdef CONFIG_WOWLAN
+	u8*			FwImageWoWLAN;
+	u32			FwImageWoWLANLen;
+	char*		pFwImageFileName_WoWLAN;
+#endif	//CONFIG_WOWLAN
+	u8*			pucMappedFile = NULL;
+	//vivi, merge 92c and 92s into one driver, 20090817
+	//vivi modify this temply, consider it later!!!!!!!!
+	//PRT_FIRMWARE	pFirmware = GET_FIRMWARE_819X(Adapter);
+	//PRT_FIRMWARE_92C	pFirmware = GET_FIRMWARE_8192C(Adapter);
+	PRT_FIRMWARE_92C	pFirmware = NULL;
+	PRT_8192C_FIRMWARE_HDR		pFwHdr = NULL;
+	u8		*pFirmwareBuf;
+	u32		FirmwareLen;
+
+	pFirmware = (PRT_FIRMWARE_92C)rtw_zvmalloc(sizeof(RT_FIRMWARE_92C));
+
+	if(!pFirmware)
+	{
+		rtStatus = _FAIL;
+		goto Exit;
+	}
+
+	if(IS_VENDOR_UMC_A_CUT(pHalData->VersionID) && !IS_92C_SERIAL(pHalData->VersionID))
+	{
+		pFwImageFileName = R92CFwImageFileName_UMC;
+		FwImage = Rtl819XFwUMCACutImageArray;
+		FwImageLen = UMCACutImgArrayLength;
+#ifdef CONFIG_WOWLAN
+		pFwImageFileName_WoWLAN = R92CFwImageFileName_UMC_WW;
+		FwImageWoWLAN= Rtl8192C_FwUMCWWImageArray;
+		FwImageWoWLANLen =UMCACutWWImgArrayLength ;
+#endif	//CONFIG_WOWLAN
+		DBG_8192C(" ===> FirmwareDownload91C() fw:Rtl819XFwImageArray_UMC\n");
+	}
+	else if(IS_81xxC_VENDOR_UMC_B_CUT(pHalData->VersionID))
+	{
+		// The ROM code of UMC B-cut Fw is the same as TSMC. by tynli. 2011.01.14.
+		pFwImageFileName = R92CFwImageFileName_UMC_B;
+		FwImage = Rtl819XFwUMCBCutImageArray;
+		FwImageLen = UMCBCutImgArrayLength;
+#ifdef CONFIG_WOWLAN
+		pFwImageFileName_WoWLAN = R92CFwImageFileName_UMC_B_WW;
+		FwImageWoWLAN= Rtl8192C_FwUMCBCutWWImageArray;
+		FwImageWoWLANLen =UMCBCutWWImgArrayLength ;
+#endif //CONFIG_WOWLAN
+
+		DBG_8192C(" ===> FirmwareDownload91C() fw:Rtl819XFwImageArray_UMC_B\n");
+	}
+	else
+	{
+		pFwImageFileName = R92CFwImageFileName_TSMC;
+		FwImage = Rtl819XFwTSMCImageArray;
+		FwImageLen = TSMCImgArrayLength;
+#ifdef CONFIG_WOWLAN
+		pFwImageFileName_WoWLAN = R92CFwImageFileName_TSMC_WW;
+		FwImageWoWLAN= Rtl8192C_FwTSMCWWImageArray;
+		FwImageWoWLANLen =TSMCWWImgArrayLength ;
+#endif //CONFIG_WOWLAN
+		DBG_8192C(" ===> FirmwareDownload91C() fw:Rtl819XFwImageArray_TSMC\n");
+	}
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, (" ===> FirmwareDownload91C() fw:%s\n", pFwImageFileName));
+
+	#ifdef CONFIG_FILE_FWIMG
+	if(rtw_is_file_readable(rtw_fw_file_path) == _TRUE)
+	{
+		DBG_871X("%s accquire FW from file:%s\n", __FUNCTION__, rtw_fw_file_path);
+		pFirmware->eFWSource = FW_SOURCE_IMG_FILE; // We should decided by Reg.
+	}
+	else
+	#endif //CONFIG_FILE_FWIMG
+	{
+		DBG_871X("%s accquire FW from embedded image\n", __FUNCTION__);
+		pFirmware->eFWSource = FW_SOURCE_HEADER_FILE;
+	}
+
+
+	switch(pFirmware->eFWSource)
+	{
+		case FW_SOURCE_IMG_FILE:
+
+			#ifdef CONFIG_FILE_FWIMG
+			rtStatus = rtw_retrive_from_file(rtw_fw_file_path, FwBuffer8192C, FW_8192C_SIZE);
+			pFirmware->ulFwLength = rtStatus>=0?rtStatus:0;
+			pFirmware->szFwBuffer = FwBuffer8192C;
+			#endif //CONFIG_FILE_FWIMG
+
+			if(pFirmware->ulFwLength <= 0)
+			{
+				rtStatus = _FAIL;
+				goto Exit;
+			}
+			break;
+		case FW_SOURCE_HEADER_FILE:
+			if(FwImageLen > FW_8192C_SIZE){
+				rtStatus = _FAIL;
+				//RT_TRACE(COMP_INIT, DBG_SERIOUS, ("Firmware size exceed 0x%X. Check it.\n", FW_8192C_SIZE) );
+				DBG_871X("Firmware size exceed 0x%X. Check it.\n", FW_8192C_SIZE);
+				goto Exit;
+			}
+
+			pFirmware->szFwBuffer = FwImage;
+			pFirmware->ulFwLength = FwImageLen;
+#ifdef CONFIG_WOWLAN
+			{
+				pFirmware->szWoWLANFwBuffer=FwImageWoWLAN;
+				pFirmware->ulWoWLANFwLength = FwImageWoWLANLen;
+			}
+#endif //CONFIG_WOWLAN
+
+			break;
+	}
+
+#ifdef CONFIG_WOWLAN
+	if(bUsedWoWLANFw)	{
+		pFirmwareBuf = pFirmware->szWoWLANFwBuffer;
+		FirmwareLen = pFirmware->ulWoWLANFwLength;
+		pFwHdr = (PRT_8192C_FIRMWARE_HDR)pFirmware->szWoWLANFwBuffer;
+	}
+	else
+#endif	//CONFIG_WOWLAN
+	{
+	#ifdef DBG_FW_STORE_FILE_PATH //used to store firmware to file...
+	if(pFirmware->ulFwLength > 0)
+	{
+		rtw_store_to_file(DBG_FW_STORE_FILE_PATH, pFirmware->szFwBuffer, pFirmware->ulFwLength);
+	}
+	#endif
+
+	pFirmwareBuf = pFirmware->szFwBuffer;
+	FirmwareLen = pFirmware->ulFwLength;
+
+	// To Check Fw header. Added by tynli. 2009.12.04.
+	pFwHdr = (PRT_8192C_FIRMWARE_HDR)pFirmware->szFwBuffer;
+	}
+	pHalData->FirmwareVersion =  le16_to_cpu(pFwHdr->Version);
+	pHalData->FirmwareSubVersion = le16_to_cpu(pFwHdr->Subversion);
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, (" FirmwareVersion(%#x), Signature(%#x)\n",
+	//	Adapter->MgntInfo.FirmwareVersion, pFwHdr->Signature));
+
+	DBG_8192C("fw_ver=v%d, fw_subver=%d, sig=0x%x\n",
+		pHalData->FirmwareVersion, pHalData->FirmwareSubVersion, le16_to_cpu(pFwHdr->Signature)&0xFFF0);
+
+	if(IS_FW_HEADER_EXIST(pFwHdr))
+	{
+		//RT_TRACE(COMP_INIT, DBG_LOUD,("Shift 32 bytes for FW header!!\n"));
+		pFirmwareBuf = pFirmwareBuf + 32;
+		FirmwareLen = FirmwareLen -32;
+	}
+
+	// Suggested by Filen. If 8051 is running in RAM code, driver should inform Fw to reset by itself,
+	// or it will cause download Fw fail. 2010.02.01. by tynli.
+	if(rtw_read8(Adapter, REG_MCUFWDL)&BIT7) //8051 RAM code
+	{
+		rtl8192c_FirmwareSelfReset(Adapter);
+		rtw_write8(Adapter, REG_MCUFWDL, 0x00);
+	}
+
+
+	_FWDownloadEnable(Adapter, _TRUE);
+	while(1) {
+		u8 tmp8;
+		tmp8 = rtw_read8(Adapter, REG_MCUFWDL);
+
+		//reset the FWDL chksum
+		rtw_write8(Adapter, REG_MCUFWDL, tmp8|FWDL_ChkSum_rpt);
+
+		//tmp8 = rtw_read8(Adapter, REG_MCUFWDL);
+		//DBG_8192C("Before _WriteFW, REG_MCUFWDL:0x%02x, writeFW_retry:%u\n", tmp8, writeFW_retry);
+
+		rtStatus = _WriteFW(Adapter, pFirmwareBuf, FirmwareLen);
+
+		//tmp8 = rtw_read8(Adapter, REG_MCUFWDL);
+		//DBG_8192C("After _WriteFW, REG_MCUFWDL:0x%02x, rtStatus:%d\n", tmp8, rtStatus);
+
+		if(rtStatus == _SUCCESS || ++writeFW_retry>3)
+			break;
+	}
+	_FWDownloadEnable(Adapter, _FALSE);
+
+	if(_SUCCESS != rtStatus){
+		DBG_8192C("DL Firmware failed!\n");
+		goto Exit;
+	}
+
+	rtStatus = _FWFreeToGo(Adapter);
+	if(_SUCCESS != rtStatus){
+		DBG_8192C("DL Firmware failed!\n");
+		goto Exit;
+	}
+	//RT_TRACE(COMP_INIT, DBG_LOUD, (" Firmware is ready to run!\n"));
+
+Exit:
+
+	if(pFirmware) {
+		rtw_vmfree((u8*)pFirmware, sizeof(RT_FIRMWARE_92C));
+	}
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, (" <=== FirmwareDownload91C()\n"));
+	return rtStatus;
+
+}
+
+VOID
+InitializeFirmwareVars92C(
+	IN	PADAPTER		Adapter
+)
+{
+	HAL_DATA_TYPE		*pHalData	= GET_HAL_DATA(Adapter);
+
+	// Init Fw LPS related.
+	Adapter->pwrctrlpriv.bFwCurrentInPSMode = _FALSE;
+
+	//Init H2C counter. by tynli. 2009.12.09.
+	pHalData->LastHMEBoxNum = 0;
+}
+
+#ifdef CONFIG_WOWLAN
+//===========================================
+
+//
+// Description: Prepare some information to Fw for WoWLAN.
+//			(1) Download wowlan Fw.
+//			(2) Download RSVD page packets.
+//			(3) Enable AP offload if needed.
+//
+// 2011.04.12 by tynli.
+//
+VOID
+SetFwRelatedForWoWLAN8192CU(
+	IN	PADAPTER			padapter,
+	IN	u8			bHostIsGoingtoSleep
+)
+{
+	int	status=_FAIL;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	u8	 bRecover = _FALSE;
+
+	if(bHostIsGoingtoSleep)
+	{
+		//
+		// 1. Before WoWLAN we need to re-download WoWLAN Fw.
+		//
+		status = FirmwareDownload92C(padapter, bHostIsGoingtoSleep);
+		if(status != _SUCCESS)
+		{
+			DBG_8192C("ConfigFwRelatedForWoWLAN8192CU(): Re-Download Firmware failed!!\n");
+			return;
+		}
+		else
+		{
+			DBG_8192C("ConfigFwRelatedForWoWLAN8192CU(): Re-Download Firmware Success !!\n");
+		}
+
+		//
+		// 2. Re-Init the variables about Fw related setting.
+		//
+		InitializeFirmwareVars92C(padapter);
+
+
+	}
+}
+#endif // CONFIG_WOWLAN
+
+#ifdef CONFIG_BT_COEXIST
+static void _update_bt_param(_adapter *padapter)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(padapter);
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+	struct registry_priv	*registry_par = &padapter->registrypriv;
+
+	if(2 != registry_par->bt_iso)
+		pbtpriv->BT_Ant_isolation = registry_par->bt_iso;// 0:Low, 1:High, 2:From Efuse
+
+	if(registry_par->bt_sco == 1) // 0:Idle, 1:None-SCO, 2:SCO, 3:From Counter, 4.Busy, 5.OtherBusy
+		pbtpriv->BT_Service = BT_OtherAction;
+	else if(registry_par->bt_sco==2)
+		pbtpriv->BT_Service = BT_SCO;
+	else if(registry_par->bt_sco==4)
+		pbtpriv->BT_Service = BT_Busy;
+	else if(registry_par->bt_sco==5)
+		pbtpriv->BT_Service = BT_OtherBusy;
+	else
+		pbtpriv->BT_Service = BT_Idle;
+
+	pbtpriv->BT_Ampdu = registry_par->bt_ampdu;
+	pbtpriv->bCOBT = _TRUE;
+#if 1
+	DBG_8192C("BT Coexistance = %s\n", (pbtpriv->BT_Coexist==_TRUE)?"enable":"disable");
+	if(pbtpriv->BT_Coexist)
+	{
+		if(pbtpriv->BT_Ant_Num == Ant_x2)
+		{
+			DBG_8192C("BlueTooth BT_Ant_Num = Antx2\n");
+		}
+		else if(pbtpriv->BT_Ant_Num == Ant_x1)
+		{
+			DBG_8192C("BlueTooth BT_Ant_Num = Antx1\n");
+		}
+		switch(pbtpriv->BT_CoexistType)
+		{
+			case BT_2Wire:
+				DBG_8192C("BlueTooth BT_CoexistType = BT_2Wire\n");
+				break;
+			case BT_ISSC_3Wire:
+				DBG_8192C("BlueTooth BT_CoexistType = BT_ISSC_3Wire\n");
+				break;
+			case BT_Accel:
+				DBG_8192C("BlueTooth BT_CoexistType = BT_Accel\n");
+				break;
+			case BT_CSR_BC4:
+				DBG_8192C("BlueTooth BT_CoexistType = BT_CSR_BC4\n");
+				break;
+			case BT_RTL8756:
+				DBG_8192C("BlueTooth BT_CoexistType = BT_RTL8756\n");
+				break;
+			default:
+				DBG_8192C("BlueTooth BT_CoexistType = Unknown\n");
+				break;
+		}
+		DBG_8192C("BlueTooth BT_Ant_isolation = %d\n", pbtpriv->BT_Ant_isolation);
+
+
+		switch(pbtpriv->BT_Service)
+		{
+			case BT_OtherAction:
+				DBG_8192C("BlueTooth BT_Service = BT_OtherAction\n");
+				break;
+			case BT_SCO:
+				DBG_8192C("BlueTooth BT_Service = BT_SCO\n");
+				break;
+			case BT_Busy:
+				DBG_8192C("BlueTooth BT_Service = BT_Busy\n");
+				break;
+			case BT_OtherBusy:
+				DBG_8192C("BlueTooth BT_Service = BT_OtherBusy\n");
+				break;
+			default:
+				DBG_8192C("BlueTooth BT_Service = BT_Idle\n");
+				break;
+		}
+
+		DBG_8192C("BT_RadioSharedType = 0x%x\n", pbtpriv->BT_RadioSharedType);
+	}
+#endif
+
+}
+
+
+#define GET_BT_COEXIST(priv) (&priv->bt_coexist)
+
+void rtl8192c_ReadBluetoothCoexistInfo(
+	IN	PADAPTER	Adapter,
+	IN	u8*		PROMContent,
+	IN	BOOLEAN		AutoloadFail
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+	u8	rf_opt4;
+
+	if(AutoloadFail){
+		pbtpriv->BT_Coexist = _FALSE;
+		pbtpriv->BT_CoexistType= BT_2Wire;
+		pbtpriv->BT_Ant_Num = Ant_x2;
+		pbtpriv->BT_Ant_isolation= 0;
+		pbtpriv->BT_RadioSharedType = BT_Radio_Shared;
+		return;
+	}
+
+	pbtpriv->BT_Coexist = (((PROMContent[EEPROM_RF_OPT1]&BOARD_TYPE_NORMAL_MASK)>>5) == BOARD_USB_COMBO)?_TRUE:_FALSE;	// bit [7:5]
+	rf_opt4 = PROMContent[EEPROM_RF_OPT4];
+	pbtpriv->BT_CoexistType 		= ((rf_opt4&0xe)>>1);			// bit [3:1]
+	pbtpriv->BT_Ant_Num 		= (rf_opt4&0x1);				// bit [0]
+	pbtpriv->BT_Ant_isolation 	= ((rf_opt4&0x10)>>4);			// bit [4]
+	pbtpriv->BT_RadioSharedType 	= ((rf_opt4&0x20)>>5);			// bit [5]
+
+	_update_bt_param(Adapter);
+
+}
+#endif
+
+VERSION_8192C
+rtl8192c_ReadChipVersion(
+	IN	PADAPTER	Adapter
+	)
+{
+	u32			value32;
+	//VERSION_8192C	version;
+	u32			ChipVersion=0;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	value32 = rtw_read32(Adapter, REG_SYS_CFG);
+
+	if (value32 & TRP_VAUX_EN)
+	{
+#if 0
+		// Test chip.
+		if(IS_HARDWARE_TYPE_8723A(Adapter)) {
+			ChipVersion |= ((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : 0);
+			ChipVersion |= ((value32 & BT_FUNC) ? CHIP_8723: 0); // RTL8723 with BT function.
+		}
+		else	 {
+		version = (value32 & TYPE_ID) ?VERSION_TEST_CHIP_92C :VERSION_TEST_CHIP_88C;
+	}
+#else
+		// tynli_test. 2011.01.10.
+		if(IS_HARDWARE_TYPE_8192C(Adapter))
+		{
+			ChipVersion = (value32 & TYPE_ID) ? VERSION_TEST_CHIP_92C : VERSION_TEST_CHIP_88C;
+		}
+		else
+		{
+			ChipVersion |= ((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : 0);
+			ChipVersion |= ((value32 & BT_FUNC) ? CHIP_8723: 0); // RTL8723 with BT function.
+		}
+#endif
+	}
+	else
+	{
+#if 0
+		// Normal mass production chip.
+		ChipVersion = NORMAL_CHIP;
+#if !RTL8723_FPGA_TRUE_PHY_VERIFICATION
+		ChipVersion |= ((value32 & TYPE_ID) ? CHIP_92C : 0);
+#endif
+		ChipVersion |= ((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : 0);
+		ChipVersion |= ((value32 & BT_FUNC) ? CHIP_8723: 0); // RTL8723 with BT function.
+		if(IS_8723_SERIES(ChipVersion))
+		{
+			if(IS_VENDOR_UMC(ChipVersion))
+				ChipVersion |= ((value32 & CHIP_VER_RTL_MASK) ? CHIP_VENDOR_UMC_B_CUT : 0);
+		}
+		else
+		{
+			// Mark out by tynli. UMC B-cut IC will not set the SYS_CFG[19] to UMC
+			// because we do not want the custmor to know. 2011.01.11.
+			//if(IS_VENDOR_UMC(ChipVersion))
+			{
+				// To check the value of B-cut. by tynli. 2011.01.11.
+				u1bTmp = (u1Byte)((value32 & CHIP_VER_RTL_MASK)>>12);
+				if(u1bTmp == 1)
+				{	// B-cut
+					ChipVersion |= CHIP_VENDOR_UMC_B_CUT;
+				}
+			}
+		}
+#else
+		// Normal mass production chip.
+		ChipVersion = NORMAL_CHIP;
+//#if !RTL8723_FPGA_TRUE_PHY_VERIFICATION
+		ChipVersion |= ((value32 & TYPE_ID) ? RF_TYPE_2T2R : 0); //92c
+//#endif
+		ChipVersion |= ((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : 0);
+		ChipVersion |= ((value32 & BT_FUNC) ? CHIP_8723: 0); // RTL8723 with BT function.
+		if(IS_HARDWARE_TYPE_8192C(Adapter))
+		{
+			// 88/92C UMC B-cut IC will not set the SYS_CFG[19] to UMC
+			// because we do not want the custmor to know. by tynli. 2011.01.17.
+			//MSG_8192C("mask result = 0x%x is_UMC %d chipversion 0x%x\n", (value32 & CHIP_VER_RTL_MASK), IS_CHIP_VENDOR_UMC(ChipVersion), ChipVersion);
+			if((!IS_CHIP_VENDOR_UMC(ChipVersion) )&& (value32 & CHIP_VER_RTL_MASK))
+			{
+				//MSG_8192C("chip mask result = 0x%x\n", ((value32 & CHIP_VER_RTL_MASK) | CHIP_VENDOR_UMC));
+				ChipVersion |= ((value32 & CHIP_VER_RTL_MASK) | CHIP_VENDOR_UMC); // IC version (CUT)
+				//MSG_8192C("chip version = 0x%x\n", ChipVersion);
+			}
+		}
+		else
+		{
+			if(IS_CHIP_VENDOR_UMC(ChipVersion))
+				ChipVersion |= ((value32 & CHIP_VER_RTL_MASK)); // IC version (CUT)
+		}
+
+		if(IS_92C_SERIAL(ChipVersion))
+		{
+			value32 = rtw_read32(Adapter, REG_HPON_FSM);
+			ChipVersion |= ((CHIP_BONDING_IDENTIFIER(value32) == CHIP_BONDING_92C_1T2R) ? RF_TYPE_1T2R : 0);
+		}
+		else if(IS_8723_SERIES(ChipVersion))
+		{
+			//RT_ASSERT(IS_HARDWARE_TYPE_8723A(Adapter), ("Incorrect chip version!!\n"));
+			value32 = rtw_read32(Adapter, REG_GPIO_OUTSTS);
+			ChipVersion |= ((value32 & RF_RL_ID)>>20);	 //ROM code version.
+		}
+#endif
+
+	}
+
+	//version = (VERSION_8192C)ChipVersion;
+
+	// For multi-function consideration. Added by Roger, 2010.10.06.
+	if(IS_8723_SERIES(ChipVersion))
+	{
+		pHalData->MultiFunc = RT_MULTI_FUNC_NONE;
+		value32 = rtw_read32(Adapter, REG_MULTI_FUNC_CTRL);
+		pHalData->MultiFunc =(RT_MULTI_FUNC) (pHalData->MultiFunc| ((value32 & WL_FUNC_EN) ?  RT_MULTI_FUNC_WIFI : 0) );
+		pHalData->MultiFunc =(RT_MULTI_FUNC) (pHalData->MultiFunc| ((value32 & BT_FUNC_EN) ?  RT_MULTI_FUNC_BT : 0) );
+		pHalData->MultiFunc =(RT_MULTI_FUNC) (pHalData->MultiFunc| ((value32 & GPS_FUNC_EN) ?  RT_MULTI_FUNC_GPS : 0) );
+		pHalData->PolarityCtl = ((value32 & WL_HWPDN_SL) ?  RT_POLARITY_HIGH_ACT : RT_POLARITY_LOW_ACT);
+		//MSG_8192C("ReadChipVersion(): MultiFunc(%x), PolarityCtl(%x) \n", pHalData->MultiFunc, pHalData->PolarityCtl);
+
+		//For regulator mode. by tynli. 2011.01.14
+		pHalData->RegulatorMode = ((value32 & TRP_BT_EN) ? RT_LDO_REGULATOR : RT_SWITCHING_REGULATOR);
+		//MSG_8192C("ReadChipVersion(): RegulatorMode(%x) \n", pHalData->RegulatorMode);
+	}
+
+//#if DBG
+#if 1
+	switch(ChipVersion)
+	{
+		case VERSION_NORMAL_TSMC_CHIP_92C_1T2R:
+			MSG_8192C("Chip Version ID: VERSION_NORMAL_TSMC_CHIP_92C_1T2R.\n");
+			break;
+		case VERSION_NORMAL_TSMC_CHIP_92C:
+			MSG_8192C("Chip Version ID: VERSION_NORMAL_TSMC_CHIP_92C.\n");
+			break;
+		case VERSION_NORMAL_TSMC_CHIP_88C:
+			MSG_8192C("Chip Version ID: VERSION_NORMAL_TSMC_CHIP_88C.\n");
+			break;
+		case VERSION_NORMAL_UMC_CHIP_92C_1T2R_A_CUT:
+			MSG_8192C("Chip Version ID: VERSION_NORMAL_UMC_CHIP_92C_1T2R_A_CUT.\n");
+			break;
+		case VERSION_NORMAL_UMC_CHIP_92C_A_CUT:
+			MSG_8192C("Chip Version ID: VERSION_NORMAL_UMC_CHIP_92C_A_CUT.\n");
+			break;
+		case VERSION_NORMAL_UMC_CHIP_88C_A_CUT:
+			MSG_8192C("Chip Version ID: VERSION_NORMAL_UMC_CHIP_88C_A_CUT.\n");
+			break;
+		case VERSION_NORMAL_UMC_CHIP_92C_1T2R_B_CUT:
+			MSG_8192C("Chip Version ID: VERSION_NORMAL_UMC_CHIP_92C_1T2R_B_CUT.\n");
+			break;
+		case VERSION_NORMAL_UMC_CHIP_92C_B_CUT:
+			MSG_8192C("Chip Version ID: VERSION_NORMAL_UMC_CHIP_92C_B_CUT.\n");
+			break;
+		case VERSION_NORMAL_UMC_CHIP_88C_B_CUT:
+			MSG_8192C("Chip Version ID: VERSION_NORMAL_UMC_CHIP_88C_B_CUT.\n");
+			break;
+		case VERSION_TEST_CHIP_92C:
+			MSG_8192C("Chip Version ID: VERSION_TEST_CHIP_92C.\n");
+			break;
+		case VERSION_TEST_CHIP_88C:
+			MSG_8192C("Chip Version ID: VERSION_TEST_CHIP_88C.\n");
+			break;
+		case VERSION_TEST_UMC_CHIP_8723:
+			MSG_8192C("Chip Version ID: VERSION_TEST_UMC_CHIP_8723.\n");
+			break;
+		case VERSION_NORMAL_UMC_CHIP_8723_1T1R_A_CUT:
+			MSG_8192C("Chip Version ID: VERSION_NORMA_UMC_CHIP_8723_1T1R_A_CUT.\n");
+			break;
+		case VERSION_NORMAL_UMC_CHIP_8723_1T1R_B_CUT:
+			MSG_8192C("Chip Version ID: VERSION_NORMA_UMC_CHIP_8723_1T1R_B_CUT.\n");
+			break;
+		default:
+			MSG_8192C("Chip Version ID: ???????????????.\n");
+			break;
+	}
+#endif
+
+	pHalData->VersionID = ChipVersion;
+
+	if(IS_1T2R(ChipVersion))
+		pHalData->rf_type = RF_1T2R;
+	else if(IS_2T2R(ChipVersion))
+		pHalData->rf_type = RF_2T2R;
+	else if(IS_8723_SERIES(ChipVersion))
+		pHalData->rf_type = RF_1T1R;
+	else
+		pHalData->rf_type = RF_1T1R;
+
+	MSG_8192C("RF_Type is %x!!\n", pHalData->rf_type);
+
+	return ChipVersion;
+}
+
+void
+rtl8192c_EfuseParseChnlPlan(
+	IN	PADAPTER		padapter,
+	IN	u8*			hwinfo,
+	IN	BOOLEAN			AutoLoadFail
+	)
+{
+	padapter->mlmepriv.ChannelPlan = hal_com_get_channel_plan(
+		padapter
+		, hwinfo?hwinfo[EEPROM_CHANNEL_PLAN]:0xFF
+		, padapter->registrypriv.channel_plan
+		, RT_CHANNEL_DOMAIN_WORLD_WIDE_13
+		, AutoLoadFail
+	);
+
+	DBG_871X("mlmepriv.ChannelPlan = 0x%02x\n", padapter->mlmepriv.ChannelPlan);
+}
+
+u8 GetEEPROMSize8192C(PADAPTER Adapter)
+{
+	u8	size = 0;
+	u32	curRCR;
+
+	curRCR = rtw_read16(Adapter, REG_9346CR);
+	size = (curRCR & BOOT_FROM_EEPROM) ? 6 : 4; // 6: EEPROM used is 93C46, 4: boot from E-Fuse.
+
+	MSG_8192C("EEPROM type is %s\n", size==4 ? "E-FUSE" : "93C46");
+
+	return size;
+}
+
+void rtl8192c_free_hal_data(_adapter * padapter)
+{
+_func_enter_;
+
+	DBG_8192C("=====> rtl8192c_free_hal_data =====\n");
+
+	if(padapter->HalData)
+		rtw_mfree(padapter->HalData, sizeof(HAL_DATA_TYPE));
+	DBG_8192C("<===== rtl8192c_free_hal_data =====\n");
+
+_func_exit_;
+}
+
+//===========================================================
+//				Efuse related code
+//===========================================================
+enum{
+		VOLTAGE_V25						= 0x03,
+		LDOE25_SHIFT						= 28 ,
+	};
+
+static VOID
+hal_EfusePowerSwitch_RTL8192C(
+	IN	PADAPTER	pAdapter,
+	IN	u8		bWrite,
+	IN	u8		PwrState)
+{
+	u8	tempval;
+	u16	tmpV16;
+
+	if (PwrState == _TRUE)
+	{
+		// 1.2V Power: From VDDON with Power Cut(0x0000h[15]), defualt valid
+		tmpV16 = rtw_read16(pAdapter,REG_SYS_ISO_CTRL);
+		if( ! (tmpV16 & PWC_EV12V ) ){
+			tmpV16 |= PWC_EV12V ;
+			rtw_write16(pAdapter,REG_SYS_ISO_CTRL,tmpV16);
+		}
+		// Reset: 0x0000h[28], default valid
+		tmpV16 =  rtw_read16(pAdapter,REG_SYS_FUNC_EN);
+		if( !(tmpV16 & FEN_ELDR) ){
+			tmpV16 |= FEN_ELDR ;
+			rtw_write16(pAdapter,REG_SYS_FUNC_EN,tmpV16);
+		}
+
+		// Clock: Gated(0x0008h[5]) 8M(0x0008h[1]) clock from ANA, default valid
+		tmpV16 = rtw_read16(pAdapter,REG_SYS_CLKR);
+		if( (!(tmpV16 & LOADER_CLK_EN) )  ||(!(tmpV16 & ANA8M) ) ){
+			tmpV16 |= (LOADER_CLK_EN |ANA8M ) ;
+			rtw_write16(pAdapter,REG_SYS_CLKR,tmpV16);
+		}
+
+		if(bWrite == _TRUE)
+		{
+			// Enable LDO 2.5V before read/write action
+			tempval = rtw_read8(pAdapter, EFUSE_TEST+3);
+			tempval &= 0x0F;
+			tempval |= (VOLTAGE_V25 << 4);
+			rtw_write8(pAdapter, EFUSE_TEST+3, (tempval | 0x80));
+		}
+	}
+	else
+	{
+		if(bWrite == _TRUE){
+			// Disable LDO 2.5V after read/write action
+			tempval = rtw_read8(pAdapter, EFUSE_TEST+3);
+			rtw_write8(pAdapter, EFUSE_TEST+3, (tempval & 0x7F));
+		}
+	}
+}
+
+static VOID
+hal_EfusePowerSwitch_RTL8723(
+	IN	PADAPTER	pAdapter,
+	IN	u8		bWrite,
+	IN	u8		PwrState)
+{
+	u8	tempval;
+	u16	tmpV16;
+
+	if (PwrState == _TRUE)
+	{
+		rtw_write8(pAdapter, REG_EFUSE_ACCESS, EFUSE_ACCESS_ON);
+
+		// 1.2V Power: From VDDON with Power Cut(0x0000h[15]), defualt valid
+		tmpV16 = rtw_read16(pAdapter,REG_SYS_ISO_CTRL);
+		if( ! (tmpV16 & PWC_EV12V ) ){
+			tmpV16 |= PWC_EV12V ;
+			 rtw_write16(pAdapter,REG_SYS_ISO_CTRL,tmpV16);
+		}
+		// Reset: 0x0000h[28], default valid
+		tmpV16 =  rtw_read16(pAdapter,REG_SYS_FUNC_EN);
+		if( !(tmpV16 & FEN_ELDR) ){
+			tmpV16 |= FEN_ELDR ;
+			rtw_write16(pAdapter,REG_SYS_FUNC_EN,tmpV16);
+		}
+
+		// Clock: Gated(0x0008h[5]) 8M(0x0008h[1]) clock from ANA, default valid
+		tmpV16 = rtw_read16(pAdapter,REG_SYS_CLKR);
+		if( (!(tmpV16 & LOADER_CLK_EN) )  ||(!(tmpV16 & ANA8M) ) ){
+			tmpV16 |= (LOADER_CLK_EN |ANA8M ) ;
+			rtw_write16(pAdapter,REG_SYS_CLKR,tmpV16);
+		}
+
+		if(bWrite == _TRUE)
+		{
+			// Enable LDO 2.5V before read/write action
+			tempval = rtw_read8(pAdapter, EFUSE_TEST+3);
+			tempval &= 0x0F;
+			tempval |= (VOLTAGE_V25 << 4);
+			rtw_write8(pAdapter, EFUSE_TEST+3, (tempval | 0x80));
+		}
+	}
+	else
+	{
+		rtw_write8(pAdapter, REG_EFUSE_ACCESS, EFUSE_ACCESS_OFF);
+
+		if(bWrite == _TRUE){
+			// Disable LDO 2.5V after read/write action
+			tempval = rtw_read8(pAdapter, EFUSE_TEST+3);
+			rtw_write8(pAdapter, EFUSE_TEST+3, (tempval & 0x7F));
+		}
+	}
+}
+
+static VOID
+rtl8192c_EfusePowerSwitch(
+	IN	PADAPTER	pAdapter,
+	IN	u8		bWrite,
+	IN	u8		PwrState)
+{
+	if(IS_HARDWARE_TYPE_8192C(pAdapter))
+	{
+		hal_EfusePowerSwitch_RTL8192C(pAdapter, bWrite, PwrState);
+	}
+	else if(IS_HARDWARE_TYPE_8723A(pAdapter))
+	{
+		hal_EfusePowerSwitch_RTL8723(pAdapter, bWrite, PwrState);
+	}
+}
+
+static VOID
+ReadEFuse_RTL8192C(
+	PADAPTER	Adapter,
+	u16		 _offset,
+	u16 		_size_byte,
+	u8      	*pbuf,
+	IN	BOOLEAN		bPseudoTest
+	)
+{
+	u8	efuseTbl[EFUSE_MAP_LEN];
+	u8	rtemp8[1];
+	u16 	eFuse_Addr = 0;
+	u8  	offset, wren;
+	u16	i, j;
+	u16	eFuseWord[EFUSE_MAX_SECTION][EFUSE_MAX_WORD_UNIT];
+	u16	efuse_utilized = 0;
+	u8	efuse_usage = 0;
+
+	//
+	// Do NOT excess total size of EFuse table. Added by Roger, 2008.11.10.
+	//
+	if((_offset + _size_byte)>EFUSE_MAP_LEN)
+	{// total E-Fuse table is 128bytes
+		//DBG_8192C("ReadEFuse_RTL8192C(): Invalid offset(%#x) with read bytes(%#x)!!\n",_offset, _size_byte);
+		return;
+	}
+
+	// 0. Refresh efuse init map as all oxFF.
+	for (i = 0; i < EFUSE_MAX_SECTION; i++)
+		for (j = 0; j < EFUSE_MAX_WORD_UNIT; j++)
+			eFuseWord[i][j] = 0xFFFF;
+
+
+	//
+	// 1. Read the first byte to check if efuse is empty!!!
+	//
+	//
+	ReadEFuseByte(Adapter, eFuse_Addr, rtemp8, bPseudoTest);
+	if(*rtemp8 != 0xFF)
+	{
+		efuse_utilized++;
+		//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Addr=%d\n", eFuse_Addr));
+		eFuse_Addr++;
+	}
+
+	//
+	// 2. Read real efuse content. Filter PG header and every section data.
+	//
+	while((*rtemp8 != 0xFF) && (eFuse_Addr < EFUSE_REAL_CONTENT_LEN))
+	{
+		// Check PG header for section num.
+		offset = ((*rtemp8 >> 4) & 0x0f);
+
+		if(offset < EFUSE_MAX_SECTION)
+		{
+			// Get word enable value from PG header
+			wren = (*rtemp8 & 0x0f);
+			//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Offset-%d Worden=%x\n", offset, wren));
+
+			for(i=0; i<EFUSE_MAX_WORD_UNIT; i++)
+			{
+				// Check word enable condition in the section
+				if(!(wren & 0x01))
+				{
+					//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Addr=%d\n", eFuse_Addr));
+					ReadEFuseByte(Adapter, eFuse_Addr, rtemp8, bPseudoTest);	eFuse_Addr++;
+					efuse_utilized++;
+					eFuseWord[offset][i] = (*rtemp8 & 0xff);
+
+
+					if(eFuse_Addr >= EFUSE_REAL_CONTENT_LEN)
+						break;
+
+					//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Addr=%d\n", eFuse_Addr));
+					ReadEFuseByte(Adapter, eFuse_Addr, rtemp8, bPseudoTest);	eFuse_Addr++;
+					efuse_utilized++;
+					eFuseWord[offset][i] |= (((u16)*rtemp8 << 8) & 0xff00);
+
+					if(eFuse_Addr >= EFUSE_REAL_CONTENT_LEN)
+						break;
+				}
+
+				wren >>= 1;
+
+			}
+		}
+
+		//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Addr=%d\n", eFuse_Addr));
+		// Read next PG header
+		ReadEFuseByte(Adapter, eFuse_Addr, rtemp8, bPseudoTest);
+		if(*rtemp8 != 0xFF && (eFuse_Addr < 512))
+		{
+			efuse_utilized++;
+			eFuse_Addr++;
+		}
+	}
+
+	//
+	// 3. Collect 16 sections and 4 word unit into Efuse map.
+	//
+	for(i=0; i<EFUSE_MAX_SECTION; i++)
+	{
+		for(j=0; j<EFUSE_MAX_WORD_UNIT; j++)
+		{
+			efuseTbl[(i*8)+(j*2)]=(eFuseWord[i][j] & 0xff);
+			efuseTbl[(i*8)+((j*2)+1)]=((eFuseWord[i][j] >> 8) & 0xff);
+		}
+	}
+
+	//
+	// 4. Copy from Efuse map to output pointer memory!!!
+	//
+	for(i=0; i<_size_byte; i++)
+	{
+		pbuf[i] = efuseTbl[_offset+i];
+	}
+
+	//
+	// 5. Calculate Efuse utilization.
+	//
+	efuse_usage = (u8)((efuse_utilized*100)/EFUSE_REAL_CONTENT_LEN);
+	rtw_hal_set_hwreg(Adapter, HW_VAR_EFUSE_BYTES, (u8 *)&efuse_utilized);
+	//rtw_hal_set_hwreg(Adapter, HW_VAR_EFUSE_USAGE, (pu1Byte)&efuse_usage);
+}
+
+static VOID
+ReadEFuse_RTL8723(
+	PADAPTER	Adapter,
+	u16		 _offset,
+	u16 		_size_byte,
+	u8      	*pbuf,
+	IN	BOOLEAN		bPseudoTest
+	)
+{
+	u8	efuseTbl[EFUSE_MAP_LEN_8723];
+	u16	eFuse_Addr = 0;
+	u8	offset = 0, wden = 0;
+	u16	i, j;
+	u16	eFuseWord[EFUSE_MAX_SECTION_8723][EFUSE_MAX_WORD_UNIT];
+	u16	efuse_utilized = 0;
+	u8	efuse_usage = 0;
+	u8	offset_2_0=0;
+	u8	efuseHeader=0, efuseExtHdr=0, efuseData=0;
+	//
+	// Do NOT excess total size of EFuse table. Added by Roger, 2008.11.10.
+	//
+	if((_offset + _size_byte)>EFUSE_MAP_LEN_8723)
+	{
+		//RT_TRACE(COMP_EFUSE, DBG_LOUD, ("ReadEFuse_RTL8723(): Invalid offset(%#x) with read bytes(%#x)!!\n",_offset, _size_byte));
+		return;
+	}
+
+	// 0. Refresh efuse init map as all oxFF.
+	for (i = 0; i < EFUSE_MAX_SECTION_8723; i++)
+		for (j = 0; j < EFUSE_MAX_WORD_UNIT; j++)
+			eFuseWord[i][j] = 0xFFFF;
+
+	//
+	// 1. Read the first byte to check if efuse is empty!!!
+	//
+	//
+	ReadEFuseByte(Adapter, eFuse_Addr++, &efuseHeader, bPseudoTest);
+
+	if(efuseHeader != 0xFF)
+	{
+		efuse_utilized++;
+	}
+	else
+	{
+		//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("EFUSE is empty\n"));
+		return;
+	}
+
+
+	//
+	// 2. Read real efuse content. Filter PG header and every section data.
+	//
+	while((efuseHeader != 0xFF) && AVAILABLE_EFUSE_ADDR(eFuse_Addr))
+	{
+		//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("efuse[%d]=%x\n", eFuse_Addr-1, efuseHeader));
+
+		// Check PG header for section num.
+		if(EXT_HEADER(efuseHeader))		//extended header
+		{
+			offset_2_0 = GET_HDR_OFFSET_2_0(efuseHeader);
+			//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("extended header offset_2_0=%x\n", offset_2_0));
+
+			ReadEFuseByte(Adapter, eFuse_Addr++, &efuseExtHdr, bPseudoTest);
+
+			//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("efuse[%d]=%x\n", eFuse_Addr-1, efuseExtHdr));
+
+			if(efuseExtHdr != 0xff)
+			{
+				efuse_utilized++;
+				if(ALL_WORDS_DISABLED(efuseExtHdr))
+				{
+					ReadEFuseByte(Adapter, eFuse_Addr++, &efuseHeader, bPseudoTest);
+					if(efuseHeader != 0xff)
+					{
+						efuse_utilized++;
+					}
+					continue;
+				}
+				else
+				{
+					offset = ((efuseExtHdr & 0xF0) >> 1) | offset_2_0;
+					wden = (efuseExtHdr & 0x0F);
+				}
+			}
+			else
+			{
+				//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Error condition, extended = 0xff\n"));
+				// We should handle this condition.
+			}
+		}
+		else
+		{
+			offset = ((efuseHeader >> 4) & 0x0f);
+			wden = (efuseHeader & 0x0f);
+		}
+
+		if(offset < EFUSE_MAX_SECTION_8723)
+		{
+			// Get word enable value from PG header
+			//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Offset-%d Worden=%x\n", offset, wden));
+
+			for(i=0; i<EFUSE_MAX_WORD_UNIT; i++)
+			{
+				// Check word enable condition in the section
+				if(!(wden & (0x01<<i)))
+				{
+					ReadEFuseByte(Adapter, eFuse_Addr++, &efuseData, bPseudoTest);
+					//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("efuse[%d]=%x\n", eFuse_Addr-1, efuseData));
+					efuse_utilized++;
+					eFuseWord[offset][i] = (efuseData & 0xff);
+
+					if(!AVAILABLE_EFUSE_ADDR(eFuse_Addr))
+						break;
+
+					ReadEFuseByte(Adapter, eFuse_Addr++, &efuseData, bPseudoTest);
+					//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("efuse[%d]=%x\n", eFuse_Addr-1, efuseData));
+					efuse_utilized++;
+					eFuseWord[offset][i] |= (((u16)efuseData << 8) & 0xff00);
+
+					if(!AVAILABLE_EFUSE_ADDR(eFuse_Addr))
+						break;
+				}
+			}
+		}
+
+		// Read next PG header
+		ReadEFuseByte(Adapter, eFuse_Addr++, &efuseHeader, bPseudoTest);
+
+		if(efuseHeader != 0xFF)
+		{
+			efuse_utilized++;
+		}
+	}
+
+	//
+	// 3. Collect 16 sections and 4 word unit into Efuse map.
+	//
+	for(i=0; i<EFUSE_MAX_SECTION_8723; i++)
+	{
+		for(j=0; j<EFUSE_MAX_WORD_UNIT; j++)
+		{
+			efuseTbl[(i*8)+(j*2)]=(eFuseWord[i][j] & 0xff);
+			efuseTbl[(i*8)+((j*2)+1)]=((eFuseWord[i][j] >> 8) & 0xff);
+		}
+	}
+
+	//
+	// 4. Copy from Efuse map to output pointer memory!!!
+	//
+	for(i=0; i<_size_byte; i++)
+	{
+		pbuf[i] = efuseTbl[_offset+i];
+	}
+
+	//
+	// 5. Calculate Efuse utilization.
+	//
+	efuse_usage = (u8)((efuse_utilized*100)/EFUSE_REAL_CONTENT_LEN);
+	rtw_hal_set_hwreg(Adapter, HW_VAR_EFUSE_BYTES, (u8 *)&efuse_utilized);
+	//rtw_hal_set_hwreg(Adapter, HW_VAR_EFUSE_USAGE, (pu1Byte)&efuse_usage);
+}
+
+static BOOLEAN
+Hal_EfuseSwitchToBank(
+	IN		PADAPTER	pAdapter,
+	IN		u8			bank,
+	IN		BOOLEAN		bPseudoTest
+	)
+{
+	BOOLEAN		bRet = _FALSE;
+	u32		value32=0;
+
+	//RTPRINT(FEEPROM, EFUSE_PG, ("Efuse switch bank to %d\n", bank));
+	if(bPseudoTest)
+	{
+		fakeEfuseBank = bank;
+		bRet = _TRUE;
+	}
+	else
+	{
+		if(IS_HARDWARE_TYPE_8723A(pAdapter) &&
+			INCLUDE_MULTI_FUNC_BT(pAdapter))
+		{
+			value32 = rtw_read32(pAdapter, EFUSE_TEST);
+			bRet = _TRUE;
+			switch(bank)
+			{
+			case 0:
+				value32 = (value32 & ~EFUSE_SEL_MASK) | EFUSE_SEL(EFUSE_WIFI_SEL_0);
+				break;
+			case 1:
+				value32 = (value32 & ~EFUSE_SEL_MASK) | EFUSE_SEL(EFUSE_BT_SEL_0);
+				break;
+			case 2:
+				value32 = (value32 & ~EFUSE_SEL_MASK) | EFUSE_SEL(EFUSE_BT_SEL_1);
+				break;
+			case 3:
+				value32 = (value32 & ~EFUSE_SEL_MASK) | EFUSE_SEL(EFUSE_BT_SEL_2);
+				break;
+			default:
+				value32 = (value32 & ~EFUSE_SEL_MASK) | EFUSE_SEL(EFUSE_WIFI_SEL_0);
+				bRet = _FALSE;
+				break;
+			}
+			rtw_write32(pAdapter, EFUSE_TEST, value32);
+		}
+		else
+			bRet = _TRUE;
+	}
+	return bRet;
+}
+
+static VOID
+ReadEFuse_BT(
+	PADAPTER	Adapter,
+	u16		 _offset,
+	u16 		_size_byte,
+	u8      	*pbuf,
+	IN	BOOLEAN	bPseudoTest
+	)
+{
+	u8  	*efuseTbl;
+	u16 	eFuse_Addr = 0;
+	u8  	offset = 0, wden = 0;
+	u16	i, j;
+	u16 	**eFuseWord;
+	u16	efuse_utilized = 0;
+	u8	efuse_usage = 0;
+	u8	offset_2_0=0;
+	u8	efuseHeader=0, efuseExtHdr=0, efuseData=0;
+	u8	bank=0;
+	BOOLEAN	bCheckNextBank=_FALSE;
+
+	efuseTbl = rtw_malloc(EFUSE_BT_MAP_LEN);
+	if(efuseTbl == NULL){
+		DBG_8192C("efuseTbl malloc fail !\n");
+		return;
+	}
+
+	eFuseWord = (u16 **)rtw_zmalloc(sizeof(u16 *)*EFUSE_BT_MAX_SECTION);
+	if(eFuseWord == NULL){
+		DBG_8192C("eFuseWord malloc fail !\n");
+		return;
+	}
+	else{
+		for(i=0;i<EFUSE_BT_MAX_SECTION;i++){
+			eFuseWord[i]= (u16 *)rtw_zmalloc(sizeof(u16)*EFUSE_MAX_WORD_UNIT);
+			if(eFuseWord[i]==NULL){
+				DBG_8192C("eFuseWord[] malloc fail !\n");
+				return;
+			}
+		}
+	}
+
+	//
+	// Do NOT excess total size of EFuse table. Added by Roger, 2008.11.10.
+	//
+	if((_offset + _size_byte)>EFUSE_BT_MAP_LEN)
+	{
+		//RT_TRACE(COMP_EFUSE, DBG_LOUD, ("ReadEFuse_BT(): Invalid offset(%#x) with read bytes(%#x)!!\n",_offset, _size_byte));
+		return;
+	}
+
+	// 0. Refresh efuse init map as all oxFF.
+	for (i = 0; i < EFUSE_BT_MAX_SECTION; i++)
+		for (j = 0; j < EFUSE_MAX_WORD_UNIT; j++)
+			eFuseWord[i][j] = 0xFFFF;
+
+	for(bank=1; bank<EFUSE_MAX_BANK; bank++)
+	{
+		if(!Hal_EfuseSwitchToBank(Adapter, bank, bPseudoTest))
+		{
+			//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Hal_EfuseSwitchToBank() Fail!!\n"));
+			return;
+		}
+		eFuse_Addr = 0;
+		//
+		// 1. Read the first byte to check if efuse is empty!!!
+		//
+		ReadEFuseByte(Adapter, eFuse_Addr++, &efuseHeader, bPseudoTest);
+
+		if(efuseHeader != 0xFF)
+		{
+			efuse_utilized++;
+		}
+		else
+		{
+			//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("EFUSE is empty\n"));
+			return;
+		}
+		//
+		// 2. Read real efuse content. Filter PG header and every section data.
+		//
+		while((efuseHeader != 0xFF) && AVAILABLE_EFUSE_ADDR(eFuse_Addr))
+		{
+			//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("efuse[%d]=0x%02x (header)\n", (((bank-1)*EFUSE_REAL_CONTENT_LEN)+eFuse_Addr-1), efuseHeader));
+
+			// Check PG header for section num.
+			if(EXT_HEADER(efuseHeader))		//extended header
+			{
+				offset_2_0 = GET_HDR_OFFSET_2_0(efuseHeader);
+				//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("extended header offset_2_0=%x\n", offset_2_0));
+
+				ReadEFuseByte(Adapter, eFuse_Addr++, &efuseExtHdr, bPseudoTest);
+
+				//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("efuse[%d]=0x%02x (ext header)\n", (((bank-1)*EFUSE_REAL_CONTENT_LEN)+eFuse_Addr-1), efuseExtHdr));
+
+				if(efuseExtHdr != 0xff)
+				{
+					efuse_utilized++;
+					if(ALL_WORDS_DISABLED(efuseExtHdr))
+					{
+						ReadEFuseByte(Adapter, eFuse_Addr++, &efuseHeader, bPseudoTest);
+						if(efuseHeader != 0xff)
+						{
+							efuse_utilized++;
+						}
+						continue;
+					}
+					else
+					{
+						offset = ((efuseExtHdr & 0xF0) >> 1) | offset_2_0;
+						wden = (efuseExtHdr & 0x0F);
+					}
+				}
+				else
+				{
+					//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Error condition, extended = 0xff\n"));
+					// We should handle this condition.
+				}
+			}
+			else
+			{
+				offset = ((efuseHeader >> 4) & 0x0f);
+				wden = (efuseHeader & 0x0f);
+			}
+
+			if(offset < EFUSE_BT_MAX_SECTION)
+			{
+				// Get word enable value from PG header
+				//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Offset-%d Worden=%x\n", offset, wden));
+
+				for(i=0; i<EFUSE_MAX_WORD_UNIT; i++)
+				{
+					// Check word enable condition in the section
+					if(!(wden & (0x01<<i)))
+					{
+						ReadEFuseByte(Adapter, eFuse_Addr++, &efuseData, bPseudoTest);
+						//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("efuse[%d]=0x%02x\n", (((bank-1)*EFUSE_REAL_CONTENT_LEN)+eFuse_Addr-1), efuseData));
+						efuse_utilized++;
+						eFuseWord[offset][i] = (efuseData & 0xff);
+
+						if(!AVAILABLE_EFUSE_ADDR(eFuse_Addr))
+							break;
+
+						ReadEFuseByte(Adapter, eFuse_Addr++, &efuseData, bPseudoTest);
+						//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("efuse[%d]=0x%02x\n", (((bank-1)*EFUSE_REAL_CONTENT_LEN)+eFuse_Addr-1), efuseData));
+						efuse_utilized++;
+						eFuseWord[offset][i] |= (((u16)efuseData << 8) & 0xff00);
+
+						if(!AVAILABLE_EFUSE_ADDR(eFuse_Addr))
+							break;
+					}
+				}
+			}
+
+			// Read next PG header
+			ReadEFuseByte(Adapter, eFuse_Addr++, &efuseHeader, bPseudoTest);
+
+			if(efuseHeader != 0xFF)
+			{
+				efuse_utilized++;
+			}
+			else
+			{
+				if((eFuse_Addr + EFUSE_PROTECT_BYTES_BANK) >= EFUSE_REAL_CONTENT_LEN)
+					bCheckNextBank = _TRUE;
+				else
+					bCheckNextBank = _FALSE;
+			}
+		}
+		if(!bCheckNextBank)
+		{
+			//RTPRINT(FEEPROM, EFUSE_READ_ALL, ("Stop to check next bank\n"));
+			break;
+		}
+	}
+
+	// switch bank back to bank 0 for later BT and wifi use.
+	Hal_EfuseSwitchToBank(Adapter, 0, bPseudoTest);
+
+	//
+	// 3. Collect 16 sections and 4 word unit into Efuse map.
+	//
+	for(i=0; i<EFUSE_BT_MAX_SECTION; i++)
+	{
+		for(j=0; j<EFUSE_MAX_WORD_UNIT; j++)
+		{
+			efuseTbl[(i*8)+(j*2)]=(eFuseWord[i][j] & 0xff);
+			efuseTbl[(i*8)+((j*2)+1)]=((eFuseWord[i][j] >> 8) & 0xff);
+		}
+	}
+
+	//
+	// 4. Copy from Efuse map to output pointer memory!!!
+	//
+	for(i=0; i<_size_byte; i++)
+	{
+		pbuf[i] = efuseTbl[_offset+i];
+	}
+
+	//
+	// 5. Calculate Efuse utilization.
+	//
+	efuse_usage = (u8)((efuse_utilized*100)/EFUSE_BT_REAL_CONTENT_LEN);
+	if(bPseudoTest)
+	{
+		fakeBTEfuseUsedBytes =  (EFUSE_REAL_CONTENT_LEN*(bank-1))+eFuse_Addr-1;
+	}
+	else
+	{
+		BTEfuseUsedBytes =  (EFUSE_REAL_CONTENT_LEN*(bank-1))+eFuse_Addr-1;
+	}
+
+	for(i=0;i<EFUSE_BT_MAX_SECTION;i++)
+		rtw_mfree((u8 *)eFuseWord[i], sizeof(u16)*EFUSE_MAX_WORD_UNIT);
+	rtw_mfree((u8 *)eFuseWord, sizeof(u16 *)*EFUSE_BT_MAX_SECTION);
+	rtw_mfree(efuseTbl, EFUSE_BT_MAP_LEN);
+}
+
+
+static VOID
+ReadEFuseByIC(
+	PADAPTER	Adapter,
+	u8		efuseType,
+	u16		 _offset,
+	u16 		_size_byte,
+	u8      	*pbuf,
+	IN BOOLEAN	bPseudoTest
+	)
+{
+	if(efuseType == EFUSE_WIFI)
+	{
+		if(IS_HARDWARE_TYPE_8192C(Adapter))
+		{
+			ReadEFuse_RTL8192C(Adapter, _offset, _size_byte, pbuf, bPseudoTest);
+		}
+		else if(IS_HARDWARE_TYPE_8723A(Adapter))
+		{
+			ReadEFuse_RTL8723(Adapter, _offset, _size_byte, pbuf, bPseudoTest);
+		}
+	}
+	else
+		ReadEFuse_BT(Adapter, _offset, _size_byte, pbuf, bPseudoTest);
+}
+
+static VOID
+ReadEFuse_Pseudo(
+	PADAPTER	Adapter,
+	u8		efuseType,
+	u16		 _offset,
+	u16 		_size_byte,
+	u8      	*pbuf,
+	IN BOOLEAN	bPseudoTest
+	)
+{
+	if(efuseType == EFUSE_WIFI)
+		ReadEFuse_RTL8723(Adapter, _offset, _size_byte, pbuf, bPseudoTest);
+	else
+		ReadEFuse_BT(Adapter, _offset, _size_byte, pbuf, bPseudoTest);
+}
+
+static VOID
+rtl8192c_ReadEFuse(
+	PADAPTER	Adapter,
+	u8		efuseType,
+	u16		_offset,
+	u16 		_size_byte,
+	u8      	*pbuf,
+	IN	BOOLEAN	bPseudoTest
+	)
+{
+	if(bPseudoTest)
+	{
+		ReadEFuse_Pseudo(Adapter, efuseType, _offset, _size_byte, pbuf, bPseudoTest);
+	}
+	else
+	{
+		ReadEFuseByIC(Adapter, efuseType, _offset, _size_byte, pbuf, bPseudoTest);
+	}
+}
+
+static VOID
+Hal_EFUSEGetEfuseDefinition(
+	IN		PADAPTER	pAdapter,
+	IN		u8		efuseType,
+	IN		u8		type,
+	OUT		PVOID		*pOut
+	)
+{
+	switch(type)
+	{
+		case TYPE_EFUSE_MAX_SECTION:
+			{
+				u8	*pMax_section;
+				pMax_section = (u8 *)pOut;
+
+				if(efuseType == EFUSE_WIFI)
+				{
+					if(IS_HARDWARE_TYPE_8192C(pAdapter))
+					{
+						*pMax_section = EFUSE_MAX_SECTION;
+					}
+					else if(IS_HARDWARE_TYPE_8723A(pAdapter))
+					{
+						*pMax_section = EFUSE_MAX_SECTION_8723;
+					}
+				}
+				else
+					*pMax_section = EFUSE_BT_MAX_SECTION;
+			}
+			break;
+		case TYPE_EFUSE_REAL_CONTENT_LEN:
+			{
+				u16 *pu2Tmp;
+				pu2Tmp = (u16 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pu2Tmp = EFUSE_REAL_CONTENT_LEN;
+				else
+					*pu2Tmp = EFUSE_BT_REAL_CONTENT_LEN;
+			}
+			break;
+		case TYPE_AVAILABLE_EFUSE_BYTES_BANK:
+			{
+				u16	*pu2Tmp;
+				pu2Tmp = (u16 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pu2Tmp = (u16)(EFUSE_REAL_CONTENT_LEN-EFUSE_OOB_PROTECT_BYTES);
+				else
+					*pu2Tmp = (u16)(EFUSE_REAL_CONTENT_LEN-EFUSE_PROTECT_BYTES_BANK);
+			}
+			break;
+		case TYPE_AVAILABLE_EFUSE_BYTES_TOTAL:
+			{
+				u16 *pu2Tmp;
+				pu2Tmp = (u16 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pu2Tmp = (u16)(EFUSE_REAL_CONTENT_LEN-EFUSE_OOB_PROTECT_BYTES);
+				else
+					*pu2Tmp = (u16)(EFUSE_BT_REAL_CONTENT_LEN-(EFUSE_PROTECT_BYTES_BANK*3));
+			}
+			break;
+		case TYPE_EFUSE_MAP_LEN:
+			{
+				u16 *pu2Tmp;
+				pu2Tmp = (u16 *)pOut;
+
+				if(efuseType == EFUSE_WIFI)
+				{
+					if(IS_HARDWARE_TYPE_8192C(pAdapter))
+					{
+						*pu2Tmp = (u16)EFUSE_MAP_LEN;
+					}
+					else if(IS_HARDWARE_TYPE_8723A(pAdapter))
+					{
+						*pu2Tmp = (u16)EFUSE_MAP_LEN_8723;
+					}
+				}
+				else
+					*pu2Tmp = (u16)EFUSE_BT_MAP_LEN;
+			}
+			break;
+		case TYPE_EFUSE_PROTECT_BYTES_BANK:
+			{
+				u8 *pu1Tmp;
+				pu1Tmp = (u8 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pu1Tmp = (u8)(EFUSE_OOB_PROTECT_BYTES);
+				else
+					*pu1Tmp = (u8)(EFUSE_PROTECT_BYTES_BANK);
+			}
+			break;
+		default:
+			{
+				u8 *pu1Tmp;
+				pu1Tmp = (u8 *)pOut;
+				*pu1Tmp = 0;
+			}
+			break;
+	}
+}
+
+static VOID
+Hal_EFUSEGetEfuseDefinition_Pseudo(
+	IN		PADAPTER	pAdapter,
+	IN		u8		efuseType,
+	IN		u8		type,
+	OUT		PVOID		*pOut
+	)
+{
+	switch(type)
+	{
+		case TYPE_EFUSE_MAX_SECTION:
+			{
+				u8	*pMax_section;
+				pMax_section = (u8 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pMax_section = EFUSE_MAX_SECTION_8723;
+				else
+					*pMax_section = EFUSE_BT_MAX_SECTION;
+			}
+			break;
+		case TYPE_EFUSE_REAL_CONTENT_LEN:
+			{
+				u16 *pu2Tmp;
+				pu2Tmp = (u16 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pu2Tmp = EFUSE_REAL_CONTENT_LEN;
+				else
+					*pu2Tmp = EFUSE_BT_REAL_CONTENT_LEN;
+			}
+			break;
+		case TYPE_AVAILABLE_EFUSE_BYTES_BANK:
+			{
+				u16 *pu2Tmp;
+				pu2Tmp = (u16 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pu2Tmp = (u16)(EFUSE_REAL_CONTENT_LEN-EFUSE_OOB_PROTECT_BYTES);
+				else
+					*pu2Tmp = (u16)(EFUSE_REAL_CONTENT_LEN-EFUSE_PROTECT_BYTES_BANK);
+			}
+			break;
+		case TYPE_AVAILABLE_EFUSE_BYTES_TOTAL:
+			{
+				u16 *pu2Tmp;
+				pu2Tmp = (u16 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pu2Tmp = (u16)(EFUSE_REAL_CONTENT_LEN-EFUSE_OOB_PROTECT_BYTES);
+				else
+					*pu2Tmp = (u16)(EFUSE_BT_REAL_CONTENT_LEN-(EFUSE_PROTECT_BYTES_BANK*3));
+			}
+			break;
+		case TYPE_EFUSE_MAP_LEN:
+			{
+				u16 *pu2Tmp;
+				pu2Tmp = (u16 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pu2Tmp = (u16)EFUSE_MAP_LEN_8723;
+				else
+					*pu2Tmp = (u16)EFUSE_BT_MAP_LEN;
+			}
+			break;
+		case TYPE_EFUSE_PROTECT_BYTES_BANK:
+			{
+				u8 *pu1Tmp;
+				pu1Tmp = (u8 *)pOut;
+				if(efuseType == EFUSE_WIFI)
+					*pu1Tmp = (u8)(EFUSE_OOB_PROTECT_BYTES);
+				else
+					*pu1Tmp = (u8)(EFUSE_PROTECT_BYTES_BANK);
+			}
+			break;
+		default:
+			{
+				u8 *pu1Tmp;
+				pu1Tmp = (u8 *)pOut;
+				*pu1Tmp = 0;
+			}
+			break;
+	}
+}
+
+static VOID
+rtl8192c_EFUSE_GetEfuseDefinition(
+	IN		PADAPTER	pAdapter,
+	IN		u8		efuseType,
+	IN		u8		type,
+	OUT		PVOID		*pOut,
+	IN		BOOLEAN		bPseudoTest
+	)
+{
+	if(bPseudoTest)
+	{
+		Hal_EFUSEGetEfuseDefinition_Pseudo(pAdapter, efuseType, type, pOut);
+	}
+	else
+	{
+		Hal_EFUSEGetEfuseDefinition(pAdapter, efuseType, type, pOut);
+	}
+}
+
+static u8
+Hal_EfuseWordEnableDataWrite(	IN	PADAPTER	pAdapter,
+							IN	u16		efuse_addr,
+							IN	u8		word_en,
+							IN	u8		*data,
+							IN	BOOLEAN		bPseudoTest)
+{
+	u16	tmpaddr = 0;
+	u16	start_addr = efuse_addr;
+	u8	badworden = 0x0F;
+	u8	tmpdata[8];
+
+	_rtw_memset((PVOID)tmpdata, 0xff, PGPKT_DATA_SIZE);
+	//RT_TRACE(COMP_EFUSE, DBG_LOUD, ("word_en = %x efuse_addr=%x\n", word_en, efuse_addr));
+
+	if(!(word_en&BIT0))
+	{
+		tmpaddr = start_addr;
+		efuse_OneByteWrite(pAdapter,start_addr++, data[0], bPseudoTest);
+		efuse_OneByteWrite(pAdapter,start_addr++, data[1], bPseudoTest);
+
+		efuse_OneByteRead(pAdapter,tmpaddr, &tmpdata[0], bPseudoTest);
+		efuse_OneByteRead(pAdapter,tmpaddr+1, &tmpdata[1], bPseudoTest);
+		if((data[0]!=tmpdata[0])||(data[1]!=tmpdata[1])){
+			badworden &= (~BIT0);
+		}
+	}
+	if(!(word_en&BIT1))
+	{
+		tmpaddr = start_addr;
+		efuse_OneByteWrite(pAdapter,start_addr++, data[2], bPseudoTest);
+		efuse_OneByteWrite(pAdapter,start_addr++, data[3], bPseudoTest);
+
+		efuse_OneByteRead(pAdapter,tmpaddr    , &tmpdata[2], bPseudoTest);
+		efuse_OneByteRead(pAdapter,tmpaddr+1, &tmpdata[3], bPseudoTest);
+		if((data[2]!=tmpdata[2])||(data[3]!=tmpdata[3])){
+			badworden &=( ~BIT1);
+		}
+	}
+	if(!(word_en&BIT2))
+	{
+		tmpaddr = start_addr;
+		efuse_OneByteWrite(pAdapter,start_addr++, data[4], bPseudoTest);
+		efuse_OneByteWrite(pAdapter,start_addr++, data[5], bPseudoTest);
+
+		efuse_OneByteRead(pAdapter,tmpaddr, &tmpdata[4], bPseudoTest);
+		efuse_OneByteRead(pAdapter,tmpaddr+1, &tmpdata[5], bPseudoTest);
+		if((data[4]!=tmpdata[4])||(data[5]!=tmpdata[5])){
+			badworden &=( ~BIT2);
+		}
+	}
+	if(!(word_en&BIT3))
+	{
+		tmpaddr = start_addr;
+		efuse_OneByteWrite(pAdapter,start_addr++, data[6], bPseudoTest);
+		efuse_OneByteWrite(pAdapter,start_addr++, data[7], bPseudoTest);
+
+		efuse_OneByteRead(pAdapter,tmpaddr, &tmpdata[6], bPseudoTest);
+		efuse_OneByteRead(pAdapter,tmpaddr+1, &tmpdata[7], bPseudoTest);
+		if((data[6]!=tmpdata[6])||(data[7]!=tmpdata[7])){
+			badworden &=( ~BIT3);
+		}
+	}
+	return badworden;
+}
+
+static u8
+Hal_EfuseWordEnableDataWrite_Pseudo(	IN	PADAPTER	pAdapter,
+							IN	u16		efuse_addr,
+							IN	u8		word_en,
+							IN	u8		*data,
+							IN	BOOLEAN		bPseudoTest)
+{
+	u8	ret=0;
+
+	ret = Hal_EfuseWordEnableDataWrite(pAdapter, efuse_addr, word_en, data, bPseudoTest);
+
+	return ret;
+}
+
+static u8
+rtl8192c_Efuse_WordEnableDataWrite(	IN	PADAPTER	pAdapter,
+							IN	u16		efuse_addr,
+							IN	u8		word_en,
+							IN	u8		*data,
+							IN	BOOLEAN		bPseudoTest)
+{
+	u8	ret=0;
+
+	if(bPseudoTest)
+	{
+		ret = Hal_EfuseWordEnableDataWrite_Pseudo(pAdapter, efuse_addr, word_en, data, bPseudoTest);
+	}
+	else
+	{
+		ret = Hal_EfuseWordEnableDataWrite(pAdapter, efuse_addr, word_en, data, bPseudoTest);
+	}
+
+	return ret;
+}
+
+
+static u16
+hal_EfuseGetCurrentSize_8192C(IN	PADAPTER	pAdapter,
+	IN		BOOLEAN		bPseudoTest)
+{
+	int bContinual = _TRUE;
+
+	u16	efuse_addr = 0;
+	u8	hoffset=0,hworden=0;
+	u8	efuse_data,word_cnts=0;
+
+	while (	bContinual &&
+			efuse_OneByteRead(pAdapter, efuse_addr ,&efuse_data, bPseudoTest) &&
+			(efuse_addr  < EFUSE_REAL_CONTENT_LEN) )
+	{
+		if(efuse_data!=0xFF)
+		{
+			hoffset = (efuse_data>>4) & 0x0F;
+			hworden =  efuse_data & 0x0F;
+			word_cnts = Efuse_CalculateWordCnts(hworden);
+			//read next header
+			efuse_addr = efuse_addr + (word_cnts*2)+1;
+		}
+		else
+		{
+			bContinual = _FALSE ;
+		}
+	}
+
+	return efuse_addr;
+}
+
+static u16
+Hal_EfuseGetCurrentSize_BT(IN	PADAPTER	pAdapter,
+		IN		BOOLEAN			bPseudoTest)
+{
+	int	bContinual = _TRUE;
+	u16	efuse_addr = 0;
+	u8	hoffset=0,hworden=0;
+	u8	efuse_data,word_cnts=0;
+	u8	bank=0, startBank=0;
+	u16	retU2=0;
+	u32	total_efuse_used=0;
+
+	if(bPseudoTest)
+	{
+		efuse_addr = (u16)((fakeBTEfuseUsedBytes%EFUSE_REAL_CONTENT_LEN));
+		startBank = (u8)(1+(fakeBTEfuseUsedBytes/EFUSE_REAL_CONTENT_LEN));
+	}
+	else
+	{
+		efuse_addr = (u16)((BTEfuseUsedBytes%EFUSE_REAL_CONTENT_LEN));
+		startBank = (u8)(1+(BTEfuseUsedBytes/EFUSE_REAL_CONTENT_LEN));
+	}
+
+	if((startBank < 1) || (startBank >= EFUSE_MAX_BANK))
+		DBG_8192C("Error, bank error, bank=%d\n", bank);
+
+	//RTPRINT(FEEPROM, EFUSE_PG, ("Hal_EfuseGetCurrentSize_BT(), start bank=%d, start_efuse_addr = %d\n", startBank, efuse_addr));
+
+	for(bank=startBank; bank<EFUSE_MAX_BANK; bank++)
+	{
+		if(!Hal_EfuseSwitchToBank(pAdapter, bank, bPseudoTest))
+			break;
+		else
+		{
+			bContinual = _TRUE;
+			if(bank != startBank)	// only when bank is switched we have to reset the efuse_addr.
+				efuse_addr = 0;
+		}
+
+		while (	bContinual &&
+				efuse_OneByteRead(pAdapter, efuse_addr ,&efuse_data, bPseudoTest) &&
+				AVAILABLE_EFUSE_ADDR(efuse_addr))
+		{
+			if(efuse_data!=0xFF)
+			{
+				if((efuse_data&0x1F) == 0x0F)		//extended header
+				{
+					hoffset = efuse_data;
+					efuse_addr++;
+					efuse_OneByteRead(pAdapter, efuse_addr ,&efuse_data, bPseudoTest);
+					if((efuse_data & 0x0F) == 0x0F)
+					{
+						efuse_addr++;
+						continue;
+					}
+					else
+					{
+						hoffset = ((hoffset & 0xE0) >> 5) | ((efuse_data & 0xF0) >> 1);
+						hworden = efuse_data & 0x0F;
+					}
+				}
+				else
+				{
+					hoffset = (efuse_data>>4) & 0x0F;
+					hworden =  efuse_data & 0x0F;
+				}
+				word_cnts = Efuse_CalculateWordCnts(hworden);
+				//read next header
+				efuse_addr = efuse_addr + (word_cnts*2)+1;
+			}
+			else
+			{
+				bContinual = _FALSE ;
+			}
+		}
+
+		// Check if we need to check next bank efuse
+		if(efuse_addr < (EFUSE_REAL_CONTENT_LEN-EFUSE_PROTECT_BYTES_BANK))
+		{
+			break;// don't need to check next bank.
+		}
+	}
+
+	retU2 = ((bank-1)*EFUSE_REAL_CONTENT_LEN)+efuse_addr;
+	if(bPseudoTest)
+	{
+		fakeBTEfuseUsedBytes = retU2;
+		//RTPRINT(FEEPROM, EFUSE_PG, ("Hal_EfuseGetCurrentSize_BT(), return %d\n", fakeBTEfuseUsedBytes));
+	}
+	else
+	{
+		BTEfuseUsedBytes = retU2;
+		//RTPRINT(FEEPROM, EFUSE_PG, ("Hal_EfuseGetCurrentSize_BT(), return %d\n", BTEfuseUsedBytes));
+	}
+
+	return retU2;
+}
+
+
+static u16
+hal_EfuseGetCurrentSize_8723(IN	PADAPTER	pAdapter,
+		IN		BOOLEAN			bPseudoTest)
+{
+	int	bContinual = _TRUE;
+
+	u16	efuse_addr = 0;
+	u8	hoffset=0,hworden=0;
+	u8	efuse_data,word_cnts=0;
+
+	if(bPseudoTest)
+	{
+		efuse_addr = (u16)(fakeEfuseUsedBytes);
+	}
+	else
+	{
+		rtw_hal_get_hwreg(pAdapter, HW_VAR_EFUSE_BYTES, (u8 *)&efuse_addr);
+	}
+	//RTPRINT(FEEPROM, EFUSE_PG, ("hal_EfuseGetCurrentSize_8723(), start_efuse_addr = %d\n", efuse_addr));
+
+	while (	bContinual &&
+			efuse_OneByteRead(pAdapter, efuse_addr ,&efuse_data, bPseudoTest) &&
+			AVAILABLE_EFUSE_ADDR(efuse_addr))
+	{
+		if(efuse_data!=0xFF)
+		{
+			if((efuse_data&0x1F) == 0x0F)		//extended header
+			{
+				hoffset = efuse_data;
+				efuse_addr++;
+				efuse_OneByteRead(pAdapter, efuse_addr ,&efuse_data, bPseudoTest);
+				if((efuse_data & 0x0F) == 0x0F)
+				{
+					efuse_addr++;
+					continue;
+				}
+				else
+				{
+					hoffset = ((hoffset & 0xE0) >> 5) | ((efuse_data & 0xF0) >> 1);
+					hworden = efuse_data & 0x0F;
+				}
+			}
+			else
+			{
+				hoffset = (efuse_data>>4) & 0x0F;
+				hworden =  efuse_data & 0x0F;
+			}
+			word_cnts = Efuse_CalculateWordCnts(hworden);
+			//read next header
+			efuse_addr = efuse_addr + (word_cnts*2)+1;
+		}
+		else
+		{
+			bContinual = _FALSE ;
+		}
+	}
+
+	if(bPseudoTest)
+	{
+		fakeEfuseUsedBytes = efuse_addr;
+		//RTPRINT(FEEPROM, EFUSE_PG, ("hal_EfuseGetCurrentSize_8723(), return %d\n", fakeEfuseUsedBytes));
+	}
+	else
+	{
+		rtw_hal_set_hwreg(pAdapter, HW_VAR_EFUSE_BYTES, (u8 *)&efuse_addr);
+		//RTPRINT(FEEPROM, EFUSE_PG, ("hal_EfuseGetCurrentSize_8723(), return %d\n", efuse_addr));
+	}
+
+	return efuse_addr;
+}
+
+static u16
+Hal_EfuseGetCurrentSize_Pseudo(IN	PADAPTER	pAdapter,
+		IN		BOOLEAN			bPseudoTest)
+{
+	u16	ret=0;
+
+	ret = hal_EfuseGetCurrentSize_8723(pAdapter, bPseudoTest);
+
+	return ret;
+}
+
+static u16
+rtl8192c_EfuseGetCurrentSize(
+	IN	PADAPTER	pAdapter,
+	IN	u8			efuseType,
+	IN	BOOLEAN		bPseudoTest)
+{
+	u16	ret=0;
+
+	if(efuseType == EFUSE_WIFI)
+	{
+		if(bPseudoTest)
+		{
+			ret = Hal_EfuseGetCurrentSize_Pseudo(pAdapter, bPseudoTest);
+		}
+		else
+		{
+			if(IS_HARDWARE_TYPE_8192C(pAdapter))
+			{
+				ret = hal_EfuseGetCurrentSize_8192C(pAdapter, bPseudoTest);
+			}
+			else if(IS_HARDWARE_TYPE_8723A(pAdapter))
+			{
+				ret = hal_EfuseGetCurrentSize_8723(pAdapter, bPseudoTest);
+			}
+		}
+	}
+	else
+	{
+		ret = Hal_EfuseGetCurrentSize_BT(pAdapter, bPseudoTest);
+	}
+
+	return ret;
+}
+
+static int
+hal_EfusePgPacketRead_8192C(	IN	PADAPTER	pAdapter,
+					IN	u8			offset,
+					IN	u8			*data,
+					IN	BOOLEAN			bPseudoTest)
+{
+	u8	ReadState = PG_STATE_HEADER;
+
+	int	bContinual = _TRUE;
+	int	bDataEmpty = _TRUE ;
+
+	u8	efuse_data,word_cnts=0;
+	u16	efuse_addr = 0;
+	u8	hoffset=0,hworden=0;
+	u8	tmpidx=0;
+	u8	tmpdata[8];
+
+	if(data==NULL)	return _FALSE;
+	if(offset>15)		return _FALSE;
+
+
+	_rtw_memset((PVOID)data, 0xff, sizeof(u8)*PGPKT_DATA_SIZE);
+	_rtw_memset((PVOID)tmpdata, 0xff, sizeof(u8)*PGPKT_DATA_SIZE);
+
+	//
+	// <Roger_TODO> Efuse has been pre-programmed dummy 5Bytes at the end of Efuse by CP.
+	// Skip dummy parts to prevent unexpected data read from Efuse.
+	// By pass right now. 2009.02.19.
+	//
+	while(bContinual && (efuse_addr  < EFUSE_REAL_CONTENT_LEN) )
+	{
+		//-------  Header Read -------------
+		if(ReadState & PG_STATE_HEADER)
+		{
+			if(efuse_OneByteRead(pAdapter, efuse_addr ,&efuse_data, bPseudoTest)&&(efuse_data!=0xFF)){
+				hoffset = (efuse_data>>4) & 0x0F;
+				hworden =  efuse_data & 0x0F;
+				word_cnts = Efuse_CalculateWordCnts(hworden);
+				bDataEmpty = _TRUE ;
+
+				if(hoffset==offset){
+					for(tmpidx = 0;tmpidx< word_cnts*2 ;tmpidx++){
+						if(efuse_OneByteRead(pAdapter, efuse_addr+1+tmpidx ,&efuse_data, bPseudoTest) ){
+							tmpdata[tmpidx] = efuse_data;
+							if(efuse_data!=0xff){
+								bDataEmpty = _FALSE;
+							}
+						}
+					}
+					if(bDataEmpty==_FALSE){
+						ReadState = PG_STATE_DATA;
+					}else{//read next header
+						efuse_addr = efuse_addr + (word_cnts*2)+1;
+						ReadState = PG_STATE_HEADER;
+					}
+				}
+				else{//read next header
+					efuse_addr = efuse_addr + (word_cnts*2)+1;
+					ReadState = PG_STATE_HEADER;
+				}
+
+			}
+			else{
+				bContinual = _FALSE ;
+			}
+		}
+		//-------  Data section Read -------------
+		else if(ReadState & PG_STATE_DATA)
+		{
+			efuse_WordEnableDataRead(hworden,tmpdata,data);
+			efuse_addr = efuse_addr + (word_cnts*2)+1;
+			ReadState = PG_STATE_HEADER;
+		}
+
+	}
+
+	if(	(data[0]==0xff) &&(data[1]==0xff) && (data[2]==0xff)  && (data[3]==0xff) &&
+		(data[4]==0xff) &&(data[5]==0xff) && (data[6]==0xff)  && (data[7]==0xff))
+		return _FALSE;
+	else
+		return _TRUE;
+
+}
+
+static int
+hal_EfusePgPacketRead_8723(	IN	PADAPTER	pAdapter,
+					IN	u8			offset,
+					IN	u8			*data,
+					IN	BOOLEAN			bPseudoTest)
+{
+	u8	ReadState = PG_STATE_HEADER;
+
+	int	bContinual = _TRUE;
+	int	bDataEmpty = _TRUE ;
+
+	u8	efuse_data,word_cnts=0;
+	u16	efuse_addr = 0;
+	u8	hoffset=0,hworden=0;
+	u8	tmpidx=0;
+	u8	tmpdata[8];
+	u8	max_section=0;
+	u8	tmp_header = 0;
+
+	EFUSE_GetEfuseDefinition(pAdapter, EFUSE_WIFI, TYPE_EFUSE_MAX_SECTION, (PVOID)&max_section, bPseudoTest);
+
+	if(data==NULL)
+		return _FALSE;
+	if(offset>max_section)
+		return _FALSE;
+
+	_rtw_memset((PVOID)data, 0xff, sizeof(u8)*PGPKT_DATA_SIZE);
+	_rtw_memset((PVOID)tmpdata, 0xff, sizeof(u8)*PGPKT_DATA_SIZE);
+
+
+	//
+	// <Roger_TODO> Efuse has been pre-programmed dummy 5Bytes at the end of Efuse by CP.
+	// Skip dummy parts to prevent unexpected data read from Efuse.
+	// By pass right now. 2009.02.19.
+	//
+	while(bContinual && AVAILABLE_EFUSE_ADDR(efuse_addr) )
+	{
+		//-------  Header Read -------------
+		if(ReadState & PG_STATE_HEADER)
+		{
+			if(efuse_OneByteRead(pAdapter, efuse_addr ,&efuse_data, bPseudoTest)&&(efuse_data!=0xFF))
+			{
+				if(EXT_HEADER(efuse_data))
+				{
+					tmp_header = efuse_data;
+					efuse_addr++;
+					efuse_OneByteRead(pAdapter, efuse_addr ,&efuse_data, bPseudoTest);
+					if(!ALL_WORDS_DISABLED(efuse_data))
+					{
+						hoffset = ((tmp_header & 0xE0) >> 5) | ((efuse_data & 0xF0) >> 1);
+						hworden = efuse_data & 0x0F;
+					}
+					else
+					{
+						DBG_8192C("Error, All words disabled\n");
+						efuse_addr++;
+						continue;
+					}
+				}
+				else
+				{
+					hoffset = (efuse_data>>4) & 0x0F;
+					hworden =  efuse_data & 0x0F;
+				}
+				word_cnts = Efuse_CalculateWordCnts(hworden);
+				bDataEmpty = _TRUE ;
+
+				if(hoffset==offset)
+				{
+					for(tmpidx = 0;tmpidx< word_cnts*2 ;tmpidx++)
+					{
+						if(efuse_OneByteRead(pAdapter, efuse_addr+1+tmpidx ,&efuse_data, bPseudoTest) )
+						{
+							tmpdata[tmpidx] = efuse_data;
+							if(efuse_data!=0xff)
+							{
+								bDataEmpty = _FALSE;
+							}
+						}
+					}
+					if(bDataEmpty==_FALSE){
+						ReadState = PG_STATE_DATA;
+					}else{//read next header
+						efuse_addr = efuse_addr + (word_cnts*2)+1;
+						ReadState = PG_STATE_HEADER;
+					}
+				}
+				else{//read next header
+					efuse_addr = efuse_addr + (word_cnts*2)+1;
+					ReadState = PG_STATE_HEADER;
+				}
+
+			}
+			else{
+				bContinual = _FALSE ;
+			}
+		}
+		//-------  Data section Read -------------
+		else if(ReadState & PG_STATE_DATA)
+		{
+			efuse_WordEnableDataRead(hworden,tmpdata,data);
+			efuse_addr = efuse_addr + (word_cnts*2)+1;
+			ReadState = PG_STATE_HEADER;
+		}
+
+	}
+
+	if(	(data[0]==0xff) &&(data[1]==0xff) && (data[2]==0xff)  && (data[3]==0xff) &&
+		(data[4]==0xff) &&(data[5]==0xff) && (data[6]==0xff)  && (data[7]==0xff))
+		return _FALSE;
+	else
+		return _TRUE;
+
+}
+
+static int
+Hal_EfusePgPacketRead(	IN	PADAPTER	pAdapter,
+					IN	u8			offset,
+					IN	u8			*data,
+					IN	BOOLEAN			bPseudoTest)
+{
+	int	ret=0;
+
+	if(IS_HARDWARE_TYPE_8192C(pAdapter))
+	{
+		ret = hal_EfusePgPacketRead_8192C(pAdapter, offset, data, bPseudoTest);
+	}
+	else if(IS_HARDWARE_TYPE_8723A(pAdapter))
+	{
+		ret = hal_EfusePgPacketRead_8723(pAdapter, offset, data, bPseudoTest);
+	}
+
+	return ret;
+}
+
+static int
+Hal_EfusePgPacketRead_Pseudo(	IN	PADAPTER	pAdapter,
+					IN	u8			offset,
+					IN	u8			*data,
+					IN	BOOLEAN		bPseudoTest)
+{
+	int	ret=0;
+
+	ret = hal_EfusePgPacketRead_8723(pAdapter, offset, data, bPseudoTest);
+
+	return ret;
+}
+
+static int
+rtl8192c_Efuse_PgPacketRead(	IN	PADAPTER	pAdapter,
+					IN	u8			offset,
+					IN	u8			*data,
+					IN	BOOLEAN		bPseudoTest)
+{
+	int	ret=0;
+
+	if(bPseudoTest)
+	{
+		ret = Hal_EfusePgPacketRead_Pseudo(pAdapter, offset, data, bPseudoTest);
+	}
+	else
+	{
+		ret = Hal_EfusePgPacketRead(pAdapter, offset, data, bPseudoTest);
+	}
+
+	return ret;
+}
+
+static BOOLEAN
+hal_EfuseFixHeaderProcess(
+	IN		PADAPTER			pAdapter,
+	IN		u8					efuseType,
+	IN		PPGPKT_STRUCT		pFixPkt,
+	IN		u16					*pAddr,
+	IN		BOOLEAN				bPseudoTest
+)
+{
+	u8	originaldata[8], badworden=0;
+	u16	efuse_addr=*pAddr;
+	u32	PgWriteSuccess=0;
+
+	_rtw_memset((PVOID)originaldata, 0xff, 8);
+
+	if(Efuse_PgPacketRead(pAdapter, pFixPkt->offset, originaldata, bPseudoTest))
+	{	//check if data exist
+		badworden = Efuse_WordEnableDataWrite(pAdapter, efuse_addr+1, pFixPkt->word_en, originaldata, bPseudoTest);
+
+		if(badworden != 0xf)	// write fail
+		{
+			if(efuseType == EFUSE_WIFI)
+				PgWriteSuccess = Efuse_PgPacketWrite(pAdapter, pFixPkt->offset, badworden, originaldata, bPseudoTest);
+			else
+				PgWriteSuccess = hal_EfusePgPacketWrite_BT(pAdapter, pFixPkt->offset, badworden, originaldata, bPseudoTest);
+			if(!PgWriteSuccess)
+				return _FALSE;
+			else
+				efuse_addr = Efuse_GetCurrentSize(pAdapter, efuseType, bPseudoTest);
+		}
+		else
+		{
+			efuse_addr = efuse_addr + (pFixPkt->word_cnts*2) +1;
+		}
+	}
+	else
+	{
+		efuse_addr = efuse_addr + (pFixPkt->word_cnts*2) +1;
+	}
+	*pAddr = efuse_addr;
+	return _TRUE;
+}
+
+static BOOLEAN
+hal_EfusePgPacketWrite2ByteHeader(
+	IN			PADAPTER		pAdapter,
+	IN			u8				efuseType,
+	IN			u16				*pAddr,
+	IN			PPGPKT_STRUCT	pTargetPkt,
+	IN			BOOLEAN			bPseudoTest)
+{
+	BOOLEAN		bRet=_FALSE, bContinual=_TRUE;
+	u16	efuse_addr=*pAddr, efuse_max_available_len=0;
+	u8	pg_header=0, tmp_header=0, pg_header_temp=0;
+	u8	repeatcnt=0;
+
+	//RTPRINT(FEEPROM, EFUSE_PG, ("Wirte 2byte header\n"));
+	EFUSE_GetEfuseDefinition(pAdapter, efuseType, TYPE_AVAILABLE_EFUSE_BYTES_BANK, (PVOID)&efuse_max_available_len, bPseudoTest);
+
+	while(efuse_addr < efuse_max_available_len)
+	{
+		pg_header = ((pTargetPkt->offset & 0x07) << 5) | 0x0F;
+		//RTPRINT(FEEPROM, EFUSE_PG, ("pg_header = 0x%x\n", pg_header));
+		efuse_OneByteWrite(pAdapter, efuse_addr, pg_header, bPseudoTest);
+		efuse_OneByteRead(pAdapter, efuse_addr, &tmp_header, bPseudoTest);
+
+		while(tmp_header == 0xFF)
+		{
+			if(repeatcnt++ > EFUSE_REPEAT_THRESHOLD_)
+			{
+				//RTPRINT(FEEPROM, EFUSE_PG, ("Repeat over limit for pg_header!!\n"));
+				return _FALSE;
+			}
+
+			efuse_OneByteWrite(pAdapter, efuse_addr, pg_header, bPseudoTest);
+			efuse_OneByteRead(pAdapter, efuse_addr, &tmp_header, bPseudoTest);
+		}
+
+		//to write ext_header
+		if(tmp_header == pg_header)
+		{
+			efuse_addr++;
+			pg_header_temp = pg_header;
+			pg_header = ((pTargetPkt->offset & 0x78) << 1) | pTargetPkt->word_en;
+
+			efuse_OneByteWrite(pAdapter, efuse_addr, pg_header, bPseudoTest);
+			efuse_OneByteRead(pAdapter, efuse_addr, &tmp_header, bPseudoTest);
+
+			while(tmp_header == 0xFF)
+			{
+				if(repeatcnt++ > EFUSE_REPEAT_THRESHOLD_)
+				{
+					//RTPRINT(FEEPROM, EFUSE_PG, ("Repeat over limit for ext_header!!\n"));
+					return _FALSE;
+				}
+
+				efuse_OneByteWrite(pAdapter, efuse_addr, pg_header, bPseudoTest);
+				efuse_OneByteRead(pAdapter, efuse_addr, &tmp_header, bPseudoTest);
+			}
+
+			if((tmp_header & 0x0F) == 0x0F)	//word_en PG fail
+			{
+				if(repeatcnt++ > EFUSE_REPEAT_THRESHOLD_)
+				{
+					//RTPRINT(FEEPROM, EFUSE_PG, ("Repeat over limit for word_en!!\n"));
+					return _FALSE;
+				}
+				else
+				{
+					efuse_addr++;
+					continue;
+				}
+			}
+			else if(pg_header != tmp_header)	//offset PG fail
+			{
+				PGPKT_STRUCT	fixPkt;
+				//RTPRINT(FEEPROM, EFUSE_PG, ("Error condition for offset PG fail, need to cover the existed data\n"));
+				fixPkt.offset = ((pg_header_temp & 0xE0) >> 5) | ((tmp_header & 0xF0) >> 1);
+				fixPkt.word_en = tmp_header & 0x0F;
+				fixPkt.word_cnts = Efuse_CalculateWordCnts(fixPkt.word_en);
+				if(!hal_EfuseFixHeaderProcess(pAdapter, efuseType, &fixPkt, &efuse_addr, bPseudoTest))
+					return _FALSE;
+			}
+			else
+			{
+				bRet = _TRUE;
+				break;
+			}
+		}
+		else if ((tmp_header & 0x1F) == 0x0F)		//wrong extended header
+		{
+			efuse_addr+=2;
+			continue;
+		}
+	}
+
+	*pAddr = efuse_addr;
+	return bRet;
+}
+
+static BOOLEAN
+hal_EfusePgPacketWrite1ByteHeader(
+	IN			PADAPTER		pAdapter,
+	IN			u8				efuseType,
+	IN			u16				*pAddr,
+	IN			PPGPKT_STRUCT	pTargetPkt,
+	IN			BOOLEAN			bPseudoTest)
+{
+	BOOLEAN		bRet=_FALSE;
+	u8	pg_header=0, tmp_header=0;
+	u16	efuse_addr=*pAddr;
+	u8	repeatcnt=0;
+
+	//RTPRINT(FEEPROM, EFUSE_PG, ("Wirte 1byte header\n"));
+	pg_header = ((pTargetPkt->offset << 4) & 0xf0) |pTargetPkt->word_en;
+
+	efuse_OneByteWrite(pAdapter, efuse_addr, pg_header, bPseudoTest);
+	efuse_OneByteRead(pAdapter, efuse_addr, &tmp_header, bPseudoTest);
+
+	while(tmp_header == 0xFF)
+	{
+		if(repeatcnt++ > EFUSE_REPEAT_THRESHOLD_)
+		{
+			return _FALSE;
+		}
+		efuse_OneByteWrite(pAdapter,efuse_addr, pg_header, bPseudoTest);
+		efuse_OneByteRead(pAdapter,efuse_addr, &tmp_header, bPseudoTest);
+	}
+
+	if(pg_header == tmp_header)
+	{
+		bRet = _TRUE;
+	}
+	else
+	{
+		PGPKT_STRUCT	fixPkt;
+		//RTPRINT(FEEPROM, EFUSE_PG, ("Error condition for fixed PG packet, need to cover the existed data\n"));
+		fixPkt.offset = (tmp_header>>4) & 0x0F;
+		fixPkt.word_en = tmp_header & 0x0F;
+		fixPkt.word_cnts = Efuse_CalculateWordCnts(fixPkt.word_en);
+		if(!hal_EfuseFixHeaderProcess(pAdapter, efuseType, &fixPkt, &efuse_addr, bPseudoTest))
+			return _FALSE;
+	}
+
+	*pAddr = efuse_addr;
+	return bRet;
+}
+
+static BOOLEAN
+hal_EfusePgPacketWriteData(
+	IN			PADAPTER		pAdapter,
+	IN			u8				efuseType,
+	IN			u16				*pAddr,
+	IN			PPGPKT_STRUCT	pTargetPkt,
+	IN			BOOLEAN			bPseudoTest)
+{
+	BOOLEAN	bRet=_FALSE;
+	u16	efuse_addr=*pAddr;
+	u8	badworden=0;
+	u32	PgWriteSuccess=0;
+
+	badworden = 0x0f;
+	badworden = Efuse_WordEnableDataWrite(pAdapter, efuse_addr+1, pTargetPkt->word_en, pTargetPkt->data, bPseudoTest);
+	if(badworden == 0x0F)
+	{
+		// write ok
+		//RTPRINT(FEEPROM, EFUSE_PG, ("hal_EfusePgPacketWriteData ok!!\n"));
+		return _TRUE;
+	}
+	else
+	{
+		//RTPRINT(FEEPROM, EFUSE_PG, ("hal_EfusePgPacketWriteData Fail!!\n"));
+		//reorganize other pg packet
+		if(efuseType == EFUSE_WIFI)
+			PgWriteSuccess = Efuse_PgPacketWrite(pAdapter, pTargetPkt->offset, badworden, pTargetPkt->data, bPseudoTest);
+		else
+			PgWriteSuccess = hal_EfusePgPacketWrite_BT(pAdapter, pTargetPkt->offset, badworden, pTargetPkt->data, bPseudoTest);
+		if(!PgWriteSuccess)
+			return _FALSE;
+		else
+			return _TRUE;
+	}
+
+	return bRet;
+}
+
+static BOOLEAN
+hal_EfusePgPacketWriteHeader(
+	IN			PADAPTER		pAdapter,
+	IN			u8				efuseType,
+	IN			u16				*pAddr,
+	IN			PPGPKT_STRUCT	pTargetPkt,
+	IN			BOOLEAN			bPseudoTest)
+{
+	BOOLEAN		bRet=_FALSE;
+
+	if(pTargetPkt->offset >= EFUSE_MAX_SECTION_BASE)
+	{
+		bRet = hal_EfusePgPacketWrite2ByteHeader(pAdapter, efuseType, pAddr, pTargetPkt, bPseudoTest);
+	}
+	else
+	{
+		bRet = hal_EfusePgPacketWrite1ByteHeader(pAdapter, efuseType, pAddr, pTargetPkt, bPseudoTest);
+	}
+
+	return bRet;
+}
+
+static BOOLEAN
+hal_EfusePgCheckAvailableAddr(
+	IN	PADAPTER	pAdapter,
+	IN	u8			efuseType,
+	IN	BOOLEAN		bPseudoTest
+	)
+{
+	u16	efuse_max_available_len=0;
+
+	EFUSE_GetEfuseDefinition(pAdapter, efuseType, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&efuse_max_available_len, bPseudoTest);
+	//RTPRINT(FEEPROM, EFUSE_PG, ("efuse_max_available_len = %d\n", efuse_max_available_len));
+
+	if(Efuse_GetCurrentSize(pAdapter, efuseType, bPseudoTest) >= efuse_max_available_len)
+	{
+		//RTPRINT(FEEPROM, EFUSE_PG, ("hal_EfusePgCheckAvailableAddr error!!\n"));
+		return _FALSE;
+	}
+	return _TRUE;
+}
+
+static VOID
+hal_EfuseConstructPGPkt(
+					IN	u8 				offset,
+					IN	u8				word_en,
+					IN	u8				*pData,
+					IN	PPGPKT_STRUCT	pTargetPkt
+
+)
+{
+	_rtw_memset((PVOID)pTargetPkt->data, 0xFF, sizeof(u8)*8);
+	pTargetPkt->offset = offset;
+	pTargetPkt->word_en= word_en;
+	efuse_WordEnableDataRead(word_en, pData, pTargetPkt->data);
+	pTargetPkt->word_cnts = Efuse_CalculateWordCnts(pTargetPkt->word_en);
+
+	//RTPRINT(FEEPROM, EFUSE_PG, ("hal_EfuseConstructPGPkt(), targetPkt, offset=%d, word_en=0x%x, word_cnts=%d\n", pTargetPkt->offset, pTargetPkt->word_en, pTargetPkt->word_cnts));
+}
+
+static BOOLEAN
+hal_EfuseCheckIfDatafollowed(
+	IN		PADAPTER		pAdapter,
+	IN		u8				word_cnts,
+	IN		u16				startAddr,
+	IN		BOOLEAN			bPseudoTest
+	)
+{
+	BOOLEAN		bRet=_FALSE;
+	u8	i, efuse_data;
+
+	for(i=0; i<(word_cnts*2) ; i++)
+	{
+		if(efuse_OneByteRead(pAdapter, (startAddr+i) ,&efuse_data, bPseudoTest)&&(efuse_data != 0xFF))
+			bRet = _TRUE;
+	}
+
+	return bRet;
+}
+
+static BOOLEAN
+wordEnMatched(
+	IN	PPGPKT_STRUCT	pTargetPkt,
+	IN	PPGPKT_STRUCT	pCurPkt,
+	IN	u8				*pWden
+)
+{
+	u8	match_word_en = 0x0F;	// default all words are disabled
+	u8	i;
+
+	// check if the same words are enabled both target and current PG packet
+	if( ((pTargetPkt->word_en & BIT0) == 0) &&
+		((pCurPkt->word_en & BIT0) == 0) )
+	{
+		match_word_en &= ~BIT0;				// enable word 0
+	}
+	if( ((pTargetPkt->word_en & BIT1) == 0) &&
+		((pCurPkt->word_en & BIT1) == 0) )
+	{
+		match_word_en &= ~BIT1;				// enable word 1
+	}
+	if( ((pTargetPkt->word_en & BIT2) == 0) &&
+		((pCurPkt->word_en & BIT2) == 0) )
+	{
+		match_word_en &= ~BIT2;				// enable word 2
+	}
+	if( ((pTargetPkt->word_en & BIT3) == 0) &&
+		((pCurPkt->word_en & BIT3) == 0) )
+	{
+		match_word_en &= ~BIT3;				// enable word 3
+	}
+
+	*pWden = match_word_en;
+
+	if(match_word_en != 0xf)
+		return _TRUE;
+	else
+		return _FALSE;
+}
+
+static BOOLEAN
+hal_EfusePartialWriteCheck(
+					IN	PADAPTER		pAdapter,
+					IN	u8				efuseType,
+					IN	u16				*pAddr,
+					IN	PPGPKT_STRUCT	pTargetPkt,
+					IN	BOOLEAN			bPseudoTest
+					)
+{
+	BOOLEAN		bRet=_FALSE;
+	u8	i, efuse_data=0, cur_header=0;
+	u8	new_wden=0, matched_wden=0, badworden=0;
+	u16	startAddr=0, efuse_max_available_len=0, efuse_max=0;
+	PGPKT_STRUCT	curPkt;
+
+	EFUSE_GetEfuseDefinition(pAdapter, efuseType, TYPE_AVAILABLE_EFUSE_BYTES_BANK, (PVOID)&efuse_max_available_len, bPseudoTest);
+	EFUSE_GetEfuseDefinition(pAdapter, efuseType, TYPE_EFUSE_REAL_CONTENT_LEN, (PVOID)&efuse_max, bPseudoTest);
+
+	if(efuseType == EFUSE_WIFI)
+	{
+		if(bPseudoTest)
+		{
+			startAddr = (u16)(fakeEfuseUsedBytes%EFUSE_REAL_CONTENT_LEN);
+		}
+		else
+		{
+			rtw_hal_get_hwreg(pAdapter, HW_VAR_EFUSE_BYTES, (u8 *)&startAddr);
+			startAddr%=EFUSE_REAL_CONTENT_LEN;
+		}
+	}
+	else
+	{
+		if(bPseudoTest)
+		{
+			startAddr = (u16)(fakeBTEfuseUsedBytes%EFUSE_REAL_CONTENT_LEN);
+		}
+		else
+		{
+			startAddr = (u16)(BTEfuseUsedBytes%EFUSE_REAL_CONTENT_LEN);
+		}
+	}
+	//RTPRINT(FEEPROM, EFUSE_PG, ("hal_EfusePartialWriteCheck(), startAddr=%d\n", startAddr));
+
+	while(1)
+	{
+		if(startAddr >= efuse_max_available_len)
+		{
+			bRet = _FALSE;
+			break;
+		}
+
+		if(efuse_OneByteRead(pAdapter, startAddr, &efuse_data, bPseudoTest) && (efuse_data!=0xFF))
+		{
+			if(EXT_HEADER(efuse_data))
+			{
+				cur_header = efuse_data;
+				startAddr++;
+				efuse_OneByteRead(pAdapter, startAddr, &efuse_data, bPseudoTest);
+				if(ALL_WORDS_DISABLED(efuse_data))
+				{
+					//RTPRINT(FEEPROM, EFUSE_PG, ("Error condition, all words disabled"));
+					bRet = _FALSE;
+					break;
+				}
+				else
+				{
+					curPkt.offset = ((cur_header & 0xE0) >> 5) | ((efuse_data & 0xF0) >> 1);
+					curPkt.word_en = efuse_data & 0x0F;
+				}
+			}
+			else
+			{
+				cur_header  =  efuse_data;
+				curPkt.offset = (cur_header>>4) & 0x0F;
+				curPkt.word_en = cur_header & 0x0F;
+			}
+
+			curPkt.word_cnts = Efuse_CalculateWordCnts(curPkt.word_en);
+			// if same header is found but no data followed
+			// write some part of data followed by the header.
+			if( (curPkt.offset == pTargetPkt->offset) &&
+				(!hal_EfuseCheckIfDatafollowed(pAdapter, curPkt.word_cnts, startAddr+1, bPseudoTest)) &&
+				wordEnMatched(pTargetPkt, &curPkt, &matched_wden) )
+			{
+				//RTPRINT(FEEPROM, EFUSE_PG, ("Need to partial write data by the previous wrote header\n"));
+				// Here to write partial data
+				badworden = Efuse_WordEnableDataWrite(pAdapter, startAddr+1, matched_wden, pTargetPkt->data, bPseudoTest);
+				if(badworden != 0x0F)
+				{
+					u32	PgWriteSuccess=0;
+					// if write fail on some words, write these bad words again
+					if(efuseType == EFUSE_WIFI)
+						PgWriteSuccess = Efuse_PgPacketWrite(pAdapter, pTargetPkt->offset, badworden, pTargetPkt->data, bPseudoTest);
+					else
+						PgWriteSuccess = hal_EfusePgPacketWrite_BT(pAdapter, pTargetPkt->offset, badworden, pTargetPkt->data, bPseudoTest);
+
+					if(!PgWriteSuccess)
+					{
+						bRet = _FALSE;	// write fail, return
+						break;
+					}
+				}
+				// partial write ok, update the target packet for later use
+				for(i=0; i<4; i++)
+				{
+					if((matched_wden & (0x1<<i)) == 0)	// this word has been written
+					{
+						pTargetPkt->word_en |= (0x1<<i);	// disable the word
+					}
+				}
+				pTargetPkt->word_cnts = Efuse_CalculateWordCnts(pTargetPkt->word_en);
+			}
+			// read from next header
+			startAddr = startAddr + (curPkt.word_cnts*2) +1;
+		}
+		else
+		{
+			// not used header, 0xff
+			*pAddr = startAddr;
+			//RTPRINT(FEEPROM, EFUSE_PG, ("Started from unused header offset=%d\n", startAddr));
+			bRet = _TRUE;
+			break;
+		}
+	}
+	return bRet;
+}
+
+static BOOLEAN
+hal_EfusePgPacketWrite_BT(
+					IN	PADAPTER	pAdapter,
+					IN	u8 			offset,
+					IN	u8			word_en,
+					IN	u8			*pData,
+					IN	BOOLEAN		bPseudoTest
+					)
+{
+	PGPKT_STRUCT 	targetPkt;
+	u16	startAddr=0;
+	u8	efuseType=EFUSE_BT;
+
+	if(!hal_EfusePgCheckAvailableAddr(pAdapter, efuseType, bPseudoTest))
+		return _FALSE;
+
+	hal_EfuseConstructPGPkt(offset, word_en, pData, &targetPkt);
+
+	if(!hal_EfusePartialWriteCheck(pAdapter, efuseType, &startAddr, &targetPkt, bPseudoTest))
+		return _FALSE;
+
+	if(!hal_EfusePgPacketWriteHeader(pAdapter, efuseType, &startAddr, &targetPkt, bPseudoTest))
+		return _FALSE;
+
+	if(!hal_EfusePgPacketWriteData(pAdapter, efuseType, &startAddr, &targetPkt, bPseudoTest))
+		return _FALSE;
+
+	return _TRUE;
+}
+
+static BOOLEAN
+hal_EfusePgPacketWrite_8723(
+					IN	PADAPTER		pAdapter,
+					IN	u8 			offset,
+					IN	u8			word_en,
+					IN	u8			*pData,
+					IN	BOOLEAN		bPseudoTest
+					)
+{
+	PGPKT_STRUCT 	targetPkt;
+	u16			startAddr=0;
+	u8			efuseType=EFUSE_WIFI;
+
+	if(!hal_EfusePgCheckAvailableAddr(pAdapter, efuseType, bPseudoTest))
+		return _FALSE;
+
+	hal_EfuseConstructPGPkt(offset, word_en, pData, &targetPkt);
+
+	if(!hal_EfusePartialWriteCheck(pAdapter, efuseType, &startAddr, &targetPkt, bPseudoTest))
+		return _FALSE;
+
+	if(!hal_EfusePgPacketWriteHeader(pAdapter, efuseType, &startAddr, &targetPkt, bPseudoTest))
+		return _FALSE;
+
+	if(!hal_EfusePgPacketWriteData(pAdapter, efuseType, &startAddr, &targetPkt, bPseudoTest))
+		return _FALSE;
+
+	return _TRUE;
+}
+
+static int
+hal_EfusePgPacketWrite_8192C(IN	PADAPTER	pAdapter,
+					IN	u8 			offset,
+					IN	u8			word_en,
+					IN	u8			*data,
+					IN	BOOLEAN		bPseudoTest)
+{
+	u8	WriteState = PG_STATE_HEADER;
+
+	int	bContinual = _TRUE,bDataEmpty=_TRUE, bResult = _TRUE;
+	u16	efuse_addr = 0;
+	u8	efuse_data;
+
+	u8	pg_header = 0;
+
+	u8	tmp_word_cnts=0,target_word_cnts=0;
+	u8	tmp_header,match_word_en,tmp_word_en;
+
+	PGPKT_STRUCT target_pkt;
+	PGPKT_STRUCT tmp_pkt;
+
+	u8	originaldata[sizeof(u8)*8];
+	u8	tmpindex = 0,badworden = 0x0F;
+
+	static int	repeat_times = 0;
+	u8	efuseType=EFUSE_WIFI;
+
+	//
+	// <Roger_Notes> Efuse has been pre-programmed dummy 5Bytes at the end of Efuse by CP.
+	// So we have to prevent unexpected data string connection, which will cause
+	// incorrect data auto-load from HW. The total size is equal or smaller than 498bytes
+	// (i.e., offset 0~497, and dummy 1bytes) expected after CP test.
+	// 2009.02.19.
+	//
+	if( Efuse_GetCurrentSize(pAdapter, efuseType, bPseudoTest) >= (EFUSE_REAL_CONTENT_LEN-EFUSE_OOB_PROTECT_BYTES))
+	{
+		//RTPRINT(FEEPROM, EFUSE_PG, ("hal_EfusePgPacketWrite_8192C(), over size\n"));
+		return _FALSE;
+	}
+
+	// Init the 8 bytes content as 0xff
+	target_pkt.offset = offset;
+	target_pkt.word_en= word_en;
+
+	_rtw_memset((PVOID)target_pkt.data, 0xFF, sizeof(u8)*8);
+
+	efuse_WordEnableDataRead(word_en,data,target_pkt.data);
+	target_word_cnts = Efuse_CalculateWordCnts(target_pkt.word_en);
+
+	//efuse_reg_ctrl(pAdapter,_TRUE);//power on
+	//RTPRINT(FEEPROM, EFUSE_PG, ("EFUSE Power ON\n"));
+
+	//
+	// <Roger_Notes> Efuse has been pre-programmed dummy 5Bytes at the end of Efuse by CP.
+	// So we have to prevent unexpected data string connection, which will cause
+	// incorrect data auto-load from HW. Dummy 1bytes is additional.
+	// 2009.02.19.
+	//
+	while( bContinual && (efuse_addr  < (EFUSE_REAL_CONTENT_LEN-EFUSE_OOB_PROTECT_BYTES)) )
+	{
+
+		if(WriteState==PG_STATE_HEADER)
+		{
+			bDataEmpty=_TRUE;
+			badworden = 0x0F;
+			//************  so *******************
+			//RTPRINT(FEEPROM, EFUSE_PG, ("EFUSE PG_STATE_HEADER\n"));
+			if (	efuse_OneByteRead(pAdapter, efuse_addr ,&efuse_data, bPseudoTest) &&
+				(efuse_data!=0xFF))
+			{
+				tmp_header  =  efuse_data;
+
+				tmp_pkt.offset 	= (tmp_header>>4) & 0x0F;
+				tmp_pkt.word_en 	= tmp_header & 0x0F;
+				tmp_word_cnts =  Efuse_CalculateWordCnts(tmp_pkt.word_en);
+
+				//************  so-1 *******************
+				if(tmp_pkt.offset  != target_pkt.offset)
+				{
+					efuse_addr = efuse_addr + (tmp_word_cnts*2) +1; //Next pg_packet
+					#if (EFUSE_ERROE_HANDLE == 1)
+					WriteState = PG_STATE_HEADER;
+					#endif
+				}
+				else
+				{
+					//************  so-2 *******************
+					for(tmpindex=0 ; tmpindex<(tmp_word_cnts*2) ; tmpindex++)
+					{
+						if(efuse_OneByteRead(pAdapter, (efuse_addr+1+tmpindex) ,&efuse_data, bPseudoTest)&&(efuse_data != 0xFF)){
+							bDataEmpty = _FALSE;
+						}
+					}
+					//************  so-2-1 *******************
+					if(bDataEmpty == _FALSE)
+					{
+						efuse_addr = efuse_addr + (tmp_word_cnts*2) +1; //Next pg_packet
+						#if (EFUSE_ERROE_HANDLE == 1)
+						WriteState=PG_STATE_HEADER;
+						#endif
+					}
+					else
+					{//************  so-2-2 *******************
+						match_word_en = 0x0F;
+						if(   !( (target_pkt.word_en&BIT0)|(tmp_pkt.word_en&BIT0)  ))
+						{
+							 match_word_en &= (~BIT0);
+						}
+						if(   !( (target_pkt.word_en&BIT1)|(tmp_pkt.word_en&BIT1)  ))
+						{
+							 match_word_en &= (~BIT1);
+						}
+						if(   !( (target_pkt.word_en&BIT2)|(tmp_pkt.word_en&BIT2)  ))
+						{
+							 match_word_en &= (~BIT2);
+						}
+						if(   !( (target_pkt.word_en&BIT3)|(tmp_pkt.word_en&BIT3)  ))
+						{
+							 match_word_en &= (~BIT3);
+						}
+
+						//************  so-2-2-A *******************
+						if((match_word_en&0x0F)!=0x0F)
+						{
+							badworden = Efuse_WordEnableDataWrite(pAdapter,efuse_addr+1, tmp_pkt.word_en ,target_pkt.data, bPseudoTest);
+
+							//************  so-2-2-A-1 *******************
+							//############################
+							if(0x0F != (badworden&0x0F))
+							{
+								u8	reorg_offset = offset;
+								u8	reorg_worden=badworden;
+								Efuse_PgPacketWrite(pAdapter,reorg_offset,reorg_worden,originaldata, bPseudoTest);
+							}
+							//############################
+
+							tmp_word_en = 0x0F;
+							if(  (target_pkt.word_en&BIT0)^(match_word_en&BIT0)  )
+							{
+								tmp_word_en &= (~BIT0);
+							}
+							if(   (target_pkt.word_en&BIT1)^(match_word_en&BIT1) )
+							{
+								tmp_word_en &=  (~BIT1);
+							}
+							if(   (target_pkt.word_en&BIT2)^(match_word_en&BIT2) )
+							{
+								tmp_word_en &= (~BIT2);
+							}
+							if(   (target_pkt.word_en&BIT3)^(match_word_en&BIT3) )
+							{
+								tmp_word_en &=(~BIT3);
+							}
+
+							//************  so-2-2-A-2 *******************
+							if((tmp_word_en&0x0F)!=0x0F){
+								//reorganize other pg packet
+								//efuse_addr = efuse_addr + (2*tmp_word_cnts) +1;//next pg packet addr
+								efuse_addr = Efuse_GetCurrentSize(pAdapter, efuseType, bPseudoTest);
+								//===========================
+								target_pkt.offset = offset;
+								target_pkt.word_en= tmp_word_en;
+								//===========================
+							}else{
+								bContinual = _FALSE;
+							}
+							#if (EFUSE_ERROE_HANDLE == 1)
+							WriteState=PG_STATE_HEADER;
+							repeat_times++;
+							if(repeat_times>EFUSE_REPEAT_THRESHOLD_){
+								bContinual = _FALSE;
+								bResult = _FALSE;
+							}
+							#endif
+						}
+						else{//************  so-2-2-B *******************
+							//reorganize other pg packet
+							efuse_addr = efuse_addr + (2*tmp_word_cnts) +1;//next pg packet addr
+							//===========================
+							target_pkt.offset = offset;
+							target_pkt.word_en= target_pkt.word_en;
+							//===========================
+							#if (EFUSE_ERROE_HANDLE == 1)
+							WriteState=PG_STATE_HEADER;
+							#endif
+						}
+					}
+				}
+				//RTPRINT(FEEPROM, EFUSE_PG, ("EFUSE PG_STATE_HEADER-1\n"));
+			}
+			else		//************  s1: header == oxff  *******************
+			{
+				pg_header = ((target_pkt.offset << 4)&0xf0) |target_pkt.word_en;
+
+				efuse_OneByteWrite(pAdapter,efuse_addr, pg_header, bPseudoTest);
+				efuse_OneByteRead(pAdapter,efuse_addr, &tmp_header, bPseudoTest);
+
+				if(tmp_header == pg_header)
+				{ //************  s1-1*******************
+					WriteState = PG_STATE_DATA;
+				}
+				#if (EFUSE_ERROE_HANDLE == 1)
+				else if(tmp_header == 0xFF){//************  s1-3: if Write or read func doesn't work *******************
+					//efuse_addr doesn't change
+					WriteState = PG_STATE_HEADER;
+					repeat_times++;
+					if(repeat_times>EFUSE_REPEAT_THRESHOLD_){
+						bContinual = _FALSE;
+						bResult = _FALSE;
+					}
+				}
+				#endif
+				else
+				{//************  s1-2 : fixed the header procedure *******************
+					tmp_pkt.offset = (tmp_header>>4) & 0x0F;
+					tmp_pkt.word_en=  tmp_header & 0x0F;
+					tmp_word_cnts =  Efuse_CalculateWordCnts(tmp_pkt.word_en);
+
+					//************  s1-2-A :cover the exist data *******************
+					//memset(originaldata,0xff,sizeof(UINT8)*8);
+					_rtw_memset((PVOID)originaldata, 0xff, sizeof(u8)*8);
+
+					if(Efuse_PgPacketRead( pAdapter, tmp_pkt.offset,originaldata, bPseudoTest))
+					{	//check if data exist
+						//efuse_reg_ctrl(pAdapter,_TRUE);//power on
+						badworden = Efuse_WordEnableDataWrite(pAdapter,efuse_addr+1,tmp_pkt.word_en,originaldata, bPseudoTest);
+						//############################
+						if(0x0F != (badworden&0x0F))
+						{
+							u8	reorg_offset = tmp_pkt.offset;
+							u8	reorg_worden=badworden;
+							Efuse_PgPacketWrite(pAdapter,reorg_offset,reorg_worden,originaldata, bPseudoTest);
+							efuse_addr = Efuse_GetCurrentSize(pAdapter, efuseType, bPseudoTest);
+						}
+						//############################
+						else{
+							efuse_addr = efuse_addr + (tmp_word_cnts*2) +1; //Next pg_packet
+						}
+					}
+					 //************  s1-2-B: wrong address*******************
+					else
+					{
+						efuse_addr = efuse_addr + (tmp_word_cnts*2) +1; //Next pg_packet
+					}
+
+					#if (EFUSE_ERROE_HANDLE == 1)
+					WriteState=PG_STATE_HEADER;
+					repeat_times++;
+					if(repeat_times>EFUSE_REPEAT_THRESHOLD_){
+						bContinual = _FALSE;
+						bResult = _FALSE;
+					}
+					#endif
+
+					//RTPRINT(FEEPROM, EFUSE_PG, ("EFUSE PG_STATE_HEADER-2\n"));
+				}
+
+			}
+
+		}
+		//write data state
+		else if(WriteState==PG_STATE_DATA)
+		{	//************  s1-1  *******************
+			//RTPRINT(FEEPROM, EFUSE_PG, ("EFUSE PG_STATE_DATA\n"));
+			badworden = 0x0f;
+			badworden = Efuse_WordEnableDataWrite(pAdapter,efuse_addr+1,target_pkt.word_en,target_pkt.data, bPseudoTest);
+			if((badworden&0x0F)==0x0F)
+			{ //************  s1-1-A *******************
+				bContinual = _FALSE;
+			}
+			else
+			{//reorganize other pg packet //************  s1-1-B *******************
+				efuse_addr = efuse_addr + (2*target_word_cnts) +1;//next pg packet addr
+
+				//===========================
+				target_pkt.offset = offset;
+				target_pkt.word_en= badworden;
+				target_word_cnts =  Efuse_CalculateWordCnts(target_pkt.word_en);
+				//===========================
+				#if (EFUSE_ERROE_HANDLE == 1)
+				WriteState=PG_STATE_HEADER;
+				repeat_times++;
+				if(repeat_times>EFUSE_REPEAT_THRESHOLD_){
+					bContinual = _FALSE;
+					bResult = _FALSE;
+				}
+				#endif
+				//RTPRINT(FEEPROM, EFUSE_PG, ("EFUSE PG_STATE_HEADER-3\n"));
+			}
+		}
+	}
+
+	if(efuse_addr  >= (EFUSE_REAL_CONTENT_LEN-EFUSE_OOB_PROTECT_BYTES))
+	{
+		//RT_TRACE(COMP_EFUSE, DBG_LOUD, ("hal_EfusePgPacketWrite_8192C(): efuse_addr(%#x) Out of size!!\n", efuse_addr));
+	}
+	//efuse_reg_ctrl(pAdapter,_FALSE);//power off
+
+	return _TRUE;
+}
+
+static int
+Hal_EfusePgPacketWrite_Pseudo(IN	PADAPTER	pAdapter,
+					IN	u8 			offset,
+					IN	u8			word_en,
+					IN	u8			*data,
+					IN	BOOLEAN		bPseudoTest)
+{
+	int ret;
+
+	ret = hal_EfusePgPacketWrite_8723(pAdapter, offset, word_en, data, bPseudoTest);
+
+	return ret;
+}
+
+static int
+Hal_EfusePgPacketWrite(IN	PADAPTER	pAdapter,
+					IN	u8 			offset,
+					IN	u8			word_en,
+					IN	u8			*data,
+					IN	BOOLEAN		bPseudoTest)
+{
+	int	ret=0;
+
+	if(IS_HARDWARE_TYPE_8192C(pAdapter))
+	{
+		ret = hal_EfusePgPacketWrite_8192C(pAdapter, offset, word_en, data, bPseudoTest);
+	}
+	else if(IS_HARDWARE_TYPE_8723A(pAdapter))
+	{
+		ret = hal_EfusePgPacketWrite_8723(pAdapter, offset, word_en, data, bPseudoTest);
+	}
+
+	return ret;
+}
+
+static int
+rtl8192c_Efuse_PgPacketWrite(IN	PADAPTER	pAdapter,
+					IN	u8 			offset,
+					IN	u8			word_en,
+					IN	u8			*data,
+					IN	BOOLEAN		bPseudoTest)
+{
+	int	ret;
+
+	if(bPseudoTest)
+	{
+		ret = Hal_EfusePgPacketWrite_Pseudo(pAdapter, offset, word_en, data, bPseudoTest);
+	}
+	else
+	{
+		ret = Hal_EfusePgPacketWrite(pAdapter, offset, word_en, data, bPseudoTest);
+	}
+	return ret;
+}
+
+VOID
+rtl8192c_EfuseParseIDCode(
+	IN	PADAPTER	pAdapter,
+	IN	u8			*hwinfo
+	)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(pAdapter);
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	u16			i,EEPROMId;
+
+	// Checl 0x8129 again for making sure autoload status!!
+	EEPROMId = *((u16 *)&hwinfo[0]);
+	if( le16_to_cpu(EEPROMId) != RTL_EEPROM_ID)
+	{
+		DBG_8192C("EEPROM ID(%#x) is invalid!!\n", EEPROMId);
+		pEEPROM->bautoload_fail_flag = _TRUE;
+	}
+	else
+	{
+		pEEPROM->bautoload_fail_flag = _FALSE;
+	}
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("EEPROM ID = 0x%4x\n", EEPROMId));
+}
+
+void rtl8192c_read_chip_version(PADAPTER	pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(pAdapter);
+	pHalData->VersionID = rtl8192c_ReadChipVersion(pAdapter);
+}
+
+void hal_notch_filter_8192c(_adapter *adapter, bool enable)
+{
+	if (enable) {
+		DBG_871X("Enable notch filter\n");
+		rtw_write8(adapter, rOFDM0_RxDSP+1, rtw_read8(adapter, rOFDM0_RxDSP+1) | BIT1);
+	} else {
+		DBG_871X("Disable notch filter\n");
+		rtw_write8(adapter, rOFDM0_RxDSP+1, rtw_read8(adapter, rOFDM0_RxDSP+1) & ~BIT1);
+	}
+}
+
+void hal_reset_security_engine_8192c(_adapter * adapter)
+{
+	rtw_write8(adapter, 0x522, 0xFF);
+	rtw_write8(adapter, 0x21, 0x35);
+	rtw_usleep_os(300);
+	rtw_write8(adapter, 0x101, rtw_read8(adapter,0x101)&~0x02);
+	rtw_write8(adapter, 0x101, rtw_read8(adapter,0x101)|0x02);
+	rtw_write8(adapter, 0x21, 0x55);
+	rtw_write8(adapter, 0x522, 0x00);
+}
+
+s32 c2h_id_filter_ccx_8192c(u8 id)
+{
+	s32 ret = _FALSE;
+	if (id == C2H_CCX_TX_RPT)
+		ret = _TRUE;
+
+	return ret;
+}
+
+static s32 c2h_handler_8192c(_adapter *padapter, struct c2h_evt_hdr *c2h_evt)
+{
+	s32 ret = _SUCCESS;
+	u8 i = 0;
+
+	if (c2h_evt == NULL) {
+		DBG_8192C("%s c2h_evt is NULL\n",__FUNCTION__);
+		ret = _FAIL;
+		goto exit;
+	}
+
+	switch (c2h_evt->id) {
+	case C2H_CCX_TX_RPT:
+		handle_txrpt_ccx_8192c(padapter, c2h_evt->payload);
+		break;
+	default:
+		ret = _FAIL;
+		break;
+	}
+
+exit:
+	return ret;
+}
+
+void rtl8192c_set_hal_ops(struct hal_ops *pHalFunc)
+{
+	pHalFunc->free_hal_data = &rtl8192c_free_hal_data;
+
+	pHalFunc->dm_init = &rtl8192c_init_dm_priv;
+	pHalFunc->dm_deinit = &rtl8192c_deinit_dm_priv;
+	pHalFunc->read_chip_version = &rtl8192c_read_chip_version;
+
+	pHalFunc->set_bwmode_handler = &PHY_SetBWMode8192C;
+	pHalFunc->set_channel_handler = &PHY_SwChnl8192C;
+
+	pHalFunc->hal_dm_watchdog = &rtl8192c_HalDmWatchDog;
+
+	pHalFunc->Add_RateATid = &rtl8192c_Add_RateATid;
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+	pHalFunc->AntDivBeforeLinkHandler = &SwAntDivBeforeLink8192C;
+	pHalFunc->AntDivCompareHandler = &SwAntDivCompare8192C;
+#endif
+
+	pHalFunc->read_bbreg = &rtl8192c_PHY_QueryBBReg;
+	pHalFunc->write_bbreg = &rtl8192c_PHY_SetBBReg;
+	pHalFunc->read_rfreg = &rtl8192c_PHY_QueryRFReg;
+	pHalFunc->write_rfreg = &rtl8192c_PHY_SetRFReg;
+
+	//Efuse related function
+	pHalFunc->EfusePowerSwitch = &rtl8192c_EfusePowerSwitch;
+	pHalFunc->ReadEFuse = &rtl8192c_ReadEFuse;
+	pHalFunc->EFUSEGetEfuseDefinition = &rtl8192c_EFUSE_GetEfuseDefinition;
+	pHalFunc->EfuseGetCurrentSize = &rtl8192c_EfuseGetCurrentSize;
+	pHalFunc->Efuse_PgPacketRead = &rtl8192c_Efuse_PgPacketRead;
+	pHalFunc->Efuse_PgPacketWrite = &rtl8192c_Efuse_PgPacketWrite;
+	pHalFunc->Efuse_WordEnableDataWrite = &rtl8192c_Efuse_WordEnableDataWrite;
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+	pHalFunc->sreset_init_value = &sreset_init_value;
+	pHalFunc->sreset_reset_value = &sreset_reset_value;
+	pHalFunc->silentreset = &sreset_reset;
+	pHalFunc->sreset_xmit_status_check = &rtl8192c_sreset_xmit_status_check;
+	pHalFunc->sreset_linked_status_check  = &rtl8192c_sreset_linked_status_check;
+	pHalFunc->sreset_get_wifi_status  = &sreset_get_wifi_status;
+	pHalFunc->sreset_inprogress= &sreset_inprogress;
+#endif
+
+#ifdef CONFIG_IOL
+	pHalFunc->IOL_exec_cmds_sync = &rtl8192c_IOL_exec_cmds_sync;
+#endif
+	pHalFunc->hal_notch_filter = &hal_notch_filter_8192c;
+	pHalFunc->hal_reset_security_engine = hal_reset_security_engine_8192c;
+
+	pHalFunc->c2h_handler = c2h_handler_8192c;
+	pHalFunc->c2h_id_filter_ccx = c2h_id_filter_ccx_8192c;
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_mp.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_mp.c
new file mode 100644
index 000000000000..4d574d335c41
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_mp.c
@@ -0,0 +1,1207 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTL8192C_MP_C_
+#ifdef CONFIG_MP_INCLUDED
+
+#include <drv_types.h>
+#include <rtw_mp.h>
+
+#ifdef CONFIG_RTL8192C
+#include <rtl8192c_hal.h>
+#endif
+
+
+
+s32 Hal_SetPowerTracking(PADAPTER padapter, u8 enable)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+
+	if (!netif_running(padapter->pnetdev)) {
+		RT_TRACE(_module_mp_, _drv_warning_, ("SetPowerTracking! Fail: interface not opened!\n"));
+		return _FAIL;
+	}
+
+	if (check_fwstate(&padapter->mlmepriv, WIFI_MP_STATE) == _FALSE) {
+		RT_TRACE(_module_mp_, _drv_warning_, ("SetPowerTracking! Fail: not in MP mode!\n"));
+		return _FAIL;
+	}
+
+	if (enable)
+		pdmpriv->TxPowerTrackControl = _TRUE;
+	else
+		pdmpriv->TxPowerTrackControl = _FALSE;
+
+	return _SUCCESS;
+}
+
+void Hal_GetPowerTracking(PADAPTER padapter, u8 *enable)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+
+	*enable = pdmpriv->TxPowerTrackControl;
+}
+
+static void Hal_disable_dm(PADAPTER padapter)
+{
+	u8 v8;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+
+	//3 1. disable firmware dynamic mechanism
+	// disable Power Training, Rate Adaptive
+	v8 = rtw_read8(padapter, REG_BCN_CTRL);
+	v8 &= ~EN_BCN_FUNCTION;
+	rtw_write8(padapter, REG_BCN_CTRL, v8);
+
+	//3 2. disable driver dynamic mechanism
+	// disable Dynamic Initial Gain
+	// disable High Power
+	// disable Power Tracking
+	Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, _FALSE);
+
+	// enable APK, LCK and IQK but disable power tracking
+	pdmpriv->TxPowerTrackControl = _FALSE;
+	Switch_DM_Func(padapter, DYNAMIC_FUNC_SS, _TRUE);
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	mpt_SwitchRfSetting
+ *
+ * Overview:	Change RF Setting when we siwthc channel/rate/BW for MP.
+ *
+ * Input:       IN	PADAPTER				pAdapter
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 01/08/2009	MHC		Suggestion from SD3 Willis for 92S series.
+ * 01/09/2009	MHC		Add CCK modification for 40MHZ. Suggestion from SD3.
+ *
+ *---------------------------------------------------------------------------*/
+void Hal_mpt_SwitchRfSetting(PADAPTER pAdapter)
+{
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter);
+	struct mp_priv *pmp = &pAdapter->mppriv;
+	u8 ChannelToSw = pmp->channel, eRFPath = RF_PATH_A;
+	u8 ulRateIdx = pmp->rateidx;
+	u8 ulbandwidth = pmp->bandwidth;
+	PMPT_CONTEXT	pMptCtx = &(pAdapter->mppriv.MptCtx);
+    BOOLEAN             bInteralPA = _FALSE;
+    u32				value = 0;
+
+#ifdef CONFIG_USB_HCI
+	if (IS_92C_SERIAL(pHalData->VersionID))
+	{
+		//92CE-VAU (92cu mCard)
+		if( BOARD_MINICARD == pHalData->BoardType)
+		{
+			if (ulRateIdx < MPT_RATE_6M)					// CCK rate
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x0F400);
+			}
+			else 											//OFDM~MCS rate
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x4F000);
+			}
+		}
+		else	//92CU dongle
+		{
+			if (ulRateIdx < MPT_RATE_6M)	// CCK rate
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x0F400);
+			}
+			else if (ChannelToSw & BIT0)	// OFDM rate, odd number channel
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x4F200);
+			}
+			else if (ChannelToSw == 4)	// OFDM rate, even number channel
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x28200);
+				write_rfreg(pAdapter, 0, RF_SYN_G6, 0xe0004);
+				write_rfreg(pAdapter, 0, RF_SYN_G7, 0x709);
+				rtw_msleep_os(1);
+				write_rfreg(pAdapter, 0, RF_SYN_G7, 0x4B333);
+			}
+			else if(ChannelToSw == 10)	// OFDM rate, even number channel
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x28000);
+				write_rfreg(pAdapter, 0, RF_SYN_G6, 0xe000A);
+				write_rfreg(pAdapter, 0, RF_SYN_G7, 0x709);
+				rtw_msleep_os(1);
+				write_rfreg(pAdapter, 0, RF_SYN_G7, 0x7B333);
+			}
+			else if(ChannelToSw == 12)	// OFDM rate, even number channel
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x28200);
+				write_rfreg(pAdapter, 0, RF_SYN_G6, 0xe000C);
+				write_rfreg(pAdapter, 0, RF_SYN_G7, 0x50B);
+				rtw_msleep_os(1);
+				write_rfreg(pAdapter, 0, RF_SYN_G7, 0x4B333);
+			}
+			else
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x4F200);
+			}
+		}
+	}
+	else	//88cu
+	{
+
+		//mcard interface
+
+		if( BOARD_MINICARD == pHalData->BoardType)
+		{
+			if (ulRateIdx < MPT_RATE_6M)	// CCK rate
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x0F400);
+			}
+			else 	//OFDM~MCS rate
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x4F200);
+			}
+
+			if(ChannelToSw == 6 || ChannelToSw == 8)
+			{
+				write_bbreg(pAdapter, rOFDM0_XAAGCCore1, bMaskByte0, 0x22);
+				write_bbreg(pAdapter, rOFDM0_XBAGCCore1, bMaskByte0, 0x22);
+				write_bbreg(pAdapter, rOFDM0_RxDetector1, bMaskByte0, 0x4F);
+			}
+			else
+			{
+				write_bbreg(pAdapter, rOFDM0_XAAGCCore1, bMaskByte0, 0x20);
+				write_bbreg(pAdapter, rOFDM0_XBAGCCore1, bMaskByte0, 0x20);
+				write_bbreg(pAdapter, rOFDM0_RxDetector1, bMaskByte0, pMptCtx->backup0xc30);
+			}
+		}
+		else
+		{
+			if (ulRateIdx < MPT_RATE_6M)	// CCK rate
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x0F400);
+			}
+			else if (ChannelToSw & BIT0)	// OFDM rate, odd number channel
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x4F200);
+			}
+			else
+			{
+				write_rfreg(pAdapter, 0, RF_SYN_G2, 0x4F000);
+			}
+		}
+	}
+
+#else	//PCI_INTERFACE
+
+	if (ulRateIdx < MPT_RATE_6M)	// CCK rate
+	{
+		write_rfreg(pAdapter, 0, RF_SYN_G2, 0x0F400);
+	}
+	else	//OFDM~MCS rate
+	{
+		write_rfreg(pAdapter, 0, RF_SYN_G2, 0x4F000);
+	}
+	//88CE
+	if(!IS_92C_SERIAL(pHalData->VersionID))
+	{
+		if(ChannelToSw == 6 || ChannelToSw == 8)
+		{
+			write_bbreg(pAdapter, rOFDM0_XAAGCCore1, bMaskByte0, 0x22);
+			write_bbreg(pAdapter, rOFDM0_XBAGCCore1, bMaskByte0, 0x22);
+			write_bbreg(pAdapter, rOFDM0_RxDetector1, bMaskByte0, 0x4F);
+		}
+		else
+		{
+			write_bbreg(pAdapter, rOFDM0_XAAGCCore1, bMaskByte0, pMptCtx->backup0xc50);
+			write_bbreg(pAdapter, rOFDM0_XBAGCCore1, bMaskByte0, pMptCtx->backup0xc58);
+			write_bbreg(pAdapter, rOFDM0_RxDetector1, bMaskByte0, pMptCtx->backup0xc30);
+		}
+	 }
+
+#endif //CONFIG_USB_HCI
+
+
+}
+/*---------------------------hal\rtl8192c\MPT_Phy.c---------------------------*/
+
+/*---------------------------hal\rtl8192c\MPT_HelperFunc.c---------------------------*/
+void Hal_MPT_CCKTxPowerAdjust(PADAPTER Adapter, BOOLEAN bInCH14)
+{
+	u32		TempVal = 0, TempVal2 = 0, TempVal3 = 0;
+	u32		CurrCCKSwingVal = 0, CCKSwingIndex = 12;
+	u8		i;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+
+	// get current cck swing value and check 0xa22 & 0xa23 later to match the table.
+	CurrCCKSwingVal = read_bbreg(Adapter, rCCK0_TxFilter1, bMaskHWord);
+
+	if (!bInCH14)
+	{
+		// Readback the current bb cck swing value and compare with the table to
+		// get the current swing index
+		for (i = 0; i < CCK_TABLE_SIZE; i++)
+		{
+			if (((CurrCCKSwingVal&0xff) == (u32)CCKSwingTable_Ch1_Ch13[i][0]) &&
+				(((CurrCCKSwingVal&0xff00)>>8) == (u32)CCKSwingTable_Ch1_Ch13[i][1]))
+			{
+				CCKSwingIndex = i;
+//				RT_TRACE(COMP_INIT, DBG_LOUD,("Ch1~13, Current reg0x%x = 0x%lx, CCKSwingIndex=0x%x\n",
+//					(rCCK0_TxFilter1+2), CurrCCKSwingVal, CCKSwingIndex));
+				break;
+			}
+		}
+
+		//Write 0xa22 0xa23
+		TempVal = CCKSwingTable_Ch1_Ch13[CCKSwingIndex][0] +
+				(CCKSwingTable_Ch1_Ch13[CCKSwingIndex][1]<<8) ;
+
+
+		//Write 0xa24 ~ 0xa27
+		TempVal2 = 0;
+		TempVal2 = CCKSwingTable_Ch1_Ch13[CCKSwingIndex][2] +
+				(CCKSwingTable_Ch1_Ch13[CCKSwingIndex][3]<<8) +
+				(CCKSwingTable_Ch1_Ch13[CCKSwingIndex][4]<<16 )+
+				(CCKSwingTable_Ch1_Ch13[CCKSwingIndex][5]<<24);
+
+		//Write 0xa28  0xa29
+		TempVal3 = 0;
+		TempVal3 = CCKSwingTable_Ch1_Ch13[CCKSwingIndex][6] +
+				(CCKSwingTable_Ch1_Ch13[CCKSwingIndex][7]<<8) ;
+	}
+	else
+	{
+		for (i = 0; i < CCK_TABLE_SIZE; i++)
+		{
+			if (((CurrCCKSwingVal&0xff) == (u32)CCKSwingTable_Ch14[i][0]) &&
+				(((CurrCCKSwingVal&0xff00)>>8) == (u32)CCKSwingTable_Ch14[i][1]))
+			{
+				CCKSwingIndex = i;
+//				RT_TRACE(COMP_INIT, DBG_LOUD,("Ch14, Current reg0x%x = 0x%lx, CCKSwingIndex=0x%x\n",
+//					(rCCK0_TxFilter1+2), CurrCCKSwingVal, CCKSwingIndex));
+				break;
+			}
+		}
+
+		//Write 0xa22 0xa23
+		TempVal = CCKSwingTable_Ch14[CCKSwingIndex][0] +
+				(CCKSwingTable_Ch14[CCKSwingIndex][1]<<8) ;
+
+		//Write 0xa24 ~ 0xa27
+		TempVal2 = 0;
+		TempVal2 = CCKSwingTable_Ch14[CCKSwingIndex][2] +
+				(CCKSwingTable_Ch14[CCKSwingIndex][3]<<8) +
+				(CCKSwingTable_Ch14[CCKSwingIndex][4]<<16 )+
+				(CCKSwingTable_Ch14[CCKSwingIndex][5]<<24);
+
+		//Write 0xa28  0xa29
+		TempVal3 = 0;
+		TempVal3 = CCKSwingTable_Ch14[CCKSwingIndex][6] +
+				(CCKSwingTable_Ch14[CCKSwingIndex][7]<<8) ;
+	}
+
+	write_bbreg(Adapter, rCCK0_TxFilter1, bMaskHWord, TempVal);
+	write_bbreg(Adapter, rCCK0_TxFilter2, bMaskDWord, TempVal2);
+	write_bbreg(Adapter, rCCK0_DebugPort, bMaskLWord, TempVal3);
+}
+
+void Hal_MPT_CCKTxPowerAdjustbyIndex(PADAPTER pAdapter, BOOLEAN beven)
+{
+	s32		TempCCk;
+	u8		CCK_index, CCK_index_old;
+	u8		Action = 0;	//0: no action, 1: even->odd, 2:odd->even
+	u8		TimeOut = 100;
+	s32		i = 0;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	PMPT_CONTEXT	pMptCtx = &pAdapter->mppriv.MptCtx;
+
+
+	if (!IS_92C_SERIAL(pHalData->VersionID))
+		return;
+#if 0
+	while(PlatformAtomicExchange(&Adapter->IntrCCKRefCount, TRUE) == TRUE)
+	{
+		PlatformSleepUs(100);
+		TimeOut--;
+		if(TimeOut <= 0)
+		{
+			RTPRINT(FINIT, INIT_TxPower,
+			 ("!!!MPT_CCKTxPowerAdjustbyIndex Wait for check CCK gain index too long!!!\n" ));
+			break;
+		}
+	}
+#endif
+	if (beven && !pMptCtx->bMptIndexEven)	//odd->even
+	{
+		Action = 2;
+		pMptCtx->bMptIndexEven = _TRUE;
+	}
+	else if (!beven && pMptCtx->bMptIndexEven)	//even->odd
+	{
+		Action = 1;
+		pMptCtx->bMptIndexEven = _FALSE;
+	}
+
+	if (Action != 0)
+	{
+		//Query CCK default setting From 0xa24
+		TempCCk = read_bbreg(pAdapter, rCCK0_TxFilter2, bMaskDWord) & bMaskCCK;
+		for (i = 0; i < CCK_TABLE_SIZE; i++)
+		{
+			if (pHalData->dmpriv.bCCKinCH14)
+			{
+				if (_rtw_memcmp((void*)&TempCCk, (void*)&CCKSwingTable_Ch14[i][2], 4) == _TRUE)
+				{
+					CCK_index_old = (u8) i;
+//					RTPRINT(FINIT, INIT_TxPower,("MPT_CCKTxPowerAdjustbyIndex: Initial reg0x%x = 0x%lx, CCK_index=0x%x, ch 14 %d\n",
+//						rCCK0_TxFilter2, TempCCk, CCK_index_old, pHalData->bCCKinCH14));
+					break;
+				}
+			}
+			else
+			{
+				if (_rtw_memcmp((void*)&TempCCk, (void*)&CCKSwingTable_Ch1_Ch13[i][2], 4) == _TRUE)
+				{
+					CCK_index_old = (u8) i;
+//					RTPRINT(FINIT, INIT_TxPower,("MPT_CCKTxPowerAdjustbyIndex: Initial reg0x%x = 0x%lx, CCK_index=0x%x, ch14 %d\n",
+//						rCCK0_TxFilter2, TempCCk, CCK_index_old, pHalData->bCCKinCH14));
+					break;
+				}
+			}
+		}
+
+		if (Action == 1)
+			CCK_index = CCK_index_old - 1;
+		else
+			CCK_index = CCK_index_old + 1;
+
+//		RTPRINT(FINIT, INIT_TxPower,("MPT_CCKTxPowerAdjustbyIndex: new CCK_index=0x%x\n",
+//			 CCK_index));
+
+		//Adjust CCK according to gain index
+		if (!pHalData->dmpriv.bCCKinCH14) {
+			rtw_write8(pAdapter, 0xa22, CCKSwingTable_Ch1_Ch13[CCK_index][0]);
+			rtw_write8(pAdapter, 0xa23, CCKSwingTable_Ch1_Ch13[CCK_index][1]);
+			rtw_write8(pAdapter, 0xa24, CCKSwingTable_Ch1_Ch13[CCK_index][2]);
+			rtw_write8(pAdapter, 0xa25, CCKSwingTable_Ch1_Ch13[CCK_index][3]);
+			rtw_write8(pAdapter, 0xa26, CCKSwingTable_Ch1_Ch13[CCK_index][4]);
+			rtw_write8(pAdapter, 0xa27, CCKSwingTable_Ch1_Ch13[CCK_index][5]);
+			rtw_write8(pAdapter, 0xa28, CCKSwingTable_Ch1_Ch13[CCK_index][6]);
+			rtw_write8(pAdapter, 0xa29, CCKSwingTable_Ch1_Ch13[CCK_index][7]);
+		} else {
+			rtw_write8(pAdapter, 0xa22, CCKSwingTable_Ch14[CCK_index][0]);
+			rtw_write8(pAdapter, 0xa23, CCKSwingTable_Ch14[CCK_index][1]);
+			rtw_write8(pAdapter, 0xa24, CCKSwingTable_Ch14[CCK_index][2]);
+			rtw_write8(pAdapter, 0xa25, CCKSwingTable_Ch14[CCK_index][3]);
+			rtw_write8(pAdapter, 0xa26, CCKSwingTable_Ch14[CCK_index][4]);
+			rtw_write8(pAdapter, 0xa27, CCKSwingTable_Ch14[CCK_index][5]);
+			rtw_write8(pAdapter, 0xa28, CCKSwingTable_Ch14[CCK_index][6]);
+			rtw_write8(pAdapter, 0xa29, CCKSwingTable_Ch14[CCK_index][7]);
+		}
+	}
+#if 0
+	RTPRINT(FINIT, INIT_TxPower,
+	("MPT_CCKTxPowerAdjustbyIndex 0xa20=%x\n", PlatformEFIORead4Byte(Adapter, 0xa20)));
+
+	PlatformAtomicExchange(&Adapter->IntrCCKRefCount, FALSE);
+#endif
+}
+/*---------------------------hal\rtl8192c\MPT_HelperFunc.c---------------------------*/
+
+/*
+ * SetChannel
+ * Description
+ *	Use H2C command to change channel,
+ *	not only modify rf register, but also other setting need to be done.
+ */
+void Hal_SetChannel(PADAPTER pAdapter)
+{
+#if 0
+	struct mp_priv *pmp = &pAdapter->mppriv;
+
+//	SelectChannel(pAdapter, pmp->channel);
+	set_channel_bwmode(pAdapter, pmp->channel, pmp->channel_offset, pmp->bandwidth);
+#else
+	u8 		eRFPath;
+
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct mp_priv	*pmp = &pAdapter->mppriv;
+	u8		channel = pmp->channel;
+	u8		bandwidth = pmp->bandwidth;
+	u8		rate = pmp->rateidx;
+
+
+	// set RF channel register
+	for (eRFPath = 0; eRFPath < pHalData->NumTotalRFPath; eRFPath++)
+	{
+      if(IS_HARDWARE_TYPE_8192D(pAdapter))
+			_write_rfreg(pAdapter, (RF_RADIO_PATH_E)eRFPath, rRfChannel, 0xFF, channel);
+		else
+		_write_rfreg(pAdapter, eRFPath, rRfChannel, 0x3FF, channel);
+	}
+	Hal_mpt_SwitchRfSetting(pAdapter);
+
+	SelectChannel(pAdapter, channel);
+
+	if (pHalData->CurrentChannel == 14 && !pHalData->dmpriv.bCCKinCH14) {
+		pHalData->dmpriv.bCCKinCH14 = _TRUE;
+		Hal_MPT_CCKTxPowerAdjust(pAdapter, pHalData->dmpriv.bCCKinCH14);
+	}
+	else if (pHalData->CurrentChannel != 14 && pHalData->dmpriv.bCCKinCH14) {
+		pHalData->dmpriv.bCCKinCH14 = _FALSE;
+		Hal_MPT_CCKTxPowerAdjust(pAdapter, pHalData->dmpriv.bCCKinCH14);
+	}
+
+#endif
+}
+
+/*
+ * Notice
+ *	Switch bandwitdth may change center frequency(channel)
+ */
+void Hal_SetBandwidth(PADAPTER pAdapter)
+{
+	struct mp_priv *pmp = &pAdapter->mppriv;
+
+
+	SetBWMode(pAdapter, pmp->bandwidth, pmp->prime_channel_offset);
+	Hal_mpt_SwitchRfSetting(pAdapter);
+}
+
+void Hal_SetCCKTxPower(PADAPTER pAdapter, u8 *TxPower)
+{
+	u32 tmpval = 0;
+
+
+	// rf-A cck tx power
+	write_bbreg(pAdapter, rTxAGC_A_CCK1_Mcs32, bMaskByte1, TxPower[RF_PATH_A]);
+	tmpval = (TxPower[RF_PATH_A]<<16) | (TxPower[RF_PATH_A]<<8) | TxPower[RF_PATH_A];
+	write_bbreg(pAdapter, rTxAGC_B_CCK11_A_CCK2_11, 0xffffff00, tmpval);
+
+	// rf-B cck tx power
+	write_bbreg(pAdapter, rTxAGC_B_CCK11_A_CCK2_11, bMaskByte0, TxPower[RF_PATH_B]);
+	tmpval = (TxPower[RF_PATH_B]<<16) | (TxPower[RF_PATH_B]<<8) | TxPower[RF_PATH_B];
+	write_bbreg(pAdapter, rTxAGC_B_CCK1_55_Mcs32, 0xffffff00, tmpval);
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("-SetCCKTxPower: A[0x%02x] B[0x%02x]\n",
+		  TxPower[RF_PATH_A], TxPower[RF_PATH_B]));
+}
+
+void Hal_SetOFDMTxPower(PADAPTER pAdapter, u8 *TxPower)
+{
+	u32 TxAGC = 0;
+	u8 tmpval = 0;
+	PMPT_CONTEXT	pMptCtx = &pAdapter->mppriv.MptCtx;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+
+
+	// HT Tx-rf(A)
+	tmpval = TxPower[RF_PATH_A];
+	TxAGC = (tmpval<<24) | (tmpval<<16) | (tmpval<<8) | tmpval;
+
+	write_bbreg(pAdapter, rTxAGC_A_Rate18_06, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_A_Rate54_24, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_A_Mcs03_Mcs00, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_A_Mcs07_Mcs04, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_A_Mcs11_Mcs08, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_A_Mcs15_Mcs12, bMaskDWord, TxAGC);
+
+	// HT Tx-rf(B)
+	tmpval = TxPower[RF_PATH_B];
+	TxAGC = (tmpval<<24) | (tmpval<<16) | (tmpval<<8) | tmpval;
+
+	write_bbreg(pAdapter, rTxAGC_B_Rate18_06, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_B_Rate54_24, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_B_Mcs03_Mcs00, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_B_Mcs07_Mcs04, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_B_Mcs11_Mcs08, bMaskDWord, TxAGC);
+	write_bbreg(pAdapter, rTxAGC_B_Mcs15_Mcs12, bMaskDWord, TxAGC);
+
+	RT_TRACE(_module_mp_, _drv_notice_,
+		 ("-SetOFDMTxPower: A[0x%02x] B[0x%02x]\n",
+		  TxPower[RF_PATH_A], TxPower[RF_PATH_B]));
+}
+
+void Hal_SetAntennaPathPower(PADAPTER pAdapter)
+{
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter);
+	u8 TxPowerLevel[MAX_RF_PATH_NUMS];
+	u8 rfPath;
+
+	TxPowerLevel[RF_PATH_A] = pAdapter->mppriv.txpoweridx;
+	TxPowerLevel[RF_PATH_B] = pAdapter->mppriv.txpoweridx_b;
+
+	switch (pAdapter->mppriv.antenna_tx)
+	{
+		case ANTENNA_A:
+		default:
+			rfPath = RF_PATH_A;
+			break;
+		case ANTENNA_B:
+			rfPath = RF_PATH_B;
+			break;
+		case ANTENNA_C:
+			rfPath = RF_PATH_C;
+			break;
+	}
+
+	switch (pHalData->rf_chip)
+	{
+		case RF_8225:
+		case RF_8256:
+		case RF_6052:
+			Hal_SetCCKTxPower(pAdapter, TxPowerLevel);
+			if (pAdapter->mppriv.rateidx < MPT_RATE_6M)	// CCK rate
+				Hal_MPT_CCKTxPowerAdjustbyIndex(pAdapter, TxPowerLevel[rfPath]%2 == 0);
+			Hal_SetOFDMTxPower(pAdapter, TxPowerLevel);
+			break;
+
+		default:
+			break;
+	}
+}
+
+void Hal_SetTxPower(PADAPTER pAdapter)
+{
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter);
+	u8 TxPower = pAdapter->mppriv.txpoweridx;
+	u8 TxPowerLevel[MAX_RF_PATH_NUMS];
+	u8 rf, rfPath;
+
+	for (rf = 0; rf < MAX_RF_PATH_NUMS; rf++) {
+		TxPowerLevel[rf] = TxPower;
+	}
+
+	switch (pAdapter->mppriv.antenna_tx)
+	{
+		case ANTENNA_A:
+		default:
+			rfPath = RF_PATH_A;
+			break;
+		case ANTENNA_B:
+			rfPath = RF_PATH_B;
+			break;
+		case ANTENNA_C:
+			rfPath = RF_PATH_C;
+			break;
+	}
+
+	switch (pHalData->rf_chip)
+	{
+		// 2008/09/12 MH Test only !! We enable the TX power tracking for MP!!!!!
+		// We should call normal driver API later!!
+		case RF_8225:
+		case RF_8256:
+		case RF_6052:
+			Hal_SetCCKTxPower(pAdapter, TxPowerLevel);
+			if (pAdapter->mppriv.rateidx < MPT_RATE_6M)	// CCK rate
+				Hal_MPT_CCKTxPowerAdjustbyIndex(pAdapter, TxPowerLevel[rfPath]%2 == 0);
+			Hal_SetOFDMTxPower(pAdapter, TxPowerLevel);
+			break;
+
+		default:
+			break;
+	}
+
+//	SetCCKTxPower(pAdapter, TxPower);
+//	SetOFDMTxPower(pAdapter, TxPower);
+}
+
+void Hal_SetTxAGCOffset(PADAPTER pAdapter, u32 ulTxAGCOffset)
+{
+	u32 TxAGCOffset_B, TxAGCOffset_C, TxAGCOffset_D,tmpAGC;
+
+	TxAGCOffset_B = (ulTxAGCOffset&0x000000ff);
+	TxAGCOffset_C = ((ulTxAGCOffset&0x0000ff00)>>8);
+	TxAGCOffset_D = ((ulTxAGCOffset&0x00ff0000)>>16);
+
+	tmpAGC = (TxAGCOffset_D<<8 | TxAGCOffset_C<<4 | TxAGCOffset_B);
+	write_bbreg(pAdapter, rFPGA0_TxGainStage,
+			(bXBTxAGC|bXCTxAGC|bXDTxAGC), tmpAGC);
+}
+
+void Hal_SetDataRate(PADAPTER pAdapter)
+{
+	Hal_mpt_SwitchRfSetting(pAdapter);
+}
+
+#if  !defined (CONFIG_RTL8192C)  &&  !defined (CONFIG_RTL8192D)
+/*------------------------------Define structure----------------------------*/
+typedef struct _R_ANTENNA_SELECT_OFDM {
+	u32	r_tx_antenna:4;
+	u32	r_ant_l:4;
+	u32	r_ant_non_ht:4;
+	u32	r_ant_ht1:4;
+	u32	r_ant_ht2:4;
+	u32	r_ant_ht_s1:4;
+	u32	r_ant_non_ht_s1:4;
+	u32	OFDM_TXSC:2;
+	u32	Reserved:2;
+}R_ANTENNA_SELECT_OFDM;
+
+typedef struct _R_ANTENNA_SELECT_CCK {
+	u8	r_cckrx_enable_2:2;
+	u8	r_cckrx_enable:2;
+	u8	r_ccktx_enable:4;
+}R_ANTENNA_SELECT_CCK;
+#endif
+
+void Hal_SetAntenna(PADAPTER pAdapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+
+	R_ANTENNA_SELECT_OFDM *p_ofdm_tx;	/* OFDM Tx register */
+	R_ANTENNA_SELECT_CCK *p_cck_txrx;
+
+	u8	r_rx_antenna_ofdm = 0, r_ant_select_cck_val = 0;
+	u8	chgTx = 0, chgRx = 0;
+	u32	r_ant_sel_cck_val = 0, r_ant_select_ofdm_val = 0, r_ofdm_tx_en_val = 0;
+
+
+	p_ofdm_tx = (R_ANTENNA_SELECT_OFDM *)&r_ant_select_ofdm_val;
+	p_cck_txrx = (R_ANTENNA_SELECT_CCK *)&r_ant_select_cck_val;
+
+	p_ofdm_tx->r_ant_ht1	= 0x1;
+	p_ofdm_tx->r_ant_ht2	= 0x2;	// Second TX RF path is A
+	p_ofdm_tx->r_ant_non_ht = 0x3;	// 0x1+0x2=0x3
+
+	switch (pAdapter->mppriv.antenna_tx)
+	{
+		case ANTENNA_A:
+			p_ofdm_tx->r_tx_antenna		= 0x1;
+			r_ofdm_tx_en_val		= 0x1;
+			p_ofdm_tx->r_ant_l 		= 0x1;
+			p_ofdm_tx->r_ant_ht_s1 		= 0x1;
+			p_ofdm_tx->r_ant_non_ht_s1 	= 0x1;
+			p_cck_txrx->r_ccktx_enable	= 0x8;
+			chgTx = 1;
+
+			// From SD3 Willis suggestion !!! Set RF A=TX and B as standby
+//			if (IS_HARDWARE_TYPE_8192S(pAdapter))
+			{
+			write_bbreg(pAdapter, rFPGA0_XA_HSSIParameter2, 0xe, 2);
+			write_bbreg(pAdapter, rFPGA0_XB_HSSIParameter2, 0xe, 1);
+			r_ofdm_tx_en_val		= 0x3;
+
+			// Power save
+			//cosa r_ant_select_ofdm_val = 0x11111111;
+
+			// We need to close RFB by SW control
+			if (pHalData->rf_type == RF_2T2R)
+			{
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFInterfaceSW, BIT10, 0);
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFInterfaceSW, BIT26, 1);
+				PHY_SetBBReg(pAdapter, rFPGA0_XB_RFInterfaceOE, BIT10, 0);
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFParameter, BIT1, 1);
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFParameter, BIT17, 0);
+			}
+			}
+			break;
+
+		case ANTENNA_B:
+			p_ofdm_tx->r_tx_antenna		= 0x2;
+			r_ofdm_tx_en_val		= 0x2;
+			p_ofdm_tx->r_ant_l 		= 0x2;
+			p_ofdm_tx->r_ant_ht_s1 		= 0x2;
+			p_ofdm_tx->r_ant_non_ht_s1 	= 0x2;
+			p_cck_txrx->r_ccktx_enable	= 0x4;
+			chgTx = 1;
+
+			// From SD3 Willis suggestion !!! Set RF A as standby
+			//if (IS_HARDWARE_TYPE_8192S(pAdapter))
+			{
+			PHY_SetBBReg(pAdapter, rFPGA0_XA_HSSIParameter2, 0xe, 1);
+			PHY_SetBBReg(pAdapter, rFPGA0_XB_HSSIParameter2, 0xe, 2);
+//			r_ofdm_tx_en_val		= 0x3;
+
+			// Power save
+			//cosa r_ant_select_ofdm_val = 0x22222222;
+
+			// 2008/10/31 MH From SD3 Willi's suggestion. We must read RF 1T table.
+			// 2009/01/08 MH From Sd3 Willis. We need to close RFA by SW control
+			if (pHalData->rf_type == RF_2T2R || pHalData->rf_type == RF_1T2R)
+			{
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFInterfaceSW, BIT10, 1);
+				PHY_SetBBReg(pAdapter, rFPGA0_XA_RFInterfaceOE, BIT10, 0);
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFInterfaceSW, BIT26, 0);
+//				PHY_SetBBReg(pAdapter, rFPGA0_XB_RFInterfaceOE, BIT10, 0);
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFParameter, BIT1, 0);
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFParameter, BIT17, 1);
+			}
+			}
+		break;
+
+		case ANTENNA_AB:	// For 8192S
+			p_ofdm_tx->r_tx_antenna		= 0x3;
+			r_ofdm_tx_en_val		= 0x3;
+			p_ofdm_tx->r_ant_l 		= 0x3;
+			p_ofdm_tx->r_ant_ht_s1 		= 0x3;
+			p_ofdm_tx->r_ant_non_ht_s1 	= 0x3;
+			p_cck_txrx->r_ccktx_enable	= 0xC;
+			chgTx = 1;
+
+			// From SD3 Willis suggestion !!! Set RF B as standby
+			//if (IS_HARDWARE_TYPE_8192S(pAdapter))
+			{
+			PHY_SetBBReg(pAdapter, rFPGA0_XA_HSSIParameter2, 0xe, 2);
+			PHY_SetBBReg(pAdapter, rFPGA0_XB_HSSIParameter2, 0xe, 2);
+
+			// Disable Power save
+			//cosa r_ant_select_ofdm_val = 0x3321333;
+#if 0
+			// 2008/10/31 MH From SD3 Willi's suggestion. We must read RFA 2T table.
+			if ((pHalData->VersionID == VERSION_8192S_ACUT)) // For RTL8192SU A-Cut only, by Roger, 2008.11.07.
+			{
+				mpt_RFConfigFromPreParaArrary(pAdapter, 1, RF_PATH_A);
+			}
+#endif
+			// 2009/01/08 MH From Sd3 Willis. We need to enable RFA/B by SW control
+			if (pHalData->rf_type == RF_2T2R)
+			{
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFInterfaceSW, BIT10, 0);
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFInterfaceSW, BIT26, 0);
+//				PHY_SetBBReg(pAdapter, rFPGA0_XB_RFInterfaceOE, BIT10, 0);
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFParameter, BIT1, 1);
+				PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFParameter, BIT17, 1);
+			}
+			}
+			break;
+
+		default:
+			break;
+	}
+
+	//
+	// r_rx_antenna_ofdm, bit0=A, bit1=B, bit2=C, bit3=D
+	// r_cckrx_enable : CCK default, 0=A, 1=B, 2=C, 3=D
+	// r_cckrx_enable_2 : CCK option, 0=A, 1=B, 2=C, 3=D
+	//
+	switch (pAdapter->mppriv.antenna_rx)
+	{
+		case ANTENNA_A:
+			r_rx_antenna_ofdm 		= 0x1;	// A
+			p_cck_txrx->r_cckrx_enable 	= 0x0;	// default: A
+			p_cck_txrx->r_cckrx_enable_2	= 0x0;	// option: A
+			chgRx = 1;
+			break;
+
+		case ANTENNA_B:
+			r_rx_antenna_ofdm 		= 0x2;	// B
+			p_cck_txrx->r_cckrx_enable 	= 0x1;	// default: B
+			p_cck_txrx->r_cckrx_enable_2	= 0x1;	// option: B
+			chgRx = 1;
+			break;
+
+		case ANTENNA_AB:
+			r_rx_antenna_ofdm 		= 0x3;	// AB
+			p_cck_txrx->r_cckrx_enable 	= 0x0;	// default:A
+			p_cck_txrx->r_cckrx_enable_2	= 0x1;	// option:B
+			chgRx = 1;
+			break;
+
+		default:
+			break;
+	}
+
+	if (chgTx && chgRx)
+	{
+		switch(pHalData->rf_chip)
+		{
+			case RF_8225:
+			case RF_8256:
+			case RF_6052:
+				//r_ant_sel_cck_val = r_ant_select_cck_val;
+				PHY_SetBBReg(pAdapter, rFPGA1_TxInfo, 0x7fffffff, r_ant_select_ofdm_val);	//OFDM Tx
+				PHY_SetBBReg(pAdapter, rFPGA0_TxInfo, 0x0000000f, r_ofdm_tx_en_val);		//OFDM Tx
+				PHY_SetBBReg(pAdapter, rOFDM0_TRxPathEnable, 0x0000000f, r_rx_antenna_ofdm);	//OFDM Rx
+				PHY_SetBBReg(pAdapter, rOFDM1_TRxPathEnable, 0x0000000f, r_rx_antenna_ofdm);	//OFDM Rx
+				PHY_SetBBReg(pAdapter, rCCK0_AFESetting, bMaskByte3, r_ant_select_cck_val);//r_ant_sel_cck_val);		//CCK TxRx
+
+				break;
+
+			default:
+				break;
+		}
+	}
+
+	RT_TRACE(_module_mp_, _drv_notice_, ("-SwitchAntenna: finished\n"));
+}
+
+s32 Hal_SetThermalMeter(PADAPTER pAdapter, u8 target_ther)
+{
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter);
+
+
+	if (!netif_running(pAdapter->pnetdev)) {
+		RT_TRACE(_module_mp_, _drv_warning_, ("SetThermalMeter! Fail: interface not opened!\n"));
+		return _FAIL;
+	}
+
+	if (check_fwstate(&pAdapter->mlmepriv, WIFI_MP_STATE) == _FALSE) {
+		RT_TRACE(_module_mp_, _drv_warning_, ("SetThermalMeter: Fail! not in MP mode!\n"));
+		return _FAIL;
+	}
+
+	target_ther &= 0xff;
+	if (target_ther < 0x07)
+		target_ther = 0x07;
+	else if (target_ther > 0x1d)
+		target_ther = 0x1d;
+
+	pHalData->EEPROMThermalMeter = target_ther;
+
+	return _SUCCESS;
+}
+
+void Hal_TriggerRFThermalMeter(PADAPTER pAdapter)
+{
+
+	write_rfreg(pAdapter, RF_PATH_A, RF_T_METER, 0x60);	// 0x24: RF Reg[6:5]
+
+//	RT_TRACE(_module_mp_,_drv_alert_, ("TriggerRFThermalMeter() finished.\n" ));
+}
+
+u8 Hal_ReadRFThermalMeter(PADAPTER pAdapter)
+{
+	u32 ThermalValue = 0;
+
+	ThermalValue = _read_rfreg(pAdapter, RF_PATH_A, RF_T_METER, 0x1F);	// 0x24: RF Reg[4:0]
+//	RT_TRACE(_module_mp_, _drv_alert_, ("ThermalValue = 0x%x\n", ThermalValue));
+	return (u8)ThermalValue;
+}
+
+void Hal_GetThermalMeter(PADAPTER pAdapter, u8 *value)
+{
+#if 0
+	fw_cmd(pAdapter, IOCMD_GET_THERMAL_METER);
+	rtw_msleep_os(1000);
+	fw_cmd_data(pAdapter, value, 1);
+	*value &= 0xFF;
+#else
+
+	Hal_TriggerRFThermalMeter(pAdapter);
+	rtw_msleep_os(1000);
+	*value = Hal_ReadRFThermalMeter(pAdapter);
+#endif
+}
+
+void Hal_SetSingleCarrierTx(PADAPTER pAdapter, u8 bStart)
+{
+    HAL_DATA_TYPE *pHalData = GET_HAL_DATA(pAdapter);
+	pAdapter->mppriv.MptCtx.bSingleCarrier = bStart;
+	if (bStart)// Start Single Carrier.
+	{
+		RT_TRACE(_module_mp_,_drv_alert_, ("SetSingleCarrierTx: test start\n"));
+		// 1. if OFDM block on?
+		if(!read_bbreg(pAdapter, rFPGA0_RFMOD, bOFDMEn))
+			write_bbreg(pAdapter, rFPGA0_RFMOD, bOFDMEn, bEnable);//set OFDM block on
+
+		{
+		// 2. set CCK test mode off, set to CCK normal mode
+		write_bbreg(pAdapter, rCCK0_System, bCCKBBMode, bDisable);
+		// 3. turn on scramble setting
+		write_bbreg(pAdapter, rCCK0_System, bCCKScramble, bEnable);
+         }
+		// 4. Turn On Single Carrier Tx and turn off the other test modes.
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bEnable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
+#ifdef CONFIG_RTL8192C
+		// 5. Disable TX power saving at STF & LLTF
+		write_bbreg(pAdapter, rOFDM1_LSTF, BIT22, 1);
+#endif
+	}
+	else// Stop Single Carrier.
+	{
+		RT_TRACE(_module_mp_,_drv_alert_, ("SetSingleCarrierTx: test stop\n"));
+
+		// Turn off all test modes.
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bDisable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
+#ifdef CONFIG_RTL8192C
+		// Cancel disable TX power saving at STF&LLTF
+		write_bbreg(pAdapter, rOFDM1_LSTF, BIT22, 0);
+#endif
+		//Delay 10 ms //delay_ms(10);
+		rtw_msleep_os(10);
+
+		//BB Reset
+		write_bbreg(pAdapter, rPMAC_Reset, bBBResetB, 0x0);
+		write_bbreg(pAdapter, rPMAC_Reset, bBBResetB, 0x1);
+	}
+}
+
+
+void Hal_SetSingleToneTx(PADAPTER pAdapter, u8 bStart)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	BOOLEAN		is92C = IS_92C_SERIAL(pHalData->VersionID);
+
+	u8 rfPath;
+
+	switch (pAdapter->mppriv.antenna_tx)
+	{
+		case ANTENNA_A:
+		default:
+			rfPath = RF_PATH_A;
+			break;
+		case ANTENNA_B:
+			rfPath = RF_PATH_B;
+			break;
+		case ANTENNA_C:
+			rfPath = RF_PATH_C;
+			break;
+	}
+
+	pAdapter->mppriv.MptCtx.bSingleTone = bStart;
+	if (bStart)// Start Single Tone.
+	{
+		RT_TRACE(_module_mp_,_drv_alert_, ("SetSingleToneTx: test start\n"));
+		write_bbreg(pAdapter, rFPGA0_RFMOD, bCCKEn, 0x0);
+		write_bbreg(pAdapter, rFPGA0_RFMOD, bOFDMEn, 0x0);
+
+		if (is92C)
+		 {
+			_write_rfreg(pAdapter, RF_PATH_A, 0x21, BIT19, 0x01);
+			rtw_usleep_os(100);
+			if (rfPath == RF_PATH_A)
+				write_rfreg(pAdapter, RF_PATH_B, 0x00, 0x10000); // PAD all on.
+			else if (rfPath == RF_PATH_B)
+				write_rfreg(pAdapter, RF_PATH_A, 0x00, 0x10000); // PAD all on.
+		} else {
+			write_rfreg(pAdapter, rfPath, 0x21, 0xd4000);
+			rtw_usleep_os(100);
+		}
+
+		write_rfreg(pAdapter, rfPath, 0x00, 0x2001f); // PAD all on.
+		rtw_usleep_os(100);
+	}
+	else// Stop Single Tone.
+	{
+		RT_TRACE(_module_mp_,_drv_alert_, ("SetSingleToneTx: test stop\n"));
+		write_bbreg(pAdapter, rFPGA0_RFMOD, bCCKEn, 0x1);
+		write_bbreg(pAdapter, rFPGA0_RFMOD, bOFDMEn, 0x1);
+
+		if (is92C) {
+			_write_rfreg(pAdapter, RF_PATH_A, 0x21, BIT19, 0x00);
+			rtw_usleep_os(100);
+			write_rfreg(pAdapter, RF_PATH_A, 0x00, 0x32d75); // PAD all on.
+			write_rfreg(pAdapter, RF_PATH_B, 0x00, 0x32d75); // PAD all on.
+			rtw_usleep_os(100);
+		} else {
+			write_rfreg(pAdapter, rfPath, 0x21, 0x54000);
+			rtw_usleep_os(100);
+
+			write_rfreg(pAdapter, rfPath, 0x00, 0x30000); // PAD all on.
+			rtw_usleep_os(100);
+		}
+	}
+
+}
+
+
+void Hal_SetCarrierSuppressionTx(PADAPTER pAdapter, u8 bStart)
+{
+	pAdapter->mppriv.MptCtx.bCarrierSuppression = bStart;
+	if (bStart) // Start Carrier Suppression.
+	{
+		RT_TRACE(_module_mp_,_drv_alert_, ("SetCarrierSuppressionTx: test start\n"));
+		//if(pMgntInfo->dot11CurrentWirelessMode == WIRELESS_MODE_B)
+		if (pAdapter->mppriv.rateidx <= MPT_RATE_11M)
+		  {
+			// 1. if CCK block on?
+			if(!read_bbreg(pAdapter, rFPGA0_RFMOD, bCCKEn))
+				write_bbreg(pAdapter, rFPGA0_RFMOD, bCCKEn, bEnable);//set CCK block on
+
+			//Turn Off All Test Mode
+			write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable);
+			write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bDisable);
+			write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
+
+			write_bbreg(pAdapter, rCCK0_System, bCCKBBMode, 0x2);    //transmit mode
+			write_bbreg(pAdapter, rCCK0_System, bCCKScramble, 0x0);  //turn off scramble setting
+
+			//Set CCK Tx Test Rate
+			//PHY_SetBBReg(pAdapter, rCCK0_System, bCCKTxRate, pMgntInfo->ForcedDataRate);
+			write_bbreg(pAdapter, rCCK0_System, bCCKTxRate, 0x0);    //Set FTxRate to 1Mbps
+		}
+	}
+	else// Stop Carrier Suppression.
+	{
+		RT_TRACE(_module_mp_,_drv_alert_, ("SetCarrierSuppressionTx: test stop\n"));
+		//if(pMgntInfo->dot11CurrentWirelessMode == WIRELESS_MODE_B)
+		if (pAdapter->mppriv.rateidx <= MPT_RATE_11M ) {
+			write_bbreg(pAdapter, rCCK0_System, bCCKBBMode, 0x0);    //normal mode
+			write_bbreg(pAdapter, rCCK0_System, bCCKScramble, 0x1);  //turn on scramble setting
+
+			//BB Reset
+			write_bbreg(pAdapter, rPMAC_Reset, bBBResetB, 0x0);
+			write_bbreg(pAdapter, rPMAC_Reset, bBBResetB, 0x1);
+		}
+	}
+	//DbgPrint("\n MPT_ProSetCarrierSupp() is finished. \n");
+}
+
+void Hal_SetCCKContinuousTx(PADAPTER pAdapter, u8 bStart)
+{
+	u32 cckrate;
+
+	if (bStart)
+	{
+		RT_TRACE(_module_mp_, _drv_alert_,
+			 ("SetCCKContinuousTx: test start\n"));
+
+		// 1. if CCK block on?
+		if(!read_bbreg(pAdapter, rFPGA0_RFMOD, bCCKEn))
+			write_bbreg(pAdapter, rFPGA0_RFMOD, bCCKEn, bEnable);//set CCK block on
+
+		//Turn Off All Test Mode
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bDisable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
+		//Set CCK Tx Test Rate
+		#if 0
+		switch(pAdapter->mppriv.rateidx)
+		{
+			case 2:
+				cckrate = 0;
+				break;
+			case 4:
+				cckrate = 1;
+				break;
+			case 11:
+				cckrate = 2;
+				break;
+			case 22:
+				cckrate = 3;
+				break;
+			default:
+				cckrate = 0;
+				break;
+		}
+		#else
+		cckrate  = pAdapter->mppriv.rateidx;
+		#endif
+		write_bbreg(pAdapter, rCCK0_System, bCCKTxRate, cckrate);
+		write_bbreg(pAdapter, rCCK0_System, bCCKBBMode, 0x2);	//transmit mode
+		write_bbreg(pAdapter, rCCK0_System, bCCKScramble, bEnable);	//turn on scramble setting
+
+#ifdef CONFIG_RTL8192C
+		// Patch for CCK 11M waveform
+		if (cckrate == MPT_RATE_1M)
+			write_bbreg(pAdapter, 0xA71, BIT(6), bDisable);
+		else
+			write_bbreg(pAdapter, 0xA71, BIT(6), bEnable);
+#endif
+
+	}
+	else {
+		RT_TRACE(_module_mp_, _drv_info_,
+			 ("SetCCKContinuousTx: test stop\n"));
+
+		write_bbreg(pAdapter, rCCK0_System, bCCKBBMode, 0x0);	//normal mode
+		write_bbreg(pAdapter, rCCK0_System, bCCKScramble, bEnable);	//turn on scramble setting
+
+		//BB Reset
+		write_bbreg(pAdapter, rPMAC_Reset, bBBResetB, 0x0);
+		write_bbreg(pAdapter, rPMAC_Reset, bBBResetB, 0x1);
+	}
+
+	pAdapter->mppriv.MptCtx.bCckContTx = bStart;
+	pAdapter->mppriv.MptCtx.bOfdmContTx = _FALSE;
+}/* mpt_StartCckContTx */
+
+void Hal_SetOFDMContinuousTx(PADAPTER pAdapter, u8 bStart)
+{
+    HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+
+	if (bStart) {
+		RT_TRACE(_module_mp_, _drv_info_, ("SetOFDMContinuousTx: test start\n"));
+		// 1. if OFDM block on?
+		if(!read_bbreg(pAdapter, rFPGA0_RFMOD, bOFDMEn))
+			write_bbreg(pAdapter, rFPGA0_RFMOD, bOFDMEn, bEnable);//set OFDM block on
+        {
+
+		// 2. set CCK test mode off, set to CCK normal mode
+		write_bbreg(pAdapter, rCCK0_System, bCCKBBMode, bDisable);
+
+		// 3. turn on scramble setting
+		write_bbreg(pAdapter, rCCK0_System, bCCKScramble, bEnable);
+        }
+		// 4. Turn On Continue Tx and turn off the other test modes.
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bEnable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bDisable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
+	} else {
+		RT_TRACE(_module_mp_,_drv_info_, ("SetOFDMContinuousTx: test stop\n"));
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMContinueTx, bDisable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleCarrier, bDisable);
+		write_bbreg(pAdapter, rOFDM1_LSTF, bOFDMSingleTone, bDisable);
+		//Delay 10 ms
+		rtw_msleep_os(10);
+		//BB Reset
+		write_bbreg(pAdapter, rPMAC_Reset, bBBResetB, 0x0);
+		write_bbreg(pAdapter, rPMAC_Reset, bBBResetB, 0x1);
+	}
+
+	pAdapter->mppriv.MptCtx.bCckContTx = _FALSE;
+	pAdapter->mppriv.MptCtx.bOfdmContTx = bStart;
+}/* mpt_StartOfdmContTx */
+
+void Hal_SetContinuousTx(PADAPTER pAdapter, u8 bStart)
+{
+#if 0
+	// ADC turn off [bit24-21] adc port0 ~ port1
+	if (bStart) {
+		write_bbreg(pAdapter, rRx_Wait_CCCA, read_bbreg(pAdapter, rRx_Wait_CCCA) & 0xFE1FFFFF);
+		rtw_usleep_os(100);
+	}
+#endif
+	RT_TRACE(_module_mp_, _drv_info_,
+		 ("SetContinuousTx: rate:%d\n", pAdapter->mppriv.rateidx));
+
+	pAdapter->mppriv.MptCtx.bStartContTx = bStart;
+	if (pAdapter->mppriv.rateidx <= MPT_RATE_11M)
+	{
+		Hal_SetCCKContinuousTx(pAdapter, bStart);
+	}
+	else if ((pAdapter->mppriv.rateidx >= MPT_RATE_6M) &&
+		 (pAdapter->mppriv.rateidx <= MPT_RATE_MCS15))
+	{
+		Hal_SetOFDMContinuousTx(pAdapter, bStart);
+	}
+#if 0
+	// ADC turn on [bit24-21] adc port0 ~ port1
+	if (!bStart) {
+		write_bbreg(pAdapter, rRx_Wait_CCCA, read_bbreg(pAdapter, rRx_Wait_CCCA) | 0x01E00000);
+	}
+#endif
+}
+
+#endif // CONFIG_MP_INCLUDE
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_phycfg.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_phycfg.c
new file mode 100644
index 000000000000..af6a49bca3aa
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_phycfg.c
@@ -0,0 +1,4841 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/******************************************************************************
+
+ Module:	rtl8192c_phycfg.c
+
+ Note:		Merge 92SE/SU PHY config as below
+			1. BB register R/W API
+			2. RF register R/W API
+			3. Initial BB/RF/MAC config by reading BB/MAC/RF txt.
+			3. Power setting API
+			4. Channel switch API
+			5. Initial gain switch API.
+			6. Other BB/MAC/RF API.
+
+ Function:	PHY: Extern function, phy: local function
+
+ Export:	PHY_FunctionName
+
+ Abbrev:	NONE
+
+ History:
+	Data		Who		Remark
+	08/08/2008  MHC    	1. Port from 9x series phycfg.c
+						2. Reorganize code arch and ad description.
+						3. Collect similar function.
+						4. Seperate extern/local API.
+	08/12/2008	MHC		We must merge or move USB PHY relative function later.
+	10/07/2008	MHC		Add IQ calibration for PHY.(Only 1T2R mode now!!!)
+	11/06/2008	MHC		Add TX Power index PG file to config in 0xExx register
+						area to map with EEPROM/EFUSE tx pwr index.
+
+******************************************************************************/
+#define _HAL_8192C_PHYCFG_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_byteorder.h>
+
+#ifdef CONFIG_IOL
+#include <rtw_iol.h>
+#endif
+
+#include <rtl8192c_hal.h>
+
+
+/*---------------------------Define Local Constant---------------------------*/
+/* Channel switch:The size of command tables for switch channel*/
+#define MAX_PRECMD_CNT 16
+#define MAX_RFDEPENDCMD_CNT 16
+#define MAX_POSTCMD_CNT 16
+
+#define MAX_DOZE_WAITING_TIMES_9x 64
+
+/*---------------------------Define Local Constant---------------------------*/
+
+
+/*------------------------Define global variable-----------------------------*/
+
+/*------------------------Define local variable------------------------------*/
+
+
+/*--------------------Define export function prototype-----------------------*/
+// Please refer to header file
+/*--------------------Define export function prototype-----------------------*/
+
+/*----------------------------Function Body----------------------------------*/
+//
+// 1. BB register R/W API
+//
+
+/**
+* Function:	phy_CalculateBitShift
+*
+* OverView:	Get shifted position of the BitMask
+*
+* Input:
+*			u4Byte		BitMask,
+*
+* Output:	none
+* Return:		u4Byte		Return the shift bit bit position of the mask
+*/
+static	u32
+phy_CalculateBitShift(
+	u32 BitMask
+	)
+{
+	u32 i;
+
+	for(i=0; i<=31; i++)
+	{
+		if ( ((BitMask>>i) &  0x1 ) == 1)
+			break;
+	}
+
+	return (i);
+}
+
+
+/**
+* Function:	PHY_QueryBBReg
+*
+* OverView:	Read "sepcific bits" from BB register
+*
+* Input:
+*			PADAPTER		Adapter,
+*			u4Byte			RegAddr,		//The target address to be readback
+*			u4Byte			BitMask		//The target bit position in the target address
+*										//to be readback
+* Output:	None
+* Return:		u4Byte			Data			//The readback register value
+* Note:		This function is equal to "GetRegSetting" in PHY programming guide
+*/
+u32
+rtl8192c_PHY_QueryBBReg(
+	IN	PADAPTER	Adapter,
+	IN	u32		RegAddr,
+	IN	u32		BitMask
+	)
+{
+	u32	ReturnValue = 0, OriginalValue, BitShift;
+	u16	BBWaitCounter = 0;
+
+#if (DISABLE_BB_RF == 1)
+	return 0;
+#endif
+
+	//RT_TRACE(COMP_RF, DBG_TRACE, ("--->PHY_QueryBBReg(): RegAddr(%#lx), BitMask(%#lx)\n", RegAddr, BitMask));
+
+	OriginalValue = rtw_read32(Adapter, RegAddr);
+	BitShift = phy_CalculateBitShift(BitMask);
+	ReturnValue = (OriginalValue & BitMask) >> BitShift;
+
+	//RTPRINT(FPHY, PHY_BBR, ("BBR MASK=0x%lx Addr[0x%lx]=0x%lx\n", BitMask, RegAddr, OriginalValue));
+	//RT_TRACE(COMP_RF, DBG_TRACE, ("<---PHY_QueryBBReg(): RegAddr(%#lx), BitMask(%#lx), OriginalValue(%#lx)\n", RegAddr, BitMask, OriginalValue));
+
+	return (ReturnValue);
+
+}
+
+
+/**
+* Function:	PHY_SetBBReg
+*
+* OverView:	Write "Specific bits" to BB register (page 8~)
+*
+* Input:
+*			PADAPTER		Adapter,
+*			u4Byte			RegAddr,		//The target address to be modified
+*			u4Byte			BitMask		//The target bit position in the target address
+*										//to be modified
+*			u4Byte			Data			//The new register value in the target bit position
+*										//of the target address
+*
+* Output:	None
+* Return:		None
+* Note:		This function is equal to "PutRegSetting" in PHY programming guide
+*/
+
+VOID
+rtl8192c_PHY_SetBBReg(
+	IN	PADAPTER	Adapter,
+	IN	u32		RegAddr,
+	IN	u32		BitMask,
+	IN	u32		Data
+	)
+{
+	HAL_DATA_TYPE	*pHalData		= GET_HAL_DATA(Adapter);
+	//u16			BBWaitCounter	= 0;
+	u32			OriginalValue, BitShift;
+
+#if (DISABLE_BB_RF == 1)
+	return;
+#endif
+
+	//RT_TRACE(COMP_RF, DBG_TRACE, ("--->PHY_SetBBReg(): RegAddr(%#lx), BitMask(%#lx), Data(%#lx)\n", RegAddr, BitMask, Data));
+
+	if(BitMask!= bMaskDWord){//if not "double word" write
+		OriginalValue = rtw_read32(Adapter, RegAddr);
+		BitShift = phy_CalculateBitShift(BitMask);
+		Data = ((OriginalValue & (~BitMask)) | ((Data << BitShift) & BitMask));
+	}
+
+	rtw_write32(Adapter, RegAddr, Data);
+
+	//RTPRINT(FPHY, PHY_BBW, ("BBW MASK=0x%lx Addr[0x%lx]=0x%lx\n", BitMask, RegAddr, Data));
+	//RT_TRACE(COMP_RF, DBG_TRACE, ("<---PHY_SetBBReg(): RegAddr(%#lx), BitMask(%#lx), Data(%#lx)\n", RegAddr, BitMask, Data));
+
+}
+
+
+//
+// 2. RF register R/W API
+//
+
+/*-----------------------------------------------------------------------------
+ * Function:	phy_FwRFSerialRead()
+ *
+ * Overview:	We support firmware to execute RF-R/W.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	01/21/2008	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+static	u32
+phy_FwRFSerialRead(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset	)
+{
+	u32		retValue = 0;
+	//RT_ASSERT(FALSE,("deprecate!\n"));
+	return	(retValue);
+
+}	/* phy_FwRFSerialRead */
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	phy_FwRFSerialWrite()
+ *
+ * Overview:	We support firmware to execute RF-R/W.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	01/21/2008	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+static	VOID
+phy_FwRFSerialWrite(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset,
+	IN	u32				Data	)
+{
+	//RT_ASSERT(FALSE,("deprecate!\n"));
+}
+
+
+/**
+* Function:	phy_RFSerialRead
+*
+* OverView:	Read regster from RF chips
+*
+* Input:
+*			PADAPTER		Adapter,
+*			RF_RADIO_PATH_E	eRFPath,	//Radio path of A/B/C/D
+*			u4Byte			Offset,		//The target address to be read
+*
+* Output:	None
+* Return:		u4Byte			reback value
+* Note:		Threre are three types of serial operations:
+*			1. Software serial write
+*			2. Hardware LSSI-Low Speed Serial Interface
+*			3. Hardware HSSI-High speed
+*			serial write. Driver need to implement (1) and (2).
+*			This function is equal to the combination of RF_ReadReg() and  RFLSSIRead()
+*/
+static	u32
+phy_RFSerialRead(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset
+	)
+{
+	u32						retValue = 0;
+	HAL_DATA_TYPE				*pHalData = GET_HAL_DATA(Adapter);
+	BB_REGISTER_DEFINITION_T	*pPhyReg = &pHalData->PHYRegDef[eRFPath];
+	u32						NewOffset;
+	u32 						tmplong,tmplong2;
+	u8					RfPiEnable=0;
+#if 0
+	if(pHalData->RFChipID == RF_8225 && Offset > 0x24) //36 valid regs
+		return	retValue;
+	if(pHalData->RFChipID == RF_8256 && Offset > 0x2D) //45 valid regs
+		return	retValue;
+#endif
+	//
+	// Make sure RF register offset is correct
+	//
+	Offset &= 0x3f;
+
+	//
+	// Switch page for 8256 RF IC
+	//
+	NewOffset = Offset;
+
+	// 2009/06/17 MH We can not execute IO for power save or other accident mode.
+	//if(RT_CANNOT_IO(Adapter))
+	//{
+	//	RTPRINT(FPHY, PHY_RFR, ("phy_RFSerialRead return all one\n"));
+	//	return	0xFFFFFFFF;
+	//}
+
+	// For 92S LSSI Read RFLSSIRead
+	// For RF A/B write 0x824/82c(does not work in the future)
+	// We must use 0x824 for RF A and B to execute read trigger
+	tmplong = PHY_QueryBBReg(Adapter, rFPGA0_XA_HSSIParameter2, bMaskDWord);
+	if(eRFPath == RF_PATH_A)
+		tmplong2 = tmplong;
+	else
+		tmplong2 = PHY_QueryBBReg(Adapter, pPhyReg->rfHSSIPara2, bMaskDWord);
+
+	tmplong2 = (tmplong2 & (~bLSSIReadAddress)) | (NewOffset<<23) | bLSSIReadEdge;	//T65 RF
+
+	PHY_SetBBReg(Adapter, rFPGA0_XA_HSSIParameter2, bMaskDWord, tmplong&(~bLSSIReadEdge));
+	rtw_udelay_os(10);// PlatformStallExecution(10);
+
+	PHY_SetBBReg(Adapter, pPhyReg->rfHSSIPara2, bMaskDWord, tmplong2);
+	rtw_udelay_os(100);//PlatformStallExecution(100);
+
+	PHY_SetBBReg(Adapter, rFPGA0_XA_HSSIParameter2, bMaskDWord, tmplong|bLSSIReadEdge);
+	rtw_udelay_os(10);//PlatformStallExecution(10);
+
+	if(eRFPath == RF_PATH_A)
+		RfPiEnable = (u8)PHY_QueryBBReg(Adapter, rFPGA0_XA_HSSIParameter1, BIT8);
+	else if(eRFPath == RF_PATH_B)
+		RfPiEnable = (u8)PHY_QueryBBReg(Adapter, rFPGA0_XB_HSSIParameter1, BIT8);
+
+	if(RfPiEnable)
+	{	// Read from BBreg8b8, 12 bits for 8190, 20bits for T65 RF
+		retValue = PHY_QueryBBReg(Adapter, pPhyReg->rfLSSIReadBackPi, bLSSIReadBackData);
+		//DBG_8192C("Readback from RF-PI : 0x%x\n", retValue);
+	}
+	else
+	{	//Read from BBreg8a0, 12 bits for 8190, 20 bits for T65 RF
+		retValue = PHY_QueryBBReg(Adapter, pPhyReg->rfLSSIReadBack, bLSSIReadBackData);
+		//DBG_8192C("Readback from RF-SI : 0x%x\n", retValue);
+	}
+	//DBG_8192C("RFR-%d Addr[0x%x]=0x%x\n", eRFPath, pPhyReg->rfLSSIReadBack, retValue);
+
+	return retValue;
+
+}
+
+
+
+/**
+* Function:	phy_RFSerialWrite
+*
+* OverView:	Write data to RF register (page 8~)
+*
+* Input:
+*			PADAPTER		Adapter,
+*			RF_RADIO_PATH_E	eRFPath,	//Radio path of A/B/C/D
+*			u4Byte			Offset,		//The target address to be read
+*			u4Byte			Data			//The new register Data in the target bit position
+*										//of the target to be read
+*
+* Output:	None
+* Return:		None
+* Note:		Threre are three types of serial operations:
+*			1. Software serial write
+*			2. Hardware LSSI-Low Speed Serial Interface
+*			3. Hardware HSSI-High speed
+*			serial write. Driver need to implement (1) and (2).
+*			This function is equal to the combination of RF_ReadReg() and  RFLSSIRead()
+ *
+ * Note: 		  For RF8256 only
+ *			 The total count of RTL8256(Zebra4) register is around 36 bit it only employs
+ *			 4-bit RF address. RTL8256 uses "register mode control bit" (Reg00[12], Reg00[10])
+ *			 to access register address bigger than 0xf. See "Appendix-4 in PHY Configuration
+ *			 programming guide" for more details.
+ *			 Thus, we define a sub-finction for RTL8526 register address conversion
+ *		       ===========================================================
+ *			 Register Mode		RegCTL[1]		RegCTL[0]		Note
+ *								(Reg00[12])		(Reg00[10])
+ *		       ===========================================================
+ *			 Reg_Mode0				0				x			Reg 0 ~15(0x0 ~ 0xf)
+ *		       ------------------------------------------------------------------
+ *			 Reg_Mode1				1				0			Reg 16 ~30(0x1 ~ 0xf)
+ *		       ------------------------------------------------------------------
+ *			 Reg_Mode2				1				1			Reg 31 ~ 45(0x1 ~ 0xf)
+ *		       ------------------------------------------------------------------
+ *
+ *	2008/09/02	MH	Add 92S RF definition
+ *
+ *
+ *
+*/
+static	VOID
+phy_RFSerialWrite(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset,
+	IN	u32				Data
+	)
+{
+	u32						DataAndAddr = 0;
+	HAL_DATA_TYPE				*pHalData = GET_HAL_DATA(Adapter);
+	BB_REGISTER_DEFINITION_T	*pPhyReg = &pHalData->PHYRegDef[eRFPath];
+	u32						NewOffset;
+
+#if 0
+	//<Roger_TODO> We should check valid regs for RF_6052 case.
+	if(pHalData->RFChipID == RF_8225 && Offset > 0x24) //36 valid regs
+		return;
+	if(pHalData->RFChipID == RF_8256 && Offset > 0x2D) //45 valid regs
+		return;
+#endif
+
+	// 2009/06/17 MH We can not execute IO for power save or other accident mode.
+	//if(RT_CANNOT_IO(Adapter))
+	//{
+	//	RTPRINT(FPHY, PHY_RFW, ("phy_RFSerialWrite stop\n"));
+	//	return;
+	//}
+
+	Offset &= 0x3f;
+
+	//
+	// Shadow Update
+	//
+	//PHY_RFShadowWrite(Adapter, eRFPath, Offset, Data);
+
+	//
+	// Switch page for 8256 RF IC
+	//
+	NewOffset = Offset;
+
+	//
+	// Put write addr in [5:0]  and write data in [31:16]
+	//
+	//DataAndAddr = (Data<<16) | (NewOffset&0x3f);
+	DataAndAddr = ((NewOffset<<20) | (Data&0x000fffff)) & 0x0fffffff;	// T65 RF
+
+	//
+	// Write Operation
+	//
+	PHY_SetBBReg(Adapter, pPhyReg->rf3wireOffset, bMaskDWord, DataAndAddr);
+	//RTPRINT(FPHY, PHY_RFW, ("RFW-%d Addr[0x%lx]=0x%lx\n", eRFPath, pPhyReg->rf3wireOffset, DataAndAddr));
+
+}
+
+
+/**
+* Function:	PHY_QueryRFReg
+*
+* OverView:	Query "Specific bits" to RF register (page 8~)
+*
+* Input:
+*			PADAPTER		Adapter,
+*			RF_RADIO_PATH_E	eRFPath,	//Radio path of A/B/C/D
+*			u4Byte			RegAddr,		//The target address to be read
+*			u4Byte			BitMask		//The target bit position in the target address
+*										//to be read
+*
+* Output:	None
+* Return:		u4Byte			Readback value
+* Note:		This function is equal to "GetRFRegSetting" in PHY programming guide
+*/
+u32
+rtl8192c_PHY_QueryRFReg(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				RegAddr,
+	IN	u32				BitMask
+	)
+{
+	u32 Original_Value, Readback_Value, BitShift;
+	//HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	//u8	RFWaitCounter = 0;
+	//_irqL	irqL;
+
+#if (DISABLE_BB_RF == 1)
+	return 0;
+#endif
+
+	//RT_TRACE(COMP_RF, DBG_TRACE, ("--->PHY_QueryRFReg(): RegAddr(%#lx), eRFPath(%#x), BitMask(%#lx)\n", RegAddr, eRFPath,BitMask));
+
+#ifdef CONFIG_USB_HCI
+	//PlatformAcquireMutex(&pHalData->mxRFOperate);
+#else
+	//_enter_critical(&pHalData->rf_lock, &irqL);
+#endif
+
+
+	Original_Value = phy_RFSerialRead(Adapter, eRFPath, RegAddr);
+
+	BitShift =  phy_CalculateBitShift(BitMask);
+	Readback_Value = (Original_Value & BitMask) >> BitShift;
+
+#ifdef CONFIG_USB_HCI
+	//PlatformReleaseMutex(&pHalData->mxRFOperate);
+#else
+	//_exit_critical(&pHalData->rf_lock, &irqL);
+#endif
+
+
+	//RTPRINT(FPHY, PHY_RFR, ("RFR-%d MASK=0x%lx Addr[0x%lx]=0x%lx\n", eRFPath, BitMask, RegAddr, Original_Value));//BitMask(%#lx),BitMask,
+	//RT_TRACE(COMP_RF, DBG_TRACE, ("<---PHY_QueryRFReg(): RegAddr(%#lx), eRFPath(%#x),  Original_Value(%#lx)\n",
+	//				RegAddr, eRFPath, Original_Value));
+
+	return (Readback_Value);
+}
+
+/**
+* Function:	PHY_SetRFReg
+*
+* OverView:	Write "Specific bits" to RF register (page 8~)
+*
+* Input:
+*			PADAPTER		Adapter,
+*			RF_RADIO_PATH_E	eRFPath,	//Radio path of A/B/C/D
+*			u4Byte			RegAddr,		//The target address to be modified
+*			u4Byte			BitMask		//The target bit position in the target address
+*										//to be modified
+*			u4Byte			Data			//The new register Data in the target bit position
+*										//of the target address
+*
+* Output:	None
+* Return:		None
+* Note:		This function is equal to "PutRFRegSetting" in PHY programming guide
+*/
+VOID
+rtl8192c_PHY_SetRFReg(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				RegAddr,
+	IN	u32				BitMask,
+	IN	u32				Data
+	)
+{
+
+	//HAL_DATA_TYPE	*pHalData		= GET_HAL_DATA(Adapter);
+	//u1Byte			RFWaitCounter	= 0;
+	u32		Original_Value, BitShift;
+	//_irqL	irqL;
+
+#if (DISABLE_BB_RF == 1)
+	return;
+#endif
+
+	//RT_TRACE(COMP_RF, DBG_TRACE, ("--->PHY_SetRFReg(): RegAddr(%#lx), BitMask(%#lx), Data(%#lx), eRFPath(%#x)\n",
+	//	RegAddr, BitMask, Data, eRFPath));
+	//RTPRINT(FINIT, INIT_RF, ("PHY_SetRFReg(): RegAddr(%#lx), BitMask(%#lx), Data(%#lx), eRFPath(%#x)\n",
+	//	RegAddr, BitMask, Data, eRFPath));
+
+
+#ifdef CONFIG_USB_HCI
+	//PlatformAcquireMutex(&pHalData->mxRFOperate);
+#else
+	//_enter_critical(&pHalData->rf_lock, &irqL);
+#endif
+
+
+	// RF data is 12 bits only
+	if (BitMask != bRFRegOffsetMask)
+	{
+		Original_Value = phy_RFSerialRead(Adapter, eRFPath, RegAddr);
+		BitShift =  phy_CalculateBitShift(BitMask);
+		Data = ((Original_Value & (~BitMask)) | (Data<< BitShift));
+	}
+
+	phy_RFSerialWrite(Adapter, eRFPath, RegAddr, Data);
+
+
+
+#ifdef CONFIG_USB_HCI
+	//PlatformReleaseMutex(&pHalData->mxRFOperate);
+#else
+	//_exit_critical(&pHalData->rf_lock, &irqL);
+#endif
+
+	//PHY_QueryRFReg(Adapter,eRFPath,RegAddr,BitMask);
+	//RT_TRACE(COMP_RF, DBG_TRACE, ("<---PHY_SetRFReg(): RegAddr(%#lx), BitMask(%#lx), Data(%#lx), eRFPath(%#x)\n",
+	//		RegAddr, BitMask, Data, eRFPath));
+
+}
+
+
+//
+// 3. Initial MAC/BB/RF config by reading MAC/BB/RF txt.
+//
+
+/*-----------------------------------------------------------------------------
+ * Function:    phy_ConfigMACWithParaFile()
+ *
+ * Overview:    This function read BB parameters from general file format, and do register
+ *			  Read/Write
+ *
+ * Input:      	PADAPTER		Adapter
+ *			ps1Byte 			pFileName
+ *
+ * Output:      NONE
+ *
+ * Return:      RT_STATUS_SUCCESS: configuration file exist
+ *
+ * Note: 		The format of MACPHY_REG.txt is different from PHY and RF.
+ *			[Register][Mask][Value]
+ *---------------------------------------------------------------------------*/
+static	int
+phy_ConfigMACWithParaFile(
+	IN	PADAPTER		Adapter,
+	IN	u8* 			pFileName
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	int		rtStatus = _SUCCESS;
+
+	return rtStatus;
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:    phy_ConfigMACWithHeaderFile()
+ *
+ * Overview:    This function read BB parameters from Header file we gen, and do register
+ *			  Read/Write
+ *
+ * Input:      	PADAPTER		Adapter
+ *			ps1Byte 			pFileName
+ *
+ * Output:      NONE
+ *
+ * Return:      RT_STATUS_SUCCESS: configuration file exist
+ *
+ * Note: 		The format of MACPHY_REG.txt is different from PHY and RF.
+ *			[Register][Mask][Value]
+ *---------------------------------------------------------------------------*/
+static	int
+phy_ConfigMACWithHeaderFile(
+	IN	PADAPTER		Adapter
+)
+{
+	u32					i = 0;
+	u32					ArrayLength = 0;
+	u32*				ptrArray;
+	//HAL_DATA_TYPE			*pHalData = GET_HAL_DATA(Adapter);
+
+	//2008.11.06 Modified by tynli.
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Read Rtl819XMACPHY_Array\n"));
+	ArrayLength = MAC_2T_ArrayLength;
+	ptrArray = Rtl819XMAC_Array;
+
+#ifdef CONFIG_IOL_MAC
+	if(rtw_IOL_applied(Adapter))
+	{
+		struct xmit_frame	*xmit_frame;
+		if((xmit_frame=rtw_IOL_accquire_xmit_frame(Adapter)) == NULL)
+			return _FAIL;
+
+		for(i = 0 ;i < ArrayLength;i=i+2){ // Add by tynli for 2 column
+			rtw_IOL_append_WB_cmd(xmit_frame, ptrArray[i], (u8)ptrArray[i+1]);
+		}
+
+		return rtw_IOL_exec_cmds_sync(Adapter, xmit_frame, 1000);
+	}
+	else
+#endif
+	{
+		for(i = 0 ;i < ArrayLength;i=i+2){ // Add by tynli for 2 column
+			rtw_write8(Adapter, ptrArray[i], (u8)ptrArray[i+1]);
+		}
+	}
+
+	return _SUCCESS;
+
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:    PHY_MACConfig8192C
+ *
+ * Overview:	Condig MAC by header file or parameter file.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ *  When		Who		Remark
+ *  08/12/2008	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+int
+PHY_MACConfig8192C(
+	IN	PADAPTER	Adapter
+	)
+{
+	int		rtStatus = _SUCCESS;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	s8			*pszMACRegFile;
+	s8			sz88CMACRegFile[] = RTL8188C_PHY_MACREG;
+	s8			sz92CMACRegFile[] = RTL8192C_PHY_MACREG;
+	BOOLEAN		is92C = IS_92C_SERIAL(pHalData->VersionID);
+
+	if(is92C)
+		pszMACRegFile = sz92CMACRegFile;
+	else
+		pszMACRegFile = sz88CMACRegFile;
+
+	//
+	// Config MAC
+	//
+#ifdef CONFIG_EMBEDDED_FWIMG
+	rtStatus = phy_ConfigMACWithHeaderFile(Adapter);
+#else
+
+	// Not make sure EEPROM, add later
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Read MACREG.txt\n"));
+	rtStatus = phy_ConfigMACWithParaFile(Adapter, pszMACRegFile);
+#endif
+
+#ifdef CONFIG_PCI_HCI
+	//this switching setting cause some 8192cu hw have redownload fw fail issue
+	//improve 2-stream TX EVM by Jenyu
+	if(is92C)
+		rtw_write8(Adapter, REG_SPS0_CTRL+3,0x71);
+#endif
+
+
+	// 2010.07.13 AMPDU aggregation number 9
+	//rtw_write16(Adapter, REG_MAX_AGGR_NUM, MAX_AGGR_NUM);
+	rtw_write8(Adapter, REG_MAX_AGGR_NUM, 0x0A); //By tynli. 2010.11.18.
+#ifdef CONFIG_USB_HCI
+	if(is92C && (BOARD_USB_DONGLE == pHalData->BoardType))
+		rtw_write8(Adapter, 0x40,0x04);
+#endif
+
+	return rtStatus;
+
+}
+
+
+/**
+* Function:	phy_InitBBRFRegisterDefinition
+*
+* OverView:	Initialize Register definition offset for Radio Path A/B/C/D
+*
+* Input:
+*			PADAPTER		Adapter,
+*
+* Output:	None
+* Return:		None
+* Note:		The initialization value is constant and it should never be changes
+*/
+static	VOID
+phy_InitBBRFRegisterDefinition(
+	IN	PADAPTER		Adapter
+)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+
+	// RF Interface Sowrtware Control
+	pHalData->PHYRegDef[RF_PATH_A].rfintfs = rFPGA0_XAB_RFInterfaceSW; // 16 LSBs if read 32-bit from 0x870
+	pHalData->PHYRegDef[RF_PATH_B].rfintfs = rFPGA0_XAB_RFInterfaceSW; // 16 MSBs if read 32-bit from 0x870 (16-bit for 0x872)
+	pHalData->PHYRegDef[RF_PATH_C].rfintfs = rFPGA0_XCD_RFInterfaceSW;// 16 LSBs if read 32-bit from 0x874
+	pHalData->PHYRegDef[RF_PATH_D].rfintfs = rFPGA0_XCD_RFInterfaceSW;// 16 MSBs if read 32-bit from 0x874 (16-bit for 0x876)
+
+	// RF Interface Readback Value
+	pHalData->PHYRegDef[RF_PATH_A].rfintfi = rFPGA0_XAB_RFInterfaceRB; // 16 LSBs if read 32-bit from 0x8E0
+	pHalData->PHYRegDef[RF_PATH_B].rfintfi = rFPGA0_XAB_RFInterfaceRB;// 16 MSBs if read 32-bit from 0x8E0 (16-bit for 0x8E2)
+	pHalData->PHYRegDef[RF_PATH_C].rfintfi = rFPGA0_XCD_RFInterfaceRB;// 16 LSBs if read 32-bit from 0x8E4
+	pHalData->PHYRegDef[RF_PATH_D].rfintfi = rFPGA0_XCD_RFInterfaceRB;// 16 MSBs if read 32-bit from 0x8E4 (16-bit for 0x8E6)
+
+	// RF Interface Output (and Enable)
+	pHalData->PHYRegDef[RF_PATH_A].rfintfo = rFPGA0_XA_RFInterfaceOE; // 16 LSBs if read 32-bit from 0x860
+	pHalData->PHYRegDef[RF_PATH_B].rfintfo = rFPGA0_XB_RFInterfaceOE; // 16 LSBs if read 32-bit from 0x864
+
+	// RF Interface (Output and)  Enable
+	pHalData->PHYRegDef[RF_PATH_A].rfintfe = rFPGA0_XA_RFInterfaceOE; // 16 MSBs if read 32-bit from 0x860 (16-bit for 0x862)
+	pHalData->PHYRegDef[RF_PATH_B].rfintfe = rFPGA0_XB_RFInterfaceOE; // 16 MSBs if read 32-bit from 0x864 (16-bit for 0x866)
+
+	//Addr of LSSI. Wirte RF register by driver
+	pHalData->PHYRegDef[RF_PATH_A].rf3wireOffset = rFPGA0_XA_LSSIParameter; //LSSI Parameter
+	pHalData->PHYRegDef[RF_PATH_B].rf3wireOffset = rFPGA0_XB_LSSIParameter;
+
+	// RF parameter
+	pHalData->PHYRegDef[RF_PATH_A].rfLSSI_Select = rFPGA0_XAB_RFParameter;  //BB Band Select
+	pHalData->PHYRegDef[RF_PATH_B].rfLSSI_Select = rFPGA0_XAB_RFParameter;
+	pHalData->PHYRegDef[RF_PATH_C].rfLSSI_Select = rFPGA0_XCD_RFParameter;
+	pHalData->PHYRegDef[RF_PATH_D].rfLSSI_Select = rFPGA0_XCD_RFParameter;
+
+	// Tx AGC Gain Stage (same for all path. Should we remove this?)
+	pHalData->PHYRegDef[RF_PATH_A].rfTxGainStage = rFPGA0_TxGainStage; //Tx gain stage
+	pHalData->PHYRegDef[RF_PATH_B].rfTxGainStage = rFPGA0_TxGainStage; //Tx gain stage
+	pHalData->PHYRegDef[RF_PATH_C].rfTxGainStage = rFPGA0_TxGainStage; //Tx gain stage
+	pHalData->PHYRegDef[RF_PATH_D].rfTxGainStage = rFPGA0_TxGainStage; //Tx gain stage
+
+	// Tranceiver A~D HSSI Parameter-1
+	pHalData->PHYRegDef[RF_PATH_A].rfHSSIPara1 = rFPGA0_XA_HSSIParameter1;  //wire control parameter1
+	pHalData->PHYRegDef[RF_PATH_B].rfHSSIPara1 = rFPGA0_XB_HSSIParameter1;  //wire control parameter1
+
+	// Tranceiver A~D HSSI Parameter-2
+	pHalData->PHYRegDef[RF_PATH_A].rfHSSIPara2 = rFPGA0_XA_HSSIParameter2;  //wire control parameter2
+	pHalData->PHYRegDef[RF_PATH_B].rfHSSIPara2 = rFPGA0_XB_HSSIParameter2;  //wire control parameter2
+
+	// RF switch Control
+	pHalData->PHYRegDef[RF_PATH_A].rfSwitchControl = rFPGA0_XAB_SwitchControl; //TR/Ant switch control
+	pHalData->PHYRegDef[RF_PATH_B].rfSwitchControl = rFPGA0_XAB_SwitchControl;
+	pHalData->PHYRegDef[RF_PATH_C].rfSwitchControl = rFPGA0_XCD_SwitchControl;
+	pHalData->PHYRegDef[RF_PATH_D].rfSwitchControl = rFPGA0_XCD_SwitchControl;
+
+	// AGC control 1
+	pHalData->PHYRegDef[RF_PATH_A].rfAGCControl1 = rOFDM0_XAAGCCore1;
+	pHalData->PHYRegDef[RF_PATH_B].rfAGCControl1 = rOFDM0_XBAGCCore1;
+	pHalData->PHYRegDef[RF_PATH_C].rfAGCControl1 = rOFDM0_XCAGCCore1;
+	pHalData->PHYRegDef[RF_PATH_D].rfAGCControl1 = rOFDM0_XDAGCCore1;
+
+	// AGC control 2
+	pHalData->PHYRegDef[RF_PATH_A].rfAGCControl2 = rOFDM0_XAAGCCore2;
+	pHalData->PHYRegDef[RF_PATH_B].rfAGCControl2 = rOFDM0_XBAGCCore2;
+	pHalData->PHYRegDef[RF_PATH_C].rfAGCControl2 = rOFDM0_XCAGCCore2;
+	pHalData->PHYRegDef[RF_PATH_D].rfAGCControl2 = rOFDM0_XDAGCCore2;
+
+	// RX AFE control 1
+	pHalData->PHYRegDef[RF_PATH_A].rfRxIQImbalance = rOFDM0_XARxIQImbalance;
+	pHalData->PHYRegDef[RF_PATH_B].rfRxIQImbalance = rOFDM0_XBRxIQImbalance;
+	pHalData->PHYRegDef[RF_PATH_C].rfRxIQImbalance = rOFDM0_XCRxIQImbalance;
+	pHalData->PHYRegDef[RF_PATH_D].rfRxIQImbalance = rOFDM0_XDRxIQImbalance;
+
+	// RX AFE control 1
+	pHalData->PHYRegDef[RF_PATH_A].rfRxAFE = rOFDM0_XARxAFE;
+	pHalData->PHYRegDef[RF_PATH_B].rfRxAFE = rOFDM0_XBRxAFE;
+	pHalData->PHYRegDef[RF_PATH_C].rfRxAFE = rOFDM0_XCRxAFE;
+	pHalData->PHYRegDef[RF_PATH_D].rfRxAFE = rOFDM0_XDRxAFE;
+
+	// Tx AFE control 1
+	pHalData->PHYRegDef[RF_PATH_A].rfTxIQImbalance = rOFDM0_XATxIQImbalance;
+	pHalData->PHYRegDef[RF_PATH_B].rfTxIQImbalance = rOFDM0_XBTxIQImbalance;
+	pHalData->PHYRegDef[RF_PATH_C].rfTxIQImbalance = rOFDM0_XCTxIQImbalance;
+	pHalData->PHYRegDef[RF_PATH_D].rfTxIQImbalance = rOFDM0_XDTxIQImbalance;
+
+	// Tx AFE control 2
+	pHalData->PHYRegDef[RF_PATH_A].rfTxAFE = rOFDM0_XATxAFE;
+	pHalData->PHYRegDef[RF_PATH_B].rfTxAFE = rOFDM0_XBTxAFE;
+	pHalData->PHYRegDef[RF_PATH_C].rfTxAFE = rOFDM0_XCTxAFE;
+	pHalData->PHYRegDef[RF_PATH_D].rfTxAFE = rOFDM0_XDTxAFE;
+
+	// Tranceiver LSSI Readback SI mode
+	pHalData->PHYRegDef[RF_PATH_A].rfLSSIReadBack = rFPGA0_XA_LSSIReadBack;
+	pHalData->PHYRegDef[RF_PATH_B].rfLSSIReadBack = rFPGA0_XB_LSSIReadBack;
+	pHalData->PHYRegDef[RF_PATH_C].rfLSSIReadBack = rFPGA0_XC_LSSIReadBack;
+	pHalData->PHYRegDef[RF_PATH_D].rfLSSIReadBack = rFPGA0_XD_LSSIReadBack;
+
+	// Tranceiver LSSI Readback PI mode
+	pHalData->PHYRegDef[RF_PATH_A].rfLSSIReadBackPi = TransceiverA_HSPI_Readback;
+	pHalData->PHYRegDef[RF_PATH_B].rfLSSIReadBackPi = TransceiverB_HSPI_Readback;
+	//pHalData->PHYRegDef[RF_PATH_C].rfLSSIReadBackPi = rFPGA0_XC_LSSIReadBack;
+	//pHalData->PHYRegDef[RF_PATH_D].rfLSSIReadBackPi = rFPGA0_XD_LSSIReadBack;
+
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:    phy_ConfigBBWithParaFile()
+ *
+ * Overview:    This function read BB parameters from general file format, and do register
+ *			  Read/Write
+ *
+ * Input:      	PADAPTER		Adapter
+ *			ps1Byte 			pFileName
+ *
+ * Output:      NONE
+ *
+ * Return:      RT_STATUS_SUCCESS: configuration file exist
+ *	2008/11/06	MH	For 92S we do not support silent reset now. Disable
+ *					parameter file compare!!!!!!??
+ *
+ *---------------------------------------------------------------------------*/
+static	int
+phy_ConfigBBWithParaFile(
+	IN	PADAPTER		Adapter,
+	IN	u8* 			pFileName
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	int		rtStatus = _SUCCESS;
+
+	return rtStatus;
+}
+
+
+
+//****************************************
+// The following is for High Power PA
+//****************************************
+VOID
+phy_ConfigBBExternalPA(
+	IN	PADAPTER			Adapter
+)
+{
+#ifdef CONFIG_USB_HCI
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u16 i=0;
+	u32 temp=0;
+
+	if(!pHalData->ExternalPA)
+	{
+		return;
+	}
+
+	// 2010/10/19 MH According to Jenyu/EEChou 's opinion, we need not to execute the
+	// same code as SU. It is already updated in PHY_REG_1T_HP.txt.
+#if 0
+	PHY_SetBBReg(Adapter, 0xee8, BIT28, 1);
+	temp = PHY_QueryBBReg(Adapter, 0x860, bMaskDWord);
+	temp |= (BIT26|BIT21|BIT10|BIT5);
+	PHY_SetBBReg(Adapter, 0x860, bMaskDWord, temp);
+	PHY_SetBBReg(Adapter, 0x870, BIT10, 0);
+	PHY_SetBBReg(Adapter, 0xc80, bMaskDWord, 0x20000080);
+	PHY_SetBBReg(Adapter, 0xc88, bMaskDWord, 0x40000100);
+#endif
+
+#endif
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:    phy_ConfigBBWithHeaderFile()
+ *
+ * Overview:    This function read BB parameters from general file format, and do register
+ *			  Read/Write
+ *
+ * Input:      	PADAPTER		Adapter
+ *			u1Byte 			ConfigType     0 => PHY_CONFIG
+ *										 1 =>AGC_TAB
+ *
+ * Output:      NONE
+ *
+ * Return:      RT_STATUS_SUCCESS: configuration file exist
+ *
+ *---------------------------------------------------------------------------*/
+static	int
+phy_ConfigBBWithHeaderFile(
+	IN	PADAPTER		Adapter,
+	IN	u8 			ConfigType
+)
+{
+	int i;
+	u32*	Rtl819XPHY_REGArray_Table;
+	u32*	Rtl819XAGCTAB_Array_Table;
+	u16	PHY_REGArrayLen, AGCTAB_ArrayLen;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	int ret = _SUCCESS;
+
+	//
+	// 2009.11.24. Modified by tynli.
+	//
+	if(IS_92C_SERIAL(pHalData->VersionID))
+	{
+		AGCTAB_ArrayLen = AGCTAB_2TArrayLength;
+		Rtl819XAGCTAB_Array_Table = Rtl819XAGCTAB_2TArray;
+		PHY_REGArrayLen = PHY_REG_2TArrayLength;
+		Rtl819XPHY_REGArray_Table = Rtl819XPHY_REG_2TArray;
+#ifdef CONFIG_USB_HCI
+		if(pHalData->BoardType == BOARD_MINICARD )
+		{
+			PHY_REGArrayLen = PHY_REG_2T_mCardArrayLength;
+			Rtl819XPHY_REGArray_Table = Rtl819XPHY_REG_2T_mCardArray;
+		}
+#endif
+	}
+	else
+	{
+		AGCTAB_ArrayLen = AGCTAB_1TArrayLength;
+		Rtl819XAGCTAB_Array_Table = Rtl819XAGCTAB_1TArray;
+		PHY_REGArrayLen = PHY_REG_1TArrayLength;
+		Rtl819XPHY_REGArray_Table = Rtl819XPHY_REG_1TArray;
+#ifdef CONFIG_USB_HCI
+		if(pHalData->BoardType == BOARD_MINICARD )
+		{
+			PHY_REGArrayLen = PHY_REG_1T_mCardArrayLength;
+			Rtl819XPHY_REGArray_Table = Rtl819XPHY_REG_1T_mCardArray;
+		}
+		else if(pHalData->BoardType == BOARD_USB_High_PA)
+		{
+			AGCTAB_ArrayLen = AGCTAB_1T_HPArrayLength;
+			Rtl819XAGCTAB_Array_Table = Rtl819XAGCTAB_1T_HPArray;
+			PHY_REGArrayLen = PHY_REG_1T_HPArrayLength;
+			Rtl819XPHY_REGArray_Table = Rtl819XPHY_REG_1T_HPArray;
+		}
+#endif
+	}
+
+	if(ConfigType == BaseBand_Config_PHY_REG)
+	{
+		#ifdef CONFIG_IOL_BB_PHY_REG
+		if(rtw_IOL_applied(Adapter))
+		{
+			struct xmit_frame	*xmit_frame;
+			u32 tmp_value;
+
+			if((xmit_frame=rtw_IOL_accquire_xmit_frame(Adapter)) == NULL) {
+				ret = _FAIL;
+				goto exit;
+			}
+
+			for(i=0;i<PHY_REGArrayLen;i=i+2)
+			{
+				tmp_value=Rtl819XPHY_REGArray_Table[i+1];
+
+				if (Rtl819XPHY_REGArray_Table[i] == 0xfe)
+					rtw_IOL_append_DELAY_MS_cmd(xmit_frame, 50);
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xfd)
+					rtw_IOL_append_DELAY_MS_cmd(xmit_frame, 5);
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xfc)
+					rtw_IOL_append_DELAY_MS_cmd(xmit_frame, 1);
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xfb)
+					rtw_IOL_append_DELAY_US_cmd(xmit_frame, 50);
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xfa)
+					rtw_IOL_append_DELAY_US_cmd(xmit_frame, 5);
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xf9)
+					rtw_IOL_append_DELAY_US_cmd(xmit_frame, 1);
+
+				rtw_IOL_append_WD_cmd(xmit_frame, Rtl819XPHY_REGArray_Table[i], tmp_value);
+				//RT_TRACE(COMP_INIT, DBG_TRACE, ("The Rtl819XPHY_REGArray_Table[0] is %lx Rtl819XPHY_REGArray[1] is %lx \n",Rtl819XPHY_REGArray_Table[i], Rtl819XPHY_REGArray_Table[i+1]));
+			}
+
+			ret = rtw_IOL_exec_cmds_sync(Adapter, xmit_frame, 1000);
+		}
+		else
+		#endif
+		{
+			for(i=0;i<PHY_REGArrayLen;i=i+2)
+			{
+				if (Rtl819XPHY_REGArray_Table[i] == 0xfe){
+					#ifdef CONFIG_LONG_DELAY_ISSUE
+					rtw_msleep_os(50);
+					#else
+					rtw_mdelay_os(50);
+					#endif
+				}
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xfd)
+					rtw_mdelay_os(5);
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xfc)
+					rtw_mdelay_os(1);
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xfb)
+					rtw_udelay_os(50);
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xfa)
+					rtw_udelay_os(5);
+				else if (Rtl819XPHY_REGArray_Table[i] == 0xf9)
+					rtw_udelay_os(1);
+
+				PHY_SetBBReg(Adapter, Rtl819XPHY_REGArray_Table[i], bMaskDWord, Rtl819XPHY_REGArray_Table[i+1]);
+
+				// Add 1us delay between BB/RF register setting.
+				rtw_udelay_os(1);
+
+				//RT_TRACE(COMP_INIT, DBG_TRACE, ("The Rtl819XPHY_REGArray_Table[0] is %lx Rtl819XPHY_REGArray[1] is %lx \n",Rtl819XPHY_REGArray_Table[i], Rtl819XPHY_REGArray_Table[i+1]));
+			}
+		}
+
+		// for External PA
+		phy_ConfigBBExternalPA(Adapter);
+	}
+	else if(ConfigType == BaseBand_Config_AGC_TAB)
+	{
+		#ifdef CONFIG_IOL_BB_AGC_TAB
+		if(rtw_IOL_applied(Adapter))
+		{
+			struct xmit_frame	*xmit_frame;
+
+			if((xmit_frame=rtw_IOL_accquire_xmit_frame(Adapter)) == NULL) {
+				ret = _FAIL;
+				goto exit;
+			}
+
+			for(i=0;i<AGCTAB_ArrayLen;i=i+2)
+			{
+				rtw_IOL_append_WD_cmd(xmit_frame, Rtl819XAGCTAB_Array_Table[i], Rtl819XAGCTAB_Array_Table[i+1]);
+				//RT_TRACE(COMP_INIT, DBG_TRACE, ("The Rtl819XAGCTAB_Array_Table[0] is %lx Rtl819XPHY_REGArray[1] is %lx \n",Rtl819XAGCTAB_Array_Table[i], Rtl819XAGCTAB_Array_Table[i+1]));
+			}
+
+			ret = rtw_IOL_exec_cmds_sync(Adapter, xmit_frame, 1000);
+		}
+		else
+		#endif
+		{
+			for(i=0;i<AGCTAB_ArrayLen;i=i+2)
+			{
+				PHY_SetBBReg(Adapter, Rtl819XAGCTAB_Array_Table[i], bMaskDWord, Rtl819XAGCTAB_Array_Table[i+1]);
+
+				// Add 1us delay between BB/RF register setting.
+				rtw_udelay_os(1);
+
+				//RT_TRACE(COMP_INIT, DBG_TRACE, ("The Rtl819XAGCTAB_Array_Table[0] is %lx Rtl819XPHY_REGArray[1] is %lx \n",Rtl819XAGCTAB_Array_Table[i], Rtl819XAGCTAB_Array_Table[i+1]));
+			}
+		}
+	}
+
+exit:
+	return ret;
+
+}
+
+
+VOID
+storePwrIndexDiffRateOffset(
+	IN	PADAPTER	Adapter,
+	IN	u32		RegAddr,
+	IN	u32		BitMask,
+	IN	u32		Data
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	if(RegAddr == rTxAGC_A_Rate18_06)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][0] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][0] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][0]));
+	}
+	if(RegAddr == rTxAGC_A_Rate54_24)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][1] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][1] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][1]));
+	}
+	if(RegAddr == rTxAGC_A_CCK1_Mcs32)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][6] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][6] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][6]));
+	}
+	if(RegAddr == rTxAGC_B_CCK11_A_CCK2_11 && BitMask == 0xffffff00)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][7] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][7] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][7]));
+	}
+	if(RegAddr == rTxAGC_A_Mcs03_Mcs00)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][2] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][2] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][2]));
+	}
+	if(RegAddr == rTxAGC_A_Mcs07_Mcs04)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][3] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][3] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][3]));
+	}
+	if(RegAddr == rTxAGC_A_Mcs11_Mcs08)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][4] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][4] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][4]));
+	}
+	if(RegAddr == rTxAGC_A_Mcs15_Mcs12)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][5] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][5] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][5]));
+	}
+	if(RegAddr == rTxAGC_B_Rate18_06)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][8] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][8] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][8]));
+	}
+	if(RegAddr == rTxAGC_B_Rate54_24)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][9] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][9] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][9]));
+	}
+	if(RegAddr == rTxAGC_B_CCK1_55_Mcs32)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][14] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][14] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][14]));
+	}
+	if(RegAddr == rTxAGC_B_CCK11_A_CCK2_11 && BitMask == 0x000000ff)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][15] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][15] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][15]));
+	}
+	if(RegAddr == rTxAGC_B_Mcs03_Mcs00)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][10] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][10] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][10]));
+	}
+	if(RegAddr == rTxAGC_B_Mcs07_Mcs04)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][11] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][11] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][11]));
+	}
+	if(RegAddr == rTxAGC_B_Mcs11_Mcs08)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][12] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][12] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][12]));
+	}
+	if(RegAddr == rTxAGC_B_Mcs15_Mcs12)
+	{
+		pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][13] = Data;
+		//RT_TRACE(COMP_INIT, DBG_TRACE, ("MCSTxPowerLevelOriginalOffset[%d][13] = 0x%lx\n", pHalData->pwrGroupCnt,
+		//	pHalData->MCSTxPowerLevelOriginalOffset[pHalData->pwrGroupCnt][13]));
+		pHalData->pwrGroupCnt++;
+	}
+}
+/*-----------------------------------------------------------------------------
+ * Function:	phy_ConfigBBWithPgParaFile
+ *
+ * Overview:
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/06/2008 	MHC		Create Version 0.
+ * 2009/07/29	tynli		(porting from 92SE branch)2009/03/11 Add copy parameter file to buffer for silent reset
+ *---------------------------------------------------------------------------*/
+static	int
+phy_ConfigBBWithPgParaFile(
+	IN	PADAPTER		Adapter,
+	IN	u8* 			pFileName)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	int		rtStatus = _SUCCESS;
+
+
+	return rtStatus;
+
+}	/* phy_ConfigBBWithPgParaFile */
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	phy_ConfigBBWithPgHeaderFile
+ *
+ * Overview:	Config PHY_REG_PG array
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/06/2008 	MHC		Add later!!!!!!.. Please modify for new files!!!!
+ * 11/10/2008	tynli		Modify to mew files.
+ *---------------------------------------------------------------------------*/
+static	int
+phy_ConfigBBWithPgHeaderFile(
+	IN	PADAPTER		Adapter,
+	IN	u8 			ConfigType)
+{
+	int i;
+	u32*	Rtl819XPHY_REGArray_Table_PG;
+	u16	PHY_REGArrayPGLen;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	// Default: pHalData->RF_Type = RF_2T2R.
+	PHY_REGArrayPGLen = PHY_REG_Array_PGLength;
+	Rtl819XPHY_REGArray_Table_PG = Rtl819XPHY_REG_Array_PG;
+
+#ifdef CONFIG_USB_HCI
+// 2010/10/19 Chiyoko According to Alex/Willson opinion, VAU/dongle can share the same PHY_REG_PG.txt
+/*
+	if(pHalData->BoardType == BOARD_MINICARD )
+	{
+		PHY_REGArrayPGLen = PHY_REG_Array_PG_mCardLength;
+		Rtl819XPHY_REGArray_Table_PG = Rtl819XPHY_REG_Array_PG_mCard;
+	}
+	else */if(pHalData->BoardType ==BOARD_USB_High_PA )
+	{
+		PHY_REGArrayPGLen = PHY_REG_Array_PG_HPLength;
+		Rtl819XPHY_REGArray_Table_PG = Rtl819XPHY_REG_Array_PG_HP;
+	}
+#endif
+
+	if(ConfigType == BaseBand_Config_PHY_REG)
+	{
+		for(i=0;i<PHY_REGArrayPGLen;i=i+3)
+		{
+			#if 0 //without IO, no delay is neeeded...
+			if (Rtl819XPHY_REGArray_Table_PG[i] == 0xfe){
+				#ifdef CONFIG_LONG_DELAY_ISSUE
+				rtw_msleep_os(50);
+				#else
+				rtw_mdelay_os(50);
+				#endif
+			}
+			else if (Rtl819XPHY_REGArray_Table_PG[i] == 0xfd)
+				rtw_mdelay_os(5);
+			else if (Rtl819XPHY_REGArray_Table_PG[i] == 0xfc)
+				rtw_mdelay_os(1);
+			else if (Rtl819XPHY_REGArray_Table_PG[i] == 0xfb)
+				rtw_udelay_os(50);
+			else if (Rtl819XPHY_REGArray_Table_PG[i] == 0xfa)
+				rtw_udelay_os(5);
+			else if (Rtl819XPHY_REGArray_Table_PG[i] == 0xf9)
+				rtw_udelay_os(1);
+			//PHY_SetBBReg(Adapter, Rtl819XPHY_REGArray_Table_PG[i], Rtl819XPHY_REGArray_Table_PG[i+1], Rtl819XPHY_REGArray_Table_PG[i+2]);
+			#endif
+
+			storePwrIndexDiffRateOffset(Adapter, Rtl819XPHY_REGArray_Table_PG[i],
+				Rtl819XPHY_REGArray_Table_PG[i+1],
+				Rtl819XPHY_REGArray_Table_PG[i+2]);
+			//RT_TRACE(COMP_SEND, DBG_TRACE, ("The Rtl819XPHY_REGArray_Table_PG[0] is %lx Rtl819XPHY_REGArray_Table_PG[1] is %lx \n",Rtl819XPHY_REGArray_Table_PG[i], Rtl819XPHY_REGArray_Table_PG[i+1]));
+		}
+	}
+	else
+	{
+
+		//RT_TRACE(COMP_SEND, DBG_LOUD, ("phy_ConfigBBWithPgHeaderFile(): ConfigType != BaseBand_Config_PHY_REG\n"));
+	}
+
+	return _SUCCESS;
+
+}	/* phy_ConfigBBWithPgHeaderFile */
+
+#if (MP_DRIVER == 1)
+
+/*-----------------------------------------------------------------------------
+ * Function:    phy_ConfigBBWithMpParaFile()
+ *
+ * Overview:    This function read BB parameters from general file format, and do register
+ *			  Read/Write
+ *
+ * Input:      	PADAPTER		Adapter
+ *			ps1Byte 			pFileName
+ *
+ * Output:      NONE
+ *
+ * Return:      RT_STATUS_SUCCESS: configuration file exist
+ *	2008/11/06	MH	For 92S we do not support silent reset now. Disable
+ *					parameter file compare!!!!!!??
+ *
+ *---------------------------------------------------------------------------*/
+static	int
+phy_ConfigBBWithMpParaFile(
+	IN	PADAPTER		Adapter,
+	IN	u8* 			pFileName
+)
+{
+#if 1
+	int		rtStatus = _SUCCESS;
+#else
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	s4Byte			nLinesRead, ithLine;
+	RT_STATUS		rtStatus = RT_STATUS_SUCCESS;
+	ps1Byte 		szLine;
+	u4Byte			u4bRegOffset, u4bRegMask, u4bRegValue;
+	u4Byte			u4bMove;
+
+	if(ADAPTER_TEST_STATUS_FLAG(Adapter, ADAPTER_STATUS_FIRST_INIT))
+	{
+		rtStatus = PlatformReadFile(
+					Adapter,
+					pFileName,
+					(pu1Byte)(pHalData->BufOfLines),
+					MAX_LINES_HWCONFIG_TXT,
+					MAX_BYTES_LINE_HWCONFIG_TXT,
+					&nLinesRead
+					);
+		if(rtStatus == RT_STATUS_SUCCESS)
+		{
+			PlatformMoveMemory(pHalData->BufOfLines6, pHalData->BufOfLines, nLinesRead*MAX_BYTES_LINE_HWCONFIG_TXT);
+			pHalData->nLinesRead6 = nLinesRead;
+		}
+		else
+		{
+			// Temporarily skip PHY_REG_MP.txt if file does not exist.
+			pHalData->nLinesRead6 = 0;
+			RT_TRACE(COMP_INIT, DBG_LOUD, ("No matched file \r\n"));
+			return RT_STATUS_SUCCESS;
+		}
+	}
+	else
+	{
+		PlatformMoveMemory(pHalData->BufOfLines, pHalData->BufOfLines6, MAX_LINES_HWCONFIG_TXT*MAX_BYTES_LINE_HWCONFIG_TXT);
+		nLinesRead = pHalData->nLinesRead6;
+		rtStatus = RT_STATUS_SUCCESS;
+	}
+
+
+	if(rtStatus == RT_STATUS_SUCCESS)
+	{
+		RT_TRACE(COMP_INIT, DBG_LOUD, ("phy_ConfigBBWithMpParaFile(): read %s ok\n", pFileName));
+
+		for(ithLine = 0; ithLine < nLinesRead; ithLine++)
+		{
+			szLine = pHalData->BufOfLines[ithLine];
+
+			if(!IsCommentString(szLine))
+			{
+				// Get 1st hex value as register offset.
+				if(GetHexValueFromString(szLine, &u4bRegOffset, &u4bMove))
+				{
+					if(u4bRegOffset == 0xff)
+					{ // Ending.
+						break;
+					}
+					else if (u4bRegOffset == 0xfe)
+						delay_ms(50);
+					else if (u4bRegOffset == 0xfd)
+						delay_ms(5);
+					else if (u4bRegOffset == 0xfc)
+						delay_ms(1);
+					else if (u4bRegOffset == 0xfb)
+						PlatformStallExecution(50);
+					else if (u4bRegOffset == 0xfa)
+						PlatformStallExecution(5);
+					else if (u4bRegOffset == 0xf9)
+						PlatformStallExecution(1);
+
+					// Get 2nd hex value as register value.
+					szLine += u4bMove;
+					if(GetHexValueFromString(szLine, &u4bRegValue, &u4bMove))
+					{
+						RT_TRACE(COMP_FPGA, DBG_TRACE, ("[ADDR]%03lX=%08lX\n", u4bRegOffset, u4bRegValue));
+						PHY_SetBBReg(Adapter, u4bRegOffset, bMaskDWord, u4bRegValue);
+
+						// Add 1us delay between BB/RF register setting.
+						PlatformStallExecution(1);
+					}
+				}
+			}
+		}
+	}
+	else
+	{
+		RT_TRACE(COMP_INIT, DBG_LOUD, ("phy_ConfigBBWithMpParaFile(): Failed%s\n", pFileName));
+	}
+#endif
+
+	return rtStatus;
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	phy_ConfigBBWithMpHeaderFile
+ *
+ * Overview:	Config PHY_REG_MP array
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 02/04/2010	chiyokolin		Modify to new files.
+ *---------------------------------------------------------------------------*/
+static int
+phy_ConfigBBWithMpHeaderFile(
+	IN	PADAPTER		Adapter,
+	IN	u1Byte 			ConfigType)
+{
+	int i;
+	u32*	Rtl8192CPHY_REGArray_Table_MP;
+	u16	PHY_REGArrayMPLen;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	PHY_REGArrayMPLen = PHY_REG_Array_MPLength;
+	Rtl8192CPHY_REGArray_Table_MP = Rtl819XPHY_REG_Array_MP;
+
+	if(ConfigType == BaseBand_Config_PHY_REG)
+	{
+		for(i=0;i<PHY_REGArrayMPLen;i=i+2)
+		{
+			if (Rtl8192CPHY_REGArray_Table_MP[i] == 0xfe) {
+				#ifdef CONFIG_LONG_DELAY_ISSUE
+				rtw_msleep_os(50);
+				#else
+				rtw_mdelay_os(50);
+				#endif
+			}
+			else if (Rtl8192CPHY_REGArray_Table_MP[i] == 0xfd)
+				rtw_mdelay_os(5);
+			else if (Rtl8192CPHY_REGArray_Table_MP[i] == 0xfc)
+				rtw_mdelay_os(1);
+			else if (Rtl8192CPHY_REGArray_Table_MP[i] == 0xfb) {
+				#ifdef CONFIG_LONG_DELAY_ISSUE
+				rtw_msleep_os(50);
+				#else
+				rtw_mdelay_os(50);
+				#endif
+			}
+			else if (Rtl8192CPHY_REGArray_Table_MP[i] == 0xfa)
+				rtw_mdelay_os(5);
+			else if (Rtl8192CPHY_REGArray_Table_MP[i] == 0xf9)
+				rtw_mdelay_os(1);
+			PHY_SetBBReg(Adapter, Rtl8192CPHY_REGArray_Table_MP[i], bMaskDWord, Rtl8192CPHY_REGArray_Table_MP[i+1]);
+
+			// Add 1us delay between BB/RF register setting.
+			rtw_mdelay_os(1);
+
+//			RT_TRACE(COMP_INIT, DBG_TRACE, ("The Rtl8192CPHY_REGArray_Table_MP[%d] is %lx Rtl8192CPHY_REGArray_Table_MP[%d] is %lx \n", i, i+1, Rtl8192CPHY_REGArray_Table_MP[i], Rtl8192CPHY_REGArray_Table_MP[i+1]));
+		}
+	}
+	else
+	{
+//		RT_TRACE(COMP_SEND, DBG_LOUD, ("phy_ConfigBBWithMpHeaderFile(): ConfigType != BaseBand_Config_PHY_REG\n"));
+	}
+
+	return _SUCCESS;
+}	/* phy_ConfigBBWithMpHeaderFile */
+
+#endif	// #if (MP_DRIVER == 1)
+
+static VOID
+phy_BB8192C_Config_1T(
+	IN PADAPTER Adapter
+	)
+{
+#if 0
+	//for path - A
+	PHY_SetBBReg(Adapter, rFPGA0_TxInfo, 0x3, 0x1);
+	PHY_SetBBReg(Adapter, rFPGA1_TxInfo, 0x0303, 0x0101);
+	PHY_SetBBReg(Adapter, 0xe74, 0x0c000000, 0x1);
+	PHY_SetBBReg(Adapter, 0xe78, 0x0c000000, 0x1);
+	PHY_SetBBReg(Adapter, 0xe7c, 0x0c000000, 0x1);
+	PHY_SetBBReg(Adapter, 0xe80, 0x0c000000, 0x1);
+	PHY_SetBBReg(Adapter, 0xe88, 0x0c000000, 0x1);
+#endif
+	//for path - B
+	PHY_SetBBReg(Adapter, rFPGA0_TxInfo, 0x3, 0x2);
+	PHY_SetBBReg(Adapter, rFPGA1_TxInfo, 0x300033, 0x200022);
+
+	// 20100519 Joseph: Add for 1T2R config. Suggested by Kevin, Jenyu and Yunan.
+	PHY_SetBBReg(Adapter, rCCK0_AFESetting, bMaskByte3, 0x45);
+	PHY_SetBBReg(Adapter, rOFDM0_TRxPathEnable, bMaskByte0, 0x23);
+	PHY_SetBBReg(Adapter, rOFDM0_AGCParameter1, 0x30, 0x1);	// B path first AGC
+
+	PHY_SetBBReg(Adapter, 0xe74, 0x0c000000, 0x2);
+	PHY_SetBBReg(Adapter, 0xe78, 0x0c000000, 0x2);
+	PHY_SetBBReg(Adapter, 0xe7c, 0x0c000000, 0x2);
+	PHY_SetBBReg(Adapter, 0xe80, 0x0c000000, 0x2);
+	PHY_SetBBReg(Adapter, 0xe88, 0x0c000000, 0x2);
+
+
+}
+
+// Joseph test: new initialize order!!
+// Test only!! This part need to be re-organized.
+// Now it is just for 8256.
+static	int
+phy_BB8190_Config_HardCode(
+	IN	PADAPTER	Adapter
+	)
+{
+	//RT_ASSERT(FALSE, ("This function is not implement yet!! \n"));
+	return _SUCCESS;
+}
+
+static	int
+phy_BB8192C_Config_ParaFile(
+	IN	PADAPTER	Adapter
+	)
+{
+	EEPROM_EFUSE_PRIV	*pEEPROM = GET_EEPROM_EFUSE_PRIV(Adapter);
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	int			rtStatus = _SUCCESS;
+
+	u8				szBBRegPgFile[] = RTL819X_PHY_REG_PG;
+
+	u8				sz88CBBRegFile[] = RTL8188C_PHY_REG;
+	u8				sz88CAGCTableFile[] = RTL8188C_AGC_TAB;
+
+	u8				sz92CBBRegFile[] = RTL8192C_PHY_REG;
+	u8				sz92CAGCTableFile[] = RTL8192C_AGC_TAB;
+
+	u8				*pszBBRegFile, *pszAGCTableFile, *pszBBRegMpFile;
+
+	//RT_TRACE(COMP_INIT, DBG_TRACE, ("==>phy_BB8192S_Config_ParaFile\n"));
+
+	if(IS_92C_SERIAL(pHalData->VersionID)){
+		pszBBRegFile=(u8*)&sz92CBBRegFile ;
+		pszAGCTableFile =(u8*)&sz92CAGCTableFile;
+	}
+	else{
+		pszBBRegFile=(u8*)&sz88CBBRegFile ;
+		pszAGCTableFile =(u8*)&sz88CAGCTableFile;
+	}
+
+	//
+	// 1. Read PHY_REG.TXT BB INIT!!
+	// We will seperate as 88C / 92C according to chip version
+	//
+#ifdef CONFIG_EMBEDDED_FWIMG
+	rtStatus = phy_ConfigBBWithHeaderFile(Adapter, BaseBand_Config_PHY_REG);
+#else
+	// No matter what kind of CHIP we always read PHY_REG.txt. We must copy different
+	// type of parameter files to phy_reg.txt at first.
+	rtStatus = phy_ConfigBBWithParaFile(Adapter,pszBBRegFile);
+#endif
+
+	if(rtStatus != _SUCCESS){
+		//RT_TRACE(COMP_INIT, DBG_SERIOUS, ("phy_BB8192S_Config_ParaFile():Write BB Reg Fail!!"));
+		goto phy_BB8190_Config_ParaFile_Fail;
+	}
+
+#if MP_DRIVER == 1
+	//
+	// 1.1 Read PHY_REG_MP.TXT BB INIT!!
+	// We will seperate as 88C / 92C according to chip version
+	//
+#ifdef CONFIG_EMBEDDED_FWIMG
+	rtStatus = phy_ConfigBBWithMpHeaderFile(Adapter, BaseBand_Config_PHY_REG);
+#else
+	// No matter what kind of CHIP we always read PHY_REG.txt. We must copy different
+	// type of parameter files to phy_reg.txt at first.
+	rtStatus = phy_ConfigBBWithMpParaFile(Adapter, pszBBRegMpFile);
+#endif
+
+	if(rtStatus != _SUCCESS){
+//		RT_TRACE(COMP_INIT, DBG_SERIOUS, ("phy_BB8192S_Config_ParaFile():Write BB Reg MP Fail!!"));
+		goto phy_BB8190_Config_ParaFile_Fail;
+	}
+#endif	// #if (MP_DRIVER == 1)
+
+	//
+	// 20100318 Joseph: Config 2T2R to 1T2R if necessary.
+	//
+	if(pHalData->rf_type == RF_1T2R)
+	{
+		phy_BB8192C_Config_1T(Adapter);
+		DBG_8192C("phy_BB8192C_Config_ParaFile():Config to 1T!!\n");
+	}
+
+	//
+	// 2. If EEPROM or EFUSE autoload OK, We must config by PHY_REG_PG.txt
+	//
+	if (pEEPROM->bautoload_fail_flag == _FALSE)
+	{
+		pHalData->pwrGroupCnt = 0;
+
+#ifdef CONFIG_EMBEDDED_FWIMG
+		rtStatus = phy_ConfigBBWithPgHeaderFile(Adapter, BaseBand_Config_PHY_REG);
+#else
+		rtStatus = phy_ConfigBBWithPgParaFile(Adapter, (u8*)&szBBRegPgFile);
+#endif
+	}
+
+	if(rtStatus != _SUCCESS){
+		//RT_TRACE(COMP_INIT, DBG_SERIOUS, ("phy_BB8192S_Config_ParaFile():BB_PG Reg Fail!!"));
+		goto phy_BB8190_Config_ParaFile_Fail;
+	}
+
+	//
+	// 3. BB AGC table Initialization
+	//
+#ifdef CONFIG_EMBEDDED_FWIMG
+	rtStatus = phy_ConfigBBWithHeaderFile(Adapter, BaseBand_Config_AGC_TAB);
+#else
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("phy_BB8192S_Config_ParaFile AGC_TAB.txt\n"));
+	rtStatus = phy_ConfigBBWithParaFile(Adapter, pszAGCTableFile);
+#endif
+
+	if(rtStatus != _SUCCESS){
+		//RT_TRACE(COMP_FPGA, DBG_SERIOUS, ("phy_BB8192S_Config_ParaFile():AGC Table Fail\n"));
+		goto phy_BB8190_Config_ParaFile_Fail;
+	}
+
+	// Check if the CCK HighPower is turned ON.
+	// This is used to calculate PWDB.
+	pHalData->bCckHighPower = (BOOLEAN)(PHY_QueryBBReg(Adapter, rFPGA0_XA_HSSIParameter2, 0x200));
+
+phy_BB8190_Config_ParaFile_Fail:
+
+	return rtStatus;
+}
+
+
+int
+PHY_BBConfig8192C(
+	IN	PADAPTER	Adapter
+	)
+{
+	int	rtStatus = _SUCCESS;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u32	RegVal;
+	u8	TmpU1B=0;
+	u8	value8;
+
+	phy_InitBBRFRegisterDefinition(Adapter);
+
+	if(IS_HARDWARE_TYPE_8723A(Adapter))
+	{
+		// Suggested by Scott. tynli_test. 2010.12.30.
+		//1. 0x28[1] = 1
+		TmpU1B = rtw_read8(Adapter, REG_AFE_PLL_CTRL);
+		rtw_udelay_os(2);
+		rtw_write8(Adapter, REG_AFE_PLL_CTRL, (TmpU1B|BIT1));
+		rtw_udelay_os(2);
+
+		//2. 0x29[7:0] = 0xFF
+		rtw_write8(Adapter, REG_AFE_PLL_CTRL+1, 0xff);
+		rtw_udelay_os(2);
+
+		//3. 0x02[1:0] = 2b'11
+		TmpU1B = rtw_read8(Adapter, REG_SYS_FUNC_EN);
+		rtw_write8(Adapter, REG_SYS_FUNC_EN, (TmpU1B|FEN_BB_GLB_RSTn|FEN_BBRSTB));
+
+		//undo clock gated
+		rtw_write32(Adapter, rFPGA0_XCD_RFParameter, rtw_read32(Adapter, rFPGA0_XCD_RFParameter)&(~BIT31));
+
+		//4. 0x25[6] = 0
+		TmpU1B = rtw_read8(Adapter, REG_AFE_XTAL_CTRL+1);
+		rtw_write8(Adapter, REG_AFE_XTAL_CTRL+1, (TmpU1B&(~BIT6)));
+
+		//5. 0x24[20] = 0 	//Advised by SD3 Alex Wang. 2011.02.09.
+		TmpU1B = rtw_read8(Adapter, REG_AFE_XTAL_CTRL+2);
+		rtw_write8(Adapter, REG_AFE_XTAL_CTRL+2, (TmpU1B&(~BIT4)));
+
+		//6. 0x1f[7:0] = 0x07
+		rtw_write8(Adapter, REG_RF_CTRL, 0x07);
+	}
+	else
+	{
+		// Enable BB and RF
+		RegVal = rtw_read16(Adapter, REG_SYS_FUNC_EN);
+		rtw_write16(Adapter, REG_SYS_FUNC_EN, (u16)(RegVal|BIT13|BIT0|BIT1));
+
+		// 20090923 Joseph: Advised by Steven and Jenyu. Power sequence before init RF.
+		rtw_write8(Adapter, REG_AFE_PLL_CTRL, 0x83);
+		rtw_write8(Adapter, REG_AFE_PLL_CTRL+1, 0xdb);
+
+		rtw_write8(Adapter, REG_RF_CTRL, RF_EN|RF_RSTB|RF_SDMRSTB);
+
+#ifdef CONFIG_USB_HCI
+		rtw_write8(Adapter, REG_SYS_FUNC_EN, FEN_USBA | FEN_USBD | FEN_BB_GLB_RSTn | FEN_BBRSTB);
+#else
+		rtw_write8(Adapter, REG_SYS_FUNC_EN, FEN_PPLL|FEN_PCIEA|FEN_DIO_PCIE|FEN_BB_GLB_RSTn|FEN_BBRSTB);
+#endif
+
+		//undo clock gated
+		rtw_write32(Adapter, rFPGA0_XCD_RFParameter, rtw_read32(Adapter, rFPGA0_XCD_RFParameter)&(~BIT31));
+
+		// 2009/10/21 by SD1 Jong. Modified by tynli. Not in Documented in V8.1.
+#ifdef CONFIG_USB_HCI
+		//To Fix MAC loopback mode fail. Suggested by SD4 Johnny. 2010.03.23.
+		rtw_write8(Adapter, REG_LDOHCI12_CTRL, 0x0f);
+		rtw_write8(Adapter, 0x15, 0xe9);
+#endif
+
+		rtw_write8(Adapter, REG_AFE_XTAL_CTRL+1, 0x80);
+
+#ifdef CONFIG_PCI_HCI
+		// Force use left antenna by default for 88C.
+	//	if(!IS_92C_SERIAL(pHalData->VersionID) || IS_92C_1T2R(pHalData->VersionID))
+		if(Adapter->ledpriv.LedStrategy != SW_LED_MODE10)
+		{
+			RegVal = rtw_read32(Adapter, REG_LEDCFG0);
+			rtw_write32(Adapter, REG_LEDCFG0, RegVal|BIT23);
+		}
+#endif
+	}
+
+	//
+	// Config BB and AGC
+	//
+	rtStatus = phy_BB8192C_Config_ParaFile(Adapter);
+#if 0
+	switch(Adapter->MgntInfo.bRegHwParaFile)
+	{
+		case 0:
+			phy_BB8190_Config_HardCode(Adapter);
+			break;
+
+		case 1:
+			rtStatus = phy_BB8192C_Config_ParaFile(Adapter);
+			break;
+
+		case 2:
+			// Partial Modify.
+			phy_BB8190_Config_HardCode(Adapter);
+			phy_BB8192C_Config_ParaFile(Adapter);
+			break;
+
+		default:
+			phy_BB8190_Config_HardCode(Adapter);
+			break;
+	}
+#endif
+#ifdef CONFIG_USB_HCI
+	if(IS_HARDWARE_TYPE_8192CU(Adapter)&&IS_81xxC_VENDOR_UMC_B_CUT(pHalData->VersionID)
+		&&(pHalData->BoardType == BOARD_USB_High_PA))
+			rtw_write8(Adapter, 0xc72, 0x50);
+#endif
+
+	return rtStatus;
+}
+
+
+int
+PHY_RFConfig8192C(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	int		rtStatus = _SUCCESS;
+
+	//
+	// RF config
+	//
+	rtStatus = PHY_RF6052_Config8192C(Adapter);
+#if 0
+	switch(pHalData->rf_chip)
+	{
+		case RF_6052:
+			rtStatus = PHY_RF6052_Config(Adapter);
+			break;
+		case RF_8225:
+			rtStatus = PHY_RF8225_Config(Adapter);
+			break;
+		case RF_8256:
+			rtStatus = PHY_RF8256_Config(Adapter);
+			break;
+		case RF_8258:
+			break;
+		case RF_PSEUDO_11N:
+			rtStatus = PHY_RF8225_Config(Adapter);
+			break;
+		default: //for MacOs Warning: "RF_TYPE_MIN" not handled in switch
+			break;
+	}
+#endif
+	return rtStatus;
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:    PHY_ConfigRFWithParaFile()
+ *
+ * Overview:    This function read RF parameters from general file format, and do RF 3-wire
+ *
+ * Input:      	PADAPTER			Adapter
+ *			ps1Byte 				pFileName
+ *			RF_RADIO_PATH_E	eRFPath
+ *
+ * Output:      NONE
+ *
+ * Return:      RT_STATUS_SUCCESS: configuration file exist
+ *
+ * Note:		Delay may be required for RF configuration
+ *---------------------------------------------------------------------------*/
+int
+rtl8192c_PHY_ConfigRFWithParaFile(
+	IN	PADAPTER			Adapter,
+	IN	u8* 				pFileName,
+	RF_RADIO_PATH_E		eRFPath
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	int	rtStatus = _SUCCESS;
+
+
+	return rtStatus;
+
+}
+
+//****************************************
+// The following is for High Power PA
+//****************************************
+#define HighPowerRadioAArrayLen 22
+//This is for High power PA
+u32 Rtl8192S_HighPower_RadioA_Array[HighPowerRadioAArrayLen] = {
+0x013,0x00029ea4,
+0x013,0x00025e74,
+0x013,0x00020ea4,
+0x013,0x0001ced0,
+0x013,0x00019f40,
+0x013,0x00014e70,
+0x013,0x000106a0,
+0x013,0x0000c670,
+0x013,0x000082a0,
+0x013,0x00004270,
+0x013,0x00000240,
+};
+
+int
+PHY_ConfigRFExternalPA(
+	IN	PADAPTER			Adapter,
+	RF_RADIO_PATH_E		eRFPath
+)
+{
+	int	rtStatus = _SUCCESS;
+#ifdef CONFIG_USB_HCI
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u16 i=0;
+
+	if(!pHalData->ExternalPA)
+	{
+		return rtStatus;
+	}
+
+	// 2010/10/19 MH According to Jenyu/EEChou 's opinion, we need not to execute the
+	// same code as SU. It is already updated in radio_a_1T_HP.txt.
+#if 0
+	//add for SU High Power PA
+	for(i = 0;i<HighPowerRadioAArrayLen; i=i+2)
+	{
+		RT_TRACE(COMP_INIT, DBG_LOUD, ("External PA, write RF 0x%lx=0x%lx\n", Rtl8192S_HighPower_RadioA_Array[i], Rtl8192S_HighPower_RadioA_Array[i+1]));
+		PHY_SetRFReg(Adapter, eRFPath, Rtl8192S_HighPower_RadioA_Array[i], bRFRegOffsetMask, Rtl8192S_HighPower_RadioA_Array[i+1]);
+	}
+#endif
+
+#endif
+	return rtStatus;
+}
+//****************************************
+/*-----------------------------------------------------------------------------
+ * Function:    PHY_ConfigRFWithHeaderFile()
+ *
+ * Overview:    This function read RF parameters from general file format, and do RF 3-wire
+ *
+ * Input:      	PADAPTER			Adapter
+ *			ps1Byte 				pFileName
+ *			RF_RADIO_PATH_E	eRFPath
+ *
+ * Output:      NONE
+ *
+ * Return:      RT_STATUS_SUCCESS: configuration file exist
+ *
+ * Note:		Delay may be required for RF configuration
+ *---------------------------------------------------------------------------*/
+int
+rtl8192c_PHY_ConfigRFWithHeaderFile(
+	IN	PADAPTER			Adapter,
+	RF_RADIO_PATH_E		eRFPath
+)
+{
+
+	int			i;
+	int			rtStatus = _SUCCESS;
+	u32*		Rtl819XRadioA_Array_Table;
+	u32*		Rtl819XRadioB_Array_Table;
+	u16		RadioA_ArrayLen,RadioB_ArrayLen;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	//
+	// 2009.11.24. Modified by tynli.
+	//
+	if(IS_92C_SERIAL(pHalData->VersionID))
+	{
+		RadioA_ArrayLen = RadioA_2TArrayLength;
+		Rtl819XRadioA_Array_Table = Rtl819XRadioA_2TArray;
+		RadioB_ArrayLen = RadioB_2TArrayLength;
+		Rtl819XRadioB_Array_Table = Rtl819XRadioB_2TArray;
+	}
+	else
+	{
+		RadioA_ArrayLen = RadioA_1TArrayLength;
+		Rtl819XRadioA_Array_Table = Rtl819XRadioA_1TArray;
+		RadioB_ArrayLen = RadioB_1TArrayLength;
+		Rtl819XRadioB_Array_Table = Rtl819XRadioB_1TArray;
+#ifdef CONFIG_USB_HCI
+		if( BOARD_MINICARD == pHalData->BoardType )
+		{
+			RadioA_ArrayLen = RadioA_1T_mCardArrayLength;
+			Rtl819XRadioA_Array_Table = Rtl819XRadioA_1T_mCardArray;
+			RadioB_ArrayLen = RadioB_1T_mCardArrayLength;
+			Rtl819XRadioB_Array_Table = Rtl819XRadioB_1T_mCardArray;
+		}
+		else if( BOARD_USB_High_PA == pHalData->BoardType )
+		{
+			RadioA_ArrayLen = RadioA_1T_HPArrayLength;
+			Rtl819XRadioA_Array_Table = Rtl819XRadioA_1T_HPArray;
+		}
+#endif
+	}
+
+	switch(eRFPath){
+		case RF_PATH_A:
+			#ifdef CONFIG_IOL_RF_RF90_PATH_A
+			if(rtw_IOL_applied(Adapter))
+			{
+				struct xmit_frame	*xmit_frame;
+				if((xmit_frame=rtw_IOL_accquire_xmit_frame(Adapter)) == NULL) {
+					rtStatus = _FAIL;
+					goto exit;
+				}
+
+				for(i = 0;i<RadioA_ArrayLen; i=i+2)
+				{
+					if(Rtl819XRadioA_Array_Table[i] == 0xfe)
+						rtw_IOL_append_DELAY_MS_cmd(xmit_frame, 50);
+					else if (Rtl819XRadioA_Array_Table[i] == 0xfd)
+						rtw_IOL_append_DELAY_MS_cmd(xmit_frame, 5);
+					else if (Rtl819XRadioA_Array_Table[i] == 0xfc)
+						rtw_IOL_append_DELAY_MS_cmd(xmit_frame, 1);
+					else if (Rtl819XRadioA_Array_Table[i] == 0xfb)
+						rtw_IOL_append_DELAY_US_cmd(xmit_frame, 50);
+					else if (Rtl819XRadioA_Array_Table[i] == 0xfa)
+						rtw_IOL_append_DELAY_US_cmd(xmit_frame, 5);
+					else if (Rtl819XRadioA_Array_Table[i] == 0xf9)
+						rtw_IOL_append_DELAY_US_cmd(xmit_frame, 1);
+					else
+					{
+						BB_REGISTER_DEFINITION_T	*pPhyReg = &pHalData->PHYRegDef[eRFPath];
+						u32	NewOffset = 0;
+						u32	DataAndAddr = 0;
+
+						NewOffset = Rtl819XRadioA_Array_Table[i] & 0x3f;
+						DataAndAddr = ((NewOffset<<20) | (Rtl819XRadioA_Array_Table[i+1]&0x000fffff)) & 0x0fffffff;	// T65 RF
+						rtw_IOL_append_WD_cmd(xmit_frame, pPhyReg->rf3wireOffset, DataAndAddr);
+					}
+				}
+				rtStatus = rtw_IOL_exec_cmds_sync(Adapter, xmit_frame, 1000);
+			}
+			else
+			#endif
+			{
+				for(i = 0;i<RadioA_ArrayLen; i=i+2)
+				{
+					if(Rtl819XRadioA_Array_Table[i] == 0xfe) {
+						#ifdef CONFIG_LONG_DELAY_ISSUE
+						rtw_msleep_os(50);
+						#else
+						rtw_mdelay_os(50);
+						#endif
+					}
+					else if (Rtl819XRadioA_Array_Table[i] == 0xfd)
+						rtw_mdelay_os(5);
+					else if (Rtl819XRadioA_Array_Table[i] == 0xfc)
+						rtw_mdelay_os(1);
+					else if (Rtl819XRadioA_Array_Table[i] == 0xfb)
+						rtw_udelay_os(50);
+					else if (Rtl819XRadioA_Array_Table[i] == 0xfa)
+						rtw_udelay_os(5);
+					else if (Rtl819XRadioA_Array_Table[i] == 0xf9)
+						rtw_udelay_os(1);
+					else
+					{
+						PHY_SetRFReg(Adapter, eRFPath, Rtl819XRadioA_Array_Table[i], bRFRegOffsetMask, Rtl819XRadioA_Array_Table[i+1]);
+						// Add 1us delay between BB/RF register setting.
+						rtw_udelay_os(1);
+					}
+				}
+			}
+
+			//Add for High Power PA
+			PHY_ConfigRFExternalPA(Adapter, eRFPath);
+			break;
+		case RF_PATH_B:
+			#ifdef CONFIG_IOL_RF_RF90_PATH_B
+			if(rtw_IOL_applied(Adapter))
+			{
+				struct xmit_frame	*xmit_frame;
+				if((xmit_frame=rtw_IOL_accquire_xmit_frame(Adapter)) == NULL) {
+					rtStatus = _FAIL;
+					goto exit;
+				}
+
+				for(i = 0;i<RadioB_ArrayLen; i=i+2)
+				{
+					if(Rtl819XRadioB_Array_Table[i] == 0xfe)
+						rtw_IOL_append_DELAY_MS_cmd(xmit_frame, 50);
+					else if (Rtl819XRadioB_Array_Table[i] == 0xfd)
+						rtw_IOL_append_DELAY_MS_cmd(xmit_frame, 5);
+					else if (Rtl819XRadioB_Array_Table[i] == 0xfc)
+						rtw_IOL_append_DELAY_MS_cmd(xmit_frame, 1);
+					else if (Rtl819XRadioB_Array_Table[i] == 0xfb)
+						rtw_IOL_append_DELAY_US_cmd(xmit_frame, 50);
+					else if (Rtl819XRadioB_Array_Table[i] == 0xfa)
+						rtw_IOL_append_DELAY_US_cmd(xmit_frame, 5);
+					else if (Rtl819XRadioB_Array_Table[i] == 0xf9)
+						rtw_IOL_append_DELAY_US_cmd(xmit_frame, 1);
+					else
+					{
+						BB_REGISTER_DEFINITION_T	*pPhyReg = &pHalData->PHYRegDef[eRFPath];
+						u32	NewOffset = 0;
+						u32	DataAndAddr = 0;
+
+						NewOffset = Rtl819XRadioB_Array_Table[i] & 0x3f;
+						DataAndAddr = ((NewOffset<<20) | (Rtl819XRadioB_Array_Table[i+1]&0x000fffff)) & 0x0fffffff;	// T65 RF
+						rtw_IOL_append_WD_cmd(xmit_frame, pPhyReg->rf3wireOffset, DataAndAddr);
+					}
+				}
+				rtStatus = rtw_IOL_exec_cmds_sync(Adapter, xmit_frame, 1000);
+			}
+			else
+			#endif
+			{
+				for(i = 0;i<RadioB_ArrayLen; i=i+2)
+				{
+					if(Rtl819XRadioB_Array_Table[i] == 0xfe)
+					{ // Deay specific ms. Only RF configuration require delay.
+#if 0//#ifdef CONFIG_USB_HCI
+						#ifdef CONFIG_LONG_DELAY_ISSUE
+						rtw_msleep_os(1000);
+						#else
+						rtw_mdelay_os(1000);
+						#endif
+#else
+						#ifdef CONFIG_LONG_DELAY_ISSUE
+						rtw_msleep_os(50);
+						#else
+						rtw_mdelay_os(50);
+						#endif
+#endif
+					}
+					else if (Rtl819XRadioB_Array_Table[i] == 0xfd)
+						rtw_mdelay_os(5);
+					else if (Rtl819XRadioB_Array_Table[i] == 0xfc)
+						rtw_mdelay_os(1);
+					else if (Rtl819XRadioB_Array_Table[i] == 0xfb)
+						rtw_udelay_os(50);
+					else if (Rtl819XRadioB_Array_Table[i] == 0xfa)
+						rtw_udelay_os(5);
+					else if (Rtl819XRadioB_Array_Table[i] == 0xf9)
+						rtw_udelay_os(1);
+					else
+					{
+						PHY_SetRFReg(Adapter, eRFPath, Rtl819XRadioB_Array_Table[i], bRFRegOffsetMask, Rtl819XRadioB_Array_Table[i+1]);
+						// Add 1us delay between BB/RF register setting.
+						rtw_udelay_os(1);
+					}
+				}
+			}
+
+			break;
+		case RF_PATH_C:
+			break;
+		case RF_PATH_D:
+			break;
+	}
+
+exit:
+	return rtStatus;
+
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:    PHY_CheckBBAndRFOK()
+ *
+ * Overview:    This function is write register and then readback to make sure whether
+ *			  BB[PHY0, PHY1], RF[Patha, path b, path c, path d] is Ok
+ *
+ * Input:      	PADAPTER			Adapter
+ *			HW90_BLOCK_E		CheckBlock
+ *			RF_RADIO_PATH_E	eRFPath		// it is used only when CheckBlock is HW90_BLOCK_RF
+ *
+ * Output:      NONE
+ *
+ * Return:      RT_STATUS_SUCCESS: PHY is OK
+ *
+ * Note:		This function may be removed in the ASIC
+ *---------------------------------------------------------------------------*/
+int
+PHY_CheckBBAndRFOK(
+	IN	PADAPTER			Adapter,
+	IN	HW90_BLOCK_E		CheckBlock,
+	IN	RF_RADIO_PATH_E	eRFPath
+	)
+{
+	int			rtStatus = _SUCCESS;
+
+	u32				i, CheckTimes = 4,ulRegRead = 0;
+
+	u32				WriteAddr[4];
+	u32				WriteData[] = {0xfffff027, 0xaa55a02f, 0x00000027, 0x55aa502f};
+
+	// Initialize register address offset to be checked
+	WriteAddr[HW90_BLOCK_MAC] = 0x100;
+	WriteAddr[HW90_BLOCK_PHY0] = 0x900;
+	WriteAddr[HW90_BLOCK_PHY1] = 0x800;
+	WriteAddr[HW90_BLOCK_RF] = 0x3;
+
+	for(i=0 ; i < CheckTimes ; i++)
+	{
+
+		//
+		// Write Data to register and readback
+		//
+		switch(CheckBlock)
+		{
+		case HW90_BLOCK_MAC:
+			//RT_ASSERT(FALSE, ("PHY_CheckBBRFOK(): Never Write 0x100 here!"));
+			//RT_TRACE(COMP_INIT, DBG_LOUD, ("PHY_CheckBBRFOK(): Never Write 0x100 here!\n"));
+			break;
+
+		case HW90_BLOCK_PHY0:
+		case HW90_BLOCK_PHY1:
+			rtw_write32(Adapter, WriteAddr[CheckBlock], WriteData[i]);
+			ulRegRead = rtw_read32(Adapter, WriteAddr[CheckBlock]);
+			break;
+
+		case HW90_BLOCK_RF:
+			// When initialization, we want the delay function(delay_ms(), delay_us()
+			// ==> actually we call PlatformStallExecution()) to do NdisStallExecution()
+			// [busy wait] instead of NdisMSleep(). So we acquire RT_INITIAL_SPINLOCK
+			// to run at Dispatch level to achive it.
+			//cosa PlatformAcquireSpinLock(Adapter, RT_INITIAL_SPINLOCK);
+			WriteData[i] &= 0xfff;
+			PHY_SetRFReg(Adapter, eRFPath, WriteAddr[HW90_BLOCK_RF], bRFRegOffsetMask, WriteData[i]);
+			// TODO: we should not delay for such a long time. Ask SD3
+			rtw_mdelay_os(10);
+			ulRegRead = PHY_QueryRFReg(Adapter, eRFPath, WriteAddr[HW90_BLOCK_RF], bMaskDWord);
+			rtw_mdelay_os(10);
+			//cosa PlatformReleaseSpinLock(Adapter, RT_INITIAL_SPINLOCK);
+			break;
+
+		default:
+			rtStatus = _FAIL;
+			break;
+		}
+
+
+		//
+		// Check whether readback data is correct
+		//
+		if(ulRegRead != WriteData[i])
+		{
+			//RT_TRACE(COMP_FPGA, DBG_LOUD, ("ulRegRead: %lx, WriteData: %lx \n", ulRegRead, WriteData[i]));
+			rtStatus = _FAIL;
+			break;
+		}
+	}
+
+	return rtStatus;
+}
+
+
+VOID
+rtl8192c_PHY_GetHWRegOriginalValue(
+	IN	PADAPTER		Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	// read rx initial gain
+	pHalData->DefaultInitialGain[0] = (u8)PHY_QueryBBReg(Adapter, rOFDM0_XAAGCCore1, bMaskByte0);
+	pHalData->DefaultInitialGain[1] = (u8)PHY_QueryBBReg(Adapter, rOFDM0_XBAGCCore1, bMaskByte0);
+	pHalData->DefaultInitialGain[2] = (u8)PHY_QueryBBReg(Adapter, rOFDM0_XCAGCCore1, bMaskByte0);
+	pHalData->DefaultInitialGain[3] = (u8)PHY_QueryBBReg(Adapter, rOFDM0_XDAGCCore1, bMaskByte0);
+	//RT_TRACE(COMP_INIT, DBG_LOUD,
+	//("Default initial gain (c50=0x%x, c58=0x%x, c60=0x%x, c68=0x%x) \n",
+	//pHalData->DefaultInitialGain[0], pHalData->DefaultInitialGain[1],
+	//pHalData->DefaultInitialGain[2], pHalData->DefaultInitialGain[3]));
+
+	// read framesync
+	pHalData->framesync = (u8)PHY_QueryBBReg(Adapter, rOFDM0_RxDetector3, bMaskByte0);
+	pHalData->framesyncC34 = PHY_QueryBBReg(Adapter, rOFDM0_RxDetector2, bMaskDWord);
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Default framesync (0x%x) = 0x%x \n",
+	//	rOFDM0_RxDetector3, pHalData->framesync));
+}
+
+
+//
+//	Description:
+//		Map dBm into Tx power index according to
+//		current HW model, for example, RF and PA, and
+//		current wireless mode.
+//	By Bruce, 2008-01-29.
+//
+static	u8
+phy_DbmToTxPwrIdx(
+	IN	PADAPTER		Adapter,
+	IN	WIRELESS_MODE	WirelessMode,
+	IN	int			PowerInDbm
+	)
+{
+	u8				TxPwrIdx = 0;
+	int				Offset = 0;
+
+
+	//
+	// Tested by MP, we found that CCK Index 0 equals to 8dbm, OFDM legacy equals to
+	// 3dbm, and OFDM HT equals to 0dbm repectively.
+	// Note:
+	//	The mapping may be different by different NICs. Do not use this formula for what needs accurate result.
+	// By Bruce, 2008-01-29.
+	//
+	switch(WirelessMode)
+	{
+	case WIRELESS_MODE_B:
+		Offset = -7;
+		break;
+
+	case WIRELESS_MODE_G:
+	case WIRELESS_MODE_N_24G:
+		Offset = -8;
+		break;
+	default:
+		Offset = -8;
+		break;
+	}
+
+	if((PowerInDbm - Offset) > 0)
+	{
+		TxPwrIdx = (u8)((PowerInDbm - Offset) * 2);
+	}
+	else
+	{
+		TxPwrIdx = 0;
+	}
+
+	// Tx Power Index is too large.
+	if(TxPwrIdx > MAX_TXPWR_IDX_NMODE_92S)
+		TxPwrIdx = MAX_TXPWR_IDX_NMODE_92S;
+
+	return TxPwrIdx;
+}
+
+//
+//	Description:
+//		Map Tx power index into dBm according to
+//		current HW model, for example, RF and PA, and
+//		current wireless mode.
+//	By Bruce, 2008-01-29.
+//
+int
+phy_TxPwrIdxToDbm(
+	IN	PADAPTER		Adapter,
+	IN	WIRELESS_MODE	WirelessMode,
+	IN	u8			TxPwrIdx
+	)
+{
+	int				Offset = 0;
+	int				PwrOutDbm = 0;
+
+	//
+	// Tested by MP, we found that CCK Index 0 equals to -7dbm, OFDM legacy equals to -8dbm.
+	// Note:
+	//	The mapping may be different by different NICs. Do not use this formula for what needs accurate result.
+	// By Bruce, 2008-01-29.
+	//
+	switch(WirelessMode)
+	{
+	case WIRELESS_MODE_B:
+		Offset = -7;
+		break;
+
+	case WIRELESS_MODE_G:
+	case WIRELESS_MODE_N_24G:
+		Offset = -8;
+		break;
+	default:
+		Offset = -8;
+		break;
+	}
+
+	PwrOutDbm = TxPwrIdx / 2 + Offset; // Discard the decimal part.
+
+	return PwrOutDbm;
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:    GetTxPowerLevel8190()
+ *
+ * Overview:    This function is export to "common" moudule
+ *
+ * Input:       PADAPTER		Adapter
+ *			psByte			Power Level
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ *---------------------------------------------------------------------------*/
+VOID
+PHY_GetTxPowerLevel8192C(
+	IN	PADAPTER		Adapter,
+	OUT u32*    		powerlevel
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u8			TxPwrLevel = 0;
+	int			TxPwrDbm;
+
+	//
+	// Because the Tx power indexes are different, we report the maximum of them to
+	// meet the CCX TPC request. By Bruce, 2008-01-31.
+	//
+
+	// CCK
+	TxPwrLevel = pHalData->CurrentCckTxPwrIdx;
+	TxPwrDbm = phy_TxPwrIdxToDbm(Adapter, WIRELESS_MODE_B, TxPwrLevel);
+
+	// Legacy OFDM
+	TxPwrLevel = pHalData->CurrentOfdm24GTxPwrIdx + pHalData->LegacyHTTxPowerDiff;
+
+	// Compare with Legacy OFDM Tx power.
+	if(phy_TxPwrIdxToDbm(Adapter, WIRELESS_MODE_G, TxPwrLevel) > TxPwrDbm)
+		TxPwrDbm = phy_TxPwrIdxToDbm(Adapter, WIRELESS_MODE_G, TxPwrLevel);
+
+	// HT OFDM
+	TxPwrLevel = pHalData->CurrentOfdm24GTxPwrIdx;
+
+	// Compare with HT OFDM Tx power.
+	if(phy_TxPwrIdxToDbm(Adapter, WIRELESS_MODE_N_24G, TxPwrLevel) > TxPwrDbm)
+		TxPwrDbm = phy_TxPwrIdxToDbm(Adapter, WIRELESS_MODE_N_24G, TxPwrLevel);
+
+	*powerlevel = TxPwrDbm;
+}
+
+
+static void getTxPowerIndex(
+	IN	PADAPTER		Adapter,
+	IN	u8			channel,
+	IN OUT u8*		cckPowerLevel,
+	IN OUT u8*		ofdmPowerLevel
+	)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	u8				index = (channel -1);
+	// 1. CCK
+	cckPowerLevel[RF_PATH_A] = pHalData->TxPwrLevelCck[RF_PATH_A][index];	//RF-A
+	cckPowerLevel[RF_PATH_B] = pHalData->TxPwrLevelCck[RF_PATH_B][index];	//RF-B
+
+	// 2. OFDM for 1S or 2S
+	if (GET_RF_TYPE(Adapter) == RF_1T2R || GET_RF_TYPE(Adapter) == RF_1T1R)
+	{
+		// Read HT 40 OFDM TX power
+		ofdmPowerLevel[RF_PATH_A] = pHalData->TxPwrLevelHT40_1S[RF_PATH_A][index];
+		ofdmPowerLevel[RF_PATH_B] = pHalData->TxPwrLevelHT40_1S[RF_PATH_B][index];
+	}
+	else if (GET_RF_TYPE(Adapter) == RF_2T2R)
+	{
+		// Read HT 40 OFDM TX power
+		ofdmPowerLevel[RF_PATH_A] = pHalData->TxPwrLevelHT40_2S[RF_PATH_A][index];
+		ofdmPowerLevel[RF_PATH_B] = pHalData->TxPwrLevelHT40_2S[RF_PATH_B][index];
+	}
+	//RTPRINT(FPHY, PHY_TXPWR, ("Channel-%d, set tx power index !!\n", channel));
+}
+
+static void ccxPowerIndexCheck(
+	IN	PADAPTER		Adapter,
+	IN	u8			channel,
+	IN OUT u8*		cckPowerLevel,
+	IN OUT u8*		ofdmPowerLevel
+	)
+{
+#if 0
+	PMGNT_INFO			pMgntInfo = &(Adapter->MgntInfo);
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	PRT_CCX_INFO		pCcxInfo = GET_CCX_INFO(pMgntInfo);
+
+	//
+	// CCX 2 S31, AP control of client transmit power:
+	// 1. We shall not exceed Cell Power Limit as possible as we can.
+	// 2. Tolerance is +/- 5dB.
+	// 3. 802.11h Power Contraint takes higher precedence over CCX Cell Power Limit.
+	//
+	// TODO:
+	// 1. 802.11h power contraint
+	//
+	// 071011, by rcnjko.
+	//
+	if(	pMgntInfo->OpMode == RT_OP_MODE_INFRASTRUCTURE &&
+		pMgntInfo->mAssoc &&
+		pCcxInfo->bUpdateCcxPwr &&
+		pCcxInfo->bWithCcxCellPwr &&
+		channel == pMgntInfo->dot11CurrentChannelNumber)
+	{
+		u1Byte	CckCellPwrIdx = phy_DbmToTxPwrIdx(Adapter, WIRELESS_MODE_B, pCcxInfo->CcxCellPwr);
+		u1Byte	LegacyOfdmCellPwrIdx = phy_DbmToTxPwrIdx(Adapter, WIRELESS_MODE_G, pCcxInfo->CcxCellPwr);
+		u1Byte	OfdmCellPwrIdx = phy_DbmToTxPwrIdx(Adapter, WIRELESS_MODE_N_24G, pCcxInfo->CcxCellPwr);
+
+		RT_TRACE(COMP_TXAGC, DBG_LOUD,
+		("CCX Cell Limit: %d dbm => CCK Tx power index : %d, Legacy OFDM Tx power index : %d, OFDM Tx power index: %d\n",
+		pCcxInfo->CcxCellPwr, CckCellPwrIdx, LegacyOfdmCellPwrIdx, OfdmCellPwrIdx));
+		RT_TRACE(COMP_TXAGC, DBG_LOUD,
+		("EEPROM channel(%d) => CCK Tx power index: %d, Legacy OFDM Tx power index : %d, OFDM Tx power index: %d\n",
+		channel, cckPowerLevel[0], ofdmPowerLevel[0] + pHalData->LegacyHTTxPowerDiff, ofdmPowerLevel[0]));
+
+		// CCK
+		if(cckPowerLevel[0] > CckCellPwrIdx)
+			cckPowerLevel[0] = CckCellPwrIdx;
+		// Legacy OFDM, HT OFDM
+		if(ofdmPowerLevel[0] + pHalData->LegacyHTTxPowerDiff > LegacyOfdmCellPwrIdx)
+		{
+			if((OfdmCellPwrIdx - pHalData->LegacyHTTxPowerDiff) > 0)
+			{
+				ofdmPowerLevel[0] = OfdmCellPwrIdx - pHalData->LegacyHTTxPowerDiff;
+			}
+			else
+			{
+				ofdmPowerLevel[0] = 0;
+			}
+		}
+
+		RT_TRACE(COMP_TXAGC, DBG_LOUD,
+		("Altered CCK Tx power index : %d, Legacy OFDM Tx power index: %d, OFDM Tx power index: %d\n",
+		cckPowerLevel[0], ofdmPowerLevel[0] + pHalData->LegacyHTTxPowerDiff, ofdmPowerLevel[0]));
+	}
+
+	pHalData->CurrentCckTxPwrIdx = cckPowerLevel[0];
+	pHalData->CurrentOfdm24GTxPwrIdx = ofdmPowerLevel[0];
+
+	RT_TRACE(COMP_TXAGC, DBG_LOUD,
+		("PHY_SetTxPowerLevel8192S(): CCK Tx power index : %d, Legacy OFDM Tx power index: %d, OFDM Tx power index: %d\n",
+		cckPowerLevel[0], ofdmPowerLevel[0] + pHalData->LegacyHTTxPowerDiff, ofdmPowerLevel[0]));
+#endif
+}
+/*-----------------------------------------------------------------------------
+ * Function:    SetTxPowerLevel8190()
+ *
+ * Overview:    This function is export to "HalCommon" moudule
+ *			We must consider RF path later!!!!!!!
+ *
+ * Input:       PADAPTER		Adapter
+ *			u1Byte		channel
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *	2008/11/04	MHC		We remove EEPROM_93C56.
+ *						We need to move CCX relative code to independet file.
+ *	2009/01/21	MHC		Support new EEPROM format from SD3 requirement.
+ *
+ *---------------------------------------------------------------------------*/
+VOID
+PHY_SetTxPowerLevel8192C(
+	IN	PADAPTER		Adapter,
+	IN	u8			channel
+	)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	u8	cckPowerLevel[2], ofdmPowerLevel[2];	// [0]:RF-A, [1]:RF-B
+
+#if(MP_DRIVER == 1)
+	return;
+#endif
+
+	if(pHalData->bTXPowerDataReadFromEEPORM == _FALSE)
+		return;
+
+	getTxPowerIndex(Adapter, channel, &cckPowerLevel[0], &ofdmPowerLevel[0]);
+	//RTPRINT(FPHY, PHY_TXPWR, ("Channel-%d, cckPowerLevel (A / B) = 0x%x / 0x%x,   ofdmPowerLevel (A / B) = 0x%x / 0x%x\n",
+	//	channel, cckPowerLevel[0], cckPowerLevel[1], ofdmPowerLevel[0], ofdmPowerLevel[1]));
+
+	ccxPowerIndexCheck(Adapter, channel, &cckPowerLevel[0], &ofdmPowerLevel[0]);
+
+	rtl8192c_PHY_RF6052SetCckTxPower(Adapter, &cckPowerLevel[0]);
+	rtl8192c_PHY_RF6052SetOFDMTxPower(Adapter, &ofdmPowerLevel[0], channel);
+
+#if 0
+	switch(pHalData->rf_chip)
+	{
+		case RF_8225:
+			PHY_SetRF8225CckTxPower(Adapter, cckPowerLevel[0]);
+			PHY_SetRF8225OfdmTxPower(Adapter, ofdmPowerLevel[0]);
+		break;
+
+		case RF_8256:
+			PHY_SetRF8256CCKTxPower(Adapter, cckPowerLevel[0]);
+			PHY_SetRF8256OFDMTxPower(Adapter, ofdmPowerLevel[0]);
+			break;
+
+		case RF_6052:
+			PHY_RF6052SetCckTxPower(Adapter, &cckPowerLevel[0]);
+			PHY_RF6052SetOFDMTxPower(Adapter, &ofdmPowerLevel[0], channel);
+			break;
+
+		case RF_8258:
+			break;
+	}
+#endif
+
+}
+
+
+//
+//	Description:
+//		Update transmit power level of all channel supported.
+//
+//	TODO:
+//		A mode.
+//	By Bruce, 2008-02-04.
+//
+BOOLEAN
+PHY_UpdateTxPowerDbm8192C(
+	IN	PADAPTER	Adapter,
+	IN	int		powerInDbm
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u8				idx;
+	u8			rf_path;
+
+	// TODO: A mode Tx power.
+	u8	CckTxPwrIdx = phy_DbmToTxPwrIdx(Adapter, WIRELESS_MODE_B, powerInDbm);
+	u8	OfdmTxPwrIdx = phy_DbmToTxPwrIdx(Adapter, WIRELESS_MODE_N_24G, powerInDbm);
+
+	if(OfdmTxPwrIdx - pHalData->LegacyHTTxPowerDiff > 0)
+		OfdmTxPwrIdx -= pHalData->LegacyHTTxPowerDiff;
+	else
+		OfdmTxPwrIdx = 0;
+
+	//RT_TRACE(COMP_TXAGC, DBG_LOUD, ("PHY_UpdateTxPowerDbm8192S(): %ld dBm , CckTxPwrIdx = %d, OfdmTxPwrIdx = %d\n", powerInDbm, CckTxPwrIdx, OfdmTxPwrIdx));
+
+	for(idx = 0; idx < 14; idx++)
+	{
+		for (rf_path = 0; rf_path < 2; rf_path++)
+		{
+			pHalData->TxPwrLevelCck[rf_path][idx] = CckTxPwrIdx;
+			pHalData->TxPwrLevelHT40_1S[rf_path][idx] =
+			pHalData->TxPwrLevelHT40_2S[rf_path][idx] = OfdmTxPwrIdx;
+		}
+	}
+
+	//Adapter->HalFunc.SetTxPowerLevelHandler(Adapter, pHalData->CurrentChannel);//gtest:todo
+
+	return _TRUE;
+}
+
+
+/*
+	Description:
+		When beacon interval is changed, the values of the
+		hw registers should be modified.
+	By tynli, 2008.10.24.
+
+*/
+
+
+void
+rtl8192c_PHY_SetBeaconHwReg(
+	IN	PADAPTER		Adapter,
+	IN	u16			BeaconInterval
+	)
+{
+
+}
+
+
+VOID
+PHY_ScanOperationBackup8192C(
+	IN	PADAPTER	Adapter,
+	IN	u8		Operation
+	)
+{
+#if 0
+	IO_TYPE	IoType;
+
+	if(!Adapter->bDriverStopped)
+	{
+		switch(Operation)
+		{
+			case SCAN_OPT_BACKUP:
+				IoType = IO_CMD_PAUSE_DM_BY_SCAN;
+				rtw_hal_set_hwreg(Adapter,HW_VAR_IO_CMD,  (pu1Byte)&IoType);
+
+				break;
+
+			case SCAN_OPT_RESTORE:
+				IoType = IO_CMD_RESUME_DM_BY_SCAN;
+				rtw_hal_set_hwreg(Adapter,HW_VAR_IO_CMD,  (pu1Byte)&IoType);
+				break;
+
+			default:
+				RT_TRACE(COMP_SCAN, DBG_LOUD, ("Unknown Scan Backup Operation. \n"));
+				break;
+		}
+	}
+#endif
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:    PHY_SetBWModeCallback8192C()
+ *
+ * Overview:    Timer callback function for SetSetBWMode
+ *
+ * Input:       	PRT_TIMER		pTimer
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Note:		(1) We do not take j mode into consideration now
+ *			(2) Will two workitem of "switch channel" and "switch channel bandwidth" run
+ *			     concurrently?
+ *---------------------------------------------------------------------------*/
+static VOID
+_PHY_SetBWMode92C(
+	IN	PADAPTER	Adapter
+)
+{
+//	PADAPTER			Adapter = (PADAPTER)pTimer->Adapter;
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	u8				regBwOpMode;
+	u8				regRRSR_RSC;
+
+	//return;
+
+	// Added it for 20/40 mhz switch time evaluation by guangan 070531
+	//u4Byte				NowL, NowH;
+	//u8Byte				BeginTime, EndTime;
+
+	/*RT_TRACE(COMP_SCAN, DBG_LOUD, ("==>PHY_SetBWModeCallback8192C()  Switch to %s bandwidth\n", \
+					pHalData->CurrentChannelBW == HT_CHANNEL_WIDTH_20?"20MHz":"40MHz"))*/
+
+	if(pHalData->rf_chip == RF_PSEUDO_11N)
+	{
+		//pHalData->SetBWModeInProgress= _FALSE;
+		return;
+	}
+
+	// There is no 40MHz mode in RF_8225.
+	if(pHalData->rf_chip==RF_8225)
+		return;
+
+	if(Adapter->bDriverStopped)
+		return;
+
+	// Added it for 20/40 mhz switch time evaluation by guangan 070531
+	//NowL = PlatformEFIORead4Byte(Adapter, TSFR);
+	//NowH = PlatformEFIORead4Byte(Adapter, TSFR+4);
+	//BeginTime = ((u8Byte)NowH << 32) + NowL;
+
+	//3//
+	//3//<1>Set MAC register
+	//3//
+	//Adapter->HalFunc.SetBWModeHandler();
+
+	regBwOpMode = rtw_read8(Adapter, REG_BWOPMODE);
+	regRRSR_RSC = rtw_read8(Adapter, REG_RRSR+2);
+	//regBwOpMode = rtw_hal_get_hwreg(Adapter,HW_VAR_BWMODE,(pu1Byte)&regBwOpMode);
+
+	switch(pHalData->CurrentChannelBW)
+	{
+		case HT_CHANNEL_WIDTH_20:
+			regBwOpMode |= BW_OPMODE_20MHZ;
+			   // 2007/02/07 Mark by Emily becasue we have not verify whether this register works
+			rtw_write8(Adapter, REG_BWOPMODE, regBwOpMode);
+			break;
+
+		case HT_CHANNEL_WIDTH_40:
+			regBwOpMode &= ~BW_OPMODE_20MHZ;
+				// 2007/02/07 Mark by Emily becasue we have not verify whether this register works
+			rtw_write8(Adapter, REG_BWOPMODE, regBwOpMode);
+
+			regRRSR_RSC = (regRRSR_RSC&0x90) |(pHalData->nCur40MhzPrimeSC<<5);
+			rtw_write8(Adapter, REG_RRSR+2, regRRSR_RSC);
+			break;
+
+		default:
+			/*RT_TRACE(COMP_DBG, DBG_LOUD, ("PHY_SetBWModeCallback8192C():
+						unknown Bandwidth: %#X\n",pHalData->CurrentChannelBW));*/
+			break;
+	}
+
+	//3//
+	//3//<2>Set PHY related register
+	//3//
+	switch(pHalData->CurrentChannelBW)
+	{
+		/* 20 MHz channel*/
+		case HT_CHANNEL_WIDTH_20:
+			PHY_SetBBReg(Adapter, rFPGA0_RFMOD, bRFMOD, 0x0);
+			PHY_SetBBReg(Adapter, rFPGA1_RFMOD, bRFMOD, 0x0);
+			PHY_SetBBReg(Adapter, rFPGA0_AnalogParameter2, BIT10, 1);
+
+			break;
+
+
+		/* 40 MHz channel*/
+		case HT_CHANNEL_WIDTH_40:
+			PHY_SetBBReg(Adapter, rFPGA0_RFMOD, bRFMOD, 0x1);
+			PHY_SetBBReg(Adapter, rFPGA1_RFMOD, bRFMOD, 0x1);
+
+			// Set Control channel to upper or lower. These settings are required only for 40MHz
+			PHY_SetBBReg(Adapter, rCCK0_System, bCCKSideBand, (pHalData->nCur40MhzPrimeSC>>1));
+			PHY_SetBBReg(Adapter, rOFDM1_LSTF, 0xC00, pHalData->nCur40MhzPrimeSC);
+			PHY_SetBBReg(Adapter, rFPGA0_AnalogParameter2, BIT10, 0);
+
+			PHY_SetBBReg(Adapter, 0x818, (BIT26|BIT27), (pHalData->nCur40MhzPrimeSC==HAL_PRIME_CHNL_OFFSET_LOWER)?2:1);
+
+			break;
+
+
+
+		default:
+			/*RT_TRACE(COMP_DBG, DBG_LOUD, ("PHY_SetBWModeCallback8192C(): unknown Bandwidth: %#X\n"\
+						,pHalData->CurrentChannelBW));*/
+			break;
+
+	}
+	//Skip over setting of J-mode in BB register here. Default value is "None J mode". Emily 20070315
+
+	// Added it for 20/40 mhz switch time evaluation by guangan 070531
+	//NowL = PlatformEFIORead4Byte(Adapter, TSFR);
+	//NowH = PlatformEFIORead4Byte(Adapter, TSFR+4);
+	//EndTime = ((u8Byte)NowH << 32) + NowL;
+	//RT_TRACE(COMP_SCAN, DBG_LOUD, ("SetBWModeCallback8190Pci: time of SetBWMode = %I64d us!\n", (EndTime - BeginTime)));
+
+	//3<3>Set RF related register
+	switch(pHalData->rf_chip)
+	{
+		case RF_8225:
+			//PHY_SetRF8225Bandwidth(Adapter, pHalData->CurrentChannelBW);
+			break;
+
+		case RF_8256:
+			// Please implement this function in Hal8190PciPhy8256.c
+			//PHY_SetRF8256Bandwidth(Adapter, pHalData->CurrentChannelBW);
+			break;
+
+		case RF_8258:
+			// Please implement this function in Hal8190PciPhy8258.c
+			// PHY_SetRF8258Bandwidth();
+			break;
+
+		case RF_PSEUDO_11N:
+			// Do Nothing
+			break;
+
+		case RF_6052:
+			rtl8192c_PHY_RF6052SetBandwidth(Adapter, pHalData->CurrentChannelBW);
+			break;
+
+		default:
+			//RT_ASSERT(FALSE, ("Unknown RFChipID: %d\n", pHalData->RFChipID));
+			break;
+	}
+
+	//pHalData->SetBWModeInProgress= FALSE;
+
+	//RT_TRACE(COMP_SCAN, DBG_LOUD, ("<==PHY_SetBWModeCallback8192C() \n" ));
+}
+
+
+ /*-----------------------------------------------------------------------------
+ * Function:   SetBWMode8190Pci()
+ *
+ * Overview:  This function is export to "HalCommon" moudule
+ *
+ * Input:       	PADAPTER			Adapter
+ *			HT_CHANNEL_WIDTH	Bandwidth	//20M or 40M
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Note:		We do not take j mode into consideration now
+ *---------------------------------------------------------------------------*/
+VOID
+PHY_SetBWMode8192C(
+	IN	PADAPTER					Adapter,
+	IN	HT_CHANNEL_WIDTH	Bandwidth,	// 20M or 40M
+	IN	unsigned char	Offset		// Upper, Lower, or Don't care
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	HT_CHANNEL_WIDTH 	tmpBW= pHalData->CurrentChannelBW;
+	// Modified it for 20/40 mhz switch by guangan 070531
+	//PMGNT_INFO	pMgntInfo=&Adapter->MgntInfo;
+
+	//return;
+
+	//if(pHalData->SwChnlInProgress)
+//	if(pMgntInfo->bScanInProgress)
+//	{
+//		RT_TRACE(COMP_SCAN, DBG_LOUD, ("PHY_SetBWMode8192C() %s Exit because bScanInProgress!\n",
+//					Bandwidth == HT_CHANNEL_WIDTH_20?"20MHz":"40MHz"));
+//		return;
+//	}
+
+//	if(pHalData->SetBWModeInProgress)
+//	{
+//		// Modified it for 20/40 mhz switch by guangan 070531
+//		RT_TRACE(COMP_SCAN, DBG_LOUD, ("PHY_SetBWMode8192C() %s cancel last timer because SetBWModeInProgress!\n",
+//					Bandwidth == HT_CHANNEL_WIDTH_20?"20MHz":"40MHz"));
+//		PlatformCancelTimer(Adapter, &pHalData->SetBWModeTimer);
+//		//return;
+//	}
+
+	//if(pHalData->SetBWModeInProgress)
+	//	return;
+
+	//pHalData->SetBWModeInProgress= TRUE;
+
+	pHalData->CurrentChannelBW = Bandwidth;
+
+#if 0
+	if(Offset==HT_EXTCHNL_OFFSET_LOWER)
+		pHalData->nCur40MhzPrimeSC = HAL_PRIME_CHNL_OFFSET_UPPER;
+	else if(Offset==HT_EXTCHNL_OFFSET_UPPER)
+		pHalData->nCur40MhzPrimeSC = HAL_PRIME_CHNL_OFFSET_LOWER;
+	else
+		pHalData->nCur40MhzPrimeSC = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+#else
+	pHalData->nCur40MhzPrimeSC = Offset;
+#endif
+
+	if((!Adapter->bDriverStopped) && (!Adapter->bSurpriseRemoved))
+	{
+#ifdef USE_WORKITEM
+		//PlatformScheduleWorkItem(&(pHalData->SetBWModeWorkItem));
+#else
+	#if 0
+		//PlatformSetTimer(Adapter, &(pHalData->SetBWModeTimer), 0);
+	#else
+		_PHY_SetBWMode92C(Adapter);
+	#endif
+#endif
+	}
+	else
+	{
+		//RT_TRACE(COMP_SCAN, DBG_LOUD, ("PHY_SetBWMode8192C() SetBWModeInProgress FALSE driver sleep or unload\n"));
+		//pHalData->SetBWModeInProgress= FALSE;
+		pHalData->CurrentChannelBW = tmpBW;
+	}
+
+}
+
+
+static void _PHY_SwChnl8192C(PADAPTER Adapter, u8 channel)
+{
+	u8 eRFPath;
+	u32 param1, param2;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	if ( Adapter->bNotifyChannelChange )
+	{
+		DBG_871X( "[%s] ch = %d\n", __FUNCTION__, channel );
+	}
+
+	//s1. pre common command - CmdID_SetTxPowerLevel
+	PHY_SetTxPowerLevel8192C(Adapter, channel);
+
+	//s2. RF dependent command - CmdID_RF_WriteReg, param1=RF_CHNLBW, param2=channel
+	param1 = RF_CHNLBW;
+	param2 = channel;
+	for(eRFPath = 0; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+	{
+		pHalData->RfRegChnlVal[eRFPath] = ((pHalData->RfRegChnlVal[eRFPath] & 0xfffffc00) | param2);
+		PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)eRFPath, param1, bRFRegOffsetMask, pHalData->RfRegChnlVal[eRFPath]);
+	}
+
+
+	//s3. post common command - CmdID_End, None
+
+}
+
+VOID
+PHY_SwChnl8192C(	// Call after initialization
+	IN	PADAPTER	Adapter,
+	IN	u8		channel
+	)
+{
+	//PADAPTER Adapter =  ADJUST_TO_ADAPTIVE_ADAPTER(pAdapter, _TRUE);
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u8	tmpchannel = pHalData->CurrentChannel;
+	BOOLEAN  bResult = _TRUE;
+
+	if(pHalData->rf_chip == RF_PSEUDO_11N)
+	{
+		//pHalData->SwChnlInProgress=FALSE;
+		return; 								//return immediately if it is peudo-phy
+	}
+
+	//if(pHalData->SwChnlInProgress)
+	//	return;
+
+	//if(pHalData->SetBWModeInProgress)
+	//	return;
+
+	//--------------------------------------------
+	switch(pHalData->CurrentWirelessMode)
+	{
+		case WIRELESS_MODE_A:
+		case WIRELESS_MODE_N_5G:
+			//RT_ASSERT((channel>14), ("WIRELESS_MODE_A but channel<=14"));
+			break;
+
+		case WIRELESS_MODE_B:
+			//RT_ASSERT((channel<=14), ("WIRELESS_MODE_B but channel>14"));
+			break;
+
+		case WIRELESS_MODE_G:
+		case WIRELESS_MODE_N_24G:
+			//RT_ASSERT((channel<=14), ("WIRELESS_MODE_G but channel>14"));
+			break;
+
+		default:
+			//RT_ASSERT(FALSE, ("Invalid WirelessMode(%#x)!!\n", pHalData->CurrentWirelessMode));
+			break;
+	}
+	//--------------------------------------------
+
+	//pHalData->SwChnlInProgress = TRUE;
+	if(channel == 0)
+		channel = 1;
+
+	pHalData->CurrentChannel=channel;
+
+	//pHalData->SwChnlStage=0;
+	//pHalData->SwChnlStep=0;
+
+	if((!Adapter->bDriverStopped) && (!Adapter->bSurpriseRemoved))
+	{
+#ifdef USE_WORKITEM
+		//bResult = PlatformScheduleWorkItem(&(pHalData->SwChnlWorkItem));
+#else
+		#if 0
+		//PlatformSetTimer(Adapter, &(pHalData->SwChnlTimer), 0);
+		#else
+		_PHY_SwChnl8192C(Adapter, channel);
+		#endif
+#endif
+		if(bResult)
+		{
+			//RT_TRACE(COMP_SCAN, DBG_LOUD, ("PHY_SwChnl8192C SwChnlInProgress TRUE schdule workitem done\n"));
+		}
+		else
+		{
+			//RT_TRACE(COMP_SCAN, DBG_LOUD, ("PHY_SwChnl8192C SwChnlInProgress FALSE schdule workitem error\n"));
+			//if(IS_HARDWARE_TYPE_8192SU(Adapter))
+			//{
+			//	pHalData->SwChnlInProgress = FALSE;
+				pHalData->CurrentChannel = tmpchannel;
+			//}
+		}
+
+	}
+	else
+	{
+		//RT_TRACE(COMP_SCAN, DBG_LOUD, ("PHY_SwChnl8192C SwChnlInProgress FALSE driver sleep or unload\n"));
+		//if(IS_HARDWARE_TYPE_8192SU(Adapter))
+		//{
+		//	pHalData->SwChnlInProgress = FALSE;
+			pHalData->CurrentChannel = tmpchannel;
+		//}
+	}
+}
+
+
+static	BOOLEAN
+phy_SwChnlStepByStep(
+	IN	PADAPTER	Adapter,
+	IN	u8		channel,
+	IN	u8		*stage,
+	IN	u8		*step,
+	OUT u32		*delay
+	)
+{
+#if 0
+	HAL_DATA_TYPE			*pHalData = GET_HAL_DATA(Adapter);
+	PCHANNEL_ACCESS_SETTING	pChnlAccessSetting;
+	SwChnlCmd				PreCommonCmd[MAX_PRECMD_CNT];
+	u4Byte					PreCommonCmdCnt;
+	SwChnlCmd				PostCommonCmd[MAX_POSTCMD_CNT];
+	u4Byte					PostCommonCmdCnt;
+	SwChnlCmd				RfDependCmd[MAX_RFDEPENDCMD_CNT];
+	u4Byte					RfDependCmdCnt;
+	SwChnlCmd				*CurrentCmd;
+	u1Byte					eRFPath;
+	u4Byte					RfTXPowerCtrl;
+	BOOLEAN					bAdjRfTXPowerCtrl = _FALSE;
+
+
+	RT_ASSERT((Adapter != NULL), ("Adapter should not be NULL\n"));
+#if(MP_DRIVER != 1)
+	RT_ASSERT(IsLegalChannel(Adapter, channel), ("illegal channel: %d\n", channel));
+#endif
+	RT_ASSERT((pHalData != NULL), ("pHalData should not be NULL\n"));
+
+	pChnlAccessSetting = &Adapter->MgntInfo.Info8185.ChannelAccessSetting;
+	RT_ASSERT((pChnlAccessSetting != NULL), ("pChnlAccessSetting should not be NULL\n"));
+
+	//for(eRFPath = RF_PATH_A; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+	//for(eRFPath = 0; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+	//{
+		// <1> Fill up pre common command.
+	PreCommonCmdCnt = 0;
+	phy_SetSwChnlCmdArray(PreCommonCmd, PreCommonCmdCnt++, MAX_PRECMD_CNT,
+				CmdID_SetTxPowerLevel, 0, 0, 0);
+	phy_SetSwChnlCmdArray(PreCommonCmd, PreCommonCmdCnt++, MAX_PRECMD_CNT,
+				CmdID_End, 0, 0, 0);
+
+		// <2> Fill up post common command.
+	PostCommonCmdCnt = 0;
+
+	phy_SetSwChnlCmdArray(PostCommonCmd, PostCommonCmdCnt++, MAX_POSTCMD_CNT,
+				CmdID_End, 0, 0, 0);
+
+		// <3> Fill up RF dependent command.
+	RfDependCmdCnt = 0;
+	switch( pHalData->RFChipID )
+	{
+		case RF_8225:
+		RT_ASSERT((channel >= 1 && channel <= 14), ("illegal channel for Zebra: %d\n", channel));
+		// 2008/09/04 MH Change channel.
+		if(channel==14) channel++;
+		phy_SetSwChnlCmdArray(RfDependCmd, RfDependCmdCnt++, MAX_RFDEPENDCMD_CNT,
+			CmdID_RF_WriteReg, rZebra1_Channel, (0x10+channel-1), 10);
+		phy_SetSwChnlCmdArray(RfDependCmd, RfDependCmdCnt++, MAX_RFDEPENDCMD_CNT,
+		CmdID_End, 0, 0, 0);
+		break;
+
+	case RF_8256:
+		// TEST!! This is not the table for 8256!!
+		RT_ASSERT((channel >= 1 && channel <= 14), ("illegal channel for Zebra: %d\n", channel));
+		phy_SetSwChnlCmdArray(RfDependCmd, RfDependCmdCnt++, MAX_RFDEPENDCMD_CNT,
+			CmdID_RF_WriteReg, rRfChannel, channel, 10);
+		phy_SetSwChnlCmdArray(RfDependCmd, RfDependCmdCnt++, MAX_RFDEPENDCMD_CNT,
+		CmdID_End, 0, 0, 0);
+		break;
+
+	case RF_6052:
+		RT_ASSERT((channel >= 1 && channel <= 14), ("illegal channel for Zebra: %d\n", channel));
+		phy_SetSwChnlCmdArray(RfDependCmd, RfDependCmdCnt++, MAX_RFDEPENDCMD_CNT,
+			CmdID_RF_WriteReg, RF_CHNLBW, channel, 10);
+		phy_SetSwChnlCmdArray(RfDependCmd, RfDependCmdCnt++, MAX_RFDEPENDCMD_CNT,
+		CmdID_End, 0, 0, 0);
+
+		break;
+
+	case RF_8258:
+		break;
+
+	// For FPGA two MAC verification
+	case RF_PSEUDO_11N:
+		return TRUE;
+	default:
+		RT_ASSERT(FALSE, ("Unknown RFChipID: %d\n", pHalData->RFChipID));
+		return FALSE;
+		break;
+	}
+
+
+	do{
+		switch(*stage)
+		{
+		case 0:
+			CurrentCmd=&PreCommonCmd[*step];
+			break;
+		case 1:
+			CurrentCmd=&RfDependCmd[*step];
+			break;
+		case 2:
+			CurrentCmd=&PostCommonCmd[*step];
+			break;
+		}
+
+		if(CurrentCmd->CmdID==CmdID_End)
+		{
+			if((*stage)==2)
+			{
+				return TRUE;
+			}
+			else
+			{
+				(*stage)++;
+				(*step)=0;
+				continue;
+			}
+		}
+
+		switch(CurrentCmd->CmdID)
+		{
+		case CmdID_SetTxPowerLevel:
+			PHY_SetTxPowerLevel8192C(Adapter,channel);
+			break;
+		case CmdID_WritePortUlong:
+			PlatformEFIOWrite4Byte(Adapter, CurrentCmd->Para1, CurrentCmd->Para2);
+			break;
+		case CmdID_WritePortUshort:
+			PlatformEFIOWrite2Byte(Adapter, CurrentCmd->Para1, (u2Byte)CurrentCmd->Para2);
+			break;
+		case CmdID_WritePortUchar:
+			PlatformEFIOWrite1Byte(Adapter, CurrentCmd->Para1, (u1Byte)CurrentCmd->Para2);
+			break;
+		case CmdID_RF_WriteReg:	// Only modify channel for the register now !!!!!
+			for(eRFPath = 0; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+			{
+#if 1
+				pHalData->RfRegChnlVal[eRFPath] = ((pHalData->RfRegChnlVal[eRFPath] & 0xfffffc00) | CurrentCmd->Para2);
+				PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)eRFPath, CurrentCmd->Para1, bRFRegOffsetMask, pHalData->RfRegChnlVal[eRFPath]);
+#else
+				PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)eRFPath, CurrentCmd->Para1, bRFRegOffsetMask, (CurrentCmd->Para2));
+#endif
+			}
+			break;
+		}
+
+		break;
+	}while(TRUE);
+	//cosa }/*for(Number of RF paths)*/
+
+	(*delay)=CurrentCmd->msDelay;
+	(*step)++;
+	return FALSE;
+#endif
+	return _TRUE;
+}
+
+
+static	BOOLEAN
+phy_SetSwChnlCmdArray(
+	SwChnlCmd*		CmdTable,
+	u32			CmdTableIdx,
+	u32			CmdTableSz,
+	SwChnlCmdID		CmdID,
+	u32			Para1,
+	u32			Para2,
+	u32			msDelay
+	)
+{
+	SwChnlCmd* pCmd;
+
+	if(CmdTable == NULL)
+	{
+		//RT_ASSERT(FALSE, ("phy_SetSwChnlCmdArray(): CmdTable cannot be NULL.\n"));
+		return _FALSE;
+	}
+	if(CmdTableIdx >= CmdTableSz)
+	{
+		//RT_ASSERT(FALSE,
+		//		("phy_SetSwChnlCmdArray(): Access invalid index, please check size of the table, CmdTableIdx:%ld, CmdTableSz:%ld\n",
+		//		CmdTableIdx, CmdTableSz));
+		return _FALSE;
+	}
+
+	pCmd = CmdTable + CmdTableIdx;
+	pCmd->CmdID = CmdID;
+	pCmd->Para1 = Para1;
+	pCmd->Para2 = Para2;
+	pCmd->msDelay = msDelay;
+
+	return _TRUE;
+}
+
+
+static	void
+phy_FinishSwChnlNow(	// We should not call this function directly
+		IN	PADAPTER	Adapter,
+		IN	u8		channel
+		)
+{
+#if 0
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u32			delay;
+
+	while(!phy_SwChnlStepByStep(Adapter,channel,&pHalData->SwChnlStage,&pHalData->SwChnlStep,&delay))
+	{
+		if(delay>0)
+			rtw_mdelay_os(delay);
+	}
+#endif
+}
+
+
+
+//
+// Description:
+//	Switch channel synchronously. Called by SwChnlByDelayHandler.
+//
+// Implemented by Bruce, 2008-02-14.
+// The following procedure is operted according to SwChanlCallback8190Pci().
+// However, this procedure is performed synchronously  which should be running under
+// passive level.
+//
+VOID
+PHY_SwChnlPhy8192C(	// Only called during initialize
+	IN	PADAPTER	Adapter,
+	IN	u8		channel
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	//RT_TRACE(COMP_SCAN | COMP_RM, DBG_LOUD, ("==>PHY_SwChnlPhy8192S(), switch from channel %d to channel %d.\n", pHalData->CurrentChannel, channel));
+
+	// Cannot IO.
+	//if(RT_CANNOT_IO(Adapter))
+	//	return;
+
+	// Channel Switching is in progress.
+	//if(pHalData->SwChnlInProgress)
+	//	return;
+
+	//return immediately if it is peudo-phy
+	if(pHalData->rf_chip == RF_PSEUDO_11N)
+	{
+		//pHalData->SwChnlInProgress=FALSE;
+		return;
+	}
+
+	//pHalData->SwChnlInProgress = TRUE;
+	if( channel == 0)
+		channel = 1;
+
+	pHalData->CurrentChannel=channel;
+
+	//pHalData->SwChnlStage = 0;
+	//pHalData->SwChnlStep = 0;
+
+	phy_FinishSwChnlNow(Adapter,channel);
+
+	//pHalData->SwChnlInProgress = FALSE;
+}
+
+
+//
+//	Description:
+//		Configure H/W functionality to enable/disable Monitor mode.
+//		Note, because we possibly need to configure BB and RF in this function,
+//		so caller should in PASSIVE_LEVEL. 080118, by rcnjko.
+//
+VOID
+PHY_SetMonitorMode8192C(
+	IN	PADAPTER			pAdapter,
+	IN	BOOLEAN				bEnableMonitorMode
+	)
+{
+#if 0
+	HAL_DATA_TYPE		*pHalData	= GET_HAL_DATA(pAdapter);
+	BOOLEAN				bFilterOutNonAssociatedBSSID = FALSE;
+
+	//2 Note: we may need to stop antenna diversity.
+	if(bEnableMonitorMode)
+	{
+		bFilterOutNonAssociatedBSSID = FALSE;
+		RT_TRACE(COMP_RM, DBG_LOUD, ("PHY_SetMonitorMode8192S(): enable monitor mode\n"));
+
+		pHalData->bInMonitorMode = TRUE;
+		pAdapter->HalFunc.AllowAllDestAddrHandler(pAdapter, TRUE, TRUE);
+		rtw_hal_set_hwreg(pAdapter, HW_VAR_CHECK_BSSID, (pu1Byte)&bFilterOutNonAssociatedBSSID);
+	}
+	else
+	{
+		bFilterOutNonAssociatedBSSID = TRUE;
+		RT_TRACE(COMP_RM, DBG_LOUD, ("PHY_SetMonitorMode8192S(): disable monitor mode\n"));
+
+		pAdapter->HalFunc.AllowAllDestAddrHandler(pAdapter, FALSE, TRUE);
+		pHalData->bInMonitorMode = FALSE;
+		rtw_hal_set_hwreg(pAdapter, HW_VAR_CHECK_BSSID, (pu1Byte)&bFilterOutNonAssociatedBSSID);
+	}
+#endif
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	PHYCheckIsLegalRfPath8190Pci()
+ *
+ * Overview:	Check different RF type to execute legal judgement. If RF Path is illegal
+ *			We will return false.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	11/15/2007	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+BOOLEAN
+PHY_CheckIsLegalRfPath8192C(
+	IN	PADAPTER	pAdapter,
+	IN	u32	eRFPath)
+{
+//	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	BOOLEAN				rtValue = _TRUE;
+
+	// NOt check RF Path now.!
+#if 0
+	if (pHalData->RF_Type == RF_1T2R && eRFPath != RF_PATH_A)
+	{
+		rtValue = FALSE;
+	}
+	if (pHalData->RF_Type == RF_1T2R && eRFPath != RF_PATH_A)
+	{
+
+	}
+#endif
+	return	rtValue;
+
+}	/* PHY_CheckIsLegalRfPath8192C */
+
+//-------------------------------------------------------------------------
+//
+//	IQK
+//
+//-------------------------------------------------------------------------
+#define MAX_TOLERANCE		5
+#define IQK_DELAY_TIME		1 	//ms
+
+static u8			//bit0 = 1 => Tx OK, bit1 = 1 => Rx OK
+_PHY_PathA_IQK(
+	IN	PADAPTER	pAdapter,
+	IN	BOOLEAN		configPathB
+	)
+{
+	u32 regEAC, regE94, regE9C, regEA4;
+	u8 result = 0x00;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+
+	//RTPRINT(FINIT, INIT_IQK, ("Path A IQK!\n"));
+
+	//path-A IQK setting
+	//RTPRINT(FINIT, INIT_IQK, ("Path-A IQK setting!\n"));
+	PHY_SetBBReg(pAdapter, rTx_IQK_Tone_A, bMaskDWord, 0x10008c1f);
+	PHY_SetBBReg(pAdapter, rRx_IQK_Tone_A, bMaskDWord, 0x10008c1f);
+	PHY_SetBBReg(pAdapter, rTx_IQK_PI_A, bMaskDWord, 0x82140102);
+
+	PHY_SetBBReg(pAdapter, rRx_IQK_PI_A, bMaskDWord, configPathB ? 0x28160202 :
+		IS_81xxC_VENDOR_UMC_B_CUT(pHalData->VersionID)?0x28160202:0x28160502);
+
+	//path-B IQK setting
+	if(configPathB)
+	{
+		PHY_SetBBReg(pAdapter, rTx_IQK_Tone_B, bMaskDWord, 0x10008c22);
+		PHY_SetBBReg(pAdapter, rRx_IQK_Tone_B, bMaskDWord, 0x10008c22);
+		PHY_SetBBReg(pAdapter, rTx_IQK_PI_B, bMaskDWord, 0x82140102);
+		PHY_SetBBReg(pAdapter, rRx_IQK_PI_B, bMaskDWord, 0x28160202);
+	}
+
+	//LO calibration setting
+	//RTPRINT(FINIT, INIT_IQK, ("LO calibration setting!\n"));
+	PHY_SetBBReg(pAdapter, rIQK_AGC_Rsp, bMaskDWord, 0x001028d1);
+
+	//One shot, path A LOK & IQK
+	//RTPRINT(FINIT, INIT_IQK, ("One shot, path A LOK & IQK!\n"));
+	PHY_SetBBReg(pAdapter, rIQK_AGC_Pts, bMaskDWord, 0xf9000000);
+	PHY_SetBBReg(pAdapter, rIQK_AGC_Pts, bMaskDWord, 0xf8000000);
+
+	// delay x ms
+	//RTPRINT(FINIT, INIT_IQK, ("Delay %d ms for One shot, path A LOK & IQK.\n", IQK_DELAY_TIME));
+	rtw_udelay_os(IQK_DELAY_TIME*1000);//PlatformStallExecution(IQK_DELAY_TIME*1000);
+
+	// Check failed
+	regEAC = PHY_QueryBBReg(pAdapter, rRx_Power_After_IQK_A_2, bMaskDWord);
+	//RTPRINT(FINIT, INIT_IQK, ("0xeac = 0x%x\n", regEAC));
+	regE94 = PHY_QueryBBReg(pAdapter, rTx_Power_Before_IQK_A, bMaskDWord);
+	//RTPRINT(FINIT, INIT_IQK, ("0xe94 = 0x%x\n", regE94));
+	regE9C= PHY_QueryBBReg(pAdapter, rTx_Power_After_IQK_A, bMaskDWord);
+	//RTPRINT(FINIT, INIT_IQK, ("0xe9c = 0x%x\n", regE9C));
+	regEA4= PHY_QueryBBReg(pAdapter, rRx_Power_Before_IQK_A_2, bMaskDWord);
+	//RTPRINT(FINIT, INIT_IQK, ("0xea4 = 0x%x\n", regEA4));
+
+        if(!(regEAC & BIT28) &&
+		(((regE94 & 0x03FF0000)>>16) != 0x142) &&
+		(((regE9C & 0x03FF0000)>>16) != 0x42) )
+		result |= 0x01;
+	else							//if Tx not OK, ignore Rx
+		return result;
+
+	if(!(regEAC & BIT27) &&		//if Tx is OK, check whether Rx is OK
+		(((regEA4 & 0x03FF0000)>>16) != 0x132) &&
+		(((regEAC & 0x03FF0000)>>16) != 0x36))
+		result |= 0x02;
+	else
+		DBG_8192C("Path A Rx IQK fail!!\n");
+
+	return result;
+
+
+}
+
+static u8				//bit0 = 1 => Tx OK, bit1 = 1 => Rx OK
+_PHY_PathB_IQK(
+	IN	PADAPTER	pAdapter
+	)
+{
+	u32 regEAC, regEB4, regEBC, regEC4, regECC;
+	u8	result = 0x00;
+	//RTPRINT(FINIT, INIT_IQK, ("Path B IQK!\n"));
+
+	//One shot, path B LOK & IQK
+	//RTPRINT(FINIT, INIT_IQK, ("One shot, path A LOK & IQK!\n"));
+	PHY_SetBBReg(pAdapter, rIQK_AGC_Cont, bMaskDWord, 0x00000002);
+	PHY_SetBBReg(pAdapter, rIQK_AGC_Cont, bMaskDWord, 0x00000000);
+
+	// delay x ms
+	//RTPRINT(FINIT, INIT_IQK, ("Delay %d ms for One shot, path B LOK & IQK.\n", IQK_DELAY_TIME));
+	rtw_udelay_os(IQK_DELAY_TIME*1000);//PlatformStallExecution(IQK_DELAY_TIME*1000);
+
+	// Check failed
+	regEAC = PHY_QueryBBReg(pAdapter, rRx_Power_After_IQK_A_2, bMaskDWord);
+	//RTPRINT(FINIT, INIT_IQK, ("0xeac = 0x%x\n", regEAC));
+	regEB4 = PHY_QueryBBReg(pAdapter, rTx_Power_Before_IQK_B, bMaskDWord);
+	//RTPRINT(FINIT, INIT_IQK, ("0xeb4 = 0x%x\n", regEB4));
+	regEBC= PHY_QueryBBReg(pAdapter, rTx_Power_After_IQK_B, bMaskDWord);
+	//RTPRINT(FINIT, INIT_IQK, ("0xebc = 0x%x\n", regEBC));
+	regEC4= PHY_QueryBBReg(pAdapter, rRx_Power_Before_IQK_B_2, bMaskDWord);
+	//RTPRINT(FINIT, INIT_IQK, ("0xec4 = 0x%x\n", regEC4));
+	regECC= PHY_QueryBBReg(pAdapter, rRx_Power_After_IQK_B_2, bMaskDWord);
+	//RTPRINT(FINIT, INIT_IQK, ("0xecc = 0x%x\n", regECC));
+
+	if(!(regEAC & BIT31) &&
+		(((regEB4 & 0x03FF0000)>>16) != 0x142) &&
+		(((regEBC & 0x03FF0000)>>16) != 0x42))
+		result |= 0x01;
+	else
+		return result;
+
+	if(!(regEAC & BIT30) &&
+		(((regEC4 & 0x03FF0000)>>16) != 0x132) &&
+		(((regECC & 0x03FF0000)>>16) != 0x36))
+		result |= 0x02;
+	else
+		DBG_8192C("Path B Rx IQK fail!!\n");
+
+
+	return result;
+
+}
+
+static VOID
+_PHY_PathAFillIQKMatrix(
+	IN	PADAPTER	pAdapter,
+	IN 	BOOLEAN    	bIQKOK,
+	IN	int			result[][8],
+	IN	u8			final_candidate,
+	IN 	BOOLEAN		bTxOnly
+	)
+{
+	u32	Oldval_0, X, TX0_A, reg;
+	s32	Y, TX0_C;
+
+	DBG_8192C("Path A IQ Calibration %s !\n",(bIQKOK)?"Success":"Failed");
+
+	if(final_candidate == 0xFF)
+		return;
+	else if(bIQKOK)
+	{
+		Oldval_0 = (PHY_QueryBBReg(pAdapter, rOFDM0_XATxIQImbalance, bMaskDWord) >> 22) & 0x3FF;
+
+		X = result[final_candidate][0];
+		if ((X & 0x00000200) != 0)
+			X = X | 0xFFFFFC00;
+		TX0_A = (X * Oldval_0) >> 8;
+		//RTPRINT(FINIT, INIT_IQK, ("X = 0x%lx, TX0_A = 0x%lx, Oldval_0 0x%lx\n", X, TX0_A, Oldval_0));
+		PHY_SetBBReg(pAdapter, rOFDM0_XATxIQImbalance, 0x3FF, TX0_A);
+		PHY_SetBBReg(pAdapter, rOFDM0_ECCAThreshold, BIT(31), ((X* Oldval_0>>7) & 0x1));
+
+		Y = result[final_candidate][1];
+		if ((Y & 0x00000200) != 0)
+			Y = Y | 0xFFFFFC00;
+		TX0_C = (Y * Oldval_0) >> 8;
+		//RTPRINT(FINIT, INIT_IQK, ("Y = 0x%lx, TX = 0x%lx\n", Y, TX0_C));
+		PHY_SetBBReg(pAdapter, rOFDM0_XCTxAFE, 0xF0000000, ((TX0_C&0x3C0)>>6));
+		PHY_SetBBReg(pAdapter, rOFDM0_XATxIQImbalance, 0x003F0000, (TX0_C&0x3F));
+		PHY_SetBBReg(pAdapter, rOFDM0_ECCAThreshold, BIT(29), ((Y* Oldval_0>>7) & 0x1));
+
+	        if(bTxOnly)
+		{
+			DBG_8192C("_PHY_PathAFillIQKMatrix only Tx OK\n");
+			return;
+		}
+
+		reg = result[final_candidate][2];
+		PHY_SetBBReg(pAdapter, rOFDM0_XARxIQImbalance, 0x3FF, reg);
+
+		reg = result[final_candidate][3] & 0x3F;
+		PHY_SetBBReg(pAdapter, rOFDM0_XARxIQImbalance, 0xFC00, reg);
+
+		reg = (result[final_candidate][3] >> 6) & 0xF;
+		PHY_SetBBReg(pAdapter, rOFDM0_RxIQExtAnta, 0xF0000000, reg);
+	}
+}
+
+static VOID
+_PHY_PathBFillIQKMatrix(
+	IN	PADAPTER	pAdapter,
+	IN	BOOLEAN   	bIQKOK,
+	IN	int			result[][8],
+	IN	u8			final_candidate,
+	IN	BOOLEAN		bTxOnly			//do Tx only
+	)
+{
+	u32	Oldval_1, X, TX1_A, reg;
+	s32	Y, TX1_C;
+
+	DBG_8192C("Path B IQ Calibration %s !\n",(bIQKOK)?"Success":"Failed");
+
+	if(final_candidate == 0xFF)
+		return;
+	else if(bIQKOK)
+	{
+		Oldval_1 = (PHY_QueryBBReg(pAdapter, rOFDM0_XBTxIQImbalance, bMaskDWord) >> 22) & 0x3FF;
+
+		X = result[final_candidate][4];
+		if ((X & 0x00000200) != 0)
+			X = X | 0xFFFFFC00;
+		TX1_A = (X * Oldval_1) >> 8;
+		//RTPRINT(FINIT, INIT_IQK, ("X = 0x%lx, TX1_A = 0x%lx\n", X, TX1_A));
+		PHY_SetBBReg(pAdapter, rOFDM0_XBTxIQImbalance, 0x3FF, TX1_A);
+		PHY_SetBBReg(pAdapter, rOFDM0_ECCAThreshold, BIT(27), ((X* Oldval_1>>7) & 0x1));
+
+		Y = result[final_candidate][5];
+		if ((Y & 0x00000200) != 0)
+			Y = Y | 0xFFFFFC00;
+		TX1_C = (Y * Oldval_1) >> 8;
+		//RTPRINT(FINIT, INIT_IQK, ("Y = 0x%lx, TX1_C = 0x%lx\n", Y, TX1_C));
+		PHY_SetBBReg(pAdapter, rOFDM0_XDTxAFE, 0xF0000000, ((TX1_C&0x3C0)>>6));
+		PHY_SetBBReg(pAdapter, rOFDM0_XBTxIQImbalance, 0x003F0000, (TX1_C&0x3F));
+		PHY_SetBBReg(pAdapter, rOFDM0_ECCAThreshold, BIT(25), ((Y* Oldval_1>>7) & 0x1));
+
+		if(bTxOnly)
+			return;
+
+		reg = result[final_candidate][6];
+		PHY_SetBBReg(pAdapter, rOFDM0_XBRxIQImbalance, 0x3FF, reg);
+
+		reg = result[final_candidate][7] & 0x3F;
+		PHY_SetBBReg(pAdapter, rOFDM0_XBRxIQImbalance, 0xFC00, reg);
+
+		reg = (result[final_candidate][7] >> 6) & 0xF;
+		PHY_SetBBReg(pAdapter, rOFDM0_AGCRSSITable, 0x0000F000, reg);
+	}
+}
+
+static VOID
+_PHY_SaveADDARegisters(
+	IN	PADAPTER	pAdapter,
+	IN	u32*		ADDAReg,
+	IN	u32*		ADDABackup,
+	IN	u32			RegisterNum
+	)
+{
+	u32	i;
+
+	//RTPRINT(FINIT, INIT_IQK, ("Save ADDA parameters.\n"));
+	for( i = 0 ; i < RegisterNum ; i++){
+		ADDABackup[i] = PHY_QueryBBReg(pAdapter, ADDAReg[i], bMaskDWord);
+	}
+}
+
+static VOID
+_PHY_SaveMACRegisters(
+	IN	PADAPTER	pAdapter,
+	IN	u32*		MACReg,
+	IN	u32*		MACBackup
+	)
+{
+	u32	i;
+
+	//RTPRINT(FINIT, INIT_IQK, ("Save MAC parameters.\n"));
+	for( i = 0 ; i < (IQK_MAC_REG_NUM - 1); i++){
+		MACBackup[i] =rtw_read8(pAdapter, MACReg[i]);
+	}
+	MACBackup[i] = rtw_read32(pAdapter, MACReg[i]);
+
+}
+
+static VOID
+_PHY_ReloadADDARegisters(
+	IN	PADAPTER	pAdapter,
+	IN	u32*		ADDAReg,
+	IN	u32*		ADDABackup,
+	IN	u32			RegiesterNum
+	)
+{
+	u32	i;
+
+	//RTPRINT(FINIT, INIT_IQK, ("Reload ADDA power saving parameters !\n"));
+	for(i = 0 ; i < RegiesterNum ; i++){
+		PHY_SetBBReg(pAdapter, ADDAReg[i], bMaskDWord, ADDABackup[i]);
+	}
+}
+
+static VOID
+_PHY_ReloadMACRegisters(
+	IN	PADAPTER	pAdapter,
+	IN	u32*		MACReg,
+	IN	u32*		MACBackup
+	)
+{
+	u32	i;
+
+	//RTPRINT(FINIT, INIT_IQK, ("Reload MAC parameters !\n"));
+	for(i = 0 ; i < (IQK_MAC_REG_NUM - 1); i++){
+		rtw_write8(pAdapter, MACReg[i], (u8)MACBackup[i]);
+	}
+	rtw_write32(pAdapter, MACReg[i], MACBackup[i]);
+}
+
+static VOID
+_PHY_PathADDAOn(
+	IN	PADAPTER	pAdapter,
+	IN	u32*		ADDAReg,
+	IN	BOOLEAN		isPathAOn,
+	IN	BOOLEAN		is2T
+	)
+{
+	u32	pathOn;
+	u32	i;
+
+	//RTPRINT(FINIT, INIT_IQK, ("ADDA ON.\n"));
+
+	pathOn = isPathAOn ? 0x04db25a4 : 0x0b1b25a4;
+	if(_FALSE == is2T){
+		pathOn = 0x0bdb25a0;
+		PHY_SetBBReg(pAdapter, ADDAReg[0], bMaskDWord, 0x0b1b25a0);
+	}
+	else{
+		PHY_SetBBReg(pAdapter, ADDAReg[0], bMaskDWord, pathOn);
+	}
+
+	for( i = 1 ; i < IQK_ADDA_REG_NUM ; i++){
+		PHY_SetBBReg(pAdapter, ADDAReg[i], bMaskDWord, pathOn);
+	}
+
+}
+
+static VOID
+_PHY_MACSettingCalibration(
+	IN	PADAPTER	pAdapter,
+	IN	u32*		MACReg,
+	IN	u32*		MACBackup
+	)
+{
+	u32	i = 0;
+
+	//RTPRINT(FINIT, INIT_IQK, ("MAC settings for Calibration.\n"));
+
+	rtw_write8(pAdapter, MACReg[i], 0x3F);
+
+	for(i = 1 ; i < (IQK_MAC_REG_NUM - 1); i++){
+		rtw_write8(pAdapter, MACReg[i], (u8)(MACBackup[i]&(~BIT3)));
+	}
+	rtw_write8(pAdapter, MACReg[i], (u8)(MACBackup[i]&(~BIT5)));
+
+}
+
+static VOID
+_PHY_PathAStandBy(
+	IN	PADAPTER	pAdapter
+	)
+{
+	//RTPRINT(FINIT, INIT_IQK, ("Path-A standby mode!\n"));
+
+	PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0x0);
+	PHY_SetBBReg(pAdapter, 0x840, bMaskDWord, 0x00010000);
+	PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0x80800000);
+}
+
+static VOID
+_PHY_PIModeSwitch(
+	IN	PADAPTER	pAdapter,
+	IN	BOOLEAN		PIMode
+	)
+{
+	u32	mode;
+
+	//RTPRINT(FINIT, INIT_IQK, ("BB Switch to %s mode!\n", (PIMode ? "PI" : "SI")));
+
+	mode = PIMode ? 0x01000100 : 0x01000000;
+	PHY_SetBBReg(pAdapter, 0x820, bMaskDWord, mode);
+	PHY_SetBBReg(pAdapter, 0x828, bMaskDWord, mode);
+}
+
+/*
+return _FALSE => do IQK again
+*/
+static BOOLEAN
+_PHY_SimularityCompare(
+	IN	PADAPTER	pAdapter,
+	IN	int 		result[][8],
+	IN	u8		 c1,
+	IN	u8		 c2
+	)
+{
+	u32		i, j, diff, SimularityBitMap, bound = 0;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	u8		final_candidate[2] = {0xFF, 0xFF};	//for path A and path B
+	BOOLEAN		bResult = _TRUE, is2T = IS_92C_SERIAL( pHalData->VersionID);
+
+	if(is2T)
+		bound = 8;
+	else
+		bound = 4;
+
+	SimularityBitMap = 0;
+
+	for( i = 0; i < bound; i++ )
+	{
+		diff = (result[c1][i] > result[c2][i]) ? (result[c1][i] - result[c2][i]) : (result[c2][i] - result[c1][i]);
+		if (diff > MAX_TOLERANCE)
+		{
+			if((i == 2 || i == 6) && !SimularityBitMap)
+			{
+				if(result[c1][i]+result[c1][i+1] == 0)
+					final_candidate[(i/4)] = c2;
+				else if (result[c2][i]+result[c2][i+1] == 0)
+					final_candidate[(i/4)] = c1;
+				else
+					SimularityBitMap = SimularityBitMap|(1<<i);
+			}
+			else
+				SimularityBitMap = SimularityBitMap|(1<<i);
+		}
+	}
+
+	if ( SimularityBitMap == 0)
+	{
+		for( i = 0; i < (bound/4); i++ )
+		{
+			if(final_candidate[i] != 0xFF)
+			{
+				for( j = i*4; j < (i+1)*4-2; j++)
+					result[3][j] = result[final_candidate[i]][j];
+				bResult = _FALSE;
+			}
+		}
+		return bResult;
+	}
+	else if (!(SimularityBitMap & 0x0F))			//path A OK
+	{
+		for(i = 0; i < 4; i++)
+			result[3][i] = result[c1][i];
+		return _FALSE;
+	}
+	else if (!(SimularityBitMap & 0xF0) && is2T)	//path B OK
+	{
+		for(i = 4; i < 8; i++)
+			result[3][i] = result[c1][i];
+		return _FALSE;
+	}
+	else
+		return _FALSE;
+
+}
+
+static VOID
+_PHY_IQCalibrate(
+	IN	PADAPTER	pAdapter,
+	IN	int 		result[][8],
+	IN	u8		t,
+	IN	BOOLEAN		is2T
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	u32			i;
+	u8			PathAOK, PathBOK;
+	u32			ADDA_REG[IQK_ADDA_REG_NUM] = {
+						rFPGA0_XCD_SwitchControl, 	rBlue_Tooth,
+						rRx_Wait_CCA, 		rTx_CCK_RFON,
+						rTx_CCK_BBON, 	rTx_OFDM_RFON,
+						rTx_OFDM_BBON, 	rTx_To_Rx,
+						rTx_To_Tx, 		rRx_CCK,
+						rRx_OFDM, 		rRx_Wait_RIFS,
+						rRx_TO_Rx, 		rStandby,
+						rSleep, 			rPMPD_ANAEN };
+
+	u32			IQK_MAC_REG[IQK_MAC_REG_NUM] = {
+						REG_TXPAUSE, 		REG_BCN_CTRL,
+						REG_BCN_CTRL_1,	REG_GPIO_MUXCFG};
+
+	u32			IQK_BB_REG_92C[IQK_BB_REG_NUM] = {
+							rOFDM0_TRxPathEnable, 		rOFDM0_TRMuxPar,
+							rFPGA0_XCD_RFInterfaceSW,	rConfig_AntA,	rConfig_AntB,
+							rFPGA0_XAB_RFInterfaceSW,	rFPGA0_XA_RFInterfaceOE,
+							rFPGA0_XB_RFInterfaceOE,	rFPGA0_RFMOD
+							};
+
+#if MP_DRIVER
+	const u32	retryCount = 9;
+#else
+	const u32	retryCount = 2;
+#endif
+
+	// Note: IQ calibration must be performed after loading
+	// 		PHY_REG.txt , and radio_a, radio_b.txt
+
+	u32 bbvalue;
+
+	if(t==0)
+	{
+		bbvalue = PHY_QueryBBReg(pAdapter, rFPGA0_RFMOD, bMaskDWord);
+		//RTPRINT(FINIT, INIT_IQK, ("PHY_IQCalibrate()==>0x%08lx\n",bbvalue));
+
+		//RTPRINT(FINIT, INIT_IQK, ("IQ Calibration for %s\n", (is2T ? "2T2R" : "1T1R")));
+
+		// Save ADDA parameters, turn Path A ADDA on
+		_PHY_SaveADDARegisters(pAdapter, ADDA_REG, pdmpriv->ADDA_backup,IQK_ADDA_REG_NUM);
+		_PHY_SaveMACRegisters(pAdapter, IQK_MAC_REG, pdmpriv->IQK_MAC_backup);
+		_PHY_SaveADDARegisters(pAdapter, IQK_BB_REG_92C, pdmpriv->IQK_BB_backup, IQK_BB_REG_NUM);
+	}
+	_PHY_PathADDAOn(pAdapter, ADDA_REG, _TRUE, is2T);
+
+	if(t==0)
+	{
+		pdmpriv->bRfPiEnable = (u8)PHY_QueryBBReg(pAdapter, rFPGA0_XA_HSSIParameter1, BIT(8));
+	}
+
+	if(!pdmpriv->bRfPiEnable){
+		// Switch BB to PI mode to do IQ Calibration.
+		_PHY_PIModeSwitch(pAdapter, _TRUE);
+	}
+
+	PHY_SetBBReg(pAdapter, rFPGA0_RFMOD, BIT24, 0x00);
+	PHY_SetBBReg(pAdapter, rOFDM0_TRxPathEnable, bMaskDWord, 0x03a05600);
+	PHY_SetBBReg(pAdapter, rOFDM0_TRMuxPar, bMaskDWord, 0x000800e4);
+	PHY_SetBBReg(pAdapter, rFPGA0_XCD_RFInterfaceSW, bMaskDWord, 0x22204000);
+	PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFInterfaceSW, BIT10, 0x01);
+	PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFInterfaceSW, BIT26, 0x01);
+	PHY_SetBBReg(pAdapter, rFPGA0_XA_RFInterfaceOE, BIT10, 0x00);
+	PHY_SetBBReg(pAdapter, rFPGA0_XB_RFInterfaceOE, BIT10, 0x00);
+
+	if(is2T)
+	{
+		PHY_SetBBReg(pAdapter, rFPGA0_XA_LSSIParameter, bMaskDWord, 0x00010000);
+		PHY_SetBBReg(pAdapter, rFPGA0_XB_LSSIParameter, bMaskDWord, 0x00010000);
+	}
+
+	//MAC settings
+	_PHY_MACSettingCalibration(pAdapter, IQK_MAC_REG, pdmpriv->IQK_MAC_backup);
+
+	//Page B init
+	PHY_SetBBReg(pAdapter, rConfig_AntA, bMaskDWord, 0x00080000);
+
+	if(is2T)
+	{
+		PHY_SetBBReg(pAdapter, rConfig_AntB, bMaskDWord, 0x00080000);
+	}
+
+	// IQ calibration setting
+	//RTPRINT(FINIT, INIT_IQK, ("IQK setting!\n"));
+	PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0x80800000);
+	PHY_SetBBReg(pAdapter, rTx_IQK, bMaskDWord, 0x01007c00);
+	PHY_SetBBReg(pAdapter, rRx_IQK, bMaskDWord, 0x01004800);
+
+	for(i = 0 ; i < retryCount ; i++){
+		PathAOK = _PHY_PathA_IQK(pAdapter, is2T);
+		if(PathAOK == 0x03){
+				DBG_8192C("Path A IQK Success!!\n");
+				result[t][0] = (PHY_QueryBBReg(pAdapter, rTx_Power_Before_IQK_A, bMaskDWord)&0x3FF0000)>>16;
+				result[t][1] = (PHY_QueryBBReg(pAdapter, rTx_Power_After_IQK_A, bMaskDWord)&0x3FF0000)>>16;
+				result[t][2] = (PHY_QueryBBReg(pAdapter, rRx_Power_Before_IQK_A_2, bMaskDWord)&0x3FF0000)>>16;
+				result[t][3] = (PHY_QueryBBReg(pAdapter, rRx_Power_After_IQK_A_2, bMaskDWord)&0x3FF0000)>>16;
+			break;
+		}
+		else if (i == (retryCount-1) && PathAOK == 0x01)	//Tx IQK OK
+		{
+			DBG_8192C("Path A IQK Only  Tx Success!!\n");
+
+			result[t][0] = (PHY_QueryBBReg(pAdapter, rTx_Power_Before_IQK_A, bMaskDWord)&0x3FF0000)>>16;
+			result[t][1] = (PHY_QueryBBReg(pAdapter, rTx_Power_After_IQK_A, bMaskDWord)&0x3FF0000)>>16;
+		}
+	}
+
+	if(0x00 == PathAOK){
+		DBG_8192C("Path A IQK failed!!\n");
+	}
+
+	if(is2T){
+		_PHY_PathAStandBy(pAdapter);
+
+		// Turn Path B ADDA on
+		_PHY_PathADDAOn(pAdapter, ADDA_REG, _FALSE, is2T);
+
+		for(i = 0 ; i < retryCount ; i++){
+			PathBOK = _PHY_PathB_IQK(pAdapter);
+			if(PathBOK == 0x03){
+				DBG_8192C("Path B IQK Success!!\n");
+				result[t][4] = (PHY_QueryBBReg(pAdapter, rTx_Power_Before_IQK_B, bMaskDWord)&0x3FF0000)>>16;
+				result[t][5] = (PHY_QueryBBReg(pAdapter, rTx_Power_After_IQK_B, bMaskDWord)&0x3FF0000)>>16;
+				result[t][6] = (PHY_QueryBBReg(pAdapter, rRx_Power_Before_IQK_B_2, bMaskDWord)&0x3FF0000)>>16;
+				result[t][7] = (PHY_QueryBBReg(pAdapter, rRx_Power_After_IQK_B_2, bMaskDWord)&0x3FF0000)>>16;
+				break;
+			}
+			else if (i == (retryCount - 1) && PathBOK == 0x01)	//Tx IQK OK
+			{
+				DBG_8192C("Path B Only Tx IQK Success!!\n");
+				result[t][4] = (PHY_QueryBBReg(pAdapter, rTx_Power_Before_IQK_B, bMaskDWord)&0x3FF0000)>>16;
+				result[t][5] = (PHY_QueryBBReg(pAdapter, rTx_Power_After_IQK_B, bMaskDWord)&0x3FF0000)>>16;
+			}
+		}
+
+		if(0x00 == PathBOK){
+			DBG_8192C("Path B IQK failed!!\n");
+		}
+	}
+
+	//Back to BB mode, load original value
+	//RTPRINT(FINIT, INIT_IQK, ("IQK:Back to BB mode, load original value!\n"));
+	PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0);
+
+	if(t!=0)
+	{
+		if(!pdmpriv->bRfPiEnable){
+			// Switch back BB to SI mode after finish IQ Calibration.
+			_PHY_PIModeSwitch(pAdapter, _FALSE);
+		}
+
+		// Reload ADDA power saving parameters
+		_PHY_ReloadADDARegisters(pAdapter, ADDA_REG, pdmpriv->ADDA_backup, IQK_ADDA_REG_NUM);
+
+		// Reload MAC parameters
+		_PHY_ReloadMACRegisters(pAdapter, IQK_MAC_REG, pdmpriv->IQK_MAC_backup);
+
+		// Reload BB parameters
+		_PHY_ReloadADDARegisters(pAdapter, IQK_BB_REG_92C, pdmpriv->IQK_BB_backup, IQK_BB_REG_NUM);
+
+		// Restore RX initial gain
+		PHY_SetBBReg(pAdapter, rFPGA0_XA_LSSIParameter, bMaskDWord, 0x00032ed3);
+		if(is2T){
+			PHY_SetBBReg(pAdapter, rFPGA0_XB_LSSIParameter, bMaskDWord, 0x00032ed3);
+		}
+
+		//load 0xe30 IQC default value
+		PHY_SetBBReg(pAdapter, rTx_IQK_Tone_A, bMaskDWord, 0x01008c00);
+		PHY_SetBBReg(pAdapter, rRx_IQK_Tone_A, bMaskDWord, 0x01008c00);
+
+	}
+	//RTPRINT(FINIT, INIT_IQK, ("_PHY_IQCalibrate() <==\n"));
+
+}
+
+
+static VOID
+_PHY_LCCalibrate(
+	IN	PADAPTER	pAdapter,
+	IN	BOOLEAN		is2T
+	)
+{
+	u8	tmpReg;
+	u32 	RF_Amode = 0, RF_Bmode = 0, LC_Cal;
+
+	//Check continuous TX and Packet TX
+	tmpReg = rtw_read8(pAdapter, 0xd03);
+
+	if((tmpReg&0x70) != 0)			//Deal with contisuous TX case
+		rtw_write8(pAdapter, 0xd03, tmpReg&0x8F);	//disable all continuous TX
+	else 							// Deal with Packet TX case
+		rtw_write8(pAdapter, REG_TXPAUSE, 0xFF);			// block all queues
+
+	if((tmpReg&0x70) != 0)
+	{
+		//1. Read original RF mode
+		//Path-A
+		RF_Amode = PHY_QueryRFReg(pAdapter, RF_PATH_A, RF_AC, bMask12Bits);
+
+		//Path-B
+		if(is2T)
+			RF_Bmode = PHY_QueryRFReg(pAdapter, RF_PATH_B, RF_AC, bMask12Bits);
+
+		//2. Set RF mode = standby mode
+		//Path-A
+		PHY_SetRFReg(pAdapter, RF_PATH_A, RF_AC, bMask12Bits, (RF_Amode&0x8FFFF)|0x10000);
+
+		//Path-B
+		if(is2T)
+			PHY_SetRFReg(pAdapter, RF_PATH_B, RF_AC, bMask12Bits, (RF_Bmode&0x8FFFF)|0x10000);
+	}
+
+	//3. Read RF reg18
+	LC_Cal = PHY_QueryRFReg(pAdapter, RF_PATH_A, RF_CHNLBW, bMask12Bits);
+
+	//4. Set LC calibration begin
+	PHY_SetRFReg(pAdapter, RF_PATH_A, RF_CHNLBW, bMask12Bits, LC_Cal|0x08000);
+
+	#ifdef CONFIG_LONG_DELAY_ISSUE
+	rtw_msleep_os(100);
+	#else
+	rtw_mdelay_os(100);
+	#endif
+
+	//Restore original situation
+	if((tmpReg&0x70) != 0)	//Deal with contisuous TX case
+	{
+		//Path-A
+		rtw_write8(pAdapter, 0xd03, tmpReg);
+		PHY_SetRFReg(pAdapter, RF_PATH_A, RF_AC, bMask12Bits, RF_Amode);
+
+		//Path-B
+		if(is2T)
+			PHY_SetRFReg(pAdapter, RF_PATH_B, RF_AC, bMask12Bits, RF_Bmode);
+	}
+	else // Deal with Packet TX case
+	{
+		rtw_write8(pAdapter, REG_TXPAUSE, 0x00);
+	}
+
+}
+
+
+//Analog Pre-distortion calibration
+#define		APK_BB_REG_NUM	8
+#define		APK_CURVE_REG_NUM 4
+#define		PATH_NUM		2
+
+static VOID
+_PHY_APCalibrate(
+	IN	PADAPTER	pAdapter,
+	IN	char 		delta,
+	IN	BOOLEAN		is2T
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+	u32 			regD[PATH_NUM];
+	u32			tmpReg, index, offset, i, apkbound;
+	u8			path, pathbound = PATH_NUM;
+	u32			BB_backup[APK_BB_REG_NUM];
+	u32			BB_REG[APK_BB_REG_NUM] = {
+						rFPGA1_TxBlock, 	rOFDM0_TRxPathEnable,
+						rFPGA0_RFMOD, 	rOFDM0_TRMuxPar,
+						rFPGA0_XCD_RFInterfaceSW,	rFPGA0_XAB_RFInterfaceSW,
+						rFPGA0_XA_RFInterfaceOE, 	rFPGA0_XB_RFInterfaceOE	};
+	u32			BB_AP_MODE[APK_BB_REG_NUM] = {
+						0x00000020, 0x00a05430, 0x02040000,
+						0x000800e4, 0x00204000 };
+	u32			BB_normal_AP_MODE[APK_BB_REG_NUM] = {
+						0x00000020, 0x00a05430, 0x02040000,
+						0x000800e4, 0x22204000 };
+
+	u32			AFE_backup[IQK_ADDA_REG_NUM];
+	u32			AFE_REG[IQK_ADDA_REG_NUM] = {
+						rFPGA0_XCD_SwitchControl, 	rBlue_Tooth,
+						rRx_Wait_CCA, 		rTx_CCK_RFON,
+						rTx_CCK_BBON, 	rTx_OFDM_RFON,
+						rTx_OFDM_BBON, 	rTx_To_Rx,
+						rTx_To_Tx, 		rRx_CCK,
+						rRx_OFDM, 		rRx_Wait_RIFS,
+						rRx_TO_Rx, 		rStandby,
+						rSleep, 			rPMPD_ANAEN };
+
+	u32			MAC_backup[IQK_MAC_REG_NUM];
+	u32			MAC_REG[IQK_MAC_REG_NUM] = {
+						REG_TXPAUSE, 		REG_BCN_CTRL,
+						REG_BCN_CTRL_1,	REG_GPIO_MUXCFG};
+
+	u32			APK_RF_init_value[PATH_NUM][APK_BB_REG_NUM] = {
+					{0x0852c, 0x1852c, 0x5852c, 0x1852c, 0x5852c},
+					{0x2852e, 0x0852e, 0x3852e, 0x0852e, 0x0852e}
+					};
+
+	u32			APK_normal_RF_init_value[PATH_NUM][APK_BB_REG_NUM] = {
+					{0x0852c, 0x0a52c, 0x3a52c, 0x5a52c, 0x5a52c},	//path settings equal to path b settings
+					{0x0852c, 0x0a52c, 0x5a52c, 0x5a52c, 0x5a52c}
+					};
+
+	u32			APK_RF_value_0[PATH_NUM][APK_BB_REG_NUM] = {
+					{0x52019, 0x52014, 0x52013, 0x5200f, 0x5208d},
+					{0x5201a, 0x52019, 0x52016, 0x52033, 0x52050}
+					};
+
+	u32			APK_normal_RF_value_0[PATH_NUM][APK_BB_REG_NUM] = {
+					{0x52019, 0x52017, 0x52010, 0x5200d, 0x5206a},	//path settings equal to path b settings
+					{0x52019, 0x52017, 0x52010, 0x5200d, 0x5206a}
+					};
+#if 0
+	u32			APK_RF_value_A[PATH_NUM][APK_BB_REG_NUM] = {
+					{0x1adb0, 0x1adb0, 0x1ada0, 0x1ad90, 0x1ad80},
+					{0x00fb0, 0x00fb0, 0x00fa0, 0x00f90, 0x00f80}
+					};
+#endif
+	u32			AFE_on_off[PATH_NUM] = {
+					0x04db25a4, 0x0b1b25a4};	//path A on path B off / path A off path B on
+
+	u32			APK_offset[PATH_NUM] = {
+					rConfig_AntA, rConfig_AntB};
+
+	u32			APK_normal_offset[PATH_NUM] = {
+					rConfig_Pmpd_AntA, rConfig_Pmpd_AntB};
+
+	u32			APK_value[PATH_NUM] = {
+					0x92fc0000, 0x12fc0000};
+
+	u32			APK_normal_value[PATH_NUM] = {
+					0x92680000, 0x12680000};
+
+	char			APK_delta_mapping[APK_BB_REG_NUM][13] = {
+					{-4, -3, -2, -2, -1, -1, 0, 1, 2, 3, 4, 5, 6},
+					{-4, -3, -2, -2, -1, -1, 0, 1, 2, 3, 4, 5, 6},
+					{-6, -4, -2, -2, -1, -1, 0, 1, 2, 3, 4, 5, 6},
+					{-1, -1, -1, -1, -1, -1, 0, 1, 2, 3, 4, 5, 6},
+					{-11, -9, -7, -5, -3, -1, 0, 0, 0, 0, 0, 0, 0}
+					};
+
+	u32			APK_normal_setting_value_1[13] = {
+					0x01017018, 0xf7ed8f84, 0x1b1a1816, 0x2522201e, 0x322e2b28,
+					0x433f3a36, 0x5b544e49, 0x7b726a62, 0xa69a8f84, 0xdfcfc0b3,
+					0x12680000, 0x00880000, 0x00880000
+					};
+
+	u32			APK_normal_setting_value_2[16] = {
+					0x01c7021d, 0x01670183, 0x01000123, 0x00bf00e2, 0x008d00a3,
+					0x0068007b, 0x004d0059, 0x003a0042, 0x002b0031, 0x001f0025,
+					0x0017001b, 0x00110014, 0x000c000f, 0x0009000b, 0x00070008,
+					0x00050006
+					};
+
+	u32			APK_result[PATH_NUM][APK_BB_REG_NUM];	//val_1_1a, val_1_2a, val_2a, val_3a, val_4a
+	//u32			AP_curve[PATH_NUM][APK_CURVE_REG_NUM];
+
+	int			BB_offset, delta_V, delta_offset;
+
+#if (MP_DRIVER == 1)
+	PMPT_CONTEXT	pMptCtx = &pAdapter->mppriv.MptCtx;
+
+	pMptCtx->APK_bound[0] = 45;
+	pMptCtx->APK_bound[1] = 52;
+#endif
+
+	//RTPRINT(FINIT, INIT_IQK, ("==>PHY_APCalibrate() delta %d\n", delta));
+
+	//RTPRINT(FINIT, INIT_IQK, ("AP Calibration for %s %s\n", (is2T ? "2T2R" : "1T1R"), (isNormal ? "Normal chip" : "Test chip")));
+
+	if(!is2T)
+		pathbound = 1;
+
+	//2 FOR NORMAL CHIP SETTINGS
+
+// Temporarily do not allow normal driver to do the following settings because these offset
+// and value will cause RF internal PA to be unpredictably disabled by HW, such that RF Tx signal
+// will disappear after disable/enable card many times on 88CU. RF SD and DD have not find the
+// root cause, so we remove these actions temporarily. Added by tynli and SD3 Allen. 2010.05.31.
+#if (MP_DRIVER != 1)
+	return;
+#endif
+
+	//settings adjust for normal chip
+	for(index = 0; index < PATH_NUM; index ++)
+	{
+		APK_offset[index] = APK_normal_offset[index];
+		APK_value[index] = APK_normal_value[index];
+		AFE_on_off[index] = 0x6fdb25a4;
+	}
+
+	for(index = 0; index < APK_BB_REG_NUM; index ++)
+	{
+		for(path = 0; path < pathbound; path++)
+		{
+			APK_RF_init_value[path][index] = APK_normal_RF_init_value[path][index];
+			APK_RF_value_0[path][index] = APK_normal_RF_value_0[path][index];
+		}
+		BB_AP_MODE[index] = BB_normal_AP_MODE[index];
+	}
+
+	apkbound = 6;
+
+	//save BB default value
+	for(index = 0; index < APK_BB_REG_NUM ; index++)
+	{
+		if(index == 0)		//skip
+			continue;
+		BB_backup[index] = PHY_QueryBBReg(pAdapter, BB_REG[index], bMaskDWord);
+	}
+
+	//save MAC default value
+	_PHY_SaveMACRegisters(pAdapter, MAC_REG, MAC_backup);
+
+	//save AFE default value
+	_PHY_SaveADDARegisters(pAdapter, AFE_REG, AFE_backup, IQK_ADDA_REG_NUM);
+
+	for(path = 0; path < pathbound; path++)
+	{
+		if(path == RF_PATH_A)
+		{
+			//path A APK
+			//load APK setting
+			//path-A
+			offset = rPdp_AntA;
+			for(index = 0; index < 11; index ++)
+			{
+				PHY_SetBBReg(pAdapter, offset, bMaskDWord, APK_normal_setting_value_1[index]);
+				//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x%x value 0x%x\n", offset, PHY_QueryBBReg(pAdapter, offset, bMaskDWord)));
+
+				offset += 0x04;
+			}
+
+			PHY_SetBBReg(pAdapter, rConfig_Pmpd_AntB, bMaskDWord, 0x12680000);
+
+			offset = rConfig_AntA;
+			for(; index < 13; index ++)
+			{
+				PHY_SetBBReg(pAdapter, offset, bMaskDWord, APK_normal_setting_value_1[index]);
+				//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x%x value 0x%x\n", offset, PHY_QueryBBReg(pAdapter, offset, bMaskDWord)));
+
+				offset += 0x04;
+			}
+
+			//page-B1
+			PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0x40000000);
+
+			//path A
+			offset = rPdp_AntA;
+			for(index = 0; index < 16; index++)
+			{
+				PHY_SetBBReg(pAdapter, offset, bMaskDWord, APK_normal_setting_value_2[index]);
+				//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x%x value 0x%x\n", offset, PHY_QueryBBReg(pAdapter, offset, bMaskDWord)));
+
+				offset += 0x04;
+			}
+			PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0x00000000);
+		}
+		else if(path == RF_PATH_B)
+		{
+			//path B APK
+			//load APK setting
+			//path-B
+			offset = rPdp_AntB;
+			for(index = 0; index < 10; index ++)
+			{
+				PHY_SetBBReg(pAdapter, offset, bMaskDWord, APK_normal_setting_value_1[index]);
+				//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x%x value 0x%x\n", offset, PHY_QueryBBReg(pAdapter, offset, bMaskDWord)));
+
+				offset += 0x04;
+			}
+			PHY_SetBBReg(pAdapter, rConfig_Pmpd_AntA, bMaskDWord, 0x12680000);
+
+			PHY_SetBBReg(pAdapter, rConfig_Pmpd_AntB, bMaskDWord, 0x12680000);
+
+			offset = rConfig_AntA;
+			index = 11;
+			for(; index < 13; index ++) //offset 0xb68, 0xb6c
+			{
+				PHY_SetBBReg(pAdapter, offset, bMaskDWord, APK_normal_setting_value_1[index]);
+				//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x%x value 0x%x\n", offset, PHY_QueryBBReg(pAdapter, offset, bMaskDWord)));
+
+				offset += 0x04;
+			}
+
+			//page-B1
+			PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0x40000000);
+
+			//path B
+			offset = 0xb60;
+			for(index = 0; index < 16; index++)
+			{
+				PHY_SetBBReg(pAdapter, offset, bMaskDWord, APK_normal_setting_value_2[index]);
+				//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x%x value 0x%x\n", offset, PHY_QueryBBReg(pAdapter, offset, bMaskDWord)));
+
+				offset += 0x04;
+			}
+			PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0x00000000);
+		}
+
+		//save RF default value
+		regD[path] = PHY_QueryRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_TXBIAS_A, bRFRegOffsetMask);
+
+		//Path A AFE all on, path B AFE All off or vise versa
+		for(index = 0; index < IQK_ADDA_REG_NUM ; index++)
+			PHY_SetBBReg(pAdapter, AFE_REG[index], bMaskDWord, AFE_on_off[path]);
+		//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0xe70 %x\n", PHY_QueryBBReg(pAdapter, 0xe70, bMaskDWord)));
+
+		//BB to AP mode
+		if(path == 0)
+		{
+			for(index = 0; index < APK_BB_REG_NUM ; index++)
+			{
+				if(index == 0)		//skip
+					continue;
+				else if (index < 5)
+					PHY_SetBBReg(pAdapter, BB_REG[index], bMaskDWord, BB_AP_MODE[index]);
+				else if (BB_REG[index] == 0x870)
+					PHY_SetBBReg(pAdapter, BB_REG[index], bMaskDWord, BB_backup[index]|BIT10|BIT26);
+				else
+					PHY_SetBBReg(pAdapter, BB_REG[index], BIT10, 0x0);
+			}
+			PHY_SetBBReg(pAdapter, rTx_IQK_Tone_A, bMaskDWord, 0x01008c00);
+			PHY_SetBBReg(pAdapter, rRx_IQK_Tone_A, bMaskDWord, 0x01008c00);
+		}
+		else		//path B
+		{
+			PHY_SetBBReg(pAdapter, rTx_IQK_Tone_B, bMaskDWord, 0x01008c00);
+			PHY_SetBBReg(pAdapter, rRx_IQK_Tone_B, bMaskDWord, 0x01008c00);
+		}
+
+		//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x800 %x\n", PHY_QueryBBReg(pAdapter, 0x800, bMaskDWord)));
+
+		//MAC settings
+		_PHY_MACSettingCalibration(pAdapter, MAC_REG, MAC_backup);
+
+		if(path == RF_PATH_A)	//Path B to standby mode
+		{
+			PHY_SetRFReg(pAdapter, RF_PATH_B, RF_AC, bRFRegOffsetMask, 0x10000);
+		}
+		else			//Path A to standby mode
+		{
+			PHY_SetRFReg(pAdapter, RF_PATH_A, RF_AC, bRFRegOffsetMask, 0x10000);
+			PHY_SetRFReg(pAdapter, RF_PATH_A, RF_MODE1, bRFRegOffsetMask, 0x1000f);
+			PHY_SetRFReg(pAdapter, RF_PATH_A, RF_MODE2, bRFRegOffsetMask, 0x20103);
+		}
+
+		delta_offset = ((delta+14)/2);
+		if(delta_offset < 0)
+			delta_offset = 0;
+		else if (delta_offset > 12)
+			delta_offset = 12;
+
+		//AP calibration
+		for(index = 0; index < APK_BB_REG_NUM; index++)
+		{
+			if(index != 1)		//only DO PA11+PAD01001, AP RF setting
+				continue;
+
+			tmpReg = APK_RF_init_value[path][index];
+#if 1
+			if(!pdmpriv->bAPKThermalMeterIgnore)
+			{
+				BB_offset = (tmpReg & 0xF0000) >> 16;
+
+				if(!(tmpReg & BIT15)) //sign bit 0
+				{
+					BB_offset = -BB_offset;
+				}
+
+				delta_V = APK_delta_mapping[index][delta_offset];
+
+				BB_offset += delta_V;
+
+				//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() APK num %d delta_V %d delta_offset %d\n", index, delta_V, delta_offset));
+
+				if(BB_offset < 0)
+				{
+					tmpReg = tmpReg & (~BIT15);
+					BB_offset = -BB_offset;
+				}
+				else
+				{
+					tmpReg = tmpReg | BIT15;
+				}
+				tmpReg = (tmpReg & 0xFFF0FFFF) | (BB_offset << 16);
+			}
+#endif
+
+#ifdef CONFIG_PCI_HCI
+			if(IS_81xxC_VENDOR_UMC_B_CUT(pHalData->VersionID))
+				PHY_SetRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_IPA_A, bRFRegOffsetMask, 0x894ae);
+			else
+#endif
+				PHY_SetRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_IPA_A, bRFRegOffsetMask, 0x8992e);
+			//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0xc %x\n", PHY_QueryRFReg(pAdapter, (RF_RADIO_PATH_E)path, 0xc, bMaskDWord)));
+			PHY_SetRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_AC, bRFRegOffsetMask, APK_RF_value_0[path][index]);
+			//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x0 %x\n", PHY_QueryRFReg(pAdapter, (RF_RADIO_PATH_E)path, 0x0, bMaskDWord)));
+			PHY_SetRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_TXBIAS_A, bRFRegOffsetMask, tmpReg);
+			//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0xd %x\n", PHY_QueryRFReg(pAdapter, (RF_RADIO_PATH_E)path, 0xd, bMaskDWord)));
+
+			// PA11+PAD01111, one shot
+			i = 0;
+			do
+			{
+				PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0x80000000);
+				{
+					PHY_SetBBReg(pAdapter, APK_offset[path], bMaskDWord, APK_value[0]);
+					//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x%x value 0x%x\n", APK_offset[path], PHY_QueryBBReg(pAdapter, APK_offset[path], bMaskDWord)));
+					rtw_mdelay_os(3);
+					PHY_SetBBReg(pAdapter, APK_offset[path], bMaskDWord, APK_value[1]);
+					//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0x%x value 0x%x\n", APK_offset[path], PHY_QueryBBReg(pAdapter, APK_offset[path], bMaskDWord)));
+					#ifdef CONFIG_LONG_DELAY_ISSUE
+					rtw_msleep_os(20);
+					#else
+					rtw_mdelay_os(20);
+					#endif
+				}
+				PHY_SetBBReg(pAdapter, rFPGA0_IQK, bMaskDWord, 0x00000000);
+
+				if(path == RF_PATH_A)
+					tmpReg = PHY_QueryBBReg(pAdapter, rAPK, 0x03E00000);
+				else
+					tmpReg = PHY_QueryBBReg(pAdapter, rAPK, 0xF8000000);
+				//RTPRINT(FINIT, INIT_IQK, ("PHY_APCalibrate() offset 0xbd8[25:21] %x\n", tmpReg));
+
+				i++;
+			}
+			while(tmpReg > apkbound && i < 4);
+
+			APK_result[path][index] = tmpReg;
+		}
+	}
+
+	//reload MAC default value
+	_PHY_ReloadMACRegisters(pAdapter, MAC_REG, MAC_backup);
+
+	//reload BB default value
+	for(index = 0; index < APK_BB_REG_NUM ; index++)
+	{
+		if(index == 0)		//skip
+			continue;
+		PHY_SetBBReg(pAdapter, BB_REG[index], bMaskDWord, BB_backup[index]);
+	}
+
+	//reload AFE default value
+	_PHY_ReloadADDARegisters(pAdapter, AFE_REG, AFE_backup, IQK_ADDA_REG_NUM);
+
+	//reload RF path default value
+	for(path = 0; path < pathbound; path++)
+	{
+		PHY_SetRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_TXBIAS_A, bRFRegOffsetMask, regD[path]);
+		if(path == RF_PATH_B)
+		{
+			PHY_SetRFReg(pAdapter, RF_PATH_A, RF_MODE1, bRFRegOffsetMask, 0x1000f);
+			PHY_SetRFReg(pAdapter, RF_PATH_A, RF_MODE2, bRFRegOffsetMask, 0x20101);
+		}
+
+		//note no index == 0
+		if (APK_result[path][1] > 6)
+			APK_result[path][1] = 6;
+		//RTPRINT(FINIT, INIT_IQK, ("apk path %d result %d 0x%x \t", path, 1, APK_result[path][1]));
+	}
+
+	//RTPRINT(FINIT, INIT_IQK, ("\n"));
+
+
+	for(path = 0; path < pathbound; path++)
+	{
+		PHY_SetRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_BS_PA_APSET_G1_G4, bRFRegOffsetMask,
+		((APK_result[path][1] << 15) | (APK_result[path][1] << 10) | (APK_result[path][1] << 5) | APK_result[path][1]));
+		if(path == RF_PATH_A)
+			PHY_SetRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_BS_PA_APSET_G5_G8, bRFRegOffsetMask,
+			((APK_result[path][1] << 15) | (APK_result[path][1] << 10) | (0x00 << 5) | 0x05));
+		else
+			PHY_SetRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_BS_PA_APSET_G5_G8, bRFRegOffsetMask,
+			((APK_result[path][1] << 15) | (APK_result[path][1] << 10) | (0x02 << 5) | 0x05));
+		PHY_SetRFReg(pAdapter, (RF_RADIO_PATH_E)path, RF_BS_PA_APSET_G9_G11, bRFRegOffsetMask,
+		((0x08 << 15) | (0x08 << 10) | (0x08 << 5) | 0x08));
+	}
+
+	pdmpriv->bAPKdone = _TRUE;
+
+	//RTPRINT(FINIT, INIT_IQK, ("<==PHY_APCalibrate()\n"));
+}
+
+static VOID _PHY_SetRFPathSwitch(
+	IN	PADAPTER	pAdapter,
+	IN	BOOLEAN		bMain,
+	IN	BOOLEAN		is2T
+	)
+{
+	u8	u1bTmp;
+
+	if(!pAdapter->hw_init_completed)
+	{
+		u1bTmp = rtw_read8(pAdapter, REG_LEDCFG2) | BIT7;
+		rtw_write8(pAdapter, REG_LEDCFG2, u1bTmp);
+		//PHY_SetBBReg(pAdapter, REG_LEDCFG0, BIT23, 0x01);
+		PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFParameter, BIT13, 0x01);
+	}
+
+	if(is2T)
+	{
+		if(bMain)
+			PHY_SetBBReg(pAdapter, rFPGA0_XB_RFInterfaceOE, BIT5|BIT6, 0x1);	//92C_Path_A
+		else
+			PHY_SetBBReg(pAdapter, rFPGA0_XB_RFInterfaceOE, BIT5|BIT6, 0x2);	//BT
+	}
+	else
+	{
+
+		if(bMain)
+			PHY_SetBBReg(pAdapter, rFPGA0_XA_RFInterfaceOE, 0x300, 0x2);	//Main
+		else
+			PHY_SetBBReg(pAdapter, rFPGA0_XA_RFInterfaceOE, 0x300, 0x1);	//Aux
+	}
+
+}
+
+//return value TRUE => Main; FALSE => Aux
+
+static BOOLEAN _PHY_QueryRFPathSwitch(
+	IN	PADAPTER	pAdapter,
+	IN	BOOLEAN		is2T
+	)
+{
+//	if(is2T)
+//		return _TRUE;
+
+	if(!pAdapter->hw_init_completed)
+	{
+		PHY_SetBBReg(pAdapter, REG_LEDCFG0, BIT23, 0x01);
+		PHY_SetBBReg(pAdapter, rFPGA0_XAB_RFParameter, BIT13, 0x01);
+	}
+
+	if(is2T)
+	{
+		if(PHY_QueryBBReg(pAdapter, rFPGA0_XB_RFInterfaceOE, BIT5|BIT6) == 0x01)
+			return _TRUE;
+		else
+			return _FALSE;
+	}
+	else
+	{
+		if(PHY_QueryBBReg(pAdapter, rFPGA0_XA_RFInterfaceOE, 0x300) == 0x02)
+			return _TRUE;
+		else
+			return _FALSE;
+	}
+}
+
+VOID
+rtl8192c_PHY_IQCalibrate(
+	IN	PADAPTER	pAdapter,
+	IN	BOOLEAN 	bReCovery
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	s32			result[4][8];	//last is final result
+	u8			i, final_candidate;
+	BOOLEAN		bPathAOK, bPathBOK;
+	s32			RegE94, RegE9C, RegEA4, RegEAC, RegEB4, RegEBC, RegEC4, RegECC, RegTmp = 0;
+	BOOLEAN		is12simular, is13simular, is23simular;
+	BOOLEAN 	bStartContTx = _FALSE, bSingleTone = _FALSE, bCarrierSuppression = _FALSE;
+	u32			IQK_BB_REG_92C[IQK_BB_REG_NUM] = {
+					rOFDM0_XARxIQImbalance, 	rOFDM0_XBRxIQImbalance,
+					rOFDM0_ECCAThreshold, 	rOFDM0_AGCRSSITable,
+					rOFDM0_XATxIQImbalance, 	rOFDM0_XBTxIQImbalance,
+					rOFDM0_XCTxAFE, 			rOFDM0_XDTxAFE,
+					rOFDM0_RxIQExtAnta};
+
+
+#if MP_DRIVER == 1
+	bStartContTx = pAdapter->mppriv.MptCtx.bStartContTx;
+	bSingleTone = pAdapter->mppriv.MptCtx.bSingleTone;
+	bCarrierSuppression = pAdapter->mppriv.MptCtx.bCarrierSuppression;
+#endif
+
+	//ignore IQK when continuous Tx
+	if(bStartContTx || bSingleTone || bCarrierSuppression)
+		return;
+
+#if DISABLE_BB_RF
+	return;
+#endif
+
+	if(bReCovery)
+	{
+		_PHY_ReloadADDARegisters(pAdapter, IQK_BB_REG_92C, pdmpriv->IQK_BB_backup_recover, 9);
+		return;
+	}
+	DBG_8192C("IQK:Start!!!\n");
+
+	for(i = 0; i < 8; i++)
+	{
+		result[0][i] = 0;
+		result[1][i] = 0;
+		result[2][i] = 0;
+		result[3][i] = 0;
+	}
+	final_candidate = 0xff;
+	bPathAOK = _FALSE;
+	bPathBOK = _FALSE;
+	is12simular = _FALSE;
+	is23simular = _FALSE;
+	is13simular = _FALSE;
+
+	for (i=0; i<3; i++)
+	{
+		if(IS_92C_SERIAL( pHalData->VersionID)){
+			 _PHY_IQCalibrate(pAdapter, result, i, _TRUE);
+		}
+		else{
+			// For 88C 1T1R
+			_PHY_IQCalibrate(pAdapter, result, i, _FALSE);
+		}
+
+		if(i == 1)
+		{
+			is12simular = _PHY_SimularityCompare(pAdapter, result, 0, 1);
+			if(is12simular)
+			{
+				final_candidate = 0;
+				break;
+			}
+		}
+
+		if(i == 2)
+		{
+			is13simular = _PHY_SimularityCompare(pAdapter, result, 0, 2);
+			if(is13simular)
+			{
+				final_candidate = 0;
+				break;
+			}
+
+			is23simular = _PHY_SimularityCompare(pAdapter, result, 1, 2);
+			if(is23simular)
+				final_candidate = 1;
+			else
+			{
+				for(i = 0; i < 8; i++)
+					RegTmp += result[3][i];
+
+				if(RegTmp != 0)
+					final_candidate = 3;
+				else
+					final_candidate = 0xFF;
+			}
+		}
+	}
+
+        for (i=0; i<4; i++)
+	{
+		RegE94 = result[i][0];
+		RegE9C = result[i][1];
+		RegEA4 = result[i][2];
+		RegEAC = result[i][3];
+		RegEB4 = result[i][4];
+		RegEBC = result[i][5];
+		RegEC4 = result[i][6];
+		RegECC = result[i][7];
+		//RTPRINT(FINIT, INIT_IQK, ("IQK: RegE94=%lx RegE9C=%lx RegEA4=%lx RegEAC=%lx RegEB4=%lx RegEBC=%lx RegEC4=%lx RegECC=%lx\n ", RegE94, RegE9C, RegEA4, RegEAC, RegEB4, RegEBC, RegEC4, RegECC));
+	}
+
+	if(final_candidate != 0xff)
+	{
+		pdmpriv->RegE94 = RegE94 = result[final_candidate][0];
+		pdmpriv->RegE9C = RegE9C = result[final_candidate][1];
+		RegEA4 = result[final_candidate][2];
+		RegEAC = result[final_candidate][3];
+		pdmpriv->RegEB4 = RegEB4 = result[final_candidate][4];
+		pdmpriv->RegEBC = RegEBC = result[final_candidate][5];
+		RegEC4 = result[final_candidate][6];
+		RegECC = result[final_candidate][7];
+		DBG_8192C("IQK: final_candidate is %x\n", final_candidate);
+		DBG_8192C("IQK: RegE94=%x RegE9C=%x RegEA4=%x RegEAC=%x RegEB4=%x RegEBC=%x RegEC4=%x RegECC=%x\n ", RegE94, RegE9C, RegEA4, RegEAC, RegEB4, RegEBC, RegEC4, RegECC);
+		bPathAOK = bPathBOK = _TRUE;
+	}
+	else
+	{
+		RegE94 = RegEB4 = pdmpriv->RegE94 = pdmpriv->RegEB4 = 0x100;	//X default value
+		RegE9C = RegEBC = pdmpriv->RegE9C = pdmpriv->RegEBC = 0x0;		//Y default value
+	}
+
+	if((RegE94 != 0)/*&&(RegEA4 != 0)*/)
+		_PHY_PathAFillIQKMatrix(pAdapter, bPathAOK, result, final_candidate, (RegEA4 == 0));
+
+	if(IS_92C_SERIAL( pHalData->VersionID)){
+		if((RegEB4 != 0)/*&&(RegEC4 != 0)*/)
+		_PHY_PathBFillIQKMatrix(pAdapter, bPathBOK, result, final_candidate, (RegEC4 == 0));
+	}
+
+	_PHY_SaveADDARegisters(pAdapter, IQK_BB_REG_92C, pdmpriv->IQK_BB_backup_recover, 9);
+
+}
+
+
+VOID
+rtl8192c_PHY_LCCalibrate(
+	IN	PADAPTER	pAdapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct mlme_ext_priv	*pmlmeext = &pAdapter->mlmeextpriv;
+	BOOLEAN 	bStartContTx = _FALSE, bSingleTone = _FALSE, bCarrierSuppression = _FALSE;
+
+#if MP_DRIVER == 1
+	bStartContTx = pAdapter->mppriv.MptCtx.bStartContTx;
+	bSingleTone = pAdapter->mppriv.MptCtx.bSingleTone;
+	bCarrierSuppression = pAdapter->mppriv.MptCtx.bCarrierSuppression;
+#endif
+
+#if DISABLE_BB_RF
+	return;
+#endif
+
+	//ignore IQK when continuous Tx
+	if(bStartContTx || bSingleTone || bCarrierSuppression)
+		return;
+
+	if(pmlmeext->sitesurvey_res.state == SCAN_PROCESS)
+		return;
+
+	if(IS_92C_SERIAL( pHalData->VersionID)){
+		_PHY_LCCalibrate(pAdapter, _TRUE);
+	}
+	else{
+		// For 88C 1T1R
+		_PHY_LCCalibrate(pAdapter, _FALSE);
+	}
+}
+
+VOID
+rtl8192c_PHY_APCalibrate(
+	IN	PADAPTER	pAdapter,
+	IN	char 		delta
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+	//default disable APK, because Tx NG issue, suggest by Jenyu, 2011.11.25
+	return;
+
+#if DISABLE_BB_RF
+	return;
+#endif
+
+	if(pdmpriv->bAPKdone)
+		return;
+
+	if(IS_92C_SERIAL( pHalData->VersionID)){
+		_PHY_APCalibrate(pAdapter, delta, _TRUE);
+	}
+	else{
+		// For 88C 1T1R
+		_PHY_APCalibrate(pAdapter, delta, _FALSE);
+	}
+}
+
+VOID rtl8192c_PHY_SetRFPathSwitch(
+	IN	PADAPTER	pAdapter,
+	IN	BOOLEAN		bMain
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+
+#if DISABLE_BB_RF
+	return;
+#endif
+
+	if(IS_92C_SERIAL( pHalData->VersionID)){
+		_PHY_SetRFPathSwitch(pAdapter, bMain, _TRUE);
+	}
+	else{
+		// For 88C 1T1R
+		_PHY_SetRFPathSwitch(pAdapter, bMain, _FALSE);
+	}
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_rf6052.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_rf6052.c
new file mode 100644
index 000000000000..7532c63ff0d8
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_rf6052.c
@@ -0,0 +1,1030 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/******************************************************************************
+ *
+ *
+ * Module:	rtl8192c_rf6052.c	( Source C File)
+ *
+ * Note:	Provide RF 6052 series relative API.
+ *
+ * Function:
+ *
+ * Export:
+ *
+ * Abbrev:
+ *
+ * History:
+ * Data			Who		Remark
+ *
+ * 09/25/2008	MHC		Create initial version.
+ * 11/05/2008 	MHC		Add API for tw power setting.
+ *
+ *
+******************************************************************************/
+
+#define _RTL8192C_RF6052_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_byteorder.h>
+
+#include <rtl8192c_hal.h>
+
+/*---------------------------Define Local Constant---------------------------*/
+// Define local structure for debug!!!!!
+typedef struct RF_Shadow_Compare_Map {
+	// Shadow register value
+	u32		Value;
+	// Compare or not flag
+	u8		Compare;
+	// Record If it had ever modified unpredicted
+	u8		ErrorOrNot;
+	// Recorver Flag
+	u8		Recorver;
+	//
+	u8		Driver_Write;
+}RF_SHADOW_T;
+/*---------------------------Define Local Constant---------------------------*/
+
+
+/*------------------------Define global variable-----------------------------*/
+/*------------------------Define global variable-----------------------------*/
+
+
+/*------------------------Define local variable------------------------------*/
+// 2008/11/20 MH For Debug only, RF
+//static	RF_SHADOW_T	RF_Shadow[RF6052_MAX_PATH][RF6052_MAX_REG] = {0};
+static	RF_SHADOW_T	RF_Shadow[RF6052_MAX_PATH][RF6052_MAX_REG];
+/*------------------------Define local variable------------------------------*/
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	RF_ChangeTxPath
+ *
+ * Overview:	For RL6052, we must change some RF settign for 1T or 2T.
+ *
+ * Input:		u2Byte DataRate		// 0x80-8f, 0x90-9f
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 09/25/2008 	MHC		Create Version 0.
+ *						Firmwaer support the utility later.
+ *
+ *---------------------------------------------------------------------------*/
+void rtl8192c_RF_ChangeTxPath(	IN	PADAPTER	Adapter,
+										IN	u16		DataRate)
+{
+// We do not support gain table change inACUT now !!!! Delete later !!!
+#if 0//(RTL92SE_FPGA_VERIFY == 0)
+	static	u1Byte	RF_Path_Type = 2;	// 1 = 1T 2= 2T
+	static	u4Byte	tx_gain_tbl1[6]
+			= {0x17f50, 0x11f40, 0x0cf30, 0x08720, 0x04310, 0x00100};
+	static	u4Byte	tx_gain_tbl2[6]
+			= {0x15ea0, 0x10e90, 0x0c680, 0x08250, 0x04040, 0x00030};
+	u1Byte	i;
+
+	if (RF_Path_Type == 2 && (DataRate&0xF) <= 0x7)
+	{
+		// Set TX SYNC power G2G3 loop filter
+		PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)RF_PATH_A,
+					RF_TXPA_G2, bRFRegOffsetMask, 0x0f000);
+		PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)RF_PATH_A,
+					RF_TXPA_G3, bRFRegOffsetMask, 0xeacf1);
+
+		// Change TX AGC gain table
+		for (i = 0; i < 6; i++)
+			PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)RF_PATH_A,
+						RF_TX_AGC, bRFRegOffsetMask, tx_gain_tbl1[i]);
+
+		// Set PA to high value
+		PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)RF_PATH_A,
+					RF_TXPA_G2, bRFRegOffsetMask, 0x01e39);
+	}
+	else if (RF_Path_Type == 1 && (DataRate&0xF) >= 0x8)
+	{
+		// Set TX SYNC power G2G3 loop filter
+		PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)RF_PATH_A,
+					RF_TXPA_G2, bRFRegOffsetMask, 0x04440);
+		PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)RF_PATH_A,
+					RF_TXPA_G3, bRFRegOffsetMask, 0xea4f1);
+
+		// Change TX AGC gain table
+		for (i = 0; i < 6; i++)
+			PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)RF_PATH_A,
+						RF_TX_AGC, bRFRegOffsetMask, tx_gain_tbl2[i]);
+
+		// Set PA low gain
+		PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)RF_PATH_A,
+					RF_TXPA_G2, bRFRegOffsetMask, 0x01e19);
+	}
+#endif
+
+}	/* RF_ChangeTxPath */
+
+
+/*-----------------------------------------------------------------------------
+ * Function:    PHY_RF6052SetBandwidth()
+ *
+ * Overview:    This function is called by SetBWModeCallback8190Pci() only
+ *
+ * Input:       PADAPTER				Adapter
+ *			WIRELESS_BANDWIDTH_E	Bandwidth	//20M or 40M
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Note:		For RF type 0222D
+ *---------------------------------------------------------------------------*/
+VOID
+rtl8192c_PHY_RF6052SetBandwidth(
+	IN	PADAPTER				Adapter,
+	IN	HT_CHANNEL_WIDTH		Bandwidth)	//20M or 40M
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	switch(Bandwidth)
+	{
+		case HT_CHANNEL_WIDTH_20:
+			pHalData->RfRegChnlVal[0] = ((pHalData->RfRegChnlVal[0] & 0xfffff3ff) | 0x0400);
+			PHY_SetRFReg(Adapter, RF_PATH_A, RF_CHNLBW, bRFRegOffsetMask, pHalData->RfRegChnlVal[0]);
+			break;
+
+		case HT_CHANNEL_WIDTH_40:
+			pHalData->RfRegChnlVal[0] = ((pHalData->RfRegChnlVal[0] & 0xfffff3ff));
+			PHY_SetRFReg(Adapter, RF_PATH_A, RF_CHNLBW, bRFRegOffsetMask, pHalData->RfRegChnlVal[0]);
+			break;
+
+		default:
+			//RT_TRACE(COMP_DBG, DBG_LOUD, ("PHY_SetRF8225Bandwidth(): unknown Bandwidth: %#X\n",Bandwidth ));
+			break;
+	}
+
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	PHY_RF6052SetCckTxPower
+ *
+ * Overview:
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/05/2008 	MHC		Simulate 8192series..
+ *
+ *---------------------------------------------------------------------------*/
+
+VOID
+rtl8192c_PHY_RF6052SetCckTxPower(
+	IN	PADAPTER		Adapter,
+	IN	u8*			pPowerlevel)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	struct mlme_priv	*pmlmepriv = &Adapter->mlmepriv;
+	struct dm_priv		*pdmpriv = &pHalData->dmpriv;
+	struct mlme_ext_priv 		*pmlmeext = &Adapter->mlmeextpriv;
+	//PMGNT_INFO		pMgntInfo=&Adapter->MgntInfo;
+	u32			TxAGC[2]={0, 0}, tmpval=0;
+	BOOLEAN		TurboScanOff = _FALSE;
+	u8			idx1, idx2;
+	u8*			ptr;
+
+	// 2010/10/18 MH Accorsing to SD3 eechou's suggestion, we need to disable turbo scan for RU.
+	// Otherwise, external PA will be broken if power index > 0x20.
+#ifdef CONFIG_USB_HCI
+	if (pHalData->EEPROMRegulatory != 0 || pHalData->ExternalPA)
+#else
+	if (pHalData->EEPROMRegulatory != 0)
+#endif
+	{
+		//DbgPrint("TurboScanOff=1 EEPROMRegulatory=%d ExternalPA=%d\n", pHalData->EEPROMRegulatory, pHalData->ExternalPA);
+		TurboScanOff = _TRUE;
+	}
+
+	if(pmlmeext->sitesurvey_res.state == SCAN_PROCESS)
+	{
+		TxAGC[RF_PATH_A] = 0x3f3f3f3f;
+		TxAGC[RF_PATH_B] = 0x3f3f3f3f;
+
+		TurboScanOff = _TRUE;//disable turbo scan
+
+		if(TurboScanOff)
+		{
+			for(idx1=RF_PATH_A; idx1<=RF_PATH_B; idx1++)
+			{
+				TxAGC[idx1] =
+					pPowerlevel[idx1] | (pPowerlevel[idx1]<<8) |
+					(pPowerlevel[idx1]<<16) | (pPowerlevel[idx1]<<24);
+#ifdef CONFIG_USB_HCI
+				// 2010/10/18 MH For external PA module. We need to limit power index to be less than 0x20.
+				if (TxAGC[idx1] > 0x20 && pHalData->ExternalPA)
+					TxAGC[idx1] = 0x20;
+#endif
+			}
+		}
+	}
+	else
+	{
+// 20100427 Joseph: Driver dynamic Tx power shall not affect Tx power. It shall be determined by power training mechanism.
+// Currently, we cannot fully disable driver dynamic tx power mechanism because it is referenced by BT coexist mechanism.
+// In the future, two mechanism shall be separated from each other and maintained independantly. Thanks for Lanhsin's reminder.
+		if(pdmpriv->DynamicTxHighPowerLvl == TxHighPwrLevel_Level1)
+		{
+			TxAGC[RF_PATH_A] = 0x10101010;
+			TxAGC[RF_PATH_B] = 0x10101010;
+		}
+		else if(pdmpriv->DynamicTxHighPowerLvl == TxHighPwrLevel_Level2)
+		{
+			TxAGC[RF_PATH_A] = 0x00000000;
+			TxAGC[RF_PATH_B] = 0x00000000;
+		}
+		else
+		{
+			for(idx1=RF_PATH_A; idx1<=RF_PATH_B; idx1++)
+			{
+				TxAGC[idx1] =
+					pPowerlevel[idx1] | (pPowerlevel[idx1]<<8) |
+					(pPowerlevel[idx1]<<16) | (pPowerlevel[idx1]<<24);
+			}
+
+			if(pHalData->EEPROMRegulatory==0)
+			{
+				tmpval = (pHalData->MCSTxPowerLevelOriginalOffset[0][6]) +
+						(pHalData->MCSTxPowerLevelOriginalOffset[0][7]<<8);
+				TxAGC[RF_PATH_A] += tmpval;
+
+				tmpval = (pHalData->MCSTxPowerLevelOriginalOffset[0][14]) +
+						(pHalData->MCSTxPowerLevelOriginalOffset[0][15]<<24);
+				TxAGC[RF_PATH_B] += tmpval;
+			}
+		}
+	}
+
+	for(idx1=RF_PATH_A; idx1<=RF_PATH_B; idx1++)
+	{
+		ptr = (u8*)(&(TxAGC[idx1]));
+		for(idx2=0; idx2<4; idx2++)
+		{
+			if(*ptr > RF6052_MAX_TX_PWR)
+				*ptr = RF6052_MAX_TX_PWR;
+			ptr++;
+		}
+	}
+
+	// rf-A cck tx power
+	tmpval = TxAGC[RF_PATH_A]&0xff;
+	PHY_SetBBReg(Adapter, rTxAGC_A_CCK1_Mcs32, bMaskByte1, tmpval);
+	//RTPRINT(FPHY, PHY_TXPWR, ("CCK PWR 1M (rf-A) = 0x%x (reg 0x%x)\n", tmpval, rTxAGC_A_CCK1_Mcs32));
+	tmpval = TxAGC[RF_PATH_A]>>8;
+	PHY_SetBBReg(Adapter, rTxAGC_B_CCK11_A_CCK2_11, 0xffffff00, tmpval);
+	//RTPRINT(FPHY, PHY_TXPWR, ("CCK PWR 2~11M (rf-A) = 0x%x (reg 0x%x)\n", tmpval, rTxAGC_B_CCK11_A_CCK2_11));
+
+	// rf-B cck tx power
+	tmpval = TxAGC[RF_PATH_B]>>24;
+	PHY_SetBBReg(Adapter, rTxAGC_B_CCK11_A_CCK2_11, bMaskByte0, tmpval);
+	//RTPRINT(FPHY, PHY_TXPWR, ("CCK PWR 11M (rf-B) = 0x%x (reg 0x%x)\n", tmpval, rTxAGC_B_CCK11_A_CCK2_11));
+	tmpval = TxAGC[RF_PATH_B]&0x00ffffff;
+	PHY_SetBBReg(Adapter, rTxAGC_B_CCK1_55_Mcs32, 0xffffff00, tmpval);
+	//RTPRINT(FPHY, PHY_TXPWR, ("CCK PWR 1~5.5M (rf-B) = 0x%x (reg 0x%x)\n",
+	//	tmpval, rTxAGC_B_CCK1_55_Mcs32));
+
+}	/* PHY_RF6052SetCckTxPower */
+
+//
+// powerbase0 for OFDM rates
+// powerbase1 for HT MCS rates
+//
+static void getPowerBase(
+	IN	PADAPTER	Adapter,
+	IN	u8*		pPowerLevel,
+	IN	u8		Channel,
+	IN OUT u32*	OfdmBase,
+	IN OUT u32*	MCSBase
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u32			powerBase0, powerBase1;
+	u8			Legacy_pwrdiff=0;
+	s8			HT20_pwrdiff=0;
+	u8			i, powerlevel[2];
+
+	for(i=0; i<2; i++)
+	{
+		powerlevel[i] = pPowerLevel[i];
+		Legacy_pwrdiff = pHalData->TxPwrLegacyHtDiff[i][Channel-1];
+		powerBase0 = powerlevel[i] + Legacy_pwrdiff;
+
+		powerBase0 = (powerBase0<<24) | (powerBase0<<16) |(powerBase0<<8) |powerBase0;
+		*(OfdmBase+i) = powerBase0;
+		//RTPRINT(FPHY, PHY_TXPWR, (" [OFDM power base index rf(%c) = 0x%x]\n", ((i==0)?'A':'B'), *(OfdmBase+i)));
+	}
+
+	for(i=0; i<2; i++)
+	{
+		//Check HT20 to HT40 diff
+		if(pHalData->CurrentChannelBW == HT_CHANNEL_WIDTH_20)
+		{
+			HT20_pwrdiff = pHalData->TxPwrHt20Diff[i][Channel-1];
+			powerlevel[i] += HT20_pwrdiff;
+		}
+		powerBase1 = powerlevel[i];
+		powerBase1 = (powerBase1<<24) | (powerBase1<<16) |(powerBase1<<8) |powerBase1;
+		*(MCSBase+i) = powerBase1;
+		//RTPRINT(FPHY, PHY_TXPWR, (" [MCS power base index rf(%c) = 0x%x]\n", ((i==0)?'A':'B'), *(MCSBase+i)));
+	}
+}
+
+static void getTxPowerWriteValByRegulatory(
+	IN		PADAPTER	Adapter,
+	IN		u8		Channel,
+	IN		u8		index,
+	IN		u32*		powerBase0,
+	IN		u32*		powerBase1,
+	OUT		u32*		pOutWriteVal
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	u8	i, chnlGroup = 0, pwr_diff_limit[4];
+	u32 	writeVal, customer_limit, rf;
+
+	//
+	// Index 0 & 1= legacy OFDM, 2-5=HT_MCS rate
+	//
+	for(rf=0; rf<2; rf++)
+	{
+		switch(pHalData->EEPROMRegulatory)
+		{
+			case 0:	// Realtek better performance
+					// increase power diff defined by Realtek for large power
+				chnlGroup = 0;
+				//RTPRINT(FPHY, PHY_TXPWR, ("MCSTxPowerLevelOriginalOffset[%d][%d] = 0x%x\n",
+				//	chnlGroup, index, pHalData->MCSTxPowerLevelOriginalOffset[chnlGroup][index+(rf?8:0)]));
+				writeVal = pHalData->MCSTxPowerLevelOriginalOffset[chnlGroup][index+(rf?8:0)] +
+					((index<2)?powerBase0[rf]:powerBase1[rf]);
+				//RTPRINT(FPHY, PHY_TXPWR, ("RTK better performance, writeVal(%c) = 0x%x\n", ((rf==0)?'A':'B'), writeVal));
+				break;
+			case 1:	// Realtek regulatory
+					// increase power diff defined by Realtek for regulatory
+				{
+					if(pHalData->pwrGroupCnt == 1)
+						chnlGroup = 0;
+					if(pHalData->pwrGroupCnt >= 3)
+					{
+						if(Channel <= 3)
+							chnlGroup = 0;
+						else if(Channel >= 4 && Channel <= 9)
+							chnlGroup = 1;
+						else if(Channel > 9)
+							chnlGroup = 2;
+
+						if(pHalData->CurrentChannelBW == HT_CHANNEL_WIDTH_20)
+							chnlGroup++;
+						else
+							chnlGroup+=4;
+					}
+					//RTPRINT(FPHY, PHY_TXPWR, ("MCSTxPowerLevelOriginalOffset[%d][%d] = 0x%x\n",
+					//chnlGroup, index, pHalData->MCSTxPowerLevelOriginalOffset[chnlGroup][index+(rf?8:0)]));
+					writeVal = pHalData->MCSTxPowerLevelOriginalOffset[chnlGroup][index+(rf?8:0)] +
+							((index<2)?powerBase0[rf]:powerBase1[rf]);
+					//RTPRINT(FPHY, PHY_TXPWR, ("Realtek regulatory, 20MHz, writeVal(%c) = 0x%x\n", ((rf==0)?'A':'B'), writeVal));
+				}
+				break;
+			case 2:	// Better regulatory
+					// don't increase any power diff
+				writeVal = ((index<2)?powerBase0[rf]:powerBase1[rf]);
+				//RTPRINT(FPHY, PHY_TXPWR, ("Better regulatory, writeVal(%c) = 0x%x\n", ((rf==0)?'A':'B'), writeVal));
+				break;
+			case 3:	// Customer defined power diff.
+					// increase power diff defined by customer.
+				chnlGroup = 0;
+				//RTPRINT(FPHY, PHY_TXPWR, ("MCSTxPowerLevelOriginalOffset[%d][%d] = 0x%x\n",
+				//	chnlGroup, index, pHalData->MCSTxPowerLevelOriginalOffset[chnlGroup][index+(rf?8:0)]));
+
+				if (pHalData->CurrentChannelBW == HT_CHANNEL_WIDTH_40)
+				{
+					//RTPRINT(FPHY, PHY_TXPWR, ("customer's limit, 40MHz rf(%c) = 0x%x\n",
+					//	((rf==0)?'A':'B'), pHalData->PwrGroupHT40[rf][Channel-1]));
+				}
+				else
+				{
+					//RTPRINT(FPHY, PHY_TXPWR, ("customer's limit, 20MHz rf(%c) = 0x%x\n",
+					//	((rf==0)?'A':'B'), pHalData->PwrGroupHT20[rf][Channel-1]));
+				}
+				for (i=0; i<4; i++)
+				{
+					pwr_diff_limit[i] = (u8)((pHalData->MCSTxPowerLevelOriginalOffset[chnlGroup][index+(rf?8:0)]&(0x7f<<(i*8)))>>(i*8));
+					if (pHalData->CurrentChannelBW == HT_CHANNEL_WIDTH_40)
+					{
+						if(pwr_diff_limit[i] > pHalData->PwrGroupHT40[rf][Channel-1])
+							pwr_diff_limit[i] = pHalData->PwrGroupHT40[rf][Channel-1];
+					}
+					else
+					{
+						if(pwr_diff_limit[i] > pHalData->PwrGroupHT20[rf][Channel-1])
+							pwr_diff_limit[i] = pHalData->PwrGroupHT20[rf][Channel-1];
+					}
+				}
+				customer_limit = (pwr_diff_limit[3]<<24) | (pwr_diff_limit[2]<<16) |
+								(pwr_diff_limit[1]<<8) | (pwr_diff_limit[0]);
+				//RTPRINT(FPHY, PHY_TXPWR, ("Customer's limit rf(%c) = 0x%x\n", ((rf==0)?'A':'B'), customer_limit));
+
+				writeVal = customer_limit + ((index<2)?powerBase0[rf]:powerBase1[rf]);
+				//RTPRINT(FPHY, PHY_TXPWR, ("Customer, writeVal rf(%c)= 0x%x\n", ((rf==0)?'A':'B'), writeVal));
+				break;
+			default:
+				chnlGroup = 0;
+				writeVal = pHalData->MCSTxPowerLevelOriginalOffset[chnlGroup][index+(rf?8:0)] +
+						((index<2)?powerBase0[rf]:powerBase1[rf]);
+				//RTPRINT(FPHY, PHY_TXPWR, ("RTK better performance, writeVal rf(%c) = 0x%x\n", ((rf==0)?'A':'B'), writeVal));
+				break;
+		}
+
+// 20100427 Joseph: Driver dynamic Tx power shall not affect Tx power. It shall be determined by power training mechanism.
+// Currently, we cannot fully disable driver dynamic tx power mechanism because it is referenced by BT coexist mechanism.
+// In the future, two mechanism shall be separated from each other and maintained independantly. Thanks for Lanhsin's reminder.
+
+		if(pdmpriv->DynamicTxHighPowerLvl == TxHighPwrLevel_Level1)
+			writeVal = 0x14141414;
+		else if(pdmpriv->DynamicTxHighPowerLvl == TxHighPwrLevel_Level2)
+			writeVal = 0x00000000;
+
+
+		// 20100628 Joseph: High power mode for BT-Coexist mechanism.
+		// This mechanism is only applied when Driver-Highpower-Mechanism is OFF.
+		if(pdmpriv->DynamicTxHighPowerLvl == TxHighPwrLevel_BT1)
+		{
+			//RTPRINT(FBT, BT_TRACE, ("Tx Power (-6)\n"));
+			writeVal = writeVal - 0x06060606;
+		}
+		else if(pdmpriv->DynamicTxHighPowerLvl == TxHighPwrLevel_BT2)
+		{
+			//RTPRINT(FBT, BT_TRACE, ("Tx Power (-0)\n"));
+			writeVal = writeVal;
+		}
+		*(pOutWriteVal+rf) = writeVal;
+	}
+}
+
+static void writeOFDMPowerReg(
+	IN		PADAPTER	Adapter,
+	IN		u8		index,
+	IN 		u32*		pValue
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u16 RegOffset_A[6] = {	rTxAGC_A_Rate18_06, rTxAGC_A_Rate54_24,
+							rTxAGC_A_Mcs03_Mcs00, rTxAGC_A_Mcs07_Mcs04,
+							rTxAGC_A_Mcs11_Mcs08, rTxAGC_A_Mcs15_Mcs12};
+	u16 RegOffset_B[6] = {	rTxAGC_B_Rate18_06, rTxAGC_B_Rate54_24,
+							rTxAGC_B_Mcs03_Mcs00, rTxAGC_B_Mcs07_Mcs04,
+							rTxAGC_B_Mcs11_Mcs08, rTxAGC_B_Mcs15_Mcs12};
+	u8 i, rf, pwr_val[4];
+	u32 writeVal;
+	u16 RegOffset;
+
+	for(rf=0; rf<2; rf++)
+	{
+		writeVal = pValue[rf];
+		for(i=0; i<4; i++)
+		{
+			pwr_val[i] = (u8)((writeVal & (0x7f<<(i*8)))>>(i*8));
+			if (pwr_val[i]  > RF6052_MAX_TX_PWR)
+				pwr_val[i]  = RF6052_MAX_TX_PWR;
+		}
+		writeVal = (pwr_val[3]<<24) | (pwr_val[2]<<16) |(pwr_val[1]<<8) |pwr_val[0];
+
+		if(rf == 0)
+			RegOffset = RegOffset_A[index];
+		else
+			RegOffset = RegOffset_B[index];
+
+		PHY_SetBBReg(Adapter, RegOffset, bMaskDWord, writeVal);
+		//RTPRINT(FPHY, PHY_TXPWR, ("Set 0x%x = %08x\n", RegOffset, writeVal));
+
+		// 201005115 Joseph: Set Tx Power diff for Tx power training mechanism.
+		if(((pHalData->rf_type == RF_2T2R) &&
+				(RegOffset == rTxAGC_A_Mcs15_Mcs12 || RegOffset == rTxAGC_B_Mcs15_Mcs12))||
+		     ((pHalData->rf_type != RF_2T2R) &&
+				(RegOffset == rTxAGC_A_Mcs07_Mcs04 || RegOffset == rTxAGC_B_Mcs07_Mcs04))	)
+		{
+			writeVal = pwr_val[3];
+			if(RegOffset == rTxAGC_A_Mcs15_Mcs12 || RegOffset == rTxAGC_A_Mcs07_Mcs04)
+				RegOffset = 0xc90;
+			if(RegOffset == rTxAGC_B_Mcs15_Mcs12 || RegOffset == rTxAGC_B_Mcs07_Mcs04)
+				RegOffset = 0xc98;
+			for(i=0; i<3; i++)
+			{
+				if(i!=2)
+					writeVal = (writeVal>8)?(writeVal-8):0;
+				else
+					writeVal = (writeVal>6)?(writeVal-6):0;
+				rtw_write8(Adapter, (u32)(RegOffset+i), (u8)writeVal);
+			}
+		}
+	}
+}
+/*-----------------------------------------------------------------------------
+ * Function:	PHY_RF6052SetOFDMTxPower
+ *
+ * Overview:	For legacy and HY OFDM, we must read EEPROM TX power index for
+ *			different channel and read original value in TX power register area from
+ *			0xe00. We increase offset and original value to be correct tx pwr.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/05/2008 	MHC		Simulate 8192 series method.
+ * 01/06/2009	MHC		1. Prevent Path B tx power overflow or underflow dure to
+ *						A/B pwr difference or legacy/HT pwr diff.
+ *						2. We concern with path B legacy/HT OFDM difference.
+ * 01/22/2009	MHC		Support new EPRO format from SD3.
+ *
+ *---------------------------------------------------------------------------*/
+VOID
+rtl8192c_PHY_RF6052SetOFDMTxPower(
+	IN	PADAPTER	Adapter,
+	IN	u8*		pPowerLevel,
+	IN	u8		Channel)
+{
+	//HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u32 writeVal[2], powerBase0[2], powerBase1[2];
+	u8 index = 0;
+
+	getPowerBase(Adapter, pPowerLevel, Channel, &powerBase0[0], &powerBase1[0]);
+
+	for(index=0; index<6; index++)
+	{
+		getTxPowerWriteValByRegulatory(Adapter, Channel, index,
+			&powerBase0[0], &powerBase1[0], &writeVal[0]);
+
+		writeOFDMPowerReg(Adapter, index, &writeVal[0]);
+	}
+
+}
+
+
+static VOID
+phy_RF6052_Config_HardCode(
+	IN	PADAPTER		Adapter
+	)
+{
+
+	// Set Default Bandwidth to 20M
+	//Adapter->HalFunc	.SetBWModeHandler(Adapter, HT_CHANNEL_WIDTH_20);
+
+	// TODO: Set Default Channel to channel one for RTL8225
+
+}
+
+static int
+phy_RF6052_Config_ParaFile(
+	IN	PADAPTER		Adapter
+	)
+{
+	u32					u4RegValue=0;
+	u8					eRFPath;
+	BB_REGISTER_DEFINITION_T	*pPhyReg;
+
+	int					rtStatus = _SUCCESS;
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	static char			sz88CRadioAFile[] = RTL8188C_PHY_RADIO_A;
+	static char			sz88CRadioBFile[] = RTL8188C_PHY_RADIO_B;
+#ifdef CONFIG_USB_HCI
+	static char			sz88CRadioAFile_mCard[] = RTL8188C_PHY_RADIO_A_mCard;
+	static char			sz88CRadioBFile_mCard[] = RTL8188C_PHY_RADIO_B_mCard;
+	static char			sz88CRadioAFile_HP[] = RTL8188C_PHY_RADIO_A_HP;
+#endif
+	static char			sz92CRadioAFile[] = RTL8192C_PHY_RADIO_A;
+	static char			sz92CRadioBFile[] = RTL8192C_PHY_RADIO_B;
+	static char			sz8723RadioAFile[] = RTL8723_PHY_RADIO_A;
+	static char			sz8723RadioBFile[] = RTL8723_PHY_RADIO_B;
+	char					*pszRadioAFile, *pszRadioBFile;
+
+
+	if(IS_HARDWARE_TYPE_8192C(Adapter))
+	{
+		if(IS_92C_SERIAL( pHalData->VersionID))// 88c's IPA  is different from 92c's
+		{
+			pszRadioAFile = sz92CRadioAFile;
+			pszRadioBFile = sz92CRadioBFile;
+		}
+		else
+		{
+			pszRadioAFile = sz88CRadioAFile;
+			pszRadioBFile = sz88CRadioBFile;
+#ifdef CONFIG_USB_HCI
+			if( BOARD_MINICARD == pHalData->BoardType)
+			{
+				pszRadioAFile = sz88CRadioAFile_mCard;
+				pszRadioBFile = sz88CRadioBFile_mCard;
+			}
+			else if( BOARD_USB_High_PA == pHalData->BoardType)
+			{
+				pszRadioAFile = sz88CRadioAFile_HP;
+			}
+#endif
+		}
+	}
+	else if(IS_HARDWARE_TYPE_8723A(Adapter))
+	{
+		pszRadioAFile = sz8723RadioAFile;
+		pszRadioBFile = sz8723RadioBFile;
+	}
+
+	//3//-----------------------------------------------------------------
+	//3// <2> Initialize RF
+	//3//-----------------------------------------------------------------
+	//for(eRFPath = RF_PATH_A; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+	for(eRFPath = 0; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+	{
+
+		pPhyReg = &pHalData->PHYRegDef[eRFPath];
+
+		/*----Store original RFENV control type----*/
+		switch(eRFPath)
+		{
+		case RF_PATH_A:
+		case RF_PATH_C:
+			u4RegValue = PHY_QueryBBReg(Adapter, pPhyReg->rfintfs, bRFSI_RFENV);
+			break;
+		case RF_PATH_B :
+		case RF_PATH_D:
+			u4RegValue = PHY_QueryBBReg(Adapter, pPhyReg->rfintfs, bRFSI_RFENV<<16);
+			break;
+		}
+
+		/*----Set RF_ENV enable----*/
+		PHY_SetBBReg(Adapter, pPhyReg->rfintfe, bRFSI_RFENV<<16, 0x1);
+		rtw_udelay_os(1);//PlatformStallExecution(1);
+
+		/*----Set RF_ENV output high----*/
+		PHY_SetBBReg(Adapter, pPhyReg->rfintfo, bRFSI_RFENV, 0x1);
+		rtw_udelay_os(1);//PlatformStallExecution(1);
+
+		/* Set bit number of Address and Data for RF register */
+		PHY_SetBBReg(Adapter, pPhyReg->rfHSSIPara2, b3WireAddressLength, 0x0); 	// Set 1 to 4 bits for 8255
+		rtw_udelay_os(1);//PlatformStallExecution(1);
+
+		PHY_SetBBReg(Adapter, pPhyReg->rfHSSIPara2, b3WireDataLength, 0x0);	// Set 0 to 12  bits for 8255
+		rtw_udelay_os(1);//PlatformStallExecution(1);
+
+		/*----Initialize RF fom connfiguration file----*/
+		switch(eRFPath)
+		{
+		case RF_PATH_A:
+#ifdef CONFIG_EMBEDDED_FWIMG
+			rtStatus= rtl8192c_PHY_ConfigRFWithHeaderFile(Adapter,(RF_RADIO_PATH_E)eRFPath);
+#else
+			rtStatus = rtl8192c_PHY_ConfigRFWithParaFile(Adapter, pszRadioAFile, (RF_RADIO_PATH_E)eRFPath);
+#endif
+			break;
+		case RF_PATH_B:
+#ifdef CONFIG_EMBEDDED_FWIMG
+			rtStatus = rtl8192c_PHY_ConfigRFWithHeaderFile(Adapter,(RF_RADIO_PATH_E)eRFPath);
+#else
+			rtStatus = rtl8192c_PHY_ConfigRFWithParaFile(Adapter, pszRadioBFile, (RF_RADIO_PATH_E)eRFPath);
+#endif
+			break;
+		case RF_PATH_C:
+			break;
+		case RF_PATH_D:
+			break;
+		}
+
+		/*----Restore RFENV control type----*/;
+		switch(eRFPath)
+		{
+		case RF_PATH_A:
+		case RF_PATH_C:
+			PHY_SetBBReg(Adapter, pPhyReg->rfintfs, bRFSI_RFENV, u4RegValue);
+			break;
+		case RF_PATH_B :
+		case RF_PATH_D:
+			PHY_SetBBReg(Adapter, pPhyReg->rfintfs, bRFSI_RFENV<<16, u4RegValue);
+			break;
+		}
+
+		if(rtStatus != _SUCCESS){
+			//RT_TRACE(COMP_FPGA, DBG_LOUD, ("phy_RF6052_Config_ParaFile():Radio[%d] Fail!!", eRFPath));
+			goto phy_RF6052_Config_ParaFile_Fail;
+		}
+
+	}
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("<---phy_RF6052_Config_ParaFile()\n"));
+	return rtStatus;
+
+phy_RF6052_Config_ParaFile_Fail:
+	return rtStatus;
+}
+
+
+int
+PHY_RF6052_Config8192C(
+	IN	PADAPTER		Adapter)
+{
+	HAL_DATA_TYPE				*pHalData = GET_HAL_DATA(Adapter);
+	int					rtStatus = _SUCCESS;
+
+	//
+	// Initialize general global value
+	//
+	// TODO: Extend RF_PATH_C and RF_PATH_D in the future
+	if(pHalData->rf_type == RF_1T1R)
+		pHalData->NumTotalRFPath = 1;
+	else
+		pHalData->NumTotalRFPath = 2;
+
+	//
+	// Config BB and RF
+	//
+	rtStatus = phy_RF6052_Config_ParaFile(Adapter);
+#if 0
+	switch( Adapter->MgntInfo.bRegHwParaFile )
+	{
+		case 0:
+			phy_RF6052_Config_HardCode(Adapter);
+			break;
+
+		case 1:
+			rtStatus = phy_RF6052_Config_ParaFile(Adapter);
+			break;
+
+		case 2:
+			// Partial Modify.
+			phy_RF6052_Config_HardCode(Adapter);
+			phy_RF6052_Config_ParaFile(Adapter);
+			break;
+
+		default:
+			phy_RF6052_Config_HardCode(Adapter);
+			break;
+	}
+#endif
+	return rtStatus;
+
+}
+
+
+//
+// ==> RF shadow Operation API Code Section!!!
+//
+/*-----------------------------------------------------------------------------
+ * Function:	PHY_RFShadowRead
+ *				PHY_RFShadowWrite
+ *				PHY_RFShadowCompare
+ *				PHY_RFShadowRecorver
+ *				PHY_RFShadowCompareAll
+ *				PHY_RFShadowRecorverAll
+ *				PHY_RFShadowCompareFlagSet
+ *				PHY_RFShadowRecorverFlagSet
+ *
+ * Overview:	When we set RF register, we must write shadow at first.
+ *			When we are running, we must compare shadow abd locate error addr.
+ *			Decide to recorver or not.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ * When			Who		Remark
+ * 11/20/2008 	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+u32
+PHY_RFShadowRead(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset)
+{
+	return	RF_Shadow[eRFPath][Offset].Value;
+
+}	/* PHY_RFShadowRead */
+
+
+VOID
+PHY_RFShadowWrite(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset,
+	IN	u32				Data)
+{
+	RF_Shadow[eRFPath][Offset].Value = (Data & bRFRegOffsetMask);
+	RF_Shadow[eRFPath][Offset].Driver_Write = _TRUE;
+
+}	/* PHY_RFShadowWrite */
+
+
+BOOLEAN
+PHY_RFShadowCompare(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset)
+{
+	u32	reg;
+	// Check if we need to check the register
+	if (RF_Shadow[eRFPath][Offset].Compare == _TRUE)
+	{
+		reg = PHY_QueryRFReg(Adapter, eRFPath, Offset, bRFRegOffsetMask);
+		// Compare shadow and real rf register for 20bits!!
+		if (RF_Shadow[eRFPath][Offset].Value != reg)
+		{
+			// Locate error position.
+			RF_Shadow[eRFPath][Offset].ErrorOrNot = _TRUE;
+			//RT_TRACE(COMP_INIT, DBG_LOUD,
+			//("PHY_RFShadowCompare RF-%d Addr%02lx Err = %05lx\n",
+			//eRFPath, Offset, reg));
+		}
+		return RF_Shadow[eRFPath][Offset].ErrorOrNot ;
+	}
+	return _FALSE;
+}	/* PHY_RFShadowCompare */
+
+
+VOID
+PHY_RFShadowRecorver(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset)
+{
+	// Check if the address is error
+	if (RF_Shadow[eRFPath][Offset].ErrorOrNot == _TRUE)
+	{
+		// Check if we need to recorver the register.
+		if (RF_Shadow[eRFPath][Offset].Recorver == _TRUE)
+		{
+			PHY_SetRFReg(Adapter, eRFPath, Offset, bRFRegOffsetMask,
+							RF_Shadow[eRFPath][Offset].Value);
+			//RT_TRACE(COMP_INIT, DBG_LOUD,
+			//("PHY_RFShadowRecorver RF-%d Addr%02lx=%05lx",
+			//eRFPath, Offset, RF_Shadow[eRFPath][Offset].Value));
+		}
+	}
+
+}	/* PHY_RFShadowRecorver */
+
+
+VOID
+PHY_RFShadowCompareAll(
+	IN	PADAPTER			Adapter)
+{
+	u32		eRFPath;
+	u32		Offset;
+
+	for (eRFPath = 0; eRFPath < RF6052_MAX_PATH; eRFPath++)
+	{
+		for (Offset = 0; Offset <= RF6052_MAX_REG; Offset++)
+		{
+			PHY_RFShadowCompare(Adapter, (RF_RADIO_PATH_E)eRFPath, Offset);
+		}
+	}
+
+}	/* PHY_RFShadowCompareAll */
+
+
+VOID
+PHY_RFShadowRecorverAll(
+	IN	PADAPTER			Adapter)
+{
+	u32		eRFPath;
+	u32		Offset;
+
+	for (eRFPath = 0; eRFPath < RF6052_MAX_PATH; eRFPath++)
+	{
+		for (Offset = 0; Offset <= RF6052_MAX_REG; Offset++)
+		{
+			PHY_RFShadowRecorver(Adapter, (RF_RADIO_PATH_E)eRFPath, Offset);
+		}
+	}
+
+}	/* PHY_RFShadowRecorverAll */
+
+
+VOID
+PHY_RFShadowCompareFlagSet(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset,
+	IN	u8				Type)
+{
+	// Set True or False!!!
+	RF_Shadow[eRFPath][Offset].Compare = Type;
+
+}	/* PHY_RFShadowCompareFlagSet */
+
+
+VOID
+PHY_RFShadowRecorverFlagSet(
+	IN	PADAPTER			Adapter,
+	IN	RF_RADIO_PATH_E	eRFPath,
+	IN	u32				Offset,
+	IN	u8				Type)
+{
+	// Set True or False!!!
+	RF_Shadow[eRFPath][Offset].Recorver= Type;
+
+}	/* PHY_RFShadowRecorverFlagSet */
+
+
+VOID
+PHY_RFShadowCompareFlagSetAll(
+	IN	PADAPTER			Adapter)
+{
+	u32		eRFPath;
+	u32		Offset;
+
+	for (eRFPath = 0; eRFPath < RF6052_MAX_PATH; eRFPath++)
+	{
+		for (Offset = 0; Offset <= RF6052_MAX_REG; Offset++)
+		{
+			// 2008/11/20 MH For S3S4 test, we only check reg 26/27 now!!!!
+			if (Offset != 0x26 && Offset != 0x27)
+				PHY_RFShadowCompareFlagSet(Adapter, (RF_RADIO_PATH_E)eRFPath, Offset, _FALSE);
+			else
+				PHY_RFShadowCompareFlagSet(Adapter, (RF_RADIO_PATH_E)eRFPath, Offset, _TRUE);
+		}
+	}
+
+}	/* PHY_RFShadowCompareFlagSetAll */
+
+
+VOID
+PHY_RFShadowRecorverFlagSetAll(
+	IN	PADAPTER			Adapter)
+{
+	u32		eRFPath;
+	u32		Offset;
+
+	for (eRFPath = 0; eRFPath < RF6052_MAX_PATH; eRFPath++)
+	{
+		for (Offset = 0; Offset <= RF6052_MAX_REG; Offset++)
+		{
+			// 2008/11/20 MH For S3S4 test, we only check reg 26/27 now!!!!
+			if (Offset != 0x26 && Offset != 0x27)
+				PHY_RFShadowRecorverFlagSet(Adapter, (RF_RADIO_PATH_E)eRFPath, Offset, _FALSE);
+			else
+				PHY_RFShadowRecorverFlagSet(Adapter, (RF_RADIO_PATH_E)eRFPath, Offset, _TRUE);
+		}
+	}
+
+}	/* PHY_RFShadowCompareFlagSetAll */
+
+VOID
+PHY_RFShadowRefresh(
+	IN	PADAPTER			Adapter)
+{
+	u32		eRFPath;
+	u32		Offset;
+
+	for (eRFPath = 0; eRFPath < RF6052_MAX_PATH; eRFPath++)
+	{
+		for (Offset = 0; Offset < RF6052_MAX_REG; Offset++)
+		{
+			RF_Shadow[eRFPath][Offset].Value = 0;
+			RF_Shadow[eRFPath][Offset].Compare = _FALSE;
+			RF_Shadow[eRFPath][Offset].Recorver  = _FALSE;
+			RF_Shadow[eRFPath][Offset].ErrorOrNot = _FALSE;
+			RF_Shadow[eRFPath][Offset].Driver_Write = _FALSE;
+		}
+	}
+
+}	/* PHY_RFShadowRead */
+
+/* End of HalRf6052.c */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_rxdesc.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_rxdesc.c
new file mode 100644
index 000000000000..1b102c650563
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_rxdesc.c
@@ -0,0 +1,874 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTL8192C_REDESC_C_
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtl8192c_hal.h>
+
+static u8 evm_db2percentage(s8 value)
+{
+	//
+	// -33dB~0dB to 0%~99%
+	//
+	s8 ret_val;
+
+	ret_val = value;
+	//ret_val /= 2;
+
+	RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("EVMdbToPercentage92S Value=%d / %x \n", ret_val, ret_val));
+
+	if(ret_val >= 0)
+		ret_val = 0;
+	if(ret_val <= -33)
+		ret_val = -33;
+
+	ret_val = 0 - ret_val;
+	ret_val*=3;
+
+	if(ret_val == 99)
+		ret_val = 100;
+
+	return(ret_val);
+}
+
+
+static s32 signal_scale_mapping(_adapter *padapter, s32 cur_sig )
+{
+	s32 ret_sig;
+
+#ifdef CONFIG_USB_HCI
+	if(cur_sig >= 51 && cur_sig <= 100)
+	{
+		ret_sig = 100;
+	}
+	else if(cur_sig >= 41 && cur_sig <= 50)
+	{
+		ret_sig = 80 + ((cur_sig - 40)*2);
+	}
+	else if(cur_sig >= 31 && cur_sig <= 40)
+	{
+		ret_sig = 66 + (cur_sig - 30);
+	}
+	else if(cur_sig >= 21 && cur_sig <= 30)
+	{
+		ret_sig = 54 + (cur_sig - 20);
+	}
+	else if(cur_sig >= 10 && cur_sig <= 20)
+	{
+		ret_sig = 42 + (((cur_sig - 10) * 2) / 3);
+	}
+	else if(cur_sig >= 5 && cur_sig <= 9)
+	{
+		ret_sig = 22 + (((cur_sig - 5) * 3) / 2);
+	}
+	else if(cur_sig >= 1 && cur_sig <= 4)
+	{
+		ret_sig = 6 + (((cur_sig - 1) * 3) / 2);
+	}
+	else
+	{
+		ret_sig = cur_sig;
+	}
+#else
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+
+	if(pHalData->CustomerID == RT_CID_819x_Lenovo)
+	{
+		// Step 1. Scale mapping.
+		// 20100611 Joseph: Re-tunning RSSI presentation for Lenovo.
+		// 20100426 Joseph: Modify Signal strength mapping.
+		// This modification makes the RSSI indication similar to Intel solution.
+		// 20100414 Joseph: Tunning RSSI for Lenovo according to RTL8191SE.
+		if(cur_sig >= 54 && cur_sig <= 100)
+		{
+			ret_sig = 100;
+		}
+		else if(cur_sig>=42 && cur_sig <= 53 )
+		{
+			ret_sig = 95;
+		}
+		else if(cur_sig>=36 && cur_sig <= 41 )
+		{
+			ret_sig = 74 + ((cur_sig - 36) *20)/6;
+		}
+		else if(cur_sig>=33 && cur_sig <= 35 )
+		{
+			ret_sig = 65 + ((cur_sig - 33) *8)/2;
+		}
+		else if(cur_sig>=18 && cur_sig <= 32 )
+		{
+			ret_sig = 62 + ((cur_sig - 18) *2)/15;
+		}
+		else if(cur_sig>=15 && cur_sig <= 17 )
+		{
+			ret_sig = 33 + ((cur_sig - 15) *28)/2;
+		}
+		else if(cur_sig>=10 && cur_sig <= 14 )
+		{
+			ret_sig = 39;
+		}
+		else if(cur_sig>=8 && cur_sig <= 9 )
+		{
+			ret_sig = 33;
+		}
+		else if(cur_sig <= 8 )
+		{
+			ret_sig = 19;
+		}
+	}
+	else
+	{
+		// Step 1. Scale mapping.
+		if(cur_sig >= 61 && cur_sig <= 100)
+		{
+			ret_sig = 90 + ((cur_sig - 60) / 4);
+		}
+		else if(cur_sig >= 41 && cur_sig <= 60)
+		{
+			ret_sig = 78 + ((cur_sig - 40) / 2);
+		}
+		else if(cur_sig >= 31 && cur_sig <= 40)
+		{
+			ret_sig = 66 + (cur_sig - 30);
+		}
+		else if(cur_sig >= 21 && cur_sig <= 30)
+		{
+			ret_sig = 54 + (cur_sig - 20);
+		}
+		else if(cur_sig >= 5 && cur_sig <= 20)
+		{
+			ret_sig = 42 + (((cur_sig - 5) * 2) / 3);
+		}
+		else if(cur_sig == 4)
+		{
+			ret_sig = 36;
+		}
+		else if(cur_sig == 3)
+		{
+			ret_sig = 27;
+		}
+		else if(cur_sig == 2)
+		{
+			ret_sig = 18;
+		}
+		else if(cur_sig == 1)
+		{
+			ret_sig = 9;
+		}
+		else
+		{
+			ret_sig = cur_sig;
+		}
+	}
+#endif
+
+	return ret_sig;
+}
+
+
+static s32  translate2dbm(u8 signal_strength_idx)
+{
+	s32	signal_power; // in dBm.
+
+
+	// Translate to dBm (x=0.5y-95).
+	signal_power = (s32)((signal_strength_idx + 1) >> 1);
+	signal_power -= 95;
+
+	return signal_power;
+}
+
+static void query_rx_phy_status(union recv_frame *prframe, struct phy_stat *pphy_stat)
+{
+	PHY_STS_OFDM_8192CD_T	*pOfdm_buf;
+	PHY_STS_CCK_8192CD_T	*pCck_buf;
+	u8	i, max_spatial_stream, evm;
+	s8	rx_pwr[4], rx_pwr_all = 0;
+	u8	pwdb_all;
+	u32	rssi,total_rssi=0;
+	u8 	bcck_rate=0, rf_rx_num = 0, cck_highpwr = 0;
+	_adapter				*padapter = prframe->u.hdr.adapter;
+	struct rx_pkt_attrib	*pattrib = &prframe->u.hdr.attrib;
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(padapter);
+	struct dm_priv		*pdmpriv = &pHalData->dmpriv;
+	u8	tmp_rxsnr;
+	s8	rx_snrX;
+
+#ifdef CONFIG_HW_ANTENNA_DIVERSITY
+	PHY_RX_DRIVER_INFO_8192CD *pDrvInfo = ((PHY_RX_DRIVER_INFO_8192CD *)pphy_stat);
+	u8 	bant1_sel = (pDrvInfo->ANTSEL == 1)?_TRUE:_FALSE;
+#endif
+
+	// Record it for next packet processing
+	bcck_rate=(pattrib->mcs_rate<=3? 1:0);
+
+	if(bcck_rate) //CCK
+	{
+		u8 report;
+#ifdef CONFIG_HW_ANTENNA_DIVERSITY
+		if(bant1_sel == _TRUE)
+			pHalData->CCK_Ant1_Cnt++;
+		else
+			pHalData->CCK_Ant2_Cnt++;
+#endif
+
+		// CCK Driver info Structure is not the same as OFDM packet.
+		pCck_buf = (PHY_STS_CCK_8192CD_T *)pphy_stat;
+		//Adapter->RxStats.NumQryPhyStatusCCK++;
+
+		//
+		// (1)Hardware does not provide RSSI for CCK
+		// (2)PWDB, Average PWDB cacluated by hardware (for rate adaptive)
+		//
+
+		if(padapter->pwrctrlpriv.rf_pwrstate == rf_on)
+			cck_highpwr = (u8)pHalData->bCckHighPower;
+		else
+			cck_highpwr = _FALSE;
+
+		if(!cck_highpwr)
+		{
+			report = pCck_buf->cck_agc_rpt&0xc0;
+			report = report>>6;
+			switch(report)
+			{
+				// 03312009 modified by cosa
+				// Modify the RF RNA gain value to -40, -20, -2, 14 by Jenyu's suggestion
+				// Note: different RF with the different RNA gain.
+				case 0x3:
+					rx_pwr_all = (-46) - (pCck_buf->cck_agc_rpt & 0x3e);
+					break;
+				case 0x2:
+					rx_pwr_all = (-26) - (pCck_buf->cck_agc_rpt & 0x3e);
+					break;
+				case 0x1:
+					rx_pwr_all = (-12) - (pCck_buf->cck_agc_rpt & 0x3e);
+					break;
+				case 0x0:
+					rx_pwr_all = (16) - (pCck_buf->cck_agc_rpt & 0x3e);
+					break;
+			}
+		}
+		else
+		{
+			report = pCck_buf->cck_agc_rpt & 0x60;
+			report = report>>5;
+			switch(report)
+			{
+				case 0x3:
+					rx_pwr_all = (-46) - ((pCck_buf->cck_agc_rpt & 0x1f)<<1) ;
+					break;
+				case 0x2:
+					rx_pwr_all = (-26)- ((pCck_buf->cck_agc_rpt & 0x1f)<<1);
+					break;
+				case 0x1:
+					rx_pwr_all = (-12) - ((pCck_buf->cck_agc_rpt & 0x1f)<<1) ;
+					break;
+				case 0x0:
+					rx_pwr_all = (16) - ((pCck_buf->cck_agc_rpt & 0x1f)<<1) ;
+					break;
+			}
+		}
+
+		pwdb_all= query_rx_pwr_percentage(rx_pwr_all);
+		if(pHalData->CustomerID == RT_CID_819x_Lenovo)
+		{
+			// CCK gain is smaller than OFDM/MCS gain,
+			// so we add gain diff by experiences, the val is 6
+			pwdb_all+=6;
+			if(pwdb_all > 100)
+				pwdb_all = 100;
+			// modify the offset to make the same gain index with OFDM.
+			if(pwdb_all > 34 && pwdb_all <= 42)
+				pwdb_all -= 2;
+			else if(pwdb_all > 26 && pwdb_all <= 34)
+				pwdb_all -= 6;
+			else if(pwdb_all > 14 && pwdb_all <= 26)
+				pwdb_all -= 8;
+			else if(pwdb_all > 4 && pwdb_all <= 14)
+				pwdb_all -= 4;
+		}
+
+		pattrib->RxPWDBAll = pwdb_all;	//for DIG/rate adaptive
+		pattrib->RecvSignalPower = rx_pwr_all;	//dBM
+		padapter->recvpriv.rxpwdb = rx_pwr_all;
+		//
+		// (3) Get Signal Quality (EVM)
+		//
+		//if(bPacketMatchBSSID)
+		{
+			u8	sq;
+
+			if(pHalData->CustomerID == RT_CID_819x_Lenovo)
+			{
+				// mapping to 5 bars for vista signal strength
+				// signal quality in driver will be displayed to signal strength
+				// in vista.
+				if(pwdb_all >= 50)
+					sq = 100;
+				else if(pwdb_all >= 35 && pwdb_all < 50)
+					sq = 80;
+				else if(pwdb_all >= 22 && pwdb_all < 35)
+					sq = 60;
+				else if(pwdb_all >= 18 && pwdb_all < 22)
+					sq = 40;
+				else
+					sq = 20;
+			}
+			else
+			{
+				if(pwdb_all> 40)
+				{
+					sq = 100;
+				}
+				else
+				{
+					sq = pCck_buf->SQ_rpt;
+
+					if(pCck_buf->SQ_rpt > 64)
+						sq = 0;
+					else if (pCck_buf->SQ_rpt < 20)
+						sq= 100;
+					else
+						sq = ((64-sq) * 100) / 44;
+
+				}
+			}
+
+			pattrib->signal_qual=sq;
+			pattrib->rx_mimo_signal_qual[0]=sq;
+			pattrib->rx_mimo_signal_qual[1]=(-1);
+		}
+
+	}
+	else //OFDM/HT
+	{
+#ifdef CONFIG_HW_ANTENNA_DIVERSITY
+		if(bant1_sel == _TRUE)
+			pHalData->OFDM_Ant1_Cnt++;
+		else
+			pHalData->OFDM_Ant2_Cnt++;
+#endif
+		pdmpriv->OFDM_Pkt_Cnt++;
+
+		pOfdm_buf = (PHY_STS_OFDM_8192CD_T *)pphy_stat;
+
+		//
+		// (1)Get RSSI per-path
+		//
+		for(i=0; i<pHalData->NumTotalRFPath; i++)
+		{
+			// 2008/01/30 MH we will judge RF RX path now.
+			if (pHalData->bRFPathRxEnable[i])
+				rf_rx_num++;
+			//else
+				//continue;
+
+			rx_pwr[i] =  ((pOfdm_buf->trsw_gain_X[i]&0x3F)*2) - 110;
+			padapter->recvpriv.RxRssi[i] = rx_pwr[i];
+			/* Translate DBM to percentage. */
+			pattrib->rx_rssi[i] = rssi = query_rx_pwr_percentage(rx_pwr[i]);
+			total_rssi += rssi;
+
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("RF-%d RXPWR=%x RSSI=%d\n", i, rx_pwr[i], rssi));
+
+			//Get Rx snr value in DB
+			tmp_rxsnr =	pOfdm_buf->rxsnr_X[i];
+			rx_snrX = (s8)(tmp_rxsnr);
+			rx_snrX >>= 1;
+			padapter->recvpriv.RxSNRdB[i] =  (int)rx_snrX;
+			pattrib->rx_snr[i]=pOfdm_buf->rxsnr_X[i];
+			/* Record Signal Strength for next packet */
+			//if(bPacketMatchBSSID)
+			{
+				//pRfd->Status.RxMIMOSignalStrength[i] =(u1Byte) RSSI;
+
+				//The following is for lenovo signal strength in vista
+				if(pHalData->CustomerID == RT_CID_819x_Lenovo)
+				{
+					u8	sq;
+
+					if(i == 0)
+					{
+						// mapping to 5 bars for vista signal strength
+						// signal quality in driver will be displayed to signal strength
+						// in vista.
+						if(rssi >= 50)
+							sq = 100;
+						else if(rssi >= 35 && rssi < 50)
+							sq = 80;
+						else if(rssi >= 22 && rssi < 35)
+							sq = 60;
+						else if(rssi >= 18 && rssi < 22)
+							sq = 40;
+						else
+							sq = 20;
+						//DbgPrint("ofdm/mcs RSSI=%d\n", RSSI);
+						//pRfd->Status.SignalQuality = SQ;
+						//DbgPrint("ofdm/mcs SQ = %d\n", pRfd->Status.SignalQuality);
+					}
+				}
+			}
+		}
+
+
+		//
+		// (2)PWDB, Average PWDB cacluated by hardware (for rate adaptive),average
+		//
+		rx_pwr_all = (((pOfdm_buf->pwdb_all ) >> 1 )& 0x7f) -110;//for OFDM Average RSSI
+		pwdb_all = query_rx_pwr_percentage(rx_pwr_all);
+
+		RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("PWDB_ALL=%d\n",	pwdb_all));
+
+		pattrib->RxPWDBAll = pwdb_all;	//for DIG/rate adaptive
+		pattrib->RecvSignalPower = rx_pwr_all;//dBM
+		padapter->recvpriv.rxpwdb = rx_pwr_all;
+		//
+		// (3)EVM of HT rate
+		//
+		if(pHalData->CustomerID != RT_CID_819x_Lenovo)
+		{
+			if(pattrib->rxht &&  pattrib->mcs_rate >=20 && pattrib->mcs_rate<=27)
+				max_spatial_stream = 2; //both spatial stream make sense
+			else
+				max_spatial_stream = 1; //only spatial stream 1 makes sense
+
+			for(i=0; i<max_spatial_stream; i++)
+			{
+				// Do not use shift operation like "rx_evmX >>= 1" because the compilor of free build environment
+				// fill most significant bit to "zero" when doing shifting operation which may change a negative
+				// value to positive one, then the dbm value (which is supposed to be negative)  is not correct anymore.
+				evm = evm_db2percentage( (pOfdm_buf->rxevm_X[i]/*/ 2*/));//dbm
+
+				RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("RXRATE=%x RXEVM=%x EVM=%s%d\n",
+					pattrib->mcs_rate, pOfdm_buf->rxevm_X[i], "%",evm));
+
+				//if(bPacketMatchBSSID)
+				{
+					if(i==0) // Fill value in RFD, Get the first spatial stream only
+					{
+						pattrib->signal_qual = (u8)(evm & 0xff);
+					}
+					pattrib->rx_mimo_signal_qual[i] = (u8)(evm & 0xff);
+				}
+			}
+
+		}
+
+		//
+		// 4. Record rx statistics for debug
+		//
+
+	}
+
+
+	//UI BSS List signal strength(in percentage), make it good looking, from 0~100.
+	//It is assigned to the BSS List in GetValueFromBeaconOrProbeRsp().
+	if(bcck_rate)
+	{
+		pattrib->signal_strength=(u8)signal_scale_mapping(padapter, pwdb_all);
+	}
+	else
+	{
+		if (rf_rx_num != 0)
+		{
+			pattrib->signal_strength= (u8)(signal_scale_mapping(padapter, total_rssi/=rf_rx_num));
+		}
+	}
+	//DBG_8192C("%s,rx_pwr_all(%d),RxPWDBAll(%d)\n",__FUNCTION__,rx_pwr_all,pattrib->RxPWDBAll);
+
+}
+
+
+static void process_rssi(_adapter *padapter,union recv_frame *prframe)
+{
+	u32	last_rssi, tmp_val;
+	struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	struct signal_stat * signal_stat = &padapter->recvpriv.signal_strength_data;
+#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+
+	//DBG_8192C("process_rssi=> pattrib->rssil(%d) signal_strength(%d)\n ",pattrib->RecvSignalPower,pattrib->signal_strength);
+	//if(pRfd->Status.bPacketToSelf || pRfd->Status.bPacketBeacon)
+	{
+
+	#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+		if(signal_stat->update_req) {
+			signal_stat->total_num = 0;
+			signal_stat->total_val = 0;
+			signal_stat->update_req = 0;
+		}
+
+		signal_stat->total_num++;
+		signal_stat->total_val  += pattrib->signal_strength;
+		signal_stat->avg_val = signal_stat->total_val / signal_stat->total_num;
+	#else //CONFIG_NEW_SIGNAL_STAT_PROCESS
+
+		//Adapter->RxStats.RssiCalculateCnt++;	//For antenna Test
+		if(padapter->recvpriv.signal_strength_data.total_num++ >= PHY_RSSI_SLID_WIN_MAX)
+		{
+			padapter->recvpriv.signal_strength_data.total_num = PHY_RSSI_SLID_WIN_MAX;
+			last_rssi = padapter->recvpriv.signal_strength_data.elements[padapter->recvpriv.signal_strength_data.index];
+			padapter->recvpriv.signal_strength_data.total_val -= last_rssi;
+		}
+		padapter->recvpriv.signal_strength_data.total_val  +=pattrib->signal_strength;
+
+		padapter->recvpriv.signal_strength_data.elements[padapter->recvpriv.signal_strength_data.index++] = pattrib->signal_strength;
+		if(padapter->recvpriv.signal_strength_data.index >= PHY_RSSI_SLID_WIN_MAX)
+			padapter->recvpriv.signal_strength_data.index = 0;
+
+
+		tmp_val = padapter->recvpriv.signal_strength_data.total_val/padapter->recvpriv.signal_strength_data.total_num;
+
+		if(padapter->recvpriv.is_signal_dbg) {
+			padapter->recvpriv.signal_strength= padapter->recvpriv.signal_strength_dbg;
+			padapter->recvpriv.rssi=(s8)translate2dbm((u8)padapter->recvpriv.signal_strength_dbg);
+		} else {
+			padapter->recvpriv.signal_strength= tmp_val;
+			padapter->recvpriv.rssi=(s8)translate2dbm((u8)tmp_val);
+		}
+
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("UI RSSI = %d, ui_rssi.TotalVal = %d, ui_rssi.TotalNum = %d\n", tmp_val, padapter->recvpriv.signal_strength_data.total_val,padapter->recvpriv.signal_strength_data.total_num));
+	#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+	}
+
+}// Process_UI_RSSI_8192C
+
+
+static void process_PWDB(_adapter *padapter, union recv_frame *prframe)
+{
+	int	UndecoratedSmoothedPWDB;
+	int	UndecoratedSmoothedCCK;
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(padapter);
+	struct dm_priv		*pdmpriv = &pHalData->dmpriv;
+	struct rx_pkt_attrib	*pattrib= &prframe->u.hdr.attrib;
+	struct sta_info		*psta = prframe->u.hdr.psta;
+	u8 isCCKrate=(pattrib->mcs_rate<=3? 1:0);
+
+
+	if(psta)
+	{
+		UndecoratedSmoothedPWDB = psta->rssi_stat.UndecoratedSmoothedPWDB;
+		UndecoratedSmoothedCCK = psta->rssi_stat.UndecoratedSmoothedCCK;
+	}
+	else
+	{
+		UndecoratedSmoothedPWDB = pdmpriv->UndecoratedSmoothedPWDB;
+		UndecoratedSmoothedCCK = pdmpriv->UndecoratedSmoothedCCK;
+	}
+
+	//if(pRfd->Status.bPacketToSelf || pRfd->Status.bPacketBeacon)
+
+	if(!isCCKrate)
+	{
+		// Process OFDM RSSI
+		if(UndecoratedSmoothedPWDB < 0) // initialize
+		{
+			UndecoratedSmoothedPWDB = pattrib->RxPWDBAll;
+		}
+
+		if(pattrib->RxPWDBAll > (u32)UndecoratedSmoothedPWDB)
+		{
+			UndecoratedSmoothedPWDB =
+					( ((UndecoratedSmoothedPWDB)*(Rx_Smooth_Factor-1)) +
+					(pattrib->RxPWDBAll)) /(Rx_Smooth_Factor);
+
+			UndecoratedSmoothedPWDB = UndecoratedSmoothedPWDB + 1;
+		}
+		else
+		{
+			UndecoratedSmoothedPWDB =
+					( ((UndecoratedSmoothedPWDB)*(Rx_Smooth_Factor-1)) +
+					(pattrib->RxPWDBAll)) /(Rx_Smooth_Factor);
+		}
+	}
+	else
+	{
+		// Process CCK RSSI
+		if(UndecoratedSmoothedCCK < 0) // initialize
+		{
+			UndecoratedSmoothedCCK = pattrib->RxPWDBAll;
+		}
+
+		if(pattrib->RxPWDBAll > (u32)UndecoratedSmoothedCCK)
+		{
+			UndecoratedSmoothedCCK =
+					( ((UndecoratedSmoothedCCK)*(Rx_Smooth_Factor-1)) +
+					(pattrib->RxPWDBAll)) /(Rx_Smooth_Factor);
+
+			UndecoratedSmoothedCCK = UndecoratedSmoothedCCK + 1;
+		}
+		else
+		{
+			UndecoratedSmoothedCCK =
+					( ((UndecoratedSmoothedCCK)*(Rx_Smooth_Factor-1)) +
+					(pattrib->RxPWDBAll)) /(Rx_Smooth_Factor);
+		}
+	}
+
+
+	if(psta)
+	{
+		//psta->UndecoratedSmoothedPWDB = UndecoratedSmoothedPWDB;//todo:
+		pdmpriv->UndecoratedSmoothedPWDB = UndecoratedSmoothedPWDB;
+
+		if(pdmpriv->RSSI_Select == RSSI_OFDM){
+			psta->rssi_stat.UndecoratedSmoothedPWDB = UndecoratedSmoothedPWDB;
+		}
+		else if(pdmpriv->RSSI_Select == RSSI_CCK){
+			psta->rssi_stat.UndecoratedSmoothedPWDB = UndecoratedSmoothedCCK;
+		}
+		else{
+			if(UndecoratedSmoothedPWDB <0 )
+				pdmpriv->UndecoratedSmoothedPWDB = UndecoratedSmoothedCCK;
+			else
+				pdmpriv->UndecoratedSmoothedPWDB = UndecoratedSmoothedPWDB;
+		}
+		psta->rssi_stat.UndecoratedSmoothedCCK = UndecoratedSmoothedCCK;
+	}
+	else
+	{
+		//pdmpriv->UndecoratedSmoothedPWDB = UndecoratedSmoothedPWDB;
+
+		if(pdmpriv->RSSI_Select == RSSI_OFDM){
+			pdmpriv->UndecoratedSmoothedPWDB = UndecoratedSmoothedPWDB;
+		}
+		else if(pdmpriv->RSSI_Select == RSSI_CCK){
+			pdmpriv->UndecoratedSmoothedPWDB = UndecoratedSmoothedCCK;
+		}
+		else	{
+			if(UndecoratedSmoothedPWDB <0 )
+				pdmpriv->UndecoratedSmoothedPWDB = UndecoratedSmoothedCCK;
+			else
+				pdmpriv->UndecoratedSmoothedPWDB = UndecoratedSmoothedPWDB;
+
+		}
+		pdmpriv->UndecoratedSmoothedCCK = UndecoratedSmoothedCCK;
+	}
+
+	//UpdateRxSignalStatistics8192C(padapter, prframe);
+
+}
+
+
+static void process_link_qual(_adapter *padapter,union recv_frame *prframe)
+{
+	u32	last_evm=0, tmpVal;
+	struct rx_pkt_attrib *pattrib;
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	struct signal_stat * signal_stat;
+#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+
+	if(prframe == NULL || padapter==NULL){
+		return;
+	}
+
+	pattrib = &prframe->u.hdr.attrib;
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	signal_stat = &padapter->recvpriv.signal_qual_data;
+#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+
+	//DBG_8192C("process_link_qual=> pattrib->signal_qual(%d)\n ",pattrib->signal_qual);
+
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	if(signal_stat->update_req) {
+		signal_stat->total_num = 0;
+		signal_stat->total_val = 0;
+		signal_stat->update_req = 0;
+	}
+
+	signal_stat->total_num++;
+	signal_stat->total_val  += pattrib->signal_qual;
+	signal_stat->avg_val = signal_stat->total_val / signal_stat->total_num;
+
+#else //CONFIG_NEW_SIGNAL_STAT_PROCESS
+	if(pattrib->signal_qual != 0)
+	{
+			//
+			// 1. Record the general EVM to the sliding window.
+			//
+			if(padapter->recvpriv.signal_qual_data.total_num++ >= PHY_LINKQUALITY_SLID_WIN_MAX)
+			{
+				padapter->recvpriv.signal_qual_data.total_num = PHY_LINKQUALITY_SLID_WIN_MAX;
+				last_evm = padapter->recvpriv.signal_qual_data.elements[padapter->recvpriv.signal_qual_data.index];
+				padapter->recvpriv.signal_qual_data.total_val -= last_evm;
+			}
+			padapter->recvpriv.signal_qual_data.total_val += pattrib->signal_qual;
+
+			padapter->recvpriv.signal_qual_data.elements[padapter->recvpriv.signal_qual_data.index++] = pattrib->signal_qual;
+			if(padapter->recvpriv.signal_qual_data.index >= PHY_LINKQUALITY_SLID_WIN_MAX)
+				padapter->recvpriv.signal_qual_data.index = 0;
+
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("Total SQ=%d  pattrib->signal_qual= %d\n", padapter->recvpriv.signal_qual_data.total_val, pattrib->signal_qual));
+
+			// <1> Showed on UI for user, in percentage.
+			tmpVal = padapter->recvpriv.signal_qual_data.total_val/padapter->recvpriv.signal_qual_data.total_num;
+			padapter->recvpriv.signal_qual=(u8)tmpVal;
+
+	}
+	else
+	{
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,(" pattrib->signal_qual =%d\n", pattrib->signal_qual));
+	}
+#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+
+}// Process_UiLinkQuality8192S
+
+
+static void process_phy_info(_adapter *padapter, union recv_frame *prframe)
+{
+	union recv_frame *precvframe = (union recv_frame *)prframe;
+
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+	// If we switch to the antenna for testing, the signal strength
+	// of the packets in this time shall not be counted into total receiving power.
+	// This prevents error counting Rx signal strength and affecting other dynamic mechanism.
+
+	// Select the packets to do RSSI checking for antenna switching.
+	SwAntDivRSSICheck8192C(padapter, precvframe->u.hdr.attrib.RxPWDBAll);
+
+	if(GET_HAL_DATA(padapter)->RSSI_test == _TRUE)
+		return;
+#endif
+	//
+	// Check RSSI
+	//
+	process_rssi(padapter, precvframe);
+	//
+	// Check PWDB.
+	//
+	process_PWDB(padapter, precvframe);
+	//
+	// Check EVM
+	//
+	process_link_qual(padapter,  precvframe);
+
+}
+
+
+void rtl8192c_translate_rx_signal_stuff(union recv_frame *precvframe, struct phy_stat *pphy_info)
+{
+	struct rx_pkt_attrib	*pattrib = &precvframe->u.hdr.attrib;
+	_adapter				*padapter = precvframe->u.hdr.adapter;
+	u8	bPacketMatchBSSID =_FALSE;
+	u8	bPacketToSelf = _FALSE;
+	u8	bPacketBeacon = _FALSE;
+
+	if((pattrib->physt) && (pphy_info != NULL))
+	{
+		bPacketMatchBSSID = ((!IsFrameTypeCtrl(precvframe->u.hdr.rx_data)) && !(pattrib->icv_err) && !(pattrib->crc_err) &&
+			_rtw_memcmp(get_hdr_bssid(precvframe->u.hdr.rx_data), get_my_bssid(&padapter->mlmeextpriv.mlmext_info.network), ETH_ALEN));
+
+
+		bPacketToSelf = bPacketMatchBSSID &&  (_rtw_memcmp(get_da(precvframe->u.hdr.rx_data), myid(&padapter->eeprompriv), ETH_ALEN));
+
+		bPacketBeacon =bPacketMatchBSSID && (GetFrameSubType(precvframe->u.hdr.rx_data) ==  WIFI_BEACON);
+
+		query_rx_phy_status(precvframe, pphy_info);
+
+		precvframe->u.hdr.psta = NULL;
+		if(bPacketMatchBSSID && check_fwstate(&padapter->mlmepriv, WIFI_AP_STATE) == _TRUE)
+		{
+			u8 *sa;
+			struct sta_info *psta=NULL;
+			struct sta_priv *pstapriv = &padapter->stapriv;
+
+			sa = get_sa(precvframe->u.hdr.rx_data);
+
+			psta = rtw_get_stainfo(pstapriv, sa);
+			if(psta)
+			{
+				precvframe->u.hdr.psta = psta;
+				process_phy_info(padapter, precvframe);
+			}
+		}
+		else if(bPacketToSelf || bPacketBeacon)
+		{
+			if(check_fwstate(&padapter->mlmepriv, WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE) == _TRUE)
+			{
+				u8 *sa;
+				struct sta_info *psta=NULL;
+				struct sta_priv *pstapriv = &padapter->stapriv;
+
+				sa = get_sa(precvframe->u.hdr.rx_data);
+
+				psta = rtw_get_stainfo(pstapriv, sa);
+				if(psta)
+				{
+					precvframe->u.hdr.psta = psta;
+				}
+			}
+
+			process_phy_info(padapter, precvframe);
+		}
+	}
+}
+
+void rtl8192c_query_rx_desc_status(union recv_frame *precvframe, struct recv_stat *pdesc)
+{
+	struct rx_pkt_attrib	*pattrib = &precvframe->u.hdr.attrib;
+
+	//Offset 0
+	pattrib->physt = (u8)((le32_to_cpu(pdesc->rxdw0) >> 26) & 0x1);
+	pattrib->pkt_len =  (u16)(le32_to_cpu(pdesc->rxdw0)&0x00003fff);
+	pattrib->drvinfo_sz = (u8)((le32_to_cpu(pdesc->rxdw0) >> 16) & 0xf) * 8;//uint 2^3 = 8 bytes
+
+	pattrib->shift_sz = (u8)((le32_to_cpu(pdesc->rxdw0) >> 24) & 0x3);
+
+	pattrib->crc_err = (u8)((le32_to_cpu(pdesc->rxdw0) >> 14) & 0x1);
+	pattrib->icv_err = (u8)((le32_to_cpu(pdesc->rxdw0) >> 15) & 0x1);
+	pattrib->qos = (u8)(( le32_to_cpu( pdesc->rxdw0 ) >> 23) & 0x1);// Qos data, wireless lan header length is 26
+	pattrib->bdecrypted = (le32_to_cpu(pdesc->rxdw0) & BIT(27))? 0:1;
+
+	//Offset 4
+	pattrib->mfrag = (u8)((le32_to_cpu(pdesc->rxdw1) >> 27) & 0x1);//more fragment bit
+
+	//Offset 8
+	pattrib->frag_num = (u8)((le32_to_cpu(pdesc->rxdw2) >> 12) & 0xf);//fragmentation number
+
+	//Offset 12
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_RX
+	if ( le32_to_cpu(pdesc->rxdw3) & BIT(13)){
+		pattrib->tcpchk_valid = 1; // valid
+		if ( le32_to_cpu(pdesc->rxdw3) & BIT(11) ) {
+			pattrib->tcp_chkrpt = 1; // correct
+			//DBG_8192C("tcp csum ok\n");
+		}
+		else
+			pattrib->tcp_chkrpt = 0; // incorrect
+
+		if ( le32_to_cpu(pdesc->rxdw3) & BIT(12) )
+			pattrib->ip_chkrpt = 1; // correct
+		else
+			pattrib->ip_chkrpt = 0; // incorrect
+	}
+	else {
+		pattrib->tcpchk_valid = 0; // invalid
+	}
+#endif
+
+	pattrib->mcs_rate=(u8)((le32_to_cpu(pdesc->rxdw3))&0x3f);
+	pattrib->rxht=(u8)((le32_to_cpu(pdesc->rxdw3) >>6)&0x1);
+	pattrib->sgi=(u8)((le32_to_cpu(pdesc->rxdw3) >>8)&0x1);
+	//Offset 16
+	//Offset 20
+
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_sreset.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_sreset.c
new file mode 100644
index 000000000000..6275894c8c85
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_sreset.c
@@ -0,0 +1,93 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#include <rtl8192c_sreset.h>
+#include <rtl8192c_hal.h>
+#ifdef DBG_CONFIG_ERROR_DETECT
+void rtl8192c_sreset_xmit_status_check(_adapter *padapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct sreset_priv *psrtpriv = &pHalData->srestpriv;
+
+	unsigned long current_time;
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+	unsigned int diff_time;
+	u32 txdma_status;
+	if( (txdma_status=rtw_read32(padapter, REG_TXDMA_STATUS)) !=0x00){
+		DBG_871X("%s REG_TXDMA_STATUS:0x%08x\n", __FUNCTION__, txdma_status);
+		rtw_hal_sreset_reset(padapter);
+	}
+
+	//total xmit irp = 4
+	//DBG_8192C("==>%s free_xmitbuf_cnt(%d),txirp_cnt(%d)\n",__FUNCTION__,pxmitpriv->free_xmitbuf_cnt,pxmitpriv->txirp_cnt);
+	//if(pxmitpriv->txirp_cnt == NR_XMITBUFF+1)
+	current_time = rtw_get_current_time();
+
+	if(0 == pxmitpriv->free_xmitbuf_cnt || 0 == pxmitpriv->free_xmit_extbuf_cnt) {
+
+		diff_time = rtw_get_passing_time_ms(psrtpriv->last_tx_time);
+
+		if (diff_time > 2000) {
+			if (psrtpriv->last_tx_complete_time == 0) {
+				psrtpriv->last_tx_complete_time = current_time;
+			}
+			else{
+				diff_time = rtw_get_passing_time_ms(psrtpriv->last_tx_complete_time);
+				if (diff_time > 4000) {
+					//padapter->Wifi_Error_Status = WIFI_TX_HANG;
+					DBG_871X("%s tx hang\n", __FUNCTION__);
+					rtw_hal_sreset_reset(padapter);
+				}
+			}
+		}
+	}
+
+	if (psrtpriv->dbg_trigger_point == SRESET_TGP_XMIT_STATUS) {
+		psrtpriv->dbg_trigger_point = SRESET_TGP_NULL;
+		rtw_hal_sreset_reset(padapter);
+		return;
+	}
+}
+void rtl8192c_sreset_linked_status_check(_adapter *padapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct sreset_priv *psrtpriv = &pHalData->srestpriv;
+
+	u32 regc50,regc58,reg824,reg800;
+	regc50 = rtw_read32(padapter,0xc50);
+	regc58 = rtw_read32(padapter,0xc58);
+	reg824 = rtw_read32(padapter,0x824);
+	reg800 = rtw_read32(padapter,0x800);
+	if(	((regc50&0xFFFFFF00)!= 0x69543400)||
+		((regc58&0xFFFFFF00)!= 0x69543400)||
+		(((reg824&0xFFFFFF00)!= 0x00390000)&&(((reg824&0xFFFFFF00)!= 0x80390000)))||
+		( ((reg800&0xFFFFFF00)!= 0x03040000)&&((reg800&0xFFFFFF00)!= 0x83040000)))
+	{
+		DBG_8192C("%s regc50:0x%08x, regc58:0x%08x, reg824:0x%08x, reg800:0x%08x,\n", __FUNCTION__,
+			regc50, regc58, reg824, reg800);
+		rtw_hal_sreset_reset(padapter);
+	}
+
+	if (psrtpriv->dbg_trigger_point == SRESET_TGP_LINK_STATUS) {
+		psrtpriv->dbg_trigger_point = SRESET_TGP_NULL;
+		rtw_hal_sreset_reset(padapter);
+		return;
+	}
+}
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_xmit.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_xmit.c
new file mode 100644
index 000000000000..e958164364e1
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/rtl8192c_xmit.c
@@ -0,0 +1,62 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTL8192C_XMIT_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtl8192c_hal.h>
+
+#ifdef CONFIG_XMIT_ACK
+void dump_txrpt_ccx_8192c(void *buf)
+{
+	struct txrpt_ccx_8192c *txrpt_ccx = buf;
+
+	DBG_871X("%s:\n"
+		"retry_cnt:%u, rsvd_0:%u, rts_retry_cnt:%u, rsvd_1:%u\n"
+		"ccx_qtime:%u, missed_pkt_num:%u, rsvd_4:%u\n"
+		"mac_id:%u, des1_fragssn:%u\n"
+		"rpt_pkt_num:%u, pkt_drop:%u, lifetime_over:%u, retry_over:%u\n"
+		"edca_tx_queue:%u, rsvd_7:%u, bmc:%u, pkt_ok:%u, init_ccx:%u\n"
+		, __func__
+		, txrpt_ccx->retry_cnt, txrpt_ccx->rsvd_0, txrpt_ccx->rts_retry_cnt, txrpt_ccx->rsvd_1
+		, txrpt_ccx_qtime_8192c(txrpt_ccx), txrpt_ccx->missed_pkt_num, txrpt_ccx->rsvd_4
+		, txrpt_ccx->mac_id, txrpt_ccx->des1_fragssn
+		, txrpt_ccx->rpt_pkt_num, txrpt_ccx->pkt_drop, txrpt_ccx->lifetime_over, txrpt_ccx->retry_over
+		, txrpt_ccx->edca_tx_queue, txrpt_ccx->rsvd_7, txrpt_ccx->bmc, txrpt_ccx->pkt_ok, txrpt_ccx->int_ccx
+	);
+}
+
+void handle_txrpt_ccx_8192c(_adapter *adapter, void *buf)
+{
+	struct txrpt_ccx_8192c *txrpt_ccx = buf;
+
+	#ifdef DBG_CCX
+	dump_txrpt_ccx_8192c(buf);
+	#endif
+
+	if (txrpt_ccx->int_ccx) {
+		if (txrpt_ccx->pkt_ok)
+			rtw_ack_tx_done(&adapter->xmitpriv, RTW_SCTX_DONE_SUCCESS);
+		else
+			rtw_ack_tx_done(&adapter->xmitpriv, RTW_SCTX_DONE_CCX_PKT_FAIL);
+	}
+}
+#endif //CONFIG_XMIT_ACK
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/Hal8192CUHWImg.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/Hal8192CUHWImg.c
new file mode 100644
index 000000000000..9faa8c19f0fc
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/Hal8192CUHWImg.c
@@ -0,0 +1,8757 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+/*Created on  2011/ 6/15,  5:45*/
+
+#include <basic_types.h>
+#include "Hal8192CUHWImg.h"
+
+#ifdef CONFIG_BT_COEXISTENCE
+// =================== v84 TSMC COMMON 2012-04-13 =======================
+u8 Rtl8192CUFwTSMCImgArray[TSMCImgArrayLength] = {
+0xc1,0x88,0x02,0x00,0x54,0x00,0x01,0x00,0x04,0x13,0x11,0x07,0x3a,0x3d,0x00,0x00,
+0x58,0x97,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x02,0x43,0xba,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x50,0xa1,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x57,0x91,0x00,0x00,0x00,0x00,0x00,0xa1,0xe8,0x00,0x00,0x00,
+0x05,0x04,0x03,0x02,0x00,0x03,0x06,0x05,0x04,0x03,0x00,0x04,0x06,0x05,0x04,0x02,
+0x00,0x04,0x08,0x07,0x06,0x04,0x00,0x06,0x0a,0x09,0x08,0x06,0x00,0x08,0x0a,0x09,
+0x08,0x04,0x00,0x08,0x0a,0x09,0x08,0x02,0x00,0x08,0x0a,0x09,0x08,0x00,0x00,0x08,
+0x12,0x11,0x10,0x08,0x00,0x10,0x1a,0x19,0x18,0x10,0x00,0x18,0x22,0x21,0x20,0x18,
+0x00,0x20,0x22,0x21,0x20,0x10,0x00,0x20,0x22,0x21,0x20,0x08,0x00,0x20,0x22,0x21,
+0x1c,0x08,0x00,0x20,0x22,0x21,0x14,0x08,0x00,0x20,0x22,0x20,0x18,0x08,0x00,0x20,
+0x31,0x30,0x20,0x10,0x00,0x30,0x31,0x30,0x18,0x00,0x00,0x30,0x31,0x2f,0x10,0x10,
+0x00,0x30,0x31,0x2c,0x10,0x10,0x00,0x30,0x31,0x28,0x10,0x00,0x00,0x30,0x31,0x20,
+0x10,0x00,0x00,0x30,0x31,0x10,0x10,0x00,0x00,0x30,0x04,0x04,0x04,0x05,0x04,0x04,
+0x04,0x05,0x05,0x05,0x06,0x06,0x04,0x04,0x04,0x05,0x05,0x05,0x06,0x06,0x04,0x04,
+0x05,0x05,0x05,0x05,0x06,0x06,0x04,0x04,0x05,0x05,0x05,0x05,0x06,0x07,0x0a,0x0b,
+0x0d,0x10,0x04,0x05,0x05,0x06,0x06,0x09,0x0c,0x11,0x08,0x08,0x09,0x09,0x0a,0x0c,
+0x10,0x11,0x04,0x04,0x04,0x05,0x04,0x04,0x05,0x07,0x07,0x07,0x08,0x0a,0x04,0x04,
+0x04,0x04,0x06,0x0a,0x0b,0x0d,0x05,0x05,0x07,0x07,0x08,0x0b,0x0d,0x0f,0x04,0x04,
+0x04,0x05,0x07,0x07,0x09,0x09,0x0c,0x0e,0x10,0x12,0x04,0x04,0x05,0x05,0x06,0x0a,
+0x11,0x13,0x09,0x09,0x09,0x09,0x0c,0x0e,0x11,0x13,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x24,0x26,0x2a,0x18,0x1a,0x1d,0x1f,0x21,0x27,0x29,0x2a,0x00,0x00,
+0x00,0x1f,0x23,0x28,0x2a,0x2c,0x00,0x04,0x00,0x04,0x00,0x08,0x00,0x10,0x00,0x18,
+0x00,0x24,0x00,0x30,0x00,0x48,0x00,0x60,0x00,0x90,0x00,0xc0,0x00,0xd8,0x00,0x50,
+0x00,0x78,0x00,0xa0,0x00,0xc8,0x01,0x40,0x01,0x90,0x01,0xe0,0x02,0x30,0x01,0x2c,
+0x01,0x40,0x01,0xe0,0x02,0xd0,0x03,0xe8,0x04,0xb0,0x06,0x40,0x07,0xd0,0x00,0x02,
+0x00,0x02,0x00,0x04,0x00,0x08,0x00,0x0c,0x00,0x12,0x00,0x18,0x00,0x24,0x00,0x30,
+0x00,0x48,0x00,0x60,0x00,0x6c,0x00,0x28,0x00,0x3c,0x00,0x50,0x00,0x64,0x00,0xa0,
+0x00,0xc8,0x00,0xf0,0x01,0x18,0x00,0x64,0x00,0xa0,0x00,0xf0,0x01,0x68,0x01,0xf4,
+0x02,0x58,0x03,0x20,0x03,0xe8,0x02,0x02,0x02,0x02,0x02,0x02,0x03,0x03,0x04,0x04,
+0x05,0x07,0x04,0x04,0x07,0x0a,0x0a,0x0c,0x0c,0x12,0x05,0x07,0x07,0x08,0x0b,0x12,
+0x24,0x3c,0x01,0x01,0x01,0x01,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x01,0x02,
+0x03,0x04,0x05,0x06,0x07,0x08,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x20,0x1e,
+0x1c,0x18,0x10,0x18,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0xbb,0x01,0x0c,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe0,0x22,0x50,
+0x06,0xe9,0x25,0x82,0xf8,0xe6,0x22,0xbb,0xfe,0x06,0xe9,0x25,0x82,0xf8,0xe2,0x22,
+0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe4,0x93,0x22,0xbb,0x01,0x06,
+0x89,0x82,0x8a,0x83,0xf0,0x22,0x50,0x02,0xf7,0x22,0xbb,0xfe,0x01,0xf3,0x22,0xf8,
+0xbb,0x01,0x0d,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0x22,
+0x50,0x06,0xe9,0x25,0x82,0xc8,0xf6,0x22,0xbb,0xfe,0x05,0xe9,0x25,0x82,0xc8,0xf2,
+0x22,0xc5,0xf0,0xf8,0xa3,0xe0,0x28,0xf0,0xc5,0xf0,0xf8,0xe5,0x82,0x15,0x82,0x70,
+0x02,0x15,0x83,0xe0,0x38,0xf0,0x22,0xbb,0x01,0x0a,0x89,0x82,0x8a,0x83,0xe0,0xf5,
+0xf0,0xa3,0xe0,0x22,0x50,0x06,0x87,0xf0,0x09,0xe7,0x19,0x22,0xbb,0xfe,0x07,0xe3,
+0xf5,0xf0,0x09,0xe3,0x19,0x22,0x89,0x82,0x8a,0x83,0xe4,0x93,0xf5,0xf0,0x74,0x01,
+0x93,0x22,0xbb,0x01,0x10,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe0,
+0xf5,0xf0,0xa3,0xe0,0x22,0x50,0x09,0xe9,0x25,0x82,0xf8,0x86,0xf0,0x08,0xe6,0x22,
+0xbb,0xfe,0x0a,0xe9,0x25,0x82,0xf8,0xe2,0xf5,0xf0,0x08,0xe2,0x22,0xe5,0x83,0x2a,
+0xf5,0x83,0xe9,0x93,0xf5,0xf0,0xa3,0xe9,0x93,0x22,0xbb,0x01,0x0a,0x89,0x82,0x8a,
+0x83,0xf0,0xe5,0xf0,0xa3,0xf0,0x22,0x50,0x06,0xf7,0x09,0xa7,0xf0,0x19,0x22,0xbb,
+0xfe,0x06,0xf3,0xe5,0xf0,0x09,0xf3,0x19,0x22,0xf8,0xbb,0x01,0x11,0xe5,0x82,0x29,
+0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0xe5,0xf0,0xa3,0xf0,0x22,0x50,0x09,
+0xe9,0x25,0x82,0xc8,0xf6,0x08,0xa6,0xf0,0x22,0xbb,0xfe,0x09,0xe9,0x25,0x82,0xc8,
+0xf2,0xe5,0xf0,0x08,0xf2,0x22,0xef,0x4b,0xff,0xee,0x4a,0xfe,0xed,0x49,0xfd,0xec,
+0x48,0xfc,0x22,0xe0,0xfc,0xa3,0xe0,0xfd,0xa3,0xe0,0xfe,0xa3,0xe0,0xff,0x22,0xa4,
+0x25,0x82,0xf5,0x82,0xe5,0xf0,0x35,0x83,0xf5,0x83,0x22,0xe0,0xfb,0xa3,0xe0,0xfa,
+0xa3,0xe0,0xf9,0x22,0xf8,0xe0,0xfb,0xa3,0xa3,0xe0,0xf9,0x25,0xf0,0xf0,0xe5,0x82,
+0x15,0x82,0x70,0x02,0x15,0x83,0xe0,0xfa,0x38,0xf0,0x22,0xeb,0xf0,0xa3,0xea,0xf0,
+0xa3,0xe9,0xf0,0x22,0xd0,0x83,0xd0,0x82,0xf8,0xe4,0x93,0x70,0x12,0x74,0x01,0x93,
+0x70,0x0d,0xa3,0xa3,0x93,0xf8,0x74,0x01,0x93,0xf5,0x82,0x88,0x83,0xe4,0x73,0x74,
+0x02,0x93,0x68,0x60,0xef,0xa3,0xa3,0xa3,0x80,0xdf,0x02,0x43,0xf8,0x02,0x48,0x29,
+0xe4,0x93,0xa3,0xf8,0xe4,0x93,0xa3,0x40,0x03,0xf6,0x80,0x01,0xf2,0x08,0xdf,0xf4,
+0x80,0x29,0xe4,0x93,0xa3,0xf8,0x54,0x07,0x24,0x0c,0xc8,0xc3,0x33,0xc4,0x54,0x0f,
+0x44,0x20,0xc8,0x83,0x40,0x04,0xf4,0x56,0x80,0x01,0x46,0xf6,0xdf,0xe4,0x80,0x0b,
+0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x90,0x44,0x3d,0xe4,0x7e,0x01,0x93,0x60,
+0xbc,0xa3,0xff,0x54,0x3f,0x30,0xe5,0x09,0x54,0x1f,0xfe,0xe4,0x93,0xa3,0x60,0x01,
+0x0e,0xcf,0x54,0xc0,0x25,0xe0,0x60,0xa8,0x40,0xb8,0xe4,0x93,0xa3,0xfa,0xe4,0x93,
+0xa3,0xf8,0xe4,0x93,0xa3,0xc8,0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,0xf0,0xa3,0xc8,
+0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,0xdf,0xe9,0xde,0xe7,0x80,0xbe,0x41,0x9e,0x77,
+0x00,0x41,0x9e,0xae,0x00,0x41,0x9e,0x54,0x80,0x41,0x9e,0xb0,0x00,0x00,0xf0,0x90,
+0x9e,0x5d,0xe0,0x90,0x9e,0x86,0xf0,0xe4,0xfb,0xfd,0x7f,0x54,0x7e,0x01,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x85,0xe0,0xfb,0xa3,0xe0,0xf5,0x44,0xe4,0xf5,
+0x45,0x12,0x35,0xab,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x01,0x5f,0xe4,0xf0,0x90,0x01,
+0x3c,0x74,0x08,0xf0,0xe4,0x90,0x9e,0x85,0xf0,0x90,0x9e,0x5b,0xe0,0x90,0x9e,0x86,
+0xf0,0xe4,0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x91,0x5e,0x90,0x01,0x5f,0x74,0x05,0xf0,
+0x90,0x06,0x92,0x74,0x02,0xf0,0x90,0x9e,0x63,0x14,0xf0,0xe5,0x61,0x54,0x0f,0xc3,
+0x94,0x0c,0x50,0x03,0x12,0x54,0xe3,0x22,0x8f,0x82,0x8e,0x83,0xa3,0xa3,0xa3,0xe4,
+0xf0,0x22,0xe4,0xf5,0x65,0x7f,0x60,0x7e,0x01,0x80,0xed,0x7d,0x01,0xaf,0x62,0x02,
+0x54,0xe7,0xb1,0xb0,0xbf,0x01,0x12,0x90,0x9e,0x79,0xe0,0xff,0xe4,0xfd,0xf1,0x79,
+0x12,0x5f,0xf7,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0xb1,0xb0,0xbf,0x01,0x0f,0x90,
+0x02,0x09,0xe0,0xff,0x7d,0x01,0xf1,0x79,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0x22,
+0x22,0x22,0x00,0x02,0x45,0x03,0x02,0x45,0x06,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x8b,0x20,0x8a,0x21,0x89,0x22,0x90,0x9e,0x87,0x71,0x8b,0xab,0x23,0xaa,0x24,0xa9,
+0x25,0x90,0x9e,0x8a,0x71,0x8b,0xaf,0x26,0x15,0x26,0xef,0x60,0x1b,0x90,0x9e,0x8a,
+0xe4,0x75,0xf0,0x01,0x71,0x74,0x12,0x29,0xd9,0xff,0x90,0x9e,0x87,0xe4,0x75,0xf0,
+0x01,0x71,0x74,0xef,0x51,0x4d,0x80,0xde,0xab,0x20,0xaa,0x21,0xa9,0x22,0xd0,0xd0,
+0x92,0xaf,0x22,0x90,0x9e,0x11,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0x90,0x06,0xa9,
+0xe0,0x90,0x9e,0x10,0xf0,0xe0,0x54,0xc0,0x70,0x08,0x53,0x64,0xfe,0x53,0x64,0xfd,
+0x91,0xcb,0x90,0x9e,0x10,0xe0,0x30,0xe6,0x13,0x43,0x64,0x01,0x90,0x9e,0x66,0xe0,
+0x64,0x02,0x60,0x04,0x91,0xd2,0x80,0x07,0x91,0x79,0x80,0x03,0x53,0x64,0xfe,0x90,
+0x9e,0x10,0xe0,0x30,0xe7,0x16,0x43,0x64,0x02,0xe4,0x90,0x9e,0x85,0x91,0x4e,0x90,
+0x01,0x57,0x74,0x05,0xf0,0x90,0x9e,0x67,0x74,0x01,0xf0,0x22,0x53,0x64,0xfd,0x22,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x01,0xc4,0x74,0xb0,0xf0,0x74,0x45,0xa3,
+0xf0,0x90,0x04,0x1d,0xe0,0x60,0x1a,0x90,0x05,0x22,0xe0,0x54,0x90,0x60,0x07,0x90,
+0x01,0xc6,0xe0,0x44,0x40,0xf0,0x90,0x01,0xc7,0xe0,0x30,0xe1,0xe4,0x7f,0x00,0x80,
+0x02,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,
+0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,
+0x05,0xc0,0x06,0xc0,0x07,0x75,0x13,0x00,0x90,0x01,0xc4,0x74,0xe8,0xf0,0x74,0x45,
+0xa3,0xf0,0x53,0x91,0xdf,0x90,0x01,0x3c,0xe0,0x55,0x30,0xf5,0x34,0xa3,0xe0,0x55,
+0x31,0xf5,0x35,0xa3,0xe0,0x55,0x32,0xf5,0x36,0xa3,0xe0,0x55,0x33,0xf5,0x37,0xe5,
+0x34,0x30,0xe0,0x06,0x90,0x01,0x3c,0x74,0x01,0xf0,0xe5,0x34,0x30,0xe1,0x09,0x90,
+0x01,0x3c,0x74,0x02,0xf0,0x12,0x61,0xc9,0xe5,0x34,0x30,0xe2,0x38,0x90,0x01,0x3c,
+0x74,0x04,0xf0,0x90,0x06,0x92,0xe0,0x30,0xe0,0x24,0x90,0x9e,0x85,0xe4,0xf0,0x90,
+0x9e,0x5b,0xe0,0x90,0x9e,0x86,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,0x01,0x91,0x5e,
+0x90,0x01,0x5b,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x80,0x07,0x90,0x9e,
+0x64,0xe4,0xf0,0x91,0xcb,0xe5,0x34,0x30,0xe3,0x38,0x90,0x01,0x3c,0x74,0x08,0xf0,
+0x90,0x06,0x92,0xe0,0x30,0xe1,0x24,0x90,0x9e,0x85,0xe4,0xf0,0x90,0x9e,0x5b,0xe0,
+0x90,0x9e,0x86,0xf0,0xe4,0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x91,0x5e,0x90,0x01,0x5f,
+0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x02,0xf0,0x80,0x07,0x90,0x9e,0x63,0xe4,0xf0,
+0x91,0xcb,0xe5,0x34,0x30,0xe4,0x09,0x90,0x01,0x3c,0x74,0x10,0xf0,0x12,0x4b,0xfb,
+0xe5,0x34,0x30,0xe5,0x09,0x90,0x01,0x3c,0x74,0x20,0xf0,0x12,0x4c,0x3d,0xe5,0x35,
+0x30,0xe0,0x44,0x90,0x01,0x3d,0x74,0x01,0xf0,0x90,0x01,0x2f,0xe0,0x44,0x7f,0xf0,
+0x90,0x00,0x83,0xe0,0x54,0x0f,0xf5,0x13,0xb4,0x01,0x02,0x80,0x1c,0xe5,0x13,0xb4,
+0x02,0x05,0x90,0x00,0x83,0x80,0x12,0xe5,0x13,0xb4,0x04,0x05,0x90,0x00,0x83,0x80,
+0x08,0xe5,0x13,0xb4,0x0c,0x06,0x90,0x00,0x83,0xe0,0xf5,0x62,0x90,0x01,0xbb,0xe5,
+0x62,0xf0,0x12,0x60,0xc0,0x91,0xcb,0xe5,0x35,0x30,0xe2,0x06,0x90,0x01,0x3d,0x74,
+0x04,0xf0,0xe5,0x35,0x30,0xe4,0x06,0x90,0x01,0x3d,0x74,0x10,0xf0,0xe5,0x36,0x30,
+0xe0,0x06,0x90,0x01,0x3e,0x74,0x01,0xf0,0xe5,0x36,0x30,0xe1,0x06,0x90,0x01,0x3e,
+0x74,0x02,0xf0,0x74,0xe8,0x04,0x90,0x01,0xc4,0xf0,0x74,0x45,0xa3,0xf0,0xd0,0x07,
+0xd0,0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,
+0xd0,0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,0x90,0x9e,0x98,0xef,0xf0,0xa3,0xed,
+0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xe5,0x63,0x60,0x05,0xe4,0xff,0x12,0x54,0x97,0x90,
+0x9e,0x98,0xe0,0x30,0xe0,0x09,0x90,0x9e,0x9a,0xe4,0xf0,0xa3,0x74,0x80,0xf0,0x90,
+0x9e,0x98,0xe0,0xff,0xc3,0x13,0x90,0xfd,0x10,0xf0,0x90,0x04,0x25,0xef,0xf0,0x90,
+0x9e,0x99,0xe0,0x60,0x1f,0xa3,0xa3,0xe0,0xff,0x24,0x0f,0xf5,0x82,0xe4,0x34,0xfc,
+0xf5,0x83,0xe0,0x44,0x80,0xf0,0x74,0x10,0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,
+0xe0,0x44,0x80,0xf0,0x90,0x9e,0x9a,0xa3,0xe0,0xff,0xfd,0x24,0x08,0xf5,0x82,0xe4,
+0x34,0xfc,0xf5,0x83,0xe4,0xf0,0x74,0x09,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,
+0xe0,0x54,0xf0,0xf0,0x74,0x21,0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,
+0xf7,0xf0,0x90,0x9e,0x9a,0xe0,0xfe,0xa3,0xe0,0xff,0x22,0x75,0x28,0x33,0xe4,0xf5,
+0x29,0x75,0x2a,0x07,0xf5,0x2b,0x90,0x01,0x30,0xe5,0x28,0xf0,0xa3,0xe5,0x29,0xf0,
+0xa3,0xe5,0x2a,0xf0,0xa3,0xe5,0x2b,0xf0,0x22,0xe4,0x90,0x9e,0x16,0xf0,0xa3,0xf0,
+0x75,0x8e,0x02,0xf1,0xa1,0xf1,0xe9,0x90,0x9e,0x7e,0xef,0xf0,0xf1,0xdd,0x90,0x9e,
+0x80,0xef,0xf0,0xf1,0xf6,0x90,0x9e,0x75,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xf5,0x57,
+0x12,0x6e,0x77,0xf1,0xd4,0x12,0x60,0x4b,0x12,0x32,0x3d,0xf1,0xc9,0x11,0x0b,0x12,
+0x50,0x0e,0xf1,0xcd,0xf1,0xb1,0x12,0x44,0xff,0xf1,0x45,0x90,0x9e,0x18,0xe5,0xd9,
+0xf0,0x11,0xd0,0xc2,0xaf,0x90,0x00,0x80,0xe0,0x44,0x40,0xf0,0xb1,0x45,0x75,0xe8,
+0x03,0x43,0xa8,0x85,0xd2,0xaf,0x90,0x9e,0x16,0xe0,0x64,0x01,0xf0,0x24,0x29,0x90,
+0x01,0xc4,0xf0,0x74,0x48,0xa3,0xf0,0xe5,0x57,0x30,0xe4,0x0a,0xc2,0xaf,0x53,0x57,
+0xef,0xd2,0xaf,0x12,0x58,0x74,0xe5,0x57,0x30,0xe6,0x17,0xc2,0xaf,0x53,0x57,0xbf,
+0xd2,0xaf,0x12,0x67,0xa1,0x90,0x9e,0x43,0xe0,0xff,0x60,0x03,0xb4,0x01,0x03,0x12,
+0x7b,0x5c,0x90,0x9e,0x43,0xe0,0x70,0x03,0x12,0x7c,0x5f,0x12,0x73,0x85,0x80,0xb6,
+0x90,0x01,0x3c,0x74,0xff,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x01,0x34,0xf0,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x54,0x31,0x05,0x7d,0xff,0x7f,0x55,0x31,0x05,0x7d,
+0xff,0x7f,0x56,0x31,0x05,0x7d,0xff,0x7f,0x57,0x80,0x0a,0xf0,0x90,0x00,0x45,0xe0,
+0x54,0xfe,0xfd,0x7f,0x45,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x8f,0x82,0x75,0x83,
+0x00,0xed,0xf0,0xb1,0x45,0xd0,0xd0,0x92,0xaf,0x22,0xef,0x14,0x60,0x30,0x14,0x60,
+0x66,0x24,0x02,0x60,0x02,0x21,0xc1,0x90,0x9e,0x3f,0x74,0x02,0xf0,0x90,0x00,0x48,
+0xe0,0x44,0x0c,0xfd,0x7f,0x48,0x31,0x05,0x90,0x00,0x47,0xe0,0x44,0x08,0xfd,0x7f,
+0x47,0x31,0x05,0x90,0x00,0x45,0xe0,0x44,0x10,0xfd,0x7f,0x45,0x80,0x71,0xe4,0x90,
+0x9e,0x3f,0xf0,0x90,0x9e,0x3b,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x80,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x00,0x45,0xe0,0x44,0xef,0xfd,0x7f,0x45,0x31,
+0x05,0x90,0x00,0x45,0xe0,0x54,0xef,0xfd,0x7f,0x45,0x31,0x05,0x90,0x00,0x46,0xe0,
+0x44,0x10,0xfd,0x7f,0x46,0x80,0x38,0x90,0x9e,0x3f,0x74,0x01,0xf0,0x90,0x9e,0x45,
+0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,
+0x90,0x00,0x45,0xe0,0x44,0x20,0xfd,0x7f,0x45,0x31,0x05,0x90,0x00,0x45,0xe0,0x44,
+0x10,0xfd,0x7f,0x45,0x31,0x05,0x90,0x00,0x46,0xe0,0x44,0x10,0xfd,0x7f,0x46,0x31,
+0x05,0x22,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x9e,0x41,0xf0,0x90,0x00,0x01,0x12,
+0x42,0x20,0x25,0xe0,0x25,0xe0,0x90,0x9e,0x40,0xf0,0x12,0x29,0xd9,0x25,0xe0,0x25,
+0xe0,0x90,0x9e,0x44,0xf0,0x90,0x05,0x60,0xe0,0x90,0x9e,0x4f,0xf0,0x90,0x05,0x61,
+0xe0,0x90,0x9e,0x50,0xf0,0x90,0x05,0x62,0xe0,0x90,0x9e,0x51,0xf0,0x90,0x05,0x63,
+0xe0,0x90,0x9e,0x52,0xf0,0xa2,0xaf,0xe4,0x33,0x90,0x9e,0x24,0xf0,0xc2,0xaf,0x90,
+0x9e,0x40,0xe0,0xff,0x91,0xf0,0x90,0x9e,0x24,0xe0,0x24,0xff,0x92,0xaf,0x90,0x9e,
+0x41,0xe0,0x70,0x02,0x41,0xc8,0x90,0x9e,0x40,0xe0,0x70,0x02,0x41,0xc8,0x90,0x9e,
+0x44,0xe0,0x70,0x02,0x41,0xc8,0xa2,0xaf,0xe4,0x33,0x90,0x9e,0x24,0xf0,0xc2,0xaf,
+0x90,0x9e,0x53,0x74,0x01,0xf0,0x90,0x9e,0x24,0xe0,0x24,0xff,0x92,0xaf,0x11,0xfc,
+0x90,0x00,0x46,0xe0,0x44,0x01,0xfd,0x7f,0x46,0x31,0x05,0x90,0x9e,0x39,0xe0,0x60,
+0x15,0x90,0x9e,0x45,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,
+0x08,0x12,0x2f,0xd9,0x80,0x06,0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,0x00,0x45,0xe0,
+0x54,0xef,0xfd,0x7f,0x45,0x31,0x05,0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,0x9e,
+0x4f,0xe0,0x90,0x05,0x84,0xf0,0x90,0x9e,0x50,0xe0,0x90,0x05,0x85,0xf0,0x90,0x9e,
+0x51,0xe0,0x90,0x05,0x86,0xf0,0x90,0x9e,0x52,0xe0,0x90,0x05,0x87,0xf0,0xa2,0xaf,
+0xe4,0x33,0x90,0x9e,0x24,0xf0,0xc2,0xaf,0x90,0x01,0x3c,0xe0,0x44,0x20,0xf0,0x7d,
+0x20,0xe4,0xff,0x12,0x37,0x00,0x80,0x2b,0x90,0x9e,0x41,0xe0,0x70,0x2d,0x90,0x9e,
+0x53,0x11,0xfb,0x90,0x00,0x46,0xe0,0x54,0xfe,0xfd,0x7f,0x46,0x31,0x05,0x90,0x05,
+0x22,0xe4,0xf0,0xa2,0xaf,0x33,0x90,0x9e,0x24,0xf0,0xc2,0xaf,0x7d,0x20,0xe4,0xff,
+0x12,0x36,0x92,0x90,0x9e,0x24,0xe0,0x24,0xff,0x92,0xaf,0x22,0x8b,0x14,0x8a,0x15,
+0x89,0x16,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x9e,0x42,0xf0,0xe0,0x30,0xe0,0x4b,
+0x90,0x9e,0x39,0x74,0x01,0xf0,0x7f,0x80,0x7e,0x08,0x12,0x27,0xde,0x90,0x9e,0x3b,
+0x12,0x2a,0x7f,0xab,0x14,0xaa,0x15,0xa9,0x16,0x90,0x00,0x01,0x12,0x42,0x20,0xff,
+0xe4,0xfc,0xfd,0xfe,0x78,0x1a,0x12,0x2a,0x6c,0xa8,0x04,0xa9,0x05,0xaa,0x06,0xab,
+0x07,0x90,0x9e,0x3b,0x12,0x43,0x53,0xec,0x54,0x03,0xfc,0x12,0x43,0x46,0x90,0x9e,
+0x45,0x12,0x2a,0x7f,0x90,0x05,0x22,0xe4,0xf0,0x80,0x2d,0xe4,0x90,0x9e,0x39,0xf0,
+0x7f,0x80,0x7e,0x08,0x12,0x27,0xde,0xec,0x54,0x03,0xfc,0xec,0x44,0xc0,0xfc,0x90,
+0x9e,0x3b,0x12,0x2a,0x7f,0x90,0x9e,0x3b,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9e,0x42,0xe0,0x30,0xe1,0x19,0x7d,
+0x0c,0x7f,0x47,0x31,0x05,0x90,0x00,0x48,0xe0,0x44,0x0c,0xfd,0x7f,0x48,0x31,0x05,
+0x90,0x00,0x46,0xe0,0x44,0x10,0x80,0x1c,0x90,0x00,0x47,0xe0,0x54,0xf3,0xfd,0x7f,
+0x47,0x31,0x05,0x90,0x00,0x48,0xe0,0x54,0xf3,0xfd,0x7f,0x48,0x31,0x05,0x90,0x00,
+0x46,0xe0,0x54,0xef,0xfd,0x7f,0x46,0x31,0x05,0xe4,0x90,0x9e,0x3f,0xf0,0x22,0x90,
+0x01,0x30,0xe4,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x01,0x38,0xf0,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x50,0x31,0x05,0xe4,0xfd,0x7f,0x51,0x31,0x05,0xe4,
+0xfd,0x7f,0x52,0x31,0x05,0xe4,0xfd,0x7f,0x53,0x21,0x05,0xe5,0x65,0x64,0x01,0x70,
+0x3b,0xd1,0x85,0xbf,0x01,0x04,0x7f,0x01,0xd1,0x79,0x90,0x00,0x46,0xe0,0x44,0x04,
+0xfd,0x7f,0x46,0x31,0x05,0x90,0x00,0x44,0xe0,0x54,0xfb,0xfd,0x7f,0x44,0x31,0x05,
+0x90,0x00,0x46,0xe0,0x54,0xfb,0xfd,0x7f,0x46,0x31,0x05,0x7f,0x02,0xd1,0xa1,0x8f,
+0x69,0x90,0x01,0xc9,0xe5,0x69,0xf0,0xb4,0x01,0x02,0xd1,0x19,0x22,0x90,0x9e,0x41,
+0xe0,0x64,0x01,0x60,0x02,0x81,0xef,0x90,0x00,0x46,0xe0,0x44,0x01,0xfd,0x7f,0x46,
+0x31,0x05,0x90,0x9e,0x53,0xe0,0x70,0x31,0x90,0x9e,0x39,0xe0,0x60,0x15,0x90,0x9e,
+0x45,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,
+0xd9,0x80,0x06,0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,0x9e,0x40,0xe0,0xff,0x91,0xf0,
+0x90,0x9e,0x53,0x74,0x01,0x11,0xfb,0x80,0x3f,0x90,0x9e,0x53,0xe0,0x64,0x01,0x70,
+0x37,0x90,0x9e,0x44,0xe0,0xff,0x91,0xf0,0xe4,0x90,0x9e,0x53,0xf0,0x90,0x00,0x45,
+0xe0,0x44,0x01,0xfd,0x7f,0x45,0x31,0x05,0x90,0x9e,0x39,0xe0,0x60,0x15,0x90,0x9e,
+0x3b,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,
+0xd9,0x80,0x05,0x90,0x05,0x22,0xe4,0xf0,0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,
+0x9e,0x4f,0xe0,0x90,0x05,0x84,0xf0,0x90,0x9e,0x50,0xe0,0x90,0x05,0x85,0xf0,0x90,
+0x9e,0x51,0xe0,0x90,0x05,0x86,0xf0,0x90,0x9e,0x52,0xe0,0x90,0x05,0x87,0xf0,0x22,
+0x90,0x05,0x60,0xe0,0x90,0x9e,0x4f,0xf0,0x90,0x05,0x61,0xe0,0x90,0x9e,0x50,0xf0,
+0x90,0x05,0x62,0xe0,0x90,0x9e,0x51,0xf0,0x90,0x05,0x63,0xe0,0x90,0x9e,0x52,0xf0,
+0xc3,0x74,0xff,0x9f,0xfe,0x90,0x9e,0x50,0xe0,0xd3,0x9e,0x40,0x1e,0xe0,0x2f,0xf0,
+0xa3,0xe0,0xb4,0xff,0x0f,0xe4,0xf0,0xa3,0xe0,0xb4,0xff,0x03,0xe4,0xf0,0x22,0x90,
+0x9e,0x52,0x80,0x03,0x90,0x9e,0x51,0xe0,0x04,0xf0,0x22,0x90,0x9e,0x50,0xe0,0x2f,
+0xf0,0x22,0xe0,0x5f,0xf0,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x7f,0x10,0xdf,0xfe,
+0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x2a,0xed,
+0xf0,0x90,0x9e,0x29,0xef,0xf0,0xd3,0x94,0x07,0x50,0x4e,0xa3,0xe0,0x70,0x1a,0x90,
+0x9e,0x29,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,
+0xff,0x90,0x00,0x47,0xe0,0x5f,0xf0,0x80,0x17,0x90,0x9e,0x29,0xe0,0xff,0x74,0x01,
+0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x47,0xe0,0x4f,0xf0,
+0xb1,0x45,0x90,0x9e,0x29,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xf4,0xff,0x90,0x00,0x46,0x80,0x59,0x90,0x9e,0x29,0xe0,0x24,0xf8,0xf0,
+0xa3,0xe0,0x70,0x1d,0x90,0x9e,0x29,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,
+0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,0x80,
+0x1a,0x90,0x9e,0x29,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,
+0xfc,0xc4,0x54,0xf0,0xff,0x90,0x00,0x43,0xe0,0x4f,0xf0,0xb1,0x45,0x90,0x9e,0x29,
+0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,
+0x00,0x43,0xb1,0x42,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x00,0x49,0xe0,0x90,0x9e,0xb1,
+0xf0,0xe0,0x54,0x0f,0xf0,0x44,0xf0,0xfd,0x7f,0x49,0x31,0x05,0x90,0x9e,0xb1,0xe0,
+0x44,0xb0,0xfd,0x7f,0x49,0x21,0x05,0x90,0x9e,0x27,0xee,0xf0,0xa3,0xef,0xf0,0x75,
+0x65,0x01,0x8e,0x66,0xf5,0x67,0xe4,0xfd,0x7f,0x0b,0xb1,0x55,0xe4,0xfd,0x7f,0x02,
+0xb1,0x55,0xd1,0x85,0xe4,0xff,0xd1,0x79,0xe4,0xf5,0x69,0x90,0x01,0xc9,0xe5,0x69,
+0xf0,0x90,0x9e,0x27,0xe0,0xfc,0xa3,0xe0,0xfd,0xec,0xfb,0x8d,0x44,0xe4,0xf5,0x45,
+0x7d,0x01,0x7f,0x60,0x7e,0x01,0x02,0x35,0xab,0x90,0x01,0xca,0xe5,0x68,0xf0,0xef,
+0x60,0x02,0xd1,0x19,0x22,0x7f,0x0b,0xd1,0xa1,0xef,0x65,0x68,0x60,0x10,0xe5,0x68,
+0xb4,0x01,0x05,0xe4,0xf5,0x68,0x80,0x03,0x75,0x68,0x01,0x7f,0x01,0x22,0x7f,0x00,
+0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0xb2,0xef,0xf0,0xd3,0x94,0x07,
+0x50,0x43,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,
+0xff,0x90,0x00,0x46,0xb1,0x42,0x90,0x9e,0xb2,0xe0,0xfd,0x74,0x01,0x7e,0x00,0xa8,
+0x05,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,0x44,0xe0,
+0xfb,0xe4,0xfe,0xef,0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,0xce,0x13,
+0xd8,0xf8,0xff,0x80,0x4b,0x90,0x9e,0xb2,0xe0,0x24,0xf8,0xf0,0xe0,0xff,0x74,0x01,
+0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,
+0xf0,0xb1,0x45,0x90,0x9e,0xb2,0xe0,0xfd,0x74,0x01,0x7e,0x00,0xa8,0x05,0x08,0x80,
+0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,0x42,0xe0,0xfb,0xe4,0xfe,
+0xef,0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,0xce,0x13,0xd8,0xf8,0xff,
+0xd0,0xd0,0x92,0xaf,0x22,0xe4,0xfd,0x7f,0x45,0x31,0x05,0x90,0x04,0xfd,0xe4,0xf0,
+0xa3,0xf0,0x90,0x9e,0x43,0xf0,0x90,0x9e,0x49,0xf0,0x90,0x9e,0x4c,0xf0,0x90,0x9e,
+0x4a,0xf0,0x90,0x9e,0x4d,0xf0,0x90,0x9e,0x4b,0xf0,0x90,0x9e,0x4e,0xf0,0x90,0x9e,
+0x35,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x9e,0x3a,0xf0,0x90,0x9e,
+0x3f,0xf0,0x90,0x9e,0x41,0xf0,0x90,0x9e,0x53,0xf0,0x90,0x9e,0x44,0xf0,0x90,0x9e,
+0x40,0xf0,0x90,0x9e,0x39,0xf0,0x90,0x00,0x51,0xe0,0x44,0xc0,0xfd,0x7f,0x51,0x21,
+0x05,0xe4,0x90,0x9e,0x7d,0xf0,0x90,0x00,0x80,0xe0,0x44,0x80,0xfd,0x7f,0x80,0x21,
+0x05,0x75,0x30,0x1f,0x75,0x31,0x01,0xe4,0xf5,0x32,0x90,0x01,0x38,0xe5,0x30,0xf0,
+0xa3,0xe5,0x31,0xf0,0xa3,0xe5,0x32,0xf0,0x22,0xe4,0xf5,0x68,0x22,0x90,0x01,0x64,
+0x74,0xa0,0xf0,0x22,0x90,0x9e,0x80,0xe0,0x90,0x9e,0x0f,0xf0,0x22,0x90,0x00,0xf3,
+0xe0,0x7f,0x00,0x30,0xe3,0x02,0x7f,0x01,0x22,0x90,0x00,0x02,0xe0,0x54,0xe0,0x7f,
+0x01,0x60,0x02,0x7f,0x00,0x22,0x90,0x9e,0x80,0xe0,0xb4,0x01,0x0c,0x90,0x00,0xf2,
+0xe0,0x30,0xe7,0x05,0x7e,0xfd,0x7f,0x33,0x22,0x7e,0xfd,0x7f,0x2f,0x22,0x90,0x00,
+0xf3,0xe0,0x30,0xe2,0x0d,0x90,0x05,0x41,0x74,0x10,0xf0,0x90,0x05,0x5a,0xf0,0xa3,
+0xe4,0xf0,0x22,0x90,0x01,0x02,0xe0,0x54,0x03,0xff,0xe0,0x54,0x0c,0x13,0x13,0x54,
+0x3f,0xfe,0xef,0x64,0x01,0x60,0x04,0xef,0xb4,0x03,0x10,0x90,0x9e,0x10,0x74,0x01,
+0xf0,0xa3,0x74,0x37,0xf0,0xa3,0x74,0x01,0xf0,0x80,0x1a,0xee,0x64,0x01,0x60,0x07,
+0xaf,0x06,0xee,0x64,0x03,0x70,0x49,0x90,0x9e,0x10,0x74,0x01,0xf0,0xa3,0x74,0x3d,
+0xf0,0xa3,0x74,0x40,0xf0,0x90,0x9e,0x10,0xe0,0xfe,0xa3,0xe0,0xff,0xf5,0x82,0x8e,
+0x83,0xe0,0xfd,0x90,0x9e,0x12,0xe0,0xfc,0xed,0x5c,0x60,0x0c,0x8f,0x82,0x8e,0x83,
+0xec,0xf0,0xe4,0x90,0x9e,0x77,0xf0,0x22,0x90,0x9e,0x77,0xe0,0x04,0xf0,0xe0,0xc3,
+0x94,0x0a,0x40,0x0c,0xe4,0xf0,0x90,0x04,0x19,0xe0,0x30,0xe0,0x03,0x12,0x44,0xea,
+0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,
+0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,0x01,
+0xc4,0x74,0xa1,0xf0,0x74,0x50,0xa3,0xf0,0x90,0x01,0x34,0xe0,0x55,0x28,0xf5,0x2c,
+0xa3,0xe0,0x55,0x29,0xf5,0x2d,0xa3,0xe0,0x55,0x2a,0xf5,0x2e,0xa3,0xe0,0x55,0x2b,
+0xf5,0x2f,0xe5,0x2c,0x20,0xe0,0x02,0x41,0x46,0x90,0x01,0x34,0x74,0x01,0xf0,0x85,
+0xd1,0x4d,0x85,0xd2,0x4e,0x85,0xd3,0x4f,0x85,0xd4,0x50,0x85,0xd5,0x51,0x85,0xd6,
+0x52,0x85,0xd7,0x53,0x85,0xd9,0x54,0xe5,0x54,0x54,0x40,0xc3,0x13,0xff,0xe5,0x53,
+0x54,0x20,0x6f,0x70,0x02,0x21,0xf5,0xe5,0x54,0x30,0xe5,0x02,0x21,0xf5,0xe5,0x52,
+0x54,0x3f,0xf5,0x08,0xe5,0x4d,0x54,0x3f,0xf5,0x09,0xe5,0x51,0x54,0x1f,0xff,0xe5,
+0x08,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0x8f,0xf0,0x12,
+0x42,0x81,0xe5,0x53,0x54,0x1f,0xff,0xe5,0x08,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,
+0x34,0x93,0xf5,0x83,0xe4,0x8f,0xf0,0x12,0x42,0x81,0xe5,0x09,0xd3,0x94,0x04,0x40,
+0x03,0x75,0x09,0x04,0x75,0xf0,0x0a,0xe5,0x08,0x90,0x90,0x00,0x12,0x43,0x5f,0x75,
+0xf0,0x02,0xe5,0x09,0x12,0x43,0x5f,0xe0,0xfe,0xa3,0xe0,0xff,0xe5,0x53,0x54,0x1f,
+0x2f,0xff,0xe4,0x3e,0xfe,0x75,0xf0,0x0a,0xe5,0x08,0x90,0x90,0x00,0x12,0x43,0x5f,
+0x75,0xf0,0x02,0xe5,0x09,0x12,0x43,0x5f,0xee,0xf0,0xa3,0xef,0xf0,0xe5,0x54,0x20,
+0xe6,0x24,0xe5,0x53,0x54,0x1f,0xff,0xe5,0x08,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,
+0x34,0x98,0xf5,0x83,0xe4,0x8f,0xf0,0x12,0x42,0x81,0xe5,0x4f,0x30,0xe7,0x36,0xaf,
+0x08,0x12,0x63,0x51,0x80,0x2f,0xe5,0x53,0x54,0x1f,0xff,0xe5,0x08,0x25,0xe0,0x24,
+0x44,0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0x8f,0xf0,0x12,0x42,0x81,0xe5,0x4f,
+0x30,0xe7,0x12,0xe5,0x4f,0x54,0x7f,0xfd,0xe5,0x53,0x54,0x1f,0xf5,0x0d,0xab,0x09,
+0xaf,0x08,0x12,0x62,0xee,0xe5,0x63,0x14,0x24,0xfd,0x50,0x02,0x80,0x48,0x90,0x9e,
+0x66,0xe0,0x60,0x3a,0x90,0x01,0x5b,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x04,0xf0,0x71,
+0xc3,0xef,0x64,0x01,0x70,0x30,0x90,0x9e,0x85,0xf0,0x90,0x9e,0x5b,0xe0,0x90,0x9e,
+0x86,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,0x01,0x12,0x44,0x5e,0x90,0x01,0x5b,0x74,
+0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x90,0x9e,0x64,0xf0,0x80,0x08,0x71,0xc3,
+0xbf,0x01,0x03,0x12,0x44,0xcb,0xe5,0x2c,0x30,0xe1,0x20,0x90,0x01,0x34,0x74,0x02,
+0xf0,0x85,0xd1,0x58,0x85,0xd2,0x59,0x85,0xd3,0x5a,0x85,0xd4,0x5b,0x85,0xd5,0x5c,
+0x85,0xd6,0x5d,0x85,0xd7,0x5e,0x85,0xd9,0x5f,0x71,0xd2,0xe5,0x2c,0x30,0xe3,0x06,
+0x90,0x01,0x34,0x74,0x08,0xf0,0xe5,0x2c,0x30,0xe4,0x09,0x90,0x01,0x34,0x74,0x10,
+0xf0,0x43,0x57,0x10,0xe5,0x2c,0x30,0xe5,0x26,0x90,0x01,0xcf,0xe0,0x30,0xe5,0x1f,
+0xe0,0x54,0xdf,0xf0,0x90,0x01,0x34,0x74,0x20,0xf0,0x75,0xa8,0x00,0x75,0xe8,0x00,
+0x12,0x4b,0xcf,0x90,0x00,0x03,0xe0,0x54,0xfb,0xf0,0x12,0x4d,0x45,0x80,0xfe,0xe5,
+0x2c,0x30,0xe6,0x06,0x90,0x01,0x34,0x74,0x40,0xf0,0xe5,0x2e,0x30,0xe0,0x12,0x90,
+0x9e,0x7f,0x74,0x01,0xf0,0x90,0x01,0x36,0xf0,0x12,0x61,0x4e,0x90,0x9e,0x7f,0xe4,
+0xf0,0xe5,0x2e,0x30,0xe1,0x0b,0x90,0x01,0x36,0x74,0x02,0xf0,0x43,0x57,0x40,0x11,
+0x23,0xe5,0x2e,0x30,0xe2,0x09,0x90,0x01,0x36,0x74,0x04,0xf0,0x12,0x60,0xdf,0xe5,
+0x2e,0x30,0xe3,0x28,0x90,0x01,0x36,0x74,0x08,0xf0,0xe5,0x60,0x64,0x01,0x70,0x1c,
+0xe5,0x63,0x60,0x18,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,
+0x9e,0x85,0xe4,0x12,0x44,0x4e,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,0x2e,0x30,0xe4,
+0x2b,0x90,0x01,0x36,0x74,0x10,0xf0,0xe5,0x60,0xb4,0x01,0x20,0xe5,0x63,0x60,0x1c,
+0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,0x9e,0x67,0xe4,0xf0,
+0x53,0x64,0xfd,0xe5,0x64,0x54,0x07,0x70,0x03,0x12,0x44,0xcb,0xe5,0x2e,0x30,0xe5,
+0x1f,0x90,0x01,0x36,0x74,0x20,0xf0,0xe5,0x60,0xb4,0x01,0x14,0xe5,0x63,0x60,0x10,
+0x90,0x9e,0x66,0xe0,0x64,0x02,0x60,0x05,0x12,0x44,0xd2,0x80,0x03,0x12,0x44,0x79,
+0xe5,0x2e,0x30,0xe6,0x1b,0x90,0x01,0x36,0x74,0x40,0xf0,0xe5,0x60,0xb4,0x01,0x10,
+0xe5,0x63,0x60,0x0c,0x53,0x64,0xfe,0xe5,0x64,0x54,0x07,0x70,0x03,0x12,0x44,0xcb,
+0xe5,0x2f,0x30,0xe1,0x08,0x90,0x01,0x37,0x74,0x02,0xf0,0x91,0x64,0x74,0xa1,0x04,
+0x90,0x01,0xc4,0xf0,0x74,0x50,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,0xd0,0x04,
+0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,0xd0,0xf0,
+0xd0,0xe0,0x32,0x90,0x04,0x1b,0xe0,0x54,0x7f,0x64,0x7f,0x7f,0x01,0x60,0x02,0x7f,
+0x00,0x22,0x90,0x9e,0x10,0xe0,0x54,0xf0,0x44,0x03,0xf0,0x54,0x0f,0x44,0x80,0xf0,
+0x7b,0x00,0x7a,0x00,0x79,0x58,0x90,0x9e,0x90,0x12,0x43,0x8b,0x0b,0x7a,0x9e,0x79,
+0x10,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x8d,0x12,0x43,0x8b,0x90,0x9e,
+0xb0,0xe0,0xff,0x04,0xf0,0x90,0x00,0x01,0xef,0x12,0x42,0x5f,0x7f,0xaf,0x7e,0x01,
+0x12,0x71,0x7a,0xef,0x60,0x49,0x90,0x9e,0x8d,0x12,0x43,0x6b,0x8b,0x23,0x8a,0x24,
+0x89,0x25,0x75,0x26,0x02,0x7b,0x01,0x7a,0x01,0x79,0xa0,0x12,0x45,0x09,0x90,0x9e,
+0x90,0x12,0x43,0x6b,0x8b,0x23,0x8a,0x24,0x89,0x25,0x90,0x9e,0x8d,0x12,0x43,0x6b,
+0x12,0x29,0xd9,0xff,0xc4,0x54,0x0f,0xf5,0x26,0x7b,0x01,0x7a,0x01,0x79,0xa2,0x12,
+0x45,0x09,0x90,0x01,0xaf,0x74,0xff,0xf0,0x90,0x01,0xcb,0xe0,0x64,0x80,0xf0,0xd0,
+0xd0,0x92,0xaf,0x22,0x90,0x9e,0xa0,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,0x63,
+0x14,0x24,0xfd,0x50,0x02,0x80,0x1f,0x90,0x9e,0x66,0xe0,0x60,0x06,0x7d,0x01,0x7f,
+0x0c,0x80,0x0d,0xe5,0x61,0x54,0x0f,0xc3,0x94,0x04,0x50,0x06,0x7d,0x01,0x7f,0x04,
+0x91,0xe7,0xe4,0xff,0x91,0x97,0x22,0xef,0x60,0x0b,0x90,0x9e,0x80,0xe0,0xb4,0x01,
+0x10,0xe4,0xff,0x80,0x09,0x90,0x9e,0x80,0xe0,0xb4,0x01,0x05,0x7f,0x01,0x12,0x75,
+0xa5,0x22,0x90,0x01,0x37,0x74,0x02,0xf0,0x90,0x05,0x22,0x74,0xff,0xf0,0x12,0x74,
+0x12,0xef,0x70,0x06,0x90,0x01,0xc8,0x74,0xfd,0xf0,0x7d,0x02,0x7f,0x03,0x12,0x36,
+0xe6,0xe5,0x63,0x60,0x04,0x7f,0x01,0x91,0x97,0x12,0x74,0xd2,0x53,0x61,0xf0,0x43,
+0x61,0x02,0x22,0x7d,0x01,0x7f,0x0c,0x8f,0x6a,0x8d,0x6b,0xe5,0x6a,0x54,0x0f,0xff,
+0xe5,0x61,0x54,0x0f,0x6f,0x60,0x65,0xe5,0x6a,0x30,0xe2,0x28,0xe5,0x61,0x20,0xe2,
+0x04,0x7f,0x01,0xd1,0xc2,0xe5,0x61,0x30,0xe3,0x0c,0xe5,0x6a,0x20,0xe3,0x07,0xb1,
+0x5d,0xef,0x60,0x48,0xa1,0xa5,0xe5,0x61,0x20,0xe3,0x41,0xe5,0x6a,0x30,0xe3,0x3c,
+0xaf,0x6b,0xc1,0xdc,0xe5,0x61,0x54,0x0f,0xff,0xbf,0x0c,0x0c,0xe5,0x6a,0x20,0xe3,
+0x07,0xb1,0x5d,0xef,0x60,0x26,0xb1,0xa5,0xe5,0x61,0x54,0x0f,0xff,0xbf,0x04,0x0c,
+0xe5,0x6a,0x20,0xe2,0x07,0xf1,0x21,0xef,0x60,0x12,0x91,0xb2,0xe5,0x61,0x54,0x0f,
+0xff,0xbf,0x02,0x08,0x12,0x60,0xbd,0xef,0x60,0x02,0xd1,0xaf,0x22,0x71,0xc3,0xef,
+0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,0x30,0x90,0x9e,0x64,0xe0,
+0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x22,0x90,0x9e,0x63,0xe0,0x60,0x08,
+0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x14,0xe5,0x62,0x54,0x0f,0xd3,0x94,0x04,0x40,
+0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x03,0x7f,0x01,0x22,0x90,0x01,0xb8,0x74,
+0x08,0xf0,0x7f,0x00,0x22,0x90,0x06,0x04,0xe0,0x44,0x40,0xf0,0xe5,0x60,0xb4,0x01,
+0x04,0x7f,0x01,0xd1,0xf6,0x53,0x61,0xf0,0x43,0x61,0x04,0x22,0xef,0x64,0x01,0x70,
+0x2e,0x7d,0x78,0x7f,0x02,0x12,0x36,0x75,0x7d,0x02,0x7f,0x03,0x12,0x36,0x75,0x90,
+0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x91,0xe3,0xe4,0xff,0x91,0x97,
+0x90,0x06,0x04,0xe0,0x54,0x7f,0xf0,0x90,0x06,0x0a,0xe0,0x54,0xf8,0xf0,0x22,0x90,
+0x01,0x36,0x74,0x7b,0xf0,0xa3,0x74,0x02,0xf0,0x7d,0x7b,0xff,0x12,0x36,0xe6,0x7d,
+0x02,0x7f,0x03,0x12,0x36,0xe6,0x90,0x06,0x04,0xe0,0x44,0x80,0xf0,0x90,0x06,0x0a,
+0xe0,0x44,0x07,0xf0,0x12,0x62,0x4c,0xe5,0x60,0x20,0xe0,0x05,0xe4,0x90,0x9e,0x58,
+0xf0,0x22,0x8b,0x14,0x8a,0x15,0x89,0x16,0x12,0x60,0xb1,0xab,0x14,0xaa,0x15,0xa9,
+0x16,0x12,0x29,0xd9,0xf5,0x63,0x14,0x60,0x0e,0x14,0x60,0x1e,0x14,0x60,0x2f,0x24,
+0x03,0x70,0x40,0x7f,0x01,0x80,0x3a,0xab,0x14,0xaa,0x15,0xa9,0x16,0x90,0x00,0x02,
+0x12,0x42,0x20,0xfd,0xe4,0xff,0xd1,0x84,0x80,0x27,0xab,0x14,0xaa,0x15,0xa9,0x16,
+0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x7f,0x01,0xd1,0x84,0x1f,0x80,0x13,0xab,0x14,
+0xaa,0x15,0xa9,0x16,0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x7f,0x02,0xd1,0x84,0xe4,
+0xff,0xb1,0xbc,0x22,0xef,0x24,0xfe,0x60,0x0b,0x04,0x70,0x22,0x90,0x9e,0x65,0x74,
+0x01,0xf0,0x80,0x16,0xed,0x70,0x0a,0x90,0x9e,0x62,0xe0,0x90,0x9e,0x65,0xf0,0x80,
+0x05,0x90,0x9e,0x65,0xed,0xf0,0x90,0x9e,0x65,0xe0,0x90,0x9e,0x56,0xf0,0x22,0x53,
+0x61,0xf0,0x43,0x61,0x01,0x12,0x45,0x00,0x12,0x45,0x01,0x53,0x61,0xf0,0x43,0x61,
+0x02,0x22,0x90,0x9e,0xaf,0xef,0xf0,0x12,0x74,0x53,0x90,0x9e,0xaf,0xe0,0x60,0x05,
+0x90,0x05,0x22,0xe4,0xf0,0x53,0x61,0xf0,0x43,0x61,0x04,0x22,0x90,0x06,0x04,0xe0,
+0x54,0xbf,0xf0,0xef,0x60,0x09,0xe5,0x60,0xb4,0x01,0x04,0xe4,0xff,0xd1,0xf6,0x53,
+0x61,0xf0,0x43,0x61,0x0c,0x22,0x8f,0x27,0x12,0x45,0xb0,0xbf,0x01,0x22,0x90,0x9e,
+0x7a,0xe0,0xff,0x7d,0x01,0x12,0x47,0x79,0xab,0x07,0xaa,0x06,0xad,0x03,0xac,0x02,
+0xaf,0x27,0x12,0x60,0x2a,0xaf,0x03,0x12,0x5f,0xf7,0x90,0x04,0x1f,0x74,0x20,0xf0,
+0x22,0x71,0xc3,0xef,0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,0x58,
+0xe5,0x64,0x54,0x03,0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x4a,0xe5,0x62,
+0x54,0x0f,0xd3,0x94,0x02,0x40,0x08,0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x39,0xe5,
+0x64,0x30,0xe2,0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x2c,0xe5,0x64,0x30,0xe4,
+0x08,0x90,0x01,0xb9,0x74,0x10,0xf0,0x80,0x1f,0x90,0x9e,0x58,0xe0,0x60,0x08,0x90,
+0x01,0xb9,0x74,0x20,0xf0,0x80,0x11,0x90,0x9e,0x5e,0xe0,0x60,0x08,0x90,0x01,0xb9,
+0x74,0x80,0xf0,0x80,0x03,0x7f,0x01,0x22,0x90,0x01,0xb8,0x74,0x04,0xf0,0x7f,0x00,
+0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,
+0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,0x01,
+0xc4,0x74,0x91,0xf0,0x74,0x57,0xa3,0xf0,0x53,0x91,0xef,0x90,0x00,0x51,0xe0,0xff,
+0x90,0x00,0x55,0xe0,0x5f,0xf5,0x3d,0x90,0x00,0x52,0xe0,0xff,0x90,0x00,0x56,0xe0,
+0x5f,0xf5,0x3e,0xe5,0x3d,0x30,0xe4,0x06,0x90,0x00,0x55,0x74,0x10,0xf0,0xe5,0x3d,
+0x30,0xe5,0x06,0x90,0x00,0x55,0x74,0x20,0xf0,0xe5,0x3d,0x30,0xe6,0x1b,0x90,0x00,
+0x55,0x74,0x40,0xf0,0x90,0x9e,0x42,0xe0,0x54,0x03,0xff,0xbf,0x03,0x0b,0x90,0x9e,
+0x3f,0xe0,0x60,0x05,0x7f,0x01,0x12,0x49,0x1a,0xe5,0x3d,0x30,0xe7,0x15,0x90,0x00,
+0x55,0x74,0x80,0xf0,0x90,0x9e,0x42,0xe0,0x54,0x03,0xff,0xbf,0x03,0x05,0x7f,0x02,
+0x12,0x49,0x1a,0xe5,0x3e,0x30,0xe0,0x06,0x90,0x00,0x56,0x74,0x01,0xf0,0xe5,0x3e,
+0x30,0xe1,0x06,0x90,0x00,0x56,0x74,0x02,0xf0,0xe5,0x3e,0x30,0xe2,0x06,0x90,0x00,
+0x56,0x74,0x04,0xf0,0xe5,0x3e,0x30,0xe3,0x06,0x90,0x00,0x56,0x74,0x08,0xf0,0x90,
+0x01,0xc4,0x74,0x91,0xf0,0x74,0x57,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,0xd0,
+0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,0xd0,
+0xf0,0xd0,0xe0,0x32,0x90,0x01,0xcc,0xe0,0x54,0x0f,0x90,0x9e,0x19,0xf0,0x90,0x9e,
+0x19,0xe0,0xfd,0x70,0x02,0x21,0xb5,0x90,0x9e,0xae,0xe0,0xff,0x74,0x01,0x7e,0x00,
+0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xef,0x5d,0x70,
+0x02,0x21,0xae,0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd0,0x12,0x43,0x5f,
+0xe0,0x90,0x9e,0x1a,0xf0,0x75,0x23,0x01,0x75,0x24,0x9e,0x75,0x25,0x1a,0x75,0x26,
+0x01,0x7b,0x01,0x7a,0x9e,0x79,0x1b,0x12,0x45,0x09,0x90,0x9e,0x1b,0xe0,0xff,0xc4,
+0x13,0x13,0x13,0x54,0x01,0x90,0x9e,0xae,0x30,0xe0,0x59,0xe0,0x75,0xf0,0x02,0x90,
+0x00,0x88,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x1c,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,
+0x02,0x90,0x00,0x89,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x1d,0xf0,0x90,0x9e,0xae,0xe0,
+0x75,0xf0,0x04,0x90,0x01,0xd1,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x1e,0xf0,0x90,0x9e,
+0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd2,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x1f,0xf0,
+0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd3,0x12,0x43,0x5f,0xe0,0x90,0x9e,
+0x20,0xf0,0x80,0x33,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd1,0x12,0x43,0x5f,0xe0,0x90,
+0x9e,0x1c,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd2,0x12,0x43,0x5f,
+0xe0,0x90,0x9e,0x1d,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd3,0x12,
+0x43,0x5f,0xe0,0x90,0x9e,0x1e,0xf0,0xef,0x54,0x7f,0xff,0x7b,0x01,0x7a,0x9e,0x79,
+0x1c,0x31,0xb6,0x90,0x9e,0x19,0xe0,0xff,0x90,0x9e,0xae,0xe0,0xfe,0x74,0x01,0xa8,
+0x06,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0x5f,0x90,0x9e,0x19,0xf0,0x90,0x9e,
+0xae,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0x90,0x01,
+0xcc,0xf0,0x90,0x9e,0xae,0xe0,0x04,0xf0,0xe0,0x54,0x03,0xf0,0x01,0x7e,0x90,0x01,
+0xc6,0xe0,0x44,0x02,0xf0,0x22,0x90,0x9e,0x21,0x12,0x43,0x8b,0xef,0x12,0x43,0x94,
+0x59,0xfc,0x01,0x59,0xf4,0x02,0x5a,0x20,0x03,0x5a,0x29,0x05,0x5a,0x32,0x06,0x5a,
+0x7e,0x07,0x5a,0x3a,0x09,0x5a,0x43,0x0b,0x5a,0x4c,0x0c,0x5a,0x55,0x0d,0x5a,0x5e,
+0x0e,0x5a,0x67,0x1b,0x5a,0x6f,0x1c,0x5a,0x05,0x2d,0x5a,0x0e,0x2e,0x5a,0x17,0x3b,
+0x00,0x00,0x5a,0x77,0x90,0x9e,0x21,0x12,0x43,0x6b,0xe1,0xe9,0x90,0x9e,0x21,0x12,
+0x43,0x6b,0x02,0x71,0xd0,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x72,0x0b,0x90,0x9e,
+0x21,0x12,0x43,0x6b,0x02,0x72,0x53,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x72,0x8c,
+0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x72,0xb6,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,
+0x70,0x4a,0x90,0x9e,0x21,0x12,0x43,0x6b,0x80,0x45,0x90,0x9e,0x21,0x12,0x43,0x6b,
+0x02,0x72,0xfe,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x70,0xa2,0x90,0x9e,0x21,0x12,
+0x43,0x6b,0x02,0x49,0xc2,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x7b,0x29,0x90,0x9e,
+0x21,0x12,0x43,0x6b,0x02,0x4a,0xfc,0x90,0x9e,0x21,0x12,0x43,0x6b,0xe1,0xef,0x90,
+0x9e,0x21,0x12,0x43,0x6b,0xe1,0xd1,0x90,0x01,0xc6,0xe0,0x44,0x01,0xf0,0x22,0x90,
+0x00,0x04,0x12,0x42,0x20,0xff,0x54,0x1f,0xfe,0xef,0x54,0x20,0xc4,0x13,0x54,0x07,
+0xfd,0xaf,0x06,0x90,0x9e,0x24,0xef,0xf0,0xa3,0xed,0xf0,0xa3,0x12,0x43,0x8b,0x90,
+0x9e,0x26,0x12,0x43,0x6b,0x90,0x00,0x03,0x12,0x42,0x20,0x54,0xf0,0xc4,0x54,0x0f,
+0x90,0x9e,0x29,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0x54,0x40,0xc4,0x13,0x13,0x54,
+0x03,0x90,0x9e,0x2a,0xf0,0x90,0x9e,0x24,0xe0,0xff,0x75,0xf0,0x09,0x90,0x96,0x46,
+0x12,0x43,0x5f,0xad,0x82,0xac,0x83,0x90,0x9e,0x2b,0xec,0xf0,0xa3,0xed,0xf0,0xef,
+0x75,0xf0,0x09,0xa4,0x24,0x44,0xf9,0x74,0x96,0x35,0xf0,0xfa,0x7b,0x01,0xa3,0x12,
+0x43,0x8b,0x90,0x9e,0x26,0x12,0x43,0x6b,0x90,0x00,0x03,0x12,0x42,0x20,0x54,0x0f,
+0xff,0x90,0x9e,0x2d,0x12,0x43,0x6b,0xef,0x12,0x42,0x4d,0x90,0x9e,0x26,0x12,0x43,
+0x6b,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0x90,0x9e,0x2d,0x12,0x43,0x6b,0x90,0x00,
+0x01,0xef,0x12,0x42,0x5f,0x90,0x9e,0x26,0x12,0x43,0x6b,0x90,0x00,0x01,0x12,0x42,
+0x20,0xff,0x90,0x9e,0x2b,0xe0,0xfc,0xa3,0xe0,0xfd,0xf5,0x82,0x8c,0x83,0xef,0xf0,
+0x12,0x29,0xd9,0x8d,0x82,0x8c,0x83,0xa3,0xf0,0x90,0x9e,0x29,0xe0,0xfe,0x90,0x9e,
+0x24,0xe0,0xff,0x24,0x82,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,0x90,0x9e,
+0x25,0xe0,0xfe,0x75,0xf0,0x09,0xef,0x90,0x96,0x4a,0x12,0x43,0x5f,0xee,0xf0,0x75,
+0xf0,0x09,0xef,0x90,0x96,0x4b,0x12,0x43,0x5f,0x74,0x01,0xf0,0x90,0x9e,0x2a,0xe0,
+0xfe,0x75,0xf0,0x09,0xef,0x90,0x96,0x4c,0x12,0x43,0x5f,0xee,0xf0,0x8f,0x14,0xef,
+0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xaf,0x82,0xf5,0x16,0x8f,0x17,0xe5,
+0x14,0x75,0xf0,0x02,0xa4,0x24,0x02,0xf9,0x74,0x95,0x35,0xf0,0x75,0x18,0x01,0xf5,
+0x19,0x89,0x1a,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x46,0x12,0x43,0x5f,0xaf,0x82,
+0x85,0x83,0x1b,0x8f,0x1c,0xe5,0x14,0x75,0xf0,0x09,0xa4,0x24,0x44,0xf9,0x74,0x96,
+0x35,0xf0,0x75,0x1d,0x01,0xf5,0x1e,0x89,0x1f,0x74,0x82,0x25,0x14,0xf5,0x82,0xe4,
+0x34,0x95,0xf5,0x83,0xe0,0x12,0x43,0x94,0x5c,0x0d,0x00,0x5c,0x22,0x01,0x5c,0x37,
+0x02,0x5c,0x4c,0x03,0x5c,0x75,0x04,0x5c,0x8a,0x05,0x5c,0x9f,0x06,0x5c,0xc5,0x0c,
+0x5c,0xf2,0x0d,0x5d,0x1f,0x0e,0x5d,0x4c,0x0f,0x00,0x00,0x5d,0x80,0xe5,0x14,0x25,
+0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0xf0,0xf0,0xa3,0x74,0x15,
+0x80,0x3c,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,
+0xf0,0xf0,0xa3,0x74,0x10,0x80,0x27,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,
+0x34,0x9b,0xf5,0x83,0x74,0xf0,0xf0,0xa3,0x74,0x05,0x80,0x12,0xe5,0x14,0x25,0xe0,
+0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0xf0,0xf0,0xa3,0xe4,0xf0,0xe5,
+0x14,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0x74,0x0f,0xf0,0xa3,
+0x74,0x8f,0xf0,0xa1,0x80,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,
+0xf5,0x83,0x74,0x0f,0xf0,0xa3,0x74,0xf5,0x80,0x27,0xe5,0x14,0x25,0xe0,0x24,0xc6,
+0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0x0f,0xf0,0xa3,0x74,0xf0,0x80,0x12,0xe5,
+0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,0xa3,0x74,
+0x0d,0xf0,0xe5,0x14,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe4,
+0xf0,0xa3,0xf0,0xa1,0x80,0x90,0x04,0x47,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x12,
+0x42,0x4d,0x90,0x04,0x46,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x01,0x12,
+0x42,0x5f,0x90,0x04,0x45,0xe0,0x85,0x17,0x82,0x85,0x16,0x83,0xf0,0x90,0x04,0x44,
+0xa1,0x77,0x90,0x04,0x4b,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x12,0x42,0x4d,0x90,
+0x04,0x4a,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x01,0x12,0x42,0x5f,0x90,
+0x04,0x49,0xe0,0x85,0x17,0x82,0x85,0x16,0x83,0xf0,0x90,0x04,0x48,0x80,0x58,0x90,
+0x04,0x4f,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x12,0x42,0x4d,0x90,0x04,0x4e,0xe0,
+0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x01,0x12,0x42,0x5f,0x90,0x04,0x4d,0xe0,
+0x85,0x17,0x82,0x85,0x16,0x83,0xf0,0x90,0x04,0x4c,0x80,0x2b,0x90,0x04,0x53,0xe0,
+0xab,0x18,0xaa,0x19,0xa9,0x1a,0x12,0x42,0x4d,0x90,0x04,0x52,0xe0,0xab,0x18,0xaa,
+0x19,0xa9,0x1a,0x90,0x00,0x01,0x12,0x42,0x5f,0x90,0x04,0x51,0xe0,0x85,0x17,0x82,
+0x85,0x16,0x83,0xf0,0x90,0x04,0x50,0xe0,0x85,0x17,0x82,0x85,0x16,0x83,0xa3,0xf0,
+0xab,0x18,0xaa,0x19,0xa9,0x1a,0xc0,0x03,0xc0,0x02,0xc0,0x01,0x12,0x29,0xd9,0xff,
+0xab,0x1d,0xaa,0x1e,0xa9,0x1f,0x12,0x29,0xd9,0x5f,0xd0,0x01,0xd0,0x02,0xd0,0x03,
+0x12,0x42,0x4d,0xab,0x18,0xe5,0x1a,0x24,0x01,0xf9,0xe4,0x35,0x19,0xfa,0xc0,0x03,
+0xc0,0x02,0xc0,0x01,0x12,0x29,0xd9,0xff,0xab,0x1d,0xaa,0x1e,0xa9,0x1f,0x90,0x00,
+0x01,0x12,0x42,0x20,0x5f,0xd0,0x01,0xd0,0x02,0xd0,0x03,0x12,0x42,0x4d,0x85,0x17,
+0x82,0x85,0x16,0x83,0xc0,0x83,0xc0,0x82,0xe0,0xff,0x85,0x1c,0x82,0x85,0x1b,0x83,
+0xe0,0xfe,0xef,0x5e,0xd0,0x82,0xd0,0x83,0xf0,0x85,0x17,0x82,0x85,0x16,0x83,0xa3,
+0xc0,0x83,0xc0,0x82,0xe0,0xff,0x85,0x1c,0x82,0x85,0x1b,0x83,0xa3,0xe0,0xfe,0xef,
+0x5e,0xd0,0x82,0xd0,0x83,0xf0,0xe5,0x14,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,
+0x95,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x3b,0x75,0x15,0x0b,0x74,0x01,0x7e,
+0x00,0xa8,0x15,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xe5,0x14,
+0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0x5e,0xfe,0xa3,0xe0,
+0x5f,0x4e,0x60,0x06,0xe5,0x15,0x24,0x10,0x80,0x5d,0x15,0x15,0xe5,0x15,0xc3,0x94,
+0x00,0x50,0xca,0x80,0x56,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,
+0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x3d,0x75,0x15,0x0f,0x74,0x01,0x7e,0x00,
+0xa8,0x15,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xe5,0x14,0x25,
+0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,
+0x4e,0x60,0x08,0x90,0x9e,0x30,0xe5,0x15,0xf0,0x80,0x10,0x15,0x15,0xe5,0x15,0xc3,
+0x94,0x00,0x50,0xc8,0x80,0x05,0xe4,0x90,0x9e,0x30,0xf0,0xe5,0x14,0x25,0xe0,0x24,
+0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x3b,0xe4,
+0xf5,0x15,0x74,0x01,0x7e,0x00,0xa8,0x15,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,
+0xd8,0xf9,0xff,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,
+0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x08,0x90,0x9e,0x31,0xe5,0x15,0xf0,0x80,
+0x5b,0x05,0x15,0xe5,0x15,0xb4,0x10,0xca,0x80,0x52,0xe5,0x14,0x25,0xe0,0x24,0x02,
+0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x39,0xe4,0xf5,
+0x15,0x74,0x01,0x7e,0x00,0xa8,0x15,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,
+0xf9,0xff,0xe5,0x14,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,
+0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x06,0xe5,0x15,0x24,0x10,0x80,0x0a,0x05,0x15,
+0xe5,0x15,0xb4,0x0c,0xcc,0x80,0x05,0xe4,0x90,0x9e,0x31,0xf0,0x90,0x9e,0x30,0xe0,
+0xff,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x48,0x12,0x43,0x5f,0xef,0xf0,0x90,0x9e,
+0x31,0xe0,0xfe,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x49,0x12,0x43,0x5f,0xee,0xf0,
+0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0xd3,0x9f,0x40,0x06,
+0x90,0x9e,0x30,0x12,0x62,0x94,0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,0x04,0xf5,
+0x83,0xe0,0xff,0x90,0x9e,0x31,0xe0,0xfe,0xef,0xc3,0x9e,0x50,0x03,0x12,0x62,0x94,
+0x90,0x9e,0x30,0xe0,0xff,0xd3,0x94,0x13,0x40,0x07,0x90,0x96,0x43,0x74,0x03,0xf0,
+0x22,0xef,0xd3,0x94,0x0b,0x40,0x07,0x90,0x96,0x43,0x74,0x02,0xf0,0x22,0xef,0xd3,
+0x94,0x03,0x40,0x07,0x90,0x96,0x43,0x74,0x01,0xf0,0x22,0xe4,0x90,0x96,0x43,0xf0,
+0x22,0x90,0x00,0x04,0x12,0x42,0x20,0xff,0x54,0x3f,0xfe,0xef,0x54,0x80,0xc4,0x13,
+0x13,0x13,0x54,0x01,0xfd,0xaf,0x06,0x41,0x93,0x12,0x29,0xd9,0xf5,0x60,0x22,0x12,
+0x29,0xd9,0x90,0x95,0x01,0xf0,0x22,0xad,0x07,0x74,0x11,0x2d,0xf5,0x82,0xe4,0x34,
+0xfc,0xf5,0x83,0xe0,0x44,0x01,0xf0,0x90,0x04,0x80,0xe0,0x54,0x0f,0xfc,0x74,0x14,
+0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xc0,0x4c,0xfd,0x74,0x14,0x2f,
+0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xed,0xf0,0x22,0xef,0x60,0x0f,0x74,0x21,0x2d,
+0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x10,0xf0,0x22,0x74,0x21,0x2d,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xef,0xf0,0x22,0xe4,0xf5,0x60,0xf5,0x64,
+0xf5,0x63,0x75,0x62,0x0c,0x75,0x61,0x0c,0x90,0x9e,0x66,0xf0,0x90,0x9e,0x64,0xf0,
+0x90,0x9e,0x63,0xf0,0x90,0x9e,0x65,0x04,0xf0,0x90,0x9e,0x56,0xf0,0xe4,0x90,0x9e,
+0x67,0xf0,0x90,0x9e,0x58,0xf0,0x90,0x9e,0x61,0x74,0x07,0xf0,0xe4,0x90,0x9e,0x57,
+0xf0,0x90,0x9e,0x5f,0xf0,0xa3,0x74,0x03,0xf0,0x90,0x9e,0x5c,0x74,0x0a,0xf0,0xa3,
+0x74,0x05,0xf0,0x90,0x9e,0x5b,0x74,0x14,0xf0,0x90,0x9e,0x62,0x74,0x05,0xf0,0xe4,
+0x90,0x9e,0x5a,0xf0,0x90,0x9e,0x55,0xf0,0x90,0x9e,0x7f,0xf0,0x90,0x9e,0x5e,0xf0,
+0x22,0xe4,0x90,0x9e,0x67,0xf0,0x90,0x9e,0x57,0xf0,0xf5,0x64,0x22,0x7f,0x00,0x22,
+0xe5,0x62,0x30,0xe6,0x19,0xe5,0x62,0x54,0x0f,0xff,0x90,0x9e,0x54,0xe0,0xfe,0x4f,
+0x90,0x01,0x2f,0xf0,0xee,0x64,0x80,0x90,0x9e,0x54,0xf0,0x53,0x62,0xbf,0x22,0xe5,
+0x60,0x64,0x01,0x70,0x68,0xe5,0x63,0x60,0x64,0xe5,0x63,0x64,0x02,0x60,0x06,0xe5,
+0x63,0x64,0x05,0x70,0x27,0x90,0x06,0xab,0xe0,0x90,0x9e,0x56,0xf0,0x90,0x06,0xaa,
+0xe0,0x90,0x9e,0x65,0xf0,0x90,0x9e,0x56,0xe0,0x70,0x07,0x90,0x9e,0x65,0xe0,0xff,
+0x80,0x05,0x90,0x9e,0x56,0xe0,0xff,0x90,0x9e,0x56,0xef,0xf0,0x90,0x9e,0x58,0xe0,
+0x60,0x03,0xe0,0x14,0xf0,0xe4,0x90,0x9e,0x57,0xf0,0x90,0x05,0x58,0x74,0x03,0xf0,
+0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x53,0x64,0xfd,0x53,0x64,
+0xef,0xe5,0x63,0x14,0x24,0xfd,0x50,0x02,0x80,0x03,0x12,0x45,0x53,0x22,0xe4,0xfb,
+0x90,0x9e,0x9c,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,0x63,0x60,0x6a,0xe5,0x60,
+0x64,0x01,0x70,0x64,0xe5,0x63,0x14,0x60,0x2b,0x24,0xfd,0x60,0x27,0x24,0x02,0x24,
+0xfb,0x50,0x02,0x80,0x21,0x90,0x9e,0x56,0xe0,0x14,0xf0,0xe0,0x60,0x04,0xa3,0xe0,
+0x60,0x14,0x90,0x9e,0x56,0xe0,0x70,0x08,0x90,0x9e,0x65,0xe0,0x90,0x9e,0x56,0xf0,
+0x7b,0x01,0x80,0x02,0x7b,0x01,0xeb,0x60,0x2f,0x43,0x64,0x10,0xe4,0x90,0x9e,0x85,
+0xf0,0x90,0x9e,0x57,0xe0,0x75,0xf0,0x03,0xa4,0xff,0x90,0x9e,0x61,0xe0,0x2f,0x12,
+0x44,0x53,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,0x61,0x54,0x0f,0xc3,0x94,0x04,0x50,
+0x07,0x7d,0x01,0x7f,0x04,0x12,0x54,0xe7,0x22,0xe4,0x90,0x9e,0x15,0xf0,0xe5,0x63,
+0x60,0x79,0x90,0x9e,0x67,0xe0,0x60,0x0d,0xe4,0xf0,0x53,0x64,0xfd,0xe5,0x64,0x54,
+0x07,0x70,0x68,0x80,0x63,0x90,0x9e,0x57,0xe0,0x04,0xf0,0x53,0x64,0xef,0x90,0x9e,
+0x15,0xe0,0xf9,0xff,0x7e,0x00,0x24,0x01,0xfd,0xee,0x33,0xfc,0x90,0x9e,0x57,0xe0,
+0xb5,0x05,0x06,0xe4,0xb5,0x04,0x02,0x80,0x12,0xef,0x24,0x02,0xff,0xe4,0x3e,0xfe,
+0x90,0x9e,0x57,0xe0,0xb5,0x07,0x0a,0xe4,0xb5,0x06,0x06,0x90,0x05,0x58,0xe0,0x04,
+0xf0,0xe9,0xff,0x90,0x9e,0x5c,0xe0,0x2f,0xff,0xe4,0x33,0xfe,0x90,0x9e,0x57,0xe0,
+0xd3,0x9f,0xee,0x64,0x80,0xf8,0x74,0x80,0x98,0x40,0x0d,0xe5,0x60,0xb4,0x01,0x0b,
+0xa3,0xe0,0x70,0x07,0xe0,0x04,0xf0,0x22,0x12,0x44,0xcb,0x22,0x90,0x9e,0x5f,0xe0,
+0xa3,0xe0,0x90,0x05,0x58,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,
+0x93,0x12,0x43,0x8b,0x90,0x9e,0x96,0xe0,0x54,0xf0,0x44,0x06,0xff,0xf0,0xed,0x54,
+0x0f,0xc4,0x54,0xf0,0xfe,0xef,0x54,0x0f,0x4e,0xf0,0x90,0x9e,0x93,0x12,0x43,0x6b,
+0x90,0x9e,0x90,0x12,0x43,0x8b,0x7b,0x01,0x7a,0x9e,0x79,0x96,0x12,0x53,0xf1,0xd0,
+0xd0,0x92,0xaf,0x22,0xe0,0xfd,0x74,0x26,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9d,0xf5,
+0x83,0xed,0xf0,0xaf,0x14,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0xef,0xc3,0x94,0x20,
+0x50,0x0e,0x74,0x84,0x2f,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xed,0xf0,0x80,0x29,
+0x74,0xa6,0x2f,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xed,0xf0,0x90,0x9e,0x68,0xef,
+0xf0,0x24,0xa6,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x90,0x9e,0x69,0xf0,0x7b,
+0x01,0x7a,0x9e,0x79,0x68,0x7d,0x02,0x51,0x57,0xd0,0xd0,0x92,0xaf,0x22,0x8f,0x0a,
+0x8d,0x0b,0xe5,0x0b,0x54,0x1f,0xf5,0x10,0x74,0x01,0x2f,0xf5,0x82,0xe4,0x34,0x94,
+0xf5,0x83,0xe0,0xf5,0x0e,0x90,0x04,0xfd,0xe0,0xb4,0x01,0x05,0x75,0x11,0x03,0x80,
+0x03,0x75,0x11,0x01,0xeb,0xc3,0x95,0x11,0x40,0x04,0xaf,0x0a,0x80,0x33,0xe5,0x0e,
+0x25,0x0d,0xf5,0x0f,0xe5,0x10,0x90,0x41,0xd6,0x93,0xff,0xe5,0x0f,0xd3,0x9f,0x74,
+0x01,0x40,0x11,0x25,0x0a,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xe4,0xf0,0xad,0x0b,
+0xaf,0x0a,0x41,0xa5,0x25,0x0a,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xe5,0x0f,0xf0,
+0x22,0xad,0x07,0x75,0xf0,0x09,0xed,0x90,0x96,0x48,0x12,0x43,0x5f,0xe0,0xff,0x74,
+0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xe0,0x54,0x1f,0xf5,0x12,0xd3,0x9f,
+0x40,0x02,0x8f,0x12,0xe5,0x12,0x25,0xe0,0x24,0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,
+0x83,0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xe5,0x12,0x25,0xe0,0x24,0x66,0xf5,0x82,
+0xe4,0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,
+0xef,0x13,0xff,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,
+0xf0,0xa3,0xef,0xf0,0xaf,0x05,0xad,0x12,0x51,0xa5,0xaf,0x12,0x22,0xac,0x07,0xec,
+0xc3,0x94,0x20,0x50,0x0d,0x74,0x84,0x2c,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,
+0x80,0x0b,0x74,0xa6,0x2c,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x54,0x7f,0xf5,
+0x1f,0xe5,0x1f,0x54,0x1f,0xff,0x90,0x9e,0x25,0xf0,0x75,0xf0,0x09,0xec,0x90,0x96,
+0x49,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x27,0xf0,0x75,0xf0,0x09,0xec,0x90,0x96,0x48,
+0x12,0x43,0x5f,0xe0,0xfe,0x90,0x9e,0x28,0xf0,0xec,0x25,0xe0,0x24,0xc6,0xf5,0x82,
+0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfb,0xa3,0xe0,0x90,0x9e,0x29,0xcb,0xf0,0xa3,0xeb,
+0xf0,0xec,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0xfb,0xa3,
+0xe0,0x90,0x9e,0x2b,0xcb,0xf0,0xa3,0xeb,0xf0,0xef,0xd3,0x9e,0x40,0x0a,0x90,0x9e,
+0x28,0xe0,0x90,0x9e,0x25,0xf0,0xf5,0x1f,0xed,0x70,0x02,0xa1,0x13,0x90,0x9e,0x26,
+0xed,0xf0,0xe5,0x1f,0x30,0xe6,0x0a,0x90,0x9e,0x25,0xe0,0xf5,0x1f,0xa3,0xe0,0x14,
+0xf0,0x90,0x9e,0x26,0xe0,0x70,0x02,0xa1,0x13,0x90,0x9e,0x25,0xe0,0xff,0xd3,0x94,
+0x00,0x50,0x02,0xa1,0x13,0xe4,0x90,0x9e,0x24,0xf0,0xef,0x14,0x90,0x9e,0x23,0xf0,
+0x90,0x9e,0x27,0xe0,0xfd,0x90,0x9e,0x23,0xe0,0xff,0xd3,0x9d,0x40,0x6b,0xef,0x94,
+0x10,0x40,0x21,0xef,0x24,0xf0,0xff,0x74,0x01,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,
+0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x9e,0x2b,0xe0,0x5e,0xfe,0xa3,0xe0,
+0x5f,0x4e,0x70,0x27,0x90,0x9e,0x23,0xe0,0xff,0xc3,0x94,0x10,0x50,0x33,0x74,0x01,
+0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,
+0x9e,0x29,0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x16,0x90,0x9e,0x23,0xe0,0xf5,
+0x1f,0xa3,0xe0,0x04,0xf0,0x90,0x9e,0x26,0xe0,0xff,0x90,0x9e,0x24,0xe0,0x6f,0x60,
+0x08,0x90,0x9e,0x23,0xe0,0x14,0xf0,0x80,0x87,0x90,0x9e,0x26,0xe0,0xff,0x90,0x9e,
+0x24,0xe0,0xc3,0x9f,0x50,0x0d,0x90,0x9e,0x23,0xe0,0xb5,0x05,0x06,0x90,0x9e,0x27,
+0xe0,0xf5,0x1f,0xe5,0x1f,0x25,0xe0,0x24,0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,
+0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xe5,0x1f,0x25,0xe0,0x24,0x66,0xf5,0x82,0xe4,
+0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,0xef,
+0x13,0xff,0xec,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,
+0xa3,0xef,0xf0,0xaf,0x04,0xad,0x1f,0x51,0xa5,0xaf,0x1f,0x22,0xad,0x07,0xed,0xc3,
+0x94,0x20,0x50,0x0d,0x74,0x84,0x2d,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0x80,
+0x0b,0x74,0xa6,0x2d,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x54,0x7f,0xf5,0x1f,
+0xe5,0x1f,0x54,0x1f,0xfc,0x75,0xf0,0x09,0xed,0x90,0x96,0x48,0x12,0x43,0x5f,0xe0,
+0xff,0x90,0x9e,0x23,0xf0,0xed,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,
+0x83,0xe0,0xfb,0xa3,0xe0,0x90,0x9e,0x24,0xcb,0xf0,0xa3,0xeb,0xf0,0xed,0x25,0xe0,
+0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfb,0xa3,0xe0,0x90,0x9e,0x26,
+0xcb,0xf0,0xa3,0xeb,0xf0,0xec,0x25,0xe0,0x24,0x66,0xf5,0x82,0xe4,0x34,0x41,0xf5,
+0x83,0xe4,0x93,0xfa,0x74,0x01,0x93,0xfb,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,
+0x34,0x95,0xf5,0x83,0xea,0xf0,0xa3,0xeb,0xf0,0xec,0xc3,0x9f,0x40,0x02,0xc1,0x7a,
+0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xec,0xf0,0x04,0xfb,0x90,0x9e,
+0x23,0xe0,0xff,0xeb,0xd3,0x9f,0x40,0x02,0xc1,0xab,0xeb,0xc3,0x94,0x10,0x40,0x21,
+0xeb,0x24,0xf0,0xff,0x74,0x01,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,
+0x33,0xce,0xd8,0xf9,0xff,0x90,0x9e,0x24,0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x70,
+0x23,0xeb,0xc3,0x94,0x10,0x50,0x40,0x74,0x01,0x7e,0x00,0xa8,0x03,0x08,0x80,0x05,
+0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x9e,0x26,0xe0,0x5e,0xfe,0xa3,0xe0,
+0x5f,0x4e,0x60,0x23,0xbb,0x11,0x09,0x90,0x9e,0x25,0xe0,0x30,0xe7,0x02,0x7b,0x17,
+0xeb,0x64,0x13,0x60,0x03,0xbb,0x12,0x09,0x90,0x9e,0x24,0xe0,0x30,0xe0,0x02,0x7b,
+0x18,0xac,0x03,0x8c,0x1f,0x80,0x34,0x0b,0x80,0x84,0x90,0x9e,0x23,0xe0,0xfb,0x6c,
+0x70,0x69,0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xec,0xf0,0x75,0xf0,
+0x09,0xed,0x90,0x96,0x4a,0x12,0x43,0x5f,0xe0,0xb4,0x01,0x0c,0xe5,0x1f,0x20,0xe6,
+0x07,0xec,0x44,0x40,0xf5,0x1f,0x80,0x03,0xaf,0x1f,0x22,0xec,0x25,0xe0,0x24,0x9e,
+0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xec,0x25,
+0xe0,0x24,0x66,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,
+0x93,0x3e,0xc3,0x13,0xfe,0xef,0x13,0xff,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,
+0x34,0x95,0xf5,0x83,0xee,0xf0,0xa3,0xef,0xf0,0x80,0x5b,0xec,0xd3,0x9b,0x40,0x56,
+0x90,0x9e,0x23,0xe0,0xff,0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xef,
+0xf0,0xac,0x07,0x8f,0x1f,0xec,0x25,0xe0,0x24,0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,
+0x83,0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xec,0x25,0xe0,0x24,0x66,0xf5,0x82,0xe4,
+0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,0xef,
+0x13,0xff,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,
+0xa3,0xef,0xf0,0xaf,0x1f,0x22,0x74,0x01,0x2d,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,
+0xe4,0xf0,0xaf,0x05,0xe5,0x1f,0x44,0x80,0xfd,0x51,0xa5,0xe5,0x1f,0x44,0x80,0xff,
+0x22,0xef,0xc3,0x94,0x20,0x50,0x39,0xef,0x30,0xe0,0x17,0xed,0xc4,0x54,0xf0,0xfd,
+0xef,0xc3,0x13,0xfe,0x24,0xa4,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0x54,0x0f,
+0x80,0x10,0xef,0xc3,0x13,0xfe,0x24,0xa4,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,
+0x54,0xf0,0xf0,0x74,0xa4,0x2e,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0x4d,0xf0,
+0x22,0xe4,0xf5,0x14,0xe5,0x14,0xb4,0x20,0x14,0x90,0x9a,0xc5,0xe0,0x04,0xf0,0x90,
+0x95,0x01,0xe0,0xff,0x90,0x9a,0xc5,0xe0,0xb5,0x07,0x02,0xe4,0xf0,0x75,0xf0,0x09,
+0xe5,0x14,0x90,0x96,0x4b,0x12,0x43,0x5f,0xe0,0x64,0x01,0x60,0x03,0x02,0x6e,0x6a,
+0xe5,0x14,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,0x34,0x93,0xf5,0x83,0xe0,0xfe,0xa3,
+0xe0,0xd3,0x94,0x00,0xee,0x94,0x00,0x50,0x03,0x02,0x6e,0x6a,0xe5,0x14,0x94,0x20,
+0x40,0x09,0x90,0x9a,0xc5,0xe0,0x60,0x03,0x02,0x6e,0x76,0xe5,0x14,0x75,0xf0,0x0a,
+0xa4,0x24,0x00,0xf9,0x74,0x90,0x35,0xf0,0x75,0x18,0x01,0xf5,0x19,0x89,0x1a,0xe5,
+0x14,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,0x34,0x93,0xf5,0x83,0xe0,0xff,0xa3,0xe0,
+0x90,0x9e,0x1b,0xcf,0xf0,0xa3,0xef,0xf0,0xe5,0x14,0x25,0xe0,0x24,0xc4,0xf5,0x82,
+0xe4,0x34,0x98,0xf5,0x83,0xe0,0xff,0xa3,0xe0,0x90,0x9e,0x1d,0xcf,0xf0,0xa3,0xef,
+0xf0,0xe5,0x14,0xc3,0x94,0x20,0x50,0x14,0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,
+0x04,0xf5,0x83,0xe0,0x54,0x3f,0x90,0x9e,0x19,0xf0,0x80,0x12,0x74,0xa6,0x25,0x14,
+0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x54,0x3f,0x90,0x9e,0x19,0xf0,0x90,0x9e,
+0x19,0xe0,0xfe,0x54,0x1f,0xa3,0xf0,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x48,0x12,
+0x43,0x5f,0xe0,0x90,0x9e,0x20,0xf0,0x74,0xe6,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,
+0xf5,0x83,0xe0,0xc3,0x94,0x05,0x40,0x02,0x41,0x9f,0x90,0x9e,0x20,0xe0,0xff,0x90,
+0x9e,0x1a,0xe0,0x9f,0x40,0x13,0x90,0x9e,0x20,0xe0,0x90,0x9e,0x1a,0xf0,0xee,0x54,
+0x40,0xfe,0x90,0x9e,0x19,0xf0,0xef,0x4e,0xf0,0x90,0x04,0xfd,0xe0,0x54,0x05,0x64,
+0x01,0x70,0x29,0x90,0x9e,0x1a,0xe0,0xff,0x90,0x41,0x4a,0x93,0xfe,0x74,0x44,0x25,
+0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xc3,0x9e,0x40,0x06,0xef,0x90,0x40,
+0xda,0x80,0x30,0x90,0x9e,0x1a,0xe0,0x90,0x40,0xf6,0x80,0x27,0x90,0x9e,0x1a,0xe0,
+0xff,0x90,0x41,0x4a,0x93,0xfe,0x74,0x44,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,
+0x83,0xe0,0xc3,0x9e,0x40,0x06,0xef,0x90,0x41,0x12,0x80,0x07,0x90,0x9e,0x1a,0xe0,
+0x90,0x41,0x2e,0x93,0x90,0x9e,0x1f,0xf0,0x90,0x9e,0x1f,0xe0,0x75,0xf0,0x06,0xa4,
+0x24,0x50,0xf9,0x74,0x40,0x35,0xf0,0xfa,0x7b,0xff,0x8b,0x15,0xf5,0x16,0x89,0x17,
+0xe5,0x14,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0xf5,0x1b,
+0xa3,0xe0,0xf5,0x1c,0x12,0x29,0xd9,0xff,0x7e,0x00,0xab,0x18,0xaa,0x19,0xa9,0x1a,
+0x12,0x42,0x97,0xfd,0xac,0xf0,0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,0x35,
+0x1b,0xf5,0x1b,0xab,0x15,0xaa,0x16,0xa9,0x17,0x90,0x00,0x01,0x12,0x42,0x20,0xff,
+0x7e,0x00,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x02,0x12,0x42,0xc2,0xfd,0xac,
+0xf0,0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,0x35,0x1b,0xf5,0x1b,0xab,0x15,
+0xaa,0x16,0xa9,0x17,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0x7e,0x00,0xab,0x18,0xaa,
+0x19,0xa9,0x1a,0x90,0x00,0x04,0x12,0x42,0xc2,0xfd,0xac,0xf0,0x12,0x29,0xf2,0xef,
+0x25,0x1c,0xf5,0x1c,0xee,0x35,0x1b,0xf5,0x1b,0xab,0x15,0xaa,0x16,0xa9,0x17,0x90,
+0x00,0x03,0x12,0x42,0x20,0xff,0x7e,0x00,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,
+0x06,0x12,0x42,0xc2,0xfd,0xac,0xf0,0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,
+0x35,0x1b,0xf5,0x1b,0xab,0x15,0xaa,0x16,0xa9,0x17,0x90,0x00,0x04,0x12,0x42,0x20,
+0xff,0x7e,0x00,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x08,0x12,0x42,0xc2,0xfd,
+0xac,0xf0,0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,0x35,0x1b,0xf5,0x1b,0xab,
+0x15,0xaa,0x16,0xa9,0x17,0x90,0x00,0x05,0x12,0x42,0x20,0xff,0x7e,0x00,0x90,0x9e,
+0x1b,0xe0,0xfc,0xa3,0xe0,0xfd,0x12,0x29,0xf2,0xd3,0xe5,0x1c,0x9f,0xe5,0x1b,0x9e,
+0x40,0x0c,0xe5,0x1c,0x9f,0xf5,0x1c,0xe5,0x1b,0x9e,0xf5,0x1b,0x80,0x05,0xe4,0xf5,
+0x1b,0xf5,0x1c,0xe5,0x14,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,
+0xe5,0x1b,0xf0,0xa3,0xe5,0x1c,0xf0,0x90,0x9e,0x19,0xe0,0x25,0xe0,0x24,0x66,0xf5,
+0x82,0xe4,0x34,0x41,0xf5,0x83,0xc3,0x74,0x01,0x93,0x95,0x1c,0xe4,0x93,0x95,0x1b,
+0x50,0x07,0xaf,0x14,0x12,0x65,0x5c,0xa1,0x31,0x90,0x9e,0x19,0xe0,0x25,0xe0,0x24,
+0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0xd3,0x74,0x01,0x93,0x95,0x1c,0xe4,0x93,
+0x95,0x1b,0x50,0x02,0xa1,0x31,0x7d,0x01,0xaf,0x14,0x12,0x63,0xbd,0xa1,0x31,0x74,
+0xe6,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0xfc,0x64,0x05,0x60,0x02,
+0x81,0x3a,0x90,0x96,0x43,0xe0,0xff,0xb4,0x03,0x0b,0x90,0x9e,0x1a,0xe0,0xc3,0x94,
+0x19,0x40,0x3d,0x80,0x2e,0xef,0xb4,0x02,0x0b,0x90,0x9e,0x1a,0xe0,0xc3,0x94,0x11,
+0x40,0x2e,0x80,0x1f,0x90,0x96,0x43,0xe0,0xff,0xb4,0x01,0x0b,0x90,0x9e,0x1a,0xe0,
+0xc3,0x94,0x0a,0x40,0x1b,0x80,0x0c,0xef,0x70,0x11,0x90,0x9e,0x1a,0xe0,0xc3,0x94,
+0x03,0x40,0x0d,0x90,0x9a,0x84,0x74,0x01,0xf0,0x80,0x05,0xe4,0x90,0x9a,0x84,0xf0,
+0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe0,0xf5,0x1e,0x74,0x44,
+0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xff,0xc3,0x94,0x30,0x50,0x02,
+0x61,0xe7,0x90,0x9a,0x84,0xe0,0x64,0x01,0x60,0x02,0x61,0xe7,0x74,0x85,0x25,0x14,
+0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0x64,0x0a,0x60,0x51,0xef,0x24,0x05,0xff,
+0xe4,0x33,0xfe,0x74,0x41,0x25,0x14,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xe0,0xfd,
+0xd3,0x9f,0xee,0x64,0x80,0xf8,0x74,0x80,0x98,0x50,0x32,0xed,0x24,0x05,0xff,0xe4,
+0x33,0xfe,0x74,0x44,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xd3,0x9f,
+0xee,0x64,0x80,0xf8,0x74,0x80,0x98,0x50,0x14,0x74,0x26,0x25,0x14,0xf5,0x82,0xe4,
+0x34,0x9d,0xf5,0x83,0xe0,0xff,0x90,0x9e,0x1a,0xe0,0x6f,0x60,0x3d,0x74,0x44,0x25,
+0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xff,0xd3,0x94,0x42,0x40,0x05,0x75,
+0x1e,0x05,0x80,0x0e,0xef,0xd3,0x94,0x39,0x40,0x05,0x75,0x1e,0x03,0x80,0x03,0x75,
+0x1e,0x01,0x74,0x41,0x25,0x14,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xef,0xf0,0x74,
+0x85,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,0x80,0x29,0x74,0xe6,0x25,0x14,0xf5,0x82,
+0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x74,0x85,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,
+0xf5,0x83,0xe0,0x04,0xf0,0x80,0x10,0xe4,0xf5,0x1e,0x74,0xe6,0x25,0x14,0xf5,0x82,
+0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x90,0x9e,0x1a,0xe0,0xff,0x74,0x26,0x25,0x14,
+0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xef,0xf0,0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,
+0x34,0x98,0xf5,0x83,0xe5,0x1e,0xf0,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x4c,0x12,
+0x43,0x5f,0xe0,0xb4,0x01,0x10,0xe4,0xf5,0x1e,0x74,0xe6,0x25,0x14,0xf5,0x82,0xe4,
+0x34,0x9c,0xf5,0x83,0xe4,0xf0,0xad,0x1e,0xa1,0x2c,0xec,0x64,0x06,0x60,0x02,0xa1,
+0x31,0xf5,0x1b,0xf5,0x1c,0x90,0x42,0x13,0x93,0xff,0x7e,0x00,0x90,0x9e,0x1b,0xe0,
+0xfc,0xa3,0xe0,0xfd,0x12,0x29,0xf2,0x90,0x9e,0x21,0xee,0xf0,0xa3,0xef,0xf0,0x74,
+0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe0,0xf5,0x1e,0xe4,0xf5,0x1d,
+0xab,0x18,0xaa,0x19,0xa9,0x1a,0x75,0xf0,0x02,0xe5,0x1d,0xa4,0xf5,0x82,0x85,0xf0,
+0x83,0x12,0x42,0xc2,0xfd,0xac,0xf0,0xe5,0x1d,0x90,0x42,0x0e,0x93,0xff,0x7e,0x00,
+0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,0x35,0x1b,0xf5,0x1b,0xc3,0x90,0x9e,
+0x22,0xe0,0x95,0x1c,0x90,0x9e,0x21,0xe0,0x95,0x1b,0x40,0x07,0x05,0x1d,0xe5,0x1d,
+0xb4,0x05,0xbd,0xe5,0x1d,0xc3,0x13,0xf5,0x1d,0xe5,0x1e,0xb4,0x01,0x06,0xe5,0x1d,
+0x70,0x46,0x80,0x13,0xe5,0x1e,0xb4,0x03,0x15,0xe5,0x1d,0x70,0x05,0x75,0x1e,0x03,
+0x80,0x39,0xe5,0x1d,0xb4,0x01,0x05,0x75,0x1e,0x01,0x80,0x2f,0x80,0x2a,0xe5,0x1e,
+0xb4,0x05,0x28,0xe5,0x1d,0x70,0x05,0x75,0x1e,0x05,0x80,0x0d,0xe5,0x1d,0xb4,0x01,
+0x05,0x75,0x1e,0x03,0x80,0x03,0x75,0x1e,0x01,0xd3,0x90,0x9e,0x1e,0xe0,0x94,0x03,
+0x90,0x9e,0x1d,0xe0,0x94,0x00,0x40,0x03,0xe4,0xf5,0x1e,0xd3,0x90,0x9e,0x1e,0xe0,
+0x94,0x03,0x90,0x9e,0x1d,0xe0,0x94,0x00,0x40,0x03,0xe4,0xf5,0x1e,0x74,0x84,0x25,
+0x14,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe5,0x1e,0xf0,0xfd,0xaf,0x14,0x12,0x67,
+0x61,0x74,0xe6,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0xd3,0x94,0x05,
+0x74,0xe6,0x50,0x0e,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x04,0xf0,
+0x80,0x0b,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x90,0x9e,0x1d,
+0xe0,0xfe,0xa3,0xe0,0xff,0xc3,0x74,0xff,0x9f,0xfd,0x74,0xff,0x9e,0xfc,0xe5,0x14,
+0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xfa,0xa3,0xe0,0xd3,
+0x9d,0xea,0x9c,0xe5,0x14,0x50,0x13,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,
+0xf5,0x83,0xee,0x8f,0xf0,0x12,0x42,0x81,0x80,0x10,0x25,0xe0,0x24,0xc6,0xf5,0x82,
+0xe4,0x34,0x9a,0xf5,0x83,0x74,0xff,0xf0,0xa3,0xf0,0xe5,0x14,0x25,0xe0,0x24,0x44,
+0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0xff,0xc3,0x74,0xff,0x9f,
+0xfd,0x74,0xff,0x9e,0xfc,0xe5,0x14,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,
+0xf5,0x83,0xe0,0xfa,0xa3,0xe0,0xd3,0x9d,0xea,0x9c,0xe5,0x14,0x50,0x13,0x25,0xe0,
+0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xee,0x8f,0xf0,0x12,0x42,0x81,0x80,
+0x10,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0xff,0xf0,0xa3,
+0xf0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0xe4,0xf5,0xf0,0x12,0x42,0xfa,0xab,0x18,0xaa,
+0x19,0xa9,0x1a,0x90,0x00,0x02,0xe4,0xf5,0xf0,0x12,0x43,0x19,0x90,0x00,0x04,0xe4,
+0xf5,0xf0,0x12,0x43,0x19,0x90,0x00,0x06,0xe4,0xf5,0xf0,0x12,0x43,0x19,0x90,0x00,
+0x08,0xe4,0xf5,0xf0,0x12,0x43,0x19,0xe5,0x14,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,
+0x34,0x93,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0xe5,0x14,0x25,0xe0,0x24,0xc4,0xf5,0x82,
+0xe4,0x34,0x98,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0xe5,0x14,0x25,0xe0,0x24,0x44,0xf5,
+0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0x05,0x14,0xe5,0x14,0xc3,0x94,
+0x40,0x50,0x03,0x02,0x67,0xa4,0x22,0x90,0x04,0x44,0x74,0x11,0xf0,0xa3,0x74,0xf0,
+0xf0,0xa3,0x74,0x0f,0xf0,0xa3,0xe4,0xf0,0xfd,0x74,0xa4,0x2d,0xf5,0x82,0xe4,0x34,
+0x04,0xf5,0x83,0xe4,0xf0,0x0d,0xbd,0x10,0xf0,0xe4,0x90,0x9a,0xc5,0xf0,0x90,0x95,
+0x01,0x04,0xf0,0xe4,0xfd,0x75,0xf0,0x0a,0xed,0x90,0x90,0x00,0x12,0x43,0x5f,0xe4,
+0xf0,0xa3,0xf0,0x75,0xf0,0x0a,0xed,0x90,0x90,0x02,0x12,0x43,0x5f,0xe4,0xf0,0xa3,
+0xf0,0x75,0xf0,0x0a,0xed,0x90,0x90,0x04,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x75,
+0xf0,0x0a,0xed,0x90,0x90,0x06,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x75,0xf0,0x0a,
+0xed,0x90,0x90,0x08,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x74,0x26,0x2d,0xf5,0x82,
+0xe4,0x34,0x9d,0xf5,0x83,0x74,0x13,0xf0,0x74,0x85,0x2d,0xf5,0x82,0xe4,0x34,0x9a,
+0xf5,0x83,0xe4,0xf0,0x74,0x84,0x2d,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe4,0xf0,
+0xed,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,0x34,0x93,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0x44,0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0x74,0x86,0x2d,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x74,0x46,0x2d,0xf5,
+0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x74,0xe6,0x2d,0xf5,0x82,0xe4,0x34,0x9c,
+0xf5,0x83,0xe4,0xf0,0x90,0x41,0xc4,0x93,0xfe,0x74,0x01,0x93,0xff,0x90,0x41,0x8c,
+0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,0xef,0x13,0xff,0xed,0x25,
+0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,0xa3,0xef,0xf0,0x75,
+0xf0,0x09,0xed,0x90,0x96,0x4b,0x12,0x43,0x5f,0x74,0x01,0xf0,0x75,0xf0,0x09,0xed,
+0x90,0x96,0x4a,0x12,0x43,0x5f,0x74,0x01,0xf0,0x74,0x82,0x2d,0xf5,0x82,0xe4,0x34,
+0x95,0xf5,0x83,0x74,0x0c,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x46,0x12,0x43,0x5f,
+0x74,0xff,0xf0,0xa3,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x44,0x12,0x43,0x5f,0xe4,
+0xf0,0xa3,0x74,0x0f,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x48,0x12,0x43,0x5f,0x74,
+0x13,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x49,0x12,0x43,0x5f,0xe4,0xf0,0xed,0xc3,
+0x94,0x20,0x50,0x0f,0x74,0x84,0x2d,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0x74,0x13,
+0xf0,0x80,0x0d,0x74,0xa6,0x2d,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0x74,0x13,0xf0,
+0x0d,0xed,0x64,0x40,0x60,0x03,0x02,0x6e,0xa5,0x22,0x12,0x29,0xd9,0xf5,0x14,0xc3,
+0x94,0x40,0x50,0x15,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0x74,0x44,0x25,0x14,0xf5,
+0x82,0xe4,0x34,0x9a,0xf5,0x83,0xef,0xf0,0x22,0xe5,0x14,0xb4,0x40,0x0a,0x90,0x00,
+0x02,0x12,0x42,0x20,0x90,0x96,0x42,0xf0,0x22,0x90,0x9e,0x30,0x12,0x43,0x8b,0x90,
+0x9e,0x33,0xe0,0x54,0xf0,0x44,0x02,0xf0,0x54,0x0f,0x44,0xc0,0xf0,0x90,0x9e,0x30,
+0x12,0x43,0x6b,0x90,0x9e,0x90,0x12,0x43,0x8b,0x7b,0x01,0x7a,0x9e,0x79,0x33,0x02,
+0x53,0xf1,0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x90,0x00,0x01,0x12,0x42,0x20,0xfc,
+0xed,0xc3,0x94,0x40,0x40,0x02,0xe4,0xfd,0xec,0xc3,0x94,0x40,0x40,0x02,0xe4,0xfc,
+0xed,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xfa,0xa3,0xe0,
+0xfb,0xea,0x90,0x9e,0x24,0xf0,0xeb,0xa3,0xf0,0xed,0x25,0xe0,0x24,0x46,0xf5,0x82,
+0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfa,0xa3,0xe0,0xfb,0xea,0x90,0x9e,0x26,0xf0,0xeb,
+0xa3,0xf0,0xa3,0xed,0xf0,0xa3,0x74,0xff,0xf0,0xec,0x25,0xe0,0x24,0xc6,0xf5,0x82,
+0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xfa,0xa3,0xe0,0xfb,0xea,0x90,0x9e,0x2a,0xf0,0xeb,
+0xa3,0xf0,0xec,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfa,
+0xa3,0xe0,0xfb,0xea,0x90,0x9e,0x2c,0xf0,0xeb,0xa3,0xf0,0xa3,0xec,0xf0,0xa3,0x74,
+0xff,0xf0,0xed,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe4,0xf0,
+0xa3,0xf0,0xed,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,
+0xa3,0xf0,0xec,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe4,0xf0,
+0xa3,0xf0,0xec,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,
+0xa3,0xf0,0x7b,0x01,0x7a,0x9e,0x79,0x24,0x01,0x79,0xd3,0x10,0xaf,0x01,0xc3,0xc0,
+0xd0,0x90,0x9e,0xa4,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0x90,0x9e,
+0xa4,0xe0,0xfe,0xa3,0xe0,0xf5,0x82,0x8e,0x83,0xe0,0x60,0x2d,0xc3,0x90,0x9e,0xa7,
+0xe0,0x94,0xe8,0x90,0x9e,0xa6,0xe0,0x94,0x03,0x40,0x0b,0x90,0x01,0xc6,0xe0,0x44,
+0x10,0xf0,0x7f,0x00,0x80,0x15,0x90,0x9e,0xa6,0xe4,0x75,0xf0,0x01,0x12,0x42,0x81,
+0x7f,0x0a,0x7e,0x00,0x12,0x37,0x54,0x80,0xc5,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x24,0x12,0x2a,0x8b,0x00,0x00,0x00,
+0x00,0x90,0x00,0x01,0x12,0x42,0x20,0x90,0x9e,0x66,0xf0,0x90,0x00,0x03,0x12,0x42,
+0x20,0x90,0x9e,0x55,0xf0,0x12,0x56,0x22,0x90,0x01,0xe5,0xe5,0x63,0xf0,0x90,0x9e,
+0x66,0xe0,0x90,0x01,0xe6,0xf0,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x00,0x02,0x12,0x42,
+0x20,0xff,0x30,0xe0,0x25,0x12,0x29,0xd9,0x90,0x9e,0x5c,0xf0,0x90,0x00,0x01,0x12,
+0x42,0x20,0x90,0x9e,0x5d,0xf0,0xef,0xc3,0x13,0x54,0x7f,0x90,0x9e,0x5b,0xf0,0x90,
+0x00,0x03,0x12,0x42,0x20,0x90,0x9e,0x62,0xf0,0x22,0x90,0x9e,0x5c,0x74,0x0a,0xf0,
+0x90,0x9e,0x5d,0x74,0x05,0xf0,0x90,0x9e,0x5b,0x74,0x14,0xf0,0x90,0x9e,0x62,0x74,
+0x05,0xf0,0x22,0x12,0x29,0xd9,0x30,0xe0,0x19,0xc3,0x13,0x54,0x7f,0x90,0x9e,0x61,
+0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0x90,0x9e,0x5f,0xe4,0xf0,0xa3,0xef,0xf0,
+0x80,0x0f,0x90,0x9e,0x61,0x74,0x07,0xf0,0x90,0x9e,0x5f,0xe4,0xf0,0xa3,0x74,0x03,
+0xf0,0x90,0x9e,0x5f,0xe0,0xa3,0xe0,0x90,0x05,0x58,0xf0,0x22,0x90,0x9e,0x24,0x12,
+0x2a,0x8b,0x00,0x00,0x00,0x00,0x12,0x29,0xd9,0x60,0x0d,0x90,0x9e,0x5e,0xf0,0xe4,
+0xfd,0x7f,0x04,0x12,0x54,0xe7,0x80,0x05,0xe4,0x90,0x9e,0x5e,0xf0,0x90,0x9e,0x5e,
+0xe0,0x90,0x01,0xe7,0xf0,0x22,0x90,0x02,0x09,0xe0,0xfd,0x12,0x29,0xd9,0xfe,0xaf,
+0x05,0xed,0x2e,0x90,0x9e,0x78,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0xed,0x2f,
+0x90,0x9e,0x79,0xf0,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x9e,0x7a,
+0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x9e,0x7b,0xf0,0x90,0x00,
+0x04,0x12,0x42,0x20,0xff,0xae,0x05,0xed,0x2f,0x90,0x9e,0x7c,0xf0,0x22,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x24,0x12,0x43,0x8b,0x90,0x9e,0x24,0x12,0x43,
+0x6b,0x90,0x00,0x01,0x12,0x42,0xc2,0xfa,0xe5,0xf0,0x24,0x00,0xff,0xe4,0x3a,0xfe,
+0x90,0x9e,0x24,0x12,0x43,0x6b,0x90,0x00,0x01,0xee,0x8f,0xf0,0x12,0x43,0x19,0x12,
+0x29,0xd9,0xff,0x60,0x2d,0xb5,0x65,0x16,0x90,0x9e,0x24,0x12,0x43,0x6b,0x90,0x00,
+0x01,0x12,0x42,0xc2,0x65,0x67,0x70,0x04,0xe5,0x66,0x65,0xf0,0x60,0x24,0x90,0x9e,
+0x24,0x12,0x43,0x6b,0x90,0x00,0x01,0x12,0x42,0xc2,0xff,0xae,0xf0,0x12,0x4e,0x37,
+0x80,0x10,0x90,0x9e,0x24,0x12,0x43,0x6b,0x12,0x29,0xd9,0x65,0x65,0x60,0x03,0x12,
+0x44,0xc2,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x06,0x34,0x74,0xff,0xf0,0xe4,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xf0,0x22,0x90,0x06,0x34,0xe0,0x60,0x24,0x14,0x70,0x1a,0x7b,0x01,
+0x7a,0x06,0x79,0x35,0x7f,0xf9,0x7e,0x01,0x71,0xb0,0xbf,0x01,0x09,0x90,0x06,0x35,
+0xe0,0x54,0x0f,0xf0,0x80,0x04,0x80,0x00,0x80,0xcd,0xe4,0x90,0x06,0x34,0xf0,0x22,
+0x8e,0x14,0x8f,0x15,0x8b,0x16,0x8a,0x17,0x89,0x18,0xe4,0x90,0x9e,0x19,0xf0,0xef,
+0x90,0x00,0x31,0xf0,0x12,0x4d,0x45,0xe5,0x14,0x54,0x03,0xff,0x90,0x00,0x32,0xe0,
+0x54,0xfc,0x4f,0xf0,0x12,0x4d,0x45,0x90,0x00,0x33,0xe0,0x54,0x7f,0xf0,0x12,0x4d,
+0x45,0x90,0x00,0x33,0xe0,0x20,0xe7,0x0e,0x90,0x9e,0x19,0xe0,0xc3,0x94,0x64,0x50,
+0x05,0xe0,0x04,0xf0,0x80,0xeb,0x90,0x9e,0x19,0xe0,0xc3,0x94,0x64,0x50,0x10,0x90,
+0x00,0x30,0xe0,0xab,0x16,0xaa,0x17,0xa9,0x18,0x12,0x42,0x4d,0x7f,0x01,0x22,0x7f,
+0x00,0x22,0xe4,0x90,0x9e,0xac,0xf0,0xa3,0xf0,0x90,0x05,0xf8,0xe0,0x70,0x0f,0xa3,
+0xe0,0x70,0x0b,0xa3,0xe0,0x70,0x07,0xa3,0xe0,0x70,0x03,0x7f,0x01,0x22,0xd3,0x90,
+0x9e,0xad,0xe0,0x94,0xe8,0x90,0x9e,0xac,0xe0,0x94,0x03,0x40,0x03,0x7f,0x00,0x22,
+0x7f,0x32,0x7e,0x00,0x12,0x37,0x54,0x90,0x9e,0xac,0xe4,0x75,0xf0,0x01,0x12,0x42,
+0x81,0x80,0xc6,0x90,0x00,0x11,0xe0,0x44,0x09,0xf0,0x12,0x4d,0x45,0x90,0x9d,0xff,
+0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x78,0x7e,0x08,0x12,0x2f,0xd9,
+0x90,0x9e,0x03,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,
+0x12,0x2f,0xd9,0x90,0x9e,0x07,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x00,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9e,0x0b,0x12,0x43,0x53,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,
+0x03,0x2d,0x95,0xe4,0xfd,0xff,0x12,0x34,0x81,0x90,0x9e,0x80,0xe0,0xb4,0x01,0x11,
+0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,0x03,0x2d,0x95,0xe4,0xfd,0x7f,0x01,0x12,0x34,
+0x81,0x22,0x7f,0x78,0x7e,0x08,0x12,0x27,0xde,0x90,0x9d,0xff,0x12,0x2a,0x7f,0x7f,
+0x04,0x7e,0x0c,0x12,0x27,0xde,0x90,0x9e,0x03,0x12,0x2a,0x7f,0x7f,0x00,0x7e,0x08,
+0x12,0x27,0xde,0x90,0x9e,0x07,0x12,0x2a,0x7f,0x90,0x9e,0x80,0xe0,0x90,0x9d,0xff,
+0xb4,0x01,0x0d,0x12,0x43,0x53,0xef,0x54,0xc7,0xff,0xed,0x54,0xc7,0xfd,0x80,0x07,
+0x12,0x43,0x53,0xef,0x54,0xc7,0xff,0xec,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x78,
+0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9e,0x03,0x12,0x43,0x53,0xef,0x54,0x0f,0xff,0xec,
+0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x9e,0x07,
+0x12,0x43,0x53,0xef,0x44,0x02,0xff,0xec,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x00,
+0x7e,0x08,0x12,0x2f,0xd9,0x7f,0x70,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9e,0x0b,0x12,
+0x2a,0x7f,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa0,0x7f,0x70,0x7e,0x0e,
+0x12,0x2f,0xd9,0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe4,0xfd,0xff,
+0x12,0x34,0x81,0x90,0x9e,0x80,0xe0,0xb4,0x01,0x11,0x90,0x80,0x59,0x12,0x2a,0x8b,
+0x00,0x00,0x00,0x00,0xe4,0xfd,0x7f,0x01,0x12,0x34,0x81,0x90,0x00,0x11,0xe0,0x54,
+0xf6,0xf0,0x02,0x4d,0x45,0xef,0x70,0x02,0xe1,0x5c,0x90,0x9e,0x0f,0xe0,0x60,0x03,
+0x02,0x7b,0x28,0x90,0x9d,0xfb,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x8c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9d,0xa7,0x12,0x43,0x53,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x44,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9d,0xab,0x12,0x43,0x53,0x90,
+0x80,0x85,0x12,0x2a,0x7f,0x7f,0x5c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9d,0xaf,0x12,
+0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x6c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,
+0x9d,0xb3,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,0x12,
+0x2f,0xd9,0x90,0x9d,0xb7,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x74,
+0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xbb,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x78,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xbf,0x12,0x43,0x53,0x90,0x80,
+0x85,0x12,0x2a,0x7f,0x7f,0x7c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xc3,0x12,0x43,
+0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,
+0xc7,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x84,0x7e,0x0e,0x12,0x2f,
+0xd9,0x90,0x9d,0xcb,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x88,0x7e,
+0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xcf,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0x8c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xd3,0x12,0x43,0x53,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0x7f,0xd0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xd7,0x12,0x43,0x53,
+0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xd4,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xdb,
+0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xd8,0x7e,0x0e,0x12,0x2f,0xd9,
+0x90,0x9d,0xdf,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xdc,0x7e,0x0e,
+0x12,0x2f,0xd9,0x90,0x9d,0xe3,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0xe0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xe7,0x12,0x43,0x53,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0xec,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xeb,0x12,0x43,0x53,0x90,
+0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x9d,0xef,0x12,
+0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0d,0x12,0x2f,0xd9,0x90,
+0x9d,0xf3,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,
+0x2f,0xd9,0x90,0x9d,0xf7,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,
+0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9e,0x0f,0x74,0x01,0xf0,0x22,0x90,0x9e,0x0f,0xe0,
+0x64,0x01,0x60,0x03,0x02,0x7b,0x28,0x7f,0x8c,0x7e,0x08,0x12,0x27,0xde,0x90,0x9d,
+0xfb,0x12,0x2a,0x7f,0x7f,0x44,0x7e,0x08,0x12,0x27,0xde,0x90,0x9d,0xa7,0x12,0x2a,
+0x7f,0x7f,0x5c,0x7e,0x08,0x12,0x27,0xde,0x90,0x9d,0xab,0x12,0x2a,0x7f,0x7f,0x6c,
+0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xaf,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,0x12,
+0x27,0xde,0x90,0x9d,0xb3,0x12,0x2a,0x7f,0x7f,0x74,0x7e,0x0e,0x12,0x27,0xde,0x90,
+0x9d,0xb7,0x12,0x2a,0x7f,0x7f,0x78,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xbb,0x12,
+0x2a,0x7f,0x7f,0x7c,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xbf,0x12,0x2a,0x7f,0x7f,
+0x80,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xc3,0x12,0x2a,0x7f,0x7f,0x84,0x7e,0x0e,
+0x12,0x27,0xde,0x90,0x9d,0xc7,0x12,0x2a,0x7f,0x7f,0x88,0x7e,0x0e,0x12,0x27,0xde,
+0x90,0x9d,0xcb,0x12,0x2a,0x7f,0x7f,0x8c,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xcf,
+0x12,0x2a,0x7f,0x7f,0xd0,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xd3,0x12,0x2a,0x7f,
+0x7f,0xd4,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xd7,0x12,0x2a,0x7f,0x7f,0xd8,0x7e,
+0x0e,0x12,0x27,0xde,0x90,0x9d,0xdb,0x12,0x2a,0x7f,0x7f,0xdc,0x7e,0x0e,0x12,0x27,
+0xde,0x90,0x9d,0xdf,0x12,0x2a,0x7f,0x7f,0xe0,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,
+0xe3,0x12,0x2a,0x7f,0x7f,0xec,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xe7,0x12,0x2a,
+0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x27,0xde,0x90,0x9d,0xeb,0x12,0x2a,0x7f,0x7f,0x04,
+0x7e,0x0d,0x12,0x27,0xde,0x90,0x9d,0xef,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,
+0x27,0xde,0x90,0x9d,0xf3,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x08,0x12,0x27,0xde,0x90,
+0x9d,0xf7,0x12,0x2a,0x7f,0x7f,0x8c,0x7e,0x08,0x12,0x27,0xde,0x90,0x9e,0xa8,0x12,
+0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xed,0x44,0xc0,0xfd,0xec,0x90,0x9e,0xa8,
+0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x8c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x01,0x00,0x00,
+0x7f,0x44,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0xdb,0x25,
+0xa4,0x7f,0x5c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,
+0x25,0xa4,0x7f,0x6c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,
+0xdb,0x25,0xa4,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,
+0x04,0x1b,0x25,0xa4,0x7f,0x74,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,
+0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x78,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,
+0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x7c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,
+0x12,0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x80,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,
+0x85,0x12,0x2a,0x8b,0x63,0xdb,0x25,0xa4,0x7f,0x84,0x7e,0x0e,0x12,0x2f,0xd9,0x90,
+0x80,0x85,0x12,0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x88,0x7e,0x0e,0x12,0x2f,0xd9,
+0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0x8c,0x7e,0x0e,0x12,0x2f,
+0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd0,0x7e,0x0e,0x12,
+0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd4,0x7e,0x0e,
+0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd8,0x7e,
+0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa4,0x7f,0xdc,
+0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa4,0x7f,
+0xe0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x24,0xdb,0x25,0xa4,
+0x7f,0xec,0x7e,0x0e,0x12,0x2f,0xd9,0x7f,0x04,0x7e,0x0c,0x12,0x27,0xde,0x90,0x9e,
+0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xe4,0xff,0xec,0x90,0x9e,0xa8,
+0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xef,0x44,0x11,0xff,0xec,0x90,0x9e,
+0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x7f,0x04,0x7e,0x0d,0x12,0x27,0xde,0x90,0x9e,
+0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xef,0x54,0xf0,0xff,0xec,0x90,
+0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xef,0x44,0x01,0xff,0xec,
+0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x04,0x7e,0x0d,0x12,0x2f,0xd9,0x7f,0x0c,0x7e,0x09,0x12,0x27,0xde,
+0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xe4,0xff,0xec,0x90,
+0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xef,0x44,0x11,0xff,0xec,
+0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,0x2f,0xd9,0x7f,0x0c,0x7e,0x09,0x12,0x27,0xde,
+0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xed,0x54,0x0f,0xfd,
+0xec,0x54,0xf0,0xfc,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,
+0xed,0x44,0x10,0xfd,0xec,0x44,0x01,0xfc,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,
+0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,0x2f,
+0xd9,0x7f,0x04,0x7e,0x08,0x12,0x27,0xde,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,
+0xa8,0x12,0x43,0x53,0xef,0x54,0xf0,0xff,0xec,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,
+0x9e,0xa8,0x12,0x43,0x53,0xef,0x44,0x01,0xff,0xec,0x90,0x9e,0xa8,0x12,0x2a,0x7f,
+0x90,0x9e,0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x08,
+0x12,0x2f,0xd9,0xe4,0x90,0x9e,0x0f,0xf0,0x22,0x90,0x00,0x02,0x12,0x42,0x20,0x90,
+0x9e,0x43,0xf0,0xe0,0x60,0x04,0xe0,0xf4,0x70,0x21,0xa2,0xaf,0xe4,0x33,0xf5,0x14,
+0xc2,0xaf,0x90,0x00,0x47,0xe0,0x54,0xfb,0xfd,0x7f,0x47,0x12,0x49,0x05,0x7d,0x40,
+0x7f,0x01,0x12,0x36,0xaf,0xe5,0x14,0x24,0xff,0x92,0xaf,0x22,0x90,0x9e,0x3a,0xe0,
+0xc3,0x94,0x14,0x50,0x05,0xe0,0x04,0xf0,0x81,0x14,0x90,0x9e,0x3a,0xe0,0x64,0x14,
+0x60,0x02,0x81,0x14,0x90,0x9e,0x49,0xe0,0x70,0x25,0x90,0x9e,0x4c,0xe0,0x70,0x1f,
+0x90,0x9e,0x4a,0xe0,0x70,0x19,0x90,0x9e,0x4d,0xe0,0x70,0x13,0x90,0x9e,0x4b,0xe0,
+0x70,0x0d,0x90,0x9e,0x4e,0xe0,0x70,0x07,0x90,0x04,0xfd,0xe0,0x54,0xfe,0xf0,0x90,
+0x9e,0x49,0xe0,0x90,0x04,0x44,0xf0,0x90,0x9e,0x4a,0xe0,0x90,0x04,0x45,0xf0,0x90,
+0x9e,0x4b,0xe0,0x90,0x04,0x46,0xf0,0xa3,0xe4,0xf0,0x90,0x9e,0x4c,0xe0,0x90,0x04,
+0x48,0xf0,0x90,0x9e,0x4d,0xe0,0x90,0x04,0x49,0xf0,0x90,0x9e,0x4e,0xe0,0x90,0x04,
+0x4a,0xf0,0xa3,0xe4,0xf0,0x90,0x9e,0x35,0xe0,0x90,0x04,0x4c,0xf0,0x90,0x9e,0x36,
+0xe0,0x90,0x04,0x4d,0xf0,0x90,0x9e,0x37,0xe0,0x90,0x04,0x4e,0xf0,0x90,0x9e,0x38,
+0xe0,0x90,0x04,0x4f,0xf0,0xe4,0x90,0x9e,0x3a,0xf0,0x90,0x9e,0x35,0x04,0xf0,0xe4,
+0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x9e,0x49,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xf0,0x90,0x05,0x60,0xe0,0x90,0x9e,0x19,0xf0,0x90,0x05,0x61,0xe0,
+0x90,0x9e,0x1a,0xf0,0x90,0x05,0x62,0xe0,0x90,0x9e,0x1b,0xf0,0x90,0x05,0x63,0xe0,
+0x90,0x9e,0x1c,0xf0,0x90,0x9e,0x52,0xe0,0xff,0x90,0x9e,0x1c,0xe0,0xfe,0xd3,0x9f,
+0x50,0x0b,0x90,0x9e,0x52,0xe0,0xc3,0x9e,0xd3,0x94,0x01,0x40,0x11,0x90,0x9e,0x40,
+0xe0,0xb4,0x01,0x02,0x80,0x03,0x90,0x9e,0x44,0xe0,0xff,0x12,0x4c,0xf0,0x22,0x90,
+0x9e,0x53,0xe0,0x64,0x01,0x60,0x08,0x90,0x9e,0x41,0xe0,0x60,0x02,0xa1,0x36,0x90,
+0x9e,0x35,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x3b,0x90,0x9e,0x36,
+0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x28,0x90,0x9e,0x37,0xe0,
+0xc3,0x94,0xff,0x50,0x0a,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x36,0xf0,0x80,0x15,0x90,
+0x9e,0x38,0xe0,0xc3,0x94,0xff,0x50,0x10,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x37,0xf0,
+0x90,0x9e,0x36,0xf0,0x90,0x9e,0x35,0xf0,0x90,0x00,0x44,0xe0,0x54,0x0c,0x60,0x76,
+0xe0,0x30,0xe2,0x32,0x90,0x9e,0x49,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,
+0x80,0x24,0x90,0x9e,0x4a,0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,
+0x11,0x90,0x9e,0x4b,0xe0,0xc3,0x94,0xff,0x50,0x0c,0xe0,0x04,0xf0,0xe4,0x90,0x9e,
+0x4a,0xf0,0x90,0x9e,0x49,0xf0,0x90,0x00,0x44,0xe0,0x30,0xe3,0x32,0x90,0x9e,0x4c,
+0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x24,0x90,0x9e,0x4d,0xe0,0xc3,
+0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x11,0x90,0x9e,0x4e,0xe0,0xc3,0x94,
+0xff,0x50,0x0c,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x4d,0xf0,0x90,0x9e,0x4c,0xf0,0x90,
+0x04,0xfd,0xe0,0x44,0x01,0xf0,0x22,0x00,0x37,0xda,};
+
+// =================== v79 UMC A Cut COMMON 2011-10-06 =====================
+u8 Rtl8192CUFwUMCACutImgArray[UMCACutImgArrayLength] = {
+0xc1,0x88,0x02,0x00,0x4f,0x00,0x00,0x00,0x0a,0x06,0x18,0x09,0x58,0x3f,0x01,0x00,
+0x61,0x80,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x02,0x43,0xba,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x5a,0x45,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x5f,0xfb,0x00,0x00,0x00,0x00,0x00,0xa1,0xdf,0x00,0x00,0x00,
+0x05,0x04,0x03,0x02,0x00,0x03,0x06,0x05,0x04,0x03,0x00,0x04,0x06,0x05,0x04,0x02,
+0x00,0x04,0x08,0x07,0x06,0x04,0x00,0x06,0x0a,0x09,0x08,0x06,0x00,0x08,0x0a,0x09,
+0x08,0x04,0x00,0x08,0x0a,0x09,0x08,0x02,0x00,0x08,0x0a,0x09,0x08,0x00,0x00,0x08,
+0x12,0x11,0x10,0x08,0x00,0x10,0x1a,0x19,0x18,0x10,0x00,0x18,0x22,0x21,0x20,0x18,
+0x00,0x20,0x22,0x21,0x20,0x10,0x00,0x20,0x22,0x21,0x20,0x08,0x00,0x20,0x22,0x21,
+0x1c,0x08,0x00,0x20,0x22,0x21,0x14,0x08,0x00,0x20,0x22,0x20,0x18,0x08,0x00,0x20,
+0x31,0x30,0x20,0x10,0x00,0x30,0x31,0x30,0x18,0x00,0x00,0x30,0x31,0x2f,0x10,0x10,
+0x00,0x30,0x31,0x2c,0x10,0x10,0x00,0x30,0x31,0x28,0x10,0x00,0x00,0x30,0x31,0x20,
+0x10,0x00,0x00,0x30,0x31,0x10,0x10,0x00,0x00,0x30,0x04,0x04,0x04,0x05,0x04,0x04,
+0x04,0x05,0x05,0x05,0x06,0x06,0x04,0x04,0x04,0x05,0x05,0x05,0x06,0x06,0x04,0x04,
+0x05,0x05,0x05,0x05,0x06,0x06,0x04,0x04,0x05,0x05,0x05,0x05,0x06,0x07,0x0a,0x0b,
+0x0d,0x10,0x04,0x05,0x05,0x06,0x06,0x09,0x0c,0x11,0x08,0x08,0x09,0x09,0x0a,0x0c,
+0x10,0x11,0x04,0x04,0x04,0x05,0x04,0x04,0x05,0x07,0x07,0x07,0x08,0x0a,0x04,0x04,
+0x04,0x04,0x06,0x0a,0x0b,0x0d,0x05,0x05,0x07,0x07,0x08,0x0b,0x0d,0x0f,0x04,0x04,
+0x04,0x05,0x07,0x07,0x09,0x09,0x0c,0x0e,0x10,0x12,0x04,0x04,0x05,0x05,0x06,0x0a,
+0x11,0x13,0x09,0x09,0x09,0x09,0x0c,0x0e,0x11,0x13,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x24,0x26,0x2a,0x18,0x1a,0x1d,0x1f,0x21,0x27,0x29,0x2a,0x00,0x00,
+0x00,0x1f,0x23,0x28,0x2a,0x2c,0x00,0x04,0x00,0x04,0x00,0x08,0x00,0x10,0x00,0x18,
+0x00,0x24,0x00,0x30,0x00,0x48,0x00,0x60,0x00,0x90,0x00,0xc0,0x00,0xd8,0x00,0x50,
+0x00,0x78,0x00,0xa0,0x00,0xc8,0x01,0x40,0x01,0x90,0x01,0xe0,0x02,0x30,0x01,0x2c,
+0x01,0x40,0x01,0xe0,0x02,0xd0,0x03,0xe8,0x04,0xb0,0x06,0x40,0x07,0xd0,0x00,0x02,
+0x00,0x02,0x00,0x04,0x00,0x08,0x00,0x0c,0x00,0x12,0x00,0x18,0x00,0x24,0x00,0x30,
+0x00,0x48,0x00,0x60,0x00,0x6c,0x00,0x28,0x00,0x3c,0x00,0x50,0x00,0x64,0x00,0xa0,
+0x00,0xc8,0x00,0xf0,0x01,0x18,0x00,0x64,0x00,0xa0,0x00,0xf0,0x01,0x68,0x01,0xf4,
+0x02,0x58,0x03,0x20,0x03,0xe8,0x02,0x02,0x02,0x02,0x02,0x02,0x03,0x03,0x04,0x04,
+0x05,0x07,0x04,0x04,0x07,0x0a,0x0a,0x0c,0x0c,0x12,0x05,0x07,0x07,0x08,0x0b,0x12,
+0x24,0x3c,0x01,0x01,0x01,0x01,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x01,0x02,
+0x03,0x04,0x05,0x06,0x07,0x08,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x20,0x1e,
+0x1c,0x18,0x10,0x18,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0xbb,0x01,0x0c,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe0,0x22,0x50,
+0x06,0xe9,0x25,0x82,0xf8,0xe6,0x22,0xbb,0xfe,0x06,0xe9,0x25,0x82,0xf8,0xe2,0x22,
+0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe4,0x93,0x22,0xbb,0x01,0x06,
+0x89,0x82,0x8a,0x83,0xf0,0x22,0x50,0x02,0xf7,0x22,0xbb,0xfe,0x01,0xf3,0x22,0xf8,
+0xbb,0x01,0x0d,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0x22,
+0x50,0x06,0xe9,0x25,0x82,0xc8,0xf6,0x22,0xbb,0xfe,0x05,0xe9,0x25,0x82,0xc8,0xf2,
+0x22,0xc5,0xf0,0xf8,0xa3,0xe0,0x28,0xf0,0xc5,0xf0,0xf8,0xe5,0x82,0x15,0x82,0x70,
+0x02,0x15,0x83,0xe0,0x38,0xf0,0x22,0xbb,0x01,0x0a,0x89,0x82,0x8a,0x83,0xe0,0xf5,
+0xf0,0xa3,0xe0,0x22,0x50,0x06,0x87,0xf0,0x09,0xe7,0x19,0x22,0xbb,0xfe,0x07,0xe3,
+0xf5,0xf0,0x09,0xe3,0x19,0x22,0x89,0x82,0x8a,0x83,0xe4,0x93,0xf5,0xf0,0x74,0x01,
+0x93,0x22,0xbb,0x01,0x10,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe0,
+0xf5,0xf0,0xa3,0xe0,0x22,0x50,0x09,0xe9,0x25,0x82,0xf8,0x86,0xf0,0x08,0xe6,0x22,
+0xbb,0xfe,0x0a,0xe9,0x25,0x82,0xf8,0xe2,0xf5,0xf0,0x08,0xe2,0x22,0xe5,0x83,0x2a,
+0xf5,0x83,0xe9,0x93,0xf5,0xf0,0xa3,0xe9,0x93,0x22,0xbb,0x01,0x0a,0x89,0x82,0x8a,
+0x83,0xf0,0xe5,0xf0,0xa3,0xf0,0x22,0x50,0x06,0xf7,0x09,0xa7,0xf0,0x19,0x22,0xbb,
+0xfe,0x06,0xf3,0xe5,0xf0,0x09,0xf3,0x19,0x22,0xf8,0xbb,0x01,0x11,0xe5,0x82,0x29,
+0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0xe5,0xf0,0xa3,0xf0,0x22,0x50,0x09,
+0xe9,0x25,0x82,0xc8,0xf6,0x08,0xa6,0xf0,0x22,0xbb,0xfe,0x09,0xe9,0x25,0x82,0xc8,
+0xf2,0xe5,0xf0,0x08,0xf2,0x22,0xef,0x4b,0xff,0xee,0x4a,0xfe,0xed,0x49,0xfd,0xec,
+0x48,0xfc,0x22,0xe0,0xfc,0xa3,0xe0,0xfd,0xa3,0xe0,0xfe,0xa3,0xe0,0xff,0x22,0xa4,
+0x25,0x82,0xf5,0x82,0xe5,0xf0,0x35,0x83,0xf5,0x83,0x22,0xe0,0xfb,0xa3,0xe0,0xfa,
+0xa3,0xe0,0xf9,0x22,0xf8,0xe0,0xfb,0xa3,0xa3,0xe0,0xf9,0x25,0xf0,0xf0,0xe5,0x82,
+0x15,0x82,0x70,0x02,0x15,0x83,0xe0,0xfa,0x38,0xf0,0x22,0xeb,0xf0,0xa3,0xea,0xf0,
+0xa3,0xe9,0xf0,0x22,0xd0,0x83,0xd0,0x82,0xf8,0xe4,0x93,0x70,0x12,0x74,0x01,0x93,
+0x70,0x0d,0xa3,0xa3,0x93,0xf8,0x74,0x01,0x93,0xf5,0x82,0x88,0x83,0xe4,0x73,0x74,
+0x02,0x93,0x68,0x60,0xef,0xa3,0xa3,0xa3,0x80,0xdf,0x02,0x43,0xf8,0x02,0x50,0xa9,
+0xe4,0x93,0xa3,0xf8,0xe4,0x93,0xa3,0x40,0x03,0xf6,0x80,0x01,0xf2,0x08,0xdf,0xf4,
+0x80,0x29,0xe4,0x93,0xa3,0xf8,0x54,0x07,0x24,0x0c,0xc8,0xc3,0x33,0xc4,0x54,0x0f,
+0x44,0x20,0xc8,0x83,0x40,0x04,0xf4,0x56,0x80,0x01,0x46,0xf6,0xdf,0xe4,0x80,0x0b,
+0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x90,0x44,0x3d,0xe4,0x7e,0x01,0x93,0x60,
+0xbc,0xa3,0xff,0x54,0x3f,0x30,0xe5,0x09,0x54,0x1f,0xfe,0xe4,0x93,0xa3,0x60,0x01,
+0x0e,0xcf,0x54,0xc0,0x25,0xe0,0x60,0xa8,0x40,0xb8,0xe4,0x93,0xa3,0xfa,0xe4,0x93,
+0xa3,0xf8,0xe4,0x93,0xa3,0xc8,0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,0xf0,0xa3,0xc8,
+0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,0xdf,0xe9,0xde,0xe7,0x80,0xbe,0x41,0x9e,0x66,
+0x00,0x41,0x9e,0xae,0x00,0x41,0x9e,0x4d,0x80,0x41,0x9e,0x4e,0x80,0x41,0x9e,0xb0,
+0x00,0x00,0xf0,0x90,0x9e,0x57,0xe0,0x90,0x9e,0x8a,0xf0,0xe4,0xfb,0xfd,0x7f,0x54,
+0x7e,0x01,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x88,0xeb,0xf0,0xa3,0xe0,
+0xfb,0xa3,0xe0,0xf5,0x44,0xe4,0xf5,0x45,0x12,0x30,0x62,0xd0,0xd0,0x92,0xaf,0x22,
+0x90,0x01,0x5f,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x08,0xf0,0xe4,0x90,0x9e,0x89,0xf0,
+0x90,0x9e,0x55,0xe0,0x90,0x9e,0x8a,0xf0,0xe4,0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x91,
+0x62,0x90,0x01,0x5f,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x02,0xf0,0x90,0x9e,0x5c,
+0x14,0xf0,0x90,0x9e,0x5e,0xe0,0x54,0x0f,0xc3,0x94,0x0c,0x50,0x02,0xf1,0x16,0x22,
+0x8f,0x82,0x8e,0x83,0xa3,0xa3,0xa3,0xe4,0xf0,0x22,0xe4,0xf5,0x22,0x7f,0x60,0x7e,
+0x01,0x80,0xed,0x90,0x9e,0x60,0xe0,0xff,0x7d,0x01,0xe1,0x1a,0xb1,0xb1,0xbf,0x01,
+0x0f,0x90,0x9e,0x68,0xe0,0xff,0xe4,0xfd,0xf1,0xfe,0x90,0x04,0x1f,0x74,0x20,0xf0,
+0x22,0x90,0x01,0xca,0xe5,0x25,0xf0,0xef,0x60,0x03,0x12,0x4f,0x2a,0x22,0x22,0x22,
+0x22,0x22,0x00,0x02,0x60,0x8d,0x02,0x60,0x94,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x8b,0x1b,0x8a,0x1c,0x89,0x1d,0x90,0x9e,0x8b,0x71,0x8b,0xab,0x1e,0xaa,0x1f,0xa9,
+0x20,0x90,0x9e,0x8e,0x71,0x8b,0xaf,0x21,0x15,0x21,0xef,0x60,0x1b,0x90,0x9e,0x8e,
+0xe4,0x75,0xf0,0x01,0x71,0x74,0x12,0x24,0x62,0xff,0x90,0x9e,0x8b,0xe4,0x75,0xf0,
+0x01,0x71,0x74,0xef,0x51,0x4d,0x80,0xde,0xab,0x1b,0xaa,0x1c,0xa9,0x1d,0xd0,0xd0,
+0x92,0xaf,0x22,0x90,0x06,0xa9,0xe0,0xf5,0x50,0x54,0xc0,0x70,0x0d,0x90,0x9e,0x63,
+0xe0,0x54,0xfe,0xf0,0xe0,0x54,0xfd,0xf0,0x91,0xd3,0xe5,0x50,0x30,0xe6,0x17,0x90,
+0x9e,0x63,0xe0,0x44,0x01,0xf0,0x90,0x9e,0x61,0xe0,0x64,0x02,0x60,0x04,0x91,0xdc,
+0x80,0x0b,0x91,0x80,0x80,0x07,0x90,0x9e,0x63,0xe0,0x54,0xfe,0xf0,0xe5,0x50,0x90,
+0x9e,0x63,0x30,0xe7,0x17,0xe0,0x44,0x02,0xf0,0xe4,0x90,0x9e,0x89,0x91,0x52,0x90,
+0x01,0x57,0x74,0x05,0xf0,0x90,0x9e,0x62,0x74,0x01,0xf0,0x22,0xe0,0x54,0xfd,0xf0,
+0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x04,0x1d,0xe0,0x60,0x1a,0x90,0x05,
+0x22,0xe0,0x54,0x90,0x60,0x07,0x90,0x01,0xc6,0xe0,0x44,0x40,0xf0,0x90,0x01,0xc7,
+0xe0,0x30,0xe1,0xe4,0x7f,0x00,0x80,0x02,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,0xc0,
+0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,
+0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,0x01,0xc4,0x74,
+0xdf,0xf0,0x74,0x45,0xa3,0xf0,0x53,0x91,0xdf,0x90,0x01,0x3c,0xe0,0x55,0x30,0xf5,
+0x34,0xa3,0xe0,0x55,0x31,0xf5,0x35,0xa3,0xe0,0x55,0x32,0xf5,0x36,0xa3,0xe0,0x55,
+0x33,0xf5,0x37,0xe5,0x34,0x30,0xe0,0x06,0x90,0x01,0x3c,0x74,0x01,0xf0,0xe5,0x34,
+0x30,0xe1,0x08,0x90,0x01,0x3c,0x74,0x02,0xf0,0xf1,0xbc,0xe5,0x34,0x30,0xe2,0x38,
+0x90,0x01,0x3c,0x74,0x04,0xf0,0x90,0x06,0x92,0xe0,0x30,0xe0,0x24,0x90,0x9e,0x89,
+0xe4,0xf0,0x90,0x9e,0x55,0xe0,0x90,0x9e,0x8a,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,
+0x01,0x91,0x62,0x90,0x01,0x5b,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x80,
+0x07,0x90,0x9e,0x5d,0xe4,0xf0,0x91,0xd3,0xe5,0x34,0x30,0xe3,0x38,0x90,0x01,0x3c,
+0x74,0x08,0xf0,0x90,0x06,0x92,0xe0,0x30,0xe1,0x24,0x90,0x9e,0x89,0xe4,0xf0,0x90,
+0x9e,0x55,0xe0,0x90,0x9e,0x8a,0xf0,0xe4,0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x91,0x62,
+0x90,0x01,0x5f,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x02,0xf0,0x80,0x07,0x90,0x9e,
+0x5c,0xe4,0xf0,0x91,0xd3,0xe5,0x34,0x30,0xe4,0x09,0x90,0x01,0x3c,0x74,0x10,0xf0,
+0x12,0x4d,0xe2,0xe5,0x34,0x30,0xe5,0x09,0x90,0x01,0x3c,0x74,0x20,0xf0,0x12,0x4e,
+0x25,0xe5,0x35,0x30,0xe0,0x1a,0x90,0x01,0x3d,0x74,0x01,0xf0,0x90,0x01,0x2f,0xe0,
+0x44,0x7f,0xf0,0x90,0x00,0x83,0xe0,0x90,0x9e,0x60,0xf0,0x12,0x64,0xa1,0x91,0xd3,
+0x74,0xdf,0x04,0x90,0x01,0xc4,0xf0,0x74,0x45,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,
+0x05,0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,
+0x83,0xd0,0xf0,0xd0,0xe0,0x32,0x7d,0x01,0x7f,0x0c,0x8f,0x71,0x8d,0x72,0xe5,0x71,
+0x54,0x0f,0xff,0x90,0x9e,0x5e,0xe0,0x54,0x0f,0x6f,0x60,0x72,0xe5,0x71,0x30,0xe2,
+0x2b,0x90,0x9e,0x5e,0xe0,0x20,0xe2,0x05,0x7f,0x01,0x12,0x63,0x92,0x90,0x9e,0x5e,
+0xe0,0x30,0xe3,0x07,0xe5,0x71,0x20,0xe3,0x02,0x80,0x54,0x90,0x9e,0x5e,0xe0,0x20,
+0xe3,0x4c,0xe5,0x71,0x30,0xe3,0x47,0xaf,0x72,0x02,0x63,0x2e,0x90,0x9e,0x5e,0xe0,
+0x54,0x0f,0xff,0xbf,0x0c,0x0d,0xe5,0x71,0x20,0xe3,0x08,0x12,0x5e,0xf1,0xef,0x60,
+0x2d,0xf1,0x9f,0x90,0x9e,0x5e,0xe0,0x54,0x0f,0xff,0xbf,0x04,0x0e,0xe5,0x71,0x20,
+0xe2,0x09,0x12,0x62,0x50,0xef,0x60,0x16,0x12,0x48,0xaa,0x90,0x9e,0x5e,0xe0,0x54,
+0x0f,0xff,0xbf,0x02,0x09,0x12,0x62,0xbb,0xef,0x60,0x03,0x12,0x64,0x87,0x22,0x90,
+0x06,0x04,0xe0,0x44,0x40,0xf0,0xe5,0x73,0xb4,0x01,0x05,0x7f,0x01,0x12,0x63,0x4d,
+0x90,0x9e,0x5e,0xe0,0x54,0xf0,0xf0,0xe0,0x44,0x04,0xf0,0x22,0x90,0x9e,0x62,0xe0,
+0x60,0x0e,0xe4,0xf0,0xa3,0xe0,0x54,0xfd,0xf0,0xe0,0x54,0x07,0x70,0x2b,0x80,0x27,
+0x90,0x9e,0x51,0xe0,0x04,0xf0,0x90,0x9e,0x63,0xe0,0x54,0xef,0xf0,0x90,0x9e,0x56,
+0xe0,0xff,0x90,0x9e,0x51,0xe0,0xd3,0x9f,0x40,0x0d,0xe5,0x73,0xb4,0x01,0x0a,0xa3,
+0xe0,0x70,0x06,0xe0,0x04,0xf0,0x22,0x91,0xd3,0x22,0xe0,0xff,0x7d,0x01,0x90,0x9e,
+0x9c,0xef,0xf0,0xa3,0xed,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xe5,0x74,0x60,0x04,0xe4,
+0xff,0x11,0x8f,0x90,0x9e,0x9c,0xe0,0x30,0xe0,0x09,0x90,0x9e,0x9e,0xe4,0xf0,0xa3,
+0x74,0x80,0xf0,0x90,0x9e,0x9c,0xe0,0xff,0xc3,0x13,0x90,0xfd,0x10,0xf0,0x90,0x04,
+0x25,0xef,0xf0,0x90,0x9e,0x9d,0xe0,0x60,0x1f,0xa3,0xa3,0xe0,0xff,0x24,0x0f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x80,0xf0,0x74,0x10,0x2f,0xf5,0x82,0xe4,
+0x34,0xfc,0xf5,0x83,0xe0,0x44,0x80,0xf0,0x90,0x9e,0x9e,0xa3,0xe0,0xff,0xfd,0x24,
+0x08,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe4,0xf0,0x74,0x09,0x2d,0xf5,0x82,0xe4,
+0x34,0xfc,0xf5,0x83,0xe0,0x54,0xf0,0xf0,0x74,0x21,0x2f,0xf5,0x82,0xe4,0x34,0xfc,
+0xf5,0x83,0xe0,0x54,0xf7,0xf0,0x90,0x9e,0x9e,0xe0,0xfe,0xa3,0xe0,0xff,0x22,0xef,
+0x60,0x0b,0x90,0x9e,0x77,0xe0,0xb4,0x01,0x10,0xe4,0xff,0x80,0x09,0x90,0x9e,0x77,
+0xe0,0xb4,0x01,0x05,0x7f,0x01,0x12,0x77,0x66,0x22,0x90,0x01,0x37,0x74,0x02,0xf0,
+0x90,0x05,0x22,0x74,0xff,0xf0,0x12,0x77,0x1c,0xef,0x70,0x06,0x90,0x01,0xc8,0x74,
+0xfd,0xf0,0x7d,0x02,0x7f,0x03,0x12,0x31,0x9d,0xe5,0x74,0x60,0x04,0x7f,0x01,0x11,
+0x8f,0x11,0xdf,0x90,0x9e,0x5e,0xe0,0x54,0xf0,0xf0,0xe0,0x44,0x02,0xf0,0x22,0x7f,
+0x78,0x7e,0x08,0x12,0x22,0x65,0x90,0x9d,0xff,0x12,0x25,0x08,0x7f,0x04,0x7e,0x0c,
+0x12,0x22,0x65,0x90,0x9e,0x03,0x12,0x25,0x08,0x7f,0x00,0x7e,0x08,0x12,0x22,0x65,
+0x90,0x9e,0x07,0x12,0x25,0x08,0x90,0x9e,0x77,0xe0,0x90,0x9d,0xff,0xb4,0x01,0x0d,
+0x12,0x43,0x53,0xef,0x54,0xc7,0xff,0xed,0x54,0xc7,0xfd,0x80,0x07,0x12,0x43,0x53,
+0xef,0x54,0xc7,0xff,0xec,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x78,0x7e,0x08,0x12,
+0x2b,0x08,0x90,0x9e,0x03,0x12,0x43,0x53,0xef,0x54,0x0f,0xff,0xec,0x90,0x80,0x96,
+0x12,0x25,0x08,0x7f,0x04,0x7e,0x0c,0x12,0x2b,0x08,0x90,0x9e,0x07,0x12,0x43,0x53,
+0xef,0x44,0x02,0xff,0xec,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x00,0x7e,0x08,0x12,
+0x2b,0x08,0x7f,0x70,0x7e,0x0e,0x12,0x22,0x65,0x90,0x9e,0x0b,0x12,0x25,0x08,0x90,
+0x80,0x96,0x12,0x25,0x14,0x00,0x1b,0x25,0xa0,0x7f,0x70,0x7e,0x0e,0x12,0x2b,0x08,
+0x90,0x80,0x68,0x12,0x25,0x14,0x00,0x00,0x00,0x00,0xe4,0xfd,0xff,0x12,0x30,0x2c,
+0x90,0x9e,0x77,0xe0,0xb4,0x01,0x11,0x90,0x80,0x68,0x12,0x25,0x14,0x00,0x00,0x00,
+0x00,0xe4,0xfd,0x7f,0x01,0x12,0x30,0x2c,0x90,0x00,0x11,0xe0,0x54,0xf6,0xf0,0x80,
+0x08,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x7f,0x10,0xdf,0xfe,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x90,0x9e,0xad,0xed,0xf0,0x90,0x9e,0xac,0xef,0xf0,0xd3,0x94,0x07,0x50,0x63,0xe0,
+0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,
+0x47,0xe0,0x5f,0xf0,0x31,0xb9,0x90,0x9e,0xac,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,
+0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x46,0xe0,0x4f,0xf0,0x31,0xb9,0x90,
+0x9e,0xad,0xe0,0x60,0x16,0x90,0x9e,0xac,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,
+0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x45,0x80,0x66,0x90,0x9e,0xac,0xe0,0xff,
+0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x45,
+0x80,0x6b,0x90,0x9e,0xac,0xe0,0x24,0xf8,0xf0,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,
+0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0x31,0xb1,0x90,0x9e,0xac,0xe0,0xff,
+0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x43,0xe0,
+0x4f,0xf0,0x31,0xb9,0x90,0x9e,0xad,0xe0,0x60,0x1b,0x90,0x9e,0xac,0xe0,0xff,0x74,
+0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xff,0x90,0x00,
+0x42,0xe0,0x4f,0x80,0x1a,0x90,0x9e,0xac,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,
+0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xf4,0xff,0x90,0x00,0x42,0xe0,0x5f,0xf0,
+0x31,0xb9,0xd0,0xd0,0x92,0xaf,0x22,0xf0,0x90,0x00,0x45,0xe0,0x54,0xfe,0xfd,0x7f,
+0x45,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x8f,0x82,0x75,0x83,0x00,0xed,0xf0,0x31,
+0xb9,0xd0,0xd0,0x92,0xaf,0x22,0xef,0x14,0x60,0x30,0x14,0x60,0x66,0x24,0x02,0x60,
+0x02,0x61,0x7d,0x90,0x9e,0x1a,0x74,0x02,0xf0,0x90,0x00,0x48,0xe0,0x44,0x0c,0xfd,
+0x7f,0x48,0x51,0xc1,0x90,0x00,0x47,0xe0,0x44,0x08,0xfd,0x7f,0x47,0x51,0xc1,0x90,
+0x00,0x45,0xe0,0x44,0x10,0xfd,0x7f,0x45,0x80,0x71,0xe4,0x90,0x9e,0x1a,0xf0,0x90,
+0x9e,0x16,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,
+0x2b,0x08,0x90,0x00,0x45,0xe0,0x44,0xef,0xfd,0x7f,0x45,0x51,0xc1,0x90,0x00,0x45,
+0xe0,0x54,0xef,0xfd,0x7f,0x45,0x51,0xc1,0x90,0x00,0x46,0xe0,0x44,0x10,0xfd,0x7f,
+0x46,0x80,0x38,0x90,0x9e,0x1a,0x74,0x01,0xf0,0x90,0x9e,0x20,0x12,0x43,0x53,0x90,
+0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,0x2b,0x08,0x90,0x00,0x45,0xe0,
+0x44,0x20,0xfd,0x7f,0x45,0x51,0xc1,0x90,0x00,0x45,0xe0,0x44,0x10,0xfd,0x7f,0x45,
+0x51,0xc1,0x90,0x00,0x46,0xe0,0x44,0x10,0xfd,0x7f,0x46,0x51,0xc1,0x22,0x90,0x00,
+0x02,0x12,0x42,0x20,0x90,0x9e,0x1c,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0x25,0xe0,
+0x25,0xe0,0x90,0x9e,0x1b,0xf0,0x12,0x24,0x62,0x25,0xe0,0x25,0xe0,0x90,0x9e,0x1f,
+0xf0,0x90,0x05,0x60,0xe0,0x90,0x9e,0x2a,0xf0,0x90,0x05,0x61,0xe0,0x90,0x9e,0x2b,
+0xf0,0x90,0x05,0x62,0xe0,0x90,0x9e,0x2c,0xf0,0x90,0x05,0x63,0xe0,0x90,0x9e,0x2d,
+0xf0,0xa2,0xaf,0xe4,0x33,0x90,0x9e,0x3f,0xf0,0xc2,0xaf,0x90,0x9e,0x1b,0xe0,0xff,
+0xd1,0xd8,0x90,0x9e,0x3f,0xe0,0x24,0xff,0x92,0xaf,0x90,0x9e,0x1c,0xe0,0x70,0x02,
+0x81,0x84,0x90,0x9e,0x1b,0xe0,0x70,0x02,0x81,0x84,0x90,0x9e,0x1f,0xe0,0x70,0x02,
+0x81,0x84,0xa2,0xaf,0xe4,0x33,0x90,0x9e,0x3f,0xf0,0xc2,0xaf,0x90,0x9e,0x2e,0x74,
+0x01,0xf0,0x90,0x9e,0x3f,0xe0,0x24,0xff,0x92,0xaf,0x51,0xb8,0x90,0x00,0x46,0xe0,
+0x44,0x01,0xfd,0x7f,0x46,0x51,0xc1,0x90,0x9e,0x14,0xe0,0x60,0x15,0x90,0x9e,0x20,
+0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,0x2b,0x08,
+0x80,0x06,0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,0x00,0x45,0xe0,0x54,0xef,0xfd,0x7f,
+0x45,0x51,0xc1,0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,0x9e,0x2a,0xe0,0x90,0x05,
+0x84,0xf0,0x90,0x9e,0x2b,0xe0,0x90,0x05,0x85,0xf0,0x90,0x9e,0x2c,0xe0,0x90,0x05,
+0x86,0xf0,0x90,0x9e,0x2d,0xe0,0x90,0x05,0x87,0xf0,0xa2,0xaf,0xe4,0x33,0x90,0x9e,
+0x3f,0xf0,0xc2,0xaf,0x90,0x01,0x3c,0xe0,0x44,0x20,0xf0,0x7d,0x20,0xe4,0xff,0x12,
+0x31,0xb7,0x80,0x2b,0x90,0x9e,0x1c,0xe0,0x70,0x2d,0x90,0x9e,0x2e,0x51,0xb7,0x90,
+0x00,0x46,0xe0,0x54,0xfe,0xfd,0x7f,0x46,0x51,0xc1,0x90,0x05,0x22,0xe4,0xf0,0xa2,
+0xaf,0x33,0x90,0x9e,0x3f,0xf0,0xc2,0xaf,0x7d,0x20,0xe4,0xff,0x12,0x31,0x49,0x90,
+0x9e,0x3f,0xe0,0x24,0xff,0x92,0xaf,0x22,0x8b,0x59,0x8a,0x5a,0x89,0x5b,0x90,0x00,
+0x02,0x12,0x42,0x20,0x90,0x9e,0x1d,0xf0,0xe0,0x30,0xe0,0x4b,0x90,0x9e,0x14,0x74,
+0x01,0xf0,0x7f,0x80,0x7e,0x08,0x12,0x22,0x65,0x90,0x9e,0x16,0x12,0x25,0x08,0xab,
+0x59,0xaa,0x5a,0xa9,0x5b,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0xe4,0xfc,0xfd,0xfe,
+0x78,0x1a,0x12,0x24,0xf5,0xa8,0x04,0xa9,0x05,0xaa,0x06,0xab,0x07,0x90,0x9e,0x16,
+0x12,0x43,0x53,0xec,0x54,0x03,0xfc,0x12,0x43,0x46,0x90,0x9e,0x20,0x12,0x25,0x08,
+0x90,0x05,0x22,0xe4,0xf0,0x80,0x2d,0xe4,0x90,0x9e,0x14,0xf0,0x7f,0x80,0x7e,0x08,
+0x12,0x22,0x65,0xec,0x54,0x03,0xfc,0xec,0x44,0xc0,0xfc,0x90,0x9e,0x16,0x12,0x25,
+0x08,0x90,0x9e,0x16,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,
+0x08,0x12,0x2b,0x08,0x90,0x9e,0x1d,0xe0,0x30,0xe1,0x19,0x7d,0x0c,0x7f,0x47,0x51,
+0xc1,0x90,0x00,0x48,0xe0,0x44,0x0c,0xfd,0x7f,0x48,0x51,0xc1,0x90,0x00,0x46,0xe0,
+0x44,0x10,0x80,0x1c,0x90,0x00,0x47,0xe0,0x54,0xf3,0xfd,0x7f,0x47,0x51,0xc1,0x90,
+0x00,0x48,0xe0,0x54,0xf3,0xfd,0x7f,0x48,0x51,0xc1,0x90,0x00,0x46,0xe0,0x54,0xef,
+0xfd,0x7f,0x46,0x51,0xc1,0xe4,0x90,0x9e,0x1a,0xf0,0x22,0x90,0x01,0x3c,0x74,0xff,
+0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x01,0x34,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xfd,
+0x7f,0x54,0x51,0xc1,0x7d,0xff,0x7f,0x55,0x51,0xc1,0x7d,0xff,0x7f,0x56,0x51,0xc1,
+0x7d,0xff,0x7f,0x57,0x41,0xc1,0x90,0x01,0x30,0xe4,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,
+0xf0,0x90,0x01,0x38,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x50,0x51,0xc1,
+0xe4,0xfd,0x7f,0x51,0x51,0xc1,0xe4,0xfd,0x7f,0x52,0x51,0xc1,0xe4,0xfd,0x7f,0x53,
+0x41,0xc1,0xe5,0x22,0x64,0x01,0x70,0x3c,0xf1,0xbe,0xbf,0x01,0x05,0x7f,0x01,0x12,
+0x44,0xf1,0x90,0x00,0x46,0xe0,0x44,0x04,0xfd,0x7f,0x46,0x51,0xc1,0x90,0x00,0x44,
+0xe0,0x54,0xfb,0xfd,0x7f,0x44,0x51,0xc1,0x90,0x00,0x46,0xe0,0x54,0xfb,0xfd,0x7f,
+0x46,0x51,0xc1,0x7f,0x02,0xf1,0xea,0x8f,0x26,0x90,0x01,0xc9,0xe5,0x26,0xf0,0xb4,
+0x01,0x02,0xf1,0x2a,0x22,0x90,0x9e,0x1c,0xe0,0x64,0x01,0x60,0x02,0xc1,0xd7,0x90,
+0x00,0x46,0xe0,0x44,0x01,0xfd,0x7f,0x46,0x51,0xc1,0x90,0x9e,0x2e,0xe0,0x70,0x31,
+0x90,0x9e,0x14,0xe0,0x60,0x15,0x90,0x9e,0x20,0x12,0x43,0x53,0x90,0x80,0x96,0x12,
+0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,0x2b,0x08,0x80,0x06,0x90,0x05,0x22,0x74,0x7f,
+0xf0,0x90,0x9e,0x1b,0xe0,0xff,0xd1,0xd8,0x90,0x9e,0x2e,0x74,0x01,0x51,0xb7,0x80,
+0x3f,0x90,0x9e,0x2e,0xe0,0x64,0x01,0x70,0x37,0x90,0x9e,0x1f,0xe0,0xff,0xd1,0xd8,
+0xe4,0x90,0x9e,0x2e,0xf0,0x90,0x00,0x45,0xe0,0x44,0x01,0xfd,0x7f,0x45,0x51,0xc1,
+0x90,0x9e,0x14,0xe0,0x60,0x15,0x90,0x9e,0x16,0x12,0x43,0x53,0x90,0x80,0x96,0x12,
+0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,0x2b,0x08,0x80,0x05,0x90,0x05,0x22,0xe4,0xf0,
+0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,0x9e,0x2a,0xe0,0x90,0x05,0x84,0xf0,0x90,
+0x9e,0x2b,0xe0,0x90,0x05,0x85,0xf0,0x90,0x9e,0x2c,0xe0,0x90,0x05,0x86,0xf0,0x90,
+0x9e,0x2d,0xe0,0x90,0x05,0x87,0xf0,0x22,0x90,0x05,0x60,0xe0,0x90,0x9e,0x2a,0xf0,
+0x90,0x05,0x61,0xe0,0x90,0x9e,0x2b,0xf0,0x90,0x05,0x62,0xe0,0x90,0x9e,0x2c,0xf0,
+0x90,0x05,0x63,0xe0,0x90,0x9e,0x2d,0xf0,0xc3,0x74,0xff,0x9f,0xfe,0x90,0x9e,0x2b,
+0xe0,0xd3,0x9e,0x40,0x1e,0xe0,0x2f,0xf0,0xa3,0xe0,0xb4,0xff,0x0f,0xe4,0xf0,0xa3,
+0xe0,0xb4,0xff,0x03,0xe4,0xf0,0x22,0x90,0x9e,0x2d,0x80,0x03,0x90,0x9e,0x2c,0xe0,
+0x04,0xf0,0x22,0x90,0x9e,0x2b,0xe0,0x2f,0xf0,0x22,0x90,0x00,0x49,0xe0,0x90,0x9e,
+0xb1,0xf0,0xe0,0x54,0x0f,0xf0,0x44,0xf0,0xfd,0x7f,0x49,0x51,0xc1,0x90,0x9e,0xb1,
+0xe0,0x44,0xb0,0xfd,0x7f,0x49,0x41,0xc1,0x8e,0x59,0x8f,0x5a,0x8b,0x5b,0x8a,0x5c,
+0x89,0x5d,0xe4,0x90,0x9e,0x34,0xf0,0xef,0x90,0x00,0x31,0xf0,0x31,0xb9,0xe5,0x59,
+0x54,0x03,0xff,0x90,0x00,0x32,0xe0,0x54,0xfc,0x4f,0xf0,0x31,0xb9,0x90,0x00,0x33,
+0xe0,0x54,0x7f,0xf0,0x31,0xb9,0x90,0x00,0x33,0xe0,0x20,0xe7,0x0e,0x90,0x9e,0x34,
+0xe0,0xc3,0x94,0x64,0x50,0x05,0xe0,0x04,0xf0,0x80,0xeb,0x90,0x9e,0x34,0xe0,0xc3,
+0x94,0x64,0x50,0x10,0x90,0x00,0x30,0xe0,0xab,0x5b,0xaa,0x5c,0xa9,0x5d,0x12,0x42,
+0x4d,0x7f,0x01,0x22,0x7f,0x00,0x22,0x12,0x45,0xb1,0xbf,0x01,0x10,0x90,0x02,0x09,
+0xe0,0xff,0x7d,0x01,0x12,0x47,0xfe,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0x7f,0x0b,
+0xf1,0xea,0xef,0x65,0x25,0x60,0x10,0xe5,0x25,0xb4,0x01,0x05,0xe4,0xf5,0x25,0x80,
+0x03,0x75,0x25,0x01,0x7f,0x01,0x22,0x7f,0x00,0x22,0xe4,0x90,0x9e,0x74,0xf0,0x90,
+0x00,0x80,0xe0,0x44,0x80,0xfd,0x7f,0x80,0x41,0xc1,0xd3,0x10,0xaf,0x01,0xc3,0xc0,
+0xd0,0x90,0x9e,0xb2,0xef,0xf0,0xd3,0x94,0x07,0x50,0x47,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x46,0xe0,0x5f,0xf0,
+0x12,0x49,0xb9,0x90,0x9e,0xb2,0xe0,0xfd,0x74,0x01,0x7e,0x00,0xa8,0x05,0x08,0x80,
+0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,0x44,0xe0,0xfb,0xe4,0xfe,
+0xef,0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,0xce,0x13,0xd8,0xf8,0xff,
+0x80,0x44,0x90,0x9e,0xb2,0xe0,0x24,0xf8,0xf0,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,
+0x80,0x02,0xc3,0x33,0xd8,0xfc,0x12,0x49,0xb1,0x90,0x9e,0xb2,0xe0,0xfd,0x74,0x01,
+0x7e,0x00,0xa8,0x05,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,
+0x00,0x42,0xe0,0xfb,0xe4,0xfe,0xef,0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,
+0x13,0xce,0x13,0xd8,0xf8,0xff,0xd0,0xd0,0x92,0xaf,0x22,0x75,0x28,0x33,0xe4,0xf5,
+0x29,0x75,0x2a,0x03,0xf5,0x2b,0x90,0x01,0x30,0xe5,0x28,0xf0,0xa3,0xe5,0x29,0xf0,
+0xa3,0xe5,0x2a,0xf0,0xa3,0xe5,0x2b,0xf0,0x22,0xe4,0x90,0x9e,0x31,0xf0,0xa3,0xf0,
+0x75,0x8e,0x02,0x12,0x4f,0xda,0x12,0x5f,0xa9,0x12,0x5f,0xbc,0xe4,0xf5,0x12,0x12,
+0x6f,0xa1,0x12,0x77,0x5d,0x12,0x60,0x9b,0x12,0x2e,0x01,0x12,0x77,0x18,0x11,0x8b,
+0x90,0x00,0xf3,0xe0,0x30,0xe2,0x0d,0x90,0x05,0x41,0x74,0x10,0xf0,0x90,0x05,0x5a,
+0xf0,0xa3,0xe4,0xf0,0x12,0x5f,0xf4,0x12,0x5f,0x91,0x12,0x44,0xfe,0x12,0x7d,0x1d,
+0x90,0x9e,0x33,0xe5,0xd9,0xf0,0x12,0x4d,0x8b,0xc2,0xaf,0x90,0x00,0x80,0xe0,0x44,
+0x40,0xf0,0x12,0x49,0xb9,0x75,0xe8,0x03,0x43,0xa8,0x85,0xd2,0xaf,0x90,0x01,0xbe,
+0xe0,0x04,0xf0,0x90,0x01,0xc0,0xe0,0x04,0xf0,0x90,0x9e,0x31,0xe0,0x64,0x01,0xf0,
+0x24,0xa9,0x90,0x01,0xc4,0xf0,0x74,0x50,0xa3,0xf0,0xe5,0x12,0x30,0xe4,0x09,0xc2,
+0xaf,0x53,0x12,0xef,0xd2,0xaf,0x31,0x8e,0xe5,0x12,0x30,0xe6,0x17,0xc2,0xaf,0x53,
+0x12,0xbf,0xd2,0xaf,0x12,0x69,0x51,0x90,0x9e,0x1e,0xe0,0xff,0x60,0x03,0xb4,0x01,
+0x03,0x12,0x7d,0x7b,0x90,0x9e,0x1e,0xe0,0x70,0x03,0x12,0x7e,0x7e,0x31,0x61,0x80,
+0xb8,0x90,0x06,0x34,0xe0,0x60,0x26,0x14,0x70,0x1b,0x7b,0x01,0x7a,0x06,0x79,0x35,
+0x7f,0xf9,0x7e,0x01,0x12,0x4f,0x48,0xbf,0x01,0x09,0x90,0x06,0x35,0xe0,0x54,0x0f,
+0xf0,0x80,0x05,0x80,0x00,0x02,0x77,0x0a,0xe4,0x90,0x06,0x34,0xf0,0x22,0x90,0x01,
+0xcc,0xe0,0x54,0x0f,0x90,0x9e,0x34,0xf0,0x90,0x9e,0x34,0xe0,0xfd,0x70,0x02,0x41,
+0xcf,0x90,0x9e,0xae,0xe0,0xff,0x74,0x01,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,
+0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xef,0x5d,0x70,0x02,0x41,0xc8,0x90,0x9e,0xae,
+0xe0,0x75,0xf0,0x04,0x90,0x01,0xd0,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x35,0xf0,0x75,
+0x1e,0x01,0x75,0x1f,0x9e,0x75,0x20,0x35,0x75,0x21,0x01,0x7b,0x01,0x7a,0x9e,0x79,
+0x36,0x12,0x45,0x09,0x90,0x9e,0x36,0xe0,0xff,0xc4,0x13,0x13,0x13,0x54,0x01,0x90,
+0x9e,0xae,0x30,0xe0,0x59,0xe0,0x75,0xf0,0x02,0x90,0x00,0x88,0x12,0x43,0x5f,0xe0,
+0x90,0x9e,0x37,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,0x02,0x90,0x00,0x89,0x12,0x43,
+0x5f,0xe0,0x90,0x9e,0x38,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd1,
+0x12,0x43,0x5f,0xe0,0x90,0x9e,0x39,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,
+0x01,0xd2,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x3a,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,
+0x04,0x90,0x01,0xd3,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x3b,0xf0,0x80,0x33,0xe0,0x75,
+0xf0,0x04,0x90,0x01,0xd1,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x37,0xf0,0x90,0x9e,0xae,
+0xe0,0x75,0xf0,0x04,0x90,0x01,0xd2,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x38,0xf0,0x90,
+0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd3,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x39,
+0xf0,0xef,0x54,0x7f,0xff,0x7b,0x01,0x7a,0x9e,0x79,0x37,0x51,0xd0,0x90,0x9e,0x34,
+0xe0,0xff,0x90,0x9e,0xae,0xe0,0xfe,0x74,0x01,0xa8,0x06,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xf4,0x5f,0x90,0x9e,0x34,0xf0,0x90,0x9e,0xae,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0x90,0x01,0xcc,0xf0,0x90,0x9e,0xae,0xe0,
+0x04,0xf0,0xe0,0x54,0x03,0xf0,0x21,0x98,0x90,0x01,0xc6,0xe0,0x44,0x02,0xf0,0x22,
+0x90,0x9e,0x3c,0x12,0x43,0x8b,0xef,0x12,0x43,0x94,0x53,0x0b,0x01,0x53,0x14,0x02,
+0x53,0x2f,0x03,0x53,0x38,0x05,0x53,0x41,0x06,0x53,0x8f,0x07,0x53,0x49,0x09,0x53,
+0x52,0x0c,0x53,0x5b,0x0d,0x53,0x64,0x0e,0x53,0x6d,0x1b,0x53,0x76,0x1c,0x53,0x7f,
+0x2c,0x53,0x1d,0x2d,0x53,0x26,0x2e,0x00,0x00,0x53,0x88,0x90,0x9e,0x3c,0x12,0x43,
+0x6b,0x02,0x61,0x9d,0x90,0x9e,0x3c,0x12,0x43,0x6b,0x02,0x71,0xc4,0x90,0x9e,0x3c,
+0x12,0x43,0x6b,0x02,0x71,0xca,0x90,0x9e,0x3c,0x12,0x43,0x6b,0x02,0x72,0x12,0x90,
+0x9e,0x3c,0x12,0x43,0x6b,0x02,0x72,0x40,0x90,0x9e,0x3c,0x12,0x43,0x6b,0x02,0x71,
+0x74,0x90,0x9e,0x3c,0x12,0x43,0x6b,0x80,0x47,0x90,0x9e,0x3c,0x12,0x43,0x6b,0x02,
+0x72,0x88,0x90,0x9e,0x3c,0x12,0x43,0x6b,0x02,0x4b,0x7e,0x90,0x9e,0x3c,0x12,0x43,
+0x6b,0x02,0x7c,0xea,0x90,0x9e,0x3c,0x12,0x43,0x6b,0x02,0x4c,0xb8,0x90,0x9e,0x3c,
+0x12,0x43,0x6b,0x02,0x71,0xbc,0x90,0x9e,0x3c,0x12,0x43,0x6b,0x02,0x71,0xa3,0x90,
+0x9e,0x3c,0x12,0x43,0x6b,0x02,0x75,0xea,0x90,0x01,0xc6,0xe0,0x44,0x01,0xf0,0x22,
+0x90,0x00,0x04,0x12,0x42,0x20,0xff,0x54,0x1f,0xfe,0xef,0x54,0x20,0xc4,0x13,0x54,
+0x07,0xfd,0xaf,0x06,0x90,0x9e,0x3f,0xef,0xf0,0xa3,0xed,0xf0,0xa3,0x12,0x43,0x8b,
+0x90,0x9e,0x41,0x12,0x43,0x6b,0x90,0x00,0x03,0x12,0x42,0x20,0x54,0xf0,0xc4,0x54,
+0x0f,0x90,0x9e,0x44,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0x54,0x40,0xc4,0x13,0x13,
+0x54,0x03,0x90,0x9e,0x45,0xf0,0x90,0x9e,0x3f,0xe0,0xff,0x75,0xf0,0x09,0x90,0x96,
+0x46,0x12,0x43,0x5f,0xad,0x82,0xac,0x83,0x90,0x9e,0x46,0xec,0xf0,0xa3,0xed,0xf0,
+0xef,0x75,0xf0,0x09,0xa4,0x24,0x44,0xf9,0x74,0x96,0x35,0xf0,0xfa,0x7b,0x01,0xa3,
+0x12,0x43,0x8b,0x90,0x9e,0x41,0x12,0x43,0x6b,0x90,0x00,0x03,0x12,0x42,0x20,0x54,
+0x0f,0xff,0x90,0x9e,0x48,0x12,0x43,0x6b,0xef,0x12,0x42,0x4d,0x90,0x9e,0x41,0x12,
+0x43,0x6b,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0x90,0x9e,0x48,0x12,0x43,0x6b,0x90,
+0x00,0x01,0xef,0x12,0x42,0x5f,0x90,0x9e,0x41,0x12,0x43,0x6b,0x90,0x00,0x01,0x12,
+0x42,0x20,0xff,0x90,0x9e,0x46,0xe0,0xfc,0xa3,0xe0,0xfd,0xf5,0x82,0x8c,0x83,0xef,
+0xf0,0x12,0x24,0x62,0x8d,0x82,0x8c,0x83,0xa3,0xf0,0x90,0x9e,0x44,0xe0,0xfe,0x90,
+0x9e,0x3f,0xe0,0xff,0x24,0x82,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,0x90,
+0x9e,0x40,0xe0,0xfe,0x75,0xf0,0x09,0xef,0x90,0x96,0x4a,0x12,0x43,0x5f,0xee,0xf0,
+0x75,0xf0,0x09,0xef,0x90,0x96,0x4b,0x12,0x43,0x5f,0x74,0x01,0xf0,0x90,0x9e,0x45,
+0xe0,0xfe,0x75,0xf0,0x09,0xef,0x90,0x96,0x4c,0x12,0x43,0x5f,0xee,0xf0,0x8f,0x59,
+0xef,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xaf,0x82,0xf5,0x5b,0x8f,0x5c,
+0xe5,0x59,0x75,0xf0,0x02,0xa4,0x24,0x02,0xf9,0x74,0x95,0x35,0xf0,0x75,0x5d,0x01,
+0xf5,0x5e,0x89,0x5f,0x75,0xf0,0x09,0xe5,0x59,0x90,0x96,0x46,0x12,0x43,0x5f,0xaf,
+0x82,0x85,0x83,0x60,0x8f,0x61,0xe5,0x59,0x75,0xf0,0x09,0xa4,0x24,0x44,0xf9,0x74,
+0x96,0x35,0xf0,0x75,0x62,0x01,0xf5,0x63,0x89,0x64,0x74,0x82,0x25,0x59,0xf5,0x82,
+0xe4,0x34,0x95,0xf5,0x83,0xe0,0x12,0x43,0x94,0x55,0x1e,0x00,0x55,0x33,0x01,0x55,
+0x48,0x02,0x55,0x5d,0x03,0x55,0x86,0x04,0x55,0x9b,0x05,0x55,0xb0,0x06,0x55,0xd6,
+0x0c,0x56,0x03,0x0d,0x56,0x30,0x0e,0x56,0x5d,0x0f,0x00,0x00,0x56,0x91,0xe5,0x59,
+0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0xf0,0xf0,0xa3,0x74,
+0x15,0x80,0x3c,0xe5,0x59,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,
+0x74,0xf0,0xf0,0xa3,0x74,0x10,0x80,0x27,0xe5,0x59,0x25,0xe0,0x24,0xc6,0xf5,0x82,
+0xe4,0x34,0x9b,0xf5,0x83,0x74,0xf0,0xf0,0xa3,0x74,0x05,0x80,0x12,0xe5,0x59,0x25,
+0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0xf0,0xf0,0xa3,0xe4,0xf0,
+0xe5,0x59,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0x74,0x0f,0xf0,
+0xa3,0x74,0x8f,0xf0,0xc1,0x91,0xe5,0x59,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,
+0x9b,0xf5,0x83,0x74,0x0f,0xf0,0xa3,0x74,0xf5,0x80,0x27,0xe5,0x59,0x25,0xe0,0x24,
+0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0x0f,0xf0,0xa3,0x74,0xf0,0x80,0x12,
+0xe5,0x59,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,0xa3,
+0x74,0x0d,0xf0,0xe5,0x59,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,
+0xe4,0xf0,0xa3,0xf0,0xc1,0x91,0x90,0x04,0x47,0xe0,0xab,0x5d,0xaa,0x5e,0xa9,0x5f,
+0x12,0x42,0x4d,0x90,0x04,0x46,0xe0,0xab,0x5d,0xaa,0x5e,0xa9,0x5f,0x90,0x00,0x01,
+0x12,0x42,0x5f,0x90,0x04,0x45,0xe0,0x85,0x5c,0x82,0x85,0x5b,0x83,0xf0,0x90,0x04,
+0x44,0xc1,0x88,0x90,0x04,0x4b,0xe0,0xab,0x5d,0xaa,0x5e,0xa9,0x5f,0x12,0x42,0x4d,
+0x90,0x04,0x4a,0xe0,0xab,0x5d,0xaa,0x5e,0xa9,0x5f,0x90,0x00,0x01,0x12,0x42,0x5f,
+0x90,0x04,0x49,0xe0,0x85,0x5c,0x82,0x85,0x5b,0x83,0xf0,0x90,0x04,0x48,0x80,0x58,
+0x90,0x04,0x4f,0xe0,0xab,0x5d,0xaa,0x5e,0xa9,0x5f,0x12,0x42,0x4d,0x90,0x04,0x4e,
+0xe0,0xab,0x5d,0xaa,0x5e,0xa9,0x5f,0x90,0x00,0x01,0x12,0x42,0x5f,0x90,0x04,0x4d,
+0xe0,0x85,0x5c,0x82,0x85,0x5b,0x83,0xf0,0x90,0x04,0x4c,0x80,0x2b,0x90,0x04,0x53,
+0xe0,0xab,0x5d,0xaa,0x5e,0xa9,0x5f,0x12,0x42,0x4d,0x90,0x04,0x52,0xe0,0xab,0x5d,
+0xaa,0x5e,0xa9,0x5f,0x90,0x00,0x01,0x12,0x42,0x5f,0x90,0x04,0x51,0xe0,0x85,0x5c,
+0x82,0x85,0x5b,0x83,0xf0,0x90,0x04,0x50,0xe0,0x85,0x5c,0x82,0x85,0x5b,0x83,0xa3,
+0xf0,0xab,0x5d,0xaa,0x5e,0xa9,0x5f,0xc0,0x03,0xc0,0x02,0xc0,0x01,0x12,0x24,0x62,
+0xff,0xab,0x62,0xaa,0x63,0xa9,0x64,0x12,0x24,0x62,0x5f,0xd0,0x01,0xd0,0x02,0xd0,
+0x03,0x12,0x42,0x4d,0xab,0x5d,0xe5,0x5f,0x24,0x01,0xf9,0xe4,0x35,0x5e,0xfa,0xc0,
+0x03,0xc0,0x02,0xc0,0x01,0x12,0x24,0x62,0xff,0xab,0x62,0xaa,0x63,0xa9,0x64,0x90,
+0x00,0x01,0x12,0x42,0x20,0x5f,0xd0,0x01,0xd0,0x02,0xd0,0x03,0x12,0x42,0x4d,0x85,
+0x5c,0x82,0x85,0x5b,0x83,0xc0,0x83,0xc0,0x82,0xe0,0xff,0x85,0x61,0x82,0x85,0x60,
+0x83,0xe0,0xfe,0xef,0x5e,0xd0,0x82,0xd0,0x83,0xf0,0x85,0x5c,0x82,0x85,0x5b,0x83,
+0xa3,0xc0,0x83,0xc0,0x82,0xe0,0xff,0x85,0x61,0x82,0x85,0x60,0x83,0xa3,0xe0,0xfe,
+0xef,0x5e,0xd0,0x82,0xd0,0x83,0xf0,0xe5,0x59,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,
+0x34,0x95,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x3b,0x75,0x5a,0x0b,0x74,0x01,
+0x7e,0x00,0xa8,0x5a,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xe5,
+0x59,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0x5e,0xfe,0xa3,
+0xe0,0x5f,0x4e,0x60,0x06,0xe5,0x5a,0x24,0x10,0x80,0x5d,0x15,0x5a,0xe5,0x5a,0xc3,
+0x94,0x00,0x50,0xca,0x80,0x56,0xe5,0x59,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,
+0x9b,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x3d,0x75,0x5a,0x0f,0x74,0x01,0x7e,
+0x00,0xa8,0x5a,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xe5,0x59,
+0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0x5e,0xfe,0xa3,0xe0,
+0x5f,0x4e,0x60,0x08,0x90,0x9e,0x4b,0xe5,0x5a,0xf0,0x80,0x10,0x15,0x5a,0xe5,0x5a,
+0xc3,0x94,0x00,0x50,0xc8,0x80,0x05,0xe4,0x90,0x9e,0x4b,0xf0,0xe5,0x59,0x25,0xe0,
+0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x3b,
+0xe4,0xf5,0x5a,0x74,0x01,0x7e,0x00,0xa8,0x5a,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,
+0xce,0xd8,0xf9,0xff,0xe5,0x59,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,
+0x83,0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x08,0x90,0x9e,0x4c,0xe5,0x5a,0xf0,
+0x80,0x5b,0x05,0x5a,0xe5,0x5a,0xb4,0x10,0xca,0x80,0x52,0xe5,0x59,0x25,0xe0,0x24,
+0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x39,0xe4,
+0xf5,0x5a,0x74,0x01,0x7e,0x00,0xa8,0x5a,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,
+0xd8,0xf9,0xff,0xe5,0x59,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,
+0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x06,0xe5,0x5a,0x24,0x10,0x80,0x0a,0x05,
+0x5a,0xe5,0x5a,0xb4,0x0c,0xcc,0x80,0x05,0xe4,0x90,0x9e,0x4c,0xf0,0x90,0x9e,0x4b,
+0xe0,0xff,0x75,0xf0,0x09,0xe5,0x59,0x90,0x96,0x48,0x12,0x43,0x5f,0xef,0xf0,0x90,
+0x9e,0x4c,0xe0,0xfe,0x75,0xf0,0x09,0xe5,0x59,0x90,0x96,0x49,0x12,0x43,0x5f,0xee,
+0xf0,0x74,0x84,0x25,0x59,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0xd3,0x9f,0x40,
+0x05,0x90,0x9e,0x4b,0x11,0xe0,0x74,0x84,0x25,0x59,0xf5,0x82,0xe4,0x34,0x04,0xf5,
+0x83,0xe0,0xff,0x90,0x9e,0x4c,0xe0,0xfe,0xef,0xc3,0x9e,0x50,0x02,0x11,0xe0,0x90,
+0x9e,0x4b,0xe0,0xff,0xd3,0x94,0x13,0x40,0x07,0x90,0x96,0x43,0x74,0x03,0xf0,0x22,
+0xef,0xd3,0x94,0x0b,0x40,0x07,0x90,0x96,0x43,0x74,0x02,0xf0,0x22,0xef,0xd3,0x94,
+0x03,0x40,0x07,0x90,0x96,0x43,0x74,0x01,0xf0,0x22,0xe4,0x90,0x96,0x43,0xf0,0x22,
+0xe0,0xfd,0x74,0x26,0x25,0x59,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xed,0xf0,0xaf,
+0x59,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0xef,0xc3,0x94,0x20,0x50,0x0e,0x74,0x84,
+0x2f,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xed,0xf0,0x80,0x29,0x74,0xa6,0x2f,0xf5,
+0x82,0xe4,0x34,0x9c,0xf5,0x83,0xed,0xf0,0x90,0x9e,0x78,0xef,0xf0,0x24,0xa6,0xf5,
+0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x90,0x9e,0x79,0xf0,0x7b,0x01,0x7a,0x9e,0x79,
+0x78,0x7d,0x02,0x31,0x3a,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,
+0xd0,0x90,0x9e,0x97,0x12,0x43,0x8b,0x90,0x9e,0x9a,0xe0,0x54,0xf0,0x44,0x06,0xff,
+0xf0,0xed,0x54,0x0f,0xc4,0x54,0xf0,0xfe,0xef,0x54,0x0f,0x4e,0xf0,0x90,0x9e,0x97,
+0x12,0x43,0x6b,0x90,0x9e,0x94,0x12,0x43,0x8b,0x7b,0x01,0x7a,0x9e,0x79,0x9a,0xd1,
+0x14,0xd0,0xd0,0x92,0xaf,0x22,0x8f,0x50,0x8d,0x51,0xe5,0x51,0x54,0x1f,0xf5,0x56,
+0x74,0x01,0x2f,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xe0,0xf5,0x54,0x90,0x04,0xfd,
+0xe0,0xb4,0x01,0x05,0x75,0x57,0x03,0x80,0x03,0x75,0x57,0x01,0xeb,0xc3,0x95,0x57,
+0x40,0x04,0xaf,0x50,0x80,0x33,0xe5,0x54,0x25,0x53,0xf5,0x55,0xe5,0x56,0x90,0x41,
+0xd6,0x93,0xff,0xe5,0x55,0xd3,0x9f,0x74,0x01,0x40,0x11,0x25,0x50,0xf5,0x82,0xe4,
+0x34,0x94,0xf5,0x83,0xe4,0xf0,0xad,0x51,0xaf,0x50,0x01,0xf1,0x25,0x50,0xf5,0x82,
+0xe4,0x34,0x94,0xf5,0x83,0xe5,0x55,0xf0,0x22,0xad,0x07,0x75,0xf0,0x09,0xed,0x90,
+0x96,0x48,0x12,0x43,0x5f,0xe0,0xff,0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,
+0x83,0xe0,0x54,0x1f,0xf5,0x58,0xd3,0x9f,0x40,0x02,0x8f,0x58,0xe5,0x58,0x25,0xe0,
+0x24,0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,
+0xe5,0x58,0x25,0xe0,0x24,0x66,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0x74,0x01,0x93,
+0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,0xef,0x13,0xff,0xed,0x25,0xe0,0x24,0xc2,
+0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,0xa3,0xef,0xf0,0xaf,0x05,0xad,0x58,
+0x11,0xf1,0xaf,0x58,0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,0x75,
+0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,0x06,
+0xc0,0x07,0x90,0x01,0xc4,0x74,0x45,0xf0,0x74,0x5a,0xa3,0xf0,0x90,0x01,0x34,0xe0,
+0x55,0x28,0xf5,0x2c,0x90,0x01,0x36,0xe0,0x55,0x2a,0xf5,0x2e,0xa3,0xe0,0x55,0x2b,
+0xf5,0x2f,0xe5,0x2c,0x20,0xe0,0x02,0x61,0xe1,0x90,0x01,0x34,0x74,0x01,0xf0,0x85,
+0xd1,0x08,0x85,0xd2,0x09,0x85,0xd3,0x0a,0x85,0xd4,0x0b,0x85,0xd5,0x0c,0x85,0xd6,
+0x0d,0x85,0xd7,0x0e,0x85,0xd9,0x0f,0xe5,0x0f,0x54,0x40,0xc3,0x13,0xff,0xe5,0x0e,
+0x54,0x20,0x6f,0x70,0x02,0x61,0x93,0xe5,0x0f,0x30,0xe5,0x02,0x61,0x93,0xe5,0x0d,
+0x54,0x3f,0xf5,0x4d,0xe5,0x08,0x54,0x3f,0xf5,0x4e,0xe5,0x0c,0x54,0x1f,0xff,0xe5,
+0x4d,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0x8f,0xf0,0x12,
+0x42,0x81,0xe5,0x0e,0x54,0x1f,0xff,0xe5,0x4d,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,
+0x34,0x93,0xf5,0x83,0xe4,0x8f,0xf0,0x12,0x42,0x81,0xe5,0x4e,0xd3,0x94,0x04,0x40,
+0x03,0x75,0x4e,0x04,0x75,0xf0,0x0a,0xe5,0x4d,0x90,0x90,0x00,0x12,0x43,0x5f,0x75,
+0xf0,0x02,0xe5,0x4e,0x12,0x43,0x5f,0xe0,0xfe,0xa3,0xe0,0xff,0xe5,0x0e,0x54,0x1f,
+0x2f,0xff,0xe4,0x3e,0xfe,0x75,0xf0,0x0a,0xe5,0x4d,0x90,0x90,0x00,0x12,0x43,0x5f,
+0x75,0xf0,0x02,0xe5,0x4e,0x12,0x43,0x5f,0xee,0xf0,0xa3,0xef,0xf0,0xe5,0x0f,0x20,
+0xe6,0x23,0xe5,0x0e,0x54,0x1f,0xff,0xe5,0x4d,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,
+0x34,0x98,0xf5,0x83,0xe4,0x8f,0xf0,0x12,0x42,0x81,0xe5,0x0a,0x30,0xe7,0x34,0xaf,
+0x4d,0x31,0xd9,0x80,0x2e,0xe5,0x0e,0x54,0x1f,0xff,0xe5,0x4d,0x25,0xe0,0x24,0x44,
+0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0x8f,0xf0,0x12,0x42,0x81,0xe5,0x0a,0x30,
+0xe7,0x11,0xe5,0x0a,0x54,0x7f,0xfd,0xe5,0x0e,0x54,0x1f,0xf5,0x53,0xab,0x4e,0xaf,
+0x4d,0x31,0x76,0xe5,0x74,0x14,0x24,0xfd,0x50,0x02,0x80,0x45,0x90,0x9e,0x61,0xe0,
+0x60,0x37,0x90,0x01,0x5b,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x04,0xf0,0xd1,0x05,0xef,
+0x64,0x01,0x70,0x2d,0x90,0x9e,0x55,0xe0,0xf5,0x44,0x75,0x45,0x00,0xe4,0xfb,0xfd,
+0x7f,0x58,0x7e,0x01,0x12,0x30,0x62,0x90,0x01,0x5b,0x74,0x05,0xf0,0x90,0x06,0x92,
+0x74,0x01,0xf0,0x90,0x9e,0x5d,0xf0,0x80,0x08,0xd1,0x05,0xbf,0x01,0x03,0x12,0x44,
+0xd3,0xe5,0x2c,0x30,0xe1,0x20,0x90,0x01,0x34,0x74,0x02,0xf0,0x85,0xd1,0x13,0x85,
+0xd2,0x14,0x85,0xd3,0x15,0x85,0xd4,0x16,0x85,0xd5,0x17,0x85,0xd6,0x18,0x85,0xd7,
+0x19,0x85,0xd9,0x1a,0xd1,0x9c,0xe5,0x2c,0x30,0xe3,0x06,0x90,0x01,0x34,0x74,0x08,
+0xf0,0xe5,0x2c,0x30,0xe4,0x09,0x90,0x01,0x34,0x74,0x10,0xf0,0x43,0x12,0x10,0xe5,
+0x2c,0x30,0xe5,0x26,0x90,0x01,0xcf,0xe0,0x30,0xe5,0x1f,0xe0,0x54,0xdf,0xf0,0x90,
+0x01,0x34,0x74,0x20,0xf0,0x75,0xa8,0x00,0x75,0xe8,0x00,0x12,0x4d,0xb6,0x90,0x00,
+0x03,0xe0,0x54,0xfb,0xf0,0x12,0x49,0xb9,0x80,0xfe,0xe5,0x2c,0x30,0xe6,0x06,0x90,
+0x01,0x34,0x74,0x40,0xf0,0xe5,0x2e,0x30,0xe1,0x3c,0x90,0x01,0x36,0x74,0x02,0xf0,
+0x43,0x12,0x40,0x90,0x01,0x02,0xe0,0x54,0x03,0x64,0x01,0x70,0x29,0x90,0x01,0x37,
+0xe0,0x30,0xe0,0x0a,0x74,0x01,0xf0,0x90,0x9e,0x66,0xe4,0xf0,0x80,0x18,0x90,0x9e,
+0x66,0xe0,0x04,0xf0,0xe0,0xc3,0x94,0x0a,0x40,0x0c,0xe4,0xf0,0x90,0x04,0x19,0xe0,
+0x30,0xe0,0x03,0x12,0x4f,0xa7,0xe5,0x2e,0x30,0xe0,0x12,0x90,0x9e,0x76,0x74,0x01,
+0xf0,0x90,0x01,0x36,0xf0,0x12,0x64,0xfe,0x90,0x9e,0x76,0xe4,0xf0,0xe5,0x2e,0x30,
+0xe2,0x78,0x90,0x01,0x36,0x74,0x04,0xf0,0x90,0x01,0xbd,0xe0,0x04,0xf0,0xe5,0x73,
+0x64,0x01,0x70,0x66,0xe5,0x74,0x60,0x62,0xe5,0x74,0x64,0x02,0x60,0x06,0xe5,0x74,
+0x64,0x05,0x70,0x27,0x90,0x06,0xab,0xe0,0x90,0x9e,0x50,0xf0,0x90,0x06,0xaa,0xe0,
+0x90,0x9e,0x5f,0xf0,0x90,0x9e,0x50,0xe0,0x70,0x07,0x90,0x9e,0x5f,0xe0,0xff,0x80,
+0x05,0x90,0x9e,0x50,0xe0,0xff,0x90,0x9e,0x50,0xef,0xf0,0x90,0x9e,0x52,0xe0,0x60,
+0x03,0xe0,0x14,0xf0,0x90,0x9e,0x51,0xe4,0xf0,0x90,0x01,0x57,0xf0,0x90,0x01,0x3c,
+0x74,0x02,0xf0,0x90,0x9e,0x63,0xe0,0x54,0xfd,0xf0,0xe0,0x54,0xef,0xf0,0xe5,0x74,
+0x14,0x24,0xfd,0x50,0x02,0x80,0x03,0x12,0x45,0x53,0xe5,0x2e,0x30,0xe3,0x28,0x90,
+0x01,0x36,0x74,0x08,0xf0,0xe5,0x73,0x64,0x01,0x70,0x1c,0xe5,0x74,0x60,0x18,0x90,
+0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,0x9e,0x89,0xe4,0x12,0x44,
+0x52,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,0x2e,0x30,0xe4,0x2f,0x90,0x01,0x36,0x74,
+0x10,0xf0,0xe5,0x73,0x64,0x01,0x70,0x23,0xe5,0x74,0x60,0x1f,0x90,0x01,0x57,0xe4,
+0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,0x9e,0x62,0xe4,0xf0,0x90,0x9e,0x63,0xe0,
+0x54,0xfd,0xf0,0xe0,0x54,0x07,0x70,0x03,0x12,0x44,0xd3,0xe5,0x2e,0x30,0xe5,0x1f,
+0x90,0x01,0x36,0x74,0x20,0xf0,0xe5,0x73,0xb4,0x01,0x14,0xe5,0x74,0x60,0x10,0x90,
+0x9e,0x61,0xe0,0x64,0x02,0x60,0x05,0x12,0x44,0xdc,0x80,0x03,0x12,0x44,0x80,0xe5,
+0x2e,0x30,0xe6,0x1e,0x90,0x01,0x36,0x74,0x40,0xf0,0xe5,0x73,0xb4,0x01,0x13,0xe5,
+0x74,0x60,0x0f,0x90,0x9e,0x63,0xe0,0x54,0xfe,0xf0,0xe0,0x54,0x07,0x70,0x03,0x12,
+0x44,0xd3,0xe5,0x2f,0x30,0xe1,0x08,0x90,0x01,0x37,0x74,0x02,0xf0,0xd1,0xbd,0x74,
+0x45,0x04,0x90,0x01,0xc4,0xf0,0x74,0x5a,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,
+0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,
+0xd0,0xf0,0xd0,0xe0,0x32,0x90,0x04,0x1b,0xe0,0x54,0x7f,0x64,0x7f,0x7f,0x01,0x60,
+0x02,0x7f,0x00,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x91,0x12,0x43,
+0x8b,0x90,0x9e,0x75,0xe0,0x64,0x02,0x60,0x6e,0x90,0x9e,0x75,0xe0,0x64,0x01,0x70,
+0x66,0x90,0x9e,0xb0,0xe0,0xff,0x04,0xf0,0x90,0x9e,0x91,0x12,0x43,0x6b,0x90,0x00,
+0x01,0xef,0x12,0x42,0x5f,0x7f,0xaf,0x7e,0x01,0xf1,0x3b,0xef,0x60,0x49,0x90,0x9e,
+0x91,0x12,0x43,0x6b,0x8b,0x1e,0x8a,0x1f,0x89,0x20,0x75,0x21,0x02,0x7b,0x01,0x7a,
+0x01,0x79,0xa0,0x12,0x45,0x09,0x90,0x9e,0x94,0x12,0x43,0x6b,0x8b,0x1e,0x8a,0x1f,
+0x89,0x20,0x90,0x9e,0x91,0x12,0x43,0x6b,0x12,0x24,0x62,0xff,0xc4,0x54,0x0f,0xf5,
+0x21,0x7b,0x01,0x7a,0x01,0x79,0xa2,0x12,0x45,0x09,0x90,0x01,0xaf,0x74,0xff,0xf0,
+0x90,0x01,0xcb,0xe0,0x64,0x80,0xf0,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x9e,0x2f,0xe0,
+0x54,0xf0,0x44,0x03,0xf0,0x54,0x0f,0x44,0x80,0xf0,0x7b,0x00,0x7a,0x00,0x79,0x13,
+0x90,0x9e,0x94,0x12,0x43,0x8b,0x0b,0x7a,0x9e,0x79,0x2f,0xc1,0x14,0x7d,0x02,0x7f,
+0x03,0x12,0x31,0x2c,0xe5,0x74,0x14,0x24,0xfd,0x50,0x02,0x80,0x23,0x90,0x9e,0x61,
+0xe0,0x60,0x06,0x7d,0x01,0x7f,0x0c,0x80,0x0f,0x90,0x9e,0x5e,0xe0,0x54,0x0f,0xc3,
+0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,0x04,0x12,0x47,0x1a,0xe4,0xff,0x12,0x48,0x8f,
+0x22,0xd1,0x05,0xef,0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,0x32,
+0x90,0x9e,0x5d,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x24,0x90,0x9e,
+0x5c,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x16,0x90,0x9e,0x60,0xe0,
+0x54,0x0f,0xd3,0x94,0x04,0x40,0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x03,0x7f,
+0x01,0x22,0x90,0x01,0xb8,0x74,0x08,0xf0,0x7f,0x00,0x22,0xd3,0x10,0xaf,0x01,0xc3,
+0xc0,0xd0,0x90,0x9e,0xa0,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0x90,
+0x9e,0xa0,0xe0,0xfe,0xa3,0xe0,0xf5,0x82,0x8e,0x83,0xe0,0x60,0x2d,0xc3,0x90,0x9e,
+0xa3,0xe0,0x94,0xe8,0x90,0x9e,0xa2,0xe0,0x94,0x03,0x40,0x0b,0x90,0x01,0xc6,0xe0,
+0x44,0x10,0xf0,0x7f,0x00,0x80,0x15,0x90,0x9e,0xa2,0xe4,0x75,0xf0,0x01,0x12,0x42,
+0x81,0x7f,0x0a,0x7e,0x00,0x12,0x32,0x15,0x80,0xc5,0x7f,0x01,0xd0,0xd0,0x92,0xaf,
+0x22,0x75,0x30,0x1f,0x75,0x31,0x01,0xe4,0xf5,0x32,0x90,0x01,0x38,0xe5,0x30,0xf0,
+0xa3,0xe5,0x31,0xf0,0xa3,0xe5,0x32,0xf0,0x22,0x90,0x00,0x02,0xe0,0x54,0xe0,0x90,
+0x9e,0x75,0x60,0x04,0x74,0x01,0xf0,0x22,0x74,0x02,0xf0,0x22,0x90,0x00,0xf3,0xe0,
+0x30,0xe3,0x08,0x90,0x9e,0x77,0x74,0x01,0xf0,0x80,0x05,0xe4,0x90,0x9e,0x77,0xf0,
+0x90,0x9e,0x77,0xe0,0xb4,0x01,0x12,0x90,0x00,0xf2,0xe0,0x30,0xe7,0x0b,0x90,0x9e,
+0x64,0x74,0xfd,0xf0,0xa3,0x74,0x33,0xf0,0x22,0x90,0x9e,0x64,0x74,0xfd,0xf0,0xa3,
+0x74,0x2f,0xf0,0x22,0x90,0x01,0x64,0x74,0xa0,0xf0,0x22,0xc0,0xe0,0xc0,0xf0,0xc0,
+0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,
+0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,0x01,0xc4,0x74,0xfb,0xf0,0x74,0x5f,
+0xa3,0xf0,0x53,0x91,0xef,0x90,0x00,0x51,0xe0,0xff,0x90,0x00,0x55,0xe0,0x5f,0xf5,
+0x3d,0xe5,0x3d,0x30,0xe6,0x18,0x74,0x40,0xf0,0x90,0x9e,0x1d,0xe0,0x54,0x03,0xff,
+0xbf,0x03,0x0b,0x90,0x9e,0x1a,0xe0,0x60,0x05,0x7f,0x01,0x12,0x4a,0xd6,0xe5,0x3d,
+0x30,0xe7,0x15,0x90,0x00,0x55,0x74,0x80,0xf0,0x90,0x9e,0x1d,0xe0,0x54,0x03,0xff,
+0xbf,0x03,0x05,0x7f,0x02,0x12,0x4a,0xd6,0x90,0x01,0xc4,0x74,0xfb,0xf0,0x74,0x5f,
+0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,
+0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,0x8f,0x6b,0x8c,
+0x6c,0x8d,0x6d,0x22,0x8f,0x6e,0x8c,0x6f,0x8d,0x70,0x22,0xe4,0xf5,0x73,0x90,0x9e,
+0x63,0xf0,0xf5,0x74,0x90,0x9e,0x60,0x74,0x0c,0xf0,0x90,0x9e,0x5e,0xf0,0xe4,0x90,
+0x9e,0x61,0xf0,0x90,0x9e,0x5d,0xf0,0x90,0x9e,0x5c,0xf0,0x90,0x9e,0x5f,0x04,0xf0,
+0x90,0x9e,0x50,0xf0,0xe4,0x90,0x9e,0x62,0xf0,0x90,0x9e,0x52,0xf0,0x90,0x9e,0x5a,
+0x74,0x07,0xf0,0xe4,0x90,0x9e,0x51,0xf0,0x90,0x9e,0x58,0xf0,0xa3,0x74,0x02,0xf0,
+0x90,0x9e,0x56,0x14,0xf0,0xa3,0x74,0x03,0xf0,0x90,0x9e,0x55,0x74,0x14,0xf0,0x90,
+0x9e,0x5b,0x74,0x05,0xf0,0xe4,0x90,0x9e,0x54,0xf0,0x90,0x9e,0x4f,0xf0,0x90,0x9e,
+0x76,0xf0,0x22,0xe4,0x90,0x9e,0x62,0xf0,0x90,0x9e,0x51,0xf0,0x90,0x9e,0x63,0xf0,
+0x22,0x8b,0x59,0x8a,0x5a,0x89,0x5b,0x31,0x03,0xab,0x59,0xaa,0x5a,0xa9,0x5b,0x12,
+0x24,0x62,0xf5,0x74,0x14,0x60,0x0e,0x14,0x60,0x1e,0x14,0x60,0x2f,0x24,0x03,0x70,
+0x40,0x7f,0x01,0x80,0x3a,0xab,0x59,0xaa,0x5a,0xa9,0x5b,0x90,0x00,0x02,0x12,0x42,
+0x20,0xfd,0xe4,0xff,0x31,0x72,0x80,0x27,0xab,0x59,0xaa,0x5a,0xa9,0x5b,0x90,0x00,
+0x02,0x12,0x42,0x20,0xfd,0x7f,0x01,0x31,0x72,0x1f,0x80,0x13,0xab,0x59,0xaa,0x5a,
+0xa9,0x5b,0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x7f,0x02,0x31,0x72,0xe4,0xff,0x31,
+0xc6,0x22,0xef,0x24,0xfe,0x60,0x0b,0x04,0x70,0x22,0x90,0x9e,0x5f,0x74,0x01,0xf0,
+0x80,0x16,0xed,0x70,0x0a,0x90,0x9e,0x5b,0xe0,0x90,0x9e,0x5f,0xf0,0x80,0x05,0x90,
+0x9e,0x5f,0xed,0xf0,0x90,0x9e,0x5f,0xe0,0x90,0x9e,0x50,0xf0,0x22,0xd3,0x10,0xaf,
+0x01,0xc3,0xc0,0xd0,0x90,0x00,0x01,0x12,0x42,0x20,0x90,0x9e,0x61,0xf0,0x90,0x00,
+0x03,0x12,0x42,0x20,0x90,0x9e,0x4f,0xf0,0x12,0x24,0x62,0x65,0x74,0x60,0x02,0x31,
+0x11,0xd0,0xd0,0x92,0xaf,0x22,0xef,0x64,0x01,0x70,0x30,0x7d,0x7c,0x7f,0x02,0x12,
+0x31,0x2c,0x7d,0x02,0x7f,0x03,0x12,0x31,0x2c,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,
+0x3c,0x74,0x02,0xf0,0x12,0x47,0x16,0xe4,0xff,0x12,0x48,0x8f,0x90,0x06,0x04,0xe0,
+0x54,0x7f,0xf0,0x90,0x06,0x0a,0xe0,0x54,0xf8,0xf0,0x22,0x90,0x01,0x36,0x74,0x7c,
+0xf0,0xa3,0x74,0x02,0xf0,0x7d,0x7c,0xff,0x12,0x31,0x9d,0x7d,0x02,0x7f,0x03,0x12,
+0x31,0x9d,0x90,0x06,0x04,0xe0,0x44,0x80,0xf0,0x90,0x06,0x0a,0xe0,0x44,0x07,0xf0,
+0x90,0x9e,0x58,0xe0,0xa3,0xe0,0x90,0x05,0x58,0xf0,0xe5,0x73,0x30,0xe0,0x1b,0x90,
+0x9e,0x52,0xe0,0x70,0x1a,0xe0,0x04,0xf0,0x90,0x9e,0x5e,0xe0,0x54,0x0f,0xc3,0x94,
+0x04,0x50,0x0c,0x7d,0x01,0x7f,0x04,0x02,0x47,0x1a,0xe4,0x90,0x9e,0x52,0xf0,0x22,
+0x12,0x5e,0x05,0xef,0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,0x52,
+0x90,0x9e,0x63,0xe0,0x54,0x03,0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x42,
+0x90,0x9e,0x60,0xe0,0x54,0x0f,0xd3,0x94,0x02,0x40,0x08,0x90,0x01,0xb9,0x74,0x04,
+0xf0,0x80,0x2f,0x90,0x9e,0x63,0xe0,0x30,0xe2,0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,
+0x80,0x20,0x90,0x9e,0x63,0xe0,0x30,0xe4,0x08,0x90,0x01,0xb9,0x74,0x10,0xf0,0x80,
+0x11,0x90,0x9e,0x52,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,0x20,0xf0,0x80,0x03,0x7f,
+0x01,0x22,0x90,0x01,0xb8,0x74,0x04,0xf0,0x7f,0x00,0x22,0xe5,0x12,0x60,0x08,0x90,
+0x01,0xb9,0x74,0x01,0xf0,0x80,0x5e,0x90,0x9e,0x60,0xe0,0x54,0x0f,0xd3,0x94,0x01,
+0x40,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x4b,0x90,0x02,0x87,0xe0,0x60,0x08,
+0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x3d,0x90,0x9e,0x75,0xe0,0xb4,0x02,0x10,0x90,
+0x9e,0x64,0xe0,0xfe,0xa3,0xe0,0xf5,0x82,0x8e,0x83,0xe0,0x60,0x17,0x80,0x26,0x90,
+0x9e,0x75,0xe0,0xb4,0x01,0x0e,0x90,0x01,0xaf,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,
+0x08,0xf0,0x80,0x11,0x90,0x9e,0x54,0xe0,0x70,0x08,0x90,0x01,0xb9,0x74,0x10,0xf0,
+0x80,0x03,0x7f,0x01,0x22,0x90,0x01,0xb8,0x74,0x02,0xf0,0x7f,0x00,0x22,0x90,0x06,
+0x04,0xe0,0x54,0xbf,0xf0,0xef,0x60,0x09,0xe5,0x73,0xb4,0x01,0x04,0xe4,0xff,0x71,
+0x4d,0x90,0x9e,0x5e,0xe0,0x54,0xf0,0xf0,0xe0,0x44,0x0c,0xf0,0x22,0x8f,0x76,0x90,
+0x9e,0x5e,0xe0,0x90,0x01,0xc1,0xf0,0xa3,0xe5,0x12,0xf0,0x12,0x45,0xb1,0xef,0x64,
+0x01,0x70,0x2e,0x90,0x9e,0x69,0x12,0x47,0xfa,0xe5,0x76,0x60,0x10,0x74,0x21,0x2f,
+0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x10,0xf0,0x80,0x0e,0x74,0x21,0x2f,
+0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xef,0xf0,0x90,0x04,0x1f,0x74,0x20,
+0xf0,0x22,0x90,0x9e,0xaf,0xef,0xf0,0x71,0xb0,0x90,0x9e,0xaf,0xe0,0x60,0x05,0x90,
+0x05,0x22,0xe4,0xf0,0x90,0x9e,0x5e,0xe0,0x54,0xf0,0xf0,0xe0,0x44,0x04,0xf0,0x22,
+0x90,0x00,0x11,0xe0,0x44,0x09,0xf0,0x12,0x49,0xb9,0x90,0x9d,0xff,0x12,0x43,0x53,
+0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x78,0x7e,0x08,0x12,0x2b,0x08,0x90,0x9e,0x03,
+0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x04,0x7e,0x0c,0x12,0x2b,0x08,
+0x90,0x9e,0x07,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x00,0x7e,0x08,
+0x12,0x2b,0x08,0x90,0x9e,0x0b,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,
+0x70,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x68,0x12,0x25,0x14,0x00,0x03,0x2d,0x95,
+0xe4,0xfd,0xff,0x12,0x30,0x2c,0x90,0x9e,0x77,0xe0,0xb4,0x01,0x11,0x90,0x80,0x68,
+0x12,0x25,0x14,0x00,0x03,0x2d,0x95,0xe4,0xfd,0x7f,0x01,0x12,0x30,0x2c,0x22,0x8f,
+0x27,0xe4,0x90,0x9e,0xa8,0xf0,0xa3,0xf0,0x90,0x01,0x09,0xe0,0x7f,0x00,0x30,0xe7,
+0x02,0x7f,0x01,0xef,0x65,0x27,0x60,0x3e,0xc3,0x90,0x9e,0xa9,0xe0,0x94,0x88,0x90,
+0x9e,0xa8,0xe0,0x94,0x13,0x40,0x08,0x90,0x01,0xc6,0xe0,0x44,0x80,0xf0,0x22,0x90,
+0x9e,0xa8,0xe4,0x75,0xf0,0x01,0x12,0x42,0x81,0x7f,0x14,0x7e,0x00,0x12,0x32,0x15,
+0xd3,0x90,0x9e,0xa9,0xe0,0x94,0x32,0x90,0x9e,0xa8,0xe0,0x94,0x00,0x40,0xb9,0x90,
+0x01,0xc7,0xe0,0x30,0xe0,0xb2,0x22,0x90,0x9e,0x5e,0xe0,0x54,0xf0,0xf0,0xe0,0x44,
+0x01,0xf0,0x12,0x44,0xff,0x12,0x45,0x00,0xe0,0x54,0xf0,0xf0,0xe0,0x44,0x02,0xf0,
+0x22,0x90,0x9e,0x60,0xe0,0x30,0xe6,0x1c,0xe0,0x54,0x0f,0xff,0x90,0x9e,0x4e,0xe0,
+0xfe,0x4f,0x90,0x01,0x2f,0xf0,0xee,0x64,0x80,0x90,0x9e,0x4e,0xf0,0x90,0x9e,0x60,
+0xe0,0x54,0xbf,0xf0,0x22,0x8f,0x75,0x12,0x45,0xb1,0xef,0x64,0x01,0x70,0x2e,0x90,
+0x9e,0x6a,0x12,0x47,0xfa,0xe5,0x75,0x60,0x10,0x74,0x21,0x2f,0xf5,0x82,0xe4,0x34,
+0xfc,0xf5,0x83,0xe0,0x44,0x10,0xf0,0x80,0x0e,0x74,0x21,0x2f,0xf5,0x82,0xe4,0x34,
+0xfc,0xf5,0x83,0xe0,0x54,0xef,0xf0,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0xe4,0x90,
+0x9e,0x2f,0xf0,0xe5,0x74,0x60,0x6a,0xe5,0x73,0x64,0x01,0x70,0x64,0xe5,0x74,0x14,
+0x60,0x29,0x24,0xfd,0x60,0x25,0x24,0x02,0x24,0xfb,0x50,0x02,0x80,0x23,0x90,0x9e,
+0x50,0xe0,0x14,0xf0,0xe0,0x60,0x04,0xa3,0xe0,0x60,0x16,0x90,0x9e,0x50,0xe0,0x70,
+0x0a,0x90,0x9e,0x5f,0xe0,0x90,0x9e,0x50,0xf0,0x80,0x00,0x90,0x9e,0x2f,0x74,0x01,
+0xf0,0x90,0x9e,0x2f,0xe0,0x60,0x2a,0x90,0x9e,0x63,0xe0,0x44,0x10,0xf0,0xe4,0x90,
+0x9e,0x89,0xf0,0x90,0x9e,0x5a,0x12,0x44,0x56,0x90,0x01,0x57,0x74,0x05,0xf0,0x90,
+0x9e,0x5e,0xe0,0x54,0x0f,0xc3,0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,0x04,0x12,0x47,
+0x1a,0x22,0xef,0xc3,0x94,0x20,0x50,0x39,0xef,0x30,0xe0,0x17,0xed,0xc4,0x54,0xf0,
+0xfd,0xef,0xc3,0x13,0xfe,0x24,0xa4,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0x54,
+0x0f,0x80,0x10,0xef,0xc3,0x13,0xfe,0x24,0xa4,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,
+0xe0,0x54,0xf0,0xf0,0x74,0xa4,0x2e,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0x4d,
+0xf0,0x22,0xad,0x07,0xed,0xc3,0x94,0x20,0x50,0x0d,0x74,0x84,0x2d,0xf5,0x82,0xe4,
+0x34,0x04,0xf5,0x83,0xe0,0x80,0x0b,0x74,0xa6,0x2d,0xf5,0x82,0xe4,0x34,0x9c,0xf5,
+0x83,0xe0,0x54,0x7f,0xf5,0x64,0xe5,0x64,0x54,0x1f,0xfc,0x75,0xf0,0x09,0xed,0x90,
+0x96,0x48,0x12,0x43,0x5f,0xe0,0xff,0x90,0x9e,0x3e,0xf0,0xed,0x25,0xe0,0x24,0x02,
+0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0xfb,0xa3,0xe0,0x90,0x9e,0x3f,0xcb,0xf0,
+0xa3,0xeb,0xf0,0xed,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,
+0xfb,0xa3,0xe0,0x90,0x9e,0x41,0xcb,0xf0,0xa3,0xeb,0xf0,0xec,0x25,0xe0,0x24,0x66,
+0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0xe4,0x93,0xfa,0x74,0x01,0x93,0xfb,0xed,0x25,
+0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xea,0xf0,0xa3,0xeb,0xf0,0xec,
+0xc3,0x9f,0x40,0x02,0xc1,0xc9,0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,
+0xec,0xf0,0x04,0xfb,0x90,0x9e,0x3e,0xe0,0xff,0xeb,0xd3,0x9f,0x40,0x02,0xc1,0xfa,
+0xeb,0xc3,0x94,0x10,0x40,0x21,0xeb,0x24,0xf0,0xff,0x74,0x01,0x7e,0x00,0xa8,0x07,
+0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x9e,0x3f,0xe0,0x5e,
+0xfe,0xa3,0xe0,0x5f,0x4e,0x70,0x23,0xeb,0xc3,0x94,0x10,0x50,0x39,0x74,0x01,0x7e,
+0x00,0xa8,0x03,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x9e,
+0x41,0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x1c,0xeb,0x64,0x13,0x60,0x08,0xeb,
+0x64,0x12,0x60,0x03,0xbb,0x11,0x09,0x90,0x9e,0x3f,0xe0,0x30,0xe0,0x02,0x7b,0x18,
+0xac,0x03,0x8c,0x64,0x80,0x34,0x0b,0x80,0x8b,0x90,0x9e,0x3e,0xe0,0xfb,0x6c,0x70,
+0x69,0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xec,0xf0,0x75,0xf0,0x09,
+0xed,0x90,0x96,0x4a,0x12,0x43,0x5f,0xe0,0xb4,0x01,0x0c,0xe5,0x64,0x20,0xe6,0x07,
+0xec,0x44,0x40,0xf5,0x64,0x80,0x03,0xaf,0x64,0x22,0xec,0x25,0xe0,0x24,0x9e,0xf5,
+0x82,0xe4,0x34,0x41,0xf5,0x83,0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xec,0x25,0xe0,
+0x24,0x66,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,
+0x3e,0xc3,0x13,0xfe,0xef,0x13,0xff,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,
+0x95,0xf5,0x83,0xee,0xf0,0xa3,0xef,0xf0,0x80,0x5b,0xec,0xd3,0x9b,0x40,0x56,0x90,
+0x9e,0x3e,0xe0,0xff,0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xef,0xf0,
+0xac,0x07,0x8f,0x64,0xec,0x25,0xe0,0x24,0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,
+0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xec,0x25,0xe0,0x24,0x66,0xf5,0x82,0xe4,0x34,
+0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,0xef,0x13,
+0xff,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,0xa3,
+0xef,0xf0,0xaf,0x64,0x22,0x74,0x01,0x2d,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xe4,
+0xf0,0xaf,0x05,0xe5,0x64,0x44,0x80,0xfd,0x12,0x58,0xf1,0xe5,0x64,0x44,0x80,0xff,
+0x22,0xac,0x07,0xec,0xc3,0x94,0x20,0x50,0x0d,0x74,0x84,0x2c,0xf5,0x82,0xe4,0x34,
+0x04,0xf5,0x83,0xe0,0x80,0x0b,0x74,0xa6,0x2c,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,
+0xe0,0x54,0x7f,0xf5,0x64,0xe5,0x64,0x54,0x1f,0xff,0x90,0x9e,0x40,0xf0,0x75,0xf0,
+0x09,0xec,0x90,0x96,0x49,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x42,0xf0,0x75,0xf0,0x09,
+0xec,0x90,0x96,0x48,0x12,0x43,0x5f,0xe0,0xfe,0x90,0x9e,0x43,0xf0,0xec,0x25,0xe0,
+0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfb,0xa3,0xe0,0x90,0x9e,0x44,
+0xcb,0xf0,0xa3,0xeb,0xf0,0xec,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,
+0x83,0xe0,0xfb,0xa3,0xe0,0x90,0x9e,0x46,0xcb,0xf0,0xa3,0xeb,0xf0,0xef,0xd3,0x9e,
+0x40,0x0a,0x90,0x9e,0x43,0xe0,0x90,0x9e,0x40,0xf0,0xf5,0x64,0xed,0x70,0x02,0x21,
+0x07,0x90,0x9e,0x41,0xed,0xf0,0xe5,0x64,0x30,0xe6,0x0a,0x90,0x9e,0x40,0xe0,0xf5,
+0x64,0xa3,0xe0,0x14,0xf0,0x90,0x9e,0x41,0xe0,0x70,0x02,0x21,0x07,0x90,0x9e,0x40,
+0xe0,0xff,0xd3,0x94,0x00,0x50,0x02,0x21,0x07,0xe4,0x90,0x9e,0x3f,0xf0,0xef,0x14,
+0x90,0x9e,0x3e,0xf0,0x90,0x9e,0x42,0xe0,0xfd,0x90,0x9e,0x3e,0xe0,0xff,0xd3,0x9d,
+0x40,0x6b,0xef,0x94,0x10,0x40,0x21,0xef,0x24,0xf0,0xff,0x74,0x01,0x7e,0x00,0xa8,
+0x07,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x9e,0x46,0xe0,
+0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x70,0x27,0x90,0x9e,0x3e,0xe0,0xff,0xc3,0x94,0x10,
+0x50,0x33,0x74,0x01,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,
+0xd8,0xf9,0xff,0x90,0x9e,0x44,0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x16,0x90,
+0x9e,0x3e,0xe0,0xf5,0x64,0xa3,0xe0,0x04,0xf0,0x90,0x9e,0x41,0xe0,0xff,0x90,0x9e,
+0x3f,0xe0,0x6f,0x60,0x08,0x90,0x9e,0x3e,0xe0,0x14,0xf0,0x80,0x87,0x90,0x9e,0x41,
+0xe0,0xff,0x90,0x9e,0x3f,0xe0,0xc3,0x9f,0x50,0x0d,0x90,0x9e,0x3e,0xe0,0xb5,0x05,
+0x06,0x90,0x9e,0x42,0xe0,0xf5,0x64,0xe5,0x64,0x25,0xe0,0x24,0x9e,0xf5,0x82,0xe4,
+0x34,0x41,0xf5,0x83,0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xe5,0x64,0x25,0xe0,0x24,
+0x66,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,
+0xc3,0x13,0xfe,0xef,0x13,0xff,0xec,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,
+0xf5,0x83,0xee,0xf0,0xa3,0xef,0xf0,0xaf,0x04,0xad,0x64,0x12,0x58,0xf1,0xaf,0x64,
+0x22,0xe4,0xf5,0x59,0xe5,0x59,0xb4,0x20,0x14,0x90,0x9a,0xc5,0xe0,0x04,0xf0,0x90,
+0x95,0x01,0xe0,0xff,0x90,0x9a,0xc5,0xe0,0xb5,0x07,0x02,0xe4,0xf0,0x75,0xf0,0x09,
+0xe5,0x59,0x90,0x96,0x4b,0x12,0x43,0x5f,0xe0,0x64,0x01,0x60,0x02,0xe1,0x95,0xe5,
+0x59,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,0x34,0x93,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,
+0xd3,0x94,0x00,0xee,0x94,0x00,0x50,0x02,0xe1,0x95,0xe5,0x59,0x94,0x20,0x40,0x08,
+0x90,0x9a,0xc5,0xe0,0x60,0x02,0xe1,0xa0,0xe5,0x59,0x75,0xf0,0x0a,0xa4,0x24,0x00,
+0xf9,0x74,0x90,0x35,0xf0,0x75,0x5e,0x01,0xf5,0x5f,0x89,0x60,0xe5,0x59,0x25,0xe0,
+0x24,0x80,0xf5,0x82,0xe4,0x34,0x93,0xf5,0x83,0xe0,0xff,0xa3,0xe0,0x90,0x9e,0x38,
+0xcf,0xf0,0xa3,0xef,0xf0,0xe5,0x59,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,0x34,0x98,
+0xf5,0x83,0xe0,0xff,0xa3,0xe0,0x90,0x9e,0x3a,0xcf,0xf0,0xa3,0xef,0xf0,0xe5,0x59,
+0xc3,0x94,0x20,0x50,0x14,0x74,0x84,0x25,0x59,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,
+0xe0,0x54,0x3f,0x90,0x9e,0x34,0xf0,0x80,0x12,0x74,0xa6,0x25,0x59,0xf5,0x82,0xe4,
+0x34,0x9c,0xf5,0x83,0xe0,0x54,0x3f,0x90,0x9e,0x34,0xf0,0x90,0x9e,0x34,0xe0,0xfe,
+0x54,0x1f,0xa3,0xf0,0x75,0xf0,0x09,0xe5,0x59,0x90,0x96,0x48,0x12,0x43,0x5f,0xe0,
+0x90,0x9e,0x3d,0xf0,0x74,0xe6,0x25,0x59,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,
+0xc3,0x94,0x05,0x40,0x02,0x81,0x6e,0x90,0x9e,0x3d,0xe0,0xff,0x90,0x9e,0x35,0xe0,
+0x9f,0x40,0x13,0x90,0x9e,0x3d,0xe0,0x90,0x9e,0x35,0xf0,0xee,0x54,0x40,0xfe,0x90,
+0x9e,0x34,0xf0,0xef,0x4e,0xf0,0x90,0x04,0xfd,0xe0,0x64,0x01,0x70,0x29,0x90,0x9e,
+0x35,0xe0,0xff,0x90,0x41,0x4a,0x93,0xfe,0x74,0x44,0x25,0x59,0xf5,0x82,0xe4,0x34,
+0x9a,0xf5,0x83,0xe0,0xc3,0x9e,0x40,0x06,0xef,0x90,0x40,0xda,0x80,0x30,0x90,0x9e,
+0x35,0xe0,0x90,0x40,0xf6,0x80,0x27,0x90,0x9e,0x35,0xe0,0xff,0x90,0x41,0x4a,0x93,
+0xfe,0x74,0x44,0x25,0x59,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xc3,0x9e,0x40,
+0x06,0xef,0x90,0x41,0x12,0x80,0x07,0x90,0x9e,0x35,0xe0,0x90,0x41,0x2e,0x93,0x90,
+0x9e,0x3c,0xf0,0x90,0x9e,0x3c,0xe0,0x75,0xf0,0x06,0xa4,0x24,0x50,0xf9,0x74,0x40,
+0x35,0xf0,0x75,0x5b,0xff,0xf5,0x5c,0x89,0x5d,0x90,0x9e,0x34,0xe0,0x90,0x41,0xf2,
+0x93,0xff,0xd3,0x90,0x9e,0x3b,0xe0,0x9f,0x90,0x9e,0x3a,0xe0,0x94,0x00,0x40,0x09,
+0xe4,0xfd,0xaf,0x59,0x12,0x67,0xb1,0xe1,0x2c,0xe5,0x59,0x25,0xe0,0x24,0xc2,0xf5,
+0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0xf5,0x61,0xa3,0xe0,0xf5,0x62,0xab,0x5b,0xaa,
+0x5c,0xa9,0x5d,0x12,0x24,0x62,0xff,0x7e,0x00,0xab,0x5e,0xaa,0x5f,0xa9,0x60,0x12,
+0x42,0x97,0xfd,0xac,0xf0,0x12,0x24,0x7b,0xef,0x25,0x62,0xf5,0x62,0xee,0x35,0x61,
+0xf5,0x61,0xab,0x5b,0xaa,0x5c,0xa9,0x5d,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0x7e,
+0x00,0xab,0x5e,0xaa,0x5f,0xa9,0x60,0x90,0x00,0x02,0x12,0x42,0xc2,0xfd,0xac,0xf0,
+0x12,0x24,0x7b,0xef,0x25,0x62,0xf5,0x62,0xee,0x35,0x61,0xf5,0x61,0xab,0x5b,0xaa,
+0x5c,0xa9,0x5d,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0x7e,0x00,0xab,0x5e,0xaa,0x5f,
+0xa9,0x60,0x90,0x00,0x04,0x12,0x42,0xc2,0xfd,0xac,0xf0,0x12,0x24,0x7b,0xef,0x25,
+0x62,0xf5,0x62,0xee,0x35,0x61,0xf5,0x61,0xab,0x5b,0xaa,0x5c,0xa9,0x5d,0x90,0x00,
+0x03,0x12,0x42,0x20,0xff,0x7e,0x00,0xab,0x5e,0xaa,0x5f,0xa9,0x60,0x90,0x00,0x06,
+0x12,0x42,0xc2,0xfd,0xac,0xf0,0x12,0x24,0x7b,0xef,0x25,0x62,0xf5,0x62,0xee,0x35,
+0x61,0xf5,0x61,0xab,0x5b,0xaa,0x5c,0xa9,0x5d,0x90,0x00,0x04,0x12,0x42,0x20,0xff,
+0x7e,0x00,0xab,0x5e,0xaa,0x5f,0xa9,0x60,0x90,0x00,0x08,0x12,0x42,0xc2,0xfd,0xac,
+0xf0,0x12,0x24,0x7b,0xef,0x25,0x62,0xf5,0x62,0xee,0x35,0x61,0xf5,0x61,0xab,0x5b,
+0xaa,0x5c,0xa9,0x5d,0x90,0x00,0x05,0x12,0x42,0x20,0xff,0x7e,0x00,0x90,0x9e,0x38,
+0xe0,0xfc,0xa3,0xe0,0xfd,0x12,0x24,0x7b,0xd3,0xe5,0x62,0x9f,0xe5,0x61,0x9e,0x40,
+0x0c,0xe5,0x62,0x9f,0xf5,0x62,0xe5,0x61,0x9e,0xf5,0x61,0x80,0x05,0xe4,0xf5,0x61,
+0xf5,0x62,0xe5,0x59,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe5,
+0x61,0xf0,0xa3,0xe5,0x62,0xf0,0x90,0x9e,0x34,0xe0,0x25,0xe0,0x24,0x66,0xf5,0x82,
+0xe4,0x34,0x41,0xf5,0x83,0xc3,0x74,0x01,0x93,0x95,0x62,0xe4,0x93,0x95,0x61,0x50,
+0x07,0xaf,0x59,0x12,0x65,0xb2,0xe1,0x00,0x90,0x9e,0x34,0xe0,0x25,0xe0,0x24,0x9e,
+0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0xd3,0x74,0x01,0x93,0x95,0x62,0xe4,0x93,0x95,
+0x61,0x50,0x02,0xe1,0x00,0x7d,0x01,0xaf,0x59,0x12,0x67,0xb1,0xe1,0x00,0x74,0xe6,
+0x25,0x59,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0xfc,0x64,0x05,0x60,0x02,0xc1,
+0x09,0x90,0x96,0x43,0xe0,0xff,0xb4,0x03,0x0b,0x90,0x9e,0x35,0xe0,0xc3,0x94,0x19,
+0x40,0x3d,0x80,0x2e,0xef,0xb4,0x02,0x0b,0x90,0x9e,0x35,0xe0,0xc3,0x94,0x11,0x40,
+0x2e,0x80,0x1f,0x90,0x96,0x43,0xe0,0xff,0xb4,0x01,0x0b,0x90,0x9e,0x35,0xe0,0xc3,
+0x94,0x0a,0x40,0x1b,0x80,0x0c,0xef,0x70,0x11,0x90,0x9e,0x35,0xe0,0xc3,0x94,0x03,
+0x40,0x0d,0x90,0x9a,0x84,0x74,0x01,0xf0,0x80,0x05,0xe4,0x90,0x9a,0x84,0xf0,0x74,
+0x84,0x25,0x59,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe0,0xf5,0x63,0x74,0x44,0x25,
+0x59,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xff,0xc3,0x94,0x30,0x50,0x02,0xa1,
+0xb6,0x90,0x9a,0x84,0xe0,0x64,0x01,0x60,0x02,0xa1,0xb6,0x74,0x85,0x25,0x59,0xf5,
+0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0x64,0x0a,0x60,0x51,0xef,0x24,0x05,0xff,0xe4,
+0x33,0xfe,0x74,0x41,0x25,0x59,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xe0,0xfd,0xd3,
+0x9f,0xee,0x64,0x80,0xf8,0x74,0x80,0x98,0x50,0x32,0xed,0x24,0x05,0xff,0xe4,0x33,
+0xfe,0x74,0x44,0x25,0x59,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xd3,0x9f,0xee,
+0x64,0x80,0xf8,0x74,0x80,0x98,0x50,0x14,0x74,0x26,0x25,0x59,0xf5,0x82,0xe4,0x34,
+0x9d,0xf5,0x83,0xe0,0xff,0x90,0x9e,0x35,0xe0,0x6f,0x60,0x3d,0x74,0x44,0x25,0x59,
+0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xff,0xd3,0x94,0x42,0x40,0x05,0x75,0x63,
+0x05,0x80,0x0e,0xef,0xd3,0x94,0x39,0x40,0x05,0x75,0x63,0x03,0x80,0x03,0x75,0x63,
+0x01,0x74,0x41,0x25,0x59,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xef,0xf0,0x74,0x85,
+0x25,0x59,0xf5,0x82,0xe4,0x34,0x9a,0x80,0x29,0x74,0xe6,0x25,0x59,0xf5,0x82,0xe4,
+0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x74,0x85,0x25,0x59,0xf5,0x82,0xe4,0x34,0x9a,0xf5,
+0x83,0xe0,0x04,0xf0,0x80,0x10,0xe4,0xf5,0x63,0x74,0xe6,0x25,0x59,0xf5,0x82,0xe4,
+0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x90,0x9e,0x35,0xe0,0xff,0x74,0x26,0x25,0x59,0xf5,
+0x82,0xe4,0x34,0x9d,0xf5,0x83,0xef,0xf0,0x74,0x84,0x25,0x59,0xf5,0x82,0xe4,0x34,
+0x98,0xf5,0x83,0xe5,0x63,0xf0,0x75,0xf0,0x09,0xe5,0x59,0x90,0x96,0x4c,0x12,0x43,
+0x5f,0xe0,0xb4,0x01,0x10,0xe4,0xf5,0x63,0x74,0xe6,0x25,0x59,0xf5,0x82,0xe4,0x34,
+0x9c,0xf5,0x83,0xe4,0xf0,0xad,0x63,0xc1,0xfb,0xec,0x64,0x06,0x60,0x02,0xe1,0x00,
+0xf5,0x61,0xf5,0x62,0x90,0x42,0x13,0x93,0xff,0x7e,0x00,0x90,0x9e,0x38,0xe0,0xfc,
+0xa3,0xe0,0xfd,0x12,0x24,0x7b,0x90,0x9e,0x36,0xee,0xf0,0xa3,0xef,0xf0,0x74,0x84,
+0x25,0x59,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe0,0xf5,0x63,0xe4,0xf5,0x5a,0xab,
+0x5e,0xaa,0x5f,0xa9,0x60,0x75,0xf0,0x02,0xe5,0x5a,0xa4,0xf5,0x82,0x85,0xf0,0x83,
+0x12,0x42,0xc2,0xfd,0xac,0xf0,0xe5,0x5a,0x90,0x42,0x0e,0x93,0xff,0x7e,0x00,0x12,
+0x24,0x7b,0xef,0x25,0x62,0xf5,0x62,0xee,0x35,0x61,0xf5,0x61,0xc3,0x90,0x9e,0x37,
+0xe0,0x95,0x62,0x90,0x9e,0x36,0xe0,0x95,0x61,0x40,0x07,0x05,0x5a,0xe5,0x5a,0xb4,
+0x05,0xbd,0xe5,0x5a,0xc3,0x13,0xf5,0x5a,0xe5,0x63,0xb4,0x01,0x06,0xe5,0x5a,0x70,
+0x46,0x80,0x13,0xe5,0x63,0xb4,0x03,0x15,0xe5,0x5a,0x70,0x05,0x75,0x63,0x03,0x80,
+0x39,0xe5,0x5a,0xb4,0x01,0x05,0x75,0x63,0x01,0x80,0x2f,0x80,0x2a,0xe5,0x63,0xb4,
+0x05,0x28,0xe5,0x5a,0x70,0x05,0x75,0x63,0x05,0x80,0x0d,0xe5,0x5a,0xb4,0x01,0x05,
+0x75,0x63,0x03,0x80,0x03,0x75,0x63,0x01,0xd3,0x90,0x9e,0x3b,0xe0,0x94,0x03,0x90,
+0x9e,0x3a,0xe0,0x94,0x00,0x40,0x03,0xe4,0xf5,0x63,0xd3,0x90,0x9e,0x3b,0xe0,0x94,
+0x03,0x90,0x9e,0x3a,0xe0,0x94,0x00,0x40,0x03,0xe4,0xf5,0x63,0x74,0x84,0x25,0x59,
+0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe5,0x63,0xf0,0xfd,0xaf,0x59,0x12,0x65,0x72,
+0x74,0xe6,0x25,0x59,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0xd3,0x94,0x05,0x74,
+0xe6,0x50,0x0e,0x25,0x59,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x04,0xf0,0x80,
+0x0b,0x25,0x59,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0xab,0x5e,0xaa,0x5f,
+0xa9,0x60,0xe4,0xf5,0xf0,0x12,0x42,0xfa,0xab,0x5e,0xaa,0x5f,0xa9,0x60,0x90,0x00,
+0x02,0xe4,0xf5,0xf0,0x12,0x43,0x19,0x90,0x00,0x04,0xe4,0xf5,0xf0,0x12,0x43,0x19,
+0x90,0x00,0x06,0xe4,0xf5,0xf0,0x12,0x43,0x19,0x90,0x00,0x08,0xe4,0xf5,0xf0,0x12,
+0x43,0x19,0xe5,0x59,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,0x34,0x93,0xf5,0x83,0xe4,
+0xf0,0xa3,0xf0,0xe5,0x59,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,
+0xe4,0xf0,0xa3,0xf0,0xe5,0x59,0x25,0xe0,0x24,0x44,0xf5,0x82,0xe4,0x34,0x99,0xf5,
+0x83,0xe4,0xf0,0xa3,0xf0,0x05,0x59,0xe5,0x59,0xc3,0x94,0x40,0x50,0x02,0x21,0x54,
+0x22,0x90,0x04,0x44,0x74,0x11,0xf0,0xa3,0x74,0xf0,0xf0,0xa3,0x74,0x0f,0xf0,0xa3,
+0xe4,0xf0,0xfd,0x74,0xa4,0x2d,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe4,0xf0,0x0d,
+0xbd,0x10,0xf0,0xe4,0x90,0x9a,0xc5,0xf0,0x90,0x95,0x01,0x04,0xf0,0xe4,0xfd,0x75,
+0xf0,0x0a,0xed,0x90,0x90,0x00,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x75,0xf0,0x0a,
+0xed,0x90,0x90,0x02,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x75,0xf0,0x0a,0xed,0x90,
+0x90,0x04,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x75,0xf0,0x0a,0xed,0x90,0x90,0x06,
+0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x75,0xf0,0x0a,0xed,0x90,0x90,0x08,0x12,0x43,
+0x5f,0xe4,0xf0,0xa3,0xf0,0x74,0x26,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0x74,
+0x13,0xf0,0x74,0x85,0x2d,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe4,0xf0,0x74,0x84,
+0x2d,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe4,0xf0,0xed,0x25,0xe0,0x24,0x80,0xf5,
+0x82,0xe4,0x34,0x93,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0xed,0x25,0xe0,0x24,0xc4,0xf5,
+0x82,0xe4,0x34,0x98,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0xed,0x25,0xe0,0x24,0xc4,0xf5,
+0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0xed,0x25,0xe0,0x24,0x44,0xf5,
+0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0xed,0x25,0xe0,0x24,0xc6,0xf5,
+0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0xed,0x25,0xe0,0x24,0x46,0xf5,
+0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0x74,0x86,0x2d,0xf5,0x82,0xe4,
+0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x74,0x46,0x2d,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,
+0xe4,0xf0,0x74,0xe6,0x2d,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x90,0x41,
+0xc4,0x93,0xfe,0x74,0x01,0x93,0xff,0x90,0x41,0x8c,0x74,0x01,0x93,0x2f,0xff,0xe4,
+0x93,0x3e,0xc3,0x13,0xfe,0xef,0x13,0xff,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,
+0x34,0x95,0xf5,0x83,0xee,0xf0,0xa3,0xef,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x4b,
+0x12,0x43,0x5f,0x74,0x01,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x4a,0x12,0x43,0x5f,
+0x74,0x01,0xf0,0x74,0x82,0x2d,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0x74,0x0c,0xf0,
+0x75,0xf0,0x09,0xed,0x90,0x96,0x46,0x12,0x43,0x5f,0x74,0xff,0xf0,0xa3,0xf0,0x75,
+0xf0,0x09,0xed,0x90,0x96,0x44,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0x74,0x0f,0xf0,0x75,
+0xf0,0x09,0xed,0x90,0x96,0x48,0x12,0x43,0x5f,0x74,0x13,0xf0,0x75,0xf0,0x09,0xed,
+0x90,0x96,0x49,0x12,0x43,0x5f,0xe4,0xf0,0xed,0xc3,0x94,0x20,0x50,0x0f,0x74,0x84,
+0x2d,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0x74,0x13,0xf0,0x80,0x0d,0x74,0xa6,0x2d,
+0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0x74,0x13,0xf0,0x0d,0xed,0x64,0x40,0x60,0x03,
+0x02,0x6f,0xcf,0x22,0x12,0x24,0x62,0xf5,0x59,0xc3,0x94,0x40,0x50,0x15,0x90,0x00,
+0x02,0x12,0x42,0x20,0xff,0x74,0x44,0x25,0x59,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,
+0xef,0xf0,0x22,0xe5,0x59,0xb4,0x40,0x0a,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x96,
+0x42,0xf0,0x22,0x90,0x00,0x04,0x12,0x42,0x20,0xff,0x54,0x3f,0xfe,0xef,0x54,0x80,
+0xc4,0x13,0x13,0x13,0x54,0x01,0xfd,0xaf,0x06,0x02,0x53,0xa4,0x12,0x24,0x62,0x90,
+0x95,0x01,0xf0,0x22,0x12,0x24,0x62,0xf5,0x73,0x22,0x90,0x00,0x02,0x12,0x42,0x20,
+0xff,0x30,0xe0,0x25,0x12,0x24,0x62,0x90,0x9e,0x56,0xf0,0x90,0x00,0x01,0x12,0x42,
+0x20,0x90,0x9e,0x57,0xf0,0xef,0xc3,0x13,0x54,0x7f,0x90,0x9e,0x55,0xf0,0x90,0x00,
+0x03,0x12,0x42,0x20,0x90,0x9e,0x5b,0xf0,0x22,0x90,0x9e,0x56,0x74,0x01,0xf0,0x90,
+0x9e,0x57,0x74,0x03,0xf0,0x90,0x9e,0x55,0x74,0x14,0xf0,0x90,0x9e,0x5b,0x74,0x05,
+0xf0,0x22,0x12,0x24,0x62,0x30,0xe0,0x18,0xc3,0x13,0x54,0x7f,0x90,0x9e,0x5a,0xf0,
+0x90,0x00,0x01,0x12,0x42,0x20,0xff,0x90,0x9e,0x58,0xe4,0xf0,0xa3,0xef,0xf0,0x22,
+0x90,0x9e,0x5a,0x74,0x07,0xf0,0x90,0x9e,0x58,0xe4,0xf0,0xa3,0x74,0x02,0xf0,0x22,
+0x90,0x02,0x09,0xe0,0xfd,0x12,0x24,0x62,0xfe,0xaf,0x05,0xed,0x2e,0x90,0x9e,0x67,
+0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x9e,0x68,0xf0,0x90,0x00,
+0x02,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x9e,0x69,0xf0,0x90,0x00,0x03,0x12,0x42,
+0x20,0xff,0xed,0x2f,0x90,0x9e,0x6a,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0xff,0xae,
+0x05,0xed,0x2f,0x90,0x9e,0x6b,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,
+0x9e,0x3f,0x12,0x43,0x8b,0x90,0x9e,0x3f,0x12,0x43,0x6b,0x90,0x00,0x01,0x12,0x42,
+0xc2,0xfa,0xe5,0xf0,0x24,0x00,0xff,0xe4,0x3a,0xfe,0x90,0x9e,0x3f,0x12,0x43,0x6b,
+0x90,0x00,0x01,0xee,0x8f,0xf0,0x12,0x43,0x19,0x12,0x24,0x62,0xff,0x60,0x2c,0xb5,
+0x22,0x16,0x90,0x9e,0x3f,0x12,0x43,0x6b,0x90,0x00,0x01,0x12,0x42,0xc2,0x65,0x24,
+0x70,0x04,0xe5,0x23,0x65,0xf0,0x60,0x23,0x90,0x9e,0x3f,0x12,0x43,0x6b,0x90,0x00,
+0x01,0x12,0x42,0xc2,0xff,0xae,0xf0,0x71,0x00,0x80,0x10,0x90,0x9e,0x3f,0x12,0x43,
+0x6b,0x12,0x24,0x62,0x65,0x22,0x60,0x03,0x12,0x44,0xca,0xd0,0xd0,0x92,0xaf,0x22,
+0x90,0x9e,0x42,0xee,0xf0,0xa3,0xef,0xf0,0x75,0x22,0x01,0x8e,0x23,0xf5,0x24,0xe4,
+0xfd,0x7f,0x0b,0x71,0x44,0xe4,0xfd,0x7f,0x02,0x71,0x44,0x12,0x4f,0xbe,0xe4,0xff,
+0x12,0x44,0xf1,0xe4,0xf5,0x26,0x90,0x01,0xc9,0xe5,0x26,0xf0,0x90,0x9e,0x42,0xe0,
+0xfc,0xa3,0xe0,0xfd,0xec,0xfb,0x8d,0x44,0xe4,0xf5,0x45,0x7d,0x01,0x7f,0x60,0x7e,
+0x01,0x02,0x30,0x62,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x45,0xed,0xf0,
+0x90,0x9e,0x44,0xef,0xf0,0xd3,0x94,0x07,0x50,0x4f,0xa3,0xe0,0x70,0x1a,0x90,0x9e,
+0x44,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,
+0x90,0x00,0x47,0xe0,0x5f,0xf0,0x80,0x17,0x90,0x9e,0x44,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x47,0xe0,0x4f,0xf0,0x12,
+0x49,0xb9,0x90,0x9e,0x44,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xf4,0xff,0x90,0x00,0x46,0x80,0x5a,0x90,0x9e,0x44,0xe0,0x24,0xf8,0xf0,
+0xa3,0xe0,0x70,0x1d,0x90,0x9e,0x44,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,
+0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,0x80,
+0x1a,0x90,0x9e,0x44,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,
+0xfc,0xc4,0x54,0xf0,0xff,0x90,0x00,0x43,0xe0,0x4f,0xf0,0x12,0x49,0xb9,0x90,0x9e,
+0x44,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,
+0x90,0x00,0x43,0xe0,0x5f,0xf0,0x12,0x49,0xb9,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x6d,0xe0,0x90,0x9e,0x40,0xf0,0x90,0x9e,0x6e,
+0xe0,0xf5,0x64,0xa3,0xe0,0xf5,0x65,0xe4,0xf5,0x61,0x74,0x70,0x25,0x61,0xf5,0x82,
+0xe4,0x34,0x9e,0xf5,0x83,0xe0,0xff,0x74,0x66,0x25,0x61,0xf8,0xa6,0x07,0x05,0x61,
+0xe5,0x61,0xb4,0x04,0xe5,0x90,0x9e,0x40,0xe0,0x12,0x43,0x94,0x74,0x6b,0x00,0x75,
+0x93,0x01,0x74,0x71,0x02,0x74,0x71,0x03,0x74,0x71,0x04,0x75,0x93,0x05,0x75,0x63,
+0x80,0x75,0x79,0x81,0x75,0x93,0x82,0x00,0x00,0x75,0x8f,0xaf,0x69,0xb1,0x9a,0xa1,
+0x93,0x90,0x9e,0x40,0xe0,0xff,0xb4,0x02,0x08,0x90,0x9e,0x3f,0x74,0x01,0xf0,0x80,
+0x0f,0xef,0x90,0x9e,0x3f,0xb4,0x03,0x05,0x74,0x02,0xf0,0x80,0x03,0x74,0x04,0xf0,
+0xc3,0xe5,0x64,0x94,0x08,0x50,0x49,0xe4,0xf5,0x61,0x90,0x9e,0x3f,0xe0,0xff,0xe5,
+0x61,0xc3,0x9f,0x40,0x02,0xa1,0x93,0xc3,0xe5,0x64,0x94,0x01,0x50,0x14,0xe5,0x61,
+0x25,0x65,0xff,0xc3,0x74,0x03,0x95,0x61,0x24,0x66,0xf8,0xe6,0xfd,0x12,0x4a,0xc1,
+0x80,0x1a,0xc3,0x74,0x03,0x95,0x61,0x24,0x66,0xf8,0xe6,0xff,0xe5,0x61,0x7c,0x00,
+0x25,0x65,0xfd,0xec,0x35,0x64,0x8d,0x82,0xf5,0x83,0xef,0xf0,0x05,0x61,0x80,0xba,
+0xc3,0xe5,0x64,0x94,0x10,0x40,0x02,0xa1,0x93,0x90,0x9e,0x40,0xe0,0x64,0x04,0x60,
+0x02,0xa1,0x93,0xaf,0x67,0xfc,0xfd,0xfe,0x78,0x10,0x12,0x24,0xf5,0xc0,0x04,0xc0,
+0x05,0xc0,0x06,0xc0,0x07,0xaf,0x66,0xe4,0xfc,0xfd,0xfe,0x78,0x18,0x12,0x24,0xf5,
+0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0x12,0x43,0x46,0xc0,0x04,0xc0,0x05,0xc0,
+0x06,0xc0,0x07,0xaf,0x68,0xe4,0xfc,0xfd,0xfe,0x78,0x08,0x12,0x24,0xf5,0xd0,0x03,
+0xd0,0x02,0xd0,0x01,0xd0,0x00,0x12,0x43,0x46,0xa8,0x04,0xa9,0x05,0xaa,0x06,0xab,
+0x07,0xaf,0x69,0xe4,0xfc,0xfd,0xfe,0x12,0x43,0x46,0xa3,0x12,0x25,0x08,0x90,0x9e,
+0x41,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0xaf,0x65,0xae,0x64,0x12,0x2b,
+0x08,0x80,0x30,0xe5,0x68,0x7f,0x00,0xfe,0xef,0x25,0x69,0xf5,0x63,0xe4,0x3e,0xf5,
+0x62,0xaf,0x63,0xfe,0x12,0x32,0x15,0x80,0x1a,0xe5,0x68,0x7f,0x00,0xfe,0xef,0x25,
+0x69,0xf5,0x63,0xe4,0x3e,0xf5,0x62,0xaf,0x63,0xfe,0x12,0x31,0x82,0x80,0x04,0x7f,
+0x00,0x80,0x02,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,0x8f,0x6a,0xe4,0x90,0x9e,0x45,
+0xf0,0xe5,0x6a,0x14,0xfe,0x90,0x9e,0x45,0xe0,0xff,0xc3,0x9e,0x50,0x0e,0xef,0x04,
+0xfd,0x12,0x2d,0x4d,0x90,0x9e,0x45,0xe0,0x04,0xf0,0x80,0xe5,0xe5,0x6a,0x14,0xff,
+0x7d,0xff,0x12,0x2d,0x4d,0x90,0x9e,0x45,0xe5,0x6a,0xf0,0x90,0x9e,0x45,0xe0,0xc3,
+0x94,0xff,0x50,0x0f,0xe0,0xff,0x04,0xfd,0x12,0x2d,0x4d,0x90,0x9e,0x45,0xe0,0x04,
+0xf0,0x80,0xe8,0xad,0x6a,0x7f,0xff,0x02,0x2d,0x4d,0xd3,0x10,0xaf,0x01,0xc3,0xc0,
+0xd0,0xe4,0xf5,0x5b,0x75,0x5c,0x04,0xf5,0x5d,0xf5,0x5f,0xf5,0x60,0x90,0x02,0x09,
+0xe0,0xff,0x12,0x24,0x62,0xfe,0xef,0x2e,0xf5,0x5e,0x30,0xe0,0x08,0x75,0x59,0x00,
+0x75,0x5a,0x80,0x80,0x05,0xe4,0xf5,0x59,0xf5,0x5a,0xe5,0x5e,0xc3,0x13,0x90,0xfd,
+0x10,0xf0,0x74,0x20,0x25,0x5b,0xf5,0x5b,0xad,0x5a,0xe5,0x5b,0x2d,0xff,0x24,0x01,
+0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x90,0x9e,0x6d,0xf0,0x74,0x02,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0xfe,0xe5,0x5b,0x2d,0x24,0x03,0xf5,0x82,0xe4,
+0x34,0xfc,0xf5,0x83,0xe0,0x24,0x00,0xff,0xe4,0x3e,0x90,0x9e,0x6e,0xf0,0xa3,0xef,
+0xf0,0x7f,0x04,0xe5,0x5b,0x25,0x5a,0x2f,0x24,0x00,0xf5,0x82,0xe4,0x34,0xfc,0xf5,
+0x83,0xe0,0xfe,0x74,0x6c,0x2f,0xf5,0x82,0xe4,0x34,0x9e,0xf5,0x83,0xee,0xf0,0x0f,
+0xbf,0x08,0xe0,0x91,0x0e,0xef,0x70,0x3f,0x90,0x01,0xc3,0xe0,0x60,0x25,0xc3,0xe5,
+0x60,0x94,0xe8,0xe5,0x5f,0x94,0x03,0x40,0x09,0x90,0x01,0xc6,0xe0,0x44,0x10,0xf0,
+0x80,0x63,0x05,0x60,0xe5,0x60,0x70,0x02,0x05,0x5f,0x7f,0x0a,0x7e,0x00,0x12,0x32,
+0x15,0x80,0xd5,0x90,0x01,0xc6,0xe0,0x90,0x01,0xc3,0x30,0xe2,0x05,0x74,0xfe,0xf0,
+0x80,0x43,0x74,0xff,0xf0,0x80,0x3e,0xe5,0x5b,0xb4,0x78,0x23,0xe4,0xf5,0x5b,0x05,
+0x5e,0xe5,0x5a,0x64,0x80,0x45,0x59,0x70,0x06,0xf5,0x59,0xf5,0x5a,0x80,0x06,0x75,
+0x59,0x00,0x75,0x5a,0x80,0xe5,0x5e,0xc3,0x13,0x90,0xfd,0x10,0xf0,0x80,0x06,0x74,
+0x08,0x25,0x5b,0xf5,0x5b,0xe5,0x5d,0x15,0x5d,0x70,0x02,0x15,0x5c,0xe5,0x5d,0x45,
+0x5c,0x60,0x02,0xc1,0x28,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x06,0x34,0x74,0xff,0xf0,
+0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x22,0xe4,0xf5,0x25,0x22,0xe4,0x90,0x9e,0xaa,
+0xf0,0xa3,0xf0,0x90,0x05,0xf8,0xe0,0x70,0x0f,0xa3,0xe0,0x70,0x0b,0xa3,0xe0,0x70,
+0x07,0xa3,0xe0,0x70,0x03,0x7f,0x01,0x22,0xd3,0x90,0x9e,0xab,0xe0,0x94,0xe8,0x90,
+0x9e,0xaa,0xe0,0x94,0x03,0x40,0x03,0x7f,0x00,0x22,0x7f,0x32,0x7e,0x00,0x12,0x32,
+0x15,0x90,0x9e,0xaa,0xe4,0x75,0xf0,0x01,0x12,0x42,0x81,0x80,0xc6,0x90,0x9e,0x77,
+0xe0,0x90,0x9e,0x0f,0xf0,0x22,0xef,0x70,0x03,0x02,0x79,0x1e,0x90,0x9e,0x0f,0xe0,
+0x60,0x03,0x02,0x7c,0xe9,0x90,0x9d,0xfb,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,
+0x08,0x7f,0x8c,0x7e,0x08,0x12,0x2b,0x08,0x90,0x9d,0xa7,0x12,0x43,0x53,0x90,0x80,
+0x96,0x12,0x25,0x08,0x7f,0x44,0x7e,0x08,0x12,0x2b,0x08,0x90,0x9d,0xab,0x12,0x43,
+0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x5c,0x7e,0x08,0x12,0x2b,0x08,0x90,0x9d,
+0xaf,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x6c,0x7e,0x0e,0x12,0x2b,
+0x08,0x90,0x9d,0xb3,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x70,0x7e,
+0x0e,0x12,0x2b,0x08,0x90,0x9d,0xb7,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,
+0x7f,0x74,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x9d,0xbb,0x12,0x43,0x53,0x90,0x80,0x96,
+0x12,0x25,0x08,0x7f,0x78,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x9d,0xbf,0x12,0x43,0x53,
+0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x7c,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x9d,0xc3,
+0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x0e,0x12,0x2b,0x08,
+0x90,0x9d,0xc7,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x84,0x7e,0x0e,
+0x12,0x2b,0x08,0x90,0x9d,0xcb,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,
+0x88,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x9d,0xcf,0x12,0x43,0x53,0x90,0x80,0x96,0x12,
+0x25,0x08,0x7f,0x8c,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x9d,0xd3,0x12,0x43,0x53,0x90,
+0x80,0x96,0x12,0x25,0x08,0x7f,0xd0,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x9d,0xd7,0x12,
+0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0xd4,0x7e,0x0e,0x12,0x2b,0x08,0x90,
+0x9d,0xdb,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0xd8,0x7e,0x0e,0x12,
+0x2b,0x08,0x90,0x9d,0xdf,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0xdc,
+0x7e,0x0e,0x12,0x2b,0x08,0x90,0x9d,0xe3,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,
+0x08,0x7f,0xe0,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x9d,0xe7,0x12,0x43,0x53,0x90,0x80,
+0x96,0x12,0x25,0x08,0x7f,0xec,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x9d,0xeb,0x12,0x43,
+0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x04,0x7e,0x0c,0x12,0x2b,0x08,0x90,0x9d,
+0xef,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x04,0x7e,0x0d,0x12,0x2b,
+0x08,0x90,0x9d,0xf3,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x0c,0x7e,
+0x09,0x12,0x2b,0x08,0x90,0x9d,0xf7,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,
+0x7f,0x04,0x7e,0x08,0x12,0x2b,0x08,0x90,0x9e,0x0f,0x74,0x01,0xf0,0x22,0x90,0x9e,
+0x0f,0xe0,0x64,0x01,0x60,0x02,0x81,0xe9,0x7f,0x8c,0x7e,0x08,0x12,0x22,0x65,0x90,
+0x9d,0xfb,0x12,0x25,0x08,0x7f,0x44,0x7e,0x08,0x12,0x22,0x65,0x90,0x9d,0xa7,0x12,
+0x25,0x08,0x7f,0x5c,0x7e,0x08,0x12,0x22,0x65,0x90,0x9d,0xab,0x12,0x25,0x08,0x7f,
+0x6c,0x7e,0x0e,0x12,0x22,0x65,0x90,0x9d,0xaf,0x12,0x25,0x08,0x7f,0x70,0x7e,0x0e,
+0x12,0x22,0x65,0x90,0x9d,0xb3,0x12,0x25,0x08,0x7f,0x74,0x7e,0x0e,0x12,0x22,0x65,
+0x90,0x9d,0xb7,0x12,0x25,0x08,0x7f,0x78,0x7e,0x0e,0x12,0x22,0x65,0x90,0x9d,0xbb,
+0x12,0x25,0x08,0x7f,0x7c,0x7e,0x0e,0x12,0x22,0x65,0x90,0x9d,0xbf,0x12,0x25,0x08,
+0x7f,0x80,0x7e,0x0e,0x12,0x22,0x65,0x90,0x9d,0xc3,0x12,0x25,0x08,0x7f,0x84,0x7e,
+0x0e,0x12,0x22,0x65,0x90,0x9d,0xc7,0x12,0x25,0x08,0x7f,0x88,0x7e,0x0e,0x12,0x22,
+0x65,0x90,0x9d,0xcb,0x12,0x25,0x08,0x7f,0x8c,0x7e,0x0e,0x12,0x22,0x65,0x90,0x9d,
+0xcf,0x12,0x25,0x08,0x7f,0xd0,0x7e,0x0e,0x12,0x22,0x65,0x90,0x9d,0xd3,0x12,0x25,
+0x08,0x7f,0xd4,0x7e,0x0e,0x12,0x22,0x65,0x90,0x9d,0xd7,0x12,0x25,0x08,0x7f,0xd8,
+0x7e,0x0e,0x12,0x22,0x65,0x90,0x9d,0xdb,0x12,0x25,0x08,0x7f,0xdc,0x7e,0x0e,0x12,
+0x22,0x65,0x90,0x9d,0xdf,0x12,0x25,0x08,0x7f,0xe0,0x7e,0x0e,0x12,0x22,0x65,0x90,
+0x9d,0xe3,0x12,0x25,0x08,0x7f,0xec,0x7e,0x0e,0x12,0x22,0x65,0x90,0x9d,0xe7,0x12,
+0x25,0x08,0x7f,0x04,0x7e,0x0c,0x12,0x22,0x65,0x90,0x9d,0xeb,0x12,0x25,0x08,0x7f,
+0x04,0x7e,0x0d,0x12,0x22,0x65,0x90,0x9d,0xef,0x12,0x25,0x08,0x7f,0x0c,0x7e,0x09,
+0x12,0x22,0x65,0x90,0x9d,0xf3,0x12,0x25,0x08,0x7f,0x04,0x7e,0x08,0x12,0x22,0x65,
+0x90,0x9d,0xf7,0x12,0x25,0x08,0x7f,0x8c,0x7e,0x08,0x12,0x22,0x65,0x90,0x9e,0xa4,
+0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0xed,0x44,0xc0,0xfd,0xec,0x90,0x9e,
+0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,
+0x7f,0x8c,0x7e,0x08,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x00,0x01,0x00,
+0x00,0x7f,0x44,0x7e,0x08,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x00,0xdb,
+0x25,0xa4,0x7f,0x5c,0x7e,0x08,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,
+0xdb,0x25,0xa4,0x7f,0x6c,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,
+0x20,0xdb,0x25,0xa4,0x7f,0x70,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,
+0x14,0x04,0x1b,0x25,0xa4,0x7f,0x74,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,
+0x25,0x14,0x04,0x1b,0x25,0xa4,0x7f,0x78,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,
+0x12,0x25,0x14,0x04,0x1b,0x25,0xa4,0x7f,0x7c,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,
+0x96,0x12,0x25,0x14,0x04,0x1b,0x25,0xa4,0x7f,0x80,0x7e,0x0e,0x12,0x2b,0x08,0x90,
+0x80,0x96,0x12,0x25,0x14,0x63,0xdb,0x25,0xa4,0x7f,0x84,0x7e,0x0e,0x12,0x2b,0x08,
+0x90,0x80,0x96,0x12,0x25,0x14,0x04,0x1b,0x25,0xa4,0x7f,0x88,0x7e,0x0e,0x12,0x2b,
+0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,0xdb,0x25,0xa4,0x7f,0x8c,0x7e,0x0e,0x12,
+0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,0xdb,0x25,0xa4,0x7f,0xd0,0x7e,0x0e,
+0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,0xdb,0x25,0xa4,0x7f,0xd4,0x7e,
+0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,0xdb,0x25,0xa4,0x7f,0xd8,
+0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x00,0x1b,0x25,0xa4,0x7f,
+0xdc,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x00,0x1b,0x25,0xa4,
+0x7f,0xe0,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x24,0xdb,0x25,
+0xa4,0x7f,0xec,0x7e,0x0e,0x12,0x2b,0x08,0x7f,0x04,0x7e,0x0c,0x12,0x22,0x65,0x90,
+0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0xe4,0xff,0xec,0x90,0x9e,
+0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0xef,0x44,0x11,0xff,0xec,0x90,
+0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,
+0x08,0x7f,0x04,0x7e,0x0c,0x12,0x2b,0x08,0x7f,0x04,0x7e,0x0d,0x12,0x22,0x65,0x90,
+0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0xef,0x54,0xf0,0xff,0xec,
+0x90,0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0xef,0x44,0x01,0xff,
+0xec,0x90,0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0x90,0x80,0x96,
+0x12,0x25,0x08,0x7f,0x04,0x7e,0x0d,0x12,0x2b,0x08,0x7f,0x0c,0x7e,0x09,0x12,0x22,
+0x65,0x90,0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0xe4,0xff,0xec,
+0x90,0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0xef,0x44,0x11,0xff,
+0xec,0x90,0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0x90,0x80,0x96,
+0x12,0x25,0x08,0x7f,0x0c,0x7e,0x09,0x12,0x2b,0x08,0x7f,0x0c,0x7e,0x09,0x12,0x22,
+0x65,0x90,0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0xed,0x54,0x0f,
+0xfd,0xec,0x54,0xf0,0xfc,0x90,0x9e,0xa4,0x12,0x25,0x08,0x90,0x9e,0xa4,0x12,0x43,
+0x53,0xed,0x44,0x10,0xfd,0xec,0x44,0x01,0xfc,0x90,0x9e,0xa4,0x12,0x25,0x08,0x90,
+0x9e,0xa4,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x0c,0x7e,0x09,0x12,
+0x2b,0x08,0x7f,0x04,0x7e,0x08,0x12,0x22,0x65,0x90,0x9e,0xa4,0x12,0x25,0x08,0x90,
+0x9e,0xa4,0x12,0x43,0x53,0xef,0x54,0xf0,0xff,0xec,0x90,0x9e,0xa4,0x12,0x25,0x08,
+0x90,0x9e,0xa4,0x12,0x43,0x53,0xef,0x44,0x01,0xff,0xec,0x90,0x9e,0xa4,0x12,0x25,
+0x08,0x90,0x9e,0xa4,0x12,0x43,0x53,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x04,0x7e,
+0x08,0x12,0x2b,0x08,0xe4,0x90,0x9e,0x0f,0xf0,0x22,0x90,0x00,0x02,0x12,0x42,0x20,
+0x90,0x9e,0x1e,0xf0,0xe0,0x60,0x04,0xe0,0xf4,0x70,0x21,0xa2,0xaf,0xe4,0x33,0xf5,
+0x59,0xc2,0xaf,0x90,0x00,0x47,0xe0,0x54,0xfb,0xfd,0x7f,0x47,0x12,0x4a,0xc1,0x7d,
+0x40,0x7f,0x01,0x12,0x31,0x66,0xe5,0x59,0x24,0xff,0x92,0xaf,0x22,0xe4,0xfd,0x7f,
+0x45,0x12,0x4a,0xc1,0x90,0x04,0xfd,0xe4,0xf0,0xa3,0xf0,0x90,0x9e,0x1e,0xf0,0x90,
+0x9e,0x24,0xf0,0x90,0x9e,0x27,0xf0,0x90,0x9e,0x25,0xf0,0x90,0x9e,0x28,0xf0,0x90,
+0x9e,0x26,0xf0,0x90,0x9e,0x29,0xf0,0x90,0x9e,0x10,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,
+0xf0,0xa3,0xf0,0x90,0x9e,0x15,0xf0,0x90,0x9e,0x1a,0xf0,0x90,0x9e,0x1c,0xf0,0x90,
+0x9e,0x2e,0xf0,0x90,0x9e,0x1f,0xf0,0x90,0x9e,0x1b,0xf0,0x90,0x9e,0x14,0xf0,0x90,
+0x00,0x51,0xe0,0x44,0xc0,0xfd,0x7f,0x51,0x02,0x4a,0xc1,0x90,0x9e,0x15,0xe0,0xc3,
+0x94,0x14,0x50,0x05,0xe0,0x04,0xf0,0xc1,0x33,0x90,0x9e,0x15,0xe0,0x64,0x14,0x60,
+0x02,0xc1,0x33,0x90,0x9e,0x24,0xe0,0x70,0x25,0x90,0x9e,0x27,0xe0,0x70,0x1f,0x90,
+0x9e,0x25,0xe0,0x70,0x19,0x90,0x9e,0x28,0xe0,0x70,0x13,0x90,0x9e,0x26,0xe0,0x70,
+0x0d,0x90,0x9e,0x29,0xe0,0x70,0x07,0x90,0x04,0xfd,0xe0,0x54,0xfe,0xf0,0x90,0x9e,
+0x24,0xe0,0x90,0x04,0x44,0xf0,0x90,0x9e,0x25,0xe0,0x90,0x04,0x45,0xf0,0x90,0x9e,
+0x26,0xe0,0x90,0x04,0x46,0xf0,0xa3,0xe4,0xf0,0x90,0x9e,0x27,0xe0,0x90,0x04,0x48,
+0xf0,0x90,0x9e,0x28,0xe0,0x90,0x04,0x49,0xf0,0x90,0x9e,0x29,0xe0,0x90,0x04,0x4a,
+0xf0,0xa3,0xe4,0xf0,0x90,0x9e,0x10,0xe0,0x90,0x04,0x4c,0xf0,0x90,0x9e,0x11,0xe0,
+0x90,0x04,0x4d,0xf0,0x90,0x9e,0x12,0xe0,0x90,0x04,0x4e,0xf0,0x90,0x9e,0x13,0xe0,
+0x90,0x04,0x4f,0xf0,0xe4,0x90,0x9e,0x15,0xf0,0x90,0x9e,0x10,0x04,0xf0,0xe4,0xa3,
+0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x9e,0x24,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,
+0xf0,0xa3,0xf0,0x90,0x05,0x60,0xe0,0x90,0x9e,0x34,0xf0,0x90,0x05,0x61,0xe0,0x90,
+0x9e,0x35,0xf0,0x90,0x05,0x62,0xe0,0x90,0x9e,0x36,0xf0,0x90,0x05,0x63,0xe0,0x90,
+0x9e,0x37,0xf0,0x90,0x9e,0x2d,0xe0,0xff,0x90,0x9e,0x37,0xe0,0xfe,0xd3,0x9f,0x50,
+0x0b,0x90,0x9e,0x2d,0xe0,0xc3,0x9e,0xd3,0x94,0x01,0x40,0x11,0x90,0x9e,0x1b,0xe0,
+0xb4,0x01,0x02,0x80,0x03,0x90,0x9e,0x1f,0xe0,0xff,0x12,0x4e,0xd8,0x22,0x90,0x9e,
+0x2e,0xe0,0x64,0x01,0x60,0x08,0x90,0x9e,0x1c,0xe0,0x60,0x02,0xe1,0x55,0x90,0x9e,
+0x10,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x3b,0x90,0x9e,0x11,0xe0,
+0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x28,0x90,0x9e,0x12,0xe0,0xc3,
+0x94,0xff,0x50,0x0a,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x11,0xf0,0x80,0x15,0x90,0x9e,
+0x13,0xe0,0xc3,0x94,0xff,0x50,0x10,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x12,0xf0,0x90,
+0x9e,0x11,0xf0,0x90,0x9e,0x10,0xf0,0x90,0x00,0x44,0xe0,0x54,0x0c,0x60,0x76,0xe0,
+0x30,0xe2,0x32,0x90,0x9e,0x24,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,
+0x24,0x90,0x9e,0x25,0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x11,
+0x90,0x9e,0x26,0xe0,0xc3,0x94,0xff,0x50,0x0c,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x25,
+0xf0,0x90,0x9e,0x24,0xf0,0x90,0x00,0x44,0xe0,0x30,0xe3,0x32,0x90,0x9e,0x27,0xe0,
+0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x24,0x90,0x9e,0x28,0xe0,0xc3,0x94,
+0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x11,0x90,0x9e,0x29,0xe0,0xc3,0x94,0xff,
+0x50,0x0c,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x28,0xf0,0x90,0x9e,0x27,0xf0,0x90,0x04,
+0xfd,0xe0,0x44,0x01,0xf0,0x22,0xf5,0x67,};
+
+// =================== v84 UMC B Cut COMMON 2012-04-13 =====================
+u8 Rtl8192CUFwUMCBCutImgArray[UMCBCutImgArrayLength] = {
+0xc2,0x88,0x02,0x00,0x54,0x00,0x01,0x00,0x04,0x13,0x11,0x08,0x26,0x3d,0x01,0x00,
+0x58,0x97,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x02,0x43,0xba,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x50,0xa1,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x57,0x91,0x00,0x00,0x00,0x00,0x00,0xa1,0xe8,0x00,0x00,0x00,
+0x05,0x04,0x03,0x02,0x00,0x03,0x06,0x05,0x04,0x03,0x00,0x04,0x06,0x05,0x04,0x02,
+0x00,0x04,0x08,0x07,0x06,0x04,0x00,0x06,0x0a,0x09,0x08,0x06,0x00,0x08,0x0a,0x09,
+0x08,0x04,0x00,0x08,0x0a,0x09,0x08,0x02,0x00,0x08,0x0a,0x09,0x08,0x00,0x00,0x08,
+0x12,0x11,0x10,0x08,0x00,0x10,0x1a,0x19,0x18,0x10,0x00,0x18,0x22,0x21,0x20,0x18,
+0x00,0x20,0x22,0x21,0x20,0x10,0x00,0x20,0x22,0x21,0x20,0x08,0x00,0x20,0x22,0x21,
+0x1c,0x08,0x00,0x20,0x22,0x21,0x14,0x08,0x00,0x20,0x22,0x20,0x18,0x08,0x00,0x20,
+0x31,0x30,0x20,0x10,0x00,0x30,0x31,0x30,0x18,0x00,0x00,0x30,0x31,0x2f,0x10,0x10,
+0x00,0x30,0x31,0x2c,0x10,0x10,0x00,0x30,0x31,0x28,0x10,0x00,0x00,0x30,0x31,0x20,
+0x10,0x00,0x00,0x30,0x31,0x10,0x10,0x00,0x00,0x30,0x04,0x04,0x04,0x05,0x04,0x04,
+0x04,0x05,0x05,0x05,0x06,0x06,0x04,0x04,0x04,0x05,0x05,0x05,0x06,0x06,0x04,0x04,
+0x05,0x05,0x05,0x05,0x06,0x06,0x04,0x04,0x05,0x05,0x05,0x05,0x06,0x07,0x0a,0x0b,
+0x0d,0x10,0x04,0x05,0x05,0x06,0x06,0x09,0x0c,0x11,0x08,0x08,0x09,0x09,0x0a,0x0c,
+0x10,0x11,0x04,0x04,0x04,0x05,0x04,0x04,0x05,0x07,0x07,0x07,0x08,0x0a,0x04,0x04,
+0x04,0x04,0x06,0x0a,0x0b,0x0d,0x05,0x05,0x07,0x07,0x08,0x0b,0x0d,0x0f,0x04,0x04,
+0x04,0x05,0x07,0x07,0x09,0x09,0x0c,0x0e,0x10,0x12,0x04,0x04,0x05,0x05,0x06,0x0a,
+0x11,0x13,0x09,0x09,0x09,0x09,0x0c,0x0e,0x11,0x13,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x24,0x26,0x2a,0x18,0x1a,0x1d,0x1f,0x21,0x27,0x29,0x2a,0x00,0x00,
+0x00,0x1f,0x23,0x28,0x2a,0x2c,0x00,0x04,0x00,0x04,0x00,0x08,0x00,0x10,0x00,0x18,
+0x00,0x24,0x00,0x30,0x00,0x48,0x00,0x60,0x00,0x90,0x00,0xc0,0x00,0xd8,0x00,0x50,
+0x00,0x78,0x00,0xa0,0x00,0xc8,0x01,0x40,0x01,0x90,0x01,0xe0,0x02,0x30,0x01,0x2c,
+0x01,0x40,0x01,0xe0,0x02,0xd0,0x03,0xe8,0x04,0xb0,0x06,0x40,0x07,0xd0,0x00,0x02,
+0x00,0x02,0x00,0x04,0x00,0x08,0x00,0x0c,0x00,0x12,0x00,0x18,0x00,0x24,0x00,0x30,
+0x00,0x48,0x00,0x60,0x00,0x6c,0x00,0x28,0x00,0x3c,0x00,0x50,0x00,0x64,0x00,0xa0,
+0x00,0xc8,0x00,0xf0,0x01,0x18,0x00,0x64,0x00,0xa0,0x00,0xf0,0x01,0x68,0x01,0xf4,
+0x02,0x58,0x03,0x20,0x03,0xe8,0x02,0x02,0x02,0x02,0x02,0x02,0x03,0x03,0x04,0x04,
+0x05,0x07,0x04,0x04,0x07,0x0a,0x0a,0x0c,0x0c,0x12,0x05,0x07,0x07,0x08,0x0b,0x12,
+0x24,0x3c,0x01,0x01,0x01,0x01,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x01,0x02,
+0x03,0x04,0x05,0x06,0x07,0x08,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x20,0x1e,
+0x1c,0x18,0x10,0x18,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0xbb,0x01,0x0c,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe0,0x22,0x50,
+0x06,0xe9,0x25,0x82,0xf8,0xe6,0x22,0xbb,0xfe,0x06,0xe9,0x25,0x82,0xf8,0xe2,0x22,
+0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe4,0x93,0x22,0xbb,0x01,0x06,
+0x89,0x82,0x8a,0x83,0xf0,0x22,0x50,0x02,0xf7,0x22,0xbb,0xfe,0x01,0xf3,0x22,0xf8,
+0xbb,0x01,0x0d,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0x22,
+0x50,0x06,0xe9,0x25,0x82,0xc8,0xf6,0x22,0xbb,0xfe,0x05,0xe9,0x25,0x82,0xc8,0xf2,
+0x22,0xc5,0xf0,0xf8,0xa3,0xe0,0x28,0xf0,0xc5,0xf0,0xf8,0xe5,0x82,0x15,0x82,0x70,
+0x02,0x15,0x83,0xe0,0x38,0xf0,0x22,0xbb,0x01,0x0a,0x89,0x82,0x8a,0x83,0xe0,0xf5,
+0xf0,0xa3,0xe0,0x22,0x50,0x06,0x87,0xf0,0x09,0xe7,0x19,0x22,0xbb,0xfe,0x07,0xe3,
+0xf5,0xf0,0x09,0xe3,0x19,0x22,0x89,0x82,0x8a,0x83,0xe4,0x93,0xf5,0xf0,0x74,0x01,
+0x93,0x22,0xbb,0x01,0x10,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe0,
+0xf5,0xf0,0xa3,0xe0,0x22,0x50,0x09,0xe9,0x25,0x82,0xf8,0x86,0xf0,0x08,0xe6,0x22,
+0xbb,0xfe,0x0a,0xe9,0x25,0x82,0xf8,0xe2,0xf5,0xf0,0x08,0xe2,0x22,0xe5,0x83,0x2a,
+0xf5,0x83,0xe9,0x93,0xf5,0xf0,0xa3,0xe9,0x93,0x22,0xbb,0x01,0x0a,0x89,0x82,0x8a,
+0x83,0xf0,0xe5,0xf0,0xa3,0xf0,0x22,0x50,0x06,0xf7,0x09,0xa7,0xf0,0x19,0x22,0xbb,
+0xfe,0x06,0xf3,0xe5,0xf0,0x09,0xf3,0x19,0x22,0xf8,0xbb,0x01,0x11,0xe5,0x82,0x29,
+0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0xe5,0xf0,0xa3,0xf0,0x22,0x50,0x09,
+0xe9,0x25,0x82,0xc8,0xf6,0x08,0xa6,0xf0,0x22,0xbb,0xfe,0x09,0xe9,0x25,0x82,0xc8,
+0xf2,0xe5,0xf0,0x08,0xf2,0x22,0xef,0x4b,0xff,0xee,0x4a,0xfe,0xed,0x49,0xfd,0xec,
+0x48,0xfc,0x22,0xe0,0xfc,0xa3,0xe0,0xfd,0xa3,0xe0,0xfe,0xa3,0xe0,0xff,0x22,0xa4,
+0x25,0x82,0xf5,0x82,0xe5,0xf0,0x35,0x83,0xf5,0x83,0x22,0xe0,0xfb,0xa3,0xe0,0xfa,
+0xa3,0xe0,0xf9,0x22,0xf8,0xe0,0xfb,0xa3,0xa3,0xe0,0xf9,0x25,0xf0,0xf0,0xe5,0x82,
+0x15,0x82,0x70,0x02,0x15,0x83,0xe0,0xfa,0x38,0xf0,0x22,0xeb,0xf0,0xa3,0xea,0xf0,
+0xa3,0xe9,0xf0,0x22,0xd0,0x83,0xd0,0x82,0xf8,0xe4,0x93,0x70,0x12,0x74,0x01,0x93,
+0x70,0x0d,0xa3,0xa3,0x93,0xf8,0x74,0x01,0x93,0xf5,0x82,0x88,0x83,0xe4,0x73,0x74,
+0x02,0x93,0x68,0x60,0xef,0xa3,0xa3,0xa3,0x80,0xdf,0x02,0x43,0xf8,0x02,0x48,0x29,
+0xe4,0x93,0xa3,0xf8,0xe4,0x93,0xa3,0x40,0x03,0xf6,0x80,0x01,0xf2,0x08,0xdf,0xf4,
+0x80,0x29,0xe4,0x93,0xa3,0xf8,0x54,0x07,0x24,0x0c,0xc8,0xc3,0x33,0xc4,0x54,0x0f,
+0x44,0x20,0xc8,0x83,0x40,0x04,0xf4,0x56,0x80,0x01,0x46,0xf6,0xdf,0xe4,0x80,0x0b,
+0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x90,0x44,0x3d,0xe4,0x7e,0x01,0x93,0x60,
+0xbc,0xa3,0xff,0x54,0x3f,0x30,0xe5,0x09,0x54,0x1f,0xfe,0xe4,0x93,0xa3,0x60,0x01,
+0x0e,0xcf,0x54,0xc0,0x25,0xe0,0x60,0xa8,0x40,0xb8,0xe4,0x93,0xa3,0xfa,0xe4,0x93,
+0xa3,0xf8,0xe4,0x93,0xa3,0xc8,0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,0xf0,0xa3,0xc8,
+0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,0xdf,0xe9,0xde,0xe7,0x80,0xbe,0x41,0x9e,0x77,
+0x00,0x41,0x9e,0xae,0x00,0x41,0x9e,0x54,0x80,0x41,0x9e,0xb0,0x00,0x00,0xf0,0x90,
+0x9e,0x5d,0xe0,0x90,0x9e,0x86,0xf0,0xe4,0xfb,0xfd,0x7f,0x54,0x7e,0x01,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x85,0xe0,0xfb,0xa3,0xe0,0xf5,0x44,0xe4,0xf5,
+0x45,0x12,0x35,0xab,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x01,0x5f,0xe4,0xf0,0x90,0x01,
+0x3c,0x74,0x08,0xf0,0xe4,0x90,0x9e,0x85,0xf0,0x90,0x9e,0x5b,0xe0,0x90,0x9e,0x86,
+0xf0,0xe4,0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x91,0x5e,0x90,0x01,0x5f,0x74,0x05,0xf0,
+0x90,0x06,0x92,0x74,0x02,0xf0,0x90,0x9e,0x63,0x14,0xf0,0xe5,0x61,0x54,0x0f,0xc3,
+0x94,0x0c,0x50,0x03,0x12,0x54,0xe3,0x22,0x8f,0x82,0x8e,0x83,0xa3,0xa3,0xa3,0xe4,
+0xf0,0x22,0xe4,0xf5,0x65,0x7f,0x60,0x7e,0x01,0x80,0xed,0x7d,0x01,0xaf,0x62,0x02,
+0x54,0xe7,0xb1,0xb0,0xbf,0x01,0x12,0x90,0x9e,0x79,0xe0,0xff,0xe4,0xfd,0xf1,0x79,
+0x12,0x5f,0xf7,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0xb1,0xb0,0xbf,0x01,0x0f,0x90,
+0x02,0x09,0xe0,0xff,0x7d,0x01,0xf1,0x79,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0x22,
+0x22,0x22,0x00,0x02,0x45,0x03,0x02,0x45,0x06,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x8b,0x20,0x8a,0x21,0x89,0x22,0x90,0x9e,0x87,0x71,0x8b,0xab,0x23,0xaa,0x24,0xa9,
+0x25,0x90,0x9e,0x8a,0x71,0x8b,0xaf,0x26,0x15,0x26,0xef,0x60,0x1b,0x90,0x9e,0x8a,
+0xe4,0x75,0xf0,0x01,0x71,0x74,0x12,0x29,0xd9,0xff,0x90,0x9e,0x87,0xe4,0x75,0xf0,
+0x01,0x71,0x74,0xef,0x51,0x4d,0x80,0xde,0xab,0x20,0xaa,0x21,0xa9,0x22,0xd0,0xd0,
+0x92,0xaf,0x22,0x90,0x9e,0x11,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0x90,0x06,0xa9,
+0xe0,0x90,0x9e,0x10,0xf0,0xe0,0x54,0xc0,0x70,0x08,0x53,0x64,0xfe,0x53,0x64,0xfd,
+0x91,0xcb,0x90,0x9e,0x10,0xe0,0x30,0xe6,0x13,0x43,0x64,0x01,0x90,0x9e,0x66,0xe0,
+0x64,0x02,0x60,0x04,0x91,0xd2,0x80,0x07,0x91,0x79,0x80,0x03,0x53,0x64,0xfe,0x90,
+0x9e,0x10,0xe0,0x30,0xe7,0x16,0x43,0x64,0x02,0xe4,0x90,0x9e,0x85,0x91,0x4e,0x90,
+0x01,0x57,0x74,0x05,0xf0,0x90,0x9e,0x67,0x74,0x01,0xf0,0x22,0x53,0x64,0xfd,0x22,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x01,0xc4,0x74,0xb0,0xf0,0x74,0x45,0xa3,
+0xf0,0x90,0x04,0x1d,0xe0,0x60,0x1a,0x90,0x05,0x22,0xe0,0x54,0x90,0x60,0x07,0x90,
+0x01,0xc6,0xe0,0x44,0x40,0xf0,0x90,0x01,0xc7,0xe0,0x30,0xe1,0xe4,0x7f,0x00,0x80,
+0x02,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,
+0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,
+0x05,0xc0,0x06,0xc0,0x07,0x75,0x13,0x00,0x90,0x01,0xc4,0x74,0xe8,0xf0,0x74,0x45,
+0xa3,0xf0,0x53,0x91,0xdf,0x90,0x01,0x3c,0xe0,0x55,0x30,0xf5,0x34,0xa3,0xe0,0x55,
+0x31,0xf5,0x35,0xa3,0xe0,0x55,0x32,0xf5,0x36,0xa3,0xe0,0x55,0x33,0xf5,0x37,0xe5,
+0x34,0x30,0xe0,0x06,0x90,0x01,0x3c,0x74,0x01,0xf0,0xe5,0x34,0x30,0xe1,0x09,0x90,
+0x01,0x3c,0x74,0x02,0xf0,0x12,0x61,0xc9,0xe5,0x34,0x30,0xe2,0x38,0x90,0x01,0x3c,
+0x74,0x04,0xf0,0x90,0x06,0x92,0xe0,0x30,0xe0,0x24,0x90,0x9e,0x85,0xe4,0xf0,0x90,
+0x9e,0x5b,0xe0,0x90,0x9e,0x86,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,0x01,0x91,0x5e,
+0x90,0x01,0x5b,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x80,0x07,0x90,0x9e,
+0x64,0xe4,0xf0,0x91,0xcb,0xe5,0x34,0x30,0xe3,0x38,0x90,0x01,0x3c,0x74,0x08,0xf0,
+0x90,0x06,0x92,0xe0,0x30,0xe1,0x24,0x90,0x9e,0x85,0xe4,0xf0,0x90,0x9e,0x5b,0xe0,
+0x90,0x9e,0x86,0xf0,0xe4,0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x91,0x5e,0x90,0x01,0x5f,
+0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x02,0xf0,0x80,0x07,0x90,0x9e,0x63,0xe4,0xf0,
+0x91,0xcb,0xe5,0x34,0x30,0xe4,0x09,0x90,0x01,0x3c,0x74,0x10,0xf0,0x12,0x4b,0xfb,
+0xe5,0x34,0x30,0xe5,0x09,0x90,0x01,0x3c,0x74,0x20,0xf0,0x12,0x4c,0x3d,0xe5,0x35,
+0x30,0xe0,0x44,0x90,0x01,0x3d,0x74,0x01,0xf0,0x90,0x01,0x2f,0xe0,0x44,0x7f,0xf0,
+0x90,0x00,0x83,0xe0,0x54,0x0f,0xf5,0x13,0xb4,0x01,0x02,0x80,0x1c,0xe5,0x13,0xb4,
+0x02,0x05,0x90,0x00,0x83,0x80,0x12,0xe5,0x13,0xb4,0x04,0x05,0x90,0x00,0x83,0x80,
+0x08,0xe5,0x13,0xb4,0x0c,0x06,0x90,0x00,0x83,0xe0,0xf5,0x62,0x90,0x01,0xbb,0xe5,
+0x62,0xf0,0x12,0x60,0xc0,0x91,0xcb,0xe5,0x35,0x30,0xe2,0x06,0x90,0x01,0x3d,0x74,
+0x04,0xf0,0xe5,0x35,0x30,0xe4,0x06,0x90,0x01,0x3d,0x74,0x10,0xf0,0xe5,0x36,0x30,
+0xe0,0x06,0x90,0x01,0x3e,0x74,0x01,0xf0,0xe5,0x36,0x30,0xe1,0x06,0x90,0x01,0x3e,
+0x74,0x02,0xf0,0x74,0xe8,0x04,0x90,0x01,0xc4,0xf0,0x74,0x45,0xa3,0xf0,0xd0,0x07,
+0xd0,0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,
+0xd0,0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,0x90,0x9e,0x98,0xef,0xf0,0xa3,0xed,
+0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xe5,0x63,0x60,0x05,0xe4,0xff,0x12,0x54,0x97,0x90,
+0x9e,0x98,0xe0,0x30,0xe0,0x09,0x90,0x9e,0x9a,0xe4,0xf0,0xa3,0x74,0x80,0xf0,0x90,
+0x9e,0x98,0xe0,0xff,0xc3,0x13,0x90,0xfd,0x10,0xf0,0x90,0x04,0x25,0xef,0xf0,0x90,
+0x9e,0x99,0xe0,0x60,0x1f,0xa3,0xa3,0xe0,0xff,0x24,0x0f,0xf5,0x82,0xe4,0x34,0xfc,
+0xf5,0x83,0xe0,0x44,0x80,0xf0,0x74,0x10,0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,
+0xe0,0x44,0x80,0xf0,0x90,0x9e,0x9a,0xa3,0xe0,0xff,0xfd,0x24,0x08,0xf5,0x82,0xe4,
+0x34,0xfc,0xf5,0x83,0xe4,0xf0,0x74,0x09,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,
+0xe0,0x54,0xf0,0xf0,0x74,0x21,0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,
+0xf7,0xf0,0x90,0x9e,0x9a,0xe0,0xfe,0xa3,0xe0,0xff,0x22,0x75,0x28,0x33,0xe4,0xf5,
+0x29,0x75,0x2a,0x07,0xf5,0x2b,0x90,0x01,0x30,0xe5,0x28,0xf0,0xa3,0xe5,0x29,0xf0,
+0xa3,0xe5,0x2a,0xf0,0xa3,0xe5,0x2b,0xf0,0x22,0xe4,0x90,0x9e,0x16,0xf0,0xa3,0xf0,
+0x75,0x8e,0x02,0xf1,0xa1,0xf1,0xe9,0x90,0x9e,0x7e,0xef,0xf0,0xf1,0xdd,0x90,0x9e,
+0x80,0xef,0xf0,0xf1,0xf6,0x90,0x9e,0x75,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xf5,0x57,
+0x12,0x6e,0x77,0xf1,0xd4,0x12,0x60,0x4b,0x12,0x32,0x3d,0xf1,0xc9,0x11,0x0b,0x12,
+0x50,0x0e,0xf1,0xcd,0xf1,0xb1,0x12,0x44,0xff,0xf1,0x45,0x90,0x9e,0x18,0xe5,0xd9,
+0xf0,0x11,0xd0,0xc2,0xaf,0x90,0x00,0x80,0xe0,0x44,0x40,0xf0,0xb1,0x45,0x75,0xe8,
+0x03,0x43,0xa8,0x85,0xd2,0xaf,0x90,0x9e,0x16,0xe0,0x64,0x01,0xf0,0x24,0x29,0x90,
+0x01,0xc4,0xf0,0x74,0x48,0xa3,0xf0,0xe5,0x57,0x30,0xe4,0x0a,0xc2,0xaf,0x53,0x57,
+0xef,0xd2,0xaf,0x12,0x58,0x74,0xe5,0x57,0x30,0xe6,0x17,0xc2,0xaf,0x53,0x57,0xbf,
+0xd2,0xaf,0x12,0x67,0xa1,0x90,0x9e,0x43,0xe0,0xff,0x60,0x03,0xb4,0x01,0x03,0x12,
+0x7b,0x49,0x90,0x9e,0x43,0xe0,0x70,0x03,0x12,0x7c,0x4c,0x12,0x73,0x85,0x80,0xb6,
+0x90,0x01,0x3c,0x74,0xff,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x01,0x34,0xf0,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x54,0x31,0x05,0x7d,0xff,0x7f,0x55,0x31,0x05,0x7d,
+0xff,0x7f,0x56,0x31,0x05,0x7d,0xff,0x7f,0x57,0x80,0x0a,0xf0,0x90,0x00,0x45,0xe0,
+0x54,0xfe,0xfd,0x7f,0x45,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x8f,0x82,0x75,0x83,
+0x00,0xed,0xf0,0xb1,0x45,0xd0,0xd0,0x92,0xaf,0x22,0xef,0x14,0x60,0x30,0x14,0x60,
+0x66,0x24,0x02,0x60,0x02,0x21,0xc1,0x90,0x9e,0x3f,0x74,0x02,0xf0,0x90,0x00,0x48,
+0xe0,0x44,0x0c,0xfd,0x7f,0x48,0x31,0x05,0x90,0x00,0x47,0xe0,0x44,0x08,0xfd,0x7f,
+0x47,0x31,0x05,0x90,0x00,0x45,0xe0,0x44,0x10,0xfd,0x7f,0x45,0x80,0x71,0xe4,0x90,
+0x9e,0x3f,0xf0,0x90,0x9e,0x3b,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x80,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x00,0x45,0xe0,0x44,0xef,0xfd,0x7f,0x45,0x31,
+0x05,0x90,0x00,0x45,0xe0,0x54,0xef,0xfd,0x7f,0x45,0x31,0x05,0x90,0x00,0x46,0xe0,
+0x44,0x10,0xfd,0x7f,0x46,0x80,0x38,0x90,0x9e,0x3f,0x74,0x01,0xf0,0x90,0x9e,0x45,
+0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,
+0x90,0x00,0x45,0xe0,0x44,0x20,0xfd,0x7f,0x45,0x31,0x05,0x90,0x00,0x45,0xe0,0x44,
+0x10,0xfd,0x7f,0x45,0x31,0x05,0x90,0x00,0x46,0xe0,0x44,0x10,0xfd,0x7f,0x46,0x31,
+0x05,0x22,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x9e,0x41,0xf0,0x90,0x00,0x01,0x12,
+0x42,0x20,0x25,0xe0,0x25,0xe0,0x90,0x9e,0x40,0xf0,0x12,0x29,0xd9,0x25,0xe0,0x25,
+0xe0,0x90,0x9e,0x44,0xf0,0x90,0x05,0x60,0xe0,0x90,0x9e,0x4f,0xf0,0x90,0x05,0x61,
+0xe0,0x90,0x9e,0x50,0xf0,0x90,0x05,0x62,0xe0,0x90,0x9e,0x51,0xf0,0x90,0x05,0x63,
+0xe0,0x90,0x9e,0x52,0xf0,0xa2,0xaf,0xe4,0x33,0x90,0x9e,0x24,0xf0,0xc2,0xaf,0x90,
+0x9e,0x40,0xe0,0xff,0x91,0xf0,0x90,0x9e,0x24,0xe0,0x24,0xff,0x92,0xaf,0x90,0x9e,
+0x41,0xe0,0x70,0x02,0x41,0xc8,0x90,0x9e,0x40,0xe0,0x70,0x02,0x41,0xc8,0x90,0x9e,
+0x44,0xe0,0x70,0x02,0x41,0xc8,0xa2,0xaf,0xe4,0x33,0x90,0x9e,0x24,0xf0,0xc2,0xaf,
+0x90,0x9e,0x53,0x74,0x01,0xf0,0x90,0x9e,0x24,0xe0,0x24,0xff,0x92,0xaf,0x11,0xfc,
+0x90,0x00,0x46,0xe0,0x44,0x01,0xfd,0x7f,0x46,0x31,0x05,0x90,0x9e,0x39,0xe0,0x60,
+0x15,0x90,0x9e,0x45,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,
+0x08,0x12,0x2f,0xd9,0x80,0x06,0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,0x00,0x45,0xe0,
+0x54,0xef,0xfd,0x7f,0x45,0x31,0x05,0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,0x9e,
+0x4f,0xe0,0x90,0x05,0x84,0xf0,0x90,0x9e,0x50,0xe0,0x90,0x05,0x85,0xf0,0x90,0x9e,
+0x51,0xe0,0x90,0x05,0x86,0xf0,0x90,0x9e,0x52,0xe0,0x90,0x05,0x87,0xf0,0xa2,0xaf,
+0xe4,0x33,0x90,0x9e,0x24,0xf0,0xc2,0xaf,0x90,0x01,0x3c,0xe0,0x44,0x20,0xf0,0x7d,
+0x20,0xe4,0xff,0x12,0x37,0x00,0x80,0x2b,0x90,0x9e,0x41,0xe0,0x70,0x2d,0x90,0x9e,
+0x53,0x11,0xfb,0x90,0x00,0x46,0xe0,0x54,0xfe,0xfd,0x7f,0x46,0x31,0x05,0x90,0x05,
+0x22,0xe4,0xf0,0xa2,0xaf,0x33,0x90,0x9e,0x24,0xf0,0xc2,0xaf,0x7d,0x20,0xe4,0xff,
+0x12,0x36,0x92,0x90,0x9e,0x24,0xe0,0x24,0xff,0x92,0xaf,0x22,0x8b,0x14,0x8a,0x15,
+0x89,0x16,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x9e,0x42,0xf0,0xe0,0x30,0xe0,0x4b,
+0x90,0x9e,0x39,0x74,0x01,0xf0,0x7f,0x80,0x7e,0x08,0x12,0x27,0xde,0x90,0x9e,0x3b,
+0x12,0x2a,0x7f,0xab,0x14,0xaa,0x15,0xa9,0x16,0x90,0x00,0x01,0x12,0x42,0x20,0xff,
+0xe4,0xfc,0xfd,0xfe,0x78,0x1a,0x12,0x2a,0x6c,0xa8,0x04,0xa9,0x05,0xaa,0x06,0xab,
+0x07,0x90,0x9e,0x3b,0x12,0x43,0x53,0xec,0x54,0x03,0xfc,0x12,0x43,0x46,0x90,0x9e,
+0x45,0x12,0x2a,0x7f,0x90,0x05,0x22,0xe4,0xf0,0x80,0x2d,0xe4,0x90,0x9e,0x39,0xf0,
+0x7f,0x80,0x7e,0x08,0x12,0x27,0xde,0xec,0x54,0x03,0xfc,0xec,0x44,0xc0,0xfc,0x90,
+0x9e,0x3b,0x12,0x2a,0x7f,0x90,0x9e,0x3b,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9e,0x42,0xe0,0x30,0xe1,0x19,0x7d,
+0x0c,0x7f,0x47,0x31,0x05,0x90,0x00,0x48,0xe0,0x44,0x0c,0xfd,0x7f,0x48,0x31,0x05,
+0x90,0x00,0x46,0xe0,0x44,0x10,0x80,0x1c,0x90,0x00,0x47,0xe0,0x54,0xf3,0xfd,0x7f,
+0x47,0x31,0x05,0x90,0x00,0x48,0xe0,0x54,0xf3,0xfd,0x7f,0x48,0x31,0x05,0x90,0x00,
+0x46,0xe0,0x54,0xef,0xfd,0x7f,0x46,0x31,0x05,0xe4,0x90,0x9e,0x3f,0xf0,0x22,0x90,
+0x01,0x30,0xe4,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x01,0x38,0xf0,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x50,0x31,0x05,0xe4,0xfd,0x7f,0x51,0x31,0x05,0xe4,
+0xfd,0x7f,0x52,0x31,0x05,0xe4,0xfd,0x7f,0x53,0x21,0x05,0xe5,0x65,0x64,0x01,0x70,
+0x3b,0xd1,0x85,0xbf,0x01,0x04,0x7f,0x01,0xd1,0x79,0x90,0x00,0x46,0xe0,0x44,0x04,
+0xfd,0x7f,0x46,0x31,0x05,0x90,0x00,0x44,0xe0,0x54,0xfb,0xfd,0x7f,0x44,0x31,0x05,
+0x90,0x00,0x46,0xe0,0x54,0xfb,0xfd,0x7f,0x46,0x31,0x05,0x7f,0x02,0xd1,0xa1,0x8f,
+0x69,0x90,0x01,0xc9,0xe5,0x69,0xf0,0xb4,0x01,0x02,0xd1,0x19,0x22,0x90,0x9e,0x41,
+0xe0,0x64,0x01,0x60,0x02,0x81,0xef,0x90,0x00,0x46,0xe0,0x44,0x01,0xfd,0x7f,0x46,
+0x31,0x05,0x90,0x9e,0x53,0xe0,0x70,0x31,0x90,0x9e,0x39,0xe0,0x60,0x15,0x90,0x9e,
+0x45,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,
+0xd9,0x80,0x06,0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,0x9e,0x40,0xe0,0xff,0x91,0xf0,
+0x90,0x9e,0x53,0x74,0x01,0x11,0xfb,0x80,0x3f,0x90,0x9e,0x53,0xe0,0x64,0x01,0x70,
+0x37,0x90,0x9e,0x44,0xe0,0xff,0x91,0xf0,0xe4,0x90,0x9e,0x53,0xf0,0x90,0x00,0x45,
+0xe0,0x44,0x01,0xfd,0x7f,0x45,0x31,0x05,0x90,0x9e,0x39,0xe0,0x60,0x15,0x90,0x9e,
+0x3b,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,
+0xd9,0x80,0x05,0x90,0x05,0x22,0xe4,0xf0,0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,
+0x9e,0x4f,0xe0,0x90,0x05,0x84,0xf0,0x90,0x9e,0x50,0xe0,0x90,0x05,0x85,0xf0,0x90,
+0x9e,0x51,0xe0,0x90,0x05,0x86,0xf0,0x90,0x9e,0x52,0xe0,0x90,0x05,0x87,0xf0,0x22,
+0x90,0x05,0x60,0xe0,0x90,0x9e,0x4f,0xf0,0x90,0x05,0x61,0xe0,0x90,0x9e,0x50,0xf0,
+0x90,0x05,0x62,0xe0,0x90,0x9e,0x51,0xf0,0x90,0x05,0x63,0xe0,0x90,0x9e,0x52,0xf0,
+0xc3,0x74,0xff,0x9f,0xfe,0x90,0x9e,0x50,0xe0,0xd3,0x9e,0x40,0x1e,0xe0,0x2f,0xf0,
+0xa3,0xe0,0xb4,0xff,0x0f,0xe4,0xf0,0xa3,0xe0,0xb4,0xff,0x03,0xe4,0xf0,0x22,0x90,
+0x9e,0x52,0x80,0x03,0x90,0x9e,0x51,0xe0,0x04,0xf0,0x22,0x90,0x9e,0x50,0xe0,0x2f,
+0xf0,0x22,0xe0,0x5f,0xf0,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x7f,0x10,0xdf,0xfe,
+0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x2a,0xed,
+0xf0,0x90,0x9e,0x29,0xef,0xf0,0xd3,0x94,0x07,0x50,0x4e,0xa3,0xe0,0x70,0x1a,0x90,
+0x9e,0x29,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,
+0xff,0x90,0x00,0x47,0xe0,0x5f,0xf0,0x80,0x17,0x90,0x9e,0x29,0xe0,0xff,0x74,0x01,
+0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x47,0xe0,0x4f,0xf0,
+0xb1,0x45,0x90,0x9e,0x29,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xf4,0xff,0x90,0x00,0x46,0x80,0x59,0x90,0x9e,0x29,0xe0,0x24,0xf8,0xf0,
+0xa3,0xe0,0x70,0x1d,0x90,0x9e,0x29,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,
+0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,0x80,
+0x1a,0x90,0x9e,0x29,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,
+0xfc,0xc4,0x54,0xf0,0xff,0x90,0x00,0x43,0xe0,0x4f,0xf0,0xb1,0x45,0x90,0x9e,0x29,
+0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,
+0x00,0x43,0xb1,0x42,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x00,0x49,0xe0,0x90,0x9e,0xb1,
+0xf0,0xe0,0x54,0x0f,0xf0,0x44,0xf0,0xfd,0x7f,0x49,0x31,0x05,0x90,0x9e,0xb1,0xe0,
+0x44,0xb0,0xfd,0x7f,0x49,0x21,0x05,0x90,0x9e,0x27,0xee,0xf0,0xa3,0xef,0xf0,0x75,
+0x65,0x01,0x8e,0x66,0xf5,0x67,0xe4,0xfd,0x7f,0x0b,0xb1,0x55,0xe4,0xfd,0x7f,0x02,
+0xb1,0x55,0xd1,0x85,0xe4,0xff,0xd1,0x79,0xe4,0xf5,0x69,0x90,0x01,0xc9,0xe5,0x69,
+0xf0,0x90,0x9e,0x27,0xe0,0xfc,0xa3,0xe0,0xfd,0xec,0xfb,0x8d,0x44,0xe4,0xf5,0x45,
+0x7d,0x01,0x7f,0x60,0x7e,0x01,0x02,0x35,0xab,0x90,0x01,0xca,0xe5,0x68,0xf0,0xef,
+0x60,0x02,0xd1,0x19,0x22,0x7f,0x0b,0xd1,0xa1,0xef,0x65,0x68,0x60,0x10,0xe5,0x68,
+0xb4,0x01,0x05,0xe4,0xf5,0x68,0x80,0x03,0x75,0x68,0x01,0x7f,0x01,0x22,0x7f,0x00,
+0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0xb2,0xef,0xf0,0xd3,0x94,0x07,
+0x50,0x43,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,
+0xff,0x90,0x00,0x46,0xb1,0x42,0x90,0x9e,0xb2,0xe0,0xfd,0x74,0x01,0x7e,0x00,0xa8,
+0x05,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,0x44,0xe0,
+0xfb,0xe4,0xfe,0xef,0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,0xce,0x13,
+0xd8,0xf8,0xff,0x80,0x4b,0x90,0x9e,0xb2,0xe0,0x24,0xf8,0xf0,0xe0,0xff,0x74,0x01,
+0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,
+0xf0,0xb1,0x45,0x90,0x9e,0xb2,0xe0,0xfd,0x74,0x01,0x7e,0x00,0xa8,0x05,0x08,0x80,
+0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,0x42,0xe0,0xfb,0xe4,0xfe,
+0xef,0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,0xce,0x13,0xd8,0xf8,0xff,
+0xd0,0xd0,0x92,0xaf,0x22,0xe4,0xfd,0x7f,0x45,0x31,0x05,0x90,0x04,0xfd,0xe4,0xf0,
+0xa3,0xf0,0x90,0x9e,0x43,0xf0,0x90,0x9e,0x49,0xf0,0x90,0x9e,0x4c,0xf0,0x90,0x9e,
+0x4a,0xf0,0x90,0x9e,0x4d,0xf0,0x90,0x9e,0x4b,0xf0,0x90,0x9e,0x4e,0xf0,0x90,0x9e,
+0x35,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x9e,0x3a,0xf0,0x90,0x9e,
+0x3f,0xf0,0x90,0x9e,0x41,0xf0,0x90,0x9e,0x53,0xf0,0x90,0x9e,0x44,0xf0,0x90,0x9e,
+0x40,0xf0,0x90,0x9e,0x39,0xf0,0x90,0x00,0x51,0xe0,0x44,0xc0,0xfd,0x7f,0x51,0x21,
+0x05,0xe4,0x90,0x9e,0x7d,0xf0,0x90,0x00,0x80,0xe0,0x44,0x80,0xfd,0x7f,0x80,0x21,
+0x05,0x75,0x30,0x1f,0x75,0x31,0x01,0xe4,0xf5,0x32,0x90,0x01,0x38,0xe5,0x30,0xf0,
+0xa3,0xe5,0x31,0xf0,0xa3,0xe5,0x32,0xf0,0x22,0xe4,0xf5,0x68,0x22,0x90,0x01,0x64,
+0x74,0xa0,0xf0,0x22,0x90,0x9e,0x80,0xe0,0x90,0x9e,0x0f,0xf0,0x22,0x90,0x00,0xf3,
+0xe0,0x7f,0x00,0x30,0xe3,0x02,0x7f,0x01,0x22,0x90,0x00,0x02,0xe0,0x54,0xe0,0x7f,
+0x01,0x60,0x02,0x7f,0x00,0x22,0x90,0x9e,0x80,0xe0,0xb4,0x01,0x0c,0x90,0x00,0xf2,
+0xe0,0x30,0xe7,0x05,0x7e,0xfd,0x7f,0x33,0x22,0x7e,0xfd,0x7f,0x2f,0x22,0x90,0x00,
+0xf3,0xe0,0x30,0xe2,0x0d,0x90,0x05,0x41,0x74,0x10,0xf0,0x90,0x05,0x5a,0xf0,0xa3,
+0xe4,0xf0,0x22,0x90,0x01,0x02,0xe0,0x54,0x03,0xff,0xe0,0x54,0x0c,0x13,0x13,0x54,
+0x3f,0xfe,0xef,0x64,0x01,0x60,0x04,0xef,0xb4,0x03,0x10,0x90,0x9e,0x10,0x74,0x01,
+0xf0,0xa3,0x74,0x37,0xf0,0xa3,0x74,0x01,0xf0,0x80,0x1a,0xee,0x64,0x01,0x60,0x07,
+0xaf,0x06,0xee,0x64,0x03,0x70,0x49,0x90,0x9e,0x10,0x74,0x01,0xf0,0xa3,0x74,0x3d,
+0xf0,0xa3,0x74,0x40,0xf0,0x90,0x9e,0x10,0xe0,0xfe,0xa3,0xe0,0xff,0xf5,0x82,0x8e,
+0x83,0xe0,0xfd,0x90,0x9e,0x12,0xe0,0xfc,0xed,0x5c,0x60,0x0c,0x8f,0x82,0x8e,0x83,
+0xec,0xf0,0xe4,0x90,0x9e,0x77,0xf0,0x22,0x90,0x9e,0x77,0xe0,0x04,0xf0,0xe0,0xc3,
+0x94,0x0a,0x40,0x0c,0xe4,0xf0,0x90,0x04,0x19,0xe0,0x30,0xe0,0x03,0x12,0x44,0xea,
+0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,
+0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,0x01,
+0xc4,0x74,0xa1,0xf0,0x74,0x50,0xa3,0xf0,0x90,0x01,0x34,0xe0,0x55,0x28,0xf5,0x2c,
+0xa3,0xe0,0x55,0x29,0xf5,0x2d,0xa3,0xe0,0x55,0x2a,0xf5,0x2e,0xa3,0xe0,0x55,0x2b,
+0xf5,0x2f,0xe5,0x2c,0x20,0xe0,0x02,0x41,0x46,0x90,0x01,0x34,0x74,0x01,0xf0,0x85,
+0xd1,0x4d,0x85,0xd2,0x4e,0x85,0xd3,0x4f,0x85,0xd4,0x50,0x85,0xd5,0x51,0x85,0xd6,
+0x52,0x85,0xd7,0x53,0x85,0xd9,0x54,0xe5,0x54,0x54,0x40,0xc3,0x13,0xff,0xe5,0x53,
+0x54,0x20,0x6f,0x70,0x02,0x21,0xf5,0xe5,0x54,0x30,0xe5,0x02,0x21,0xf5,0xe5,0x52,
+0x54,0x3f,0xf5,0x08,0xe5,0x4d,0x54,0x3f,0xf5,0x09,0xe5,0x51,0x54,0x1f,0xff,0xe5,
+0x08,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0x8f,0xf0,0x12,
+0x42,0x81,0xe5,0x53,0x54,0x1f,0xff,0xe5,0x08,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,
+0x34,0x93,0xf5,0x83,0xe4,0x8f,0xf0,0x12,0x42,0x81,0xe5,0x09,0xd3,0x94,0x04,0x40,
+0x03,0x75,0x09,0x04,0x75,0xf0,0x0a,0xe5,0x08,0x90,0x90,0x00,0x12,0x43,0x5f,0x75,
+0xf0,0x02,0xe5,0x09,0x12,0x43,0x5f,0xe0,0xfe,0xa3,0xe0,0xff,0xe5,0x53,0x54,0x1f,
+0x2f,0xff,0xe4,0x3e,0xfe,0x75,0xf0,0x0a,0xe5,0x08,0x90,0x90,0x00,0x12,0x43,0x5f,
+0x75,0xf0,0x02,0xe5,0x09,0x12,0x43,0x5f,0xee,0xf0,0xa3,0xef,0xf0,0xe5,0x54,0x20,
+0xe6,0x24,0xe5,0x53,0x54,0x1f,0xff,0xe5,0x08,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,
+0x34,0x98,0xf5,0x83,0xe4,0x8f,0xf0,0x12,0x42,0x81,0xe5,0x4f,0x30,0xe7,0x36,0xaf,
+0x08,0x12,0x63,0x51,0x80,0x2f,0xe5,0x53,0x54,0x1f,0xff,0xe5,0x08,0x25,0xe0,0x24,
+0x44,0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0x8f,0xf0,0x12,0x42,0x81,0xe5,0x4f,
+0x30,0xe7,0x12,0xe5,0x4f,0x54,0x7f,0xfd,0xe5,0x53,0x54,0x1f,0xf5,0x0d,0xab,0x09,
+0xaf,0x08,0x12,0x62,0xee,0xe5,0x63,0x14,0x24,0xfd,0x50,0x02,0x80,0x48,0x90,0x9e,
+0x66,0xe0,0x60,0x3a,0x90,0x01,0x5b,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x04,0xf0,0x71,
+0xc3,0xef,0x64,0x01,0x70,0x30,0x90,0x9e,0x85,0xf0,0x90,0x9e,0x5b,0xe0,0x90,0x9e,
+0x86,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,0x01,0x12,0x44,0x5e,0x90,0x01,0x5b,0x74,
+0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x90,0x9e,0x64,0xf0,0x80,0x08,0x71,0xc3,
+0xbf,0x01,0x03,0x12,0x44,0xcb,0xe5,0x2c,0x30,0xe1,0x20,0x90,0x01,0x34,0x74,0x02,
+0xf0,0x85,0xd1,0x58,0x85,0xd2,0x59,0x85,0xd3,0x5a,0x85,0xd4,0x5b,0x85,0xd5,0x5c,
+0x85,0xd6,0x5d,0x85,0xd7,0x5e,0x85,0xd9,0x5f,0x71,0xd2,0xe5,0x2c,0x30,0xe3,0x06,
+0x90,0x01,0x34,0x74,0x08,0xf0,0xe5,0x2c,0x30,0xe4,0x09,0x90,0x01,0x34,0x74,0x10,
+0xf0,0x43,0x57,0x10,0xe5,0x2c,0x30,0xe5,0x26,0x90,0x01,0xcf,0xe0,0x30,0xe5,0x1f,
+0xe0,0x54,0xdf,0xf0,0x90,0x01,0x34,0x74,0x20,0xf0,0x75,0xa8,0x00,0x75,0xe8,0x00,
+0x12,0x4b,0xcf,0x90,0x00,0x03,0xe0,0x54,0xfb,0xf0,0x12,0x4d,0x45,0x80,0xfe,0xe5,
+0x2c,0x30,0xe6,0x06,0x90,0x01,0x34,0x74,0x40,0xf0,0xe5,0x2e,0x30,0xe0,0x12,0x90,
+0x9e,0x7f,0x74,0x01,0xf0,0x90,0x01,0x36,0xf0,0x12,0x61,0x4e,0x90,0x9e,0x7f,0xe4,
+0xf0,0xe5,0x2e,0x30,0xe1,0x0b,0x90,0x01,0x36,0x74,0x02,0xf0,0x43,0x57,0x40,0x11,
+0x23,0xe5,0x2e,0x30,0xe2,0x09,0x90,0x01,0x36,0x74,0x04,0xf0,0x12,0x60,0xdf,0xe5,
+0x2e,0x30,0xe3,0x28,0x90,0x01,0x36,0x74,0x08,0xf0,0xe5,0x60,0x64,0x01,0x70,0x1c,
+0xe5,0x63,0x60,0x18,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,
+0x9e,0x85,0xe4,0x12,0x44,0x4e,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,0x2e,0x30,0xe4,
+0x2b,0x90,0x01,0x36,0x74,0x10,0xf0,0xe5,0x60,0xb4,0x01,0x20,0xe5,0x63,0x60,0x1c,
+0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,0x9e,0x67,0xe4,0xf0,
+0x53,0x64,0xfd,0xe5,0x64,0x54,0x07,0x70,0x03,0x12,0x44,0xcb,0xe5,0x2e,0x30,0xe5,
+0x1f,0x90,0x01,0x36,0x74,0x20,0xf0,0xe5,0x60,0xb4,0x01,0x14,0xe5,0x63,0x60,0x10,
+0x90,0x9e,0x66,0xe0,0x64,0x02,0x60,0x05,0x12,0x44,0xd2,0x80,0x03,0x12,0x44,0x79,
+0xe5,0x2e,0x30,0xe6,0x1b,0x90,0x01,0x36,0x74,0x40,0xf0,0xe5,0x60,0xb4,0x01,0x10,
+0xe5,0x63,0x60,0x0c,0x53,0x64,0xfe,0xe5,0x64,0x54,0x07,0x70,0x03,0x12,0x44,0xcb,
+0xe5,0x2f,0x30,0xe1,0x08,0x90,0x01,0x37,0x74,0x02,0xf0,0x91,0x64,0x74,0xa1,0x04,
+0x90,0x01,0xc4,0xf0,0x74,0x50,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,0xd0,0x04,
+0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,0xd0,0xf0,
+0xd0,0xe0,0x32,0x90,0x04,0x1b,0xe0,0x54,0x7f,0x64,0x7f,0x7f,0x01,0x60,0x02,0x7f,
+0x00,0x22,0x90,0x9e,0x10,0xe0,0x54,0xf0,0x44,0x03,0xf0,0x54,0x0f,0x44,0x80,0xf0,
+0x7b,0x00,0x7a,0x00,0x79,0x58,0x90,0x9e,0x90,0x12,0x43,0x8b,0x0b,0x7a,0x9e,0x79,
+0x10,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x8d,0x12,0x43,0x8b,0x90,0x9e,
+0xb0,0xe0,0xff,0x04,0xf0,0x90,0x00,0x01,0xef,0x12,0x42,0x5f,0x7f,0xaf,0x7e,0x01,
+0x12,0x71,0x7a,0xef,0x60,0x49,0x90,0x9e,0x8d,0x12,0x43,0x6b,0x8b,0x23,0x8a,0x24,
+0x89,0x25,0x75,0x26,0x02,0x7b,0x01,0x7a,0x01,0x79,0xa0,0x12,0x45,0x09,0x90,0x9e,
+0x90,0x12,0x43,0x6b,0x8b,0x23,0x8a,0x24,0x89,0x25,0x90,0x9e,0x8d,0x12,0x43,0x6b,
+0x12,0x29,0xd9,0xff,0xc4,0x54,0x0f,0xf5,0x26,0x7b,0x01,0x7a,0x01,0x79,0xa2,0x12,
+0x45,0x09,0x90,0x01,0xaf,0x74,0xff,0xf0,0x90,0x01,0xcb,0xe0,0x64,0x80,0xf0,0xd0,
+0xd0,0x92,0xaf,0x22,0x90,0x9e,0xa0,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,0x63,
+0x14,0x24,0xfd,0x50,0x02,0x80,0x1f,0x90,0x9e,0x66,0xe0,0x60,0x06,0x7d,0x01,0x7f,
+0x0c,0x80,0x0d,0xe5,0x61,0x54,0x0f,0xc3,0x94,0x04,0x50,0x06,0x7d,0x01,0x7f,0x04,
+0x91,0xe7,0xe4,0xff,0x91,0x97,0x22,0xef,0x60,0x0b,0x90,0x9e,0x80,0xe0,0xb4,0x01,
+0x10,0xe4,0xff,0x80,0x09,0x90,0x9e,0x80,0xe0,0xb4,0x01,0x05,0x7f,0x01,0x12,0x75,
+0x92,0x22,0x90,0x01,0x37,0x74,0x02,0xf0,0x90,0x05,0x22,0x74,0xff,0xf0,0x12,0x74,
+0x12,0xef,0x70,0x06,0x90,0x01,0xc8,0x74,0xfd,0xf0,0x7d,0x02,0x7f,0x03,0x12,0x36,
+0xe6,0xe5,0x63,0x60,0x04,0x7f,0x01,0x91,0x97,0x12,0x74,0xc8,0x53,0x61,0xf0,0x43,
+0x61,0x02,0x22,0x7d,0x01,0x7f,0x0c,0x8f,0x6a,0x8d,0x6b,0xe5,0x6a,0x54,0x0f,0xff,
+0xe5,0x61,0x54,0x0f,0x6f,0x60,0x65,0xe5,0x6a,0x30,0xe2,0x28,0xe5,0x61,0x20,0xe2,
+0x04,0x7f,0x01,0xd1,0xc2,0xe5,0x61,0x30,0xe3,0x0c,0xe5,0x6a,0x20,0xe3,0x07,0xb1,
+0x5d,0xef,0x60,0x48,0xa1,0xa5,0xe5,0x61,0x20,0xe3,0x41,0xe5,0x6a,0x30,0xe3,0x3c,
+0xaf,0x6b,0xc1,0xdc,0xe5,0x61,0x54,0x0f,0xff,0xbf,0x0c,0x0c,0xe5,0x6a,0x20,0xe3,
+0x07,0xb1,0x5d,0xef,0x60,0x26,0xb1,0xa5,0xe5,0x61,0x54,0x0f,0xff,0xbf,0x04,0x0c,
+0xe5,0x6a,0x20,0xe2,0x07,0xf1,0x21,0xef,0x60,0x12,0x91,0xb2,0xe5,0x61,0x54,0x0f,
+0xff,0xbf,0x02,0x08,0x12,0x60,0xbd,0xef,0x60,0x02,0xd1,0xaf,0x22,0x71,0xc3,0xef,
+0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,0x30,0x90,0x9e,0x64,0xe0,
+0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x22,0x90,0x9e,0x63,0xe0,0x60,0x08,
+0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x14,0xe5,0x62,0x54,0x0f,0xd3,0x94,0x04,0x40,
+0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x03,0x7f,0x01,0x22,0x90,0x01,0xb8,0x74,
+0x08,0xf0,0x7f,0x00,0x22,0x90,0x06,0x04,0xe0,0x44,0x40,0xf0,0xe5,0x60,0xb4,0x01,
+0x04,0x7f,0x01,0xd1,0xf6,0x53,0x61,0xf0,0x43,0x61,0x04,0x22,0xef,0x64,0x01,0x70,
+0x2e,0x7d,0x78,0x7f,0x02,0x12,0x36,0x75,0x7d,0x02,0x7f,0x03,0x12,0x36,0x75,0x90,
+0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x91,0xe3,0xe4,0xff,0x91,0x97,
+0x90,0x06,0x04,0xe0,0x54,0x7f,0xf0,0x90,0x06,0x0a,0xe0,0x54,0xf8,0xf0,0x22,0x90,
+0x01,0x36,0x74,0x7b,0xf0,0xa3,0x74,0x02,0xf0,0x7d,0x7b,0xff,0x12,0x36,0xe6,0x7d,
+0x02,0x7f,0x03,0x12,0x36,0xe6,0x90,0x06,0x04,0xe0,0x44,0x80,0xf0,0x90,0x06,0x0a,
+0xe0,0x44,0x07,0xf0,0x12,0x62,0x4c,0xe5,0x60,0x20,0xe0,0x05,0xe4,0x90,0x9e,0x58,
+0xf0,0x22,0x8b,0x14,0x8a,0x15,0x89,0x16,0x12,0x60,0xb1,0xab,0x14,0xaa,0x15,0xa9,
+0x16,0x12,0x29,0xd9,0xf5,0x63,0x14,0x60,0x0e,0x14,0x60,0x1e,0x14,0x60,0x2f,0x24,
+0x03,0x70,0x40,0x7f,0x01,0x80,0x3a,0xab,0x14,0xaa,0x15,0xa9,0x16,0x90,0x00,0x02,
+0x12,0x42,0x20,0xfd,0xe4,0xff,0xd1,0x84,0x80,0x27,0xab,0x14,0xaa,0x15,0xa9,0x16,
+0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x7f,0x01,0xd1,0x84,0x1f,0x80,0x13,0xab,0x14,
+0xaa,0x15,0xa9,0x16,0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x7f,0x02,0xd1,0x84,0xe4,
+0xff,0xb1,0xbc,0x22,0xef,0x24,0xfe,0x60,0x0b,0x04,0x70,0x22,0x90,0x9e,0x65,0x74,
+0x01,0xf0,0x80,0x16,0xed,0x70,0x0a,0x90,0x9e,0x62,0xe0,0x90,0x9e,0x65,0xf0,0x80,
+0x05,0x90,0x9e,0x65,0xed,0xf0,0x90,0x9e,0x65,0xe0,0x90,0x9e,0x56,0xf0,0x22,0x53,
+0x61,0xf0,0x43,0x61,0x01,0x12,0x45,0x00,0x12,0x45,0x01,0x53,0x61,0xf0,0x43,0x61,
+0x02,0x22,0x90,0x9e,0xaf,0xef,0xf0,0x12,0x74,0x53,0x90,0x9e,0xaf,0xe0,0x60,0x05,
+0x90,0x05,0x22,0xe4,0xf0,0x53,0x61,0xf0,0x43,0x61,0x04,0x22,0x90,0x06,0x04,0xe0,
+0x54,0xbf,0xf0,0xef,0x60,0x09,0xe5,0x60,0xb4,0x01,0x04,0xe4,0xff,0xd1,0xf6,0x53,
+0x61,0xf0,0x43,0x61,0x0c,0x22,0x8f,0x27,0x12,0x45,0xb0,0xbf,0x01,0x22,0x90,0x9e,
+0x7a,0xe0,0xff,0x7d,0x01,0x12,0x47,0x79,0xab,0x07,0xaa,0x06,0xad,0x03,0xac,0x02,
+0xaf,0x27,0x12,0x60,0x2a,0xaf,0x03,0x12,0x5f,0xf7,0x90,0x04,0x1f,0x74,0x20,0xf0,
+0x22,0x71,0xc3,0xef,0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,0x58,
+0xe5,0x64,0x54,0x03,0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x4a,0xe5,0x62,
+0x54,0x0f,0xd3,0x94,0x02,0x40,0x08,0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x39,0xe5,
+0x64,0x30,0xe2,0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x2c,0xe5,0x64,0x30,0xe4,
+0x08,0x90,0x01,0xb9,0x74,0x10,0xf0,0x80,0x1f,0x90,0x9e,0x58,0xe0,0x60,0x08,0x90,
+0x01,0xb9,0x74,0x20,0xf0,0x80,0x11,0x90,0x9e,0x5e,0xe0,0x60,0x08,0x90,0x01,0xb9,
+0x74,0x80,0xf0,0x80,0x03,0x7f,0x01,0x22,0x90,0x01,0xb8,0x74,0x04,0xf0,0x7f,0x00,
+0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,
+0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,0x01,
+0xc4,0x74,0x91,0xf0,0x74,0x57,0xa3,0xf0,0x53,0x91,0xef,0x90,0x00,0x51,0xe0,0xff,
+0x90,0x00,0x55,0xe0,0x5f,0xf5,0x3d,0x90,0x00,0x52,0xe0,0xff,0x90,0x00,0x56,0xe0,
+0x5f,0xf5,0x3e,0xe5,0x3d,0x30,0xe4,0x06,0x90,0x00,0x55,0x74,0x10,0xf0,0xe5,0x3d,
+0x30,0xe5,0x06,0x90,0x00,0x55,0x74,0x20,0xf0,0xe5,0x3d,0x30,0xe6,0x1b,0x90,0x00,
+0x55,0x74,0x40,0xf0,0x90,0x9e,0x42,0xe0,0x54,0x03,0xff,0xbf,0x03,0x0b,0x90,0x9e,
+0x3f,0xe0,0x60,0x05,0x7f,0x01,0x12,0x49,0x1a,0xe5,0x3d,0x30,0xe7,0x15,0x90,0x00,
+0x55,0x74,0x80,0xf0,0x90,0x9e,0x42,0xe0,0x54,0x03,0xff,0xbf,0x03,0x05,0x7f,0x02,
+0x12,0x49,0x1a,0xe5,0x3e,0x30,0xe0,0x06,0x90,0x00,0x56,0x74,0x01,0xf0,0xe5,0x3e,
+0x30,0xe1,0x06,0x90,0x00,0x56,0x74,0x02,0xf0,0xe5,0x3e,0x30,0xe2,0x06,0x90,0x00,
+0x56,0x74,0x04,0xf0,0xe5,0x3e,0x30,0xe3,0x06,0x90,0x00,0x56,0x74,0x08,0xf0,0x90,
+0x01,0xc4,0x74,0x91,0xf0,0x74,0x57,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,0xd0,
+0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,0xd0,
+0xf0,0xd0,0xe0,0x32,0x90,0x01,0xcc,0xe0,0x54,0x0f,0x90,0x9e,0x19,0xf0,0x90,0x9e,
+0x19,0xe0,0xfd,0x70,0x02,0x21,0xb5,0x90,0x9e,0xae,0xe0,0xff,0x74,0x01,0x7e,0x00,
+0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xef,0x5d,0x70,
+0x02,0x21,0xae,0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd0,0x12,0x43,0x5f,
+0xe0,0x90,0x9e,0x1a,0xf0,0x75,0x23,0x01,0x75,0x24,0x9e,0x75,0x25,0x1a,0x75,0x26,
+0x01,0x7b,0x01,0x7a,0x9e,0x79,0x1b,0x12,0x45,0x09,0x90,0x9e,0x1b,0xe0,0xff,0xc4,
+0x13,0x13,0x13,0x54,0x01,0x90,0x9e,0xae,0x30,0xe0,0x59,0xe0,0x75,0xf0,0x02,0x90,
+0x00,0x88,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x1c,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,
+0x02,0x90,0x00,0x89,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x1d,0xf0,0x90,0x9e,0xae,0xe0,
+0x75,0xf0,0x04,0x90,0x01,0xd1,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x1e,0xf0,0x90,0x9e,
+0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd2,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x1f,0xf0,
+0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd3,0x12,0x43,0x5f,0xe0,0x90,0x9e,
+0x20,0xf0,0x80,0x33,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd1,0x12,0x43,0x5f,0xe0,0x90,
+0x9e,0x1c,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd2,0x12,0x43,0x5f,
+0xe0,0x90,0x9e,0x1d,0xf0,0x90,0x9e,0xae,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd3,0x12,
+0x43,0x5f,0xe0,0x90,0x9e,0x1e,0xf0,0xef,0x54,0x7f,0xff,0x7b,0x01,0x7a,0x9e,0x79,
+0x1c,0x31,0xb6,0x90,0x9e,0x19,0xe0,0xff,0x90,0x9e,0xae,0xe0,0xfe,0x74,0x01,0xa8,
+0x06,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0x5f,0x90,0x9e,0x19,0xf0,0x90,0x9e,
+0xae,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0x90,0x01,
+0xcc,0xf0,0x90,0x9e,0xae,0xe0,0x04,0xf0,0xe0,0x54,0x03,0xf0,0x01,0x7e,0x90,0x01,
+0xc6,0xe0,0x44,0x02,0xf0,0x22,0x90,0x9e,0x21,0x12,0x43,0x8b,0xef,0x12,0x43,0x94,
+0x59,0xfc,0x01,0x59,0xf4,0x02,0x5a,0x20,0x03,0x5a,0x29,0x05,0x5a,0x32,0x06,0x5a,
+0x7e,0x07,0x5a,0x3a,0x09,0x5a,0x43,0x0b,0x5a,0x4c,0x0c,0x5a,0x55,0x0d,0x5a,0x5e,
+0x0e,0x5a,0x67,0x1b,0x5a,0x6f,0x1c,0x5a,0x05,0x2d,0x5a,0x0e,0x2e,0x5a,0x17,0x3b,
+0x00,0x00,0x5a,0x77,0x90,0x9e,0x21,0x12,0x43,0x6b,0xe1,0xe9,0x90,0x9e,0x21,0x12,
+0x43,0x6b,0x02,0x71,0xd0,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x72,0x0b,0x90,0x9e,
+0x21,0x12,0x43,0x6b,0x02,0x72,0x53,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x72,0x8c,
+0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x72,0xb6,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,
+0x70,0x4a,0x90,0x9e,0x21,0x12,0x43,0x6b,0x80,0x45,0x90,0x9e,0x21,0x12,0x43,0x6b,
+0x02,0x72,0xfe,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x70,0xa2,0x90,0x9e,0x21,0x12,
+0x43,0x6b,0x02,0x49,0xc2,0x90,0x9e,0x21,0x12,0x43,0x6b,0x02,0x7b,0x16,0x90,0x9e,
+0x21,0x12,0x43,0x6b,0x02,0x4a,0xfc,0x90,0x9e,0x21,0x12,0x43,0x6b,0xe1,0xef,0x90,
+0x9e,0x21,0x12,0x43,0x6b,0xe1,0xd1,0x90,0x01,0xc6,0xe0,0x44,0x01,0xf0,0x22,0x90,
+0x00,0x04,0x12,0x42,0x20,0xff,0x54,0x1f,0xfe,0xef,0x54,0x20,0xc4,0x13,0x54,0x07,
+0xfd,0xaf,0x06,0x90,0x9e,0x24,0xef,0xf0,0xa3,0xed,0xf0,0xa3,0x12,0x43,0x8b,0x90,
+0x9e,0x26,0x12,0x43,0x6b,0x90,0x00,0x03,0x12,0x42,0x20,0x54,0xf0,0xc4,0x54,0x0f,
+0x90,0x9e,0x29,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0x54,0x40,0xc4,0x13,0x13,0x54,
+0x03,0x90,0x9e,0x2a,0xf0,0x90,0x9e,0x24,0xe0,0xff,0x75,0xf0,0x09,0x90,0x96,0x46,
+0x12,0x43,0x5f,0xad,0x82,0xac,0x83,0x90,0x9e,0x2b,0xec,0xf0,0xa3,0xed,0xf0,0xef,
+0x75,0xf0,0x09,0xa4,0x24,0x44,0xf9,0x74,0x96,0x35,0xf0,0xfa,0x7b,0x01,0xa3,0x12,
+0x43,0x8b,0x90,0x9e,0x26,0x12,0x43,0x6b,0x90,0x00,0x03,0x12,0x42,0x20,0x54,0x0f,
+0xff,0x90,0x9e,0x2d,0x12,0x43,0x6b,0xef,0x12,0x42,0x4d,0x90,0x9e,0x26,0x12,0x43,
+0x6b,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0x90,0x9e,0x2d,0x12,0x43,0x6b,0x90,0x00,
+0x01,0xef,0x12,0x42,0x5f,0x90,0x9e,0x26,0x12,0x43,0x6b,0x90,0x00,0x01,0x12,0x42,
+0x20,0xff,0x90,0x9e,0x2b,0xe0,0xfc,0xa3,0xe0,0xfd,0xf5,0x82,0x8c,0x83,0xef,0xf0,
+0x12,0x29,0xd9,0x8d,0x82,0x8c,0x83,0xa3,0xf0,0x90,0x9e,0x29,0xe0,0xfe,0x90,0x9e,
+0x24,0xe0,0xff,0x24,0x82,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,0x90,0x9e,
+0x25,0xe0,0xfe,0x75,0xf0,0x09,0xef,0x90,0x96,0x4a,0x12,0x43,0x5f,0xee,0xf0,0x75,
+0xf0,0x09,0xef,0x90,0x96,0x4b,0x12,0x43,0x5f,0x74,0x01,0xf0,0x90,0x9e,0x2a,0xe0,
+0xfe,0x75,0xf0,0x09,0xef,0x90,0x96,0x4c,0x12,0x43,0x5f,0xee,0xf0,0x8f,0x14,0xef,
+0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xaf,0x82,0xf5,0x16,0x8f,0x17,0xe5,
+0x14,0x75,0xf0,0x02,0xa4,0x24,0x02,0xf9,0x74,0x95,0x35,0xf0,0x75,0x18,0x01,0xf5,
+0x19,0x89,0x1a,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x46,0x12,0x43,0x5f,0xaf,0x82,
+0x85,0x83,0x1b,0x8f,0x1c,0xe5,0x14,0x75,0xf0,0x09,0xa4,0x24,0x44,0xf9,0x74,0x96,
+0x35,0xf0,0x75,0x1d,0x01,0xf5,0x1e,0x89,0x1f,0x74,0x82,0x25,0x14,0xf5,0x82,0xe4,
+0x34,0x95,0xf5,0x83,0xe0,0x12,0x43,0x94,0x5c,0x0d,0x00,0x5c,0x22,0x01,0x5c,0x37,
+0x02,0x5c,0x4c,0x03,0x5c,0x75,0x04,0x5c,0x8a,0x05,0x5c,0x9f,0x06,0x5c,0xc5,0x0c,
+0x5c,0xf2,0x0d,0x5d,0x1f,0x0e,0x5d,0x4c,0x0f,0x00,0x00,0x5d,0x80,0xe5,0x14,0x25,
+0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0xf0,0xf0,0xa3,0x74,0x15,
+0x80,0x3c,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,
+0xf0,0xf0,0xa3,0x74,0x10,0x80,0x27,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,
+0x34,0x9b,0xf5,0x83,0x74,0xf0,0xf0,0xa3,0x74,0x05,0x80,0x12,0xe5,0x14,0x25,0xe0,
+0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0xf0,0xf0,0xa3,0xe4,0xf0,0xe5,
+0x14,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0x74,0x0f,0xf0,0xa3,
+0x74,0x8f,0xf0,0xa1,0x80,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,
+0xf5,0x83,0x74,0x0f,0xf0,0xa3,0x74,0xf5,0x80,0x27,0xe5,0x14,0x25,0xe0,0x24,0xc6,
+0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0x0f,0xf0,0xa3,0x74,0xf0,0x80,0x12,0xe5,
+0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,0xa3,0x74,
+0x0d,0xf0,0xe5,0x14,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe4,
+0xf0,0xa3,0xf0,0xa1,0x80,0x90,0x04,0x47,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x12,
+0x42,0x4d,0x90,0x04,0x46,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x01,0x12,
+0x42,0x5f,0x90,0x04,0x45,0xe0,0x85,0x17,0x82,0x85,0x16,0x83,0xf0,0x90,0x04,0x44,
+0xa1,0x77,0x90,0x04,0x4b,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x12,0x42,0x4d,0x90,
+0x04,0x4a,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x01,0x12,0x42,0x5f,0x90,
+0x04,0x49,0xe0,0x85,0x17,0x82,0x85,0x16,0x83,0xf0,0x90,0x04,0x48,0x80,0x58,0x90,
+0x04,0x4f,0xe0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x12,0x42,0x4d,0x90,0x04,0x4e,0xe0,
+0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x01,0x12,0x42,0x5f,0x90,0x04,0x4d,0xe0,
+0x85,0x17,0x82,0x85,0x16,0x83,0xf0,0x90,0x04,0x4c,0x80,0x2b,0x90,0x04,0x53,0xe0,
+0xab,0x18,0xaa,0x19,0xa9,0x1a,0x12,0x42,0x4d,0x90,0x04,0x52,0xe0,0xab,0x18,0xaa,
+0x19,0xa9,0x1a,0x90,0x00,0x01,0x12,0x42,0x5f,0x90,0x04,0x51,0xe0,0x85,0x17,0x82,
+0x85,0x16,0x83,0xf0,0x90,0x04,0x50,0xe0,0x85,0x17,0x82,0x85,0x16,0x83,0xa3,0xf0,
+0xab,0x18,0xaa,0x19,0xa9,0x1a,0xc0,0x03,0xc0,0x02,0xc0,0x01,0x12,0x29,0xd9,0xff,
+0xab,0x1d,0xaa,0x1e,0xa9,0x1f,0x12,0x29,0xd9,0x5f,0xd0,0x01,0xd0,0x02,0xd0,0x03,
+0x12,0x42,0x4d,0xab,0x18,0xe5,0x1a,0x24,0x01,0xf9,0xe4,0x35,0x19,0xfa,0xc0,0x03,
+0xc0,0x02,0xc0,0x01,0x12,0x29,0xd9,0xff,0xab,0x1d,0xaa,0x1e,0xa9,0x1f,0x90,0x00,
+0x01,0x12,0x42,0x20,0x5f,0xd0,0x01,0xd0,0x02,0xd0,0x03,0x12,0x42,0x4d,0x85,0x17,
+0x82,0x85,0x16,0x83,0xc0,0x83,0xc0,0x82,0xe0,0xff,0x85,0x1c,0x82,0x85,0x1b,0x83,
+0xe0,0xfe,0xef,0x5e,0xd0,0x82,0xd0,0x83,0xf0,0x85,0x17,0x82,0x85,0x16,0x83,0xa3,
+0xc0,0x83,0xc0,0x82,0xe0,0xff,0x85,0x1c,0x82,0x85,0x1b,0x83,0xa3,0xe0,0xfe,0xef,
+0x5e,0xd0,0x82,0xd0,0x83,0xf0,0xe5,0x14,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,
+0x95,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x3b,0x75,0x15,0x0b,0x74,0x01,0x7e,
+0x00,0xa8,0x15,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xe5,0x14,
+0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0x5e,0xfe,0xa3,0xe0,
+0x5f,0x4e,0x60,0x06,0xe5,0x15,0x24,0x10,0x80,0x5d,0x15,0x15,0xe5,0x15,0xc3,0x94,
+0x00,0x50,0xca,0x80,0x56,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,
+0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x3d,0x75,0x15,0x0f,0x74,0x01,0x7e,0x00,
+0xa8,0x15,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xe5,0x14,0x25,
+0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,
+0x4e,0x60,0x08,0x90,0x9e,0x30,0xe5,0x15,0xf0,0x80,0x10,0x15,0x15,0xe5,0x15,0xc3,
+0x94,0x00,0x50,0xc8,0x80,0x05,0xe4,0x90,0x9e,0x30,0xf0,0xe5,0x14,0x25,0xe0,0x24,
+0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x3b,0xe4,
+0xf5,0x15,0x74,0x01,0x7e,0x00,0xa8,0x15,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,
+0xd8,0xf9,0xff,0xe5,0x14,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,
+0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x08,0x90,0x9e,0x31,0xe5,0x15,0xf0,0x80,
+0x5b,0x05,0x15,0xe5,0x15,0xb4,0x10,0xca,0x80,0x52,0xe5,0x14,0x25,0xe0,0x24,0x02,
+0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0x4e,0x60,0x39,0xe4,0xf5,
+0x15,0x74,0x01,0x7e,0x00,0xa8,0x15,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,
+0xf9,0xff,0xe5,0x14,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,
+0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x06,0xe5,0x15,0x24,0x10,0x80,0x0a,0x05,0x15,
+0xe5,0x15,0xb4,0x0c,0xcc,0x80,0x05,0xe4,0x90,0x9e,0x31,0xf0,0x90,0x9e,0x30,0xe0,
+0xff,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x48,0x12,0x43,0x5f,0xef,0xf0,0x90,0x9e,
+0x31,0xe0,0xfe,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x49,0x12,0x43,0x5f,0xee,0xf0,
+0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0xd3,0x9f,0x40,0x06,
+0x90,0x9e,0x30,0x12,0x62,0x94,0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,0x04,0xf5,
+0x83,0xe0,0xff,0x90,0x9e,0x31,0xe0,0xfe,0xef,0xc3,0x9e,0x50,0x03,0x12,0x62,0x94,
+0x90,0x9e,0x30,0xe0,0xff,0xd3,0x94,0x13,0x40,0x07,0x90,0x96,0x43,0x74,0x03,0xf0,
+0x22,0xef,0xd3,0x94,0x0b,0x40,0x07,0x90,0x96,0x43,0x74,0x02,0xf0,0x22,0xef,0xd3,
+0x94,0x03,0x40,0x07,0x90,0x96,0x43,0x74,0x01,0xf0,0x22,0xe4,0x90,0x96,0x43,0xf0,
+0x22,0x90,0x00,0x04,0x12,0x42,0x20,0xff,0x54,0x3f,0xfe,0xef,0x54,0x80,0xc4,0x13,
+0x13,0x13,0x54,0x01,0xfd,0xaf,0x06,0x41,0x93,0x12,0x29,0xd9,0xf5,0x60,0x22,0x12,
+0x29,0xd9,0x90,0x95,0x01,0xf0,0x22,0xad,0x07,0x74,0x11,0x2d,0xf5,0x82,0xe4,0x34,
+0xfc,0xf5,0x83,0xe0,0x44,0x01,0xf0,0x90,0x04,0x80,0xe0,0x54,0x0f,0xfc,0x74,0x14,
+0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xc0,0x4c,0xfd,0x74,0x14,0x2f,
+0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xed,0xf0,0x22,0xef,0x60,0x0f,0x74,0x21,0x2d,
+0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x10,0xf0,0x22,0x74,0x21,0x2d,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xef,0xf0,0x22,0xe4,0xf5,0x60,0xf5,0x64,
+0xf5,0x63,0x75,0x62,0x0c,0x75,0x61,0x0c,0x90,0x9e,0x66,0xf0,0x90,0x9e,0x64,0xf0,
+0x90,0x9e,0x63,0xf0,0x90,0x9e,0x65,0x04,0xf0,0x90,0x9e,0x56,0xf0,0xe4,0x90,0x9e,
+0x67,0xf0,0x90,0x9e,0x58,0xf0,0x90,0x9e,0x61,0x74,0x07,0xf0,0xe4,0x90,0x9e,0x57,
+0xf0,0x90,0x9e,0x5f,0xf0,0xa3,0x74,0x03,0xf0,0x90,0x9e,0x5c,0x74,0x0a,0xf0,0xa3,
+0x74,0x05,0xf0,0x90,0x9e,0x5b,0x74,0x14,0xf0,0x90,0x9e,0x62,0x74,0x05,0xf0,0xe4,
+0x90,0x9e,0x5a,0xf0,0x90,0x9e,0x55,0xf0,0x90,0x9e,0x7f,0xf0,0x90,0x9e,0x5e,0xf0,
+0x22,0xe4,0x90,0x9e,0x67,0xf0,0x90,0x9e,0x57,0xf0,0xf5,0x64,0x22,0x7f,0x00,0x22,
+0xe5,0x62,0x30,0xe6,0x19,0xe5,0x62,0x54,0x0f,0xff,0x90,0x9e,0x54,0xe0,0xfe,0x4f,
+0x90,0x01,0x2f,0xf0,0xee,0x64,0x80,0x90,0x9e,0x54,0xf0,0x53,0x62,0xbf,0x22,0xe5,
+0x60,0x64,0x01,0x70,0x68,0xe5,0x63,0x60,0x64,0xe5,0x63,0x64,0x02,0x60,0x06,0xe5,
+0x63,0x64,0x05,0x70,0x27,0x90,0x06,0xab,0xe0,0x90,0x9e,0x56,0xf0,0x90,0x06,0xaa,
+0xe0,0x90,0x9e,0x65,0xf0,0x90,0x9e,0x56,0xe0,0x70,0x07,0x90,0x9e,0x65,0xe0,0xff,
+0x80,0x05,0x90,0x9e,0x56,0xe0,0xff,0x90,0x9e,0x56,0xef,0xf0,0x90,0x9e,0x58,0xe0,
+0x60,0x03,0xe0,0x14,0xf0,0xe4,0x90,0x9e,0x57,0xf0,0x90,0x05,0x58,0x74,0x03,0xf0,
+0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x53,0x64,0xfd,0x53,0x64,
+0xef,0xe5,0x63,0x14,0x24,0xfd,0x50,0x02,0x80,0x03,0x12,0x45,0x53,0x22,0xe4,0xfb,
+0x90,0x9e,0x9c,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,0x63,0x60,0x6a,0xe5,0x60,
+0x64,0x01,0x70,0x64,0xe5,0x63,0x14,0x60,0x2b,0x24,0xfd,0x60,0x27,0x24,0x02,0x24,
+0xfb,0x50,0x02,0x80,0x21,0x90,0x9e,0x56,0xe0,0x14,0xf0,0xe0,0x60,0x04,0xa3,0xe0,
+0x60,0x14,0x90,0x9e,0x56,0xe0,0x70,0x08,0x90,0x9e,0x65,0xe0,0x90,0x9e,0x56,0xf0,
+0x7b,0x01,0x80,0x02,0x7b,0x01,0xeb,0x60,0x2f,0x43,0x64,0x10,0xe4,0x90,0x9e,0x85,
+0xf0,0x90,0x9e,0x57,0xe0,0x75,0xf0,0x03,0xa4,0xff,0x90,0x9e,0x61,0xe0,0x2f,0x12,
+0x44,0x53,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,0x61,0x54,0x0f,0xc3,0x94,0x04,0x50,
+0x07,0x7d,0x01,0x7f,0x04,0x12,0x54,0xe7,0x22,0xe4,0x90,0x9e,0x15,0xf0,0xe5,0x63,
+0x60,0x79,0x90,0x9e,0x67,0xe0,0x60,0x0d,0xe4,0xf0,0x53,0x64,0xfd,0xe5,0x64,0x54,
+0x07,0x70,0x68,0x80,0x63,0x90,0x9e,0x57,0xe0,0x04,0xf0,0x53,0x64,0xef,0x90,0x9e,
+0x15,0xe0,0xf9,0xff,0x7e,0x00,0x24,0x01,0xfd,0xee,0x33,0xfc,0x90,0x9e,0x57,0xe0,
+0xb5,0x05,0x06,0xe4,0xb5,0x04,0x02,0x80,0x12,0xef,0x24,0x02,0xff,0xe4,0x3e,0xfe,
+0x90,0x9e,0x57,0xe0,0xb5,0x07,0x0a,0xe4,0xb5,0x06,0x06,0x90,0x05,0x58,0xe0,0x04,
+0xf0,0xe9,0xff,0x90,0x9e,0x5c,0xe0,0x2f,0xff,0xe4,0x33,0xfe,0x90,0x9e,0x57,0xe0,
+0xd3,0x9f,0xee,0x64,0x80,0xf8,0x74,0x80,0x98,0x40,0x0d,0xe5,0x60,0xb4,0x01,0x0b,
+0xa3,0xe0,0x70,0x07,0xe0,0x04,0xf0,0x22,0x12,0x44,0xcb,0x22,0x90,0x9e,0x5f,0xe0,
+0xa3,0xe0,0x90,0x05,0x58,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,
+0x93,0x12,0x43,0x8b,0x90,0x9e,0x96,0xe0,0x54,0xf0,0x44,0x06,0xff,0xf0,0xed,0x54,
+0x0f,0xc4,0x54,0xf0,0xfe,0xef,0x54,0x0f,0x4e,0xf0,0x90,0x9e,0x93,0x12,0x43,0x6b,
+0x90,0x9e,0x90,0x12,0x43,0x8b,0x7b,0x01,0x7a,0x9e,0x79,0x96,0x12,0x53,0xf1,0xd0,
+0xd0,0x92,0xaf,0x22,0xe0,0xfd,0x74,0x26,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9d,0xf5,
+0x83,0xed,0xf0,0xaf,0x14,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0xef,0xc3,0x94,0x20,
+0x50,0x0e,0x74,0x84,0x2f,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xed,0xf0,0x80,0x29,
+0x74,0xa6,0x2f,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xed,0xf0,0x90,0x9e,0x68,0xef,
+0xf0,0x24,0xa6,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x90,0x9e,0x69,0xf0,0x7b,
+0x01,0x7a,0x9e,0x79,0x68,0x7d,0x02,0x51,0x57,0xd0,0xd0,0x92,0xaf,0x22,0x8f,0x0a,
+0x8d,0x0b,0xe5,0x0b,0x54,0x1f,0xf5,0x10,0x74,0x01,0x2f,0xf5,0x82,0xe4,0x34,0x94,
+0xf5,0x83,0xe0,0xf5,0x0e,0x90,0x04,0xfd,0xe0,0xb4,0x01,0x05,0x75,0x11,0x03,0x80,
+0x03,0x75,0x11,0x01,0xeb,0xc3,0x95,0x11,0x40,0x04,0xaf,0x0a,0x80,0x33,0xe5,0x0e,
+0x25,0x0d,0xf5,0x0f,0xe5,0x10,0x90,0x41,0xd6,0x93,0xff,0xe5,0x0f,0xd3,0x9f,0x74,
+0x01,0x40,0x11,0x25,0x0a,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xe4,0xf0,0xad,0x0b,
+0xaf,0x0a,0x41,0xa5,0x25,0x0a,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xe5,0x0f,0xf0,
+0x22,0xad,0x07,0x75,0xf0,0x09,0xed,0x90,0x96,0x48,0x12,0x43,0x5f,0xe0,0xff,0x74,
+0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xe0,0x54,0x1f,0xf5,0x12,0xd3,0x9f,
+0x40,0x02,0x8f,0x12,0xe5,0x12,0x25,0xe0,0x24,0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,
+0x83,0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xe5,0x12,0x25,0xe0,0x24,0x66,0xf5,0x82,
+0xe4,0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,
+0xef,0x13,0xff,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,
+0xf0,0xa3,0xef,0xf0,0xaf,0x05,0xad,0x12,0x51,0xa5,0xaf,0x12,0x22,0xac,0x07,0xec,
+0xc3,0x94,0x20,0x50,0x0d,0x74,0x84,0x2c,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,
+0x80,0x0b,0x74,0xa6,0x2c,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x54,0x7f,0xf5,
+0x1f,0xe5,0x1f,0x54,0x1f,0xff,0x90,0x9e,0x25,0xf0,0x75,0xf0,0x09,0xec,0x90,0x96,
+0x49,0x12,0x43,0x5f,0xe0,0x90,0x9e,0x27,0xf0,0x75,0xf0,0x09,0xec,0x90,0x96,0x48,
+0x12,0x43,0x5f,0xe0,0xfe,0x90,0x9e,0x28,0xf0,0xec,0x25,0xe0,0x24,0xc6,0xf5,0x82,
+0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfb,0xa3,0xe0,0x90,0x9e,0x29,0xcb,0xf0,0xa3,0xeb,
+0xf0,0xec,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0xfb,0xa3,
+0xe0,0x90,0x9e,0x2b,0xcb,0xf0,0xa3,0xeb,0xf0,0xef,0xd3,0x9e,0x40,0x0a,0x90,0x9e,
+0x28,0xe0,0x90,0x9e,0x25,0xf0,0xf5,0x1f,0xed,0x70,0x02,0xa1,0x13,0x90,0x9e,0x26,
+0xed,0xf0,0xe5,0x1f,0x30,0xe6,0x0a,0x90,0x9e,0x25,0xe0,0xf5,0x1f,0xa3,0xe0,0x14,
+0xf0,0x90,0x9e,0x26,0xe0,0x70,0x02,0xa1,0x13,0x90,0x9e,0x25,0xe0,0xff,0xd3,0x94,
+0x00,0x50,0x02,0xa1,0x13,0xe4,0x90,0x9e,0x24,0xf0,0xef,0x14,0x90,0x9e,0x23,0xf0,
+0x90,0x9e,0x27,0xe0,0xfd,0x90,0x9e,0x23,0xe0,0xff,0xd3,0x9d,0x40,0x6b,0xef,0x94,
+0x10,0x40,0x21,0xef,0x24,0xf0,0xff,0x74,0x01,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,
+0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x9e,0x2b,0xe0,0x5e,0xfe,0xa3,0xe0,
+0x5f,0x4e,0x70,0x27,0x90,0x9e,0x23,0xe0,0xff,0xc3,0x94,0x10,0x50,0x33,0x74,0x01,
+0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,
+0x9e,0x29,0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x60,0x16,0x90,0x9e,0x23,0xe0,0xf5,
+0x1f,0xa3,0xe0,0x04,0xf0,0x90,0x9e,0x26,0xe0,0xff,0x90,0x9e,0x24,0xe0,0x6f,0x60,
+0x08,0x90,0x9e,0x23,0xe0,0x14,0xf0,0x80,0x87,0x90,0x9e,0x26,0xe0,0xff,0x90,0x9e,
+0x24,0xe0,0xc3,0x9f,0x50,0x0d,0x90,0x9e,0x23,0xe0,0xb5,0x05,0x06,0x90,0x9e,0x27,
+0xe0,0xf5,0x1f,0xe5,0x1f,0x25,0xe0,0x24,0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,
+0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xe5,0x1f,0x25,0xe0,0x24,0x66,0xf5,0x82,0xe4,
+0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,0xef,
+0x13,0xff,0xec,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,
+0xa3,0xef,0xf0,0xaf,0x04,0xad,0x1f,0x51,0xa5,0xaf,0x1f,0x22,0xad,0x07,0xed,0xc3,
+0x94,0x20,0x50,0x0d,0x74,0x84,0x2d,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0x80,
+0x0b,0x74,0xa6,0x2d,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x54,0x7f,0xf5,0x1f,
+0xe5,0x1f,0x54,0x1f,0xfc,0x75,0xf0,0x09,0xed,0x90,0x96,0x48,0x12,0x43,0x5f,0xe0,
+0xff,0x90,0x9e,0x23,0xf0,0xed,0x25,0xe0,0x24,0x02,0xf5,0x82,0xe4,0x34,0x95,0xf5,
+0x83,0xe0,0xfb,0xa3,0xe0,0x90,0x9e,0x24,0xcb,0xf0,0xa3,0xeb,0xf0,0xed,0x25,0xe0,
+0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfb,0xa3,0xe0,0x90,0x9e,0x26,
+0xcb,0xf0,0xa3,0xeb,0xf0,0xec,0x25,0xe0,0x24,0x66,0xf5,0x82,0xe4,0x34,0x41,0xf5,
+0x83,0xe4,0x93,0xfa,0x74,0x01,0x93,0xfb,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,
+0x34,0x95,0xf5,0x83,0xea,0xf0,0xa3,0xeb,0xf0,0xec,0xc3,0x9f,0x40,0x02,0xc1,0x7a,
+0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xec,0xf0,0x04,0xfb,0x90,0x9e,
+0x23,0xe0,0xff,0xeb,0xd3,0x9f,0x40,0x02,0xc1,0xab,0xeb,0xc3,0x94,0x10,0x40,0x21,
+0xeb,0x24,0xf0,0xff,0x74,0x01,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,
+0x33,0xce,0xd8,0xf9,0xff,0x90,0x9e,0x24,0xe0,0x5e,0xfe,0xa3,0xe0,0x5f,0x4e,0x70,
+0x23,0xeb,0xc3,0x94,0x10,0x50,0x40,0x74,0x01,0x7e,0x00,0xa8,0x03,0x08,0x80,0x05,
+0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x9e,0x26,0xe0,0x5e,0xfe,0xa3,0xe0,
+0x5f,0x4e,0x60,0x23,0xbb,0x11,0x09,0x90,0x9e,0x25,0xe0,0x30,0xe7,0x02,0x7b,0x17,
+0xeb,0x64,0x13,0x60,0x03,0xbb,0x12,0x09,0x90,0x9e,0x24,0xe0,0x30,0xe0,0x02,0x7b,
+0x18,0xac,0x03,0x8c,0x1f,0x80,0x34,0x0b,0x80,0x84,0x90,0x9e,0x23,0xe0,0xfb,0x6c,
+0x70,0x69,0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xec,0xf0,0x75,0xf0,
+0x09,0xed,0x90,0x96,0x4a,0x12,0x43,0x5f,0xe0,0xb4,0x01,0x0c,0xe5,0x1f,0x20,0xe6,
+0x07,0xec,0x44,0x40,0xf5,0x1f,0x80,0x03,0xaf,0x1f,0x22,0xec,0x25,0xe0,0x24,0x9e,
+0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xec,0x25,
+0xe0,0x24,0x66,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,
+0x93,0x3e,0xc3,0x13,0xfe,0xef,0x13,0xff,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,
+0x34,0x95,0xf5,0x83,0xee,0xf0,0xa3,0xef,0xf0,0x80,0x5b,0xec,0xd3,0x9b,0x40,0x56,
+0x90,0x9e,0x23,0xe0,0xff,0x74,0x67,0x2d,0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xef,
+0xf0,0xac,0x07,0x8f,0x1f,0xec,0x25,0xe0,0x24,0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,
+0x83,0xe4,0x93,0xfe,0x74,0x01,0x93,0xff,0xec,0x25,0xe0,0x24,0x66,0xf5,0x82,0xe4,
+0x34,0x41,0xf5,0x83,0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,0xef,
+0x13,0xff,0xed,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,
+0xa3,0xef,0xf0,0xaf,0x1f,0x22,0x74,0x01,0x2d,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,
+0xe4,0xf0,0xaf,0x05,0xe5,0x1f,0x44,0x80,0xfd,0x51,0xa5,0xe5,0x1f,0x44,0x80,0xff,
+0x22,0xef,0xc3,0x94,0x20,0x50,0x39,0xef,0x30,0xe0,0x17,0xed,0xc4,0x54,0xf0,0xfd,
+0xef,0xc3,0x13,0xfe,0x24,0xa4,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0x54,0x0f,
+0x80,0x10,0xef,0xc3,0x13,0xfe,0x24,0xa4,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,
+0x54,0xf0,0xf0,0x74,0xa4,0x2e,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0xe0,0x4d,0xf0,
+0x22,0xe4,0xf5,0x14,0xe5,0x14,0xb4,0x20,0x14,0x90,0x9a,0xc5,0xe0,0x04,0xf0,0x90,
+0x95,0x01,0xe0,0xff,0x90,0x9a,0xc5,0xe0,0xb5,0x07,0x02,0xe4,0xf0,0x75,0xf0,0x09,
+0xe5,0x14,0x90,0x96,0x4b,0x12,0x43,0x5f,0xe0,0x64,0x01,0x60,0x03,0x02,0x6e,0x6a,
+0xe5,0x14,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,0x34,0x93,0xf5,0x83,0xe0,0xfe,0xa3,
+0xe0,0xd3,0x94,0x00,0xee,0x94,0x00,0x50,0x03,0x02,0x6e,0x6a,0xe5,0x14,0x94,0x20,
+0x40,0x09,0x90,0x9a,0xc5,0xe0,0x60,0x03,0x02,0x6e,0x76,0xe5,0x14,0x75,0xf0,0x0a,
+0xa4,0x24,0x00,0xf9,0x74,0x90,0x35,0xf0,0x75,0x18,0x01,0xf5,0x19,0x89,0x1a,0xe5,
+0x14,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,0x34,0x93,0xf5,0x83,0xe0,0xff,0xa3,0xe0,
+0x90,0x9e,0x1b,0xcf,0xf0,0xa3,0xef,0xf0,0xe5,0x14,0x25,0xe0,0x24,0xc4,0xf5,0x82,
+0xe4,0x34,0x98,0xf5,0x83,0xe0,0xff,0xa3,0xe0,0x90,0x9e,0x1d,0xcf,0xf0,0xa3,0xef,
+0xf0,0xe5,0x14,0xc3,0x94,0x20,0x50,0x14,0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,
+0x04,0xf5,0x83,0xe0,0x54,0x3f,0x90,0x9e,0x19,0xf0,0x80,0x12,0x74,0xa6,0x25,0x14,
+0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x54,0x3f,0x90,0x9e,0x19,0xf0,0x90,0x9e,
+0x19,0xe0,0xfe,0x54,0x1f,0xa3,0xf0,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x48,0x12,
+0x43,0x5f,0xe0,0x90,0x9e,0x20,0xf0,0x74,0xe6,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,
+0xf5,0x83,0xe0,0xc3,0x94,0x05,0x40,0x02,0x41,0x9f,0x90,0x9e,0x20,0xe0,0xff,0x90,
+0x9e,0x1a,0xe0,0x9f,0x40,0x13,0x90,0x9e,0x20,0xe0,0x90,0x9e,0x1a,0xf0,0xee,0x54,
+0x40,0xfe,0x90,0x9e,0x19,0xf0,0xef,0x4e,0xf0,0x90,0x04,0xfd,0xe0,0x54,0x05,0x64,
+0x01,0x70,0x29,0x90,0x9e,0x1a,0xe0,0xff,0x90,0x41,0x4a,0x93,0xfe,0x74,0x44,0x25,
+0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xc3,0x9e,0x40,0x06,0xef,0x90,0x40,
+0xda,0x80,0x30,0x90,0x9e,0x1a,0xe0,0x90,0x40,0xf6,0x80,0x27,0x90,0x9e,0x1a,0xe0,
+0xff,0x90,0x41,0x4a,0x93,0xfe,0x74,0x44,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,
+0x83,0xe0,0xc3,0x9e,0x40,0x06,0xef,0x90,0x41,0x12,0x80,0x07,0x90,0x9e,0x1a,0xe0,
+0x90,0x41,0x2e,0x93,0x90,0x9e,0x1f,0xf0,0x90,0x9e,0x1f,0xe0,0x75,0xf0,0x06,0xa4,
+0x24,0x50,0xf9,0x74,0x40,0x35,0xf0,0xfa,0x7b,0xff,0x8b,0x15,0xf5,0x16,0x89,0x17,
+0xe5,0x14,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xe0,0xf5,0x1b,
+0xa3,0xe0,0xf5,0x1c,0x12,0x29,0xd9,0xff,0x7e,0x00,0xab,0x18,0xaa,0x19,0xa9,0x1a,
+0x12,0x42,0x97,0xfd,0xac,0xf0,0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,0x35,
+0x1b,0xf5,0x1b,0xab,0x15,0xaa,0x16,0xa9,0x17,0x90,0x00,0x01,0x12,0x42,0x20,0xff,
+0x7e,0x00,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x02,0x12,0x42,0xc2,0xfd,0xac,
+0xf0,0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,0x35,0x1b,0xf5,0x1b,0xab,0x15,
+0xaa,0x16,0xa9,0x17,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0x7e,0x00,0xab,0x18,0xaa,
+0x19,0xa9,0x1a,0x90,0x00,0x04,0x12,0x42,0xc2,0xfd,0xac,0xf0,0x12,0x29,0xf2,0xef,
+0x25,0x1c,0xf5,0x1c,0xee,0x35,0x1b,0xf5,0x1b,0xab,0x15,0xaa,0x16,0xa9,0x17,0x90,
+0x00,0x03,0x12,0x42,0x20,0xff,0x7e,0x00,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,
+0x06,0x12,0x42,0xc2,0xfd,0xac,0xf0,0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,
+0x35,0x1b,0xf5,0x1b,0xab,0x15,0xaa,0x16,0xa9,0x17,0x90,0x00,0x04,0x12,0x42,0x20,
+0xff,0x7e,0x00,0xab,0x18,0xaa,0x19,0xa9,0x1a,0x90,0x00,0x08,0x12,0x42,0xc2,0xfd,
+0xac,0xf0,0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,0x35,0x1b,0xf5,0x1b,0xab,
+0x15,0xaa,0x16,0xa9,0x17,0x90,0x00,0x05,0x12,0x42,0x20,0xff,0x7e,0x00,0x90,0x9e,
+0x1b,0xe0,0xfc,0xa3,0xe0,0xfd,0x12,0x29,0xf2,0xd3,0xe5,0x1c,0x9f,0xe5,0x1b,0x9e,
+0x40,0x0c,0xe5,0x1c,0x9f,0xf5,0x1c,0xe5,0x1b,0x9e,0xf5,0x1b,0x80,0x05,0xe4,0xf5,
+0x1b,0xf5,0x1c,0xe5,0x14,0x25,0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,
+0xe5,0x1b,0xf0,0xa3,0xe5,0x1c,0xf0,0x90,0x9e,0x19,0xe0,0x25,0xe0,0x24,0x66,0xf5,
+0x82,0xe4,0x34,0x41,0xf5,0x83,0xc3,0x74,0x01,0x93,0x95,0x1c,0xe4,0x93,0x95,0x1b,
+0x50,0x07,0xaf,0x14,0x12,0x65,0x5c,0xa1,0x31,0x90,0x9e,0x19,0xe0,0x25,0xe0,0x24,
+0x9e,0xf5,0x82,0xe4,0x34,0x41,0xf5,0x83,0xd3,0x74,0x01,0x93,0x95,0x1c,0xe4,0x93,
+0x95,0x1b,0x50,0x02,0xa1,0x31,0x7d,0x01,0xaf,0x14,0x12,0x63,0xbd,0xa1,0x31,0x74,
+0xe6,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0xfc,0x64,0x05,0x60,0x02,
+0x81,0x3a,0x90,0x96,0x43,0xe0,0xff,0xb4,0x03,0x0b,0x90,0x9e,0x1a,0xe0,0xc3,0x94,
+0x19,0x40,0x3d,0x80,0x2e,0xef,0xb4,0x02,0x0b,0x90,0x9e,0x1a,0xe0,0xc3,0x94,0x11,
+0x40,0x2e,0x80,0x1f,0x90,0x96,0x43,0xe0,0xff,0xb4,0x01,0x0b,0x90,0x9e,0x1a,0xe0,
+0xc3,0x94,0x0a,0x40,0x1b,0x80,0x0c,0xef,0x70,0x11,0x90,0x9e,0x1a,0xe0,0xc3,0x94,
+0x03,0x40,0x0d,0x90,0x9a,0x84,0x74,0x01,0xf0,0x80,0x05,0xe4,0x90,0x9a,0x84,0xf0,
+0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe0,0xf5,0x1e,0x74,0x44,
+0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xff,0xc3,0x94,0x30,0x50,0x02,
+0x61,0xe7,0x90,0x9a,0x84,0xe0,0x64,0x01,0x60,0x02,0x61,0xe7,0x74,0x85,0x25,0x14,
+0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0x64,0x0a,0x60,0x51,0xef,0x24,0x05,0xff,
+0xe4,0x33,0xfe,0x74,0x41,0x25,0x14,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xe0,0xfd,
+0xd3,0x9f,0xee,0x64,0x80,0xf8,0x74,0x80,0x98,0x50,0x32,0xed,0x24,0x05,0xff,0xe4,
+0x33,0xfe,0x74,0x44,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xd3,0x9f,
+0xee,0x64,0x80,0xf8,0x74,0x80,0x98,0x50,0x14,0x74,0x26,0x25,0x14,0xf5,0x82,0xe4,
+0x34,0x9d,0xf5,0x83,0xe0,0xff,0x90,0x9e,0x1a,0xe0,0x6f,0x60,0x3d,0x74,0x44,0x25,
+0x14,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xff,0xd3,0x94,0x42,0x40,0x05,0x75,
+0x1e,0x05,0x80,0x0e,0xef,0xd3,0x94,0x39,0x40,0x05,0x75,0x1e,0x03,0x80,0x03,0x75,
+0x1e,0x01,0x74,0x41,0x25,0x14,0xf5,0x82,0xe4,0x34,0x94,0xf5,0x83,0xef,0xf0,0x74,
+0x85,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,0x80,0x29,0x74,0xe6,0x25,0x14,0xf5,0x82,
+0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x74,0x85,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9a,
+0xf5,0x83,0xe0,0x04,0xf0,0x80,0x10,0xe4,0xf5,0x1e,0x74,0xe6,0x25,0x14,0xf5,0x82,
+0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x90,0x9e,0x1a,0xe0,0xff,0x74,0x26,0x25,0x14,
+0xf5,0x82,0xe4,0x34,0x9d,0xf5,0x83,0xef,0xf0,0x74,0x84,0x25,0x14,0xf5,0x82,0xe4,
+0x34,0x98,0xf5,0x83,0xe5,0x1e,0xf0,0x75,0xf0,0x09,0xe5,0x14,0x90,0x96,0x4c,0x12,
+0x43,0x5f,0xe0,0xb4,0x01,0x10,0xe4,0xf5,0x1e,0x74,0xe6,0x25,0x14,0xf5,0x82,0xe4,
+0x34,0x9c,0xf5,0x83,0xe4,0xf0,0xad,0x1e,0xa1,0x2c,0xec,0x64,0x06,0x60,0x02,0xa1,
+0x31,0xf5,0x1b,0xf5,0x1c,0x90,0x42,0x13,0x93,0xff,0x7e,0x00,0x90,0x9e,0x1b,0xe0,
+0xfc,0xa3,0xe0,0xfd,0x12,0x29,0xf2,0x90,0x9e,0x21,0xee,0xf0,0xa3,0xef,0xf0,0x74,
+0x84,0x25,0x14,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe0,0xf5,0x1e,0xe4,0xf5,0x1d,
+0xab,0x18,0xaa,0x19,0xa9,0x1a,0x75,0xf0,0x02,0xe5,0x1d,0xa4,0xf5,0x82,0x85,0xf0,
+0x83,0x12,0x42,0xc2,0xfd,0xac,0xf0,0xe5,0x1d,0x90,0x42,0x0e,0x93,0xff,0x7e,0x00,
+0x12,0x29,0xf2,0xef,0x25,0x1c,0xf5,0x1c,0xee,0x35,0x1b,0xf5,0x1b,0xc3,0x90,0x9e,
+0x22,0xe0,0x95,0x1c,0x90,0x9e,0x21,0xe0,0x95,0x1b,0x40,0x07,0x05,0x1d,0xe5,0x1d,
+0xb4,0x05,0xbd,0xe5,0x1d,0xc3,0x13,0xf5,0x1d,0xe5,0x1e,0xb4,0x01,0x06,0xe5,0x1d,
+0x70,0x46,0x80,0x13,0xe5,0x1e,0xb4,0x03,0x15,0xe5,0x1d,0x70,0x05,0x75,0x1e,0x03,
+0x80,0x39,0xe5,0x1d,0xb4,0x01,0x05,0x75,0x1e,0x01,0x80,0x2f,0x80,0x2a,0xe5,0x1e,
+0xb4,0x05,0x28,0xe5,0x1d,0x70,0x05,0x75,0x1e,0x05,0x80,0x0d,0xe5,0x1d,0xb4,0x01,
+0x05,0x75,0x1e,0x03,0x80,0x03,0x75,0x1e,0x01,0xd3,0x90,0x9e,0x1e,0xe0,0x94,0x03,
+0x90,0x9e,0x1d,0xe0,0x94,0x00,0x40,0x03,0xe4,0xf5,0x1e,0xd3,0x90,0x9e,0x1e,0xe0,
+0x94,0x03,0x90,0x9e,0x1d,0xe0,0x94,0x00,0x40,0x03,0xe4,0xf5,0x1e,0x74,0x84,0x25,
+0x14,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe5,0x1e,0xf0,0xfd,0xaf,0x14,0x12,0x67,
+0x61,0x74,0xe6,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0xd3,0x94,0x05,
+0x74,0xe6,0x50,0x0e,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe0,0x04,0xf0,
+0x80,0x0b,0x25,0x14,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x90,0x9e,0x1d,
+0xe0,0xfe,0xa3,0xe0,0xff,0xc3,0x74,0xff,0x9f,0xfd,0x74,0xff,0x9e,0xfc,0xe5,0x14,
+0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xfa,0xa3,0xe0,0xd3,
+0x9d,0xea,0x9c,0xe5,0x14,0x50,0x13,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,
+0xf5,0x83,0xee,0x8f,0xf0,0x12,0x42,0x81,0x80,0x10,0x25,0xe0,0x24,0xc6,0xf5,0x82,
+0xe4,0x34,0x9a,0xf5,0x83,0x74,0xff,0xf0,0xa3,0xf0,0xe5,0x14,0x25,0xe0,0x24,0x44,
+0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe0,0xfe,0xa3,0xe0,0xff,0xc3,0x74,0xff,0x9f,
+0xfd,0x74,0xff,0x9e,0xfc,0xe5,0x14,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,
+0xf5,0x83,0xe0,0xfa,0xa3,0xe0,0xd3,0x9d,0xea,0x9c,0xe5,0x14,0x50,0x13,0x25,0xe0,
+0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xee,0x8f,0xf0,0x12,0x42,0x81,0x80,
+0x10,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0x74,0xff,0xf0,0xa3,
+0xf0,0xab,0x18,0xaa,0x19,0xa9,0x1a,0xe4,0xf5,0xf0,0x12,0x42,0xfa,0xab,0x18,0xaa,
+0x19,0xa9,0x1a,0x90,0x00,0x02,0xe4,0xf5,0xf0,0x12,0x43,0x19,0x90,0x00,0x04,0xe4,
+0xf5,0xf0,0x12,0x43,0x19,0x90,0x00,0x06,0xe4,0xf5,0xf0,0x12,0x43,0x19,0x90,0x00,
+0x08,0xe4,0xf5,0xf0,0x12,0x43,0x19,0xe5,0x14,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,
+0x34,0x93,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0xe5,0x14,0x25,0xe0,0x24,0xc4,0xf5,0x82,
+0xe4,0x34,0x98,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0xe5,0x14,0x25,0xe0,0x24,0x44,0xf5,
+0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,0x05,0x14,0xe5,0x14,0xc3,0x94,
+0x40,0x50,0x03,0x02,0x67,0xa4,0x22,0x90,0x04,0x44,0x74,0x11,0xf0,0xa3,0x74,0xf0,
+0xf0,0xa3,0x74,0x0f,0xf0,0xa3,0xe4,0xf0,0xfd,0x74,0xa4,0x2d,0xf5,0x82,0xe4,0x34,
+0x04,0xf5,0x83,0xe4,0xf0,0x0d,0xbd,0x10,0xf0,0xe4,0x90,0x9a,0xc5,0xf0,0x90,0x95,
+0x01,0x04,0xf0,0xe4,0xfd,0x75,0xf0,0x0a,0xed,0x90,0x90,0x00,0x12,0x43,0x5f,0xe4,
+0xf0,0xa3,0xf0,0x75,0xf0,0x0a,0xed,0x90,0x90,0x02,0x12,0x43,0x5f,0xe4,0xf0,0xa3,
+0xf0,0x75,0xf0,0x0a,0xed,0x90,0x90,0x04,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x75,
+0xf0,0x0a,0xed,0x90,0x90,0x06,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x75,0xf0,0x0a,
+0xed,0x90,0x90,0x08,0x12,0x43,0x5f,0xe4,0xf0,0xa3,0xf0,0x74,0x26,0x2d,0xf5,0x82,
+0xe4,0x34,0x9d,0xf5,0x83,0x74,0x13,0xf0,0x74,0x85,0x2d,0xf5,0x82,0xe4,0x34,0x9a,
+0xf5,0x83,0xe4,0xf0,0x74,0x84,0x2d,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe4,0xf0,
+0xed,0x25,0xe0,0x24,0x80,0xf5,0x82,0xe4,0x34,0x93,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,0x34,0x98,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0xc4,0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0x44,0xf5,0x82,0xe4,0x34,0x99,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0xed,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,0xa3,0xf0,
+0x74,0x86,0x2d,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x74,0x46,0x2d,0xf5,
+0x82,0xe4,0x34,0x9c,0xf5,0x83,0xe4,0xf0,0x74,0xe6,0x2d,0xf5,0x82,0xe4,0x34,0x9c,
+0xf5,0x83,0xe4,0xf0,0x90,0x41,0xc4,0x93,0xfe,0x74,0x01,0x93,0xff,0x90,0x41,0x8c,
+0x74,0x01,0x93,0x2f,0xff,0xe4,0x93,0x3e,0xc3,0x13,0xfe,0xef,0x13,0xff,0xed,0x25,
+0xe0,0x24,0xc2,0xf5,0x82,0xe4,0x34,0x95,0xf5,0x83,0xee,0xf0,0xa3,0xef,0xf0,0x75,
+0xf0,0x09,0xed,0x90,0x96,0x4b,0x12,0x43,0x5f,0x74,0x01,0xf0,0x75,0xf0,0x09,0xed,
+0x90,0x96,0x4a,0x12,0x43,0x5f,0x74,0x01,0xf0,0x74,0x82,0x2d,0xf5,0x82,0xe4,0x34,
+0x95,0xf5,0x83,0x74,0x0c,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x46,0x12,0x43,0x5f,
+0x74,0xff,0xf0,0xa3,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x44,0x12,0x43,0x5f,0xe4,
+0xf0,0xa3,0x74,0x0f,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x48,0x12,0x43,0x5f,0x74,
+0x13,0xf0,0x75,0xf0,0x09,0xed,0x90,0x96,0x49,0x12,0x43,0x5f,0xe4,0xf0,0xed,0xc3,
+0x94,0x20,0x50,0x0f,0x74,0x84,0x2d,0xf5,0x82,0xe4,0x34,0x04,0xf5,0x83,0x74,0x13,
+0xf0,0x80,0x0d,0x74,0xa6,0x2d,0xf5,0x82,0xe4,0x34,0x9c,0xf5,0x83,0x74,0x13,0xf0,
+0x0d,0xed,0x64,0x40,0x60,0x03,0x02,0x6e,0xa5,0x22,0x12,0x29,0xd9,0xf5,0x14,0xc3,
+0x94,0x40,0x50,0x15,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0x74,0x44,0x25,0x14,0xf5,
+0x82,0xe4,0x34,0x9a,0xf5,0x83,0xef,0xf0,0x22,0xe5,0x14,0xb4,0x40,0x0a,0x90,0x00,
+0x02,0x12,0x42,0x20,0x90,0x96,0x42,0xf0,0x22,0x90,0x9e,0x30,0x12,0x43,0x8b,0x90,
+0x9e,0x33,0xe0,0x54,0xf0,0x44,0x02,0xf0,0x54,0x0f,0x44,0xc0,0xf0,0x90,0x9e,0x30,
+0x12,0x43,0x6b,0x90,0x9e,0x90,0x12,0x43,0x8b,0x7b,0x01,0x7a,0x9e,0x79,0x33,0x02,
+0x53,0xf1,0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x90,0x00,0x01,0x12,0x42,0x20,0xfc,
+0xed,0xc3,0x94,0x40,0x40,0x02,0xe4,0xfd,0xec,0xc3,0x94,0x40,0x40,0x02,0xe4,0xfc,
+0xed,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xfa,0xa3,0xe0,
+0xfb,0xea,0x90,0x9e,0x24,0xf0,0xeb,0xa3,0xf0,0xed,0x25,0xe0,0x24,0x46,0xf5,0x82,
+0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfa,0xa3,0xe0,0xfb,0xea,0x90,0x9e,0x26,0xf0,0xeb,
+0xa3,0xf0,0xa3,0xed,0xf0,0xa3,0x74,0xff,0xf0,0xec,0x25,0xe0,0x24,0xc6,0xf5,0x82,
+0xe4,0x34,0x9a,0xf5,0x83,0xe0,0xfa,0xa3,0xe0,0xfb,0xea,0x90,0x9e,0x2a,0xf0,0xeb,
+0xa3,0xf0,0xec,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe0,0xfa,
+0xa3,0xe0,0xfb,0xea,0x90,0x9e,0x2c,0xf0,0xeb,0xa3,0xf0,0xa3,0xec,0xf0,0xa3,0x74,
+0xff,0xf0,0xed,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe4,0xf0,
+0xa3,0xf0,0xed,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,
+0xa3,0xf0,0xec,0x25,0xe0,0x24,0xc6,0xf5,0x82,0xe4,0x34,0x9a,0xf5,0x83,0xe4,0xf0,
+0xa3,0xf0,0xec,0x25,0xe0,0x24,0x46,0xf5,0x82,0xe4,0x34,0x9b,0xf5,0x83,0xe4,0xf0,
+0xa3,0xf0,0x7b,0x01,0x7a,0x9e,0x79,0x24,0x01,0x79,0xd3,0x10,0xaf,0x01,0xc3,0xc0,
+0xd0,0x90,0x9e,0xa4,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0x90,0x9e,
+0xa4,0xe0,0xfe,0xa3,0xe0,0xf5,0x82,0x8e,0x83,0xe0,0x60,0x2d,0xc3,0x90,0x9e,0xa7,
+0xe0,0x94,0xe8,0x90,0x9e,0xa6,0xe0,0x94,0x03,0x40,0x0b,0x90,0x01,0xc6,0xe0,0x44,
+0x10,0xf0,0x7f,0x00,0x80,0x15,0x90,0x9e,0xa6,0xe4,0x75,0xf0,0x01,0x12,0x42,0x81,
+0x7f,0x0a,0x7e,0x00,0x12,0x37,0x54,0x80,0xc5,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x24,0x12,0x2a,0x8b,0x00,0x00,0x00,
+0x00,0x90,0x00,0x01,0x12,0x42,0x20,0x90,0x9e,0x66,0xf0,0x90,0x00,0x03,0x12,0x42,
+0x20,0x90,0x9e,0x55,0xf0,0x12,0x56,0x22,0x90,0x01,0xe5,0xe5,0x63,0xf0,0x90,0x9e,
+0x66,0xe0,0x90,0x01,0xe6,0xf0,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x00,0x02,0x12,0x42,
+0x20,0xff,0x30,0xe0,0x25,0x12,0x29,0xd9,0x90,0x9e,0x5c,0xf0,0x90,0x00,0x01,0x12,
+0x42,0x20,0x90,0x9e,0x5d,0xf0,0xef,0xc3,0x13,0x54,0x7f,0x90,0x9e,0x5b,0xf0,0x90,
+0x00,0x03,0x12,0x42,0x20,0x90,0x9e,0x62,0xf0,0x22,0x90,0x9e,0x5c,0x74,0x0a,0xf0,
+0x90,0x9e,0x5d,0x74,0x05,0xf0,0x90,0x9e,0x5b,0x74,0x14,0xf0,0x90,0x9e,0x62,0x74,
+0x05,0xf0,0x22,0x12,0x29,0xd9,0x30,0xe0,0x19,0xc3,0x13,0x54,0x7f,0x90,0x9e,0x61,
+0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0x90,0x9e,0x5f,0xe4,0xf0,0xa3,0xef,0xf0,
+0x80,0x0f,0x90,0x9e,0x61,0x74,0x07,0xf0,0x90,0x9e,0x5f,0xe4,0xf0,0xa3,0x74,0x03,
+0xf0,0x90,0x9e,0x5f,0xe0,0xa3,0xe0,0x90,0x05,0x58,0xf0,0x22,0x90,0x9e,0x24,0x12,
+0x2a,0x8b,0x00,0x00,0x00,0x00,0x12,0x29,0xd9,0x60,0x0d,0x90,0x9e,0x5e,0xf0,0xe4,
+0xfd,0x7f,0x04,0x12,0x54,0xe7,0x80,0x05,0xe4,0x90,0x9e,0x5e,0xf0,0x90,0x9e,0x5e,
+0xe0,0x90,0x01,0xe7,0xf0,0x22,0x90,0x02,0x09,0xe0,0xfd,0x12,0x29,0xd9,0xfe,0xaf,
+0x05,0xed,0x2e,0x90,0x9e,0x78,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0xed,0x2f,
+0x90,0x9e,0x79,0xf0,0x90,0x00,0x02,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x9e,0x7a,
+0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x9e,0x7b,0xf0,0x90,0x00,
+0x04,0x12,0x42,0x20,0xff,0xae,0x05,0xed,0x2f,0x90,0x9e,0x7c,0xf0,0x22,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x9e,0x24,0x12,0x43,0x8b,0x90,0x9e,0x24,0x12,0x43,
+0x6b,0x90,0x00,0x01,0x12,0x42,0xc2,0xfa,0xe5,0xf0,0x24,0x00,0xff,0xe4,0x3a,0xfe,
+0x90,0x9e,0x24,0x12,0x43,0x6b,0x90,0x00,0x01,0xee,0x8f,0xf0,0x12,0x43,0x19,0x12,
+0x29,0xd9,0xff,0x60,0x2d,0xb5,0x65,0x16,0x90,0x9e,0x24,0x12,0x43,0x6b,0x90,0x00,
+0x01,0x12,0x42,0xc2,0x65,0x67,0x70,0x04,0xe5,0x66,0x65,0xf0,0x60,0x24,0x90,0x9e,
+0x24,0x12,0x43,0x6b,0x90,0x00,0x01,0x12,0x42,0xc2,0xff,0xae,0xf0,0x12,0x4e,0x37,
+0x80,0x10,0x90,0x9e,0x24,0x12,0x43,0x6b,0x12,0x29,0xd9,0x65,0x65,0x60,0x03,0x12,
+0x44,0xc2,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x06,0x34,0x74,0xff,0xf0,0xe4,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xf0,0x22,0x90,0x06,0x34,0xe0,0x60,0x24,0x14,0x70,0x1a,0x7b,0x01,
+0x7a,0x06,0x79,0x35,0x7f,0xf9,0x7e,0x01,0x71,0xb0,0xbf,0x01,0x09,0x90,0x06,0x35,
+0xe0,0x54,0x0f,0xf0,0x80,0x04,0x80,0x00,0x80,0xcd,0xe4,0x90,0x06,0x34,0xf0,0x22,
+0x8e,0x14,0x8f,0x15,0x8b,0x16,0x8a,0x17,0x89,0x18,0xe4,0x90,0x9e,0x19,0xf0,0xef,
+0x90,0x00,0x31,0xf0,0x12,0x4d,0x45,0xe5,0x14,0x54,0x03,0xff,0x90,0x00,0x32,0xe0,
+0x54,0xfc,0x4f,0xf0,0x12,0x4d,0x45,0x90,0x00,0x33,0xe0,0x54,0x7f,0xf0,0x12,0x4d,
+0x45,0x90,0x00,0x33,0xe0,0x20,0xe7,0x0e,0x90,0x9e,0x19,0xe0,0xc3,0x94,0x64,0x50,
+0x05,0xe0,0x04,0xf0,0x80,0xeb,0x90,0x9e,0x19,0xe0,0xc3,0x94,0x64,0x50,0x10,0x90,
+0x00,0x30,0xe0,0xab,0x16,0xaa,0x17,0xa9,0x18,0x12,0x42,0x4d,0x7f,0x01,0x22,0x7f,
+0x00,0x22,0xe4,0x90,0x9e,0xac,0xf0,0xa3,0xf0,0x90,0x05,0xf8,0xe0,0x70,0x0f,0xa3,
+0xe0,0x70,0x0b,0xa3,0xe0,0x70,0x07,0xa3,0xe0,0x70,0x03,0x7f,0x01,0x22,0xd3,0x90,
+0x9e,0xad,0xe0,0x94,0xe8,0x90,0x9e,0xac,0xe0,0x94,0x03,0x40,0x03,0x7f,0x00,0x22,
+0x7f,0x32,0x7e,0x00,0x12,0x37,0x54,0x90,0x9e,0xac,0xe4,0x75,0xf0,0x01,0x12,0x42,
+0x81,0x80,0xc6,0x90,0x9d,0xff,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x78,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9e,0x03,0x12,0x43,0x53,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x9e,0x07,0x12,0x43,0x53,0x90,
+0x80,0x85,0x12,0x2a,0x7f,0x7f,0x00,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9e,0x0b,0x12,
+0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,
+0x80,0x59,0x12,0x2a,0x8b,0x00,0x03,0x2d,0x95,0xe4,0xfd,0xff,0x12,0x34,0x81,0x90,
+0x9e,0x80,0xe0,0xb4,0x01,0x11,0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,0x03,0x2d,0x95,
+0xe4,0xfd,0x7f,0x01,0x12,0x34,0x81,0x22,0x7f,0x78,0x7e,0x08,0x12,0x27,0xde,0x90,
+0x9d,0xff,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x27,0xde,0x90,0x9e,0x03,0x12,
+0x2a,0x7f,0x7f,0x00,0x7e,0x08,0x12,0x27,0xde,0x90,0x9e,0x07,0x12,0x2a,0x7f,0x90,
+0x9e,0x80,0xe0,0x90,0x9d,0xff,0xb4,0x01,0x0d,0x12,0x43,0x53,0xef,0x54,0xc7,0xff,
+0xed,0x54,0xc7,0xfd,0x80,0x07,0x12,0x43,0x53,0xef,0x54,0xc7,0xff,0xec,0x90,0x80,
+0x85,0x12,0x2a,0x7f,0x7f,0x78,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9e,0x03,0x12,0x43,
+0x53,0xef,0x54,0x0f,0xff,0xec,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,
+0x12,0x2f,0xd9,0x90,0x9e,0x07,0x12,0x43,0x53,0xef,0x44,0x02,0xff,0xec,0x90,0x80,
+0x85,0x12,0x2a,0x7f,0x7f,0x00,0x7e,0x08,0x12,0x2f,0xd9,0x7f,0x70,0x7e,0x0e,0x12,
+0x27,0xde,0x90,0x9e,0x0b,0x12,0x2a,0x7f,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,
+0x25,0xa0,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,
+0x00,0x00,0x00,0xe4,0xfd,0xff,0x12,0x34,0x81,0x90,0x9e,0x80,0xe0,0xb4,0x01,0x11,
+0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe4,0xfd,0x7f,0x01,0x12,0x34,
+0x81,0x22,0xef,0x70,0x02,0xe1,0x49,0x90,0x9e,0x0f,0xe0,0x60,0x03,0x02,0x7b,0x15,
+0x90,0x9d,0xfb,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x8c,0x7e,0x08,
+0x12,0x2f,0xd9,0x90,0x9d,0xa7,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x44,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9d,0xab,0x12,0x43,0x53,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x5c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x9d,0xaf,0x12,0x43,0x53,0x90,
+0x80,0x85,0x12,0x2a,0x7f,0x7f,0x6c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xb3,0x12,
+0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,
+0x9d,0xb7,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x74,0x7e,0x0e,0x12,
+0x2f,0xd9,0x90,0x9d,0xbb,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x78,
+0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xbf,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x7c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xc3,0x12,0x43,0x53,0x90,0x80,
+0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xc7,0x12,0x43,
+0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x84,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,
+0xcb,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x88,0x7e,0x0e,0x12,0x2f,
+0xd9,0x90,0x9d,0xcf,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x8c,0x7e,
+0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xd3,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0xd0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xd7,0x12,0x43,0x53,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0x7f,0xd4,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xdb,0x12,0x43,0x53,
+0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xd8,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xdf,
+0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xdc,0x7e,0x0e,0x12,0x2f,0xd9,
+0x90,0x9d,0xe3,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xe0,0x7e,0x0e,
+0x12,0x2f,0xd9,0x90,0x9d,0xe7,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0xec,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x9d,0xeb,0x12,0x43,0x53,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x9d,0xef,0x12,0x43,0x53,0x90,
+0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0d,0x12,0x2f,0xd9,0x90,0x9d,0xf3,0x12,
+0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,0x2f,0xd9,0x90,
+0x9d,0xf7,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x08,0x12,
+0x2f,0xd9,0x90,0x9e,0x0f,0x74,0x01,0xf0,0x22,0x90,0x9e,0x0f,0xe0,0x64,0x01,0x60,
+0x03,0x02,0x7b,0x15,0x7f,0x8c,0x7e,0x08,0x12,0x27,0xde,0x90,0x9d,0xfb,0x12,0x2a,
+0x7f,0x7f,0x44,0x7e,0x08,0x12,0x27,0xde,0x90,0x9d,0xa7,0x12,0x2a,0x7f,0x7f,0x5c,
+0x7e,0x08,0x12,0x27,0xde,0x90,0x9d,0xab,0x12,0x2a,0x7f,0x7f,0x6c,0x7e,0x0e,0x12,
+0x27,0xde,0x90,0x9d,0xaf,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,0x12,0x27,0xde,0x90,
+0x9d,0xb3,0x12,0x2a,0x7f,0x7f,0x74,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xb7,0x12,
+0x2a,0x7f,0x7f,0x78,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xbb,0x12,0x2a,0x7f,0x7f,
+0x7c,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xbf,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x0e,
+0x12,0x27,0xde,0x90,0x9d,0xc3,0x12,0x2a,0x7f,0x7f,0x84,0x7e,0x0e,0x12,0x27,0xde,
+0x90,0x9d,0xc7,0x12,0x2a,0x7f,0x7f,0x88,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xcb,
+0x12,0x2a,0x7f,0x7f,0x8c,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xcf,0x12,0x2a,0x7f,
+0x7f,0xd0,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xd3,0x12,0x2a,0x7f,0x7f,0xd4,0x7e,
+0x0e,0x12,0x27,0xde,0x90,0x9d,0xd7,0x12,0x2a,0x7f,0x7f,0xd8,0x7e,0x0e,0x12,0x27,
+0xde,0x90,0x9d,0xdb,0x12,0x2a,0x7f,0x7f,0xdc,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,
+0xdf,0x12,0x2a,0x7f,0x7f,0xe0,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xe3,0x12,0x2a,
+0x7f,0x7f,0xec,0x7e,0x0e,0x12,0x27,0xde,0x90,0x9d,0xe7,0x12,0x2a,0x7f,0x7f,0x04,
+0x7e,0x0c,0x12,0x27,0xde,0x90,0x9d,0xeb,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0d,0x12,
+0x27,0xde,0x90,0x9d,0xef,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,0x27,0xde,0x90,
+0x9d,0xf3,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x08,0x12,0x27,0xde,0x90,0x9d,0xf7,0x12,
+0x2a,0x7f,0x7f,0x8c,0x7e,0x08,0x12,0x27,0xde,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,
+0x9e,0xa8,0x12,0x43,0x53,0xed,0x44,0xc0,0xfd,0xec,0x90,0x9e,0xa8,0x12,0x2a,0x7f,
+0x90,0x9e,0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x8c,0x7e,0x08,
+0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x01,0x00,0x00,0x7f,0x44,0x7e,
+0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0xdb,0x25,0xa4,0x7f,0x5c,
+0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,
+0x6c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,
+0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x04,0x1b,0x25,
+0xa4,0x7f,0x74,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x04,0x1b,
+0x25,0xa4,0x7f,0x78,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x04,
+0x1b,0x25,0xa4,0x7f,0x7c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,
+0x04,0x1b,0x25,0xa4,0x7f,0x80,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,
+0x8b,0x63,0xdb,0x25,0xa4,0x7f,0x84,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,
+0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x88,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,
+0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0x8c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,
+0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,
+0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd4,0x7e,0x0e,0x12,0x2f,0xd9,
+0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd8,0x7e,0x0e,0x12,0x2f,
+0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa4,0x7f,0xdc,0x7e,0x0e,0x12,
+0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa4,0x7f,0xe0,0x7e,0x0e,
+0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x24,0xdb,0x25,0xa4,0x7f,0xec,0x7e,
+0x0e,0x12,0x2f,0xd9,0x7f,0x04,0x7e,0x0c,0x12,0x27,0xde,0x90,0x9e,0xa8,0x12,0x2a,
+0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xe4,0xff,0xec,0x90,0x9e,0xa8,0x12,0x2a,0x7f,
+0x90,0x9e,0xa8,0x12,0x43,0x53,0xef,0x44,0x11,0xff,0xec,0x90,0x9e,0xa8,0x12,0x2a,
+0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,
+0x0c,0x12,0x2f,0xd9,0x7f,0x04,0x7e,0x0d,0x12,0x27,0xde,0x90,0x9e,0xa8,0x12,0x2a,
+0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xef,0x54,0xf0,0xff,0xec,0x90,0x9e,0xa8,0x12,
+0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xef,0x44,0x01,0xff,0xec,0x90,0x9e,0xa8,
+0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x04,0x7e,0x0d,0x12,0x2f,0xd9,0x7f,0x0c,0x7e,0x09,0x12,0x27,0xde,0x90,0x9e,0xa8,
+0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xe4,0xff,0xec,0x90,0x9e,0xa8,0x12,
+0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xef,0x44,0x11,0xff,0xec,0x90,0x9e,0xa8,
+0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x0c,0x7e,0x09,0x12,0x2f,0xd9,0x7f,0x0c,0x7e,0x09,0x12,0x27,0xde,0x90,0x9e,0xa8,
+0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xed,0x54,0x0f,0xfd,0xec,0x54,0xf0,
+0xfc,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,0x53,0xed,0x44,0x10,
+0xfd,0xec,0x44,0x01,0xfc,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,
+0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,0x2f,0xd9,0x7f,0x04,
+0x7e,0x08,0x12,0x27,0xde,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,0x43,
+0x53,0xef,0x54,0xf0,0xff,0xec,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,0x12,
+0x43,0x53,0xef,0x44,0x01,0xff,0xec,0x90,0x9e,0xa8,0x12,0x2a,0x7f,0x90,0x9e,0xa8,
+0x12,0x43,0x53,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x08,0x12,0x2f,0xd9,
+0xe4,0x90,0x9e,0x0f,0xf0,0x22,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x9e,0x43,0xf0,
+0xe0,0x60,0x04,0xe0,0xf4,0x70,0x21,0xa2,0xaf,0xe4,0x33,0xf5,0x14,0xc2,0xaf,0x90,
+0x00,0x47,0xe0,0x54,0xfb,0xfd,0x7f,0x47,0x12,0x49,0x05,0x7d,0x40,0x7f,0x01,0x12,
+0x36,0xaf,0xe5,0x14,0x24,0xff,0x92,0xaf,0x22,0x90,0x9e,0x3a,0xe0,0xc3,0x94,0x14,
+0x50,0x05,0xe0,0x04,0xf0,0x81,0x01,0x90,0x9e,0x3a,0xe0,0x64,0x14,0x60,0x02,0x81,
+0x01,0x90,0x9e,0x49,0xe0,0x70,0x25,0x90,0x9e,0x4c,0xe0,0x70,0x1f,0x90,0x9e,0x4a,
+0xe0,0x70,0x19,0x90,0x9e,0x4d,0xe0,0x70,0x13,0x90,0x9e,0x4b,0xe0,0x70,0x0d,0x90,
+0x9e,0x4e,0xe0,0x70,0x07,0x90,0x04,0xfd,0xe0,0x54,0xfe,0xf0,0x90,0x9e,0x49,0xe0,
+0x90,0x04,0x44,0xf0,0x90,0x9e,0x4a,0xe0,0x90,0x04,0x45,0xf0,0x90,0x9e,0x4b,0xe0,
+0x90,0x04,0x46,0xf0,0xa3,0xe4,0xf0,0x90,0x9e,0x4c,0xe0,0x90,0x04,0x48,0xf0,0x90,
+0x9e,0x4d,0xe0,0x90,0x04,0x49,0xf0,0x90,0x9e,0x4e,0xe0,0x90,0x04,0x4a,0xf0,0xa3,
+0xe4,0xf0,0x90,0x9e,0x35,0xe0,0x90,0x04,0x4c,0xf0,0x90,0x9e,0x36,0xe0,0x90,0x04,
+0x4d,0xf0,0x90,0x9e,0x37,0xe0,0x90,0x04,0x4e,0xf0,0x90,0x9e,0x38,0xe0,0x90,0x04,
+0x4f,0xf0,0xe4,0x90,0x9e,0x3a,0xf0,0x90,0x9e,0x35,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,
+0xf0,0xa3,0xf0,0x90,0x9e,0x49,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,
+0xf0,0x90,0x05,0x60,0xe0,0x90,0x9e,0x19,0xf0,0x90,0x05,0x61,0xe0,0x90,0x9e,0x1a,
+0xf0,0x90,0x05,0x62,0xe0,0x90,0x9e,0x1b,0xf0,0x90,0x05,0x63,0xe0,0x90,0x9e,0x1c,
+0xf0,0x90,0x9e,0x52,0xe0,0xff,0x90,0x9e,0x1c,0xe0,0xfe,0xd3,0x9f,0x50,0x0b,0x90,
+0x9e,0x52,0xe0,0xc3,0x9e,0xd3,0x94,0x01,0x40,0x11,0x90,0x9e,0x40,0xe0,0xb4,0x01,
+0x02,0x80,0x03,0x90,0x9e,0x44,0xe0,0xff,0x12,0x4c,0xf0,0x22,0x90,0x9e,0x53,0xe0,
+0x64,0x01,0x60,0x08,0x90,0x9e,0x41,0xe0,0x60,0x02,0xa1,0x23,0x90,0x9e,0x35,0xe0,
+0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x3b,0x90,0x9e,0x36,0xe0,0xc3,0x94,
+0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x28,0x90,0x9e,0x37,0xe0,0xc3,0x94,0xff,
+0x50,0x0a,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x36,0xf0,0x80,0x15,0x90,0x9e,0x38,0xe0,
+0xc3,0x94,0xff,0x50,0x10,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x37,0xf0,0x90,0x9e,0x36,
+0xf0,0x90,0x9e,0x35,0xf0,0x90,0x00,0x44,0xe0,0x54,0x0c,0x60,0x76,0xe0,0x30,0xe2,
+0x32,0x90,0x9e,0x49,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x24,0x90,
+0x9e,0x4a,0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x11,0x90,0x9e,
+0x4b,0xe0,0xc3,0x94,0xff,0x50,0x0c,0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x4a,0xf0,0x90,
+0x9e,0x49,0xf0,0x90,0x00,0x44,0xe0,0x30,0xe3,0x32,0x90,0x9e,0x4c,0xe0,0xc3,0x94,
+0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x24,0x90,0x9e,0x4d,0xe0,0xc3,0x94,0xff,0x50,
+0x06,0xe0,0x04,0xf0,0xe4,0x80,0x11,0x90,0x9e,0x4e,0xe0,0xc3,0x94,0xff,0x50,0x0c,
+0xe0,0x04,0xf0,0xe4,0x90,0x9e,0x4d,0xf0,0x90,0x9e,0x4c,0xf0,0x90,0x04,0xfd,0xe0,
+0x44,0x01,0xf0,0x22,0x68,0x4c,};
+#else
+// =================== v88 TSMC P2PPS with CCX report C2H 2012-12-05 =======================
+u8 Rtl8192CUFwTSMCImgArray[TSMCImgArrayLength] = {
+0xC1, 0x88, 0x02, 0x05, 0x58, 0x00, 0x02, 0x00, 0x12, 0x05, 0x17, 0x12, 0xDE, 0x3E, 0x00, 0x00,
+0x94, 0x18, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x02, 0x46, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x02, 0x60, 0xF2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x02, 0x68, 0x91, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x4B, 0x87, 0x00, 0x00,
+0x05, 0x04, 0x03, 0x02, 0x00, 0x03, 0x06, 0x05, 0x04, 0x03, 0x00, 0x04, 0x06, 0x05, 0x04, 0x02,
+0x00, 0x04, 0x08, 0x07, 0x06, 0x04, 0x00, 0x06, 0x0A, 0x09, 0x08, 0x06, 0x00, 0x08, 0x0A, 0x09,
+0x08, 0x04, 0x00, 0x08, 0x0A, 0x09, 0x08, 0x02, 0x00, 0x08, 0x0A, 0x09, 0x08, 0x00, 0x00, 0x08,
+0x12, 0x11, 0x10, 0x08, 0x00, 0x10, 0x1A, 0x19, 0x18, 0x10, 0x00, 0x18, 0x22, 0x21, 0x20, 0x18,
+0x00, 0x20, 0x22, 0x21, 0x20, 0x10, 0x00, 0x20, 0x22, 0x21, 0x20, 0x08, 0x00, 0x20, 0x22, 0x21,
+0x1C, 0x08, 0x00, 0x20, 0x22, 0x21, 0x14, 0x08, 0x00, 0x20, 0x22, 0x20, 0x18, 0x08, 0x00, 0x20,
+0x31, 0x30, 0x20, 0x10, 0x00, 0x30, 0x31, 0x30, 0x18, 0x00, 0x00, 0x30, 0x31, 0x2F, 0x10, 0x10,
+0x00, 0x30, 0x31, 0x2C, 0x10, 0x10, 0x00, 0x30, 0x31, 0x28, 0x10, 0x00, 0x00, 0x30, 0x31, 0x20,
+0x10, 0x00, 0x00, 0x30, 0x31, 0x10, 0x10, 0x00, 0x00, 0x30, 0x04, 0x04, 0x04, 0x05, 0x04, 0x04,
+0x05, 0x07, 0x07, 0x07, 0x08, 0x0A, 0x04, 0x04, 0x04, 0x04, 0x06, 0x0A, 0x0B, 0x0D, 0x05, 0x05,
+0x07, 0x07, 0x08, 0x0B, 0x0D, 0x0F, 0x04, 0x04, 0x04, 0x05, 0x07, 0x07, 0x09, 0x09, 0x0C, 0x0E,
+0x10, 0x12, 0x06, 0x07, 0x09, 0x0A, 0x0C, 0x0E, 0x11, 0x13, 0x09, 0x09, 0x09, 0x09, 0x0C, 0x0E,
+0x11, 0x13, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0x26, 0x2A, 0x18, 0x1A,
+0x1D, 0x1F, 0x21, 0x27, 0x29, 0x2A, 0x00, 0x00, 0x00, 0x1F, 0x23, 0x28, 0x2A, 0x2C, 0x00, 0x04,
+0x00, 0x04, 0x00, 0x08, 0x00, 0x10, 0x00, 0x18, 0x00, 0x24, 0x00, 0x30, 0x00, 0x48, 0x00, 0x60,
+0x00, 0x90, 0x00, 0xC0, 0x00, 0xD8, 0x00, 0x50, 0x00, 0x78, 0x00, 0xA0, 0x00, 0xC8, 0x01, 0x40,
+0x01, 0x90, 0x01, 0xE0, 0x02, 0x30, 0x01, 0x2C, 0x01, 0x40, 0x01, 0xE0, 0x02, 0xD0, 0x03, 0xE8,
+0x04, 0xB0, 0x06, 0x40, 0x07, 0xD0, 0x00, 0x02, 0x00, 0x02, 0x00, 0x04, 0x00, 0x08, 0x00, 0x0C,
+0x00, 0x12, 0x00, 0x18, 0x00, 0x24, 0x00, 0x30, 0x00, 0x48, 0x00, 0x60, 0x00, 0x6C, 0x00, 0x28,
+0x00, 0x3C, 0x00, 0x50, 0x00, 0x64, 0x00, 0xA0, 0x00, 0xC8, 0x00, 0xF0, 0x01, 0x18, 0x00, 0x64,
+0x00, 0xA0, 0x00, 0xF0, 0x01, 0x68, 0x01, 0xF4, 0x02, 0x58, 0x03, 0x20, 0x03, 0xE8, 0x02, 0x02,
+0x02, 0x02, 0x02, 0x02, 0x03, 0x03, 0x04, 0x04, 0x05, 0x07, 0x02, 0x03, 0x04, 0x0A, 0x0C, 0x0E,
+0x10, 0x12, 0x05, 0x07, 0x07, 0x08, 0x0B, 0x12, 0x24, 0x3C, 0x01, 0x01, 0x01, 0x01, 0x01, 0x02,
+0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x05, 0x06,
+0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x20, 0x1E, 0x1C, 0x18, 0x10, 0x18, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0xBB, 0x01, 0x0C, 0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE0, 0x22, 0x50,
+0x06, 0xE9, 0x25, 0x82, 0xF8, 0xE6, 0x22, 0xBB, 0xFE, 0x06, 0xE9, 0x25, 0x82, 0xF8, 0xE2, 0x22,
+0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE4, 0x93, 0x22, 0xBB, 0x01, 0x06,
+0x89, 0x82, 0x8A, 0x83, 0xF0, 0x22, 0x50, 0x02, 0xF7, 0x22, 0xBB, 0xFE, 0x01, 0xF3, 0x22, 0xF8,
+0xBB, 0x01, 0x0D, 0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE8, 0xF0, 0x22,
+0x50, 0x06, 0xE9, 0x25, 0x82, 0xC8, 0xF6, 0x22, 0xBB, 0xFE, 0x05, 0xE9, 0x25, 0x82, 0xC8, 0xF2,
+0x22, 0xC5, 0xF0, 0xF8, 0xA3, 0xE0, 0x28, 0xF0, 0xC5, 0xF0, 0xF8, 0xE5, 0x82, 0x15, 0x82, 0x70,
+0x02, 0x15, 0x83, 0xE0, 0x38, 0xF0, 0x22, 0xBB, 0x01, 0x0A, 0x89, 0x82, 0x8A, 0x83, 0xE0, 0xF5,
+0xF0, 0xA3, 0xE0, 0x22, 0x50, 0x06, 0x87, 0xF0, 0x09, 0xE7, 0x19, 0x22, 0xBB, 0xFE, 0x07, 0xE3,
+0xF5, 0xF0, 0x09, 0xE3, 0x19, 0x22, 0x89, 0x82, 0x8A, 0x83, 0xE4, 0x93, 0xF5, 0xF0, 0x74, 0x01,
+0x93, 0x22, 0xBB, 0x01, 0x10, 0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE0,
+0xF5, 0xF0, 0xA3, 0xE0, 0x22, 0x50, 0x09, 0xE9, 0x25, 0x82, 0xF8, 0x86, 0xF0, 0x08, 0xE6, 0x22,
+0xBB, 0xFE, 0x0A, 0xE9, 0x25, 0x82, 0xF8, 0xE2, 0xF5, 0xF0, 0x08, 0xE2, 0x22, 0xE5, 0x83, 0x2A,
+0xF5, 0x83, 0xE9, 0x93, 0xF5, 0xF0, 0xA3, 0xE9, 0x93, 0x22, 0xBB, 0x01, 0x0A, 0x89, 0x82, 0x8A,
+0x83, 0xF0, 0xE5, 0xF0, 0xA3, 0xF0, 0x22, 0x50, 0x06, 0xF7, 0x09, 0xA7, 0xF0, 0x19, 0x22, 0xBB,
+0xFE, 0x06, 0xF3, 0xE5, 0xF0, 0x09, 0xF3, 0x19, 0x22, 0xF8, 0xBB, 0x01, 0x11, 0xE5, 0x82, 0x29,
+0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE8, 0xF0, 0xE5, 0xF0, 0xA3, 0xF0, 0x22, 0x50, 0x09,
+0xE9, 0x25, 0x82, 0xC8, 0xF6, 0x08, 0xA6, 0xF0, 0x22, 0xBB, 0xFE, 0x09, 0xE9, 0x25, 0x82, 0xC8,
+0xF2, 0xE5, 0xF0, 0x08, 0xF2, 0x22, 0xEF, 0x4B, 0xFF, 0xEE, 0x4A, 0xFE, 0xED, 0x49, 0xFD, 0xEC,
+0x48, 0xFC, 0x22, 0xE0, 0xFC, 0xA3, 0xE0, 0xFD, 0xA3, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0x22, 0xA4,
+0x25, 0x82, 0xF5, 0x82, 0xE5, 0xF0, 0x35, 0x83, 0xF5, 0x83, 0x22, 0xE0, 0xFB, 0xA3, 0xE0, 0xFA,
+0xA3, 0xE0, 0xF9, 0x22, 0xF8, 0xE0, 0xFB, 0xA3, 0xA3, 0xE0, 0xF9, 0x25, 0xF0, 0xF0, 0xE5, 0x82,
+0x15, 0x82, 0x70, 0x02, 0x15, 0x83, 0xE0, 0xFA, 0x38, 0xF0, 0x22, 0xEB, 0xF0, 0xA3, 0xEA, 0xF0,
+0xA3, 0xE9, 0xF0, 0x22, 0xD0, 0x83, 0xD0, 0x82, 0xF8, 0xE4, 0x93, 0x70, 0x12, 0x74, 0x01, 0x93,
+0x70, 0x0D, 0xA3, 0xA3, 0x93, 0xF8, 0x74, 0x01, 0x93, 0xF5, 0x82, 0x88, 0x83, 0xE4, 0x73, 0x74,
+0x02, 0x93, 0x68, 0x60, 0xEF, 0xA3, 0xA3, 0xA3, 0x80, 0xDF, 0xD0, 0x83, 0xD0, 0x82, 0xF8, 0xE4,
+0x93, 0x70, 0x12, 0x74, 0x01, 0x93, 0x70, 0x0D, 0xA3, 0xA3, 0x93, 0xF8, 0x74, 0x01, 0x93, 0xF5,
+0x82, 0x88, 0x83, 0xE4, 0x73, 0x74, 0x02, 0x93, 0xB5, 0xF0, 0x06, 0x74, 0x03, 0x93, 0x68, 0x60,
+0xE9, 0xA3, 0xA3, 0xA3, 0xA3, 0x80, 0xD8, 0xE4, 0x90, 0x8A, 0xC5, 0xF0, 0xE5, 0x24, 0x70, 0x03,
+0x02, 0x44, 0x9D, 0xE5, 0x21, 0x64, 0x01, 0x60, 0x03, 0x02, 0x44, 0x9D, 0xE5, 0x24, 0x14, 0x60,
+0x29, 0x24, 0xFD, 0x60, 0x25, 0x24, 0x02, 0x24, 0xFB, 0x50, 0x02, 0x80, 0x23, 0x90, 0x8B, 0x0B,
+0xE0, 0x14, 0xF0, 0xE0, 0x60, 0x04, 0xA3, 0xE0, 0x60, 0x16, 0x90, 0x8B, 0x0B, 0xE0, 0x70, 0x0A,
+0x90, 0x8B, 0x19, 0xE0, 0x90, 0x8B, 0x0B, 0xF0, 0x80, 0x00, 0x90, 0x8A, 0xC5, 0x74, 0x01, 0xF0,
+0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x16, 0xA3, 0xE0, 0xB4, 0x06, 0x05, 0xE4, 0x90, 0x8A, 0xC5,
+0xF0, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x70, 0x04, 0x90, 0x8A, 0xC5, 0xF0, 0x90, 0x8A, 0xC5,
+0xE0, 0x60, 0x4A, 0x43, 0x25, 0x10, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x0C, 0xE0, 0x75,
+0xF0, 0x03, 0xA4, 0xFF, 0x90, 0x8B, 0x15, 0xE0, 0x2F, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD,
+0x7F, 0x54, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x57, 0x74, 0x05, 0xF0, 0xE5, 0x22, 0x54,
+0x0F, 0xC3, 0x94, 0x04, 0x50, 0x07, 0x7D, 0x01, 0x7F, 0x04, 0x12, 0x45, 0xA2, 0x90, 0x8B, 0x2C,
+0xE0, 0x30, 0xE0, 0x09, 0x12, 0x7D, 0xC1, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x22, 0xE4, 0xF5,
+0x25, 0xF5, 0x24, 0x75, 0x23, 0x0C, 0x75, 0x22, 0x0C, 0x90, 0x8B, 0x1A, 0xF0, 0x90, 0x8B, 0x18,
+0xF0, 0x90, 0x8B, 0x17, 0xF0, 0x90, 0x8B, 0x19, 0x04, 0xF0, 0x90, 0x8B, 0x0B, 0xF0, 0xE4, 0x90,
+0x8B, 0x1B, 0xF0, 0x90, 0x8B, 0x0D, 0xF0, 0x90, 0x8B, 0x15, 0x74, 0x05, 0xF0, 0xE4, 0x90, 0x8B,
+0x0C, 0xF0, 0x90, 0x8B, 0x13, 0xF0, 0xA3, 0x74, 0x03, 0xF0, 0x90, 0x8B, 0x10, 0xF0, 0xA3, 0x74,
+0x05, 0xF0, 0x90, 0x8B, 0x0F, 0x74, 0x14, 0xF0, 0x90, 0x8B, 0x16, 0x74, 0x05, 0xF0, 0xE4, 0x90,
+0x8B, 0x0E, 0xF0, 0x90, 0x8B, 0x0A, 0xF0, 0x90, 0x8B, 0x08, 0xF0, 0x90, 0x8B, 0x12, 0xF0, 0x22,
+0x7F, 0x00, 0x22, 0x02, 0x45, 0x03, 0x02, 0x45, 0x06, 0x8E, 0x64, 0x8F, 0x65, 0xAD, 0x65, 0xAC,
+0x64, 0xAF, 0x63, 0x12, 0x4A, 0x5B, 0xAF, 0x65, 0xAE, 0x64, 0x90, 0x04, 0x80, 0xE0, 0x54, 0x0F,
+0xFD, 0xAC, 0x07, 0x74, 0x11, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x01,
+0xF0, 0x74, 0x11, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xFB, 0xF0, 0xAC,
+0x07, 0x74, 0x16, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0xFA, 0xF0, 0x74,
+0x15, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x1F, 0xF0, 0xAC, 0x07, 0x74,
+0x06, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x0F, 0xF0, 0x90, 0x04, 0x53,
+0xE4, 0xF0, 0x90, 0x04, 0x52, 0xF0, 0x90, 0x04, 0x51, 0x74, 0xFF, 0xF0, 0x90, 0x04, 0x50, 0x74,
+0xFD, 0xF0, 0x74, 0x14, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xC0, 0x4D,
+0xFD, 0x74, 0x14, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xED, 0xF0, 0x22, 0x7D, 0x01,
+0x7F, 0x0C, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8F, 0x67, 0x8D, 0x68, 0xE5, 0x67, 0x54,
+0x0F, 0xFF, 0xE5, 0x22, 0x54, 0x0F, 0x6F, 0x60, 0x72, 0xE5, 0x67, 0x30, 0xE2, 0x30, 0xE5, 0x22,
+0x20, 0xE2, 0x05, 0x7F, 0x01, 0x12, 0x4A, 0xB2, 0xE5, 0x22, 0x30, 0xE3, 0x10, 0xE5, 0x67, 0x20,
+0xE3, 0x0B, 0x12, 0x49, 0xD5, 0xEF, 0x60, 0x53, 0x12, 0x4A, 0xCC, 0x80, 0x4E, 0xE5, 0x22, 0x20,
+0xE3, 0x49, 0xE5, 0x67, 0x30, 0xE3, 0x44, 0xAF, 0x68, 0x12, 0x4A, 0x7C, 0x80, 0x3D, 0xE5, 0x22,
+0x54, 0x0F, 0xFF, 0xBF, 0x0C, 0x0E, 0xE5, 0x67, 0x20, 0xE3, 0x09, 0x12, 0x49, 0xD5, 0xEF, 0x60,
+0x2A, 0x12, 0x4A, 0xCC, 0xE5, 0x22, 0x54, 0x0F, 0xFF, 0xBF, 0x04, 0x0E, 0xE5, 0x67, 0x20, 0xE2,
+0x09, 0x12, 0x49, 0x93, 0xEF, 0x60, 0x14, 0x12, 0x4A, 0x32, 0xE5, 0x22, 0x54, 0x0F, 0xFF, 0xBF,
+0x02, 0x09, 0x12, 0x45, 0x00, 0xEF, 0x60, 0x03, 0x12, 0x4B, 0x10, 0xD0, 0xD0, 0x92, 0xAF, 0x22,
+0x02, 0x46, 0x6E, 0x02, 0x50, 0xC6, 0xE4, 0x93, 0xA3, 0xF8, 0xE4, 0x93, 0xA3, 0x40, 0x03, 0xF6,
+0x80, 0x01, 0xF2, 0x08, 0xDF, 0xF4, 0x80, 0x29, 0xE4, 0x93, 0xA3, 0xF8, 0x54, 0x07, 0x24, 0x0C,
+0xC8, 0xC3, 0x33, 0xC4, 0x54, 0x0F, 0x44, 0x20, 0xC8, 0x83, 0x40, 0x04, 0xF4, 0x56, 0x80, 0x01,
+0x46, 0xF6, 0xDF, 0xE4, 0x80, 0x0B, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x90, 0x4B,
+0x23, 0xE4, 0x7E, 0x01, 0x93, 0x60, 0xBC, 0xA3, 0xFF, 0x54, 0x3F, 0x30, 0xE5, 0x09, 0x54, 0x1F,
+0xFE, 0xE4, 0x93, 0xA3, 0x60, 0x01, 0x0E, 0xCF, 0x54, 0xC0, 0x25, 0xE0, 0x60, 0xA8, 0x40, 0xB8,
+0xE4, 0x93, 0xA3, 0xFA, 0xE4, 0x93, 0xA3, 0xF8, 0xE4, 0x93, 0xA3, 0xC8, 0xC5, 0x82, 0xC8, 0xCA,
+0xC5, 0x83, 0xCA, 0xF0, 0xA3, 0xC8, 0xC5, 0x82, 0xC8, 0xCA, 0xC5, 0x83, 0xCA, 0xDF, 0xE9, 0xDE,
+0xE7, 0x80, 0xBE, 0xE5, 0x21, 0x64, 0x01, 0x70, 0x67, 0xE5, 0x24, 0x60, 0x63, 0xE5, 0x24, 0x64,
+0x02, 0x60, 0x06, 0xE5, 0x24, 0x64, 0x05, 0x70, 0x27, 0x90, 0x06, 0xAB, 0xE0, 0x90, 0x8B, 0x0B,
+0xF0, 0x90, 0x06, 0xAA, 0xE0, 0x90, 0x8B, 0x19, 0xF0, 0x90, 0x8B, 0x0B, 0xE0, 0x70, 0x07, 0x90,
+0x8B, 0x19, 0xE0, 0xFF, 0x80, 0x05, 0x90, 0x8B, 0x0B, 0xE0, 0xFF, 0x90, 0x8B, 0x0B, 0xEF, 0xF0,
+0x90, 0x8B, 0x0D, 0xE0, 0x60, 0x02, 0xE4, 0xF0, 0xE4, 0x90, 0x8B, 0x0C, 0xF0, 0x90, 0x05, 0x58,
+0x74, 0x03, 0xF0, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x53, 0x25,
+0xFD, 0x53, 0x25, 0xEF, 0xE5, 0x24, 0x14, 0x24, 0xFD, 0x50, 0x02, 0x80, 0x03, 0x12, 0x47, 0x8E,
+0x22, 0xEF, 0x64, 0x01, 0x70, 0x35, 0x7D, 0x78, 0x7F, 0x02, 0x12, 0x36, 0x75, 0x7D, 0x02, 0x7F,
+0x03, 0x12, 0x36, 0x75, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x12,
+0x45, 0x9E, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x03, 0x12, 0x7D, 0xC1, 0x90, 0x06, 0x04, 0xE0,
+0x54, 0x7F, 0xF0, 0x90, 0x06, 0x0A, 0xE0, 0x54, 0xF8, 0xF0, 0x22, 0x90, 0x01, 0x36, 0x74, 0x7B,
+0xF0, 0xA3, 0x74, 0x02, 0xF0, 0x7D, 0x7B, 0xFF, 0x12, 0x36, 0xE6, 0x7D, 0x02, 0x7F, 0x03, 0x12,
+0x36, 0xE6, 0x90, 0x06, 0x04, 0xE0, 0x44, 0x80, 0xF0, 0x90, 0x06, 0x0A, 0xE0, 0x44, 0x07, 0xF0,
+0x12, 0x4B, 0x4F, 0xE5, 0x21, 0x20, 0xE0, 0x05, 0xE4, 0x90, 0x8B, 0x0D, 0xF0, 0x22, 0xE4, 0x90,
+0x8A, 0xC5, 0xF0, 0x90, 0x06, 0xA9, 0xE0, 0x90, 0x8A, 0xC5, 0xF0, 0xE0, 0x54, 0xC0, 0x70, 0x09,
+0x53, 0x25, 0xFE, 0x53, 0x25, 0xFD, 0x12, 0x4A, 0xFC, 0x90, 0x8A, 0xC5, 0xE0, 0x30, 0xE6, 0x15,
+0x43, 0x25, 0x01, 0x90, 0x8B, 0x1A, 0xE0, 0x64, 0x02, 0x60, 0x05, 0x12, 0x4A, 0x97, 0x80, 0x08,
+0x12, 0x49, 0x49, 0x80, 0x03, 0x53, 0x25, 0xFE, 0x90, 0x8A, 0xC5, 0xE0, 0x30, 0xE7, 0x27, 0x43,
+0x25, 0x02, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x11, 0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4,
+0xFB, 0xFD, 0x7F, 0x54, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x57, 0x74, 0x05, 0xF0, 0x90,
+0x8B, 0x1B, 0x74, 0x01, 0xF0, 0x22, 0x53, 0x25, 0xFD, 0x22, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x8B,
+0x12, 0x4B, 0x43, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0xF5, 0x24, 0x14, 0x60,
+0x0E, 0x14, 0x60, 0x1F, 0x14, 0x60, 0x31, 0x24, 0x03, 0x70, 0x44, 0x7F, 0x01, 0x80, 0x3D, 0x90,
+0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFD, 0xE4, 0xFF, 0x12, 0x4A,
+0x07, 0x80, 0x29, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFD,
+0x7F, 0x01, 0x12, 0x4A, 0x07, 0x1F, 0x80, 0x14, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x90, 0x00,
+0x02, 0x12, 0x42, 0x20, 0xFD, 0x7F, 0x02, 0x12, 0x4A, 0x07, 0xE4, 0xFF, 0x12, 0x47, 0x21, 0x22,
+0xE4, 0x90, 0x8A, 0xCB, 0xF0, 0xE5, 0x24, 0x60, 0x49, 0x90, 0x8B, 0x1B, 0xE0, 0x60, 0x0D, 0xE4,
+0xF0, 0x53, 0x25, 0xFD, 0xE5, 0x25, 0x54, 0x07, 0x70, 0x38, 0x80, 0x33, 0x90, 0x8B, 0x0C, 0xE0,
+0x04, 0xF0, 0x53, 0x25, 0xEF, 0x90, 0x8A, 0xCB, 0xE0, 0xFF, 0x90, 0x8B, 0x10, 0xE0, 0x2F, 0xFF,
+0xE4, 0x33, 0xFE, 0x90, 0x8B, 0x0C, 0xE0, 0xD3, 0x9F, 0xEE, 0x64, 0x80, 0xF8, 0x74, 0x80, 0x98,
+0x40, 0x0D, 0xE5, 0x21, 0xB4, 0x01, 0x0B, 0xA3, 0xE0, 0x70, 0x07, 0xE0, 0x04, 0xF0, 0x22, 0x12,
+0x4A, 0xFC, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8F, 0x63, 0x90, 0x04, 0x1D, 0xE0,
+0x60, 0x24, 0x90, 0x05, 0x22, 0xE0, 0xF5, 0x66, 0x74, 0xFF, 0xF0, 0x12, 0x7E, 0x9A, 0xBF, 0x01,
+0x0D, 0x90, 0x8A, 0xF9, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5F, 0xFD, 0x12, 0x45, 0x09, 0x90, 0x05,
+0x22, 0xE5, 0x66, 0xF0, 0x80, 0x0D, 0x90, 0x8A, 0xF9, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5F, 0xFD,
+0x12, 0x45, 0x09, 0x90, 0x04, 0x1F, 0x74, 0x20, 0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xE5, 0x24,
+0x14, 0x24, 0xFD, 0x50, 0x02, 0x80, 0x41, 0x90, 0x8B, 0x1A, 0xE0, 0x60, 0x2B, 0x12, 0x45, 0x9E,
+0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x0F, 0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD,
+0x7F, 0x58, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x5B, 0x74, 0x05, 0xF0, 0x90, 0x06, 0x92,
+0x74, 0x01, 0xF0, 0x90, 0x8B, 0x18, 0xF0, 0x22, 0xE5, 0x22, 0x54, 0x0F, 0xC3, 0x94, 0x04, 0x50,
+0x07, 0x7D, 0x01, 0x7F, 0x04, 0x12, 0x45, 0xA2, 0x22, 0x90, 0x01, 0x5F, 0xE4, 0xF0, 0x90, 0x01,
+0x3C, 0x74, 0x08, 0xF0, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x0F, 0xE0, 0x90, 0x8B, 0x3E,
+0xF0, 0xE4, 0xFB, 0xFD, 0x7F, 0x5C, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x5F, 0x74, 0x05,
+0xF0, 0x90, 0x06, 0x92, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x17, 0x14, 0xF0, 0xE5, 0x22, 0x54, 0x0F,
+0xC3, 0x94, 0x0C, 0x50, 0x0D, 0x12, 0x45, 0x9E, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x03, 0x12,
+0x7D, 0xC1, 0x22, 0x12, 0x4B, 0x34, 0xEF, 0x64, 0x01, 0x70, 0x37, 0xE5, 0x25, 0x54, 0x03, 0x70,
+0x31, 0xE5, 0x23, 0x54, 0x0F, 0xD3, 0x94, 0x02, 0x50, 0x28, 0xE5, 0x25, 0x20, 0xE2, 0x23, 0xE5,
+0x25, 0x20, 0xE4, 0x1E, 0x90, 0x8B, 0x0D, 0xE0, 0x70, 0x18, 0x90, 0x8B, 0x12, 0xE0, 0x70, 0x12,
+0xE5, 0x26, 0x70, 0x0E, 0x90, 0x01, 0xB9, 0xE4, 0xF0, 0x90, 0x01, 0xB8, 0x74, 0x04, 0xF0, 0x7F,
+0x01, 0x22, 0x7F, 0x00, 0x22, 0x12, 0x4B, 0x34, 0xEF, 0x64, 0x01, 0x70, 0x27, 0x90, 0x8B, 0x18,
+0xE0, 0x70, 0x21, 0x90, 0x8B, 0x17, 0xE0, 0x70, 0x1B, 0xE5, 0x23, 0x54, 0x0F, 0xD3, 0x94, 0x04,
+0x50, 0x12, 0xE5, 0x26, 0x70, 0x0E, 0x90, 0x01, 0xB9, 0xE4, 0xF0, 0x90, 0x01, 0xB8, 0x74, 0x08,
+0xF0, 0x7F, 0x01, 0x22, 0x7F, 0x00, 0x22, 0xEF, 0x24, 0xFE, 0x60, 0x0B, 0x04, 0x70, 0x22, 0x90,
+0x8B, 0x19, 0x74, 0x01, 0xF0, 0x80, 0x16, 0xED, 0x70, 0x0A, 0x90, 0x8B, 0x16, 0xE0, 0x90, 0x8B,
+0x19, 0xF0, 0x80, 0x05, 0x90, 0x8B, 0x19, 0xED, 0xF0, 0x90, 0x8B, 0x19, 0xE0, 0x90, 0x8B, 0x0B,
+0xF0, 0x22, 0x90, 0x01, 0x37, 0x74, 0x02, 0xF0, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x12, 0x7E,
+0x9A, 0xEF, 0x70, 0x06, 0x90, 0x01, 0xC8, 0x74, 0xFD, 0xF0, 0x7D, 0x02, 0x7F, 0x03, 0x12, 0x36,
+0xE6, 0x12, 0x7C, 0x50, 0x53, 0x22, 0xF0, 0x43, 0x22, 0x02, 0x22, 0xEF, 0x60, 0x0F, 0x74, 0x21,
+0x2D, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x10, 0xF0, 0x22, 0x74, 0x21, 0x2D,
+0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xEF, 0xF0, 0x22, 0x90, 0x06, 0x04, 0xE0,
+0x54, 0xBF, 0xF0, 0xEF, 0x60, 0x0A, 0xE5, 0x21, 0xB4, 0x01, 0x05, 0xE4, 0xFF, 0x12, 0x48, 0xB3,
+0x53, 0x22, 0xF0, 0x43, 0x22, 0x0C, 0x22, 0x90, 0x04, 0x1D, 0xE0, 0x70, 0x14, 0x90, 0x8A, 0xF8,
+0xE0, 0xFF, 0xE4, 0xFD, 0x12, 0x5F, 0xFD, 0x8E, 0x69, 0x8F, 0x6A, 0x90, 0x04, 0x1F, 0x74, 0x20,
+0xF0, 0x22, 0x90, 0x8B, 0x52, 0xEF, 0xF0, 0x12, 0x7D, 0x42, 0x90, 0x8B, 0x52, 0xE0, 0x60, 0x05,
+0x90, 0x05, 0x22, 0xE4, 0xF0, 0x53, 0x22, 0xF0, 0x43, 0x22, 0x04, 0x22, 0x90, 0x06, 0x04, 0xE0,
+0x44, 0x40, 0xF0, 0xE5, 0x21, 0xB4, 0x01, 0x05, 0x7F, 0x01, 0x12, 0x48, 0xB3, 0x53, 0x22, 0xF0,
+0x43, 0x22, 0x04, 0x22, 0xE5, 0x23, 0x30, 0xE6, 0x12, 0xE5, 0x23, 0x54, 0x0F, 0xFF, 0x90, 0x01,
+0x2F, 0xE0, 0x54, 0x80, 0x4F, 0x64, 0x80, 0xF0, 0x53, 0x23, 0xBF, 0x22, 0x90, 0x8B, 0x2C, 0xE0,
+0x30, 0xE0, 0x05, 0xAF, 0x23, 0x02, 0x7E, 0x06, 0x7D, 0x01, 0xAF, 0x23, 0x12, 0x45, 0xA2, 0x22,
+0x53, 0x22, 0xF0, 0x43, 0x22, 0x01, 0x12, 0x4B, 0x5A, 0x12, 0x4B, 0x5B, 0x53, 0x22, 0xF0, 0x43,
+0x22, 0x02, 0x22, 0x41, 0x8A, 0xF6, 0x00, 0x41, 0x8B, 0x05, 0x00, 0x41, 0x8B, 0x51, 0x00, 0x41,
+0x8B, 0x53, 0x00, 0x00, 0x90, 0x04, 0x1B, 0xE0, 0x54, 0x7F, 0x64, 0x7F, 0x7F, 0x01, 0x60, 0x02,
+0x7F, 0x00, 0x22, 0xE4, 0x90, 0x8B, 0x1B, 0xF0, 0x90, 0x8B, 0x0C, 0xF0, 0xF5, 0x25, 0x22, 0x90,
+0x8B, 0x13, 0xE0, 0xA3, 0xE0, 0x90, 0x05, 0x58, 0xF0, 0x22, 0x22, 0x22, 0xF0, 0x90, 0x8B, 0x0F,
+0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD, 0x7F, 0x58, 0x7E, 0x01, 0xD3, 0x10, 0xAF, 0x01,
+0xC3, 0xC0, 0xD0, 0x90, 0x8B, 0x3D, 0xE0, 0xFB, 0xA3, 0xE0, 0xF5, 0x44, 0xE4, 0xF5, 0x45, 0x12,
+0x35, 0xAB, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xC0, 0xE0, 0xC0, 0xF0, 0xC0, 0x83, 0xC0, 0x82, 0xC0,
+0xD0, 0x75, 0xD0, 0x00, 0xC0, 0x00, 0xC0, 0x01, 0xC0, 0x02, 0xC0, 0x03, 0xC0, 0x04, 0xC0, 0x05,
+0xC0, 0x06, 0xC0, 0x07, 0x75, 0x0E, 0x00, 0x90, 0x01, 0xC4, 0x74, 0x87, 0xF0, 0x74, 0x4B, 0xA3,
+0xF0, 0x53, 0x91, 0xDF, 0x90, 0x01, 0x3C, 0xE0, 0x55, 0x30, 0xF5, 0x34, 0xA3, 0xE0, 0x55, 0x31,
+0xF5, 0x35, 0xA3, 0xE0, 0x55, 0x32, 0xF5, 0x36, 0xA3, 0xE0, 0x55, 0x33, 0xF5, 0x37, 0xE5, 0x34,
+0x30, 0xE0, 0x51, 0x90, 0x01, 0x3C, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0x30, 0xE0, 0x1F,
+0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x18, 0x90, 0x8B, 0x34, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0xE0,
+0x64, 0x03, 0x60, 0x0B, 0x7F, 0x01, 0xB1, 0xE0, 0xEF, 0x70, 0x04, 0x7F, 0x02, 0xD1, 0x89, 0x90,
+0x8B, 0x2C, 0xE0, 0xFF, 0x30, 0xE0, 0x1D, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x16, 0x90, 0x8B,
+0x2E, 0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60, 0x09, 0xE4, 0xFF, 0xB1, 0xE0, 0xEF,
+0x70, 0x02, 0xD1, 0x56, 0xE5, 0x34, 0x30, 0xE1, 0x08, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x11,
+0x60, 0xE5, 0x34, 0x30, 0xE2, 0x28, 0x90, 0x01, 0x3C, 0x74, 0x04, 0xF0, 0x90, 0x06, 0x92, 0xE0,
+0x30, 0xE0, 0x14, 0x90, 0x8B, 0x3D, 0xE4, 0x71, 0x5C, 0x90, 0x01, 0x5B, 0x74, 0x05, 0xF0, 0x90,
+0x06, 0x92, 0x74, 0x01, 0xF0, 0x80, 0x07, 0x90, 0x8B, 0x18, 0xE4, 0xF0, 0x51, 0xFC, 0xE5, 0x34,
+0x30, 0xE3, 0x38, 0x90, 0x01, 0x3C, 0x74, 0x08, 0xF0, 0x90, 0x06, 0x92, 0xE0, 0x30, 0xE1, 0x24,
+0x90, 0x8B, 0x3D, 0xE4, 0xF0, 0x90, 0x8B, 0x0F, 0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD,
+0x7F, 0x5C, 0x7E, 0x01, 0x71, 0x6C, 0x90, 0x01, 0x5F, 0x74, 0x05, 0xF0, 0x90, 0x06, 0x92, 0x74,
+0x02, 0xF0, 0x80, 0x07, 0x90, 0x8B, 0x17, 0xE4, 0xF0, 0x51, 0xFC, 0xE5, 0x34, 0x30, 0xE4, 0x09,
+0x90, 0x01, 0x3C, 0x74, 0x10, 0xF0, 0x12, 0x51, 0xC9, 0xE5, 0x34, 0x30, 0xE5, 0x06, 0x90, 0x01,
+0x3C, 0x74, 0x20, 0xF0, 0xE5, 0x35, 0x30, 0xE0, 0x10, 0x90, 0x01, 0x3D, 0x74, 0x01, 0xF0, 0x90,
+0x00, 0x83, 0xE0, 0xF5, 0x23, 0x51, 0xE4, 0x51, 0xFC, 0xE5, 0x35, 0x30, 0xE2, 0x06, 0x90, 0x01,
+0x3D, 0x74, 0x04, 0xF0, 0xE5, 0x35, 0x30, 0xE4, 0x1B, 0x90, 0x01, 0x3D, 0x74, 0x10, 0xF0, 0x90,
+0x8B, 0x05, 0xE0, 0x60, 0x0F, 0xE4, 0xF0, 0x90, 0x05, 0x53, 0xE0, 0x44, 0x01, 0xF0, 0x90, 0x05,
+0xFD, 0xE0, 0x04, 0xF0, 0xE5, 0x36, 0x30, 0xE0, 0x75, 0x90, 0x01, 0x3E, 0x74, 0x01, 0xF0, 0x90,
+0x8B, 0x32, 0xE0, 0x30, 0xE0, 0x18, 0x90, 0x8B, 0x36, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0xE0, 0x64,
+0x03, 0x60, 0x0B, 0x7F, 0x01, 0xB1, 0xE0, 0xEF, 0x60, 0x04, 0x7F, 0x01, 0xD1, 0x89, 0x90, 0x8B,
+0x2C, 0xE0, 0x30, 0xE0, 0x49, 0x90, 0x8B, 0x30, 0xE4, 0xF0, 0xFF, 0xB1, 0xE0, 0xEF, 0x60, 0x3E,
+0x12, 0x65, 0x5F, 0x90, 0x8B, 0x2D, 0xE0, 0xFF, 0x64, 0x06, 0x60, 0x32, 0xEF, 0xB4, 0x04, 0x02,
+0x80, 0x07, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x04, 0xE4, 0xFF, 0x80, 0x14, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x05, 0x7F,
+0x01, 0x12, 0x65, 0x82, 0x7D, 0x01, 0xAF, 0x23, 0x12, 0x45, 0xA2, 0x12, 0x7D, 0xC1, 0xE5, 0x36,
+0x30, 0xE1, 0x47, 0x90, 0x01, 0x3E, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0x30, 0xE0, 0x19,
+0x90, 0x8B, 0x36, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x33, 0xE0, 0x64, 0x03, 0x60, 0x0B, 0x7F, 0x01,
+0xB1, 0xE0, 0xEF, 0x70, 0x04, 0x7F, 0x02, 0xD1, 0x89, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x1A,
+0x90, 0x8B, 0x30, 0x74, 0x01, 0xF0, 0x12, 0x7E, 0x2B, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60,
+0x09, 0xE4, 0xFF, 0xB1, 0xE0, 0xEF, 0x70, 0x02, 0xD1, 0x56, 0x74, 0x87, 0x04, 0x90, 0x01, 0xC4,
+0xF0, 0x74, 0x4B, 0xA3, 0xF0, 0xD0, 0x07, 0xD0, 0x06, 0xD0, 0x05, 0xD0, 0x04, 0xD0, 0x03, 0xD0,
+0x02, 0xD0, 0x01, 0xD0, 0x00, 0xD0, 0xD0, 0xD0, 0x82, 0xD0, 0x83, 0xD0, 0xF0, 0xD0, 0xE0, 0x32,
+0xEF, 0x64, 0x01, 0x70, 0x3D, 0x90, 0x8B, 0x35, 0xE0, 0x60, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B,
+0x08, 0xE0, 0x60, 0x03, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x34, 0xE0, 0x60, 0x03, 0x7F, 0x01, 0x22,
+0x90, 0x8B, 0x32, 0xE0, 0xFF, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x0B, 0xEF, 0xC4, 0x13, 0x54,
+0x07, 0x30, 0xE0, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x36, 0xE0, 0x7F, 0x01, 0x60, 0x36, 0x7F,
+0x00, 0x22, 0x90, 0x8B, 0x2F, 0xE0, 0x60, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x08, 0xE0, 0x60,
+0x03, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x2E, 0xE0, 0x60, 0x03, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x2C,
+0xE0, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x30, 0xE0, 0x7F,
+0x01, 0x60, 0x02, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x0D, 0xE0, 0x60, 0x16, 0x90, 0x8B, 0x2D, 0xE0,
+0x70, 0x04, 0x7F, 0x05, 0x80, 0x1F, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x01, 0x70, 0x1A, 0x7F, 0x02,
+0x80, 0x13, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x01, 0x04, 0x7F, 0x03, 0x80, 0x08, 0x90, 0x8B, 0x2D,
+0xE0, 0x70, 0x05, 0x7F, 0x04, 0x12, 0x65, 0x82, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0,
+0x90, 0x8B, 0x33, 0xE0, 0x90, 0x8B, 0x55, 0xF0, 0x6F, 0x70, 0x02, 0xE1, 0x55, 0xEF, 0x14, 0x60,
+0x3B, 0x14, 0x60, 0x5F, 0x14, 0x70, 0x02, 0xE1, 0x30, 0x24, 0x03, 0x60, 0x02, 0xE1, 0x55, 0x90,
+0x8B, 0x55, 0xE0, 0xB4, 0x03, 0x04, 0xF1, 0xC2, 0xE1, 0x55, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x02,
+0x04, 0xF1, 0xAF, 0xE1, 0x55, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x04, 0x04, 0xF1, 0xC6, 0xE1, 0x55,
+0x90, 0x8B, 0x55, 0xE0, 0x64, 0x01, 0x70, 0x7D, 0xF1, 0xB1, 0x80, 0x79, 0x90, 0x8B, 0x55, 0xE0,
+0xFF, 0xB4, 0x03, 0x04, 0xF1, 0xCA, 0x80, 0x6D, 0xEF, 0xB4, 0x02, 0x04, 0xF1, 0xA1, 0x80, 0x65,
+0x90, 0x8B, 0x55, 0xE0, 0xFF, 0xB4, 0x04, 0x04, 0xF1, 0xD5, 0x80, 0x59, 0xEF, 0x70, 0x56, 0xF1,
+0x8E, 0x80, 0x52, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x03, 0x05, 0x12, 0x7C, 0x41, 0x80, 0x46, 0x90,
+0x8B, 0x55, 0xE0, 0xB4, 0x01, 0x04, 0xF1, 0x72, 0x80, 0x3B, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x04,
+0x05, 0x12, 0x7D, 0x23, 0x80, 0x2F, 0x90, 0x8B, 0x55, 0xE0, 0x70, 0x29, 0xF1, 0x70, 0x80, 0x25,
+0x90, 0x8B, 0x55, 0xE0, 0xFF, 0xB4, 0x01, 0x04, 0xF1, 0x5A, 0x80, 0x19, 0xEF, 0xB4, 0x02, 0x04,
+0xF1, 0x6B, 0x80, 0x11, 0x90, 0x8B, 0x55, 0xE0, 0xFF, 0xB4, 0x04, 0x04, 0xF1, 0x5A, 0x80, 0x05,
+0xEF, 0x70, 0x02, 0xF1, 0x67, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x05, 0x22, 0x74, 0x6F, 0xF0,
+0x90, 0x8B, 0x33, 0x74, 0x03, 0xF0, 0x22, 0xF1, 0x8E, 0x80, 0xEF, 0x12, 0x7D, 0x42, 0x80, 0xEA,
+0xF1, 0x8E, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x12, 0x7E, 0x9A, 0xEF, 0x70, 0x06, 0x90, 0x01,
+0xC8, 0x74, 0xFD, 0xF0, 0x12, 0x7C, 0x50, 0x90, 0x8B, 0x33, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x01,
+0x3E, 0x74, 0x03, 0xF0, 0xFD, 0x7F, 0x02, 0x12, 0x37, 0x00, 0x90, 0x8B, 0x33, 0x74, 0x01, 0xF0,
+0x22, 0x12, 0x7D, 0x42, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0x04, 0xF0, 0x22, 0xF1,
+0xA1, 0x7D, 0x03, 0x7F, 0x02, 0x12, 0x36, 0x92, 0x90, 0x05, 0x27, 0xE4, 0xF0, 0x90, 0x8B, 0x33,
+0xF0, 0x22, 0xF1, 0xCA, 0x80, 0xEB, 0xF1, 0xD5, 0x80, 0xE7, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90,
+0x8B, 0x33, 0x04, 0xF0, 0x22, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0x04, 0xF0, 0x22,
+0xF1, 0x8E, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x33, 0x74, 0x04, 0xF0, 0x22, 0x90,
+0x02, 0x84, 0xEF, 0xF0, 0xA3, 0xEE, 0xF0, 0xA3, 0x74, 0x05, 0xF0, 0x22, 0xEF, 0x8E, 0xF0, 0x12,
+0x43, 0xBA, 0x50, 0x1A, 0x00, 0x40, 0x50, 0x42, 0x00, 0x80, 0x50, 0x6D, 0x01, 0x00, 0x50, 0x81,
+0x02, 0x00, 0x50, 0x99, 0x04, 0x00, 0x00, 0x00, 0x50, 0xB6, 0xED, 0x54, 0x3F, 0x70, 0x04, 0xFE,
+0xFF, 0x80, 0x04, 0x7E, 0x00, 0x7F, 0x40, 0xEF, 0x2D, 0xFF, 0xEE, 0x3C, 0xFE, 0xEF, 0x78, 0x06,
+0xCE, 0xC3, 0x13, 0xCE, 0x13, 0xD8, 0xF9, 0x78, 0x06, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9,
+0x80, 0x26, 0xED, 0x54, 0x7F, 0x70, 0x04, 0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x00, 0x7F, 0x80, 0xEF,
+0x2D, 0xFF, 0xEE, 0x3C, 0xFE, 0xEF, 0x78, 0x07, 0xCE, 0xC3, 0x13, 0xCE, 0x13, 0xD8, 0xF9, 0x78,
+0x07, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFD, 0xAC, 0x06, 0x80, 0x49, 0xED, 0x70, 0x04,
+0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x01, 0x7F, 0x00, 0xEF, 0x2D, 0xEE, 0x3C, 0x7D, 0x00, 0xFC, 0x80,
+0x35, 0xEC, 0x54, 0x01, 0x4D, 0x70, 0x04, 0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x02, 0x7F, 0x00, 0xEF,
+0x2D, 0xEE, 0x3C, 0xC3, 0x13, 0x7D, 0x00, 0x80, 0x1A, 0xEC, 0x54, 0x03, 0x4D, 0x70, 0x04, 0xFE,
+0xFF, 0x80, 0x04, 0x7E, 0x04, 0x7F, 0x00, 0xEF, 0x2D, 0xEE, 0x3C, 0x13, 0x13, 0x54, 0x3F, 0x7D,
+0x00, 0x25, 0xE0, 0x25, 0xE0, 0xFC, 0xAE, 0x04, 0xAF, 0x05, 0x22, 0x90, 0x01, 0xE4, 0x74, 0x58,
+0xF0, 0xA3, 0x74, 0x02, 0xF0, 0x22, 0xE4, 0x90, 0x8A, 0xCC, 0xF0, 0xA3, 0xF0, 0x75, 0x8E, 0x02,
+0x91, 0x0E, 0x12, 0x68, 0x44, 0x90, 0x8B, 0x07, 0xEF, 0xF0, 0x12, 0x68, 0x51, 0x90, 0x8B, 0x09,
+0xEF, 0xF0, 0x12, 0x68, 0x5D, 0x90, 0x8A, 0xF4, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xE4, 0xF5, 0x55,
+0xF5, 0x21, 0x12, 0x72, 0x55, 0x12, 0x44, 0x9E, 0x12, 0x32, 0x3D, 0x7F, 0x03, 0x12, 0x78, 0x42,
+0x12, 0x7C, 0x3D, 0x12, 0x68, 0x0A, 0x12, 0x68, 0x75, 0x12, 0x68, 0x8A, 0x12, 0x68, 0x28, 0x12,
+0x68, 0x43, 0x90, 0x8A, 0xCE, 0xE5, 0xD9, 0xF0, 0x31, 0x5F, 0xC2, 0xAF, 0x90, 0x00, 0x80, 0xE0,
+0x44, 0x40, 0xF0, 0x51, 0x0E, 0x75, 0xE8, 0x03, 0x43, 0xA8, 0x85, 0xD2, 0xAF, 0x11, 0xBB, 0x90,
+0x8A, 0xCC, 0xE0, 0x64, 0x01, 0xF0, 0x24, 0xC6, 0x90, 0x01, 0xC4, 0xF0, 0x74, 0x50, 0xA3, 0xF0,
+0xE5, 0x55, 0x30, 0xE4, 0x09, 0xC2, 0xAF, 0x53, 0x55, 0xEF, 0xD2, 0xAF, 0xB1, 0x59, 0xE5, 0x55,
+0x30, 0xE6, 0xDC, 0xC2, 0xAF, 0x53, 0x55, 0xBF, 0xD2, 0xAF, 0x12, 0x6B, 0xBD, 0x80, 0xD0, 0x90,
+0x01, 0x3C, 0x74, 0xFF, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0x90, 0x01, 0x34, 0xF0, 0xA3, 0xF0, 0xA3,
+0xF0, 0xA3, 0xF0, 0xFD, 0x7F, 0x54, 0x31, 0x88, 0x7D, 0xFF, 0x7F, 0x55, 0x31, 0x88, 0x7D, 0xFF,
+0x7F, 0x56, 0x31, 0x88, 0x7D, 0xFF, 0x7F, 0x57, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8F,
+0x82, 0x75, 0x83, 0x00, 0xED, 0xF0, 0x51, 0x0E, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x01, 0x30,
+0xE4, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0x90, 0x01, 0x38, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0,
+0xA3, 0xF0, 0xFD, 0x7F, 0x50, 0x31, 0x88, 0xE4, 0xFD, 0x7F, 0x51, 0x31, 0x88, 0xE4, 0xFD, 0x7F,
+0x52, 0x31, 0x88, 0xE4, 0xFD, 0x7F, 0x53, 0x80, 0xBF, 0xE5, 0x5E, 0x64, 0x01, 0x70, 0x3B, 0x71,
+0x4E, 0xBF, 0x01, 0x04, 0x7F, 0x01, 0x71, 0x42, 0x90, 0x00, 0x46, 0xE0, 0x44, 0x04, 0xFD, 0x7F,
+0x46, 0x31, 0x88, 0x90, 0x00, 0x44, 0xE0, 0x54, 0xFB, 0xFD, 0x7F, 0x44, 0x31, 0x88, 0x90, 0x00,
+0x46, 0xE0, 0x54, 0xFB, 0xFD, 0x7F, 0x46, 0x31, 0x88, 0x7F, 0x02, 0x71, 0x6A, 0x8F, 0x62, 0x90,
+0x01, 0xC9, 0xE5, 0x62, 0xF0, 0xB4, 0x01, 0x02, 0x51, 0xE2, 0x22, 0xE0, 0x5F, 0xF0, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x7F, 0x10, 0xDF, 0xFE, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8A, 0xE0, 0xED, 0xF0, 0x90, 0x8A, 0xDF, 0xEF, 0xF0, 0xD3,
+0x94, 0x07, 0x50, 0x4E, 0xA3, 0xE0, 0x70, 0x1A, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0x01, 0xA8,
+0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x47, 0xE0, 0x5F, 0xF0,
+0x80, 0x17, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33,
+0xD8, 0xFC, 0xFF, 0x90, 0x00, 0x47, 0xE0, 0x4F, 0xF0, 0x51, 0x0E, 0x90, 0x8A, 0xDF, 0xE0, 0xFF,
+0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x46,
+0x80, 0x59, 0x90, 0x8A, 0xDF, 0xE0, 0x24, 0xF8, 0xF0, 0xA3, 0xE0, 0x70, 0x1D, 0x90, 0x8A, 0xDF,
+0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xC4, 0x54, 0xF0,
+0xF4, 0xFF, 0x90, 0x00, 0x43, 0xE0, 0x5F, 0xF0, 0x80, 0x1A, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74,
+0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xC4, 0x54, 0xF0, 0xFF, 0x90, 0x00,
+0x43, 0xE0, 0x4F, 0xF0, 0x51, 0x0E, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08,
+0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x43, 0x51, 0x0B, 0xD0, 0xD0, 0x92,
+0xAF, 0x22, 0x90, 0x00, 0x49, 0xE0, 0x90, 0x8B, 0x54, 0xF0, 0xE0, 0x54, 0x0F, 0xF0, 0x44, 0xF0,
+0xFD, 0x7F, 0x49, 0x31, 0x88, 0x90, 0x8B, 0x54, 0xE0, 0x44, 0xB0, 0xFD, 0x7F, 0x49, 0x21, 0x88,
+0x90, 0x8A, 0xDD, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x75, 0x5E, 0x01, 0x8E, 0x5F, 0xF5, 0x60, 0xE4,
+0xFD, 0x7F, 0x0B, 0x51, 0x1E, 0xE4, 0xFD, 0x7F, 0x02, 0x51, 0x1E, 0x71, 0x4E, 0xE4, 0xFF, 0x71,
+0x42, 0xE4, 0xF5, 0x62, 0x90, 0x01, 0xC9, 0xE5, 0x62, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFC, 0xA3,
+0xE0, 0xFD, 0xEC, 0xFB, 0x8D, 0x44, 0xE4, 0xF5, 0x45, 0x7D, 0x01, 0x7F, 0x60, 0x7E, 0x01, 0x02,
+0x35, 0xAB, 0x90, 0x01, 0xCA, 0xE5, 0x61, 0xF0, 0xEF, 0x60, 0x02, 0x51, 0xE2, 0x22, 0x7F, 0x0B,
+0x71, 0x6A, 0xEF, 0x65, 0x61, 0x60, 0x10, 0xE5, 0x61, 0xB4, 0x01, 0x05, 0xE4, 0xF5, 0x61, 0x80,
+0x03, 0x75, 0x61, 0x01, 0x7F, 0x01, 0x22, 0x7F, 0x00, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0,
+0xD0, 0x90, 0x8B, 0x57, 0xEF, 0xF0, 0xD3, 0x94, 0x07, 0x50, 0x43, 0xE0, 0xFF, 0x74, 0x01, 0xA8,
+0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x46, 0x51, 0x0B, 0x90,
+0x8B, 0x57, 0xE0, 0xFD, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x05, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE,
+0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x00, 0x44, 0xE0, 0xFB, 0xE4, 0xFE, 0xEF, 0x5B, 0xA8, 0x05,
+0x08, 0x80, 0x06, 0xCE, 0xA2, 0xE7, 0x13, 0xCE, 0x13, 0xD8, 0xF8, 0xFF, 0x80, 0x4B, 0x90, 0x8B,
+0x57, 0xE0, 0x24, 0xF8, 0xF0, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33,
+0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x43, 0xE0, 0x5F, 0xF0, 0x51, 0x0E, 0x90, 0x8B, 0x57, 0xE0,
+0xFD, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x05, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8,
+0xF9, 0xFF, 0x90, 0x00, 0x42, 0xE0, 0xFB, 0xE4, 0xFE, 0xEF, 0x5B, 0xA8, 0x05, 0x08, 0x80, 0x06,
+0xCE, 0xA2, 0xE7, 0x13, 0xCE, 0x13, 0xD8, 0xF8, 0xFF, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xE4, 0x90,
+0x8B, 0x04, 0xF0, 0x90, 0x00, 0x80, 0xE0, 0x44, 0x80, 0xFD, 0x7F, 0x80, 0x21, 0x88, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x8B, 0x90, 0x8A, 0xDA, 0x12, 0x43,
+0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0xC2, 0xFA, 0xE5, 0xF0, 0x24, 0x00, 0xFF, 0xE4, 0x3A, 0xFE,
+0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0xEE, 0x8F, 0xF0, 0x12, 0x43, 0x19, 0x12,
+0x29, 0xD9, 0xFF, 0x60, 0x2C, 0xB5, 0x5E, 0x16, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x90, 0x00,
+0x01, 0x12, 0x42, 0xC2, 0x65, 0x60, 0x70, 0x04, 0xE5, 0x5F, 0x65, 0xF0, 0x60, 0x22, 0x90, 0x8A,
+0xDA, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0xC2, 0xFF, 0xAE, 0xF0, 0x71, 0x00, 0x80,
+0x0F, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0x65, 0x5E, 0x60, 0x02, 0x91, 0x95,
+0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xE4, 0xF5, 0x5E, 0x7F, 0x60, 0x7E, 0x01, 0x8F, 0x82, 0x8E, 0x83,
+0xA3, 0xA3, 0xA3, 0xE4, 0xF0, 0x22, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x8B, 0xEF, 0x12, 0x43, 0x94,
+0x54, 0xE7, 0x01, 0x54, 0xDE, 0x02, 0x55, 0x0B, 0x03, 0x55, 0x14, 0x05, 0x55, 0x1D, 0x06, 0x55,
+0x58, 0x07, 0x55, 0x25, 0x08, 0x55, 0x2E, 0x09, 0x55, 0x36, 0x20, 0x55, 0x3F, 0x2C, 0x54, 0xF0,
+0x2D, 0x54, 0xF9, 0x2E, 0x55, 0x02, 0x3B, 0x55, 0x48, 0x4B, 0x00, 0x00, 0x55, 0x51, 0x90, 0x8A,
+0xD7, 0x12, 0x43, 0x6B, 0x02, 0x74, 0x85, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x74, 0x8B,
+0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x74, 0xB8, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02,
+0x75, 0x00, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x75, 0x39, 0x90, 0x8A, 0xD7, 0x12, 0x43,
+0x6B, 0x02, 0x75, 0x52, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x74, 0x0F, 0x90, 0x8A, 0xD7,
+0x12, 0x43, 0x6B, 0xC1, 0xA6, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x75, 0x9A, 0x90, 0x8A,
+0xD7, 0x12, 0x43, 0x6B, 0x81, 0x1E, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x78, 0x81, 0x90,
+0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x7A, 0xC2, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x7C,
+0x2B, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x01, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0,
+0x90, 0x01, 0xCC, 0xE0, 0x54, 0x0F, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFD, 0x70,
+0x02, 0xC1, 0xA1, 0x90, 0x8B, 0x51, 0xE0, 0xFF, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80,
+0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0xEF, 0x5D, 0x70, 0x02, 0xC1, 0x9A, 0x90,
+0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD0, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD0,
+0xF0, 0x75, 0x1D, 0x01, 0x75, 0x1E, 0x8A, 0x75, 0x1F, 0xD0, 0x75, 0x20, 0x01, 0x7B, 0x01, 0x7A,
+0x8A, 0x79, 0xD1, 0x12, 0x5E, 0xE4, 0x90, 0x8A, 0xD1, 0xE0, 0xFF, 0xC4, 0x13, 0x13, 0x13, 0x54,
+0x01, 0x90, 0x8B, 0x51, 0x30, 0xE0, 0x59, 0xE0, 0x75, 0xF0, 0x02, 0x90, 0x00, 0x88, 0x12, 0x43,
+0x5F, 0xE0, 0x90, 0x8A, 0xD2, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x02, 0x90, 0x00, 0x89,
+0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD3, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90,
+0x01, 0xD1, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD4, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0,
+0x04, 0x90, 0x01, 0xD2, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD5, 0xF0, 0x90, 0x8B, 0x51, 0xE0,
+0x75, 0xF0, 0x04, 0x90, 0x01, 0xD3, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD6, 0xF0, 0x80, 0x33,
+0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD1, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD2, 0xF0, 0x90,
+0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD2, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD3,
+0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD3, 0x12, 0x43, 0x5F, 0xE0, 0x90,
+0x8A, 0xD4, 0xF0, 0xEF, 0x54, 0x7F, 0xFF, 0x7B, 0x01, 0x7A, 0x8A, 0x79, 0xD2, 0x91, 0xA6, 0x90,
+0x8A, 0xCF, 0xE0, 0xFF, 0x90, 0x8B, 0x51, 0xE0, 0xFE, 0x74, 0x01, 0xA8, 0x06, 0x08, 0x80, 0x02,
+0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0x5F, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0xFF, 0x74,
+0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0x90, 0x01, 0xCC, 0xF0, 0x90, 0x8B,
+0x51, 0xE0, 0x04, 0xF0, 0xE0, 0x54, 0x03, 0xF0, 0xA1, 0x6A, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x02,
+0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x00, 0x04, 0x12, 0x42, 0x20, 0xFF, 0x54, 0x1F, 0xFE,
+0xEF, 0x54, 0x20, 0xC4, 0x13, 0x54, 0x07, 0xFD, 0xAF, 0x06, 0x90, 0x8A, 0xDA, 0xEF, 0xF0, 0xA3,
+0xED, 0xF0, 0xA3, 0x12, 0x43, 0x8B, 0x90, 0x8A, 0xDC, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x03, 0x12,
+0x42, 0x20, 0x54, 0xF0, 0xC4, 0x54, 0x0F, 0x90, 0x8A, 0xDF, 0xF0, 0x90, 0x00, 0x04, 0x12, 0x42,
+0x20, 0x54, 0x40, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x90, 0x8A, 0xE0, 0xF0, 0x90, 0x8A, 0xDA, 0xE0,
+0xFF, 0x75, 0xF0, 0x09, 0x90, 0x87, 0x25, 0x12, 0x43, 0x5F, 0xAD, 0x82, 0xAC, 0x83, 0x90, 0x8A,
+0xE1, 0xEC, 0xF0, 0xA3, 0xED, 0xF0, 0xEF, 0x75, 0xF0, 0x09, 0xA4, 0x24, 0x23, 0xF9, 0x74, 0x87,
+0x35, 0xF0, 0xFA, 0x7B, 0x01, 0xA3, 0x12, 0x43, 0x8B, 0x90, 0x8A, 0xDC, 0x12, 0x43, 0x6B, 0x90,
+0x00, 0x03, 0x12, 0x42, 0x20, 0x54, 0x0F, 0xFF, 0x90, 0x8A, 0xE3, 0x12, 0x43, 0x6B, 0xEF, 0x12,
+0x42, 0x4D, 0x90, 0x8A, 0xDC, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0x90,
+0x8A, 0xE3, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0xEF, 0x12, 0x42, 0x5F, 0x90, 0x8A, 0xDC, 0x12,
+0x43, 0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0xFF, 0x90, 0x8A, 0xE1, 0xE0, 0xFC, 0xA3, 0xE0,
+0xFD, 0xF5, 0x82, 0x8C, 0x83, 0xEF, 0xF0, 0x12, 0x29, 0xD9, 0x8D, 0x82, 0x8C, 0x83, 0xA3, 0xF0,
+0x90, 0x8A, 0xDF, 0xE0, 0xFE, 0x90, 0x8A, 0xDA, 0xE0, 0xFF, 0x24, 0xC1, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xDB, 0xE0, 0xFE, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87,
+0x29, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2A, 0x12, 0x43, 0x5F,
+0x74, 0x01, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xFE, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2B, 0x12,
+0x43, 0x5F, 0xEE, 0xF0, 0x8F, 0x0F, 0xEF, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89,
+0xAF, 0x82, 0xF5, 0x10, 0x8F, 0x11, 0xE5, 0x0F, 0x75, 0xF0, 0x02, 0xA4, 0x24, 0x81, 0xF9, 0x74,
+0x86, 0x35, 0xF0, 0x75, 0x12, 0x01, 0xF5, 0x13, 0x89, 0x14, 0x75, 0xF0, 0x09, 0xE5, 0x0F, 0x90,
+0x87, 0x25, 0x12, 0x43, 0x5F, 0xAF, 0x82, 0x85, 0x83, 0x15, 0x8F, 0x16, 0xE5, 0x0F, 0x75, 0xF0,
+0x09, 0xA4, 0x24, 0x23, 0xF9, 0x74, 0x87, 0x35, 0xF0, 0x75, 0x17, 0x01, 0xF5, 0x18, 0x89, 0x19,
+0x74, 0xC1, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0x12, 0x43, 0x94, 0x58,
+0x34, 0x00, 0x58, 0x49, 0x01, 0x58, 0x5E, 0x02, 0x58, 0x73, 0x03, 0x58, 0x9C, 0x04, 0x58, 0xB1,
+0x05, 0x58, 0xC6, 0x06, 0x58, 0xEC, 0x0C, 0x59, 0x19, 0x0D, 0x59, 0x46, 0x0E, 0x59, 0x73, 0x0F,
+0x00, 0x00, 0x59, 0xA7, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5,
+0x83, 0x74, 0xF0, 0xF0, 0xA3, 0x74, 0x15, 0x80, 0x3C, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5,
+0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0xF0, 0xF0, 0xA3, 0x74, 0x10, 0x80, 0x27, 0xE5, 0x0F,
+0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0xF0, 0xF0, 0xA3, 0x74,
+0x05, 0x80, 0x12, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83,
+0x74, 0xF0, 0xF0, 0xA3, 0xE4, 0xF0, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0x74, 0x0F, 0xF0, 0xA3, 0x74, 0x8F, 0xF0, 0x21, 0xA7, 0xE5, 0x0F, 0x25, 0xE0,
+0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0x0F, 0xF0, 0xA3, 0x74, 0xF5, 0x80,
+0x27, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0x0F,
+0xF0, 0xA3, 0x74, 0xF0, 0x80, 0x12, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34,
+0x89, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0x74, 0x0D, 0xF0, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5,
+0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0x21, 0xA7, 0x90, 0x04, 0x47, 0xE0,
+0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x12, 0x42, 0x4D, 0x90, 0x04, 0x46, 0xE0, 0xAB, 0x12, 0xAA,
+0x13, 0xA9, 0x14, 0x90, 0x00, 0x01, 0x12, 0x42, 0x5F, 0x90, 0x04, 0x45, 0xE0, 0x85, 0x11, 0x82,
+0x85, 0x10, 0x83, 0xF0, 0x90, 0x04, 0x44, 0x21, 0x9E, 0x90, 0x04, 0x4B, 0xE0, 0xAB, 0x12, 0xAA,
+0x13, 0xA9, 0x14, 0x12, 0x42, 0x4D, 0x90, 0x04, 0x4A, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14,
+0x90, 0x00, 0x01, 0x12, 0x42, 0x5F, 0x90, 0x04, 0x49, 0xE0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83,
+0xF0, 0x90, 0x04, 0x48, 0x80, 0x58, 0x90, 0x04, 0x4F, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14,
+0x12, 0x42, 0x4D, 0x90, 0x04, 0x4E, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x01,
+0x12, 0x42, 0x5F, 0x90, 0x04, 0x4D, 0xE0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xF0, 0x90, 0x04,
+0x4C, 0x80, 0x2B, 0x90, 0x04, 0x53, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x12, 0x42, 0x4D,
+0x90, 0x04, 0x52, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x01, 0x12, 0x42, 0x5F,
+0x90, 0x04, 0x51, 0xE0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xF0, 0x90, 0x04, 0x50, 0xE0, 0x85,
+0x11, 0x82, 0x85, 0x10, 0x83, 0xA3, 0xF0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0xC0, 0x03, 0xC0,
+0x02, 0xC0, 0x01, 0x12, 0x29, 0xD9, 0xFF, 0xAB, 0x17, 0xAA, 0x18, 0xA9, 0x19, 0x12, 0x29, 0xD9,
+0x5F, 0xD0, 0x01, 0xD0, 0x02, 0xD0, 0x03, 0x12, 0x42, 0x4D, 0xAB, 0x12, 0xE5, 0x14, 0x24, 0x01,
+0xF9, 0xE4, 0x35, 0x13, 0xFA, 0xC0, 0x03, 0xC0, 0x02, 0xC0, 0x01, 0x12, 0x29, 0xD9, 0xFF, 0xAB,
+0x17, 0xAA, 0x18, 0xA9, 0x19, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0x5F, 0xD0, 0x01, 0xD0, 0x02,
+0xD0, 0x03, 0x12, 0x42, 0x4D, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xC0, 0x83, 0xC0, 0x82, 0xE0,
+0xFF, 0x85, 0x16, 0x82, 0x85, 0x15, 0x83, 0xE0, 0xFE, 0xEF, 0x5E, 0xD0, 0x82, 0xD0, 0x83, 0xF0,
+0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xA3, 0xC0, 0x83, 0xC0, 0x82, 0xE0, 0xFF, 0x85, 0x16, 0x82,
+0x85, 0x15, 0x83, 0xA3, 0xE0, 0xFE, 0xEF, 0x5E, 0xD0, 0x82, 0xD0, 0x83, 0xF0, 0xE5, 0x0F, 0x25,
+0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0, 0x4E, 0x60,
+0x4B, 0x90, 0x8A, 0xE6, 0x74, 0x0B, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x00, 0x50,
+0x02, 0x41, 0xEC, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33,
+0xCE, 0xD8, 0xF9, 0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5,
+0x83, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x0A, 0x90, 0x8A, 0xE6, 0xE0, 0x24, 0x10,
+0xA3, 0xF0, 0x80, 0x68, 0x90, 0x8A, 0xE6, 0xE0, 0x14, 0xF0, 0x80, 0xBB, 0xE5, 0x0F, 0x25, 0xE0,
+0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0, 0x4E, 0x60, 0x47,
+0x90, 0x8A, 0xE6, 0x74, 0x0F, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x00, 0x40, 0x3C,
+0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9,
+0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0x5E,
+0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x08, 0x90, 0x8A, 0xE6, 0xE0, 0xA3, 0xF0, 0x80, 0x0D, 0x90,
+0x8A, 0xE6, 0xE0, 0x14, 0xF0, 0x80, 0xBF, 0xE4, 0x90, 0x8A, 0xE7, 0xF0, 0xE5, 0x0F, 0x25, 0xE0,
+0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0, 0x4E, 0x60, 0x46,
+0xE4, 0x90, 0x8A, 0xE6, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x10, 0x40, 0x02, 0x61,
+0xA5, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8,
+0xF9, 0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0,
+0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x06, 0x90, 0x8A, 0xE6, 0xE0, 0x80, 0x63, 0x90, 0x8A,
+0xE6, 0xE0, 0x04, 0xF0, 0x80, 0xBF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0, 0x4E, 0x60, 0x46, 0xE4, 0x90, 0x8A, 0xE6, 0xF0, 0x90,
+0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x0C, 0x50, 0x3C, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08,
+0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81,
+0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x08,
+0x90, 0x8A, 0xE6, 0xE0, 0x24, 0x10, 0x80, 0x09, 0x90, 0x8A, 0xE6, 0xE0, 0x04, 0xF0, 0x80, 0xBF,
+0xE4, 0x90, 0x8A, 0xE8, 0xF0, 0x90, 0x8A, 0xE7, 0xE0, 0xFF, 0x75, 0xF0, 0x09, 0xE5, 0x0F, 0x90,
+0x87, 0x27, 0x12, 0x43, 0x5F, 0xEF, 0xF0, 0x90, 0x8A, 0xE8, 0xE0, 0xFE, 0x75, 0xF0, 0x09, 0xE5,
+0x0F, 0x90, 0x87, 0x28, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0xE5, 0x0F, 0xC3, 0x94, 0x20, 0x50, 0x32,
+0x74, 0x84, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0xD3, 0x9F, 0x40, 0x02,
+0x80, 0x18, 0x74, 0x84, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0xC3, 0x9E,
+0x50, 0x08, 0x90, 0x8A, 0xE8, 0xE0, 0xA3, 0xF0, 0x80, 0x08, 0x90, 0x8A, 0xE7, 0xE0, 0x90, 0x8A,
+0xE9, 0xF0, 0x90, 0x8A, 0xE9, 0xE0, 0xFD, 0xAF, 0x0F, 0x91, 0x4E, 0x90, 0x8A, 0xE9, 0xE0, 0xFF,
+0x74, 0x84, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0, 0x90, 0x8A, 0xE7,
+0xE0, 0xFF, 0xD3, 0x94, 0x13, 0x40, 0x07, 0x90, 0x87, 0x22, 0x74, 0x03, 0xF0, 0x22, 0xEF, 0xD3,
+0x94, 0x0B, 0x40, 0x07, 0x90, 0x87, 0x22, 0x74, 0x02, 0xF0, 0x22, 0xEF, 0xD3, 0x94, 0x03, 0x40,
+0x07, 0x90, 0x87, 0x22, 0x74, 0x01, 0xF0, 0x22, 0xE4, 0x90, 0x87, 0x22, 0xF0, 0x22, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x74, 0x84, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xED,
+0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xAC, 0x07, 0xED, 0x54, 0x1F, 0x90, 0x8A, 0xC7, 0xF0, 0x74,
+0x01, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0x90, 0x8A, 0xC5, 0xF0, 0x90, 0x8A,
+0xC8, 0x74, 0x01, 0xF0, 0xEB, 0xC3, 0x94, 0x01, 0x40, 0x02, 0x80, 0x37, 0x90, 0x8A, 0xC5, 0xE0,
+0x25, 0x0D, 0xFF, 0xA3, 0xF0, 0xA3, 0xE0, 0x90, 0x41, 0x9E, 0x93, 0xFE, 0xEF, 0xD3, 0x9E, 0x40,
+0x10, 0x74, 0x01, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE4, 0xF0, 0xAF, 0x04, 0x80,
+0x9D, 0x90, 0x8A, 0xC6, 0xE0, 0xFF, 0x74, 0x01, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83,
+0xEF, 0xF0, 0x22, 0xAD, 0x07, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0,
+0xFF, 0x90, 0x8A, 0xCA, 0xF0, 0x74, 0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0,
+0x54, 0x1F, 0x90, 0x8A, 0xC9, 0xF0, 0xD3, 0x9F, 0x40, 0x06, 0xA3, 0xE0, 0x90, 0x8A, 0xC9, 0xF0,
+0x90, 0x8A, 0xC9, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83,
+0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0, 0x24, 0x2E, 0xF5, 0x82, 0xE4, 0x34,
+0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93, 0x3A, 0xC3, 0x13, 0xFE, 0xEF, 0x13,
+0xFF, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE, 0xF0, 0xA3,
+0xEF, 0xF0, 0xAF, 0x05, 0x90, 0x8A, 0xC9, 0xE0, 0xFD, 0x91, 0x4E, 0x90, 0x8A, 0xC9, 0xE0, 0xFF,
+0x22, 0xAC, 0x07, 0x74, 0x84, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0x7F,
+0x90, 0x8A, 0xDE, 0xF0, 0xE0, 0x54, 0x1F, 0xFF, 0x90, 0x8A, 0xE1, 0xF0, 0x75, 0xF0, 0x09, 0xEC,
+0x90, 0x87, 0x28, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xE3, 0xF0, 0x75, 0xF0, 0x09, 0xEC, 0x90,
+0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0, 0xFE, 0x90, 0x8A, 0xE4, 0xF0, 0xEC, 0x25, 0xE0, 0x24, 0xE4,
+0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFB, 0xA3, 0xE0, 0x90, 0x8A, 0xE5, 0xCB, 0xF0,
+0xA3, 0xEB, 0xF0, 0xEC, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0,
+0xFB, 0xA3, 0xE0, 0x90, 0x8A, 0xE7, 0xCB, 0xF0, 0xA3, 0xEB, 0xF0, 0xEF, 0xD3, 0x9E, 0x40, 0x0C,
+0x90, 0x8A, 0xE4, 0xE0, 0x90, 0x8A, 0xE1, 0xF0, 0x90, 0x8A, 0xDE, 0xF0, 0xED, 0x70, 0x02, 0xC1,
+0x93, 0x90, 0x8A, 0xE2, 0xED, 0xF0, 0x90, 0x8A, 0xDE, 0xE0, 0x30, 0xE6, 0x0E, 0x90, 0x8A, 0xE1,
+0xE0, 0x90, 0x8A, 0xDE, 0xF0, 0x90, 0x8A, 0xE2, 0xE0, 0x14, 0xF0, 0x90, 0x8A, 0xE2, 0xE0, 0x70,
+0x02, 0xC1, 0x93, 0x90, 0x8A, 0xE1, 0xE0, 0xFF, 0xD3, 0x94, 0x00, 0x50, 0x02, 0xC1, 0x93, 0xE4,
+0x90, 0x8A, 0xE0, 0xF0, 0xEF, 0x14, 0x90, 0x8A, 0xDF, 0xF0, 0x90, 0x8A, 0xE3, 0xE0, 0xFD, 0x90,
+0x8A, 0xDF, 0xE0, 0xFF, 0xD3, 0x9D, 0x40, 0x6F, 0xEF, 0x94, 0x10, 0x40, 0x21, 0xEF, 0x24, 0xF0,
+0xFF, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8,
+0xF9, 0xFF, 0x90, 0x8A, 0xE7, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x70, 0x27, 0x90, 0x8A,
+0xDF, 0xE0, 0xFF, 0xC3, 0x94, 0x10, 0x50, 0x37, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80,
+0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x8A, 0xE5, 0xE0, 0x5E, 0xFE, 0xA3,
+0xE0, 0x5F, 0x4E, 0x60, 0x1A, 0x90, 0x8A, 0xDF, 0xE0, 0x90, 0x8A, 0xDE, 0xF0, 0x90, 0x8A, 0xE0,
+0xE0, 0x04, 0xF0, 0x90, 0x8A, 0xE2, 0xE0, 0xFF, 0x90, 0x8A, 0xE0, 0xE0, 0x6F, 0x60, 0x08, 0x90,
+0x8A, 0xDF, 0xE0, 0x14, 0xF0, 0x80, 0x83, 0x90, 0x8A, 0xE2, 0xE0, 0xFF, 0x90, 0x8A, 0xE0, 0xE0,
+0xC3, 0x9F, 0x50, 0x0F, 0x90, 0x8A, 0xDF, 0xE0, 0xB5, 0x05, 0x08, 0x90, 0x8A, 0xE3, 0xE0, 0x90,
+0x8A, 0xDE, 0xF0, 0x90, 0x8A, 0xDE, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5, 0x82, 0xE4, 0x34,
+0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0, 0x24, 0x2E, 0xF5,
+0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93, 0x3A, 0xC3, 0x13,
+0xFE, 0xEF, 0x13, 0xFF, 0xEC, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83,
+0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xAF, 0x04, 0x90, 0x8A, 0xDE, 0xE0, 0xFD, 0x91, 0x4E, 0x90, 0x8A,
+0xDE, 0xE0, 0xFF, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8B, 0x1A, 0x8A, 0x1B, 0x89,
+0x1C, 0x90, 0x8B, 0x3F, 0x12, 0x43, 0x8B, 0xAB, 0x1D, 0xAA, 0x1E, 0xA9, 0x1F, 0x90, 0x8B, 0x42,
+0x12, 0x43, 0x8B, 0xAF, 0x20, 0x15, 0x20, 0xEF, 0x60, 0x1E, 0x90, 0x8B, 0x42, 0xE4, 0x75, 0xF0,
+0x01, 0x12, 0x43, 0x74, 0x12, 0x29, 0xD9, 0xFF, 0x90, 0x8B, 0x3F, 0xE4, 0x75, 0xF0, 0x01, 0x12,
+0x43, 0x74, 0xEF, 0x12, 0x42, 0x4D, 0x80, 0xDB, 0xAB, 0x1A, 0xAA, 0x1B, 0xA9, 0x1C, 0xD0, 0xD0,
+0x92, 0xAF, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8B, 0x45, 0x12, 0x43, 0x8B,
+0x90, 0x8B, 0x53, 0xE0, 0xFF, 0x04, 0xF0, 0x90, 0x00, 0x01, 0xEF, 0x12, 0x42, 0x5F, 0x7F, 0xAF,
+0x7E, 0x01, 0x12, 0x74, 0x3B, 0xEF, 0x60, 0x47, 0x90, 0x8B, 0x45, 0x12, 0x43, 0x6B, 0x8B, 0x1D,
+0x8A, 0x1E, 0x89, 0x1F, 0x75, 0x20, 0x02, 0x7B, 0x01, 0x7A, 0x01, 0x79, 0xA0, 0xD1, 0xE4, 0x90,
+0x8B, 0x48, 0x12, 0x43, 0x6B, 0x8B, 0x1D, 0x8A, 0x1E, 0x89, 0x1F, 0x90, 0x8B, 0x45, 0x12, 0x43,
+0x6B, 0x12, 0x29, 0xD9, 0xFF, 0xC4, 0x54, 0x0F, 0xF5, 0x20, 0x7B, 0x01, 0x7A, 0x01, 0x79, 0xA2,
+0xD1, 0xE4, 0x90, 0x01, 0xAF, 0x74, 0xFF, 0xF0, 0x90, 0x01, 0xCB, 0xE0, 0x64, 0x80, 0xF0, 0xD0,
+0xD0, 0x92, 0xAF, 0x22, 0x90, 0x8A, 0xC5, 0xE0, 0x54, 0xF0, 0x44, 0x03, 0xF0, 0x54, 0x0F, 0x44,
+0x80, 0xF0, 0x7B, 0x00, 0x7A, 0x00, 0x79, 0x56, 0x90, 0x8B, 0x48, 0x12, 0x43, 0x8B, 0x0B, 0x7A,
+0x8A, 0x79, 0xC5, 0xE1, 0x33, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x01, 0xC4, 0x74,
+0xC5, 0xF0, 0x74, 0x5F, 0xA3, 0xF0, 0x90, 0x04, 0x1D, 0xE0, 0x60, 0x1A, 0x90, 0x05, 0x22, 0xE0,
+0x54, 0x90, 0x60, 0x07, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x40, 0xF0, 0x90, 0x01, 0xC7, 0xE0, 0x30,
+0xE1, 0xE4, 0x7F, 0x00, 0x80, 0x02, 0x7F, 0x01, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xD3, 0x10, 0xAF,
+0x01, 0xC3, 0xC0, 0xD0, 0xE4, 0xFB, 0xFA, 0xEF, 0x30, 0xE0, 0x02, 0x7B, 0x80, 0xEF, 0xC3, 0x13,
+0x90, 0xFD, 0x10, 0xF0, 0x90, 0x04, 0x25, 0xEF, 0xF0, 0xED, 0x60, 0x1E, 0xAF, 0x03, 0x74, 0x0F,
+0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x80, 0xF0, 0x74, 0x10, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x80, 0xF0, 0xAF, 0x03, 0x74, 0x08, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x09, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC,
+0xF5, 0x83, 0xE0, 0x54, 0xF0, 0xF0, 0x74, 0x21, 0x2B, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83,
+0xE0, 0x54, 0xF7, 0xF0, 0xAE, 0x02, 0xAF, 0x03, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x12, 0x5F, 0xC5,
+0xBF, 0x01, 0x10, 0x90, 0x02, 0x09, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5F, 0xFD, 0x90, 0x04, 0x1F,
+0x74, 0x20, 0xF0, 0x22, 0x90, 0x01, 0x02, 0xE0, 0x54, 0x03, 0xFF, 0xE0, 0x54, 0x0C, 0x13, 0x13,
+0x54, 0x3F, 0xFE, 0xEF, 0x64, 0x01, 0x60, 0x04, 0xEF, 0xB4, 0x03, 0x0E, 0x90, 0x8A, 0xC5, 0x74,
+0x01, 0xF0, 0xA3, 0x74, 0x37, 0xF0, 0x79, 0x01, 0x80, 0x18, 0xEE, 0x64, 0x01, 0x60, 0x07, 0xAF,
+0x06, 0xEE, 0x64, 0x03, 0x70, 0x3B, 0x90, 0x8A, 0xC5, 0x74, 0x01, 0xF0, 0xA3, 0x74, 0x3D, 0xF0,
+0x79, 0x40, 0x90, 0x8A, 0xC5, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xF5, 0x82, 0x8E, 0x83, 0xE0, 0x59,
+0x60, 0x08, 0xE9, 0xF0, 0xE4, 0x90, 0x8A, 0xF6, 0xF0, 0x22, 0x90, 0x8A, 0xF6, 0xE0, 0x04, 0xF0,
+0xE0, 0xC3, 0x94, 0x0A, 0x40, 0x0B, 0xE4, 0xF0, 0x90, 0x04, 0x19, 0xE0, 0x30, 0xE0, 0x02, 0x11,
+0x6D, 0x22, 0xC0, 0xE0, 0xC0, 0xF0, 0xC0, 0x83, 0xC0, 0x82, 0xC0, 0xD0, 0x75, 0xD0, 0x00, 0xC0,
+0x00, 0xC0, 0x01, 0xC0, 0x02, 0xC0, 0x03, 0xC0, 0x04, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07, 0x90,
+0x01, 0xC4, 0x74, 0xF2, 0xF0, 0x74, 0x60, 0xA3, 0xF0, 0x90, 0x01, 0x34, 0xE0, 0x55, 0x28, 0xF5,
+0x2C, 0xA3, 0xE0, 0x55, 0x29, 0xF5, 0x2D, 0xA3, 0xE0, 0x55, 0x2A, 0xF5, 0x2E, 0xA3, 0xE0, 0x55,
+0x2B, 0xF5, 0x2F, 0xE5, 0x2C, 0x20, 0xE0, 0x02, 0x41, 0x89, 0x90, 0x01, 0x34, 0x74, 0x01, 0xF0,
+0x85, 0xD1, 0x4D, 0x85, 0xD2, 0x4E, 0x85, 0xD3, 0x4F, 0x85, 0xD4, 0x50, 0x85, 0xD5, 0x51, 0x85,
+0xD6, 0x52, 0x85, 0xD7, 0x53, 0x85, 0xD9, 0x54, 0xE5, 0x54, 0x54, 0x40, 0xC3, 0x13, 0xFF, 0xE5,
+0x53, 0x54, 0x20, 0x6F, 0x70, 0x02, 0x41, 0x46, 0xE5, 0x54, 0x30, 0xE5, 0x02, 0x41, 0x46, 0xE5,
+0x52, 0x54, 0x1F, 0xF5, 0x08, 0xE5, 0x4D, 0x54, 0x3F, 0xF5, 0x09, 0xE5, 0x51, 0x54, 0x1F, 0xFF,
+0xE5, 0x08, 0x25, 0xE0, 0x24, 0xE3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0x8F, 0xF0,
+0x12, 0x42, 0x81, 0xE5, 0x53, 0x54, 0x1F, 0xFF, 0xE5, 0x08, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82,
+0xE4, 0x34, 0x85, 0xF5, 0x83, 0xE4, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xE5, 0x09, 0xD3, 0x94, 0x04,
+0x40, 0x03, 0x75, 0x09, 0x04, 0x75, 0xF0, 0x0A, 0xE5, 0x08, 0x90, 0x84, 0x00, 0x12, 0x43, 0x5F,
+0x75, 0xF0, 0x02, 0xE5, 0x09, 0x12, 0x43, 0x5F, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xE5, 0x53, 0x54,
+0x1F, 0x2F, 0xFF, 0xE4, 0x3E, 0xFE, 0x75, 0xF0, 0x0A, 0xE5, 0x08, 0x90, 0x84, 0x00, 0x12, 0x43,
+0x5F, 0x75, 0xF0, 0x02, 0xE5, 0x09, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xE5, 0x54,
+0x20, 0xE6, 0x24, 0xE5, 0x53, 0x54, 0x1F, 0xFF, 0xE5, 0x08, 0x25, 0xE0, 0x24, 0x63, 0xF5, 0x82,
+0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xE5, 0x4F, 0x30, 0xE7, 0x36,
+0xAF, 0x08, 0x12, 0x5C, 0xC3, 0x80, 0x2F, 0xE5, 0x53, 0x54, 0x1F, 0xFF, 0xE5, 0x08, 0x25, 0xE0,
+0x24, 0xA3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xE5,
+0x4F, 0x30, 0xE7, 0x12, 0xE5, 0x4F, 0x54, 0x7F, 0xFD, 0xE5, 0x53, 0x54, 0x1F, 0xF5, 0x0D, 0xAB,
+0x09, 0xAF, 0x08, 0x12, 0x5C, 0x66, 0xE5, 0x24, 0x14, 0x24, 0xFD, 0x50, 0x02, 0x80, 0x3A, 0x90,
+0x8B, 0x1A, 0xE0, 0x60, 0x2B, 0x90, 0x01, 0x5B, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x04, 0xF0,
+0x12, 0x4B, 0x34, 0xEF, 0x64, 0x01, 0x70, 0x21, 0x90, 0x8B, 0x3D, 0x12, 0x4B, 0x5C, 0x90, 0x01,
+0x5B, 0x74, 0x05, 0xF0, 0x90, 0x06, 0x92, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x18, 0xF0, 0x80, 0x09,
+0x12, 0x4B, 0x34, 0xBF, 0x01, 0x03, 0x12, 0x4A, 0xFC, 0xE5, 0x2C, 0x30, 0xE1, 0x21, 0x90, 0x01,
+0x34, 0x74, 0x02, 0xF0, 0x85, 0xD1, 0x56, 0x85, 0xD2, 0x57, 0x85, 0xD3, 0x58, 0x85, 0xD4, 0x59,
+0x85, 0xD5, 0x5A, 0x85, 0xD6, 0x5B, 0x85, 0xD7, 0x5C, 0x85, 0xD9, 0x5D, 0x12, 0x5F, 0xA4, 0xE5,
+0x2C, 0x30, 0xE3, 0x06, 0x90, 0x01, 0x34, 0x74, 0x08, 0xF0, 0xE5, 0x2C, 0x30, 0xE4, 0x09, 0x90,
+0x01, 0x34, 0x74, 0x10, 0xF0, 0x43, 0x55, 0x10, 0xE5, 0x2C, 0x30, 0xE5, 0x26, 0x90, 0x01, 0xCF,
+0xE0, 0x30, 0xE5, 0x1F, 0xE0, 0x54, 0xDF, 0xF0, 0x90, 0x01, 0x34, 0x74, 0x20, 0xF0, 0x75, 0xA8,
+0x00, 0x75, 0xE8, 0x00, 0x12, 0x51, 0x9D, 0x90, 0x00, 0x03, 0xE0, 0x54, 0xFB, 0xF0, 0x12, 0x52,
+0x0E, 0x80, 0xFE, 0xE5, 0x2C, 0x30, 0xE6, 0x2D, 0x90, 0x01, 0x34, 0x74, 0x40, 0xF0, 0x90, 0x8B,
+0x32, 0xE0, 0x30, 0xE0, 0x0C, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x05, 0x90, 0x8B, 0x34, 0xE4,
+0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0xFF, 0x30, 0xE0, 0x0C, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x05,
+0x90, 0x8B, 0x2E, 0xE4, 0xF0, 0xE5, 0x2E, 0x20, 0xE0, 0x02, 0x61, 0xE6, 0x90, 0x8B, 0x08, 0x74,
+0x01, 0xF0, 0x90, 0x01, 0x36, 0xF0, 0x90, 0x8B, 0x06, 0xE0, 0x60, 0x0F, 0xE4, 0xF0, 0x90, 0x05,
+0x53, 0xE0, 0x44, 0x02, 0xF0, 0x90, 0x05, 0xFC, 0xE0, 0x04, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0x30,
+0xE0, 0x2F, 0x90, 0x8B, 0x37, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0xFF, 0x13, 0x13, 0x54,
+0x3F, 0x30, 0xE0, 0x1D, 0x90, 0x8B, 0x34, 0x74, 0x01, 0xF0, 0xB1, 0x39, 0x90, 0x8B, 0x33, 0xE0,
+0x64, 0x03, 0x60, 0x0D, 0x7F, 0x01, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x05, 0x7F, 0x04, 0x12, 0x4E,
+0x89, 0x90, 0x8B, 0x2C, 0xE0, 0xFF, 0x30, 0xE0, 0x55, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x4E,
+0x90, 0x8B, 0x2E, 0x74, 0x01, 0xF0, 0xB1, 0x39, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x3E,
+0xB1, 0x5F, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x2D, 0xE0, 0xFF, 0x64, 0x06, 0x60,
+0x2D, 0xEF, 0xB4, 0x04, 0x02, 0x80, 0x07, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x04, 0xE4, 0xFF,
+0x80, 0x14, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0x80, 0x09, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x02, 0x04, 0x7F, 0x01, 0xB1, 0x82, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x12, 0x43,
+0xE7, 0x90, 0x8B, 0x08, 0xE4, 0xF0, 0xE5, 0x2E, 0x30, 0xE1, 0x2F, 0x90, 0x01, 0x36, 0x74, 0x02,
+0xF0, 0x43, 0x55, 0x40, 0x11, 0x84, 0x90, 0x8B, 0x37, 0xE0, 0xB4, 0x01, 0x09, 0x90, 0x05, 0x22,
+0xE4, 0xF0, 0x90, 0x8B, 0x37, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x0D, 0xE4, 0xFF, 0x12,
+0x4D, 0xE0, 0xEF, 0x60, 0x05, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0xE5, 0x2E, 0x30, 0xE2, 0x16, 0x90,
+0x01, 0x36, 0x74, 0x04, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x06, 0xA3, 0xE0, 0x64, 0x06,
+0x60, 0x03, 0x12, 0x46, 0xB3, 0xE5, 0x2E, 0x30, 0xE3, 0x38, 0x90, 0x01, 0x36, 0x74, 0x08, 0xF0,
+0xE5, 0x21, 0x64, 0x01, 0x70, 0x2C, 0xE5, 0x24, 0x60, 0x28, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90,
+0x01, 0x3C, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x3D, 0xE4, 0xF0, 0x90, 0x8B, 0x11, 0xE0, 0x90, 0x8B,
+0x3E, 0xF0, 0xE4, 0xFB, 0xFD, 0x7F, 0x54, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x57, 0x74,
+0x05, 0xF0, 0xE5, 0x2E, 0x30, 0xE4, 0x2B, 0x90, 0x01, 0x36, 0x74, 0x10, 0xF0, 0xE5, 0x21, 0xB4,
+0x01, 0x20, 0xE5, 0x24, 0x60, 0x1C, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02,
+0xF0, 0x90, 0x8B, 0x1B, 0xE4, 0xF0, 0x53, 0x25, 0xFD, 0xE5, 0x25, 0x54, 0x07, 0x70, 0x03, 0x12,
+0x4A, 0xFC, 0xE5, 0x2E, 0x30, 0xE5, 0x1F, 0x90, 0x01, 0x36, 0x74, 0x20, 0xF0, 0xE5, 0x21, 0xB4,
+0x01, 0x14, 0xE5, 0x24, 0x60, 0x10, 0x90, 0x8B, 0x1A, 0xE0, 0x64, 0x02, 0x60, 0x05, 0x12, 0x4A,
+0x97, 0x80, 0x03, 0x12, 0x49, 0x49, 0xE5, 0x2E, 0x30, 0xE6, 0x1B, 0x90, 0x01, 0x36, 0x74, 0x40,
+0xF0, 0xE5, 0x21, 0xB4, 0x01, 0x10, 0xE5, 0x24, 0x60, 0x0C, 0x53, 0x25, 0xFE, 0xE5, 0x25, 0x54,
+0x07, 0x70, 0x03, 0x12, 0x4A, 0xFC, 0xE5, 0x2F, 0x30, 0xE1, 0x28, 0x90, 0x01, 0x37, 0x74, 0x02,
+0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x18, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x08,
+0x12, 0x48, 0xFE, 0x12, 0x7D, 0xC1, 0x80, 0x0B, 0x90, 0x8B, 0x31, 0x74, 0x01, 0xF0, 0x80, 0x03,
+0x12, 0x48, 0xFE, 0x74, 0xF2, 0x04, 0x90, 0x01, 0xC4, 0xF0, 0x74, 0x60, 0xA3, 0xF0, 0xD0, 0x07,
+0xD0, 0x06, 0xD0, 0x05, 0xD0, 0x04, 0xD0, 0x03, 0xD0, 0x02, 0xD0, 0x01, 0xD0, 0x00, 0xD0, 0xD0,
+0xD0, 0x82, 0xD0, 0x83, 0xD0, 0xF0, 0xD0, 0xE0, 0x32, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x05,
+0x58, 0xE0, 0xFF, 0x90, 0x8B, 0x38, 0xE0, 0x2F, 0x24, 0xFE, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB,
+0xFD, 0x7F, 0x50, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x53, 0x74, 0x05, 0xF0, 0x22, 0x90,
+0x8B, 0x2C, 0xE0, 0xFF, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x30, 0xE0, 0x0A, 0xA3, 0xE0, 0x64, 0x06,
+0x60, 0x04, 0x7F, 0x06, 0xB1, 0x82, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60, 0x03, 0x12, 0x78,
+0x35, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0x6F, 0x70,
+0x02, 0xE1, 0x4E, 0xEF, 0x12, 0x43, 0x94, 0x65, 0xB0, 0x00, 0x65, 0xEA, 0x01, 0x66, 0x30, 0x02,
+0x66, 0x6A, 0x03, 0x66, 0xA2, 0x04, 0x66, 0xDB, 0x05, 0x67, 0x16, 0x06, 0x00, 0x00, 0x67, 0x4E,
+0xEE, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xF1, 0x81, 0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xFF, 0xB4,
+0x05, 0x04, 0xF1, 0x5D, 0xE1, 0x4E, 0xEF, 0xB4, 0x06, 0x06, 0x7F, 0x01, 0xF1, 0x72, 0x80, 0x16,
+0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xF1, 0x53, 0x80, 0x09, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x02, 0x02, 0xF1, 0x67, 0xF1, 0xA4, 0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04,
+0x06, 0x7F, 0x01, 0xF1, 0x81, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D,
+0x90, 0x8B, 0x2D, 0xE0, 0x70, 0x04, 0xF1, 0x9A, 0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4,
+0x06, 0x06, 0x7F, 0x01, 0xF1, 0x72, 0xE1, 0x4E, 0xEE, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xF1, 0x53,
+0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x02, 0x60, 0x02, 0xE1, 0x4E, 0xF1, 0x67, 0xE1, 0x4E,
+0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xF1, 0x81, 0x80, 0x09, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D, 0x90, 0x8B, 0x2D, 0xE0, 0x70, 0x04, 0xF1, 0x9A, 0x80, 0x16,
+0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4, 0x06, 0x06, 0x7F, 0x01, 0xF1, 0x72, 0x80, 0x08, 0xEE, 0xB4,
+0x03, 0x04, 0x7F, 0x01, 0xF1, 0x53, 0xF1, 0xD0, 0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04,
+0x06, 0x7F, 0x01, 0xF1, 0x81, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D,
+0x90, 0x8B, 0x2D, 0xE0, 0x70, 0x04, 0xF1, 0x9A, 0x80, 0x14, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4,
+0x06, 0x06, 0xE4, 0xFF, 0xF1, 0x72, 0x80, 0x06, 0xEE, 0xB4, 0x02, 0x02, 0xF1, 0x67, 0xF1, 0xB9,
+0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4, 0x06, 0x06, 0xE4, 0xFF, 0xF1, 0x72, 0x80, 0x13,
+0xEE, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xF1, 0x53, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02,
+0x02, 0xF1, 0x67, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x01, 0x04, 0xF1, 0xA4, 0x80, 0x09, 0x90, 0x8B,
+0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D, 0xF1, 0xAF, 0x80, 0x73, 0x90, 0x8B, 0x2D, 0xE0, 0xFE,
+0xB4, 0x06, 0x06, 0xE4, 0xFF, 0xF1, 0x72, 0x80, 0x13, 0xEE, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xF1,
+0x53, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x02, 0xF1, 0x67, 0x90, 0x8B, 0x2D, 0xE0,
+0xB4, 0x01, 0x04, 0xF1, 0xA4, 0x80, 0x0B, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x04, 0x7F, 0x01,
+0xF1, 0x81, 0xF1, 0xC3, 0x80, 0x38, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xF1,
+0x81, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D, 0x90, 0x8B, 0x2D, 0xE0,
+0x70, 0x04, 0xF1, 0x9A, 0x80, 0x16, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x06, 0xE4, 0xFF, 0xF1,
+0x53, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x02, 0xF1, 0x67, 0xF1, 0xDD, 0xD0, 0xD0,
+0x92, 0xAF, 0x22, 0x12, 0x4A, 0xB2, 0x90, 0x8B, 0x2D, 0x74, 0x01, 0xF0, 0x22, 0x90, 0x05, 0x22,
+0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0xF0, 0x22, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0x04,
+0xF0, 0x22, 0xEF, 0x60, 0x05, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x01, 0xF0,
+0x22, 0x90, 0x8B, 0x56, 0xEF, 0xF0, 0x12, 0x7D, 0x42, 0x90, 0x8B, 0x56, 0xE0, 0x60, 0x05, 0x90,
+0x05, 0x22, 0xE4, 0xF0, 0xE4, 0x90, 0x8B, 0x2D, 0xF0, 0x22, 0x12, 0x4A, 0xCC, 0x90, 0x8B, 0x2D,
+0x74, 0x01, 0xF0, 0x22, 0x7F, 0x01, 0x12, 0x4A, 0x7C, 0xE4, 0x90, 0x8B, 0x2D, 0xF0, 0x22, 0x12,
+0x7C, 0x4A, 0x90, 0x8B, 0x2D, 0x74, 0x04, 0xF0, 0x22, 0x12, 0x4A, 0x32, 0x90, 0x8B, 0x2D, 0x74,
+0x03, 0xF0, 0x22, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x05, 0xF0, 0x22,
+0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x05, 0x22,
+0x74, 0x6F, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x06, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0,
+0xD0, 0xE4, 0xFD, 0xFC, 0xEF, 0x30, 0xE0, 0x02, 0x7D, 0x80, 0xEF, 0xC3, 0x13, 0x90, 0xFD, 0x10,
+0xF0, 0xAE, 0x04, 0xAF, 0x05, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x75, 0x28, 0x33, 0xE4, 0xF5, 0x29,
+0x75, 0x2A, 0x07, 0xF5, 0x2B, 0x90, 0x01, 0x30, 0xE5, 0x28, 0xF0, 0xA3, 0xE5, 0x29, 0xF0, 0xA3,
+0xE5, 0x2A, 0xF0, 0xA3, 0xE5, 0x2B, 0xF0, 0x22, 0x75, 0x30, 0x1F, 0x75, 0x31, 0x01, 0x43, 0x31,
+0x10, 0xE4, 0xF5, 0x32, 0x90, 0x01, 0x38, 0xE5, 0x30, 0xF0, 0xA3, 0xE5, 0x31, 0xF0, 0xA3, 0xE5,
+0x32, 0xF0, 0x22, 0x22, 0x90, 0x00, 0x02, 0xE0, 0x54, 0xE0, 0x7F, 0x01, 0x60, 0x02, 0x7F, 0x00,
+0x22, 0x90, 0x00, 0xF3, 0xE0, 0x7F, 0x00, 0x30, 0xE3, 0x02, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x09,
+0xE0, 0xB4, 0x01, 0x0C, 0x90, 0x00, 0xF2, 0xE0, 0x30, 0xE7, 0x05, 0x7E, 0xFD, 0x7F, 0x33, 0x22,
+0x7E, 0xFD, 0x7F, 0x2F, 0x22, 0x90, 0x00, 0xF3, 0xE0, 0x30, 0xE2, 0x0D, 0x90, 0x05, 0x41, 0x74,
+0x10, 0xF0, 0x90, 0x05, 0x5A, 0xF0, 0xA3, 0xE4, 0xF0, 0x22, 0x90, 0x01, 0x64, 0x74, 0xA0, 0xF0,
+0x22, 0xC0, 0xE0, 0xC0, 0x83, 0xC0, 0x82, 0xC0, 0xD0, 0x75, 0xD0, 0x00, 0xC0, 0x05, 0xC0, 0x06,
+0xC0, 0x07, 0x7D, 0x91, 0x90, 0x01, 0xC4, 0xED, 0xF0, 0x74, 0x68, 0xFF, 0xA3, 0xF0, 0x53, 0x91,
+0xEF, 0x90, 0x00, 0x51, 0xE0, 0xFE, 0x90, 0x00, 0x55, 0xE0, 0x5E, 0xF5, 0x3D, 0x90, 0x00, 0x52,
+0xE0, 0xFE, 0x90, 0x00, 0x56, 0xE0, 0x5E, 0xF5, 0x3E, 0xE5, 0x3D, 0x30, 0xE4, 0x06, 0x90, 0x00,
+0x55, 0x74, 0x10, 0xF0, 0xE5, 0x3D, 0x30, 0xE5, 0x06, 0x90, 0x00, 0x55, 0x74, 0x20, 0xF0, 0xE5,
+0x3D, 0x30, 0xE6, 0x06, 0x90, 0x00, 0x55, 0x74, 0x40, 0xF0, 0xE5, 0x3D, 0x30, 0xE7, 0x06, 0x90,
+0x00, 0x55, 0x74, 0x80, 0xF0, 0xE5, 0x3E, 0x30, 0xE0, 0x06, 0x90, 0x00, 0x56, 0x74, 0x01, 0xF0,
+0xE5, 0x3E, 0x30, 0xE1, 0x06, 0x90, 0x00, 0x56, 0x74, 0x02, 0xF0, 0xE5, 0x3E, 0x30, 0xE2, 0x06,
+0x90, 0x00, 0x56, 0x74, 0x04, 0xF0, 0xE5, 0x3E, 0x30, 0xE3, 0x06, 0x90, 0x00, 0x56, 0x74, 0x08,
+0xF0, 0x90, 0x01, 0xC4, 0xED, 0xF0, 0xA3, 0xEF, 0xF0, 0xD0, 0x07, 0xD0, 0x06, 0xD0, 0x05, 0xD0,
+0xD0, 0xD0, 0x82, 0xD0, 0x83, 0xD0, 0xE0, 0x32, 0xEF, 0xC3, 0x94, 0x20, 0x50, 0x39, 0xEF, 0x30,
+0xE0, 0x17, 0xED, 0xC4, 0x54, 0xF0, 0xFD, 0xEF, 0xC3, 0x13, 0xFE, 0x24, 0xA4, 0xF5, 0x82, 0xE4,
+0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0x0F, 0x80, 0x10, 0xEF, 0xC3, 0x13, 0xFE, 0x24, 0xA4, 0xF5,
+0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0xF0, 0xF0, 0x74, 0xA4, 0x2E, 0xF5, 0x82, 0xE4,
+0x34, 0x04, 0xF5, 0x83, 0xE0, 0x4D, 0xF0, 0x22, 0xAD, 0x07, 0x74, 0x84, 0x2D, 0xF5, 0x82, 0xE4,
+0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0x7F, 0x90, 0x8A, 0xDE, 0xF0, 0xE0, 0xF9, 0x54, 0x1F, 0xA3,
+0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0, 0xFF, 0x90, 0x8A, 0xE1,
+0xF0, 0xED, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFB, 0xA3,
+0xE0, 0x90, 0x8A, 0xE2, 0xCB, 0xF0, 0xA3, 0xEB, 0xF0, 0xED, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82,
+0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFB, 0xA3, 0xE0, 0x90, 0x8A, 0xE4, 0xCB, 0xF0, 0xA3, 0xEB,
+0xF0, 0x90, 0x8A, 0xDF, 0xE0, 0xFE, 0x25, 0xE0, 0x24, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5,
+0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4,
+0x34, 0x86, 0xF5, 0x83, 0xEA, 0xF0, 0xA3, 0xEB, 0xF0, 0xEE, 0xC3, 0x9F, 0x40, 0x02, 0x41, 0xB9,
+0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF,
+0xF0, 0xEF, 0x04, 0x90, 0x8A, 0xE0, 0xF0, 0x90, 0x8A, 0xE1, 0xE0, 0xFF, 0x90, 0x8A, 0xE0, 0xE0,
+0xFE, 0xD3, 0x9F, 0x40, 0x02, 0x41, 0xF3, 0xEE, 0xC3, 0x94, 0x10, 0x40, 0x21, 0xEE, 0x24, 0xF0,
+0xFF, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8,
+0xF9, 0xFF, 0x90, 0x8A, 0xE2, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x70, 0x27, 0x90, 0x8A,
+0xE0, 0xE0, 0xFF, 0xC3, 0x94, 0x10, 0x50, 0x59, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80,
+0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x8A, 0xE4, 0xE0, 0x5E, 0xFE, 0xA3,
+0xE0, 0x5F, 0x4E, 0x60, 0x3C, 0x90, 0x8A, 0xE0, 0xE0, 0xB4, 0x11, 0x0D, 0x90, 0x8A, 0xE3, 0xE0,
+0x30, 0xE7, 0x06, 0x90, 0x8A, 0xE0, 0x74, 0x17, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xFF, 0x64, 0x13,
+0x60, 0x04, 0xEF, 0xB4, 0x12, 0x0D, 0x90, 0x8A, 0xE2, 0xE0, 0x30, 0xE0, 0x06, 0x90, 0x8A, 0xE0,
+0x74, 0x18, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0x90, 0x8A, 0xDF, 0xF0, 0x90, 0x8A, 0xDE, 0xF0, 0x80,
+0x42, 0x90, 0x8A, 0xE0, 0xE0, 0x04, 0xF0, 0x41, 0x17, 0x90, 0x8A, 0xE1, 0xE0, 0xFC, 0x90, 0x8A,
+0xDF, 0xE0, 0xFF, 0x6C, 0x70, 0x71, 0x74, 0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83,
+0xEF, 0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x29, 0x12, 0x43, 0x5F, 0xE0, 0xB4, 0x01, 0x10,
+0xE9, 0x20, 0xE6, 0x0C, 0x90, 0x8A, 0xDF, 0xE0, 0x44, 0x40, 0x90, 0x8A, 0xDE, 0xF0, 0x80, 0x03,
+0xAF, 0x01, 0x22, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5, 0x82, 0xE4, 0x34,
+0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0, 0x24, 0x2E, 0xF5,
+0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93, 0x3A, 0xC3, 0x13,
+0xFE, 0xEF, 0x13, 0xFF, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83,
+0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x80, 0x66, 0x90, 0x8A, 0xDF, 0xE0, 0xD3, 0x9C, 0x40, 0x5E, 0x90,
+0x8A, 0xE1, 0xE0, 0xFF, 0x74, 0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0,
+0x90, 0x8A, 0xDF, 0xEF, 0xF0, 0x90, 0x8A, 0xDE, 0xF0, 0xFC, 0xA3, 0xE0, 0xFF, 0x25, 0xE0, 0x24,
+0x66, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF,
+0x25, 0xE0, 0x24, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF,
+0xE4, 0x93, 0x3A, 0xC3, 0x13, 0xFE, 0xEF, 0x13, 0xFF, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82,
+0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xAF, 0x04, 0x22, 0x74, 0x01, 0x2D,
+0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE4, 0xF0, 0xAF, 0x05, 0x90, 0x8A, 0xDE, 0xE0, 0x44,
+0x80, 0xFD, 0x12, 0x5C, 0x4E, 0x90, 0x8A, 0xDE, 0xE0, 0x44, 0x80, 0xFF, 0x22, 0xE4, 0x90, 0x8A,
+0xCF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0xC3, 0x94, 0x20, 0x40, 0x03, 0x02, 0x72, 0x54, 0x75,
+0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2A, 0x12, 0x43, 0x5F, 0xE0, 0x64, 0x01, 0x60, 0x03, 0x02, 0x72,
+0x4B, 0x90, 0x8A, 0xCF, 0xE0, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5, 0x83,
+0xE0, 0xFC, 0xA3, 0xE0, 0xD3, 0x94, 0x00, 0xEC, 0x94, 0x00, 0x50, 0x03, 0x02, 0x72, 0x4B, 0xEF,
+0x75, 0xF0, 0x0A, 0xA4, 0x24, 0x00, 0xF9, 0x74, 0x84, 0x35, 0xF0, 0x75, 0x12, 0x01, 0xF5, 0x13,
+0x89, 0x14, 0x90, 0x8A, 0xCF, 0xE0, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5,
+0x83, 0xE0, 0xFD, 0xA3, 0xE0, 0x90, 0x8A, 0xD4, 0xCD, 0xF0, 0xA3, 0xED, 0xF0, 0xEF, 0x25, 0xE0,
+0x24, 0x63, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE0, 0xFF, 0xA3, 0xE0, 0x90, 0x8A, 0xD6,
+0xCF, 0xF0, 0xA3, 0xEF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFE, 0x24, 0x84, 0xF5, 0x82, 0xE4, 0x34,
+0x04, 0xF5, 0x83, 0xE0, 0x54, 0x3F, 0x90, 0x8A, 0xD0, 0xF0, 0xE0, 0xFD, 0x54, 0x1F, 0xA3, 0xF0,
+0x75, 0xF0, 0x09, 0xEE, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD9, 0xF0, 0x90,
+0x8A, 0xCF, 0xE0, 0xFB, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0xC3, 0x94,
+0x05, 0x40, 0x02, 0xC1, 0x9C, 0x90, 0x8A, 0xD9, 0xE0, 0xFE, 0x90, 0x8A, 0xD1, 0xE0, 0x9E, 0x40,
+0x13, 0x90, 0x8A, 0xD9, 0xE0, 0x90, 0x8A, 0xD1, 0xF0, 0xED, 0x54, 0x40, 0xFD, 0x90, 0x8A, 0xD0,
+0xF0, 0xEE, 0x4D, 0xF0, 0x90, 0x8A, 0xD1, 0xE0, 0xFF, 0x90, 0x41, 0x12, 0x93, 0xFE, 0x74, 0x23,
+0x2B, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xC3, 0x9E, 0x40, 0x06, 0xEF, 0x90, 0x40,
+0xDA, 0x80, 0x07, 0x90, 0x8A, 0xD1, 0xE0, 0x90, 0x40, 0xF6, 0x93, 0x90, 0x8A, 0xD8, 0xF0, 0x90,
+0x8A, 0xD8, 0xE0, 0x75, 0xF0, 0x06, 0xA4, 0x24, 0x50, 0xF9, 0x74, 0x40, 0x35, 0xF0, 0x75, 0x0F,
+0xFF, 0xF5, 0x10, 0x89, 0x11, 0x90, 0x8A, 0xD0, 0xE0, 0x90, 0x41, 0xBA, 0x93, 0xFF, 0xD3, 0x90,
+0x8A, 0xD7, 0xE0, 0x9F, 0x90, 0x8A, 0xD6, 0xE0, 0x94, 0x00, 0x40, 0x0D, 0x90, 0x8A, 0xCF, 0xE0,
+0xFF, 0xE4, 0xFD, 0x12, 0x5D, 0x41, 0x02, 0x71, 0xE1, 0x90, 0x8A, 0xCF, 0xE0, 0x25, 0xE0, 0x24,
+0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFF, 0xA3, 0xE0, 0x90, 0x8A, 0xD2, 0xCF,
+0xF0, 0xA3, 0xEF, 0xF0, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x12, 0x29, 0xD9, 0xFF, 0x7E, 0x00,
+0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x12, 0x42, 0x97, 0xFD, 0xAC, 0xF0, 0x12, 0x29, 0xF2, 0x90,
+0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00,
+0x01, 0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x02,
+0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0x12, 0x29, 0xF2, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12,
+0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0x7E,
+0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x04, 0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0,
+0x12, 0x29, 0xF2, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10,
+0xA9, 0x11, 0x90, 0x00, 0x03, 0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9,
+0x14, 0x90, 0x00, 0x06, 0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0x12, 0x29, 0xF2, 0x90, 0x8A, 0xD2,
+0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00, 0x04, 0x12,
+0x42, 0x20, 0xFF, 0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x08, 0x12, 0x42,
+0xC2, 0xFD, 0xAC, 0xF0, 0x12, 0x29, 0xF2, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81,
+0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00, 0x05, 0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00, 0x90,
+0x8A, 0xD4, 0xE0, 0xFC, 0xA3, 0xE0, 0xFD, 0x12, 0x29, 0xF2, 0xD3, 0x90, 0x8A, 0xD3, 0xE0, 0x9F,
+0x90, 0x8A, 0xD2, 0xE0, 0x9E, 0x40, 0x0C, 0xA3, 0xE0, 0x9F, 0xF0, 0x90, 0x8A, 0xD2, 0xE0, 0x9E,
+0xF0, 0x80, 0x07, 0xE4, 0x90, 0x8A, 0xD2, 0xF0, 0xA3, 0xF0, 0x90, 0x8A, 0xD2, 0xE0, 0xFC, 0xA3,
+0xE0, 0xFD, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86,
+0xF5, 0x83, 0xEC, 0xF0, 0xA3, 0xED, 0xF0, 0x90, 0x8A, 0xD0, 0xE0, 0x25, 0xE0, 0x24, 0x2E, 0xF5,
+0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xD3, 0xED, 0x9B,
+0xEC, 0x9A, 0x40, 0x05, 0x31, 0x78, 0x02, 0x71, 0xAF, 0x90, 0x8A, 0xD0, 0xE0, 0x25, 0xE0, 0x24,
+0x66, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFE, 0x74, 0x01, 0x93, 0xFF, 0xC3,
+0x90, 0x8A, 0xD3, 0xE0, 0x9F, 0x90, 0x8A, 0xD2, 0xE0, 0x9E, 0x40, 0x03, 0x02, 0x71, 0xAF, 0x90,
+0x8A, 0xCF, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5D, 0x41, 0x02, 0x71, 0xAF, 0x90, 0x8A, 0xCF, 0xE0,
+0xFF, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0xFC, 0x64, 0x05, 0x60, 0x03,
+0x02, 0x70, 0x7D, 0x90, 0x87, 0x22, 0xE0, 0xFE, 0xB4, 0x03, 0x0B, 0x90, 0x8A, 0xD1, 0xE0, 0xC3,
+0x94, 0x19, 0x40, 0x3D, 0x80, 0x2E, 0xEE, 0xB4, 0x02, 0x0B, 0x90, 0x8A, 0xD1, 0xE0, 0xC3, 0x94,
+0x11, 0x40, 0x2E, 0x80, 0x1F, 0x90, 0x87, 0x22, 0xE0, 0xFE, 0xB4, 0x01, 0x0B, 0x90, 0x8A, 0xD1,
+0xE0, 0xC3, 0x94, 0x0A, 0x40, 0x1B, 0x80, 0x0C, 0xEE, 0x70, 0x11, 0x90, 0x8A, 0xD1, 0xE0, 0xC3,
+0x94, 0x03, 0x40, 0x0D, 0x90, 0x89, 0x43, 0x74, 0x01, 0xF0, 0x80, 0x05, 0xE4, 0x90, 0x89, 0x43,
+0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFE, 0x24, 0x43, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE0,
+0x90, 0x8A, 0xDD, 0xF0, 0x74, 0x23, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE,
+0xC3, 0x94, 0x30, 0x50, 0x0B, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x74, 0x64, 0x2F, 0x02, 0x70, 0x28,
+0x90, 0x89, 0x43, 0xE0, 0x64, 0x01, 0x60, 0x03, 0x02, 0x70, 0x1D, 0x90, 0x8A, 0xCF, 0xE0, 0x24,
+0x44, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0x64, 0x0A, 0x60, 0x5B, 0x90, 0x8A, 0xCF,
+0xE0, 0xFF, 0xEE, 0x24, 0x05, 0xFB, 0xE4, 0x33, 0xFA, 0x74, 0x21, 0x2F, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xE0, 0xFF, 0xD3, 0x9B, 0xEA, 0x64, 0x80, 0xF8, 0x74, 0x80, 0x98, 0x50, 0x38,
+0x90, 0x8A, 0xCF, 0xE0, 0xFE, 0xEF, 0x24, 0x05, 0xFB, 0xE4, 0x33, 0xFA, 0x74, 0x23, 0x2E, 0xF5,
+0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xD3, 0x9B, 0xEA, 0x64, 0x80, 0xF8, 0x74, 0x80, 0x98,
+0x50, 0x16, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x84, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0,
+0xFF, 0x90, 0x8A, 0xD1, 0xE0, 0x6F, 0x60, 0x56, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x23, 0xF5, 0x82,
+0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFF, 0xD3, 0x94, 0x42, 0x40, 0x08, 0x90, 0x8A, 0xDD, 0x74,
+0x05, 0xF0, 0x80, 0x11, 0xEF, 0xD3, 0x94, 0x39, 0x90, 0x8A, 0xDD, 0x40, 0x05, 0x74, 0x03, 0xF0,
+0x80, 0x03, 0x74, 0x01, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x23, 0xF5, 0x82, 0xE4, 0x34,
+0x89, 0xF5, 0x83, 0xE0, 0xFE, 0x74, 0x21, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE,
+0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x44, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0x80, 0x2F, 0x90, 0x8A,
+0xCF, 0xE0, 0xFF, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x44,
+0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0x04, 0xF0, 0x80, 0x14, 0xE4, 0x90, 0x8A,
+0xDD, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4,
+0xF0, 0x90, 0x8A, 0xD1, 0xE0, 0xFE, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x84, 0xF5, 0x82, 0xE4,
+0x34, 0x8A, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFE, 0x74, 0x43, 0x2F, 0xF5, 0x82,
+0xE4, 0x34, 0x88, 0xF5, 0x83, 0xEE, 0xF0, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2B, 0x12, 0x43,
+0x5F, 0xE0, 0xB4, 0x01, 0x11, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x74, 0x64, 0x2F, 0xF5, 0x82, 0xE4,
+0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFD, 0x21, 0xAC, 0xEC, 0x64, 0x06,
+0x60, 0x02, 0x21, 0xAF, 0x90, 0x8A, 0xD2, 0xF0, 0xA3, 0xF0, 0x90, 0x41, 0xDB, 0x93, 0xFF, 0x7E,
+0x00, 0x90, 0x8A, 0xD4, 0xE0, 0xFC, 0xA3, 0xE0, 0xFD, 0x12, 0x29, 0xF2, 0x90, 0x8A, 0xDB, 0xEE,
+0xF0, 0xA3, 0xEF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x43, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5,
+0x83, 0xE0, 0x90, 0x8A, 0xDD, 0xF0, 0xE4, 0x90, 0x8A, 0xDA, 0xF0, 0x90, 0x8A, 0xDA, 0xE0, 0xFF,
+0xD3, 0x94, 0x04, 0x50, 0x47, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x75, 0xF0, 0x02, 0xEF, 0xA4,
+0xF5, 0x82, 0x85, 0xF0, 0x83, 0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0xEF, 0x90, 0x41, 0xD6, 0x93,
+0xFF, 0x7E, 0x00, 0x12, 0x29, 0xF2, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0x90,
+0x8A, 0xDB, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xD3, 0x90, 0x8A, 0xD3, 0xE0, 0x9F, 0x90, 0x8A, 0xD2,
+0xE0, 0x9E, 0x50, 0x08, 0x90, 0x8A, 0xDA, 0xE0, 0x04, 0xF0, 0x80, 0xAF, 0x90, 0x8A, 0xDA, 0xE0,
+0xC3, 0x13, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFF, 0xB4, 0x01, 0x0D, 0x90, 0x8A, 0xDA, 0xE0, 0x70,
+0x5D, 0x90, 0x8A, 0xDD, 0x04, 0xF0, 0x80, 0x5B, 0xEF, 0xB4, 0x03, 0x1D, 0x90, 0x8A, 0xDA, 0xE0,
+0xFF, 0x70, 0x08, 0x90, 0x8A, 0xDD, 0x74, 0x03, 0xF0, 0x80, 0x48, 0xEF, 0xB4, 0x01, 0x08, 0x90,
+0x8A, 0xDD, 0x74, 0x01, 0xF0, 0x80, 0x3C, 0x80, 0x35, 0x90, 0x8A, 0xDD, 0xE0, 0x64, 0x05, 0x70,
+0x32, 0x90, 0x8A, 0xDA, 0xE0, 0xFF, 0x70, 0x08, 0x90, 0x8A, 0xDD, 0x74, 0x05, 0xF0, 0x80, 0x0F,
+0xEF, 0x90, 0x8A, 0xDD, 0xB4, 0x01, 0x05, 0x74, 0x03, 0xF0, 0x80, 0x03, 0x74, 0x01, 0xF0, 0xD3,
+0x90, 0x8A, 0xD7, 0xE0, 0x94, 0x03, 0x90, 0x8A, 0xD6, 0xE0, 0x94, 0x00, 0x40, 0x05, 0xE4, 0x90,
+0x8A, 0xDD, 0xF0, 0xD3, 0x90, 0x8A, 0xD7, 0xE0, 0x94, 0x03, 0x90, 0x8A, 0xD6, 0xE0, 0x94, 0x00,
+0x40, 0x05, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFD, 0x90, 0x8A, 0xCF, 0xE0,
+0xFF, 0x24, 0x43, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xED, 0xF0, 0x12, 0x69, 0x38, 0x90,
+0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0xD3, 0x94,
+0x05, 0x50, 0x0F, 0x74, 0x64, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0x04, 0xF0,
+0x80, 0x0F, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4,
+0xF0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0xE4, 0xF5, 0xF0, 0x12, 0x42, 0xFA, 0xAB, 0x12, 0xAA,
+0x13, 0xA9, 0x14, 0x90, 0x00, 0x02, 0xE4, 0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x00, 0x04, 0xE4,
+0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x00, 0x06, 0xE4, 0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x00,
+0x08, 0xE4, 0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0xC0,
+0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0x63,
+0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xA3,
+0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x04,
+0xF0, 0x02, 0x6B, 0xC2, 0x22, 0xE4, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0xC3,
+0x94, 0x10, 0x50, 0x14, 0x74, 0xA4, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE4, 0xF0,
+0x90, 0x8A, 0xCF, 0xE0, 0x04, 0xF0, 0x80, 0xE2, 0xE4, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A, 0xCF,
+0xE0, 0xFF, 0xC3, 0x94, 0x20, 0x40, 0x02, 0x81, 0x0E, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x00,
+0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x02, 0x12, 0x43,
+0x5F, 0xE4, 0xF0, 0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x04, 0x12, 0x43, 0x5F, 0xE4,
+0xF0, 0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x06, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3,
+0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x08, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0xF0, 0x74,
+0x84, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0x74, 0x13, 0xF0, 0x74, 0x44, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x43, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x88,
+0xF5, 0x83, 0xE4, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0x63, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xE3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xA3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xA4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0x74, 0x44, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0,
+0x74, 0x24, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x64, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x90, 0x41, 0x8C, 0x93, 0xFE, 0x74, 0x01, 0x93,
+0xFF, 0x90, 0x41, 0x54, 0x74, 0x01, 0x93, 0x2F, 0xFF, 0xE4, 0x93, 0x3E, 0xC3, 0x13, 0xFE, 0xEF,
+0x13, 0xFF, 0x90, 0x8A, 0xCF, 0xE0, 0xFD, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86,
+0xF5, 0x83, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x29, 0x12, 0x43,
+0x5F, 0x74, 0x01, 0xF0, 0x74, 0xC1, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0x74, 0x0C,
+0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x25, 0x12, 0x43, 0x5F, 0x74, 0xFF, 0xF0, 0xA3, 0xF0,
+0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x23, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0x74, 0x0F, 0xF0,
+0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0x74, 0x13, 0xF0, 0x75, 0xF0, 0x09,
+0xED, 0x90, 0x87, 0x28, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0x74, 0x84, 0x2D, 0xF5, 0x82, 0xE4, 0x34,
+0x04, 0xF5, 0x83, 0x74, 0x13, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x04, 0xF0, 0x41, 0x7D, 0x22, 0x12,
+0x29, 0xD9, 0xFF, 0xC3, 0x94, 0x20, 0x50, 0x14, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFE, 0x74,
+0x23, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xEE, 0xF0, 0x22, 0xEF, 0xB4, 0x20, 0x0A,
+0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0x90, 0x87, 0x21, 0xF0, 0x22, 0x90, 0x8B, 0x4B, 0xEE, 0xF0,
+0xA3, 0xEF, 0xF0, 0xE4, 0xA3, 0xF0, 0xA3, 0xF0, 0x90, 0x8B, 0x4B, 0xE0, 0xFE, 0xA3, 0xE0, 0xF5,
+0x82, 0x8E, 0x83, 0xE0, 0x60, 0x2C, 0xC3, 0x90, 0x8B, 0x4E, 0xE0, 0x94, 0xE8, 0x90, 0x8B, 0x4D,
+0xE0, 0x94, 0x03, 0x40, 0x0A, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x10, 0xF0, 0x7F, 0x00, 0x22, 0x90,
+0x8B, 0x4D, 0xE4, 0x75, 0xF0, 0x01, 0x12, 0x42, 0x81, 0x7F, 0x0A, 0x7E, 0x00, 0x12, 0x37, 0x54,
+0x80, 0xC6, 0x7F, 0x01, 0x22, 0x12, 0x29, 0xD9, 0xF5, 0x21, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3,
+0xC0, 0xD0, 0x90, 0x8A, 0xDA, 0x12, 0x2A, 0x8B, 0x00, 0x00, 0x00, 0x00, 0x90, 0x00, 0x01, 0x12,
+0x42, 0x20, 0x90, 0x8B, 0x1A, 0xF0, 0x90, 0x00, 0x03, 0x12, 0x42, 0x20, 0x90, 0x8B, 0x0A, 0xF0,
+0x12, 0x47, 0xFA, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0x30,
+0xE0, 0x25, 0x12, 0x29, 0xD9, 0x90, 0x8B, 0x10, 0xF0, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0x90,
+0x8B, 0x11, 0xF0, 0xEF, 0xC3, 0x13, 0x54, 0x7F, 0x90, 0x8B, 0x0F, 0xF0, 0x90, 0x00, 0x03, 0x12,
+0x42, 0x20, 0x90, 0x8B, 0x16, 0xF0, 0x22, 0x90, 0x8B, 0x10, 0x74, 0x03, 0xF0, 0x90, 0x8B, 0x11,
+0x74, 0x05, 0xF0, 0x90, 0x8B, 0x0F, 0x74, 0x14, 0xF0, 0x90, 0x8B, 0x16, 0x74, 0x05, 0xF0, 0x22,
+0x12, 0x29, 0xD9, 0x30, 0xE0, 0x19, 0xC3, 0x13, 0x54, 0x7F, 0x90, 0x8B, 0x15, 0xF0, 0x90, 0x00,
+0x01, 0x12, 0x42, 0x20, 0xFF, 0x90, 0x8B, 0x13, 0xE4, 0xF0, 0xA3, 0xEF, 0xF0, 0x80, 0x0F, 0x90,
+0x8B, 0x15, 0x74, 0x05, 0xF0, 0x90, 0x8B, 0x13, 0xE4, 0xF0, 0xA3, 0x74, 0x03, 0xF0, 0x90, 0x8B,
+0x13, 0xE0, 0xA3, 0xE0, 0x90, 0x05, 0x58, 0xF0, 0x22, 0x12, 0x29, 0xD9, 0x90, 0x8B, 0x12, 0xF0,
+0x60, 0x07, 0xE4, 0xFD, 0x7F, 0x04, 0x12, 0x45, 0xA2, 0x90, 0x8B, 0x12, 0xE0, 0x90, 0x01, 0xE7,
+0xF0, 0x22, 0x90, 0x02, 0x09, 0xE0, 0xFD, 0x12, 0x29, 0xD9, 0xFE, 0xAF, 0x05, 0xED, 0x2E, 0x90,
+0x8A, 0xF7, 0xF0, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0xFF, 0xED, 0x2F, 0x90, 0x8A, 0xF8, 0xF0,
+0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0xED, 0x2F, 0x90, 0x8A, 0xF9, 0xF0, 0x90, 0x00, 0x03,
+0x12, 0x42, 0x20, 0xFF, 0xED, 0x2F, 0x90, 0x8A, 0xFA, 0xF0, 0x90, 0x00, 0x04, 0x12, 0x42, 0x20,
+0xFF, 0xAE, 0x05, 0xED, 0x2F, 0x90, 0x8A, 0xFB, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0,
+0xD0, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x8B, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x12, 0x29, 0xD9, 0xC3,
+0x13, 0x20, 0xE0, 0x02, 0xC1, 0xED, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0xFF,
+0x54, 0x02, 0xFE, 0x90, 0x8B, 0x32, 0xE0, 0x54, 0xFD, 0x4E, 0xFE, 0xF0, 0xEF, 0x54, 0x01, 0xFF,
+0xEE, 0x54, 0xFE, 0x4F, 0xFF, 0xF0, 0x12, 0x29, 0xD9, 0xFE, 0x54, 0x08, 0xFD, 0xEF, 0x54, 0xF7,
+0x4D, 0xFF, 0x90, 0x8B, 0x32, 0xF0, 0xEE, 0x54, 0x10, 0xFE, 0xEF, 0x54, 0xEF, 0x4E, 0xFF, 0xF0,
+0x12, 0x29, 0xD9, 0xFE, 0x54, 0x20, 0xFD, 0xEF, 0x54, 0xDF, 0x4D, 0xFF, 0x90, 0x8B, 0x32, 0xF0,
+0xEE, 0x54, 0x40, 0xFE, 0xEF, 0x54, 0xBF, 0x4E, 0xF0, 0x20, 0xE0, 0x02, 0xC1, 0xD9, 0x90, 0x8A,
+0xDD, 0x74, 0x21, 0xF0, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0xFF, 0x13, 0x13,
+0x54, 0x01, 0xFE, 0x90, 0x8B, 0x32, 0xE0, 0xFD, 0x13, 0x13, 0x54, 0x01, 0x6E, 0x60, 0x2A, 0xEF,
+0x54, 0x04, 0xFF, 0xED, 0x54, 0xFB, 0x4F, 0xF0, 0xE0, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x0E,
+0x90, 0x01, 0x34, 0x74, 0x40, 0xF0, 0xFD, 0xE4, 0xFF, 0x12, 0x36, 0xE6, 0x80, 0x0B, 0xE4, 0x90,
+0x8B, 0x34, 0xF0, 0x7D, 0x40, 0xFF, 0x12, 0x36, 0x75, 0x90, 0x8B, 0x32, 0xE0, 0xFD, 0x13, 0x13,
+0x13, 0x54, 0x1F, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x12, 0xF0, 0xED, 0xC4, 0x54,
+0x0F, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x14, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0xC4,
+0x13, 0x54, 0x07, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x80, 0xF0, 0x90, 0x8B, 0x32,
+0xE0, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x20, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x40, 0xF0,
+0x90, 0x8A, 0xDD, 0xE0, 0x90, 0x05, 0x27, 0xF0, 0x90, 0x8B, 0x33, 0xE0, 0x70, 0x05, 0x7F, 0x01,
+0x12, 0x4E, 0x89, 0x90, 0x8B, 0x32, 0xE0, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x30, 0xE0, 0x04, 0x7F,
+0x03, 0x80, 0x0E, 0x7F, 0x01, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x04, 0x7F, 0x01, 0x80, 0x02, 0x7F,
+0x02, 0x12, 0x4E, 0x89, 0x7F, 0x02, 0x02, 0x78, 0x2E, 0x90, 0x8A, 0xDD, 0x74, 0x01, 0xF0, 0x90,
+0x05, 0x27, 0xF0, 0xE4, 0xFF, 0x12, 0x4E, 0x89, 0x7F, 0x03, 0x02, 0x78, 0x2E, 0x90, 0x8A, 0xDA,
+0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0xFF, 0x54, 0x02, 0xFE, 0x90, 0x8B, 0x2C, 0xE0, 0x54, 0xFD,
+0x4E, 0xFE, 0xF0, 0xEF, 0x54, 0x01, 0xFF, 0xEE, 0x54, 0xFE, 0x4F, 0xFF, 0xF0, 0x12, 0x29, 0xD9,
+0xFE, 0x54, 0x08, 0xFD, 0xEF, 0x54, 0xF7, 0x4D, 0xFF, 0x90, 0x8B, 0x2C, 0xF0, 0xEE, 0x54, 0x10,
+0xFE, 0xEF, 0x54, 0xEF, 0x4E, 0xFF, 0xF0, 0x12, 0x29, 0xD9, 0xFE, 0x54, 0x40, 0xFD, 0xEF, 0x54,
+0xBF, 0x4D, 0xFF, 0x90, 0x8B, 0x2C, 0xF0, 0xEE, 0x54, 0x04, 0xFE, 0xEF, 0x54, 0xFB, 0x4E, 0xF0,
+0x20, 0xE0, 0x02, 0xE1, 0xE2, 0x90, 0x8A, 0xDD, 0x74, 0x31, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x13,
+0x13, 0x54, 0x3F, 0x20, 0xE0, 0x0B, 0xE4, 0x90, 0x8B, 0x2E, 0xF0, 0x7D, 0x40, 0xFF, 0x12, 0x36,
+0x75, 0x90, 0x8B, 0x2C, 0xE0, 0xFD, 0x13, 0x13, 0x13, 0x54, 0x1F, 0x30, 0xE0, 0x07, 0x90, 0x8A,
+0xDD, 0xE0, 0x44, 0x02, 0xF0, 0xED, 0xC4, 0x54, 0x0F, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0,
+0x44, 0x04, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0x54, 0x06, 0x60, 0x0C, 0x90, 0x01, 0x3E, 0x74, 0x03,
+0xF0, 0xFD, 0x7F, 0x02, 0x12, 0x37, 0x00, 0x90, 0x8A, 0xDD, 0xE0, 0x90, 0x05, 0x27, 0xF0, 0x90,
+0x8B, 0x2C, 0xE0, 0xFF, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x30, 0xE0, 0x0D, 0xA3, 0xE0, 0x64, 0x06,
+0x60, 0x2C, 0x7F, 0x06, 0x12, 0x65, 0x82, 0x80, 0x25, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x06, 0x1B,
+0x7F, 0x01, 0x12, 0x65, 0x82, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x09, 0x7D, 0x01, 0xAF,
+0x23, 0x12, 0x45, 0xA2, 0x80, 0x05, 0x12, 0x4E, 0x56, 0x80, 0x03, 0x12, 0x7D, 0xC1, 0x7F, 0x01,
+0x80, 0x4C, 0x90, 0x8A, 0xDD, 0x74, 0x01, 0xF0, 0x90, 0x05, 0x27, 0xF0, 0x7D, 0x03, 0x7F, 0x02,
+0x12, 0x36, 0x92, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x06, 0x02, 0x80, 0x1B, 0x90, 0x8B, 0x2D, 0xE0,
+0xB4, 0x04, 0x02, 0x80, 0x07, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x04, 0xE4, 0xFF, 0x80, 0x14,
+0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4,
+0x02, 0x05, 0x7F, 0x01, 0x12, 0x65, 0x82, 0x11, 0x35, 0x12, 0x4A, 0xFC, 0x7F, 0x03, 0x11, 0x42,
+0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x8B, 0x31, 0xE0, 0xB4, 0x01, 0x05, 0xE4, 0xF0, 0x12, 0x48,
+0xFE, 0x22, 0xAD, 0x07, 0xEF, 0x64, 0x01, 0x60, 0x04, 0xEF, 0xB4, 0x03, 0x15, 0x90, 0x8B, 0x32,
+0xE0, 0x54, 0xFE, 0xF0, 0x54, 0xFB, 0xF0, 0xE4, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0,
+0xA3, 0xF0, 0xED, 0x64, 0x02, 0x60, 0x04, 0xED, 0xB4, 0x03, 0x15, 0x90, 0x8B, 0x2C, 0xE0, 0x54,
+0xFE, 0xF0, 0x54, 0xFB, 0xF0, 0xE4, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0,
+0x22, 0x12, 0x29, 0xD9, 0x90, 0x8B, 0x38, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0,
+0x90, 0x8A, 0xFD, 0xE0, 0x90, 0x8A, 0xE8, 0xF0, 0x90, 0x8A, 0xFE, 0xE0, 0xFF, 0xA3, 0xE0, 0x90,
+0x8A, 0xE9, 0xCF, 0xF0, 0xA3, 0xEF, 0xF0, 0xE4, 0x90, 0x8A, 0xE4, 0xF0, 0x90, 0x8A, 0xE4, 0xE0,
+0xFF, 0x24, 0x00, 0xF5, 0x82, 0xE4, 0x34, 0x8B, 0xF5, 0x83, 0xE0, 0xFE, 0x74, 0xEB, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xE4, 0xE0, 0x04, 0xF0, 0xE0, 0xB4,
+0x04, 0xDA, 0x90, 0x8A, 0xE8, 0xE0, 0x12, 0x43, 0x94, 0x78, 0xF8, 0x00, 0x7A, 0x6B, 0x01, 0x79,
+0x01, 0x02, 0x79, 0x01, 0x03, 0x79, 0x01, 0x04, 0x7A, 0x6B, 0x05, 0x7A, 0x35, 0x80, 0x7A, 0x4E,
+0x81, 0x7A, 0x6B, 0x82, 0x00, 0x00, 0x7A, 0x67, 0x90, 0x8A, 0xEE, 0xE0, 0xFF, 0x51, 0x72, 0x41,
+0x6B, 0x90, 0x8A, 0xE8, 0xE0, 0xFF, 0xB4, 0x02, 0x08, 0x90, 0x8A, 0xE5, 0x74, 0x01, 0xF0, 0x80,
+0x0F, 0xEF, 0x90, 0x8A, 0xE5, 0xB4, 0x03, 0x05, 0x74, 0x02, 0xF0, 0x80, 0x03, 0x74, 0x04, 0xF0,
+0xC3, 0x90, 0x8A, 0xE9, 0xE0, 0x94, 0x08, 0x50, 0x78, 0xE4, 0x90, 0x8A, 0xE4, 0xF0, 0x90, 0x8A,
+0xE5, 0xE0, 0xFF, 0x90, 0x8A, 0xE4, 0xE0, 0xC3, 0x9F, 0x40, 0x02, 0x41, 0x6B, 0x90, 0x8A, 0xE9,
+0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xC3, 0xEE, 0x94, 0x01, 0x90, 0x8A, 0xE4, 0xE0, 0x50, 0x1F, 0xFE,
+0x2F, 0xFF, 0xEE, 0xFD, 0xC3, 0x74, 0x03, 0x9D, 0xFD, 0xE4, 0x94, 0x00, 0xFC, 0x74, 0xEB, 0x2D,
+0xF5, 0x82, 0x74, 0x8A, 0x3C, 0xF5, 0x83, 0xE0, 0xFD, 0x12, 0x51, 0x88, 0x80, 0x2B, 0xFF, 0xFD,
+0xC3, 0x74, 0x03, 0x9D, 0xFD, 0xE4, 0x94, 0x00, 0xFC, 0x74, 0xEB, 0x2D, 0xF5, 0x82, 0x74, 0x8A,
+0x3C, 0xF5, 0x83, 0xE0, 0xFE, 0xEF, 0xFD, 0x90, 0x8A, 0xEA, 0xE0, 0x2D, 0xFD, 0x90, 0x8A, 0xE9,
+0xE0, 0x34, 0x00, 0x8D, 0x82, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xE4, 0xE0, 0x04, 0xF0, 0x80,
+0x8D, 0xC3, 0x90, 0x8A, 0xE9, 0xE0, 0x94, 0x10, 0x40, 0x02, 0x41, 0x6B, 0x90, 0x8A, 0xE8, 0xE0,
+0x64, 0x04, 0x60, 0x02, 0x41, 0x6B, 0x90, 0x8A, 0xEC, 0xE0, 0xFF, 0xE4, 0xFC, 0xFD, 0xFE, 0x78,
+0x10, 0x12, 0x2A, 0x6C, 0xC0, 0x04, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07, 0x90, 0x8A, 0xEB, 0xE0,
+0xFF, 0xE4, 0xFC, 0xFD, 0xFE, 0x78, 0x18, 0x12, 0x2A, 0x6C, 0xD0, 0x03, 0xD0, 0x02, 0xD0, 0x01,
+0xD0, 0x00, 0x12, 0x43, 0x46, 0xC0, 0x04, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07, 0x90, 0x8A, 0xED,
+0xE0, 0xFF, 0xE4, 0xFC, 0xFD, 0xFE, 0x78, 0x08, 0x12, 0x2A, 0x6C, 0xD0, 0x03, 0xD0, 0x02, 0xD0,
+0x01, 0xD0, 0x00, 0x12, 0x43, 0x46, 0xA8, 0x04, 0xA9, 0x05, 0xAA, 0x06, 0xAB, 0x07, 0xA3, 0xE0,
+0xFF, 0xE4, 0xFC, 0xFD, 0xFE, 0x12, 0x43, 0x46, 0xA3, 0x12, 0x2A, 0x7F, 0x90, 0x8A, 0xEF, 0x12,
+0x43, 0x53, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x90, 0x8A, 0xE9, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF,
+0x12, 0x2F, 0xD9, 0x80, 0x36, 0x90, 0x8A, 0xED, 0xE0, 0xFE, 0xA3, 0xE0, 0x24, 0x00, 0xFF, 0xE4,
+0x3E, 0xFE, 0x90, 0x8A, 0xE6, 0xF0, 0xA3, 0xEF, 0xF0, 0x12, 0x37, 0x54, 0x80, 0x1D, 0x90, 0x8A,
+0xED, 0xE0, 0xFE, 0xA3, 0xE0, 0x24, 0x00, 0xFF, 0xE4, 0x3E, 0xFE, 0x90, 0x8A, 0xE6, 0xF0, 0xA3,
+0xEF, 0xF0, 0x12, 0x36, 0xCB, 0x80, 0x04, 0x7F, 0x00, 0x80, 0x02, 0x7F, 0x01, 0xD0, 0xD0, 0x92,
+0xAF, 0x22, 0x8F, 0x0F, 0xE4, 0x90, 0x8A, 0xF3, 0xF0, 0xE5, 0x0F, 0x14, 0xFE, 0x90, 0x8A, 0xF3,
+0xE0, 0xFF, 0xC3, 0x9E, 0x50, 0x0E, 0xEF, 0x04, 0xFD, 0x12, 0x34, 0xB7, 0x90, 0x8A, 0xF3, 0xE0,
+0x04, 0xF0, 0x80, 0xE5, 0xE5, 0x0F, 0x14, 0xFF, 0x7D, 0xFF, 0x12, 0x34, 0xB7, 0x90, 0x8A, 0xF3,
+0xE5, 0x0F, 0xF0, 0x90, 0x8A, 0xF3, 0xE0, 0xC3, 0x94, 0xFF, 0x50, 0x0F, 0xE0, 0xFF, 0x04, 0xFD,
+0x12, 0x34, 0xB7, 0x90, 0x8A, 0xF3, 0xE0, 0x04, 0xF0, 0x80, 0xE8, 0xAD, 0x0F, 0x7F, 0xFF, 0x02,
+0x34, 0xB7, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0xA3, 0x74,
+0x04, 0xF0, 0xA3, 0xE4, 0xF0, 0x90, 0x8A, 0xE2, 0xF0, 0xA3, 0xF0, 0x90, 0x02, 0x09, 0xE0, 0x90,
+0x8A, 0xE1, 0xF0, 0x12, 0x29, 0xD9, 0xFF, 0x90, 0x8A, 0xE1, 0xE0, 0x2F, 0x90, 0x8A, 0xE0, 0xF0,
+0x30, 0xE0, 0x0B, 0x90, 0x8A, 0xDB, 0xE4, 0xF0, 0xA3, 0x74, 0x80, 0xF0, 0x80, 0x07, 0xE4, 0x90,
+0x8A, 0xDB, 0xF0, 0xA3, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xC3, 0x13, 0x90, 0xFD, 0x10, 0xF0, 0x90,
+0x8A, 0xDD, 0xE0, 0x24, 0x20, 0xF0, 0x90, 0x8A, 0xDB, 0xA3, 0xE0, 0xFD, 0xA3, 0xE0, 0xFC, 0x2D,
+0xFF, 0x24, 0x01, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x90, 0x8A, 0xFD, 0xF0, 0x74,
+0x02, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0xFE, 0xEC, 0x2D, 0x24, 0x03, 0xF5,
+0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x24, 0x00, 0xFF, 0xE4, 0x3E, 0x90, 0x8A, 0xFE, 0xF0,
+0xA3, 0xEF, 0xF0, 0x90, 0x8A, 0xDA, 0x74, 0x04, 0xF0, 0x90, 0x8A, 0xDB, 0xA3, 0xE0, 0xFF, 0xA3,
+0xE0, 0x2F, 0xFF, 0x90, 0x8A, 0xDA, 0xE0, 0xFE, 0x2F, 0x24, 0x00, 0xF5, 0x82, 0xE4, 0x34, 0xFC,
+0xF5, 0x83, 0xE0, 0xFF, 0x74, 0xFC, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0,
+0x90, 0x8A, 0xDA, 0xE0, 0x04, 0xF0, 0xE0, 0xB4, 0x08, 0xCF, 0x11, 0x89, 0xEF, 0x70, 0x45, 0x90,
+0x01, 0xC3, 0xE0, 0x60, 0x2B, 0xC3, 0x90, 0x8A, 0xE3, 0xE0, 0x94, 0xE8, 0x90, 0x8A, 0xE2, 0xE0,
+0x94, 0x03, 0x40, 0x09, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x10, 0xF0, 0x80, 0x79, 0x90, 0x8A, 0xE2,
+0xE4, 0x75, 0xF0, 0x01, 0x12, 0x42, 0x81, 0x7F, 0x0A, 0x7E, 0x00, 0x12, 0x37, 0x54, 0x80, 0xCF,
+0x90, 0x01, 0xC6, 0xE0, 0x90, 0x01, 0xC3, 0x30, 0xE2, 0x05, 0x74, 0xFE, 0xF0, 0x80, 0x57, 0x74,
+0xFF, 0xF0, 0x80, 0x52, 0x90, 0x8A, 0xDD, 0xE0, 0xB4, 0x78, 0x2E, 0xE4, 0xF0, 0x90, 0x8A, 0xE0,
+0xE0, 0x04, 0xF0, 0x90, 0x8A, 0xDB, 0xE0, 0x70, 0x04, 0xA3, 0xE0, 0x64, 0x80, 0x90, 0x8A, 0xDB,
+0x70, 0x05, 0xF0, 0xA3, 0xF0, 0x80, 0x06, 0xE4, 0xF0, 0xA3, 0x74, 0x80, 0xF0, 0x90, 0x8A, 0xE0,
+0xE0, 0xC3, 0x13, 0x90, 0xFD, 0x10, 0xF0, 0x80, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x24, 0x08, 0xF0,
+0x90, 0x8A, 0xDE, 0x74, 0xFF, 0xF5, 0xF0, 0x12, 0x42, 0x81, 0x90, 0x8A, 0xDE, 0xE0, 0x70, 0x02,
+0xA3, 0xE0, 0x60, 0x02, 0x61, 0x16, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x12, 0x29, 0xD9, 0x90, 0x8B,
+0x05, 0xF0, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0x90, 0x8B, 0x06, 0xF0, 0x22, 0xE4, 0xF5, 0x61,
+0x22, 0x91, 0x4A, 0x90, 0x8B, 0x33, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0,
+0x7F, 0x78, 0x7E, 0x08, 0x12, 0x27, 0xDE, 0x90, 0x8B, 0x1C, 0x12, 0x2A, 0x7F, 0x7F, 0x04, 0x7E,
+0x0C, 0x12, 0x27, 0xDE, 0x90, 0x8B, 0x20, 0x12, 0x2A, 0x7F, 0x7F, 0x00, 0x7E, 0x08, 0x12, 0x27,
+0xDE, 0x90, 0x8B, 0x24, 0x12, 0x2A, 0x7F, 0x90, 0x8B, 0x09, 0xE0, 0x90, 0x8B, 0x1C, 0xB4, 0x01,
+0x0D, 0x12, 0x43, 0x53, 0xEF, 0x54, 0xC7, 0xFF, 0xED, 0x54, 0xC7, 0xFD, 0x80, 0x07, 0x12, 0x43,
+0x53, 0xEF, 0x54, 0xC7, 0xFF, 0xEC, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x78, 0x7E, 0x08,
+0x12, 0x2F, 0xD9, 0x90, 0x8B, 0x20, 0x12, 0x43, 0x53, 0xEF, 0x54, 0x0F, 0xFF, 0xEC, 0x90, 0x80,
+0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x04, 0x7E, 0x0C, 0x12, 0x2F, 0xD9, 0x90, 0x8B, 0x24, 0x12, 0x43,
+0x53, 0xEF, 0x44, 0x02, 0xFF, 0xEC, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x00, 0x7E, 0x08,
+0x12, 0x2F, 0xD9, 0x7F, 0x70, 0x7E, 0x0E, 0x12, 0x27, 0xDE, 0x90, 0x8B, 0x28, 0x12, 0x2A, 0x7F,
+0x90, 0x80, 0x85, 0x12, 0x2A, 0x8B, 0x00, 0x1B, 0x25, 0xA0, 0x7F, 0x70, 0x7E, 0x0E, 0x12, 0x2F,
+0xD9, 0x90, 0x80, 0x59, 0x12, 0x2A, 0x8B, 0x00, 0x00, 0x00, 0x00, 0xE4, 0xFD, 0xFF, 0x12, 0x34,
+0x81, 0x90, 0x8B, 0x09, 0xE0, 0xB4, 0x01, 0x11, 0x90, 0x80, 0x59, 0x12, 0x2A, 0x8B, 0x00, 0x00,
+0x00, 0x00, 0xE4, 0xFD, 0x7F, 0x01, 0x12, 0x34, 0x81, 0x90, 0x00, 0x11, 0xE0, 0x54, 0xF6, 0xF0,
+0x02, 0x52, 0x0E, 0x91, 0x50, 0x90, 0x8B, 0x33, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x05, 0x22, 0x74,
+0xFF, 0xF0, 0x90, 0x8B, 0x33, 0x74, 0x04, 0xF0, 0x22, 0xB1, 0x42, 0x90, 0x8B, 0x33, 0x74, 0x04,
+0xF0, 0x22, 0x90, 0x00, 0x11, 0xE0, 0x44, 0x09, 0xF0, 0x12, 0x52, 0x0E, 0x90, 0x8B, 0x1C, 0x12,
+0x43, 0x53, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x78, 0x7E, 0x08, 0x12, 0x2F, 0xD9, 0x90,
+0x8B, 0x20, 0x12, 0x43, 0x53, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x04, 0x7E, 0x0C, 0x12,
+0x2F, 0xD9, 0x90, 0x8B, 0x24, 0x12, 0x43, 0x53, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x00,
+0x7E, 0x08, 0x12, 0x2F, 0xD9, 0x90, 0x8B, 0x28, 0x12, 0x43, 0x53, 0x90, 0x80, 0x85, 0x12, 0x2A,
+0x7F, 0x7F, 0x70, 0x7E, 0x0E, 0x12, 0x2F, 0xD9, 0x90, 0x80, 0x59, 0x12, 0x2A, 0x8B, 0x00, 0x03,
+0x2D, 0x95, 0xE4, 0xFD, 0xFF, 0x12, 0x34, 0x81, 0x90, 0x8B, 0x09, 0xE0, 0xB4, 0x01, 0x11, 0x90,
+0x80, 0x59, 0x12, 0x2A, 0x8B, 0x00, 0x03, 0x2D, 0x95, 0xE4, 0xFD, 0x7F, 0x01, 0x12, 0x34, 0x81,
+0x22, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60, 0x3C, 0xE5, 0x22, 0x54, 0x0F, 0x14, 0x60, 0x2E,
+0x14, 0x60, 0x1E, 0x24, 0xFE, 0x60, 0x0E, 0x24, 0xF8, 0x70, 0x2A, 0xE4, 0x90, 0x8B, 0x2D, 0xF0,
+0x90, 0x05, 0x22, 0xF0, 0x22, 0x90, 0x8B, 0x2D, 0x74, 0x01, 0xF0, 0x90, 0x05, 0x22, 0xE4, 0xF0,
+0x22, 0x90, 0x8B, 0x2D, 0x74, 0x03, 0xF0, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x22, 0x90, 0x01,
+0xC6, 0xE0, 0x44, 0x08, 0xF0, 0x22, 0xAE, 0x07, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x18,
+0x90, 0x8B, 0x2C, 0xE0, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x20, 0xE0, 0x0C, 0xAF, 0x06, 0x7D, 0x01,
+0x12, 0x45, 0xA2, 0xB1, 0xC1, 0x7F, 0x01, 0x22, 0x7F, 0x00, 0x22, 0x90, 0x01, 0x57, 0xE0, 0x60,
+0x3C, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x1B, 0xE0,
+0x60, 0x07, 0xE4, 0xF0, 0x53, 0x25, 0xFD, 0x80, 0x24, 0x90, 0x8B, 0x0C, 0xE0, 0x04, 0xF0, 0x53,
+0x25, 0xEF, 0x90, 0x8B, 0x10, 0xE0, 0xFF, 0x90, 0x8B, 0x0C, 0xE0, 0xD3, 0x9F, 0x40, 0x0E, 0xE5,
+0x21, 0xB4, 0x01, 0x09, 0x90, 0x8B, 0x0D, 0xE0, 0x70, 0x03, 0xE0, 0x04, 0xF0, 0x90, 0x01, 0x5B,
+0xE0, 0x60, 0x10, 0x90, 0x01, 0x5B, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x04, 0xF0, 0xE4, 0x90,
+0x8B, 0x18, 0xF0, 0x90, 0x01, 0x5F, 0xE0, 0x60, 0x10, 0x90, 0x01, 0x5F, 0xE4, 0xF0, 0x90, 0x01,
+0x3C, 0x74, 0x08, 0xF0, 0xE4, 0x90, 0x8B, 0x17, 0xF0, 0x22, 0xE4, 0x90, 0x8B, 0x4F, 0xF0, 0xA3,
+0xF0, 0x90, 0x05, 0xF8, 0xE0, 0x70, 0x0F, 0xA3, 0xE0, 0x70, 0x0B, 0xA3, 0xE0, 0x70, 0x07, 0xA3,
+0xE0, 0x70, 0x03, 0x7F, 0x01, 0x22, 0xD3, 0x90, 0x8B, 0x50, 0xE0, 0x94, 0xE8, 0x90, 0x8B, 0x4F,
+0xE0, 0x94, 0x03, 0x40, 0x03, 0x7F, 0x00, 0x22, 0x7F, 0x32, 0x7E, 0x00, 0x12, 0x37, 0x54, 0x90,
+0x8B, 0x4F, 0xE4, 0x75, 0xF0, 0x01, 0x12, 0x42, 0x81, 0x80, 0xC6, 0x00, 0x92, 0x00};
+
+// =================== v88 UMC A Cut P2PPS with CCX report C2H 2012-12-05 =====================
+u8 Rtl8192CUFwUMCACutImgArray[UMCACutImgArrayLength] = {
+0xC1, 0x88, 0x02, 0x05, 0x58, 0x00, 0x02, 0x00, 0x12, 0x05, 0x17, 0x11, 0xDE, 0x3E, 0x01, 0x00,
+0x94, 0x18, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x02, 0x46, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x02, 0x60, 0xF2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x02, 0x68, 0x91, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x4B, 0x87, 0x00, 0x00,
+0x05, 0x04, 0x03, 0x02, 0x00, 0x03, 0x06, 0x05, 0x04, 0x03, 0x00, 0x04, 0x06, 0x05, 0x04, 0x02,
+0x00, 0x04, 0x08, 0x07, 0x06, 0x04, 0x00, 0x06, 0x0A, 0x09, 0x08, 0x06, 0x00, 0x08, 0x0A, 0x09,
+0x08, 0x04, 0x00, 0x08, 0x0A, 0x09, 0x08, 0x02, 0x00, 0x08, 0x0A, 0x09, 0x08, 0x00, 0x00, 0x08,
+0x12, 0x11, 0x10, 0x08, 0x00, 0x10, 0x1A, 0x19, 0x18, 0x10, 0x00, 0x18, 0x22, 0x21, 0x20, 0x18,
+0x00, 0x20, 0x22, 0x21, 0x20, 0x10, 0x00, 0x20, 0x22, 0x21, 0x20, 0x08, 0x00, 0x20, 0x22, 0x21,
+0x1C, 0x08, 0x00, 0x20, 0x22, 0x21, 0x14, 0x08, 0x00, 0x20, 0x22, 0x20, 0x18, 0x08, 0x00, 0x20,
+0x31, 0x30, 0x20, 0x10, 0x00, 0x30, 0x31, 0x30, 0x18, 0x00, 0x00, 0x30, 0x31, 0x2F, 0x10, 0x10,
+0x00, 0x30, 0x31, 0x2C, 0x10, 0x10, 0x00, 0x30, 0x31, 0x28, 0x10, 0x00, 0x00, 0x30, 0x31, 0x20,
+0x10, 0x00, 0x00, 0x30, 0x31, 0x10, 0x10, 0x00, 0x00, 0x30, 0x04, 0x04, 0x04, 0x05, 0x04, 0x04,
+0x05, 0x07, 0x07, 0x07, 0x08, 0x0A, 0x04, 0x04, 0x04, 0x04, 0x06, 0x0A, 0x0B, 0x0D, 0x05, 0x05,
+0x07, 0x07, 0x08, 0x0B, 0x0D, 0x0F, 0x04, 0x04, 0x04, 0x05, 0x07, 0x07, 0x09, 0x09, 0x0C, 0x0E,
+0x10, 0x12, 0x06, 0x07, 0x09, 0x0A, 0x0C, 0x0E, 0x11, 0x13, 0x09, 0x09, 0x09, 0x09, 0x0C, 0x0E,
+0x11, 0x13, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0x26, 0x2A, 0x18, 0x1A,
+0x1D, 0x1F, 0x21, 0x27, 0x29, 0x2A, 0x00, 0x00, 0x00, 0x1F, 0x23, 0x28, 0x2A, 0x2C, 0x00, 0x04,
+0x00, 0x04, 0x00, 0x08, 0x00, 0x10, 0x00, 0x18, 0x00, 0x24, 0x00, 0x30, 0x00, 0x48, 0x00, 0x60,
+0x00, 0x90, 0x00, 0xC0, 0x00, 0xD8, 0x00, 0x50, 0x00, 0x78, 0x00, 0xA0, 0x00, 0xC8, 0x01, 0x40,
+0x01, 0x90, 0x01, 0xE0, 0x02, 0x30, 0x01, 0x2C, 0x01, 0x40, 0x01, 0xE0, 0x02, 0xD0, 0x03, 0xE8,
+0x04, 0xB0, 0x06, 0x40, 0x07, 0xD0, 0x00, 0x02, 0x00, 0x02, 0x00, 0x04, 0x00, 0x08, 0x00, 0x0C,
+0x00, 0x12, 0x00, 0x18, 0x00, 0x24, 0x00, 0x30, 0x00, 0x48, 0x00, 0x60, 0x00, 0x6C, 0x00, 0x28,
+0x00, 0x3C, 0x00, 0x50, 0x00, 0x64, 0x00, 0xA0, 0x00, 0xC8, 0x00, 0xF0, 0x01, 0x18, 0x00, 0x64,
+0x00, 0xA0, 0x00, 0xF0, 0x01, 0x68, 0x01, 0xF4, 0x02, 0x58, 0x03, 0x20, 0x03, 0xE8, 0x02, 0x02,
+0x02, 0x02, 0x02, 0x02, 0x03, 0x03, 0x04, 0x04, 0x05, 0x07, 0x02, 0x03, 0x04, 0x0A, 0x0C, 0x0E,
+0x10, 0x12, 0x05, 0x07, 0x07, 0x08, 0x0B, 0x12, 0x24, 0x3C, 0x01, 0x01, 0x01, 0x01, 0x01, 0x02,
+0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x05, 0x06,
+0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x20, 0x1E, 0x1C, 0x18, 0x10, 0x18, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0xBB, 0x01, 0x0C, 0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE0, 0x22, 0x50,
+0x06, 0xE9, 0x25, 0x82, 0xF8, 0xE6, 0x22, 0xBB, 0xFE, 0x06, 0xE9, 0x25, 0x82, 0xF8, 0xE2, 0x22,
+0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE4, 0x93, 0x22, 0xBB, 0x01, 0x06,
+0x89, 0x82, 0x8A, 0x83, 0xF0, 0x22, 0x50, 0x02, 0xF7, 0x22, 0xBB, 0xFE, 0x01, 0xF3, 0x22, 0xF8,
+0xBB, 0x01, 0x0D, 0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE8, 0xF0, 0x22,
+0x50, 0x06, 0xE9, 0x25, 0x82, 0xC8, 0xF6, 0x22, 0xBB, 0xFE, 0x05, 0xE9, 0x25, 0x82, 0xC8, 0xF2,
+0x22, 0xC5, 0xF0, 0xF8, 0xA3, 0xE0, 0x28, 0xF0, 0xC5, 0xF0, 0xF8, 0xE5, 0x82, 0x15, 0x82, 0x70,
+0x02, 0x15, 0x83, 0xE0, 0x38, 0xF0, 0x22, 0xBB, 0x01, 0x0A, 0x89, 0x82, 0x8A, 0x83, 0xE0, 0xF5,
+0xF0, 0xA3, 0xE0, 0x22, 0x50, 0x06, 0x87, 0xF0, 0x09, 0xE7, 0x19, 0x22, 0xBB, 0xFE, 0x07, 0xE3,
+0xF5, 0xF0, 0x09, 0xE3, 0x19, 0x22, 0x89, 0x82, 0x8A, 0x83, 0xE4, 0x93, 0xF5, 0xF0, 0x74, 0x01,
+0x93, 0x22, 0xBB, 0x01, 0x10, 0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE0,
+0xF5, 0xF0, 0xA3, 0xE0, 0x22, 0x50, 0x09, 0xE9, 0x25, 0x82, 0xF8, 0x86, 0xF0, 0x08, 0xE6, 0x22,
+0xBB, 0xFE, 0x0A, 0xE9, 0x25, 0x82, 0xF8, 0xE2, 0xF5, 0xF0, 0x08, 0xE2, 0x22, 0xE5, 0x83, 0x2A,
+0xF5, 0x83, 0xE9, 0x93, 0xF5, 0xF0, 0xA3, 0xE9, 0x93, 0x22, 0xBB, 0x01, 0x0A, 0x89, 0x82, 0x8A,
+0x83, 0xF0, 0xE5, 0xF0, 0xA3, 0xF0, 0x22, 0x50, 0x06, 0xF7, 0x09, 0xA7, 0xF0, 0x19, 0x22, 0xBB,
+0xFE, 0x06, 0xF3, 0xE5, 0xF0, 0x09, 0xF3, 0x19, 0x22, 0xF8, 0xBB, 0x01, 0x11, 0xE5, 0x82, 0x29,
+0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE8, 0xF0, 0xE5, 0xF0, 0xA3, 0xF0, 0x22, 0x50, 0x09,
+0xE9, 0x25, 0x82, 0xC8, 0xF6, 0x08, 0xA6, 0xF0, 0x22, 0xBB, 0xFE, 0x09, 0xE9, 0x25, 0x82, 0xC8,
+0xF2, 0xE5, 0xF0, 0x08, 0xF2, 0x22, 0xEF, 0x4B, 0xFF, 0xEE, 0x4A, 0xFE, 0xED, 0x49, 0xFD, 0xEC,
+0x48, 0xFC, 0x22, 0xE0, 0xFC, 0xA3, 0xE0, 0xFD, 0xA3, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0x22, 0xA4,
+0x25, 0x82, 0xF5, 0x82, 0xE5, 0xF0, 0x35, 0x83, 0xF5, 0x83, 0x22, 0xE0, 0xFB, 0xA3, 0xE0, 0xFA,
+0xA3, 0xE0, 0xF9, 0x22, 0xF8, 0xE0, 0xFB, 0xA3, 0xA3, 0xE0, 0xF9, 0x25, 0xF0, 0xF0, 0xE5, 0x82,
+0x15, 0x82, 0x70, 0x02, 0x15, 0x83, 0xE0, 0xFA, 0x38, 0xF0, 0x22, 0xEB, 0xF0, 0xA3, 0xEA, 0xF0,
+0xA3, 0xE9, 0xF0, 0x22, 0xD0, 0x83, 0xD0, 0x82, 0xF8, 0xE4, 0x93, 0x70, 0x12, 0x74, 0x01, 0x93,
+0x70, 0x0D, 0xA3, 0xA3, 0x93, 0xF8, 0x74, 0x01, 0x93, 0xF5, 0x82, 0x88, 0x83, 0xE4, 0x73, 0x74,
+0x02, 0x93, 0x68, 0x60, 0xEF, 0xA3, 0xA3, 0xA3, 0x80, 0xDF, 0xD0, 0x83, 0xD0, 0x82, 0xF8, 0xE4,
+0x93, 0x70, 0x12, 0x74, 0x01, 0x93, 0x70, 0x0D, 0xA3, 0xA3, 0x93, 0xF8, 0x74, 0x01, 0x93, 0xF5,
+0x82, 0x88, 0x83, 0xE4, 0x73, 0x74, 0x02, 0x93, 0xB5, 0xF0, 0x06, 0x74, 0x03, 0x93, 0x68, 0x60,
+0xE9, 0xA3, 0xA3, 0xA3, 0xA3, 0x80, 0xD8, 0xE4, 0x90, 0x8A, 0xC5, 0xF0, 0xE5, 0x24, 0x70, 0x03,
+0x02, 0x44, 0x9D, 0xE5, 0x21, 0x64, 0x01, 0x60, 0x03, 0x02, 0x44, 0x9D, 0xE5, 0x24, 0x14, 0x60,
+0x29, 0x24, 0xFD, 0x60, 0x25, 0x24, 0x02, 0x24, 0xFB, 0x50, 0x02, 0x80, 0x23, 0x90, 0x8B, 0x0B,
+0xE0, 0x14, 0xF0, 0xE0, 0x60, 0x04, 0xA3, 0xE0, 0x60, 0x16, 0x90, 0x8B, 0x0B, 0xE0, 0x70, 0x0A,
+0x90, 0x8B, 0x19, 0xE0, 0x90, 0x8B, 0x0B, 0xF0, 0x80, 0x00, 0x90, 0x8A, 0xC5, 0x74, 0x01, 0xF0,
+0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x16, 0xA3, 0xE0, 0xB4, 0x06, 0x05, 0xE4, 0x90, 0x8A, 0xC5,
+0xF0, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x70, 0x04, 0x90, 0x8A, 0xC5, 0xF0, 0x90, 0x8A, 0xC5,
+0xE0, 0x60, 0x4A, 0x43, 0x25, 0x10, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x0C, 0xE0, 0x75,
+0xF0, 0x03, 0xA4, 0xFF, 0x90, 0x8B, 0x15, 0xE0, 0x2F, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD,
+0x7F, 0x54, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x57, 0x74, 0x05, 0xF0, 0xE5, 0x22, 0x54,
+0x0F, 0xC3, 0x94, 0x04, 0x50, 0x07, 0x7D, 0x01, 0x7F, 0x04, 0x12, 0x45, 0xA2, 0x90, 0x8B, 0x2C,
+0xE0, 0x30, 0xE0, 0x09, 0x12, 0x7D, 0xC1, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x22, 0xE4, 0xF5,
+0x25, 0xF5, 0x24, 0x75, 0x23, 0x0C, 0x75, 0x22, 0x0C, 0x90, 0x8B, 0x1A, 0xF0, 0x90, 0x8B, 0x18,
+0xF0, 0x90, 0x8B, 0x17, 0xF0, 0x90, 0x8B, 0x19, 0x04, 0xF0, 0x90, 0x8B, 0x0B, 0xF0, 0xE4, 0x90,
+0x8B, 0x1B, 0xF0, 0x90, 0x8B, 0x0D, 0xF0, 0x90, 0x8B, 0x15, 0x74, 0x05, 0xF0, 0xE4, 0x90, 0x8B,
+0x0C, 0xF0, 0x90, 0x8B, 0x13, 0xF0, 0xA3, 0x74, 0x03, 0xF0, 0x90, 0x8B, 0x10, 0xF0, 0xA3, 0x74,
+0x05, 0xF0, 0x90, 0x8B, 0x0F, 0x74, 0x14, 0xF0, 0x90, 0x8B, 0x16, 0x74, 0x05, 0xF0, 0xE4, 0x90,
+0x8B, 0x0E, 0xF0, 0x90, 0x8B, 0x0A, 0xF0, 0x90, 0x8B, 0x08, 0xF0, 0x90, 0x8B, 0x12, 0xF0, 0x22,
+0x7F, 0x00, 0x22, 0x02, 0x45, 0x03, 0x02, 0x45, 0x06, 0x8E, 0x64, 0x8F, 0x65, 0xAD, 0x65, 0xAC,
+0x64, 0xAF, 0x63, 0x12, 0x4A, 0x5B, 0xAF, 0x65, 0xAE, 0x64, 0x90, 0x04, 0x80, 0xE0, 0x54, 0x0F,
+0xFD, 0xAC, 0x07, 0x74, 0x11, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x01,
+0xF0, 0x74, 0x11, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xFB, 0xF0, 0xAC,
+0x07, 0x74, 0x16, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0xFA, 0xF0, 0x74,
+0x15, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x1F, 0xF0, 0xAC, 0x07, 0x74,
+0x06, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x0F, 0xF0, 0x90, 0x04, 0x53,
+0xE4, 0xF0, 0x90, 0x04, 0x52, 0xF0, 0x90, 0x04, 0x51, 0x74, 0xFF, 0xF0, 0x90, 0x04, 0x50, 0x74,
+0xFD, 0xF0, 0x74, 0x14, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xC0, 0x4D,
+0xFD, 0x74, 0x14, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xED, 0xF0, 0x22, 0x7D, 0x01,
+0x7F, 0x0C, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8F, 0x67, 0x8D, 0x68, 0xE5, 0x67, 0x54,
+0x0F, 0xFF, 0xE5, 0x22, 0x54, 0x0F, 0x6F, 0x60, 0x72, 0xE5, 0x67, 0x30, 0xE2, 0x30, 0xE5, 0x22,
+0x20, 0xE2, 0x05, 0x7F, 0x01, 0x12, 0x4A, 0xB2, 0xE5, 0x22, 0x30, 0xE3, 0x10, 0xE5, 0x67, 0x20,
+0xE3, 0x0B, 0x12, 0x49, 0xD5, 0xEF, 0x60, 0x53, 0x12, 0x4A, 0xCC, 0x80, 0x4E, 0xE5, 0x22, 0x20,
+0xE3, 0x49, 0xE5, 0x67, 0x30, 0xE3, 0x44, 0xAF, 0x68, 0x12, 0x4A, 0x7C, 0x80, 0x3D, 0xE5, 0x22,
+0x54, 0x0F, 0xFF, 0xBF, 0x0C, 0x0E, 0xE5, 0x67, 0x20, 0xE3, 0x09, 0x12, 0x49, 0xD5, 0xEF, 0x60,
+0x2A, 0x12, 0x4A, 0xCC, 0xE5, 0x22, 0x54, 0x0F, 0xFF, 0xBF, 0x04, 0x0E, 0xE5, 0x67, 0x20, 0xE2,
+0x09, 0x12, 0x49, 0x93, 0xEF, 0x60, 0x14, 0x12, 0x4A, 0x32, 0xE5, 0x22, 0x54, 0x0F, 0xFF, 0xBF,
+0x02, 0x09, 0x12, 0x45, 0x00, 0xEF, 0x60, 0x03, 0x12, 0x4B, 0x10, 0xD0, 0xD0, 0x92, 0xAF, 0x22,
+0x02, 0x46, 0x6E, 0x02, 0x50, 0xC6, 0xE4, 0x93, 0xA3, 0xF8, 0xE4, 0x93, 0xA3, 0x40, 0x03, 0xF6,
+0x80, 0x01, 0xF2, 0x08, 0xDF, 0xF4, 0x80, 0x29, 0xE4, 0x93, 0xA3, 0xF8, 0x54, 0x07, 0x24, 0x0C,
+0xC8, 0xC3, 0x33, 0xC4, 0x54, 0x0F, 0x44, 0x20, 0xC8, 0x83, 0x40, 0x04, 0xF4, 0x56, 0x80, 0x01,
+0x46, 0xF6, 0xDF, 0xE4, 0x80, 0x0B, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x90, 0x4B,
+0x23, 0xE4, 0x7E, 0x01, 0x93, 0x60, 0xBC, 0xA3, 0xFF, 0x54, 0x3F, 0x30, 0xE5, 0x09, 0x54, 0x1F,
+0xFE, 0xE4, 0x93, 0xA3, 0x60, 0x01, 0x0E, 0xCF, 0x54, 0xC0, 0x25, 0xE0, 0x60, 0xA8, 0x40, 0xB8,
+0xE4, 0x93, 0xA3, 0xFA, 0xE4, 0x93, 0xA3, 0xF8, 0xE4, 0x93, 0xA3, 0xC8, 0xC5, 0x82, 0xC8, 0xCA,
+0xC5, 0x83, 0xCA, 0xF0, 0xA3, 0xC8, 0xC5, 0x82, 0xC8, 0xCA, 0xC5, 0x83, 0xCA, 0xDF, 0xE9, 0xDE,
+0xE7, 0x80, 0xBE, 0xE5, 0x21, 0x64, 0x01, 0x70, 0x67, 0xE5, 0x24, 0x60, 0x63, 0xE5, 0x24, 0x64,
+0x02, 0x60, 0x06, 0xE5, 0x24, 0x64, 0x05, 0x70, 0x27, 0x90, 0x06, 0xAB, 0xE0, 0x90, 0x8B, 0x0B,
+0xF0, 0x90, 0x06, 0xAA, 0xE0, 0x90, 0x8B, 0x19, 0xF0, 0x90, 0x8B, 0x0B, 0xE0, 0x70, 0x07, 0x90,
+0x8B, 0x19, 0xE0, 0xFF, 0x80, 0x05, 0x90, 0x8B, 0x0B, 0xE0, 0xFF, 0x90, 0x8B, 0x0B, 0xEF, 0xF0,
+0x90, 0x8B, 0x0D, 0xE0, 0x60, 0x02, 0xE4, 0xF0, 0xE4, 0x90, 0x8B, 0x0C, 0xF0, 0x90, 0x05, 0x58,
+0x74, 0x03, 0xF0, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x53, 0x25,
+0xFD, 0x53, 0x25, 0xEF, 0xE5, 0x24, 0x14, 0x24, 0xFD, 0x50, 0x02, 0x80, 0x03, 0x12, 0x47, 0x8E,
+0x22, 0xEF, 0x64, 0x01, 0x70, 0x35, 0x7D, 0x78, 0x7F, 0x02, 0x12, 0x31, 0x2C, 0x7D, 0x02, 0x7F,
+0x03, 0x12, 0x31, 0x2C, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x12,
+0x45, 0x9E, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x03, 0x12, 0x7D, 0xC1, 0x90, 0x06, 0x04, 0xE0,
+0x54, 0x7F, 0xF0, 0x90, 0x06, 0x0A, 0xE0, 0x54, 0xF8, 0xF0, 0x22, 0x90, 0x01, 0x36, 0x74, 0x7B,
+0xF0, 0xA3, 0x74, 0x02, 0xF0, 0x7D, 0x7B, 0xFF, 0x12, 0x31, 0x9D, 0x7D, 0x02, 0x7F, 0x03, 0x12,
+0x31, 0x9D, 0x90, 0x06, 0x04, 0xE0, 0x44, 0x80, 0xF0, 0x90, 0x06, 0x0A, 0xE0, 0x44, 0x07, 0xF0,
+0x12, 0x4B, 0x4F, 0xE5, 0x21, 0x20, 0xE0, 0x05, 0xE4, 0x90, 0x8B, 0x0D, 0xF0, 0x22, 0xE4, 0x90,
+0x8A, 0xC5, 0xF0, 0x90, 0x06, 0xA9, 0xE0, 0x90, 0x8A, 0xC5, 0xF0, 0xE0, 0x54, 0xC0, 0x70, 0x09,
+0x53, 0x25, 0xFE, 0x53, 0x25, 0xFD, 0x12, 0x4A, 0xFC, 0x90, 0x8A, 0xC5, 0xE0, 0x30, 0xE6, 0x15,
+0x43, 0x25, 0x01, 0x90, 0x8B, 0x1A, 0xE0, 0x64, 0x02, 0x60, 0x05, 0x12, 0x4A, 0x97, 0x80, 0x08,
+0x12, 0x49, 0x49, 0x80, 0x03, 0x53, 0x25, 0xFE, 0x90, 0x8A, 0xC5, 0xE0, 0x30, 0xE7, 0x27, 0x43,
+0x25, 0x02, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x11, 0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4,
+0xFB, 0xFD, 0x7F, 0x54, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x57, 0x74, 0x05, 0xF0, 0x90,
+0x8B, 0x1B, 0x74, 0x01, 0xF0, 0x22, 0x53, 0x25, 0xFD, 0x22, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x8B,
+0x12, 0x4B, 0x43, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x12, 0x24, 0x62, 0xF5, 0x24, 0x14, 0x60,
+0x0E, 0x14, 0x60, 0x1F, 0x14, 0x60, 0x31, 0x24, 0x03, 0x70, 0x44, 0x7F, 0x01, 0x80, 0x3D, 0x90,
+0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFD, 0xE4, 0xFF, 0x12, 0x4A,
+0x07, 0x80, 0x29, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFD,
+0x7F, 0x01, 0x12, 0x4A, 0x07, 0x1F, 0x80, 0x14, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x90, 0x00,
+0x02, 0x12, 0x42, 0x20, 0xFD, 0x7F, 0x02, 0x12, 0x4A, 0x07, 0xE4, 0xFF, 0x12, 0x47, 0x21, 0x22,
+0xE4, 0x90, 0x8A, 0xCB, 0xF0, 0xE5, 0x24, 0x60, 0x49, 0x90, 0x8B, 0x1B, 0xE0, 0x60, 0x0D, 0xE4,
+0xF0, 0x53, 0x25, 0xFD, 0xE5, 0x25, 0x54, 0x07, 0x70, 0x38, 0x80, 0x33, 0x90, 0x8B, 0x0C, 0xE0,
+0x04, 0xF0, 0x53, 0x25, 0xEF, 0x90, 0x8A, 0xCB, 0xE0, 0xFF, 0x90, 0x8B, 0x10, 0xE0, 0x2F, 0xFF,
+0xE4, 0x33, 0xFE, 0x90, 0x8B, 0x0C, 0xE0, 0xD3, 0x9F, 0xEE, 0x64, 0x80, 0xF8, 0x74, 0x80, 0x98,
+0x40, 0x0D, 0xE5, 0x21, 0xB4, 0x01, 0x0B, 0xA3, 0xE0, 0x70, 0x07, 0xE0, 0x04, 0xF0, 0x22, 0x12,
+0x4A, 0xFC, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8F, 0x63, 0x90, 0x04, 0x1D, 0xE0,
+0x60, 0x24, 0x90, 0x05, 0x22, 0xE0, 0xF5, 0x66, 0x74, 0xFF, 0xF0, 0x12, 0x7E, 0x9A, 0xBF, 0x01,
+0x0D, 0x90, 0x8A, 0xF9, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5F, 0xFD, 0x12, 0x45, 0x09, 0x90, 0x05,
+0x22, 0xE5, 0x66, 0xF0, 0x80, 0x0D, 0x90, 0x8A, 0xF9, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5F, 0xFD,
+0x12, 0x45, 0x09, 0x90, 0x04, 0x1F, 0x74, 0x20, 0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xE5, 0x24,
+0x14, 0x24, 0xFD, 0x50, 0x02, 0x80, 0x41, 0x90, 0x8B, 0x1A, 0xE0, 0x60, 0x2B, 0x12, 0x45, 0x9E,
+0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x0F, 0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD,
+0x7F, 0x58, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x5B, 0x74, 0x05, 0xF0, 0x90, 0x06, 0x92,
+0x74, 0x01, 0xF0, 0x90, 0x8B, 0x18, 0xF0, 0x22, 0xE5, 0x22, 0x54, 0x0F, 0xC3, 0x94, 0x04, 0x50,
+0x07, 0x7D, 0x01, 0x7F, 0x04, 0x12, 0x45, 0xA2, 0x22, 0x90, 0x01, 0x5F, 0xE4, 0xF0, 0x90, 0x01,
+0x3C, 0x74, 0x08, 0xF0, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x0F, 0xE0, 0x90, 0x8B, 0x3E,
+0xF0, 0xE4, 0xFB, 0xFD, 0x7F, 0x5C, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x5F, 0x74, 0x05,
+0xF0, 0x90, 0x06, 0x92, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x17, 0x14, 0xF0, 0xE5, 0x22, 0x54, 0x0F,
+0xC3, 0x94, 0x0C, 0x50, 0x0D, 0x12, 0x45, 0x9E, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x03, 0x12,
+0x7D, 0xC1, 0x22, 0x12, 0x4B, 0x34, 0xEF, 0x64, 0x01, 0x70, 0x37, 0xE5, 0x25, 0x54, 0x03, 0x70,
+0x31, 0xE5, 0x23, 0x54, 0x0F, 0xD3, 0x94, 0x02, 0x50, 0x28, 0xE5, 0x25, 0x20, 0xE2, 0x23, 0xE5,
+0x25, 0x20, 0xE4, 0x1E, 0x90, 0x8B, 0x0D, 0xE0, 0x70, 0x18, 0x90, 0x8B, 0x12, 0xE0, 0x70, 0x12,
+0xE5, 0x26, 0x70, 0x0E, 0x90, 0x01, 0xB9, 0xE4, 0xF0, 0x90, 0x01, 0xB8, 0x74, 0x04, 0xF0, 0x7F,
+0x01, 0x22, 0x7F, 0x00, 0x22, 0x12, 0x4B, 0x34, 0xEF, 0x64, 0x01, 0x70, 0x27, 0x90, 0x8B, 0x18,
+0xE0, 0x70, 0x21, 0x90, 0x8B, 0x17, 0xE0, 0x70, 0x1B, 0xE5, 0x23, 0x54, 0x0F, 0xD3, 0x94, 0x04,
+0x50, 0x12, 0xE5, 0x26, 0x70, 0x0E, 0x90, 0x01, 0xB9, 0xE4, 0xF0, 0x90, 0x01, 0xB8, 0x74, 0x08,
+0xF0, 0x7F, 0x01, 0x22, 0x7F, 0x00, 0x22, 0xEF, 0x24, 0xFE, 0x60, 0x0B, 0x04, 0x70, 0x22, 0x90,
+0x8B, 0x19, 0x74, 0x01, 0xF0, 0x80, 0x16, 0xED, 0x70, 0x0A, 0x90, 0x8B, 0x16, 0xE0, 0x90, 0x8B,
+0x19, 0xF0, 0x80, 0x05, 0x90, 0x8B, 0x19, 0xED, 0xF0, 0x90, 0x8B, 0x19, 0xE0, 0x90, 0x8B, 0x0B,
+0xF0, 0x22, 0x90, 0x01, 0x37, 0x74, 0x02, 0xF0, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x12, 0x7E,
+0x9A, 0xEF, 0x70, 0x06, 0x90, 0x01, 0xC8, 0x74, 0xFD, 0xF0, 0x7D, 0x02, 0x7F, 0x03, 0x12, 0x31,
+0x9D, 0x12, 0x7C, 0x50, 0x53, 0x22, 0xF0, 0x43, 0x22, 0x02, 0x22, 0xEF, 0x60, 0x0F, 0x74, 0x21,
+0x2D, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x10, 0xF0, 0x22, 0x74, 0x21, 0x2D,
+0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xEF, 0xF0, 0x22, 0x90, 0x06, 0x04, 0xE0,
+0x54, 0xBF, 0xF0, 0xEF, 0x60, 0x0A, 0xE5, 0x21, 0xB4, 0x01, 0x05, 0xE4, 0xFF, 0x12, 0x48, 0xB3,
+0x53, 0x22, 0xF0, 0x43, 0x22, 0x0C, 0x22, 0x90, 0x04, 0x1D, 0xE0, 0x70, 0x14, 0x90, 0x8A, 0xF8,
+0xE0, 0xFF, 0xE4, 0xFD, 0x12, 0x5F, 0xFD, 0x8E, 0x69, 0x8F, 0x6A, 0x90, 0x04, 0x1F, 0x74, 0x20,
+0xF0, 0x22, 0x90, 0x8B, 0x52, 0xEF, 0xF0, 0x12, 0x7D, 0x42, 0x90, 0x8B, 0x52, 0xE0, 0x60, 0x05,
+0x90, 0x05, 0x22, 0xE4, 0xF0, 0x53, 0x22, 0xF0, 0x43, 0x22, 0x04, 0x22, 0x90, 0x06, 0x04, 0xE0,
+0x44, 0x40, 0xF0, 0xE5, 0x21, 0xB4, 0x01, 0x05, 0x7F, 0x01, 0x12, 0x48, 0xB3, 0x53, 0x22, 0xF0,
+0x43, 0x22, 0x04, 0x22, 0xE5, 0x23, 0x30, 0xE6, 0x12, 0xE5, 0x23, 0x54, 0x0F, 0xFF, 0x90, 0x01,
+0x2F, 0xE0, 0x54, 0x80, 0x4F, 0x64, 0x80, 0xF0, 0x53, 0x23, 0xBF, 0x22, 0x90, 0x8B, 0x2C, 0xE0,
+0x30, 0xE0, 0x05, 0xAF, 0x23, 0x02, 0x7E, 0x06, 0x7D, 0x01, 0xAF, 0x23, 0x12, 0x45, 0xA2, 0x22,
+0x53, 0x22, 0xF0, 0x43, 0x22, 0x01, 0x12, 0x4B, 0x5A, 0x12, 0x4B, 0x5B, 0x53, 0x22, 0xF0, 0x43,
+0x22, 0x02, 0x22, 0x41, 0x8A, 0xF6, 0x00, 0x41, 0x8B, 0x05, 0x00, 0x41, 0x8B, 0x51, 0x00, 0x41,
+0x8B, 0x53, 0x00, 0x00, 0x90, 0x04, 0x1B, 0xE0, 0x54, 0x7F, 0x64, 0x7F, 0x7F, 0x01, 0x60, 0x02,
+0x7F, 0x00, 0x22, 0xE4, 0x90, 0x8B, 0x1B, 0xF0, 0x90, 0x8B, 0x0C, 0xF0, 0xF5, 0x25, 0x22, 0x90,
+0x8B, 0x13, 0xE0, 0xA3, 0xE0, 0x90, 0x05, 0x58, 0xF0, 0x22, 0x22, 0x22, 0xF0, 0x90, 0x8B, 0x0F,
+0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD, 0x7F, 0x58, 0x7E, 0x01, 0xD3, 0x10, 0xAF, 0x01,
+0xC3, 0xC0, 0xD0, 0x90, 0x8B, 0x3D, 0xE0, 0xFB, 0xA3, 0xE0, 0xF5, 0x44, 0xE4, 0xF5, 0x45, 0x12,
+0x30, 0x62, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xC0, 0xE0, 0xC0, 0xF0, 0xC0, 0x83, 0xC0, 0x82, 0xC0,
+0xD0, 0x75, 0xD0, 0x00, 0xC0, 0x00, 0xC0, 0x01, 0xC0, 0x02, 0xC0, 0x03, 0xC0, 0x04, 0xC0, 0x05,
+0xC0, 0x06, 0xC0, 0x07, 0x75, 0x0E, 0x00, 0x90, 0x01, 0xC4, 0x74, 0x87, 0xF0, 0x74, 0x4B, 0xA3,
+0xF0, 0x53, 0x91, 0xDF, 0x90, 0x01, 0x3C, 0xE0, 0x55, 0x30, 0xF5, 0x34, 0xA3, 0xE0, 0x55, 0x31,
+0xF5, 0x35, 0xA3, 0xE0, 0x55, 0x32, 0xF5, 0x36, 0xA3, 0xE0, 0x55, 0x33, 0xF5, 0x37, 0xE5, 0x34,
+0x30, 0xE0, 0x51, 0x90, 0x01, 0x3C, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0x30, 0xE0, 0x1F,
+0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x18, 0x90, 0x8B, 0x34, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0xE0,
+0x64, 0x03, 0x60, 0x0B, 0x7F, 0x01, 0xB1, 0xE0, 0xEF, 0x70, 0x04, 0x7F, 0x02, 0xD1, 0x89, 0x90,
+0x8B, 0x2C, 0xE0, 0xFF, 0x30, 0xE0, 0x1D, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x16, 0x90, 0x8B,
+0x2E, 0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60, 0x09, 0xE4, 0xFF, 0xB1, 0xE0, 0xEF,
+0x70, 0x02, 0xD1, 0x56, 0xE5, 0x34, 0x30, 0xE1, 0x08, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x11,
+0x60, 0xE5, 0x34, 0x30, 0xE2, 0x28, 0x90, 0x01, 0x3C, 0x74, 0x04, 0xF0, 0x90, 0x06, 0x92, 0xE0,
+0x30, 0xE0, 0x14, 0x90, 0x8B, 0x3D, 0xE4, 0x71, 0x5C, 0x90, 0x01, 0x5B, 0x74, 0x05, 0xF0, 0x90,
+0x06, 0x92, 0x74, 0x01, 0xF0, 0x80, 0x07, 0x90, 0x8B, 0x18, 0xE4, 0xF0, 0x51, 0xFC, 0xE5, 0x34,
+0x30, 0xE3, 0x38, 0x90, 0x01, 0x3C, 0x74, 0x08, 0xF0, 0x90, 0x06, 0x92, 0xE0, 0x30, 0xE1, 0x24,
+0x90, 0x8B, 0x3D, 0xE4, 0xF0, 0x90, 0x8B, 0x0F, 0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD,
+0x7F, 0x5C, 0x7E, 0x01, 0x71, 0x6C, 0x90, 0x01, 0x5F, 0x74, 0x05, 0xF0, 0x90, 0x06, 0x92, 0x74,
+0x02, 0xF0, 0x80, 0x07, 0x90, 0x8B, 0x17, 0xE4, 0xF0, 0x51, 0xFC, 0xE5, 0x34, 0x30, 0xE4, 0x09,
+0x90, 0x01, 0x3C, 0x74, 0x10, 0xF0, 0x12, 0x51, 0xC9, 0xE5, 0x34, 0x30, 0xE5, 0x06, 0x90, 0x01,
+0x3C, 0x74, 0x20, 0xF0, 0xE5, 0x35, 0x30, 0xE0, 0x10, 0x90, 0x01, 0x3D, 0x74, 0x01, 0xF0, 0x90,
+0x00, 0x83, 0xE0, 0xF5, 0x23, 0x51, 0xE4, 0x51, 0xFC, 0xE5, 0x35, 0x30, 0xE2, 0x06, 0x90, 0x01,
+0x3D, 0x74, 0x04, 0xF0, 0xE5, 0x35, 0x30, 0xE4, 0x1B, 0x90, 0x01, 0x3D, 0x74, 0x10, 0xF0, 0x90,
+0x8B, 0x05, 0xE0, 0x60, 0x0F, 0xE4, 0xF0, 0x90, 0x05, 0x53, 0xE0, 0x44, 0x01, 0xF0, 0x90, 0x05,
+0xFD, 0xE0, 0x04, 0xF0, 0xE5, 0x36, 0x30, 0xE0, 0x75, 0x90, 0x01, 0x3E, 0x74, 0x01, 0xF0, 0x90,
+0x8B, 0x32, 0xE0, 0x30, 0xE0, 0x18, 0x90, 0x8B, 0x36, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0xE0, 0x64,
+0x03, 0x60, 0x0B, 0x7F, 0x01, 0xB1, 0xE0, 0xEF, 0x60, 0x04, 0x7F, 0x01, 0xD1, 0x89, 0x90, 0x8B,
+0x2C, 0xE0, 0x30, 0xE0, 0x49, 0x90, 0x8B, 0x30, 0xE4, 0xF0, 0xFF, 0xB1, 0xE0, 0xEF, 0x60, 0x3E,
+0x12, 0x65, 0x5F, 0x90, 0x8B, 0x2D, 0xE0, 0xFF, 0x64, 0x06, 0x60, 0x32, 0xEF, 0xB4, 0x04, 0x02,
+0x80, 0x07, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x04, 0xE4, 0xFF, 0x80, 0x14, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x05, 0x7F,
+0x01, 0x12, 0x65, 0x82, 0x7D, 0x01, 0xAF, 0x23, 0x12, 0x45, 0xA2, 0x12, 0x7D, 0xC1, 0xE5, 0x36,
+0x30, 0xE1, 0x47, 0x90, 0x01, 0x3E, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0x30, 0xE0, 0x19,
+0x90, 0x8B, 0x36, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x33, 0xE0, 0x64, 0x03, 0x60, 0x0B, 0x7F, 0x01,
+0xB1, 0xE0, 0xEF, 0x70, 0x04, 0x7F, 0x02, 0xD1, 0x89, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x1A,
+0x90, 0x8B, 0x30, 0x74, 0x01, 0xF0, 0x12, 0x7E, 0x2B, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60,
+0x09, 0xE4, 0xFF, 0xB1, 0xE0, 0xEF, 0x70, 0x02, 0xD1, 0x56, 0x74, 0x87, 0x04, 0x90, 0x01, 0xC4,
+0xF0, 0x74, 0x4B, 0xA3, 0xF0, 0xD0, 0x07, 0xD0, 0x06, 0xD0, 0x05, 0xD0, 0x04, 0xD0, 0x03, 0xD0,
+0x02, 0xD0, 0x01, 0xD0, 0x00, 0xD0, 0xD0, 0xD0, 0x82, 0xD0, 0x83, 0xD0, 0xF0, 0xD0, 0xE0, 0x32,
+0xEF, 0x64, 0x01, 0x70, 0x3D, 0x90, 0x8B, 0x35, 0xE0, 0x60, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B,
+0x08, 0xE0, 0x60, 0x03, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x34, 0xE0, 0x60, 0x03, 0x7F, 0x01, 0x22,
+0x90, 0x8B, 0x32, 0xE0, 0xFF, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x0B, 0xEF, 0xC4, 0x13, 0x54,
+0x07, 0x30, 0xE0, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x36, 0xE0, 0x7F, 0x01, 0x60, 0x36, 0x7F,
+0x00, 0x22, 0x90, 0x8B, 0x2F, 0xE0, 0x60, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x08, 0xE0, 0x60,
+0x03, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x2E, 0xE0, 0x60, 0x03, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x2C,
+0xE0, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x30, 0xE0, 0x7F,
+0x01, 0x60, 0x02, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x0D, 0xE0, 0x60, 0x16, 0x90, 0x8B, 0x2D, 0xE0,
+0x70, 0x04, 0x7F, 0x05, 0x80, 0x1F, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x01, 0x70, 0x1A, 0x7F, 0x02,
+0x80, 0x13, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x01, 0x04, 0x7F, 0x03, 0x80, 0x08, 0x90, 0x8B, 0x2D,
+0xE0, 0x70, 0x05, 0x7F, 0x04, 0x12, 0x65, 0x82, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0,
+0x90, 0x8B, 0x33, 0xE0, 0x90, 0x8B, 0x55, 0xF0, 0x6F, 0x70, 0x02, 0xE1, 0x55, 0xEF, 0x14, 0x60,
+0x3B, 0x14, 0x60, 0x5F, 0x14, 0x70, 0x02, 0xE1, 0x30, 0x24, 0x03, 0x60, 0x02, 0xE1, 0x55, 0x90,
+0x8B, 0x55, 0xE0, 0xB4, 0x03, 0x04, 0xF1, 0xC2, 0xE1, 0x55, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x02,
+0x04, 0xF1, 0xAF, 0xE1, 0x55, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x04, 0x04, 0xF1, 0xC6, 0xE1, 0x55,
+0x90, 0x8B, 0x55, 0xE0, 0x64, 0x01, 0x70, 0x7D, 0xF1, 0xB1, 0x80, 0x79, 0x90, 0x8B, 0x55, 0xE0,
+0xFF, 0xB4, 0x03, 0x04, 0xF1, 0xCA, 0x80, 0x6D, 0xEF, 0xB4, 0x02, 0x04, 0xF1, 0xA1, 0x80, 0x65,
+0x90, 0x8B, 0x55, 0xE0, 0xFF, 0xB4, 0x04, 0x04, 0xF1, 0xD5, 0x80, 0x59, 0xEF, 0x70, 0x56, 0xF1,
+0x8E, 0x80, 0x52, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x03, 0x05, 0x12, 0x7C, 0x41, 0x80, 0x46, 0x90,
+0x8B, 0x55, 0xE0, 0xB4, 0x01, 0x04, 0xF1, 0x72, 0x80, 0x3B, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x04,
+0x05, 0x12, 0x7D, 0x23, 0x80, 0x2F, 0x90, 0x8B, 0x55, 0xE0, 0x70, 0x29, 0xF1, 0x70, 0x80, 0x25,
+0x90, 0x8B, 0x55, 0xE0, 0xFF, 0xB4, 0x01, 0x04, 0xF1, 0x5A, 0x80, 0x19, 0xEF, 0xB4, 0x02, 0x04,
+0xF1, 0x6B, 0x80, 0x11, 0x90, 0x8B, 0x55, 0xE0, 0xFF, 0xB4, 0x04, 0x04, 0xF1, 0x5A, 0x80, 0x05,
+0xEF, 0x70, 0x02, 0xF1, 0x67, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x05, 0x22, 0x74, 0x6F, 0xF0,
+0x90, 0x8B, 0x33, 0x74, 0x03, 0xF0, 0x22, 0xF1, 0x8E, 0x80, 0xEF, 0x12, 0x7D, 0x42, 0x80, 0xEA,
+0xF1, 0x8E, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x12, 0x7E, 0x9A, 0xEF, 0x70, 0x06, 0x90, 0x01,
+0xC8, 0x74, 0xFD, 0xF0, 0x12, 0x7C, 0x50, 0x90, 0x8B, 0x33, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x01,
+0x3E, 0x74, 0x03, 0xF0, 0xFD, 0x7F, 0x02, 0x12, 0x31, 0xB7, 0x90, 0x8B, 0x33, 0x74, 0x01, 0xF0,
+0x22, 0x12, 0x7D, 0x42, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0x04, 0xF0, 0x22, 0xF1,
+0xA1, 0x7D, 0x03, 0x7F, 0x02, 0x12, 0x31, 0x49, 0x90, 0x05, 0x27, 0xE4, 0xF0, 0x90, 0x8B, 0x33,
+0xF0, 0x22, 0xF1, 0xCA, 0x80, 0xEB, 0xF1, 0xD5, 0x80, 0xE7, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90,
+0x8B, 0x33, 0x04, 0xF0, 0x22, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0x04, 0xF0, 0x22,
+0xF1, 0x8E, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x33, 0x74, 0x04, 0xF0, 0x22, 0x90,
+0x02, 0x84, 0xEF, 0xF0, 0xA3, 0xEE, 0xF0, 0xA3, 0x74, 0x05, 0xF0, 0x22, 0xEF, 0x8E, 0xF0, 0x12,
+0x43, 0xBA, 0x50, 0x1A, 0x00, 0x40, 0x50, 0x42, 0x00, 0x80, 0x50, 0x6D, 0x01, 0x00, 0x50, 0x81,
+0x02, 0x00, 0x50, 0x99, 0x04, 0x00, 0x00, 0x00, 0x50, 0xB6, 0xED, 0x54, 0x3F, 0x70, 0x04, 0xFE,
+0xFF, 0x80, 0x04, 0x7E, 0x00, 0x7F, 0x40, 0xEF, 0x2D, 0xFF, 0xEE, 0x3C, 0xFE, 0xEF, 0x78, 0x06,
+0xCE, 0xC3, 0x13, 0xCE, 0x13, 0xD8, 0xF9, 0x78, 0x06, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9,
+0x80, 0x26, 0xED, 0x54, 0x7F, 0x70, 0x04, 0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x00, 0x7F, 0x80, 0xEF,
+0x2D, 0xFF, 0xEE, 0x3C, 0xFE, 0xEF, 0x78, 0x07, 0xCE, 0xC3, 0x13, 0xCE, 0x13, 0xD8, 0xF9, 0x78,
+0x07, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFD, 0xAC, 0x06, 0x80, 0x49, 0xED, 0x70, 0x04,
+0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x01, 0x7F, 0x00, 0xEF, 0x2D, 0xEE, 0x3C, 0x7D, 0x00, 0xFC, 0x80,
+0x35, 0xEC, 0x54, 0x01, 0x4D, 0x70, 0x04, 0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x02, 0x7F, 0x00, 0xEF,
+0x2D, 0xEE, 0x3C, 0xC3, 0x13, 0x7D, 0x00, 0x80, 0x1A, 0xEC, 0x54, 0x03, 0x4D, 0x70, 0x04, 0xFE,
+0xFF, 0x80, 0x04, 0x7E, 0x04, 0x7F, 0x00, 0xEF, 0x2D, 0xEE, 0x3C, 0x13, 0x13, 0x54, 0x3F, 0x7D,
+0x00, 0x25, 0xE0, 0x25, 0xE0, 0xFC, 0xAE, 0x04, 0xAF, 0x05, 0x22, 0x90, 0x01, 0xE4, 0x74, 0x58,
+0xF0, 0xA3, 0x74, 0x02, 0xF0, 0x22, 0xE4, 0x90, 0x8A, 0xCC, 0xF0, 0xA3, 0xF0, 0x75, 0x8E, 0x02,
+0x91, 0x0E, 0x12, 0x68, 0x44, 0x90, 0x8B, 0x07, 0xEF, 0xF0, 0x12, 0x68, 0x51, 0x90, 0x8B, 0x09,
+0xEF, 0xF0, 0x12, 0x68, 0x5D, 0x90, 0x8A, 0xF4, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xE4, 0xF5, 0x55,
+0xF5, 0x21, 0x12, 0x72, 0x55, 0x12, 0x44, 0x9E, 0x12, 0x2E, 0x01, 0x7F, 0x03, 0x12, 0x78, 0x42,
+0x12, 0x7C, 0x3D, 0x12, 0x68, 0x0A, 0x12, 0x68, 0x75, 0x12, 0x68, 0x8A, 0x12, 0x68, 0x28, 0x12,
+0x68, 0x43, 0x90, 0x8A, 0xCE, 0xE5, 0xD9, 0xF0, 0x31, 0x5F, 0xC2, 0xAF, 0x90, 0x00, 0x80, 0xE0,
+0x44, 0x40, 0xF0, 0x51, 0x0E, 0x75, 0xE8, 0x03, 0x43, 0xA8, 0x85, 0xD2, 0xAF, 0x11, 0xBB, 0x90,
+0x8A, 0xCC, 0xE0, 0x64, 0x01, 0xF0, 0x24, 0xC6, 0x90, 0x01, 0xC4, 0xF0, 0x74, 0x50, 0xA3, 0xF0,
+0xE5, 0x55, 0x30, 0xE4, 0x09, 0xC2, 0xAF, 0x53, 0x55, 0xEF, 0xD2, 0xAF, 0xB1, 0x59, 0xE5, 0x55,
+0x30, 0xE6, 0xDC, 0xC2, 0xAF, 0x53, 0x55, 0xBF, 0xD2, 0xAF, 0x12, 0x6B, 0xBD, 0x80, 0xD0, 0x90,
+0x01, 0x3C, 0x74, 0xFF, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0x90, 0x01, 0x34, 0xF0, 0xA3, 0xF0, 0xA3,
+0xF0, 0xA3, 0xF0, 0xFD, 0x7F, 0x54, 0x31, 0x88, 0x7D, 0xFF, 0x7F, 0x55, 0x31, 0x88, 0x7D, 0xFF,
+0x7F, 0x56, 0x31, 0x88, 0x7D, 0xFF, 0x7F, 0x57, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8F,
+0x82, 0x75, 0x83, 0x00, 0xED, 0xF0, 0x51, 0x0E, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x01, 0x30,
+0xE4, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0x90, 0x01, 0x38, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0,
+0xA3, 0xF0, 0xFD, 0x7F, 0x50, 0x31, 0x88, 0xE4, 0xFD, 0x7F, 0x51, 0x31, 0x88, 0xE4, 0xFD, 0x7F,
+0x52, 0x31, 0x88, 0xE4, 0xFD, 0x7F, 0x53, 0x80, 0xBF, 0xE5, 0x5E, 0x64, 0x01, 0x70, 0x3B, 0x71,
+0x4E, 0xBF, 0x01, 0x04, 0x7F, 0x01, 0x71, 0x42, 0x90, 0x00, 0x46, 0xE0, 0x44, 0x04, 0xFD, 0x7F,
+0x46, 0x31, 0x88, 0x90, 0x00, 0x44, 0xE0, 0x54, 0xFB, 0xFD, 0x7F, 0x44, 0x31, 0x88, 0x90, 0x00,
+0x46, 0xE0, 0x54, 0xFB, 0xFD, 0x7F, 0x46, 0x31, 0x88, 0x7F, 0x02, 0x71, 0x6A, 0x8F, 0x62, 0x90,
+0x01, 0xC9, 0xE5, 0x62, 0xF0, 0xB4, 0x01, 0x02, 0x51, 0xE2, 0x22, 0xE0, 0x5F, 0xF0, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x7F, 0x10, 0xDF, 0xFE, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8A, 0xE0, 0xED, 0xF0, 0x90, 0x8A, 0xDF, 0xEF, 0xF0, 0xD3,
+0x94, 0x07, 0x50, 0x4E, 0xA3, 0xE0, 0x70, 0x1A, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0x01, 0xA8,
+0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x47, 0xE0, 0x5F, 0xF0,
+0x80, 0x17, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33,
+0xD8, 0xFC, 0xFF, 0x90, 0x00, 0x47, 0xE0, 0x4F, 0xF0, 0x51, 0x0E, 0x90, 0x8A, 0xDF, 0xE0, 0xFF,
+0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x46,
+0x80, 0x59, 0x90, 0x8A, 0xDF, 0xE0, 0x24, 0xF8, 0xF0, 0xA3, 0xE0, 0x70, 0x1D, 0x90, 0x8A, 0xDF,
+0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xC4, 0x54, 0xF0,
+0xF4, 0xFF, 0x90, 0x00, 0x43, 0xE0, 0x5F, 0xF0, 0x80, 0x1A, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74,
+0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xC4, 0x54, 0xF0, 0xFF, 0x90, 0x00,
+0x43, 0xE0, 0x4F, 0xF0, 0x51, 0x0E, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08,
+0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x43, 0x51, 0x0B, 0xD0, 0xD0, 0x92,
+0xAF, 0x22, 0x90, 0x00, 0x49, 0xE0, 0x90, 0x8B, 0x54, 0xF0, 0xE0, 0x54, 0x0F, 0xF0, 0x44, 0xF0,
+0xFD, 0x7F, 0x49, 0x31, 0x88, 0x90, 0x8B, 0x54, 0xE0, 0x44, 0xB0, 0xFD, 0x7F, 0x49, 0x21, 0x88,
+0x90, 0x8A, 0xDD, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x75, 0x5E, 0x01, 0x8E, 0x5F, 0xF5, 0x60, 0xE4,
+0xFD, 0x7F, 0x0B, 0x51, 0x1E, 0xE4, 0xFD, 0x7F, 0x02, 0x51, 0x1E, 0x71, 0x4E, 0xE4, 0xFF, 0x71,
+0x42, 0xE4, 0xF5, 0x62, 0x90, 0x01, 0xC9, 0xE5, 0x62, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFC, 0xA3,
+0xE0, 0xFD, 0xEC, 0xFB, 0x8D, 0x44, 0xE4, 0xF5, 0x45, 0x7D, 0x01, 0x7F, 0x60, 0x7E, 0x01, 0x02,
+0x30, 0x62, 0x90, 0x01, 0xCA, 0xE5, 0x61, 0xF0, 0xEF, 0x60, 0x02, 0x51, 0xE2, 0x22, 0x7F, 0x0B,
+0x71, 0x6A, 0xEF, 0x65, 0x61, 0x60, 0x10, 0xE5, 0x61, 0xB4, 0x01, 0x05, 0xE4, 0xF5, 0x61, 0x80,
+0x03, 0x75, 0x61, 0x01, 0x7F, 0x01, 0x22, 0x7F, 0x00, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0,
+0xD0, 0x90, 0x8B, 0x57, 0xEF, 0xF0, 0xD3, 0x94, 0x07, 0x50, 0x43, 0xE0, 0xFF, 0x74, 0x01, 0xA8,
+0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x46, 0x51, 0x0B, 0x90,
+0x8B, 0x57, 0xE0, 0xFD, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x05, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE,
+0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x00, 0x44, 0xE0, 0xFB, 0xE4, 0xFE, 0xEF, 0x5B, 0xA8, 0x05,
+0x08, 0x80, 0x06, 0xCE, 0xA2, 0xE7, 0x13, 0xCE, 0x13, 0xD8, 0xF8, 0xFF, 0x80, 0x4B, 0x90, 0x8B,
+0x57, 0xE0, 0x24, 0xF8, 0xF0, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33,
+0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x43, 0xE0, 0x5F, 0xF0, 0x51, 0x0E, 0x90, 0x8B, 0x57, 0xE0,
+0xFD, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x05, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8,
+0xF9, 0xFF, 0x90, 0x00, 0x42, 0xE0, 0xFB, 0xE4, 0xFE, 0xEF, 0x5B, 0xA8, 0x05, 0x08, 0x80, 0x06,
+0xCE, 0xA2, 0xE7, 0x13, 0xCE, 0x13, 0xD8, 0xF8, 0xFF, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xE4, 0x90,
+0x8B, 0x04, 0xF0, 0x90, 0x00, 0x80, 0xE0, 0x44, 0x80, 0xFD, 0x7F, 0x80, 0x21, 0x88, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x8B, 0x90, 0x8A, 0xDA, 0x12, 0x43,
+0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0xC2, 0xFA, 0xE5, 0xF0, 0x24, 0x00, 0xFF, 0xE4, 0x3A, 0xFE,
+0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0xEE, 0x8F, 0xF0, 0x12, 0x43, 0x19, 0x12,
+0x24, 0x62, 0xFF, 0x60, 0x2C, 0xB5, 0x5E, 0x16, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x90, 0x00,
+0x01, 0x12, 0x42, 0xC2, 0x65, 0x60, 0x70, 0x04, 0xE5, 0x5F, 0x65, 0xF0, 0x60, 0x22, 0x90, 0x8A,
+0xDA, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0xC2, 0xFF, 0xAE, 0xF0, 0x71, 0x00, 0x80,
+0x0F, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x12, 0x24, 0x62, 0x65, 0x5E, 0x60, 0x02, 0x91, 0x95,
+0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xE4, 0xF5, 0x5E, 0x7F, 0x60, 0x7E, 0x01, 0x8F, 0x82, 0x8E, 0x83,
+0xA3, 0xA3, 0xA3, 0xE4, 0xF0, 0x22, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x8B, 0xEF, 0x12, 0x43, 0x94,
+0x54, 0xE7, 0x01, 0x54, 0xDE, 0x02, 0x55, 0x0B, 0x03, 0x55, 0x14, 0x05, 0x55, 0x1D, 0x06, 0x55,
+0x58, 0x07, 0x55, 0x25, 0x08, 0x55, 0x2E, 0x09, 0x55, 0x36, 0x20, 0x55, 0x3F, 0x2C, 0x54, 0xF0,
+0x2D, 0x54, 0xF9, 0x2E, 0x55, 0x02, 0x3B, 0x55, 0x48, 0x4B, 0x00, 0x00, 0x55, 0x51, 0x90, 0x8A,
+0xD7, 0x12, 0x43, 0x6B, 0x02, 0x74, 0x85, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x74, 0x8B,
+0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x74, 0xB8, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02,
+0x75, 0x00, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x75, 0x39, 0x90, 0x8A, 0xD7, 0x12, 0x43,
+0x6B, 0x02, 0x75, 0x52, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x74, 0x0F, 0x90, 0x8A, 0xD7,
+0x12, 0x43, 0x6B, 0xC1, 0xA6, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x75, 0x9A, 0x90, 0x8A,
+0xD7, 0x12, 0x43, 0x6B, 0x81, 0x1E, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x78, 0x81, 0x90,
+0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x7A, 0xC2, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x7C,
+0x2B, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x01, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0,
+0x90, 0x01, 0xCC, 0xE0, 0x54, 0x0F, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFD, 0x70,
+0x02, 0xC1, 0xA1, 0x90, 0x8B, 0x51, 0xE0, 0xFF, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80,
+0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0xEF, 0x5D, 0x70, 0x02, 0xC1, 0x9A, 0x90,
+0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD0, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD0,
+0xF0, 0x75, 0x1D, 0x01, 0x75, 0x1E, 0x8A, 0x75, 0x1F, 0xD0, 0x75, 0x20, 0x01, 0x7B, 0x01, 0x7A,
+0x8A, 0x79, 0xD1, 0x12, 0x5E, 0xE4, 0x90, 0x8A, 0xD1, 0xE0, 0xFF, 0xC4, 0x13, 0x13, 0x13, 0x54,
+0x01, 0x90, 0x8B, 0x51, 0x30, 0xE0, 0x59, 0xE0, 0x75, 0xF0, 0x02, 0x90, 0x00, 0x88, 0x12, 0x43,
+0x5F, 0xE0, 0x90, 0x8A, 0xD2, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x02, 0x90, 0x00, 0x89,
+0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD3, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90,
+0x01, 0xD1, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD4, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0,
+0x04, 0x90, 0x01, 0xD2, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD5, 0xF0, 0x90, 0x8B, 0x51, 0xE0,
+0x75, 0xF0, 0x04, 0x90, 0x01, 0xD3, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD6, 0xF0, 0x80, 0x33,
+0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD1, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD2, 0xF0, 0x90,
+0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD2, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD3,
+0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD3, 0x12, 0x43, 0x5F, 0xE0, 0x90,
+0x8A, 0xD4, 0xF0, 0xEF, 0x54, 0x7F, 0xFF, 0x7B, 0x01, 0x7A, 0x8A, 0x79, 0xD2, 0x91, 0xA6, 0x90,
+0x8A, 0xCF, 0xE0, 0xFF, 0x90, 0x8B, 0x51, 0xE0, 0xFE, 0x74, 0x01, 0xA8, 0x06, 0x08, 0x80, 0x02,
+0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0x5F, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0xFF, 0x74,
+0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0x90, 0x01, 0xCC, 0xF0, 0x90, 0x8B,
+0x51, 0xE0, 0x04, 0xF0, 0xE0, 0x54, 0x03, 0xF0, 0xA1, 0x6A, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x02,
+0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x00, 0x04, 0x12, 0x42, 0x20, 0xFF, 0x54, 0x1F, 0xFE,
+0xEF, 0x54, 0x20, 0xC4, 0x13, 0x54, 0x07, 0xFD, 0xAF, 0x06, 0x90, 0x8A, 0xDA, 0xEF, 0xF0, 0xA3,
+0xED, 0xF0, 0xA3, 0x12, 0x43, 0x8B, 0x90, 0x8A, 0xDC, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x03, 0x12,
+0x42, 0x20, 0x54, 0xF0, 0xC4, 0x54, 0x0F, 0x90, 0x8A, 0xDF, 0xF0, 0x90, 0x00, 0x04, 0x12, 0x42,
+0x20, 0x54, 0x40, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x90, 0x8A, 0xE0, 0xF0, 0x90, 0x8A, 0xDA, 0xE0,
+0xFF, 0x75, 0xF0, 0x09, 0x90, 0x87, 0x25, 0x12, 0x43, 0x5F, 0xAD, 0x82, 0xAC, 0x83, 0x90, 0x8A,
+0xE1, 0xEC, 0xF0, 0xA3, 0xED, 0xF0, 0xEF, 0x75, 0xF0, 0x09, 0xA4, 0x24, 0x23, 0xF9, 0x74, 0x87,
+0x35, 0xF0, 0xFA, 0x7B, 0x01, 0xA3, 0x12, 0x43, 0x8B, 0x90, 0x8A, 0xDC, 0x12, 0x43, 0x6B, 0x90,
+0x00, 0x03, 0x12, 0x42, 0x20, 0x54, 0x0F, 0xFF, 0x90, 0x8A, 0xE3, 0x12, 0x43, 0x6B, 0xEF, 0x12,
+0x42, 0x4D, 0x90, 0x8A, 0xDC, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0x90,
+0x8A, 0xE3, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0xEF, 0x12, 0x42, 0x5F, 0x90, 0x8A, 0xDC, 0x12,
+0x43, 0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0xFF, 0x90, 0x8A, 0xE1, 0xE0, 0xFC, 0xA3, 0xE0,
+0xFD, 0xF5, 0x82, 0x8C, 0x83, 0xEF, 0xF0, 0x12, 0x24, 0x62, 0x8D, 0x82, 0x8C, 0x83, 0xA3, 0xF0,
+0x90, 0x8A, 0xDF, 0xE0, 0xFE, 0x90, 0x8A, 0xDA, 0xE0, 0xFF, 0x24, 0xC1, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xDB, 0xE0, 0xFE, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87,
+0x29, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2A, 0x12, 0x43, 0x5F,
+0x74, 0x01, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xFE, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2B, 0x12,
+0x43, 0x5F, 0xEE, 0xF0, 0x8F, 0x0F, 0xEF, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89,
+0xAF, 0x82, 0xF5, 0x10, 0x8F, 0x11, 0xE5, 0x0F, 0x75, 0xF0, 0x02, 0xA4, 0x24, 0x81, 0xF9, 0x74,
+0x86, 0x35, 0xF0, 0x75, 0x12, 0x01, 0xF5, 0x13, 0x89, 0x14, 0x75, 0xF0, 0x09, 0xE5, 0x0F, 0x90,
+0x87, 0x25, 0x12, 0x43, 0x5F, 0xAF, 0x82, 0x85, 0x83, 0x15, 0x8F, 0x16, 0xE5, 0x0F, 0x75, 0xF0,
+0x09, 0xA4, 0x24, 0x23, 0xF9, 0x74, 0x87, 0x35, 0xF0, 0x75, 0x17, 0x01, 0xF5, 0x18, 0x89, 0x19,
+0x74, 0xC1, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0x12, 0x43, 0x94, 0x58,
+0x34, 0x00, 0x58, 0x49, 0x01, 0x58, 0x5E, 0x02, 0x58, 0x73, 0x03, 0x58, 0x9C, 0x04, 0x58, 0xB1,
+0x05, 0x58, 0xC6, 0x06, 0x58, 0xEC, 0x0C, 0x59, 0x19, 0x0D, 0x59, 0x46, 0x0E, 0x59, 0x73, 0x0F,
+0x00, 0x00, 0x59, 0xA7, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5,
+0x83, 0x74, 0xF0, 0xF0, 0xA3, 0x74, 0x15, 0x80, 0x3C, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5,
+0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0xF0, 0xF0, 0xA3, 0x74, 0x10, 0x80, 0x27, 0xE5, 0x0F,
+0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0xF0, 0xF0, 0xA3, 0x74,
+0x05, 0x80, 0x12, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83,
+0x74, 0xF0, 0xF0, 0xA3, 0xE4, 0xF0, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0x74, 0x0F, 0xF0, 0xA3, 0x74, 0x8F, 0xF0, 0x21, 0xA7, 0xE5, 0x0F, 0x25, 0xE0,
+0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0x0F, 0xF0, 0xA3, 0x74, 0xF5, 0x80,
+0x27, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0x0F,
+0xF0, 0xA3, 0x74, 0xF0, 0x80, 0x12, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34,
+0x89, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0x74, 0x0D, 0xF0, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5,
+0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0x21, 0xA7, 0x90, 0x04, 0x47, 0xE0,
+0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x12, 0x42, 0x4D, 0x90, 0x04, 0x46, 0xE0, 0xAB, 0x12, 0xAA,
+0x13, 0xA9, 0x14, 0x90, 0x00, 0x01, 0x12, 0x42, 0x5F, 0x90, 0x04, 0x45, 0xE0, 0x85, 0x11, 0x82,
+0x85, 0x10, 0x83, 0xF0, 0x90, 0x04, 0x44, 0x21, 0x9E, 0x90, 0x04, 0x4B, 0xE0, 0xAB, 0x12, 0xAA,
+0x13, 0xA9, 0x14, 0x12, 0x42, 0x4D, 0x90, 0x04, 0x4A, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14,
+0x90, 0x00, 0x01, 0x12, 0x42, 0x5F, 0x90, 0x04, 0x49, 0xE0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83,
+0xF0, 0x90, 0x04, 0x48, 0x80, 0x58, 0x90, 0x04, 0x4F, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14,
+0x12, 0x42, 0x4D, 0x90, 0x04, 0x4E, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x01,
+0x12, 0x42, 0x5F, 0x90, 0x04, 0x4D, 0xE0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xF0, 0x90, 0x04,
+0x4C, 0x80, 0x2B, 0x90, 0x04, 0x53, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x12, 0x42, 0x4D,
+0x90, 0x04, 0x52, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x01, 0x12, 0x42, 0x5F,
+0x90, 0x04, 0x51, 0xE0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xF0, 0x90, 0x04, 0x50, 0xE0, 0x85,
+0x11, 0x82, 0x85, 0x10, 0x83, 0xA3, 0xF0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0xC0, 0x03, 0xC0,
+0x02, 0xC0, 0x01, 0x12, 0x24, 0x62, 0xFF, 0xAB, 0x17, 0xAA, 0x18, 0xA9, 0x19, 0x12, 0x24, 0x62,
+0x5F, 0xD0, 0x01, 0xD0, 0x02, 0xD0, 0x03, 0x12, 0x42, 0x4D, 0xAB, 0x12, 0xE5, 0x14, 0x24, 0x01,
+0xF9, 0xE4, 0x35, 0x13, 0xFA, 0xC0, 0x03, 0xC0, 0x02, 0xC0, 0x01, 0x12, 0x24, 0x62, 0xFF, 0xAB,
+0x17, 0xAA, 0x18, 0xA9, 0x19, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0x5F, 0xD0, 0x01, 0xD0, 0x02,
+0xD0, 0x03, 0x12, 0x42, 0x4D, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xC0, 0x83, 0xC0, 0x82, 0xE0,
+0xFF, 0x85, 0x16, 0x82, 0x85, 0x15, 0x83, 0xE0, 0xFE, 0xEF, 0x5E, 0xD0, 0x82, 0xD0, 0x83, 0xF0,
+0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xA3, 0xC0, 0x83, 0xC0, 0x82, 0xE0, 0xFF, 0x85, 0x16, 0x82,
+0x85, 0x15, 0x83, 0xA3, 0xE0, 0xFE, 0xEF, 0x5E, 0xD0, 0x82, 0xD0, 0x83, 0xF0, 0xE5, 0x0F, 0x25,
+0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0, 0x4E, 0x60,
+0x4B, 0x90, 0x8A, 0xE6, 0x74, 0x0B, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x00, 0x50,
+0x02, 0x41, 0xEC, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33,
+0xCE, 0xD8, 0xF9, 0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5,
+0x83, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x0A, 0x90, 0x8A, 0xE6, 0xE0, 0x24, 0x10,
+0xA3, 0xF0, 0x80, 0x68, 0x90, 0x8A, 0xE6, 0xE0, 0x14, 0xF0, 0x80, 0xBB, 0xE5, 0x0F, 0x25, 0xE0,
+0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0, 0x4E, 0x60, 0x47,
+0x90, 0x8A, 0xE6, 0x74, 0x0F, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x00, 0x40, 0x3C,
+0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9,
+0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0x5E,
+0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x08, 0x90, 0x8A, 0xE6, 0xE0, 0xA3, 0xF0, 0x80, 0x0D, 0x90,
+0x8A, 0xE6, 0xE0, 0x14, 0xF0, 0x80, 0xBF, 0xE4, 0x90, 0x8A, 0xE7, 0xF0, 0xE5, 0x0F, 0x25, 0xE0,
+0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0, 0x4E, 0x60, 0x46,
+0xE4, 0x90, 0x8A, 0xE6, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x10, 0x40, 0x02, 0x61,
+0xA5, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8,
+0xF9, 0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0,
+0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x06, 0x90, 0x8A, 0xE6, 0xE0, 0x80, 0x63, 0x90, 0x8A,
+0xE6, 0xE0, 0x04, 0xF0, 0x80, 0xBF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0, 0x4E, 0x60, 0x46, 0xE4, 0x90, 0x8A, 0xE6, 0xF0, 0x90,
+0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x0C, 0x50, 0x3C, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08,
+0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81,
+0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x08,
+0x90, 0x8A, 0xE6, 0xE0, 0x24, 0x10, 0x80, 0x09, 0x90, 0x8A, 0xE6, 0xE0, 0x04, 0xF0, 0x80, 0xBF,
+0xE4, 0x90, 0x8A, 0xE8, 0xF0, 0x90, 0x8A, 0xE7, 0xE0, 0xFF, 0x75, 0xF0, 0x09, 0xE5, 0x0F, 0x90,
+0x87, 0x27, 0x12, 0x43, 0x5F, 0xEF, 0xF0, 0x90, 0x8A, 0xE8, 0xE0, 0xFE, 0x75, 0xF0, 0x09, 0xE5,
+0x0F, 0x90, 0x87, 0x28, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0xE5, 0x0F, 0xC3, 0x94, 0x20, 0x50, 0x32,
+0x74, 0x84, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0xD3, 0x9F, 0x40, 0x02,
+0x80, 0x18, 0x74, 0x84, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0xC3, 0x9E,
+0x50, 0x08, 0x90, 0x8A, 0xE8, 0xE0, 0xA3, 0xF0, 0x80, 0x08, 0x90, 0x8A, 0xE7, 0xE0, 0x90, 0x8A,
+0xE9, 0xF0, 0x90, 0x8A, 0xE9, 0xE0, 0xFD, 0xAF, 0x0F, 0x91, 0x4E, 0x90, 0x8A, 0xE9, 0xE0, 0xFF,
+0x74, 0x84, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0, 0x90, 0x8A, 0xE7,
+0xE0, 0xFF, 0xD3, 0x94, 0x13, 0x40, 0x07, 0x90, 0x87, 0x22, 0x74, 0x03, 0xF0, 0x22, 0xEF, 0xD3,
+0x94, 0x0B, 0x40, 0x07, 0x90, 0x87, 0x22, 0x74, 0x02, 0xF0, 0x22, 0xEF, 0xD3, 0x94, 0x03, 0x40,
+0x07, 0x90, 0x87, 0x22, 0x74, 0x01, 0xF0, 0x22, 0xE4, 0x90, 0x87, 0x22, 0xF0, 0x22, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x74, 0x84, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xED,
+0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xAC, 0x07, 0xED, 0x54, 0x1F, 0x90, 0x8A, 0xC7, 0xF0, 0x74,
+0x01, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0x90, 0x8A, 0xC5, 0xF0, 0x90, 0x8A,
+0xC8, 0x74, 0x01, 0xF0, 0xEB, 0xC3, 0x94, 0x01, 0x40, 0x02, 0x80, 0x37, 0x90, 0x8A, 0xC5, 0xE0,
+0x25, 0x0D, 0xFF, 0xA3, 0xF0, 0xA3, 0xE0, 0x90, 0x41, 0x9E, 0x93, 0xFE, 0xEF, 0xD3, 0x9E, 0x40,
+0x10, 0x74, 0x01, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE4, 0xF0, 0xAF, 0x04, 0x80,
+0x9D, 0x90, 0x8A, 0xC6, 0xE0, 0xFF, 0x74, 0x01, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83,
+0xEF, 0xF0, 0x22, 0xAD, 0x07, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0,
+0xFF, 0x90, 0x8A, 0xCA, 0xF0, 0x74, 0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0,
+0x54, 0x1F, 0x90, 0x8A, 0xC9, 0xF0, 0xD3, 0x9F, 0x40, 0x06, 0xA3, 0xE0, 0x90, 0x8A, 0xC9, 0xF0,
+0x90, 0x8A, 0xC9, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83,
+0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0, 0x24, 0x2E, 0xF5, 0x82, 0xE4, 0x34,
+0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93, 0x3A, 0xC3, 0x13, 0xFE, 0xEF, 0x13,
+0xFF, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE, 0xF0, 0xA3,
+0xEF, 0xF0, 0xAF, 0x05, 0x90, 0x8A, 0xC9, 0xE0, 0xFD, 0x91, 0x4E, 0x90, 0x8A, 0xC9, 0xE0, 0xFF,
+0x22, 0xAC, 0x07, 0x74, 0x84, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0x7F,
+0x90, 0x8A, 0xDE, 0xF0, 0xE0, 0x54, 0x1F, 0xFF, 0x90, 0x8A, 0xE1, 0xF0, 0x75, 0xF0, 0x09, 0xEC,
+0x90, 0x87, 0x28, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xE3, 0xF0, 0x75, 0xF0, 0x09, 0xEC, 0x90,
+0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0, 0xFE, 0x90, 0x8A, 0xE4, 0xF0, 0xEC, 0x25, 0xE0, 0x24, 0xE4,
+0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFB, 0xA3, 0xE0, 0x90, 0x8A, 0xE5, 0xCB, 0xF0,
+0xA3, 0xEB, 0xF0, 0xEC, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0,
+0xFB, 0xA3, 0xE0, 0x90, 0x8A, 0xE7, 0xCB, 0xF0, 0xA3, 0xEB, 0xF0, 0xEF, 0xD3, 0x9E, 0x40, 0x0C,
+0x90, 0x8A, 0xE4, 0xE0, 0x90, 0x8A, 0xE1, 0xF0, 0x90, 0x8A, 0xDE, 0xF0, 0xED, 0x70, 0x02, 0xC1,
+0x93, 0x90, 0x8A, 0xE2, 0xED, 0xF0, 0x90, 0x8A, 0xDE, 0xE0, 0x30, 0xE6, 0x0E, 0x90, 0x8A, 0xE1,
+0xE0, 0x90, 0x8A, 0xDE, 0xF0, 0x90, 0x8A, 0xE2, 0xE0, 0x14, 0xF0, 0x90, 0x8A, 0xE2, 0xE0, 0x70,
+0x02, 0xC1, 0x93, 0x90, 0x8A, 0xE1, 0xE0, 0xFF, 0xD3, 0x94, 0x00, 0x50, 0x02, 0xC1, 0x93, 0xE4,
+0x90, 0x8A, 0xE0, 0xF0, 0xEF, 0x14, 0x90, 0x8A, 0xDF, 0xF0, 0x90, 0x8A, 0xE3, 0xE0, 0xFD, 0x90,
+0x8A, 0xDF, 0xE0, 0xFF, 0xD3, 0x9D, 0x40, 0x6F, 0xEF, 0x94, 0x10, 0x40, 0x21, 0xEF, 0x24, 0xF0,
+0xFF, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8,
+0xF9, 0xFF, 0x90, 0x8A, 0xE7, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x70, 0x27, 0x90, 0x8A,
+0xDF, 0xE0, 0xFF, 0xC3, 0x94, 0x10, 0x50, 0x37, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80,
+0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x8A, 0xE5, 0xE0, 0x5E, 0xFE, 0xA3,
+0xE0, 0x5F, 0x4E, 0x60, 0x1A, 0x90, 0x8A, 0xDF, 0xE0, 0x90, 0x8A, 0xDE, 0xF0, 0x90, 0x8A, 0xE0,
+0xE0, 0x04, 0xF0, 0x90, 0x8A, 0xE2, 0xE0, 0xFF, 0x90, 0x8A, 0xE0, 0xE0, 0x6F, 0x60, 0x08, 0x90,
+0x8A, 0xDF, 0xE0, 0x14, 0xF0, 0x80, 0x83, 0x90, 0x8A, 0xE2, 0xE0, 0xFF, 0x90, 0x8A, 0xE0, 0xE0,
+0xC3, 0x9F, 0x50, 0x0F, 0x90, 0x8A, 0xDF, 0xE0, 0xB5, 0x05, 0x08, 0x90, 0x8A, 0xE3, 0xE0, 0x90,
+0x8A, 0xDE, 0xF0, 0x90, 0x8A, 0xDE, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5, 0x82, 0xE4, 0x34,
+0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0, 0x24, 0x2E, 0xF5,
+0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93, 0x3A, 0xC3, 0x13,
+0xFE, 0xEF, 0x13, 0xFF, 0xEC, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83,
+0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xAF, 0x04, 0x90, 0x8A, 0xDE, 0xE0, 0xFD, 0x91, 0x4E, 0x90, 0x8A,
+0xDE, 0xE0, 0xFF, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8B, 0x1A, 0x8A, 0x1B, 0x89,
+0x1C, 0x90, 0x8B, 0x3F, 0x12, 0x43, 0x8B, 0xAB, 0x1D, 0xAA, 0x1E, 0xA9, 0x1F, 0x90, 0x8B, 0x42,
+0x12, 0x43, 0x8B, 0xAF, 0x20, 0x15, 0x20, 0xEF, 0x60, 0x1E, 0x90, 0x8B, 0x42, 0xE4, 0x75, 0xF0,
+0x01, 0x12, 0x43, 0x74, 0x12, 0x24, 0x62, 0xFF, 0x90, 0x8B, 0x3F, 0xE4, 0x75, 0xF0, 0x01, 0x12,
+0x43, 0x74, 0xEF, 0x12, 0x42, 0x4D, 0x80, 0xDB, 0xAB, 0x1A, 0xAA, 0x1B, 0xA9, 0x1C, 0xD0, 0xD0,
+0x92, 0xAF, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8B, 0x45, 0x12, 0x43, 0x8B,
+0x90, 0x8B, 0x53, 0xE0, 0xFF, 0x04, 0xF0, 0x90, 0x00, 0x01, 0xEF, 0x12, 0x42, 0x5F, 0x7F, 0xAF,
+0x7E, 0x01, 0x12, 0x74, 0x3B, 0xEF, 0x60, 0x47, 0x90, 0x8B, 0x45, 0x12, 0x43, 0x6B, 0x8B, 0x1D,
+0x8A, 0x1E, 0x89, 0x1F, 0x75, 0x20, 0x02, 0x7B, 0x01, 0x7A, 0x01, 0x79, 0xA0, 0xD1, 0xE4, 0x90,
+0x8B, 0x48, 0x12, 0x43, 0x6B, 0x8B, 0x1D, 0x8A, 0x1E, 0x89, 0x1F, 0x90, 0x8B, 0x45, 0x12, 0x43,
+0x6B, 0x12, 0x24, 0x62, 0xFF, 0xC4, 0x54, 0x0F, 0xF5, 0x20, 0x7B, 0x01, 0x7A, 0x01, 0x79, 0xA2,
+0xD1, 0xE4, 0x90, 0x01, 0xAF, 0x74, 0xFF, 0xF0, 0x90, 0x01, 0xCB, 0xE0, 0x64, 0x80, 0xF0, 0xD0,
+0xD0, 0x92, 0xAF, 0x22, 0x90, 0x8A, 0xC5, 0xE0, 0x54, 0xF0, 0x44, 0x03, 0xF0, 0x54, 0x0F, 0x44,
+0x80, 0xF0, 0x7B, 0x00, 0x7A, 0x00, 0x79, 0x56, 0x90, 0x8B, 0x48, 0x12, 0x43, 0x8B, 0x0B, 0x7A,
+0x8A, 0x79, 0xC5, 0xE1, 0x33, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x01, 0xC4, 0x74,
+0xC5, 0xF0, 0x74, 0x5F, 0xA3, 0xF0, 0x90, 0x04, 0x1D, 0xE0, 0x60, 0x1A, 0x90, 0x05, 0x22, 0xE0,
+0x54, 0x90, 0x60, 0x07, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x40, 0xF0, 0x90, 0x01, 0xC7, 0xE0, 0x30,
+0xE1, 0xE4, 0x7F, 0x00, 0x80, 0x02, 0x7F, 0x01, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xD3, 0x10, 0xAF,
+0x01, 0xC3, 0xC0, 0xD0, 0xE4, 0xFB, 0xFA, 0xEF, 0x30, 0xE0, 0x02, 0x7B, 0x80, 0xEF, 0xC3, 0x13,
+0x90, 0xFD, 0x10, 0xF0, 0x90, 0x04, 0x25, 0xEF, 0xF0, 0xED, 0x60, 0x1E, 0xAF, 0x03, 0x74, 0x0F,
+0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x80, 0xF0, 0x74, 0x10, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x80, 0xF0, 0xAF, 0x03, 0x74, 0x08, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x09, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC,
+0xF5, 0x83, 0xE0, 0x54, 0xF0, 0xF0, 0x74, 0x21, 0x2B, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83,
+0xE0, 0x54, 0xF7, 0xF0, 0xAE, 0x02, 0xAF, 0x03, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x12, 0x5F, 0xC5,
+0xBF, 0x01, 0x10, 0x90, 0x02, 0x09, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5F, 0xFD, 0x90, 0x04, 0x1F,
+0x74, 0x20, 0xF0, 0x22, 0x90, 0x01, 0x02, 0xE0, 0x54, 0x03, 0xFF, 0xE0, 0x54, 0x0C, 0x13, 0x13,
+0x54, 0x3F, 0xFE, 0xEF, 0x64, 0x01, 0x60, 0x04, 0xEF, 0xB4, 0x03, 0x0E, 0x90, 0x8A, 0xC5, 0x74,
+0x01, 0xF0, 0xA3, 0x74, 0x37, 0xF0, 0x79, 0x01, 0x80, 0x18, 0xEE, 0x64, 0x01, 0x60, 0x07, 0xAF,
+0x06, 0xEE, 0x64, 0x03, 0x70, 0x3B, 0x90, 0x8A, 0xC5, 0x74, 0x01, 0xF0, 0xA3, 0x74, 0x3D, 0xF0,
+0x79, 0x40, 0x90, 0x8A, 0xC5, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xF5, 0x82, 0x8E, 0x83, 0xE0, 0x59,
+0x60, 0x08, 0xE9, 0xF0, 0xE4, 0x90, 0x8A, 0xF6, 0xF0, 0x22, 0x90, 0x8A, 0xF6, 0xE0, 0x04, 0xF0,
+0xE0, 0xC3, 0x94, 0x0A, 0x40, 0x0B, 0xE4, 0xF0, 0x90, 0x04, 0x19, 0xE0, 0x30, 0xE0, 0x02, 0x11,
+0x6D, 0x22, 0xC0, 0xE0, 0xC0, 0xF0, 0xC0, 0x83, 0xC0, 0x82, 0xC0, 0xD0, 0x75, 0xD0, 0x00, 0xC0,
+0x00, 0xC0, 0x01, 0xC0, 0x02, 0xC0, 0x03, 0xC0, 0x04, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07, 0x90,
+0x01, 0xC4, 0x74, 0xF2, 0xF0, 0x74, 0x60, 0xA3, 0xF0, 0x90, 0x01, 0x34, 0xE0, 0x55, 0x28, 0xF5,
+0x2C, 0xA3, 0xE0, 0x55, 0x29, 0xF5, 0x2D, 0xA3, 0xE0, 0x55, 0x2A, 0xF5, 0x2E, 0xA3, 0xE0, 0x55,
+0x2B, 0xF5, 0x2F, 0xE5, 0x2C, 0x20, 0xE0, 0x02, 0x41, 0x89, 0x90, 0x01, 0x34, 0x74, 0x01, 0xF0,
+0x85, 0xD1, 0x4D, 0x85, 0xD2, 0x4E, 0x85, 0xD3, 0x4F, 0x85, 0xD4, 0x50, 0x85, 0xD5, 0x51, 0x85,
+0xD6, 0x52, 0x85, 0xD7, 0x53, 0x85, 0xD9, 0x54, 0xE5, 0x54, 0x54, 0x40, 0xC3, 0x13, 0xFF, 0xE5,
+0x53, 0x54, 0x20, 0x6F, 0x70, 0x02, 0x41, 0x46, 0xE5, 0x54, 0x30, 0xE5, 0x02, 0x41, 0x46, 0xE5,
+0x52, 0x54, 0x1F, 0xF5, 0x08, 0xE5, 0x4D, 0x54, 0x3F, 0xF5, 0x09, 0xE5, 0x51, 0x54, 0x1F, 0xFF,
+0xE5, 0x08, 0x25, 0xE0, 0x24, 0xE3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0x8F, 0xF0,
+0x12, 0x42, 0x81, 0xE5, 0x53, 0x54, 0x1F, 0xFF, 0xE5, 0x08, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82,
+0xE4, 0x34, 0x85, 0xF5, 0x83, 0xE4, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xE5, 0x09, 0xD3, 0x94, 0x04,
+0x40, 0x03, 0x75, 0x09, 0x04, 0x75, 0xF0, 0x0A, 0xE5, 0x08, 0x90, 0x84, 0x00, 0x12, 0x43, 0x5F,
+0x75, 0xF0, 0x02, 0xE5, 0x09, 0x12, 0x43, 0x5F, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xE5, 0x53, 0x54,
+0x1F, 0x2F, 0xFF, 0xE4, 0x3E, 0xFE, 0x75, 0xF0, 0x0A, 0xE5, 0x08, 0x90, 0x84, 0x00, 0x12, 0x43,
+0x5F, 0x75, 0xF0, 0x02, 0xE5, 0x09, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xE5, 0x54,
+0x20, 0xE6, 0x24, 0xE5, 0x53, 0x54, 0x1F, 0xFF, 0xE5, 0x08, 0x25, 0xE0, 0x24, 0x63, 0xF5, 0x82,
+0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xE5, 0x4F, 0x30, 0xE7, 0x36,
+0xAF, 0x08, 0x12, 0x5C, 0xC3, 0x80, 0x2F, 0xE5, 0x53, 0x54, 0x1F, 0xFF, 0xE5, 0x08, 0x25, 0xE0,
+0x24, 0xA3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xE5,
+0x4F, 0x30, 0xE7, 0x12, 0xE5, 0x4F, 0x54, 0x7F, 0xFD, 0xE5, 0x53, 0x54, 0x1F, 0xF5, 0x0D, 0xAB,
+0x09, 0xAF, 0x08, 0x12, 0x5C, 0x66, 0xE5, 0x24, 0x14, 0x24, 0xFD, 0x50, 0x02, 0x80, 0x3A, 0x90,
+0x8B, 0x1A, 0xE0, 0x60, 0x2B, 0x90, 0x01, 0x5B, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x04, 0xF0,
+0x12, 0x4B, 0x34, 0xEF, 0x64, 0x01, 0x70, 0x21, 0x90, 0x8B, 0x3D, 0x12, 0x4B, 0x5C, 0x90, 0x01,
+0x5B, 0x74, 0x05, 0xF0, 0x90, 0x06, 0x92, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x18, 0xF0, 0x80, 0x09,
+0x12, 0x4B, 0x34, 0xBF, 0x01, 0x03, 0x12, 0x4A, 0xFC, 0xE5, 0x2C, 0x30, 0xE1, 0x21, 0x90, 0x01,
+0x34, 0x74, 0x02, 0xF0, 0x85, 0xD1, 0x56, 0x85, 0xD2, 0x57, 0x85, 0xD3, 0x58, 0x85, 0xD4, 0x59,
+0x85, 0xD5, 0x5A, 0x85, 0xD6, 0x5B, 0x85, 0xD7, 0x5C, 0x85, 0xD9, 0x5D, 0x12, 0x5F, 0xA4, 0xE5,
+0x2C, 0x30, 0xE3, 0x06, 0x90, 0x01, 0x34, 0x74, 0x08, 0xF0, 0xE5, 0x2C, 0x30, 0xE4, 0x09, 0x90,
+0x01, 0x34, 0x74, 0x10, 0xF0, 0x43, 0x55, 0x10, 0xE5, 0x2C, 0x30, 0xE5, 0x26, 0x90, 0x01, 0xCF,
+0xE0, 0x30, 0xE5, 0x1F, 0xE0, 0x54, 0xDF, 0xF0, 0x90, 0x01, 0x34, 0x74, 0x20, 0xF0, 0x75, 0xA8,
+0x00, 0x75, 0xE8, 0x00, 0x12, 0x51, 0x9D, 0x90, 0x00, 0x03, 0xE0, 0x54, 0xFB, 0xF0, 0x12, 0x52,
+0x0E, 0x80, 0xFE, 0xE5, 0x2C, 0x30, 0xE6, 0x2D, 0x90, 0x01, 0x34, 0x74, 0x40, 0xF0, 0x90, 0x8B,
+0x32, 0xE0, 0x30, 0xE0, 0x0C, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x05, 0x90, 0x8B, 0x34, 0xE4,
+0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0xFF, 0x30, 0xE0, 0x0C, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x05,
+0x90, 0x8B, 0x2E, 0xE4, 0xF0, 0xE5, 0x2E, 0x20, 0xE0, 0x02, 0x61, 0xE6, 0x90, 0x8B, 0x08, 0x74,
+0x01, 0xF0, 0x90, 0x01, 0x36, 0xF0, 0x90, 0x8B, 0x06, 0xE0, 0x60, 0x0F, 0xE4, 0xF0, 0x90, 0x05,
+0x53, 0xE0, 0x44, 0x02, 0xF0, 0x90, 0x05, 0xFC, 0xE0, 0x04, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0x30,
+0xE0, 0x2F, 0x90, 0x8B, 0x37, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0xFF, 0x13, 0x13, 0x54,
+0x3F, 0x30, 0xE0, 0x1D, 0x90, 0x8B, 0x34, 0x74, 0x01, 0xF0, 0xB1, 0x39, 0x90, 0x8B, 0x33, 0xE0,
+0x64, 0x03, 0x60, 0x0D, 0x7F, 0x01, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x05, 0x7F, 0x04, 0x12, 0x4E,
+0x89, 0x90, 0x8B, 0x2C, 0xE0, 0xFF, 0x30, 0xE0, 0x55, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x4E,
+0x90, 0x8B, 0x2E, 0x74, 0x01, 0xF0, 0xB1, 0x39, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x3E,
+0xB1, 0x5F, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x2D, 0xE0, 0xFF, 0x64, 0x06, 0x60,
+0x2D, 0xEF, 0xB4, 0x04, 0x02, 0x80, 0x07, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x04, 0xE4, 0xFF,
+0x80, 0x14, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0x80, 0x09, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x02, 0x04, 0x7F, 0x01, 0xB1, 0x82, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x12, 0x43,
+0xE7, 0x90, 0x8B, 0x08, 0xE4, 0xF0, 0xE5, 0x2E, 0x30, 0xE1, 0x2F, 0x90, 0x01, 0x36, 0x74, 0x02,
+0xF0, 0x43, 0x55, 0x40, 0x11, 0x84, 0x90, 0x8B, 0x37, 0xE0, 0xB4, 0x01, 0x09, 0x90, 0x05, 0x22,
+0xE4, 0xF0, 0x90, 0x8B, 0x37, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x0D, 0xE4, 0xFF, 0x12,
+0x4D, 0xE0, 0xEF, 0x60, 0x05, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0xE5, 0x2E, 0x30, 0xE2, 0x16, 0x90,
+0x01, 0x36, 0x74, 0x04, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x06, 0xA3, 0xE0, 0x64, 0x06,
+0x60, 0x03, 0x12, 0x46, 0xB3, 0xE5, 0x2E, 0x30, 0xE3, 0x38, 0x90, 0x01, 0x36, 0x74, 0x08, 0xF0,
+0xE5, 0x21, 0x64, 0x01, 0x70, 0x2C, 0xE5, 0x24, 0x60, 0x28, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90,
+0x01, 0x3C, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x3D, 0xE4, 0xF0, 0x90, 0x8B, 0x11, 0xE0, 0x90, 0x8B,
+0x3E, 0xF0, 0xE4, 0xFB, 0xFD, 0x7F, 0x54, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x57, 0x74,
+0x05, 0xF0, 0xE5, 0x2E, 0x30, 0xE4, 0x2B, 0x90, 0x01, 0x36, 0x74, 0x10, 0xF0, 0xE5, 0x21, 0xB4,
+0x01, 0x20, 0xE5, 0x24, 0x60, 0x1C, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02,
+0xF0, 0x90, 0x8B, 0x1B, 0xE4, 0xF0, 0x53, 0x25, 0xFD, 0xE5, 0x25, 0x54, 0x07, 0x70, 0x03, 0x12,
+0x4A, 0xFC, 0xE5, 0x2E, 0x30, 0xE5, 0x1F, 0x90, 0x01, 0x36, 0x74, 0x20, 0xF0, 0xE5, 0x21, 0xB4,
+0x01, 0x14, 0xE5, 0x24, 0x60, 0x10, 0x90, 0x8B, 0x1A, 0xE0, 0x64, 0x02, 0x60, 0x05, 0x12, 0x4A,
+0x97, 0x80, 0x03, 0x12, 0x49, 0x49, 0xE5, 0x2E, 0x30, 0xE6, 0x1B, 0x90, 0x01, 0x36, 0x74, 0x40,
+0xF0, 0xE5, 0x21, 0xB4, 0x01, 0x10, 0xE5, 0x24, 0x60, 0x0C, 0x53, 0x25, 0xFE, 0xE5, 0x25, 0x54,
+0x07, 0x70, 0x03, 0x12, 0x4A, 0xFC, 0xE5, 0x2F, 0x30, 0xE1, 0x28, 0x90, 0x01, 0x37, 0x74, 0x02,
+0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x18, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x08,
+0x12, 0x48, 0xFE, 0x12, 0x7D, 0xC1, 0x80, 0x0B, 0x90, 0x8B, 0x31, 0x74, 0x01, 0xF0, 0x80, 0x03,
+0x12, 0x48, 0xFE, 0x74, 0xF2, 0x04, 0x90, 0x01, 0xC4, 0xF0, 0x74, 0x60, 0xA3, 0xF0, 0xD0, 0x07,
+0xD0, 0x06, 0xD0, 0x05, 0xD0, 0x04, 0xD0, 0x03, 0xD0, 0x02, 0xD0, 0x01, 0xD0, 0x00, 0xD0, 0xD0,
+0xD0, 0x82, 0xD0, 0x83, 0xD0, 0xF0, 0xD0, 0xE0, 0x32, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x05,
+0x58, 0xE0, 0xFF, 0x90, 0x8B, 0x38, 0xE0, 0x2F, 0x24, 0xFE, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB,
+0xFD, 0x7F, 0x50, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x53, 0x74, 0x05, 0xF0, 0x22, 0x90,
+0x8B, 0x2C, 0xE0, 0xFF, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x30, 0xE0, 0x0A, 0xA3, 0xE0, 0x64, 0x06,
+0x60, 0x04, 0x7F, 0x06, 0xB1, 0x82, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60, 0x03, 0x12, 0x78,
+0x35, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0x6F, 0x70,
+0x02, 0xE1, 0x4E, 0xEF, 0x12, 0x43, 0x94, 0x65, 0xB0, 0x00, 0x65, 0xEA, 0x01, 0x66, 0x30, 0x02,
+0x66, 0x6A, 0x03, 0x66, 0xA2, 0x04, 0x66, 0xDB, 0x05, 0x67, 0x16, 0x06, 0x00, 0x00, 0x67, 0x4E,
+0xEE, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xF1, 0x81, 0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xFF, 0xB4,
+0x05, 0x04, 0xF1, 0x5D, 0xE1, 0x4E, 0xEF, 0xB4, 0x06, 0x06, 0x7F, 0x01, 0xF1, 0x72, 0x80, 0x16,
+0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xF1, 0x53, 0x80, 0x09, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x02, 0x02, 0xF1, 0x67, 0xF1, 0xA4, 0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04,
+0x06, 0x7F, 0x01, 0xF1, 0x81, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D,
+0x90, 0x8B, 0x2D, 0xE0, 0x70, 0x04, 0xF1, 0x9A, 0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4,
+0x06, 0x06, 0x7F, 0x01, 0xF1, 0x72, 0xE1, 0x4E, 0xEE, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xF1, 0x53,
+0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x02, 0x60, 0x02, 0xE1, 0x4E, 0xF1, 0x67, 0xE1, 0x4E,
+0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xF1, 0x81, 0x80, 0x09, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D, 0x90, 0x8B, 0x2D, 0xE0, 0x70, 0x04, 0xF1, 0x9A, 0x80, 0x16,
+0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4, 0x06, 0x06, 0x7F, 0x01, 0xF1, 0x72, 0x80, 0x08, 0xEE, 0xB4,
+0x03, 0x04, 0x7F, 0x01, 0xF1, 0x53, 0xF1, 0xD0, 0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04,
+0x06, 0x7F, 0x01, 0xF1, 0x81, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D,
+0x90, 0x8B, 0x2D, 0xE0, 0x70, 0x04, 0xF1, 0x9A, 0x80, 0x14, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4,
+0x06, 0x06, 0xE4, 0xFF, 0xF1, 0x72, 0x80, 0x06, 0xEE, 0xB4, 0x02, 0x02, 0xF1, 0x67, 0xF1, 0xB9,
+0xE1, 0x4E, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4, 0x06, 0x06, 0xE4, 0xFF, 0xF1, 0x72, 0x80, 0x13,
+0xEE, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xF1, 0x53, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02,
+0x02, 0xF1, 0x67, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x01, 0x04, 0xF1, 0xA4, 0x80, 0x09, 0x90, 0x8B,
+0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D, 0xF1, 0xAF, 0x80, 0x73, 0x90, 0x8B, 0x2D, 0xE0, 0xFE,
+0xB4, 0x06, 0x06, 0xE4, 0xFF, 0xF1, 0x72, 0x80, 0x13, 0xEE, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xF1,
+0x53, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x02, 0xF1, 0x67, 0x90, 0x8B, 0x2D, 0xE0,
+0xB4, 0x01, 0x04, 0xF1, 0xA4, 0x80, 0x0B, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x04, 0x7F, 0x01,
+0xF1, 0x81, 0xF1, 0xC3, 0x80, 0x38, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xF1,
+0x81, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xF1, 0x5D, 0x90, 0x8B, 0x2D, 0xE0,
+0x70, 0x04, 0xF1, 0x9A, 0x80, 0x16, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x06, 0xE4, 0xFF, 0xF1,
+0x53, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x02, 0xF1, 0x67, 0xF1, 0xDD, 0xD0, 0xD0,
+0x92, 0xAF, 0x22, 0x12, 0x4A, 0xB2, 0x90, 0x8B, 0x2D, 0x74, 0x01, 0xF0, 0x22, 0x90, 0x05, 0x22,
+0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0xF0, 0x22, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0x04,
+0xF0, 0x22, 0xEF, 0x60, 0x05, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x01, 0xF0,
+0x22, 0x90, 0x8B, 0x56, 0xEF, 0xF0, 0x12, 0x7D, 0x42, 0x90, 0x8B, 0x56, 0xE0, 0x60, 0x05, 0x90,
+0x05, 0x22, 0xE4, 0xF0, 0xE4, 0x90, 0x8B, 0x2D, 0xF0, 0x22, 0x12, 0x4A, 0xCC, 0x90, 0x8B, 0x2D,
+0x74, 0x01, 0xF0, 0x22, 0x7F, 0x01, 0x12, 0x4A, 0x7C, 0xE4, 0x90, 0x8B, 0x2D, 0xF0, 0x22, 0x12,
+0x7C, 0x4A, 0x90, 0x8B, 0x2D, 0x74, 0x04, 0xF0, 0x22, 0x12, 0x4A, 0x32, 0x90, 0x8B, 0x2D, 0x74,
+0x03, 0xF0, 0x22, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x05, 0xF0, 0x22,
+0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x05, 0x22,
+0x74, 0x6F, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x06, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0,
+0xD0, 0xE4, 0xFD, 0xFC, 0xEF, 0x30, 0xE0, 0x02, 0x7D, 0x80, 0xEF, 0xC3, 0x13, 0x90, 0xFD, 0x10,
+0xF0, 0xAE, 0x04, 0xAF, 0x05, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x75, 0x28, 0x33, 0xE4, 0xF5, 0x29,
+0x75, 0x2A, 0x07, 0xF5, 0x2B, 0x90, 0x01, 0x30, 0xE5, 0x28, 0xF0, 0xA3, 0xE5, 0x29, 0xF0, 0xA3,
+0xE5, 0x2A, 0xF0, 0xA3, 0xE5, 0x2B, 0xF0, 0x22, 0x75, 0x30, 0x1F, 0x75, 0x31, 0x01, 0x43, 0x31,
+0x10, 0xE4, 0xF5, 0x32, 0x90, 0x01, 0x38, 0xE5, 0x30, 0xF0, 0xA3, 0xE5, 0x31, 0xF0, 0xA3, 0xE5,
+0x32, 0xF0, 0x22, 0x22, 0x90, 0x00, 0x02, 0xE0, 0x54, 0xE0, 0x7F, 0x01, 0x60, 0x02, 0x7F, 0x00,
+0x22, 0x90, 0x00, 0xF3, 0xE0, 0x7F, 0x00, 0x30, 0xE3, 0x02, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x09,
+0xE0, 0xB4, 0x01, 0x0C, 0x90, 0x00, 0xF2, 0xE0, 0x30, 0xE7, 0x05, 0x7E, 0xFD, 0x7F, 0x33, 0x22,
+0x7E, 0xFD, 0x7F, 0x2F, 0x22, 0x90, 0x00, 0xF3, 0xE0, 0x30, 0xE2, 0x0D, 0x90, 0x05, 0x41, 0x74,
+0x10, 0xF0, 0x90, 0x05, 0x5A, 0xF0, 0xA3, 0xE4, 0xF0, 0x22, 0x90, 0x01, 0x64, 0x74, 0xA0, 0xF0,
+0x22, 0xC0, 0xE0, 0xC0, 0x83, 0xC0, 0x82, 0xC0, 0xD0, 0x75, 0xD0, 0x00, 0xC0, 0x05, 0xC0, 0x06,
+0xC0, 0x07, 0x7D, 0x91, 0x90, 0x01, 0xC4, 0xED, 0xF0, 0x74, 0x68, 0xFF, 0xA3, 0xF0, 0x53, 0x91,
+0xEF, 0x90, 0x00, 0x51, 0xE0, 0xFE, 0x90, 0x00, 0x55, 0xE0, 0x5E, 0xF5, 0x3D, 0x90, 0x00, 0x52,
+0xE0, 0xFE, 0x90, 0x00, 0x56, 0xE0, 0x5E, 0xF5, 0x3E, 0xE5, 0x3D, 0x30, 0xE4, 0x06, 0x90, 0x00,
+0x55, 0x74, 0x10, 0xF0, 0xE5, 0x3D, 0x30, 0xE5, 0x06, 0x90, 0x00, 0x55, 0x74, 0x20, 0xF0, 0xE5,
+0x3D, 0x30, 0xE6, 0x06, 0x90, 0x00, 0x55, 0x74, 0x40, 0xF0, 0xE5, 0x3D, 0x30, 0xE7, 0x06, 0x90,
+0x00, 0x55, 0x74, 0x80, 0xF0, 0xE5, 0x3E, 0x30, 0xE0, 0x06, 0x90, 0x00, 0x56, 0x74, 0x01, 0xF0,
+0xE5, 0x3E, 0x30, 0xE1, 0x06, 0x90, 0x00, 0x56, 0x74, 0x02, 0xF0, 0xE5, 0x3E, 0x30, 0xE2, 0x06,
+0x90, 0x00, 0x56, 0x74, 0x04, 0xF0, 0xE5, 0x3E, 0x30, 0xE3, 0x06, 0x90, 0x00, 0x56, 0x74, 0x08,
+0xF0, 0x90, 0x01, 0xC4, 0xED, 0xF0, 0xA3, 0xEF, 0xF0, 0xD0, 0x07, 0xD0, 0x06, 0xD0, 0x05, 0xD0,
+0xD0, 0xD0, 0x82, 0xD0, 0x83, 0xD0, 0xE0, 0x32, 0xEF, 0xC3, 0x94, 0x20, 0x50, 0x39, 0xEF, 0x30,
+0xE0, 0x17, 0xED, 0xC4, 0x54, 0xF0, 0xFD, 0xEF, 0xC3, 0x13, 0xFE, 0x24, 0xA4, 0xF5, 0x82, 0xE4,
+0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0x0F, 0x80, 0x10, 0xEF, 0xC3, 0x13, 0xFE, 0x24, 0xA4, 0xF5,
+0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0xF0, 0xF0, 0x74, 0xA4, 0x2E, 0xF5, 0x82, 0xE4,
+0x34, 0x04, 0xF5, 0x83, 0xE0, 0x4D, 0xF0, 0x22, 0xAD, 0x07, 0x74, 0x84, 0x2D, 0xF5, 0x82, 0xE4,
+0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0x7F, 0x90, 0x8A, 0xDE, 0xF0, 0xE0, 0xF9, 0x54, 0x1F, 0xA3,
+0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0, 0xFF, 0x90, 0x8A, 0xE1,
+0xF0, 0xED, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFB, 0xA3,
+0xE0, 0x90, 0x8A, 0xE2, 0xCB, 0xF0, 0xA3, 0xEB, 0xF0, 0xED, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82,
+0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFB, 0xA3, 0xE0, 0x90, 0x8A, 0xE4, 0xCB, 0xF0, 0xA3, 0xEB,
+0xF0, 0x90, 0x8A, 0xDF, 0xE0, 0xFE, 0x25, 0xE0, 0x24, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5,
+0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4,
+0x34, 0x86, 0xF5, 0x83, 0xEA, 0xF0, 0xA3, 0xEB, 0xF0, 0xEE, 0xC3, 0x9F, 0x40, 0x02, 0x41, 0xB9,
+0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF,
+0xF0, 0xEF, 0x04, 0x90, 0x8A, 0xE0, 0xF0, 0x90, 0x8A, 0xE1, 0xE0, 0xFF, 0x90, 0x8A, 0xE0, 0xE0,
+0xFE, 0xD3, 0x9F, 0x40, 0x02, 0x41, 0xF3, 0xEE, 0xC3, 0x94, 0x10, 0x40, 0x21, 0xEE, 0x24, 0xF0,
+0xFF, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8,
+0xF9, 0xFF, 0x90, 0x8A, 0xE2, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x70, 0x27, 0x90, 0x8A,
+0xE0, 0xE0, 0xFF, 0xC3, 0x94, 0x10, 0x50, 0x59, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80,
+0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x8A, 0xE4, 0xE0, 0x5E, 0xFE, 0xA3,
+0xE0, 0x5F, 0x4E, 0x60, 0x3C, 0x90, 0x8A, 0xE0, 0xE0, 0xB4, 0x11, 0x0D, 0x90, 0x8A, 0xE3, 0xE0,
+0x30, 0xE7, 0x06, 0x90, 0x8A, 0xE0, 0x74, 0x17, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xFF, 0x64, 0x13,
+0x60, 0x04, 0xEF, 0xB4, 0x12, 0x0D, 0x90, 0x8A, 0xE2, 0xE0, 0x30, 0xE0, 0x06, 0x90, 0x8A, 0xE0,
+0x74, 0x18, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0x90, 0x8A, 0xDF, 0xF0, 0x90, 0x8A, 0xDE, 0xF0, 0x80,
+0x42, 0x90, 0x8A, 0xE0, 0xE0, 0x04, 0xF0, 0x41, 0x17, 0x90, 0x8A, 0xE1, 0xE0, 0xFC, 0x90, 0x8A,
+0xDF, 0xE0, 0xFF, 0x6C, 0x70, 0x71, 0x74, 0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83,
+0xEF, 0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x29, 0x12, 0x43, 0x5F, 0xE0, 0xB4, 0x01, 0x10,
+0xE9, 0x20, 0xE6, 0x0C, 0x90, 0x8A, 0xDF, 0xE0, 0x44, 0x40, 0x90, 0x8A, 0xDE, 0xF0, 0x80, 0x03,
+0xAF, 0x01, 0x22, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5, 0x82, 0xE4, 0x34,
+0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0, 0x24, 0x2E, 0xF5,
+0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93, 0x3A, 0xC3, 0x13,
+0xFE, 0xEF, 0x13, 0xFF, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83,
+0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x80, 0x66, 0x90, 0x8A, 0xDF, 0xE0, 0xD3, 0x9C, 0x40, 0x5E, 0x90,
+0x8A, 0xE1, 0xE0, 0xFF, 0x74, 0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0,
+0x90, 0x8A, 0xDF, 0xEF, 0xF0, 0x90, 0x8A, 0xDE, 0xF0, 0xFC, 0xA3, 0xE0, 0xFF, 0x25, 0xE0, 0x24,
+0x66, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF,
+0x25, 0xE0, 0x24, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF,
+0xE4, 0x93, 0x3A, 0xC3, 0x13, 0xFE, 0xEF, 0x13, 0xFF, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82,
+0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xAF, 0x04, 0x22, 0x74, 0x01, 0x2D,
+0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE4, 0xF0, 0xAF, 0x05, 0x90, 0x8A, 0xDE, 0xE0, 0x44,
+0x80, 0xFD, 0x12, 0x5C, 0x4E, 0x90, 0x8A, 0xDE, 0xE0, 0x44, 0x80, 0xFF, 0x22, 0xE4, 0x90, 0x8A,
+0xCF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0xC3, 0x94, 0x20, 0x40, 0x03, 0x02, 0x72, 0x54, 0x75,
+0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2A, 0x12, 0x43, 0x5F, 0xE0, 0x64, 0x01, 0x60, 0x03, 0x02, 0x72,
+0x4B, 0x90, 0x8A, 0xCF, 0xE0, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5, 0x83,
+0xE0, 0xFC, 0xA3, 0xE0, 0xD3, 0x94, 0x00, 0xEC, 0x94, 0x00, 0x50, 0x03, 0x02, 0x72, 0x4B, 0xEF,
+0x75, 0xF0, 0x0A, 0xA4, 0x24, 0x00, 0xF9, 0x74, 0x84, 0x35, 0xF0, 0x75, 0x12, 0x01, 0xF5, 0x13,
+0x89, 0x14, 0x90, 0x8A, 0xCF, 0xE0, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5,
+0x83, 0xE0, 0xFD, 0xA3, 0xE0, 0x90, 0x8A, 0xD4, 0xCD, 0xF0, 0xA3, 0xED, 0xF0, 0xEF, 0x25, 0xE0,
+0x24, 0x63, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE0, 0xFF, 0xA3, 0xE0, 0x90, 0x8A, 0xD6,
+0xCF, 0xF0, 0xA3, 0xEF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFE, 0x24, 0x84, 0xF5, 0x82, 0xE4, 0x34,
+0x04, 0xF5, 0x83, 0xE0, 0x54, 0x3F, 0x90, 0x8A, 0xD0, 0xF0, 0xE0, 0xFD, 0x54, 0x1F, 0xA3, 0xF0,
+0x75, 0xF0, 0x09, 0xEE, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD9, 0xF0, 0x90,
+0x8A, 0xCF, 0xE0, 0xFB, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0xC3, 0x94,
+0x05, 0x40, 0x02, 0xC1, 0x9C, 0x90, 0x8A, 0xD9, 0xE0, 0xFE, 0x90, 0x8A, 0xD1, 0xE0, 0x9E, 0x40,
+0x13, 0x90, 0x8A, 0xD9, 0xE0, 0x90, 0x8A, 0xD1, 0xF0, 0xED, 0x54, 0x40, 0xFD, 0x90, 0x8A, 0xD0,
+0xF0, 0xEE, 0x4D, 0xF0, 0x90, 0x8A, 0xD1, 0xE0, 0xFF, 0x90, 0x41, 0x12, 0x93, 0xFE, 0x74, 0x23,
+0x2B, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xC3, 0x9E, 0x40, 0x06, 0xEF, 0x90, 0x40,
+0xDA, 0x80, 0x07, 0x90, 0x8A, 0xD1, 0xE0, 0x90, 0x40, 0xF6, 0x93, 0x90, 0x8A, 0xD8, 0xF0, 0x90,
+0x8A, 0xD8, 0xE0, 0x75, 0xF0, 0x06, 0xA4, 0x24, 0x50, 0xF9, 0x74, 0x40, 0x35, 0xF0, 0x75, 0x0F,
+0xFF, 0xF5, 0x10, 0x89, 0x11, 0x90, 0x8A, 0xD0, 0xE0, 0x90, 0x41, 0xBA, 0x93, 0xFF, 0xD3, 0x90,
+0x8A, 0xD7, 0xE0, 0x9F, 0x90, 0x8A, 0xD6, 0xE0, 0x94, 0x00, 0x40, 0x0D, 0x90, 0x8A, 0xCF, 0xE0,
+0xFF, 0xE4, 0xFD, 0x12, 0x5D, 0x41, 0x02, 0x71, 0xE1, 0x90, 0x8A, 0xCF, 0xE0, 0x25, 0xE0, 0x24,
+0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFF, 0xA3, 0xE0, 0x90, 0x8A, 0xD2, 0xCF,
+0xF0, 0xA3, 0xEF, 0xF0, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x12, 0x24, 0x62, 0xFF, 0x7E, 0x00,
+0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x12, 0x42, 0x97, 0xFD, 0xAC, 0xF0, 0x12, 0x24, 0x7B, 0x90,
+0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00,
+0x01, 0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x02,
+0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0x12, 0x24, 0x7B, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12,
+0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0x7E,
+0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x04, 0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0,
+0x12, 0x24, 0x7B, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10,
+0xA9, 0x11, 0x90, 0x00, 0x03, 0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9,
+0x14, 0x90, 0x00, 0x06, 0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0x12, 0x24, 0x7B, 0x90, 0x8A, 0xD2,
+0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00, 0x04, 0x12,
+0x42, 0x20, 0xFF, 0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x08, 0x12, 0x42,
+0xC2, 0xFD, 0xAC, 0xF0, 0x12, 0x24, 0x7B, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81,
+0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00, 0x05, 0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00, 0x90,
+0x8A, 0xD4, 0xE0, 0xFC, 0xA3, 0xE0, 0xFD, 0x12, 0x24, 0x7B, 0xD3, 0x90, 0x8A, 0xD3, 0xE0, 0x9F,
+0x90, 0x8A, 0xD2, 0xE0, 0x9E, 0x40, 0x0C, 0xA3, 0xE0, 0x9F, 0xF0, 0x90, 0x8A, 0xD2, 0xE0, 0x9E,
+0xF0, 0x80, 0x07, 0xE4, 0x90, 0x8A, 0xD2, 0xF0, 0xA3, 0xF0, 0x90, 0x8A, 0xD2, 0xE0, 0xFC, 0xA3,
+0xE0, 0xFD, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86,
+0xF5, 0x83, 0xEC, 0xF0, 0xA3, 0xED, 0xF0, 0x90, 0x8A, 0xD0, 0xE0, 0x25, 0xE0, 0x24, 0x2E, 0xF5,
+0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xD3, 0xED, 0x9B,
+0xEC, 0x9A, 0x40, 0x05, 0x31, 0x78, 0x02, 0x71, 0xAF, 0x90, 0x8A, 0xD0, 0xE0, 0x25, 0xE0, 0x24,
+0x66, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFE, 0x74, 0x01, 0x93, 0xFF, 0xC3,
+0x90, 0x8A, 0xD3, 0xE0, 0x9F, 0x90, 0x8A, 0xD2, 0xE0, 0x9E, 0x40, 0x03, 0x02, 0x71, 0xAF, 0x90,
+0x8A, 0xCF, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5D, 0x41, 0x02, 0x71, 0xAF, 0x90, 0x8A, 0xCF, 0xE0,
+0xFF, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0xFC, 0x64, 0x05, 0x60, 0x03,
+0x02, 0x70, 0x7D, 0x90, 0x87, 0x22, 0xE0, 0xFE, 0xB4, 0x03, 0x0B, 0x90, 0x8A, 0xD1, 0xE0, 0xC3,
+0x94, 0x19, 0x40, 0x3D, 0x80, 0x2E, 0xEE, 0xB4, 0x02, 0x0B, 0x90, 0x8A, 0xD1, 0xE0, 0xC3, 0x94,
+0x11, 0x40, 0x2E, 0x80, 0x1F, 0x90, 0x87, 0x22, 0xE0, 0xFE, 0xB4, 0x01, 0x0B, 0x90, 0x8A, 0xD1,
+0xE0, 0xC3, 0x94, 0x0A, 0x40, 0x1B, 0x80, 0x0C, 0xEE, 0x70, 0x11, 0x90, 0x8A, 0xD1, 0xE0, 0xC3,
+0x94, 0x03, 0x40, 0x0D, 0x90, 0x89, 0x43, 0x74, 0x01, 0xF0, 0x80, 0x05, 0xE4, 0x90, 0x89, 0x43,
+0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFE, 0x24, 0x43, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE0,
+0x90, 0x8A, 0xDD, 0xF0, 0x74, 0x23, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE,
+0xC3, 0x94, 0x30, 0x50, 0x0B, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x74, 0x64, 0x2F, 0x02, 0x70, 0x28,
+0x90, 0x89, 0x43, 0xE0, 0x64, 0x01, 0x60, 0x03, 0x02, 0x70, 0x1D, 0x90, 0x8A, 0xCF, 0xE0, 0x24,
+0x44, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0x64, 0x0A, 0x60, 0x5B, 0x90, 0x8A, 0xCF,
+0xE0, 0xFF, 0xEE, 0x24, 0x05, 0xFB, 0xE4, 0x33, 0xFA, 0x74, 0x21, 0x2F, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xE0, 0xFF, 0xD3, 0x9B, 0xEA, 0x64, 0x80, 0xF8, 0x74, 0x80, 0x98, 0x50, 0x38,
+0x90, 0x8A, 0xCF, 0xE0, 0xFE, 0xEF, 0x24, 0x05, 0xFB, 0xE4, 0x33, 0xFA, 0x74, 0x23, 0x2E, 0xF5,
+0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xD3, 0x9B, 0xEA, 0x64, 0x80, 0xF8, 0x74, 0x80, 0x98,
+0x50, 0x16, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x84, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0,
+0xFF, 0x90, 0x8A, 0xD1, 0xE0, 0x6F, 0x60, 0x56, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x23, 0xF5, 0x82,
+0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFF, 0xD3, 0x94, 0x42, 0x40, 0x08, 0x90, 0x8A, 0xDD, 0x74,
+0x05, 0xF0, 0x80, 0x11, 0xEF, 0xD3, 0x94, 0x39, 0x90, 0x8A, 0xDD, 0x40, 0x05, 0x74, 0x03, 0xF0,
+0x80, 0x03, 0x74, 0x01, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x23, 0xF5, 0x82, 0xE4, 0x34,
+0x89, 0xF5, 0x83, 0xE0, 0xFE, 0x74, 0x21, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE,
+0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x44, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0x80, 0x2F, 0x90, 0x8A,
+0xCF, 0xE0, 0xFF, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x44,
+0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0x04, 0xF0, 0x80, 0x14, 0xE4, 0x90, 0x8A,
+0xDD, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4,
+0xF0, 0x90, 0x8A, 0xD1, 0xE0, 0xFE, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x84, 0xF5, 0x82, 0xE4,
+0x34, 0x8A, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFE, 0x74, 0x43, 0x2F, 0xF5, 0x82,
+0xE4, 0x34, 0x88, 0xF5, 0x83, 0xEE, 0xF0, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2B, 0x12, 0x43,
+0x5F, 0xE0, 0xB4, 0x01, 0x11, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x74, 0x64, 0x2F, 0xF5, 0x82, 0xE4,
+0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFD, 0x21, 0xAC, 0xEC, 0x64, 0x06,
+0x60, 0x02, 0x21, 0xAF, 0x90, 0x8A, 0xD2, 0xF0, 0xA3, 0xF0, 0x90, 0x41, 0xDB, 0x93, 0xFF, 0x7E,
+0x00, 0x90, 0x8A, 0xD4, 0xE0, 0xFC, 0xA3, 0xE0, 0xFD, 0x12, 0x24, 0x7B, 0x90, 0x8A, 0xDB, 0xEE,
+0xF0, 0xA3, 0xEF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x43, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5,
+0x83, 0xE0, 0x90, 0x8A, 0xDD, 0xF0, 0xE4, 0x90, 0x8A, 0xDA, 0xF0, 0x90, 0x8A, 0xDA, 0xE0, 0xFF,
+0xD3, 0x94, 0x04, 0x50, 0x47, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x75, 0xF0, 0x02, 0xEF, 0xA4,
+0xF5, 0x82, 0x85, 0xF0, 0x83, 0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0xEF, 0x90, 0x41, 0xD6, 0x93,
+0xFF, 0x7E, 0x00, 0x12, 0x24, 0x7B, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0x90,
+0x8A, 0xDB, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xD3, 0x90, 0x8A, 0xD3, 0xE0, 0x9F, 0x90, 0x8A, 0xD2,
+0xE0, 0x9E, 0x50, 0x08, 0x90, 0x8A, 0xDA, 0xE0, 0x04, 0xF0, 0x80, 0xAF, 0x90, 0x8A, 0xDA, 0xE0,
+0xC3, 0x13, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFF, 0xB4, 0x01, 0x0D, 0x90, 0x8A, 0xDA, 0xE0, 0x70,
+0x5D, 0x90, 0x8A, 0xDD, 0x04, 0xF0, 0x80, 0x5B, 0xEF, 0xB4, 0x03, 0x1D, 0x90, 0x8A, 0xDA, 0xE0,
+0xFF, 0x70, 0x08, 0x90, 0x8A, 0xDD, 0x74, 0x03, 0xF0, 0x80, 0x48, 0xEF, 0xB4, 0x01, 0x08, 0x90,
+0x8A, 0xDD, 0x74, 0x01, 0xF0, 0x80, 0x3C, 0x80, 0x35, 0x90, 0x8A, 0xDD, 0xE0, 0x64, 0x05, 0x70,
+0x32, 0x90, 0x8A, 0xDA, 0xE0, 0xFF, 0x70, 0x08, 0x90, 0x8A, 0xDD, 0x74, 0x05, 0xF0, 0x80, 0x0F,
+0xEF, 0x90, 0x8A, 0xDD, 0xB4, 0x01, 0x05, 0x74, 0x03, 0xF0, 0x80, 0x03, 0x74, 0x01, 0xF0, 0xD3,
+0x90, 0x8A, 0xD7, 0xE0, 0x94, 0x03, 0x90, 0x8A, 0xD6, 0xE0, 0x94, 0x00, 0x40, 0x05, 0xE4, 0x90,
+0x8A, 0xDD, 0xF0, 0xD3, 0x90, 0x8A, 0xD7, 0xE0, 0x94, 0x03, 0x90, 0x8A, 0xD6, 0xE0, 0x94, 0x00,
+0x40, 0x05, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFD, 0x90, 0x8A, 0xCF, 0xE0,
+0xFF, 0x24, 0x43, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xED, 0xF0, 0x12, 0x69, 0x38, 0x90,
+0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0xD3, 0x94,
+0x05, 0x50, 0x0F, 0x74, 0x64, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0x04, 0xF0,
+0x80, 0x0F, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4,
+0xF0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0xE4, 0xF5, 0xF0, 0x12, 0x42, 0xFA, 0xAB, 0x12, 0xAA,
+0x13, 0xA9, 0x14, 0x90, 0x00, 0x02, 0xE4, 0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x00, 0x04, 0xE4,
+0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x00, 0x06, 0xE4, 0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x00,
+0x08, 0xE4, 0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0xC0,
+0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0x63,
+0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xA3,
+0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x04,
+0xF0, 0x02, 0x6B, 0xC2, 0x22, 0xE4, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0xC3,
+0x94, 0x10, 0x50, 0x14, 0x74, 0xA4, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE4, 0xF0,
+0x90, 0x8A, 0xCF, 0xE0, 0x04, 0xF0, 0x80, 0xE2, 0xE4, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A, 0xCF,
+0xE0, 0xFF, 0xC3, 0x94, 0x20, 0x40, 0x02, 0x81, 0x0E, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x00,
+0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x02, 0x12, 0x43,
+0x5F, 0xE4, 0xF0, 0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x04, 0x12, 0x43, 0x5F, 0xE4,
+0xF0, 0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x06, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3,
+0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x08, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0xF0, 0x74,
+0x84, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0x74, 0x13, 0xF0, 0x74, 0x44, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x43, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x88,
+0xF5, 0x83, 0xE4, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0x63, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xE3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xA3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xA4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83,
+0xE4, 0xF0, 0xA3, 0xF0, 0x74, 0x44, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0,
+0x74, 0x24, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x64, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x90, 0x41, 0x8C, 0x93, 0xFE, 0x74, 0x01, 0x93,
+0xFF, 0x90, 0x41, 0x54, 0x74, 0x01, 0x93, 0x2F, 0xFF, 0xE4, 0x93, 0x3E, 0xC3, 0x13, 0xFE, 0xEF,
+0x13, 0xFF, 0x90, 0x8A, 0xCF, 0xE0, 0xFD, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86,
+0xF5, 0x83, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x29, 0x12, 0x43,
+0x5F, 0x74, 0x01, 0xF0, 0x74, 0xC1, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0x74, 0x0C,
+0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x25, 0x12, 0x43, 0x5F, 0x74, 0xFF, 0xF0, 0xA3, 0xF0,
+0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x23, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0x74, 0x0F, 0xF0,
+0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0x74, 0x13, 0xF0, 0x75, 0xF0, 0x09,
+0xED, 0x90, 0x87, 0x28, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0x74, 0x84, 0x2D, 0xF5, 0x82, 0xE4, 0x34,
+0x04, 0xF5, 0x83, 0x74, 0x13, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x04, 0xF0, 0x41, 0x7D, 0x22, 0x12,
+0x24, 0x62, 0xFF, 0xC3, 0x94, 0x20, 0x50, 0x14, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFE, 0x74,
+0x23, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xEE, 0xF0, 0x22, 0xEF, 0xB4, 0x20, 0x0A,
+0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0x90, 0x87, 0x21, 0xF0, 0x22, 0x90, 0x8B, 0x4B, 0xEE, 0xF0,
+0xA3, 0xEF, 0xF0, 0xE4, 0xA3, 0xF0, 0xA3, 0xF0, 0x90, 0x8B, 0x4B, 0xE0, 0xFE, 0xA3, 0xE0, 0xF5,
+0x82, 0x8E, 0x83, 0xE0, 0x60, 0x2C, 0xC3, 0x90, 0x8B, 0x4E, 0xE0, 0x94, 0xE8, 0x90, 0x8B, 0x4D,
+0xE0, 0x94, 0x03, 0x40, 0x0A, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x10, 0xF0, 0x7F, 0x00, 0x22, 0x90,
+0x8B, 0x4D, 0xE4, 0x75, 0xF0, 0x01, 0x12, 0x42, 0x81, 0x7F, 0x0A, 0x7E, 0x00, 0x12, 0x32, 0x15,
+0x80, 0xC6, 0x7F, 0x01, 0x22, 0x12, 0x24, 0x62, 0xF5, 0x21, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3,
+0xC0, 0xD0, 0x90, 0x8A, 0xDA, 0x12, 0x25, 0x14, 0x00, 0x00, 0x00, 0x00, 0x90, 0x00, 0x01, 0x12,
+0x42, 0x20, 0x90, 0x8B, 0x1A, 0xF0, 0x90, 0x00, 0x03, 0x12, 0x42, 0x20, 0x90, 0x8B, 0x0A, 0xF0,
+0x12, 0x47, 0xFA, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0x30,
+0xE0, 0x25, 0x12, 0x24, 0x62, 0x90, 0x8B, 0x10, 0xF0, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0x90,
+0x8B, 0x11, 0xF0, 0xEF, 0xC3, 0x13, 0x54, 0x7F, 0x90, 0x8B, 0x0F, 0xF0, 0x90, 0x00, 0x03, 0x12,
+0x42, 0x20, 0x90, 0x8B, 0x16, 0xF0, 0x22, 0x90, 0x8B, 0x10, 0x74, 0x03, 0xF0, 0x90, 0x8B, 0x11,
+0x74, 0x05, 0xF0, 0x90, 0x8B, 0x0F, 0x74, 0x14, 0xF0, 0x90, 0x8B, 0x16, 0x74, 0x05, 0xF0, 0x22,
+0x12, 0x24, 0x62, 0x30, 0xE0, 0x19, 0xC3, 0x13, 0x54, 0x7F, 0x90, 0x8B, 0x15, 0xF0, 0x90, 0x00,
+0x01, 0x12, 0x42, 0x20, 0xFF, 0x90, 0x8B, 0x13, 0xE4, 0xF0, 0xA3, 0xEF, 0xF0, 0x80, 0x0F, 0x90,
+0x8B, 0x15, 0x74, 0x05, 0xF0, 0x90, 0x8B, 0x13, 0xE4, 0xF0, 0xA3, 0x74, 0x03, 0xF0, 0x90, 0x8B,
+0x13, 0xE0, 0xA3, 0xE0, 0x90, 0x05, 0x58, 0xF0, 0x22, 0x12, 0x24, 0x62, 0x90, 0x8B, 0x12, 0xF0,
+0x60, 0x07, 0xE4, 0xFD, 0x7F, 0x04, 0x12, 0x45, 0xA2, 0x90, 0x8B, 0x12, 0xE0, 0x90, 0x01, 0xE7,
+0xF0, 0x22, 0x90, 0x02, 0x09, 0xE0, 0xFD, 0x12, 0x24, 0x62, 0xFE, 0xAF, 0x05, 0xED, 0x2E, 0x90,
+0x8A, 0xF7, 0xF0, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0xFF, 0xED, 0x2F, 0x90, 0x8A, 0xF8, 0xF0,
+0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0xED, 0x2F, 0x90, 0x8A, 0xF9, 0xF0, 0x90, 0x00, 0x03,
+0x12, 0x42, 0x20, 0xFF, 0xED, 0x2F, 0x90, 0x8A, 0xFA, 0xF0, 0x90, 0x00, 0x04, 0x12, 0x42, 0x20,
+0xFF, 0xAE, 0x05, 0xED, 0x2F, 0x90, 0x8A, 0xFB, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0,
+0xD0, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x8B, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x12, 0x24, 0x62, 0xC3,
+0x13, 0x20, 0xE0, 0x02, 0xC1, 0xED, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x12, 0x24, 0x62, 0xFF,
+0x54, 0x02, 0xFE, 0x90, 0x8B, 0x32, 0xE0, 0x54, 0xFD, 0x4E, 0xFE, 0xF0, 0xEF, 0x54, 0x01, 0xFF,
+0xEE, 0x54, 0xFE, 0x4F, 0xFF, 0xF0, 0x12, 0x24, 0x62, 0xFE, 0x54, 0x08, 0xFD, 0xEF, 0x54, 0xF7,
+0x4D, 0xFF, 0x90, 0x8B, 0x32, 0xF0, 0xEE, 0x54, 0x10, 0xFE, 0xEF, 0x54, 0xEF, 0x4E, 0xFF, 0xF0,
+0x12, 0x24, 0x62, 0xFE, 0x54, 0x20, 0xFD, 0xEF, 0x54, 0xDF, 0x4D, 0xFF, 0x90, 0x8B, 0x32, 0xF0,
+0xEE, 0x54, 0x40, 0xFE, 0xEF, 0x54, 0xBF, 0x4E, 0xF0, 0x20, 0xE0, 0x02, 0xC1, 0xD9, 0x90, 0x8A,
+0xDD, 0x74, 0x21, 0xF0, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x12, 0x24, 0x62, 0xFF, 0x13, 0x13,
+0x54, 0x01, 0xFE, 0x90, 0x8B, 0x32, 0xE0, 0xFD, 0x13, 0x13, 0x54, 0x01, 0x6E, 0x60, 0x2A, 0xEF,
+0x54, 0x04, 0xFF, 0xED, 0x54, 0xFB, 0x4F, 0xF0, 0xE0, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x0E,
+0x90, 0x01, 0x34, 0x74, 0x40, 0xF0, 0xFD, 0xE4, 0xFF, 0x12, 0x31, 0x9D, 0x80, 0x0B, 0xE4, 0x90,
+0x8B, 0x34, 0xF0, 0x7D, 0x40, 0xFF, 0x12, 0x31, 0x2C, 0x90, 0x8B, 0x32, 0xE0, 0xFD, 0x13, 0x13,
+0x13, 0x54, 0x1F, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x12, 0xF0, 0xED, 0xC4, 0x54,
+0x0F, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x14, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0xC4,
+0x13, 0x54, 0x07, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x80, 0xF0, 0x90, 0x8B, 0x32,
+0xE0, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x20, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x40, 0xF0,
+0x90, 0x8A, 0xDD, 0xE0, 0x90, 0x05, 0x27, 0xF0, 0x90, 0x8B, 0x33, 0xE0, 0x70, 0x05, 0x7F, 0x01,
+0x12, 0x4E, 0x89, 0x90, 0x8B, 0x32, 0xE0, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x30, 0xE0, 0x04, 0x7F,
+0x03, 0x80, 0x0E, 0x7F, 0x01, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x04, 0x7F, 0x01, 0x80, 0x02, 0x7F,
+0x02, 0x12, 0x4E, 0x89, 0x7F, 0x02, 0x02, 0x78, 0x2E, 0x90, 0x8A, 0xDD, 0x74, 0x01, 0xF0, 0x90,
+0x05, 0x27, 0xF0, 0xE4, 0xFF, 0x12, 0x4E, 0x89, 0x7F, 0x03, 0x02, 0x78, 0x2E, 0x90, 0x8A, 0xDA,
+0x12, 0x43, 0x6B, 0x12, 0x24, 0x62, 0xFF, 0x54, 0x02, 0xFE, 0x90, 0x8B, 0x2C, 0xE0, 0x54, 0xFD,
+0x4E, 0xFE, 0xF0, 0xEF, 0x54, 0x01, 0xFF, 0xEE, 0x54, 0xFE, 0x4F, 0xFF, 0xF0, 0x12, 0x24, 0x62,
+0xFE, 0x54, 0x08, 0xFD, 0xEF, 0x54, 0xF7, 0x4D, 0xFF, 0x90, 0x8B, 0x2C, 0xF0, 0xEE, 0x54, 0x10,
+0xFE, 0xEF, 0x54, 0xEF, 0x4E, 0xFF, 0xF0, 0x12, 0x24, 0x62, 0xFE, 0x54, 0x40, 0xFD, 0xEF, 0x54,
+0xBF, 0x4D, 0xFF, 0x90, 0x8B, 0x2C, 0xF0, 0xEE, 0x54, 0x04, 0xFE, 0xEF, 0x54, 0xFB, 0x4E, 0xF0,
+0x20, 0xE0, 0x02, 0xE1, 0xE2, 0x90, 0x8A, 0xDD, 0x74, 0x31, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x13,
+0x13, 0x54, 0x3F, 0x20, 0xE0, 0x0B, 0xE4, 0x90, 0x8B, 0x2E, 0xF0, 0x7D, 0x40, 0xFF, 0x12, 0x31,
+0x2C, 0x90, 0x8B, 0x2C, 0xE0, 0xFD, 0x13, 0x13, 0x13, 0x54, 0x1F, 0x30, 0xE0, 0x07, 0x90, 0x8A,
+0xDD, 0xE0, 0x44, 0x02, 0xF0, 0xED, 0xC4, 0x54, 0x0F, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0,
+0x44, 0x04, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0x54, 0x06, 0x60, 0x0C, 0x90, 0x01, 0x3E, 0x74, 0x03,
+0xF0, 0xFD, 0x7F, 0x02, 0x12, 0x31, 0xB7, 0x90, 0x8A, 0xDD, 0xE0, 0x90, 0x05, 0x27, 0xF0, 0x90,
+0x8B, 0x2C, 0xE0, 0xFF, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x30, 0xE0, 0x0D, 0xA3, 0xE0, 0x64, 0x06,
+0x60, 0x2C, 0x7F, 0x06, 0x12, 0x65, 0x82, 0x80, 0x25, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x06, 0x1B,
+0x7F, 0x01, 0x12, 0x65, 0x82, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x09, 0x7D, 0x01, 0xAF,
+0x23, 0x12, 0x45, 0xA2, 0x80, 0x05, 0x12, 0x4E, 0x56, 0x80, 0x03, 0x12, 0x7D, 0xC1, 0x7F, 0x01,
+0x80, 0x4C, 0x90, 0x8A, 0xDD, 0x74, 0x01, 0xF0, 0x90, 0x05, 0x27, 0xF0, 0x7D, 0x03, 0x7F, 0x02,
+0x12, 0x31, 0x49, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x06, 0x02, 0x80, 0x1B, 0x90, 0x8B, 0x2D, 0xE0,
+0xB4, 0x04, 0x02, 0x80, 0x07, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x04, 0xE4, 0xFF, 0x80, 0x14,
+0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4,
+0x02, 0x05, 0x7F, 0x01, 0x12, 0x65, 0x82, 0x11, 0x35, 0x12, 0x4A, 0xFC, 0x7F, 0x03, 0x11, 0x42,
+0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x8B, 0x31, 0xE0, 0xB4, 0x01, 0x05, 0xE4, 0xF0, 0x12, 0x48,
+0xFE, 0x22, 0xAD, 0x07, 0xEF, 0x64, 0x01, 0x60, 0x04, 0xEF, 0xB4, 0x03, 0x15, 0x90, 0x8B, 0x32,
+0xE0, 0x54, 0xFE, 0xF0, 0x54, 0xFB, 0xF0, 0xE4, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0,
+0xA3, 0xF0, 0xED, 0x64, 0x02, 0x60, 0x04, 0xED, 0xB4, 0x03, 0x15, 0x90, 0x8B, 0x2C, 0xE0, 0x54,
+0xFE, 0xF0, 0x54, 0xFB, 0xF0, 0xE4, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0,
+0x22, 0x12, 0x24, 0x62, 0x90, 0x8B, 0x38, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0,
+0x90, 0x8A, 0xFD, 0xE0, 0x90, 0x8A, 0xE8, 0xF0, 0x90, 0x8A, 0xFE, 0xE0, 0xFF, 0xA3, 0xE0, 0x90,
+0x8A, 0xE9, 0xCF, 0xF0, 0xA3, 0xEF, 0xF0, 0xE4, 0x90, 0x8A, 0xE4, 0xF0, 0x90, 0x8A, 0xE4, 0xE0,
+0xFF, 0x24, 0x00, 0xF5, 0x82, 0xE4, 0x34, 0x8B, 0xF5, 0x83, 0xE0, 0xFE, 0x74, 0xEB, 0x2F, 0xF5,
+0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xE4, 0xE0, 0x04, 0xF0, 0xE0, 0xB4,
+0x04, 0xDA, 0x90, 0x8A, 0xE8, 0xE0, 0x12, 0x43, 0x94, 0x78, 0xF8, 0x00, 0x7A, 0x6B, 0x01, 0x79,
+0x01, 0x02, 0x79, 0x01, 0x03, 0x79, 0x01, 0x04, 0x7A, 0x6B, 0x05, 0x7A, 0x35, 0x80, 0x7A, 0x4E,
+0x81, 0x7A, 0x6B, 0x82, 0x00, 0x00, 0x7A, 0x67, 0x90, 0x8A, 0xEE, 0xE0, 0xFF, 0x51, 0x72, 0x41,
+0x6B, 0x90, 0x8A, 0xE8, 0xE0, 0xFF, 0xB4, 0x02, 0x08, 0x90, 0x8A, 0xE5, 0x74, 0x01, 0xF0, 0x80,
+0x0F, 0xEF, 0x90, 0x8A, 0xE5, 0xB4, 0x03, 0x05, 0x74, 0x02, 0xF0, 0x80, 0x03, 0x74, 0x04, 0xF0,
+0xC3, 0x90, 0x8A, 0xE9, 0xE0, 0x94, 0x08, 0x50, 0x78, 0xE4, 0x90, 0x8A, 0xE4, 0xF0, 0x90, 0x8A,
+0xE5, 0xE0, 0xFF, 0x90, 0x8A, 0xE4, 0xE0, 0xC3, 0x9F, 0x40, 0x02, 0x41, 0x6B, 0x90, 0x8A, 0xE9,
+0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xC3, 0xEE, 0x94, 0x01, 0x90, 0x8A, 0xE4, 0xE0, 0x50, 0x1F, 0xFE,
+0x2F, 0xFF, 0xEE, 0xFD, 0xC3, 0x74, 0x03, 0x9D, 0xFD, 0xE4, 0x94, 0x00, 0xFC, 0x74, 0xEB, 0x2D,
+0xF5, 0x82, 0x74, 0x8A, 0x3C, 0xF5, 0x83, 0xE0, 0xFD, 0x12, 0x51, 0x88, 0x80, 0x2B, 0xFF, 0xFD,
+0xC3, 0x74, 0x03, 0x9D, 0xFD, 0xE4, 0x94, 0x00, 0xFC, 0x74, 0xEB, 0x2D, 0xF5, 0x82, 0x74, 0x8A,
+0x3C, 0xF5, 0x83, 0xE0, 0xFE, 0xEF, 0xFD, 0x90, 0x8A, 0xEA, 0xE0, 0x2D, 0xFD, 0x90, 0x8A, 0xE9,
+0xE0, 0x34, 0x00, 0x8D, 0x82, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xE4, 0xE0, 0x04, 0xF0, 0x80,
+0x8D, 0xC3, 0x90, 0x8A, 0xE9, 0xE0, 0x94, 0x10, 0x40, 0x02, 0x41, 0x6B, 0x90, 0x8A, 0xE8, 0xE0,
+0x64, 0x04, 0x60, 0x02, 0x41, 0x6B, 0x90, 0x8A, 0xEC, 0xE0, 0xFF, 0xE4, 0xFC, 0xFD, 0xFE, 0x78,
+0x10, 0x12, 0x24, 0xF5, 0xC0, 0x04, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07, 0x90, 0x8A, 0xEB, 0xE0,
+0xFF, 0xE4, 0xFC, 0xFD, 0xFE, 0x78, 0x18, 0x12, 0x24, 0xF5, 0xD0, 0x03, 0xD0, 0x02, 0xD0, 0x01,
+0xD0, 0x00, 0x12, 0x43, 0x46, 0xC0, 0x04, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07, 0x90, 0x8A, 0xED,
+0xE0, 0xFF, 0xE4, 0xFC, 0xFD, 0xFE, 0x78, 0x08, 0x12, 0x24, 0xF5, 0xD0, 0x03, 0xD0, 0x02, 0xD0,
+0x01, 0xD0, 0x00, 0x12, 0x43, 0x46, 0xA8, 0x04, 0xA9, 0x05, 0xAA, 0x06, 0xAB, 0x07, 0xA3, 0xE0,
+0xFF, 0xE4, 0xFC, 0xFD, 0xFE, 0x12, 0x43, 0x46, 0xA3, 0x12, 0x25, 0x08, 0x90, 0x8A, 0xEF, 0x12,
+0x43, 0x53, 0x90, 0x80, 0x96, 0x12, 0x25, 0x08, 0x90, 0x8A, 0xE9, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF,
+0x12, 0x2B, 0x08, 0x80, 0x36, 0x90, 0x8A, 0xED, 0xE0, 0xFE, 0xA3, 0xE0, 0x24, 0x00, 0xFF, 0xE4,
+0x3E, 0xFE, 0x90, 0x8A, 0xE6, 0xF0, 0xA3, 0xEF, 0xF0, 0x12, 0x32, 0x15, 0x80, 0x1D, 0x90, 0x8A,
+0xED, 0xE0, 0xFE, 0xA3, 0xE0, 0x24, 0x00, 0xFF, 0xE4, 0x3E, 0xFE, 0x90, 0x8A, 0xE6, 0xF0, 0xA3,
+0xEF, 0xF0, 0x12, 0x31, 0x82, 0x80, 0x04, 0x7F, 0x00, 0x80, 0x02, 0x7F, 0x01, 0xD0, 0xD0, 0x92,
+0xAF, 0x22, 0x8F, 0x0F, 0xE4, 0x90, 0x8A, 0xF3, 0xF0, 0xE5, 0x0F, 0x14, 0xFE, 0x90, 0x8A, 0xF3,
+0xE0, 0xFF, 0xC3, 0x9E, 0x50, 0x0E, 0xEF, 0x04, 0xFD, 0x12, 0x2D, 0x4D, 0x90, 0x8A, 0xF3, 0xE0,
+0x04, 0xF0, 0x80, 0xE5, 0xE5, 0x0F, 0x14, 0xFF, 0x7D, 0xFF, 0x12, 0x2D, 0x4D, 0x90, 0x8A, 0xF3,
+0xE5, 0x0F, 0xF0, 0x90, 0x8A, 0xF3, 0xE0, 0xC3, 0x94, 0xFF, 0x50, 0x0F, 0xE0, 0xFF, 0x04, 0xFD,
+0x12, 0x2D, 0x4D, 0x90, 0x8A, 0xF3, 0xE0, 0x04, 0xF0, 0x80, 0xE8, 0xAD, 0x0F, 0x7F, 0xFF, 0x02,
+0x2D, 0x4D, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0xA3, 0x74,
+0x04, 0xF0, 0xA3, 0xE4, 0xF0, 0x90, 0x8A, 0xE2, 0xF0, 0xA3, 0xF0, 0x90, 0x02, 0x09, 0xE0, 0x90,
+0x8A, 0xE1, 0xF0, 0x12, 0x24, 0x62, 0xFF, 0x90, 0x8A, 0xE1, 0xE0, 0x2F, 0x90, 0x8A, 0xE0, 0xF0,
+0x30, 0xE0, 0x0B, 0x90, 0x8A, 0xDB, 0xE4, 0xF0, 0xA3, 0x74, 0x80, 0xF0, 0x80, 0x07, 0xE4, 0x90,
+0x8A, 0xDB, 0xF0, 0xA3, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xC3, 0x13, 0x90, 0xFD, 0x10, 0xF0, 0x90,
+0x8A, 0xDD, 0xE0, 0x24, 0x20, 0xF0, 0x90, 0x8A, 0xDB, 0xA3, 0xE0, 0xFD, 0xA3, 0xE0, 0xFC, 0x2D,
+0xFF, 0x24, 0x01, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x90, 0x8A, 0xFD, 0xF0, 0x74,
+0x02, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0xFE, 0xEC, 0x2D, 0x24, 0x03, 0xF5,
+0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x24, 0x00, 0xFF, 0xE4, 0x3E, 0x90, 0x8A, 0xFE, 0xF0,
+0xA3, 0xEF, 0xF0, 0x90, 0x8A, 0xDA, 0x74, 0x04, 0xF0, 0x90, 0x8A, 0xDB, 0xA3, 0xE0, 0xFF, 0xA3,
+0xE0, 0x2F, 0xFF, 0x90, 0x8A, 0xDA, 0xE0, 0xFE, 0x2F, 0x24, 0x00, 0xF5, 0x82, 0xE4, 0x34, 0xFC,
+0xF5, 0x83, 0xE0, 0xFF, 0x74, 0xFC, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0,
+0x90, 0x8A, 0xDA, 0xE0, 0x04, 0xF0, 0xE0, 0xB4, 0x08, 0xCF, 0x11, 0x89, 0xEF, 0x70, 0x45, 0x90,
+0x01, 0xC3, 0xE0, 0x60, 0x2B, 0xC3, 0x90, 0x8A, 0xE3, 0xE0, 0x94, 0xE8, 0x90, 0x8A, 0xE2, 0xE0,
+0x94, 0x03, 0x40, 0x09, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x10, 0xF0, 0x80, 0x79, 0x90, 0x8A, 0xE2,
+0xE4, 0x75, 0xF0, 0x01, 0x12, 0x42, 0x81, 0x7F, 0x0A, 0x7E, 0x00, 0x12, 0x32, 0x15, 0x80, 0xCF,
+0x90, 0x01, 0xC6, 0xE0, 0x90, 0x01, 0xC3, 0x30, 0xE2, 0x05, 0x74, 0xFE, 0xF0, 0x80, 0x57, 0x74,
+0xFF, 0xF0, 0x80, 0x52, 0x90, 0x8A, 0xDD, 0xE0, 0xB4, 0x78, 0x2E, 0xE4, 0xF0, 0x90, 0x8A, 0xE0,
+0xE0, 0x04, 0xF0, 0x90, 0x8A, 0xDB, 0xE0, 0x70, 0x04, 0xA3, 0xE0, 0x64, 0x80, 0x90, 0x8A, 0xDB,
+0x70, 0x05, 0xF0, 0xA3, 0xF0, 0x80, 0x06, 0xE4, 0xF0, 0xA3, 0x74, 0x80, 0xF0, 0x90, 0x8A, 0xE0,
+0xE0, 0xC3, 0x13, 0x90, 0xFD, 0x10, 0xF0, 0x80, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x24, 0x08, 0xF0,
+0x90, 0x8A, 0xDE, 0x74, 0xFF, 0xF5, 0xF0, 0x12, 0x42, 0x81, 0x90, 0x8A, 0xDE, 0xE0, 0x70, 0x02,
+0xA3, 0xE0, 0x60, 0x02, 0x61, 0x16, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x12, 0x24, 0x62, 0x90, 0x8B,
+0x05, 0xF0, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0x90, 0x8B, 0x06, 0xF0, 0x22, 0xE4, 0xF5, 0x61,
+0x22, 0x91, 0x4A, 0x90, 0x8B, 0x33, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0,
+0x7F, 0x78, 0x7E, 0x08, 0x12, 0x22, 0x65, 0x90, 0x8B, 0x1C, 0x12, 0x25, 0x08, 0x7F, 0x04, 0x7E,
+0x0C, 0x12, 0x22, 0x65, 0x90, 0x8B, 0x20, 0x12, 0x25, 0x08, 0x7F, 0x00, 0x7E, 0x08, 0x12, 0x22,
+0x65, 0x90, 0x8B, 0x24, 0x12, 0x25, 0x08, 0x90, 0x8B, 0x09, 0xE0, 0x90, 0x8B, 0x1C, 0xB4, 0x01,
+0x0D, 0x12, 0x43, 0x53, 0xEF, 0x54, 0xC7, 0xFF, 0xED, 0x54, 0xC7, 0xFD, 0x80, 0x07, 0x12, 0x43,
+0x53, 0xEF, 0x54, 0xC7, 0xFF, 0xEC, 0x90, 0x80, 0x96, 0x12, 0x25, 0x08, 0x7F, 0x78, 0x7E, 0x08,
+0x12, 0x2B, 0x08, 0x90, 0x8B, 0x20, 0x12, 0x43, 0x53, 0xEF, 0x54, 0x0F, 0xFF, 0xEC, 0x90, 0x80,
+0x96, 0x12, 0x25, 0x08, 0x7F, 0x04, 0x7E, 0x0C, 0x12, 0x2B, 0x08, 0x90, 0x8B, 0x24, 0x12, 0x43,
+0x53, 0xEF, 0x44, 0x02, 0xFF, 0xEC, 0x90, 0x80, 0x96, 0x12, 0x25, 0x08, 0x7F, 0x00, 0x7E, 0x08,
+0x12, 0x2B, 0x08, 0x7F, 0x70, 0x7E, 0x0E, 0x12, 0x22, 0x65, 0x90, 0x8B, 0x28, 0x12, 0x25, 0x08,
+0x90, 0x80, 0x96, 0x12, 0x25, 0x14, 0x00, 0x1B, 0x25, 0xA0, 0x7F, 0x70, 0x7E, 0x0E, 0x12, 0x2B,
+0x08, 0x90, 0x80, 0x68, 0x12, 0x25, 0x14, 0x00, 0x00, 0x00, 0x00, 0xE4, 0xFD, 0xFF, 0x12, 0x30,
+0x2C, 0x90, 0x8B, 0x09, 0xE0, 0xB4, 0x01, 0x11, 0x90, 0x80, 0x68, 0x12, 0x25, 0x14, 0x00, 0x00,
+0x00, 0x00, 0xE4, 0xFD, 0x7F, 0x01, 0x12, 0x30, 0x2C, 0x90, 0x00, 0x11, 0xE0, 0x54, 0xF6, 0xF0,
+0x02, 0x52, 0x0E, 0x91, 0x50, 0x90, 0x8B, 0x33, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x05, 0x22, 0x74,
+0xFF, 0xF0, 0x90, 0x8B, 0x33, 0x74, 0x04, 0xF0, 0x22, 0xB1, 0x42, 0x90, 0x8B, 0x33, 0x74, 0x04,
+0xF0, 0x22, 0x90, 0x00, 0x11, 0xE0, 0x44, 0x09, 0xF0, 0x12, 0x52, 0x0E, 0x90, 0x8B, 0x1C, 0x12,
+0x43, 0x53, 0x90, 0x80, 0x96, 0x12, 0x25, 0x08, 0x7F, 0x78, 0x7E, 0x08, 0x12, 0x2B, 0x08, 0x90,
+0x8B, 0x20, 0x12, 0x43, 0x53, 0x90, 0x80, 0x96, 0x12, 0x25, 0x08, 0x7F, 0x04, 0x7E, 0x0C, 0x12,
+0x2B, 0x08, 0x90, 0x8B, 0x24, 0x12, 0x43, 0x53, 0x90, 0x80, 0x96, 0x12, 0x25, 0x08, 0x7F, 0x00,
+0x7E, 0x08, 0x12, 0x2B, 0x08, 0x90, 0x8B, 0x28, 0x12, 0x43, 0x53, 0x90, 0x80, 0x96, 0x12, 0x25,
+0x08, 0x7F, 0x70, 0x7E, 0x0E, 0x12, 0x2B, 0x08, 0x90, 0x80, 0x68, 0x12, 0x25, 0x14, 0x00, 0x03,
+0x2D, 0x95, 0xE4, 0xFD, 0xFF, 0x12, 0x30, 0x2C, 0x90, 0x8B, 0x09, 0xE0, 0xB4, 0x01, 0x11, 0x90,
+0x80, 0x68, 0x12, 0x25, 0x14, 0x00, 0x03, 0x2D, 0x95, 0xE4, 0xFD, 0x7F, 0x01, 0x12, 0x30, 0x2C,
+0x22, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60, 0x3C, 0xE5, 0x22, 0x54, 0x0F, 0x14, 0x60, 0x2E,
+0x14, 0x60, 0x1E, 0x24, 0xFE, 0x60, 0x0E, 0x24, 0xF8, 0x70, 0x2A, 0xE4, 0x90, 0x8B, 0x2D, 0xF0,
+0x90, 0x05, 0x22, 0xF0, 0x22, 0x90, 0x8B, 0x2D, 0x74, 0x01, 0xF0, 0x90, 0x05, 0x22, 0xE4, 0xF0,
+0x22, 0x90, 0x8B, 0x2D, 0x74, 0x03, 0xF0, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x22, 0x90, 0x01,
+0xC6, 0xE0, 0x44, 0x08, 0xF0, 0x22, 0xAE, 0x07, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x18,
+0x90, 0x8B, 0x2C, 0xE0, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x20, 0xE0, 0x0C, 0xAF, 0x06, 0x7D, 0x01,
+0x12, 0x45, 0xA2, 0xB1, 0xC1, 0x7F, 0x01, 0x22, 0x7F, 0x00, 0x22, 0x90, 0x01, 0x57, 0xE0, 0x60,
+0x3C, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x1B, 0xE0,
+0x60, 0x07, 0xE4, 0xF0, 0x53, 0x25, 0xFD, 0x80, 0x24, 0x90, 0x8B, 0x0C, 0xE0, 0x04, 0xF0, 0x53,
+0x25, 0xEF, 0x90, 0x8B, 0x10, 0xE0, 0xFF, 0x90, 0x8B, 0x0C, 0xE0, 0xD3, 0x9F, 0x40, 0x0E, 0xE5,
+0x21, 0xB4, 0x01, 0x09, 0x90, 0x8B, 0x0D, 0xE0, 0x70, 0x03, 0xE0, 0x04, 0xF0, 0x90, 0x01, 0x5B,
+0xE0, 0x60, 0x10, 0x90, 0x01, 0x5B, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x04, 0xF0, 0xE4, 0x90,
+0x8B, 0x18, 0xF0, 0x90, 0x01, 0x5F, 0xE0, 0x60, 0x10, 0x90, 0x01, 0x5F, 0xE4, 0xF0, 0x90, 0x01,
+0x3C, 0x74, 0x08, 0xF0, 0xE4, 0x90, 0x8B, 0x17, 0xF0, 0x22, 0xE4, 0x90, 0x8B, 0x4F, 0xF0, 0xA3,
+0xF0, 0x90, 0x05, 0xF8, 0xE0, 0x70, 0x0F, 0xA3, 0xE0, 0x70, 0x0B, 0xA3, 0xE0, 0x70, 0x07, 0xA3,
+0xE0, 0x70, 0x03, 0x7F, 0x01, 0x22, 0xD3, 0x90, 0x8B, 0x50, 0xE0, 0x94, 0xE8, 0x90, 0x8B, 0x4F,
+0xE0, 0x94, 0x03, 0x40, 0x03, 0x7F, 0x00, 0x22, 0x7F, 0x32, 0x7E, 0x00, 0x12, 0x32, 0x15, 0x90,
+0x8B, 0x4F, 0xE4, 0x75, 0xF0, 0x01, 0x12, 0x42, 0x81, 0x80, 0xC6, 0x00, 0xFB, 0x98};
+
+// =================== v88 UMC B Cut P2PPS with CCX report C2H 2012-12-05 =====================
+u8 Rtl8192CUFwUMCBCutImgArray[UMCBCutImgArrayLength] = {
+0xC2, 0x88, 0x02, 0x05, 0x58, 0x00, 0x02, 0x00, 0x12, 0x05, 0x17, 0x10, 0xC0, 0x3E, 0x01, 0x00,
+0x94, 0x18, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x02, 0x46, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x02, 0x60, 0xF3, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x02, 0x67, 0x5B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x4B, 0x87, 0x00, 0x00,
+0x05, 0x04, 0x03, 0x02, 0x00, 0x03, 0x06, 0x05, 0x04, 0x03, 0x00, 0x04, 0x06, 0x05, 0x04, 0x02,
+0x00, 0x04, 0x08, 0x07, 0x06, 0x04, 0x00, 0x06, 0x0A, 0x09, 0x08, 0x06, 0x00, 0x08, 0x0A, 0x09,
+0x08, 0x04, 0x00, 0x08, 0x0A, 0x09, 0x08, 0x02, 0x00, 0x08, 0x0A, 0x09, 0x08, 0x00, 0x00, 0x08,
+0x12, 0x11, 0x10, 0x08, 0x00, 0x10, 0x1A, 0x19, 0x18, 0x10, 0x00, 0x18, 0x22, 0x21, 0x20, 0x18,
+0x00, 0x20, 0x22, 0x21, 0x20, 0x10, 0x00, 0x20, 0x22, 0x21, 0x20, 0x08, 0x00, 0x20, 0x22, 0x21,
+0x1C, 0x08, 0x00, 0x20, 0x22, 0x21, 0x14, 0x08, 0x00, 0x20, 0x22, 0x20, 0x18, 0x08, 0x00, 0x20,
+0x31, 0x30, 0x20, 0x10, 0x00, 0x30, 0x31, 0x30, 0x18, 0x00, 0x00, 0x30, 0x31, 0x2F, 0x10, 0x10,
+0x00, 0x30, 0x31, 0x2C, 0x10, 0x10, 0x00, 0x30, 0x31, 0x28, 0x10, 0x00, 0x00, 0x30, 0x31, 0x20,
+0x10, 0x00, 0x00, 0x30, 0x31, 0x10, 0x10, 0x00, 0x00, 0x30, 0x04, 0x04, 0x04, 0x05, 0x04, 0x04,
+0x05, 0x07, 0x07, 0x07, 0x08, 0x0A, 0x04, 0x04, 0x04, 0x04, 0x06, 0x0A, 0x0B, 0x0D, 0x05, 0x05,
+0x07, 0x07, 0x08, 0x0B, 0x0D, 0x0F, 0x04, 0x04, 0x04, 0x05, 0x07, 0x07, 0x09, 0x09, 0x0C, 0x0E,
+0x10, 0x12, 0x06, 0x07, 0x09, 0x0A, 0x0C, 0x0E, 0x11, 0x13, 0x09, 0x09, 0x09, 0x09, 0x0C, 0x0E,
+0x11, 0x13, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0x26, 0x2A, 0x18, 0x1A,
+0x1D, 0x1F, 0x21, 0x27, 0x29, 0x2A, 0x00, 0x00, 0x00, 0x1F, 0x23, 0x28, 0x2A, 0x2C, 0x00, 0x04,
+0x00, 0x04, 0x00, 0x08, 0x00, 0x10, 0x00, 0x18, 0x00, 0x24, 0x00, 0x30, 0x00, 0x48, 0x00, 0x60,
+0x00, 0x90, 0x00, 0xC0, 0x00, 0xD8, 0x00, 0x50, 0x00, 0x78, 0x00, 0xA0, 0x00, 0xC8, 0x01, 0x40,
+0x01, 0x90, 0x01, 0xE0, 0x02, 0x30, 0x01, 0x2C, 0x01, 0x40, 0x01, 0xE0, 0x02, 0xD0, 0x03, 0xE8,
+0x04, 0xB0, 0x06, 0x40, 0x07, 0xD0, 0x00, 0x02, 0x00, 0x02, 0x00, 0x04, 0x00, 0x08, 0x00, 0x0C,
+0x00, 0x12, 0x00, 0x18, 0x00, 0x24, 0x00, 0x30, 0x00, 0x48, 0x00, 0x60, 0x00, 0x6C, 0x00, 0x28,
+0x00, 0x3C, 0x00, 0x50, 0x00, 0x64, 0x00, 0xA0, 0x00, 0xC8, 0x00, 0xF0, 0x01, 0x18, 0x00, 0x64,
+0x00, 0xA0, 0x00, 0xF0, 0x01, 0x68, 0x01, 0xF4, 0x02, 0x58, 0x03, 0x20, 0x03, 0xE8, 0x02, 0x02,
+0x02, 0x02, 0x02, 0x02, 0x03, 0x03, 0x04, 0x04, 0x05, 0x07, 0x02, 0x03, 0x04, 0x0A, 0x0C, 0x0E,
+0x10, 0x12, 0x05, 0x07, 0x07, 0x08, 0x0B, 0x12, 0x24, 0x3C, 0x01, 0x01, 0x01, 0x01, 0x01, 0x02,
+0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x05, 0x06,
+0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x20, 0x1E, 0x1C, 0x18, 0x10, 0x18, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0xBB, 0x01, 0x0C, 0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE0, 0x22, 0x50,
+0x06, 0xE9, 0x25, 0x82, 0xF8, 0xE6, 0x22, 0xBB, 0xFE, 0x06, 0xE9, 0x25, 0x82, 0xF8, 0xE2, 0x22,
+0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE4, 0x93, 0x22, 0xBB, 0x01, 0x06,
+0x89, 0x82, 0x8A, 0x83, 0xF0, 0x22, 0x50, 0x02, 0xF7, 0x22, 0xBB, 0xFE, 0x01, 0xF3, 0x22, 0xF8,
+0xBB, 0x01, 0x0D, 0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE8, 0xF0, 0x22,
+0x50, 0x06, 0xE9, 0x25, 0x82, 0xC8, 0xF6, 0x22, 0xBB, 0xFE, 0x05, 0xE9, 0x25, 0x82, 0xC8, 0xF2,
+0x22, 0xC5, 0xF0, 0xF8, 0xA3, 0xE0, 0x28, 0xF0, 0xC5, 0xF0, 0xF8, 0xE5, 0x82, 0x15, 0x82, 0x70,
+0x02, 0x15, 0x83, 0xE0, 0x38, 0xF0, 0x22, 0xBB, 0x01, 0x0A, 0x89, 0x82, 0x8A, 0x83, 0xE0, 0xF5,
+0xF0, 0xA3, 0xE0, 0x22, 0x50, 0x06, 0x87, 0xF0, 0x09, 0xE7, 0x19, 0x22, 0xBB, 0xFE, 0x07, 0xE3,
+0xF5, 0xF0, 0x09, 0xE3, 0x19, 0x22, 0x89, 0x82, 0x8A, 0x83, 0xE4, 0x93, 0xF5, 0xF0, 0x74, 0x01,
+0x93, 0x22, 0xBB, 0x01, 0x10, 0xE5, 0x82, 0x29, 0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE0,
+0xF5, 0xF0, 0xA3, 0xE0, 0x22, 0x50, 0x09, 0xE9, 0x25, 0x82, 0xF8, 0x86, 0xF0, 0x08, 0xE6, 0x22,
+0xBB, 0xFE, 0x0A, 0xE9, 0x25, 0x82, 0xF8, 0xE2, 0xF5, 0xF0, 0x08, 0xE2, 0x22, 0xE5, 0x83, 0x2A,
+0xF5, 0x83, 0xE9, 0x93, 0xF5, 0xF0, 0xA3, 0xE9, 0x93, 0x22, 0xBB, 0x01, 0x0A, 0x89, 0x82, 0x8A,
+0x83, 0xF0, 0xE5, 0xF0, 0xA3, 0xF0, 0x22, 0x50, 0x06, 0xF7, 0x09, 0xA7, 0xF0, 0x19, 0x22, 0xBB,
+0xFE, 0x06, 0xF3, 0xE5, 0xF0, 0x09, 0xF3, 0x19, 0x22, 0xF8, 0xBB, 0x01, 0x11, 0xE5, 0x82, 0x29,
+0xF5, 0x82, 0xE5, 0x83, 0x3A, 0xF5, 0x83, 0xE8, 0xF0, 0xE5, 0xF0, 0xA3, 0xF0, 0x22, 0x50, 0x09,
+0xE9, 0x25, 0x82, 0xC8, 0xF6, 0x08, 0xA6, 0xF0, 0x22, 0xBB, 0xFE, 0x09, 0xE9, 0x25, 0x82, 0xC8,
+0xF2, 0xE5, 0xF0, 0x08, 0xF2, 0x22, 0xEF, 0x4B, 0xFF, 0xEE, 0x4A, 0xFE, 0xED, 0x49, 0xFD, 0xEC,
+0x48, 0xFC, 0x22, 0xE0, 0xFC, 0xA3, 0xE0, 0xFD, 0xA3, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0x22, 0xA4,
+0x25, 0x82, 0xF5, 0x82, 0xE5, 0xF0, 0x35, 0x83, 0xF5, 0x83, 0x22, 0xE0, 0xFB, 0xA3, 0xE0, 0xFA,
+0xA3, 0xE0, 0xF9, 0x22, 0xF8, 0xE0, 0xFB, 0xA3, 0xA3, 0xE0, 0xF9, 0x25, 0xF0, 0xF0, 0xE5, 0x82,
+0x15, 0x82, 0x70, 0x02, 0x15, 0x83, 0xE0, 0xFA, 0x38, 0xF0, 0x22, 0xEB, 0xF0, 0xA3, 0xEA, 0xF0,
+0xA3, 0xE9, 0xF0, 0x22, 0xD0, 0x83, 0xD0, 0x82, 0xF8, 0xE4, 0x93, 0x70, 0x12, 0x74, 0x01, 0x93,
+0x70, 0x0D, 0xA3, 0xA3, 0x93, 0xF8, 0x74, 0x01, 0x93, 0xF5, 0x82, 0x88, 0x83, 0xE4, 0x73, 0x74,
+0x02, 0x93, 0x68, 0x60, 0xEF, 0xA3, 0xA3, 0xA3, 0x80, 0xDF, 0xD0, 0x83, 0xD0, 0x82, 0xF8, 0xE4,
+0x93, 0x70, 0x12, 0x74, 0x01, 0x93, 0x70, 0x0D, 0xA3, 0xA3, 0x93, 0xF8, 0x74, 0x01, 0x93, 0xF5,
+0x82, 0x88, 0x83, 0xE4, 0x73, 0x74, 0x02, 0x93, 0xB5, 0xF0, 0x06, 0x74, 0x03, 0x93, 0x68, 0x60,
+0xE9, 0xA3, 0xA3, 0xA3, 0xA3, 0x80, 0xD8, 0xE4, 0x90, 0x8A, 0xC5, 0xF0, 0xE5, 0x24, 0x70, 0x03,
+0x02, 0x44, 0x9D, 0xE5, 0x21, 0x64, 0x01, 0x60, 0x03, 0x02, 0x44, 0x9D, 0xE5, 0x24, 0x14, 0x60,
+0x29, 0x24, 0xFD, 0x60, 0x25, 0x24, 0x02, 0x24, 0xFB, 0x50, 0x02, 0x80, 0x23, 0x90, 0x8B, 0x0B,
+0xE0, 0x14, 0xF0, 0xE0, 0x60, 0x04, 0xA3, 0xE0, 0x60, 0x16, 0x90, 0x8B, 0x0B, 0xE0, 0x70, 0x0A,
+0x90, 0x8B, 0x19, 0xE0, 0x90, 0x8B, 0x0B, 0xF0, 0x80, 0x00, 0x90, 0x8A, 0xC5, 0x74, 0x01, 0xF0,
+0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x16, 0xA3, 0xE0, 0xB4, 0x06, 0x05, 0xE4, 0x90, 0x8A, 0xC5,
+0xF0, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x70, 0x04, 0x90, 0x8A, 0xC5, 0xF0, 0x90, 0x8A, 0xC5,
+0xE0, 0x60, 0x4A, 0x43, 0x25, 0x10, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x0C, 0xE0, 0x75,
+0xF0, 0x03, 0xA4, 0xFF, 0x90, 0x8B, 0x15, 0xE0, 0x2F, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD,
+0x7F, 0x54, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x57, 0x74, 0x05, 0xF0, 0xE5, 0x22, 0x54,
+0x0F, 0xC3, 0x94, 0x04, 0x50, 0x07, 0x7D, 0x01, 0x7F, 0x04, 0x12, 0x45, 0xA2, 0x90, 0x8B, 0x2C,
+0xE0, 0x30, 0xE0, 0x09, 0x12, 0x66, 0x20, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x22, 0xE4, 0xF5,
+0x25, 0xF5, 0x24, 0x75, 0x23, 0x0C, 0x75, 0x22, 0x0C, 0x90, 0x8B, 0x1A, 0xF0, 0x90, 0x8B, 0x18,
+0xF0, 0x90, 0x8B, 0x17, 0xF0, 0x90, 0x8B, 0x19, 0x04, 0xF0, 0x90, 0x8B, 0x0B, 0xF0, 0xE4, 0x90,
+0x8B, 0x1B, 0xF0, 0x90, 0x8B, 0x0D, 0xF0, 0x90, 0x8B, 0x15, 0x74, 0x05, 0xF0, 0xE4, 0x90, 0x8B,
+0x0C, 0xF0, 0x90, 0x8B, 0x13, 0xF0, 0xA3, 0x74, 0x03, 0xF0, 0x90, 0x8B, 0x10, 0xF0, 0xA3, 0x74,
+0x05, 0xF0, 0x90, 0x8B, 0x0F, 0x74, 0x14, 0xF0, 0x90, 0x8B, 0x16, 0x74, 0x05, 0xF0, 0xE4, 0x90,
+0x8B, 0x0E, 0xF0, 0x90, 0x8B, 0x0A, 0xF0, 0x90, 0x8B, 0x08, 0xF0, 0x90, 0x8B, 0x12, 0xF0, 0x22,
+0x7F, 0x00, 0x22, 0x02, 0x45, 0x03, 0x02, 0x45, 0x06, 0x8E, 0x64, 0x8F, 0x65, 0xAD, 0x65, 0xAC,
+0x64, 0xAF, 0x63, 0x12, 0x4A, 0x5B, 0xAF, 0x65, 0xAE, 0x64, 0x90, 0x04, 0x80, 0xE0, 0x54, 0x0F,
+0xFD, 0xAC, 0x07, 0x74, 0x11, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x01,
+0xF0, 0x74, 0x11, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xFB, 0xF0, 0xAC,
+0x07, 0x74, 0x16, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0xFA, 0xF0, 0x74,
+0x15, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x1F, 0xF0, 0xAC, 0x07, 0x74,
+0x06, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x0F, 0xF0, 0x90, 0x04, 0x53,
+0xE4, 0xF0, 0x90, 0x04, 0x52, 0xF0, 0x90, 0x04, 0x51, 0x74, 0xFF, 0xF0, 0x90, 0x04, 0x50, 0x74,
+0xFD, 0xF0, 0x74, 0x14, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xC0, 0x4D,
+0xFD, 0x74, 0x14, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xED, 0xF0, 0x22, 0x7D, 0x01,
+0x7F, 0x0C, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8F, 0x67, 0x8D, 0x68, 0xE5, 0x67, 0x54,
+0x0F, 0xFF, 0xE5, 0x22, 0x54, 0x0F, 0x6F, 0x60, 0x72, 0xE5, 0x67, 0x30, 0xE2, 0x30, 0xE5, 0x22,
+0x20, 0xE2, 0x05, 0x7F, 0x01, 0x12, 0x4A, 0xB2, 0xE5, 0x22, 0x30, 0xE3, 0x10, 0xE5, 0x67, 0x20,
+0xE3, 0x0B, 0x12, 0x49, 0xD5, 0xEF, 0x60, 0x53, 0x12, 0x4A, 0xCC, 0x80, 0x4E, 0xE5, 0x22, 0x20,
+0xE3, 0x49, 0xE5, 0x67, 0x30, 0xE3, 0x44, 0xAF, 0x68, 0x12, 0x4A, 0x7C, 0x80, 0x3D, 0xE5, 0x22,
+0x54, 0x0F, 0xFF, 0xBF, 0x0C, 0x0E, 0xE5, 0x67, 0x20, 0xE3, 0x09, 0x12, 0x49, 0xD5, 0xEF, 0x60,
+0x2A, 0x12, 0x4A, 0xCC, 0xE5, 0x22, 0x54, 0x0F, 0xFF, 0xBF, 0x04, 0x0E, 0xE5, 0x67, 0x20, 0xE2,
+0x09, 0x12, 0x49, 0x93, 0xEF, 0x60, 0x14, 0x12, 0x4A, 0x32, 0xE5, 0x22, 0x54, 0x0F, 0xFF, 0xBF,
+0x02, 0x09, 0x12, 0x45, 0x00, 0xEF, 0x60, 0x03, 0x12, 0x4B, 0x10, 0xD0, 0xD0, 0x92, 0xAF, 0x22,
+0x02, 0x46, 0x6E, 0x02, 0x51, 0x39, 0xE4, 0x93, 0xA3, 0xF8, 0xE4, 0x93, 0xA3, 0x40, 0x03, 0xF6,
+0x80, 0x01, 0xF2, 0x08, 0xDF, 0xF4, 0x80, 0x29, 0xE4, 0x93, 0xA3, 0xF8, 0x54, 0x07, 0x24, 0x0C,
+0xC8, 0xC3, 0x33, 0xC4, 0x54, 0x0F, 0x44, 0x20, 0xC8, 0x83, 0x40, 0x04, 0xF4, 0x56, 0x80, 0x01,
+0x46, 0xF6, 0xDF, 0xE4, 0x80, 0x0B, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x90, 0x4B,
+0x23, 0xE4, 0x7E, 0x01, 0x93, 0x60, 0xBC, 0xA3, 0xFF, 0x54, 0x3F, 0x30, 0xE5, 0x09, 0x54, 0x1F,
+0xFE, 0xE4, 0x93, 0xA3, 0x60, 0x01, 0x0E, 0xCF, 0x54, 0xC0, 0x25, 0xE0, 0x60, 0xA8, 0x40, 0xB8,
+0xE4, 0x93, 0xA3, 0xFA, 0xE4, 0x93, 0xA3, 0xF8, 0xE4, 0x93, 0xA3, 0xC8, 0xC5, 0x82, 0xC8, 0xCA,
+0xC5, 0x83, 0xCA, 0xF0, 0xA3, 0xC8, 0xC5, 0x82, 0xC8, 0xCA, 0xC5, 0x83, 0xCA, 0xDF, 0xE9, 0xDE,
+0xE7, 0x80, 0xBE, 0xE5, 0x21, 0x64, 0x01, 0x70, 0x67, 0xE5, 0x24, 0x60, 0x63, 0xE5, 0x24, 0x64,
+0x02, 0x60, 0x06, 0xE5, 0x24, 0x64, 0x05, 0x70, 0x27, 0x90, 0x06, 0xAB, 0xE0, 0x90, 0x8B, 0x0B,
+0xF0, 0x90, 0x06, 0xAA, 0xE0, 0x90, 0x8B, 0x19, 0xF0, 0x90, 0x8B, 0x0B, 0xE0, 0x70, 0x07, 0x90,
+0x8B, 0x19, 0xE0, 0xFF, 0x80, 0x05, 0x90, 0x8B, 0x0B, 0xE0, 0xFF, 0x90, 0x8B, 0x0B, 0xEF, 0xF0,
+0x90, 0x8B, 0x0D, 0xE0, 0x60, 0x02, 0xE4, 0xF0, 0xE4, 0x90, 0x8B, 0x0C, 0xF0, 0x90, 0x05, 0x58,
+0x74, 0x03, 0xF0, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x53, 0x25,
+0xFD, 0x53, 0x25, 0xEF, 0xE5, 0x24, 0x14, 0x24, 0xFD, 0x50, 0x02, 0x80, 0x03, 0x12, 0x47, 0x8E,
+0x22, 0xEF, 0x64, 0x01, 0x70, 0x35, 0x7D, 0x78, 0x7F, 0x02, 0x12, 0x36, 0x75, 0x7D, 0x02, 0x7F,
+0x03, 0x12, 0x36, 0x75, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x12,
+0x45, 0x9E, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x03, 0x12, 0x66, 0x20, 0x90, 0x06, 0x04, 0xE0,
+0x54, 0x7F, 0xF0, 0x90, 0x06, 0x0A, 0xE0, 0x54, 0xF8, 0xF0, 0x22, 0x90, 0x01, 0x36, 0x74, 0x7B,
+0xF0, 0xA3, 0x74, 0x02, 0xF0, 0x7D, 0x7B, 0xFF, 0x12, 0x36, 0xE6, 0x7D, 0x02, 0x7F, 0x03, 0x12,
+0x36, 0xE6, 0x90, 0x06, 0x04, 0xE0, 0x44, 0x80, 0xF0, 0x90, 0x06, 0x0A, 0xE0, 0x44, 0x07, 0xF0,
+0x12, 0x4B, 0x4F, 0xE5, 0x21, 0x20, 0xE0, 0x05, 0xE4, 0x90, 0x8B, 0x0D, 0xF0, 0x22, 0xE4, 0x90,
+0x8A, 0xC5, 0xF0, 0x90, 0x06, 0xA9, 0xE0, 0x90, 0x8A, 0xC5, 0xF0, 0xE0, 0x54, 0xC0, 0x70, 0x09,
+0x53, 0x25, 0xFE, 0x53, 0x25, 0xFD, 0x12, 0x4A, 0xFC, 0x90, 0x8A, 0xC5, 0xE0, 0x30, 0xE6, 0x15,
+0x43, 0x25, 0x01, 0x90, 0x8B, 0x1A, 0xE0, 0x64, 0x02, 0x60, 0x05, 0x12, 0x4A, 0x97, 0x80, 0x08,
+0x12, 0x49, 0x49, 0x80, 0x03, 0x53, 0x25, 0xFE, 0x90, 0x8A, 0xC5, 0xE0, 0x30, 0xE7, 0x27, 0x43,
+0x25, 0x02, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x11, 0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4,
+0xFB, 0xFD, 0x7F, 0x54, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x57, 0x74, 0x05, 0xF0, 0x90,
+0x8B, 0x1B, 0x74, 0x01, 0xF0, 0x22, 0x53, 0x25, 0xFD, 0x22, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x8B,
+0x12, 0x4B, 0x43, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0xF5, 0x24, 0x14, 0x60,
+0x0E, 0x14, 0x60, 0x1F, 0x14, 0x60, 0x31, 0x24, 0x03, 0x70, 0x44, 0x7F, 0x01, 0x80, 0x3D, 0x90,
+0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFD, 0xE4, 0xFF, 0x12, 0x4A,
+0x07, 0x80, 0x29, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFD,
+0x7F, 0x01, 0x12, 0x4A, 0x07, 0x1F, 0x80, 0x14, 0x90, 0x8A, 0xDE, 0x12, 0x43, 0x6B, 0x90, 0x00,
+0x02, 0x12, 0x42, 0x20, 0xFD, 0x7F, 0x02, 0x12, 0x4A, 0x07, 0xE4, 0xFF, 0x12, 0x47, 0x21, 0x22,
+0xE4, 0x90, 0x8A, 0xCB, 0xF0, 0xE5, 0x24, 0x60, 0x49, 0x90, 0x8B, 0x1B, 0xE0, 0x60, 0x0D, 0xE4,
+0xF0, 0x53, 0x25, 0xFD, 0xE5, 0x25, 0x54, 0x07, 0x70, 0x38, 0x80, 0x33, 0x90, 0x8B, 0x0C, 0xE0,
+0x04, 0xF0, 0x53, 0x25, 0xEF, 0x90, 0x8A, 0xCB, 0xE0, 0xFF, 0x90, 0x8B, 0x10, 0xE0, 0x2F, 0xFF,
+0xE4, 0x33, 0xFE, 0x90, 0x8B, 0x0C, 0xE0, 0xD3, 0x9F, 0xEE, 0x64, 0x80, 0xF8, 0x74, 0x80, 0x98,
+0x40, 0x0D, 0xE5, 0x21, 0xB4, 0x01, 0x0B, 0xA3, 0xE0, 0x70, 0x07, 0xE0, 0x04, 0xF0, 0x22, 0x12,
+0x4A, 0xFC, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8F, 0x63, 0x90, 0x04, 0x1D, 0xE0,
+0x60, 0x24, 0x90, 0x05, 0x22, 0xE0, 0xF5, 0x66, 0x74, 0xFF, 0xF0, 0x12, 0x7E, 0x2D, 0xBF, 0x01,
+0x0D, 0x90, 0x8A, 0xF9, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5F, 0xDE, 0x12, 0x45, 0x09, 0x90, 0x05,
+0x22, 0xE5, 0x66, 0xF0, 0x80, 0x0D, 0x90, 0x8A, 0xF9, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5F, 0xDE,
+0x12, 0x45, 0x09, 0x90, 0x04, 0x1F, 0x74, 0x20, 0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xE5, 0x24,
+0x14, 0x24, 0xFD, 0x50, 0x02, 0x80, 0x41, 0x90, 0x8B, 0x1A, 0xE0, 0x60, 0x2B, 0x12, 0x45, 0x9E,
+0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x0F, 0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD,
+0x7F, 0x58, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x5B, 0x74, 0x05, 0xF0, 0x90, 0x06, 0x92,
+0x74, 0x01, 0xF0, 0x90, 0x8B, 0x18, 0xF0, 0x22, 0xE5, 0x22, 0x54, 0x0F, 0xC3, 0x94, 0x04, 0x50,
+0x07, 0x7D, 0x01, 0x7F, 0x04, 0x12, 0x45, 0xA2, 0x22, 0x90, 0x01, 0x5F, 0xE4, 0xF0, 0x90, 0x01,
+0x3C, 0x74, 0x08, 0xF0, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x8B, 0x0F, 0xE0, 0x90, 0x8B, 0x3E,
+0xF0, 0xE4, 0xFB, 0xFD, 0x7F, 0x5C, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x5F, 0x74, 0x05,
+0xF0, 0x90, 0x06, 0x92, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x17, 0x14, 0xF0, 0xE5, 0x22, 0x54, 0x0F,
+0xC3, 0x94, 0x0C, 0x50, 0x0D, 0x12, 0x45, 0x9E, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x03, 0x12,
+0x66, 0x20, 0x22, 0x12, 0x4B, 0x34, 0xEF, 0x64, 0x01, 0x70, 0x37, 0xE5, 0x25, 0x54, 0x03, 0x70,
+0x31, 0xE5, 0x23, 0x54, 0x0F, 0xD3, 0x94, 0x02, 0x50, 0x28, 0xE5, 0x25, 0x20, 0xE2, 0x23, 0xE5,
+0x25, 0x20, 0xE4, 0x1E, 0x90, 0x8B, 0x0D, 0xE0, 0x70, 0x18, 0x90, 0x8B, 0x12, 0xE0, 0x70, 0x12,
+0xE5, 0x26, 0x70, 0x0E, 0x90, 0x01, 0xB9, 0xE4, 0xF0, 0x90, 0x01, 0xB8, 0x74, 0x04, 0xF0, 0x7F,
+0x01, 0x22, 0x7F, 0x00, 0x22, 0x12, 0x4B, 0x34, 0xEF, 0x64, 0x01, 0x70, 0x27, 0x90, 0x8B, 0x18,
+0xE0, 0x70, 0x21, 0x90, 0x8B, 0x17, 0xE0, 0x70, 0x1B, 0xE5, 0x23, 0x54, 0x0F, 0xD3, 0x94, 0x04,
+0x50, 0x12, 0xE5, 0x26, 0x70, 0x0E, 0x90, 0x01, 0xB9, 0xE4, 0xF0, 0x90, 0x01, 0xB8, 0x74, 0x08,
+0xF0, 0x7F, 0x01, 0x22, 0x7F, 0x00, 0x22, 0xEF, 0x24, 0xFE, 0x60, 0x0B, 0x04, 0x70, 0x22, 0x90,
+0x8B, 0x19, 0x74, 0x01, 0xF0, 0x80, 0x16, 0xED, 0x70, 0x0A, 0x90, 0x8B, 0x16, 0xE0, 0x90, 0x8B,
+0x19, 0xF0, 0x80, 0x05, 0x90, 0x8B, 0x19, 0xED, 0xF0, 0x90, 0x8B, 0x19, 0xE0, 0x90, 0x8B, 0x0B,
+0xF0, 0x22, 0x90, 0x01, 0x37, 0x74, 0x02, 0xF0, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x12, 0x7E,
+0x2D, 0xEF, 0x70, 0x06, 0x90, 0x01, 0xC8, 0x74, 0xFD, 0xF0, 0x7D, 0x02, 0x7F, 0x03, 0x12, 0x36,
+0xE6, 0x12, 0x7A, 0x6D, 0x53, 0x22, 0xF0, 0x43, 0x22, 0x02, 0x22, 0xEF, 0x60, 0x0F, 0x74, 0x21,
+0x2D, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x10, 0xF0, 0x22, 0x74, 0x21, 0x2D,
+0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xEF, 0xF0, 0x22, 0x90, 0x06, 0x04, 0xE0,
+0x54, 0xBF, 0xF0, 0xEF, 0x60, 0x0A, 0xE5, 0x21, 0xB4, 0x01, 0x05, 0xE4, 0xFF, 0x12, 0x48, 0xB3,
+0x53, 0x22, 0xF0, 0x43, 0x22, 0x0C, 0x22, 0x90, 0x04, 0x1D, 0xE0, 0x70, 0x14, 0x90, 0x8A, 0xF8,
+0xE0, 0xFF, 0xE4, 0xFD, 0x12, 0x5F, 0xDE, 0x8E, 0x69, 0x8F, 0x6A, 0x90, 0x04, 0x1F, 0x74, 0x20,
+0xF0, 0x22, 0x90, 0x8B, 0x52, 0xEF, 0xF0, 0x12, 0x4F, 0xED, 0x90, 0x8B, 0x52, 0xE0, 0x60, 0x05,
+0x90, 0x05, 0x22, 0xE4, 0xF0, 0x53, 0x22, 0xF0, 0x43, 0x22, 0x04, 0x22, 0x90, 0x06, 0x04, 0xE0,
+0x44, 0x40, 0xF0, 0xE5, 0x21, 0xB4, 0x01, 0x05, 0x7F, 0x01, 0x12, 0x48, 0xB3, 0x53, 0x22, 0xF0,
+0x43, 0x22, 0x04, 0x22, 0xE5, 0x23, 0x30, 0xE6, 0x12, 0xE5, 0x23, 0x54, 0x0F, 0xFF, 0x90, 0x01,
+0x2F, 0xE0, 0x54, 0x80, 0x4F, 0x64, 0x80, 0xF0, 0x53, 0x23, 0xBF, 0x22, 0x90, 0x8B, 0x2C, 0xE0,
+0x30, 0xE0, 0x05, 0xAF, 0x23, 0x02, 0x66, 0x65, 0x7D, 0x01, 0xAF, 0x23, 0x12, 0x45, 0xA2, 0x22,
+0x53, 0x22, 0xF0, 0x43, 0x22, 0x01, 0x12, 0x4B, 0x5A, 0x12, 0x4B, 0x5B, 0x53, 0x22, 0xF0, 0x43,
+0x22, 0x02, 0x22, 0x41, 0x8A, 0xF6, 0x00, 0x41, 0x8B, 0x05, 0x00, 0x41, 0x8B, 0x51, 0x00, 0x41,
+0x8B, 0x53, 0x00, 0x00, 0x90, 0x04, 0x1B, 0xE0, 0x54, 0x7F, 0x64, 0x7F, 0x7F, 0x01, 0x60, 0x02,
+0x7F, 0x00, 0x22, 0xE4, 0x90, 0x8B, 0x1B, 0xF0, 0x90, 0x8B, 0x0C, 0xF0, 0xF5, 0x25, 0x22, 0x90,
+0x8B, 0x13, 0xE0, 0xA3, 0xE0, 0x90, 0x05, 0x58, 0xF0, 0x22, 0x22, 0x22, 0xF0, 0x90, 0x8B, 0x0F,
+0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD, 0x7F, 0x58, 0x7E, 0x01, 0xD3, 0x10, 0xAF, 0x01,
+0xC3, 0xC0, 0xD0, 0x90, 0x8B, 0x3D, 0xE0, 0xFB, 0xA3, 0xE0, 0xF5, 0x44, 0xE4, 0xF5, 0x45, 0x12,
+0x35, 0xAB, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xC0, 0xE0, 0xC0, 0xF0, 0xC0, 0x83, 0xC0, 0x82, 0xC0,
+0xD0, 0x75, 0xD0, 0x00, 0xC0, 0x00, 0xC0, 0x01, 0xC0, 0x02, 0xC0, 0x03, 0xC0, 0x04, 0xC0, 0x05,
+0xC0, 0x06, 0xC0, 0x07, 0x75, 0x0E, 0x00, 0x90, 0x01, 0xC4, 0x74, 0x87, 0xF0, 0x74, 0x4B, 0xA3,
+0xF0, 0x53, 0x91, 0xDF, 0x90, 0x01, 0x3C, 0xE0, 0x55, 0x30, 0xF5, 0x34, 0xA3, 0xE0, 0x55, 0x31,
+0xF5, 0x35, 0xA3, 0xE0, 0x55, 0x32, 0xF5, 0x36, 0xA3, 0xE0, 0x55, 0x33, 0xF5, 0x37, 0xE5, 0x34,
+0x30, 0xE0, 0x51, 0x90, 0x01, 0x3C, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0x30, 0xE0, 0x1F,
+0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x18, 0x90, 0x8B, 0x34, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0xE0,
+0x64, 0x03, 0x60, 0x0B, 0x7F, 0x01, 0xB1, 0xE0, 0xEF, 0x70, 0x04, 0x7F, 0x02, 0xD1, 0x89, 0x90,
+0x8B, 0x2C, 0xE0, 0xFF, 0x30, 0xE0, 0x1D, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x16, 0x90, 0x8B,
+0x2E, 0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60, 0x09, 0xE4, 0xFF, 0xB1, 0xE0, 0xEF,
+0x70, 0x02, 0xD1, 0x56, 0xE5, 0x34, 0x30, 0xE1, 0x08, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x11,
+0x60, 0xE5, 0x34, 0x30, 0xE2, 0x28, 0x90, 0x01, 0x3C, 0x74, 0x04, 0xF0, 0x90, 0x06, 0x92, 0xE0,
+0x30, 0xE0, 0x14, 0x90, 0x8B, 0x3D, 0xE4, 0x71, 0x5C, 0x90, 0x01, 0x5B, 0x74, 0x05, 0xF0, 0x90,
+0x06, 0x92, 0x74, 0x01, 0xF0, 0x80, 0x07, 0x90, 0x8B, 0x18, 0xE4, 0xF0, 0x51, 0xFC, 0xE5, 0x34,
+0x30, 0xE3, 0x38, 0x90, 0x01, 0x3C, 0x74, 0x08, 0xF0, 0x90, 0x06, 0x92, 0xE0, 0x30, 0xE1, 0x24,
+0x90, 0x8B, 0x3D, 0xE4, 0xF0, 0x90, 0x8B, 0x0F, 0xE0, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD,
+0x7F, 0x5C, 0x7E, 0x01, 0x71, 0x6C, 0x90, 0x01, 0x5F, 0x74, 0x05, 0xF0, 0x90, 0x06, 0x92, 0x74,
+0x02, 0xF0, 0x80, 0x07, 0x90, 0x8B, 0x17, 0xE4, 0xF0, 0x51, 0xFC, 0xE5, 0x34, 0x30, 0xE4, 0x09,
+0x90, 0x01, 0x3C, 0x74, 0x10, 0xF0, 0x12, 0x52, 0x3C, 0xE5, 0x34, 0x30, 0xE5, 0x06, 0x90, 0x01,
+0x3C, 0x74, 0x20, 0xF0, 0xE5, 0x35, 0x30, 0xE0, 0x10, 0x90, 0x01, 0x3D, 0x74, 0x01, 0xF0, 0x90,
+0x00, 0x83, 0xE0, 0xF5, 0x23, 0x51, 0xE4, 0x51, 0xFC, 0xE5, 0x35, 0x30, 0xE2, 0x06, 0x90, 0x01,
+0x3D, 0x74, 0x04, 0xF0, 0xE5, 0x35, 0x30, 0xE4, 0x1B, 0x90, 0x01, 0x3D, 0x74, 0x10, 0xF0, 0x90,
+0x8B, 0x05, 0xE0, 0x60, 0x0F, 0xE4, 0xF0, 0x90, 0x05, 0x53, 0xE0, 0x44, 0x01, 0xF0, 0x90, 0x05,
+0xFD, 0xE0, 0x04, 0xF0, 0xE5, 0x36, 0x30, 0xE0, 0x75, 0x90, 0x01, 0x3E, 0x74, 0x01, 0xF0, 0x90,
+0x8B, 0x32, 0xE0, 0x30, 0xE0, 0x18, 0x90, 0x8B, 0x36, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0xE0, 0x64,
+0x03, 0x60, 0x0B, 0x7F, 0x01, 0xB1, 0xE0, 0xEF, 0x60, 0x04, 0x7F, 0x01, 0xD1, 0x89, 0x90, 0x8B,
+0x2C, 0xE0, 0x30, 0xE0, 0x49, 0x90, 0x8B, 0x30, 0xE4, 0xF0, 0xFF, 0xB1, 0xE0, 0xEF, 0x60, 0x3E,
+0x12, 0x65, 0xF0, 0x90, 0x8B, 0x2D, 0xE0, 0xFF, 0x64, 0x06, 0x60, 0x32, 0xEF, 0xB4, 0x04, 0x02,
+0x80, 0x07, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x04, 0xE4, 0xFF, 0x80, 0x14, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x05, 0x7F,
+0x01, 0x12, 0x7B, 0x49, 0x7D, 0x01, 0xAF, 0x23, 0x12, 0x45, 0xA2, 0x12, 0x66, 0x20, 0xE5, 0x36,
+0x30, 0xE1, 0x47, 0x90, 0x01, 0x3E, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0x30, 0xE0, 0x19,
+0x90, 0x8B, 0x36, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x33, 0xE0, 0x64, 0x03, 0x60, 0x0B, 0x7F, 0x01,
+0xB1, 0xE0, 0xEF, 0x70, 0x04, 0x7F, 0x02, 0xD1, 0x89, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x1A,
+0x90, 0x8B, 0x30, 0x74, 0x01, 0xF0, 0x12, 0x7D, 0xBE, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60,
+0x09, 0xE4, 0xFF, 0xB1, 0xE0, 0xEF, 0x70, 0x02, 0xD1, 0x56, 0x74, 0x87, 0x04, 0x90, 0x01, 0xC4,
+0xF0, 0x74, 0x4B, 0xA3, 0xF0, 0xD0, 0x07, 0xD0, 0x06, 0xD0, 0x05, 0xD0, 0x04, 0xD0, 0x03, 0xD0,
+0x02, 0xD0, 0x01, 0xD0, 0x00, 0xD0, 0xD0, 0xD0, 0x82, 0xD0, 0x83, 0xD0, 0xF0, 0xD0, 0xE0, 0x32,
+0xEF, 0x64, 0x01, 0x70, 0x3D, 0x90, 0x8B, 0x35, 0xE0, 0x60, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B,
+0x08, 0xE0, 0x60, 0x03, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x34, 0xE0, 0x60, 0x03, 0x7F, 0x01, 0x22,
+0x90, 0x8B, 0x32, 0xE0, 0xFF, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x0B, 0xEF, 0xC4, 0x13, 0x54,
+0x07, 0x30, 0xE0, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x36, 0xE0, 0x7F, 0x01, 0x60, 0x36, 0x7F,
+0x00, 0x22, 0x90, 0x8B, 0x2F, 0xE0, 0x60, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x08, 0xE0, 0x60,
+0x03, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x2E, 0xE0, 0x60, 0x03, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x2C,
+0xE0, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x03, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x30, 0xE0, 0x7F,
+0x01, 0x60, 0x02, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x0D, 0xE0, 0x60, 0x16, 0x90, 0x8B, 0x2D, 0xE0,
+0x70, 0x04, 0x7F, 0x05, 0x80, 0x1F, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x01, 0x70, 0x1A, 0x7F, 0x02,
+0x80, 0x13, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x01, 0x04, 0x7F, 0x03, 0x80, 0x08, 0x90, 0x8B, 0x2D,
+0xE0, 0x70, 0x05, 0x7F, 0x04, 0x12, 0x7B, 0x49, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0,
+0x90, 0x8B, 0x33, 0xE0, 0x90, 0x8B, 0x55, 0xF0, 0x6F, 0x70, 0x02, 0xE1, 0x55, 0xEF, 0x14, 0x60,
+0x3B, 0x14, 0x60, 0x5F, 0x14, 0x70, 0x02, 0xE1, 0x30, 0x24, 0x03, 0x60, 0x02, 0xE1, 0x55, 0x90,
+0x8B, 0x55, 0xE0, 0xB4, 0x03, 0x04, 0xF1, 0xC0, 0xE1, 0x55, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x02,
+0x04, 0xF1, 0xAD, 0xE1, 0x55, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x04, 0x04, 0xF1, 0xC4, 0xE1, 0x55,
+0x90, 0x8B, 0x55, 0xE0, 0x64, 0x01, 0x70, 0x7D, 0xF1, 0xAF, 0x80, 0x79, 0x90, 0x8B, 0x55, 0xE0,
+0xFF, 0xB4, 0x03, 0x04, 0xF1, 0xC8, 0x80, 0x6D, 0xEF, 0xB4, 0x02, 0x04, 0xF1, 0xA0, 0x80, 0x65,
+0x90, 0x8B, 0x55, 0xE0, 0xFF, 0xB4, 0x04, 0x04, 0xF1, 0xD3, 0x80, 0x59, 0xEF, 0x70, 0x56, 0xF1,
+0x8D, 0x80, 0x52, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x03, 0x05, 0x12, 0x7A, 0x5E, 0x80, 0x46, 0x90,
+0x8B, 0x55, 0xE0, 0xB4, 0x01, 0x04, 0xF1, 0x71, 0x80, 0x3B, 0x90, 0x8B, 0x55, 0xE0, 0xB4, 0x04,
+0x05, 0x12, 0x7B, 0x37, 0x80, 0x2F, 0x90, 0x8B, 0x55, 0xE0, 0x70, 0x29, 0xF1, 0x6F, 0x80, 0x25,
+0x90, 0x8B, 0x55, 0xE0, 0xFF, 0xB4, 0x01, 0x04, 0xF1, 0x5A, 0x80, 0x19, 0xEF, 0xB4, 0x02, 0x04,
+0xF1, 0x6B, 0x80, 0x11, 0x90, 0x8B, 0x55, 0xE0, 0xFF, 0xB4, 0x04, 0x04, 0xF1, 0x5A, 0x80, 0x05,
+0xEF, 0x70, 0x02, 0xF1, 0x67, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x05, 0x22, 0x74, 0x6F, 0xF0,
+0x90, 0x8B, 0x33, 0x74, 0x03, 0xF0, 0x22, 0xF1, 0x8D, 0x80, 0xEF, 0xF1, 0xED, 0x80, 0xEB, 0xF1,
+0x8D, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x12, 0x7E, 0x2D, 0xEF, 0x70, 0x06, 0x90, 0x01, 0xC8,
+0x74, 0xFD, 0xF0, 0x12, 0x7A, 0x6D, 0x90, 0x8B, 0x33, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x01, 0x3E,
+0x74, 0x03, 0xF0, 0xFD, 0x7F, 0x02, 0x12, 0x37, 0x00, 0x90, 0x8B, 0x33, 0x74, 0x01, 0xF0, 0x22,
+0xF1, 0xED, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0x04, 0xF0, 0x22, 0xF1, 0xA0, 0x7D,
+0x03, 0x7F, 0x02, 0x12, 0x36, 0x92, 0x90, 0x05, 0x27, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0xF0, 0x22,
+0xF1, 0xC8, 0x80, 0xEB, 0xF1, 0xD3, 0x80, 0xE7, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x33,
+0x04, 0xF0, 0x22, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x33, 0x04, 0xF0, 0x22, 0xF1, 0x8D,
+0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x33, 0x74, 0x04, 0xF0, 0x22, 0x90, 0x8B, 0x1C,
+0x12, 0x43, 0x53, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x78, 0x7E, 0x08, 0x12, 0x2F, 0xD9,
+0x90, 0x8B, 0x20, 0x12, 0x43, 0x53, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x04, 0x7E, 0x0C,
+0x12, 0x2F, 0xD9, 0x90, 0x8B, 0x24, 0x12, 0x43, 0x53, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F,
+0x00, 0x7E, 0x08, 0x12, 0x2F, 0xD9, 0x90, 0x8B, 0x28, 0x12, 0x43, 0x53, 0x90, 0x80, 0x85, 0x12,
+0x2A, 0x7F, 0x7F, 0x70, 0x7E, 0x0E, 0x12, 0x2F, 0xD9, 0x90, 0x80, 0x59, 0x12, 0x2A, 0x8B, 0x00,
+0x03, 0x2D, 0x95, 0xE4, 0xFD, 0xFF, 0x12, 0x34, 0x81, 0x90, 0x8B, 0x09, 0xE0, 0xB4, 0x01, 0x11,
+0x90, 0x80, 0x59, 0x12, 0x2A, 0x8B, 0x00, 0x03, 0x2D, 0x95, 0xE4, 0xFD, 0x7F, 0x01, 0x12, 0x34,
+0x81, 0x22, 0x90, 0x02, 0x84, 0xEF, 0xF0, 0xA3, 0xEE, 0xF0, 0xA3, 0x74, 0x05, 0xF0, 0x22, 0xEF,
+0x8E, 0xF0, 0x12, 0x43, 0xBA, 0x50, 0x8D, 0x00, 0x40, 0x50, 0xB5, 0x00, 0x80, 0x50, 0xE0, 0x01,
+0x00, 0x50, 0xF4, 0x02, 0x00, 0x51, 0x0C, 0x04, 0x00, 0x00, 0x00, 0x51, 0x29, 0xED, 0x54, 0x3F,
+0x70, 0x04, 0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x00, 0x7F, 0x40, 0xEF, 0x2D, 0xFF, 0xEE, 0x3C, 0xFE,
+0xEF, 0x78, 0x06, 0xCE, 0xC3, 0x13, 0xCE, 0x13, 0xD8, 0xF9, 0x78, 0x06, 0xC3, 0x33, 0xCE, 0x33,
+0xCE, 0xD8, 0xF9, 0x80, 0x26, 0xED, 0x54, 0x7F, 0x70, 0x04, 0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x00,
+0x7F, 0x80, 0xEF, 0x2D, 0xFF, 0xEE, 0x3C, 0xFE, 0xEF, 0x78, 0x07, 0xCE, 0xC3, 0x13, 0xCE, 0x13,
+0xD8, 0xF9, 0x78, 0x07, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFD, 0xAC, 0x06, 0x80, 0x49,
+0xED, 0x70, 0x04, 0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x01, 0x7F, 0x00, 0xEF, 0x2D, 0xEE, 0x3C, 0x7D,
+0x00, 0xFC, 0x80, 0x35, 0xEC, 0x54, 0x01, 0x4D, 0x70, 0x04, 0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x02,
+0x7F, 0x00, 0xEF, 0x2D, 0xEE, 0x3C, 0xC3, 0x13, 0x7D, 0x00, 0x80, 0x1A, 0xEC, 0x54, 0x03, 0x4D,
+0x70, 0x04, 0xFE, 0xFF, 0x80, 0x04, 0x7E, 0x04, 0x7F, 0x00, 0xEF, 0x2D, 0xEE, 0x3C, 0x13, 0x13,
+0x54, 0x3F, 0x7D, 0x00, 0x25, 0xE0, 0x25, 0xE0, 0xFC, 0xAE, 0x04, 0xAF, 0x05, 0x22, 0x90, 0x01,
+0xE4, 0x74, 0x58, 0xF0, 0xA3, 0x74, 0x02, 0xF0, 0x22, 0xE4, 0x90, 0x8A, 0xCC, 0xF0, 0xA3, 0xF0,
+0x75, 0x8E, 0x02, 0x91, 0x81, 0x12, 0x67, 0x0E, 0x90, 0x8B, 0x07, 0xEF, 0xF0, 0x12, 0x67, 0x1B,
+0x90, 0x8B, 0x09, 0xEF, 0xF0, 0x12, 0x67, 0x27, 0x90, 0x8A, 0xF4, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0,
+0xE4, 0xF5, 0x55, 0xF5, 0x21, 0x12, 0x71, 0x16, 0x12, 0x44, 0x9E, 0x12, 0x32, 0x3D, 0x7F, 0x03,
+0x12, 0x76, 0xAB, 0x12, 0x7A, 0x5A, 0x12, 0x66, 0xD4, 0x12, 0x67, 0x3F, 0x12, 0x67, 0x54, 0x12,
+0x66, 0xF2, 0x12, 0x67, 0x0D, 0x90, 0x8A, 0xCE, 0xE5, 0xD9, 0xF0, 0x31, 0xD2, 0xC2, 0xAF, 0x90,
+0x00, 0x80, 0xE0, 0x44, 0x40, 0xF0, 0x51, 0x81, 0x75, 0xE8, 0x03, 0x43, 0xA8, 0x85, 0xD2, 0xAF,
+0x31, 0x2E, 0x90, 0x8A, 0xCC, 0xE0, 0x64, 0x01, 0xF0, 0x24, 0x39, 0x90, 0x01, 0xC4, 0xF0, 0x74,
+0x51, 0xA3, 0xF0, 0xE5, 0x55, 0x30, 0xE4, 0x09, 0xC2, 0xAF, 0x53, 0x55, 0xEF, 0xD2, 0xAF, 0xB1,
+0xCC, 0xE5, 0x55, 0x30, 0xE6, 0xDC, 0xC2, 0xAF, 0x53, 0x55, 0xBF, 0xD2, 0xAF, 0x12, 0x68, 0x42,
+0x80, 0xD0, 0x90, 0x01, 0x3C, 0x74, 0xFF, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0x90, 0x01, 0x34, 0xF0,
+0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xFD, 0x7F, 0x54, 0x31, 0xFB, 0x7D, 0xFF, 0x7F, 0x55, 0x31,
+0xFB, 0x7D, 0xFF, 0x7F, 0x56, 0x31, 0xFB, 0x7D, 0xFF, 0x7F, 0x57, 0xD3, 0x10, 0xAF, 0x01, 0xC3,
+0xC0, 0xD0, 0x8F, 0x82, 0x75, 0x83, 0x00, 0xED, 0xF0, 0x51, 0x81, 0xD0, 0xD0, 0x92, 0xAF, 0x22,
+0x90, 0x01, 0x30, 0xE4, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0x90, 0x01, 0x38, 0xF0, 0xA3,
+0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xFD, 0x7F, 0x50, 0x31, 0xFB, 0xE4, 0xFD, 0x7F, 0x51, 0x31, 0xFB,
+0xE4, 0xFD, 0x7F, 0x52, 0x31, 0xFB, 0xE4, 0xFD, 0x7F, 0x53, 0x80, 0xBF, 0xE5, 0x5E, 0x64, 0x01,
+0x70, 0x3B, 0x71, 0xC1, 0xBF, 0x01, 0x04, 0x7F, 0x01, 0x71, 0xB5, 0x90, 0x00, 0x46, 0xE0, 0x44,
+0x04, 0xFD, 0x7F, 0x46, 0x31, 0xFB, 0x90, 0x00, 0x44, 0xE0, 0x54, 0xFB, 0xFD, 0x7F, 0x44, 0x31,
+0xFB, 0x90, 0x00, 0x46, 0xE0, 0x54, 0xFB, 0xFD, 0x7F, 0x46, 0x31, 0xFB, 0x7F, 0x02, 0x71, 0xDD,
+0x8F, 0x62, 0x90, 0x01, 0xC9, 0xE5, 0x62, 0xF0, 0xB4, 0x01, 0x02, 0x71, 0x55, 0x22, 0xE0, 0x5F,
+0xF0, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x7F, 0x10, 0xDF, 0xFE, 0xD0, 0xD0, 0x92, 0xAF,
+0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8A, 0xE0, 0xED, 0xF0, 0x90, 0x8A, 0xDF,
+0xEF, 0xF0, 0xD3, 0x94, 0x07, 0x50, 0x4E, 0xA3, 0xE0, 0x70, 0x1A, 0x90, 0x8A, 0xDF, 0xE0, 0xFF,
+0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x47,
+0xE0, 0x5F, 0xF0, 0x80, 0x17, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80,
+0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xFF, 0x90, 0x00, 0x47, 0xE0, 0x4F, 0xF0, 0x51, 0x81, 0x90, 0x8A,
+0xDF, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF,
+0x90, 0x00, 0x46, 0x80, 0x59, 0x90, 0x8A, 0xDF, 0xE0, 0x24, 0xF8, 0xF0, 0xA3, 0xE0, 0x70, 0x1D,
+0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC,
+0xC4, 0x54, 0xF0, 0xF4, 0xFF, 0x90, 0x00, 0x43, 0xE0, 0x5F, 0xF0, 0x80, 0x1A, 0x90, 0x8A, 0xDF,
+0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xC4, 0x54, 0xF0,
+0xFF, 0x90, 0x00, 0x43, 0xE0, 0x4F, 0xF0, 0x51, 0x81, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0x01,
+0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x43, 0x51, 0x7E,
+0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x00, 0x49, 0xE0, 0x90, 0x8B, 0x54, 0xF0, 0xE0, 0x54, 0x0F,
+0xF0, 0x44, 0xF0, 0xFD, 0x7F, 0x49, 0x31, 0xFB, 0x90, 0x8B, 0x54, 0xE0, 0x44, 0xB0, 0xFD, 0x7F,
+0x49, 0x21, 0xFB, 0x90, 0x8A, 0xDD, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x75, 0x5E, 0x01, 0x8E, 0x5F,
+0xF5, 0x60, 0xE4, 0xFD, 0x7F, 0x0B, 0x51, 0x91, 0xE4, 0xFD, 0x7F, 0x02, 0x51, 0x91, 0x71, 0xC1,
+0xE4, 0xFF, 0x71, 0xB5, 0xE4, 0xF5, 0x62, 0x90, 0x01, 0xC9, 0xE5, 0x62, 0xF0, 0x90, 0x8A, 0xDD,
+0xE0, 0xFC, 0xA3, 0xE0, 0xFD, 0xEC, 0xFB, 0x8D, 0x44, 0xE4, 0xF5, 0x45, 0x7D, 0x01, 0x7F, 0x60,
+0x7E, 0x01, 0x02, 0x35, 0xAB, 0x90, 0x01, 0xCA, 0xE5, 0x61, 0xF0, 0xEF, 0x60, 0x02, 0x71, 0x55,
+0x22, 0x7F, 0x0B, 0x71, 0xDD, 0xEF, 0x65, 0x61, 0x60, 0x10, 0xE5, 0x61, 0xB4, 0x01, 0x05, 0xE4,
+0xF5, 0x61, 0x80, 0x03, 0x75, 0x61, 0x01, 0x7F, 0x01, 0x22, 0x7F, 0x00, 0x22, 0xD3, 0x10, 0xAF,
+0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8B, 0x57, 0xEF, 0xF0, 0xD3, 0x94, 0x07, 0x50, 0x43, 0xE0, 0xFF,
+0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x46,
+0x51, 0x7E, 0x90, 0x8B, 0x57, 0xE0, 0xFD, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x05, 0x08, 0x80, 0x05,
+0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x00, 0x44, 0xE0, 0xFB, 0xE4, 0xFE, 0xEF,
+0x5B, 0xA8, 0x05, 0x08, 0x80, 0x06, 0xCE, 0xA2, 0xE7, 0x13, 0xCE, 0x13, 0xD8, 0xF8, 0xFF, 0x80,
+0x4B, 0x90, 0x8B, 0x57, 0xE0, 0x24, 0xF8, 0xF0, 0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80,
+0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0xFF, 0x90, 0x00, 0x43, 0xE0, 0x5F, 0xF0, 0x51, 0x81, 0x90,
+0x8B, 0x57, 0xE0, 0xFD, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x05, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE,
+0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x00, 0x42, 0xE0, 0xFB, 0xE4, 0xFE, 0xEF, 0x5B, 0xA8, 0x05,
+0x08, 0x80, 0x06, 0xCE, 0xA2, 0xE7, 0x13, 0xCE, 0x13, 0xD8, 0xF8, 0xFF, 0xD0, 0xD0, 0x92, 0xAF,
+0x22, 0xE4, 0x90, 0x8B, 0x04, 0xF0, 0x90, 0x00, 0x80, 0xE0, 0x44, 0x80, 0xFD, 0x7F, 0x80, 0x21,
+0xFB, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x8B, 0x90, 0x8A,
+0xDA, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0xC2, 0xFA, 0xE5, 0xF0, 0x24, 0x00, 0xFF,
+0xE4, 0x3A, 0xFE, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0xEE, 0x8F, 0xF0, 0x12,
+0x43, 0x19, 0x12, 0x29, 0xD9, 0xFF, 0x60, 0x2C, 0xB5, 0x5E, 0x16, 0x90, 0x8A, 0xDA, 0x12, 0x43,
+0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0xC2, 0x65, 0x60, 0x70, 0x04, 0xE5, 0x5F, 0x65, 0xF0, 0x60,
+0x22, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0xC2, 0xFF, 0xAE, 0xF0,
+0x71, 0x73, 0x80, 0x0F, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0x65, 0x5E, 0x60,
+0x02, 0xB1, 0x08, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xE4, 0xF5, 0x5E, 0x7F, 0x60, 0x7E, 0x01, 0x8F,
+0x82, 0x8E, 0x83, 0xA3, 0xA3, 0xA3, 0xE4, 0xF0, 0x22, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x8B, 0xEF,
+0x12, 0x43, 0x94, 0x55, 0x5A, 0x01, 0x55, 0x51, 0x02, 0x55, 0x7E, 0x03, 0x55, 0x87, 0x05, 0x55,
+0x90, 0x06, 0x55, 0xCB, 0x07, 0x55, 0x98, 0x08, 0x55, 0xA1, 0x09, 0x55, 0xA9, 0x20, 0x55, 0xB2,
+0x2C, 0x55, 0x63, 0x2D, 0x55, 0x6C, 0x2E, 0x55, 0x75, 0x3B, 0x55, 0xBB, 0x4B, 0x00, 0x00, 0x55,
+0xC4, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x72, 0xFC, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B,
+0x02, 0x73, 0x02, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x73, 0x2F, 0x90, 0x8A, 0xD7, 0x12,
+0x43, 0x6B, 0x02, 0x73, 0x77, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x73, 0xB0, 0x90, 0x8A,
+0xD7, 0x12, 0x43, 0x6B, 0x02, 0x73, 0xC9, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x72, 0xD0,
+0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0xE1, 0x19, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x74,
+0x11, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x81, 0x91, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02,
+0x76, 0xEA, 0x90, 0x8A, 0xD7, 0x12, 0x43, 0x6B, 0x02, 0x78, 0xDE, 0x90, 0x8A, 0xD7, 0x12, 0x43,
+0x6B, 0x02, 0x7A, 0x48, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x01, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01,
+0xC3, 0xC0, 0xD0, 0x90, 0x01, 0xCC, 0xE0, 0x54, 0x0F, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A, 0xCF,
+0xE0, 0xFD, 0x70, 0x02, 0xE1, 0x14, 0x90, 0x8B, 0x51, 0xE0, 0xFF, 0x74, 0x01, 0x7E, 0x00, 0xA8,
+0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0xEF, 0x5D, 0x70, 0x02,
+0xE1, 0x0D, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD0, 0x12, 0x43, 0x5F, 0xE0,
+0x90, 0x8A, 0xD0, 0xF0, 0x75, 0x1D, 0x01, 0x75, 0x1E, 0x8A, 0x75, 0x1F, 0xD0, 0x75, 0x20, 0x01,
+0x7B, 0x01, 0x7A, 0x8A, 0x79, 0xD1, 0x12, 0x5F, 0x57, 0x90, 0x8A, 0xD1, 0xE0, 0xFF, 0xC4, 0x13,
+0x13, 0x13, 0x54, 0x01, 0x90, 0x8B, 0x51, 0x30, 0xE0, 0x59, 0xE0, 0x75, 0xF0, 0x02, 0x90, 0x00,
+0x88, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD2, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x02,
+0x90, 0x00, 0x89, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD3, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75,
+0xF0, 0x04, 0x90, 0x01, 0xD1, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD4, 0xF0, 0x90, 0x8B, 0x51,
+0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD2, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD5, 0xF0, 0x90,
+0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD3, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD6,
+0xF0, 0x80, 0x33, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD1, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A,
+0xD2, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD2, 0x12, 0x43, 0x5F, 0xE0,
+0x90, 0x8A, 0xD3, 0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x75, 0xF0, 0x04, 0x90, 0x01, 0xD3, 0x12, 0x43,
+0x5F, 0xE0, 0x90, 0x8A, 0xD4, 0xF0, 0xEF, 0x54, 0x7F, 0xFF, 0x7B, 0x01, 0x7A, 0x8A, 0x79, 0xD2,
+0xB1, 0x19, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x90, 0x8B, 0x51, 0xE0, 0xFE, 0x74, 0x01, 0xA8, 0x06,
+0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0xF4, 0x5F, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8B, 0x51,
+0xE0, 0xFF, 0x74, 0x01, 0xA8, 0x07, 0x08, 0x80, 0x02, 0xC3, 0x33, 0xD8, 0xFC, 0x90, 0x01, 0xCC,
+0xF0, 0x90, 0x8B, 0x51, 0xE0, 0x04, 0xF0, 0xE0, 0x54, 0x03, 0xF0, 0xA1, 0xDD, 0x90, 0x01, 0xC6,
+0xE0, 0x44, 0x02, 0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90, 0x00, 0x04, 0x12, 0x42, 0x20, 0xFF,
+0x54, 0x1F, 0xFE, 0xEF, 0x54, 0x20, 0xC4, 0x13, 0x54, 0x07, 0xFD, 0xAF, 0x06, 0x90, 0x8A, 0xDA,
+0xEF, 0xF0, 0xA3, 0xED, 0xF0, 0xA3, 0x12, 0x43, 0x8B, 0x90, 0x8A, 0xDC, 0x12, 0x43, 0x6B, 0x90,
+0x00, 0x03, 0x12, 0x42, 0x20, 0x54, 0xF0, 0xC4, 0x54, 0x0F, 0x90, 0x8A, 0xDF, 0xF0, 0x90, 0x00,
+0x04, 0x12, 0x42, 0x20, 0x54, 0x40, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x90, 0x8A, 0xE0, 0xF0, 0x90,
+0x8A, 0xDA, 0xE0, 0xFF, 0x75, 0xF0, 0x09, 0x90, 0x87, 0x25, 0x12, 0x43, 0x5F, 0xAD, 0x82, 0xAC,
+0x83, 0x90, 0x8A, 0xE1, 0xEC, 0xF0, 0xA3, 0xED, 0xF0, 0xEF, 0x75, 0xF0, 0x09, 0xA4, 0x24, 0x23,
+0xF9, 0x74, 0x87, 0x35, 0xF0, 0xFA, 0x7B, 0x01, 0xA3, 0x12, 0x43, 0x8B, 0x90, 0x8A, 0xDC, 0x12,
+0x43, 0x6B, 0x90, 0x00, 0x03, 0x12, 0x42, 0x20, 0x54, 0x0F, 0xFF, 0x90, 0x8A, 0xE3, 0x12, 0x43,
+0x6B, 0xEF, 0x12, 0x42, 0x4D, 0x90, 0x8A, 0xDC, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x02, 0x12, 0x42,
+0x20, 0xFF, 0x90, 0x8A, 0xE3, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0xEF, 0x12, 0x42, 0x5F, 0x90,
+0x8A, 0xDC, 0x12, 0x43, 0x6B, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0xFF, 0x90, 0x8A, 0xE1, 0xE0,
+0xFC, 0xA3, 0xE0, 0xFD, 0xF5, 0x82, 0x8C, 0x83, 0xEF, 0xF0, 0x12, 0x29, 0xD9, 0x8D, 0x82, 0x8C,
+0x83, 0xA3, 0xF0, 0x90, 0x8A, 0xDF, 0xE0, 0xFE, 0x90, 0x8A, 0xDA, 0xE0, 0xFF, 0x24, 0xC1, 0xF5,
+0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xDB, 0xE0, 0xFE, 0x75, 0xF0, 0x09,
+0xEF, 0x90, 0x87, 0x29, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2A,
+0x12, 0x43, 0x5F, 0x74, 0x01, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xFE, 0x75, 0xF0, 0x09, 0xEF, 0x90,
+0x87, 0x2B, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0x8F, 0x0F, 0xEF, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82,
+0xE4, 0x34, 0x89, 0xAF, 0x82, 0xF5, 0x10, 0x8F, 0x11, 0xE5, 0x0F, 0x75, 0xF0, 0x02, 0xA4, 0x24,
+0x81, 0xF9, 0x74, 0x86, 0x35, 0xF0, 0x75, 0x12, 0x01, 0xF5, 0x13, 0x89, 0x14, 0x75, 0xF0, 0x09,
+0xE5, 0x0F, 0x90, 0x87, 0x25, 0x12, 0x43, 0x5F, 0xAF, 0x82, 0x85, 0x83, 0x15, 0x8F, 0x16, 0xE5,
+0x0F, 0x75, 0xF0, 0x09, 0xA4, 0x24, 0x23, 0xF9, 0x74, 0x87, 0x35, 0xF0, 0x75, 0x17, 0x01, 0xF5,
+0x18, 0x89, 0x19, 0x74, 0xC1, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0x12,
+0x43, 0x94, 0x58, 0xA7, 0x00, 0x58, 0xBC, 0x01, 0x58, 0xD1, 0x02, 0x58, 0xE6, 0x03, 0x59, 0x0F,
+0x04, 0x59, 0x24, 0x05, 0x59, 0x39, 0x06, 0x59, 0x5F, 0x0C, 0x59, 0x8C, 0x0D, 0x59, 0xB9, 0x0E,
+0x59, 0xE6, 0x0F, 0x00, 0x00, 0x5A, 0x1A, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4,
+0x34, 0x89, 0xF5, 0x83, 0x74, 0xF0, 0xF0, 0xA3, 0x74, 0x15, 0x80, 0x3C, 0xE5, 0x0F, 0x25, 0xE0,
+0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0xF0, 0xF0, 0xA3, 0x74, 0x10, 0x80,
+0x27, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0xF0,
+0xF0, 0xA3, 0x74, 0x05, 0x80, 0x12, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34,
+0x89, 0xF5, 0x83, 0x74, 0xF0, 0xF0, 0xA3, 0xE4, 0xF0, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5,
+0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0x74, 0x0F, 0xF0, 0xA3, 0x74, 0x8F, 0xF0, 0x41, 0x1A, 0xE5,
+0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0x74, 0x0F, 0xF0, 0xA3,
+0x74, 0xF5, 0x80, 0x27, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5,
+0x83, 0x74, 0x0F, 0xF0, 0xA3, 0x74, 0xF0, 0x80, 0x12, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5,
+0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0x74, 0x0D, 0xF0, 0xE5, 0x0F, 0x25, 0xE0,
+0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0x41, 0x1A, 0x90,
+0x04, 0x47, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x12, 0x42, 0x4D, 0x90, 0x04, 0x46, 0xE0,
+0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x01, 0x12, 0x42, 0x5F, 0x90, 0x04, 0x45, 0xE0,
+0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xF0, 0x90, 0x04, 0x44, 0x41, 0x11, 0x90, 0x04, 0x4B, 0xE0,
+0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x12, 0x42, 0x4D, 0x90, 0x04, 0x4A, 0xE0, 0xAB, 0x12, 0xAA,
+0x13, 0xA9, 0x14, 0x90, 0x00, 0x01, 0x12, 0x42, 0x5F, 0x90, 0x04, 0x49, 0xE0, 0x85, 0x11, 0x82,
+0x85, 0x10, 0x83, 0xF0, 0x90, 0x04, 0x48, 0x80, 0x58, 0x90, 0x04, 0x4F, 0xE0, 0xAB, 0x12, 0xAA,
+0x13, 0xA9, 0x14, 0x12, 0x42, 0x4D, 0x90, 0x04, 0x4E, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14,
+0x90, 0x00, 0x01, 0x12, 0x42, 0x5F, 0x90, 0x04, 0x4D, 0xE0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83,
+0xF0, 0x90, 0x04, 0x4C, 0x80, 0x2B, 0x90, 0x04, 0x53, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14,
+0x12, 0x42, 0x4D, 0x90, 0x04, 0x52, 0xE0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x01,
+0x12, 0x42, 0x5F, 0x90, 0x04, 0x51, 0xE0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xF0, 0x90, 0x04,
+0x50, 0xE0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xA3, 0xF0, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14,
+0xC0, 0x03, 0xC0, 0x02, 0xC0, 0x01, 0x12, 0x29, 0xD9, 0xFF, 0xAB, 0x17, 0xAA, 0x18, 0xA9, 0x19,
+0x12, 0x29, 0xD9, 0x5F, 0xD0, 0x01, 0xD0, 0x02, 0xD0, 0x03, 0x12, 0x42, 0x4D, 0xAB, 0x12, 0xE5,
+0x14, 0x24, 0x01, 0xF9, 0xE4, 0x35, 0x13, 0xFA, 0xC0, 0x03, 0xC0, 0x02, 0xC0, 0x01, 0x12, 0x29,
+0xD9, 0xFF, 0xAB, 0x17, 0xAA, 0x18, 0xA9, 0x19, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0x5F, 0xD0,
+0x01, 0xD0, 0x02, 0xD0, 0x03, 0x12, 0x42, 0x4D, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xC0, 0x83,
+0xC0, 0x82, 0xE0, 0xFF, 0x85, 0x16, 0x82, 0x85, 0x15, 0x83, 0xE0, 0xFE, 0xEF, 0x5E, 0xD0, 0x82,
+0xD0, 0x83, 0xF0, 0x85, 0x11, 0x82, 0x85, 0x10, 0x83, 0xA3, 0xC0, 0x83, 0xC0, 0x82, 0xE0, 0xFF,
+0x85, 0x16, 0x82, 0x85, 0x15, 0x83, 0xA3, 0xE0, 0xFE, 0xEF, 0x5E, 0xD0, 0x82, 0xD0, 0x83, 0xF0,
+0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFE, 0xA3,
+0xE0, 0x4E, 0x60, 0x4B, 0x90, 0x8A, 0xE6, 0x74, 0x0B, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3,
+0x94, 0x00, 0x50, 0x02, 0x61, 0x5F, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3,
+0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4,
+0x34, 0x86, 0xF5, 0x83, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x0A, 0x90, 0x8A, 0xE6,
+0xE0, 0x24, 0x10, 0xA3, 0xF0, 0x80, 0x68, 0x90, 0x8A, 0xE6, 0xE0, 0x14, 0xF0, 0x80, 0xBB, 0xE5,
+0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0,
+0x4E, 0x60, 0x47, 0x90, 0x8A, 0xE6, 0x74, 0x0F, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94,
+0x00, 0x40, 0x3C, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33,
+0xCE, 0xD8, 0xF9, 0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5,
+0x83, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x08, 0x90, 0x8A, 0xE6, 0xE0, 0xA3, 0xF0,
+0x80, 0x0D, 0x90, 0x8A, 0xE6, 0xE0, 0x14, 0xF0, 0x80, 0xBF, 0xE4, 0x90, 0x8A, 0xE7, 0xF0, 0xE5,
+0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0,
+0x4E, 0x60, 0x46, 0xE4, 0x90, 0x8A, 0xE6, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x10,
+0x40, 0x02, 0x81, 0x18, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE,
+0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89,
+0xF5, 0x83, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x06, 0x90, 0x8A, 0xE6, 0xE0, 0x80,
+0x63, 0x90, 0x8A, 0xE6, 0xE0, 0x04, 0xF0, 0x80, 0xBF, 0xE5, 0x0F, 0x25, 0xE0, 0x24, 0x81, 0xF5,
+0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFE, 0xA3, 0xE0, 0x4E, 0x60, 0x46, 0xE4, 0x90, 0x8A,
+0xE6, 0xF0, 0x90, 0x8A, 0xE6, 0xE0, 0xFF, 0xC3, 0x94, 0x0C, 0x50, 0x3C, 0x74, 0x01, 0x7E, 0x00,
+0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0xE5, 0x0F, 0x25,
+0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F,
+0x4E, 0x60, 0x08, 0x90, 0x8A, 0xE6, 0xE0, 0x24, 0x10, 0x80, 0x09, 0x90, 0x8A, 0xE6, 0xE0, 0x04,
+0xF0, 0x80, 0xBF, 0xE4, 0x90, 0x8A, 0xE8, 0xF0, 0x90, 0x8A, 0xE7, 0xE0, 0xFF, 0x75, 0xF0, 0x09,
+0xE5, 0x0F, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0xEF, 0xF0, 0x90, 0x8A, 0xE8, 0xE0, 0xFE, 0x75,
+0xF0, 0x09, 0xE5, 0x0F, 0x90, 0x87, 0x28, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0xE5, 0x0F, 0xC3, 0x94,
+0x20, 0x50, 0x32, 0x74, 0x84, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0xD3,
+0x9F, 0x40, 0x02, 0x80, 0x18, 0x74, 0x84, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83,
+0xE0, 0xC3, 0x9E, 0x50, 0x08, 0x90, 0x8A, 0xE8, 0xE0, 0xA3, 0xF0, 0x80, 0x08, 0x90, 0x8A, 0xE7,
+0xE0, 0x90, 0x8A, 0xE9, 0xF0, 0x90, 0x8A, 0xE9, 0xE0, 0xFD, 0xAF, 0x0F, 0x91, 0xC1, 0x90, 0x8A,
+0xE9, 0xE0, 0xFF, 0x74, 0x84, 0x25, 0x0F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0,
+0x90, 0x8A, 0xE7, 0xE0, 0xFF, 0xD3, 0x94, 0x13, 0x40, 0x07, 0x90, 0x87, 0x22, 0x74, 0x03, 0xF0,
+0x22, 0xEF, 0xD3, 0x94, 0x0B, 0x40, 0x07, 0x90, 0x87, 0x22, 0x74, 0x02, 0xF0, 0x22, 0xEF, 0xD3,
+0x94, 0x03, 0x40, 0x07, 0x90, 0x87, 0x22, 0x74, 0x01, 0xF0, 0x22, 0xE4, 0x90, 0x87, 0x22, 0xF0,
+0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x74, 0x84, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x04,
+0xF5, 0x83, 0xED, 0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xAC, 0x07, 0xED, 0x54, 0x1F, 0x90, 0x8A,
+0xC7, 0xF0, 0x74, 0x01, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0x90, 0x8A, 0xC5,
+0xF0, 0x90, 0x8A, 0xC8, 0x74, 0x01, 0xF0, 0xEB, 0xC3, 0x94, 0x01, 0x40, 0x02, 0x80, 0x37, 0x90,
+0x8A, 0xC5, 0xE0, 0x25, 0x0D, 0xFF, 0xA3, 0xF0, 0xA3, 0xE0, 0x90, 0x41, 0x9E, 0x93, 0xFE, 0xEF,
+0xD3, 0x9E, 0x40, 0x10, 0x74, 0x01, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE4, 0xF0,
+0xAF, 0x04, 0x80, 0x9D, 0x90, 0x8A, 0xC6, 0xE0, 0xFF, 0x74, 0x01, 0x2C, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xEF, 0xF0, 0x22, 0xAD, 0x07, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x27, 0x12,
+0x43, 0x5F, 0xE0, 0xFF, 0x90, 0x8A, 0xCA, 0xF0, 0x74, 0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A,
+0xF5, 0x83, 0xE0, 0x54, 0x1F, 0x90, 0x8A, 0xC9, 0xF0, 0xD3, 0x9F, 0x40, 0x06, 0xA3, 0xE0, 0x90,
+0x8A, 0xC9, 0xF0, 0x90, 0x8A, 0xC9, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5, 0x82, 0xE4, 0x34,
+0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0, 0x24, 0x2E, 0xF5,
+0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93, 0x3A, 0xC3, 0x13,
+0xFE, 0xEF, 0x13, 0xFF, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83,
+0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xAF, 0x05, 0x90, 0x8A, 0xC9, 0xE0, 0xFD, 0x91, 0xC1, 0x90, 0x8A,
+0xC9, 0xE0, 0xFF, 0x22, 0xAC, 0x07, 0x74, 0x84, 0x2C, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83,
+0xE0, 0x54, 0x7F, 0x90, 0x8A, 0xDE, 0xF0, 0xE0, 0x54, 0x1F, 0xFF, 0x90, 0x8A, 0xE1, 0xF0, 0x75,
+0xF0, 0x09, 0xEC, 0x90, 0x87, 0x28, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xE3, 0xF0, 0x75, 0xF0,
+0x09, 0xEC, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0, 0xFE, 0x90, 0x8A, 0xE4, 0xF0, 0xEC, 0x25,
+0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFB, 0xA3, 0xE0, 0x90, 0x8A,
+0xE5, 0xCB, 0xF0, 0xA3, 0xEB, 0xF0, 0xEC, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34, 0x86,
+0xF5, 0x83, 0xE0, 0xFB, 0xA3, 0xE0, 0x90, 0x8A, 0xE7, 0xCB, 0xF0, 0xA3, 0xEB, 0xF0, 0xEF, 0xD3,
+0x9E, 0x40, 0x0C, 0x90, 0x8A, 0xE4, 0xE0, 0x90, 0x8A, 0xE1, 0xF0, 0x90, 0x8A, 0xDE, 0xF0, 0xED,
+0x70, 0x02, 0xE1, 0x06, 0x90, 0x8A, 0xE2, 0xED, 0xF0, 0x90, 0x8A, 0xDE, 0xE0, 0x30, 0xE6, 0x0E,
+0x90, 0x8A, 0xE1, 0xE0, 0x90, 0x8A, 0xDE, 0xF0, 0x90, 0x8A, 0xE2, 0xE0, 0x14, 0xF0, 0x90, 0x8A,
+0xE2, 0xE0, 0x70, 0x02, 0xE1, 0x06, 0x90, 0x8A, 0xE1, 0xE0, 0xFF, 0xD3, 0x94, 0x00, 0x50, 0x02,
+0xE1, 0x06, 0xE4, 0x90, 0x8A, 0xE0, 0xF0, 0xEF, 0x14, 0x90, 0x8A, 0xDF, 0xF0, 0x90, 0x8A, 0xE3,
+0xE0, 0xFD, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0xD3, 0x9D, 0x40, 0x6F, 0xEF, 0x94, 0x10, 0x40, 0x21,
+0xEF, 0x24, 0xF0, 0xFF, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE,
+0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x8A, 0xE7, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x70,
+0x27, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0xC3, 0x94, 0x10, 0x50, 0x37, 0x74, 0x01, 0x7E, 0x00, 0xA8,
+0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x8A, 0xE5, 0xE0,
+0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x1A, 0x90, 0x8A, 0xDF, 0xE0, 0x90, 0x8A, 0xDE, 0xF0,
+0x90, 0x8A, 0xE0, 0xE0, 0x04, 0xF0, 0x90, 0x8A, 0xE2, 0xE0, 0xFF, 0x90, 0x8A, 0xE0, 0xE0, 0x6F,
+0x60, 0x08, 0x90, 0x8A, 0xDF, 0xE0, 0x14, 0xF0, 0x80, 0x83, 0x90, 0x8A, 0xE2, 0xE0, 0xFF, 0x90,
+0x8A, 0xE0, 0xE0, 0xC3, 0x9F, 0x50, 0x0F, 0x90, 0x8A, 0xDF, 0xE0, 0xB5, 0x05, 0x08, 0x90, 0x8A,
+0xE3, 0xE0, 0x90, 0x8A, 0xDE, 0xF0, 0x90, 0x8A, 0xDE, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5,
+0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0,
+0x24, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93,
+0x3A, 0xC3, 0x13, 0xFE, 0xEF, 0x13, 0xFF, 0xEC, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xAF, 0x04, 0x90, 0x8A, 0xDE, 0xE0, 0xFD, 0x91,
+0xC1, 0x90, 0x8A, 0xDE, 0xE0, 0xFF, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x8B, 0x1A,
+0x8A, 0x1B, 0x89, 0x1C, 0x90, 0x8B, 0x3F, 0x12, 0x43, 0x8B, 0xAB, 0x1D, 0xAA, 0x1E, 0xA9, 0x1F,
+0x90, 0x8B, 0x42, 0x12, 0x43, 0x8B, 0xAF, 0x20, 0x15, 0x20, 0xEF, 0x60, 0x1E, 0x90, 0x8B, 0x42,
+0xE4, 0x75, 0xF0, 0x01, 0x12, 0x43, 0x74, 0x12, 0x29, 0xD9, 0xFF, 0x90, 0x8B, 0x3F, 0xE4, 0x75,
+0xF0, 0x01, 0x12, 0x43, 0x74, 0xEF, 0x12, 0x42, 0x4D, 0x80, 0xDB, 0xAB, 0x1A, 0xAA, 0x1B, 0xA9,
+0x1C, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x01, 0xC4,
+0x74, 0xA6, 0xF0, 0x74, 0x5F, 0xA3, 0xF0, 0x90, 0x04, 0x1D, 0xE0, 0x60, 0x1A, 0x90, 0x05, 0x22,
+0xE0, 0x54, 0x90, 0x60, 0x07, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x40, 0xF0, 0x90, 0x01, 0xC7, 0xE0,
+0x30, 0xE1, 0xE4, 0x7F, 0x00, 0x80, 0x02, 0x7F, 0x01, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0xE4, 0xFB, 0xFA, 0xEF, 0x30, 0xE0, 0x02, 0x7B, 0x80, 0xEF, 0xC3,
+0x13, 0x90, 0xFD, 0x10, 0xF0, 0x90, 0x04, 0x25, 0xEF, 0xF0, 0xED, 0x60, 0x1E, 0xAF, 0x03, 0x74,
+0x0F, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x80, 0xF0, 0x74, 0x10, 0x2F,
+0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x44, 0x80, 0xF0, 0xAF, 0x03, 0x74, 0x08, 0x2F,
+0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x09, 0x2F, 0xF5, 0x82, 0xE4, 0x34,
+0xFC, 0xF5, 0x83, 0xE0, 0x54, 0xF0, 0xF0, 0x74, 0x21, 0x2B, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5,
+0x83, 0xE0, 0x54, 0xF7, 0xF0, 0xAE, 0x02, 0xAF, 0x03, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0xE4, 0xFD, 0xFC, 0xEF, 0x30, 0xE0, 0x02, 0x7D, 0x80, 0xEF, 0xC3,
+0x13, 0x90, 0xFD, 0x10, 0xF0, 0xAE, 0x04, 0xAF, 0x05, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x12, 0x5F,
+0xA6, 0xBF, 0x01, 0x10, 0x90, 0x02, 0x09, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5F, 0xDE, 0x90, 0x04,
+0x1F, 0x74, 0x20, 0xF0, 0x22, 0x90, 0x01, 0x02, 0xE0, 0x54, 0x03, 0xFF, 0xE0, 0x54, 0x0C, 0x13,
+0x13, 0x54, 0x3F, 0xFE, 0xEF, 0x64, 0x01, 0x60, 0x04, 0xEF, 0xB4, 0x03, 0x0E, 0x90, 0x8A, 0xC5,
+0x74, 0x01, 0xF0, 0xA3, 0x74, 0x37, 0xF0, 0x79, 0x01, 0x80, 0x18, 0xEE, 0x64, 0x01, 0x60, 0x07,
+0xAF, 0x06, 0xEE, 0x64, 0x03, 0x70, 0x3B, 0x90, 0x8A, 0xC5, 0x74, 0x01, 0xF0, 0xA3, 0x74, 0x3D,
+0xF0, 0x79, 0x40, 0x90, 0x8A, 0xC5, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xF5, 0x82, 0x8E, 0x83, 0xE0,
+0x59, 0x60, 0x08, 0xE9, 0xF0, 0xE4, 0x90, 0x8A, 0xF6, 0xF0, 0x22, 0x90, 0x8A, 0xF6, 0xE0, 0x04,
+0xF0, 0xE0, 0xC3, 0x94, 0x0A, 0x40, 0x0B, 0xE4, 0xF0, 0x90, 0x04, 0x19, 0xE0, 0x30, 0xE0, 0x02,
+0x11, 0x6E, 0x22, 0xC0, 0xE0, 0xC0, 0xF0, 0xC0, 0x83, 0xC0, 0x82, 0xC0, 0xD0, 0x75, 0xD0, 0x00,
+0xC0, 0x00, 0xC0, 0x01, 0xC0, 0x02, 0xC0, 0x03, 0xC0, 0x04, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07,
+0x90, 0x01, 0xC4, 0x74, 0xF3, 0xF0, 0x74, 0x60, 0xA3, 0xF0, 0x90, 0x01, 0x34, 0xE0, 0x55, 0x28,
+0xF5, 0x2C, 0xA3, 0xE0, 0x55, 0x29, 0xF5, 0x2D, 0xA3, 0xE0, 0x55, 0x2A, 0xF5, 0x2E, 0xA3, 0xE0,
+0x55, 0x2B, 0xF5, 0x2F, 0xE5, 0x2C, 0x20, 0xE0, 0x02, 0x41, 0x8A, 0x90, 0x01, 0x34, 0x74, 0x01,
+0xF0, 0x85, 0xD1, 0x4D, 0x85, 0xD2, 0x4E, 0x85, 0xD3, 0x4F, 0x85, 0xD4, 0x50, 0x85, 0xD5, 0x51,
+0x85, 0xD6, 0x52, 0x85, 0xD7, 0x53, 0x85, 0xD9, 0x54, 0xE5, 0x54, 0x54, 0x40, 0xC3, 0x13, 0xFF,
+0xE5, 0x53, 0x54, 0x20, 0x6F, 0x70, 0x02, 0x41, 0x47, 0xE5, 0x54, 0x30, 0xE5, 0x02, 0x41, 0x47,
+0xE5, 0x52, 0x54, 0x1F, 0xF5, 0x08, 0xE5, 0x4D, 0x54, 0x3F, 0xF5, 0x09, 0xE5, 0x51, 0x54, 0x1F,
+0xFF, 0xE5, 0x08, 0x25, 0xE0, 0x24, 0xE3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0x8F,
+0xF0, 0x12, 0x42, 0x81, 0xE5, 0x53, 0x54, 0x1F, 0xFF, 0xE5, 0x08, 0x25, 0xE0, 0x24, 0xC0, 0xF5,
+0x82, 0xE4, 0x34, 0x85, 0xF5, 0x83, 0xE4, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xE5, 0x09, 0xD3, 0x94,
+0x04, 0x40, 0x03, 0x75, 0x09, 0x04, 0x75, 0xF0, 0x0A, 0xE5, 0x08, 0x90, 0x84, 0x00, 0x12, 0x43,
+0x5F, 0x75, 0xF0, 0x02, 0xE5, 0x09, 0x12, 0x43, 0x5F, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0xE5, 0x53,
+0x54, 0x1F, 0x2F, 0xFF, 0xE4, 0x3E, 0xFE, 0x75, 0xF0, 0x0A, 0xE5, 0x08, 0x90, 0x84, 0x00, 0x12,
+0x43, 0x5F, 0x75, 0xF0, 0x02, 0xE5, 0x09, 0x12, 0x43, 0x5F, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0xE5,
+0x54, 0x20, 0xE6, 0x24, 0xE5, 0x53, 0x54, 0x1F, 0xFF, 0xE5, 0x08, 0x25, 0xE0, 0x24, 0x63, 0xF5,
+0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xE5, 0x4F, 0x30, 0xE7,
+0x36, 0xAF, 0x08, 0x12, 0x5D, 0x36, 0x80, 0x2F, 0xE5, 0x53, 0x54, 0x1F, 0xFF, 0xE5, 0x08, 0x25,
+0xE0, 0x24, 0xA3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE4, 0x8F, 0xF0, 0x12, 0x42, 0x81,
+0xE5, 0x4F, 0x30, 0xE7, 0x12, 0xE5, 0x4F, 0x54, 0x7F, 0xFD, 0xE5, 0x53, 0x54, 0x1F, 0xF5, 0x0D,
+0xAB, 0x09, 0xAF, 0x08, 0x12, 0x5C, 0xD9, 0xE5, 0x24, 0x14, 0x24, 0xFD, 0x50, 0x02, 0x80, 0x3A,
+0x90, 0x8B, 0x1A, 0xE0, 0x60, 0x2B, 0x90, 0x01, 0x5B, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x04,
+0xF0, 0x12, 0x4B, 0x34, 0xEF, 0x64, 0x01, 0x70, 0x21, 0x90, 0x8B, 0x3D, 0x12, 0x4B, 0x5C, 0x90,
+0x01, 0x5B, 0x74, 0x05, 0xF0, 0x90, 0x06, 0x92, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x18, 0xF0, 0x80,
+0x09, 0x12, 0x4B, 0x34, 0xBF, 0x01, 0x03, 0x12, 0x4A, 0xFC, 0xE5, 0x2C, 0x30, 0xE1, 0x20, 0x90,
+0x01, 0x34, 0x74, 0x02, 0xF0, 0x85, 0xD1, 0x56, 0x85, 0xD2, 0x57, 0x85, 0xD3, 0x58, 0x85, 0xD4,
+0x59, 0x85, 0xD5, 0x5A, 0x85, 0xD6, 0x5B, 0x85, 0xD7, 0x5C, 0x85, 0xD9, 0x5D, 0xB1, 0x5F, 0xE5,
+0x2C, 0x30, 0xE3, 0x06, 0x90, 0x01, 0x34, 0x74, 0x08, 0xF0, 0xE5, 0x2C, 0x30, 0xE4, 0x09, 0x90,
+0x01, 0x34, 0x74, 0x10, 0xF0, 0x43, 0x55, 0x10, 0xE5, 0x2C, 0x30, 0xE5, 0x26, 0x90, 0x01, 0xCF,
+0xE0, 0x30, 0xE5, 0x1F, 0xE0, 0x54, 0xDF, 0xF0, 0x90, 0x01, 0x34, 0x74, 0x20, 0xF0, 0x75, 0xA8,
+0x00, 0x75, 0xE8, 0x00, 0x12, 0x52, 0x10, 0x90, 0x00, 0x03, 0xE0, 0x54, 0xFB, 0xF0, 0x12, 0x52,
+0x81, 0x80, 0xFE, 0xE5, 0x2C, 0x30, 0xE6, 0x2D, 0x90, 0x01, 0x34, 0x74, 0x40, 0xF0, 0x90, 0x8B,
+0x32, 0xE0, 0x30, 0xE0, 0x0C, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x05, 0x90, 0x8B, 0x34, 0xE4,
+0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0xFF, 0x30, 0xE0, 0x0C, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x05,
+0x90, 0x8B, 0x2E, 0xE4, 0xF0, 0xE5, 0x2E, 0x20, 0xE0, 0x02, 0x61, 0xE7, 0x90, 0x8B, 0x08, 0x74,
+0x01, 0xF0, 0x90, 0x01, 0x36, 0xF0, 0x90, 0x8B, 0x06, 0xE0, 0x60, 0x0F, 0xE4, 0xF0, 0x90, 0x05,
+0x53, 0xE0, 0x44, 0x02, 0xF0, 0x90, 0x05, 0xFC, 0xE0, 0x04, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0x30,
+0xE0, 0x2F, 0x90, 0x8B, 0x37, 0x74, 0x01, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0xFF, 0x13, 0x13, 0x54,
+0x3F, 0x30, 0xE0, 0x1D, 0x90, 0x8B, 0x34, 0x74, 0x01, 0xF0, 0xB1, 0x39, 0x90, 0x8B, 0x33, 0xE0,
+0x64, 0x03, 0x60, 0x0D, 0x7F, 0x01, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x05, 0x7F, 0x04, 0x12, 0x4E,
+0x89, 0x90, 0x8B, 0x2C, 0xE0, 0xFF, 0x30, 0xE0, 0x56, 0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x4F,
+0x90, 0x8B, 0x2E, 0x74, 0x01, 0xF0, 0xB1, 0x39, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x3F,
+0xB1, 0xF0, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x2D, 0xE0, 0xFF, 0x64, 0x06, 0x60,
+0x2E, 0xEF, 0xB4, 0x04, 0x02, 0x80, 0x07, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x04, 0xE4, 0xFF,
+0x80, 0x14, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0x80, 0x09, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x02, 0x05, 0x7F, 0x01, 0x12, 0x7B, 0x49, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x12,
+0x43, 0xE7, 0x90, 0x8B, 0x08, 0xE4, 0xF0, 0xE5, 0x2E, 0x30, 0xE1, 0x2F, 0x90, 0x01, 0x36, 0x74,
+0x02, 0xF0, 0x43, 0x55, 0x40, 0x11, 0x85, 0x90, 0x8B, 0x37, 0xE0, 0xB4, 0x01, 0x09, 0x90, 0x05,
+0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x37, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x0D, 0xE4, 0xFF,
+0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x05, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0xE5, 0x2E, 0x30, 0xE2, 0x16,
+0x90, 0x01, 0x36, 0x74, 0x04, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x06, 0xA3, 0xE0, 0x64,
+0x06, 0x60, 0x03, 0x12, 0x46, 0xB3, 0xE5, 0x2E, 0x30, 0xE3, 0x38, 0x90, 0x01, 0x36, 0x74, 0x08,
+0xF0, 0xE5, 0x21, 0x64, 0x01, 0x70, 0x2C, 0xE5, 0x24, 0x60, 0x28, 0x90, 0x01, 0x57, 0xE4, 0xF0,
+0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x90, 0x8B, 0x3D, 0xE4, 0xF0, 0x90, 0x8B, 0x11, 0xE0, 0x90,
+0x8B, 0x3E, 0xF0, 0xE4, 0xFB, 0xFD, 0x7F, 0x54, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x57,
+0x74, 0x05, 0xF0, 0xE5, 0x2E, 0x30, 0xE4, 0x2B, 0x90, 0x01, 0x36, 0x74, 0x10, 0xF0, 0xE5, 0x21,
+0xB4, 0x01, 0x20, 0xE5, 0x24, 0x60, 0x1C, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74,
+0x02, 0xF0, 0x90, 0x8B, 0x1B, 0xE4, 0xF0, 0x53, 0x25, 0xFD, 0xE5, 0x25, 0x54, 0x07, 0x70, 0x03,
+0x12, 0x4A, 0xFC, 0xE5, 0x2E, 0x30, 0xE5, 0x1F, 0x90, 0x01, 0x36, 0x74, 0x20, 0xF0, 0xE5, 0x21,
+0xB4, 0x01, 0x14, 0xE5, 0x24, 0x60, 0x10, 0x90, 0x8B, 0x1A, 0xE0, 0x64, 0x02, 0x60, 0x05, 0x12,
+0x4A, 0x97, 0x80, 0x03, 0x12, 0x49, 0x49, 0xE5, 0x2E, 0x30, 0xE6, 0x1B, 0x90, 0x01, 0x36, 0x74,
+0x40, 0xF0, 0xE5, 0x21, 0xB4, 0x01, 0x10, 0xE5, 0x24, 0x60, 0x0C, 0x53, 0x25, 0xFE, 0xE5, 0x25,
+0x54, 0x07, 0x70, 0x03, 0x12, 0x4A, 0xFC, 0xE5, 0x2F, 0x30, 0xE1, 0x27, 0x90, 0x01, 0x37, 0x74,
+0x02, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0x30, 0xE0, 0x17, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60,
+0x07, 0x12, 0x48, 0xFE, 0xD1, 0x20, 0x80, 0x0B, 0x90, 0x8B, 0x31, 0x74, 0x01, 0xF0, 0x80, 0x03,
+0x12, 0x48, 0xFE, 0x74, 0xF3, 0x04, 0x90, 0x01, 0xC4, 0xF0, 0x74, 0x60, 0xA3, 0xF0, 0xD0, 0x07,
+0xD0, 0x06, 0xD0, 0x05, 0xD0, 0x04, 0xD0, 0x03, 0xD0, 0x02, 0xD0, 0x01, 0xD0, 0x00, 0xD0, 0xD0,
+0xD0, 0x82, 0xD0, 0x83, 0xD0, 0xF0, 0xD0, 0xE0, 0x32, 0xE4, 0x90, 0x8B, 0x3D, 0xF0, 0x90, 0x05,
+0x58, 0xE0, 0xFF, 0x90, 0x8B, 0x38, 0xE0, 0x2F, 0x24, 0xFE, 0x90, 0x8B, 0x3E, 0xF0, 0xE4, 0xFB,
+0xFD, 0x7F, 0x50, 0x7E, 0x01, 0x12, 0x4B, 0x6C, 0x90, 0x01, 0x53, 0x74, 0x05, 0xF0, 0x22, 0x90,
+0x8A, 0xC5, 0xE0, 0x54, 0xF0, 0x44, 0x03, 0xF0, 0x54, 0x0F, 0x44, 0x80, 0xF0, 0x7B, 0x00, 0x7A,
+0x00, 0x79, 0x56, 0x90, 0x8B, 0x48, 0x12, 0x43, 0x8B, 0x0B, 0x7A, 0x8A, 0x79, 0xC5, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8B, 0x45, 0x12, 0x43, 0x8B, 0x90, 0x8B, 0x53, 0xE0, 0xFF,
+0x04, 0xF0, 0x90, 0x00, 0x01, 0xEF, 0x12, 0x42, 0x5F, 0x7F, 0xAF, 0x7E, 0x01, 0xD1, 0x8A, 0xEF,
+0x60, 0x49, 0x90, 0x8B, 0x45, 0x12, 0x43, 0x6B, 0x8B, 0x1D, 0x8A, 0x1E, 0x89, 0x1F, 0x75, 0x20,
+0x02, 0x7B, 0x01, 0x7A, 0x01, 0x79, 0xA0, 0x12, 0x5F, 0x57, 0x90, 0x8B, 0x48, 0x12, 0x43, 0x6B,
+0x8B, 0x1D, 0x8A, 0x1E, 0x89, 0x1F, 0x90, 0x8B, 0x45, 0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0xFF,
+0xC4, 0x54, 0x0F, 0xF5, 0x20, 0x7B, 0x01, 0x7A, 0x01, 0x79, 0xA2, 0x12, 0x5F, 0x57, 0x90, 0x01,
+0xAF, 0x74, 0xFF, 0xF0, 0x90, 0x01, 0xCB, 0xE0, 0x64, 0x80, 0xF0, 0xD0, 0xD0, 0x92, 0xAF, 0x22,
+0x90, 0x8B, 0x2C, 0xE0, 0xFF, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x30, 0xE0, 0x0B, 0xA3, 0xE0, 0x64,
+0x06, 0x60, 0x05, 0x7F, 0x06, 0x12, 0x7B, 0x49, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60, 0x02,
+0xD1, 0x13, 0x22, 0x90, 0x8B, 0x31, 0xE0, 0xB4, 0x01, 0x05, 0xE4, 0xF0, 0x12, 0x48, 0xFE, 0x22,
+0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x06, 0x60, 0x3C, 0xE5, 0x22, 0x54, 0x0F, 0x14, 0x60, 0x2E, 0x14,
+0x60, 0x1E, 0x24, 0xFE, 0x60, 0x0E, 0x24, 0xF8, 0x70, 0x2A, 0xE4, 0x90, 0x8B, 0x2D, 0xF0, 0x90,
+0x05, 0x22, 0xF0, 0x22, 0x90, 0x8B, 0x2D, 0x74, 0x01, 0xF0, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x22,
+0x90, 0x8B, 0x2D, 0x74, 0x03, 0xF0, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x22, 0x90, 0x01, 0xC6,
+0xE0, 0x44, 0x08, 0xF0, 0x22, 0xAE, 0x07, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF, 0x60, 0x18, 0x90,
+0x8B, 0x2C, 0xE0, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x20, 0xE0, 0x0C, 0xAF, 0x06, 0x7D, 0x01, 0x12,
+0x45, 0xA2, 0xD1, 0x20, 0x7F, 0x01, 0x22, 0x7F, 0x00, 0x22, 0x90, 0x8B, 0x4B, 0xEE, 0xF0, 0xA3,
+0xEF, 0xF0, 0xE4, 0xA3, 0xF0, 0xA3, 0xF0, 0x90, 0x8B, 0x4B, 0xE0, 0xFE, 0xA3, 0xE0, 0xF5, 0x82,
+0x8E, 0x83, 0xE0, 0x60, 0x2C, 0xC3, 0x90, 0x8B, 0x4E, 0xE0, 0x94, 0xE8, 0x90, 0x8B, 0x4D, 0xE0,
+0x94, 0x03, 0x40, 0x0A, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x10, 0xF0, 0x7F, 0x00, 0x22, 0x90, 0x8B,
+0x4D, 0xE4, 0x75, 0xF0, 0x01, 0x12, 0x42, 0x81, 0x7F, 0x0A, 0x7E, 0x00, 0x12, 0x37, 0x54, 0x80,
+0xC6, 0x7F, 0x01, 0x22, 0x75, 0x28, 0x33, 0xE4, 0xF5, 0x29, 0x75, 0x2A, 0x07, 0xF5, 0x2B, 0x90,
+0x01, 0x30, 0xE5, 0x28, 0xF0, 0xA3, 0xE5, 0x29, 0xF0, 0xA3, 0xE5, 0x2A, 0xF0, 0xA3, 0xE5, 0x2B,
+0xF0, 0x22, 0x75, 0x30, 0x1F, 0x75, 0x31, 0x01, 0x43, 0x31, 0x10, 0xE4, 0xF5, 0x32, 0x90, 0x01,
+0x38, 0xE5, 0x30, 0xF0, 0xA3, 0xE5, 0x31, 0xF0, 0xA3, 0xE5, 0x32, 0xF0, 0x22, 0x22, 0x90, 0x00,
+0x02, 0xE0, 0x54, 0xE0, 0x7F, 0x01, 0x60, 0x02, 0x7F, 0x00, 0x22, 0x90, 0x00, 0xF3, 0xE0, 0x7F,
+0x00, 0x30, 0xE3, 0x02, 0x7F, 0x01, 0x22, 0x90, 0x8B, 0x09, 0xE0, 0xB4, 0x01, 0x0C, 0x90, 0x00,
+0xF2, 0xE0, 0x30, 0xE7, 0x05, 0x7E, 0xFD, 0x7F, 0x33, 0x22, 0x7E, 0xFD, 0x7F, 0x2F, 0x22, 0x90,
+0x00, 0xF3, 0xE0, 0x30, 0xE2, 0x0D, 0x90, 0x05, 0x41, 0x74, 0x10, 0xF0, 0x90, 0x05, 0x5A, 0xF0,
+0xA3, 0xE4, 0xF0, 0x22, 0x90, 0x01, 0x64, 0x74, 0xA0, 0xF0, 0x22, 0xC0, 0xE0, 0xC0, 0x83, 0xC0,
+0x82, 0xC0, 0xD0, 0x75, 0xD0, 0x00, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07, 0x7D, 0x5B, 0x90, 0x01,
+0xC4, 0xED, 0xF0, 0x74, 0x67, 0xFF, 0xA3, 0xF0, 0x53, 0x91, 0xEF, 0x90, 0x00, 0x51, 0xE0, 0xFE,
+0x90, 0x00, 0x55, 0xE0, 0x5E, 0xF5, 0x3D, 0x90, 0x00, 0x52, 0xE0, 0xFE, 0x90, 0x00, 0x56, 0xE0,
+0x5E, 0xF5, 0x3E, 0xE5, 0x3D, 0x30, 0xE4, 0x06, 0x90, 0x00, 0x55, 0x74, 0x10, 0xF0, 0xE5, 0x3D,
+0x30, 0xE5, 0x06, 0x90, 0x00, 0x55, 0x74, 0x20, 0xF0, 0xE5, 0x3D, 0x30, 0xE6, 0x06, 0x90, 0x00,
+0x55, 0x74, 0x40, 0xF0, 0xE5, 0x3D, 0x30, 0xE7, 0x06, 0x90, 0x00, 0x55, 0x74, 0x80, 0xF0, 0xE5,
+0x3E, 0x30, 0xE0, 0x06, 0x90, 0x00, 0x56, 0x74, 0x01, 0xF0, 0xE5, 0x3E, 0x30, 0xE1, 0x06, 0x90,
+0x00, 0x56, 0x74, 0x02, 0xF0, 0xE5, 0x3E, 0x30, 0xE2, 0x06, 0x90, 0x00, 0x56, 0x74, 0x04, 0xF0,
+0xE5, 0x3E, 0x30, 0xE3, 0x06, 0x90, 0x00, 0x56, 0x74, 0x08, 0xF0, 0x90, 0x01, 0xC4, 0xED, 0xF0,
+0xA3, 0xEF, 0xF0, 0xD0, 0x07, 0xD0, 0x06, 0xD0, 0x05, 0xD0, 0xD0, 0xD0, 0x82, 0xD0, 0x83, 0xD0,
+0xE0, 0x32, 0xEF, 0xC3, 0x94, 0x20, 0x50, 0x39, 0xEF, 0x30, 0xE0, 0x17, 0xED, 0xC4, 0x54, 0xF0,
+0xFD, 0xEF, 0xC3, 0x13, 0xFE, 0x24, 0xA4, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54,
+0x0F, 0x80, 0x10, 0xEF, 0xC3, 0x13, 0xFE, 0x24, 0xA4, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83,
+0xE0, 0x54, 0xF0, 0xF0, 0x74, 0xA4, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0x4D,
+0xF0, 0x22, 0xE4, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0xC3, 0x94, 0x20, 0x40,
+0x02, 0xC1, 0xCD, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2A, 0x12, 0x43, 0x5F, 0xE0, 0x64, 0x01,
+0x60, 0x02, 0xC1, 0xC5, 0x90, 0x8A, 0xCF, 0xE0, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34,
+0x85, 0xF5, 0x83, 0xE0, 0xFC, 0xA3, 0xE0, 0xD3, 0x94, 0x00, 0xEC, 0x94, 0x00, 0x50, 0x02, 0xC1,
+0xC5, 0xEF, 0x75, 0xF0, 0x0A, 0xA4, 0x24, 0x00, 0xF9, 0x74, 0x84, 0x35, 0xF0, 0x75, 0x12, 0x01,
+0xF5, 0x13, 0x89, 0x14, 0x90, 0x8A, 0xCF, 0xE0, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34,
+0x85, 0xF5, 0x83, 0xE0, 0xFD, 0xA3, 0xE0, 0x90, 0x8A, 0xD4, 0xCD, 0xF0, 0xA3, 0xED, 0xF0, 0xEF,
+0x25, 0xE0, 0x24, 0x63, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE0, 0xFF, 0xA3, 0xE0, 0x90,
+0x8A, 0xD6, 0xCF, 0xF0, 0xA3, 0xEF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFE, 0x24, 0x84, 0xF5, 0x82,
+0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0x3F, 0x90, 0x8A, 0xD0, 0xF0, 0xE0, 0xFD, 0x54, 0x1F,
+0xA3, 0xF0, 0x75, 0xF0, 0x09, 0xEE, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0xE0, 0x90, 0x8A, 0xD9,
+0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFB, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0,
+0xC3, 0x94, 0x05, 0x40, 0x02, 0x61, 0x1A, 0x90, 0x8A, 0xD9, 0xE0, 0xFE, 0x90, 0x8A, 0xD1, 0xE0,
+0x9E, 0x40, 0x13, 0x90, 0x8A, 0xD9, 0xE0, 0x90, 0x8A, 0xD1, 0xF0, 0xED, 0x54, 0x40, 0xFD, 0x90,
+0x8A, 0xD0, 0xF0, 0xEE, 0x4D, 0xF0, 0x90, 0x8A, 0xD1, 0xE0, 0xFF, 0x90, 0x41, 0x12, 0x93, 0xFE,
+0x74, 0x23, 0x2B, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xC3, 0x9E, 0x40, 0x06, 0xEF,
+0x90, 0x40, 0xDA, 0x80, 0x07, 0x90, 0x8A, 0xD1, 0xE0, 0x90, 0x40, 0xF6, 0x93, 0x90, 0x8A, 0xD8,
+0xF0, 0x90, 0x8A, 0xD8, 0xE0, 0x75, 0xF0, 0x06, 0xA4, 0x24, 0x50, 0xF9, 0x74, 0x40, 0x35, 0xF0,
+0x75, 0x0F, 0xFF, 0xF5, 0x10, 0x89, 0x11, 0x90, 0x8A, 0xD0, 0xE0, 0x90, 0x41, 0xBA, 0x93, 0xFF,
+0xD3, 0x90, 0x8A, 0xD7, 0xE0, 0x9F, 0x90, 0x8A, 0xD6, 0xE0, 0x94, 0x00, 0x40, 0x0C, 0x90, 0x8A,
+0xCF, 0xE0, 0xFF, 0xE4, 0xFD, 0x12, 0x5D, 0xB4, 0xC1, 0x5B, 0x90, 0x8A, 0xCF, 0xE0, 0x25, 0xE0,
+0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFF, 0xA3, 0xE0, 0x90, 0x8A, 0xD2,
+0xCF, 0xF0, 0xA3, 0xEF, 0xF0, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x12, 0x29, 0xD9, 0xFF, 0x7E,
+0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x12, 0x42, 0x97, 0xFD, 0xAC, 0xF0, 0x12, 0x29, 0xF2,
+0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90,
+0x00, 0x01, 0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00,
+0x02, 0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0x12, 0x29, 0xF2, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0,
+0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF,
+0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x04, 0x12, 0x42, 0xC2, 0xFD, 0xAC,
+0xF0, 0x12, 0x29, 0xF2, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA,
+0x10, 0xA9, 0x11, 0x90, 0x00, 0x03, 0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13,
+0xA9, 0x14, 0x90, 0x00, 0x06, 0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0x12, 0x29, 0xF2, 0x90, 0x8A,
+0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00, 0x04,
+0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x08, 0x12,
+0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0x12, 0x29, 0xF2, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42,
+0x81, 0xAB, 0x0F, 0xAA, 0x10, 0xA9, 0x11, 0x90, 0x00, 0x05, 0x12, 0x42, 0x20, 0xFF, 0x7E, 0x00,
+0x90, 0x8A, 0xD4, 0xE0, 0xFC, 0xA3, 0xE0, 0xFD, 0x12, 0x29, 0xF2, 0xD3, 0x90, 0x8A, 0xD3, 0xE0,
+0x9F, 0x90, 0x8A, 0xD2, 0xE0, 0x9E, 0x40, 0x0C, 0xA3, 0xE0, 0x9F, 0xF0, 0x90, 0x8A, 0xD2, 0xE0,
+0x9E, 0xF0, 0x80, 0x07, 0xE4, 0x90, 0x8A, 0xD2, 0xF0, 0xA3, 0xF0, 0x90, 0x8A, 0xD2, 0xE0, 0xFC,
+0xA3, 0xE0, 0xFD, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xEC, 0xF0, 0xA3, 0xED, 0xF0, 0x90, 0x8A, 0xD0, 0xE0, 0x25, 0xE0, 0x24, 0x2E,
+0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xD3, 0xED,
+0x9B, 0xEC, 0x9A, 0x40, 0x04, 0xD1, 0xCE, 0xC1, 0x29, 0x90, 0x8A, 0xD0, 0xE0, 0x25, 0xE0, 0x24,
+0x66, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFE, 0x74, 0x01, 0x93, 0xFF, 0xC3,
+0x90, 0x8A, 0xD3, 0xE0, 0x9F, 0x90, 0x8A, 0xD2, 0xE0, 0x9E, 0x40, 0x02, 0xC1, 0x29, 0x90, 0x8A,
+0xCF, 0xE0, 0xFF, 0x7D, 0x01, 0x12, 0x5D, 0xB4, 0xC1, 0x29, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24,
+0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0xFC, 0x64, 0x05, 0x60, 0x02, 0x81, 0xF8,
+0x90, 0x87, 0x22, 0xE0, 0xFE, 0xB4, 0x03, 0x0B, 0x90, 0x8A, 0xD1, 0xE0, 0xC3, 0x94, 0x19, 0x40,
+0x3D, 0x80, 0x2E, 0xEE, 0xB4, 0x02, 0x0B, 0x90, 0x8A, 0xD1, 0xE0, 0xC3, 0x94, 0x11, 0x40, 0x2E,
+0x80, 0x1F, 0x90, 0x87, 0x22, 0xE0, 0xFE, 0xB4, 0x01, 0x0B, 0x90, 0x8A, 0xD1, 0xE0, 0xC3, 0x94,
+0x0A, 0x40, 0x1B, 0x80, 0x0C, 0xEE, 0x70, 0x11, 0x90, 0x8A, 0xD1, 0xE0, 0xC3, 0x94, 0x03, 0x40,
+0x0D, 0x90, 0x89, 0x43, 0x74, 0x01, 0xF0, 0x80, 0x05, 0xE4, 0x90, 0x89, 0x43, 0xF0, 0x90, 0x8A,
+0xCF, 0xE0, 0xFE, 0x24, 0x43, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE0, 0x90, 0x8A, 0xDD,
+0xF0, 0x74, 0x23, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE, 0xC3, 0x94, 0x30,
+0x50, 0x0A, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x74, 0x64, 0x2F, 0x81, 0xA3, 0x90, 0x89, 0x43, 0xE0,
+0x64, 0x01, 0x60, 0x02, 0x81, 0x98, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x44, 0xF5, 0x82, 0xE4, 0x34,
+0x89, 0xF5, 0x83, 0xE0, 0x64, 0x0A, 0x60, 0x5B, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0xEE, 0x24, 0x05,
+0xFB, 0xE4, 0x33, 0xFA, 0x74, 0x21, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xE0, 0xFF,
+0xD3, 0x9B, 0xEA, 0x64, 0x80, 0xF8, 0x74, 0x80, 0x98, 0x50, 0x38, 0x90, 0x8A, 0xCF, 0xE0, 0xFE,
+0xEF, 0x24, 0x05, 0xFB, 0xE4, 0x33, 0xFA, 0x74, 0x23, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5,
+0x83, 0xE0, 0xD3, 0x9B, 0xEA, 0x64, 0x80, 0xF8, 0x74, 0x80, 0x98, 0x50, 0x16, 0x90, 0x8A, 0xCF,
+0xE0, 0x24, 0x84, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0xFF, 0x90, 0x8A, 0xD1, 0xE0,
+0x6F, 0x60, 0x56, 0x90, 0x8A, 0xCF, 0xE0, 0x24, 0x23, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83,
+0xE0, 0xFF, 0xD3, 0x94, 0x42, 0x40, 0x08, 0x90, 0x8A, 0xDD, 0x74, 0x05, 0xF0, 0x80, 0x11, 0xEF,
+0xD3, 0x94, 0x39, 0x90, 0x8A, 0xDD, 0x40, 0x05, 0x74, 0x03, 0xF0, 0x80, 0x03, 0x74, 0x01, 0xF0,
+0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x23, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFE,
+0x74, 0x21, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xCF, 0xE0,
+0x24, 0x44, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0x80, 0x2F, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x64,
+0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x44, 0x2F, 0xF5, 0x82, 0xE4, 0x34,
+0x89, 0xF5, 0x83, 0xE0, 0x04, 0xF0, 0x80, 0x14, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x90, 0x8A, 0xCF,
+0xE0, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x90, 0x8A, 0xD1, 0xE0,
+0xFE, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x84, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEE,
+0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFE, 0x74, 0x43, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83,
+0xEE, 0xF0, 0x75, 0xF0, 0x09, 0xEF, 0x90, 0x87, 0x2B, 0x12, 0x43, 0x5F, 0xE0, 0xB4, 0x01, 0x11,
+0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0x74, 0x64, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4,
+0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFD, 0xC1, 0x27, 0xEC, 0x64, 0x06, 0x60, 0x02, 0xC1, 0x29, 0x90,
+0x8A, 0xD2, 0xF0, 0xA3, 0xF0, 0x90, 0x41, 0xDB, 0x93, 0xFF, 0x7E, 0x00, 0x90, 0x8A, 0xD4, 0xE0,
+0xFC, 0xA3, 0xE0, 0xFD, 0x12, 0x29, 0xF2, 0x90, 0x8A, 0xDB, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x90,
+0x8A, 0xCF, 0xE0, 0x24, 0x43, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5, 0x83, 0xE0, 0x90, 0x8A, 0xDD,
+0xF0, 0xE4, 0x90, 0x8A, 0xDA, 0xF0, 0x90, 0x8A, 0xDA, 0xE0, 0xFF, 0xD3, 0x94, 0x04, 0x50, 0x47,
+0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x75, 0xF0, 0x02, 0xEF, 0xA4, 0xF5, 0x82, 0x85, 0xF0, 0x83,
+0x12, 0x42, 0xC2, 0xFD, 0xAC, 0xF0, 0xEF, 0x90, 0x41, 0xD6, 0x93, 0xFF, 0x7E, 0x00, 0x12, 0x29,
+0xF2, 0x90, 0x8A, 0xD2, 0xEE, 0x8F, 0xF0, 0x12, 0x42, 0x81, 0x90, 0x8A, 0xDB, 0xE0, 0xFE, 0xA3,
+0xE0, 0xFF, 0xD3, 0x90, 0x8A, 0xD3, 0xE0, 0x9F, 0x90, 0x8A, 0xD2, 0xE0, 0x9E, 0x50, 0x08, 0x90,
+0x8A, 0xDA, 0xE0, 0x04, 0xF0, 0x80, 0xAF, 0x90, 0x8A, 0xDA, 0xE0, 0xC3, 0x13, 0xF0, 0x90, 0x8A,
+0xDD, 0xE0, 0xFF, 0xB4, 0x01, 0x0D, 0x90, 0x8A, 0xDA, 0xE0, 0x70, 0x5D, 0x90, 0x8A, 0xDD, 0x04,
+0xF0, 0x80, 0x5B, 0xEF, 0xB4, 0x03, 0x1D, 0x90, 0x8A, 0xDA, 0xE0, 0xFF, 0x70, 0x08, 0x90, 0x8A,
+0xDD, 0x74, 0x03, 0xF0, 0x80, 0x48, 0xEF, 0xB4, 0x01, 0x08, 0x90, 0x8A, 0xDD, 0x74, 0x01, 0xF0,
+0x80, 0x3C, 0x80, 0x35, 0x90, 0x8A, 0xDD, 0xE0, 0x64, 0x05, 0x70, 0x32, 0x90, 0x8A, 0xDA, 0xE0,
+0xFF, 0x70, 0x08, 0x90, 0x8A, 0xDD, 0x74, 0x05, 0xF0, 0x80, 0x0F, 0xEF, 0x90, 0x8A, 0xDD, 0xB4,
+0x01, 0x05, 0x74, 0x03, 0xF0, 0x80, 0x03, 0x74, 0x01, 0xF0, 0xD3, 0x90, 0x8A, 0xD7, 0xE0, 0x94,
+0x03, 0x90, 0x8A, 0xD6, 0xE0, 0x94, 0x00, 0x40, 0x05, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0xD3, 0x90,
+0x8A, 0xD7, 0xE0, 0x94, 0x03, 0x90, 0x8A, 0xD6, 0xE0, 0x94, 0x00, 0x40, 0x05, 0xE4, 0x90, 0x8A,
+0xDD, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0xFD, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x43, 0xF5, 0x82,
+0xE4, 0x34, 0x88, 0xF5, 0x83, 0xED, 0xF0, 0x11, 0x02, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x24, 0x64,
+0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0xD3, 0x94, 0x05, 0x50, 0x0F, 0x74, 0x64, 0x2F,
+0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE0, 0x04, 0xF0, 0x80, 0x0F, 0x90, 0x8A, 0xCF, 0xE0,
+0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0xAB, 0x12, 0xAA, 0x13, 0xA9,
+0x14, 0xE4, 0xF5, 0xF0, 0x12, 0x42, 0xFA, 0xAB, 0x12, 0xAA, 0x13, 0xA9, 0x14, 0x90, 0x00, 0x02,
+0xE4, 0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x00, 0x04, 0xE4, 0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90,
+0x00, 0x06, 0xE4, 0xF5, 0xF0, 0x12, 0x43, 0x19, 0x90, 0x00, 0x08, 0xE4, 0xF5, 0xF0, 0x12, 0x43,
+0x19, 0x90, 0x8A, 0xCF, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5,
+0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0x63, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5,
+0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xA3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5,
+0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x04, 0xF0, 0x01, 0x47, 0x22, 0xAD, 0x07,
+0x74, 0x84, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE0, 0x54, 0x7F, 0x90, 0x8A, 0xDE,
+0xF0, 0xE0, 0xF9, 0x54, 0x1F, 0xA3, 0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x27, 0x12, 0x43,
+0x5F, 0xE0, 0xFF, 0x90, 0x8A, 0xE1, 0xF0, 0xED, 0x25, 0xE0, 0x24, 0x81, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xE0, 0xFB, 0xA3, 0xE0, 0x90, 0x8A, 0xE2, 0xCB, 0xF0, 0xA3, 0xEB, 0xF0, 0xED,
+0x25, 0xE0, 0x24, 0xE4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE0, 0xFB, 0xA3, 0xE0, 0x90,
+0x8A, 0xE4, 0xCB, 0xF0, 0xA3, 0xEB, 0xF0, 0x90, 0x8A, 0xDF, 0xE0, 0xFE, 0x25, 0xE0, 0x24, 0x2E,
+0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xED, 0x25,
+0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEA, 0xF0, 0xA3, 0xEB, 0xF0, 0xEE,
+0xC3, 0x9F, 0x40, 0x03, 0x02, 0x70, 0x12, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x74, 0xA5, 0x2D, 0xF5,
+0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0, 0xEF, 0x04, 0x90, 0x8A, 0xE0, 0xF0, 0x90, 0x8A,
+0xE1, 0xE0, 0xFF, 0x90, 0x8A, 0xE0, 0xE0, 0xFE, 0xD3, 0x9F, 0x40, 0x03, 0x02, 0x70, 0x4C, 0xEE,
+0xC3, 0x94, 0x10, 0x40, 0x21, 0xEE, 0x24, 0xF0, 0xFF, 0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08,
+0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9, 0xFF, 0x90, 0x8A, 0xE2, 0xE0, 0x5E, 0xFE,
+0xA3, 0xE0, 0x5F, 0x4E, 0x70, 0x27, 0x90, 0x8A, 0xE0, 0xE0, 0xFF, 0xC3, 0x94, 0x10, 0x50, 0x59,
+0x74, 0x01, 0x7E, 0x00, 0xA8, 0x07, 0x08, 0x80, 0x05, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9,
+0xFF, 0x90, 0x8A, 0xE4, 0xE0, 0x5E, 0xFE, 0xA3, 0xE0, 0x5F, 0x4E, 0x60, 0x3C, 0x90, 0x8A, 0xE0,
+0xE0, 0xB4, 0x11, 0x0D, 0x90, 0x8A, 0xE3, 0xE0, 0x30, 0xE7, 0x06, 0x90, 0x8A, 0xE0, 0x74, 0x17,
+0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xFF, 0x64, 0x13, 0x60, 0x04, 0xEF, 0xB4, 0x12, 0x0D, 0x90, 0x8A,
+0xE2, 0xE0, 0x30, 0xE0, 0x06, 0x90, 0x8A, 0xE0, 0x74, 0x18, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0x90,
+0x8A, 0xDF, 0xF0, 0x90, 0x8A, 0xDE, 0xF0, 0x80, 0x43, 0x90, 0x8A, 0xE0, 0xE0, 0x04, 0xF0, 0x02,
+0x6F, 0x6E, 0x90, 0x8A, 0xE1, 0xE0, 0xFC, 0x90, 0x8A, 0xDF, 0xE0, 0xFF, 0x6C, 0x70, 0x71, 0x74,
+0xA5, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90,
+0x87, 0x29, 0x12, 0x43, 0x5F, 0xE0, 0xB4, 0x01, 0x10, 0xE9, 0x20, 0xE6, 0x0C, 0x90, 0x8A, 0xDF,
+0xE0, 0x44, 0x40, 0x90, 0x8A, 0xDE, 0xF0, 0x80, 0x03, 0xAF, 0x01, 0x22, 0x90, 0x8A, 0xDF, 0xE0,
+0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0xE4, 0x93, 0xFA, 0x74,
+0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0, 0x24, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5, 0x83, 0x74,
+0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93, 0x3A, 0xC3, 0x13, 0xFE, 0xEF, 0x13, 0xFF, 0xED, 0x25, 0xE0,
+0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x80, 0x66,
+0x90, 0x8A, 0xDF, 0xE0, 0xD3, 0x9C, 0x40, 0x5E, 0x90, 0x8A, 0xE1, 0xE0, 0xFF, 0x74, 0xA5, 0x2D,
+0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0, 0x90, 0x8A, 0xDF, 0xEF, 0xF0, 0x90, 0x8A,
+0xDE, 0xF0, 0xFC, 0xA3, 0xE0, 0xFF, 0x25, 0xE0, 0x24, 0x66, 0xF5, 0x82, 0xE4, 0x34, 0x41, 0xF5,
+0x83, 0xE4, 0x93, 0xFA, 0x74, 0x01, 0x93, 0xFB, 0xEF, 0x25, 0xE0, 0x24, 0x2E, 0xF5, 0x82, 0xE4,
+0x34, 0x41, 0xF5, 0x83, 0x74, 0x01, 0x93, 0x2B, 0xFF, 0xE4, 0x93, 0x3A, 0xC3, 0x13, 0xFE, 0xEF,
+0x13, 0xFF, 0xED, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0xEE, 0xF0,
+0xA3, 0xEF, 0xF0, 0xAF, 0x04, 0x22, 0x74, 0x01, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83,
+0xE4, 0xF0, 0xAF, 0x05, 0x90, 0x8A, 0xDE, 0xE0, 0x44, 0x80, 0xFD, 0x12, 0x5C, 0xC1, 0x90, 0x8A,
+0xDE, 0xE0, 0x44, 0x80, 0xFF, 0x22, 0xE4, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0xFF,
+0xC3, 0x94, 0x10, 0x50, 0x14, 0x74, 0xA4, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x04, 0xF5, 0x83, 0xE4,
+0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x04, 0xF0, 0x80, 0xE2, 0xE4, 0x90, 0x8A, 0xCF, 0xF0, 0x90, 0x8A,
+0xCF, 0xE0, 0xFF, 0xC3, 0x94, 0x20, 0x40, 0x02, 0x41, 0xCF, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84,
+0x00, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x02, 0x12,
+0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x04, 0x12, 0x43, 0x5F,
+0xE4, 0xF0, 0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x06, 0x12, 0x43, 0x5F, 0xE4, 0xF0,
+0xA3, 0xF0, 0x75, 0xF0, 0x0A, 0xEF, 0x90, 0x84, 0x08, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0xF0,
+0x74, 0x84, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0x74, 0x13, 0xF0, 0x74, 0x44, 0x2F,
+0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x43, 0x2F, 0xF5, 0x82, 0xE4, 0x34,
+0x88, 0xF5, 0x83, 0xE4, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xC0, 0xF5, 0x82, 0xE4, 0x34, 0x85, 0xF5,
+0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0x63, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5,
+0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xE3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5,
+0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xA3, 0xF5, 0x82, 0xE4, 0x34, 0x88, 0xF5,
+0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0x64, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5,
+0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0xEF, 0x25, 0xE0, 0x24, 0xA4, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5,
+0x83, 0xE4, 0xF0, 0xA3, 0xF0, 0x74, 0x44, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4,
+0xF0, 0x74, 0x24, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x74, 0x64, 0x2F,
+0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xE4, 0xF0, 0x90, 0x41, 0x8C, 0x93, 0xFE, 0x74, 0x01,
+0x93, 0xFF, 0x90, 0x41, 0x54, 0x74, 0x01, 0x93, 0x2F, 0xFF, 0xE4, 0x93, 0x3E, 0xC3, 0x13, 0xFE,
+0xEF, 0x13, 0xFF, 0x90, 0x8A, 0xCF, 0xE0, 0xFD, 0x25, 0xE0, 0x24, 0xE1, 0xF5, 0x82, 0xE4, 0x34,
+0x86, 0xF5, 0x83, 0xEE, 0xF0, 0xA3, 0xEF, 0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x29, 0x12,
+0x43, 0x5F, 0x74, 0x01, 0xF0, 0x74, 0xC1, 0x2D, 0xF5, 0x82, 0xE4, 0x34, 0x86, 0xF5, 0x83, 0x74,
+0x0C, 0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x25, 0x12, 0x43, 0x5F, 0x74, 0xFF, 0xF0, 0xA3,
+0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x23, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0xA3, 0x74, 0x0F,
+0xF0, 0x75, 0xF0, 0x09, 0xED, 0x90, 0x87, 0x27, 0x12, 0x43, 0x5F, 0x74, 0x13, 0xF0, 0x75, 0xF0,
+0x09, 0xED, 0x90, 0x87, 0x28, 0x12, 0x43, 0x5F, 0xE4, 0xF0, 0x74, 0x84, 0x2D, 0xF5, 0x82, 0xE4,
+0x34, 0x04, 0xF5, 0x83, 0x74, 0x13, 0xF0, 0x90, 0x8A, 0xCF, 0xE0, 0x04, 0xF0, 0x21, 0x3E, 0x22,
+0x12, 0x29, 0xD9, 0xFF, 0xC3, 0x94, 0x20, 0x50, 0x14, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFE,
+0x74, 0x23, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x89, 0xF5, 0x83, 0xEE, 0xF0, 0x22, 0xEF, 0xB4, 0x20,
+0x0A, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0x90, 0x87, 0x21, 0xF0, 0x22, 0x12, 0x29, 0xD9, 0xF5,
+0x21, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8A, 0xDA, 0x12, 0x2A, 0x8B, 0x00,
+0x00, 0x00, 0x00, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0x90, 0x8B, 0x1A, 0xF0, 0x90, 0x00, 0x03,
+0x12, 0x42, 0x20, 0x90, 0x8B, 0x0A, 0xF0, 0x12, 0x47, 0xFA, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x90,
+0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0x30, 0xE0, 0x25, 0x12, 0x29, 0xD9, 0x90, 0x8B, 0x10, 0xF0,
+0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0x90, 0x8B, 0x11, 0xF0, 0xEF, 0xC3, 0x13, 0x54, 0x7F, 0x90,
+0x8B, 0x0F, 0xF0, 0x90, 0x00, 0x03, 0x12, 0x42, 0x20, 0x90, 0x8B, 0x16, 0xF0, 0x22, 0x90, 0x8B,
+0x10, 0x74, 0x03, 0xF0, 0x90, 0x8B, 0x11, 0x74, 0x05, 0xF0, 0x90, 0x8B, 0x0F, 0x74, 0x14, 0xF0,
+0x90, 0x8B, 0x16, 0x74, 0x05, 0xF0, 0x22, 0x12, 0x29, 0xD9, 0x30, 0xE0, 0x19, 0xC3, 0x13, 0x54,
+0x7F, 0x90, 0x8B, 0x15, 0xF0, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20, 0xFF, 0x90, 0x8B, 0x13, 0xE4,
+0xF0, 0xA3, 0xEF, 0xF0, 0x80, 0x0F, 0x90, 0x8B, 0x15, 0x74, 0x05, 0xF0, 0x90, 0x8B, 0x13, 0xE4,
+0xF0, 0xA3, 0x74, 0x03, 0xF0, 0x90, 0x8B, 0x13, 0xE0, 0xA3, 0xE0, 0x90, 0x05, 0x58, 0xF0, 0x22,
+0x12, 0x29, 0xD9, 0x90, 0x8B, 0x12, 0xF0, 0x60, 0x07, 0xE4, 0xFD, 0x7F, 0x04, 0x12, 0x45, 0xA2,
+0x90, 0x8B, 0x12, 0xE0, 0x90, 0x01, 0xE7, 0xF0, 0x22, 0x90, 0x02, 0x09, 0xE0, 0xFD, 0x12, 0x29,
+0xD9, 0xFE, 0xAF, 0x05, 0xED, 0x2E, 0x90, 0x8A, 0xF7, 0xF0, 0x90, 0x00, 0x01, 0x12, 0x42, 0x20,
+0xFF, 0xED, 0x2F, 0x90, 0x8A, 0xF8, 0xF0, 0x90, 0x00, 0x02, 0x12, 0x42, 0x20, 0xFF, 0xED, 0x2F,
+0x90, 0x8A, 0xF9, 0xF0, 0x90, 0x00, 0x03, 0x12, 0x42, 0x20, 0xFF, 0xED, 0x2F, 0x90, 0x8A, 0xFA,
+0xF0, 0x90, 0x00, 0x04, 0x12, 0x42, 0x20, 0xFF, 0xAE, 0x05, 0xED, 0x2F, 0x90, 0x8A, 0xFB, 0xF0,
+0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x8B, 0xE4, 0x90,
+0x8A, 0xDD, 0xF0, 0x12, 0x29, 0xD9, 0xC3, 0x13, 0x20, 0xE0, 0x02, 0xA1, 0x62, 0x90, 0x8A, 0xDA,
+0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0xFF, 0x54, 0x02, 0xFE, 0x90, 0x8B, 0x32, 0xE0, 0x54, 0xFD,
+0x4E, 0xFE, 0xF0, 0xEF, 0x54, 0x01, 0xFF, 0xEE, 0x54, 0xFE, 0x4F, 0xFF, 0xF0, 0x12, 0x29, 0xD9,
+0xFE, 0x54, 0x08, 0xFD, 0xEF, 0x54, 0xF7, 0x4D, 0xFF, 0x90, 0x8B, 0x32, 0xF0, 0xEE, 0x54, 0x10,
+0xFE, 0xEF, 0x54, 0xEF, 0x4E, 0xFF, 0xF0, 0x12, 0x29, 0xD9, 0xFE, 0x54, 0x20, 0xFD, 0xEF, 0x54,
+0xDF, 0x4D, 0xFF, 0x90, 0x8B, 0x32, 0xF0, 0xEE, 0x54, 0x40, 0xFE, 0xEF, 0x54, 0xBF, 0x4E, 0xF0,
+0x20, 0xE0, 0x02, 0xA1, 0x4F, 0x90, 0x8A, 0xDD, 0x74, 0x21, 0xF0, 0x90, 0x8A, 0xDA, 0x12, 0x43,
+0x6B, 0x12, 0x29, 0xD9, 0xFF, 0x13, 0x13, 0x54, 0x01, 0xFE, 0x90, 0x8B, 0x32, 0xE0, 0xFD, 0x13,
+0x13, 0x54, 0x01, 0x6E, 0x60, 0x2A, 0xEF, 0x54, 0x04, 0xFF, 0xED, 0x54, 0xFB, 0x4F, 0xF0, 0xE0,
+0x13, 0x13, 0x54, 0x3F, 0x30, 0xE0, 0x0E, 0x90, 0x01, 0x34, 0x74, 0x40, 0xF0, 0xFD, 0xE4, 0xFF,
+0x12, 0x36, 0xE6, 0x80, 0x0B, 0xE4, 0x90, 0x8B, 0x34, 0xF0, 0x7D, 0x40, 0xFF, 0x12, 0x36, 0x75,
+0x90, 0x8B, 0x32, 0xE0, 0xFD, 0x13, 0x13, 0x13, 0x54, 0x1F, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD,
+0xE0, 0x44, 0x12, 0xF0, 0xED, 0xC4, 0x54, 0x0F, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44,
+0x14, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0xC4, 0x13, 0x54, 0x07, 0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD,
+0xE0, 0x44, 0x80, 0xF0, 0x90, 0x8B, 0x32, 0xE0, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x20, 0xE0, 0x07,
+0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x40, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0x90, 0x05, 0x27, 0xF0, 0x90,
+0x8B, 0x33, 0xE0, 0x70, 0x05, 0x7F, 0x01, 0x12, 0x4E, 0x89, 0x90, 0x8B, 0x32, 0xE0, 0xC4, 0x13,
+0x13, 0x54, 0x03, 0x30, 0xE0, 0x04, 0x7F, 0x03, 0x80, 0x0E, 0x7F, 0x01, 0x12, 0x4D, 0xE0, 0xEF,
+0x60, 0x04, 0x7F, 0x01, 0x80, 0x02, 0x7F, 0x02, 0x12, 0x4E, 0x89, 0x7F, 0x02, 0xC1, 0xA4, 0x90,
+0x8A, 0xDD, 0x74, 0x01, 0xF0, 0x90, 0x05, 0x27, 0xF0, 0xE4, 0xFF, 0x12, 0x4E, 0x89, 0x7F, 0x03,
+0xC1, 0xA4, 0x90, 0x8A, 0xDA, 0x12, 0x43, 0x6B, 0x12, 0x29, 0xD9, 0xFF, 0x54, 0x02, 0xFE, 0x90,
+0x8B, 0x2C, 0xE0, 0x54, 0xFD, 0x4E, 0xFE, 0xF0, 0xEF, 0x54, 0x01, 0xFF, 0xEE, 0x54, 0xFE, 0x4F,
+0xFF, 0xF0, 0x12, 0x29, 0xD9, 0xFE, 0x54, 0x08, 0xFD, 0xEF, 0x54, 0xF7, 0x4D, 0xFF, 0x90, 0x8B,
+0x2C, 0xF0, 0xEE, 0x54, 0x10, 0xFE, 0xEF, 0x54, 0xEF, 0x4E, 0xFF, 0xF0, 0x12, 0x29, 0xD9, 0xFE,
+0x54, 0x40, 0xFD, 0xEF, 0x54, 0xBF, 0x4D, 0xFF, 0x90, 0x8B, 0x2C, 0xF0, 0xEE, 0x54, 0x04, 0xFE,
+0xEF, 0x54, 0xFB, 0x4E, 0xF0, 0x20, 0xE0, 0x02, 0xC1, 0x57, 0x90, 0x8A, 0xDD, 0x74, 0x31, 0xF0,
+0x90, 0x8B, 0x2C, 0xE0, 0x13, 0x13, 0x54, 0x3F, 0x20, 0xE0, 0x0B, 0xE4, 0x90, 0x8B, 0x2E, 0xF0,
+0x7D, 0x40, 0xFF, 0x12, 0x36, 0x75, 0x90, 0x8B, 0x2C, 0xE0, 0xFD, 0x13, 0x13, 0x13, 0x54, 0x1F,
+0x30, 0xE0, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x02, 0xF0, 0xED, 0xC4, 0x54, 0x0F, 0x30, 0xE0,
+0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x44, 0x04, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0x54, 0x06, 0x60, 0x0C,
+0x90, 0x01, 0x3E, 0x74, 0x03, 0xF0, 0xFD, 0x7F, 0x02, 0x12, 0x37, 0x00, 0x90, 0x8A, 0xDD, 0xE0,
+0x90, 0x05, 0x27, 0xF0, 0x90, 0x8B, 0x2C, 0xE0, 0xFF, 0xC4, 0x13, 0x13, 0x54, 0x03, 0x30, 0xE0,
+0x0D, 0xA3, 0xE0, 0x64, 0x06, 0x60, 0x2C, 0x7F, 0x06, 0x12, 0x7B, 0x49, 0x80, 0x25, 0x90, 0x8B,
+0x2D, 0xE0, 0xB4, 0x06, 0x1B, 0x7F, 0x01, 0x12, 0x7B, 0x49, 0xE4, 0xFF, 0x12, 0x4D, 0xE0, 0xEF,
+0x60, 0x09, 0x7D, 0x01, 0xAF, 0x23, 0x12, 0x45, 0xA2, 0x80, 0x05, 0x12, 0x4E, 0x56, 0x80, 0x03,
+0x12, 0x66, 0x20, 0x7F, 0x01, 0x80, 0x4D, 0x90, 0x8A, 0xDD, 0x74, 0x01, 0xF0, 0x90, 0x05, 0x27,
+0xF0, 0x7D, 0x03, 0x7F, 0x02, 0x12, 0x36, 0x92, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x06, 0x02, 0x80,
+0x1B, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x02, 0x80, 0x07, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05,
+0x04, 0xE4, 0xFF, 0x80, 0x14, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0x80, 0x09,
+0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x05, 0x7F, 0x01, 0x12, 0x7B, 0x49, 0x12, 0x66, 0x13, 0x12,
+0x4A, 0xFC, 0x7F, 0x03, 0xD1, 0xAB, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xAD, 0x07, 0xEF, 0x64, 0x01,
+0x60, 0x04, 0xEF, 0xB4, 0x03, 0x15, 0x90, 0x8B, 0x32, 0xE0, 0x54, 0xFE, 0xF0, 0x54, 0xFB, 0xF0,
+0xE4, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xED, 0x64, 0x02, 0x60, 0x04,
+0xED, 0xB4, 0x03, 0x15, 0x90, 0x8B, 0x2C, 0xE0, 0x54, 0xFE, 0xF0, 0x54, 0xFB, 0xF0, 0xE4, 0xA3,
+0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0xA3, 0xF0, 0x22, 0x12, 0x29, 0xD9, 0x90, 0x8B, 0x38,
+0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0x90, 0x8A, 0xFD, 0xE0, 0x90, 0x8A, 0xE8,
+0xF0, 0x90, 0x8A, 0xFE, 0xE0, 0xFF, 0xA3, 0xE0, 0x90, 0x8A, 0xE9, 0xCF, 0xF0, 0xA3, 0xEF, 0xF0,
+0xE4, 0x90, 0x8A, 0xE4, 0xF0, 0x90, 0x8A, 0xE4, 0xE0, 0xFF, 0x24, 0x00, 0xF5, 0x82, 0xE4, 0x34,
+0x8B, 0xF5, 0x83, 0xE0, 0xFE, 0x74, 0xEB, 0x2F, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEE,
+0xF0, 0x90, 0x8A, 0xE4, 0xE0, 0x04, 0xF0, 0xE0, 0xB4, 0x04, 0xDA, 0x90, 0x8A, 0xE8, 0xE0, 0x12,
+0x43, 0x94, 0x77, 0x61, 0x00, 0x78, 0xD7, 0x01, 0x77, 0x6C, 0x02, 0x77, 0x6C, 0x03, 0x77, 0x6C,
+0x04, 0x78, 0xD7, 0x05, 0x78, 0xA1, 0x80, 0x78, 0xBA, 0x81, 0x78, 0xD7, 0x82, 0x00, 0x00, 0x78,
+0xD3, 0x90, 0x8A, 0xEE, 0xE0, 0xFF, 0x12, 0x7E, 0x6E, 0x02, 0x78, 0xD7, 0x90, 0x8A, 0xE8, 0xE0,
+0xFF, 0xB4, 0x02, 0x08, 0x90, 0x8A, 0xE5, 0x74, 0x01, 0xF0, 0x80, 0x0F, 0xEF, 0x90, 0x8A, 0xE5,
+0xB4, 0x03, 0x05, 0x74, 0x02, 0xF0, 0x80, 0x03, 0x74, 0x04, 0xF0, 0xC3, 0x90, 0x8A, 0xE9, 0xE0,
+0x94, 0x08, 0x50, 0x79, 0xE4, 0x90, 0x8A, 0xE4, 0xF0, 0x90, 0x8A, 0xE5, 0xE0, 0xFF, 0x90, 0x8A,
+0xE4, 0xE0, 0xC3, 0x9F, 0x40, 0x03, 0x02, 0x78, 0xD7, 0x90, 0x8A, 0xE9, 0xE0, 0xFE, 0xA3, 0xE0,
+0xFF, 0xC3, 0xEE, 0x94, 0x01, 0x90, 0x8A, 0xE4, 0xE0, 0x50, 0x1F, 0xFE, 0x2F, 0xFF, 0xEE, 0xFD,
+0xC3, 0x74, 0x03, 0x9D, 0xFD, 0xE4, 0x94, 0x00, 0xFC, 0x74, 0xEB, 0x2D, 0xF5, 0x82, 0x74, 0x8A,
+0x3C, 0xF5, 0x83, 0xE0, 0xFD, 0x12, 0x51, 0xFB, 0x80, 0x2B, 0xFF, 0xFD, 0xC3, 0x74, 0x03, 0x9D,
+0xFD, 0xE4, 0x94, 0x00, 0xFC, 0x74, 0xEB, 0x2D, 0xF5, 0x82, 0x74, 0x8A, 0x3C, 0xF5, 0x83, 0xE0,
+0xFE, 0xEF, 0xFD, 0x90, 0x8A, 0xEA, 0xE0, 0x2D, 0xFD, 0x90, 0x8A, 0xE9, 0xE0, 0x34, 0x00, 0x8D,
+0x82, 0xF5, 0x83, 0xEE, 0xF0, 0x90, 0x8A, 0xE4, 0xE0, 0x04, 0xF0, 0x80, 0x8C, 0xC3, 0x90, 0x8A,
+0xE9, 0xE0, 0x94, 0x10, 0x40, 0x02, 0x01, 0xD7, 0x90, 0x8A, 0xE8, 0xE0, 0x64, 0x04, 0x60, 0x02,
+0x01, 0xD7, 0x90, 0x8A, 0xEC, 0xE0, 0xFF, 0xE4, 0xFC, 0xFD, 0xFE, 0x78, 0x10, 0x12, 0x2A, 0x6C,
+0xC0, 0x04, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07, 0x90, 0x8A, 0xEB, 0xE0, 0xFF, 0xE4, 0xFC, 0xFD,
+0xFE, 0x78, 0x18, 0x12, 0x2A, 0x6C, 0xD0, 0x03, 0xD0, 0x02, 0xD0, 0x01, 0xD0, 0x00, 0x12, 0x43,
+0x46, 0xC0, 0x04, 0xC0, 0x05, 0xC0, 0x06, 0xC0, 0x07, 0x90, 0x8A, 0xED, 0xE0, 0xFF, 0xE4, 0xFC,
+0xFD, 0xFE, 0x78, 0x08, 0x12, 0x2A, 0x6C, 0xD0, 0x03, 0xD0, 0x02, 0xD0, 0x01, 0xD0, 0x00, 0x12,
+0x43, 0x46, 0xA8, 0x04, 0xA9, 0x05, 0xAA, 0x06, 0xAB, 0x07, 0xA3, 0xE0, 0xFF, 0xE4, 0xFC, 0xFD,
+0xFE, 0x12, 0x43, 0x46, 0xA3, 0x12, 0x2A, 0x7F, 0x90, 0x8A, 0xEF, 0x12, 0x43, 0x53, 0x90, 0x80,
+0x85, 0x12, 0x2A, 0x7F, 0x90, 0x8A, 0xE9, 0xE0, 0xFE, 0xA3, 0xE0, 0xFF, 0x12, 0x2F, 0xD9, 0x80,
+0x36, 0x90, 0x8A, 0xED, 0xE0, 0xFE, 0xA3, 0xE0, 0x24, 0x00, 0xFF, 0xE4, 0x3E, 0xFE, 0x90, 0x8A,
+0xE6, 0xF0, 0xA3, 0xEF, 0xF0, 0x12, 0x37, 0x54, 0x80, 0x1D, 0x90, 0x8A, 0xED, 0xE0, 0xFE, 0xA3,
+0xE0, 0x24, 0x00, 0xFF, 0xE4, 0x3E, 0xFE, 0x90, 0x8A, 0xE6, 0xF0, 0xA3, 0xEF, 0xF0, 0x12, 0x36,
+0xCB, 0x80, 0x04, 0x7F, 0x00, 0x80, 0x02, 0x7F, 0x01, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0xD3, 0x10,
+0xAF, 0x01, 0xC3, 0xC0, 0xD0, 0xE4, 0x90, 0x8A, 0xDD, 0xF0, 0xA3, 0x74, 0x04, 0xF0, 0xA3, 0xE4,
+0xF0, 0x90, 0x8A, 0xE2, 0xF0, 0xA3, 0xF0, 0x90, 0x02, 0x09, 0xE0, 0x90, 0x8A, 0xE1, 0xF0, 0x12,
+0x29, 0xD9, 0xFF, 0x90, 0x8A, 0xE1, 0xE0, 0x2F, 0x90, 0x8A, 0xE0, 0xF0, 0x30, 0xE0, 0x0B, 0x90,
+0x8A, 0xDB, 0xE4, 0xF0, 0xA3, 0x74, 0x80, 0xF0, 0x80, 0x07, 0xE4, 0x90, 0x8A, 0xDB, 0xF0, 0xA3,
+0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xC3, 0x13, 0x90, 0xFD, 0x10, 0xF0, 0x90, 0x8A, 0xDD, 0xE0, 0x24,
+0x20, 0xF0, 0x90, 0x8A, 0xDB, 0xA3, 0xE0, 0xFD, 0xA3, 0xE0, 0xFC, 0x2D, 0xFF, 0x24, 0x01, 0xF5,
+0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0x90, 0x8A, 0xFD, 0xF0, 0x74, 0x02, 0x2F, 0xF5, 0x82,
+0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0xFE, 0xEC, 0x2D, 0x24, 0x03, 0xF5, 0x82, 0xE4, 0x34, 0xFC,
+0xF5, 0x83, 0xE0, 0x24, 0x00, 0xFF, 0xE4, 0x3E, 0x90, 0x8A, 0xFE, 0xF0, 0xA3, 0xEF, 0xF0, 0x90,
+0x8A, 0xDA, 0x74, 0x04, 0xF0, 0x90, 0x8A, 0xDB, 0xA3, 0xE0, 0xFF, 0xA3, 0xE0, 0x2F, 0xFF, 0x90,
+0x8A, 0xDA, 0xE0, 0xFE, 0x2F, 0x24, 0x00, 0xF5, 0x82, 0xE4, 0x34, 0xFC, 0xF5, 0x83, 0xE0, 0xFF,
+0x74, 0xFC, 0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x8A, 0xF5, 0x83, 0xEF, 0xF0, 0x90, 0x8A, 0xDA, 0xE0,
+0x04, 0xF0, 0xE0, 0xB4, 0x08, 0xCF, 0x12, 0x76, 0xF2, 0xEF, 0x70, 0x45, 0x90, 0x01, 0xC3, 0xE0,
+0x60, 0x2B, 0xC3, 0x90, 0x8A, 0xE3, 0xE0, 0x94, 0xE8, 0x90, 0x8A, 0xE2, 0xE0, 0x94, 0x03, 0x40,
+0x09, 0x90, 0x01, 0xC6, 0xE0, 0x44, 0x10, 0xF0, 0x80, 0x79, 0x90, 0x8A, 0xE2, 0xE4, 0x75, 0xF0,
+0x01, 0x12, 0x42, 0x81, 0x7F, 0x0A, 0x7E, 0x00, 0x12, 0x37, 0x54, 0x80, 0xCF, 0x90, 0x01, 0xC6,
+0xE0, 0x90, 0x01, 0xC3, 0x30, 0xE2, 0x05, 0x74, 0xFE, 0xF0, 0x80, 0x57, 0x74, 0xFF, 0xF0, 0x80,
+0x52, 0x90, 0x8A, 0xDD, 0xE0, 0xB4, 0x78, 0x2E, 0xE4, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0x04, 0xF0,
+0x90, 0x8A, 0xDB, 0xE0, 0x70, 0x04, 0xA3, 0xE0, 0x64, 0x80, 0x90, 0x8A, 0xDB, 0x70, 0x05, 0xF0,
+0xA3, 0xF0, 0x80, 0x06, 0xE4, 0xF0, 0xA3, 0x74, 0x80, 0xF0, 0x90, 0x8A, 0xE0, 0xE0, 0xC3, 0x13,
+0x90, 0xFD, 0x10, 0xF0, 0x80, 0x07, 0x90, 0x8A, 0xDD, 0xE0, 0x24, 0x08, 0xF0, 0x90, 0x8A, 0xDE,
+0x74, 0xFF, 0xF5, 0xF0, 0x12, 0x42, 0x81, 0x90, 0x8A, 0xDE, 0xE0, 0x70, 0x02, 0xA3, 0xE0, 0x60,
+0x02, 0x21, 0x32, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x12, 0x29, 0xD9, 0x90, 0x8B, 0x05, 0xF0, 0x90,
+0x00, 0x01, 0x12, 0x42, 0x20, 0x90, 0x8B, 0x06, 0xF0, 0x22, 0xE4, 0xF5, 0x61, 0x22, 0x51, 0x67,
+0x90, 0x8B, 0x33, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x7F, 0x78, 0x7E,
+0x08, 0x12, 0x27, 0xDE, 0x90, 0x8B, 0x1C, 0x12, 0x2A, 0x7F, 0x7F, 0x04, 0x7E, 0x0C, 0x12, 0x27,
+0xDE, 0x90, 0x8B, 0x20, 0x12, 0x2A, 0x7F, 0x7F, 0x00, 0x7E, 0x08, 0x12, 0x27, 0xDE, 0x90, 0x8B,
+0x24, 0x12, 0x2A, 0x7F, 0x90, 0x8B, 0x09, 0xE0, 0x90, 0x8B, 0x1C, 0xB4, 0x01, 0x0D, 0x12, 0x43,
+0x53, 0xEF, 0x54, 0xC7, 0xFF, 0xED, 0x54, 0xC7, 0xFD, 0x80, 0x07, 0x12, 0x43, 0x53, 0xEF, 0x54,
+0xC7, 0xFF, 0xEC, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x78, 0x7E, 0x08, 0x12, 0x2F, 0xD9,
+0x90, 0x8B, 0x20, 0x12, 0x43, 0x53, 0xEF, 0x54, 0x0F, 0xFF, 0xEC, 0x90, 0x80, 0x85, 0x12, 0x2A,
+0x7F, 0x7F, 0x04, 0x7E, 0x0C, 0x12, 0x2F, 0xD9, 0x90, 0x8B, 0x24, 0x12, 0x43, 0x53, 0xEF, 0x44,
+0x02, 0xFF, 0xEC, 0x90, 0x80, 0x85, 0x12, 0x2A, 0x7F, 0x7F, 0x00, 0x7E, 0x08, 0x12, 0x2F, 0xD9,
+0x7F, 0x70, 0x7E, 0x0E, 0x12, 0x27, 0xDE, 0x90, 0x8B, 0x28, 0x12, 0x2A, 0x7F, 0x90, 0x80, 0x85,
+0x12, 0x2A, 0x8B, 0x00, 0x1B, 0x25, 0xA0, 0x7F, 0x70, 0x7E, 0x0E, 0x12, 0x2F, 0xD9, 0x90, 0x80,
+0x59, 0x12, 0x2A, 0x8B, 0x00, 0x00, 0x00, 0x00, 0xE4, 0xFD, 0xFF, 0x12, 0x34, 0x81, 0x90, 0x8B,
+0x09, 0xE0, 0xB4, 0x01, 0x11, 0x90, 0x80, 0x59, 0x12, 0x2A, 0x8B, 0x00, 0x00, 0x00, 0x00, 0xE4,
+0xFD, 0x7F, 0x01, 0x12, 0x34, 0x81, 0x22, 0x51, 0x6D, 0x90, 0x8B, 0x33, 0x74, 0x02, 0xF0, 0x22,
+0x51, 0x67, 0x90, 0x8B, 0x2D, 0x74, 0x04, 0xF0, 0x22, 0xD3, 0x10, 0xAF, 0x01, 0xC3, 0xC0, 0xD0,
+0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0x6F, 0x70, 0x02, 0xA1, 0x15, 0xEF, 0x12, 0x43, 0x94, 0x7B, 0x77,
+0x00, 0x7B, 0xB1, 0x01, 0x7B, 0xF7, 0x02, 0x7C, 0x31, 0x03, 0x7C, 0x69, 0x04, 0x7C, 0xA2, 0x05,
+0x7C, 0xDD, 0x06, 0x00, 0x00, 0x7D, 0x15, 0xEE, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xB1, 0x48, 0xA1,
+0x15, 0x90, 0x8B, 0x2D, 0xE0, 0xFF, 0xB4, 0x05, 0x04, 0xB1, 0x24, 0xA1, 0x15, 0xEF, 0xB4, 0x06,
+0x06, 0x7F, 0x01, 0xB1, 0x39, 0x80, 0x16, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x03, 0x06, 0x7F, 0x01,
+0xB1, 0x1A, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x02, 0xB1, 0x2E, 0xB1, 0x6B, 0xA1,
+0x15, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xB1, 0x48, 0x80, 0x09, 0x90, 0x8B,
+0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xB1, 0x24, 0x90, 0x8B, 0x2D, 0xE0, 0x70, 0x04, 0xB1, 0x61, 0xA1,
+0x15, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4, 0x06, 0x06, 0x7F, 0x01, 0xB1, 0x39, 0xA1, 0x15, 0xEE,
+0xB4, 0x03, 0x06, 0x7F, 0x01, 0xB1, 0x1A, 0xA1, 0x15, 0x90, 0x8B, 0x2D, 0xE0, 0x64, 0x02, 0x60,
+0x02, 0xA1, 0x15, 0xB1, 0x2E, 0xA1, 0x15, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x06, 0x7F, 0x01,
+0xB1, 0x48, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xB1, 0x24, 0x90, 0x8B, 0x2D,
+0xE0, 0x70, 0x04, 0xB1, 0x61, 0x80, 0x16, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4, 0x06, 0x06, 0x7F,
+0x01, 0xB1, 0x39, 0x80, 0x08, 0xEE, 0xB4, 0x03, 0x04, 0x7F, 0x01, 0xB1, 0x1A, 0xB1, 0x8D, 0xA1,
+0x15, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xB1, 0x48, 0x80, 0x09, 0x90, 0x8B,
+0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xB1, 0x24, 0x90, 0x8B, 0x2D, 0xE0, 0x70, 0x04, 0xB1, 0x61, 0x80,
+0x14, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4, 0x06, 0x06, 0xE4, 0xFF, 0xB1, 0x39, 0x80, 0x06, 0xEE,
+0xB4, 0x02, 0x02, 0xB1, 0x2E, 0xB1, 0x76, 0xA1, 0x15, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4, 0x06,
+0x06, 0xE4, 0xFF, 0xB1, 0x39, 0x80, 0x13, 0xEE, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xB1, 0x1A, 0x80,
+0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02, 0x02, 0xB1, 0x2E, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x01,
+0x04, 0xB1, 0x6B, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05, 0x02, 0xB1, 0x24, 0x71, 0x40,
+0x80, 0x73, 0x90, 0x8B, 0x2D, 0xE0, 0xFE, 0xB4, 0x06, 0x06, 0xE4, 0xFF, 0xB1, 0x39, 0x80, 0x13,
+0xEE, 0xB4, 0x03, 0x06, 0x7F, 0x01, 0xB1, 0x1A, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02,
+0x02, 0xB1, 0x2E, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x01, 0x04, 0xB1, 0x6B, 0x80, 0x0B, 0x90, 0x8B,
+0x2D, 0xE0, 0xB4, 0x04, 0x04, 0x7F, 0x01, 0xB1, 0x48, 0xB1, 0x80, 0x80, 0x38, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x04, 0x06, 0x7F, 0x01, 0xB1, 0x48, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x05,
+0x02, 0xB1, 0x24, 0x90, 0x8B, 0x2D, 0xE0, 0x70, 0x04, 0xB1, 0x61, 0x80, 0x16, 0x90, 0x8B, 0x2D,
+0xE0, 0xB4, 0x03, 0x06, 0xE4, 0xFF, 0xB1, 0x1A, 0x80, 0x09, 0x90, 0x8B, 0x2D, 0xE0, 0xB4, 0x02,
+0x02, 0xB1, 0x2E, 0xB1, 0x9A, 0xD0, 0xD0, 0x92, 0xAF, 0x22, 0x12, 0x4A, 0xB2, 0x90, 0x8B, 0x2D,
+0x74, 0x01, 0xF0, 0x22, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0xF0, 0x22, 0x90, 0x05,
+0x22, 0xE4, 0xF0, 0x90, 0x8B, 0x2D, 0x04, 0xF0, 0x22, 0xEF, 0x60, 0x05, 0x90, 0x05, 0x22, 0xE4,
+0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x01, 0xF0, 0x22, 0x90, 0x8B, 0x56, 0xEF, 0xF0, 0x12, 0x4F, 0xED,
+0x90, 0x8B, 0x56, 0xE0, 0x60, 0x05, 0x90, 0x05, 0x22, 0xE4, 0xF0, 0xE4, 0x90, 0x8B, 0x2D, 0xF0,
+0x22, 0x12, 0x4A, 0xCC, 0x90, 0x8B, 0x2D, 0x74, 0x01, 0xF0, 0x22, 0x7F, 0x01, 0x12, 0x4A, 0x7C,
+0xE4, 0x90, 0x8B, 0x2D, 0xF0, 0x22, 0x12, 0x4A, 0x32, 0x90, 0x8B, 0x2D, 0x74, 0x03, 0xF0, 0x22,
+0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x05, 0xF0, 0x22, 0x90, 0x05, 0x22,
+0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x2D, 0x74, 0x02, 0xF0, 0x22, 0x90, 0x05, 0x22, 0x74, 0x6F, 0xF0,
+0x90, 0x8B, 0x2D, 0x74, 0x06, 0xF0, 0x22, 0x90, 0x05, 0x22, 0x74, 0xFF, 0xF0, 0x90, 0x8B, 0x33,
+0x74, 0x04, 0xF0, 0x22, 0x12, 0x4F, 0xED, 0x90, 0x8B, 0x33, 0x74, 0x04, 0xF0, 0x22, 0x90, 0x01,
+0x57, 0xE0, 0x60, 0x3C, 0x90, 0x01, 0x57, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x02, 0xF0, 0x90,
+0x8B, 0x1B, 0xE0, 0x60, 0x07, 0xE4, 0xF0, 0x53, 0x25, 0xFD, 0x80, 0x24, 0x90, 0x8B, 0x0C, 0xE0,
+0x04, 0xF0, 0x53, 0x25, 0xEF, 0x90, 0x8B, 0x10, 0xE0, 0xFF, 0x90, 0x8B, 0x0C, 0xE0, 0xD3, 0x9F,
+0x40, 0x0E, 0xE5, 0x21, 0xB4, 0x01, 0x09, 0x90, 0x8B, 0x0D, 0xE0, 0x70, 0x03, 0xE0, 0x04, 0xF0,
+0x90, 0x01, 0x5B, 0xE0, 0x60, 0x10, 0x90, 0x01, 0x5B, 0xE4, 0xF0, 0x90, 0x01, 0x3C, 0x74, 0x04,
+0xF0, 0xE4, 0x90, 0x8B, 0x18, 0xF0, 0x90, 0x01, 0x5F, 0xE0, 0x60, 0x10, 0x90, 0x01, 0x5F, 0xE4,
+0xF0, 0x90, 0x01, 0x3C, 0x74, 0x08, 0xF0, 0xE4, 0x90, 0x8B, 0x17, 0xF0, 0x22, 0xE4, 0x90, 0x8B,
+0x4F, 0xF0, 0xA3, 0xF0, 0x90, 0x05, 0xF8, 0xE0, 0x70, 0x0F, 0xA3, 0xE0, 0x70, 0x0B, 0xA3, 0xE0,
+0x70, 0x07, 0xA3, 0xE0, 0x70, 0x03, 0x7F, 0x01, 0x22, 0xD3, 0x90, 0x8B, 0x50, 0xE0, 0x94, 0xE8,
+0x90, 0x8B, 0x4F, 0xE0, 0x94, 0x03, 0x40, 0x03, 0x7F, 0x00, 0x22, 0x7F, 0x32, 0x7E, 0x00, 0x12,
+0x37, 0x54, 0x90, 0x8B, 0x4F, 0xE4, 0x75, 0xF0, 0x01, 0x12, 0x42, 0x81, 0x80, 0xC6, 0x8F, 0x0F,
+0xE4, 0x90, 0x8A, 0xF3, 0xF0, 0xE5, 0x0F, 0x14, 0xFE, 0x90, 0x8A, 0xF3, 0xE0, 0xFF, 0xC3, 0x9E,
+0x50, 0x0E, 0xEF, 0x04, 0xFD, 0x12, 0x34, 0xB7, 0x90, 0x8A, 0xF3, 0xE0, 0x04, 0xF0, 0x80, 0xE5,
+0xE5, 0x0F, 0x14, 0xFF, 0x7D, 0xFF, 0x12, 0x34, 0xB7, 0x90, 0x8A, 0xF3, 0xE5, 0x0F, 0xF0, 0x90,
+0x8A, 0xF3, 0xE0, 0xC3, 0x94, 0xFF, 0x50, 0x0F, 0xE0, 0xFF, 0x04, 0xFD, 0x12, 0x34, 0xB7, 0x90,
+0x8A, 0xF3, 0xE0, 0x04, 0xF0, 0x80, 0xE8, 0xAD, 0x0F, 0x7F, 0xFF, 0x02, 0x34, 0xB7, 0xDC, 0xD3,
+};
+#endif
+
+//8188C_Formal_All_PHYforMP_111117	2011-11-23
+//8192C_Formal_92CU_PHYforMP_110817 	2011-11-23
+
+u32 Rtl8192CUPHY_REG_2TArray[PHY_REG_2TArrayLength] = {
+0x024,0x0011800f,
+0x028,0x00ffdb83,
+0x800,0x80040002,
+0x804,0x00000003,
+0x808,0x0000fc00,
+0x80c,0x0000000a,
+0x810,0x10000330, //for Broadcom AP IOT
+0x814,0x020c3d10,
+0x818,0x02200385,
+0x81c,0x00000000,
+0x820,0x01000100,
+0x824,0x00390004,
+0x828,0x01000100,
+0x82c,0x00390004,
+0x830,0x27272727,
+0x834,0x27272727,
+0x838,0x27272727,
+0x83c,0x27272727,
+0x840,0x00010000,
+0x844,0x00010000,
+0x848,0x27272727,
+0x84c,0x27272727,
+0x850,0x00000000,
+0x854,0x00000000,
+0x858,0x569a569a,
+0x85c,0x0c1b25a4,
+0x860,0x66e60230,
+0x864,0x061f0130,
+0x868,0x27272727,
+0x86c,0x2b2b2b27,
+0x870,0x07000700,
+0x874,0x22184000,
+0x878,0x08080808,
+0x87c,0x00000000,
+0x880,0xc0083070,
+0x884,0x000004d5,
+0x888,0x00000000,
+0x88c,0xcc0000c0,
+0x890,0x00000800,
+0x894,0xfffffffe,
+0x898,0x40302010,
+0x89c,0x00706050,
+0x900,0x00000000,
+0x904,0x00000023,
+0x908,0x00000000,
+0x90c,0x81121313,
+0xa00,0x00d047c8,
+0xa04,0x80ff000c,
+0xa08,0x8c838300,
+0xa0c,0x2e68120f,
+0xa10,0x9500bb78,
+0xa14,0x11144028,
+0xa18,0x00881117,
+0xa1c,0x89140f00,
+0xa20,0x1a1b0000,
+0xa24,0x090e1317,
+0xa28,0x00000204,
+0xa2c,0x00d30000,
+0xa70,0x101fbf00,
+0xa74,0x00000007,
+0xc00,0x48071d40,
+0xc04,0x03a05633,
+0xc08,0x000000e4,
+0xc0c,0x6c6c6c6c,
+0xc10,0x08800000,
+0xc14,0x40000100,
+0xc18,0x08800000,
+0xc1c,0x40000100,
+0xc20,0x00000000,
+0xc24,0x00000000,
+0xc28,0x00000000,
+0xc2c,0x00000000,
+0xc30,0x69e9ac44,
+0xc34,0x469652cf,
+0xc38,0x49795994,
+0xc3c,0x0a97971c,
+0xc40,0x1f7c403f,
+0xc44,0x000100b7,
+0xc48,0xec020107,
+0xc4c,0x007f037f,
+0xc50,0x69543420,
+0xc54,0x43bc0094,
+0xc58,0x69543420,
+0xc5c,0x433c0094,
+0xc60,0x00000000,
+0xc64,0x5116848b,
+0xc68,0x47c00bff,
+0xc6c,0x00000036,
+0xc70,0x2c7f000d,
+0xc74,0x2186115b,
+0xc78,0x0000001f,
+0xc7c,0x00b99612,
+0xc80,0x40000100,
+0xc84,0x20f60000,
+0xc88,0x40000100,
+0xc8c,0xa0e40000,
+0xc90,0x00121820,
+0xc94,0x00000000,
+0xc98,0x00121820,
+0xc9c,0x00007f7f,
+0xca0,0x00000000,
+0xca4,0x00000080,
+0xca8,0x00000000,
+0xcac,0x00000000,
+0xcb0,0x00000000,
+0xcb4,0x00000000,
+0xcb8,0x00000000,
+0xcbc,0x28000000,
+0xcc0,0x00000000,
+0xcc4,0x00000000,
+0xcc8,0x00000000,
+0xccc,0x00000000,
+0xcd0,0x00000000,
+0xcd4,0x00000000,
+0xcd8,0x64b22427,
+0xcdc,0x00766932,
+0xce0,0x00222222,
+0xce4,0x00000000,
+0xce8,0x37644302,
+0xcec,0x2f97d40c,
+0xd00,0x00080740,
+0xd04,0x00020403,
+0xd08,0x0000907f,
+0xd0c,0x20010201,
+0xd10,0xa0633333,
+0xd14,0x3333bc43,
+0xd18,0x7a8f5b6b,
+0xd2c,0xcc979975,
+0xd30,0x00000000,
+0xd34,0x80608000,
+0xd38,0x00000000,
+0xd3c,0x00027293,
+0xd40,0x00000000,
+0xd44,0x00000000,
+0xd48,0x00000000,
+0xd4c,0x00000000,
+0xd50,0x6437140a,
+0xd54,0x00000000,
+0xd58,0x00000000,
+0xd5c,0x30032064,
+0xd60,0x4653de68,
+0xd64,0x04518a3c,
+0xd68,0x00002101,
+0xd6c,0x2a201c16,
+0xd70,0x1812362e,
+0xd74,0x322c2220,
+0xd78,0x000e3c24,
+0xe00,0x2a2a2a2a,
+0xe04,0x2a2a2a2a,
+0xe08,0x03902a2a,
+0xe10,0x2a2a2a2a,
+0xe14,0x2a2a2a2a,
+0xe18,0x2a2a2a2a,
+0xe1c,0x2a2a2a2a,
+0xe28,0x00000000,
+0xe30,0x1000dc1f,
+0xe34,0x10008c1f,
+0xe38,0x02140102,
+0xe3c,0x681604c2,
+0xe40,0x01007c00,
+0xe44,0x01004800,
+0xe48,0xfb000000,
+0xe4c,0x000028d1,
+0xe50,0x1000dc1f,
+0xe54,0x10008c1f,
+0xe58,0x02140102,
+0xe5c,0x28160d05,
+0xe60,0x00000010,
+0xe68,0x001b25a4,
+0xe6c,0x63db25a4,
+0xe70,0x63db25a4,
+0xe74,0x0c1b25a4,
+0xe78,0x0c1b25a4,
+0xe7c,0x0c1b25a4,
+0xe80,0x0c1b25a4,
+0xe84,0x63db25a4,
+0xe88,0x0c1b25a4,
+0xe8c,0x63db25a4,
+0xed0,0x63db25a4,
+0xed4,0x63db25a4,
+0xed8,0x63db25a4,
+0xedc,0x001b25a4,
+0xee0,0x001b25a4,
+0xeec,0x6fdb25a4,
+0xf14,0x00000003,
+0xf4c,0x00000000,
+0xf00,0x00000300,
+};
+
+u32 Rtl8192CUPHY_REG_1TArray[PHY_REG_1TArrayLength] = {
+0x024,0x0011800f,
+0x028,0x00ffdb83,
+0x800,0x80040000,
+0x804,0x00000001,
+0x808,0x0000fc00,
+0x80c,0x0000000a,
+0x810,0x10000330, //for Broadcom AP IOT
+0x814,0x020c3d10,
+0x818,0x02200385,
+0x81c,0x00000000,
+0x820,0x01000100,
+0x824,0x00390004,
+0x828,0x00000000,
+0x82c,0x00000000,
+0x830,0x00000000,
+0x834,0x00000000,
+0x838,0x00000000,
+0x83c,0x00000000,
+0x840,0x00010000,
+0x844,0x00000000,
+0x848,0x00000000,
+0x84c,0x00000000,
+0x850,0x00000000,
+0x854,0x00000000,
+0x858,0x569a569a,
+0x85c,0x001b25a4,
+0x860,0x66e60230,
+0x864,0x061f0130,
+0x868,0x00000000,
+0x86c,0x32323200,
+0x870,0x07000700,
+0x874,0x22004000,
+0x878,0x00000808,
+0x87c,0x00000000,
+0x880,0xc0083070,
+0x884,0x000004d5,
+0x888,0x00000000,
+0x88c,0xccc000c0,
+0x890,0x00000800,
+0x894,0xfffffffe,
+0x898,0x40302010,
+0x89c,0x00706050,
+0x900,0x00000000,
+0x904,0x00000023,
+0x908,0x00000000,
+0x90c,0x81121111,
+0xa00,0x00d047c8,
+0xa04,0x80ff000c,
+0xa08,0x8c838300,
+0xa0c,0x2e68120f,
+0xa10,0x9500bb78,
+0xa14,0x11144028,
+0xa18,0x00881117,
+0xa1c,0x89140f00,
+0xa20,0x1a1b0000,
+0xa24,0x090e1317,
+0xa28,0x00000204,
+0xa2c,0x00d30000,
+0xa70,0x101fbf00,
+0xa74,0x00000007,
+0xc00,0x48071d40,
+0xc04,0x03a05611,
+0xc08,0x000000e4,
+0xc0c,0x6c6c6c6c,
+0xc10,0x08800000,
+0xc14,0x40000100,
+0xc18,0x08800000,
+0xc1c,0x40000100,
+0xc20,0x00000000,
+0xc24,0x00000000,
+0xc28,0x00000000,
+0xc2c,0x00000000,
+0xc30,0x69e9ac44,
+0xc34,0x469652cf,
+0xc38,0x49795994,
+0xc3c,0x0a97971c,
+0xc40,0x1f7c403f,
+0xc44,0x000100b7,
+0xc48,0xec020107,
+0xc4c,0x007f037f,
+0xc50,0x69543420,
+0xc54,0x43bc0094,
+0xc58,0x69543420,
+0xc5c,0x433c0094,
+0xc60,0x00000000,
+0xc64,0x5116848b,
+0xc68,0x47c00bff,
+0xc6c,0x00000036,
+0xc70,0x2c7f000d,
+0xc74,0x018610db,
+0xc78,0x0000001f,
+0xc7c,0x00b91612,
+0xc80,0x40000100,
+0xc84,0x20f60000,
+0xc88,0x40000100,
+0xc8c,0x20200000,
+0xc90,0x00121820,
+0xc94,0x00000000,
+0xc98,0x00121820,
+0xc9c,0x00007f7f,
+0xca0,0x00000000,
+0xca4,0x00000080,
+0xca8,0x00000000,
+0xcac,0x00000000,
+0xcb0,0x00000000,
+0xcb4,0x00000000,
+0xcb8,0x00000000,
+0xcbc,0x28000000,
+0xcc0,0x00000000,
+0xcc4,0x00000000,
+0xcc8,0x00000000,
+0xccc,0x00000000,
+0xcd0,0x00000000,
+0xcd4,0x00000000,
+0xcd8,0x64b22427,
+0xcdc,0x00766932,
+0xce0,0x00222222,
+0xce4,0x00000000,
+0xce8,0x37644302,
+0xcec,0x2f97d40c,
+0xd00,0x00000740,
+0xd04,0x00020401,
+0xd08,0x0000907f,
+0xd0c,0x20010201,
+0xd10,0xa0633333,
+0xd14,0x3333bc43,
+0xd18,0x7a8f5b6b,
+0xd2c,0xcc979975,
+0xd30,0x00000000,
+0xd34,0x80608000,
+0xd38,0x00000000,
+0xd3c,0x00027293,
+0xd40,0x00000000,
+0xd44,0x00000000,
+0xd48,0x00000000,
+0xd4c,0x00000000,
+0xd50,0x6437140a,
+0xd54,0x00000000,
+0xd58,0x00000000,
+0xd5c,0x30032064,
+0xd60,0x4653de68,
+0xd64,0x04518a3c,
+0xd68,0x00002101,
+0xd6c,0x2a201c16,
+0xd70,0x1812362e,
+0xd74,0x322c2220,
+0xd78,0x000e3c24,
+0xe00,0x2a2a2a2a,
+0xe04,0x2a2a2a2a,
+0xe08,0x03902a2a,
+0xe10,0x2a2a2a2a,
+0xe14,0x2a2a2a2a,
+0xe18,0x2a2a2a2a,
+0xe1c,0x2a2a2a2a,
+0xe28,0x00000000,
+0xe30,0x1000dc1f,
+0xe34,0x10008c1f,
+0xe38,0x02140102,
+0xe3c,0x681604c2,
+0xe40,0x01007c00,
+0xe44,0x01004800,
+0xe48,0xfb000000,
+0xe4c,0x000028d1,
+0xe50,0x1000dc1f,
+0xe54,0x10008c1f,
+0xe58,0x02140102,
+0xe5c,0x28160d05,
+0xe60,0x00000008,
+0xe68,0x001b25a4,
+0xe6c,0x631b25a0,
+0xe70,0x631b25a0,
+0xe74,0x081b25a0,
+0xe78,0x081b25a0,
+0xe7c,0x081b25a0,
+0xe80,0x081b25a0,
+0xe84,0x631b25a0,
+0xe88,0x081b25a0,
+0xe8c,0x631b25a0,
+0xed0,0x631b25a0,
+0xed4,0x631b25a0,
+0xed8,0x631b25a0,
+0xedc,0x001b25a0,
+0xee0,0x001b25a0,
+0xeec,0x6b1b25a0,
+0xf14,0x00000003,
+0xf4c,0x00000000,
+0xf00,0x00000300,
+};
+
+u32 Rtl8192CUPHY_ChangeTo_1T1RArray[PHY_ChangeTo_1T1RArrayLength] = {
+0x0, };
+
+u32 Rtl8192CUPHY_ChangeTo_1T2RArray[PHY_ChangeTo_1T2RArrayLength] = {
+0x0, };
+
+u32 Rtl8192CUPHY_ChangeTo_2T2RArray[PHY_ChangeTo_2T2RArrayLength] = {
+0x0, };
+
+u32 Rtl8192CUPHY_REG_Array_PG[PHY_REG_Array_PGLength] = {
+0xe00,0xffffffff,0x07090c0c,
+0xe04,0xffffffff,0x01020405,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x0b0c0c0e,
+0xe14,0xffffffff,0x01030506,
+0xe18,0xffffffff,0x0b0c0d0e,
+0xe1c,0xffffffff,0x01030509,
+0x830,0xffffffff,0x07090c0c,
+0x834,0xffffffff,0x01020405,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x0b0c0d0e,
+0x848,0xffffffff,0x01030509,
+0x84c,0xffffffff,0x0b0c0d0e,
+0x868,0xffffffff,0x01030509,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x04040404,
+0xe04,0xffffffff,0x00020204,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x06060606,
+0xe14,0xffffffff,0x00020406,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x04040404,
+0x834,0xffffffff,0x00020204,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x06060606,
+0x848,0xffffffff,0x00020406,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x04040404,
+0xe04,0xffffffff,0x00020204,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x04040404,
+0x834,0xffffffff,0x00020204,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+};
+
+u32  Rtl8192CUPHY_REG_Array_PG_mCard[PHY_REG_Array_PG_mCardLength] = {
+0xe00,0xffffffff,0x0a0c0c0c,
+0xe04,0xffffffff,0x02040608,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x0a0c0d0e,
+0xe14,0xffffffff,0x02040608,
+0xe18,0xffffffff,0x0a0c0d0e,
+0xe1c,0xffffffff,0x02040608,
+0x830,0xffffffff,0x0a0c0c0c,
+0x834,0xffffffff,0x02040608,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x0a0c0d0e,
+0x848,0xffffffff,0x02040608,
+0x84c,0xffffffff,0x0a0c0d0e,
+0x868,0xffffffff,0x02040608,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x04040404,
+0xe04,0xffffffff,0x00020204,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x06060606,
+0xe14,0xffffffff,0x00020406,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x04040404,
+0x834,0xffffffff,0x00020204,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x06060606,
+0x848,0xffffffff,0x00020406,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x04040404,
+0xe04,0xffffffff,0x00020204,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x04040404,
+0x834,0xffffffff,0x00020204,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+};
+
+u32 Rtl8192CUPHY_REG_Array_MP[PHY_REG_Array_MPLength] = {
+0xc30,0x69e9ac4a,
+0xc3c,0x0a979718,
+};
+
+u32 Rtl8192CUPHY_REG_1T_HPArray[PHY_REG_1T_HPArrayLength] = {
+0x024,0x0011800f,
+0x028,0x00ffdb83,
+0x040,0x000c0004,
+0x800,0x80040000,
+0x804,0x00000001,
+0x808,0x0000fc00,
+0x80c,0x0000000a,
+0x810,0x10000330, //for Broadcom AP IOT
+0x814,0x020c3d10,
+0x818,0x02200385,
+0x81c,0x00000000,
+0x820,0x01000100,
+0x824,0x00390204,
+0x828,0x00000000,
+0x82c,0x00000000,
+0x830,0x00000000,
+0x834,0x00000000,
+0x838,0x00000000,
+0x83c,0x00000000,
+0x840,0x00010000,
+0x844,0x00000000,
+0x848,0x00000000,
+0x84c,0x00000000,
+0x850,0x00000000,
+0x854,0x00000000,
+0x858,0x569a569a,
+0x85c,0x001b25a4,
+0x860,0x66e60230,
+0x864,0x061f0130,
+0x868,0x00000000,
+0x86c,0x20202000,
+0x870,0x03000300,
+0x874,0x22004000,
+0x878,0x00000808,
+0x87c,0x00ffc3f1,
+0x880,0xc0083070,
+0x884,0x000004d5,
+0x888,0x00000000,
+0x88c,0xccc000c0,
+0x890,0x00000800,
+0x894,0xfffffffe,
+0x898,0x40302010,
+0x89c,0x00706050,
+0x900,0x00000000,
+0x904,0x00000023,
+0x908,0x00000000,
+0x90c,0x81121111,
+0xa00,0x00d047c8,
+0xa04,0x80ff000c,
+0xa08,0x8c838300,
+0xa0c,0x2e68120f,
+0xa10,0x9500bb78,
+0xa14,0x11144028,
+0xa18,0x00881117,
+0xa1c,0x89140f00,
+0xa20,0x15160000,
+0xa24,0x070b0f12,
+0xa28,0x00000104,
+0xa2c,0x00d30000,
+0xa70,0x101fbf00,
+0xa74,0x00000007,
+0xc00,0x48071d40,
+0xc04,0x03a05611,
+0xc08,0x000000e4,
+0xc0c,0x6c6c6c6c,
+0xc10,0x08800000,
+0xc14,0x40000100,
+0xc18,0x08800000,
+0xc1c,0x40000100,
+0xc20,0x00000000,
+0xc24,0x00000000,
+0xc28,0x00000000,
+0xc2c,0x00000000,
+0xc30,0x69e9ac44,
+0xc34,0x469652cf,
+0xc38,0x49795994,
+0xc3c,0x0a97971c,
+0xc40,0x1f7c403f,
+0xc44,0x000100b7,
+0xc48,0xec020107,
+0xc4c,0x007f037f,
+0xc50,0x6954342e,
+0xc54,0x43bc0094,
+0xc58,0x6954342f,
+0xc5c,0x433c0094,
+0xc60,0x00000000,
+0xc64,0x5116848b,
+0xc68,0x47c00bff,
+0xc6c,0x00000036,
+0xc70,0x2c46000d,
+0xc74,0x018610db,
+0xc78,0x0000001f,
+0xc7c,0x00b91612,
+0xc80,0x24000090,
+0xc84,0x20f60000,
+0xc88,0x24000090,
+0xc8c,0x20200000,
+0xc90,0x00121820,
+0xc94,0x00000000,
+0xc98,0x00121820,
+0xc9c,0x00007f7f,
+0xca0,0x00000000,
+0xca4,0x00000080,
+0xca8,0x00000000,
+0xcac,0x00000000,
+0xcb0,0x00000000,
+0xcb4,0x00000000,
+0xcb8,0x00000000,
+0xcbc,0x28000000,
+0xcc0,0x00000000,
+0xcc4,0x00000000,
+0xcc8,0x00000000,
+0xccc,0x00000000,
+0xcd0,0x00000000,
+0xcd4,0x00000000,
+0xcd8,0x64b22427,
+0xcdc,0x00766932,
+0xce0,0x00222222,
+0xce4,0x00000000,
+0xce8,0x37644302,
+0xcec,0x2f97d40c,
+0xd00,0x00000740,
+0xd04,0x00020401,
+0xd08,0x0000907f,
+0xd0c,0x20010201,
+0xd10,0xa0633333,
+0xd14,0x3333bc43,
+0xd18,0x7a8f5b6b,
+0xd2c,0xcc979975,
+0xd30,0x00000000,
+0xd34,0x80608000,
+0xd38,0x00000000,
+0xd3c,0x00027293,
+0xd40,0x00000000,
+0xd44,0x00000000,
+0xd48,0x00000000,
+0xd4c,0x00000000,
+0xd50,0x6437140a,
+0xd54,0x00000000,
+0xd58,0x00000000,
+0xd5c,0x30032064,
+0xd60,0x4653de68,
+0xd64,0x04518a3c,
+0xd68,0x00002101,
+0xd6c,0x2a201c16,
+0xd70,0x1812362e,
+0xd74,0x322c2220,
+0xd78,0x000e3c24,
+0xe00,0x24242424,
+0xe04,0x24242424,
+0xe08,0x03902024,
+0xe10,0x24242424,
+0xe14,0x24242424,
+0xe18,0x24242424,
+0xe1c,0x24242424,
+0xe28,0x00000000,
+0xe30,0x1000dc1f,
+0xe34,0x10008c1f,
+0xe38,0x02140102,
+0xe3c,0x681604c2,
+0xe40,0x01007c00,
+0xe44,0x01004800,
+0xe48,0xfb000000,
+0xe4c,0x000028d1,
+0xe50,0x1000dc1f,
+0xe54,0x10008c1f,
+0xe58,0x02140102,
+0xe5c,0x28160d05,
+0xe60,0x00000008,
+0xe68,0x001b25a4,
+0xe6c,0x631b25a0,
+0xe70,0x631b25a0,
+0xe74,0x081b25a0,
+0xe78,0x081b25a0,
+0xe7c,0x081b25a0,
+0xe80,0x081b25a0,
+0xe84,0x631b25a0,
+0xe88,0x081b25a0,
+0xe8c,0x631b25a0,
+0xed0,0x631b25a0,
+0xed4,0x631b25a0,
+0xed8,0x631b25a0,
+0xedc,0x001b25a0,
+0xee0,0x001b25a0,
+0xeec,0x6b1b25a0,
+0xee8,0x31555448,
+0xf14,0x00000003,
+0xf4c,0x00000000,
+0xf00,0x00000300,
+};
+
+u32 Rtl8192CUPHY_REG_1T_mCardArray[PHY_REG_1T_mCardArrayLength] = {
+0x024,0x0011800d,
+0x028,0x00ffdb83,
+0x800,0x80040000,
+0x804,0x00000001,
+0x808,0x0000fc00,
+0x80c,0x0000000a,
+0x810,0x10000330, //for Broadcom AP IOT
+0x814,0x020c3d10,
+0x818,0x02200385,
+0x81c,0x00000000,
+0x820,0x01000100,
+0x824,0x00390004,
+0x828,0x00000000,
+0x82c,0x00000000,
+0x830,0x00000000,
+0x834,0x00000000,
+0x838,0x00000000,
+0x83c,0x00000000,
+0x840,0x00010000,
+0x844,0x00000000,
+0x848,0x00000000,
+0x84c,0x00000000,
+0x850,0x00000000,
+0x854,0x00000000,
+0x858,0x569a569a,
+0x85c,0x001b25a4,
+0x860,0x66e60230,
+0x864,0x061f0130,
+0x868,0x00000000,
+0x86c,0x32323200,
+0x870,0x07000700,
+0x874,0x22004000,
+0x878,0x00000808,
+0x87c,0x00000000,
+0x880,0xc0083070,
+0x884,0x000004d5,
+0x888,0x00000000,
+0x88c,0xccc000c0,
+0x890,0x00000800,
+0x894,0xfffffffe,
+0x898,0x40302010,
+0x89c,0x00706050,
+0x900,0x00000000,
+0x904,0x00000023,
+0x908,0x00000000,
+0x90c,0x81121111,
+0xa00,0x00d047c8,
+0xa04,0x80ff000c,
+0xa08,0x8c838300,
+0xa0c,0x2e68120f,
+0xa10,0x9500bb78,
+0xa14,0x11144028,
+0xa18,0x00881117,
+0xa1c,0x89140f00,
+0xa20,0x1a1b0000,
+0xa24,0x090e1317,
+0xa28,0x00000204,
+0xa2c,0x00d30000,
+0xa70,0x101fbf00,
+0xa74,0x00000007,
+0xc00,0x48071d40,
+0xc04,0x03a05611,
+0xc08,0x000000e4,
+0xc0c,0x6c6c6c6c,
+0xc10,0x08800000,
+0xc14,0x40000100,
+0xc18,0x08800000,
+0xc1c,0x40000100,
+0xc20,0x00000000,
+0xc24,0x00000000,
+0xc28,0x00000000,
+0xc2c,0x00000000,
+0xc30,0x69e9ac44,
+0xc34,0x469652cf,
+0xc38,0x49795994,
+0xc3c,0x0a97971c,
+0xc40,0x1f7c403f,
+0xc44,0x000100b7,
+0xc48,0xec020107,
+0xc4c,0x007f037f,
+0xc50,0x69543420,
+0xc54,0x43bc0094,
+0xc58,0x69543420,
+0xc5c,0x433c0094,
+0xc60,0x00000000,
+0xc64,0x5116848b,
+0xc68,0x47c00bff,
+0xc6c,0x00000036,
+0xc70,0x2c7f000d,
+0xc74,0x018610db,
+0xc78,0x0000001f,
+0xc7c,0x00b91612,
+0xc80,0x40000100,
+0xc84,0x20f60000,
+0xc88,0x40000100,
+0xc8c,0x20200000,
+0xc90,0x00121820,
+0xc94,0x00000000,
+0xc98,0x00121820,
+0xc9c,0x00007f7f,
+0xca0,0x00000000,
+0xca4,0x00000080,
+0xca8,0x00000000,
+0xcac,0x00000000,
+0xcb0,0x00000000,
+0xcb4,0x00000000,
+0xcb8,0x00000000,
+0xcbc,0x28000000,
+0xcc0,0x00000000,
+0xcc4,0x00000000,
+0xcc8,0x00000000,
+0xccc,0x00000000,
+0xcd0,0x00000000,
+0xcd4,0x00000000,
+0xcd8,0x64b22427,
+0xcdc,0x00766932,
+0xce0,0x00222222,
+0xce4,0x00000000,
+0xce8,0x37644302,
+0xcec,0x2f97d40c,
+0xd00,0x00000740,
+0xd04,0x00020401,
+0xd08,0x0000907f,
+0xd0c,0x20010201,
+0xd10,0xa0633333,
+0xd14,0x3333bc43,
+0xd18,0x7a8f5b6b,
+0xd2c,0xcc979975,
+0xd30,0x00000000,
+0xd34,0x80608000,
+0xd38,0x00000000,
+0xd3c,0x00027293,
+0xd40,0x00000000,
+0xd44,0x00000000,
+0xd48,0x00000000,
+0xd4c,0x00000000,
+0xd50,0x6437140a,
+0xd54,0x00000000,
+0xd58,0x00000000,
+0xd5c,0x30032064,
+0xd60,0x4653de68,
+0xd64,0x04518a3c,
+0xd68,0x00002101,
+0xd6c,0x2a201c16,
+0xd70,0x1812362e,
+0xd74,0x322c2220,
+0xd78,0x000e3c24,
+0xe00,0x2a2a2a2a,
+0xe04,0x2a2a2a2a,
+0xe08,0x03902a2a,
+0xe10,0x2a2a2a2a,
+0xe14,0x2a2a2a2a,
+0xe18,0x2a2a2a2a,
+0xe1c,0x2a2a2a2a,
+0xe28,0x00000000,
+0xe30,0x1000dc1f,
+0xe34,0x10008c1f,
+0xe38,0x02140102,
+0xe3c,0x681604c2,
+0xe40,0x01007c00,
+0xe44,0x01004800,
+0xe48,0xfb000000,
+0xe4c,0x000028d1,
+0xe50,0x1000dc1f,
+0xe54,0x10008c1f,
+0xe58,0x02140102,
+0xe5c,0x28160d05,
+0xe60,0x00000008,
+0xe68,0x001b25a4,
+0xe6c,0x631b25a0,
+0xe70,0x631b25a0,
+0xe74,0x081b25a0,
+0xe78,0x081b25a0,
+0xe7c,0x081b25a0,
+0xe80,0x081b25a0,
+0xe84,0x631b25a0,
+0xe88,0x081b25a0,
+0xe8c,0x631b25a0,
+0xed0,0x631b25a0,
+0xed4,0x631b25a0,
+0xed8,0x631b25a0,
+0xedc,0x001b25a0,
+0xee0,0x001b25a0,
+0xeec,0x6b1b25a0,
+0xf14,0x00000003,
+0xf4c,0x00000000,
+0xf00,0x00000300,
+};
+
+u32 Rtl8192CUPHY_REG_2T_mCardArray[PHY_REG_2T_mCardArrayLength] = {
+0x024,0x0011800d,
+0x028,0x00ffdb83,
+0x800,0x80040002,
+0x804,0x00000003,
+0x808,0x0000fc00,
+0x80c,0x0000000a,
+0x810,0x10000330, //for Broadcom AP IOT
+0x814,0x020c3d10,
+0x818,0x02200385,
+0x81c,0x00000000,
+0x820,0x01000100,
+0x824,0x00390004,
+0x828,0x01000100,
+0x82c,0x00390004,
+0x830,0x27272727,
+0x834,0x27272727,
+0x838,0x27272727,
+0x83c,0x27272727,
+0x840,0x00010000,
+0x844,0x00010000,
+0x848,0x27272727,
+0x84c,0x27272727,
+0x850,0x00000000,
+0x854,0x00000000,
+0x858,0x569a569a,
+0x85c,0x0c1b25a4,
+0x860,0x66e60230,
+0x864,0x061f0130,
+0x868,0x27272727,
+0x86c,0x2b2b2b27,
+0x870,0x07000700,
+0x874,0x22184000,
+0x878,0x08080808,
+0x87c,0x00000000,
+0x880,0xc0083070,
+0x884,0x000004d5,
+0x888,0x00000000,
+0x88c,0xcc0000c0,
+0x890,0x00000800,
+0x894,0xfffffffe,
+0x898,0x40302010,
+0x89c,0x00706050,
+0x900,0x00000000,
+0x904,0x00000023,
+0x908,0x00000000,
+0x90c,0x81121313,
+0xa00,0x00d047c8,
+0xa04,0x80ff000c,
+0xa08,0x8c838300,
+0xa0c,0x2e68120f,
+0xa10,0x9500bb78,
+0xa14,0x11144028,
+0xa18,0x00881117,
+0xa1c,0x89140f00,
+0xa20,0x1a1b0000,
+0xa24,0x090e1317,
+0xa28,0x00000204,
+0xa2c,0x00d30000,
+0xa70,0x101fbf00,
+0xa74,0x00000007,
+0xc00,0x48071d40,
+0xc04,0x03a05633,
+0xc08,0x000000e4,
+0xc0c,0x6c6c6c6c,
+0xc10,0x08800000,
+0xc14,0x40000100,
+0xc18,0x08800000,
+0xc1c,0x40000100,
+0xc20,0x00000000,
+0xc24,0x00000000,
+0xc28,0x00000000,
+0xc2c,0x00000000,
+0xc30,0x69e9ac44,
+0xc34,0x469652cf,
+0xc38,0x49795994,
+0xc3c,0x0a97971c,
+0xc40,0x1f7c403f,
+0xc44,0x000100b7,
+0xc48,0xec020107,
+0xc4c,0x007f037f,
+0xc50,0x69543420,
+0xc54,0x43bc0094,
+0xc58,0x69543420,
+0xc5c,0x433c0094,
+0xc60,0x00000000,
+0xc64,0x5116848b,
+0xc68,0x47c00bff,
+0xc6c,0x00000036,
+0xc70,0x2c7f000d,
+0xc74,0x218610db,
+0xc78,0x0000001f,
+0xc7c,0x00b91612,
+0xc80,0x40000100,
+0xc84,0x20f60000,
+0xc88,0x40000100,
+0xc8c,0xa0e40000,
+0xc90,0x00121820,
+0xc94,0x00000000,
+0xc98,0x00121820,
+0xc9c,0x00007f7f,
+0xca0,0x00000000,
+0xca4,0x00000080,
+0xca8,0x00000000,
+0xcac,0x00000000,
+0xcb0,0x00000000,
+0xcb4,0x00000000,
+0xcb8,0x00000000,
+0xcbc,0x28000000,
+0xcc0,0x00000000,
+0xcc4,0x00000000,
+0xcc8,0x00000000,
+0xccc,0x00000000,
+0xcd0,0x00000000,
+0xcd4,0x00000000,
+0xcd8,0x64b22427,
+0xcdc,0x00766932,
+0xce0,0x00222222,
+0xce4,0x00000000,
+0xce8,0x37644302,
+0xcec,0x2f97d40c,
+0xd00,0x00080740,
+0xd04,0x00020403,
+0xd08,0x0000907f,
+0xd0c,0x20010201,
+0xd10,0xa0633333,
+0xd14,0x3333bc43,
+0xd18,0x7a8f5b6b,
+0xd2c,0xcc979975,
+0xd30,0x00000000,
+0xd34,0x80608000,
+0xd38,0x00000000,
+0xd3c,0x00027293,
+0xd40,0x00000000,
+0xd44,0x00000000,
+0xd48,0x00000000,
+0xd4c,0x00000000,
+0xd50,0x6437140a,
+0xd54,0x00000000,
+0xd58,0x00000000,
+0xd5c,0x30032064,
+0xd60,0x4653de68,
+0xd64,0x04518a3c,
+0xd68,0x00002101,
+0xd6c,0x2a201c16,
+0xd70,0x1812362e,
+0xd74,0x322c2220,
+0xd78,0x000e3c24,
+0xe00,0x2a2a2a2a,
+0xe04,0x2a2a2a2a,
+0xe08,0x03902a2a,
+0xe10,0x2a2a2a2a,
+0xe14,0x2a2a2a2a,
+0xe18,0x2a2a2a2a,
+0xe1c,0x2a2a2a2a,
+0xe28,0x00000000,
+0xe30,0x1000dc1f,
+0xe34,0x10008c1f,
+0xe38,0x02140102,
+0xe3c,0x681604c2,
+0xe40,0x01007c00,
+0xe44,0x01004800,
+0xe48,0xfb000000,
+0xe4c,0x000028d1,
+0xe50,0x1000dc1f,
+0xe54,0x10008c1f,
+0xe58,0x02140102,
+0xe5c,0x28160d05,
+0xe60,0x00000010,
+0xe68,0x001b25a4,
+0xe6c,0x63db25a4,
+0xe70,0x63db25a4,
+0xe74,0x0c1b25a4,
+0xe78,0x0c1b25a4,
+0xe7c,0x0c1b25a4,
+0xe80,0x0c1b25a4,
+0xe84,0x63db25a4,
+0xe88,0x0c1b25a4,
+0xe8c,0x63db25a4,
+0xed0,0x63db25a4,
+0xed4,0x63db25a4,
+0xed8,0x63db25a4,
+0xedc,0x001b25a4,
+0xee0,0x001b25a4,
+0xeec,0x6fdb25a4,
+0xf14,0x00000003,
+0xf4c,0x00000000,
+0xf00,0x00000300,
+};
+
+u32 Rtl8192CUPHY_REG_Array_PG_HP[PHY_REG_Array_PG_HPLength] = {
+0xe00,0xffffffff,0x06080808,
+0xe04,0xffffffff,0x00040406,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x04060608,
+0xe14,0xffffffff,0x00020204,
+0xe18,0xffffffff,0x04060608,
+0xe1c,0xffffffff,0x00020204,
+0x830,0xffffffff,0x06080808,
+0x834,0xffffffff,0x00040406,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x04060608,
+0x848,0xffffffff,0x00020204,
+0x84c,0xffffffff,0x04060608,
+0x868,0xffffffff,0x00020204,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+0xe00,0xffffffff,0x00000000,
+0xe04,0xffffffff,0x00000000,
+0xe08,0x0000ff00,0x00000000,
+0x86c,0xffffff00,0x00000000,
+0xe10,0xffffffff,0x00000000,
+0xe14,0xffffffff,0x00000000,
+0xe18,0xffffffff,0x00000000,
+0xe1c,0xffffffff,0x00000000,
+0x830,0xffffffff,0x00000000,
+0x834,0xffffffff,0x00000000,
+0x838,0xffffff00,0x00000000,
+0x86c,0x000000ff,0x00000000,
+0x83c,0xffffffff,0x00000000,
+0x848,0xffffffff,0x00000000,
+0x84c,0xffffffff,0x00000000,
+0x868,0xffffffff,0x00000000,
+};
+
+u32 Rtl8192CURadioA_2TArray[RadioA_2TArrayLength] = {
+0x000,0x00030159,
+0x001,0x00031284,
+0x002,0x00098000,
+0x003,0x00018c63,
+0x004,0x000210e7,
+0x009,0x0002044f,
+0x00a,0x0001adb1,
+0x00b,0x00054867,
+0x00c,0x0008992e,
+0x00d,0x0000e52c,
+0x00e,0x00039ce7,
+0x00f,0x00000451,
+0x019,0x00000000,
+0x01a,0x00010255,
+0x01b,0x00060a00,
+0x01c,0x000fc378,
+0x01d,0x000a1250,
+0x01e,0x0004445f,
+0x01f,0x00080001,
+0x020,0x0000b614,
+0x021,0x0006c000,
+0x022,0x00000000,
+0x023,0x00001558,
+0x024,0x00000060,
+0x025,0x00000483,
+0x026,0x0004f000,
+0x027,0x000ec7d9,
+0x028,0x000577c0,
+0x029,0x00004783,
+0x02a,0x00000001,
+0x02b,0x00021334,
+0x02a,0x00000000,
+0x02b,0x00000054,
+0x02a,0x00000001,
+0x02b,0x00000808,
+0x02b,0x00053333,
+0x02c,0x0000000c,
+0x02a,0x00000002,
+0x02b,0x00000808,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000003,
+0x02b,0x00000808,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000004,
+0x02b,0x00000808,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x00000005,
+0x02b,0x00000808,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x00000006,
+0x02b,0x00000709,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000007,
+0x02b,0x00000709,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000008,
+0x02b,0x0000060a,
+0x02b,0x0004b333,
+0x02c,0x0000000d,
+0x02a,0x00000009,
+0x02b,0x0000060a,
+0x02b,0x00053333,
+0x02c,0x0000000d,
+0x02a,0x0000000a,
+0x02b,0x0000060a,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x0000000b,
+0x02b,0x0000060a,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x0000000c,
+0x02b,0x0000060a,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x0000000d,
+0x02b,0x0000060a,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x0000000e,
+0x02b,0x0000050b,
+0x02b,0x00066666,
+0x02c,0x0000001a,
+0x02a,0x000e0000,
+0x010,0x0004000f,
+0x011,0x000e31fc,
+0x010,0x0006000f,
+0x011,0x000ff9f8,
+0x010,0x0002000f,
+0x011,0x000203f9,
+0x010,0x0003000f,
+0x011,0x000ff500,
+0x010,0x00000000,
+0x011,0x00000000,
+0x010,0x0008000f,
+0x011,0x0003f100,
+0x010,0x0009000f,
+0x011,0x00023100,
+0x012,0x00032000,
+0x012,0x00071000,
+0x012,0x000b0000,
+0x012,0x000fc000,
+0x013,0x000287b3,
+0x013,0x000244b7,
+0x013,0x000204ab,
+0x013,0x0001c49f,
+0x013,0x00018493,
+0x013,0x0001429b,
+0x013,0x00010299,
+0x013,0x0000c29c,
+0x013,0x000081a0,
+0x013,0x000040ac,
+0x013,0x00000020,
+0x014,0x0001944c,
+0x014,0x00059444,
+0x014,0x0009944c,
+0x014,0x000d9444,
+0x015,0x0000f424,
+0x015,0x0004f424,
+0x015,0x0008f424,
+0x015,0x000cf424,
+0x016,0x000e0330,
+0x016,0x000a0330,
+0x016,0x00060330,
+0x016,0x00020330,
+0x000,0x00010159,
+0x018,0x0000f401,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01f,0x00080003,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01e,0x00044457,
+0x01f,0x00080000,
+0x000,0x00030159,
+};
+
+u32 Rtl8192CURadioB_2TArray[RadioB_2TArrayLength] = {
+0x000,0x00030159,
+0x001,0x00031284,
+0x002,0x00098000,
+0x003,0x00018c63,
+0x004,0x000210e7,
+0x009,0x0002044f,
+0x00a,0x0001adb1,
+0x00b,0x00054867,
+0x00c,0x0008992e,
+0x00d,0x0000e52c,
+0x00e,0x00039ce7,
+0x00f,0x00000451,
+0x012,0x00032000,
+0x012,0x00071000,
+0x012,0x000b0000,
+0x012,0x000fc000,
+0x013,0x000287af,
+0x013,0x000244b7,
+0x013,0x000204ab,
+0x013,0x0001c49f,
+0x013,0x00018493,
+0x013,0x00014297,
+0x013,0x00010295,
+0x013,0x0000c298,
+0x013,0x0000819c,
+0x013,0x000040a8,
+0x013,0x0000001c,
+0x014,0x0001944c,
+0x014,0x00059444,
+0x014,0x0009944c,
+0x014,0x000d9444,
+0x015,0x0000f424,
+0x015,0x0004f424,
+0x015,0x0008f424,
+0x015,0x000cf424,
+0x016,0x000e0330,
+0x016,0x000a0330,
+0x016,0x00060330,
+0x016,0x00020330,
+};
+
+u32 Rtl8192CURadioA_1TArray[RadioA_1TArrayLength] = {
+0x000,0x00030159,
+0x001,0x00031284,
+0x002,0x00098000,
+0x003,0x00018c63,
+0x004,0x000210e7,
+0x009,0x0002044f,
+0x00a,0x0001adb1,
+0x00b,0x00054867,
+0x00c,0x0008992e,
+0x00d,0x0000e52c,
+0x00e,0x00039ce7,
+0x00f,0x00000451,
+0x019,0x00000000,
+0x01a,0x00010255,
+0x01b,0x00060a00,
+0x01c,0x000fc378,
+0x01d,0x000a1250,
+0x01e,0x0004445f,
+0x01f,0x00080001,
+0x020,0x0000b614,
+0x021,0x0006c000,
+0x022,0x00000000,
+0x023,0x00001558,
+0x024,0x00000060,
+0x025,0x00000483,
+0x026,0x0004f000,
+0x027,0x000ec7d9,
+0x028,0x000577c0,
+0x029,0x00004783,
+0x02a,0x00000001,
+0x02b,0x00021334,
+0x02a,0x00000000,
+0x02b,0x00000054,
+0x02a,0x00000001,
+0x02b,0x00000808,
+0x02b,0x00053333,
+0x02c,0x0000000c,
+0x02a,0x00000002,
+0x02b,0x00000808,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000003,
+0x02b,0x00000808,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000004,
+0x02b,0x00000808,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x00000005,
+0x02b,0x00000808,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x00000006,
+0x02b,0x00000709,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000007,
+0x02b,0x00000709,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000008,
+0x02b,0x0000060a,
+0x02b,0x0004b333,
+0x02c,0x0000000d,
+0x02a,0x00000009,
+0x02b,0x0000060a,
+0x02b,0x00053333,
+0x02c,0x0000000d,
+0x02a,0x0000000a,
+0x02b,0x0000060a,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x0000000b,
+0x02b,0x0000060a,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x0000000c,
+0x02b,0x0000060a,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x0000000d,
+0x02b,0x0000060a,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x0000000e,
+0x02b,0x0000050b,
+0x02b,0x00066666,
+0x02c,0x0000001a,
+0x02a,0x000e0000,
+0x010,0x0004000f,
+0x011,0x000e31fc,
+0x010,0x0006000f,
+0x011,0x000ff9f8,
+0x010,0x0002000f,
+0x011,0x000203f9,
+0x010,0x0003000f,
+0x011,0x000ff500,
+0x010,0x00000000,
+0x011,0x00000000,
+0x010,0x0008000f,
+0x011,0x0003f100,
+0x010,0x0009000f,
+0x011,0x00023100,
+0x012,0x00032000,
+0x012,0x00071000,
+0x012,0x000b0000,
+0x012,0x000fc000,
+0x013,0x000287b3,
+0x013,0x000244b7,
+0x013,0x000204ab,
+0x013,0x0001c49f,
+0x013,0x00018493,
+0x013,0x0001429b,
+0x013,0x00010299,
+0x013,0x0000c29c,
+0x013,0x000081a0,
+0x013,0x000040ac,
+0x013,0x00000020,
+0x014,0x0001944c,
+0x014,0x00059444,
+0x014,0x0009944c,
+0x014,0x000d9444,
+0x015,0x0000f405,
+0x015,0x0004f405,
+0x015,0x0008f405,
+0x015,0x000cf405,
+0x016,0x000e0330,
+0x016,0x000a0330,
+0x016,0x00060330,
+0x016,0x00020330,
+0x000,0x00010159,
+0x018,0x0000f401,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01f,0x00080003,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01e,0x00044457,
+0x01f,0x00080000,
+0x000,0x00030159,
+};
+
+u32 Rtl8192CURadioB_1TArray[RadioB_1TArrayLength] = {
+0x0, };
+
+
+u32 Rtl8192CURadioA_2T_mCardArray[RadioA_2T_mCardArrayLength] = {
+0x000,0x00030159,
+0x001,0x00031284,
+0x002,0x00098000,
+0x003,0x00018c63,
+0x004,0x000210e7,
+0x009,0x0002044f,
+0x00a,0x0001adb1,
+0x00b,0x00054867,
+0x00c,0x0008992e,
+0x00d,0x0000e52c,
+0x00e,0x00039ce7,
+0x00f,0x00000451,
+0x019,0x00000000,
+0x01a,0x00010255,
+0x01b,0x00060a00,
+0x01c,0x000fc378,
+0x01d,0x000a1250,
+0x01e,0x0004445f,
+0x01f,0x00080001,
+0x020,0x0000b614,
+0x021,0x0006c000,
+0x022,0x00000000,
+0x023,0x00001558,
+0x024,0x00000060,
+0x025,0x00000483,
+0x026,0x0004f000,
+0x027,0x000ec7d9,
+0x028,0x000577c0,
+0x029,0x00004783,
+0x02a,0x00000001,
+0x02b,0x00021334,
+0x02a,0x00000000,
+0x02b,0x00000054,
+0x02a,0x00000001,
+0x02b,0x00000808,
+0x02b,0x00053333,
+0x02c,0x0000000c,
+0x02a,0x00000002,
+0x02b,0x00000808,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000003,
+0x02b,0x00000808,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000004,
+0x02b,0x00000808,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x00000005,
+0x02b,0x00000808,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x00000006,
+0x02b,0x00000709,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000007,
+0x02b,0x00000709,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000008,
+0x02b,0x0000060a,
+0x02b,0x0004b333,
+0x02c,0x0000000d,
+0x02a,0x00000009,
+0x02b,0x0000060a,
+0x02b,0x00053333,
+0x02c,0x0000000d,
+0x02a,0x0000000a,
+0x02b,0x0000060a,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x0000000b,
+0x02b,0x0000060a,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x0000000c,
+0x02b,0x0000060a,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x0000000d,
+0x02b,0x0000060a,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x0000000e,
+0x02b,0x0000050b,
+0x02b,0x00066666,
+0x02c,0x0000001a,
+0x02a,0x000e0000,
+0x010,0x0004000f,
+0x011,0x000e31fc,
+0x010,0x0006000f,
+0x011,0x000ff9f8,
+0x010,0x0002000f,
+0x011,0x000203f9,
+0x010,0x0003000f,
+0x011,0x000ff500,
+0x010,0x00000000,
+0x011,0x00000000,
+0x010,0x0008000f,
+0x011,0x0003f100,
+0x010,0x0009000f,
+0x011,0x00023100,
+0x012,0x00032000,
+0x012,0x00071000,
+0x012,0x000b0000,
+0x012,0x000fc000,
+0x013,0x000287b3,
+0x013,0x000244b7,
+0x013,0x000204ab,
+0x013,0x0001c49f,
+0x013,0x00018493,
+0x013,0x0001429b,
+0x013,0x00010299,
+0x013,0x0000c29c,
+0x013,0x000081a0,
+0x013,0x000040ac,
+0x013,0x00000020,
+0x014,0x0001944c,
+0x014,0x00059444,
+0x014,0x0009944c,
+0x014,0x000d9444,
+0x015,0x0000f424,
+0x015,0x0004f424,
+0x015,0x0008f424,
+0x015,0x000cf424,
+0x016,0x000e0330,
+0x016,0x000a0330,
+0x016,0x00060330,
+0x016,0x00020330,
+0x000,0x00010159,
+0x018,0x0000f401,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01f,0x00080003,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01e,0x00044457,
+0x01f,0x00080000,
+0x000,0x00030159,
+};
+
+u32 Rtl8192CURadioB_2T_mCardArray[RadioB_2T_mCardArrayLength] = {
+0x000,0x00030159,
+0x001,0x00031284,
+0x002,0x00098000,
+0x003,0x00018c63,
+0x004,0x000210e7,
+0x009,0x0002044f,
+0x00a,0x0001adb1,
+0x00b,0x00054867,
+0x00c,0x0008992e,
+0x00d,0x0000e52c,
+0x00e,0x00039ce7,
+0x00f,0x00000451,
+0x012,0x00032000,
+0x012,0x00071000,
+0x012,0x000b0000,
+0x012,0x000fc000,
+0x013,0x000287af,
+0x013,0x000244b7,
+0x013,0x000204ab,
+0x013,0x0001c49f,
+0x013,0x00018493,
+0x013,0x00014297,
+0x013,0x00010295,
+0x013,0x0000c298,
+0x013,0x0000819c,
+0x013,0x000040a8,
+0x013,0x0000001c,
+0x014,0x0001944c,
+0x014,0x00059444,
+0x014,0x0009944c,
+0x014,0x000d9444,
+0x015,0x0000f424,
+0x015,0x0004f424,
+0x015,0x0008f424,
+0x015,0x000cf424,
+0x016,0x000e0330,
+0x016,0x000a0330,
+0x016,0x00060330,
+0x016,0x00020330,
+};
+
+u32 Rtl8192CURadioA_1T_mCardArray[RadioA_1T_mCardArrayLength] = {
+0x000,0x00030159,
+0x001,0x00031284,
+0x002,0x00098000,
+0x003,0x00018c63,
+0x004,0x000210e7,
+0x009,0x0002044f,
+0x00a,0x0001adb1,
+0x00b,0x00054867,
+0x00c,0x0008992e,
+0x00d,0x0000e52c,
+0x00e,0x00039ce7,
+0x00f,0x00000451,
+0x019,0x00000000,
+0x01a,0x00010255,
+0x01b,0x00060a00,
+0x01c,0x000fc378,
+0x01d,0x000a1250,
+0x01e,0x0004445f,
+0x01f,0x00080001,
+0x020,0x0000b614,
+0x021,0x0006c000,
+0x022,0x00000000,
+0x023,0x00001558,
+0x024,0x00000060,
+0x025,0x00000483,
+0x026,0x0004f200,
+0x027,0x000ec7d9,
+0x028,0x000577c0,
+0x029,0x00004783,
+0x02a,0x00000001,
+0x02b,0x00021334,
+0x02a,0x00000000,
+0x02b,0x00000054,
+0x02a,0x00000001,
+0x02b,0x00000808,
+0x02b,0x00053333,
+0x02c,0x0000000c,
+0x02a,0x00000002,
+0x02b,0x00000808,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000003,
+0x02b,0x00000808,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000004,
+0x02b,0x00000808,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x00000005,
+0x02b,0x00000808,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x00000006,
+0x02b,0x00000709,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000007,
+0x02b,0x00000709,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000008,
+0x02b,0x0000060a,
+0x02b,0x0004b333,
+0x02c,0x0000000d,
+0x02a,0x00000009,
+0x02b,0x0000060a,
+0x02b,0x00053333,
+0x02c,0x0000000d,
+0x02a,0x0000000a,
+0x02b,0x0000060a,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x0000000b,
+0x02b,0x0000060a,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x0000000c,
+0x02b,0x0000060a,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x0000000d,
+0x02b,0x0000060a,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x0000000e,
+0x02b,0x0000050b,
+0x02b,0x00066666,
+0x02c,0x0000001a,
+0x02a,0x000e0000,
+0x010,0x0004000f,
+0x011,0x000e31fc,
+0x010,0x0006000f,
+0x011,0x000ff9f8,
+0x010,0x0002000f,
+0x011,0x000203f9,
+0x010,0x0003000f,
+0x011,0x000ff500,
+0x010,0x00000000,
+0x011,0x00000000,
+0x010,0x0008000f,
+0x011,0x0003f100,
+0x010,0x0009000f,
+0x011,0x00023100,
+0x012,0x00032000,
+0x012,0x00071000,
+0x012,0x000b0000,
+0x012,0x000fc000,
+0x013,0x000287b3,
+0x013,0x000244b7,
+0x013,0x000204ab,
+0x013,0x0001c49f,
+0x013,0x00018493,
+0x013,0x0001429b,
+0x013,0x00010299,
+0x013,0x0000c29c,
+0x013,0x000081a0,
+0x013,0x000040ac,
+0x013,0x00000020,
+0x014,0x0001944c,
+0x014,0x00059444,
+0x014,0x0009944c,
+0x014,0x000d9444,
+0x015,0x0000f424,
+0x015,0x0004f424,
+0x015,0x0008f424,
+0x015,0x000cf424,
+0x016,0x000e0330,
+0x016,0x000a0330,
+0x016,0x00060330,
+0x016,0x00020330,
+0x000,0x00010159,
+0x018,0x0000f401,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01f,0x00080003,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01e,0x00044457,
+0x01f,0x00080000,
+0x000,0x00030159,
+};
+
+u32 Rtl8192CURadioB_1T_mCardArray[RadioB_1T_mCardArrayLength] = {
+0x0, };
+
+u32 Rtl8192CURadioA_1T_HPArray[RadioA_1T_HPArrayLength] = {
+0x000,0x00030159,
+0x001,0x00031284,
+0x002,0x00098000,
+0x003,0x00018c63,
+0x004,0x000210e7,
+0x009,0x0002044f,
+0x00a,0x0001adb0,
+0x00b,0x00054867,
+0x00c,0x0008992e,
+0x00d,0x0000e529,
+0x00e,0x00039ce7,
+0x00f,0x00000451,
+0x019,0x00000000,
+0x01a,0x00000255,
+0x01b,0x00060a00,
+0x01c,0x000fc378,
+0x01d,0x000a1250,
+0x01e,0x0004445f,
+0x01f,0x00080001,
+0x020,0x0000b614,
+0x021,0x0006c000,
+0x022,0x0000083c,
+0x023,0x00001558,
+0x024,0x00000060,
+0x025,0x00000483,
+0x026,0x0004f000,
+0x027,0x000ec7d9,
+0x028,0x000977c0,
+0x029,0x00004783,
+0x02a,0x00000001,
+0x02b,0x00021334,
+0x02a,0x00000000,
+0x02b,0x00000054,
+0x02a,0x00000001,
+0x02b,0x00000808,
+0x02b,0x00053333,
+0x02c,0x0000000c,
+0x02a,0x00000002,
+0x02b,0x00000808,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000003,
+0x02b,0x00000808,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000004,
+0x02b,0x00000808,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x00000005,
+0x02b,0x00000808,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x00000006,
+0x02b,0x00000709,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x00000007,
+0x02b,0x00000709,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x00000008,
+0x02b,0x0000060a,
+0x02b,0x0004b333,
+0x02c,0x0000000d,
+0x02a,0x00000009,
+0x02b,0x0000060a,
+0x02b,0x00053333,
+0x02c,0x0000000d,
+0x02a,0x0000000a,
+0x02b,0x0000060a,
+0x02b,0x0005b333,
+0x02c,0x0000000d,
+0x02a,0x0000000b,
+0x02b,0x0000060a,
+0x02b,0x00063333,
+0x02c,0x0000000d,
+0x02a,0x0000000c,
+0x02b,0x0000060a,
+0x02b,0x0006b333,
+0x02c,0x0000000d,
+0x02a,0x0000000d,
+0x02b,0x0000060a,
+0x02b,0x00073333,
+0x02c,0x0000000d,
+0x02a,0x0000000e,
+0x02b,0x0000050b,
+0x02b,0x00066666,
+0x02c,0x0000001a,
+0x02a,0x000e0000,
+0x010,0x0004000f,
+0x011,0x000e31fc,
+0x010,0x0006000f,
+0x011,0x000ff9f8,
+0x010,0x0002000f,
+0x011,0x000203f9,
+0x010,0x0003000f,
+0x011,0x000ff500,
+0x010,0x00000000,
+0x011,0x00000000,
+0x010,0x0008000f,
+0x011,0x0003f100,
+0x010,0x0009000f,
+0x011,0x00023100,
+0x012,0x000d8000,
+0x012,0x00090000,
+0x012,0x00051000,
+0x012,0x00012000,
+0x013,0x00028fb4,
+0x013,0x00024fa8,
+0x013,0x000207a4,
+0x013,0x0001c3b0,
+0x013,0x000183a4,
+0x013,0x00014398,
+0x013,0x000101a4,
+0x013,0x0000c198,
+0x013,0x000080a4,
+0x013,0x00004098,
+0x013,0x00000000,
+0x014,0x0001944c,
+0x014,0x00059444,
+0x014,0x0009944c,
+0x014,0x000d9444,
+0x015,0x0000f405,
+0x015,0x0004f405,
+0x015,0x0008f405,
+0x015,0x000cf405,
+0x016,0x000e0330,
+0x016,0x000a0330,
+0x016,0x00060330,
+0x016,0x00020330,
+0x000,0x00010159,
+0x018,0x0000f401,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01f,0x00080003,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x01e,0x00044457,
+0x01f,0x00080000,
+0x000,0x00030159,
+};
+
+u32 Rtl8192CURadioB_GM_Array[RadioB_GM_ArrayLength] = {
+0x0, };
+
+// MAC reg V14 - 2011-11-23
+u32 Rtl8192CUMAC_2T_Array[MAC_2T_ArrayLength] = {
+0x420,0x00000080,
+0x423,0x00000000,
+0x430,0x00000000,
+0x431,0x00000000,
+0x432,0x00000000,
+0x433,0x00000001,
+0x434,0x00000004,
+0x435,0x00000005,
+0x436,0x00000006,
+0x437,0x00000007,
+0x438,0x00000000,
+0x439,0x00000000,
+0x43a,0x00000000,
+0x43b,0x00000001,
+0x43c,0x00000004,
+0x43d,0x00000005,
+0x43e,0x00000006,
+0x43f,0x00000007,
+0x440,0x0000005d,
+0x441,0x00000001,
+0x442,0x00000000,
+0x444,0x00000015,
+0x445,0x000000f0,
+0x446,0x0000000f,
+0x447,0x00000000,
+0x458,0x00000041,
+0x459,0x000000a8,
+0x45a,0x00000072,
+0x45b,0x000000b9,
+0x460,0x00000066,
+0x461,0x00000066,
+0x462,0x00000008,
+0x463,0x00000003,
+0x4c8,0x000000ff,
+0x4c9,0x00000008,
+0x4cc,0x000000ff,
+0x4cd,0x000000ff,
+0x4ce,0x00000001,
+0x500,0x00000026,
+0x501,0x000000a2,
+0x502,0x0000002f,
+0x503,0x00000000,
+0x504,0x00000028,
+0x505,0x000000a3,
+0x506,0x0000005e,
+0x507,0x00000000,
+0x508,0x0000002b,
+0x509,0x000000a4,
+0x50a,0x0000005e,
+0x50b,0x00000000,
+0x50c,0x0000004f,
+0x50d,0x000000a4,
+0x50e,0x00000000,
+0x50f,0x00000000,
+0x512,0x0000001c,
+0x514,0x0000000a,
+0x515,0x00000010,
+0x516,0x0000000a,
+0x517,0x00000010,
+0x51a,0x00000016,
+0x524,0x0000000f,
+0x525,0x0000004f,
+0x546,0x00000040,
+0x547,0x00000000,
+0x550,0x00000010,
+0x551,0x00000010,
+0x559,0x00000002,
+0x55a,0x00000002,
+0x55d,0x000000ff,
+0x605,0x00000030,
+0x608,0x0000000e,
+0x609,0x0000002a,
+0x652,0x00000020,
+0x652,0x00000020,
+0x63c,0x00000008,
+0x63d,0x00000008,
+0x63e,0x0000000c,
+0x63f,0x0000000c,
+0x66e,0x00000005,
+0x700,0x00000021,
+0x701,0x00000043,
+0x702,0x00000065,
+0x703,0x00000087,
+0x708,0x00000021,
+0x709,0x00000043,
+0x70a,0x00000065,
+0x70b,0x00000087,
+};
+
+u32 Rtl8192CUMACPHY_Array_PG[MACPHY_Array_PGLength] = {
+0x0, };
+
+u32 Rtl8192CUAGCTAB_2TArray[AGCTAB_2TArrayLength] = {
+0xc78,0x7b000001,
+0xc78,0x7b010001,
+0xc78,0x7b020001,
+0xc78,0x7b030001,
+0xc78,0x7b040001,
+0xc78,0x7b050001,
+0xc78,0x7a060001,
+0xc78,0x79070001,
+0xc78,0x78080001,
+0xc78,0x77090001,
+0xc78,0x760a0001,
+0xc78,0x750b0001,
+0xc78,0x740c0001,
+0xc78,0x730d0001,
+0xc78,0x720e0001,
+0xc78,0x710f0001,
+0xc78,0x70100001,
+0xc78,0x6f110001,
+0xc78,0x6e120001,
+0xc78,0x6d130001,
+0xc78,0x6c140001,
+0xc78,0x6b150001,
+0xc78,0x6a160001,
+0xc78,0x69170001,
+0xc78,0x68180001,
+0xc78,0x67190001,
+0xc78,0x661a0001,
+0xc78,0x651b0001,
+0xc78,0x641c0001,
+0xc78,0x631d0001,
+0xc78,0x621e0001,
+0xc78,0x611f0001,
+0xc78,0x60200001,
+0xc78,0x49210001,
+0xc78,0x48220001,
+0xc78,0x47230001,
+0xc78,0x46240001,
+0xc78,0x45250001,
+0xc78,0x44260001,
+0xc78,0x43270001,
+0xc78,0x42280001,
+0xc78,0x41290001,
+0xc78,0x402a0001,
+0xc78,0x262b0001,
+0xc78,0x252c0001,
+0xc78,0x242d0001,
+0xc78,0x232e0001,
+0xc78,0x222f0001,
+0xc78,0x21300001,
+0xc78,0x20310001,
+0xc78,0x06320001,
+0xc78,0x05330001,
+0xc78,0x04340001,
+0xc78,0x03350001,
+0xc78,0x02360001,
+0xc78,0x01370001,
+0xc78,0x00380001,
+0xc78,0x00390001,
+0xc78,0x003a0001,
+0xc78,0x003b0001,
+0xc78,0x003c0001,
+0xc78,0x003d0001,
+0xc78,0x003e0001,
+0xc78,0x003f0001,
+0xc78,0x7b400001,
+0xc78,0x7b410001,
+0xc78,0x7b420001,
+0xc78,0x7b430001,
+0xc78,0x7b440001,
+0xc78,0x7b450001,
+0xc78,0x7a460001,
+0xc78,0x79470001,
+0xc78,0x78480001,
+0xc78,0x77490001,
+0xc78,0x764a0001,
+0xc78,0x754b0001,
+0xc78,0x744c0001,
+0xc78,0x734d0001,
+0xc78,0x724e0001,
+0xc78,0x714f0001,
+0xc78,0x70500001,
+0xc78,0x6f510001,
+0xc78,0x6e520001,
+0xc78,0x6d530001,
+0xc78,0x6c540001,
+0xc78,0x6b550001,
+0xc78,0x6a560001,
+0xc78,0x69570001,
+0xc78,0x68580001,
+0xc78,0x67590001,
+0xc78,0x665a0001,
+0xc78,0x655b0001,
+0xc78,0x645c0001,
+0xc78,0x635d0001,
+0xc78,0x625e0001,
+0xc78,0x615f0001,
+0xc78,0x60600001,
+0xc78,0x49610001,
+0xc78,0x48620001,
+0xc78,0x47630001,
+0xc78,0x46640001,
+0xc78,0x45650001,
+0xc78,0x44660001,
+0xc78,0x43670001,
+0xc78,0x42680001,
+0xc78,0x41690001,
+0xc78,0x406a0001,
+0xc78,0x266b0001,
+0xc78,0x256c0001,
+0xc78,0x246d0001,
+0xc78,0x236e0001,
+0xc78,0x226f0001,
+0xc78,0x21700001,
+0xc78,0x20710001,
+0xc78,0x06720001,
+0xc78,0x05730001,
+0xc78,0x04740001,
+0xc78,0x03750001,
+0xc78,0x02760001,
+0xc78,0x01770001,
+0xc78,0x00780001,
+0xc78,0x00790001,
+0xc78,0x007a0001,
+0xc78,0x007b0001,
+0xc78,0x007c0001,
+0xc78,0x007d0001,
+0xc78,0x007e0001,
+0xc78,0x007f0001,
+0xc78,0x3800001e,
+0xc78,0x3801001e,
+0xc78,0x3802001e,
+0xc78,0x3803001e,
+0xc78,0x3804001e,
+0xc78,0x3805001e,
+0xc78,0x3806001e,
+0xc78,0x3807001e,
+0xc78,0x3808001e,
+0xc78,0x3c09001e,
+0xc78,0x3e0a001e,
+0xc78,0x400b001e,
+0xc78,0x440c001e,
+0xc78,0x480d001e,
+0xc78,0x4c0e001e,
+0xc78,0x500f001e,
+0xc78,0x5210001e,
+0xc78,0x5611001e,
+0xc78,0x5a12001e,
+0xc78,0x5e13001e,
+0xc78,0x6014001e,
+0xc78,0x6015001e,
+0xc78,0x6016001e,
+0xc78,0x6217001e,
+0xc78,0x6218001e,
+0xc78,0x6219001e,
+0xc78,0x621a001e,
+0xc78,0x621b001e,
+0xc78,0x621c001e,
+0xc78,0x621d001e,
+0xc78,0x621e001e,
+0xc78,0x621f001e,
+};
+
+u32 Rtl8192CUAGCTAB_1TArray[AGCTAB_1TArrayLength] = {
+0xc78,0x7b000001,
+0xc78,0x7b010001,
+0xc78,0x7b020001,
+0xc78,0x7b030001,
+0xc78,0x7b040001,
+0xc78,0x7b050001,
+0xc78,0x7a060001,
+0xc78,0x79070001,
+0xc78,0x78080001,
+0xc78,0x77090001,
+0xc78,0x760a0001,
+0xc78,0x750b0001,
+0xc78,0x740c0001,
+0xc78,0x730d0001,
+0xc78,0x720e0001,
+0xc78,0x710f0001,
+0xc78,0x70100001,
+0xc78,0x6f110001,
+0xc78,0x6e120001,
+0xc78,0x6d130001,
+0xc78,0x6c140001,
+0xc78,0x6b150001,
+0xc78,0x6a160001,
+0xc78,0x69170001,
+0xc78,0x68180001,
+0xc78,0x67190001,
+0xc78,0x661a0001,
+0xc78,0x651b0001,
+0xc78,0x641c0001,
+0xc78,0x631d0001,
+0xc78,0x621e0001,
+0xc78,0x611f0001,
+0xc78,0x60200001,
+0xc78,0x49210001,
+0xc78,0x48220001,
+0xc78,0x47230001,
+0xc78,0x46240001,
+0xc78,0x45250001,
+0xc78,0x44260001,
+0xc78,0x43270001,
+0xc78,0x42280001,
+0xc78,0x41290001,
+0xc78,0x402a0001,
+0xc78,0x262b0001,
+0xc78,0x252c0001,
+0xc78,0x242d0001,
+0xc78,0x232e0001,
+0xc78,0x222f0001,
+0xc78,0x21300001,
+0xc78,0x20310001,
+0xc78,0x06320001,
+0xc78,0x05330001,
+0xc78,0x04340001,
+0xc78,0x03350001,
+0xc78,0x02360001,
+0xc78,0x01370001,
+0xc78,0x00380001,
+0xc78,0x00390001,
+0xc78,0x003a0001,
+0xc78,0x003b0001,
+0xc78,0x003c0001,
+0xc78,0x003d0001,
+0xc78,0x003e0001,
+0xc78,0x003f0001,
+0xc78,0x7b400001,
+0xc78,0x7b410001,
+0xc78,0x7b420001,
+0xc78,0x7b430001,
+0xc78,0x7b440001,
+0xc78,0x7b450001,
+0xc78,0x7a460001,
+0xc78,0x79470001,
+0xc78,0x78480001,
+0xc78,0x77490001,
+0xc78,0x764a0001,
+0xc78,0x754b0001,
+0xc78,0x744c0001,
+0xc78,0x734d0001,
+0xc78,0x724e0001,
+0xc78,0x714f0001,
+0xc78,0x70500001,
+0xc78,0x6f510001,
+0xc78,0x6e520001,
+0xc78,0x6d530001,
+0xc78,0x6c540001,
+0xc78,0x6b550001,
+0xc78,0x6a560001,
+0xc78,0x69570001,
+0xc78,0x68580001,
+0xc78,0x67590001,
+0xc78,0x665a0001,
+0xc78,0x655b0001,
+0xc78,0x645c0001,
+0xc78,0x635d0001,
+0xc78,0x625e0001,
+0xc78,0x615f0001,
+0xc78,0x60600001,
+0xc78,0x49610001,
+0xc78,0x48620001,
+0xc78,0x47630001,
+0xc78,0x46640001,
+0xc78,0x45650001,
+0xc78,0x44660001,
+0xc78,0x43670001,
+0xc78,0x42680001,
+0xc78,0x41690001,
+0xc78,0x406a0001,
+0xc78,0x266b0001,
+0xc78,0x256c0001,
+0xc78,0x246d0001,
+0xc78,0x236e0001,
+0xc78,0x226f0001,
+0xc78,0x21700001,
+0xc78,0x20710001,
+0xc78,0x06720001,
+0xc78,0x05730001,
+0xc78,0x04740001,
+0xc78,0x03750001,
+0xc78,0x02760001,
+0xc78,0x01770001,
+0xc78,0x00780001,
+0xc78,0x00790001,
+0xc78,0x007a0001,
+0xc78,0x007b0001,
+0xc78,0x007c0001,
+0xc78,0x007d0001,
+0xc78,0x007e0001,
+0xc78,0x007f0001,
+0xc78,0x3800001e,
+0xc78,0x3801001e,
+0xc78,0x3802001e,
+0xc78,0x3803001e,
+0xc78,0x3804001e,
+0xc78,0x3805001e,
+0xc78,0x3806001e,
+0xc78,0x3807001e,
+0xc78,0x3808001e,
+0xc78,0x3c09001e,
+0xc78,0x3e0a001e,
+0xc78,0x400b001e,
+0xc78,0x440c001e,
+0xc78,0x480d001e,
+0xc78,0x4c0e001e,
+0xc78,0x500f001e,
+0xc78,0x5210001e,
+0xc78,0x5611001e,
+0xc78,0x5a12001e,
+0xc78,0x5e13001e,
+0xc78,0x6014001e,
+0xc78,0x6015001e,
+0xc78,0x6016001e,
+0xc78,0x6217001e,
+0xc78,0x6218001e,
+0xc78,0x6219001e,
+0xc78,0x621a001e,
+0xc78,0x621b001e,
+0xc78,0x621c001e,
+0xc78,0x621d001e,
+0xc78,0x621e001e,
+0xc78,0x621f001e,
+};
+
+u32 Rtl8192CUAGCTAB_1T_HPArray[AGCTAB_1T_HPArrayLength] = {
+0xc78,0x7b000001,
+0xc78,0x7b010001,
+0xc78,0x7b020001,
+0xc78,0x7b030001,
+0xc78,0x7b040001,
+0xc78,0x7b050001,
+0xc78,0x7b060001,
+0xc78,0x7b070001,
+0xc78,0x7b080001,
+0xc78,0x7a090001,
+0xc78,0x790a0001,
+0xc78,0x780b0001,
+0xc78,0x770c0001,
+0xc78,0x760d0001,
+0xc78,0x750e0001,
+0xc78,0x740f0001,
+0xc78,0x73100001,
+0xc78,0x72110001,
+0xc78,0x71120001,
+0xc78,0x70130001,
+0xc78,0x6f140001,
+0xc78,0x6e150001,
+0xc78,0x6d160001,
+0xc78,0x6c170001,
+0xc78,0x6b180001,
+0xc78,0x6a190001,
+0xc78,0x691a0001,
+0xc78,0x681b0001,
+0xc78,0x671c0001,
+0xc78,0x661d0001,
+0xc78,0x651e0001,
+0xc78,0x641f0001,
+0xc78,0x63200001,
+0xc78,0x62210001,
+0xc78,0x61220001,
+0xc78,0x60230001,
+0xc78,0x46240001,
+0xc78,0x45250001,
+0xc78,0x44260001,
+0xc78,0x43270001,
+0xc78,0x42280001,
+0xc78,0x41290001,
+0xc78,0x402a0001,
+0xc78,0x262b0001,
+0xc78,0x252c0001,
+0xc78,0x242d0001,
+0xc78,0x232e0001,
+0xc78,0x222f0001,
+0xc78,0x21300001,
+0xc78,0x20310001,
+0xc78,0x06320001,
+0xc78,0x05330001,
+0xc78,0x04340001,
+0xc78,0x03350001,
+0xc78,0x02360001,
+0xc78,0x01370001,
+0xc78,0x00380001,
+0xc78,0x00390001,
+0xc78,0x003a0001,
+0xc78,0x003b0001,
+0xc78,0x003c0001,
+0xc78,0x003d0001,
+0xc78,0x003e0001,
+0xc78,0x003f0001,
+0xc78,0x7b400001,
+0xc78,0x7b410001,
+0xc78,0x7b420001,
+0xc78,0x7b430001,
+0xc78,0x7b440001,
+0xc78,0x7b450001,
+0xc78,0x7b460001,
+0xc78,0x7b470001,
+0xc78,0x7b480001,
+0xc78,0x7a490001,
+0xc78,0x794a0001,
+0xc78,0x784b0001,
+0xc78,0x774c0001,
+0xc78,0x764d0001,
+0xc78,0x754e0001,
+0xc78,0x744f0001,
+0xc78,0x73500001,
+0xc78,0x72510001,
+0xc78,0x71520001,
+0xc78,0x70530001,
+0xc78,0x6f540001,
+0xc78,0x6e550001,
+0xc78,0x6d560001,
+0xc78,0x6c570001,
+0xc78,0x6b580001,
+0xc78,0x6a590001,
+0xc78,0x695a0001,
+0xc78,0x685b0001,
+0xc78,0x675c0001,
+0xc78,0x665d0001,
+0xc78,0x655e0001,
+0xc78,0x645f0001,
+0xc78,0x63600001,
+0xc78,0x62610001,
+0xc78,0x61620001,
+0xc78,0x60630001,
+0xc78,0x46640001,
+0xc78,0x45650001,
+0xc78,0x44660001,
+0xc78,0x43670001,
+0xc78,0x42680001,
+0xc78,0x41690001,
+0xc78,0x406a0001,
+0xc78,0x266b0001,
+0xc78,0x256c0001,
+0xc78,0x246d0001,
+0xc78,0x236e0001,
+0xc78,0x226f0001,
+0xc78,0x21700001,
+0xc78,0x20710001,
+0xc78,0x06720001,
+0xc78,0x05730001,
+0xc78,0x04740001,
+0xc78,0x03750001,
+0xc78,0x02760001,
+0xc78,0x01770001,
+0xc78,0x00780001,
+0xc78,0x00790001,
+0xc78,0x007a0001,
+0xc78,0x007b0001,
+0xc78,0x007c0001,
+0xc78,0x007d0001,
+0xc78,0x007e0001,
+0xc78,0x007f0001,
+0xc78,0x3800001e,
+0xc78,0x3801001e,
+0xc78,0x3802001e,
+0xc78,0x3803001e,
+0xc78,0x3804001e,
+0xc78,0x3805001e,
+0xc78,0x3806001e,
+0xc78,0x3807001e,
+0xc78,0x3808001e,
+0xc78,0x3c09001e,
+0xc78,0x3e0a001e,
+0xc78,0x400b001e,
+0xc78,0x440c001e,
+0xc78,0x480d001e,
+0xc78,0x4c0e001e,
+0xc78,0x500f001e,
+0xc78,0x5210001e,
+0xc78,0x5611001e,
+0xc78,0x5a12001e,
+0xc78,0x5e13001e,
+0xc78,0x6014001e,
+0xc78,0x6015001e,
+0xc78,0x6016001e,
+0xc78,0x6217001e,
+0xc78,0x6218001e,
+0xc78,0x6219001e,
+0xc78,0x621a001e,
+0xc78,0x621b001e,
+0xc78,0x621c001e,
+0xc78,0x621d001e,
+0xc78,0x621e001e,
+0xc78,0x621f001e,
+};
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/Hal8192CUHWImg_wowlan.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/Hal8192CUHWImg_wowlan.c
new file mode 100644
index 000000000000..55548130496c
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/Hal8192CUHWImg_wowlan.c
@@ -0,0 +1,2557 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*Created on  2011/11/ 8, 14:15*/
+
+#include <basic_types.h>
+#include "Hal8192CUHWImg_wowlan.h"
+
+
+u8 Rtl8192CUFwTSMCWWImgArray[TSMCWWImgArrayLength] = {
+0xc1,0x88,0x02,0x00,0x51,0x00,0x00,0x00,0x03,0x23,0x16,0x43,0x72,0x34,0x00,0x00,
+0x58,0x92,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x02,0x43,0x9d,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x57,0xcb,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x5c,0xb6,0x00,0x00,0x00,0x00,0x00,0x02,0x5d,0x99,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0xbb,0x01,0x0c,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe0,0x22,0x50,
+0x06,0xe9,0x25,0x82,0xf8,0xe6,0x22,0xbb,0xfe,0x06,0xe9,0x25,0x82,0xf8,0xe2,0x22,
+0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe4,0x93,0x22,0xbb,0x01,0x06,
+0x89,0x82,0x8a,0x83,0xf0,0x22,0x50,0x02,0xf7,0x22,0xbb,0xfe,0x01,0xf3,0x22,0xf8,
+0xbb,0x01,0x0d,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0x22,
+0x50,0x06,0xe9,0x25,0x82,0xc8,0xf6,0x22,0xbb,0xfe,0x05,0xe9,0x25,0x82,0xc8,0xf2,
+0x22,0xc5,0xf0,0xf8,0xa3,0xe0,0x28,0xf0,0xc5,0xf0,0xf8,0xe5,0x82,0x15,0x82,0x70,
+0x02,0x15,0x83,0xe0,0x38,0xf0,0x22,0xbb,0x01,0x10,0xe5,0x82,0x29,0xf5,0x82,0xe5,
+0x83,0x3a,0xf5,0x83,0xe0,0xf5,0xf0,0xa3,0xe0,0x22,0x50,0x09,0xe9,0x25,0x82,0xf8,
+0x86,0xf0,0x08,0xe6,0x22,0xbb,0xfe,0x0a,0xe9,0x25,0x82,0xf8,0xe2,0xf5,0xf0,0x08,
+0xe2,0x22,0xe5,0x83,0x2a,0xf5,0x83,0xe9,0x93,0xf5,0xf0,0xa3,0xe9,0x93,0x22,0xf8,
+0xbb,0x01,0x11,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0xe5,
+0xf0,0xa3,0xf0,0x22,0x50,0x09,0xe9,0x25,0x82,0xc8,0xf6,0x08,0xa6,0xf0,0x22,0xbb,
+0xfe,0x09,0xe9,0x25,0x82,0xc8,0xf2,0xe5,0xf0,0x08,0xf2,0x22,0xef,0x4b,0xff,0xee,
+0x4a,0xfe,0xed,0x49,0xfd,0xec,0x48,0xfc,0x22,0xe0,0xfc,0xa3,0xe0,0xfd,0xa3,0xe0,
+0xfe,0xa3,0xe0,0xff,0x22,0xa4,0x25,0x82,0xf5,0x82,0xe5,0xf0,0x35,0x83,0xf5,0x83,
+0x22,0xe0,0xfb,0xa3,0xe0,0xfa,0xa3,0xe0,0xf9,0x22,0xf8,0xe0,0xfb,0xa3,0xa3,0xe0,
+0xf9,0x25,0xf0,0xf0,0xe5,0x82,0x15,0x82,0x70,0x02,0x15,0x83,0xe0,0xfa,0x38,0xf0,
+0x22,0xeb,0xf0,0xa3,0xea,0xf0,0xa3,0xe9,0xf0,0x22,0xd0,0x83,0xd0,0x82,0xf8,0xe4,
+0x93,0x70,0x12,0x74,0x01,0x93,0x70,0x0d,0xa3,0xa3,0x93,0xf8,0x74,0x01,0x93,0xf5,
+0x82,0x88,0x83,0xe4,0x73,0x74,0x02,0x93,0x68,0x60,0xef,0xa3,0xa3,0xa3,0x80,0xdf,
+0xd0,0x83,0xd0,0x82,0xf8,0xe4,0x93,0x70,0x12,0x74,0x01,0x93,0x70,0x0d,0xa3,0xa3,
+0x93,0xf8,0x74,0x01,0x93,0xf5,0x82,0x88,0x83,0xe4,0x73,0x74,0x02,0x93,0xb5,0xf0,
+0x06,0x74,0x03,0x93,0x68,0x60,0xe9,0xa3,0xa3,0xa3,0xa3,0x80,0xd8,0x02,0x43,0xdb,
+0x02,0x50,0x2a,0xe4,0x93,0xa3,0xf8,0xe4,0x93,0xa3,0x40,0x03,0xf6,0x80,0x01,0xf2,
+0x08,0xdf,0xf4,0x80,0x29,0xe4,0x93,0xa3,0xf8,0x54,0x07,0x24,0x0c,0xc8,0xc3,0x33,
+0xc4,0x54,0x0f,0x44,0x20,0xc8,0x83,0x40,0x04,0xf4,0x56,0x80,0x01,0x46,0xf6,0xdf,
+0xe4,0x80,0x0b,0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x90,0x44,0x20,0xe4,0x7e,
+0x01,0x93,0x60,0xbc,0xa3,0xff,0x54,0x3f,0x30,0xe5,0x09,0x54,0x1f,0xfe,0xe4,0x93,
+0xa3,0x60,0x01,0x0e,0xcf,0x54,0xc0,0x25,0xe0,0x60,0xa8,0x40,0xb8,0xe4,0x93,0xa3,
+0xfa,0xe4,0x93,0xa3,0xf8,0xe4,0x93,0xa3,0xc8,0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,
+0xf0,0xa3,0xc8,0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,0xdf,0xe9,0xde,0xe7,0x80,0xbe,
+0x41,0x91,0x40,0x00,0x41,0x91,0x9c,0x00,0x41,0x91,0x23,0x80,0x41,0x91,0x24,0x80,
+0x41,0x91,0x9e,0x00,0x41,0x91,0x52,0x00,0x41,0x91,0x93,0x00,0x41,0x91,0x91,0x00,
+0x41,0x91,0x90,0x00,0x41,0x91,0x92,0x00,0x00,0xf0,0x90,0x91,0x30,0xe0,0x90,0x91,
+0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x54,0x7e,0x01,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x90,0x91,0x65,0xeb,0xf0,0xa3,0xe0,0xfb,0xa3,0xe0,0xf5,0x44,0xe4,0xf5,0x45,0x12,
+0x35,0xab,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x01,0x5f,0xe4,0xf0,0x90,0x01,0x3c,0x74,
+0x08,0xf0,0xe4,0x90,0x91,0x66,0xf0,0x90,0x91,0x2d,0xe0,0x90,0x91,0x67,0xf0,0xe4,
+0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x91,0x59,0x90,0x01,0x5f,0x74,0x05,0xf0,0x90,0x06,
+0x92,0x74,0x02,0xf0,0x90,0x91,0x36,0x14,0xf0,0xe5,0x6e,0x54,0x0f,0xc3,0x94,0x0c,
+0x50,0x02,0xf1,0x23,0x22,0x90,0x02,0x84,0xef,0xf0,0xa3,0xee,0xf0,0xa3,0x74,0x05,
+0xf0,0x22,0x7d,0x01,0xaf,0x6f,0xe1,0x27,0xf1,0xe6,0xbf,0x01,0x10,0x90,0x91,0x42,
+0xe0,0xff,0xe4,0xfd,0x12,0x48,0x22,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0x8f,0x82,
+0x8e,0x83,0xa3,0xa3,0xa3,0xe4,0xf0,0x22,0xe4,0xf5,0x72,0x7f,0x60,0x7e,0x01,0x80,
+0xed,0x7f,0x00,0x22,0x90,0x91,0x53,0xe0,0x54,0xfe,0xf0,0x02,0x50,0xd6,0x22,0xe4,
+0xf5,0x75,0x22,0x02,0x5f,0xe2,0x02,0x5f,0xe9,0xef,0x8e,0xf0,0x71,0x70,0x45,0x26,
+0x00,0x40,0x45,0x4e,0x00,0x80,0x45,0x79,0x01,0x00,0x45,0x8d,0x02,0x00,0x45,0xa5,
+0x04,0x00,0x00,0x00,0x45,0xc2,0xed,0x54,0x3f,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,
+0x00,0x7f,0x40,0xef,0x2d,0xff,0xee,0x3c,0xfe,0xef,0x78,0x06,0xce,0xc3,0x13,0xce,
+0x13,0xd8,0xf9,0x78,0x06,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0x80,0x26,0xed,0x54,
+0x7f,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,0x00,0x7f,0x80,0xef,0x2d,0xff,0xee,0x3c,
+0xfe,0xef,0x78,0x07,0xce,0xc3,0x13,0xce,0x13,0xd8,0xf9,0x78,0x07,0xc3,0x33,0xce,
+0x33,0xce,0xd8,0xf9,0xfd,0xac,0x06,0x80,0x49,0xed,0x70,0x04,0xfe,0xff,0x80,0x04,
+0x7e,0x01,0x7f,0x00,0xef,0x2d,0xee,0x3c,0x7d,0x00,0xfc,0x80,0x35,0xec,0x54,0x01,
+0x4d,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,0x02,0x7f,0x00,0xef,0x2d,0xee,0x3c,0xc3,
+0x13,0x7d,0x00,0x80,0x1a,0xec,0x54,0x03,0x4d,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,
+0x04,0x7f,0x00,0xef,0x2d,0xee,0x3c,0x13,0x13,0x54,0x3f,0x7d,0x00,0x25,0xe0,0x25,
+0xe0,0xfc,0xae,0x04,0xaf,0x05,0x22,0x90,0x91,0x09,0x12,0x2a,0x8b,0x00,0x00,0x00,
+0x00,0x90,0x06,0xa9,0xe0,0x90,0x91,0x08,0xf0,0xe0,0x54,0xc0,0x70,0x0a,0x53,0x71,
+0xfe,0x53,0x71,0xfd,0x91,0xc2,0x80,0x47,0x90,0x91,0x26,0xe0,0x60,0x41,0x90,0x91,
+0x38,0xe0,0x70,0x3b,0x90,0x91,0x38,0x74,0x01,0xf0,0x7f,0x00,0x7e,0x08,0x12,0x27,
+0xde,0x90,0x91,0x09,0x12,0x2a,0x7f,0x90,0x91,0x09,0x71,0x09,0xec,0x44,0x02,0xfc,
+0x90,0x91,0x09,0x12,0x2a,0x7f,0x90,0x91,0x09,0x71,0x09,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x00,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x02,0x86,0xe0,0x54,0xfb,0xf0,0x90,
+0x91,0x08,0xe0,0x30,0xe6,0x13,0x43,0x71,0x01,0x90,0x91,0x3b,0xe0,0x64,0x02,0x60,
+0x04,0x91,0xc8,0x80,0x07,0x91,0x77,0x80,0x03,0x53,0x71,0xfe,0x90,0x91,0x08,0xe0,
+0x30,0xe7,0x16,0x43,0x71,0x02,0xe4,0x90,0x91,0x66,0x91,0x49,0x90,0x01,0x57,0x74,
+0x05,0xf0,0x90,0x91,0x3c,0x74,0x01,0xf0,0x22,0x53,0x71,0xfd,0x22,0xd3,0x10,0xaf,
+0x01,0xc3,0xc0,0xd0,0x8b,0x60,0x8a,0x61,0x89,0x62,0x90,0x91,0x68,0x71,0x41,0xab,
+0x63,0xaa,0x64,0xa9,0x65,0x90,0x91,0x6b,0x71,0x41,0xaf,0x66,0x15,0x66,0xef,0x60,
+0x1b,0x90,0x91,0x6b,0xe4,0x75,0xf0,0x01,0x71,0x2a,0x12,0x29,0xd9,0xff,0x90,0x91,
+0x68,0xe4,0x75,0xf0,0x01,0x71,0x2a,0xef,0x51,0x4d,0x80,0xde,0xab,0x60,0xaa,0x61,
+0xa9,0x62,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,
+0x6e,0x71,0x41,0x90,0x91,0x9e,0xe0,0xff,0x04,0xf0,0x90,0x00,0x01,0xef,0x51,0x5f,
+0x7f,0xaf,0x7e,0x01,0x12,0x64,0x1c,0xef,0x60,0x44,0x90,0x91,0x6e,0x71,0x21,0x8b,
+0x63,0x8a,0x64,0x89,0x65,0x75,0x66,0x02,0x7b,0x01,0x7a,0x01,0x79,0xa0,0xd1,0x6d,
+0x90,0x91,0x71,0x71,0x21,0x8b,0x63,0x8a,0x64,0x89,0x65,0x90,0x91,0x6e,0x71,0x21,
+0x12,0x29,0xd9,0xff,0xc4,0x54,0x0f,0xf5,0x66,0x7b,0x01,0x7a,0x01,0x79,0xa2,0xd1,
+0x6d,0x90,0x01,0xaf,0x74,0xff,0xf0,0x90,0x01,0xcb,0xe0,0x64,0x80,0xf0,0xd0,0xd0,
+0x92,0xaf,0x22,0x7d,0x01,0x7f,0x0c,0x90,0x91,0x95,0xed,0xf0,0x90,0x91,0x94,0xef,
+0xf0,0x54,0x0f,0xff,0xe5,0x6e,0x54,0x0f,0x6f,0x60,0x76,0x90,0x91,0x94,0xe0,0x30,
+0xe2,0x30,0xe5,0x6e,0x20,0xe2,0x05,0x7f,0x01,0x12,0x62,0x65,0xe5,0x6e,0x30,0xe3,
+0x0f,0x90,0x91,0x94,0xe0,0x20,0xe3,0x08,0x12,0x5a,0x3f,0xef,0x60,0x53,0x80,0x52,
+0xe5,0x6e,0x20,0xe3,0x4c,0x90,0x91,0x94,0xe0,0x30,0xe3,0x45,0xa3,0xe0,0xff,0x02,
+0x62,0x4a,0xe5,0x6e,0x54,0x0f,0xff,0xbf,0x0c,0x0f,0x90,0x91,0x94,0xe0,0x20,0xe3,
+0x08,0x12,0x5a,0x3f,0xef,0x60,0x2a,0xf1,0xb2,0xe5,0x6e,0x54,0x0f,0xff,0xbf,0x04,
+0x10,0x90,0x91,0x94,0xe0,0x20,0xe2,0x09,0x12,0x5b,0xb3,0xef,0x60,0x13,0x12,0x48,
+0xce,0xe5,0x6e,0x54,0x0f,0xff,0xbf,0x02,0x08,0x91,0xf1,0xef,0x60,0x03,0x12,0x63,
+0x56,0x22,0x90,0x06,0x04,0xe0,0x44,0x40,0xf0,0xe5,0x6d,0xb4,0x01,0x04,0x7f,0x01,
+0xf1,0xc9,0x53,0x6e,0xf0,0x43,0x6e,0x04,0x22,0x8f,0x67,0xf1,0xe6,0xbf,0x01,0x15,
+0x90,0x91,0x43,0x12,0x48,0x1e,0xad,0x07,0xac,0x06,0xaf,0x67,0x12,0x61,0xa3,0x90,
+0x04,0x1f,0x74,0x20,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x01,0xc4,
+0x74,0xe6,0xf0,0x74,0x47,0xa3,0xf0,0x90,0x04,0x1d,0xe0,0x60,0x1a,0x90,0x05,0x22,
+0xe0,0x54,0x90,0x60,0x07,0x90,0x01,0xc6,0xe0,0x44,0x40,0xf0,0x90,0x01,0xc7,0xe0,
+0x30,0xe1,0xe4,0x7f,0x00,0x80,0x02,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,0xe0,0xff,
+0x7d,0x01,0x90,0x91,0x74,0xef,0xf0,0xa3,0xed,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xe5,
+0x70,0x60,0x04,0xe4,0xff,0x11,0xb3,0x90,0x91,0x74,0xe0,0x30,0xe0,0x09,0x90,0x91,
+0x76,0xe4,0xf0,0xa3,0x74,0x80,0xf0,0x90,0x91,0x74,0xe0,0xff,0xc3,0x13,0x90,0xfd,
+0x10,0xf0,0x90,0x04,0x25,0xef,0xf0,0x90,0x91,0x75,0xe0,0x60,0x1f,0xa3,0xa3,0xe0,
+0xff,0x24,0x0f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x80,0xf0,0x74,0x10,
+0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x80,0xf0,0x90,0x91,0x76,0xa3,
+0xe0,0xff,0xfd,0x24,0x08,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe4,0xf0,0x74,0x09,
+0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xf0,0xf0,0x74,0x21,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xf7,0xf0,0x90,0x91,0x76,0xe0,0xfe,0xa3,
+0xe0,0xff,0x22,0xef,0x60,0x0b,0x90,0x91,0x51,0xe0,0xb4,0x01,0x10,0xe4,0xff,0x80,
+0x09,0x90,0x91,0x51,0xe0,0xb4,0x01,0x05,0x7f,0x01,0x12,0x68,0x87,0x22,0x90,0x01,
+0x37,0x74,0x02,0xf0,0x90,0x05,0x22,0x74,0xff,0xf0,0x12,0x68,0x46,0xef,0x70,0x06,
+0x90,0x01,0xc8,0x74,0xfd,0xf0,0x7d,0x02,0x7f,0x03,0x12,0x36,0xe6,0xe5,0x70,0x60,
+0x04,0x7f,0x01,0x11,0xb3,0x51,0x0c,0x53,0x6e,0xf0,0x43,0x6e,0x02,0x22,0xef,0x64,
+0x01,0x70,0x42,0x7d,0x78,0x7f,0x02,0x12,0x36,0x75,0x7d,0x02,0x7f,0x03,0x12,0x36,
+0x75,0x90,0x01,0x36,0x74,0x03,0xf0,0xfd,0x7f,0x02,0x12,0x36,0xe6,0x7d,0x10,0x7f,
+0x03,0x12,0x36,0x92,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x12,
+0x47,0x23,0xe4,0xff,0x11,0xb3,0x90,0x06,0x04,0xe0,0x54,0x7f,0xf0,0x90,0x06,0x0a,
+0xe0,0x54,0xf8,0xf0,0x22,0x90,0x01,0x36,0x74,0x7b,0xf0,0xa3,0x74,0x02,0xf0,0x7d,
+0x7b,0xff,0x12,0x36,0xe6,0x7d,0x02,0x7f,0x03,0x12,0x36,0xe6,0x7d,0x10,0x7f,0x03,
+0x12,0x36,0x92,0x90,0x06,0x04,0xe0,0x44,0x80,0xf0,0x90,0x06,0x0a,0xe0,0x44,0x07,
+0xf0,0x12,0x64,0x11,0xe5,0x6d,0x20,0xe0,0x05,0xe4,0x90,0x91,0x29,0xf0,0x22,0x8b,
+0x0e,0x8a,0x0f,0x89,0x10,0x12,0x62,0x3e,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x12,0x29,
+0xd9,0xf5,0x70,0x14,0x60,0x0e,0x14,0x60,0x1e,0x14,0x60,0x2f,0x24,0x03,0x70,0x40,
+0x7f,0x01,0x80,0x3a,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x90,0x00,0x02,0x12,0x42,0x20,
+0xfd,0xe4,0xff,0x31,0xe1,0x80,0x27,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x90,0x00,0x02,
+0x12,0x42,0x20,0xfd,0x7f,0x01,0x31,0xe1,0x1f,0x80,0x13,0xab,0x0e,0xaa,0x0f,0xa9,
+0x10,0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x7f,0x02,0x31,0xe1,0xe4,0xff,0x11,0xfe,
+0x22,0xef,0x24,0xfe,0x60,0x0b,0x04,0x70,0x22,0x90,0x91,0x39,0x74,0x01,0xf0,0x80,
+0x16,0xed,0x70,0x0a,0x90,0x91,0x35,0xe0,0x90,0x91,0x39,0xf0,0x80,0x05,0x90,0x91,
+0x39,0xed,0xf0,0x90,0x91,0x39,0xe0,0x90,0x91,0x27,0xf0,0x22,0x7f,0x78,0x7e,0x08,
+0x12,0x27,0xde,0x90,0x90,0xd8,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x27,0xde,
+0x90,0x90,0xdc,0x12,0x2a,0x7f,0x7f,0x00,0x7e,0x08,0x12,0x27,0xde,0x90,0x90,0xe0,
+0x12,0x2a,0x7f,0x90,0x91,0x51,0xe0,0x90,0x90,0xd8,0xb4,0x01,0x0d,0x12,0x43,0x09,
+0xef,0x54,0xc7,0xff,0xed,0x54,0xc7,0xfd,0x80,0x07,0x12,0x43,0x09,0xef,0x54,0xc7,
+0xff,0xec,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x78,0x7e,0x08,0x12,0x2f,0xd9,0x90,
+0x90,0xdc,0x12,0x43,0x09,0xef,0x54,0x0f,0xff,0xec,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x90,0xe0,0x12,0x43,0x09,0xef,0x44,0x02,
+0xff,0xec,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x00,0x7e,0x08,0x12,0x2f,0xd9,0x7f,
+0x70,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xe4,0x12,0x2a,0x7f,0x90,0x80,0x85,0x12,
+0x2a,0x8b,0x00,0x1b,0x25,0xa0,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x59,
+0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe4,0xfd,0xff,0x12,0x34,0x81,0x90,0x91,0x51,
+0xe0,0xb4,0x01,0x11,0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe4,0xfd,
+0x7f,0x01,0x12,0x34,0x81,0x90,0x00,0x11,0xe0,0x54,0xf6,0xf0,0x80,0x08,0xf4,0xff,
+0x90,0x00,0x43,0xe0,0x5f,0xf0,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x7f,0x10,0xdf,
+0xfe,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x9b,
+0xed,0xf0,0x90,0x91,0x9a,0xef,0xf0,0xd3,0x94,0x07,0x50,0x63,0xe0,0xff,0x74,0x01,
+0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x47,0xe0,0x5f,
+0xf0,0x51,0xe6,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,
+0x33,0xd8,0xfc,0xff,0x90,0x00,0x46,0xe0,0x4f,0xf0,0x51,0xe6,0x90,0x91,0x9b,0xe0,
+0x60,0x16,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xff,0x90,0x00,0x45,0x80,0x66,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x45,0x80,0x6b,0x90,
+0x91,0x9a,0xe0,0x24,0xf8,0xf0,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,
+0x33,0xd8,0xfc,0xc4,0x54,0xf0,0x51,0xde,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x43,0xe0,0x4f,0xf0,0x51,
+0xe6,0x90,0x91,0x9b,0xe0,0x60,0x1b,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,
+0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xff,0x90,0x00,0x42,0xe0,0x4f,
+0x80,0x1a,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xc4,0x54,0xf0,0xf4,0xff,0x90,0x00,0x42,0xe0,0x5f,0xf0,0x51,0xe6,0xd0,
+0xd0,0x92,0xaf,0x22,0xf0,0x90,0x00,0x45,0xe0,0x54,0xfe,0xfd,0x7f,0x45,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x8f,0x82,0x75,0x83,0x00,0xed,0xf0,0x51,0xe6,0xd0,0xd0,
+0x92,0xaf,0x22,0xef,0x14,0x60,0x30,0x14,0x60,0x66,0x24,0x02,0x60,0x02,0x81,0xaa,
+0x90,0x90,0xf3,0x74,0x02,0xf0,0x90,0x00,0x48,0xe0,0x44,0x0c,0xfd,0x7f,0x48,0x71,
+0xee,0x90,0x00,0x47,0xe0,0x44,0x08,0xfd,0x7f,0x47,0x71,0xee,0x90,0x00,0x45,0xe0,
+0x44,0x10,0xfd,0x7f,0x45,0x80,0x71,0xe4,0x90,0x90,0xf3,0xf0,0x90,0x90,0xef,0x12,
+0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x90,
+0x00,0x45,0xe0,0x44,0xef,0xfd,0x7f,0x45,0x71,0xee,0x90,0x00,0x45,0xe0,0x54,0xef,
+0xfd,0x7f,0x45,0x71,0xee,0x90,0x00,0x46,0xe0,0x44,0x10,0xfd,0x7f,0x46,0x80,0x38,
+0x90,0x90,0xf3,0x74,0x01,0xf0,0x90,0x90,0xf9,0x12,0x43,0x09,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x00,0x45,0xe0,0x44,0x20,0xfd,
+0x7f,0x45,0x71,0xee,0x90,0x00,0x45,0xe0,0x44,0x10,0xfd,0x7f,0x45,0x71,0xee,0x90,
+0x00,0x46,0xe0,0x44,0x10,0xfd,0x7f,0x46,0x71,0xee,0x22,0x90,0x00,0x02,0x12,0x42,
+0x20,0x90,0x90,0xf5,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0x25,0xe0,0x25,0xe0,0x90,
+0x90,0xf4,0xf0,0x12,0x29,0xd9,0x25,0xe0,0x25,0xe0,0x90,0x90,0xf8,0xf0,0x90,0x05,
+0x60,0xe0,0x90,0x91,0x03,0xf0,0x90,0x05,0x61,0xe0,0x90,0x91,0x04,0xf0,0x90,0x05,
+0x62,0xe0,0x90,0x91,0x05,0xf0,0x90,0x05,0x63,0xe0,0x90,0x91,0x06,0xf0,0xa2,0xaf,
+0xe4,0x33,0x90,0x91,0x1c,0xf0,0xc2,0xaf,0x90,0x90,0xf4,0xe0,0xff,0x12,0x6e,0x67,
+0x90,0x91,0x1c,0xe0,0x24,0xff,0x92,0xaf,0x90,0x90,0xf5,0xe0,0x70,0x02,0xa1,0xb2,
+0x90,0x90,0xf4,0xe0,0x70,0x02,0xa1,0xb2,0x90,0x90,0xf8,0xe0,0x70,0x02,0xa1,0xb2,
+0xa2,0xaf,0xe4,0x33,0x90,0x91,0x1c,0xf0,0xc2,0xaf,0x90,0x91,0x07,0x74,0x01,0xf0,
+0x90,0x91,0x1c,0xe0,0x24,0xff,0x92,0xaf,0x71,0xe5,0x90,0x00,0x46,0xe0,0x44,0x01,
+0xfd,0x7f,0x46,0x71,0xee,0x90,0x90,0xed,0xe0,0x60,0x15,0x90,0x90,0xf9,0x12,0x43,
+0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x80,0x06,
+0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,0x00,0x45,0xe0,0x54,0xef,0xfd,0x7f,0x45,0x71,
+0xee,0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,0x91,0x03,0xe0,0x90,0x05,0x84,0xf0,
+0x90,0x91,0x04,0xe0,0x90,0x05,0x85,0xf0,0x90,0x91,0x05,0xe0,0x90,0x05,0x86,0xf0,
+0x90,0x91,0x06,0xe0,0x90,0x05,0x87,0xf0,0xa2,0xaf,0xe4,0x33,0x90,0x91,0x1c,0xf0,
+0xc2,0xaf,0x90,0x01,0x3c,0xe0,0x44,0x20,0xf0,0x7d,0x20,0xe4,0xff,0x12,0x37,0x00,
+0x80,0x2b,0x90,0x90,0xf5,0xe0,0x70,0x2d,0x90,0x91,0x07,0x71,0xe4,0x90,0x00,0x46,
+0xe0,0x54,0xfe,0xfd,0x7f,0x46,0x71,0xee,0x90,0x05,0x22,0xe4,0xf0,0xa2,0xaf,0x33,
+0x90,0x91,0x1c,0xf0,0xc2,0xaf,0x7d,0x20,0xe4,0xff,0x12,0x36,0x92,0x90,0x91,0x1c,
+0xe0,0x24,0xff,0x92,0xaf,0x22,0x8b,0x0e,0x8a,0x0f,0x89,0x10,0x90,0x00,0x02,0x12,
+0x42,0x20,0x90,0x90,0xf6,0xf0,0xe0,0x30,0xe0,0x4b,0x90,0x90,0xed,0x74,0x01,0xf0,
+0x7f,0x80,0x7e,0x08,0x12,0x27,0xde,0x90,0x90,0xef,0x12,0x2a,0x7f,0xab,0x0e,0xaa,
+0x0f,0xa9,0x10,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0xe4,0xfc,0xfd,0xfe,0x78,0x1a,
+0x12,0x2a,0x6c,0xa8,0x04,0xa9,0x05,0xaa,0x06,0xab,0x07,0x90,0x90,0xef,0x12,0x43,
+0x09,0xec,0x54,0x03,0xfc,0x12,0x42,0xfc,0x90,0x90,0xf9,0x12,0x2a,0x7f,0x90,0x05,
+0x22,0xe4,0xf0,0x80,0x2d,0xe4,0x90,0x90,0xed,0xf0,0x7f,0x80,0x7e,0x08,0x12,0x27,
+0xde,0xec,0x54,0x03,0xfc,0xec,0x44,0xc0,0xfc,0x90,0x90,0xef,0x12,0x2a,0x7f,0x90,
+0x90,0xef,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,
+0x2f,0xd9,0x90,0x90,0xf6,0xe0,0x30,0xe1,0x19,0x7d,0x0c,0x7f,0x47,0x71,0xee,0x90,
+0x00,0x48,0xe0,0x44,0x0c,0xfd,0x7f,0x48,0x71,0xee,0x90,0x00,0x46,0xe0,0x44,0x10,
+0x80,0x1c,0x90,0x00,0x47,0xe0,0x54,0xf3,0xfd,0x7f,0x47,0x71,0xee,0x90,0x00,0x48,
+0xe0,0x54,0xf3,0xfd,0x7f,0x48,0x71,0xee,0x90,0x00,0x46,0xe0,0x54,0xef,0xfd,0x7f,
+0x46,0x71,0xee,0xe4,0x90,0x90,0xf3,0xf0,0x22,0x90,0x01,0x3c,0x74,0xff,0xf0,0xa3,
+0xf0,0xa3,0xf0,0x90,0x01,0x34,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x54,
+0x71,0xee,0x7d,0xff,0x7f,0x55,0x71,0xee,0x7d,0xff,0x7f,0x56,0x71,0xee,0x7d,0xff,
+0x7f,0x57,0x61,0xee,0x90,0x01,0x30,0xe4,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,
+0x01,0x38,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x50,0x71,0xee,0xe4,0xfd,
+0x7f,0x51,0x71,0xee,0xe4,0xfd,0x7f,0x52,0x71,0xee,0xe4,0xfd,0x7f,0x53,0x61,0xee,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x22,0xed,0xf0,0x90,0x91,0x21,0xef,
+0xf0,0xd3,0x94,0x07,0x50,0x4e,0xa3,0xe0,0x70,0x1a,0x90,0x91,0x21,0xe0,0xff,0x74,
+0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x47,0xe0,
+0x5f,0xf0,0x80,0x17,0x90,0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,
+0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x47,0xe0,0x4f,0xf0,0x51,0xe6,0x90,0x91,0x21,
+0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,
+0x00,0x46,0x80,0x59,0x90,0x91,0x21,0xe0,0x24,0xf8,0xf0,0xa3,0xe0,0x70,0x1d,0x90,
+0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,
+0x54,0xf0,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,0x80,0x1a,0x90,0x91,0x21,0xe0,
+0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xff,
+0x90,0x00,0x43,0xe0,0x4f,0xf0,0x51,0xe6,0x90,0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,
+0x51,0xe6,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x00,0x49,0xe0,0x90,0x91,0x9f,0xf0,0xe0,
+0x54,0x0f,0xf0,0x44,0xf0,0xfd,0x7f,0x49,0x71,0xee,0x90,0x91,0x9f,0xe0,0x44,0xb0,
+0xfd,0x7f,0x49,0x61,0xee,0x12,0x47,0xe6,0xbf,0x01,0x10,0x90,0x02,0x09,0xe0,0xff,
+0x7d,0x01,0x12,0x48,0x22,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0x75,0x28,0x33,0xe4,
+0xf5,0x29,0x75,0x2a,0x07,0xf5,0x2b,0x90,0x01,0x30,0xe5,0x28,0xf0,0xa3,0xe5,0x29,
+0xf0,0xa3,0xe5,0x2a,0xf0,0xa3,0xe5,0x2b,0xf0,0x22,0xe4,0x90,0x91,0x0e,0xf0,0xa3,
+0xf0,0x75,0x8e,0x02,0xf1,0x25,0xd1,0xe8,0x90,0x91,0x4f,0xef,0xf0,0xf1,0x0b,0x90,
+0x91,0x51,0xef,0xf0,0xf1,0x60,0x90,0x91,0x3d,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xf5,
+0x57,0xf1,0x02,0x12,0x61,0xc4,0x12,0x32,0x3d,0x12,0x44,0xff,0x11,0x0c,0xf1,0x36,
+0xd1,0xfb,0xd1,0xd0,0x12,0x44,0xfe,0x31,0x13,0x12,0x44,0xf4,0x12,0x6e,0x09,0x90,
+0x91,0x10,0xe5,0xd9,0xf0,0x12,0x4e,0xb9,0xc2,0xaf,0x90,0x00,0x80,0xe0,0x44,0x40,
+0xf0,0x12,0x4a,0xe6,0x75,0xe8,0x03,0x43,0xa8,0x85,0xd2,0xaf,0x90,0x91,0x0e,0xe0,
+0x64,0x01,0xf0,0x24,0x2a,0x90,0x01,0xc4,0xf0,0x74,0x50,0xa3,0xf0,0xe5,0x57,0x30,
+0xe2,0x10,0x12,0x5f,0xf0,0xbf,0x01,0x0a,0xc2,0xaf,0x53,0x57,0xfb,0xd2,0xaf,0x12,
+0x71,0x97,0xe5,0x57,0x30,0xe4,0x0a,0xc2,0xaf,0x53,0x57,0xef,0xd2,0xaf,0x12,0x60,
+0x2d,0x90,0x90,0xf7,0xe0,0x70,0x03,0x12,0x70,0x74,0x11,0xe7,0x90,0x91,0x3f,0xe0,
+0x90,0x01,0xba,0xf0,0x80,0xb6,0xe4,0x90,0x91,0x55,0xf0,0x90,0x91,0x53,0xe0,0x54,
+0x7f,0xf0,0xa3,0x74,0x0a,0xf0,0x22,0x90,0x06,0x34,0xe0,0x60,0x25,0x14,0x70,0x1b,
+0x7b,0x01,0x7a,0x06,0x79,0x35,0x7f,0xf9,0x7e,0x01,0x12,0x67,0xe4,0xbf,0x01,0x09,
+0x90,0x06,0x35,0xe0,0x54,0x0f,0xf0,0x80,0x04,0x80,0x00,0xe1,0x17,0xe4,0x90,0x06,
+0x34,0xf0,0x22,0x90,0x91,0x56,0xe0,0x54,0xfe,0xf0,0xe0,0x54,0x7f,0xf0,0x90,0x01,
+0x17,0xe0,0xfe,0x90,0x01,0x16,0xe0,0x7c,0x00,0x24,0x00,0xff,0xec,0x3e,0x90,0x91,
+0x5c,0xf0,0xa3,0xef,0xf0,0x90,0x01,0x04,0xe0,0x54,0x0f,0x90,0x91,0x1c,0xf0,0xe0,
+0xff,0x74,0x40,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,
+0xf9,0x90,0x91,0x5b,0xf0,0xee,0x90,0x91,0x5a,0xf0,0x90,0x91,0x5e,0xe0,0x54,0xfe,
+0xf0,0xe0,0x54,0xfd,0xf0,0xe0,0x54,0xfb,0xf0,0xe0,0x54,0xf7,0xf0,0xe0,0x54,0xef,
+0xf0,0xe0,0x54,0xdf,0xf0,0xe0,0x54,0xbf,0xf0,0xe0,0x54,0x7f,0xf0,0xe4,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xe0,0x54,0xfe,0xf0,0xe0,0x54,0xfd,0xf0,0xe0,0x54,0xf7,0xf0,0x22,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x12,0x29,0xd9,0x54,0x01,0xff,0x90,0x91,0x56,
+0xe0,0x54,0xfe,0x4f,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0x90,0x91,0x57,0xf0,0x90,
+0x00,0x02,0x12,0x42,0x20,0x90,0x91,0x58,0xf0,0x90,0x91,0x56,0xe0,0x30,0xe0,0x1a,
+0x90,0x06,0x09,0xe0,0x54,0xfe,0xf0,0x90,0x02,0x86,0xe0,0x44,0x04,0xf0,0x43,0x57,
+0x04,0x7d,0x08,0xe4,0xff,0x12,0x36,0xe6,0x80,0x12,0x7d,0x08,0xe4,0xff,0x12,0x36,
+0x75,0x90,0x02,0x86,0xe0,0x54,0xfb,0xf0,0x31,0xf1,0x31,0x13,0xd0,0xd0,0x92,0xaf,
+0x22,0x90,0x06,0x90,0xe4,0xf0,0x21,0x5a,0x90,0x91,0x19,0x12,0x43,0x41,0xef,0x12,
+0x43,0x4a,0x52,0x30,0x01,0x52,0x39,0x02,0x52,0x5b,0x03,0x52,0x64,0x09,0x52,0x6c,
+0x0c,0x52,0x75,0x0d,0x52,0x7d,0x0e,0x52,0x8e,0x1a,0x52,0x96,0x2c,0x52,0x41,0x2d,
+0x52,0x4a,0x2e,0x52,0x9e,0x30,0x52,0x53,0x3b,0x52,0x86,0x3c,0x00,0x00,0x52,0xa6,
+0x90,0x91,0x19,0x12,0x43,0x21,0x02,0x64,0x72,0x90,0x91,0x19,0x12,0x43,0x21,0xc1,
+0xf5,0x90,0x91,0x19,0x12,0x43,0x21,0x02,0x65,0x8d,0x90,0x91,0x19,0x12,0x43,0x21,
+0x02,0x65,0xd5,0x90,0x91,0x19,0x12,0x43,0x21,0xe1,0x4b,0x90,0x91,0x19,0x12,0x43,
+0x21,0x02,0x66,0x0e,0x90,0x91,0x19,0x12,0x43,0x21,0x80,0x42,0x90,0x91,0x19,0x12,
+0x43,0x21,0x02,0x4c,0xab,0x90,0x91,0x19,0x12,0x43,0x21,0xe1,0x98,0x90,0x91,0x19,
+0x12,0x43,0x21,0x02,0x4d,0xe6,0x90,0x91,0x19,0x12,0x43,0x21,0x21,0x90,0x90,0x91,
+0x19,0x12,0x43,0x21,0xa1,0x9b,0x90,0x91,0x19,0x12,0x43,0x21,0x81,0x7a,0x90,0x91,
+0x19,0x12,0x43,0x21,0xe1,0x78,0x90,0x01,0xc6,0xe0,0x44,0x01,0xf0,0x22,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x1c,0x12,0x43,0x41,0x90,0x91,0x1c,0x12,0x43,
+0x21,0x90,0x00,0x01,0x12,0x42,0x97,0xfa,0xe5,0xf0,0x24,0x00,0xff,0xe4,0x3a,0xfe,
+0x90,0x91,0x1c,0x12,0x43,0x21,0x90,0x00,0x01,0xee,0x8f,0xf0,0x12,0x42,0xcf,0x12,
+0x29,0xd9,0xff,0x60,0x2c,0xb5,0x72,0x16,0x90,0x91,0x1c,0x12,0x43,0x21,0x90,0x00,
+0x01,0x12,0x42,0x97,0x65,0x74,0x70,0x04,0xe5,0x73,0x65,0xf0,0x60,0x23,0x90,0x91,
+0x1c,0x12,0x43,0x21,0x90,0x00,0x01,0x12,0x42,0x97,0xff,0xae,0xf0,0x71,0x26,0x80,
+0x10,0x90,0x91,0x1c,0x12,0x43,0x21,0x12,0x29,0xd9,0x65,0x72,0x60,0x03,0x12,0x44,
+0xe8,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x91,0x1f,0xee,0xf0,0xa3,0xef,0xf0,0x75,0x72,
+0x01,0x8e,0x73,0xf5,0x74,0xe4,0xfd,0x7f,0x0b,0x12,0x4f,0x10,0xe4,0xfd,0x7f,0x02,
+0x12,0x4f,0x10,0x71,0x6a,0xe4,0xff,0x71,0xcc,0xe4,0xf5,0x76,0x90,0x01,0xc9,0xe5,
+0x76,0xf0,0x90,0x91,0x1f,0xe0,0xfc,0xa3,0xe0,0xfd,0xec,0xfb,0x8d,0x44,0xe4,0xf5,
+0x45,0x7d,0x01,0x7f,0x60,0x7e,0x01,0x02,0x35,0xab,0x7f,0x0b,0x71,0xd9,0xef,0x65,
+0x75,0x60,0x10,0xe5,0x75,0xb4,0x01,0x05,0xe4,0xf5,0x75,0x80,0x03,0x75,0x75,0x01,
+0x7f,0x01,0x22,0x7f,0x00,0x22,0xe5,0x72,0x64,0x01,0x70,0x3f,0x71,0x6a,0xbf,0x01,
+0x04,0x7f,0x01,0x71,0xcc,0x90,0x00,0x46,0xe0,0x44,0x04,0xfd,0x7f,0x46,0x12,0x4b,
+0xee,0x90,0x00,0x44,0xe0,0x54,0xfb,0xfd,0x7f,0x44,0x12,0x4b,0xee,0x90,0x00,0x46,
+0xe0,0x54,0xfb,0xfd,0x7f,0x46,0x12,0x4b,0xee,0x7f,0x02,0x71,0xd9,0x8f,0x76,0x90,
+0x01,0xc9,0xe5,0x76,0xf0,0xb4,0x01,0x03,0x12,0x4f,0xd7,0x22,0x90,0x01,0xca,0xe5,
+0x75,0xf0,0xef,0x60,0x03,0x12,0x4f,0xd7,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x90,0x91,0xa0,0xef,0xf0,0xd3,0x94,0x07,0x50,0x47,0xe0,0xff,0x74,0x01,0xa8,0x07,
+0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x46,0xe0,0x5f,0xf0,0x12,
+0x4a,0xe6,0x90,0x91,0xa0,0xe0,0xfd,0x74,0x01,0x7e,0x00,0xa8,0x05,0x08,0x80,0x05,
+0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,0x44,0xe0,0xfb,0xe4,0xfe,0xef,
+0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,0xce,0x13,0xd8,0xf8,0xff,0x80,
+0x44,0x90,0x91,0xa0,0xe0,0x24,0xf8,0xf0,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,
+0x02,0xc3,0x33,0xd8,0xfc,0x12,0x4a,0xde,0x90,0x91,0xa0,0xe0,0xfd,0x74,0x01,0x7e,
+0x00,0xa8,0x05,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,
+0x42,0xe0,0xfb,0xe4,0xfe,0xef,0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,
+0xce,0x13,0xd8,0xf8,0xff,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,
+0xd0,0xe4,0xf5,0x10,0x75,0x11,0x04,0xf5,0x12,0xf5,0x14,0xf5,0x15,0x90,0x02,0x09,
+0xe0,0xff,0x12,0x29,0xd9,0xfe,0xef,0x2e,0xf5,0x13,0x30,0xe0,0x08,0x75,0x0e,0x00,
+0x75,0x0f,0x80,0x80,0x05,0xe4,0xf5,0x0e,0xf5,0x0f,0xe5,0x13,0xc3,0x13,0x90,0xfd,
+0x10,0xf0,0x74,0x20,0x25,0x10,0xf5,0x10,0xad,0x0f,0xe5,0x10,0x2d,0xff,0x24,0x01,
+0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x90,0x91,0x47,0xf0,0x74,0x02,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0xfe,0xe5,0x10,0x2d,0x24,0x03,0xf5,0x82,0xe4,
+0x34,0xfc,0xf5,0x83,0xe0,0x24,0x00,0xff,0xe4,0x3e,0x90,0x91,0x48,0xf0,0xa3,0xef,
+0xf0,0x7f,0x04,0xe5,0x10,0x25,0x0f,0x2f,0x24,0x00,0xf5,0x82,0xe4,0x34,0xfc,0xf5,
+0x83,0xe0,0xfe,0x74,0x46,0x2f,0xf5,0x82,0xe4,0x34,0x91,0xf5,0x83,0xee,0xf0,0x0f,
+0xbf,0x08,0xe0,0x12,0x66,0x56,0xef,0x70,0x3f,0x90,0x01,0xc3,0xe0,0x60,0x25,0xc3,
+0xe5,0x15,0x94,0xe8,0xe5,0x14,0x94,0x03,0x40,0x09,0x90,0x01,0xc6,0xe0,0x44,0x10,
+0xf0,0x80,0x63,0x05,0x15,0xe5,0x15,0x70,0x02,0x05,0x14,0x7f,0x0a,0x7e,0x00,0x12,
+0x37,0x54,0x80,0xd5,0x90,0x01,0xc6,0xe0,0x90,0x01,0xc3,0x30,0xe2,0x05,0x74,0xfe,
+0xf0,0x80,0x43,0x74,0xff,0xf0,0x80,0x3e,0xe5,0x10,0xb4,0x78,0x23,0xe4,0xf5,0x10,
+0x05,0x13,0xe5,0x0f,0x64,0x80,0x45,0x0e,0x70,0x06,0xf5,0x0e,0xf5,0x0f,0x80,0x06,
+0x75,0x0e,0x00,0x75,0x0f,0x80,0xe5,0x13,0xc3,0x13,0x90,0xfd,0x10,0xf0,0x80,0x06,
+0x74,0x08,0x25,0x10,0xf5,0x10,0xe5,0x12,0x15,0x12,0x70,0x02,0x15,0x11,0xe5,0x12,
+0x45,0x11,0x60,0x02,0x81,0xb8,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x91,0x1c,0x12,0x43,
+0x41,0x12,0x29,0xd9,0xff,0x54,0x01,0xfe,0x90,0x91,0x5e,0xe0,0x54,0xfe,0x4e,0xf0,
+0xef,0x54,0x04,0xff,0xe0,0x54,0xfb,0x4f,0xf0,0x12,0x29,0xd9,0xff,0x54,0x02,0xfe,
+0x90,0x91,0x5e,0xe0,0x54,0xfd,0x4e,0xf0,0xef,0x54,0x08,0xff,0xe0,0x54,0xf7,0x4f,
+0xf0,0x12,0x29,0xd9,0xff,0x54,0x10,0xfe,0x90,0x91,0x5e,0xe0,0x54,0xef,0x4e,0xf0,
+0xef,0x54,0x20,0xff,0xe0,0x54,0xdf,0x4f,0xf0,0x12,0x29,0xd9,0xff,0x54,0x40,0xfe,
+0x90,0x91,0x5e,0xe0,0x54,0xbf,0x4e,0xf0,0xef,0x54,0x80,0xff,0xe0,0x54,0x7f,0x4f,
+0xf0,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x91,0x60,0xf0,0x90,0x00,0x01,0x12,0x42,
+0x20,0x90,0x91,0x5f,0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0xff,0x54,0x01,0xfe,0x90,
+0x91,0x61,0xe0,0x54,0xfe,0x4e,0xf0,0xef,0x54,0x02,0xff,0xe0,0x54,0xfd,0x4f,0xf0,
+0x90,0x00,0x03,0x12,0x42,0x20,0x54,0x04,0xff,0x90,0x91,0x61,0xe0,0x54,0xfb,0x4f,
+0xf0,0x90,0x91,0x5e,0xe0,0x54,0x01,0x90,0x01,0xb8,0xf0,0x90,0x91,0x5e,0xe0,0xff,
+0xc4,0x13,0x54,0x01,0x90,0x01,0xb9,0xf0,0x90,0x91,0x61,0xe0,0x54,0x01,0x90,0x01,
+0xba,0xf0,0xa3,0x74,0xff,0xf0,0x12,0x29,0xd9,0x20,0xe0,0x02,0x21,0xf1,0xe4,0xfd,
+0x7f,0x81,0x12,0x4b,0xee,0x90,0x91,0x1c,0x12,0x43,0x21,0x12,0x29,0xd9,0xff,0xc3,
+0x13,0x30,0xe0,0x07,0x90,0x06,0x90,0xe0,0x44,0x02,0xf0,0xef,0x13,0x13,0x54,0x3f,
+0x30,0xe0,0x07,0x90,0x06,0x90,0xe0,0x44,0x04,0xf0,0x12,0x29,0xd9,0x13,0x13,0x13,
+0x54,0x1f,0x30,0xe0,0x07,0x90,0x06,0x90,0xe0,0x44,0x08,0xf0,0x90,0x91,0x61,0xe0,
+0x30,0xe0,0x1c,0x90,0x91,0x5e,0xe0,0xc4,0x13,0x54,0x07,0x30,0xe0,0x07,0xa3,0xe0,
+0xff,0xe4,0xfd,0x80,0x07,0x90,0x91,0x5f,0xe0,0xff,0x7d,0x01,0x12,0x4a,0xf6,0x22,
+0x75,0x30,0x1f,0x75,0x31,0x01,0xe4,0xf5,0x32,0x90,0x01,0x38,0xe5,0x30,0xf0,0xa3,
+0xe5,0x31,0xf0,0xa3,0xe5,0x32,0xf0,0x22,0x90,0x00,0x02,0xe0,0x54,0xe0,0x7f,0x01,
+0x60,0x02,0x7f,0x00,0x22,0x12,0x29,0xd9,0xf5,0x6d,0x22,0x90,0x01,0x64,0x74,0xa0,
+0xf0,0x22,0x90,0x91,0x51,0xe0,0x90,0x90,0xe8,0xf0,0x22,0x90,0x00,0xf3,0xe0,0x7f,
+0x00,0x30,0xe3,0x02,0x7f,0x01,0x22,0x90,0x06,0x34,0x74,0xff,0xf0,0xe4,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xf0,0x22,0xe4,0x90,0x91,0x4e,0xf0,0x90,0x00,0x80,0xe0,0x44,0x80,
+0xfd,0x7f,0x80,0x02,0x4b,0xee,0x90,0x00,0xf3,0xe0,0x30,0xe2,0x0d,0x90,0x05,0x41,
+0x74,0x10,0xf0,0x90,0x05,0x5a,0xf0,0xa3,0xe4,0xf0,0x22,0x12,0x29,0xd9,0x60,0x02,
+0x80,0x01,0xe4,0x90,0x91,0x31,0xf0,0x90,0x91,0x31,0xe0,0x90,0x01,0xe7,0xf0,0x22,
+0x90,0x91,0x51,0xe0,0xb4,0x01,0x0c,0x90,0x00,0xf2,0xe0,0x30,0xe7,0x05,0x7e,0xfd,
+0x7f,0x33,0x22,0x7e,0xfd,0x7f,0x2f,0x22,0x12,0x29,0xd9,0xff,0x54,0x01,0xfe,0x90,
+0x91,0x53,0xe0,0x54,0xfe,0x4e,0xf0,0xef,0xc3,0x13,0x30,0xe0,0x0a,0x90,0x00,0x01,
+0x12,0x42,0x20,0x90,0x91,0x54,0xf0,0x22,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x90,
+0xf7,0xf0,0xe0,0x60,0x04,0xe0,0xf4,0x70,0x21,0xa2,0xaf,0xe4,0x33,0xf5,0x0e,0xc2,
+0xaf,0x90,0x00,0x47,0xe0,0x54,0xfb,0xfd,0x7f,0x47,0x12,0x4b,0xee,0x7d,0x40,0x7f,
+0x01,0x12,0x36,0xaf,0xe5,0x0e,0x24,0xff,0x92,0xaf,0x22,0xc0,0xe0,0xc0,0xf0,0xc0,
+0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,
+0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,0x01,0xc4,0x74,0xcb,0xf0,0x74,0x57,
+0xa3,0xf0,0x90,0x01,0x34,0xe0,0x55,0x28,0xf5,0x2c,0x90,0x01,0x36,0xe0,0x55,0x2a,
+0xf5,0x2e,0xa3,0xe0,0x55,0x2b,0xf5,0x2f,0xe5,0x2c,0x30,0xe0,0x5a,0x90,0x01,0x34,
+0x74,0x01,0xf0,0x85,0xd9,0x54,0xe5,0x70,0x14,0x24,0xfd,0x50,0x02,0x80,0x48,0x90,
+0x91,0x3b,0xe0,0x60,0x3a,0x90,0x01,0x5b,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x04,0xf0,
+0x51,0x30,0xef,0x64,0x01,0x70,0x30,0x90,0x91,0x66,0xf0,0x90,0x91,0x2d,0xe0,0x90,
+0x91,0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,0x01,0x12,0x44,0x59,0x90,0x01,0x5b,
+0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x90,0x91,0x37,0xf0,0x80,0x08,0x51,
+0x30,0xbf,0x01,0x03,0x12,0x44,0xc2,0xe5,0x2c,0x30,0xe1,0x20,0x90,0x01,0x34,0x74,
+0x02,0xf0,0x85,0xd1,0x58,0x85,0xd2,0x59,0x85,0xd3,0x5a,0x85,0xd4,0x5b,0x85,0xd5,
+0x5c,0x85,0xd6,0x5d,0x85,0xd7,0x5e,0x85,0xd9,0x5f,0x71,0x5c,0xe5,0x2c,0x30,0xe3,
+0x10,0x90,0x01,0x34,0x74,0x08,0xf0,0x90,0x91,0x56,0xe0,0x30,0xe0,0x03,0x43,0x57,
+0x04,0xe5,0x2c,0x30,0xe4,0x09,0x90,0x01,0x34,0x74,0x10,0xf0,0x43,0x57,0x10,0xe5,
+0x2c,0x30,0xe5,0x26,0x90,0x01,0xcf,0xe0,0x30,0xe5,0x1f,0xe0,0x54,0xdf,0xf0,0x90,
+0x01,0x34,0x74,0x20,0xf0,0x75,0xa8,0x00,0x75,0xe8,0x00,0x12,0x4e,0xe4,0x90,0x00,
+0x03,0xe0,0x54,0xfb,0xf0,0x12,0x4a,0xe6,0x80,0xfe,0xe5,0x2c,0x30,0xe6,0x06,0x90,
+0x01,0x34,0x74,0x40,0xf0,0xe5,0x2e,0x30,0xe0,0x13,0x90,0x91,0x50,0x74,0x01,0xf0,
+0x90,0x01,0x36,0xf0,0x91,0x23,0x51,0x87,0x90,0x91,0x50,0xe4,0xf0,0xe5,0x2e,0x30,
+0xe1,0x3c,0x90,0x01,0x36,0x74,0x02,0xf0,0x43,0x57,0x40,0x90,0x01,0x02,0xe0,0x54,
+0x03,0x64,0x01,0x70,0x29,0x90,0x01,0x37,0xe0,0x30,0xe0,0x0a,0x74,0x01,0xf0,0x90,
+0x91,0x40,0xe4,0xf0,0x80,0x18,0x90,0x91,0x40,0xe0,0x04,0xf0,0xe0,0xc3,0x94,0x0a,
+0x40,0x0c,0xe4,0xf0,0x90,0x04,0x19,0xe0,0x30,0xe0,0x03,0x12,0x4f,0xf5,0xe5,0x2e,
+0x30,0xe2,0x19,0x90,0x01,0x36,0x74,0x04,0xf0,0x90,0x91,0x3a,0xe4,0xf0,0x90,0x05,
+0x58,0x74,0x03,0xf0,0x51,0xd8,0x90,0x91,0x3f,0xe0,0x04,0xf0,0xe5,0x2e,0x30,0xe3,
+0x28,0x90,0x01,0x36,0x74,0x08,0xf0,0xe5,0x6d,0x64,0x01,0x70,0x1c,0xe5,0x70,0x60,
+0x18,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,0x91,0x66,0xe4,
+0x12,0x44,0x49,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,0x2e,0x30,0xe4,0x2b,0x90,0x01,
+0x36,0x74,0x10,0xf0,0xe5,0x6d,0xb4,0x01,0x20,0xe5,0x70,0x60,0x1c,0x90,0x01,0x57,
+0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,0x91,0x3c,0xe4,0xf0,0x53,0x71,0xfd,
+0xe5,0x71,0x54,0x07,0x70,0x03,0x12,0x44,0xc2,0xe5,0x2e,0x30,0xe5,0x1f,0x90,0x01,
+0x36,0x74,0x20,0xf0,0xe5,0x6d,0xb4,0x01,0x14,0xe5,0x70,0x60,0x10,0x90,0x91,0x3b,
+0xe0,0x64,0x02,0x60,0x05,0x12,0x44,0xc8,0x80,0x03,0x12,0x44,0x77,0xe5,0x2e,0x30,
+0xe6,0x1b,0x90,0x01,0x36,0x74,0x40,0xf0,0xe5,0x6d,0xb4,0x01,0x10,0xe5,0x70,0x60,
+0x0c,0x53,0x71,0xfe,0xe5,0x71,0x54,0x07,0x70,0x03,0x12,0x44,0xc2,0xe5,0x2f,0x30,
+0xe1,0x08,0x90,0x01,0x37,0x74,0x02,0xf0,0x71,0x7e,0x74,0xcb,0x04,0x90,0x01,0xc4,
+0xf0,0x74,0x57,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,
+0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,
+0x90,0x04,0x1b,0xe0,0x54,0x7f,0x64,0x7f,0x7f,0x01,0x60,0x02,0x7f,0x00,0x22,0x51,
+0x30,0xef,0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,0x30,0x90,0x91,
+0x37,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x22,0x90,0x91,0x36,0xe0,
+0x60,0x08,0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x14,0xe5,0x6f,0x54,0x0f,0xd3,0x94,
+0x04,0x40,0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x03,0x7f,0x01,0x22,0x90,0x01,
+0xb8,0x74,0x08,0xf0,0x7f,0x00,0x22,0x90,0x91,0x53,0xe0,0x30,0xe0,0x49,0xe5,0x6d,
+0x64,0x01,0x70,0x43,0x90,0x91,0x52,0xe0,0x04,0xf0,0xe5,0x70,0x64,0x03,0x60,0x05,
+0xe5,0x70,0xb4,0x06,0x0d,0x90,0x91,0x52,0xe0,0xff,0x74,0x01,0xd3,0x9f,0x50,0x14,
+0x80,0x07,0x90,0x91,0x52,0xe0,0xb4,0x0a,0x0b,0x90,0x91,0x55,0xe0,0x04,0xf0,0xe4,
+0x90,0x91,0x52,0xf0,0x90,0x91,0x55,0xe0,0xff,0x90,0x91,0x54,0xe0,0xb5,0x07,0x07,
+0x71,0x4e,0xe4,0x90,0x91,0x55,0xf0,0x22,0xe5,0x6d,0x64,0x01,0x70,0x63,0xe5,0x70,
+0x60,0x5f,0xe5,0x70,0x64,0x02,0x60,0x06,0xe5,0x70,0x64,0x05,0x70,0x27,0x90,0x06,
+0xab,0xe0,0x90,0x91,0x27,0xf0,0x90,0x06,0xaa,0xe0,0x90,0x91,0x39,0xf0,0x90,0x91,
+0x27,0xe0,0x70,0x07,0x90,0x91,0x39,0xe0,0xff,0x80,0x05,0x90,0x91,0x27,0xe0,0xff,
+0x90,0x91,0x27,0xef,0xf0,0x90,0x91,0x29,0xe0,0x60,0x03,0xe0,0x14,0xf0,0xe4,0x90,
+0x91,0x28,0xf0,0x90,0x01,0x57,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x53,0x71,0xfd,
+0x53,0x71,0xef,0xe5,0x70,0x14,0x24,0xfd,0x50,0x02,0x80,0x03,0x12,0x45,0xc7,0x71,
+0x42,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0xd0,0xd0,0x92,0xaf,0x22,0xe5,0x6e,
+0x30,0xe3,0x04,0xe4,0xff,0x80,0x02,0x7f,0x01,0x02,0x47,0xc9,0x90,0x91,0x08,0xe0,
+0x54,0xf0,0x44,0x03,0xf0,0x54,0x0f,0x44,0x80,0xf0,0x7b,0x00,0x7a,0x00,0x79,0x58,
+0x90,0x91,0x71,0x12,0x43,0x41,0x0b,0x7a,0x91,0x79,0x08,0x02,0x46,0xb7,0x90,0x91,
+0x80,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,0x70,0x14,0x24,0xfd,0x50,0x02,0x80,
+0x21,0x90,0x91,0x3b,0xe0,0x60,0x06,0x7d,0x01,0x7f,0x0c,0x80,0x0d,0xe5,0x6e,0x54,
+0x0f,0xc3,0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,0x04,0x12,0x47,0x27,0xe4,0xff,0x12,
+0x48,0xb3,0x22,0x51,0x30,0xef,0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,
+0x80,0x58,0xe5,0x71,0x54,0x03,0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x4a,
+0xe5,0x6f,0x54,0x0f,0xd3,0x94,0x02,0x40,0x08,0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,
+0x39,0xe5,0x71,0x30,0xe2,0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x2c,0xe5,0x71,
+0x30,0xe4,0x08,0x90,0x01,0xb9,0x74,0x10,0xf0,0x80,0x1f,0x90,0x91,0x29,0xe0,0x60,
+0x08,0x90,0x01,0xb9,0x74,0x20,0xf0,0x80,0x11,0x90,0x91,0x31,0xe0,0x60,0x08,0x90,
+0x01,0xb9,0x74,0x80,0xf0,0x80,0x03,0x7f,0x01,0x22,0x90,0x01,0xb8,0x74,0x04,0xf0,
+0x7f,0x00,0x22,0xe4,0xfb,0x90,0x91,0x78,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,
+0x70,0x70,0x02,0x81,0xb5,0xe5,0x6d,0x64,0x01,0x70,0x7a,0xe5,0x70,0x14,0x60,0x2b,
+0x24,0xfd,0x60,0x27,0x24,0x02,0x24,0xfb,0x50,0x02,0x80,0x21,0x90,0x91,0x27,0xe0,
+0x14,0xf0,0xe0,0x60,0x04,0xa3,0xe0,0x60,0x14,0x90,0x91,0x27,0xe0,0x70,0x08,0x90,
+0x91,0x39,0xe0,0x90,0x91,0x27,0xf0,0x7b,0x01,0x80,0x02,0x7b,0x01,0xeb,0x60,0x45,
+0x43,0x71,0x10,0xe4,0x90,0x91,0x66,0xf0,0x90,0x91,0x3a,0xe0,0x75,0xf0,0x05,0xa4,
+0xff,0x90,0x91,0x34,0xe0,0x2f,0x12,0x44,0x4e,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,
+0x6e,0x54,0x0f,0xc3,0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,0x04,0x12,0x47,0x27,0x90,
+0x91,0x2e,0xe0,0x60,0x10,0x90,0x91,0x2c,0xe0,0x90,0x07,0x78,0x60,0x04,0x74,0x0d,
+0xf0,0x22,0x74,0x09,0xf0,0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,
+0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,
+0x06,0xc0,0x07,0x90,0x01,0xc4,0x74,0xb6,0xf0,0x74,0x5c,0xa3,0xf0,0x53,0x91,0xef,
+0x90,0x00,0x51,0xe0,0xff,0x90,0x00,0x55,0xe0,0x5f,0xf5,0x3d,0x90,0x00,0x52,0xe0,
+0xff,0x90,0x00,0x56,0xe0,0x5f,0xf5,0x3e,0xe5,0x3d,0x30,0xe4,0x06,0x90,0x00,0x55,
+0x74,0x10,0xf0,0xe5,0x3d,0x30,0xe5,0x06,0x90,0x00,0x55,0x74,0x20,0xf0,0xe5,0x3d,
+0x30,0xe6,0x1b,0x90,0x00,0x55,0x74,0x40,0xf0,0x90,0x90,0xf6,0xe0,0x54,0x03,0xff,
+0xbf,0x03,0x0b,0x90,0x90,0xf3,0xe0,0x60,0x05,0x7f,0x01,0x12,0x4c,0x03,0xe5,0x3d,
+0x30,0xe7,0x15,0x90,0x00,0x55,0x74,0x80,0xf0,0x90,0x90,0xf6,0xe0,0x54,0x03,0xff,
+0xbf,0x03,0x05,0x7f,0x02,0x12,0x4c,0x03,0xe5,0x3e,0x30,0xe0,0x06,0x90,0x00,0x56,
+0x74,0x01,0xf0,0xe5,0x3e,0x30,0xe1,0x06,0x90,0x00,0x56,0x74,0x02,0xf0,0xe5,0x3e,
+0x30,0xe2,0x06,0x90,0x00,0x56,0x74,0x04,0xf0,0xe5,0x3e,0x30,0xe3,0x06,0x90,0x00,
+0x56,0x74,0x08,0xf0,0x90,0x01,0xc4,0x74,0xb6,0xf0,0x74,0x5c,0xa3,0xf0,0xd0,0x07,
+0xd0,0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,
+0xd0,0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,
+0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,
+0xc0,0x05,0xc0,0x06,0xc0,0x07,0x75,0x0d,0x00,0x90,0x01,0xc4,0x74,0x99,0xf0,0x74,
+0x5d,0xa3,0xf0,0x53,0x91,0xdf,0x90,0x01,0x3c,0xe0,0x55,0x30,0xf5,0x34,0xa3,0xe0,
+0x55,0x31,0xf5,0x35,0xa3,0xe0,0x55,0x32,0xf5,0x36,0xa3,0xe0,0x55,0x33,0xf5,0x37,
+0xe5,0x34,0x30,0xe0,0x06,0x90,0x01,0x3c,0x74,0x01,0xf0,0xe5,0x34,0x30,0xe1,0x08,
+0x90,0x01,0x3c,0x74,0x02,0xf0,0xf1,0x57,0xe5,0x34,0x30,0xe2,0x3a,0x90,0x01,0x3c,
+0x74,0x04,0xf0,0x90,0x06,0x92,0xe0,0x30,0xe0,0x25,0x90,0x91,0x66,0xe4,0xf0,0x90,
+0x91,0x2d,0xe0,0x90,0x91,0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,0x01,0x12,0x44,
+0x59,0x90,0x01,0x5b,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x80,0x08,0x90,
+0x91,0x37,0xe4,0xf0,0x12,0x44,0xc2,0xe5,0x34,0x30,0xe3,0x3a,0x90,0x01,0x3c,0x74,
+0x08,0xf0,0x90,0x06,0x92,0xe0,0x30,0xe1,0x25,0x90,0x91,0x66,0xe4,0xf0,0x90,0x91,
+0x2d,0xe0,0x90,0x91,0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x12,0x44,0x59,
+0x90,0x01,0x5f,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x02,0xf0,0x80,0x08,0x90,0x91,
+0x36,0xe4,0xf0,0x12,0x44,0xc2,0xe5,0x34,0x30,0xe4,0x09,0x90,0x01,0x3c,0x74,0x10,
+0xf0,0x12,0x53,0x86,0xe5,0x34,0x30,0xe5,0x09,0x90,0x01,0x3c,0x74,0x20,0xf0,0x12,
+0x6e,0xb9,0xe5,0x35,0x30,0xe0,0x5a,0x90,0x01,0x3d,0x74,0x01,0xf0,0x90,0x01,0x2f,
+0xe0,0x44,0x7f,0xf0,0x90,0x00,0x83,0xe0,0x54,0x0f,0xf5,0x0d,0xb4,0x01,0x02,0x80,
+0x1c,0xe5,0x0d,0xb4,0x02,0x05,0x90,0x00,0x83,0x80,0x12,0xe5,0x0d,0xb4,0x04,0x05,
+0x90,0x00,0x83,0x80,0x08,0xe5,0x0d,0xb4,0x0c,0x08,0x90,0x00,0x83,0xe0,0xf5,0x6f,
+0x80,0x06,0x90,0x01,0xbe,0xe0,0x04,0xf0,0x90,0x01,0xbb,0xe5,0x6f,0xf0,0xe5,0x6f,
+0x30,0xe0,0x03,0xa3,0x80,0x03,0x90,0x01,0xbd,0xe0,0x04,0xf0,0xf1,0x38,0x12,0x44,
+0xc2,0xe5,0x35,0x30,0xe2,0x06,0x90,0x01,0x3d,0x74,0x04,0xf0,0xe5,0x36,0x30,0xe0,
+0x06,0x90,0x01,0x3e,0x74,0x01,0xf0,0xe5,0x36,0x30,0xe1,0x06,0x90,0x01,0x3e,0x74,
+0x02,0xf0,0x74,0x99,0x04,0x90,0x01,0xc4,0xf0,0x74,0x5d,0xa3,0xf0,0xd0,0x07,0xd0,
+0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,
+0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,0xe5,0x6f,0x30,0xe6,0x19,0xe5,0x6f,0x54,
+0x0f,0xff,0x90,0x91,0x24,0xe0,0xfe,0x4f,0x90,0x01,0x2f,0xf0,0xee,0x64,0x80,0x90,
+0x91,0x24,0xf0,0x53,0x6f,0xbf,0x22,0xe4,0x90,0x91,0x0d,0xf0,0xe5,0x70,0x70,0x02,
+0xe1,0xe1,0x90,0x91,0x3c,0xe0,0x60,0x0d,0xe4,0xf0,0x53,0x71,0xfd,0xe5,0x71,0x54,
+0x07,0x70,0x6e,0x80,0x69,0x90,0x91,0x28,0xe0,0x04,0xf0,0x53,0x71,0xef,0x90,0x91,
+0x3a,0xe0,0x04,0xf0,0x90,0x91,0x0d,0xe0,0xf9,0xff,0x7e,0x00,0x24,0x01,0xfd,0xee,
+0x33,0xfc,0x90,0x91,0x3a,0xe0,0xb5,0x05,0x06,0xe4,0xb5,0x04,0x02,0x80,0x12,0xef,
+0x24,0x02,0xff,0xe4,0x3e,0xfe,0x90,0x91,0x3a,0xe0,0xb5,0x07,0x0a,0xe4,0xb5,0x06,
+0x06,0x90,0x05,0x58,0xe0,0x04,0xf0,0xe9,0xff,0x90,0x91,0x2f,0xe0,0x2f,0xff,0xe4,
+0x33,0xfe,0x90,0x91,0x28,0xe0,0xd3,0x9f,0xee,0x64,0x80,0xf8,0x74,0x80,0x98,0x40,
+0x0d,0xe5,0x6d,0xb4,0x01,0x0b,0xa3,0xe0,0x70,0x07,0xe0,0x04,0xf0,0x22,0x12,0x44,
+0xc2,0x22,0x8f,0x20,0x8c,0x21,0x8d,0x22,0x22,0x8f,0x23,0x8c,0x24,0x8d,0x25,0x22,
+0xe4,0x90,0x91,0x11,0xf0,0xa3,0xf0,0x90,0x02,0x86,0xe0,0x20,0xe1,0x2c,0xc3,0x90,
+0x91,0x12,0xe0,0x94,0x20,0x90,0x91,0x11,0xe0,0x94,0x03,0x40,0x0a,0x90,0x01,0xc6,
+0xe0,0x44,0x20,0xf0,0x7f,0x00,0x22,0x90,0x91,0x11,0xe4,0x75,0xf0,0x01,0x12,0x42,
+0x81,0x7f,0x01,0x7e,0x00,0x12,0x37,0x54,0x80,0xcd,0x7f,0x01,0x22,0x90,0x01,0xcc,
+0xe0,0x54,0x0f,0x90,0x91,0x11,0xf0,0x90,0x91,0x11,0xe0,0xfd,0x70,0x02,0x21,0x6f,
+0x90,0x91,0x9c,0xe0,0xff,0x74,0x01,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,
+0xce,0x33,0xce,0xd8,0xf9,0xff,0xef,0x5d,0x70,0x02,0x21,0x68,0x90,0x91,0x9c,0xe0,
+0x75,0xf0,0x04,0x90,0x01,0xd0,0x12,0x43,0x15,0xe0,0x90,0x91,0x12,0xf0,0x75,0x63,
+0x01,0x75,0x64,0x91,0x75,0x65,0x12,0x75,0x66,0x01,0x7b,0x01,0x7a,0x91,0x79,0x13,
+0x12,0x46,0x6d,0x90,0x91,0x13,0xe0,0xff,0xc4,0x13,0x13,0x13,0x54,0x01,0x90,0x91,
+0x9c,0x30,0xe0,0x59,0xe0,0x75,0xf0,0x02,0x90,0x00,0x88,0x12,0x43,0x15,0xe0,0x90,
+0x91,0x14,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x02,0x90,0x00,0x89,0x12,0x43,0x15,
+0xe0,0x90,0x91,0x15,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd1,0x12,
+0x43,0x15,0xe0,0x90,0x91,0x16,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x04,0x90,0x01,
+0xd2,0x12,0x43,0x15,0xe0,0x90,0x91,0x17,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x04,
+0x90,0x01,0xd3,0x12,0x43,0x15,0xe0,0x90,0x91,0x18,0xf0,0x80,0x33,0xe0,0x75,0xf0,
+0x04,0x90,0x01,0xd1,0x12,0x43,0x15,0xe0,0x90,0x91,0x14,0xf0,0x90,0x91,0x9c,0xe0,
+0x75,0xf0,0x04,0x90,0x01,0xd2,0x12,0x43,0x15,0xe0,0x90,0x91,0x15,0xf0,0x90,0x91,
+0x9c,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd3,0x12,0x43,0x15,0xe0,0x90,0x91,0x16,0xf0,
+0xef,0x54,0x7f,0xff,0x7b,0x01,0x7a,0x91,0x79,0x14,0x12,0x51,0xf8,0x90,0x91,0x11,
+0xe0,0xff,0x90,0x91,0x9c,0xe0,0xfe,0x74,0x01,0xa8,0x06,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xf4,0x5f,0x90,0x91,0x11,0xf0,0x90,0x91,0x9c,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0x90,0x01,0xcc,0xf0,0x90,0x91,0x9c,0xe0,
+0x04,0xf0,0xe0,0x54,0x03,0xf0,0x01,0x37,0x90,0x01,0xc6,0xe0,0x44,0x02,0xf0,0x22,
+0xad,0x07,0x74,0x11,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x01,0xf0,
+0x90,0x04,0x80,0xe0,0x54,0x0f,0xfc,0x74,0x14,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,
+0x83,0xe0,0x54,0xc0,0x4c,0xfd,0x74,0x14,0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,
+0xed,0xf0,0x22,0xef,0x60,0x0f,0x74,0x21,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,
+0xe0,0x44,0x10,0xf0,0x22,0x74,0x21,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,
+0x54,0xef,0xf0,0x22,0xe4,0xf5,0x6d,0xf5,0x71,0xf5,0x70,0x75,0x6f,0x0c,0x75,0x6e,
+0x0c,0x90,0x91,0x3b,0xf0,0x90,0x91,0x37,0xf0,0x90,0x91,0x36,0xf0,0x90,0x91,0x39,
+0x04,0xf0,0x90,0x91,0x27,0xf0,0xe4,0x90,0x91,0x3c,0xf0,0x90,0x91,0x29,0xf0,0x90,
+0x91,0x34,0x74,0x07,0xf0,0xe4,0x90,0x91,0x28,0xf0,0x90,0x91,0x32,0xf0,0xa3,0x74,
+0x03,0xf0,0x90,0x91,0x2f,0x74,0x0a,0xf0,0xa3,0x74,0x05,0xf0,0x90,0x91,0x2d,0x74,
+0x14,0xf0,0x90,0x91,0x35,0x74,0x05,0xf0,0xe4,0x90,0x91,0x2b,0xf0,0x90,0x91,0x25,
+0xf0,0x90,0x91,0x50,0xf0,0x90,0x91,0x31,0xf0,0x90,0x91,0x3a,0xf0,0x90,0x91,0x26,
+0xf0,0x90,0x91,0x38,0xf0,0x90,0x91,0x2e,0xf0,0x90,0x91,0x2c,0xf0,0x22,0xe4,0x90,
+0x91,0x3c,0xf0,0x90,0x91,0x28,0xf0,0xf5,0x71,0x22,0x90,0x06,0x04,0xe0,0x54,0xbf,
+0xf0,0xef,0x60,0x0a,0xe5,0x6d,0xb4,0x01,0x05,0xe4,0xff,0x12,0x47,0xc9,0x53,0x6e,
+0xf0,0x43,0x6e,0x0c,0x22,0x90,0x91,0x9d,0xef,0xf0,0x51,0x7e,0x90,0x91,0x9d,0xe0,
+0x60,0x05,0x90,0x05,0x22,0xe4,0xf0,0x53,0x6e,0xf0,0x43,0x6e,0x04,0x22,0x90,0x00,
+0x11,0xe0,0x44,0x09,0xf0,0x12,0x4a,0xe6,0x90,0x90,0xd8,0x12,0x43,0x09,0x90,0x80,
+0x85,0x12,0x2a,0x7f,0x7f,0x78,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0xdc,0x12,0x43,
+0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x90,
+0xe0,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x00,0x7e,0x08,0x12,0x2f,
+0xd9,0x90,0x90,0xe4,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x70,0x7e,
+0x0e,0x12,0x2f,0xd9,0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,0x03,0x2d,0x95,0xe4,0xfd,
+0xff,0x12,0x34,0x81,0x90,0x91,0x51,0xe0,0xb4,0x01,0x11,0x90,0x80,0x59,0x12,0x2a,
+0x8b,0x00,0x03,0x2d,0x95,0xe4,0xfd,0x7f,0x01,0x12,0x34,0x81,0x22,0x8f,0x77,0xe4,
+0x90,0x91,0x96,0xf0,0xa3,0xf0,0x90,0x01,0x09,0xe0,0x7f,0x00,0x30,0xe7,0x02,0x7f,
+0x01,0xef,0x65,0x77,0x60,0x3e,0xc3,0x90,0x91,0x97,0xe0,0x94,0x88,0x90,0x91,0x96,
+0xe0,0x94,0x13,0x40,0x08,0x90,0x01,0xc6,0xe0,0x44,0x80,0xf0,0x22,0x90,0x91,0x96,
+0xe4,0x75,0xf0,0x01,0x12,0x42,0x81,0x7f,0x14,0x7e,0x00,0x12,0x37,0x54,0xd3,0x90,
+0x91,0x97,0xe0,0x94,0x32,0x90,0x91,0x96,0xe0,0x94,0x00,0x40,0xb9,0x90,0x01,0xc7,
+0xe0,0x30,0xe0,0xb2,0x22,0x22,0x53,0x6e,0xf0,0x43,0x6e,0x01,0x71,0x55,0x71,0x67,
+0x53,0x6e,0xf0,0x43,0x6e,0x02,0x22,0x22,0x8f,0x78,0x12,0x47,0xe6,0xef,0x64,0x01,
+0x70,0x2e,0x90,0x91,0x44,0x12,0x48,0x1e,0xe5,0x78,0x60,0x10,0x74,0x21,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x10,0xf0,0x80,0x0e,0x74,0x21,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xef,0xf0,0x90,0x04,0x1f,0x74,0x20,0xf0,
+0x22,0xe4,0xfb,0x90,0x91,0x7c,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,0x70,0x60,
+0x5f,0xe5,0x6d,0x64,0x01,0x70,0x59,0x0b,0x90,0x91,0x27,0xf0,0x04,0x60,0x51,0x43,
+0x71,0x10,0xe4,0x90,0x91,0x66,0xf0,0x90,0x91,0x3a,0xe0,0x75,0xf0,0x05,0xa4,0xff,
+0x90,0x91,0x34,0xe0,0x2f,0x90,0x91,0x67,0xf0,0xe4,0x1b,0x12,0x44,0x54,0x90,0x01,
+0x57,0x74,0x05,0xf0,0xe5,0x6e,0x54,0x0f,0xc3,0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,
+0x04,0x12,0x47,0x27,0x90,0x91,0x2e,0xe0,0x60,0x11,0x90,0x91,0x2c,0xe0,0x90,0x07,
+0x78,0x60,0x05,0x74,0x0d,0xf0,0x80,0x03,0x74,0x09,0xf0,0x90,0x05,0x22,0xe4,0xf0,
+0x22,0x90,0x91,0x32,0xe0,0xa3,0xe0,0x90,0x05,0x58,0xf0,0x22,0xd3,0x10,0xaf,0x01,
+0xc3,0xc0,0xd0,0x90,0x91,0x84,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,
+0x90,0x91,0x84,0xe0,0xfe,0xa3,0xe0,0xf5,0x82,0x8e,0x83,0xe0,0x60,0x2d,0xc3,0x90,
+0x91,0x87,0xe0,0x94,0xe8,0x90,0x91,0x86,0xe0,0x94,0x03,0x40,0x0b,0x90,0x01,0xc6,
+0xe0,0x44,0x10,0xf0,0x7f,0x00,0x80,0x15,0x90,0x91,0x86,0xe4,0x75,0xf0,0x01,0x12,
+0x42,0x81,0x7f,0x0a,0x7e,0x00,0x12,0x37,0x54,0x80,0xc5,0x7f,0x01,0xd0,0xd0,0x92,
+0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x1c,0x12,0x43,0x41,0x90,
+0x91,0x1f,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0x90,0x91,0x1c,0x12,0x43,0x21,0x90,
+0x00,0x01,0x12,0x42,0x20,0x90,0x91,0x3b,0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0x90,
+0x91,0x25,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0xff,0x54,0x01,0x90,0x91,0x26,0xf0,
+0xef,0xc3,0x13,0x54,0x01,0x90,0x91,0x2e,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0xff,
+0x13,0x13,0x54,0x01,0x90,0x91,0x2c,0xf0,0x90,0x91,0x2e,0xe0,0x90,0x91,0x1f,0x70,
+0x26,0x12,0x2a,0x8b,0x00,0x00,0x02,0x10,0x90,0x91,0x1f,0x12,0x43,0x09,0x90,0x80,
+0x85,0x12,0x2a,0x7f,0x7f,0x60,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x91,0x1f,0x12,0x2a,
+0x8b,0x00,0x00,0x03,0x10,0x80,0x24,0x12,0x2a,0x8b,0x00,0x00,0x01,0x10,0x90,0x91,
+0x1f,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x60,0x7e,0x08,0x12,0x2f,
+0xd9,0x90,0x91,0x1f,0x12,0x2a,0x8b,0x00,0x00,0x03,0x00,0x90,0x91,0x1f,0x12,0x43,
+0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x91,
+0x26,0xe0,0x70,0x3d,0x90,0x91,0x38,0x74,0x01,0xf0,0x7f,0x00,0x7e,0x08,0x12,0x27,
+0xde,0x90,0x91,0x1f,0x12,0x2a,0x7f,0x90,0x91,0x1f,0x12,0x43,0x09,0xec,0x44,0x02,
+0xfc,0x90,0x91,0x1f,0x12,0x2a,0x7f,0x90,0x91,0x1f,0x12,0x43,0x09,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0x7f,0x00,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x02,0x86,0xe0,0x54,0xfb,
+0xf0,0x90,0x91,0x1c,0x12,0x43,0x21,0x12,0x49,0x7f,0x90,0x01,0xe5,0xe5,0x70,0xf0,
+0x90,0x91,0x3b,0xe0,0x90,0x01,0xe6,0xf0,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x00,0x02,
+0x12,0x42,0x20,0xff,0x30,0xe0,0x25,0x12,0x29,0xd9,0x90,0x91,0x2f,0xf0,0x90,0x00,
+0x01,0x12,0x42,0x20,0x90,0x91,0x30,0xf0,0xef,0xc3,0x13,0x54,0x7f,0x90,0x91,0x2d,
+0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0x90,0x91,0x35,0xf0,0x22,0x90,0x91,0x2f,0x74,
+0x0a,0xf0,0x90,0x91,0x30,0x74,0x05,0xf0,0x90,0x91,0x2d,0x74,0x14,0xf0,0x90,0x91,
+0x35,0x74,0x05,0xf0,0x22,0x12,0x29,0xd9,0x30,0xe0,0x19,0xc3,0x13,0x54,0x7f,0x90,
+0x91,0x34,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0x90,0x91,0x32,0xe4,0xf0,0xa3,
+0xef,0xf0,0x80,0x0f,0x90,0x91,0x34,0x74,0x07,0xf0,0x90,0x91,0x32,0xe4,0xf0,0xa3,
+0x74,0x03,0xf0,0x90,0x91,0x32,0xe0,0xa3,0xe0,0x90,0x05,0x58,0xf0,0x22,0x90,0x02,
+0x09,0xe0,0xfd,0x12,0x29,0xd9,0xfe,0xaf,0x05,0xed,0x2e,0x90,0x91,0x41,0xf0,0x90,
+0x00,0x01,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x91,0x42,0xf0,0x90,0x00,0x02,0x12,
+0x42,0x20,0xff,0xed,0x2f,0x90,0x91,0x43,0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0xff,
+0xed,0x2f,0x90,0x91,0x44,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0xff,0xae,0x05,0xed,
+0x2f,0x90,0x91,0x45,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x47,
+0xe0,0x90,0x91,0x1d,0xf0,0x90,0x91,0x48,0xe0,0xf5,0x19,0xa3,0xe0,0xf5,0x1a,0xe4,
+0xf5,0x16,0x74,0x4a,0x25,0x16,0xf5,0x82,0xe4,0x34,0x91,0xf5,0x83,0xe0,0xff,0x74,
+0x1b,0x25,0x16,0xf8,0xa6,0x07,0x05,0x16,0xe5,0x16,0xb4,0x04,0xe5,0x90,0x91,0x1d,
+0xe0,0x12,0x43,0x4a,0x66,0xb3,0x00,0x67,0xdc,0x01,0x66,0xba,0x02,0x66,0xba,0x03,
+0x66,0xba,0x04,0x67,0xdc,0x05,0x67,0xac,0x80,0x67,0xc2,0x81,0x67,0xdc,0x82,0x00,
+0x00,0x67,0xd8,0xaf,0x1e,0x12,0x73,0xea,0xe1,0xdc,0x90,0x91,0x1d,0xe0,0xff,0xb4,
+0x02,0x08,0x90,0x91,0x1c,0x74,0x01,0xf0,0x80,0x0f,0xef,0x90,0x91,0x1c,0xb4,0x03,
+0x05,0x74,0x02,0xf0,0x80,0x03,0x74,0x04,0xf0,0xc3,0xe5,0x19,0x94,0x08,0x50,0x49,
+0xe4,0xf5,0x16,0x90,0x91,0x1c,0xe0,0xff,0xe5,0x16,0xc3,0x9f,0x40,0x02,0xe1,0xdc,
+0xc3,0xe5,0x19,0x94,0x01,0x50,0x14,0xe5,0x16,0x25,0x1a,0xff,0xc3,0x74,0x03,0x95,
+0x16,0x24,0x1b,0xf8,0xe6,0xfd,0x12,0x4b,0xee,0x80,0x1a,0xc3,0x74,0x03,0x95,0x16,
+0x24,0x1b,0xf8,0xe6,0xff,0xe5,0x16,0x7c,0x00,0x25,0x1a,0xfd,0xec,0x35,0x19,0x8d,
+0x82,0xf5,0x83,0xef,0xf0,0x05,0x16,0x80,0xba,0xc3,0xe5,0x19,0x94,0x10,0x40,0x02,
+0xe1,0xdc,0x90,0x91,0x1d,0xe0,0x64,0x04,0x60,0x02,0xe1,0xdc,0xaf,0x1c,0xfc,0xfd,
+0xfe,0x78,0x10,0x12,0x2a,0x6c,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0xaf,0x1b,
+0xe4,0xfc,0xfd,0xfe,0x78,0x18,0x12,0x2a,0x6c,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,
+0x00,0x12,0x42,0xfc,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0xaf,0x1d,0xe4,0xfc,
+0xfd,0xfe,0x78,0x08,0x12,0x2a,0x6c,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0x12,
+0x42,0xfc,0xa8,0x04,0xa9,0x05,0xaa,0x06,0xab,0x07,0xaf,0x1e,0xe4,0xfc,0xfd,0xfe,
+0x12,0x42,0xfc,0xa3,0x12,0x2a,0x7f,0x90,0x91,0x1e,0x12,0x43,0x09,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0xaf,0x1a,0xae,0x19,0x12,0x2f,0xd9,0x80,0x30,0xe5,0x1d,0x7f,0x00,
+0xfe,0xef,0x25,0x1e,0xf5,0x18,0xe4,0x3e,0xf5,0x17,0xaf,0x18,0xfe,0x12,0x37,0x54,
+0x80,0x1a,0xe5,0x1d,0x7f,0x00,0xfe,0xef,0x25,0x1e,0xf5,0x18,0xe4,0x3e,0xf5,0x17,
+0xaf,0x18,0xfe,0x12,0x36,0xcb,0x80,0x04,0x7f,0x00,0x80,0x02,0x7f,0x01,0xd0,0xd0,
+0x92,0xaf,0x22,0x22,0x8e,0x0e,0x8f,0x0f,0x8b,0x10,0x8a,0x11,0x89,0x12,0xe4,0x90,
+0x91,0x11,0xf0,0xef,0x90,0x00,0x31,0xf0,0x12,0x4a,0xe6,0xe5,0x0e,0x54,0x03,0xff,
+0x90,0x00,0x32,0xe0,0x54,0xfc,0x4f,0xf0,0x12,0x4a,0xe6,0x90,0x00,0x33,0xe0,0x54,
+0x7f,0xf0,0x12,0x4a,0xe6,0x90,0x00,0x33,0xe0,0x20,0xe7,0x0e,0x90,0x91,0x11,0xe0,
+0xc3,0x94,0x64,0x50,0x05,0xe0,0x04,0xf0,0x80,0xeb,0x90,0x91,0x11,0xe0,0xc3,0x94,
+0x64,0x50,0x10,0x90,0x00,0x30,0xe0,0xab,0x10,0xaa,0x11,0xa9,0x12,0x12,0x42,0x4d,
+0x7f,0x01,0x22,0x7f,0x00,0x22,0xe4,0x90,0x91,0x98,0xf0,0xa3,0xf0,0x90,0x05,0xf8,
+0xe0,0x70,0x0f,0xa3,0xe0,0x70,0x0b,0xa3,0xe0,0x70,0x07,0xa3,0xe0,0x70,0x03,0x7f,
+0x01,0x22,0xd3,0x90,0x91,0x99,0xe0,0x94,0xe8,0x90,0x91,0x98,0xe0,0x94,0x03,0x40,
+0x03,0x7f,0x00,0x22,0x7f,0x32,0x7e,0x00,0x12,0x37,0x54,0x90,0x91,0x98,0xe4,0x75,
+0xf0,0x01,0x12,0x42,0x81,0x80,0xc6,0xef,0x70,0x02,0x41,0x3d,0x90,0x90,0xe8,0xe0,
+0x60,0x02,0xc1,0x08,0x90,0x90,0xd4,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0x8c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0x80,0x12,0x43,0x09,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0x7f,0x44,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0x84,0x12,0x43,0x09,
+0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x5c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0x88,
+0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x6c,0x7e,0x0e,0x12,0x2f,0xd9,
+0x90,0x90,0x8c,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,
+0x12,0x2f,0xd9,0x90,0x90,0x90,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x74,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0x94,0x12,0x43,0x09,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x78,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0x98,0x12,0x43,0x09,0x90,
+0x80,0x85,0x12,0x2a,0x7f,0x7f,0x7c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0x9c,0x12,
+0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x0e,0x12,0x2f,0xd9,0x90,
+0x90,0xa0,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x84,0x7e,0x0e,0x12,
+0x2f,0xd9,0x90,0x90,0xa4,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x88,
+0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xa8,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x8c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xac,0x12,0x43,0x09,0x90,0x80,
+0x85,0x12,0x2a,0x7f,0x7f,0xd0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xb0,0x12,0x43,
+0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xd4,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,
+0xb4,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xd8,0x7e,0x0e,0x12,0x2f,
+0xd9,0x90,0x90,0xb8,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xdc,0x7e,
+0x0e,0x12,0x2f,0xd9,0x90,0x90,0xbc,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0xe0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xc0,0x12,0x43,0x09,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0x7f,0xec,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xc4,0x12,0x43,0x09,
+0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x90,0xc8,
+0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0d,0x12,0x2f,0xd9,
+0x90,0x90,0xcc,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,
+0x12,0x2f,0xd9,0x90,0x90,0xd0,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x04,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0xe8,0x74,0x01,0xf0,0x22,0x90,0x90,0xe8,
+0xe0,0x64,0x01,0x60,0x02,0xc1,0x08,0x7f,0x8c,0x7e,0x08,0x12,0x27,0xde,0x90,0x90,
+0xd4,0x12,0x2a,0x7f,0x7f,0x44,0x7e,0x08,0x12,0x27,0xde,0x90,0x90,0x80,0x12,0x2a,
+0x7f,0x7f,0x5c,0x7e,0x08,0x12,0x27,0xde,0x90,0x90,0x84,0x12,0x2a,0x7f,0x7f,0x6c,
+0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0x88,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,0x12,
+0x27,0xde,0x90,0x90,0x8c,0x12,0x2a,0x7f,0x7f,0x74,0x7e,0x0e,0x12,0x27,0xde,0x90,
+0x90,0x90,0x12,0x2a,0x7f,0x7f,0x78,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0x94,0x12,
+0x2a,0x7f,0x7f,0x7c,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0x98,0x12,0x2a,0x7f,0x7f,
+0x80,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0x9c,0x12,0x2a,0x7f,0x7f,0x84,0x7e,0x0e,
+0x12,0x27,0xde,0x90,0x90,0xa0,0x12,0x2a,0x7f,0x7f,0x88,0x7e,0x0e,0x12,0x27,0xde,
+0x90,0x90,0xa4,0x12,0x2a,0x7f,0x7f,0x8c,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xa8,
+0x12,0x2a,0x7f,0x7f,0xd0,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xac,0x12,0x2a,0x7f,
+0x7f,0xd4,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xb0,0x12,0x2a,0x7f,0x7f,0xd8,0x7e,
+0x0e,0x12,0x27,0xde,0x90,0x90,0xb4,0x12,0x2a,0x7f,0x7f,0xdc,0x7e,0x0e,0x12,0x27,
+0xde,0x90,0x90,0xb8,0x12,0x2a,0x7f,0x7f,0xe0,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,
+0xbc,0x12,0x2a,0x7f,0x7f,0xec,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xc0,0x12,0x2a,
+0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x27,0xde,0x90,0x90,0xc4,0x12,0x2a,0x7f,0x7f,0x04,
+0x7e,0x0d,0x12,0x27,0xde,0x90,0x90,0xc8,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,
+0x27,0xde,0x90,0x90,0xcc,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x08,0x12,0x27,0xde,0x90,
+0x90,0xd0,0x12,0x2a,0x7f,0x7f,0x8c,0x7e,0x08,0x12,0x27,0xde,0x90,0x91,0x88,0x12,
+0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xed,0x44,0xc0,0xfd,0xec,0x90,0x91,0x88,
+0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x8c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x01,0x00,0x00,
+0x7f,0x44,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0xdb,0x25,
+0xa4,0x7f,0x5c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,
+0x25,0xa4,0x7f,0x6c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,
+0xdb,0x25,0xa4,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,
+0x04,0x1b,0x25,0xa4,0x7f,0x74,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,
+0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x78,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,
+0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x7c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,
+0x12,0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x80,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,
+0x85,0x12,0x2a,0x8b,0x63,0xdb,0x25,0xa4,0x7f,0x84,0x7e,0x0e,0x12,0x2f,0xd9,0x90,
+0x80,0x85,0x12,0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x88,0x7e,0x0e,0x12,0x2f,0xd9,
+0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0x8c,0x7e,0x0e,0x12,0x2f,
+0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd0,0x7e,0x0e,0x12,
+0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd4,0x7e,0x0e,
+0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd8,0x7e,
+0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa4,0x7f,0xdc,
+0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa4,0x7f,
+0xe0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x24,0xdb,0x25,0xa4,
+0x7f,0xec,0x7e,0x0e,0x12,0x2f,0xd9,0x7f,0x04,0x7e,0x0c,0x12,0x27,0xde,0x90,0x91,
+0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xe4,0xff,0xec,0x90,0x91,0x88,
+0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x11,0xff,0xec,0x90,0x91,
+0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x7f,0x04,0x7e,0x0d,0x12,0x27,0xde,0x90,0x91,
+0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x54,0xf0,0xff,0xec,0x90,
+0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x01,0xff,0xec,
+0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x04,0x7e,0x0d,0x12,0x2f,0xd9,0x7f,0x0c,0x7e,0x09,0x12,0x27,0xde,
+0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xe4,0xff,0xec,0x90,
+0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x11,0xff,0xec,
+0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,0x2f,0xd9,0x7f,0x0c,0x7e,0x09,0x12,0x27,0xde,
+0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xed,0x54,0x0f,0xfd,
+0xec,0x54,0xf0,0xfc,0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,
+0xed,0x44,0x10,0xfd,0xec,0x44,0x01,0xfc,0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,
+0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,0x2f,
+0xd9,0x7f,0x04,0x7e,0x08,0x12,0x27,0xde,0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,
+0x88,0x12,0x43,0x09,0xef,0x54,0xf0,0xff,0xec,0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,
+0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x01,0xff,0xec,0x90,0x91,0x88,0x12,0x2a,0x7f,
+0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x08,
+0x12,0x2f,0xd9,0xe4,0x90,0x90,0xe8,0xf0,0x22,0xe4,0xfd,0x7f,0x45,0x12,0x4b,0xee,
+0x90,0x04,0xfd,0xe4,0xf0,0xa3,0xf0,0x90,0x90,0xf7,0xf0,0x90,0x90,0xfd,0xf0,0x90,
+0x91,0x00,0xf0,0x90,0x90,0xfe,0xf0,0x90,0x91,0x01,0xf0,0x90,0x90,0xff,0xf0,0x90,
+0x91,0x02,0xf0,0x90,0x90,0xe9,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,
+0x90,0xee,0xf0,0x90,0x90,0xf3,0xf0,0x90,0x90,0xf5,0xf0,0x90,0x91,0x07,0xf0,0x90,
+0x90,0xf8,0xf0,0x90,0x90,0xf4,0xf0,0x90,0x90,0xed,0xf0,0x90,0x00,0x51,0xe0,0x44,
+0xc0,0xfd,0x7f,0x51,0x02,0x4b,0xee,0x90,0x05,0x60,0xe0,0x90,0x91,0x03,0xf0,0x90,
+0x05,0x61,0xe0,0x90,0x91,0x04,0xf0,0x90,0x05,0x62,0xe0,0x90,0x91,0x05,0xf0,0x90,
+0x05,0x63,0xe0,0x90,0x91,0x06,0xf0,0xc3,0x74,0xff,0x9f,0xfe,0x90,0x91,0x04,0xe0,
+0xd3,0x9e,0x40,0x1e,0xe0,0x2f,0xf0,0xa3,0xe0,0xb4,0xff,0x0f,0xe4,0xf0,0xa3,0xe0,
+0xb4,0xff,0x03,0xe4,0xf0,0x22,0x90,0x91,0x06,0x80,0x03,0x90,0x91,0x05,0xe0,0x04,
+0xf0,0x22,0x90,0x91,0x04,0xe0,0x2f,0xf0,0x22,0x90,0x90,0xf5,0xe0,0x64,0x01,0x60,
+0x02,0xe1,0x6e,0x90,0x00,0x46,0xe0,0x44,0x01,0xfd,0x7f,0x46,0x12,0x4b,0xee,0x90,
+0x91,0x07,0xe0,0x70,0x32,0x90,0x90,0xed,0xe0,0x60,0x15,0x90,0x90,0xf9,0x12,0x43,
+0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x80,0x06,
+0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,0x90,0xf4,0xe0,0xff,0xd1,0x67,0x90,0x91,0x07,
+0x74,0x01,0x12,0x4b,0xe4,0x80,0x40,0x90,0x91,0x07,0xe0,0x64,0x01,0x70,0x38,0x90,
+0x90,0xf8,0xe0,0xff,0xd1,0x67,0xe4,0x90,0x91,0x07,0xf0,0x90,0x00,0x45,0xe0,0x44,
+0x01,0xfd,0x7f,0x45,0x12,0x4b,0xee,0x90,0x90,0xed,0xe0,0x60,0x15,0x90,0x90,0xef,
+0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,
+0x80,0x05,0x90,0x05,0x22,0xe4,0xf0,0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,0x91,
+0x03,0xe0,0x90,0x05,0x84,0xf0,0x90,0x91,0x04,0xe0,0x90,0x05,0x85,0xf0,0x90,0x91,
+0x05,0xe0,0x90,0x05,0x86,0xf0,0x90,0x91,0x06,0xe0,0x90,0x05,0x87,0xf0,0x22,0x90,
+0x90,0xee,0xe0,0xc3,0x94,0x14,0x50,0x06,0xe0,0x04,0xf0,0x02,0x70,0x29,0x90,0x90,
+0xee,0xe0,0x64,0x14,0x60,0x03,0x02,0x70,0x29,0x90,0x90,0xfd,0xe0,0x70,0x25,0x90,
+0x91,0x00,0xe0,0x70,0x1f,0x90,0x90,0xfe,0xe0,0x70,0x19,0x90,0x91,0x01,0xe0,0x70,
+0x13,0x90,0x90,0xff,0xe0,0x70,0x0d,0x90,0x91,0x02,0xe0,0x70,0x07,0x90,0x04,0xfd,
+0xe0,0x54,0xfe,0xf0,0x90,0x90,0xfd,0xe0,0x90,0x04,0x44,0xf0,0x90,0x90,0xfe,0xe0,
+0x90,0x04,0x45,0xf0,0x90,0x90,0xff,0xe0,0x90,0x04,0x46,0xf0,0xa3,0xe4,0xf0,0x90,
+0x91,0x00,0xe0,0x90,0x04,0x48,0xf0,0x90,0x91,0x01,0xe0,0x90,0x04,0x49,0xf0,0x90,
+0x91,0x02,0xe0,0x90,0x04,0x4a,0xf0,0xa3,0xe4,0xf0,0x90,0x90,0xe9,0xe0,0x90,0x04,
+0x4c,0xf0,0x90,0x90,0xea,0xe0,0x90,0x04,0x4d,0xf0,0x90,0x90,0xeb,0xe0,0x90,0x04,
+0x4e,0xf0,0x90,0x90,0xec,0xe0,0x90,0x04,0x4f,0xf0,0xe4,0x90,0x90,0xee,0xf0,0x90,
+0x90,0xe9,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x90,0xfd,0xf0,0xa3,
+0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x05,0x60,0xe0,0x90,0x91,0x8c,
+0xf0,0x90,0x05,0x61,0xe0,0x90,0x91,0x8d,0xf0,0x90,0x05,0x62,0xe0,0x90,0x91,0x8e,
+0xf0,0x90,0x05,0x63,0xe0,0x90,0x91,0x8f,0xf0,0x90,0x91,0x06,0xe0,0xff,0x90,0x91,
+0x8f,0xe0,0xfe,0xd3,0x9f,0x50,0x0b,0x90,0x91,0x06,0xe0,0xc3,0x9e,0xd3,0x94,0x01,
+0x40,0x11,0x90,0x90,0xf4,0xe0,0xb4,0x01,0x02,0x80,0x03,0x90,0x90,0xf8,0xe0,0xff,
+0x12,0x6e,0x67,0x22,0x90,0x91,0x07,0xe0,0x64,0x01,0x60,0x08,0x90,0x90,0xf5,0xe0,
+0x60,0x02,0x21,0x4b,0x90,0x90,0xe9,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,
+0x80,0x3b,0x90,0x90,0xea,0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,
+0x28,0x90,0x90,0xeb,0xe0,0xc3,0x94,0xff,0x50,0x0a,0xe0,0x04,0xf0,0xe4,0x90,0x90,
+0xea,0xf0,0x80,0x15,0x90,0x90,0xec,0xe0,0xc3,0x94,0xff,0x50,0x10,0xe0,0x04,0xf0,
+0xe4,0x90,0x90,0xeb,0xf0,0x90,0x90,0xea,0xf0,0x90,0x90,0xe9,0xf0,0x90,0x00,0x44,
+0xe0,0x54,0x0c,0x60,0x76,0xe0,0x30,0xe2,0x32,0x90,0x90,0xfd,0xe0,0xc3,0x94,0xff,
+0x50,0x05,0xe0,0x04,0xf0,0x80,0x24,0x90,0x90,0xfe,0xe0,0xc3,0x94,0xff,0x50,0x06,
+0xe0,0x04,0xf0,0xe4,0x80,0x11,0x90,0x90,0xff,0xe0,0xc3,0x94,0xff,0x50,0x0c,0xe0,
+0x04,0xf0,0xe4,0x90,0x90,0xfe,0xf0,0x90,0x90,0xfd,0xf0,0x90,0x00,0x44,0xe0,0x30,
+0xe3,0x32,0x90,0x91,0x00,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x24,
+0x90,0x91,0x01,0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x11,0x90,
+0x91,0x02,0xe0,0xc3,0x94,0xff,0x50,0x0c,0xe0,0x04,0xf0,0xe4,0x90,0x91,0x01,0xf0,
+0x90,0x91,0x00,0xf0,0x90,0x04,0xfd,0xe0,0x44,0x01,0xf0,0x22,0x90,0x06,0x90,0xe0,
+0x44,0x01,0xf0,0x90,0x91,0x61,0xe0,0x30,0xe0,0x3c,0x90,0x91,0x5f,0xe0,0xff,0x90,
+0x91,0x5e,0xe0,0xfe,0xc4,0x13,0x54,0x01,0xfd,0x12,0x4a,0xf6,0x90,0x91,0x60,0xe0,
+0x75,0xf0,0x20,0xa4,0xff,0xae,0xf0,0x12,0x37,0x54,0x90,0x91,0x5e,0xe0,0xc4,0x13,
+0x54,0x07,0x30,0xe0,0x07,0xa3,0xe0,0xff,0xe4,0xfd,0x80,0x07,0x90,0x91,0x5f,0xe0,
+0xff,0x7d,0x01,0x12,0x4a,0xf6,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0xe4,0x90,
+0x91,0x19,0xf0,0xa3,0x74,0x08,0xf0,0xa3,0xf0,0xe4,0xa3,0xf0,0x90,0x01,0x1f,0xe0,
+0xfe,0x90,0x01,0x1e,0xe0,0x7c,0x00,0x24,0x00,0xff,0xec,0x3e,0x90,0x91,0x11,0xf0,
+0xa3,0xef,0xf0,0x90,0x02,0x87,0xe0,0x90,0x91,0x18,0xf0,0x90,0x91,0x56,0xe0,0x20,
+0xe0,0x02,0x61,0xc4,0xe4,0x90,0x91,0x17,0xf0,0x90,0x91,0x18,0xe0,0xff,0x90,0x91,
+0x17,0xe0,0xc3,0x9f,0x40,0x02,0x61,0xc4,0x90,0x91,0x11,0xe0,0xfc,0xa3,0xe0,0xfd,
+0xec,0xff,0x90,0xfd,0x11,0xf0,0x90,0x91,0x1c,0xef,0xf0,0x74,0x02,0x2d,0xf5,0x82,
+0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x54,0x0f,0xfc,0x33,0x33,0x33,0x54,0xf8,0xff,0xed,
+0x24,0x18,0x2f,0x90,0x91,0x15,0xf0,0xe0,0x24,0x00,0xf5,0x82,0xe4,0x34,0xfb,0xf5,
+0x83,0xe0,0x54,0xfc,0x90,0x91,0x16,0xf0,0x74,0x01,0x2d,0xf5,0x82,0xe4,0x34,0xfb,
+0xf5,0x83,0xe0,0xfe,0x74,0x00,0x2d,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x7a,
+0x00,0x24,0x00,0xff,0xea,0x3e,0x54,0x3f,0xab,0x07,0xfa,0x90,0x91,0x13,0xf0,0xa3,
+0xeb,0xf0,0xaf,0x04,0xef,0x75,0xf0,0x08,0xa4,0x24,0x18,0xff,0xe4,0x35,0xf0,0xfe,
+0xef,0x2b,0xfb,0xee,0x3a,0xfa,0x90,0x91,0x5a,0xe0,0xfe,0xa3,0xe0,0xff,0xad,0x03,
+0xac,0x02,0x12,0x45,0x09,0xaa,0x06,0xab,0x07,0x90,0x91,0x15,0xe0,0x24,0x00,0xf5,
+0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x30,0xe7,0x08,0x90,0x91,0x19,0x74,0x02,0xf0,
+0x80,0x05,0xe4,0x90,0x91,0x19,0xf0,0xaf,0x03,0x90,0x91,0x11,0xea,0x8f,0xf0,0x12,
+0x42,0x81,0x90,0x91,0x5c,0xe0,0xfe,0xa3,0xe0,0xff,0x90,0x91,0x11,0xe0,0xfc,0xa3,
+0xe0,0xfd,0xd3,0x9f,0xec,0x9e,0x40,0x1b,0x90,0x91,0x5d,0xe0,0x24,0x01,0xff,0x90,
+0x91,0x5c,0xe0,0x34,0x00,0xfe,0xc3,0xed,0x9f,0xff,0xec,0x9e,0x90,0x91,0x11,0xf0,
+0xa3,0xef,0xf0,0x90,0x91,0x16,0xe0,0xff,0x24,0x40,0x60,0x04,0x24,0x20,0x70,0x27,
+0x90,0x91,0x5e,0xe0,0xfe,0xc4,0x13,0x13,0x13,0x54,0x01,0x20,0xe0,0x02,0x61,0x9c,
+0xef,0x90,0x00,0x81,0xb4,0xa0,0x05,0xe0,0x44,0x04,0x80,0x03,0xe0,0x44,0x08,0xfd,
+0x7f,0x81,0x12,0x4b,0xee,0x61,0x95,0x90,0x91,0x5e,0xe0,0xc4,0x13,0x13,0x54,0x03,
+0x20,0xe0,0x02,0x61,0x9c,0x90,0x91,0x15,0xe0,0xff,0x24,0x00,0xf5,0x82,0xe4,0x34,
+0xfb,0xf5,0x83,0xe0,0x54,0x0c,0x64,0x08,0x70,0x72,0x90,0x91,0x19,0xe0,0xfe,0xef,
+0x2e,0xff,0xa3,0xe0,0x2f,0xff,0x24,0x1e,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,
+0x64,0x88,0x70,0x58,0x74,0x1f,0x2f,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x64,
+0x8e,0x70,0x49,0x90,0x91,0x19,0xe0,0xff,0x90,0x91,0x15,0xe0,0x2f,0xff,0x90,0x91,
+0x1a,0xe0,0x2f,0xff,0xa3,0xe0,0x2f,0xff,0x24,0x19,0xf5,0x82,0xe4,0x34,0xfb,0xf5,
+0x83,0xe0,0x64,0x03,0x70,0x26,0x74,0x1e,0x2f,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,
+0xe0,0x90,0x00,0x81,0x30,0xe3,0x05,0xe0,0x44,0x01,0x80,0x03,0xe0,0x44,0x02,0xfd,
+0x7f,0x81,0x12,0x4b,0xee,0x90,0x91,0x56,0xe0,0x44,0x80,0xf0,0x90,0x91,0x56,0xe0,
+0xff,0xc4,0x13,0x13,0x13,0x54,0x01,0x30,0xe0,0x02,0x31,0x4c,0x71,0xc9,0xbf,0x01,
+0x13,0x90,0x91,0x11,0xe0,0xfe,0xa3,0xe0,0xff,0x12,0x44,0xb5,0x90,0x91,0x17,0xe0,
+0x04,0xf0,0x21,0xd9,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x91,0x56,0xe0,0xc4,0x13,0x13,
+0x13,0x54,0x01,0x30,0xe0,0x11,0xe0,0x44,0x80,0xf0,0x90,0x91,0x5e,0xe0,0xc4,0x54,
+0x0f,0x20,0xe0,0x03,0x7f,0x00,0x22,0x7f,0x01,0x22,0x8f,0x1f,0xe4,0x90,0x91,0x22,
+0xf0,0xe5,0x1f,0x14,0xfe,0x90,0x91,0x22,0xe0,0xff,0xc3,0x9e,0x50,0x0e,0xef,0x04,
+0xfd,0x12,0x34,0xb7,0x90,0x91,0x22,0xe0,0x04,0xf0,0x80,0xe5,0xe5,0x1f,0x14,0xff,
+0x7d,0xff,0x12,0x34,0xb7,0x90,0x91,0x22,0xe5,0x1f,0xf0,0x90,0x91,0x22,0xe0,0xc3,
+0x94,0xff,0x50,0x0f,0xe0,0xff,0x04,0xfd,0x12,0x34,0xb7,0x90,0x91,0x22,0xe0,0x04,
+0xf0,0x80,0xe8,0xad,0x1f,0x7f,0xff,0x02,0x34,0xb7,0xc3,0xee,0x94,0x01,0x40,0x0a,
+0x0d,0xed,0x13,0x90,0xfd,0x10,0xf0,0xe4,0x2f,0xff,0x22,0xc3,0xee,0x94,0x01,0x40,
+0x1e,0x90,0xfd,0x11,0xe0,0xb5,0x05,0x14,0x90,0x01,0x17,0xe0,0xb5,0x05,0x07,0x90,
+0xfd,0x11,0xe4,0xf0,0x80,0x06,0xed,0x04,0x90,0xfd,0x11,0xf0,0xe4,0x2f,0xff,0x22,
+0x0f,0x75,};
+
+u8 Rtl8192CUFwUMCACutWWImgArray[UMCACutWWImgArrayLength] = {
+0xc1,0x88,0x02,0x00,0x51,0x00,0x00,0x00,0x03,0x23,0x16,0x44,0x72,0x34,0x01,0x00,
+0x58,0x92,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x02,0x43,0x9d,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x57,0xcb,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x5c,0xb6,0x00,0x00,0x00,0x00,0x00,0x02,0x5d,0x99,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0xbb,0x01,0x0c,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe0,0x22,0x50,
+0x06,0xe9,0x25,0x82,0xf8,0xe6,0x22,0xbb,0xfe,0x06,0xe9,0x25,0x82,0xf8,0xe2,0x22,
+0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe4,0x93,0x22,0xbb,0x01,0x06,
+0x89,0x82,0x8a,0x83,0xf0,0x22,0x50,0x02,0xf7,0x22,0xbb,0xfe,0x01,0xf3,0x22,0xf8,
+0xbb,0x01,0x0d,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0x22,
+0x50,0x06,0xe9,0x25,0x82,0xc8,0xf6,0x22,0xbb,0xfe,0x05,0xe9,0x25,0x82,0xc8,0xf2,
+0x22,0xc5,0xf0,0xf8,0xa3,0xe0,0x28,0xf0,0xc5,0xf0,0xf8,0xe5,0x82,0x15,0x82,0x70,
+0x02,0x15,0x83,0xe0,0x38,0xf0,0x22,0xbb,0x01,0x10,0xe5,0x82,0x29,0xf5,0x82,0xe5,
+0x83,0x3a,0xf5,0x83,0xe0,0xf5,0xf0,0xa3,0xe0,0x22,0x50,0x09,0xe9,0x25,0x82,0xf8,
+0x86,0xf0,0x08,0xe6,0x22,0xbb,0xfe,0x0a,0xe9,0x25,0x82,0xf8,0xe2,0xf5,0xf0,0x08,
+0xe2,0x22,0xe5,0x83,0x2a,0xf5,0x83,0xe9,0x93,0xf5,0xf0,0xa3,0xe9,0x93,0x22,0xf8,
+0xbb,0x01,0x11,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0xe5,
+0xf0,0xa3,0xf0,0x22,0x50,0x09,0xe9,0x25,0x82,0xc8,0xf6,0x08,0xa6,0xf0,0x22,0xbb,
+0xfe,0x09,0xe9,0x25,0x82,0xc8,0xf2,0xe5,0xf0,0x08,0xf2,0x22,0xef,0x4b,0xff,0xee,
+0x4a,0xfe,0xed,0x49,0xfd,0xec,0x48,0xfc,0x22,0xe0,0xfc,0xa3,0xe0,0xfd,0xa3,0xe0,
+0xfe,0xa3,0xe0,0xff,0x22,0xa4,0x25,0x82,0xf5,0x82,0xe5,0xf0,0x35,0x83,0xf5,0x83,
+0x22,0xe0,0xfb,0xa3,0xe0,0xfa,0xa3,0xe0,0xf9,0x22,0xf8,0xe0,0xfb,0xa3,0xa3,0xe0,
+0xf9,0x25,0xf0,0xf0,0xe5,0x82,0x15,0x82,0x70,0x02,0x15,0x83,0xe0,0xfa,0x38,0xf0,
+0x22,0xeb,0xf0,0xa3,0xea,0xf0,0xa3,0xe9,0xf0,0x22,0xd0,0x83,0xd0,0x82,0xf8,0xe4,
+0x93,0x70,0x12,0x74,0x01,0x93,0x70,0x0d,0xa3,0xa3,0x93,0xf8,0x74,0x01,0x93,0xf5,
+0x82,0x88,0x83,0xe4,0x73,0x74,0x02,0x93,0x68,0x60,0xef,0xa3,0xa3,0xa3,0x80,0xdf,
+0xd0,0x83,0xd0,0x82,0xf8,0xe4,0x93,0x70,0x12,0x74,0x01,0x93,0x70,0x0d,0xa3,0xa3,
+0x93,0xf8,0x74,0x01,0x93,0xf5,0x82,0x88,0x83,0xe4,0x73,0x74,0x02,0x93,0xb5,0xf0,
+0x06,0x74,0x03,0x93,0x68,0x60,0xe9,0xa3,0xa3,0xa3,0xa3,0x80,0xd8,0x02,0x43,0xdb,
+0x02,0x50,0x2a,0xe4,0x93,0xa3,0xf8,0xe4,0x93,0xa3,0x40,0x03,0xf6,0x80,0x01,0xf2,
+0x08,0xdf,0xf4,0x80,0x29,0xe4,0x93,0xa3,0xf8,0x54,0x07,0x24,0x0c,0xc8,0xc3,0x33,
+0xc4,0x54,0x0f,0x44,0x20,0xc8,0x83,0x40,0x04,0xf4,0x56,0x80,0x01,0x46,0xf6,0xdf,
+0xe4,0x80,0x0b,0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x90,0x44,0x20,0xe4,0x7e,
+0x01,0x93,0x60,0xbc,0xa3,0xff,0x54,0x3f,0x30,0xe5,0x09,0x54,0x1f,0xfe,0xe4,0x93,
+0xa3,0x60,0x01,0x0e,0xcf,0x54,0xc0,0x25,0xe0,0x60,0xa8,0x40,0xb8,0xe4,0x93,0xa3,
+0xfa,0xe4,0x93,0xa3,0xf8,0xe4,0x93,0xa3,0xc8,0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,
+0xf0,0xa3,0xc8,0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,0xdf,0xe9,0xde,0xe7,0x80,0xbe,
+0x41,0x91,0x40,0x00,0x41,0x91,0x9c,0x00,0x41,0x91,0x23,0x80,0x41,0x91,0x24,0x80,
+0x41,0x91,0x9e,0x00,0x41,0x91,0x52,0x00,0x41,0x91,0x93,0x00,0x41,0x91,0x91,0x00,
+0x41,0x91,0x90,0x00,0x41,0x91,0x92,0x00,0x00,0xf0,0x90,0x91,0x30,0xe0,0x90,0x91,
+0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x54,0x7e,0x01,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x90,0x91,0x65,0xeb,0xf0,0xa3,0xe0,0xfb,0xa3,0xe0,0xf5,0x44,0xe4,0xf5,0x45,0x12,
+0x30,0x62,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x01,0x5f,0xe4,0xf0,0x90,0x01,0x3c,0x74,
+0x08,0xf0,0xe4,0x90,0x91,0x66,0xf0,0x90,0x91,0x2d,0xe0,0x90,0x91,0x67,0xf0,0xe4,
+0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x91,0x59,0x90,0x01,0x5f,0x74,0x05,0xf0,0x90,0x06,
+0x92,0x74,0x02,0xf0,0x90,0x91,0x36,0x14,0xf0,0xe5,0x6e,0x54,0x0f,0xc3,0x94,0x0c,
+0x50,0x02,0xf1,0x23,0x22,0x90,0x02,0x84,0xef,0xf0,0xa3,0xee,0xf0,0xa3,0x74,0x05,
+0xf0,0x22,0x7d,0x01,0xaf,0x6f,0xe1,0x27,0xf1,0xe6,0xbf,0x01,0x10,0x90,0x91,0x42,
+0xe0,0xff,0xe4,0xfd,0x12,0x48,0x22,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0x8f,0x82,
+0x8e,0x83,0xa3,0xa3,0xa3,0xe4,0xf0,0x22,0xe4,0xf5,0x72,0x7f,0x60,0x7e,0x01,0x80,
+0xed,0x7f,0x00,0x22,0x90,0x91,0x53,0xe0,0x54,0xfe,0xf0,0x02,0x50,0xd6,0x22,0xe4,
+0xf5,0x75,0x22,0x02,0x5f,0xe2,0x02,0x5f,0xe9,0xef,0x8e,0xf0,0x71,0x70,0x45,0x26,
+0x00,0x40,0x45,0x4e,0x00,0x80,0x45,0x79,0x01,0x00,0x45,0x8d,0x02,0x00,0x45,0xa5,
+0x04,0x00,0x00,0x00,0x45,0xc2,0xed,0x54,0x3f,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,
+0x00,0x7f,0x40,0xef,0x2d,0xff,0xee,0x3c,0xfe,0xef,0x78,0x06,0xce,0xc3,0x13,0xce,
+0x13,0xd8,0xf9,0x78,0x06,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0x80,0x26,0xed,0x54,
+0x7f,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,0x00,0x7f,0x80,0xef,0x2d,0xff,0xee,0x3c,
+0xfe,0xef,0x78,0x07,0xce,0xc3,0x13,0xce,0x13,0xd8,0xf9,0x78,0x07,0xc3,0x33,0xce,
+0x33,0xce,0xd8,0xf9,0xfd,0xac,0x06,0x80,0x49,0xed,0x70,0x04,0xfe,0xff,0x80,0x04,
+0x7e,0x01,0x7f,0x00,0xef,0x2d,0xee,0x3c,0x7d,0x00,0xfc,0x80,0x35,0xec,0x54,0x01,
+0x4d,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,0x02,0x7f,0x00,0xef,0x2d,0xee,0x3c,0xc3,
+0x13,0x7d,0x00,0x80,0x1a,0xec,0x54,0x03,0x4d,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,
+0x04,0x7f,0x00,0xef,0x2d,0xee,0x3c,0x13,0x13,0x54,0x3f,0x7d,0x00,0x25,0xe0,0x25,
+0xe0,0xfc,0xae,0x04,0xaf,0x05,0x22,0x90,0x91,0x09,0x12,0x25,0x14,0x00,0x00,0x00,
+0x00,0x90,0x06,0xa9,0xe0,0x90,0x91,0x08,0xf0,0xe0,0x54,0xc0,0x70,0x0a,0x53,0x71,
+0xfe,0x53,0x71,0xfd,0x91,0xc2,0x80,0x47,0x90,0x91,0x26,0xe0,0x60,0x41,0x90,0x91,
+0x38,0xe0,0x70,0x3b,0x90,0x91,0x38,0x74,0x01,0xf0,0x7f,0x00,0x7e,0x08,0x12,0x22,
+0x65,0x90,0x91,0x09,0x12,0x25,0x08,0x90,0x91,0x09,0x71,0x09,0xec,0x44,0x02,0xfc,
+0x90,0x91,0x09,0x12,0x25,0x08,0x90,0x91,0x09,0x71,0x09,0x90,0x80,0x96,0x12,0x25,
+0x08,0x7f,0x00,0x7e,0x08,0x12,0x2b,0x08,0x90,0x02,0x86,0xe0,0x54,0xfb,0xf0,0x90,
+0x91,0x08,0xe0,0x30,0xe6,0x13,0x43,0x71,0x01,0x90,0x91,0x3b,0xe0,0x64,0x02,0x60,
+0x04,0x91,0xc8,0x80,0x07,0x91,0x77,0x80,0x03,0x53,0x71,0xfe,0x90,0x91,0x08,0xe0,
+0x30,0xe7,0x16,0x43,0x71,0x02,0xe4,0x90,0x91,0x66,0x91,0x49,0x90,0x01,0x57,0x74,
+0x05,0xf0,0x90,0x91,0x3c,0x74,0x01,0xf0,0x22,0x53,0x71,0xfd,0x22,0xd3,0x10,0xaf,
+0x01,0xc3,0xc0,0xd0,0x8b,0x60,0x8a,0x61,0x89,0x62,0x90,0x91,0x68,0x71,0x41,0xab,
+0x63,0xaa,0x64,0xa9,0x65,0x90,0x91,0x6b,0x71,0x41,0xaf,0x66,0x15,0x66,0xef,0x60,
+0x1b,0x90,0x91,0x6b,0xe4,0x75,0xf0,0x01,0x71,0x2a,0x12,0x24,0x62,0xff,0x90,0x91,
+0x68,0xe4,0x75,0xf0,0x01,0x71,0x2a,0xef,0x51,0x4d,0x80,0xde,0xab,0x60,0xaa,0x61,
+0xa9,0x62,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,
+0x6e,0x71,0x41,0x90,0x91,0x9e,0xe0,0xff,0x04,0xf0,0x90,0x00,0x01,0xef,0x51,0x5f,
+0x7f,0xaf,0x7e,0x01,0x12,0x64,0x1c,0xef,0x60,0x44,0x90,0x91,0x6e,0x71,0x21,0x8b,
+0x63,0x8a,0x64,0x89,0x65,0x75,0x66,0x02,0x7b,0x01,0x7a,0x01,0x79,0xa0,0xd1,0x6d,
+0x90,0x91,0x71,0x71,0x21,0x8b,0x63,0x8a,0x64,0x89,0x65,0x90,0x91,0x6e,0x71,0x21,
+0x12,0x24,0x62,0xff,0xc4,0x54,0x0f,0xf5,0x66,0x7b,0x01,0x7a,0x01,0x79,0xa2,0xd1,
+0x6d,0x90,0x01,0xaf,0x74,0xff,0xf0,0x90,0x01,0xcb,0xe0,0x64,0x80,0xf0,0xd0,0xd0,
+0x92,0xaf,0x22,0x7d,0x01,0x7f,0x0c,0x90,0x91,0x95,0xed,0xf0,0x90,0x91,0x94,0xef,
+0xf0,0x54,0x0f,0xff,0xe5,0x6e,0x54,0x0f,0x6f,0x60,0x76,0x90,0x91,0x94,0xe0,0x30,
+0xe2,0x30,0xe5,0x6e,0x20,0xe2,0x05,0x7f,0x01,0x12,0x62,0x65,0xe5,0x6e,0x30,0xe3,
+0x0f,0x90,0x91,0x94,0xe0,0x20,0xe3,0x08,0x12,0x5a,0x3f,0xef,0x60,0x53,0x80,0x52,
+0xe5,0x6e,0x20,0xe3,0x4c,0x90,0x91,0x94,0xe0,0x30,0xe3,0x45,0xa3,0xe0,0xff,0x02,
+0x62,0x4a,0xe5,0x6e,0x54,0x0f,0xff,0xbf,0x0c,0x0f,0x90,0x91,0x94,0xe0,0x20,0xe3,
+0x08,0x12,0x5a,0x3f,0xef,0x60,0x2a,0xf1,0xb2,0xe5,0x6e,0x54,0x0f,0xff,0xbf,0x04,
+0x10,0x90,0x91,0x94,0xe0,0x20,0xe2,0x09,0x12,0x5b,0xb3,0xef,0x60,0x13,0x12,0x48,
+0xce,0xe5,0x6e,0x54,0x0f,0xff,0xbf,0x02,0x08,0x91,0xf1,0xef,0x60,0x03,0x12,0x63,
+0x56,0x22,0x90,0x06,0x04,0xe0,0x44,0x40,0xf0,0xe5,0x6d,0xb4,0x01,0x04,0x7f,0x01,
+0xf1,0xc9,0x53,0x6e,0xf0,0x43,0x6e,0x04,0x22,0x8f,0x67,0xf1,0xe6,0xbf,0x01,0x15,
+0x90,0x91,0x43,0x12,0x48,0x1e,0xad,0x07,0xac,0x06,0xaf,0x67,0x12,0x61,0xa3,0x90,
+0x04,0x1f,0x74,0x20,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x01,0xc4,
+0x74,0xe6,0xf0,0x74,0x47,0xa3,0xf0,0x90,0x04,0x1d,0xe0,0x60,0x1a,0x90,0x05,0x22,
+0xe0,0x54,0x90,0x60,0x07,0x90,0x01,0xc6,0xe0,0x44,0x40,0xf0,0x90,0x01,0xc7,0xe0,
+0x30,0xe1,0xe4,0x7f,0x00,0x80,0x02,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,0xe0,0xff,
+0x7d,0x01,0x90,0x91,0x74,0xef,0xf0,0xa3,0xed,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xe5,
+0x70,0x60,0x04,0xe4,0xff,0x11,0xb3,0x90,0x91,0x74,0xe0,0x30,0xe0,0x09,0x90,0x91,
+0x76,0xe4,0xf0,0xa3,0x74,0x80,0xf0,0x90,0x91,0x74,0xe0,0xff,0xc3,0x13,0x90,0xfd,
+0x10,0xf0,0x90,0x04,0x25,0xef,0xf0,0x90,0x91,0x75,0xe0,0x60,0x1f,0xa3,0xa3,0xe0,
+0xff,0x24,0x0f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x80,0xf0,0x74,0x10,
+0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x80,0xf0,0x90,0x91,0x76,0xa3,
+0xe0,0xff,0xfd,0x24,0x08,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe4,0xf0,0x74,0x09,
+0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xf0,0xf0,0x74,0x21,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xf7,0xf0,0x90,0x91,0x76,0xe0,0xfe,0xa3,
+0xe0,0xff,0x22,0xef,0x60,0x0b,0x90,0x91,0x51,0xe0,0xb4,0x01,0x10,0xe4,0xff,0x80,
+0x09,0x90,0x91,0x51,0xe0,0xb4,0x01,0x05,0x7f,0x01,0x12,0x68,0x87,0x22,0x90,0x01,
+0x37,0x74,0x02,0xf0,0x90,0x05,0x22,0x74,0xff,0xf0,0x12,0x68,0x46,0xef,0x70,0x06,
+0x90,0x01,0xc8,0x74,0xfd,0xf0,0x7d,0x02,0x7f,0x03,0x12,0x31,0x9d,0xe5,0x70,0x60,
+0x04,0x7f,0x01,0x11,0xb3,0x51,0x0c,0x53,0x6e,0xf0,0x43,0x6e,0x02,0x22,0xef,0x64,
+0x01,0x70,0x42,0x7d,0x78,0x7f,0x02,0x12,0x31,0x2c,0x7d,0x02,0x7f,0x03,0x12,0x31,
+0x2c,0x90,0x01,0x36,0x74,0x03,0xf0,0xfd,0x7f,0x02,0x12,0x31,0x9d,0x7d,0x10,0x7f,
+0x03,0x12,0x31,0x49,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x12,
+0x47,0x23,0xe4,0xff,0x11,0xb3,0x90,0x06,0x04,0xe0,0x54,0x7f,0xf0,0x90,0x06,0x0a,
+0xe0,0x54,0xf8,0xf0,0x22,0x90,0x01,0x36,0x74,0x7b,0xf0,0xa3,0x74,0x02,0xf0,0x7d,
+0x7b,0xff,0x12,0x31,0x9d,0x7d,0x02,0x7f,0x03,0x12,0x31,0x9d,0x7d,0x10,0x7f,0x03,
+0x12,0x31,0x49,0x90,0x06,0x04,0xe0,0x44,0x80,0xf0,0x90,0x06,0x0a,0xe0,0x44,0x07,
+0xf0,0x12,0x64,0x11,0xe5,0x6d,0x20,0xe0,0x05,0xe4,0x90,0x91,0x29,0xf0,0x22,0x8b,
+0x0e,0x8a,0x0f,0x89,0x10,0x12,0x62,0x3e,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x12,0x24,
+0x62,0xf5,0x70,0x14,0x60,0x0e,0x14,0x60,0x1e,0x14,0x60,0x2f,0x24,0x03,0x70,0x40,
+0x7f,0x01,0x80,0x3a,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x90,0x00,0x02,0x12,0x42,0x20,
+0xfd,0xe4,0xff,0x31,0xe1,0x80,0x27,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x90,0x00,0x02,
+0x12,0x42,0x20,0xfd,0x7f,0x01,0x31,0xe1,0x1f,0x80,0x13,0xab,0x0e,0xaa,0x0f,0xa9,
+0x10,0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x7f,0x02,0x31,0xe1,0xe4,0xff,0x11,0xfe,
+0x22,0xef,0x24,0xfe,0x60,0x0b,0x04,0x70,0x22,0x90,0x91,0x39,0x74,0x01,0xf0,0x80,
+0x16,0xed,0x70,0x0a,0x90,0x91,0x35,0xe0,0x90,0x91,0x39,0xf0,0x80,0x05,0x90,0x91,
+0x39,0xed,0xf0,0x90,0x91,0x39,0xe0,0x90,0x91,0x27,0xf0,0x22,0x7f,0x78,0x7e,0x08,
+0x12,0x22,0x65,0x90,0x90,0xd8,0x12,0x25,0x08,0x7f,0x04,0x7e,0x0c,0x12,0x22,0x65,
+0x90,0x90,0xdc,0x12,0x25,0x08,0x7f,0x00,0x7e,0x08,0x12,0x22,0x65,0x90,0x90,0xe0,
+0x12,0x25,0x08,0x90,0x91,0x51,0xe0,0x90,0x90,0xd8,0xb4,0x01,0x0d,0x12,0x43,0x09,
+0xef,0x54,0xc7,0xff,0xed,0x54,0xc7,0xfd,0x80,0x07,0x12,0x43,0x09,0xef,0x54,0xc7,
+0xff,0xec,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x78,0x7e,0x08,0x12,0x2b,0x08,0x90,
+0x90,0xdc,0x12,0x43,0x09,0xef,0x54,0x0f,0xff,0xec,0x90,0x80,0x96,0x12,0x25,0x08,
+0x7f,0x04,0x7e,0x0c,0x12,0x2b,0x08,0x90,0x90,0xe0,0x12,0x43,0x09,0xef,0x44,0x02,
+0xff,0xec,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x00,0x7e,0x08,0x12,0x2b,0x08,0x7f,
+0x70,0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,0xe4,0x12,0x25,0x08,0x90,0x80,0x96,0x12,
+0x25,0x14,0x00,0x1b,0x25,0xa0,0x7f,0x70,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x68,
+0x12,0x25,0x14,0x00,0x00,0x00,0x00,0xe4,0xfd,0xff,0x12,0x30,0x2c,0x90,0x91,0x51,
+0xe0,0xb4,0x01,0x11,0x90,0x80,0x68,0x12,0x25,0x14,0x00,0x00,0x00,0x00,0xe4,0xfd,
+0x7f,0x01,0x12,0x30,0x2c,0x90,0x00,0x11,0xe0,0x54,0xf6,0xf0,0x80,0x08,0xf4,0xff,
+0x90,0x00,0x43,0xe0,0x5f,0xf0,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x7f,0x10,0xdf,
+0xfe,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x9b,
+0xed,0xf0,0x90,0x91,0x9a,0xef,0xf0,0xd3,0x94,0x07,0x50,0x63,0xe0,0xff,0x74,0x01,
+0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x47,0xe0,0x5f,
+0xf0,0x51,0xe6,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,
+0x33,0xd8,0xfc,0xff,0x90,0x00,0x46,0xe0,0x4f,0xf0,0x51,0xe6,0x90,0x91,0x9b,0xe0,
+0x60,0x16,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xff,0x90,0x00,0x45,0x80,0x66,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x45,0x80,0x6b,0x90,
+0x91,0x9a,0xe0,0x24,0xf8,0xf0,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,
+0x33,0xd8,0xfc,0xc4,0x54,0xf0,0x51,0xde,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x43,0xe0,0x4f,0xf0,0x51,
+0xe6,0x90,0x91,0x9b,0xe0,0x60,0x1b,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,
+0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xff,0x90,0x00,0x42,0xe0,0x4f,
+0x80,0x1a,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xc4,0x54,0xf0,0xf4,0xff,0x90,0x00,0x42,0xe0,0x5f,0xf0,0x51,0xe6,0xd0,
+0xd0,0x92,0xaf,0x22,0xf0,0x90,0x00,0x45,0xe0,0x54,0xfe,0xfd,0x7f,0x45,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x8f,0x82,0x75,0x83,0x00,0xed,0xf0,0x51,0xe6,0xd0,0xd0,
+0x92,0xaf,0x22,0xef,0x14,0x60,0x30,0x14,0x60,0x66,0x24,0x02,0x60,0x02,0x81,0xaa,
+0x90,0x90,0xf3,0x74,0x02,0xf0,0x90,0x00,0x48,0xe0,0x44,0x0c,0xfd,0x7f,0x48,0x71,
+0xee,0x90,0x00,0x47,0xe0,0x44,0x08,0xfd,0x7f,0x47,0x71,0xee,0x90,0x00,0x45,0xe0,
+0x44,0x10,0xfd,0x7f,0x45,0x80,0x71,0xe4,0x90,0x90,0xf3,0xf0,0x90,0x90,0xef,0x12,
+0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,0x2b,0x08,0x90,
+0x00,0x45,0xe0,0x44,0xef,0xfd,0x7f,0x45,0x71,0xee,0x90,0x00,0x45,0xe0,0x54,0xef,
+0xfd,0x7f,0x45,0x71,0xee,0x90,0x00,0x46,0xe0,0x44,0x10,0xfd,0x7f,0x46,0x80,0x38,
+0x90,0x90,0xf3,0x74,0x01,0xf0,0x90,0x90,0xf9,0x12,0x43,0x09,0x90,0x80,0x96,0x12,
+0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,0x2b,0x08,0x90,0x00,0x45,0xe0,0x44,0x20,0xfd,
+0x7f,0x45,0x71,0xee,0x90,0x00,0x45,0xe0,0x44,0x10,0xfd,0x7f,0x45,0x71,0xee,0x90,
+0x00,0x46,0xe0,0x44,0x10,0xfd,0x7f,0x46,0x71,0xee,0x22,0x90,0x00,0x02,0x12,0x42,
+0x20,0x90,0x90,0xf5,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0x25,0xe0,0x25,0xe0,0x90,
+0x90,0xf4,0xf0,0x12,0x24,0x62,0x25,0xe0,0x25,0xe0,0x90,0x90,0xf8,0xf0,0x90,0x05,
+0x60,0xe0,0x90,0x91,0x03,0xf0,0x90,0x05,0x61,0xe0,0x90,0x91,0x04,0xf0,0x90,0x05,
+0x62,0xe0,0x90,0x91,0x05,0xf0,0x90,0x05,0x63,0xe0,0x90,0x91,0x06,0xf0,0xa2,0xaf,
+0xe4,0x33,0x90,0x91,0x1c,0xf0,0xc2,0xaf,0x90,0x90,0xf4,0xe0,0xff,0x12,0x6e,0x67,
+0x90,0x91,0x1c,0xe0,0x24,0xff,0x92,0xaf,0x90,0x90,0xf5,0xe0,0x70,0x02,0xa1,0xb2,
+0x90,0x90,0xf4,0xe0,0x70,0x02,0xa1,0xb2,0x90,0x90,0xf8,0xe0,0x70,0x02,0xa1,0xb2,
+0xa2,0xaf,0xe4,0x33,0x90,0x91,0x1c,0xf0,0xc2,0xaf,0x90,0x91,0x07,0x74,0x01,0xf0,
+0x90,0x91,0x1c,0xe0,0x24,0xff,0x92,0xaf,0x71,0xe5,0x90,0x00,0x46,0xe0,0x44,0x01,
+0xfd,0x7f,0x46,0x71,0xee,0x90,0x90,0xed,0xe0,0x60,0x15,0x90,0x90,0xf9,0x12,0x43,
+0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,0x2b,0x08,0x80,0x06,
+0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,0x00,0x45,0xe0,0x54,0xef,0xfd,0x7f,0x45,0x71,
+0xee,0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,0x91,0x03,0xe0,0x90,0x05,0x84,0xf0,
+0x90,0x91,0x04,0xe0,0x90,0x05,0x85,0xf0,0x90,0x91,0x05,0xe0,0x90,0x05,0x86,0xf0,
+0x90,0x91,0x06,0xe0,0x90,0x05,0x87,0xf0,0xa2,0xaf,0xe4,0x33,0x90,0x91,0x1c,0xf0,
+0xc2,0xaf,0x90,0x01,0x3c,0xe0,0x44,0x20,0xf0,0x7d,0x20,0xe4,0xff,0x12,0x31,0xb7,
+0x80,0x2b,0x90,0x90,0xf5,0xe0,0x70,0x2d,0x90,0x91,0x07,0x71,0xe4,0x90,0x00,0x46,
+0xe0,0x54,0xfe,0xfd,0x7f,0x46,0x71,0xee,0x90,0x05,0x22,0xe4,0xf0,0xa2,0xaf,0x33,
+0x90,0x91,0x1c,0xf0,0xc2,0xaf,0x7d,0x20,0xe4,0xff,0x12,0x31,0x49,0x90,0x91,0x1c,
+0xe0,0x24,0xff,0x92,0xaf,0x22,0x8b,0x0e,0x8a,0x0f,0x89,0x10,0x90,0x00,0x02,0x12,
+0x42,0x20,0x90,0x90,0xf6,0xf0,0xe0,0x30,0xe0,0x4b,0x90,0x90,0xed,0x74,0x01,0xf0,
+0x7f,0x80,0x7e,0x08,0x12,0x22,0x65,0x90,0x90,0xef,0x12,0x25,0x08,0xab,0x0e,0xaa,
+0x0f,0xa9,0x10,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0xe4,0xfc,0xfd,0xfe,0x78,0x1a,
+0x12,0x24,0xf5,0xa8,0x04,0xa9,0x05,0xaa,0x06,0xab,0x07,0x90,0x90,0xef,0x12,0x43,
+0x09,0xec,0x54,0x03,0xfc,0x12,0x42,0xfc,0x90,0x90,0xf9,0x12,0x25,0x08,0x90,0x05,
+0x22,0xe4,0xf0,0x80,0x2d,0xe4,0x90,0x90,0xed,0xf0,0x7f,0x80,0x7e,0x08,0x12,0x22,
+0x65,0xec,0x54,0x03,0xfc,0xec,0x44,0xc0,0xfc,0x90,0x90,0xef,0x12,0x25,0x08,0x90,
+0x90,0xef,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,
+0x2b,0x08,0x90,0x90,0xf6,0xe0,0x30,0xe1,0x19,0x7d,0x0c,0x7f,0x47,0x71,0xee,0x90,
+0x00,0x48,0xe0,0x44,0x0c,0xfd,0x7f,0x48,0x71,0xee,0x90,0x00,0x46,0xe0,0x44,0x10,
+0x80,0x1c,0x90,0x00,0x47,0xe0,0x54,0xf3,0xfd,0x7f,0x47,0x71,0xee,0x90,0x00,0x48,
+0xe0,0x54,0xf3,0xfd,0x7f,0x48,0x71,0xee,0x90,0x00,0x46,0xe0,0x54,0xef,0xfd,0x7f,
+0x46,0x71,0xee,0xe4,0x90,0x90,0xf3,0xf0,0x22,0x90,0x01,0x3c,0x74,0xff,0xf0,0xa3,
+0xf0,0xa3,0xf0,0x90,0x01,0x34,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x54,
+0x71,0xee,0x7d,0xff,0x7f,0x55,0x71,0xee,0x7d,0xff,0x7f,0x56,0x71,0xee,0x7d,0xff,
+0x7f,0x57,0x61,0xee,0x90,0x01,0x30,0xe4,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,
+0x01,0x38,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x50,0x71,0xee,0xe4,0xfd,
+0x7f,0x51,0x71,0xee,0xe4,0xfd,0x7f,0x52,0x71,0xee,0xe4,0xfd,0x7f,0x53,0x61,0xee,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x22,0xed,0xf0,0x90,0x91,0x21,0xef,
+0xf0,0xd3,0x94,0x07,0x50,0x4e,0xa3,0xe0,0x70,0x1a,0x90,0x91,0x21,0xe0,0xff,0x74,
+0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x47,0xe0,
+0x5f,0xf0,0x80,0x17,0x90,0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,
+0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x47,0xe0,0x4f,0xf0,0x51,0xe6,0x90,0x91,0x21,
+0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,
+0x00,0x46,0x80,0x59,0x90,0x91,0x21,0xe0,0x24,0xf8,0xf0,0xa3,0xe0,0x70,0x1d,0x90,
+0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,
+0x54,0xf0,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,0x80,0x1a,0x90,0x91,0x21,0xe0,
+0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xff,
+0x90,0x00,0x43,0xe0,0x4f,0xf0,0x51,0xe6,0x90,0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,
+0x51,0xe6,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x00,0x49,0xe0,0x90,0x91,0x9f,0xf0,0xe0,
+0x54,0x0f,0xf0,0x44,0xf0,0xfd,0x7f,0x49,0x71,0xee,0x90,0x91,0x9f,0xe0,0x44,0xb0,
+0xfd,0x7f,0x49,0x61,0xee,0x12,0x47,0xe6,0xbf,0x01,0x10,0x90,0x02,0x09,0xe0,0xff,
+0x7d,0x01,0x12,0x48,0x22,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0x75,0x28,0x33,0xe4,
+0xf5,0x29,0x75,0x2a,0x07,0xf5,0x2b,0x90,0x01,0x30,0xe5,0x28,0xf0,0xa3,0xe5,0x29,
+0xf0,0xa3,0xe5,0x2a,0xf0,0xa3,0xe5,0x2b,0xf0,0x22,0xe4,0x90,0x91,0x0e,0xf0,0xa3,
+0xf0,0x75,0x8e,0x02,0xf1,0x25,0xd1,0xe8,0x90,0x91,0x4f,0xef,0xf0,0xf1,0x0b,0x90,
+0x91,0x51,0xef,0xf0,0xf1,0x60,0x90,0x91,0x3d,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xf5,
+0x57,0xf1,0x02,0x12,0x61,0xc4,0x12,0x2e,0x01,0x12,0x44,0xff,0x11,0x0c,0xf1,0x36,
+0xd1,0xfb,0xd1,0xd0,0x12,0x44,0xfe,0x31,0x13,0x12,0x44,0xf4,0x12,0x6e,0x09,0x90,
+0x91,0x10,0xe5,0xd9,0xf0,0x12,0x4e,0xb9,0xc2,0xaf,0x90,0x00,0x80,0xe0,0x44,0x40,
+0xf0,0x12,0x4a,0xe6,0x75,0xe8,0x03,0x43,0xa8,0x85,0xd2,0xaf,0x90,0x91,0x0e,0xe0,
+0x64,0x01,0xf0,0x24,0x2a,0x90,0x01,0xc4,0xf0,0x74,0x50,0xa3,0xf0,0xe5,0x57,0x30,
+0xe2,0x10,0x12,0x5f,0xf0,0xbf,0x01,0x0a,0xc2,0xaf,0x53,0x57,0xfb,0xd2,0xaf,0x12,
+0x71,0x97,0xe5,0x57,0x30,0xe4,0x0a,0xc2,0xaf,0x53,0x57,0xef,0xd2,0xaf,0x12,0x60,
+0x2d,0x90,0x90,0xf7,0xe0,0x70,0x03,0x12,0x70,0x74,0x11,0xe7,0x90,0x91,0x3f,0xe0,
+0x90,0x01,0xba,0xf0,0x80,0xb6,0xe4,0x90,0x91,0x55,0xf0,0x90,0x91,0x53,0xe0,0x54,
+0x7f,0xf0,0xa3,0x74,0x0a,0xf0,0x22,0x90,0x06,0x34,0xe0,0x60,0x25,0x14,0x70,0x1b,
+0x7b,0x01,0x7a,0x06,0x79,0x35,0x7f,0xf9,0x7e,0x01,0x12,0x67,0xe4,0xbf,0x01,0x09,
+0x90,0x06,0x35,0xe0,0x54,0x0f,0xf0,0x80,0x04,0x80,0x00,0xe1,0x17,0xe4,0x90,0x06,
+0x34,0xf0,0x22,0x90,0x91,0x56,0xe0,0x54,0xfe,0xf0,0xe0,0x54,0x7f,0xf0,0x90,0x01,
+0x17,0xe0,0xfe,0x90,0x01,0x16,0xe0,0x7c,0x00,0x24,0x00,0xff,0xec,0x3e,0x90,0x91,
+0x5c,0xf0,0xa3,0xef,0xf0,0x90,0x01,0x04,0xe0,0x54,0x0f,0x90,0x91,0x1c,0xf0,0xe0,
+0xff,0x74,0x40,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,
+0xf9,0x90,0x91,0x5b,0xf0,0xee,0x90,0x91,0x5a,0xf0,0x90,0x91,0x5e,0xe0,0x54,0xfe,
+0xf0,0xe0,0x54,0xfd,0xf0,0xe0,0x54,0xfb,0xf0,0xe0,0x54,0xf7,0xf0,0xe0,0x54,0xef,
+0xf0,0xe0,0x54,0xdf,0xf0,0xe0,0x54,0xbf,0xf0,0xe0,0x54,0x7f,0xf0,0xe4,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xe0,0x54,0xfe,0xf0,0xe0,0x54,0xfd,0xf0,0xe0,0x54,0xf7,0xf0,0x22,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x12,0x24,0x62,0x54,0x01,0xff,0x90,0x91,0x56,
+0xe0,0x54,0xfe,0x4f,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0x90,0x91,0x57,0xf0,0x90,
+0x00,0x02,0x12,0x42,0x20,0x90,0x91,0x58,0xf0,0x90,0x91,0x56,0xe0,0x30,0xe0,0x1a,
+0x90,0x06,0x09,0xe0,0x54,0xfe,0xf0,0x90,0x02,0x86,0xe0,0x44,0x04,0xf0,0x43,0x57,
+0x04,0x7d,0x08,0xe4,0xff,0x12,0x31,0x9d,0x80,0x12,0x7d,0x08,0xe4,0xff,0x12,0x31,
+0x2c,0x90,0x02,0x86,0xe0,0x54,0xfb,0xf0,0x31,0xf1,0x31,0x13,0xd0,0xd0,0x92,0xaf,
+0x22,0x90,0x06,0x90,0xe4,0xf0,0x21,0x5a,0x90,0x91,0x19,0x12,0x43,0x41,0xef,0x12,
+0x43,0x4a,0x52,0x30,0x01,0x52,0x39,0x02,0x52,0x5b,0x03,0x52,0x64,0x09,0x52,0x6c,
+0x0c,0x52,0x75,0x0d,0x52,0x7d,0x0e,0x52,0x8e,0x1a,0x52,0x96,0x2c,0x52,0x41,0x2d,
+0x52,0x4a,0x2e,0x52,0x9e,0x30,0x52,0x53,0x3b,0x52,0x86,0x3c,0x00,0x00,0x52,0xa6,
+0x90,0x91,0x19,0x12,0x43,0x21,0x02,0x64,0x72,0x90,0x91,0x19,0x12,0x43,0x21,0xc1,
+0xf5,0x90,0x91,0x19,0x12,0x43,0x21,0x02,0x65,0x8d,0x90,0x91,0x19,0x12,0x43,0x21,
+0x02,0x65,0xd5,0x90,0x91,0x19,0x12,0x43,0x21,0xe1,0x4b,0x90,0x91,0x19,0x12,0x43,
+0x21,0x02,0x66,0x0e,0x90,0x91,0x19,0x12,0x43,0x21,0x80,0x42,0x90,0x91,0x19,0x12,
+0x43,0x21,0x02,0x4c,0xab,0x90,0x91,0x19,0x12,0x43,0x21,0xe1,0x98,0x90,0x91,0x19,
+0x12,0x43,0x21,0x02,0x4d,0xe6,0x90,0x91,0x19,0x12,0x43,0x21,0x21,0x90,0x90,0x91,
+0x19,0x12,0x43,0x21,0xa1,0x9b,0x90,0x91,0x19,0x12,0x43,0x21,0x81,0x7a,0x90,0x91,
+0x19,0x12,0x43,0x21,0xe1,0x78,0x90,0x01,0xc6,0xe0,0x44,0x01,0xf0,0x22,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x1c,0x12,0x43,0x41,0x90,0x91,0x1c,0x12,0x43,
+0x21,0x90,0x00,0x01,0x12,0x42,0x97,0xfa,0xe5,0xf0,0x24,0x00,0xff,0xe4,0x3a,0xfe,
+0x90,0x91,0x1c,0x12,0x43,0x21,0x90,0x00,0x01,0xee,0x8f,0xf0,0x12,0x42,0xcf,0x12,
+0x24,0x62,0xff,0x60,0x2c,0xb5,0x72,0x16,0x90,0x91,0x1c,0x12,0x43,0x21,0x90,0x00,
+0x01,0x12,0x42,0x97,0x65,0x74,0x70,0x04,0xe5,0x73,0x65,0xf0,0x60,0x23,0x90,0x91,
+0x1c,0x12,0x43,0x21,0x90,0x00,0x01,0x12,0x42,0x97,0xff,0xae,0xf0,0x71,0x26,0x80,
+0x10,0x90,0x91,0x1c,0x12,0x43,0x21,0x12,0x24,0x62,0x65,0x72,0x60,0x03,0x12,0x44,
+0xe8,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x91,0x1f,0xee,0xf0,0xa3,0xef,0xf0,0x75,0x72,
+0x01,0x8e,0x73,0xf5,0x74,0xe4,0xfd,0x7f,0x0b,0x12,0x4f,0x10,0xe4,0xfd,0x7f,0x02,
+0x12,0x4f,0x10,0x71,0x6a,0xe4,0xff,0x71,0xcc,0xe4,0xf5,0x76,0x90,0x01,0xc9,0xe5,
+0x76,0xf0,0x90,0x91,0x1f,0xe0,0xfc,0xa3,0xe0,0xfd,0xec,0xfb,0x8d,0x44,0xe4,0xf5,
+0x45,0x7d,0x01,0x7f,0x60,0x7e,0x01,0x02,0x30,0x62,0x7f,0x0b,0x71,0xd9,0xef,0x65,
+0x75,0x60,0x10,0xe5,0x75,0xb4,0x01,0x05,0xe4,0xf5,0x75,0x80,0x03,0x75,0x75,0x01,
+0x7f,0x01,0x22,0x7f,0x00,0x22,0xe5,0x72,0x64,0x01,0x70,0x3f,0x71,0x6a,0xbf,0x01,
+0x04,0x7f,0x01,0x71,0xcc,0x90,0x00,0x46,0xe0,0x44,0x04,0xfd,0x7f,0x46,0x12,0x4b,
+0xee,0x90,0x00,0x44,0xe0,0x54,0xfb,0xfd,0x7f,0x44,0x12,0x4b,0xee,0x90,0x00,0x46,
+0xe0,0x54,0xfb,0xfd,0x7f,0x46,0x12,0x4b,0xee,0x7f,0x02,0x71,0xd9,0x8f,0x76,0x90,
+0x01,0xc9,0xe5,0x76,0xf0,0xb4,0x01,0x03,0x12,0x4f,0xd7,0x22,0x90,0x01,0xca,0xe5,
+0x75,0xf0,0xef,0x60,0x03,0x12,0x4f,0xd7,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x90,0x91,0xa0,0xef,0xf0,0xd3,0x94,0x07,0x50,0x47,0xe0,0xff,0x74,0x01,0xa8,0x07,
+0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x46,0xe0,0x5f,0xf0,0x12,
+0x4a,0xe6,0x90,0x91,0xa0,0xe0,0xfd,0x74,0x01,0x7e,0x00,0xa8,0x05,0x08,0x80,0x05,
+0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,0x44,0xe0,0xfb,0xe4,0xfe,0xef,
+0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,0xce,0x13,0xd8,0xf8,0xff,0x80,
+0x44,0x90,0x91,0xa0,0xe0,0x24,0xf8,0xf0,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,
+0x02,0xc3,0x33,0xd8,0xfc,0x12,0x4a,0xde,0x90,0x91,0xa0,0xe0,0xfd,0x74,0x01,0x7e,
+0x00,0xa8,0x05,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,
+0x42,0xe0,0xfb,0xe4,0xfe,0xef,0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,
+0xce,0x13,0xd8,0xf8,0xff,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,
+0xd0,0xe4,0xf5,0x10,0x75,0x11,0x04,0xf5,0x12,0xf5,0x14,0xf5,0x15,0x90,0x02,0x09,
+0xe0,0xff,0x12,0x24,0x62,0xfe,0xef,0x2e,0xf5,0x13,0x30,0xe0,0x08,0x75,0x0e,0x00,
+0x75,0x0f,0x80,0x80,0x05,0xe4,0xf5,0x0e,0xf5,0x0f,0xe5,0x13,0xc3,0x13,0x90,0xfd,
+0x10,0xf0,0x74,0x20,0x25,0x10,0xf5,0x10,0xad,0x0f,0xe5,0x10,0x2d,0xff,0x24,0x01,
+0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x90,0x91,0x47,0xf0,0x74,0x02,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0xfe,0xe5,0x10,0x2d,0x24,0x03,0xf5,0x82,0xe4,
+0x34,0xfc,0xf5,0x83,0xe0,0x24,0x00,0xff,0xe4,0x3e,0x90,0x91,0x48,0xf0,0xa3,0xef,
+0xf0,0x7f,0x04,0xe5,0x10,0x25,0x0f,0x2f,0x24,0x00,0xf5,0x82,0xe4,0x34,0xfc,0xf5,
+0x83,0xe0,0xfe,0x74,0x46,0x2f,0xf5,0x82,0xe4,0x34,0x91,0xf5,0x83,0xee,0xf0,0x0f,
+0xbf,0x08,0xe0,0x12,0x66,0x56,0xef,0x70,0x3f,0x90,0x01,0xc3,0xe0,0x60,0x25,0xc3,
+0xe5,0x15,0x94,0xe8,0xe5,0x14,0x94,0x03,0x40,0x09,0x90,0x01,0xc6,0xe0,0x44,0x10,
+0xf0,0x80,0x63,0x05,0x15,0xe5,0x15,0x70,0x02,0x05,0x14,0x7f,0x0a,0x7e,0x00,0x12,
+0x32,0x15,0x80,0xd5,0x90,0x01,0xc6,0xe0,0x90,0x01,0xc3,0x30,0xe2,0x05,0x74,0xfe,
+0xf0,0x80,0x43,0x74,0xff,0xf0,0x80,0x3e,0xe5,0x10,0xb4,0x78,0x23,0xe4,0xf5,0x10,
+0x05,0x13,0xe5,0x0f,0x64,0x80,0x45,0x0e,0x70,0x06,0xf5,0x0e,0xf5,0x0f,0x80,0x06,
+0x75,0x0e,0x00,0x75,0x0f,0x80,0xe5,0x13,0xc3,0x13,0x90,0xfd,0x10,0xf0,0x80,0x06,
+0x74,0x08,0x25,0x10,0xf5,0x10,0xe5,0x12,0x15,0x12,0x70,0x02,0x15,0x11,0xe5,0x12,
+0x45,0x11,0x60,0x02,0x81,0xb8,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x91,0x1c,0x12,0x43,
+0x41,0x12,0x24,0x62,0xff,0x54,0x01,0xfe,0x90,0x91,0x5e,0xe0,0x54,0xfe,0x4e,0xf0,
+0xef,0x54,0x04,0xff,0xe0,0x54,0xfb,0x4f,0xf0,0x12,0x24,0x62,0xff,0x54,0x02,0xfe,
+0x90,0x91,0x5e,0xe0,0x54,0xfd,0x4e,0xf0,0xef,0x54,0x08,0xff,0xe0,0x54,0xf7,0x4f,
+0xf0,0x12,0x24,0x62,0xff,0x54,0x10,0xfe,0x90,0x91,0x5e,0xe0,0x54,0xef,0x4e,0xf0,
+0xef,0x54,0x20,0xff,0xe0,0x54,0xdf,0x4f,0xf0,0x12,0x24,0x62,0xff,0x54,0x40,0xfe,
+0x90,0x91,0x5e,0xe0,0x54,0xbf,0x4e,0xf0,0xef,0x54,0x80,0xff,0xe0,0x54,0x7f,0x4f,
+0xf0,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x91,0x60,0xf0,0x90,0x00,0x01,0x12,0x42,
+0x20,0x90,0x91,0x5f,0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0xff,0x54,0x01,0xfe,0x90,
+0x91,0x61,0xe0,0x54,0xfe,0x4e,0xf0,0xef,0x54,0x02,0xff,0xe0,0x54,0xfd,0x4f,0xf0,
+0x90,0x00,0x03,0x12,0x42,0x20,0x54,0x04,0xff,0x90,0x91,0x61,0xe0,0x54,0xfb,0x4f,
+0xf0,0x90,0x91,0x5e,0xe0,0x54,0x01,0x90,0x01,0xb8,0xf0,0x90,0x91,0x5e,0xe0,0xff,
+0xc4,0x13,0x54,0x01,0x90,0x01,0xb9,0xf0,0x90,0x91,0x61,0xe0,0x54,0x01,0x90,0x01,
+0xba,0xf0,0xa3,0x74,0xff,0xf0,0x12,0x24,0x62,0x20,0xe0,0x02,0x21,0xf1,0xe4,0xfd,
+0x7f,0x81,0x12,0x4b,0xee,0x90,0x91,0x1c,0x12,0x43,0x21,0x12,0x24,0x62,0xff,0xc3,
+0x13,0x30,0xe0,0x07,0x90,0x06,0x90,0xe0,0x44,0x02,0xf0,0xef,0x13,0x13,0x54,0x3f,
+0x30,0xe0,0x07,0x90,0x06,0x90,0xe0,0x44,0x04,0xf0,0x12,0x24,0x62,0x13,0x13,0x13,
+0x54,0x1f,0x30,0xe0,0x07,0x90,0x06,0x90,0xe0,0x44,0x08,0xf0,0x90,0x91,0x61,0xe0,
+0x30,0xe0,0x1c,0x90,0x91,0x5e,0xe0,0xc4,0x13,0x54,0x07,0x30,0xe0,0x07,0xa3,0xe0,
+0xff,0xe4,0xfd,0x80,0x07,0x90,0x91,0x5f,0xe0,0xff,0x7d,0x01,0x12,0x4a,0xf6,0x22,
+0x75,0x30,0x1f,0x75,0x31,0x01,0xe4,0xf5,0x32,0x90,0x01,0x38,0xe5,0x30,0xf0,0xa3,
+0xe5,0x31,0xf0,0xa3,0xe5,0x32,0xf0,0x22,0x90,0x00,0x02,0xe0,0x54,0xe0,0x7f,0x01,
+0x60,0x02,0x7f,0x00,0x22,0x12,0x24,0x62,0xf5,0x6d,0x22,0x90,0x01,0x64,0x74,0xa0,
+0xf0,0x22,0x90,0x91,0x51,0xe0,0x90,0x90,0xe8,0xf0,0x22,0x90,0x00,0xf3,0xe0,0x7f,
+0x00,0x30,0xe3,0x02,0x7f,0x01,0x22,0x90,0x06,0x34,0x74,0xff,0xf0,0xe4,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xf0,0x22,0xe4,0x90,0x91,0x4e,0xf0,0x90,0x00,0x80,0xe0,0x44,0x80,
+0xfd,0x7f,0x80,0x02,0x4b,0xee,0x90,0x00,0xf3,0xe0,0x30,0xe2,0x0d,0x90,0x05,0x41,
+0x74,0x10,0xf0,0x90,0x05,0x5a,0xf0,0xa3,0xe4,0xf0,0x22,0x12,0x24,0x62,0x60,0x02,
+0x80,0x01,0xe4,0x90,0x91,0x31,0xf0,0x90,0x91,0x31,0xe0,0x90,0x01,0xe7,0xf0,0x22,
+0x90,0x91,0x51,0xe0,0xb4,0x01,0x0c,0x90,0x00,0xf2,0xe0,0x30,0xe7,0x05,0x7e,0xfd,
+0x7f,0x33,0x22,0x7e,0xfd,0x7f,0x2f,0x22,0x12,0x24,0x62,0xff,0x54,0x01,0xfe,0x90,
+0x91,0x53,0xe0,0x54,0xfe,0x4e,0xf0,0xef,0xc3,0x13,0x30,0xe0,0x0a,0x90,0x00,0x01,
+0x12,0x42,0x20,0x90,0x91,0x54,0xf0,0x22,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x90,
+0xf7,0xf0,0xe0,0x60,0x04,0xe0,0xf4,0x70,0x21,0xa2,0xaf,0xe4,0x33,0xf5,0x0e,0xc2,
+0xaf,0x90,0x00,0x47,0xe0,0x54,0xfb,0xfd,0x7f,0x47,0x12,0x4b,0xee,0x7d,0x40,0x7f,
+0x01,0x12,0x31,0x66,0xe5,0x0e,0x24,0xff,0x92,0xaf,0x22,0xc0,0xe0,0xc0,0xf0,0xc0,
+0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,
+0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,0x01,0xc4,0x74,0xcb,0xf0,0x74,0x57,
+0xa3,0xf0,0x90,0x01,0x34,0xe0,0x55,0x28,0xf5,0x2c,0x90,0x01,0x36,0xe0,0x55,0x2a,
+0xf5,0x2e,0xa3,0xe0,0x55,0x2b,0xf5,0x2f,0xe5,0x2c,0x30,0xe0,0x5a,0x90,0x01,0x34,
+0x74,0x01,0xf0,0x85,0xd9,0x54,0xe5,0x70,0x14,0x24,0xfd,0x50,0x02,0x80,0x48,0x90,
+0x91,0x3b,0xe0,0x60,0x3a,0x90,0x01,0x5b,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x04,0xf0,
+0x51,0x30,0xef,0x64,0x01,0x70,0x30,0x90,0x91,0x66,0xf0,0x90,0x91,0x2d,0xe0,0x90,
+0x91,0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,0x01,0x12,0x44,0x59,0x90,0x01,0x5b,
+0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x90,0x91,0x37,0xf0,0x80,0x08,0x51,
+0x30,0xbf,0x01,0x03,0x12,0x44,0xc2,0xe5,0x2c,0x30,0xe1,0x20,0x90,0x01,0x34,0x74,
+0x02,0xf0,0x85,0xd1,0x58,0x85,0xd2,0x59,0x85,0xd3,0x5a,0x85,0xd4,0x5b,0x85,0xd5,
+0x5c,0x85,0xd6,0x5d,0x85,0xd7,0x5e,0x85,0xd9,0x5f,0x71,0x5c,0xe5,0x2c,0x30,0xe3,
+0x10,0x90,0x01,0x34,0x74,0x08,0xf0,0x90,0x91,0x56,0xe0,0x30,0xe0,0x03,0x43,0x57,
+0x04,0xe5,0x2c,0x30,0xe4,0x09,0x90,0x01,0x34,0x74,0x10,0xf0,0x43,0x57,0x10,0xe5,
+0x2c,0x30,0xe5,0x26,0x90,0x01,0xcf,0xe0,0x30,0xe5,0x1f,0xe0,0x54,0xdf,0xf0,0x90,
+0x01,0x34,0x74,0x20,0xf0,0x75,0xa8,0x00,0x75,0xe8,0x00,0x12,0x4e,0xe4,0x90,0x00,
+0x03,0xe0,0x54,0xfb,0xf0,0x12,0x4a,0xe6,0x80,0xfe,0xe5,0x2c,0x30,0xe6,0x06,0x90,
+0x01,0x34,0x74,0x40,0xf0,0xe5,0x2e,0x30,0xe0,0x13,0x90,0x91,0x50,0x74,0x01,0xf0,
+0x90,0x01,0x36,0xf0,0x91,0x23,0x51,0x87,0x90,0x91,0x50,0xe4,0xf0,0xe5,0x2e,0x30,
+0xe1,0x3c,0x90,0x01,0x36,0x74,0x02,0xf0,0x43,0x57,0x40,0x90,0x01,0x02,0xe0,0x54,
+0x03,0x64,0x01,0x70,0x29,0x90,0x01,0x37,0xe0,0x30,0xe0,0x0a,0x74,0x01,0xf0,0x90,
+0x91,0x40,0xe4,0xf0,0x80,0x18,0x90,0x91,0x40,0xe0,0x04,0xf0,0xe0,0xc3,0x94,0x0a,
+0x40,0x0c,0xe4,0xf0,0x90,0x04,0x19,0xe0,0x30,0xe0,0x03,0x12,0x4f,0xf5,0xe5,0x2e,
+0x30,0xe2,0x19,0x90,0x01,0x36,0x74,0x04,0xf0,0x90,0x91,0x3a,0xe4,0xf0,0x90,0x05,
+0x58,0x74,0x03,0xf0,0x51,0xd8,0x90,0x91,0x3f,0xe0,0x04,0xf0,0xe5,0x2e,0x30,0xe3,
+0x28,0x90,0x01,0x36,0x74,0x08,0xf0,0xe5,0x6d,0x64,0x01,0x70,0x1c,0xe5,0x70,0x60,
+0x18,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,0x91,0x66,0xe4,
+0x12,0x44,0x49,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,0x2e,0x30,0xe4,0x2b,0x90,0x01,
+0x36,0x74,0x10,0xf0,0xe5,0x6d,0xb4,0x01,0x20,0xe5,0x70,0x60,0x1c,0x90,0x01,0x57,
+0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x90,0x91,0x3c,0xe4,0xf0,0x53,0x71,0xfd,
+0xe5,0x71,0x54,0x07,0x70,0x03,0x12,0x44,0xc2,0xe5,0x2e,0x30,0xe5,0x1f,0x90,0x01,
+0x36,0x74,0x20,0xf0,0xe5,0x6d,0xb4,0x01,0x14,0xe5,0x70,0x60,0x10,0x90,0x91,0x3b,
+0xe0,0x64,0x02,0x60,0x05,0x12,0x44,0xc8,0x80,0x03,0x12,0x44,0x77,0xe5,0x2e,0x30,
+0xe6,0x1b,0x90,0x01,0x36,0x74,0x40,0xf0,0xe5,0x6d,0xb4,0x01,0x10,0xe5,0x70,0x60,
+0x0c,0x53,0x71,0xfe,0xe5,0x71,0x54,0x07,0x70,0x03,0x12,0x44,0xc2,0xe5,0x2f,0x30,
+0xe1,0x08,0x90,0x01,0x37,0x74,0x02,0xf0,0x71,0x7e,0x74,0xcb,0x04,0x90,0x01,0xc4,
+0xf0,0x74,0x57,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,
+0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,
+0x90,0x04,0x1b,0xe0,0x54,0x7f,0x64,0x7f,0x7f,0x01,0x60,0x02,0x7f,0x00,0x22,0x51,
+0x30,0xef,0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,0x30,0x90,0x91,
+0x37,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x22,0x90,0x91,0x36,0xe0,
+0x60,0x08,0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x14,0xe5,0x6f,0x54,0x0f,0xd3,0x94,
+0x04,0x40,0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x03,0x7f,0x01,0x22,0x90,0x01,
+0xb8,0x74,0x08,0xf0,0x7f,0x00,0x22,0x90,0x91,0x53,0xe0,0x30,0xe0,0x49,0xe5,0x6d,
+0x64,0x01,0x70,0x43,0x90,0x91,0x52,0xe0,0x04,0xf0,0xe5,0x70,0x64,0x03,0x60,0x05,
+0xe5,0x70,0xb4,0x06,0x0d,0x90,0x91,0x52,0xe0,0xff,0x74,0x01,0xd3,0x9f,0x50,0x14,
+0x80,0x07,0x90,0x91,0x52,0xe0,0xb4,0x0a,0x0b,0x90,0x91,0x55,0xe0,0x04,0xf0,0xe4,
+0x90,0x91,0x52,0xf0,0x90,0x91,0x55,0xe0,0xff,0x90,0x91,0x54,0xe0,0xb5,0x07,0x07,
+0x71,0x4e,0xe4,0x90,0x91,0x55,0xf0,0x22,0xe5,0x6d,0x64,0x01,0x70,0x63,0xe5,0x70,
+0x60,0x5f,0xe5,0x70,0x64,0x02,0x60,0x06,0xe5,0x70,0x64,0x05,0x70,0x27,0x90,0x06,
+0xab,0xe0,0x90,0x91,0x27,0xf0,0x90,0x06,0xaa,0xe0,0x90,0x91,0x39,0xf0,0x90,0x91,
+0x27,0xe0,0x70,0x07,0x90,0x91,0x39,0xe0,0xff,0x80,0x05,0x90,0x91,0x27,0xe0,0xff,
+0x90,0x91,0x27,0xef,0xf0,0x90,0x91,0x29,0xe0,0x60,0x03,0xe0,0x14,0xf0,0xe4,0x90,
+0x91,0x28,0xf0,0x90,0x01,0x57,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x53,0x71,0xfd,
+0x53,0x71,0xef,0xe5,0x70,0x14,0x24,0xfd,0x50,0x02,0x80,0x03,0x12,0x45,0xc7,0x71,
+0x42,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0xd0,0xd0,0x92,0xaf,0x22,0xe5,0x6e,
+0x30,0xe3,0x04,0xe4,0xff,0x80,0x02,0x7f,0x01,0x02,0x47,0xc9,0x90,0x91,0x08,0xe0,
+0x54,0xf0,0x44,0x03,0xf0,0x54,0x0f,0x44,0x80,0xf0,0x7b,0x00,0x7a,0x00,0x79,0x58,
+0x90,0x91,0x71,0x12,0x43,0x41,0x0b,0x7a,0x91,0x79,0x08,0x02,0x46,0xb7,0x90,0x91,
+0x80,0x12,0x25,0x14,0x00,0x00,0x00,0x00,0xe5,0x70,0x14,0x24,0xfd,0x50,0x02,0x80,
+0x21,0x90,0x91,0x3b,0xe0,0x60,0x06,0x7d,0x01,0x7f,0x0c,0x80,0x0d,0xe5,0x6e,0x54,
+0x0f,0xc3,0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,0x04,0x12,0x47,0x27,0xe4,0xff,0x12,
+0x48,0xb3,0x22,0x51,0x30,0xef,0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,
+0x80,0x58,0xe5,0x71,0x54,0x03,0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x4a,
+0xe5,0x6f,0x54,0x0f,0xd3,0x94,0x02,0x40,0x08,0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,
+0x39,0xe5,0x71,0x30,0xe2,0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x2c,0xe5,0x71,
+0x30,0xe4,0x08,0x90,0x01,0xb9,0x74,0x10,0xf0,0x80,0x1f,0x90,0x91,0x29,0xe0,0x60,
+0x08,0x90,0x01,0xb9,0x74,0x20,0xf0,0x80,0x11,0x90,0x91,0x31,0xe0,0x60,0x08,0x90,
+0x01,0xb9,0x74,0x80,0xf0,0x80,0x03,0x7f,0x01,0x22,0x90,0x01,0xb8,0x74,0x04,0xf0,
+0x7f,0x00,0x22,0xe4,0xfb,0x90,0x91,0x78,0x12,0x25,0x14,0x00,0x00,0x00,0x00,0xe5,
+0x70,0x70,0x02,0x81,0xb5,0xe5,0x6d,0x64,0x01,0x70,0x7a,0xe5,0x70,0x14,0x60,0x2b,
+0x24,0xfd,0x60,0x27,0x24,0x02,0x24,0xfb,0x50,0x02,0x80,0x21,0x90,0x91,0x27,0xe0,
+0x14,0xf0,0xe0,0x60,0x04,0xa3,0xe0,0x60,0x14,0x90,0x91,0x27,0xe0,0x70,0x08,0x90,
+0x91,0x39,0xe0,0x90,0x91,0x27,0xf0,0x7b,0x01,0x80,0x02,0x7b,0x01,0xeb,0x60,0x45,
+0x43,0x71,0x10,0xe4,0x90,0x91,0x66,0xf0,0x90,0x91,0x3a,0xe0,0x75,0xf0,0x05,0xa4,
+0xff,0x90,0x91,0x34,0xe0,0x2f,0x12,0x44,0x4e,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,
+0x6e,0x54,0x0f,0xc3,0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,0x04,0x12,0x47,0x27,0x90,
+0x91,0x2e,0xe0,0x60,0x10,0x90,0x91,0x2c,0xe0,0x90,0x07,0x78,0x60,0x04,0x74,0x0d,
+0xf0,0x22,0x74,0x09,0xf0,0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,
+0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,
+0x06,0xc0,0x07,0x90,0x01,0xc4,0x74,0xb6,0xf0,0x74,0x5c,0xa3,0xf0,0x53,0x91,0xef,
+0x90,0x00,0x51,0xe0,0xff,0x90,0x00,0x55,0xe0,0x5f,0xf5,0x3d,0x90,0x00,0x52,0xe0,
+0xff,0x90,0x00,0x56,0xe0,0x5f,0xf5,0x3e,0xe5,0x3d,0x30,0xe4,0x06,0x90,0x00,0x55,
+0x74,0x10,0xf0,0xe5,0x3d,0x30,0xe5,0x06,0x90,0x00,0x55,0x74,0x20,0xf0,0xe5,0x3d,
+0x30,0xe6,0x1b,0x90,0x00,0x55,0x74,0x40,0xf0,0x90,0x90,0xf6,0xe0,0x54,0x03,0xff,
+0xbf,0x03,0x0b,0x90,0x90,0xf3,0xe0,0x60,0x05,0x7f,0x01,0x12,0x4c,0x03,0xe5,0x3d,
+0x30,0xe7,0x15,0x90,0x00,0x55,0x74,0x80,0xf0,0x90,0x90,0xf6,0xe0,0x54,0x03,0xff,
+0xbf,0x03,0x05,0x7f,0x02,0x12,0x4c,0x03,0xe5,0x3e,0x30,0xe0,0x06,0x90,0x00,0x56,
+0x74,0x01,0xf0,0xe5,0x3e,0x30,0xe1,0x06,0x90,0x00,0x56,0x74,0x02,0xf0,0xe5,0x3e,
+0x30,0xe2,0x06,0x90,0x00,0x56,0x74,0x04,0xf0,0xe5,0x3e,0x30,0xe3,0x06,0x90,0x00,
+0x56,0x74,0x08,0xf0,0x90,0x01,0xc4,0x74,0xb6,0xf0,0x74,0x5c,0xa3,0xf0,0xd0,0x07,
+0xd0,0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,
+0xd0,0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,
+0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,
+0xc0,0x05,0xc0,0x06,0xc0,0x07,0x75,0x0d,0x00,0x90,0x01,0xc4,0x74,0x99,0xf0,0x74,
+0x5d,0xa3,0xf0,0x53,0x91,0xdf,0x90,0x01,0x3c,0xe0,0x55,0x30,0xf5,0x34,0xa3,0xe0,
+0x55,0x31,0xf5,0x35,0xa3,0xe0,0x55,0x32,0xf5,0x36,0xa3,0xe0,0x55,0x33,0xf5,0x37,
+0xe5,0x34,0x30,0xe0,0x06,0x90,0x01,0x3c,0x74,0x01,0xf0,0xe5,0x34,0x30,0xe1,0x08,
+0x90,0x01,0x3c,0x74,0x02,0xf0,0xf1,0x57,0xe5,0x34,0x30,0xe2,0x3a,0x90,0x01,0x3c,
+0x74,0x04,0xf0,0x90,0x06,0x92,0xe0,0x30,0xe0,0x25,0x90,0x91,0x66,0xe4,0xf0,0x90,
+0x91,0x2d,0xe0,0x90,0x91,0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,0x01,0x12,0x44,
+0x59,0x90,0x01,0x5b,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x80,0x08,0x90,
+0x91,0x37,0xe4,0xf0,0x12,0x44,0xc2,0xe5,0x34,0x30,0xe3,0x3a,0x90,0x01,0x3c,0x74,
+0x08,0xf0,0x90,0x06,0x92,0xe0,0x30,0xe1,0x25,0x90,0x91,0x66,0xe4,0xf0,0x90,0x91,
+0x2d,0xe0,0x90,0x91,0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x12,0x44,0x59,
+0x90,0x01,0x5f,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x02,0xf0,0x80,0x08,0x90,0x91,
+0x36,0xe4,0xf0,0x12,0x44,0xc2,0xe5,0x34,0x30,0xe4,0x09,0x90,0x01,0x3c,0x74,0x10,
+0xf0,0x12,0x53,0x86,0xe5,0x34,0x30,0xe5,0x09,0x90,0x01,0x3c,0x74,0x20,0xf0,0x12,
+0x6e,0xb9,0xe5,0x35,0x30,0xe0,0x5a,0x90,0x01,0x3d,0x74,0x01,0xf0,0x90,0x01,0x2f,
+0xe0,0x44,0x7f,0xf0,0x90,0x00,0x83,0xe0,0x54,0x0f,0xf5,0x0d,0xb4,0x01,0x02,0x80,
+0x1c,0xe5,0x0d,0xb4,0x02,0x05,0x90,0x00,0x83,0x80,0x12,0xe5,0x0d,0xb4,0x04,0x05,
+0x90,0x00,0x83,0x80,0x08,0xe5,0x0d,0xb4,0x0c,0x08,0x90,0x00,0x83,0xe0,0xf5,0x6f,
+0x80,0x06,0x90,0x01,0xbe,0xe0,0x04,0xf0,0x90,0x01,0xbb,0xe5,0x6f,0xf0,0xe5,0x6f,
+0x30,0xe0,0x03,0xa3,0x80,0x03,0x90,0x01,0xbd,0xe0,0x04,0xf0,0xf1,0x38,0x12,0x44,
+0xc2,0xe5,0x35,0x30,0xe2,0x06,0x90,0x01,0x3d,0x74,0x04,0xf0,0xe5,0x36,0x30,0xe0,
+0x06,0x90,0x01,0x3e,0x74,0x01,0xf0,0xe5,0x36,0x30,0xe1,0x06,0x90,0x01,0x3e,0x74,
+0x02,0xf0,0x74,0x99,0x04,0x90,0x01,0xc4,0xf0,0x74,0x5d,0xa3,0xf0,0xd0,0x07,0xd0,
+0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,
+0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,0xe5,0x6f,0x30,0xe6,0x19,0xe5,0x6f,0x54,
+0x0f,0xff,0x90,0x91,0x24,0xe0,0xfe,0x4f,0x90,0x01,0x2f,0xf0,0xee,0x64,0x80,0x90,
+0x91,0x24,0xf0,0x53,0x6f,0xbf,0x22,0xe4,0x90,0x91,0x0d,0xf0,0xe5,0x70,0x70,0x02,
+0xe1,0xe1,0x90,0x91,0x3c,0xe0,0x60,0x0d,0xe4,0xf0,0x53,0x71,0xfd,0xe5,0x71,0x54,
+0x07,0x70,0x6e,0x80,0x69,0x90,0x91,0x28,0xe0,0x04,0xf0,0x53,0x71,0xef,0x90,0x91,
+0x3a,0xe0,0x04,0xf0,0x90,0x91,0x0d,0xe0,0xf9,0xff,0x7e,0x00,0x24,0x01,0xfd,0xee,
+0x33,0xfc,0x90,0x91,0x3a,0xe0,0xb5,0x05,0x06,0xe4,0xb5,0x04,0x02,0x80,0x12,0xef,
+0x24,0x02,0xff,0xe4,0x3e,0xfe,0x90,0x91,0x3a,0xe0,0xb5,0x07,0x0a,0xe4,0xb5,0x06,
+0x06,0x90,0x05,0x58,0xe0,0x04,0xf0,0xe9,0xff,0x90,0x91,0x2f,0xe0,0x2f,0xff,0xe4,
+0x33,0xfe,0x90,0x91,0x28,0xe0,0xd3,0x9f,0xee,0x64,0x80,0xf8,0x74,0x80,0x98,0x40,
+0x0d,0xe5,0x6d,0xb4,0x01,0x0b,0xa3,0xe0,0x70,0x07,0xe0,0x04,0xf0,0x22,0x12,0x44,
+0xc2,0x22,0x8f,0x20,0x8c,0x21,0x8d,0x22,0x22,0x8f,0x23,0x8c,0x24,0x8d,0x25,0x22,
+0xe4,0x90,0x91,0x11,0xf0,0xa3,0xf0,0x90,0x02,0x86,0xe0,0x20,0xe1,0x2c,0xc3,0x90,
+0x91,0x12,0xe0,0x94,0x20,0x90,0x91,0x11,0xe0,0x94,0x03,0x40,0x0a,0x90,0x01,0xc6,
+0xe0,0x44,0x20,0xf0,0x7f,0x00,0x22,0x90,0x91,0x11,0xe4,0x75,0xf0,0x01,0x12,0x42,
+0x81,0x7f,0x01,0x7e,0x00,0x12,0x32,0x15,0x80,0xcd,0x7f,0x01,0x22,0x90,0x01,0xcc,
+0xe0,0x54,0x0f,0x90,0x91,0x11,0xf0,0x90,0x91,0x11,0xe0,0xfd,0x70,0x02,0x21,0x6f,
+0x90,0x91,0x9c,0xe0,0xff,0x74,0x01,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,
+0xce,0x33,0xce,0xd8,0xf9,0xff,0xef,0x5d,0x70,0x02,0x21,0x68,0x90,0x91,0x9c,0xe0,
+0x75,0xf0,0x04,0x90,0x01,0xd0,0x12,0x43,0x15,0xe0,0x90,0x91,0x12,0xf0,0x75,0x63,
+0x01,0x75,0x64,0x91,0x75,0x65,0x12,0x75,0x66,0x01,0x7b,0x01,0x7a,0x91,0x79,0x13,
+0x12,0x46,0x6d,0x90,0x91,0x13,0xe0,0xff,0xc4,0x13,0x13,0x13,0x54,0x01,0x90,0x91,
+0x9c,0x30,0xe0,0x59,0xe0,0x75,0xf0,0x02,0x90,0x00,0x88,0x12,0x43,0x15,0xe0,0x90,
+0x91,0x14,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x02,0x90,0x00,0x89,0x12,0x43,0x15,
+0xe0,0x90,0x91,0x15,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd1,0x12,
+0x43,0x15,0xe0,0x90,0x91,0x16,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x04,0x90,0x01,
+0xd2,0x12,0x43,0x15,0xe0,0x90,0x91,0x17,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x04,
+0x90,0x01,0xd3,0x12,0x43,0x15,0xe0,0x90,0x91,0x18,0xf0,0x80,0x33,0xe0,0x75,0xf0,
+0x04,0x90,0x01,0xd1,0x12,0x43,0x15,0xe0,0x90,0x91,0x14,0xf0,0x90,0x91,0x9c,0xe0,
+0x75,0xf0,0x04,0x90,0x01,0xd2,0x12,0x43,0x15,0xe0,0x90,0x91,0x15,0xf0,0x90,0x91,
+0x9c,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd3,0x12,0x43,0x15,0xe0,0x90,0x91,0x16,0xf0,
+0xef,0x54,0x7f,0xff,0x7b,0x01,0x7a,0x91,0x79,0x14,0x12,0x51,0xf8,0x90,0x91,0x11,
+0xe0,0xff,0x90,0x91,0x9c,0xe0,0xfe,0x74,0x01,0xa8,0x06,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xf4,0x5f,0x90,0x91,0x11,0xf0,0x90,0x91,0x9c,0xe0,0xff,0x74,0x01,0xa8,
+0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0x90,0x01,0xcc,0xf0,0x90,0x91,0x9c,0xe0,
+0x04,0xf0,0xe0,0x54,0x03,0xf0,0x01,0x37,0x90,0x01,0xc6,0xe0,0x44,0x02,0xf0,0x22,
+0xad,0x07,0x74,0x11,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x01,0xf0,
+0x90,0x04,0x80,0xe0,0x54,0x0f,0xfc,0x74,0x14,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,
+0x83,0xe0,0x54,0xc0,0x4c,0xfd,0x74,0x14,0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,
+0xed,0xf0,0x22,0xef,0x60,0x0f,0x74,0x21,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,
+0xe0,0x44,0x10,0xf0,0x22,0x74,0x21,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,
+0x54,0xef,0xf0,0x22,0xe4,0xf5,0x6d,0xf5,0x71,0xf5,0x70,0x75,0x6f,0x0c,0x75,0x6e,
+0x0c,0x90,0x91,0x3b,0xf0,0x90,0x91,0x37,0xf0,0x90,0x91,0x36,0xf0,0x90,0x91,0x39,
+0x04,0xf0,0x90,0x91,0x27,0xf0,0xe4,0x90,0x91,0x3c,0xf0,0x90,0x91,0x29,0xf0,0x90,
+0x91,0x34,0x74,0x07,0xf0,0xe4,0x90,0x91,0x28,0xf0,0x90,0x91,0x32,0xf0,0xa3,0x74,
+0x03,0xf0,0x90,0x91,0x2f,0x74,0x0a,0xf0,0xa3,0x74,0x05,0xf0,0x90,0x91,0x2d,0x74,
+0x14,0xf0,0x90,0x91,0x35,0x74,0x05,0xf0,0xe4,0x90,0x91,0x2b,0xf0,0x90,0x91,0x25,
+0xf0,0x90,0x91,0x50,0xf0,0x90,0x91,0x31,0xf0,0x90,0x91,0x3a,0xf0,0x90,0x91,0x26,
+0xf0,0x90,0x91,0x38,0xf0,0x90,0x91,0x2e,0xf0,0x90,0x91,0x2c,0xf0,0x22,0xe4,0x90,
+0x91,0x3c,0xf0,0x90,0x91,0x28,0xf0,0xf5,0x71,0x22,0x90,0x06,0x04,0xe0,0x54,0xbf,
+0xf0,0xef,0x60,0x0a,0xe5,0x6d,0xb4,0x01,0x05,0xe4,0xff,0x12,0x47,0xc9,0x53,0x6e,
+0xf0,0x43,0x6e,0x0c,0x22,0x90,0x91,0x9d,0xef,0xf0,0x51,0x7e,0x90,0x91,0x9d,0xe0,
+0x60,0x05,0x90,0x05,0x22,0xe4,0xf0,0x53,0x6e,0xf0,0x43,0x6e,0x04,0x22,0x90,0x00,
+0x11,0xe0,0x44,0x09,0xf0,0x12,0x4a,0xe6,0x90,0x90,0xd8,0x12,0x43,0x09,0x90,0x80,
+0x96,0x12,0x25,0x08,0x7f,0x78,0x7e,0x08,0x12,0x2b,0x08,0x90,0x90,0xdc,0x12,0x43,
+0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x04,0x7e,0x0c,0x12,0x2b,0x08,0x90,0x90,
+0xe0,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x00,0x7e,0x08,0x12,0x2b,
+0x08,0x90,0x90,0xe4,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x70,0x7e,
+0x0e,0x12,0x2b,0x08,0x90,0x80,0x68,0x12,0x25,0x14,0x00,0x03,0x2d,0x95,0xe4,0xfd,
+0xff,0x12,0x30,0x2c,0x90,0x91,0x51,0xe0,0xb4,0x01,0x11,0x90,0x80,0x68,0x12,0x25,
+0x14,0x00,0x03,0x2d,0x95,0xe4,0xfd,0x7f,0x01,0x12,0x30,0x2c,0x22,0x8f,0x77,0xe4,
+0x90,0x91,0x96,0xf0,0xa3,0xf0,0x90,0x01,0x09,0xe0,0x7f,0x00,0x30,0xe7,0x02,0x7f,
+0x01,0xef,0x65,0x77,0x60,0x3e,0xc3,0x90,0x91,0x97,0xe0,0x94,0x88,0x90,0x91,0x96,
+0xe0,0x94,0x13,0x40,0x08,0x90,0x01,0xc6,0xe0,0x44,0x80,0xf0,0x22,0x90,0x91,0x96,
+0xe4,0x75,0xf0,0x01,0x12,0x42,0x81,0x7f,0x14,0x7e,0x00,0x12,0x32,0x15,0xd3,0x90,
+0x91,0x97,0xe0,0x94,0x32,0x90,0x91,0x96,0xe0,0x94,0x00,0x40,0xb9,0x90,0x01,0xc7,
+0xe0,0x30,0xe0,0xb2,0x22,0x22,0x53,0x6e,0xf0,0x43,0x6e,0x01,0x71,0x55,0x71,0x67,
+0x53,0x6e,0xf0,0x43,0x6e,0x02,0x22,0x22,0x8f,0x78,0x12,0x47,0xe6,0xef,0x64,0x01,
+0x70,0x2e,0x90,0x91,0x44,0x12,0x48,0x1e,0xe5,0x78,0x60,0x10,0x74,0x21,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x10,0xf0,0x80,0x0e,0x74,0x21,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xef,0xf0,0x90,0x04,0x1f,0x74,0x20,0xf0,
+0x22,0xe4,0xfb,0x90,0x91,0x7c,0x12,0x25,0x14,0x00,0x00,0x00,0x00,0xe5,0x70,0x60,
+0x5f,0xe5,0x6d,0x64,0x01,0x70,0x59,0x0b,0x90,0x91,0x27,0xf0,0x04,0x60,0x51,0x43,
+0x71,0x10,0xe4,0x90,0x91,0x66,0xf0,0x90,0x91,0x3a,0xe0,0x75,0xf0,0x05,0xa4,0xff,
+0x90,0x91,0x34,0xe0,0x2f,0x90,0x91,0x67,0xf0,0xe4,0x1b,0x12,0x44,0x54,0x90,0x01,
+0x57,0x74,0x05,0xf0,0xe5,0x6e,0x54,0x0f,0xc3,0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,
+0x04,0x12,0x47,0x27,0x90,0x91,0x2e,0xe0,0x60,0x11,0x90,0x91,0x2c,0xe0,0x90,0x07,
+0x78,0x60,0x05,0x74,0x0d,0xf0,0x80,0x03,0x74,0x09,0xf0,0x90,0x05,0x22,0xe4,0xf0,
+0x22,0x90,0x91,0x32,0xe0,0xa3,0xe0,0x90,0x05,0x58,0xf0,0x22,0xd3,0x10,0xaf,0x01,
+0xc3,0xc0,0xd0,0x90,0x91,0x84,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,
+0x90,0x91,0x84,0xe0,0xfe,0xa3,0xe0,0xf5,0x82,0x8e,0x83,0xe0,0x60,0x2d,0xc3,0x90,
+0x91,0x87,0xe0,0x94,0xe8,0x90,0x91,0x86,0xe0,0x94,0x03,0x40,0x0b,0x90,0x01,0xc6,
+0xe0,0x44,0x10,0xf0,0x7f,0x00,0x80,0x15,0x90,0x91,0x86,0xe4,0x75,0xf0,0x01,0x12,
+0x42,0x81,0x7f,0x0a,0x7e,0x00,0x12,0x32,0x15,0x80,0xc5,0x7f,0x01,0xd0,0xd0,0x92,
+0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x1c,0x12,0x43,0x41,0x90,
+0x91,0x1f,0x12,0x25,0x14,0x00,0x00,0x00,0x00,0x90,0x91,0x1c,0x12,0x43,0x21,0x90,
+0x00,0x01,0x12,0x42,0x20,0x90,0x91,0x3b,0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0x90,
+0x91,0x25,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0xff,0x54,0x01,0x90,0x91,0x26,0xf0,
+0xef,0xc3,0x13,0x54,0x01,0x90,0x91,0x2e,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0xff,
+0x13,0x13,0x54,0x01,0x90,0x91,0x2c,0xf0,0x90,0x91,0x2e,0xe0,0x90,0x91,0x1f,0x70,
+0x26,0x12,0x25,0x14,0x00,0x00,0x02,0x10,0x90,0x91,0x1f,0x12,0x43,0x09,0x90,0x80,
+0x96,0x12,0x25,0x08,0x7f,0x60,0x7e,0x08,0x12,0x2b,0x08,0x90,0x91,0x1f,0x12,0x25,
+0x14,0x00,0x00,0x03,0x10,0x80,0x24,0x12,0x25,0x14,0x00,0x00,0x01,0x10,0x90,0x91,
+0x1f,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x60,0x7e,0x08,0x12,0x2b,
+0x08,0x90,0x91,0x1f,0x12,0x25,0x14,0x00,0x00,0x03,0x00,0x90,0x91,0x1f,0x12,0x43,
+0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x70,0x7e,0x08,0x12,0x2b,0x08,0x90,0x91,
+0x26,0xe0,0x70,0x3d,0x90,0x91,0x38,0x74,0x01,0xf0,0x7f,0x00,0x7e,0x08,0x12,0x22,
+0x65,0x90,0x91,0x1f,0x12,0x25,0x08,0x90,0x91,0x1f,0x12,0x43,0x09,0xec,0x44,0x02,
+0xfc,0x90,0x91,0x1f,0x12,0x25,0x08,0x90,0x91,0x1f,0x12,0x43,0x09,0x90,0x80,0x96,
+0x12,0x25,0x08,0x7f,0x00,0x7e,0x08,0x12,0x2b,0x08,0x90,0x02,0x86,0xe0,0x54,0xfb,
+0xf0,0x90,0x91,0x1c,0x12,0x43,0x21,0x12,0x49,0x7f,0x90,0x01,0xe5,0xe5,0x70,0xf0,
+0x90,0x91,0x3b,0xe0,0x90,0x01,0xe6,0xf0,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x00,0x02,
+0x12,0x42,0x20,0xff,0x30,0xe0,0x25,0x12,0x24,0x62,0x90,0x91,0x2f,0xf0,0x90,0x00,
+0x01,0x12,0x42,0x20,0x90,0x91,0x30,0xf0,0xef,0xc3,0x13,0x54,0x7f,0x90,0x91,0x2d,
+0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0x90,0x91,0x35,0xf0,0x22,0x90,0x91,0x2f,0x74,
+0x0a,0xf0,0x90,0x91,0x30,0x74,0x05,0xf0,0x90,0x91,0x2d,0x74,0x14,0xf0,0x90,0x91,
+0x35,0x74,0x05,0xf0,0x22,0x12,0x24,0x62,0x30,0xe0,0x19,0xc3,0x13,0x54,0x7f,0x90,
+0x91,0x34,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0x90,0x91,0x32,0xe4,0xf0,0xa3,
+0xef,0xf0,0x80,0x0f,0x90,0x91,0x34,0x74,0x07,0xf0,0x90,0x91,0x32,0xe4,0xf0,0xa3,
+0x74,0x03,0xf0,0x90,0x91,0x32,0xe0,0xa3,0xe0,0x90,0x05,0x58,0xf0,0x22,0x90,0x02,
+0x09,0xe0,0xfd,0x12,0x24,0x62,0xfe,0xaf,0x05,0xed,0x2e,0x90,0x91,0x41,0xf0,0x90,
+0x00,0x01,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x91,0x42,0xf0,0x90,0x00,0x02,0x12,
+0x42,0x20,0xff,0xed,0x2f,0x90,0x91,0x43,0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0xff,
+0xed,0x2f,0x90,0x91,0x44,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0xff,0xae,0x05,0xed,
+0x2f,0x90,0x91,0x45,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x47,
+0xe0,0x90,0x91,0x1d,0xf0,0x90,0x91,0x48,0xe0,0xf5,0x19,0xa3,0xe0,0xf5,0x1a,0xe4,
+0xf5,0x16,0x74,0x4a,0x25,0x16,0xf5,0x82,0xe4,0x34,0x91,0xf5,0x83,0xe0,0xff,0x74,
+0x1b,0x25,0x16,0xf8,0xa6,0x07,0x05,0x16,0xe5,0x16,0xb4,0x04,0xe5,0x90,0x91,0x1d,
+0xe0,0x12,0x43,0x4a,0x66,0xb3,0x00,0x67,0xdc,0x01,0x66,0xba,0x02,0x66,0xba,0x03,
+0x66,0xba,0x04,0x67,0xdc,0x05,0x67,0xac,0x80,0x67,0xc2,0x81,0x67,0xdc,0x82,0x00,
+0x00,0x67,0xd8,0xaf,0x1e,0x12,0x73,0xea,0xe1,0xdc,0x90,0x91,0x1d,0xe0,0xff,0xb4,
+0x02,0x08,0x90,0x91,0x1c,0x74,0x01,0xf0,0x80,0x0f,0xef,0x90,0x91,0x1c,0xb4,0x03,
+0x05,0x74,0x02,0xf0,0x80,0x03,0x74,0x04,0xf0,0xc3,0xe5,0x19,0x94,0x08,0x50,0x49,
+0xe4,0xf5,0x16,0x90,0x91,0x1c,0xe0,0xff,0xe5,0x16,0xc3,0x9f,0x40,0x02,0xe1,0xdc,
+0xc3,0xe5,0x19,0x94,0x01,0x50,0x14,0xe5,0x16,0x25,0x1a,0xff,0xc3,0x74,0x03,0x95,
+0x16,0x24,0x1b,0xf8,0xe6,0xfd,0x12,0x4b,0xee,0x80,0x1a,0xc3,0x74,0x03,0x95,0x16,
+0x24,0x1b,0xf8,0xe6,0xff,0xe5,0x16,0x7c,0x00,0x25,0x1a,0xfd,0xec,0x35,0x19,0x8d,
+0x82,0xf5,0x83,0xef,0xf0,0x05,0x16,0x80,0xba,0xc3,0xe5,0x19,0x94,0x10,0x40,0x02,
+0xe1,0xdc,0x90,0x91,0x1d,0xe0,0x64,0x04,0x60,0x02,0xe1,0xdc,0xaf,0x1c,0xfc,0xfd,
+0xfe,0x78,0x10,0x12,0x24,0xf5,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0xaf,0x1b,
+0xe4,0xfc,0xfd,0xfe,0x78,0x18,0x12,0x24,0xf5,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,
+0x00,0x12,0x42,0xfc,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0xaf,0x1d,0xe4,0xfc,
+0xfd,0xfe,0x78,0x08,0x12,0x24,0xf5,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0x12,
+0x42,0xfc,0xa8,0x04,0xa9,0x05,0xaa,0x06,0xab,0x07,0xaf,0x1e,0xe4,0xfc,0xfd,0xfe,
+0x12,0x42,0xfc,0xa3,0x12,0x25,0x08,0x90,0x91,0x1e,0x12,0x43,0x09,0x90,0x80,0x96,
+0x12,0x25,0x08,0xaf,0x1a,0xae,0x19,0x12,0x2b,0x08,0x80,0x30,0xe5,0x1d,0x7f,0x00,
+0xfe,0xef,0x25,0x1e,0xf5,0x18,0xe4,0x3e,0xf5,0x17,0xaf,0x18,0xfe,0x12,0x32,0x15,
+0x80,0x1a,0xe5,0x1d,0x7f,0x00,0xfe,0xef,0x25,0x1e,0xf5,0x18,0xe4,0x3e,0xf5,0x17,
+0xaf,0x18,0xfe,0x12,0x31,0x82,0x80,0x04,0x7f,0x00,0x80,0x02,0x7f,0x01,0xd0,0xd0,
+0x92,0xaf,0x22,0x22,0x8e,0x0e,0x8f,0x0f,0x8b,0x10,0x8a,0x11,0x89,0x12,0xe4,0x90,
+0x91,0x11,0xf0,0xef,0x90,0x00,0x31,0xf0,0x12,0x4a,0xe6,0xe5,0x0e,0x54,0x03,0xff,
+0x90,0x00,0x32,0xe0,0x54,0xfc,0x4f,0xf0,0x12,0x4a,0xe6,0x90,0x00,0x33,0xe0,0x54,
+0x7f,0xf0,0x12,0x4a,0xe6,0x90,0x00,0x33,0xe0,0x20,0xe7,0x0e,0x90,0x91,0x11,0xe0,
+0xc3,0x94,0x64,0x50,0x05,0xe0,0x04,0xf0,0x80,0xeb,0x90,0x91,0x11,0xe0,0xc3,0x94,
+0x64,0x50,0x10,0x90,0x00,0x30,0xe0,0xab,0x10,0xaa,0x11,0xa9,0x12,0x12,0x42,0x4d,
+0x7f,0x01,0x22,0x7f,0x00,0x22,0xe4,0x90,0x91,0x98,0xf0,0xa3,0xf0,0x90,0x05,0xf8,
+0xe0,0x70,0x0f,0xa3,0xe0,0x70,0x0b,0xa3,0xe0,0x70,0x07,0xa3,0xe0,0x70,0x03,0x7f,
+0x01,0x22,0xd3,0x90,0x91,0x99,0xe0,0x94,0xe8,0x90,0x91,0x98,0xe0,0x94,0x03,0x40,
+0x03,0x7f,0x00,0x22,0x7f,0x32,0x7e,0x00,0x12,0x32,0x15,0x90,0x91,0x98,0xe4,0x75,
+0xf0,0x01,0x12,0x42,0x81,0x80,0xc6,0xef,0x70,0x02,0x41,0x3d,0x90,0x90,0xe8,0xe0,
+0x60,0x02,0xc1,0x08,0x90,0x90,0xd4,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,
+0x7f,0x8c,0x7e,0x08,0x12,0x2b,0x08,0x90,0x90,0x80,0x12,0x43,0x09,0x90,0x80,0x96,
+0x12,0x25,0x08,0x7f,0x44,0x7e,0x08,0x12,0x2b,0x08,0x90,0x90,0x84,0x12,0x43,0x09,
+0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x5c,0x7e,0x08,0x12,0x2b,0x08,0x90,0x90,0x88,
+0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x6c,0x7e,0x0e,0x12,0x2b,0x08,
+0x90,0x90,0x8c,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x70,0x7e,0x0e,
+0x12,0x2b,0x08,0x90,0x90,0x90,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,
+0x74,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x90,0x94,0x12,0x43,0x09,0x90,0x80,0x96,0x12,
+0x25,0x08,0x7f,0x78,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x90,0x98,0x12,0x43,0x09,0x90,
+0x80,0x96,0x12,0x25,0x08,0x7f,0x7c,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x90,0x9c,0x12,
+0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x0e,0x12,0x2b,0x08,0x90,
+0x90,0xa0,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x84,0x7e,0x0e,0x12,
+0x2b,0x08,0x90,0x90,0xa4,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x88,
+0x7e,0x0e,0x12,0x2b,0x08,0x90,0x90,0xa8,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,
+0x08,0x7f,0x8c,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x90,0xac,0x12,0x43,0x09,0x90,0x80,
+0x96,0x12,0x25,0x08,0x7f,0xd0,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x90,0xb0,0x12,0x43,
+0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0xd4,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x90,
+0xb4,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0xd8,0x7e,0x0e,0x12,0x2b,
+0x08,0x90,0x90,0xb8,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0xdc,0x7e,
+0x0e,0x12,0x2b,0x08,0x90,0x90,0xbc,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,
+0x7f,0xe0,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x90,0xc0,0x12,0x43,0x09,0x90,0x80,0x96,
+0x12,0x25,0x08,0x7f,0xec,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x90,0xc4,0x12,0x43,0x09,
+0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x04,0x7e,0x0c,0x12,0x2b,0x08,0x90,0x90,0xc8,
+0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x04,0x7e,0x0d,0x12,0x2b,0x08,
+0x90,0x90,0xcc,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x0c,0x7e,0x09,
+0x12,0x2b,0x08,0x90,0x90,0xd0,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,
+0x04,0x7e,0x08,0x12,0x2b,0x08,0x90,0x90,0xe8,0x74,0x01,0xf0,0x22,0x90,0x90,0xe8,
+0xe0,0x64,0x01,0x60,0x02,0xc1,0x08,0x7f,0x8c,0x7e,0x08,0x12,0x22,0x65,0x90,0x90,
+0xd4,0x12,0x25,0x08,0x7f,0x44,0x7e,0x08,0x12,0x22,0x65,0x90,0x90,0x80,0x12,0x25,
+0x08,0x7f,0x5c,0x7e,0x08,0x12,0x22,0x65,0x90,0x90,0x84,0x12,0x25,0x08,0x7f,0x6c,
+0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,0x88,0x12,0x25,0x08,0x7f,0x70,0x7e,0x0e,0x12,
+0x22,0x65,0x90,0x90,0x8c,0x12,0x25,0x08,0x7f,0x74,0x7e,0x0e,0x12,0x22,0x65,0x90,
+0x90,0x90,0x12,0x25,0x08,0x7f,0x78,0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,0x94,0x12,
+0x25,0x08,0x7f,0x7c,0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,0x98,0x12,0x25,0x08,0x7f,
+0x80,0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,0x9c,0x12,0x25,0x08,0x7f,0x84,0x7e,0x0e,
+0x12,0x22,0x65,0x90,0x90,0xa0,0x12,0x25,0x08,0x7f,0x88,0x7e,0x0e,0x12,0x22,0x65,
+0x90,0x90,0xa4,0x12,0x25,0x08,0x7f,0x8c,0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,0xa8,
+0x12,0x25,0x08,0x7f,0xd0,0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,0xac,0x12,0x25,0x08,
+0x7f,0xd4,0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,0xb0,0x12,0x25,0x08,0x7f,0xd8,0x7e,
+0x0e,0x12,0x22,0x65,0x90,0x90,0xb4,0x12,0x25,0x08,0x7f,0xdc,0x7e,0x0e,0x12,0x22,
+0x65,0x90,0x90,0xb8,0x12,0x25,0x08,0x7f,0xe0,0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,
+0xbc,0x12,0x25,0x08,0x7f,0xec,0x7e,0x0e,0x12,0x22,0x65,0x90,0x90,0xc0,0x12,0x25,
+0x08,0x7f,0x04,0x7e,0x0c,0x12,0x22,0x65,0x90,0x90,0xc4,0x12,0x25,0x08,0x7f,0x04,
+0x7e,0x0d,0x12,0x22,0x65,0x90,0x90,0xc8,0x12,0x25,0x08,0x7f,0x0c,0x7e,0x09,0x12,
+0x22,0x65,0x90,0x90,0xcc,0x12,0x25,0x08,0x7f,0x04,0x7e,0x08,0x12,0x22,0x65,0x90,
+0x90,0xd0,0x12,0x25,0x08,0x7f,0x8c,0x7e,0x08,0x12,0x22,0x65,0x90,0x91,0x88,0x12,
+0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0xed,0x44,0xc0,0xfd,0xec,0x90,0x91,0x88,
+0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,
+0x8c,0x7e,0x08,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x00,0x01,0x00,0x00,
+0x7f,0x44,0x7e,0x08,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x00,0xdb,0x25,
+0xa4,0x7f,0x5c,0x7e,0x08,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,0xdb,
+0x25,0xa4,0x7f,0x6c,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,
+0xdb,0x25,0xa4,0x7f,0x70,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,
+0x04,0x1b,0x25,0xa4,0x7f,0x74,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,
+0x14,0x04,0x1b,0x25,0xa4,0x7f,0x78,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,
+0x25,0x14,0x04,0x1b,0x25,0xa4,0x7f,0x7c,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,
+0x12,0x25,0x14,0x04,0x1b,0x25,0xa4,0x7f,0x80,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,
+0x96,0x12,0x25,0x14,0x63,0xdb,0x25,0xa4,0x7f,0x84,0x7e,0x0e,0x12,0x2b,0x08,0x90,
+0x80,0x96,0x12,0x25,0x14,0x04,0x1b,0x25,0xa4,0x7f,0x88,0x7e,0x0e,0x12,0x2b,0x08,
+0x90,0x80,0x96,0x12,0x25,0x14,0x20,0xdb,0x25,0xa4,0x7f,0x8c,0x7e,0x0e,0x12,0x2b,
+0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,0xdb,0x25,0xa4,0x7f,0xd0,0x7e,0x0e,0x12,
+0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,0xdb,0x25,0xa4,0x7f,0xd4,0x7e,0x0e,
+0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x20,0xdb,0x25,0xa4,0x7f,0xd8,0x7e,
+0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x00,0x1b,0x25,0xa4,0x7f,0xdc,
+0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x00,0x1b,0x25,0xa4,0x7f,
+0xe0,0x7e,0x0e,0x12,0x2b,0x08,0x90,0x80,0x96,0x12,0x25,0x14,0x24,0xdb,0x25,0xa4,
+0x7f,0xec,0x7e,0x0e,0x12,0x2b,0x08,0x7f,0x04,0x7e,0x0c,0x12,0x22,0x65,0x90,0x91,
+0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0xe4,0xff,0xec,0x90,0x91,0x88,
+0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x11,0xff,0xec,0x90,0x91,
+0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,
+0x7f,0x04,0x7e,0x0c,0x12,0x2b,0x08,0x7f,0x04,0x7e,0x0d,0x12,0x22,0x65,0x90,0x91,
+0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x54,0xf0,0xff,0xec,0x90,
+0x91,0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x01,0xff,0xec,
+0x90,0x91,0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x96,0x12,
+0x25,0x08,0x7f,0x04,0x7e,0x0d,0x12,0x2b,0x08,0x7f,0x0c,0x7e,0x09,0x12,0x22,0x65,
+0x90,0x91,0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0xe4,0xff,0xec,0x90,
+0x91,0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x11,0xff,0xec,
+0x90,0x91,0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x96,0x12,
+0x25,0x08,0x7f,0x0c,0x7e,0x09,0x12,0x2b,0x08,0x7f,0x0c,0x7e,0x09,0x12,0x22,0x65,
+0x90,0x91,0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,0xed,0x54,0x0f,0xfd,
+0xec,0x54,0xf0,0xfc,0x90,0x91,0x88,0x12,0x25,0x08,0x90,0x91,0x88,0x12,0x43,0x09,
+0xed,0x44,0x10,0xfd,0xec,0x44,0x01,0xfc,0x90,0x91,0x88,0x12,0x25,0x08,0x90,0x91,
+0x88,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x0c,0x7e,0x09,0x12,0x2b,
+0x08,0x7f,0x04,0x7e,0x08,0x12,0x22,0x65,0x90,0x91,0x88,0x12,0x25,0x08,0x90,0x91,
+0x88,0x12,0x43,0x09,0xef,0x54,0xf0,0xff,0xec,0x90,0x91,0x88,0x12,0x25,0x08,0x90,
+0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x01,0xff,0xec,0x90,0x91,0x88,0x12,0x25,0x08,
+0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x04,0x7e,0x08,
+0x12,0x2b,0x08,0xe4,0x90,0x90,0xe8,0xf0,0x22,0xe4,0xfd,0x7f,0x45,0x12,0x4b,0xee,
+0x90,0x04,0xfd,0xe4,0xf0,0xa3,0xf0,0x90,0x90,0xf7,0xf0,0x90,0x90,0xfd,0xf0,0x90,
+0x91,0x00,0xf0,0x90,0x90,0xfe,0xf0,0x90,0x91,0x01,0xf0,0x90,0x90,0xff,0xf0,0x90,
+0x91,0x02,0xf0,0x90,0x90,0xe9,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,
+0x90,0xee,0xf0,0x90,0x90,0xf3,0xf0,0x90,0x90,0xf5,0xf0,0x90,0x91,0x07,0xf0,0x90,
+0x90,0xf8,0xf0,0x90,0x90,0xf4,0xf0,0x90,0x90,0xed,0xf0,0x90,0x00,0x51,0xe0,0x44,
+0xc0,0xfd,0x7f,0x51,0x02,0x4b,0xee,0x90,0x05,0x60,0xe0,0x90,0x91,0x03,0xf0,0x90,
+0x05,0x61,0xe0,0x90,0x91,0x04,0xf0,0x90,0x05,0x62,0xe0,0x90,0x91,0x05,0xf0,0x90,
+0x05,0x63,0xe0,0x90,0x91,0x06,0xf0,0xc3,0x74,0xff,0x9f,0xfe,0x90,0x91,0x04,0xe0,
+0xd3,0x9e,0x40,0x1e,0xe0,0x2f,0xf0,0xa3,0xe0,0xb4,0xff,0x0f,0xe4,0xf0,0xa3,0xe0,
+0xb4,0xff,0x03,0xe4,0xf0,0x22,0x90,0x91,0x06,0x80,0x03,0x90,0x91,0x05,0xe0,0x04,
+0xf0,0x22,0x90,0x91,0x04,0xe0,0x2f,0xf0,0x22,0x90,0x90,0xf5,0xe0,0x64,0x01,0x60,
+0x02,0xe1,0x6e,0x90,0x00,0x46,0xe0,0x44,0x01,0xfd,0x7f,0x46,0x12,0x4b,0xee,0x90,
+0x91,0x07,0xe0,0x70,0x32,0x90,0x90,0xed,0xe0,0x60,0x15,0x90,0x90,0xf9,0x12,0x43,
+0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,0x2b,0x08,0x80,0x06,
+0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,0x90,0xf4,0xe0,0xff,0xd1,0x67,0x90,0x91,0x07,
+0x74,0x01,0x12,0x4b,0xe4,0x80,0x40,0x90,0x91,0x07,0xe0,0x64,0x01,0x70,0x38,0x90,
+0x90,0xf8,0xe0,0xff,0xd1,0x67,0xe4,0x90,0x91,0x07,0xf0,0x90,0x00,0x45,0xe0,0x44,
+0x01,0xfd,0x7f,0x45,0x12,0x4b,0xee,0x90,0x90,0xed,0xe0,0x60,0x15,0x90,0x90,0xef,
+0x12,0x43,0x09,0x90,0x80,0x96,0x12,0x25,0x08,0x7f,0x80,0x7e,0x08,0x12,0x2b,0x08,
+0x80,0x05,0x90,0x05,0x22,0xe4,0xf0,0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,0x91,
+0x03,0xe0,0x90,0x05,0x84,0xf0,0x90,0x91,0x04,0xe0,0x90,0x05,0x85,0xf0,0x90,0x91,
+0x05,0xe0,0x90,0x05,0x86,0xf0,0x90,0x91,0x06,0xe0,0x90,0x05,0x87,0xf0,0x22,0x90,
+0x90,0xee,0xe0,0xc3,0x94,0x14,0x50,0x06,0xe0,0x04,0xf0,0x02,0x70,0x29,0x90,0x90,
+0xee,0xe0,0x64,0x14,0x60,0x03,0x02,0x70,0x29,0x90,0x90,0xfd,0xe0,0x70,0x25,0x90,
+0x91,0x00,0xe0,0x70,0x1f,0x90,0x90,0xfe,0xe0,0x70,0x19,0x90,0x91,0x01,0xe0,0x70,
+0x13,0x90,0x90,0xff,0xe0,0x70,0x0d,0x90,0x91,0x02,0xe0,0x70,0x07,0x90,0x04,0xfd,
+0xe0,0x54,0xfe,0xf0,0x90,0x90,0xfd,0xe0,0x90,0x04,0x44,0xf0,0x90,0x90,0xfe,0xe0,
+0x90,0x04,0x45,0xf0,0x90,0x90,0xff,0xe0,0x90,0x04,0x46,0xf0,0xa3,0xe4,0xf0,0x90,
+0x91,0x00,0xe0,0x90,0x04,0x48,0xf0,0x90,0x91,0x01,0xe0,0x90,0x04,0x49,0xf0,0x90,
+0x91,0x02,0xe0,0x90,0x04,0x4a,0xf0,0xa3,0xe4,0xf0,0x90,0x90,0xe9,0xe0,0x90,0x04,
+0x4c,0xf0,0x90,0x90,0xea,0xe0,0x90,0x04,0x4d,0xf0,0x90,0x90,0xeb,0xe0,0x90,0x04,
+0x4e,0xf0,0x90,0x90,0xec,0xe0,0x90,0x04,0x4f,0xf0,0xe4,0x90,0x90,0xee,0xf0,0x90,
+0x90,0xe9,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x90,0xfd,0xf0,0xa3,
+0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x05,0x60,0xe0,0x90,0x91,0x8c,
+0xf0,0x90,0x05,0x61,0xe0,0x90,0x91,0x8d,0xf0,0x90,0x05,0x62,0xe0,0x90,0x91,0x8e,
+0xf0,0x90,0x05,0x63,0xe0,0x90,0x91,0x8f,0xf0,0x90,0x91,0x06,0xe0,0xff,0x90,0x91,
+0x8f,0xe0,0xfe,0xd3,0x9f,0x50,0x0b,0x90,0x91,0x06,0xe0,0xc3,0x9e,0xd3,0x94,0x01,
+0x40,0x11,0x90,0x90,0xf4,0xe0,0xb4,0x01,0x02,0x80,0x03,0x90,0x90,0xf8,0xe0,0xff,
+0x12,0x6e,0x67,0x22,0x90,0x91,0x07,0xe0,0x64,0x01,0x60,0x08,0x90,0x90,0xf5,0xe0,
+0x60,0x02,0x21,0x4b,0x90,0x90,0xe9,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,
+0x80,0x3b,0x90,0x90,0xea,0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,
+0x28,0x90,0x90,0xeb,0xe0,0xc3,0x94,0xff,0x50,0x0a,0xe0,0x04,0xf0,0xe4,0x90,0x90,
+0xea,0xf0,0x80,0x15,0x90,0x90,0xec,0xe0,0xc3,0x94,0xff,0x50,0x10,0xe0,0x04,0xf0,
+0xe4,0x90,0x90,0xeb,0xf0,0x90,0x90,0xea,0xf0,0x90,0x90,0xe9,0xf0,0x90,0x00,0x44,
+0xe0,0x54,0x0c,0x60,0x76,0xe0,0x30,0xe2,0x32,0x90,0x90,0xfd,0xe0,0xc3,0x94,0xff,
+0x50,0x05,0xe0,0x04,0xf0,0x80,0x24,0x90,0x90,0xfe,0xe0,0xc3,0x94,0xff,0x50,0x06,
+0xe0,0x04,0xf0,0xe4,0x80,0x11,0x90,0x90,0xff,0xe0,0xc3,0x94,0xff,0x50,0x0c,0xe0,
+0x04,0xf0,0xe4,0x90,0x90,0xfe,0xf0,0x90,0x90,0xfd,0xf0,0x90,0x00,0x44,0xe0,0x30,
+0xe3,0x32,0x90,0x91,0x00,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x24,
+0x90,0x91,0x01,0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x11,0x90,
+0x91,0x02,0xe0,0xc3,0x94,0xff,0x50,0x0c,0xe0,0x04,0xf0,0xe4,0x90,0x91,0x01,0xf0,
+0x90,0x91,0x00,0xf0,0x90,0x04,0xfd,0xe0,0x44,0x01,0xf0,0x22,0x90,0x06,0x90,0xe0,
+0x44,0x01,0xf0,0x90,0x91,0x61,0xe0,0x30,0xe0,0x3c,0x90,0x91,0x5f,0xe0,0xff,0x90,
+0x91,0x5e,0xe0,0xfe,0xc4,0x13,0x54,0x01,0xfd,0x12,0x4a,0xf6,0x90,0x91,0x60,0xe0,
+0x75,0xf0,0x20,0xa4,0xff,0xae,0xf0,0x12,0x32,0x15,0x90,0x91,0x5e,0xe0,0xc4,0x13,
+0x54,0x07,0x30,0xe0,0x07,0xa3,0xe0,0xff,0xe4,0xfd,0x80,0x07,0x90,0x91,0x5f,0xe0,
+0xff,0x7d,0x01,0x12,0x4a,0xf6,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0xe4,0x90,
+0x91,0x19,0xf0,0xa3,0x74,0x08,0xf0,0xa3,0xf0,0xe4,0xa3,0xf0,0x90,0x01,0x1f,0xe0,
+0xfe,0x90,0x01,0x1e,0xe0,0x7c,0x00,0x24,0x00,0xff,0xec,0x3e,0x90,0x91,0x11,0xf0,
+0xa3,0xef,0xf0,0x90,0x02,0x87,0xe0,0x90,0x91,0x18,0xf0,0x90,0x91,0x56,0xe0,0x20,
+0xe0,0x02,0x61,0xc4,0xe4,0x90,0x91,0x17,0xf0,0x90,0x91,0x18,0xe0,0xff,0x90,0x91,
+0x17,0xe0,0xc3,0x9f,0x40,0x02,0x61,0xc4,0x90,0x91,0x11,0xe0,0xfc,0xa3,0xe0,0xfd,
+0xec,0xff,0x90,0xfd,0x11,0xf0,0x90,0x91,0x1c,0xef,0xf0,0x74,0x02,0x2d,0xf5,0x82,
+0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x54,0x0f,0xfc,0x33,0x33,0x33,0x54,0xf8,0xff,0xed,
+0x24,0x18,0x2f,0x90,0x91,0x15,0xf0,0xe0,0x24,0x00,0xf5,0x82,0xe4,0x34,0xfb,0xf5,
+0x83,0xe0,0x54,0xfc,0x90,0x91,0x16,0xf0,0x74,0x01,0x2d,0xf5,0x82,0xe4,0x34,0xfb,
+0xf5,0x83,0xe0,0xfe,0x74,0x00,0x2d,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x7a,
+0x00,0x24,0x00,0xff,0xea,0x3e,0x54,0x3f,0xab,0x07,0xfa,0x90,0x91,0x13,0xf0,0xa3,
+0xeb,0xf0,0xaf,0x04,0xef,0x75,0xf0,0x08,0xa4,0x24,0x18,0xff,0xe4,0x35,0xf0,0xfe,
+0xef,0x2b,0xfb,0xee,0x3a,0xfa,0x90,0x91,0x5a,0xe0,0xfe,0xa3,0xe0,0xff,0xad,0x03,
+0xac,0x02,0x12,0x45,0x09,0xaa,0x06,0xab,0x07,0x90,0x91,0x15,0xe0,0x24,0x00,0xf5,
+0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x30,0xe7,0x08,0x90,0x91,0x19,0x74,0x02,0xf0,
+0x80,0x05,0xe4,0x90,0x91,0x19,0xf0,0xaf,0x03,0x90,0x91,0x11,0xea,0x8f,0xf0,0x12,
+0x42,0x81,0x90,0x91,0x5c,0xe0,0xfe,0xa3,0xe0,0xff,0x90,0x91,0x11,0xe0,0xfc,0xa3,
+0xe0,0xfd,0xd3,0x9f,0xec,0x9e,0x40,0x1b,0x90,0x91,0x5d,0xe0,0x24,0x01,0xff,0x90,
+0x91,0x5c,0xe0,0x34,0x00,0xfe,0xc3,0xed,0x9f,0xff,0xec,0x9e,0x90,0x91,0x11,0xf0,
+0xa3,0xef,0xf0,0x90,0x91,0x16,0xe0,0xff,0x24,0x40,0x60,0x04,0x24,0x20,0x70,0x27,
+0x90,0x91,0x5e,0xe0,0xfe,0xc4,0x13,0x13,0x13,0x54,0x01,0x20,0xe0,0x02,0x61,0x9c,
+0xef,0x90,0x00,0x81,0xb4,0xa0,0x05,0xe0,0x44,0x04,0x80,0x03,0xe0,0x44,0x08,0xfd,
+0x7f,0x81,0x12,0x4b,0xee,0x61,0x95,0x90,0x91,0x5e,0xe0,0xc4,0x13,0x13,0x54,0x03,
+0x20,0xe0,0x02,0x61,0x9c,0x90,0x91,0x15,0xe0,0xff,0x24,0x00,0xf5,0x82,0xe4,0x34,
+0xfb,0xf5,0x83,0xe0,0x54,0x0c,0x64,0x08,0x70,0x72,0x90,0x91,0x19,0xe0,0xfe,0xef,
+0x2e,0xff,0xa3,0xe0,0x2f,0xff,0x24,0x1e,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,
+0x64,0x88,0x70,0x58,0x74,0x1f,0x2f,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x64,
+0x8e,0x70,0x49,0x90,0x91,0x19,0xe0,0xff,0x90,0x91,0x15,0xe0,0x2f,0xff,0x90,0x91,
+0x1a,0xe0,0x2f,0xff,0xa3,0xe0,0x2f,0xff,0x24,0x19,0xf5,0x82,0xe4,0x34,0xfb,0xf5,
+0x83,0xe0,0x64,0x03,0x70,0x26,0x74,0x1e,0x2f,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,
+0xe0,0x90,0x00,0x81,0x30,0xe3,0x05,0xe0,0x44,0x01,0x80,0x03,0xe0,0x44,0x02,0xfd,
+0x7f,0x81,0x12,0x4b,0xee,0x90,0x91,0x56,0xe0,0x44,0x80,0xf0,0x90,0x91,0x56,0xe0,
+0xff,0xc4,0x13,0x13,0x13,0x54,0x01,0x30,0xe0,0x02,0x31,0x4c,0x71,0xc9,0xbf,0x01,
+0x13,0x90,0x91,0x11,0xe0,0xfe,0xa3,0xe0,0xff,0x12,0x44,0xb5,0x90,0x91,0x17,0xe0,
+0x04,0xf0,0x21,0xd9,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x91,0x56,0xe0,0xc4,0x13,0x13,
+0x13,0x54,0x01,0x30,0xe0,0x11,0xe0,0x44,0x80,0xf0,0x90,0x91,0x5e,0xe0,0xc4,0x54,
+0x0f,0x20,0xe0,0x03,0x7f,0x00,0x22,0x7f,0x01,0x22,0x8f,0x1f,0xe4,0x90,0x91,0x22,
+0xf0,0xe5,0x1f,0x14,0xfe,0x90,0x91,0x22,0xe0,0xff,0xc3,0x9e,0x50,0x0e,0xef,0x04,
+0xfd,0x12,0x2d,0x4d,0x90,0x91,0x22,0xe0,0x04,0xf0,0x80,0xe5,0xe5,0x1f,0x14,0xff,
+0x7d,0xff,0x12,0x2d,0x4d,0x90,0x91,0x22,0xe5,0x1f,0xf0,0x90,0x91,0x22,0xe0,0xc3,
+0x94,0xff,0x50,0x0f,0xe0,0xff,0x04,0xfd,0x12,0x2d,0x4d,0x90,0x91,0x22,0xe0,0x04,
+0xf0,0x80,0xe8,0xad,0x1f,0x7f,0xff,0x02,0x2d,0x4d,0xc3,0xee,0x94,0x01,0x40,0x0a,
+0x0d,0xed,0x13,0x90,0xfd,0x10,0xf0,0xe4,0x2f,0xff,0x22,0xc3,0xee,0x94,0x01,0x40,
+0x1e,0x90,0xfd,0x11,0xe0,0xb5,0x05,0x14,0x90,0x01,0x17,0xe0,0xb5,0x05,0x07,0x90,
+0xfd,0x11,0xe4,0xf0,0x80,0x06,0xed,0x04,0x90,0xfd,0x11,0xf0,0xe4,0x2f,0xff,0x22,
+0x14,0x25,};
+
+
+
+u8 Rtl8192CUFwUMCBCutWWImgArray[UMCBCutWWImgArrayLength] = {
+0xc2,0x88,0x02,0x00,0x51,0x00,0x00,0x00,0x03,0x23,0x16,0x45,0x66,0x34,0x01,0x00,
+0x58,0x92,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x02,0x43,0x9d,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x4a,0x22,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x02,0x57,0xe1,0x00,0x00,0x00,0x00,0x00,0x02,0x58,0xc4,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0xbb,0x01,0x0c,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe0,0x22,0x50,
+0x06,0xe9,0x25,0x82,0xf8,0xe6,0x22,0xbb,0xfe,0x06,0xe9,0x25,0x82,0xf8,0xe2,0x22,
+0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe4,0x93,0x22,0xbb,0x01,0x06,
+0x89,0x82,0x8a,0x83,0xf0,0x22,0x50,0x02,0xf7,0x22,0xbb,0xfe,0x01,0xf3,0x22,0xf8,
+0xbb,0x01,0x0d,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0x22,
+0x50,0x06,0xe9,0x25,0x82,0xc8,0xf6,0x22,0xbb,0xfe,0x05,0xe9,0x25,0x82,0xc8,0xf2,
+0x22,0xc5,0xf0,0xf8,0xa3,0xe0,0x28,0xf0,0xc5,0xf0,0xf8,0xe5,0x82,0x15,0x82,0x70,
+0x02,0x15,0x83,0xe0,0x38,0xf0,0x22,0xbb,0x01,0x10,0xe5,0x82,0x29,0xf5,0x82,0xe5,
+0x83,0x3a,0xf5,0x83,0xe0,0xf5,0xf0,0xa3,0xe0,0x22,0x50,0x09,0xe9,0x25,0x82,0xf8,
+0x86,0xf0,0x08,0xe6,0x22,0xbb,0xfe,0x0a,0xe9,0x25,0x82,0xf8,0xe2,0xf5,0xf0,0x08,
+0xe2,0x22,0xe5,0x83,0x2a,0xf5,0x83,0xe9,0x93,0xf5,0xf0,0xa3,0xe9,0x93,0x22,0xf8,
+0xbb,0x01,0x11,0xe5,0x82,0x29,0xf5,0x82,0xe5,0x83,0x3a,0xf5,0x83,0xe8,0xf0,0xe5,
+0xf0,0xa3,0xf0,0x22,0x50,0x09,0xe9,0x25,0x82,0xc8,0xf6,0x08,0xa6,0xf0,0x22,0xbb,
+0xfe,0x09,0xe9,0x25,0x82,0xc8,0xf2,0xe5,0xf0,0x08,0xf2,0x22,0xef,0x4b,0xff,0xee,
+0x4a,0xfe,0xed,0x49,0xfd,0xec,0x48,0xfc,0x22,0xe0,0xfc,0xa3,0xe0,0xfd,0xa3,0xe0,
+0xfe,0xa3,0xe0,0xff,0x22,0xa4,0x25,0x82,0xf5,0x82,0xe5,0xf0,0x35,0x83,0xf5,0x83,
+0x22,0xe0,0xfb,0xa3,0xe0,0xfa,0xa3,0xe0,0xf9,0x22,0xf8,0xe0,0xfb,0xa3,0xa3,0xe0,
+0xf9,0x25,0xf0,0xf0,0xe5,0x82,0x15,0x82,0x70,0x02,0x15,0x83,0xe0,0xfa,0x38,0xf0,
+0x22,0xeb,0xf0,0xa3,0xea,0xf0,0xa3,0xe9,0xf0,0x22,0xd0,0x83,0xd0,0x82,0xf8,0xe4,
+0x93,0x70,0x12,0x74,0x01,0x93,0x70,0x0d,0xa3,0xa3,0x93,0xf8,0x74,0x01,0x93,0xf5,
+0x82,0x88,0x83,0xe4,0x73,0x74,0x02,0x93,0x68,0x60,0xef,0xa3,0xa3,0xa3,0x80,0xdf,
+0xd0,0x83,0xd0,0x82,0xf8,0xe4,0x93,0x70,0x12,0x74,0x01,0x93,0x70,0x0d,0xa3,0xa3,
+0x93,0xf8,0x74,0x01,0x93,0xf5,0x82,0x88,0x83,0xe4,0x73,0x74,0x02,0x93,0xb5,0xf0,
+0x06,0x74,0x03,0x93,0x68,0x60,0xe9,0xa3,0xa3,0xa3,0xa3,0x80,0xd8,0x02,0x43,0xdb,
+0x02,0x50,0x34,0xe4,0x93,0xa3,0xf8,0xe4,0x93,0xa3,0x40,0x03,0xf6,0x80,0x01,0xf2,
+0x08,0xdf,0xf4,0x80,0x29,0xe4,0x93,0xa3,0xf8,0x54,0x07,0x24,0x0c,0xc8,0xc3,0x33,
+0xc4,0x54,0x0f,0x44,0x20,0xc8,0x83,0x40,0x04,0xf4,0x56,0x80,0x01,0x46,0xf6,0xdf,
+0xe4,0x80,0x0b,0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x90,0x44,0x20,0xe4,0x7e,
+0x01,0x93,0x60,0xbc,0xa3,0xff,0x54,0x3f,0x30,0xe5,0x09,0x54,0x1f,0xfe,0xe4,0x93,
+0xa3,0x60,0x01,0x0e,0xcf,0x54,0xc0,0x25,0xe0,0x60,0xa8,0x40,0xb8,0xe4,0x93,0xa3,
+0xfa,0xe4,0x93,0xa3,0xf8,0xe4,0x93,0xa3,0xc8,0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,
+0xf0,0xa3,0xc8,0xc5,0x82,0xc8,0xca,0xc5,0x83,0xca,0xdf,0xe9,0xde,0xe7,0x80,0xbe,
+0x41,0x91,0x40,0x00,0x41,0x91,0x9c,0x00,0x41,0x91,0x23,0x80,0x41,0x91,0x24,0x80,
+0x41,0x91,0x9e,0x00,0x41,0x91,0x52,0x00,0x41,0x91,0x93,0x00,0x41,0x91,0x91,0x00,
+0x41,0x91,0x90,0x00,0x41,0x91,0x92,0x00,0x00,0xf0,0x90,0x91,0x30,0xe0,0x90,0x91,
+0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x54,0x7e,0x01,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x90,0x91,0x65,0xeb,0xf0,0xa3,0xe0,0xfb,0xa3,0xe0,0xf5,0x44,0xe4,0xf5,0x45,0x12,
+0x35,0xab,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x01,0x5f,0xe4,0xf0,0x90,0x01,0x3c,0x74,
+0x08,0xf0,0xe4,0x90,0x91,0x66,0xf0,0x90,0x91,0x2d,0xe0,0x90,0x91,0x67,0xf0,0xe4,
+0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x91,0x59,0x90,0x01,0x5f,0x74,0x05,0xf0,0x90,0x06,
+0x92,0x74,0x02,0xf0,0x90,0x91,0x36,0x14,0xf0,0xe5,0x6e,0x54,0x0f,0xc3,0x94,0x0c,
+0x50,0x02,0xf1,0x23,0x22,0x90,0x02,0x84,0xef,0xf0,0xa3,0xee,0xf0,0xa3,0x74,0x05,
+0xf0,0x22,0x7d,0x01,0xaf,0x6f,0xe1,0x27,0xf1,0xe6,0xbf,0x01,0x10,0x90,0x91,0x42,
+0xe0,0xff,0xe4,0xfd,0x12,0x48,0x22,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0x8f,0x82,
+0x8e,0x83,0xa3,0xa3,0xa3,0xe4,0xf0,0x22,0xe4,0xf5,0x72,0x7f,0x60,0x7e,0x01,0x80,
+0xed,0x7f,0x00,0x22,0x90,0x91,0x32,0xe0,0xa3,0xe0,0x90,0x05,0x58,0xf0,0x22,0x22,
+0x22,0x22,0x22,0x02,0x5e,0x55,0x02,0x5e,0x5c,0xef,0x8e,0xf0,0x71,0x70,0x45,0x26,
+0x00,0x40,0x45,0x4e,0x00,0x80,0x45,0x79,0x01,0x00,0x45,0x8d,0x02,0x00,0x45,0xa5,
+0x04,0x00,0x00,0x00,0x45,0xc2,0xed,0x54,0x3f,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,
+0x00,0x7f,0x40,0xef,0x2d,0xff,0xee,0x3c,0xfe,0xef,0x78,0x06,0xce,0xc3,0x13,0xce,
+0x13,0xd8,0xf9,0x78,0x06,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0x80,0x26,0xed,0x54,
+0x7f,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,0x00,0x7f,0x80,0xef,0x2d,0xff,0xee,0x3c,
+0xfe,0xef,0x78,0x07,0xce,0xc3,0x13,0xce,0x13,0xd8,0xf9,0x78,0x07,0xc3,0x33,0xce,
+0x33,0xce,0xd8,0xf9,0xfd,0xac,0x06,0x80,0x49,0xed,0x70,0x04,0xfe,0xff,0x80,0x04,
+0x7e,0x01,0x7f,0x00,0xef,0x2d,0xee,0x3c,0x7d,0x00,0xfc,0x80,0x35,0xec,0x54,0x01,
+0x4d,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,0x02,0x7f,0x00,0xef,0x2d,0xee,0x3c,0xc3,
+0x13,0x7d,0x00,0x80,0x1a,0xec,0x54,0x03,0x4d,0x70,0x04,0xfe,0xff,0x80,0x04,0x7e,
+0x04,0x7f,0x00,0xef,0x2d,0xee,0x3c,0x13,0x13,0x54,0x3f,0x7d,0x00,0x25,0xe0,0x25,
+0xe0,0xfc,0xae,0x04,0xaf,0x05,0x22,0x90,0x91,0x09,0x12,0x2a,0x8b,0x00,0x00,0x00,
+0x00,0x90,0x06,0xa9,0xe0,0x90,0x91,0x08,0xf0,0xe0,0x54,0xc0,0x70,0x0a,0x53,0x71,
+0xfe,0x53,0x71,0xfd,0x91,0xc2,0x80,0x47,0x90,0x91,0x26,0xe0,0x60,0x41,0x90,0x91,
+0x38,0xe0,0x70,0x3b,0x90,0x91,0x38,0x74,0x01,0xf0,0x7f,0x00,0x7e,0x08,0x12,0x27,
+0xde,0x90,0x91,0x09,0x12,0x2a,0x7f,0x90,0x91,0x09,0x71,0x09,0xec,0x44,0x02,0xfc,
+0x90,0x91,0x09,0x12,0x2a,0x7f,0x90,0x91,0x09,0x71,0x09,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x00,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x02,0x86,0xe0,0x54,0xfb,0xf0,0x90,
+0x91,0x08,0xe0,0x30,0xe6,0x13,0x43,0x71,0x01,0x90,0x91,0x3b,0xe0,0x64,0x02,0x60,
+0x04,0x91,0xc8,0x80,0x07,0x91,0x77,0x80,0x03,0x53,0x71,0xfe,0x90,0x91,0x08,0xe0,
+0x30,0xe7,0x16,0x43,0x71,0x02,0xe4,0x90,0x91,0x66,0x91,0x49,0x90,0x01,0x57,0x74,
+0x05,0xf0,0x90,0x91,0x3c,0x74,0x01,0xf0,0x22,0x53,0x71,0xfd,0x22,0xd3,0x10,0xaf,
+0x01,0xc3,0xc0,0xd0,0x8b,0x60,0x8a,0x61,0x89,0x62,0x90,0x91,0x68,0x71,0x41,0xab,
+0x63,0xaa,0x64,0xa9,0x65,0x90,0x91,0x6b,0x71,0x41,0xaf,0x66,0x15,0x66,0xef,0x60,
+0x1b,0x90,0x91,0x6b,0xe4,0x75,0xf0,0x01,0x71,0x2a,0x12,0x29,0xd9,0xff,0x90,0x91,
+0x68,0xe4,0x75,0xf0,0x01,0x71,0x2a,0xef,0x51,0x4d,0x80,0xde,0xab,0x60,0xaa,0x61,
+0xa9,0x62,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,
+0x6e,0x71,0x41,0x90,0x91,0x9e,0xe0,0xff,0x04,0xf0,0x90,0x00,0x01,0xef,0x51,0x5f,
+0x7f,0xaf,0x7e,0x01,0x12,0x64,0x88,0xef,0x60,0x44,0x90,0x91,0x6e,0x71,0x21,0x8b,
+0x63,0x8a,0x64,0x89,0x65,0x75,0x66,0x02,0x7b,0x01,0x7a,0x01,0x79,0xa0,0xd1,0x6d,
+0x90,0x91,0x71,0x71,0x21,0x8b,0x63,0x8a,0x64,0x89,0x65,0x90,0x91,0x6e,0x71,0x21,
+0x12,0x29,0xd9,0xff,0xc4,0x54,0x0f,0xf5,0x66,0x7b,0x01,0x7a,0x01,0x79,0xa2,0xd1,
+0x6d,0x90,0x01,0xaf,0x74,0xff,0xf0,0x90,0x01,0xcb,0xe0,0x64,0x80,0xf0,0xd0,0xd0,
+0x92,0xaf,0x22,0x7d,0x01,0x7f,0x0c,0x90,0x91,0x95,0xed,0xf0,0x90,0x91,0x94,0xef,
+0xf0,0x54,0x0f,0xff,0xe5,0x6e,0x54,0x0f,0x6f,0x60,0x76,0x90,0x91,0x94,0xe0,0x30,
+0xe2,0x30,0xe5,0x6e,0x20,0xe2,0x05,0x7f,0x01,0x12,0x61,0x86,0xe5,0x6e,0x30,0xe3,
+0x0f,0x90,0x91,0x94,0xe0,0x20,0xe3,0x08,0x12,0x60,0xb1,0xef,0x60,0x53,0x80,0x52,
+0xe5,0x6e,0x20,0xe3,0x4c,0x90,0x91,0x94,0xe0,0x30,0xe3,0x45,0xa3,0xe0,0xff,0x02,
+0x61,0x6b,0xe5,0x6e,0x54,0x0f,0xff,0xbf,0x0c,0x0f,0x90,0x91,0x94,0xe0,0x20,0xe3,
+0x08,0x12,0x60,0xb1,0xef,0x60,0x2a,0xf1,0xb2,0xe5,0x6e,0x54,0x0f,0xff,0xbf,0x04,
+0x10,0x90,0x91,0x94,0xe0,0x20,0xe2,0x09,0x12,0x60,0xfa,0xef,0x60,0x13,0x12,0x48,
+0xce,0xe5,0x6e,0x54,0x0f,0xff,0xbf,0x02,0x08,0x91,0xf1,0xef,0x60,0x03,0x12,0x62,
+0x6c,0x22,0x90,0x06,0x04,0xe0,0x44,0x40,0xf0,0xe5,0x6d,0xb4,0x01,0x04,0x7f,0x01,
+0xf1,0xc9,0x53,0x6e,0xf0,0x43,0x6e,0x04,0x22,0x8f,0x67,0xf1,0xe6,0xbf,0x01,0x15,
+0x90,0x91,0x43,0x12,0x48,0x1e,0xad,0x07,0xac,0x06,0xaf,0x67,0x12,0x60,0x16,0x90,
+0x04,0x1f,0x74,0x20,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x01,0xc4,
+0x74,0xe6,0xf0,0x74,0x47,0xa3,0xf0,0x90,0x04,0x1d,0xe0,0x60,0x1a,0x90,0x05,0x22,
+0xe0,0x54,0x90,0x60,0x07,0x90,0x01,0xc6,0xe0,0x44,0x40,0xf0,0x90,0x01,0xc7,0xe0,
+0x30,0xe1,0xe4,0x7f,0x00,0x80,0x02,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,0xe0,0xff,
+0x7d,0x01,0x90,0x91,0x74,0xef,0xf0,0xa3,0xed,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xe5,
+0x70,0x60,0x04,0xe4,0xff,0x11,0xb3,0x90,0x91,0x74,0xe0,0x30,0xe0,0x09,0x90,0x91,
+0x76,0xe4,0xf0,0xa3,0x74,0x80,0xf0,0x90,0x91,0x74,0xe0,0xff,0xc3,0x13,0x90,0xfd,
+0x10,0xf0,0x90,0x04,0x25,0xef,0xf0,0x90,0x91,0x75,0xe0,0x60,0x1f,0xa3,0xa3,0xe0,
+0xff,0x24,0x0f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x80,0xf0,0x74,0x10,
+0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x80,0xf0,0x90,0x91,0x76,0xa3,
+0xe0,0xff,0xfd,0x24,0x08,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe4,0xf0,0x74,0x09,
+0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xf0,0xf0,0x74,0x21,0x2f,0xf5,
+0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xf7,0xf0,0x90,0x91,0x76,0xe0,0xfe,0xa3,
+0xe0,0xff,0x22,0xef,0x60,0x0b,0x90,0x91,0x51,0xe0,0xb4,0x01,0x10,0xe4,0xff,0x80,
+0x09,0x90,0x91,0x51,0xe0,0xb4,0x01,0x05,0x7f,0x01,0x12,0x69,0x87,0x22,0x90,0x01,
+0x37,0x74,0x02,0xf0,0x90,0x05,0x22,0x74,0xff,0xf0,0x12,0x68,0x7c,0xef,0x70,0x06,
+0x90,0x01,0xc8,0x74,0xfd,0xf0,0x7d,0x02,0x7f,0x03,0x12,0x36,0xe6,0xe5,0x70,0x60,
+0x04,0x7f,0x01,0x11,0xb3,0x12,0x68,0xbd,0x53,0x6e,0xf0,0x43,0x6e,0x02,0x22,0xef,
+0x64,0x01,0x70,0x42,0x7d,0x78,0x7f,0x02,0x12,0x36,0x75,0x7d,0x02,0x7f,0x03,0x12,
+0x36,0x75,0x90,0x01,0x36,0x74,0x03,0xf0,0xfd,0x7f,0x02,0x12,0x36,0xe6,0x7d,0x10,
+0x7f,0x03,0x12,0x36,0x92,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,
+0x12,0x47,0x23,0xe4,0xff,0x11,0xb3,0x90,0x06,0x04,0xe0,0x54,0x7f,0xf0,0x90,0x06,
+0x0a,0xe0,0x54,0xf8,0xf0,0x22,0x90,0x01,0x36,0x74,0x7b,0xf0,0xa3,0x74,0x02,0xf0,
+0x7d,0x7b,0xff,0x12,0x36,0xe6,0x7d,0x02,0x7f,0x03,0x12,0x36,0xe6,0x7d,0x10,0x7f,
+0x03,0x12,0x36,0x92,0x90,0x06,0x04,0xe0,0x44,0x80,0xf0,0x90,0x06,0x0a,0xe0,0x44,
+0x07,0xf0,0x12,0x44,0xf4,0xe5,0x6d,0x20,0xe0,0x05,0xe4,0x90,0x91,0x29,0xf0,0x22,
+0x8b,0x0e,0x8a,0x0f,0x89,0x10,0xf1,0xf2,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x12,0x29,
+0xd9,0xf5,0x70,0x14,0x60,0x0e,0x14,0x60,0x1e,0x14,0x60,0x2f,0x24,0x03,0x70,0x40,
+0x7f,0x01,0x80,0x3a,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x90,0x00,0x02,0x12,0x42,0x20,
+0xfd,0xe4,0xff,0x31,0xe1,0x80,0x27,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x90,0x00,0x02,
+0x12,0x42,0x20,0xfd,0x7f,0x01,0x31,0xe1,0x1f,0x80,0x13,0xab,0x0e,0xaa,0x0f,0xa9,
+0x10,0x90,0x00,0x02,0x12,0x42,0x20,0xfd,0x7f,0x02,0x31,0xe1,0xe4,0xff,0x11,0xff,
+0x22,0xef,0x24,0xfe,0x60,0x0b,0x04,0x70,0x22,0x90,0x91,0x39,0x74,0x01,0xf0,0x80,
+0x16,0xed,0x70,0x0a,0x90,0x91,0x35,0xe0,0x90,0x91,0x39,0xf0,0x80,0x05,0x90,0x91,
+0x39,0xed,0xf0,0x90,0x91,0x39,0xe0,0x90,0x91,0x27,0xf0,0x22,0x12,0x47,0xe6,0xbf,
+0x01,0x0f,0x90,0x02,0x09,0xe0,0xff,0x7d,0x01,0x11,0x22,0x90,0x04,0x1f,0x74,0x20,
+0xf0,0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,
+0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,
+0x01,0xc4,0x74,0x22,0xf0,0x74,0x4a,0xa3,0xf0,0x90,0x01,0x34,0xe0,0x55,0x28,0xf5,
+0x2c,0x90,0x01,0x36,0xe0,0x55,0x2a,0xf5,0x2e,0xa3,0xe0,0x55,0x2b,0xf5,0x2f,0xe5,
+0x2c,0x30,0xe0,0x5a,0x90,0x01,0x34,0x74,0x01,0xf0,0x85,0xd9,0x54,0xe5,0x70,0x14,
+0x24,0xfd,0x50,0x02,0x80,0x48,0x90,0x91,0x3b,0xe0,0x60,0x3a,0x90,0x01,0x5b,0xe4,
+0xf0,0x90,0x01,0x3c,0x74,0x04,0xf0,0x91,0x89,0xef,0x64,0x01,0x70,0x30,0x90,0x91,
+0x66,0xf0,0x90,0x91,0x2d,0xe0,0x90,0x91,0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,
+0x01,0x12,0x44,0x59,0x90,0x01,0x5b,0x74,0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,
+0x90,0x91,0x37,0xf0,0x80,0x08,0x91,0x89,0xbf,0x01,0x03,0x12,0x44,0xc2,0xe5,0x2c,
+0x30,0xe1,0x21,0x90,0x01,0x34,0x74,0x02,0xf0,0x85,0xd1,0x58,0x85,0xd2,0x59,0x85,
+0xd3,0x5a,0x85,0xd4,0x5b,0x85,0xd5,0x5c,0x85,0xd6,0x5d,0x85,0xd7,0x5e,0x85,0xd9,
+0x5f,0x12,0x64,0x66,0xe5,0x2c,0x30,0xe3,0x10,0x90,0x01,0x34,0x74,0x08,0xf0,0x90,
+0x91,0x56,0xe0,0x30,0xe0,0x03,0x43,0x57,0x04,0xe5,0x2c,0x30,0xe4,0x09,0x90,0x01,
+0x34,0x74,0x10,0xf0,0x43,0x57,0x10,0xe5,0x2c,0x30,0xe5,0x24,0x90,0x01,0xcf,0xe0,
+0x30,0xe5,0x1d,0xe0,0x54,0xdf,0xf0,0x90,0x01,0x34,0x74,0x20,0xf0,0x75,0xa8,0x00,
+0x75,0xe8,0x00,0xd1,0x65,0x90,0x00,0x03,0xe0,0x54,0xfb,0xf0,0x91,0xa0,0x80,0xfe,
+0xe5,0x2c,0x30,0xe6,0x06,0x90,0x01,0x34,0x74,0x40,0xf0,0xe5,0x2e,0x30,0xe0,0x15,
+0x90,0x91,0x50,0x74,0x01,0xf0,0x90,0x01,0x36,0xf0,0x12,0x63,0x2e,0x12,0x70,0xee,
+0x90,0x91,0x50,0xe4,0xf0,0xe5,0x2e,0x30,0xe1,0x3b,0x90,0x01,0x36,0x74,0x02,0xf0,
+0x43,0x57,0x40,0x90,0x01,0x02,0xe0,0x54,0x03,0x64,0x01,0x70,0x28,0x90,0x01,0x37,
+0xe0,0x30,0xe0,0x0a,0x74,0x01,0xf0,0x90,0x91,0x40,0xe4,0xf0,0x80,0x17,0x90,0x91,
+0x40,0xe0,0x04,0xf0,0xe0,0xc3,0x94,0x0a,0x40,0x0b,0xe4,0xf0,0x90,0x04,0x19,0xe0,
+0x30,0xe0,0x02,0x51,0x0c,0xe5,0x2e,0x30,0xe2,0x1a,0x90,0x01,0x36,0x74,0x04,0xf0,
+0x90,0x91,0x3a,0xe4,0xf0,0x90,0x05,0x58,0x74,0x03,0xf0,0x12,0x62,0xb8,0x90,0x91,
+0x3f,0xe0,0x04,0xf0,0xe5,0x2e,0x30,0xe3,0x28,0x90,0x01,0x36,0x74,0x08,0xf0,0xe5,
+0x6d,0x64,0x01,0x70,0x1c,0xe5,0x70,0x60,0x18,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,
+0x3c,0x74,0x02,0xf0,0x90,0x91,0x66,0xe4,0x12,0x44,0x49,0x90,0x01,0x57,0x74,0x05,
+0xf0,0xe5,0x2e,0x30,0xe4,0x2b,0x90,0x01,0x36,0x74,0x10,0xf0,0xe5,0x6d,0xb4,0x01,
+0x20,0xe5,0x70,0x60,0x1c,0x90,0x01,0x57,0xe4,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,
+0x90,0x91,0x3c,0xe4,0xf0,0x53,0x71,0xfd,0xe5,0x71,0x54,0x07,0x70,0x03,0x12,0x44,
+0xc2,0xe5,0x2e,0x30,0xe5,0x1f,0x90,0x01,0x36,0x74,0x20,0xf0,0xe5,0x6d,0xb4,0x01,
+0x14,0xe5,0x70,0x60,0x10,0x90,0x91,0x3b,0xe0,0x64,0x02,0x60,0x05,0x12,0x44,0xc8,
+0x80,0x03,0x12,0x44,0x77,0xe5,0x2e,0x30,0xe6,0x1b,0x90,0x01,0x36,0x74,0x40,0xf0,
+0xe5,0x6d,0xb4,0x01,0x10,0xe5,0x70,0x60,0x0c,0x53,0x71,0xfe,0xe5,0x71,0x54,0x07,
+0x70,0x03,0x12,0x44,0xc2,0xe5,0x2f,0x30,0xe1,0x09,0x90,0x01,0x37,0x74,0x02,0xf0,
+0x12,0x64,0x31,0x74,0x22,0x04,0x90,0x01,0xc4,0xf0,0x74,0x4a,0xa3,0xf0,0xd0,0x07,
+0xd0,0x06,0xd0,0x05,0xd0,0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,
+0xd0,0x82,0xd0,0x83,0xd0,0xf0,0xd0,0xe0,0x32,0x90,0x04,0x1b,0xe0,0x54,0x7f,0x64,
+0x7f,0x7f,0x01,0x60,0x02,0x7f,0x00,0x22,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x7f,0x10,0xdf,0xfe,0xd0,0xd0,0x92,0xaf,0x22,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x9b,0xed,0xf0,0x90,0x91,0x9a,0xef,
+0xf0,0xd3,0x94,0x07,0x50,0x63,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,
+0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x47,0xe0,0x5f,0xf0,0x91,0xa0,0x90,0x91,0x9a,
+0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,
+0x46,0xe0,0x4f,0xf0,0x91,0xa0,0x90,0x91,0x9b,0xe0,0x60,0x16,0x90,0x91,0x9a,0xe0,
+0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x45,
+0x80,0x66,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xf4,0xff,0x90,0x00,0x45,0x80,0x6b,0x90,0x91,0x9a,0xe0,0x24,0xf8,0xf0,
+0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,
+0x91,0x98,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,
+0xd8,0xfc,0xff,0x90,0x00,0x43,0xe0,0x4f,0xf0,0x91,0xa0,0x90,0x91,0x9b,0xe0,0x60,
+0x1b,0x90,0x91,0x9a,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,
+0xfc,0xc4,0x54,0xf0,0xff,0x90,0x00,0x42,0xe0,0x4f,0x80,0x1a,0x90,0x91,0x9a,0xe0,
+0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xf4,
+0xff,0x90,0x00,0x42,0xe0,0x5f,0xf0,0x91,0xa0,0xd0,0xd0,0x92,0xaf,0x22,0xf0,0x90,
+0x00,0x45,0xe0,0x54,0xfe,0xfd,0x7f,0x45,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x8f,
+0x82,0x75,0x83,0x00,0xed,0xf0,0x91,0xa0,0xd0,0xd0,0x92,0xaf,0x22,0xef,0x14,0x60,
+0x30,0x14,0x60,0x66,0x24,0x02,0x60,0x02,0xc1,0x64,0x90,0x90,0xf3,0x74,0x02,0xf0,
+0x90,0x00,0x48,0xe0,0x44,0x0c,0xfd,0x7f,0x48,0xb1,0xa8,0x90,0x00,0x47,0xe0,0x44,
+0x08,0xfd,0x7f,0x47,0xb1,0xa8,0x90,0x00,0x45,0xe0,0x44,0x10,0xfd,0x7f,0x45,0x80,
+0x71,0xe4,0x90,0x90,0xf3,0xf0,0x90,0x90,0xef,0x12,0x43,0x09,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x00,0x45,0xe0,0x44,0xef,0xfd,
+0x7f,0x45,0xb1,0xa8,0x90,0x00,0x45,0xe0,0x54,0xef,0xfd,0x7f,0x45,0xb1,0xa8,0x90,
+0x00,0x46,0xe0,0x44,0x10,0xfd,0x7f,0x46,0x80,0x38,0x90,0x90,0xf3,0x74,0x01,0xf0,
+0x90,0x90,0xf9,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,
+0x12,0x2f,0xd9,0x90,0x00,0x45,0xe0,0x44,0x20,0xfd,0x7f,0x45,0xb1,0xa8,0x90,0x00,
+0x45,0xe0,0x44,0x10,0xfd,0x7f,0x45,0xb1,0xa8,0x90,0x00,0x46,0xe0,0x44,0x10,0xfd,
+0x7f,0x46,0xb1,0xa8,0x22,0x90,0x01,0x30,0xe4,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,
+0x90,0x01,0x38,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x50,0xb1,0xa8,0xe4,
+0xfd,0x7f,0x51,0xb1,0xa8,0xe4,0xfd,0x7f,0x52,0xb1,0xa8,0xe4,0xfd,0x7f,0x53,0xa1,
+0xa8,0x8b,0x0e,0x8a,0x0f,0x89,0x10,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x90,0xf6,
+0xf0,0xe0,0x30,0xe0,0x4b,0x90,0x90,0xed,0x74,0x01,0xf0,0x7f,0x80,0x7e,0x08,0x12,
+0x27,0xde,0x90,0x90,0xef,0x12,0x2a,0x7f,0xab,0x0e,0xaa,0x0f,0xa9,0x10,0x90,0x00,
+0x01,0x12,0x42,0x20,0xff,0xe4,0xfc,0xfd,0xfe,0x78,0x1a,0x12,0x2a,0x6c,0xa8,0x04,
+0xa9,0x05,0xaa,0x06,0xab,0x07,0x90,0x90,0xef,0x12,0x43,0x09,0xec,0x54,0x03,0xfc,
+0x12,0x42,0xfc,0x90,0x90,0xf9,0x12,0x2a,0x7f,0x90,0x05,0x22,0xe4,0xf0,0x80,0x2d,
+0xe4,0x90,0x90,0xed,0xf0,0x7f,0x80,0x7e,0x08,0x12,0x27,0xde,0xec,0x54,0x03,0xfc,
+0xec,0x44,0xc0,0xfc,0x90,0x90,0xef,0x12,0x2a,0x7f,0x90,0x90,0xef,0x12,0x43,0x09,
+0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0xf6,
+0xe0,0x30,0xe1,0x19,0x7d,0x0c,0x7f,0x47,0xb1,0xa8,0x90,0x00,0x48,0xe0,0x44,0x0c,
+0xfd,0x7f,0x48,0xb1,0xa8,0x90,0x00,0x46,0xe0,0x44,0x10,0x80,0x1c,0x90,0x00,0x47,
+0xe0,0x54,0xf3,0xfd,0x7f,0x47,0xb1,0xa8,0x90,0x00,0x48,0xe0,0x54,0xf3,0xfd,0x7f,
+0x48,0xb1,0xa8,0x90,0x00,0x46,0xe0,0x54,0xef,0xfd,0x7f,0x46,0xb1,0xa8,0xe4,0x90,
+0x90,0xf3,0xf0,0x22,0x90,0x01,0x3c,0x74,0xff,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x01,
+0x34,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xfd,0x7f,0x54,0xb1,0xa8,0x7d,0xff,0x7f,
+0x55,0xb1,0xa8,0x7d,0xff,0x7f,0x56,0xb1,0xa8,0x7d,0xff,0x7f,0x57,0xa1,0xa8,0xe5,
+0x72,0x64,0x01,0x70,0x3e,0x12,0x54,0x41,0xbf,0x01,0x05,0x7f,0x01,0x12,0x56,0xe7,
+0x90,0x00,0x46,0xe0,0x44,0x04,0xfd,0x7f,0x46,0xb1,0xa8,0x90,0x00,0x44,0xe0,0x54,
+0xfb,0xfd,0x7f,0x44,0xb1,0xa8,0x90,0x00,0x46,0xe0,0x54,0xfb,0xfd,0x7f,0x46,0xb1,
+0xa8,0x7f,0x02,0x12,0x6f,0x09,0x8f,0x76,0x90,0x01,0xc9,0xe5,0x76,0xf0,0xb4,0x01,
+0x02,0xf1,0xd4,0x22,0x90,0x00,0x49,0xe0,0x90,0x91,0x9f,0xf0,0xe0,0x54,0x0f,0xf0,
+0x44,0xf0,0xfd,0x7f,0x49,0xb1,0xa8,0x90,0x91,0x9f,0xe0,0x44,0xb0,0xfd,0x7f,0x49,
+0xa1,0xa8,0xe4,0x90,0x91,0x3c,0xf0,0x90,0x91,0x28,0xf0,0xf5,0x71,0x22,0x75,0x28,
+0x33,0xe4,0xf5,0x29,0x75,0x2a,0x07,0xf5,0x2b,0x90,0x01,0x30,0xe5,0x28,0xf0,0xa3,
+0xe5,0x29,0xf0,0xa3,0xe5,0x2a,0xf0,0xa3,0xe5,0x2b,0xf0,0x22,0x75,0x30,0x1f,0x75,
+0x31,0x01,0xe4,0xf5,0x32,0x90,0x01,0x38,0xe5,0x30,0xf0,0xa3,0xe5,0x31,0xf0,0xa3,
+0xe5,0x32,0xf0,0x22,0xe4,0x90,0x91,0x0e,0xf0,0xa3,0xf0,0x75,0x8e,0x02,0xf1,0x02,
+0xd1,0xb4,0x90,0x91,0x4f,0xef,0xf0,0xd1,0xdb,0x90,0x91,0x51,0xef,0xf0,0xf1,0x3d,
+0x90,0x91,0x3d,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xf5,0x57,0xd1,0xd2,0x12,0x60,0x37,
+0x12,0x32,0x3d,0xd1,0xc1,0x12,0x4f,0xfe,0xf1,0x13,0xd1,0xcb,0x11,0x1c,0x12,0x44,
+0xff,0x31,0x23,0x11,0xdf,0x12,0x6f,0xaa,0x90,0x91,0x10,0xe5,0xd9,0xf0,0x12,0x4f,
+0x64,0xc2,0xaf,0x90,0x00,0x80,0xe0,0x44,0x40,0xf0,0x12,0x4c,0xa0,0x75,0xe8,0x03,
+0x43,0xa8,0x85,0xd2,0xaf,0x90,0x91,0x0e,0xe0,0x64,0x01,0xf0,0x24,0x34,0x90,0x01,
+0xc4,0xf0,0x74,0x50,0xa3,0xf0,0xe5,0x57,0x30,0xe2,0x10,0x12,0x5e,0x63,0xbf,0x01,
+0x0a,0xc2,0xaf,0x53,0x57,0xfb,0xd2,0xaf,0x12,0x71,0x8a,0xe5,0x57,0x30,0xe4,0x0a,
+0xc2,0xaf,0x53,0x57,0xef,0xd2,0xaf,0x12,0x5e,0xa0,0x90,0x90,0xf7,0xe0,0x70,0x03,
+0x12,0x70,0x08,0x11,0xf7,0x90,0x91,0x3f,0xe0,0x90,0x01,0xba,0xf0,0x80,0xb6,0x90,
+0x91,0x53,0xe0,0x54,0xfe,0xf0,0xe4,0x90,0x91,0x55,0xf0,0x90,0x91,0x53,0xe0,0x54,
+0x7f,0xf0,0xa3,0x74,0x0a,0xf0,0x22,0x90,0x06,0x34,0xe0,0x60,0x25,0x14,0x70,0x1b,
+0x7b,0x01,0x7a,0x06,0x79,0x35,0x7f,0xf9,0x7e,0x01,0x12,0x68,0x1a,0xbf,0x01,0x09,
+0x90,0x06,0x35,0xe0,0x54,0x0f,0xf0,0x80,0x04,0x80,0x00,0xc1,0xf4,0xe4,0x90,0x06,
+0x34,0xf0,0x22,0x90,0x91,0x56,0xe0,0x54,0xfe,0xf0,0xe0,0x54,0x7f,0xf0,0x90,0x01,
+0x17,0xe0,0xfe,0x90,0x01,0x16,0xe0,0x7c,0x00,0x24,0x00,0xff,0xec,0x3e,0x90,0x91,
+0x5c,0xf0,0xa3,0xef,0xf0,0x90,0x01,0x04,0xe0,0x54,0x0f,0x90,0x91,0x1c,0xf0,0xe0,
+0xff,0x74,0x40,0x7e,0x00,0xa8,0x07,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,
+0xf9,0x90,0x91,0x5b,0xf0,0xee,0x90,0x91,0x5a,0xf0,0x90,0x91,0x5e,0xe0,0x54,0xfe,
+0xf0,0xe0,0x54,0xfd,0xf0,0xe0,0x54,0xfb,0xf0,0xe0,0x54,0xf7,0xf0,0xe0,0x54,0xef,
+0xf0,0xe0,0x54,0xdf,0xf0,0xe0,0x54,0xbf,0xf0,0xe0,0x54,0x7f,0xf0,0xe4,0xa3,0xf0,
+0xa3,0xf0,0xa3,0xe0,0x54,0xfe,0xf0,0xe0,0x54,0xfd,0xf0,0xe0,0x54,0xf7,0xf0,0x22,
+0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x12,0x29,0xd9,0x54,0x01,0xff,0x90,0x91,0x56,
+0xe0,0x54,0xfe,0x4f,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0x90,0x91,0x57,0xf0,0x90,
+0x00,0x02,0x12,0x42,0x20,0x90,0x91,0x58,0xf0,0x90,0x91,0x56,0xe0,0x30,0xe0,0x1a,
+0x90,0x06,0x09,0xe0,0x54,0xfe,0xf0,0x90,0x02,0x86,0xe0,0x44,0x04,0xf0,0x43,0x57,
+0x04,0x7d,0x08,0xe4,0xff,0x12,0x36,0xe6,0x80,0x12,0x7d,0x08,0xe4,0xff,0x12,0x36,
+0x75,0x90,0x02,0x86,0xe0,0x54,0xfb,0xf0,0x51,0x01,0x31,0x23,0xd0,0xd0,0x92,0xaf,
+0x22,0x90,0x06,0x90,0xe4,0xf0,0x21,0x6a,0x90,0x91,0x19,0x12,0x43,0x41,0xef,0x12,
+0x43,0x4a,0x52,0x40,0x01,0x52,0x49,0x02,0x52,0x6a,0x03,0x52,0x73,0x09,0x52,0x7b,
+0x0c,0x52,0x84,0x0d,0x52,0x8c,0x0e,0x52,0x9d,0x1a,0x52,0xa5,0x2c,0x52,0x51,0x2d,
+0x52,0x5a,0x2e,0x52,0xad,0x30,0x52,0x62,0x3b,0x52,0x95,0x3c,0x00,0x00,0x52,0xb5,
+0x90,0x91,0x19,0x12,0x43,0x21,0x02,0x64,0xde,0x90,0x91,0x19,0x12,0x43,0x21,0xc1,
+0xc5,0x90,0x91,0x19,0x12,0x43,0x21,0x02,0x65,0xf9,0x90,0x91,0x19,0x12,0x43,0x21,
+0xe1,0xa8,0x90,0x91,0x19,0x12,0x43,0x21,0xe1,0x28,0x90,0x91,0x19,0x12,0x43,0x21,
+0x02,0x66,0x41,0x90,0x91,0x19,0x12,0x43,0x21,0x80,0x42,0x90,0x91,0x19,0x12,0x43,
+0x21,0x02,0x5d,0x16,0x90,0x91,0x19,0x12,0x43,0x21,0xe1,0x75,0x90,0x91,0x19,0x12,
+0x43,0x21,0x02,0x4e,0x91,0x90,0x91,0x19,0x12,0x43,0x21,0x21,0xa0,0x90,0x91,0x19,
+0x12,0x43,0x21,0xa1,0x7f,0x90,0x91,0x19,0x12,0x43,0x21,0x81,0x5e,0x90,0x91,0x19,
+0x12,0x43,0x21,0xe1,0x55,0x90,0x01,0xc6,0xe0,0x44,0x01,0xf0,0x22,0xd3,0x10,0xaf,
+0x01,0xc3,0xc0,0xd0,0x90,0x91,0x1c,0x12,0x43,0x41,0x90,0x91,0x1c,0x12,0x43,0x21,
+0x90,0x00,0x01,0x12,0x42,0x97,0xfa,0xe5,0xf0,0x24,0x00,0xff,0xe4,0x3a,0xfe,0x90,
+0x91,0x1c,0x12,0x43,0x21,0x90,0x00,0x01,0xee,0x8f,0xf0,0x12,0x42,0xcf,0x12,0x29,
+0xd9,0xff,0x60,0x2c,0xb5,0x72,0x16,0x90,0x91,0x1c,0x12,0x43,0x21,0x90,0x00,0x01,
+0x12,0x42,0x97,0x65,0x74,0x70,0x04,0xe5,0x73,0x65,0xf0,0x60,0x23,0x90,0x91,0x1c,
+0x12,0x43,0x21,0x90,0x00,0x01,0x12,0x42,0x97,0xff,0xae,0xf0,0x71,0x35,0x80,0x10,
+0x90,0x91,0x1c,0x12,0x43,0x21,0x12,0x29,0xd9,0x65,0x72,0x60,0x03,0x12,0x44,0xe8,
+0xd0,0xd0,0x92,0xaf,0x22,0x90,0x91,0x1f,0xee,0xf0,0xa3,0xef,0xf0,0x75,0x72,0x01,
+0x8e,0x73,0xf5,0x74,0xe4,0xfd,0x7f,0x0b,0x71,0x77,0xe4,0xfd,0x7f,0x02,0x71,0x77,
+0x91,0x41,0xe4,0xff,0xd1,0xe7,0xe4,0xf5,0x76,0x90,0x01,0xc9,0xe5,0x76,0xf0,0x90,
+0x91,0x1f,0xe0,0xfc,0xa3,0xe0,0xfd,0xec,0xfb,0x8d,0x44,0xe4,0xf5,0x45,0x7d,0x01,
+0x7f,0x60,0x7e,0x01,0x02,0x35,0xab,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,
+0x22,0xed,0xf0,0x90,0x91,0x21,0xef,0xf0,0xd3,0x94,0x07,0x50,0x4f,0xa3,0xe0,0x70,
+0x1a,0x90,0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,
+0xfc,0xf4,0xff,0x90,0x00,0x47,0xe0,0x5f,0xf0,0x80,0x17,0x90,0x91,0x21,0xe0,0xff,
+0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xff,0x90,0x00,0x47,0xe0,
+0x4f,0xf0,0x12,0x4c,0xa0,0x90,0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,
+0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x46,0x80,0x5a,0x90,0x91,0x21,0xe0,
+0x24,0xf8,0xf0,0xa3,0xe0,0x70,0x1d,0x90,0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,0x07,
+0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xf4,0xff,0x90,0x00,0x43,0xe0,
+0x5f,0xf0,0x80,0x1a,0x90,0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,
+0xc3,0x33,0xd8,0xfc,0xc4,0x54,0xf0,0xff,0x90,0x00,0x43,0xe0,0x4f,0xf0,0x12,0x4c,
+0xa0,0x90,0x91,0x21,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,
+0xfc,0xf4,0xff,0x90,0x00,0x43,0xe0,0x5f,0xf0,0x12,0x4c,0xa0,0xd0,0xd0,0x92,0xaf,
+0x22,0x7f,0x0b,0x12,0x6f,0x09,0xef,0x65,0x75,0x60,0x10,0xe5,0x75,0xb4,0x01,0x05,
+0xe4,0xf5,0x75,0x80,0x03,0x75,0x75,0x01,0x7f,0x01,0x22,0x7f,0x00,0x22,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0xe4,0xf5,0x10,0x75,0x11,0x04,0xf5,0x12,0xf5,0x14,0xf5,
+0x15,0x90,0x02,0x09,0xe0,0xff,0x12,0x29,0xd9,0xfe,0xef,0x2e,0xf5,0x13,0x30,0xe0,
+0x08,0x75,0x0e,0x00,0x75,0x0f,0x80,0x80,0x05,0xe4,0xf5,0x0e,0xf5,0x0f,0xe5,0x13,
+0xc3,0x13,0x90,0xfd,0x10,0xf0,0x74,0x20,0x25,0x10,0xf5,0x10,0xad,0x0f,0xe5,0x10,
+0x2d,0xff,0x24,0x01,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x90,0x91,0x47,0xf0,
+0x74,0x02,0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0xfe,0xe5,0x10,0x2d,0x24,
+0x03,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x24,0x00,0xff,0xe4,0x3e,0x90,0x91,
+0x48,0xf0,0xa3,0xef,0xf0,0x7f,0x04,0xe5,0x10,0x25,0x0f,0x2f,0x24,0x00,0xf5,0x82,
+0xe4,0x34,0xfc,0xf5,0x83,0xe0,0xfe,0x74,0x46,0x2f,0xf5,0x82,0xe4,0x34,0x91,0xf5,
+0x83,0xee,0xf0,0x0f,0xbf,0x08,0xe0,0x12,0x66,0x89,0xef,0x70,0x3f,0x90,0x01,0xc3,
+0xe0,0x60,0x25,0xc3,0xe5,0x15,0x94,0xe8,0xe5,0x14,0x94,0x03,0x40,0x09,0x90,0x01,
+0xc6,0xe0,0x44,0x10,0xf0,0x80,0x63,0x05,0x15,0xe5,0x15,0x70,0x02,0x05,0x14,0x7f,
+0x0a,0x7e,0x00,0x12,0x37,0x54,0x80,0xd5,0x90,0x01,0xc6,0xe0,0x90,0x01,0xc3,0x30,
+0xe2,0x05,0x74,0xfe,0xf0,0x80,0x43,0x74,0xff,0xf0,0x80,0x3e,0xe5,0x10,0xb4,0x78,
+0x23,0xe4,0xf5,0x10,0x05,0x13,0xe5,0x0f,0x64,0x80,0x45,0x0e,0x70,0x06,0xf5,0x0e,
+0xf5,0x0f,0x80,0x06,0x75,0x0e,0x00,0x75,0x0f,0x80,0xe5,0x13,0xc3,0x13,0x90,0xfd,
+0x10,0xf0,0x80,0x06,0x74,0x08,0x25,0x10,0xf5,0x10,0xe5,0x12,0x15,0x12,0x70,0x02,
+0x15,0x11,0xe5,0x12,0x45,0x11,0x60,0x02,0x81,0x9c,0xd0,0xd0,0x92,0xaf,0x22,0x90,
+0x91,0x1c,0x12,0x43,0x41,0x12,0x29,0xd9,0xff,0x54,0x01,0xfe,0x90,0x91,0x5e,0xe0,
+0x54,0xfe,0x4e,0xf0,0xef,0x54,0x04,0xff,0xe0,0x54,0xfb,0x4f,0xf0,0x12,0x29,0xd9,
+0xff,0x54,0x02,0xfe,0x90,0x91,0x5e,0xe0,0x54,0xfd,0x4e,0xf0,0xef,0x54,0x08,0xff,
+0xe0,0x54,0xf7,0x4f,0xf0,0x12,0x29,0xd9,0xff,0x54,0x10,0xfe,0x90,0x91,0x5e,0xe0,
+0x54,0xef,0x4e,0xf0,0xef,0x54,0x20,0xff,0xe0,0x54,0xdf,0x4f,0xf0,0x12,0x29,0xd9,
+0xff,0x54,0x40,0xfe,0x90,0x91,0x5e,0xe0,0x54,0xbf,0x4e,0xf0,0xef,0x54,0x80,0xff,
+0xe0,0x54,0x7f,0x4f,0xf0,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x91,0x60,0xf0,0x90,
+0x00,0x01,0x12,0x42,0x20,0x90,0x91,0x5f,0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0xff,
+0x54,0x01,0xfe,0x90,0x91,0x61,0xe0,0x54,0xfe,0x4e,0xf0,0xef,0x54,0x02,0xff,0xe0,
+0x54,0xfd,0x4f,0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0x54,0x04,0xff,0x90,0x91,0x61,
+0xe0,0x54,0xfb,0x4f,0xf0,0x90,0x91,0x5e,0xe0,0x54,0x01,0x90,0x01,0xb8,0xf0,0x90,
+0x91,0x5e,0xe0,0xff,0xc4,0x13,0x54,0x01,0x90,0x01,0xb9,0xf0,0x90,0x91,0x61,0xe0,
+0x54,0x01,0x90,0x01,0xba,0xf0,0xa3,0x74,0xff,0xf0,0x12,0x29,0xd9,0x20,0xe0,0x02,
+0x41,0x01,0xe4,0xfd,0x7f,0x81,0x12,0x4d,0xa8,0x90,0x91,0x1c,0x12,0x43,0x21,0x12,
+0x29,0xd9,0xff,0xc3,0x13,0x30,0xe0,0x07,0x90,0x06,0x90,0xe0,0x44,0x02,0xf0,0xef,
+0x13,0x13,0x54,0x3f,0x30,0xe0,0x07,0x90,0x06,0x90,0xe0,0x44,0x04,0xf0,0x12,0x29,
+0xd9,0x13,0x13,0x13,0x54,0x1f,0x30,0xe0,0x07,0x90,0x06,0x90,0xe0,0x44,0x08,0xf0,
+0x90,0x91,0x61,0xe0,0x30,0xe0,0x1c,0x90,0x91,0x5e,0xe0,0xc4,0x13,0x54,0x07,0x30,
+0xe0,0x07,0xa3,0xe0,0xff,0xe4,0xfd,0x80,0x07,0x90,0x91,0x5f,0xe0,0xff,0x7d,0x01,
+0x12,0x4c,0xb0,0x22,0x90,0x00,0x02,0xe0,0x54,0xe0,0x7f,0x01,0x60,0x02,0x7f,0x00,
+0x22,0xe4,0xf5,0x75,0x22,0x12,0x29,0xd9,0xf5,0x6d,0x22,0x90,0x01,0x64,0x74,0xa0,
+0xf0,0x22,0x90,0x91,0x51,0xe0,0x90,0x90,0xe8,0xf0,0x22,0x90,0x00,0xf3,0xe0,0x7f,
+0x00,0x30,0xe3,0x02,0x7f,0x01,0x22,0x90,0x01,0xca,0xe5,0x75,0xf0,0xef,0x60,0x03,
+0x12,0x4f,0xd4,0x22,0x90,0x06,0x34,0x74,0xff,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,
+0xf0,0x22,0xe4,0x90,0x91,0x4e,0xf0,0x90,0x00,0x80,0xe0,0x44,0x80,0xfd,0x7f,0x80,
+0x02,0x4d,0xa8,0x90,0x00,0xf3,0xe0,0x30,0xe2,0x0d,0x90,0x05,0x41,0x74,0x10,0xf0,
+0x90,0x05,0x5a,0xf0,0xa3,0xe4,0xf0,0x22,0x12,0x29,0xd9,0x60,0x02,0x80,0x01,0xe4,
+0x90,0x91,0x31,0xf0,0x90,0x91,0x31,0xe0,0x90,0x01,0xe7,0xf0,0x22,0x90,0x91,0x51,
+0xe0,0xb4,0x01,0x0c,0x90,0x00,0xf2,0xe0,0x30,0xe7,0x05,0x7e,0xfd,0x7f,0x33,0x22,
+0x7e,0xfd,0x7f,0x2f,0x22,0x12,0x29,0xd9,0xff,0x54,0x01,0xfe,0x90,0x91,0x53,0xe0,
+0x54,0xfe,0x4e,0xf0,0xef,0xc3,0x13,0x30,0xe0,0x0a,0x90,0x00,0x01,0x12,0x42,0x20,
+0x90,0x91,0x54,0xf0,0x22,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x90,0xf7,0xf0,0xe0,
+0x60,0x04,0xe0,0xf4,0x70,0x21,0xa2,0xaf,0xe4,0x33,0xf5,0x0e,0xc2,0xaf,0x90,0x00,
+0x47,0xe0,0x54,0xfb,0xfd,0x7f,0x47,0x12,0x4d,0xa8,0x7d,0x40,0x7f,0x01,0x12,0x36,
+0xaf,0xe5,0x0e,0x24,0xff,0x92,0xaf,0x22,0x12,0x29,0xd9,0x30,0xe0,0x19,0xc3,0x13,
+0x54,0x7f,0x90,0x91,0x34,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0x90,0x91,0x32,
+0xe4,0xf0,0xa3,0xef,0xf0,0x80,0x0f,0x90,0x91,0x34,0x74,0x07,0xf0,0x90,0x91,0x32,
+0xe4,0xf0,0xa3,0x74,0x03,0xf0,0x90,0x91,0x32,0xe0,0xa3,0xe0,0x90,0x05,0x58,0xf0,
+0x22,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,0x00,0xc0,0x00,
+0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,0x07,0x90,0x01,
+0xc4,0x74,0xe1,0xf0,0x74,0x57,0xa3,0xf0,0x53,0x91,0xef,0x90,0x00,0x51,0xe0,0xff,
+0x90,0x00,0x55,0xe0,0x5f,0xf5,0x3d,0x90,0x00,0x52,0xe0,0xff,0x90,0x00,0x56,0xe0,
+0x5f,0xf5,0x3e,0xe5,0x3d,0x30,0xe4,0x06,0x90,0x00,0x55,0x74,0x10,0xf0,0xe5,0x3d,
+0x30,0xe5,0x06,0x90,0x00,0x55,0x74,0x20,0xf0,0xe5,0x3d,0x30,0xe6,0x1b,0x90,0x00,
+0x55,0x74,0x40,0xf0,0x90,0x90,0xf6,0xe0,0x54,0x03,0xff,0xbf,0x03,0x0b,0x90,0x90,
+0xf3,0xe0,0x60,0x05,0x7f,0x01,0x12,0x4d,0xbd,0xe5,0x3d,0x30,0xe7,0x15,0x90,0x00,
+0x55,0x74,0x80,0xf0,0x90,0x90,0xf6,0xe0,0x54,0x03,0xff,0xbf,0x03,0x05,0x7f,0x02,
+0x12,0x4d,0xbd,0xe5,0x3e,0x30,0xe0,0x06,0x90,0x00,0x56,0x74,0x01,0xf0,0xe5,0x3e,
+0x30,0xe1,0x06,0x90,0x00,0x56,0x74,0x02,0xf0,0xe5,0x3e,0x30,0xe2,0x06,0x90,0x00,
+0x56,0x74,0x04,0xf0,0xe5,0x3e,0x30,0xe3,0x06,0x90,0x00,0x56,0x74,0x08,0xf0,0x90,
+0x01,0xc4,0x74,0xe1,0xf0,0x74,0x57,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,0xd0,
+0x04,0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,0xd0,
+0xf0,0xd0,0xe0,0x32,0xc0,0xe0,0xc0,0xf0,0xc0,0x83,0xc0,0x82,0xc0,0xd0,0x75,0xd0,
+0x00,0xc0,0x00,0xc0,0x01,0xc0,0x02,0xc0,0x03,0xc0,0x04,0xc0,0x05,0xc0,0x06,0xc0,
+0x07,0x75,0x0d,0x00,0x90,0x01,0xc4,0x74,0xc4,0xf0,0x74,0x58,0xa3,0xf0,0x53,0x91,
+0xdf,0x90,0x01,0x3c,0xe0,0x55,0x30,0xf5,0x34,0xa3,0xe0,0x55,0x31,0xf5,0x35,0xa3,
+0xe0,0x55,0x32,0xf5,0x36,0xa3,0xe0,0x55,0x33,0xf5,0x37,0xe5,0x34,0x30,0xe0,0x06,
+0x90,0x01,0x3c,0x74,0x01,0xf0,0xe5,0x34,0x30,0xe1,0x08,0x90,0x01,0x3c,0x74,0x02,
+0xf0,0x71,0x89,0xe5,0x34,0x30,0xe2,0x3a,0x90,0x01,0x3c,0x74,0x04,0xf0,0x90,0x06,
+0x92,0xe0,0x30,0xe0,0x25,0x90,0x91,0x66,0xe4,0xf0,0x90,0x91,0x2d,0xe0,0x90,0x91,
+0x67,0xf0,0xe4,0xfb,0xfd,0x7f,0x58,0x7e,0x01,0x12,0x44,0x59,0x90,0x01,0x5b,0x74,
+0x05,0xf0,0x90,0x06,0x92,0x74,0x01,0xf0,0x80,0x08,0x90,0x91,0x37,0xe4,0xf0,0x12,
+0x44,0xc2,0xe5,0x34,0x30,0xe3,0x3a,0x90,0x01,0x3c,0x74,0x08,0xf0,0x90,0x06,0x92,
+0xe0,0x30,0xe1,0x25,0x90,0x91,0x66,0xe4,0xf0,0x90,0x91,0x2d,0xe0,0x90,0x91,0x67,
+0xf0,0xe4,0xfb,0xfd,0x7f,0x5c,0x7e,0x01,0x12,0x44,0x59,0x90,0x01,0x5f,0x74,0x05,
+0xf0,0x90,0x06,0x92,0x74,0x02,0xf0,0x80,0x08,0x90,0x91,0x36,0xe4,0xf0,0x12,0x44,
+0xc2,0xe5,0x34,0x30,0xe4,0x09,0x90,0x01,0x3c,0x74,0x10,0xf0,0x12,0x4f,0x8f,0xe5,
+0x34,0x30,0xe5,0x08,0x90,0x01,0x3c,0x74,0x20,0xf0,0x51,0x62,0xe5,0x35,0x30,0xe0,
+0x5a,0x90,0x01,0x3d,0x74,0x01,0xf0,0x90,0x01,0x2f,0xe0,0x44,0x7f,0xf0,0x90,0x00,
+0x83,0xe0,0x54,0x0f,0xf5,0x0d,0xb4,0x01,0x02,0x80,0x1c,0xe5,0x0d,0xb4,0x02,0x05,
+0x90,0x00,0x83,0x80,0x12,0xe5,0x0d,0xb4,0x04,0x05,0x90,0x00,0x83,0x80,0x08,0xe5,
+0x0d,0xb4,0x0c,0x08,0x90,0x00,0x83,0xe0,0xf5,0x6f,0x80,0x06,0x90,0x01,0xbe,0xe0,
+0x04,0xf0,0x90,0x01,0xbb,0xe5,0x6f,0xf0,0xe5,0x6f,0x30,0xe0,0x03,0xa3,0x80,0x03,
+0x90,0x01,0xbd,0xe0,0x04,0xf0,0x71,0x6a,0x12,0x44,0xc2,0xe5,0x35,0x30,0xe2,0x06,
+0x90,0x01,0x3d,0x74,0x04,0xf0,0xe5,0x36,0x30,0xe0,0x06,0x90,0x01,0x3e,0x74,0x01,
+0xf0,0xe5,0x36,0x30,0xe1,0x06,0x90,0x01,0x3e,0x74,0x02,0xf0,0x74,0xc4,0x04,0x90,
+0x01,0xc4,0xf0,0x74,0x58,0xa3,0xf0,0xd0,0x07,0xd0,0x06,0xd0,0x05,0xd0,0x04,0xd0,
+0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0xd0,0xd0,0xd0,0x82,0xd0,0x83,0xd0,0xf0,0xd0,
+0xe0,0x32,0x90,0x90,0xf5,0xe0,0x64,0x01,0x60,0x02,0x61,0x17,0x90,0x00,0x46,0xe0,
+0x44,0x01,0xfd,0x7f,0x46,0x12,0x4d,0xa8,0x90,0x91,0x07,0xe0,0x70,0x32,0x90,0x90,
+0xed,0xe0,0x60,0x15,0x90,0x90,0xf9,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x80,0x06,0x90,0x05,0x22,0x74,0x7f,0xf0,0x90,
+0x90,0xf4,0xe0,0xff,0x71,0x18,0x90,0x91,0x07,0x74,0x01,0x12,0x4d,0x9e,0x80,0x40,
+0x90,0x91,0x07,0xe0,0x64,0x01,0x70,0x38,0x90,0x90,0xf8,0xe0,0xff,0x71,0x18,0xe4,
+0x90,0x91,0x07,0xf0,0x90,0x00,0x45,0xe0,0x44,0x01,0xfd,0x7f,0x45,0x12,0x4d,0xa8,
+0x90,0x90,0xed,0xe0,0x60,0x15,0x90,0x90,0xef,0x12,0x43,0x09,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x80,0x05,0x90,0x05,0x22,0xe4,0xf0,
+0x90,0x05,0x87,0xe0,0x64,0x80,0xf0,0x90,0x91,0x03,0xe0,0x90,0x05,0x84,0xf0,0x90,
+0x91,0x04,0xe0,0x90,0x05,0x85,0xf0,0x90,0x91,0x05,0xe0,0x90,0x05,0x86,0xf0,0x90,
+0x91,0x06,0xe0,0x90,0x05,0x87,0xf0,0x22,0x90,0x05,0x60,0xe0,0x90,0x91,0x03,0xf0,
+0x90,0x05,0x61,0xe0,0x90,0x91,0x04,0xf0,0x90,0x05,0x62,0xe0,0x90,0x91,0x05,0xf0,
+0x90,0x05,0x63,0xe0,0x90,0x91,0x06,0xf0,0xc3,0x74,0xff,0x9f,0xfe,0x90,0x91,0x04,
+0xe0,0xd3,0x9e,0x40,0x1e,0xe0,0x2f,0xf0,0xa3,0xe0,0xb4,0xff,0x0f,0xe4,0xf0,0xa3,
+0xe0,0xb4,0xff,0x03,0xe4,0xf0,0x22,0x90,0x91,0x06,0x80,0x03,0x90,0x91,0x05,0xe0,
+0x04,0xf0,0x22,0x90,0x91,0x04,0xe0,0x2f,0xf0,0x22,0xe5,0x6f,0x30,0xe6,0x19,0xe5,
+0x6f,0x54,0x0f,0xff,0x90,0x91,0x24,0xe0,0xfe,0x4f,0x90,0x01,0x2f,0xf0,0xee,0x64,
+0x80,0x90,0x91,0x24,0xf0,0x53,0x6f,0xbf,0x22,0xe4,0x90,0x91,0x0d,0xf0,0xe5,0x70,
+0x70,0x02,0x81,0x13,0x90,0x91,0x3c,0xe0,0x60,0x0d,0xe4,0xf0,0x53,0x71,0xfd,0xe5,
+0x71,0x54,0x07,0x70,0x6e,0x80,0x69,0x90,0x91,0x28,0xe0,0x04,0xf0,0x53,0x71,0xef,
+0x90,0x91,0x3a,0xe0,0x04,0xf0,0x90,0x91,0x0d,0xe0,0xf9,0xff,0x7e,0x00,0x24,0x01,
+0xfd,0xee,0x33,0xfc,0x90,0x91,0x3a,0xe0,0xb5,0x05,0x06,0xe4,0xb5,0x04,0x02,0x80,
+0x12,0xef,0x24,0x02,0xff,0xe4,0x3e,0xfe,0x90,0x91,0x3a,0xe0,0xb5,0x07,0x0a,0xe4,
+0xb5,0x06,0x06,0x90,0x05,0x58,0xe0,0x04,0xf0,0xe9,0xff,0x90,0x91,0x2f,0xe0,0x2f,
+0xff,0xe4,0x33,0xfe,0x90,0x91,0x28,0xe0,0xd3,0x9f,0xee,0x64,0x80,0xf8,0x74,0x80,
+0x98,0x40,0x0d,0xe5,0x6d,0xb4,0x01,0x0b,0xa3,0xe0,0x70,0x07,0xe0,0x04,0xf0,0x22,
+0x12,0x44,0xc2,0x22,0x90,0x90,0xee,0xe0,0xc3,0x94,0x14,0x50,0x05,0xe0,0x04,0xf0,
+0x81,0xcc,0x90,0x90,0xee,0xe0,0x64,0x14,0x60,0x02,0x81,0xcc,0x90,0x90,0xfd,0xe0,
+0x70,0x25,0x90,0x91,0x00,0xe0,0x70,0x1f,0x90,0x90,0xfe,0xe0,0x70,0x19,0x90,0x91,
+0x01,0xe0,0x70,0x13,0x90,0x90,0xff,0xe0,0x70,0x0d,0x90,0x91,0x02,0xe0,0x70,0x07,
+0x90,0x04,0xfd,0xe0,0x54,0xfe,0xf0,0x90,0x90,0xfd,0xe0,0x90,0x04,0x44,0xf0,0x90,
+0x90,0xfe,0xe0,0x90,0x04,0x45,0xf0,0x90,0x90,0xff,0xe0,0x90,0x04,0x46,0xf0,0xa3,
+0xe4,0xf0,0x90,0x91,0x00,0xe0,0x90,0x04,0x48,0xf0,0x90,0x91,0x01,0xe0,0x90,0x04,
+0x49,0xf0,0x90,0x91,0x02,0xe0,0x90,0x04,0x4a,0xf0,0xa3,0xe4,0xf0,0x90,0x90,0xe9,
+0xe0,0x90,0x04,0x4c,0xf0,0x90,0x90,0xea,0xe0,0x90,0x04,0x4d,0xf0,0x90,0x90,0xeb,
+0xe0,0x90,0x04,0x4e,0xf0,0x90,0x90,0xec,0xe0,0x90,0x04,0x4f,0xf0,0xe4,0x90,0x90,
+0xee,0xf0,0x90,0x90,0xe9,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x90,
+0xfd,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,0x90,0x05,0x60,0xe0,
+0x90,0x91,0x8c,0xf0,0x90,0x05,0x61,0xe0,0x90,0x91,0x8d,0xf0,0x90,0x05,0x62,0xe0,
+0x90,0x91,0x8e,0xf0,0x90,0x05,0x63,0xe0,0x90,0x91,0x8f,0xf0,0x90,0x91,0x06,0xe0,
+0xff,0x90,0x91,0x8f,0xe0,0xfe,0xd3,0x9f,0x50,0x0b,0x90,0x91,0x06,0xe0,0xc3,0x9e,
+0xd3,0x94,0x01,0x40,0x10,0x90,0x90,0xf4,0xe0,0xb4,0x01,0x02,0x80,0x03,0x90,0x90,
+0xf8,0xe0,0xff,0x71,0x18,0x22,0x90,0x00,0x02,0x12,0x42,0x20,0x90,0x90,0xf5,0xf0,
+0x90,0x00,0x01,0x12,0x42,0x20,0x25,0xe0,0x25,0xe0,0x90,0x90,0xf4,0xf0,0x12,0x29,
+0xd9,0x25,0xe0,0x25,0xe0,0x90,0x90,0xf8,0xf0,0x90,0x05,0x60,0xe0,0x90,0x91,0x03,
+0xf0,0x90,0x05,0x61,0xe0,0x90,0x91,0x04,0xf0,0x90,0x05,0x62,0xe0,0x90,0x91,0x05,
+0xf0,0x90,0x05,0x63,0xe0,0x90,0x91,0x06,0xf0,0xa2,0xaf,0xe4,0x33,0x90,0x91,0x1c,
+0xf0,0xc2,0xaf,0x90,0x90,0xf4,0xe0,0xff,0x71,0x18,0x90,0x91,0x1c,0xe0,0x24,0xff,
+0x92,0xaf,0x90,0x90,0xf5,0xe0,0x70,0x02,0xc1,0x1f,0x90,0x90,0xf4,0xe0,0x70,0x02,
+0xc1,0x1f,0x90,0x90,0xf8,0xe0,0x70,0x02,0xc1,0x1f,0xa2,0xaf,0xe4,0x33,0x90,0x91,
+0x1c,0xf0,0xc2,0xaf,0x90,0x91,0x07,0x74,0x01,0xf0,0x90,0x91,0x1c,0xe0,0x24,0xff,
+0x92,0xaf,0x12,0x4d,0x9f,0x90,0x00,0x46,0xe0,0x44,0x01,0xfd,0x7f,0x46,0x12,0x4d,
+0xa8,0x90,0x90,0xed,0xe0,0x60,0x15,0x90,0x90,0xf9,0x12,0x43,0x09,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x08,0x12,0x2f,0xd9,0x80,0x06,0x90,0x05,0x22,0x74,
+0x7f,0xf0,0x90,0x00,0x45,0xe0,0x54,0xef,0xfd,0x7f,0x45,0x12,0x4d,0xa8,0x90,0x05,
+0x87,0xe0,0x64,0x80,0xf0,0x90,0x91,0x03,0xe0,0x90,0x05,0x84,0xf0,0x90,0x91,0x04,
+0xe0,0x90,0x05,0x85,0xf0,0x90,0x91,0x05,0xe0,0x90,0x05,0x86,0xf0,0x90,0x91,0x06,
+0xe0,0x90,0x05,0x87,0xf0,0xa2,0xaf,0xe4,0x33,0x90,0x91,0x1c,0xf0,0xc2,0xaf,0x90,
+0x01,0x3c,0xe0,0x44,0x20,0xf0,0x7d,0x20,0xe4,0xff,0x12,0x37,0x00,0x80,0x2d,0x90,
+0x90,0xf5,0xe0,0x70,0x2f,0x90,0x91,0x07,0x12,0x4d,0x9e,0x90,0x00,0x46,0xe0,0x54,
+0xfe,0xfd,0x7f,0x46,0x12,0x4d,0xa8,0x90,0x05,0x22,0xe4,0xf0,0xa2,0xaf,0x33,0x90,
+0x91,0x1c,0xf0,0xc2,0xaf,0x7d,0x20,0xe4,0xff,0x12,0x36,0x92,0x90,0x91,0x1c,0xe0,
+0x24,0xff,0x92,0xaf,0x22,0x8f,0x20,0x8c,0x21,0x8d,0x22,0x22,0x8f,0x23,0x8c,0x24,
+0x8d,0x25,0x22,0xe4,0x90,0x91,0x11,0xf0,0xa3,0xf0,0x90,0x02,0x86,0xe0,0x20,0xe1,
+0x2c,0xc3,0x90,0x91,0x12,0xe0,0x94,0x20,0x90,0x91,0x11,0xe0,0x94,0x03,0x40,0x0a,
+0x90,0x01,0xc6,0xe0,0x44,0x20,0xf0,0x7f,0x00,0x22,0x90,0x91,0x11,0xe4,0x75,0xf0,
+0x01,0x12,0x42,0x81,0x7f,0x01,0x7e,0x00,0x12,0x37,0x54,0x80,0xcd,0x7f,0x01,0x22,
+0x90,0x01,0xcc,0xe0,0x54,0x0f,0x90,0x91,0x11,0xf0,0x90,0x91,0x11,0xe0,0xfd,0x70,
+0x02,0xe1,0xe2,0x90,0x91,0x9c,0xe0,0xff,0x74,0x01,0x7e,0x00,0xa8,0x07,0x08,0x80,
+0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0xef,0x5d,0x70,0x02,0xe1,0xdb,0x90,
+0x91,0x9c,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd0,0x12,0x43,0x15,0xe0,0x90,0x91,0x12,
+0xf0,0x75,0x63,0x01,0x75,0x64,0x91,0x75,0x65,0x12,0x75,0x66,0x01,0x7b,0x01,0x7a,
+0x91,0x79,0x13,0x12,0x46,0x6d,0x90,0x91,0x13,0xe0,0xff,0xc4,0x13,0x13,0x13,0x54,
+0x01,0x90,0x91,0x9c,0x30,0xe0,0x59,0xe0,0x75,0xf0,0x02,0x90,0x00,0x88,0x12,0x43,
+0x15,0xe0,0x90,0x91,0x14,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x02,0x90,0x00,0x89,
+0x12,0x43,0x15,0xe0,0x90,0x91,0x15,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x04,0x90,
+0x01,0xd1,0x12,0x43,0x15,0xe0,0x90,0x91,0x16,0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,
+0x04,0x90,0x01,0xd2,0x12,0x43,0x15,0xe0,0x90,0x91,0x17,0xf0,0x90,0x91,0x9c,0xe0,
+0x75,0xf0,0x04,0x90,0x01,0xd3,0x12,0x43,0x15,0xe0,0x90,0x91,0x18,0xf0,0x80,0x33,
+0xe0,0x75,0xf0,0x04,0x90,0x01,0xd1,0x12,0x43,0x15,0xe0,0x90,0x91,0x14,0xf0,0x90,
+0x91,0x9c,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd2,0x12,0x43,0x15,0xe0,0x90,0x91,0x15,
+0xf0,0x90,0x91,0x9c,0xe0,0x75,0xf0,0x04,0x90,0x01,0xd3,0x12,0x43,0x15,0xe0,0x90,
+0x91,0x16,0xf0,0xef,0x54,0x7f,0xff,0x7b,0x01,0x7a,0x91,0x79,0x14,0x12,0x52,0x08,
+0x90,0x91,0x11,0xe0,0xff,0x90,0x91,0x9c,0xe0,0xfe,0x74,0x01,0xa8,0x06,0x08,0x80,
+0x02,0xc3,0x33,0xd8,0xfc,0xf4,0x5f,0x90,0x91,0x11,0xf0,0x90,0x91,0x9c,0xe0,0xff,
+0x74,0x01,0xa8,0x07,0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0x90,0x01,0xcc,0xf0,0x90,
+0x91,0x9c,0xe0,0x04,0xf0,0xe0,0x54,0x03,0xf0,0xc1,0xaa,0x90,0x01,0xc6,0xe0,0x44,
+0x02,0xf0,0x22,0xad,0x07,0x74,0x11,0x2d,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,
+0x44,0x01,0xf0,0x90,0x04,0x80,0xe0,0x54,0x0f,0xfc,0x74,0x14,0x2d,0xf5,0x82,0xe4,
+0x34,0xfc,0xf5,0x83,0xe0,0x54,0xc0,0x4c,0xfd,0x74,0x14,0x2f,0xf5,0x82,0xe4,0x34,
+0xfc,0xf5,0x83,0xed,0xf0,0x22,0xef,0x60,0x0f,0x74,0x21,0x2d,0xf5,0x82,0xe4,0x34,
+0xfc,0xf5,0x83,0xe0,0x44,0x10,0xf0,0x22,0x74,0x21,0x2d,0xf5,0x82,0xe4,0x34,0xfc,
+0xf5,0x83,0xe0,0x54,0xef,0xf0,0x22,0xe4,0xf5,0x6d,0xf5,0x71,0xf5,0x70,0x75,0x6f,
+0x0c,0x75,0x6e,0x0c,0x90,0x91,0x3b,0xf0,0x90,0x91,0x37,0xf0,0x90,0x91,0x36,0xf0,
+0x90,0x91,0x39,0x04,0xf0,0x90,0x91,0x27,0xf0,0xe4,0x90,0x91,0x3c,0xf0,0x90,0x91,
+0x29,0xf0,0x90,0x91,0x34,0x74,0x07,0xf0,0xe4,0x90,0x91,0x28,0xf0,0x90,0x91,0x32,
+0xf0,0xa3,0x74,0x03,0xf0,0x90,0x91,0x2f,0x74,0x0a,0xf0,0xa3,0x74,0x05,0xf0,0x90,
+0x91,0x2d,0x74,0x14,0xf0,0x90,0x91,0x35,0x74,0x05,0xf0,0xe4,0x90,0x91,0x2b,0xf0,
+0x90,0x91,0x25,0xf0,0x90,0x91,0x50,0xf0,0x90,0x91,0x31,0xf0,0x90,0x91,0x3a,0xf0,
+0x90,0x91,0x26,0xf0,0x90,0x91,0x38,0xf0,0x90,0x91,0x2e,0xf0,0x90,0x91,0x2c,0xf0,
+0x22,0x12,0x4c,0x89,0xef,0x64,0x01,0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,
+0x30,0x90,0x91,0x37,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x22,0x90,
+0x91,0x36,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x14,0xe5,0x6f,0x54,
+0x0f,0xd3,0x94,0x04,0x40,0x08,0x90,0x01,0xb9,0x74,0x08,0xf0,0x80,0x03,0x7f,0x01,
+0x22,0x90,0x01,0xb8,0x74,0x08,0xf0,0x7f,0x00,0x22,0x12,0x4c,0x89,0xef,0x64,0x01,
+0x60,0x08,0x90,0x01,0xb9,0x74,0x01,0xf0,0x80,0x58,0xe5,0x71,0x54,0x03,0x60,0x08,
+0x90,0x01,0xb9,0x74,0x02,0xf0,0x80,0x4a,0xe5,0x6f,0x54,0x0f,0xd3,0x94,0x02,0x40,
+0x08,0x90,0x01,0xb9,0x74,0x04,0xf0,0x80,0x39,0xe5,0x71,0x30,0xe2,0x08,0x90,0x01,
+0xb9,0x74,0x08,0xf0,0x80,0x2c,0xe5,0x71,0x30,0xe4,0x08,0x90,0x01,0xb9,0x74,0x10,
+0xf0,0x80,0x1f,0x90,0x91,0x29,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,0x20,0xf0,0x80,
+0x11,0x90,0x91,0x31,0xe0,0x60,0x08,0x90,0x01,0xb9,0x74,0x80,0xf0,0x80,0x03,0x7f,
+0x01,0x22,0x90,0x01,0xb8,0x74,0x04,0xf0,0x7f,0x00,0x22,0x90,0x06,0x04,0xe0,0x54,
+0xbf,0xf0,0xef,0x60,0x0a,0xe5,0x6d,0xb4,0x01,0x05,0xe4,0xff,0x12,0x47,0xc9,0x53,
+0x6e,0xf0,0x43,0x6e,0x0c,0x22,0x90,0x91,0x9d,0xef,0xf0,0x31,0x9f,0x90,0x91,0x9d,
+0xe0,0x60,0x05,0x90,0x05,0x22,0xe4,0xf0,0x53,0x6e,0xf0,0x43,0x6e,0x04,0x22,0x90,
+0x90,0xd8,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x78,0x7e,0x08,0x12,
+0x2f,0xd9,0x90,0x90,0xdc,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,
+0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x90,0xe0,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x00,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0xe4,0x12,0x43,0x09,0x90,0x80,
+0x85,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x59,0x12,0x2a,
+0x8b,0x00,0x03,0x2d,0x95,0xe4,0xfd,0xff,0x12,0x34,0x81,0x90,0x91,0x51,0xe0,0xb4,
+0x01,0x11,0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,0x03,0x2d,0x95,0xe4,0xfd,0x7f,0x01,
+0x12,0x34,0x81,0x22,0x8f,0x77,0xe4,0x90,0x91,0x96,0xf0,0xa3,0xf0,0x90,0x01,0x09,
+0xe0,0x7f,0x00,0x30,0xe7,0x02,0x7f,0x01,0xef,0x65,0x77,0x60,0x3e,0xc3,0x90,0x91,
+0x97,0xe0,0x94,0x88,0x90,0x91,0x96,0xe0,0x94,0x13,0x40,0x08,0x90,0x01,0xc6,0xe0,
+0x44,0x80,0xf0,0x22,0x90,0x91,0x96,0xe4,0x75,0xf0,0x01,0x12,0x42,0x81,0x7f,0x14,
+0x7e,0x00,0x12,0x37,0x54,0xd3,0x90,0x91,0x97,0xe0,0x94,0x32,0x90,0x91,0x96,0xe0,
+0x94,0x00,0x40,0xb9,0x90,0x01,0xc7,0xe0,0x30,0xe0,0xb2,0x22,0x53,0x6e,0xf0,0x43,
+0x6e,0x01,0x12,0x45,0x00,0x12,0x45,0x01,0x53,0x6e,0xf0,0x43,0x6e,0x02,0x22,0x8f,
+0x78,0x12,0x47,0xe6,0xef,0x64,0x01,0x70,0x2e,0x90,0x91,0x44,0x12,0x48,0x1e,0xe5,
+0x78,0x60,0x10,0x74,0x21,0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x44,0x10,
+0xf0,0x80,0x0e,0x74,0x21,0x2f,0xf5,0x82,0xe4,0x34,0xfc,0xf5,0x83,0xe0,0x54,0xef,
+0xf0,0x90,0x04,0x1f,0x74,0x20,0xf0,0x22,0xe5,0x6d,0x64,0x01,0x70,0x63,0xe5,0x70,
+0x60,0x5f,0xe5,0x70,0x64,0x02,0x60,0x06,0xe5,0x70,0x64,0x05,0x70,0x27,0x90,0x06,
+0xab,0xe0,0x90,0x91,0x27,0xf0,0x90,0x06,0xaa,0xe0,0x90,0x91,0x39,0xf0,0x90,0x91,
+0x27,0xe0,0x70,0x07,0x90,0x91,0x39,0xe0,0xff,0x80,0x05,0x90,0x91,0x27,0xe0,0xff,
+0x90,0x91,0x27,0xef,0xf0,0x90,0x91,0x29,0xe0,0x60,0x03,0xe0,0x14,0xf0,0xe4,0x90,
+0x91,0x28,0xf0,0x90,0x01,0x57,0xf0,0x90,0x01,0x3c,0x74,0x02,0xf0,0x53,0x71,0xfd,
+0x53,0x71,0xef,0xe5,0x70,0x14,0x24,0xfd,0x50,0x02,0x80,0x03,0x12,0x45,0xc7,0x71,
+0x22,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0xd0,0xd0,0x92,0xaf,0x22,0xe4,0xfb,
+0x90,0x91,0x78,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,0x70,0x70,0x02,0x61,0xc0,
+0xe5,0x6d,0x64,0x01,0x70,0x7a,0xe5,0x70,0x14,0x60,0x2b,0x24,0xfd,0x60,0x27,0x24,
+0x02,0x24,0xfb,0x50,0x02,0x80,0x21,0x90,0x91,0x27,0xe0,0x14,0xf0,0xe0,0x60,0x04,
+0xa3,0xe0,0x60,0x14,0x90,0x91,0x27,0xe0,0x70,0x08,0x90,0x91,0x39,0xe0,0x90,0x91,
+0x27,0xf0,0x7b,0x01,0x80,0x02,0x7b,0x01,0xeb,0x60,0x45,0x43,0x71,0x10,0xe4,0x90,
+0x91,0x66,0xf0,0x90,0x91,0x3a,0xe0,0x75,0xf0,0x05,0xa4,0xff,0x90,0x91,0x34,0xe0,
+0x2f,0x12,0x44,0x4e,0x90,0x01,0x57,0x74,0x05,0xf0,0xe5,0x6e,0x54,0x0f,0xc3,0x94,
+0x04,0x50,0x07,0x7d,0x01,0x7f,0x04,0x12,0x47,0x27,0x90,0x91,0x2e,0xe0,0x60,0x10,
+0x90,0x91,0x2c,0xe0,0x90,0x07,0x78,0x60,0x04,0x74,0x0d,0xf0,0x22,0x74,0x09,0xf0,
+0x22,0xe4,0xfb,0x90,0x91,0x7c,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,0x70,0x60,
+0x5f,0xe5,0x6d,0x64,0x01,0x70,0x59,0x0b,0x90,0x91,0x27,0xf0,0x04,0x60,0x51,0x43,
+0x71,0x10,0xe4,0x90,0x91,0x66,0xf0,0x90,0x91,0x3a,0xe0,0x75,0xf0,0x05,0xa4,0xff,
+0x90,0x91,0x34,0xe0,0x2f,0x90,0x91,0x67,0xf0,0xe4,0x1b,0x12,0x44,0x54,0x90,0x01,
+0x57,0x74,0x05,0xf0,0xe5,0x6e,0x54,0x0f,0xc3,0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,
+0x04,0x12,0x47,0x27,0x90,0x91,0x2e,0xe0,0x60,0x11,0x90,0x91,0x2c,0xe0,0x90,0x07,
+0x78,0x60,0x05,0x74,0x0d,0xf0,0x80,0x03,0x74,0x09,0xf0,0x90,0x05,0x22,0xe4,0xf0,
+0x22,0x90,0x91,0x80,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe5,0x70,0x14,0x24,0xfd,
+0x50,0x02,0x80,0x21,0x90,0x91,0x3b,0xe0,0x60,0x06,0x7d,0x01,0x7f,0x0c,0x80,0x0d,
+0xe5,0x6e,0x54,0x0f,0xc3,0x94,0x04,0x50,0x07,0x7d,0x01,0x7f,0x04,0x12,0x47,0x27,
+0xe4,0xff,0x12,0x48,0xb3,0x22,0x90,0x91,0x08,0xe0,0x54,0xf0,0x44,0x03,0xf0,0x54,
+0x0f,0x44,0x80,0xf0,0x7b,0x00,0x7a,0x00,0x79,0x58,0x90,0x91,0x71,0x12,0x43,0x41,
+0x0b,0x7a,0x91,0x79,0x08,0x02,0x46,0xb7,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,0x90,
+0x91,0x84,0xee,0xf0,0xa3,0xef,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0x90,0x91,0x84,0xe0,
+0xfe,0xa3,0xe0,0xf5,0x82,0x8e,0x83,0xe0,0x60,0x2d,0xc3,0x90,0x91,0x87,0xe0,0x94,
+0xe8,0x90,0x91,0x86,0xe0,0x94,0x03,0x40,0x0b,0x90,0x01,0xc6,0xe0,0x44,0x10,0xf0,
+0x7f,0x00,0x80,0x15,0x90,0x91,0x86,0xe4,0x75,0xf0,0x01,0x12,0x42,0x81,0x7f,0x0a,
+0x7e,0x00,0x12,0x37,0x54,0x80,0xc5,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,0xd3,0x10,
+0xaf,0x01,0xc3,0xc0,0xd0,0x90,0x91,0x1c,0x12,0x43,0x41,0x90,0x91,0x1f,0x12,0x2a,
+0x8b,0x00,0x00,0x00,0x00,0x90,0x91,0x1c,0x12,0x43,0x21,0x90,0x00,0x01,0x12,0x42,
+0x20,0x90,0x91,0x3b,0xf0,0x90,0x00,0x03,0x12,0x42,0x20,0x90,0x91,0x25,0xf0,0x90,
+0x00,0x04,0x12,0x42,0x20,0xff,0x54,0x01,0x90,0x91,0x26,0xf0,0xef,0xc3,0x13,0x54,
+0x01,0x90,0x91,0x2e,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0xff,0x13,0x13,0x54,0x01,
+0x90,0x91,0x2c,0xf0,0x90,0x91,0x2e,0xe0,0x90,0x91,0x1f,0x70,0x26,0x12,0x2a,0x8b,
+0x00,0x00,0x02,0x10,0x90,0x91,0x1f,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0x60,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x91,0x1f,0x12,0x2a,0x8b,0x00,0x00,0x03,
+0x10,0x80,0x24,0x12,0x2a,0x8b,0x00,0x00,0x01,0x10,0x90,0x91,0x1f,0x12,0x43,0x09,
+0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x60,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x91,0x1f,
+0x12,0x2a,0x8b,0x00,0x00,0x03,0x00,0x90,0x91,0x1f,0x12,0x43,0x09,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x91,0x26,0xe0,0x70,0x3d,
+0x90,0x91,0x38,0x74,0x01,0xf0,0x7f,0x00,0x7e,0x08,0x12,0x27,0xde,0x90,0x91,0x1f,
+0x12,0x2a,0x7f,0x90,0x91,0x1f,0x12,0x43,0x09,0xec,0x44,0x02,0xfc,0x90,0x91,0x1f,
+0x12,0x2a,0x7f,0x90,0x91,0x1f,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x00,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x02,0x86,0xe0,0x54,0xfb,0xf0,0x90,0x91,0x1c,
+0x12,0x43,0x21,0x12,0x49,0x80,0x90,0x01,0xe5,0xe5,0x70,0xf0,0x90,0x91,0x3b,0xe0,
+0x90,0x01,0xe6,0xf0,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x00,0x02,0x12,0x42,0x20,0xff,
+0x30,0xe0,0x25,0x12,0x29,0xd9,0x90,0x91,0x2f,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,
+0x90,0x91,0x30,0xf0,0xef,0xc3,0x13,0x54,0x7f,0x90,0x91,0x2d,0xf0,0x90,0x00,0x03,
+0x12,0x42,0x20,0x90,0x91,0x35,0xf0,0x22,0x90,0x91,0x2f,0x74,0x0a,0xf0,0x90,0x91,
+0x30,0x74,0x05,0xf0,0x90,0x91,0x2d,0x74,0x14,0xf0,0x90,0x91,0x35,0x74,0x05,0xf0,
+0x22,0x90,0x02,0x09,0xe0,0xfd,0x12,0x29,0xd9,0xfe,0xaf,0x05,0xed,0x2e,0x90,0x91,
+0x41,0xf0,0x90,0x00,0x01,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x91,0x42,0xf0,0x90,
+0x00,0x02,0x12,0x42,0x20,0xff,0xed,0x2f,0x90,0x91,0x43,0xf0,0x90,0x00,0x03,0x12,
+0x42,0x20,0xff,0xed,0x2f,0x90,0x91,0x44,0xf0,0x90,0x00,0x04,0x12,0x42,0x20,0xff,
+0xae,0x05,0xed,0x2f,0x90,0x91,0x45,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x90,0x91,0x47,0xe0,0x90,0x91,0x1d,0xf0,0x90,0x91,0x48,0xe0,0xf5,0x19,0xa3,0xe0,
+0xf5,0x1a,0xe4,0xf5,0x16,0x74,0x4a,0x25,0x16,0xf5,0x82,0xe4,0x34,0x91,0xf5,0x83,
+0xe0,0xff,0x74,0x1b,0x25,0x16,0xf8,0xa6,0x07,0x05,0x16,0xe5,0x16,0xb4,0x04,0xe5,
+0x90,0x91,0x1d,0xe0,0x12,0x43,0x4a,0x66,0xe6,0x00,0x68,0x13,0x01,0x66,0xee,0x02,
+0x66,0xee,0x03,0x66,0xee,0x04,0x68,0x13,0x05,0x67,0xe3,0x80,0x67,0xf9,0x81,0x68,
+0x13,0x82,0x00,0x00,0x68,0x0f,0xaf,0x1e,0x12,0x73,0xdd,0x02,0x68,0x13,0x90,0x91,
+0x1d,0xe0,0xff,0xb4,0x02,0x08,0x90,0x91,0x1c,0x74,0x01,0xf0,0x80,0x0f,0xef,0x90,
+0x91,0x1c,0xb4,0x03,0x05,0x74,0x02,0xf0,0x80,0x03,0x74,0x04,0xf0,0xc3,0xe5,0x19,
+0x94,0x08,0x50,0x4a,0xe4,0xf5,0x16,0x90,0x91,0x1c,0xe0,0xff,0xe5,0x16,0xc3,0x9f,
+0x40,0x03,0x02,0x68,0x13,0xc3,0xe5,0x19,0x94,0x01,0x50,0x14,0xe5,0x16,0x25,0x1a,
+0xff,0xc3,0x74,0x03,0x95,0x16,0x24,0x1b,0xf8,0xe6,0xfd,0x12,0x4d,0xa8,0x80,0x1a,
+0xc3,0x74,0x03,0x95,0x16,0x24,0x1b,0xf8,0xe6,0xff,0xe5,0x16,0x7c,0x00,0x25,0x1a,
+0xfd,0xec,0x35,0x19,0x8d,0x82,0xf5,0x83,0xef,0xf0,0x05,0x16,0x80,0xb9,0xc3,0xe5,
+0x19,0x94,0x10,0x40,0x03,0x02,0x68,0x13,0x90,0x91,0x1d,0xe0,0x64,0x04,0x60,0x03,
+0x02,0x68,0x13,0xaf,0x1c,0xfc,0xfd,0xfe,0x78,0x10,0x12,0x2a,0x6c,0xc0,0x04,0xc0,
+0x05,0xc0,0x06,0xc0,0x07,0xaf,0x1b,0xe4,0xfc,0xfd,0xfe,0x78,0x18,0x12,0x2a,0x6c,
+0xd0,0x03,0xd0,0x02,0xd0,0x01,0xd0,0x00,0x12,0x42,0xfc,0xc0,0x04,0xc0,0x05,0xc0,
+0x06,0xc0,0x07,0xaf,0x1d,0xe4,0xfc,0xfd,0xfe,0x78,0x08,0x12,0x2a,0x6c,0xd0,0x03,
+0xd0,0x02,0xd0,0x01,0xd0,0x00,0x12,0x42,0xfc,0xa8,0x04,0xa9,0x05,0xaa,0x06,0xab,
+0x07,0xaf,0x1e,0xe4,0xfc,0xfd,0xfe,0x12,0x42,0xfc,0xa3,0x12,0x2a,0x7f,0x90,0x91,
+0x1e,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0xaf,0x1a,0xae,0x19,0x12,0x2f,
+0xd9,0x80,0x30,0xe5,0x1d,0x7f,0x00,0xfe,0xef,0x25,0x1e,0xf5,0x18,0xe4,0x3e,0xf5,
+0x17,0xaf,0x18,0xfe,0x12,0x37,0x54,0x80,0x1a,0xe5,0x1d,0x7f,0x00,0xfe,0xef,0x25,
+0x1e,0xf5,0x18,0xe4,0x3e,0xf5,0x17,0xaf,0x18,0xfe,0x12,0x36,0xcb,0x80,0x04,0x7f,
+0x00,0x80,0x02,0x7f,0x01,0xd0,0xd0,0x92,0xaf,0x22,0x8e,0x0e,0x8f,0x0f,0x8b,0x10,
+0x8a,0x11,0x89,0x12,0xe4,0x90,0x91,0x11,0xf0,0xef,0x90,0x00,0x31,0xf0,0x12,0x4c,
+0xa0,0xe5,0x0e,0x54,0x03,0xff,0x90,0x00,0x32,0xe0,0x54,0xfc,0x4f,0xf0,0x12,0x4c,
+0xa0,0x90,0x00,0x33,0xe0,0x54,0x7f,0xf0,0x12,0x4c,0xa0,0x90,0x00,0x33,0xe0,0x20,
+0xe7,0x0e,0x90,0x91,0x11,0xe0,0xc3,0x94,0x64,0x50,0x05,0xe0,0x04,0xf0,0x80,0xeb,
+0x90,0x91,0x11,0xe0,0xc3,0x94,0x64,0x50,0x10,0x90,0x00,0x30,0xe0,0xab,0x10,0xaa,
+0x11,0xa9,0x12,0x12,0x42,0x4d,0x7f,0x01,0x22,0x7f,0x00,0x22,0xe4,0x90,0x91,0x98,
+0xf0,0xa3,0xf0,0x90,0x05,0xf8,0xe0,0x70,0x0f,0xa3,0xe0,0x70,0x0b,0xa3,0xe0,0x70,
+0x07,0xa3,0xe0,0x70,0x03,0x7f,0x01,0x22,0xd3,0x90,0x91,0x99,0xe0,0x94,0xe8,0x90,
+0x91,0x98,0xe0,0x94,0x03,0x40,0x03,0x7f,0x00,0x22,0x7f,0x32,0x7e,0x00,0x12,0x37,
+0x54,0x90,0x91,0x98,0xe4,0x75,0xf0,0x01,0x12,0x42,0x81,0x80,0xc6,0x7f,0x78,0x7e,
+0x08,0x12,0x27,0xde,0x90,0x90,0xd8,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x27,
+0xde,0x90,0x90,0xdc,0x12,0x2a,0x7f,0x7f,0x00,0x7e,0x08,0x12,0x27,0xde,0x90,0x90,
+0xe0,0x12,0x2a,0x7f,0x90,0x91,0x51,0xe0,0x90,0x90,0xd8,0xb4,0x01,0x0d,0x12,0x43,
+0x09,0xef,0x54,0xc7,0xff,0xed,0x54,0xc7,0xfd,0x80,0x07,0x12,0x43,0x09,0xef,0x54,
+0xc7,0xff,0xec,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x78,0x7e,0x08,0x12,0x2f,0xd9,
+0x90,0x90,0xdc,0x12,0x43,0x09,0xef,0x54,0x0f,0xff,0xec,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x90,0xe0,0x12,0x43,0x09,0xef,0x44,
+0x02,0xff,0xec,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x00,0x7e,0x08,0x12,0x2f,0xd9,
+0x7f,0x70,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xe4,0x12,0x2a,0x7f,0x90,0x80,0x85,
+0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa0,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,
+0x59,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe4,0xfd,0xff,0x12,0x34,0x81,0x90,0x91,
+0x51,0xe0,0xb4,0x01,0x11,0x90,0x80,0x59,0x12,0x2a,0x8b,0x00,0x00,0x00,0x00,0xe4,
+0xfd,0x7f,0x01,0x12,0x34,0x81,0x22,0xef,0x70,0x02,0x61,0x3d,0x90,0x90,0xe8,0xe0,
+0x60,0x02,0xe1,0x08,0x90,0x90,0xd4,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0x8c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0x80,0x12,0x43,0x09,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0x7f,0x44,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0x84,0x12,0x43,0x09,
+0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x5c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0x88,
+0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x6c,0x7e,0x0e,0x12,0x2f,0xd9,
+0x90,0x90,0x8c,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,
+0x12,0x2f,0xd9,0x90,0x90,0x90,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x74,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0x94,0x12,0x43,0x09,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x78,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0x98,0x12,0x43,0x09,0x90,
+0x80,0x85,0x12,0x2a,0x7f,0x7f,0x7c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0x9c,0x12,
+0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x80,0x7e,0x0e,0x12,0x2f,0xd9,0x90,
+0x90,0xa0,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x84,0x7e,0x0e,0x12,
+0x2f,0xd9,0x90,0x90,0xa4,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x88,
+0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xa8,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,
+0x7f,0x7f,0x8c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xac,0x12,0x43,0x09,0x90,0x80,
+0x85,0x12,0x2a,0x7f,0x7f,0xd0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xb0,0x12,0x43,
+0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xd4,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,
+0xb4,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xd8,0x7e,0x0e,0x12,0x2f,
+0xd9,0x90,0x90,0xb8,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0xdc,0x7e,
+0x0e,0x12,0x2f,0xd9,0x90,0x90,0xbc,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0xe0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xc0,0x12,0x43,0x09,0x90,0x80,0x85,
+0x12,0x2a,0x7f,0x7f,0xec,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x90,0xc4,0x12,0x43,0x09,
+0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x90,0x90,0xc8,
+0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x0d,0x12,0x2f,0xd9,
+0x90,0x90,0xcc,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,
+0x12,0x2f,0xd9,0x90,0x90,0xd0,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x04,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x90,0xe8,0x74,0x01,0xf0,0x22,0x90,0x90,0xe8,
+0xe0,0x64,0x01,0x60,0x02,0xe1,0x08,0x7f,0x8c,0x7e,0x08,0x12,0x27,0xde,0x90,0x90,
+0xd4,0x12,0x2a,0x7f,0x7f,0x44,0x7e,0x08,0x12,0x27,0xde,0x90,0x90,0x80,0x12,0x2a,
+0x7f,0x7f,0x5c,0x7e,0x08,0x12,0x27,0xde,0x90,0x90,0x84,0x12,0x2a,0x7f,0x7f,0x6c,
+0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0x88,0x12,0x2a,0x7f,0x7f,0x70,0x7e,0x0e,0x12,
+0x27,0xde,0x90,0x90,0x8c,0x12,0x2a,0x7f,0x7f,0x74,0x7e,0x0e,0x12,0x27,0xde,0x90,
+0x90,0x90,0x12,0x2a,0x7f,0x7f,0x78,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0x94,0x12,
+0x2a,0x7f,0x7f,0x7c,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0x98,0x12,0x2a,0x7f,0x7f,
+0x80,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0x9c,0x12,0x2a,0x7f,0x7f,0x84,0x7e,0x0e,
+0x12,0x27,0xde,0x90,0x90,0xa0,0x12,0x2a,0x7f,0x7f,0x88,0x7e,0x0e,0x12,0x27,0xde,
+0x90,0x90,0xa4,0x12,0x2a,0x7f,0x7f,0x8c,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xa8,
+0x12,0x2a,0x7f,0x7f,0xd0,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xac,0x12,0x2a,0x7f,
+0x7f,0xd4,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xb0,0x12,0x2a,0x7f,0x7f,0xd8,0x7e,
+0x0e,0x12,0x27,0xde,0x90,0x90,0xb4,0x12,0x2a,0x7f,0x7f,0xdc,0x7e,0x0e,0x12,0x27,
+0xde,0x90,0x90,0xb8,0x12,0x2a,0x7f,0x7f,0xe0,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,
+0xbc,0x12,0x2a,0x7f,0x7f,0xec,0x7e,0x0e,0x12,0x27,0xde,0x90,0x90,0xc0,0x12,0x2a,
+0x7f,0x7f,0x04,0x7e,0x0c,0x12,0x27,0xde,0x90,0x90,0xc4,0x12,0x2a,0x7f,0x7f,0x04,
+0x7e,0x0d,0x12,0x27,0xde,0x90,0x90,0xc8,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,
+0x27,0xde,0x90,0x90,0xcc,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x08,0x12,0x27,0xde,0x90,
+0x90,0xd0,0x12,0x2a,0x7f,0x7f,0x8c,0x7e,0x08,0x12,0x27,0xde,0x90,0x91,0x88,0x12,
+0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xed,0x44,0xc0,0xfd,0xec,0x90,0x91,0x88,
+0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,
+0x8c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x01,0x00,0x00,
+0x7f,0x44,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0xdb,0x25,
+0xa4,0x7f,0x5c,0x7e,0x08,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,
+0x25,0xa4,0x7f,0x6c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,
+0xdb,0x25,0xa4,0x7f,0x70,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,
+0x04,0x1b,0x25,0xa4,0x7f,0x74,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,
+0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x78,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,
+0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x7c,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,
+0x12,0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x80,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,
+0x85,0x12,0x2a,0x8b,0x63,0xdb,0x25,0xa4,0x7f,0x84,0x7e,0x0e,0x12,0x2f,0xd9,0x90,
+0x80,0x85,0x12,0x2a,0x8b,0x04,0x1b,0x25,0xa4,0x7f,0x88,0x7e,0x0e,0x12,0x2f,0xd9,
+0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0x8c,0x7e,0x0e,0x12,0x2f,
+0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd0,0x7e,0x0e,0x12,
+0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd4,0x7e,0x0e,
+0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x20,0xdb,0x25,0xa4,0x7f,0xd8,0x7e,
+0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa4,0x7f,0xdc,
+0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x00,0x1b,0x25,0xa4,0x7f,
+0xe0,0x7e,0x0e,0x12,0x2f,0xd9,0x90,0x80,0x85,0x12,0x2a,0x8b,0x24,0xdb,0x25,0xa4,
+0x7f,0xec,0x7e,0x0e,0x12,0x2f,0xd9,0x7f,0x04,0x7e,0x0c,0x12,0x27,0xde,0x90,0x91,
+0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xe4,0xff,0xec,0x90,0x91,0x88,
+0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x11,0xff,0xec,0x90,0x91,
+0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,
+0x7f,0x04,0x7e,0x0c,0x12,0x2f,0xd9,0x7f,0x04,0x7e,0x0d,0x12,0x27,0xde,0x90,0x91,
+0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x54,0xf0,0xff,0xec,0x90,
+0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x01,0xff,0xec,
+0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x04,0x7e,0x0d,0x12,0x2f,0xd9,0x7f,0x0c,0x7e,0x09,0x12,0x27,0xde,
+0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xe4,0xff,0xec,0x90,
+0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x11,0xff,0xec,
+0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,
+0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,0x2f,0xd9,0x7f,0x0c,0x7e,0x09,0x12,0x27,0xde,
+0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,0xed,0x54,0x0f,0xfd,
+0xec,0x54,0xf0,0xfc,0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,0x88,0x12,0x43,0x09,
+0xed,0x44,0x10,0xfd,0xec,0x44,0x01,0xfc,0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,
+0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x0c,0x7e,0x09,0x12,0x2f,
+0xd9,0x7f,0x04,0x7e,0x08,0x12,0x27,0xde,0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,0x91,
+0x88,0x12,0x43,0x09,0xef,0x54,0xf0,0xff,0xec,0x90,0x91,0x88,0x12,0x2a,0x7f,0x90,
+0x91,0x88,0x12,0x43,0x09,0xef,0x44,0x01,0xff,0xec,0x90,0x91,0x88,0x12,0x2a,0x7f,
+0x90,0x91,0x88,0x12,0x43,0x09,0x90,0x80,0x85,0x12,0x2a,0x7f,0x7f,0x04,0x7e,0x08,
+0x12,0x2f,0xd9,0xe4,0x90,0x90,0xe8,0xf0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,0xd0,
+0x90,0x91,0xa0,0xef,0xf0,0xd3,0x94,0x07,0x50,0x47,0xe0,0xff,0x74,0x01,0xa8,0x07,
+0x08,0x80,0x02,0xc3,0x33,0xd8,0xfc,0xf4,0xff,0x90,0x00,0x46,0xe0,0x5f,0xf0,0x12,
+0x4c,0xa0,0x90,0x91,0xa0,0xe0,0xfd,0x74,0x01,0x7e,0x00,0xa8,0x05,0x08,0x80,0x05,
+0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,0x44,0xe0,0xfb,0xe4,0xfe,0xef,
+0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,0xce,0x13,0xd8,0xf8,0xff,0x80,
+0x44,0x90,0x91,0xa0,0xe0,0x24,0xf8,0xf0,0xe0,0xff,0x74,0x01,0xa8,0x07,0x08,0x80,
+0x02,0xc3,0x33,0xd8,0xfc,0x12,0x4c,0x98,0x90,0x91,0xa0,0xe0,0xfd,0x74,0x01,0x7e,
+0x00,0xa8,0x05,0x08,0x80,0x05,0xc3,0x33,0xce,0x33,0xce,0xd8,0xf9,0xff,0x90,0x00,
+0x42,0xe0,0xfb,0xe4,0xfe,0xef,0x5b,0xa8,0x05,0x08,0x80,0x06,0xce,0xa2,0xe7,0x13,
+0xce,0x13,0xd8,0xf8,0xff,0xd0,0xd0,0x92,0xaf,0x22,0xe4,0xfd,0x7f,0x45,0x12,0x4d,
+0xa8,0x90,0x04,0xfd,0xe4,0xf0,0xa3,0xf0,0x90,0x90,0xf7,0xf0,0x90,0x90,0xfd,0xf0,
+0x90,0x91,0x00,0xf0,0x90,0x90,0xfe,0xf0,0x90,0x91,0x01,0xf0,0x90,0x90,0xff,0xf0,
+0x90,0x91,0x02,0xf0,0x90,0x90,0xe9,0x04,0xf0,0xe4,0xa3,0xf0,0xa3,0xf0,0xa3,0xf0,
+0x90,0x90,0xee,0xf0,0x90,0x90,0xf3,0xf0,0x90,0x90,0xf5,0xf0,0x90,0x91,0x07,0xf0,
+0x90,0x90,0xf8,0xf0,0x90,0x90,0xf4,0xf0,0x90,0x90,0xed,0xf0,0x90,0x00,0x51,0xe0,
+0x44,0xc0,0xfd,0x7f,0x51,0x02,0x4d,0xa8,0x90,0x91,0x07,0xe0,0x64,0x01,0x60,0x08,
+0x90,0x90,0xf5,0xe0,0x60,0x02,0x01,0xdf,0x90,0x90,0xe9,0xe0,0xc3,0x94,0xff,0x50,
+0x05,0xe0,0x04,0xf0,0x80,0x3b,0x90,0x90,0xea,0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,
+0x04,0xf0,0xe4,0x80,0x28,0x90,0x90,0xeb,0xe0,0xc3,0x94,0xff,0x50,0x0a,0xe0,0x04,
+0xf0,0xe4,0x90,0x90,0xea,0xf0,0x80,0x15,0x90,0x90,0xec,0xe0,0xc3,0x94,0xff,0x50,
+0x10,0xe0,0x04,0xf0,0xe4,0x90,0x90,0xeb,0xf0,0x90,0x90,0xea,0xf0,0x90,0x90,0xe9,
+0xf0,0x90,0x00,0x44,0xe0,0x54,0x0c,0x60,0x76,0xe0,0x30,0xe2,0x32,0x90,0x90,0xfd,
+0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,0x04,0xf0,0x80,0x24,0x90,0x90,0xfe,0xe0,0xc3,
+0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,0xe4,0x80,0x11,0x90,0x90,0xff,0xe0,0xc3,0x94,
+0xff,0x50,0x0c,0xe0,0x04,0xf0,0xe4,0x90,0x90,0xfe,0xf0,0x90,0x90,0xfd,0xf0,0x90,
+0x00,0x44,0xe0,0x30,0xe3,0x32,0x90,0x91,0x00,0xe0,0xc3,0x94,0xff,0x50,0x05,0xe0,
+0x04,0xf0,0x80,0x24,0x90,0x91,0x01,0xe0,0xc3,0x94,0xff,0x50,0x06,0xe0,0x04,0xf0,
+0xe4,0x80,0x11,0x90,0x91,0x02,0xe0,0xc3,0x94,0xff,0x50,0x0c,0xe0,0x04,0xf0,0xe4,
+0x90,0x91,0x01,0xf0,0x90,0x91,0x00,0xf0,0x90,0x04,0xfd,0xe0,0x44,0x01,0xf0,0x22,
+0xe5,0x6e,0x30,0xe3,0x04,0xe4,0xff,0x80,0x02,0x7f,0x01,0x02,0x47,0xc9,0x90,0x91,
+0x53,0xe0,0x30,0xe0,0x49,0xe5,0x6d,0x64,0x01,0x70,0x43,0x90,0x91,0x52,0xe0,0x04,
+0xf0,0xe5,0x70,0x64,0x03,0x60,0x05,0xe5,0x70,0xb4,0x06,0x0d,0x90,0x91,0x52,0xe0,
+0xff,0x74,0x01,0xd3,0x9f,0x50,0x14,0x80,0x07,0x90,0x91,0x52,0xe0,0xb4,0x0a,0x0b,
+0x90,0x91,0x55,0xe0,0x04,0xf0,0xe4,0x90,0x91,0x52,0xf0,0x90,0x91,0x55,0xe0,0xff,
+0x90,0x91,0x54,0xe0,0xb5,0x07,0x07,0x11,0xe0,0xe4,0x90,0x91,0x55,0xf0,0x22,0x90,
+0x06,0x90,0xe0,0x44,0x01,0xf0,0x90,0x91,0x61,0xe0,0x30,0xe0,0x3c,0x90,0x91,0x5f,
+0xe0,0xff,0x90,0x91,0x5e,0xe0,0xfe,0xc4,0x13,0x54,0x01,0xfd,0x12,0x4c,0xb0,0x90,
+0x91,0x60,0xe0,0x75,0xf0,0x20,0xa4,0xff,0xae,0xf0,0x12,0x37,0x54,0x90,0x91,0x5e,
+0xe0,0xc4,0x13,0x54,0x07,0x30,0xe0,0x07,0xa3,0xe0,0xff,0xe4,0xfd,0x80,0x07,0x90,
+0x91,0x5f,0xe0,0xff,0x7d,0x01,0x12,0x4c,0xb0,0x22,0xd3,0x10,0xaf,0x01,0xc3,0xc0,
+0xd0,0xe4,0x90,0x91,0x19,0xf0,0xa3,0x74,0x08,0xf0,0xa3,0xf0,0xe4,0xa3,0xf0,0x90,
+0x01,0x1f,0xe0,0xfe,0x90,0x01,0x1e,0xe0,0x7c,0x00,0x24,0x00,0xff,0xec,0x3e,0x90,
+0x91,0x11,0xf0,0xa3,0xef,0xf0,0x90,0x02,0x87,0xe0,0x90,0x91,0x18,0xf0,0x90,0x91,
+0x56,0xe0,0x20,0xe0,0x02,0x61,0xb7,0xe4,0x90,0x91,0x17,0xf0,0x90,0x91,0x18,0xe0,
+0xff,0x90,0x91,0x17,0xe0,0xc3,0x9f,0x40,0x02,0x61,0xb7,0x90,0x91,0x11,0xe0,0xfc,
+0xa3,0xe0,0xfd,0xec,0xff,0x90,0xfd,0x11,0xf0,0x90,0x91,0x1c,0xef,0xf0,0x74,0x02,
+0x2d,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x54,0x0f,0xfc,0x33,0x33,0x33,0x54,
+0xf8,0xff,0xed,0x24,0x18,0x2f,0x90,0x91,0x15,0xf0,0xe0,0x24,0x00,0xf5,0x82,0xe4,
+0x34,0xfb,0xf5,0x83,0xe0,0x54,0xfc,0x90,0x91,0x16,0xf0,0x74,0x01,0x2d,0xf5,0x82,
+0xe4,0x34,0xfb,0xf5,0x83,0xe0,0xfe,0x74,0x00,0x2d,0xf5,0x82,0xe4,0x34,0xfb,0xf5,
+0x83,0xe0,0x7a,0x00,0x24,0x00,0xff,0xea,0x3e,0x54,0x3f,0xab,0x07,0xfa,0x90,0x91,
+0x13,0xf0,0xa3,0xeb,0xf0,0xaf,0x04,0xef,0x75,0xf0,0x08,0xa4,0x24,0x18,0xff,0xe4,
+0x35,0xf0,0xfe,0xef,0x2b,0xfb,0xee,0x3a,0xfa,0x90,0x91,0x5a,0xe0,0xfe,0xa3,0xe0,
+0xff,0xad,0x03,0xac,0x02,0x12,0x45,0x09,0xaa,0x06,0xab,0x07,0x90,0x91,0x15,0xe0,
+0x24,0x00,0xf5,0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x30,0xe7,0x08,0x90,0x91,0x19,
+0x74,0x02,0xf0,0x80,0x05,0xe4,0x90,0x91,0x19,0xf0,0xaf,0x03,0x90,0x91,0x11,0xea,
+0x8f,0xf0,0x12,0x42,0x81,0x90,0x91,0x5c,0xe0,0xfe,0xa3,0xe0,0xff,0x90,0x91,0x11,
+0xe0,0xfc,0xa3,0xe0,0xfd,0xd3,0x9f,0xec,0x9e,0x40,0x1b,0x90,0x91,0x5d,0xe0,0x24,
+0x01,0xff,0x90,0x91,0x5c,0xe0,0x34,0x00,0xfe,0xc3,0xed,0x9f,0xff,0xec,0x9e,0x90,
+0x91,0x11,0xf0,0xa3,0xef,0xf0,0x90,0x91,0x16,0xe0,0xff,0x24,0x40,0x60,0x04,0x24,
+0x20,0x70,0x27,0x90,0x91,0x5e,0xe0,0xfe,0xc4,0x13,0x13,0x13,0x54,0x01,0x20,0xe0,
+0x02,0x61,0x8f,0xef,0x90,0x00,0x81,0xb4,0xa0,0x05,0xe0,0x44,0x04,0x80,0x03,0xe0,
+0x44,0x08,0xfd,0x7f,0x81,0x12,0x4d,0xa8,0x61,0x88,0x90,0x91,0x5e,0xe0,0xc4,0x13,
+0x13,0x54,0x03,0x20,0xe0,0x02,0x61,0x8f,0x90,0x91,0x15,0xe0,0xff,0x24,0x00,0xf5,
+0x82,0xe4,0x34,0xfb,0xf5,0x83,0xe0,0x54,0x0c,0x64,0x08,0x70,0x72,0x90,0x91,0x19,
+0xe0,0xfe,0xef,0x2e,0xff,0xa3,0xe0,0x2f,0xff,0x24,0x1e,0xf5,0x82,0xe4,0x34,0xfb,
+0xf5,0x83,0xe0,0x64,0x88,0x70,0x58,0x74,0x1f,0x2f,0xf5,0x82,0xe4,0x34,0xfb,0xf5,
+0x83,0xe0,0x64,0x8e,0x70,0x49,0x90,0x91,0x19,0xe0,0xff,0x90,0x91,0x15,0xe0,0x2f,
+0xff,0x90,0x91,0x1a,0xe0,0x2f,0xff,0xa3,0xe0,0x2f,0xff,0x24,0x19,0xf5,0x82,0xe4,
+0x34,0xfb,0xf5,0x83,0xe0,0x64,0x03,0x70,0x26,0x74,0x1e,0x2f,0xf5,0x82,0xe4,0x34,
+0xfb,0xf5,0x83,0xe0,0x90,0x00,0x81,0x30,0xe3,0x05,0xe0,0x44,0x01,0x80,0x03,0xe0,
+0x44,0x02,0xfd,0x7f,0x81,0x12,0x4d,0xa8,0x90,0x91,0x56,0xe0,0x44,0x80,0xf0,0x90,
+0x91,0x56,0xe0,0xff,0xc4,0x13,0x13,0x13,0x54,0x01,0x30,0xe0,0x02,0x31,0x3f,0x71,
+0xbc,0xbf,0x01,0x13,0x90,0x91,0x11,0xe0,0xfe,0xa3,0xe0,0xff,0x12,0x44,0xb5,0x90,
+0x91,0x17,0xe0,0x04,0xf0,0x21,0xcc,0xd0,0xd0,0x92,0xaf,0x22,0x90,0x91,0x56,0xe0,
+0xc4,0x13,0x13,0x13,0x54,0x01,0x30,0xe0,0x11,0xe0,0x44,0x80,0xf0,0x90,0x91,0x5e,
+0xe0,0xc4,0x54,0x0f,0x20,0xe0,0x03,0x7f,0x00,0x22,0x7f,0x01,0x22,0x8f,0x1f,0xe4,
+0x90,0x91,0x22,0xf0,0xe5,0x1f,0x14,0xfe,0x90,0x91,0x22,0xe0,0xff,0xc3,0x9e,0x50,
+0x0e,0xef,0x04,0xfd,0x12,0x34,0xb7,0x90,0x91,0x22,0xe0,0x04,0xf0,0x80,0xe5,0xe5,
+0x1f,0x14,0xff,0x7d,0xff,0x12,0x34,0xb7,0x90,0x91,0x22,0xe5,0x1f,0xf0,0x90,0x91,
+0x22,0xe0,0xc3,0x94,0xff,0x50,0x0f,0xe0,0xff,0x04,0xfd,0x12,0x34,0xb7,0x90,0x91,
+0x22,0xe0,0x04,0xf0,0x80,0xe8,0xad,0x1f,0x7f,0xff,0x02,0x34,0xb7,0xc3,0xee,0x94,
+0x01,0x40,0x0a,0x0d,0xed,0x13,0x90,0xfd,0x10,0xf0,0xe4,0x2f,0xff,0x22,0xc3,0xee,
+0x94,0x01,0x40,0x1e,0x90,0xfd,0x11,0xe0,0xb5,0x05,0x14,0x90,0x01,0x17,0xe0,0xb5,
+0x05,0x07,0x90,0xfd,0x11,0xe4,0xf0,0x80,0x06,0xed,0x04,0x90,0xfd,0x11,0xf0,0xe4,
+0x2f,0xff,0x22,0x00,0x18,0x58,};
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_led.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_led.c
new file mode 100644
index 000000000000..382b9782c2f1
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_led.c
@@ -0,0 +1,2674 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#include "drv_types.h"
+#include "rtl8192c_hal.h"
+
+//================================================================================
+//	Constant.
+//================================================================================
+
+//
+// Default LED behavior.
+//
+#define LED_BLINK_NORMAL_INTERVAL	100
+#define LED_BLINK_SLOWLY_INTERVAL	200
+#define LED_BLINK_LONG_INTERVAL	400
+
+#define LED_BLINK_NO_LINK_INTERVAL_ALPHA		1000
+#define LED_BLINK_LINK_INTERVAL_ALPHA			500		//500
+#define LED_BLINK_SCAN_INTERVAL_ALPHA		180 	//150
+#define LED_BLINK_FASTER_INTERVAL_ALPHA		50
+#define LED_BLINK_WPS_SUCESS_INTERVAL_ALPHA	5000
+
+//================================================================================
+// LED object.
+//================================================================================
+
+
+//================================================================================
+//	Prototype of protected function.
+//================================================================================
+
+
+static void
+BlinkTimerCallback(
+	unsigned long data
+	);
+
+static void
+BlinkWorkItemCallback(
+	struct work_struct *work
+	);
+
+//
+//	Description:
+//		Reset blinking status of LED_871x object.
+//
+static void
+ResetLedStatus(PLED_871x	pLed) {
+	pLed->CurrLedState = RTW_LED_OFF; // Current LED state.
+	pLed->bLedOn = _FALSE; // true if LED is ON, false if LED is OFF.
+
+	pLed->bLedBlinkInProgress = _FALSE; // true if it is blinking, false o.w..
+	pLed->bLedNoLinkBlinkInProgress = _FALSE;
+	pLed->bLedLinkBlinkInProgress = _FALSE;
+	pLed->bLedStartToLinkBlinkInProgress = _FALSE;
+	pLed->bLedScanBlinkInProgress = _FALSE;
+	pLed->bLedWPSBlinkInProgress = _FALSE;
+	pLed->BlinkTimes = 0; // Number of times to toggle led state for blinking.
+	pLed->BlinkingLedState = LED_UNKNOWN; // Next state for blinking, either RTW_LED_ON or RTW_LED_OFF are.
+}
+
+//================================================================================
+// LED_819xUsb routines.
+//================================================================================
+
+//
+//	Description:
+//		Initialize an LED_871x object.
+//
+static void
+InitLed871x(
+	_adapter			*padapter,
+	PLED_871x		pLed,
+	LED_PIN_871x	LedPin
+	)
+{
+	pLed->padapter = padapter;
+	pLed->LedPin = LedPin;
+
+	ResetLedStatus(pLed);
+
+	_init_timer(&(pLed->BlinkTimer), padapter->pnetdev, BlinkTimerCallback, pLed);
+	_init_workitem(&(pLed->BlinkWorkItem), BlinkWorkItemCallback, pLed);
+}
+
+
+//
+//	Description:
+//		DeInitialize an LED_871x object.
+//
+static void
+DeInitLed871x(
+	PLED_871x			pLed
+	)
+{
+	//call _cancel_workitem_sync(&(pLed->BlinkWorkItem))
+    //before _cancel_timer_ex(&(pLed->BlinkTimer)) to
+    //avoid led timer restarting when driver is removed
+
+	_cancel_workitem_sync(&(pLed->BlinkWorkItem));
+
+	_cancel_timer_ex(&(pLed->BlinkTimer));
+
+	// We should reset bLedBlinkInProgress if we cancel the LedControlTimer, 2005.03.10, by rcnjko.
+	ResetLedStatus(pLed);
+}
+
+//
+//	Description:
+//		Turn on LED according to LedPin specified.
+//
+static void
+SwLedOn(
+	_adapter			*padapter,
+	PLED_871x		pLed
+)
+{
+	u8	LedCfg;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+
+	if( (padapter->bSurpriseRemoved == _TRUE) || ( padapter->bDriverStopped == _TRUE))
+	{
+		return;
+	}
+
+	if( 	(BOARD_MINICARD == pHalData->BoardType )||
+		(BOARD_USB_SOLO == pHalData->BoardType)||
+		(BOARD_USB_COMBO == pHalData->BoardType))
+	{
+		LedCfg = rtw_read8(padapter, REG_LEDCFG2);
+		switch(pLed->LedPin)
+		{
+			case LED_PIN_GPIO0:
+				break;
+
+			case LED_PIN_LED0:
+				rtw_write8(padapter, REG_LEDCFG2, (LedCfg&0xf0)|BIT5|BIT6); // SW control led0 on.
+				break;
+
+			case LED_PIN_LED1:
+				rtw_write8(padapter, REG_LEDCFG2, (LedCfg&0x0f)|BIT5); // SW control led1 on.
+				break;
+
+			default:
+				break;
+
+		}
+	}
+	else
+	{
+		switch(pLed->LedPin)
+		{
+			case LED_PIN_GPIO0:
+				break;
+
+			case LED_PIN_LED0:
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+				if(pHalData->AntDivCfg)
+				{
+					LedCfg = rtw_read8(padapter, REG_LEDCFG2);
+					rtw_write8(padapter, REG_LEDCFG2, (LedCfg&0xe0)|BIT7|BIT6|BIT5); // SW control led0 on.
+					//RT_TRACE(COMP_LED, DBG_LOUD, ("SwLedOn LED0 0x%x\n", PlatformEFIORead4Byte(Adapter, REG_LEDCFG2)));
+				}
+				else
+#endif
+				{
+					LedCfg = rtw_read8(padapter, REG_LEDCFG0);
+					rtw_write8(padapter,REG_LEDCFG0, LedCfg&0x70); // SW control led0 on.
+					//RT_TRACE(COMP_LED, DBG_LOUD, ("SwLedOn LED0 0x%lx\n", PlatformEFIORead4Byte(Adapter, REG_LEDCFG0)));
+				}
+				break;
+
+			case LED_PIN_LED1:
+				LedCfg = rtw_read8(padapter,(REG_LEDCFG1));
+				rtw_write8(padapter,(REG_LEDCFG1), LedCfg&0x70); // SW control led1 on.
+				//RT_TRACE(COMP_LED, DBG_LOUD, ("SwLedOn LED1 0x%lx\n", PlatformEFIORead4Byte(Adapter, REG_LEDCFG0)));
+
+				break;
+
+			default:
+				break;
+		}
+	}
+	pLed->bLedOn = _TRUE;
+
+}
+
+
+//
+//	Description:
+//		Turn off LED according to LedPin specified.
+//
+static void
+SwLedOff(
+	_adapter			*padapter,
+	PLED_871x		pLed
+)
+{
+	u8	LedCfg;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+
+	if((padapter->bSurpriseRemoved == _TRUE) || ( padapter->bDriverStopped == _TRUE))
+	{
+		goto exit;
+	}
+
+	if( 	(BOARD_MINICARD == pHalData->BoardType )||
+		(BOARD_USB_SOLO == pHalData->BoardType)||
+		(BOARD_USB_COMBO == pHalData->BoardType))
+	{
+		LedCfg = rtw_read8(padapter, REG_LEDCFG2);//0x4E
+
+		switch(pLed->LedPin)
+		{
+
+			case LED_PIN_GPIO0:
+				break;
+
+			case LED_PIN_LED0:
+				if(BOARD_USB_COMBO == pHalData->BoardType)
+				{
+					LedCfg &= 0x90; // Set to software control.
+					rtw_write8(padapter, REG_LEDCFG2, (LedCfg|BIT3));
+					LedCfg = rtw_read8(padapter, REG_MAC_PINMUX_CFG);
+					LedCfg &= 0xFE;
+					rtw_write8(padapter, REG_MAC_PINMUX_CFG, LedCfg);
+				}
+				else
+				{
+					LedCfg &= 0xf0; // Set to software control.
+					if(pHalData->bLedOpenDrain == _TRUE) // Open-drain arrangement for controlling the LED
+						rtw_write8(padapter, REG_LEDCFG2, (LedCfg|BIT1|BIT5|BIT6));
+					else
+						rtw_write8(padapter, REG_LEDCFG2, (LedCfg|BIT3|BIT5|BIT6));
+				}
+				break;
+
+			case LED_PIN_LED1:
+				LedCfg &= 0x0f; // Set to software control.
+				rtw_write8(padapter, REG_LEDCFG2, (LedCfg|BIT3));
+				break;
+
+			default:
+				break;
+		}
+	}
+	else
+	{
+		switch(pLed->LedPin)
+		{
+			case LED_PIN_GPIO0:
+				break;
+
+			case LED_PIN_LED0:
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+				if(pHalData->AntDivCfg)
+				{
+					LedCfg = rtw_read8(padapter, REG_LEDCFG2);
+					LedCfg &= 0xe0; // Set to software control.
+					rtw_write8(padapter, REG_LEDCFG2, (LedCfg|BIT3|BIT7|BIT6|BIT5));
+					//RT_TRACE(COMP_LED, DBG_LOUD, ("SwLedOff LED0 0x%x\n", PlatformEFIORead4Byte(Adapter, REG_LEDCFG2)));
+				}
+				else
+#endif
+				{
+					LedCfg = rtw_read8(padapter, REG_LEDCFG0);
+					LedCfg &= 0x70; // Set to software control.
+					rtw_write8(padapter, REG_LEDCFG0, (LedCfg|BIT3));
+					//RT_TRACE(COMP_LED, DBG_LOUD, ("SwLedOff LED0 0x%lx\n", PlatformEFIORead4Byte(Adapter, REG_LEDCFG0)));
+				}
+				break;
+
+			case LED_PIN_LED1:
+				LedCfg = rtw_read8(padapter, (REG_LEDCFG1));
+				LedCfg &= 0x70; // Set to software control.
+				rtw_write8(padapter,  (REG_LEDCFG1), (LedCfg|BIT3));
+				//RT_TRACE(COMP_LED, DBG_LOUD, ("SwLedOff LED1 0x%lx\n", PlatformEFIORead4Byte(Adapter, REG_LEDCFG0)));
+				break;
+
+			default:
+				break;
+		}
+	}
+
+exit:
+	pLed->bLedOn = _FALSE;
+
+}
+
+//================================================================================
+// Interface to manipulate LED objects.
+//================================================================================
+
+
+//
+//	Description:
+//		Implementation of LED blinking behavior.
+//		It toggle off LED and schedule corresponding timer if necessary.
+//
+static void
+SwLedBlink(
+	PLED_871x			pLed
+	)
+{
+	_adapter			*padapter = pLed->padapter;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	u8				bStopBlinking = _FALSE;
+
+	// Change LED according to BlinkingLedState specified.
+	if( pLed->BlinkingLedState == RTW_LED_ON )
+	{
+		SwLedOn(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn on\n", pLed->BlinkTimes));
+	}
+	else
+	{
+		SwLedOff(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,( "Blinktimes (%d): turn off\n", pLed->BlinkTimes));
+	}
+
+	// Determine if we shall change LED state again.
+	pLed->BlinkTimes--;
+	switch(pLed->CurrLedState)
+	{
+
+	case LED_BLINK_NORMAL:
+		if(pLed->BlinkTimes == 0)
+		{
+			bStopBlinking = _TRUE;
+		}
+		break;
+
+	case LED_BLINK_StartToBlink:
+		if( check_fwstate(pmlmepriv, _FW_LINKED) && check_fwstate(pmlmepriv, WIFI_STATION_STATE) )
+		{
+			bStopBlinking = _TRUE;
+		}
+		if( check_fwstate(pmlmepriv, _FW_LINKED) &&
+			(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) || check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) )
+		{
+			bStopBlinking = _TRUE;
+		}
+		else if(pLed->BlinkTimes == 0)
+		{
+			bStopBlinking = _TRUE;
+		}
+		break;
+
+	case LED_BLINK_WPS:
+		if( pLed->BlinkTimes == 0 )
+		{
+			bStopBlinking = _TRUE;
+		}
+		break;
+
+
+	default:
+		bStopBlinking = _TRUE;
+		break;
+
+	}
+
+	if(bStopBlinking)
+	{
+		//if( padapter->pwrctrlpriv.cpwm >= PS_STATE_S2)
+		if(0)
+		{
+			SwLedOff(padapter, pLed);
+		}
+		else if( (check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE) && (pLed->bLedOn == _FALSE))
+		{
+			SwLedOn(padapter, pLed);
+		}
+		else if( (check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE) &&  pLed->bLedOn == _TRUE)
+		{
+			SwLedOff(padapter, pLed);
+		}
+
+		pLed->BlinkTimes = 0;
+		pLed->bLedBlinkInProgress = _FALSE;
+	}
+	else
+	{
+		// Assign LED state to toggle.
+		if( pLed->BlinkingLedState == RTW_LED_ON )
+			pLed->BlinkingLedState = RTW_LED_OFF;
+		else
+			pLed->BlinkingLedState = RTW_LED_ON;
+
+		// Schedule a timer to toggle LED state.
+		switch( pLed->CurrLedState )
+		{
+		case LED_BLINK_NORMAL:
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+			break;
+
+		case LED_BLINK_SLOWLY:
+		case LED_BLINK_StartToBlink:
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_SLOWLY_INTERVAL);
+			break;
+
+		case LED_BLINK_WPS:
+			{
+				if( pLed->BlinkingLedState == RTW_LED_ON )
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_LONG_INTERVAL);
+				else
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_LONG_INTERVAL);
+			}
+			break;
+
+		default:
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_SLOWLY_INTERVAL);
+			break;
+		}
+	}
+}
+
+
+static void
+SwLedBlink1(
+	PLED_871x			pLed
+	)
+{
+	_adapter				*padapter = pLed->padapter;
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(padapter);
+	struct led_priv		*ledpriv = &(padapter->ledpriv);
+	struct mlme_priv		*pmlmepriv = &(padapter->mlmepriv);
+	PLED_871x 			pLed1 = &(ledpriv->SwLed1);
+	u8					bStopBlinking = _FALSE;
+
+	if(pHalData->EEPROMCustomerID == RT_CID_819x_CAMEO)
+		pLed = &(ledpriv->SwLed1);
+
+	// Change LED according to BlinkingLedState specified.
+	if( pLed->BlinkingLedState == RTW_LED_ON )
+	{
+		SwLedOn(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,( "Blinktimes (%d): turn on\n", pLed->BlinkTimes));
+	}
+	else
+	{
+		SwLedOff(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn off\n", pLed->BlinkTimes));
+	}
+
+
+	if(pHalData->EEPROMCustomerID == RT_CID_DEFAULT)
+	{
+		if(check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE)
+		{
+			if(!pLed1->bSWLedCtrl)
+			{
+				SwLedOn(padapter, pLed1);
+				pLed1->bSWLedCtrl = _TRUE;
+			}
+			else if(!pLed1->bLedOn)
+				SwLedOn(padapter, pLed1);
+			RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (): turn on pLed1\n"));
+		}
+		else
+		{
+			if(!pLed1->bSWLedCtrl)
+			{
+				SwLedOff(padapter, pLed1);
+				pLed1->bSWLedCtrl = _TRUE;
+			}
+			else if(pLed1->bLedOn)
+				SwLedOff(padapter, pLed1);
+			RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (): turn off pLed1\n"));
+		}
+	}
+
+
+	if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+	{
+		SwLedOff(padapter, pLed);
+		ResetLedStatus(pLed);
+		return;
+	}
+
+
+	switch(pLed->CurrLedState)
+	{
+		case LED_BLINK_SLOWLY:
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF;
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+			break;
+
+		case LED_BLINK_NORMAL:
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF;
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_LINK_INTERVAL_ALPHA);
+			break;
+
+		case LED_SCAN_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _TRUE;
+			}
+
+			if(bStopBlinking)
+			{
+				if(check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE)
+				{
+					pLed->bLedLinkBlinkInProgress = _TRUE;
+					pLed->CurrLedState = LED_BLINK_NORMAL;
+					if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF;
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_LINK_INTERVAL_ALPHA);
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _FALSE)
+				{
+					pLed->bLedNoLinkBlinkInProgress = _TRUE;
+					pLed->CurrLedState = LED_BLINK_SLOWLY;
+					if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF;
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+				}
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}
+			else
+			{
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_TXRX_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _TRUE;
+			}
+			if(bStopBlinking)
+			{
+				if(check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE)
+				{
+					pLed->bLedLinkBlinkInProgress = _TRUE;
+					pLed->CurrLedState = LED_BLINK_NORMAL;
+					if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF;
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_LINK_INTERVAL_ALPHA);
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _FALSE)
+				{
+					pLed->bLedNoLinkBlinkInProgress = _TRUE;
+					pLed->CurrLedState = LED_BLINK_SLOWLY;
+					if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF;
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+				}
+				pLed->BlinkTimes = 0;
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			else
+			{
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_BLINK_WPS:
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF;
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			break;
+
+		case LED_BLINK_WPS_STOP:	//WPS success
+			if(pLed->BlinkingLedState == RTW_LED_ON)
+				bStopBlinking = _FALSE;
+			else
+				bStopBlinking = _TRUE;
+
+			if(bStopBlinking)
+			{
+				pLed->bLedLinkBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_BLINK_NORMAL;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_LINK_INTERVAL_ALPHA);
+				RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+
+				pLed->bLedWPSBlinkInProgress = _FALSE;
+			}
+			else
+			{
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_WPS_SUCESS_INTERVAL_ALPHA);
+			}
+			break;
+
+		default:
+			break;
+	}
+
+}
+
+static void
+SwLedBlink2(
+	PLED_871x			pLed
+	)
+{
+	_adapter				*padapter = pLed->padapter;
+	struct mlme_priv		*pmlmepriv = &(padapter->mlmepriv);
+	u8					bStopBlinking = _FALSE;
+
+	// Change LED according to BlinkingLedState specified.
+	if( pLed->BlinkingLedState == RTW_LED_ON)
+	{
+		SwLedOn(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn on\n", pLed->BlinkTimes));
+	}
+	else
+	{
+		SwLedOff(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn off\n", pLed->BlinkTimes));
+	}
+
+	switch(pLed->CurrLedState)
+	{
+		case LED_SCAN_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _TRUE;
+			}
+
+			if(bStopBlinking)
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE)
+				{
+					pLed->CurrLedState = RTW_LED_ON;
+					pLed->BlinkingLedState = RTW_LED_ON;
+					SwLedOn(padapter, pLed);
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("stop scan blink CurrLedState %d\n", pLed->CurrLedState));
+
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _FALSE)
+				{
+					pLed->CurrLedState = RTW_LED_OFF;
+					pLed->BlinkingLedState = RTW_LED_OFF;
+					SwLedOff(padapter, pLed);
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("stop scan blink CurrLedState %d\n", pLed->CurrLedState));
+				}
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}
+			else
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					 if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF;
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+				}
+			}
+			break;
+
+		case LED_TXRX_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _TRUE;
+			}
+			if(bStopBlinking)
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE)
+				{
+					pLed->CurrLedState = RTW_LED_ON;
+					pLed->BlinkingLedState = RTW_LED_ON;
+					SwLedOn(padapter, pLed);
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("stop CurrLedState %d\n", pLed->CurrLedState));
+
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _FALSE)
+				{
+					pLed->CurrLedState = RTW_LED_OFF;
+					pLed->BlinkingLedState = RTW_LED_OFF;
+					SwLedOff(padapter, pLed);
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("stop CurrLedState %d\n", pLed->CurrLedState));
+				}
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			else
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					 if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF;
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+				}
+			}
+			break;
+
+		default:
+			break;
+	}
+
+}
+
+static void
+SwLedBlink3(
+	PLED_871x			pLed
+	)
+{
+	_adapter			*padapter = pLed->padapter;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	u8				bStopBlinking = _FALSE;
+
+	// Change LED according to BlinkingLedState specified.
+	if( pLed->BlinkingLedState == RTW_LED_ON )
+	{
+		SwLedOn(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn on\n", pLed->BlinkTimes));
+	}
+	else
+	{
+		if(pLed->CurrLedState != LED_BLINK_WPS_STOP)
+			SwLedOff(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn off\n", pLed->BlinkTimes));
+	}
+
+	switch(pLed->CurrLedState)
+	{
+		case LED_SCAN_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _TRUE;
+			}
+
+			if(bStopBlinking)
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE)
+				{
+					pLed->CurrLedState = RTW_LED_ON;
+					pLed->BlinkingLedState = RTW_LED_ON;
+					if( !pLed->bLedOn )
+						SwLedOn(padapter, pLed);
+
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _FALSE)
+				{
+					pLed->CurrLedState = RTW_LED_OFF;
+					pLed->BlinkingLedState = RTW_LED_OFF;
+					if( pLed->bLedOn )
+						SwLedOff(padapter, pLed);
+
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+				}
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}
+			else
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF;
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+				}
+			}
+			break;
+
+		case LED_TXRX_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _TRUE;
+			}
+			if(bStopBlinking)
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE)
+				{
+					pLed->CurrLedState = RTW_LED_ON;
+					pLed->BlinkingLedState = RTW_LED_ON;
+
+					if( !pLed->bLedOn )
+						SwLedOn(padapter, pLed);
+
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+				}
+				else if(check_fwstate(pmlmepriv, _FW_LINKED)== _FALSE)
+				{
+					pLed->CurrLedState = RTW_LED_OFF;
+					pLed->BlinkingLedState = RTW_LED_OFF;
+
+					if( pLed->bLedOn )
+						SwLedOff(padapter, pLed);
+
+
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+				}
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			else
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF;
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+				}
+			}
+			break;
+
+		case LED_BLINK_WPS:
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF;
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			break;
+
+		case LED_BLINK_WPS_STOP:	//WPS success
+			if(pLed->BlinkingLedState == RTW_LED_ON)
+			{
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_WPS_SUCESS_INTERVAL_ALPHA);
+				bStopBlinking = _FALSE;
+			}
+			else
+			{
+				bStopBlinking = _TRUE;
+			}
+
+			if(bStopBlinking)
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on )
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					pLed->CurrLedState = RTW_LED_ON;
+					pLed->BlinkingLedState = RTW_LED_ON;
+					SwLedOn(padapter, pLed);
+					RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+				}
+				pLed->bLedWPSBlinkInProgress = _FALSE;
+			}
+			break;
+
+
+		default:
+			break;
+	}
+
+}
+
+
+static void
+SwLedBlink4(
+	PLED_871x			pLed
+	)
+{
+	_adapter			*padapter = pLed->padapter;
+	struct led_priv	*ledpriv = &(padapter->ledpriv);
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	PLED_871x 		pLed1 = &(ledpriv->SwLed1);
+	u8				bStopBlinking = _FALSE;
+
+	// Change LED according to BlinkingLedState specified.
+	if( pLed->BlinkingLedState == RTW_LED_ON )
+	{
+		SwLedOn(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn on\n", pLed->BlinkTimes));
+	}
+	else
+	{
+		SwLedOff(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn off\n", pLed->BlinkTimes));
+	}
+
+	if(!pLed1->bLedWPSBlinkInProgress && pLed1->BlinkingLedState == LED_UNKNOWN)
+	{
+		pLed1->BlinkingLedState = RTW_LED_OFF;
+		pLed1->CurrLedState = RTW_LED_OFF;
+		SwLedOff(padapter, pLed1);
+	}
+
+	switch(pLed->CurrLedState)
+	{
+		case LED_BLINK_SLOWLY:
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF;
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+			break;
+
+		case LED_BLINK_StartToBlink:
+			if( pLed->bLedOn )
+			{
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SLOWLY_INTERVAL);
+			}
+			else
+			{
+				pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+			}
+			break;
+
+		case LED_SCAN_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _FALSE;
+			}
+
+			if(bStopBlinking)
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on && padapter->pwrctrlpriv.rfoff_reason > RF_CHANGE_BY_PS)
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					pLed->bLedNoLinkBlinkInProgress = _FALSE;
+					pLed->CurrLedState = LED_BLINK_SLOWLY;
+					if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF;
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+				}
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}
+			else
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on && padapter->pwrctrlpriv.rfoff_reason > RF_CHANGE_BY_PS)
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					 if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF;
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+				}
+			}
+			break;
+
+		case LED_TXRX_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _TRUE;
+			}
+			if(bStopBlinking)
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on && padapter->pwrctrlpriv.rfoff_reason > RF_CHANGE_BY_PS)
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					pLed->bLedNoLinkBlinkInProgress = _TRUE;
+					pLed->CurrLedState = LED_BLINK_SLOWLY;
+					if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF;
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+				}
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			else
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on && padapter->pwrctrlpriv.rfoff_reason > RF_CHANGE_BY_PS)
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					 if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF;
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+				}
+			}
+			break;
+
+		case LED_BLINK_WPS:
+			if( pLed->bLedOn )
+			{
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SLOWLY_INTERVAL);
+			}
+			else
+			{
+				pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+			}
+			break;
+
+		case LED_BLINK_WPS_STOP:	//WPS authentication fail
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF;
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+			break;
+
+		case LED_BLINK_WPS_STOP_OVERLAP:	//WPS session overlap
+			pLed->BlinkTimes--;
+			if(pLed->BlinkTimes == 0)
+			{
+				if(pLed->bLedOn)
+				{
+					pLed->BlinkTimes = 1;
+				}
+				else
+				{
+					bStopBlinking = _TRUE;
+				}
+			}
+
+			if(bStopBlinking)
+			{
+				pLed->BlinkTimes = 10;
+				pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_LINK_INTERVAL_ALPHA);
+			}
+			else
+			{
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+			}
+			break;
+
+
+		default:
+			break;
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("SwLedBlink4 CurrLedState %d\n", pLed->CurrLedState));
+
+
+}
+
+static void
+SwLedBlink5(
+	PLED_871x			pLed
+	)
+{
+	_adapter			*padapter = pLed->padapter;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	u8				bStopBlinking = _FALSE;
+
+	// Change LED according to BlinkingLedState specified.
+	if( pLed->BlinkingLedState == RTW_LED_ON )
+	{
+		SwLedOn(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn on\n", pLed->BlinkTimes));
+	}
+	else
+	{
+		SwLedOff(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn off\n", pLed->BlinkTimes));
+	}
+
+	switch(pLed->CurrLedState)
+	{
+		case LED_SCAN_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _TRUE;
+			}
+
+			if(bStopBlinking)
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on && padapter->pwrctrlpriv.rfoff_reason > RF_CHANGE_BY_PS)
+				{
+					pLed->CurrLedState = RTW_LED_OFF;
+					pLed->BlinkingLedState = RTW_LED_OFF;
+					if(pLed->bLedOn)
+						SwLedOff(padapter, pLed);
+				}
+				else
+				{		pLed->CurrLedState = RTW_LED_ON;
+						pLed->BlinkingLedState = RTW_LED_ON;
+						if(!pLed->bLedOn)
+							_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+				}
+
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}
+			else
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on && padapter->pwrctrlpriv.rfoff_reason > RF_CHANGE_BY_PS)
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF;
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+				}
+			}
+			break;
+
+
+		case LED_TXRX_BLINK:
+			pLed->BlinkTimes--;
+			if( pLed->BlinkTimes == 0 )
+			{
+				bStopBlinking = _TRUE;
+			}
+
+			if(bStopBlinking)
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on && padapter->pwrctrlpriv.rfoff_reason > RF_CHANGE_BY_PS)
+				{
+					pLed->CurrLedState = RTW_LED_OFF;
+					pLed->BlinkingLedState = RTW_LED_OFF;
+					if(pLed->bLedOn)
+						SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					pLed->CurrLedState = RTW_LED_ON;
+					pLed->BlinkingLedState = RTW_LED_ON;
+					if(!pLed->bLedOn)
+						_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+				}
+
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			else
+			{
+				if( padapter->pwrctrlpriv.rf_pwrstate != rf_on && padapter->pwrctrlpriv.rfoff_reason > RF_CHANGE_BY_PS)
+				{
+					SwLedOff(padapter, pLed);
+				}
+				else
+				{
+					 if( pLed->bLedOn )
+						pLed->BlinkingLedState = RTW_LED_OFF;
+					else
+						pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+				}
+			}
+			break;
+
+		default:
+			break;
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("SwLedBlink5 CurrLedState %d\n", pLed->CurrLedState));
+
+
+}
+
+static void
+SwLedBlink6(
+	PLED_871x			pLed
+	)
+{
+	_adapter			*padapter = pLed->padapter;
+	struct mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	u8				bStopBlinking = _FALSE;
+
+	// Change LED according to BlinkingLedState specified.
+	if( pLed->BlinkingLedState == RTW_LED_ON )
+	{
+		SwLedOn(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn on\n", pLed->BlinkTimes));
+	}
+	else
+	{
+		SwLedOff(padapter, pLed);
+		RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Blinktimes (%d): turn off\n", pLed->BlinkTimes));
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("<==== blink6\n"));
+}
+
+
+//
+//	Description:
+//		Callback function of LED BlinkTimer,
+//		it just schedules to corresponding BlinkWorkItem.
+//
+static void
+BlinkTimerCallback(
+	unsigned long data
+	)
+{
+	PLED_871x	 pLed = (PLED_871x)data;
+	_adapter		*padapter = pLed->padapter;
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	if( (padapter->bSurpriseRemoved == _TRUE) || ( padapter->bDriverStopped == _TRUE))
+	{
+		//DBG_871X("%s bSurpriseRemoved:%d, bDriverStopped:%d\n", __FUNCTION__, padapter->bSurpriseRemoved, padapter->bDriverStopped);
+		return;
+	}
+
+#ifdef CONFIG_LED_HANDLED_BY_CMD_THREAD
+	rtw_led_blink_cmd(padapter, pLed);
+#else
+	_set_workitem(&(pLed->BlinkWorkItem));
+#endif
+}
+
+//
+//	Description:
+//		Handler function of LED Blinking.
+//		We dispatch acture LED blink action according to LedStrategy.
+//
+void BlinkHandler(PLED_871x	 pLed)
+{
+	struct led_priv	*ledpriv = &(pLed->padapter->ledpriv);
+	_adapter		*padapter = pLed->padapter;
+
+	//DBG_871X("%s (%s:%d)\n",__FUNCTION__, current->comm, current->pid);
+
+	if( (padapter->bSurpriseRemoved == _TRUE) || ( padapter->bDriverStopped == _TRUE))
+	{
+		//DBG_871X("%s bSurpriseRemoved:%d, bDriverStopped:%d\n", __FUNCTION__, padapter->bSurpriseRemoved, padapter->bDriverStopped);
+		return;
+	}
+
+	switch(ledpriv->LedStrategy)
+	{
+		case SW_LED_MODE0:
+			SwLedBlink(pLed);
+			break;
+
+		case SW_LED_MODE1:
+			SwLedBlink1(pLed);
+			break;
+
+		case SW_LED_MODE2:
+			SwLedBlink2(pLed);
+			break;
+
+		case SW_LED_MODE3:
+			SwLedBlink3(pLed);
+			break;
+
+		case SW_LED_MODE4:
+			SwLedBlink4(pLed);
+			break;
+
+		case SW_LED_MODE5:
+			SwLedBlink5(pLed);
+			break;
+
+		case SW_LED_MODE6:
+			SwLedBlink6(pLed);
+			break;
+
+		default:
+			//RT_TRACE(COMP_LED, DBG_LOUD, ("BlinkWorkItemCallback 0x%x \n", pHalData->LedStrategy));
+			//SwLedBlink(pLed);
+			break;
+	}
+}
+
+//
+//	Description:
+//		Callback function of LED BlinkWorkItem.
+//		We dispatch acture LED blink action according to LedStrategy.
+//
+static void BlinkWorkItemCallback(struct work_struct *work)
+{
+	PLED_871x	 pLed = container_of(work, LED_871x, BlinkWorkItem);
+	BlinkHandler(pLed);
+}
+
+
+
+//================================================================================
+// Default LED behavior.
+//================================================================================
+
+//
+//	Description:
+//		Implement each led action for SW_LED_MODE0.
+//		This is default strategy.
+//
+static void
+SwLedControlMode0(
+	_adapter		*padapter,
+	LED_CTL_MODE		LedAction
+)
+{
+	struct led_priv	*ledpriv = &(padapter->ledpriv);
+	PLED_871x	pLed = &(ledpriv->SwLed1);
+
+	// Decide led state
+	switch(LedAction)
+	{
+	case LED_CTL_TX:
+	case LED_CTL_RX:
+		if( pLed->bLedBlinkInProgress == _FALSE )
+		{
+			pLed->bLedBlinkInProgress = _TRUE;
+
+			pLed->CurrLedState = LED_BLINK_NORMAL;
+			pLed->BlinkTimes = 2;
+
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF;
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+		}
+		break;
+
+	case LED_CTL_START_TO_LINK:
+		if( pLed->bLedBlinkInProgress == _FALSE )
+		{
+			pLed->bLedBlinkInProgress = _TRUE;
+
+			pLed->CurrLedState = LED_BLINK_StartToBlink;
+			pLed->BlinkTimes = 24;
+
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF;
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_SLOWLY_INTERVAL);
+		}
+		else
+		{
+			pLed->CurrLedState = LED_BLINK_StartToBlink;
+		}
+		break;
+
+	case LED_CTL_LINK:
+		pLed->CurrLedState = RTW_LED_ON;
+		if( pLed->bLedBlinkInProgress == _FALSE )
+		{
+			SwLedOn(padapter, pLed);
+		}
+		break;
+
+	case LED_CTL_NO_LINK:
+		pLed->CurrLedState = RTW_LED_OFF;
+		if( pLed->bLedBlinkInProgress == _FALSE )
+		{
+			SwLedOff(padapter, pLed);
+		}
+		break;
+
+	case LED_CTL_POWER_OFF:
+		pLed->CurrLedState = RTW_LED_OFF;
+		if(pLed->bLedBlinkInProgress)
+		{
+			_cancel_timer_ex(&(pLed->BlinkTimer));
+			pLed->bLedBlinkInProgress = _FALSE;
+		}
+		SwLedOff(padapter, pLed);
+		break;
+
+	case LED_CTL_START_WPS:
+		if( pLed->bLedBlinkInProgress == _FALSE || pLed->CurrLedState == RTW_LED_ON)
+		{
+			pLed->bLedBlinkInProgress = _TRUE;
+
+			pLed->CurrLedState = LED_BLINK_WPS;
+			pLed->BlinkTimes = 20;
+
+			if( pLed->bLedOn )
+			{
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_LONG_INTERVAL);
+			}
+			else
+			{
+				pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_LONG_INTERVAL);
+			}
+		}
+		break;
+
+	case LED_CTL_STOP_WPS:
+		if(pLed->bLedBlinkInProgress)
+		{
+			pLed->CurrLedState = RTW_LED_OFF;
+			_cancel_timer_ex(&(pLed->BlinkTimer));
+			pLed->bLedBlinkInProgress = _FALSE;
+		}
+		break;
+
+
+	default:
+		break;
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Led %d\n", pLed->CurrLedState));
+
+}
+
+ //ALPHA, added by chiyoko, 20090106
+static void
+SwLedControlMode1(
+	_adapter		*padapter,
+	LED_CTL_MODE		LedAction
+)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(padapter);
+	struct led_priv		*ledpriv = &(padapter->ledpriv);
+	PLED_871x			pLed = &(ledpriv->SwLed0);
+	struct mlme_priv		*pmlmepriv = &(padapter->mlmepriv);
+
+	if(pHalData->EEPROMCustomerID == RT_CID_819x_CAMEO)
+		pLed = &(ledpriv->SwLed1);
+
+	switch(LedAction)
+	{
+		case LED_CTL_POWER_ON:
+		case LED_CTL_START_TO_LINK:
+		case LED_CTL_NO_LINK:
+			if( pLed->bLedNoLinkBlinkInProgress == _FALSE )
+			{
+				if(pLed->CurrLedState == LED_SCAN_BLINK || IS_LED_WPS_BLINKING(pLed))
+				{
+					return;
+				}
+				if( pLed->bLedLinkBlinkInProgress == _TRUE )
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedLinkBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+
+				pLed->bLedNoLinkBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_BLINK_SLOWLY;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_CTL_LINK:
+			if( pLed->bLedLinkBlinkInProgress == _FALSE )
+			{
+				if(pLed->CurrLedState == LED_SCAN_BLINK || IS_LED_WPS_BLINKING(pLed))
+				{
+					return;
+				}
+				if(pLed->bLedNoLinkBlinkInProgress == _TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedNoLinkBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				pLed->bLedLinkBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_BLINK_NORMAL;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_LINK_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_CTL_SITE_SURVEY:
+			 if((pmlmepriv->LinkDetectInfo.bBusyTraffic) && (check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE))
+				;
+			 else if(pLed->bLedScanBlinkInProgress ==_FALSE)
+			 {
+				if(IS_LED_WPS_BLINKING(pLed))
+					return;
+
+				if(pLed->bLedNoLinkBlinkInProgress == _TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedNoLinkBlinkInProgress = _FALSE;
+				}
+				if( pLed->bLedLinkBlinkInProgress == _TRUE )
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					 pLed->bLedLinkBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				pLed->bLedScanBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_SCAN_BLINK;
+				pLed->BlinkTimes = 24;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			 }
+			break;
+
+		case LED_CTL_TX:
+		case LED_CTL_RX:
+			if(pLed->bLedBlinkInProgress ==_FALSE)
+			{
+				if(pLed->CurrLedState == LED_SCAN_BLINK || IS_LED_WPS_BLINKING(pLed))
+				{
+					return;
+				}
+				if(pLed->bLedNoLinkBlinkInProgress == _TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedNoLinkBlinkInProgress = _FALSE;
+				}
+				if( pLed->bLedLinkBlinkInProgress == _TRUE )
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedLinkBlinkInProgress = _FALSE;
+				}
+				pLed->bLedBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_TXRX_BLINK;
+				pLed->BlinkTimes = 2;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_CTL_START_WPS: //wait until xinpin finish
+		case LED_CTL_START_WPS_BOTTON:
+			 if(pLed->bLedWPSBlinkInProgress ==_FALSE)
+			 {
+				if(pLed->bLedNoLinkBlinkInProgress == _TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedNoLinkBlinkInProgress = _FALSE;
+				}
+				if( pLed->bLedLinkBlinkInProgress == _TRUE )
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					 pLed->bLedLinkBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedScanBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedScanBlinkInProgress = _FALSE;
+				}
+				pLed->bLedWPSBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_BLINK_WPS;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			 }
+			break;
+
+
+		case LED_CTL_STOP_WPS:
+			if(pLed->bLedNoLinkBlinkInProgress == _TRUE)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedNoLinkBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedLinkBlinkInProgress == _TRUE )
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				 pLed->bLedLinkBlinkInProgress = _FALSE;
+			}
+			if(pLed->bLedBlinkInProgress ==_TRUE)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			if(pLed->bLedScanBlinkInProgress ==_TRUE)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}
+			if(pLed->bLedWPSBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+			}
+			else
+			{
+				pLed->bLedWPSBlinkInProgress = _TRUE;
+			}
+
+			pLed->CurrLedState = LED_BLINK_WPS_STOP;
+			if(pLed->bLedOn)
+			{
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_WPS_SUCESS_INTERVAL_ALPHA);
+			}
+			else
+			{
+				pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), 0);
+			}
+			break;
+
+		case LED_CTL_STOP_WPS_FAIL:
+			if(pLed->bLedWPSBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;
+			}
+
+			pLed->bLedNoLinkBlinkInProgress = _TRUE;
+			pLed->CurrLedState = LED_BLINK_SLOWLY;
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF;
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+			break;
+
+		case LED_CTL_POWER_OFF:
+			pLed->CurrLedState = RTW_LED_OFF;
+			pLed->BlinkingLedState = RTW_LED_OFF;
+			if( pLed->bLedNoLinkBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedNoLinkBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedLinkBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedLinkBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedWPSBlinkInProgress )
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedScanBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}
+
+			SwLedOff(padapter, pLed);
+			break;
+
+		default:
+			break;
+
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Led %d\n", pLed->CurrLedState));
+}
+
+ //Arcadyan/Sitecom , added by chiyoko, 20090216
+static void
+SwLedControlMode2(
+	_adapter				*padapter,
+	LED_CTL_MODE		LedAction
+)
+{
+	struct led_priv	*ledpriv = &(padapter->ledpriv);
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	PLED_871x 		pLed = &(ledpriv->SwLed0);
+
+	switch(LedAction)
+	{
+		case LED_CTL_SITE_SURVEY:
+			 if(pmlmepriv->LinkDetectInfo.bBusyTraffic)
+				;
+			 else if(pLed->bLedScanBlinkInProgress ==_FALSE)
+			 {
+				if(IS_LED_WPS_BLINKING(pLed))
+					return;
+
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				pLed->bLedScanBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_SCAN_BLINK;
+				pLed->BlinkTimes = 24;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			 }
+			break;
+
+		case LED_CTL_TX:
+		case LED_CTL_RX:
+			if((pLed->bLedBlinkInProgress ==_FALSE) && (check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE))
+			{
+				if(pLed->CurrLedState == LED_SCAN_BLINK || IS_LED_WPS_BLINKING(pLed))
+				{
+					return;
+				}
+
+				pLed->bLedBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_TXRX_BLINK;
+				pLed->BlinkTimes = 2;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_CTL_LINK:
+			pLed->CurrLedState = RTW_LED_ON;
+			pLed->BlinkingLedState = RTW_LED_ON;
+			if( pLed->bLedBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedScanBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}
+
+			_set_timer(&(pLed->BlinkTimer), 0);
+			break;
+
+		case LED_CTL_START_WPS: //wait until xinpin finish
+		case LED_CTL_START_WPS_BOTTON:
+			if(pLed->bLedWPSBlinkInProgress ==_FALSE)
+			{
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedScanBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedScanBlinkInProgress = _FALSE;
+				}
+				pLed->bLedWPSBlinkInProgress = _TRUE;
+				pLed->CurrLedState = RTW_LED_ON;
+				pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), 0);
+			 }
+			break;
+
+		case LED_CTL_STOP_WPS:
+			pLed->bLedWPSBlinkInProgress = _FALSE;
+			if(padapter->pwrctrlpriv.rf_pwrstate != rf_on)
+			{
+				SwLedOff(padapter, pLed);
+			}
+			else
+			{
+				pLed->CurrLedState = RTW_LED_ON;
+				pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), 0);
+				RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+			}
+			break;
+
+		case LED_CTL_STOP_WPS_FAIL:
+			pLed->bLedWPSBlinkInProgress = _FALSE;
+			if(padapter->pwrctrlpriv.rf_pwrstate != rf_on)
+			{
+				SwLedOff(padapter, pLed);
+			}
+			else
+			{
+				pLed->CurrLedState = RTW_LED_OFF;
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), 0);
+				RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+			}
+			break;
+
+		case LED_CTL_START_TO_LINK:
+		case LED_CTL_NO_LINK:
+			if(!IS_LED_BLINKING(pLed))
+			{
+				pLed->CurrLedState = RTW_LED_OFF;
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), 0);
+			}
+			break;
+
+		case LED_CTL_POWER_OFF:
+			pLed->CurrLedState = RTW_LED_OFF;
+			pLed->BlinkingLedState = RTW_LED_OFF;
+			if( pLed->bLedBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedScanBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedWPSBlinkInProgress )
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;
+			}
+
+			_set_timer(&(pLed->BlinkTimer), 0);
+			break;
+
+		default:
+			break;
+
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+}
+
+  //COREGA, added by chiyoko, 20090316
+ static void
+ SwLedControlMode3(
+	_adapter				*padapter,
+	LED_CTL_MODE		LedAction
+)
+{
+	struct led_priv	*ledpriv = &(padapter->ledpriv);
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	PLED_871x		pLed = &(ledpriv->SwLed0);
+
+	switch(LedAction)
+	{
+		case LED_CTL_SITE_SURVEY:
+			if(pmlmepriv->LinkDetectInfo.bBusyTraffic)
+				;
+			else if(pLed->bLedScanBlinkInProgress ==_FALSE)
+			{
+				if(IS_LED_WPS_BLINKING(pLed))
+					return;
+
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				pLed->bLedScanBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_SCAN_BLINK;
+				pLed->BlinkTimes = 24;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_CTL_TX:
+		case LED_CTL_RX:
+			if((pLed->bLedBlinkInProgress ==_FALSE) && (check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE))
+			{
+				if(pLed->CurrLedState == LED_SCAN_BLINK || IS_LED_WPS_BLINKING(pLed))
+				{
+					return;
+				}
+
+				pLed->bLedBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_TXRX_BLINK;
+				pLed->BlinkTimes = 2;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_CTL_LINK:
+			if(IS_LED_WPS_BLINKING(pLed))
+				return;
+
+			pLed->CurrLedState = RTW_LED_ON;
+			pLed->BlinkingLedState = RTW_LED_ON;
+			if( pLed->bLedBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedScanBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}
+
+			_set_timer(&(pLed->BlinkTimer), 0);
+			break;
+
+		case LED_CTL_START_WPS: //wait until xinpin finish
+		case LED_CTL_START_WPS_BOTTON:
+			if(pLed->bLedWPSBlinkInProgress ==_FALSE)
+			{
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedScanBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedScanBlinkInProgress = _FALSE;
+				}
+				pLed->bLedWPSBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_BLINK_WPS;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_CTL_STOP_WPS:
+			if(pLed->bLedWPSBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;
+			}
+			else
+			{
+				pLed->bLedWPSBlinkInProgress = _TRUE;
+			}
+
+			pLed->CurrLedState = LED_BLINK_WPS_STOP;
+			if(pLed->bLedOn)
+			{
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_WPS_SUCESS_INTERVAL_ALPHA);
+			}
+			else
+			{
+				pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), 0);
+			}
+
+			break;
+
+		case LED_CTL_STOP_WPS_FAIL:
+			if(pLed->bLedWPSBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;
+			}
+
+			pLed->CurrLedState = RTW_LED_OFF;
+			pLed->BlinkingLedState = RTW_LED_OFF;
+			_set_timer(&(pLed->BlinkTimer), 0);
+			break;
+
+		case LED_CTL_START_TO_LINK:
+		case LED_CTL_NO_LINK:
+			if(!IS_LED_BLINKING(pLed))
+			{
+				pLed->CurrLedState = RTW_LED_OFF;
+				pLed->BlinkingLedState = RTW_LED_OFF;
+				_set_timer(&(pLed->BlinkTimer), 0);
+			}
+			break;
+
+		case LED_CTL_POWER_OFF:
+			pLed->CurrLedState = RTW_LED_OFF;
+			pLed->BlinkingLedState = RTW_LED_OFF;
+			if( pLed->bLedBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedScanBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedWPSBlinkInProgress )
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;
+			}
+
+			_set_timer(&(pLed->BlinkTimer), 0);
+			break;
+
+		default:
+			break;
+
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("CurrLedState %d\n", pLed->CurrLedState));
+}
+
+
+ //Edimax-Belkin, added by chiyoko, 20090413
+static void
+SwLedControlMode4(
+	_adapter				*padapter,
+	LED_CTL_MODE		LedAction
+)
+{
+	struct led_priv	*ledpriv = &(padapter->ledpriv);
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	PLED_871x		pLed = &(ledpriv->SwLed0);
+	PLED_871x		pLed1 = &(ledpriv->SwLed1);
+
+	switch(LedAction)
+	{
+		case LED_CTL_START_TO_LINK:
+			if(pLed1->bLedWPSBlinkInProgress)
+			{
+				pLed1->bLedWPSBlinkInProgress = _FALSE;
+				_cancel_timer_ex(&(pLed1->BlinkTimer));
+
+				pLed1->BlinkingLedState = RTW_LED_OFF;
+				pLed1->CurrLedState = RTW_LED_OFF;
+
+				if(pLed1->bLedOn)
+					_set_timer(&(pLed->BlinkTimer), 0);
+			}
+
+			if( pLed->bLedStartToLinkBlinkInProgress == _FALSE )
+			{
+				if(pLed->CurrLedState == LED_SCAN_BLINK || IS_LED_WPS_BLINKING(pLed))
+				{
+					return;
+				}
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedNoLinkBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedNoLinkBlinkInProgress = _FALSE;
+				}
+
+				pLed->bLedStartToLinkBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_BLINK_StartToBlink;
+				if( pLed->bLedOn )
+				{
+					pLed->BlinkingLedState = RTW_LED_OFF;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_SLOWLY_INTERVAL);
+				}
+				else
+				{
+					pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+				}
+			}
+			break;
+
+		case LED_CTL_LINK:
+		case LED_CTL_NO_LINK:
+			//LED1 settings
+			if(LedAction == LED_CTL_LINK)
+			{
+				if(pLed1->bLedWPSBlinkInProgress)
+				{
+					pLed1->bLedWPSBlinkInProgress = _FALSE;
+					_cancel_timer_ex(&(pLed1->BlinkTimer));
+
+					pLed1->BlinkingLedState = RTW_LED_OFF;
+					pLed1->CurrLedState = RTW_LED_OFF;
+
+					if(pLed1->bLedOn)
+						_set_timer(&(pLed->BlinkTimer), 0);
+				}
+			}
+
+			if( pLed->bLedNoLinkBlinkInProgress == _FALSE )
+			{
+				if(pLed->CurrLedState == LED_SCAN_BLINK || IS_LED_WPS_BLINKING(pLed))
+				{
+					return;
+				}
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+
+				pLed->bLedNoLinkBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_BLINK_SLOWLY;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_CTL_SITE_SURVEY:
+			if((pmlmepriv->LinkDetectInfo.bBusyTraffic) && (check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE))
+				;
+			else if(pLed->bLedScanBlinkInProgress ==_FALSE)
+			{
+				if(IS_LED_WPS_BLINKING(pLed))
+					return;
+
+				if(pLed->bLedNoLinkBlinkInProgress == _TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedNoLinkBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				pLed->bLedScanBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_SCAN_BLINK;
+				pLed->BlinkTimes = 24;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_CTL_TX:
+		case LED_CTL_RX:
+			if(pLed->bLedBlinkInProgress ==_FALSE)
+			{
+				if(pLed->CurrLedState == LED_SCAN_BLINK || IS_LED_WPS_BLINKING(pLed))
+				{
+					return;
+				}
+				if(pLed->bLedNoLinkBlinkInProgress == _TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedNoLinkBlinkInProgress = _FALSE;
+				}
+				pLed->bLedBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_TXRX_BLINK;
+				pLed->BlinkTimes = 2;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_CTL_START_WPS: //wait until xinpin finish
+		case LED_CTL_START_WPS_BOTTON:
+			if(pLed1->bLedWPSBlinkInProgress)
+			{
+				pLed1->bLedWPSBlinkInProgress = _FALSE;
+				_cancel_timer_ex(&(pLed1->BlinkTimer));
+
+				pLed1->BlinkingLedState = RTW_LED_OFF;
+				pLed1->CurrLedState = RTW_LED_OFF;
+
+				if(pLed1->bLedOn)
+					_set_timer(&(pLed->BlinkTimer), 0);
+			}
+
+			if(pLed->bLedWPSBlinkInProgress ==_FALSE)
+			{
+				if(pLed->bLedNoLinkBlinkInProgress == _TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedNoLinkBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				if(pLed->bLedScanBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedScanBlinkInProgress = _FALSE;
+				}
+				pLed->bLedWPSBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_BLINK_WPS;
+				if( pLed->bLedOn )
+				{
+					pLed->BlinkingLedState = RTW_LED_OFF;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_SLOWLY_INTERVAL);
+				}
+				else
+				{
+					pLed->BlinkingLedState = RTW_LED_ON;
+					_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+				}
+			}
+			break;
+
+		case LED_CTL_STOP_WPS:	//WPS connect success
+			if(pLed->bLedWPSBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;
+			}
+
+			pLed->bLedNoLinkBlinkInProgress = _TRUE;
+			pLed->CurrLedState = LED_BLINK_SLOWLY;
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF;
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+
+			break;
+
+		case LED_CTL_STOP_WPS_FAIL:		//WPS authentication fail
+			if(pLed->bLedWPSBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;
+			}
+
+			pLed->bLedNoLinkBlinkInProgress = _TRUE;
+			pLed->CurrLedState = LED_BLINK_SLOWLY;
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF;
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+
+			//LED1 settings
+			if(pLed1->bLedWPSBlinkInProgress)
+				_cancel_timer_ex(&(pLed1->BlinkTimer));
+			else
+				pLed1->bLedWPSBlinkInProgress = _TRUE;
+
+			pLed1->CurrLedState = LED_BLINK_WPS_STOP;
+			if( pLed1->bLedOn )
+				pLed1->BlinkingLedState = RTW_LED_OFF;
+			else
+				pLed1->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+
+			break;
+
+		case LED_CTL_STOP_WPS_FAIL_OVERLAP:	//WPS session overlap
+			if(pLed->bLedWPSBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;
+			}
+
+			pLed->bLedNoLinkBlinkInProgress = _TRUE;
+			pLed->CurrLedState = LED_BLINK_SLOWLY;
+			if( pLed->bLedOn )
+				pLed->BlinkingLedState = RTW_LED_OFF;
+			else
+				pLed->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NO_LINK_INTERVAL_ALPHA);
+
+			//LED1 settings
+			if(pLed1->bLedWPSBlinkInProgress)
+				_cancel_timer_ex(&(pLed1->BlinkTimer));
+			else
+				pLed1->bLedWPSBlinkInProgress = _TRUE;
+
+			pLed1->CurrLedState = LED_BLINK_WPS_STOP_OVERLAP;
+			pLed1->BlinkTimes = 10;
+			if( pLed1->bLedOn )
+				pLed1->BlinkingLedState = RTW_LED_OFF;
+			else
+				pLed1->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed->BlinkTimer), LED_BLINK_NORMAL_INTERVAL);
+
+			break;
+
+		case LED_CTL_POWER_OFF:
+			pLed->CurrLedState = RTW_LED_OFF;
+			pLed->BlinkingLedState = RTW_LED_OFF;
+
+			if( pLed->bLedNoLinkBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedNoLinkBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedLinkBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedLinkBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedWPSBlinkInProgress )
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedWPSBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedScanBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedScanBlinkInProgress = _FALSE;
+			}
+			if( pLed->bLedStartToLinkBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedStartToLinkBlinkInProgress = _FALSE;
+			}
+
+			if( pLed1->bLedWPSBlinkInProgress )
+			{
+				_cancel_timer_ex(&(pLed1->BlinkTimer));
+				pLed1->bLedWPSBlinkInProgress = _FALSE;
+			}
+
+			pLed1->BlinkingLedState = LED_UNKNOWN;
+			SwLedOff(padapter, pLed);
+			SwLedOff(padapter, pLed1);
+			break;
+
+		default:
+			break;
+
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Led %d\n", pLed->CurrLedState));
+}
+
+
+
+ //Sercomm-Belkin, added by chiyoko, 20090415
+static void
+SwLedControlMode5(
+	_adapter				*padapter,
+	LED_CTL_MODE		LedAction
+)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct led_priv	*ledpriv = &(padapter->ledpriv);
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	PLED_871x		pLed = &(ledpriv->SwLed0);
+
+	if(pHalData->EEPROMCustomerID == RT_CID_819x_CAMEO)
+		pLed = &(ledpriv->SwLed1);
+
+	switch(LedAction)
+	{
+		case LED_CTL_POWER_ON:
+		case LED_CTL_NO_LINK:
+		case LED_CTL_LINK: 	//solid blue
+			pLed->CurrLedState = RTW_LED_ON;
+			pLed->BlinkingLedState = RTW_LED_ON;
+
+			_set_timer(&(pLed->BlinkTimer), 0);
+			break;
+
+		case LED_CTL_SITE_SURVEY:
+			if((pmlmepriv->LinkDetectInfo.bBusyTraffic) && (check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE))
+				;
+			else if(pLed->bLedScanBlinkInProgress ==_FALSE)
+			{
+				if(pLed->bLedBlinkInProgress ==_TRUE)
+				{
+					_cancel_timer_ex(&(pLed->BlinkTimer));
+					pLed->bLedBlinkInProgress = _FALSE;
+				}
+				pLed->bLedScanBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_SCAN_BLINK;
+				pLed->BlinkTimes = 24;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_SCAN_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_CTL_TX:
+		case LED_CTL_RX:
+			if(pLed->bLedBlinkInProgress ==_FALSE)
+			{
+				if(pLed->CurrLedState == LED_SCAN_BLINK)
+				{
+					return;
+				}
+				pLed->bLedBlinkInProgress = _TRUE;
+				pLed->CurrLedState = LED_TXRX_BLINK;
+				pLed->BlinkTimes = 2;
+				if( pLed->bLedOn )
+					pLed->BlinkingLedState = RTW_LED_OFF;
+				else
+					pLed->BlinkingLedState = RTW_LED_ON;
+				_set_timer(&(pLed->BlinkTimer), LED_BLINK_FASTER_INTERVAL_ALPHA);
+			}
+			break;
+
+		case LED_CTL_POWER_OFF:
+			pLed->CurrLedState = RTW_LED_OFF;
+			pLed->BlinkingLedState = RTW_LED_OFF;
+
+			if( pLed->bLedBlinkInProgress)
+			{
+				_cancel_timer_ex(&(pLed->BlinkTimer));
+				pLed->bLedBlinkInProgress = _FALSE;
+			}
+
+			SwLedOff(padapter, pLed);
+			break;
+
+		default:
+			break;
+
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("Led %d\n", pLed->CurrLedState));
+}
+
+ //WNC-Corega, added by chiyoko, 20090902
+static void
+SwLedControlMode6(
+	_adapter				*padapter,
+	LED_CTL_MODE		LedAction
+)
+{
+	struct led_priv	*ledpriv = &(padapter->ledpriv);
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	PLED_871x pLed0 = &(ledpriv->SwLed0);
+
+	switch(LedAction)
+	{
+		case LED_CTL_POWER_ON:
+		case LED_CTL_LINK:
+		case LED_CTL_NO_LINK:
+			_cancel_timer_ex(&(pLed0->BlinkTimer));
+			pLed0->CurrLedState = RTW_LED_ON;
+			pLed0->BlinkingLedState = RTW_LED_ON;
+			_set_timer(&(pLed0->BlinkTimer), 0);
+			break;
+
+		case LED_CTL_POWER_OFF:
+			SwLedOff(padapter, pLed0);
+			break;
+
+		default:
+			break;
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("ledcontrol 6 Led %d\n", pLed0->CurrLedState));
+}
+
+
+//
+//	Description:
+//		Dispatch LED action according to pHalData->LedStrategy.
+//
+static void
+LedControl871x(
+	_adapter				*padapter,
+	LED_CTL_MODE		LedAction
+	)
+{
+	struct led_priv	*ledpriv = &(padapter->ledpriv);
+
+       if( (padapter->bSurpriseRemoved == _TRUE) || ( padapter->bDriverStopped == _TRUE)
+		||(padapter->hw_init_completed == _FALSE) )
+       {
+             return;
+       }
+
+
+	if( ledpriv->bRegUseLed == _FALSE)
+		return;
+
+	//if (!priv->up)
+	//	return;
+
+	//if(priv->bInHctTest)
+	//	return;
+
+	if( (padapter->pwrctrlpriv.rf_pwrstate != rf_on &&
+		padapter->pwrctrlpriv.rfoff_reason > RF_CHANGE_BY_PS) &&
+		(LedAction == LED_CTL_TX || LedAction == LED_CTL_RX ||
+		 LedAction == LED_CTL_SITE_SURVEY ||
+		 LedAction == LED_CTL_LINK ||
+		 LedAction == LED_CTL_NO_LINK ||
+		 LedAction == LED_CTL_POWER_ON) )
+	{
+		return;
+	}
+
+	switch(ledpriv->LedStrategy)
+	{
+		case SW_LED_MODE0:
+			//SwLedControlMode0(padapter, LedAction);
+			break;
+
+		case SW_LED_MODE1:
+			SwLedControlMode1(padapter, LedAction);
+			break;
+		case SW_LED_MODE2:
+			SwLedControlMode2(padapter, LedAction);
+			break;
+
+		case SW_LED_MODE3:
+			SwLedControlMode3(padapter, LedAction);
+			break;
+
+		case SW_LED_MODE4:
+			SwLedControlMode4(padapter, LedAction);
+			break;
+
+		case SW_LED_MODE5:
+			SwLedControlMode5(padapter, LedAction);
+			break;
+
+		case SW_LED_MODE6:
+			SwLedControlMode6(padapter, LedAction);
+			break;
+
+		default:
+			break;
+	}
+
+	RT_TRACE(_module_rtl8712_led_c_,_drv_info_,("LedStrategy:%d, LedAction %d\n", ledpriv->LedStrategy,LedAction));
+}
+
+//
+//	Description:
+//		Initialize all LED_871x objects.
+//
+void
+rtl8192cu_InitSwLeds(
+	_adapter	*padapter
+	)
+{
+	struct led_priv *pledpriv = &(padapter->ledpriv);
+
+	pledpriv->LedControlHandler = LedControl871x;
+
+	InitLed871x(padapter, &(pledpriv->SwLed0), LED_PIN_LED0);
+
+	InitLed871x(padapter,&(pledpriv->SwLed1), LED_PIN_LED1);
+}
+
+
+//
+//	Description:
+//		DeInitialize all LED_819xUsb objects.
+//
+void
+rtl8192cu_DeInitSwLeds(
+	_adapter	*padapter
+	)
+{
+	struct led_priv	*ledpriv = &(padapter->ledpriv);
+
+	DeInitLed871x( &(ledpriv->SwLed0) );
+	DeInitLed871x( &(ledpriv->SwLed1) );
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_recv.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_recv.c
new file mode 100644
index 000000000000..dd4383f5f6d9
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_recv.c
@@ -0,0 +1,227 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTL8192CU_RECV_C_
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#include <mlme_osdep.h>
+#include <ip.h>
+#include <if_ether.h>
+#include <ethernet.h>
+
+#include <usb_ops.h>
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+
+#error "Shall be Linux or Windows, but not both!\n"
+
+#endif
+
+#include <wifi.h>
+#include <circ_buf.h>
+
+#include <rtl8192c_hal.h>
+
+
+void rtl8192cu_init_recvbuf(_adapter *padapter, struct recv_buf *precvbuf)
+{
+
+	precvbuf->transfer_len = 0;
+
+	precvbuf->len = 0;
+
+	precvbuf->ref_cnt = 0;
+
+	if(precvbuf->pbuf)
+	{
+		precvbuf->pdata = precvbuf->phead = precvbuf->ptail = precvbuf->pbuf;
+		precvbuf->pend = precvbuf->pdata + MAX_RECVBUF_SZ;
+	}
+
+}
+
+int	rtl8192cu_init_recv_priv(_adapter *padapter)
+{
+	struct recv_priv	*precvpriv = &padapter->recvpriv;
+	int	i, res = _SUCCESS;
+	struct recv_buf *precvbuf;
+
+#ifdef CONFIG_RECV_THREAD_MODE
+	_rtw_init_sema(&precvpriv->recv_sema, 0);//will be removed
+	_rtw_init_sema(&precvpriv->terminate_recvthread_sema, 0);//will be removed
+#endif
+
+#ifdef PLATFORM_LINUX
+	tasklet_init(&precvpriv->recv_tasklet,
+	     (void(*)(unsigned long))rtl8192cu_recv_tasklet,
+	     (unsigned long)padapter);
+#endif
+
+#ifdef CONFIG_USB_INTERRUPT_IN_PIPE
+#ifdef PLATFORM_LINUX
+	precvpriv->int_in_urb = usb_alloc_urb(0, GFP_KERNEL);
+	if(precvpriv->int_in_urb == NULL){
+		DBG_8192C("alloc_urb for interrupt in endpoint fail !!!!\n");
+	}
+#endif
+	precvpriv->int_in_buf = rtw_zmalloc(sizeof(INTERRUPT_MSG_FORMAT_EX));
+	if(precvpriv->int_in_buf == NULL){
+		DBG_8192C("alloc_mem for interrupt in endpoint fail !!!!\n");
+	}
+#endif
+
+	//init recv_buf
+	_rtw_init_queue(&precvpriv->free_recv_buf_queue);
+
+#ifdef CONFIG_USE_USB_BUFFER_ALLOC_RX
+	_rtw_init_queue(&precvpriv->recv_buf_pending_queue);
+#endif	// CONFIG_USE_USB_BUFFER_ALLOC_RX
+
+	precvpriv->pallocated_recv_buf = rtw_zmalloc(NR_RECVBUFF *sizeof(struct recv_buf) + 4);
+	if(precvpriv->pallocated_recv_buf==NULL){
+		res= _FAIL;
+		RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("alloc recv_buf fail!\n"));
+		goto exit;
+	}
+	_rtw_memset(precvpriv->pallocated_recv_buf, 0, NR_RECVBUFF *sizeof(struct recv_buf) + 4);
+
+	precvpriv->precv_buf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(precvpriv->pallocated_recv_buf), 4);
+	//precvpriv->precv_buf = precvpriv->pallocated_recv_buf + 4 -
+	//						((uint) (precvpriv->pallocated_recv_buf) &(4-1));
+
+
+	precvbuf = (struct recv_buf*)precvpriv->precv_buf;
+
+	for(i=0; i < NR_RECVBUFF ; i++)
+	{
+		_rtw_init_listhead(&precvbuf->list);
+
+		_rtw_spinlock_init(&precvbuf->recvbuf_lock);
+
+		precvbuf->alloc_sz = MAX_RECVBUF_SZ;
+
+		res = rtw_os_recvbuf_resource_alloc(padapter, precvbuf);
+		if(res==_FAIL)
+			break;
+
+		precvbuf->ref_cnt = 0;
+		precvbuf->adapter =padapter;
+
+
+		//rtw_list_insert_tail(&precvbuf->list, &(precvpriv->free_recv_buf_queue.queue));
+
+		precvbuf++;
+
+	}
+
+	precvpriv->free_recv_buf_queue_cnt = NR_RECVBUFF;
+
+#ifdef PLATFORM_LINUX
+
+	skb_queue_head_init(&precvpriv->rx_skb_queue);
+
+#ifdef CONFIG_PREALLOC_RECV_SKB
+	{
+		int i;
+		SIZE_PTR tmpaddr=0;
+		SIZE_PTR alignment=0;
+		struct sk_buff *pskb=NULL;
+
+		skb_queue_head_init(&precvpriv->free_recv_skb_queue);
+
+		for(i=0; i<NR_PREALLOC_RECV_SKB; i++)
+		{
+			pskb = rtw_skb_alloc(MAX_RECVBUF_SZ + RECVBUFF_ALIGN_SZ);
+
+			if(pskb)
+			{
+				pskb->dev = padapter->pnetdev;
+
+				tmpaddr = (SIZE_PTR)pskb->data;
+				alignment = tmpaddr & (RECVBUFF_ALIGN_SZ-1);
+				skb_reserve(pskb, (RECVBUFF_ALIGN_SZ - alignment));
+
+				skb_queue_tail(&precvpriv->free_recv_skb_queue, pskb);
+			}
+
+			pskb=NULL;
+
+		}
+	}
+#endif
+
+#endif
+
+exit:
+
+	return res;
+
+}
+
+void rtl8192cu_free_recv_priv (_adapter *padapter)
+{
+	int	i;
+	struct recv_buf	*precvbuf;
+	struct recv_priv	*precvpriv = &padapter->recvpriv;
+
+	precvbuf = (struct recv_buf *)precvpriv->precv_buf;
+
+	for(i=0; i < NR_RECVBUFF ; i++)
+	{
+		rtw_os_recvbuf_resource_free(padapter, precvbuf);
+		precvbuf++;
+	}
+
+	if(precvpriv->pallocated_recv_buf)
+		rtw_mfree(precvpriv->pallocated_recv_buf, NR_RECVBUFF *sizeof(struct recv_buf) + 4);
+
+#ifdef CONFIG_USB_INTERRUPT_IN_PIPE
+#ifdef PLATFORM_LINUX
+	if(precvpriv->int_in_urb)
+	{
+		usb_free_urb(precvpriv->int_in_urb);
+	}
+#endif
+	if(precvpriv->int_in_buf)
+		rtw_mfree(precvpriv->int_in_buf, sizeof(INTERRUPT_MSG_FORMAT_EX));
+#endif
+
+#ifdef PLATFORM_LINUX
+
+	if (skb_queue_len(&precvpriv->rx_skb_queue)) {
+		DBG_8192C(KERN_WARNING "rx_skb_queue not empty\n");
+	}
+
+	rtw_skb_queue_purge(&precvpriv->rx_skb_queue);
+
+#ifdef CONFIG_PREALLOC_RECV_SKB
+
+	if (skb_queue_len(&precvpriv->free_recv_skb_queue)) {
+		DBG_8192C(KERN_WARNING "free_recv_skb_queue not empty, %d\n", skb_queue_len(&precvpriv->free_recv_skb_queue));
+	}
+
+	rtw_skb_queue_purge(&precvpriv->free_recv_skb_queue);
+
+#endif
+
+#endif
+
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_xmit.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_xmit.c
new file mode 100644
index 000000000000..c7bcae76564d
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/rtl8192cu_xmit.c
@@ -0,0 +1,1149 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RTL8192C_XMIT_C_
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_byteorder.h>
+#include <wifi.h>
+#include <osdep_intf.h>
+#include <circ_buf.h>
+#include <usb_ops.h>
+#include <rtl8192c_hal.h>
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+#error "Shall be Linux or Windows, but not both!\n"
+#endif
+
+
+s32	rtl8192cu_init_xmit_priv(_adapter *padapter)
+{
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+
+#ifdef PLATFORM_LINUX
+	tasklet_init(&pxmitpriv->xmit_tasklet,
+	     (void(*)(unsigned long))rtl8192cu_xmit_tasklet,
+	     (unsigned long)padapter);
+#endif
+	return _SUCCESS;
+}
+
+void	rtl8192cu_free_xmit_priv(_adapter *padapter)
+{
+}
+
+u32 rtw_get_ff_hwaddr(struct xmit_frame	*pxmitframe)
+{
+	u32 addr;
+	struct pkt_attrib *pattrib = &pxmitframe->attrib;
+
+	switch(pattrib->qsel)
+	{
+		case 0:
+		case 3:
+			addr = BE_QUEUE_INX;
+			break;
+		case 1:
+		case 2:
+			addr = BK_QUEUE_INX;
+			break;
+		case 4:
+		case 5:
+			addr = VI_QUEUE_INX;
+			break;
+		case 6:
+		case 7:
+			addr = VO_QUEUE_INX;
+			break;
+		case 0x10:
+			addr = BCN_QUEUE_INX;
+			break;
+		case 0x11://BC/MC in PS (HIQ)
+			addr = HIGH_QUEUE_INX;
+			break;
+		case 0x12:
+			addr = MGT_QUEUE_INX;
+			break;
+		default:
+			addr = BE_QUEUE_INX;
+			break;
+
+	}
+
+	return addr;
+
+}
+
+int urb_zero_packet_chk(_adapter *padapter, int sz)
+{
+	int blnSetTxDescOffset;
+	struct dvobj_priv	*pdvobj = adapter_to_dvobj(padapter);
+
+	if ( pdvobj->ishighspeed )
+	{
+		if ( ( (sz + TXDESC_SIZE) % 512 ) == 0 ) {
+			blnSetTxDescOffset = 1;
+		} else {
+			blnSetTxDescOffset = 0;
+		}
+	}
+	else
+	{
+		if ( ( (sz + TXDESC_SIZE) % 64 ) == 0 ) 	{
+			blnSetTxDescOffset = 1;
+		} else {
+			blnSetTxDescOffset = 0;
+		}
+	}
+
+	return blnSetTxDescOffset;
+
+}
+
+void rtl8192cu_cal_txdesc_chksum(struct tx_desc	*ptxdesc)
+{
+		u16	*usPtr = (u16*)ptxdesc;
+		u32 count = 16;		// (32 bytes / 2 bytes per XOR) => 16 times
+		u32 index;
+		u16 checksum = 0;
+
+		//Clear first
+		ptxdesc->txdw7 &= cpu_to_le32(0xffff0000);
+
+		for(index = 0 ; index < count ; index++){
+			checksum = checksum ^ le16_to_cpu(*(usPtr + index));
+		}
+
+		ptxdesc->txdw7 |= cpu_to_le32(0x0000ffff&checksum);
+
+}
+
+void fill_txdesc_sectype(struct pkt_attrib *pattrib, struct tx_desc *ptxdesc)
+{
+	if ((pattrib->encrypt > 0) && !pattrib->bswenc)
+	{
+		switch (pattrib->encrypt)
+		{
+			//SEC_TYPE
+			case _WEP40_:
+			case _WEP104_:
+					ptxdesc->txdw1 |= cpu_to_le32((0x01<<22)&0x00c00000);
+					break;
+			case _TKIP_:
+			case _TKIP_WTMIC_:
+					//ptxdesc->txdw1 |= cpu_to_le32((0x02<<22)&0x00c00000);
+					ptxdesc->txdw1 |= cpu_to_le32((0x01<<22)&0x00c00000);
+					break;
+			case _AES_:
+					ptxdesc->txdw1 |= cpu_to_le32((0x03<<22)&0x00c00000);
+					break;
+			case _NO_PRIVACY_:
+			default:
+					break;
+
+		}
+
+	}
+
+}
+
+static void fill_txdesc_vcs(struct pkt_attrib *pattrib, u32 *pdw)
+{
+	//DBG_8192C("cvs_mode=%d\n", pattrib->vcs_mode);
+
+	switch(pattrib->vcs_mode)
+	{
+		case RTS_CTS:
+			*pdw |= cpu_to_le32(BIT(12));
+			break;
+		case CTS_TO_SELF:
+			*pdw |= cpu_to_le32(BIT(11));
+			break;
+		case NONE_VCS:
+		default:
+			break;
+	}
+
+	if(pattrib->vcs_mode) {
+		*pdw |= cpu_to_le32(BIT(13));
+
+		// Set RTS BW
+		if(pattrib->ht_en)
+		{
+			*pdw |= (pattrib->bwmode&HT_CHANNEL_WIDTH_40)?	cpu_to_le32(BIT(27)):0;
+
+			if(pattrib->ch_offset == HAL_PRIME_CHNL_OFFSET_LOWER)
+				*pdw |= cpu_to_le32((0x01<<28)&0x30000000);
+			else if(pattrib->ch_offset == HAL_PRIME_CHNL_OFFSET_UPPER)
+				*pdw |= cpu_to_le32((0x02<<28)&0x30000000);
+			else if(pattrib->ch_offset == HAL_PRIME_CHNL_OFFSET_DONT_CARE)
+				*pdw |= 0;
+			else
+				*pdw |= cpu_to_le32((0x03<<28)&0x30000000);
+		}
+	}
+}
+
+static void fill_txdesc_phy(struct pkt_attrib *pattrib, u32 *pdw)
+{
+	//DBG_8192C("bwmode=%d, ch_off=%d\n", pattrib->bwmode, pattrib->ch_offset);
+
+	if(pattrib->ht_en)
+	{
+		*pdw |= (pattrib->bwmode&HT_CHANNEL_WIDTH_40)?	cpu_to_le32(BIT(25)):0;
+
+		if(pattrib->ch_offset == HAL_PRIME_CHNL_OFFSET_LOWER)
+			*pdw |= cpu_to_le32((0x01<<20)&0x00300000);
+		else if(pattrib->ch_offset == HAL_PRIME_CHNL_OFFSET_UPPER)
+			*pdw |= cpu_to_le32((0x02<<20)&0x00300000);
+		else if(pattrib->ch_offset == HAL_PRIME_CHNL_OFFSET_DONT_CARE)
+			*pdw |= 0;
+		else
+			*pdw |= cpu_to_le32((0x03<<20)&0x00300000);
+	}
+}
+
+static s32 update_txdesc(struct xmit_frame *pxmitframe, u8 *pmem, s32 sz, u8 bagg_pkt)
+{
+	int	pull=0;
+	uint	qsel;
+	_adapter			*padapter = pxmitframe->padapter;
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	struct tx_desc	*ptxdesc = (struct tx_desc *)pmem;
+	struct ht_priv		*phtpriv = &pmlmepriv->htpriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	sint	bmcst = IS_MCAST(pattrib->ra);
+#ifdef CONFIG_P2P
+	struct wifidirect_info*	pwdinfo = &padapter->wdinfo;
+#endif //CONFIG_P2P
+
+#ifndef CONFIG_USE_USB_BUFFER_ALLOC_TX
+	if((_FALSE == bagg_pkt) && (urb_zero_packet_chk(padapter, sz)==0))
+	{
+		ptxdesc = (struct tx_desc *)(pmem+PACKET_OFFSET_SZ);
+		pull = 1;
+		pxmitframe->pkt_offset --;
+	}
+#endif	// CONFIG_USE_USB_BUFFER_ALLOC_TX
+
+	_rtw_memset(ptxdesc, 0, sizeof(struct tx_desc));
+
+	if((pxmitframe->frame_tag&0x0f) == DATA_FRAMETAG)
+	{
+		//DBG_8192C("pxmitframe->frame_tag == DATA_FRAMETAG\n");
+
+		//offset 4
+		ptxdesc->txdw1 |= cpu_to_le32(pattrib->mac_id&0x1f);
+
+		qsel = (uint)(pattrib->qsel & 0x0000001f);
+		ptxdesc->txdw1 |= cpu_to_le32((qsel << QSEL_SHT) & 0x00001f00);
+
+		ptxdesc->txdw1 |= cpu_to_le32((pattrib->raid<< 16) & 0x000f0000);
+
+		fill_txdesc_sectype(pattrib, ptxdesc);
+
+		if(pattrib->ampdu_en==_TRUE)
+			ptxdesc->txdw1 |= cpu_to_le32(BIT(5));//AGG EN
+		else
+			ptxdesc->txdw1 |= cpu_to_le32(BIT(6));//AGG BK
+
+		//offset 8
+
+
+		//offset 12
+		ptxdesc->txdw3 |= cpu_to_le32((pattrib->seqnum<<16)&0xffff0000);
+
+
+		//offset 16 , offset 20
+		if (pattrib->qos_en)
+			ptxdesc->txdw4 |= cpu_to_le32(BIT(6));//QoS
+
+		if ((pattrib->ether_type != 0x888e) && (pattrib->ether_type != 0x0806) && (pattrib->dhcp_pkt != 1))
+		{
+		//Non EAP & ARP & DHCP type data packet
+
+			fill_txdesc_vcs(pattrib, &ptxdesc->txdw4);
+			fill_txdesc_phy(pattrib, &ptxdesc->txdw4);
+
+			ptxdesc->txdw4 |= cpu_to_le32(0x00000008);//RTS Rate=24M
+			ptxdesc->txdw5 |= cpu_to_le32(0x0001ff00);//
+			//ptxdesc->txdw5 |= cpu_to_le32(0x0000000b);//DataRate - 54M
+
+			//use REG_INIDATA_RATE_SEL value
+			ptxdesc->txdw5 |= cpu_to_le32(pdmpriv->INIDATA_RATE[pattrib->mac_id]);
+
+		if(0)//for driver dbg
+			{
+				ptxdesc->txdw4 |= cpu_to_le32(BIT(8));//driver uses rate
+
+				if(pattrib->ht_en)
+					ptxdesc->txdw5 |= cpu_to_le32(BIT(6));//SGI
+
+				ptxdesc->txdw5 |= cpu_to_le32(0x00000013);//init rate - mcs7
+			}
+
+		}
+		else
+		{
+			// EAP data packet and ARP packet.
+			// Use the 1M data rate to send the EAP/ARP packet.
+			// This will maybe make the handshake smooth.
+
+			ptxdesc->txdw1 |= cpu_to_le32(BIT(6));//AGG BK
+
+			ptxdesc->txdw4 |= cpu_to_le32(BIT(8));//driver uses rate
+
+			if (pmlmeinfo->preamble_mode == PREAMBLE_SHORT)
+				ptxdesc->txdw4 |= cpu_to_le32(BIT(24));// DATA_SHORT
+
+			ptxdesc->txdw5 |= cpu_to_le32(MRateToHwRate(pmlmeext->tx_rate));
+		}
+
+		//offset 24
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_TX
+		if ( pattrib->hw_tcp_csum == 1 ) {
+			// ptxdesc->txdw6 = 0; // clear TCP_CHECKSUM and IP_CHECKSUM. It's zero already!!
+			u8 ip_hdr_offset = 32 + pattrib->hdrlen + pattrib->iv_len + 8;
+			ptxdesc->txdw7 = (1 << 31) | (ip_hdr_offset << 16);
+			DBG_8192C("ptxdesc->txdw7 = %08x\n", ptxdesc->txdw7);
+		}
+#endif
+	}
+	else if((pxmitframe->frame_tag&0x0f)== MGNT_FRAMETAG)
+	{
+		//DBG_8192C("pxmitframe->frame_tag == MGNT_FRAMETAG\n");
+
+		//offset 4
+		ptxdesc->txdw1 |= cpu_to_le32(pattrib->mac_id&0x1f);
+
+		qsel = (uint)(pattrib->qsel&0x0000001f);
+		ptxdesc->txdw1 |= cpu_to_le32((qsel<<QSEL_SHT)&0x00001f00);
+
+		ptxdesc->txdw1 |= cpu_to_le32((pattrib->raid<< 16) & 0x000f0000);
+
+		//fill_txdesc_sectype(pattrib, ptxdesc);
+
+		//offset 8
+#ifdef CONFIG_XMIT_ACK
+		//CCX-TXRPT ack for xmit mgmt frames.
+		if (pxmitframe->ack_report) {
+			ptxdesc->txdw2 |= cpu_to_le32(BIT(19));
+			#ifdef DBG_CCX
+			DBG_871X("%s set ccx\n", __func__);
+			#endif
+		}
+#endif //CONFIG_XMIT_ACK
+
+		//offset 12
+		ptxdesc->txdw3 |= cpu_to_le32((pattrib->seqnum<<16)&0xffff0000);
+
+		//offset 16
+		ptxdesc->txdw4 |= cpu_to_le32(BIT(8));//driver uses rate
+
+		//offset 20
+		ptxdesc->txdw5 |= cpu_to_le32(BIT(17));//retry limit enable
+		if(pattrib->retry_ctrl == _TRUE)
+		{
+#ifdef CONFIG_P2P
+			if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+			{
+#ifdef CONFIG_INTEL_WIDI
+				if(padapter->mlmepriv.widi_enable == _TRUE)
+					ptxdesc->txdw5 |= cpu_to_le32(0x00180000);//retry limit = 6
+				else
+#endif //CONFIG_INTEL_WIDI
+					ptxdesc->txdw5 |= cpu_to_le32(0x00080000);//retry limit = 2
+			}
+			else
+#endif //CONFIG_P2P
+				ptxdesc->txdw5 |= cpu_to_le32(0x00180000);//retry limit = 6
+		}
+		else
+			ptxdesc->txdw5 |= cpu_to_le32(0x00300000);//retry limit = 12
+
+#ifdef CONFIG_INTEL_PROXIM
+		if((padapter->proximity.proxim_on==_TRUE)&&(pattrib->intel_proxim==_TRUE)){
+			printk("\n %s pattrib->rate=%d\n",__FUNCTION__,pattrib->rate);
+			ptxdesc->txdw5 |= cpu_to_le32( pattrib->rate);
+		}
+		else
+#endif
+		{
+			ptxdesc->txdw5 |= cpu_to_le32(MRateToHwRate(pmlmeext->tx_rate));
+		}
+	}
+	else if((pxmitframe->frame_tag&0x0f) == TXAGG_FRAMETAG)
+	{
+		DBG_8192C("pxmitframe->frame_tag == TXAGG_FRAMETAG\n");
+	}
+#ifdef CONFIG_MP_INCLUDED
+	else if((pxmitframe->frame_tag&0x0f) == MP_FRAMETAG)
+	{
+		fill_txdesc_for_mp(padapter, ptxdesc);
+	}
+#endif
+	else
+	{
+		DBG_8192C("pxmitframe->frame_tag = %d\n", pxmitframe->frame_tag);
+
+		//offset 4
+		ptxdesc->txdw1 |= cpu_to_le32((4)&0x1f);//CAM_ID(MAC_ID)
+
+		ptxdesc->txdw1 |= cpu_to_le32((6<< 16) & 0x000f0000);//raid
+
+		//offset 8
+
+		//offset 12
+		ptxdesc->txdw3 |= cpu_to_le32((pattrib->seqnum<<16)&0xffff0000);
+
+		//offset 16
+		ptxdesc->txdw4 |= cpu_to_le32(BIT(8));//driver uses rate
+
+		//offset 20
+		ptxdesc->txdw5 |= cpu_to_le32(MRateToHwRate(pmlmeext->tx_rate));
+	}
+
+	// 2009.11.05. tynli_test. Suggested by SD4 Filen for FW LPS.
+	// (1) The sequence number of each non-Qos frame / broadcast / multicast /
+	// mgnt frame should be controled by Hw because Fw will also send null data
+	// which we cannot control when Fw LPS enable.
+	// --> default enable non-Qos data sequense number. 2010.06.23. by tynli.
+	// (2) Enable HW SEQ control for beacon packet, because we use Hw beacon.
+	// (3) Use HW Qos SEQ to control the seq num of Ext port non-Qos packets.
+	// 2010.06.23. Added by tynli.
+	if(!pattrib->qos_en)
+	{
+		ptxdesc->txdw4 |= cpu_to_le32(BIT(7)); // Hw set sequence number
+		ptxdesc->txdw3 |= cpu_to_le32((8 <<28)); //set bit3 to 1. Suugested by TimChen. 2009.12.29.
+	}
+
+	//offset 0
+	ptxdesc->txdw0 |= cpu_to_le32(sz&0x0000ffff);
+	ptxdesc->txdw0 |= cpu_to_le32(OWN | FSG | LSG);
+	ptxdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE+OFFSET_SZ)<<OFFSET_SHT)&0x00ff0000);//32 bytes for TX Desc
+
+	if(bmcst)
+	{
+		ptxdesc->txdw0 |= cpu_to_le32(BIT(24));
+	}
+
+	RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("offset0-txdesc=0x%x\n", ptxdesc->txdw0));
+
+	//offset 4
+	// pkt_offset, unit:8 bytes padding
+	if (pxmitframe->pkt_offset > 0)
+		ptxdesc->txdw1 |= cpu_to_le32((pxmitframe->pkt_offset << 26) & 0x7c000000);
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+	if (pxmitframe->agg_num > 1)
+		ptxdesc->txdw5 |= cpu_to_le32((pxmitframe->agg_num << 24) & 0xff000000);
+#endif
+
+	rtl8192cu_cal_txdesc_chksum(ptxdesc);
+
+	return pull;
+
+}
+
+static s32 rtw_dump_xframe(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	s32 ret = _SUCCESS;
+	s32 inner_ret = _SUCCESS;
+	int t, sz, w_sz, pull=0;
+	u8 *mem_addr;
+	u32 ff_hwaddr;
+	struct xmit_buf *pxmitbuf = pxmitframe->pxmitbuf;
+	struct pkt_attrib *pattrib = &pxmitframe->attrib;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+
+	if ((pxmitframe->frame_tag == DATA_FRAMETAG) &&
+	    (pxmitframe->attrib.ether_type != 0x0806) &&
+	    (pxmitframe->attrib.ether_type != 0x888e) &&
+	    (pxmitframe->attrib.dhcp_pkt != 1))
+	{
+		rtw_issue_addbareq_cmd(padapter, pxmitframe);
+	}
+
+	mem_addr = pxmitframe->buf_addr;
+
+       RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_dump_xframe()\n"));
+
+	for (t = 0; t < pattrib->nr_frags; t++)
+	{
+		if (inner_ret != _SUCCESS && ret == _SUCCESS)
+			ret = _FAIL;
+
+		if (t != (pattrib->nr_frags - 1))
+		{
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_err_,("pattrib->nr_frags=%d\n", pattrib->nr_frags));
+
+			sz = pxmitpriv->frag_len;
+			sz = sz - 4 - (psecuritypriv->sw_encrypt ? 0 : pattrib->icv_len);
+		}
+		else //no frag
+		{
+			sz = pattrib->last_txcmdsz;
+		}
+
+		pull = update_txdesc(pxmitframe, mem_addr, sz, _FALSE);
+
+		if(pull)
+		{
+			mem_addr += PACKET_OFFSET_SZ; //pull txdesc head
+
+			//pxmitbuf ->pbuf = mem_addr;
+			pxmitframe->buf_addr = mem_addr;
+
+			w_sz = sz + TXDESC_SIZE;
+		}
+		else
+		{
+			w_sz = sz + TXDESC_SIZE + PACKET_OFFSET_SZ;
+		}
+
+		ff_hwaddr = rtw_get_ff_hwaddr(pxmitframe);
+
+		inner_ret = rtw_write_port(padapter, ff_hwaddr, w_sz, (unsigned char*)pxmitbuf);
+
+		rtw_count_tx_stats(padapter, pxmitframe, sz);
+
+
+		RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("rtw_write_port, w_sz=%d\n", w_sz));
+		//DBG_8192C("rtw_write_port, w_sz=%d, sz=%d, txdesc_sz=%d, tid=%d\n", w_sz, sz, w_sz-sz, pattrib->priority);
+
+		mem_addr += w_sz;
+
+		mem_addr = (u8 *)RND4(((SIZE_PTR)(mem_addr)));
+
+	}
+
+	rtw_free_xmitframe(pxmitpriv, pxmitframe);
+
+	if  (ret != _SUCCESS)
+		rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_UNKNOWN);
+
+	return ret;
+}
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+static u32 xmitframe_need_length(struct xmit_frame *pxmitframe)
+{
+	struct pkt_attrib *pattrib = &pxmitframe->attrib;
+
+	u32	len = 0;
+
+	// no consider fragement
+	len = pattrib->hdrlen + pattrib->iv_len +
+		SNAP_SIZE + sizeof(u16) +
+		pattrib->pktlen +
+		((pattrib->bswenc) ? pattrib->icv_len : 0);
+
+	if(pattrib->encrypt ==_TKIP_)
+		len += 8;
+
+	return len;
+}
+
+#define IDEA_CONDITION 1	// check all packets before enqueue
+s32 rtl8192cu_xmitframe_complete(_adapter *padapter, struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct xmit_frame *pxmitframe = NULL;
+	struct xmit_frame *pfirstframe = NULL;
+
+	// aggregate variable
+	struct hw_xmit *phwxmit;
+	struct sta_info *psta = NULL;
+	struct tx_servq *ptxservq = NULL;
+
+	_irqL irqL;
+	_list *xmitframe_plist = NULL, *xmitframe_phead = NULL;
+
+	u32	pbuf;	// next pkt address
+	u32	pbuf_tail;	// last pkt tail
+	u32	len;	// packet length, except TXDESC_SIZE and PKT_OFFSET
+
+	u32	bulkSize = pHalData->UsbBulkOutSize;
+	u8	descCount;
+	u32	bulkPtr;
+
+	// dump frame variable
+	u32 ff_hwaddr;
+
+#ifndef IDEA_CONDITION
+	int res = _SUCCESS;
+#endif
+
+	RT_TRACE(_module_rtl8192c_xmit_c_, _drv_info_, ("+xmitframe_complete\n"));
+
+
+	// check xmitbuffer is ok
+	if (pxmitbuf == NULL) {
+		pxmitbuf = rtw_alloc_xmitbuf(pxmitpriv);
+		if (pxmitbuf == NULL) return _FALSE;
+	}
+
+
+	//3 1. pick up first frame
+	do {
+		rtw_free_xmitframe(pxmitpriv, pxmitframe);
+
+		pxmitframe = rtw_dequeue_xframe(pxmitpriv, pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
+		if (pxmitframe == NULL) {
+			// no more xmit frame, release xmit buffer
+			rtw_free_xmitbuf(pxmitpriv, pxmitbuf);
+			return _FALSE;
+		}
+
+
+#ifndef IDEA_CONDITION
+		if (pxmitframe->frame_tag != DATA_FRAMETAG) {
+			RT_TRACE(_module_rtl8192c_xmit_c_, _drv_err_,
+				 ("xmitframe_complete: frame tag(%d) is not DATA_FRAMETAG(%d)!\n",
+				  pxmitframe->frame_tag, DATA_FRAMETAG));
+//			rtw_free_xmitframe(pxmitpriv, pxmitframe);
+			continue;
+		}
+
+		// TID 0~15
+		if ((pxmitframe->attrib.priority < 0) ||
+		    (pxmitframe->attrib.priority > 15)) {
+			RT_TRACE(_module_rtl8192c_xmit_c_, _drv_err_,
+				 ("xmitframe_complete: TID(%d) should be 0~15!\n",
+				  pxmitframe->attrib.priority));
+//			rtw_free_xmitframe(pxmitpriv, pxmitframe);
+			continue;
+		}
+#endif
+
+		pxmitframe->pxmitbuf = pxmitbuf;
+		pxmitframe->buf_addr = pxmitbuf->pbuf;
+		pxmitbuf->priv_data = pxmitframe;
+
+		//pxmitframe->agg_num = 1; // alloc xmitframe should assign to 1.
+		pxmitframe->pkt_offset = 1; // first frame of aggregation, reserve offset
+
+
+		if (rtw_xmitframe_coalesce(padapter, pxmitframe->pkt, pxmitframe) == _FALSE) {
+			DBG_871X("%s coalesce 1st xmitframe failed \n",__FUNCTION__);
+			continue;
+		}
+
+
+		// always return ndis_packet after rtw_xmitframe_coalesce
+		rtw_os_xmit_complete(padapter, pxmitframe);
+
+		break;
+	} while (1);
+
+	//3 2. aggregate same priority and same DA(AP or STA) frames
+	pfirstframe = pxmitframe;
+	len = xmitframe_need_length(pfirstframe) + TXDESC_OFFSET;
+	pbuf_tail = len;
+	pbuf = _RND8(pbuf_tail);
+
+	// check pkt amount in one bluk
+	descCount = 0;
+	bulkPtr = bulkSize;
+	if (pbuf < bulkPtr)
+		descCount++;
+	else {
+		descCount = 0;
+		bulkPtr = ((pbuf / bulkSize) + 1) * bulkSize; // round to next bulkSize
+	}
+
+	// dequeue same priority packet from station tx queue
+	psta = pfirstframe->attrib.psta;
+	switch (pfirstframe->attrib.priority) {
+		case 1:
+		case 2:
+			ptxservq = &(psta->sta_xmitpriv.bk_q);
+			phwxmit = pxmitpriv->hwxmits + 3;
+			break;
+
+		case 4:
+		case 5:
+			ptxservq = &(psta->sta_xmitpriv.vi_q);
+			phwxmit = pxmitpriv->hwxmits + 1;
+			break;
+
+		case 6:
+		case 7:
+			ptxservq = &(psta->sta_xmitpriv.vo_q);
+			phwxmit = pxmitpriv->hwxmits;
+			break;
+
+		case 0:
+		case 3:
+		default:
+			ptxservq = &(psta->sta_xmitpriv.be_q);
+			phwxmit = pxmitpriv->hwxmits + 2;
+			break;
+	}
+
+	_enter_critical_bh(&pxmitpriv->lock, &irqL);
+
+	xmitframe_phead = get_list_head(&ptxservq->sta_pending);
+	xmitframe_plist = get_next(xmitframe_phead);
+	while (rtw_end_of_queue_search(xmitframe_phead, xmitframe_plist) == _FALSE)
+	{
+		pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
+		xmitframe_plist = get_next(xmitframe_plist);
+
+		len = xmitframe_need_length(pxmitframe) + TXDESC_SIZE; // no offset
+		if (pbuf + len > MAX_XMITBUF_SZ) break;
+
+		rtw_list_delete(&pxmitframe->list);
+		ptxservq->qcnt--;
+		phwxmit->accnt--;
+
+#ifndef IDEA_CONDITION
+		// suppose only data frames would be in queue
+		if (pxmitframe->frame_tag != DATA_FRAMETAG) {
+			RT_TRACE(_module_rtl8192c_xmit_c_, _drv_err_,
+				 ("xmitframe_complete: frame tag(%d) is not DATA_FRAMETAG(%d)!\n",
+				  pxmitframe->frame_tag, DATA_FRAMETAG));
+			rtw_free_xmitframe(pxmitpriv, pxmitframe);
+			continue;
+		}
+
+		// TID 0~15
+		if ((pxmitframe->attrib.priority < 0) ||
+		    (pxmitframe->attrib.priority > 15)) {
+			RT_TRACE(_module_rtl8192c_xmit_c_, _drv_err_,
+				 ("xmitframe_complete: TID(%d) should be 0~15!\n",
+				  pxmitframe->attrib.priority));
+			rtw_free_xmitframe(pxmitpriv, pxmitframe);
+			continue;
+		}
+#endif
+
+//		pxmitframe->pxmitbuf = pxmitbuf;
+		pxmitframe->buf_addr = pxmitbuf->pbuf + pbuf;
+
+		pxmitframe->agg_num = 0; // not first frame of aggregation
+		pxmitframe->pkt_offset = 0; // not first frame of aggregation, no need to reserve offset
+
+		if (rtw_xmitframe_coalesce(padapter, pxmitframe->pkt, pxmitframe) == _FALSE) {
+			DBG_871X("%s coalesce failed \n",__FUNCTION__);
+			rtw_free_xmitframe(pxmitpriv, pxmitframe);
+			continue;
+		}
+
+		// always return ndis_packet after rtw_xmitframe_coalesce
+		rtw_os_xmit_complete(padapter, pxmitframe);
+
+		// (len - TXDESC_SIZE) == pxmitframe->attrib.last_txcmdsz
+		update_txdesc(pxmitframe, pxmitframe->buf_addr, pxmitframe->attrib.last_txcmdsz, _TRUE);
+
+		// don't need xmitframe any more
+		rtw_free_xmitframe(pxmitpriv, pxmitframe);
+
+		// handle pointer and stop condition
+		pbuf_tail = pbuf + len;
+		pbuf = _RND8(pbuf_tail);
+
+		pfirstframe->agg_num++;
+		if (MAX_TX_AGG_PACKET_NUMBER == pfirstframe->agg_num)
+			break;
+
+		if (pbuf < bulkPtr) {
+			descCount++;
+			if (descCount == pHalData->UsbTxAggDescNum)
+				break;
+		} else {
+			descCount = 0;
+			bulkPtr = ((pbuf / bulkSize) + 1) * bulkSize;
+		}
+	}
+	if (_rtw_queue_empty(&ptxservq->sta_pending) == _TRUE)
+		rtw_list_delete(&ptxservq->tx_pending);
+
+	_exit_critical_bh(&pxmitpriv->lock, &irqL);
+
+	if ((pfirstframe->attrib.ether_type != 0x0806) &&
+	    (pfirstframe->attrib.ether_type != 0x888e) &&
+	    (pfirstframe->attrib.dhcp_pkt != 1))
+	{
+		rtw_issue_addbareq_cmd(padapter, pfirstframe);
+	}
+
+#ifndef CONFIG_USE_USB_BUFFER_ALLOC_TX
+	//3 3. update first frame txdesc
+	if ((pbuf_tail % bulkSize) == 0) {
+		// remove pkt_offset
+		pbuf_tail -= PACKET_OFFSET_SZ;
+		pfirstframe->buf_addr += PACKET_OFFSET_SZ;
+		pfirstframe->pkt_offset = 0;
+	}
+#endif	// CONFIG_USE_USB_BUFFER_ALLOC_TX
+	update_txdesc(pfirstframe, pfirstframe->buf_addr, pfirstframe->attrib.last_txcmdsz, _TRUE);
+
+	//3 4. write xmit buffer to USB FIFO
+	ff_hwaddr = rtw_get_ff_hwaddr(pfirstframe);
+
+	// xmit address == ((xmit_frame*)pxmitbuf->priv_data)->buf_addr
+	rtw_write_port(padapter, ff_hwaddr, pbuf_tail, (u8*)pxmitbuf);
+
+
+	//3 5. update statisitc
+	pbuf_tail -= (pfirstframe->agg_num * TXDESC_SIZE);
+	if (pfirstframe->pkt_offset == 1) pbuf_tail -= PACKET_OFFSET_SZ;
+
+	rtw_count_tx_stats(padapter, pfirstframe, pbuf_tail);
+
+	rtw_free_xmitframe(pxmitpriv, pfirstframe);
+
+	return _TRUE;
+}
+
+#else
+
+s32 rtl8192cu_xmitframe_complete(_adapter *padapter, struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf)
+{
+
+	struct hw_xmit *phwxmits;
+	sint hwentry;
+	struct xmit_frame *pxmitframe=NULL;
+	int res=_SUCCESS, xcnt = 0;
+
+	phwxmits = pxmitpriv->hwxmits;
+	hwentry = pxmitpriv->hwxmit_entry;
+
+	RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("xmitframe_complete()\n"));
+
+	if(pxmitbuf==NULL)
+	{
+		pxmitbuf = rtw_alloc_xmitbuf(pxmitpriv);
+		if(!pxmitbuf)
+		{
+			return _FALSE;
+		}
+	}
+
+
+	do
+	{
+		pxmitframe =  rtw_dequeue_xframe(pxmitpriv, phwxmits, hwentry);
+
+		if(pxmitframe)
+		{
+			pxmitframe->pxmitbuf = pxmitbuf;
+
+			pxmitframe->buf_addr = pxmitbuf->pbuf;
+
+			pxmitbuf->priv_data = pxmitframe;
+
+			if((pxmitframe->frame_tag&0x0f) == DATA_FRAMETAG)
+			{
+				if(pxmitframe->attrib.priority<=15)//TID0~15
+				{
+					res = rtw_xmitframe_coalesce(padapter, pxmitframe->pkt, pxmitframe);
+				}
+
+				rtw_os_xmit_complete(padapter, pxmitframe);//always return ndis_packet after rtw_xmitframe_coalesce
+			}
+
+
+			RT_TRACE(_module_rtl871x_xmit_c_,_drv_info_,("xmitframe_complete(): rtw_dump_xframe\n"));
+
+
+			if(res == _SUCCESS)
+			{
+				rtw_dump_xframe(padapter, pxmitframe);
+			}
+			else
+			{
+				rtw_free_xmitbuf(pxmitpriv, pxmitbuf);
+				rtw_free_xmitframe(pxmitpriv, pxmitframe);
+			}
+
+			xcnt++;
+
+		}
+		else
+		{
+			rtw_free_xmitbuf(pxmitpriv, pxmitbuf);
+			return _FALSE;
+		}
+
+		break;
+
+	}while(0/*xcnt < (NR_XMITFRAME >> 3)*/);
+
+	return _TRUE;
+
+}
+#endif
+
+
+
+static s32 xmitframe_direct(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	s32 res = _SUCCESS;
+
+
+	res = rtw_xmitframe_coalesce(padapter, pxmitframe->pkt, pxmitframe);
+	if (res == _SUCCESS) {
+		rtw_dump_xframe(padapter, pxmitframe);
+	}
+
+	return res;
+}
+
+/*
+ * Return
+ *	_TRUE	dump packet directly
+ *	_FALSE	enqueue packet
+ */
+static s32 pre_xmitframe(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+        _irqL irqL;
+	s32 res;
+	struct xmit_buf *pxmitbuf = NULL;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+	struct pkt_attrib *pattrib = &pxmitframe->attrib;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+
+	_enter_critical_bh(&pxmitpriv->lock, &irqL);
+
+
+	if (rtw_txframes_sta_ac_pending(padapter, pattrib) > 0)
+		goto enqueue;
+
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE)
+		goto enqueue;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (check_buddy_fwstate(padapter, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE)
+		goto enqueue;
+#endif
+
+	pxmitbuf = rtw_alloc_xmitbuf(pxmitpriv);
+	if (pxmitbuf == NULL)
+		goto enqueue;
+
+	_exit_critical_bh(&pxmitpriv->lock, &irqL);
+
+	pxmitframe->pxmitbuf = pxmitbuf;
+	pxmitframe->buf_addr = pxmitbuf->pbuf;
+	pxmitbuf->priv_data = pxmitframe;
+
+	if (xmitframe_direct(padapter, pxmitframe) != _SUCCESS) {
+		rtw_free_xmitbuf(pxmitpriv, pxmitbuf);
+		rtw_free_xmitframe(pxmitpriv, pxmitframe);
+	}
+
+	return _TRUE;
+
+enqueue:
+	res = rtw_xmitframe_enqueue(padapter, pxmitframe);
+	_exit_critical_bh(&pxmitpriv->lock, &irqL);
+
+	if (res != _SUCCESS) {
+		RT_TRACE(_module_xmit_osdep_c_, _drv_err_, ("pre_xmitframe: enqueue xmitframe fail\n"));
+		rtw_free_xmitframe(pxmitpriv, pxmitframe);
+
+		// Trick, make the statistics correct
+		pxmitpriv->tx_pkts--;
+		pxmitpriv->tx_drop++;
+		return _TRUE;
+	}
+
+	return _FALSE;
+}
+
+s32 rtl8192cu_mgnt_xmit(_adapter *padapter, struct xmit_frame *pmgntframe)
+{
+	return rtw_dump_xframe(padapter, pmgntframe);
+}
+
+/*
+ * Return
+ *	_TRUE	dump packet directly ok
+ *	_FALSE	temporary can't transmit packets to hardware
+ */
+s32 rtl8192cu_hal_xmit(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	return pre_xmitframe(padapter, pxmitframe);
+}
+
+s32	 rtl8192cu_hal_xmitframe_enqueue(_adapter *padapter, struct xmit_frame *pxmitframe)
+{
+	struct xmit_priv 	*pxmitpriv = &padapter->xmitpriv;
+	s32 err;
+
+	if ((err=rtw_xmitframe_enqueue(padapter, pxmitframe)) != _SUCCESS)
+	{
+		rtw_free_xmitframe(pxmitpriv, pxmitframe);
+
+		// Trick, make the statistics correct
+		pxmitpriv->tx_pkts--;
+		pxmitpriv->tx_drop++;
+	}
+	else
+	{
+#ifdef PLATFORM_LINUX
+		tasklet_hi_schedule(&pxmitpriv->xmit_tasklet);
+#endif
+	}
+
+	return err;
+
+}
+
+#ifdef  CONFIG_HOSTAPD_MLME
+
+static void rtl8192cu_hostap_mgnt_xmit_cb(struct urb *urb)
+{
+#ifdef PLATFORM_LINUX
+	struct sk_buff *skb = (struct sk_buff *)urb->context;
+
+	//DBG_8192C("%s\n", __FUNCTION__);
+
+	rtw_skb_free(skb);
+#endif
+}
+
+s32 rtl8192cu_hostap_mgnt_xmit_entry(_adapter *padapter, _pkt *pkt)
+{
+#ifdef PLATFORM_LINUX
+	u16 fc;
+	int rc, len, pipe;
+	unsigned int bmcst, tid, qsel;
+	struct sk_buff *skb, *pxmit_skb;
+	struct urb *urb;
+	unsigned char *pxmitbuf;
+	struct tx_desc *ptxdesc;
+	struct rtw_ieee80211_hdr *tx_hdr;
+	struct hostapd_priv *phostapdpriv = padapter->phostapdpriv;
+	struct net_device *pnetdev = padapter->pnetdev;
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(padapter);
+	struct dvobj_priv *pdvobj = adapter_to_dvobj(padapter);
+
+
+	//DBG_8192C("%s\n", __FUNCTION__);
+
+	skb = pkt;
+
+	len = skb->len;
+	tx_hdr = (struct rtw_ieee80211_hdr *)(skb->data);
+	fc = le16_to_cpu(tx_hdr->frame_ctl);
+	bmcst = IS_MCAST(tx_hdr->addr1);
+
+	if ((fc & RTW_IEEE80211_FCTL_FTYPE) != RTW_IEEE80211_FTYPE_MGMT)
+		goto _exit;
+
+	pxmit_skb = rtw_skb_alloc(len + TXDESC_SIZE);
+
+	if(!pxmit_skb)
+		goto _exit;
+
+	pxmitbuf = pxmit_skb->data;
+
+	urb = usb_alloc_urb(0, GFP_ATOMIC);
+	if (!urb) {
+		goto _exit;
+	}
+
+	// ----- fill tx desc -----
+	ptxdesc = (struct tx_desc *)pxmitbuf;
+	_rtw_memset(ptxdesc, 0, sizeof(*ptxdesc));
+
+	//offset 0
+	ptxdesc->txdw0 |= cpu_to_le32(len&0x0000ffff);
+	ptxdesc->txdw0 |= cpu_to_le32(((TXDESC_SIZE+OFFSET_SZ)<<OFFSET_SHT)&0x00ff0000);//default = 32 bytes for TX Desc
+	ptxdesc->txdw0 |= cpu_to_le32(OWN | FSG | LSG);
+
+	if(bmcst)
+	{
+		ptxdesc->txdw0 |= cpu_to_le32(BIT(24));
+	}
+
+	//offset 4
+	ptxdesc->txdw1 |= cpu_to_le32(0x00);//MAC_ID
+
+	ptxdesc->txdw1 |= cpu_to_le32((0x12<<QSEL_SHT)&0x00001f00);
+
+	ptxdesc->txdw1 |= cpu_to_le32((0x06<< 16) & 0x000f0000);//b mode
+
+	//offset 8
+
+	//offset 12
+	ptxdesc->txdw3 |= cpu_to_le32((le16_to_cpu(tx_hdr->seq_ctl)<<16)&0xffff0000);
+
+	//offset 16
+	ptxdesc->txdw4 |= cpu_to_le32(BIT(8));//driver uses rate
+
+	//offset 20
+
+
+	//HW append seq
+	ptxdesc->txdw4 |= cpu_to_le32(BIT(7)); // Hw set sequence number
+	ptxdesc->txdw3 |= cpu_to_le32((8 <<28)); //set bit3 to 1. Suugested by TimChen. 2009.12.29.
+
+
+	rtl8192cu_cal_txdesc_chksum(ptxdesc);
+	// ----- end of fill tx desc -----
+
+	//
+	skb_put(pxmit_skb, len + TXDESC_SIZE);
+	pxmitbuf = pxmitbuf + TXDESC_SIZE;
+	_rtw_memcpy(pxmitbuf, skb->data, len);
+
+	//DBG_8192C("mgnt_xmit, len=%x\n", pxmit_skb->len);
+
+
+	// ----- prepare urb for submit -----
+
+	//translate DMA FIFO addr to pipehandle
+	//pipe = ffaddr2pipehdl(pdvobj, MGT_QUEUE_INX);
+	pipe = usb_sndbulkpipe(pdvobj->pusbdev, pHalData->Queue2EPNum[(u8)MGT_QUEUE_INX]&0x0f);
+
+	usb_fill_bulk_urb(urb, pdvobj->pusbdev, pipe,
+			  pxmit_skb->data, pxmit_skb->len, rtl8192cu_hostap_mgnt_xmit_cb, pxmit_skb);
+
+	urb->transfer_flags |= URB_ZERO_PACKET;
+	usb_anchor_urb(urb, &phostapdpriv->anchored);
+	rc = usb_submit_urb(urb, GFP_ATOMIC);
+	if (rc < 0) {
+		usb_unanchor_urb(urb);
+		kfree_skb(skb);
+	}
+	usb_free_urb(urb);
+
+
+_exit:
+
+	rtw_skb_free(skb);
+
+#endif
+
+	return 0;
+
+}
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_halinit.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_halinit.c
new file mode 100644
index 000000000000..72d5bc82d2d5
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_halinit.c
@@ -0,0 +1,6261 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _HCI_HAL_INIT_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_efuse.h>
+
+#include <rtl8192c_hal.h>
+#include <rtl8192c_led.h>
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+#include "rtl8192c_sreset.h"
+#endif
+
+#ifdef CONFIG_IOL
+#include <rtw_iol.h>
+#endif
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+
+#error "Shall be Linux or Windows, but not both!\n"
+
+#endif
+
+#ifndef CONFIG_USB_HCI
+
+#error "CONFIG_USB_HCI shall be on!\n"
+
+#endif
+
+#include <usb_ops.h>
+#include <usb_hal.h>
+#include <usb_osintf.h>
+
+#if DISABLE_BB_RF
+	#define		HAL_MAC_ENABLE	0
+	#define		HAL_BB_ENABLE		0
+	#define		HAL_RF_ENABLE		0
+#else
+	#define		HAL_MAC_ENABLE	1
+	#define		HAL_BB_ENABLE		1
+	#define		HAL_RF_ENABLE		1
+#endif
+
+//endpoint number 1,2,3,4,5
+// bult in : 1
+// bult out: 2 (High)
+// bult out: 3 (Normal) for 3 out_ep, (Low) for 2 out_ep
+// interrupt in: 4
+// bult out: 5 (Low) for 3 out_ep
+
+
+static VOID
+_OneOutEpMapping(
+	IN	HAL_DATA_TYPE	*pHalData
+	)
+{
+	//only endpoint number 0x02
+
+	pHalData->Queue2EPNum[0] = pHalData->RtBulkOutPipe[0];//VO
+	pHalData->Queue2EPNum[1] = pHalData->RtBulkOutPipe[0];//VI
+	pHalData->Queue2EPNum[2] = pHalData->RtBulkOutPipe[0];//BE
+	pHalData->Queue2EPNum[3] = pHalData->RtBulkOutPipe[0];//BK
+
+	pHalData->Queue2EPNum[4] = pHalData->RtBulkOutPipe[0];//BCN
+	pHalData->Queue2EPNum[5] = pHalData->RtBulkOutPipe[0];//MGT
+	pHalData->Queue2EPNum[6] = pHalData->RtBulkOutPipe[0];//HIGH
+	pHalData->Queue2EPNum[7] = pHalData->RtBulkOutPipe[0];//TXCMD
+}
+
+
+static VOID
+_TwoOutEpMapping(
+	IN	HAL_DATA_TYPE	*pHalData,
+	IN	BOOLEAN	 		bWIFICfg
+	)
+{
+
+/*
+#define VO_QUEUE_INX		0
+#define VI_QUEUE_INX		1
+#define BE_QUEUE_INX		2
+#define BK_QUEUE_INX		3
+#define BCN_QUEUE_INX	4
+#define MGT_QUEUE_INX	5
+#define HIGH_QUEUE_INX	6
+#define TXCMD_QUEUE_INX	7
+*/
+	if(bWIFICfg){ // Normal chip && wmm
+
+		//	BK, 	BE, 	VI, 	VO, 	BCN,	CMD,MGT,HIGH,HCCA
+		//{  0, 	1, 	0, 	1, 	0, 	0, 	0, 	0, 		0	};
+		//0:H(end_number=0x02), 1:L (end_number=0x03)
+
+		pHalData->Queue2EPNum[0] = pHalData->RtBulkOutPipe[1];//VO
+		pHalData->Queue2EPNum[1] = pHalData->RtBulkOutPipe[0];//VI
+		pHalData->Queue2EPNum[2] = pHalData->RtBulkOutPipe[1];//BE
+		pHalData->Queue2EPNum[3] = pHalData->RtBulkOutPipe[0];//BK
+
+		pHalData->Queue2EPNum[4] = pHalData->RtBulkOutPipe[0];//BCN
+		pHalData->Queue2EPNum[5] = pHalData->RtBulkOutPipe[0];//MGT
+		pHalData->Queue2EPNum[6] = pHalData->RtBulkOutPipe[0];//HIGH
+		pHalData->Queue2EPNum[7] = pHalData->RtBulkOutPipe[0];//TXCMD
+	}
+	else{//typical setting
+
+		//BK, 	BE, 	VI, 	VO, 	BCN,	CMD,MGT,HIGH,HCCA
+		//{  1, 	1, 	0, 	0, 	0, 	0, 	0, 	0, 		0	};
+		//0:H(end_number=0x02), 1:L (end_number=0x03)
+
+		pHalData->Queue2EPNum[0] = pHalData->RtBulkOutPipe[0];//VO
+		pHalData->Queue2EPNum[1] = pHalData->RtBulkOutPipe[0];//VI
+		pHalData->Queue2EPNum[2] = pHalData->RtBulkOutPipe[1];//BE
+		pHalData->Queue2EPNum[3] = pHalData->RtBulkOutPipe[1];//BK
+
+		pHalData->Queue2EPNum[4] = pHalData->RtBulkOutPipe[0];//BCN
+		pHalData->Queue2EPNum[5] = pHalData->RtBulkOutPipe[0];//MGT
+		pHalData->Queue2EPNum[6] = pHalData->RtBulkOutPipe[0];//HIGH
+		pHalData->Queue2EPNum[7] = pHalData->RtBulkOutPipe[0];//TXCMD
+	}
+
+}
+
+
+static VOID _ThreeOutEpMapping(
+	IN	HAL_DATA_TYPE	*pHalData,
+	IN	BOOLEAN	 		bWIFICfg
+	)
+{
+	if(bWIFICfg){//for WMM
+
+		//	BK, 	BE, 	VI, 	VO, 	BCN,	CMD,MGT,HIGH,HCCA
+		//{  1, 	2, 	1, 	0, 	0, 	0, 	0, 	0, 		0	};
+		//0:H(end_number=0x02), 1:N(end_number=0x03), 2:L (end_number=0x05)
+
+		pHalData->Queue2EPNum[0] = pHalData->RtBulkOutPipe[0];//VO
+		pHalData->Queue2EPNum[1] = pHalData->RtBulkOutPipe[1];//VI
+		pHalData->Queue2EPNum[2] = pHalData->RtBulkOutPipe[2];//BE
+		pHalData->Queue2EPNum[3] = pHalData->RtBulkOutPipe[1];//BK
+
+		pHalData->Queue2EPNum[4] = pHalData->RtBulkOutPipe[0];//BCN
+		pHalData->Queue2EPNum[5] = pHalData->RtBulkOutPipe[0];//MGT
+		pHalData->Queue2EPNum[6] = pHalData->RtBulkOutPipe[0];//HIGH
+		pHalData->Queue2EPNum[7] = pHalData->RtBulkOutPipe[0];//TXCMD
+	}
+	else{//typical setting
+
+		//	BK, 	BE, 	VI, 	VO, 	BCN,	CMD,MGT,HIGH,HCCA
+		//{  2, 	2, 	1, 	0, 	0, 	0, 	0, 	0, 		0	};
+		//0:H(end_number=0x02), 1:N(end_number=0x03), 2:L (end_number=0x05)
+		pHalData->Queue2EPNum[0] = pHalData->RtBulkOutPipe[0];//VO
+		pHalData->Queue2EPNum[1] = pHalData->RtBulkOutPipe[1];//VI
+		pHalData->Queue2EPNum[2] = pHalData->RtBulkOutPipe[2];//BE
+		pHalData->Queue2EPNum[3] = pHalData->RtBulkOutPipe[2];//BK
+
+		pHalData->Queue2EPNum[4] = pHalData->RtBulkOutPipe[0];//BCN
+		pHalData->Queue2EPNum[5] = pHalData->RtBulkOutPipe[0];//MGT
+		pHalData->Queue2EPNum[6] = pHalData->RtBulkOutPipe[0];//HIGH
+		pHalData->Queue2EPNum[7] = pHalData->RtBulkOutPipe[0];//TXCMD
+	}
+
+}
+
+static BOOLEAN
+_MappingOutEP(
+	IN	PADAPTER	pAdapter,
+	IN	u8		NumOutPipe
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct registry_priv *pregistrypriv = &pAdapter->registrypriv;
+
+	BOOLEAN	 bWIFICfg = (pregistrypriv->wifi_spec) ?_TRUE:_FALSE;
+
+	BOOLEAN result = _TRUE;
+
+	switch(NumOutPipe)
+	{
+		case 2:
+			_TwoOutEpMapping(pHalData, bWIFICfg);
+			break;
+		case 3:
+			_ThreeOutEpMapping(pHalData, bWIFICfg);
+			break;
+		case 1:
+			_OneOutEpMapping(pHalData);
+			break;
+		default:
+			result = _FALSE;
+			break;
+	}
+
+	return result;
+
+}
+
+static VOID
+_ConfigChipOutEP(
+	IN	PADAPTER	pAdapter,
+	IN	u8		NumOutPipe
+	)
+{
+	u8			value8;
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(pAdapter);
+
+	pHalData->OutEpQueueSel = 0;
+	pHalData->OutEpNumber	= 0;
+
+	// Normal and High queue
+	value8 = rtw_read8(pAdapter, (REG_NORMAL_SIE_EP + 1));
+
+	if(value8 & USB_NORMAL_SIE_EP_MASK){
+		pHalData->OutEpQueueSel |= TX_SELE_HQ;
+		pHalData->OutEpNumber++;
+	}
+
+#ifdef CONFIG_USB_ONE_OUT_EP
+		return;
+#endif
+
+	if((value8 >> USB_NORMAL_SIE_EP_SHIFT) & USB_NORMAL_SIE_EP_MASK){
+		pHalData->OutEpQueueSel |= TX_SELE_NQ;
+		pHalData->OutEpNumber++;
+	}
+
+	// Low queue
+	value8 = rtw_read8(pAdapter, (REG_NORMAL_SIE_EP + 2));
+	if(value8 & USB_NORMAL_SIE_EP_MASK){
+		pHalData->OutEpQueueSel |= TX_SELE_LQ;
+		pHalData->OutEpNumber++;
+	}
+
+	// TODO: Error recovery for this case
+	//RT_ASSERT((NumOutPipe == pHalData->OutEpNumber), ("Out EP number isn't match! %d(Descriptor) != %d (SIE reg)\n", (u4Byte)NumOutPipe, (u4Byte)pHalData->OutEpNumber));
+
+}
+
+static BOOLEAN HalUsbSetQueuePipeMapping8192CUsb(
+	IN	PADAPTER	pAdapter,
+	IN	u8		NumInPipe,
+	IN	u8		NumOutPipe
+	)
+{
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(pAdapter);
+	BOOLEAN			result		= _FALSE;
+
+	_ConfigChipOutEP(pAdapter, NumOutPipe);
+
+	#ifndef CONFIG_USB_ONE_OUT_EP
+	// Normal chip with one IN and one OUT doesn't have interrupt IN EP.
+	if(1 == pHalData->OutEpNumber){
+		if(1 != NumInPipe){
+			return result;
+		}
+	}
+	#endif
+	result = _MappingOutEP(pAdapter, NumOutPipe);
+
+	return result;
+
+}
+
+void rtl8192cu_interface_configure(_adapter *padapter)
+{
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(padapter);
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+
+	if (pdvobjpriv->ishighspeed == _TRUE)
+	{
+		pHalData->UsbBulkOutSize = USB_HIGH_SPEED_BULK_SIZE;//512 bytes
+	}
+	else
+	{
+		pHalData->UsbBulkOutSize = USB_FULL_SPEED_BULK_SIZE;//64 bytes
+	}
+
+	pHalData->interfaceIndex = pdvobjpriv->InterfaceNumber;
+	pHalData->RtBulkInPipe = pdvobjpriv->ep_num[0];
+	pHalData->RtBulkOutPipe[0] = pdvobjpriv->ep_num[1];
+	pHalData->RtBulkOutPipe[1] = pdvobjpriv->ep_num[2];
+	pHalData->RtIntInPipe = pdvobjpriv->ep_num[3];
+	pHalData->RtBulkOutPipe[2] = pdvobjpriv->ep_num[4];
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+	pHalData->UsbTxAggMode		= 1;
+	pHalData->UsbTxAggDescNum	= 0x6;	// only 4 bits
+#endif
+
+#ifdef CONFIG_USB_RX_AGGREGATION
+	pHalData->UsbRxAggMode		= USB_RX_AGG_DMA;// USB_RX_AGG_DMA;
+	pHalData->UsbRxAggBlockCount	= 8; //unit : 512b
+	pHalData->UsbRxAggBlockTimeout	= 0x6;
+	pHalData->UsbRxAggPageCount	= 48; //uint :128 b //0x0A;	// 10 = MAX_RX_DMA_BUFFER_SIZE/2/pHalData->UsbBulkOutSize
+	pHalData->UsbRxAggPageTimeout	= 0x4; //6, absolute time = 34ms/(2^6)
+#endif
+
+	HalUsbSetQueuePipeMapping8192CUsb(padapter, pdvobjpriv->RtNumInPipes,
+		#ifdef CONFIG_USB_ONE_OUT_EP
+		1
+		#else
+		pdvobjpriv->RtNumOutPipes
+		#endif
+		);
+
+}
+
+static u8 _InitPowerOn(_adapter *padapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	u8	ret = _SUCCESS;
+	u16	value16=0;
+	u8	value8 = 0;
+	u32  value32 = 0;
+
+	// polling autoload done.
+	u32	pollingCount = 0;
+
+	do
+	{
+		if(rtw_read8(padapter, REG_APS_FSMCO) & PFM_ALDN){
+			//RT_TRACE(COMP_INIT,DBG_LOUD,("Autoload Done!\n"));
+			break;
+		}
+
+		if(pollingCount++ > POLLING_READY_TIMEOUT_COUNT){
+			//RT_TRACE(COMP_INIT,DBG_SERIOUS,("Failed to polling REG_APS_FSMCO[PFM_ALDN] done!\n"));
+			return _FAIL;
+		}
+
+	}while(_TRUE);
+
+
+//	For hardware power on sequence.
+
+	//0.	RSV_CTRL 0x1C[7:0] = 0x00			// unlock ISO/CLK/Power control register
+	rtw_write8(padapter, REG_RSV_CTRL, 0x0);
+	// Power on when re-enter from IPS/Radio off/card disable
+	rtw_write8(padapter, REG_SPS0_CTRL, 0x2b);//enable SPS into PWM mode
+/*
+	value16 = PlatformIORead2Byte(Adapter, REG_AFE_XTAL_CTRL);//enable AFE clock
+	value16 &=  (~XTAL_GATE_AFE);
+	PlatformIOWrite2Byte(Adapter,REG_AFE_XTAL_CTRL, value16 );
+*/
+
+	rtw_udelay_os(100);//PlatformSleepUs(150);//this is not necessary when initially power on
+
+	value8 = rtw_read8(padapter, REG_LDOV12D_CTRL);
+	if(0== (value8 & LDV12_EN) ){
+		value8 |= LDV12_EN;
+		rtw_write8(padapter, REG_LDOV12D_CTRL, value8);
+		//RT_TRACE(COMP_INIT, DBG_LOUD, (" power-on :REG_LDOV12D_CTRL Reg0x21:0x%02x.\n",value8));
+		rtw_udelay_os(100);//PlatformSleepUs(100);//this is not necessary when initially power on
+		value8 = rtw_read8(padapter, REG_SYS_ISO_CTRL);
+		value8 &= ~ISO_MD2PP;
+		rtw_write8(padapter, REG_SYS_ISO_CTRL, value8);
+	}
+
+	// auto enable WLAN
+	pollingCount = 0;
+	value16 = rtw_read16(padapter, REG_APS_FSMCO);
+	value16 |= APFM_ONMAC;
+	rtw_write16(padapter, REG_APS_FSMCO, value16);
+
+	do
+	{
+		if(0 == (rtw_read16(padapter, REG_APS_FSMCO) & APFM_ONMAC)){
+			//RT_TRACE(COMP_INIT,DBG_LOUD,("MAC auto ON okay!\n"));
+			break;
+		}
+
+		if(pollingCount++ > POLLING_READY_TIMEOUT_COUNT){
+			//RT_TRACE(COMP_INIT,DBG_SERIOUS,("Failed to polling REG_APS_FSMCO[APFM_ONMAC] done!\n"));
+			return _FAIL;
+		}
+
+	}while(_TRUE);
+
+	//Enable Radio ,GPIO ,and LED function
+	rtw_write16(padapter,REG_APS_FSMCO,0x0812);
+
+#ifdef CONFIG_AUTOSUSPEND
+	//for usb Combo card ,BT
+	if((BOARD_USB_COMBO == pHalData->BoardType)&&(padapter->registrypriv.usbss_enable))
+	{
+		value32 =  rtw_read32(padapter, REG_APS_FSMCO);
+		value32 |= (SOP_ABG|SOP_AMB|XOP_BTCK);
+		rtw_write32(padapter, REG_APS_FSMCO, value32);
+	}
+#endif
+
+	// release RF digital isolation
+	value16 = rtw_read16(padapter, REG_SYS_ISO_CTRL);
+	value16 &= ~ISO_DIOR;
+	rtw_write16(padapter, REG_SYS_ISO_CTRL, value16);
+
+	// Enable MAC DMA/WMAC/SCHEDULE/SEC block
+	value16 = rtw_read16(padapter, REG_CR);
+	value16 |= (HCI_TXDMA_EN | HCI_RXDMA_EN | TXDMA_EN | RXDMA_EN
+				| PROTOCOL_EN | SCHEDULE_EN | MACTXEN | MACRXEN | ENSEC);
+	rtw_write16(padapter, REG_CR, value16);
+
+	//tynli_test for suspend mode.
+	{
+		rtw_write8(padapter,  0xfe10, 0x19);
+	}
+
+	// 2010/11/22 MH For slim combo debug mode check.
+	if (pHalData->BoardType == BOARD_USB_COMBO)
+	{
+		if (pHalData->SlimComboDbg == _TRUE)
+		{
+			DBG_8192C("SlimComboDbg == TRUE\n");
+
+			// 1. SIC?Test Mode ��, Debug Ports �|�۰� Enable, �ҥH Driver �W�ӫ�,
+			//	�n�����г]�w 0x 00[7] -> "1", �N�� Disable.   effect if not: power consumption increase
+			rtw_write8(padapter, REG_SYS_ISO_CTRL, rtw_read8(padapter, REG_SYS_ISO_CTRL)|BIT7);
+
+			// 2. SIC?Test Mode ��, GPIO-8?�| report Power State �ҥH Driver �W�ӫ�, �г]�w? 0x04[6] -> "1" �N�� Disable
+			// effect if not: GPIO-8 could not be GPIO or LED function
+			rtw_write8(padapter, REG_APS_FSMCO, rtw_read8(padapter, REG_APS_FSMCO)|BIT6);
+
+			// 3. SIC Test Mode ��, EESK, EECS �| report?Host Clock status, �ҥH Driver �W�ӫ�, �г]�w? 0x40[4] -> "1" �N������ EEPROM �ϥ� Pin (autoload still from Efuse)
+			//  effect if not:power consumption increase
+			value8 = rtw_read8(padapter, REG_GPIO_MUXCFG)|BIT4 ;
+		#ifdef CONFIG_BT_COEXIST
+			// 2011/01/26 MH UMB-B cut bug. We need to support the modification.
+			if (IS_81xxC_VENDOR_UMC_B_CUT(pHalData->VersionID) &&
+				pHalData->bt_coexist.BT_Coexist)
+			{
+				value8 |= (BIT5);
+			}
+		#endif
+			rtw_write8(padapter, REG_GPIO_MUXCFG,value8 );
+
+
+			// 4. SIC Test Mode ��,?SIC Debug ports �|�۰� Enable , �ҥH Driver �W�ӫᰨ�W, �г]�w? 0x40[15:11] -> ��0x00��, �N��Disable
+			//  4.1Two Steps setting for safety: 0x40[15,13,12, 11] -> "0", then ?0x40[14] -> "0"
+			// effect if not: Host could not transfer packets, and GPIO-3,2 will occupied by SIC then Co-exist could not work.
+			rtw_write16(padapter, REG_GPIO_MUXCFG, (rtw_read16(padapter, REG_GPIO_MUXCFG)&0x07FF)|BIT14);
+			rtw_write16(padapter, REG_GPIO_MUXCFG, rtw_read16(padapter, REG_GPIO_MUXCFG)&0x07FF);
+		}
+	}
+
+
+	// 2011/02/18 To Fix RU LNA  power leakage problem. We need to execute below below in
+	// Adapter init and halt sequence. Accordingto EEchou's opinion, we can enable the ability for all
+	// IC. According to Johnny's opinion, only RU will meet the condition.
+	if (IS_HARDWARE_TYPE_8192C(padapter) && (pHalData->BoardType == BOARD_USB_High_PA))
+		rtw_write32(padapter, rFPGA0_XCD_RFParameter, rtw_read32(padapter, rFPGA0_XCD_RFParameter)&(~BIT1));
+	return ret;
+
+}
+
+
+static void _dbg_dump_macreg(_adapter *padapter)
+{
+	u32 offset = 0;
+	u32 val32 = 0;
+	u32 index =0 ;
+	for(index=0;index<64;index++)
+	{
+		offset = index*4;
+		val32 = rtw_read32(padapter,offset);
+		DBG_8192C("offset : 0x%02x ,val:0x%08x\n",offset,val32);
+	}
+}
+
+
+static void _InitPABias(_adapter *padapter)
+{
+	HAL_DATA_TYPE		*pHalData	= GET_HAL_DATA(padapter);
+	u8			pa_setting;
+	BOOLEAN		is92C = IS_92C_SERIAL(pHalData->VersionID);
+
+	//FIXED PA current issue
+	//efuse_one_byte_read(padapter, 0x1FA, &pa_setting);
+	pa_setting = EFUSE_Read1Byte(padapter, 0x1FA);
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("_InitPABias 0x1FA 0x%x \n",pa_setting));
+
+	if(!(pa_setting & BIT0))
+	{
+		PHY_SetRFReg(padapter, RF_PATH_A, 0x15, 0x0FFFFF, 0x0F406);
+		PHY_SetRFReg(padapter, RF_PATH_A, 0x15, 0x0FFFFF, 0x4F406);
+		PHY_SetRFReg(padapter, RF_PATH_A, 0x15, 0x0FFFFF, 0x8F406);
+		PHY_SetRFReg(padapter, RF_PATH_A, 0x15, 0x0FFFFF, 0xCF406);
+		//RT_TRACE(COMP_INIT, DBG_LOUD, ("PA BIAS path A\n"));
+	}
+
+	if(!(pa_setting & BIT1) && is92C)
+	{
+		PHY_SetRFReg(padapter,RF_PATH_B, 0x15, 0x0FFFFF, 0x0F406);
+		PHY_SetRFReg(padapter,RF_PATH_B, 0x15, 0x0FFFFF, 0x4F406);
+		PHY_SetRFReg(padapter,RF_PATH_B, 0x15, 0x0FFFFF, 0x8F406);
+		PHY_SetRFReg(padapter,RF_PATH_B, 0x15, 0x0FFFFF, 0xCF406);
+		//RT_TRACE(COMP_INIT, DBG_LOUD, ("PA BIAS path B\n"));
+	}
+
+	if(!(pa_setting & BIT4))
+	{
+		pa_setting = rtw_read8(padapter, 0x16);
+		pa_setting &= 0x0F;
+		rtw_write8(padapter, 0x16, pa_setting | 0x90);
+	}
+}
+#ifdef CONFIG_BT_COEXIST
+static void _InitBTCoexist(_adapter *padapter)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(padapter);
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+	u8 u1Tmp;
+
+	if(pbtpriv->BT_Coexist && pbtpriv->BT_CoexistType == BT_CSR_BC4)
+	{
+
+#if MP_DRIVER != 1
+		if(pbtpriv->BT_Ant_isolation)
+		{
+			rtw_write8( padapter,REG_GPIO_MUXCFG, 0xa0);
+			DBG_8192C("BT write 0x%x = 0x%x\n", REG_GPIO_MUXCFG, 0xa0);
+		}
+#endif
+
+		u1Tmp = rtw_read8(padapter, 0x4fd) & BIT0;
+		u1Tmp = u1Tmp |
+				((pbtpriv->BT_Ant_isolation==1)?0:BIT1) |
+				((pbtpriv->BT_Service==BT_SCO)?0:BIT2);
+		rtw_write8( padapter, 0x4fd, u1Tmp);
+		DBG_8192C("BT write 0x%x = 0x%x for non-isolation\n", 0x4fd, u1Tmp);
+
+
+		rtw_write32(padapter, REG_BT_COEX_TABLE+4, 0xaaaa9aaa);
+		DBG_8192C("BT write 0x%x = 0x%x\n", REG_BT_COEX_TABLE+4, 0xaaaa9aaa);
+
+		rtw_write32(padapter, REG_BT_COEX_TABLE+8, 0xffbd0040);
+		DBG_8192C("BT write 0x%x = 0x%x\n", REG_BT_COEX_TABLE+8, 0xffbd0040);
+
+		rtw_write32(padapter,  REG_BT_COEX_TABLE+0xc, 0x40000010);
+		DBG_8192C("BT write 0x%x = 0x%x\n", REG_BT_COEX_TABLE+0xc, 0x40000010);
+
+		//Config to 1T1R
+		u1Tmp =  rtw_read8(padapter,rOFDM0_TRxPathEnable);
+		u1Tmp &= ~(BIT1);
+		rtw_write8( padapter, rOFDM0_TRxPathEnable, u1Tmp);
+		DBG_8192C("BT write 0xC04 = 0x%x\n", u1Tmp);
+
+		u1Tmp = rtw_read8(padapter, rOFDM1_TRxPathEnable);
+		u1Tmp &= ~(BIT1);
+		rtw_write8( padapter, rOFDM1_TRxPathEnable, u1Tmp);
+		DBG_8192C("BT write 0xD04 = 0x%x\n", u1Tmp);
+
+	}
+}
+#endif
+
+//-------------------------------------------------------------------------
+//
+// LLT R/W/Init function
+//
+//-------------------------------------------------------------------------
+static u8 _LLTWrite(
+	IN  PADAPTER	Adapter,
+	IN	u32		address,
+	IN	u32		data
+	)
+{
+	u8	status = _SUCCESS;
+	int 		count = 0;
+	u32 		value = _LLT_INIT_ADDR(address) | _LLT_INIT_DATA(data) | _LLT_OP(_LLT_WRITE_ACCESS);
+
+	rtw_write32(Adapter, REG_LLT_INIT, value);
+
+	//polling
+	do{
+
+		value = rtw_read32(Adapter, REG_LLT_INIT);
+		if(_LLT_NO_ACTIVE == _LLT_OP_VALUE(value)){
+			break;
+		}
+
+		if(count > POLLING_LLT_THRESHOLD){
+			//RT_TRACE(COMP_INIT,DBG_SERIOUS,("Failed to polling write LLT done at address %d!\n", address));
+			status = _FAIL;
+			break;
+		}
+	}while(count++);
+
+	return status;
+
+}
+
+
+static u8 _LLTRead(
+	IN  PADAPTER	Adapter,
+	IN	u32		address
+	)
+{
+	int		count = 0;
+	u32		value = _LLT_INIT_ADDR(address) | _LLT_OP(_LLT_READ_ACCESS);
+
+	rtw_write32(Adapter, REG_LLT_INIT, value);
+
+	//polling and get value
+	do{
+
+		value = rtw_read32(Adapter, REG_LLT_INIT);
+		if(_LLT_NO_ACTIVE == _LLT_OP_VALUE(value)){
+			return (u8)value;
+		}
+
+		if(count > POLLING_LLT_THRESHOLD){
+			//RT_TRACE(COMP_INIT,DBG_SERIOUS,("Failed to polling read LLT done at address %d!\n", address));
+			break;
+		}
+	}while(count++);
+
+	return 0xFF;
+
+}
+
+
+static u8 InitLLTTable(
+	IN  PADAPTER	Adapter,
+	IN	u32		boundary
+	)
+{
+	u8	status = _SUCCESS;
+	u32		i;
+
+#ifdef CONFIG_IOL_LLT
+	if(rtw_IOL_applied(Adapter))
+	{
+		struct xmit_frame	*xmit_frame;
+		if((xmit_frame=rtw_IOL_accquire_xmit_frame(Adapter)) == NULL)
+			return _FAIL;
+
+		rtw_IOL_append_LLT_cmd(xmit_frame, boundary);
+		status = rtw_IOL_exec_cmds_sync(Adapter, xmit_frame, 1000);
+	}
+	else
+#endif
+	{
+		for(i = 0 ; i < (boundary - 1) ; i++){
+			status = _LLTWrite(Adapter, i , i + 1);
+			if(_SUCCESS != status){
+				return status;
+			}
+		}
+
+		// end of list
+		status = _LLTWrite(Adapter, (boundary - 1), 0xFF);
+		if(_SUCCESS != status){
+			return status;
+		}
+
+		// Make the other pages as ring buffer
+		// This ring buffer is used as beacon buffer if we config this MAC as two MAC transfer.
+		// Otherwise used as local loopback buffer.
+		for(i = boundary ; i < LAST_ENTRY_OF_TX_PKT_BUFFER ; i++){
+			status = _LLTWrite(Adapter, i, (i + 1));
+			if(_SUCCESS != status){
+				return status;
+			}
+		}
+
+		// Let last entry point to the start entry of ring buffer
+		status = _LLTWrite(Adapter, LAST_ENTRY_OF_TX_PKT_BUFFER, boundary);
+		if(_SUCCESS != status){
+			return status;
+		}
+	}
+
+	return status;
+
+}
+
+
+//---------------------------------------------------------------
+//
+//	MAC init functions
+//
+//---------------------------------------------------------------
+static VOID
+_SetMacID(
+	IN  PADAPTER Adapter, u8* MacID
+	)
+{
+	u32 i;
+	for(i=0 ; i< MAC_ADDR_LEN ; i++){
+#ifdef  CONFIG_CONCURRENT_MODE
+		if(Adapter->iface_type == IFACE_PORT1)
+			rtw_write32(Adapter, REG_MACID1+i, MacID[i]);
+		else
+#endif
+		rtw_write32(Adapter, REG_MACID+i, MacID[i]);
+	}
+}
+
+static VOID
+_SetBSSID(
+	IN  PADAPTER Adapter, u8* BSSID
+	)
+{
+	u32 i;
+	for(i=0 ; i< MAC_ADDR_LEN ; i++){
+#ifdef  CONFIG_CONCURRENT_MODE
+		if(Adapter->iface_type == IFACE_PORT1)
+			rtw_write32(Adapter, REG_BSSID1+i, BSSID[i]);
+		else
+#endif
+		rtw_write32(Adapter, REG_BSSID+i, BSSID[i]);
+	}
+}
+
+
+// Shall USB interface init this?
+static VOID
+_InitInterrupt(
+	IN  PADAPTER Adapter
+	)
+{
+	u32	value32;
+
+	// HISR - turn all on
+	value32 = 0xFFFFFFFF;
+	rtw_write32(Adapter, REG_HISR, value32);
+
+	// HIMR - turn all on
+	rtw_write32(Adapter, REG_HIMR, value32);
+}
+
+
+static VOID
+_InitQueueReservedPage(
+	IN  PADAPTER Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(Adapter);
+	struct registry_priv *pregistrypriv = &Adapter->registrypriv;
+
+	u32			outEPNum	= (u32)pHalData->OutEpNumber;
+	u32			numHQ		= 0;
+	u32			numLQ		= 0;
+	u32			numNQ		= 0;
+	u32			numPubQ;
+	u32			value32;
+	u8			value8;
+	BOOLEAN		bWiFiConfig	= pregistrypriv->wifi_spec;
+	//u32			txQPageNum, txQPageUnit,txQRemainPage;
+
+	{ //for WMM
+		//RT_ASSERT((outEPNum>=2), ("for WMM ,number of out-ep must more than or equal to 2!\n"));
+
+		if(pHalData->OutEpQueueSel & TX_SELE_HQ){
+			numHQ = (bWiFiConfig)?WMM_NORMAL_PAGE_NUM_HPQ:NORMAL_PAGE_NUM_HPQ;
+		}
+
+		if(pHalData->OutEpQueueSel & TX_SELE_LQ){
+			numLQ = (bWiFiConfig)?WMM_NORMAL_PAGE_NUM_LPQ:NORMAL_PAGE_NUM_LPQ;
+		}
+		// NOTE: This step shall be proceed before writting REG_RQPN.
+		if(pHalData->OutEpQueueSel & TX_SELE_NQ){
+			numNQ = (bWiFiConfig)?WMM_NORMAL_PAGE_NUM_NPQ:NORMAL_PAGE_NUM_NPQ;
+		}
+		value8 = (u8)_NPQ(numNQ);
+		rtw_write8(Adapter, REG_RQPN_NPQ, value8);
+
+		if (bWiFiConfig)
+			numPubQ = WMM_NORMAL_TX_TOTAL_PAGE_NUMBER - numHQ - numLQ - numNQ;
+		else
+			numPubQ = TX_TOTAL_PAGE_NUMBER - numHQ - numLQ - numNQ;
+	}
+
+	// TX DMA
+	value32 = _HPQ(numHQ) | _LPQ(numLQ) | _PUBQ(numPubQ) | LD_RQPN;
+	rtw_write32(Adapter, REG_RQPN, value32);
+}
+
+static VOID
+_InitTxBufferBoundary(
+	IN  PADAPTER Adapter
+	)
+{
+	struct registry_priv *pregistrypriv = &Adapter->registrypriv;
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(Adapter);
+
+	u8	txpktbuf_bndy;
+
+	if(!pregistrypriv->wifi_spec){
+		txpktbuf_bndy = TX_PAGE_BOUNDARY;
+	}
+	else{//for WMM
+		txpktbuf_bndy = WMM_NORMAL_TX_PAGE_BOUNDARY;
+	}
+
+	rtw_write8(Adapter, REG_TXPKTBUF_BCNQ_BDNY, txpktbuf_bndy);
+	rtw_write8(Adapter, REG_TXPKTBUF_MGQ_BDNY, txpktbuf_bndy);
+	rtw_write8(Adapter, REG_TXPKTBUF_WMAC_LBK_BF_HD, txpktbuf_bndy);
+	rtw_write8(Adapter, REG_TRXFF_BNDY, txpktbuf_bndy);
+#if 1
+	rtw_write8(Adapter, REG_TDECTRL+1, txpktbuf_bndy);
+#else
+	txdmactrl = PlatformIORead2Byte(Adapter, REG_TDECTRL);
+	txdmactrl &= ~BCN_HEAD_MASK;
+	txdmactrl |= BCN_HEAD(txpktbuf_bndy);
+	PlatformIOWrite2Byte(Adapter, REG_TDECTRL, txdmactrl);
+#endif
+}
+
+static VOID
+_InitPageBoundary(
+	IN  PADAPTER Adapter
+	)
+{
+	// RX Page Boundary
+	//srand(static_cast<unsigned int>(time(NULL)) );
+	u16 rxff_bndy = 0x27FF;//(rand() % 1) ? 0x27FF : 0x23FF;
+
+	rtw_write16(Adapter, (REG_TRXFF_BNDY + 2), rxff_bndy);
+
+	// TODO: ?? shall we set tx boundary?
+}
+
+
+static VOID
+_InitNormalChipRegPriority(
+	IN	PADAPTER	Adapter,
+	IN	u16		beQ,
+	IN	u16		bkQ,
+	IN	u16		viQ,
+	IN	u16		voQ,
+	IN	u16		mgtQ,
+	IN	u16		hiQ
+	)
+{
+	u16 value16		= (rtw_read16(Adapter, REG_TRXDMA_CTRL) & 0x7);
+
+	value16 |=	_TXDMA_BEQ_MAP(beQ) 	| _TXDMA_BKQ_MAP(bkQ) |
+				_TXDMA_VIQ_MAP(viQ) 	| _TXDMA_VOQ_MAP(voQ) |
+				_TXDMA_MGQ_MAP(mgtQ)| _TXDMA_HIQ_MAP(hiQ);
+
+	rtw_write16(Adapter, REG_TRXDMA_CTRL, value16);
+}
+
+static VOID
+_InitNormalChipOneOutEpPriority(
+	IN	PADAPTER Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(Adapter);
+
+	u16	value = 0;
+	switch(pHalData->OutEpQueueSel)
+	{
+		case TX_SELE_HQ:
+			value = QUEUE_HIGH;
+			break;
+		case TX_SELE_LQ:
+			value = QUEUE_LOW;
+			break;
+		case TX_SELE_NQ:
+			value = QUEUE_NORMAL;
+			break;
+		default:
+			//RT_ASSERT(FALSE,("Shall not reach here!\n"));
+			break;
+	}
+
+	_InitNormalChipRegPriority(Adapter,
+								value,
+								value,
+								value,
+								value,
+								value,
+								value
+								);
+
+}
+
+static VOID
+_InitNormalChipTwoOutEpPriority(
+	IN	PADAPTER Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(Adapter);
+	struct registry_priv *pregistrypriv = &Adapter->registrypriv;
+	u16			beQ,bkQ,viQ,voQ,mgtQ,hiQ;
+
+
+	u16	valueHi = 0;
+	u16	valueLow = 0;
+
+	switch(pHalData->OutEpQueueSel)
+	{
+		case (TX_SELE_HQ | TX_SELE_LQ):
+			valueHi = QUEUE_HIGH;
+			valueLow = QUEUE_LOW;
+			break;
+		case (TX_SELE_NQ | TX_SELE_LQ):
+			valueHi = QUEUE_NORMAL;
+			valueLow = QUEUE_LOW;
+			break;
+		case (TX_SELE_HQ | TX_SELE_NQ):
+			valueHi = QUEUE_HIGH;
+			valueLow = QUEUE_NORMAL;
+			break;
+		default:
+			//RT_ASSERT(FALSE,("Shall not reach here!\n"));
+			break;
+	}
+
+	if(!pregistrypriv->wifi_spec ){
+		beQ		= valueLow;
+		bkQ		= valueLow;
+		viQ		= valueHi;
+		voQ		= valueHi;
+		mgtQ	= valueHi;
+		hiQ		= valueHi;
+	}
+	else{//for WMM ,CONFIG_OUT_EP_WIFI_MODE
+		beQ		= valueLow;
+		bkQ		= valueHi;
+		viQ		= valueHi;
+		voQ		= valueLow;
+		mgtQ	= valueHi;
+		hiQ		= valueHi;
+	}
+
+	_InitNormalChipRegPriority(Adapter,beQ,bkQ,viQ,voQ,mgtQ,hiQ);
+
+}
+
+static VOID
+_InitNormalChipThreeOutEpPriority(
+	IN	PADAPTER Adapter
+	)
+{
+	struct registry_priv *pregistrypriv = &Adapter->registrypriv;
+	u16			beQ,bkQ,viQ,voQ,mgtQ,hiQ;
+
+	if(!pregistrypriv->wifi_spec ){// typical setting
+		beQ		= QUEUE_LOW;
+		bkQ 		= QUEUE_LOW;
+		viQ 		= QUEUE_NORMAL;
+		voQ 		= QUEUE_HIGH;
+		mgtQ 	= QUEUE_HIGH;
+		hiQ 		= QUEUE_HIGH;
+	}
+	else{// for WMM
+		beQ		= QUEUE_LOW;
+		bkQ 		= QUEUE_NORMAL;
+		viQ 		= QUEUE_NORMAL;
+		voQ 		= QUEUE_HIGH;
+		mgtQ 	= QUEUE_HIGH;
+		hiQ 		= QUEUE_HIGH;
+	}
+	_InitNormalChipRegPriority(Adapter,beQ,bkQ,viQ,voQ,mgtQ,hiQ);
+}
+
+static VOID
+_InitNormalChipQueuePriority(
+	IN	PADAPTER Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(Adapter);
+
+	switch(pHalData->OutEpNumber)
+	{
+		case 1:
+			_InitNormalChipOneOutEpPriority(Adapter);
+			break;
+		case 2:
+			_InitNormalChipTwoOutEpPriority(Adapter);
+			break;
+		case 3:
+			_InitNormalChipThreeOutEpPriority(Adapter);
+			break;
+		default:
+			//RT_ASSERT(FALSE,("Shall not reach here!\n"));
+			break;
+	}
+
+
+}
+
+static VOID
+_InitQueuePriority(
+	IN  PADAPTER Adapter
+	)
+{
+	_InitNormalChipQueuePriority(Adapter);
+}
+
+static VOID
+_InitHardwareDropIncorrectBulkOut(
+	IN  PADAPTER Adapter
+	)
+{
+	u32	value32 = rtw_read32(Adapter, REG_TXDMA_OFFSET_CHK);
+	value32 |= DROP_DATA_EN;
+	rtw_write32(Adapter, REG_TXDMA_OFFSET_CHK, value32);
+}
+
+static VOID
+_InitNetworkType(
+	IN  PADAPTER Adapter
+	)
+{
+	u32	value32;
+
+	value32 = rtw_read32(Adapter, REG_CR);
+
+	// TODO: use the other function to set network type
+#if RTL8191C_FPGA_NETWORKTYPE_ADHOC
+	value32 = (value32 & ~MASK_NETTYPE) | _NETTYPE(NT_LINK_AD_HOC);
+#else
+	value32 = (value32 & ~MASK_NETTYPE) | _NETTYPE(NT_LINK_AP);
+#endif
+	rtw_write32(Adapter, REG_CR, value32);
+//	RASSERT(pIoBase->rtw_read8(REG_CR + 2) == 0x2);
+}
+
+static VOID
+_InitTransferPageSize(
+	IN  PADAPTER Adapter
+	)
+{
+	// Tx page size is always 128.
+
+	u8	value8;
+	value8 = _PSRX(PBP_128) | _PSTX(PBP_128);
+	rtw_write8(Adapter, REG_PBP, value8);
+}
+
+static VOID
+_InitDriverInfoSize(
+	IN  PADAPTER	Adapter,
+	IN	u8		drvInfoSize
+	)
+{
+	rtw_write8(Adapter,REG_RX_DRVINFO_SZ, drvInfoSize);
+}
+
+static VOID
+_InitWMACSetting(
+	IN  PADAPTER Adapter
+	)
+{
+	//u4Byte			value32;
+	//u16			value16;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	//pHalData->ReceiveConfig = AAP | APM | AM | AB | APP_ICV | ADF | AMF | APP_FCS | HTC_LOC_CTRL | APP_MIC | APP_PHYSTS;
+	//pHalData->ReceiveConfig = RCR_AAP | RCR_APM | RCR_AM | RCR_AB |RCR_CBSSID_DATA| RCR_CBSSID_BCN| RCR_APP_ICV | RCR_AMF | RCR_HTC_LOC_CTRL | RCR_APP_MIC | RCR_APP_PHYSTS;
+	// don't turn on AAP, it will allow all packets to driver
+	pHalData->ReceiveConfig = RCR_APM | RCR_AM | RCR_AB |RCR_CBSSID_DATA| RCR_CBSSID_BCN| RCR_APP_ICV | RCR_AMF | RCR_HTC_LOC_CTRL | RCR_APP_MIC | RCR_APP_PHYSTS;
+
+#if (0 == RTL8192C_RX_PACKET_NO_INCLUDE_CRC)
+	pHalData->ReceiveConfig |= ACRC32;
+#endif
+
+	// some REG_RCR will be modified later by phy_ConfigMACWithHeaderFile()
+	rtw_write32(Adapter, REG_RCR, pHalData->ReceiveConfig);
+
+	// Accept all multicast address
+	rtw_write32(Adapter, REG_MAR, 0xFFFFFFFF);
+	rtw_write32(Adapter, REG_MAR + 4, 0xFFFFFFFF);
+
+
+	// Accept all data frames
+	//value16 = 0xFFFF;
+	//rtw_write16(Adapter, REG_RXFLTMAP2, value16);
+
+	// 2010.09.08 hpfan
+	// Since ADF is removed from RCR, ps-poll will not be indicate to driver,
+	// RxFilterMap should mask ps-poll to gurantee AP mode can rx ps-poll.
+	//value16 = 0x400;
+	//rtw_write16(Adapter, REG_RXFLTMAP1, value16);
+
+	// Accept all management frames
+	//value16 = 0xFFFF;
+	//rtw_write16(Adapter, REG_RXFLTMAP0, value16);
+
+	//enable RX_SHIFT bits
+	//rtw_write8(Adapter, REG_TRXDMA_CTRL, rtw_read8(Adapter, REG_TRXDMA_CTRL)|BIT(1));
+
+}
+
+static VOID
+_InitAdaptiveCtrl(
+	IN  PADAPTER Adapter
+	)
+{
+	u16	value16;
+	u32	value32;
+
+	// Response Rate Set
+	value32 = rtw_read32(Adapter, REG_RRSR);
+	value32 &= ~RATE_BITMAP_ALL;
+	value32 |= RATE_RRSR_CCK_ONLY_1M;
+	rtw_write32(Adapter, REG_RRSR, value32);
+
+	// CF-END Threshold
+	//m_spIoBase->rtw_write8(REG_CFEND_TH, 0x1);
+
+	// SIFS (used in NAV)
+	value16 = _SPEC_SIFS_CCK(0x10) | _SPEC_SIFS_OFDM(0x10);
+	rtw_write16(Adapter, REG_SPEC_SIFS, value16);
+
+	// Retry Limit
+	value16 = _LRL(0x30) | _SRL(0x30);
+	rtw_write16(Adapter, REG_RL, value16);
+
+}
+
+static VOID
+_InitRateFallback(
+	IN  PADAPTER Adapter
+	)
+{
+	// Set Data Auto Rate Fallback Retry Count register.
+	rtw_write32(Adapter, REG_DARFRC, 0x00000000);
+	rtw_write32(Adapter, REG_DARFRC+4, 0x10080404);
+	rtw_write32(Adapter, REG_RARFRC, 0x04030201);
+	rtw_write32(Adapter, REG_RARFRC+4, 0x08070605);
+
+}
+
+
+static VOID
+_InitEDCA(
+	IN  PADAPTER Adapter
+	)
+{
+	// Set Spec SIFS (used in NAV)
+	rtw_write16(Adapter,REG_SPEC_SIFS, 0x100a);
+	rtw_write16(Adapter,REG_MAC_SPEC_SIFS, 0x100a);
+
+    //REG514:SIFS_CCK_CTX
+    //REG515:SIFS_OFDM_CTX
+	//REG516:SIFS_CCK_TRX
+    //REG517:SIFS_OFDM_TRX
+
+	// Set SIFS for CCK_CTS and OFDM_CTX
+	rtw_write16(Adapter,REG_SIFS_CTX, 0x100a);
+
+	// Set SIFS for CCK_TRX and OFDM_TRX
+	rtw_write16(Adapter,REG_SIFS_TRX, 0x100a);
+
+	// TXOP
+	rtw_write32(Adapter, REG_EDCA_BE_PARAM, 0x005EA42B);
+	rtw_write32(Adapter, REG_EDCA_BK_PARAM, 0x0000A44F);
+	rtw_write32(Adapter, REG_EDCA_VI_PARAM, 0x005EA324);
+	rtw_write32(Adapter, REG_EDCA_VO_PARAM, 0x002FA226);
+}
+
+
+static VOID
+_InitBeaconMaxError(
+	IN  PADAPTER	Adapter,
+	IN	BOOLEAN		InfraMode
+	)
+{
+#ifdef RTL8192CU_ADHOC_WORKAROUND_SETTING
+	rtw_write8(Adapter, REG_BCN_MAX_ERR, 0xFF);
+#else
+	//rtw_write8(Adapter, REG_BCN_MAX_ERR, (InfraMode ? 0xFF : 0x10));
+#endif
+}
+
+
+#ifdef CONFIG_LED
+static void _InitHWLed(PADAPTER Adapter)
+{
+	struct led_priv *pledpriv = &(Adapter->ledpriv);
+
+	if( pledpriv->LedStrategy != HW_LED)
+		return;
+
+// HW led control
+// to do ....
+//must consider cases of antenna diversity/ commbo card/solo card/mini card
+
+}
+#endif //CONFIG_LED
+
+static VOID
+_InitRDGSetting(
+	IN	PADAPTER Adapter
+	)
+{
+	rtw_write8(Adapter,REG_RD_CTRL,0xFF);
+	rtw_write16(Adapter, REG_RD_NAV_NXT, 0x200);
+	rtw_write8(Adapter,REG_RD_RESP_PKT_TH,0x05);
+}
+
+static VOID
+_InitRxSetting(
+	IN	PADAPTER Adapter
+	)
+{
+	rtw_write32(Adapter, REG_MACID, 0x87654321);
+	rtw_write32(Adapter, 0x0700, 0x87654321);
+}
+
+static VOID
+_InitRetryFunction(
+	IN  PADAPTER Adapter
+	)
+{
+	u8	value8;
+
+	value8 = rtw_read8(Adapter, REG_FWHW_TXQ_CTRL);
+	value8 |= EN_AMPDU_RTY_NEW;
+	rtw_write8(Adapter, REG_FWHW_TXQ_CTRL, value8);
+
+	// Set ACK timeout
+	rtw_write8(Adapter, REG_ACKTO, 0x40);
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	usb_AggSettingTxUpdate()
+ *
+ * Overview:	Seperate TX/RX parameters update independent for TP detection and
+ *			dynamic TX/RX aggreagtion parameters update.
+ *
+ * Input:			PADAPTER
+ *
+ * Output/Return:	NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	12/10/2010	MHC		Seperate to smaller function.
+ *
+ *---------------------------------------------------------------------------*/
+static VOID
+usb_AggSettingTxUpdate(
+	IN	PADAPTER			Adapter
+	)
+{
+#ifdef CONFIG_USB_TX_AGGREGATION
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	//PMGNT_INFO		pMgntInfo = &(Adapter->MgntInfo);
+	u32			value32;
+
+	if(Adapter->registrypriv.wifi_spec)
+		pHalData->UsbTxAggMode = _FALSE;
+
+	if(pHalData->UsbTxAggMode){
+		value32 = rtw_read32(Adapter, REG_TDECTRL);
+		value32 = value32 & ~(BLK_DESC_NUM_MASK << BLK_DESC_NUM_SHIFT);
+		value32 |= ((pHalData->UsbTxAggDescNum & BLK_DESC_NUM_MASK) << BLK_DESC_NUM_SHIFT);
+
+		rtw_write32(Adapter, REG_TDECTRL, value32);
+	}
+
+#endif
+}	// usb_AggSettingTxUpdate
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	usb_AggSettingRxUpdate()
+ *
+ * Overview:	Seperate TX/RX parameters update independent for TP detection and
+ *			dynamic TX/RX aggreagtion parameters update.
+ *
+ * Input:			PADAPTER
+ *
+ * Output/Return:	NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	12/10/2010	MHC		Seperate to smaller function.
+ *
+ *---------------------------------------------------------------------------*/
+static VOID
+usb_AggSettingRxUpdate(
+	IN	PADAPTER			Adapter
+	)
+{
+#ifdef CONFIG_USB_RX_AGGREGATION
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	//PMGNT_INFO		pMgntInfo = &(Adapter->MgntInfo);
+	u8			valueDMA;
+	u8			valueUSB;
+
+	valueDMA = rtw_read8(Adapter, REG_TRXDMA_CTRL);
+	valueUSB = rtw_read8(Adapter, REG_USB_SPECIAL_OPTION);
+
+	switch(pHalData->UsbRxAggMode)
+	{
+		case USB_RX_AGG_DMA:
+			valueDMA |= RXDMA_AGG_EN;
+			valueUSB &= ~USB_AGG_EN;
+			break;
+		case USB_RX_AGG_USB:
+			valueDMA &= ~RXDMA_AGG_EN;
+			valueUSB |= USB_AGG_EN;
+			break;
+		case USB_RX_AGG_MIX:
+			valueDMA |= RXDMA_AGG_EN;
+			valueUSB |= USB_AGG_EN;
+			break;
+		case USB_RX_AGG_DISABLE:
+		default:
+			valueDMA &= ~RXDMA_AGG_EN;
+			valueUSB &= ~USB_AGG_EN;
+			break;
+	}
+
+	rtw_write8(Adapter, REG_TRXDMA_CTRL, valueDMA);
+	rtw_write8(Adapter, REG_USB_SPECIAL_OPTION, valueUSB);
+
+	switch(pHalData->UsbRxAggMode)
+	{
+		case USB_RX_AGG_DMA:
+			rtw_write8(Adapter, REG_RXDMA_AGG_PG_TH, pHalData->UsbRxAggPageCount);
+			rtw_write8(Adapter, REG_USB_DMA_AGG_TO, pHalData->UsbRxAggPageTimeout);
+			break;
+		case USB_RX_AGG_USB:
+			rtw_write8(Adapter, REG_USB_AGG_TH, pHalData->UsbRxAggBlockCount);
+			rtw_write8(Adapter, REG_USB_AGG_TO, pHalData->UsbRxAggBlockTimeout);
+			break;
+		case USB_RX_AGG_MIX:
+			rtw_write8(Adapter, REG_RXDMA_AGG_PG_TH, pHalData->UsbRxAggPageCount);
+			rtw_write8(Adapter, REG_USB_DMA_AGG_TO, pHalData->UsbRxAggPageTimeout);
+			rtw_write8(Adapter, REG_USB_AGG_TH, pHalData->UsbRxAggBlockCount);
+			rtw_write8(Adapter, REG_USB_AGG_TO, pHalData->UsbRxAggBlockTimeout);
+			break;
+		case USB_RX_AGG_DISABLE:
+		default:
+			// TODO:
+			break;
+	}
+
+	switch(PBP_128)
+	{
+		case PBP_128:
+			pHalData->HwRxPageSize = 128;
+			break;
+		case PBP_64:
+			pHalData->HwRxPageSize = 64;
+			break;
+		case PBP_256:
+			pHalData->HwRxPageSize = 256;
+			break;
+		case PBP_512:
+			pHalData->HwRxPageSize = 512;
+			break;
+		case PBP_1024:
+			pHalData->HwRxPageSize = 1024;
+			break;
+		default:
+			//RT_ASSERT(FALSE, ("RX_PAGE_SIZE_REG_VALUE definition is incorrect!\n"));
+			break;
+	}
+#endif
+}	// usb_AggSettingRxUpdate
+
+static VOID
+InitUsbAggregationSetting(
+	IN  PADAPTER Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	// Tx aggregation setting
+	usb_AggSettingTxUpdate(Adapter);
+
+	// Rx aggregation setting
+	usb_AggSettingRxUpdate(Adapter);
+
+	// 201/12/10 MH Add for USB agg mode dynamic switch.
+	pHalData->UsbRxHighSpeedMode = _FALSE;
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	USB_AggModeSwitch()
+ *
+ * Overview:	When RX traffic is more than 40M, we need to adjust some parameters to increase
+ *			RX speed by increasing batch indication size. This will decrease TCP ACK speed, we
+ *			need to monitor the influence of FTP/network share.
+ *			For TX mode, we are still ubder investigation.
+ *
+ * Input:		PADAPTER
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	12/10/2010	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+VOID
+USB_AggModeSwitch(
+	IN	PADAPTER			Adapter
+	)
+{
+#if 0
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct mlme_priv	*pmlmepriv = &(Adapter->mlmepriv);
+
+	//pHalData->UsbRxHighSpeedMode = FALSE;
+	// How to measure the RX speed? We assume that when traffic is more than
+	if (pMgntInfo->bRegAggDMEnable == _FALSE)
+	{
+		return;	// Inf not support.
+	}
+
+
+	if (pmlmepriv->LinkDetectInfo.bHigherBusyTraffic == _TRUE &&
+		pHalData->UsbRxHighSpeedMode == _FALSE)
+	{
+		pHalData->UsbRxHighSpeedMode = _TRUE;
+		DBG_8192C("UsbAggModeSwitchCheck to HIGH\n");
+	}
+	else if (pmlmepriv->LinkDetectInfo.bHigherBusyTraffic == _FALSE &&
+		pHalData->UsbRxHighSpeedMode == _TRUE)
+	{
+		pHalData->UsbRxHighSpeedMode = _FALSE;
+		DBG_8192C("UsbAggModeSwitchCheck to LOW\n");
+	}
+	else
+	{
+		return;
+	}
+
+	// 2010/12/10 MH Add for USB Aggregation judgement we need to
+	//if( pMgntInfo->LinkDetectInfo.NumRxOkInPeriod > 4000 ||
+		//			pMgntInfo->LinkDetectInfo.NumTxOkInPeriod > 4000 )
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+	//usb_AggSettingTxUpdate(Adapter);
+#endif
+
+#ifdef CONFIG_USB_RX_AGGREGATION
+	if (pHalData->UsbRxHighSpeedMode == _TRUE)
+	{
+		// 2010/12/10 MH The parameter is tested by SD1 engineer and SD3 channel emulator.
+		// USB mode
+		pHalData->UsbRxAggBlockCount		= 40;
+		pHalData->UsbRxAggBlockTimeout	= 5;
+		// Mix mode
+		pHalData->UsbRxAggPageCount		= 72;
+		pHalData->UsbRxAggPageTimeout	= 6;
+	}
+	else
+	{
+		// USB mode
+		pHalData->UsbRxAggBlockCount		= pMgntInfo->RegUsbRxAggBlockCount;
+		pHalData->UsbRxAggBlockTimeout	= pMgntInfo->RegUsbRxAggBlockTimeout;
+		// Mix mode
+		pHalData->UsbRxAggPageCount		= pMgntInfo->RegUsbRxAggPageCount;
+		pHalData->UsbRxAggPageTimeout	= pMgntInfo->RegUsbRxAggPageTimeout;
+	}
+#endif
+#endif
+}	// USB_AggModeSwitch
+
+static VOID
+_InitOperationMode(
+	IN	PADAPTER			Adapter
+	)
+{
+#if 0//gtest
+	PHAL_DATA_8192CUSB	pHalData = GetHalData8192CUsb(Adapter);
+	u1Byte				regBwOpMode = 0;
+	u4Byte				regRATR = 0, regRRSR = 0;
+
+
+	//1 This part need to modified according to the rate set we filtered!!
+	//
+	// Set RRSR, RATR, and REG_BWOPMODE registers
+	//
+	switch(Adapter->RegWirelessMode)
+	{
+		case WIRELESS_MODE_B:
+			regBwOpMode = BW_OPMODE_20MHZ;
+			regRATR = RATE_ALL_CCK;
+			regRRSR = RATE_ALL_CCK;
+			break;
+		case WIRELESS_MODE_A:
+			ASSERT(FALSE);
+#if 0
+			regBwOpMode = BW_OPMODE_5G |BW_OPMODE_20MHZ;
+			regRATR = RATE_ALL_OFDM_AG;
+			regRRSR = RATE_ALL_OFDM_AG;
+#endif
+			break;
+		case WIRELESS_MODE_G:
+			regBwOpMode = BW_OPMODE_20MHZ;
+			regRATR = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+			regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+			break;
+		case WIRELESS_MODE_AUTO:
+			if (Adapter->bInHctTest)
+			{
+			    regBwOpMode = BW_OPMODE_20MHZ;
+			    regRATR = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+			    regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+			}
+			else
+			{
+			    regBwOpMode = BW_OPMODE_20MHZ;
+			    regRATR = RATE_ALL_CCK | RATE_ALL_OFDM_AG | RATE_ALL_OFDM_1SS | RATE_ALL_OFDM_2SS;
+			    regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+			}
+			break;
+		case WIRELESS_MODE_N_24G:
+			// It support CCK rate by default.
+			// CCK rate will be filtered out only when associated AP does not support it.
+			regBwOpMode = BW_OPMODE_20MHZ;
+				regRATR = RATE_ALL_CCK | RATE_ALL_OFDM_AG | RATE_ALL_OFDM_1SS | RATE_ALL_OFDM_2SS;
+				regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+			break;
+		case WIRELESS_MODE_N_5G:
+			ASSERT(FALSE);
+#if 0
+			regBwOpMode = BW_OPMODE_5G;
+			regRATR = RATE_ALL_OFDM_AG | RATE_ALL_OFDM_1SS | RATE_ALL_OFDM_2SS;
+			regRRSR = RATE_ALL_OFDM_AG;
+#endif
+			break;
+	}
+
+	// Ziv ????????
+	//PlatformEFIOWrite4Byte(Adapter, REG_INIRTS_RATE_SEL, regRRSR);
+	PlatformEFIOWrite1Byte(Adapter, REG_BWOPMODE, regBwOpMode);
+
+	// For Min Spacing configuration.
+	switch(pHalData->RF_Type)
+	{
+		case RF_1T2R:
+		case RF_1T1R:
+			RT_TRACE(COMP_INIT, DBG_LOUD, ("Initializeadapter: RF_Type%s\n", (pHalData->RF_Type==RF_1T1R? "(1T1R)":"(1T2R)")));
+			Adapter->MgntInfo.MinSpaceCfg = (MAX_MSS_DENSITY_1T<<3);
+			break;
+		case RF_2T2R:
+		case RF_2T2R_GREEN:
+			RT_TRACE(COMP_INIT, DBG_LOUD, ("Initializeadapter:RF_Type(2T2R)\n"));
+			Adapter->MgntInfo.MinSpaceCfg = (MAX_MSS_DENSITY_2T<<3);
+			break;
+	}
+
+	PlatformEFIOWrite1Byte(Adapter, REG_AMPDU_MIN_SPACE, Adapter->MgntInfo.MinSpaceCfg);
+#endif
+}
+
+
+ static VOID
+_InitBeaconParameters(
+	IN  PADAPTER Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	rtw_write16(Adapter, REG_BCN_CTRL, 0x1010);
+
+	// TODO: Remove these magic number
+	rtw_write16(Adapter, REG_TBTT_PROHIBIT,0x6404);// ms
+
+	rtw_write8(Adapter, REG_DRVERLYINT, DRIVER_EARLY_INT_TIME);// 5ms
+	rtw_write8(Adapter, REG_BCNDMATIM, BCN_DMA_ATIME_INT_TIME); // 2ms
+
+	// Suggested by designer timchen. Change beacon AIFS to the largest number
+	// beacause test chip does not contension before sending beacon. by tynli. 2009.11.03
+	rtw_write16(Adapter, REG_BCNTCFG, 0x660F);
+}
+
+static VOID
+_InitRFType(
+	IN	PADAPTER Adapter
+	)
+{
+	struct registry_priv	 *pregpriv = &Adapter->registrypriv;
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(Adapter);
+	BOOLEAN			is92CU		= IS_92C_SERIAL(pHalData->VersionID);
+
+#if	DISABLE_BB_RF
+	pHalData->rf_chip	= RF_PSEUDO_11N;
+	return;
+#endif
+
+	pHalData->rf_chip	= RF_6052;
+
+	if(_FALSE == is92CU){
+		pHalData->rf_type = RF_1T1R;
+		DBG_8192C("Set RF Chip ID to RF_6052 and RF type to 1T1R.\n");
+		return;
+	}
+
+	// TODO: Consider that EEPROM set 92CU to 1T1R later.
+	// Force to overwrite setting according to chip version. Ignore EEPROM setting.
+	//pHalData->RF_Type = is92CU ? RF_2T2R : RF_1T1R;
+	MSG_8192C("Set RF Chip ID to RF_6052 and RF type to %d.\n", pHalData->rf_type);
+
+}
+
+static VOID _InitAdhocWorkaroundParams(IN PADAPTER Adapter)
+{
+#if RTL8192CU_ADHOC_WORKAROUND_SETTING
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	pHalData->RegBcnCtrlVal = rtw_read8(Adapter, REG_BCN_CTRL);
+	pHalData->RegTxPause = rtw_read8(Adapter, REG_TXPAUSE);
+	pHalData->RegFwHwTxQCtrl = rtw_read8(Adapter, REG_FWHW_TXQ_CTRL+2);
+	pHalData->RegReg542 = rtw_read8(Adapter, REG_TBTT_PROHIBIT+2);
+#endif
+}
+
+static VOID
+_BeaconFunctionEnable(
+	IN	PADAPTER		Adapter,
+	IN	BOOLEAN			Enable,
+	IN	BOOLEAN			Linked
+	)
+{
+	rtw_write8(Adapter, REG_BCN_CTRL, (BIT4 | BIT3 | BIT1));
+	//SetBcnCtrlReg(Adapter, (BIT4 | BIT3 | BIT1), 0x00);
+	//RT_TRACE(COMP_BEACON, DBG_LOUD, ("_BeaconFunctionEnable 0x550 0x%x\n", PlatformEFIORead1Byte(Adapter, 0x550)));
+
+	rtw_write8(Adapter, REG_RD_CTRL+1, 0x6F);
+}
+
+
+// Set CCK and OFDM Block "ON"
+static VOID _BBTurnOnBlock(
+	IN	PADAPTER		Adapter
+	)
+{
+#if (DISABLE_BB_RF)
+	return;
+#endif
+
+	PHY_SetBBReg(Adapter, rFPGA0_RFMOD, bCCKEn, 0x1);
+	PHY_SetBBReg(Adapter, rFPGA0_RFMOD, bOFDMEn, 0x1);
+}
+
+static VOID _RfPowerSave(
+	IN	PADAPTER		Adapter
+	)
+{
+#if 0
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(Adapter);
+	PMGNT_INFO		pMgntInfo	= &(Adapter->MgntInfo);
+	u1Byte			eRFPath;
+
+#if (DISABLE_BB_RF)
+	return;
+#endif
+
+	if(pMgntInfo->RegRfOff == TRUE){ // User disable RF via registry.
+		RT_TRACE((COMP_INIT|COMP_RF), DBG_LOUD, ("InitializeAdapter8192CUsb(): Turn off RF for RegRfOff.\n"));
+		MgntActSet_RF_State(Adapter, eRfOff, RF_CHANGE_BY_SW);
+		// Those action will be discard in MgntActSet_RF_State because off the same state
+		for(eRFPath = 0; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+			PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)eRFPath, 0x4, 0xC00, 0x0);
+	}
+	else if(pMgntInfo->RfOffReason > RF_CHANGE_BY_PS){ // H/W or S/W RF OFF before sleep.
+		RT_TRACE((COMP_INIT|COMP_RF), DBG_LOUD, ("InitializeAdapter8192CUsb(): Turn off RF for RfOffReason(%ld).\n", pMgntInfo->RfOffReason));
+		MgntActSet_RF_State(Adapter, eRfOff, pMgntInfo->RfOffReason);
+	}
+	else{
+		pHalData->eRFPowerState = eRfOn;
+		pMgntInfo->RfOffReason = 0;
+		if(Adapter->bInSetPower || Adapter->bResetInProgress)
+			PlatformUsbEnableInPipes(Adapter);
+		RT_TRACE((COMP_INIT|COMP_RF), DBG_LOUD, ("InitializeAdapter8192CUsb(): RF is on.\n"));
+	}
+#endif
+}
+
+enum {
+	Antenna_Lfet = 1,
+	Antenna_Right = 2,
+};
+
+static VOID
+_InitAntenna_Selection(IN	PADAPTER Adapter)
+{
+
+	HAL_DATA_TYPE	*pHalData	= GET_HAL_DATA(Adapter);
+
+	if(pHalData->AntDivCfg==0)
+		return;
+	DBG_8192C("==>  %s ....\n",__FUNCTION__);
+
+	if((RF_1T1R == pHalData->rf_type))
+	{
+		rtw_write32(Adapter, REG_LEDCFG0, rtw_read32(Adapter, REG_LEDCFG0)|BIT23);
+		PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, BIT13, 0x01);
+
+		if(PHY_QueryBBReg(Adapter, rFPGA0_XA_RFInterfaceOE, 0x300) == Antenna_A)
+			pHalData->CurAntenna = Antenna_A;
+		else
+			pHalData->CurAntenna = Antenna_B;
+		DBG_8192C("%s,Cur_ant:(%x)%s\n",__FUNCTION__,pHalData->CurAntenna,(pHalData->CurAntenna == Antenna_A)?"Antenna_A":"Antenna_B");
+
+}
+
+
+}
+//
+// 2010/08/09 MH Add for power down check.
+//
+static BOOLEAN
+HalDetectPwrDownMode(
+	IN PADAPTER				Adapter
+	)
+{
+	u8	tmpvalue;
+	HAL_DATA_TYPE		*pHalData	= GET_HAL_DATA(Adapter);
+	struct pwrctrl_priv		*pwrctrlpriv = &Adapter->pwrctrlpriv;
+
+	EFUSE_ShadowRead(Adapter, 1, EEPROM_RF_OPT3, (u32 *)&tmpvalue);
+
+	// 2010/08/25 MH INF priority > PDN Efuse value.
+	if(tmpvalue & BIT4 && pwrctrlpriv->reg_pdnmode)
+	{
+		pHalData->pwrdown = _TRUE;
+	}
+	else
+	{
+		pHalData->pwrdown = _FALSE;
+	}
+
+	DBG_8192C("HalDetectPwrDownMode(): PDN=%d\n", pHalData->pwrdown);
+	return pHalData->pwrdown;
+
+}	// HalDetectPwrDownMode
+
+
+//
+// 2010/08/26 MH Add for selective suspend mode check.
+// If Efuse 0x0e bit1 is not enabled, we can not support selective suspend for Minicard and
+// slim card.
+//
+static VOID
+HalDetectSelectiveSuspendMode(
+	IN PADAPTER				Adapter
+	)
+{
+	u8	tmpvalue;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(Adapter);
+
+	// If support HW radio detect, we need to enable WOL ability, otherwise, we
+	// can not use FW to notify host the power state switch.
+
+	EFUSE_ShadowRead(Adapter, 1, EEPROM_USB_OPTIONAL1, (u32 *)&tmpvalue);
+
+	DBG_8192C("HalDetectSelectiveSuspendMode(): SS ");
+	if(tmpvalue & BIT1)
+	{
+		DBG_8192C("Enable\n");
+	}
+	else
+	{
+		DBG_8192C("Disable\n");
+		pdvobjpriv->RegUsbSS = _FALSE;
+	}
+
+	// 2010/09/01 MH According to Dongle Selective Suspend INF. We can switch SS mode.
+	if (pdvobjpriv->RegUsbSS && !SUPPORT_HW_RADIO_DETECT(pHalData))
+	{
+		//PMGNT_INFO				pMgntInfo = &(Adapter->MgntInfo);
+
+		//if (!pMgntInfo->bRegDongleSS)
+		//{
+		//	RT_TRACE(COMP_INIT, DBG_LOUD, ("Dongle disable SS\n"));
+			pdvobjpriv->RegUsbSS = _FALSE;
+		//}
+	}
+}	// HalDetectSelectiveSuspendMode
+/*-----------------------------------------------------------------------------
+ * Function:	HwSuspendModeEnable92Cu()
+ *
+ * Overview:	HW suspend mode switch.
+ *
+ * Input:		NONE
+ *
+ * Output:	NONE
+ *
+ * Return:	NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	08/23/2010	MHC		HW suspend mode switch test..
+ *---------------------------------------------------------------------------*/
+static VOID
+HwSuspendModeEnable92Cu(
+	IN	PADAPTER	pAdapter,
+	IN	u8			Type
+	)
+{
+	//PRT_USB_DEVICE 		pDevice = GET_RT_USB_DEVICE(pAdapter);
+	u16	reg = rtw_read16(pAdapter, REG_GPIO_MUXCFG);
+
+	//if (!pDevice->RegUsbSS)
+	{
+		return;
+	}
+
+	//
+	// 2010/08/23 MH According to Alfred's suggestion, we need to to prevent HW
+	// to enter suspend mode automatically. Otherwise, it will shut down major power
+	// domain and 8051 will stop. When we try to enter selective suspend mode, we
+	// need to prevent HW to enter D2 mode aumotmatically. Another way, Host will
+	// issue a S10 signal to power domain. Then it will cleat SIC setting(from Yngli).
+	// We need to enable HW suspend mode when enter S3/S4 or disable. We need
+	// to disable HW suspend mode for IPS/radio_off.
+	//
+	//RT_TRACE(COMP_RF, DBG_LOUD, ("HwSuspendModeEnable92Cu = %d\n", Type));
+	if (Type == _FALSE)
+	{
+		reg |= BIT14;
+		//RT_TRACE(COMP_RF, DBG_LOUD, ("REG_GPIO_MUXCFG = %x\n", reg));
+		rtw_write16(pAdapter, REG_GPIO_MUXCFG, reg);
+		reg |= BIT12;
+		//RT_TRACE(COMP_RF, DBG_LOUD, ("REG_GPIO_MUXCFG = %x\n", reg));
+		rtw_write16(pAdapter, REG_GPIO_MUXCFG, reg);
+	}
+	else
+	{
+		reg &= (~BIT12);
+		rtw_write16(pAdapter, REG_GPIO_MUXCFG, reg);
+		reg &= (~BIT14);
+		rtw_write16(pAdapter, REG_GPIO_MUXCFG, reg);
+	}
+
+}	// HwSuspendModeEnable92Cu
+rt_rf_power_state RfOnOffDetect(IN	PADAPTER pAdapter )
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(pAdapter);
+	u8	val8;
+	rt_rf_power_state rfpowerstate = rf_off;
+
+	if(pAdapter->pwrctrlpriv.bHWPowerdown)
+	{
+		val8 = rtw_read8(pAdapter, REG_HSISR);
+		DBG_8192C("pwrdown, 0x5c(BIT7)=%02x\n", val8);
+		rfpowerstate = (val8 & BIT7) ? rf_off: rf_on;
+	}
+	else // rf on/off
+	{
+		rtw_write8(	pAdapter, REG_MAC_PINMUX_CFG,rtw_read8(pAdapter, REG_MAC_PINMUX_CFG)&~(BIT3));
+		val8 = rtw_read8(pAdapter, REG_GPIO_IO_SEL);
+		DBG_8192C("GPIO_IN=%02x\n", val8);
+		rfpowerstate = (val8 & BIT3) ? rf_on : rf_off;
+	}
+	return rfpowerstate;
+}	// HalDetectPwrDownMode
+
+void _ps_open_RF(_adapter *padapter);
+
+
+u32 rtl8192cu_hal_init(PADAPTER Adapter)
+{
+	u8	val8 = 0;
+	u32	boundary, status = _SUCCESS;
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	struct pwrctrl_priv		*pwrctrlpriv = &Adapter->pwrctrlpriv;
+	struct registry_priv	*pregistrypriv = &Adapter->registrypriv;
+	u8	is92C = IS_92C_SERIAL(pHalData->VersionID);
+	rt_rf_power_state		eRfPowerStateToSet;
+#ifdef CONFIG_BT_COEXIST
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+#endif
+
+	u32 init_start_time = rtw_get_current_time();
+
+
+#ifdef DBG_HAL_INIT_PROFILING
+
+	enum HAL_INIT_STAGES {
+		HAL_INIT_STAGES_BEGIN = 0,
+		HAL_INIT_STAGES_INIT_PW_ON,
+		HAL_INIT_STAGES_MISC01,
+		HAL_INIT_STAGES_DOWNLOAD_FW,
+		HAL_INIT_STAGES_INIT_LLTT,
+		HAL_INIT_STAGES_MAC,
+		HAL_INIT_STAGES_MISC02,
+		HAL_INIT_STAGES_BB,
+		HAL_INIT_STAGES_RF,
+		HAL_INIT_STAGES_TURN_ON_BLOCK,
+		HAL_INIT_STAGES_INIT_SECURITY,
+		HAL_INIT_STAGES_MISC11,
+		//HAL_INIT_STAGES_RF_PS,
+		HAL_INIT_STAGES_IQK,
+		HAL_INIT_STAGES_PW_TRACK,
+		HAL_INIT_STAGES_LCK,
+		HAL_INIT_STAGES_MISC21,
+		HAL_INIT_STAGES_INIT_PABIAS,
+		HAL_INIT_STAGES_BT_COEXIST,
+		//HAL_INIT_STAGES_ANTENNA_SEL,
+		HAL_INIT_STAGES_INIT_HAL_DM,
+		HAL_INIT_STAGES_MISC31,
+		HAL_INIT_STAGES_END,
+		HAL_INIT_STAGES_NUM
+	};
+
+	char * hal_init_stages_str[] = {
+		"HAL_INIT_STAGES_BEGIN",
+		"HAL_INIT_STAGES_INIT_PW_ON",
+		"HAL_INIT_STAGES_MISC01",
+		"HAL_INIT_STAGES_DOWNLOAD_FW",
+		"HAL_INIT_STAGES_INIT_LLTT",
+		"HAL_INIT_STAGES_MAC",
+		"HAL_INIT_STAGES_MISC02",
+		"HAL_INIT_STAGES_BB",
+		"HAL_INIT_STAGES_RF",
+		"HAL_INIT_STAGES_TURN_ON_BLOCK",
+		"HAL_INIT_STAGES_INIT_SECURITY",
+		"HAL_INIT_STAGES_MISC11",
+		//"HAL_INIT_STAGES_RF_PS",
+		"HAL_INIT_STAGES_IQK",
+		"HAL_INIT_STAGES_PW_TRACK",
+		"HAL_INIT_STAGES_LCK",
+		"HAL_INIT_STAGES_MISC21",
+		"HAL_INIT_STAGES_INIT_PABIAS",
+		"HAL_INIT_STAGES_BT_COEXIST",
+		//"HAL_INIT_STAGES_ANTENNA_SEL",
+		"HAL_INIT_STAGES_INIT_HAL_DM",
+		"HAL_INIT_STAGES_MISC31",
+		"HAL_INIT_STAGES_END",
+	};
+
+	int hal_init_profiling_i;
+	u32 hal_init_stages_timestamp[HAL_INIT_STAGES_NUM]; //used to record the time of each stage's starting point
+
+	for(hal_init_profiling_i=0;hal_init_profiling_i<HAL_INIT_STAGES_NUM;hal_init_profiling_i++)
+		hal_init_stages_timestamp[hal_init_profiling_i]=0;
+
+	#define HAL_INIT_PROFILE_TAG(stage) hal_init_stages_timestamp[(stage)]=rtw_get_current_time();
+#else
+	#define HAL_INIT_PROFILE_TAG(stage) do {} while(0)
+#endif //DBG_HAL_INIT_PROFILING
+
+
+
+_func_enter_;
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_BEGIN);
+	if(Adapter->pwrctrlpriv.bkeepfwalive)
+	{
+		_ps_open_RF(Adapter);
+
+		if(pHalData->bIQKInitialized ){
+			rtl8192c_PHY_IQCalibrate(Adapter,_TRUE);
+		}
+		else{
+			rtl8192c_PHY_IQCalibrate(Adapter,_FALSE);
+			pHalData->bIQKInitialized = _TRUE;
+		}
+		rtl8192c_dm_CheckTXPowerTracking(Adapter);
+		rtl8192c_PHY_LCCalibrate(Adapter);
+
+		goto exit;
+	}
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_PW_ON);
+	status = _InitPowerOn(Adapter);
+	if(status == _FAIL){
+		RT_TRACE(_module_hci_hal_init_c_, _drv_err_, ("Failed to init power on!\n"));
+		goto exit;
+	}
+
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC01);
+	_InitQueueReservedPage(Adapter);
+	_InitTxBufferBoundary(Adapter);
+	_InitQueuePriority(Adapter);
+	_InitPageBoundary(Adapter);
+	_InitTransferPageSize(Adapter);
+
+
+#if ENABLE_USB_DROP_INCORRECT_OUT
+	_InitHardwareDropIncorrectBulkOut(Adapter);
+#endif
+
+	if(pHalData->bRDGEnable){
+		_InitRDGSetting(Adapter);
+	}
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_DOWNLOAD_FW);
+#if (1 == MP_DRIVER)
+	_InitRxSetting(Adapter);
+	// Don't Download Firmware
+	Adapter->bFWReady = _FALSE;
+#elif RTL8192CU_FW_DOWNLOAD_ENABLE
+	status = FirmwareDownload92C(Adapter,_FALSE);
+	if(status != _SUCCESS)
+	{
+		Adapter->bFWReady = _FALSE;
+		pHalData->fw_ractrl = _FALSE;
+		DBG_8192C("fw download fail!\n");
+		goto exit;
+	}
+	else
+	{
+		Adapter->bFWReady = _TRUE;
+		pHalData->fw_ractrl = _TRUE;
+		DBG_8192C("fw download ok!\n");
+	}
+#endif
+
+	InitializeFirmwareVars92C(Adapter);
+
+	if(pwrctrlpriv->reg_rfoff == _TRUE){
+		pwrctrlpriv->rf_pwrstate = rf_off;
+	}
+
+	// 2010/08/09 MH We need to check if we need to turnon or off RF after detecting
+	// HW GPIO pin. Before PHY_RFConfig8192C.
+	//HalDetectPwrDownMode(Adapter);
+	// 2010/08/26 MH If Efuse does not support sective suspend then disable the function.
+	//HalDetectSelectiveSuspendMode(Adapter);
+
+	// Set RF type for BB/RF configuration
+	_InitRFType(Adapter);//->_ReadRFType()
+
+	// Save target channel
+	// <Roger_Notes> Current Channel will be updated again later.
+	pHalData->CurrentChannel = 6;//default set to 6
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_LLTT);
+	if(!pregistrypriv->wifi_spec){
+		boundary = TX_PAGE_BOUNDARY;
+	}
+	else{// for WMM
+		boundary = WMM_NORMAL_TX_PAGE_BOUNDARY;
+	}
+	status =  InitLLTTable(Adapter, boundary);
+	if(status == _FAIL){
+		RT_TRACE(_module_hci_hal_init_c_, _drv_err_, ("Failed to init LLT table\n"));
+		goto exit;
+	}
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MAC);
+#if (HAL_MAC_ENABLE == 1)
+	status = PHY_MACConfig8192C(Adapter);
+	if(status == _FAIL)
+	{
+		goto exit;
+	}
+#endif
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC02);
+	// Get Rx PHY status in order to report RSSI and others.
+	_InitDriverInfoSize(Adapter, DRVINFO_SZ);
+
+	_InitInterrupt(Adapter);
+	hal_init_macaddr(Adapter);//set mac_address
+	_InitNetworkType(Adapter);//set msr
+	_InitWMACSetting(Adapter);
+	_InitAdaptiveCtrl(Adapter);
+	_InitEDCA(Adapter);
+	_InitRateFallback(Adapter);
+	_InitRetryFunction(Adapter);
+	InitUsbAggregationSetting(Adapter);
+	_InitOperationMode(Adapter);//todo
+	_InitBeaconParameters(Adapter);
+	_InitBeaconMaxError(Adapter, _TRUE);
+
+#if defined(CONFIG_CONCURRENT_MODE) || defined(CONFIG_TX_MCAST2UNI)
+
+#ifdef CONFIG_CHECK_AC_LIFETIME
+	// Enable lifetime check for the four ACs
+	rtw_write8(Adapter, REG_LIFETIME_EN, 0x0F);
+#endif	// CONFIG_CHECK_AC_LIFETIME
+
+#ifdef CONFIG_TX_MCAST2UNI
+	rtw_write16(Adapter, REG_PKT_VO_VI_LIFE_TIME, 0x0400);	// unit: 256us. 256ms
+	rtw_write16(Adapter, REG_PKT_BE_BK_LIFE_TIME, 0x0400);	// unit: 256us. 256ms
+#else	// CONFIG_TX_MCAST2UNI
+	rtw_write16(Adapter, REG_PKT_VO_VI_LIFE_TIME, 0x3000);	// unit: 256us. 3s
+	rtw_write16(Adapter, REG_PKT_BE_BK_LIFE_TIME, 0x3000);	// unit: 256us. 3s
+#endif	// CONFIG_TX_MCAST2UNI
+#endif	// CONFIG_CONCURRENT_MODE || CONFIG_TX_MCAST2UNI
+
+
+#ifdef CONFIG_LED
+	_InitHWLed(Adapter);
+#endif //CONFIG_LED
+
+	//
+	//d. Initialize BB related configurations.
+	//
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_BB);
+#if (HAL_BB_ENABLE == 1)
+	status = PHY_BBConfig8192C(Adapter);
+	if(status == _FAIL)
+	{
+		goto exit;
+	}
+#endif
+
+	// 92CU use 3-wire to r/w RF
+	//pHalData->Rf_Mode = RF_OP_By_SW_3wire;
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_RF);
+#if (HAL_RF_ENABLE == 1)
+	status = PHY_RFConfig8192C(Adapter);
+	if(status == _FAIL)
+	{
+		goto exit;
+	}
+
+	if(IS_VENDOR_UMC_A_CUT(pHalData->VersionID) && !IS_92C_SERIAL(pHalData->VersionID))
+	{
+		PHY_SetRFReg(Adapter, RF_PATH_A, RF_RX_G1, bMaskDWord, 0x30255);
+		PHY_SetRFReg(Adapter, RF_PATH_A, RF_RX_G2, bMaskDWord, 0x50a00);
+	}
+#endif
+
+	//
+	// Joseph Note: Keep RfRegChnlVal for later use.
+	//
+	pHalData->RfRegChnlVal[0] = PHY_QueryRFReg(Adapter, (RF_RADIO_PATH_E)0, RF_CHNLBW, bRFRegOffsetMask);
+	pHalData->RfRegChnlVal[1] = PHY_QueryRFReg(Adapter, (RF_RADIO_PATH_E)1, RF_CHNLBW, bRFRegOffsetMask);
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_TURN_ON_BLOCK);
+	_BBTurnOnBlock(Adapter);
+	//NicIFSetMacAddress(padapter, padapter->PermanentAddress);
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_SECURITY);
+	invalidate_cam_all(Adapter);
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC11);
+	// 2010/12/17 MH We need to set TX power according to EFUSE content at first.
+	PHY_SetTxPowerLevel8192C(Adapter, pHalData->CurrentChannel);
+
+// Move by Neo for USB SS to below setp
+//_RfPowerSave(Adapter);
+
+	if (!IS_92C_SERIAL( pHalData->VersionID) && (pHalData->AntDivCfg!=0))
+	{ //for 88CU ,1T1R
+		_InitAntenna_Selection(Adapter);
+	}
+
+
+	//
+	// Disable BAR, suggested by Scott
+	// 2010.04.09 add by hpfan
+	//
+	rtw_write32(Adapter, REG_BAR_MODE_CTRL, 0x0201ffff);
+
+	// HW SEQ CTRL
+	//set 0x0 to 0xFF by tynli. Default enable HW SEQ NUM.
+	rtw_write8(Adapter,REG_HWSEQ_CTRL, 0xFF);
+
+	if(pregistrypriv->wifi_spec)
+		rtw_write16(Adapter,REG_FAST_EDCA_CTRL ,0);
+
+	//Nav limit , suggest by scott
+	rtw_write8(Adapter, 0x652, 0x0);
+
+#if (MP_DRIVER == 1)
+	Adapter->mppriv.channel = pHalData->CurrentChannel;
+	MPT_InitializeAdapter(Adapter, Adapter->mppriv.channel);
+#else
+	//
+	// 2010/08/11 MH Merge from 8192SE for Minicard init. We need to confirm current radio status
+	// and then decide to enable RF or not.!!!??? For Selective suspend mode. We may not
+	// call init_adapter. May cause some problem??
+	//
+	// Fix the bug that Hw/Sw radio off before S3/S4, the RF off action will not be executed
+	// in MgntActSet_RF_State() after wake up, because the value of pHalData->eRFPowerState
+	// is the same as eRfOff, we should change it to eRfOn after we config RF parameters.
+	// Added by tynli. 2010.03.30.
+	pwrctrlpriv->rf_pwrstate = rf_on;
+
+#if 0  //to do
+	RT_CLEAR_PS_LEVEL(pwrctrlpriv, RT_RF_OFF_LEVL_HALT_NIC);
+#if 1 //Todo
+	// 20100326 Joseph: Copy from GPIOChangeRFWorkItemCallBack() function to check HW radio on/off.
+	// 20100329 Joseph: Revise and integrate the HW/SW radio off code in initialization.
+
+	eRfPowerStateToSet = (rt_rf_power_state) RfOnOffDetect(Adapter);
+	pwrctrlpriv->rfoff_reason |= eRfPowerStateToSet==rf_on ? RF_CHANGE_BY_INIT : RF_CHANGE_BY_HW;
+	pwrctrlpriv->rfoff_reason |= (pwrctrlpriv->reg_rfoff) ? RF_CHANGE_BY_SW : 0;
+
+	if(pwrctrlpriv->rfoff_reason&RF_CHANGE_BY_HW)
+		pwrctrlpriv->b_hw_radio_off = _TRUE;
+
+	DBG_8192C("eRfPowerStateToSet=%d\n", eRfPowerStateToSet);
+
+	if(pwrctrlpriv->reg_rfoff == _TRUE)
+	{	// User disable RF via registry.
+		DBG_8192C("InitializeAdapter8192CU(): Turn off RF for RegRfOff.\n");
+		//MgntActSet_RF_State(Adapter, rf_off, RF_CHANGE_BY_SW, _TRUE);
+
+		// Those action will be discard in MgntActSet_RF_State because off the same state
+		//for(eRFPath = 0; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+			//PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)eRFPath, 0x4, 0xC00, 0x0);
+	}
+	else if(pwrctrlpriv->rfoff_reason > RF_CHANGE_BY_PS)
+	{	// H/W or S/W RF OFF before sleep.
+		DBG_8192C(" Turn off RF for RfOffReason(%x) ----------\n", pwrctrlpriv->rfoff_reason);
+		//pwrctrlpriv->rfoff_reason = RF_CHANGE_BY_INIT;
+		pwrctrlpriv->rf_pwrstate = rf_on;
+		//MgntActSet_RF_State(Adapter, rf_off, pwrctrlpriv->rfoff_reason, _TRUE);
+	}
+	else
+	{
+		// Perform GPIO polling to find out current RF state. added by Roger, 2010.04.09.
+		if(pHalData->BoardType == BOARD_MINICARD /*&& (Adapter->MgntInfo.PowerSaveControl.bGpioRfSw)*/)
+		{
+			DBG_8192C("InitializeAdapter8192CU(): RF=%d \n", eRfPowerStateToSet);
+			if (eRfPowerStateToSet == rf_off)
+			{
+				//MgntActSet_RF_State(Adapter, rf_off, RF_CHANGE_BY_HW, _TRUE);
+				pwrctrlpriv->b_hw_radio_off = _TRUE;
+			}
+			else
+			{
+				pwrctrlpriv->rf_pwrstate = rf_off;
+				pwrctrlpriv->rfoff_reason = RF_CHANGE_BY_INIT;
+				pwrctrlpriv->b_hw_radio_off = _FALSE;
+				//MgntActSet_RF_State(Adapter, rf_on, pwrctrlpriv->rfoff_reason, _TRUE);
+			}
+		}
+		else
+		{
+			pwrctrlpriv->rf_pwrstate = rf_off;
+			pwrctrlpriv->rfoff_reason = RF_CHANGE_BY_INIT;
+			//MgntActSet_RF_State(Adapter, rf_on, pwrctrlpriv->rfoff_reason, _TRUE);
+		}
+
+		pwrctrlpriv->rfoff_reason = 0;
+		pwrctrlpriv->b_hw_radio_off = _FALSE;
+		pwrctrlpriv->rf_pwrstate = rf_on;
+		rtw_led_control(Adapter, LED_CTL_POWER_ON);
+
+	}
+
+	// 2010/-8/09 MH For power down module, we need to enable register block contrl reg at 0x1c.
+	// Then enable power down control bit of register 0x04 BIT4 and BIT15 as 1.
+	if(pHalData->pwrdown && eRfPowerStateToSet == rf_off)
+	{
+		// Enable register area 0x0-0xc.
+		rtw_write8(Adapter, REG_RSV_CTRL, 0x0);
+
+		//
+		// <Roger_Notes> We should configure HW PDn source for WiFi ONLY, and then
+		// our HW will be set in power-down mode if PDn source from all  functions are configured.
+		// 2010.10.06.
+		//
+		//if(IS_HARDWARE_TYPE_8723AU(Adapter))
+		//{
+		//	u1bTmp = rtw_read8(Adapter, REG_MULTI_FUNC_CTRL);
+		//	rtw_write8(Adapter, REG_MULTI_FUNC_CTRL, (u1bTmp|WL_HWPDN_EN));
+		//}
+		//else
+		//{
+			rtw_write16(Adapter, REG_APS_FSMCO, 0x8812);
+		//}
+	}
+	//DrvIFIndicateCurrentPhyStatus(Adapter); // 2010/08/17 MH Disable to prevent BSOD.
+#endif
+#endif
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_IQK);
+	// 2010/08/26 MH Merge from 8192CE.
+	if(pwrctrlpriv->rf_pwrstate == rf_on)
+	{
+		if(pHalData->bIQKInitialized ){
+			rtl8192c_PHY_IQCalibrate(Adapter,_TRUE);
+		}
+		else
+		{
+			rtl8192c_PHY_IQCalibrate(Adapter,_FALSE);
+			pHalData->bIQKInitialized = _TRUE;
+		}
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_PW_TRACK);
+		rtl8192c_dm_CheckTXPowerTracking(Adapter);
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_LCK);
+		rtl8192c_PHY_LCCalibrate(Adapter);
+	}
+#endif /* #if (MP_DRIVER == 1) */
+
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC21);
+#if RTL8192CU_ADHOC_WORKAROUND_SETTING
+	_InitAdhocWorkaroundParams(Adapter);
+#endif
+
+
+#ifdef USB_INTERFERENCE_ISSUE
+ //fixed USB interface interference issue
+	rtw_write8(Adapter, 0xfe40, 0xe0);
+	rtw_write8(Adapter, 0xfe41, 0x8d);
+	rtw_write8(Adapter, 0xfe42, 0x80);
+	rtw_write32(Adapter,0x20c,0xfd0320);
+#if 1
+	//2011/01/07 ,suggest by Johnny,for solved the problem that too many protocol error on USB bus
+	if(!IS_VENDOR_UMC_A_CUT(pHalData->VersionID) )//&& !IS_92C_SERIAL(pHalData->VersionID))// TSMC , 8188
+	{
+		// 0xE6=0x94
+		rtw_write8(Adapter, 0xFE40, 0xE6);
+		rtw_write8(Adapter, 0xFE41, 0x94);
+		rtw_write8(Adapter, 0xFE42, 0x80);
+
+		// 0xE0=0x19
+		rtw_write8(Adapter, 0xFE40, 0xE0);
+		rtw_write8(Adapter, 0xFE41, 0x19);
+		rtw_write8(Adapter, 0xFE42, 0x80);
+
+		// 0xE5=0x91
+		rtw_write8(Adapter, 0xFE40, 0xE5);
+		rtw_write8(Adapter, 0xFE41, 0x91);
+		rtw_write8(Adapter, 0xFE42, 0x80);
+
+		// 0xE2=0x81
+		rtw_write8(Adapter, 0xFE40, 0xE2);
+		rtw_write8(Adapter, 0xFE41, 0x81);
+		rtw_write8(Adapter, 0xFE42, 0x80);
+
+	}
+
+#endif
+#endif //USB_INTERFERENCE_ISSUE
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_PABIAS);
+	_InitPABias(Adapter);
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_BT_COEXIST);
+#ifdef CONFIG_BT_COEXIST
+	_InitBTCoexist(Adapter);
+#endif
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_INIT_HAL_DM);
+	rtl8192c_InitHalDm(Adapter);
+
+	// 2010/08/23 MH According to Alfred's suggestion, we need to to prevent HW enter
+	// suspend mode automatically.
+	//HwSuspendModeEnable92Cu(Adapter, _FALSE);
+
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_MISC31);
+	rtw_write8(Adapter, 0x15, 0xe9);//suggest by Johnny for lower temperature
+
+        rtw_write8(Adapter, 0xc87, 0x50);//suggest by Jackson for CCA
+
+	//_dbg_dump_macreg(padapter);
+
+	rtw_write16(Adapter, REG_BCN_CTRL, 0x1818);	// For 2 PORT TSF SYNC
+
+
+
+#ifdef CONFIG_XMIT_ACK
+	//ack for xmit mgmt frames.
+	rtw_write32(Adapter, REG_FWHW_TXQ_CTRL, rtw_read32(Adapter, REG_FWHW_TXQ_CTRL)|BIT(12));
+#endif //CONFIG_XMIT_ACK
+
+exit:
+HAL_INIT_PROFILE_TAG(HAL_INIT_STAGES_END);
+
+	DBG_871X("%s in %dms\n", __FUNCTION__, rtw_get_passing_time_ms(init_start_time));
+
+	#ifdef DBG_HAL_INIT_PROFILING
+	hal_init_stages_timestamp[HAL_INIT_STAGES_END]=rtw_get_current_time();
+
+	for(hal_init_profiling_i=0;hal_init_profiling_i<HAL_INIT_STAGES_NUM-1;hal_init_profiling_i++) {
+		DBG_871X("DBG_HAL_INIT_PROFILING: %35s, %u, %5u, %5u\n"
+			, hal_init_stages_str[hal_init_profiling_i]
+			, hal_init_stages_timestamp[hal_init_profiling_i]
+			, (hal_init_stages_timestamp[hal_init_profiling_i+1]-hal_init_stages_timestamp[hal_init_profiling_i])
+			, rtw_get_time_interval_ms(hal_init_stages_timestamp[hal_init_profiling_i], hal_init_stages_timestamp[hal_init_profiling_i+1])
+		);
+	}
+	#endif
+
+
+_func_exit_;
+
+	return status;
+}
+
+
+#define SYNC_SD7_20110802_phy_SsPwrSwitch92CU
+#ifdef SYNC_SD7_20110802_phy_SsPwrSwitch92CU
+
+VOID
+phy_SsPwrSwitch92CU(
+	IN	PADAPTER			Adapter,
+	IN	rt_rf_power_state	eRFPowerState,
+	IN	int bRegSSPwrLvl
+	)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	u8				value8;
+
+	switch( eRFPowerState )
+	{
+		case rf_on:
+			if (bRegSSPwrLvl == 1)
+			{
+				// 1. Enable MAC Clock. Can not be enabled now.
+				//WriteXBYTE(REG_SYS_CLKR+1, ReadXBYTE(REG_SYS_CLKR+1) | BIT(3));
+
+				// 2. Force PWM, Enable SPS18_LDO_Marco_Block
+				rtw_write8(Adapter, REG_SPS0_CTRL,
+				rtw_read8(Adapter, REG_SPS0_CTRL) | (BIT0|BIT3));
+
+				// 3. restore BB, AFE control register.
+				//RF
+				if (pHalData->rf_type ==  RF_2T2R)
+					PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, 0x380038, 1);
+				else
+					PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, 0x38, 1);
+				PHY_SetBBReg(Adapter, rOFDM0_TRxPathEnable, 0xf0, 1);
+				PHY_SetBBReg(Adapter, rFPGA0_RFMOD, BIT1, 0);
+
+				//AFE
+				//DbgPrint("0x0e70 = %x\n", Adapter->PS_BBRegBackup[PSBBREG_AFE0]);
+				//PHY_SetBBReg(Adapter, 0x0e70, bMaskDWord ,Adapter->PS_BBRegBackup[PSBBREG_AFE0] );
+				//PHY_SetBBReg(Adapter, 0x0e70, bMaskDWord ,0x631B25A0 );
+				if (pHalData->rf_type ==  RF_2T2R)
+					PHY_SetBBReg(Adapter, rRx_Wait_CCA, bMaskDWord ,0x63DB25A0 );
+				else if (pHalData->rf_type ==  RF_1T1R)
+					PHY_SetBBReg(Adapter, rRx_Wait_CCA, bMaskDWord ,0x631B25A0 );
+
+				// 4. issue 3-wire command that RF set to Rx idle mode. This is used to re-write the RX idle mode.
+				// We can only prvide a usual value instead and then HW will modify the value by itself.
+				PHY_SetRFReg(Adapter,RF_PATH_A, 0, bRFRegOffsetMask,0x32D95);
+				if (pHalData->rf_type ==  RF_2T2R)
+				{
+					PHY_SetRFReg(Adapter,RF_PATH_B, 0, bRFRegOffsetMask,0x32D95);
+				}
+			}
+			else		// Level 2 or others.
+			{
+				//h.	AFE_PLL_CTRL 0x28[7:0] = 0x80			//disable AFE PLL
+				rtw_write8(Adapter, REG_AFE_PLL_CTRL, 0x81);
+
+				// i.	AFE_XTAL_CTRL 0x24[15:0] = 0x880F		//gated AFE DIG_CLOCK
+				rtw_write16(Adapter, REG_AFE_XTAL_CTRL, 0x800F);
+				rtw_mdelay_os(1);
+
+				// 1. Enable MAC Clock. Can not be enabled now.
+				//WriteXBYTE(REG_SYS_CLKR+1, ReadXBYTE(REG_SYS_CLKR+1) | BIT(3));
+
+				// 2. Force PWM, Enable SPS18_LDO_Marco_Block
+				rtw_write8(Adapter, REG_SPS0_CTRL,
+				rtw_read8(Adapter, REG_SPS0_CTRL) | (BIT0|BIT3));
+
+				// 3. restore BB, AFE control register.
+				//RF
+				if (pHalData->rf_type ==  RF_2T2R)
+					PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, 0x380038, 1);
+				else
+					PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, 0x38, 1);
+				PHY_SetBBReg(Adapter, rOFDM0_TRxPathEnable, 0xf0, 1);
+				PHY_SetBBReg(Adapter, rFPGA0_RFMOD, BIT1, 0);
+
+				//AFE
+				if (pHalData->rf_type ==  RF_2T2R)
+					PHY_SetBBReg(Adapter, rRx_Wait_CCA, bMaskDWord ,0x63DB25A0 );
+				else if (pHalData->rf_type ==  RF_1T1R)
+					PHY_SetBBReg(Adapter, rRx_Wait_CCA, bMaskDWord ,0x631B25A0 );
+
+				// 4. issue 3-wire command that RF set to Rx idle mode. This is used to re-write the RX idle mode.
+				// We can only prvide a usual value instead and then HW will modify the value by itself.
+				PHY_SetRFReg(Adapter,RF_PATH_A, 0, bRFRegOffsetMask,0x32D95);
+				if (pHalData->rf_type ==  RF_2T2R)
+				{
+					PHY_SetRFReg(Adapter,RF_PATH_B, 0, bRFRegOffsetMask,0x32D95);
+				}
+
+				// 5. gated MAC Clock
+				//WriteXBYTE(REG_SYS_CLKR+1, ReadXBYTE(REG_SYS_CLKR+1) & ~(BIT(3)));
+				//PlatformEFIOWrite1Byte(Adapter, REG_SYS_CLKR+1, PlatformEFIORead1Byte(Adapter, REG_SYS_CLKR+1)|(BIT3));
+
+				{
+					//u8 			eRFPath = RF_PATH_A,value8 = 0, retry = 0;
+					u8		bytetmp;
+					//PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)eRFPath, 0x0, bMaskByte0, 0x0);
+					// 2010/08/12 MH Add for B path under SS test.
+					//if (pHalData->RF_Type ==  RF_2T2R)
+						//PHY_SetRFReg(Adapter, RF_PATH_B, 0x0, bMaskByte0, 0x0);
+
+					bytetmp = rtw_read8(Adapter, REG_APSD_CTRL);
+					rtw_write8(Adapter, REG_APSD_CTRL, bytetmp & ~BIT6);
+
+					rtw_mdelay_os(10);
+
+					// Set BB reset at first
+					rtw_write8(Adapter, REG_SYS_FUNC_EN, 0x17 );//0x16
+					//undo clock gated
+					rtw_write32(Adapter, rFPGA0_XCD_RFParameter, rtw_read32(Adapter, rFPGA0_XCD_RFParameter)&(~BIT31));
+					// Enable TX
+					rtw_write8(Adapter, REG_TXPAUSE, 0x0);
+				}
+				//Adapter->HalFunc.InitializeAdapterHandler(Adapter, Adapter->MgntInfo.dot11CurrentChannelNumber);
+				//CardSelectiveSuspendLeave(Adapter);
+			}
+
+			break;
+
+		case rf_sleep:
+		case rf_off:
+				value8 = rtw_read8(Adapter, REG_SPS0_CTRL) ;
+				if (IS_81xxC_VENDOR_UMC_B_CUT(pHalData->VersionID))
+					value8 &= ~(BIT0);
+				else
+					value8 &= ~(BIT0|BIT3);
+				if (bRegSSPwrLvl == 1)
+				{
+					//RT_TRACE(COMP_POWER, DBG_LOUD, ("SS LVL1\n"));
+					// Disable RF and BB only for SelectSuspend.
+
+					// 1. Set BB/RF to shutdown.
+					//	(1) Reg878[5:3]= 0 	// RF rx_code for preamble power saving
+					//	(2)Reg878[21:19]= 0	//Turn off RF-B
+					//	(3) RegC04[7:4]= 0 	// turn off all paths for packet detection
+					//	(4) Reg800[1] = 1 		// enable preamble power saving
+					Adapter->pwrctrlpriv.PS_BBRegBackup[PSBBREG_RF0] = PHY_QueryBBReg(Adapter, rFPGA0_XAB_RFParameter, bMaskDWord);
+					Adapter->pwrctrlpriv.PS_BBRegBackup[PSBBREG_RF1] = PHY_QueryBBReg(Adapter, rOFDM0_TRxPathEnable, bMaskDWord);
+					Adapter->pwrctrlpriv.PS_BBRegBackup[PSBBREG_RF2] = PHY_QueryBBReg(Adapter, rFPGA0_RFMOD, bMaskDWord);
+					if (pHalData->rf_type ==  RF_2T2R)
+					{
+						PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, 0x380038, 0);
+					}
+					else if (pHalData->rf_type ==  RF_1T1R)
+					{
+						PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, 0x38, 0);
+					}
+					PHY_SetBBReg(Adapter, rOFDM0_TRxPathEnable, 0xf0, 0);
+					PHY_SetBBReg(Adapter, rFPGA0_RFMOD, BIT1,1);
+
+					// 2 .AFE control register to power down. bit[30:22]
+					Adapter->pwrctrlpriv.PS_BBRegBackup[PSBBREG_AFE0] = PHY_QueryBBReg(Adapter, rRx_Wait_CCA, bMaskDWord);
+					if (pHalData->rf_type ==  RF_2T2R)
+						PHY_SetBBReg(Adapter, rRx_Wait_CCA, bMaskDWord ,0x00DB25A0);
+					else if (pHalData->rf_type ==  RF_1T1R)
+						PHY_SetBBReg(Adapter, rRx_Wait_CCA, bMaskDWord ,0x001B25A0);
+
+					// 3. issue 3-wire command that RF set to power down.
+					PHY_SetRFReg(Adapter,RF_PATH_A, 0, bRFRegOffsetMask,0);
+					if (pHalData->rf_type ==  RF_2T2R)
+					{
+						PHY_SetRFReg(Adapter,RF_PATH_B, 0, bRFRegOffsetMask,0);
+					}
+
+					// 4. Force PFM , disable SPS18_LDO_Marco_Block
+					rtw_write8(Adapter, REG_SPS0_CTRL, value8);
+
+					// 5. gated MAC Clock
+					//WriteXBYTE(REG_SYS_CLKR+1, ReadXBYTE(REG_SYS_CLKR+1) & ~(BIT(3)));
+				}
+				else	// Level 2 or others.
+				{
+					//RT_TRACE(COMP_POWER, DBG_LOUD, ("SS LVL2\n"));
+					{
+						u8 			eRFPath = RF_PATH_A,value8 = 0;
+						rtw_write8(Adapter, REG_TXPAUSE, 0xFF);
+						PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)eRFPath, 0x0, bMaskByte0, 0x0);
+						// 2010/08/12 MH Add for B path under SS test.
+						//if (pHalData->RF_Type ==  RF_2T2R)
+							//PHY_SetRFReg(Adapter, RF_PATH_B, 0x0, bMaskByte0, 0x0);
+
+						value8 |= APSDOFF;
+						rtw_write8(Adapter, REG_APSD_CTRL, value8);//0x40
+
+						// After switch APSD, we need to delay for stability
+						rtw_mdelay_os(10);
+						//before BB reset should do clock gated
+						rtw_write32(Adapter, rFPGA0_XCD_RFParameter, rtw_read32(Adapter, rFPGA0_XCD_RFParameter)|(BIT31));
+						// Set BB reset at first
+						value8 = 0 ;
+						value8 |=( FEN_USBD | FEN_USBA | FEN_BB_GLB_RSTn);
+						rtw_write8(Adapter, REG_SYS_FUNC_EN,value8 );//0x16
+					}
+
+					// Disable RF and BB only for SelectSuspend.
+
+					// 1. Set BB/RF to shutdown.
+					//	(1) Reg878[5:3]= 0 	// RF rx_code for preamble power saving
+					//	(2)Reg878[21:19]= 0	//Turn off RF-B
+					//	(3) RegC04[7:4]= 0 	// turn off all paths for packet detection
+					//	(4) Reg800[1] = 1 		// enable preamble power saving
+					Adapter->pwrctrlpriv.PS_BBRegBackup[PSBBREG_RF0] = PHY_QueryBBReg(Adapter, rFPGA0_XAB_RFParameter, bMaskDWord);
+					Adapter->pwrctrlpriv.PS_BBRegBackup[PSBBREG_RF1] = PHY_QueryBBReg(Adapter, rOFDM0_TRxPathEnable, bMaskDWord);
+					Adapter->pwrctrlpriv.PS_BBRegBackup[PSBBREG_RF2] = PHY_QueryBBReg(Adapter, rFPGA0_RFMOD, bMaskDWord);
+					if (pHalData->rf_type ==  RF_2T2R)
+					{
+						PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, 0x380038, 0);
+					}
+					else if (pHalData->rf_type ==  RF_1T1R)
+					{
+						PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, 0x38, 0);
+					}
+					PHY_SetBBReg(Adapter, rOFDM0_TRxPathEnable, 0xf0, 0);
+					PHY_SetBBReg(Adapter, rFPGA0_RFMOD, BIT1,1);
+
+					// 2 .AFE control register to power down. bit[30:22]
+					Adapter->pwrctrlpriv.PS_BBRegBackup[PSBBREG_AFE0] = PHY_QueryBBReg(Adapter, rRx_Wait_CCA, bMaskDWord);
+					if (pHalData->rf_type ==  RF_2T2R)
+						PHY_SetBBReg(Adapter, rRx_Wait_CCA, bMaskDWord ,0x00DB25A0);
+					else if (pHalData->rf_type ==  RF_1T1R)
+						PHY_SetBBReg(Adapter, rRx_Wait_CCA, bMaskDWord ,0x001B25A0);
+
+					// 3. issue 3-wire command that RF set to power down.
+					PHY_SetRFReg(Adapter,RF_PATH_A, 0, bRFRegOffsetMask,0);
+					if (pHalData->rf_type ==  RF_2T2R)
+					{
+						PHY_SetRFReg(Adapter,RF_PATH_B, 0, bRFRegOffsetMask,0);
+					}
+
+					// 4. Force PFM , disable SPS18_LDO_Marco_Block
+					rtw_write8(Adapter, REG_SPS0_CTRL, value8);
+
+					// 2010/10/13 MH/Isaachsu exchange sequence.
+					//h.	AFE_PLL_CTRL 0x28[7:0] = 0x80			//disable AFE PLL
+					rtw_write8(Adapter, REG_AFE_PLL_CTRL, 0x80);
+					rtw_mdelay_os(1);
+
+					// i.	AFE_XTAL_CTRL 0x24[15:0] = 0x880F		//gated AFE DIG_CLOCK
+					rtw_write16(Adapter, REG_AFE_XTAL_CTRL, 0xA80F);
+
+					// 5. gated MAC Clock
+					//WriteXBYTE(REG_SYS_CLKR+1, ReadXBYTE(REG_SYS_CLKR+1) & ~(BIT(3)));
+					//PlatformEFIOWrite1Byte(Adapter, REG_SYS_CLKR+1, PlatformEFIORead1Byte(Adapter, REG_SYS_CLKR+1)& ~(BIT3))
+
+					//CardSelectiveSuspendEnter(Adapter);
+				}
+
+			break;
+
+		default:
+			break;
+	}
+
+}	// phy_PowerSwitch92CU
+
+void _ps_open_RF(_adapter *padapter) {
+	//here call with bRegSSPwrLvl 1, bRegSSPwrLvl 2 needs to be verified
+	phy_SsPwrSwitch92CU(padapter, rf_on, 1);
+}
+
+void _ps_close_RF(_adapter *padapter){
+	//here call with bRegSSPwrLvl 1, bRegSSPwrLvl 2 needs to be verified
+	phy_SsPwrSwitch92CU(padapter, rf_off, 1);
+}
+#endif //SYNC_SD7_20110802_phy_SsPwrSwitch92CU
+
+
+
+static VOID
+_DisableGPIO(
+	IN	PADAPTER	Adapter
+	)
+{
+/***************************************
+j. GPIO_PIN_CTRL 0x44[31:0]=0x000		//
+k. Value = GPIO_PIN_CTRL[7:0]
+l.  GPIO_PIN_CTRL 0x44[31:0] = 0x00FF0000 | (value <<8); //write external PIN level
+m. GPIO_MUXCFG 0x42 [15:0] = 0x0780
+n. LEDCFG 0x4C[15:0] = 0x8080
+***************************************/
+	u8	value8;
+	u16	value16;
+	u32	value32;
+
+	//1. Disable GPIO[7:0]
+	rtw_write16(Adapter, REG_GPIO_PIN_CTRL+2, 0x0000);
+	value32 = rtw_read32(Adapter, REG_GPIO_PIN_CTRL) & 0xFFFF00FF;
+	value8 = (u8) (value32&0x000000FF);
+	value32 |= ((value8<<8) | 0x00FF0000);
+	rtw_write32(Adapter, REG_GPIO_PIN_CTRL, value32);
+
+	//2. Disable GPIO[10:8]
+	rtw_write8(Adapter, REG_GPIO_MUXCFG+3, 0x00);
+	    value16 = rtw_read16(Adapter, REG_GPIO_MUXCFG+2) & 0xFF0F;
+	value8 = (u8) (value16&0x000F);
+	value16 |= ((value8<<4) | 0x0780);
+	rtw_write16(Adapter, REG_GPIO_MUXCFG+2, value16);
+
+	//3. Disable LED0 & 1
+	rtw_write16(Adapter, REG_LEDCFG0, 0x8080);
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("======> Disable GPIO and LED.\n"));
+
+} //end of _DisableGPIO()
+
+static VOID
+_ResetFWDownloadRegister(
+	IN PADAPTER			Adapter
+	)
+{
+	u32	value32;
+
+	value32 = rtw_read32(Adapter, REG_MCUFWDL);
+	value32 &= ~(MCUFWDL_EN | MCUFWDL_RDY);
+	rtw_write32(Adapter, REG_MCUFWDL, value32);
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Reset FW download register.\n"));
+}
+
+
+static int
+_DisableRF_AFE(
+	IN PADAPTER			Adapter
+	)
+{
+	int		rtStatus = _SUCCESS;
+	u32			pollingCount = 0;
+	u8			value8;
+
+	//disable RF/ AFE AD/DA
+	value8 = APSDOFF;
+	rtw_write8(Adapter, REG_APSD_CTRL, value8);
+
+
+#if (RTL8192CU_ASIC_VERIFICATION)
+
+	do
+	{
+		if(rtw_read8(Adapter, REG_APSD_CTRL) & APSDOFF_STATUS){
+			//RT_TRACE(COMP_INIT, DBG_LOUD, ("Disable RF, AFE, AD, DA Done!\n"));
+			break;
+		}
+
+		if(pollingCount++ > POLLING_READY_TIMEOUT_COUNT){
+			//RT_TRACE(COMP_INIT, DBG_SERIOUS, ("Failed to polling APSDOFF_STATUS done!\n"));
+			return _FAIL;
+		}
+
+	}while(_TRUE);
+
+#endif
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Disable RF, AFE,AD, DA.\n"));
+	return rtStatus;
+
+}
+
+static VOID
+_ResetBB(
+	IN PADAPTER			Adapter
+	)
+{
+	u16	value16;
+
+	//before BB reset should do clock gated
+	rtw_write32(Adapter, rFPGA0_XCD_RFParameter, rtw_read32(Adapter, rFPGA0_XCD_RFParameter)|(BIT31));
+	//reset BB
+	value16 = rtw_read16(Adapter, REG_SYS_FUNC_EN);
+	value16 &= ~(FEN_BBRSTB | FEN_BB_GLB_RSTn);
+	rtw_write16(Adapter, REG_SYS_FUNC_EN, value16);
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Reset BB.\n"));
+}
+
+static VOID
+_ResetMCU(
+	IN PADAPTER			Adapter
+	)
+{
+	u16	value16;
+
+	// reset MCU
+	value16 = rtw_read16(Adapter, REG_SYS_FUNC_EN);
+	value16 &= ~FEN_CPUEN;
+	rtw_write16(Adapter, REG_SYS_FUNC_EN, value16);
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Reset MCU.\n"));
+}
+
+static VOID
+_DisableMAC_AFE_PLL(
+	IN PADAPTER			Adapter
+	)
+{
+	u32	value32;
+
+	//disable MAC/ AFE PLL
+	value32 = rtw_read32(Adapter, REG_APS_FSMCO);
+	value32 |= APDM_MAC;
+	rtw_write32(Adapter, REG_APS_FSMCO, value32);
+
+	value32 |= APFM_OFF;
+	rtw_write32(Adapter, REG_APS_FSMCO, value32);
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Disable MAC, AFE PLL.\n"));
+}
+
+static VOID
+_AutoPowerDownToHostOff(
+	IN	PADAPTER		Adapter
+	)
+{
+	u32			value32;
+	rtw_write8(Adapter, REG_SPS0_CTRL, 0x22);
+
+	value32 = rtw_read32(Adapter, REG_APS_FSMCO);
+
+	value32 |= APDM_HOST;//card disable
+	rtw_write32(Adapter, REG_APS_FSMCO, value32);
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Auto Power Down to Host-off state.\n"));
+
+	// set USB suspend
+	value32 = rtw_read32(Adapter, REG_APS_FSMCO);
+	value32 &= ~AFSM_PCIE;
+	rtw_write32(Adapter, REG_APS_FSMCO, value32);
+
+}
+
+static VOID
+_SetUsbSuspend(
+	IN PADAPTER			Adapter
+	)
+{
+	u32			value32;
+
+	value32 = rtw_read32(Adapter, REG_APS_FSMCO);
+
+	// set USB suspend
+	value32 |= AFSM_HSUS;
+	rtw_write32(Adapter, REG_APS_FSMCO, value32);
+
+	//RT_ASSERT(0 == (rtw_read32(Adapter, REG_APS_FSMCO) & BIT(12)),(""));
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("Set USB suspend.\n"));
+
+}
+
+static VOID
+_DisableRFAFEAndResetBB(
+	IN PADAPTER			Adapter
+	)
+{
+/**************************************
+a.	TXPAUSE 0x522[7:0] = 0xFF             //Pause MAC TX queue
+b.	RF path 0 offset 0x00 = 0x00            // disable RF
+c. 	APSD_CTRL 0x600[7:0] = 0x40
+d.	SYS_FUNC_EN 0x02[7:0] = 0x16		//reset BB state machine
+e.	SYS_FUNC_EN 0x02[7:0] = 0x14		//reset BB state machine
+***************************************/
+	u8 eRFPath = 0,value8 = 0;
+	rtw_write8(Adapter, REG_TXPAUSE, 0xFF);
+	PHY_SetRFReg(Adapter, (RF_RADIO_PATH_E)eRFPath, 0x0, bMaskByte0, 0x0);
+
+	value8 |= APSDOFF;
+	rtw_write8(Adapter, REG_APSD_CTRL, value8);//0x40
+	//before BB reset should do clock gated
+	rtw_write32(Adapter, rFPGA0_XCD_RFParameter, rtw_read32(Adapter, rFPGA0_XCD_RFParameter)|(BIT31));
+	value8 = 0 ;
+	value8 |=( FEN_USBD | FEN_USBA | FEN_BB_GLB_RSTn);
+	rtw_write8(Adapter, REG_SYS_FUNC_EN,value8 );//0x16
+
+	value8 &=( ~FEN_BB_GLB_RSTn );
+	rtw_write8(Adapter, REG_SYS_FUNC_EN, value8); //0x14
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("======> RF off and reset BB.\n"));
+}
+
+static VOID
+_ResetDigitalProcedure1(
+	IN 	PADAPTER			Adapter,
+	IN	BOOLEAN				bWithoutHWSM
+	)
+{
+
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter);
+
+	if(pHalData->FirmwareVersion <=  0x20){
+		#if 0
+		/*****************************
+		f.	SYS_FUNC_EN 0x03[7:0]=0x54		// reset MAC register, DCORE
+		g.	MCUFWDL 0x80[7:0]=0				// reset MCU ready status
+		******************************/
+		u4Byte	value32 = 0;
+		PlatformIOWrite1Byte(Adapter, REG_SYS_FUNC_EN+1, 0x54);
+		PlatformIOWrite1Byte(Adapter, REG_MCUFWDL, 0);
+		#else
+		/*****************************
+		f.	MCUFWDL 0x80[7:0]=0				// reset MCU ready status
+		g.	SYS_FUNC_EN 0x02[10]= 0			// reset MCU register, (8051 reset)
+		h.	SYS_FUNC_EN 0x02[15-12]= 5		// reset MAC register, DCORE
+		i.     SYS_FUNC_EN 0x02[10]= 1			// enable MCU register, (8051 enable)
+		******************************/
+			u16 valu16 = 0;
+			rtw_write8(Adapter, REG_MCUFWDL, 0);
+
+			valu16 = rtw_read16(Adapter, REG_SYS_FUNC_EN);
+			rtw_write16(Adapter, REG_SYS_FUNC_EN, (valu16 & (~FEN_CPUEN)));//reset MCU ,8051
+
+			valu16 = rtw_read16(Adapter, REG_SYS_FUNC_EN)&0x0FFF;
+			rtw_write16(Adapter, REG_SYS_FUNC_EN, (valu16 |(FEN_HWPDN|FEN_ELDR)));//reset MAC
+
+			#ifdef DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE
+			{
+				u8 val;
+				if( (val=rtw_read8(Adapter, REG_MCUFWDL)))
+					DBG_871X("DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE %s:%d REG_MCUFWDL:0x%02x\n", __FUNCTION__, __LINE__, val);
+			}
+			#endif
+
+
+			valu16 = rtw_read16(Adapter, REG_SYS_FUNC_EN);
+			rtw_write16(Adapter, REG_SYS_FUNC_EN, (valu16 | FEN_CPUEN));//enable MCU ,8051
+
+
+		#endif
+	}
+	else{
+		u8 retry_cnts = 0;
+
+		if(rtw_read8(Adapter, REG_MCUFWDL) & BIT1)
+		{ //IF fw in RAM code, do reset
+
+			rtw_write8(Adapter, REG_MCUFWDL, 0);
+			if(Adapter->bFWReady){
+				// 2010/08/25 MH Accordign to RD alfred's suggestion, we need to disable other
+				// HRCV INT to influence 8051 reset.
+				rtw_write8(Adapter, REG_FWIMR, 0x20);
+
+				rtw_write8(Adapter, REG_HMETFR+3, 0x20);//8051 reset by self
+
+				while( (retry_cnts++ <100) && (FEN_CPUEN &rtw_read16(Adapter, REG_SYS_FUNC_EN)))
+				{
+					rtw_udelay_os(50);//PlatformStallExecution(50);//us
+				}
+
+				if(retry_cnts >= 100){
+					DBG_8192C("%s #####=> 8051 reset failed!.........................\n", __FUNCTION__);
+					// if 8051 reset fail we trigger GPIO 0 for LA
+					//PlatformEFIOWrite4Byte(	Adapter,
+					//						REG_GPIO_PIN_CTRL,
+					//						0x00010100);
+					// 2010/08/31 MH According to Filen's info, if 8051 reset fail, reset MAC directly.
+					rtw_write8(Adapter, REG_SYS_FUNC_EN+1, 0x50);	//Reset MAC and Enable 8051
+					rtw_mdelay_os(10);
+				}
+				else {
+					//DBG_871X("%s =====> 8051 reset success (%d) .\n", __FUNCTION__, retry_cnts);
+				}
+			}
+			else {
+				DBG_871X("%s =====> 8051 in RAM but !Adapter->bFWReady\n", __FUNCTION__);
+			}
+		}
+		else{
+			//DBG_871X("%s =====> 8051 in ROM.\n", __FUNCTION__);
+		}
+
+		#ifdef DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE
+		{
+			u8 val;
+			if( (val=rtw_read8(Adapter, REG_MCUFWDL)))
+				DBG_871X("DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE %s:%d REG_MCUFWDL:0x%02x\n", __FUNCTION__, __LINE__, val);
+		}
+		#endif
+
+		rtw_write8(Adapter, REG_SYS_FUNC_EN+1, 0x54);	//Reset MAC and Enable 8051
+	}
+
+	// Clear rpwm value for initial toggle bit trigger.
+	rtw_write8(Adapter, REG_USB_HRPWM, 0x00);
+
+	if(bWithoutHWSM){
+	/*****************************
+		Without HW auto state machine
+	g.	SYS_CLKR 0x08[15:0] = 0x30A3			//disable MAC clock
+	h.	AFE_PLL_CTRL 0x28[7:0] = 0x80			//disable AFE PLL
+	i.	AFE_XTAL_CTRL 0x24[15:0] = 0x880F		//gated AFE DIG_CLOCK
+	j.	SYS_ISO_CTRL 0x00[7:0] = 0xF9			// isolated digital to PON
+	******************************/
+		//rtw_write16(Adapter, REG_SYS_CLKR, 0x30A3);
+		rtw_write16(Adapter, REG_SYS_CLKR, 0x70A3);//modify to 0x70A3 by Scott.
+		rtw_write8(Adapter, REG_AFE_PLL_CTRL, 0x80);
+		rtw_write16(Adapter, REG_AFE_XTAL_CTRL, 0x880F);
+		rtw_write8(Adapter, REG_SYS_ISO_CTRL, 0xF9);
+	}
+	else
+	{
+		// Disable all RF/BB power
+		rtw_write8(Adapter, REG_RF_CTRL, 0x00);
+	}
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("======> Reset Digital.\n"));
+
+}
+
+static VOID
+_ResetDigitalProcedure2(
+	IN 	PADAPTER			Adapter
+)
+{
+/*****************************
+k.	SYS_FUNC_EN 0x03[7:0] = 0x44			// disable ELDR runction
+l.	SYS_CLKR 0x08[15:0] = 0x3083			// disable ELDR clock
+m.	SYS_ISO_CTRL 0x01[7:0] = 0x83			// isolated ELDR to PON
+******************************/
+	//rtw_write8(Adapter, REG_SYS_FUNC_EN+1, 0x44);//marked by Scott.
+	//rtw_write16(Adapter, REG_SYS_CLKR, 0x3083);
+	//rtw_write8(Adapter, REG_SYS_ISO_CTRL+1, 0x83);
+
+	rtw_write16(Adapter, REG_SYS_CLKR, 0x70a3); //modify to 0x70a3 by Scott.
+	rtw_write8(Adapter, REG_SYS_ISO_CTRL+1, 0x82); //modify to 0x82 by Scott.
+}
+
+static VOID
+_DisableAnalog(
+	IN PADAPTER			Adapter,
+	IN BOOLEAN			bWithoutHWSM
+	)
+{
+	u16 value16 = 0;
+	u8 value8=0;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	if(bWithoutHWSM){
+	/*****************************
+	n.	LDOA15_CTRL 0x20[7:0] = 0x04		// disable A15 power
+	o.	LDOV12D_CTRL 0x21[7:0] = 0x54		// disable digital core power
+	r.	When driver call disable, the ASIC will turn off remaining clock automatically
+	******************************/
+
+		rtw_write8(Adapter, REG_LDOA15_CTRL, 0x04);
+		//PlatformIOWrite1Byte(Adapter, REG_LDOV12D_CTRL, 0x54);
+
+		value8 = rtw_read8(Adapter, REG_LDOV12D_CTRL);
+		value8 &= (~LDV12_EN);
+		rtw_write8(Adapter, REG_LDOV12D_CTRL, value8);
+		//RT_TRACE(COMP_INIT, DBG_LOUD, (" REG_LDOV12D_CTRL Reg0x21:0x%02x.\n",value8));
+	}
+
+/*****************************
+h.	SPS0_CTRL 0x11[7:0] = 0x23			//enter PFM mode
+i.	APS_FSMCO 0x04[15:0] = 0x4802		// set USB suspend
+******************************/
+
+
+	value8 = 0x23;
+	if (IS_81xxC_VENDOR_UMC_B_CUT(pHalData->VersionID))
+		value8 |= BIT3;
+
+	rtw_write8(Adapter, REG_SPS0_CTRL, value8);
+
+
+	if(bWithoutHWSM)
+	{
+		//value16 |= (APDM_HOST | /*AFSM_HSUS |*/PFM_ALDN);
+		// 2010/08/31 According to Filen description, we need to use HW to shut down 8051 automatically.
+		// Becasue suspend operatione need the asistance of 8051 to wait for 3ms.
+		value16 |= (APDM_HOST | AFSM_HSUS |PFM_ALDN);
+	}
+	else
+	{
+		value16 |= (APDM_HOST | AFSM_HSUS |PFM_ALDN);
+	}
+
+	rtw_write16(Adapter, REG_APS_FSMCO,value16 );//0x4802
+
+	rtw_write8(Adapter, REG_RSV_CTRL, 0x0e);
+
+ #if 0
+	//tynli_test for suspend mode.
+	if(!bWithoutHWSM){
+		rtw_write8(Adapter, 0xfe10, 0x19);
+	}
+#endif
+
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("======> Disable Analog Reg0x04:0x%04x.\n",value16));
+}
+
+static int
+CardDisableHWSM( // HW Auto state machine
+	IN	PADAPTER		Adapter,
+	IN	BOOLEAN			resetMCU
+	)
+{
+	int		rtStatus = _SUCCESS;
+	if(Adapter->bSurpriseRemoved){
+		return rtStatus;
+	}
+#if 1
+	//==== RF Off Sequence ====
+	_DisableRFAFEAndResetBB(Adapter);
+
+	//  ==== Reset digital sequence   ======
+	_ResetDigitalProcedure1(Adapter, _FALSE);
+
+	//  ==== Pull GPIO PIN to balance level and LED control ======
+	_DisableGPIO(Adapter);
+
+	//  ==== Disable analog sequence ===
+	_DisableAnalog(Adapter, _FALSE);
+
+	RT_TRACE(_module_hci_hal_init_c_, _drv_info_, ("======> Card disable finished.\n"));
+#else
+	_DisableGPIO(Adapter);
+
+	//reset FW download register
+	_ResetFWDownloadRegister(Adapter);
+
+
+	//disable RF/ AFE AD/DA
+	rtStatus = _DisableRF_AFE(Adapter);
+	if(RT_STATUS_SUCCESS != rtStatus){
+		RT_TRACE(COMP_INIT, DBG_SERIOUS, ("_DisableRF_AFE failed!\n"));
+		goto Exit;
+	}
+	_ResetBB(Adapter);
+
+	if(resetMCU){
+		_ResetMCU(Adapter);
+	}
+
+	_AutoPowerDownToHostOff(Adapter);
+	//_DisableMAC_AFE_PLL(Adapter);
+
+	_SetUsbSuspend(Adapter);
+Exit:
+#endif
+	return rtStatus;
+
+}
+
+static int
+CardDisableWithoutHWSM( // without HW Auto state machine
+	IN	PADAPTER		Adapter
+	)
+{
+	int		rtStatus = _SUCCESS;
+
+	if(Adapter->bSurpriseRemoved){
+		return rtStatus;
+	}
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("======> Card Disable Without HWSM .\n"));
+	//==== RF Off Sequence ====
+	_DisableRFAFEAndResetBB(Adapter);
+
+	//  ==== Reset digital sequence   ======
+	_ResetDigitalProcedure1(Adapter, _TRUE);
+
+	//  ==== Pull GPIO PIN to balance level and LED control ======
+	_DisableGPIO(Adapter);
+
+	//  ==== Reset digital sequence   ======
+	_ResetDigitalProcedure2(Adapter);
+
+	//  ==== Disable analog sequence ===
+	_DisableAnalog(Adapter, _TRUE);
+	//RT_TRACE(COMP_INIT, DBG_LOUD, ("<====== Card Disable Without HWSM .\n"));
+	return rtStatus;
+}
+
+static void rtl8192cu_hw_power_down(_adapter *padapter)
+{
+	// 2010/-8/09 MH For power down module, we need to enable register block contrl reg at 0x1c.
+	// Then enable power down control bit of register 0x04 BIT4 and BIT15 as 1.
+
+	// Enable register area 0x0-0xc.
+	rtw_write8(padapter,REG_RSV_CTRL, 0x0);
+	rtw_write16(padapter, REG_APS_FSMCO, 0x8812);
+}
+
+u32 rtl8192cu_hal_deinit(PADAPTER Adapter)
+ {
+
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	DBG_8192C("==> %s \n",__FUNCTION__);
+	// 2011/02/18 To Fix RU LNA  power leakage problem. We need to execute below below in
+	// Adapter init and halt sequence. Accordingto EEchou's opinion, we can enable the ability for all
+	// IC. Accord to johnny's opinion, only RU need the support.
+	if (IS_HARDWARE_TYPE_8192C(Adapter)  && (pHalData->BoardType == BOARD_USB_High_PA))
+		rtw_write32(Adapter, rFPGA0_XCD_RFParameter, rtw_read32(Adapter, rFPGA0_XCD_RFParameter)|BIT1);
+
+ #ifdef SUPPORT_HW_RFOFF_DETECTED
+	DBG_8192C("bkeepfwalive(%x)\n",Adapter->pwrctrlpriv.bkeepfwalive);
+	if(Adapter->pwrctrlpriv.bkeepfwalive)
+	{
+		_ps_close_RF(Adapter);
+		if((Adapter->pwrctrlpriv.bHWPwrPindetect) && (Adapter->pwrctrlpriv.bHWPowerdown))
+			rtl8192cu_hw_power_down(Adapter);
+	}
+	else
+#endif
+	{
+		if( Adapter->bCardDisableWOHSM == _FALSE)
+		{
+			DBG_8192C("card disble HWSM...........\n");
+			CardDisableHWSM(Adapter, _FALSE);
+		}
+		else
+		{
+			DBG_8192C("card disble without HWSM...........\n");
+			CardDisableWithoutHWSM(Adapter); // without HW Auto state machine
+
+			if((Adapter->pwrctrlpriv.bHWPwrPindetect ) && (Adapter->pwrctrlpriv.bHWPowerdown))
+				rtl8192cu_hw_power_down(Adapter);
+		}
+	}
+
+	return _SUCCESS;
+ }
+
+
+unsigned int rtl8192cu_inirp_init(PADAPTER Adapter)
+{
+	u8 i;
+	struct recv_buf *precvbuf;
+	uint	status;
+	struct dvobj_priv *pdev = adapter_to_dvobj(Adapter);
+	struct intf_hdl * pintfhdl=&Adapter->iopriv.intf;
+	struct recv_priv *precvpriv = &(Adapter->recvpriv);
+	u32 (*_read_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+#ifdef CONFIG_USB_INTERRUPT_IN_PIPE
+	u32 (*_read_interrupt)(struct intf_hdl *pintfhdl, u32 addr);
+#endif
+
+_func_enter_;
+
+	_read_port = pintfhdl->io_ops._read_port;
+
+	status = _SUCCESS;
+
+	RT_TRACE(_module_hci_hal_init_c_,_drv_info_,("===> usb_inirp_init \n"));
+
+	precvpriv->ff_hwaddr = RECV_BULK_IN_ADDR;
+
+	//issue Rx irp to receive data
+	precvbuf = (struct recv_buf *)precvpriv->precv_buf;
+	for(i=0; i<NR_RECVBUFF; i++)
+	{
+		if(_read_port(pintfhdl, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf) == _FALSE )
+		{
+			RT_TRACE(_module_hci_hal_init_c_,_drv_err_,("usb_rx_init: usb_read_port error \n"));
+			status = _FAIL;
+			goto exit;
+		}
+
+		precvbuf++;
+		precvpriv->free_recv_buf_queue_cnt--;
+	}
+
+#ifdef CONFIG_USB_INTERRUPT_IN_PIPE
+	_read_interrupt = pintfhdl->io_ops._read_interrupt;
+	if(_read_interrupt(pintfhdl, RECV_INT_IN_ADDR) == _FALSE )
+	{
+		RT_TRACE(_module_hci_hal_init_c_,_drv_err_,("usb_rx_init: usb_read_interrupt error \n"));
+		status = _FAIL;
+	}
+#endif
+
+exit:
+
+	RT_TRACE(_module_hci_hal_init_c_,_drv_info_,("<=== usb_inirp_init \n"));
+
+_func_exit_;
+
+	return status;
+
+}
+
+unsigned int rtl8192cu_inirp_deinit(PADAPTER Adapter)
+{
+	RT_TRACE(_module_hci_hal_init_c_,_drv_info_,("\n ===> usb_rx_deinit \n"));
+
+	rtw_read_port_cancel(Adapter);
+
+	RT_TRACE(_module_hci_hal_init_c_,_drv_info_,("\n <=== usb_rx_deinit \n"));
+
+	return _SUCCESS;
+}
+
+
+//-------------------------------------------------------------------------
+//
+//	EEPROM Power index mapping
+//
+//-------------------------------------------------------------------------
+
+ static VOID
+_ReadPowerValueFromPROM(
+	IN	PTxPowerInfo	pwrInfo,
+	IN	u8*			PROMContent,
+	IN	BOOLEAN			AutoLoadFail
+	)
+{
+	u32 rfPath, eeAddr, group;
+
+	_rtw_memset(pwrInfo, 0, sizeof(TxPowerInfo));
+
+	if(AutoLoadFail){
+		for(group = 0 ; group < CHANNEL_GROUP_MAX ; group++){
+			for(rfPath = 0 ; rfPath < RF_PATH_MAX ; rfPath++){
+				pwrInfo->CCKIndex[rfPath][group]		= EEPROM_Default_TxPowerLevel;
+				pwrInfo->HT40_1SIndex[rfPath][group]	= EEPROM_Default_TxPowerLevel;
+				pwrInfo->HT40_2SIndexDiff[rfPath][group]= EEPROM_Default_HT40_2SDiff;
+				pwrInfo->HT20IndexDiff[rfPath][group]	= EEPROM_Default_HT20_Diff;
+				pwrInfo->OFDMIndexDiff[rfPath][group]	= EEPROM_Default_LegacyHTTxPowerDiff;
+				pwrInfo->HT40MaxOffset[rfPath][group]	= EEPROM_Default_HT40_PwrMaxOffset;
+				pwrInfo->HT20MaxOffset[rfPath][group]	= EEPROM_Default_HT20_PwrMaxOffset;
+			}
+		}
+
+		pwrInfo->TSSI_A = EEPROM_Default_TSSI;
+		pwrInfo->TSSI_B = EEPROM_Default_TSSI;
+
+		return;
+	}
+
+	for(rfPath = 0 ; rfPath < RF_PATH_MAX ; rfPath++){
+		for(group = 0 ; group < CHANNEL_GROUP_MAX ; group++){
+			eeAddr = EEPROM_CCK_TX_PWR_INX + (rfPath * 3) + group;
+			pwrInfo->CCKIndex[rfPath][group] = PROMContent[eeAddr];
+
+			eeAddr = EEPROM_HT40_1S_TX_PWR_INX + (rfPath * 3) + group;
+			pwrInfo->HT40_1SIndex[rfPath][group] = PROMContent[eeAddr];
+		}
+	}
+
+	for(group = 0 ; group < CHANNEL_GROUP_MAX ; group++){
+		for(rfPath = 0 ; rfPath < RF_PATH_MAX ; rfPath++){
+			pwrInfo->HT40_2SIndexDiff[rfPath][group] =
+			(PROMContent[EEPROM_HT40_2S_TX_PWR_INX_DIFF + group] >> (rfPath * 4)) & 0xF;
+
+#if 1
+			pwrInfo->HT20IndexDiff[rfPath][group] =
+			(PROMContent[EEPROM_HT20_TX_PWR_INX_DIFF + group] >> (rfPath * 4)) & 0xF;
+			if(pwrInfo->HT20IndexDiff[rfPath][group] & BIT3)	//4bit sign number to 8 bit sign number
+				pwrInfo->HT20IndexDiff[rfPath][group] |= 0xF0;
+#else
+			pwrInfo->HT20IndexDiff[rfPath][group] =
+			(PROMContent[EEPROM_HT20_TX_PWR_INX_DIFF + group] >> (rfPath * 4)) & 0xF;
+#endif
+
+			pwrInfo->OFDMIndexDiff[rfPath][group] =
+			(PROMContent[EEPROM_OFDM_TX_PWR_INX_DIFF+ group] >> (rfPath * 4)) & 0xF;
+
+			pwrInfo->HT40MaxOffset[rfPath][group] =
+			(PROMContent[EEPROM_HT40_MAX_PWR_OFFSET+ group] >> (rfPath * 4)) & 0xF;
+
+			pwrInfo->HT20MaxOffset[rfPath][group] =
+			(PROMContent[EEPROM_HT20_MAX_PWR_OFFSET+ group] >> (rfPath * 4)) & 0xF;
+		}
+	}
+
+	pwrInfo->TSSI_A = PROMContent[EEPROM_TSSI_A];
+	pwrInfo->TSSI_B = PROMContent[EEPROM_TSSI_B];
+
+}
+
+
+static u32
+_GetChannelGroup(
+	IN	u32	channel
+	)
+{
+	//RT_ASSERT((channel < 14), ("Channel %d no is supported!\n"));
+
+	if(channel < 3){ 	// Channel 1~3
+		return 0;
+	}
+	else if(channel < 9){ // Channel 4~9
+		return 1;
+	}
+
+	return 2;				// Channel 10~14
+}
+
+
+static VOID
+ReadTxPowerInfo(
+	IN	PADAPTER 		Adapter,
+	IN	u8*			PROMContent,
+	IN	BOOLEAN			AutoLoadFail
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	TxPowerInfo		pwrInfo;
+	u32			rfPath, ch, group;
+	u8			pwr, diff;
+
+	_ReadPowerValueFromPROM(&pwrInfo, PROMContent, AutoLoadFail);
+
+	if(!AutoLoadFail)
+		pHalData->bTXPowerDataReadFromEEPORM = _TRUE;
+
+	for(rfPath = 0 ; rfPath < RF_PATH_MAX ; rfPath++){
+		for(ch = 0 ; ch < CHANNEL_MAX_NUMBER ; ch++){
+			group = _GetChannelGroup(ch);
+
+			pHalData->TxPwrLevelCck[rfPath][ch]		= pwrInfo.CCKIndex[rfPath][group];
+			pHalData->TxPwrLevelHT40_1S[rfPath][ch]	= pwrInfo.HT40_1SIndex[rfPath][group];
+
+			pHalData->TxPwrHt20Diff[rfPath][ch]		= pwrInfo.HT20IndexDiff[rfPath][group];
+			pHalData->TxPwrLegacyHtDiff[rfPath][ch]	= pwrInfo.OFDMIndexDiff[rfPath][group];
+			pHalData->PwrGroupHT20[rfPath][ch]		= pwrInfo.HT20MaxOffset[rfPath][group];
+			pHalData->PwrGroupHT40[rfPath][ch]		= pwrInfo.HT40MaxOffset[rfPath][group];
+
+			pwr		= pwrInfo.HT40_1SIndex[rfPath][group];
+			diff	= pwrInfo.HT40_2SIndexDiff[rfPath][group];
+
+			pHalData->TxPwrLevelHT40_2S[rfPath][ch]  = (pwr > diff) ? (pwr - diff) : 0;
+		}
+	}
+
+#if DBG
+
+	for(rfPath = 0 ; rfPath < RF_PATH_MAX ; rfPath++){
+		for(ch = 0 ; ch < CHANNEL_MAX_NUMBER ; ch++){
+			RTPRINT(FINIT, INIT_TxPower,
+				("RF(%d)-Ch(%d) [CCK / HT40_1S / HT40_2S] = [0x%x / 0x%x / 0x%x]\n",
+				rfPath, ch, pHalData->TxPwrLevelCck[rfPath][ch],
+				pHalData->TxPwrLevelHT40_1S[rfPath][ch],
+				pHalData->TxPwrLevelHT40_2S[rfPath][ch]));
+
+		}
+	}
+
+	for(ch = 0 ; ch < CHANNEL_MAX_NUMBER ; ch++){
+		RTPRINT(FINIT, INIT_TxPower, ("RF-A Ht20 to HT40 Diff[%d] = 0x%x\n", ch, pHalData->TxPwrHt20Diff[RF_PATH_A][ch]));
+	}
+
+	for(ch = 0 ; ch < CHANNEL_MAX_NUMBER ; ch++){
+		RTPRINT(FINIT, INIT_TxPower, ("RF-A Legacy to Ht40 Diff[%d] = 0x%x\n", ch, pHalData->TxPwrLegacyHtDiff[RF_PATH_A][ch]));
+	}
+
+	for(ch = 0 ; ch < CHANNEL_MAX_NUMBER ; ch++){
+		RTPRINT(FINIT, INIT_TxPower, ("RF-B Ht20 to HT40 Diff[%d] = 0x%x\n", ch, pHalData->TxPwrHt20Diff[RF_PATH_B][ch]));
+	}
+
+	for(ch = 0 ; ch < CHANNEL_MAX_NUMBER ; ch++){
+		RTPRINT(FINIT, INIT_TxPower, ("RF-B Legacy to HT40 Diff[%d] = 0x%x\n", ch, pHalData->TxPwrLegacyHtDiff[RF_PATH_B][ch]));
+	}
+
+#endif
+	// 2010/10/19 MH Add Regulator recognize for CU.
+	if(!AutoLoadFail)
+	{
+		pHalData->EEPROMRegulatory = (PROMContent[RF_OPTION1]&0x7);	//bit0~2
+	}
+	else
+	{
+		pHalData->EEPROMRegulatory = 0;
+	}
+	DBG_8192C("EEPROMRegulatory = 0x%x\n", pHalData->EEPROMRegulatory);
+
+}
+
+
+//-------------------------------------------------------------------
+//
+//	EEPROM/EFUSE Content Parsing
+//
+//-------------------------------------------------------------------
+static void
+_ReadIDs(
+	IN	PADAPTER	Adapter,
+	IN	u8*		PROMContent,
+	IN	BOOLEAN		AutoloadFail
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	if(_FALSE == AutoloadFail){
+		// VID, PID
+		pHalData->EEPROMVID = le16_to_cpu( *(u16 *)&PROMContent[EEPROM_VID]);
+		pHalData->EEPROMPID = le16_to_cpu( *(u16 *)&PROMContent[EEPROM_PID]);
+
+		// Customer ID, 0x00 and 0xff are reserved for Realtek.
+		pHalData->EEPROMCustomerID = *(u8 *)&PROMContent[EEPROM_CUSTOMER_ID];
+		pHalData->EEPROMSubCustomerID = *(u8 *)&PROMContent[EEPROM_SUBCUSTOMER_ID];
+
+	}
+	else{
+		pHalData->EEPROMVID	 = EEPROM_Default_VID;
+		pHalData->EEPROMPID	 = EEPROM_Default_PID;
+
+		// Customer ID, 0x00 and 0xff are reserved for Realtek.
+		pHalData->EEPROMCustomerID	= EEPROM_Default_CustomerID;
+		pHalData->EEPROMSubCustomerID = EEPROM_Default_SubCustomerID;
+
+	}
+
+	// For customized behavior.
+	if((pHalData->EEPROMVID == 0x103C) && (pHalData->EEPROMVID == 0x1629))// HP Lite-On for RTL8188CUS Slim Combo.
+		pHalData->CustomerID = RT_CID_819x_HP;
+
+	//	Decide CustomerID according to VID/DID or EEPROM
+	switch(pHalData->EEPROMCustomerID)
+	{
+		case EEPROM_CID_DEFAULT:
+			if((pHalData->EEPROMVID == 0x2001) && (pHalData->EEPROMPID == 0x3308))
+				pHalData->CustomerID = RT_CID_DLINK;
+			else if((pHalData->EEPROMVID == 0x2001) && (pHalData->EEPROMPID == 0x3309))
+				pHalData->CustomerID = RT_CID_DLINK;
+			else if((pHalData->EEPROMVID == 0x2001) && (pHalData->EEPROMPID == 0x330a))
+				pHalData->CustomerID = RT_CID_DLINK;
+			break;
+		case EEPROM_CID_WHQL:
+/*
+			Adapter->bInHctTest = TRUE;
+
+			pMgntInfo->bSupportTurboMode = FALSE;
+			pMgntInfo->bAutoTurboBy8186 = FALSE;
+
+			pMgntInfo->PowerSaveControl.bInactivePs = FALSE;
+			pMgntInfo->PowerSaveControl.bIPSModeBackup = FALSE;
+			pMgntInfo->PowerSaveControl.bLeisurePs = FALSE;
+
+			pMgntInfo->keepAliveLevel = 0;
+
+			Adapter->bUnloadDriverwhenS3S4 = FALSE;
+*/
+			break;
+		default:
+			pHalData->CustomerID = RT_CID_DEFAULT;
+			break;
+
+	}
+
+	MSG_8192C("EEPROMVID = 0x%04x\n", pHalData->EEPROMVID);
+	MSG_8192C("EEPROMPID = 0x%04x\n", pHalData->EEPROMPID);
+	MSG_8192C("EEPROMCustomerID : 0x%02x\n", pHalData->EEPROMCustomerID);
+	MSG_8192C("EEPROMSubCustomerID: 0x%02x\n", pHalData->EEPROMSubCustomerID);
+
+	MSG_8192C("RT_CustomerID: 0x%02x\n", pHalData->CustomerID);
+
+}
+
+
+static VOID
+_ReadMACAddress(
+	IN	PADAPTER	Adapter,
+	IN	u8*		PROMContent,
+	IN	BOOLEAN		AutoloadFail
+	)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(Adapter);
+
+	if(_FALSE == AutoloadFail){
+		//Read Permanent MAC address and set value to hardware
+		_rtw_memcpy(pEEPROM->mac_addr, &PROMContent[EEPROM_MAC_ADDR], ETH_ALEN);
+	}
+	else{
+		//Random assigh MAC address
+		u8 sMacAddr[MAC_ADDR_LEN] = {0x00, 0xE0, 0x4C, 0x81, 0x92, 0x00};
+		//sMacAddr[5] = (u8)GetRandomNumber(1, 254);
+		_rtw_memcpy(pEEPROM->mac_addr, sMacAddr, ETH_ALEN);
+	}
+	DBG_8192C("%s MAC Address from EFUSE = "MAC_FMT"\n",__FUNCTION__, MAC_ARG(pEEPROM->mac_addr));
+	//NicIFSetMacAddress(Adapter, Adapter->PermanentAddress);
+	//RT_PRINT_ADDR(COMP_INIT|COMP_EFUSE, DBG_LOUD, "MAC Addr: %s", Adapter->PermanentAddress);
+
+}
+
+static VOID
+_ReadBoardType(
+	IN	PADAPTER	Adapter,
+	IN	u8*		PROMContent,
+	IN	BOOLEAN		AutoloadFail
+	)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(Adapter);
+	u32			value32;
+	u8			boardType = BOARD_USB_DONGLE;
+
+	if(AutoloadFail){
+		if(IS_8723_SERIES(pHalData->VersionID))
+			pHalData->rf_type = RF_1T1R;
+		else
+		        pHalData->rf_type = RF_2T2R;
+
+		pHalData->BluetoothCoexist = _FALSE;
+		pHalData->BoardType = boardType;
+		return;
+	}
+
+	boardType = PROMContent[EEPROM_NORMAL_BoardType];
+	boardType &= BOARD_TYPE_NORMAL_MASK;//bit[7:5]
+	boardType >>= 5;
+
+	pHalData->BoardType = boardType;
+	MSG_8192C("_ReadBoardType(%x)\n",pHalData->BoardType);
+
+	if (boardType == BOARD_USB_High_PA)
+		pHalData->ExternalPA = 1;
+}
+
+
+static VOID
+_ReadLEDSetting(
+	IN	PADAPTER	Adapter,
+	IN	u8*		PROMContent,
+	IN	BOOLEAN		AutoloadFail
+	)
+{
+	struct led_priv *pledpriv = &(Adapter->ledpriv);
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+#ifdef CONFIG_SW_LED
+	pledpriv->bRegUseLed = _TRUE;
+
+	//
+	// Led mode
+	//
+	switch(pHalData->CustomerID)
+	{
+		case RT_CID_DEFAULT:
+			pledpriv->LedStrategy = SW_LED_MODE1;
+			pledpriv->bRegUseLed = _TRUE;
+			break;
+
+		case RT_CID_819x_HP:
+			pledpriv->LedStrategy = SW_LED_MODE6;
+			break;
+
+		default:
+			pledpriv->LedStrategy = SW_LED_MODE1;
+			break;
+	}
+
+	if( BOARD_MINICARD == pHalData->BoardType )
+	{
+		pledpriv->LedStrategy = SW_LED_MODE6;
+	}
+	pHalData->bLedOpenDrain = _TRUE;// Support Open-drain arrangement for controlling the LED. Added by Roger, 2009.10.16.
+#else // HW LED
+	pledpriv->LedStrategy = HW_LED;
+#endif //CONFIG_SW_LED
+}
+
+static VOID
+_ReadThermalMeter(
+	IN	PADAPTER	Adapter,
+	IN	u8* 	PROMContent,
+	IN	BOOLEAN 	AutoloadFail
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	u8	tempval;
+
+	//
+	// ThermalMeter from EEPROM
+	//
+	if(!AutoloadFail)
+		tempval = PROMContent[EEPROM_THERMAL_METER];
+	else
+		tempval = EEPROM_Default_ThermalMeter;
+
+	pHalData->EEPROMThermalMeter = (tempval&0x1f);	//[4:0]
+
+	if(pHalData->EEPROMThermalMeter == 0x1f || AutoloadFail)
+		pdmpriv->bAPKThermalMeterIgnore = _TRUE;
+
+#if 0
+	if(pHalData->EEPROMThermalMeter < 0x06 || pHalData->EEPROMThermalMeter > 0x1c)
+		pHalData->EEPROMThermalMeter = 0x12;
+#endif
+
+	pdmpriv->ThermalMeter[0] = pHalData->EEPROMThermalMeter;
+
+	//RTPRINT(FINIT, INIT_TxPower, ("ThermalMeter = 0x%x\n", pHalData->EEPROMThermalMeter));
+
+}
+
+static VOID
+_ReadRFSetting(
+	IN	PADAPTER	Adapter,
+	IN	u8* 	PROMContent,
+	IN	BOOLEAN 	AutoloadFail
+	)
+{
+}
+
+static void
+_ReadPROMVersion(
+	IN	PADAPTER	Adapter,
+	IN	u8* 	PROMContent,
+	IN	BOOLEAN 	AutoloadFail
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	if(AutoloadFail){
+		pHalData->EEPROMVersion = EEPROM_Default_Version;
+	}
+	else{
+		pHalData->EEPROMVersion = *(u8 *)&PROMContent[EEPROM_VERSION];
+	}
+}
+
+static VOID
+readAntennaDiversity(
+	IN	PADAPTER	pAdapter,
+	IN	u8			*hwinfo,
+	IN	BOOLEAN		AutoLoadFail
+	)
+{
+
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	struct registry_priv	*registry_par = &pAdapter->registrypriv;
+
+	if(!AutoLoadFail)
+	{
+		// Antenna Diversity setting.
+		if(registry_par->antdiv_cfg == 2) // 2: From Efuse
+			pHalData->AntDivCfg = (hwinfo[EEPROM_RF_OPT1]&0x18)>>3;
+		else
+			pHalData->AntDivCfg = registry_par->antdiv_cfg ;  // 0:OFF , 1:ON,
+
+		DBG_8192C("### AntDivCfg(%x)\n",pHalData->AntDivCfg);
+
+		//if(pHalData->EEPROMBluetoothCoexist!=0 && pHalData->EEPROMBluetoothAntNum==Ant_x1)
+		//	pHalData->AntDivCfg = 0;
+	}
+	else
+	{
+		pHalData->AntDivCfg = 0;
+	}
+
+}
+
+static VOID
+hal_InitPGData(
+	IN	PADAPTER	pAdapter,
+	IN	OUT	u8		*PROMContent
+	)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(pAdapter);
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(pAdapter);
+	u32	i;
+	u16	value16;
+
+	if(_FALSE == pEEPROM->bautoload_fail_flag)
+	{ // autoload OK.
+		if (_TRUE == pEEPROM->EepromOrEfuse)
+		{
+			// Read all Content from EEPROM or EFUSE.
+			for(i = 0; i < HWSET_MAX_SIZE; i += 2)
+			{
+				//value16 = EF2Byte(ReadEEprom(pAdapter, (u2Byte) (i>>1)));
+				//*((u16 *)(&PROMContent[i])) = value16;
+			}
+		}
+		else
+		{
+			// Read EFUSE real map to shadow.
+			EFUSE_ShadowMapUpdate(pAdapter, EFUSE_WIFI, _FALSE);
+			_rtw_memcpy((void*)PROMContent, (void*)pEEPROM->efuse_eeprom_data, HWSET_MAX_SIZE);
+		}
+	}
+	else
+	{//autoload fail
+		//RT_TRACE(COMP_INIT, DBG_LOUD, ("AutoLoad Fail reported from CR9346!!\n"));
+		pEEPROM->bautoload_fail_flag = _TRUE;
+		//update to default value 0xFF
+		if (_FALSE == pEEPROM->EepromOrEfuse)
+		EFUSE_ShadowMapUpdate(pAdapter, EFUSE_WIFI, _FALSE);
+	}
+}
+// Read HW power down mode selection
+static void _ReadPSSetting(IN PADAPTER Adapter,IN u8*PROMContent,IN u8	AutoloadFail)
+{
+	if(AutoloadFail){
+		Adapter->pwrctrlpriv.bHWPowerdown = _FALSE;
+		Adapter->pwrctrlpriv.bSupportRemoteWakeup = _FALSE;
+	}
+	else	{
+		//if(SUPPORT_HW_RADIO_DETECT(Adapter))
+			Adapter->pwrctrlpriv.bHWPwrPindetect = Adapter->registrypriv.hwpwrp_detect;
+		//else
+			//Adapter->pwrctrlpriv.bHWPwrPindetect = _FALSE;//dongle not support new
+
+
+		//hw power down mode selection , 0:rf-off / 1:power down
+
+		if(Adapter->registrypriv.hwpdn_mode==2)
+			Adapter->pwrctrlpriv.bHWPowerdown = (PROMContent[EEPROM_RF_OPT3] & BIT4);
+		else
+			Adapter->pwrctrlpriv.bHWPowerdown = Adapter->registrypriv.hwpdn_mode;
+#ifdef CONFIG_WOWLAN
+		// decide hw if support remote wakeup function
+		// if hw supported, 8051 (SIE) will generate WeakUP signal( D+/D- toggle) when autoresume
+		Adapter->pwrctrlpriv.bSupportRemoteWakeup = (PROMContent[EEPROM_TEST_USB_OPT] & BIT1)?_TRUE :_FALSE;
+#endif //CONFIG_WOWLAN
+
+		//if(SUPPORT_HW_RADIO_DETECT(Adapter))
+			//Adapter->registrypriv.usbss_enable = Adapter->pwrctrlpriv.bSupportRemoteWakeup ;
+
+		DBG_8192C("%s...bHWPwrPindetect(%x)-bHWPowerdown(%x) ,bSupportRemoteWakeup(%x)\n",__FUNCTION__,
+		Adapter->pwrctrlpriv.bHWPwrPindetect,Adapter->pwrctrlpriv.bHWPowerdown ,Adapter->pwrctrlpriv.bSupportRemoteWakeup);
+
+		DBG_8192C("### PS params=>  power_mgnt(%x),usbss_enable(%x) ###\n",Adapter->registrypriv.power_mgnt,Adapter->registrypriv.usbss_enable);
+
+	}
+
+}
+
+static VOID
+readAdapterInfo_8192CU(
+	IN	PADAPTER	Adapter
+	)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(Adapter);
+	PHAL_DATA_TYPE pHalData = GET_HAL_DATA(Adapter);
+	u8	PROMContent[HWSET_MAX_SIZE]={0};
+
+	hal_InitPGData(Adapter, PROMContent);
+	rtl8192c_EfuseParseIDCode(Adapter, PROMContent);
+
+	_ReadPROMVersion(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+	_ReadIDs(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+	_ReadMACAddress(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+	ReadTxPowerInfo(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+	_ReadBoardType(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+
+#ifdef CONFIG_BT_COEXIST
+	//
+	// Read Bluetooth co-exist and initialize
+	//
+	rtl8192c_ReadBluetoothCoexistInfo(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+#endif
+
+	rtl8192c_EfuseParseChnlPlan(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+	_ReadThermalMeter(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+	_ReadLEDSetting(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+	_ReadRFSetting(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+	_ReadPSSetting(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+	readAntennaDiversity(Adapter, PROMContent, pEEPROM->bautoload_fail_flag);
+
+	//hal_CustomizedBehavior_8723U(Adapter);
+
+	Adapter->bDongle = (PROMContent[EEPROM_EASY_REPLACEMENT] == 1)? 0: 1;
+	DBG_8192C("%s(): REPLACEMENT = %x\n",__FUNCTION__,Adapter->bDongle);
+#ifdef CONFIG_INTEL_PROXIM
+		/* for intel proximity */
+	if (pHalData->rf_type== RF_1T1R) {
+		Adapter->proximity.proxim_support = _TRUE;
+	} else if (pHalData->rf_type== RF_2T2R) {
+		if ((pHalData->EEPROMPID == 0x8186) &&
+			(pHalData->EEPROMVID== 0x0bda))
+		Adapter->proximity.proxim_support = _TRUE;
+	} else {
+		Adapter->proximity.proxim_support = _FALSE;
+	}
+#endif //CONFIG_INTEL_PROXIM
+}
+
+static void _ReadPROMContent(
+	IN PADAPTER 		Adapter
+	)
+{
+	EEPROM_EFUSE_PRIV *pEEPROM = GET_EEPROM_EFUSE_PRIV(Adapter);
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u8			PROMContent[HWSET_MAX_SIZE]={0};
+	u8			eeValue;
+	u32			i;
+	u16			value16;
+
+	eeValue = rtw_read8(Adapter, REG_9346CR);
+	// To check system boot selection.
+	pEEPROM->EepromOrEfuse		= (eeValue & BOOT_FROM_EEPROM) ? _TRUE : _FALSE;
+	pEEPROM->bautoload_fail_flag	= (eeValue & EEPROM_EN) ? _FALSE : _TRUE;
+
+
+	DBG_8192C("Boot from %s, Autoload %s !\n", (pEEPROM->EepromOrEfuse ? "EEPROM" : "EFUSE"),
+				(pEEPROM->bautoload_fail_flag ? "Fail" : "OK") );
+
+	//pHalData->EEType = IS_BOOT_FROM_EEPROM(Adapter) ? EEPROM_93C46 : EEPROM_BOOT_EFUSE;
+
+	//if(IS_HARDWARE_TYPE_8723A(Adapter))
+	//	readAdapterInfo_8723U(Adapter);
+	//else
+		readAdapterInfo_8192CU(Adapter);
+}
+
+
+static VOID
+_InitOtherVariable(
+	IN PADAPTER 		Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+
+	//if(Adapter->bInHctTest){
+	//	pMgntInfo->PowerSaveControl.bInactivePs = FALSE;
+	//	pMgntInfo->PowerSaveControl.bIPSModeBackup = FALSE;
+	//	pMgntInfo->PowerSaveControl.bLeisurePs = FALSE;
+	//	pMgntInfo->keepAliveLevel = 0;
+	//}
+
+	// 2009/06/10 MH For 92S 1*1=1R/ 1*2&2*2 use 2R. We default set 1*1 use radio A
+	// So if you want to use radio B. Please modify RF path enable bit for correct signal
+	// strength calculate.
+	if (pHalData->rf_type == RF_1T1R){
+		pHalData->bRFPathRxEnable[0] = _TRUE;
+	}
+	else{
+		pHalData->bRFPathRxEnable[0] = pHalData->bRFPathRxEnable[1] = _TRUE;
+	}
+
+}
+
+static VOID
+_ReadRFType(
+	IN	PADAPTER	Adapter
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+#if DISABLE_BB_RF
+	pHalData->rf_chip = RF_PSEUDO_11N;
+#else
+	pHalData->rf_chip = RF_6052;
+#endif
+}
+
+void _ReadSilmComboMode(PADAPTER Adapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+	pHalData->SlimComboDbg = _FALSE;	// Default is not debug mode.
+
+	// 2010/11/22 MH We need to enter debug mode for TSMA and UMC A cut
+	if ((Adapter->chip_type == RTL8188C_8192C) &&
+		(pHalData->BoardType == BOARD_USB_COMBO))
+	{
+		switch (pHalData->VersionID)
+		{
+			case	VERSION_NORMAL_TSMC_CHIP_88C:
+			case	VERSION_NORMAL_TSMC_CHIP_92C:
+			case	VERSION_NORMAL_TSMC_CHIP_92C_1T2R:
+			case	VERSION_NORMAL_UMC_CHIP_88C_A_CUT:
+			case	VERSION_NORMAL_UMC_CHIP_92C_A_CUT:
+			case	VERSION_NORMAL_UMC_CHIP_92C_1T2R_A_CUT:
+				if ((rtw_read8(Adapter, REG_SYS_CFG+3) &0xF0) == 0x20)
+					pHalData->SlimComboDbg = _TRUE;
+
+				break;
+
+			case	VERSION_NORMAL_UMC_CHIP_88C_B_CUT:
+			case	VERSION_NORMAL_UMC_CHIP_92C_B_CUT:
+			case	VERSION_NORMAL_UMC_CHIP_92C_1T2R_B_CUT:
+				// 2011/02/15 MH UNC-B cut ECO fail, we need to support slim combo debug mode.
+				if ((rtw_read8(Adapter, REG_SYS_CFG+3) &0xF0) == 0x20)
+					pHalData->SlimComboDbg = _TRUE;
+				break;
+
+			default:
+				break;
+		}
+
+	}
+
+}
+static int _ReadAdapterInfo8192CU(PADAPTER	Adapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u32 start=rtw_get_current_time();
+
+	MSG_8192C("====> ReadAdapterInfo8192C\n");
+
+	//Efuse_InitSomeVar(Adapter);
+
+	//if(IS_HARDWARE_TYPE_8723A(Adapter))
+	//	_EfuseCellSel(Adapter);
+
+	_ReadRFType(Adapter);//rf_chip -> _InitRFType()
+	_ReadPROMContent(Adapter);
+
+	// 2010/10/25 MH THe function must be called after borad_type & IC-Version recognize.
+	_ReadSilmComboMode(Adapter);
+
+	_InitOtherVariable(Adapter);
+
+	//MSG_8192C("%s()(done), rf_chip=0x%x, rf_type=0x%x\n",  __FUNCTION__, pHalData->rf_chip, pHalData->rf_type);
+
+	MSG_8192C("<==== ReadAdapterInfo8192C in %d ms\n", rtw_get_passing_time_ms(start));
+
+	return _SUCCESS;
+}
+
+
+static void ReadAdapterInfo8192CU(PADAPTER Adapter)
+{
+	// Read EEPROM size before call any EEPROM function
+	//Adapter->EepromAddressSize=Adapter->HalFunc.GetEEPROMSizeHandler(Adapter);
+	Adapter->EepromAddressSize = GetEEPROMSize8192C(Adapter);
+
+	_ReadAdapterInfo8192CU(Adapter);
+}
+
+
+#define GPIO_DEBUG_PORT_NUM 0
+static void rtl8192cu_trigger_gpio_0(_adapter *padapter)
+{
+
+	u32 gpioctrl;
+	DBG_8192C("==> trigger_gpio_0...\n");
+	rtw_write16_async(padapter,REG_GPIO_PIN_CTRL,0);
+	rtw_write8_async(padapter,REG_GPIO_PIN_CTRL+2,0xFF);
+	gpioctrl = (BIT(GPIO_DEBUG_PORT_NUM)<<24 )|(BIT(GPIO_DEBUG_PORT_NUM)<<16);
+	rtw_write32_async(padapter,REG_GPIO_PIN_CTRL,gpioctrl);
+	gpioctrl |= (BIT(GPIO_DEBUG_PORT_NUM)<<8);
+	rtw_write32_async(padapter,REG_GPIO_PIN_CTRL,gpioctrl);
+	DBG_8192C("<=== trigger_gpio_0...\n");
+
+}
+
+static void ResumeTxBeacon(_adapter *padapter)
+{
+	HAL_DATA_TYPE*	pHalData = GET_HAL_DATA(padapter);
+
+	// 2010.03.01. Marked by tynli. No need to call workitem beacause we record the value
+	// which should be read from register to a global variable.
+
+	rtw_write8(padapter, REG_FWHW_TXQ_CTRL+2, (pHalData->RegFwHwTxQCtrl) | BIT6);
+	pHalData->RegFwHwTxQCtrl |= BIT6;
+}
+
+static void StopTxBeacon(_adapter *padapter)
+{
+	HAL_DATA_TYPE*	pHalData = GET_HAL_DATA(padapter);
+
+	// 2010.03.01. Marked by tynli. No need to call workitem beacause we record the value
+	// which should be read from register to a global variable.
+
+	rtw_write8(padapter, REG_FWHW_TXQ_CTRL+2, (pHalData->RegFwHwTxQCtrl) & (~BIT6));
+	pHalData->RegFwHwTxQCtrl &= (~BIT6);
+
+	 //todo: CheckFwRsvdPageContent(Adapter);  // 2010.06.23. Added by tynli.
+
+}
+
+u16 CRC16(u8 data,u16 CRC)
+{
+	unsigned char shift_in,CRC_BIT15,DataBit,CRC_BIT11,CRC_BIT4 ;
+	int index;
+	unsigned short CRC_Result;
+
+	for(index=0;index<8;index++)
+	{
+		CRC_BIT15=((CRC&BIT15) ? 1:0);
+		DataBit  =(data&(BIT0<<index) ? 1:0);
+		shift_in=CRC_BIT15^DataBit;
+		//printf("CRC_BIT15=%d, DataBit=%d, shift_in=%d \n",CRC_BIT15,DataBit,shift_in);
+
+		CRC_Result=CRC<<1;
+		//set BIT0
+		//	printf("CRC =%x\n",CRC_Result);
+		//CRC bit 0 =shift_in,
+		if(shift_in==0)
+		{
+			CRC_Result&=(~BIT0);
+		}
+		else
+		{
+			CRC_Result|=BIT0;
+		}
+		//printf("CRC =%x\n",CRC_Result);
+
+		CRC_BIT11 = ((CRC&BIT11) ? 1:0)^shift_in;
+		if(CRC_BIT11==0)
+		{
+			CRC_Result&=(~BIT12);
+		}
+		else
+		{
+			CRC_Result|=BIT12;
+		}
+		//printf("bit12 CRC =%x\n",CRC_Result);
+
+		CRC_BIT4 = ((CRC&BIT4) ? 1:0)^shift_in;
+		if(CRC_BIT4==0)
+		{
+			CRC_Result&=(~BIT5);
+		}
+		else
+		{
+			CRC_Result|=BIT5;
+		}
+		//printf("bit5 CRC =%x\n",CRC_Result);
+
+		CRC=CRC_Result; //���ƨϥΤW�@�������G
+	}
+
+	return CRC;
+
+}
+
+
+/////////////////////////////////////////////////
+//
+//function name :calc_crc
+//
+//input         : char* pattern , pattern size
+//
+//////////////////////////////////////////////////
+u16 calc_crc(u8 * pdata,int length)
+{
+//    unsigned char data[2]={0xC6,0xAA};
+	u16 CRC=0xffff;
+	int i;
+
+	for(i=0;i<length;i++)
+	{
+		CRC=CRC16(pdata[i],CRC);
+	}
+
+	CRC=~CRC;                  //���ɼ�
+	printk("CRC =%x\n",CRC);
+	return CRC;
+}
+
+static void hw_var_set_opmode(PADAPTER Adapter, u8 variable, u8* val)
+{
+	u8	val8;
+	u8	mode = *((u8 *)val);
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(Adapter->iface_type == IFACE_PORT1)
+	{
+		// disable Port1 TSF update
+		rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)|BIT(4));
+
+		// set net_type
+		val8 = rtw_read8(Adapter, MSR)&0x03;
+		val8 |= (mode<<2);
+		rtw_write8(Adapter, MSR, val8);
+
+		//reset TSF1
+		rtw_write8(Adapter, REG_DUAL_TSF_RST, BIT(1));
+
+		DBG_871X("%s()-%d mode = %d\n", __FUNCTION__, __LINE__, mode);
+
+		if((mode == _HW_STATE_STATION_) || (mode == _HW_STATE_NOLINK_))
+		{
+			if(!check_buddy_mlmeinfo_state(Adapter, WIFI_FW_AP_STATE))
+			{
+				StopTxBeacon(Adapter);
+			}
+
+			rtw_write8(Adapter,REG_BCN_CTRL_1, 0x19);//disable atim wnd
+			//rtw_write8(Adapter,REG_BCN_CTRL_1, 0x18);
+		}
+		else if((mode == _HW_STATE_ADHOC_) /*|| (mode == _HW_STATE_AP_)*/)
+		{
+			ResumeTxBeacon(Adapter);
+			rtw_write8(Adapter,REG_BCN_CTRL_1, 0x1a);
+		}
+		else if(mode == _HW_STATE_AP_)
+		{
+			ResumeTxBeacon(Adapter);
+
+			rtw_write8(Adapter, REG_BCN_CTRL_1, 0x12);
+
+			//Set RCR
+			//rtw_write32(padapter, REG_RCR, 0x70002a8e);//CBSSID_DATA must set to 0
+			rtw_write32(Adapter, REG_RCR, 0x7000228e);//CBSSID_DATA must set to 0
+			//enable to rx data frame
+			rtw_write16(Adapter, REG_RXFLTMAP2, 0xFFFF);
+			//enable to rx ps-poll
+			rtw_write16(Adapter, REG_RXFLTMAP1, 0x0400);
+
+			//Beacon Control related register for first time
+			rtw_write8(Adapter, REG_BCNDMATIM, 0x02); // 2ms
+			rtw_write8(Adapter, REG_DRVERLYINT, 0x05);// 5ms
+			//rtw_write8(Adapter, REG_BCN_MAX_ERR, 0xFF);
+			rtw_write8(Adapter, REG_ATIMWND_1, 0x0a); // 10ms for port1
+			rtw_write16(Adapter, REG_BCNTCFG, 0x00);
+			rtw_write16(Adapter, REG_TBTT_PROHIBIT, 0xff04);
+			rtw_write16(Adapter, REG_TSFTR_SYN_OFFSET, 0x7fff);// +32767 (~32ms)
+
+
+			//enable BCN1 Function for if2
+			//don't enable update TSF1 for if2 (due to TSF update when beacon/probe rsp are received)
+			rtw_write8(Adapter, REG_BCN_CTRL_1, (DIS_TSF_UDT0_NORMAL_CHIP|EN_BCN_FUNCTION | EN_TXBCN_RPT|BIT(1)));
+
+#ifdef CONFIG_CONCURRENT_MODE
+			if(check_buddy_fwstate(Adapter, WIFI_FW_NULL_STATE))
+				rtw_write8(Adapter, REG_BCN_CTRL,
+					rtw_read8(Adapter, REG_BCN_CTRL) & ~EN_BCN_FUNCTION);
+#endif
+
+			DBG_871X("%s()-%d: REG_BCN_CTRL_1 = %02x\n", __FUNCTION__, __LINE__, rtw_read8(Adapter, REG_BCN_CTRL_1));
+
+                        //BCN1 TSF will sync to BCN0 TSF with offset(0x518) if if1_sta linked
+			//rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)|BIT(5));
+			//rtw_write8(Adapter, REG_DUAL_TSF_RST, BIT(3));
+
+			//dis BCN0 ATIM  WND if if1 is station
+			rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)|BIT(0));
+#ifdef CONFIG_TSF_RESET_OFFLOAD
+			// Reset TSF for STA+AP concurrent mode
+			if ( check_buddy_fwstate(Adapter, (WIFI_STATION_STATE|WIFI_ASOC_STATE)) ) {
+				if (reset_tsf(Adapter, IFACE_PORT1) == _FALSE)
+					DBG_871X("ERROR! %s()-%d: Reset port1 TSF fail\n",
+						__FUNCTION__, __LINE__);
+			}
+#endif	// CONFIG_TSF_RESET_OFFLOAD
+		}
+
+	}
+	else	// (Adapter->iface_type == IFACE_PORT1)
+#endif //CONFIG_CONCURRENT_MODE
+	{
+		// disable Port0 TSF update
+		rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)|BIT(4));
+
+		// set net_type
+		val8 = rtw_read8(Adapter, MSR)&0x0c;
+		val8 |= mode;
+		rtw_write8(Adapter, MSR, val8);
+
+		//reset TSF0
+		rtw_write8(Adapter, REG_DUAL_TSF_RST, BIT(0));
+
+		DBG_871X("%s()-%d mode = %d\n", __FUNCTION__, __LINE__, mode);
+
+		if((mode == _HW_STATE_STATION_) || (mode == _HW_STATE_NOLINK_))
+		{
+#ifdef CONFIG_CONCURRENT_MODE
+			if(!check_buddy_mlmeinfo_state(Adapter, WIFI_FW_AP_STATE))
+#endif //CONFIG_CONCURRENT_MODE
+			{
+				StopTxBeacon(Adapter);
+			}
+
+			rtw_write8(Adapter,REG_BCN_CTRL, 0x19);//disable atim wnd
+			//rtw_write8(Adapter,REG_BCN_CTRL, 0x18);
+		}
+		else if((mode == _HW_STATE_ADHOC_) /*|| (mode == _HW_STATE_AP_)*/)
+		{
+			ResumeTxBeacon(Adapter);
+			rtw_write8(Adapter,REG_BCN_CTRL, 0x1a);
+		}
+		else if(mode == _HW_STATE_AP_)
+		{
+			ResumeTxBeacon(Adapter);
+
+			rtw_write8(Adapter, REG_BCN_CTRL, 0x12);
+
+			//Set RCR
+			//write32(padapter, REG_RCR, 0x70002a8e);//CBSSID_DATA must set to 0
+			rtw_write32(Adapter, REG_RCR, 0x7000228e);//CBSSID_DATA must set to 0
+			//enable to rx data frame
+			rtw_write16(Adapter, REG_RXFLTMAP2, 0xFFFF);
+			//enable to rx ps-poll
+			rtw_write16(Adapter, REG_RXFLTMAP1, 0x0400);
+
+			//Beacon Control related register for first time
+
+			rtw_write8(Adapter, REG_BCNDMATIM, 0x02); // 2ms
+			rtw_write8(Adapter, REG_DRVERLYINT, 0x05);// 5ms
+
+			//write8(Adapter, REG_BCN_MAX_ERR, 0xFF);
+			rtw_write8(Adapter, REG_ATIMWND, 0x0a); // 10ms for port0
+			rtw_write16(Adapter, REG_BCNTCFG, 0x00);
+			rtw_write16(Adapter, REG_TBTT_PROHIBIT, 0xff04);
+			rtw_write16(Adapter, REG_TSFTR_SYN_OFFSET, 0x7fff);// +32767 (~32ms)
+
+		        //enable BCN0 Function for if1
+			//don't enable update TSF0 for if1 (due to TSF update when beacon/probe rsp are received)
+			rtw_write8(Adapter, REG_BCN_CTRL, (DIS_TSF_UDT0_NORMAL_CHIP|EN_BCN_FUNCTION | EN_TXBCN_RPT|BIT(1)));
+
+#ifdef CONFIG_CONCURRENT_MODE
+			if(check_buddy_fwstate(Adapter, WIFI_FW_NULL_STATE))
+				rtw_write8(Adapter, REG_BCN_CTRL_1,
+					rtw_read8(Adapter, REG_BCN_CTRL_1) & ~EN_BCN_FUNCTION);
+#endif
+			//BCN1 TSF will sync to BCN0 TSF with offset(0x518) if if1_sta linked
+			//only interface 2 as AP MODE need to sync
+			//rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)|BIT(5));
+
+
+			//dis BCN1 ATIM  WND if if2 is station
+			rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)|BIT(0));
+#ifdef CONFIG_TSF_RESET_OFFLOAD
+			// Reset TSF for STA+AP concurrent mode
+			if ( check_buddy_fwstate(Adapter, (WIFI_STATION_STATE|WIFI_ASOC_STATE)) ) {
+				if (reset_tsf(Adapter, IFACE_PORT0) == _FALSE)
+					DBG_871X("ERROR! %s()-%d: Reset port0 TSF fail\n",
+						__FUNCTION__, __LINE__);
+			}
+#endif	// CONFIG_TSF_RESET_OFFLOAD
+
+		}
+
+
+	}
+
+}
+
+static void hw_var_set_macaddr(PADAPTER Adapter, u8 variable, u8* val)
+{
+	u8 idx = 0;
+	u32 reg_macid;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(Adapter->iface_type == IFACE_PORT1)
+	{
+		reg_macid = REG_MACID1;
+	}
+	else
+#endif
+	{
+		reg_macid = REG_MACID;
+	}
+
+	for(idx = 0 ; idx < 6; idx++)
+	{
+		rtw_write8(Adapter, (reg_macid+idx), val[idx]);
+	}
+
+}
+
+static void hw_var_set_bssid(PADAPTER Adapter, u8 variable, u8* val)
+{
+	u8	idx = 0;
+	u32 reg_bssid;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(Adapter->iface_type == IFACE_PORT1)
+	{
+		reg_bssid = REG_BSSID1;
+	}
+	else
+#endif
+	{
+		reg_bssid = REG_BSSID;
+	}
+
+	for(idx = 0 ; idx < 6; idx++)
+	{
+		rtw_write8(Adapter, (reg_bssid+idx), val[idx]);
+	}
+
+}
+
+static void hw_var_set_bcn_func(PADAPTER Adapter, u8 variable, u8* val)
+{
+	u32 bcn_ctrl_reg;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(Adapter->iface_type == IFACE_PORT1)
+	{
+		bcn_ctrl_reg = REG_BCN_CTRL_1;
+
+		if(*((u8 *)val))
+		{
+			rtw_write8(Adapter, bcn_ctrl_reg, (EN_BCN_FUNCTION | EN_TXBCN_RPT));
+		}
+		else
+		{
+			rtw_write8(Adapter, bcn_ctrl_reg, rtw_read8(Adapter, bcn_ctrl_reg)&(~(EN_BCN_FUNCTION | EN_TXBCN_RPT)));
+		}
+	}
+	else
+#endif
+	{
+		bcn_ctrl_reg = REG_BCN_CTRL;
+		if(*((u8 *)val))
+		{
+			rtw_write8(Adapter, bcn_ctrl_reg, (EN_BCN_FUNCTION | EN_TXBCN_RPT));
+		}
+		else
+		{
+			//rtw_write8(Adapter, bcn_ctrl_reg, rtw_read8(Adapter, bcn_ctrl_reg)&(~(EN_BCN_FUNCTION | EN_TXBCN_RPT)));
+			rtw_write8(Adapter, bcn_ctrl_reg, (rtw_read8(Adapter, bcn_ctrl_reg)&(~(EN_TXBCN_RPT))) | DIS_TSF_UDT0_NORMAL_CHIP);
+		}
+	}
+
+
+}
+
+#ifdef CONFIG_WOWLAN
+static int rtw_wowlan_set_pattern(_adapter *padapter ,u8* pbuf){
+	struct pwrctrl_priv *pwrpriv=&padapter->pwrctrlpriv;
+	int res=0,crc_idx;
+	u32 content=0,cmd=0;
+	u32 *pdata;
+	u8 config,crc,mc,bc,uc,idx,pattern_len,packet[200],packet_len,valid;
+	u16 crc_val=0,i;
+
+	config=pbuf[0];
+	bc=config & BIT(3)?1:0;
+	mc=config & BIT(4)?1:0;
+	uc=config & BIT(5)?1:0;
+	idx=config & 0x7;
+	crc=config & BIT(6)?1:0;
+	valid=config & BIT(7)?1:0;
+	pattern_len=pbuf[1];
+	packet_len=pattern_len*8;
+	pdata=(u32 *)pbuf;
+
+	// Write to the Wakeup CAM
+	//offset 0
+	if(pattern_len>=4){
+		content=pdata[1];
+	}
+	else{
+		content=0;
+	}
+	DBG_8192C("\nrtw_wowlan_set_pattern offset[0]  content  0x%x  [cpu_to_le32  0x%x]\n", content,__cpu_to_le32(content));
+	//rtw_write32(padapter, REG_WKFMCAM_RWD, __cpu_to_le32(content));
+	pwrpriv->wowlan_pattern_context[idx][0]= __cpu_to_le32(content);
+	//cmd=BIT(31)|BIT(16)|(idx+0);
+	//rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+	//offset 4
+	if(pattern_len>=8){
+		content=pdata[2];
+	}
+	else{
+		content=0;
+	}
+	DBG_8192C("rtw_wowlan_set_pattern offset[4]  content  0x%x  [cpu_to_le32  0x%x]\n", content,__cpu_to_le32(content));
+	//rtw_write32(padapter, REG_WKFMCAM_RWD, __cpu_to_le32(content));
+	pwrpriv->wowlan_pattern_context[idx][1]= __cpu_to_le32(content);
+
+	//cmd=BIT(31)|BIT(16)|(idx+1);
+	//rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+	//offset 8
+	if(pattern_len>=12){
+		content=pdata[3];
+	}
+	else{
+		content=0;
+	}
+	DBG_8192C("rtw_wowlan_set_pattern offset[8]  content  0x%x  [cpu_to_le32  0x%x]\n", content,__cpu_to_le32(content));
+	//rtw_write32(padapter, REG_WKFMCAM_RWD, __cpu_to_le32(content));
+	pwrpriv->wowlan_pattern_context[idx][2]= __cpu_to_le32(content);
+	//cmd=BIT(31)|BIT(16)|(idx+2);
+	//rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+	//offset 12
+	if(pattern_len>=16){
+		content=pdata[4];
+	}
+	else{
+		content=0;
+	}
+	DBG_8192C("rtw_wowlan_set_pattern offset[12]  content  0x%x  [cpu_to_le32  0x%x]\n", content,__cpu_to_le32(content));
+	//rtw_write32(padapter, REG_WKFMCAM_RWD, __cpu_to_le32(content));
+	pwrpriv->wowlan_pattern_context[idx][3]= __cpu_to_le32(content);
+	//cmd=BIT(31)|BIT(16)|(idx+3);
+	//rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+
+	if(crc){
+		// Have the CRC value
+		crc_val=*(u16 *)(&pbuf[2]);
+		DBG_8192C("rtw_wowlan_set_pattern crc_val  0x%x  \n", crc_val);
+		crc_val=__cpu_to_le16(crc_val);
+		DBG_8192C("rtw_wowlan_set_pattern crc_val  after 0x%x  \n", crc_val);
+	}
+	else{
+		DBG_8192C("+rtw_wowlan_set_pattern   crc=0[%x]  Should calculate the CRC\n", crc);
+		// calculate the CRC the write to the Wakeup CAM
+		crc_idx=0;
+		for(i=0;i<packet_len;i++){
+			if(pbuf[4+(i/8)]&(0x01<<(i%8)))
+			{
+				packet[crc_idx++]=pbuf[20+i];
+		//		printk("\n i=%d packet[i]=%x pbuf[20+i(%d)]=%x \n",i,packet[i],20+i,pbuf[20+i]);
+			}
+		}
+		crc_val=calc_crc(packet, crc_idx);
+		printk("+rtw_wowlan_set_pattern   crc_val=0x%.8x \n", crc_val);
+
+	}
+
+	//offset 16
+	content=(valid<<31)| (bc<<26)|(mc<<25)|(uc<<24) |crc_val;
+	printk("rtw_wowlan_set_pattern offset[16]  content  0x%x \n", content);
+	rtw_write32(padapter, REG_WKFMCAM_RWD,content);
+	pwrpriv->wowlan_pattern_context[idx][4]= content;
+	//cmd=BIT(31)|BIT(16)|(idx+4);
+	//rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+	pwrpriv->wowlan_pattern_idx|=BIT(idx);
+
+_rtw_wowlan_set_pattern_exit:
+	return res;
+}
+
+
+
+void rtw_wowlan_reload_pattern(_adapter *padapter){
+	struct pwrctrl_priv *pwrpriv=&padapter->pwrctrlpriv;
+	u32 content=0,cmd=0;
+	u8 idx;
+
+	for (idx=0;idx<8;idx ++){
+		if(pwrpriv->wowlan_pattern_idx & BIT(idx)){
+			//offset 0
+			rtw_write32(padapter, REG_WKFMCAM_RWD, pwrpriv->wowlan_pattern_context[idx][0]);
+			cmd=BIT(31)|BIT(16)|(idx+0);
+			rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+
+			//offset 4
+			rtw_write32(padapter, REG_WKFMCAM_RWD, pwrpriv->wowlan_pattern_context[idx][1]);
+			cmd=BIT(31)|BIT(16)|(idx+1);
+			rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+
+			//offset 8
+			rtw_write32(padapter, REG_WKFMCAM_RWD, pwrpriv->wowlan_pattern_context[idx][2]);
+			cmd=BIT(31)|BIT(16)|(idx+2);
+			rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+
+			//offset 12
+			rtw_write32(padapter, REG_WKFMCAM_RWD, pwrpriv->wowlan_pattern_context[idx][3]);
+			cmd=BIT(31)|BIT(16)|(idx+3);
+			rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+
+			//offset 16
+			rtw_write32(padapter, REG_WKFMCAM_RWD, pwrpriv->wowlan_pattern_context[idx][4]);
+			cmd=BIT(31)|BIT(16)|(idx+4);
+			rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+
+		}
+		printk("print WOWCAM  idx =%d\n",idx);
+		cmd=BIT(31)|(idx+0);
+		rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+		printk("print WOWCAM  offset[0]  =%x\n",rtw_read32(padapter, REG_WKFMCAM_RWD));
+		cmd=BIT(31)|(idx+1);
+		rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+		printk("print WOWCAM  offset[1]  =%x\n",rtw_read32(padapter, REG_WKFMCAM_RWD));
+		cmd=BIT(31)|(idx+2);
+		rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+		printk("print WOWCAM  offset[2]  =%x\n",rtw_read32(padapter, REG_WKFMCAM_RWD));
+		cmd=BIT(31)|(idx+3);
+		rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+		printk("print WOWCAM  offset[3]  =%x\n",rtw_read32(padapter, REG_WKFMCAM_RWD));
+		cmd=BIT(31)|(idx+4);
+		rtw_write32(padapter, REG_WKFMCAM_CMD, cmd);
+		printk("print WOWCAM  offset[4]  =%x\n",rtw_read32(padapter, REG_WKFMCAM_RWD));
+
+
+	}
+}
+#endif //CONFIG_WOWLAN
+
+static void hw_var_set_correct_tsf(PADAPTER Adapter, u8 variable, u8* val)
+{
+#ifdef CONFIG_CONCURRENT_MODE
+	u64	tsf;
+	struct mlme_ext_priv	*pmlmeext = &Adapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	//tsf = pmlmeext->TSFValue - ((u32)pmlmeext->TSFValue % (pmlmeinfo->bcn_interval*1024)) -1024; //us
+	tsf = pmlmeext->TSFValue - rtw_modular64(pmlmeext->TSFValue, (pmlmeinfo->bcn_interval*1024)) -1024; //us
+
+	if(((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE))
+	{
+		//pHalData->RegTxPause |= STOP_BCNQ;BIT(6)
+		//rtw_write8(Adapter, REG_TXPAUSE, (rtw_read8(Adapter, REG_TXPAUSE)|BIT(6)));
+		StopTxBeacon(Adapter);
+	}
+
+	if(Adapter->iface_type == IFACE_PORT1)
+	{
+		//disable related TSF function
+		rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)&(~BIT(3)));
+
+		rtw_write32(Adapter, REG_TSFTR1, tsf);
+		rtw_write32(Adapter, REG_TSFTR1+4, tsf>>32);
+
+		//enable related TSF function
+		rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)|BIT(3));
+
+
+#ifdef CONFIG_TSF_RESET_OFFLOAD
+		// Update buddy port's TSF(TBTT) if it is SoftAP for beacon TX issue!
+		if ( (pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE
+			&& check_buddy_fwstate(Adapter, WIFI_AP_STATE) ) {
+			if (reset_tsf(Adapter, IFACE_PORT0) == _FALSE)
+				DBG_871X("ERROR! %s()-%d: Reset port0 TSF fail\n",
+					__FUNCTION__, __LINE__);
+		}
+#endif	// CONFIG_TSF_RESET_OFFLOAD
+
+	}
+	else	// Adapter->iface_type == IFACE_PORT1
+	{
+		//disable related TSF function
+		rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)&(~BIT(3)));
+		// disable TSF update instead! May induce burst beacon TX
+		//rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)|BIT(4));
+
+		rtw_write32(Adapter, REG_TSFTR, tsf);
+		rtw_write32(Adapter, REG_TSFTR+4, tsf>>32);
+
+		//enable related TSF function
+		rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)|BIT(3));
+		//rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)&(~BIT(4)));
+
+		// Update buddy port's TSF if it is SoftAP for beacon TX issue!
+		if ( (pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE
+			&& check_buddy_fwstate(Adapter, WIFI_AP_STATE)
+		) {
+			//disable related TSF function
+			rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)&(~BIT(3)));
+			// disable TSF update instead!
+			//rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL_1)|BIT(4));
+
+			rtw_write32(Adapter, REG_TSFTR1, tsf);
+			rtw_write32(Adapter, REG_TSFTR1+4, tsf>>32);
+
+			//enable related TSF function
+			rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)|BIT(3));
+			//rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL_1)&(~BIT(4)));
+		}
+#ifdef CONFIG_TSF_RESET_OFFLOAD
+		// Update buddy port's TSF if it is SoftAP for beacon TX issue!
+		if ( (pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE
+			&& check_buddy_fwstate(Adapter, WIFI_AP_STATE) ) {
+			if (reset_tsf(Adapter, IFACE_PORT1) == _FALSE)
+				DBG_871X("ERROR! %s()-%d: Reset port1 TSF fail\n",
+					__FUNCTION__, __LINE__);
+		}
+#endif	// CONFIG_TSF_RESET_OFFLOAD
+	}
+
+	if(((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE))
+	{
+		//pHalData->RegTxPause  &= (~STOP_BCNQ);
+		//rtw_write8(Adapter, REG_TXPAUSE, (rtw_read8(Adapter, REG_TXPAUSE)&(~BIT(6))));
+		ResumeTxBeacon(Adapter);
+	}
+#endif	// CONFIG_CONCURRENT_MODE
+}
+
+static void hw_var_set_mlme_disconnect(PADAPTER Adapter, u8 variable, u8* val)
+{
+#ifdef CONFIG_CONCURRENT_MODE
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	PADAPTER pbuddy_adapter = Adapter->pbuddy_adapter;
+
+
+	if(check_buddy_mlmeinfo_state(Adapter, _HW_STATE_NOLINK_))
+		rtw_write16(Adapter, REG_RXFLTMAP2, 0x00);
+
+
+	if(Adapter->iface_type == IFACE_PORT1)
+	{
+		int i;
+		u8 reg_bcn_ctrl_1;
+
+		// a.Driver set 0x422 bit 6 =0
+		rtw_write8(Adapter, REG_FWHW_TXQ_CTRL+2, (pHalData->RegFwHwTxQCtrl) & (~BIT6));
+		pHalData->RegFwHwTxQCtrl &= (~BIT6);
+
+
+#ifdef CONFIG_BEACON_DISABLE_OFFLOAD
+		u8 reg_bcn_disable_cnt = rtw_read8(Adapter, REG_FW_BCN_DIS_CNT);
+		DBG_871X("%s()-%d: reg_bcn_disable_cnt=%02x\n", __FUNCTION__, __LINE__, reg_bcn_disable_cnt);
+
+		reg_bcn_ctrl_1 = rtw_read8(Adapter, REG_BCN_CTRL_1);
+		DBG_871X("%s()-%d: reg_bcn_ctrl_1=%02x\n", __FUNCTION__, __LINE__, reg_bcn_ctrl_1);
+
+		// b. driver set h2c cmd
+		rtl8192c_dis_beacon_fun_cmd(Adapter);
+
+		/*
+			// FW Job for port 0
+
+		   c. 8051 set nettype to ap
+		   d. 8051 check dma_int
+		   e. 8051 set nettype to no_link
+		   f.8051 dis_tsf_update   0x550 bit 4
+		   g.8051 reset  beacon function test count   0x553 bit0.
+		   h.8051 disable beacon function   0x550  bit3
+		   i. 8051 sent ready to driver
+
+		*/
+
+		// The worst case is 100 + 15 ms
+		rtw_msleep_os(120);
+
+		for (i=0; i< 10; i++) {
+			reg_bcn_ctrl_1 = rtw_read8(Adapter, REG_BCN_CTRL_1);
+			if ( (reg_bcn_ctrl_1 & BIT(3)) == 0 ) {
+				//DBG_871X("%s()-%d: BEACON_DISABLE_OFFLOAD finished! reg=%02x\n", __FUNCTION__, __LINE__, reg);
+				break;
+			}
+			DBG_871X("%s()-%d: BEACON_DISABLE_OFFLOAD not finished! REG_BCN_CTRL_1=%02x\n", __FUNCTION__, __LINE__, reg_bcn_ctrl_1);
+			DBG_871X("%s()-%d: reg_bcn_disable_cnt=%02x\n", __FUNCTION__, __LINE__, rtw_read8(Adapter, REG_FW_BCN_DIS_CNT));
+			DBG_871X("%s()-%d: REG_BCN_CTRL=%02x\n", __FUNCTION__, __LINE__, rtw_read8(Adapter, REG_BCN_CTRL));
+			DBG_871X("%s()-%d: FWISR=%08x\n", __FUNCTION__, __LINE__, rtw_read32(Adapter, REG_FWISR));
+			rtw_msleep_os(100);
+		}
+		DBG_871X("%s()-%d: reg_bcn_disable_cnt=%02x\n", __FUNCTION__, __LINE__, rtw_read8(Adapter, REG_FW_BCN_DIS_CNT));
+		DBG_871X("%s()-%d: reg_bcn_ctrl_1=%02x\n", __FUNCTION__, __LINE__, reg_bcn_ctrl_1);
+
+#else   // CONFIG_BEACON_DISABLE_OFFLOAD
+
+		//disable update TSF1
+		rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)|BIT(4));
+
+		//reset TSF1
+		rtw_write8(Adapter, REG_DUAL_TSF_RST, BIT(1));
+
+		// disable Port1's beacon function
+		rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)&(~BIT(3)));
+
+#endif  // CONFIG_BEACON_DISABLE_OFFLOAD
+
+		// j, Driver set 0x422 bit 6 =1
+		rtw_write8(Adapter, REG_FWHW_TXQ_CTRL+2, (pHalData->RegFwHwTxQCtrl) | BIT6);
+		pHalData->RegFwHwTxQCtrl |= BIT6;
+
+		// k. re_download beacon pkt
+		if(check_buddy_mlmeinfo_state(Adapter, WIFI_FW_AP_STATE))
+			set_tx_beacon_cmd(pbuddy_adapter);
+
+
+	}
+	else	// (Adapter->iface_type == IFACE_PORT1)
+	{
+		//disable update TSF
+		rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)|BIT(4));
+
+		//reset TSF
+		rtw_write8(Adapter, REG_DUAL_TSF_RST, BIT(0));
+
+		// Can't disable Port0's beacon function due to it is used by RA
+	}
+#endif
+}
+
+static void hw_var_set_mlme_sitesurvey(PADAPTER Adapter, u8 variable, u8* val)
+{
+	u32	value_rcr, rcr_clear_bit, reg_bcn_ctl;
+	u16	value_rxfltmap2;
+	struct mlme_priv *pmlmepriv=&(Adapter->mlmepriv);
+
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(Adapter->iface_type == IFACE_PORT1)
+		reg_bcn_ctl = REG_BCN_CTRL_1;
+	else
+#endif
+		reg_bcn_ctl = REG_BCN_CTRL;
+
+#ifdef CONFIG_FIND_BEST_CHANNEL
+
+	if( (check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+#ifdef CONFIG_CONCURRENT_MODE
+		|| (check_buddy_fwstate(Adapter, WIFI_AP_STATE) == _TRUE)
+#endif
+#ifdef CONFIG_TDLS
+		// TDLS will clear RCR_CBSSID_DATA bit for connection.
+		|| ( Adapter->tdlsinfo.setup_state & TDLS_LINKED_STATE )
+#endif // CONFIG_TDLS
+		)
+	{
+		rcr_clear_bit = RCR_CBSSID_BCN;
+	}
+	else
+	{
+		rcr_clear_bit = (RCR_CBSSID_BCN | RCR_CBSSID_DATA);
+	}
+
+	// Recieve all data frames
+	value_rxfltmap2 = 0xFFFF;
+
+#else /* CONFIG_FIND_BEST_CHANNEL */
+
+	rcr_clear_bit = RCR_CBSSID_BCN;
+
+	//config RCR to receive different BSSID & not to receive data frame
+	value_rxfltmap2 = 0;
+
+#endif /* CONFIG_FIND_BEST_CHANNEL */
+
+	value_rcr = rtw_read32(Adapter, REG_RCR);
+
+	if(*((u8 *)val))//under sitesurvey
+	{
+		value_rcr &= ~(rcr_clear_bit);
+		rtw_write32(Adapter, REG_RCR, value_rcr);
+
+		rtw_write16(Adapter, REG_RXFLTMAP2, value_rxfltmap2);
+
+		if (check_fwstate(pmlmepriv, WIFI_STATION_STATE | WIFI_ADHOC_STATE |WIFI_ADHOC_MASTER_STATE)) {
+			//disable update TSF
+			rtw_write8(Adapter, reg_bcn_ctl, rtw_read8(Adapter, reg_bcn_ctl)|BIT(4));
+		}
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if(check_buddy_mlmeinfo_state(Adapter, WIFI_FW_AP_STATE) &&
+			check_buddy_fwstate(Adapter, _FW_LINKED))
+		{
+			StopTxBeacon(Adapter);
+		}
+#endif
+	}
+	else//sitesurvey done
+	{
+		if(check_fwstate(pmlmepriv, _FW_LINKED) || check_fwstate(pmlmepriv, WIFI_AP_STATE)
+#ifdef CONFIG_CONCURRENT_MODE
+			|| check_buddy_fwstate(Adapter, _FW_LINKED) || check_buddy_fwstate(Adapter, WIFI_AP_STATE)
+#endif
+			)
+		{
+			//enable to rx data frame
+			rtw_write16(Adapter, REG_RXFLTMAP2,0xFFFF);
+		}
+
+		if (check_fwstate(pmlmepriv, WIFI_STATION_STATE | WIFI_ADHOC_STATE |WIFI_ADHOC_MASTER_STATE)) {
+			//enable update TSF
+			rtw_write8(Adapter, reg_bcn_ctl, rtw_read8(Adapter, reg_bcn_ctl)&(~BIT(4)));
+		}
+
+		value_rcr |= rcr_clear_bit;
+		rtw_write32(Adapter, REG_RCR, value_rcr);
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if(check_buddy_mlmeinfo_state(Adapter, WIFI_FW_AP_STATE) &&
+			check_buddy_fwstate(Adapter, _FW_LINKED))
+		{
+			ResumeTxBeacon(Adapter);
+		}
+#endif
+	}
+}
+
+static void hw_var_set_mlme_join(PADAPTER Adapter, u8 variable, u8* val)
+{
+#ifdef CONFIG_CONCURRENT_MODE
+	u8	RetryLimit = 0x30;
+	u8	type = *((u8 *)val);
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter);
+	struct mlme_priv	*pmlmepriv = &Adapter->mlmepriv;
+
+	if(type == 0) // prepare to join
+	{
+		if(check_buddy_mlmeinfo_state(Adapter, WIFI_FW_AP_STATE) &&
+			check_buddy_fwstate(Adapter, _FW_LINKED))
+		{
+			StopTxBeacon(Adapter);
+		}
+
+		//enable to rx data frame.Accept all data frame
+		//rtw_write32(padapter, REG_RCR, rtw_read32(padapter, REG_RCR)|RCR_ADF);
+		rtw_write16(Adapter, REG_RXFLTMAP2,0xFFFF);
+
+		if(check_buddy_mlmeinfo_state(Adapter, WIFI_FW_AP_STATE))
+			rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)|RCR_CBSSID_BCN);
+		else
+			rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)|RCR_CBSSID_DATA|RCR_CBSSID_BCN);
+
+		if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE)
+		{
+			RetryLimit = (pHalData->CustomerID == RT_CID_CCX) ? 7 : 48;
+		}
+		else // Ad-hoc Mode
+		{
+			RetryLimit = 0x7;
+		}
+	}
+	else if(type == 1) //joinbss_event call back when join res < 0
+	{
+		if(check_buddy_mlmeinfo_state(Adapter, _HW_STATE_NOLINK_))
+			rtw_write16(Adapter, REG_RXFLTMAP2,0x00);
+
+		if(check_buddy_mlmeinfo_state(Adapter, WIFI_FW_AP_STATE) &&
+			check_buddy_fwstate(Adapter, _FW_LINKED))
+		{
+			ResumeTxBeacon(Adapter);
+
+			//reset TSF 1/2 after ResumeTxBeacon
+			//rtw_write8(Adapter, REG_DUAL_TSF_RST, BIT(1)|BIT(0));
+
+		}
+	}
+	else if(type == 2) //sta add event call back
+	{
+
+		//enable update TSF
+		if(Adapter->iface_type == IFACE_PORT1)
+			rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1)&(~BIT(4)));
+		else
+			rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)&(~BIT(4)));
+
+
+		if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE))
+		{
+			//fixed beacon issue for 8191su...........
+			rtw_write8(Adapter,0x542 ,0x02);
+			RetryLimit = 0x7;
+		}
+
+
+		if(check_buddy_mlmeinfo_state(Adapter, WIFI_FW_AP_STATE) &&
+			check_buddy_fwstate(Adapter, _FW_LINKED))
+		{
+			ResumeTxBeacon(Adapter);
+
+			//reset TSF 1/2 after ResumeTxBeacon
+			//rtw_write8(Adapter, REG_DUAL_TSF_RST, BIT(1)|BIT(0));
+		}
+
+	}
+
+	rtw_write16(Adapter, REG_RL, RetryLimit << RETRY_LIMIT_SHORT_SHIFT | RetryLimit << RETRY_LIMIT_LONG_SHIFT);
+
+#endif
+}
+
+void SetHwReg8192CU(PADAPTER Adapter, u8 variable, u8* val)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+_func_enter_;
+
+	switch(variable)
+	{
+		case HW_VAR_MEDIA_STATUS:
+			{
+				u8 val8;
+
+				val8 = rtw_read8(Adapter, MSR)&0x0c;
+				val8 |= *((u8 *)val);
+				rtw_write8(Adapter, MSR, val8);
+			}
+			break;
+		case HW_VAR_MEDIA_STATUS1:
+			{
+				u8 val8;
+
+				val8 = rtw_read8(Adapter, MSR)&0x03;
+				val8 |= *((u8 *)val) <<2;
+				rtw_write8(Adapter, MSR, val8);
+			}
+			break;
+		case HW_VAR_SET_OPMODE:
+			hw_var_set_opmode(Adapter, variable, val);
+			break;
+		case HW_VAR_MAC_ADDR:
+			hw_var_set_macaddr(Adapter, variable, val);
+			break;
+		case HW_VAR_BSSID:
+			hw_var_set_bssid(Adapter, variable, val);
+			break;
+		case HW_VAR_BASIC_RATE:
+			{
+				u16			BrateCfg = 0;
+				u8			RateIndex = 0;
+
+				// 2007.01.16, by Emily
+				// Select RRSR (in Legacy-OFDM and CCK)
+				// For 8190, we select only 24M, 12M, 6M, 11M, 5.5M, 2M, and 1M from the Basic rate.
+				// We do not use other rates.
+				HalSetBrateCfg( Adapter, val, &BrateCfg );
+
+				//2011.03.30 add by Luke Lee
+				//CCK 2M ACK should be disabled for some BCM and Atheros AP IOT
+				//because CCK 2M has poor TXEVM
+				//CCK 5.5M & 11M ACK should be enabled for better performance
+
+				pHalData->BasicRateSet = BrateCfg = (BrateCfg |0xd) & 0x15d;
+
+				BrateCfg |= 0x01; // default enable 1M ACK rate
+
+				DBG_8192C("HW_VAR_BASIC_RATE: BrateCfg(%#x)\n", BrateCfg);
+
+				// Set RRSR rate table.
+				rtw_write8(Adapter, REG_RRSR, BrateCfg&0xff);
+				rtw_write8(Adapter, REG_RRSR+1, (BrateCfg>>8)&0xff);
+				rtw_write8(Adapter, REG_RRSR+2, rtw_read8(Adapter, REG_RRSR+2)&0xf0);
+
+				// Set RTS initial rate
+				while(BrateCfg > 0x1)
+				{
+					BrateCfg = (BrateCfg>> 1);
+					RateIndex++;
+				}
+				// Ziv - Check
+				rtw_write8(Adapter, REG_INIRTS_RATE_SEL, RateIndex);
+			}
+			break;
+		case HW_VAR_TXPAUSE:
+			rtw_write8(Adapter, REG_TXPAUSE, *((u8 *)val));
+			break;
+		case HW_VAR_BCN_FUNC:
+			hw_var_set_bcn_func(Adapter, variable, val);
+			break;
+		case HW_VAR_CORRECT_TSF:
+#ifdef CONFIG_CONCURRENT_MODE
+			hw_var_set_correct_tsf(Adapter, variable, val);
+#else
+			{
+				u64	tsf;
+				struct mlme_ext_priv	*pmlmeext = &Adapter->mlmeextpriv;
+				struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+				//tsf = pmlmeext->TSFValue - ((u32)pmlmeext->TSFValue % (pmlmeinfo->bcn_interval*1024)) -1024; //us
+				tsf = pmlmeext->TSFValue - rtw_modular64(pmlmeext->TSFValue, (pmlmeinfo->bcn_interval*1024)) -1024; //us
+
+				if(((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE))
+				{
+					//pHalData->RegTxPause |= STOP_BCNQ;BIT(6)
+					//rtw_write8(Adapter, REG_TXPAUSE, (rtw_read8(Adapter, REG_TXPAUSE)|BIT(6)));
+					StopTxBeacon(Adapter);
+				}
+
+				//disable related TSF function
+				rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)&(~BIT(3)));
+
+				rtw_write32(Adapter, REG_TSFTR, tsf);
+				rtw_write32(Adapter, REG_TSFTR+4, tsf>>32);
+
+				//enable related TSF function
+				rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)|BIT(3));
+
+
+				if(((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE))
+				{
+					//pHalData->RegTxPause  &= (~STOP_BCNQ);
+					//rtw_write8(Adapter, REG_TXPAUSE, (rtw_read8(Adapter, REG_TXPAUSE)&(~BIT(6))));
+					ResumeTxBeacon(Adapter);
+				}
+			}
+#endif
+			break;
+		case HW_VAR_CHECK_BSSID:
+			if(*((u8 *)val))
+			{
+				rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)|RCR_CBSSID_DATA|RCR_CBSSID_BCN);
+			}
+			else
+			{
+				u32	val32;
+
+				val32 = rtw_read32(Adapter, REG_RCR);
+				val32 &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN);
+				rtw_write32(Adapter, REG_RCR, val32);
+			}
+			break;
+		case HW_VAR_MLME_DISCONNECT:
+#ifdef CONFIG_CONCURRENT_MODE
+			hw_var_set_mlme_disconnect(Adapter, variable, val);
+#else
+			{
+				//Set RCR to not to receive data frame when NO LINK state
+				//rtw_write32(Adapter, REG_RCR, rtw_read32(padapter, REG_RCR) & ~RCR_ADF);
+				//reject all data frames
+				rtw_write16(Adapter, REG_RXFLTMAP2,0x00);
+
+				//reset TSF
+				rtw_write8(Adapter, REG_DUAL_TSF_RST, (BIT(0)|BIT(1)));
+
+				//disable update TSF
+				rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)|BIT(4));
+			}
+#endif
+			break;
+		case HW_VAR_MLME_SITESURVEY:
+			hw_var_set_mlme_sitesurvey(Adapter, variable,  val);
+			break;
+		case HW_VAR_MLME_JOIN:
+#ifdef CONFIG_CONCURRENT_MODE
+			hw_var_set_mlme_join(Adapter, variable,  val);
+#else
+			{
+				u8	RetryLimit = 0x30;
+				u8	type = *((u8 *)val);
+				struct mlme_priv	*pmlmepriv = &Adapter->mlmepriv;
+
+				if(type == 0) // prepare to join
+				{
+					//enable to rx data frame.Accept all data frame
+					//rtw_write32(padapter, REG_RCR, rtw_read32(padapter, REG_RCR)|RCR_ADF);
+					rtw_write16(Adapter, REG_RXFLTMAP2,0xFFFF);
+
+					rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)|RCR_CBSSID_DATA|RCR_CBSSID_BCN);
+
+					if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE)
+					{
+						RetryLimit = (pHalData->CustomerID == RT_CID_CCX) ? 7 : 48;
+					}
+					else // Ad-hoc Mode
+					{
+						RetryLimit = 0x7;
+					}
+				}
+				else if(type == 1) //joinbss_event call back when join res < 0
+				{
+					rtw_write16(Adapter, REG_RXFLTMAP2,0x00);
+				}
+				else if(type == 2) //sta add event call back
+				{
+					//enable update TSF
+					rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)&(~BIT(4)));
+
+					if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE))
+					{
+						//fixed beacon issue for 8191su...........
+						rtw_write8(Adapter,0x542 ,0x02);
+						RetryLimit = 0x7;
+					}
+				}
+
+				rtw_write16(Adapter, REG_RL, RetryLimit << RETRY_LIMIT_SHORT_SHIFT | RetryLimit << RETRY_LIMIT_LONG_SHIFT);
+			}
+#endif
+			break;
+
+		case HW_VAR_ON_RCR_AM:
+			rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)|RCR_AM);
+			DBG_871X("%s, %d, RCR= %x \n", __FUNCTION__,__LINE__, rtw_read32(Adapter, REG_RCR));
+			break;
+		case HW_VAR_OFF_RCR_AM:
+			rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)& (~RCR_AM));
+			DBG_871X("%s, %d, RCR= %x \n", __FUNCTION__,__LINE__, rtw_read32(Adapter, REG_RCR));
+			break;
+
+		case HW_VAR_BEACON_INTERVAL:
+			rtw_write16(Adapter, REG_BCN_INTERVAL, *((u16 *)val));
+			break;
+		case HW_VAR_SLOT_TIME:
+			{
+				u8	u1bAIFS, aSifsTime;
+				struct mlme_ext_priv	*pmlmeext = &Adapter->mlmeextpriv;
+				struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+				rtw_write8(Adapter, REG_SLOT, val[0]);
+
+				if(pmlmeinfo->WMM_enable == 0)
+				{
+					if( pmlmeext->cur_wireless_mode == WIRELESS_11B)
+						aSifsTime = 10;
+					else
+						aSifsTime = 16;
+
+					u1bAIFS = aSifsTime + (2 * pmlmeinfo->slotTime);
+
+					// <Roger_EXP> Temporary removed, 2008.06.20.
+					rtw_write8(Adapter, REG_EDCA_VO_PARAM, u1bAIFS);
+					rtw_write8(Adapter, REG_EDCA_VI_PARAM, u1bAIFS);
+					rtw_write8(Adapter, REG_EDCA_BE_PARAM, u1bAIFS);
+					rtw_write8(Adapter, REG_EDCA_BK_PARAM, u1bAIFS);
+				}
+			}
+			break;
+		case HW_VAR_RESP_SIFS:
+			{
+#if 0
+				// SIFS for OFDM Data ACK
+				rtw_write8(Adapter, REG_SIFS_CTX+1, val[0]);
+				// SIFS for OFDM consecutive tx like CTS data!
+				rtw_write8(Adapter, REG_SIFS_TRX+1, val[1]);
+
+				rtw_write8(Adapter,REG_SPEC_SIFS+1, val[0]);
+				rtw_write8(Adapter,REG_MAC_SPEC_SIFS+1, val[0]);
+
+				// 20100719 Joseph: Revise SIFS setting due to Hardware register definition change.
+				rtw_write8(Adapter, REG_R2T_SIFS+1, val[0]); //0x08 - CCK
+				rtw_write8(Adapter, REG_T2T_SIFS+1, val[0]); //0x0e - OFDM
+#else
+				//SIFS_Timer = 0x0a0a0808;
+				//RESP_SIFS for CCK
+				rtw_write8(Adapter, REG_R2T_SIFS, val[0]); // SIFS_T2T_CCK (0x08)
+				rtw_write8(Adapter, REG_R2T_SIFS+1, val[1]); //SIFS_R2T_CCK(0x08)
+				//RESP_SIFS for OFDM
+				rtw_write8(Adapter, REG_T2T_SIFS, val[2]); //SIFS_T2T_OFDM (0x0a)
+				rtw_write8(Adapter, REG_T2T_SIFS+1, val[3]); //SIFS_R2T_OFDM(0x0a)
+#endif
+			}
+			break;
+		case HW_VAR_ACK_PREAMBLE:
+			{
+				u8	regTmp;
+				u8	bShortPreamble = *( (PBOOLEAN)val );
+				// Joseph marked out for Netgear 3500 TKIP channel 7 issue.(Temporarily)
+				regTmp = (pHalData->nCur40MhzPrimeSC)<<5;
+				//regTmp = 0;
+				if(bShortPreamble)
+					regTmp |= 0x80;
+
+				rtw_write8(Adapter, REG_RRSR+2, regTmp);
+			}
+			break;
+		case HW_VAR_SEC_CFG:
+#ifdef CONFIG_CONCURRENT_MODE
+			rtw_write8(Adapter, REG_SECCFG, 0x0c|BIT(5));// enable tx enc and rx dec engine, and no key search for MC/BC
+#else
+			rtw_write8(Adapter, REG_SECCFG, *((u8 *)val));
+#endif
+			break;
+		case HW_VAR_DM_FLAG:
+			pdmpriv->DMFlag = *((u8 *)val);
+			break;
+		case HW_VAR_DM_FUNC_OP:
+			if(val[0])
+			{// save dm flag
+				pdmpriv->DMFlag_tmp = pdmpriv->DMFlag;
+			}
+			else
+			{// restore dm flag
+				pdmpriv->DMFlag = pdmpriv->DMFlag_tmp;
+			}
+			break;
+		case HW_VAR_DM_FUNC_SET:
+			pdmpriv->DMFlag |= *((u8 *)val);
+			break;
+		case HW_VAR_DM_FUNC_CLR:
+			pdmpriv->DMFlag &= *((u8 *)val);
+			break;
+		case HW_VAR_CAM_EMPTY_ENTRY:
+			{
+				u8	ucIndex = *((u8 *)val);
+				u8	i;
+				u32	ulCommand=0;
+				u32	ulContent=0;
+				u32	ulEncAlgo=CAM_AES;
+
+				for(i=0;i<CAM_CONTENT_COUNT;i++)
+				{
+					// filled id in CAM config 2 byte
+					if( i == 0)
+					{
+						ulContent |=(ucIndex & 0x03) | ((u16)(ulEncAlgo)<<2);
+						//ulContent |= CAM_VALID;
+					}
+					else
+					{
+						ulContent = 0;
+					}
+					// polling bit, and No Write enable, and address
+					ulCommand= CAM_CONTENT_COUNT*ucIndex+i;
+					ulCommand= ulCommand | CAM_POLLINIG|CAM_WRITE;
+					// write content 0 is equall to mark invalid
+					rtw_write32(Adapter, WCAMI, ulContent);  //delay_ms(40);
+					//RT_TRACE(COMP_SEC, DBG_LOUD, ("CAM_empty_entry(): WRITE A4: %lx \n",ulContent));
+					rtw_write32(Adapter, RWCAM, ulCommand);  //delay_ms(40);
+					//RT_TRACE(COMP_SEC, DBG_LOUD, ("CAM_empty_entry(): WRITE A0: %lx \n",ulCommand));
+				}
+			}
+			break;
+		case HW_VAR_CAM_INVALID_ALL:
+			rtw_write32(Adapter, RWCAM, BIT(31)|BIT(30));
+			break;
+		case HW_VAR_CAM_WRITE:
+			{
+				u32	cmd;
+				u32	*cam_val = (u32 *)val;
+				rtw_write32(Adapter, WCAMI, cam_val[0]);
+
+				cmd = CAM_POLLINIG | CAM_WRITE | cam_val[1];
+				rtw_write32(Adapter, RWCAM, cmd);
+			}
+			break;
+		case HW_VAR_AC_PARAM_VO:
+			rtw_write32(Adapter, REG_EDCA_VO_PARAM, ((u32 *)(val))[0]);
+			break;
+		case HW_VAR_AC_PARAM_VI:
+			rtw_write32(Adapter, REG_EDCA_VI_PARAM, ((u32 *)(val))[0]);
+			break;
+		case HW_VAR_AC_PARAM_BE:
+			pHalData->AcParam_BE = ((u32 *)(val))[0];
+			rtw_write32(Adapter, REG_EDCA_BE_PARAM, ((u32 *)(val))[0]);
+			break;
+		case HW_VAR_AC_PARAM_BK:
+			rtw_write32(Adapter, REG_EDCA_BK_PARAM, ((u32 *)(val))[0]);
+			break;
+		case HW_VAR_ACM_CTRL:
+			{
+				u8	acm_ctrl = *((u8 *)val);
+				u8	AcmCtrl = rtw_read8( Adapter, REG_ACMHWCTRL);
+
+				if(acm_ctrl > 1)
+					AcmCtrl = AcmCtrl | 0x1;
+
+				if(acm_ctrl & BIT(3))
+					AcmCtrl |= AcmHw_VoqEn;
+				else
+					AcmCtrl &= (~AcmHw_VoqEn);
+
+				if(acm_ctrl & BIT(2))
+					AcmCtrl |= AcmHw_ViqEn;
+				else
+					AcmCtrl &= (~AcmHw_ViqEn);
+
+				if(acm_ctrl & BIT(1))
+					AcmCtrl |= AcmHw_BeqEn;
+				else
+					AcmCtrl &= (~AcmHw_BeqEn);
+
+				DBG_871X("[HW_VAR_ACM_CTRL] Write 0x%X\n", AcmCtrl );
+				rtw_write8(Adapter, REG_ACMHWCTRL, AcmCtrl );
+			}
+			break;
+		case HW_VAR_AMPDU_MIN_SPACE:
+			{
+				u8	MinSpacingToSet;
+				u8	SecMinSpace;
+
+				MinSpacingToSet = *((u8 *)val);
+				if(MinSpacingToSet <= 7)
+				{
+					switch(Adapter->securitypriv.dot11PrivacyAlgrthm)
+					{
+						case _NO_PRIVACY_:
+						case _AES_:
+							SecMinSpace = 0;
+							break;
+
+						case _WEP40_:
+						case _WEP104_:
+						case _TKIP_:
+						case _TKIP_WTMIC_:
+							SecMinSpace = 6;
+							break;
+						default:
+							SecMinSpace = 7;
+							break;
+					}
+
+					if(MinSpacingToSet < SecMinSpace){
+						MinSpacingToSet = SecMinSpace;
+					}
+
+					//RT_TRACE(COMP_MLME, DBG_LOUD, ("Set HW_VAR_AMPDU_MIN_SPACE: %#x\n", Adapter->MgntInfo.MinSpaceCfg));
+					rtw_write8(Adapter, REG_AMPDU_MIN_SPACE, (rtw_read8(Adapter, REG_AMPDU_MIN_SPACE) & 0xf8) | MinSpacingToSet);
+				}
+			}
+			break;
+		case HW_VAR_AMPDU_FACTOR:
+			{
+				u8	RegToSet_Normal[4]={0x41,0xa8,0x72, 0xb9};
+				u8	RegToSet_BT[4]={0x31,0x74,0x42, 0x97};
+				u8	FactorToSet;
+				u8	*pRegToSet;
+				u8	index = 0;
+
+#ifdef CONFIG_BT_COEXIST
+				if(	(pHalData->bt_coexist.BT_Coexist) &&
+					(pHalData->bt_coexist.BT_CoexistType == BT_CSR_BC4) )
+					pRegToSet = RegToSet_BT; // 0x97427431;
+				else
+#endif
+					pRegToSet = RegToSet_Normal; // 0xb972a841;
+
+				FactorToSet = *((u8 *)val);
+				if(FactorToSet <= 3)
+				{
+					FactorToSet = (1<<(FactorToSet + 2));
+					if(FactorToSet>0xf)
+						FactorToSet = 0xf;
+
+					for(index=0; index<4; index++)
+					{
+						if((pRegToSet[index] & 0xf0) > (FactorToSet<<4))
+							pRegToSet[index] = (pRegToSet[index] & 0x0f) | (FactorToSet<<4);
+
+						if((pRegToSet[index] & 0x0f) > FactorToSet)
+							pRegToSet[index] = (pRegToSet[index] & 0xf0) | (FactorToSet);
+
+						rtw_write8(Adapter, (REG_AGGLEN_LMT+index), pRegToSet[index]);
+					}
+
+					//RT_TRACE(COMP_MLME, DBG_LOUD, ("Set HW_VAR_AMPDU_FACTOR: %#x\n", FactorToSet));
+				}
+			}
+			break;
+		case HW_VAR_RXDMA_AGG_PG_TH:
+			#ifdef CONFIG_USB_RX_AGGREGATION
+			{
+				u8	threshold = *((u8 *)val);
+				if( threshold == 0)
+				{
+					threshold = pHalData->UsbRxAggPageCount;
+				}
+				rtw_write8(Adapter, REG_RXDMA_AGG_PG_TH, threshold);
+			}
+			#endif
+			break;
+		case HW_VAR_SET_RPWM:
+			rtw_write8(Adapter, REG_USB_HRPWM, *((u8 *)val));
+			break;
+		case HW_VAR_H2C_FW_PWRMODE:
+			{
+				u8	psmode = (*(u8 *)val);
+
+				// Forece leave RF low power mode for 1T1R to prevent conficting setting in Fw power
+				// saving sequence. 2010.06.07. Added by tynli. Suggested by SD3 yschang.
+				if( (psmode != PS_MODE_ACTIVE) && (!IS_92C_SERIAL(pHalData->VersionID)))
+				{
+					rtl8192c_dm_RF_Saving(Adapter, _TRUE);
+				}
+				rtl8192c_set_FwPwrMode_cmd(Adapter, psmode);
+			}
+			break;
+		case HW_VAR_H2C_FW_JOINBSSRPT:
+			{
+				u8	mstatus = (*(u8 *)val);
+				rtl8192c_set_FwJoinBssReport_cmd(Adapter, mstatus);
+			}
+			break;
+#ifdef CONFIG_P2P_PS
+		case HW_VAR_H2C_FW_P2P_PS_OFFLOAD:
+			{
+				u8	p2p_ps_state = (*(u8 *)val);
+				rtl8192c_set_p2p_ps_offload_cmd(Adapter, p2p_ps_state);
+			}
+			break;
+#endif // CONFIG_P2P_PS
+#ifdef CONFIG_TDLS
+		case HW_VAR_TDLS_WRCR:
+			rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)&(~ BIT(6) ));
+			break;
+		case HW_VAR_TDLS_INIT_CH_SEN:
+			{
+				rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)&(~ BIT(6) )&(~ BIT(7) ));
+				rtw_write16(Adapter, REG_RXFLTMAP2,0xffff);
+
+				//disable update TSF
+				rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)|BIT(4));
+			}
+			break;
+		case HW_VAR_TDLS_DONE_CH_SEN:
+			{
+				//enable update TSF
+				rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL)&(~ BIT(4)));
+				rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)|(BIT(7) ));
+			}
+			break;
+		case HW_VAR_TDLS_RS_RCR:
+			rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR)|(BIT(6)));
+			break;
+#endif //CONFIG_TDLS
+		case HW_VAR_INITIAL_GAIN:
+			{
+				DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+				u32 		rx_gain = ((u32 *)(val))[0];
+
+				if(rx_gain == 0xff){//restore rx gain
+					pDigTable->CurIGValue = pDigTable->BackupIGValue;
+					PHY_SetBBReg(Adapter, rOFDM0_XAAGCCore1, 0x7f,pDigTable->CurIGValue );
+					PHY_SetBBReg(Adapter, rOFDM0_XBAGCCore1, 0x7f,pDigTable->CurIGValue);
+				}
+				else{
+					pDigTable->BackupIGValue = pDigTable->CurIGValue;
+					PHY_SetBBReg(Adapter, rOFDM0_XAAGCCore1, 0x7f,rx_gain );
+					PHY_SetBBReg(Adapter, rOFDM0_XBAGCCore1, 0x7f,rx_gain);
+					pDigTable->CurIGValue = (u8)rx_gain;
+				}
+
+
+			}
+			break;
+		case HW_VAR_TRIGGER_GPIO_0:
+			rtl8192cu_trigger_gpio_0(Adapter);
+			break;
+#ifdef CONFIG_BT_COEXIST
+		case HW_VAR_BT_SET_COEXIST:
+			{
+				u8	bStart = (*(u8 *)val);
+				rtl8192c_set_dm_bt_coexist(Adapter, bStart);
+			}
+			break;
+		case HW_VAR_BT_ISSUE_DELBA:
+			{
+				u8	dir = (*(u8 *)val);
+				rtl8192c_issue_delete_ba(Adapter, dir);
+			}
+			break;
+#endif
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+
+		case HW_VAR_ANTENNA_DIVERSITY_LINK:
+			SwAntDivRestAfterLink8192C(Adapter);
+			break;
+		case HW_VAR_ANTENNA_DIVERSITY_SELECT:
+			{
+				u8	Optimum_antenna = (*(u8 *)val);
+				//switch antenna to Optimum_antenna
+		//		DBG_8192C("==> HW_VAR_ANTENNA_DIVERSITY_SELECT , Ant_(%s)\n",(Optimum_antenna==2)?"A":"B");
+				if(pHalData->CurAntenna !=  Optimum_antenna)
+				{
+					PHY_SetBBReg(Adapter, rFPGA0_XA_RFInterfaceOE, 0x300, Optimum_antenna);
+					pHalData->CurAntenna = Optimum_antenna ;
+					//DBG_8192C("==> HW_VAR_ANTENNA_DIVERSITY_SELECT , Ant_(%s)\n",(Optimum_antenna==2)?"A":"B");
+				}
+			}
+			break;
+#endif
+		case HW_VAR_EFUSE_BYTES: // To set EFUE total used bytes, added by Roger, 2008.12.22.
+			pHalData->EfuseUsedBytes = *((u16 *)val);
+			break;
+		case HW_VAR_FIFO_CLEARN_UP:
+			{
+				#define RW_RELEASE_EN		BIT18
+				#define RXDMA_IDLE			BIT17
+
+				struct pwrctrl_priv *pwrpriv = &Adapter->pwrctrlpriv;
+				u8 trycnt = 100;
+
+				//pause tx
+				rtw_write8(Adapter,REG_TXPAUSE,0xff);
+
+				//keep sn
+				Adapter->xmitpriv.nqos_ssn = rtw_read16(Adapter,REG_NQOS_SEQ);
+
+				if(pwrpriv->bkeepfwalive != _TRUE)
+				{
+					//RX DMA stop
+					rtw_write32(Adapter,REG_RXPKT_NUM,(rtw_read32(Adapter,REG_RXPKT_NUM)|RW_RELEASE_EN));
+					do{
+						if(!(rtw_read32(Adapter,REG_RXPKT_NUM)&RXDMA_IDLE))
+							break;
+					}while(trycnt--);
+					if(trycnt ==0)
+						DBG_8192C("Stop RX DMA failed...... \n");
+
+					//RQPN Load 0
+					rtw_write16(Adapter,REG_RQPN_NPQ,0x0);
+					rtw_write32(Adapter,REG_RQPN,0x80000000);
+					rtw_mdelay_os(10);
+				}
+			}
+			break;
+			case HW_VAR_WOWLAN:
+#ifdef CONFIG_WOWLAN
+			{
+				struct wowlan_ioctl_param *poidparam;
+
+				int res;
+
+				poidparam = (struct wowlan_ioctl_param *)val;
+				switch (poidparam->subcode){
+					case WOWLAN_PATTERN_MATCH:
+						//Turn on the Pattern Match feature
+						DBG_8192C("\n PATTERN_MATCH poidparam->subcode_value=%d\n",poidparam->subcode_value);
+						if(poidparam->subcode_value==1){
+							//rtw_write8(Adapter, REG_WOW_CTRL, (rtw_read8(Adapter, REG_WOW_CTRL)|BIT(1)));
+							Adapter->pwrctrlpriv.wowlan_pattern=_TRUE;
+							DBG_8192C("%s Adapter->pwrctrlpriv.wowlan_pattern=%x\n",__FUNCTION__,Adapter->pwrctrlpriv.wowlan_pattern);
+						}
+						else{
+							//rtw_write8(Adapter, REG_WOW_CTRL, (rtw_read8(Adapter, REG_WOW_CTRL)&~BIT(1)));
+							Adapter->pwrctrlpriv.wowlan_pattern=_FALSE;
+						}
+						break;
+					case WOWLAN_MAGIC_PACKET:
+						//Turn on the Magic Packet feature
+						DBG_8192C("\n MAGIC_PACKET poidparam->subcode_value=%d\n",poidparam->subcode_value);
+						if(poidparam->subcode_value==1){
+							//rtw_write8(Adapter, REG_WOW_CTRL, (rtw_read8(Adapter, REG_WOW_CTRL)|BIT(2)));
+							Adapter->pwrctrlpriv.wowlan_magic=_TRUE;
+							DBG_8192C("%s Adapter->pwrctrlpriv.wowlan_magic=%x\n",__FUNCTION__,Adapter->pwrctrlpriv.wowlan_magic);
+						}
+						else{
+							//rtw_write8(Adapter, REG_WOW_CTRL, (rtw_read8(Adapter, REG_WOW_CTRL)&~BIT(2)));
+							Adapter->pwrctrlpriv.wowlan_magic=_FALSE;
+						}
+						break;
+					case WOWLAN_UNICAST:
+						//Turn on the Unicast wakeup feature
+						if(poidparam->subcode_value==1){
+							//rtw_write8(Adapter, REG_WOW_CTRL, (rtw_read8(Adapter, REG_WOW_CTRL)|BIT(3)));
+							Adapter->pwrctrlpriv.wowlan_unicast=_TRUE;
+						}
+						else{
+							//rtw_write8(Adapter, REG_WOW_CTRL, (rtw_read8(Adapter, REG_WOW_CTRL)&~BIT(3)));
+							Adapter->pwrctrlpriv.wowlan_unicast=_FALSE;
+							DBG_8192C("%s Adapter->pwrctrlpriv.wowlan_unicast=%x\n",__FUNCTION__,Adapter->pwrctrlpriv.wowlan_unicast);
+						}
+						break;
+					case WOWLAN_SET_PATTERN:
+						//Setting the Pattern for wowlan
+						res=rtw_wowlan_set_pattern(Adapter,poidparam->pattern);
+						if(res)
+							DBG_8192C("rtw_wowlan_set_pattern retern value=0x%x",res);
+						break;
+					case WOWLAN_DUMP_REG:
+						//dump the WKFMCAM and WOW_CTRL register
+						/*DBG_8192C("\n\n\n\n rtw_wowlan_ctrl: WOW_CTRL=0x%x \n",rtw_read8(Adapter, REG_WOW_CTRL));
+						DBG_8192C("print WKFMCAM index =%d ",poidparam->data[0]);
+						{	int cmd=0,offset=0;
+							for(offset=0;offset<5;offset++){
+								cmd=BIT(31)|(poidparam->data[0]+offset);
+								rtw_write32(Adapter, REG_WKFMCAM_CMD, cmd);
+								DBG_8192C("offset[%d]=0x%.8x  ",offset,rtw_read32(Adapter, REG_WKFMCAM_RWD));
+								DBG_8192C("offset[%d]=MSB 0x%x:0x%x:0x%x:0x%x  ",offset,rtw_read8(Adapter, REG_WKFMCAM_RWD+3),rtw_read8(Adapter, REG_WKFMCAM_RWD+2),rtw_read8(Adapter, REG_WKFMCAM_RWD+1),rtw_read8(Adapter, REG_WKFMCAM_RWD));
+							}
+						}*/
+
+						break;
+					case WOWLAN_ENABLE:
+						SetFwRelatedForWoWLAN8192CU(Adapter, _TRUE);
+						//Set Pattern
+						if(Adapter->pwrctrlpriv.wowlan_pattern==_TRUE)
+							rtw_wowlan_reload_pattern(Adapter);
+						rtl8192c_set_wowlan_cmd(Adapter);
+						rtw_write8(Adapter, 0x6, rtw_read8(Adapter, 0x6)|BIT(3));
+						rtw_msleep_os(10);
+						//DBG_8192C(" \n REG_WOW_CTRL=0x%x \n",rtw_read8(Adapter, REG_WOW_CTRL));
+//						if(rtw_read8(Adapter, REG_WOW_CTRL)==0)
+//							rtw_write8(Adapter, REG_WOW_CTRL, (rtw_read8(Adapter, REG_WOW_CTRL)|BIT(1)|BIT(2)|BIT(3)));
+						//DBG_8192C(" \n REG_WOW_CTRL=0x%x \n",rtw_read8(Adapter, REG_WOW_CTRL));
+						break;
+
+					case WOWLAN_DISABLE:
+						Adapter->pwrctrlpriv.wowlan_mode=_FALSE;
+						rtl8192c_set_wowlan_cmd(Adapter);
+						rtw_msleep_os(10);
+						break;
+
+					case WOWLAN_STATUS:
+						poidparam->wakeup_reason = rtw_read8(Adapter, REG_WOWLAN_REASON);
+						DBG_8192C("wake on wlan reason 0x%02x\n", poidparam->wakeup_reason);
+						break;
+
+					default:
+						break;
+				}
+				if (Adapter->pwrctrlpriv.wowlan_unicast||Adapter->pwrctrlpriv.wowlan_magic || Adapter->pwrctrlpriv.wowlan_pattern)
+					Adapter->pwrctrlpriv.wowlan_mode =_TRUE;
+				else
+					Adapter->pwrctrlpriv.wowlan_mode =_FALSE;
+			}
+
+			break;
+#endif //CONFIG_WOWLAN
+		case HW_VAR_CHECK_TXBUF:
+#ifdef CONFIG_CONCURRENT_MODE
+			{
+				int i;
+				u8	RetryLimit = 0x01;
+
+				//rtw_write16(Adapter, REG_RL,0x0101);
+				rtw_write16(Adapter, REG_RL, RetryLimit << RETRY_LIMIT_SHORT_SHIFT | RetryLimit << RETRY_LIMIT_LONG_SHIFT);
+
+				for(i=0;i<1000;i++)
+				{
+					if(rtw_read32(Adapter, 0x200) != rtw_read32(Adapter, 0x204))
+					{
+						//DBG_871X("packet in tx packet buffer - 0x204=%x, 0x200=%x (%d)\n", rtw_read32(Adapter, 0x204), rtw_read32(Adapter, 0x200), i);
+						rtw_msleep_os(10);
+					}
+					else
+					{
+						DBG_871X("no packet in tx packet buffer (%d)\n", i);
+						break;
+					}
+				}
+
+				RetryLimit = 0x30;
+				rtw_write16(Adapter, REG_RL, RetryLimit << RETRY_LIMIT_SHORT_SHIFT | RetryLimit << RETRY_LIMIT_LONG_SHIFT);
+
+			}
+#endif
+			break;
+		case HW_VAR_BCN_VALID:
+			//BCN_VALID, BIT16 of REG_TDECTRL = BIT0 of REG_TDECTRL+2, write 1 to clear, Clear by sw
+			rtw_write8(Adapter, REG_TDECTRL+2, rtw_read8(Adapter, REG_TDECTRL+2) | BIT0);
+			break;
+		case HW_VAR_USB_RXAGG_PAGE_TO:
+			rtw_write8(Adapter, REG_USB_DMA_AGG_TO, *((u8 *)val));
+			break;
+		default:
+			break;
+	}
+
+_func_exit_;
+}
+
+void GetHwReg8192CU(PADAPTER Adapter, u8 variable, u8* val)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+
+_func_enter_;
+
+	switch(variable)
+	{
+		case HW_VAR_BASIC_RATE:
+			*((u16 *)(val)) = pHalData->BasicRateSet;
+			/* falls through */
+		case HW_VAR_TXPAUSE:
+			val[0] = rtw_read8(Adapter, REG_TXPAUSE);
+			break;
+		case HW_VAR_BCN_VALID:
+			//BCN_VALID, BIT16 of REG_TDECTRL = BIT0 of REG_TDECTRL+2
+			val[0] = (BIT0 & rtw_read8(Adapter, REG_TDECTRL+2))?_TRUE:_FALSE;
+			break;
+		case HW_VAR_DM_FLAG:
+			val[0] = pHalData->dmpriv.DMFlag;
+			break;
+		case HW_VAR_RF_TYPE:
+			val[0] = pHalData->rf_type;
+			break;
+		case HW_VAR_FWLPS_RF_ON:
+			{
+				//When we halt NIC, we should check if FW LPS is leave.
+				u32	valRCR;
+
+				if(Adapter->pwrctrlpriv.rf_pwrstate == rf_off)
+				{
+					// If it is in HW/SW Radio OFF or IPS state, we do not check Fw LPS Leave,
+					// because Fw is unload.
+					val[0] = _TRUE;
+				}
+				else
+				{
+					valRCR = rtw_read32(Adapter, REG_RCR);
+					valRCR &= 0x00070000;
+					if(valRCR)
+						val[0] = _FALSE;
+					else
+						val[0] = _TRUE;
+				}
+			}
+			break;
+#ifdef CONFIG_ANTENNA_DIVERSITY
+		case HW_VAR_CURRENT_ANTENNA:
+			val[0] = pHalData->CurAntenna;
+			break;
+#endif
+		case HW_VAR_EFUSE_BYTES: // To get EFUE total used bytes, added by Roger, 2008.12.22.
+			*((u16 *)(val)) = pHalData->EfuseUsedBytes;
+			break;
+		case HW_VAR_VID:
+			*((u16 *)(val)) = pHalData->EEPROMVID;
+			break;
+		case HW_VAR_PID:
+			*((u16 *)(val)) = pHalData->EEPROMPID;
+			break;
+		default:
+			break;
+	}
+
+_func_exit_;
+}
+
+//
+//	Description:
+//		Query setting of specified variable.
+//
+u8
+GetHalDefVar8192CUsb(
+	IN	PADAPTER				Adapter,
+	IN	HAL_DEF_VARIABLE		eVariable,
+	IN	PVOID					pValue
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u8			bResult = _TRUE;
+
+	switch(eVariable)
+	{
+		case HAL_DEF_UNDERCORATEDSMOOTHEDPWDB:
+#if 0 //trunk
+			{
+				struct mlme_priv *pmlmepriv = &Adapter->mlmepriv;
+				struct sta_priv * pstapriv = &Adapter->stapriv;
+				struct sta_info * psta;
+				psta = rtw_get_stainfo(pstapriv, pmlmepriv->cur_network.network.MacAddress);
+				if(psta)
+				{
+					*((int *)pValue) = psta->rssi_stat.UndecoratedSmoothedPWDB;
+				}
+			}
+#else //v4 branch
+				//if(check_fwstate(&Adapter->mlmepriv, WIFI_STATION_STATE) == _TRUE){
+			*((int *)pValue) = pHalData->dmpriv.UndecoratedSmoothedPWDB;
+				//}
+				//else{
+
+				//}
+#endif
+			break;
+		case HAL_DEF_IS_SUPPORT_ANT_DIV:
+			#ifdef CONFIG_ANTENNA_DIVERSITY
+			*((u8 *)pValue) = (IS_92C_SERIAL(pHalData->VersionID) ||(pHalData->AntDivCfg==0))?_FALSE:_TRUE;
+			#endif
+			break;
+		case HAL_DEF_CURRENT_ANTENNA:
+			#ifdef CONFIG_ANTENNA_DIVERSITY
+			*(( u8*)pValue) = pHalData->CurAntenna;
+			#endif
+			break;
+		case HAL_DEF_DRVINFO_SZ:
+			*(( u32*)pValue) = DRVINFO_SZ;
+			break;
+		case HAL_DEF_MAX_RECVBUF_SZ:
+			*(( u32*)pValue) = MAX_RECVBUF_SZ;
+			break;
+		case HAL_DEF_RX_PACKET_OFFSET:
+			*(( u32*)pValue) = RXDESC_SIZE + DRVINFO_SZ;
+			break;
+		case HAL_DEF_DBG_DUMP_RXPKT:
+			*(( u8*)pValue) = pHalData->bDumpRxPkt;
+			break;
+		case HAL_DEF_DBG_DM_FUNC:
+			*(( u8*)pValue) = pHalData->dmpriv.DMFlag;
+			break;
+		default:
+			//RT_TRACE(COMP_INIT, DBG_WARNING, ("GetHalDefVar8192CUsb(): Unkown variable: %d!\n", eVariable));
+			bResult = _FALSE;
+			break;
+	}
+
+	return bResult;
+}
+
+
+
+
+//
+//	Description:
+//		Change default setting of specified variable.
+//
+u8
+SetHalDefVar8192CUsb(
+	IN	PADAPTER				Adapter,
+	IN	HAL_DEF_VARIABLE		eVariable,
+	IN	PVOID					pValue
+	)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(Adapter);
+	u8			bResult = _TRUE;
+
+	switch(eVariable)
+	{
+		case HAL_DEF_DBG_DUMP_RXPKT:
+			pHalData->bDumpRxPkt = *(( u8*)pValue);
+			break;
+		case HAL_DEF_DBG_DM_FUNC:
+			{
+				u8 dm_func = *(( u8*)pValue);
+				struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+
+				if(dm_func == 0){ //disable all dynamic func
+					pdmpriv->DMFlag = DYNAMIC_FUNC_DISABLE;
+					DBG_8192C("==> Disable all dynamic function...\n");
+				}
+				else if(dm_func == 1){//disable DIG
+					pdmpriv->DMFlag &= (~DYNAMIC_FUNC_DIG);
+					DBG_8192C("==> Disable DIG...\n");
+				}
+				else if(dm_func == 2){//disable High power
+					pdmpriv->DMFlag &= (~DYNAMIC_FUNC_HP);
+				}
+				else if(dm_func == 3){//disable tx power tracking
+					pdmpriv->DMFlag &= (~DYNAMIC_FUNC_SS);
+					DBG_8192C("==> Disable tx power tracking...\n");
+				}
+				else if(dm_func == 4){//disable BT coexistence
+					pdmpriv->DMFlag &= (~DYNAMIC_FUNC_BT);
+				}
+				else if(dm_func == 5){//disable antenna diversity
+					pdmpriv->DMFlag &= (~DYNAMIC_FUNC_ANT_DIV);
+				}
+				else if(dm_func == 6){//turn on all dynamic func
+					if(!(pdmpriv->DMFlag & DYNAMIC_FUNC_DIG))
+					{
+						struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+						DIG_T	*pDigTable = &pdmpriv->DM_DigTable;
+						pDigTable->PreIGValue = rtw_read8(Adapter,0xc50);
+					}
+
+					pdmpriv->DMFlag |= (DYNAMIC_FUNC_DIG|DYNAMIC_FUNC_HP|DYNAMIC_FUNC_SS|
+						DYNAMIC_FUNC_BT|DYNAMIC_FUNC_ANT_DIV) ;
+					DBG_8192C("==> Turn on all dynamic function...\n");
+				}
+			}
+			break;
+		default:
+			//RT_TRACE(COMP_INIT, DBG_TRACE, ("SetHalDefVar819xUsb(): Unkown variable: %d!\n", eVariable));
+			bResult = _FALSE;
+			break;
+	}
+
+	return bResult;
+}
+
+u32  _update_92cu_basic_rate(_adapter *padapter, unsigned int mask)
+{
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(padapter);
+#ifdef CONFIG_BT_COEXIST
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+#endif
+	unsigned int BrateCfg = 0;
+
+#ifdef CONFIG_BT_COEXIST
+	if(	(pbtpriv->BT_Coexist) &&	(pbtpriv->BT_CoexistType == BT_CSR_BC4)	)
+	{
+		BrateCfg = mask  & 0x151;
+		//DBG_8192C("BT temp disable cck 2/5.5/11M, (0x%x = 0x%x)\n", REG_RRSR, BrateCfg & 0x151);
+	}
+	else
+#endif
+	{
+		if(pHalData->VersionID != VERSION_TEST_CHIP_88C)
+			BrateCfg = mask  & 0x15F;
+		else	//for 88CU 46PING setting, Disable CCK 2M, 5.5M, Others must tuning
+			BrateCfg = mask  & 0x159;
+	}
+
+	BrateCfg |= 0x01; // default enable 1M ACK rate
+
+	return BrateCfg;
+}
+
+void _update_response_rate(_adapter *padapter,unsigned int mask)
+{
+	u8	RateIndex = 0;
+	// Set RRSR rate table.
+	rtw_write8(padapter, REG_RRSR, mask&0xff);
+	rtw_write8(padapter,REG_RRSR+1, (mask>>8)&0xff);
+
+
+	// Set RTS initial rate
+	while(mask > 0x1)
+	{
+		mask = (mask>> 1);
+		RateIndex++;
+	}
+	rtw_write8(padapter, REG_INIRTS_RATE_SEL, RateIndex);
+}
+
+void UpdateHalRAMask8192CUsb(PADAPTER padapter, u32 mac_id)
+{
+	//volatile unsigned int result;
+	u8	init_rate=0;
+	u8	networkType, raid;
+	u32	mask;
+	u8	shortGIrate = _FALSE;
+	int	supportRateNum = 0;
+	struct sta_info	*psta;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	WLAN_BSSID_EX 		*cur_network = &(pmlmeinfo->network);
+#ifdef CONFIG_BT_COEXIST
+	struct btcoexist_priv	*pbtpriv = &(pHalData->bt_coexist);
+#endif
+
+	if (mac_id >= NUM_STA) //CAM_SIZE
+	{
+		return;
+	}
+
+	psta = pmlmeinfo->FW_sta_info[mac_id].psta;
+	if(psta == NULL)
+	{
+		return;
+	}
+
+	switch (mac_id)
+	{
+		case 0:// for infra mode
+#ifdef CONFIG_CONCURRENT_MODE
+		case 2:// first station uses macid=0, second station uses macid=2
+#endif
+			supportRateNum = rtw_get_rateset_len(cur_network->SupportedRates);
+			networkType = judge_network_type(padapter, cur_network->SupportedRates, supportRateNum) & 0xf;
+			//pmlmeext->cur_wireless_mode = networkType;
+			raid = networktype_to_raid(networkType);
+
+			mask = update_supported_rate(cur_network->SupportedRates, supportRateNum);
+			mask |= (pmlmeinfo->HT_enable)? update_MSC_rate(&(pmlmeinfo->HT_caps)): 0;
+			mask |= ((raid<<28)&0xf0000000);
+
+			if (support_short_GI(padapter, &(pmlmeinfo->HT_caps)))
+			{
+				shortGIrate = _TRUE;
+			}
+
+			break;
+
+		case 1://for broadcast/multicast
+			supportRateNum = rtw_get_rateset_len(pmlmeinfo->FW_sta_info[mac_id].SupportedRates);
+			if(pmlmeext->cur_wireless_mode & WIRELESS_11B)
+				networkType = WIRELESS_11B;
+			else
+				networkType = WIRELESS_11G;
+			raid = networktype_to_raid(networkType);
+
+			mask = update_basic_rate(cur_network->SupportedRates, supportRateNum);
+			mask |= ((raid<<28)&0xf0000000);
+
+			break;
+
+		default: //for each sta in IBSS
+#ifdef CONFIG_TDLS
+			if(psta->tdls_sta_state & TDLS_LINKED_STATE)
+			{
+				shortGIrate = update_sgi_tdls(padapter, psta);
+				mask = update_mask_tdls(padapter, psta);
+				raid = mask>>28;
+				break;
+			}
+			else
+#endif //CONFIG_TDLS
+			{
+				supportRateNum = rtw_get_rateset_len(pmlmeinfo->FW_sta_info[mac_id].SupportedRates);
+				networkType = judge_network_type(padapter, pmlmeinfo->FW_sta_info[mac_id].SupportedRates, supportRateNum) & 0xf;
+				//pmlmeext->cur_wireless_mode = networkType;
+				raid = networktype_to_raid(networkType);
+
+				mask = update_supported_rate(cur_network->SupportedRates, supportRateNum);
+				mask |= ((raid<<28)&0xf0000000);
+
+				//todo: support HT in IBSS
+
+				break;
+			}
+	}
+
+#ifdef CONFIG_BT_COEXIST
+	if( (pbtpriv->BT_Coexist) &&
+		(pbtpriv->BT_CoexistType == BT_CSR_BC4) &&
+		(pbtpriv->BT_CUR_State) &&
+		(pbtpriv->BT_Ant_isolation) &&
+		((pbtpriv->BT_Service==BT_SCO)||
+		(pbtpriv->BT_Service==BT_Busy)) )
+		mask &= 0xffffcfc0;
+	else
+#endif
+		mask &=0xffffffff;
+
+
+	init_rate = get_highest_rate_idx(mask)&0x3f;
+
+	if(pHalData->fw_ractrl == _TRUE)
+	{
+		u8 arg = 0;
+
+		//arg = (cam_idx-4)&0x1f;//MACID
+		arg = mac_id&0x1f;//MACID
+
+		arg |= BIT(7);
+
+		if (shortGIrate==_TRUE)
+			arg |= BIT(5);
+
+		DBG_871X("update raid entry, mask=0x%x, arg=0x%x\n", mask, arg);
+		psta->ra_mask=mask;
+#ifdef CONFIG_INTEL_PROXIM
+		if(padapter->proximity.proxim_on ==_TRUE){
+			arg &= ~BIT(6);
+		}
+		else {
+			arg |= BIT(6);
+		}
+#endif //CONFIG_INTEL_PROXIM
+		rtl8192c_set_raid_cmd(padapter, mask, arg);
+
+	}
+	else
+	{
+		if (shortGIrate==_TRUE)
+			init_rate |= BIT(6);
+
+		rtw_write8(padapter, (REG_INIDATA_RATE_SEL+mac_id), init_rate);
+	}
+
+
+	//set ra_id
+	psta->raid = raid;
+	psta->init_rate = init_rate;
+
+	//set correct initial date rate for each mac_id
+	pdmpriv->INIDATA_RATE[mac_id] = init_rate;
+}
+
+void SetBeaconRelatedRegisters8192CUsb(PADAPTER padapter)
+{
+	u32	value32;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	//reset TSF, enable update TSF, correcting TSF On Beacon
+
+	//REG_BCN_INTERVAL
+	//REG_BCNDMATIM
+	//REG_ATIMWND
+	//REG_TBTT_PROHIBIT
+	//REG_DRVERLYINT
+	//REG_BCN_MAX_ERR
+	//REG_BCNTCFG //(0x510)
+	//REG_DUAL_TSF_RST
+	//REG_BCN_CTRL //(0x550)
+
+	//BCN interval
+	rtw_write16(padapter, REG_BCN_INTERVAL, pmlmeinfo->bcn_interval);
+	rtw_write8(padapter, REG_ATIMWND, 0x02);// 2ms
+
+	_InitBeaconParameters(padapter);
+
+	rtw_write8(padapter, REG_SLOT, 0x09);
+
+	value32 =rtw_read32(padapter, REG_TCR);
+	value32 &= ~TSFRST;
+	rtw_write32(padapter,  REG_TCR, value32);
+
+	value32 |= TSFRST;
+	rtw_write32(padapter, REG_TCR, value32);
+
+	// NOTE: Fix test chip's bug (about contention windows's randomness)
+	rtw_write8(padapter,  REG_RXTSF_OFFSET_CCK, 0x50);
+	rtw_write8(padapter, REG_RXTSF_OFFSET_OFDM, 0x50);
+
+	_BeaconFunctionEnable(padapter, _TRUE, _TRUE);
+
+	ResumeTxBeacon(padapter);
+
+	//rtw_write8(padapter, 0x422, rtw_read8(padapter, 0x422)|BIT(6));
+
+	//rtw_write8(padapter, 0x541, 0xff);
+
+	//rtw_write8(padapter, 0x542, rtw_read8(padapter, 0x541)|BIT(0));
+
+	rtw_write8(padapter, REG_BCN_CTRL, rtw_read8(padapter, REG_BCN_CTRL)|BIT(1));
+
+}
+
+static void rtl8192cu_init_default_value(_adapter * padapter)
+{
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv;
+	struct dm_priv	*pdmpriv = &pHalData->dmpriv;
+	u8	i;
+
+	//init default value
+	pHalData->fw_ractrl = _FALSE;
+	pHalData->bIQKInitialized = _FALSE;
+	if(!pwrctrlpriv->bkeepfwalive)
+		pHalData->LastHMEBoxNum = 0;
+
+	pHalData->bIQKInitialized = _FALSE;
+	//init dm default value
+	pdmpriv->TM_Trigger = 0;
+	pdmpriv->binitialized = _FALSE;
+	pdmpriv->prv_traffic_idx = 3;
+	pdmpriv->initialize = 0;
+
+	pdmpriv->ThermalValue_HP_index = 0;
+	for(i = 0; i < HP_THERMAL_NUM; i++)
+		pdmpriv->ThermalValue_HP[i] = 0;
+}
+
+static u8 rtl8192cu_ps_func(PADAPTER Adapter,HAL_INTF_PS_FUNC efunc_id, u8 *val)
+{
+	u8 bResult = _TRUE;
+	switch(efunc_id){
+
+		#if defined(CONFIG_AUTOSUSPEND) && defined(SUPPORT_HW_RFOFF_DETECTED)
+		case HAL_USB_SELECT_SUSPEND:
+			{
+				u8 bfwpoll = *(( u8*)val);
+				rtl8192c_set_FwSelectSuspend_cmd(Adapter,bfwpoll ,500);//note fw to support hw power down ping detect
+			}
+			break;
+		#endif //CONFIG_AUTOSUSPEND && SUPPORT_HW_RFOFF_DETECTED
+
+		default:
+			break;
+	}
+	return bResult;
+}
+
+void rtl8192cu_set_hal_ops(_adapter * padapter)
+{
+	struct hal_ops	*pHalFunc = &padapter->HalFunc;
+
+_func_enter_;
+
+	padapter->HalData = rtw_zmalloc(sizeof(HAL_DATA_TYPE));
+	if(padapter->HalData == NULL){
+		DBG_8192C("cant not alloc memory for HAL DATA \n");
+	}
+	//_rtw_memset(padapter->HalData, 0, sizeof(HAL_DATA_TYPE));
+	padapter->hal_data_sz = sizeof(HAL_DATA_TYPE);
+
+	pHalFunc->hal_init = &rtl8192cu_hal_init;
+	pHalFunc->hal_deinit = &rtl8192cu_hal_deinit;
+
+	//pHalFunc->free_hal_data = &rtl8192c_free_hal_data;
+
+	pHalFunc->inirp_init = &rtl8192cu_inirp_init;
+	pHalFunc->inirp_deinit = &rtl8192cu_inirp_deinit;
+
+	pHalFunc->init_xmit_priv = &rtl8192cu_init_xmit_priv;
+	pHalFunc->free_xmit_priv = &rtl8192cu_free_xmit_priv;
+
+	pHalFunc->init_recv_priv = &rtl8192cu_init_recv_priv;
+	pHalFunc->free_recv_priv = &rtl8192cu_free_recv_priv;
+#ifdef CONFIG_SW_LED
+	pHalFunc->InitSwLeds = &rtl8192cu_InitSwLeds;
+	pHalFunc->DeInitSwLeds = &rtl8192cu_DeInitSwLeds;
+#else //case of hw led or no led
+	pHalFunc->InitSwLeds = NULL;
+	pHalFunc->DeInitSwLeds = NULL;
+#endif//CONFIG_SW_LED
+
+	//pHalFunc->dm_init = &rtl8192c_init_dm_priv;
+	//pHalFunc->dm_deinit = &rtl8192c_deinit_dm_priv;
+
+	pHalFunc->init_default_value = &rtl8192cu_init_default_value;
+	pHalFunc->intf_chip_configure = &rtl8192cu_interface_configure;
+	pHalFunc->read_adapter_info = &ReadAdapterInfo8192CU;
+
+	//pHalFunc->set_bwmode_handler = &PHY_SetBWMode8192C;
+	//pHalFunc->set_channel_handler = &PHY_SwChnl8192C;
+
+	//pHalFunc->hal_dm_watchdog = &rtl8192c_HalDmWatchDog;
+
+	pHalFunc->SetHwRegHandler = &SetHwReg8192CU;
+	pHalFunc->GetHwRegHandler = &GetHwReg8192CU;
+	pHalFunc->GetHalDefVarHandler = &GetHalDefVar8192CUsb;
+	pHalFunc->SetHalDefVarHandler = &SetHalDefVar8192CUsb;
+
+	pHalFunc->UpdateRAMaskHandler = &UpdateHalRAMask8192CUsb;
+	pHalFunc->SetBeaconRelatedRegistersHandler = &SetBeaconRelatedRegisters8192CUsb;
+
+	//pHalFunc->Add_RateATid = &rtl8192c_Add_RateATid;
+
+//#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+	//pHalFunc->AntDivBeforeLinkHandler = &SwAntDivBeforeLink8192C;
+	//pHalFunc->AntDivCompareHandler = &SwAntDivCompare8192C;
+//#endif
+
+	pHalFunc->hal_xmit = &rtl8192cu_hal_xmit;
+	pHalFunc->mgnt_xmit = &rtl8192cu_mgnt_xmit;
+	pHalFunc->hal_xmitframe_enqueue = &rtl8192cu_hal_xmitframe_enqueue;
+
+	//pHalFunc->read_bbreg = &rtl8192c_PHY_QueryBBReg;
+	//pHalFunc->write_bbreg = &rtl8192c_PHY_SetBBReg;
+	//pHalFunc->read_rfreg = &rtl8192c_PHY_QueryRFReg;
+	//pHalFunc->write_rfreg = &rtl8192c_PHY_SetRFReg;
+
+#ifdef CONFIG_HOSTAPD_MLME
+	pHalFunc->hostap_mgnt_xmit_entry = &rtl8192cu_hostap_mgnt_xmit_entry;
+#endif
+	pHalFunc->interface_ps_func = &rtl8192cu_ps_func;
+
+	rtl8192c_set_hal_ops(pHalFunc);
+_func_exit_;
+
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_ce.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_ce.c
new file mode 100644
index 000000000000..26148fcc5370
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_ce.c
@@ -0,0 +1,1205 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _HCI_OPS_OS_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <osdep_intf.h>
+
+#ifndef PLATFORM_OS_CE
+    #error "PLATFORM_OS_CE shall be set \n"
+#endif
+
+#ifndef CONFIG_USB_HCI
+	#error "CONFIG_USB_HCI shall be on!\n"
+#endif
+
+#include <usb_ops.h>
+#include <recv_osdep.h>
+
+#include <circ_buf.h>
+
+
+struct zero_bulkout_context
+{
+	void *pbuf;
+	void *purb;
+	void *pirp;
+	void *padapter;
+};
+
+
+
+#define PUSB_ERROR LPDWORD
+#define USBD_HALTED(Status) ((ULONG)(Status) >> 30 == 3)
+
+
+USB_PIPE ffaddr2pipehdl(struct dvobj_priv *pNdisCEDvice, u32 addr);
+
+
+static NTSTATUS usb_async_interrupt_in_complete( LPVOID Context );
+static NTSTATUS usb_async_interrupt_out_complete( LPVOID Context );
+
+DWORD usb_write_port_complete( LPVOID Context );
+DWORD usb_read_port_complete( LPVOID Context );
+
+void usb_read_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem)
+{
+_func_enter_;
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+_func_exit_;
+}
+
+
+
+BOOL
+CloseTransferHandle(
+    LPCUSB_FUNCS   pUsbFuncs,
+    USB_TRANSFER   hTransfer
+    )
+{
+    BOOL bRc = TRUE;
+
+    // This assert may fail on suprise remove,
+    // but should pass during normal I/O.
+    // ASSERT( pUsbFuncs->lpIsTransferComplete(hTransfer) );
+
+    // CloseTransfer aborts any pending transfers
+    if ( !pUsbFuncs->lpCloseTransfer(hTransfer) ) {
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("*** CloseTransfer ERROR:%d ***\n", GetLastError()));
+        bRc = FALSE;
+    }
+
+    return bRc;
+}
+
+
+BOOL
+GetTransferStatus(
+    LPCUSB_FUNCS   pUsbFuncs,
+    USB_TRANSFER   hTransfer,
+    LPDWORD        pBytesTransferred , // OPTIONAL returns number of bytes transferred
+    PUSB_ERROR     pUsbError  	 // returns USB error code
+    )
+{
+
+    BOOL bRc = TRUE;
+
+    if ( pUsbFuncs->lpGetTransferStatus(hTransfer, pBytesTransferred, pUsbError) ) {
+        if ( USB_NO_ERROR != *pUsbError ) {
+		RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("*** CloseTransfer ERROR:%d ***\n", GetLastError()));
+            RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("GetTransferStatus (BytesTransferred:%d, UsbError:0x%x)\n", pBytesTransferred?*pBytesTransferred:-1, pUsbError?*pUsbError:-1 ));
+        }
+    } else {
+        RT_TRACE( _module_hci_ops_os_c_, _drv_err_,("*** GetTransferStatus ERROR:%d ***\n", GetLastError()));
+        *pUsbError = USB_CANCELED_ERROR;
+        bRc = FALSE;
+    }
+
+    return bRc;
+}
+
+
+// The driver should never read RxCmd register. We have to set
+// RCR CMDHAT0 (bit6) to append Rx status before the Rx frame.
+//
+// |<--------  pBulkUrb->TransferBufferLength  ------------>|
+// +------------------+-------------------+------------+
+//  | Rx status (16 bytes)  | Rx frame .....             | CRC(4 bytes) |
+// +------------------+-------------------+------------+
+// ^
+// ^pRfd->Buffer.VirtualAddress
+//
+/*! \brief USB RX IRP Complete Routine.
+	@param Context pointer of RT_RFD
+*/
+u32 usb_read_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem)
+{
+    struct intf_priv	*pintfpriv		= pintfhdl->pintfpriv;
+    struct dvobj_priv	*pdvobj_priv	= (struct dvobj_priv*)pintfpriv->intf_dev;
+    _adapter			*adapter		= (_adapter *)pdvobj_priv->padapter;
+
+	struct recv_priv	*precvpriv	= &adapter->recvpriv;
+
+	struct recv_buf		*precvbuf	= (struct recv_buf *)rmem;
+	DWORD dwErr = ERROR_SUCCESS ;
+	DWORD dwBytesTransferred = 0 ;
+	USB_TRANSFER hTransfer = NULL;
+	USB_PIPE	hPipe;
+	LPCUSB_FUNCS usb_funcs_vp = pdvobj_priv->usb_extension._lpUsbFuncs;
+
+_func_enter_;
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("usb_read_port(%u)\n", __LINE__));
+
+#if (CONFIG_PWRCTRL == 1)
+    if (adapter->pwrctrlpriv.pnp_bstop_trx)
+	{
+        return _FALSE;
+    }
+#endif
+
+	if(adapter->bDriverStopped || adapter->bSurpriseRemoved)
+	{
+		RT_TRACE(_module_hci_ops_os_c_, _drv_info_,("usb_read_port:( padapter->bDriverStopped ||padapter->bSurpriseRemoved)!!!\n"));
+		return _FALSE;
+	}
+
+	if(precvbuf !=NULL)
+	{
+
+		// get a recv buffer
+		rtl8192cu_init_recvbuf(adapter, precvbuf);
+
+
+
+		_rtw_spinlock(&precvpriv->lock);
+		precvpriv->rx_pending_cnt++;
+		precvbuf->irp_pending = _TRUE;
+		_rtw_spinunlock(&precvpriv->lock);
+
+
+		//translate DMA FIFO addr to pipehandle
+		hPipe = ffaddr2pipehdl(pdvobj_priv, addr);
+
+
+		RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("usb_read_port(%u)\n", __LINE__));
+
+		precvbuf->usb_transfer_read_port = (*usb_funcs_vp->lpIssueBulkTransfer)(
+			hPipe,
+			usb_read_port_complete,
+			precvbuf,
+			USB_IN_TRANSFER|USB_SHORT_TRANSFER_OK,
+			MAX_RECVBUF_SZ,
+			precvbuf->pbuf,
+			0);
+
+
+		if(precvbuf->usb_transfer_read_port)
+		{
+
+		//	  GetTransferStatus(usb_funcs_vp, hTransfer, &dwBytesTransferred,&UsbRc);
+
+		//	  CloseTransferHandle(usb_funcs_vp, hTransfer);
+
+		}
+		else
+		{
+
+			dwErr = GetLastError();
+			//RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("usb_read_port ERROR : %d\n", dwErr));
+
+		}
+
+//	 	if (  USB_NO_ERROR != UsbRc && ERROR_SUCCESS == dwErr) {
+//	        dwErr = ERROR_GEN_FAILURE;
+//	    }
+
+
+		if ( ERROR_SUCCESS != dwErr ) {
+
+			SetLastError(dwErr);
+			RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("usb_read_port ERROR : %d\n", dwErr));
+		}
+
+		RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("-usb_read_port(%u)\n", __LINE__));
+
+	}
+	else // if(precvbuf !=NULL)
+	{
+
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port:precv_frame ==NULL\n"));
+	}
+
+	return _TRUE;
+
+}
+
+DWORD usb_read_port_complete( PVOID context )
+{
+	struct recv_buf 	*precvbuf	= (struct recv_buf *)context;
+	_adapter			*adapter	= (_adapter *)precvbuf->adapter;
+	struct recv_priv	*precvpriv	= &adapter->recvpriv;
+
+
+	struct intf_hdl		*pintfhdl = &adapter->pio_queue->intf;
+    struct intf_priv	*pintfpriv    = pintfhdl->pintfpriv;
+    struct dvobj_priv	*pdvobj_priv  = (struct dvobj_priv*)pintfpriv->intf_dev;
+
+
+	LPCUSB_FUNCS usb_funcs_vp = pdvobj_priv->usb_extension._lpUsbFuncs;
+
+    DWORD dwBytesTransferred    = 0;
+    DWORD dwErr                 = USB_CANCELED_ERROR;
+
+	uint isevt, *pbuf;
+	int fComplete =_FALSE;
+
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("usb_read_port_complete(%u)\n", __LINE__));
+
+_func_enter_;
+
+
+	_rtw_spinlock_ex(&precvpriv->lock);
+	precvbuf->irp_pending=_FALSE;
+	precvpriv->rx_pending_cnt --;
+	_rtw_spinunlock_ex(&precvpriv->lock);
+
+
+#if 1
+
+	(*usb_funcs_vp->lpGetTransferStatus)(precvbuf->usb_transfer_read_port, &dwBytesTransferred, &dwErr);
+	fComplete = (*usb_funcs_vp->lpIsTransferComplete)(precvbuf->usb_transfer_read_port);
+	if(fComplete!=_TRUE)
+	{
+		RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("usb_read_port_complete CloseTransfer before complete\n"));
+	}
+	(*usb_funcs_vp->lpCloseTransfer)(precvbuf->usb_transfer_read_port);
+
+
+#endif
+
+
+	if(USB_NO_ERROR != dwErr)
+		RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("usb_read_port_complete Fail :%d\n",dwErr));
+
+	{
+
+		if ( dwBytesTransferred > MAX_RECVBUF_SZ || dwBytesTransferred < RXDESC_SIZE )
+		{
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,
+				("\n usb_read_port_complete: (pbulkurb->TransferBufferLength > MAX_RECVBUF_SZ) || (pbulkurb->TransferBufferLength < RXDESC_SIZE): %d\n",dwBytesTransferred));
+			rtw_read_port(adapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+
+	    //usb_read_port(pintfhdl, 0, 0, (unsigned char *)precvframe);
+	}
+		else
+		{
+			precvbuf->transfer_len = dwBytesTransferred;
+
+			pbuf = (uint*)precvbuf->pbuf;
+
+			if((isevt = *(pbuf+1)&0x1ff) == 0x1ff)
+			{
+				RT_TRACE(_module_hci_ops_os_c_,_drv_info_,
+					("\n usb_read_port_complete: get a event\n"));
+				rxcmd_event_hdl(adapter, pbuf);//rx c2h events
+
+				rtw_read_port(adapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+			}
+			else
+			{
+				if(recvbuf2recvframe(adapter, precvbuf)==_FAIL)//rx packets
+				{
+					//precvbuf->reuse = _TRUE;
+					rtw_read_port(adapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+				}
+			}
+	    }
+	}
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("-usb_read_port_complete(%u)\n", __LINE__));
+
+_func_exit_;
+	return ERROR_SUCCESS;
+//	return STATUS_MORE_PROCESSING_REQUIRED;
+}
+
+void usb_read_port_cancel(_adapter *padapter){
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("usb_read_port_cancel(%u)\n",__FUNCTION__, __LINE__));
+}
+
+DWORD usb_write_mem_complete( LPVOID Context )
+{
+	int fComplete =_FALSE;
+	DWORD	dwBytes 	= 0;
+	DWORD	dwErr		= USB_CANCELED_ERROR;
+
+	_irqL irqL;
+	_list	*head;
+	_list *plist;
+	struct io_req	*pio_req;
+	struct io_queue *pio_q = (struct io_queue *) Context;
+	struct intf_hdl *pintf = &(pio_q->intf);
+	struct intf_priv *pintfpriv = pintf->pintfpriv;
+	_adapter *padapter = (_adapter *)pintf->adapter;
+	NTSTATUS status = STATUS_SUCCESS;
+    struct xmit_priv * pxmitpriv	= &padapter->xmitpriv;
+
+	struct dvobj_priv * pdvobj_priv	= (struct dvobj_priv*)pintfpriv->intf_dev;
+
+    USB_HANDLE		usbHandle		= pdvobj_priv->usb_extension._hDevice;
+    LPCUSB_FUNCS	usb_funcs_vp	= pdvobj_priv->usb_extension._lpUsbFuncs;
+
+	// get the head from the processing io_queue
+	head = &(pio_q->processing);
+
+_func_enter_;
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("+usb_write_mem_complete %p\n", Context));
+
+#if 1
+	_enter_critical_bh(&(pio_q->lock), &irqL);
+
+
+	//free irp in processing list...
+	while(rtw_is_list_empty(head) != _TRUE)
+	{
+		plist = get_next(head);
+		rtw_list_delete(plist);
+		pio_req = LIST_CONTAINOR(plist, struct io_req, list);
+		_rtw_up_sema(&pio_req->sema);
+	}
+
+	_exit_critical_bh(&(pio_q->lock), &irqL);
+#endif
+
+
+#if 1
+
+	(*usb_funcs_vp->lpGetTransferStatus)(pio_req->usb_transfer_write_mem , &dwBytes, &dwErr);
+	fComplete = (*usb_funcs_vp->lpIsTransferComplete)(pio_req->usb_transfer_write_mem);
+	if(fComplete!=_TRUE)
+	{
+		RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("usb_write_mem_complete CloseTransfer before complete\n"));
+	}
+	(*usb_funcs_vp->lpCloseTransfer)(pio_req->usb_transfer_write_mem );
+
+#endif
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("-usb_write_mem_complete\n"));
+
+_func_exit_;
+
+
+	return STATUS_MORE_PROCESSING_REQUIRED;
+
+}
+
+
+void usb_write_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem)
+{
+
+	NTSTATUS NtStatus = STATUS_SUCCESS;
+    USB_PIPE	hPipe;
+	_irqL	irqL;
+
+	int 	fComplete	= _FALSE;
+	DWORD	dwBytes 	= 0;
+	DWORD	dwErr		= USB_CANCELED_ERROR;
+
+
+	struct io_req 		*pio_req;
+
+	_adapter 			*adapter 	= (_adapter *)pintfhdl->adapter;
+	struct intf_priv 	*pintfpriv	= pintfhdl->pintfpriv;
+	struct dvobj_priv   * pdvobj_priv   = (struct dvobj_priv*)pintfpriv->intf_dev;
+
+
+    struct xmit_priv	*pxmitpriv	= &adapter->xmitpriv;
+	struct io_queue 	*pio_queue 	= (struct io_queue *)adapter->pio_queue;
+
+	LPCUSB_FUNCS usb_funcs_vp = pdvobj_priv->usb_extension._lpUsbFuncs;
+
+
+_func_enter_;
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("usb_write_mem(%u) pintfhdl %p wmem %p\n", __LINE__, pintfhdl, wmem));
+
+	// fetch a io_request from the io_queue
+	pio_req = alloc_ioreq(pio_queue);
+
+	if ((pio_req == NULL)||(adapter->bSurpriseRemoved))
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("async_irp_write32 : pio_req =0x%x adapter->bSurpriseRemoved=0x%x",pio_req,adapter->bSurpriseRemoved ));
+		goto exit;
+	}
+
+	_enter_critical_bh(&(pio_queue->lock), &irqL);
+
+
+	// insert the io_request into processing io_queue
+	rtw_list_insert_tail(&(pio_req->list),&(pio_queue->processing));
+
+
+	if((adapter->bDriverStopped) || (adapter->bSurpriseRemoved) ||(adapter->pwrctrlpriv.pnp_bstop_trx))
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\npadapter->pwrctrlpriv.pnp_bstop_trx==_TRUE\n"));
+		goto exit;
+	}
+
+	//translate DMA FIFO addr to pipehandle
+	hPipe = ffaddr2pipehdl(pdvobj_priv, addr);
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_,("usb_write_mem(%u)\n",__LINE__));
+
+	pio_req->usb_transfer_write_mem = (*usb_funcs_vp->lpIssueBulkTransfer)(
+		hPipe,
+		usb_write_mem_complete,
+		pio_queue,
+		USB_OUT_TRANSFER,
+		cnt,
+		wmem,
+		0);
+
+#if 0
+
+	(*usb_funcs_vp->lpGetTransferStatus)(pio_req->usb_transfer_write_mem , &dwBytes, &dwErr);
+
+	while( fComplete != _TRUE)
+	{
+		fComplete = (*usb_funcs_vp->lpIsTransferComplete)(pio_req->usb_transfer_write_mem);
+		if(fComplete==_TRUE)
+		{
+			(*usb_funcs_vp->lpCloseTransfer)(pio_req->usb_transfer_write_mem );
+			RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("usb_write_mem finished\n"));
+			break;
+		}
+		else
+		{
+			RT_TRACE( _module_hci_ops_os_c_, _drv_err_,
+				("usb_write_mem not yet finished %X\n",
+				pio_req->usb_transfer_write_mem));
+			rtw_msleep_os(10);
+		}
+
+	}
+
+#endif
+
+
+//	_rtw_down_sema(&pio_req->sema);
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("-usb_write_mem(%X)\n",pio_req->usb_transfer_write_mem));
+
+	_exit_critical_bh(&(pio_queue->lock), &irqL);
+
+	_rtw_down_sema(&pio_req->sema);
+	free_ioreq(pio_req, pio_queue);
+
+exit:
+_func_exit_;
+	return;
+}
+
+u32 usb_write_cnt=0;
+u32 usb_complete_cnt=0;
+
+USB_PIPE ffaddr2pipehdl(struct dvobj_priv *pNdisCEDvice, u32 addr)
+{
+	USB_PIPE	PipeHandle = NULL;
+	_adapter	*padapter = pNdisCEDvice->padapter;
+
+
+	if(pNdisCEDvice->nr_endpoint == 11)
+	{
+		switch(addr)
+		{
+			case RTL8712_DMA_BEQ:
+				PipeHandle= padapter->halpriv.pipehdls_r8712[3] ;
+				break;
+			case RTL8712_DMA_BKQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[4];
+				break;
+			case RTL8712_DMA_VIQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[2];
+				break;
+			case RTL8712_DMA_VOQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[1];
+				break;
+                     case RTL8712_DMA_BCNQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[6];
+				break;
+			case RTL8712_DMA_BMCQ:	//HI Queue
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[7];
+				break;
+			case RTL8712_DMA_MGTQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[8];
+				break;
+                     case RTL8712_DMA_RX0FF:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[0];
+				break;
+			case RTL8712_DMA_C2HCMD:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[5];
+				break;
+			case RTL8712_DMA_H2CCMD:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[9];
+				break;
+
+		}
+
+	}
+	else if(pNdisCEDvice->nr_endpoint == 6)
+	{
+		switch(addr)
+		{
+			case RTL8712_DMA_BEQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[3];
+				break;
+		case RTL8712_DMA_BKQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[4];
+				break;
+		case RTL8712_DMA_VIQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[2];
+				break;
+		case RTL8712_DMA_VOQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[1];
+				break;
+			case RTL8712_DMA_RX0FF:
+			case RTL8712_DMA_C2HCMD:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[0];
+				break;
+			case RTL8712_DMA_H2CCMD:
+			case RTL8712_DMA_BCNQ:
+			case RTL8712_DMA_BMCQ:
+			case RTL8712_DMA_MGTQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[5];
+				break;
+
+		}
+
+	}
+	else if(pNdisCEDvice->nr_endpoint == 4)
+	{
+		switch(addr)
+		{
+		case RTL8712_DMA_BEQ:
+			case RTL8712_DMA_BKQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[2];
+				break;
+		case RTL8712_DMA_VIQ:
+			case RTL8712_DMA_VOQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[1];
+				break;
+			case RTL8712_DMA_RX0FF:
+			case RTL8712_DMA_C2HCMD:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[0];
+				break;
+			case RTL8712_DMA_H2CCMD:
+			case RTL8712_DMA_BCNQ:
+			case RTL8712_DMA_BMCQ:
+			case RTL8712_DMA_MGTQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[3];
+				break;
+		}
+
+	}
+	else
+	{
+	   RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("ffaddr2pipehdl():nr_endpoint=%d error!\n", pNdisCEDvice->nr_endpoint));
+	}
+
+	return PipeHandle;
+
+}
+
+DWORD usb_bulkout_zero_complete( LPVOID pZeroContext )
+{
+	struct zero_bulkout_context *pcontext = (struct zero_bulkout_context *)pZeroContext;
+	_adapter * padapter = pcontext->padapter;
+    struct dvobj_priv *	pdvobj_priv = (struct dvobj_priv *)&padapter->dvobjpriv;
+	LPCUSB_FUNCS usb_funcs_vp = pdvobj_priv->usb_extension._lpUsbFuncs;
+	struct xmit_priv  * pxmitpriv	= &padapter->xmitpriv;
+
+	int 	fComplete			=_FALSE;
+	DWORD	dwBytesTransferred	= 0;
+	DWORD	dwErr				= USB_CANCELED_ERROR;
+
+_func_enter_;
+
+#if 1
+
+	(*usb_funcs_vp->lpGetTransferStatus)(pxmitpriv->usb_transfer_write_port, &dwBytesTransferred, &dwErr);
+	fComplete = (*usb_funcs_vp->lpIsTransferComplete)(pxmitpriv->usb_transfer_write_port);
+	if(fComplete!=_TRUE)
+	{
+		RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("usb_bulkout_zero_complete CloseTransfer before complete\n"));
+	}
+	(*usb_funcs_vp->lpCloseTransfer)(pxmitpriv->usb_transfer_write_port);
+
+#endif
+
+	if(pcontext)
+	{
+		if(pcontext->pbuf)
+		{
+			rtw_mfree(pcontext->pbuf, sizeof(int));
+		}
+
+		rtw_mfree((u8*)pcontext, sizeof(struct zero_bulkout_context));
+	}
+
+_func_exit_;
+
+	return ERROR_SUCCESS;
+
+
+}
+
+u32 usb_bulkout_zero(struct intf_hdl *pintfhdl, u32 addr)
+{
+	struct zero_bulkout_context *pcontext;
+	unsigned char *pbuf;
+	u8 len = 0 ;
+	_adapter *padapter = (_adapter *)pintfhdl->adapter;
+	struct dvobj_priv	*pdvobj = (struct dvobj_priv *)&padapter->dvobjpriv;
+	struct xmit_priv	* pxmitpriv     = &padapter->xmitpriv;
+
+
+	LPCUSB_FUNCS usb_funcs_vp = pdvobj->usb_extension._lpUsbFuncs;
+
+	USB_PIPE	hPipe;
+
+_func_enter_;
+
+	if((padapter->bDriverStopped) || (padapter->bSurpriseRemoved) ||(padapter->pwrctrlpriv.pnp_bstop_trx))
+	{
+		return _FAIL;
+	}
+
+
+	pcontext = (struct zero_bulkout_context *)rtw_zmalloc(sizeof(struct zero_bulkout_context));
+
+	pbuf = (unsigned char *)rtw_zmalloc(sizeof(int));
+
+	len = 0;
+
+	pcontext->pbuf = pbuf;
+	pcontext->purb = NULL;
+	pcontext->pirp = NULL;
+	pcontext->padapter = padapter;
+
+
+//translate DMA FIFO addr to pipehandle
+	hPipe = ffaddr2pipehdl(pdvobj, addr);
+
+
+
+
+	pxmitpriv->usb_transfer_write_port = (*usb_funcs_vp->lpIssueBulkTransfer)(
+						        hPipe, usb_bulkout_zero_complete,
+						        pcontext, USB_OUT_TRANSFER,
+						    len, pbuf, 0);
+
+
+_func_exit_;
+
+	return _SUCCESS;
+
+}
+
+u32 usb_write_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem)
+{
+
+    u32	i, bwritezero = _FALSE;
+	u32	ac_tag = addr;
+
+    u8*	ptr;
+
+	struct intf_priv    * pintfpriv     = pintfhdl->pintfpriv;
+	struct dvobj_priv   * pdvobj_priv   = (struct dvobj_priv*)pintfpriv->intf_dev;
+	_adapter            * padapter      = pdvobj_priv->padapter;
+
+    struct xmit_priv	* pxmitpriv     = &padapter->xmitpriv;
+    struct xmit_frame   * pxmitframe    = (struct xmit_frame *)wmem;
+
+	LPCUSB_FUNCS usb_funcs_vp = pdvobj_priv->usb_extension._lpUsbFuncs;
+
+    USB_PIPE	hPipe;
+
+	u32			bResult = _FALSE;
+
+_func_enter_;
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("+usb_write_port\n"));
+
+#if (CONFIG_PWRCTRL == 1)
+    if(padapter->pwrctrlpriv.pnp_bstop_trx==_TRUE){
+	RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("\npadapter->pwrctrlpriv.pnp_bstop_trx==_TRUE\n"));
+
+    }
+#endif
+
+	if((padapter->bDriverStopped) || (padapter->bSurpriseRemoved) ||(padapter->pwrctrlpriv.pnp_bstop_trx))
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port:( padapter->bDriverStopped ||padapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx)!!!\n"));
+		bResult = _FALSE;
+		goto exit;
+	}
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("usb_write_port(%u)\n", __LINE__));
+
+	for(i=0; i<8; i++)
+	{
+		if(pxmitframe->bpending[i] == _FALSE)
+		{
+			_rtw_spinlock(&pxmitpriv->lock);
+			pxmitpriv->txirp_cnt++;
+			pxmitframe->bpending[i]  = _TRUE;
+			_rtw_spinunlock(&pxmitpriv->lock);
+
+			pxmitframe->sz[i] = cnt;
+			pxmitframe->ac_tag[i] = ac_tag;
+
+			break;
+		}
+	}
+
+
+	//TODO:
+	if (pdvobj_priv->ishighspeed)
+	{
+		if(cnt> 0 && cnt%512 == 0)
+		{
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("ishighspeed, cnt=%d\n", cnt));
+		//	cnt=cnt+1;
+			bwritezero = _TRUE;
+
+		}
+	}
+	else
+	{
+		if(cnt > 0 && cnt%64 == 0)
+		{
+			RT_TRACE(_module_hci_ops_os_c_,_drv_info_,("cnt=%d\n", cnt));
+		//	cnt=cnt+1;
+			bwritezero = _TRUE;
+
+		}
+	}
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("usb_write_port: pipe handle convert\n"));
+
+	//translate DMA FIFO addr to pipehandle
+	hPipe = ffaddr2pipehdl(pdvobj_priv, addr);
+
+
+#if 0
+	// for tx fifo, the maximum payload number is 8,
+	// we workaround this issue here by separate whole fifo into 8 segments.
+	if (cnt <= 500)
+		cnt = 500;
+#endif
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_,
+		("usb_write_port(%u): pxmitframe %X  pxmitframe->padapter %X\n",__LINE__, pxmitframe, pxmitframe->padapter));
+
+	pxmitpriv->usb_transfer_write_port = (*usb_funcs_vp->lpIssueBulkTransfer)(
+						        hPipe, usb_write_port_complete,
+						        pxmitframe, USB_OUT_TRANSFER,
+						    cnt, pxmitframe->mem_addr, 0);
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+
+	ptr=(u8 *)&pxmitframe->mem;
+
+#if 0
+	if (pdvobj_priv->ishighspeed)
+	{
+		ptr=ptr+512;
+	}
+	else
+	{
+		ptr=ptr+64;
+
+	}
+#endif
+	if(bwritezero == _TRUE)
+	{
+		usb_bulkout_zero(pintfhdl, addr);
+	}
+
+//	if (!pxmitframe->usb_transfer_xmit)
+//	    padapter->bSurpriseRemoved=_TRUE;
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+	bResult = _SUCCESS;
+
+exit:
+_func_exit_;
+	return bResult;
+}
+
+DWORD usb_write_port_complete( LPVOID Context )
+{
+
+//    u8 *ptr;
+
+    struct xmit_frame *	pxmitframe  = (struct xmit_frame *) Context;
+    _adapter          * padapter    = pxmitframe->padapter;
+    struct dvobj_priv *	pdvobj_priv = (struct dvobj_priv *)&padapter->dvobjpriv;
+	struct xmit_priv  * pxmitpriv   = &padapter->xmitpriv;
+	struct xmit_buf *pxmitbuf = pxmitframe->pxmitbuf;
+	LPCUSB_FUNCS usb_funcs_vp = pdvobj_priv->usb_extension._lpUsbFuncs;
+
+	int		fComplete			=_FALSE;
+	DWORD	dwBytesTransferred	= 0;
+	DWORD	dwErr				= USB_CANCELED_ERROR;
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u), pxmitframe %X\n",__FUNCTION__, __LINE__, Context));
+
+_func_enter_;
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_info_,("+usb_write_port_complete\n"));
+
+	_rtw_spinlock_ex(&pxmitpriv->lock);
+	pxmitpriv->txirp_cnt--;
+	_rtw_spinunlock_ex(&pxmitpriv->lock);
+
+	if(pxmitpriv->txirp_cnt==0){
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete: txirp_cnt== 0, set allrxreturnevt!\n"));
+		_rtw_up_sema(&(pxmitpriv->tx_retevt));
+	}
+
+
+	//not to consider tx fragment
+	rtw_free_xmitframe(pxmitpriv, pxmitframe);
+
+
+#if 1
+
+	(*usb_funcs_vp->lpGetTransferStatus)(pxmitpriv->usb_transfer_write_port, &dwBytesTransferred, &dwErr);
+	fComplete = (*usb_funcs_vp->lpIsTransferComplete)(pxmitpriv->usb_transfer_write_port);
+	if(fComplete!=_TRUE)
+	{
+		RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("usb_write_port_complete CloseTransfer before complete\n"));
+	}
+	(*usb_funcs_vp->lpCloseTransfer)(pxmitpriv->usb_transfer_write_port);
+
+#else
+
+	if((*usb_funcs_vp->lpIsTransferComplete)(pxmitpriv->usb_transfer_write_port))
+	{
+		(*usb_funcs_vp->lpCloseTransfer)(pxmitpriv->usb_transfer_write_port);
+	}
+
+#endif
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_,
+		("%s(%u): pxmitpriv %X pxmitpriv->free_xmitframe_cnt %X pxmitframe->padapter %X pxmitframe->padapter %X\n",
+		__LINE__, pxmitpriv, pxmitpriv->free_xmitframe_cnt, pxmitframe->padapter));
+
+    rtl8192cu_xmitframe_complete(padapter, pxmitpriv, pxmitbuf);
+
+_func_exit_;
+
+    return STATUS_SUCCESS;
+}
+
+DWORD usb_write_scsi_complete(LPVOID pTxContext)
+{
+#ifndef PLATFORM_OS_CE
+	struct SCSI_BUFFER_ENTRY *psb_entry = (struct SCSI_BUFFER_ENTRY *)pTxContext;
+	_adapter 				 *padapter 	= psb_entry->padapter;
+	struct SCSI_BUFFER 		 *psb 		= padapter->pscsi_buf;
+	struct xmit_priv 		 *pxmitpriv = &(padapter->xmitpriv);
+    struct dvobj_priv 		*pdvobj_priv = (struct dvobj_priv *)&padapter->dvobjpriv;
+	LPCUSB_FUNCS 		  	 lpUsbFuncs = pdvobj_priv->pUsbExtension->_lpUsbFuncs;
+
+	int 	fComplete			=_FALSE;
+	DWORD	dwBytesTransferred	= 0;
+	DWORD	dwErr				= USB_CANCELED_ERROR;
+
+_func_enter_;
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u): circ_space = %d\n",__FUNCTION__, __LINE__, CIRC_SPACE( psb->head,psb->tail,  SCSI_BUFFER_NUMBER)));
+
+#if 1
+
+	(*lpUsbFuncs->lpGetTransferStatus)(psb_entry->usb_transfer_scsi_txcmd, &dwBytesTransferred, &dwErr);
+	fComplete = (*lpUsbFuncs->lpIsTransferComplete)(psb_entry->usb_transfer_scsi_txcmd);
+	if(fComplete!=_TRUE)
+	{
+		RT_TRACE( _module_hci_ops_os_c_, _drv_err_, ("usb_write_scsi_complete CloseTransfer before complete\n"));
+	}
+	(*lpUsbFuncs->lpCloseTransfer)(psb_entry->usb_transfer_scsi_txcmd);
+
+#else
+
+	if((*lpUsbFuncs->lpIsTransferComplete)(psb_entry->usb_transfer_scsi_txcmd))
+		(*lpUsbFuncs->lpCloseTransfer)(psb_entry->usb_transfer_scsi_txcmd);
+#endif
+
+	memset(psb_entry->entry_memory, 0, 8);
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+	if((psb->tail+1)==SCSI_BUFFER_NUMBER)
+		psb->tail=0;
+	else
+		psb->tail++;
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+	if(CIRC_CNT(psb->head,psb->tail,SCSI_BUFFER_NUMBER)==0){
+		RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("write_txcmd_scsififo_callback: up_sema\n"));
+		_rtw_up_sema(&pxmitpriv->xmit_sema);
+	}
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+	if(padapter->bSurpriseRemoved) {
+		return STATUS_MORE_PROCESSING_REQUIRED;
+	}
+
+_func_exit_;
+#endif
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+	return STATUS_MORE_PROCESSING_REQUIRED;
+}
+
+uint usb_write_scsi(struct intf_hdl *pintfhdl, u32 cnt, u8 *wmem)
+{
+
+#ifndef PLATFORM_OS_CE
+
+	_adapter 		  *padapter = (_adapter *)pintfhdl->adapter;
+	struct dvobj_priv *pdev 	= (struct dvobj_priv*)&padapter->dvobjpriv;
+
+	struct SCSI_BUFFER       *psb      =padapter->pscsi_buf;
+	struct SCSI_BUFFER_ENTRY *psb_entry=LIST_CONTAINOR(wmem,struct SCSI_BUFFER_ENTRY,entry_memory);
+
+_func_enter_;
+	if(padapter->bSurpriseRemoved||padapter->bDriverStopped)
+		return 0;
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+	psb_entry->usb_transfer_scsi_txcmd=pdev->pUsbExtension->_lpUsbFuncs->lpIssueBulkTransfer(
+			pdev->scsi_out_pipehandle,
+			usb_write_scsi_complete,
+			psb_entry,
+			USB_OUT_TRANSFER,
+			cnt,
+			wmem,
+			0);
+
+_func_exit_;
+#endif
+
+   return _SUCCESS;
+}
+
+
+/*
+ */
+uint usb_init_intf_priv(struct intf_priv *pintfpriv)
+{
+	// get the dvobj_priv object
+	struct dvobj_priv * pNdisCEDvice = (struct dvobj_priv *) pintfpriv->intf_dev;
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+	// set init intf_priv init status as _IOREADY
+	pintfpriv->intf_status = _IOREADY;
+
+	//  determine the max io size by dvobj_priv.ishighspeed
+	if(pNdisCEDvice->ishighspeed)
+		pintfpriv->max_iosz =  128;
+	else
+		pintfpriv->max_iosz =  64;
+
+	//  read/write size set as 0
+	pintfpriv->io_wsz = 0;
+	pintfpriv->io_rsz = 0;
+
+	//  init io_rwmem buffer
+	pintfpriv->allocated_io_rwmem = rtw_zmalloc(pintfpriv->max_iosz +4);
+	if (pintfpriv->allocated_io_rwmem == NULL)
+	{
+		rtw_mfree((u8 *)(pintfpriv->allocated_io_rwmem), pintfpriv->max_iosz +4);
+		return _FAIL;
+	}
+	else
+	{
+		// word align the io_rwmem
+		pintfpriv->io_rwmem = pintfpriv->allocated_io_rwmem + 4 - ( (u32)(pintfpriv->allocated_io_rwmem) & 3);
+	}
+
+#ifndef PLATFORM_OS_CE
+
+	//  init io_r_mem buffer
+	pintfpriv->allocated_io_r_mem = rtw_zmalloc(pintfpriv->max_iosz +4);
+	if (pintfpriv->allocated_io_r_mem == NULL)
+	{
+		rtw_mfree((u8 *)(pintfpriv->allocated_io_r_mem), pintfpriv->max_iosz +4);
+		return _FAIL;
+	}
+	else
+	{
+		// word align the io_rwmem
+		pintfpriv->io_r_mem = pintfpriv->allocated_io_r_mem + 4 - ( (u32)(pintfpriv->allocated_io_r_mem) & 3);
+	}
+#endif
+
+	return _SUCCESS;
+}
+
+void usb_unload_intf_priv(struct intf_priv *pintfpriv)
+{
+#ifndef PLATFORM_OS_CE
+
+	rtw_mfree((u8 *)(pintfpriv->allocated_io_rwmem), pintfpriv->max_iosz+4);
+	rtw_mfree((u8 *)(pintfpriv->allocated_io_r_mem), pintfpriv->max_iosz+4);
+#endif
+
+	RT_TRACE( _module_hci_ops_os_c_, _drv_info_, ("%s(%u)\n",__FUNCTION__, __LINE__));
+}
+
+
+
+void usb_write_port_cancel(_adapter *padapter)
+{
+
+	sint i,j;
+	struct dvobj_priv   *pdev = &padapter->dvobjpriv;
+	struct xmit_priv *pxmitpriv=&padapter->xmitpriv;
+	struct xmit_frame *pxmitframe;
+
+	_rtw_spinlock(&pxmitpriv->lock);
+	pxmitpriv->txirp_cnt--; //decrease 1 for Initialize ++
+	_rtw_spinunlock(&pxmitpriv->lock);
+
+	if (pxmitpriv->txirp_cnt)
+	{
+		// Canceling Pending Recv Irp
+		pxmitframe= (struct xmit_frame *)pxmitpriv->pxmit_frame_buf;
+
+		for( i = 0; i < NR_XMITFRAME; i++ )
+		{
+			for(j=0;j<8;j++)
+			{
+				if (pxmitframe->bpending[j]==_TRUE)
+				{
+
+					RT_TRACE(_module_hci_ops_os_c_,_drv_err_,(" usb_write_port_cancel() :IoCancelIrp\n"));
+
+				}
+			}
+
+			pxmitframe++;
+		}
+
+		_rtw_down_sema(&(pxmitpriv->tx_retevt));
+
+	}
+
+}
+
+DWORD usbctrl_vendorreq_complete(LPVOID lpvNotifyParameter)
+{
+	struct dvobj_priv  *pdvobjpriv = (struct dvobj_priv*)lpvNotifyParameter;
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_debug_,("+usbctrl_vendorreq_complete\n"));
+
+    return STATUS_SUCCESS;
+}
+
+
+int usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value, u16 index, void *pdata, u16 len, u8 requesttype)
+{
+	u8			ret=_TRUE;
+//	NTSTATUS	ntstatus;
+//	int 		fComplete;
+//	LPCUSB_DEVICE		lpDeviceInfo;
+
+	struct dvobj_priv  *pdvobjpriv = (struct dvobj_priv  *)pintfpriv->intf_dev;
+
+    USB_TRANSFER        usbTrans;
+    USB_DEVICE_REQUEST  usb_device_req;
+    USB_HANDLE      usbHandle   = pdvobjpriv->usb_extension._hDevice;
+    LPCUSB_FUNCS    usbFuncs    = pdvobjpriv->usb_extension._lpUsbFuncs;
+
+	u32	transfer_flags = 0;
+
+	_func_enter_;
+
+    memset( &usb_device_req, 0, sizeof( USB_DEVICE_REQUEST ) );
+
+    if( 0x01 == requesttype )
+	{
+        usb_device_req.bmRequestType = USB_REQUEST_DEVICE_TO_HOST | USB_REQUEST_VENDOR | USB_REQUEST_FOR_DEVICE;
+    }
+	else
+    {
+        usb_device_req.bmRequestType = USB_REQUEST_HOST_TO_DEVICE | USB_REQUEST_VENDOR | USB_REQUEST_FOR_DEVICE;
+    }
+
+	usb_device_req.bRequest 		= request;
+	usb_device_req.wValue 			= value;
+	usb_device_req.wIndex 	    	= index;
+	usb_device_req.wLength 	    	= len;
+
+	if (requesttype == 0x01)
+	{
+		transfer_flags = USB_IN_TRANSFER;//read_in
+	}
+	else
+	{
+		transfer_flags= USB_OUT_TRANSFER;//write_out
+	}
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_debug_,("+usbctrl_vendorreq\n",__FUNCTION__,__LINE__));
+
+#if 0
+	// Remember to add callback for sync
+	usbTrans = (*usbFuncs->lpIssueVendorTransfer)(usbHandle,
+							usbctrl_vendorreq_complete, pdvobjpriv,
+							transfer_flags, &usb_device_req, pdata, 0);
+#else
+	// Remember to add callback for sync
+	usbTrans = (*usbFuncs->lpIssueVendorTransfer)(usbHandle,
+							NULL, 0,
+							transfer_flags, &usb_device_req, pdata, 0);
+#endif
+
+//	rtw_usleep_os(10);
+
+	if ( usbTrans )
+	{
+		DWORD	dwBytes 	= 0;
+		DWORD	dwErr		= USB_CANCELED_ERROR;
+		int 	fComplete;
+
+		(*usbFuncs->lpGetTransferStatus)(usbTrans, &dwBytes, &dwErr);
+
+		fComplete = (*usbFuncs->lpIsTransferComplete)(usbTrans);
+
+		if (fComplete== _TRUE)
+		{
+			(*usbFuncs->lpCloseTransfer)(usbTrans);
+			RT_TRACE(_module_hci_ops_os_c_,_drv_debug_,("usbctrl_vendorreq lpCloseTransfer\n"));
+		}
+
+		if ( dwErr != USB_NO_ERROR || fComplete != _TRUE)
+		{
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usbctrl_vendorreq lpCloseTransfer without complete\n"));
+			ret = _FALSE;
+			goto exit;
+		}
+	}
+	else
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usbctrl_vendorreq without usbTrans\n"));
+		ret = _FALSE;
+		goto exit;
+
+	}
+
+exit:
+	RT_TRACE(_module_hci_ops_os_c_,_drv_debug_,("-usbctrl_vendorreq\n"));
+_func_exit_;
+
+	return ret;
+
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_linux.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_linux.c
new file mode 100644
index 000000000000..7167c2679955
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_linux.c
@@ -0,0 +1,1535 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _HCI_OPS_OS_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <osdep_intf.h>
+#include <usb_ops.h>
+#include <circ_buf.h>
+#include <recv_osdep.h>
+#include <rtl8192c_hal.h>
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+
+#error "Shall be Linux or Windows, but not both!\n"
+
+#endif
+
+static int usbctrl_vendorreq(struct intf_hdl *pintfhdl, u8 request, u16 value, u16 index, void *pdata, u16 len, u8 requesttype)
+{
+	_adapter *padapter = pintfhdl->padapter;
+	struct dvobj_priv  *pdvobjpriv = adapter_to_dvobj(padapter);
+	struct usb_device *udev = pdvobjpriv->pusbdev;
+
+	unsigned int pipe;
+	int status = 0;
+	u32 tmp_buflen=0;
+	u8 reqtype;
+	u8 *pIo_buf;
+	int vendorreq_times = 0;
+
+	#ifdef CONFIG_USB_VENDOR_REQ_BUFFER_DYNAMIC_ALLOCATE
+	u8 *tmp_buf;
+	#else // use stack memory
+	u8 tmp_buf[MAX_USB_IO_CTL_SIZE];
+	#endif
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->adapter_type > PRIMARY_ADAPTER)
+	{
+		padapter = padapter->pbuddy_adapter;
+		pdvobjpriv = adapter_to_dvobj(padapter);
+		udev = pdvobjpriv->pusbdev;
+	}
+#endif
+
+
+	//DBG_871X("%s %s:%d\n",__FUNCTION__, current->comm, current->pid);
+
+	if((padapter->bSurpriseRemoved) ||(padapter->pwrctrlpriv.pnp_bstop_trx)){
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usbctrl_vendorreq:(padapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx)!!!\n"));
+		status = -EPERM;
+		goto exit;
+	}
+
+	if(len>MAX_VENDOR_REQ_CMD_SIZE){
+		DBG_8192C( "[%s] Buffer len error ,vendor request failed\n", __FUNCTION__ );
+		status = -EINVAL;
+		goto exit;
+	}
+
+	#ifdef CONFIG_USB_VENDOR_REQ_MUTEX
+	_enter_critical_mutex(&pdvobjpriv->usb_vendor_req_mutex, NULL);
+	#endif
+
+
+	// Acquire IO memory for vendorreq
+#ifdef CONFIG_USB_VENDOR_REQ_BUFFER_PREALLOC
+	pIo_buf = pdvobjpriv->usb_vendor_req_buf;
+#else
+	#ifdef CONFIG_USB_VENDOR_REQ_BUFFER_DYNAMIC_ALLOCATE
+	tmp_buf = rtw_malloc( (u32) len + ALIGNMENT_UNIT);
+	tmp_buflen =  (u32)len + ALIGNMENT_UNIT;
+	#else // use stack memory
+	tmp_buflen = MAX_USB_IO_CTL_SIZE;
+	#endif
+
+	// Added by Albert 2010/02/09
+	// For mstar platform, mstar suggests the address for USB IO should be 16 bytes alignment.
+	// Trying to fix it here.
+	pIo_buf = (tmp_buf==NULL)?NULL:tmp_buf + ALIGNMENT_UNIT -((SIZE_PTR)(tmp_buf) & 0x0f );
+#endif
+
+	if ( pIo_buf== NULL) {
+		DBG_8192C( "[%s] pIo_buf == NULL \n", __FUNCTION__ );
+		status = -ENOMEM;
+		goto release_mutex;
+	}
+
+	while(++vendorreq_times<= MAX_USBCTRL_VENDORREQ_TIMES)
+	{
+		_rtw_memset(pIo_buf, 0, len);
+
+		if (requesttype == 0x01)
+		{
+			pipe = usb_rcvctrlpipe(udev, 0);//read_in
+			reqtype =  REALTEK_USB_VENQT_READ;
+		}
+		else
+		{
+			pipe = usb_sndctrlpipe(udev, 0);//write_out
+			reqtype =  REALTEK_USB_VENQT_WRITE;
+			_rtw_memcpy( pIo_buf, pdata, len);
+		}
+
+		#if 0
+		//timeout test for firmware downloading
+		status = rtw_usb_control_msg(udev, pipe, request, reqtype, value, index, pIo_buf, len
+			, ((value >= FW_8192C_START_ADDRESS && value <= FW_8192C_END_ADDRESS) ||value!=0x1000) ?RTW_USB_CONTROL_MSG_TIMEOUT : RTW_USB_CONTROL_MSG_TIMEOUT_TEST
+		);
+		#else
+		status = rtw_usb_control_msg(udev, pipe, request, reqtype, value, index, pIo_buf, len, RTW_USB_CONTROL_MSG_TIMEOUT);
+		#endif
+
+		if ( status == len)   // Success this control transfer.
+		{
+			rtw_reset_continual_urb_error(pdvobjpriv);
+			if ( requesttype == 0x01 )
+			{   // For Control read transfer, we have to copy the read data from pIo_buf to pdata.
+				_rtw_memcpy( pdata, pIo_buf,  len );
+			}
+		}
+		else { // error cases
+			DBG_8192C("reg 0x%x, usb %s %u fail, status:%d value=0x%x, vendorreq_times:%d\n"
+				, value,(requesttype == 0x01)?"read":"write" , len, status, *(u32*)pdata, vendorreq_times);
+
+			if (status < 0) {
+				if(status == (-ESHUTDOWN)	|| status == -ENODEV	)
+				{
+					padapter->bSurpriseRemoved = _TRUE;
+				} else {
+					#ifdef DBG_CONFIG_ERROR_DETECT
+					{
+						HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+						pHalData->srestpriv.Wifi_Error_Status = USB_VEN_REQ_CMD_FAIL;
+					}
+					#endif
+				}
+			}
+			else // status != len && status >= 0
+			{
+				if(status > 0) {
+					if ( requesttype == 0x01 )
+					{   // For Control read transfer, we have to copy the read data from pIo_buf to pdata.
+						_rtw_memcpy( pdata, pIo_buf,  len );
+					}
+				}
+			}
+
+			if(rtw_inc_and_chk_continual_urb_error(pdvobjpriv) == _TRUE ){
+				padapter->bSurpriseRemoved = _TRUE;
+				break;
+			}
+
+		}
+
+		// firmware download is checksumed, don't retry
+		if( (value >= FW_8192C_START_ADDRESS && value <= FW_8192C_END_ADDRESS) || status == len )
+			break;
+
+	}
+
+	// release IO memory used by vendorreq
+	#ifdef CONFIG_USB_VENDOR_REQ_BUFFER_DYNAMIC_ALLOCATE
+	rtw_mfree(tmp_buf, tmp_buflen);
+	#endif
+
+release_mutex:
+	#ifdef CONFIG_USB_VENDOR_REQ_MUTEX
+	_exit_critical_mutex(&pdvobjpriv->usb_vendor_req_mutex, NULL);
+	#endif
+exit:
+	return status;
+
+}
+
+static u8 usb_read8(struct intf_hdl *pintfhdl, u32 addr)
+{
+	u8 request;
+	u8 requesttype;
+	u16 wvalue;
+	u16 index;
+	u16 len;
+	u32 data=0;
+
+	_func_enter_;
+
+	request = 0x05;
+	requesttype = 0x01;//read_in
+	index = 0;//n/a
+
+	wvalue = (u16)(addr&0x0000ffff);
+	len = 1;
+
+	usbctrl_vendorreq(pintfhdl, request, wvalue, index, &data, len, requesttype);
+
+	_func_exit_;
+
+	return (u8)(le32_to_cpu(data)&0x0ff);
+
+}
+
+static u16 usb_read16(struct intf_hdl *pintfhdl, u32 addr)
+{
+	u8 request;
+	u8 requesttype;
+	u16 wvalue;
+	u16 index;
+	u16 len;
+	u32 data=0;
+
+	_func_enter_;
+
+	request = 0x05;
+	requesttype = 0x01;//read_in
+	index = 0;//n/a
+
+	wvalue = (u16)(addr&0x0000ffff);
+	len = 2;
+
+	usbctrl_vendorreq(pintfhdl, request, wvalue, index, &data, len, requesttype);
+
+	_func_exit_;
+
+	return (u16)(le32_to_cpu(data)&0xffff);
+
+}
+
+static u32 usb_read32(struct intf_hdl *pintfhdl, u32 addr)
+{
+	u8 request;
+	u8 requesttype;
+	u16 wvalue;
+	u16 index;
+	u16 len;
+	u32 data=0;
+
+	_func_enter_;
+
+	request = 0x05;
+	requesttype = 0x01;//read_in
+	index = 0;//n/a
+
+	wvalue = (u16)(addr&0x0000ffff);
+	len = 4;
+
+	usbctrl_vendorreq(pintfhdl, request, wvalue, index, &data, len, requesttype);
+
+	_func_exit_;
+
+	return le32_to_cpu(data);
+
+}
+
+static int usb_write8(struct intf_hdl *pintfhdl, u32 addr, u8 val)
+{
+	u8 request;
+	u8 requesttype;
+	u16 wvalue;
+	u16 index;
+	u16 len;
+	u32 data;
+	int ret;
+
+	_func_enter_;
+
+	request = 0x05;
+	requesttype = 0x00;//write_out
+	index = 0;//n/a
+
+	wvalue = (u16)(addr&0x0000ffff);
+	len = 1;
+
+	data = val;
+	data = cpu_to_le32(data&0x000000ff);
+
+	ret = usbctrl_vendorreq(pintfhdl, request, wvalue, index, &data, len, requesttype);
+
+	_func_exit_;
+
+	return ret;
+
+}
+
+static int usb_write16(struct intf_hdl *pintfhdl, u32 addr, u16 val)
+{
+	u8 request;
+	u8 requesttype;
+	u16 wvalue;
+	u16 index;
+	u16 len;
+	u32 data;
+	int ret;
+
+	_func_enter_;
+
+	request = 0x05;
+	requesttype = 0x00;//write_out
+	index = 0;//n/a
+
+	wvalue = (u16)(addr&0x0000ffff);
+	len = 2;
+
+	data = val;
+	data = cpu_to_le32(data&0x0000ffff);
+
+	ret = usbctrl_vendorreq(pintfhdl, request, wvalue, index, &data, len, requesttype);
+
+	_func_exit_;
+
+	return ret;
+
+}
+
+static int usb_write32(struct intf_hdl *pintfhdl, u32 addr, u32 val)
+{
+	u8 request;
+	u8 requesttype;
+	u16 wvalue;
+	u16 index;
+	u16 len;
+	u32 data;
+	int ret;
+
+	_func_enter_;
+
+	request = 0x05;
+	requesttype = 0x00;//write_out
+	index = 0;//n/a
+
+	wvalue = (u16)(addr&0x0000ffff);
+	len = 4;
+	data = cpu_to_le32(val);
+
+
+	ret =usbctrl_vendorreq(pintfhdl, request, wvalue, index, &data, len, requesttype);
+
+	_func_exit_;
+
+	return ret;
+
+}
+
+static int usb_writeN(struct intf_hdl *pintfhdl, u32 addr, u32 length, u8 *pdata)
+{
+	u8 request;
+	u8 requesttype;
+	u16 wvalue;
+	u16 index;
+	u16 len;
+	u8 buf[VENDOR_CMD_MAX_DATA_LEN]={0};
+	int ret;
+
+	_func_enter_;
+
+	request = 0x05;
+	requesttype = 0x00;//write_out
+	index = 0;//n/a
+
+	wvalue = (u16)(addr&0x0000ffff);
+	len = length;
+	 _rtw_memcpy(buf, pdata, len );
+
+	ret = usbctrl_vendorreq(pintfhdl, request, wvalue, index, buf, len, requesttype);
+
+	_func_exit_;
+
+	return ret;
+
+}
+
+#ifdef CONFIG_USB_INTERRUPT_IN_PIPE
+static void usb_read_interrupt_complete(struct urb *purb, struct pt_regs *regs)
+{
+	int	err;
+	_adapter		*padapter = (_adapter	 *)purb->context;
+
+	if(purb->status==0)//SUCCESS
+	{
+		if (purb->actual_length > sizeof(INTERRUPT_MSG_FORMAT_EX))
+		{
+			DBG_8192C("usb_read_interrupt_complete: purb->actual_length > sizeof(INTERRUPT_MSG_FORMAT_EX) \n");
+		}
+
+		err = usb_submit_urb(purb, GFP_ATOMIC);
+		if((err) && (err != (-EPERM)))
+		{
+			DBG_8192C("cannot submit interrupt in-token(err = 0x%08x),urb_status = %d\n",err, purb->status);
+		}
+	}
+	else
+	{
+		DBG_8192C("###=> usb_read_interrupt_complete => urb status(%d)\n", purb->status);
+
+		switch(purb->status) {
+			case -EINVAL:
+			case -EPIPE:
+			case -ENODEV:
+			case -ESHUTDOWN:
+				//padapter->bSurpriseRemoved=_TRUE;
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete:bSurpriseRemoved=TRUE\n"));
+			case -ENOENT:
+				padapter->bDriverStopped=_TRUE;
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete:bDriverStopped=TRUE\n"));
+				break;
+			case -EPROTO:
+				break;
+			case -EINPROGRESS:
+				DBG_8192C("ERROR: URB IS IN PROGRESS!/n");
+				break;
+			default:
+				break;
+		}
+	}
+
+}
+
+static u32 usb_read_interrupt(struct intf_hdl *pintfhdl, u32 addr)
+{
+	int	err;
+	unsigned int pipe;
+	u32	ret = _SUCCESS;
+	_adapter			*adapter = pintfhdl->padapter;
+	struct dvobj_priv	*pdvobj = adapter_to_dvobj(adapter);
+	struct recv_priv	*precvpriv = &adapter->recvpriv;
+	struct usb_device	*pusbd = pdvobj->pusbdev;
+
+_func_enter_;
+
+	//translate DMA FIFO addr to pipehandle
+	pipe = ffaddr2pipehdl(pdvobj, addr);
+
+	usb_fill_int_urb(precvpriv->int_in_urb, pusbd, pipe,
+					precvpriv->int_in_buf,
+					sizeof(INTERRUPT_MSG_FORMAT_EX),
+					usb_read_interrupt_complete,
+					adapter,
+					1);
+
+	err = usb_submit_urb(precvpriv->int_in_urb, GFP_ATOMIC);
+	if((err) && (err != (-EPERM)))
+	{
+		DBG_8192C("cannot submit interrupt in-token(err = 0x%08x),urb_status = %d\n",err, precvpriv->int_in_urb->status);
+		ret = _FAIL;
+	}
+
+_func_exit_;
+
+	return ret;
+}
+#endif
+
+static s32 pre_recv_entry(union recv_frame *precvframe, struct recv_stat *prxstat, struct phy_stat *pphy_info)
+{
+	s32 ret=_SUCCESS;
+#ifdef CONFIG_CONCURRENT_MODE
+	u8 *primary_myid, *secondary_myid, *paddr1;
+	union recv_frame	*precvframe_if2 = NULL;
+	_adapter *primary_padapter = precvframe->u.hdr.adapter;
+	_adapter *secondary_padapter = primary_padapter->pbuddy_adapter;
+	struct recv_priv *precvpriv = &primary_padapter->recvpriv;
+	_queue *pfree_recv_queue = &precvpriv->free_recv_queue;
+	u8	*pbuf = precvframe->u.hdr.rx_data;
+
+	if(!secondary_padapter)
+		return ret;
+
+	paddr1 = GetAddr1Ptr(precvframe->u.hdr.rx_data);
+
+	if(IS_MCAST(paddr1) == _FALSE)//unicast packets
+	{
+		//primary_myid = myid(&primary_padapter->eeprompriv);
+		secondary_myid = myid(&secondary_padapter->eeprompriv);
+
+		if(_rtw_memcmp(paddr1, secondary_myid, ETH_ALEN))
+		{
+			//change to secondary interface
+			precvframe->u.hdr.adapter = secondary_padapter;
+		}
+
+		//ret = recv_entry(precvframe);
+
+	}
+	else // Handle BC/MC Packets
+	{
+
+		u8 clone = _TRUE;
+#if 0
+		u8 type, subtype, *paddr2, *paddr3;
+
+		type =  GetFrameType(pbuf);
+		subtype = GetFrameSubType(pbuf); //bit(7)~bit(2)
+
+		switch (type)
+		{
+			case WIFI_MGT_TYPE: //Handle BC/MC mgnt Packets
+				if(subtype == WIFI_BEACON)
+				{
+					paddr3 = GetAddr3Ptr(precvframe->u.hdr.rx_data);
+
+					if (check_fwstate(&secondary_padapter->mlmepriv, _FW_LINKED) &&
+						_rtw_memcmp(paddr3, get_bssid(&secondary_padapter->mlmepriv), ETH_ALEN))
+					{
+						//change to secondary interface
+						precvframe->u.hdr.adapter = secondary_padapter;
+						clone = _FALSE;
+					}
+
+					if(check_fwstate(&primary_padapter->mlmepriv, _FW_LINKED) &&
+						_rtw_memcmp(paddr3, get_bssid(&primary_padapter->mlmepriv), ETH_ALEN))
+					{
+						if(clone==_FALSE)
+						{
+							clone = _TRUE;
+						}
+						else
+						{
+							clone = _FALSE;
+						}
+
+						precvframe->u.hdr.adapter = primary_padapter;
+					}
+
+					if(check_fwstate(&primary_padapter->mlmepriv, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) ||
+						check_fwstate(&secondary_padapter->mlmepriv, _FW_UNDER_SURVEY|_FW_UNDER_LINKING))
+					{
+						clone = _TRUE;
+						precvframe->u.hdr.adapter = primary_padapter;
+					}
+
+				}
+				else if(subtype == WIFI_PROBEREQ)
+				{
+					//probe req frame is only for interface2
+					//change to secondary interface
+					precvframe->u.hdr.adapter = secondary_padapter;
+					clone = _FALSE;
+				}
+				break;
+			case WIFI_CTRL_TYPE: // Handle BC/MC ctrl Packets
+
+				break;
+			case WIFI_DATA_TYPE: //Handle BC/MC data Packets
+					//Notes: AP MODE never rx BC/MC data packets
+
+				paddr2 = GetAddr2Ptr(precvframe->u.hdr.rx_data);
+
+				if(_rtw_memcmp(paddr2, get_bssid(&secondary_padapter->mlmepriv), ETH_ALEN))
+				{
+					//change to secondary interface
+					precvframe->u.hdr.adapter = secondary_padapter;
+					clone = _FALSE;
+				}
+
+				break;
+			default:
+
+				break;
+		}
+#endif
+
+		if(_TRUE == clone)
+		{
+			//clone/copy to if2
+			u8 shift_sz = 0;
+			u32 alloc_sz, skb_len;
+			_pkt	 *pkt_copy = NULL;
+			struct rx_pkt_attrib *pattrib = NULL;
+
+			precvframe_if2 = rtw_alloc_recvframe(pfree_recv_queue);
+			if(precvframe_if2)
+			{
+				precvframe_if2->u.hdr.adapter = secondary_padapter;
+
+				_rtw_init_listhead(&precvframe_if2->u.hdr.list);
+				precvframe_if2->u.hdr.precvbuf = NULL;	//can't access the precvbuf for new arch.
+				precvframe_if2->u.hdr.len=0;
+
+				_rtw_memcpy(&precvframe_if2->u.hdr.attrib, &precvframe->u.hdr.attrib, sizeof(struct rx_pkt_attrib));
+
+				pattrib = &precvframe_if2->u.hdr.attrib;
+
+				//	Modified by Albert 20101213
+				//	For 8 bytes IP header alignment.
+				if (pattrib->qos)	//	Qos data, wireless lan header length is 26
+				{
+					shift_sz = 6;
+				}
+				else
+				{
+					shift_sz = 0;
+				}
+
+				skb_len = pattrib->pkt_len;
+
+				// for first fragment packet, driver need allocate 1536+drvinfo_sz+RXDESC_SIZE to defrag packet.
+				// modify alloc_sz for recvive crc error packet by thomas 2011-06-02
+				if((pattrib->mfrag == 1)&&(pattrib->frag_num == 0)){
+					//alloc_sz = 1664;	//1664 is 128 alignment.
+					if(skb_len <= 1650)
+						alloc_sz = 1664;
+					else
+						alloc_sz = skb_len + 14;
+				}
+				else {
+					alloc_sz = skb_len;
+					//	6 is for IP header 8 bytes alignment in QoS packet case.
+					//	8 is for skb->data 4 bytes alignment.
+					alloc_sz += 14;
+				}
+
+				pkt_copy = rtw_skb_alloc(alloc_sz);
+
+				if(pkt_copy)
+				{
+					pkt_copy->dev = secondary_padapter->pnetdev;
+					precvframe_if2->u.hdr.pkt = pkt_copy;
+					precvframe_if2->u.hdr.rx_head = pkt_copy->data;
+					precvframe_if2->u.hdr.rx_end = pkt_copy->data + alloc_sz;
+					skb_reserve( pkt_copy, 8 - ((SIZE_PTR)( pkt_copy->data ) & 7 ));//force pkt_copy->data at 8-byte alignment address
+					skb_reserve( pkt_copy, shift_sz );//force ip_hdr at 8-byte alignment address according to shift_sz.
+					_rtw_memcpy(pkt_copy->data, pbuf, skb_len);
+					precvframe_if2->u.hdr.rx_data = precvframe_if2->u.hdr.rx_tail = pkt_copy->data;
+
+
+					recvframe_put(precvframe_if2, skb_len);
+					//recvframe_pull(precvframe_if2, drvinfo_sz + RXDESC_SIZE);
+
+					rtl8192c_translate_rx_signal_stuff(precvframe_if2, pphy_info);
+
+					ret = rtw_recv_entry(precvframe_if2);
+
+				} else {
+					rtw_free_recvframe(precvframe_if2, pfree_recv_queue);
+					DBG_8192C("%s()-%d: alloc_skb() failed!\n", __FUNCTION__, __LINE__);
+				}
+
+			}
+
+		}
+
+	}
+
+	rtl8192c_translate_rx_signal_stuff(precvframe, pphy_info);
+
+	ret = rtw_recv_entry(precvframe);
+
+#endif
+
+	return ret;
+
+}
+
+#ifdef CONFIG_USE_USB_BUFFER_ALLOC_RX
+static int recvbuf2recvframe(_adapter *padapter, struct recv_buf *precvbuf)
+{
+	u8	*pbuf;
+	u8	shift_sz = 0;
+	u16	pkt_cnt, drvinfo_sz;
+	u32	pkt_offset, skb_len, alloc_sz;
+	s32	transfer_len;
+	struct recv_stat	*prxstat;
+	struct phy_stat	*pphy_info = NULL;
+	_pkt				*pkt_copy = NULL;
+	union recv_frame	*precvframe = NULL;
+	struct rx_pkt_attrib	*pattrib = NULL;
+	HAL_DATA_TYPE		*pHalData = GET_HAL_DATA(padapter);
+	struct recv_priv	*precvpriv = &padapter->recvpriv;
+	_queue			*pfree_recv_queue = &precvpriv->free_recv_queue;
+
+
+	transfer_len = (s32)precvbuf->transfer_len;
+	pbuf = precvbuf->pbuf;
+
+	prxstat = (struct recv_stat *)pbuf;
+	pkt_cnt = (le32_to_cpu(prxstat->rxdw2)>>16) & 0xff;
+
+#if 0 //temp remove when disable usb rx aggregation
+	if((pkt_cnt > 10) || (pkt_cnt < 1) || (transfer_len<RXDESC_SIZE) ||(pkt_len<=0))
+	{
+		return _FAIL;
+	}
+#endif
+
+	do{
+		RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
+			 ("recvbuf2recvframe: rxdesc=offsset 0:0x%08x, 4:0x%08x, 8:0x%08x, C:0x%08x\n",
+			  prxstat->rxdw0, prxstat->rxdw1, prxstat->rxdw2, prxstat->rxdw4));
+
+		prxstat = (struct recv_stat *)pbuf;
+
+		precvframe = rtw_alloc_recvframe(pfree_recv_queue);
+		if(precvframe==NULL)
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvbuf2recvframe: precvframe==NULL\n"));
+			DBG_8192C("%s()-%d: rtw_alloc_recvframe() failed! RX Drop!\n", __FUNCTION__, __LINE__);
+			goto _exit_recvbuf2recvframe;
+		}
+
+		_rtw_init_listhead(&precvframe->u.hdr.list);
+		precvframe->u.hdr.precvbuf = NULL;	//can't access the precvbuf for new arch.
+		precvframe->u.hdr.len=0;
+
+		rtl8192c_query_rx_desc_status(precvframe, prxstat);
+
+		pattrib = &precvframe->u.hdr.attrib;
+		if(pattrib->physt)
+		{
+			pphy_info = (struct phy_stat *)(pbuf + RXDESC_OFFSET);
+		}
+
+		pkt_offset = RXDESC_SIZE + pattrib->drvinfo_sz + pattrib->shift_sz + pattrib->pkt_len;
+
+		if((pattrib->pkt_len<=0) || (pkt_offset>transfer_len))
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("recvbuf2recvframe: pkt_len<=0\n"));
+			DBG_8192C("%s()-%d: RX Warning!\n", __FUNCTION__, __LINE__);
+			rtw_free_recvframe(precvframe, pfree_recv_queue);
+			goto _exit_recvbuf2recvframe;
+		}
+
+		//	Modified by Albert 20101213
+		//	For 8 bytes IP header alignment.
+		if (pattrib->qos)	//	Qos data, wireless lan header length is 26
+		{
+			shift_sz = 6;
+		}
+		else
+		{
+			shift_sz = 0;
+		}
+
+		skb_len = pattrib->pkt_len;
+
+		// for first fragment packet, driver need allocate 1536+drvinfo_sz+RXDESC_SIZE to defrag packet.
+		// modify alloc_sz for recvive crc error packet by thomas 2011-06-02
+		if((pattrib->mfrag == 1)&&(pattrib->frag_num == 0)){
+			//alloc_sz = 1664;	//1664 is 128 alignment.
+			if(skb_len <= 1650)
+				alloc_sz = 1664;
+			else
+				alloc_sz = skb_len + 14;
+		}
+		else {
+			alloc_sz = skb_len;
+			//	6 is for IP header 8 bytes alignment in QoS packet case.
+			//	8 is for skb->data 4 bytes alignment.
+			alloc_sz += 14;
+		}
+
+		pkt_copy = rtw_skb_alloc(alloc_sz);
+
+		if(pkt_copy)
+		{
+			pkt_copy->dev = padapter->pnetdev;
+			precvframe->u.hdr.pkt = pkt_copy;
+			precvframe->u.hdr.rx_head = pkt_copy->data;
+			precvframe->u.hdr.rx_end = pkt_copy->data + alloc_sz;
+			skb_reserve( pkt_copy, 8 - ((SIZE_PTR)( pkt_copy->data ) & 7 ));//force pkt_copy->data at 8-byte alignment address
+			skb_reserve( pkt_copy, shift_sz );//force ip_hdr at 8-byte alignment address according to shift_sz.
+			_rtw_memcpy(pkt_copy->data, (pbuf + pattrib->shift_sz + pattrib->drvinfo_sz + RXDESC_SIZE), skb_len);
+			precvframe->u.hdr.rx_data = precvframe->u.hdr.rx_tail = pkt_copy->data;
+		}
+		else
+		{
+			DBG_8192C("recvbuf2recvframe:can not allocate memory for skb copy\n");
+			//precvframe->u.hdr.pkt = rtw_skb_clone(pskb);
+			//precvframe->u.hdr.rx_head = precvframe->u.hdr.rx_data = precvframe->u.hdr.rx_tail = pbuf;
+			//precvframe->u.hdr.rx_end = pbuf + (pkt_offset>1612?pkt_offset:1612);
+
+			precvframe->u.hdr.pkt = NULL;
+			rtw_free_recvframe(precvframe, pfree_recv_queue);
+
+			goto _exit_recvbuf2recvframe;
+		}
+
+		recvframe_put(precvframe, skb_len);
+		//recvframe_pull(precvframe, drvinfo_sz + RXDESC_SIZE);
+
+#ifdef CONFIG_USB_RX_AGGREGATION
+		switch(pHalData->UsbRxAggMode)
+		{
+			case USB_RX_AGG_DMA:
+			case USB_RX_AGG_MIX:
+				pkt_offset = (u16)_RND128(pkt_offset);
+				break;
+				case USB_RX_AGG_USB:
+				pkt_offset = (u16)_RND4(pkt_offset);
+				break;
+			case USB_RX_AGG_DISABLE:
+			default:
+				break;
+		}
+#endif
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if(rtw_buddy_adapter_up(padapter))
+		{
+			if(pre_recv_entry(precvframe, prxstat, pphy_info) != _SUCCESS)
+			{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvbuf2recvframe: recv_entry(precvframe) != _SUCCESS\n"));
+			}
+		}
+		else
+		{
+			rtl8192c_translate_rx_signal_stuff(precvframe, pphy_info);
+			if(rtw_recv_entry(precvframe) != _SUCCESS)
+			{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvbuf2recvframe: rtw_recv_entry(precvframe) != _SUCCESS\n"));
+			}
+		}
+
+#else
+		rtl8192c_translate_rx_signal_stuff(precvframe, pphy_info);
+		if(rtw_recv_entry(precvframe) != _SUCCESS)
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvbuf2recvframe: rtw_recv_entry(precvframe) != _SUCCESS\n"));
+		}
+#endif
+
+		pkt_cnt--;
+		transfer_len -= pkt_offset;
+		pbuf += pkt_offset;
+		precvframe = NULL;
+		pkt_copy = NULL;
+
+		if(transfer_len>0 && pkt_cnt==0)
+			pkt_cnt = (le32_to_cpu(prxstat->rxdw2)>>16) & 0xff;
+
+	}while((transfer_len>0) && (pkt_cnt>0));
+
+_exit_recvbuf2recvframe:
+
+	return _SUCCESS;
+}
+
+void rtl8192cu_recv_tasklet(void *priv)
+{
+	struct recv_buf *precvbuf = NULL;
+	_adapter	*padapter = (_adapter*)priv;
+	struct recv_priv	*precvpriv = &padapter->recvpriv;
+
+	while (NULL != (precvbuf = rtw_dequeue_recvbuf(&precvpriv->recv_buf_pending_queue)))
+	{
+		if ((padapter->bDriverStopped == _TRUE)||(padapter->bSurpriseRemoved== _TRUE))
+		{
+			DBG_8192C("recv_tasklet => bDriverStopped or bSurpriseRemoved \n");
+
+			break;
+		}
+
+
+		recvbuf2recvframe(padapter, precvbuf);
+
+		rtw_read_port(padapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+	}
+
+}
+
+static void usb_read_port_complete(struct urb *purb, struct pt_regs *regs)
+{
+	struct recv_buf	*precvbuf = (struct recv_buf *)purb->context;
+	_adapter 			*padapter =(_adapter *)precvbuf->adapter;
+	struct recv_priv	*precvpriv = &padapter->recvpriv;
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete!!!\n"));
+
+	precvpriv->rx_pending_cnt --;
+
+	if(padapter->bSurpriseRemoved || padapter->bDriverStopped||padapter->bReadPortCancel)
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete:bDriverStopped(%d) OR bSurpriseRemoved(%d)\n", padapter->bDriverStopped, padapter->bSurpriseRemoved));
+
+		goto exit;
+	}
+
+	if(purb->status==0)//SUCCESS
+	{
+		if ((purb->actual_length > MAX_RECVBUF_SZ) || (purb->actual_length < RXDESC_SIZE))
+		{
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete: (purb->actual_length > MAX_RECVBUF_SZ) || (purb->actual_length < RXDESC_SIZE)\n"));
+
+			rtw_read_port(padapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+		}
+		else
+		{
+			rtw_reset_continual_urb_error(adapter_to_dvobj(padapter));
+
+			precvbuf->transfer_len = purb->actual_length;
+
+			//rtw_enqueue_rx_transfer_buffer(precvpriv, rx_transfer_buf);
+			rtw_enqueue_recvbuf(precvbuf, &precvpriv->recv_buf_pending_queue);
+
+			tasklet_schedule(&precvpriv->recv_tasklet);
+		}
+	}
+	else
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete : purb->status(%d) != 0 \n", purb->status));
+
+		DBG_8192C("###=> usb_read_port_complete => urb status(%d)\n", purb->status);
+
+		if(rtw_inc_and_chk_continual_urb_error(adapter_to_dvobj(padapter)) == _TRUE ){
+			padapter->bSurpriseRemoved = _TRUE;
+		}
+
+		switch(purb->status) {
+			case -EINVAL:
+			case -EPIPE:
+			case -ENODEV:
+			case -ESHUTDOWN:
+				//padapter->bSurpriseRemoved=_TRUE;
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete:bSurpriseRemoved=TRUE\n"));
+			case -ENOENT:
+				padapter->bDriverStopped=_TRUE;
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete:bDriverStopped=TRUE\n"));
+				break;
+			case -EPROTO:
+			case -EILSEQ:
+			case -ETIME:
+			case -ECOMM:
+			case -EOVERFLOW:
+				#ifdef DBG_CONFIG_ERROR_DETECT
+				{
+					HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+					pHalData->srestpriv.Wifi_Error_Status = USB_READ_PORT_FAIL;
+				}
+				#endif
+				rtw_read_port(padapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+				break;
+			case -EINPROGRESS:
+				DBG_8192C("ERROR: URB IS IN PROGRESS!/n");
+				break;
+			default:
+				break;
+		}
+
+	}
+
+exit:
+
+_func_exit_;
+
+}
+
+static u32 usb_read_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem)
+{
+	int err;
+	unsigned int pipe;
+	u32 ret = _SUCCESS;
+	PURB purb = NULL;
+	struct recv_buf	*precvbuf = (struct recv_buf *)rmem;
+	_adapter *adapter = pintfhdl->padapter;
+	struct dvobj_priv	*pdvobj = adapter_to_dvobj(adapter);
+	struct recv_priv	*precvpriv = &adapter->recvpriv;
+	struct usb_device	*pusbd = pdvobj->pusbdev;
+
+_func_enter_;
+
+	if(adapter->bDriverStopped || adapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx)
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port:( padapter->bDriverStopped ||padapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx)!!!\n"));
+		return _FAIL;
+	}
+
+	if(precvbuf !=NULL)
+	{
+		rtl8192cu_init_recvbuf(adapter, precvbuf);
+
+		if(precvbuf->pbuf)
+		{
+			precvpriv->rx_pending_cnt++;
+
+			purb = precvbuf->purb;
+
+			//translate DMA FIFO addr to pipehandle
+			pipe = ffaddr2pipehdl(pdvobj, addr);
+
+			usb_fill_bulk_urb(purb, pusbd, pipe,
+						precvbuf->pbuf,
+						MAX_RECVBUF_SZ,
+						usb_read_port_complete,
+						precvbuf);//context is precvbuf
+
+			purb->transfer_dma = precvbuf->dma_transfer_addr;
+			purb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+			err = usb_submit_urb(purb, GFP_ATOMIC);
+			if((err) && (err != (-EPERM)))
+			{
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("cannot submit rx in-token(err=0x%.8x), URB_STATUS =0x%.8x", err, purb->status));
+				DBG_8192C("cannot submit rx in-token(err = 0x%08x),urb_status = %d\n",err,purb->status);
+				ret = _FAIL;
+			}
+
+		}
+
+	}
+	else
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port:precvbuf ==NULL\n"));
+		ret = _FAIL;
+	}
+
+_func_exit_;
+
+	return ret;
+}
+#else	// CONFIG_USE_USB_BUFFER_ALLOC_RX
+static int recvbuf2recvframe(_adapter *padapter, _pkt *pskb)
+{
+	u8	*pbuf;
+	u8	shift_sz = 0;
+	u16	pkt_cnt;
+	u32	pkt_offset, skb_len, alloc_sz;
+	s32	transfer_len;
+	struct recv_stat	*prxstat;
+	struct phy_stat	*pphy_info = NULL;
+	_pkt				*pkt_copy = NULL;
+	union recv_frame	*precvframe = NULL;
+	struct rx_pkt_attrib	*pattrib = NULL;
+	HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+	struct recv_priv	*precvpriv = &padapter->recvpriv;
+	_queue			*pfree_recv_queue = &precvpriv->free_recv_queue;
+
+
+	transfer_len = (s32)pskb->len;
+	pbuf = pskb->data;
+
+	prxstat = (struct recv_stat *)pbuf;
+	pkt_cnt = (le32_to_cpu(prxstat->rxdw2)>>16) & 0xff;
+
+#if 0 //temp remove when disable usb rx aggregation
+	if((pkt_cnt > 10) || (pkt_cnt < 1) || (transfer_len<RXDESC_SIZE) ||(pkt_len<=0))
+	{
+		return _FAIL;
+	}
+#endif
+
+	do{
+		RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
+			 ("recvbuf2recvframe: rxdesc=offsset 0:0x%08x, 4:0x%08x, 8:0x%08x, C:0x%08x\n",
+			  prxstat->rxdw0, prxstat->rxdw1, prxstat->rxdw2, prxstat->rxdw4));
+
+		prxstat = (struct recv_stat *)pbuf;
+
+		precvframe = rtw_alloc_recvframe(pfree_recv_queue);
+		if(precvframe==NULL)
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvbuf2recvframe: precvframe==NULL\n"));
+			DBG_8192C("%s()-%d: rtw_alloc_recvframe() failed! RX Drop!\n", __FUNCTION__, __LINE__);
+			goto _exit_recvbuf2recvframe;
+		}
+
+		_rtw_init_listhead(&precvframe->u.hdr.list);
+		precvframe->u.hdr.precvbuf = NULL;	//can't access the precvbuf for new arch.
+		precvframe->u.hdr.len=0;
+
+		rtl8192c_query_rx_desc_status(precvframe, prxstat);
+
+		pattrib = &precvframe->u.hdr.attrib;
+		if(pattrib->physt)
+		{
+			pphy_info = (struct phy_stat *)(pbuf + RXDESC_OFFSET);
+		}
+
+		pkt_offset = RXDESC_SIZE + pattrib->drvinfo_sz + pattrib->shift_sz + pattrib->pkt_len;
+
+		if((pattrib->pkt_len<=0) || (pkt_offset>transfer_len))
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_info_,("recvbuf2recvframe: pkt_len<=0\n"));
+			DBG_8192C("%s()-%d: RX Warning!\n", __FUNCTION__, __LINE__);
+			rtw_free_recvframe(precvframe, pfree_recv_queue);
+			goto _exit_recvbuf2recvframe;
+		}
+
+		//	Modified by Albert 20101213
+		//	For 8 bytes IP header alignment.
+		if (pattrib->qos)	//	Qos data, wireless lan header length is 26
+		{
+			shift_sz = 6;
+		}
+		else
+		{
+			shift_sz = 0;
+		}
+
+		skb_len = pattrib->pkt_len;
+
+		// for first fragment packet, driver need allocate 1536+drvinfo_sz+RXDESC_SIZE to defrag packet.
+		// modify alloc_sz for recvive crc error packet by thomas 2011-06-02
+		if((pattrib->mfrag == 1)&&(pattrib->frag_num == 0)){
+			//alloc_sz = 1664;	//1664 is 128 alignment.
+			if(skb_len <= 1650)
+				alloc_sz = 1664;
+			else
+				alloc_sz = skb_len + 14;
+		}
+		else {
+			alloc_sz = skb_len;
+			//	6 is for IP header 8 bytes alignment in QoS packet case.
+			//	8 is for skb->data 4 bytes alignment.
+			alloc_sz += 14;
+		}
+
+		pkt_copy = rtw_skb_alloc(alloc_sz);
+
+		if(pkt_copy)
+		{
+			pkt_copy->dev = padapter->pnetdev;
+			precvframe->u.hdr.pkt = pkt_copy;
+			precvframe->u.hdr.rx_head = pkt_copy->data;
+			precvframe->u.hdr.rx_end = pkt_copy->data + alloc_sz;
+			skb_reserve( pkt_copy, 8 - ((SIZE_PTR)( pkt_copy->data ) & 7 ));//force pkt_copy->data at 8-byte alignment address
+			skb_reserve( pkt_copy, shift_sz );//force ip_hdr at 8-byte alignment address according to shift_sz.
+			_rtw_memcpy(pkt_copy->data, (pbuf + pattrib->shift_sz + pattrib->drvinfo_sz + RXDESC_SIZE), skb_len);
+			precvframe->u.hdr.rx_data = precvframe->u.hdr.rx_tail = pkt_copy->data;
+
+		}
+		else
+		{
+			precvframe->u.hdr.pkt = rtw_skb_clone(pskb);
+			if(pkt_copy)
+			{
+				precvframe->u.hdr.rx_head = precvframe->u.hdr.rx_data = precvframe->u.hdr.rx_tail = pbuf;
+				precvframe->u.hdr.rx_end = pbuf + alloc_sz;
+			}
+			else
+			{
+				DBG_8192C("recvbuf2recvframe: rtw_skb_clone fail\n");
+				rtw_free_recvframe(precvframe, pfree_recv_queue);
+				goto _exit_recvbuf2recvframe;
+			}
+		}
+
+		recvframe_put(precvframe, skb_len);
+		//recvframe_pull(precvframe, drvinfo_sz + RXDESC_SIZE);
+
+#ifdef CONFIG_USB_RX_AGGREGATION
+		switch(pHalData->UsbRxAggMode)
+		{
+			case USB_RX_AGG_DMA:
+			case USB_RX_AGG_MIX:
+				pkt_offset = (u16)_RND128(pkt_offset);
+				break;
+				case USB_RX_AGG_USB:
+				pkt_offset = (u16)_RND4(pkt_offset);
+				break;
+			case USB_RX_AGG_DISABLE:
+			default:
+				break;
+		}
+#endif
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if(rtw_buddy_adapter_up(padapter))
+		{
+			if(pre_recv_entry(precvframe, prxstat, pphy_info) != _SUCCESS)
+			{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvbuf2recvframe: recv_entry(precvframe) != _SUCCESS\n"));
+			}
+		}
+		else
+		{
+			rtl8192c_translate_rx_signal_stuff(precvframe, pphy_info);
+			if(rtw_recv_entry(precvframe) != _SUCCESS)
+			{
+				RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvbuf2recvframe: rtw_recv_entry(precvframe) != _SUCCESS\n"));
+			}
+		}
+
+#else
+		rtl8192c_translate_rx_signal_stuff(precvframe, pphy_info);
+		if(rtw_recv_entry(precvframe) != _SUCCESS)
+		{
+			RT_TRACE(_module_rtl871x_recv_c_,_drv_err_,("recvbuf2recvframe: rtw_recv_entry(precvframe) != _SUCCESS\n"));
+		}
+#endif
+
+		pkt_cnt--;
+		transfer_len -= pkt_offset;
+		pbuf += pkt_offset;
+		precvframe = NULL;
+		pkt_copy = NULL;
+
+		if(transfer_len>0 && pkt_cnt==0)
+			pkt_cnt = (le32_to_cpu(prxstat->rxdw2)>>16) & 0xff;
+
+	}while((transfer_len>0) && (pkt_cnt>0));
+
+_exit_recvbuf2recvframe:
+
+	return _SUCCESS;
+}
+
+void rtl8192cu_recv_tasklet(void *priv)
+{
+	_pkt			*pskb;
+	_adapter		*padapter = (_adapter*)priv;
+	struct recv_priv	*precvpriv = &padapter->recvpriv;
+
+	while (NULL != (pskb = skb_dequeue(&precvpriv->rx_skb_queue)))
+	{
+		if ((padapter->bDriverStopped == _TRUE)||(padapter->bSurpriseRemoved== _TRUE))
+		{
+			DBG_8192C("recv_tasklet => bDriverStopped or bSurpriseRemoved \n");
+			rtw_skb_free(pskb);
+			break;
+		}
+
+		recvbuf2recvframe(padapter, pskb);
+
+#ifdef CONFIG_PREALLOC_RECV_SKB
+
+		skb_reset_tail_pointer(pskb);
+
+		pskb->len = 0;
+
+		skb_queue_tail(&precvpriv->free_recv_skb_queue, pskb);
+
+#else
+		rtw_skb_free(pskb);
+#endif
+
+	}
+
+}
+
+
+static void usb_read_port_complete(struct urb *purb, struct pt_regs *regs)
+{
+	_irqL irqL;
+	uint isevt, *pbuf;
+	struct recv_buf	*precvbuf = (struct recv_buf *)purb->context;
+	_adapter 			*padapter =(_adapter *)precvbuf->adapter;
+	struct recv_priv	*precvpriv = &padapter->recvpriv;
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete!!!\n"));
+
+	//_enter_critical(&precvpriv->lock, &irqL);
+	//precvbuf->irp_pending=_FALSE;
+	//precvpriv->rx_pending_cnt --;
+	//_exit_critical(&precvpriv->lock, &irqL);
+
+	precvpriv->rx_pending_cnt --;
+
+	//if(precvpriv->rx_pending_cnt== 0)
+	//{
+	//	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete: rx_pending_cnt== 0, set allrxreturnevt!\n"));
+	//	_rtw_up_sema(&precvpriv->allrxreturnevt);
+	//}
+
+	if(padapter->bSurpriseRemoved || padapter->bDriverStopped||padapter->bReadPortCancel)
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete:bDriverStopped(%d) OR bSurpriseRemoved(%d)\n", padapter->bDriverStopped, padapter->bSurpriseRemoved));
+
+	#ifdef CONFIG_PREALLOC_RECV_SKB
+		precvbuf->reuse = _TRUE;
+	#else
+		if(precvbuf->pskb){
+			DBG_8192C("==> free skb(%p)\n",precvbuf->pskb);
+			rtw_skb_free(precvbuf->pskb);
+		}
+	#endif
+		DBG_8192C("%s()-%d: RX Warning! bDriverStopped(%d) OR bSurpriseRemoved(%d) bReadPortCancel(%d)\n",
+		__FUNCTION__, __LINE__,padapter->bDriverStopped, padapter->bSurpriseRemoved,padapter->bReadPortCancel);
+		goto exit;
+	}
+
+	if(purb->status==0)//SUCCESS
+	{
+		if ((purb->actual_length > MAX_RECVBUF_SZ) || (purb->actual_length < RXDESC_SIZE))
+		{
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete: (purb->actual_length > MAX_RECVBUF_SZ) || (purb->actual_length < RXDESC_SIZE)\n"));
+			precvbuf->reuse = _TRUE;
+			rtw_read_port(padapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+			DBG_8192C("%s()-%d: RX Warning!\n", __FUNCTION__, __LINE__);
+		}
+		else
+		{
+			rtw_reset_continual_urb_error(adapter_to_dvobj(padapter));
+
+			precvbuf->transfer_len = purb->actual_length;
+			skb_put(precvbuf->pskb, purb->actual_length);
+			skb_queue_tail(&precvpriv->rx_skb_queue, precvbuf->pskb);
+
+			if (skb_queue_len(&precvpriv->rx_skb_queue)<=1)
+				tasklet_schedule(&precvpriv->recv_tasklet);
+
+			precvbuf->pskb = NULL;
+			precvbuf->reuse = _FALSE;
+			rtw_read_port(padapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+		}
+	}
+	else
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete : purb->status(%d) != 0 \n", purb->status));
+
+		DBG_8192C("###=> usb_read_port_complete => urb status(%d)\n", purb->status);
+
+		if(rtw_inc_and_chk_continual_urb_error(adapter_to_dvobj(padapter)) == _TRUE ){
+			padapter->bSurpriseRemoved = _TRUE;
+		}
+
+		switch(purb->status) {
+			case -EINVAL:
+			case -EPIPE:
+			case -ENODEV:
+			case -ESHUTDOWN:
+				//padapter->bSurpriseRemoved=_TRUE;
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete:bSurpriseRemoved=TRUE\n"));
+			case -ENOENT:
+				padapter->bDriverStopped=_TRUE;
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete:bDriverStopped=TRUE\n"));
+				break;
+			case -EPROTO:
+			case -EILSEQ:
+			case -ETIME:
+			case -ECOMM:
+			case -EOVERFLOW:
+				#ifdef DBG_CONFIG_ERROR_DETECT
+				{
+					HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+					pHalData->srestpriv.Wifi_Error_Status = USB_READ_PORT_FAIL;
+				}
+				#endif
+				precvbuf->reuse = _TRUE;
+				rtw_read_port(padapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+				break;
+			case -EINPROGRESS:
+				precvpriv->read_port_complete_EINPROGRESS_cnt++;
+				DBG_8192C("ERROR: URB IS IN PROGRESS!/n");
+				break;
+			default:
+				precvpriv->read_port_complete_other_urb_err_cnt++;
+				break;
+		}
+
+	}
+
+exit:
+
+_func_exit_;
+
+}
+
+static u32 usb_read_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem)
+{
+	_irqL irqL;
+	int err;
+	unsigned int pipe;
+	SIZE_PTR tmpaddr=0;
+	SIZE_PTR alignment=0;
+	u32 ret = _SUCCESS;
+	PURB purb = NULL;
+	struct recv_buf	*precvbuf = (struct recv_buf *)rmem;
+	_adapter		*adapter = pintfhdl->padapter;
+	struct dvobj_priv	*pdvobj = adapter_to_dvobj(adapter);
+	struct recv_priv	*precvpriv = &adapter->recvpriv;
+	struct usb_device	*pusbd = pdvobj->pusbdev;
+
+_func_enter_;
+
+	if(adapter->bDriverStopped || adapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx)
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port:( padapter->bDriverStopped ||padapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx)!!!\n"));
+		return _FAIL;
+	}
+
+#ifdef CONFIG_PREALLOC_RECV_SKB
+	if((precvbuf->reuse == _FALSE) || (precvbuf->pskb == NULL))
+	{
+		if (NULL != (precvbuf->pskb = skb_dequeue(&precvpriv->free_recv_skb_queue)))
+		{
+			precvbuf->reuse = _TRUE;
+		}
+	}
+#endif
+
+
+	if(precvbuf !=NULL)
+	{
+		rtl8192cu_init_recvbuf(adapter, precvbuf);
+
+		//re-assign for linux based on skb
+		if((precvbuf->reuse == _FALSE) || (precvbuf->pskb == NULL))
+		{
+			precvbuf->pskb = rtw_skb_alloc(MAX_RECVBUF_SZ + RECVBUFF_ALIGN_SZ);
+
+			if(precvbuf->pskb == NULL)
+			{
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("init_recvbuf(): alloc_skb fail!\n"));
+				precvpriv->recvbuf_skb_alloc_fail_cnt++;
+				return _FAIL;
+			}
+
+			tmpaddr = (SIZE_PTR)precvbuf->pskb->data;
+			alignment = tmpaddr & (RECVBUFF_ALIGN_SZ-1);
+			skb_reserve(precvbuf->pskb, (RECVBUFF_ALIGN_SZ - alignment));
+
+			precvbuf->phead = precvbuf->pskb->head;
+			precvbuf->pdata = precvbuf->pskb->data;
+			precvbuf->ptail = skb_tail_pointer(precvbuf->pskb);
+			precvbuf->pend = skb_end_pointer(precvbuf->pskb);
+			precvbuf->pbuf = precvbuf->pskb->data;
+		}
+		else//reuse skb
+		{
+			precvbuf->phead = precvbuf->pskb->head;
+			precvbuf->pdata = precvbuf->pskb->data;
+			precvbuf->ptail = skb_tail_pointer(precvbuf->pskb);
+			precvbuf->pend = skb_end_pointer(precvbuf->pskb);
+		precvbuf->pbuf = precvbuf->pskb->data;
+
+			precvbuf->reuse = _FALSE;
+		}
+
+		//_enter_critical(&precvpriv->lock, &irqL);
+		//precvpriv->rx_pending_cnt++;
+		//precvbuf->irp_pending = _TRUE;
+		//_exit_critical(&precvpriv->lock, &irqL);
+
+		precvpriv->rx_pending_cnt++;
+
+		purb = precvbuf->purb;
+
+		//translate DMA FIFO addr to pipehandle
+		pipe = ffaddr2pipehdl(pdvobj, addr);
+
+		usb_fill_bulk_urb(purb, pusbd, pipe,
+						precvbuf->pbuf,
+						MAX_RECVBUF_SZ,
+						usb_read_port_complete,
+						precvbuf);//context is precvbuf
+
+		err = usb_submit_urb(purb, GFP_ATOMIC);
+		if((err) && (err != (-EPERM)))
+		{
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("cannot submit rx in-token(err=0x%.8x), URB_STATUS =0x%.8x", err, purb->status));
+			DBG_8192C("cannot submit rx in-token(err = 0x%08x),urb_status = %d\n",err,purb->status);
+			ret = _FAIL;
+		}
+	}
+	else
+	{
+		precvpriv->recvbuf_null_cnt++;
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port:precvbuf ==NULL\n"));
+		ret = _FAIL;
+	}
+
+_func_exit_;
+
+	return ret;
+}
+#endif	// CONFIG_USE_USB_BUFFER_ALLOC_RX
+
+void rtl8192cu_xmit_tasklet(void *priv)
+{
+	int ret = _FALSE;
+	_adapter *padapter = (_adapter*)priv;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+
+	if(check_fwstate(&padapter->mlmepriv, _FW_UNDER_SURVEY) == _TRUE)
+		return;
+
+	while(1)
+	{
+		if ((padapter->bDriverStopped == _TRUE)||(padapter->bSurpriseRemoved== _TRUE) || (padapter->bWritePortCancel == _TRUE))
+		{
+			DBG_8192C("xmit_tasklet => bDriverStopped or bSurpriseRemoved or bWritePortCancel\n");
+			break;
+		}
+
+		ret = rtl8192cu_xmitframe_complete(padapter, pxmitpriv, NULL);
+
+		if(ret==_FALSE)
+			break;
+
+	}
+
+}
+
+void rtl8192cu_set_intf_ops(struct _io_ops	*pops)
+{
+	_func_enter_;
+
+	_rtw_memset((u8 *)pops, 0, sizeof(struct _io_ops));
+
+	pops->_read8 = &usb_read8;
+	pops->_read16 = &usb_read16;
+	pops->_read32 = &usb_read32;
+	pops->_read_mem = &usb_read_mem;
+	pops->_read_port = &usb_read_port;
+
+	pops->_write8 = &usb_write8;
+	pops->_write16 = &usb_write16;
+	pops->_write32 = &usb_write32;
+	pops->_writeN = &usb_writeN;
+
+#ifdef CONFIG_USB_SUPPORT_ASYNC_VDN_REQ
+	pops->_write8_async= &usb_async_write8;
+	pops->_write16_async = &usb_async_write16;
+	pops->_write32_async = &usb_async_write32;
+#endif
+	pops->_write_mem = &usb_write_mem;
+	pops->_write_port = &usb_write_port;
+
+	pops->_read_port_cancel = &usb_read_port_cancel;
+	pops->_write_port_cancel = &usb_write_port_cancel;
+
+#ifdef CONFIG_USB_INTERRUPT_IN_PIPE
+	pops->_read_interrupt = &usb_read_interrupt;
+#endif
+
+	_func_exit_;
+
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_xp.c b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_xp.c
new file mode 100644
index 000000000000..59143e3ea6a9
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/hal/rtl8192c/usb/usb_ops_xp.c
@@ -0,0 +1,1264 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _HCI_OPS_OS_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <osdep_intf.h>
+#include <circ_buf.h>
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+	#error "Shall be Linux or Windows, but not both!\n"
+#endif
+
+#ifndef CONFIG_USB_HCI
+	#error "CONFIG_USB_HCI shall be on!\n"
+#endif
+
+
+#include <usb.h>
+#include <usbdlib.h>
+#include <usbioctl.h>
+
+#include <usb_ops.h>
+#include <recv_osdep.h>
+
+#include <usb_osintf.h>
+
+
+struct zero_bulkout_context
+{
+	void *pbuf;
+	void *purb;
+	void *pirp;
+	void *padapter;
+};
+
+#define usb_write_cmd usb_write_mem
+#define usb_read_cmd usb_read_mem
+#define usb_write_cmd_complete usb_write_mem_complete
+//#define usb_read_cmd_complete usb_read_mem_complete
+
+
+
+uint usb_init_intf_priv(struct intf_priv *pintfpriv)
+{
+
+	PURB	piorw_urb;
+	u8		NextDeviceStackSize;
+	struct dvobj_priv   *pdev = (struct dvobj_priv   *)pintfpriv->intf_dev;
+	_adapter * padapter=pdev->padapter;
+
+_func_enter_;
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_info_,("\n +usb_init_intf_priv\n"));
+
+	pintfpriv->intf_status = _IOREADY;
+
+       if(pdev->ishighspeed) pintfpriv->max_iosz =  128;
+	else pintfpriv->max_iosz =  64;
+
+
+	_init_timer(&pintfpriv->io_timer, padapter->hndis_adapter, io_irp_timeout_handler, pintfpriv);
+
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_info_,("usb_init_intf_priv:pintfpriv->max_iosz:%d\n",pintfpriv->max_iosz));
+
+	pintfpriv->io_wsz = 0;
+	pintfpriv->io_rsz = 0;
+
+	pintfpriv->allocated_io_rwmem = rtw_zmalloc(pintfpriv->max_iosz +4);
+
+	if (pintfpriv->allocated_io_rwmem == NULL){
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usb_init_intf_priv:pintfpriv->allocated_io_rwmem == NULL\n"));
+		goto usb_init_intf_priv_fail;
+	}
+
+	pintfpriv->io_rwmem = pintfpriv->allocated_io_rwmem +  4 \
+					-( (u32)(pintfpriv->allocated_io_rwmem) & 3);
+
+
+
+     NextDeviceStackSize = (u8)pdev->nextdevstacksz;//pintfpriv->pUsbDevObj->StackSize + 1;
+
+      piorw_urb = (PURB)ExAllocatePool(NonPagedPool, sizeof(URB) );
+      if(piorw_urb == NULL)
+	  goto usb_init_intf_priv_fail;
+
+      pintfpriv->piorw_urb = piorw_urb;
+
+      pintfpriv->piorw_irp = IoAllocateIrp(NextDeviceStackSize , FALSE);
+
+
+      pintfpriv->io_irp_cnt=1;
+      pintfpriv->bio_irp_pending=_FALSE;
+
+     _rtw_init_sema(&(pintfpriv->io_retevt), 0);//NdisInitializeEvent(&pintfpriv->io_irp_return_evt);
+
+_func_exit_;
+	return _SUCCESS;
+
+usb_init_intf_priv_fail:
+
+	if (pintfpriv->allocated_io_rwmem)
+		rtw_mfree((u8 *)(pintfpriv->allocated_io_rwmem), pintfpriv->max_iosz +4);
+
+	if(piorw_urb)
+		ExFreePool(piorw_urb);
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_info_,("\n -usb_init_intf_priv(usb_init_intf_priv_fail)\n"));
+
+_func_exit_;
+	return _FAIL;
+
+}
+
+void usb_unload_intf_priv(struct intf_priv *pintfpriv)
+{
+
+_func_enter_;
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n+usb_unload_intf_priv\n"));
+
+	rtw_mfree((u8 *)(pintfpriv->allocated_io_rwmem), pintfpriv->max_iosz+4);
+
+#ifdef PLATFORM_WINDOWS
+	if(pintfpriv->piorw_urb)
+		ExFreePool(pintfpriv->piorw_urb);
+
+	if(pintfpriv->piorw_irp)
+		IoFreeIrp(pintfpriv->piorw_irp);
+#endif
+
+
+#ifdef PLATFORM_LINUX
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\npintfpriv->io_irp_cnt=%d\n",pintfpriv->io_irp_cnt));
+	pintfpriv->io_irp_cnt--;
+	if(pintfpriv->io_irp_cnt){
+		if(pintfpriv->bio_irp_pending==_TRUE){
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\nkill iorw_urb\n"));
+		usb_kill_urb(pintfpriv->piorw_urb);
+		}
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n wait io_retevt\n"));
+		_rtw_down_sema(&(pintfpriv->io_retevt));
+	}
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n cancel io_urb ok\n"));
+#endif
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n-usb_unload_intf_priv\n"));
+
+_func_exit_;
+
+}
+
+void *ffaddr2pipehdl(struct dvobj_priv *pNdisCEDvice, u32 addr)
+{
+	HANDLE PipeHandle = NULL;
+	_adapter	*padapter = pNdisCEDvice->padapter;
+
+
+	if(pNdisCEDvice->nr_endpoint == 11)
+	{
+		switch(addr)
+		{
+			case RTL8712_DMA_BEQ:
+				PipeHandle= padapter->halpriv.pipehdls_r8712[3] ;
+				break;
+			case RTL8712_DMA_BKQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[4];
+				break;
+			case RTL8712_DMA_VIQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[2];
+				break;
+			case RTL8712_DMA_VOQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[1];
+				break;
+                     case RTL8712_DMA_BCNQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[6];
+				break;
+			case RTL8712_DMA_BMCQ:	//HI Queue
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[7];
+				break;
+			case RTL8712_DMA_MGTQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[8];
+				break;
+                     case RTL8712_DMA_RX0FF:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[0];
+				break;
+			case RTL8712_DMA_C2HCMD:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[5];
+				break;
+			case RTL8712_DMA_H2CCMD:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[9];
+				break;
+
+		}
+
+	}
+	else if(pNdisCEDvice->nr_endpoint == 6)
+	{
+		switch(addr)
+		{
+			case RTL8712_DMA_BEQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[3];
+				break;
+			case RTL8712_DMA_BKQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[4];
+				break;
+			case RTL8712_DMA_VIQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[2];
+				break;
+			case RTL8712_DMA_VOQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[1];
+				break;
+                     case RTL8712_DMA_RX0FF:
+			case RTL8712_DMA_C2HCMD:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[0];
+				break;
+			case RTL8712_DMA_H2CCMD:
+			case RTL8712_DMA_BCNQ:
+			case RTL8712_DMA_BMCQ:
+			case RTL8712_DMA_MGTQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[5];
+				break;
+
+		}
+
+	}
+	else if(pNdisCEDvice->nr_endpoint == 4)
+	{
+		switch(addr)
+		{
+			case RTL8712_DMA_BEQ:
+			//case RTL8712_DMA_BKQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[2];
+				break;
+			//case RTL8712_DMA_VIQ:
+			case RTL8712_DMA_VOQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[1];
+				break;
+			case RTL8712_DMA_RX0FF:
+			case RTL8712_DMA_C2HCMD:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[0];
+				break;
+			case RTL8712_DMA_H2CCMD:
+			case RTL8712_DMA_BCNQ:
+			case RTL8712_DMA_BMCQ:
+			case RTL8712_DMA_MGTQ:
+				PipeHandle=  padapter->halpriv.pipehdls_r8712[3];
+				break;
+		}
+
+	}
+	else
+	{
+	   RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("ffaddr2pipehdl():nr_endpoint=%d error!\n", pNdisCEDvice->nr_endpoint));
+	}
+
+	return PipeHandle;
+
+}
+
+
+NTSTATUS usb_bulkout_zero_complete(
+	PDEVICE_OBJECT	pUsbDevObj,
+	PIRP		pIrp, void*	pZeroContext)
+{
+	struct zero_bulkout_context *pcontext = (struct zero_bulkout_context *)pZeroContext;
+
+_func_enter_;
+
+	if(pcontext)
+	{
+		if(pcontext->pbuf)
+		{
+			ExFreePool(pcontext->pbuf);
+		}
+
+		if(pcontext->purb)
+		{
+			ExFreePool(pcontext->purb);
+		}
+
+		if(pcontext->pirp && (pIrp ==pcontext->pirp))
+		{
+			IoFreeIrp(pIrp);
+		}
+
+		ExFreePool(pcontext);
+	}
+
+_func_exit_;
+
+	return STATUS_MORE_PROCESSING_REQUIRED;
+
+
+}
+
+u32 usb_bulkout_zero(struct intf_hdl *pintfhdl, u32 addr)
+{
+	struct zero_bulkout_context *pcontext;
+	unsigned char *pbuf;
+	char NextDeviceStackSize, len;
+	PIO_STACK_LOCATION	nextStack;
+	USBD_STATUS		usbdstatus;
+	HANDLE				PipeHandle;
+	PIRP					pirp = NULL;
+	PURB				purb = NULL;
+	NDIS_STATUS			ndisStatus = NDIS_STATUS_SUCCESS;
+	_adapter *padapter = (_adapter *)pintfhdl->adapter;
+	struct dvobj_priv	*pdvobj = (struct dvobj_priv *)&padapter->dvobjpriv;
+
+
+_func_enter_;
+
+	if((padapter->bDriverStopped) || (padapter->bSurpriseRemoved) ||(padapter->pwrctrlpriv.pnp_bstop_trx))
+	{
+		return _FAIL;
+	}
+
+	len = 0;
+	NextDeviceStackSize = (char)pdvobj->nextdevstacksz;
+
+	pcontext = (struct zero_bulkout_context *)ExAllocatePool(NonPagedPool, sizeof(struct zero_bulkout_context));
+	pbuf = (unsigned char *)ExAllocatePool(NonPagedPool, sizeof(int));
+	purb = (PURB)ExAllocatePool(NonPagedPool, sizeof(URB));
+	pirp = IoAllocateIrp(NextDeviceStackSize, FALSE);
+
+	pcontext->pbuf = pbuf;
+	pcontext->purb = purb;
+	pcontext->pirp = pirp;
+	pcontext->padapter = padapter;
+
+	//translate DMA FIFO addr to pipehandle
+	PipeHandle = ffaddr2pipehdl(pdvobj, addr);
+
+
+	// Build our URB for USBD
+	UsbBuildInterruptOrBulkTransferRequest(
+				purb,
+				sizeof(struct _URB_BULK_OR_INTERRUPT_TRANSFER),
+				PipeHandle,
+				pbuf,
+				NULL,
+				len,
+				0,
+				NULL);
+
+	//
+	// call the calss driver to perform the operation
+	// pass the URB to the USB driver stack
+	//
+	nextStack = IoGetNextIrpStackLocation(pirp);
+	nextStack->MajorFunction = IRP_MJ_INTERNAL_DEVICE_CONTROL;
+	nextStack->Parameters.Others.Argument1 = purb;
+	nextStack->Parameters.DeviceIoControl.IoControlCode = IOCTL_INTERNAL_USB_SUBMIT_URB;
+
+	//Set Completion Routine
+	IoSetCompletionRoutine(pirp,					// irp to use
+				               usb_bulkout_zero_complete,	// callback routine
+				               pcontext,				// context
+				               TRUE,					// call on success
+				               TRUE,					// call on error
+				               TRUE);					// call on cancel
+
+
+	// Call IoCallDriver to send the irp to the usb bus driver
+	//
+	ndisStatus = IoCallDriver(pdvobj->pnextdevobj, pirp);
+	usbdstatus = URB_STATUS(purb);
+
+	if( USBD_HALTED(usbdstatus) )
+	{
+		padapter->bDriverStopped=_TRUE;
+		padapter->bSurpriseRemoved=_TRUE;
+	}
+
+	//
+	// The usb bus driver should always return STATUS_PENDING when bulk out irp async
+	//
+	if ( ndisStatus != STATUS_PENDING )
+	{
+		return _FAIL;
+	}
+
+_func_exit_;
+
+	return _SUCCESS;
+
+}
+
+void usb_read_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem)
+{
+	_func_enter_;
+
+
+
+	_func_exit_;
+}
+
+NTSTATUS usb_write_mem_complete(PDEVICE_OBJECT	pUsbDevObj, PIRP piowrite_irp, PVOID pusb_cnxt)
+{
+
+	_irqL irqL;
+	_list	*head, *plist;
+	struct io_req	*pio_req;
+	struct io_queue *pio_q = (struct io_queue *) pusb_cnxt;
+	struct intf_hdl *pintf = &(pio_q->intf);
+	struct intf_priv *pintfpriv = pintf->pintfpriv;
+	_adapter *padapter = (_adapter *)pintf->adapter;
+	NTSTATUS status = STATUS_SUCCESS;
+
+	head = &(pio_q->processing);
+
+	_func_enter_;
+
+	_enter_critical_bh(&(pio_q->lock), &irqL);
+
+	pintfpriv->io_irp_cnt--;
+	if(pintfpriv->io_irp_cnt ==0){
+		_rtw_up_sema(&(pintfpriv->io_retevt));
+	}
+
+	pintfpriv->bio_irp_pending=_FALSE;
+
+	switch(piowrite_irp->IoStatus.Status)
+	{
+		case STATUS_SUCCESS:
+			break;
+
+		default:
+			padapter->bSurpriseRemoved=_TRUE;
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usbAsynIntOutComplete:pioread_irp->IoStatus.Status !=STATUS_SUCCESS\n"));
+			break;
+	}
+
+	//free irp in processing list...
+	while(rtw_is_list_empty(head) != _TRUE)
+	{
+		plist = get_next(head);
+		rtw_list_delete(plist);
+		pio_req = LIST_CONTAINOR(plist, struct io_req, list);
+		_rtw_up_sema(&pio_req->sema);
+	}
+
+	_exit_critical_bh(&(pio_q->lock), &irqL);
+
+	_func_exit_;
+
+	return STATUS_MORE_PROCESSING_REQUIRED;
+
+}
+
+void usb_write_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem)
+{
+	u32 bwritezero;
+	_irqL	irqL;
+	USBD_STATUS			usbdstatus;
+	PIO_STACK_LOCATION		nextStack;
+	HANDLE				PipeHandle;
+	struct io_req *pio_req;
+
+	_adapter *adapter = (_adapter *)pintfhdl->adapter;
+	struct intf_priv *pintfpriv = pintfhdl->pintfpriv;
+	struct dvobj_priv   *pdev = (struct dvobj_priv   *)pintfpriv->intf_dev;
+	PURB	piorw_urb = pintfpriv->piorw_urb;
+	PIRP		piorw_irp  = pintfpriv->piorw_irp;
+	struct io_queue	*pio_queue = (struct io_queue *)adapter->pio_queue;
+	NTSTATUS NtStatus = STATUS_SUCCESS;
+
+	_func_enter_;
+
+	pio_req = alloc_ioreq(pio_queue);
+
+	if ((pio_req == NULL)||(adapter->bSurpriseRemoved)){
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("async_irp_write32 : pio_req =0x%x adapter->bSurpriseRemoved=0x%x",pio_req,adapter->bSurpriseRemoved ));
+		goto exit;
+	}
+
+	_enter_critical_bh(&(pio_queue->lock), &irqL);
+
+	rtw_list_insert_tail(&(pio_req->list),&(pio_queue->processing));
+
+
+#ifdef NDIS51_MINIPORT
+	IoReuseIrp(piorw_irp, STATUS_SUCCESS);
+#else
+	piorw_irp->Cancel = _FALSE;
+#endif
+
+	if((adapter->bDriverStopped) || (adapter->bSurpriseRemoved) ||(adapter->pwrctrlpriv.pnp_bstop_trx))
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\npadapter->pwrctrlpriv.pnp_bstop_trx==_TRUE\n"));
+		_func_exit_;
+		return;
+	}
+
+	//translate DMA FIFO addr to pipehandle
+	PipeHandle = ffaddr2pipehdl(pdev, addr);
+
+
+	pintfpriv->io_irp_cnt++;
+	pintfpriv->bio_irp_pending=_TRUE;
+	// Build our URB for USBD
+	UsbBuildInterruptOrBulkTransferRequest(
+				piorw_urb,
+				sizeof(struct _URB_BULK_OR_INTERRUPT_TRANSFER),
+				PipeHandle,
+				(PVOID)wmem,
+				NULL,
+				cnt,
+				0,
+				NULL);
+
+	//
+	// call the calss driver to perform the operation
+	// pass the URB to the USB driver stack
+	//
+	nextStack = IoGetNextIrpStackLocation(piorw_irp);
+	nextStack->MajorFunction = IRP_MJ_INTERNAL_DEVICE_CONTROL;
+	nextStack->Parameters.Others.Argument1 = (PURB)piorw_urb;
+	nextStack->Parameters.DeviceIoControl.IoControlCode = IOCTL_INTERNAL_USB_SUBMIT_URB;
+
+	IoSetCompletionRoutine(
+				piorw_irp,				// irp to use
+				usb_write_mem_complete,		// routine to call when irp is done
+				pio_queue,				// context to pass routine
+				TRUE,					// call on success
+				TRUE,					// call on error
+				TRUE);					// call on cancel
+
+	//
+	// Call IoCallDriver to send the irp to the usb port
+	//
+	NtStatus	= IoCallDriver(pdev->pnextdevobj, piorw_irp);
+	usbdstatus = URB_STATUS(piorw_urb);
+
+	//
+	// The USB driver should always return STATUS_PENDING when
+	// it receives a write irp
+	//
+	if ((NtStatus != STATUS_PENDING) || USBD_HALTED(usbdstatus) ) {
+
+		if( USBD_HALTED(usbdstatus) ) {
+
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_mem():USBD_HALTED(usbdstatus)=%X!\n",USBD_HALTED(usbdstatus)) );
+		}
+		_func_exit_;
+		return;//STATUS_UNSUCCESSFUL;
+	}
+
+	_exit_critical_bh(&(pio_queue->lock), &irqL);
+
+	_rtw_down_sema(&pio_req->sema);
+	free_ioreq(pio_req, pio_queue);
+
+
+	bwritezero = _FALSE;
+       if (pdev->ishighspeed)
+	{
+		if(cnt> 0 && cnt%512 == 0)
+			bwritezero = _TRUE;
+
+	}
+	else
+	{
+		if(cnt > 0 && cnt%64 == 0)
+			bwritezero = _TRUE;
+	}
+
+
+	if(bwritezero == _TRUE)
+	{
+		usb_bulkout_zero(pintfhdl, addr);
+	}
+
+exit:
+
+	_func_exit_;
+
+}
+
+NTSTATUS usb_read_port_complete(PDEVICE_OBJECT pUsbDevObj, PIRP pIrp, PVOID context)
+{
+	uint isevt, *pbuf;
+	struct _URB_BULK_OR_INTERRUPT_TRANSFER	*pbulkurb;
+	USBD_STATUS		usbdstatus;
+	struct recv_buf		*precvbuf = (struct recv_buf *)context;
+	_adapter 				*adapter =(_adapter *)precvbuf->adapter;
+	struct recv_priv		*precvpriv = &adapter->recvpriv;
+	struct dvobj_priv   	*dev = (struct dvobj_priv   *)&adapter->dvobjpriv;
+	PURB				purb = precvbuf->purb;
+	struct intf_hdl 		*pintfhdl = &adapter->pio_queue->intf;
+
+	//RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete!!!\n"));
+
+	usbdstatus = URB_STATUS(purb);
+
+	_rtw_spinlock_ex(&precvpriv->lock);
+	precvbuf->irp_pending=_FALSE;
+	precvpriv->rx_pending_cnt --;
+	_rtw_spinunlock_ex(&precvpriv->lock);
+
+	if(precvpriv->rx_pending_cnt== 0) {
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete: rx_pending_cnt== 0, set allrxreturnevt!\n"));
+		_rtw_up_sema(&precvpriv->allrxreturnevt);
+	}
+
+
+	if( pIrp->Cancel == _TRUE ) {
+
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete: One IRP has been cancelled succesfully\n"));
+		return STATUS_MORE_PROCESSING_REQUIRED;
+	}
+	if(adapter->bSurpriseRemoved) {
+
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete:bDriverStopped(%d) OR bSurpriseRemoved(%d)", adapter->bDriverStopped, adapter->bSurpriseRemoved));
+		return STATUS_MORE_PROCESSING_REQUIRED;
+	}
+
+	switch(pIrp->IoStatus.Status)
+	{
+		case STATUS_SUCCESS:
+
+			pbulkurb = &(precvbuf->purb)->UrbBulkOrInterruptTransfer;
+			if((pbulkurb->TransferBufferLength >(MAX_RECVBUF_SZ)) || (pbulkurb->TransferBufferLength < RXDESC_SIZE) )
+			{
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usb_read_port_complete: (pbulkurb->TransferBufferLength > MAX_RECVBUF_SZ) || (pbulkurb->TransferBufferLength < RXDESC_SIZE)\n"));
+				rtw_read_port(adapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+			}
+			else
+			{
+			       precvbuf->transfer_len = pbulkurb->TransferBufferLength;
+
+				pbuf = (uint*)precvbuf->pbuf;
+
+				if((isevt = *(pbuf+1)&0x1ff) == 0x1ff)
+				{
+					rxcmd_event_hdl(adapter, pbuf);//rx c2h events
+
+					rtw_read_port(adapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+				}
+				else
+				{
+					if(recvbuf2recvframe(adapter, precvbuf)==_FAIL)//rx packets
+					{
+						//precvbuf->reuse = _TRUE;
+						rtw_read_port(adapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+					}
+				}
+
+			}
+
+			break;
+
+		default:
+
+			if( !USBD_HALTED(usbdstatus) )
+			{
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usb_read_port_complete():USBD_HALTED(usbdstatus)=%x  (need to handle ) \n",USBD_HALTED(usbdstatus)));
+
+			}
+			else
+			{
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usb_read_port_complete(): USBD_HALTED(usbdstatus)=%x \n\n", USBD_HALTED(usbdstatus)) );
+				adapter->bDriverStopped = _TRUE;
+				adapter->bSurpriseRemoved = _TRUE;
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_complete(): USBD_HALTED(usbdstatus)=%x \n\n", USBD_HALTED(usbdstatus))) ;
+			}
+
+		      break;
+
+	}
+
+	return STATUS_MORE_PROCESSING_REQUIRED;
+
+}
+
+u32 usb_read_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem)
+{
+	u8 					*pdata;
+	u16					size;
+	PURB				purb;
+	PIRP					pirp;
+	PIO_STACK_LOCATION	nextStack;
+	NTSTATUS			ntstatus;
+	USBD_STATUS		usbdstatus;
+	HANDLE				PipeHandle;
+	struct recv_buf		*precvbuf = (struct recv_buf *)rmem;
+	struct intf_priv		*pintfpriv = pintfhdl->pintfpriv;
+	struct dvobj_priv		*pdev = (struct dvobj_priv   *)pintfpriv->intf_dev;
+	_adapter				*adapter = (_adapter *)pdev->padapter;
+	struct recv_priv		*precvpriv = &adapter->recvpriv;
+	u32					bResult = _FALSE;
+
+_func_enter_;
+
+	if(adapter->bDriverStopped || adapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx) {
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port:( padapter->bDriverStopped ||padapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx)!!!\n"));
+		return bResult;
+	}
+
+	if(precvbuf !=NULL)
+	{
+
+		rtl8192cu_init_recvbuf(adapter, precvbuf);
+
+		_rtw_spinlock(&precvpriv->lock);
+		precvpriv->rx_pending_cnt++;
+		precvbuf->irp_pending = _TRUE;
+		_rtw_spinunlock(&precvpriv->lock);
+
+	       pdata = (u8*)precvbuf->pbuf;
+
+		size	 = sizeof( struct _URB_BULK_OR_INTERRUPT_TRANSFER );
+		purb = precvbuf->purb;
+
+		//translate DMA FIFO addr to pipehandle
+		PipeHandle = ffaddr2pipehdl(pdev, addr);
+
+		UsbBuildInterruptOrBulkTransferRequest(
+			purb,
+			(USHORT)size,
+			PipeHandle,
+			pdata,
+			NULL,
+			MAX_RECVBUF_SZ,
+			USBD_TRANSFER_DIRECTION_IN | USBD_SHORT_TRANSFER_OK,
+			NULL
+			);
+
+		pirp = precvbuf->pirp;
+
+#if NDIS51_MINIPORT
+		IoReuseIrp(pirp, STATUS_SUCCESS);
+#else
+		pirp->Cancel = _FALSE;
+#endif
+
+		// call the class driver to perform the operation
+		// and pass the URB to the USB driver stack
+		nextStack = IoGetNextIrpStackLocation(pirp);
+		nextStack->Parameters.Others.Argument1 = purb;
+		nextStack->Parameters.DeviceIoControl.IoControlCode = IOCTL_INTERNAL_USB_SUBMIT_URB;
+		nextStack->MajorFunction = IRP_MJ_INTERNAL_DEVICE_CONTROL;
+
+		IoSetCompletionRoutine(
+			pirp,					// irp to use
+			usb_read_port_complete,	// routine to call when irp is done
+			precvbuf,					// context to pass routine
+			TRUE,					// call on success
+			TRUE,					// call on error
+			TRUE);					// call on cancel
+
+		//
+		// The IoCallDriver routine
+		// sends an IRP to the driver associated with a specified device object.
+		//
+		ntstatus = IoCallDriver(pdev->pnextdevobj, pirp);
+		usbdstatus = URB_STATUS(purb);
+
+		if( USBD_HALTED(usbdstatus) ) {
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usb_read_port(): USBD_HALTED(usbdstatus=0x%.8x)=%.8x  \n\n", usbdstatus, USBD_HALTED(usbdstatus)));
+			pdev->padapter->bDriverStopped=_TRUE;
+			pdev->padapter->bSurpriseRemoved=_TRUE;
+		}
+
+		if( ntstatus == STATUS_PENDING )
+		{
+			bResult = _TRUE;// The IRP is pended in USBD as we expected.
+		}
+		else {
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port(): IoCallDriver failed!!! IRP STATUS: %X\n", ntstatus));
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port(): IoCallDriver failed!!! USB STATUS: %X\n", usbdstatus));
+		}
+
+	}
+	else{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port:precv_frame ==NULL\n"));
+	}
+
+_func_exit_;
+
+	return bResult;
+
+}
+
+void usb_read_port_cancel(_adapter *padapter)
+{
+	struct recv_buf  *precvbuf;
+	sint i;
+	struct dvobj_priv   *pdev = &padapter->dvobjpriv;
+	struct recv_priv *precvpriv=&padapter->recvpriv;
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n ==>usb_read_port_cancel\n"));
+
+	_rtw_spinlock(&precvpriv->lock);
+	precvpriv->rx_pending_cnt--; //decrease 1 for Initialize ++
+	_rtw_spinunlock(&precvpriv->lock);
+
+	if (precvpriv->rx_pending_cnt)
+	{
+		// Canceling Pending Recv Irp
+		precvbuf = (struct recv_buf  *)precvpriv->precv_buf;
+
+		for( i = 0; i < NR_RECVBUFF; i++ )
+		{
+			if (precvbuf->irp_pending == _TRUE)
+			{
+				IoCancelIrp(precvbuf->pirp);
+				RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_cancel() :IoCancelIrp\n"));
+			}
+
+			precvbuf++;
+		}
+
+		_rtw_down_sema(&precvpriv->allrxreturnevt);
+
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_read_port_cancel:down sema\n"));
+
+	}
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("<==usb_read_port_cancel\n"));
+
+}
+
+NTSTATUS usb_write_port_complete(
+	PDEVICE_OBJECT	pUsbDevObj,
+	PIRP				pIrp,
+	PVOID			pTxContext
+)
+{
+	u32	i, bIrpSuccess, sz;
+	NTSTATUS	status = STATUS_SUCCESS;
+	u8 *ptr;
+	struct xmit_frame	*pxmitframe = (struct xmit_frame *) pTxContext;
+        struct xmit_buf *pxmitbuf = pxmitframe->pxmitbuf;
+	_adapter			*padapter = pxmitframe->padapter;
+	struct dvobj_priv	*pdev =	(struct dvobj_priv *)&padapter->dvobjpriv;
+	struct io_queue	*pio_queue = (struct io_queue *)padapter->pio_queue;
+	struct intf_hdl	*pintfhdl = &(pio_queue->intf);
+       struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+
+_func_enter_;
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("+usb_write_port_complete\n"));
+
+	_rtw_spinlock_ex(&pxmitpriv->lock);
+	pxmitpriv->txirp_cnt--;
+	_rtw_spinunlock_ex(&pxmitpriv->lock);
+
+	if(pxmitpriv->txirp_cnt==0){
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete: txirp_cnt== 0, set allrxreturnevt!\n"));
+		_rtw_up_sema(&(pxmitpriv->tx_retevt));
+	}
+
+	status = pIrp->IoStatus.Status;
+
+	if( status == STATUS_SUCCESS )
+		bIrpSuccess = _TRUE;
+	else
+		bIrpSuccess = _FALSE;
+
+	if( pIrp->Cancel == _TRUE )
+	{
+	    if(pxmitframe !=NULL)
+	    {
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usb_write_port_complete:pIrp->Cancel == _TRUE,(pxmitframe !=NULL\n"));
+			rtw_free_xmitframe(pxmitpriv, pxmitframe);
+	    }
+
+	     return STATUS_MORE_PROCESSING_REQUIRED;
+	}
+
+	if(padapter->bSurpriseRemoved)
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete:bDriverStopped(%d) OR bSurpriseRemoved(%d)", padapter->bDriverStopped, padapter->bSurpriseRemoved));
+		return STATUS_MORE_PROCESSING_REQUIRED;
+	}
+
+
+	//
+	// Send 0-byte here if necessary.
+	//
+	// <Note>
+	// 1. We MUST keep at most one IRP pending in each endpoint, otherwise USB host controler driver will hang.
+	// Besides, even 0-byte IRP shall be count into #IRP sent down, so, we send 0-byte here instead of TxFillDescriptor8187().
+	// 2. If we don't count 0-byte IRP into an #IRP sent down, Tx will stuck when we download files via BT and
+	// play online video on XP SP1 EHCU.
+	// 2005.12.26, by rcnjko.
+	//
+
+
+	for(i=0; i< 8; i++)
+	{
+            if(pIrp == pxmitframe->pxmit_irp[i])
+            {
+		    pxmitframe->bpending[i] = _FALSE;//
+		    //ac_tag = pxmitframe->ac_tag[i];
+                  sz = pxmitframe->sz[i];
+		    break;
+            }
+	}
+
+#if 0
+	pxmitframe->fragcnt--;
+	if(pxmitframe->fragcnt == 0)// if((pxmitframe->fragcnt == 0) && (pxmitframe->irpcnt == 8)){
+	{
+		//RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usb_write_port_complete:pxmitframe->fragcnt == 0\n"));
+		rtw_free_xmitframe(pxmitpriv,pxmitframe);
+	}
+#else
+
+	//not to consider tx fragment
+	rtw_free_xmitframe(pxmitpriv, pxmitframe);
+
+#endif
+
+	rtl8192cu_xmitframe_complete(padapter, pxmitpriv, pxmitbuf);
+
+_func_exit_;
+
+	return STATUS_MORE_PROCESSING_REQUIRED;
+
+}
+
+u32 usb_write_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem)
+{
+       u32 i, bwritezero;
+	u8 *ptr;
+	PIO_STACK_LOCATION	nextStack;
+	USBD_STATUS		usbdstatus;
+	HANDLE				PipeHandle;
+	PIRP					pirp = NULL;
+	PURB				purb = NULL;
+	NDIS_STATUS			ndisStatus = NDIS_STATUS_SUCCESS;
+	_adapter *padapter = (_adapter *)pintfhdl->adapter;
+	struct dvobj_priv	*pNdisCEDvice = (struct dvobj_priv   *)&padapter->dvobjpriv;
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+	struct xmit_frame *pxmitframe = (struct xmit_frame *)wmem;
+
+_func_enter_;
+
+	if((padapter->bDriverStopped) || (padapter->bSurpriseRemoved) ||(padapter->pwrctrlpriv.pnp_bstop_trx))
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port:( padapter->bDriverStopped ||padapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx)!!!\n"));
+		return _FAIL;
+	}
+
+
+	for(i=0; i<8; i++)
+       {
+		if(pxmitframe->bpending[i] == _FALSE)
+		{
+			_rtw_spinlock(&pxmitpriv->lock);
+			pxmitpriv->txirp_cnt++;
+			pxmitframe->bpending[i]  = _TRUE;
+			_rtw_spinunlock(&pxmitpriv->lock);
+
+			pxmitframe->sz[i] = cnt;
+			purb	= pxmitframe->pxmit_urb[i];
+			pirp	= pxmitframe->pxmit_irp[i];
+
+			//pxmitframe->ac_tag[i] = ac_tag;
+
+			break;
+		}
+       }
+
+	bwritezero = _FALSE;
+       if (pNdisCEDvice->ishighspeed)
+	{
+		if(cnt> 0 && cnt%512 == 0)
+		{
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("ishighspeed, cnt=%d\n", cnt));
+			//cnt=cnt+1;
+			bwritezero = _TRUE;
+		}
+	}
+	else
+	{
+		if(cnt > 0 && cnt%64 == 0)
+		{
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("cnt=%d\n", cnt));
+			//cnt=cnt+1;
+			bwritezero = _TRUE;
+		}
+	}
+
+
+#ifdef NDIS51_MINIPORT
+	IoReuseIrp(pirp, STATUS_SUCCESS);
+#else
+	pirp->Cancel = _FALSE;
+#endif
+
+
+	//translate DMA FIFO addr to pipehandle
+	PipeHandle = ffaddr2pipehdl(pNdisCEDvice, addr);
+
+
+	// Build our URB for USBD
+	UsbBuildInterruptOrBulkTransferRequest(
+				purb,
+				sizeof(struct _URB_BULK_OR_INTERRUPT_TRANSFER),
+				PipeHandle,
+				pxmitframe->mem_addr,
+				NULL,
+				cnt,
+				0,
+				NULL);
+
+	//
+	// call the calss driver to perform the operation
+	// pass the URB to the USB driver stack
+	//
+	nextStack = IoGetNextIrpStackLocation(pirp);
+	nextStack->MajorFunction = IRP_MJ_INTERNAL_DEVICE_CONTROL;
+	nextStack->Parameters.Others.Argument1 = purb;
+	nextStack->Parameters.DeviceIoControl.IoControlCode = IOCTL_INTERNAL_USB_SUBMIT_URB;
+
+	//Set Completion Routine
+	IoSetCompletionRoutine(pirp,					// irp to use
+				               usb_write_port_complete,	// callback routine
+				               pxmitframe,				// context
+				               TRUE,					// call on success
+				               TRUE,					// call on error
+				               TRUE);					// call on cancel
+
+
+	// Call IoCallDriver to send the irp to the usb bus driver
+	//
+	ndisStatus = IoCallDriver(pNdisCEDvice->pnextdevobj, pirp);
+	usbdstatus = URB_STATUS(purb);
+
+	if( USBD_HALTED(usbdstatus) )
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usb_write_port(): USBD_HALTED(usbdstatus)=%x set bDriverStopped TRUE!\n\n",USBD_HALTED(usbdstatus)) );
+		padapter->bDriverStopped=_TRUE;
+		padapter->bSurpriseRemoved=_TRUE;
+	}
+
+	//
+	// The usb bus driver should always return STATUS_PENDING when bulk out irp async
+	//
+	if ( ndisStatus != STATUS_PENDING )
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("\n usb_write_port(): ndisStatus(%x) != STATUS_PENDING!\n\n", ndisStatus));
+
+		_func_exit_;
+
+		return _FAIL;
+	}
+
+	if(bwritezero == _TRUE)
+	{
+		usb_bulkout_zero(pintfhdl, addr);
+	}
+
+
+_func_exit_;
+
+	return _SUCCESS;
+
+}
+
+
+void usb_write_port_cancel(_adapter *padapter)
+{
+
+	sint i,j;
+	struct dvobj_priv   *pdev = &padapter->dvobjpriv;
+	struct xmit_priv *pxmitpriv=&padapter->xmitpriv;
+	struct xmit_frame *pxmitframe;
+
+	_rtw_spinlock(&pxmitpriv->lock);
+	pxmitpriv->txirp_cnt--; //decrease 1 for Initialize ++
+	_rtw_spinunlock(&pxmitpriv->lock);
+
+	if (pxmitpriv->txirp_cnt)
+	{
+		// Canceling Pending Recv Irp
+		pxmitframe= (struct xmit_frame *)pxmitpriv->pxmit_frame_buf;
+
+		for( i = 0; i < NR_XMITFRAME; i++ )
+		{
+			for(j=0;j<8;j++)
+			{
+				if (pxmitframe->bpending[j]==_TRUE)
+				{
+					IoCancelIrp(pxmitframe->pxmit_irp[j]);
+					RT_TRACE(_module_hci_ops_os_c_,_drv_err_,(" usb_write_port_cancel() :IoCancelIrp\n"));
+
+				}
+			}
+
+			pxmitframe++;
+		}
+
+		_rtw_down_sema(&(pxmitpriv->tx_retevt));
+
+	}
+
+}
+
+
+/*! \brief Wrap the pUrb to an IRP and send this IRP to Bus Driver. Then wait for this IRP completion.
+	The Caller shall be at Passive Level.
+*/
+NTSTATUS  sync_callusbd(struct dvobj_priv *pdvobjpriv, PURB purb)
+{
+
+	KEVENT					kevent;
+	PIRP						irp;
+	IO_STATUS_BLOCK		iostatusblock;
+	PIO_STACK_LOCATION		nextstack;
+	USBD_STATUS			usbdstatus;
+	LARGE_INTEGER			waittime;
+	NTSTATUS ntstatus = STATUS_SUCCESS;
+	_adapter *padapter = pdvobjpriv->padapter;
+
+
+	_func_enter_;
+
+//	if(padapter->bDriverStopped) {
+//		goto exit;
+//	}
+
+	KeInitializeEvent(&kevent, NotificationEvent, _FALSE);
+	irp = IoBuildDeviceIoControlRequest(
+			IOCTL_INTERNAL_USB_SUBMIT_URB,
+			pdvobjpriv->pphysdevobj,//CEdevice->pUsbDevObj,
+			NULL,
+			0,
+			NULL,
+			0,
+			_TRUE,
+			&kevent,
+			&iostatusblock);
+
+	if(irp == NULL) {
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("SyncCallUSBD: memory alloc for irp failed\n"));
+		ntstatus=STATUS_INSUFFICIENT_RESOURCES;
+		goto exit;
+	}
+
+	nextstack = IoGetNextIrpStackLocation(irp);
+	if(nextstack == NULL)
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("IoGetNextIrpStackLocation fail\n"));
+
+	nextstack->Parameters.Others.Argument1 = purb;
+
+	// Issue an IRP for Sync IO.
+	ntstatus = IoCallDriver(pdvobjpriv->pphysdevobj, irp);
+	usbdstatus = URB_STATUS(purb);
+
+	if(ntstatus == STATUS_PENDING)
+	{
+		// Method 1
+		waittime.QuadPart = -10000 * 50000;
+		ntstatus = KeWaitForSingleObject(&kevent, Executive, KernelMode, _FALSE, &waittime); //8150 code
+
+		// Method 2
+		//ntStatus = KeWaitForSingleObject(&Kevent, Executive, KernelMode, FALSE, NULL); //DDK sample
+
+		usbdstatus = URB_STATUS(purb);
+
+		if(ntstatus == STATUS_TIMEOUT)
+		{
+			//usbdevice->nIoStuckCnt++;
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("SyncCallUSBD: TIMEOUT....5000ms\n"));
+
+			// Method 2
+			IoCancelIrp(irp);
+			ntstatus = KeWaitForSingleObject(&kevent, Executive, KernelMode, _FALSE, NULL); //DDK sample
+			usbdstatus = URB_STATUS(purb);
+
+			usbdstatus = USBD_STATUS_SUCCESS;
+		}
+
+	}
+
+exit:
+
+	_func_exit_;
+
+	return ntstatus;
+
+}
+int usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value, u16 index, void *pdata, u16 len, u8 requesttype)
+{
+	PURB			purb;
+	u8				ret;
+	unsigned long		transferflags;
+	NTSTATUS		ntstatus;
+
+	struct dvobj_priv  *pdvobjpriv = (struct dvobj_priv  *)pintfpriv->intf_dev;
+
+	_func_enter_;
+
+	ret=_TRUE;
+	purb = (PURB)ExAllocatePool(NonPagedPool, sizeof(struct _URB_CONTROL_VENDOR_OR_CLASS_REQUEST) );
+	if(purb == NULL) {
+
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usbctrl_vendorreq(): Failed to allocate urb !!!\n"));
+		ret =_FALSE;
+		goto exit;
+	}
+
+	if (requesttype == 0x01) {
+		transferflags = USBD_TRANSFER_DIRECTION_IN;//read_in
+	} else {
+		transferflags= 0;//write_out
+	}
+
+	UsbBuildVendorRequest(
+			purb, 		//Pointer to an URB that is to be formatted as a vendor or class request.
+			URB_FUNCTION_VENDOR_DEVICE,	//Indicates the URB is a vendor-defined request for a USB device.
+			sizeof(struct _URB_CONTROL_VENDOR_OR_CLASS_REQUEST),  //Specifies the length, in bytes, of the URB.
+			transferflags, 	//TransferFlags
+			0,			//ReservedBits
+			request, 	//Request
+			value, 		//Value
+			index,		//Index
+			pdata,		//TransferBuffer
+			NULL,		//TransferBufferMDL
+			len,			//TransferBufferLength
+			NULL		//Link
+	);
+
+	ntstatus = sync_callusbd(pdvobjpriv, purb);
+	if(!NT_SUCCESS(ntstatus))
+	{
+		ExFreePool(purb);
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,(" usbctrl_vendorreq() : SOMETHING WRONG\n") );
+		ret = _FALSE;
+		goto exit;
+	}
+
+	ExFreePool(purb);
+
+exit:
+	_func_exit_;
+
+	return ret;
+
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/ifcfg-wlan0 b/drivers/net/wireless/realtek/rtl8192cu/ifcfg-wlan0
new file mode 100755
index 000000000000..7ecb7ae62c7f
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/ifcfg-wlan0
@@ -0,0 +1,4 @@
+#DHCP client
+DEVICE=wlan0
+BOOTPROTO=dhcp
+ONBOOT=yes
\ No newline at end of file
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CEHWImg.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CEHWImg.h
new file mode 100644
index 000000000000..2ae36e452ce3
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CEHWImg.h
@@ -0,0 +1,85 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __INC_HAL8192CE_FW_IMG_H
+#define __INC_HAL8192CE_FW_IMG_H
+
+#include <basic_types.h>
+
+/*Created on  2011/ 6/15,  5:45*/
+
+#ifdef CONFIG_BT_COEXISTENCE
+#define TSMCImgArrayLength 15706 //v84 TSMC COMMON 2012-04-13
+#else //#ifdef CONFIG_P2P
+#define TSMCImgArrayLength 16126 //v88 TSMC P2PPS with CCX report C2H 2012-12-05
+#endif
+extern u8 Rtl8192CEFwTSMCImgArray[TSMCImgArrayLength];
+
+#ifdef CONFIG_BT_COEXISTENCE
+#define UMCACutImgArrayLength 16248 //v79 UMC A Cut COMMON 2011-10-06
+#else //#ifdef CONFIG_P2P
+#define UMCACutImgArrayLength 16126 //v88 UMC A Cut P2PPS with CCX report C2H 2012-12-05
+#endif
+extern u8 Rtl8192CEFwUMCACutImgArray[UMCACutImgArrayLength];
+
+#ifdef CONFIG_BT_COEXISTENCE
+#define UMCBCutImgArrayLength 15686 //v84 UMC B Cut COMMON 2012-04-13
+#else //#ifdef CONFIG_P2P
+#define UMCBCutImgArrayLength 16096 //v88 UMC B Cut P2PPS with CCX report C2H 2012-12-05
+#endif
+extern u8 Rtl8192CEFwUMCBCutImgArray[UMCBCutImgArrayLength];
+
+//8192C_Formal_92CE_PHYforMP_110804 2011-11-23
+//8188C_Formal_88CE_PHYforMP_111117 2011-11-23
+
+#define PHY_REG_2TArrayLength 374
+extern u32 Rtl8192CEPHY_REG_2TArray[PHY_REG_2TArrayLength];
+#define PHY_REG_1TArrayLength 374
+extern u32 Rtl8192CEPHY_REG_1TArray[PHY_REG_1TArrayLength];
+#define PHY_ChangeTo_1T1RArrayLength 1
+extern u32 Rtl8192CEPHY_ChangeTo_1T1RArray[PHY_ChangeTo_1T1RArrayLength];
+#define PHY_ChangeTo_1T2RArrayLength 1
+extern u32 Rtl8192CEPHY_ChangeTo_1T2RArray[PHY_ChangeTo_1T2RArrayLength];
+#define PHY_ChangeTo_2T2RArrayLength 1
+extern u32 Rtl8192CEPHY_ChangeTo_2T2RArray[PHY_ChangeTo_2T2RArrayLength];
+#define PHY_REG_Array_PGLength 336
+extern u32 Rtl8192CEPHY_REG_Array_PG[PHY_REG_Array_PGLength];
+#define PHY_REG_Array_MPLength 4
+extern u32 Rtl8192CEPHY_REG_Array_MP[PHY_REG_Array_MPLength];
+#define RadioA_2TArrayLength 282
+extern u32 Rtl8192CERadioA_2TArray[RadioA_2TArrayLength];
+#define RadioB_2TArrayLength 78
+extern u32 Rtl8192CERadioB_2TArray[RadioB_2TArrayLength];
+#define RadioA_1TArrayLength 282
+extern u32 Rtl8192CERadioA_1TArray[RadioA_1TArrayLength];
+#define RadioB_1TArrayLength 1
+extern u32 Rtl8192CERadioB_1TArray[RadioB_1TArrayLength];
+#define RadioB_GM_ArrayLength 1
+extern u32 Rtl8192CERadioB_GM_Array[RadioB_GM_ArrayLength];
+// MAC reg V14 - 2011-11-23
+#define MAC_2T_ArrayLength 174
+extern u32 Rtl8192CEMAC_2T_Array[MAC_2T_ArrayLength];
+#define MACPHY_Array_PGLength 1
+extern u32 Rtl8192CEMACPHY_Array_PG[MACPHY_Array_PGLength];
+#define AGCTAB_2TArrayLength 320
+extern u32 Rtl8192CEAGCTAB_2TArray[AGCTAB_2TArrayLength];
+#define AGCTAB_1TArrayLength 320
+extern u32 Rtl8192CEAGCTAB_1TArray[AGCTAB_1TArrayLength];
+
+#endif //__INC_HAL8192CE_FW_IMG_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CPhyCfg.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CPhyCfg.h
new file mode 100644
index 000000000000..918b52056124
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CPhyCfg.h
@@ -0,0 +1,427 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*****************************************************************************
+ * Module:	__INC_HAL8192CPHYCFG_H
+ *
+ *
+ * Note:
+ *
+ *
+ * Export:	Constants, macro, functions(API), global variables(None).
+ *
+ * Abbrev:
+ *
+ * History:
+ *		Data		Who		Remark
+ *      08/07/2007  MHC    	1. Porting from 9x series PHYCFG.h.
+ *							2. Reorganize code architecture.
+ *
+ *****************************************************************************/
+ /* Check to see if the file has been included already.  */
+#ifndef __INC_HAL8192CPHYCFG_H
+#define __INC_HAL8192CPHYCFG_H
+
+
+/*--------------------------Define Parameters-------------------------------*/
+#define LOOP_LIMIT				5
+#define MAX_STALL_TIME			50		//us
+#define AntennaDiversityValue	0x80	//(Adapter->bSoftwareAntennaDiversity ? 0x00:0x80)
+#define MAX_TXPWR_IDX_NMODE_92S	63
+#define Reset_Cnt_Limit			3
+
+#define IQK_MAC_REG_NUM		4
+#define IQK_ADDA_REG_NUM		16
+#define IQK_BB_REG_NUM			9
+#define HP_THERMAL_NUM		8
+
+#ifdef CONFIG_PCI_HCI
+#define MAX_AGGR_NUM	0x0A0A
+#else
+#define MAX_AGGR_NUM	0x0909
+#endif
+
+#ifdef CONFIG_PCI_HCI
+#define	SET_RTL8192SE_RF_SLEEP(_pAdapter)							\
+{																	\
+	u1Byte		u1bTmp;												\
+	u1bTmp = PlatformEFIORead1Byte(_pAdapter, REG_LDOV12D_CTRL);		\
+	u1bTmp |= BIT0;													\
+	PlatformEFIOWrite1Byte(_pAdapter, REG_LDOV12D_CTRL, u1bTmp);		\
+	PlatformEFIOWrite1Byte(_pAdapter, REG_SPS_OCP_CFG, 0x0);				\
+	PlatformEFIOWrite1Byte(_pAdapter, TXPAUSE, 0xFF);				\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x57FC);				\
+	delay_us(100);													\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x77FC);				\
+	PlatformEFIOWrite1Byte(_pAdapter, PHY_CCA, 0x0);				\
+	delay_us(10);													\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x37FC);				\
+	delay_us(10);													\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x77FC);				\
+	delay_us(10);													\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x57FC);				\
+}
+#endif
+
+
+/*--------------------------Define Parameters-------------------------------*/
+
+
+/*------------------------------Define structure----------------------------*/
+typedef enum _SwChnlCmdID{
+	CmdID_End,
+	CmdID_SetTxPowerLevel,
+	CmdID_BBRegWrite10,
+	CmdID_WritePortUlong,
+	CmdID_WritePortUshort,
+	CmdID_WritePortUchar,
+	CmdID_RF_WriteReg,
+}SwChnlCmdID;
+
+
+/* 1. Switch channel related */
+typedef struct _SwChnlCmd{
+	SwChnlCmdID	CmdID;
+	u32			Para1;
+	u32			Para2;
+	u32			msDelay;
+}SwChnlCmd;
+
+typedef enum _HW90_BLOCK{
+	HW90_BLOCK_MAC = 0,
+	HW90_BLOCK_PHY0 = 1,
+	HW90_BLOCK_PHY1 = 2,
+	HW90_BLOCK_RF = 3,
+	HW90_BLOCK_MAXIMUM = 4, // Never use this
+}HW90_BLOCK_E, *PHW90_BLOCK_E;
+
+#define	RF_PATH_MAX			2
+
+#define CHANNEL_MAX_NUMBER		14	// 14 is the max channel number
+#define CHANNEL_GROUP_MAX		3	// ch1~3, ch4~9, ch10~14 total three groups
+
+typedef enum _WIRELESS_MODE {
+	WIRELESS_MODE_UNKNOWN = 0x00,
+	WIRELESS_MODE_A = 0x01,
+	WIRELESS_MODE_B = 0x02,
+	WIRELESS_MODE_G = 0x04,
+	WIRELESS_MODE_AUTO = 0x08,
+	WIRELESS_MODE_N_24G = 0x10,
+	WIRELESS_MODE_N_5G = 0x20
+} WIRELESS_MODE;
+
+typedef enum _BaseBand_Config_Type{
+	BaseBand_Config_PHY_REG = 0,			//Radio Path A
+	BaseBand_Config_AGC_TAB = 1,			//Radio Path B
+}BaseBand_Config_Type, *PBaseBand_Config_Type;
+
+
+typedef enum _PHY_Rate_Tx_Power_Offset_Area{
+	RA_OFFSET_LEGACY_OFDM1,
+	RA_OFFSET_LEGACY_OFDM2,
+	RA_OFFSET_HT_OFDM1,
+	RA_OFFSET_HT_OFDM2,
+	RA_OFFSET_HT_OFDM3,
+	RA_OFFSET_HT_OFDM4,
+	RA_OFFSET_HT_CCK,
+}RA_OFFSET_AREA,*PRA_OFFSET_AREA;
+
+
+/* BB/RF related */
+typedef	enum _RF_TYPE_8190P{
+	RF_TYPE_MIN,	// 0
+	RF_8225=1,			// 1 11b/g RF for verification only
+	RF_8256=2,			// 2 11b/g/n
+	RF_8258=3,			// 3 11a/b/g/n RF
+	RF_6052=4,		// 4 11b/g/n RF
+	//RF_6052=5,		// 4 11b/g/n RF
+	// TODO: We sholud remove this psudo PHY RF after we get new RF.
+	RF_PSEUDO_11N=5,	// 5, It is a temporality RF.
+}RF_TYPE_8190P_E,*PRF_TYPE_8190P_E;
+
+typedef struct _BB_REGISTER_DEFINITION{
+	u32 rfintfs;			// set software control:
+							//		0x870~0x877[8 bytes]
+
+	u32 rfintfi;			// readback data:
+							//		0x8e0~0x8e7[8 bytes]
+
+	u32 rfintfo; 		// output data:
+							//		0x860~0x86f [16 bytes]
+
+	u32 rfintfe; 		// output enable:
+							//		0x860~0x86f [16 bytes]
+
+	u32 rf3wireOffset;	// LSSI data:
+							//		0x840~0x84f [16 bytes]
+
+	u32 rfLSSI_Select;	// BB Band Select:
+							//		0x878~0x87f [8 bytes]
+
+	u32 rfTxGainStage;	// Tx gain stage:
+							//		0x80c~0x80f [4 bytes]
+
+	u32 rfHSSIPara1; 	// wire parameter control1 :
+							//		0x820~0x823,0x828~0x82b, 0x830~0x833, 0x838~0x83b [16 bytes]
+
+	u32 rfHSSIPara2; 	// wire parameter control2 :
+							//		0x824~0x827,0x82c~0x82f, 0x834~0x837, 0x83c~0x83f [16 bytes]
+
+	u32 rfSwitchControl; //Tx Rx antenna control :
+							//		0x858~0x85f [16 bytes]
+
+	u32 rfAGCControl1; 	//AGC parameter control1 :
+							//		0xc50~0xc53,0xc58~0xc5b, 0xc60~0xc63, 0xc68~0xc6b [16 bytes]
+
+	u32 rfAGCControl2; 	//AGC parameter control2 :
+							//		0xc54~0xc57,0xc5c~0xc5f, 0xc64~0xc67, 0xc6c~0xc6f [16 bytes]
+
+	u32 rfRxIQImbalance; //OFDM Rx IQ imbalance matrix :
+							//		0xc14~0xc17,0xc1c~0xc1f, 0xc24~0xc27, 0xc2c~0xc2f [16 bytes]
+
+	u32 rfRxAFE;  		//Rx IQ DC ofset and Rx digital filter, Rx DC notch filter :
+							//		0xc10~0xc13,0xc18~0xc1b, 0xc20~0xc23, 0xc28~0xc2b [16 bytes]
+
+	u32 rfTxIQImbalance; //OFDM Tx IQ imbalance matrix
+							//		0xc80~0xc83,0xc88~0xc8b, 0xc90~0xc93, 0xc98~0xc9b [16 bytes]
+
+	u32 rfTxAFE; 		//Tx IQ DC Offset and Tx DFIR type
+							//		0xc84~0xc87,0xc8c~0xc8f, 0xc94~0xc97, 0xc9c~0xc9f [16 bytes]
+
+	u32 rfLSSIReadBack; 	//LSSI RF readback data SI mode
+								//		0x8a0~0x8af [16 bytes]
+
+	u32 rfLSSIReadBackPi; 	//LSSI RF readback data PI mode 0x8b8-8bc for Path A and B
+
+}BB_REGISTER_DEFINITION_T, *PBB_REGISTER_DEFINITION_T;
+
+#ifdef CONFIG_MP_INCLUDED
+typedef enum _ANTENNA_PATH{
+        ANTENNA_NONE 	= 0x00,
+		ANTENNA_D		,
+		ANTENNA_C		,
+		ANTENNA_CD		,
+		ANTENNA_B		,
+		ANTENNA_BD		,
+		ANTENNA_BC		,
+		ANTENNA_BCD		,
+		ANTENNA_A		,
+		ANTENNA_AD		,
+		ANTENNA_AC		,
+		ANTENNA_ACD		,
+		ANTENNA_AB		,
+		ANTENNA_ABD		,
+		ANTENNA_ABC		,
+		ANTENNA_ABCD
+} ANTENNA_PATH;
+#endif
+
+typedef struct _R_ANTENNA_SELECT_OFDM{
+	u32			r_tx_antenna:4;
+	u32			r_ant_l:4;
+	u32			r_ant_non_ht:4;
+	u32			r_ant_ht1:4;
+	u32			r_ant_ht2:4;
+	u32			r_ant_ht_s1:4;
+	u32			r_ant_non_ht_s1:4;
+	u32			OFDM_TXSC:2;
+	u32			Reserved:2;
+}R_ANTENNA_SELECT_OFDM;
+
+typedef struct _R_ANTENNA_SELECT_CCK{
+	u8			r_cckrx_enable_2:2;
+	u8			r_cckrx_enable:2;
+	u8			r_ccktx_enable:4;
+}R_ANTENNA_SELECT_CCK;
+
+/*------------------------------Define structure----------------------------*/
+
+
+/*------------------------Export global variable----------------------------*/
+/*------------------------Export global variable----------------------------*/
+
+
+/*------------------------Export Marco Definition---------------------------*/
+/*------------------------Export Marco Definition---------------------------*/
+
+
+/*--------------------------Exported Function prototype---------------------*/
+//
+// BB and RF register read/write
+//
+u32	rtl8192c_PHY_QueryBBReg(	IN	PADAPTER	Adapter,
+								IN	u32		RegAddr,
+								IN	u32		BitMask	);
+void	rtl8192c_PHY_SetBBReg(	IN	PADAPTER	Adapter,
+								IN	u32		RegAddr,
+								IN	u32		BitMask,
+								IN	u32		Data	);
+u32	rtl8192c_PHY_QueryRFReg(	IN	PADAPTER			Adapter,
+								IN	RF_RADIO_PATH_E	eRFPath,
+								IN	u32				RegAddr,
+								IN	u32				BitMask	);
+void	rtl8192c_PHY_SetRFReg(	IN	PADAPTER			Adapter,
+								IN	RF_RADIO_PATH_E	eRFPath,
+								IN	u32				RegAddr,
+								IN	u32				BitMask,
+								IN	u32				Data	);
+
+//
+// Initialization related function
+//
+/* MAC/BB/RF HAL config */
+int	PHY_MACConfig8192C(	IN	PADAPTER	Adapter	);
+int	PHY_BBConfig8192C(	IN	PADAPTER	Adapter	);
+int	PHY_RFConfig8192C(	IN	PADAPTER	Adapter	);
+/* RF config */
+int	rtl8192c_PHY_ConfigRFWithParaFile(	IN	PADAPTER	Adapter,
+												IN	u8* 	pFileName,
+												IN	RF_RADIO_PATH_E	eRFPath);
+int	rtl8192c_PHY_ConfigRFWithHeaderFile(	IN	PADAPTER			Adapter,
+												IN	RF_RADIO_PATH_E	eRFPath);
+
+/* BB/RF readback check for making sure init OK */
+int	rtl8192c_PHY_CheckBBAndRFOK(	IN	PADAPTER			Adapter,
+										IN	HW90_BLOCK_E		CheckBlock,
+										IN	RF_RADIO_PATH_E	eRFPath	  );
+/* Read initi reg value for tx power setting. */
+void	rtl8192c_PHY_GetHWRegOriginalValue(	IN	PADAPTER		Adapter	);
+
+//
+// RF Power setting
+//
+//extern	BOOLEAN	PHY_SetRFPowerState(IN	PADAPTER			Adapter,
+//									IN	RT_RF_POWER_STATE	eRFPowerState);
+
+//
+// BB TX Power R/W
+//
+void	PHY_GetTxPowerLevel8192C(	IN	PADAPTER		Adapter,
+											OUT u32*    		powerlevel	);
+void	PHY_SetTxPowerLevel8192C(	IN	PADAPTER		Adapter,
+											IN	u8			channel	);
+BOOLEAN	PHY_UpdateTxPowerDbm8192C(	IN	PADAPTER	Adapter,
+											IN	int		powerInDbm	);
+
+//
+VOID
+PHY_ScanOperationBackup8192C(IN	PADAPTER	Adapter,
+										IN	u8		Operation	);
+
+//
+// Switch bandwidth for 8192S
+//
+//extern	void	PHY_SetBWModeCallback8192C(	IN	PRT_TIMER		pTimer	);
+void	PHY_SetBWMode8192C(	IN	PADAPTER			pAdapter,
+									IN	HT_CHANNEL_WIDTH	ChnlWidth,
+									IN	unsigned char	Offset	);
+
+//
+// Set FW CMD IO for 8192S.
+//
+//extern	BOOLEAN HalSetIO8192C(	IN	PADAPTER			Adapter,
+//									IN	IO_TYPE				IOType);
+
+//
+// Set A2 entry to fw for 8192S
+//
+extern	void FillA2Entry8192C(		IN	PADAPTER			Adapter,
+										IN	u8				index,
+										IN	u8*				val);
+
+
+//
+// channel switch related funciton
+//
+//extern	void	PHY_SwChnlCallback8192C(	IN	PRT_TIMER		pTimer	);
+void	PHY_SwChnl8192C(	IN	PADAPTER		pAdapter,
+									IN	u8			channel	);
+				// Call after initialization
+void	PHY_SwChnlPhy8192C(	IN	PADAPTER		pAdapter,
+									IN	u8			channel	);
+
+void ChkFwCmdIoDone(	IN	PADAPTER	Adapter);
+
+#ifdef USE_WORKITEM
+//extern 	void SetIOWorkItemCallback( IN PVOID            pContext );
+#else
+//extern	void SetIOTimerCallback( IN PRT_TIMER		pTimer);
+#endif
+
+//
+// BB/MAC/RF other monitor API
+//
+void	PHY_SetMonitorMode8192C(IN	PADAPTER	pAdapter,
+										IN	BOOLEAN		bEnableMonitorMode	);
+
+BOOLEAN	PHY_CheckIsLegalRfPath8192C(IN	PADAPTER	pAdapter,
+											IN	u32		eRFPath	);
+
+//
+// IQ calibrate
+//
+VOID rtl8192c_PHY_IQCalibrate( IN PADAPTER pAdapter , IN BOOLEAN bReCovery);
+
+//
+// LC calibrate
+//
+VOID rtl8192c_PHY_LCCalibrate(IN	PADAPTER	pAdapter);
+
+//
+// AP calibrate
+//
+VOID rtl8192c_PHY_APCalibrate(IN	PADAPTER	pAdapter, IN 	char		delta);
+
+VOID rtl8192c_PHY_SetRFPathSwitch(IN	PADAPTER	pAdapter, IN	BOOLEAN		bMain);
+
+//
+// Modify the value of the hw register when beacon interval be changed.
+//
+void
+rtl8192c_PHY_SetBeaconHwReg(	IN	PADAPTER		Adapter,
+					IN	u16			BeaconInterval	);
+
+
+extern	VOID
+PHY_SwitchEphyParameter(
+	IN	PADAPTER			Adapter
+	);
+
+extern	VOID
+PHY_EnableHostClkReq(
+	IN	PADAPTER			Adapter
+	);
+
+BOOLEAN
+SetAntennaConfig92C(
+	IN	PADAPTER	Adapter,
+	IN	u8		DefaultAnt
+	);
+
+
+/*--------------------------Exported Function prototype---------------------*/
+
+#define PHY_QueryBBReg(Adapter, RegAddr, BitMask) rtl8192c_PHY_QueryBBReg((Adapter), (RegAddr), (BitMask))
+#define PHY_SetBBReg(Adapter, RegAddr, BitMask, Data) rtl8192c_PHY_SetBBReg((Adapter), (RegAddr), (BitMask), (Data))
+#define PHY_QueryRFReg(Adapter, eRFPath, RegAddr, BitMask) rtl8192c_PHY_QueryRFReg((Adapter), (eRFPath), (RegAddr), (BitMask))
+#define PHY_SetRFReg(Adapter, eRFPath, RegAddr, BitMask, Data) rtl8192c_PHY_SetRFReg((Adapter), (eRFPath), (RegAddr), (BitMask), (Data))
+
+#define PHY_SetMacReg	PHY_SetBBReg
+
+#endif	// __INC_HAL8192CPHYCFG_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CPhyReg.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CPhyReg.h
new file mode 100644
index 000000000000..746326edbf11
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CPhyReg.h
@@ -0,0 +1,1122 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*****************************************************************************
+ *
+ * Module:	__INC_HAL8192CPHYREG_H
+ *
+ *
+ * Note:	1. Define PMAC/BB register map
+ *			2. Define RF register map
+ *			3. PMAC/BB register bit mask.
+ *			4. RF reg bit mask.
+ *			5. Other BB/RF relative definition.
+ *
+ *
+ * Export:	Constants, macro, functions(API), global variables(None).
+ *
+ * Abbrev:
+ *
+ * History:
+ *		Data		Who		Remark
+ *      08/07/2007  MHC    	1. Porting from 9x series PHYCFG.h.
+ *							2. Reorganize code architecture.
+ *	09/25/2008	MH		1. Add RL6052 register definition
+ *
+ *****************************************************************************/
+#ifndef __INC_HAL8192CPHYREG_H
+#define __INC_HAL8192CPHYREG_H
+
+
+/*--------------------------Define Parameters-------------------------------*/
+
+//============================================================
+//       8192S Regsiter offset definition
+//============================================================
+
+//
+// BB-PHY register PMAC 0x100 PHY 0x800 - 0xEFF
+// 1. PMAC duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF
+// 2. 0x800/0x900/0xA00/0xC00/0xD00/0xE00
+// 3. RF register 0x00-2E
+// 4. Bit Mask for BB/RF register
+// 5. Other defintion for BB/RF R/W
+//
+
+
+//
+// 1. PMAC duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF
+// 1. Page1(0x100)
+//
+#define		rPMAC_Reset					0x100
+#define		rPMAC_TxStart					0x104
+#define		rPMAC_TxLegacySIG				0x108
+#define		rPMAC_TxHTSIG1				0x10c
+#define		rPMAC_TxHTSIG2				0x110
+#define		rPMAC_PHYDebug				0x114
+#define		rPMAC_TxPacketNum				0x118
+#define		rPMAC_TxIdle					0x11c
+#define		rPMAC_TxMACHeader0			0x120
+#define		rPMAC_TxMACHeader1			0x124
+#define		rPMAC_TxMACHeader2			0x128
+#define		rPMAC_TxMACHeader3			0x12c
+#define		rPMAC_TxMACHeader4			0x130
+#define		rPMAC_TxMACHeader5			0x134
+#define		rPMAC_TxDataType				0x138
+#define		rPMAC_TxRandomSeed			0x13c
+#define		rPMAC_CCKPLCPPreamble			0x140
+#define		rPMAC_CCKPLCPHeader			0x144
+#define		rPMAC_CCKCRC16				0x148
+#define		rPMAC_OFDMRxCRC32OK			0x170
+#define		rPMAC_OFDMRxCRC32Er			0x174
+#define		rPMAC_OFDMRxParityEr			0x178
+#define		rPMAC_OFDMRxCRC8Er			0x17c
+#define		rPMAC_CCKCRxRC16Er			0x180
+#define		rPMAC_CCKCRxRC32Er			0x184
+#define		rPMAC_CCKCRxRC32OK			0x188
+#define		rPMAC_TxStatus					0x18c
+
+//
+// 2. Page2(0x200)
+//
+// The following two definition are only used for USB interface.
+#define		RF_BB_CMD_ADDR				0x02c0	// RF/BB read/write command address.
+#define		RF_BB_CMD_DATA				0x02c4	// RF/BB read/write command data.
+
+//
+// 3. Page8(0x800)
+//
+#define		rFPGA0_RFMOD				0x800	//RF mode & CCK TxSC // RF BW Setting??
+
+#define		rFPGA0_TxInfo				0x804	// Status report??
+#define		rFPGA0_PSDFunction			0x808
+
+#define		rFPGA0_TxGainStage			0x80c	// Set TX PWR init gain?
+
+#define		rFPGA0_RFTiming1			0x810	// Useless now
+#define		rFPGA0_RFTiming2			0x814
+
+#define		rFPGA0_XA_HSSIParameter1		0x820	// RF 3 wire register
+#define		rFPGA0_XA_HSSIParameter2		0x824
+#define		rFPGA0_XB_HSSIParameter1		0x828
+#define		rFPGA0_XB_HSSIParameter2		0x82c
+#define		rTxAGC_B_Rate18_06				0x830
+#define		rTxAGC_B_Rate54_24				0x834
+#define		rTxAGC_B_CCK1_55_Mcs32		0x838
+#define		rTxAGC_B_Mcs03_Mcs00			0x83c
+
+#define		rTxAGC_B_Mcs07_Mcs04			0x848
+#define		rTxAGC_B_Mcs11_Mcs08			0x84c
+
+#define		rFPGA0_XA_LSSIParameter		0x840
+#define		rFPGA0_XB_LSSIParameter		0x844
+
+#define		rFPGA0_RFWakeUpParameter		0x850	// Useless now
+#define		rFPGA0_RFSleepUpParameter		0x854
+
+#define		rFPGA0_XAB_SwitchControl		0x858	// RF Channel switch
+#define		rFPGA0_XCD_SwitchControl		0x85c
+
+#define		rFPGA0_XA_RFInterfaceOE		0x860	// RF Channel switch
+#define		rFPGA0_XB_RFInterfaceOE		0x864
+
+#define		rTxAGC_B_Mcs15_Mcs12			0x868
+#define		rTxAGC_B_CCK11_A_CCK2_11		0x86c
+
+#define		rFPGA0_XAB_RFInterfaceSW		0x870	// RF Interface Software Control
+#define		rFPGA0_XCD_RFInterfaceSW		0x874
+
+#define		rFPGA0_XAB_RFParameter		0x878	// RF Parameter
+#define		rFPGA0_XCD_RFParameter		0x87c
+
+#define		rFPGA0_AnalogParameter1		0x880	// Crystal cap setting RF-R/W protection for parameter4??
+#define		rFPGA0_AnalogParameter2		0x884
+#define		rFPGA0_AnalogParameter3		0x888	// Useless now
+#define		rFPGA0_AnalogParameter4		0x88c
+
+#define		rFPGA0_XA_LSSIReadBack		0x8a0	// Tranceiver LSSI Readback
+#define		rFPGA0_XB_LSSIReadBack		0x8a4
+#define		rFPGA0_XC_LSSIReadBack		0x8a8
+#define		rFPGA0_XD_LSSIReadBack		0x8ac
+
+#define		rFPGA0_PSDReport				0x8b4	// Useless now
+#define		TransceiverA_HSPI_Readback	0x8b8	// Transceiver A HSPI Readback
+#define		TransceiverB_HSPI_Readback	0x8bc	// Transceiver B HSPI Readback
+#define		rFPGA0_XAB_RFInterfaceRB		0x8e0	// Useless now // RF Interface Readback Value
+#define		rFPGA0_XCD_RFInterfaceRB		0x8e4	// Useless now
+
+//
+// 4. Page9(0x900)
+//
+#define		rFPGA1_RFMOD				0x900	//RF mode & OFDM TxSC // RF BW Setting??
+
+#define		rFPGA1_TxBlock				0x904	// Useless now
+#define		rFPGA1_DebugSelect			0x908	// Useless now
+#define		rFPGA1_TxInfo				0x90c	// Useless now // Status report??
+
+//
+// 5. PageA(0xA00)
+//
+// Set Control channel to upper or lower. These settings are required only for 40MHz
+#define		rCCK0_System				0xa00
+
+#define		rCCK0_AFESetting			0xa04	// Disable init gain now // Select RX path by RSSI
+#define		rCCK0_CCA					0xa08	// Disable init gain now // Init gain
+
+#define		rCCK0_RxAGC1				0xa0c 	//AGC default value, saturation level // Antenna Diversity, RX AGC, LNA Threshold, RX LNA Threshold useless now. Not the same as 90 series
+#define		rCCK0_RxAGC2				0xa10 	//AGC & DAGC
+
+#define		rCCK0_RxHP					0xa14
+
+#define		rCCK0_DSPParameter1		0xa18	//Timing recovery & Channel estimation threshold
+#define		rCCK0_DSPParameter2		0xa1c	//SQ threshold
+
+#define		rCCK0_TxFilter1				0xa20
+#define		rCCK0_TxFilter2				0xa24
+#define		rCCK0_DebugPort			0xa28	//debug port and Tx filter3
+#define		rCCK0_FalseAlarmReport		0xa2c	//0xa2d	useless now 0xa30-a4f channel report
+#define		rCCK0_TRSSIReport         		0xa50
+#define		rCCK0_RxReport            		0xa54  //0xa57
+#define		rCCK0_FACounterLower      	0xa5c  //0xa5b
+#define		rCCK0_FACounterUpper      	0xa58  //0xa5c
+
+//
+// PageB(0xB00)
+//
+#define		rPdp_AntA      				0xb00
+#define		rPdp_AntA_4    				0xb04
+#define		rConfig_Pmpd_AntA 			0xb28
+#define		rConfig_AntA 				0xb68
+#define		rConfig_AntB 				0xb6c
+#define		rPdp_AntB 					0xb70
+#define		rPdp_AntB_4 				0xb74
+#define		rConfig_Pmpd_AntB			0xb98
+#define		rAPK						0xbd8
+
+//
+// 6. PageC(0xC00)
+//
+#define		rOFDM0_LSTF				0xc00
+
+#define		rOFDM0_TRxPathEnable		0xc04
+#define		rOFDM0_TRMuxPar			0xc08
+#define		rOFDM0_TRSWIsolation		0xc0c
+
+#define		rOFDM0_XARxAFE			0xc10  //RxIQ DC offset, Rx digital filter, DC notch filter
+#define		rOFDM0_XARxIQImbalance    	0xc14  //RxIQ imblance matrix
+#define		rOFDM0_XBRxAFE            		0xc18
+#define		rOFDM0_XBRxIQImbalance    	0xc1c
+#define		rOFDM0_XCRxAFE            		0xc20
+#define		rOFDM0_XCRxIQImbalance    	0xc24
+#define		rOFDM0_XDRxAFE            		0xc28
+#define		rOFDM0_XDRxIQImbalance    	0xc2c
+
+#define		rOFDM0_RxDetector1			0xc30  //PD,BW & SBD	// DM tune init gain
+#define		rOFDM0_RxDetector2			0xc34  //SBD & Fame Sync.
+#define		rOFDM0_RxDetector3			0xc38  //Frame Sync.
+#define		rOFDM0_RxDetector4			0xc3c  //PD, SBD, Frame Sync & Short-GI
+
+#define		rOFDM0_RxDSP				0xc40  //Rx Sync Path
+#define		rOFDM0_CFOandDAGC		0xc44  //CFO & DAGC
+#define		rOFDM0_CCADropThreshold	0xc48 //CCA Drop threshold
+#define		rOFDM0_ECCAThreshold		0xc4c // energy CCA
+
+#define		rOFDM0_XAAGCCore1			0xc50	// DIG
+#define		rOFDM0_XAAGCCore2			0xc54
+#define		rOFDM0_XBAGCCore1			0xc58
+#define		rOFDM0_XBAGCCore2			0xc5c
+#define		rOFDM0_XCAGCCore1			0xc60
+#define		rOFDM0_XCAGCCore2			0xc64
+#define		rOFDM0_XDAGCCore1			0xc68
+#define		rOFDM0_XDAGCCore2			0xc6c
+
+#define		rOFDM0_AGCParameter1			0xc70
+#define		rOFDM0_AGCParameter2			0xc74
+#define		rOFDM0_AGCRSSITable			0xc78
+#define		rOFDM0_HTSTFAGC				0xc7c
+
+#define		rOFDM0_XATxIQImbalance		0xc80	// TX PWR TRACK and DIG
+#define		rOFDM0_XATxAFE				0xc84
+#define		rOFDM0_XBTxIQImbalance		0xc88
+#define		rOFDM0_XBTxAFE				0xc8c
+#define		rOFDM0_XCTxIQImbalance		0xc90
+#define		rOFDM0_XCTxAFE            			0xc94
+#define		rOFDM0_XDTxIQImbalance		0xc98
+#define		rOFDM0_XDTxAFE				0xc9c
+
+#define		rOFDM0_RxIQExtAnta			0xca0
+#define		rOFDM0_TxCoeff1				0xca4
+#define		rOFDM0_TxCoeff2				0xca8
+#define		rOFDM0_TxCoeff3				0xcac
+#define		rOFDM0_TxCoeff4				0xcb0
+#define		rOFDM0_TxCoeff5				0xcb4
+#define		rOFDM0_TxCoeff6				0xcb8
+#define		rOFDM0_RxHPParameter			0xce0
+#define		rOFDM0_TxPseudoNoiseWgt		0xce4
+#define		rOFDM0_FrameSync				0xcf0
+#define		rOFDM0_DFSReport				0xcf4
+
+//
+// 7. PageD(0xD00)
+//
+#define		rOFDM1_LSTF					0xd00
+#define		rOFDM1_TRxPathEnable			0xd04
+
+#define		rOFDM1_CFO						0xd08	// No setting now
+#define		rOFDM1_CSI1					0xd10
+#define		rOFDM1_SBD						0xd14
+#define		rOFDM1_CSI2					0xd18
+#define		rOFDM1_CFOTracking			0xd2c
+#define		rOFDM1_TRxMesaure1			0xd34
+#define		rOFDM1_IntfDet					0xd3c
+#define		rOFDM1_PseudoNoiseStateAB		0xd50
+#define		rOFDM1_PseudoNoiseStateCD		0xd54
+#define		rOFDM1_RxPseudoNoiseWgt		0xd58
+
+#define		rOFDM_PHYCounter1				0xda0  //cca, parity fail
+#define		rOFDM_PHYCounter2				0xda4  //rate illegal, crc8 fail
+#define		rOFDM_PHYCounter3				0xda8  //MCS not support
+
+#define		rOFDM_ShortCFOAB				0xdac	// No setting now
+#define		rOFDM_ShortCFOCD				0xdb0
+#define		rOFDM_LongCFOAB				0xdb4
+#define		rOFDM_LongCFOCD				0xdb8
+#define		rOFDM_TailCFOAB				0xdbc
+#define		rOFDM_TailCFOCD				0xdc0
+#define		rOFDM_PWMeasure1          		0xdc4
+#define		rOFDM_PWMeasure2          		0xdc8
+#define		rOFDM_BWReport				0xdcc
+#define		rOFDM_AGCReport				0xdd0
+#define		rOFDM_RxSNR					0xdd4
+#define		rOFDM_RxEVMCSI				0xdd8
+#define		rOFDM_SIGReport				0xddc
+
+
+//
+// 8. PageE(0xE00)
+//
+#define		rTxAGC_A_Rate18_06			0xe00
+#define		rTxAGC_A_Rate54_24			0xe04
+#define		rTxAGC_A_CCK1_Mcs32			0xe08
+#define		rTxAGC_A_Mcs03_Mcs00			0xe10
+#define		rTxAGC_A_Mcs07_Mcs04			0xe14
+#define		rTxAGC_A_Mcs11_Mcs08			0xe18
+#define		rTxAGC_A_Mcs15_Mcs12			0xe1c
+
+#define		rFPGA0_IQK					0xe28
+#define		rTx_IQK_Tone_A				0xe30
+#define		rRx_IQK_Tone_A				0xe34
+#define		rTx_IQK_PI_A					0xe38
+#define		rRx_IQK_PI_A					0xe3c
+
+#define		rTx_IQK 						0xe40
+#define		rRx_IQK						0xe44
+#define		rIQK_AGC_Pts					0xe48
+#define		rIQK_AGC_Rsp					0xe4c
+#define		rTx_IQK_Tone_B				0xe50
+#define		rRx_IQK_Tone_B				0xe54
+#define		rTx_IQK_PI_B					0xe58
+#define		rRx_IQK_PI_B					0xe5c
+#define		rIQK_AGC_Cont				0xe60
+
+#define		rBlue_Tooth					0xe6c
+#define		rRx_Wait_CCA					0xe70
+#define		rTx_CCK_RFON					0xe74
+#define		rTx_CCK_BBON				0xe78
+#define		rTx_OFDM_RFON				0xe7c
+#define		rTx_OFDM_BBON				0xe80
+#define		rTx_To_Rx					0xe84
+#define		rTx_To_Tx					0xe88
+#define		rRx_CCK						0xe8c
+
+#define		rTx_Power_Before_IQK_A		0xe94
+#define		rTx_Power_After_IQK_A			0xe9c
+
+#define		rRx_Power_Before_IQK_A		0xea0
+#define		rRx_Power_Before_IQK_A_2		0xea4
+#define		rRx_Power_After_IQK_A			0xea8
+#define		rRx_Power_After_IQK_A_2		0xeac
+
+#define		rTx_Power_Before_IQK_B		0xeb4
+#define		rTx_Power_After_IQK_B			0xebc
+
+#define		rRx_Power_Before_IQK_B		0xec0
+#define		rRx_Power_Before_IQK_B_2		0xec4
+#define		rRx_Power_After_IQK_B			0xec8
+#define		rRx_Power_After_IQK_B_2		0xecc
+
+#define		rRx_OFDM					0xed0
+#define		rRx_Wait_RIFS 				0xed4
+#define		rRx_TO_Rx 					0xed8
+#define		rStandby 						0xedc
+#define		rSleep 						0xee0
+#define		rPMPD_ANAEN				0xeec
+
+//
+// 7. RF Register 0x00-0x2E (RF 8256)
+//    RF-0222D 0x00-3F
+//
+//Zebra1
+#define		rZebra1_HSSIEnable				0x0	// Useless now
+#define		rZebra1_TRxEnable1				0x1
+#define		rZebra1_TRxEnable2				0x2
+#define		rZebra1_AGC					0x4
+#define		rZebra1_ChargePump			0x5
+#define		rZebra1_Channel				0x7	// RF channel switch
+
+//#endif
+#define		rZebra1_TxGain					0x8	// Useless now
+#define		rZebra1_TxLPF					0x9
+#define		rZebra1_RxLPF					0xb
+#define		rZebra1_RxHPFCorner			0xc
+
+//Zebra4
+#define		rGlobalCtrl						0	// Useless now
+#define		rRTL8256_TxLPF					19
+#define		rRTL8256_RxLPF					11
+
+//RTL8258
+#define		rRTL8258_TxLPF					0x11	// Useless now
+#define		rRTL8258_RxLPF					0x13
+#define		rRTL8258_RSSILPF				0xa
+
+//
+// RL6052 Register definition
+//
+#define		RF_AC						0x00	//
+
+#define		RF_IQADJ_G1				0x01	//
+#define		RF_IQADJ_G2				0x02	//
+#define		RF_BS_PA_APSET_G1_G4		0x03
+#define		RF_BS_PA_APSET_G5_G8		0x04
+#define		RF_POW_TRSW				0x05	//
+
+#define		RF_GAIN_RX					0x06	//
+#define		RF_GAIN_TX					0x07	//
+
+#define		RF_TXM_IDAC				0x08	//
+#define		RF_IPA_G					0x09	//
+#define		RF_TXBIAS_G				0x0A
+#define		RF_TXPA_AG					0x0B
+#define		RF_IPA_A					0x0C	//
+#define		RF_TXBIAS_A				0x0D
+#define		RF_BS_PA_APSET_G9_G11	0x0E
+#define		RF_BS_IQGEN				0x0F	//
+
+#define		RF_MODE1					0x10	//
+#define		RF_MODE2					0x11	//
+
+#define		RF_RX_AGC_HP				0x12	//
+#define		RF_TX_AGC					0x13	//
+#define		RF_BIAS						0x14	//
+#define		RF_IPA						0x15	//
+#define		RF_POW_ABILITY			0x17	//
+#define		RF_MODE_AG				0x18	//
+#define		rRfChannel					0x18	// RF channel and BW switch
+#define		RF_CHNLBW					0x18	// RF channel and BW switch
+#define		RF_TOP						0x19	//
+
+#define		RF_RX_G1					0x1A	//
+#define		RF_RX_G2					0x1B	//
+
+#define		RF_RX_BB2					0x1C	//
+#define		RF_RX_BB1					0x1D	//
+
+#define		RF_RCK1					0x1E	//
+#define		RF_RCK2					0x1F	//
+
+#define		RF_TX_G1					0x20	//
+#define		RF_TX_G2					0x21	//
+#define		RF_TX_G3					0x22	//
+
+#define		RF_TX_BB1					0x23	//
+
+#define		RF_T_METER					0x24	//
+
+#define		RF_SYN_G1					0x25	// RF TX Power control
+#define		RF_SYN_G2					0x26	// RF TX Power control
+#define		RF_SYN_G3					0x27	// RF TX Power control
+#define		RF_SYN_G4					0x28	// RF TX Power control
+#define		RF_SYN_G5					0x29	// RF TX Power control
+#define		RF_SYN_G6					0x2A	// RF TX Power control
+#define		RF_SYN_G7					0x2B	// RF TX Power control
+#define		RF_SYN_G8					0x2C	// RF TX Power control
+
+#define		RF_RCK_OS					0x30	// RF TX PA control
+
+#define		RF_TXPA_G1					0x31	// RF TX PA control
+#define		RF_TXPA_G2					0x32	// RF TX PA control
+#define		RF_TXPA_G3					0x33	// RF TX PA control
+
+//
+//Bit Mask
+//
+// 1. Page1(0x100)
+#define		bBBResetB						0x100	// Useless now?
+#define		bGlobalResetB					0x200
+#define		bOFDMTxStart					0x4
+#define		bCCKTxStart						0x8
+#define		bCRC32Debug					0x100
+#define		bPMACLoopback					0x10
+#define		bTxLSIG							0xffffff
+#define		bOFDMTxRate					0xf
+#define		bOFDMTxReserved				0x10
+#define		bOFDMTxLength					0x1ffe0
+#define		bOFDMTxParity					0x20000
+#define		bTxHTSIG1						0xffffff
+#define		bTxHTMCSRate					0x7f
+#define		bTxHTBW						0x80
+#define		bTxHTLength					0xffff00
+#define		bTxHTSIG2						0xffffff
+#define		bTxHTSmoothing					0x1
+#define		bTxHTSounding					0x2
+#define		bTxHTReserved					0x4
+#define		bTxHTAggreation				0x8
+#define		bTxHTSTBC						0x30
+#define		bTxHTAdvanceCoding			0x40
+#define		bTxHTShortGI					0x80
+#define		bTxHTNumberHT_LTF			0x300
+#define		bTxHTCRC8						0x3fc00
+#define		bCounterReset					0x10000
+#define		bNumOfOFDMTx					0xffff
+#define		bNumOfCCKTx					0xffff0000
+#define		bTxIdleInterval					0xffff
+#define		bOFDMService					0xffff0000
+#define		bTxMACHeader					0xffffffff
+#define		bTxDataInit						0xff
+#define		bTxHTMode						0x100
+#define		bTxDataType					0x30000
+#define		bTxRandomSeed					0xffffffff
+#define		bCCKTxPreamble					0x1
+#define		bCCKTxSFD						0xffff0000
+#define		bCCKTxSIG						0xff
+#define		bCCKTxService					0xff00
+#define		bCCKLengthExt					0x8000
+#define		bCCKTxLength					0xffff0000
+#define		bCCKTxCRC16					0xffff
+#define		bCCKTxStatus					0x1
+#define		bOFDMTxStatus					0x2
+
+#define 		IS_BB_REG_OFFSET_92S(_Offset)		((_Offset >= 0x800) && (_Offset <= 0xfff))
+
+// 2. Page8(0x800)
+#define		bRFMOD							0x1	// Reg 0x800 rFPGA0_RFMOD
+#define		bJapanMode						0x2
+#define		bCCKTxSC						0x30
+#define		bCCKEn							0x1000000
+#define		bOFDMEn						0x2000000
+
+#define		bOFDMRxADCPhase           		0x10000	// Useless now
+#define		bOFDMTxDACPhase           		0x40000
+#define		bXATxAGC                  			0x3f
+
+#define		bAntennaSelect                 		0x0300
+
+#define		bXBTxAGC                  			0xf00	// Reg 80c rFPGA0_TxGainStage
+#define		bXCTxAGC                  			0xf000
+#define		bXDTxAGC                  			0xf0000
+
+#define		bPAStart                  			0xf0000000	// Useless now
+#define		bTRStart                  			0x00f00000
+#define		bRFStart                  			0x0000f000
+#define		bBBStart                  			0x000000f0
+#define		bBBCCKStart               		0x0000000f
+#define		bPAEnd                    			0xf          //Reg0x814
+#define		bTREnd                    			0x0f000000
+#define		bRFEnd                    			0x000f0000
+#define		bCCAMask                  			0x000000f0   //T2R
+#define		bR2RCCAMask               		0x00000f00
+#define		bHSSI_R2TDelay            		0xf8000000
+#define		bHSSI_T2RDelay            		0xf80000
+#define		bContTxHSSI               		0x400     //chane gain at continue Tx
+#define		bIGFromCCK                		0x200
+#define		bAGCAddress               		0x3f
+#define		bRxHPTx                   			0x7000
+#define		bRxHPT2R                  			0x38000
+#define		bRxHPCCKIni               		0xc0000
+#define		bAGCTxCode                		0xc00000
+#define		bAGCRxCode                		0x300000
+
+#define		b3WireDataLength          		0x800	// Reg 0x820~84f rFPGA0_XA_HSSIParameter1
+#define		b3WireAddressLength       		0x400
+
+#define		b3WireRFPowerDown         		0x1	// Useless now
+//#define bHWSISelect               		0x8
+#define		b5GPAPEPolarity           		0x40000000
+#define		b2GPAPEPolarity           		0x80000000
+#define		bRFSW_TxDefaultAnt        		0x3
+#define		bRFSW_TxOptionAnt         		0x30
+#define		bRFSW_RxDefaultAnt        		0x300
+#define		bRFSW_RxOptionAnt         		0x3000
+#define		bRFSI_3WireData           		0x1
+#define		bRFSI_3WireClock          		0x2
+#define		bRFSI_3WireLoad           		0x4
+#define		bRFSI_3WireRW             		0x8
+#define		bRFSI_3Wire               			0xf
+
+#define		bRFSI_RFENV               		0x10	// Reg 0x870 rFPGA0_XAB_RFInterfaceSW
+
+#define		bRFSI_TRSW                		0x20	// Useless now
+#define		bRFSI_TRSWB               		0x40
+#define		bRFSI_ANTSW               		0x100
+#define		bRFSI_ANTSWB              		0x200
+#define		bRFSI_PAPE                			0x400
+#define		bRFSI_PAPE5G              		0x800
+#define		bBandSelect               			0x1
+#define		bHTSIG2_GI                			0x80
+#define		bHTSIG2_Smoothing         		0x01
+#define		bHTSIG2_Sounding          		0x02
+#define		bHTSIG2_Aggreaton         		0x08
+#define		bHTSIG2_STBC              		0x30
+#define		bHTSIG2_AdvCoding         		0x40
+#define		bHTSIG2_NumOfHTLTF        	0x300
+#define		bHTSIG2_CRC8              		0x3fc
+#define		bHTSIG1_MCS               		0x7f
+#define		bHTSIG1_BandWidth         		0x80
+#define		bHTSIG1_HTLength          		0xffff
+#define		bLSIG_Rate                			0xf
+#define		bLSIG_Reserved            		0x10
+#define		bLSIG_Length              		0x1fffe
+#define		bLSIG_Parity              			0x20
+#define		bCCKRxPhase               		0x4
+
+#define		bLSSIReadAddress          		0x7f800000   // T65 RF
+
+#define		bLSSIReadEdge             		0x80000000   //LSSI "Read" edge signal
+
+#define		bLSSIReadBackData         		0xfffff		// T65 RF
+
+#define		bLSSIReadOKFlag           		0x1000	// Useless now
+#define		bCCKSampleRate            		0x8       //0: 44MHz, 1:88MHz
+#define		bRegulator0Standby        		0x1
+#define		bRegulatorPLLStandby      		0x2
+#define		bRegulator1Standby        		0x4
+#define		bPLLPowerUp               		0x8
+#define		bDPLLPowerUp              		0x10
+#define		bDA10PowerUp              		0x20
+#define		bAD7PowerUp               		0x200
+#define		bDA6PowerUp               		0x2000
+#define		bXtalPowerUp              		0x4000
+#define		b40MDClkPowerUP           		0x8000
+#define		bDA6DebugMode             		0x20000
+#define		bDA6Swing                 			0x380000
+
+#define		bADClkPhase               		0x4000000	// Reg 0x880 rFPGA0_AnalogParameter1 20/40 CCK support switch 40/80 BB MHZ
+
+#define		b80MClkDelay              		0x18000000	// Useless
+#define		bAFEWatchDogEnable        		0x20000000
+
+#define		bXtalCap01                			0xc0000000	// Reg 0x884 rFPGA0_AnalogParameter2 Crystal cap
+#define		bXtalCap23                			0x3
+#define		bXtalCap92x					0x0f000000
+#define 		bXtalCap                			0x0f000000
+
+#define		bIntDifClkEnable          		0x400	// Useless
+#define		bExtSigClkEnable         	 	0x800
+#define		bBandgapMbiasPowerUp      	0x10000
+#define		bAD11SHGain               		0xc0000
+#define		bAD11InputRange           		0x700000
+#define		bAD11OPCurrent            		0x3800000
+#define		bIPathLoopback            		0x4000000
+#define		bQPathLoopback            		0x8000000
+#define		bAFELoopback              		0x10000000
+#define		bDA10Swing                		0x7e0
+#define		bDA10Reverse              		0x800
+#define		bDAClkSource              		0x1000
+#define		bAD7InputRange            		0x6000
+#define		bAD7Gain                  			0x38000
+#define		bAD7OutputCMMode          		0x40000
+#define		bAD7InputCMMode           		0x380000
+#define		bAD7Current               			0xc00000
+#define		bRegulatorAdjust          		0x7000000
+#define		bAD11PowerUpAtTx          		0x1
+#define		bDA10PSAtTx               		0x10
+#define		bAD11PowerUpAtRx          		0x100
+#define		bDA10PSAtRx               		0x1000
+#define		bCCKRxAGCFormat           		0x200
+#define		bPSDFFTSamplepPoint       		0xc000
+#define		bPSDAverageNum            		0x3000
+#define		bIQPathControl            		0xc00
+#define		bPSDFreq                  			0x3ff
+#define		bPSDAntennaPath           		0x30
+#define		bPSDIQSwitch              		0x40
+#define		bPSDRxTrigger             		0x400000
+#define		bPSDTxTrigger             		0x80000000
+#define		bPSDSineToneScale        		0x7f000000
+#define		bPSDReport                			0xffff
+
+// 3. Page9(0x900)
+#define		bOFDMTxSC                 		0x30000000	// Useless
+#define		bCCKTxOn                  			0x1
+#define		bOFDMTxOn                 		0x2
+#define		bDebugPage                		0xfff  //reset debug page and also HWord, LWord
+#define		bDebugItem                		0xff   //reset debug page and LWord
+#define		bAntL              	       		0x10
+#define		bAntNonHT           	      			0x100
+#define		bAntHT1               			0x1000
+#define		bAntHT2                   			0x10000
+#define		bAntHT1S1                 			0x100000
+#define		bAntNonHTS1               		0x1000000
+
+// 4. PageA(0xA00)
+#define		bCCKBBMode				0x3	// Useless
+#define		bCCKTxPowerSaving		0x80
+#define		bCCKRxPowerSaving		0x40
+
+#define		bCCKSideBand			0x10	// Reg 0xa00 rCCK0_System 20/40 switch
+
+#define		bCCKScramble			0x8	// Useless
+#define		bCCKAntDiversity		0x8000
+#define		bCCKCarrierRecovery		0x4000
+#define		bCCKTxRate				0x3000
+#define		bCCKDCCancel			0x0800
+#define		bCCKISICancel			0x0400
+#define		bCCKMatchFilter			0x0200
+#define		bCCKEqualizer			0x0100
+#define		bCCKPreambleDetect		0x800000
+#define		bCCKFastFalseCCA		0x400000
+#define		bCCKChEstStart			0x300000
+#define		bCCKCCACount			0x080000
+#define		bCCKcs_lim				0x070000
+#define		bCCKBistMode			0x80000000
+#define		bCCKCCAMask			0x40000000
+#define		bCCKTxDACPhase		0x4
+#define		bCCKRxADCPhase		0x20000000   //r_rx_clk
+#define		bCCKr_cp_mode0		0x0100
+#define		bCCKTxDCOffset			0xf0
+#define		bCCKRxDCOffset			0xf
+#define		bCCKCCAMode			0xc000
+#define		bCCKFalseCS_lim			0x3f00
+#define		bCCKCS_ratio			0xc00000
+#define		bCCKCorgBit_sel			0x300000
+#define		bCCKPD_lim				0x0f0000
+#define		bCCKNewCCA			0x80000000
+#define		bCCKRxHPofIG			0x8000
+#define		bCCKRxIG				0x7f00
+#define		bCCKLNAPolarity			0x800000
+#define		bCCKRx1stGain			0x7f0000
+#define		bCCKRFExtend			0x20000000 //CCK Rx Iinital gain polarity
+#define		bCCKRxAGCSatLevel		0x1f000000
+#define		bCCKRxAGCSatCount		0xe0
+#define		bCCKRxRFSettle			0x1f       //AGCsamp_dly
+#define		bCCKFixedRxAGC			0x8000
+//#define bCCKRxAGCFormat         	 	0x4000   //remove to HSSI register 0x824
+#define		bCCKAntennaPolarity		0x2000
+#define		bCCKTxFilterType		0x0c00
+#define		bCCKRxAGCReportType	0x0300
+#define		bCCKRxDAGCEn			0x80000000
+#define		bCCKRxDAGCPeriod		0x20000000
+#define		bCCKRxDAGCSatLevel		0x1f000000
+#define		bCCKTimingRecovery		0x800000
+#define		bCCKTxC0				0x3f0000
+#define		bCCKTxC1				0x3f000000
+#define		bCCKTxC2				0x3f
+#define		bCCKTxC3				0x3f00
+#define		bCCKTxC4				0x3f0000
+#define		bCCKTxC5				0x3f000000
+#define		bCCKTxC6				0x3f
+#define		bCCKTxC7				0x3f00
+#define		bCCKDebugPort			0xff0000
+#define		bCCKDACDebug			0x0f000000
+#define		bCCKFalseAlarmEnable	0x8000
+#define		bCCKFalseAlarmRead		0x4000
+#define		bCCKTRSSI				0x7f
+#define		bCCKRxAGCReport		0xfe
+#define		bCCKRxReport_AntSel	0x80000000
+#define		bCCKRxReport_MFOff		0x40000000
+#define		bCCKRxRxReport_SQLoss	0x20000000
+#define		bCCKRxReport_Pktloss	0x10000000
+#define		bCCKRxReport_Lockedbit	0x08000000
+#define		bCCKRxReport_RateError	0x04000000
+#define		bCCKRxReport_RxRate	0x03000000
+#define		bCCKRxFACounterLower	0xff
+#define		bCCKRxFACounterUpper	0xff000000
+#define		bCCKRxHPAGCStart		0xe000
+#define		bCCKRxHPAGCFinal		0x1c00
+#define		bCCKRxFalseAlarmEnable	0x8000
+#define		bCCKFACounterFreeze	0x4000
+#define		bCCKTxPathSel			0x10000000
+#define		bCCKDefaultRxPath		0xc000000
+#define		bCCKOptionRxPath		0x3000000
+
+// 5. PageC(0xC00)
+#define		bNumOfSTF				0x3	// Useless
+#define		bShift_L					0xc0
+#define		bGI_TH					0xc
+#define		bRxPathA				0x1
+#define		bRxPathB				0x2
+#define		bRxPathC				0x4
+#define		bRxPathD				0x8
+#define		bTxPathA				0x1
+#define		bTxPathB				0x2
+#define		bTxPathC				0x4
+#define		bTxPathD				0x8
+#define		bTRSSIFreq				0x200
+#define		bADCBackoff				0x3000
+#define		bDFIRBackoff			0xc000
+#define		bTRSSILatchPhase		0x10000
+#define		bRxIDCOffset			0xff
+#define		bRxQDCOffset			0xff00
+#define		bRxDFIRMode			0x1800000
+#define		bRxDCNFType			0xe000000
+#define		bRXIQImb_A				0x3ff
+#define		bRXIQImb_B				0xfc00
+#define		bRXIQImb_C				0x3f0000
+#define		bRXIQImb_D				0xffc00000
+#define		bDC_dc_Notch			0x60000
+#define		bRxNBINotch			0x1f000000
+#define		bPD_TH					0xf
+#define		bPD_TH_Opt2			0xc000
+#define		bPWED_TH				0x700
+#define		bIfMF_Win_L			0x800
+#define		bPD_Option				0x1000
+#define		bMF_Win_L				0xe000
+#define		bBW_Search_L			0x30000
+#define		bwin_enh_L				0xc0000
+#define		bBW_TH					0x700000
+#define		bED_TH2				0x3800000
+#define		bBW_option				0x4000000
+#define		bRatio_TH				0x18000000
+#define		bWindow_L				0xe0000000
+#define		bSBD_Option				0x1
+#define		bFrame_TH				0x1c
+#define		bFS_Option				0x60
+#define		bDC_Slope_check		0x80
+#define		bFGuard_Counter_DC_L	0xe00
+#define		bFrame_Weight_Short	0x7000
+#define		bSub_Tune				0xe00000
+#define		bFrame_DC_Length		0xe000000
+#define		bSBD_start_offset		0x30000000
+#define		bFrame_TH_2			0x7
+#define		bFrame_GI2_TH			0x38
+#define		bGI2_Sync_en			0x40
+#define		bSarch_Short_Early		0x300
+#define		bSarch_Short_Late		0xc00
+#define		bSarch_GI2_Late		0x70000
+#define		bCFOAntSum				0x1
+#define		bCFOAcc				0x2
+#define		bCFOStartOffset			0xc
+#define		bCFOLookBack			0x70
+#define		bCFOSumWeight			0x80
+#define		bDAGCEnable			0x10000
+#define		bTXIQImb_A				0x3ff
+#define		bTXIQImb_B				0xfc00
+#define		bTXIQImb_C				0x3f0000
+#define		bTXIQImb_D				0xffc00000
+#define		bTxIDCOffset			0xff
+#define		bTxQDCOffset			0xff00
+#define		bTxDFIRMode			0x10000
+#define		bTxPesudoNoiseOn		0x4000000
+#define		bTxPesudoNoise_A		0xff
+#define		bTxPesudoNoise_B		0xff00
+#define		bTxPesudoNoise_C		0xff0000
+#define		bTxPesudoNoise_D		0xff000000
+#define		bCCADropOption			0x20000
+#define		bCCADropThres			0xfff00000
+#define		bEDCCA_H				0xf
+#define		bEDCCA_L				0xf0
+#define		bLambda_ED			0x300
+#define		bRxInitialGain			0x7f
+#define		bRxAntDivEn				0x80
+#define		bRxAGCAddressForLNA	0x7f00
+#define		bRxHighPowerFlow		0x8000
+#define		bRxAGCFreezeThres		0xc0000
+#define		bRxFreezeStep_AGC1	0x300000
+#define		bRxFreezeStep_AGC2	0xc00000
+#define		bRxFreezeStep_AGC3	0x3000000
+#define		bRxFreezeStep_AGC0	0xc000000
+#define		bRxRssi_Cmp_En			0x10000000
+#define		bRxQuickAGCEn			0x20000000
+#define		bRxAGCFreezeThresMode	0x40000000
+#define		bRxOverFlowCheckType	0x80000000
+#define		bRxAGCShift				0x7f
+#define		bTRSW_Tri_Only			0x80
+#define		bPowerThres			0x300
+#define		bRxAGCEn				0x1
+#define		bRxAGCTogetherEn		0x2
+#define		bRxAGCMin				0x4
+#define		bRxHP_Ini				0x7
+#define		bRxHP_TRLNA			0x70
+#define		bRxHP_RSSI				0x700
+#define		bRxHP_BBP1				0x7000
+#define		bRxHP_BBP2				0x70000
+#define		bRxHP_BBP3				0x700000
+#define		bRSSI_H					0x7f0000     //the threshold for high power
+#define		bRSSI_Gen				0x7f000000   //the threshold for ant diversity
+#define		bRxSettle_TRSW			0x7
+#define		bRxSettle_LNA			0x38
+#define		bRxSettle_RSSI			0x1c0
+#define		bRxSettle_BBP			0xe00
+#define		bRxSettle_RxHP			0x7000
+#define		bRxSettle_AntSW_RSSI	0x38000
+#define		bRxSettle_AntSW		0xc0000
+#define		bRxProcessTime_DAGC	0x300000
+#define		bRxSettle_HSSI			0x400000
+#define		bRxProcessTime_BBPPW	0x800000
+#define		bRxAntennaPowerShift	0x3000000
+#define		bRSSITableSelect		0xc000000
+#define		bRxHP_Final				0x7000000
+#define		bRxHTSettle_BBP			0x7
+#define		bRxHTSettle_HSSI		0x8
+#define		bRxHTSettle_RxHP		0x70
+#define		bRxHTSettle_BBPPW		0x80
+#define		bRxHTSettle_Idle		0x300
+#define		bRxHTSettle_Reserved	0x1c00
+#define		bRxHTRxHPEn			0x8000
+#define		bRxHTAGCFreezeThres	0x30000
+#define		bRxHTAGCTogetherEn	0x40000
+#define		bRxHTAGCMin			0x80000
+#define		bRxHTAGCEn				0x100000
+#define		bRxHTDAGCEn			0x200000
+#define		bRxHTRxHP_BBP			0x1c00000
+#define		bRxHTRxHP_Final		0xe0000000
+#define		bRxPWRatioTH			0x3
+#define		bRxPWRatioEn			0x4
+#define		bRxMFHold				0x3800
+#define		bRxPD_Delay_TH1		0x38
+#define		bRxPD_Delay_TH2		0x1c0
+#define		bRxPD_DC_COUNT_MAX	0x600
+//#define bRxMF_Hold               0x3800
+#define		bRxPD_Delay_TH			0x8000
+#define		bRxProcess_Delay		0xf0000
+#define		bRxSearchrange_GI2_Early	0x700000
+#define		bRxFrame_Guard_Counter_L	0x3800000
+#define		bRxSGI_Guard_L			0xc000000
+#define		bRxSGI_Search_L		0x30000000
+#define		bRxSGI_TH				0xc0000000
+#define		bDFSCnt0				0xff
+#define		bDFSCnt1				0xff00
+#define		bDFSFlag				0xf0000
+#define		bMFWeightSum			0x300000
+#define		bMinIdxTH				0x7f000000
+#define		bDAFormat				0x40000
+#define		bTxChEmuEnable		0x01000000
+#define		bTRSWIsolation_A		0x7f
+#define		bTRSWIsolation_B		0x7f00
+#define		bTRSWIsolation_C		0x7f0000
+#define		bTRSWIsolation_D		0x7f000000
+#define		bExtLNAGain				0x7c00
+
+// 6. PageE(0xE00)
+#define		bSTBCEn				0x4	// Useless
+#define		bAntennaMapping		0x10
+#define		bNss					0x20
+#define		bCFOAntSumD			0x200
+#define		bPHYCounterReset		0x8000000
+#define		bCFOReportGet			0x4000000
+#define		bOFDMContinueTx		0x10000000
+#define		bOFDMSingleCarrier		0x20000000
+#define		bOFDMSingleTone		0x40000000
+//#define bRxPath1                 0x01
+//#define bRxPath2                 0x02
+//#define bRxPath3                 0x04
+//#define bRxPath4                 0x08
+//#define bTxPath1                 0x10
+//#define bTxPath2                 0x20
+#define		bHTDetect			0x100
+#define		bCFOEn				0x10000
+#define		bCFOValue			0xfff00000
+#define		bSigTone_Re		0x3f
+#define		bSigTone_Im		0x7f00
+#define		bCounter_CCA		0xffff
+#define		bCounter_ParityFail	0xffff0000
+#define		bCounter_RateIllegal		0xffff
+#define		bCounter_CRC8Fail	0xffff0000
+#define		bCounter_MCSNoSupport	0xffff
+#define		bCounter_FastSync	0xffff
+#define		bShortCFO			0xfff
+#define		bShortCFOTLength	12   //total
+#define		bShortCFOFLength	11   //fraction
+#define		bLongCFO			0x7ff
+#define		bLongCFOTLength	11
+#define		bLongCFOFLength	11
+#define		bTailCFO			0x1fff
+#define		bTailCFOTLength		13
+#define		bTailCFOFLength		12
+#define		bmax_en_pwdB		0xffff
+#define		bCC_power_dB		0xffff0000
+#define		bnoise_pwdB		0xffff
+#define		bPowerMeasTLength	10
+#define		bPowerMeasFLength	3
+#define		bRx_HT_BW			0x1
+#define		bRxSC				0x6
+#define		bRx_HT				0x8
+#define		bNB_intf_det_on		0x1
+#define		bIntf_win_len_cfg	0x30
+#define		bNB_Intf_TH_cfg		0x1c0
+#define		bRFGain				0x3f
+#define		bTableSel			0x40
+#define		bTRSW				0x80
+#define		bRxSNR_A			0xff
+#define		bRxSNR_B			0xff00
+#define		bRxSNR_C			0xff0000
+#define		bRxSNR_D			0xff000000
+#define		bSNREVMTLength		8
+#define		bSNREVMFLength		1
+#define		bCSI1st				0xff
+#define		bCSI2nd				0xff00
+#define		bRxEVM1st			0xff0000
+#define		bRxEVM2nd			0xff000000
+#define		bSIGEVM			0xff
+#define		bPWDB				0xff00
+#define		bSGIEN				0x10000
+
+#define		bSFactorQAM1		0xf	// Useless
+#define		bSFactorQAM2		0xf0
+#define		bSFactorQAM3		0xf00
+#define		bSFactorQAM4		0xf000
+#define		bSFactorQAM5		0xf0000
+#define		bSFactorQAM6		0xf0000
+#define		bSFactorQAM7		0xf00000
+#define		bSFactorQAM8		0xf000000
+#define		bSFactorQAM9		0xf0000000
+#define		bCSIScheme			0x100000
+
+#define		bNoiseLvlTopSet		0x3	// Useless
+#define		bChSmooth			0x4
+#define		bChSmoothCfg1		0x38
+#define		bChSmoothCfg2		0x1c0
+#define		bChSmoothCfg3		0xe00
+#define		bChSmoothCfg4		0x7000
+#define		bMRCMode			0x800000
+#define		bTHEVMCfg			0x7000000
+
+#define		bLoopFitType		0x1	// Useless
+#define		bUpdCFO			0x40
+#define		bUpdCFOOffData		0x80
+#define		bAdvUpdCFO			0x100
+#define		bAdvTimeCtrl		0x800
+#define		bUpdClko			0x1000
+#define		bFC					0x6000
+#define		bTrackingMode		0x8000
+#define		bPhCmpEnable		0x10000
+#define		bUpdClkoLTF		0x20000
+#define		bComChCFO			0x40000
+#define		bCSIEstiMode		0x80000
+#define		bAdvUpdEqz			0x100000
+#define		bUChCfg				0x7000000
+#define		bUpdEqz			0x8000000
+
+//Rx Pseduo noise
+#define		bRxPesudoNoiseOn		0x20000000	// Useless
+#define		bRxPesudoNoise_A		0xff
+#define		bRxPesudoNoise_B		0xff00
+#define		bRxPesudoNoise_C		0xff0000
+#define		bRxPesudoNoise_D		0xff000000
+#define		bPesudoNoiseState_A	0xffff
+#define		bPesudoNoiseState_B	0xffff0000
+#define		bPesudoNoiseState_C	0xffff
+#define		bPesudoNoiseState_D	0xffff0000
+
+//7. RF Register
+//Zebra1
+#define		bZebra1_HSSIEnable		0x8		// Useless
+#define		bZebra1_TRxControl		0xc00
+#define		bZebra1_TRxGainSetting	0x07f
+#define		bZebra1_RxCorner		0xc00
+#define		bZebra1_TxChargePump	0x38
+#define		bZebra1_RxChargePump	0x7
+#define		bZebra1_ChannelNum	0xf80
+#define		bZebra1_TxLPFBW		0x400
+#define		bZebra1_RxLPFBW		0x600
+
+//Zebra4
+#define		bRTL8256RegModeCtrl1	0x100	// Useless
+#define		bRTL8256RegModeCtrl0	0x40
+#define		bRTL8256_TxLPFBW		0x18
+#define		bRTL8256_RxLPFBW		0x600
+
+//RTL8258
+#define		bRTL8258_TxLPFBW		0xc	// Useless
+#define		bRTL8258_RxLPFBW		0xc00
+#define		bRTL8258_RSSILPFBW	0xc0
+
+
+//
+// Other Definition
+//
+
+//byte endable for sb_write
+#define		bByte0				0x1	// Useless
+#define		bByte1				0x2
+#define		bByte2				0x4
+#define		bByte3				0x8
+#define		bWord0				0x3
+#define		bWord1				0xc
+#define		bDWord				0xf
+
+//for PutRegsetting & GetRegSetting BitMask
+#define		bMaskByte0			0xff	// Reg 0xc50 rOFDM0_XAAGCCore~0xC6f
+#define		bMaskByte1			0xff00
+#define		bMaskByte2			0xff0000
+#define		bMaskByte3			0xff000000
+#define		bMaskHWord		0xffff0000
+#define		bMaskLWord			0x0000ffff
+#define		bMaskDWord		0xffffffff
+#define		bMask12Bits			0xfff
+#define		bMaskH4Bits			0xf0000000
+#define		bMaskOFDM_D		0xffc00000
+#define		bMaskCCK			0x3f3f3f3f
+
+//for PutRFRegsetting & GetRFRegSetting BitMask
+//#define		bMask12Bits               0xfffff	// RF Reg mask bits
+//#define		bMask20Bits               0xfffff	// RF Reg mask bits T65 RF
+#define 		bRFRegOffsetMask	0xfffff
+
+#define		bEnable			0x1	// Useless
+#define		bDisable		0x0
+
+#define		LeftAntenna		0x0	// Useless
+#define		RightAntenna	0x1
+
+#define		tCheckTxStatus		500   //500ms // Useless
+#define		tUpdateRxCounter	100   //100ms
+
+#define		rateCCK		0	// Useless
+#define		rateOFDM	1
+#define		rateHT		2
+
+//define Register-End
+#define		bPMAC_End			0x1ff	// Useless
+#define		bFPGAPHY0_End		0x8ff
+#define		bFPGAPHY1_End		0x9ff
+#define		bCCKPHY0_End		0xaff
+#define		bOFDMPHY0_End		0xcff
+#define		bOFDMPHY1_End		0xdff
+
+//define max debug item in each debug page
+//#define bMaxItem_FPGA_PHY0        0x9
+//#define bMaxItem_FPGA_PHY1        0x3
+//#define bMaxItem_PHY_11B          0x16
+//#define bMaxItem_OFDM_PHY0        0x29
+//#define bMaxItem_OFDM_PHY1        0x0
+
+#define		bPMACControl		0x0		// Useless
+#define		bWMACControl		0x1
+#define		bWNICControl		0x2
+
+#define		PathA			0x0	// Useless
+#define		PathB			0x1
+#define		PathC			0x2
+#define		PathD			0x3
+
+/*--------------------------Define Parameters-------------------------------*/
+
+
+#endif	//__INC_HAL8192SPHYREG_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CUHWImg.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CUHWImg.h
new file mode 100644
index 000000000000..cafea7bb3f03
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CUHWImg.h
@@ -0,0 +1,105 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __INC_HAL8192CU_FW_IMG_H
+#define __INC_HAL8192CU_FW_IMG_H
+
+/*Created on  2011/ 6/15,  5:45*/
+
+#ifdef CONFIG_BT_COEXISTENCE
+#define TSMCImgArrayLength 15706 //v84 TSMC COMMON 2012-04-13
+#else //#ifdef CONFIG_P2P
+#define TSMCImgArrayLength 16126 //v88 TSMC P2PPS with CCX report C2H 2012-12-05
+#endif
+extern u8 Rtl8192CUFwTSMCImgArray[TSMCImgArrayLength];
+
+#ifdef CONFIG_BT_COEXISTENCE
+#define UMCACutImgArrayLength 16248 //v79 UMC A Cut COMMON 2011-10-06
+#else //#ifdef CONFIG_P2P
+#define UMCACutImgArrayLength 16126 //v88 UMC A Cut P2PPS with CCX report C2H 2012-12-05
+#endif
+extern u8 Rtl8192CUFwUMCACutImgArray[UMCACutImgArrayLength];
+
+#ifdef CONFIG_BT_COEXISTENCE
+#define UMCBCutImgArrayLength 15686 //v84 UMC B Cut COMMON 2012-04-13
+#else //#ifdef CONFIG_P2P
+#define UMCBCutImgArrayLength 16096 //v88 UMC B Cut P2PPS with CCX report C2H 2012-12-05
+#endif
+extern u8 Rtl8192CUFwUMCBCutImgArray[UMCBCutImgArrayLength];
+
+//8188C_Formal_All_PHYforMP_111117	2011-11-23
+//8192C_Formal_92CU_PHYforMP_110817 	2011-11-23
+#define PHY_REG_2TArrayLength 374
+extern u32  Rtl8192CUPHY_REG_2TArray[PHY_REG_2TArrayLength];
+#define PHY_REG_1TArrayLength 374
+extern u32 Rtl8192CUPHY_REG_1TArray[PHY_REG_1TArrayLength];
+#define PHY_ChangeTo_1T1RArrayLength 1
+extern u32 Rtl8192CUPHY_ChangeTo_1T1RArray[PHY_ChangeTo_1T1RArrayLength];
+#define PHY_ChangeTo_1T2RArrayLength 1
+extern u32 Rtl8192CUPHY_ChangeTo_1T2RArray[PHY_ChangeTo_1T2RArrayLength];
+#define PHY_ChangeTo_2T2RArrayLength 1
+extern u32 Rtl8192CUPHY_ChangeTo_2T2RArray[PHY_ChangeTo_2T2RArrayLength];
+#define PHY_REG_Array_PGLength 336
+extern u32 Rtl8192CUPHY_REG_Array_PG[PHY_REG_Array_PGLength];
+#define PHY_REG_Array_PG_mCardLength 336
+extern u32 Rtl8192CUPHY_REG_Array_PG_mCard[PHY_REG_Array_PG_mCardLength];
+#define PHY_REG_Array_MPLength 4
+extern u32 Rtl8192CUPHY_REG_Array_MP[PHY_REG_Array_MPLength];
+#define PHY_REG_1T_HPArrayLength 378
+extern u32 Rtl8192CUPHY_REG_1T_HPArray[PHY_REG_1T_HPArrayLength];
+#define PHY_REG_1T_mCardArrayLength 374
+extern u32 Rtl8192CUPHY_REG_1T_mCardArray[PHY_REG_1T_mCardArrayLength];
+#define PHY_REG_2T_mCardArrayLength 374
+extern u32 Rtl8192CUPHY_REG_2T_mCardArray[PHY_REG_2T_mCardArrayLength];
+#define PHY_REG_Array_PG_HPLength 336
+extern u32 Rtl8192CUPHY_REG_Array_PG_HP[PHY_REG_Array_PG_HPLength];
+#define RadioA_2TArrayLength 282
+extern u32 Rtl8192CURadioA_2TArray[RadioA_2TArrayLength];
+#define RadioB_2TArrayLength 78
+extern u32 Rtl8192CURadioB_2TArray[RadioB_2TArrayLength];
+#define RadioA_1TArrayLength 282
+extern u32 Rtl8192CURadioA_1TArray[RadioA_1TArrayLength];
+#define RadioB_1TArrayLength 1
+extern u32 Rtl8192CURadioB_1TArray[RadioB_1TArrayLength];
+#define RadioA_2T_mCardArrayLength 282
+extern u32 Rtl8192CURadioA_2T_mCardArray[RadioA_2T_mCardArrayLength];
+#define RadioB_2T_mCardArrayLength 78
+extern u32 Rtl8192CURadioB_2T_mCardArray[RadioB_2T_mCardArrayLength];
+#define RadioA_1T_mCardArrayLength 282
+extern u32 Rtl8192CURadioA_1T_mCardArray[RadioA_1T_mCardArrayLength];
+#define RadioB_1T_mCardArrayLength 1
+extern u32 Rtl8192CURadioB_1T_mCardArray[RadioB_1T_mCardArrayLength];
+#define RadioA_1T_HPArrayLength 282
+extern u32 Rtl8192CURadioA_1T_HPArray[RadioA_1T_HPArrayLength];
+#define RadioB_GM_ArrayLength 1
+extern u32 Rtl8192CURadioB_GM_Array[RadioB_GM_ArrayLength];
+
+// MAC reg V14 - 2011-11-23
+#define MAC_2T_ArrayLength 174
+extern u32 Rtl8192CUMAC_2T_Array[MAC_2T_ArrayLength];
+#define MACPHY_Array_PGLength 1
+extern u32 Rtl8192CUMACPHY_Array_PG[MACPHY_Array_PGLength];
+#define AGCTAB_2TArrayLength 320
+extern u32 Rtl8192CUAGCTAB_2TArray[AGCTAB_2TArrayLength];
+#define AGCTAB_1TArrayLength 320
+extern u32 Rtl8192CUAGCTAB_1TArray[AGCTAB_1TArrayLength];
+#define AGCTAB_1T_HPArrayLength 320
+extern u32 Rtl8192CUAGCTAB_1T_HPArray[AGCTAB_1T_HPArrayLength];
+
+#endif //__INC_HAL8192CU_FW_IMG_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CUHWImg_wowlan.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CUHWImg_wowlan.h
new file mode 100644
index 000000000000..6e18fbceed8e
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192CUHWImg_wowlan.h
@@ -0,0 +1,33 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __INC_HAL8192CU_FW_IMG_WOWLAN_H
+#define __INC_HAL8192CU_FW_IMG_WOWLAN_H
+
+/*Created on  2011/11/ 8, 14:15*/
+
+
+#define TSMCWWImgArrayLength 13458
+extern u8 Rtl8192CUFwTSMCWWImgArray[TSMCWWImgArrayLength];
+#define UMCACutWWImgArrayLength 13458
+extern u8 Rtl8192CUFwUMCACutWWImgArray[UMCACutWWImgArrayLength];
+#define UMCBCutWWImgArrayLength 13446
+extern u8 Rtl8192CUFwUMCBCutWWImgArray[UMCBCutWWImgArrayLength];
+
+#endif //__INC_HAL8192CU_FW_IMG_WOWLAN_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DEHWImg.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DEHWImg.h
new file mode 100644
index 000000000000..55998c212e9c
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DEHWImg.h
@@ -0,0 +1,66 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __INC_HAL8192DE_FW_IMG_H
+#define __INC_HAL8192DE_FW_IMG_H
+
+#include <basic_types.h>
+
+/*Created on  2011/11/11,  8: 8*/
+
+#define Rtl8192DEImgArrayLength 32296
+extern const u8 Rtl8192DEFwImgArray[Rtl8192DEImgArrayLength];
+#define Rtl8192DEMainArrayLength 1
+extern const u8 Rtl8192DEFwMainArray[Rtl8192DEMainArrayLength];
+#define Rtl8192DEDataArrayLength 1
+extern const u8 Rtl8192DEFwDataArray[Rtl8192DEDataArrayLength];
+#define Rtl8192DEPHY_REG_2TArrayLength 372
+extern const u32 Rtl8192DEPHY_REG_2TArray[Rtl8192DEPHY_REG_2TArrayLength];
+#define Rtl8192DEPHY_REG_1TArrayLength 1
+extern const u32 Rtl8192DEPHY_REG_1TArray[Rtl8192DEPHY_REG_1TArrayLength];
+#define Rtl8192DEPHY_REG_Array_PGLength 624
+extern const u32 Rtl8192DEPHY_REG_Array_PG[Rtl8192DEPHY_REG_Array_PGLength];
+#define Rtl8192DEPHY_REG_Array_MPLength 12
+extern const u32 Rtl8192DEPHY_REG_Array_MP[Rtl8192DEPHY_REG_Array_MPLength];
+#define Rtl8192DERadioA_2TArrayLength 378
+extern const u32 Rtl8192DERadioA_2TArray[Rtl8192DERadioA_2TArrayLength];
+#define Rtl8192DERadioB_2TArrayLength 384
+extern const u32 Rtl8192DERadioB_2TArray[Rtl8192DERadioB_2TArrayLength];
+#define Rtl8192DERadioA_1TArrayLength 1
+extern const u32 Rtl8192DERadioA_1TArray[Rtl8192DERadioA_1TArrayLength];
+#define Rtl8192DERadioB_1TArrayLength 1
+extern const u32 Rtl8192DERadioB_1TArray[Rtl8192DERadioB_1TArrayLength];
+#define Rtl8192DERadioA_2T_intPAArrayLength 378
+extern const u32 Rtl8192DERadioA_2T_intPAArray[Rtl8192DERadioA_2T_intPAArrayLength];
+#define Rtl8192DERadioB_2T_intPAArrayLength 384
+extern const u32 Rtl8192DERadioB_2T_intPAArray[Rtl8192DERadioB_2T_intPAArrayLength];
+#define Rtl8192DEMAC_2T_ArrayLength 192
+extern const u32 Rtl8192DEMAC_2T_Array[Rtl8192DEMAC_2T_ArrayLength];
+#define Rtl8192DEAGCTAB_ArrayLength 386
+extern const u32 Rtl8192DEAGCTAB_Array[Rtl8192DEAGCTAB_ArrayLength];
+#define Rtl8192DEAGCTAB_5GArrayLength 194
+extern const u32 Rtl8192DEAGCTAB_5GArray[Rtl8192DEAGCTAB_5GArrayLength];
+#define Rtl8192DEAGCTAB_2GArrayLength 194
+extern const u32 Rtl8192DEAGCTAB_2GArray[Rtl8192DEAGCTAB_2GArrayLength];
+#define Rtl8192DEAGCTAB_2TArrayLength 1
+extern const u32 Rtl8192DEAGCTAB_2TArray[Rtl8192DEAGCTAB_2TArrayLength];
+#define Rtl8192DEAGCTAB_1TArrayLength 1
+extern const u32 Rtl8192DEAGCTAB_1TArray[Rtl8192DEAGCTAB_1TArrayLength];
+
+#endif //__INC_HAL8192CU_FW_IMG_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DPhyCfg.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DPhyCfg.h
new file mode 100644
index 000000000000..43c1188b6f88
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DPhyCfg.h
@@ -0,0 +1,527 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*****************************************************************************
+ *
+ * Module:	__INC_HAL8192DPHYCFG_H
+ *
+ *
+ * Note:
+ *
+ *
+ * Export:	Constants, macro, functions(API), global variables(None).
+ *
+ * Abbrev:
+ *
+ * History:
+ *		Data		Who		Remark
+ *      08/07/2007  MHC    	1. Porting from 9x series PHYCFG.h.
+ *							2. Reorganize code architecture.
+ *
+ *****************************************************************************/
+ /* Check to see if the file has been included already.  */
+#ifndef __INC_HAL8192DPHYCFG_H
+#define __INC_HAL8192DPHYCFG_H
+
+
+/*--------------------------Define Parameters-------------------------------*/
+#define LOOP_LIMIT				5
+#define MAX_STALL_TIME			50		//us
+#define AntennaDiversityValue	0x80	//(Adapter->bSoftwareAntennaDiversity ? 0x00:0x80)
+#define MAX_TXPWR_IDX_NMODE_92S	63
+#define Reset_Cnt_Limit			3
+
+
+#define IQK_MAC_REG_NUM		4
+#define IQK_ADDA_REG_NUM		16
+#define IQK_BB_REG_NUM			10
+#define IQK_BB_REG_NUM_92C	9
+#define IQK_BB_REG_NUM_92D	10
+#define IQK_BB_REG_NUM_test	6
+#define index_mapping_NUM		13
+#define Rx_index_mapping_NUM	15
+#define AVG_THERMAL_NUM		8
+#define IQK_Matrix_REG_NUM	8
+#define IQK_Matrix_Settings_NUM	1+24+21
+
+#ifdef CONFIG_PCI_HCI
+#define	SET_RTL8192SE_RF_SLEEP(_pAdapter)							\
+{																	\
+	u1Byte		u1bTmp;												\
+	u1bTmp = PlatformEFIORead1Byte(_pAdapter, REG_LDOV12D_CTRL);		\
+	u1bTmp |= BIT0;													\
+	PlatformEFIOWrite1Byte(_pAdapter, REG_LDOV12D_CTRL, u1bTmp);		\
+	PlatformEFIOWrite1Byte(_pAdapter, REG_SPS_OCP_CFG, 0x0);				\
+	PlatformEFIOWrite1Byte(_pAdapter, TXPAUSE, 0xFF);				\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x57FC);				\
+	delay_us(100);													\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x77FC);				\
+	PlatformEFIOWrite1Byte(_pAdapter, PHY_CCA, 0x0);				\
+	delay_us(10);													\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x37FC);				\
+	delay_us(10);													\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x77FC);				\
+	delay_us(10);													\
+	PlatformEFIOWrite2Byte(_pAdapter, CMDR, 0x57FC);				\
+}
+#endif
+
+
+/*--------------------------Define Parameters-------------------------------*/
+
+
+/*------------------------------Define structure----------------------------*/
+typedef enum _SwChnlCmdID{
+	CmdID_End,
+	CmdID_SetTxPowerLevel,
+	CmdID_BBRegWrite10,
+	CmdID_WritePortUlong,
+	CmdID_WritePortUshort,
+	CmdID_WritePortUchar,
+	CmdID_RF_WriteReg,
+}SwChnlCmdID;
+
+
+/* 1. Switch channel related */
+typedef struct _SwChnlCmd{
+	SwChnlCmdID	CmdID;
+	u32			Para1;
+	u32			Para2;
+	u32			msDelay;
+}SwChnlCmd;
+
+typedef enum _HW90_BLOCK{
+	HW90_BLOCK_MAC = 0,
+	HW90_BLOCK_PHY0 = 1,
+	HW90_BLOCK_PHY1 = 2,
+	HW90_BLOCK_RF = 3,
+	HW90_BLOCK_MAXIMUM = 4, // Never use this
+}HW90_BLOCK_E, *PHW90_BLOCK_E;
+
+//vivi added this for read parameter from header, 20100908
+typedef enum _RF_CONTENT{
+	radioa_txt = 0x1000,
+	radiob_txt = 0x1001,
+	radioc_txt = 0x1002,
+	radiod_txt = 0x1003
+} RF_CONTENT;
+
+#define	RF_PATH_MAX			2
+
+typedef enum _WIRELESS_MODE {
+	WIRELESS_MODE_UNKNOWN = 0x00,
+	WIRELESS_MODE_A = 0x01,
+	WIRELESS_MODE_B = 0x02,
+	WIRELESS_MODE_G = 0x04,
+	WIRELESS_MODE_AUTO = 0x08,
+	WIRELESS_MODE_N_24G = 0x10,
+	WIRELESS_MODE_N_5G = 0x20
+} WIRELESS_MODE;
+
+
+#define CHANNEL_MAX_NUMBER		14+24+21	// 14 is the max channel number
+#define CHANNEL_GROUP_MAX		3+9	// ch1~3, ch4~9, ch10~14 total three groups
+#define MAX_PG_GROUP 13
+
+#define	CHANNEL_GROUP_MAX_2G		3
+#define	CHANNEL_GROUP_IDX_5GL		3
+#define	CHANNEL_GROUP_IDX_5GM		6
+#define	CHANNEL_GROUP_IDX_5GH		9
+#define	CHANNEL_GROUP_MAX_5G		9
+#define	CHANNEL_MAX_NUMBER_2G		14
+
+typedef enum _BaseBand_Config_Type{
+	BaseBand_Config_PHY_REG = 0,			//Radio Path A
+	BaseBand_Config_AGC_TAB = 1,			//Radio Path B
+}BaseBand_Config_Type, *PBaseBand_Config_Type;
+
+typedef enum _MACPHY_MODE_8192D{
+	SINGLEMAC_SINGLEPHY,
+	DUALMAC_DUALPHY,
+	DUALMAC_SINGLEPHY,
+}MACPHY_MODE_8192D,*PMACPHY_MODE_8192D;
+
+typedef enum _MACPHY_MODE_CHANGE_ACTION{
+	DMDP2DMSP = 0,
+	DMSP2DMDP = 1,
+	DMDP2SMSP = 2,
+	SMSP2DMDP = 3,
+	DMSP2SMSP = 4,
+	SMSP2DMSP = 5,
+	MAXACTION
+}MACPHY_MODE_CHANGE_ACTION,*PMACPHY_MODE_CHANGE_ACTION;
+
+typedef enum _BAND_TYPE{
+	BAND_ON_2_4G = 0,
+	BAND_ON_5G,
+	BAND_ON_BOTH,
+	BANDMAX
+}BAND_TYPE,*PBAND_TYPE;
+
+typedef enum _PHY_Rate_Tx_Power_Offset_Area{
+	RA_OFFSET_LEGACY_OFDM1,
+	RA_OFFSET_LEGACY_OFDM2,
+	RA_OFFSET_HT_OFDM1,
+	RA_OFFSET_HT_OFDM2,
+	RA_OFFSET_HT_OFDM3,
+	RA_OFFSET_HT_OFDM4,
+	RA_OFFSET_HT_CCK,
+}RA_OFFSET_AREA,*PRA_OFFSET_AREA;
+
+
+/* BB/RF related */
+typedef	enum _RF_TYPE_8190P{
+	RF_TYPE_MIN,	// 0
+	RF_8225=1,			// 1 11b/g RF for verification only
+	RF_8256=2,			// 2 11b/g/n
+	RF_8258=3,			// 3 11a/b/g/n RF
+	RF_6052=4,		// 4 11b/g/n RF
+	//RF_6052=5,		// 4 11b/g/n RF
+	// TODO: We sholud remove this psudo PHY RF after we get new RF.
+	RF_PSEUDO_11N=5,	// 5, It is a temporality RF.
+}RF_TYPE_8190P_E,*PRF_TYPE_8190P_E;
+
+typedef struct _BB_REGISTER_DEFINITION{
+	u32 rfintfs;			// set software control:
+							//		0x870~0x877[8 bytes]
+
+	u32 rfintfi;			// readback data:
+							//		0x8e0~0x8e7[8 bytes]
+
+	u32 rfintfo; 		// output data:
+							//		0x860~0x86f [16 bytes]
+
+	u32 rfintfe; 		// output enable:
+							//		0x860~0x86f [16 bytes]
+
+	u32 rf3wireOffset;	// LSSI data:
+							//		0x840~0x84f [16 bytes]
+
+	u32 rfLSSI_Select;	// BB Band Select:
+							//		0x878~0x87f [8 bytes]
+
+	u32 rfTxGainStage;	// Tx gain stage:
+							//		0x80c~0x80f [4 bytes]
+
+	u32 rfHSSIPara1; 	// wire parameter control1 :
+							//		0x820~0x823,0x828~0x82b, 0x830~0x833, 0x838~0x83b [16 bytes]
+
+	u32 rfHSSIPara2; 	// wire parameter control2 :
+							//		0x824~0x827,0x82c~0x82f, 0x834~0x837, 0x83c~0x83f [16 bytes]
+
+	u32 rfSwitchControl; //Tx Rx antenna control :
+							//		0x858~0x85f [16 bytes]
+
+	u32 rfAGCControl1; 	//AGC parameter control1 :
+							//		0xc50~0xc53,0xc58~0xc5b, 0xc60~0xc63, 0xc68~0xc6b [16 bytes]
+
+	u32 rfAGCControl2; 	//AGC parameter control2 :
+							//		0xc54~0xc57,0xc5c~0xc5f, 0xc64~0xc67, 0xc6c~0xc6f [16 bytes]
+
+	u32 rfRxIQImbalance; //OFDM Rx IQ imbalance matrix :
+							//		0xc14~0xc17,0xc1c~0xc1f, 0xc24~0xc27, 0xc2c~0xc2f [16 bytes]
+
+	u32 rfRxAFE;  		//Rx IQ DC ofset and Rx digital filter, Rx DC notch filter :
+							//		0xc10~0xc13,0xc18~0xc1b, 0xc20~0xc23, 0xc28~0xc2b [16 bytes]
+
+	u32 rfTxIQImbalance; //OFDM Tx IQ imbalance matrix
+							//		0xc80~0xc83,0xc88~0xc8b, 0xc90~0xc93, 0xc98~0xc9b [16 bytes]
+
+	u32 rfTxAFE; 		//Tx IQ DC Offset and Tx DFIR type
+							//		0xc84~0xc87,0xc8c~0xc8f, 0xc94~0xc97, 0xc9c~0xc9f [16 bytes]
+
+	u32 rfLSSIReadBack; 	//LSSI RF readback data SI mode
+								//		0x8a0~0x8af [16 bytes]
+
+	u32 rfLSSIReadBackPi; 	//LSSI RF readback data PI mode 0x8b8-8bc for Path A and B
+
+}BB_REGISTER_DEFINITION_T, *PBB_REGISTER_DEFINITION_T;
+
+#ifdef CONFIG_MP_INCLUDED
+typedef enum _ANTENNA_PATH{
+        ANTENNA_NONE 	= 0x00,
+		ANTENNA_D		,
+		ANTENNA_C		,
+		ANTENNA_CD		,
+		ANTENNA_B		,
+		ANTENNA_BD		,
+		ANTENNA_BC		,
+		ANTENNA_BCD		,
+		ANTENNA_A		,
+		ANTENNA_AD		,
+		ANTENNA_AC		,
+		ANTENNA_ACD		,
+		ANTENNA_AB		,
+		ANTENNA_ABD		,
+		ANTENNA_ABC		,
+		ANTENNA_ABCD
+} ANTENNA_PATH;
+#endif
+
+typedef struct _R_ANTENNA_SELECT_OFDM{
+	u32			r_tx_antenna:4;
+	u32			r_ant_l:4;
+	u32			r_ant_non_ht:4;
+	u32			r_ant_ht1:4;
+	u32			r_ant_ht2:4;
+	u32			r_ant_ht_s1:4;
+	u32			r_ant_non_ht_s1:4;
+	u32			OFDM_TXSC:2;
+	u32			Reserved:2;
+}R_ANTENNA_SELECT_OFDM;
+
+typedef struct _R_ANTENNA_SELECT_CCK{
+	u8			r_cckrx_enable_2:2;
+	u8			r_cckrx_enable:2;
+	u8			r_ccktx_enable:4;
+}R_ANTENNA_SELECT_CCK;
+
+/*------------------------------Define structure----------------------------*/
+
+
+/*------------------------Export global variable----------------------------*/
+/*------------------------Export global variable----------------------------*/
+
+
+/*------------------------Export Marco Definition---------------------------*/
+/*------------------------Export Marco Definition---------------------------*/
+
+//Added for TX Power
+//u8 GetRightChnlPlace(u8 chnl);
+u8 rtl8192d_GetRightChnlPlaceforIQK(u8 chnl);
+u8 rtl8192d_getChnlGroupfromArray(u8 chnl);
+/*--------------------------Exported Function prototype---------------------*/
+//
+// BB and RF register read/write
+//
+void	rtl8192d_PHY_SetBBReg1Byte(	IN	PADAPTER	Adapter,
+								IN	u32		RegAddr,
+								IN	u32		BitMask,
+								IN	u32		Data	);
+u32	rtl8192d_PHY_QueryBBReg(	IN	PADAPTER	Adapter,
+								IN	u32		RegAddr,
+								IN	u32		BitMask	);
+void	rtl8192d_PHY_SetBBReg(	IN	PADAPTER	Adapter,
+								IN	u32		RegAddr,
+								IN	u32		BitMask,
+								IN	u32		Data	);
+u32	rtl8192d_PHY_QueryRFReg(	IN	PADAPTER			Adapter,
+								IN	RF_RADIO_PATH_E	eRFPath,
+								IN	u32				RegAddr,
+								IN	u32				BitMask	);
+void	rtl8192d_PHY_SetRFReg(	IN	PADAPTER			Adapter,
+								IN	RF_RADIO_PATH_E	eRFPath,
+								IN	u32				RegAddr,
+								IN	u32				BitMask,
+								IN	u32				Data	);
+
+//
+// Initialization related function
+//
+/* MAC/BB/RF HAL config */
+extern	int	PHY_MACConfig8192D(	IN	PADAPTER	Adapter	);
+extern	int	PHY_BBConfig8192D(	IN	PADAPTER	Adapter	);
+extern	int	PHY_RFConfig8192D(	IN	PADAPTER	Adapter	);
+/* RF config */
+int	rtl8192d_PHY_ConfigRFWithParaFile(	IN	PADAPTER	Adapter,
+												IN	u8* 	pFileName,
+												IN	RF_RADIO_PATH_E	eRFPath);
+int	rtl8192d_PHY_ConfigRFWithHeaderFile(	IN	PADAPTER			Adapter,
+												IN	RF_CONTENT			Content,
+												IN	RF_RADIO_PATH_E	eRFPath);
+/* BB/RF readback check for making sure init OK */
+int	rtl8192d_PHY_CheckBBAndRFOK(	IN	PADAPTER			Adapter,
+										IN	HW90_BLOCK_E		CheckBlock,
+										IN	RF_RADIO_PATH_E	eRFPath	  );
+/* Read initi reg value for tx power setting. */
+void	rtl8192d_PHY_GetHWRegOriginalValue(	IN	PADAPTER		Adapter	);
+
+//
+// RF Power setting
+//
+//extern	BOOLEAN	PHY_SetRFPowerState(IN	PADAPTER			Adapter,
+//									IN	RT_RF_POWER_STATE	eRFPowerState);
+
+//
+// BB TX Power R/W
+//
+void	PHY_GetTxPowerLevel8192D(	IN	PADAPTER		Adapter,
+											OUT u32*    		powerlevel	);
+void	PHY_SetTxPowerLevel8192D(	IN	PADAPTER		Adapter,
+											IN	u8			channel	);
+BOOLEAN	PHY_UpdateTxPowerDbm8192D(	IN	PADAPTER	Adapter,
+											IN	int		powerInDbm	);
+
+//
+VOID
+PHY_ScanOperationBackup8192D(IN	PADAPTER	Adapter,
+										IN	u8		Operation	);
+
+//
+// Switch bandwidth for 8192S
+//
+//void	PHY_SetBWModeCallback8192C(	IN	PRT_TIMER		pTimer	);
+void	PHY_SetBWMode8192D(	IN	PADAPTER			pAdapter,
+									IN	HT_CHANNEL_WIDTH	ChnlWidth,
+									IN	unsigned char	Offset	);
+
+//
+// Set FW CMD IO for 8192S.
+//
+//extern	BOOLEAN HalSetIO8192C(	IN	PADAPTER			Adapter,
+//									IN	IO_TYPE				IOType);
+
+//
+// Set A2 entry to fw for 8192S
+//
+extern	void FillA2Entry8192C(		IN	PADAPTER			Adapter,
+										IN	u8				index,
+										IN	u8*				val);
+
+
+//
+// channel switch related funciton
+//
+//extern	void	PHY_SwChnlCallback8192C(	IN	PRT_TIMER		pTimer	);
+void	PHY_SwChnl8192D(	IN	PADAPTER		pAdapter,
+									IN	u8			channel	);
+				// Call after initialization
+void	PHY_SwChnlPhy8192D(	IN	PADAPTER		pAdapter,
+									IN	u8			channel	);
+
+extern void ChkFwCmdIoDone(	IN	PADAPTER	Adapter);
+
+#ifdef USE_WORKITEM
+//extern 	void SetIOWorkItemCallback( IN PVOID            pContext );
+#else
+//extern	void SetIOTimerCallback( IN PRT_TIMER		pTimer);
+#endif
+
+//
+// BB/MAC/RF other monitor API
+//
+void	PHY_SetMonitorMode8192D(IN	PADAPTER	pAdapter,
+										IN	BOOLEAN		bEnableMonitorMode	);
+
+BOOLEAN	PHY_CheckIsLegalRfPath8192D(IN	PADAPTER	pAdapter,
+											IN	u32		eRFPath	);
+
+//
+// IQ calibrate
+//
+void	rtl8192d_PHY_IQCalibrate(	IN	PADAPTER	pAdapter);
+
+
+//
+// LC calibrate
+//
+void	rtl8192d_PHY_LCCalibrate(IN	PADAPTER	pAdapter);
+
+//
+// AP calibrate
+//
+void	rtl8192d_PHY_APCalibrate(IN	PADAPTER	pAdapter, IN 	char		delta);
+
+
+//
+// Modify the value of the hw register when beacon interval be changed.
+//
+void
+rtl8192d_PHY_SetBeaconHwReg(	IN	PADAPTER		Adapter,
+					IN	u16			BeaconInterval	);
+
+
+extern	VOID
+PHY_SwitchEphyParameter(
+	IN	PADAPTER			Adapter
+	);
+
+extern	VOID
+PHY_EnableHostClkReq(
+	IN	PADAPTER			Adapter
+	);
+
+BOOLEAN
+SetAntennaConfig92C(
+	IN	PADAPTER	Adapter,
+	IN	u8		DefaultAnt
+	);
+
+VOID
+PHY_StopTRXBeforeChangeBand8192D(
+	  PADAPTER		Adapter
+);
+
+VOID
+PHY_UpdateBBRFConfiguration8192D(
+	IN PADAPTER Adapter,
+	IN BOOLEAN bisBandSwitch
+);
+
+VOID PHY_ReadMacPhyMode92D(
+	IN PADAPTER	Adapter,
+	IN BOOLEAN 	AutoloadFail
+);
+
+VOID PHY_ConfigMacPhyMode92D(
+	IN PADAPTER	Adapter
+);
+
+VOID PHY_ConfigMacPhyModeInfo92D(
+	IN PADAPTER	Adapter
+);
+
+VOID PHY_ConfigMacCoexist_RFPage92D(
+	IN PADAPTER	Adapter
+);
+
+VOID
+rtl8192d_PHY_InitRxSetting(
+	IN	PADAPTER Adapter
+);
+
+VOID
+rtl8192d_PHY_ResetIQKResult(
+	IN	PADAPTER Adapter
+);
+
+
+VOID
+rtl8192d_PHY_SetRFPathSwitch(IN	PADAPTER	pAdapter, IN	BOOLEAN		bMain);
+
+VOID
+HalChangeCCKStatus8192D(
+	IN	PADAPTER	Adapter,
+	IN	BOOLEAN		bCCKDisable
+);
+
+VOID
+PHY_InitPABias92D(IN	PADAPTER Adapter);
+
+/*--------------------------Exported Function prototype---------------------*/
+
+#define PHY_SetBBReg1Byte(Adapter, RegAddr, BitMask, Data) rtl8192d_PHY_SetBBReg1Byte((Adapter), (RegAddr), (BitMask), (Data))
+#define PHY_QueryBBReg(Adapter, RegAddr, BitMask) rtl8192d_PHY_QueryBBReg((Adapter), (RegAddr), (BitMask))
+#define PHY_SetBBReg(Adapter, RegAddr, BitMask, Data) rtl8192d_PHY_SetBBReg((Adapter), (RegAddr), (BitMask), (Data))
+#define PHY_QueryRFReg(Adapter, eRFPath, RegAddr, BitMask) rtl8192d_PHY_QueryRFReg((Adapter), (eRFPath), (RegAddr), (BitMask))
+#define PHY_SetRFReg(Adapter, eRFPath, RegAddr, BitMask, Data) rtl8192d_PHY_SetRFReg((Adapter), (eRFPath), (RegAddr), (BitMask), (Data))
+
+#define PHY_SetMacReg	PHY_SetBBReg
+
+#endif	// __INC_HAL8192SPHYCFG_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DPhyReg.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DPhyReg.h
new file mode 100644
index 000000000000..f79d8a2c5c98
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DPhyReg.h
@@ -0,0 +1,1170 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*****************************************************************************
+ *
+ * Module:	__INC_HAL8192DPHYREG_H
+ *
+ *
+ * Note:	1. Define PMAC/BB register map
+ *			2. Define RF register map
+ *			3. PMAC/BB register bit mask.
+ *			4. RF reg bit mask.
+ *			5. Other BB/RF relative definition.
+ *
+ *
+ * Export:	Constants, macro, functions(API), global variables(None).
+ *
+ * Abbrev:
+ *
+ * History:
+ *		Data		Who		Remark
+ *      08/07/2007  MHC    	1. Porting from 9x series PHYCFG.h.
+ *							2. Reorganize code architecture.
+ *	09/25/2008	MH		1. Add RL6052 register definition
+ *
+ *****************************************************************************/
+#ifndef __INC_HAL8192DPHYREG_H
+#define __INC_HAL8192DPHYREG_H
+
+
+/*--------------------------Define Parameters-------------------------------*/
+
+//============================================================
+//       8192S Regsiter offset definition
+//============================================================
+
+//
+// BB-PHY register PMAC 0x100 PHY 0x800 - 0xEFF
+// 1. PMAC duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF
+// 2. 0x800/0x900/0xA00/0xC00/0xD00/0xE00
+// 3. RF register 0x00-2E
+// 4. Bit Mask for BB/RF register
+// 5. Other defintion for BB/RF R/W
+//
+
+
+//
+// 1. PMAC duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF
+// 1. Page1(0x100)
+//
+#define		rPMAC_Reset					0x100
+#define		rPMAC_TxStart					0x104
+#define		rPMAC_TxLegacySIG				0x108
+#define		rPMAC_TxHTSIG1				0x10c
+#define		rPMAC_TxHTSIG2				0x110
+#define		rPMAC_PHYDebug				0x114
+#define		rPMAC_TxPacketNum				0x118
+#define		rPMAC_TxIdle					0x11c
+#define		rPMAC_TxMACHeader0			0x120
+#define		rPMAC_TxMACHeader1			0x124
+#define		rPMAC_TxMACHeader2			0x128
+#define		rPMAC_TxMACHeader3			0x12c
+#define		rPMAC_TxMACHeader4			0x130
+#define		rPMAC_TxMACHeader5			0x134
+#define		rPMAC_TxDataType				0x138
+#define		rPMAC_TxRandomSeed			0x13c
+#define		rPMAC_CCKPLCPPreamble			0x140
+#define		rPMAC_CCKPLCPHeader			0x144
+#define		rPMAC_CCKCRC16				0x148
+#define		rPMAC_OFDMRxCRC32OK			0x170
+#define		rPMAC_OFDMRxCRC32Er			0x174
+#define		rPMAC_OFDMRxParityEr			0x178
+#define		rPMAC_OFDMRxCRC8Er			0x17c
+#define		rPMAC_CCKCRxRC16Er			0x180
+#define		rPMAC_CCKCRxRC32Er			0x184
+#define		rPMAC_CCKCRxRC32OK			0x188
+#define		rPMAC_TxStatus					0x18c
+
+//
+// 2. Page2(0x200)
+//
+// The following two definition are only used for USB interface.
+#define		RF_BB_CMD_ADDR				0x02c0	// RF/BB read/write command address.
+#define		RF_BB_CMD_DATA				0x02c4	// RF/BB read/write command data.
+
+//
+// 3. Page8(0x800)
+//
+#define		rFPGA0_RFMOD				0x800	//RF mode & CCK TxSC // RF BW Setting??
+
+#define		rFPGA0_TxInfo				0x804	// Status report??
+#define		rFPGA0_PSDFunction			0x808
+
+#define		rFPGA0_TxGainStage			0x80c	// Set TX PWR init gain?
+
+#define		rFPGA0_RFTiming1			0x810	// Useless now
+#define		rFPGA0_RFTiming2			0x814
+
+#define		rFPGA0_XA_HSSIParameter1		0x820	// RF 3 wire register
+#define		rFPGA0_XA_HSSIParameter2		0x824
+#define		rFPGA0_XB_HSSIParameter1		0x828
+#define		rFPGA0_XB_HSSIParameter2		0x82c
+
+#define		rFPGA0_XA_LSSIParameter		0x840
+#define		rFPGA0_XB_LSSIParameter		0x844
+
+#define		rFPGA0_RFWakeUpParameter		0x850	// Useless now
+#define		rFPGA0_RFSleepUpParameter		0x854
+
+#define		rFPGA0_XAB_SwitchControl		0x858	// RF Channel switch
+#define		rFPGA0_XCD_SwitchControl		0x85c
+
+#define		rFPGA0_XA_RFInterfaceOE		0x860	// RF Channel switch
+#define		rFPGA0_XB_RFInterfaceOE		0x864
+
+#define		rFPGA0_XAB_RFInterfaceSW		0x870	// RF Interface Software Control
+#define		rFPGA0_XCD_RFInterfaceSW		0x874
+
+#define		rFPGA0_XAB_RFParameter		0x878	// RF Parameter
+#define		rFPGA0_XCD_RFParameter		0x87c
+
+#define		rFPGA0_AnalogParameter1		0x880	// Crystal cap setting RF-R/W protection for parameter4??
+#define		rFPGA0_AnalogParameter2		0x884
+#define		rFPGA0_AnalogParameter3		0x888
+#define		rFPGA0_AdDaClockEn			0x888	// enable ad/da clock1 for dual-phy
+#define		rFPGA0_AnalogParameter4		0x88c
+
+#define		rFPGA0_XA_LSSIReadBack		0x8a0	// Tranceiver LSSI Readback
+#define		rFPGA0_XB_LSSIReadBack		0x8a4
+#define		rFPGA0_XC_LSSIReadBack		0x8a8
+#define		rFPGA0_XD_LSSIReadBack		0x8ac
+
+#define		rFPGA0_PSDReport				0x8b4	// Useless now
+#define		TransceiverA_HSPI_Readback	0x8b8	// Transceiver A HSPI Readback
+#define		TransceiverB_HSPI_Readback	0x8bc	// Transceiver B HSPI Readback
+#define		rFPGA0_XAB_RFInterfaceRB		0x8e0	// Useless now // RF Interface Readback Value
+#define		rFPGA0_XCD_RFInterfaceRB		0x8e4	// Useless now
+
+//
+// 4. Page9(0x900)
+//
+#define		rFPGA1_RFMOD				0x900	//RF mode & OFDM TxSC // RF BW Setting??
+
+#define		rFPGA1_TxBlock				0x904	// Useless now
+#define		rFPGA1_DebugSelect			0x908	// Useless now
+#define		rFPGA1_TxInfo				0x90c	// Useless now // Status report??
+
+//
+// 5. PageA(0xA00)
+//
+// Set Control channel to upper or lower. These settings are required only for 40MHz
+#define		rCCK0_System				0xa00
+
+#define		rCCK0_AFESetting			0xa04	// Disable init gain now // Select RX path by RSSI
+#define		rCCK0_CCA					0xa08	// Disable init gain now // Init gain
+
+#define		rCCK0_RxAGC1				0xa0c 	//AGC default value, saturation level // Antenna Diversity, RX AGC, LNA Threshold, RX LNA Threshold useless now. Not the same as 90 series
+#define		rCCK0_RxAGC2				0xa10 	//AGC & DAGC
+
+#define		rCCK0_RxHP					0xa14
+
+#define		rCCK0_DSPParameter1		0xa18	//Timing recovery & Channel estimation threshold
+#define		rCCK0_DSPParameter2		0xa1c	//SQ threshold
+
+#define		rCCK0_TxFilter1				0xa20
+#define		rCCK0_TxFilter2				0xa24
+#define		rCCK0_DebugPort			0xa28	//debug port and Tx filter3
+#define		rCCK0_FalseAlarmReport		0xa2c	//0xa2d	useless now 0xa30-a4f channel report
+#define		rCCK0_TRSSIReport         		0xa50
+#define		rCCK0_RxReport            		0xa54  //0xa57
+#define		rCCK0_FACounterLower      	0xa5c  //0xa5b
+#define		rCCK0_FACounterUpper      	0xa58  //0xa5c
+
+//
+// PageB(0xB00)
+//
+#define		rPdp_AntA      					0xb00
+#define		rPdp_AntA_4    				0xb04
+#define		rPdp_AntA_8    				0xb08
+#define		rPdp_AntA_C    				0xb0c
+#define		rPdp_AntA_10    				0xb10
+#define		rPdp_AntA_14    				0xb14
+#define		rPdp_AntA_18    				0xb18
+#define		rPdp_AntA_1C    				0xb1c
+#define		rPdp_AntA_20    				0xb20
+#define		rPdp_AntA_24    				0xb24
+
+#define		rConfig_Pmpd_AntA 			0xb28
+#define		rConfig_ram64x16				0xb2c
+
+#define		rBndA						0xb30
+#define		rHssiPar						0xb34
+
+#define		rConfig_AntA 					0xb68
+#define		rConfig_AntB 					0xb6c
+
+#define		rPdp_AntB 					0xb70
+#define		rPdp_AntB_4 					0xb74
+#define		rPdp_AntB_8 					0xb78
+#define		rPdp_AntB_C 					0xb7c
+#define		rPdp_AntB_10 					0xb80
+#define		rPdp_AntB_14 					0xb84
+#define		rPdp_AntB_18 					0xb88
+#define		rPdp_AntB_1C 					0xb8c
+#define		rPdp_AntB_20 					0xb90
+#define		rPdp_AntB_24 					0xb94
+
+#define		rConfig_Pmpd_AntB			0xb98
+
+#define		rBndB						0xba0
+
+#define		rAPK							0xbd8
+#define		rPm_Rx0_AntA				0xbdc
+#define		rPm_Rx1_AntA				0xbe0
+#define		rPm_Rx2_AntA				0xbe4
+#define		rPm_Rx3_AntA				0xbe8
+#define		rPm_Rx0_AntB				0xbec
+#define		rPm_Rx1_AntB				0xbf0
+#define		rPm_Rx2_AntB				0xbf4
+#define		rPm_Rx3_AntB				0xbf8
+
+//
+// 6. PageC(0xC00)
+//
+#define		rOFDM0_LSTF				0xc00
+
+#define		rOFDM0_TRxPathEnable		0xc04
+#define		rOFDM0_TRMuxPar			0xc08
+#define		rOFDM0_TRSWIsolation		0xc0c
+
+#define		rOFDM0_XARxAFE			0xc10  //RxIQ DC offset, Rx digital filter, DC notch filter
+#define		rOFDM0_XARxIQImbalance    	0xc14  //RxIQ imblance matrix
+#define		rOFDM0_XBRxAFE            		0xc18
+#define		rOFDM0_XBRxIQImbalance    	0xc1c
+#define		rOFDM0_XCRxAFE            		0xc20
+#define		rOFDM0_XCRxIQImbalance    	0xc24
+#define		rOFDM0_XDRxAFE            		0xc28
+#define		rOFDM0_XDRxIQImbalance    	0xc2c
+
+#define		rOFDM0_RxDetector1			0xc30  //PD,BW & SBD	// DM tune init gain
+#define		rOFDM0_RxDetector2			0xc34  //SBD & Fame Sync.
+#define		rOFDM0_RxDetector3			0xc38  //Frame Sync.
+#define		rOFDM0_RxDetector4			0xc3c  //PD, SBD, Frame Sync & Short-GI
+
+#define		rOFDM0_RxDSP				0xc40  //Rx Sync Path
+#define		rOFDM0_CFOandDAGC		0xc44  //CFO & DAGC
+#define		rOFDM0_CCADropThreshold	0xc48 //CCA Drop threshold
+#define		rOFDM0_ECCAThreshold		0xc4c // energy CCA
+
+#define		rOFDM0_XAAGCCore1			0xc50	// DIG
+#define		rOFDM0_XAAGCCore2			0xc54
+#define		rOFDM0_XBAGCCore1			0xc58
+#define		rOFDM0_XBAGCCore2			0xc5c
+#define		rOFDM0_XCAGCCore1			0xc60
+#define		rOFDM0_XCAGCCore2			0xc64
+#define		rOFDM0_XDAGCCore1			0xc68
+#define		rOFDM0_XDAGCCore2			0xc6c
+
+#define		rOFDM0_AGCParameter1			0xc70
+#define		rOFDM0_AGCParameter2			0xc74
+#define		rOFDM0_AGCRSSITable			0xc78
+#define		rOFDM0_HTSTFAGC				0xc7c
+
+#define		rOFDM0_XATxIQImbalance		0xc80	// TX PWR TRACK and DIG
+#define		rOFDM0_XATxAFE				0xc84
+#define		rOFDM0_XBTxIQImbalance		0xc88
+#define		rOFDM0_XBTxAFE				0xc8c
+#define		rOFDM0_XCTxIQImbalance		0xc90
+#define		rOFDM0_XCTxAFE            			0xc94
+#define		rOFDM0_XDTxIQImbalance		0xc98
+#define		rOFDM0_XDTxAFE				0xc9c
+
+#define		rOFDM0_RxIQExtAnta			0xca0
+#define		rOFDM0_TxCoeff1				0xca4
+#define		rOFDM0_TxCoeff2				0xca8
+#define		rOFDM0_TxCoeff3				0xcac
+#define		rOFDM0_TxCoeff4				0xcb0
+#define		rOFDM0_TxCoeff5				0xcb4
+#define		rOFDM0_TxCoeff6				0xcb8
+#define		rOFDM0_RxHPParameter			0xce0
+#define		rOFDM0_TxPseudoNoiseWgt		0xce4
+#define		rOFDM0_FrameSync				0xcf0
+#define		rOFDM0_DFSReport				0xcf4
+
+//
+// 7. PageD(0xD00)
+//
+#define		rOFDM1_LSTF					0xd00
+#define		rOFDM1_TRxPathEnable			0xd04
+
+#define		rOFDM1_CFO						0xd08	// No setting now
+#define		rOFDM1_CSI1					0xd10
+#define		rOFDM1_SBD						0xd14
+#define		rOFDM1_CSI2					0xd18
+#define		rOFDM1_CFOTracking			0xd2c
+#define		rOFDM1_TRxMesaure1			0xd34
+#define		rOFDM1_IntfDet					0xd3c
+#define		rOFDM1_PseudoNoiseStateAB		0xd50
+#define		rOFDM1_PseudoNoiseStateCD		0xd54
+#define		rOFDM1_RxPseudoNoiseWgt		0xd58
+
+#define		rOFDM_PHYCounter1				0xda0  //cca, parity fail
+#define		rOFDM_PHYCounter2				0xda4  //rate illegal, crc8 fail
+#define		rOFDM_PHYCounter3				0xda8  //MCS not support
+
+#define		rOFDM_ShortCFOAB				0xdac	// No setting now
+#define		rOFDM_ShortCFOCD				0xdb0
+#define		rOFDM_LongCFOAB				0xdb4
+#define		rOFDM_LongCFOCD				0xdb8
+#define		rOFDM_TailCFOAB				0xdbc
+#define		rOFDM_TailCFOCD				0xdc0
+#define		rOFDM_PWMeasure1          		0xdc4
+#define		rOFDM_PWMeasure2          		0xdc8
+#define		rOFDM_BWReport				0xdcc
+#define		rOFDM_AGCReport				0xdd0
+#define		rOFDM_RxSNR					0xdd4
+#define		rOFDM_RxEVMCSI				0xdd8
+#define		rOFDM_SIGReport				0xddc
+
+
+//
+// 8. PageE(0xE00)
+//
+#define		rTxAGC_A_Rate18_06			0xe00
+#define		rTxAGC_A_Rate54_24			0xe04
+#define		rTxAGC_A_CCK1_Mcs32			0xe08
+#define		rTxAGC_A_Mcs03_Mcs00			0xe10
+#define		rTxAGC_A_Mcs07_Mcs04			0xe14
+#define		rTxAGC_A_Mcs11_Mcs08			0xe18
+#define		rTxAGC_A_Mcs15_Mcs12			0xe1c
+
+#define		rTxAGC_B_Rate18_06			0x830
+#define		rTxAGC_B_Rate54_24			0x834
+#define		rTxAGC_B_CCK1_55_Mcs32		0x838
+#define		rTxAGC_B_Mcs03_Mcs00			0x83c
+#define		rTxAGC_B_Mcs07_Mcs04			0x848
+#define		rTxAGC_B_Mcs11_Mcs08			0x84c
+#define		rTxAGC_B_Mcs15_Mcs12			0x868
+#define		rTxAGC_B_CCK11_A_CCK2_11		0x86c
+
+#define		rFPGA0_IQK						0xe28
+#define		rTx_IQK_Tone_A					0xe30
+#define		rRx_IQK_Tone_A					0xe34
+#define		rTx_IQK_PI_A					0xe38
+#define		rRx_IQK_PI_A					0xe3c
+
+#define		rTx_IQK 						0xe40
+#define		rRx_IQK							0xe44
+#define		rIQK_AGC_Pts					0xe48
+#define		rIQK_AGC_Rsp					0xe4c
+#define		rTx_IQK_Tone_B					0xe50
+#define		rRx_IQK_Tone_B					0xe54
+#define		rTx_IQK_PI_B					0xe58
+#define		rRx_IQK_PI_B					0xe5c
+#define		rIQK_AGC_Cont					0xe60
+
+#define		rBlue_Tooth						0xe6c
+#define		rRx_Wait_CCA					0xe70
+#define		rTx_CCK_RFON					0xe74
+#define		rTx_CCK_BBON					0xe78
+#define		rTx_OFDM_RFON					0xe7c
+#define		rTx_OFDM_BBON					0xe80
+#define		rTx_To_Rx						0xe84
+#define		rTx_To_Tx						0xe88
+#define		rRx_CCK							0xe8c
+
+#define		rTx_Power_Before_IQK_A		0xe94
+#define		rTx_Power_After_IQK_A			0xe9c
+
+#define		rRx_Power_Before_IQK_A		0xea0
+#define		rRx_Power_Before_IQK_A_2		0xea4
+#define		rRx_Power_After_IQK_A			0xea8
+#define		rRx_Power_After_IQK_A_2		0xeac
+
+#define		rTx_Power_Before_IQK_B		0xeb4
+#define		rTx_Power_After_IQK_B			0xebc
+
+#define		rRx_Power_Before_IQK_B		0xec0
+#define		rRx_Power_Before_IQK_B_2		0xec4
+#define		rRx_Power_After_IQK_B			0xec8
+#define		rRx_Power_After_IQK_B_2		0xecc
+
+#define		rRx_OFDM						0xed0
+#define		rRx_Wait_RIFS 					0xed4
+#define		rRx_TO_Rx 						0xed8
+#define		rStandby 						0xedc
+#define		rSleep 							0xee0
+#define		rPMPD_ANAEN					0xeec
+
+//
+// 7. RF Register 0x00-0x2E (RF 8256)
+//    RF-0222D 0x00-3F
+//
+//Zebra1
+#define		rZebra1_HSSIEnable				0x0	// Useless now
+#define		rZebra1_TRxEnable1				0x1
+#define		rZebra1_TRxEnable2				0x2
+#define		rZebra1_AGC					0x4
+#define		rZebra1_ChargePump			0x5
+#define		rZebra1_Channel				0x7	// RF channel switch
+
+//#endif
+#define		rZebra1_TxGain					0x8	// Useless now
+#define		rZebra1_TxLPF					0x9
+#define		rZebra1_RxLPF					0xb
+#define		rZebra1_RxHPFCorner			0xc
+
+//Zebra4
+#define		rGlobalCtrl						0	// Useless now
+#define		rRTL8256_TxLPF					19
+#define		rRTL8256_RxLPF					11
+
+//RTL8258
+#define		rRTL8258_TxLPF					0x11	// Useless now
+#define		rRTL8258_RxLPF					0x13
+#define		rRTL8258_RSSILPF				0xa
+
+//
+// RL6052 Register definition
+//
+#define		RF_AC						0x00	//
+
+#define		RF_IQADJ_G1				0x01	//
+#define		RF_IQADJ_G2				0x02	//
+#define		RF_BS_PA_APSET_G1_G4		0x03
+#define		RF_BS_PA_APSET_G5_G8		0x04
+#define		RF_POW_TRSW				0x05	//
+
+#define		RF_GAIN_RX					0x06	//
+#define		RF_GAIN_TX					0x07	//
+
+#define		RF_TXM_IDAC				0x08	//
+#define		RF_IPA_G					0x09	//
+#define		RF_TXBIAS_G				0x0A
+#define		RF_TXPA_AG					0x0B
+#define		RF_IPA_A					0x0C	//
+#define		RF_TXBIAS_A				0x0D
+#define		RF_BS_PA_APSET_G9_G11	0x0E
+#define		RF_BS_IQGEN				0x0F	//
+
+#define		RF_MODE1					0x10	//
+#define		RF_MODE2					0x11	//
+
+#define		RF_RX_AGC_HP				0x12	//
+#define		RF_TX_AGC					0x13	//
+#define		RF_BIAS						0x14	//
+#define		RF_IPA						0x15	//
+#define		RF_POW_ABILITY			0x17	//
+#define		RF_MODE_AG				0x18	//
+#define		rRfChannel					0x18	// RF channel and BW switch
+#define		RF_CHNLBW					0x18	// RF channel and BW switch
+#define		RF_TOP						0x19	//
+
+#define		RF_RX_G1					0x1A	//
+#define		RF_RX_G2					0x1B	//
+
+#define		RF_RX_BB2					0x1C	//
+#define		RF_RX_BB1					0x1D	//
+
+#define		RF_RCK1					0x1E	//
+#define		RF_RCK2					0x1F	//
+
+#define		RF_TX_G1					0x20	//
+#define		RF_TX_G2					0x21	//
+#define		RF_TX_G3					0x22	//
+
+#define		RF_TX_BB1					0x23	//
+
+#define		RF_T_METER					0x42	//
+
+#define		RF_SYN_G1					0x25	// RF TX Power control
+#define		RF_SYN_G2					0x26	// RF TX Power control
+#define		RF_SYN_G3					0x27	// RF TX Power control
+#define		RF_SYN_G4					0x28	// RF TX Power control
+#define		RF_SYN_G5					0x29	// RF TX Power control
+#define		RF_SYN_G6					0x2A	// RF TX Power control
+#define		RF_SYN_G7					0x2B	// RF TX Power control
+#define		RF_SYN_G8					0x2C	// RF TX Power control
+
+#define		RF_RCK_OS					0x30	// RF TX PA control
+
+#define		RF_TXPA_G1					0x31	// RF TX PA control
+#define		RF_TXPA_G2					0x32	// RF TX PA control
+#define		RF_TXPA_G3					0x33	// RF TX PA control
+#define		RF_LOBF_9					0x38
+#define		RF_RXRF_A3					0x3C	//
+#define		RF_TRSW					0x3F
+
+#define		RF_TXRF_A2					0x41
+#define		RF_TXPA_G4					0x46
+#define		RF_TXPA_A4					0x4B
+
+//
+//Bit Mask
+//
+// 1. Page1(0x100)
+#define		bBBResetB						0x100	// Useless now?
+#define		bGlobalResetB					0x200
+#define		bOFDMTxStart					0x4
+#define		bCCKTxStart						0x8
+#define		bCRC32Debug					0x100
+#define		bPMACLoopback					0x10
+#define		bTxLSIG							0xffffff
+#define		bOFDMTxRate					0xf
+#define		bOFDMTxReserved				0x10
+#define		bOFDMTxLength					0x1ffe0
+#define		bOFDMTxParity					0x20000
+#define		bTxHTSIG1						0xffffff
+#define		bTxHTMCSRate					0x7f
+#define		bTxHTBW						0x80
+#define		bTxHTLength					0xffff00
+#define		bTxHTSIG2						0xffffff
+#define		bTxHTSmoothing					0x1
+#define		bTxHTSounding					0x2
+#define		bTxHTReserved					0x4
+#define		bTxHTAggreation				0x8
+#define		bTxHTSTBC						0x30
+#define		bTxHTAdvanceCoding			0x40
+#define		bTxHTShortGI					0x80
+#define		bTxHTNumberHT_LTF			0x300
+#define		bTxHTCRC8						0x3fc00
+#define		bCounterReset					0x10000
+#define		bNumOfOFDMTx					0xffff
+#define		bNumOfCCKTx					0xffff0000
+#define		bTxIdleInterval					0xffff
+#define		bOFDMService					0xffff0000
+#define		bTxMACHeader					0xffffffff
+#define		bTxDataInit						0xff
+#define		bTxHTMode						0x100
+#define		bTxDataType					0x30000
+#define		bTxRandomSeed					0xffffffff
+#define		bCCKTxPreamble					0x1
+#define		bCCKTxSFD						0xffff0000
+#define		bCCKTxSIG						0xff
+#define		bCCKTxService					0xff00
+#define		bCCKLengthExt					0x8000
+#define		bCCKTxLength					0xffff0000
+#define		bCCKTxCRC16					0xffff
+#define		bCCKTxStatus					0x1
+#define		bOFDMTxStatus					0x2
+
+#define 		IS_BB_REG_OFFSET_92S(_Offset)		((_Offset >= 0x800) && (_Offset <= 0xfff))
+
+// 2. Page8(0x800)
+#define		bRFMOD							0x1	// Reg 0x800 rFPGA0_RFMOD
+#define		bJapanMode						0x2
+#define		bCCKTxSC						0x30
+#define		bCCKEn							0x1000000
+#define		bOFDMEn						0x2000000
+
+#define		bOFDMRxADCPhase           		0x10000	// Useless now
+#define		bOFDMTxDACPhase           		0x40000
+#define		bXATxAGC                  			0x3f
+
+#define		bAntennaSelect                 		0x0300
+
+#define		bXBTxAGC                  			0xf00	// Reg 80c rFPGA0_TxGainStage
+#define		bXCTxAGC                  			0xf000
+#define		bXDTxAGC                  			0xf0000
+
+#define		bPAStart                  			0xf0000000	// Useless now
+#define		bTRStart                  			0x00f00000
+#define		bRFStart                  			0x0000f000
+#define		bBBStart                  			0x000000f0
+#define		bBBCCKStart               		0x0000000f
+#define		bPAEnd                    			0xf          //Reg0x814
+#define		bTREnd                    			0x0f000000
+#define		bRFEnd                    			0x000f0000
+#define		bCCAMask                  			0x000000f0   //T2R
+#define		bR2RCCAMask               		0x00000f00
+#define		bHSSI_R2TDelay            		0xf8000000
+#define		bHSSI_T2RDelay            		0xf80000
+#define		bContTxHSSI               		0x400     //chane gain at continue Tx
+#define		bIGFromCCK                		0x200
+#define		bAGCAddress               		0x3f
+#define		bRxHPTx                   			0x7000
+#define		bRxHPT2R                  			0x38000
+#define		bRxHPCCKIni               		0xc0000
+#define		bAGCTxCode                		0xc00000
+#define		bAGCRxCode                		0x300000
+
+#define		b3WireDataLength          		0x800	// Reg 0x820~84f rFPGA0_XA_HSSIParameter1
+#define		b3WireAddressLength       		0x400
+
+#define		b3WireRFPowerDown         		0x1	// Useless now
+//#define bHWSISelect               		0x8
+#define		b5GPAPEPolarity           		0x40000000
+#define		b2GPAPEPolarity           		0x80000000
+#define		bRFSW_TxDefaultAnt        		0x3
+#define		bRFSW_TxOptionAnt         		0x30
+#define		bRFSW_RxDefaultAnt        		0x300
+#define		bRFSW_RxOptionAnt         		0x3000
+#define		bRFSI_3WireData           		0x1
+#define		bRFSI_3WireClock          		0x2
+#define		bRFSI_3WireLoad           		0x4
+#define		bRFSI_3WireRW             		0x8
+#define		bRFSI_3Wire               			0xf
+
+#define		bRFSI_RFENV               		0x10	// Reg 0x870 rFPGA0_XAB_RFInterfaceSW
+
+#define		bRFSI_TRSW                		0x20	// Useless now
+#define		bRFSI_TRSWB               		0x40
+#define		bRFSI_ANTSW               		0x100
+#define		bRFSI_ANTSWB              		0x200
+#define		bRFSI_PAPE                			0x400
+#define		bRFSI_PAPE5G              		0x800
+#define		bBandSelect               			0x1
+#define		bHTSIG2_GI                			0x80
+#define		bHTSIG2_Smoothing         		0x01
+#define		bHTSIG2_Sounding          		0x02
+#define		bHTSIG2_Aggreaton         		0x08
+#define		bHTSIG2_STBC              		0x30
+#define		bHTSIG2_AdvCoding         		0x40
+#define		bHTSIG2_NumOfHTLTF        	0x300
+#define		bHTSIG2_CRC8              		0x3fc
+#define		bHTSIG1_MCS               		0x7f
+#define		bHTSIG1_BandWidth         		0x80
+#define		bHTSIG1_HTLength          		0xffff
+#define		bLSIG_Rate                			0xf
+#define		bLSIG_Reserved            		0x10
+#define		bLSIG_Length              		0x1fffe
+#define		bLSIG_Parity              			0x20
+#define		bCCKRxPhase               		0x4
+
+#define		bLSSIReadAddress          		0x7f800000   // T65 RF
+
+#define		bLSSIReadEdge             		0x80000000   //LSSI "Read" edge signal
+
+#define		bLSSIReadBackData         		0xfffff		// T65 RF
+
+#define		bLSSIReadOKFlag           		0x1000	// Useless now
+#define		bCCKSampleRate            		0x8       //0: 44MHz, 1:88MHz
+#define		bRegulator0Standby        		0x1
+#define		bRegulatorPLLStandby      		0x2
+#define		bRegulator1Standby        		0x4
+#define		bPLLPowerUp               		0x8
+#define		bDPLLPowerUp              		0x10
+#define		bDA10PowerUp              		0x20
+#define		bAD7PowerUp               		0x200
+#define		bDA6PowerUp               		0x2000
+#define		bXtalPowerUp              		0x4000
+#define		b40MDClkPowerUP           		0x8000
+#define		bDA6DebugMode             		0x20000
+#define		bDA6Swing                 			0x380000
+
+#define		bADClkPhase               		0x4000000	// Reg 0x880 rFPGA0_AnalogParameter1 20/40 CCK support switch 40/80 BB MHZ
+
+#define		b80MClkDelay              		0x18000000	// Useless
+#define		bAFEWatchDogEnable        		0x20000000
+
+#define		bXtalCap01                			0xc0000000	// Reg 0x884 rFPGA0_AnalogParameter2 Crystal cap
+#define		bXtalCap23                			0x3
+#define		bXtalCap92x					0x0f000000
+#define 		bXtalCap                			0x0f000000
+
+#define		bIntDifClkEnable          		0x400	// Useless
+#define		bExtSigClkEnable         	 	0x800
+#define		bBandgapMbiasPowerUp      	0x10000
+#define		bAD11SHGain               		0xc0000
+#define		bAD11InputRange           		0x700000
+#define		bAD11OPCurrent            		0x3800000
+#define		bIPathLoopback            		0x4000000
+#define		bQPathLoopback            		0x8000000
+#define		bAFELoopback              		0x10000000
+#define		bDA10Swing                		0x7e0
+#define		bDA10Reverse              		0x800
+#define		bDAClkSource              		0x1000
+#define		bAD7InputRange            		0x6000
+#define		bAD7Gain                  			0x38000
+#define		bAD7OutputCMMode          		0x40000
+#define		bAD7InputCMMode           		0x380000
+#define		bAD7Current               			0xc00000
+#define		bRegulatorAdjust          		0x7000000
+#define		bAD11PowerUpAtTx          		0x1
+#define		bDA10PSAtTx               		0x10
+#define		bAD11PowerUpAtRx          		0x100
+#define		bDA10PSAtRx               		0x1000
+#define		bCCKRxAGCFormat           		0x200
+#define		bPSDFFTSamplepPoint       		0xc000
+#define		bPSDAverageNum            		0x3000
+#define		bIQPathControl            		0xc00
+#define		bPSDFreq                  			0x3ff
+#define		bPSDAntennaPath           		0x30
+#define		bPSDIQSwitch              		0x40
+#define		bPSDRxTrigger             		0x400000
+#define		bPSDTxTrigger             		0x80000000
+#define		bPSDSineToneScale        		0x7f000000
+#define		bPSDReport                			0xffff
+
+// 3. Page9(0x900)
+#define		bOFDMTxSC                 		0x30000000	// Useless
+#define		bCCKTxOn                  			0x1
+#define		bOFDMTxOn                 		0x2
+#define		bDebugPage                		0xfff  //reset debug page and also HWord, LWord
+#define		bDebugItem                		0xff   //reset debug page and LWord
+#define		bAntL              	       		0x10
+#define		bAntNonHT           	      			0x100
+#define		bAntHT1               			0x1000
+#define		bAntHT2                   			0x10000
+#define		bAntHT1S1                 			0x100000
+#define		bAntNonHTS1               		0x1000000
+
+// 4. PageA(0xA00)
+#define		bCCKBBMode				0x3	// Useless
+#define		bCCKTxPowerSaving		0x80
+#define		bCCKRxPowerSaving		0x40
+
+#define		bCCKSideBand			0x10	// Reg 0xa00 rCCK0_System 20/40 switch
+
+#define		bCCKScramble			0x8	// Useless
+#define		bCCKAntDiversity		0x8000
+#define		bCCKCarrierRecovery		0x4000
+#define		bCCKTxRate				0x3000
+#define		bCCKDCCancel			0x0800
+#define		bCCKISICancel			0x0400
+#define		bCCKMatchFilter			0x0200
+#define		bCCKEqualizer			0x0100
+#define		bCCKPreambleDetect		0x800000
+#define		bCCKFastFalseCCA		0x400000
+#define		bCCKChEstStart			0x300000
+#define		bCCKCCACount			0x080000
+#define		bCCKcs_lim				0x070000
+#define		bCCKBistMode			0x80000000
+#define		bCCKCCAMask			0x40000000
+#define		bCCKTxDACPhase		0x4
+#define		bCCKRxADCPhase		0x20000000   //r_rx_clk
+#define		bCCKr_cp_mode0		0x0100
+#define		bCCKTxDCOffset			0xf0
+#define		bCCKRxDCOffset			0xf
+#define		bCCKCCAMode			0xc000
+#define		bCCKFalseCS_lim			0x3f00
+#define		bCCKCS_ratio			0xc00000
+#define		bCCKCorgBit_sel			0x300000
+#define		bCCKPD_lim				0x0f0000
+#define		bCCKNewCCA			0x80000000
+#define		bCCKRxHPofIG			0x8000
+#define		bCCKRxIG				0x7f00
+#define		bCCKLNAPolarity			0x800000
+#define		bCCKRx1stGain			0x7f0000
+#define		bCCKRFExtend			0x20000000 //CCK Rx Iinital gain polarity
+#define		bCCKRxAGCSatLevel		0x1f000000
+#define		bCCKRxAGCSatCount		0xe0
+#define		bCCKRxRFSettle			0x1f       //AGCsamp_dly
+#define		bCCKFixedRxAGC			0x8000
+//#define bCCKRxAGCFormat         	 	0x4000   //remove to HSSI register 0x824
+#define		bCCKAntennaPolarity		0x2000
+#define		bCCKTxFilterType		0x0c00
+#define		bCCKRxAGCReportType	0x0300
+#define		bCCKRxDAGCEn			0x80000000
+#define		bCCKRxDAGCPeriod		0x20000000
+#define		bCCKRxDAGCSatLevel		0x1f000000
+#define		bCCKTimingRecovery		0x800000
+#define		bCCKTxC0				0x3f0000
+#define		bCCKTxC1				0x3f000000
+#define		bCCKTxC2				0x3f
+#define		bCCKTxC3				0x3f00
+#define		bCCKTxC4				0x3f0000
+#define		bCCKTxC5				0x3f000000
+#define		bCCKTxC6				0x3f
+#define		bCCKTxC7				0x3f00
+#define		bCCKDebugPort			0xff0000
+#define		bCCKDACDebug			0x0f000000
+#define		bCCKFalseAlarmEnable	0x8000
+#define		bCCKFalseAlarmRead		0x4000
+#define		bCCKTRSSI				0x7f
+#define		bCCKRxAGCReport		0xfe
+#define		bCCKRxReport_AntSel	0x80000000
+#define		bCCKRxReport_MFOff		0x40000000
+#define		bCCKRxRxReport_SQLoss	0x20000000
+#define		bCCKRxReport_Pktloss	0x10000000
+#define		bCCKRxReport_Lockedbit	0x08000000
+#define		bCCKRxReport_RateError	0x04000000
+#define		bCCKRxReport_RxRate	0x03000000
+#define		bCCKRxFACounterLower	0xff
+#define		bCCKRxFACounterUpper	0xff000000
+#define		bCCKRxHPAGCStart		0xe000
+#define		bCCKRxHPAGCFinal		0x1c00
+#define		bCCKRxFalseAlarmEnable	0x8000
+#define		bCCKFACounterFreeze	0x4000
+#define		bCCKTxPathSel			0x10000000
+#define		bCCKDefaultRxPath		0xc000000
+#define		bCCKOptionRxPath		0x3000000
+
+// 5. PageC(0xC00)
+#define		bNumOfSTF				0x3	// Useless
+#define		bShift_L					0xc0
+#define		bGI_TH					0xc
+#define		bRxPathA				0x1
+#define		bRxPathB				0x2
+#define		bRxPathC				0x4
+#define		bRxPathD				0x8
+#define		bTxPathA				0x1
+#define		bTxPathB				0x2
+#define		bTxPathC				0x4
+#define		bTxPathD				0x8
+#define		bTRSSIFreq				0x200
+#define		bADCBackoff				0x3000
+#define		bDFIRBackoff			0xc000
+#define		bTRSSILatchPhase		0x10000
+#define		bRxIDCOffset			0xff
+#define		bRxQDCOffset			0xff00
+#define		bRxDFIRMode			0x1800000
+#define		bRxDCNFType			0xe000000
+#define		bRXIQImb_A				0x3ff
+#define		bRXIQImb_B				0xfc00
+#define		bRXIQImb_C				0x3f0000
+#define		bRXIQImb_D				0xffc00000
+#define		bDC_dc_Notch			0x60000
+#define		bRxNBINotch			0x1f000000
+#define		bPD_TH					0xf
+#define		bPD_TH_Opt2			0xc000
+#define		bPWED_TH				0x700
+#define		bIfMF_Win_L			0x800
+#define		bPD_Option				0x1000
+#define		bMF_Win_L				0xe000
+#define		bBW_Search_L			0x30000
+#define		bwin_enh_L				0xc0000
+#define		bBW_TH					0x700000
+#define		bED_TH2				0x3800000
+#define		bBW_option				0x4000000
+#define		bRatio_TH				0x18000000
+#define		bWindow_L				0xe0000000
+#define		bSBD_Option				0x1
+#define		bFrame_TH				0x1c
+#define		bFS_Option				0x60
+#define		bDC_Slope_check		0x80
+#define		bFGuard_Counter_DC_L	0xe00
+#define		bFrame_Weight_Short	0x7000
+#define		bSub_Tune				0xe00000
+#define		bFrame_DC_Length		0xe000000
+#define		bSBD_start_offset		0x30000000
+#define		bFrame_TH_2			0x7
+#define		bFrame_GI2_TH			0x38
+#define		bGI2_Sync_en			0x40
+#define		bSarch_Short_Early		0x300
+#define		bSarch_Short_Late		0xc00
+#define		bSarch_GI2_Late		0x70000
+#define		bCFOAntSum				0x1
+#define		bCFOAcc				0x2
+#define		bCFOStartOffset			0xc
+#define		bCFOLookBack			0x70
+#define		bCFOSumWeight			0x80
+#define		bDAGCEnable			0x10000
+#define		bTXIQImb_A				0x3ff
+#define		bTXIQImb_B				0xfc00
+#define		bTXIQImb_C				0x3f0000
+#define		bTXIQImb_D				0xffc00000
+#define		bTxIDCOffset			0xff
+#define		bTxQDCOffset			0xff00
+#define		bTxDFIRMode			0x10000
+#define		bTxPesudoNoiseOn		0x4000000
+#define		bTxPesudoNoise_A		0xff
+#define		bTxPesudoNoise_B		0xff00
+#define		bTxPesudoNoise_C		0xff0000
+#define		bTxPesudoNoise_D		0xff000000
+#define		bCCADropOption			0x20000
+#define		bCCADropThres			0xfff00000
+#define		bEDCCA_H				0xf
+#define		bEDCCA_L				0xf0
+#define		bLambda_ED			0x300
+#define		bRxInitialGain			0x7f
+#define		bRxAntDivEn				0x80
+#define		bRxAGCAddressForLNA	0x7f00
+#define		bRxHighPowerFlow		0x8000
+#define		bRxAGCFreezeThres		0xc0000
+#define		bRxFreezeStep_AGC1	0x300000
+#define		bRxFreezeStep_AGC2	0xc00000
+#define		bRxFreezeStep_AGC3	0x3000000
+#define		bRxFreezeStep_AGC0	0xc000000
+#define		bRxRssi_Cmp_En			0x10000000
+#define		bRxQuickAGCEn			0x20000000
+#define		bRxAGCFreezeThresMode	0x40000000
+#define		bRxOverFlowCheckType	0x80000000
+#define		bRxAGCShift				0x7f
+#define		bTRSW_Tri_Only			0x80
+#define		bPowerThres			0x300
+#define		bRxAGCEn				0x1
+#define		bRxAGCTogetherEn		0x2
+#define		bRxAGCMin				0x4
+#define		bRxHP_Ini				0x7
+#define		bRxHP_TRLNA			0x70
+#define		bRxHP_RSSI				0x700
+#define		bRxHP_BBP1				0x7000
+#define		bRxHP_BBP2				0x70000
+#define		bRxHP_BBP3				0x700000
+#define		bRSSI_H					0x7f0000     //the threshold for high power
+#define		bRSSI_Gen				0x7f000000   //the threshold for ant diversity
+#define		bRxSettle_TRSW			0x7
+#define		bRxSettle_LNA			0x38
+#define		bRxSettle_RSSI			0x1c0
+#define		bRxSettle_BBP			0xe00
+#define		bRxSettle_RxHP			0x7000
+#define		bRxSettle_AntSW_RSSI	0x38000
+#define		bRxSettle_AntSW		0xc0000
+#define		bRxProcessTime_DAGC	0x300000
+#define		bRxSettle_HSSI			0x400000
+#define		bRxProcessTime_BBPPW	0x800000
+#define		bRxAntennaPowerShift	0x3000000
+#define		bRSSITableSelect		0xc000000
+#define		bRxHP_Final				0x7000000
+#define		bRxHTSettle_BBP			0x7
+#define		bRxHTSettle_HSSI		0x8
+#define		bRxHTSettle_RxHP		0x70
+#define		bRxHTSettle_BBPPW		0x80
+#define		bRxHTSettle_Idle		0x300
+#define		bRxHTSettle_Reserved	0x1c00
+#define		bRxHTRxHPEn			0x8000
+#define		bRxHTAGCFreezeThres	0x30000
+#define		bRxHTAGCTogetherEn	0x40000
+#define		bRxHTAGCMin			0x80000
+#define		bRxHTAGCEn				0x100000
+#define		bRxHTDAGCEn			0x200000
+#define		bRxHTRxHP_BBP			0x1c00000
+#define		bRxHTRxHP_Final		0xe0000000
+#define		bRxPWRatioTH			0x3
+#define		bRxPWRatioEn			0x4
+#define		bRxMFHold				0x3800
+#define		bRxPD_Delay_TH1		0x38
+#define		bRxPD_Delay_TH2		0x1c0
+#define		bRxPD_DC_COUNT_MAX	0x600
+//#define bRxMF_Hold               0x3800
+#define		bRxPD_Delay_TH			0x8000
+#define		bRxProcess_Delay		0xf0000
+#define		bRxSearchrange_GI2_Early	0x700000
+#define		bRxFrame_Guard_Counter_L	0x3800000
+#define		bRxSGI_Guard_L			0xc000000
+#define		bRxSGI_Search_L		0x30000000
+#define		bRxSGI_TH				0xc0000000
+#define		bDFSCnt0				0xff
+#define		bDFSCnt1				0xff00
+#define		bDFSFlag				0xf0000
+#define		bMFWeightSum			0x300000
+#define		bMinIdxTH				0x7f000000
+#define		bDAFormat				0x40000
+#define		bTxChEmuEnable		0x01000000
+#define		bTRSWIsolation_A		0x7f
+#define		bTRSWIsolation_B		0x7f00
+#define		bTRSWIsolation_C		0x7f0000
+#define		bTRSWIsolation_D		0x7f000000
+#define		bExtLNAGain				0x7c00
+
+// 6. PageE(0xE00)
+#define		bSTBCEn				0x4	// Useless
+#define		bAntennaMapping		0x10
+#define		bNss					0x20
+#define		bCFOAntSumD			0x200
+#define		bPHYCounterReset		0x8000000
+#define		bCFOReportGet			0x4000000
+#define		bOFDMContinueTx		0x10000000
+#define		bOFDMSingleCarrier		0x20000000
+#define		bOFDMSingleTone		0x40000000
+//#define bRxPath1                 0x01
+//#define bRxPath2                 0x02
+//#define bRxPath3                 0x04
+//#define bRxPath4                 0x08
+//#define bTxPath1                 0x10
+//#define bTxPath2                 0x20
+#define		bHTDetect			0x100
+#define		bCFOEn				0x10000
+#define		bCFOValue			0xfff00000
+#define		bSigTone_Re		0x3f
+#define		bSigTone_Im		0x7f00
+#define		bCounter_CCA		0xffff
+#define		bCounter_ParityFail	0xffff0000
+#define		bCounter_RateIllegal		0xffff
+#define		bCounter_CRC8Fail	0xffff0000
+#define		bCounter_MCSNoSupport	0xffff
+#define		bCounter_FastSync	0xffff
+#define		bShortCFO			0xfff
+#define		bShortCFOTLength	12   //total
+#define		bShortCFOFLength	11   //fraction
+#define		bLongCFO			0x7ff
+#define		bLongCFOTLength	11
+#define		bLongCFOFLength	11
+#define		bTailCFO			0x1fff
+#define		bTailCFOTLength		13
+#define		bTailCFOFLength		12
+#define		bmax_en_pwdB		0xffff
+#define		bCC_power_dB		0xffff0000
+#define		bnoise_pwdB		0xffff
+#define		bPowerMeasTLength	10
+#define		bPowerMeasFLength	3
+#define		bRx_HT_BW			0x1
+#define		bRxSC				0x6
+#define		bRx_HT				0x8
+#define		bNB_intf_det_on		0x1
+#define		bIntf_win_len_cfg	0x30
+#define		bNB_Intf_TH_cfg		0x1c0
+#define		bRFGain				0x3f
+#define		bTableSel			0x40
+#define		bTRSW				0x80
+#define		bRxSNR_A			0xff
+#define		bRxSNR_B			0xff00
+#define		bRxSNR_C			0xff0000
+#define		bRxSNR_D			0xff000000
+#define		bSNREVMTLength		8
+#define		bSNREVMFLength		1
+#define		bCSI1st				0xff
+#define		bCSI2nd				0xff00
+#define		bRxEVM1st			0xff0000
+#define		bRxEVM2nd			0xff000000
+#define		bSIGEVM			0xff
+#define		bPWDB				0xff00
+#define		bSGIEN				0x10000
+
+#define		bSFactorQAM1		0xf	// Useless
+#define		bSFactorQAM2		0xf0
+#define		bSFactorQAM3		0xf00
+#define		bSFactorQAM4		0xf000
+#define		bSFactorQAM5		0xf0000
+#define		bSFactorQAM6		0xf0000
+#define		bSFactorQAM7		0xf00000
+#define		bSFactorQAM8		0xf000000
+#define		bSFactorQAM9		0xf0000000
+#define		bCSIScheme			0x100000
+
+#define		bNoiseLvlTopSet		0x3	// Useless
+#define		bChSmooth			0x4
+#define		bChSmoothCfg1		0x38
+#define		bChSmoothCfg2		0x1c0
+#define		bChSmoothCfg3		0xe00
+#define		bChSmoothCfg4		0x7000
+#define		bMRCMode			0x800000
+#define		bTHEVMCfg			0x7000000
+
+#define		bLoopFitType		0x1	// Useless
+#define		bUpdCFO			0x40
+#define		bUpdCFOOffData		0x80
+#define		bAdvUpdCFO			0x100
+#define		bAdvTimeCtrl		0x800
+#define		bUpdClko			0x1000
+#define		bFC					0x6000
+#define		bTrackingMode		0x8000
+#define		bPhCmpEnable		0x10000
+#define		bUpdClkoLTF		0x20000
+#define		bComChCFO			0x40000
+#define		bCSIEstiMode		0x80000
+#define		bAdvUpdEqz			0x100000
+#define		bUChCfg				0x7000000
+#define		bUpdEqz			0x8000000
+
+//Rx Pseduo noise
+#define		bRxPesudoNoiseOn		0x20000000	// Useless
+#define		bRxPesudoNoise_A		0xff
+#define		bRxPesudoNoise_B		0xff00
+#define		bRxPesudoNoise_C		0xff0000
+#define		bRxPesudoNoise_D		0xff000000
+#define		bPesudoNoiseState_A	0xffff
+#define		bPesudoNoiseState_B	0xffff0000
+#define		bPesudoNoiseState_C	0xffff
+#define		bPesudoNoiseState_D	0xffff0000
+
+//7. RF Register
+//Zebra1
+#define		bZebra1_HSSIEnable		0x8		// Useless
+#define		bZebra1_TRxControl		0xc00
+#define		bZebra1_TRxGainSetting	0x07f
+#define		bZebra1_RxCorner		0xc00
+#define		bZebra1_TxChargePump	0x38
+#define		bZebra1_RxChargePump	0x7
+#define		bZebra1_ChannelNum	0xf80
+#define		bZebra1_TxLPFBW		0x400
+#define		bZebra1_RxLPFBW		0x600
+
+//Zebra4
+#define		bRTL8256RegModeCtrl1	0x100	// Useless
+#define		bRTL8256RegModeCtrl0	0x40
+#define		bRTL8256_TxLPFBW		0x18
+#define		bRTL8256_RxLPFBW		0x600
+
+//RTL8258
+#define		bRTL8258_TxLPFBW		0xc	// Useless
+#define		bRTL8258_RxLPFBW		0xc00
+#define		bRTL8258_RSSILPFBW	0xc0
+
+
+//
+// Other Definition
+//
+
+//byte endable for sb_write
+#define		bByte0				0x1	// Useless
+#define		bByte1				0x2
+#define		bByte2				0x4
+#define		bByte3				0x8
+#define		bWord0				0x3
+#define		bWord1				0xc
+#define		bDWord				0xf
+
+//for PutRegsetting & GetRegSetting BitMask
+#define		bMaskByte0			0xff	// Reg 0xc50 rOFDM0_XAAGCCore~0xC6f
+#define		bMaskByte1			0xff00
+#define		bMaskByte2			0xff0000
+#define		bMaskByte3			0xff000000
+#define		bMaskHWord		0xffff0000
+#define		bMaskLWord			0x0000ffff
+#define		bMaskDWord		0xffffffff
+#define		bMask12Bits			0xfff
+#define		bMaskH4Bits			0xf0000000
+#define		bMaskOFDM_D		0xffc00000
+#define		bMaskCCK			0x3f3f3f3f
+
+//for PutRFRegsetting & GetRFRegSetting BitMask
+//#define		bMask12Bits               	0xfffff	// RF Reg mask bits
+//#define		bMask20Bits               	0xfffff	// RF Reg mask bits T65 RF
+#define 		bRFRegOffsetMask		0xfffff
+//#define 		bRFRegOffsetMask		0xfff
+
+//MAC0 will wirte PHY1
+#define	MAC0_ACCESS_PHY1	0x4000
+//MAC1 will wirte PHY0
+#define	MAC1_ACCESS_PHY0	0x2000
+
+#define		bEnable			0x1	// Useless
+#define		bDisable		0x0
+
+#define		LeftAntenna		0x0	// Useless
+#define		RightAntenna	0x1
+
+#define		tCheckTxStatus		500   //500ms // Useless
+#define		tUpdateRxCounter	100   //100ms
+
+#define		rateCCK		0	// Useless
+#define		rateOFDM	1
+#define		rateHT		2
+
+//define Register-End
+#define		bPMAC_End			0x1ff	// Useless
+#define		bFPGAPHY0_End		0x8ff
+#define		bFPGAPHY1_End		0x9ff
+#define		bCCKPHY0_End		0xaff
+#define		bOFDMPHY0_End		0xcff
+#define		bOFDMPHY1_End		0xdff
+
+//define max debug item in each debug page
+//#define bMaxItem_FPGA_PHY0        0x9
+//#define bMaxItem_FPGA_PHY1        0x3
+//#define bMaxItem_PHY_11B          0x16
+//#define bMaxItem_OFDM_PHY0        0x29
+//#define bMaxItem_OFDM_PHY1        0x0
+
+#define		bPMACControl		0x0		// Useless
+#define		bWMACControl		0x1
+#define		bWNICControl		0x2
+
+#define		PathA			0x0	// Useless
+#define		PathB			0x1
+#define		PathC			0x2
+#define		PathD			0x3
+
+/*--------------------------Define Parameters-------------------------------*/
+
+
+#endif	//__INC_HAL8192SPHYREG_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DUHWImg.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DUHWImg.h
new file mode 100644
index 000000000000..0d225cefa74d
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DUHWImg.h
@@ -0,0 +1,66 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __INC_HAL8192DU_FW_IMG_H
+#define __INC_HAL8192DU_FW_IMG_H
+
+#include <basic_types.h>
+
+/*Created on  2011/11/11,  8: 8*/
+
+#define Rtl8192DUImgArrayLength 31452
+extern const u8 Rtl8192DUFwImgArray[Rtl8192DUImgArrayLength];
+#define Rtl8192DUMainArrayLength 1
+extern const u8 Rtl8192DUFwMainArray[Rtl8192DUMainArrayLength];
+#define Rtl8192DUDataArrayLength 1
+extern const u8 Rtl8192DUFwDataArray[Rtl8192DUDataArrayLength];
+#define Rtl8192DUPHY_REG_2TArrayLength 372
+extern const u32 Rtl8192DUPHY_REG_2TArray[Rtl8192DUPHY_REG_2TArrayLength];
+#define Rtl8192DUPHY_REG_1TArrayLength 1
+extern const u32 Rtl8192DUPHY_REG_1TArray[Rtl8192DUPHY_REG_1TArrayLength];
+#define Rtl8192DUPHY_REG_Array_PGLength 624
+extern const u32 Rtl8192DUPHY_REG_Array_PG[Rtl8192DUPHY_REG_Array_PGLength];
+#define Rtl8192DUPHY_REG_Array_MPLength 14
+extern const u32 Rtl8192DUPHY_REG_Array_MP[Rtl8192DUPHY_REG_Array_MPLength];
+#define Rtl8192DURadioA_2TArrayLength 378
+extern const u32 Rtl8192DURadioA_2TArray[Rtl8192DURadioA_2TArrayLength];
+#define Rtl8192DURadioB_2TArrayLength 384
+extern const u32 Rtl8192DURadioB_2TArray[Rtl8192DURadioB_2TArrayLength];
+#define Rtl8192DURadioA_1TArrayLength 1
+extern const u32 Rtl8192DURadioA_1TArray[Rtl8192DURadioA_1TArrayLength];
+#define Rtl8192DURadioB_1TArrayLength 1
+extern const u32 Rtl8192DURadioB_1TArray[Rtl8192DURadioB_1TArrayLength];
+#define Rtl8192DURadioA_2T_intPAArrayLength 378
+extern const u32 Rtl8192DURadioA_2T_intPAArray[Rtl8192DURadioA_2T_intPAArrayLength];
+#define Rtl8192DURadioB_2T_intPAArrayLength 384
+extern const u32 Rtl8192DURadioB_2T_intPAArray[Rtl8192DURadioB_2T_intPAArrayLength];
+#define Rtl8192DUMAC_2T_ArrayLength 192
+extern const u32 Rtl8192DUMAC_2T_Array[Rtl8192DUMAC_2T_ArrayLength];
+#define Rtl8192DUAGCTAB_ArrayLength 386
+extern const u32 Rtl8192DUAGCTAB_Array[Rtl8192DUAGCTAB_ArrayLength];
+#define Rtl8192DUAGCTAB_5GArrayLength 194
+extern const u32 Rtl8192DUAGCTAB_5GArray[Rtl8192DUAGCTAB_5GArrayLength];
+#define Rtl8192DUAGCTAB_2GArrayLength 194
+extern const u32 Rtl8192DUAGCTAB_2GArray[Rtl8192DUAGCTAB_2GArrayLength];
+#define Rtl8192DUAGCTAB_2TArrayLength 1
+extern const u32 Rtl8192DUAGCTAB_2TArray[Rtl8192DUAGCTAB_2TArrayLength];
+#define Rtl8192DUAGCTAB_1TArrayLength 1
+extern const u32 Rtl8192DUAGCTAB_1TArray[Rtl8192DUAGCTAB_1TArrayLength];
+
+#endif //__INC_HAL8192CU_FW_IMG_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DUHWImg_wowlan.h b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DUHWImg_wowlan.h
new file mode 100644
index 000000000000..b5ab71f99967
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/Hal8192DUHWImg_wowlan.h
@@ -0,0 +1,29 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __INC_HAL8192DU_FW_IMG_WOWLAN_H
+#define __INC_HAL8192DU_FW_IMG_WOWLAN_H
+
+/*Created on  2011/11/ 8, 14:15*/
+
+
+#define DUWWImgArrayLength 24818
+extern u8 Rtl8192DUFwWWImgArray[DUWWImgArrayLength];
+
+#endif //__INC_HAL8192DU_FW_IMG_WOWLAN_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/HalPwrSeqCmd.h b/drivers/net/wireless/realtek/rtl8192cu/include/HalPwrSeqCmd.h
new file mode 100644
index 000000000000..e5d151cfdfba
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/HalPwrSeqCmd.h
@@ -0,0 +1,137 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __HALPWRSEQCMD_H__
+#define __HALPWRSEQCMD_H__
+
+#include <drv_types.h>
+
+/*---------------------------------------------*/
+//3 The value of cmd: 4 bits
+/*---------------------------------------------*/
+#define PWR_CMD_READ			0x00
+     // offset: the read register offset
+     // msk: the mask of the read value
+     // value: N/A, left by 0
+     // note: dirver shall implement this function by read & msk
+
+#define PWR_CMD_WRITE			0x01
+     // offset: the read register offset
+     // msk: the mask of the write bits
+     // value: write value
+     // note: driver shall implement this cmd by read & msk after write
+
+#define PWR_CMD_POLLING			0x02
+     // offset: the read register offset
+     // msk: the mask of the polled value
+     // value: the value to be polled, masked by the msd field.
+     // note: driver shall implement this cmd by
+     // do{
+     // if( (Read(offset) & msk) == (value & msk) )
+     // break;
+     // } while(not timeout);
+
+#define PWR_CMD_DELAY			0x03
+     // offset: the value to delay
+     // msk: N/A
+     // value: the unit of delay, 0: us, 1: ms
+
+#define PWR_CMD_END				0x04
+     // offset: N/A
+     // msk: N/A
+     // value: N/A
+
+/*---------------------------------------------*/
+//3 The value of base: 4 bits
+/*---------------------------------------------*/
+   // define the base address of each block
+#define PWR_BASEADDR_MAC		0x00
+#define PWR_BASEADDR_USB		0x01
+#define PWR_BASEADDR_PCIE		0x02
+#define PWR_BASEADDR_SDIO		0x03
+
+/*---------------------------------------------*/
+//3 The value of interface_msk: 4 bits
+/*---------------------------------------------*/
+#define	PWR_INTF_SDIO_MSK		BIT(0)
+#define	PWR_INTF_USB_MSK		BIT(1)
+#define	PWR_INTF_PCI_MSK		BIT(2)
+#define	PWR_INTF_ALL_MSK		(BIT(0)|BIT(1)|BIT(2)|BIT(3))
+
+/*---------------------------------------------*/
+//3 The value of fab_msk: 4 bits
+/*---------------------------------------------*/
+#define	PWR_FAB_TSMC_MSK		BIT(0)
+#define	PWR_FAB_UMC_MSK			BIT(1)
+#define	PWR_FAB_ALL_MSK			(BIT(0)|BIT(1)|BIT(2)|BIT(3))
+
+/*---------------------------------------------*/
+//3 The value of cut_msk: 8 bits
+/*---------------------------------------------*/
+#define	PWR_CUT_TESTCHIP_MSK	BIT(0)
+#define	PWR_CUT_A_MSK			BIT(1)
+#define	PWR_CUT_B_MSK			BIT(2)
+#define	PWR_CUT_C_MSK			BIT(3)
+#define	PWR_CUT_D_MSK			BIT(4)
+#define	PWR_CUT_E_MSK			BIT(5)
+#define	PWR_CUT_F_MSK			BIT(6)
+#define	PWR_CUT_G_MSK			BIT(7)
+#define	PWR_CUT_ALL_MSK			0xFF
+
+
+typedef enum _PWRSEQ_CMD_DELAY_UNIT_
+{
+	PWRSEQ_DELAY_US,
+	PWRSEQ_DELAY_MS,
+} PWRSEQ_DELAY_UNIT;
+
+typedef struct _WL_PWR_CFG_
+{
+	u16 offset;
+	u8 cut_msk;
+	u8 fab_msk:4;
+	u8 interface_msk:4;
+	u8 base:4;
+	u8 cmd:4;
+	u8 msk;
+	u8 value;
+} WLAN_PWR_CFG, *PWLAN_PWR_CFG;
+
+
+#define GET_PWR_CFG_OFFSET(__PWR_CMD)		__PWR_CMD.offset
+#define GET_PWR_CFG_CUT_MASK(__PWR_CMD)		__PWR_CMD.cut_msk
+#define GET_PWR_CFG_FAB_MASK(__PWR_CMD)		__PWR_CMD.fab_msk
+#define GET_PWR_CFG_INTF_MASK(__PWR_CMD)	__PWR_CMD.interface_msk
+#define GET_PWR_CFG_BASE(__PWR_CMD)			__PWR_CMD.base
+#define GET_PWR_CFG_CMD(__PWR_CMD)			__PWR_CMD.cmd
+#define GET_PWR_CFG_MASK(__PWR_CMD)			__PWR_CMD.msk
+#define GET_PWR_CFG_VALUE(__PWR_CMD)		__PWR_CMD.value
+
+
+//================================================================================
+//	Prototype of protected function.
+//================================================================================
+u8 HalPwrSeqCmdParsing(
+	PADAPTER		padapter,
+	u8				CutVersion,
+	u8				FabVersion,
+	u8				InterfaceType,
+	WLAN_PWR_CFG	PwrCfgCmd[]);
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/autoconf.h b/drivers/net/wireless/realtek/rtl8192cu/include/autoconf.h
new file mode 100644
index 000000000000..001b48f348c5
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/autoconf.h
@@ -0,0 +1,337 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+/*
+ * Public  General Config
+ */
+#define AUTOCONF_INCLUDED
+#define RTL871X_MODULE_NAME "92CU"
+#define DRV_NAME "rtl8192cu"
+
+#define CONFIG_USB_HCI	1
+
+#define CONFIG_RTL8192C	1
+
+#define PLATFORM_LINUX	1
+
+#define CONFIG_IOCTL_CFG80211 1
+#ifdef CONFIG_IOCTL_CFG80211
+	/* Indicate new sta asoc through cfg80211_new_sta */
+	#define RTW_USE_CFG80211_STA_EVENT
+	/*#define CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER*/
+	//#define CONFIG_DEBUG_CFG80211 1
+	//#define CONFIG_DRV_ISSUE_PROV_REQ // IOT FOR S2
+	#define CONFIG_SET_SCAN_DENY_TIMER
+#endif
+
+/*
+ * Internal  General Config
+ */
+//#define CONFIG_PWRCTRL
+//#define CONFIG_H2CLBK
+
+#define CONFIG_EMBEDDED_FWIMG	1
+//#define CONFIG_FILE_FWIMG
+
+#ifdef CONFIG_WAKE_ON_WLAN
+#define CONFIG_WOWLAN 1
+#endif //CONFIG_WAKE_ON_WLAN
+
+#define CONFIG_R871X_TEST	1
+
+#define CONFIG_XMIT_ACK
+#ifdef CONFIG_XMIT_ACK
+	#define CONFIG_XMIT_ACK_POLLING
+	#define CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+#endif
+
+#define CONFIG_80211N_HT	1
+
+#define CONFIG_RECV_REORDERING_CTRL	1
+
+//#define CONFIG_TCP_CSUM_OFFLOAD_RX	1
+
+//#define CONFIG_BEFORE_LINKED_DIG
+//#define CONFIG_DRVEXT_MODULE	1
+
+#ifndef CONFIG_MP_INCLUDED
+	#define CONFIG_IPS	1
+	#ifdef CONFIG_IPS
+		//#define CONFIG_IPS_LEVEL_2	1 //enable this to set default IPS mode to IPS_LEVEL_2
+	#endif
+
+	#define SUPPORT_HW_RFOFF_DETECTED	1
+
+	#define CONFIG_LPS	1
+	#define CONFIG_BT_COEXIST	1
+
+	//befor link
+	#define CONFIG_ANTENNA_DIVERSITY
+
+	//after link
+	#ifdef CONFIG_ANTENNA_DIVERSITY
+		#define CONFIG_SW_ANTENNA_DIVERSITY
+		//#define CONFIG_HW_ANTENNA_DIVERSITY
+	#endif
+
+	#define CONFIG_IOL
+#else 	//#ifndef CONFIG_MP_INCLUDED
+	#define CONFIG_MP_IWPRIV_SUPPORT	1
+#endif 	//#ifndef CONFIG_MP_INCLUDED
+
+#define CONFIG_AP_MODE	1
+#ifdef CONFIG_AP_MODE
+	#define CONFIG_NATIVEAP_MLME	1
+	#ifndef CONFIG_NATIVEAP_MLME
+		#define CONFIG_HOSTAPD_MLME	1
+	#endif
+	#define CONFIG_FIND_BEST_CHANNEL	1
+	//#define CONFIG_NO_WIRELESS_HANDLERS	1
+#endif
+
+//	Added by Albert 20110314
+#define CONFIG_P2P	1
+#ifdef CONFIG_P2P
+	//Added by Albert 20110812
+	//The CONFIG_WFD is for supporting the Wi-Fi display
+	#define CONFIG_WFD
+
+	#ifndef CONFIG_WIFI_TEST
+		#define CONFIG_P2P_REMOVE_GROUP_INFO
+	#endif
+	//#define CONFIG_DBG_P2P
+
+	//#define CONFIG_P2P_PS
+	//#define CONFIG_P2P_IPS
+
+	#define P2P_OP_CHECK_SOCIAL_CH
+		// Added comment by Borg 2013/06/21
+		// Issue:  Nexus 4 is hard to do miracast.
+		// Root Cause: After group formation,
+		//			Nexus 4 is possible to be not at OP channel of Invitation Resp/Nego Confirm but at social channel.
+		// Patch: While scan OP channel,
+		//		 not only scan OP channel of Invitation Resp/Nego Confirm,
+		//		 but also scan social channel(1, 6, 11)
+#endif
+
+//	Added by Kurt 20110511
+//#define CONFIG_TDLS	1
+#ifdef CONFIG_TDLS
+//	#ifndef CONFIG_WFD
+//		#define CONFIG_WFD	1
+//	#endif
+//	#define CONFIG_TDLS_AUTOSETUP			1
+//	#define CONFIG_TDLS_AUTOCHECKALIVE		1
+#endif
+
+#define CONFIG_SKB_COPY	1//for amsdu
+
+#define CONFIG_LED
+#ifdef CONFIG_LED
+	#define CONFIG_SW_LED
+	#ifdef CONFIG_SW_LED
+		//#define CONFIG_LED_HANDLED_BY_CMD_THREAD
+	#endif
+#endif // CONFIG_LED
+
+
+
+#define USB_INTERFERENCE_ISSUE // this should be checked in all usb interface
+#define CONFIG_GLOBAL_UI_PID
+
+#define CONFIG_LAYER2_ROAMING
+#define CONFIG_LAYER2_ROAMING_RESUME
+//#define CONFIG_ADAPTOR_INFO_CACHING_FILE // now just applied on 8192cu only, should make it general...
+//#define CONFIG_RESUME_IN_WORKQUEUE
+//#define CONFIG_SET_SCAN_DENY_TIMER
+#define CONFIG_LONG_DELAY_ISSUE
+#define CONFIG_NEW_SIGNAL_STAT_PROCESS
+//#define CONFIG_SIGNAL_DISPLAY_DBM //display RX signal with dbm
+#define RTW_NOTCH_FILTER 0 /* 0:Disable, 1:Enable */
+#define CONFIG_DEAUTH_BEFORE_CONNECT
+
+#ifdef CONFIG_IOL
+	#define CONFIG_IOL_LLT
+	#define CONFIG_IOL_MAC
+	#define CONFIG_IOL_BB_PHY_REG
+	#define CONFIG_IOL_BB_AGC_TAB
+	#define CONFIG_IOL_RF_RF90_PATH_A
+	#define CONFIG_IOL_RF_RF90_PATH_B
+#endif
+
+#define CONFIG_BR_EXT	1	// Enable NAT2.5 support for STA mode interface with a L2 Bridge
+#ifdef CONFIG_BR_EXT
+#define CONFIG_BR_EXT_BRNAME	"br0"
+#endif	// CONFIG_BR_EXT
+
+#define CONFIG_TX_MCAST2UNI	1	// Support IP multicast->unicast
+//#define CONFIG_DM_ADAPTIVITY
+//#define CONFIG_CHECK_AC_LIFETIME 1	// Check packet lifetime of 4 ACs.
+
+//#define CONFIG_CONCURRENT_MODE 1
+#ifdef CONFIG_CONCURRENT_MODE
+	#define CONFIG_TSF_RESET_OFFLOAD 1			// For 2 PORT TSF SYNC.
+	//#define CONFIG_HWPORT_SWAP				//Port0->Sec , Port1 -> Pri
+	//#define CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+	//#define CONFIG_MULTI_VIR_IFACES //besides primary&secondary interfaces, extend to support more interfaces
+#endif	// CONFIG_CONCURRENT_MODE
+
+#define CONFIG_80211D
+
+/*
+ * Interface  Related Config
+ */
+
+//#define CONFIG_USB_ONE_OUT_EP
+//#define CONFIG_USB_INTERRUPT_IN_PIPE	1
+
+#ifndef CONFIG_MINIMAL_MEMORY_USAGE
+	#define CONFIG_USB_TX_AGGREGATION	1
+	#define CONFIG_USB_RX_AGGREGATION	1
+#endif
+
+#define CONFIG_PREALLOC_RECV_SKB	1
+//#define CONFIG_REDUCE_USB_TX_INT	1	// Trade-off: Improve performance, but may cause TX URBs blocked by USB Host/Bus driver on few platforms.
+//#define CONFIG_EASY_REPLACEMENT	1
+
+/*
+ * CONFIG_USE_USB_BUFFER_ALLOC_XX uses Linux USB Buffer alloc API and is for Linux platform only now!
+ */
+//#define CONFIG_USE_USB_BUFFER_ALLOC_TX 1	// Trade-off: For TX path, improve stability on some platforms, but may cause performance degrade on other platforms.
+//#define CONFIG_USE_USB_BUFFER_ALLOC_RX 1	// For RX path
+#ifdef CONFIG_USE_USB_BUFFER_ALLOC_RX
+#undef CONFIG_PREALLOC_RECV_SKB
+#endif
+
+/*
+ * USB VENDOR REQ BUFFER ALLOCATION METHOD
+ * if not set we'll use function local variable (stack memory)
+ */
+//#define CONFIG_USB_VENDOR_REQ_BUFFER_DYNAMIC_ALLOCATE
+#define CONFIG_USB_VENDOR_REQ_BUFFER_PREALLOC
+
+#define CONFIG_USB_VENDOR_REQ_MUTEX
+#define CONFIG_VENDOR_REQ_RETRY
+
+//#define CONFIG_USB_SUPPORT_ASYNC_VDN_REQ 1
+
+
+/*
+ * HAL  Related Config
+ */
+
+#define RTL8192C_RX_PACKET_NO_INCLUDE_CRC	1
+
+#define SUPPORTED_BLOCK_IO
+
+
+
+#define RTL8192CU_FW_DOWNLOAD_ENABLE	1
+
+#define CONFIG_ONLY_ONE_OUT_EP_TO_LOW	0
+
+#define CONFIG_OUT_EP_WIFI_MODE	0
+
+#define ENABLE_USB_DROP_INCORRECT_OUT	0
+
+#define RTL8192CU_ASIC_VERIFICATION	0	// For ASIC verification.
+
+#define RTL8192CU_ADHOC_WORKAROUND_SETTING	1
+
+#define DISABLE_BB_RF	0
+
+#define RTL8191C_FPGA_NETWORKTYPE_ADHOC 0
+
+#ifdef CONFIG_MP_INCLUDED
+	#define MP_DRIVER 1
+	#undef CONFIG_USB_TX_AGGREGATION
+	#undef CONFIG_USB_RX_AGGREGATION
+#else
+	#define MP_DRIVER 0
+#endif
+
+
+/*
+ * Platform  Related Config
+ */
+#ifdef CONFIG_PLATFORM_MN10300
+#define CONFIG_SPECIAL_SETTING_FOR_FUNAI_TV
+
+#if	defined (CONFIG_SW_ANTENNA_DIVERSITY)
+	#undef CONFIG_SW_ANTENNA_DIVERSITY
+	#define CONFIG_HW_ANTENNA_DIVERSITY
+#endif
+
+#endif
+
+#ifdef CONFIG_WISTRON_PLATFORM
+
+#endif
+
+#ifdef CONFIG_PLATFORM_TI_DM365
+#define CONFIG_USE_USB_BUFFER_ALLOC_RX 1
+#endif
+
+#define CONFIG_ATTEMPT_TO_FIX_AP_BEACON_ERROR
+
+/*
+ * Debug  Related Config
+ */
+//#define CONFIG_DEBUG_RTL871X
+
+#define DBG	0
+//#define CONFIG_DEBUG_RTL819X
+
+//#define CONFIG_PROC_DEBUG	1
+
+//#define DBG_IO
+//#define DBG_DELAY_OS
+//#define DBG_MEM_ALLOC
+//#define DBG_IOCTL
+
+//#define DBG_TX
+//#define DBG_XMIT_BUF
+//#define DBG_TX_DROP_FRAME
+
+//#define DBG_RX_DROP_FRAME
+//#define DBG_RX_SEQ
+//#define DBG_RX_SIGNAL_DISPLAY_PROCESSING
+//#define DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED "jeff-ap"
+
+//#define DBG_EXPIRATION_CHK
+
+
+//#define DBG_SHOW_MCUFWDL_BEFORE_51_ENABLE
+//#define DBG_ROAMING_TEST
+
+//#define DBG_HAL_INIT_PROFILING
+
+//#define DBG_MEMORY_LEAK	1
+
+/*#define DBG_CONFIG_ERROR_DETECT*/
+//#define DBG_CONFIG_ERROR_RESET
+
+//TX use 1 urb
+//#define CONFIG_SINGLE_XMIT_BUF
+//RX use 1 urb
+//#define CONFIG_SINGLE_RECV_BUF
+
+//turn off power tracking when traffic is busy
+//#define CONFIG_BUSY_TRAFFIC_SKIP_PWR_TRACK
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/basic_types.h b/drivers/net/wireless/realtek/rtl8192cu/include/basic_types.h
new file mode 100644
index 000000000000..c52fe3a6222d
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/basic_types.h
@@ -0,0 +1,320 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __BASIC_TYPES_H__
+#define __BASIC_TYPES_H__
+
+#include <drv_conf.h>
+
+
+#define SUCCESS	0
+#define FAIL	(-1)
+
+#ifndef TRUE
+	#define _TRUE	1
+#else
+	#define _TRUE	TRUE
+#endif
+
+#ifndef FALSE
+	#define _FALSE	0
+#else
+	#define _FALSE	FALSE
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+	typedef signed char s8;
+	typedef unsigned char u8;
+
+	typedef signed short s16;
+	typedef unsigned short u16;
+
+	typedef signed long s32;
+	typedef unsigned long u32;
+
+	typedef unsigned int	uint;
+	typedef	signed int		sint;
+
+
+	typedef signed long long s64;
+	typedef unsigned long long u64;
+
+	#ifdef NDIS50_MINIPORT
+
+		#define NDIS_MAJOR_VERSION       5
+		#define NDIS_MINOR_VERSION       0
+
+	#endif
+
+	#ifdef NDIS51_MINIPORT
+
+		#define NDIS_MAJOR_VERSION       5
+		#define NDIS_MINOR_VERSION       1
+
+	#endif
+
+	typedef NDIS_PROC proc_t;
+
+	typedef LONG atomic_t;
+
+#endif
+
+
+#ifdef PLATFORM_LINUX
+
+	#include <linux/types.h>
+	#define IN
+	#define OUT
+	#define VOID void
+	#define NDIS_OID uint
+	#define NDIS_STATUS uint
+
+	typedef	signed int sint;
+
+	#ifndef	PVOID
+	typedef void * PVOID;
+	//#define PVOID	(void *)
+	#endif
+
+        #define UCHAR u8
+	#define USHORT u16
+	#define UINT u32
+	#define ULONG u32
+
+	typedef void (*proc_t)(void*);
+
+	typedef 	__kernel_size_t	SIZE_T;
+	typedef	__kernel_ssize_t	SSIZE_T;
+	#define FIELD_OFFSET(s,field)	((SSIZE_T)&((s*)(0))->field)
+
+#endif
+
+
+#ifdef PLATFORM_FREEBSD
+
+	typedef signed char s8;
+	typedef unsigned char u8;
+
+	typedef signed short s16;
+	typedef unsigned short u16;
+
+	typedef signed int s32;
+	typedef unsigned int u32;
+
+	typedef unsigned int	uint;
+	typedef	signed int		sint;
+	typedef long atomic_t;
+
+	typedef signed long long s64;
+	typedef unsigned long long u64;
+	#define IN
+	#define OUT
+	#define VOID void
+	#define NDIS_OID uint
+	#define NDIS_STATUS uint
+
+	#ifndef	PVOID
+	typedef void * PVOID;
+	//#define PVOID	(void *)
+	#endif
+	typedef u32 dma_addr_t;
+    #define UCHAR u8
+	#define USHORT u16
+	#define UINT u32
+	#define ULONG u32
+
+	typedef void (*proc_t)(void*);
+
+  typedef unsigned int __kernel_size_t;
+  typedef int __kernel_ssize_t;
+
+	typedef 	__kernel_size_t	SIZE_T;
+	typedef	__kernel_ssize_t	SSIZE_T;
+	#define FIELD_OFFSET(s,field)	((SSIZE_T)&((s*)(0))->field)
+
+#endif
+
+#define MEM_ALIGNMENT_OFFSET	(sizeof (SIZE_T))
+#define MEM_ALIGNMENT_PADDING	(sizeof(SIZE_T) - 1)
+
+#define SIZE_PTR SIZE_T
+#define SSIZE_PTR SSIZE_T
+
+//port from fw by thomas
+// TODO: Belows are Sync from SD7-Driver. It is necessary to check correctness
+
+/*
+ *	Call endian free function when
+ *		1. Read/write packet content.
+ *		2. Before write integer to IO.
+ *		3. After read integer from IO.
+*/
+
+//
+// Byte Swapping routine.
+//
+#define EF1Byte
+#define EF2Byte 	le16_to_cpu
+#define EF4Byte	le32_to_cpu
+
+//
+// Read LE format data from memory
+//
+#define ReadEF1Byte(_ptr)		EF1Byte(*((u8 *)(_ptr)))
+#define ReadEF2Byte(_ptr)		EF2Byte(*((u16 *)(_ptr)))
+#define ReadEF4Byte(_ptr)		EF4Byte(*((u32 *)(_ptr)))
+
+//
+// Write LE data to memory
+//
+#define WriteEF1Byte(_ptr, _val)	(*((u8 *)(_ptr)))=EF1Byte(_val)
+#define WriteEF2Byte(_ptr, _val)	(*((u16 *)(_ptr)))=EF2Byte(_val)
+#define WriteEF4Byte(_ptr, _val)	(*((u32 *)(_ptr)))=EF4Byte(_val)
+
+//
+//	Example:
+//		BIT_LEN_MASK_32(0) => 0x00000000
+//		BIT_LEN_MASK_32(1) => 0x00000001
+//		BIT_LEN_MASK_32(2) => 0x00000003
+//		BIT_LEN_MASK_32(32) => 0xFFFFFFFF
+//
+#define BIT_LEN_MASK_32(__BitLen) \
+	(0xFFFFFFFF >> (32 - (__BitLen)))
+//
+//	Example:
+//		BIT_OFFSET_LEN_MASK_32(0, 2) => 0x00000003
+//		BIT_OFFSET_LEN_MASK_32(16, 2) => 0x00030000
+//
+#define BIT_OFFSET_LEN_MASK_32(__BitOffset, __BitLen) \
+	(BIT_LEN_MASK_32(__BitLen) << (__BitOffset))
+
+//
+//	Description:
+//		Return 4-byte value in host byte ordering from
+//		4-byte pointer in litten-endian system.
+//
+#define LE_P4BYTE_TO_HOST_4BYTE(__pStart) \
+	(EF4Byte(*((u32 *)(__pStart))))
+
+//
+//	Description:
+//		Translate subfield (continuous bits in little-endian) of 4-byte value in litten byte to
+//		4-byte value in host byte ordering.
+//
+#define LE_BITS_TO_4BYTE(__pStart, __BitOffset, __BitLen) \
+	( \
+		( LE_P4BYTE_TO_HOST_4BYTE(__pStart) >> (__BitOffset) ) \
+		& \
+		BIT_LEN_MASK_32(__BitLen) \
+	)
+
+//
+//	Description:
+//		Mask subfield (continuous bits in little-endian) of 4-byte value in litten byte oredering
+//		and return the result in 4-byte value in host byte ordering.
+//
+#define LE_BITS_CLEARED_TO_4BYTE(__pStart, __BitOffset, __BitLen) \
+	( \
+		LE_P4BYTE_TO_HOST_4BYTE(__pStart) \
+		& \
+		( ~BIT_OFFSET_LEN_MASK_32(__BitOffset, __BitLen) ) \
+	)
+
+//
+//	Description:
+//		Set subfield of little-endian 4-byte value to specified value.
+//
+#define SET_BITS_TO_LE_4BYTE(__pStart, __BitOffset, __BitLen, __Value) \
+	*((u32 *)(__pStart)) = \
+		EF4Byte( \
+			LE_BITS_CLEARED_TO_4BYTE(__pStart, __BitOffset, __BitLen) \
+			| \
+			( (((u32)__Value) & BIT_LEN_MASK_32(__BitLen)) << (__BitOffset) ) \
+		);
+
+
+#define BIT_LEN_MASK_16(__BitLen) \
+		(0xFFFF >> (16 - (__BitLen)))
+
+#define BIT_OFFSET_LEN_MASK_16(__BitOffset, __BitLen) \
+	(BIT_LEN_MASK_16(__BitLen) << (__BitOffset))
+
+#define LE_P2BYTE_TO_HOST_2BYTE(__pStart) \
+	(EF2Byte(*((u16 *)(__pStart))))
+
+#define LE_BITS_TO_2BYTE(__pStart, __BitOffset, __BitLen) \
+	( \
+		( LE_P2BYTE_TO_HOST_2BYTE(__pStart) >> (__BitOffset) ) \
+		& \
+		BIT_LEN_MASK_16(__BitLen) \
+	)
+
+#define LE_BITS_CLEARED_TO_2BYTE(__pStart, __BitOffset, __BitLen) \
+	( \
+		LE_P2BYTE_TO_HOST_2BYTE(__pStart) \
+		& \
+		( ~BIT_OFFSET_LEN_MASK_16(__BitOffset, __BitLen) ) \
+	)
+
+#define SET_BITS_TO_LE_2BYTE(__pStart, __BitOffset, __BitLen, __Value) \
+	*((u16 *)(__pStart)) = \
+		EF2Byte( \
+			LE_BITS_CLEARED_TO_2BYTE(__pStart, __BitOffset, __BitLen) \
+			| \
+			( (((u16)__Value) & BIT_LEN_MASK_16(__BitLen)) << (__BitOffset) ) \
+		);
+
+#define BIT_LEN_MASK_8(__BitLen) \
+		(0xFF >> (8 - (__BitLen)))
+
+#define BIT_OFFSET_LEN_MASK_8(__BitOffset, __BitLen) \
+	(BIT_LEN_MASK_8(__BitLen) << (__BitOffset))
+
+#define LE_P1BYTE_TO_HOST_1BYTE(__pStart) \
+	(EF1Byte(*((u8 *)(__pStart))))
+
+#define LE_BITS_TO_1BYTE(__pStart, __BitOffset, __BitLen) \
+	( \
+		( LE_P1BYTE_TO_HOST_1BYTE(__pStart) >> (__BitOffset) ) \
+		& \
+		BIT_LEN_MASK_8(__BitLen) \
+	)
+
+#define LE_BITS_CLEARED_TO_1BYTE(__pStart, __BitOffset, __BitLen) \
+	( \
+		LE_P1BYTE_TO_HOST_1BYTE(__pStart) \
+		& \
+		( ~BIT_OFFSET_LEN_MASK_8(__BitOffset, __BitLen) ) \
+	)
+
+#define SET_BITS_TO_LE_1BYTE(__pStart, __BitOffset, __BitLen, __Value) \
+	*((u8 *)(__pStart)) = \
+		EF1Byte( \
+			LE_BITS_CLEARED_TO_1BYTE(__pStart, __BitOffset, __BitLen) \
+			| \
+			( (((u8)__Value) & BIT_LEN_MASK_8(__BitLen)) << (__BitOffset) ) \
+		);
+
+// Get the N-bytes aligment offset from the current length
+#define N_BYTE_ALIGMENT(__Value, __Aligment) ((__Aligment == 1) ? (__Value) : (((__Value + __Aligment - 1) / __Aligment) * __Aligment))
+
+typedef unsigned char	BOOLEAN,*PBOOLEAN;
+
+#endif //__BASIC_TYPES_H__
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/big_endian.h b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/big_endian.h
new file mode 100644
index 000000000000..0cd3504fa43d
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/big_endian.h
@@ -0,0 +1,87 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _LINUX_BYTEORDER_BIG_ENDIAN_H
+#define _LINUX_BYTEORDER_BIG_ENDIAN_H
+
+#ifndef __BIG_ENDIAN
+#define __BIG_ENDIAN 4321
+#endif
+#ifndef __BIG_ENDIAN_BITFIELD
+#define __BIG_ENDIAN_BITFIELD
+#endif
+
+#include <byteorder/swab.h>
+
+#define __constant_htonl(x) ((__u32)(x))
+#define __constant_ntohl(x) ((__u32)(x))
+#define __constant_htons(x) ((__u16)(x))
+#define __constant_ntohs(x) ((__u16)(x))
+#define __constant_cpu_to_le64(x) ___constant_swab64((x))
+#define __constant_le64_to_cpu(x) ___constant_swab64((x))
+#define __constant_cpu_to_le32(x) ___constant_swab32((x))
+#define __constant_le32_to_cpu(x) ___constant_swab32((x))
+#define __constant_cpu_to_le16(x) ___constant_swab16((x))
+#define __constant_le16_to_cpu(x) ___constant_swab16((x))
+#define __constant_cpu_to_be64(x) ((__u64)(x))
+#define __constant_be64_to_cpu(x) ((__u64)(x))
+#define __constant_cpu_to_be32(x) ((__u32)(x))
+#define __constant_be32_to_cpu(x) ((__u32)(x))
+#define __constant_cpu_to_be16(x) ((__u16)(x))
+#define __constant_be16_to_cpu(x) ((__u16)(x))
+#define __cpu_to_le64(x) __swab64((x))
+#define __le64_to_cpu(x) __swab64((x))
+#define __cpu_to_le32(x) __swab32((x))
+#define __le32_to_cpu(x) __swab32((x))
+#define __cpu_to_le16(x) __swab16((x))
+#define __le16_to_cpu(x) __swab16((x))
+#define __cpu_to_be64(x) ((__u64)(x))
+#define __be64_to_cpu(x) ((__u64)(x))
+#define __cpu_to_be32(x) ((__u32)(x))
+#define __be32_to_cpu(x) ((__u32)(x))
+#define __cpu_to_be16(x) ((__u16)(x))
+#define __be16_to_cpu(x) ((__u16)(x))
+#define __cpu_to_le64p(x) __swab64p((x))
+#define __le64_to_cpup(x) __swab64p((x))
+#define __cpu_to_le32p(x) __swab32p((x))
+#define __le32_to_cpup(x) __swab32p((x))
+#define __cpu_to_le16p(x) __swab16p((x))
+#define __le16_to_cpup(x) __swab16p((x))
+#define __cpu_to_be64p(x) (*(__u64*)(x))
+#define __be64_to_cpup(x) (*(__u64*)(x))
+#define __cpu_to_be32p(x) (*(__u32*)(x))
+#define __be32_to_cpup(x) (*(__u32*)(x))
+#define __cpu_to_be16p(x) (*(__u16*)(x))
+#define __be16_to_cpup(x) (*(__u16*)(x))
+#define __cpu_to_le64s(x) __swab64s((x))
+#define __le64_to_cpus(x) __swab64s((x))
+#define __cpu_to_le32s(x) __swab32s((x))
+#define __le32_to_cpus(x) __swab32s((x))
+#define __cpu_to_le16s(x) __swab16s((x))
+#define __le16_to_cpus(x) __swab16s((x))
+#define __cpu_to_be64s(x) do {} while (0)
+#define __be64_to_cpus(x) do {} while (0)
+#define __cpu_to_be32s(x) do {} while (0)
+#define __be32_to_cpus(x) do {} while (0)
+#define __cpu_to_be16s(x) do {} while (0)
+#define __be16_to_cpus(x) do {} while (0)
+
+#include <byteorder/generic.h>
+
+#endif /* _LINUX_BYTEORDER_BIG_ENDIAN_H */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/generic.h b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/generic.h
new file mode 100644
index 000000000000..11676a635069
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/generic.h
@@ -0,0 +1,212 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _LINUX_BYTEORDER_GENERIC_H
+#define _LINUX_BYTEORDER_GENERIC_H
+
+/*
+ * linux/byteorder_generic.h
+ * Generic Byte-reordering support
+ *
+ * Francois-Rene Rideau <fare@tunes.org> 19970707
+ *    gathered all the good ideas from all asm-foo/byteorder.h into one file,
+ *    cleaned them up.
+ *    I hope it is compliant with non-GCC compilers.
+ *    I decided to put __BYTEORDER_HAS_U64__ in byteorder.h,
+ *    because I wasn't sure it would be ok to put it in types.h
+ *    Upgraded it to 2.1.43
+ * Francois-Rene Rideau <fare@tunes.org> 19971012
+ *    Upgraded it to 2.1.57
+ *    to please Linus T., replaced huge #ifdef's between little/big endian
+ *    by nestedly #include'd files.
+ * Francois-Rene Rideau <fare@tunes.org> 19971205
+ *    Made it to 2.1.71; now a facelift:
+ *    Put files under include/linux/byteorder/
+ *    Split swab from generic support.
+ *
+ * TODO:
+ *   = Regular kernel maintainers could also replace all these manual
+ *    byteswap macros that remain, disseminated among drivers,
+ *    after some grep or the sources...
+ *   = Linus might want to rename all these macros and files to fit his taste,
+ *    to fit his personal naming scheme.
+ *   = it seems that a few drivers would also appreciate
+ *    nybble swapping support...
+ *   = every architecture could add their byteswap macro in asm/byteorder.h
+ *    see how some architectures already do (i386, alpha, ppc, etc)
+ *   = cpu_to_beXX and beXX_to_cpu might some day need to be well
+ *    distinguished throughout the kernel. This is not the case currently,
+ *    since little endian, big endian, and pdp endian machines needn't it.
+ *    But this might be the case for, say, a port of Linux to 20/21 bit
+ *    architectures (and F21 Linux addict around?).
+ */
+
+/*
+ * The following macros are to be defined by <asm/byteorder.h>:
+ *
+ * Conversion of long and short int between network and host format
+ *	ntohl(__u32 x)
+ *	ntohs(__u16 x)
+ *	htonl(__u32 x)
+ *	htons(__u16 x)
+ * It seems that some programs (which? where? or perhaps a standard? POSIX?)
+ * might like the above to be functions, not macros (why?).
+ * if that's true, then detect them, and take measures.
+ * Anyway, the measure is: define only ___ntohl as a macro instead,
+ * and in a separate file, have
+ * unsigned long inline ntohl(x){return ___ntohl(x);}
+ *
+ * The same for constant arguments
+ *	__constant_ntohl(__u32 x)
+ *	__constant_ntohs(__u16 x)
+ *	__constant_htonl(__u32 x)
+ *	__constant_htons(__u16 x)
+ *
+ * Conversion of XX-bit integers (16- 32- or 64-)
+ * between native CPU format and little/big endian format
+ * 64-bit stuff only defined for proper architectures
+ *	cpu_to_[bl]eXX(__uXX x)
+ *	[bl]eXX_to_cpu(__uXX x)
+ *
+ * The same, but takes a pointer to the value to convert
+ *	cpu_to_[bl]eXXp(__uXX x)
+ *	[bl]eXX_to_cpup(__uXX x)
+ *
+ * The same, but change in situ
+ *	cpu_to_[bl]eXXs(__uXX x)
+ *	[bl]eXX_to_cpus(__uXX x)
+ *
+ * See asm-foo/byteorder.h for examples of how to provide
+ * architecture-optimized versions
+ *
+ */
+
+
+#if defined(PLATFORM_LINUX) || defined(PLATFORM_WINDOWS) || defined(PLATFORM_MPIXEL) || defined(PLATFORM_FREEBSD)
+/*
+ * inside the kernel, we can use nicknames;
+ * outside of it, we must avoid POSIX namespace pollution...
+ */
+#define cpu_to_le64 __cpu_to_le64
+#define le64_to_cpu __le64_to_cpu
+#define cpu_to_le32 __cpu_to_le32
+#define le32_to_cpu __le32_to_cpu
+#define cpu_to_le16 __cpu_to_le16
+#define le16_to_cpu __le16_to_cpu
+#define cpu_to_be64 __cpu_to_be64
+#define be64_to_cpu __be64_to_cpu
+#define cpu_to_be32 __cpu_to_be32
+#define be32_to_cpu __be32_to_cpu
+#define cpu_to_be16 __cpu_to_be16
+#define be16_to_cpu __be16_to_cpu
+#define cpu_to_le64p __cpu_to_le64p
+#define le64_to_cpup __le64_to_cpup
+#define cpu_to_le32p __cpu_to_le32p
+#define le32_to_cpup __le32_to_cpup
+#define cpu_to_le16p __cpu_to_le16p
+#define le16_to_cpup __le16_to_cpup
+#define cpu_to_be64p __cpu_to_be64p
+#define be64_to_cpup __be64_to_cpup
+#define cpu_to_be32p __cpu_to_be32p
+#define be32_to_cpup __be32_to_cpup
+#define cpu_to_be16p __cpu_to_be16p
+#define be16_to_cpup __be16_to_cpup
+#define cpu_to_le64s __cpu_to_le64s
+#define le64_to_cpus __le64_to_cpus
+#define cpu_to_le32s __cpu_to_le32s
+#define le32_to_cpus __le32_to_cpus
+#define cpu_to_le16s __cpu_to_le16s
+#define le16_to_cpus __le16_to_cpus
+#define cpu_to_be64s __cpu_to_be64s
+#define be64_to_cpus __be64_to_cpus
+#define cpu_to_be32s __cpu_to_be32s
+#define be32_to_cpus __be32_to_cpus
+#define cpu_to_be16s __cpu_to_be16s
+#define be16_to_cpus __be16_to_cpus
+#endif
+
+
+/*
+ * Handle ntohl and suches. These have various compatibility
+ * issues - like we want to give the prototype even though we
+ * also have a macro for them in case some strange program
+ * wants to take the address of the thing or something..
+ *
+ * Note that these used to return a "long" in libc5, even though
+ * long is often 64-bit these days.. Thus the casts.
+ *
+ * They have to be macros in order to do the constant folding
+ * correctly - if the argument passed into a inline function
+ * it is no longer constant according to gcc..
+ */
+
+#undef ntohl
+#undef ntohs
+#undef htonl
+#undef htons
+
+/*
+ * Do the prototypes. Somebody might want to take the
+ * address or some such sick thing..
+ */
+#if defined(PLATFORM_LINUX) || (defined (__GLIBC__) && __GLIBC__ >= 2)
+extern __u32			ntohl(__u32);
+extern __u32			htonl(__u32);
+#else //defined(PLATFORM_LINUX) || (defined (__GLIBC__) && __GLIBC__ >= 2)
+#ifndef PLATFORM_FREEBSD
+extern unsigned long int	ntohl(unsigned long int);
+extern unsigned long int	htonl(unsigned long int);
+#endif
+#endif
+#ifndef PLATFORM_FREEBSD
+extern unsigned short int	ntohs(unsigned short int);
+extern unsigned short int	htons(unsigned short int);
+#endif
+
+#if defined(__GNUC__) && (__GNUC__ >= 2) && defined(__OPTIMIZE__) ||  defined(PLATFORM_MPIXEL)
+
+#define ___htonl(x) __cpu_to_be32(x)
+#define ___htons(x) __cpu_to_be16(x)
+#define ___ntohl(x) __be32_to_cpu(x)
+#define ___ntohs(x) __be16_to_cpu(x)
+
+#if defined(PLATFORM_LINUX) || (defined (__GLIBC__) && __GLIBC__ >= 2)
+#define htonl(x) ___htonl(x)
+#define ntohl(x) ___ntohl(x)
+#else
+#define htonl(x) ((unsigned long)___htonl(x))
+#define ntohl(x) ((unsigned long)___ntohl(x))
+#endif
+#define htons(x) ___htons(x)
+#define ntohs(x) ___ntohs(x)
+
+#endif /* OPTIMIZE */
+
+
+#if defined (PLATFORM_WINDOWS)
+
+#define htonl(x) __cpu_to_be32(x)
+#define ntohl(x) __be32_to_cpu(x)
+#define htons(x) __cpu_to_be16(x)
+#define ntohs(x) __be16_to_cpu(x)
+
+
+#endif
+
+#endif /* _LINUX_BYTEORDER_GENERIC_H */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/little_endian.h b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/little_endian.h
new file mode 100644
index 000000000000..9f77fb4b56e2
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/little_endian.h
@@ -0,0 +1,89 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _LINUX_BYTEORDER_LITTLE_ENDIAN_H
+#define _LINUX_BYTEORDER_LITTLE_ENDIAN_H
+
+#ifndef __LITTLE_ENDIAN
+#define __LITTLE_ENDIAN 1234
+#endif
+#ifndef __LITTLE_ENDIAN_BITFIELD
+#define __LITTLE_ENDIAN_BITFIELD
+#endif
+
+#include <byteorder/swab.h>
+
+#ifndef __constant_htonl
+#define __constant_htonl(x) ___constant_swab32((x))
+#define __constant_ntohl(x) ___constant_swab32((x))
+#define __constant_htons(x) ___constant_swab16((x))
+#define __constant_ntohs(x) ___constant_swab16((x))
+#define __constant_cpu_to_le64(x) ((__u64)(x))
+#define __constant_le64_to_cpu(x) ((__u64)(x))
+#define __constant_cpu_to_le32(x) ((__u32)(x))
+#define __constant_le32_to_cpu(x) ((__u32)(x))
+#define __constant_cpu_to_le16(x) ((__u16)(x))
+#define __constant_le16_to_cpu(x) ((__u16)(x))
+#define __constant_cpu_to_be64(x) ___constant_swab64((x))
+#define __constant_be64_to_cpu(x) ___constant_swab64((x))
+#define __constant_cpu_to_be32(x) ___constant_swab32((x))
+#define __constant_be32_to_cpu(x) ___constant_swab32((x))
+#define __constant_cpu_to_be16(x) ___constant_swab16((x))
+#define __constant_be16_to_cpu(x) ___constant_swab16((x))
+#define __cpu_to_le64(x) ((__u64)(x))
+#define __le64_to_cpu(x) ((__u64)(x))
+#define __cpu_to_le32(x) ((__u32)(x))
+#define __le32_to_cpu(x) ((__u32)(x))
+#define __cpu_to_le16(x) ((__u16)(x))
+#define __le16_to_cpu(x) ((__u16)(x))
+#define __cpu_to_be64(x) __swab64((x))
+#define __be64_to_cpu(x) __swab64((x))
+#define __cpu_to_be32(x) __swab32((x))
+#define __be32_to_cpu(x) __swab32((x))
+#define __cpu_to_be16(x) __swab16((x))
+#define __be16_to_cpu(x) __swab16((x))
+#define __cpu_to_le64p(x) (*(__u64*)(x))
+#define __le64_to_cpup(x) (*(__u64*)(x))
+#define __cpu_to_le32p(x) (*(__u32*)(x))
+#define __le32_to_cpup(x) (*(__u32*)(x))
+#define __cpu_to_le16p(x) (*(__u16*)(x))
+#define __le16_to_cpup(x) (*(__u16*)(x))
+#define __cpu_to_be64p(x) __swab64p((x))
+#define __be64_to_cpup(x) __swab64p((x))
+#define __cpu_to_be32p(x) __swab32p((x))
+#define __be32_to_cpup(x) __swab32p((x))
+#define __cpu_to_be16p(x) __swab16p((x))
+#define __be16_to_cpup(x) __swab16p((x))
+#define __cpu_to_le64s(x) do {} while (0)
+#define __le64_to_cpus(x) do {} while (0)
+#define __cpu_to_le32s(x) do {} while (0)
+#define __le32_to_cpus(x) do {} while (0)
+#define __cpu_to_le16s(x) do {} while (0)
+#define __le16_to_cpus(x) do {} while (0)
+#define __cpu_to_be64s(x) __swab64s((x))
+#define __be64_to_cpus(x) __swab64s((x))
+#define __cpu_to_be32s(x) __swab32s((x))
+#define __be32_to_cpus(x) __swab32s((x))
+#define __cpu_to_be16s(x) __swab16s((x))
+#define __be16_to_cpus(x) __swab16s((x))
+#endif	// __constant_htonl
+
+#include <byteorder/generic.h>
+
+#endif /* _LINUX_BYTEORDER_LITTLE_ENDIAN_H */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/swab.h b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/swab.h
new file mode 100644
index 000000000000..1cf2821fd6e7
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/swab.h
@@ -0,0 +1,140 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _LINUX_BYTEORDER_SWAB_H
+#define _LINUX_BYTEORDER_SWAB_H
+
+#if !defined(CONFIG_PLATFORM_MSTAR)
+#ifndef __u16
+typedef unsigned short __u16;
+#endif
+
+#ifndef __u32
+typedef unsigned int	__u32;
+#endif
+
+#ifndef __u8
+typedef unsigned char __u8;
+#endif
+
+#ifndef __u64
+typedef unsigned long long	__u64;
+#endif
+
+
+__inline static __u16  ___swab16(__u16 x)
+{
+	__u16 __x = x;
+	return
+	((__u16)(
+		(((__u16)(__x) & (__u16)0x00ffU) << 8) |
+		(((__u16)(__x) & (__u16)0xff00U) >> 8) ));
+
+}
+
+__inline static __u32  ___swab32(__u32 x)
+{
+	__u32 __x = (x);
+	return ((__u32)(
+		(((__u32)(__x) & (__u32)0x000000ffUL) << 24) |
+		(((__u32)(__x) & (__u32)0x0000ff00UL) <<  8) |
+		(((__u32)(__x) & (__u32)0x00ff0000UL) >>  8) |
+		(((__u32)(__x) & (__u32)0xff000000UL) >> 24) ));
+}
+
+__inline static __u64  ___swab64(__u64 x)
+{
+	__u64 __x = (x);
+
+	return
+	((__u64)( \
+		(__u64)(((__u64)(__x) & (__u64)0x00000000000000ffULL) << 56) | \
+		(__u64)(((__u64)(__x) & (__u64)0x000000000000ff00ULL) << 40) | \
+		(__u64)(((__u64)(__x) & (__u64)0x0000000000ff0000ULL) << 24) | \
+		(__u64)(((__u64)(__x) & (__u64)0x00000000ff000000ULL) <<  8) | \
+	        (__u64)(((__u64)(__x) & (__u64)0x000000ff00000000ULL) >>  8) | \
+		(__u64)(((__u64)(__x) & (__u64)0x0000ff0000000000ULL) >> 24) | \
+		(__u64)(((__u64)(__x) & (__u64)0x00ff000000000000ULL) >> 40) | \
+		(__u64)(((__u64)(__x) & (__u64)0xff00000000000000ULL) >> 56) )); \
+}
+#endif // CONFIG_PLATFORM_MSTAR
+
+#ifndef __arch__swab16
+__inline static __u16 __arch__swab16(__u16 x)
+{
+	return ___swab16(x);
+}
+
+#endif
+
+#ifndef __arch__swab32
+__inline static __u32 __arch__swab32(__u32 x)
+{
+	__u32 __tmp = (x) ;
+	return ___swab32(__tmp);
+}
+#endif
+
+#ifndef __arch__swab64
+
+__inline static __u64 __arch__swab64(__u64 x)
+{
+	__u64 __tmp = (x) ;
+	return ___swab64(__tmp);
+}
+
+
+#endif
+
+#ifndef __swab16
+#define __swab16(x) __fswab16(x)
+#define __swab32(x) __fswab32(x)
+#define __swab64(x) __fswab64(x)
+#endif	// __swab16
+
+#ifdef PLATFORM_FREEBSD
+__inline static __u16 __fswab16(__u16 x)
+#else
+__inline static const __u16 __fswab16(__u16 x)
+#endif //PLATFORM_FREEBSD
+{
+	return __arch__swab16(x);
+}
+#ifdef PLATFORM_FREEBSD
+__inline static __u32 __fswab32(__u32 x)
+#else
+__inline static const __u32 __fswab32(__u32 x)
+#endif //PLATFORM_FREEBSD
+{
+	return __arch__swab32(x);
+}
+
+#if defined(PLATFORM_LINUX) || defined(PLATFORM_WINDOWS)
+#define swab16 __swab16
+#define swab32 __swab32
+#define swab64 __swab64
+#define swab16p __swab16p
+#define swab32p __swab32p
+#define swab64p __swab64p
+#define swab16s __swab16s
+#define swab32s __swab32s
+#define swab64s __swab64s
+#endif
+
+#endif /* _LINUX_BYTEORDER_SWAB_H */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/swabb.h b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/swabb.h
new file mode 100644
index 000000000000..cf0fad67ac1c
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/byteorder/swabb.h
@@ -0,0 +1,156 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _LINUX_BYTEORDER_SWABB_H
+#define _LINUX_BYTEORDER_SWABB_H
+
+/*
+ * linux/byteorder/swabb.h
+ * SWAp Bytes Bizarrely
+ *	swaHHXX[ps]?(foo)
+ *
+ * Support for obNUXIous pdp-endian and other bizarre architectures.
+ * Will Linux ever run on such ancient beasts? if not, this file
+ * will be but a programming pearl. Still, it's a reminder that we
+ * shouldn't be making too many assumptions when trying to be portable.
+ *
+ */
+
+/*
+ * Meaning of the names I chose (vaxlinux people feel free to correct them):
+ * swahw32	swap 16-bit half-words in a 32-bit word
+ * swahb32	swap 8-bit halves of each 16-bit half-word in a 32-bit word
+ *
+ * No 64-bit support yet. I don't know NUXI conventions for long longs.
+ * I guarantee it will be a mess when it's there, though :->
+ * It will be even worse if there are conflicting 64-bit conventions.
+ * Hopefully, no one ever used 64-bit objects on NUXI machines.
+ *
+ */
+
+#define ___swahw32(x) \
+({ \
+	__u32 __x = (x); \
+	((__u32)( \
+		(((__u32)(__x) & (__u32)0x0000ffffUL) << 16) | \
+		(((__u32)(__x) & (__u32)0xffff0000UL) >> 16) )); \
+})
+#define ___swahb32(x) \
+({ \
+	__u32 __x = (x); \
+	((__u32)( \
+		(((__u32)(__x) & (__u32)0x00ff00ffUL) << 8) | \
+		(((__u32)(__x) & (__u32)0xff00ff00UL) >> 8) )); \
+})
+
+#define ___constant_swahw32(x) \
+	((__u32)( \
+		(((__u32)(x) & (__u32)0x0000ffffUL) << 16) | \
+		(((__u32)(x) & (__u32)0xffff0000UL) >> 16) ))
+#define ___constant_swahb32(x) \
+	((__u32)( \
+		(((__u32)(x) & (__u32)0x00ff00ffUL) << 8) | \
+		(((__u32)(x) & (__u32)0xff00ff00UL) >> 8) ))
+
+/*
+ * provide defaults when no architecture-specific optimization is detected
+ */
+#ifndef __arch__swahw32
+#  define __arch__swahw32(x) ___swahw32(x)
+#endif
+#ifndef __arch__swahb32
+#  define __arch__swahb32(x) ___swahb32(x)
+#endif
+
+#ifndef __arch__swahw32p
+#  define __arch__swahw32p(x) __swahw32(*(x))
+#endif
+#ifndef __arch__swahb32p
+#  define __arch__swahb32p(x) __swahb32(*(x))
+#endif
+
+#ifndef __arch__swahw32s
+#  define __arch__swahw32s(x) do { *(x) = __swahw32p((x)); } while (0)
+#endif
+#ifndef __arch__swahb32s
+#  define __arch__swahb32s(x) do { *(x) = __swahb32p((x)); } while (0)
+#endif
+
+
+/*
+ * Allow constant folding
+ */
+#if defined(__GNUC__) && (__GNUC__ >= 2) && defined(__OPTIMIZE__)
+#  define __swahw32(x) \
+(__builtin_constant_p((__u32)(x)) ? \
+ ___swahw32((x)) : \
+ __fswahw32((x)))
+#  define __swahb32(x) \
+(__builtin_constant_p((__u32)(x)) ? \
+ ___swahb32((x)) : \
+ __fswahb32((x)))
+#else
+#  define __swahw32(x) __fswahw32(x)
+#  define __swahb32(x) __fswahb32(x)
+#endif /* OPTIMIZE */
+
+
+__inline static__ __const__ __u32 __fswahw32(__u32 x)
+{
+	return __arch__swahw32(x);
+}
+__inline static__ __u32 __swahw32p(__u32 *x)
+{
+	return __arch__swahw32p(x);
+}
+__inline static__ void __swahw32s(__u32 *addr)
+{
+	__arch__swahw32s(addr);
+}
+
+
+__inline static__ __const__ __u32 __fswahb32(__u32 x)
+{
+	return __arch__swahb32(x);
+}
+__inline static__ __u32 __swahb32p(__u32 *x)
+{
+	return __arch__swahb32p(x);
+}
+__inline static__ void __swahb32s(__u32 *addr)
+{
+	__arch__swahb32s(addr);
+}
+
+#ifdef __BYTEORDER_HAS_U64__
+/*
+ * Not supported yet
+ */
+#endif /* __BYTEORDER_HAS_U64__ */
+
+#if defined(PLATFORM_LINUX)
+#define swahw32 __swahw32
+#define swahb32 __swahb32
+#define swahw32p __swahw32p
+#define swahb32p __swahb32p
+#define swahw32s __swahw32s
+#define swahb32s __swahb32s
+#endif
+
+#endif /* _LINUX_BYTEORDER_SWABB_H */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/circ_buf.h b/drivers/net/wireless/realtek/rtl8192cu/include/circ_buf.h
new file mode 100644
index 000000000000..236fbe60105b
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/circ_buf.h
@@ -0,0 +1,27 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __CIRC_BUF_H_
+#define __CIRC_BUF_H_ 1
+
+#define CIRC_CNT(head,tail,size) (((head) - (tail)) & ((size)-1))
+
+#define CIRC_SPACE(head,tail,size) CIRC_CNT((tail),((head)+1),(size))
+
+#endif //_CIRC_BUF_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/cmd_osdep.h b/drivers/net/wireless/realtek/rtl8192cu/include/cmd_osdep.h
new file mode 100644
index 000000000000..c4903f48144b
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/cmd_osdep.h
@@ -0,0 +1,35 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __CMD_OSDEP_H_
+#define __CMD_OSDEP_H_
+
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+extern sint _rtw_init_cmd_priv (struct	cmd_priv *pcmdpriv);
+extern sint _rtw_init_evt_priv(struct evt_priv *pevtpriv);
+extern void _rtw_free_evt_priv (struct	evt_priv *pevtpriv);
+extern void _rtw_free_cmd_priv (struct	cmd_priv *pcmdpriv);
+extern sint _rtw_enqueue_cmd(_queue *queue, struct cmd_obj *obj);
+extern struct	cmd_obj	*_rtw_dequeue_cmd(_queue *queue);
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/drv_conf.h b/drivers/net/wireless/realtek/rtl8192cu/include/drv_conf.h
new file mode 100644
index 000000000000..370a121881e9
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/drv_conf.h
@@ -0,0 +1,77 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __DRV_CONF_H__
+#define __DRV_CONF_H__
+#include "autoconf.h"
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+
+#error "Shall be Linux or Windows, but not both!\n"
+
+#endif
+
+//Older Android kernel doesn't has CONFIG_ANDROID defined,
+//add this to force CONFIG_ANDROID defined
+#ifdef CONFIG_PLATFORM_ANDROID
+#define CONFIG_ANDROID
+#endif
+
+#ifdef CONFIG_ANDROID
+//Some Android build will restart the UI while non-printable ascii is passed
+//between java and c/c++ layer (JNI). We force CONFIG_VALIDATE_SSID
+//for Android here. If you are sure there is no risk on your system about this,
+//mask this macro define to support non-printable ascii ssid.
+//#define CONFIG_VALIDATE_SSID
+
+//Android expect dbm as the rx signal strength unit
+#define CONFIG_SIGNAL_DISPLAY_DBM
+#endif
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined (CONFIG_RESUME_IN_WORKQUEUE)
+	#warning "You have CONFIG_HAS_EARLYSUSPEND enabled in your system, we disable CONFIG_RESUME_IN_WORKQUEUE automatically"
+	#undef CONFIG_RESUME_IN_WORKQUEUE
+#endif
+
+#if defined(CONFIG_ANDROID_POWER) && defined (CONFIG_RESUME_IN_WORKQUEUE)
+	#warning "You have CONFIG_ANDROID_POWER enabled in your system, we disable CONFIG_RESUME_IN_WORKQUEUE automatically"
+	#undef CONFIG_RESUME_IN_WORKQUEUE
+#endif
+
+#ifdef CONFIG_RESUME_IN_WORKQUEUE //this can be removed, because there is no case for this...
+	#if !defined( CONFIG_WAKELOCK) && !defined(CONFIG_ANDROID_POWER)
+	#error "enable CONFIG_RESUME_IN_WORKQUEUE without CONFIG_WAKELOCK or CONFIG_ANDROID_POWER will suffer from the danger of wifi's unfunctionality..."
+	#error "If you still want to enable CONFIG_RESUME_IN_WORKQUEUE in this case, mask this preprossor checking and GOOD LUCK..."
+	#endif
+#endif
+
+//About USB VENDOR REQ
+#if defined(CONFIG_USB_VENDOR_REQ_BUFFER_PREALLOC) && !defined(CONFIG_USB_VENDOR_REQ_MUTEX)
+	#warning "define CONFIG_USB_VENDOR_REQ_MUTEX for CONFIG_USB_VENDOR_REQ_BUFFER_PREALLOC automatically"
+	#define CONFIG_USB_VENDOR_REQ_MUTEX
+#endif
+#if defined(CONFIG_VENDOR_REQ_RETRY) &&  !defined(CONFIG_USB_VENDOR_REQ_MUTEX)
+	#warning "define CONFIG_USB_VENDOR_REQ_MUTEX for CONFIG_VENDOR_REQ_RETRY automatically"
+	#define CONFIG_USB_VENDOR_REQ_MUTEX
+#endif
+
+
+//#include <rtl871x_byteorder.h>
+
+#endif // __DRV_CONF_H__
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/drv_types.h b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types.h
new file mode 100644
index 000000000000..46ab66350985
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types.h
@@ -0,0 +1,661 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*-------------------------------------------------------------------------------
+
+	For type defines and data structure defines
+
+--------------------------------------------------------------------------------*/
+
+
+#ifndef __DRV_TYPES_H__
+#define __DRV_TYPES_H__
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <wlan_bssdef.h>
+
+
+#ifdef PLATFORM_OS_XP
+#include <drv_types_xp.h>
+#endif
+
+#ifdef PLATFORM_OS_CE
+#include <drv_types_ce.h>
+#endif
+
+#ifdef PLATFORM_LINUX
+#include <drv_types_linux.h>
+#endif
+
+enum _NIC_VERSION {
+
+	RTL8711_NIC,
+	RTL8712_NIC,
+	RTL8713_NIC,
+	RTL8716_NIC
+
+};
+
+enum{
+	UP_LINK,
+	DOWN_LINK,
+};
+typedef struct _ADAPTER _adapter, ADAPTER,*PADAPTER;
+
+#ifdef CONFIG_80211N_HT
+#include <rtw_ht.h>
+#endif
+
+#include <rtw_cmd.h>
+#include <wlan_bssdef.h>
+#include <rtw_security.h>
+#include <rtw_xmit.h>
+#include <rtw_recv.h>
+#include <hal_intf.h>
+#include <hal_com.h>
+#include <rtw_qos.h>
+#include <rtw_pwrctrl.h>
+#include <rtw_io.h>
+#include <rtw_eeprom.h>
+#include <sta_info.h>
+#include <rtw_mlme.h>
+#include <rtw_debug.h>
+#include <rtw_rf.h>
+#include <rtw_event.h>
+#include <rtw_led.h>
+#include <rtw_mlme_ext.h>
+#include <rtw_p2p.h>
+#include <rtw_tdls.h>
+#include <rtw_ap.h>
+
+#ifdef CONFIG_DRVEXT_MODULE
+#include <drvext_api.h>
+#endif
+
+#ifdef CONFIG_MP_INCLUDED
+#include <rtw_mp.h>
+#endif
+
+#ifdef CONFIG_BR_EXT
+#include <rtw_br_ext.h>
+#endif	// CONFIG_BR_EXT
+
+#ifdef CONFIG_IOCTL_CFG80211
+	#include "ioctl_cfg80211.h"
+#endif //CONFIG_IOCTL_CFG80211
+
+#define SPEC_DEV_ID_NONE BIT(0)
+#define SPEC_DEV_ID_DISABLE_HT BIT(1)
+#define SPEC_DEV_ID_ENABLE_PS BIT(2)
+#define SPEC_DEV_ID_RF_CONFIG_1T1R BIT(3)
+#define SPEC_DEV_ID_RF_CONFIG_2T2R BIT(4)
+#define SPEC_DEV_ID_ASSIGN_IFNAME BIT(5)
+
+struct specific_device_id{
+
+	u32		flags;
+
+	u16		idVendor;
+	u16		idProduct;
+
+};
+
+struct registry_priv
+{
+	u8	chip_version;
+	u8	rfintfs;
+	u8	lbkmode;
+	u8	hci;
+	NDIS_802_11_SSID	ssid;
+	u8	network_mode;	//infra, ad-hoc, auto
+	u8	channel;//ad-hoc support requirement
+	u8	wireless_mode;//A, B, G, auto
+	u8 	scan_mode;//active, passive
+	u8	radio_enable;
+	u8	preamble;//long, short, auto
+	u8	vrtl_carrier_sense;//Enable, Disable, Auto
+	u8	vcs_type;//RTS/CTS, CTS-to-self
+	u16	rts_thresh;
+	u16  frag_thresh;
+	u8	adhoc_tx_pwr;
+	u8	soft_ap;
+	u8	power_mgnt;
+	u8	ips_mode;
+	u8	smart_ps;
+	u8	long_retry_lmt;
+	u8	short_retry_lmt;
+	u16	busy_thresh;
+	u8	ack_policy;
+	u8	mp_mode;
+	u8	software_encrypt;
+	u8	software_decrypt;
+
+	u8	acm_method;
+	  //UAPSD
+	u8	wmm_enable;
+	u8	uapsd_enable;
+	u8	uapsd_max_sp;
+	u8	uapsd_acbk_en;
+	u8	uapsd_acbe_en;
+	u8	uapsd_acvi_en;
+	u8	uapsd_acvo_en;
+
+	WLAN_BSSID_EX    dev_network;
+
+#ifdef CONFIG_80211N_HT
+	u8	ht_enable;
+	u8	cbw40_enable;
+	u8	ampdu_enable;//for tx
+	u8 	rx_stbc;
+	u8	ampdu_amsdu;//A-MPDU Supports A-MSDU is permitted
+#endif
+	u8	lowrate_two_xmit;
+
+	u8	rf_config ;
+	u8	low_power ;
+
+	u8	wifi_spec;// !turbo_mode
+
+	u8	channel_plan;
+#ifdef CONFIG_BT_COEXIST
+	u8	bt_iso;
+	u8	bt_sco;
+	u8	bt_ampdu;
+#endif
+	BOOLEAN	bAcceptAddbaReq;
+
+	u8	antdiv_cfg;
+
+	u8	usbss_enable;//0:disable,1:enable
+	u8	hwpdn_mode;//0:disable,1:enable,2:decide by EFUSE config
+	u8	hwpwrp_detect;//0:disable,1:enable
+
+	u8	hw_wps_pbc;//0:disable,1:enable
+
+#ifdef CONFIG_ADAPTOR_INFO_CACHING_FILE
+	char	adaptor_info_caching_file_path[PATH_LENGTH_MAX];
+#endif
+
+#ifdef CONFIG_LAYER2_ROAMING
+	u8	max_roaming_times; // the max number driver will try to roaming
+#endif
+
+#ifdef CONFIG_IOL
+	bool force_iol; //enable iol without other concern
+#endif
+	u8  special_rf_path; //0: 2T2R ,1: only turn on path A 1T1R, 2: only turn on path B 1T1R
+	u8	mac_phy_mode; //0:by efuse, 1:smsp, 2:dmdp, 3:dmsp.
+
+#ifdef CONFIG_80211D
+	u8 enable80211d;
+#endif
+
+	u8 ifname[16];
+	u8 if2name[16];
+
+	u8 notch_filter;
+
+#ifdef CONFIG_MULTI_VIR_IFACES
+	u8 ext_iface_num;//primary/secondary iface is excluded
+#endif
+};
+
+
+//For registry parameters
+#define RGTRY_OFT(field) ((ULONG)FIELD_OFFSET(struct registry_priv,field))
+#define RGTRY_SZ(field)   sizeof(((struct registry_priv*) 0)->field)
+#define BSSID_OFT(field) ((ULONG)FIELD_OFFSET(WLAN_BSSID_EX,field))
+#define BSSID_SZ(field)   sizeof(((PWLAN_BSSID_EX) 0)->field)
+
+#define MAX_CONTINUAL_URB_ERR 4
+
+#ifdef CONFIG_SDIO_HCI
+#include <drv_types_sdio.h>
+#define INTF_DATA SDIO_DATA
+#endif
+
+#define GET_PRIMARY_ADAPTER(padapter) (((_adapter *)padapter)->dvobj->if1)
+
+#define GET_IFACE_NUMS(padapter) (((_adapter *)padapter)->dvobj->iface_nums)
+#define GET_ADAPTER(padapter, iface_id) (((_adapter *)padapter)->dvobj->padapters[iface_id])
+
+enum _IFACE_ID {
+	IFACE_ID0, //maping to PRIMARY_ADAPTER
+	IFACE_ID1, //maping to SECONDARY_ADAPTER
+	IFACE_ID2,
+	IFACE_ID3,
+	IFACE_ID_MAX,
+};
+
+struct dvobj_priv
+{
+	_adapter *if1; //PRIMARY_ADAPTER
+	_adapter *if2; //SECONDARY_ADAPTER
+
+	s32 processing_dev_remove;
+
+	//for local/global synchronization
+	_mutex hw_init_mutex;
+	_mutex h2c_fwcmd_mutex;
+	_mutex setch_mutex;
+	_mutex setbw_mutex;
+
+	unsigned char	oper_channel; //saved channel info when call set_channel_bw
+	unsigned char	oper_bwmode;
+	unsigned char	oper_ch_offset;//PRIME_CHNL_OFFSET
+	u32 on_oper_ch_time;
+
+	//extend to support mulitu interface
+	//padapters[IFACE_ID0] == if1
+	//padapters[IFACE_ID1] == if2
+	_adapter *padapters[IFACE_ID_MAX];
+	u8 iface_nums; // total number of ifaces used runtime
+
+	//For 92D, DMDP have 2 interface.
+	u8	InterfaceNumber;
+	u8	NumInterfaces;
+	u8	DualMacMode;
+	u8	irq_alloc;
+
+/*-------- below is for SDIO INTERFACE --------*/
+
+#ifdef INTF_DATA
+	INTF_DATA intf_data;
+#endif
+
+/*-------- below is for USB INTERFACE --------*/
+
+#ifdef CONFIG_USB_HCI
+
+	u8	nr_endpoint;
+	u8	ishighspeed;
+	u8	RtNumInPipes;
+	u8	RtNumOutPipes;
+	int	ep_num[5]; //endpoint number
+
+	int	RegUsbSS;
+
+	_sema	usb_suspend_sema;
+
+#ifdef CONFIG_USB_VENDOR_REQ_MUTEX
+	_mutex  usb_vendor_req_mutex;
+#endif
+
+#ifdef CONFIG_USB_VENDOR_REQ_BUFFER_PREALLOC
+	u8 * usb_alloc_vendor_req_buf;
+	u8 * usb_vendor_req_buf;
+#endif
+
+#ifdef PLATFORM_WINDOWS
+	//related device objects
+	PDEVICE_OBJECT	pphysdevobj;//pPhysDevObj;
+	PDEVICE_OBJECT	pfuncdevobj;//pFuncDevObj;
+	PDEVICE_OBJECT	pnextdevobj;//pNextDevObj;
+
+	u8	nextdevstacksz;//unsigned char NextDeviceStackSize;	//= (CHAR)CEdevice->pUsbDevObj->StackSize + 1;
+
+	//urb for control diescriptor request
+
+#ifdef PLATFORM_OS_XP
+	struct _URB_CONTROL_DESCRIPTOR_REQUEST descriptor_urb;
+	PUSB_CONFIGURATION_DESCRIPTOR	pconfig_descriptor;//UsbConfigurationDescriptor;
+#endif
+
+#ifdef PLATFORM_OS_CE
+	WCHAR			active_path[MAX_ACTIVE_REG_PATH];	// adapter regpath
+	USB_EXTENSION	usb_extension;
+
+	_nic_hdl		pipehdls_r8192c[0x10];
+#endif
+
+	u32	config_descriptor_len;//ULONG UsbConfigurationDescriptorLength;
+#endif//PLATFORM_WINDOWS
+
+#ifdef PLATFORM_LINUX
+	struct usb_interface *pusbintf;
+	struct usb_device *pusbdev;
+#endif//PLATFORM_LINUX
+
+#ifdef PLATFORM_FREEBSD
+	struct usb_interface *pusbintf;
+	struct usb_device *pusbdev;
+#endif//PLATFORM_FREEBSD
+	ATOMIC_T continual_urb_error;
+#endif//CONFIG_USB_HCI
+
+/*-------- below is for PCIE INTERFACE --------*/
+
+#ifdef CONFIG_PCI_HCI
+
+#ifdef PLATFORM_LINUX
+	struct pci_dev *ppcidev;
+
+	//PCI MEM map
+	unsigned long	pci_mem_end;	/* shared mem end	*/
+	unsigned long	pci_mem_start;	/* shared mem start	*/
+
+	//PCI IO map
+	unsigned long	pci_base_addr;	/* device I/O address	*/
+
+	//PciBridge
+	struct pci_priv	pcipriv;
+
+	u16	irqline;
+	u8	irq_enabled;
+	RT_ISR_CONTENT	isr_content;
+	_lock	irq_th_lock;
+
+	//ASPM
+	u8	const_pci_aspm;
+	u8	const_amdpci_aspm;
+	u8	const_hwsw_rfoff_d3;
+	u8	const_support_pciaspm;
+	// pci-e bridge */
+	u8 	const_hostpci_aspm_setting;
+	// pci-e device */
+	u8 	const_devicepci_aspm_setting;
+	u8 	b_support_aspm; // If it supports ASPM, Offset[560h] = 0x40, otherwise Offset[560h] = 0x00.
+	u8	b_support_backdoor;
+	u8 bdma64;
+#endif//PLATFORM_LINUX
+
+#endif//CONFIG_PCI_HCI
+};
+
+#ifdef PLATFORM_LINUX
+static struct device *dvobj_to_dev(struct dvobj_priv *dvobj)
+{
+	/* todo: get interface type from dvobj and the return the dev accordingly */
+#ifdef RTW_DVOBJ_CHIP_HW_TYPE
+#endif
+
+#ifdef CONFIG_USB_HCI
+	return &dvobj->pusbintf->dev;
+#endif
+#ifdef CONFIG_SDIO_HCI
+	return &dvobj->intf_data.func->dev;
+#endif
+#ifdef CONFIG_PCI_HCI
+	return &dvobj->ppcidev->dev;
+#endif
+}
+#endif
+
+
+enum _IFACE_TYPE {
+	IFACE_PORT0, //mapping to port0 for C/D series chips
+	IFACE_PORT1, //mapping to port1 for C/D series chip
+	MAX_IFACE_PORT,
+};
+
+enum _ADAPTER_TYPE {
+	PRIMARY_ADAPTER,
+	SECONDARY_ADAPTER,
+	MAX_ADAPTER = 0xFF,
+};
+
+typedef enum _DRIVER_STATE{
+	DRIVER_NORMAL = 0,
+	DRIVER_DISAPPEAR = 1,
+	DRIVER_REPLACE_DONGLE = 2,
+}DRIVER_STATE;
+
+#ifdef CONFIG_INTEL_PROXIM
+struct proxim {
+	bool proxim_support;
+	bool proxim_on;
+
+	void *proximity_priv;
+	int (*proxim_rx)(_adapter *padapter,
+		union recv_frame *precv_frame);
+	u8	(*proxim_get_var)(_adapter* padapter, u8 type);
+};
+#endif	//CONFIG_INTEL_PROXIM
+
+#ifdef RTL8723A_SDIO_LOOPBACK
+typedef struct loopbackdata
+{
+	_sema	sema;
+	_thread_hdl_ lbkthread;
+	u8 bstop;
+	u32 cnt;
+	u16 size;
+	u16 txsize;
+	u8 txbuf[0x8000];
+	u16 rxsize;
+	u8 rxbuf[0x8000];
+	u8 msg[100];
+
+}LOOPBACKDATA, *PLOOPBACKDATA;
+#endif
+
+struct _ADAPTER{
+	int	DriverState;// for disable driver using module, use dongle to replace module.
+	int	pid[3];//process id from UI, 0:wps, 1:hostapd, 2:dhcpcd
+	int	bDongle;//build-in module or external dongle
+	u16 	chip_type;
+	u16	HardwareType;
+	u16	interface_type;//USB,SDIO,PCI
+
+	struct dvobj_priv *dvobj;
+	struct	mlme_priv mlmepriv;
+	struct	mlme_ext_priv mlmeextpriv;
+	struct	cmd_priv	cmdpriv;
+	struct	evt_priv	evtpriv;
+	//struct	io_queue	*pio_queue;
+	struct 	io_priv	iopriv;
+	struct	xmit_priv	xmitpriv;
+	struct	recv_priv	recvpriv;
+	struct	sta_priv	stapriv;
+	struct	security_priv	securitypriv;
+	_lock   security_key_mutex; // add for CONFIG_IEEE80211W, none 11w also can use
+	struct	registry_priv	registrypriv;
+	struct	pwrctrl_priv	pwrctrlpriv;
+	struct 	eeprom_priv eeprompriv;
+	struct	led_priv	ledpriv;
+
+#ifdef CONFIG_MP_INCLUDED
+       struct	mp_priv	mppriv;
+#endif
+
+#ifdef CONFIG_DRVEXT_MODULE
+	struct	drvext_priv	drvextpriv;
+#endif
+
+#ifdef CONFIG_AP_MODE
+	struct	hostapd_priv	*phostapdpriv;
+#endif
+
+#ifdef CONFIG_IOCTL_CFG80211
+#ifdef CONFIG_P2P
+	struct cfg80211_wifidirect_info	cfg80211_wdinfo;
+#endif //CONFIG_P2P
+#endif //CONFIG_IOCTL_CFG80211
+	u32	setband;
+#ifdef CONFIG_P2P
+	struct wifidirect_info	wdinfo;
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_TDLS
+	struct tdls_info	tdlsinfo;
+#endif //CONFIG_TDLS
+
+#ifdef CONFIG_WFD
+	struct wifi_display_info wfd_info;
+#endif //CONFIG_WFD
+
+	PVOID			HalData;
+	u32 hal_data_sz;
+	struct hal_ops	HalFunc;
+
+#ifdef CONFIG_BT_COEXIST
+	//struct	btcoexist_priv	bt_coexist;
+#endif
+	s32	bDriverStopped;
+	s32	bSurpriseRemoved;
+	s32  bCardDisableWOHSM;
+
+	u32	IsrContent;
+	u32	ImrContent;
+
+	u8	EepromAddressSize;
+	u8	hw_init_completed;
+	u8	bDriverIsGoingToUnload;
+	u8	init_adpt_in_progress;
+	u8	bHaltInProgress;
+
+	_thread_hdl_ cmdThread;
+	_thread_hdl_ evtThread;
+	_thread_hdl_ xmitThread;
+	_thread_hdl_ recvThread;
+
+#ifndef PLATFORM_LINUX
+	NDIS_STATUS (*dvobj_init)(struct dvobj_priv	*dvobj);
+	void (*dvobj_deinit)(struct dvobj_priv *dvobj);
+#endif
+
+	void (*intf_start)(_adapter * adapter);
+	void (*intf_stop)(_adapter * adapter);
+
+#ifdef PLATFORM_WINDOWS
+	_nic_hdl		hndis_adapter;//hNdisAdapter(NDISMiniportAdapterHandle);
+	_nic_hdl		hndis_config;//hNdisConfiguration;
+	NDIS_STRING fw_img;
+
+	u32	NdisPacketFilter;
+	u8	MCList[MAX_MCAST_LIST_NUM][6];
+	u32	MCAddrCount;
+#endif //end of PLATFORM_WINDOWS
+
+
+#ifdef PLATFORM_LINUX
+	_nic_hdl pnetdev;
+
+	// used by rtw_rereg_nd_name related function
+	struct rereg_nd_name_data {
+		_nic_hdl old_pnetdev;
+		char old_ifname[IFNAMSIZ];
+		u8 old_ips_mode;
+		u8 old_bRegUseLed;
+	} rereg_nd_name_priv;
+
+	int bup;
+	struct net_device_stats stats;
+	struct iw_statistics iwstats;
+	struct proc_dir_entry *dir_dev;// for proc directory
+
+#ifdef CONFIG_IOCTL_CFG80211
+	struct wireless_dev *rtw_wdev;
+#endif //CONFIG_IOCTL_CFG80211
+
+#endif //end of PLATFORM_LINUX
+
+#ifdef PLATFORM_FREEBSD
+	_nic_hdl pifp;
+	int bup;
+	_lock glock;
+#endif //PLATFORM_FREEBSD
+	int net_closed;
+
+	u8 bFWReady;
+	u8 bReadPortCancel;
+	u8 bWritePortCancel;
+	u8 bRxRSSIDisplay;
+	//	Added by Albert 2012/07/26
+	//	The driver will write the initial gain everytime when running in the DM_Write_DIG function.
+	u8 bForceWriteInitGain;
+	//	Added by Albert 2012/10/26
+	//	The driver will show up the desired channel number when this flag is 1.
+	u8 bNotifyChannelChange;
+#ifdef CONFIG_P2P
+	//	Added by Albert 2012/12/06
+	//	The driver will show the current P2P status when the upper application reads it.
+	u8 bShowGetP2PState;
+#endif
+#ifdef CONFIG_AUTOSUSPEND
+	u8	bDisableAutosuspend;
+#endif
+
+	//pbuddy_adapter is used only in  two inteface case, (iface_nums=2 in struct dvobj_priv)
+	//PRIMARY_ADAPTER's buddy is SECONDARY_ADAPTER
+	//SECONDARY_ADAPTER's buddy is PRIMARY_ADAPTER
+	//for iface_id > SECONDARY_ADAPTER(IFACE_ID1), refer to padapters[iface_id]  in struct dvobj_priv
+	//and their pbuddy_adapter is PRIMARY_ADAPTER.
+	//for PRIMARY_ADAPTER(IFACE_ID0) can directly refer to if1 in struct dvobj_priv
+	_adapter *pbuddy_adapter;
+
+#if defined(CONFIG_CONCURRENT_MODE) || defined(CONFIG_DUALMAC_CONCURRENT)
+	u8 isprimary; //is primary adapter or not
+	//notes:
+	// if isprimary is true, the adapter_type value is 0, iface_id is IFACE_ID0 for PRIMARY_ADAPTER
+	// if isprimary is false, the adapter_type value is 1, iface_id is IFACE_ID1 for SECONDARY_ADAPTER
+	// refer to iface_id if iface_nums>2 and isprimary is false and the adapter_type value is 0xff.
+	u8 adapter_type;//used only in  two inteface case(PRIMARY_ADAPTER and SECONDARY_ADAPTER) .
+	u8 iface_type; //interface port type, it depends on HW port
+#endif
+
+	//extend to support multi interface
+       //IFACE_ID0 is equals to PRIMARY_ADAPTER
+       //IFACE_ID1 is equals to SECONDARY_ADAPTER
+	u8 iface_id;
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	u8 DualMacConcurrent; // 1: DMSP 0:DMDP
+#endif
+
+#ifdef CONFIG_BR_EXT
+	_lock					br_ext_lock;
+	//unsigned int			macclone_completed;
+	struct nat25_network_db_entry	*nethash[NAT25_HASH_SIZE];
+	int				pppoe_connection_in_progress;
+	unsigned char			pppoe_addr[MACADDRLEN];
+	unsigned char			scdb_mac[MACADDRLEN];
+	unsigned char			scdb_ip[4];
+	struct nat25_network_db_entry	*scdb_entry;
+	unsigned char			br_mac[MACADDRLEN];
+	unsigned char			br_ip[4];
+
+	struct br_ext_info		ethBrExtInfo;
+#endif	// CONFIG_BR_EXT
+
+#ifdef CONFIG_INTEL_PROXIM
+	/* intel Proximity, should be alloc mem
+	 * in intel Proximity module and can only
+	 * be used in intel Proximity mode */
+	struct proxim proximity;
+#endif	//CONFIG_INTEL_PROXIM
+
+#ifdef RTL8723A_SDIO_LOOPBACK
+	PLOOPBACKDATA ploopback;
+#endif
+
+};
+
+#define adapter_to_dvobj(adapter) (adapter->dvobj)
+
+int rtw_handle_dualmac(_adapter *adapter, bool init);
+
+__inline static u8 *myid(struct eeprom_priv *peepriv)
+{
+	return (peepriv->mac_addr);
+}
+
+
+#endif //__DRV_TYPES_H__
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_ce.h b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_ce.h
new file mode 100644
index 000000000000..25794fdaba54
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_ce.h
@@ -0,0 +1,92 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __DRV_TYPES_CE_H__
+#define __DRV_TYPES_CE_H__
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+
+#include <Sdcardddk.h>
+
+#define MAX_ACTIVE_REG_PATH 256
+
+#define MAX_MCAST_LIST_NUM					32
+
+
+
+//for ioctl
+#define MAKE_DRIVER_VERSION(_MainVer,_MinorVer)	((((u32)(_MainVer))<<16)+_MinorVer)
+
+#define NIC_HEADER_SIZE				14			//!< can be moved to typedef.h
+#define NIC_MAX_PACKET_SIZE			1514		//!< can be moved to typedef.h
+#define NIC_MAX_SEND_PACKETS			10		// max number of send packets the MiniportSendPackets function can accept, can be moved to typedef.h
+#define NIC_VENDOR_DRIVER_VERSION       MAKE_DRIVER_VERSION(0,001)	//!< can be moved to typedef.h
+#define NIC_MAX_PACKET_SIZE			1514		//!< can be moved to typedef.h
+
+typedef struct _MP_REG_ENTRY
+{
+
+	NDIS_STRING		RegName;	// variable name text
+	BOOLEAN			bRequired;	// 1 -> required, 0 -> optional
+
+	u8			Type;		// NdisParameterInteger/NdisParameterHexInteger/NdisParameterStringle/NdisParameterMultiString
+	uint			FieldOffset;	// offset to MP_ADAPTER field
+	uint			FieldSize;	// size (in bytes) of the field
+
+#ifdef UNDER_AMD64
+	u64			Default;
+#else
+	u32			Default;		// default value to use
+#endif
+
+	u32			Min;			// minimum value allowed
+	u32			Max;		// maximum value allowed
+} MP_REG_ENTRY, *PMP_REG_ENTRY;
+
+#ifdef CONFIG_USB_HCI
+typedef struct _USB_EXTENSION {
+    LPCUSB_FUNCS    _lpUsbFuncs;
+	USB_HANDLE	    _hDevice;
+    PVOID 		    pAdapter;
+
+#if 0
+	USB_ENDPOINT_DESCRIPTOR		_endpACLIn;
+    USB_ENDPOINT_DESCRIPTOR		_endpACLOutHigh;
+	USB_ENDPOINT_DESCRIPTOR		_endpACLOutNormal;
+
+	USB_PIPE        pPipeIn;
+    USB_PIPE        pPipeOutNormal;
+    USB_PIPE        pPipeOutHigh;
+#endif
+
+} USB_EXTENSION, *PUSB_EXTENSION;
+#endif
+
+
+typedef struct _OCTET_STRING{
+	u8      *Octet;
+	u16      Length;
+} OCTET_STRING, *POCTET_STRING;
+
+
+
+
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_linux.h b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_linux.h
new file mode 100644
index 000000000000..812b7440d4b0
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_linux.h
@@ -0,0 +1,24 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __DRV_TYPES_LINUX_H__
+#define __DRV_TYPES_LINUX_H__
+
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_sdio.h b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_sdio.h
new file mode 100644
index 000000000000..c44571290702
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_sdio.h
@@ -0,0 +1,69 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __DRV_TYPES_SDIO_H__
+#define __DRV_TYPES_SDIO_H__
+
+#include <drv_conf.h>
+#include <basic_types.h>
+
+// SDIO Header Files
+#ifdef PLATFORM_LINUX
+#include <linux/mmc/sdio_func.h>
+#endif
+#ifdef PLATFORM_OS_XP
+#include <wdm.h>
+#include <ntddsd.h>
+#endif
+#ifdef PLATFORM_OS_CE
+#include <sdcardddk.h>
+#endif
+
+
+typedef struct sdio_data
+{
+	u8  func_number;
+
+	u8  tx_block_mode;
+	u8  rx_block_mode;
+	u32 block_transfer_len;
+
+#ifdef PLATFORM_LINUX
+	struct sdio_func	 *func;
+#endif
+
+#ifdef PLATFORM_OS_XP
+	PDEVICE_OBJECT				pphysdevobj;
+	PDEVICE_OBJECT				pfuncdevobj;
+	PDEVICE_OBJECT				pnextdevobj;
+	SDBUS_INTERFACE_STANDARD	sdbusinft;
+	u8							nextdevstacksz;
+#endif
+
+#ifdef PLATFORM_OS_CE
+	SD_DEVICE_HANDLE			hDevice;
+	SD_CARD_RCA					sd_rca;
+	SD_CARD_INTERFACE			card_intf;
+	BOOLEAN						enableIsarWithStatus;
+	WCHAR						active_path[MAX_ACTIVE_REG_PATH];
+	SD_HOST_BLOCK_CAPABILITY	sd_host_blk_cap;
+#endif
+} SDIO_DATA, *PSDIO_DATA;
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_xp.h b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_xp.h
new file mode 100644
index 000000000000..1d735d69dc92
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/drv_types_xp.h
@@ -0,0 +1,94 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __DRV_TYPES_XP_H__
+#define __DRV_TYPES_XP_H__
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+
+
+
+#define MAX_MCAST_LIST_NUM					32
+
+
+
+//for ioctl
+#define MAKE_DRIVER_VERSION(_MainVer,_MinorVer)	((((u32)(_MainVer))<<16)+_MinorVer)
+
+#define NIC_HEADER_SIZE				14			//!< can be moved to typedef.h
+#define NIC_MAX_PACKET_SIZE			1514		//!< can be moved to typedef.h
+#define NIC_MAX_SEND_PACKETS			10		// max number of send packets the MiniportSendPackets function can accept, can be moved to typedef.h
+#define NIC_VENDOR_DRIVER_VERSION       MAKE_DRIVER_VERSION(0,001)	//!< can be moved to typedef.h
+#define NIC_MAX_PACKET_SIZE			1514		//!< can be moved to typedef.h
+
+
+#undef ON_VISTA
+//added by Jackson
+#ifndef ON_VISTA
+//
+// Bus driver versions
+//
+
+#define SDBUS_DRIVER_VERSION_1          0x100
+#define SDBUS_DRIVER_VERSION_2          0x200
+
+#define    SDP_FUNCTION_TYPE	4
+#define    SDP_BUS_DRIVER_VERSION 5
+#define    SDP_BUS_WIDTH 6
+#define    SDP_BUS_CLOCK 7
+#define    SDP_BUS_INTERFACE_CONTROL 8
+#define    SDP_HOST_BLOCK_LENGTH 9
+#define    SDP_FUNCTION_BLOCK_LENGTH 10
+#define    SDP_FN0_BLOCK_LENGTH 11
+#define    SDP_FUNCTION_INT_ENABLE 12
+#endif
+
+
+typedef struct _MP_REG_ENTRY
+{
+
+	NDIS_STRING		RegName;	// variable name text
+	BOOLEAN			bRequired;	// 1 -> required, 0 -> optional
+
+	u8			Type;		// NdisParameterInteger/NdisParameterHexInteger/NdisParameterStringle/NdisParameterMultiString
+	uint			FieldOffset;	// offset to MP_ADAPTER field
+	uint			FieldSize;	// size (in bytes) of the field
+
+#ifdef UNDER_AMD64
+	u64			Default;
+#else
+	u32			Default;		// default value to use
+#endif
+
+	u32			Min;			// minimum value allowed
+	u32			Max;		// maximum value allowed
+} MP_REG_ENTRY, *PMP_REG_ENTRY;
+
+
+typedef struct _OCTET_STRING{
+	u8      *Octet;
+	u16      Length;
+} OCTET_STRING, *POCTET_STRING;
+
+
+
+
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/ethernet.h b/drivers/net/wireless/realtek/rtl8192cu/include/ethernet.h
new file mode 100644
index 000000000000..e22c12b406e9
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/ethernet.h
@@ -0,0 +1,41 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*! \file */
+#ifndef __INC_ETHERNET_H
+#define __INC_ETHERNET_H
+
+#define ETHERNET_ADDRESS_LENGTH				6		//!< Ethernet Address Length
+#define ETHERNET_HEADER_SIZE				14		//!< Ethernet Header Length
+#define LLC_HEADER_SIZE						6		//!< LLC Header Length
+#define TYPE_LENGTH_FIELD_SIZE				2		//!< Type/Length Size
+#define MINIMUM_ETHERNET_PACKET_SIZE		60		//!< Minimum Ethernet Packet Size
+#define MAXIMUM_ETHERNET_PACKET_SIZE		1514	//!< Maximum Ethernet Packet Size
+
+#define RT_ETH_IS_MULTICAST(_pAddr)	((((UCHAR *)(_pAddr))[0]&0x01)!=0)		//!< Is Multicast Address?
+#define RT_ETH_IS_BROADCAST(_pAddr)	(										\
+											((UCHAR *)(_pAddr))[0]==0xff	&& 		\
+											((UCHAR *)(_pAddr))[1]==0xff	&&		\
+											((UCHAR *)(_pAddr))[2]==0xff	&&		\
+											((UCHAR *)(_pAddr))[3]==0xff	&&		\
+											((UCHAR *)(_pAddr))[4]==0xff	&&		\
+											((UCHAR *)(_pAddr))[5]==0xff		)	//!< Is Broadcast Address?
+
+
+#endif // #ifndef __INC_ETHERNET_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/h2clbk.h b/drivers/net/wireless/realtek/rtl8192cu/include/h2clbk.h
new file mode 100644
index 000000000000..847356e2d18f
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/h2clbk.h
@@ -0,0 +1,35 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+
+#define _H2CLBK_H_
+
+
+#include <rtl8711_spec.h>
+#include <TypeDef.h>
+
+
+void _lbk_cmd(PADAPTER Adapter);
+
+void _lbk_rsp(PADAPTER Adapter);
+
+void _lbk_evt(IN PADAPTER Adapter);
+
+void h2c_event_callback(unsigned char *dev, unsigned char *pbuf);
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/hal_com.h b/drivers/net/wireless/realtek/rtl8192cu/include/hal_com.h
new file mode 100644
index 000000000000..382f124da55c
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/hal_com.h
@@ -0,0 +1,145 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __HAL_COMMON_H__
+#define __HAL_COMMON_H__
+
+//CCK
+#define RATE_1M						BIT(0)
+#define RATE_2M						BIT(1)
+#define RATE_5_5M					BIT(2)
+#define RATE_11M					BIT(3)
+//OFDM
+#define RATE_6M						BIT(4)
+#define RATE_9M						BIT(5)
+#define RATE_12M					BIT(6)
+#define RATE_18M					BIT(7)
+#define RATE_24M					BIT(8)
+#define RATE_36M					BIT(9)
+#define RATE_48M					BIT(10)
+#define RATE_54M					BIT(11)
+//MCS 1 Spatial Stream
+#define RATE_MCS0					BIT(12)
+#define RATE_MCS1					BIT(13)
+#define RATE_MCS2					BIT(14)
+#define RATE_MCS3					BIT(15)
+#define RATE_MCS4					BIT(16)
+#define RATE_MCS5					BIT(17)
+#define RATE_MCS6					BIT(18)
+#define RATE_MCS7					BIT(19)
+//MCS 2 Spatial Stream
+#define RATE_MCS8					BIT(20)
+#define RATE_MCS9					BIT(21)
+#define RATE_MCS10					BIT(22)
+#define RATE_MCS11					BIT(23)
+#define RATE_MCS12					BIT(24)
+#define RATE_MCS13					BIT(25)
+#define RATE_MCS14					BIT(26)
+#define RATE_MCS15					BIT(27)
+
+// ALL CCK Rate
+#define	RATE_ALL_CCK				RATR_1M|RATR_2M|RATR_55M|RATR_11M
+#define	RATE_ALL_OFDM_AG			RATR_6M|RATR_9M|RATR_12M|RATR_18M|RATR_24M|\
+									RATR_36M|RATR_48M|RATR_54M
+#define	RATE_ALL_OFDM_1SS			RATR_MCS0|RATR_MCS1|RATR_MCS2|RATR_MCS3 |\
+									RATR_MCS4|RATR_MCS5|RATR_MCS6	|RATR_MCS7
+#define	RATE_ALL_OFDM_2SS			RATR_MCS8|RATR_MCS9	|RATR_MCS10|RATR_MCS11|\
+									RATR_MCS12|RATR_MCS13|RATR_MCS14|RATR_MCS15
+
+/*------------------------------ Tx Desc definition Macro ------------------------*/
+//#pragma mark -- Tx Desc related definition. --
+//----------------------------------------------------------------------------
+//-----------------------------------------------------------
+//	Rate
+//-----------------------------------------------------------
+// CCK Rates, TxHT = 0
+#define DESC_RATE1M				0x00
+#define DESC_RATE2M				0x01
+#define DESC_RATE5_5M				0x02
+#define DESC_RATE11M				0x03
+
+// OFDM Rates, TxHT = 0
+#define DESC_RATE6M				0x04
+#define DESC_RATE9M				0x05
+#define DESC_RATE12M				0x06
+#define DESC_RATE18M				0x07
+#define DESC_RATE24M				0x08
+#define DESC_RATE36M				0x09
+#define DESC_RATE48M				0x0a
+#define DESC_RATE54M				0x0b
+
+// MCS Rates, TxHT = 1
+#define DESC_RATEMCS0				0x0c
+#define DESC_RATEMCS1				0x0d
+#define DESC_RATEMCS2				0x0e
+#define DESC_RATEMCS3				0x0f
+#define DESC_RATEMCS4				0x10
+#define DESC_RATEMCS5				0x11
+#define DESC_RATEMCS6				0x12
+#define DESC_RATEMCS7				0x13
+#define DESC_RATEMCS8				0x14
+#define DESC_RATEMCS9				0x15
+#define DESC_RATEMCS10				0x16
+#define DESC_RATEMCS11				0x17
+#define DESC_RATEMCS12				0x18
+#define DESC_RATEMCS13				0x19
+#define DESC_RATEMCS14				0x1a
+#define DESC_RATEMCS15				0x1b
+#define DESC_RATEMCS15_SG			0x1c
+#define DESC_RATEMCS32				0x20
+
+//============================================================
+// Global var
+//============================================================
+#define	OFDM_TABLE_SIZE_92C 	37
+#define	OFDM_TABLE_SIZE_92D 	43
+#define	CCK_TABLE_SIZE		33
+
+extern u32 OFDMSwingTable[OFDM_TABLE_SIZE_92D] ;
+
+extern u8 CCKSwingTable_Ch1_Ch13[CCK_TABLE_SIZE][8];
+
+extern u8 CCKSwingTable_Ch14 [CCK_TABLE_SIZE][8];
+
+#ifdef CONFIG_CHIP_VER_INTEGRATION
+void dump_chip_info(HAL_VERSION	ChipVersion);
+#endif
+
+u8	//return the final channel plan decision
+hal_com_get_channel_plan(
+	IN	PADAPTER	padapter,
+	IN	u8			hw_channel_plan,	//channel plan from HW (efuse/eeprom)
+	IN	u8			sw_channel_plan,	//channel plan from SW (registry/module param)
+	IN	u8			def_channel_plan,	//channel plan used when the former two is invalid
+	IN	BOOLEAN		AutoLoadFail
+	);
+
+void	HalSetBrateCfg(
+	IN PADAPTER		Adapter,
+	IN u8			*mBratesOS,
+	OUT u16			*pBrateCfg);
+
+u8	MRateToHwRate(u8 rate);
+
+void hal_init_macaddr(_adapter *adapter);
+
+void c2h_evt_clear(_adapter *adapter);
+s32 c2h_evt_read(_adapter *adapter, u8 *buf);
+
+#endif //__HAL_COMMON_H__
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/hal_intf.h b/drivers/net/wireless/realtek/rtl8192cu/include/hal_intf.h
new file mode 100644
index 000000000000..cac4408c2e89
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/hal_intf.h
@@ -0,0 +1,431 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __HAL_INTF_H__
+#define __HAL_INTF_H__
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#ifdef CONFIG_PCI_HCI
+#include <pci_hal.h>
+#endif
+
+
+enum RTL871X_HCI_TYPE {
+
+	RTW_SDIO,
+	RTW_USB,
+	RTW_PCIE
+};
+
+enum _CHIP_TYPE {
+
+	NULL_CHIP_TYPE,
+	RTL8712_8188S_8191S_8192S,
+	RTL8188C_8192C,
+	RTL8192D,
+	RTL8723A,
+	RTL8188E,
+	MAX_CHIP_TYPE
+};
+
+
+typedef enum _HW_VARIABLES{
+	HW_VAR_MEDIA_STATUS,
+	HW_VAR_MEDIA_STATUS1,
+	HW_VAR_SET_OPMODE,
+	HW_VAR_MAC_ADDR,
+	HW_VAR_BSSID,
+	HW_VAR_INIT_RTS_RATE,
+	HW_VAR_INIT_DATA_RATE,
+	HW_VAR_BASIC_RATE,
+	HW_VAR_TXPAUSE,
+	HW_VAR_BCN_FUNC,
+	HW_VAR_CORRECT_TSF,
+	HW_VAR_CHECK_BSSID,
+	HW_VAR_MLME_DISCONNECT,
+	HW_VAR_MLME_SITESURVEY,
+	HW_VAR_MLME_JOIN,
+	HW_VAR_ON_RCR_AM,
+	HW_VAR_OFF_RCR_AM,
+	HW_VAR_BEACON_INTERVAL,
+	HW_VAR_SLOT_TIME,
+	HW_VAR_RESP_SIFS,
+	HW_VAR_ACK_PREAMBLE,
+	HW_VAR_SEC_CFG,
+	HW_VAR_BCN_VALID,
+	HW_VAR_RF_TYPE,
+	HW_VAR_DM_FLAG,
+	HW_VAR_DM_FUNC_OP,
+	HW_VAR_DM_FUNC_SET,
+	HW_VAR_DM_FUNC_CLR,
+	HW_VAR_DM_INIT_PWDB,
+	HW_VAR_CAM_EMPTY_ENTRY,
+	HW_VAR_CAM_INVALID_ALL,
+	HW_VAR_CAM_WRITE,
+	HW_VAR_CAM_READ,
+	HW_VAR_AC_PARAM_VO,
+	HW_VAR_AC_PARAM_VI,
+	HW_VAR_AC_PARAM_BE,
+	HW_VAR_AC_PARAM_BK,
+	HW_VAR_ACM_CTRL,
+	HW_VAR_AMPDU_MIN_SPACE,
+	HW_VAR_AMPDU_FACTOR,
+	HW_VAR_RXDMA_AGG_PG_TH,
+	HW_VAR_SET_RPWM,
+	HW_VAR_H2C_FW_PWRMODE,
+	HW_VAR_H2C_FW_JOINBSSRPT,
+	HW_VAR_FWLPS_RF_ON,
+	HW_VAR_H2C_FW_P2P_PS_OFFLOAD,
+	HW_VAR_TDLS_WRCR,
+	HW_VAR_TDLS_INIT_CH_SEN,
+	HW_VAR_TDLS_RS_RCR,
+	HW_VAR_TDLS_DONE_CH_SEN,
+	HW_VAR_INITIAL_GAIN,
+	HW_VAR_TRIGGER_GPIO_0,
+	HW_VAR_BT_SET_COEXIST,
+	HW_VAR_BT_ISSUE_DELBA,
+	HW_VAR_CURRENT_ANTENNA,
+	HW_VAR_ANTENNA_DIVERSITY_LINK,
+	HW_VAR_ANTENNA_DIVERSITY_SELECT,
+	HW_VAR_SWITCH_EPHY_WoWLAN,
+	HW_VAR_EFUSE_BYTES,
+	HW_VAR_FIFO_CLEARN_UP,
+	HW_VAR_CHECK_TXBUF,
+	HW_VAR_APFM_ON_MAC, //Auto FSM to Turn On, include clock, isolation, power control for MAC only
+	HW_VAR_WOWLAN,
+	HW_VAR_VID,
+	HW_VAR_PID,
+	HW_VAR_MBSSID_CAM_WRITE,
+	HW_VAR_MBSSID_CAM_CLEAR,
+	HW_VAR_RCR_MBSSID_EN,
+	HW_VAR_USB_RXAGG_PAGE_TO,
+}HW_VARIABLES;
+
+typedef enum _HAL_DEF_VARIABLE{
+	HAL_DEF_UNDERCORATEDSMOOTHEDPWDB,
+	HAL_DEF_IS_SUPPORT_ANT_DIV,
+	HAL_DEF_CURRENT_ANTENNA,
+	HAL_DEF_DRVINFO_SZ,
+	HAL_DEF_MAX_RECVBUF_SZ,
+	HAL_DEF_RX_PACKET_OFFSET,
+	HAL_DEF_DBG_DUMP_RXPKT,//for dbg
+	HAL_DEF_DBG_DM_FUNC,//for dbg
+	HAL_DEF_DUAL_MAC_MODE,
+}HAL_DEF_VARIABLE;
+
+typedef enum _HAL_INTF_PS_FUNC{
+	HAL_USB_SELECT_SUSPEND,
+	HAL_MAX_ID,
+}HAL_INTF_PS_FUNC;
+
+typedef s32 (*c2h_id_filter)(u8 id);
+
+struct hal_ops {
+	u32	(*hal_init)(PADAPTER Adapter);
+	u32	(*hal_deinit)(PADAPTER Adapter);
+
+	void	(*free_hal_data)(PADAPTER Adapter);
+
+	u32	(*inirp_init)(PADAPTER Adapter);
+	u32	(*inirp_deinit)(PADAPTER Adapter);
+
+	s32	(*init_xmit_priv)(PADAPTER Adapter);
+	void	(*free_xmit_priv)(PADAPTER Adapter);
+
+	s32	(*init_recv_priv)(PADAPTER Adapter);
+	void	(*free_recv_priv)(PADAPTER Adapter);
+
+	void	(*InitSwLeds)(PADAPTER Adapter);
+	void	(*DeInitSwLeds)(PADAPTER Adapter);
+
+	void	(*dm_init)(PADAPTER Adapter);
+	void	(*dm_deinit)(PADAPTER Adapter);
+	void	(*read_chip_version)(PADAPTER Adapter);
+
+	void	(*init_default_value)(PADAPTER Adapter);
+
+	void	(*intf_chip_configure)(PADAPTER Adapter);
+
+	void	(*read_adapter_info)(PADAPTER Adapter);
+
+	void	(*enable_interrupt)(PADAPTER Adapter);
+	void	(*disable_interrupt)(PADAPTER Adapter);
+	s32	(*interrupt_handler)(PADAPTER Adapter);
+
+	void	(*set_bwmode_handler)(PADAPTER Adapter, HT_CHANNEL_WIDTH Bandwidth, u8 Offset);
+	void	(*set_channel_handler)(PADAPTER Adapter, u8 channel);
+
+	void	(*hal_dm_watchdog)(PADAPTER Adapter);
+
+	void	(*SetHwRegHandler)(PADAPTER Adapter, u8	variable,u8* val);
+	void	(*GetHwRegHandler)(PADAPTER Adapter, u8	variable,u8* val);
+
+	u8	(*GetHalDefVarHandler)(PADAPTER Adapter, HAL_DEF_VARIABLE eVariable, PVOID pValue);
+	u8	(*SetHalDefVarHandler)(PADAPTER Adapter, HAL_DEF_VARIABLE eVariable, PVOID pValue);
+
+	void	(*UpdateRAMaskHandler)(PADAPTER Adapter, u32 mac_id);
+	void	(*SetBeaconRelatedRegistersHandler)(PADAPTER Adapter);
+
+	void	(*Add_RateATid)(PADAPTER Adapter, u32 bitmap, u8 arg);
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+	u8	(*AntDivBeforeLinkHandler)(PADAPTER Adapter);
+	void	(*AntDivCompareHandler)(PADAPTER Adapter, WLAN_BSSID_EX *dst, WLAN_BSSID_EX *src);
+#endif
+	u8	(*interface_ps_func)(PADAPTER Adapter,HAL_INTF_PS_FUNC efunc_id, u8* val);
+
+	s32	(*hal_xmit)(PADAPTER Adapter, struct xmit_frame *pxmitframe);
+	s32	(*mgnt_xmit)(PADAPTER Adapter, struct xmit_frame *pmgntframe);
+        s32	(*hal_xmitframe_enqueue)(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+	u32	(*read_bbreg)(PADAPTER Adapter, u32 RegAddr, u32 BitMask);
+	void	(*write_bbreg)(PADAPTER Adapter, u32 RegAddr, u32 BitMask, u32 Data);
+	u32	(*read_rfreg)(PADAPTER Adapter, u32 eRFPath, u32 RegAddr, u32 BitMask);
+	void	(*write_rfreg)(PADAPTER Adapter, u32 eRFPath, u32 RegAddr, u32 BitMask, u32 Data);
+
+#ifdef CONFIG_HOSTAPD_MLME
+	s32	(*hostap_mgnt_xmit_entry)(PADAPTER Adapter, _pkt *pkt);
+#endif
+	void (*EfusePowerSwitch)(PADAPTER pAdapter, u8 bWrite, u8 PwrState);
+	void (*ReadEFuse)(PADAPTER Adapter, u8 efuseType, u16 _offset, u16 _size_byte, u8 *pbuf, BOOLEAN bPseudoTest);
+	void (*EFUSEGetEfuseDefinition)(PADAPTER pAdapter, u8 efuseType, u8 type, PVOID *pOut, BOOLEAN bPseudoTest);
+	u16	(*EfuseGetCurrentSize)(PADAPTER pAdapter, u8 efuseType, BOOLEAN bPseudoTest);
+	int 	(*Efuse_PgPacketRead)(PADAPTER pAdapter, u8 offset, u8 *data, BOOLEAN bPseudoTest);
+	int 	(*Efuse_PgPacketWrite)(PADAPTER pAdapter, u8 offset, u8 word_en, u8 *data, BOOLEAN bPseudoTest);
+	u8	(*Efuse_WordEnableDataWrite)(PADAPTER pAdapter, u16 efuse_addr, u8 word_en, u8 *data, BOOLEAN bPseudoTest);
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+	void (*sreset_init_value)(_adapter *padapter);
+	void (*sreset_reset_value)(_adapter *padapter);
+	void (*silentreset)(_adapter *padapter);
+	void (*sreset_xmit_status_check)(_adapter *padapter);
+	void (*sreset_linked_status_check) (_adapter *padapter);
+	u8 (*sreset_get_wifi_status)(_adapter *padapter);
+	bool (*sreset_inprogress)(_adapter *padapter);
+#endif
+
+#ifdef CONFIG_IOL
+	int (*IOL_exec_cmds_sync)(ADAPTER *adapter, struct xmit_frame *xmit_frame, u32 max_wating_ms);
+#endif
+	void (*hal_notch_filter)(_adapter * adapter, bool enable);
+	void (*hal_reset_security_engine)(_adapter * adapter);
+
+	s32 (*c2h_handler)(_adapter *padapter, struct c2h_evt_hdr *c2h_evt);
+	c2h_id_filter c2h_id_filter_ccx;
+};
+
+typedef	enum _RT_EEPROM_TYPE{
+	EEPROM_93C46,
+	EEPROM_93C56,
+	EEPROM_BOOT_EFUSE,
+}RT_EEPROM_TYPE,*PRT_EEPROM_TYPE;
+
+#define USB_HIGH_SPEED_BULK_SIZE	512
+#define USB_FULL_SPEED_BULK_SIZE	64
+
+#define RF_CHANGE_BY_INIT	0
+#define RF_CHANGE_BY_IPS 	BIT28
+#define RF_CHANGE_BY_PS 	BIT29
+#define RF_CHANGE_BY_HW 	BIT30
+#define RF_CHANGE_BY_SW 	BIT31
+
+typedef enum _HARDWARE_TYPE{
+	HARDWARE_TYPE_RTL8180,
+	HARDWARE_TYPE_RTL8185,
+	HARDWARE_TYPE_RTL8187,
+	HARDWARE_TYPE_RTL8188,
+	HARDWARE_TYPE_RTL8190P,
+	HARDWARE_TYPE_RTL8192E,
+	HARDWARE_TYPE_RTL819xU,
+	HARDWARE_TYPE_RTL8192SE,
+	HARDWARE_TYPE_RTL8192SU,
+	HARDWARE_TYPE_RTL8192CE,
+	HARDWARE_TYPE_RTL8192CU,
+	HARDWARE_TYPE_RTL8192DE,
+	HARDWARE_TYPE_RTL8192DU,
+	HARDWARE_TYPE_RTL8723AE,
+	HARDWARE_TYPE_RTL8723AU,
+	HARDWARE_TYPE_RTL8723AS,
+	HARDWARE_TYPE_RTL8188EE,
+	HARDWARE_TYPE_RTL8188EU,
+	HARDWARE_TYPE_RTL8188ES,
+	HARDWARE_TYPE_MAX,
+}HARDWARE_TYPE;
+
+//
+// RTL8192C Series
+//
+#define IS_HARDWARE_TYPE_8192CE(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8192CE)
+#define IS_HARDWARE_TYPE_8192CU(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8192CU)
+#define	IS_HARDWARE_TYPE_8192C(_Adapter)			\
+(IS_HARDWARE_TYPE_8192CE(_Adapter) || IS_HARDWARE_TYPE_8192CU(_Adapter))
+
+//
+// RTL8192D Series
+//
+#define IS_HARDWARE_TYPE_8192DE(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8192DE)
+#define IS_HARDWARE_TYPE_8192DU(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8192DU)
+#define	IS_HARDWARE_TYPE_8192D(_Adapter)			\
+(IS_HARDWARE_TYPE_8192DE(_Adapter) || IS_HARDWARE_TYPE_8192DU(_Adapter))
+
+//
+// RTL8723A Series
+//
+#define IS_HARDWARE_TYPE_8723AE(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8723AE)
+#define IS_HARDWARE_TYPE_8723AU(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8723AU)
+#define IS_HARDWARE_TYPE_8723AS(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8723AS)
+#define	IS_HARDWARE_TYPE_8723A(_Adapter)	\
+(IS_HARDWARE_TYPE_8723AE(_Adapter) || IS_HARDWARE_TYPE_8723AU(_Adapter) || IS_HARDWARE_TYPE_8723AS(_Adapter))
+
+//
+// RTL8188E Series
+//
+#define IS_HARDWARE_TYPE_8188EE(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8188EE)
+#define IS_HARDWARE_TYPE_8188EU(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8188EU)
+#define IS_HARDWARE_TYPE_8188ES(_Adapter)	(((PADAPTER)_Adapter)->HardwareType==HARDWARE_TYPE_RTL8188ES)
+#define	IS_HARDWARE_TYPE_8188E(_Adapter)	\
+(IS_HARDWARE_TYPE_8188EE(_Adapter) || IS_HARDWARE_TYPE_8188EU(_Adapter) || IS_HARDWARE_TYPE_8188ES(_Adapter))
+
+
+typedef struct eeprom_priv EEPROM_EFUSE_PRIV, *PEEPROM_EFUSE_PRIV;
+#define GET_EEPROM_EFUSE_PRIV(priv)	(&priv->eeprompriv)
+
+#ifdef CONFIG_WOWLAN
+typedef enum _wowlan_subcode{
+	WOWLAN_PATTERN_MATCH = 1,
+	WOWLAN_MAGIC_PACKET  = 2,
+	WOWLAN_UNICAST       = 3,
+	WOWLAN_SET_PATTERN   = 4,
+	WOWLAN_DUMP_REG      = 5,
+	WOWLAN_ENABLE        = 6,
+	WOWLAN_DISABLE       = 7,
+	WOWLAN_STATUS		= 8,
+	WOWLAN_DEBUG_RELOAD_FW	= 9,
+	WOWLAN_DEBUG_1		=10,
+	WOWLAN_DEBUG_2		=11
+}wowlan_subcode;
+
+struct wowlan_ioctl_param{
+	unsigned int subcode;
+	unsigned int subcode_value;
+	unsigned int wakeup_reason;
+	unsigned int len;
+	unsigned char pattern[0];
+};
+
+#define Rx_Pairwisekey			BIT(0)
+#define Rx_GTK					BIT(1)
+#define Rx_DisAssoc				BIT(2)
+#define Rx_DeAuth				BIT(3)
+#define FWDecisionDisconnect	BIT(4)
+#define Rx_MagicPkt				BIT(5)
+#define FinishBtFwPatch			BIT(7)
+
+#endif // CONFIG_WOWLAN
+
+void rtw_hal_def_value_init(_adapter *padapter);
+void rtw_hal_free_data(_adapter *padapter);
+
+void rtw_hal_dm_init(_adapter *padapter);
+void rtw_hal_dm_deinit(_adapter *padapter);
+void rtw_hal_sw_led_init(_adapter *padapter);
+void rtw_hal_sw_led_deinit(_adapter *padapter);
+
+uint rtw_hal_init(_adapter *padapter);
+uint rtw_hal_deinit(_adapter *padapter);
+void rtw_hal_stop(_adapter *padapter);
+
+void rtw_hal_set_hwreg(PADAPTER padapter, u8 variable, u8 *val);
+void rtw_hal_get_hwreg(PADAPTER padapter, u8 variable, u8 *val);
+
+void rtw_hal_chip_configure(_adapter *padapter);
+void rtw_hal_read_chip_info(_adapter *padapter);
+void rtw_hal_read_chip_version(_adapter *padapter);
+
+u8 rtw_hal_set_def_var(_adapter *padapter, HAL_DEF_VARIABLE eVariable, PVOID pValue);
+u8 rtw_hal_get_def_var(_adapter *padapter, HAL_DEF_VARIABLE eVariable, PVOID pValue);
+
+void rtw_hal_enable_interrupt(_adapter *padapter);
+void rtw_hal_disable_interrupt(_adapter *padapter);
+
+u32 rtw_hal_inirp_init(_adapter *padapter);
+u32 rtw_hal_inirp_deinit(_adapter *padapter);
+
+u8 rtw_hal_intf_ps_func(_adapter *padapter,HAL_INTF_PS_FUNC efunc_id, u8* val);
+
+s32	rtw_hal_xmitframe_enqueue(_adapter *padapter, struct xmit_frame *pxmitframe);
+s32 rtw_hal_xmit(_adapter *padapter, struct xmit_frame *pxmitframe);
+s32 rtw_hal_mgnt_xmit(_adapter *padapter, struct xmit_frame *pmgntframe);
+
+s32 rtw_hal_init_xmit_priv(_adapter *padapter);
+void rtw_hal_free_xmit_priv(_adapter *padapter);
+
+s32 rtw_hal_init_recv_priv(_adapter *padapter);
+void rtw_hal_free_recv_priv(_adapter *padapter);
+
+void rtw_hal_update_ra_mask(_adapter *padapter, u32 mac_id);
+void rtw_hal_add_ra_tid(_adapter *padapter, u32 bitmap, u8 arg);
+
+void rtw_hal_bcn_related_reg_setting(_adapter *padapter);
+
+u32 rtw_hal_read_bbreg(_adapter *padapter, u32 RegAddr, u32 BitMask);
+void rtw_hal_write_bbreg(_adapter *padapter, u32 RegAddr, u32 BitMask, u32 Data);
+u32 rtw_hal_read_rfreg(_adapter *padapter, u32 eRFPath, u32 RegAddr, u32 BitMask);
+void rtw_hal_write_rfreg(_adapter *padapter, u32 eRFPath, u32 RegAddr, u32 BitMask, u32 Data);
+
+s32 rtw_hal_interrupt_handler(_adapter *padapter);
+
+void rtw_hal_set_bwmode(_adapter *padapter, HT_CHANNEL_WIDTH Bandwidth, u8 Offset);
+void rtw_hal_set_chan(_adapter *padapter, u8 channel);
+
+void rtw_hal_dm_watchdog(_adapter *padapter);
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+u8 rtw_hal_antdiv_before_linked(_adapter *padapter);
+void rtw_hal_antdiv_rssi_compared(_adapter *padapter, WLAN_BSSID_EX *dst, WLAN_BSSID_EX *src);
+#endif
+
+#ifdef CONFIG_HOSTAPD_MLME
+s32 rtw_hal_hostap_mgnt_xmit_entry(_adapter *padapter, _pkt *pkt);
+#endif
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+void rtw_hal_sreset_init(_adapter *padapter);
+void rtw_hal_sreset_reset(_adapter *padapter);
+void rtw_hal_sreset_reset_value(_adapter *padapter);
+void rtw_hal_sreset_xmit_status_check(_adapter *padapter);
+void rtw_hal_sreset_linked_status_check(_adapter *padapter);
+u8 rtw_hal_sreset_get_wifi_status(_adapter *padapter);
+bool rtw_hal_sreset_inprogress(_adapter *padapter);
+#endif
+
+#ifdef CONFIG_IOL
+int rtw_hal_iol_cmd(ADAPTER *adapter, struct xmit_frame *xmit_frame, u32 max_wating_ms);
+#endif
+
+void rtw_hal_notch_filter(_adapter * adapter, bool enable);
+void rtw_hal_reset_security_engine(_adapter * adapter);
+
+s32 rtw_hal_c2h_handler(_adapter *adapter, struct c2h_evt_hdr *c2h_evt);
+c2h_id_filter rtw_hal_c2h_id_filter_ccx(_adapter *adapter);
+
+#endif //__HAL_INTF_H__
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/ieee80211.h b/drivers/net/wireless/realtek/rtl8192cu/include/ieee80211.h
new file mode 100644
index 000000000000..b3735bd4e38d
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/ieee80211.h
@@ -0,0 +1,1579 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __IEEE80211_H
+#define __IEEE80211_H
+
+
+#ifndef CONFIG_RTL8711FW
+
+	#include <drv_conf.h>
+	#include <osdep_service.h>
+	#include <drv_types.h>
+	#include "wifi.h"
+
+	#if defined PLATFORM_OS_XP
+	#include <ntstrsafe.h>
+	#endif
+	#if defined PLATFORM_LINUX
+	#include <linux/wireless.h>
+	#endif
+#else
+
+	#include <list.h>
+
+#endif
+
+#define MGMT_QUEUE_NUM 5
+
+#define ETH_ALEN	6
+#define ETH_TYPE_LEN		2
+#define PAYLOAD_TYPE_LEN	1
+
+#ifdef CONFIG_AP_MODE
+
+#define RTL_IOCTL_HOSTAPD (SIOCIWFIRSTPRIV + 28)
+
+/* RTL871X_IOCTL_HOSTAPD ioctl() cmd: */
+enum {
+	RTL871X_HOSTAPD_FLUSH = 1,
+	RTL871X_HOSTAPD_ADD_STA = 2,
+	RTL871X_HOSTAPD_REMOVE_STA = 3,
+	RTL871X_HOSTAPD_GET_INFO_STA = 4,
+	/* REMOVED: PRISM2_HOSTAPD_RESET_TXEXC_STA = 5, */
+	RTL871X_HOSTAPD_GET_WPAIE_STA = 5,
+	RTL871X_SET_ENCRYPTION = 6,
+	RTL871X_GET_ENCRYPTION = 7,
+	RTL871X_HOSTAPD_SET_FLAGS_STA = 8,
+	RTL871X_HOSTAPD_GET_RID = 9,
+	RTL871X_HOSTAPD_SET_RID = 10,
+	RTL871X_HOSTAPD_SET_ASSOC_AP_ADDR = 11,
+	RTL871X_HOSTAPD_SET_GENERIC_ELEMENT = 12,
+	RTL871X_HOSTAPD_MLME = 13,
+	RTL871X_HOSTAPD_SCAN_REQ = 14,
+	RTL871X_HOSTAPD_STA_CLEAR_STATS = 15,
+	RTL871X_HOSTAPD_SET_BEACON=16,
+	RTL871X_HOSTAPD_SET_WPS_BEACON = 17,
+	RTL871X_HOSTAPD_SET_WPS_PROBE_RESP = 18,
+	RTL871X_HOSTAPD_SET_WPS_ASSOC_RESP = 19,
+	RTL871X_HOSTAPD_SET_HIDDEN_SSID = 20,
+	RTL871X_HOSTAPD_SET_MACADDR_ACL = 21,
+	RTL871X_HOSTAPD_ACL_ADD_STA = 22,
+	RTL871X_HOSTAPD_ACL_REMOVE_STA = 23,
+};
+
+/* STA flags */
+#define WLAN_STA_AUTH BIT(0)
+#define WLAN_STA_ASSOC BIT(1)
+#define WLAN_STA_PS BIT(2)
+#define WLAN_STA_TIM BIT(3)
+#define WLAN_STA_PERM BIT(4)
+#define WLAN_STA_AUTHORIZED BIT(5)
+#define WLAN_STA_PENDING_POLL BIT(6) /* pending activity poll not ACKed */
+#define WLAN_STA_SHORT_PREAMBLE BIT(7)
+#define WLAN_STA_PREAUTH BIT(8)
+#define WLAN_STA_WME BIT(9)
+#define WLAN_STA_MFP BIT(10)
+#define WLAN_STA_HT BIT(11)
+#define WLAN_STA_WPS BIT(12)
+#define WLAN_STA_MAYBE_WPS BIT(13)
+#define WLAN_STA_NONERP BIT(31)
+
+#endif
+
+#define IEEE_CMD_SET_WPA_PARAM			1
+#define IEEE_CMD_SET_WPA_IE				2
+#define IEEE_CMD_SET_ENCRYPTION			3
+#define IEEE_CMD_MLME						4
+
+#define IEEE_PARAM_WPA_ENABLED				1
+#define IEEE_PARAM_TKIP_COUNTERMEASURES		2
+#define IEEE_PARAM_DROP_UNENCRYPTED			3
+#define IEEE_PARAM_PRIVACY_INVOKED			4
+#define IEEE_PARAM_AUTH_ALGS					5
+#define IEEE_PARAM_IEEE_802_1X				6
+#define IEEE_PARAM_WPAX_SELECT				7
+
+#define AUTH_ALG_OPEN_SYSTEM			0x1
+#define AUTH_ALG_SHARED_KEY			0x2
+#define AUTH_ALG_LEAP				0x00000004
+
+#define IEEE_MLME_STA_DEAUTH				1
+#define IEEE_MLME_STA_DISASSOC			2
+
+#define IEEE_CRYPT_ERR_UNKNOWN_ALG			2
+#define IEEE_CRYPT_ERR_UNKNOWN_ADDR			3
+#define IEEE_CRYPT_ERR_CRYPT_INIT_FAILED		4
+#define IEEE_CRYPT_ERR_KEY_SET_FAILED			5
+#define IEEE_CRYPT_ERR_TX_KEY_SET_FAILED		6
+#define IEEE_CRYPT_ERR_CARD_CONF_FAILED		7
+
+
+#define	IEEE_CRYPT_ALG_NAME_LEN			16
+
+#define WPA_CIPHER_NONE 	BIT(0)
+#define WPA_CIPHER_WEP40 	BIT(1)
+#define WPA_CIPHER_WEP104 BIT(2)
+#define WPA_CIPHER_TKIP 	BIT(3)
+#define WPA_CIPHER_CCMP 	BIT(4)
+
+
+
+#define WPA_SELECTOR_LEN 4
+extern u8 RTW_WPA_OUI_TYPE[] ;
+extern u16 RTW_WPA_VERSION ;
+extern u8 WPA_AUTH_KEY_MGMT_NONE[];
+extern u8 WPA_AUTH_KEY_MGMT_UNSPEC_802_1X[];
+extern u8 WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X[];
+extern u8 WPA_CIPHER_SUITE_NONE[];
+extern u8 WPA_CIPHER_SUITE_WEP40[];
+extern u8 WPA_CIPHER_SUITE_TKIP[];
+extern u8 WPA_CIPHER_SUITE_WRAP[];
+extern u8 WPA_CIPHER_SUITE_CCMP[];
+extern u8 WPA_CIPHER_SUITE_WEP104[];
+
+
+#define RSN_HEADER_LEN 4
+#define RSN_SELECTOR_LEN 4
+
+extern u16 RSN_VERSION_BSD;
+extern u8 RSN_AUTH_KEY_MGMT_UNSPEC_802_1X[];
+extern u8 RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X[];
+extern u8 RSN_CIPHER_SUITE_NONE[];
+extern u8 RSN_CIPHER_SUITE_WEP40[];
+extern u8 RSN_CIPHER_SUITE_TKIP[];
+extern u8 RSN_CIPHER_SUITE_WRAP[];
+extern u8 RSN_CIPHER_SUITE_CCMP[];
+extern u8 RSN_CIPHER_SUITE_WEP104[];
+
+typedef enum _RATR_TABLE_MODE{
+	RATR_INX_WIRELESS_NGB = 0,	// BGN 40 Mhz 2SS 1SS
+	RATR_INX_WIRELESS_NG = 1,		// GN or N
+	RATR_INX_WIRELESS_NB = 2,		// BGN 20 Mhz 2SS 1SS  or BN
+	RATR_INX_WIRELESS_N = 3,
+	RATR_INX_WIRELESS_GB = 4,
+	RATR_INX_WIRELESS_G = 5,
+	RATR_INX_WIRELESS_B = 6,
+	RATR_INX_WIRELESS_MC = 7,
+	RATR_INX_WIRELESS_AC_N = 8,
+}RATR_TABLE_MODE, *PRATR_TABLE_MODE;
+
+enum NETWORK_TYPE
+{
+    WIRELESS_INVALID = 0,
+    //Sub-Element
+    WIRELESS_11B = BIT(0), // tx: cck only , rx: cck only, hw: cck
+    WIRELESS_11G = BIT(1), // tx: ofdm only, rx: ofdm & cck, hw: cck & ofdm
+    WIRELESS_11A = BIT(2), // tx: ofdm only, rx: ofdm only, hw: ofdm only
+    WIRELESS_11_24N = BIT(3), // tx: MCS only, rx: MCS & cck, hw: MCS & cck
+    WIRELESS_11_5N = BIT(4), // tx: MCS only, rx: MCS & ofdm, hw: ofdm only
+	//WIRELESS_AUTO 	= BIT(5),
+	WIRELESS_AC 		= BIT(6),
+
+    //Combination
+    WIRELESS_11BG = (WIRELESS_11B|WIRELESS_11G), // tx: cck & ofdm, rx: cck & ofdm & MCS, hw: cck & ofdm
+    WIRELESS_11G_24N = (WIRELESS_11G|WIRELESS_11_24N), // tx: ofdm & MCS, rx: ofdm & cck & MCS, hw: cck & ofdm
+    WIRELESS_11A_5N = (WIRELESS_11A|WIRELESS_11_5N), // tx: ofdm & MCS, rx: ofdm & MCS, hw: ofdm only
+    WIRELESS_11BG_24N = (WIRELESS_11B|WIRELESS_11G|WIRELESS_11_24N), // tx: ofdm & cck & MCS, rx: ofdm & cck & MCS, hw: ofdm & cck
+    WIRELESS_11AGN = (WIRELESS_11A|WIRELESS_11G|WIRELESS_11_24N|WIRELESS_11_5N), // tx: ofdm & MCS, rx: ofdm & MCS, hw: ofdm only
+    WIRELESS_11ABGN = (WIRELESS_11A|WIRELESS_11B|WIRELESS_11G|WIRELESS_11_24N|WIRELESS_11_5N),
+};
+
+#define SUPPORTED_24G_NETTYPE_MSK (WIRELESS_11B | WIRELESS_11G | WIRELESS_11_24N)
+#define SUPPORTED_5G_NETTYPE_MSK (WIRELESS_11A | WIRELESS_11_5N)
+
+#define IsSupported24G(NetType) ((NetType) & SUPPORTED_24G_NETTYPE_MSK ? _TRUE : _FALSE)
+#define IsSupported5G(NetType) ((NetType) & SUPPORTED_5G_NETTYPE_MSK ? _TRUE : _FALSE)
+
+#define IsEnableHWCCK(NetType) IsSupported24G(NetType)
+#define IsEnableHWOFDM(NetType) ((NetType) & (WIRELESS_11G|WIRELESS_11_24N|SUPPORTED_5G_NETTYPE_MSK) ? _TRUE : _FALSE)
+
+#define IsSupportedRxCCK(NetType) IsEnableHWCCK(NetType)
+#define IsSupportedRxOFDM(NetType) IsEnableHWOFDM(NetType)
+#define IsSupportedRxMCS(NetType) IsEnableHWOFDM(NetType)
+
+#define IsSupportedTxCCK(NetType) ((NetType) & (WIRELESS_11B) ? _TRUE : _FALSE)
+#define IsSupportedTxOFDM(NetType) ((NetType) & (WIRELESS_11G|WIRELESS_11A) ? _TRUE : _FALSE)
+#define IsSupportedTxMCS(NetType) ((NetType) & (WIRELESS_11_24N|WIRELESS_11_5N) ? _TRUE : _FALSE)
+
+
+typedef struct ieee_param {
+	u32 cmd;
+	u8 sta_addr[ETH_ALEN];
+	union {
+		struct {
+			u8 name;
+			u32 value;
+		} wpa_param;
+		struct {
+			u32 len;
+			u8 reserved[32];
+			u8 data[0];
+		} wpa_ie;
+	        struct{
+			int command;
+			int reason_code;
+		} mlme;
+		struct {
+			u8 alg[IEEE_CRYPT_ALG_NAME_LEN];
+			u8 set_tx;
+			u32 err;
+			u8 idx;
+			u8 seq[8]; /* sequence counter (set: RX, get: TX) */
+			u16 key_len;
+			u8 key[0];
+		} crypt;
+#ifdef CONFIG_AP_MODE
+		struct {
+			u16 aid;
+			u16 capability;
+			int flags;
+			u8 tx_supp_rates[16];
+			struct rtw_ieee80211_ht_cap ht_cap;
+		} add_sta;
+		struct {
+			u8	reserved[2];//for set max_num_sta
+			u8	buf[0];
+		} bcn_ie;
+#endif
+
+	} u;
+}ieee_param;
+
+#ifdef CONFIG_AP_MODE
+typedef struct ieee_param_ex {
+	u32 cmd;
+	u8 sta_addr[ETH_ALEN];
+	u8 data[0];
+}ieee_param_ex;
+
+struct sta_data{
+	u16 aid;
+	u16 capability;
+	int flags;
+	u32 sta_set;
+	u8 tx_supp_rates[16];
+	u32 tx_supp_rates_len;
+	struct rtw_ieee80211_ht_cap ht_cap;
+	u64	rx_pkts;
+	u64	rx_bytes;
+	u64	rx_drops;
+	u64	tx_pkts;
+	u64	tx_bytes;
+	u64	tx_drops;
+};
+#endif
+
+
+#if WIRELESS_EXT < 17
+#define IW_QUAL_QUAL_INVALID   0x10
+#define IW_QUAL_LEVEL_INVALID  0x20
+#define IW_QUAL_NOISE_INVALID  0x40
+#define IW_QUAL_QUAL_UPDATED   0x1
+#define IW_QUAL_LEVEL_UPDATED  0x2
+#define IW_QUAL_NOISE_UPDATED  0x4
+#endif
+
+#define IEEE80211_DATA_LEN		2304
+/* Maximum size for the MA-UNITDATA primitive, 802.11 standard section
+   6.2.1.1.2.
+
+   The figure in section 7.1.2 suggests a body size of up to 2312
+   bytes is allowed, which is a bit confusing, I suspect this
+   represents the 2304 bytes of real data, plus a possible 8 bytes of
+   WEP IV and ICV. (this interpretation suggested by Ramiro Barreiro) */
+
+
+#define IEEE80211_HLEN			30
+#define IEEE80211_FRAME_LEN		(IEEE80211_DATA_LEN + IEEE80211_HLEN)
+
+
+/* this is stolen from ipw2200 driver */
+#define IEEE_IBSS_MAC_HASH_SIZE 31
+
+struct ieee_ibss_seq {
+	u8 mac[ETH_ALEN];
+	u16 seq_num;
+	u16 frag_num;
+	unsigned long packet_time;
+	_list	list;
+};
+
+#if defined(PLATFORM_LINUX) || defined(CONFIG_RTL8711FW)||defined(PLATFORM_FREEBSD)
+
+struct rtw_ieee80211_hdr {
+	u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	u16 seq_ctl;
+	u8 addr4[ETH_ALEN];
+} __attribute__ ((packed));
+
+struct rtw_ieee80211_hdr_3addr {
+	u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	u16 seq_ctl;
+} __attribute__ ((packed));
+
+
+struct rtw_ieee80211_hdr_qos {
+	u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	u16 seq_ctl;
+	u8 addr4[ETH_ALEN];
+	u16	qc;
+}  __attribute__ ((packed));
+
+struct rtw_ieee80211_hdr_3addr_qos {
+        u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	u16 seq_ctl;
+       u16     qc;
+}  __attribute__ ((packed));
+
+struct eapol {
+	u8 snap[6];
+	u16 ethertype;
+	u8 version;
+	u8 type;
+	u16 length;
+} __attribute__ ((packed));
+
+#endif
+
+
+
+#ifdef PLATFORM_WINDOWS
+
+#pragma pack(1)
+struct rtw_ieee80211_hdr {
+	u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	u16 seq_ctl;
+	u8 addr4[ETH_ALEN];
+};
+
+struct rtw_ieee80211_hdr_3addr {
+	u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	u16 seq_ctl;
+};
+
+
+struct rtw_ieee80211_hdr_qos {
+	struct rtw_ieee80211_hdr wlan_hdr;
+	u16	qc;
+};
+
+struct rtw_ieee80211_hdr_3addr_qos {
+        struct  rtw_ieee80211_hdr_3addr wlan_hdr;
+        u16     qc;
+};
+
+struct eapol {
+	u8 snap[6];
+	u16 ethertype;
+	u8 version;
+	u8 type;
+	u16 length;
+};
+#pragma pack()
+
+#endif
+
+
+
+enum eap_type {
+	EAP_PACKET = 0,
+	EAPOL_START,
+	EAPOL_LOGOFF,
+	EAPOL_KEY,
+	EAPOL_ENCAP_ASF_ALERT
+};
+
+#define IEEE80211_3ADDR_LEN 24
+#define IEEE80211_4ADDR_LEN 30
+#define IEEE80211_FCS_LEN    4
+
+#define MIN_FRAG_THRESHOLD     256U
+#define	MAX_FRAG_THRESHOLD     2346U
+
+/* Frame control field constants */
+#define RTW_IEEE80211_FCTL_VERS		0x0003
+#define RTW_IEEE80211_FCTL_FTYPE		0x000c
+#define RTW_IEEE80211_FCTL_STYPE		0x00f0
+#define RTW_IEEE80211_FCTL_TODS		0x0100
+#define RTW_IEEE80211_FCTL_FROMDS	0x0200
+#define RTW_IEEE80211_FCTL_MOREFRAGS	0x0400
+#define RTW_IEEE80211_FCTL_RETRY		0x0800
+#define RTW_IEEE80211_FCTL_PM		0x1000
+#define RTW_IEEE80211_FCTL_MOREDATA	0x2000
+#define RTW_IEEE80211_FCTL_PROTECTED	0x4000
+#define RTW_IEEE80211_FCTL_ORDER		0x8000
+#define RTW_IEEE80211_FCTL_CTL_EXT	0x0f00
+
+#define RTW_IEEE80211_FTYPE_MGMT		0x0000
+#define RTW_IEEE80211_FTYPE_CTL		0x0004
+#define RTW_IEEE80211_FTYPE_DATA		0x0008
+#define RTW_IEEE80211_FTYPE_EXT		0x000c
+
+/* management */
+#define RTW_IEEE80211_STYPE_ASSOC_REQ	0x0000
+#define RTW_IEEE80211_STYPE_ASSOC_RESP 	0x0010
+#define RTW_IEEE80211_STYPE_REASSOC_REQ	0x0020
+#define RTW_IEEE80211_STYPE_REASSOC_RESP	0x0030
+#define RTW_IEEE80211_STYPE_PROBE_REQ	0x0040
+#define RTW_IEEE80211_STYPE_PROBE_RESP	0x0050
+#define RTW_IEEE80211_STYPE_BEACON		0x0080
+#define RTW_IEEE80211_STYPE_ATIM		0x0090
+#define RTW_IEEE80211_STYPE_DISASSOC	0x00A0
+#define RTW_IEEE80211_STYPE_AUTH		0x00B0
+#define RTW_IEEE80211_STYPE_DEAUTH		0x00C0
+#define RTW_IEEE80211_STYPE_ACTION		0x00D0
+
+/* control */
+#define RTW_IEEE80211_STYPE_CTL_EXT		0x0060
+#define RTW_IEEE80211_STYPE_BACK_REQ		0x0080
+#define RTW_IEEE80211_STYPE_BACK		0x0090
+#define RTW_IEEE80211_STYPE_PSPOLL		0x00A0
+#define RTW_IEEE80211_STYPE_RTS		0x00B0
+#define RTW_IEEE80211_STYPE_CTS		0x00C0
+#define RTW_IEEE80211_STYPE_ACK		0x00D0
+#define RTW_IEEE80211_STYPE_CFEND		0x00E0
+#define RTW_IEEE80211_STYPE_CFENDACK		0x00F0
+
+/* data */
+#define RTW_IEEE80211_STYPE_DATA		0x0000
+#define RTW_IEEE80211_STYPE_DATA_CFACK	0x0010
+#define RTW_IEEE80211_STYPE_DATA_CFPOLL	0x0020
+#define RTW_IEEE80211_STYPE_DATA_CFACKPOLL	0x0030
+#define RTW_IEEE80211_STYPE_NULLFUNC	0x0040
+#define RTW_IEEE80211_STYPE_CFACK		0x0050
+#define RTW_IEEE80211_STYPE_CFPOLL		0x0060
+#define RTW_IEEE80211_STYPE_CFACKPOLL	0x0070
+#define RTW_IEEE80211_STYPE_QOS_DATA		0x0080
+#define RTW_IEEE80211_STYPE_QOS_DATA_CFACK		0x0090
+#define RTW_IEEE80211_STYPE_QOS_DATA_CFPOLL		0x00A0
+#define RTW_IEEE80211_STYPE_QOS_DATA_CFACKPOLL	0x00B0
+#define RTW_IEEE80211_STYPE_QOS_NULLFUNC	0x00C0
+#define RTW_IEEE80211_STYPE_QOS_CFACK		0x00D0
+#define RTW_IEEE80211_STYPE_QOS_CFPOLL		0x00E0
+#define RTW_IEEE80211_STYPE_QOS_CFACKPOLL	0x00F0
+
+/* sequence control field */
+#define RTW_IEEE80211_SCTL_FRAG	0x000F
+#define RTW_IEEE80211_SCTL_SEQ	0xFFF0
+
+
+#define RTW_ERP_INFO_NON_ERP_PRESENT BIT(0)
+#define RTW_ERP_INFO_USE_PROTECTION BIT(1)
+#define RTW_ERP_INFO_BARKER_PREAMBLE_MODE BIT(2)
+
+/* QoS,QOS */
+#define NORMAL_ACK			0
+#define NO_ACK				1
+#define NON_EXPLICIT_ACK	2
+#define BLOCK_ACK			3
+
+#ifndef ETH_P_PAE
+#define ETH_P_PAE 0x888E /* Port Access Entity (IEEE 802.1X) */
+#endif /* ETH_P_PAE */
+
+#define ETH_P_PREAUTH 0x88C7 /* IEEE 802.11i pre-authentication */
+
+#define ETH_P_ECONET	0x0018
+
+#ifndef ETH_P_80211_RAW
+#define ETH_P_80211_RAW (ETH_P_ECONET + 1)
+#endif
+
+/* IEEE 802.11 defines */
+
+#define P80211_OUI_LEN 3
+
+#if defined(PLATFORM_LINUX) || defined(CONFIG_RTL8711FW) || defined(PLATFORM_FREEBSD)
+
+struct ieee80211_snap_hdr {
+
+        u8    dsap;   /* always 0xAA */
+        u8    ssap;   /* always 0xAA */
+        u8    ctrl;   /* always 0x03 */
+        u8    oui[P80211_OUI_LEN];    /* organizational universal id */
+
+} __attribute__ ((packed));
+
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+#pragma pack(1)
+struct ieee80211_snap_hdr {
+
+        u8    dsap;   /* always 0xAA */
+        u8    ssap;   /* always 0xAA */
+        u8    ctrl;   /* always 0x03 */
+        u8    oui[P80211_OUI_LEN];    /* organizational universal id */
+
+};
+#pragma pack()
+
+#endif
+
+
+#define SNAP_SIZE sizeof(struct ieee80211_snap_hdr)
+
+#define WLAN_FC_GET_TYPE(fc) ((fc) & RTW_IEEE80211_FCTL_FTYPE)
+#define WLAN_FC_GET_STYPE(fc) ((fc) & RTW_IEEE80211_FCTL_STYPE)
+
+#define WLAN_QC_GET_TID(qc) ((qc) & 0x0f)
+
+#define WLAN_GET_SEQ_FRAG(seq) ((seq) & RTW_IEEE80211_SCTL_FRAG)
+#define WLAN_GET_SEQ_SEQ(seq)  ((seq) & RTW_IEEE80211_SCTL_SEQ)
+
+/* Authentication algorithms */
+#define WLAN_AUTH_OPEN 0
+#define WLAN_AUTH_SHARED_KEY 1
+
+#define WLAN_AUTH_CHALLENGE_LEN 128
+
+#define WLAN_CAPABILITY_BSS (1<<0)
+#define WLAN_CAPABILITY_IBSS (1<<1)
+#define WLAN_CAPABILITY_CF_POLLABLE (1<<2)
+#define WLAN_CAPABILITY_CF_POLL_REQUEST (1<<3)
+#define WLAN_CAPABILITY_PRIVACY (1<<4)
+#define WLAN_CAPABILITY_SHORT_PREAMBLE (1<<5)
+#define WLAN_CAPABILITY_PBCC (1<<6)
+#define WLAN_CAPABILITY_CHANNEL_AGILITY (1<<7)
+#define WLAN_CAPABILITY_SHORT_SLOT (1<<10)
+
+/* Status codes */
+#define WLAN_STATUS_SUCCESS 0
+#define WLAN_STATUS_UNSPECIFIED_FAILURE 1
+#define WLAN_STATUS_CAPS_UNSUPPORTED 10
+#define WLAN_STATUS_REASSOC_NO_ASSOC 11
+#define WLAN_STATUS_ASSOC_DENIED_UNSPEC 12
+#define WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG 13
+#define WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION 14
+#define WLAN_STATUS_CHALLENGE_FAIL 15
+#define WLAN_STATUS_AUTH_TIMEOUT 16
+#define WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA 17
+#define WLAN_STATUS_ASSOC_DENIED_RATES 18
+/* 802.11b */
+#define WLAN_STATUS_ASSOC_DENIED_NOSHORT 19
+#define WLAN_STATUS_ASSOC_DENIED_NOPBCC 20
+#define WLAN_STATUS_ASSOC_DENIED_NOAGILITY 21
+
+/* Reason codes */
+#define WLAN_REASON_UNSPECIFIED 1
+#define WLAN_REASON_PREV_AUTH_NOT_VALID 2
+#define WLAN_REASON_DEAUTH_LEAVING 3
+#define WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY 4
+#define WLAN_REASON_DISASSOC_AP_BUSY 5
+#define WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA 6
+#define WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA 7
+#define WLAN_REASON_DISASSOC_STA_HAS_LEFT 8
+#define WLAN_REASON_STA_REQ_ASSOC_WITHOUT_AUTH 9
+#define WLAN_REASON_JOIN_WRONG_CHANNEL       65534
+#define WLAN_REASON_EXPIRATION_CHK 65535
+
+/* Information Element IDs */
+#define WLAN_EID_SSID 0
+#define WLAN_EID_SUPP_RATES 1
+#define WLAN_EID_FH_PARAMS 2
+#define WLAN_EID_DS_PARAMS 3
+#define WLAN_EID_CF_PARAMS 4
+#define WLAN_EID_TIM 5
+#define WLAN_EID_IBSS_PARAMS 6
+#define WLAN_EID_CHALLENGE 16
+/* EIDs defined by IEEE 802.11h - START */
+#define WLAN_EID_PWR_CONSTRAINT 32
+#define WLAN_EID_PWR_CAPABILITY 33
+#define WLAN_EID_TPC_REQUEST 34
+#define WLAN_EID_TPC_REPORT 35
+#define WLAN_EID_SUPPORTED_CHANNELS 36
+#define WLAN_EID_CHANNEL_SWITCH 37
+#define WLAN_EID_MEASURE_REQUEST 38
+#define WLAN_EID_MEASURE_REPORT 39
+#define WLAN_EID_QUITE 40
+#define WLAN_EID_IBSS_DFS 41
+/* EIDs defined by IEEE 802.11h - END */
+#define WLAN_EID_ERP_INFO 42
+#define WLAN_EID_HT_CAP 45
+#define WLAN_EID_RSN 48
+#define WLAN_EID_EXT_SUPP_RATES 50
+#define WLAN_EID_MOBILITY_DOMAIN 54
+#define WLAN_EID_FAST_BSS_TRANSITION 55
+#define WLAN_EID_TIMEOUT_INTERVAL 56
+#define WLAN_EID_RIC_DATA 57
+#define WLAN_EID_HT_OPERATION 61
+#define WLAN_EID_SECONDARY_CHANNEL_OFFSET 62
+#define WLAN_EID_20_40_BSS_COEXISTENCE 72
+#define WLAN_EID_20_40_BSS_INTOLERANT 73
+#define WLAN_EID_OVERLAPPING_BSS_SCAN_PARAMS 74
+#define WLAN_EID_MMIE 76
+#define WLAN_EID_VENDOR_SPECIFIC 221
+#define WLAN_EID_GENERIC (WLAN_EID_VENDOR_SPECIFIC)
+
+#define IEEE80211_MGMT_HDR_LEN 24
+#define IEEE80211_DATA_HDR3_LEN 24
+#define IEEE80211_DATA_HDR4_LEN 30
+
+
+#define IEEE80211_STATMASK_SIGNAL (1<<0)
+#define IEEE80211_STATMASK_RSSI (1<<1)
+#define IEEE80211_STATMASK_NOISE (1<<2)
+#define IEEE80211_STATMASK_RATE (1<<3)
+#define IEEE80211_STATMASK_WEMASK 0x7
+
+
+#define IEEE80211_CCK_MODULATION    (1<<0)
+#define IEEE80211_OFDM_MODULATION   (1<<1)
+
+#define IEEE80211_24GHZ_BAND     (1<<0)
+#define IEEE80211_52GHZ_BAND     (1<<1)
+
+#define IEEE80211_CCK_RATE_LEN  		4
+#define IEEE80211_NUM_OFDM_RATESLEN	8
+
+
+#define IEEE80211_CCK_RATE_1MB		        0x02
+#define IEEE80211_CCK_RATE_2MB		        0x04
+#define IEEE80211_CCK_RATE_5MB		        0x0B
+#define IEEE80211_CCK_RATE_11MB		        0x16
+#define IEEE80211_OFDM_RATE_LEN 		8
+#define IEEE80211_OFDM_RATE_6MB		        0x0C
+#define IEEE80211_OFDM_RATE_9MB		        0x12
+#define IEEE80211_OFDM_RATE_12MB		0x18
+#define IEEE80211_OFDM_RATE_18MB		0x24
+#define IEEE80211_OFDM_RATE_24MB		0x30
+#define IEEE80211_OFDM_RATE_36MB		0x48
+#define IEEE80211_OFDM_RATE_48MB		0x60
+#define IEEE80211_OFDM_RATE_54MB		0x6C
+#define IEEE80211_BASIC_RATE_MASK		0x80
+
+#define IEEE80211_CCK_RATE_1MB_MASK		(1<<0)
+#define IEEE80211_CCK_RATE_2MB_MASK		(1<<1)
+#define IEEE80211_CCK_RATE_5MB_MASK		(1<<2)
+#define IEEE80211_CCK_RATE_11MB_MASK		(1<<3)
+#define IEEE80211_OFDM_RATE_6MB_MASK		(1<<4)
+#define IEEE80211_OFDM_RATE_9MB_MASK		(1<<5)
+#define IEEE80211_OFDM_RATE_12MB_MASK		(1<<6)
+#define IEEE80211_OFDM_RATE_18MB_MASK		(1<<7)
+#define IEEE80211_OFDM_RATE_24MB_MASK		(1<<8)
+#define IEEE80211_OFDM_RATE_36MB_MASK		(1<<9)
+#define IEEE80211_OFDM_RATE_48MB_MASK		(1<<10)
+#define IEEE80211_OFDM_RATE_54MB_MASK		(1<<11)
+
+#define IEEE80211_CCK_RATES_MASK	        0x0000000F
+#define IEEE80211_CCK_BASIC_RATES_MASK	(IEEE80211_CCK_RATE_1MB_MASK | \
+	IEEE80211_CCK_RATE_2MB_MASK)
+#define IEEE80211_CCK_DEFAULT_RATES_MASK	(IEEE80211_CCK_BASIC_RATES_MASK | \
+        IEEE80211_CCK_RATE_5MB_MASK | \
+        IEEE80211_CCK_RATE_11MB_MASK)
+
+#define IEEE80211_OFDM_RATES_MASK		0x00000FF0
+#define IEEE80211_OFDM_BASIC_RATES_MASK	(IEEE80211_OFDM_RATE_6MB_MASK | \
+	IEEE80211_OFDM_RATE_12MB_MASK | \
+	IEEE80211_OFDM_RATE_24MB_MASK)
+#define IEEE80211_OFDM_DEFAULT_RATES_MASK	(IEEE80211_OFDM_BASIC_RATES_MASK | \
+	IEEE80211_OFDM_RATE_9MB_MASK  | \
+	IEEE80211_OFDM_RATE_18MB_MASK | \
+	IEEE80211_OFDM_RATE_36MB_MASK | \
+	IEEE80211_OFDM_RATE_48MB_MASK | \
+	IEEE80211_OFDM_RATE_54MB_MASK)
+#define IEEE80211_DEFAULT_RATES_MASK (IEEE80211_OFDM_DEFAULT_RATES_MASK | \
+                                IEEE80211_CCK_DEFAULT_RATES_MASK)
+
+#define IEEE80211_NUM_OFDM_RATES	    8
+#define IEEE80211_NUM_CCK_RATES	            4
+#define IEEE80211_OFDM_SHIFT_MASK_A         4
+
+
+
+
+/* NOTE: This data is for statistical purposes; not all hardware provides this
+ *       information for frames received.  Not setting these will not cause
+ *       any adverse affects. */
+struct ieee80211_rx_stats {
+	//u32 mac_time[2];
+	s8 rssi;
+	u8 signal;
+	u8 noise;
+	u8 received_channel;
+	u16 rate; /* in 100 kbps */
+	//u8 control;
+	u8 mask;
+	u8 freq;
+	u16 len;
+};
+
+/* IEEE 802.11 requires that STA supports concurrent reception of at least
+ * three fragmented frames. This define can be increased to support more
+ * concurrent frames, but it should be noted that each entry can consume about
+ * 2 kB of RAM and increasing cache size will slow down frame reassembly. */
+#define IEEE80211_FRAG_CACHE_LEN 4
+
+struct ieee80211_frag_entry {
+	u32 first_frag_time;
+	uint seq;
+	uint last_frag;
+	uint qos;   //jackson
+	uint tid;	//jackson
+	struct sk_buff *skb;
+	u8 src_addr[ETH_ALEN];
+	u8 dst_addr[ETH_ALEN];
+};
+
+#ifndef PLATFORM_FREEBSD //Baron BSD has already defined
+struct ieee80211_stats {
+	uint tx_unicast_frames;
+	uint tx_multicast_frames;
+	uint tx_fragments;
+	uint tx_unicast_octets;
+	uint tx_multicast_octets;
+	uint tx_deferred_transmissions;
+	uint tx_single_retry_frames;
+	uint tx_multiple_retry_frames;
+	uint tx_retry_limit_exceeded;
+	uint tx_discards;
+	uint rx_unicast_frames;
+	uint rx_multicast_frames;
+	uint rx_fragments;
+	uint rx_unicast_octets;
+	uint rx_multicast_octets;
+	uint rx_fcs_errors;
+	uint rx_discards_no_buffer;
+	uint tx_discards_wrong_sa;
+	uint rx_discards_undecryptable;
+	uint rx_message_in_msg_fragments;
+	uint rx_message_in_bad_msg_fragments;
+};
+#endif //PLATFORM_FREEBSD
+struct ieee80211_softmac_stats{
+	uint rx_ass_ok;
+	uint rx_ass_err;
+	uint rx_probe_rq;
+	uint tx_probe_rs;
+	uint tx_beacons;
+	uint rx_auth_rq;
+	uint rx_auth_rs_ok;
+	uint rx_auth_rs_err;
+	uint tx_auth_rq;
+	uint no_auth_rs;
+	uint no_ass_rs;
+	uint tx_ass_rq;
+	uint rx_ass_rq;
+	uint tx_probe_rq;
+	uint reassoc;
+	uint swtxstop;
+	uint swtxawake;
+};
+
+#define SEC_KEY_1         (1<<0)
+#define SEC_KEY_2         (1<<1)
+#define SEC_KEY_3         (1<<2)
+#define SEC_KEY_4         (1<<3)
+#define SEC_ACTIVE_KEY    (1<<4)
+#define SEC_AUTH_MODE     (1<<5)
+#define SEC_UNICAST_GROUP (1<<6)
+#define SEC_LEVEL         (1<<7)
+#define SEC_ENABLED       (1<<8)
+
+#define SEC_LEVEL_0      0 /* None */
+#define SEC_LEVEL_1      1 /* WEP 40 and 104 bit */
+#define SEC_LEVEL_2      2 /* Level 1 + TKIP */
+#define SEC_LEVEL_2_CKIP 3 /* Level 1 + CKIP */
+#define SEC_LEVEL_3      4 /* Level 2 + CCMP */
+
+#define WEP_KEYS 4
+#define WEP_KEY_LEN 13
+
+#ifdef CONFIG_IEEE80211W
+#define BIP_MAX_KEYID 5
+#define BIP_AAD_SIZE  20
+#endif //CONFIG_IEEE80211W
+
+#if defined(PLATFORM_LINUX) || defined(CONFIG_RTL8711FW)
+
+struct ieee80211_security {
+	u16 active_key:2,
+            enabled:1,
+	    auth_mode:2,
+            auth_algo:4,
+            unicast_uses_group:1;
+	u8 key_sizes[WEP_KEYS];
+	u8 keys[WEP_KEYS][WEP_KEY_LEN];
+	u8 level;
+	u16 flags;
+} __attribute__ ((packed));
+
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+#pragma pack(1)
+struct ieee80211_security {
+	u16 active_key:2,
+            enabled:1,
+	    auth_mode:2,
+            auth_algo:4,
+            unicast_uses_group:1;
+	u8 key_sizes[WEP_KEYS];
+	u8 keys[WEP_KEYS][WEP_KEY_LEN];
+	u8 level;
+	u16 flags;
+} ;
+#pragma pack()
+
+#endif
+
+/*
+
+ 802.11 data frame from AP
+
+      ,-------------------------------------------------------------------.
+Bytes |  2   |  2   |    6    |    6    |    6    |  2   | 0..2312 |   4  |
+      |------|------|---------|---------|---------|------|---------|------|
+Desc. | ctrl | dura |  DA/RA  |   TA    |    SA   | Sequ |  frame  |  fcs |
+      |      | tion | (BSSID) |         |         | ence |  data   |      |
+      `-------------------------------------------------------------------'
+
+Total: 28-2340 bytes
+
+*/
+
+struct ieee80211_header_data {
+	u16 frame_ctl;
+	u16 duration_id;
+	u8 addr1[6];
+	u8 addr2[6];
+	u8 addr3[6];
+	u16 seq_ctrl;
+};
+
+#define BEACON_PROBE_SSID_ID_POSITION 12
+
+/* Management Frame Information Element Types */
+#define MFIE_TYPE_SSID       0
+#define MFIE_TYPE_RATES      1
+#define MFIE_TYPE_FH_SET     2
+#define MFIE_TYPE_DS_SET     3
+#define MFIE_TYPE_CF_SET     4
+#define MFIE_TYPE_TIM        5
+#define MFIE_TYPE_IBSS_SET   6
+#define MFIE_TYPE_CHALLENGE  16
+#define MFIE_TYPE_ERP        42
+#define MFIE_TYPE_RSN	     48
+#define MFIE_TYPE_RATES_EX   50
+#define MFIE_TYPE_GENERIC    221
+
+#if defined(PLATFORM_LINUX) || defined(CONFIG_RTL8711FW)
+
+struct ieee80211_info_element_hdr {
+	u8 id;
+	u8 len;
+} __attribute__ ((packed));
+
+struct ieee80211_info_element {
+	u8 id;
+	u8 len;
+	u8 data[0];
+} __attribute__ ((packed));
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+#pragma pack(1)
+struct ieee80211_info_element_hdr {
+	u8 id;
+	u8 len;
+} ;
+
+struct ieee80211_info_element {
+	u8 id;
+	u8 len;
+	u8 data[0];
+} ;
+#pragma pack()
+
+#endif
+
+
+/*
+ * These are the data types that can make up management packets
+ *
+	u16 auth_algorithm;
+	u16 auth_sequence;
+	u16 beacon_interval;
+	u16 capability;
+	u8 current_ap[ETH_ALEN];
+	u16 listen_interval;
+	struct {
+		u16 association_id:14, reserved:2;
+	} __attribute__ ((packed));
+	u32 time_stamp[2];
+	u16 reason;
+	u16 status;
+*/
+
+#define IEEE80211_DEFAULT_TX_ESSID "Penguin"
+#define IEEE80211_DEFAULT_BASIC_RATE 10
+
+
+#if defined(PLATFORM_LINUX) || defined(CONFIG_RTL8711FW)
+
+
+struct ieee80211_authentication {
+	struct ieee80211_header_data header;
+	u16 algorithm;
+	u16 transaction;
+	u16 status;
+	//struct ieee80211_info_element_hdr info_element;
+} __attribute__ ((packed));
+
+
+struct ieee80211_probe_response {
+	struct ieee80211_header_data header;
+	u32 time_stamp[2];
+	u16 beacon_interval;
+	u16 capability;
+	struct ieee80211_info_element info_element;
+} __attribute__ ((packed));
+
+struct ieee80211_probe_request {
+	struct ieee80211_header_data header;
+	/*struct ieee80211_info_element info_element;*/
+} __attribute__ ((packed));
+
+struct ieee80211_assoc_request_frame {
+	struct rtw_ieee80211_hdr_3addr header;
+	u16 capability;
+	u16 listen_interval;
+	//u8 current_ap[ETH_ALEN];
+	struct ieee80211_info_element_hdr info_element;
+} __attribute__ ((packed));
+
+struct ieee80211_assoc_response_frame {
+	struct rtw_ieee80211_hdr_3addr header;
+	u16 capability;
+	u16 status;
+	u16 aid;
+//	struct ieee80211_info_element info_element; /* supported rates */
+} __attribute__ ((packed));
+#endif
+
+
+
+#ifdef PLATFORM_WINDOWS
+
+#pragma pack(1)
+
+struct ieee80211_authentication {
+	struct ieee80211_header_data header;
+	u16 algorithm;
+	u16 transaction;
+	u16 status;
+	//struct ieee80211_info_element_hdr info_element;
+} ;
+
+
+struct ieee80211_probe_response {
+	struct ieee80211_header_data header;
+	u32 time_stamp[2];
+	u16 beacon_interval;
+	u16 capability;
+	struct ieee80211_info_element info_element;
+} ;
+
+struct ieee80211_probe_request {
+	struct ieee80211_header_data header;
+	/*struct ieee80211_info_element info_element;*/
+} ;
+
+struct ieee80211_assoc_request_frame {
+	struct rtw_ieee80211_hdr_3addr header;
+	u16 capability;
+	u16 listen_interval;
+	//u8 current_ap[ETH_ALEN];
+	struct ieee80211_info_element_hdr info_element;
+} ;
+
+struct ieee80211_assoc_response_frame {
+	struct rtw_ieee80211_hdr_3addr header;
+	u16 capability;
+	u16 status;
+	u16 aid;
+//	struct ieee80211_info_element info_element; /* supported rates */
+};
+
+#pragma pack()
+
+#endif
+
+
+
+
+struct ieee80211_txb {
+	u8 nr_frags;
+	u8 encrypted;
+	u16 reserved;
+	u16 frag_size;
+	u16 payload_size;
+	struct sk_buff *fragments[0];
+};
+
+
+/* SWEEP TABLE ENTRIES NUMBER*/
+#define MAX_SWEEP_TAB_ENTRIES		  42
+#define MAX_SWEEP_TAB_ENTRIES_PER_PACKET  7
+/* MAX_RATES_LENGTH needs to be 12.  The spec says 8, and many APs
+ * only use 8, and then use extended rates for the remaining supported
+ * rates.  Other APs, however, stick all of their supported rates on the
+ * main rates information element... */
+#define MAX_RATES_LENGTH                  ((u8)12)
+#define MAX_RATES_EX_LENGTH               ((u8)16)
+#define MAX_NETWORK_COUNT                  128
+#define MAX_CHANNEL_NUMBER                 161
+#define IEEE80211_SOFTMAC_SCAN_TIME	  400
+//(HZ / 2)
+#define IEEE80211_SOFTMAC_ASSOC_RETRY_TIME (HZ * 2)
+
+#define CRC_LENGTH                 4U
+
+#define MAX_WPA_IE_LEN (256)
+#define MAX_WPS_IE_LEN (512)
+#define MAX_P2P_IE_LEN (256)
+#define MAX_WFD_IE_LEN (128)
+
+#define NETWORK_EMPTY_ESSID (1<<0)
+#define NETWORK_HAS_OFDM    (1<<1)
+#define NETWORK_HAS_CCK     (1<<2)
+
+#define IEEE80211_DTIM_MBCAST 4
+#define IEEE80211_DTIM_UCAST 2
+#define IEEE80211_DTIM_VALID 1
+#define IEEE80211_DTIM_INVALID 0
+
+#define IEEE80211_PS_DISABLED 0
+#define IEEE80211_PS_UNICAST IEEE80211_DTIM_UCAST
+#define IEEE80211_PS_MBCAST IEEE80211_DTIM_MBCAST
+#define IW_ESSID_MAX_SIZE 32
+#if 0
+struct ieee80211_network {
+	/* These entries are used to identify a unique network */
+	u8 bssid[ETH_ALEN];
+	u8 channel;
+	/* Ensure null-terminated for any debug msgs */
+	u8 ssid[IW_ESSID_MAX_SIZE + 1];
+	u8 ssid_len;
+	u8	rssi;	//relative signal strength
+	u8	sq;		//signal quality
+
+	/* These are network statistics */
+	//struct ieee80211_rx_stats stats;
+	u16 capability;
+	u16	aid;
+	u8 rates[MAX_RATES_LENGTH];
+	u8 rates_len;
+	u8 rates_ex[MAX_RATES_EX_LENGTH];
+	u8 rates_ex_len;
+
+	u8 edca_parmsets[18];
+
+	u8 mode;
+	u8 flags;
+	u8 time_stamp[8];
+	u16 beacon_interval;
+	u16 listen_interval;
+	u16 atim_window;
+	u8 wpa_ie[MAX_WPA_IE_LEN];
+	size_t wpa_ie_len;
+	u8 rsn_ie[MAX_WPA_IE_LEN];
+	size_t rsn_ie_len;
+	u8 country[6];
+	u8 dtim_period;
+	u8 dtim_data;
+	u8 power_constraint;
+	u8 qosinfo;
+	u8 qbssload[5];
+	u8 network_type;
+	int join_res;
+	unsigned long	last_scanned;
+};
+#endif
+/*
+join_res:
+-1: authentication fail
+-2: association fail
+> 0: TID
+*/
+
+#ifndef PLATFORM_FREEBSD //Baron BSD has already defined
+
+enum ieee80211_state {
+
+	/* the card is not linked at all */
+	IEEE80211_NOLINK = 0,
+
+	/* IEEE80211_ASSOCIATING* are for BSS client mode
+	 * the driver shall not perform RX filtering unless
+	 * the state is LINKED.
+	 * The driver shall just check for the state LINKED and
+	 * defaults to NOLINK for ALL the other states (including
+	 * LINKED_SCANNING)
+	 */
+
+	/* the association procedure will start (wq scheduling)*/
+	IEEE80211_ASSOCIATING,
+	IEEE80211_ASSOCIATING_RETRY,
+
+	/* the association procedure is sending AUTH request*/
+	IEEE80211_ASSOCIATING_AUTHENTICATING,
+
+	/* the association procedure has successfully authentcated
+	 * and is sending association request
+	 */
+	IEEE80211_ASSOCIATING_AUTHENTICATED,
+
+	/* the link is ok. the card associated to a BSS or linked
+	 * to a ibss cell or acting as an AP and creating the bss
+	 */
+	IEEE80211_LINKED,
+
+	/* same as LINKED, but the driver shall apply RX filter
+	 * rules as we are in NO_LINK mode. As the card is still
+	 * logically linked, but it is doing a syncro site survey
+	 * then it will be back to LINKED state.
+	 */
+	IEEE80211_LINKED_SCANNING,
+
+};
+#endif //PLATFORM_FREEBSD
+
+#define DEFAULT_MAX_SCAN_AGE (15 * HZ)
+#define DEFAULT_FTS 2346
+#define MAC_FMT "%02x:%02x:%02x:%02x:%02x:%02x"
+#define MAC_ARG(x) ((u8*)(x))[0],((u8*)(x))[1],((u8*)(x))[2],((u8*)(x))[3],((u8*)(x))[4],((u8*)(x))[5]
+
+#ifdef PLATFORM_FREEBSD //Baron change func to macro
+#define is_multicast_mac_addr(Addr) ((((Addr[0]) & 0x01) == 0x01) && ((Addr[0]) != 0xff))
+#define is_broadcast_mac_addr(Addr) ((((Addr[0]) & 0xff) == 0xff) && (((Addr[1]) & 0xff) == 0xff) && \
+(((Addr[2]) & 0xff) == 0xff) && (((Addr[3]) & 0xff) == 0xff) && (((Addr[4]) & 0xff) == 0xff) && \
+(((Addr[5]) & 0xff) == 0xff))
+#else
+extern __inline int is_multicast_mac_addr(const u8 *addr)
+{
+        return ((addr[0] != 0xff) && (0x01 & addr[0]));
+}
+
+extern __inline int is_broadcast_mac_addr(const u8 *addr)
+{
+	return ((addr[0] == 0xff) && (addr[1] == 0xff) && (addr[2] == 0xff) &&   \
+		(addr[3] == 0xff) && (addr[4] == 0xff) && (addr[5] == 0xff));
+}
+
+extern __inline int is_zero_mac_addr(const u8 *addr)
+{
+	return ((addr[0] == 0x00) && (addr[1] == 0x00) && (addr[2] == 0x00) &&   \
+		(addr[3] == 0x00) && (addr[4] == 0x00) && (addr[5] == 0x00));
+}
+#endif //PLATFORM_FREEBSD
+
+#define CFG_IEEE80211_RESERVE_FCS (1<<0)
+#define CFG_IEEE80211_COMPUTE_FCS (1<<1)
+
+typedef struct tx_pending_t{
+	int frag;
+	struct ieee80211_txb *txb;
+}tx_pending_t;
+
+
+
+#define MAXTID	16
+
+#define IEEE_A            (1<<0)
+#define IEEE_B            (1<<1)
+#define IEEE_G            (1<<2)
+#define IEEE_MODE_MASK    (IEEE_A|IEEE_B|IEEE_G)
+
+//Baron move to ieee80211.c
+int ieee80211_is_empty_essid(const char *essid, int essid_len);
+int ieee80211_get_hdrlen(u16 fc);
+
+#if 0
+/* Action frame categories (IEEE 802.11-2007, 7.3.1.11, Table 7-24) */
+#define WLAN_ACTION_SPECTRUM_MGMT 0
+#define WLAN_ACTION_QOS 1
+#define WLAN_ACTION_DLS 2
+#define WLAN_ACTION_BLOCK_ACK 3
+#define WLAN_ACTION_RADIO_MEASUREMENT 5
+#define WLAN_ACTION_FT 6
+#define WLAN_ACTION_SA_QUERY 8
+#define WLAN_ACTION_WMM 17
+#endif
+
+
+/* Action category code */
+enum rtw_ieee80211_category {
+	RTW_WLAN_CATEGORY_SPECTRUM_MGMT = 0,
+	RTW_WLAN_CATEGORY_QOS = 1,
+	RTW_WLAN_CATEGORY_DLS = 2,
+	RTW_WLAN_CATEGORY_BACK = 3,
+	RTW_WLAN_CATEGORY_PUBLIC = 4, //IEEE 802.11 public action frames
+	RTW_WLAN_CATEGORY_RADIO_MEASUREMENT  = 5,
+	RTW_WLAN_CATEGORY_FT = 6,
+	RTW_WLAN_CATEGORY_HT = 7,
+	RTW_WLAN_CATEGORY_SA_QUERY = 8,
+	RTW_WLAN_CATEGORY_UNPROTECTED_WNM = 11, // add for CONFIG_IEEE80211W, none 11w also can use
+	RTW_WLAN_CATEGORY_TDLS = 12,
+	RTW_WLAN_CATEGORY_SELF_PROTECTED = 15, // add for CONFIG_IEEE80211W, none 11w also can use
+	RTW_WLAN_CATEGORY_WMM = 17,
+	RTW_WLAN_CATEGORY_P2P = 0x7f,//P2P action frames
+};
+
+/* SPECTRUM_MGMT action code */
+enum rtw_ieee80211_spectrum_mgmt_actioncode {
+	RTW_WLAN_ACTION_SPCT_MSR_REQ = 0,
+	RTW_WLAN_ACTION_SPCT_MSR_RPRT = 1,
+	RTW_WLAN_ACTION_SPCT_TPC_REQ = 2,
+	RTW_WLAN_ACTION_SPCT_TPC_RPRT = 3,
+	RTW_WLAN_ACTION_SPCT_CHL_SWITCH = 4,
+	RTW_WLAN_ACTION_SPCT_EXT_CHL_SWITCH = 5,
+};
+
+enum _PUBLIC_ACTION{
+	ACT_PUBLIC_BSSCOEXIST = 0, // 20/40 BSS Coexistence
+	ACT_PUBLIC_DSE_ENABLE = 1,
+	ACT_PUBLIC_DSE_DEENABLE = 2,
+	ACT_PUBLIC_DSE_REG_LOCATION = 3,
+	ACT_PUBLIC_EXT_CHL_SWITCH = 4,
+	ACT_PUBLIC_DSE_MSR_REQ = 5,
+	ACT_PUBLIC_DSE_MSR_RPRT = 6,
+	ACT_PUBLIC_MP = 7, // Measurement Pilot
+	ACT_PUBLIC_DSE_PWR_CONSTRAINT = 8,
+	ACT_PUBLIC_VENDOR = 9, // for WIFI_DIRECT
+	ACT_PUBLIC_GAS_INITIAL_REQ = 10,
+	ACT_PUBLIC_GAS_INITIAL_RSP = 11,
+	ACT_PUBLIC_GAS_COMEBACK_REQ = 12,
+	ACT_PUBLIC_GAS_COMEBACK_RSP = 13,
+	ACT_PUBLIC_TDLS_DISCOVERY_RSP = 14,
+	ACT_PUBLIC_LOCATION_TRACK = 15,
+	ACT_PUBLIC_MAX
+};
+
+#ifdef CONFIG_TDLS
+enum TDLS_ACTION_FIELD{
+	TDLS_SETUP_REQUEST = 0,
+	TDLS_SETUP_RESPONSE = 1,
+	TDLS_SETUP_CONFIRM = 2,
+	TDLS_TEARDOWN = 3,
+	TDLS_PEER_TRAFFIC_INDICATION = 4,
+	TDLS_CHANNEL_SWITCH_REQUEST = 5,
+	TDLS_CHANNEL_SWITCH_RESPONSE = 6,
+	TDLS_PEER_PSM_REQUEST = 7,
+	TDLS_PEER_PSM_RESPONSE = 8,
+	TDLS_PEER_TRAFFIC_RESPONSE = 9,
+	TDLS_DISCOVERY_REQUEST = 10,
+	TDLS_DISCOVERY_RESPONSE = 14,	//it's used in public action frame
+};
+
+#define	TUNNELED_PROBE_REQ	15
+#define	TUNNELED_PROBE_RSP	16
+#endif //CONFIG_TDLS
+
+/* BACK action code */
+enum rtw_ieee80211_back_actioncode {
+	RTW_WLAN_ACTION_ADDBA_REQ = 0,
+	RTW_WLAN_ACTION_ADDBA_RESP = 1,
+	RTW_WLAN_ACTION_DELBA = 2,
+};
+
+/* HT features action code */
+enum rtw_ieee80211_ht_actioncode {
+	RTW_WLAN_ACTION_NOTIFY_CH_WIDTH = 0,
+       RTW_WLAN_ACTION_SM_PS = 1,
+       RTW_WLAN_ACTION_PSPM = 2,
+       RTW_WLAN_ACTION_PCO_PHASE = 3,
+       RTW_WLAN_ACTION_MIMO_CSI_MX = 4,
+       RTW_WLAN_ACTION_MIMO_NONCP_BF = 5,
+       RTW_WLAN_ACTION_MIMP_CP_BF = 6,
+       RTW_WLAN_ACTION_ASEL_INDICATES_FB = 7,
+       RTW_WLAN_ACTION_HI_INFO_EXCHG = 8,
+};
+
+/* BACK (block-ack) parties */
+enum rtw_ieee80211_back_parties {
+	RTW_WLAN_BACK_RECIPIENT = 0,
+	RTW_WLAN_BACK_INITIATOR = 1,
+	RTW_WLAN_BACK_TIMER = 2,
+};
+
+
+#define OUI_MICROSOFT 0x0050f2 /* Microsoft (also used in Wi-Fi specs)
+				* 00:50:F2 */
+#ifndef PLATFORM_FREEBSD //Baron BSD has defined
+#define WME_OUI_TYPE 2
+#endif //PLATFORM_FREEBSD
+#define WME_OUI_SUBTYPE_INFORMATION_ELEMENT 0
+#define WME_OUI_SUBTYPE_PARAMETER_ELEMENT 1
+#define WME_OUI_SUBTYPE_TSPEC_ELEMENT 2
+#define WME_VERSION 1
+
+#define WME_ACTION_CODE_SETUP_REQUEST 0
+#define WME_ACTION_CODE_SETUP_RESPONSE 1
+#define WME_ACTION_CODE_TEARDOWN 2
+
+#define WME_SETUP_RESPONSE_STATUS_ADMISSION_ACCEPTED 0
+#define WME_SETUP_RESPONSE_STATUS_INVALID_PARAMETERS 1
+#define WME_SETUP_RESPONSE_STATUS_REFUSED 3
+
+#define WME_TSPEC_DIRECTION_UPLINK 0
+#define WME_TSPEC_DIRECTION_DOWNLINK 1
+#define WME_TSPEC_DIRECTION_BI_DIRECTIONAL 3
+
+
+#define OUI_BROADCOM 0x00904c /* Broadcom (Epigram) */
+
+#define VENDOR_HT_CAPAB_OUI_TYPE 0x33 /* 00-90-4c:0x33 */
+
+/**
+ * enum rtw_ieee80211_channel_flags - channel flags
+ *
+ * Channel flags set by the regulatory control code.
+ *
+ * @RTW_IEEE80211_CHAN_DISABLED: This channel is disabled.
+ * @RTW_IEEE80211_CHAN_PASSIVE_SCAN: Only passive scanning is permitted
+ *      on this channel.
+ * @RTW_IEEE80211_CHAN_NO_IBSS: IBSS is not allowed on this channel.
+ * @RTW_IEEE80211_CHAN_RADAR: Radar detection is required on this channel.
+ * @RTW_IEEE80211_CHAN_NO_HT40PLUS: extension channel above this channel
+ *      is not permitted.
+ * @RTW_IEEE80211_CHAN_NO_HT40MINUS: extension channel below this channel
+ *      is not permitted.
+ */
+  enum rtw_ieee80211_channel_flags {
+          RTW_IEEE80211_CHAN_DISABLED         = 1<<0,
+          RTW_IEEE80211_CHAN_PASSIVE_SCAN     = 1<<1,
+          RTW_IEEE80211_CHAN_NO_IBSS          = 1<<2,
+          RTW_IEEE80211_CHAN_RADAR            = 1<<3,
+          RTW_IEEE80211_CHAN_NO_HT40PLUS      = 1<<4,
+          RTW_IEEE80211_CHAN_NO_HT40MINUS     = 1<<5,
+  };
+
+  #define RTW_IEEE80211_CHAN_NO_HT40 \
+          (RTW_IEEE80211_CHAN_NO_HT40PLUS | RTW_IEEE80211_CHAN_NO_HT40MINUS)
+
+/* Represent channel details, subset of ieee80211_channel */
+struct rtw_ieee80211_channel {
+	//enum ieee80211_band band;
+	//u16 center_freq;
+	u16 hw_value;
+	u32 flags;
+	//int max_antenna_gain;
+	//int max_power;
+	//int max_reg_power;
+	//bool beacon_found;
+	//u32 orig_flags;
+	//int orig_mag;
+	//int orig_mpwr;
+};
+
+#define CHAN_FMT \
+	/*"band:%d, "*/ \
+	/*"center_freq:%u, "*/ \
+	"hw_value:%u, " \
+	"flags:0x%08x" \
+	/*"max_antenna_gain:%d\n"*/ \
+	/*"max_power:%d\n"*/ \
+	/*"max_reg_power:%d\n"*/ \
+	/*"beacon_found:%u\n"*/ \
+	/*"orig_flags:0x%08x\n"*/ \
+	/*"orig_mag:%d\n"*/ \
+	/*"orig_mpwr:%d\n"*/
+
+#define CHAN_ARG(channel) \
+	/*(channel)->band*/ \
+	/*, (channel)->center_freq*/ \
+	(channel)->hw_value \
+	, (channel)->flags \
+	/*, (channel)->max_antenna_gain*/ \
+	/*, (channel)->max_power*/ \
+	/*, (channel)->max_reg_power*/ \
+	/*, (channel)->beacon_found*/ \
+	/*, (channel)->orig_flags*/ \
+	/*, (channel)->orig_mag*/ \
+	/*, (channel)->orig_mpwr*/ \
+
+/* Parsed Information Elements */
+struct rtw_ieee802_11_elems {
+	u8 *ssid;
+	u8 ssid_len;
+	u8 *supp_rates;
+	u8 supp_rates_len;
+	u8 *fh_params;
+	u8 fh_params_len;
+	u8 *ds_params;
+	u8 ds_params_len;
+	u8 *cf_params;
+	u8 cf_params_len;
+	u8 *tim;
+	u8 tim_len;
+	u8 *ibss_params;
+	u8 ibss_params_len;
+	u8 *challenge;
+	u8 challenge_len;
+	u8 *erp_info;
+	u8 erp_info_len;
+	u8 *ext_supp_rates;
+	u8 ext_supp_rates_len;
+	u8 *wpa_ie;
+	u8 wpa_ie_len;
+	u8 *rsn_ie;
+	u8 rsn_ie_len;
+	u8 *wme;
+	u8 wme_len;
+	u8 *wme_tspec;
+	u8 wme_tspec_len;
+	u8 *wps_ie;
+	u8 wps_ie_len;
+	u8 *power_cap;
+	u8 power_cap_len;
+	u8 *supp_channels;
+	u8 supp_channels_len;
+	u8 *mdie;
+	u8 mdie_len;
+	u8 *ftie;
+	u8 ftie_len;
+	u8 *timeout_int;
+	u8 timeout_int_len;
+	u8 *ht_capabilities;
+	u8 ht_capabilities_len;
+	u8 *ht_operation;
+	u8 ht_operation_len;
+	u8 *vendor_ht_cap;
+	u8 vendor_ht_cap_len;
+};
+
+typedef enum { ParseOK = 0, ParseUnknown = 1, ParseFailed = -1 } ParseRes;
+
+ParseRes rtw_ieee802_11_parse_elems(u8 *start, uint len,
+				struct rtw_ieee802_11_elems *elems,
+				int show_errors);
+
+u8 *rtw_set_fixed_ie(unsigned char *pbuf, unsigned int len, unsigned char *source, unsigned int *frlen);
+u8 *rtw_set_ie(u8 *pbuf, sint index, uint len, u8 *source, uint *frlen);
+
+enum secondary_ch_offset {
+	SCN = 0, /* no secondary channel */
+	SCA = 1, /* secondary channel above */
+	SCB = 3,  /* secondary channel below */
+};
+u8 secondary_ch_offset_to_hal_ch_offset(u8 ch_offset);
+u8 hal_ch_offset_to_secondary_ch_offset(u8 ch_offset);
+u8 *rtw_set_ie_ch_switch(u8 *buf, u32 *buf_len, u8 ch_switch_mode, u8 new_ch, u8 ch_switch_cnt);
+u8 *rtw_set_ie_secondary_ch_offset(u8 *buf, u32 *buf_len, u8 secondary_ch_offset);
+u8 *rtw_set_ie_mesh_ch_switch_parm(u8 *buf, u32 *buf_len, u8 ttl, u8 flags, u16 reason, u16 precedence);
+
+u8 *rtw_get_ie(u8*pbuf, sint index, sint *len, sint limit);
+u8 *rtw_get_ie_ex(u8 *in_ie, uint in_len, u8 eid, u8 *oui, u8 oui_len, u8 *ie, uint *ielen);
+int rtw_ies_remove_ie(u8 *ies, uint *ies_len, uint offset, u8 eid, u8 *oui, u8 oui_len);
+
+void rtw_set_supported_rate(u8* SupportedRates, uint mode) ;
+
+unsigned char *rtw_get_wpa_ie(unsigned char *pie, int *wpa_ie_len, int limit);
+unsigned char *rtw_get_wpa2_ie(unsigned char *pie, int *rsn_ie_len, int limit);
+int rtw_get_wpa_cipher_suite(u8 *s);
+int rtw_get_wpa2_cipher_suite(u8 *s);
+int rtw_parse_wpa_ie(u8* wpa_ie, int wpa_ie_len, int *group_cipher, int *pairwise_cipher);
+int rtw_parse_wpa2_ie(u8* wpa_ie, int wpa_ie_len, int *group_cipher, int *pairwise_cipher);
+
+int rtw_get_sec_ie(u8 *in_ie,uint in_len,u8 *rsn_ie,u16 *rsn_len,u8 *wpa_ie,u16 *wpa_len);
+
+u8 rtw_is_wps_ie(u8 *ie_ptr, uint *wps_ielen);
+u8 *rtw_get_wps_ie(u8 *in_ie, uint in_len, u8 *wps_ie, uint *wps_ielen);
+u8 *rtw_get_wps_attr(u8 *wps_ie, uint wps_ielen, u16 target_attr_id ,u8 *buf_attr, u32 *len_attr);
+u8 *rtw_get_wps_attr_content(u8 *wps_ie, uint wps_ielen, u16 target_attr_id ,u8 *buf_content, uint *len_content);
+
+/**
+ * for_each_ie - iterate over continuous IEs
+ * @ie:
+ * @buf:
+ * @buf_len:
+ */
+#define for_each_ie(ie, buf, buf_len) \
+	for (ie = (void*)buf; (((u8*)ie) - ((u8*)buf) + 1) < buf_len; ie = (void*)(((u8*)ie) + *(((u8*)ie)+1) + 2))
+
+void dump_ies(u8 *buf, u32 buf_len);
+void dump_wps_ie(u8 *ie, u32 ie_len);
+
+#ifdef CONFIG_P2P
+u32 rtw_get_p2p_merged_ies_len(u8 *in_ie, u32 in_len);
+int rtw_p2p_merge_ies(u8 *in_ie, u32 in_len, u8 *merge_ie);
+void dump_p2p_ie(u8 *ie, u32 ie_len);
+u8 *rtw_get_p2p_ie(u8 *in_ie, int in_len, u8 *p2p_ie, uint *p2p_ielen);
+u8 *rtw_get_p2p_attr(u8 *p2p_ie, uint p2p_ielen, u8 target_attr_id ,u8 *buf_attr, u32 *len_attr);
+u8 *rtw_get_p2p_attr_content(u8 *p2p_ie, uint p2p_ielen, u8 target_attr_id ,u8 *buf_content, uint *len_content);
+u32 rtw_set_p2p_attr_content(u8 *pbuf, u8 attr_id, u16 attr_len, u8 *pdata_attr);
+void rtw_WLAN_BSSID_EX_remove_p2p_attr(WLAN_BSSID_EX *bss_ex, u8 attr_id);
+#endif
+
+#ifdef CONFIG_WFD
+int rtw_get_wfd_ie(u8 *in_ie, int in_len, u8 *wfd_ie, uint *wfd_ielen);
+int rtw_get_wfd_attr_content(u8 *wfd_ie, uint wfd_ielen, u8 target_attr_id ,u8 *attr_content, uint *attr_contentlen);
+#endif // CONFIG_WFD
+
+uint	rtw_get_rateset_len(u8	*rateset);
+
+struct registry_priv;
+int rtw_generate_ie(struct registry_priv *pregistrypriv);
+
+
+int rtw_get_bit_value_from_ieee_value(u8 val);
+
+uint	rtw_is_cckrates_included(u8 *rate);
+
+uint	rtw_is_cckratesonly_included(u8 *rate);
+
+int rtw_check_network_type(unsigned char *rate, int ratelen, int channel);
+
+void rtw_macaddr_cfg(u8 *mac_addr);
+
+u16 rtw_mcs_rate(u8 rf_type, u8 bw_40MHz, u8 short_GI_20, u8 short_GI_40, unsigned char * MCS_rate);
+
+int rtw_action_frame_parse(const u8 *frame, u32 frame_len, u8* category, u8 *action);
+const char *action_public_str(u8 action);
+
+#endif /* IEEE80211_H */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/ieee80211_ext.h b/drivers/net/wireless/realtek/rtl8192cu/include/ieee80211_ext.h
new file mode 100644
index 000000000000..eba9001571c5
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/ieee80211_ext.h
@@ -0,0 +1,476 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __IEEE80211_EXT_H
+#define __IEEE80211_EXT_H
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#define WMM_OUI_TYPE 2
+#define WMM_OUI_SUBTYPE_INFORMATION_ELEMENT 0
+#define WMM_OUI_SUBTYPE_PARAMETER_ELEMENT 1
+#define WMM_OUI_SUBTYPE_TSPEC_ELEMENT 2
+#define WMM_VERSION 1
+
+#define WPA_PROTO_WPA BIT(0)
+#define WPA_PROTO_RSN BIT(1)
+
+#define WPA_KEY_MGMT_IEEE8021X BIT(0)
+#define WPA_KEY_MGMT_PSK BIT(1)
+#define WPA_KEY_MGMT_NONE BIT(2)
+#define WPA_KEY_MGMT_IEEE8021X_NO_WPA BIT(3)
+#define WPA_KEY_MGMT_WPA_NONE BIT(4)
+
+
+#define WPA_CAPABILITY_PREAUTH BIT(0)
+#define WPA_CAPABILITY_MGMT_FRAME_PROTECTION BIT(6)
+#define WPA_CAPABILITY_PEERKEY_ENABLED BIT(9)
+
+
+#define PMKID_LEN 16
+
+
+#ifdef PLATFORM_LINUX
+struct wpa_ie_hdr {
+	u8 elem_id;
+	u8 len;
+	u8 oui[4]; /* 24-bit OUI followed by 8-bit OUI type */
+	u8 version[2]; /* little endian */
+}__attribute__ ((packed));
+
+struct rsn_ie_hdr {
+	u8 elem_id; /* WLAN_EID_RSN */
+	u8 len;
+	u8 version[2]; /* little endian */
+}__attribute__ ((packed));
+
+struct wme_ac_parameter {
+#if defined(CONFIG_LITTLE_ENDIAN)
+	/* byte 1 */
+	u8 	aifsn:4,
+		acm:1,
+		aci:2,
+		reserved:1;
+
+	/* byte 2 */
+	u8 	eCWmin:4,
+		eCWmax:4;
+#elif defined(CONFIG_BIG_ENDIAN)
+	/* byte 1 */
+	u8 	reserved:1,
+		aci:2,
+		acm:1,
+		aifsn:4;
+
+	/* byte 2 */
+	u8 	eCWmax:4,
+		eCWmin:4;
+#else
+#error	"Please fix <endian.h>"
+#endif
+
+	/* bytes 3 & 4 */
+	u16 txopLimit;
+} __attribute__ ((packed));
+
+struct wme_parameter_element {
+	/* required fields for WME version 1 */
+	u8 oui[3];
+	u8 oui_type;
+	u8 oui_subtype;
+	u8 version;
+	u8 acInfo;
+	u8 reserved;
+	struct wme_ac_parameter ac[4];
+
+} __attribute__ ((packed));
+
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+#pragma pack(1)
+
+struct wpa_ie_hdr {
+	u8 elem_id;
+	u8 len;
+	u8 oui[4]; /* 24-bit OUI followed by 8-bit OUI type */
+	u8 version[2]; /* little endian */
+};
+
+struct rsn_ie_hdr {
+	u8 elem_id; /* WLAN_EID_RSN */
+	u8 len;
+	u8 version[2]; /* little endian */
+};
+
+#pragma pack()
+
+#endif
+
+#define WPA_PUT_LE16(a, val)			\
+	do {					\
+		(a)[1] = ((u16) (val)) >> 8;	\
+		(a)[0] = ((u16) (val)) & 0xff;	\
+	} while (0)
+
+#define WPA_PUT_BE32(a, val)					\
+	do {							\
+		(a)[0] = (u8) ((((u32) (val)) >> 24) & 0xff);	\
+		(a)[1] = (u8) ((((u32) (val)) >> 16) & 0xff);	\
+		(a)[2] = (u8) ((((u32) (val)) >> 8) & 0xff);	\
+		(a)[3] = (u8) (((u32) (val)) & 0xff);		\
+	} while (0)
+
+#define WPA_PUT_LE32(a, val)					\
+	do {							\
+		(a)[3] = (u8) ((((u32) (val)) >> 24) & 0xff);	\
+		(a)[2] = (u8) ((((u32) (val)) >> 16) & 0xff);	\
+		(a)[1] = (u8) ((((u32) (val)) >> 8) & 0xff);	\
+		(a)[0] = (u8) (((u32) (val)) & 0xff);		\
+	} while (0)
+
+#define RSN_SELECTOR_PUT(a, val) WPA_PUT_BE32((u8 *) (a), (val))
+//#define RSN_SELECTOR_PUT(a, val) WPA_PUT_LE32((u8 *) (a), (val))
+
+
+
+/* Action category code */
+enum ieee80211_category {
+	WLAN_CATEGORY_SPECTRUM_MGMT = 0,
+	WLAN_CATEGORY_QOS = 1,
+	WLAN_CATEGORY_DLS = 2,
+	WLAN_CATEGORY_BACK = 3,
+	WLAN_CATEGORY_HT = 7,
+	WLAN_CATEGORY_WMM = 17,
+};
+
+/* SPECTRUM_MGMT action code */
+enum ieee80211_spectrum_mgmt_actioncode {
+	WLAN_ACTION_SPCT_MSR_REQ = 0,
+	WLAN_ACTION_SPCT_MSR_RPRT = 1,
+	WLAN_ACTION_SPCT_TPC_REQ = 2,
+	WLAN_ACTION_SPCT_TPC_RPRT = 3,
+	WLAN_ACTION_SPCT_CHL_SWITCH = 4,
+	WLAN_ACTION_SPCT_EXT_CHL_SWITCH = 5,
+};
+
+/* BACK action code */
+enum ieee80211_back_actioncode {
+	WLAN_ACTION_ADDBA_REQ = 0,
+	WLAN_ACTION_ADDBA_RESP = 1,
+	WLAN_ACTION_DELBA = 2,
+};
+
+/* HT features action code */
+enum ieee80211_ht_actioncode {
+	WLAN_ACTION_NOTIFY_CH_WIDTH = 0,
+       WLAN_ACTION_SM_PS = 1,
+       WLAN_ACTION_PSPM = 2,
+       WLAN_ACTION_PCO_PHASE = 3,
+       WLAN_ACTION_MIMO_CSI_MX = 4,
+       WLAN_ACTION_MIMO_NONCP_BF = 5,
+       WLAN_ACTION_MIMP_CP_BF = 6,
+       WLAN_ACTION_ASEL_INDICATES_FB = 7,
+       WLAN_ACTION_HI_INFO_EXCHG = 8,
+};
+
+/* BACK (block-ack) parties */
+enum ieee80211_back_parties {
+	WLAN_BACK_RECIPIENT = 0,
+	WLAN_BACK_INITIATOR = 1,
+	WLAN_BACK_TIMER = 2,
+};
+
+#ifdef PLATFORM_LINUX
+
+struct ieee80211_mgmt {
+	u16 frame_control;
+	u16 duration;
+	u8 da[6];
+	u8 sa[6];
+	u8 bssid[6];
+	u16 seq_ctrl;
+	union {
+		struct {
+			u16 auth_alg;
+			u16 auth_transaction;
+			u16 status_code;
+			/* possibly followed by Challenge text */
+			u8 variable[0];
+		}  __attribute__ ((packed)) auth;
+		struct {
+			u16 reason_code;
+		}  __attribute__ ((packed)) deauth;
+		struct {
+			u16 capab_info;
+			u16 listen_interval;
+			/* followed by SSID and Supported rates */
+			u8 variable[0];
+		}  __attribute__ ((packed)) assoc_req;
+		struct {
+			u16 capab_info;
+			u16 status_code;
+			u16 aid;
+			/* followed by Supported rates */
+			u8 variable[0];
+		}  __attribute__ ((packed)) assoc_resp, reassoc_resp;
+		struct {
+			u16 capab_info;
+			u16 listen_interval;
+			u8 current_ap[6];
+			/* followed by SSID and Supported rates */
+			u8 variable[0];
+		}  __attribute__ ((packed)) reassoc_req;
+		struct {
+			u16 reason_code;
+		}  __attribute__ ((packed)) disassoc;
+		struct {
+			__le64 timestamp;
+			u16 beacon_int;
+			u16 capab_info;
+			/* followed by some of SSID, Supported rates,
+			 * FH Params, DS Params, CF Params, IBSS Params, TIM */
+			u8 variable[0];
+		}  __attribute__ ((packed)) beacon;
+		struct {
+			/* only variable items: SSID, Supported rates */
+			u8 variable[0];
+		}  __attribute__ ((packed)) probe_req;
+		struct {
+			__le64 timestamp;
+			u16 beacon_int;
+			u16 capab_info;
+			/* followed by some of SSID, Supported rates,
+			 * FH Params, DS Params, CF Params, IBSS Params */
+			u8 variable[0];
+		}  __attribute__ ((packed)) probe_resp;
+		struct {
+			u8 category;
+			union {
+				struct {
+					u8 action_code;
+					u8 dialog_token;
+					u8 status_code;
+					u8 variable[0];
+				}  __attribute__ ((packed)) wme_action;
+#if 0
+				struct{
+					u8 action_code;
+					u8 element_id;
+					u8 length;
+					struct ieee80211_channel_sw_ie sw_elem;
+				}  __attribute__ ((packed)) chan_switch;
+				struct{
+					u8 action_code;
+					u8 dialog_token;
+					u8 element_id;
+					u8 length;
+					struct ieee80211_msrment_ie msr_elem;
+				}  __attribute__ ((packed)) measurement;
+#endif
+				struct{
+					u8 action_code;
+					u8 dialog_token;
+					u16 capab;
+					u16 timeout;
+					u16 start_seq_num;
+				}  __attribute__ ((packed)) addba_req;
+				struct{
+					u8 action_code;
+					u8 dialog_token;
+					u16 status;
+					u16 capab;
+					u16 timeout;
+				}  __attribute__ ((packed)) addba_resp;
+				struct{
+					u8 action_code;
+					u16 params;
+					u16 reason_code;
+				}  __attribute__ ((packed)) delba;
+				struct{
+					u8 action_code;
+					/* capab_info for open and confirm,
+					 * reason for close
+					 */
+					u16 aux;
+					/* Followed in plink_confirm by status
+					 * code, AID and supported rates,
+					 * and directly by supported rates in
+					 * plink_open and plink_close
+					 */
+					u8 variable[0];
+				}  __attribute__ ((packed)) plink_action;
+				struct{
+					u8 action_code;
+					u8 variable[0];
+				}  __attribute__ ((packed)) mesh_action;
+			} __attribute__ ((packed)) u;
+		}  __attribute__ ((packed)) action;
+	} __attribute__ ((packed)) u;
+}__attribute__ ((packed));
+
+#endif
+
+
+#ifdef PLATFORM_WINDOWS
+
+#pragma pack(1)
+
+struct ieee80211_mgmt {
+	u16 frame_control;
+	u16 duration;
+	u8 da[6];
+	u8 sa[6];
+	u8 bssid[6];
+	u16 seq_ctrl;
+	union {
+		struct {
+			u16 auth_alg;
+			u16 auth_transaction;
+			u16 status_code;
+			/* possibly followed by Challenge text */
+			u8 variable[0];
+		}  auth;
+		struct {
+			u16 reason_code;
+		}  deauth;
+		struct {
+			u16 capab_info;
+			u16 listen_interval;
+			/* followed by SSID and Supported rates */
+			u8 variable[0];
+		}  assoc_req;
+		struct {
+			u16 capab_info;
+			u16 status_code;
+			u16 aid;
+			/* followed by Supported rates */
+			u8 variable[0];
+		}  assoc_resp, reassoc_resp;
+		struct {
+			u16 capab_info;
+			u16 listen_interval;
+			u8 current_ap[6];
+			/* followed by SSID and Supported rates */
+			u8 variable[0];
+		}  reassoc_req;
+		struct {
+			u16 reason_code;
+		}  disassoc;
+#if 0
+		struct {
+			__le64 timestamp;
+			u16 beacon_int;
+			u16 capab_info;
+			/* followed by some of SSID, Supported rates,
+			 * FH Params, DS Params, CF Params, IBSS Params, TIM */
+			u8 variable[0];
+		}  beacon;
+		struct {
+			/* only variable items: SSID, Supported rates */
+			u8 variable[0];
+		}  probe_req;
+
+		struct {
+			__le64 timestamp;
+			u16 beacon_int;
+			u16 capab_info;
+			/* followed by some of SSID, Supported rates,
+			 * FH Params, DS Params, CF Params, IBSS Params */
+			u8 variable[0];
+		}  probe_resp;
+#endif
+		struct {
+			u8 category;
+			union {
+				struct {
+					u8 action_code;
+					u8 dialog_token;
+					u8 status_code;
+					u8 variable[0];
+				}  wme_action;
+/*
+				struct{
+					u8 action_code;
+					u8 element_id;
+					u8 length;
+					struct ieee80211_channel_sw_ie sw_elem;
+				}  chan_switch;
+				struct{
+					u8 action_code;
+					u8 dialog_token;
+					u8 element_id;
+					u8 length;
+					struct ieee80211_msrment_ie msr_elem;
+				}  measurement;
+*/
+				struct{
+					u8 action_code;
+					u8 dialog_token;
+					u16 capab;
+					u16 timeout;
+					u16 start_seq_num;
+				}  addba_req;
+				struct{
+					u8 action_code;
+					u8 dialog_token;
+					u16 status;
+					u16 capab;
+					u16 timeout;
+				}  addba_resp;
+				struct{
+					u8 action_code;
+					u16 params;
+					u16 reason_code;
+				}  delba;
+				struct{
+					u8 action_code;
+					/* capab_info for open and confirm,
+					 * reason for close
+					 */
+					u16 aux;
+					/* Followed in plink_confirm by status
+					 * code, AID and supported rates,
+					 * and directly by supported rates in
+					 * plink_open and plink_close
+					 */
+					u8 variable[0];
+				}  plink_action;
+				struct{
+					u8 action_code;
+					u8 variable[0];
+				}  mesh_action;
+			} u;
+		}  action;
+	} u;
+} ;
+
+#pragma pack()
+
+#endif
+
+/* mgmt header + 1 byte category code */
+#define IEEE80211_MIN_ACTION_SIZE FIELD_OFFSET(struct ieee80211_mgmt, u.action.u)
+
+
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/if_ether.h b/drivers/net/wireless/realtek/rtl8192cu/include/if_ether.h
new file mode 100644
index 000000000000..c81c536b2060
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/if_ether.h
@@ -0,0 +1,112 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#ifndef _LINUX_IF_ETHER_H
+#define _LINUX_IF_ETHER_H
+
+/*
+ *	IEEE 802.3 Ethernet magic constants.  The frame sizes omit the preamble
+ *	and FCS/CRC (frame check sequence).
+ */
+
+#define ETH_ALEN	6		/* Octets in one ethernet addr	 */
+#define ETH_HLEN	14		/* Total octets in header.	 */
+#define ETH_ZLEN	60		/* Min. octets in frame sans FCS */
+#define ETH_DATA_LEN	1500		/* Max. octets in payload	 */
+#define ETH_FRAME_LEN	1514		/* Max. octets in frame sans FCS */
+
+/*
+ *	These are the defined Ethernet Protocol ID's.
+ */
+
+#define ETH_P_LOOP	0x0060		/* Ethernet Loopback packet	*/
+#define ETH_P_PUP	0x0200		/* Xerox PUP packet		*/
+#define ETH_P_PUPAT	0x0201		/* Xerox PUP Addr Trans packet	*/
+#define ETH_P_IP	0x0800		/* Internet Protocol packet	*/
+#define ETH_P_X25	0x0805		/* CCITT X.25			*/
+#define ETH_P_ARP	0x0806		/* Address Resolution packet	*/
+#define	ETH_P_BPQ	0x08FF		/* G8BPQ AX.25 Ethernet Packet	[ NOT AN OFFICIALLY REGISTERED ID ] */
+#define ETH_P_IEEEPUP	0x0a00		/* Xerox IEEE802.3 PUP packet */
+#define ETH_P_IEEEPUPAT	0x0a01		/* Xerox IEEE802.3 PUP Addr Trans packet */
+#define ETH_P_DEC       0x6000          /* DEC Assigned proto           */
+#define ETH_P_DNA_DL    0x6001          /* DEC DNA Dump/Load            */
+#define ETH_P_DNA_RC    0x6002          /* DEC DNA Remote Console       */
+#define ETH_P_DNA_RT    0x6003          /* DEC DNA Routing              */
+#define ETH_P_LAT       0x6004          /* DEC LAT                      */
+#define ETH_P_DIAG      0x6005          /* DEC Diagnostics              */
+#define ETH_P_CUST      0x6006          /* DEC Customer use             */
+#define ETH_P_SCA       0x6007          /* DEC Systems Comms Arch       */
+#define ETH_P_RARP      0x8035		/* Reverse Addr Res packet	*/
+#define ETH_P_ATALK	0x809B		/* Appletalk DDP		*/
+#define ETH_P_AARP	0x80F3		/* Appletalk AARP		*/
+#define ETH_P_8021Q	0x8100          /* 802.1Q VLAN Extended Header  */
+#define ETH_P_IPX	0x8137		/* IPX over DIX			*/
+#define ETH_P_IPV6	0x86DD		/* IPv6 over bluebook		*/
+#define ETH_P_PPP_DISC	0x8863		/* PPPoE discovery messages     */
+#define ETH_P_PPP_SES	0x8864		/* PPPoE session messages	*/
+#define ETH_P_ATMMPOA	0x884c		/* MultiProtocol Over ATM	*/
+#define ETH_P_ATMFATE	0x8884		/* Frame-based ATM Transport
+					 * over Ethernet
+					 */
+
+/*
+ *	Non DIX types. Won't clash for 1500 types.
+ */
+
+#define ETH_P_802_3	0x0001		/* Dummy type for 802.3 frames  */
+#define ETH_P_AX25	0x0002		/* Dummy protocol id for AX.25  */
+#define ETH_P_ALL	0x0003		/* Every packet (be careful!!!) */
+#define ETH_P_802_2	0x0004		/* 802.2 frames 		*/
+#define ETH_P_SNAP	0x0005		/* Internal only		*/
+#define ETH_P_DDCMP     0x0006          /* DEC DDCMP: Internal only     */
+#define ETH_P_WAN_PPP   0x0007          /* Dummy type for WAN PPP frames*/
+#define ETH_P_PPP_MP    0x0008          /* Dummy type for PPP MP frames */
+#define ETH_P_LOCALTALK 0x0009		/* Localtalk pseudo type 	*/
+#define ETH_P_PPPTALK	0x0010		/* Dummy type for Atalk over PPP*/
+#define ETH_P_TR_802_2	0x0011		/* 802.2 frames 		*/
+#define ETH_P_MOBITEX	0x0015		/* Mobitex (kaz@cafe.net)	*/
+#define ETH_P_CONTROL	0x0016		/* Card specific control frames */
+#define ETH_P_IRDA	0x0017		/* Linux-IrDA			*/
+#define ETH_P_ECONET	0x0018		/* Acorn Econet			*/
+
+/*
+ *	This is an Ethernet frame header.
+ */
+
+struct ethhdr
+{
+	unsigned char	h_dest[ETH_ALEN];	/* destination eth addr	*/
+	unsigned char	h_source[ETH_ALEN];	/* source ether addr	*/
+	unsigned short	h_proto;		/* packet type ID field	*/
+};
+
+struct _vlan {
+   unsigned short       h_vlan_TCI;                // Encapsulates priority and VLAN ID
+   unsigned short       h_vlan_encapsulated_proto;
+};
+
+
+
+#define get_vlan_id(pvlan) ((ntohs((unsigned short )pvlan->h_vlan_TCI)) & 0xfff)
+#define get_vlan_priority(pvlan) ((ntohs((unsigned short )pvlan->h_vlan_TCI))>>13)
+#define get_vlan_encap_proto(pvlan) (ntohs((unsigned short )pvlan->h_vlan_encapsulated_proto))
+
+
+#endif	/* _LINUX_IF_ETHER_H */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/ioctl_cfg80211.h b/drivers/net/wireless/realtek/rtl8192cu/include/ioctl_cfg80211.h
new file mode 100644
index 000000000000..610252758582
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/ioctl_cfg80211.h
@@ -0,0 +1,186 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __IOCTL_CFG80211_H__
+#define __IOCTL_CFG80211_H__
+
+#if defined(CONFIG_IOCTL_CFG80211) && !defined(CONFIG_CFG80211) && !defined(CONFIG_CFG80211_MODULE)
+	#error "Can't define CONFIG_IOCTL_CFG80211 because neither CONFIG_CFG80211 nor CONFIG_CFG80211_MODULE is defined in kernel"
+#endif
+#if defined(CONFIG_IOCTL_CFG80211) && LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35)
+	#error "We haven't verify our cfg80211 solution below kernel version 2.6.35"
+#endif
+
+#if defined(RTW_USE_CFG80211_STA_EVENT)
+	#undef CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER
+#endif
+
+struct rtw_wdev_invit_info {
+	u8 state; /* 0: req, 1:rep */
+	u8 peer_mac[ETH_ALEN];
+	u8 active;
+	u8 token;
+	u8 flags;
+	u8 status;
+	u8 req_op_ch;
+	u8 rsp_op_ch;
+};
+
+#define rtw_wdev_invit_info_init(invit_info) \
+	do { \
+		(invit_info)->state = 0xff; \
+		_rtw_memset((invit_info)->peer_mac, 0, ETH_ALEN); \
+		(invit_info)->active = 0xff; \
+		(invit_info)->token = 0; \
+		(invit_info)->flags = 0x00; \
+		(invit_info)->status = 0xff; \
+		(invit_info)->req_op_ch = 0; \
+		(invit_info)->rsp_op_ch = 0; \
+	} while (0)
+
+struct rtw_wdev_nego_info {
+	u8 state; /* 0: req, 1:rep, 3:conf */
+	u8 peer_mac[ETH_ALEN];
+	u8 active;
+	u8 token;
+	u8 status;
+	u8 req_intent;
+	u8 req_op_ch;
+	u8 req_listen_ch;
+	u8 rsp_intent;
+	u8 rsp_op_ch;
+	u8 conf_op_ch;
+};
+
+#define rtw_wdev_nego_info_init(nego_info) \
+	do { \
+		(nego_info)->state = 0xff; \
+		_rtw_memset((nego_info)->peer_mac, 0, ETH_ALEN); \
+		(nego_info)->active = 0xff; \
+		(nego_info)->token = 0; \
+		(nego_info)->status = 0xff; \
+		(nego_info)->req_intent = 0xff; \
+		(nego_info)->req_op_ch = 0; \
+		(nego_info)->req_listen_ch = 0; \
+		(nego_info)->rsp_intent = 0xff; \
+		(nego_info)->rsp_op_ch = 0; \
+		(nego_info)->conf_op_ch = 0; \
+	} while (0)
+
+struct rtw_wdev_priv
+{
+	struct wireless_dev *rtw_wdev;
+
+	_adapter *padapter;
+
+	struct cfg80211_scan_request *scan_request;
+	_lock scan_req_lock;
+
+	struct net_device *pmon_ndev;//for monitor interface
+	char ifname_mon[IFNAMSIZ + 1]; //interface name for monitor interface
+
+	u8 p2p_enabled;
+
+	u8 provdisc_req_issued;
+
+	struct rtw_wdev_invit_info invit_info;
+	struct rtw_wdev_nego_info nego_info;
+
+	u8 bandroid_scan;
+	bool block;
+	bool power_mgmt;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	ATOMIC_T ro_ch_to;
+	ATOMIC_T switch_ch_to;
+#endif
+
+};
+
+#define wdev_to_priv(w) ((struct rtw_wdev_priv *)(wdev_priv(w)))
+
+#define wiphy_to_adapter(x) (_adapter *)(((struct rtw_wdev_priv*)wiphy_priv(x))->padapter)
+
+#define wiphy_to_wdev(x) (struct wireless_dev *)(((struct rtw_wdev_priv*)wiphy_priv(x))->rtw_wdev)
+
+int rtw_wdev_alloc(_adapter *padapter, struct device *dev);
+void rtw_wdev_free(struct wireless_dev *wdev);
+void rtw_wdev_unregister(struct wireless_dev *wdev);
+
+void rtw_cfg80211_init_wiphy(_adapter *padapter);
+
+void rtw_cfg80211_surveydone_event_callback(_adapter *padapter);
+int rtw_cfg80211_check_bss(_adapter *padapter);
+void rtw_cfg80211_indicate_connect(_adapter *padapter);
+void rtw_cfg80211_indicate_disconnect(_adapter *padapter);
+void rtw_cfg80211_indicate_scan_done(struct rtw_wdev_priv *pwdev_priv, bool aborted);
+
+#ifdef CONFIG_AP_MODE
+void rtw_cfg80211_indicate_sta_assoc(_adapter *padapter, u8 *pmgmt_frame, uint frame_len);
+void rtw_cfg80211_indicate_sta_disassoc(_adapter *padapter, unsigned char *da, unsigned short reason);
+#endif //CONFIG_AP_MODE
+
+void rtw_cfg80211_issue_p2p_provision_request(_adapter *padapter, const u8 *buf, size_t len);
+void rtw_cfg80211_rx_p2p_action_public(_adapter *padapter, u8 *pmgmt_frame, uint frame_len);
+void rtw_cfg80211_rx_action_p2p(_adapter *padapter, u8 *pmgmt_frame, uint frame_len);
+void rtw_cfg80211_rx_action(_adapter *adapter, u8 *frame, uint frame_len, const char*msg);
+
+int rtw_cfg80211_set_mgnt_wpsp2pie(struct net_device *net, char *buf, int len, int type);
+
+bool rtw_cfg80211_pwr_mgmt(_adapter *adapter);
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,4,0))  && !defined(COMPAT_KERNEL_RELEASE)
+#define rtw_cfg80211_rx_mgmt(adapter, freq, sig_dbm, buf, len, gfp) cfg80211_rx_mgmt((adapter)->pnetdev, freq, buf, len, gfp)
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
+#define rtw_cfg80211_rx_mgmt(adapter, freq, sig_dbm, buf, len, gfp) cfg80211_rx_mgmt((adapter)->pnetdev, freq, sig_dbm, buf, len, gfp)
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(3,12,0))
+#define rtw_cfg80211_rx_mgmt(adapter, freq, sig_dbm, buf, len, gfp) cfg80211_rx_mgmt((adapter)->rtw_wdev, freq, sig_dbm, buf, len, gfp)
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(3,18,0))
+/* 3.12 added a flags argument which is just set to zero*/
+#define rtw_cfg80211_rx_mgmt(adapter, freq, sig_dbm, buf, len, gfp) \
+	cfg80211_rx_mgmt((adapter)->rtw_wdev, freq, sig_dbm, buf, len, 0, gfp)
+#else
+#define rtw_cfg80211_rx_mgmt(adapter, freq, sig_dbm, buf, len, gfp) \
+	cfg80211_rx_mgmt((adapter)->rtw_wdev, freq, sig_dbm, buf, len, 0)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,4,0))  && !defined(COMPAT_KERNEL_RELEASE)
+#define rtw_cfg80211_send_rx_assoc(adapter, bss, buf, len) cfg80211_send_rx_assoc((adapter)->pnetdev, buf, len)
+#else
+#define rtw_cfg80211_send_rx_assoc(adapter, bss, buf, len) cfg80211_send_rx_assoc((adapter)->pnetdev, bss, buf, len)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
+#define rtw_cfg80211_mgmt_tx_status(adapter, cookie, buf, len, ack, gfp) cfg80211_mgmt_tx_status((adapter)->pnetdev, cookie, buf, len, ack, gfp)
+#else
+#define rtw_cfg80211_mgmt_tx_status(adapter, cookie, buf, len, ack, gfp) cfg80211_mgmt_tx_status((adapter)->rtw_wdev, cookie, buf, len, ack, gfp)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,6,0))
+#define rtw_cfg80211_ready_on_channel(adapter, cookie, chan, channel_type, duration, gfp)  cfg80211_ready_on_channel((adapter)->pnetdev, cookie, chan, channel_type, duration, gfp)
+#define rtw_cfg80211_remain_on_channel_expired(adapter, cookie, chan, chan_type, gfp) cfg80211_remain_on_channel_expired((adapter)->pnetdev, cookie, chan, chan_type, gfp)
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
+#define rtw_cfg80211_ready_on_channel(adapter, cookie, chan, channel_type, duration, gfp)  cfg80211_ready_on_channel((adapter)->rtw_wdev, cookie, chan, channel_type, duration, gfp)
+#define rtw_cfg80211_remain_on_channel_expired(adapter, cookie, chan, chan_type, gfp) cfg80211_remain_on_channel_expired((adapter)->rtw_wdev, cookie, chan, chan_type, gfp)
+#else
+#define rtw_cfg80211_ready_on_channel(adapter, cookie, chan, channel_type, duration, gfp)  cfg80211_ready_on_channel((adapter)->rtw_wdev, cookie, chan, duration, gfp)
+#define rtw_cfg80211_remain_on_channel_expired(adapter, cookie, chan, chan_type, gfp) cfg80211_remain_on_channel_expired((adapter)->rtw_wdev, cookie, chan, gfp)
+#endif
+
+#endif //__IOCTL_CFG80211_H__
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/ip.h b/drivers/net/wireless/realtek/rtl8192cu/include/ip.h
new file mode 100644
index 000000000000..2c3d2f350998
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/ip.h
@@ -0,0 +1,141 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _LINUX_IP_H
+#define _LINUX_IP_H
+#include <rtw_byteorder.h>
+
+/* SOL_IP socket options */
+
+#define IPTOS_TOS_MASK		0x1E
+#define IPTOS_TOS(tos)		((tos)&IPTOS_TOS_MASK)
+#define	IPTOS_LOWDELAY		0x10
+#define	IPTOS_THROUGHPUT	0x08
+#define	IPTOS_RELIABILITY	0x04
+#define	IPTOS_MINCOST		0x02
+
+#define IPTOS_PREC_MASK		0xE0
+#define IPTOS_PREC(tos)		((tos)&IPTOS_PREC_MASK)
+#define IPTOS_PREC_NETCONTROL           0xe0
+#define IPTOS_PREC_INTERNETCONTROL      0xc0
+#define IPTOS_PREC_CRITIC_ECP           0xa0
+#define IPTOS_PREC_FLASHOVERRIDE        0x80
+#define IPTOS_PREC_FLASH                0x60
+#define IPTOS_PREC_IMMEDIATE            0x40
+#define IPTOS_PREC_PRIORITY             0x20
+#define IPTOS_PREC_ROUTINE              0x00
+
+
+/* IP options */
+#define IPOPT_COPY		0x80
+#define IPOPT_CLASS_MASK	0x60
+#define IPOPT_NUMBER_MASK	0x1f
+
+#define	IPOPT_COPIED(o)		((o)&IPOPT_COPY)
+#define	IPOPT_CLASS(o)		((o)&IPOPT_CLASS_MASK)
+#define	IPOPT_NUMBER(o)		((o)&IPOPT_NUMBER_MASK)
+
+#define	IPOPT_CONTROL		0x00
+#define	IPOPT_RESERVED1		0x20
+#define	IPOPT_MEASUREMENT	0x40
+#define	IPOPT_RESERVED2		0x60
+
+#define IPOPT_END	(0 |IPOPT_CONTROL)
+#define IPOPT_NOOP	(1 |IPOPT_CONTROL)
+#define IPOPT_SEC	(2 |IPOPT_CONTROL|IPOPT_COPY)
+#define IPOPT_LSRR	(3 |IPOPT_CONTROL|IPOPT_COPY)
+#define IPOPT_TIMESTAMP	(4 |IPOPT_MEASUREMENT)
+#define IPOPT_RR	(7 |IPOPT_CONTROL)
+#define IPOPT_SID	(8 |IPOPT_CONTROL|IPOPT_COPY)
+#define IPOPT_SSRR	(9 |IPOPT_CONTROL|IPOPT_COPY)
+#define IPOPT_RA	(20|IPOPT_CONTROL|IPOPT_COPY)
+
+#define IPVERSION	4
+#define MAXTTL		255
+#define IPDEFTTL	64
+
+/* struct timestamp, struct route and MAX_ROUTES are removed.
+
+   REASONS: it is clear that nobody used them because:
+   - MAX_ROUTES value was wrong.
+   - "struct route" was wrong.
+   - "struct timestamp" had fatally misaligned bitfields and was completely unusable.
+ */
+
+#define IPOPT_OPTVAL 0
+#define IPOPT_OLEN   1
+#define IPOPT_OFFSET 2
+#define IPOPT_MINOFF 4
+#define MAX_IPOPTLEN 40
+#define IPOPT_NOP IPOPT_NOOP
+#define IPOPT_EOL IPOPT_END
+#define IPOPT_TS  IPOPT_TIMESTAMP
+
+#define	IPOPT_TS_TSONLY		0		/* timestamps only */
+#define	IPOPT_TS_TSANDADDR	1		/* timestamps and addresses */
+#define	IPOPT_TS_PRESPEC	3		/* specified modules only */
+
+#ifdef PLATFORM_LINUX
+
+struct ip_options {
+  __u32		faddr;				/* Saved first hop address */
+  unsigned char	optlen;
+  unsigned char srr;
+  unsigned char rr;
+  unsigned char ts;
+  unsigned char is_setbyuser:1,			/* Set by setsockopt?			*/
+                is_data:1,			/* Options in __data, rather than skb	*/
+                is_strictroute:1,		/* Strict source route			*/
+                srr_is_hit:1,			/* Packet destination addr was our one	*/
+                is_changed:1,			/* IP checksum more not valid		*/
+                rr_needaddr:1,			/* Need to record addr of outgoing dev	*/
+                ts_needtime:1,			/* Need to record timestamp		*/
+                ts_needaddr:1;			/* Need to record addr of outgoing dev  */
+  unsigned char router_alert;
+  unsigned char __pad1;
+  unsigned char __pad2;
+  unsigned char __data[0];
+};
+
+#define optlength(opt) (sizeof(struct ip_options) + opt->optlen)
+#endif
+
+struct iphdr {
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+	__u8	ihl:4,
+		version:4;
+#elif defined (__BIG_ENDIAN_BITFIELD)
+	__u8	version:4,
+		ihl:4;
+#else
+#error	"Please fix <asm/byteorder.h>"
+#endif
+	__u8	tos;
+	__u16	tot_len;
+	__u16	id;
+	__u16	frag_off;
+	__u8	ttl;
+	__u8	protocol;
+	__u16	check;
+	__u32	saddr;
+	__u32	daddr;
+	/*The options start here. */
+};
+
+#endif	/* _LINUX_IP_H */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/linux/wireless.h b/drivers/net/wireless/realtek/rtl8192cu/include/linux/wireless.h
new file mode 100644
index 000000000000..036fc3275f58
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/linux/wireless.h
@@ -0,0 +1,90 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#ifndef _LINUX_WIRELESS_H
+#define _LINUX_WIRELESS_H
+
+/***************************** INCLUDES *****************************/
+
+#if 0
+#include <linux/types.h>		/* for __u* and __s* typedefs */
+#include <linux/socket.h>		/* for "struct sockaddr" et al	*/
+#include <linux/if.h>			/* for IFNAMSIZ and co... */
+#else
+#define __user
+//typedef uint16_t	__u16;
+#include <sys/socket.h>			/* for "struct sockaddr" et al	*/
+#include <net/if.h>			/* for IFNAMSIZ and co... */
+#endif
+
+/****************************** TYPES ******************************/
+
+/* --------------------------- SUBTYPES --------------------------- */
+/*
+ *	For all data larger than 16 octets, we need to use a
+ *	pointer to memory allocated in user space.
+ */
+struct	iw_point
+{
+  void __user	*pointer;	/* Pointer to the data  (in user space) */
+  __u16		length;		/* number of fields or size in bytes */
+  __u16		flags;		/* Optional params */
+};
+
+
+/* ------------------------ IOCTL REQUEST ------------------------ */
+/*
+ * This structure defines the payload of an ioctl, and is used
+ * below.
+ *
+ * Note that this structure should fit on the memory footprint
+ * of iwreq (which is the same as ifreq), which mean a max size of
+ * 16 octets = 128 bits. Warning, pointers might be 64 bits wide...
+ * You should check this when increasing the structures defined
+ * above in this file...
+ */
+union	iwreq_data
+{
+	/* Config - generic */
+	char		name[IFNAMSIZ];
+	/* Name : used to verify the presence of  wireless extensions.
+	 * Name of the protocol/provider... */
+
+	struct iw_point	data;		/* Other large parameters */
+};
+
+/*
+ * The structure to exchange data for ioctl.
+ * This structure is the same as 'struct ifreq', but (re)defined for
+ * convenience...
+ * Do I need to remind you about structure size (32 octets) ?
+ */
+struct	iwreq
+{
+	union
+	{
+		char	ifrn_name[IFNAMSIZ];	/* if name, e.g. "eth0" */
+	} ifr_ifrn;
+
+	/* Data part (defined just above) */
+	union	iwreq_data	u;
+};
+
+#endif	/* _LINUX_WIRELESS_H */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/mlme_osdep.h b/drivers/net/wireless/realtek/rtl8192cu/include/mlme_osdep.h
new file mode 100644
index 000000000000..383fc386f803
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/mlme_osdep.h
@@ -0,0 +1,39 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef	__MLME_OSDEP_H_
+#define __MLME_OSDEP_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#if defined(PLATFORM_WINDOWS) || defined(PLATFORM_MPIXEL)
+extern int time_after(u32 now, u32 old);
+#endif
+
+extern void rtw_init_mlme_timer(_adapter *padapter);
+extern void rtw_os_indicate_disconnect( _adapter *adapter );
+extern void rtw_os_indicate_connect( _adapter *adapter );
+void rtw_os_indicate_scan_done( _adapter *padapter, bool aborted);
+extern void rtw_report_sec_ie(_adapter *adapter,u8 authmode,u8 *sec_ie);
+
+void rtw_reset_securitypriv( _adapter *adapter );
+
+#endif	//_MLME_OSDEP_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/mp_custom_oid.h b/drivers/net/wireless/realtek/rtl8192cu/include/mp_custom_oid.h
new file mode 100644
index 000000000000..9c9c69b7183d
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/mp_custom_oid.h
@@ -0,0 +1,353 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef	__CUSTOM_OID_H
+#define __CUSTOM_OID_H
+
+// by Owen
+// 0xFF818000 - 0xFF81802F		RTL8180 Mass Production Kit
+// 0xFF818500 - 0xFF81850F		RTL8185 Setup Utility
+// 0xFF818580 - 0xFF81858F		RTL8185 Phy Status Utility
+
+//
+
+// by Owen for Production Kit
+// For Production Kit with Agilent Equipments
+// in order to make our custom oids hopefully somewhat unique
+// we will use 0xFF (indicating implementation specific OID)
+//               81(first byte of non zero Realtek unique identifier)
+//               80 (second byte of non zero Realtek unique identifier)
+//               XX (the custom OID number - providing 255 possible custom oids)
+
+#define OID_RT_PRO_RESET_DUT				0xFF818000
+#define OID_RT_PRO_SET_DATA_RATE			0xFF818001
+#define OID_RT_PRO_START_TEST				0xFF818002
+#define OID_RT_PRO_STOP_TEST    			0xFF818003
+#define OID_RT_PRO_SET_PREAMBLE				0xFF818004
+#define OID_RT_PRO_SET_SCRAMBLER			0xFF818005
+#define OID_RT_PRO_SET_FILTER_BB			0xFF818006
+#define OID_RT_PRO_SET_MANUAL_DIVERSITY_BB		0xFF818007
+#define OID_RT_PRO_SET_CHANNEL_DIRECT_CALL		0xFF818008
+#define OID_RT_PRO_SET_SLEEP_MODE_DIRECT_CALL		0xFF818009
+#define OID_RT_PRO_SET_WAKE_MODE_DIRECT_CALL		0xFF81800A
+
+#define OID_RT_PRO_SET_TX_ANTENNA_BB			0xFF81800D
+#define OID_RT_PRO_SET_ANTENNA_BB			0xFF81800E
+#define OID_RT_PRO_SET_CR_SCRAMBLER			0xFF81800F
+#define OID_RT_PRO_SET_CR_NEW_FILTER			0xFF818010
+#define OID_RT_PRO_SET_TX_POWER_CONTROL			0xFF818011
+#define OID_RT_PRO_SET_CR_TX_CONFIG			0xFF818012
+#define OID_RT_PRO_GET_TX_POWER_CONTROL			0xFF818013
+#define OID_RT_PRO_GET_CR_SIGNAL_QUALITY		0xFF818014
+#define OID_RT_PRO_SET_CR_SETPOINT			0xFF818015
+#define OID_RT_PRO_SET_INTEGRATOR			0xFF818016
+#define OID_RT_PRO_SET_SIGNAL_QUALITY			0xFF818017
+#define OID_RT_PRO_GET_INTEGRATOR			0xFF818018
+#define OID_RT_PRO_GET_SIGNAL_QUALITY			0xFF818019
+#define OID_RT_PRO_QUERY_EEPROM_TYPE			0xFF81801A
+#define OID_RT_PRO_WRITE_MAC_ADDRESS			0xFF81801B
+#define OID_RT_PRO_READ_MAC_ADDRESS			0xFF81801C
+#define OID_RT_PRO_WRITE_CIS_DATA			0xFF81801D
+#define OID_RT_PRO_READ_CIS_DATA			0xFF81801E
+#define OID_RT_PRO_WRITE_POWER_CONTROL			0xFF81801F
+#define OID_RT_PRO_READ_POWER_CONTROL			0xFF818020
+#define OID_RT_PRO_WRITE_EEPROM				0xFF818021
+#define OID_RT_PRO_READ_EEPROM				0xFF818022
+#define OID_RT_PRO_RESET_TX_PACKET_SENT			0xFF818023
+#define OID_RT_PRO_QUERY_TX_PACKET_SENT			0xFF818024
+#define OID_RT_PRO_RESET_RX_PACKET_RECEIVED		0xFF818025
+#define OID_RT_PRO_QUERY_RX_PACKET_RECEIVED		0xFF818026
+#define OID_RT_PRO_QUERY_RX_PACKET_CRC32_ERROR		0xFF818027
+#define OID_RT_PRO_QUERY_CURRENT_ADDRESS		0xFF818028
+#define OID_RT_PRO_QUERY_PERMANENT_ADDRESS		0xFF818029
+#define OID_RT_PRO_SET_PHILIPS_RF_PARAMETERS		0xFF81802A
+#define OID_RT_PRO_RECEIVE_PACKET			0xFF81802C
+// added by Owen on 04/08/03 for Cameo's request
+#define OID_RT_PRO_WRITE_EEPROM_BYTE			0xFF81802D
+#define OID_RT_PRO_READ_EEPROM_BYTE			0xFF81802E
+#define OID_RT_PRO_SET_MODULATION			0xFF81802F
+//
+
+//Sean
+#define OID_RT_DRIVER_OPTION				0xFF818080
+#define OID_RT_RF_OFF					0xFF818081
+#define OID_RT_AUTH_STATUS				0xFF818082
+
+//========================================================================
+#define OID_RT_PRO_SET_CONTINUOUS_TX			0xFF81800B
+#define OID_RT_PRO_SET_SINGLE_CARRIER_TX		0xFF81800C
+#define OID_RT_PRO_SET_CARRIER_SUPPRESSION_TX		0xFF81802B
+#define OID_RT_PRO_SET_SINGLE_TONE_TX			0xFF818043
+//========================================================================
+
+
+// by Owen for RTL8185 Phy Status Report Utility
+#define OID_RT_UTILITY_FALSE_ALARM_COUNTERS				0xFF818580
+#define OID_RT_UTILITY_SELECT_DEBUG_MODE				0xFF818581
+#define OID_RT_UTILITY_SELECT_SUBCARRIER_NUMBER				0xFF818582
+#define OID_RT_UTILITY_GET_RSSI_STATUS					0xFF818583
+#define OID_RT_UTILITY_GET_FRAME_DETECTION_STATUS			0xFF818584
+#define OID_RT_UTILITY_GET_AGC_AND_FREQUENCY_OFFSET_ESTIMATION_STATUS	0xFF818585
+#define OID_RT_UTILITY_GET_CHANNEL_ESTIMATION_STATUS			0xFF818586
+//
+
+// by Owen on 03/09/19-03/09/22 for RTL8185
+#define OID_RT_WIRELESS_MODE				0xFF818500
+#define OID_RT_SUPPORTED_RATES				0xFF818501
+#define OID_RT_DESIRED_RATES				0xFF818502
+#define OID_RT_WIRELESS_MODE_STARTING_ADHOC		0xFF818503
+//
+
+#define OID_RT_GET_CONNECT_STATE                	0xFF030001
+#define OID_RT_RESCAN	                        	0xFF030002
+#define OID_RT_SET_KEY_LENGTH				0xFF030003
+#define OID_RT_SET_DEFAULT_KEY_ID			0xFF030004
+
+#define OID_RT_SET_CHANNEL				0xFF010182
+#define OID_RT_SET_SNIFFER_MODE                 	0xFF010183
+#define OID_RT_GET_SIGNAL_QUALITY               	0xFF010184
+#define OID_RT_GET_SMALL_PACKET_CRC			0xFF010185
+#define OID_RT_GET_MIDDLE_PACKET_CRC			0xFF010186
+#define OID_RT_GET_LARGE_PACKET_CRC			0xFF010187
+#define OID_RT_GET_TX_RETRY				0xFF010188
+#define OID_RT_GET_RX_RETRY				0xFF010189
+#define OID_RT_PRO_SET_FW_DIG_STATE			0xFF01018A//S
+#define OID_RT_PRO_SET_FW_RA_STATE			0xFF01018B//S
+
+#define OID_RT_GET_RX_TOTAL_PACKET			0xFF010190
+#define OID_RT_GET_TX_BEACON_OK				0xFF010191
+#define OID_RT_GET_TX_BEACON_ERR			0xFF010192
+#define OID_RT_GET_RX_ICV_ERR				0xFF010193
+#define OID_RT_SET_ENCRYPTION_ALGORITHM			0xFF010194
+#define OID_RT_SET_NO_AUTO_RESCAN			0xFF010195
+#define OID_RT_GET_PREAMBLE_MODE			0xFF010196
+#define OID_RT_GET_DRIVER_UP_DELTA_TIME			0xFF010197
+#define OID_RT_GET_AP_IP				0xFF010198
+#define OID_RT_GET_CHANNELPLAN				0xFF010199
+#define OID_RT_SET_PREAMBLE_MODE			0xFF01019A
+#define OID_RT_SET_BCN_INTVL				0xFF01019B
+#define OID_RT_GET_RF_VENDER				0xFF01019C
+#define OID_RT_DEDICATE_PROBE				0xFF01019D
+#define OID_RT_PRO_RX_FILTER_PATTERN			0xFF01019E
+
+#define OID_RT_GET_DCST_CURRENT_THRESHOLD		0xFF01019F
+
+#define OID_RT_GET_CCA_ERR				0xFF0101A0
+#define OID_RT_GET_CCA_UPGRADE_THRESHOLD		0xFF0101A1
+#define OID_RT_GET_CCA_FALLBACK_THRESHOLD		0xFF0101A2
+
+#define OID_RT_GET_CCA_UPGRADE_EVALUATE_TIMES		0xFF0101A3
+#define OID_RT_GET_CCA_FALLBACK_EVALUATE_TIMES		0xFF0101A4
+
+// by Owen on 03/31/03 for Cameo's request
+#define OID_RT_SET_RATE_ADAPTIVE			0xFF0101A5
+//
+#define OID_RT_GET_DCST_EVALUATE_PERIOD			0xFF0101A5
+#define OID_RT_GET_DCST_TIME_UNIT_INDEX			0xFF0101A6
+#define OID_RT_GET_TOTAL_TX_BYTES			0xFF0101A7
+#define OID_RT_GET_TOTAL_RX_BYTES			0xFF0101A8
+#define OID_RT_CURRENT_TX_POWER_LEVEL			0xFF0101A9
+#define OID_RT_GET_ENC_KEY_MISMATCH_COUNT		0xFF0101AA
+#define OID_RT_GET_ENC_KEY_MATCH_COUNT			0xFF0101AB
+#define OID_RT_GET_CHANNEL				0xFF0101AC
+
+#define OID_RT_SET_CHANNELPLAN				0xFF0101AD
+#define OID_RT_GET_HARDWARE_RADIO_OFF			0xFF0101AE
+#define OID_RT_CHANNELPLAN_BY_COUNTRY			0xFF0101AF
+#define OID_RT_SCAN_AVAILABLE_BSSID			0xFF0101B0
+#define OID_RT_GET_HARDWARE_VERSION			0xFF0101B1
+#define OID_RT_GET_IS_ROAMING				0xFF0101B2
+#define OID_RT_GET_IS_PRIVACY				0xFF0101B3
+#define OID_RT_GET_KEY_MISMATCH				0xFF0101B4
+#define OID_RT_SET_RSSI_ROAM_TRAFFIC_TH			0xFF0101B5
+#define OID_RT_SET_RSSI_ROAM_SIGNAL_TH			0xFF0101B6
+#define OID_RT_RESET_LOG				0xFF0101B7
+#define OID_RT_GET_LOG					0xFF0101B8
+#define OID_RT_SET_INDICATE_HIDDEN_AP			0xFF0101B9
+#define OID_RT_GET_HEADER_FAIL				0xFF0101BA
+#define OID_RT_SUPPORTED_WIRELESS_MODE			0xFF0101BB
+#define OID_RT_GET_CHANNEL_LIST				0xFF0101BC
+#define OID_RT_GET_SCAN_IN_PROGRESS			0xFF0101BD
+#define OID_RT_GET_TX_INFO				0xFF0101BE
+#define OID_RT_RF_READ_WRITE_OFFSET			0xFF0101BF
+#define OID_RT_RF_READ_WRITE				0xFF0101C0
+
+// For Netgear request. 2005.01.13, by rcnjko.
+#define OID_RT_FORCED_DATA_RATE				0xFF0101C1
+#define OID_RT_WIRELESS_MODE_FOR_SCAN_LIST		0xFF0101C2
+// For Netgear request. 2005.02.17, by rcnjko.
+#define OID_RT_GET_BSS_WIRELESS_MODE			0xFF0101C3
+// For AZ project. 2005.06.27, by rcnjko.
+#define OID_RT_SCAN_WITH_MAGIC_PACKET			0xFF0101C4
+
+// Vincent 8185MP
+#define OID_RT_PRO_RX_FILTER				0xFF0111C0
+
+//Andy TEST
+//#define OID_RT_PRO_WRITE_REGISTRY			0xFF0111C1
+//#define OID_RT_PRO_READ_REGISTRY			0xFF0111C2
+#define OID_CE_USB_WRITE_REGISTRY			0xFF0111C1
+#define OID_CE_USB_READ_REGISTRY			0xFF0111C2
+
+
+#define OID_RT_PRO_SET_INITIAL_GAIN			0xFF0111C3
+#define OID_RT_PRO_SET_BB_RF_STANDBY_MODE		0xFF0111C4
+#define OID_RT_PRO_SET_BB_RF_SHUTDOWN_MODE		0xFF0111C5
+#define OID_RT_PRO_SET_TX_CHARGE_PUMP			0xFF0111C6
+#define OID_RT_PRO_SET_RX_CHARGE_PUMP			0xFF0111C7
+#define OID_RT_PRO_RF_WRITE_REGISTRY			0xFF0111C8
+#define OID_RT_PRO_RF_READ_REGISTRY			0xFF0111C9
+#define OID_RT_PRO_QUERY_RF_TYPE			0xFF0111CA
+
+// AP OID
+#define OID_RT_AP_GET_ASSOCIATED_STATION_LIST		0xFF010300
+#define OID_RT_AP_GET_CURRENT_TIME_STAMP		0xFF010301
+#define OID_RT_AP_SWITCH_INTO_AP_MODE			0xFF010302
+#define OID_RT_AP_SET_DTIM_PERIOD			0xFF010303
+#define OID_RT_AP_SUPPORTED				0xFF010304	// Determine if driver supports AP mode. 2004.08.27, by rcnjko.
+#define OID_RT_AP_SET_PASSPHRASE			0xFF010305	// Set WPA-PSK passphrase into authenticator. 2005.07.08, byrcnjko.
+
+// 8187MP. 2004.09.06, by rcnjko.
+#define OID_RT_PRO8187_WI_POLL				0xFF818780
+#define OID_RT_PRO_WRITE_BB_REG				0xFF818781
+#define OID_RT_PRO_READ_BB_REG				0xFF818782
+#define OID_RT_PRO_WRITE_RF_REG				0xFF818783
+#define OID_RT_PRO_READ_RF_REG				0xFF818784
+
+// Meeting House. added by Annie, 2005-07-20.
+#define OID_RT_MH_VENDER_ID				0xFFEDC100
+
+//8711 MP OID added 20051230.
+#define OID_RT_PRO8711_JOIN_BSS				0xFF871100//S
+
+#define OID_RT_PRO_READ_REGISTER			0xFF871101 //Q
+#define OID_RT_PRO_WRITE_REGISTER			0xFF871102 //S
+
+#define OID_RT_PRO_BURST_READ_REGISTER			0xFF871103 //Q
+#define OID_RT_PRO_BURST_WRITE_REGISTER 		0xFF871104 //S
+
+#define OID_RT_PRO_WRITE_TXCMD				0xFF871105 //S
+
+#define OID_RT_PRO_READ16_EEPROM			0xFF871106 //Q
+#define OID_RT_PRO_WRITE16_EEPROM			0xFF871107 //S
+
+#define OID_RT_PRO_H2C_SET_COMMAND			0xFF871108 //S
+#define OID_RT_PRO_H2C_QUERY_RESULT			0xFF871109 //Q
+
+#define OID_RT_PRO8711_WI_POLL				0xFF87110A //Q
+#define OID_RT_PRO8711_PKT_LOSS				0xFF87110B //Q
+#define OID_RT_RD_ATTRIB_MEM				0xFF87110C//Q
+#define OID_RT_WR_ATTRIB_MEM				0xFF87110D//S
+
+
+//Method 2 for H2C/C2H
+#define OID_RT_PRO_H2C_CMD_MODE				0xFF871110 //S
+#define OID_RT_PRO_H2C_CMD_RSP_MODE			0xFF871111 //Q
+#define OID_RT_PRO_H2C_CMD_EVENT_MODE			0xFF871112 //S
+#define OID_RT_PRO_WAIT_C2H_EVENT			0xFF871113 //Q
+#define OID_RT_PRO_RW_ACCESS_PROTOCOL_TEST		0xFF871114//Q
+
+#define OID_RT_PRO_SCSI_ACCESS_TEST			0xFF871115 //Q, S
+
+#define OID_RT_PRO_SCSI_TCPIPOFFLOAD_OUT		0xFF871116 //S
+#define OID_RT_PRO_SCSI_TCPIPOFFLOAD_IN			0xFF871117 //Q,S
+#define OID_RT_RRO_RX_PKT_VIA_IOCTRL			0xFF871118 //Q
+#define OID_RT_RRO_RX_PKTARRAY_VIA_IOCTRL		0xFF871119 //Q
+
+#define OID_RT_RPO_SET_PWRMGT_TEST			0xFF87111A //S
+#define OID_RT_PRO_QRY_PWRMGT_TEST			0XFF87111B //Q
+#define OID_RT_RPO_ASYNC_RWIO_TEST			0xFF87111C //S
+#define OID_RT_RPO_ASYNC_RWIO_POLL			0xFF87111D //Q
+#define OID_RT_PRO_SET_RF_INTFS				0xFF87111E //S
+#define OID_RT_POLL_RX_STATUS				0xFF87111F //Q
+
+#define OID_RT_PRO_CFG_DEBUG_MESSAGE			0xFF871120 //Q,S
+#define OID_RT_PRO_SET_DATA_RATE_EX			0xFF871121//S
+#define OID_RT_PRO_SET_BASIC_RATE			0xFF871122//S
+#define OID_RT_PRO_READ_TSSI				0xFF871123//S
+#define OID_RT_PRO_SET_POWER_TRACKING			0xFF871124//S
+
+
+#define OID_RT_PRO_QRY_PWRSTATE				0xFF871150 //Q
+#define OID_RT_PRO_SET_PWRSTATE				0xFF871151 //S
+
+//Method 2 , using workitem
+#define OID_RT_SET_READ_REG				0xFF871181 //S
+#define OID_RT_SET_WRITE_REG				0xFF871182 //S
+#define OID_RT_SET_BURST_READ_REG			0xFF871183 //S
+#define OID_RT_SET_BURST_WRITE_REG			0xFF871184 //S
+#define OID_RT_SET_WRITE_TXCMD				0xFF871185 //S
+#define OID_RT_SET_READ16_EEPROM			0xFF871186 //S
+#define OID_RT_SET_WRITE16_EEPROM			0xFF871187 //S
+#define OID_RT_QRY_POLL_WKITEM				0xFF871188 //Q
+
+//For SDIO INTERFACE only
+#define OID_RT_PRO_SYNCPAGERW_SRAM			0xFF8711A0 //Q, S
+#define OID_RT_PRO_871X_DRV_EXT 			0xFF8711A1
+
+//For USB INTERFACE only
+#define OID_RT_PRO_USB_VENDOR_REQ			0xFF8711B0 //Q, S
+#define OID_RT_PRO_SCSI_AUTO_TEST			0xFF8711B1 //S
+#define OID_RT_PRO_USB_MAC_AC_FIFO_WRITE		0xFF8711B2 //S
+#define OID_RT_PRO_USB_MAC_RX_FIFO_READ			0xFF8711B3 //Q
+#define OID_RT_PRO_USB_MAC_RX_FIFO_POLLING		0xFF8711B4 //Q
+
+#define OID_RT_PRO_H2C_SET_RATE_TABLE			0xFF8711FB //S
+#define OID_RT_PRO_H2C_GET_RATE_TABLE			0xFF8711FC //S
+#define OID_RT_PRO_H2C_C2H_LBK_TEST			0xFF8711FE
+
+#define OID_RT_PRO_ENCRYPTION_CTRL			0xFF871200 //Q, S
+#define OID_RT_PRO_ADD_STA_INFO				0xFF871201 //S
+#define OID_RT_PRO_DELE_STA_INFO    			0xFF871202 //S
+#define OID_RT_PRO_QUERY_DR_VARIABLE   			0xFF871203 //Q
+
+#define OID_RT_PRO_RX_PACKET_TYPE			0xFF871204 //Q, S
+
+#define OID_RT_PRO_READ_EFUSE				0xFF871205 //Q
+#define OID_RT_PRO_WRITE_EFUSE				0xFF871206 //S
+#define OID_RT_PRO_RW_EFUSE_PGPKT			0xFF871207 //Q, S
+#define OID_RT_GET_EFUSE_CURRENT_SIZE			0xFF871208 //Q
+
+#define OID_RT_SET_BANDWIDTH				0xFF871209 //S
+#define OID_RT_SET_CRYSTAL_CAP				0xFF87120A //S
+
+#define OID_RT_SET_RX_PACKET_TYPE    			0xFF87120B //S
+
+#define OID_RT_GET_EFUSE_MAX_SIZE			0xFF87120C //Q
+
+#define OID_RT_PRO_SET_TX_AGC_OFFSET			0xFF87120D //S
+
+#define OID_RT_PRO_SET_PKT_TEST_MODE			0xFF87120E //S
+
+#define OID_RT_PRO_FOR_EVM_TEST_SETTING			0xFF87120F //S
+
+#define OID_RT_PRO_GET_THERMAL_METER			0xFF871210 //Q
+
+#define OID_RT_RESET_PHY_RX_PACKET_COUNT		0xFF871211 //S
+#define OID_RT_GET_PHY_RX_PACKET_RECEIVED		0xFF871212 //Q
+#define OID_RT_GET_PHY_RX_PACKET_CRC32_ERROR		0xFF871213 //Q
+
+#define OID_RT_SET_POWER_DOWN				0xFF871214 //S
+
+#define OID_RT_GET_POWER_MODE				0xFF871215 //Q
+
+#define OID_RT_PRO_EFUSE				0xFF871216 //Q, S
+#define OID_RT_PRO_EFUSE_MAP				0xFF871217 //Q, S
+
+#endif //#ifndef	__CUSTOM_OID_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/nic_spec.h b/drivers/net/wireless/realtek/rtl8192cu/include/nic_spec.h
new file mode 100644
index 000000000000..fba5e564f07e
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/nic_spec.h
@@ -0,0 +1,46 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+
+#ifndef __NIC_SPEC_H__
+#define __NIC_SPEC_H__
+
+#include <drv_conf.h>
+
+#define RTL8711_MCTRL_		(0x20000)
+#define RTL8711_UART_		(0x30000)
+#define RTL8711_TIMER_		(0x40000)
+#define RTL8711_FINT_		(0x50000)
+#define RTL8711_HINT_		(0x50000)
+#define RTL8711_GPIO_		(0x60000)
+#define RTL8711_WLANCTRL_	(0x200000)
+#define RTL8711_WLANFF_		(0xe00000)
+#define RTL8711_HCICTRL_	(0x600000)
+#define RTL8711_SYSCFG_		(0x620000)
+#define RTL8711_SYSCTRL_	(0x620000)
+#define RTL8711_MCCTRL_		(0x020000)
+
+
+#include <rtl8711_regdef.h>
+
+#include <rtl8711_bitdef.h>
+
+
+#endif // __RTL8711_SPEC_H__
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/osdep_ce_service.h b/drivers/net/wireless/realtek/rtl8192cu/include/osdep_ce_service.h
new file mode 100644
index 000000000000..4b4def05c149
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/osdep_ce_service.h
@@ -0,0 +1,170 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#ifndef __OSDEP_CE_SERVICE_H_
+#define __OSDEP_CE_SERVICE_H_
+
+
+#include <ndis.h>
+#include <ntddndis.h>
+
+#ifdef CONFIG_SDIO_HCI
+#include "SDCardDDK.h"
+#endif
+
+#ifdef CONFIG_USB_HCI
+#include <usbdi.h>
+#endif
+
+typedef HANDLE 	_sema;
+typedef	LIST_ENTRY	_list;
+typedef NDIS_STATUS _OS_STATUS;
+
+typedef NDIS_SPIN_LOCK	_lock;
+
+typedef HANDLE 		_rwlock; //Mutex
+
+typedef u32	_irqL;
+
+typedef NDIS_HANDLE  _nic_hdl;
+
+
+typedef NDIS_MINIPORT_TIMER    _timer;
+
+struct	__queue	{
+	LIST_ENTRY	queue;
+	_lock	lock;
+};
+
+typedef	NDIS_PACKET	_pkt;
+typedef NDIS_BUFFER	_buffer;
+typedef struct	__queue	_queue;
+
+typedef HANDLE 	_thread_hdl_;
+typedef DWORD thread_return;
+typedef void*	thread_context;
+typedef NDIS_WORK_ITEM _workitem;
+
+#define thread_exit() ExitThread(STATUS_SUCCESS); return 0;
+
+
+#define SEMA_UPBND	(0x7FFFFFFF)   //8192
+
+__inline static _list *get_prev(_list	*list)
+{
+	return list->Blink;
+}
+
+__inline static _list *get_next(_list	*list)
+{
+	return list->Flink;
+}
+
+__inline static _list	*get_list_head(_queue	*queue)
+{
+	return (&(queue->queue));
+}
+
+#define LIST_CONTAINOR(ptr, type, member) CONTAINING_RECORD(ptr, type, member)
+
+__inline static void _enter_critical(_lock *plock, _irqL *pirqL)
+{
+	NdisAcquireSpinLock(plock);
+}
+
+__inline static void _exit_critical(_lock *plock, _irqL *pirqL)
+{
+	NdisReleaseSpinLock(plock);
+}
+
+__inline static _enter_critical_ex(_lock *plock, _irqL *pirqL)
+{
+	NdisDprAcquireSpinLock(plock);
+}
+
+__inline static _exit_critical_ex(_lock *plock, _irqL *pirqL)
+{
+	NdisDprReleaseSpinLock(plock);
+}
+
+
+__inline static void _enter_hwio_critical(_rwlock *prwlock, _irqL *pirqL)
+{
+	WaitForSingleObject(*prwlock, INFINITE );
+
+}
+
+__inline static void _exit_hwio_critical(_rwlock *prwlock, _irqL *pirqL)
+{
+	ReleaseMutex(*prwlock);
+}
+
+__inline static void rtw_list_delete(_list *plist)
+{
+	RemoveEntryList(plist);
+	InitializeListHead(plist);
+}
+
+__inline static void _init_timer(_timer *ptimer,_nic_hdl nic_hdl,void *pfunc,PVOID cntx)
+{
+	NdisMInitializeTimer(ptimer, nic_hdl, pfunc, cntx);
+}
+
+__inline static void _set_timer(_timer *ptimer,u32 delay_time)
+{
+	NdisMSetTimer(ptimer,delay_time);
+}
+
+__inline static void _cancel_timer(_timer *ptimer,u8 *bcancelled)
+{
+	NdisMCancelTimer(ptimer,bcancelled);
+}
+
+__inline static void _init_workitem(_workitem *pwork, void *pfunc, PVOID cntx)
+{
+
+	NdisInitializeWorkItem(pwork, pfunc, cntx);
+}
+
+__inline static void _set_workitem(_workitem *pwork)
+{
+	NdisScheduleWorkItem(pwork);
+}
+
+#define ATOMIC_INIT(i)  { (i) }
+
+//
+// Global Mutex: can only be used at PASSIVE level.
+//
+
+#define ACQUIRE_GLOBAL_MUTEX(_MutexCounter)                              \
+{                                                               \
+    while (NdisInterlockedIncrement((PULONG)&(_MutexCounter)) != 1)\
+    {                                                           \
+        NdisInterlockedDecrement((PULONG)&(_MutexCounter));        \
+        NdisMSleep(10000);                          \
+    }                                                           \
+}
+
+#define RELEASE_GLOBAL_MUTEX(_MutexCounter)                              \
+{                                                               \
+    NdisInterlockedDecrement((PULONG)&(_MutexCounter));              \
+}
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/osdep_intf.h b/drivers/net/wireless/realtek/rtl8192cu/include/osdep_intf.h
new file mode 100644
index 000000000000..10e5e4a1caf6
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/osdep_intf.h
@@ -0,0 +1,154 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#ifndef __OSDEP_INTF_H_
+#define __OSDEP_INTF_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+struct intf_priv {
+
+	u8 *intf_dev;
+	u32	max_iosz; 	//USB2.0: 128, USB1.1: 64, SDIO:64
+	u32	max_xmitsz; //USB2.0: unlimited, SDIO:512
+	u32	max_recvsz; //USB2.0: unlimited, SDIO:512
+
+	volatile u8 *io_rwmem;
+	volatile u8 *allocated_io_rwmem;
+	u32	io_wsz; //unit: 4bytes
+	u32	io_rsz;//unit: 4bytes
+	u8 intf_status;
+
+	void (*_bus_io)(u8 *priv);
+
+/*
+Under Sync. IRP (SDIO/USB)
+A protection mechanism is necessary for the io_rwmem(read/write protocol)
+
+Under Async. IRP (SDIO/USB)
+The protection mechanism is through the pending queue.
+*/
+
+	_mutex ioctl_mutex;
+
+
+#ifdef PLATFORM_LINUX
+	#ifdef CONFIG_USB_HCI
+	// when in USB, IO is through interrupt in/out endpoints
+	struct usb_device 	*udev;
+	PURB	piorw_urb;
+	u8 io_irp_cnt;
+	u8 bio_irp_pending;
+	_sema io_retevt;
+	_timer	io_timer;
+	u8 bio_irp_timeout;
+	u8 bio_timer_cancel;
+	#endif
+#endif
+
+#ifdef PLATFORM_OS_XP
+	#ifdef CONFIG_SDIO_HCI
+		// below is for io_rwmem...
+		PMDL pmdl;
+		PSDBUS_REQUEST_PACKET  sdrp;
+		PSDBUS_REQUEST_PACKET  recv_sdrp;
+		PSDBUS_REQUEST_PACKET  xmit_sdrp;
+
+			PIRP		piorw_irp;
+
+	#endif
+	#ifdef CONFIG_USB_HCI
+		PURB	piorw_urb;
+		PIRP		piorw_irp;
+		u8 io_irp_cnt;
+		u8 bio_irp_pending;
+		_sema io_retevt;
+	#endif
+#endif
+
+};
+
+
+#ifdef CONFIG_R871X_TEST
+int rtw_start_pseudo_adhoc(_adapter *padapter);
+int rtw_stop_pseudo_adhoc(_adapter *padapter);
+#endif
+
+struct dvobj_priv *devobj_init(void);
+void devobj_deinit(struct dvobj_priv *pdvobj);
+
+u8 rtw_init_drv_sw(_adapter *padapter);
+u8 rtw_free_drv_sw(_adapter *padapter);
+u8 rtw_reset_drv_sw(_adapter *padapter);
+
+u32 rtw_start_drv_threads(_adapter *padapter);
+void rtw_stop_drv_threads (_adapter *padapter);
+void rtw_cancel_all_timer(_adapter *padapter);
+
+#ifdef PLATFORM_LINUX
+int rtw_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
+
+int rtw_init_netdev_name(struct net_device *pnetdev, const char *ifname);
+struct net_device *rtw_init_netdev(_adapter *padapter);
+void rtw_unregister_netdevs(struct dvobj_priv *dvobj);
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+u16 rtw_recv_select_queue(struct sk_buff *skb);
+#endif //LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35)
+
+#ifdef CONFIG_PROC_DEBUG
+void rtw_proc_init_one(struct net_device *dev);
+void rtw_proc_remove_one(struct net_device *dev);
+#else //!CONFIG_PROC_DEBUG
+static void rtw_proc_init_one(struct net_device *dev){}
+static void rtw_proc_remove_one(struct net_device *dev){}
+#endif //!CONFIG_PROC_DEBUG
+#endif //PLATFORM_LINUX
+
+
+#ifdef PLATFORM_FREEBSD
+extern int rtw_ioctl(struct ifnet * ifp, u_long cmd, caddr_t data);
+#endif
+
+void rtw_ips_dev_unload(_adapter *padapter);
+#ifdef CONFIG_IPS
+int rtw_ips_pwr_up(_adapter *padapter);
+void rtw_ips_pwr_down(_adapter *padapter);
+#endif
+
+#ifdef CONFIG_CONCURRENT_MODE
+struct _io_ops;
+_adapter *rtw_drv_if2_init(_adapter *primary_padapter, void (*set_intf_ops)(struct _io_ops *pops));
+void rtw_drv_if2_free(_adapter *if2);
+void rtw_drv_if2_stop(_adapter *if2);
+#ifdef CONFIG_MULTI_VIR_IFACES
+struct dvobj_priv;
+_adapter *rtw_drv_add_vir_if(_adapter *primary_padapter, void (*set_intf_ops)(struct _io_ops *pops));
+void rtw_drv_stop_vir_ifaces(struct dvobj_priv *dvobj);
+void rtw_drv_free_vir_ifaces(struct dvobj_priv *dvobj);
+#endif //CONFIG_MULTI_VIR_IFACES
+#endif
+
+int rtw_drv_register_netdev(_adapter *padapter);
+void rtw_ndev_destructor(_nic_hdl ndev);
+
+#endif	//_OSDEP_INTF_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/osdep_service.h b/drivers/net/wireless/realtek/rtl8192cu/include/osdep_service.h
new file mode 100644
index 000000000000..b610ed77bc15
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/osdep_service.h
@@ -0,0 +1,1815 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __OSDEP_SERVICE_H_
+#define __OSDEP_SERVICE_H_
+
+#include <drv_conf.h>
+#include <basic_types.h>
+//#include <rtl871x_byteorder.h>
+
+#define _FAIL		0
+#define _SUCCESS	1
+#define RTW_RX_HANDLED 2
+//#define RTW_STATUS_TIMEDOUT -110
+
+#undef _TRUE
+#define _TRUE		1
+
+#undef _FALSE
+#define _FALSE		0
+
+
+#ifdef PLATFORM_FREEBSD
+#include <sys/cdefs.h>
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/param.h>
+#include <sys/sockio.h>
+#include <sys/sysctl.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/mbuf.h>
+#include <sys/kernel.h>
+#include <sys/socket.h>
+#include <sys/systm.h>
+#include <sys/malloc.h>
+#include <sys/module.h>
+#include <sys/bus.h>
+#include <sys/endian.h>
+#include <sys/kdb.h>
+#include <sys/kthread.h>
+#include <machine/atomic.h>
+
+#include <machine/bus.h>
+#include <machine/resource.h>
+#include <sys/rman.h>
+
+#include <net/bpf.h>
+#include <net/if.h>
+#include <net/if_arp.h>
+#include <net/ethernet.h>
+#include <net/if_dl.h>
+#include <net/if_media.h>
+#include <net/if_types.h>
+#include <net/route.h>
+
+
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/in_var.h>
+#include <netinet/if_ether.h>
+
+#include <net80211/ieee80211_var.h>
+#include <net80211/ieee80211_regdomain.h>
+#include <net80211/ieee80211_radiotap.h>
+#include <net80211/ieee80211_ratectl.h>
+
+#include <dev/usb/usb.h>
+#include <dev/usb/usbdi.h>
+#include "usbdevs.h"
+
+#define	USB_DEBUG_VAR rum_debug
+#include <dev/usb/usb_debug.h>
+
+#if 1 //Baron porting from linux, it's all temp solution, needs to check again
+#include <sys/sema.h>
+#include <sys/pcpu.h> /* XXX for PCPU_GET */
+//	typedef struct 	semaphore _sema;
+	typedef struct 	sema _sema;
+//	typedef	spinlock_t	_lock;
+	typedef	struct mtx	_lock;
+	typedef struct mtx 		_mutex;
+	typedef struct timer_list _timer;
+	struct list_head {
+	struct list_head *next, *prev;
+	};
+	struct	__queue	{
+		struct	list_head	queue;
+		_lock	lock;
+	};
+
+	//typedef	struct sk_buff	_pkt;
+	typedef	struct mbuf	_pkt;
+	typedef struct mbuf	_buffer;
+
+	typedef struct	__queue	_queue;
+	typedef struct	list_head	_list;
+	typedef	int	_OS_STATUS;
+	//typedef u32	_irqL;
+	typedef unsigned long _irqL;
+	typedef	struct	ifnet * _nic_hdl;
+
+	typedef pid_t		_thread_hdl_;
+//	typedef struct thread		_thread_hdl_;
+	typedef void		thread_return;
+	typedef void*	thread_context;
+
+	//#define thread_exit() complete_and_exit(NULL, 0)
+
+	typedef void timer_hdl_return;
+	typedef void* timer_hdl_context;
+	typedef struct work_struct _workitem;
+
+#define   KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))
+/* emulate a modern version */
+#define LINUX_VERSION_CODE KERNEL_VERSION(2, 6, 35)
+
+#define WIRELESS_EXT -1
+#define HZ hz
+#define spin_lock_irqsave mtx_lock_irqsave
+#define spin_lock_bh mtx_lock_irqsave
+#define mtx_lock_irqsave(lock, x) mtx_lock(lock)//{local_irq_save((x)); mtx_lock_spin((lock));}
+//#define IFT_RTW	0xf9 //ifnet allocate type for RTW
+#define free_netdev if_free
+#define LIST_CONTAINOR(ptr, type, member) \
+        ((type *)((char *)(ptr)-(SIZE_T)(&((type *)0)->member)))
+#define container_of(p,t,n) (t*)((p)-&(((t*)0)->n))
+/*
+ * Linux timers are emulated using FreeBSD callout functions
+ * (and taskqueue functionality).
+ *
+ * Currently no timer stats functionality.
+ *
+ * See (linux_compat) processes.c
+ *
+ */
+struct timer_list {
+
+        /* FreeBSD callout related fields */
+        struct callout callout;
+
+	//timeout function
+        void (*function)(void*);
+	//argument
+	 void *arg;
+
+};
+struct workqueue_struct;
+struct work_struct;
+typedef void (*work_func_t)(struct work_struct *work);
+/* Values for the state of an item of work (work_struct) */
+typedef enum work_state {
+        WORK_STATE_UNSET = 0,
+        WORK_STATE_CALLOUT_PENDING = 1,
+        WORK_STATE_TASK_PENDING = 2,
+        WORK_STATE_WORK_CANCELLED = 3
+} work_state_t;
+
+struct work_struct {
+        struct task task; /* FreeBSD task */
+        work_state_t state; /* the pending or otherwise state of work. */
+        work_func_t func;
+};
+#define spin_unlock_irqrestore mtx_unlock_irqrestore
+#define spin_unlock_bh mtx_unlock_irqrestore
+#define mtx_unlock_irqrestore(lock,x)    mtx_unlock(lock);
+extern void	_rtw_spinlock_init(_lock *plock);
+
+//modify private structure to match freebsd
+#define BITS_PER_LONG 32
+union ktime {
+	s64	tv64;
+#if BITS_PER_LONG != 64 && !defined(CONFIG_KTIME_SCALAR)
+	struct {
+#ifdef __BIG_ENDIAN
+	s32	sec, nsec;
+#else
+	s32	nsec, sec;
+#endif
+	} tv;
+#endif
+};
+#define kmemcheck_bitfield_begin(name)
+#define kmemcheck_bitfield_end(name)
+#define CHECKSUM_NONE 0
+typedef unsigned char *sk_buff_data_t;
+typedef union ktime ktime_t;		/* Kill this */
+
+void rtw_mtx_lock(_lock *plock);
+
+void rtw_mtx_unlock(_lock *plock);
+
+/**
+ *	struct sk_buff - socket buffer
+ *	@next: Next buffer in list
+ *	@prev: Previous buffer in list
+ *	@sk: Socket we are owned by
+ *	@tstamp: Time we arrived
+ *	@dev: Device we arrived on/are leaving by
+ *	@transport_header: Transport layer header
+ *	@network_header: Network layer header
+ *	@mac_header: Link layer header
+ *	@_skb_refdst: destination entry (with norefcount bit)
+ *	@sp: the security path, used for xfrm
+ *	@cb: Control buffer. Free for use by every layer. Put private vars here
+ *	@len: Length of actual data
+ *	@data_len: Data length
+ *	@mac_len: Length of link layer header
+ *	@hdr_len: writable header length of cloned skb
+ *	@csum: Checksum (must include start/offset pair)
+ *	@csum_start: Offset from skb->head where checksumming should start
+ *	@csum_offset: Offset from csum_start where checksum should be stored
+ *	@local_df: allow local fragmentation
+ *	@cloned: Head may be cloned (check refcnt to be sure)
+ *	@nohdr: Payload reference only, must not modify header
+ *	@pkt_type: Packet class
+ *	@fclone: skbuff clone status
+ *	@ip_summed: Driver fed us an IP checksum
+ *	@priority: Packet queueing priority
+ *	@users: User count - see {datagram,tcp}.c
+ *	@protocol: Packet protocol from driver
+ *	@truesize: Buffer size
+ *	@head: Head of buffer
+ *	@data: Data head pointer
+ *	@tail: Tail pointer
+ *	@end: End pointer
+ *	@destructor: Destruct function
+ *	@mark: Generic packet mark
+ *	@nfct: Associated connection, if any
+ *	@ipvs_property: skbuff is owned by ipvs
+ *	@peeked: this packet has been seen already, so stats have been
+ *		done for it, don't do them again
+ *	@nf_trace: netfilter packet trace flag
+ *	@nfctinfo: Relationship of this skb to the connection
+ *	@nfct_reasm: netfilter conntrack re-assembly pointer
+ *	@nf_bridge: Saved data about a bridged frame - see br_netfilter.c
+ *	@skb_iif: ifindex of device we arrived on
+ *	@rxhash: the packet hash computed on receive
+ *	@queue_mapping: Queue mapping for multiqueue devices
+ *	@tc_index: Traffic control index
+ *	@tc_verd: traffic control verdict
+ *	@ndisc_nodetype: router type (from link layer)
+ *	@dma_cookie: a cookie to one of several possible DMA operations
+ *		done by skb DMA functions
+ *	@secmark: security marking
+ *	@vlan_tci: vlan tag control information
+ */
+
+struct sk_buff {
+	/* These two members must be first. */
+	struct sk_buff		*next;
+	struct sk_buff		*prev;
+
+	ktime_t			tstamp;
+
+	struct sock		*sk;
+	//struct net_device	*dev;
+	struct ifnet *dev;
+
+	/*
+	 * This is the control buffer. It is free to use for every
+	 * layer. Please put your private variables there. If you
+	 * want to keep them across layers you have to do a skb_clone()
+	 * first. This is owned by whoever has the skb queued ATM.
+	 */
+	char			cb[48] __aligned(8);
+
+	unsigned long		_skb_refdst;
+#ifdef CONFIG_XFRM
+	struct	sec_path	*sp;
+#endif
+	unsigned int		len,
+				data_len;
+	u16			mac_len,
+				hdr_len;
+	union {
+		u32		csum;
+		struct {
+			u16	csum_start;
+			u16	csum_offset;
+		}smbol2;
+	}smbol1;
+	u32			priority;
+	kmemcheck_bitfield_begin(flags1);
+	u8			local_df:1,
+				cloned:1,
+				ip_summed:2,
+				nohdr:1,
+				nfctinfo:3;
+	u8			pkt_type:3,
+				fclone:2,
+				ipvs_property:1,
+				peeked:1,
+				nf_trace:1;
+	kmemcheck_bitfield_end(flags1);
+	u16			protocol;
+
+	void			(*destructor)(struct sk_buff *skb);
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+	struct nf_conntrack	*nfct;
+	struct sk_buff		*nfct_reasm;
+#endif
+#ifdef CONFIG_BRIDGE_NETFILTER
+	struct nf_bridge_info	*nf_bridge;
+#endif
+
+	int			skb_iif;
+#ifdef CONFIG_NET_SCHED
+	u16			tc_index;	/* traffic control index */
+#ifdef CONFIG_NET_CLS_ACT
+	u16			tc_verd;	/* traffic control verdict */
+#endif
+#endif
+
+	u32			rxhash;
+
+	kmemcheck_bitfield_begin(flags2);
+	u16			queue_mapping:16;
+#ifdef CONFIG_IPV6_NDISC_NODETYPE
+	u8			ndisc_nodetype:2,
+				deliver_no_wcard:1;
+#else
+	u8			deliver_no_wcard:1;
+#endif
+	kmemcheck_bitfield_end(flags2);
+
+	/* 0/14 bit hole */
+
+#ifdef CONFIG_NET_DMA
+	dma_cookie_t		dma_cookie;
+#endif
+#ifdef CONFIG_NETWORK_SECMARK
+	u32			secmark;
+#endif
+	union {
+		u32		mark;
+		u32		dropcount;
+	}symbol3;
+
+	u16			vlan_tci;
+
+	sk_buff_data_t		transport_header;
+	sk_buff_data_t		network_header;
+	sk_buff_data_t		mac_header;
+	/* These elements must be at the end, see alloc_skb() for details.  */
+	sk_buff_data_t		tail;
+	sk_buff_data_t		end;
+	unsigned char		*head,
+				*data;
+	unsigned int		truesize;
+	atomic_t		users;
+};
+struct sk_buff_head {
+	/* These two members must be first. */
+	struct sk_buff	*next;
+	struct sk_buff	*prev;
+
+	u32		qlen;
+	_lock	lock;
+};
+#define skb_tail_pointer(skb)	skb->tail
+static inline unsigned char *skb_put(struct sk_buff *skb, unsigned int len)
+{
+	unsigned char *tmp = skb_tail_pointer(skb);
+	//SKB_LINEAR_ASSERT(skb);
+	skb->tail += len;
+	skb->len  += len;
+	return tmp;
+}
+
+static inline unsigned char *__skb_pull(struct sk_buff *skb, unsigned int len)
+{
+	skb->len -= len;
+	if(skb->len < skb->data_len)
+		printf("%s(),%d,error!\n",__FUNCTION__,__LINE__);
+	return skb->data += len;
+}
+static inline unsigned char *skb_pull(struct sk_buff *skb, unsigned int len)
+{
+	#ifdef PLATFORM_FREEBSD
+	return __skb_pull(skb, len);
+	#else
+	return unlikely(len > skb->len) ? NULL : __skb_pull(skb, len);
+	#endif //PLATFORM_FREEBSD
+}
+static inline u32 skb_queue_len(const struct sk_buff_head *list_)
+{
+	return list_->qlen;
+}
+static inline void __skb_insert(struct sk_buff *newsk,
+				struct sk_buff *prev, struct sk_buff *next,
+				struct sk_buff_head *list)
+{
+	newsk->next = next;
+	newsk->prev = prev;
+	next->prev  = prev->next = newsk;
+	list->qlen++;
+}
+static inline void __skb_queue_before(struct sk_buff_head *list,
+				      struct sk_buff *next,
+				      struct sk_buff *newsk)
+{
+	__skb_insert(newsk, next->prev, next, list);
+}
+static inline void skb_queue_tail(struct sk_buff_head *list,
+				   struct sk_buff *newsk)
+{
+	mtx_lock(&list->lock);
+	__skb_queue_before(list, (struct sk_buff *)list, newsk);
+	mtx_unlock(&list->lock);
+}
+static inline struct sk_buff *skb_peek(struct sk_buff_head *list_)
+{
+	struct sk_buff *list = ((struct sk_buff *)list_)->next;
+	if (list == (struct sk_buff *)list_)
+		list = NULL;
+	return list;
+}
+static inline void __skb_unlink(struct sk_buff *skb, struct sk_buff_head *list)
+{
+	struct sk_buff *next, *prev;
+
+	list->qlen--;
+	next	   = skb->next;
+	prev	   = skb->prev;
+	skb->next  = skb->prev = NULL;
+	next->prev = prev;
+	prev->next = next;
+}
+
+static inline struct sk_buff *skb_dequeue(struct sk_buff_head *list)
+{
+	mtx_lock(&list->lock);
+
+	struct sk_buff *skb = skb_peek(list);
+	if (skb)
+		__skb_unlink(skb, list);
+
+	mtx_unlock(&list->lock);
+
+	return skb;
+}
+static inline void skb_reserve(struct sk_buff *skb, int len)
+{
+	skb->data += len;
+	skb->tail += len;
+}
+static inline void __skb_queue_head_init(struct sk_buff_head *list)
+{
+	list->prev = list->next = (struct sk_buff *)list;
+	list->qlen = 0;
+}
+/*
+ * This function creates a split out lock class for each invocation;
+ * this is needed for now since a whole lot of users of the skb-queue
+ * infrastructure in drivers have different locking usage (in hardirq)
+ * than the networking core (in softirq only). In the long run either the
+ * network layer or drivers should need annotation to consolidate the
+ * main types of usage into 3 classes.
+ */
+static inline void skb_queue_head_init(struct sk_buff_head *list)
+{
+	_rtw_spinlock_init(&list->lock);
+	__skb_queue_head_init(list);
+}
+unsigned long copy_from_user(void *to, const void *from, unsigned long n);
+unsigned long copy_to_user(void *to, const void *from, unsigned long n);
+struct sk_buff * dev_alloc_skb(unsigned int size);
+struct sk_buff *skb_clone(const struct sk_buff *skb);
+void dev_kfree_skb_any(struct sk_buff *skb);
+#endif //Baron porting from linux, it's all temp solution, needs to check again
+
+
+#if 1 // kenny add Linux compatibility code for Linux USB driver
+#include <dev/usb/usb_compat_linux.h>
+
+#define __init		// __attribute ((constructor))
+#define __exit		// __attribute ((destructor))
+
+/*
+ * Definitions for module_init and module_exit macros.
+ *
+ * These macros will use the SYSINIT framework to call a specified
+ * function (with no arguments) on module loading or unloading.
+ *
+ */
+
+void module_init_exit_wrapper(void *arg);
+
+#define module_init(initfn)                             \
+        SYSINIT(mod_init_ ## initfn,                    \
+                SI_SUB_KLD, SI_ORDER_FIRST,             \
+                module_init_exit_wrapper, initfn)
+
+#define module_exit(exitfn)                             \
+        SYSUNINIT(mod_exit_ ## exitfn,                  \
+                  SI_SUB_KLD, SI_ORDER_ANY,             \
+                  module_init_exit_wrapper, exitfn)
+
+/*
+ * The usb_register and usb_deregister functions are used to register
+ * usb drivers with the usb subsystem.
+ */
+int usb_register(struct usb_driver *driver);
+int usb_deregister(struct usb_driver *driver);
+
+/*
+ * usb_get_dev and usb_put_dev - increment/decrement the reference count
+ * of the usb device structure.
+ *
+ * Original body of usb_get_dev:
+ *
+ *       if (dev)
+ *               get_device(&dev->dev);
+ *       return dev;
+ *
+ * Reference counts are not currently used in this compatibility
+ * layer. So these functions will do nothing.
+ */
+static inline struct usb_device *
+usb_get_dev(struct usb_device *dev)
+{
+        return dev;
+}
+
+static inline void
+usb_put_dev(struct usb_device *dev)
+{
+        return;
+}
+
+
+// rtw_usb_compat_linux
+int rtw_usb_submit_urb(struct urb *urb, uint16_t mem_flags);
+int rtw_usb_unlink_urb(struct urb *urb);
+int rtw_usb_clear_halt(struct usb_device *dev, struct usb_host_endpoint *uhe);
+int rtw_usb_control_msg(struct usb_device *dev, struct usb_host_endpoint *uhe,
+    uint8_t request, uint8_t requesttype,
+    uint16_t value, uint16_t index, void *data,
+    uint16_t size, usb_timeout_t timeout);
+int rtw_usb_set_interface(struct usb_device *dev, uint8_t iface_no, uint8_t alt_index);
+int rtw_usb_setup_endpoint(struct usb_device *dev,
+    struct usb_host_endpoint *uhe, usb_size_t bufsize);
+struct urb *rtw_usb_alloc_urb(uint16_t iso_packets, uint16_t mem_flags);
+struct usb_host_endpoint *rtw_usb_find_host_endpoint(struct usb_device *dev, uint8_t type, uint8_t ep);
+struct usb_host_interface *rtw_usb_altnum_to_altsetting(const struct usb_interface *intf, uint8_t alt_index);
+struct usb_interface *rtw_usb_ifnum_to_if(struct usb_device *dev, uint8_t iface_no);
+void *rtw_usb_buffer_alloc(struct usb_device *dev, usb_size_t size, uint8_t *dma_addr);
+void *rtw_usbd_get_intfdata(struct usb_interface *intf);
+void rtw_usb_linux_register(void *arg);
+void rtw_usb_linux_deregister(void *arg);
+void rtw_usb_linux_free_device(struct usb_device *dev);
+void rtw_usb_buffer_free(struct usb_device *dev, usb_size_t size,
+    void *addr, uint8_t dma_addr);
+void rtw_usb_free_urb(struct urb *urb);
+void rtw_usb_init_urb(struct urb *urb);
+void rtw_usb_kill_urb(struct urb *urb);
+void rtw_usb_set_intfdata(struct usb_interface *intf, void *data);
+void rtw_usb_fill_bulk_urb(struct urb *urb, struct usb_device *udev,
+    struct usb_host_endpoint *uhe, void *buf,
+    int length, usb_complete_t callback, void *arg);
+int rtw_usb_bulk_msg(struct usb_device *udev, struct usb_host_endpoint *uhe,
+    void *data, int len, uint16_t *pactlen, usb_timeout_t timeout);
+void *usb_get_intfdata(struct usb_interface *intf);
+int usb_linux_init_endpoints(struct usb_device *udev);
+
+
+
+typedef struct urb *  PURB;
+
+typedef unsigned gfp_t;
+#define __GFP_WAIT      ((gfp_t)0x10u)  /* Can wait and reschedule? */
+#define __GFP_HIGH      ((gfp_t)0x20u)  /* Should access emergency pools? */
+#define __GFP_IO        ((gfp_t)0x40u)  /* Can start physical IO? */
+#define __GFP_FS        ((gfp_t)0x80u)  /* Can call down to low-level FS? */
+#define __GFP_COLD      ((gfp_t)0x100u) /* Cache-cold page required */
+#define __GFP_NOWARN    ((gfp_t)0x200u) /* Suppress page allocation failure warning */
+#define __GFP_REPEAT    ((gfp_t)0x400u) /* Retry the allocation.  Might fail */
+#define __GFP_NOFAIL    ((gfp_t)0x800u) /* Retry for ever.  Cannot fail */
+#define __GFP_NORETRY   ((gfp_t)0x1000u)/* Do not retry.  Might fail */
+#define __GFP_NO_GROW   ((gfp_t)0x2000u)/* Slab internal usage */
+#define __GFP_COMP      ((gfp_t)0x4000u)/* Add compound page metadata */
+#define __GFP_ZERO      ((gfp_t)0x8000u)/* Return zeroed page on success */
+#define __GFP_NOMEMALLOC ((gfp_t)0x10000u) /* Don't use emergency reserves */
+#define __GFP_HARDWALL   ((gfp_t)0x20000u) /* Enforce hardwall cpuset memory allocs */
+
+/* This equals 0, but use constants in case they ever change */
+#define GFP_NOWAIT      (GFP_ATOMIC & ~__GFP_HIGH)
+/* GFP_ATOMIC means both !wait (__GFP_WAIT not set) and use emergency pool */
+#define GFP_ATOMIC      (__GFP_HIGH)
+#define GFP_NOIO        (__GFP_WAIT)
+#define GFP_NOFS        (__GFP_WAIT | __GFP_IO)
+#define GFP_KERNEL      (__GFP_WAIT | __GFP_IO | __GFP_FS)
+#define GFP_USER        (__GFP_WAIT | __GFP_IO | __GFP_FS | __GFP_HARDWALL)
+#define GFP_HIGHUSER    (__GFP_WAIT | __GFP_IO | __GFP_FS | __GFP_HARDWALL | \
+                         __GFP_HIGHMEM)
+
+
+#endif // kenny add Linux compatibility code for Linux USB
+
+
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24))
+	#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
+#endif
+
+__inline static _list *get_next(_list	*list)
+{
+	return list->next;
+}
+
+__inline static _list	*get_list_head(_queue	*queue)
+{
+	return (&(queue->queue));
+}
+
+
+#define LIST_CONTAINOR(ptr, type, member) \
+        ((type *)((char *)(ptr)-(SIZE_T)(&((type *)0)->member)))
+
+
+__inline static void _enter_critical(_lock *plock, _irqL *pirqL)
+{
+	spin_lock_irqsave(plock, *pirqL);
+}
+
+__inline static void _exit_critical(_lock *plock, _irqL *pirqL)
+{
+	spin_unlock_irqrestore(plock, *pirqL);
+}
+
+__inline static void _enter_critical_ex(_lock *plock, _irqL *pirqL)
+{
+	spin_lock_irqsave(plock, *pirqL);
+}
+
+__inline static void _exit_critical_ex(_lock *plock, _irqL *pirqL)
+{
+	spin_unlock_irqrestore(plock, *pirqL);
+}
+
+__inline static void _enter_critical_bh(_lock *plock, _irqL *pirqL)
+{
+	spin_lock_bh(plock, *pirqL);
+}
+
+__inline static void _exit_critical_bh(_lock *plock, _irqL *pirqL)
+{
+	spin_unlock_bh(plock, *pirqL);
+}
+
+__inline static void _enter_critical_mutex(_mutex *pmutex, _irqL *pirqL)
+{
+
+		mtx_lock(pmutex);
+
+}
+
+
+__inline static void _exit_critical_mutex(_mutex *pmutex, _irqL *pirqL)
+{
+
+		mtx_unlock(pmutex);
+
+}
+static inline void __list_del(struct list_head * prev, struct list_head * next)
+{
+	next->prev = prev;
+	prev->next = next;
+}
+static inline void INIT_LIST_HEAD(struct list_head *list)
+{
+	list->next = list;
+	list->prev = list;
+}
+__inline static void rtw_list_delete(_list *plist)
+{
+	__list_del(plist->prev, plist->next);
+	INIT_LIST_HEAD(plist);
+}
+
+__inline static void _init_timer(_timer *ptimer,_nic_hdl padapter,void *pfunc,void* cntx)
+{
+	ptimer->function = pfunc;
+	ptimer->arg = cntx;
+	callout_init(&ptimer->callout, CALLOUT_MPSAFE);
+}
+
+__inline static void _set_timer(_timer *ptimer,u32 delay_time)
+{
+	//	mod_timer(ptimer , (jiffies+(delay_time*HZ/1000)));
+	if(ptimer->function && ptimer->arg){
+		rtw_mtx_lock(NULL);
+		callout_reset(&ptimer->callout, delay_time,ptimer->function, ptimer->arg);
+		rtw_mtx_unlock(NULL);
+	}
+}
+
+__inline static void _cancel_timer(_timer *ptimer,u8 *bcancelled)
+{
+	//	del_timer_sync(ptimer);
+	//	*bcancelled=  _TRUE;//TRUE ==1; FALSE==0
+	rtw_mtx_lock(NULL);
+	callout_drain(&ptimer->callout);
+	rtw_mtx_unlock(NULL);
+}
+
+__inline static void _init_workitem(_workitem *pwork, void *pfunc, PVOID cntx)
+{
+	printf("%s Not implement yet! \n",__FUNCTION__);
+}
+
+__inline static void _set_workitem(_workitem *pwork)
+{
+	printf("%s Not implement yet! \n",__FUNCTION__);
+//	schedule_work(pwork);
+}
+
+//
+// Global Mutex: can only be used at PASSIVE level.
+//
+
+#define ACQUIRE_GLOBAL_MUTEX(_MutexCounter)                              \
+{                                                               \
+}
+
+#define RELEASE_GLOBAL_MUTEX(_MutexCounter)                              \
+{                                                               \
+}
+
+#define ATOMIC_INIT(i)  { (i) }
+
+#endif //PLATFORM_FREEBSD
+
+
+#ifdef PLATFORM_LINUX
+	#include <linux/version.h>
+	#include <linux/spinlock.h>
+	#include <linux/compiler.h>
+	#include <linux/kernel.h>
+	#include <linux/errno.h>
+	#include <linux/init.h>
+	#include <linux/slab.h>
+	#include <linux/module.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,5))
+	#include <linux/kref.h>
+#endif
+	//#include <linux/smp_lock.h>
+	#include <linux/netdevice.h>
+	#include <linux/skbuff.h>
+	#include <linux/circ_buf.h>
+	#include <asm/uaccess.h>
+	#include <asm/byteorder.h>
+	#include <asm/atomic.h>
+	#include <asm/io.h>
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26))
+	#include <asm/semaphore.h>
+#else
+	#include <linux/semaphore.h>
+#endif
+	#include <linux/sem.h>
+	#include <linux/sched.h>
+	#include <linux/etherdevice.h>
+	#include <linux/wireless.h>
+	#include <net/iw_handler.h>
+	#include <linux/if_arp.h>
+	#include <linux/rtnetlink.h>
+	#include <linux/delay.h>
+	#include <linux/proc_fs.h>	// Necessary because we use the proc fs
+	#include <linux/interrupt.h>	// for struct tasklet_struct
+	#include <linux/ip.h>
+	#include <linux/kthread.h>
+	#include <linux/signal.h>
+	#include <linux/sched/signal.h>
+
+#ifdef CONFIG_IOCTL_CFG80211
+//	#include <linux/ieee80211.h>
+        #include <net/ieee80211_radiotap.h>
+	#include <net/cfg80211.h>
+#endif //CONFIG_IOCTL_CFG80211
+
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_TX
+	#include <linux/in.h>
+	#include <linux/udp.h>
+#endif
+
+#ifdef CONFIG_USB_HCI
+	#include <linux/usb.h>
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,21))
+	#include <linux/usb_ch9.h>
+#else
+	#include <linux/usb/ch9.h>
+#endif
+#endif
+
+#ifdef CONFIG_PCI_HCI
+	#include <linux/pci.h>
+#endif
+
+
+#ifdef CONFIG_USB_HCI
+	typedef struct urb *  PURB;
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,22))
+#ifdef CONFIG_USB_SUSPEND
+#define CONFIG_AUTOSUSPEND	1
+#endif
+#endif
+#endif
+
+	typedef struct 	semaphore _sema;
+	typedef	spinlock_t	_lock;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+	typedef struct mutex 		_mutex;
+#else
+	typedef struct semaphore	_mutex;
+#endif
+	typedef struct timer_list _timer;
+
+	struct	__queue	{
+		struct	list_head	queue;
+		_lock	lock;
+	};
+
+	typedef	struct sk_buff	_pkt;
+	typedef unsigned char	_buffer;
+
+	typedef struct	__queue	_queue;
+	typedef struct	list_head	_list;
+	typedef	int	_OS_STATUS;
+	//typedef u32	_irqL;
+	typedef unsigned long _irqL;
+	typedef	struct	net_device * _nic_hdl;
+
+	typedef void*		_thread_hdl_;
+	typedef int		thread_return;
+	typedef void*	thread_context;
+
+	#define thread_exit() complete_and_exit(NULL, 0)
+
+	typedef void timer_hdl_return;
+	typedef void* timer_hdl_context;
+	typedef struct work_struct _workitem;
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24))
+	#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22))
+// Porting from linux kernel, for compatible with old kernel.
+static inline unsigned char *skb_tail_pointer(const struct sk_buff *skb)
+{
+	return skb->tail;
+}
+
+static inline void skb_reset_tail_pointer(struct sk_buff *skb)
+{
+	skb->tail = skb->data;
+}
+
+static inline void skb_set_tail_pointer(struct sk_buff *skb, const int offset)
+{
+	skb->tail = skb->data + offset;
+}
+
+static inline unsigned char *skb_end_pointer(const struct sk_buff *skb)
+{
+	return skb->end;
+}
+#endif
+
+__inline static _list *get_next(_list	*list)
+{
+	return list->next;
+}
+
+__inline static _list	*get_list_head(_queue	*queue)
+{
+	return (&(queue->queue));
+}
+
+
+#define LIST_CONTAINOR(ptr, type, member) \
+        ((type *)((char *)(ptr)-(SIZE_T)(&((type *)0)->member)))
+
+
+__inline static void _enter_critical(_lock *plock, _irqL *pirqL)
+{
+	spin_lock_irqsave(plock, *pirqL);
+}
+
+__inline static void _exit_critical(_lock *plock, _irqL *pirqL)
+{
+	spin_unlock_irqrestore(plock, *pirqL);
+}
+
+__inline static void _enter_critical_ex(_lock *plock, _irqL *pirqL)
+{
+	spin_lock_irqsave(plock, *pirqL);
+}
+
+__inline static void _exit_critical_ex(_lock *plock, _irqL *pirqL)
+{
+	spin_unlock_irqrestore(plock, *pirqL);
+}
+
+__inline static void _enter_critical_bh(_lock *plock, _irqL *pirqL)
+{
+	spin_lock_bh(plock);
+}
+
+__inline static void _exit_critical_bh(_lock *plock, _irqL *pirqL)
+{
+	spin_unlock_bh(plock);
+}
+
+__inline static void _enter_critical_mutex(_mutex *pmutex, _irqL *pirqL)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+		mutex_lock(pmutex);
+#else
+		down(pmutex);
+#endif
+}
+
+
+__inline static void _exit_critical_mutex(_mutex *pmutex, _irqL *pirqL)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+		mutex_unlock(pmutex);
+#else
+		up(pmutex);
+#endif
+}
+
+__inline static void rtw_list_delete(_list *plist)
+{
+	list_del_init(plist);
+}
+
+__inline static void _init_timer(_timer *ptimer,_nic_hdl nic_hdl,void *pfunc,void* cntx)
+{
+	//setup_timer(ptimer, pfunc,(u32)cntx);
+	ptimer->function = pfunc;
+	ptimer->data = (unsigned long)cntx;
+	init_timer(ptimer);
+}
+
+__inline static void _set_timer(_timer *ptimer,u32 delay_time)
+{
+	mod_timer(ptimer , (jiffies+(delay_time*HZ/1000)));
+}
+
+__inline static void _cancel_timer(_timer *ptimer,u8 *bcancelled)
+{
+	del_timer_sync(ptimer);
+	*bcancelled=  _TRUE;//TRUE ==1; FALSE==0
+}
+
+#ifdef PLATFORM_LINUX
+#define RTW_TIMER_HDL_ARGS void *FunctionContext
+#elif defined(PLATFORM_OS_CE) || defined(PLATFORM_WINDOWS)
+#define RTW_TIMER_HDL_ARGS IN PVOID SystemSpecific1, IN PVOID FunctionContext, IN PVOID SystemSpecific2, IN PVOID SystemSpecific3
+#endif
+
+#define RTW_TIMER_HDL_NAME(name) rtw_##name##_timer_hdl
+#define RTW_DECLARE_TIMER_HDL(name) void RTW_TIMER_HDL_NAME(name)(RTW_TIMER_HDL_ARGS)
+
+
+__inline static void _init_workitem(_workitem *pwork, void *pfunc, PVOID cntx)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,20))
+	INIT_WORK(pwork, pfunc);
+#else
+	INIT_WORK(pwork, pfunc,pwork);
+#endif
+}
+
+__inline static void _set_workitem(_workitem *pwork)
+{
+	schedule_work(pwork);
+}
+
+__inline static void _cancel_workitem_sync(_workitem *pwork)
+{
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,22))
+	cancel_work_sync(pwork);
+#else
+	flush_scheduled_work();
+#endif
+}
+
+//
+// Global Mutex: can only be used at PASSIVE level.
+//
+
+#define ACQUIRE_GLOBAL_MUTEX(_MutexCounter)                              \
+{                                                               \
+	while (atomic_inc_return((atomic_t *)&(_MutexCounter)) != 1)\
+	{                                                           \
+		atomic_dec((atomic_t *)&(_MutexCounter));        \
+		msleep(10);                          \
+	}                                                           \
+}
+
+#define RELEASE_GLOBAL_MUTEX(_MutexCounter)                              \
+{                                                               \
+	atomic_dec((atomic_t *)&(_MutexCounter));        \
+}
+
+static inline int rtw_netif_queue_stopped(struct net_device *pnetdev)
+{
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+	return (netif_tx_queue_stopped(netdev_get_tx_queue(pnetdev, 0)) &&
+		netif_tx_queue_stopped(netdev_get_tx_queue(pnetdev, 1)) &&
+		netif_tx_queue_stopped(netdev_get_tx_queue(pnetdev, 2)) &&
+		netif_tx_queue_stopped(netdev_get_tx_queue(pnetdev, 3)) );
+#else
+	return netif_queue_stopped(pnetdev);
+#endif
+}
+
+static inline void rtw_netif_wake_queue(struct net_device *pnetdev)
+{
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+	netif_tx_wake_all_queues(pnetdev);
+#else
+	netif_wake_queue(pnetdev);
+#endif
+}
+
+static inline void rtw_netif_start_queue(struct net_device *pnetdev)
+{
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+	netif_tx_start_all_queues(pnetdev);
+#else
+	netif_start_queue(pnetdev);
+#endif
+}
+
+static inline void rtw_netif_stop_queue(struct net_device *pnetdev)
+{
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+	netif_tx_stop_all_queues(pnetdev);
+#else
+	netif_stop_queue(pnetdev);
+#endif
+}
+
+#endif	// PLATFORM_LINUX
+
+
+#ifdef PLATFORM_OS_XP
+
+	#include <ndis.h>
+	#include <ntddk.h>
+	#include <ntddndis.h>
+	#include <ntdef.h>
+
+#ifdef CONFIG_USB_HCI
+	#include <usb.h>
+	#include <usbioctl.h>
+	#include <usbdlib.h>
+#endif
+
+	typedef KSEMAPHORE 	_sema;
+	typedef	LIST_ENTRY	_list;
+	typedef NDIS_STATUS _OS_STATUS;
+
+
+	typedef NDIS_SPIN_LOCK	_lock;
+
+	typedef KMUTEX 			_mutex;
+
+	typedef KIRQL	_irqL;
+
+	// USB_PIPE for WINCE , but handle can be use just integer under windows
+	typedef NDIS_HANDLE  _nic_hdl;
+
+
+	typedef NDIS_MINIPORT_TIMER    _timer;
+
+	struct	__queue	{
+		LIST_ENTRY	queue;
+		_lock	lock;
+	};
+
+	typedef	NDIS_PACKET	_pkt;
+	typedef NDIS_BUFFER	_buffer;
+	typedef struct	__queue	_queue;
+
+	typedef PKTHREAD _thread_hdl_;
+	typedef void	thread_return;
+	typedef void* thread_context;
+
+	typedef NDIS_WORK_ITEM _workitem;
+
+	#define thread_exit() PsTerminateSystemThread(STATUS_SUCCESS);
+
+	#define HZ			10000000
+	#define SEMA_UPBND	(0x7FFFFFFF)   //8192
+
+__inline static _list *get_next(_list	*list)
+{
+	return list->Flink;
+}
+
+__inline static _list	*get_list_head(_queue	*queue)
+{
+	return (&(queue->queue));
+}
+
+
+#define LIST_CONTAINOR(ptr, type, member) CONTAINING_RECORD(ptr, type, member)
+
+
+__inline static _enter_critical(_lock *plock, _irqL *pirqL)
+{
+	NdisAcquireSpinLock(plock);
+}
+
+__inline static _exit_critical(_lock *plock, _irqL *pirqL)
+{
+	NdisReleaseSpinLock(plock);
+}
+
+
+__inline static _enter_critical_ex(_lock *plock, _irqL *pirqL)
+{
+	NdisDprAcquireSpinLock(plock);
+}
+
+__inline static _exit_critical_ex(_lock *plock, _irqL *pirqL)
+{
+	NdisDprReleaseSpinLock(plock);
+}
+
+__inline static void _enter_critical_bh(_lock *plock, _irqL *pirqL)
+{
+	NdisDprAcquireSpinLock(plock);
+}
+
+__inline static void _exit_critical_bh(_lock *plock, _irqL *pirqL)
+{
+	NdisDprReleaseSpinLock(plock);
+}
+
+__inline static _enter_critical_mutex(_mutex *pmutex, _irqL *pirqL)
+{
+	KeWaitForSingleObject(pmutex, Executive, KernelMode, FALSE, NULL);
+}
+
+
+__inline static _exit_critical_mutex(_mutex *pmutex, _irqL *pirqL)
+{
+	KeReleaseMutex(pmutex, FALSE);
+}
+
+
+__inline static void rtw_list_delete(_list *plist)
+{
+	RemoveEntryList(plist);
+	InitializeListHead(plist);
+}
+
+__inline static void _init_timer(_timer *ptimer,_nic_hdl nic_hdl,void *pfunc,PVOID cntx)
+{
+	NdisMInitializeTimer(ptimer, nic_hdl, pfunc, cntx);
+}
+
+__inline static void _set_timer(_timer *ptimer,u32 delay_time)
+{
+	NdisMSetTimer(ptimer,delay_time);
+}
+
+__inline static void _cancel_timer(_timer *ptimer,u8 *bcancelled)
+{
+	NdisMCancelTimer(ptimer,bcancelled);
+}
+
+__inline static void _init_workitem(_workitem *pwork, void *pfunc, PVOID cntx)
+{
+
+	NdisInitializeWorkItem(pwork, pfunc, cntx);
+}
+
+__inline static void _set_workitem(_workitem *pwork)
+{
+	NdisScheduleWorkItem(pwork);
+}
+
+
+#define ATOMIC_INIT(i)  { (i) }
+
+//
+// Global Mutex: can only be used at PASSIVE level.
+//
+
+#define ACQUIRE_GLOBAL_MUTEX(_MutexCounter)                              \
+{                                                               \
+    while (NdisInterlockedIncrement((PULONG)&(_MutexCounter)) != 1)\
+    {                                                           \
+        NdisInterlockedDecrement((PULONG)&(_MutexCounter));        \
+        NdisMSleep(10000);                          \
+    }                                                           \
+}
+
+#define RELEASE_GLOBAL_MUTEX(_MutexCounter)                              \
+{                                                               \
+    NdisInterlockedDecrement((PULONG)&(_MutexCounter));              \
+}
+
+#endif // PLATFORM_OS_XP
+
+
+#ifdef PLATFORM_OS_CE
+#include <osdep_ce_service.h>
+#endif
+
+#include <rtw_byteorder.h>
+
+#ifndef BIT
+	#define BIT(x)	( 1 << (x))
+#endif
+
+extern int RTW_STATUS_CODE(int error_code);
+
+#define CONFIG_USE_VMALLOC
+
+/* flags used for rtw_mstat_update() */
+enum mstat_f {
+	/* type: 0x00ff */
+	MSTAT_TYPE_VIR = 0x00,
+	MSTAT_TYPE_PHY= 0x01,
+	MSTAT_TYPE_SKB = 0x02,
+	MSTAT_TYPE_USB = 0x03,
+	MSTAT_TYPE_MAX = 0x04,
+
+	/* func: 0xff00 */
+	MSTAT_FUNC_UNSPECIFIED = 0x00<<8,
+	MSTAT_FUNC_IO = 0x01<<8,
+	MSTAT_FUNC_TX_IO = 0x02<<8,
+	MSTAT_FUNC_RX_IO = 0x03<<8,
+	MSTAT_FUNC_TX = 0x04<<8,
+	MSTAT_FUNC_RX = 0x05<<8,
+	MSTAT_FUNC_MAX = 0x06<<8,
+};
+
+#define mstat_tf_idx(flags) ((flags)&0xff)
+#define mstat_ff_idx(flags) (((flags)&0xff00) >> 8)
+
+typedef enum mstat_status{
+	MSTAT_ALLOC_SUCCESS = 0,
+	MSTAT_ALLOC_FAIL,
+	MSTAT_FREE
+} MSTAT_STATUS;
+
+#ifdef DBG_MEM_ALLOC
+void rtw_mstat_update(const enum mstat_f flags, const MSTAT_STATUS status, u32 sz);
+int _rtw_mstat_dump(char *buf, int len);
+void rtw_mstat_dump (void);
+u8* dbg_rtw_vmalloc(u32 sz, const enum mstat_f flags, const char *func, const int line);
+u8* dbg_rtw_zvmalloc(u32 sz, const enum mstat_f flags, const char *func, const int line);
+void dbg_rtw_vmfree(u8 *pbuf, const enum mstat_f flags, u32 sz, const char *func, const int line);
+u8* dbg_rtw_malloc(u32 sz, const enum mstat_f flags, const char *func, const int line);
+u8* dbg_rtw_zmalloc(u32 sz, const enum mstat_f flags, const char *func, const int line);
+void dbg_rtw_mfree(u8 *pbuf, const enum mstat_f flags, u32 sz, const char *func, const int line);
+
+struct sk_buff * dbg_rtw_skb_alloc(unsigned int size, const enum mstat_f flags, const char *func, const int line);
+void dbg_rtw_skb_free(struct sk_buff *skb, const enum mstat_f flags, const char *func, const int line);
+struct sk_buff *dbg_rtw_skb_copy(const struct sk_buff *skb, const enum mstat_f flags, const char *func, const int line);
+struct sk_buff *dbg_rtw_skb_clone(struct sk_buff *skb, const enum mstat_f flags, const char *func, const int line);
+int dbg_rtw_netif_rx(_nic_hdl ndev, struct sk_buff *skb, const enum mstat_f flags, const char *func, int line);
+void dbg_rtw_skb_queue_purge(struct sk_buff_head *list, enum mstat_f flags, const char *func, int line);
+
+#ifdef CONFIG_USB_HCI
+void *dbg_rtw_usb_buffer_alloc(struct usb_device *dev, size_t size, dma_addr_t *dma, const enum mstat_f flags, const char *func, const int line);
+void dbg_rtw_usb_buffer_free(struct usb_device *dev, size_t size, void *addr, dma_addr_t dma, const enum mstat_f flags, const char *func, const int line);
+#endif /* CONFIG_USB_HCI */
+
+#ifdef CONFIG_USE_VMALLOC
+#define rtw_vmalloc(sz)			dbg_rtw_vmalloc((sz), MSTAT_TYPE_VIR, __FUNCTION__, __LINE__)
+#define rtw_zvmalloc(sz)			dbg_rtw_zvmalloc((sz), MSTAT_TYPE_VIR, __FUNCTION__, __LINE__)
+#define rtw_vmfree(pbuf, sz)		dbg_rtw_vmfree((pbuf), (sz), MSTAT_TYPE_VIR, __FUNCTION__, __LINE__)
+#define rtw_vmalloc_f(sz, mstat_f)			dbg_rtw_vmalloc((sz), ((mstat_f)&0xff00)|MSTAT_TYPE_VIR, __FUNCTION__, __LINE__)
+#define rtw_zvmalloc_f(sz, mstat_f)		dbg_rtw_zvmalloc((sz), ((mstat_f)&0xff00)|MSTAT_TYPE_VIR, __FUNCTION__, __LINE__)
+#define rtw_vmfree_f(pbuf, sz, mstat_f)	dbg_rtw_vmfree((pbuf), (sz), ((mstat_f)&0xff00)|MSTAT_TYPE_VIR, __FUNCTION__, __LINE__)
+#else /* CONFIG_USE_VMALLOC */
+#define rtw_vmalloc(sz)			dbg_rtw_malloc((sz), MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_zvmalloc(sz)			dbg_rtw_zmalloc((sz), MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_vmfree(pbuf, sz)		dbg_rtw_mfree((pbuf), (sz), MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_vmalloc_f(sz, mstat_f)			dbg_rtw_malloc((sz), ((mstat_f)&0xff00)|MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_zvmalloc_f(sz, mstat_f)		dbg_rtw_zmalloc((sz), ((mstat_f)&0xff00)|MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_vmfree_f(pbuf, sz, mstat_f)	dbg_rtw_mfree((pbuf), (sz), ((mstat_f)&0xff00)|MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#endif /* CONFIG_USE_VMALLOC */
+#define rtw_malloc(sz)			dbg_rtw_malloc((sz), MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_zmalloc(sz)			dbg_rtw_zmalloc((sz), MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_mfree(pbuf, sz)		dbg_rtw_mfree((pbuf), (sz), MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_malloc_f(sz, mstat_f)			dbg_rtw_malloc((sz), ((mstat_f)&0xff00)|MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_zmalloc_f(sz, mstat_f)			dbg_rtw_zmalloc((sz), ((mstat_f)&0xff00)|MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+#define rtw_mfree_f(pbuf, sz, mstat_f)		dbg_rtw_mfree((pbuf), (sz), ((mstat_f)&0xff00)|MSTAT_TYPE_PHY, __FUNCTION__, __LINE__)
+
+#define rtw_skb_alloc(size)	dbg_rtw_skb_alloc((size), MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#define rtw_skb_free(skb)	dbg_rtw_skb_free((skb), MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#define rtw_skb_alloc_f(size, mstat_f)	dbg_rtw_skb_alloc((size), ((mstat_f)&0xff00)|MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#define rtw_skb_free_f(skb, mstat_f)	dbg_rtw_skb_free((skb), ((mstat_f)&0xff00)|MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#define rtw_skb_copy(skb)	dbg_rtw_skb_copy((skb), MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#define rtw_skb_clone(skb)	dbg_rtw_skb_clone((skb), MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#define rtw_skb_copy_f(skb, mstat_f)	dbg_rtw_skb_copy((skb), ((mstat_f)&0xff00)|MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#define rtw_skb_clone_f(skb, mstat_f)	dbg_rtw_skb_clone((skb), ((mstat_f)&0xff00)|MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#define rtw_netif_rx(ndev, skb)	dbg_rtw_netif_rx(ndev, skb, MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#define rtw_skb_queue_purge(sk_buff_head) dbg_rtw_skb_queue_purge(sk_buff_head, MSTAT_TYPE_SKB, __FUNCTION__, __LINE__)
+#ifdef CONFIG_USB_HCI
+#define rtw_usb_buffer_alloc(dev, size, dma)		dbg_rtw_usb_buffer_alloc((dev), (size), (dma), MSTAT_TYPE_USB, __FUNCTION__, __LINE__)
+#define rtw_usb_buffer_free(dev, size, addr, dma)	dbg_rtw_usb_buffer_free((dev), (size), (addr), (dma), MSTAT_TYPE_USB, __FUNCTION__, __LINE__)
+#define rtw_usb_buffer_alloc_f(dev, size, dma, mstat_f)			dbg_rtw_usb_buffer_alloc((dev), (size), (dma), ((mstat_f)&0xff00)|MSTAT_TYPE_USB, __FUNCTION__, __LINE__)
+#define rtw_usb_buffer_free_f(dev, size, addr, dma, mstat_f)	dbg_rtw_usb_buffer_free((dev), (size), (addr), (dma), ((mstat_f)&0xff00)|MSTAT_TYPE_USB, __FUNCTION__, __LINE__)
+#endif /* CONFIG_USB_HCI */
+
+#else /* DBG_MEM_ALLOC */
+#define rtw_mstat_update(flag, status, sz) do {} while(0)
+#define rtw_mstat_dump() do {} while(0)
+u8*	_rtw_vmalloc(u32 sz);
+u8*	_rtw_zvmalloc(u32 sz);
+void	_rtw_vmfree(u8 *pbuf, u32 sz);
+u8*	_rtw_zmalloc(u32 sz);
+u8*	_rtw_malloc(u32 sz);
+void	_rtw_mfree(u8 *pbuf, u32 sz);
+
+struct sk_buff *_rtw_skb_alloc(u32 sz);
+void _rtw_skb_free(struct sk_buff *skb);
+struct sk_buff *_rtw_skb_copy(const struct sk_buff *skb);
+struct sk_buff *_rtw_skb_clone(struct sk_buff *skb);
+int _rtw_netif_rx(_nic_hdl ndev, struct sk_buff *skb);
+void _rtw_skb_queue_purge(struct sk_buff_head *list);
+
+#ifdef CONFIG_USB_HCI
+void *_rtw_usb_buffer_alloc(struct usb_device *dev, size_t size, dma_addr_t *dma);
+void _rtw_usb_buffer_free(struct usb_device *dev, size_t size, void *addr, dma_addr_t dma);
+#endif /* CONFIG_USB_HCI */
+
+#ifdef CONFIG_USE_VMALLOC
+#define rtw_vmalloc(sz)			_rtw_vmalloc((sz))
+#define rtw_zvmalloc(sz)			_rtw_zvmalloc((sz))
+#define rtw_vmfree(pbuf, sz)		_rtw_vmfree((pbuf), (sz))
+#define rtw_vmalloc_f(sz, mstat_f)			_rtw_vmalloc((sz))
+#define rtw_zvmalloc_f(sz, mstat_f)		_rtw_zvmalloc((sz))
+#define rtw_vmfree_f(pbuf, sz, mstat_f)	_rtw_vmfree((pbuf), (sz))
+#else /* CONFIG_USE_VMALLOC */
+#define rtw_vmalloc(sz)			_rtw_malloc((sz))
+#define rtw_zvmalloc(sz)			_rtw_zmalloc((sz))
+#define rtw_vmfree(pbuf, sz)		_rtw_mfree((pbuf), (sz))
+#define rtw_vmalloc_f(sz, mstat_f)			_rtw_malloc((sz))
+#define rtw_zvmalloc_f(sz, mstat_f)		_rtw_zmalloc((sz))
+#define rtw_vmfree_f(pbuf, sz, mstat_f)	_rtw_mfree((pbuf), (sz))
+#endif /* CONFIG_USE_VMALLOC */
+#define rtw_malloc(sz)			_rtw_malloc((sz))
+#define rtw_zmalloc(sz)			_rtw_zmalloc((sz))
+#define rtw_mfree(pbuf, sz)		_rtw_mfree((pbuf), (sz))
+#define rtw_malloc_f(sz, mstat_f)			_rtw_malloc((sz))
+#define rtw_zmalloc_f(sz, mstat_f)			_rtw_zmalloc((sz))
+#define rtw_mfree_f(pbuf, sz, mstat_f)		_rtw_mfree((pbuf), (sz))
+
+#define rtw_skb_alloc(size) _rtw_skb_alloc((size))
+#define rtw_skb_free(skb) _rtw_skb_free((skb))
+#define rtw_skb_alloc_f(size, mstat_f)	_rtw_skb_alloc((size))
+#define rtw_skb_free_f(skb, mstat_f)	_rtw_skb_free((skb))
+#define rtw_skb_copy(skb)	_rtw_skb_copy((skb))
+#define rtw_skb_clone(skb)	_rtw_skb_clone((skb))
+#define rtw_skb_copy_f(skb, mstat_f)	_rtw_skb_copy((skb))
+#define rtw_skb_clone_f(skb, mstat_f)	_rtw_skb_clone((skb))
+#define rtw_netif_rx(ndev, skb) _rtw_netif_rx(ndev, skb)
+#define rtw_skb_queue_purge(sk_buff_head) _rtw_skb_queue_purge(sk_buff_head)
+#ifdef CONFIG_USB_HCI
+#define rtw_usb_buffer_alloc(dev, size, dma) _rtw_usb_buffer_alloc((dev), (size), (dma))
+#define rtw_usb_buffer_free(dev, size, addr, dma) _rtw_usb_buffer_free((dev), (size), (addr), (dma))
+#define rtw_usb_buffer_alloc_f(dev, size, dma, mstat_f) _rtw_usb_buffer_alloc((dev), (size), (dma))
+#define rtw_usb_buffer_free_f(dev, size, addr, dma, mstat_f) _rtw_usb_buffer_free((dev), (size), (addr), (dma))
+#endif /* CONFIG_USB_HCI */
+#endif /* DBG_MEM_ALLOC */
+
+extern void*	rtw_malloc2d(int h, int w, int size);
+extern void	rtw_mfree2d(void *pbuf, int h, int w, int size);
+
+extern void	_rtw_memcpy(void *dec, const void *sour, u32 sz);
+extern int	_rtw_memcmp(const void *dst, const void *src, u32 sz);
+extern void	_rtw_memset(void *pbuf, int c, u32 sz);
+
+extern void	_rtw_init_listhead(_list *list);
+extern u32	rtw_is_list_empty(_list *phead);
+extern void	rtw_list_insert_head(_list *plist, _list *phead);
+extern void	rtw_list_insert_tail(_list *plist, _list *phead);
+#ifndef PLATFORM_FREEBSD
+extern void	rtw_list_delete(_list *plist);
+#endif //PLATFORM_FREEBSD
+
+extern void	_rtw_init_sema(_sema *sema, int init_val);
+extern void	_rtw_free_sema(_sema	*sema);
+extern void	_rtw_up_sema(_sema	*sema);
+extern u32	_rtw_down_sema(_sema *sema);
+extern void	_rtw_mutex_init(_mutex *pmutex);
+extern void	_rtw_mutex_free(_mutex *pmutex);
+#ifndef PLATFORM_FREEBSD
+extern void	_rtw_spinlock_init(_lock *plock);
+#endif //PLATFORM_FREEBSD
+extern void	_rtw_spinlock_free(_lock *plock);
+extern void	_rtw_spinlock(_lock	*plock);
+extern void	_rtw_spinunlock(_lock	*plock);
+extern void	_rtw_spinlock_ex(_lock	*plock);
+extern void	_rtw_spinunlock_ex(_lock	*plock);
+
+extern void	_rtw_init_queue(_queue	*pqueue);
+extern u32	_rtw_queue_empty(_queue	*pqueue);
+extern u32	rtw_end_of_queue_search(_list *queue, _list *pelement);
+
+extern u32	rtw_get_current_time(void);
+extern u32	rtw_systime_to_ms(u32 systime);
+extern u32	rtw_ms_to_systime(u32 ms);
+extern s32	rtw_get_passing_time_ms(u32 start);
+extern s32	rtw_get_time_interval_ms(u32 start, u32 end);
+
+extern void	rtw_sleep_schedulable(int ms);
+
+extern void	rtw_msleep_os(int ms);
+extern void	rtw_usleep_os(int us);
+
+extern u32 	rtw_atoi(u8* s);
+
+#ifdef DBG_DELAY_OS
+#define rtw_mdelay_os(ms) _rtw_mdelay_os((ms), __FUNCTION__, __LINE__)
+#define rtw_udelay_os(ms) _rtw_udelay_os((ms), __FUNCTION__, __LINE__)
+extern void _rtw_mdelay_os(int ms, const char *func, const int line);
+extern void _rtw_udelay_os(int us, const char *func, const int line);
+#else
+extern void	rtw_mdelay_os(int ms);
+extern void	rtw_udelay_os(int us);
+#endif
+
+extern void rtw_yield_os(void);
+
+
+__inline static unsigned char _cancel_timer_ex(_timer *ptimer)
+{
+#ifdef PLATFORM_LINUX
+	return del_timer_sync(ptimer);
+#endif
+#ifdef PLATFORM_FREEBSD
+	_cancel_timer(ptimer,0);
+	return 0;
+#endif
+#ifdef PLATFORM_WINDOWS
+	u8 bcancelled;
+
+	_cancel_timer(ptimer, &bcancelled);
+
+	return bcancelled;
+#endif
+}
+
+#ifdef PLATFORM_FREEBSD
+static __inline void thread_enter(void *context);
+#endif //PLATFORM_FREEBSD
+static __inline void thread_enter(char *name)
+{
+#ifdef PLATFORM_LINUX
+	#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
+	daemonize("%s", name);
+	#endif
+	allow_signal(SIGTERM);
+#endif
+#ifdef PLATFORM_FREEBSD
+	printf("%s", "RTKTHREAD_enter");
+#endif
+}
+
+#ifdef PLATFORM_FREEBSD
+#define thread_exit() do{printf("%s", "RTKTHREAD_exit");}while(0)
+#endif //PLATFORM_FREEBSD
+__inline static void flush_signals_thread(void)
+{
+#ifdef PLATFORM_LINUX
+	if (signal_pending (current))
+	{
+		flush_signals(current);
+	}
+#endif
+}
+
+__inline static _OS_STATUS res_to_status(sint res)
+{
+
+
+#if defined (PLATFORM_LINUX) || defined (PLATFORM_MPIXEL) || defined (PLATFORM_FREEBSD)
+	return res;
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+	if (res == _SUCCESS)
+		return NDIS_STATUS_SUCCESS;
+	else
+		return NDIS_STATUS_FAILURE;
+
+#endif
+
+}
+
+__inline static void rtw_dump_stack(void)
+{
+#ifdef PLATFORM_LINUX
+	dump_stack();
+#endif
+}
+
+#ifdef PLATFORM_LINUX
+#define rtw_warn_on(condition) WARN_ON(condition)
+#else
+#define rtw_warn_on(condition) do {} while (0)
+#endif
+
+#define _RND(sz, r) ((((sz)+((r)-1))/(r))*(r))
+#define RND4(x)	(((x >> 2) + (((x & 3) == 0) ?  0: 1)) << 2)
+
+__inline static u32 _RND4(u32 sz)
+{
+
+	u32	val;
+
+	val = ((sz >> 2) + ((sz & 3) ? 1: 0)) << 2;
+
+	return val;
+
+}
+
+__inline static u32 _RND8(u32 sz)
+{
+
+	u32	val;
+
+	val = ((sz >> 3) + ((sz & 7) ? 1: 0)) << 3;
+
+	return val;
+
+}
+
+__inline static u32 _RND128(u32 sz)
+{
+
+	u32	val;
+
+	val = ((sz >> 7) + ((sz & 127) ? 1: 0)) << 7;
+
+	return val;
+
+}
+
+__inline static u32 _RND256(u32 sz)
+{
+
+	u32	val;
+
+	val = ((sz >> 8) + ((sz & 255) ? 1: 0)) << 8;
+
+	return val;
+
+}
+
+__inline static u32 _RND512(u32 sz)
+{
+
+	u32	val;
+
+	val = ((sz >> 9) + ((sz & 511) ? 1: 0)) << 9;
+
+	return val;
+
+}
+
+__inline static u32 bitshift(u32 bitmask)
+{
+	u32 i;
+
+	for (i = 0; i <= 31; i++)
+		if (((bitmask>>i) &  0x1) == 1) break;
+
+	return i;
+}
+
+#ifndef MAC_FMT
+#define MAC_FMT "%02x:%02x:%02x:%02x:%02x:%02x"
+#endif
+#ifndef MAC_ARG
+#define MAC_ARG(x) ((u8*)(x))[0],((u8*)(x))[1],((u8*)(x))[2],((u8*)(x))[3],((u8*)(x))[4],((u8*)(x))[5]
+#endif
+
+//#ifdef __GNUC__
+#ifdef PLATFORM_LINUX
+#define STRUCT_PACKED __attribute__ ((packed))
+#else
+#define STRUCT_PACKED
+#endif
+
+
+// limitation of path length
+#ifdef PLATFORM_LINUX
+	#define PATH_LENGTH_MAX PATH_MAX
+#elif defined(PLATFORM_WINDOWS)
+	#define PATH_LENGTH_MAX MAX_PATH
+#endif
+
+
+// Suspend lock prevent system from going suspend
+#ifdef CONFIG_WAKELOCK
+#include <linux/wakelock.h>
+#elif defined(CONFIG_ANDROID_POWER)
+#include <linux/android_power.h>
+#endif
+
+extern void rtw_suspend_lock_init(void);
+extern void rtw_suspend_lock_uninit(void);
+extern void rtw_lock_suspend(void);
+extern void rtw_unlock_suspend(void);
+extern void rtw_lock_suspend_timeout(u32 timeout_ms);
+
+
+//Atomic integer operations
+#ifdef PLATFORM_LINUX
+	#define ATOMIC_T atomic_t
+#elif defined(PLATFORM_WINDOWS)
+	#define ATOMIC_T LONG
+#elif defined(PLATFORM_FREEBSD)
+	typedef uint32_t ATOMIC_T ;
+#endif
+
+extern void ATOMIC_SET(ATOMIC_T *v, int i);
+extern int ATOMIC_READ(ATOMIC_T *v);
+extern void ATOMIC_ADD(ATOMIC_T *v, int i);
+extern void ATOMIC_SUB(ATOMIC_T *v, int i);
+extern void ATOMIC_INC(ATOMIC_T *v);
+extern void ATOMIC_DEC(ATOMIC_T *v);
+extern int ATOMIC_ADD_RETURN(ATOMIC_T *v, int i);
+extern int ATOMIC_SUB_RETURN(ATOMIC_T *v, int i);
+extern int ATOMIC_INC_RETURN(ATOMIC_T *v);
+extern int ATOMIC_DEC_RETURN(ATOMIC_T *v);
+
+//File operation APIs, just for linux now
+extern int rtw_is_file_readable(char *path);
+extern int rtw_retrive_from_file(char *path, u8* buf, u32 sz);
+extern int rtw_store_to_file(char *path, u8* buf, u32 sz);
+
+
+#if 1 //#ifdef MEM_ALLOC_REFINE_ADAPTOR
+struct rtw_netdev_priv_indicator {
+	void *priv;
+	u32 sizeof_priv;
+};
+struct net_device *rtw_alloc_etherdev_with_old_priv(int sizeof_priv, void *old_priv);
+extern struct net_device * rtw_alloc_etherdev(int sizeof_priv);
+
+#ifndef PLATFORM_FREEBSD
+#define rtw_netdev_priv(netdev) ( ((struct rtw_netdev_priv_indicator *)netdev_priv(netdev))->priv )
+#else //PLATFORM_FREEBSD
+#define rtw_netdev_priv(netdev) (((struct ifnet *)netdev)->if_softc)
+#endif //PLATFORM_FREEBSD
+
+#ifndef PLATFORM_FREEBSD
+extern void rtw_free_netdev(struct net_device * netdev);
+#else //PLATFORM_FREEBSD
+#define rtw_free_netdev(netdev) if_free((netdev))
+#endif //PLATFORM_FREEBSD
+
+#else //MEM_ALLOC_REFINE_ADAPTOR
+
+#define rtw_alloc_etherdev(sizeof_priv) alloc_etherdev((sizeof_priv))
+
+#ifndef PLATFORM_FREEBSD
+#define rtw_netdev_priv(netdev) netdev_priv((netdev))
+#define rtw_free_netdev(netdev) free_netdev((netdev))
+#else //PLATFORM_FREEBSD
+#define rtw_netdev_priv(netdev) (((struct ifnet *)netdev)->if_softc)
+#define rtw_free_netdev(netdev) if_free((netdev))
+#endif //PLATFORM_FREEBSD
+#endif
+
+#ifdef PLATFORM_LINUX
+#define NDEV_FMT "%s"
+#define NDEV_ARG(ndev) ndev->name
+#define ADPT_FMT "%s"
+#define ADPT_ARG(adapter) adapter->pnetdev->name
+#define FUNC_NDEV_FMT "%s(%s)"
+#define FUNC_NDEV_ARG(ndev) __func__, ndev->name
+#define FUNC_ADPT_FMT "%s(%s)"
+#define FUNC_ADPT_ARG(adapter) __func__, adapter->pnetdev->name
+#else
+#define NDEV_FMT "%s"
+#define NDEV_ARG(ndev) ""
+#define ADPT_FMT "%s"
+#define ADPT_ARG(adapter) ""
+#define FUNC_NDEV_FMT "%s"
+#define FUNC_NDEV_ARG(ndev) __func__
+#define FUNC_ADPT_FMT "%s"
+#define FUNC_ADPT_ARG(adapter) __func__
+#endif
+
+#ifdef PLATFORM_LINUX
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27))
+#define rtw_signal_process(pid, sig) kill_pid(find_vpid((pid)),(sig), 1)
+#else //(LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27))
+#define rtw_signal_process(pid, sig) kill_proc((pid), (sig), 1)
+#endif //(LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27))
+#endif //PLATFORM_LINUX
+
+extern u64 rtw_modular64(u64 x, u64 y);
+extern u64 rtw_division64(u64 x, u64 y);
+
+
+/* Macros for handling unaligned memory accesses */
+
+#define RTW_GET_BE16(a) ((u16) (((a)[0] << 8) | (a)[1]))
+#define RTW_PUT_BE16(a, val)			\
+	do {					\
+		(a)[0] = ((u16) (val)) >> 8;	\
+		(a)[1] = ((u16) (val)) & 0xff;	\
+	} while (0)
+
+#define RTW_GET_LE16(a) ((u16) (((a)[1] << 8) | (a)[0]))
+#define RTW_PUT_LE16(a, val)			\
+	do {					\
+		(a)[1] = ((u16) (val)) >> 8;	\
+		(a)[0] = ((u16) (val)) & 0xff;	\
+	} while (0)
+
+#define RTW_GET_BE24(a) ((((u32) (a)[0]) << 16) | (((u32) (a)[1]) << 8) | \
+			 ((u32) (a)[2]))
+#define RTW_PUT_BE24(a, val)					\
+	do {							\
+		(a)[0] = (u8) ((((u32) (val)) >> 16) & 0xff);	\
+		(a)[1] = (u8) ((((u32) (val)) >> 8) & 0xff);	\
+		(a)[2] = (u8) (((u32) (val)) & 0xff);		\
+	} while (0)
+
+#define RTW_GET_BE32(a) ((((u32) (a)[0]) << 24) | (((u32) (a)[1]) << 16) | \
+			 (((u32) (a)[2]) << 8) | ((u32) (a)[3]))
+#define RTW_PUT_BE32(a, val)					\
+	do {							\
+		(a)[0] = (u8) ((((u32) (val)) >> 24) & 0xff);	\
+		(a)[1] = (u8) ((((u32) (val)) >> 16) & 0xff);	\
+		(a)[2] = (u8) ((((u32) (val)) >> 8) & 0xff);	\
+		(a)[3] = (u8) (((u32) (val)) & 0xff);		\
+	} while (0)
+
+#define RTW_GET_LE32(a) ((((u32) (a)[3]) << 24) | (((u32) (a)[2]) << 16) | \
+			 (((u32) (a)[1]) << 8) | ((u32) (a)[0]))
+#define RTW_PUT_LE32(a, val)					\
+	do {							\
+		(a)[3] = (u8) ((((u32) (val)) >> 24) & 0xff);	\
+		(a)[2] = (u8) ((((u32) (val)) >> 16) & 0xff);	\
+		(a)[1] = (u8) ((((u32) (val)) >> 8) & 0xff);	\
+		(a)[0] = (u8) (((u32) (val)) & 0xff);		\
+	} while (0)
+
+#define RTW_GET_BE64(a) ((((u64) (a)[0]) << 56) | (((u64) (a)[1]) << 48) | \
+			 (((u64) (a)[2]) << 40) | (((u64) (a)[3]) << 32) | \
+			 (((u64) (a)[4]) << 24) | (((u64) (a)[5]) << 16) | \
+			 (((u64) (a)[6]) << 8) | ((u64) (a)[7]))
+#define RTW_PUT_BE64(a, val)				\
+	do {						\
+		(a)[0] = (u8) (((u64) (val)) >> 56);	\
+		(a)[1] = (u8) (((u64) (val)) >> 48);	\
+		(a)[2] = (u8) (((u64) (val)) >> 40);	\
+		(a)[3] = (u8) (((u64) (val)) >> 32);	\
+		(a)[4] = (u8) (((u64) (val)) >> 24);	\
+		(a)[5] = (u8) (((u64) (val)) >> 16);	\
+		(a)[6] = (u8) (((u64) (val)) >> 8);	\
+		(a)[7] = (u8) (((u64) (val)) & 0xff);	\
+	} while (0)
+
+#define RTW_GET_LE64(a) ((((u64) (a)[7]) << 56) | (((u64) (a)[6]) << 48) | \
+			 (((u64) (a)[5]) << 40) | (((u64) (a)[4]) << 32) | \
+			 (((u64) (a)[3]) << 24) | (((u64) (a)[2]) << 16) | \
+			 (((u64) (a)[1]) << 8) | ((u64) (a)[0]))
+
+void rtw_buf_free(u8 **buf, u32 *buf_len);
+void rtw_buf_update(u8 **buf, u32 *buf_len, u8 *src, u32 src_len);
+
+struct rtw_cbuf {
+	u32 write;
+	u32 read;
+	u32 size;
+	void *bufs[0];
+};
+
+bool rtw_cbuf_full(struct rtw_cbuf *cbuf);
+bool rtw_cbuf_empty(struct rtw_cbuf *cbuf);
+bool rtw_cbuf_push(struct rtw_cbuf *cbuf, void *buf);
+void *rtw_cbuf_pop(struct rtw_cbuf *cbuf);
+struct rtw_cbuf *rtw_cbuf_alloc(u32 size);
+void rtw_cbuf_free(struct rtw_cbuf *cbuf);
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/pci_hal.h b/drivers/net/wireless/realtek/rtl8192cu/include/pci_hal.h
new file mode 100644
index 000000000000..650b04fc015b
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/pci_hal.h
@@ -0,0 +1,167 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __PCI_HAL_H__
+#define __PCI_HAL_H__
+
+
+#define	INTEL_VENDOR_ID				0x8086
+#define	SIS_VENDOR_ID					0x1039
+#define	ATI_VENDOR_ID					0x1002
+#define	ATI_DEVICE_ID					0x7914
+#define	AMD_VENDOR_ID					0x1022
+
+#define	PCI_MAX_BRIDGE_NUMBER			255
+#define	PCI_MAX_DEVICES				32
+#define	PCI_MAX_FUNCTION				8
+
+#define	PCI_CONF_ADDRESS   				0x0CF8   // PCI Configuration Space Address
+#define	PCI_CONF_DATA					0x0CFC   // PCI Configuration Space Data
+
+#define	PCI_CLASS_BRIDGE_DEV			0x06
+#define	PCI_SUBCLASS_BR_PCI_TO_PCI	0x04
+
+#define 	PCI_CAPABILITY_ID_PCI_EXPRESS	0x10
+
+#define	U1DONTCARE 					0xFF
+#define	U2DONTCARE 					0xFFFF
+#define	U4DONTCARE 					0xFFFFFFFF
+
+#define PCI_VENDER_ID_REALTEK		0x10ec
+
+#define HAL_HW_PCI_8180_DEVICE_ID           	0x8180
+#define HAL_HW_PCI_8185_DEVICE_ID           	0x8185	//8185 or 8185b
+#define HAL_HW_PCI_8188_DEVICE_ID           	0x8188	//8185b
+#define HAL_HW_PCI_8198_DEVICE_ID           	0x8198	//8185b
+#define HAL_HW_PCI_8190_DEVICE_ID           	0x8190	//8190
+#define HAL_HW_PCI_8723E_DEVICE_ID		0x8723	//8723E
+#define HAL_HW_PCI_8192_DEVICE_ID           	0x8192	//8192 PCI-E
+#define HAL_HW_PCI_8192SE_DEVICE_ID		0x8192	//8192 SE
+#define HAL_HW_PCI_8174_DEVICE_ID           	0x8174	//8192 SE
+#define HAL_HW_PCI_8173_DEVICE_ID           	0x8173	//8191 SE Crab
+#define HAL_HW_PCI_8172_DEVICE_ID           	0x8172	//8191 SE RE
+#define HAL_HW_PCI_8171_DEVICE_ID           	0x8171	//8191 SE Unicron
+#define HAL_HW_PCI_0045_DEVICE_ID			0x0045	//8190 PCI for Ceraga
+#define HAL_HW_PCI_0046_DEVICE_ID			0x0046	//8190 Cardbus for Ceraga
+#define HAL_HW_PCI_0044_DEVICE_ID			0x0044	//8192e PCIE for Ceraga
+#define HAL_HW_PCI_0047_DEVICE_ID			0x0047	//8192e Express Card for Ceraga
+#define HAL_HW_PCI_700F_DEVICE_ID			0x700F
+#define HAL_HW_PCI_701F_DEVICE_ID			0x701F
+#define HAL_HW_PCI_DLINK_DEVICE_ID		0x3304
+#define HAL_HW_PCI_8192CET_DEVICE_ID		0x8191	//8192ce
+#define HAL_HW_PCI_8192CE_DEVICE_ID		0x8178	//8192ce
+#define HAL_HW_PCI_8191CE_DEVICE_ID		0x8177	//8192ce
+#define HAL_HW_PCI_8188CE_DEVICE_ID		0x8176	//8192ce
+#define HAL_HW_PCI_8192CU_DEVICE_ID      	0x8191	//8192ce
+#define HAL_HW_PCI_8192DE_DEVICE_ID		0x8193	//8192de
+#define HAL_HW_PCI_002B_DEVICE_ID			0x002B	//8192de, provided by HW SD
+
+#define HAL_MEMORY_MAPPED_IO_RANGE_8190PCI 		0x1000     //8190 support 16 pages of IO registers
+#define HAL_HW_PCI_REVISION_ID_8190PCI			0x00
+#define HAL_MEMORY_MAPPED_IO_RANGE_8192PCIE	0x4000	//8192 support 16 pages of IO registers
+#define HAL_HW_PCI_REVISION_ID_8192PCIE			0x01
+#define HAL_MEMORY_MAPPED_IO_RANGE_8192SE		0x4000	//8192 support 16 pages of IO registers
+#define HAL_HW_PCI_REVISION_ID_8192SE			0x10
+#define HAL_HW_PCI_REVISION_ID_8192CE			0x1
+#define HAL_MEMORY_MAPPED_IO_RANGE_8192CE		0x4000	//8192 support 16 pages of IO registers
+#define HAL_HW_PCI_REVISION_ID_8192DE			0x0
+#define HAL_MEMORY_MAPPED_IO_RANGE_8192DE		0x4000	//8192 support 16 pages of IO registers
+
+enum pci_bridge_vendor {
+	PCI_BRIDGE_VENDOR_INTEL = 0x0,//0b'0000,0001
+	PCI_BRIDGE_VENDOR_ATI, //= 0x02,//0b'0000,0010
+	PCI_BRIDGE_VENDOR_AMD, //= 0x04,//0b'0000,0100
+	PCI_BRIDGE_VENDOR_SIS ,//= 0x08,//0b'0000,1000
+	PCI_BRIDGE_VENDOR_UNKNOWN, //= 0x40,//0b'0100,0000
+	PCI_BRIDGE_VENDOR_MAX ,//= 0x80
+} ;
+
+struct rt_pci_capabilities_header {
+	u8	capability_id;
+	u8	next;
+};
+
+struct pci_priv{
+	u8	linkctrl_reg;
+
+	u8	busnumber;
+	u8	devnumber;
+	u8	funcnumber;
+
+	u8	pcibridge_busnum;
+	u8	pcibridge_devnum;
+	u8	pcibridge_funcnum;
+	u8	pcibridge_vendor;
+	u16	pcibridge_vendorid;
+	u16	pcibridge_deviceid;
+	u8	pcibridge_pciehdr_offset;
+	u8	pcibridge_linkctrlreg;
+
+	u8	amd_l1_patch;
+};
+
+typedef struct _RT_ISR_CONTENT
+{
+	union{
+		u32			IntArray[2];
+		u32			IntReg4Byte;
+		u16			IntReg2Byte;
+	};
+}RT_ISR_CONTENT, *PRT_ISR_CONTENT;
+
+//#define RegAddr(addr)           (addr + 0xB2000000UL)
+//some platform macros will def here
+static inline void NdisRawWritePortUlong(u32 port,  u32 val)
+{
+	outl(val, port);
+	//writel(val, (u8 *)RegAddr(port));
+}
+
+static inline void NdisRawWritePortUchar(u32 port,  u8 val)
+{
+	outb(val, port);
+	//writeb(val, (u8 *)RegAddr(port));
+}
+
+static inline void NdisRawReadPortUchar(u32 port, u8 *pval)
+{
+	*pval = inb(port);
+	//*pval = readb((u8 *)RegAddr(port));
+}
+
+static inline void NdisRawReadPortUshort(u32 port, u16 *pval)
+{
+	*pval = inw(port);
+	//*pval = readw((u8 *)RegAddr(port));
+}
+
+static inline void NdisRawReadPortUlong(u32 port, u32 *pval)
+{
+	*pval = inl(port);
+	//*pval = readl((u8 *)RegAddr(port));
+}
+
+#ifdef CONFIG_RTL8192C
+void rtl8192ce_set_hal_ops(_adapter * padapter);
+#endif
+#ifdef CONFIG_RTL8192D
+void rtl8192de_set_hal_ops(_adapter * padapter);
+#endif
+
+#endif //__PCIE_HAL_H__
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/pci_ops.h b/drivers/net/wireless/realtek/rtl8192cu/include/pci_ops.h
new file mode 100644
index 000000000000..51d96c483b0a
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/pci_ops.h
@@ -0,0 +1,60 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __PCI_OPS_H_
+#define __PCI_OPS_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <osdep_intf.h>
+
+#ifdef CONFIG_RTL8192C
+u32	rtl8192ce_init_desc_ring(_adapter * padapter);
+u32	rtl8192ce_free_desc_ring(_adapter * padapter);
+void	rtl8192ce_reset_desc_ring(_adapter * padapter);
+#ifdef CONFIG_64BIT_DMA
+u8	PlatformEnable92CEDMA64(PADAPTER Adapter);
+#endif
+int	rtl8192ce_interrupt(PADAPTER Adapter);
+void	rtl8192ce_xmit_tasklet(void *priv);
+void	rtl8192ce_recv_tasklet(void *priv);
+void	rtl8192ce_prepare_bcn_tasklet(void *priv);
+void	rtl8192ce_set_intf_ops(struct _io_ops	*pops);
+#define pci_set_intf_ops	rtl8192ce_set_intf_ops
+#endif
+
+#ifdef CONFIG_RTL8192D
+u32	rtl8192de_init_desc_ring(_adapter * padapter);
+u32	rtl8192de_free_desc_ring(_adapter * padapter);
+void	rtl8192de_reset_desc_ring(_adapter * padapter);
+#ifdef CONFIG_64BIT_DMA
+u8	PlatformEnable92DEDMA64(PADAPTER Adapter);
+#endif
+int	rtl8192de_interrupt(PADAPTER Adapter);
+void	rtl8192de_xmit_tasklet(void *priv);
+void	rtl8192de_recv_tasklet(void *priv);
+void	rtl8192de_prepare_bcn_tasklet(void *priv);
+void	rtl8192de_set_intf_ops(struct _io_ops	*pops);
+#define pci_set_intf_ops	rtl8192de_set_intf_ops
+u32	MpReadPCIDwordDBI8192D(IN PADAPTER Adapter, IN u16 Offset, IN u8 Direct);
+void	MpWritePCIDwordDBI8192D(IN PADAPTER Adapter, IN u16 Offset, IN u32 Value, IN u8 Direct);
+#endif
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/pci_osintf.h b/drivers/net/wireless/realtek/rtl8192cu/include/pci_osintf.h
new file mode 100644
index 000000000000..8d38a533d2ee
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/pci_osintf.h
@@ -0,0 +1,32 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __PCI_OSINTF_H
+#define __PCI_OSINTF_H
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+void rtw_pci_disable_aspm(_adapter *padapter);
+void rtw_pci_enable_aspm(_adapter *padapter);
+
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/recv_osdep.h b/drivers/net/wireless/realtek/rtl8192cu/include/recv_osdep.h
new file mode 100644
index 000000000000..b39e00b224f0
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/recv_osdep.h
@@ -0,0 +1,57 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RECV_OSDEP_H_
+#define __RECV_OSDEP_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+extern sint _rtw_init_recv_priv(struct recv_priv *precvpriv, _adapter *padapter);
+extern void _rtw_free_recv_priv (struct recv_priv *precvpriv);
+
+
+extern s32  rtw_recv_entry(union recv_frame *precv_frame);
+extern int rtw_recv_indicatepkt(_adapter *adapter, union recv_frame *precv_frame);
+extern void rtw_recv_returnpacket(IN _nic_hdl cnxt, IN _pkt *preturnedpkt);
+
+extern void rtw_hostapd_mlme_rx(_adapter *padapter, union recv_frame *precv_frame);
+extern void rtw_handle_tkip_mic_err(_adapter *padapter,u8 bgroup);
+
+
+int	rtw_init_recv_priv(struct recv_priv *precvpriv, _adapter *padapter);
+void rtw_free_recv_priv (struct recv_priv *precvpriv);
+
+
+int rtw_os_recv_resource_init(struct recv_priv *precvpriv, _adapter *padapter);
+int rtw_os_recv_resource_alloc(_adapter *padapter, union recv_frame *precvframe);
+void rtw_os_recv_resource_free(struct recv_priv *precvpriv);
+
+
+int rtw_os_recvbuf_resource_alloc(_adapter *padapter, struct recv_buf *precvbuf);
+int rtw_os_recvbuf_resource_free(_adapter *padapter, struct recv_buf *precvbuf);
+
+void rtw_os_read_port(_adapter *padapter, struct recv_buf *precvbuf);
+
+void rtw_init_recv_timer(struct recv_reorder_ctrl *preorder_ctrl);
+
+
+#endif //
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_cmd.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_cmd.h
new file mode 100644
index 000000000000..3a63316e48f3
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_cmd.h
@@ -0,0 +1,152 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTL8192C_CMD_H_
+#define __RTL8192C_CMD_H_
+
+
+enum cmd_msg_element_id
+{
+	NONE_CMDMSG_EID,
+	AP_OFFLOAD_EID=0,
+	SET_PWRMODE_EID=1,
+	JOINBSS_RPT_EID=2,
+	RSVD_PAGE_EID=3,
+	RSSI_4_EID = 4,
+	RSSI_SETTING_EID=5,
+	MACID_CONFIG_EID=6,
+	MACID_PS_MODE_EID=7,
+	P2P_PS_OFFLOAD_EID=8,
+	SELECTIVE_SUSPEND_ROF_CMD=9,
+#ifdef CONFIG_WOWLAN
+	H2C_WO_WLAN_CMD = 26,	// Wake on Wlan.
+	EXT_MACID_PERIOD_EID = 27,	// support macid to 64
+	MACID64_CONFIG_EID = 28,	// support macid to 64
+#endif // CONFIG_WOWLAN
+	P2P_PS_CTW_CMD_EID=32,
+	H2C_92C_IO_OFFLOAD=44,
+#ifdef CONFIG_WOWLAN
+	KEEP_ALIVE_CONTROL_CMD=48,
+	DISCONNECT_DECISION_CTRL_CMD=49,
+	REMOTE_WAKE_CTRL_CMD=60,
+#endif // CONFIG_WOWLAN
+	H2C_92C_TSF_SYNC=67,
+	H2C_92C_DISABLE_BCN_FUNC=68,
+	H2C_92C_RESET_TSF = 75,
+	H2C_92C_CMD_MAX
+};
+
+struct cmd_msg_parm {
+	u8 eid; //element id
+	u8 sz; // sz
+	u8 buf[6];
+};
+
+typedef struct _SETPWRMODE_PARM{
+	u8 	Mode;
+	u8 	SmartPS;
+	u8	BcnPassTime;	// unit: 100ms
+}SETPWRMODE_PARM, *PSETPWRMODE_PARM;
+
+#ifdef CONFIG_WOWLAN
+typedef struct _SETWOWLAN_PARM{
+	u8 	mode;
+	u8 	gpio_index;
+	u8	gpio_duration;
+	u8  second_mode;
+	u8  reserve;
+}SETWOWLAN_PARM, *PSETWOWLAN_PARM;
+
+#define FW_WOWLAN_FUN_EN			BIT(0)
+#define FW_WOWLAN_PATTERN_MATCH		BIT(1)
+#define FW_WOWLAN_MAGIC_PKT			BIT(2)
+#define FW_WOWLAN_UNICAST			BIT(3)
+#define FW_WOWLAN_ALL_PKT_DROP		BIT(4)
+#define FW_WOWLAN_GPIO_ACTIVE		BIT(5)
+#define FW_WOWLAN_REKEY_WAKEUP		BIT(6)
+#define FW_WOWLAN_DEAUTH_WAKEUP		BIT(7)
+
+#define FW_WOWLAN_GPIO_WAKEUP_EN	BIT(0)
+#define FW_FW_PARSE_MAGIC_PKT		BIT(1)
+#endif // CONFIG_WOWLAN
+
+struct H2C_SS_RFOFF_PARAM{
+	u8 	ROFOn; // 1: on, 0:off
+	u16	gpio_period; // unit: 1024 us
+}__attribute__ ((packed));
+
+
+typedef struct JOINBSSRPT_PARM{
+	u8	OpMode;	// RT_MEDIA_STATUS
+}JOINBSSRPT_PARM, *PJOINBSSRPT_PARM;
+
+typedef struct _RSVDPAGE_LOC{
+	u8 	LocProbeRsp;
+	u8 	LocPsPoll;
+	u8	LocNullData;
+}RSVDPAGE_LOC, *PRSVDPAGE_LOC;
+
+struct P2P_PS_Offload_t {
+ unsigned char Offload_En:1;
+ unsigned char role:1; // 1: Owner, 0: Client
+ unsigned char CTWindow_En:1;
+ unsigned char NoA0_En:1;
+ unsigned char NoA1_En:1;
+ unsigned char AllStaSleep:1; // Only valid in Owner
+ unsigned char discovery:1;
+ unsigned char rsvd:1;
+};
+
+struct P2P_PS_CTWPeriod_t {
+    unsigned char CTWPeriod;	//TU
+};
+
+// host message to firmware cmd
+void	rtl8192c_set_FwPwrMode_cmd(_adapter*padapter, u8 Mode);
+void	rtl8192c_set_FwJoinBssReport_cmd(_adapter* padapter, u8 mstatus);
+u8	rtl8192c_set_rssi_cmd(_adapter*padapter, u8 *param);
+u8	rtl8192c_set_raid_cmd(_adapter*padapter, u32 mask, u8 arg);
+void	rtl8192c_Add_RateATid(PADAPTER pAdapter, u32 bitmap, u8 arg);
+u8	rtl8192c_set_FwSelectSuspend_cmd(_adapter*padapter,u8 bfwpoll, u16 period);
+#ifdef CONFIG_P2P
+void	rtl8192c_set_p2p_ps_offload_cmd(_adapter* padapter, u8 p2p_ps_state);
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_IOL
+typedef struct _IO_OFFLOAD_LOC{
+	u8 	LocCmd;
+}IO_OFFLOAD_LOC, *PIO_OFFLOAD_LOC;
+int rtl8192c_IOL_exec_cmds_sync(ADAPTER *adapter, struct xmit_frame *xmit_frame, u32 max_wating_ms);
+#endif //CONFIG_IOL
+
+#ifdef CONFIG_BEACON_DISABLE_OFFLOAD
+u8 rtl8192c_dis_beacon_fun_cmd(_adapter* padapter);
+#endif  // CONFIG_BEACON_DISABLE_OFFLOAD
+
+
+#ifdef CONFIG_TSF_RESET_OFFLOAD
+int reset_tsf(PADAPTER Adapter, u8 reset_port );
+#endif	// CONFIG_TSF_RESET_OFFLOAD
+
+#ifdef CONFIG_WOWLAN
+void rtl8192c_set_wowlan_cmd(_adapter* padapter);
+void SetFwRelatedForWoWLAN8192CU(_adapter* 	padapter,u8 bHostIsGoingtoSleep);
+#endif // CONFIG_WOWLAN
+
+#endif	// __RTL8192C_CMD_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_dm.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_dm.h
new file mode 100644
index 000000000000..3c56d49c8d81
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_dm.h
@@ -0,0 +1,515 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef	__RTL8192C_DM_H__
+#define __RTL8192C_DM_H__
+//============================================================
+// Description:
+//
+// This file is for 92CE/92CU dynamic mechanism only
+//
+//
+//============================================================
+
+#define	RSSI_CCK		0
+#define	RSSI_OFDM		1
+#define	RSSI_DEFAULT	2
+
+//============================================================
+// structure and define
+//============================================================
+
+typedef struct _FALSE_ALARM_STATISTICS{
+	u32	Cnt_Parity_Fail;
+	u32	Cnt_Rate_Illegal;
+	u32	Cnt_Crc8_fail;
+	u32	Cnt_Mcs_fail;
+	u32	Cnt_Ofdm_fail;
+	u32	Cnt_Cck_fail;
+	u32	Cnt_all;
+	u32	Cnt_Fast_Fsync;
+	u32	Cnt_SB_Search_fail;
+}FALSE_ALARM_STATISTICS, *PFALSE_ALARM_STATISTICS;
+
+typedef struct _Dynamic_Power_Saving_
+{
+	u8		PreCCAState;
+	u8		CurCCAState;
+
+	u8		PreRFState;
+	u8		CurRFState;
+
+	s32		Rssi_val_min;
+
+}PS_T;
+
+typedef struct _Dynamic_Initial_Gain_Threshold_
+{
+	u8		Dig_Enable_Flag;
+	u8		Dig_Ext_Port_Stage;
+
+	int		RssiLowThresh;
+	int		RssiHighThresh;
+
+	u32		FALowThresh;
+	u32		FAHighThresh;
+
+	u8		CurSTAConnectState;
+	u8		PreSTAConnectState;
+	u8		CurMultiSTAConnectState;
+
+	u8		PreIGValue;
+	u8		CurIGValue;
+	u8		BackupIGValue;
+
+	char		BackoffVal;
+	char		BackoffVal_range_max;
+	char		BackoffVal_range_min;
+	u8		rx_gain_range_max;
+	u8		rx_gain_range_min;
+	u8		Rssi_val_min;
+
+	u8		PreCCKPDState;
+	u8		CurCCKPDState;
+        u8		PreCCKFAState;
+	u8		CurCCKFAState;
+	u8		PreCCAState;
+	u8		CurCCAState;
+
+	u8		LargeFAHit;
+	u8		ForbiddenIGI;
+	u32		Recover_cnt;
+	u8		rx_gain_range_min_nolink;
+
+}DIG_T;
+
+typedef enum tag_Dynamic_Init_Gain_Operation_Type_Definition
+{
+	DIG_TYPE_THRESH_HIGH	= 0,
+	DIG_TYPE_THRESH_LOW	= 1,
+	DIG_TYPE_BACKOFF		= 2,
+	DIG_TYPE_RX_GAIN_MIN	= 3,
+	DIG_TYPE_RX_GAIN_MAX	= 4,
+	DIG_TYPE_ENABLE 		= 5,
+	DIG_TYPE_DISABLE 		= 6,
+	DIG_OP_TYPE_MAX
+}DM_DIG_OP_E;
+
+typedef enum tag_CCK_Packet_Detection_Threshold_Type_Definition
+{
+	CCK_PD_STAGE_LowRssi = 0,
+	CCK_PD_STAGE_HighRssi = 1,
+	CCK_PD_STAGE_MAX = 3,
+}DM_CCK_PDTH_E;
+
+typedef enum tag_1R_CCA_Type_Definition
+{
+	CCA_1R =0,
+	CCA_2R = 1,
+	CCA_MAX = 2,
+}DM_1R_CCA_E;
+
+typedef enum tag_RF_Type_Definition
+{
+	RF_Save =0,
+	RF_Normal = 1,
+	RF_MAX = 2,
+}DM_RF_E;
+
+typedef enum tag_DIG_EXT_PORT_ALGO_Definition
+{
+	DIG_EXT_PORT_STAGE_0 = 0,
+	DIG_EXT_PORT_STAGE_1 = 1,
+	DIG_EXT_PORT_STAGE_2 = 2,
+	DIG_EXT_PORT_STAGE_3 = 3,
+	DIG_EXT_PORT_STAGE_MAX = 4,
+}DM_DIG_EXT_PORT_ALG_E;
+
+
+typedef enum tag_DIG_Connect_Definition
+{
+	DIG_STA_DISCONNECT = 0,
+	DIG_STA_CONNECT = 1,
+	DIG_STA_BEFORE_CONNECT = 2,
+	DIG_MultiSTA_DISCONNECT = 3,
+	DIG_MultiSTA_CONNECT = 4,
+	DIG_CONNECT_MAX
+}DM_DIG_CONNECT_E;
+
+
+
+typedef	enum _BT_Ant_NUM{
+	Ant_x2	= 0,
+	Ant_x1	= 1
+} BT_Ant_NUM, *PBT_Ant_NUM;
+
+typedef	enum _BT_CoType{
+	BT_2Wire		= 0,
+	BT_ISSC_3Wire	= 1,
+	BT_Accel		= 2,
+	BT_CSR_BC4		= 3,
+	BT_CSR_BC8		= 4,
+	BT_RTL8756		= 5,
+} BT_CoType, *PBT_CoType;
+
+typedef	enum _BT_CurState{
+	BT_OFF		= 0,
+	BT_ON		= 1,
+} BT_CurState, *PBT_CurState;
+
+typedef	enum _BT_ServiceType{
+	BT_SCO		= 0,
+	BT_A2DP		= 1,
+	BT_HID		= 2,
+	BT_HID_Idle	= 3,
+	BT_Scan		= 4,
+	BT_Idle		= 5,
+	BT_OtherAction	= 6,
+	BT_Busy			= 7,
+	BT_OtherBusy		= 8,
+	BT_PAN			= 9,
+} BT_ServiceType, *PBT_ServiceType;
+
+typedef	enum _BT_RadioShared{
+	BT_Radio_Shared 	= 0,
+	BT_Radio_Individual	= 1,
+} BT_RadioShared, *PBT_RadioShared;
+
+struct btcoexist_priv	{
+	u8					BT_Coexist;
+	u8					BT_Ant_Num;
+	u8					BT_CoexistType;
+	u8					BT_State;
+	u8					BT_CUR_State;		//0:on, 1:off
+	u8					BT_Ant_isolation;	//0:good, 1:bad
+	u8					BT_PapeCtrl;		//0:SW, 1:SW/HW dynamic
+	u8					BT_Service;
+	u8					BT_Ampdu;	// 0:Disable BT control A-MPDU, 1:Enable BT control A-MPDU.
+	u8					BT_RadioSharedType;
+	u32					Ratio_Tx;
+	u32					Ratio_PRI;
+	u8					BtRfRegOrigin1E;
+	u8					BtRfRegOrigin1F;
+	u8					BtRssiState;
+	u32					BtEdcaUL;
+	u32					BtEdcaDL;
+	u32					BT_EDCA[2];
+	u8					bCOBT;
+
+	u8					bInitSet;
+	u8					bBTBusyTraffic;
+	u8					bBTTrafficModeSet;
+	u8					bBTNonTrafficModeSet;
+	//BTTraffic				BT21TrafficStatistics;
+	u32					CurrentState;
+	u32					PreviousState;
+	u8					BtPreRssiState;
+	u8					bFWCoexistAllOff;
+	u8					bSWCoexistAllOff;
+};
+
+#define		BW_AUTO_SWITCH_HIGH_LOW	25
+#define		BW_AUTO_SWITCH_LOW_HIGH	30
+
+#define		DM_DIG_THRESH_HIGH			40
+#define		DM_DIG_THRESH_LOW			35
+
+#define		DM_FALSEALARM_THRESH_LOW	400
+#define		DM_FALSEALARM_THRESH_HIGH	1000
+
+#define		DM_DIG_MAX					0x3e
+#define		DM_DIG_MIN					0x1e //0x22//0x1c
+
+#define		DM_DIG_FA_UPPER				0x3e
+#define		DM_DIG_FA_LOWER				0x20
+#define		DM_DIG_FA_TH0					0x20
+#define		DM_DIG_FA_TH1					0x100
+#define		DM_DIG_FA_TH2					0x200
+
+#define		DM_DIG_BACKOFF_MAX			12
+#define		DM_DIG_BACKOFF_MIN			(-4)
+#define		DM_DIG_BACKOFF_DEFAULT		10
+
+#define		RxPathSelection_SS_TH_low		30
+#define		RxPathSelection_diff_TH			18
+
+#define		DM_RATR_STA_INIT			0
+#define		DM_RATR_STA_HIGH			1
+#define 		DM_RATR_STA_MIDDLE		2
+#define 		DM_RATR_STA_LOW			3
+
+#define		CTSToSelfTHVal					30
+#define		RegC38_TH						20
+
+#define		WAIotTHVal						25
+
+//Dynamic Tx Power Control Threshold
+#define		TX_POWER_NEAR_FIELD_THRESH_LVL2	74
+#define		TX_POWER_NEAR_FIELD_THRESH_LVL1	67
+
+#define		TxHighPwrLevel_Normal		0
+#define		TxHighPwrLevel_Level1		1
+#define		TxHighPwrLevel_Level2		2
+#define		TxHighPwrLevel_BT1			3
+#define		TxHighPwrLevel_BT2			4
+#define		TxHighPwrLevel_15			5
+#define		TxHighPwrLevel_35			6
+#define		TxHighPwrLevel_50			7
+#define		TxHighPwrLevel_70			8
+#define		TxHighPwrLevel_100			9
+
+#define		DM_Type_ByFW			0
+#define		DM_Type_ByDriver		1
+
+
+typedef struct _RATE_ADAPTIVE
+{
+	u8				RateAdaptiveDisabled;
+	u8				RATRState;
+	u16				reserve;
+
+	u32				HighRSSIThreshForRA;
+	u32				High2LowRSSIThreshForRA;
+	u8				Low2HighRSSIThreshForRA40M;
+	u32				LowRSSIThreshForRA40M;
+	u8				Low2HighRSSIThreshForRA20M;
+	u32				LowRSSIThreshForRA20M;
+	u32				UpperRSSIThresholdRATR;
+	u32				MiddleRSSIThresholdRATR;
+	u32				LowRSSIThresholdRATR;
+	u32				LowRSSIThresholdRATR40M;
+	u32				LowRSSIThresholdRATR20M;
+	u8				PingRSSIEnable;	//cosa add for Netcore long range ping issue
+	u32				PingRSSIRATR;	//cosa add for Netcore long range ping issue
+	u32				PingRSSIThreshForRA;//cosa add for Netcore long range ping issue
+	u32				LastRATR;
+	u8				PreRATRState;
+
+} RATE_ADAPTIVE, *PRATE_ADAPTIVE;
+
+typedef enum tag_SW_Antenna_Switch_Definition
+{
+	Antenna_B = 1,
+	Antenna_A = 2,
+	Antenna_MAX = 3,
+}DM_SWAS_E;
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+// This indicates two different the steps.
+// In SWAW_STEP_PEAK, driver needs to switch antenna and listen to the signal on the air.
+// In SWAW_STEP_DETERMINE, driver just compares the signal captured in SWAW_STEP_PEAK
+// with original RSSI to determine if it is necessary to switch antenna.
+#define SWAW_STEP_PEAK		0
+#define SWAW_STEP_DETERMINE	1
+
+#define	TP_MODE		0
+#define	RSSI_MODE		1
+#define	TRAFFIC_LOW	0
+#define	TRAFFIC_HIGH	1
+
+typedef struct _SW_Antenna_Switch_
+{
+	u8		try_flag;
+	s32		PreRSSI;
+	u8		CurAntenna;
+	u8		PreAntenna;
+	u8		RSSI_Trying;
+	u8		TestMode;
+	u8		bTriggerAntennaSwitch;
+	u8		SelectAntennaMap;
+	// Before link Antenna Switch check
+	u8		SWAS_NoLink_State;
+
+}SWAT_T;
+
+
+#endif
+
+
+struct 	dm_priv
+{
+	u8	DM_Type;
+	u8	DMFlag, DMFlag_tmp;
+
+
+	//for DIG
+	u8	bDMInitialGainEnable;
+	u8	binitialized; // for dm_initial_gain_Multi_STA use.
+	DIG_T	DM_DigTable;
+
+	PS_T	DM_PSTable;
+
+	FALSE_ALARM_STATISTICS FalseAlmCnt;
+
+	//for rate adaptive, in fact,  88c/92c fw will handle this
+	u8 bUseRAMask;
+	RATE_ADAPTIVE RateAdaptive;
+
+	//* Upper and Lower Signal threshold for Rate Adaptive*/
+	int	UndecoratedSmoothedPWDB;
+	int	UndecoratedSmoothedCCK;
+	int	EntryMinUndecoratedSmoothedPWDB;
+	int	EntryMaxUndecoratedSmoothedPWDB;
+
+
+	//for High Power
+	u8 bDynamicTxPowerEnable;
+	u8 LastDTPLvl;
+	u8 DynamicTxHighPowerLvl;//Add by Jacken Tx Power Control for Near/Far Range 2008/03/06
+
+	//for tx power tracking
+	//u8	bTXPowerTracking;
+	u8	TXPowercount;
+	u8	bTXPowerTrackingInit;
+	u8	TxPowerTrackControl;	//for mp mode, turn off txpwrtracking as default
+	u8	TM_Trigger;
+
+	u8	ThermalMeter[2];				// ThermalMeter, index 0 for RFIC0, and 1 for RFIC1
+	u8	ThermalValue;
+	u8	ThermalValue_LCK;
+	u8	ThermalValue_IQK;
+	u8	ThermalValue_DPK;
+
+	u8	bRfPiEnable;
+
+	//for APK
+	u32	APKoutput[2][2];	//path A/B; output1_1a/output1_2a
+	u8	bAPKdone;
+	u8	bAPKThermalMeterIgnore;
+	u8	bDPdone;
+	u8	bDPPathAOK;
+	u8	bDPPathBOK;
+
+	//for IQK
+	u32	RegC04;
+	u32	Reg874;
+	u32	RegC08;
+	u32	RegB68;
+	u32	RegB6C;
+	u32	Reg870;
+	u32	Reg860;
+	u32	Reg864;
+	u32	ADDA_backup[IQK_ADDA_REG_NUM];
+	u32	IQK_MAC_backup[IQK_MAC_REG_NUM];
+	u32	IQK_BB_backup_recover[9];
+	u32	IQK_BB_backup[IQK_BB_REG_NUM];
+	u8	PowerIndex_backup[6];
+
+	u8	bCCKinCH14;
+
+	char	CCK_index;
+	char	OFDM_index[2];
+
+	BOOLEAN		bDoneTxpower;
+	char	CCK_index_HP;
+	char	OFDM_index_HP[2];
+	u8	ThermalValue_HP[HP_THERMAL_NUM];
+	u8	ThermalValue_HP_index;
+
+	//for TxPwrTracking
+	int	RegE94;
+	int 	RegE9C;
+	int	RegEB4;
+	int	RegEBC;
+
+	u32	TXPowerTrackingCallbackCnt;	//cosa add for debug
+
+	u32	prv_traffic_idx; // edca turbo
+
+	// for dm_RF_Saving
+	u8	initialize;
+	u32	rf_saving_Reg874;
+	u32	rf_saving_RegC70;
+	u32	rf_saving_Reg85C;
+	u32	rf_saving_RegA74;
+
+	//for Antenna diversity
+#ifdef CONFIG_ANTENNA_DIVERSITY
+	SWAT_T DM_SWAT_Table;
+#endif
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+	_timer SwAntennaSwitchTimer;
+
+	u64	lastTxOkCnt;
+	u64	lastRxOkCnt;
+	u64	TXByteCnt_A;
+	u64	TXByteCnt_B;
+	u64	RXByteCnt_A;
+	u64	RXByteCnt_B;
+	u8	DoubleComfirm;
+	u8	TrafficLoad;
+#endif
+
+	s32	OFDM_Pkt_Cnt;
+	u8	RSSI_Select;
+	u8 	DIG_Dynamic_MIN ;
+
+	// Add for Reading Initial Data Rate SEL Register 0x484 during watchdog. Using for fill tx desc. 2011.3.21 by Thomas
+	u8	INIDATA_RATE[32];
+
+#ifdef CONFIG_DM_ADAPTIVITY
+	/* Ported from ODM, for ESTI Adaptivity test */
+	s8 TH_L2H_ini;
+	s8 TH_EDCCA_HL_diff;
+	s8 IGI_Base;
+	u8 IGI_target;
+	bool ForceEDCCA;
+	u8 AdapEn_RSSI;
+	s8 Force_TH_H;
+	s8 Force_TH_L;
+	u8 IGI_LowerBound;
+
+	bool	bPreEdccaEnable;
+#endif
+};
+
+
+/*------------------------Export global variable----------------------------*/
+/*------------------------Export global variable----------------------------*/
+/*------------------------Export Marco Definition---------------------------*/
+//#define DM_MultiSTA_InitGainChangeNotify(Event) {DM_DigTable.CurMultiSTAConnectState = Event;}
+
+
+//============================================================
+// function prototype
+//============================================================
+void rtl8192c_init_dm_priv(IN PADAPTER Adapter);
+void rtl8192c_deinit_dm_priv(IN PADAPTER Adapter);
+void rtl8192c_InitHalDm(IN PADAPTER Adapter);
+void rtl8192c_HalDmWatchDog(IN PADAPTER Adapter);
+
+VOID rtl8192c_dm_CheckTXPowerTracking(IN PADAPTER Adapter);
+
+void rtl8192c_dm_RF_Saving(IN PADAPTER pAdapter, IN u8 bForceInNormal);
+
+#ifdef CONFIG_BT_COEXIST
+void rtl8192c_set_dm_bt_coexist(_adapter *padapter, u8 bStart);
+void rtl8192c_issue_delete_ba(_adapter *padapter, u8 dir);
+#endif
+
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+void SwAntDivRSSICheck8192C(_adapter *padapter ,u32 RxPWDBAll);
+void SwAntDivRestAfterLink8192C(IN	PADAPTER Adapter);
+#endif
+#ifdef CONFIG_ANTENNA_DIVERSITY
+void	SwAntDivCompare8192C(PADAPTER Adapter, WLAN_BSSID_EX *dst, WLAN_BSSID_EX *src);
+u8 SwAntDivBeforeLink8192C(IN PADAPTER Adapter);
+#endif
+
+#endif	//__HAL8190PCIDM_H__
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_event.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_event.h
new file mode 100644
index 000000000000..ddc08bffe4d4
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_event.h
@@ -0,0 +1,26 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTL8192C_EVENT_H_
+#define _RTL8192C_EVENT_H_
+
+
+
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_hal.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_hal.h
new file mode 100644
index 000000000000..c80313909b75
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_hal.h
@@ -0,0 +1,934 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTL8192C_HAL_H__
+#define __RTL8192C_HAL_H__
+
+#include "hal_com.h"
+#include "rtl8192c_spec.h"
+#include "Hal8192CPhyReg.h"
+#include "Hal8192CPhyCfg.h"
+#include "rtl8192c_rf.h"
+#include "rtl8192c_dm.h"
+#include "rtl8192c_recv.h"
+#include "rtl8192c_xmit.h"
+#include "rtl8192c_cmd.h"
+#ifdef DBG_CONFIG_ERROR_DETECT
+#include "rtl8192c_sreset.h"
+#endif
+
+#ifdef CONFIG_PCI_HCI
+
+	#include "Hal8192CEHWImg.h"
+
+	#define RTL819X_DEFAULT_RF_TYPE			RF_2T2R
+	//#define RTL819X_DEFAULT_RF_TYPE			RF_1T2R
+	#define RTL819X_TOTAL_RF_PATH				2
+
+	//2TODO:  The following need to check!!
+	#define RTL8192C_FW_TSMC_IMG				"rtl8192CE\\rtl8192cfwT.bin"
+	#define RTL8192C_FW_UMC_IMG				"rtl8192CE\\rtl8192cfwU.bin"
+	#define RTL8192C_FW_UMC_B_IMG				"rtl8192CE\\rtl8192cfwU_B.bin"
+
+	#define RTL8188C_PHY_REG					"rtl8192CE\\PHY_REG_1T.txt"
+	#define RTL8188C_PHY_RADIO_A				"rtl8192CE\\radio_a_1T.txt"
+	#define RTL8188C_PHY_RADIO_B				"rtl8192CE\\radio_b_1T.txt"
+	#define RTL8188C_AGC_TAB					"rtl8192CE\\AGC_TAB_1T.txt"
+	#define RTL8188C_PHY_MACREG				"rtl8192CE\\MACREG_1T.txt"
+
+	#define RTL8192C_PHY_REG					"rtl8192CE\\PHY_REG_2T.txt"
+	#define RTL8192C_PHY_RADIO_A				"rtl8192CE\\radio_a_2T.txt"
+	#define RTL8192C_PHY_RADIO_B				"rtl8192CE\\radio_b_2T.txt"
+	#define RTL8192C_AGC_TAB					"rtl8192CE\\AGC_TAB_2T.txt"
+	#define RTL8192C_PHY_MACREG				"rtl8192CE\\MACREG_2T.txt"
+
+	#define RTL819X_PHY_MACPHY_REG			"rtl8192CE\\MACPHY_reg.txt"
+	#define RTL819X_PHY_MACPHY_REG_PG		"rtl8192CE\\MACPHY_reg_PG.txt"
+	#define RTL819X_PHY_MACREG				"rtl8192CE\\MAC_REG.txt"
+	#define RTL819X_PHY_REG					"rtl8192CE\\PHY_REG.txt"
+	#define RTL819X_PHY_REG_1T2R				"rtl8192CE\\PHY_REG_1T2R.txt"
+	#define RTL819X_PHY_REG_to1T1R				"rtl8192CE\\phy_to1T1R_a.txt"
+	#define RTL819X_PHY_REG_to1T2R				"rtl8192CE\\phy_to1T2R.txt"
+	#define RTL819X_PHY_REG_to2T2R				"rtl8192CE\\phy_to2T2R.txt"
+	#define RTL819X_PHY_REG_PG					"rtl8192CE\\PHY_REG_PG.txt"
+	#define RTL819X_AGC_TAB					"rtl8192CE\\AGC_TAB.txt"
+	#define RTL819X_PHY_RADIO_A				"rtl8192CE\\radio_a.txt"
+	#define RTL819X_PHY_RADIO_A_1T			"rtl8192CE\\radio_a_1t.txt"
+	#define RTL819X_PHY_RADIO_A_2T			"rtl8192CE\\radio_a_2t.txt"
+	#define RTL819X_PHY_RADIO_B				"rtl8192CE\\radio_b.txt"
+	#define RTL819X_PHY_RADIO_B_GM			"rtl8192CE\\radio_b_gm.txt"
+	#define RTL819X_PHY_RADIO_C				"rtl8192CE\\radio_c.txt"
+	#define RTL819X_PHY_RADIO_D				"rtl8192CE\\radio_d.txt"
+	#define RTL819X_EEPROM_MAP				"rtl8192CE\\8192ce.map"
+	#define RTL819X_EFUSE_MAP					"rtl8192CE\\8192ce.map"
+
+//---------------------------------------------------------------------
+//		RTL8723E From file
+//---------------------------------------------------------------------
+	#define RTL8723_FW_UMC_IMG				"rtl8723E\\rtl8723fw.bin"
+	#define RTL8723_PHY_REG					"rtl8723E\\PHY_REG_1T.txt"
+	#define RTL8723_PHY_RADIO_A				"rtl8723E\\radio_a_1T.txt"
+	#define RTL8723_PHY_RADIO_B				"rtl8723E\\radio_b_1T.txt"
+	#define RTL8723_AGC_TAB					"rtl8723E\\AGC_TAB_1T.txt"
+	#define RTL8723_PHY_MACREG 				"rtl8723E\\MAC_REG.txt"
+	#define RTL8723_PHY_MACREG 				"rtl8723E\\MAC_REG.txt"
+	#define RTL8723_PHY_REG_PG					"rtl8723E\\PHY_REG_PG.txt"
+	#define RTL8723_PHY_REG_MP 				"rtl8723E\\PHY_REG_MP.txt"
+
+	// The file name "_2T" is for 92CE, "_1T"  is for 88CE. Modified by tynli. 2009.11.24.
+	#define Rtl819XFwTSMCImageArray			Rtl8192CEFwTSMCImgArray
+	#define Rtl819XFwUMCACutImageArray			Rtl8192CEFwUMCACutImgArray
+	#define Rtl819XFwUMCBCutImageArray			Rtl8192CEFwUMCBCutImgArray
+
+	#define Rtl8723FwUMCImageArray				Rtl8192CEFwUMC8723ImgArray
+	#define Rtl819XMAC_Array					Rtl8192CEMAC_2T_Array
+	#define Rtl819XAGCTAB_2TArray				Rtl8192CEAGCTAB_2TArray
+	#define Rtl819XAGCTAB_1TArray				Rtl8192CEAGCTAB_1TArray
+	#define Rtl819XPHY_REG_2TArray				Rtl8192CEPHY_REG_2TArray
+	#define Rtl819XPHY_REG_1TArray				Rtl8192CEPHY_REG_1TArray
+	#define Rtl819XRadioA_2TArray				Rtl8192CERadioA_2TArray
+	#define Rtl819XRadioA_1TArray				Rtl8192CERadioA_1TArray
+	#define Rtl819XRadioB_2TArray				Rtl8192CERadioB_2TArray
+	#define Rtl819XRadioB_1TArray				Rtl8192CERadioB_1TArray
+	#define Rtl819XPHY_REG_Array_PG 			Rtl8192CEPHY_REG_Array_PG
+	#define Rtl819XPHY_REG_Array_MP 			Rtl8192CEPHY_REG_Array_MP
+
+#elif defined(CONFIG_USB_HCI)
+
+	#include "Hal8192CUHWImg.h"
+#ifdef CONFIG_WOWLAN
+	#include "Hal8192CUHWImg_wowlan.h"
+#endif //CONFIG_WOWLAN
+	//2TODO: We should define 8192S firmware related macro settings here!!
+	#define RTL819X_DEFAULT_RF_TYPE			RF_1T2R
+	#define RTL819X_TOTAL_RF_PATH				2
+
+	//TODO:  The following need to check!!
+	#define RTL8192C_FW_TSMC_IMG				"rtl8192CU\\rtl8192cfwT.bin"
+	#define RTL8192C_FW_UMC_IMG				"rtl8192CU\\rtl8192cfwU.bin"
+	#define RTL8192C_FW_UMC_B_IMG				"rtl8192CU\\rtl8192cfwU_B.bin"
+#ifdef CONFIG_WOWLAN
+	#define 	RTL8192C_FW_TSMC_WW_IMG			"rtl8192CU\\rtl8192cfwTww.bin"
+	#define 	RTL8192C_FW_UMC_WW_IMG			"rtl8192CU\\rtl8192cfwUww.bin"
+	#define 	RTL8192C_FW_UMC_B_WW_IMG		"rtl8192CU\\rtl8192cfwU_Bww.bin"
+#endif // CONFIG_WOWLAN
+	//#define RTL819X_FW_BOOT_IMG   				"rtl8192CU\\boot.img"
+	//#define RTL819X_FW_MAIN_IMG				"rtl8192CU\\main.img"
+	//#define RTL819X_FW_DATA_IMG				"rtl8192CU\\data.img"
+
+	#define RTL8188C_PHY_REG					"rtl8188CU\\PHY_REG.txt"
+	#define RTL8188C_PHY_RADIO_A				"rtl8188CU\\radio_a.txt"
+	#define RTL8188C_PHY_RADIO_B				"rtl8188CU\\radio_b.txt"
+	#define RTL8188C_PHY_RADIO_A_mCard		"rtl8192CU\\radio_a_1T_mCard.txt"
+	#define RTL8188C_PHY_RADIO_B_mCard		"rtl8192CU\\radio_b_1T_mCard.txt"
+	#define RTL8188C_PHY_RADIO_A_HP			"rtl8192CU\\radio_a_1T_HP.txt"
+	#define RTL8188C_AGC_TAB					"rtl8188CU\\AGC_TAB.txt"
+	#define RTL8188C_PHY_MACREG				"rtl8188CU\\MACREG.txt"
+
+	#define RTL8192C_PHY_REG					"rtl8192CU\\PHY_REG.txt"
+	#define RTL8192C_PHY_RADIO_A				"rtl8192CU\\radio_a.txt"
+	#define RTL8192C_PHY_RADIO_B				"rtl8192CU\\radio_b.txt"
+	#define RTL8192C_AGC_TAB					"rtl8192CU\\AGC_TAB.txt"
+	#define RTL8192C_PHY_MACREG				"rtl8192CU\\MACREG.txt"
+
+	#define RTL819X_PHY_REG_PG					"rtl8192CU\\PHY_REG_PG.txt"
+
+//---------------------------------------------------------------------
+//		RTL8723U From file
+//---------------------------------------------------------------------
+	#define RTL8723_FW_UMC_IMG				"rtl8723U\\rtl8723fw.bin"
+	#define RTL8723_PHY_REG					"rtl8723U\\PHY_REG_1T.txt"
+	#define RTL8723_PHY_RADIO_A				"rtl8723U\\radio_a_1T.txt"
+	#define RTL8723_PHY_RADIO_B				"rtl8723U\\radio_b_1T.txt"
+	#define RTL8723_AGC_TAB					"rtl8723U\\AGC_TAB_1T.txt"
+	#define RTL8723_PHY_MACREG 				"rtl8723U\\MAC_REG.txt"
+	#define RTL8723_PHY_MACREG 				"rtl8723U\\MAC_REG.txt"
+	#define RTL8723_PHY_REG_PG					"rtl8723U\\PHY_REG_PG.txt"
+	#define RTL8723_PHY_REG_MP					"rtl8723U\\PHY_REG_MP.txt"
+
+	// The file name "_2T" is for 92CU, "_1T"  is for 88CU. Modified by tynli. 2009.11.24.
+	#define Rtl819XFwImageArray					Rtl8192CUFwTSMCImgArray
+	#define Rtl819XFwTSMCImageArray			Rtl8192CUFwTSMCImgArray
+	#define Rtl819XFwUMCACutImageArray			Rtl8192CUFwUMCACutImgArray
+	#define Rtl819XFwUMCBCutImageArray			Rtl8192CUFwUMCBCutImgArray
+#ifdef CONFIG_WOWLAN
+	#define Rtl8192C_FwTSMCWWImageArray		Rtl8192CUFwTSMCWWImgArray
+	#define Rtl8192C_FwUMCWWImageArray		Rtl8192CUFwUMCACutWWImgArray
+	#define Rtl8192C_FwUMCBCutWWImageArray	Rtl8192CUFwUMCBCutWWImgArray
+#endif //CONFIG_WOWLAN
+	#define Rtl819XMAC_Array					Rtl8192CUMAC_2T_Array
+	#define Rtl819XAGCTAB_2TArray				Rtl8192CUAGCTAB_2TArray
+	#define Rtl819XAGCTAB_1TArray				Rtl8192CUAGCTAB_1TArray
+	#define Rtl819XAGCTAB_1T_HPArray			Rtl8192CUAGCTAB_1T_HPArray
+	#define Rtl819XPHY_REG_2TArray				Rtl8192CUPHY_REG_2TArray
+	#define Rtl819XPHY_REG_1TArray				Rtl8192CUPHY_REG_1TArray
+	#define Rtl819XPHY_REG_1T_mCardArray		Rtl8192CUPHY_REG_1T_mCardArray
+	#define Rtl819XPHY_REG_2T_mCardArray		Rtl8192CUPHY_REG_2T_mCardArray
+	#define Rtl819XPHY_REG_1T_HPArray			Rtl8192CUPHY_REG_1T_HPArray
+	#define Rtl819XRadioA_2TArray				Rtl8192CURadioA_2TArray
+	#define Rtl819XRadioA_1TArray				Rtl8192CURadioA_1TArray
+	#define Rtl819XRadioA_1T_mCardArray		Rtl8192CURadioA_1T_mCardArray
+	#define Rtl819XRadioB_2TArray				Rtl8192CURadioB_2TArray
+	#define Rtl819XRadioB_1TArray				Rtl8192CURadioB_1TArray
+	#define Rtl819XRadioB_1T_mCardArray		Rtl8192CURadioB_1T_mCardArray
+	#define Rtl819XRadioA_1T_HPArray			Rtl8192CURadioA_1T_HPArray
+	#define Rtl819XPHY_REG_Array_PG 			Rtl8192CUPHY_REG_Array_PG
+	#define Rtl819XPHY_REG_Array_PG_mCard 		Rtl8192CUPHY_REG_Array_PG_mCard
+	#define Rtl819XPHY_REG_Array_PG_HP			Rtl8192CUPHY_REG_Array_PG_HP
+	#define Rtl819XPHY_REG_Array_MP 			Rtl8192CUPHY_REG_Array_MP
+#endif
+
+#define DRVINFO_SZ	4 // unit is 8bytes
+#define PageNum_128(_Len)		(u32)(((_Len)>>7) + ((_Len)&0x7F ? 1:0))
+
+#define FW_8192C_SIZE					16384+32//16k
+#define FW_8192C_START_ADDRESS		0x1000
+//#define FW_8192C_END_ADDRESS		0x3FFF //Filen said this is for test chip
+#define FW_8192C_END_ADDRESS		0x1FFF
+
+#define MAX_PAGE_SIZE			4096	// @ page : 4k bytes
+
+#define IS_FW_HEADER_EXIST(_pFwHdr)	((le16_to_cpu(_pFwHdr->Signature)&0xFFF0) == 0x92C0 ||\
+									(le16_to_cpu(_pFwHdr->Signature)&0xFFF0) == 0x88C0 ||\
+									(le16_to_cpu(_pFwHdr->Signature)&0xFFF0) == 0x2300)
+
+typedef enum _FIRMWARE_SOURCE{
+	FW_SOURCE_IMG_FILE = 0,
+	FW_SOURCE_HEADER_FILE = 1,		//from header file
+}FIRMWARE_SOURCE, *PFIRMWARE_SOURCE;
+
+typedef struct _RT_FIRMWARE{
+	FIRMWARE_SOURCE	eFWSource;
+	u8*			szFwBuffer;
+	u32			ulFwLength;
+#ifdef CONFIG_WOWLAN
+	u8*			szWoWLANFwBuffer;
+	u32			ulWoWLANFwLength;
+#endif //CONFIG_WOWLAN
+}RT_FIRMWARE, *PRT_FIRMWARE, RT_FIRMWARE_92C, *PRT_FIRMWARE_92C;
+
+//
+// This structure must be cared byte-ordering
+//
+// Added by tynli. 2009.12.04.
+typedef struct _RT_8192C_FIRMWARE_HDR {//8-byte alinment required
+
+	//--- LONG WORD 0 ----
+	u16		Signature;	// 92C0: test chip; 92C, 88C0: test chip; 88C1: MP A-cut; 92C1: MP A-cut
+	u8		Category;	// AP/NIC and USB/PCI
+	u8		Function;	// Reserved for different FW function indcation, for further use when driver needs to download different FW in different conditions
+	u16		Version;		// FW Version
+	u8		Subversion;	// FW Subversion, default 0x00
+	u16		Rsvd1;
+
+
+	//--- LONG WORD 1 ----
+	u8		Month;	// Release time Month field
+	u8		Date;	// Release time Date field
+	u8		Hour;	// Release time Hour field
+	u8		Minute;	// Release time Minute field
+	u16		RamCodeSize;	// The size of RAM code
+	u16		Rsvd2;
+
+	//--- LONG WORD 2 ----
+	u32		SvnIdx;	// The SVN entry index
+	u32		Rsvd3;
+
+	//--- LONG WORD 3 ----
+	u32		Rsvd4;
+	u32		Rsvd5;
+
+}RT_8192C_FIRMWARE_HDR, *PRT_8192C_FIRMWARE_HDR;
+
+#define DRIVER_EARLY_INT_TIME		0x05
+#define BCN_DMA_ATIME_INT_TIME		0x02
+
+#ifdef CONFIG_USB_RX_AGGREGATION
+
+typedef enum _USB_RX_AGG_MODE{
+	USB_RX_AGG_DISABLE,
+	USB_RX_AGG_DMA,
+	USB_RX_AGG_USB,
+	USB_RX_AGG_MIX
+}USB_RX_AGG_MODE;
+
+#define MAX_RX_DMA_BUFFER_SIZE	10240		// 10K for 8192C RX DMA buffer
+
+#endif
+
+
+#define TX_SELE_HQ			BIT(0)		// High Queue
+#define TX_SELE_LQ			BIT(1)		// Low Queue
+#define TX_SELE_NQ			BIT(2)		// Normal Queue
+
+
+// Note: We will divide number of page equally for each queue other than public queue!
+
+#define TX_TOTAL_PAGE_NUMBER		0xF8
+#define TX_PAGE_BOUNDARY		(TX_TOTAL_PAGE_NUMBER + 1)
+
+// For Normal Chip Setting
+// (HPQ + LPQ + NPQ + PUBQ) shall be TX_TOTAL_PAGE_NUMBER
+#define NORMAL_PAGE_NUM_PUBQ			0xE7
+#define NORMAL_PAGE_NUM_HPQ			0x0C
+#define NORMAL_PAGE_NUM_LPQ			0x02
+#define NORMAL_PAGE_NUM_NPQ			0x02
+
+
+// For Test Chip Setting
+// (HPQ + LPQ + PUBQ) shall be TX_TOTAL_PAGE_NUMBER
+#define TEST_PAGE_NUM_PUBQ		0x7E
+
+
+// For Test Chip Setting
+#define WMM_TEST_TX_TOTAL_PAGE_NUMBER	0xF5
+#define WMM_TEST_TX_PAGE_BOUNDARY	(WMM_TEST_TX_TOTAL_PAGE_NUMBER + 1) //F6
+
+#define WMM_TEST_PAGE_NUM_PUBQ		0xA3
+#define WMM_TEST_PAGE_NUM_HPQ		0x29
+#define WMM_TEST_PAGE_NUM_LPQ		0x29
+
+
+//Note: For Normal Chip Setting ,modify later
+#define WMM_NORMAL_TX_TOTAL_PAGE_NUMBER	0xF5
+#define WMM_NORMAL_TX_PAGE_BOUNDARY	(WMM_TEST_TX_TOTAL_PAGE_NUMBER + 1) //F6
+
+#define WMM_NORMAL_PAGE_NUM_PUBQ		0x65
+#define WMM_NORMAL_PAGE_NUM_HPQ		0x30
+#define WMM_NORMAL_PAGE_NUM_LPQ			0x30
+#define WMM_NORMAL_PAGE_NUM_NPQ		0x30
+
+//-------------------------------------------------------------------------
+//	Chip specific
+//-------------------------------------------------------------------------
+#define CHIP_BONDING_IDENTIFIER(_value)	(((_value)>>22)&0x3)
+#define CHIP_BONDING_92C_1T2R	0x1
+#define CHIP_BONDING_88C_USB_MCARD	0x2
+#define CHIP_BONDING_88C_USB_HP	0x1
+
+//
+// 2011.01.06. Define new structure of chip version for RTL8723 and so on. Added by tynli.
+//
+/*
+     | BIT15:12           |  BIT11:8        | BIT 7              |  BIT6:4  |      BIT3          | BIT2:0  |
+     |-------------+-----------+-----------+-------+-----------+-------|
+     | IC version(CUT)  | ROM version  | Manufacturer  | RF type  |  Chip type       | IC Type |
+     |                           |                      | TSMC/UMC    |              | TEST/NORMAL|             |
+*/
+// [15:12] IC version(CUT): A-cut=0, B-cut=1, C-cut=2, D-cut=3
+// [7] Manufacturer: TSMC=0, UMC=1
+// [6:4] RF type: 1T1R=0, 1T2R=1, 2T2R=2
+// [3] Chip type: TEST=0, NORMAL=1
+// [2:0] IC type: 81xxC=0, 8723=1, 92D=2
+
+#define CHIP_8723						BIT(0)
+#define CHIP_92D						BIT(1)
+#define NORMAL_CHIP  					BIT(3)
+#define RF_TYPE_1T1R					(~(BIT(4)|BIT(5)|BIT(6)))
+#define RF_TYPE_1T2R					BIT(4)
+#define RF_TYPE_2T2R					BIT(5)
+#define CHIP_VENDOR_UMC				BIT(7)
+#define B_CUT_VERSION					BIT(12)
+#define C_CUT_VERSION					BIT(13)
+#define D_CUT_VERSION					((BIT(13)|BIT(14)))
+
+
+// MASK
+#define IC_TYPE_MASK					(BIT(0)|BIT(1)|BIT(2))
+#define CHIP_TYPE_MASK 				BIT(3)
+#define RF_TYPE_MASK					(BIT(4)|BIT(5)|BIT(6))
+#define MANUFACTUER_MASK			BIT(7)
+#define ROM_VERSION_MASK				(BIT(11)|BIT(10)|BIT(9)|BIT(8))
+#define CUT_VERSION_MASK				(BIT(15)|BIT(14)|BIT(13)|BIT(12))
+
+// Get element
+#define GET_CVID_IC_TYPE(version)			((version) & IC_TYPE_MASK)
+#define GET_CVID_CHIP_TYPE(version)			((version) & CHIP_TYPE_MASK)
+#define GET_CVID_RF_TYPE(version)			((version) & RF_TYPE_MASK)
+#define GET_CVID_MANUFACTUER(version)		((version) & MANUFACTUER_MASK)
+#define GET_CVID_ROM_VERSION(version)		((version) & ROM_VERSION_MASK)
+#define GET_CVID_CUT_VERSION(version)		((version) & CUT_VERSION_MASK)
+
+#define IS_81XXC(version)					((GET_CVID_IC_TYPE(version) == 0)? _TRUE : _FALSE)
+#define IS_8723_SERIES(version)				((GET_CVID_IC_TYPE(version) == CHIP_8723)? _TRUE : _FALSE)
+#define IS_92D(version)						((GET_CVID_IC_TYPE(version) == CHIP_92D)? _TRUE : _FALSE)
+#define IS_1T1R(version)						((GET_CVID_RF_TYPE(version))? _FALSE : _TRUE)
+#define IS_1T2R(version)						((GET_CVID_RF_TYPE(version) == RF_TYPE_1T2R)? _TRUE : _FALSE)
+#define IS_2T2R(version)						((GET_CVID_RF_TYPE(version) == RF_TYPE_2T2R)? _TRUE : _FALSE)
+#define IS_NORMAL_CHIP(version)				((GET_CVID_CHIP_TYPE(version))? _TRUE: _FALSE)
+#define IS_CHIP_VENDOR_UMC(version)			((GET_CVID_MANUFACTUER(version))? _TRUE: _FALSE)
+
+#define IS_81XXC_TEST_CHIP(version)			((IS_81XXC(version) && (!IS_NORMAL_CHIP(version)))? _TRUE: _FALSE)
+#define IS_92D_TEST_CHIP(version)				((IS_92D(version) && (!IS_NORMAL_CHIP(version)))? _TRUE: _FALSE)
+#define IS_92C_SERIAL(version)   				((IS_81XXC(version) && IS_2T2R(version)) ? _TRUE : _FALSE)
+#define IS_VENDOR_UMC_A_CUT(version)		((IS_CHIP_VENDOR_UMC(version)) ? ((GET_CVID_CUT_VERSION(version)) ? _FALSE : _TRUE) : _FALSE)
+#define IS_VENDOR_8723_A_CUT(version)		((IS_8723_SERIES(version)) ? ((GET_CVID_CUT_VERSION(version)) ? _FALSE : _TRUE) : _FALSE)
+// <tynli_Note> 88/92C UMC B-cut vendor is set to TSMC so we need to check CHIP_VENDOR_UMC bit is not 1.
+#define IS_81xxC_VENDOR_UMC_B_CUT(version)	((IS_CHIP_VENDOR_UMC(version)) ? ((GET_CVID_CUT_VERSION(version) == B_CUT_VERSION) ? _TRUE : _FALSE):_FALSE)
+#define IS_92D_SINGLEPHY(version)     			((IS_92D(version)) ? (IS_2T2R(version) ? _TRUE: _FALSE) : _FALSE)
+#define IS_92D_C_CUT(version)    				((IS_92D(version)) ? ((GET_CVID_CUT_VERSION(version) == 0x2) ? _TRUE : _FALSE) : _FALSE)
+#define IS_92D_D_CUT(version)    				((IS_92D(version)) ? ((GET_CVID_CUT_VERSION(version) == 0x3) ? _TRUE : _FALSE) : _FALSE)
+
+typedef enum _VERSION_8192C{
+	VERSION_TEST_CHIP_88C = 0x0000,
+	VERSION_TEST_CHIP_92C = 0x0020,
+	VERSION_TEST_UMC_CHIP_8723 = 0x0081,
+	VERSION_NORMAL_TSMC_CHIP_88C = 0x0008,
+	VERSION_NORMAL_TSMC_CHIP_92C = 0x0028,
+	VERSION_NORMAL_TSMC_CHIP_92C_1T2R = 0x0018,
+	VERSION_NORMAL_UMC_CHIP_88C_A_CUT = 0x0088,
+	VERSION_NORMAL_UMC_CHIP_92C_A_CUT = 0x00a8,
+	VERSION_NORMAL_UMC_CHIP_92C_1T2R_A_CUT = 0x0098,
+	VERSION_NORMAL_UMC_CHIP_8723_1T1R_A_CUT = 0x0089,
+	VERSION_NORMAL_UMC_CHIP_8723_1T1R_B_CUT = 0x1089,
+	VERSION_NORMAL_UMC_CHIP_88C_B_CUT = 0x1088,
+	VERSION_NORMAL_UMC_CHIP_92C_B_CUT = 0x10a8,
+	VERSION_NORMAL_UMC_CHIP_92C_1T2R_B_CUT = 0x1090,
+	VERSION_TEST_CHIP_92D_SINGLEPHY= 0x0022,
+	VERSION_TEST_CHIP_92D_DUALPHY = 0x0002,
+	VERSION_NORMAL_CHIP_92D_SINGLEPHY= 0x002a,
+	VERSION_NORMAL_CHIP_92D_DUALPHY = 0x000a,
+	VERSION_NORMAL_CHIP_92D_C_CUT_SINGLEPHY = 0x202a,
+	VERSION_NORMAL_CHIP_92D_C_CUT_DUALPHY = 0x200a,
+	VERSION_NORMAL_CHIP_92D_D_CUT_SINGLEPHY = 0x302a,
+	VERSION_NORMAL_CHIP_92D_D_CUT_DUALPHY = 0x300a,
+}VERSION_8192C,*PVERSION_8192C;
+
+
+
+//-------------------------------------------------------------------------
+//	Channel Plan
+//-------------------------------------------------------------------------
+enum ChannelPlan{
+	CHPL_FCC	= 0,
+	CHPL_IC		= 1,
+	CHPL_ETSI	= 2,
+	CHPL_SPAIN	= 3,
+	CHPL_FRANCE	= 4,
+	CHPL_MKK	= 5,
+	CHPL_MKK1	= 6,
+	CHPL_ISRAEL	= 7,
+	CHPL_TELEC	= 8,
+	CHPL_GLOBAL	= 9,
+	CHPL_WORLD	= 10,
+};
+
+typedef struct _TxPowerInfo{
+	u8 CCKIndex[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 HT40_1SIndex[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 HT40_2SIndexDiff[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	s8 HT20IndexDiff[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 OFDMIndexDiff[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 HT40MaxOffset[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 HT20MaxOffset[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 TSSI_A;
+	u8 TSSI_B;
+}TxPowerInfo, *PTxPowerInfo;
+
+#define		EFUSE_REAL_CONTENT_LEN		512
+#define		EFUSE_MAP_LEN					128
+#define		EFUSE_MAX_SECTION			16
+#define		EFUSE_IC_ID_OFFSET			506	//For some inferiority IC purpose. added by Roger, 2009.09.02.
+#define 		AVAILABLE_EFUSE_ADDR(addr) 	(addr < EFUSE_REAL_CONTENT_LEN)
+//
+// <Roger_Notes> To prevent out of boundary programming case, leave 1byte and program full section
+// 9bytes + 1byt + 5bytes and pre 1byte.
+// For worst case:
+// | 1byte|----8bytes----|1byte|--5bytes--|
+// |         |            Reserved(14bytes)	      |
+//
+#define		EFUSE_OOB_PROTECT_BYTES 		15	// PG data exclude header, dummy 6 bytes frome CP test and reserved 1byte.
+
+
+#define		EFUSE_MAP_LEN_8723			256
+#define		EFUSE_MAX_SECTION_8723		32
+
+//========================================================
+//			EFUSE for BT definition
+//========================================================
+#define		EFUSE_BT_REAL_CONTENT_LEN		1536	// 512*3
+#define		EFUSE_BT_MAP_LEN					1024	// 1k bytes
+#define		EFUSE_BT_MAX_SECTION				128		// 1024/8
+
+#define		EFUSE_PROTECT_BYTES_BANK			16
+
+//
+// <Roger_Notes> For RTL8723 WiFi/BT/GPS multi-function configuration. 2010.10.06.
+//
+typedef enum _RT_MULTI_FUNC{
+	RT_MULTI_FUNC_NONE = 0x00,
+	RT_MULTI_FUNC_WIFI = 0x01,
+	RT_MULTI_FUNC_BT = 0x02,
+	RT_MULTI_FUNC_GPS = 0x04,
+}RT_MULTI_FUNC,*PRT_MULTI_FUNC;
+
+//
+// <Roger_Notes> For RTL8723 WiFi PDn/GPIO polarity control configuration. 2010.10.08.
+//
+typedef enum _RT_POLARITY_CTL{
+	RT_POLARITY_LOW_ACT = 0,
+	RT_POLARITY_HIGH_ACT = 1,
+}RT_POLARITY_CTL,*PRT_POLARITY_CTL;
+
+// For RTL8723 regulator mode. by tynli. 2011.01.14.
+typedef enum _RT_REGULATOR_MODE{
+	RT_SWITCHING_REGULATOR = 0,
+	RT_LDO_REGULATOR = 1,
+}RT_REGULATOR_MODE,*PRT_REGULATOR_MODE;
+
+enum c2h_id_8192c {
+	C2H_DBG = 0,
+	C2H_TSF = 1,
+	C2H_AP_RPT_RSP = 2,
+	C2H_CCX_TX_RPT = 3,
+	C2H_BT_RSSI = 4,
+	C2H_BT_OP_MODE = 5,
+	C2H_EXT_RA_RPT = 6,
+	C2H_HW_INFO_EXCH = 10,
+	C2H_C2H_H2C_TEST = 11,
+	C2H_BT_INFO = 12,
+	C2H_BT_MP_INFO = 15,
+	MAX_C2HEVENT
+};
+
+#ifdef CONFIG_PCI_HCI
+struct hal_data_8192ce
+{
+	VERSION_8192C		VersionID;
+	RT_MULTI_FUNC		MultiFunc; // For multi-function consideration.
+	RT_POLARITY_CTL		PolarityCtl; // For Wifi PDn Polarity control.
+	RT_REGULATOR_MODE	RegulatorMode; // switching regulator or LDO
+	u16	CustomerID;
+
+	u16	FirmwareVersion;
+	u16	FirmwareVersionRev;
+	u16	FirmwareSubVersion;
+
+	u32	IntrMask[2];
+	u32	IntrMaskToSet[2];
+
+	u32	DisabledFunctions;
+
+	//current WIFI_PHY values
+	u32	ReceiveConfig;
+	u32	TransmitConfig;
+	WIRELESS_MODE		CurrentWirelessMode;
+	HT_CHANNEL_WIDTH	CurrentChannelBW;
+	u8	CurrentChannel;
+	u8	nCur40MhzPrimeSC;// Control channel sub-carrier
+
+	u16	BasicRateSet;
+
+	//rf_ctrl
+	_lock	rf_lock;
+	u8	rf_chip;
+	u8	rf_type;
+	u8	NumTotalRFPath;
+
+	INTERFACE_SELECT_8192CPCIe	InterfaceSel;
+
+	//
+	// EEPROM setting.
+	//
+	u16	EEPROMVID;
+	u16	EEPROMDID;
+	u16	EEPROMSVID;
+	u16	EEPROMSMID;
+	u16	EEPROMChannelPlan;
+	u16	EEPROMVersion;
+
+	u8	EEPROMChnlAreaTxPwrCCK[2][3];
+	u8	EEPROMChnlAreaTxPwrHT40_1S[2][3];
+	u8	EEPROMChnlAreaTxPwrHT40_2SDiff[2][3];
+	u8	EEPROMPwrLimitHT20[3];
+	u8	EEPROMPwrLimitHT40[3];
+
+	u8	bTXPowerDataReadFromEEPORM;
+	u8	EEPROMThermalMeter;
+	u8	EEPROMTSSI[2];
+
+	u8	EEPROMCustomerID;
+	u8	EEPROMBoardType;
+	u8	EEPROMRegulatory;
+
+	u8	bDefaultAntenna;
+	u8	bIQKInitialized;
+
+	u8	TxPwrLevelCck[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+	u8	TxPwrLevelHT40_1S[RF_PATH_MAX][CHANNEL_MAX_NUMBER];	// For HT 40MHZ pwr
+	u8	TxPwrLevelHT40_2S[RF_PATH_MAX][CHANNEL_MAX_NUMBER];	// For HT 40MHZ pwr
+	s8	TxPwrHt20Diff[RF_PATH_MAX][CHANNEL_MAX_NUMBER];// HT 20<->40 Pwr diff
+	u8	TxPwrLegacyHtDiff[RF_PATH_MAX][CHANNEL_MAX_NUMBER];// For HT<->legacy pwr diff
+	// For power group
+	u8	PwrGroupHT20[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+	u8	PwrGroupHT40[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+
+	u8	LegacyHTTxPowerDiff;// Legacy to HT rate power diff
+
+#ifdef CONFIG_BT_COEXIST
+	struct btcoexist_priv	bt_coexist;
+#endif
+
+	// Read/write are allow for following hardware information variables
+	u8	framesync;
+	u32	framesyncC34;
+	u8	framesyncMonitor;
+	u8	DefaultInitialGain[4];
+	u8	pwrGroupCnt;
+	u32	MCSTxPowerLevelOriginalOffset[7][16];
+	u32	CCKTxPowerLevelOriginalOffset;
+
+	u32	AntennaTxPath;					// Antenna path Tx
+	u32	AntennaRxPath;					// Antenna path Rx
+	u8	BluetoothCoexist;
+	u8	ExternalPA;
+
+	//u32	LedControlNum;
+	//u32	LedControlMode;
+	u8	bLedOpenDrain; // Support Open-drain arrangement for controlling the LED. Added by Roger, 2009.10.16.
+	//u32	TxPowerTrackControl;
+	u8	b1x1RecvCombine;	// for 1T1R receive combining
+
+	u8	bCurrentTurboEDCA;
+	u32	AcParam_BE; //Original parameter for BE, use for EDCA turbo.
+
+	//vivi, for tx power tracking, 20080407
+	//u16	TSSI_13dBm;
+	//u32	Pwr_Track;
+	// The current Tx Power Level
+	u8	CurrentCckTxPwrIdx;
+	u8	CurrentOfdm24GTxPwrIdx;
+
+	BB_REGISTER_DEFINITION_T	PHYRegDef[4];	//Radio A/B/C/D
+
+	BOOLEAN		bRFPathRxEnable[4];	// We support 4 RF path now.
+
+	u32	RfRegChnlVal[2];
+
+	u8	bCckHighPower;
+
+	//RDG enable
+	BOOLEAN	 bRDGEnable;
+
+	//for host message to fw
+	u8	LastHMEBoxNum;
+
+	u8	fw_ractrl;
+	u8	RegTxPause;
+	// Beacon function related global variable.
+	u32	RegBcnCtrlVal;
+	u8	RegFwHwTxQCtrl;
+	u8	RegReg542;
+	u8	CurAntenna;
+	u8	AntDivCfg;
+
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+	//SW Antenna Switch
+	s32				RSSI_sum_A;
+	s32				RSSI_sum_B;
+	s32				RSSI_cnt_A;
+	s32				RSSI_cnt_B;
+	BOOLEAN		RSSI_test;
+#endif
+#ifdef CONFIG_HW_ANTENNA_DIVERSITY
+	//Hybrid Antenna Diversity
+	u32				CCK_Ant1_Cnt;
+	u32				CCK_Ant2_Cnt;
+	u32				OFDM_Ant1_Cnt;
+	u32				OFDM_Ant2_Cnt;
+#endif
+
+	struct dm_priv	dmpriv;
+	u8	bDumpRxPkt;//for debug
+#ifdef DBG_CONFIG_ERROR_DETECT
+	struct sreset_priv srestpriv;
+#endif
+	u8	bInterruptMigration;
+	u8	bDisableTxInt;
+	u8	bGpioHwWpsPbc;
+
+	u8	FwRsvdPageStartOffset; //2010.06.23. Added by tynli. Reserve page start offset except beacon in TxQ.
+
+	u16	EfuseUsedBytes;
+
+#ifdef CONFIG_P2P
+	struct P2P_PS_Offload_t	p2p_ps_offload;
+#endif //CONFIG_P2P
+};
+
+typedef struct hal_data_8192ce HAL_DATA_TYPE, *PHAL_DATA_TYPE;
+
+//
+// Function disabled.
+//
+#define DF_TX_BIT		BIT0
+#define DF_RX_BIT		BIT1
+#define DF_IO_BIT		BIT2
+#define DF_IO_D3_BIT			BIT3
+
+#define RT_DF_TYPE		u32
+#define RT_DISABLE_FUNC(__pAdapter, __FuncBits) ((__pAdapter)->DisabledFunctions |= ((RT_DF_TYPE)(__FuncBits)))
+#define RT_ENABLE_FUNC(__pAdapter, __FuncBits) ((__pAdapter)->DisabledFunctions &= (~((RT_DF_TYPE)(__FuncBits))))
+#define RT_IS_FUNC_DISABLED(__pAdapter, __FuncBits) ( (__pAdapter)->DisabledFunctions & (__FuncBits) )
+#define IS_MULTI_FUNC_CHIP(_Adapter)	(((((PHAL_DATA_TYPE)(_Adapter->HalData))->MultiFunc) & (RT_MULTI_FUNC_BT|RT_MULTI_FUNC_GPS)) ? _TRUE : _FALSE)
+
+void InterruptRecognized8192CE(PADAPTER Adapter, PRT_ISR_CONTENT pIsrContent);
+VOID UpdateInterruptMask8192CE(PADAPTER Adapter, u32 AddMSR, u32 AddMSR1, u32 RemoveMSR, u32 RemoveMSR1);
+#endif
+
+#ifdef CONFIG_USB_HCI
+struct hal_data_8192cu
+{
+	VERSION_8192C		VersionID;
+	RT_MULTI_FUNC		MultiFunc; // For multi-function consideration.
+	RT_POLARITY_CTL		PolarityCtl; // For Wifi PDn Polarity control.
+	RT_REGULATOR_MODE	RegulatorMode; // switching regulator or LDO
+	u16	CustomerID;
+
+	u16	FirmwareVersion;
+	u16	FirmwareVersionRev;
+	u16	FirmwareSubVersion;
+
+	//current WIFI_PHY values
+	u32	ReceiveConfig;
+	WIRELESS_MODE		CurrentWirelessMode;
+	HT_CHANNEL_WIDTH	CurrentChannelBW;
+	u8	CurrentChannel;
+	u8	nCur40MhzPrimeSC;// Control channel sub-carrier
+
+	u16	BasicRateSet;
+
+	//rf_ctrl
+	u8	rf_chip;
+	u8	rf_type;
+	u8	NumTotalRFPath;
+
+	u8	BoardType;
+	//INTERFACE_SELECT_8192CUSB	InterfaceSel;
+
+	//
+	// EEPROM setting.
+	//
+	u16	EEPROMVID;
+	u16	EEPROMPID;
+	u16	EEPROMSVID;
+	u16	EEPROMSDID;
+	u8	EEPROMCustomerID;
+	u8	EEPROMSubCustomerID;
+	u8	EEPROMVersion;
+	u8	EEPROMRegulatory;
+
+	u8	bTXPowerDataReadFromEEPORM;
+	u8	EEPROMThermalMeter;
+
+	u8	bIQKInitialized;
+
+	u8	TxPwrLevelCck[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+	u8	TxPwrLevelHT40_1S[RF_PATH_MAX][CHANNEL_MAX_NUMBER];	// For HT 40MHZ pwr
+	u8	TxPwrLevelHT40_2S[RF_PATH_MAX][CHANNEL_MAX_NUMBER];	// For HT 40MHZ pwr
+	s8	TxPwrHt20Diff[RF_PATH_MAX][CHANNEL_MAX_NUMBER];// HT 20<->40 Pwr diff
+	u8	TxPwrLegacyHtDiff[RF_PATH_MAX][CHANNEL_MAX_NUMBER];// For HT<->legacy pwr diff
+	// For power group
+	u8	PwrGroupHT20[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+	u8	PwrGroupHT40[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+
+	u8	LegacyHTTxPowerDiff;// Legacy to HT rate power diff
+
+	// Read/write are allow for following hardware information variables
+	u8	framesync;
+	u32	framesyncC34;
+	u8	framesyncMonitor;
+	u8	DefaultInitialGain[4];
+	u8	pwrGroupCnt;
+	u32	MCSTxPowerLevelOriginalOffset[7][16];
+	u32	CCKTxPowerLevelOriginalOffset;
+
+	u32	AntennaTxPath;					// Antenna path Tx
+	u32	AntennaRxPath;					// Antenna path Rx
+	u8	BluetoothCoexist;
+	u8	ExternalPA;
+
+	u8	bLedOpenDrain; // Support Open-drain arrangement for controlling the LED. Added by Roger, 2009.10.16.
+
+	//u32	LedControlNum;
+	//u32	LedControlMode;
+	//u32	TxPowerTrackControl;
+	u8	b1x1RecvCombine;	// for 1T1R receive combining
+
+	u8	bCurrentTurboEDCA;
+	u32	AcParam_BE; //Original parameter for BE, use for EDCA turbo.
+
+	//vivi, for tx power tracking, 20080407
+	//u16	TSSI_13dBm;
+	//u32	Pwr_Track;
+	// The current Tx Power Level
+	u8	CurrentCckTxPwrIdx;
+	u8	CurrentOfdm24GTxPwrIdx;
+
+	BB_REGISTER_DEFINITION_T	PHYRegDef[4];	//Radio A/B/C/D
+
+	BOOLEAN		bRFPathRxEnable[4];	// We support 4 RF path now.
+
+	u32	RfRegChnlVal[2];
+
+	u8	bCckHighPower;
+
+	//RDG enable
+	BOOLEAN	 bRDGEnable;
+
+	//for host message to fw
+	u8	LastHMEBoxNum;
+
+	u8	fw_ractrl;
+	u8	RegTxPause;
+	// Beacon function related global variable.
+	u32	RegBcnCtrlVal;
+	u8	RegFwHwTxQCtrl;
+	u8	RegReg542;
+
+	struct dm_priv	dmpriv;
+#ifdef DBG_CONFIG_ERROR_DETECT
+	struct sreset_priv srestpriv;
+#endif
+
+#ifdef CONFIG_BT_COEXIST
+	struct btcoexist_priv	bt_coexist;
+#endif
+	u8	CurAntenna;
+	u8	AntDivCfg;
+
+#ifdef CONFIG_SW_ANTENNA_DIVERSITY
+	//SW Antenna Switch
+	s32				RSSI_sum_A;
+	s32				RSSI_sum_B;
+	s32				RSSI_cnt_A;
+	s32				RSSI_cnt_B;
+	BOOLEAN		RSSI_test;
+#endif
+#ifdef CONFIG_HW_ANTENNA_DIVERSITY
+	//Hybrid Antenna Diversity
+	u32				CCK_Ant1_Cnt;
+	u32				CCK_Ant2_Cnt;
+	u32				OFDM_Ant1_Cnt;
+	u32				OFDM_Ant2_Cnt;
+#endif
+
+	u8	bDumpRxPkt;//for debug
+	u8	FwRsvdPageStartOffset; //2010.06.23. Added by tynli. Reserve page start offset except beacon in TxQ.
+
+	// 2010/08/09 MH Add CU power down mode.
+	BOOLEAN		pwrdown;
+
+	// For 92C USB endpoint setting
+	//
+
+	u32	UsbBulkOutSize;
+
+	int	RtBulkOutPipe[3];
+	int	RtBulkInPipe;
+	int	RtIntInPipe;
+	// Add for dual MAC  0--Mac0 1--Mac1
+	u32	interfaceIndex;
+
+	u8	OutEpQueueSel;
+	u8	OutEpNumber;
+
+	u8	Queue2EPNum[8];//for out endpoint number mapping
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+	u8	UsbTxAggMode;
+	u8	UsbTxAggDescNum;
+#endif
+#ifdef CONFIG_USB_RX_AGGREGATION
+	u16	HwRxPageSize;				// Hardware setting
+	u32	MaxUsbRxAggBlock;
+
+	USB_RX_AGG_MODE	UsbRxAggMode;
+	u8	UsbRxAggBlockCount;			// USB Block count. Block size is 512-byte in hight speed and 64-byte in full speed
+	u8	UsbRxAggBlockTimeout;
+	u8	UsbRxAggPageCount;			// 8192C DMA page count
+	u8	UsbRxAggPageTimeout;
+#endif
+
+	// 2010/12/10 MH Add for USB aggreation mode dynamic shceme.
+	BOOLEAN		UsbRxHighSpeedMode;
+
+	// 2010/11/22 MH Add for slim combo debug mode selective.
+	// This is used for fix the drawback of CU TSMC-A/UMC-A cut. HW auto suspend ability. Close BT clock.
+	BOOLEAN		SlimComboDbg;
+
+	u16	EfuseUsedBytes;
+
+#ifdef CONFIG_P2P
+	struct P2P_PS_Offload_t	p2p_ps_offload;
+#endif //CONFIG_P2P
+};
+
+typedef struct hal_data_8192cu HAL_DATA_TYPE, *PHAL_DATA_TYPE;
+#endif
+
+#define GET_HAL_DATA(__pAdapter)	((HAL_DATA_TYPE *)((__pAdapter)->HalData))
+#define GET_RF_TYPE(priv)	(GET_HAL_DATA(priv)->rf_type)
+
+#define INCLUDE_MULTI_FUNC_BT(_Adapter)	(GET_HAL_DATA(_Adapter)->MultiFunc & RT_MULTI_FUNC_BT)
+#define INCLUDE_MULTI_FUNC_GPS(_Adapter)	(GET_HAL_DATA(_Adapter)->MultiFunc & RT_MULTI_FUNC_GPS)
+
+VOID rtl8192c_FirmwareSelfReset(IN PADAPTER Adapter);
+int FirmwareDownload92C(IN PADAPTER Adapter,IN	BOOLEAN			bUsedWoWLANFw);
+VOID InitializeFirmwareVars92C(PADAPTER Adapter);
+u8 GetEEPROMSize8192C(PADAPTER Adapter);
+void rtl8192c_EfuseParseChnlPlan(PADAPTER padapter, u8 *hwinfo, BOOLEAN AutoLoadFail);
+VERSION_8192C rtl8192c_ReadChipVersion(IN PADAPTER Adapter);
+void rtl8192c_ReadBluetoothCoexistInfo(PADAPTER Adapter, u8 *PROMContent, BOOLEAN AutoloadFail);
+//void rtl8192c_free_hal_data(_adapter * padapter);
+VOID rtl8192c_EfuseParseIDCode(PADAPTER pAdapter, u8 *hwinfo);
+void rtl8192c_set_hal_ops(struct hal_ops *pHalFunc);
+
+s32 c2h_id_filter_ccx_8192c(u8 id);
+#endif
+
+#ifdef CONFIG_MP_INCLUDED
+
+extern void Hal_SetAntenna(PADAPTER pAdapter);
+extern void Hal_SetBandwidth(PADAPTER pAdapter);
+
+extern void Hal_SetTxPower(PADAPTER pAdapter);
+extern void Hal_SetCarrierSuppressionTx(PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetSingleToneTx ( PADAPTER pAdapter , u8 bStart );
+extern void Hal_SetSingleCarrierTx (PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetContinuousTx (PADAPTER pAdapter, u8 bStart);
+
+extern void Hal_SetDataRate(PADAPTER pAdapter);
+extern void Hal_SetChannel(PADAPTER pAdapter);
+extern void Hal_SetAntennaPathPower(PADAPTER pAdapter);
+extern s32 Hal_SetThermalMeter(PADAPTER pAdapter, u8 target_ther);
+extern s32 Hal_SetPowerTracking(PADAPTER padapter, u8 enable);
+extern void Hal_GetPowerTracking(PADAPTER padapter, u8 * enable);
+extern void Hal_GetThermalMeter(PADAPTER pAdapter, u8 *value);
+extern void Hal_mpt_SwitchRfSetting(PADAPTER pAdapter);
+extern void Hal_MPT_CCKTxPowerAdjust(PADAPTER Adapter, BOOLEAN bInCH14);
+extern void Hal_MPT_CCKTxPowerAdjustbyIndex(PADAPTER pAdapter, BOOLEAN beven);
+extern void Hal_SetCCKTxPower(PADAPTER pAdapter, u8 * TxPower);
+extern void Hal_SetOFDMTxPower(PADAPTER pAdapter, u8 * TxPower);
+extern void Hal_TriggerRFThermalMeter(PADAPTER pAdapter);
+extern u8 Hal_ReadRFThermalMeter(PADAPTER pAdapter);
+extern void Hal_SetCCKContinuousTx(PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetOFDMContinuousTx(PADAPTER pAdapter, u8 bStart);
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_led.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_led.h
new file mode 100644
index 000000000000..88002db1b834
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_led.h
@@ -0,0 +1,41 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTL8192C_LED_H_
+#define __RTL8192C_LED_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+//================================================================================
+// Interface to manipulate LED objects.
+//================================================================================
+#ifdef CONFIG_USB_HCI
+void rtl8192cu_InitSwLeds(_adapter *padapter);
+void rtl8192cu_DeInitSwLeds(_adapter *padapter);
+#endif
+#ifdef CONFIG_PCI_HCI
+void rtl8192ce_gen_RefreshLedState(PADAPTER Adapter);
+void rtl8192ce_InitSwLeds(_adapter *padapter);
+void rtl8192ce_DeInitSwLeds(_adapter *padapter);
+#endif
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_recv.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_recv.h
new file mode 100644
index 000000000000..9cfca910dd4e
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_recv.h
@@ -0,0 +1,183 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTL8192C_RECV_H_
+#define _RTL8192C_RECV_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+#ifdef PLATFORM_OS_XP
+	#define NR_RECVBUFF (16)
+#elif defined(PLATFORM_OS_CE)
+	#define NR_RECVBUFF (4)
+#else
+#ifdef CONFIG_SINGLE_RECV_BUF
+	#define NR_RECVBUFF (1)
+#else
+	#define NR_RECVBUFF (4)
+#endif //CONFIG_SINGLE_RECV_BUF
+
+	#define NR_PREALLOC_RECV_SKB (8)
+#endif
+
+
+#define RECV_BLK_SZ 512
+#define RECV_BLK_CNT 16
+#define RECV_BLK_TH RECV_BLK_CNT
+
+#if defined(CONFIG_USB_HCI)
+
+#ifdef PLATFORM_OS_CE
+#define MAX_RECVBUF_SZ (8192+1024) // 8K+1k
+#else
+	#ifndef CONFIG_MINIMAL_MEMORY_USAGE
+		//#define MAX_RECVBUF_SZ (32768) // 32k
+		//#define MAX_RECVBUF_SZ (16384) //16K
+		//#define MAX_RECVBUF_SZ (10240) //10K
+		#ifdef CONFIG_PLATFORM_MSTAR
+			#define MAX_RECVBUF_SZ (8192) // 8K
+		#else
+			#define MAX_RECVBUF_SZ (15360) // 15k < 16k
+		#endif
+		//#define MAX_RECVBUF_SZ (8192+1024) // 8K+1k
+	#else
+		#define MAX_RECVBUF_SZ (4000) // about 4K
+	#endif
+#endif
+
+#elif defined(CONFIG_PCI_HCI)
+//#ifndef CONFIG_MINIMAL_MEMORY_USAGE
+//	#define MAX_RECVBUF_SZ (9100)
+//#else
+	#define MAX_RECVBUF_SZ (4000) // about 4K
+//#endif
+
+#define RX_MPDU_QUEUE				0
+#define RX_CMD_QUEUE				1
+#define RX_MAX_QUEUE				2
+#endif
+
+
+#define RECV_BULK_IN_ADDR		0x80
+#define RECV_INT_IN_ADDR		0x81
+
+#define PHY_RSSI_SLID_WIN_MAX				100
+#define PHY_LINKQUALITY_SLID_WIN_MAX		20
+
+
+struct phy_stat
+{
+	unsigned int phydw0;
+
+	unsigned int phydw1;
+
+	unsigned int phydw2;
+
+	unsigned int phydw3;
+
+	unsigned int phydw4;
+
+	unsigned int phydw5;
+
+	unsigned int phydw6;
+
+	unsigned int phydw7;
+};
+
+typedef struct _Phy_OFDM_Rx_Status_Report_8192cd
+{
+	unsigned char	trsw_gain_X[4];
+	unsigned char	pwdb_all;
+	unsigned char	cfosho_X[4];
+	unsigned char	cfotail_X[4];
+	unsigned char	rxevm_X[2];
+	unsigned char	rxsnr_X[4];
+	unsigned char	pdsnr_X[2];
+	unsigned char	csi_current_X[2];
+	unsigned char	csi_target_X[2];
+	unsigned char	sigevm;
+	unsigned char	max_ex_pwr;
+//#ifdef RTL8192SE
+#ifdef CONFIG_LITTLE_ENDIAN
+	unsigned char ex_intf_flg:1;
+	unsigned char sgi_en:1;
+	unsigned char rxsc:2;
+	//unsigned char rsvd:4;
+	unsigned char idle_long:1;
+	unsigned char r_ant_train_en:1;
+	unsigned char ANTSELB:1;
+	unsigned char ANTSEL:1;
+#else	// _BIG_ENDIAN_
+	//unsigned char rsvd:4;
+	unsigned char ANTSEL:1;
+	unsigned char ANTSELB:1;
+	unsigned char r_ant_train_en:1;
+	unsigned char idle_long:1;
+	unsigned char rxsc:2;
+	unsigned char sgi_en:1;
+	unsigned char ex_intf_flg:1;
+#endif
+//#else	// RTL8190, RTL8192E
+//	unsigned char	sgi_en;
+//	unsigned char	rxsc_sgien_exflg;
+//#endif
+} __attribute__ ((packed))PHY_STS_OFDM_8192CD_T,PHY_RX_DRIVER_INFO_8192CD;
+
+typedef struct _Phy_CCK_Rx_Status_Report_8192cd
+{
+	/* For CCK rate descriptor. This is a signed 8:1 variable. LSB bit presend
+		0.5. And MSB 7 bts presend a signed value. Range from -64~+63.5. */
+	u8	adc_pwdb_X[4];
+	u8	SQ_rpt;
+	u8	cck_agc_rpt;
+} PHY_STS_CCK_8192CD_T;
+
+
+// Rx smooth factor
+#define	Rx_Smooth_Factor (20)
+
+
+#ifdef CONFIG_USB_HCI
+typedef struct _INTERRUPT_MSG_FORMAT_EX{
+	unsigned int C2H_MSG0;
+	unsigned int C2H_MSG1;
+	unsigned int C2H_MSG2;
+	unsigned int C2H_MSG3;
+	unsigned int HISR; // from HISR Reg0x124, read to clear
+	unsigned int HISRE;// from HISRE Reg0x12c, read to clear
+	unsigned int  MSG_EX;
+}INTERRUPT_MSG_FORMAT_EX,*PINTERRUPT_MSG_FORMAT_EX;
+
+void rtl8192cu_init_recvbuf(_adapter *padapter, struct recv_buf *precvbuf);
+int	rtl8192cu_init_recv_priv(_adapter * padapter);
+void rtl8192cu_free_recv_priv(_adapter * padapter);
+#endif
+
+#ifdef CONFIG_PCI_HCI
+int	rtl8192ce_init_recv_priv(_adapter * padapter);
+void rtl8192ce_free_recv_priv(_adapter * padapter);
+#endif
+
+void rtl8192c_translate_rx_signal_stuff(union recv_frame *precvframe, struct phy_stat *pphy_info);
+void rtl8192c_query_rx_desc_status(union recv_frame *precvframe, struct recv_stat *pdesc);
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_rf.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_rf.h
new file mode 100644
index 000000000000..7e225034049f
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_rf.h
@@ -0,0 +1,91 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/******************************************************************************
+ *
+ *
+ * Module:	rtl8192c_rf.h	( Header File)
+ *
+ * Note:	Collect every HAL RF type exter API or constant.
+ *
+ * Function:
+ *
+ * Export:
+ *
+ * Abbrev:
+ *
+ * History:
+ * Data			Who		Remark
+ *
+ * 09/25/2008	MHC		Create initial version.
+ *
+ *
+******************************************************************************/
+#ifndef _RTL8192C_RF_H_
+#define _RTL8192C_RF_H_
+/* Check to see if the file has been included already.  */
+
+
+/*--------------------------Define Parameters-------------------------------*/
+
+//
+// For RF 6052 Series
+//
+#define		RF6052_MAX_TX_PWR			0x3F
+#define		RF6052_MAX_REG				0x3F
+#define		RF6052_MAX_PATH				2
+/*--------------------------Define Parameters-------------------------------*/
+
+
+/*------------------------------Define structure----------------------------*/
+
+/*------------------------------Define structure----------------------------*/
+
+
+/*------------------------Export global variable----------------------------*/
+/*------------------------Export global variable----------------------------*/
+
+/*------------------------Export Marco Definition---------------------------*/
+
+/*------------------------Export Marco Definition---------------------------*/
+
+
+/*--------------------------Exported Function prototype---------------------*/
+
+//
+// RF RL6052 Series API
+//
+void		rtl8192c_RF_ChangeTxPath(	IN	PADAPTER	Adapter,
+										IN	u16		DataRate);
+void		rtl8192c_PHY_RF6052SetBandwidth(
+										IN	PADAPTER				Adapter,
+										IN	HT_CHANNEL_WIDTH		Bandwidth);
+VOID	rtl8192c_PHY_RF6052SetCckTxPower(
+										IN	PADAPTER	Adapter,
+										IN	u8*		pPowerlevel);
+VOID	rtl8192c_PHY_RF6052SetOFDMTxPower(
+										IN	PADAPTER	Adapter,
+										IN	u8*		pPowerLevel,
+										IN	u8		Channel);
+int	PHY_RF6052_Config8192C(	IN	PADAPTER		Adapter	);
+
+/*--------------------------Exported Function prototype---------------------*/
+
+
+#endif/* End of HalRf.h */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_spec.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_spec.h
new file mode 100644
index 000000000000..c45a140c1e76
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_spec.h
@@ -0,0 +1,1864 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTL8192C_SPEC_H__
+#define __RTL8192C_SPEC_H__
+
+#include <drv_conf.h>
+
+#ifndef BIT
+#define BIT(x)		(1 << (x))
+#endif
+
+#define BIT0		0x00000001
+#define BIT1		0x00000002
+#define BIT2		0x00000004
+#define BIT3		0x00000008
+#define BIT4		0x00000010
+#define BIT5		0x00000020
+#define BIT6		0x00000040
+#define BIT7		0x00000080
+#define BIT8		0x00000100
+#define BIT9		0x00000200
+#define BIT10	0x00000400
+#define BIT11	0x00000800
+#define BIT12	0x00001000
+#define BIT13	0x00002000
+#define BIT14	0x00004000
+#define BIT15	0x00008000
+#define BIT16	0x00010000
+#define BIT17	0x00020000
+#define BIT18	0x00040000
+#define BIT19	0x00080000
+#define BIT20	0x00100000
+#define BIT21	0x00200000
+#define BIT22	0x00400000
+#define BIT23	0x00800000
+#define BIT24	0x01000000
+#define BIT25	0x02000000
+#define BIT26	0x04000000
+#define BIT27	0x08000000
+#define BIT28	0x10000000
+#define BIT29	0x20000000
+#define BIT30	0x40000000
+#define BIT31	0x80000000
+
+
+//============================================================
+//       8192C Regsiter offset definition
+//============================================================
+
+
+//============================================================
+//
+//============================================================
+
+//-----------------------------------------------------
+//
+//	0x0000h ~ 0x00FFh	System Configuration
+//
+//-----------------------------------------------------
+#define REG_SYS_ISO_CTRL			0x0000
+#define REG_SYS_FUNC_EN			0x0002
+#define REG_APS_FSMCO				0x0004
+#define REG_SYS_CLKR				0x0008
+#define REG_9346CR					0x000A
+#define REG_EE_VPD					0x000C
+#define REG_AFE_MISC				0x0010
+#define REG_SPS0_CTRL				0x0011
+#define REG_SPS_OCP_CFG			0x0018
+#define REG_RSV_CTRL				0x001C
+#define REG_RF_CTRL					0x001F
+#define REG_LDOA15_CTRL			0x0020
+#define REG_LDOV12D_CTRL			0x0021
+#define REG_LDOHCI12_CTRL			0x0022
+#define REG_LPLDO_CTRL				0x0023
+#define REG_AFE_XTAL_CTRL			0x0024
+#define REG_AFE_PLL_CTRL			0x0028
+#define REG_EFUSE_CTRL				0x0030
+#define REG_EFUSE_TEST				0x0034
+#define REG_PWR_DATA				0x0038
+#define REG_CAL_TIMER				0x003C
+#define REG_ACLK_MON				0x003E
+#define REG_GPIO_MUXCFG			0x0040
+#define REG_GPIO_IO_SEL				0x0042
+#define REG_MAC_PINMUX_CFG		0x0043
+#define REG_GPIO_PIN_CTRL			0x0044
+#define REG_GPIO_INTM				0x0048
+#define REG_LEDCFG0					0x004C
+#define REG_LEDCFG1					0x004D
+#define REG_LEDCFG2					0x004E
+#define REG_LEDCFG3					0x004F
+#define REG_LEDCFG					REG_LEDCFG2
+#define REG_FSIMR					0x0050
+#define REG_FSISR					0x0054
+#define REG_HSIMR					0x0058
+#define REG_HSISR					0x005c
+#define REG_GPIO_PIN_CTRL_2		0x0060 // RTL8723 WIFI/BT/GPS Multi-Function GPIO Pin Control.
+#define REG_GPIO_IO_SEL_2			0x0062 // RTL8723 WIFI/BT/GPS Multi-Function GPIO Select.
+#define REG_MULTI_FUNC_CTRL		0x0068 // RTL8723 WIFI/BT/GPS Multi-Function control source.
+#define REG_MCUFWDL				0x0080
+#ifdef CONFIG_WOWLAN
+#define REG_WOWLAN_REASON			0x0081
+#endif //CONFIG_WOWLAN
+#define REG_HMEBOX_EXT_0			0x0088
+#define REG_HMEBOX_EXT_1			0x008A
+#define REG_HMEBOX_EXT_2			0x008C
+#define REG_HMEBOX_EXT_3			0x008E
+#define REG_HOST_SUSP_CNT			0x00BC	// Host suspend counter on FPGA platform
+#define REG_EFUSE_ACCESS			0x00CF	// Efuse access protection for RTL8723
+#define REG_BIST_SCAN				0x00D0
+#define REG_BIST_RPT				0x00D4
+#define REG_BIST_ROM_RPT			0x00D8
+#define REG_USB_SIE_INTF			0x00E0
+#define REG_PCIE_MIO_INTF			0x00E4
+#define REG_PCIE_MIO_INTD			0x00E8
+#define REG_HPON_FSM				0x00EC
+#define REG_SYS_CFG					0x00F0
+#define REG_GPIO_OUTSTS			0x00F4	// For RTL8723 only.
+
+//-----------------------------------------------------
+//
+//	0x0100h ~ 0x01FFh	MACTOP General Configuration
+//
+//-----------------------------------------------------
+#define REG_CR						0x0100
+#define REG_PBP						0x0104
+#define REG_TRXDMA_CTRL			0x010C
+#define REG_TRXFF_BNDY				0x0114
+#define REG_TRXFF_STATUS			0x0118
+#define REG_RXFF_PTR				0x011C
+#define REG_HIMR					0x0120
+#define REG_HISR					0x0124
+#define REG_HIMRE					0x0128
+#define REG_HISRE					0x012C
+#define REG_CPWM					0x012F
+#define REG_FWIMR					0x0130
+#define REG_FWISR					0x0134
+#define REG_PKTBUF_DBG_CTRL		0x0140
+#define REG_PKTBUF_DBG_DATA_L		0x0144
+#define REG_PKTBUF_DBG_DATA_H	0x0148
+
+#define REG_TC0_CTRL				0x0150
+#define REG_TC1_CTRL				0x0154
+#define REG_TC2_CTRL				0x0158
+#define REG_TC3_CTRL				0x015C
+#define REG_TC4_CTRL				0x0160
+#define REG_TCUNIT_BASE			0x0164
+#define REG_MBIST_START			0x0174
+#define REG_MBIST_DONE				0x0178
+#define REG_MBIST_FAIL				0x017C
+#define REG_C2HEVT_MSG_NORMAL	0x01A0
+#define REG_C2HEVT_CLEAR			0x01AF
+#define REG_C2HEVT_MSG_TEST		0x01B8
+#define REG_MCUTST_1				0x01c0
+#define REG_FMETHR					0x01C8
+#define REG_HMETFR					0x01CC
+#define REG_HMEBOX_0				0x01D0
+#define REG_HMEBOX_1				0x01D4
+#define REG_HMEBOX_2				0x01D8
+#define REG_HMEBOX_3				0x01DC
+
+#define REG_LLT_INIT				0x01E0
+#define REG_BB_ACCEESS_CTRL		0x01E8
+#define REG_BB_ACCESS_DATA		0x01EC
+
+
+//-----------------------------------------------------
+//
+//	0x0200h ~ 0x027Fh	TXDMA Configuration
+//
+//-----------------------------------------------------
+#define REG_RQPN					0x0200
+#define REG_FIFOPAGE				0x0204
+#define REG_TDECTRL					0x0208
+#define REG_TXDMA_OFFSET_CHK		0x020C
+#define REG_TXDMA_STATUS			0x0210
+#define REG_RQPN_NPQ				0x0214
+
+//-----------------------------------------------------
+//
+//	0x0280h ~ 0x02FFh	RXDMA Configuration
+//
+//-----------------------------------------------------
+#define REG_RXDMA_AGG_PG_TH		0x0280
+#define REG_RXPKT_NUM				0x0284
+#define REG_RXDMA_STATUS			0x0288
+
+
+//-----------------------------------------------------
+//
+//	0x0300h ~ 0x03FFh	PCIe
+//
+//-----------------------------------------------------
+#define	REG_PCIE_CTRL_REG			0x0300
+#define	REG_INT_MIG				0x0304	// Interrupt Migration
+#define	REG_BCNQ_DESA				0x0308	// TX Beacon Descriptor Address
+#define	REG_HQ_DESA				0x0310	// TX High Queue Descriptor Address
+#define	REG_MGQ_DESA				0x0318	// TX Manage Queue Descriptor Address
+#define	REG_VOQ_DESA				0x0320	// TX VO Queue Descriptor Address
+#define	REG_VIQ_DESA				0x0328	// TX VI Queue Descriptor Address
+#define	REG_BEQ_DESA				0x0330	// TX BE Queue Descriptor Address
+#define	REG_BKQ_DESA				0x0338	// TX BK Queue Descriptor Address
+#define	REG_RX_DESA				0x0340	// RX Queue	Descriptor Address
+#define	REG_DBI					0x0348	// Backdoor REG for Access Configuration
+#define	REG_MDIO					0x0354	// MDIO for Access PCIE PHY
+#define	REG_DBG_SEL				0x0360	// Debug Selection Register
+#define	REG_PCIE_HRPWM			0x0361	//PCIe RPWM
+#define	REG_PCIE_HCPWM			0x0363	//PCIe CPWM
+#define	REG_UART_CTRL				0x0364	// UART	Control
+#define	REG_UART_TX_DESA			0x0370	// UART TX Descriptor Address
+#define	REG_UART_RX_DESA			0x0378	// UART Rx Descriptor Address
+
+
+// spec version 11
+//-----------------------------------------------------
+//
+//	0x0400h ~ 0x047Fh	Protocol Configuration
+//
+//-----------------------------------------------------
+#define REG_VOQ_INFORMATION			0x0400
+#define REG_VIQ_INFORMATION			0x0404
+#define REG_BEQ_INFORMATION			0x0408
+#define REG_BKQ_INFORMATION			0x040C
+#define REG_MGQ_INFORMATION			0x0410
+#define REG_HGQ_INFORMATION			0x0414
+#define REG_BCNQ_INFORMATION			0x0418
+
+
+#define REG_CPU_MGQ_INFORMATION		0x041C
+#define REG_FWHW_TXQ_CTRL				0x0420
+#define REG_HWSEQ_CTRL					0x0423
+#define REG_TXPKTBUF_BCNQ_BDNY		0x0424
+#define REG_TXPKTBUF_MGQ_BDNY		0x0425
+#define REG_LIFETIME_EN				0x0426
+#define REG_MULTI_BCNQ_OFFSET			0x0427
+#define REG_SPEC_SIFS					0x0428
+#define REG_RL							0x042A
+#define REG_DARFRC						0x0430
+#define REG_RARFRC						0x0438
+#define REG_RRSR						0x0440
+#define REG_ARFR0						0x0444
+#define REG_ARFR1						0x0448
+#define REG_ARFR2						0x044C
+#define REG_ARFR3						0x0450
+#define REG_AGGLEN_LMT					0x0458
+#define REG_AMPDU_MIN_SPACE			0x045C
+#define REG_TXPKTBUF_WMAC_LBK_BF_HD	0x045D
+#define REG_FAST_EDCA_CTRL				0x0460
+#define REG_RD_RESP_PKT_TH				0x0463
+#define REG_INIRTS_RATE_SEL			0x0480
+#define REG_INIDATA_RATE_SEL			0x0484
+
+//#define REG_FW_TSF_SYNC_CNT				0x04A0
+#define REG_FW_RESET_TSF_CNT_1				0x05FC
+#define REG_FW_RESET_TSF_CNT_0				0x05FD
+#define REG_FW_BCN_DIS_CNT				0x05FE
+
+#define REG_POWER_STATUS				0x04A4
+#define REG_POWER_STAGE1				0x04B4
+#define REG_POWER_STAGE2				0x04B8
+#define REG_PKT_VO_VI_LIFE_TIME		0x04C0
+#define REG_PKT_BE_BK_LIFE_TIME		0x04C2
+#define REG_STBC_SETTING				0x04C4
+#define REG_PROT_MODE_CTRL			0x04C8
+#define REG_MAX_AGGR_NUM				0x04CA
+#define REG_RTS_MAX_AGGR_NUM			0x04CB
+#define REG_BAR_MODE_CTRL				0x04CC
+#define REG_RA_TRY_RATE_AGG_LMT		0x04CF
+#define REG_NQOS_SEQ					0x04DC
+#define REG_QOS_SEQ					0x04DE
+#define REG_NEED_CPU_HANDLE			0x04E0
+#define REG_PKT_LOSE_RPT				0x04E1
+#define REG_PTCL_ERR_STATUS			0x04E2
+#define REG_DUMMY						0x04FC
+
+
+
+//-----------------------------------------------------
+//
+//	0x0500h ~ 0x05FFh	EDCA Configuration
+//
+//-----------------------------------------------------
+#define REG_EDCA_VO_PARAM			0x0500
+#define REG_EDCA_VI_PARAM			0x0504
+#define REG_EDCA_BE_PARAM			0x0508
+#define REG_EDCA_BK_PARAM			0x050C
+#define REG_BCNTCFG					0x0510
+#define REG_PIFS						0x0512
+#define REG_RDG_PIFS				0x0513
+#define REG_SIFS_CCK				0x0514
+#define REG_SIFS_OFDM				0x0516
+#define REG_SIFS_CTX				0x0514
+#define REG_SIFS_TRX				0x0516
+#define REG_TSFTR_SYN_OFFSET		0x0518
+#define REG_AGGR_BREAK_TIME		0x051A
+#define REG_SLOT					0x051B
+#define REG_TX_PTCL_CTRL			0x0520
+#define REG_TXPAUSE					0x0522
+#define REG_DIS_TXREQ_CLR			0x0523
+#define REG_RD_CTRL					0x0524
+#define REG_TBTT_PROHIBIT			0x0540
+#define REG_RD_NAV_NXT				0x0544
+#define REG_NAV_PROT_LEN			0x0546
+#define REG_BCN_CTRL				0x0550
+#define REG_BCN_CTRL_1				0x0551
+#define REG_MBID_NUM				0x0552
+#define REG_DUAL_TSF_RST			0x0553
+#define REG_BCN_INTERVAL			0x0554	// The same as REG_MBSSID_BCN_SPACE
+#define REG_MBSSID_BCN_SPACE		0x0554
+#define REG_DRVERLYINT				0x0558
+#define REG_BCNDMATIM				0x0559
+#define REG_ATIMWND				0x055A
+#define REG_BCN_MAX_ERR			0x055D
+#define REG_RXTSF_OFFSET_CCK		0x055E
+#define REG_RXTSF_OFFSET_OFDM		0x055F
+#define REG_TSFTR					0x0560
+#define REG_TSFTR1					0x0568
+#define REG_INIT_TSFTR				0x0564
+#define REG_ATIMWND_1				0x0570
+#define REG_PSTIMER					0x0580
+#define REG_TIMER0					0x0584
+#define REG_TIMER1					0x0588
+#define REG_ACMHWCTRL				0x05C0
+#define REG_ACMRSTCTRL				0x05C1
+#define REG_ACMAVG					0x05C2
+#define REG_VO_ADMTIME				0x05C4
+#define REG_VI_ADMTIME				0x05C6
+#define REG_BE_ADMTIME				0x05C8
+#define REG_EDCA_RANDOM_GEN		0x05CC
+#define REG_SCH_TXCMD				0x05D0
+
+
+//-----------------------------------------------------
+//
+//	0x0600h ~ 0x07FFh	WMAC Configuration
+//
+//-----------------------------------------------------
+#define REG_APSD_CTRL				0x0600
+#define REG_BWOPMODE				0x0603
+#define REG_TCR						0x0604
+#define REG_RCR						0x0608
+#define REG_RX_PKT_LIMIT			0x060C
+#define REG_RX_DLK_TIME			0x060D
+#define REG_RX_DRVINFO_SZ			0x060F
+
+#define REG_MACID					0x0610
+#define REG_BSSID					0x0618
+#define REG_MAR						0x0620
+#define REG_MBIDCAMCFG				0x0628
+
+#define REG_USTIME_EDCA			0x0638
+#define REG_MAC_SPEC_SIFS			0x063A
+
+// 20100719 Joseph: Hardware register definition change. (HW datasheet v54)
+#define REG_R2T_SIFS				0x063C	// [15:8]SIFS_R2T_OFDM, [7:0]SIFS_R2T_CCK
+#define REG_T2T_SIFS				0x063E	// [15:8]SIFS_T2T_OFDM, [7:0]SIFS_T2T_CCK
+#define REG_ACKTO					0x0640
+#define REG_CTS2TO					0x0641
+#define REG_EIFS						0x0642
+
+//WMA, BA, CCX
+#define REG_NAV_CTRL				0x0650
+#define REG_BACAMCMD				0x0654
+#define REG_BACAMCONTENT			0x0658
+#define REG_LBDLY					0x0660
+#define REG_FWDLY					0x0661
+#define REG_RXERR_RPT				0x0664
+#define REG_WMAC_TRXPTCL_CTL		0x0668
+
+
+// Security
+#define REG_CAMCMD					0x0670
+#define REG_CAMWRITE				0x0674
+#define REG_CAMREAD				0x0678
+#define REG_CAMDBG					0x067C
+#define REG_SECCFG					0x0680
+
+// Power
+#define REG_WOW_CTRL				0x0690
+#define REG_PSSTATUS				0x0691
+#define REG_PS_RX_INFO				0x0692
+#define REG_LPNAV_CTRL				0x0694
+#define REG_WKFMCAM_CMD			0x0698
+#define REG_WKFMCAM_RWD			0x069C
+#define REG_RXFLTMAP0				0x06A0
+#define REG_RXFLTMAP1				0x06A2
+#define REG_RXFLTMAP2				0x06A4
+#define REG_BCN_PSR_RPT			0x06A8
+#define REG_CALB32K_CTRL			0x06AC
+#define REG_PKT_MON_CTRL			0x06B4
+#define REG_BT_COEX_TABLE			0x06C0
+#define REG_WMAC_RESP_TXINFO		0x06D8
+
+#define REG_MACID1					0x0700
+#define REG_BSSID1					0x0708
+
+
+//-----------------------------------------------------
+//
+//	0xFE00h ~ 0xFE55h	USB Configuration
+//
+//-----------------------------------------------------
+#define REG_USB_INFO				0xFE17
+#define REG_USB_SPECIAL_OPTION	0xFE55
+#define REG_USB_DMA_AGG_TO		0xFE5B
+#define REG_USB_AGG_TO				0xFE5C
+#define REG_USB_AGG_TH				0xFE5D
+
+// For test chip
+#define REG_TEST_USB_TXQS			0xFE48
+#define REG_TEST_SIE_VID			0xFE60		// 0xFE60~0xFE61
+#define REG_TEST_SIE_PID			0xFE62		// 0xFE62~0xFE63
+#define REG_TEST_SIE_OPTIONAL		0xFE64
+#define REG_TEST_SIE_CHIRP_K		0xFE65
+#define REG_TEST_SIE_PHY			0xFE66		// 0xFE66~0xFE6B
+#define REG_TEST_SIE_MAC_ADDR		0xFE70		// 0xFE70~0xFE75
+#define REG_TEST_SIE_STRING		0xFE80		// 0xFE80~0xFEB9
+
+
+// For normal chip
+#define REG_NORMAL_SIE_VID			0xFE60		// 0xFE60~0xFE61
+#define REG_NORMAL_SIE_PID			0xFE62		// 0xFE62~0xFE63
+#define REG_NORMAL_SIE_OPTIONAL	0xFE64
+#define REG_NORMAL_SIE_EP			0xFE65		// 0xFE65~0xFE67
+#define REG_NORMAL_SIE_PHY		0xFE68		// 0xFE68~0xFE6B
+#define REG_NORMAL_SIE_OPTIONAL2	0xFE6C
+#define REG_NORMAL_SIE_GPS_EP		0xFE6D		// 0xFE6D, for RTL8723 only.
+#define REG_NORMAL_SIE_MAC_ADDR	0xFE70		// 0xFE70~0xFE75
+#define REG_NORMAL_SIE_STRING		0xFE80		// 0xFE80~0xFEDF
+
+
+//-----------------------------------------------------
+//
+//	Redifine 8192C register definition for compatibility
+//
+//-----------------------------------------------------
+
+// TODO: use these definition when using REG_xxx naming rule.
+// NOTE: DO NOT Remove these definition. Use later.
+
+#define	SYS_ISO_CTRL				REG_SYS_ISO_CTRL	// System Isolation Interface Control.
+#define	SYS_FUNC_EN				REG_SYS_FUNC_EN		// System Function Enable.
+#define	SYS_CLK						REG_SYS_CLKR
+#define	CR9346						REG_9346CR			// 93C46/93C56 Command Register.
+#define	EFUSE_CTRL					REG_EFUSE_CTRL		// E-Fuse Control.
+#define	EFUSE_TEST					REG_EFUSE_TEST		// E-Fuse Test.
+#define	MSR							(REG_CR + 2)		// Media Status register
+#define	ISR							REG_HISR
+#define	TSFR						REG_TSFTR			// Timing Sync Function Timer Register.
+
+#define	MACIDR0					REG_MACID			// MAC ID Register, Offset 0x0050-0x0053
+#define	MACIDR4					(REG_MACID + 4)		// MAC ID Register, Offset 0x0054-0x0055
+
+#define	PBP							REG_PBP
+
+// Redifine MACID register, to compatible prior ICs.
+#define	IDR0						MACIDR0
+#define	IDR4						MACIDR4
+
+
+//
+// 9. Security Control Registers	(Offset: )
+//
+#define	RWCAM						REG_CAMCMD		//IN 8190 Data Sheet is called CAMcmd
+#define	WCAMI						REG_CAMWRITE	// Software write CAM input content
+#define	RCAMO						REG_CAMREAD		// Software read/write CAM config
+#define	CAMDBG						REG_CAMDBG
+#define	SECR						REG_SECCFG		//Security Configuration Register
+
+// Unused register
+#define	UnusedRegister				0x1BF
+#define	DCAM						UnusedRegister
+#define	PSR							UnusedRegister
+#define	BBAddr						UnusedRegister
+#define	PhyDataR					UnusedRegister
+
+#define	InvalidBBRFValue			0x12345678
+
+// Min Spacing related settings.
+#define	MAX_MSS_DENSITY_2T 			0x13
+#define	MAX_MSS_DENSITY_1T 			0x0A
+
+//----------------------------------------------------------------------------
+//       8192C Cmd9346CR bits					(Offset 0xA, 16bit)
+//----------------------------------------------------------------------------
+#define	CmdEEPROM_En				BIT5	 // EEPROM enable when set 1
+#define	CmdEERPOMSEL				BIT4 	// System EEPROM select, 0: boot from E-FUSE, 1: The EEPROM used is 9346
+#define	Cmd9346CR_9356SEL			BIT4
+#define	AutoLoadEEPROM			(CmdEEPROM_En|CmdEERPOMSEL)
+#define	AutoLoadEFUSE				CmdEEPROM_En
+
+//----------------------------------------------------------------------------
+//       8192C GPIO MUX Configuration Register (offset 0x40, 4 byte)
+//----------------------------------------------------------------------------
+#define	GPIOSEL_GPIO				0
+#define	GPIOSEL_ENBT				BIT5
+
+//----------------------------------------------------------------------------
+//       8192C GPIO PIN Control Register (offset 0x44, 4 byte)
+//----------------------------------------------------------------------------
+#define	GPIO_IN						REG_GPIO_PIN_CTRL		// GPIO pins input value
+#define	GPIO_OUT					(REG_GPIO_PIN_CTRL+1)	// GPIO pins output value
+#define	GPIO_IO_SEL				(REG_GPIO_PIN_CTRL+2)	// GPIO pins output enable when a bit is set to "1"; otherwise, input is configured.
+#define	GPIO_MOD					(REG_GPIO_PIN_CTRL+3)
+
+//----------------------------------------------------------------------------
+//       8192C (MSR) Media Status Register	(Offset 0x4C, 8 bits)
+//----------------------------------------------------------------------------
+/*
+Network Type
+00: No link
+01: Link in ad hoc network
+10: Link in infrastructure network
+11: AP mode
+Default: 00b.
+*/
+#define	MSR_NOLINK					0x00
+#define	MSR_ADHOC					0x01
+#define	MSR_INFRA					0x02
+#define	MSR_AP						0x03
+
+//
+// 6. Adaptive Control Registers  (Offset: 0x0160 - 0x01CF)
+//
+//----------------------------------------------------------------------------
+//       8192C Response Rate Set Register	(offset 0x181, 24bits)
+//----------------------------------------------------------------------------
+#define	RRSR_RSC_OFFSET			21
+#define	RRSR_SHORT_OFFSET			23
+#define	RRSR_RSC_BW_40M			0x600000
+#define	RRSR_RSC_UPSUBCHNL		0x400000
+#define	RRSR_RSC_LOWSUBCHNL		0x200000
+#define	RRSR_SHORT					0x800000
+#define	RRSR_1M					BIT0
+#define	RRSR_2M					BIT1
+#define	RRSR_5_5M					BIT2
+#define	RRSR_11M					BIT3
+#define	RRSR_6M					BIT4
+#define	RRSR_9M					BIT5
+#define	RRSR_12M					BIT6
+#define	RRSR_18M					BIT7
+#define	RRSR_24M					BIT8
+#define	RRSR_36M					BIT9
+#define	RRSR_48M					BIT10
+#define	RRSR_54M					BIT11
+#define	RRSR_MCS0					BIT12
+#define	RRSR_MCS1					BIT13
+#define	RRSR_MCS2					BIT14
+#define	RRSR_MCS3					BIT15
+#define	RRSR_MCS4					BIT16
+#define	RRSR_MCS5					BIT17
+#define	RRSR_MCS6					BIT18
+#define	RRSR_MCS7					BIT19
+#define	BRSR_AckShortPmb			BIT23
+// CCK ACK: use Short Preamble or not
+
+
+//----------------------------------------------------------------------------
+//       8192C Rate Definition
+//----------------------------------------------------------------------------
+//CCK
+#define	RATR_1M					0x00000001
+#define	RATR_2M					0x00000002
+#define	RATR_55M					0x00000004
+#define	RATR_11M					0x00000008
+//OFDM
+#define	RATR_6M					0x00000010
+#define	RATR_9M					0x00000020
+#define	RATR_12M					0x00000040
+#define	RATR_18M					0x00000080
+#define	RATR_24M					0x00000100
+#define	RATR_36M					0x00000200
+#define	RATR_48M					0x00000400
+#define	RATR_54M					0x00000800
+//MCS 1 Spatial Stream
+#define	RATR_MCS0					0x00001000
+#define	RATR_MCS1					0x00002000
+#define	RATR_MCS2					0x00004000
+#define	RATR_MCS3					0x00008000
+#define	RATR_MCS4					0x00010000
+#define	RATR_MCS5					0x00020000
+#define	RATR_MCS6					0x00040000
+#define	RATR_MCS7					0x00080000
+//MCS 2 Spatial Stream
+#define	RATR_MCS8					0x00100000
+#define	RATR_MCS9					0x00200000
+#define	RATR_MCS10					0x00400000
+#define	RATR_MCS11					0x00800000
+#define	RATR_MCS12					0x01000000
+#define	RATR_MCS13					0x02000000
+#define	RATR_MCS14					0x04000000
+#define	RATR_MCS15					0x08000000
+
+//----------------------------------------------------------------------------
+//       8192C BW_OPMODE bits					(Offset 0x203, 8bit)
+//----------------------------------------------------------------------------
+#define	BW_OPMODE_20MHZ			BIT2
+#define	BW_OPMODE_5G				BIT1
+#define	BW_OPMODE_11J				BIT0
+
+
+//----------------------------------------------------------------------------
+//       8192C CAM Config Setting (offset 0x250, 1 byte)
+//----------------------------------------------------------------------------
+#define	CAM_VALID					BIT15
+#define	CAM_NOTVALID				0x0000
+#define	CAM_USEDK					BIT5
+
+#define	CAM_CONTENT_COUNT 		8
+
+#define	CAM_NONE					0x0
+#define	CAM_WEP40					0x01
+#define	CAM_TKIP					0x02
+#define	CAM_AES					0x04
+#define	CAM_WEP104				0x05
+
+#define	TOTAL_CAM_ENTRY			32
+#define	HALF_CAM_ENTRY			16
+
+#define	CAM_CONFIG_USEDK			_TRUE
+#define	CAM_CONFIG_NO_USEDK		_FALSE
+
+#define	CAM_WRITE					BIT16
+#define	CAM_READ					0x00000000
+#define	CAM_POLLINIG				BIT31
+
+#define	SCR_UseDK					0x01
+#define	SCR_TxSecEnable			0x02
+#define	SCR_RxSecEnable			0x04
+
+
+//
+// 12. Host Interrupt Status Registers	 (Offset: 0x0300 - 0x030F)
+//
+//----------------------------------------------------------------------------
+//       8190 IMR/ISR bits						(offset 0xfd,  8bits)
+//----------------------------------------------------------------------------
+#define	IMR8190_DISABLED				0x0
+// IMR DW0 Bit 0-31
+#define	IMR_BCNDMAINT6				BIT31		// Beacon DMA Interrupt 6
+#define	IMR_BCNDMAINT5				BIT30		// Beacon DMA Interrupt 5
+#define	IMR_BCNDMAINT4				BIT29		// Beacon DMA Interrupt 4
+#define	IMR_BCNDMAINT3				BIT28		// Beacon DMA Interrupt 3
+#define	IMR_BCNDMAINT2				BIT27		// Beacon DMA Interrupt 2
+#define	IMR_BCNDMAINT1				BIT26		// Beacon DMA Interrupt 1
+#define	IMR_BCNDOK8					BIT25		// Beacon Queue DMA OK Interrup 8
+#define	IMR_BCNDOK7					BIT24		// Beacon Queue DMA OK Interrup 7
+#define	IMR_BCNDOK6					BIT23		// Beacon Queue DMA OK Interrup 6
+#define	IMR_BCNDOK5					BIT22		// Beacon Queue DMA OK Interrup 5
+#define	IMR_BCNDOK4					BIT21		// Beacon Queue DMA OK Interrup 4
+#define	IMR_BCNDOK3					BIT20		// Beacon Queue DMA OK Interrup 3
+#define	IMR_BCNDOK2					BIT19		// Beacon Queue DMA OK Interrup 2
+#define	IMR_BCNDOK1					BIT18		// Beacon Queue DMA OK Interrup 1
+#define	IMR_TIMEOUT2					BIT17		// Timeout interrupt 2
+#define	IMR_TIMEOUT1					BIT16		// Timeout interrupt 1
+#define	IMR_TXFOVW					BIT15		// Transmit FIFO Overflow
+#define	IMR_PSTIMEOUT					BIT14		// Power save time out interrupt
+#define	IMR_BcnInt						BIT13		// Beacon DMA Interrupt 0
+#define	IMR_RXFOVW					BIT12		// Receive FIFO Overflow
+#define	IMR_RDU						BIT11		// Receive Descriptor Unavailable
+#define	IMR_ATIMEND					BIT10		// For 92C,ATIM Window End Interrupt
+#define	IMR_BDOK						BIT9		// Beacon Queue DMA OK Interrup
+#define	IMR_HIGHDOK					BIT8		// High Queue DMA OK Interrupt
+#define	IMR_TBDOK						BIT7		// Transmit Beacon OK interrup
+#define	IMR_MGNTDOK					BIT6		// Management Queue DMA OK Interrupt
+#define	IMR_TBDER						BIT5		// For 92C,Transmit Beacon Error Interrupt
+#define	IMR_BKDOK						BIT4		// AC_BK DMA OK Interrupt
+#define	IMR_BEDOK						BIT3		// AC_BE DMA OK Interrupt
+#define	IMR_VIDOK						BIT2		// AC_VI DMA OK Interrupt
+#define	IMR_VODOK						BIT1		// AC_VO DMA Interrupt
+#define	IMR_ROK						BIT0		// Receive DMA OK Interrupt
+
+#define	IMR_RX_MASK		(IMR_ROK|IMR_RDU|IMR_RXFOVW)
+#define	IMR_TX_MASK		(IMR_VODOK|IMR_VIDOK|IMR_BEDOK|IMR_BKDOK|IMR_MGNTDOK|IMR_HIGHDOK|IMR_BDOK)
+
+// 13. Host Interrupt Status Extension Register	 (Offset: 0x012C-012Eh)
+#define	IMR_BcnInt_E				BIT12
+#define	IMR_TXERR				BIT11
+#define	IMR_RXERR				BIT10
+#define	IMR_C2HCMD			BIT9
+#define	IMR_CPWM				BIT8
+//RSVD [2-7]
+#define	IMR_OCPINT				BIT1
+#define	IMR_WLANOFF			BIT0
+
+
+
+//----------------------------------------------------------------------------
+// 8192C EFUSE
+//----------------------------------------------------------------------------
+#define	HWSET_MAX_SIZE				128
+
+
+//----------------------------------------------------------------------------
+//       8192C EEPROM/EFUSE share register definition.
+//----------------------------------------------------------------------------
+
+//
+// Default Value for EEPROM or EFUSE!!!
+//
+#define EEPROM_Default_TSSI					0x0
+#define EEPROM_Default_TxPowerDiff			0x0
+#define EEPROM_Default_CrystalCap			0x5
+#define EEPROM_Default_BoardType			0x02 // Default: 2X2, RTL8192CE(QFPN68)
+#define EEPROM_Default_TxPower				0x1010
+#define EEPROM_Default_HT2T_TxPwr			0x10
+
+#define EEPROM_Default_LegacyHTTxPowerDiff	0x3
+#define EEPROM_Default_ThermalMeter			0x12
+
+#define EEPROM_Default_AntTxPowerDiff		0x0
+#define EEPROM_Default_TxPwDiff_CrystalCap	0x5
+#define EEPROM_Default_TxPowerLevel		0x22
+#define EEPROM_Default_HT40_2SDiff			0x0
+#define EEPROM_Default_HT20_Diff			2	// HT20<->40 default Tx Power Index Difference
+#define EEPROM_Default_LegacyHTTxPowerDiff	0x3
+#define EEPROM_Default_HT40_PwrMaxOffset	0
+#define EEPROM_Default_HT20_PwrMaxOffset	0
+
+// For debug
+#define EEPROM_Default_PID					0x1234
+#define EEPROM_Default_VID					0x5678
+#define EEPROM_Default_CustomerID			0xAB
+#define EEPROM_Default_SubCustomerID		0xCD
+#define EEPROM_Default_Version				0
+
+#define EEPROM_CHANNEL_PLAN_FCC				0x0
+#define EEPROM_CHANNEL_PLAN_IC				0x1
+#define EEPROM_CHANNEL_PLAN_ETSI				0x2
+#define EEPROM_CHANNEL_PLAN_SPAIN			0x3
+#define EEPROM_CHANNEL_PLAN_FRANCE			0x4
+#define EEPROM_CHANNEL_PLAN_MKK				0x5
+#define EEPROM_CHANNEL_PLAN_MKK1				0x6
+#define EEPROM_CHANNEL_PLAN_ISRAEL			0x7
+#define EEPROM_CHANNEL_PLAN_TELEC			0x8
+#define EEPROM_CHANNEL_PLAN_GLOBAL_DOMAIN	0x9
+#define EEPROM_CHANNEL_PLAN_WORLD_WIDE_13	0xA
+#define EEPROM_CHANNEL_PLAN_NCC				0xB
+#define EEPROM_USB_OPTIONAL1					0xE
+#define EEPROM_CHANNEL_PLAN_BY_HW_MASK		0x80
+
+
+#define EEPROM_CID_DEFAULT				0x0
+#define EEPROM_CID_TOSHIBA					0x4
+#define EEPROM_CID_CCX						0x10 // CCX test. By Bruce, 2009-02-25.
+#define EEPROM_CID_QMI						0x0D
+#define EEPROM_CID_WHQL 					0xFE // added by chiyoko for dtm, 20090108
+
+
+#define	RTL_EEPROM_ID						0x8129
+
+
+#ifdef CONFIG_PCI_HCI
+#define RT_IBSS_INT_MASKS				(IMR_BcnInt | IMR_TBDOK | IMR_TBDER)
+#define RT_AC_INT_MASKS				(IMR_VIDOK | IMR_VODOK | IMR_BEDOK|IMR_BKDOK)
+#define RT_BSS_INT_MASKS				(RT_IBSS_INT_MASKS)
+
+//
+// Interface type.
+//
+typedef	enum _INTERFACE_SELECT_8192CPCIe{
+	INTF_SEL0_SOLO_MINICARD			= 0,		// WiFi solo-mCard
+	INTF_SEL1_BT_COMBO_MINICARD		= 1,		// WiFi+BT combo-mCard
+	INTF_SEL2_PCIe					= 2,		// PCIe Card
+} INTERFACE_SELECT_8192CPCIe, *PINTERFACE_SELECT_8192CPCIe;
+
+#define RTL8190_EEPROM_ID					0x8129	// 0-1
+#define EEPROM_HPON						0x02 // LDO settings.2-5
+#define EEPROM_CLK							0x06 // Clock settings.6-7
+#define EEPROM_TESTR						0x08 // SE Test mode.8
+
+#define EEPROM_VID							0x0A // SE Vendor ID.A-B
+#define EEPROM_DID							0x0C // SE Device ID. C-D
+#define EEPROM_SVID							0x0E // SE Vendor ID.E-F
+#define EEPROM_SMID						0x10 // SE PCI Subsystem ID. 10-11
+
+#define EEPROM_MAC_ADDR					0x16 // SEMAC Address. 12-17
+
+//----------------------------------------------------------------
+// Ziv - Let PCIe and USB use the same define. Modify address mapping later.
+#define EEPROM_CCK_TX_PWR_INX					0x5A
+#define EEPROM_HT40_1S_TX_PWR_INX			0x60
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF		0x66
+#define EEPROM_HT20_TX_PWR_INX_DIFF			0x69
+#define EEPROM_OFDM_TX_PWR_INX_DIFF			0x6C
+#define EEPROM_HT40_MAX_PWR_OFFSET			0x6F
+#define EEPROM_HT20_MAX_PWR_OFFSET			0x72
+
+#define EEPROM_CHANNEL_PLAN 				0x75
+#define EEPROM_TSSI_A						0x76
+#define EEPROM_TSSI_B						0x77
+#define EEPROM_THERMAL_METER				0x78
+#define EEPROM_RF_OPT1						0x79
+#define EEPROM_RF_OPT2						0x7A
+#define EEPROM_RF_OPT3						0x7B
+#define EEPROM_RF_OPT4						0x7C
+#define EEPROM_VERSION						0x7E
+#define EEPROM_CUSTOMER_ID				0x7F
+
+#define EEPROM_NORMAL_BoardType			EEPROM_RF_OPT1	//[7:5]
+
+#endif
+
+#ifdef CONFIG_USB_HCI
+
+//should be renamed and moved to another file
+typedef	enum _BOARD_TYPE_8192CUSB{
+	BOARD_USB_DONGLE 			= 0,		// USB dongle
+	BOARD_USB_High_PA 		= 1,		// USB dongle with high power PA
+	BOARD_MINICARD		  	= 2,		// Minicard
+	BOARD_USB_SOLO 		 	= 3,		// USB solo-Slim module
+	BOARD_USB_COMBO			= 4,		// USB Combo-Slim module
+} BOARD_TYPE_8192CUSB, *PBOARD_TYPE_8192CUSB;
+
+#define	SUPPORT_HW_RADIO_DETECT(pHalData)	(pHalData->BoardType == BOARD_MINICARD||\
+													pHalData->BoardType == BOARD_USB_SOLO||\
+													pHalData->BoardType == BOARD_USB_COMBO)
+
+//---------------------------------------------------------------
+// EEPROM address for Test chip
+//---------------------------------------------------------------
+#define EEPROM_TEST_USB_OPT						0x0E
+#define EEPROM_TEST_CHIRP_K						0x0F
+#define EEPROM_TEST_EP_SETTING					0x0E
+#define EEPROM_TEST_USB_PHY						0x10
+
+
+//---------------------------------------------------------------
+// EEPROM address for Normal chip
+//---------------------------------------------------------------
+#define EEPROM_NORMAL_USB_OPT					0x0E
+#define EEPROM_NORMAL_CHIRP_K						0x0E	// Changed
+#define EEPROM_NORMAL_EP_SETTING					0x0F	// Changed
+#define EEPROM_NORMAL_USB_PHY					0x12	// Changed
+
+
+// Test chip and normal chip common define
+//---------------------------------------------------------------
+// EEPROM address for both
+//---------------------------------------------------------------
+#define EEPROM_ID0								0x00
+#define EEPROM_ID1								0x01
+#define EEPROM_RTK_RSV1						0x02
+#define EEPROM_RTK_RSV2						0x03
+#define EEPROM_RTK_RSV3						0x04
+#define EEPROM_RTK_RSV4						0x05
+#define EEPROM_RTK_RSV5						0x06
+#define EEPROM_DBG_SEL							0x07
+#define EEPROM_RTK_RSV6						0x08
+#define EEPROM_VID								0x0A
+#define EEPROM_PID								0x0C
+
+#define EEPROM_MAC_ADDR						0x16
+#define EEPROM_STRING							0x1C
+#define EEPROM_SUBCUSTOMER_ID					0x59
+#define EEPROM_CCK_TX_PWR_INX					0x5A
+#define EEPROM_HT40_1S_TX_PWR_INX			0x60
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF		0x66
+#define EEPROM_HT20_TX_PWR_INX_DIFF			0x69
+#define EEPROM_OFDM_TX_PWR_INX_DIFF			0x6C
+#define EEPROM_HT40_MAX_PWR_OFFSET			0x6F
+#define EEPROM_HT20_MAX_PWR_OFFSET			0x72
+
+#define EEPROM_CHANNEL_PLAN					0x75
+#define EEPROM_TSSI_A							0x76
+#define EEPROM_TSSI_B							0x77
+#define EEPROM_THERMAL_METER					0x78
+#define EEPROM_RF_OPT1							0x79
+#define EEPROM_RF_OPT2							0x7A
+#define EEPROM_RF_OPT3							0x7B
+#define EEPROM_RF_OPT4							0x7C
+#define EEPROM_VERSION							0x7E
+#define EEPROM_CUSTOMER_ID					0x7F
+
+#define EEPROM_BoardType						0x54 //0x0: RTL8188SU, 0x1: RTL8191SU, 0x2: RTL8192SU, 0x3: RTL8191GU
+#define EEPROM_TxPwIndex						0x5C //0x5C-0x76, Tx Power index.
+#define EEPROM_PwDiff							0x67 // Difference of gain index between legacy and high throughput OFDM.
+
+#define EEPROM_TxPowerCCK						0x5A // CCK Tx Power
+
+// 2009/02/09 Cosa Add for SD3 requirement
+#define EEPROM_TX_PWR_HT20_DIFF				0x6e// HT20 Tx Power Index Difference
+#define DEFAULT_HT20_TXPWR_DIFF				2	// HT20<->40 default Tx Power Index Difference
+#define EEPROM_TX_PWR_OFDM_DIFF				0x71// OFDM Tx Power Index Difference
+
+#define EEPROM_TxPWRGroup						0x73// Power diff for channel group
+#define EEPROM_Regulatory						0x79// Check if power safety is need
+
+#define EEPROM_BLUETOOTH_COEXIST				0x7E // 92cu, 0x7E[4]
+#define EEPROM_NORMAL_BoardType				EEPROM_RF_OPT1	//[7:5]
+#define BOARD_TYPE_NORMAL_MASK				0xE0
+#define BOARD_TYPE_TEST_MASK					0x0F
+#define EEPROM_EASY_REPLACEMENT				0x50//BIT0 1 for build-in module, 0 for external dongle
+//-------------------------------------------------------------
+//	EEPROM content definitions
+//-------------------------------------------------------------
+#define OS_LINK_SPEED							BIT(5)
+
+#define BOARD_TYPE_MASK						0xF
+
+#define BT_COEXISTENCE							BIT(4)
+#define BT_CO_SHIFT								4
+
+#define EP_NUMBER_MASK							0x30	//bit 4:5 0Eh
+#define EP_NUMBER_SHIFT						4
+
+
+#define USB_PHY_PARA_SIZE						5
+
+
+//-------------------------------------------------------------
+//	EEPROM default value definitions
+//-------------------------------------------------------------
+// Use 0xABCD instead of 0x8192 for debug
+#define EEPROM_DEF_ID_0						0xCD	// Byte 0x00
+#define EEPROM_DEF_ID_1						0xAB	// Byte 0x01
+
+#define EEPROM_DEF_RTK_RSV_A3					0x74	// Byte 0x03
+#define EEPROM_DEF_RTK_RSV_A4					0x6D	// Byte 0x04
+#define EEPROM_DEF_RTK_RSV_A8					0xFF	// Byte 0x08
+
+#define EEPROM_DEF_VID_0						0x0A	// Byte 0x0A
+#define EEPROM_DEF_VID_1						0x0B
+
+#define EEPROM_DEF_PID_0						0x92	// Byte 0x0C
+#define EEPROM_DEF_PID_1						0x81
+
+
+#define EEPROM_TEST_DEF_USB_OPT				0x80	// Byte 0x0E
+#define EEPROM_NORMAL_DEF_USB_OPT			0x00	// Byte 0x0E
+
+#define EEPROM_DEF_CHIRPK						0x15	// Byte 0x0F
+
+#define EEPROM_DEF_USB_PHY_0					0x85	// Byte 0x10
+#define EEPROM_DEF_USB_PHY_1					0x62	// Byte 0x11
+#define EEPROM_DEF_USB_PHY_2					0x9E	// Byte 0x12
+#define EEPROM_DEF_USB_PHY_3					0x06	// Byte 0x13
+
+#define EEPROM_DEF_TSSI_A						0x09	// Byte 0x78
+#define EEPROM_DEF_TSSI_B						0x09	// Byte 0x79
+
+
+#define EEPROM_DEF_THERMAL_METER				0x12	// Byte 0x7A
+
+#define RF_OPTION1					0x79// Check if power safety spec is need
+#define RF_OPTION2					0x7A
+#define RF_OPTION3					0x7B
+#define RF_OPTION4					0x7C
+
+
+#define	EEPROM_USB_SN							BIT(0)
+#define	EEPROM_USB_REMOTE_WAKEUP			BIT(1)
+#define	EEPROM_USB_DEVICE_PWR				BIT(2)
+#define	EEPROM_EP_NUMBER						(BIT(3)|BIT(4))
+
+#if 0
+#define	EEPROM_CHANNEL_PLAN_FCC					0x0
+#define	EEPROM_CHANNEL_PLAN_IC					0x1
+#define	EEPROM_CHANNEL_PLAN_ETSI				0x2
+#define	EEPROM_CHANNEL_PLAN_SPAIN				0x3
+#define	EEPROM_CHANNEL_PLAN_FRANCE				0x4
+#define	EEPROM_CHANNEL_PLAN_MKK					0x5
+#define	EEPROM_CHANNEL_PLAN_MKK1				0x6
+#define	EEPROM_CHANNEL_PLAN_ISRAEL				0x7
+#define	EEPROM_CHANNEL_PLAN_TELEC				0x8
+#define	EEPROM_CHANNEL_PLAN_GLOBAL_DOMAIN		0x9
+#define	EEPROM_CHANNEL_PLAN_WORLD_WIDE_13		0xA
+#define	EEPROM_CHANNEL_PLAN_BY_HW_MASK			0x80
+
+#define	EEPROM_CID_DEFAULT						0x0
+
+#define	EEPROM_CID_WHQL 						0xFE // added by chiyoko for dtm, 20090108
+
+
+#define	EEPROM_CID_CCX							0x10 // CCX test. By Bruce, 2009-02-25.
+#endif
+
+#endif
+
+
+/*===================================================================
+=====================================================================
+Here the register defines are for 92C. When the define is as same with 92C,
+we will use the 92C's define for the consistency
+So the following defines for 92C is not entire!!!!!!
+=====================================================================
+=====================================================================*/
+/*
+Based on Datasheet V33---090401
+Register Summary
+Current IOREG MAP
+0x0000h ~ 0x00FFh   System Configuration (256 Bytes)
+0x0100h ~ 0x01FFh   MACTOP General Configuration (256 Bytes)
+0x0200h ~ 0x027Fh   TXDMA Configuration (128 Bytes)
+0x0280h ~ 0x02FFh   RXDMA Configuration (128 Bytes)
+0x0300h ~ 0x03FFh   PCIE EMAC Reserved Region (256 Bytes)
+0x0400h ~ 0x04FFh   Protocol Configuration (256 Bytes)
+0x0500h ~ 0x05FFh   EDCA Configuration (256 Bytes)
+0x0600h ~ 0x07FFh   WMAC Configuration (512 Bytes)
+0x2000h ~ 0x3FFFh   8051 FW Download Region (8196 Bytes)
+*/
+
+//----------------------------------------------------------------------------
+//       8192C (RCR) Receive Configuration Register	(Offset 0x608, 32 bits)
+//----------------------------------------------------------------------------
+#define	RCR_APPFCS					BIT31		//WMAC append FCS after pauload
+#define	RCR_APP_MIC				BIT30		//
+#define	RCR_APP_PHYSTS			BIT28//
+#define	RCR_APP_ICV				BIT29       //
+#define	RCR_APP_PHYST_RXFF		BIT28       //
+#define	RCR_APP_BA_SSN			BIT27		//Accept BA SSN
+#define	RCR_ENMBID					BIT24		//Enable Multiple BssId.
+#define	RCR_LSIGEN					BIT23
+#define	RCR_MFBEN					BIT22
+#define	RCR_HTC_LOC_CTRL			BIT14       //MFC<--HTC=1 MFC-->HTC=0
+#define	RCR_AMF					BIT13		//Accept management type frame
+#define	RCR_ACF					BIT12		//Accept control type frame
+#define	RCR_ADF					BIT11		//Accept data type frame
+#define	RCR_AICV					BIT9		//Accept ICV error packet
+#define	RCR_ACRC32					BIT8		//Accept CRC32 error packet
+#define	RCR_CBSSID_BCN			BIT7		//Accept BSSID match packet (Rx beacon, probe rsp)
+#define	RCR_CBSSID_DATA			BIT6		//Accept BSSID match packet (Data)
+#define	RCR_CBSSID					RCR_CBSSID_DATA		//Accept BSSID match packet
+#define	RCR_APWRMGT				BIT5		//Accept power management packet
+#define	RCR_ADD3					BIT4		//Accept address 3 match packet
+#define	RCR_AB						BIT3		//Accept broadcast packet
+#define	RCR_AM						BIT2		//Accept multicast packet
+#define	RCR_APM					BIT1		//Accept physical match packet
+#define	RCR_AAP					BIT0		//Accept all unicast packet
+#define	RCR_MXDMA_OFFSET			8
+#define	RCR_FIFO_OFFSET			13
+
+
+
+//============================================================================
+//       8192c USB specific Regsiter Offset and Content definition,
+//       2009.08.18, added by vivi. for merge 92c and 92C into one driver
+//============================================================================
+//#define APS_FSMCO				0x0004  same with 92Ce
+#define RSV_CTRL					0x001C
+#define RD_CTRL					0x0524
+
+//-----------------------------------------------------
+//
+//	0xFE00h ~ 0xFE55h	USB Configuration
+//
+//-----------------------------------------------------
+#define REG_USB_INFO				0xFE17
+#define REG_USB_SPECIAL_OPTION	0xFE55
+#define REG_USB_DMA_AGG_TO		0xFE5B
+#define REG_USB_AGG_TO				0xFE5C
+#define REG_USB_AGG_TH				0xFE5D
+
+#define REG_USB_VID					0xFE60
+#define REG_USB_PID					0xFE62
+#define REG_USB_OPTIONAL			0xFE64
+#define REG_USB_CHIRP_K			0xFE65
+#define REG_USB_PHY					0xFE66
+#define REG_USB_MAC_ADDR			0xFE70
+
+#define REG_USB_HRPWM				0xFE58
+#define REG_USB_HCPWM				0xFE57
+
+#define	InvalidBBRFValue			0x12345678
+
+//============================================================================
+//       8192C Regsiter Bit and Content definition
+//============================================================================
+//-----------------------------------------------------
+//
+//	0x0000h ~ 0x00FFh	System Configuration
+//
+//-----------------------------------------------------
+
+//2 SPS0_CTRL
+#define SW18_FPWM					BIT(3)
+
+
+//2 SYS_ISO_CTRL
+#define ISO_MD2PP					BIT(0)
+#define ISO_UA2USB					BIT(1)
+#define ISO_UD2CORE					BIT(2)
+#define ISO_PA2PCIE					BIT(3)
+#define ISO_PD2CORE					BIT(4)
+#define ISO_IP2MAC					BIT(5)
+#define ISO_DIOP						BIT(6)
+#define ISO_DIOE						BIT(7)
+#define ISO_EB2CORE					BIT(8)
+#define ISO_DIOR						BIT(9)
+
+#define PWC_EV25V					BIT(14)
+#define PWC_EV12V					BIT(15)
+
+
+//2 SYS_FUNC_EN
+#define FEN_BBRSTB					BIT(0)
+#define FEN_BB_GLB_RSTn			BIT(1)
+#define FEN_USBA					BIT(2)
+#define FEN_UPLL					BIT(3)
+#define FEN_USBD					BIT(4)
+#define FEN_DIO_PCIE				BIT(5)
+#define FEN_PCIEA					BIT(6)
+#define FEN_PPLL						BIT(7)
+#define FEN_PCIED					BIT(8)
+#define FEN_DIOE					BIT(9)
+#define FEN_CPUEN					BIT(10)
+#define FEN_DCORE					BIT(11)
+#define FEN_ELDR					BIT(12)
+#define FEN_DIO_RF					BIT(13)
+#define FEN_HWPDN					BIT(14)
+#define FEN_MREGEN					BIT(15)
+
+//2 APS_FSMCO
+#define PFM_LDALL					BIT(0)
+#define PFM_ALDN					BIT(1)
+#define PFM_LDKP					BIT(2)
+#define PFM_WOWL					BIT(3)
+#define EnPDN						BIT(4)
+#define PDN_PL						BIT(5)
+#define APFM_ONMAC					BIT(8)
+#define APFM_OFF					BIT(9)
+#define APFM_RSM					BIT(10)
+#define AFSM_HSUS					BIT(11)
+#define AFSM_PCIE					BIT(12)
+#define APDM_MAC					BIT(13)
+#define APDM_HOST					BIT(14)
+#define APDM_HPDN					BIT(15)
+#define RDY_MACON					BIT(16)
+#define SUS_HOST					BIT(17)
+#define ROP_ALD						BIT(20)
+#define ROP_PWR						BIT(21)
+#define ROP_SPS						BIT(22)
+#define SOP_MRST					BIT(25)
+#define SOP_FUSE					BIT(26)
+#define SOP_ABG						BIT(27)
+#define SOP_AMB						BIT(28)
+#define SOP_RCK						BIT(29)
+#define SOP_A8M						BIT(30)
+#define XOP_BTCK					BIT(31)
+
+//2 SYS_CLKR
+#define ANAD16V_EN					BIT(0)
+#define ANA8M						BIT(1)
+#define MACSLP						BIT(4)
+#define LOADER_CLK_EN				BIT(5)
+#define _80M_SSC_DIS				BIT(7)
+#define _80M_SSC_EN_HO				BIT(8)
+#define PHY_SSC_RSTB				BIT(9)
+#define SEC_CLK_EN					BIT(10)
+#define MAC_CLK_EN					BIT(11)
+#define SYS_CLK_EN					BIT(12)
+#define RING_CLK_EN					BIT(13)
+
+
+//2 9346CR
+
+
+#define 	EEDO					BIT(0)
+#define 	EEDI					BIT(1)
+#define 	EESK					BIT(2)
+#define 	EECS					BIT(3)
+//#define 	EERPROMSEL			BIT(4)
+//#define 	EEPROM_EN			BIT(5)
+#define		BOOT_FROM_EEPROM		BIT(4)
+#define		EEPROM_EN				BIT(5)
+#define 	EEM0					BIT(6)
+#define 	EEM1					BIT(7)
+
+
+//2 AFE_MISC
+#define AFE_BGEN					BIT(0)
+#define AFE_MBEN					BIT(1)
+#define MAC_ID_EN					BIT(7)
+
+
+//2 SPS0_CTRL
+
+
+//2 SPS_OCP_CFG
+
+
+//2 RSV_CTRL
+#define WLOCK_ALL					BIT(0)
+#define WLOCK_00					BIT(1)
+#define WLOCK_04					BIT(2)
+#define WLOCK_08					BIT(3)
+#define WLOCK_40					BIT(4)
+#define R_DIS_PRST_0				BIT(5)
+#define R_DIS_PRST_1				BIT(6)
+#define LOCK_ALL_EN					BIT(7)
+
+//2 RF_CTRL
+#define RF_EN						BIT(0)
+#define RF_RSTB						BIT(1)
+#define RF_SDMRSTB					BIT(2)
+
+
+
+//2 LDOA15_CTRL
+#define LDA15_EN					BIT(0)
+#define LDA15_STBY					BIT(1)
+#define LDA15_OBUF					BIT(2)
+#define LDA15_REG_VOS				BIT(3)
+#define _LDA15_VOADJ(x)				(((x) & 0x7) << 4)
+
+
+
+//2 LDOV12D_CTRL
+#define LDV12_EN					BIT(0)
+#define LDV12_SDBY					BIT(1)
+#define LPLDO_HSM					BIT(2)
+#define LPLDO_LSM_DIS				BIT(3)
+#define _LDV12_VADJ(x)				(((x) & 0xF) << 4)
+
+
+//2 AFE_XTAL_CTRL
+#define XTAL_EN						BIT(0)
+#define XTAL_BSEL					BIT(1)
+#define _XTAL_BOSC(x)				(((x) & 0x3) << 2)
+#define _XTAL_CADJ(x)				(((x) & 0xF) << 4)
+#define XTAL_GATE_USB				BIT(8)
+#define _XTAL_USB_DRV(x)			(((x) & 0x3) << 9)
+#define XTAL_GATE_AFE				BIT(11)
+#define _XTAL_AFE_DRV(x)			(((x) & 0x3) << 12)
+#define XTAL_RF_GATE				BIT(14)
+#define _XTAL_RF_DRV(x)				(((x) & 0x3) << 15)
+#define XTAL_GATE_DIG				BIT(17)
+#define _XTAL_DIG_DRV(x)			(((x) & 0x3) << 18)
+#define XTAL_BT_GATE				BIT(20)
+#define _XTAL_BT_DRV(x)				(((x) & 0x3) << 21)
+#define _XTAL_GPIO(x)				(((x) & 0x7) << 23)
+
+
+#define CKDLY_AFE					BIT(26)
+#define CKDLY_USB					BIT(27)
+#define CKDLY_DIG					BIT(28)
+#define CKDLY_BT					BIT(29)
+
+
+//2 AFE_PLL_CTRL
+#define APLL_EN						BIT(0)
+#define APLL_320_EN					BIT(1)
+#define APLL_FREF_SEL				BIT(2)
+#define APLL_EDGE_SEL				BIT(3)
+#define APLL_WDOGB					BIT(4)
+#define APLL_LPFEN					BIT(5)
+
+#define APLL_REF_CLK_13MHZ			0x1
+#define APLL_REF_CLK_19_2MHZ		0x2
+#define APLL_REF_CLK_20MHZ			0x3
+#define APLL_REF_CLK_25MHZ			0x4
+#define APLL_REF_CLK_26MHZ			0x5
+#define APLL_REF_CLK_38_4MHZ		0x6
+#define APLL_REF_CLK_40MHZ			0x7
+
+#define APLL_320EN					BIT(14)
+#define APLL_80EN					BIT(15)
+#define APLL_1MEN					BIT(24)
+
+
+//2 EFUSE_CTRL
+#define ALD_EN						BIT(18)
+#define EF_PD						BIT(19)
+#define EF_FLAG						BIT(31)
+
+//2 EFUSE_TEST (For RTL8723 partially)
+#define EF_TRPT						BIT(7)
+#define EF_CELL_SEL					(BIT(8)|BIT(9)) // 00: Wifi Efuse, 01: BT Efuse0, 10: BT Efuse1, 11: BT Efuse2
+#define LDOE25_EN					BIT(31)
+#define EFUSE_SEL(x)					(((x) & 0x3) << 8)
+#define EFUSE_SEL_MASK				0x300
+#define EFUSE_WIFI_SEL_0			0x0
+#define EFUSE_BT_SEL_0				0x1
+#define EFUSE_BT_SEL_1				0x2
+#define EFUSE_BT_SEL_2				0x3
+
+#define EFUSE_ACCESS_ON			0x69	// For RTL8723 only.
+#define EFUSE_ACCESS_OFF			0x00	// For RTL8723 only.
+
+//2 PWR_DATA
+
+//2 CAL_TIMER
+
+//2 ACLK_MON
+#define RSM_EN						BIT(0)
+#define Timer_EN						BIT(4)
+
+
+//2 GPIO_MUXCFG
+#define TRSW0EN						BIT(2)
+#define TRSW1EN						BIT(3)
+#define EROM_EN						BIT(4)
+#define EnBT							BIT(5)
+#define EnUart						BIT(8)
+#define Uart_910						BIT(9)
+#define EnPMAC						BIT(10)
+#define SIC_SWRST					BIT(11)
+#define EnSIC						BIT(12)
+#define SIC_23						BIT(13)
+#define EnHDP						BIT(14)
+#define SIC_LBK						BIT(15)
+
+//2 GPIO_PIN_CTRL
+
+// GPIO BIT
+#define HAL_8192C_HW_GPIO_WPS_BIT		BIT(2)
+
+//2 GPIO_INTM
+
+//2 LEDCFG
+#define LED0PL 						BIT(4)
+#define LED0DIS						BIT(7)
+#define LED1DIS						BIT(15)
+#define LED1PL 						BIT(12)
+
+#define  SECCAM_CLR					BIT(30)
+
+
+//2 FSIMR
+
+//2 FSISR
+
+
+//2 8051FWDL
+//2 MCUFWDL
+#define MCUFWDL_EN					BIT(0)
+#define MCUFWDL_RDY				BIT(1)
+#define FWDL_ChkSum_rpt			BIT(2)
+#define MACINI_RDY					BIT(3)
+#define BBINI_RDY					BIT(4)
+#define RFINI_RDY					BIT(5)
+#define WINTINI_RDY					BIT(6)
+#define CPRST						BIT(23)
+
+//2REG_HPON_FSM
+#define BOND92CE_1T2R_CFG			BIT(22)
+
+
+//2 REG_SYS_CFG
+#define XCLK_VLD						BIT(0)
+#define ACLK_VLD					BIT(1)
+#define UCLK_VLD					BIT(2)
+#define PCLK_VLD						BIT(3)
+#define PCIRSTB						BIT(4)
+#define V15_VLD						BIT(5)
+#define TRP_B15V_EN					BIT(7)
+#define SIC_IDLE						BIT(8)
+#define BD_MAC2						BIT(9)
+#define BD_MAC1						BIT(10)
+#define IC_MACPHY_MODE				BIT(11)
+#define CHIP_VER						(BIT(12)|BIT(13)|BIT(14)|BIT(15))
+#define BT_FUNC						BIT(16)
+#define VENDOR_ID					BIT(19)
+#define PAD_HWPD_IDN				BIT(22)
+#define TRP_VAUX_EN					BIT(23)
+#define TRP_BT_EN					BIT(24)
+#define BD_PKG_SEL					BIT(25)
+#define BD_HCI_SEL					BIT(26)
+#define TYPE_ID						BIT(27)
+
+#define CHIP_VER_RTL_MASK			0xF000	//Bit 12 ~ 15
+#define CHIP_VER_RTL_SHIFT			12
+
+//2REG_GPIO_OUTSTS (For RTL8723 only)
+#define	EFS_HCI_SEL				(BIT(0)|BIT(1))
+#define	PAD_HCI_SEL				(BIT(2)|BIT(3))
+#define	HCI_SEL						(BIT(4)|BIT(5))
+#define	PKG_SEL_HCI				BIT(6)
+#define	FEN_GPS					BIT(7)
+#define	FEN_BT						BIT(8)
+#define	FEN_WL						BIT(9)
+#define	FEN_PCI						BIT(10)
+#define	FEN_USB					BIT(11)
+#define	BTRF_HWPDN_N				BIT(12)
+#define	WLRF_HWPDN_N				BIT(13)
+#define	PDN_BT_N					BIT(14)
+#define	PDN_GPS_N					BIT(15)
+#define	BT_CTL_HWPDN				BIT(16)
+#define	GPS_CTL_HWPDN				BIT(17)
+#define	PPHY_SUSB					BIT(20)
+#define	UPHY_SUSB					BIT(21)
+#define	PCI_SUSEN					BIT(22)
+#define	USB_SUSEN					BIT(23)
+#define	RF_RL_ID					(BIT(31)|BIT(30)|BIT(29)|BIT(28))
+
+//-----------------------------------------------------
+//
+//	0x0100h ~ 0x01FFh	MACTOP General Configuration
+//
+//-----------------------------------------------------
+
+
+//2 Function Enable Registers
+//2 CR
+
+#define REG_LBMODE					(REG_CR + 3)
+
+
+#define HCI_TXDMA_EN				BIT(0)
+#define HCI_RXDMA_EN				BIT(1)
+#define TXDMA_EN					BIT(2)
+#define RXDMA_EN					BIT(3)
+#define PROTOCOL_EN					BIT(4)
+#define SCHEDULE_EN					BIT(5)
+#define MACTXEN						BIT(6)
+#define MACRXEN						BIT(7)
+#define ENSWBCN						BIT(8)
+#define ENSEC						BIT(9)
+
+// Network type
+#define _NETTYPE(x)					(((x) & 0x3) << 16)
+#define MASK_NETTYPE				0x30000
+#define NT_NO_LINK					0x0
+#define NT_LINK_AD_HOC				0x1
+#define NT_LINK_AP					0x2
+#define NT_AS_AP					0x3
+
+#define _LBMODE(x)					(((x) & 0xF) << 24)
+#define MASK_LBMODE				0xF000000
+#define LOOPBACK_NORMAL			0x0
+#define LOOPBACK_IMMEDIATELY		0xB
+#define LOOPBACK_MAC_DELAY		0x3
+#define LOOPBACK_PHY				0x1
+#define LOOPBACK_DMA				0x7
+
+
+//2 PBP - Page Size Register
+#define GET_RX_PAGE_SIZE(value)		((value) & 0xF)
+#define GET_TX_PAGE_SIZE(value)		(((value) & 0xF0) >> 4)
+#define _PSRX_MASK					0xF
+#define _PSTX_MASK					0xF0
+#define _PSRX(x)						(x)
+#define _PSTX(x)						((x) << 4)
+
+#define PBP_64						0x0
+#define PBP_128						0x1
+#define PBP_256						0x2
+#define PBP_512						0x3
+#define PBP_1024					0x4
+
+
+//2 TX/RXDMA
+#define RXDMA_ARBBW_EN			BIT(0)
+#define RXSHFT_EN					BIT(1)
+#define RXDMA_AGG_EN				BIT(2)
+#define QS_VO_QUEUE				BIT(8)
+#define QS_VI_QUEUE					BIT(9)
+#define QS_BE_QUEUE				BIT(10)
+#define QS_BK_QUEUE				BIT(11)
+#define QS_MANAGER_QUEUE			BIT(12)
+#define QS_HIGH_QUEUE				BIT(13)
+
+#define HQSEL_VOQ					BIT(0)
+#define HQSEL_VIQ					BIT(1)
+#define HQSEL_BEQ					BIT(2)
+#define HQSEL_BKQ					BIT(3)
+#define HQSEL_MGTQ					BIT(4)
+#define HQSEL_HIQ					BIT(5)
+
+// For normal driver, 0x10C
+#define _TXDMA_HIQ_MAP(x) 	 		(((x)&0x3) << 14)
+#define _TXDMA_MGQ_MAP(x) 	 		(((x)&0x3) << 12)
+#define _TXDMA_BKQ_MAP(x) 	 		(((x)&0x3) << 10)
+#define _TXDMA_BEQ_MAP(x) 	 		(((x)&0x3) << 8 )
+#define _TXDMA_VIQ_MAP(x) 	 		(((x)&0x3) << 6 )
+#define _TXDMA_VOQ_MAP(x) 	 		(((x)&0x3) << 4 )
+
+#define QUEUE_LOW					1
+#define QUEUE_NORMAL				2
+#define QUEUE_HIGH					3
+
+
+
+//2 TRXFF_BNDY
+
+
+//2 LLT_INIT
+#define _LLT_NO_ACTIVE				0x0
+#define _LLT_WRITE_ACCESS			0x1
+#define _LLT_READ_ACCESS			0x2
+
+#define _LLT_INIT_DATA(x)			((x) & 0xFF)
+#define _LLT_INIT_ADDR(x)			(((x) & 0xFF) << 8)
+#define _LLT_OP(x)					(((x) & 0x3) << 30)
+#define _LLT_OP_VALUE(x)			(((x) >> 30) & 0x3)
+
+
+//2 BB_ACCESS_CTRL
+#define BB_WRITE_READ_MASK		(BIT(31) | BIT(30))
+#define BB_WRITE_EN					BIT(30)
+#define BB_READ_EN					BIT(31)
+//#define BB_ADDR_MASK				0xFFF
+//#define _BB_ADDR(x)					((x) & BB_ADDR_MASK)
+
+//-----------------------------------------------------
+//
+//	0x0200h ~ 0x027Fh	TXDMA Configuration
+//
+//-----------------------------------------------------
+//2 RQPN
+#define _HPQ(x)						((x) & 0xFF)
+#define _LPQ(x)						(((x) & 0xFF) << 8)
+#define _PUBQ(x)						(((x) & 0xFF) << 16)
+#define _NPQ(x)						((x) & 0xFF)			// NOTE: in RQPN_NPQ register
+
+
+#define HPQ_PUBLIC_DIS				BIT(24)
+#define LPQ_PUBLIC_DIS				BIT(25)
+#define LD_RQPN						BIT(31)
+
+
+//2 TDECTRL
+#define BCN_VALID					BIT(16)
+#define BCN_HEAD(x)					(((x) & 0xFF) << 8)
+#define	BCN_HEAD_MASK				0xFF00
+
+//2 TDECTL
+#define BLK_DESC_NUM_SHIFT			4
+#define BLK_DESC_NUM_MASK			0xF
+
+
+//2 TXDMA_OFFSET_CHK
+#define DROP_DATA_EN				BIT(9)
+
+//-----------------------------------------------------
+//
+//	0x0400h ~ 0x047Fh	Protocol Configuration
+//
+//-----------------------------------------------------
+//2 FWHW_TXQ_CTRL
+#define EN_AMPDU_RTY_NEW			BIT(7)
+
+//2 INIRTSMCS_SEL
+#define _INIRTSMCS_SEL(x)			((x) & 0x3F)
+
+
+//2 SPEC SIFS
+#define _SPEC_SIFS_CCK(x)			((x) & 0xFF)
+#define _SPEC_SIFS_OFDM(x)			(((x) & 0xFF) << 8)
+
+
+//2 RRSR
+
+#define RATE_REG_BITMAP_ALL			0xFFFFF
+
+#define _RRSC_BITMAP(x)					((x) & 0xFFFFF)
+
+#define _RRSR_RSC(x)						(((x) & 0x3) << 21)
+#define RRSR_RSC_RESERVED				0x0
+#define RRSR_RSC_UPPER_SUBCHANNEL	0x1
+#define RRSR_RSC_LOWER_SUBCHANNEL	0x2
+#define RRSR_RSC_DUPLICATE_MODE		0x3
+
+
+//2 ARFR
+#define USE_SHORT_G1				BIT(20)
+
+//2 AGGLEN_LMT_L
+#define _AGGLMT_MCS0(x)				((x) & 0xF)
+#define _AGGLMT_MCS1(x)				(((x) & 0xF) << 4)
+#define _AGGLMT_MCS2(x)				(((x) & 0xF) << 8)
+#define _AGGLMT_MCS3(x)				(((x) & 0xF) << 12)
+#define _AGGLMT_MCS4(x)				(((x) & 0xF) << 16)
+#define _AGGLMT_MCS5(x)				(((x) & 0xF) << 20)
+#define _AGGLMT_MCS6(x)				(((x) & 0xF) << 24)
+#define _AGGLMT_MCS7(x)				(((x) & 0xF) << 28)
+
+
+//2 RL
+#define	RETRY_LIMIT_SHORT_SHIFT		8
+#define	RETRY_LIMIT_LONG_SHIFT		0
+
+
+//2 DARFRC
+#define _DARF_RC1(x)				((x) & 0x1F)
+#define _DARF_RC2(x)				(((x) & 0x1F) << 8)
+#define _DARF_RC3(x)				(((x) & 0x1F) << 16)
+#define _DARF_RC4(x)				(((x) & 0x1F) << 24)
+// NOTE: shift starting from address (DARFRC + 4)
+#define _DARF_RC5(x)				((x) & 0x1F)
+#define _DARF_RC6(x)				(((x) & 0x1F) << 8)
+#define _DARF_RC7(x)				(((x) & 0x1F) << 16)
+#define _DARF_RC8(x)				(((x) & 0x1F) << 24)
+
+
+//2 RARFRC
+#define _RARF_RC1(x)				((x) & 0x1F)
+#define _RARF_RC2(x)				(((x) & 0x1F) << 8)
+#define _RARF_RC3(x)				(((x) & 0x1F) << 16)
+#define _RARF_RC4(x)				(((x) & 0x1F) << 24)
+// NOTE: shift starting from address (RARFRC + 4)
+#define _RARF_RC5(x)				((x) & 0x1F)
+#define _RARF_RC6(x)				(((x) & 0x1F) << 8)
+#define _RARF_RC7(x)				(((x) & 0x1F) << 16)
+#define _RARF_RC8(x)				(((x) & 0x1F) << 24)
+
+
+
+
+//-----------------------------------------------------
+//
+//	0x0500h ~ 0x05FFh	EDCA Configuration
+//
+//-----------------------------------------------------
+
+
+
+//2 EDCA setting
+#define AC_PARAM_TXOP_LIMIT_OFFSET	16
+#define AC_PARAM_ECW_MAX_OFFSET		12
+#define AC_PARAM_ECW_MIN_OFFSET		8
+#define AC_PARAM_AIFS_OFFSET			0
+
+
+//2 EDCA_VO_PARAM
+#define _AIFS(x)						(x)
+#define _ECW_MAX_MIN(x)			((x) << 8)
+#define _TXOP_LIMIT(x)				((x) << 16)
+
+
+#define _BCNIFS(x)					((x) & 0xFF)
+#define _BCNECW(x)					(((x) & 0xF))<< 8)
+
+
+#define _LRL(x)						((x) & 0x3F)
+#define _SRL(x)						(((x) & 0x3F) << 8)
+
+
+//2 SIFS_CCK
+#define _SIFS_CCK_CTX(x)			((x) & 0xFF)
+#define _SIFS_CCK_TRX(x)			(((x) & 0xFF) << 8);
+
+
+//2 SIFS_OFDM
+#define _SIFS_OFDM_CTX(x)			((x) & 0xFF)
+#define _SIFS_OFDM_TRX(x)			(((x) & 0xFF) << 8);
+
+
+//2 TBTT PROHIBIT
+#define _TBTT_PROHIBIT_HOLD(x)		(((x) & 0xFF) << 8)
+
+
+//2 REG_RD_CTRL
+#define DIS_EDCA_CNT_DWN			BIT(11)
+
+
+//2 BCN_CTRL
+#define EN_MBSSID						BIT(1)
+#define EN_TXBCN_RPT					BIT(2)
+#define	EN_BCN_FUNCTION				BIT(3)
+// The same function but different bit field.
+#define	DIS_TSF_UDT0_NORMAL_CHIP	BIT(4)
+#define	DIS_TSF_UDT0_TEST_CHIP		BIT(5)
+
+//2 ACMHWCTRL
+#define	AcmHw_HwEn					BIT(0)
+#define	AcmHw_BeqEn					BIT(1)
+#define	AcmHw_ViqEn					BIT(2)
+#define	AcmHw_VoqEn					BIT(3)
+#define	AcmHw_BeqStatus				BIT(4)
+#define	AcmHw_ViqStatus				BIT(5)
+#define	AcmHw_VoqStatus				BIT(6)
+
+
+
+//-----------------------------------------------------
+//
+//	0x0600h ~ 0x07FFh	WMAC Configuration
+//
+//-----------------------------------------------------
+
+//2 APSD_CTRL
+#define APSDOFF						BIT(6)
+#define APSDOFF_STATUS				BIT(7)
+
+
+//2 BWOPMODE
+#define BW_20MHZ					BIT(2)
+//#define BW_OPMODE_20MHZ				BIT(2)	// For compability
+
+
+#define RATE_BITMAP_ALL			0xFFFFF
+
+// Only use CCK 1M rate for ACK
+#define RATE_RRSR_CCK_ONLY_1M		0xFFFF1
+
+//2 TCR
+#define TSFRST						BIT(0)
+#define DIS_GCLK						BIT(1)
+#define PAD_SEL						BIT(2)
+#define PWR_ST						BIT(6)
+#define PWRBIT_OW_EN				BIT(7)
+#define ACRC							BIT(8)
+#define CFENDFORM					BIT(9)
+#define ICV							BIT(10)
+
+
+
+//2 RCR
+#define AAP							BIT(0)
+#define APM							BIT(1)
+#define AM							BIT(2)
+#define AB							BIT(3)
+#define ADD3							BIT(4)
+#define APWRMGT					BIT(5)
+#define CBSSID						BIT(6)
+#define CBSSID_BCN					BIT(7)
+#define ACRC32						BIT(8)
+#define AICV							BIT(9)
+#define ADF							BIT(11)
+#define ACF							BIT(12)
+#define AMF							BIT(13)
+#define HTC_LOC_CTRL				BIT(14)
+#define UC_DATA_EN					BIT(16)
+#define BM_DATA_EN					BIT(17)
+#define MFBEN						BIT(22)
+#define LSIGEN						BIT(23)
+#define EnMBID						BIT(24)
+#define APP_BASSN					BIT(27)
+#define APP_PHYSTS					BIT(28)
+#define APP_ICV						BIT(29)
+#define APP_MIC						BIT(30)
+#define APP_FCS						BIT(31)
+
+//2 RX_PKT_LIMIT
+
+//2 RX_DLK_TIME
+
+//2 MBIDCAMCFG
+
+
+
+//2 AMPDU_MIN_SPACE
+#define _MIN_SPACE(x)				((x) & 0x7)
+#define _SHORT_GI_PADDING(x)		(((x) & 0x1F) << 3)
+
+
+//2 RXERR_RPT
+#define RXERR_TYPE_OFDM_PPDU				0
+#define RXERR_TYPE_OFDM_FALSE_ALARM		1
+#define	RXERR_TYPE_OFDM_MPDU_OK			2
+#define RXERR_TYPE_OFDM_MPDU_FAIL		3
+#define RXERR_TYPE_CCK_PPDU				4
+#define RXERR_TYPE_CCK_FALSE_ALARM		5
+#define RXERR_TYPE_CCK_MPDU_OK			6
+#define RXERR_TYPE_CCK_MPDU_FAIL			7
+#define RXERR_TYPE_HT_PPDU					8
+#define RXERR_TYPE_HT_FALSE_ALARM		9
+#define RXERR_TYPE_HT_MPDU_TOTAL			10
+#define RXERR_TYPE_HT_MPDU_OK				11
+#define RXERR_TYPE_HT_MPDU_FAIL			12
+#define RXERR_TYPE_RX_FULL_DROP			15
+
+#define RXERR_COUNTER_MASK				0xFFFFF
+#define RXERR_RPT_RST						BIT(27)
+#define _RXERR_RPT_SEL(type)				((type) << 28)
+
+
+//2 SECCFG
+#define	SCR_TxUseDK						BIT(0)			//Force Tx Use Default Key
+#define	SCR_RxUseDK						BIT(1)			//Force Rx Use Default Key
+#define	SCR_TxEncEnable					BIT(2)			//Enable Tx Encryption
+#define	SCR_RxDecEnable					BIT(3)			//Enable Rx Decryption
+#define	SCR_SKByA2							BIT(4)			//Search kEY BY A2
+#define	SCR_NoSKMC							BIT(5)			//No Key Search Multicast
+
+
+
+//-----------------------------------------------------
+//
+//	0xFE00h ~ 0xFE55h	USB Configuration
+//
+//-----------------------------------------------------
+
+//2 USB Information (0xFE17)
+#define USB_IS_HIGH_SPEED				0
+#define USB_IS_FULL_SPEED				1
+#define USB_SPEED_MASK					BIT(5)
+
+#define USB_NORMAL_SIE_EP_MASK		0xF
+#define USB_NORMAL_SIE_EP_SHIFT		4
+
+#define USB_TEST_EP_MASK				0x30
+#define USB_TEST_EP_SHIFT				4
+
+//2 Special Option
+#define USB_AGG_EN						BIT(3)
+
+
+//2REG_C2HEVT_CLEAR
+#define		C2H_EVT_HOST_CLOSE		0x00	// Set by driver and notify FW that the driver has read the C2H command message
+#define		C2H_EVT_FW_CLOSE		0xFF	// Set by FW indicating that FW had set the C2H command message and it's not yet read by driver.
+
+
+//2REG_MULTI_FUNC_CTRL(For RTL8723 Only)
+#define	WL_HWPDN_EN				BIT0		// Enable GPIO[9] as WiFi HW PDn source
+#define	WL_HWPDN_SL				BIT1		// WiFi HW PDn polarity control
+#define	WL_FUNC_EN				BIT2		// WiFi function enable
+#define	WL_HWROF_EN				BIT3		// Enable GPIO[9] as WiFi RF HW PDn source
+#define	BT_HWPDN_EN				BIT16	// Enable GPIO[11] as BT HW PDn source
+#define	BT_HWPDN_SL				BIT17	// BT HW PDn polarity control
+#define	BT_FUNC_EN					BIT18	// BT function enable
+#define	BT_HWROF_EN				BIT19	// Enable GPIO[11] as BT/GPS RF HW PDn source
+#define	GPS_HWPDN_EN				BIT20	// Enable GPIO[10] as GPS HW PDn source
+#define	GPS_HWPDN_SL				BIT21	// GPS HW PDn polarity control
+#define	GPS_FUNC_EN				BIT22	// GPS function enable
+
+//3 REG_LIFECTRL_CTRL
+#define	HAL92C_EN_PKT_LIFE_TIME_BK		BIT3
+#define	HAL92C_EN_PKT_LIFE_TIME_BE		BIT2
+#define	HAL92C_EN_PKT_LIFE_TIME_VI		BIT1
+#define	HAL92C_EN_PKT_LIFE_TIME_VO		BIT0
+
+#define	HAL92C_MSDU_LIFE_TIME_UNIT		128		// in us, said by Tim.
+
+//========================================================
+// General definitions
+//========================================================
+
+#define MAC_ADDR_LEN					6
+#define LAST_ENTRY_OF_TX_PKT_BUFFER	255
+
+#define POLLING_LLT_THRESHOLD			20
+#define POLLING_READY_TIMEOUT_COUNT	1000
+
+// Min Spacing related settings.
+#define	MAX_MSS_DENSITY_2T				0x13
+#define	MAX_MSS_DENSITY_1T				0x0A
+
+//----------------------------------------------------------------------------
+//       8192C GPIO MUX Configuration Register (offset 0x40, 4 byte)
+//----------------------------------------------------------------------------
+#define	GPIOSEL_GPIO				0
+#define	GPIOSEL_ENBT				BIT5
+
+//----------------------------------------------------------------------------
+//       8192C GPIO PIN Control Register (offset 0x44, 4 byte)
+//----------------------------------------------------------------------------
+#define	GPIO_IN						REG_GPIO_PIN_CTRL		// GPIO pins input value
+#define	GPIO_OUT					(REG_GPIO_PIN_CTRL+1)	// GPIO pins output value
+#define	GPIO_IO_SEL				(REG_GPIO_PIN_CTRL+2)	// GPIO pins output enable when a bit is set to "1"; otherwise, input is configured.
+#define	GPIO_MOD					(REG_GPIO_PIN_CTRL+3)
+
+
+
+#include "basic_types.h"
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_sreset.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_sreset.h
new file mode 100644
index 000000000000..6f5b953a8ae9
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_sreset.h
@@ -0,0 +1,32 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTL8192C_SRESET_C_
+#define _RTL8192C_SRESET_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_sreset.h>
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+extern void rtl8192c_sreset_xmit_status_check(_adapter *padapter);
+extern void rtl8192c_sreset_linked_status_check(_adapter *padapter);
+#endif
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_xmit.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_xmit.h
new file mode 100644
index 000000000000..9abbae984edd
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192c_xmit.h
@@ -0,0 +1,128 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTL8192C_XMIT_H_
+#define _RTL8192C_XMIT_H_
+
+//
+// Queue Select Value in TxDesc
+//
+#define QSLT_BK							0x2//0x01
+#define QSLT_BE							0x0
+#define QSLT_VI							0x5//0x4
+#define QSLT_VO							0x7//0x6
+#define QSLT_BEACON						0x10
+#define QSLT_HIGH						0x11
+#define QSLT_MGNT						0x12
+#define QSLT_CMD						0x13
+
+struct txrpt_ccx_8192c {
+	/* offset 0 */
+	u8 retry_cnt:6;
+	u8 rsvd_0:2;
+
+	/* offset 1 */
+	u8 rts_retry_cnt:6;
+	u8 rsvd_1:2;
+
+	/* offset 2 */
+	u8 ccx_qtime0;
+	u8 ccx_qtime1;
+
+	/* offset 4 */
+	u8 missed_pkt_num:5;
+	u8 rsvd_4:3;
+
+	/* offset 5 */
+	u8 mac_id:5;
+	u8 des1_fragssn:3;
+
+	/* offset 6 */
+	u8 rpt_pkt_num:5;
+	u8 pkt_drop:1;
+	u8 lifetime_over:1;
+	u8 retry_over:1;
+
+	/* offset 7*/
+	u8 edca_tx_queue:4;
+	u8 rsvd_7:1;
+	u8 bmc:1;
+	u8 pkt_ok:1;
+	u8 int_ccx:1;
+};
+
+#define txrpt_ccx_qtime_8192c(txrpt_ccx) ((txrpt_ccx)->ccx_qtime0+((txrpt_ccx)->ccx_qtime1<<8))
+
+#ifdef CONFIG_XMIT_ACK
+void dump_txrpt_ccx_8192c(void *buf);
+void handle_txrpt_ccx_8192c(_adapter *adapter, void *buf);
+#else
+#define dump_txrpt_ccx_8192c(buf) do {} while(0)
+#define handle_txrpt_ccx_8192c(adapter, buf) do {} while(0)
+#endif
+
+#ifdef CONFIG_USB_HCI
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+#define MAX_TX_AGG_PACKET_NUMBER 0xFF
+#endif
+
+s32	rtl8192cu_init_xmit_priv(_adapter * padapter);
+
+void	rtl8192cu_free_xmit_priv(_adapter * padapter);
+
+void rtl8192cu_cal_txdesc_chksum(struct tx_desc	*ptxdesc);
+
+s32 rtl8192cu_xmitframe_complete(_adapter *padapter, struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf);
+
+s32 rtl8192cu_mgnt_xmit(_adapter *padapter, struct xmit_frame *pmgntframe);
+
+s32 rtl8192cu_hal_xmit(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+s32	 rtl8192cu_hal_xmitframe_enqueue(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+#ifdef CONFIG_HOSTAPD_MLME
+s32 rtl8192cu_hostap_mgnt_xmit_entry(_adapter *padapter, _pkt *pkt);
+#endif
+
+#endif
+
+#ifdef CONFIG_PCI_HCI
+s32	rtl8192ce_init_xmit_priv(_adapter * padapter);
+void	rtl8192ce_free_xmit_priv(_adapter * padapter);
+
+s32	rtl8192ce_enqueue_xmitbuf(struct rtw_tx_ring *ring, struct xmit_buf *pxmitbuf);
+struct xmit_buf *rtl8192ce_dequeue_xmitbuf(struct rtw_tx_ring *ring);
+
+void	rtl8192ce_xmitframe_resume(_adapter *padapter);
+
+s32	rtl8192ce_mgnt_xmit(_adapter *padapter, struct xmit_frame *pmgntframe);
+
+s32	rtl8192ce_hal_xmit(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+s32	 rtl8192ce_hal_xmitframe_enqueue(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+
+#ifdef CONFIG_HOSTAPD_MLME
+s32	rtl8192ce_hostap_mgnt_xmit_entry(_adapter *padapter, _pkt *pkt);
+#endif
+
+#endif
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_cmd.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_cmd.h
new file mode 100644
index 000000000000..8a8873af0648
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_cmd.h
@@ -0,0 +1,140 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTL8192D_CMD_H_
+#define __RTL8192D_CMD_H_
+
+
+//--------------------------------------------
+//3				Host Message Box
+//--------------------------------------------
+
+// User Define Message [31:8]
+
+//_SETPWRMODE_PARM
+#define SET_H2CCMD_PWRMODE_PARM_MODE(__pH2CCmd, __Value)			SET_BITS_TO_LE_1BYTE(__pH2CCmd, 0, 8, __Value)
+#define SET_H2CCMD_PWRMODE_PARM_SMART_PS(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE((__pH2CCmd)+1, 0, 8, __Value)
+#define SET_H2CCMD_PWRMODE_PARM_BCN_PASS_TIME(__pH2CCmd, __Value)	SET_BITS_TO_LE_1BYTE((__pH2CCmd)+2, 0, 8, __Value)
+
+//JOINBSSRPT_PARM
+#define SET_H2CCMD_JOINBSSRPT_PARM_OPMODE(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE(__pH2CCmd, 0, 8, __Value)
+
+//_RSVDPAGE_LOC
+#define SET_H2CCMD_RSVDPAGE_LOC_PROBE_RSP(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE(__pH2CCmd, 0, 8, __Value)
+#define SET_H2CCMD_RSVDPAGE_LOC_PSPOLL(__pH2CCmd, __Value)			SET_BITS_TO_LE_1BYTE((__pH2CCmd)+1, 0, 8, __Value)
+#define SET_H2CCMD_RSVDPAGE_LOC_NULL_DATA(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE((__pH2CCmd)+2, 0, 8, __Value)
+
+//P2P_PS_OFFLOAD
+
+struct P2P_PS_Offload_t {
+ unsigned char Offload_En:1;
+ unsigned char role:1; // 1: Owner, 0: Client
+ unsigned char CTWindow_En:1;
+ unsigned char NoA0_En:1;
+ unsigned char NoA1_En:1;
+ unsigned char AllStaSleep:1; // Only valid in Owner
+ unsigned char discovery:1;
+ unsigned char rsvd:1;
+};
+
+#define SET_H2CCMD_P2P_PS_OFFLOAD_EN(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE(__pH2CCmd, 0, 1, __Value)
+#define SET_H2CCMD_P2P_PS_OFFLOAD_ROLE(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE(__pH2CCmd, 1, 1, __Value)
+#define SET_H2CCMD_P2P_PS_OFFLOAD_CTW(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE(__pH2CCmd, 2, 1, __Value)
+#define SET_H2CCMD_P2P_PS_OFFLOAD_NOA0(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE(__pH2CCmd, 3, 1, __Value)
+#define SET_H2CCMD_P2P_PS_OFFLOAD_NOA1(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE(__pH2CCmd, 4, 1, __Value)
+#define SET_H2CCMD_P2P_PS_OFFLOAD_ALLSTASLEEP(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE(__pH2CCmd, 5, 1, __Value)
+#define SET_H2CCMD_P2P_PS_OFFLOAD_DISCOVERY(__pH2CCmd, __Value)		SET_BITS_TO_LE_1BYTE(__pH2CCmd, 6, 1, __Value)
+
+// Description: Determine the types of H2C commands that are the same in driver and Fw.
+// Fisrt constructed by tynli. 2009.10.09.
+typedef enum _RTL8192D_H2C_CMD
+{
+	H2C_AP_OFFLOAD = 0,		/*0*/
+	H2C_SETPWRMODE = 1,		/*1*/
+	H2C_JOINBSSRPT = 2,		/*2*/
+	H2C_RSVDPAGE = 3,
+	H2C_RSSI_REPORT = 5,
+	H2C_RA_MASK = 6,
+	H2C_P2P_PS_OFFLOAD = 8,
+	H2C_MAC_MODE_SEL = 9,
+	H2C_PWRM=15,
+#ifdef CONFIG_WOWLAN
+	H2C_WO_WLAN_CMD = 20,	// Wake on Wlan.
+#endif // CONFIG_WOWLAN
+	H2C_P2P_PS_CTW_CMD = 24,
+	H2C_PathDiv = 26,                  //PathDiv--NeilChen--2011.07.15
+#ifdef CONFIG_WOWLAN
+	KEEP_ALIVE_CONTROL_CMD=31, //keep alive for wake on wlan
+	DISCONNECT_DECISION_CTRL_CMD=32,
+	REMOTE_WAKE_CTRL_CMD=34,
+#endif // CONFIG_WOWLAN
+	H2C_92D_TSF_SYNC=36,
+	H2C_92D_RESET_TSF = 43,
+	H2C_CMD_MAX
+}RTL8192D_H2C_CMD;
+
+struct cmd_msg_parm {
+	u8 eid; //element id
+	u8 sz; // sz
+	u8 buf[6];
+};
+
+
+void	FillH2CCmd92D(_adapter* padapter, u8 ElementID, u32 CmdLen, u8* pCmdBuffer);
+
+// host message to firmware cmd
+void	rtl8192d_set_FwPwrMode_cmd(_adapter*padapter, u8 Mode);
+void	rtl8192d_set_FwJoinBssReport_cmd(_adapter* padapter, u8 mstatus);
+u8	rtl8192d_set_rssi_cmd(_adapter*padapter, u8 *param);
+u8	rtl8192d_set_raid_cmd(_adapter*padapter, u32 mask, u8 arg);
+void	rtl8192d_Add_RateATid(PADAPTER pAdapter, u32 bitmap, u8 arg);
+#ifdef CONFIG_P2P
+void	rtl8192d_set_p2p_ps_offload_cmd(_adapter* padapter, u8 p2p_ps_state);
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_TSF_RESET_OFFLOAD
+int reset_tsf(PADAPTER Adapter, u8 reset_port );
+#endif	// CONFIG_TSF_RESET_OFFLOAD
+
+#ifdef CONFIG_WOWLAN
+typedef struct _SETWOWLAN_PARM{
+	u8 	mode;
+	u8 	gpio_index;
+	u8	gpio_duration;
+	u8  second_mode;
+	u8  reserve;
+}SETWOWLAN_PARM, *PSETWOWLAN_PARM;
+
+#define FW_WOWLAN_FUN_EN			BIT(0)
+#define FW_WOWLAN_PATTERN_MATCH		BIT(1)
+#define FW_WOWLAN_MAGIC_PKT			BIT(2)
+#define FW_WOWLAN_UNICAST			BIT(3)
+#define FW_WOWLAN_ALL_PKT_DROP		BIT(4)
+#define FW_WOWLAN_GPIO_ACTIVE		BIT(5)
+#define FW_WOWLAN_REKEY_WAKEUP		BIT(6)
+#define FW_WOWLAN_DEAUTH_WAKEUP		BIT(7)
+
+#define FW_WOWLAN_GPIO_WAKEUP_EN	BIT(0)
+#define FW_FW_PARSE_MAGIC_PKT		BIT(1)
+
+void rtl8192d_set_wowlan_cmd(_adapter* padapter);
+void SetFwRelatedForWoWLAN8192DU(_adapter* 	padapter,u8 bHostIsGoingtoSleep);
+#endif // CONFIG_WOWLAN
+
+#endif	// __RTL8192D_CMD_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_dm.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_dm.h
new file mode 100644
index 000000000000..eaf1e4f5e07a
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_dm.h
@@ -0,0 +1,420 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef	__RTL8192D_DM_H__
+#define __RTL8192D_DM_H__
+//============================================================
+// Description:
+//
+// This file is for 92CE/92CU dynamic mechanism only
+//
+//
+//============================================================
+//============================================================
+// Global var
+//============================================================
+
+extern u32 EDCAParam[maxAP][3] ;
+
+//============================================================
+// structure and define
+//============================================================
+
+typedef struct _FALSE_ALARM_STATISTICS{
+	u32	Cnt_Parity_Fail;
+	u32	Cnt_Rate_Illegal;
+	u32	Cnt_Crc8_fail;
+	u32	Cnt_Mcs_fail;
+	u32	Cnt_Ofdm_fail;
+	u32	Cnt_Cck_fail;
+	u32	Cnt_all;
+	u32	Cnt_Fast_Fsync;
+	u32	Cnt_SB_Search_fail;
+}FALSE_ALARM_STATISTICS, *PFALSE_ALARM_STATISTICS;
+
+typedef struct _Dynamic_Power_Saving_
+{
+	u8		PreCCAState;
+	u8		CurCCAState;
+
+	u8		PreRFState;
+	u8		CurRFState;
+
+	//int		Rssi_val_min;
+
+}PS_T,*pPS_T;
+
+typedef struct _Dynamic_Initial_Gain_Threshold_
+{
+	u8		Dig_Enable_Flag;
+	u8		Dig_Ext_Port_Stage;
+
+	int		RssiLowThresh;
+	int		RssiHighThresh;
+
+	u32		FALowThresh;
+	u32		FAHighThresh;
+
+	u8		CurSTAConnectState;
+	u8		PreSTAConnectState;
+	u8		CurMultiSTAConnectState;
+
+	u8		PreIGValue;
+	u8		CurIGValue;
+	u8	       BackupIGValue;
+
+	char		BackoffVal;
+	char		BackoffVal_range_max;
+	char		BackoffVal_range_min;
+	u8		rx_gain_range_max;
+	u8		rx_gain_range_min;
+	u8		Rssi_val_min;
+
+	u8		PreCCKPDState;
+	u8		CurCCKPDState;
+
+	u8		LargeFAHit;
+	u8		ForbiddenIGI;
+	u32		Recover_cnt;
+	u8		rx_gain_range_min_nolink;
+}DIG_T,*pDIG_T;
+
+typedef enum tag_Dynamic_Init_Gain_Operation_Type_Definition
+{
+	DIG_TYPE_THRESH_HIGH	= 0,
+	DIG_TYPE_THRESH_LOW	= 1,
+	DIG_TYPE_BACKOFF		= 2,
+	DIG_TYPE_RX_GAIN_MIN	= 3,
+	DIG_TYPE_RX_GAIN_MAX	= 4,
+	DIG_TYPE_ENABLE 		= 5,
+	DIG_TYPE_DISABLE 		= 6,
+	DIG_OP_TYPE_MAX
+}DM_DIG_OP_E;
+
+typedef enum tag_CCK_Packet_Detection_Threshold_Type_Definition
+{
+	CCK_PD_STAGE_LowRssi = 0,
+	CCK_PD_STAGE_HighRssi = 1,
+	CCK_PD_STAGE_MAX = 3,
+}DM_CCK_PDTH_E;
+
+typedef enum tag_1R_CCA_Type_Definition
+{
+	CCA_MIN = 0,
+	CCA_1R =1,
+	CCA_2R = 2,
+	CCA_MAX = 3,
+}DM_1R_CCA_E;
+
+typedef enum tag_RF_Type_Definition
+{
+	RF_Save =0,
+	RF_Normal = 1,
+	RF_MAX = 2,
+}DM_RF_E;
+
+typedef enum tag_DIG_EXT_PORT_ALGO_Definition
+{
+	DIG_EXT_PORT_STAGE_0 = 0,
+	DIG_EXT_PORT_STAGE_1 = 1,
+	DIG_EXT_PORT_STAGE_2 = 2,
+	DIG_EXT_PORT_STAGE_3 = 3,
+	DIG_EXT_PORT_STAGE_MAX = 4,
+}DM_DIG_EXT_PORT_ALG_E;
+
+
+typedef enum tag_DIG_Connect_Definition
+{
+	DIG_STA_DISCONNECT = 0,
+	DIG_STA_CONNECT = 1,
+	DIG_STA_BEFORE_CONNECT = 2,
+	DIG_MultiSTA_DISCONNECT = 3,
+	DIG_MultiSTA_CONNECT = 4,
+	DIG_CONNECT_MAX
+}DM_DIG_CONNECT_E;
+
+
+#define		DM_DIG_THRESH_HIGH			40
+#define		DM_DIG_THRESH_LOW			35
+
+#define		DM_FALSEALARM_THRESH_LOW	400
+#define		DM_FALSEALARM_THRESH_HIGH	1000
+
+#define		DM_DIG_MAX					0x3e
+#define		DM_DIG_MIN					0x1e //0x22//0x1c
+
+#define		DM_DIG_FA_UPPER				0x32
+#define		DM_DIG_FA_LOWER				0x20
+
+//vivi 92c&92d has different definition, 20110504
+//this is for 92c
+#define		DM_DIG_FA_TH0				0x200//0x20
+#define		DM_DIG_FA_TH1				0x300//0x100
+#define		DM_DIG_FA_TH2				0x400//0x200
+//this is for 92d
+#define		DM_DIG_FA_TH0_92D			0x100
+#define		DM_DIG_FA_TH1_92D			0x150
+#define		DM_DIG_FA_TH2_92D			0x250
+
+#define		DM_DIG_BACKOFF_MAX			12
+#define		DM_DIG_BACKOFF_MIN			(-4)
+#define		DM_DIG_BACKOFF_DEFAULT		10
+
+#define		RxPathSelection_SS_TH_low		30
+#define		RxPathSelection_diff_TH			18
+
+#define		DM_RATR_STA_INIT			0
+#define		DM_RATR_STA_HIGH			1
+#define 		DM_RATR_STA_MIDDLE		2
+#define 		DM_RATR_STA_LOW			3
+
+#define		CTSToSelfTHVal					30
+#define		RegC38_TH						20
+
+#define		WAIotTHVal						25
+
+//Dynamic Tx Power Control Threshold
+#define		TX_POWER_NEAR_FIELD_THRESH_LVL2	74
+#define		TX_POWER_NEAR_FIELD_THRESH_LVL1	67
+
+#define		TxHighPwrLevel_Normal		0
+#define		TxHighPwrLevel_Level1		1
+#define		TxHighPwrLevel_Level2		2
+#define		TxHighPwrLevel_BT1			3
+#define		TxHighPwrLevel_BT2			4
+#define		TxHighPwrLevel_15			5
+#define		TxHighPwrLevel_35			6
+#define		TxHighPwrLevel_50			7
+#define		TxHighPwrLevel_70			8
+#define		TxHighPwrLevel_100			9
+
+#define		DM_Type_ByFW			0
+#define		DM_Type_ByDriver		1
+
+typedef struct _RATE_ADAPTIVE
+{
+	u8				RateAdaptiveDisabled;
+	u8				RATRState;
+	u16				reserve;
+
+	u32				HighRSSIThreshForRA;
+	u32				High2LowRSSIThreshForRA;
+	u8				Low2HighRSSIThreshForRA40M;
+	u32				LowRSSIThreshForRA40M;
+	u8				Low2HighRSSIThreshForRA20M;
+	u32				LowRSSIThreshForRA20M;
+	u32				UpperRSSIThresholdRATR;
+	u32				MiddleRSSIThresholdRATR;
+	u32				LowRSSIThresholdRATR;
+	u32				LowRSSIThresholdRATR40M;
+	u32				LowRSSIThresholdRATR20M;
+	u8				PingRSSIEnable;	//cosa add for Netcore long range ping issue
+	u32				PingRSSIRATR;	//cosa add for Netcore long range ping issue
+	u32				PingRSSIThreshForRA;//cosa add for Netcore long range ping issue
+	u32				LastRATR;
+	u8				PreRATRState;
+
+} RATE_ADAPTIVE, *PRATE_ADAPTIVE;
+
+typedef enum tag_SW_Antenna_Switch_Definition
+{
+	Antenna_B = 1,
+	Antenna_A = 2,
+	Antenna_MAX = 3,
+}DM_SWAS_E;
+
+// 20100514 Joseph: Add definition for antenna switching test after link.
+// This indicates two different the steps.
+// In SWAW_STEP_PEAK, driver needs to switch antenna and listen to the signal on the air.
+// In SWAW_STEP_DETERMINE, driver just compares the signal captured in SWAW_STEP_PEAK
+// with original RSSI to determine if it is necessary to switch antenna.
+#define SWAW_STEP_PEAK		0
+#define SWAW_STEP_DETERMINE	1
+
+#define	TP_MODE		0
+#define	RSSI_MODE		1
+#define	TRAFFIC_LOW	0
+#define	TRAFFIC_HIGH	1
+
+//=============================
+//Neil Chen---2011--06--15--
+//==============================
+//3 PathDiv
+typedef struct _SW_Antenna_Switch_
+{
+	u8		try_flag;
+	s32		PreRSSI;
+	u8		CurAntenna;
+	u8		PreAntenna;
+	u8		RSSI_Trying;
+	u8		TestMode;
+	u8		bTriggerAntennaSwitch;
+	u8		SelectAntennaMap;
+
+	// Before link Antenna Switch check
+	u8		SWAS_NoLink_State;
+	u32		SWAS_NoLink_BK_Reg860;
+}SWAT_T, *pSWAT_T;
+//========================================
+
+struct 	dm_priv
+{
+	u8	DM_Type;
+	u8	DMFlag, DMFlag_tmp;
+
+	//for DIG
+	u8	bDMInitialGainEnable;
+	//u8	binitialized; // for dm_initial_gain_Multi_STA use.
+	DIG_T	DM_DigTable;
+
+	PS_T	DM_PSTable;
+
+	FALSE_ALARM_STATISTICS	FalseAlmCnt;
+
+	//for rate adaptive, in fact,  88c/92c fw will handle this
+	u8	bUseRAMask;
+	RATE_ADAPTIVE	RateAdaptive;
+
+	//* Upper and Lower Signal threshold for Rate Adaptive*/
+	int	UndecoratedSmoothedPWDB;
+	int	EntryMinUndecoratedSmoothedPWDB;
+	int	EntryMaxUndecoratedSmoothedPWDB;
+	int	MinUndecoratedPWDBForDM;
+	int	LastMinUndecoratedPWDBForDM;
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	int	RssiValMinForAnotherMacOfDMSP;
+	u32	CurDigValueForAnotherMacOfDMSP;
+	BOOLEAN		bWriteDigForAnotherMacOfDMSP;
+	BOOLEAN		bChangeCCKPDStateForAnotherMacOfDMSP;
+	u8	CurCCKPDStateForAnotherMacOfDMSP;
+	BOOLEAN		bChangeTxHighPowerLvlForAnotherMacOfDMSP;
+	u8	CurTxHighLvlForAnotherMacOfDMSP;
+#endif
+
+	//for High Power
+	u8	bDynamicTxPowerEnable;
+	u8	LastDTPLvl;
+	u8	DynamicTxHighPowerLvl;//Add by Jacken Tx Power Control for Near/Far Range 2008/03/06
+
+	//for tx power tracking
+	u8	bTXPowerTracking;
+	u8	TXPowercount;
+	u8	bTXPowerTrackingInit;
+	u8	TxPowerTrackControl;	//for mp mode, turn off txpwrtracking as default
+	u8	TM_Trigger;
+
+	u8	ThermalMeter[2];	// ThermalMeter, index 0 for RFIC0, and 1 for RFIC1
+	u8	ThermalValue;
+	u8	ThermalValue_LCK;
+	u8	ThermalValue_IQK;
+	u8	ThermalValue_AVG[AVG_THERMAL_NUM];
+	u8	ThermalValue_AVG_index;
+	u8	ThermalValue_RxGain;
+	u8	ThermalValue_Crystal;
+	u8	Delta_IQK;
+	u8	Delta_LCK;
+	u8	bRfPiEnable;
+	u8	bReloadtxpowerindex;
+	u8	bDoneTxpower;
+
+	//for APK
+	u32	APKoutput[2][2];	//path A/B; output1_1a/output1_2a
+	u8	bAPKdone;
+	u8	bAPKThermalMeterIgnore;
+	BOOLEAN		bDPKdone[2];
+	BOOLEAN		bDPKstore;
+	BOOLEAN		bDPKworking;
+	u8	OFDM_min_index_internalPA_DPK[2];
+	u8	TxPowerLevelDPK[2];
+
+	u32	RegA24;
+
+	//for IQK
+	u32	Reg874;
+	u32	RegC08;
+	u32	Reg88C;
+	u8	Reg522;
+	u8	Reg550;
+	u8	Reg551;
+	u32	Reg870;
+	u32	ADDA_backup[IQK_ADDA_REG_NUM];
+	u32	IQK_MAC_backup[IQK_MAC_REG_NUM];
+	u32	IQK_BB_backup[IQK_BB_REG_NUM];
+
+	u8	bCCKinCH14;
+
+	char	CCK_index;
+	//u8 Record_CCK_20Mindex;
+	//u8 Record_CCK_40Mindex;
+	char	OFDM_index[2];
+
+	SWAT_T DM_SWAT_Table;
+
+	//for TxPwrTracking
+	int	RegE94;
+	int 	RegE9C;
+	int	RegEB4;
+	int	RegEBC;
+#if MP_DRIVER == 1
+	u8	RegC04_MP;
+	u32	RegD04_MP;
+#endif
+	u32	TXPowerTrackingCallbackCnt;	//cosa add for debug
+
+	u32	prv_traffic_idx; // edca turbo
+
+	u32	RegRF3C[2];	//pathA / pathB
+
+	// Add for Reading Initial Data Rate SEL Register 0x484 during watchdog. Using for fill tx desc. 2011.3.21 by Thomas
+	u8	INIDATA_RATE[32];
+
+#ifdef CONFIG_DM_ADAPTIVITY
+	/* Ported from ODM, for ESTI Adaptivity test */
+	s8 TH_L2H_ini;
+	s8 TH_EDCCA_HL_diff;
+	s8 IGI_Base;
+	u8 IGI_target;
+	bool ForceEDCCA;
+	u8 AdapEn_RSSI;
+	s8 Force_TH_H;
+	s8 Force_TH_L;
+	u8 IGI_LowerBound;
+
+	bool	bPreEdccaEnable;
+#endif
+};
+
+
+/*------------------------Export global variable----------------------------*/
+/*------------------------Export global variable----------------------------*/
+/*------------------------Export Marco Definition---------------------------*/
+//#define DM_MultiSTA_InitGainChangeNotify(Event) {DM_DigTable.CurMultiSTAConnectState = Event;}
+
+
+//============================================================
+// function prototype
+//============================================================
+void rtl8192d_init_dm_priv(IN PADAPTER Adapter);
+void rtl8192d_deinit_dm_priv(IN PADAPTER Adapter);
+void	rtl8192d_InitHalDm(IN PADAPTER Adapter);
+void	rtl8192d_HalDmWatchDog(IN PADAPTER Adapter);
+
+VOID rtl8192d_dm_CheckTXPowerTracking(IN PADAPTER Adapter);
+
+#endif	//__HAL8190PCIDM_H__
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_hal.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_hal.h
new file mode 100644
index 000000000000..347337c48c9f
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_hal.h
@@ -0,0 +1,1125 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTL8192D_HAL_H__
+#define __RTL8192D_HAL_H__
+
+#include "hal_com.h"
+#include "rtl8192d_spec.h"
+#include "Hal8192DPhyReg.h"
+#include "Hal8192DPhyCfg.h"
+#include "rtl8192d_rf.h"
+#include "rtl8192d_dm.h"
+#include "rtl8192d_recv.h"
+#include "rtl8192d_xmit.h"
+#include "rtl8192d_cmd.h"
+
+/*---------------------------Define Local Constant---------------------------*/
+/* Channel switch:The size of command tables for switch channel*/
+#define MAX_PRECMD_CNT 16
+#define MAX_RFDEPENDCMD_CNT 16
+#define MAX_POSTCMD_CNT 16
+
+#define MAX_DOZE_WAITING_TIMES_9x 64
+
+#define MAX_RF_IMR_INDEX 12
+#define MAX_RF_IMR_INDEX_NORMAL 13
+#define RF_REG_NUM_for_C_CUT_5G 	6
+#define RF_REG_NUM_for_C_CUT_5G_internalPA	7
+#define RF_REG_NUM_for_C_CUT_2G 	5
+#define RF_CHNL_NUM_5G			19
+#define RF_CHNL_NUM_5G_40M		17
+#define TARGET_CHNL_NUM_5G	221
+#define TARGET_CHNL_NUM_2G	14
+#define TARGET_CHNL_NUM_2G_5G	59
+#define CV_CURVE_CNT			64
+
+//static u32	 RF_REG_FOR_5G_SWCHNL[MAX_RF_IMR_INDEX]={0,0x2f,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x38,0x39,0x0};
+static u32	   RF_REG_FOR_5G_SWCHNL_NORMAL[MAX_RF_IMR_INDEX_NORMAL]={0,0x2f,0x30,0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x0};
+
+static u8	RF_REG_for_C_CUT_5G[RF_REG_NUM_for_C_CUT_5G] =
+			{RF_SYN_G1, RF_SYN_G2,	RF_SYN_G3,	RF_SYN_G4,	RF_SYN_G5,	RF_SYN_G6};
+
+static u8	RF_REG_for_C_CUT_5G_internalPA[RF_REG_NUM_for_C_CUT_5G_internalPA] =
+			{0x0B,	0x48,	0x49,	0x4B,	0x03,	0x04,	0x0E};
+static u8	RF_REG_for_C_CUT_2G[RF_REG_NUM_for_C_CUT_2G] =
+			{RF_SYN_G1, RF_SYN_G2,	RF_SYN_G3,	RF_SYN_G7,	RF_SYN_G8};
+
+#if DBG
+static u32	RF_REG_MASK_for_C_CUT_2G[RF_REG_NUM_for_C_CUT_2G] =
+			{BIT19|BIT18|BIT17|BIT14|BIT1,	BIT10|BIT9,
+			BIT18|BIT17|BIT16|BIT1, 	BIT2|BIT1,
+			BIT15|BIT14|BIT13|BIT12|BIT11};
+#endif	//amy, temp remove
+static u8	RF_CHNL_5G[RF_CHNL_NUM_5G] =
+			{36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140};
+static u8	RF_CHNL_5G_40M[RF_CHNL_NUM_5G_40M] =
+			{38,42,46,50,54,58,62,102,106,110,114,118,122,126,130,134,138};
+
+static u32	RF_REG_Param_for_C_CUT_5G[5][RF_REG_NUM_for_C_CUT_5G] = {
+			{0xE43BE,	0xFC638,	0x77C0A,	0xDE471,	0xd7110,	0x8EB04},
+			{0xE43BE,	0xFC078,	0xF7C1A,	0xE0C71,	0xD7550,	0xAEB04},
+			{0xE43BF,	0xFF038,	0xF7C0A,	0xDE471,	0xE5550,	0xAEB04},
+			{0xE43BF,	0xFF079,	0xF7C1A,	0xDE471,	0xE5550,	0xAEB04},
+			{0xE43BF,	0xFF038,	0xF7C1A,	0xDE471,	0xd7550,	0xAEB04}};
+
+static u32	RF_REG_Param_for_C_CUT_2G[3][RF_REG_NUM_for_C_CUT_2G] = {
+			{0x643BC,	0xFC038,	0x77C1A,	0x41289,	0x01840},
+			{0x643BC,	0xFC038,	0x07C1A,	0x41289,	0x01840},
+			{0x243BC,	0xFC438,	0x07C1A,	0x4128B,	0x0FC41}};
+
+#if SWLCK == 1
+static u32 RF_REG_SYN_G4_for_C_CUT_2G = 0xD1C31&0x7FF;
+#endif
+
+static u32	RF_REG_Param_for_C_CUT_5G_internalPA[3][RF_REG_NUM_for_C_CUT_5G_internalPA] = {
+			{0x01a00,	0x40443,	0x00eb5,	0x89bec,	0x94a12,	0x94a12,	0x94a12},
+			{0x01800,	0xc0443,	0x00730,	0x896ee,	0x94a52,	0x94a52,	0x94a52},
+			{0x01800,	0xc0443,	0x00730,	0x896ee,	0x94a12,	0x94a12,	0x94a12}};
+
+
+
+//[mode][patha+b][reg]
+static u32 RF_IMR_Param_Normal[1][3][MAX_RF_IMR_INDEX_NORMAL]={{
+	{0x70000,0x00ff0,0x4400f,0x00ff0,0x0,0x0,0x0,0x0,0x0,0x64888,0xe266c,0x00090,0x22fff},// channel 1-14.
+	{0x70000,0x22880,0x4470f,0x55880,0x00070, 0x88000, 0x0,0x88080,0x70000,0x64a82,0xe466c,0x00090,0x32c9a}, //path 36-64
+	{0x70000,0x44880,0x4477f,0x77880,0x00070, 0x88000, 0x0,0x880b0,0x0,0x64b82,0xe466c,0x00090,0x32c9a} //100 -165
+}
+};
+
+//static u32 CurveIndex_5G[TARGET_CHNL_NUM_5G]={0};
+//static u32 CurveIndex_2G[TARGET_CHNL_NUM_2G]={0};
+static u32 CurveIndex[TARGET_CHNL_NUM_2G_5G]={0};
+
+static u32 TargetChnl_5G[TARGET_CHNL_NUM_5G] = {
+25141,	25116,	25091,	25066,	25041,
+25016,	24991,	24966,	24941,	24917,
+24892,	24867,	24843,	24818,	24794,
+24770,	24765,	24721,	24697,	24672,
+24648,	24624,	24600,	24576,	24552,
+24528,	24504,	24480,	24457,	24433,
+24409,	24385,	24362,	24338,	24315,
+24291,	24268,	24245,	24221,	24198,
+24175,	24151,	24128,	24105,	24082,
+24059,	24036,	24013,	23990,	23967,
+23945,	23922,	23899,	23876,	23854,
+23831,	23809,	23786,	23764,	23741,
+23719,	23697,	23674,	23652,	23630,
+23608,	23586,	23564,	23541,	23519,
+23498,	23476,	23454,	23432,	23410,
+23388,	23367,	23345,	23323,	23302,
+23280,	23259,	23237,	23216,	23194,
+23173,	23152,	23130,	23109,	23088,
+23067,	23046,	23025,	23003,	22982,
+22962,	22941,	22920,	22899,	22878,
+22857,	22837,	22816,	22795,	22775,
+22754,	22733,	22713,	22692,	22672,
+22652,	22631,	22611,	22591,	22570,
+22550,	22530,	22510,	22490,	22469,
+22449,	22429,	22409,	22390,	22370,
+22350,	22336,	22310,	22290,	22271,
+22251,	22231,	22212,	22192,	22173,
+22153,	22134,	22114,	22095,	22075,
+22056,	22037,	22017,	21998,	21979,
+21960,	21941,	21921,	21902,	21883,
+21864,	21845,	21826,	21807,	21789,
+21770,	21751,	21732,	21713,	21695,
+21676,	21657,	21639,	21620,	21602,
+21583,	21565,	21546,	21528,	21509,
+21491,	21473,	21454,	21436,	21418,
+21400,	21381,	21363,	21345,	21327,
+21309,	21291,	21273,	21255,	21237,
+21219,	21201,	21183,	21166,	21148,
+21130,	21112,	21095,	21077,	21059,
+21042,	21024,	21007,	20989,	20972,
+25679,	25653,	25627,	25601,	25575,
+25549,	25523,	25497,	25471,	25446,
+25420,	25394,	25369,	25343,	25318,
+25292,	25267,	25242,	25216,	25191,
+25166	};
+
+static u32 TargetChnl_2G[TARGET_CHNL_NUM_2G] = {	// channel 1~14
+26084, 26030, 25976, 25923, 25869, 25816, 25764,
+25711, 25658, 25606, 25554, 25502, 25451, 25328
+};
+
+
+#ifdef CONFIG_PCI_HCI
+	#include <pci_ops.h>
+	#include "Hal8192DEHWImg.h"
+
+	#define RTL819X_DEFAULT_RF_TYPE			RF_2T2R
+
+//---------------------------------------------------------------------
+//		RTL8192DE From file
+//---------------------------------------------------------------------
+	#define RTL8192D_FW_IMG 					"rtl8192DE\\rtl8192dfw.bin"
+
+	#define RTL8192D_PHY_REG					"rtl8192DE\\PHY_REG.txt"
+	#define RTL8192D_PHY_REG_PG				"rtl8192DE\\PHY_REG_PG.txt"
+	#define RTL8192D_PHY_REG_MP				"rtl8192DE\\PHY_REG_MP.txt"
+
+	#define RTL8192D_AGC_TAB					"rtl8192DE\\AGC_TAB.txt"
+	#define RTL8192D_AGC_TAB_2G				"rtl8192DE\\AGC_TAB_2G.txt"
+	#define RTL8192D_AGC_TAB_5G				"rtl8192DE\\AGC_TAB_5G.txt"
+	#define RTL8192D_PHY_RADIO_A				"rtl8192DE\\radio_a.txt"
+	#define RTL8192D_PHY_RADIO_B				"rtl8192DE\\radio_b.txt"
+	#define RTL8192D_PHY_RADIO_A_intPA		"rtl8192DE\\radio_a_intPA.txt"
+	#define RTL8192D_PHY_RADIO_B_intPA		"rtl8192DE\\radio_b_intPA.txt"
+	#define RTL8192D_PHY_MACREG				"rtl8192DE\\MAC_REG.txt"
+
+//---------------------------------------------------------------------
+//		RTL8192DE From header
+//---------------------------------------------------------------------
+
+	// Fw Array
+	#define Rtl8192D_FwImageArray 				Rtl8192DEFwImgArray
+
+	// MAC/BB/PHY Array
+	#define Rtl8192D_MAC_Array					Rtl8192DEMAC_2T_Array
+	#define Rtl8192D_AGCTAB_Array				Rtl8192DEAGCTAB_Array
+	#define Rtl8192D_AGCTAB_5GArray			Rtl8192DEAGCTAB_5GArray
+	#define Rtl8192D_AGCTAB_2GArray			Rtl8192DEAGCTAB_2GArray
+	#define Rtl8192D_AGCTAB_2TArray 			Rtl8192DEAGCTAB_2TArray
+	#define Rtl8192D_AGCTAB_1TArray 			Rtl8192DEAGCTAB_1TArray
+	#define Rtl8192D_PHY_REG_2TArray			Rtl8192DEPHY_REG_2TArray
+	#define Rtl8192D_PHY_REG_1TArray			Rtl8192DEPHY_REG_1TArray
+	#define Rtl8192D_PHY_REG_Array_PG			Rtl8192DEPHY_REG_Array_PG
+	#define Rtl8192D_PHY_REG_Array_MP			Rtl8192DEPHY_REG_Array_MP
+	#define Rtl8192D_RadioA_2TArray				Rtl8192DERadioA_2TArray
+	#define Rtl8192D_RadioA_1TArray				Rtl8192DERadioA_1TArray
+	#define Rtl8192D_RadioB_2TArray				Rtl8192DERadioB_2TArray
+	#define Rtl8192D_RadioB_1TArray				Rtl8192DERadioB_1TArray
+	#define Rtl8192D_RadioA_2T_intPAArray		Rtl8192DERadioA_2T_intPAArray
+	#define Rtl8192D_RadioB_2T_intPAArray 		Rtl8192DERadioB_2T_intPAArray
+
+	// Array length
+	#define Rtl8192D_FwImageArrayLength				Rtl8192DEImgArrayLength
+	#define Rtl8192D_MAC_ArrayLength				Rtl8192DEMAC_2T_ArrayLength
+	#define Rtl8192D_AGCTAB_5GArrayLength			Rtl8192DEAGCTAB_5GArrayLength
+	#define Rtl8192D_AGCTAB_2GArrayLength			Rtl8192DEAGCTAB_2GArrayLength
+	#define Rtl8192D_AGCTAB_2TArrayLength			Rtl8192DEAGCTAB_2TArrayLength
+	#define Rtl8192D_AGCTAB_1TArrayLength			Rtl8192DEAGCTAB_1TArrayLength
+	#define Rtl8192D_AGCTAB_ArrayLength 			Rtl8192DEAGCTAB_ArrayLength
+	#define Rtl8192D_PHY_REG_2TArrayLength			Rtl8192DEPHY_REG_2TArrayLength
+	#define Rtl8192D_PHY_REG_1TArrayLength			Rtl8192DEPHY_REG_1TArrayLength
+	#define Rtl8192D_PHY_REG_Array_PGLength		Rtl8192DEPHY_REG_Array_PGLength
+	#define Rtl8192D_PHY_REG_Array_MPLength		Rtl8192DEPHY_REG_Array_MPLength
+	#define Rtl8192D_RadioA_2TArrayLength			Rtl8192DERadioA_2TArrayLength
+	#define Rtl8192D_RadioB_2TArrayLength			Rtl8192DERadioB_2TArrayLength
+	#define Rtl8192D_RadioA_2T_intPAArrayLength		Rtl8192DERadioA_2T_intPAArrayLength
+	#define Rtl8192D_RadioB_2T_intPAArrayLength		Rtl8192DERadioB_2T_intPAArrayLength
+
+#elif defined(CONFIG_USB_HCI)
+
+	#include "Hal8192DUHWImg.h"
+#ifdef CONFIG_WOWLAN
+	#include "Hal8192DUHWImg_wowlan.h"
+#endif //CONFIG_WOWLAN
+	#define RTL819X_DEFAULT_RF_TYPE		RF_1T2R
+
+//---------------------------------------------------------------------
+//		RTL8192DU From file
+//---------------------------------------------------------------------
+	#define RTL8192D_FW_IMG					"rtl8192DU\\rtl8192dfw.bin"
+
+	#define RTL8192D_PHY_REG					"rtl8192DU\\PHY_REG.txt"
+	#define RTL8192D_PHY_REG_PG				"rtl8192DU\\PHY_REG_PG.txt"
+	#define RTL8192D_PHY_REG_MP				"rtl8192DU\\PHY_REG_MP.txt"
+
+	#define RTL8192D_AGC_TAB					"rtl8192DU\\AGC_TAB.txt"
+	#define RTL8192D_AGC_TAB_2G				"rtl8192DU\\AGC_TAB_2G.txt"
+	#define RTL8192D_AGC_TAB_5G				"rtl8192DU\\AGC_TAB_5G.txt"
+	#define RTL8192D_PHY_RADIO_A				"rtl8192DU\\radio_a.txt"
+	#define RTL8192D_PHY_RADIO_B				"rtl8192DU\\radio_b.txt"
+	#define RTL8192D_PHY_RADIO_A_intPA		"rtl8192DU\\radio_a_intPA.txt"
+	#define RTL8192D_PHY_RADIO_B_intPA		"rtl8192DU\\radio_b_intPA.txt"
+	#define RTL8192D_PHY_MACREG				"rtl8192DU\\MAC_REG.txt"
+
+//---------------------------------------------------------------------
+//		RTL8192DU From header
+//---------------------------------------------------------------------
+
+	// Fw Array
+	#define Rtl8192D_FwImageArray 					Rtl8192DUFwImgArray
+#ifdef CONFIG_WOWLAN
+	#define Rtl8192D_FwWWImageArray				Rtl8192DUFwWWImgArray
+#endif //CONFIG_WOWLAN
+	// MAC/BB/PHY Array
+	#define Rtl8192D_MAC_Array						Rtl8192DUMAC_2T_Array
+	#define Rtl8192D_AGCTAB_Array					Rtl8192DUAGCTAB_Array
+	#define Rtl8192D_AGCTAB_5GArray				Rtl8192DUAGCTAB_5GArray
+	#define Rtl8192D_AGCTAB_2GArray				Rtl8192DUAGCTAB_2GArray
+	#define Rtl8192D_AGCTAB_2TArray 				Rtl8192DUAGCTAB_2TArray
+	#define Rtl8192D_AGCTAB_1TArray 				Rtl8192DUAGCTAB_1TArray
+	#define Rtl8192D_PHY_REG_2TArray				Rtl8192DUPHY_REG_2TArray
+	#define Rtl8192D_PHY_REG_1TArray				Rtl8192DUPHY_REG_1TArray
+	#define Rtl8192D_PHY_REG_Array_PG				Rtl8192DUPHY_REG_Array_PG
+	#define Rtl8192D_PHY_REG_Array_MP				Rtl8192DUPHY_REG_Array_MP
+	#define Rtl8192D_RadioA_2TArray					Rtl8192DURadioA_2TArray
+	#define Rtl8192D_RadioA_1TArray					Rtl8192DURadioA_1TArray
+	#define Rtl8192D_RadioB_2TArray					Rtl8192DURadioB_2TArray
+	#define Rtl8192D_RadioB_1TArray					Rtl8192DURadioB_1TArray
+	#define Rtl8192D_RadioA_2T_intPAArray			Rtl8192DURadioA_2T_intPAArray
+	#define Rtl8192D_RadioB_2T_intPAArray 			Rtl8192DURadioB_2T_intPAArray
+
+	// Array length
+	#define Rtl8192D_FwImageArrayLength			Rtl8192DUImgArrayLength
+	#define Rtl8192D_MAC_ArrayLength				Rtl8192DUMAC_2T_ArrayLength
+	#define Rtl8192D_AGCTAB_5GArrayLength			Rtl8192DUAGCTAB_5GArrayLength
+	#define Rtl8192D_AGCTAB_2GArrayLength			Rtl8192DUAGCTAB_2GArrayLength
+	#define Rtl8192D_AGCTAB_2TArrayLength			Rtl8192DUAGCTAB_2TArrayLength
+	#define Rtl8192D_AGCTAB_1TArrayLength			Rtl8192DUAGCTAB_1TArrayLength
+	#define Rtl8192D_AGCTAB_ArrayLength 			Rtl8192DUAGCTAB_ArrayLength
+	#define Rtl8192D_PHY_REG_2TArrayLength			Rtl8192DUPHY_REG_2TArrayLength
+	#define Rtl8192D_PHY_REG_1TArrayLength			Rtl8192DUPHY_REG_1TArrayLength
+	#define Rtl8192D_PHY_REG_Array_PGLength		Rtl8192DUPHY_REG_Array_PGLength
+	#define Rtl8192D_PHY_REG_Array_MPLength		Rtl8192DUPHY_REG_Array_MPLength
+	#define Rtl8192D_RadioA_2TArrayLength			Rtl8192DURadioA_2TArrayLength
+	#define Rtl8192D_RadioB_2TArrayLength			Rtl8192DURadioB_2TArrayLength
+	#define Rtl8192D_RadioA_2T_intPAArrayLength		Rtl8192DURadioA_2T_intPAArrayLength
+	#define Rtl8192D_RadioB_2T_intPAArrayLength		Rtl8192DURadioB_2T_intPAArrayLength
+
+	// The file name "_2T" is for 92CU, "_1T"  is for 88CU. Modified by tynli. 2009.11.24.
+/*	#define Rtl819XFwImageArray					Rtl8192DUFwImgArray
+	#define Rtl819XMAC_Array					Rtl8192DUMAC_2TArray
+	#define Rtl819XAGCTAB_Array					Rtl8192DUAGCTAB_Array
+	#define Rtl819XAGCTAB_5GArray				Rtl8192DUAGCTAB_5GArray
+	#define Rtl819XAGCTAB_2GArray				Rtl8192DUAGCTAB_2GArray
+	#define Rtl819XPHY_REG_2TArray				Rtl8192DUPHY_REG_2TArray
+	#define Rtl819XPHY_REG_1TArray				Rtl8192DUPHY_REG_1TArray
+	#define Rtl819XRadioA_2TArray				Rtl8192DURadioA_2TArray
+	#define Rtl819XRadioA_1TArray				Rtl8192DURadioA_1TArray
+	#define Rtl819XRadioA_2T_intPAArray 			Rtl8192DURadioA_2T_intPAArray
+	#define Rtl819XRadioB_2TArray				Rtl8192DURadioB_2TArray
+	#define Rtl819XRadioB_1TArray				Rtl8192DURadioB_1TArray
+	#define Rtl819XRadioB_2T_intPAArray 			Rtl8192DURadioB_2T_intPAArray
+	#define Rtl819XPHY_REG_Array_PG 			Rtl8192DUPHY_REG_Array_PG
+	#define Rtl819XPHY_REG_Array_MP 			Rtl8192DUPHY_REG_Array_MP
+
+	#define Rtl819XAGCTAB_2TArray				Rtl8192DUAGCTAB_2TArray
+	#define Rtl819XAGCTAB_1TArray				Rtl8192DUAGCTAB_1TArray*/
+
+#endif
+
+#define DRVINFO_SZ	4 // unit is 8bytes
+#define PageNum_128(_Len)		(u32)(((_Len)>>7) + ((_Len)&0x7F ? 1:0))
+
+//
+// Check if FW header exists. We do not consider the lower 4 bits in this case.
+// By tynli. 2009.12.04.
+//
+#define IS_FW_HEADER_EXIST(_pFwHdr)	((le16_to_cpu(_pFwHdr->Signature)&0xFFF0) == 0x92C0 ||\
+									(le16_to_cpu(_pFwHdr->Signature)&0xFFF0) == 0x88C0 ||\
+									(le16_to_cpu(_pFwHdr->Signature)&0xFFFF) == 0x92D0 ||\
+									(le16_to_cpu(_pFwHdr->Signature)&0xFFFF) == 0x92D1 ||\
+									(le16_to_cpu(_pFwHdr->Signature)&0xFFFF) == 0x92D2 ||\
+									(le16_to_cpu(_pFwHdr->Signature)&0xFFFF) == 0x92D3 )
+
+#define FW_8192D_SIZE				0x8020 // Max FW len = 32k + 32(FW header length).
+#define FW_8192D_START_ADDRESS	0x1000
+#define FW_8192D_END_ADDRESS		0x1FFF
+
+#define MAX_PAGE_SIZE				4096	// @ page : 4k bytes
+
+typedef enum _FIRMWARE_SOURCE{
+	FW_SOURCE_IMG_FILE = 0,
+	FW_SOURCE_HEADER_FILE = 1,		//from header file
+}FIRMWARE_SOURCE, *PFIRMWARE_SOURCE;
+
+typedef struct _RT_FIRMWARE{
+	FIRMWARE_SOURCE	eFWSource;
+	u8*			szFwBuffer;
+	u32			ulFwLength;
+#ifdef CONFIG_WOWLAN
+	u8*			szWoWLANFwBuffer;
+	u32			ulWoWLANFwLength;
+#endif //CONFIG_WOWLAN
+}RT_FIRMWARE, *PRT_FIRMWARE, RT_FIRMWARE_92D, *PRT_FIRMWARE_92D;
+
+//
+// This structure must be cared byte-ordering
+//
+// Added by tynli. 2009.12.04.
+typedef struct _RT_8192D_FIRMWARE_HDR {//8-byte alinment required
+
+	//--- LONG WORD 0 ----
+	u16		Signature;	// 92C0: test chip; 92C, 88C0: test chip; 88C1: MP A-cut; 92C1: MP A-cut
+	u8		Category;	// AP/NIC and USB/PCI
+	u8		Function;	// Reserved for different FW function indcation, for further use when driver needs to download different FW in different conditions
+	u16		Version;		// FW Version
+	u8		Subversion;	// FW Subversion, default 0x00
+	u8		Rsvd1;
+
+
+	//--- LONG WORD 1 ----
+	u8		Month;	// Release time Month field
+	u8		Date;	// Release time Date field
+	u8		Hour;	// Release time Hour field
+	u8		Minute;	// Release time Minute field
+	u16		RamCodeSize;	// The size of RAM code
+	u16		Rsvd2;
+
+	//--- LONG WORD 2 ----
+	u32		SvnIdx;	// The SVN entry index
+	u32		Rsvd3;
+
+	//--- LONG WORD 3 ----
+	u32		Rsvd4;
+	u32		Rsvd5;
+
+}RT_8192D_FIRMWARE_HDR, *PRT_8192D_FIRMWARE_HDR;
+
+#define DRIVER_EARLY_INT_TIME		0x05
+#define BCN_DMA_ATIME_INT_TIME		0x02
+
+typedef	enum _BT_CoType{
+	BT_2Wire			= 0,
+	BT_ISSC_3Wire	= 1,
+	BT_Accel			= 2,
+	BT_CSR			= 3,
+	BT_CSR_ENHAN	= 4,
+	BT_RTL8756		= 5,
+} BT_CoType, *PBT_CoType;
+
+typedef	enum _BT_CurState{
+	BT_OFF		= 0,
+	BT_ON		= 1,
+} BT_CurState, *PBT_CurState;
+
+typedef	enum _BT_ServiceType{
+	BT_SCO			= 0,
+	BT_A2DP			= 1,
+	BT_HID			= 2,
+	BT_HID_Idle		= 3,
+	BT_Scan			= 4,
+	BT_Idle			= 5,
+	BT_OtherAction	= 6,
+	BT_Busy			= 7,
+	BT_OtherBusy		= 8,
+} BT_ServiceType, *PBT_ServiceType;
+
+typedef	enum _BT_RadioShared{
+	BT_Radio_Shared 	= 0,
+	BT_Radio_Individual	= 1,
+} BT_RadioShared, *PBT_RadioShared;
+
+typedef struct _BT_COEXIST_STR{
+	u8					BluetoothCoexist;
+	u8					BT_Ant_Num;
+	u8					BT_CoexistType;
+	u8					BT_State;
+	u8					BT_CUR_State;		//0:on, 1:off
+	u8					BT_Ant_isolation;	//0:good, 1:bad
+	u8					BT_PapeCtrl;		//0:SW, 1:SW/HW dynamic
+	u8					BT_Service;
+	u8					BT_RadioSharedType;
+	u8					Ratio_Tx;
+	u8					Ratio_PRI;
+}BT_COEXIST_STR, *PBT_COEXIST_STR;
+
+//Added for 92D IQK setting.
+typedef struct _IQK_MATRIX_REGS_SETTING{
+	BOOLEAN 	bIQKDone;
+#if 1
+	int		Value[1][IQK_Matrix_REG_NUM];
+#else
+	u32		Mark[IQK_Matrix_REG_NUM];
+	u32		Value[IQK_Matrix_REG_NUM];
+#endif
+}IQK_MATRIX_REGS_SETTING,*PIQK_MATRIX_REGS_SETTING;
+
+#ifdef CONFIG_USB_RX_AGGREGATION
+
+typedef enum _USB_RX_AGG_MODE{
+	USB_RX_AGG_DISABLE,
+	USB_RX_AGG_DMA,
+	USB_RX_AGG_USB,
+	USB_RX_AGG_DMA_USB
+}USB_RX_AGG_MODE;
+
+#define MAX_RX_DMA_BUFFER_SIZE	10240		// 10K for 8192C RX DMA buffer
+
+#endif
+
+
+#define TX_SELE_HQ			BIT(0)		// High Queue
+#define TX_SELE_LQ			BIT(1)		// Low Queue
+#define TX_SELE_NQ			BIT(2)		// Normal Queue
+
+
+// Note: We will divide number of page equally for each queue other than public queue!
+
+#define TX_TOTAL_PAGE_NUMBER		0xF8
+#define TX_PAGE_BOUNDARY			(TX_TOTAL_PAGE_NUMBER + 1)
+
+// For Normal Chip Setting
+// (HPQ + LPQ + NPQ + PUBQ) shall be TX_TOTAL_PAGE_NUMBER
+#define NORMAL_PAGE_NUM_PUBQ		0x56
+
+
+// For Test Chip Setting
+// (HPQ + LPQ + PUBQ) shall be TX_TOTAL_PAGE_NUMBER
+#define TEST_PAGE_NUM_PUBQ_92DU			0x89
+#define TX_TOTAL_PAGE_NUMBER_92D_DUAL_MAC		0x7A
+#define NORMAL_PAGE_NUM_PUBQ_92D_DUAL_MAC			0x5A
+#define NORMAL_PAGE_NUM_HPQ_92D_DUAL_MAC			0x10
+#define NORMAL_PAGE_NUM_LPQ_92D_DUAL_MAC			0x10
+#define NORMAL_PAGE_NUM_NORMALQ_92D_DUAL_MAC		0
+
+#define TX_PAGE_BOUNDARY_DUAL_MAC			(TX_TOTAL_PAGE_NUMBER_92D_DUAL_MAC + 1)
+
+// For Test Chip Setting
+#define WMM_TEST_TX_TOTAL_PAGE_NUMBER	0xF5
+#define WMM_TEST_TX_PAGE_BOUNDARY	(WMM_TEST_TX_TOTAL_PAGE_NUMBER + 1) //F6
+
+#define WMM_TEST_PAGE_NUM_PUBQ		0xA3
+#define WMM_TEST_PAGE_NUM_HPQ		0x29
+#define WMM_TEST_PAGE_NUM_LPQ		0x29
+
+
+//Note: For Normal Chip Setting ,modify later
+#define WMM_NORMAL_TX_TOTAL_PAGE_NUMBER	0xF5
+#define WMM_NORMAL_TX_PAGE_BOUNDARY	(WMM_TEST_TX_TOTAL_PAGE_NUMBER + 1) //F6
+
+#define WMM_NORMAL_PAGE_NUM_PUBQ_92D		0X65//0x82
+#define WMM_NORMAL_PAGE_NUM_HPQ_92D		0X30//0x29
+#define WMM_NORMAL_PAGE_NUM_LPQ_92D		0X30
+#define WMM_NORMAL_PAGE_NUM_NPQ_92D		0X30
+
+#define WMM_NORMAL_PAGE_NUM_PUBQ_92D_DUAL_MAC		0X32
+#define WMM_NORMAL_PAGE_NUM_HPQ_92D_DUAL_MAC		0X18
+#define WMM_NORMAL_PAGE_NUM_LPQ_92D_DUAL_MAC		0X18
+#define WMM_NORMAL_PAGE_NUM_NPQ_92D_DUAL_MAC		0X18
+
+//-------------------------------------------------------------------------
+//	Chip specific
+//-------------------------------------------------------------------------
+
+#define CHIP_BONDING_IDENTIFIER(_value)	(((_value)>>22)&0x3)
+#define CHIP_BONDING_92C_1T2R	0x1
+#define CHIP_BONDING_88C_USB_MCARD	0x2
+#define CHIP_BONDING_88C_USB_HP	0x1
+
+//
+// 2011.01.06. Define new structure of chip version for RTL8723 and so on. Added by tynli.
+//
+/*
+     | BIT15:12           |  BIT11:8        | BIT 7              |  BIT6:4  |      BIT3          | BIT2:0  |
+     |-------------+-----------+-----------+-------+-----------+-------|
+     | IC version(CUT)  | ROM version  | Manufacturer  | RF type  |  Chip type       | IC Type |
+     |                           |                      | TSMC/UMC    |              | TEST/NORMAL|             |
+*/
+// [15:12] IC version(CUT): A-cut=0, B-cut=1, C-cut=2, D-cut=3
+// [7] Manufacturer: TSMC=0, UMC=1
+// [6:4] RF type: 1T1R=0, 1T2R=1, 2T2R=2
+// [3] Chip type: TEST=0, NORMAL=1
+// [2:0] IC type: 81xxC=0, 8723=1, 92D=2
+
+#define CHIP_8723						BIT(0)
+#define CHIP_92D						BIT(1)
+#define NORMAL_CHIP  					BIT(3)
+#define RF_TYPE_1T1R					(~(BIT(4)|BIT(5)|BIT(6)))
+#define RF_TYPE_1T2R					BIT(4)
+#define RF_TYPE_2T2R					BIT(5)
+#define CHIP_VENDOR_UMC				BIT(7)
+#define B_CUT_VERSION					BIT(12)
+#define C_CUT_VERSION					BIT(13)
+#define D_CUT_VERSION					((BIT(12)|BIT(13)))
+#define E_CUT_VERSION					BIT(14)
+
+
+// MASK
+#define IC_TYPE_MASK					(BIT(0)|BIT(1)|BIT(2))
+#define CHIP_TYPE_MASK 				BIT(3)
+#define RF_TYPE_MASK					(BIT(4)|BIT(5)|BIT(6))
+#define MANUFACTUER_MASK			BIT(7)
+#define ROM_VERSION_MASK				(BIT(11)|BIT(10)|BIT(9)|BIT(8))
+#define CUT_VERSION_MASK				(BIT(15)|BIT(14)|BIT(13)|BIT(12))
+
+// Get element
+#define GET_CVID_IC_TYPE(version)			((version) & IC_TYPE_MASK)
+#define GET_CVID_CHIP_TYPE(version)			((version) & CHIP_TYPE_MASK)
+#define GET_CVID_RF_TYPE(version)			((version) & RF_TYPE_MASK)
+#define GET_CVID_MANUFACTUER(version)		((version) & MANUFACTUER_MASK)
+#define GET_CVID_ROM_VERSION(version)		((version) & ROM_VERSION_MASK)
+#define GET_CVID_CUT_VERSION(version)		((version) & CUT_VERSION_MASK)
+
+#define IS_81XXC(version)					((GET_CVID_IC_TYPE(version) == 0)? _TRUE : _FALSE)
+#define IS_8723_SERIES(version)				((GET_CVID_IC_TYPE(version) == CHIP_8723)? _TRUE : _FALSE)
+#define IS_92D(version)						((GET_CVID_IC_TYPE(version) == CHIP_92D)? _TRUE : _FALSE)
+#define IS_1T1R(version)						((GET_CVID_RF_TYPE(version))? _FALSE : _TRUE)
+#define IS_1T2R(version)						((GET_CVID_RF_TYPE(version) == RF_TYPE_1T2R)? _TRUE : _FALSE)
+#define IS_2T2R(version)						((GET_CVID_RF_TYPE(version) == RF_TYPE_2T2R)? _TRUE : _FALSE)
+#define IS_CHIP_VENDOR_UMC(version)			((GET_CVID_MANUFACTUER(version))? _TRUE: _FALSE)
+
+#define IS_92C_SERIAL(version)   				((IS_81XXC(version) && IS_2T2R(version)) ? _TRUE : _FALSE)
+#define IS_VENDOR_UMC_A_CUT(version)		((IS_CHIP_VENDOR_UMC(version)) ? ((GET_CVID_CUT_VERSION(version)) ? _FALSE : _TRUE) : _FALSE)
+#define IS_VENDOR_8723_A_CUT(version)		((IS_8723_SERIES(version)) ? ((GET_CVID_CUT_VERSION(version)) ? _FALSE : _TRUE) : _FALSE)
+// <tynli_Note> 88/92C UMC B-cut vendor is set to TSMC so we need to check CHIP_VENDOR_UMC bit is not 1.
+#define IS_81xxC_VENDOR_UMC_B_CUT(version)	((IS_CHIP_VENDOR_UMC(version)) ? ((GET_CVID_CUT_VERSION(version) == B_CUT_VERSION) ? _TRUE : _FALSE):_FALSE)
+#define IS_92D_SINGLEPHY(version)     			((IS_92D(version)) ? (IS_2T2R(version) ? _TRUE: _FALSE) : _FALSE)
+
+#define IS_92D_C_CUT(version)    			((IS_92D(version)) ? ((GET_CVID_CUT_VERSION(version) == C_CUT_VERSION) ? _TRUE : _FALSE) : _FALSE)
+#define IS_92D_D_CUT(version)    			((IS_92D(version)) ? ((GET_CVID_CUT_VERSION(version) == D_CUT_VERSION) ? _TRUE : _FALSE) : _FALSE)
+#define IS_92D_E_CUT(version)    			((IS_92D(version)) ? ((GET_CVID_CUT_VERSION(version) == E_CUT_VERSION) ? _TRUE : _FALSE) : _FALSE)
+#define IS_NORMAL_CHIP92D(version)		((GET_CVID_CHIP_TYPE(version))? _TRUE: _FALSE)
+
+typedef enum _VERSION_8192D{
+	VERSION_TEST_CHIP_88C = 0x0000,
+	VERSION_TEST_CHIP_92C = 0x0020,
+	VERSION_TEST_UMC_CHIP_8723 = 0x0081,
+	VERSION_NORMAL_TSMC_CHIP_88C = 0x0008,
+	VERSION_NORMAL_TSMC_CHIP_92C = 0x0028,
+	VERSION_NORMAL_TSMC_CHIP_92C_1T2R = 0x0018,
+	VERSION_NORMAL_UMC_CHIP_88C_A_CUT = 0x0088,
+	VERSION_NORMAL_UMC_CHIP_92C_A_CUT = 0x00a8,
+	VERSION_NORMAL_UMC_CHIP_92C_1T2R_A_CUT = 0x0098,
+	VERSION_NORMAL_UMC_CHIP_8723_1T1R_A_CUT = 0x0089,
+	VERSION_NORMAL_UMC_CHIP_8723_1T1R_B_CUT = 0x1089,
+	VERSION_NORMAL_UMC_CHIP_88C_B_CUT = 0x1088,
+	VERSION_NORMAL_UMC_CHIP_92C_B_CUT = 0x10a8,
+	VERSION_NORMAL_UMC_CHIP_92C_1T2R_B_CUT = 0x1090,
+	VERSION_TEST_CHIP_92D_SINGLEPHY= 0x0022,
+	VERSION_TEST_CHIP_92D_DUALPHY = 0x0002,
+	VERSION_NORMAL_CHIP_92D_SINGLEPHY= 0x002a,
+	VERSION_NORMAL_CHIP_92D_DUALPHY = 0x000a,
+	VERSION_NORMAL_CHIP_92D_C_CUT_SINGLEPHY = 0x202a,
+	VERSION_NORMAL_CHIP_92D_C_CUT_DUALPHY = 0x200a,
+	VERSION_NORMAL_CHIP_92D_D_CUT_SINGLEPHY = 0x302a,
+	VERSION_NORMAL_CHIP_92D_D_CUT_DUALPHY = 0x300a,
+	VERSION_NORMAL_CHIP_92D_E_CUT_SINGLEPHY = 0x402a,
+	VERSION_NORMAL_CHIP_92D_E_CUT_DUALPHY = 0x400a,
+}VERSION_8192D,*PVERSION_8192D;
+
+
+//-------------------------------------------------------------------------
+//	Channel Plan
+//-------------------------------------------------------------------------
+enum ChannelPlan{
+	CHPL_FCC	= 0,
+	CHPL_IC		= 1,
+	CHPL_ETSI	= 2,
+	CHPL_SPAIN	= 3,
+	CHPL_FRANCE	= 4,
+	CHPL_MKK	= 5,
+	CHPL_MKK1	= 6,
+	CHPL_ISRAEL	= 7,
+	CHPL_TELEC	= 8,
+	CHPL_GLOBAL	= 9,
+	CHPL_WORLD	= 10,
+};
+
+typedef struct _TxPowerInfo{
+	u8 CCKIndex[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 HT40_1SIndex[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 HT40_2SIndexDiff[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	s8 HT20IndexDiff[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 OFDMIndexDiff[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 HT40MaxOffset[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 HT20MaxOffset[RF_PATH_MAX][CHANNEL_GROUP_MAX];
+	u8 TSSI_A[3];
+	u8 TSSI_B[3];
+	u8 TSSI_A_5G[3];		//5GL/5GM/5GH
+	u8 TSSI_B_5G[3];
+}TxPowerInfo, *PTxPowerInfo;
+
+#define EFUSE_REAL_CONTENT_LEN	1024
+#define EFUSE_MAP_LEN				256
+#define EFUSE_MAX_SECTION			32
+#define EFUSE_MAX_SECTION_BASE	16
+// <Roger_Notes> To prevent out of boundary programming case, leave 1byte and program full section
+// 9bytes + 1byt + 5bytes and pre 1byte.
+// For worst case:
+// | 2byte|----8bytes----|1byte|--7bytes--| //92D
+#define EFUSE_OOB_PROTECT_BYTES 	18 // PG data exclude header, dummy 7 bytes frome CP test and reserved 1byte.
+
+typedef enum _PA_MODE {
+	PA_MODE_EXTERNAL = 0x00,
+	PA_MODE_INTERNAL_SP3T = 0x01,
+	PA_MODE_INTERNAL_SPDT = 0x02
+} PA_MODE;
+
+/* Copy from rtl8192c */
+enum c2h_id_8192d {
+	C2H_DBG = 0,
+	C2H_TSF = 1,
+	C2H_AP_RPT_RSP = 2,
+	C2H_CCX_TX_RPT = 3,
+	C2H_BT_RSSI = 4,
+	C2H_BT_OP_MODE = 5,
+	C2H_EXT_RA_RPT = 6,
+	C2H_HW_INFO_EXCH = 10,
+	C2H_C2H_H2C_TEST = 11,
+	C2H_BT_INFO = 12,
+	C2H_BT_MP_INFO = 15,
+	MAX_C2HEVENT
+};
+
+#ifdef CONFIG_PCI_HCI
+struct hal_data_8192de
+{
+	VERSION_8192D	VersionID;
+
+	// add for 92D Phy mode/mac/Band mode
+	MACPHY_MODE_8192D	MacPhyMode92D;
+	BAND_TYPE	CurrentBandType92D;	//0:2.4G, 1:5G
+	BAND_TYPE	BandSet92D;
+	BOOLEAN		bIsVS;
+	BOOLEAN		bSupportRemoteWakeUp;
+	u8	AutoLoadStatusFor8192D;
+
+	BOOLEAN		bNOPG;
+
+	BOOLEAN       bMasterOfDMSP;
+	BOOLEAN       bSlaveOfDMSP;
+
+	u16	CustomerID;
+
+	u16	FirmwareVersion;
+	u16	FirmwareVersionRev;
+	u16	FirmwareSubVersion;
+
+	u32	IntrMask[2];
+	u32	IntrMaskToSet[2];
+
+	u32	DisabledFunctions;
+
+	//current WIFI_PHY values
+	u32	ReceiveConfig;
+	u32	TransmitConfig;
+	WIRELESS_MODE	CurrentWirelessMode;
+	HT_CHANNEL_WIDTH	CurrentChannelBW;
+	u8	CurrentChannel;
+	u8	nCur40MhzPrimeSC;// Control channel sub-carrier
+	u16	BasicRateSet;
+
+	//rf_ctrl
+	u8	rf_chip;
+	u8	rf_type;
+	u8	NumTotalRFPath;
+
+	//
+	// EEPROM setting.
+	//
+	u16	EEPROMVID;
+	u16	EEPROMDID;
+	u16	EEPROMSVID;
+	u16	EEPROMSMID;
+	u16	EEPROMChannelPlan;
+	u16	EEPROMVersion;
+
+	u8	EEPROMCustomerID;
+	u8	EEPROMBoardType;
+	u8	EEPROMRegulatory;
+
+	u8	EEPROMThermalMeter;
+
+	u8	EEPROMC9;
+	u8	EEPROMCC;
+	u8	PAMode;
+
+	u8	TxPwrLevelCck[RF_PATH_MAX][CHANNEL_MAX_NUMBER_2G];
+	u8	TxPwrLevelHT40_1S[RF_PATH_MAX][CHANNEL_MAX_NUMBER];	// For HT 40MHZ pwr
+	u8	TxPwrLevelHT40_2S[RF_PATH_MAX][CHANNEL_MAX_NUMBER];	// For HT 40MHZ pwr
+	s8	TxPwrHt20Diff[RF_PATH_MAX][CHANNEL_MAX_NUMBER];// HT 20<->40 Pwr diff
+	u8	TxPwrLegacyHtDiff[RF_PATH_MAX][CHANNEL_MAX_NUMBER];// For HT<->legacy pwr diff
+	// For power group
+	u8	PwrGroupHT20[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+	u8	PwrGroupHT40[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+
+	u8	LegacyHTTxPowerDiff;// Legacy to HT rate power diff
+
+	u8	CrystalCap;	// CrystalCap.
+
+#ifdef CONFIG_BT_COEXIST
+	struct btcoexist_priv	bt_coexist;
+#endif
+
+	// Read/write are allow for following hardware information variables
+	u8	framesync;
+	u32	framesyncC34;
+	u8	framesyncMonitor;
+	u8	DefaultInitialGain[4];
+	u8	pwrGroupCnt;
+	u32	MCSTxPowerLevelOriginalOffset[MAX_PG_GROUP][16];
+	u32	CCKTxPowerLevelOriginalOffset;
+
+	u32	AntennaTxPath;					// Antenna path Tx
+	u32	AntennaRxPath;					// Antenna path Rx
+	u8	BluetoothCoexist;
+	u8	ExternalPA;
+	u8	InternalPA5G[2];	//pathA / pathB
+
+	//u32	LedControlNum;
+	//u32	LedControlMode;
+	//u32	TxPowerTrackControl;
+	u8	b1x1RecvCombine;	// for 1T1R receive combining
+
+	u8	bCurrentTurboEDCA;
+	u32	AcParam_BE; //Original parameter for BE, use for EDCA turbo.
+
+	//vivi, for tx power tracking, 20080407
+	//u16	TSSI_13dBm;
+	//u32	Pwr_Track;
+	// The current Tx Power Level
+	u8	CurrentCckTxPwrIdx;
+	u8	CurrentOfdm24GTxPwrIdx;
+
+	BB_REGISTER_DEFINITION_T	PHYRegDef[4];	//Radio A/B/C/D
+
+	BOOLEAN		bRFPathRxEnable[4];	// We support 4 RF path now.
+
+	u32	RfRegChnlVal[2];
+
+	u8	bCckHighPower;
+
+	BOOLEAN		bPhyValueInitReady;
+
+	BOOLEAN		bTXPowerDataReadFromEEPORM;
+
+	BOOLEAN		bInSetPower;
+
+	//RDG enable
+	BOOLEAN		bRDGEnable;
+
+	BOOLEAN		bLoadIMRandIQKSettingFor2G;// True if IMR or IQK  have done  for 2.4G in scan progress
+	BOOLEAN		bNeedIQK;
+
+	BOOLEAN		bLCKInProgress;
+
+	BOOLEAN		bEarlyModeEnable;
+
+#if 1
+	IQK_MATRIX_REGS_SETTING IQKMatrixRegSetting[IQK_Matrix_Settings_NUM];
+#else
+	//regc80��regc94��regc4c��regc88��regc9c��regc14��regca0��regc1c��regc78
+	u4Byte				IQKMatrixReg[IQK_Matrix_REG_NUM];
+	IQK_MATRIX_REGS_SETTING			   IQKMatrixRegSetting[IQK_Matrix_Settings_NUM];	// 1->2G,24->5G 20M channel,21->5G 40M channel.
+#endif
+
+	//for host message to fw
+	u8	LastHMEBoxNum;
+
+	u8	fw_ractrl;
+	// Beacon function related global variable.
+	u32	RegBcnCtrlVal;
+	u8	RegTxPause;
+	u8	RegFwHwTxQCtrl;
+	u8	RegReg542;
+	u8	RegCR_1;
+
+	struct dm_priv	dmpriv;
+
+	u8	bInterruptMigration;
+
+	u8	FwRsvdPageStartOffset; //2010.06.23. Added by tynli. Reserve page start offset except beacon in TxQ.
+
+	// Add for dual MAC  0--Mac0 1--Mac1
+	u32	interfaceIndex;
+
+	u16	RegRRSR;
+
+	u16	EfuseUsedBytes;
+	u8	RTSInitRate;	 // 2010.11.24.by tynli.
+#ifdef CONFIG_P2P
+	struct P2P_PS_Offload_t	p2p_ps_offload;
+#endif //CONFIG_P2P
+};
+
+typedef struct hal_data_8192de HAL_DATA_TYPE, *PHAL_DATA_TYPE;
+
+//
+// Function disabled.
+//
+#define DF_TX_BIT		BIT0
+#define DF_RX_BIT		BIT1
+#define DF_IO_BIT		BIT2
+#define DF_IO_D3_BIT			BIT3
+
+#define RT_DF_TYPE		u32
+#define RT_DISABLE_FUNC(__pAdapter, __FuncBits) ((__pAdapter)->DisabledFunctions |= ((RT_DF_TYPE)(__FuncBits)))
+#define RT_ENABLE_FUNC(__pAdapter, __FuncBits) ((__pAdapter)->DisabledFunctions &= (~((RT_DF_TYPE)(__FuncBits))))
+#define RT_IS_FUNC_DISABLED(__pAdapter, __FuncBits) ( (__pAdapter)->DisabledFunctions & (__FuncBits) )
+
+void InterruptRecognized8192DE(PADAPTER Adapter, PRT_ISR_CONTENT pIsrContent);
+VOID UpdateInterruptMask8192DE(PADAPTER Adapter, u32 AddMSR, u32 RemoveMSR);
+#endif
+
+#ifdef CONFIG_USB_HCI
+
+//should be renamed and moved to another file
+typedef	enum _INTERFACE_SELECT_8192DUSB{
+	INTF_SEL0_USB 			= 0,		// USB
+	INTF_SEL1_MINICARD	= 1,		// Minicard
+	INTF_SEL2_EKB_PRO		= 2,		// Eee keyboard proprietary
+	INTF_SEL3_PRO			= 3,		// Customized proprietary
+} INTERFACE_SELECT_8192DUSB, *PINTERFACE_SELECT_8192DUSB;
+
+typedef INTERFACE_SELECT_8192DUSB INTERFACE_SELECT_USB;
+
+struct hal_data_8192du
+{
+	VERSION_8192D	VersionID;
+
+	// add for 92D Phy mode/mac/Band mode
+	MACPHY_MODE_8192D	MacPhyMode92D;
+	BAND_TYPE	CurrentBandType92D;	//0:2.4G, 1:5G
+	BAND_TYPE	BandSet92D;
+	BOOLEAN		bIsVS;
+
+	BOOLEAN		bNOPG;
+
+	BOOLEAN		bSupportRemoteWakeUp;
+	BOOLEAN		bMasterOfDMSP;
+	BOOLEAN		bSlaveOfDMSP;
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	BOOLEAN		bInModeSwitchProcess;
+#endif
+
+	u16	CustomerID;
+
+	u16	FirmwareVersion;
+	u16	FirmwareVersionRev;
+	u16	FirmwareSubVersion;
+
+	//current WIFI_PHY values
+	u32	ReceiveConfig;
+	WIRELESS_MODE	CurrentWirelessMode;
+	HT_CHANNEL_WIDTH	CurrentChannelBW;
+	u8	CurrentChannel;
+	u8	nCur40MhzPrimeSC;// Control channel sub-carrier
+	u16	BasicRateSet;
+
+	INTERFACE_SELECT_8192DUSB	InterfaceSel;
+
+	//rf_ctrl
+	u8	rf_chip;
+	u8	rf_type;
+	u8	NumTotalRFPath;
+
+	//
+	// EEPROM setting.
+	//
+	u8	EEPROMVersion;
+	u16	EEPROMVID;
+	u16	EEPROMPID;
+	u16	EEPROMSVID;
+	u16	EEPROMSDID;
+	u8	EEPROMCustomerID;
+	u8	EEPROMSubCustomerID;
+	u8	EEPROMRegulatory;
+
+	u8	EEPROMThermalMeter;
+
+	u8	EEPROMC9;
+	u8	EEPROMCC;
+	u8	PAMode;
+
+	u8	TxPwrLevelCck[RF_PATH_MAX][CHANNEL_MAX_NUMBER_2G];
+	u8	TxPwrLevelHT40_1S[RF_PATH_MAX][CHANNEL_MAX_NUMBER];	// For HT 40MHZ pwr
+	u8	TxPwrLevelHT40_2S[RF_PATH_MAX][CHANNEL_MAX_NUMBER];	// For HT 40MHZ pwr
+	s8	TxPwrHt20Diff[RF_PATH_MAX][CHANNEL_MAX_NUMBER];// HT 20<->40 Pwr diff
+	u8	TxPwrLegacyHtDiff[RF_PATH_MAX][CHANNEL_MAX_NUMBER];// For HT<->legacy pwr diff
+	// For power group
+	u8	PwrGroupHT20[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+	u8	PwrGroupHT40[RF_PATH_MAX][CHANNEL_MAX_NUMBER];
+
+	u8	LegacyHTTxPowerDiff;// Legacy to HT rate power diff
+
+	u8	CrystalCap;	// CrystalCap.
+
+#ifdef CONFIG_BT_COEXIST
+	struct btcoexist_priv	bt_coexist;
+#endif
+
+	// Read/write are allow for following hardware information variables
+	u8	framesync;
+	u32	framesyncC34;
+	u8	framesyncMonitor;
+	u8	DefaultInitialGain[4];
+	u8	pwrGroupCnt;
+	u32	MCSTxPowerLevelOriginalOffset[MAX_PG_GROUP][16];
+	u32	CCKTxPowerLevelOriginalOffset;
+
+	u32	AntennaTxPath;					// Antenna path Tx
+	u32	AntennaRxPath;					// Antenna path Rx
+	u8	BluetoothCoexist;
+	u8	ExternalPA;
+	u8	InternalPA5G[2];	//pathA / pathB
+
+	//u32	LedControlNum;
+	//u32	LedControlMode;
+	//u32	TxPowerTrackControl;
+	u8	b1x1RecvCombine;	// for 1T1R receive combining
+
+	u8	bCurrentTurboEDCA;
+	u32	AcParam_BE; //Original parameter for BE, use for EDCA turbo.
+
+	//vivi, for tx power tracking, 20080407
+	//u16	TSSI_13dBm;
+	//u32	Pwr_Track;
+	// The current Tx Power Level
+	u8	CurrentCckTxPwrIdx;
+	u8	CurrentOfdm24GTxPwrIdx;
+
+	BB_REGISTER_DEFINITION_T	PHYRegDef[4];	//Radio A/B/C/D
+
+	BOOLEAN		bRFPathRxEnable[4];	// We support 4 RF path now.
+
+	u32	RfRegChnlVal[2];
+
+	u8	bCckHighPower;
+
+	BOOLEAN		bPhyValueInitReady;
+
+	BOOLEAN		bTXPowerDataReadFromEEPORM;
+
+	BOOLEAN		bInSetPower;
+
+	//RDG enable
+	BOOLEAN		bRDGEnable;
+
+	BOOLEAN		bLoadIMRandIQKSettingFor2G;// True if IMR or IQK  have done  for 2.4G in scan progress
+	BOOLEAN		bNeedIQK;
+
+	BOOLEAN		bLCKInProgress;
+
+	BOOLEAN		bEarlyModeEnable;
+
+#if 1
+	IQK_MATRIX_REGS_SETTING IQKMatrixRegSetting[IQK_Matrix_Settings_NUM];
+#else
+	//regc80��regc94��regc4c��regc88��regc9c��regc14��regca0��regc1c��regc78
+	u4Byte				IQKMatrixReg[IQK_Matrix_REG_NUM];
+	IQK_MATRIX_REGS_SETTING			   IQKMatrixRegSetting[IQK_Matrix_Settings_NUM];	// 1->2G,24->5G 20M channel,21->5G 40M channel.
+#endif
+
+	//for host message to fw
+	u8	LastHMEBoxNum;
+
+	u8	fw_ractrl;
+	// Beacon function related global variable.
+	u32	RegBcnCtrlVal;
+	u8	RegTxPause;
+	u8	RegFwHwTxQCtrl;
+	u8	RegReg542;
+	u8	RegCR_1;
+
+	struct dm_priv	dmpriv;
+
+	u8	FwRsvdPageStartOffset; //2010.06.23. Added by tynli. Reserve page start offset except beacon in TxQ.
+
+	//Query RF by FW
+	BOOLEAN		bReadRFbyFW;
+
+	// For 92C USB endpoint setting
+	//
+
+	u32	UsbBulkOutSize;
+
+	int	RtBulkOutPipe[3];
+	int	RtBulkInPipe;
+	int	RtIntInPipe;
+
+	// Add for dual MAC  0--Mac0 1--Mac1
+	u32	interfaceIndex;
+
+	u8	OutEpQueueSel;
+	u8	OutEpNumber;
+
+	u8	Queue2EPNum[8];//for out endpoint number mapping
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+	u8	UsbTxAggMode;
+	u8	UsbTxAggDescNum;
+#endif
+#ifdef CONFIG_USB_RX_AGGREGATION
+	u16	HwRxPageSize;				// Hardware setting
+	u32	MaxUsbRxAggBlock;
+
+	USB_RX_AGG_MODE	UsbRxAggMode;
+	u8	UsbRxAggBlockCount;			// USB Block count. Block size is 512-byte in hight speed and 64-byte in full speed
+	u8	UsbRxAggBlockTimeout;
+	u8	UsbRxAggPageCount;			// 8192C DMA page count
+	u8	UsbRxAggPageTimeout;
+#endif
+
+	u16	RegRRSR;
+
+	u16	EfuseUsedBytes;
+	u8	RTSInitRate;	 // 2010.11.24.by tynli.
+#ifdef CONFIG_P2P
+	struct P2P_PS_Offload_t	p2p_ps_offload;
+#endif //CONFIG_P2P
+};
+
+typedef struct hal_data_8192du HAL_DATA_TYPE, *PHAL_DATA_TYPE;
+#endif
+
+#define GET_HAL_DATA(__pAdapter)	((HAL_DATA_TYPE *)((__pAdapter)->HalData))
+#define GET_RF_TYPE(priv)	(GET_HAL_DATA(priv)->rf_type)
+
+int FirmwareDownload92D(IN	PADAPTER Adapter,IN	BOOLEAN  bUsedWoWLANFw);
+VOID rtl8192d_FirmwareSelfReset(IN PADAPTER Adapter);
+void rtl8192d_ReadChipVersion(IN PADAPTER Adapter);
+VOID rtl8192d_EfuseParseChnlPlan(PADAPTER Adapter, u8 *hwinfo, BOOLEAN AutoLoadFail);
+VOID rtl8192d_ReadTxPowerInfo(PADAPTER Adapter, u8* PROMContent, BOOLEAN AutoLoadFail);
+VOID rtl8192d_ResetDualMacSwitchVariables(IN PADAPTER Adapter);
+u8 GetEEPROMSize8192D(PADAPTER Adapter);
+BOOLEAN PHY_CheckPowerOffFor8192D(PADAPTER Adapter);
+VOID PHY_SetPowerOnFor8192D(PADAPTER Adapter);
+//void PHY_ConfigMacPhyMode92D(PADAPTER Adapter);
+void rtl8192d_free_hal_data(_adapter * padapter);
+void rtl8192d_set_hal_ops(struct hal_ops *pHalFunc);
+
+#endif
+
+#ifdef CONFIG_MP_INCLUDED
+
+
+extern void Hal_SetAntenna(PADAPTER pAdapter);
+extern void Hal_SetBandwidth(PADAPTER pAdapter);
+
+extern void Hal_SetTxPower(PADAPTER pAdapter);
+extern void Hal_SetCarrierSuppressionTx(PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetSingleToneTx ( PADAPTER pAdapter , u8 bStart );
+extern void Hal_SetSingleCarrierTx (PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetContinuousTx (PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetBandwidth(PADAPTER pAdapter);
+
+extern void Hal_SetDataRate(PADAPTER pAdapter);
+extern void Hal_SetChannel(PADAPTER pAdapter);
+extern void Hal_SetAntennaPathPower(PADAPTER pAdapter);
+extern s32 Hal_SetThermalMeter(PADAPTER pAdapter, u8 target_ther);
+extern s32 Hal_SetPowerTracking(PADAPTER padapter, u8 enable);
+extern void Hal_GetPowerTracking(PADAPTER padapter, u8 * enable);
+extern void Hal_GetThermalMeter(PADAPTER pAdapter, u8 *value);
+extern void Hal_mpt_SwitchRfSetting(PADAPTER pAdapter);
+extern void Hal_MPT_CCKTxPowerAdjust(PADAPTER Adapter, BOOLEAN bInCH14);
+extern void Hal_MPT_CCKTxPowerAdjustbyIndex(PADAPTER pAdapter, BOOLEAN beven);
+extern void Hal_SetCCKTxPower(PADAPTER pAdapter, u8 * TxPower);
+extern void Hal_SetOFDMTxPower(PADAPTER pAdapter, u8 * TxPower);
+extern void Hal_TriggerRFThermalMeter(PADAPTER pAdapter);
+extern u8 Hal_ReadRFThermalMeter(PADAPTER pAdapter);
+extern void Hal_SetCCKContinuousTx(PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetOFDMContinuousTx(PADAPTER pAdapter, u8 bStart);
+
+
+#endif //end CONFIG_MP_INCLUDED
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_led.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_led.h
new file mode 100644
index 000000000000..b1f7a946fb0b
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_led.h
@@ -0,0 +1,42 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTL8192D_LED_H_
+#define __RTL8192D_LED_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+//================================================================================
+// Interface to manipulate LED objects.
+//================================================================================
+#ifdef CONFIG_USB_HCI
+void rtl8192du_InitSwLeds(_adapter *padapter);
+void rtl8192du_DeInitSwLeds(_adapter *padapter);
+#endif
+
+#ifdef CONFIG_PCI_HCI
+void rtl8192de_gen_RefreshLedState(PADAPTER Adapter);
+void rtl8192de_InitSwLeds(_adapter *padapter);
+void rtl8192de_DeInitSwLeds(_adapter *padapter);
+#endif
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_recv.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_recv.h
new file mode 100644
index 000000000000..e03347a02bfe
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_recv.h
@@ -0,0 +1,186 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTL8192D_RECV_H_
+#define _RTL8192D_RECV_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+#ifdef PLATFORM_OS_XP
+	#ifdef CONFIG_SDIO_HCI
+		#define NR_RECVBUFF 1024//512//128
+	#else
+		#define NR_RECVBUFF (16)
+	#endif
+#elif defined(PLATFORM_OS_CE)
+	#ifdef CONFIG_SDIO_HCI
+		#define NR_RECVBUFF (128)
+	#else
+		#define NR_RECVBUFF (4)
+	#endif
+#else
+#ifdef CONFIG_SINGLE_RECV_BUF
+	#define NR_RECVBUFF (1)
+#else
+	#define NR_RECVBUFF (4)
+#endif //CONFIG_SINGLE_RECV_BUF
+	#define NR_PREALLOC_RECV_SKB (8)
+#endif
+
+
+
+#define RECV_BLK_SZ 512
+#define RECV_BLK_CNT 16
+#define RECV_BLK_TH RECV_BLK_CNT
+
+#if defined(CONFIG_USB_HCI)
+
+#ifdef PLATFORM_OS_CE
+#define MAX_RECVBUF_SZ (8192+1024) // 8K+1k
+#else
+	#ifndef CONFIG_MINIMAL_MEMORY_USAGE
+		//#define MAX_RECVBUF_SZ (32768) // 32k
+		//#define MAX_RECVBUF_SZ (16384) //16K
+		//#define MAX_RECVBUF_SZ (10240) //10K
+		#ifdef CONFIG_PLATFORM_MSTAR
+			#define MAX_RECVBUF_SZ (8192) // 8K
+		#else
+			#define MAX_RECVBUF_SZ (15360) // 15k < 16k
+		#endif
+	#else
+		#define MAX_RECVBUF_SZ (4000) // about 4K
+	#endif
+#endif
+
+#elif defined(CONFIG_PCI_HCI)
+//#ifndef CONFIG_MINIMAL_MEMORY_USAGE
+//	#define MAX_RECVBUF_SZ (9100)
+//#else
+	#define MAX_RECVBUF_SZ (4000) // about 4K
+//#endif
+
+#define RX_MPDU_QUEUE				0
+#define RX_CMD_QUEUE				1
+#define RX_MAX_QUEUE				2
+#endif
+
+#define RECV_BULK_IN_ADDR		0x80
+#define RECV_INT_IN_ADDR		0x81
+
+#define PHY_RSSI_SLID_WIN_MAX				100
+#define PHY_LINKQUALITY_SLID_WIN_MAX		20
+
+struct phy_stat
+{
+	unsigned int phydw0;
+
+	unsigned int phydw1;
+
+	unsigned int phydw2;
+
+	unsigned int phydw3;
+
+	unsigned int phydw4;
+
+	unsigned int phydw5;
+
+	unsigned int phydw6;
+
+	unsigned int phydw7;
+};
+
+typedef struct _Phy_OFDM_Rx_Status_Report_8192cd
+{
+	unsigned char	trsw_gain_X[4];
+	unsigned char	pwdb_all;
+	unsigned char	cfosho_X[4];
+	unsigned char	cfotail_X[4];
+	unsigned char	rxevm_X[2];
+	unsigned char	rxsnr_X[4];
+	unsigned char	pdsnr_X[2];
+	unsigned char	csi_current_X[2];
+	unsigned char	csi_target_X[2];
+	unsigned char	sigevm;
+	unsigned char	max_ex_pwr;
+//#ifdef RTL8192SE
+#ifdef CONFIG_LITTLE_ENDIAN
+	unsigned char ex_intf_flg:1;
+	unsigned char sgi_en:1;
+	unsigned char rxsc:2;
+	//unsigned char rsvd:4;
+	unsigned char idle_long:1;
+	unsigned char r_ant_train_en:1;
+	unsigned char ANTSELB:1;
+	unsigned char ANTSEL:1;
+#else	// _BIG_ENDIAN_
+	//unsigned char rsvd:4;
+	unsigned char ANTSEL:1;
+	unsigned char ANTSELB:1;
+	unsigned char r_ant_train_en:1;
+	unsigned char idle_long:1;
+	unsigned char rxsc:2;
+	unsigned char sgi_en:1;
+	unsigned char ex_intf_flg:1;
+#endif
+//#else	// RTL8190, RTL8192E
+//	unsigned char	sgi_en;
+//	unsigned char	rxsc_sgien_exflg;
+//#endif
+}__attribute__ ((packed)) PHY_STS_OFDM_8192CD_T,PHY_RX_DRIVER_INFO_8192CD;
+
+typedef struct _Phy_CCK_Rx_Status_Report_8192cd
+{
+	/* For CCK rate descriptor. This is a signed 8:1 variable. LSB bit presend
+		0.5. And MSB 7 bts presend a signed value. Range from -64~+63.5. */
+	u8	adc_pwdb_X[4];
+	u8	SQ_rpt;
+	u8	cck_agc_rpt;
+} PHY_STS_CCK_8192CD_T;
+
+// Rx smooth factor
+#define	Rx_Smooth_Factor (20)
+
+#ifdef CONFIG_USB_HCI
+typedef struct _INTERRUPT_MSG_FORMAT_EX{
+	unsigned int C2H_MSG0;
+	unsigned int C2H_MSG1;
+	unsigned int C2H_MSG2;
+	unsigned int C2H_MSG3;
+	unsigned int HISR; // from HISR Reg0x124, read to clear
+	unsigned int HISRE;// from HISRE Reg0x12c, read to clear
+	unsigned int  MSG_EX;
+}INTERRUPT_MSG_FORMAT_EX,*PINTERRUPT_MSG_FORMAT_EX;
+
+void rtl8192du_init_recvbuf(_adapter *padapter, struct recv_buf *precvbuf);
+int	rtl8192du_init_recv_priv(_adapter * padapter);
+void	rtl8192du_free_recv_priv(_adapter * padapter);
+#endif
+
+#ifdef CONFIG_PCI_HCI
+int	rtl8192de_init_recv_priv(_adapter * padapter);
+void rtl8192de_free_recv_priv(_adapter * padapter);
+#endif
+
+void rtl8192d_translate_rx_signal_stuff(union recv_frame *precvframe, struct phy_stat *pphy_info);
+void rtl8192d_query_rx_desc_status(union recv_frame *precvframe, struct recv_stat *pdesc);
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_rf.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_rf.h
new file mode 100644
index 000000000000..1aba22938e6f
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_rf.h
@@ -0,0 +1,96 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/******************************************************************************
+ *
+ *
+ * Module:	rtl8192d_rf.h	( Header File)
+ *
+ * Note:	Collect every HAL RF type exter API or constant.
+ *
+ * Function:
+ *
+ * Export:
+ *
+ * Abbrev:
+ *
+ * History:
+ * Data			Who		Remark
+ *
+ * 09/25/2008	MHC		Create initial version.
+ *
+ *
+******************************************************************************/
+#ifndef _RTL8192D_RF_H_
+#define _RTL8192D_RF_H_
+/* Check to see if the file has been included already.  */
+
+
+/*--------------------------Define Parameters-------------------------------*/
+
+//
+// For RF 6052 Series
+//
+#define		RF6052_MAX_TX_PWR			0x3F
+#define		RF6052_MAX_REG				0x3F
+#define		RF6052_MAX_PATH				2
+/*--------------------------Define Parameters-------------------------------*/
+
+
+/*------------------------------Define structure----------------------------*/
+
+/*------------------------------Define structure----------------------------*/
+
+
+/*------------------------Export global variable----------------------------*/
+/*------------------------Export global variable----------------------------*/
+
+/*------------------------Export Marco Definition---------------------------*/
+
+/*------------------------Export Marco Definition---------------------------*/
+
+
+/*--------------------------Exported Function prototype---------------------*/
+
+//
+// RF RL6052 Series API
+//
+void		rtl8192d_RF_ChangeTxPath(	IN	PADAPTER	Adapter,
+										IN	u16		DataRate);
+void		rtl8192d_PHY_RF6052SetBandwidth(
+										IN	PADAPTER				Adapter,
+										IN	HT_CHANNEL_WIDTH		Bandwidth);
+VOID	rtl8192d_PHY_RF6052SetCckTxPower(
+										IN	PADAPTER	Adapter,
+										IN	u8*		pPowerlevel);
+VOID	rtl8192d_PHY_RF6052SetOFDMTxPower(
+										IN	PADAPTER	Adapter,
+										IN	u8*		pPowerLevel,
+										IN	u8		Channel);
+int	PHY_RF6052_Config8192D(	IN	PADAPTER		Adapter	);
+
+BOOLEAN	rtl8192d_PHY_EnableAnotherPHY(IN	PADAPTER Adapter, IN	BOOLEAN	 bMac0);
+
+void	rtl8192d_PHY_PowerDownAnotherPHY(IN PADAPTER Adapter, IN BOOLEAN bMac0);
+
+
+/*--------------------------Exported Function prototype---------------------*/
+
+
+#endif/* End of HalRf.h */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_spec.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_spec.h
new file mode 100644
index 000000000000..d2d3e894fb20
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_spec.h
@@ -0,0 +1,1840 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#ifndef __RTL8192D_SPEC_H__
+#define __RTL8192D_SPEC_H__
+
+#include <drv_conf.h>
+
+#ifndef BIT
+#define BIT(x)		(1 << (x))
+#endif
+
+#define BIT0		0x00000001
+#define BIT1		0x00000002
+#define BIT2		0x00000004
+#define BIT3		0x00000008
+#define BIT4		0x00000010
+#define BIT5		0x00000020
+#define BIT6		0x00000040
+#define BIT7		0x00000080
+#define BIT8		0x00000100
+#define BIT9		0x00000200
+#define BIT10	0x00000400
+#define BIT11	0x00000800
+#define BIT12	0x00001000
+#define BIT13	0x00002000
+#define BIT14	0x00004000
+#define BIT15	0x00008000
+#define BIT16	0x00010000
+#define BIT17	0x00020000
+#define BIT18	0x00040000
+#define BIT19	0x00080000
+#define BIT20	0x00100000
+#define BIT21	0x00200000
+#define BIT22	0x00400000
+#define BIT23	0x00800000
+#define BIT24	0x01000000
+#define BIT25	0x02000000
+#define BIT26	0x04000000
+#define BIT27	0x08000000
+#define BIT28	0x10000000
+#define BIT29	0x20000000
+#define BIT30	0x40000000
+#define BIT31	0x80000000
+
+
+//============================================================
+//       8192D Regsiter offset definition
+//============================================================
+
+
+//============================================================
+//
+//============================================================
+
+//-----------------------------------------------------
+//
+//	0x0000h ~ 0x00FFh	System Configuration
+//
+//-----------------------------------------------------
+#define REG_SYS_ISO_CTRL			0x0000
+#define REG_SYS_FUNC_EN			0x0002
+#define REG_APS_FSMCO				0x0004
+#define REG_SYS_CLKR				0x0008
+#define REG_9346CR					0x000A
+#define REG_EE_VPD					0x000C
+#define REG_AFE_MISC				0x0010
+#define REG_SPS0_CTRL				0x0011
+#define REG_POWER_OFF_IN_PROCESS 0x0017
+#define REG_SPS_OCP_CFG			0x0018
+#define REG_RSV_CTRL				0x001C
+#define REG_RF_CTRL					0x001F
+#define REG_LDOA15_CTRL			0x0020
+#define REG_LDOV12D_CTRL			0x0021
+#define REG_LDOHCI12_CTRL			0x0022
+#define REG_LPLDO_CTRL				0x0023
+#define REG_AFE_XTAL_CTRL			0x0024
+#define REG_AFE_PLL_CTRL			0x0028
+#define REG_MAC_PHY_CTRL			0x002c //for 92d, DMDP,SMSP,DMSP contrl
+#define REG_EFUSE_CTRL				0x0030
+#define REG_EFUSE_TEST				0x0034
+#define REG_PWR_DATA				0x0038
+#define REG_CAL_TIMER				0x003C
+#define REG_ACLK_MON				0x003E
+#define REG_GPIO_MUXCFG			0x0040
+//#define REG_GPIO_MUXCFG				0x0041
+#define REG_GPIO_IO_SEL				0x0042
+#define REG_MAC_PINMUX_CFG		0x0043
+#define REG_GPIO_PIN_CTRL			0x0044
+#define REG_GPIO_INTM				0x0048
+#define REG_LEDCFG0					0x004C
+#define REG_LEDCFG1					0x004D
+#define REG_LEDCFG2					0x004E
+#define REG_LEDCFG3					0x004F
+#define REG_FSIMR					0x0050
+#define REG_FSISR					0x0054
+
+#define REG_MCUFWDL				0x0080
+#ifdef CONFIG_WOWLAN
+#define REG_WOWLAN_REASON			0x00FC
+#endif // CONFIG_WOWLAN
+#define REG_HMEBOX_EXT_0			0x0088
+#define REG_HMEBOX_EXT_1			0x008A
+#define REG_HMEBOX_EXT_2			0x008C
+#define REG_HMEBOX_EXT_3			0x008E
+
+#define REG_BIST_SCAN				0x00D0
+#define REG_BIST_RPT				0x00D4
+#define REG_BIST_ROM_RPT			0x00D8
+#define REG_USB_SIE_INTF			0x00E0
+#define REG_PCIE_MIO_INTF			0x00E4
+#define REG_PCIE_MIO_INTD			0x00E8
+#define REG_HPON_FSM				0x00EC
+#define REG_SYS_CFG					0x00F0
+#define REG_MAC_PHY_CTRL_NORMAL	0x00f8
+
+#define  REG_MAC0                                	0x0081
+#define  REG_MAC1                                	0x0053
+#define  FW_MAC0_ready                      	0x18
+#define  FW_MAC1_ready                      	0x1A
+#define  MAC0_ON                                  	BIT7
+#define  MAC1_ON                                  	BIT0
+#define  mac0_ready                             	BIT0
+#define  mac1_ready                             	BIT0
+
+
+//-----------------------------------------------------
+//
+//	0x0100h ~ 0x01FFh	MACTOP General Configuration
+//
+//-----------------------------------------------------
+#define REG_CR						0x0100
+#define REG_PBP						0x0104
+#define REG_TRXDMA_CTRL			0x010C
+#define REG_TRXFF_BNDY				0x0114
+#define REG_TRXFF_STATUS			0x0118
+#define REG_RXFF_PTR				0x011C
+#define REG_HIMR					0x0120
+#define REG_HISR					0x0124
+#define REG_HIMRE					0x0128
+#define REG_HISRE					0x012C
+#define REG_CPWM					0x012F
+#define REG_FWIMR					0x0130
+#define REG_FWISR					0x0134
+#define REG_FTIMR					0x0138
+#define REG_PKTBUF_DBG_CTRL		0x0140
+#define REG_PKTBUF_DBG_DATA_L		0x0144
+#define REG_PKTBUF_DBG_DATA_H	0x0148
+
+#define REG_TC0_CTRL				0x0150
+#define REG_TC1_CTRL				0x0154
+#define REG_TC2_CTRL				0x0158
+#define REG_TC3_CTRL				0x015C
+#define REG_TC4_CTRL				0x0160
+#define REG_TCUNIT_BASE			0x0164
+#define REG_MBIST_START			0x0174
+#define REG_MBIST_DONE				0x0178
+#define REG_MBIST_FAIL				0x017C
+#define REG_C2HEVT_MSG_NORMAL	0x01A0
+#define REG_C2HEVT_CLEAR			0x01AF
+#define REG_C2HEVT_MSG_TEST		0x01B8
+#define REG_MCUTST_1				0x01c0
+#define REG_FMETHR					0x01C8
+#define REG_HMETFR					0x01CC
+#define REG_HMEBOX_0				0x01D0
+#define REG_HMEBOX_1				0x01D4
+#define REG_HMEBOX_2				0x01D8
+#define REG_HMEBOX_3				0x01DC
+
+#define REG_LLT_INIT				0x01E0
+#define REG_BB_ACCEESS_CTRL		0x01E8
+#define REG_BB_ACCESS_DATA		0x01EC
+
+
+//-----------------------------------------------------
+//
+//	0x0200h ~ 0x027Fh	TXDMA Configuration
+//
+//-----------------------------------------------------
+#define REG_RQPN					0x0200
+#define REG_FIFOPAGE				0x0204
+#define REG_TDECTRL					0x0208
+#define REG_TXDMA_OFFSET_CHK		0x020C
+#define REG_TXDMA_STATUS			0x0210
+#define REG_RQPN_NPQ				0x0214
+
+//-----------------------------------------------------
+//
+//	0x0280h ~ 0x02FFh	RXDMA Configuration
+//
+//-----------------------------------------------------
+#define REG_RXDMA_AGG_PG_TH		0x0280
+#define REG_RXPKT_NUM				0x0284
+#define REG_RXDMA_STATUS			0x0288
+
+
+//-----------------------------------------------------
+//
+//	0x0300h ~ 0x03FFh	PCIe
+//
+//-----------------------------------------------------
+#define	REG_PCIE_CTRL_REG			0x0300
+#define	REG_INT_MIG				0x0304	// Interrupt Migration
+#define	REG_BCNQ_DESA				0x0308	// TX Beacon Descriptor Address
+#define	REG_HQ_DESA				0x0310	// TX High Queue Descriptor Address
+#define	REG_MGQ_DESA				0x0318	// TX Manage Queue Descriptor Address
+#define	REG_VOQ_DESA				0x0320	// TX VO Queue Descriptor Address
+#define	REG_VIQ_DESA				0x0328	// TX VI Queue Descriptor Address
+#define	REG_BEQ_DESA				0x0330	// TX BE Queue Descriptor Address
+#define	REG_BKQ_DESA				0x0338	// TX BK Queue Descriptor Address
+#define	REG_RX_DESA				0x0340	// RX Queue	Descriptor Address
+#define	REG_DBI					0x0348	// Backdoor REG for Access Configuration
+//sherry added for DBI Read/Write  20091126
+#define	REG_DBI_WDATA				0x0348	// Backdoor REG for Access Configuration
+#define  	REG_DBI_RDATA				0x034C //Backdoor REG for Access Configuration
+#define	REG_DBI_CTRL				0x0350  //Backdoor REG for Access Configuration
+#define	REG_DBI_FLAG				0x0352 //Backdoor REG for Access Configuration#define	REG_MDIO					0x0354	// MDIO for Access PCIE PHY
+#define	REG_MDIO					0x0354	// MDIO for Access PCIE PHY
+#define	REG_DBG_SEL				0x0360	// Debug Selection Register
+#define	REG_PCIE_HRPWM			0x0361	//PCIe RPWM
+#define	REG_PCIE_HCPWM			0x0363	//PCIe CPWM
+#define	REG_UART_CTRL				0x0364	// UART	Control
+#define	REG_UART_TX_DESA			0x0370	// UART TX Descriptor Address
+#define	REG_UART_RX_DESA			0x0378	// UART Rx Descriptor Address
+
+
+// spec version 11
+//-----------------------------------------------------
+//
+//	0x0400h ~ 0x047Fh	Protocol Configuration
+//
+//-----------------------------------------------------
+#define REG_VOQ_INFORMATION			0x0400
+#define REG_VIQ_INFORMATION			0x0404
+#define REG_BEQ_INFORMATION			0x0408
+#define REG_BKQ_INFORMATION			0x040C
+#define REG_MGQ_INFORMATION			0x0410
+#define REG_HGQ_INFORMATION			0x0414
+#define REG_BCNQ_INFORMATION			0x0418
+
+
+#define REG_CPU_MGQ_INFORMATION		0x041C
+#define REG_FWHW_TXQ_CTRL				0x0420
+#define REG_HWSEQ_CTRL					0x0423
+#define REG_TXPKTBUF_BCNQ_BDNY		0x0424
+#define REG_TXPKTBUF_MGQ_BDNY		0x0425
+#define REG_LIFETIME_EN				0x0426
+#define REG_MULTI_BCNQ_OFFSET			0x0427
+#define REG_SPEC_SIFS					0x0428
+#define REG_RL							0x042A
+#define REG_DARFRC						0x0430
+#define REG_RARFRC						0x0438
+#define REG_RRSR						0x0440
+#define REG_ARFR0						0x0444
+#define REG_ARFR1						0x0448
+#define REG_ARFR2						0x044C
+#define REG_ARFR3						0x0450
+#define REG_AGGLEN_LMT					0x0458
+#define REG_AMPDU_MIN_SPACE			0x045C
+#define REG_TXPKTBUF_WMAC_LBK_BF_HD	0x045D
+#define REG_FAST_EDCA_CTRL				0x0460
+#define REG_RD_RESP_PKT_TH				0x0463
+#define REG_INIRTS_RATE_SEL			0x0480
+#define REG_INIDATA_RATE_SEL			0x0484
+
+//#define REG_FW_TSF_SYNC_CNT				0x04A0
+#define REG_FW_RESET_TSF_CNT_1				0x05FC
+#define REG_FW_RESET_TSF_CNT_0				0x05FD
+#define REG_FW_BCN_DIS_CNT				0x05FE
+
+#define REG_POWER_STATUS				0x04A4
+#define REG_POWER_STAGE1				0x04B4
+#define REG_POWER_STAGE2				0x04B8
+#define REG_PKT_VO_VI_LIFE_TIME			0x04C0
+#define REG_PKT_BE_BK_LIFE_TIME			0x04C2
+#define REG_STBC_SETTING				0x04C4
+#define REG_PROT_MODE_CTRL			0x04C8
+#define REG_MAX_AGGR_NUM				0x04CA
+#define REG_RTS_MAX_AGGR_NUM			0x04CB
+#define REG_BAR_MODE_CTRL				0x04CC
+#define REG_RA_TRY_RATE_AGG_LMT		0x04CF
+#define REG_EARLY_MODE_CONTROL		0x04D0
+#define REG_NQOS_SEQ					0x04DC
+#define REG_QOS_SEQ					0x04DE
+#define REG_NEED_CPU_HANDLE			0x04E0
+#define REG_PKT_LOSE_RPT				0x04E1
+#define REG_PTCL_ERR_STATUS			0x04E2
+#define REG_DUMMY						0x04FC
+
+
+
+//-----------------------------------------------------
+//
+//	0x0500h ~ 0x05FFh	EDCA Configuration
+//
+//-----------------------------------------------------
+#define REG_EDCA_VO_PARAM			0x0500
+#define REG_EDCA_VI_PARAM			0x0504
+#define REG_EDCA_BE_PARAM			0x0508
+#define REG_EDCA_BK_PARAM			0x050C
+#define REG_BCNTCFG					0x0510
+#define REG_PIFS						0x0512
+#define REG_RDG_PIFS				0x0513
+#define REG_SIFS_CTX				0x0514
+#define REG_SIFS_TRX				0x0516
+#define REG_TSFTR_SYN_OFFSET		0x0518
+#define REG_AGGR_BREAK_TIME		0x051A
+#define REG_SLOT					0x051B
+#define REG_TX_PTCL_CTRL			0x0520
+#define REG_TXPAUSE					0x0522
+#define REG_DIS_TXREQ_CLR			0x0523
+#define REG_RD_CTRL					0x0524
+#define REG_TBTT_PROHIBIT			0x0540
+#define REG_RD_NAV_NXT				0x0544
+#define REG_NAV_PROT_LEN			0x0546
+#define REG_BCN_CTRL				0x0550
+#define REG_BCN_CTRL_1				0x0551
+#define REG_MBID_NUM				0x0552
+#define REG_DUAL_TSF_RST			0x0553
+#define REG_BCN_INTERVAL			0x0554	// The same as REG_MBSSID_BCN_SPACE
+#define REG_MBSSID_BCN_SPACE		0x0554
+#define REG_DRVERLYINT				0x0558
+#define REG_BCNDMATIM				0x0559
+#define REG_ATIMWND				0x055A
+#define REG_USTIME_TSF				0x055C
+#define REG_BCN_MAX_ERR			0x055D
+#define REG_RXTSF_OFFSET_CCK		0x055E
+#define REG_RXTSF_OFFSET_OFDM		0x055F
+#define REG_TSFTR					0x0560
+#define REG_TSFTR1					0x0568
+#define REG_INIT_TSFTR				0x0564
+#define REG_ATIMWND_1				0x0570
+#define REG_PSTIMER					0x0580
+#define REG_TIMER0					0x0584
+#define REG_TIMER1					0x0588
+#define REG_ACMHWCTRL				0x05C0
+#define REG_ACMRSTCTRL				0x05C1
+#define REG_ACMAVG					0x05C2
+#define REG_VO_ADMTIME				0x05C4
+#define REG_VI_ADMTIME				0x05C6
+#define REG_BE_ADMTIME				0x05C8
+#define REG_EDCA_RANDOM_GEN		0x05CC
+#define REG_SCH_TXCMD				0x05D0
+
+#define REG_DMC						0x05F0	//Dual MAC Co-Existence Register
+
+
+//-----------------------------------------------------
+//
+//	0x0600h ~ 0x07FFh	WMAC Configuration
+//
+//-----------------------------------------------------
+#define REG_APSD_CTRL				0x0600
+#define REG_BWOPMODE				0x0603
+#define REG_TCR						0x0604
+#define REG_RCR						0x0608
+#define REG_RX_PKT_LIMIT			0x060C
+#define REG_RX_DLK_TIME			0x060D
+#define REG_RX_DRVINFO_SZ			0x060F
+
+#define REG_MACID					0x0610
+#define REG_BSSID					0x0618
+#define REG_MAR						0x0620
+#define REG_MBIDCAMCFG				0x0628
+
+#define REG_USTIME_EDCA			0x0638
+#define REG_MAC_SPEC_SIFS			0x063A
+#define REG_RESP_SIFS_CCK			0x063C
+#define REG_RESP_SIFS_OFDM			0x063E
+#define REG_ACKTO					0x0640
+#define REG_CTS2TO					0x0641
+#define REG_EIFS						0x0642
+
+
+//WMA, BA, CCX
+#define REG_NAV_CTRL				0x0650
+#define REG_BACAMCMD				0x0654
+#define REG_BACAMCONTENT			0x0658
+#define REG_LBDLY					0x0660
+#define REG_FWDLY					0x0661
+#define REG_RXERR_RPT				0x0664
+#define REG_WMAC_TRXPTCL_CTL		0x0668
+
+
+// Security
+#define REG_CAMCMD					0x0670
+#define REG_CAMWRITE				0x0674
+#define REG_CAMREAD				0x0678
+#define REG_CAMDBG					0x067C
+#define REG_SECCFG					0x0680
+
+// Power
+#define REG_WOW_CTRL				0x0690
+#define REG_PSSTATUS				0x0691
+#define REG_PS_RX_INFO				0x0692
+#define REG_LPNAV_CTRL				0x0694
+#define REG_WKFMCAM_CMD			0x0698
+#define REG_WKFMCAM_RWD			0x069C
+#define REG_RXFLTMAP0				0x06A0
+#define REG_RXFLTMAP1				0x06A2
+#define REG_RXFLTMAP2				0x06A4
+#define REG_BCN_PSR_RPT			0x06A8
+#define REG_CALB32K_CTRL			0x06AC
+#define REG_PKT_MON_CTRL			0x06B4
+#define REG_BT_COEX_TABLE			0x06C0
+#define REG_WMAC_RESP_TXINFO		0x06D8
+
+#define REG_MACID1					0x0700
+#define REG_BSSID1					0x0708
+
+//-----------------------------------------------------
+//
+//	0xFE00h ~ 0xFE55h	USB Configuration
+//
+//-----------------------------------------------------
+#define REG_USB_INFO				0xFE17
+#define REG_USB_SPECIAL_OPTION	0xFE55
+#define REG_USB_DMA_AGG_TO		0xFE5B
+#define REG_USB_AGG_TO				0xFE5C
+#define REG_USB_AGG_TH				0xFE5D
+
+// for 92DU high_Queue low_Queue Normal_Queue select
+#define REG_USB_High_NORMAL_Queue_Select_MAC0  0xFE44
+//#define REG_USB_LOW_Queue_Select_MAC0       0xFE45
+#define REG_USB_High_NORMAL_Queue_Select_MAC1  0xFE47
+//#define REG_USB_LOW_Queue_Select_MAC1       0xFE48
+
+// For test chip
+#define REG_TEST_USB_TXQS			0xFE48
+#define REG_TEST_SIE_VID			0xFE60		// 0xFE60~0xFE61
+#define REG_TEST_SIE_PID			0xFE62		// 0xFE62~0xFE63
+#define REG_TEST_SIE_OPTIONAL		0xFE64
+#define REG_TEST_SIE_CHIRP_K		0xFE65
+#define REG_TEST_SIE_PHY			0xFE66		// 0xFE66~0xFE6B
+#define REG_TEST_SIE_MAC_ADDR		0xFE70		// 0xFE70~0xFE75
+#define REG_TEST_SIE_STRING		0xFE80		// 0xFE80~0xFEB9
+
+
+// For normal chip
+#define REG_NORMAL_SIE_VID			0xFE60		// 0xFE60~0xFE61
+#define REG_NORMAL_SIE_PID			0xFE62		// 0xFE62~0xFE63
+#define REG_NORMAL_SIE_OPTIONAL	0xFE64
+#define REG_NORMAL_SIE_EP			0xFE65		// 0xFE65~0xFE67
+#define REG_NORMAL_SIE_PHY		0xFE68		// 0xFE68~0xFE6B
+#define REG_NORMAL_SIE_MAC_ADDR	0xFE70		// 0xFE70~0xFE75
+#define REG_NORMAL_SIE_STRING		0xFE80		// 0xFE80~0xFEDF
+
+
+//-----------------------------------------------------
+//
+//	Redifine 8192C register definition for compatibility
+//
+//-----------------------------------------------------
+
+// TODO: use these definition when using REG_xxx naming rule.
+// NOTE: DO NOT Remove these definition. Use later.
+
+#define	SYS_ISO_CTRL				REG_SYS_ISO_CTRL	// System Isolation Interface Control.
+#define	SYS_FUNC_EN				REG_SYS_FUNC_EN		// System Function Enable.
+#define	SYS_CLK						REG_SYS_CLKR
+#define	CR9346						REG_9346CR			// 93C46/93C56 Command Register.
+#define	EFUSE_CTRL					REG_EFUSE_CTRL		// E-Fuse Control.
+#define	EFUSE_TEST					REG_EFUSE_TEST		// E-Fuse Test.
+#define	MSR							(REG_CR + 2)		// Media Status register
+#define	ISR							REG_HISR
+#define	TSFR						REG_TSFTR			// Timing Sync Function Timer Register.
+
+#define	MACIDR0					REG_MACID			// MAC ID Register, Offset 0x0050-0x0053
+#define	MACIDR4					(REG_MACID + 4)		// MAC ID Register, Offset 0x0054-0x0055
+
+#define 	PBP							REG_PBP
+
+// Redifine MACID register, to compatible prior ICs.
+#define	IDR0						MACIDR0
+#define	IDR4						MACIDR4
+
+
+//
+// 9. Security Control Registers	(Offset: )
+//
+#define	RWCAM						REG_CAMCMD		//IN 8190 Data Sheet is called CAMcmd
+#define	WCAMI						REG_CAMWRITE	// Software write CAM input content
+#define	RCAMO						REG_CAMREAD		// Software read/write CAM config
+#define	CAMDBG						REG_CAMDBG
+#define	SECR						REG_SECCFG		//Security Configuration Register
+
+// Unused register
+#define	UnusedRegister				0x1BF
+#define	DCAM						UnusedRegister
+#define	PSR							UnusedRegister
+#define 	BBAddr						UnusedRegister
+#define	PhyDataR					UnusedRegister
+
+#define	InvalidBBRFValue			0x12345678
+
+// Min Spacing related settings.
+#define	MAX_MSS_DENSITY_2T 			0x13
+#define	MAX_MSS_DENSITY_1T 			0x0A
+
+//----------------------------------------------------------------------------
+//       8192C Cmd9346CR bits					(Offset 0xA, 16bit)
+//----------------------------------------------------------------------------
+#define	CmdEEPROM_En				BIT5	 // EEPROM enable when set 1
+#define	CmdEERPOMSEL				BIT4 	// System EEPROM select, 0: boot from E-FUSE, 1: The EEPROM used is 9346
+#define	Cmd9346CR_9356SEL			BIT4
+#define	AutoLoadEEPROM			(CmdEEPROM_En|CmdEERPOMSEL)
+#define	AutoLoadEFUSE				CmdEEPROM_En
+
+//       8192C GPIO MUX Configuration Register (offset 0x40, 4 byte)
+//----------------------------------------------------------------------------
+#define	GPIOSEL_GPIO				0
+#define	GPIOSEL_ENBT				BIT5
+
+//----------------------------------------------------------------------------
+//       8192C GPIO PIN Control Register (offset 0x44, 4 byte)
+//----------------------------------------------------------------------------
+#define	GPIO_IN						REG_GPIO_PIN_CTRL		// GPIO pins input value
+#define	GPIO_OUT					(REG_GPIO_PIN_CTRL+1)	// GPIO pins output value
+#define	GPIO_IO_SEL				(REG_GPIO_PIN_CTRL+2)	// GPIO pins output enable when a bit is set to "1"; otherwise, input is configured.
+#define	GPIO_MOD					(REG_GPIO_PIN_CTRL+3)
+
+
+//----------------------------------------------------------------------------
+//       8192C (MSR) Media Status Register	(Offset 0x4C, 8 bits)
+//----------------------------------------------------------------------------
+/*
+Network Type
+00: No link
+01: Link in ad hoc network
+10: Link in infrastructure network
+11: AP mode
+Default: 00b.
+*/
+#define	MSR_NOLINK					0x00
+#define	MSR_ADHOC					0x01
+#define	MSR_INFRA					0x02
+#define	MSR_AP						0x03
+
+//
+// 6. Adaptive Control Registers  (Offset: 0x0160 - 0x01CF)
+//
+//----------------------------------------------------------------------------
+//       8192C Response Rate Set Register	(offset 0x181, 24bits)
+//----------------------------------------------------------------------------
+#define	RRSR_RSC_OFFSET			21
+#define	RRSR_SHORT_OFFSET			23
+#define	RRSR_RSC_BW_40M			0x600000
+#define	RRSR_RSC_UPSUBCHNL		0x400000
+#define	RRSR_RSC_LOWSUBCHNL		0x200000
+#define	RRSR_SHORT					0x800000
+#define	RRSR_1M					BIT0
+#define	RRSR_2M					BIT1
+#define	RRSR_5_5M					BIT2
+#define	RRSR_11M					BIT3
+#define	RRSR_6M					BIT4
+#define	RRSR_9M					BIT5
+#define	RRSR_12M					BIT6
+#define	RRSR_18M					BIT7
+#define	RRSR_24M					BIT8
+#define	RRSR_36M					BIT9
+#define	RRSR_48M					BIT10
+#define	RRSR_54M					BIT11
+#define	RRSR_MCS0					BIT12
+#define	RRSR_MCS1					BIT13
+#define	RRSR_MCS2					BIT14
+#define	RRSR_MCS3					BIT15
+#define	RRSR_MCS4					BIT16
+#define	RRSR_MCS5					BIT17
+#define	RRSR_MCS6					BIT18
+#define	RRSR_MCS7					BIT19
+#define	BRSR_AckShortPmb			BIT23
+// CCK ACK: use Short Preamble or not
+
+
+//----------------------------------------------------------------------------
+//       8192C Rate Definition
+//----------------------------------------------------------------------------
+//CCK
+#define	RATR_1M					0x00000001
+#define	RATR_2M					0x00000002
+#define	RATR_55M					0x00000004
+#define	RATR_11M					0x00000008
+//OFDM
+#define	RATR_6M					0x00000010
+#define	RATR_9M					0x00000020
+#define	RATR_12M					0x00000040
+#define	RATR_18M					0x00000080
+#define	RATR_24M					0x00000100
+#define	RATR_36M					0x00000200
+#define	RATR_48M					0x00000400
+#define	RATR_54M					0x00000800
+//MCS 1 Spatial Stream
+#define	RATR_MCS0					0x00001000
+#define	RATR_MCS1					0x00002000
+#define	RATR_MCS2					0x00004000
+#define	RATR_MCS3					0x00008000
+#define	RATR_MCS4					0x00010000
+#define	RATR_MCS5					0x00020000
+#define	RATR_MCS6					0x00040000
+#define	RATR_MCS7					0x00080000
+//MCS 2 Spatial Stream
+#define	RATR_MCS8					0x00100000
+#define	RATR_MCS9					0x00200000
+#define	RATR_MCS10					0x00400000
+#define	RATR_MCS11					0x00800000
+#define	RATR_MCS12					0x01000000
+#define	RATR_MCS13					0x02000000
+#define	RATR_MCS14					0x04000000
+#define	RATR_MCS15					0x08000000
+
+//----------------------------------------------------------------------------
+//       8192C BW_OPMODE bits					(Offset 0x203, 8bit)
+//----------------------------------------------------------------------------
+#define	BW_OPMODE_20MHZ			BIT2
+#define	BW_OPMODE_5G				BIT1
+#define	BW_OPMODE_11J				BIT0
+
+
+//----------------------------------------------------------------------------
+//       8192C CAM Config Setting (offset 0x250, 1 byte)
+//----------------------------------------------------------------------------
+#define	CAM_VALID					BIT15
+#define	CAM_NOTVALID				0x0000
+#define	CAM_USEDK					BIT5
+
+#define	CAM_CONTENT_COUNT 		8
+
+#define	CAM_NONE					0x0
+#define	CAM_WEP40					0x01
+#define	CAM_TKIP					0x02
+#define	CAM_AES					0x04
+#define	CAM_WEP104				0x05
+#define	CAM_SMS4					0x6
+
+
+#define	TOTAL_CAM_ENTRY			32
+#define	HALF_CAM_ENTRY			16
+
+#define	CAM_CONFIG_USEDK			_TRUE
+#define	CAM_CONFIG_NO_USEDK		_FALSE
+
+#define	CAM_WRITE					BIT16
+#define	CAM_READ					0x00000000
+#define	CAM_POLLINIG				BIT31
+
+#define	SCR_UseDK					0x01
+#define	SCR_TxSecEnable			0x02
+#define	SCR_RxSecEnable			0x04
+
+
+//
+// 12. Host Interrupt Status Registers	 (Offset: 0x0300 - 0x030F)
+//
+//----------------------------------------------------------------------------
+//       8190 IMR/ISR bits						(offset 0xfd,  8bits)
+//----------------------------------------------------------------------------
+#define	IMR8190_DISABLED			0x0
+// IMR DW0 Bit 0-31
+#define	IMR_BCNDMAINT6			BIT31		// Beacon DMA Interrupt 6
+#define	IMR_BCNDMAINT5			BIT30		// Beacon DMA Interrupt 5
+#define	IMR_BCNDMAINT4			BIT29		// Beacon DMA Interrupt 4
+#define	IMR_BCNDMAINT3			BIT28		// Beacon DMA Interrupt 3
+#define	IMR_BCNDMAINT2			BIT27		// Beacon DMA Interrupt 2
+#define	IMR_BCNDMAINT1			BIT26		// Beacon DMA Interrupt 1
+#define	IMR_BCNDOK8				BIT25		// Beacon Queue DMA OK Interrup 8
+#define	IMR_BCNDOK7				BIT24		// Beacon Queue DMA OK Interrup 7
+#define	IMR_BCNDOK6				BIT23		// Beacon Queue DMA OK Interrup 6
+#define	IMR_BCNDOK5				BIT22		// Beacon Queue DMA OK Interrup 5
+#define	IMR_BCNDOK4				BIT21		// Beacon Queue DMA OK Interrup 4
+#define	IMR_BCNDOK3				BIT20		// Beacon Queue DMA OK Interrup 3
+#define	IMR_BCNDOK2				BIT19		// Beacon Queue DMA OK Interrup 2
+#define	IMR_BCNDOK1				BIT18		// Beacon Queue DMA OK Interrup 1
+#define	IMR_TIMEOUT2				BIT17		// Timeout interrupt 2
+#define	IMR_TIMEOUT1				BIT16		// Timeout interrupt 1
+#define	IMR_TXFOVW				BIT15		// Transmit FIFO Overflow
+#define	IMR_PSTIMEOUT				BIT14		// Power save time out interrupt
+#define	IMR_BcnInt					BIT13		// Beacon DMA Interrupt 0
+#define	IMR_RXFOVW				BIT12		// Receive FIFO Overflow
+#define	IMR_RDU					BIT11		// Receive Descriptor Unavailable
+#define	IMR_ATIMEND				BIT10		// For 92C,ATIM Window End Interrupt
+#define	IMR_BDOK					BIT9		// Beacon Queue DMA OK Interrup
+#define	IMR_HIGHDOK				BIT8		// High Queue DMA OK Interrupt
+#define	IMR_TBDOK					BIT7		// Transmit Beacon OK interrup
+#define	IMR_MGNTDOK				BIT6		// Management Queue DMA OK Interrupt
+#define	IMR_TBDER					BIT5		// For 92C,Transmit Beacon Error Interrupt
+#define	IMR_BKDOK					BIT4		// AC_BK DMA OK Interrupt
+#define	IMR_BEDOK					BIT3		// AC_BE DMA OK Interrupt
+#define	IMR_VIDOK					BIT2		// AC_VI DMA OK Interrupt
+#define	IMR_VODOK					BIT1		// AC_VO DMA Interrupt
+#define	IMR_ROK					BIT0		// Receive DMA OK Interrupt
+
+// 13. Host Interrupt Status Extension Register	 (Offset: 0x012C-012Eh)
+#define	IMR_TXERR					BIT11
+#define	IMR_RXERR					BIT10
+#define	IMR_C2HCMD				BIT9
+#define	IMR_CPWM					BIT8
+//RSVD [2-7]
+#define	IMR_OCPINT					BIT1
+#define	IMR_WLANOFF				BIT0
+
+
+
+//----------------------------------------------------------------------------
+// 8192D EFUSE
+//----------------------------------------------------------------------------
+#define	HWSET_MAX_SIZE				256
+
+//----------------------------------------------------------------------------
+//       8192C EEPROM/EFUSE share register definition.
+//----------------------------------------------------------------------------
+
+//
+// Default Value for EEPROM or EFUSE!!!
+//
+#define	EEPROM_Default_TSSI					0x0
+#define 	EEPROM_Default_TxPowerDiff				0x0
+#define 	EEPROM_Default_CrystalCap				0x0		//92D default 0x0
+#define 	EEPROM_Default_BoardType				0x02 // Default: 2X2, RTL8192CE(QFPN68)
+#define 	EEPROM_Default_TxPower				0x1010
+#define	EEPROM_Default_HT2T_TxPwr				0x10
+
+#define	EEPROM_Default_LegacyHTTxPowerDiff	0x4
+#define	EEPROM_Default_ThermalMeter			0x12
+
+#define	EEPROM_Default_AntTxPowerDiff			0x0
+//#define	EEPROM_Default_TxPwDiff_CrystalCap		0x5
+#define	EEPROM_Default_TxPowerLevel_2G		0x2C
+#define	EEPROM_Default_TxPowerLevel_5G		0x22
+
+#define	EEPROM_Default_HT40_2SDiff				0x0
+#define 	EEPROM_Default_HT20_Diff				2	// HT20<->40 default Tx Power Index Difference
+#define	EEPROM_Default_LegacyHTTxPowerDiff	0x4	//OFDM Tx Power index diff
+#define 	EEPROM_Default_HT40_PwrMaxOffset		0
+#define 	EEPROM_Default_HT20_PwrMaxOffset		0
+
+// For debug
+#define 	EEPROM_Default_PID						0x1234
+#define 	EEPROM_Default_VID						0x5678
+#define 	EEPROM_Default_CustomerID				0xAB
+#define 	EEPROM_Default_SubCustomerID			0xCD
+#define 	EEPROM_Default_Version					0
+
+#define	EEPROM_Default_externalPA_C9		0x00
+#define	EEPROM_Default_externalPA_CC		0xFF
+#define	EEPROM_Default_internalPA_SP3T_C9	0xAA
+#define	EEPROM_Default_internalPA_SP3T_CC	0xAF
+#define	EEPROM_Default_internalPA_SPDT_C9	0xAA
+#ifdef CONFIG_PCI_HCI
+#define	EEPROM_Default_internalPA_SPDT_CC	0xA0
+#else
+#define	EEPROM_Default_internalPA_SPDT_CC	0xFA
+#endif
+
+#define	EEPROM_CHANNEL_PLAN_FCC				0x0
+#define	EEPROM_CHANNEL_PLAN_IC				0x1
+#define	EEPROM_CHANNEL_PLAN_ETSI			0x2
+#define	EEPROM_CHANNEL_PLAN_SPAIN			0x3
+#define	EEPROM_CHANNEL_PLAN_FRANCE			0x4
+#define	EEPROM_CHANNEL_PLAN_MKK				0x5
+#define	EEPROM_CHANNEL_PLAN_MKK1			0x6
+#define	EEPROM_CHANNEL_PLAN_ISRAEL			0x7
+#define	EEPROM_CHANNEL_PLAN_TELEC			0x8
+#define	EEPROM_CHANNEL_PLAN_GLOBAL_DOMAIN	0x9
+#define	EEPROM_CHANNEL_PLAN_WORLD_WIDE_13	0xA
+#define	EEPROM_CHANNEL_PLAN_NCC				0xB
+#define	EEPROM_CHANNEL_PLAN_BY_HW_MASK	0x80
+
+
+#define 	EEPROM_CID_DEFAULT					0x0
+#define 	EEPROM_CID_TOSHIBA					0x4
+#define	EEPROM_CID_CCX						0x10 // CCX test. By Bruce, 2009-02-25.
+#define	EEPROM_CID_QMI						0x0D
+#define 	EEPROM_CID_WHQL 						0xFE // added by chiyoko for dtm, 20090108
+
+
+#define	RTL8192_EEPROM_ID						0x8129
+#define	EEPROM_WAPI_SUPPORT					0x78
+
+
+#ifdef CONFIG_PCI_HCI
+#define RT_IBSS_INT_MASKS				(IMR_BcnInt | IMR_TBDOK | IMR_TBDER)
+#define RT_AC_INT_MASKS				(IMR_VIDOK | IMR_VODOK | IMR_BEDOK|IMR_BKDOK)
+#define RT_BSS_INT_MASKS				(RT_IBSS_INT_MASKS)
+
+#define RTL8190_EEPROM_ID						0x8129	// 0-1
+#define EEPROM_HPON							0x02 // LDO settings.2-5
+#define EEPROM_CLK								0x06 // Clock settings.6-7
+#define EEPROM_MAC_FUNCTION					0x08 // SE Test mode.8
+
+#define EEPROM_VID								0x28 // SE Vendor ID.A-B
+#define EEPROM_DID								0x2A // SE Device ID. C-D
+#define EEPROM_SVID								0x2C // SE Vendor ID.E-F
+#define EEPROM_SMID							0x2E // SE PCI Subsystem ID. 10-11
+
+#define EEPROM_MAC_ADDR						0x16 // SEMAC Address. 12-17
+#define EEPROM_MAC_ADDR_MAC0_92D			0x55
+#define EEPROM_MAC_ADDR_MAC1_92D			0x5B
+//----------------------------------------------------------------
+// 2.4G band Tx power index setting
+#define EEPROM_CCK_TX_PWR_INX_2G				0x61
+#define EEPROM_HT40_1S_TX_PWR_INX_2G		0x67
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF_2G	0x6D
+#define EEPROM_HT20_TX_PWR_INX_DIFF_2G		0x70
+#define EEPROM_OFDM_TX_PWR_INX_DIFF_2G		0x73
+#define EEPROM_HT40_MAX_PWR_OFFSET_2G		0x76
+#define EEPROM_HT20_MAX_PWR_OFFSET_2G		0x79
+
+//5GL channel 32-64
+#define EEPROM_HT40_1S_TX_PWR_INX_5GL		0x7C
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF_5GL	0x82
+#define EEPROM_HT20_TX_PWR_INX_DIFF_5GL		0x85
+#define EEPROM_OFDM_TX_PWR_INX_DIFF_5GL		0x88
+#define EEPROM_HT40_MAX_PWR_OFFSET_5GL		0x8B
+#define EEPROM_HT20_MAX_PWR_OFFSET_5GL		0x8E
+
+//5GM channel 100-140
+#define EEPROM_HT40_1S_TX_PWR_INX_5GM		0x91
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF_5GM	0x97
+#define EEPROM_HT20_TX_PWR_INX_DIFF_5GM		0x9A
+#define EEPROM_OFDM_TX_PWR_INX_DIFF_5GM	0x9D
+#define EEPROM_HT40_MAX_PWR_OFFSET_5GM		0xA0
+#define EEPROM_HT20_MAX_PWR_OFFSET_5GM		0xA3
+
+//5GH channel 149-165
+#define EEPROM_HT40_1S_TX_PWR_INX_5GH		0xA6
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF_5GH	0xAC
+#define EEPROM_HT20_TX_PWR_INX_DIFF_5GH		0xAF
+#define EEPROM_OFDM_TX_PWR_INX_DIFF_5GH		0xB2
+#define EEPROM_HT40_MAX_PWR_OFFSET_5GH		0xB5
+#define EEPROM_HT20_MAX_PWR_OFFSET_5GH		0xB8
+
+#define EEPROM_CHANNEL_PLAN					0xBB // Map of supported channels.
+#define EEPROM_IQK_DELTA						0xBC
+#define EEPROM_LCK_DELTA						0xBC
+#define EEPROM_XTAL_K							0xBD	//[7:5]
+#define EEPROM_TSSI_A_5G						0xBE
+#define EEPROM_TSSI_B_5G						0xBF
+#define EEPROM_TSSI_AB_5G						0xC0
+#define EEPROM_THERMAL_METER					0xC3	//[4:0]
+#define EEPROM_PATHDIV							0xC4
+#define EEPROM_RF_OPT1							0xC4
+#define EEPROM_RF_OPT2							0xC5
+#define EEPROM_RF_OPT3							0xC6
+#define EEPROM_RF_OPT4							0xC7
+#define EEPROM_RF_OPT5							0xC8
+#define EEPROM_RF_OPT6							0xC9
+#define EEPROM_VERSION							0xCA
+#define EEPROM_CUSTOMER_ID					0xCB
+#define EEPROM_RF_OPT7							0xCC
+
+#define EEPROM_WIDIPAIRING_ADDR				0xF0
+#define EEPROM_WIDIPAIRING_KEY				0xF6
+
+#define EEPROM_DEF_PART_NO					0x3FD  //Byte
+#define EEPROME_CHIP_VERSION_L				0x3FF
+#define EEPROME_CHIP_VERSION_H				0x3FE
+#endif
+
+#ifdef CONFIG_USB_HCI
+#define RTL8190_EEPROM_ID						0x8129	// 0-1
+#define EEPROM_HPON							0x02 // LDO settings.2-5
+#define EEPROM_CLK								0x06 // Clock settings.6-7
+#define EEPROM_MAC_FUNCTION					0x08 // SE Test mode.8
+
+#define EEPROM_VID								0xC // SE Vendor ID.A-B
+#define EEPROM_PID								0xE // SE Device ID. C-D
+#define EEPROM_ENDPOINT_SETTING				0x10
+#ifdef CONFIG_WOWLAN
+#define EEPROM_Option_Setting				0x11
+#endif // CONFIG_WOWLAN
+#define EEPROM_CHIRP_K							0x12	// Changed
+#define EEPROM_USB_PHY							0x13	// Changed
+#define EEPROM_NORMAL_BoardType				EEPROM_RF_OPT1	//[7:5]
+#define EEPROM_MAC_ADDR						0x16 // SEMAC Address. 12-17
+#define EEPROM_STRING							0x1F
+#define EEPROM_SUBCUSTOMER_ID					0x59
+
+#define EEPROM_MAC_ADDR_MAC0_92D			0x19
+#define EEPROM_MAC_ADDR_MAC1_92D			0x5B
+//----------------------------------------------------------------
+// 2.4G band Tx power index setting
+#define EEPROM_CCK_TX_PWR_INX_2G				0x61
+#define EEPROM_HT40_1S_TX_PWR_INX_2G		0x67
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF_2G	0x6D
+#define EEPROM_HT20_TX_PWR_INX_DIFF_2G		0x70
+#define EEPROM_OFDM_TX_PWR_INX_DIFF_2G		0x73
+#define EEPROM_HT40_MAX_PWR_OFFSET_2G		0x76
+#define EEPROM_HT20_MAX_PWR_OFFSET_2G		0x79
+
+//5GL channel 32-64
+#define EEPROM_HT40_1S_TX_PWR_INX_5GL		0x7C
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF_5GL	0x82
+#define EEPROM_HT20_TX_PWR_INX_DIFF_5GL		0x85
+#define EEPROM_OFDM_TX_PWR_INX_DIFF_5GL		0x88
+#define EEPROM_HT40_MAX_PWR_OFFSET_5GL		0x8B
+#define EEPROM_HT20_MAX_PWR_OFFSET_5GL		0x8E
+
+//5GM channel 100-140
+#define EEPROM_HT40_1S_TX_PWR_INX_5GM		0x91
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF_5GM	0x97
+#define EEPROM_HT20_TX_PWR_INX_DIFF_5GM		0x9A
+#define EEPROM_OFDM_TX_PWR_INX_DIFF_5GM	0x9D
+#define EEPROM_HT40_MAX_PWR_OFFSET_5GM		0xA0
+#define EEPROM_HT20_MAX_PWR_OFFSET_5GM		0xA3
+
+//5GH channel 149-165
+#define EEPROM_HT40_1S_TX_PWR_INX_5GH		0xA6
+#define EEPROM_HT40_2S_TX_PWR_INX_DIFF_5GH	0xAC
+#define EEPROM_HT20_TX_PWR_INX_DIFF_5GH		0xAF
+#define EEPROM_OFDM_TX_PWR_INX_DIFF_5GH		0xB2
+#define EEPROM_HT40_MAX_PWR_OFFSET_5GH		0xB5
+#define EEPROM_HT20_MAX_PWR_OFFSET_5GH		0xB8
+
+#define EEPROM_CHANNEL_PLAN					0xBB // Map of supported channels.
+#define EEPROM_TEST_CHANNEL_PLAN				0xBB
+#define EEPROM_IQK_DELTA						0xBC
+#define EEPROM_LCK_DELTA						0xBC
+#define EEPROM_XTAL_K							0xBD	//[7:5]
+#define EEPROM_TSSI_A_5G						0xBE
+#define EEPROM_TSSI_B_5G						0xBF
+#define EEPROM_TSSI_AB_5G						0xC0
+#define EEPROM_THERMAL_METER					0xC3	//[4:0]
+#define EEPROM_RF_OPT1							0xC4
+#define EEPROM_RF_OPT2							0xC5
+#define EEPROM_RF_OPT3							0xC6
+#define EEPROM_RF_OPT4							0xC7
+#define EEPROM_RF_OPT5							0xC8
+#define EEPROM_RF_OPT6							0xC9
+#define EEPROM_VERSION							0xCA
+#define EEPROM_CUSTOMER_ID					0xCB
+#define EEPROM_RF_OPT7							0xCC
+
+#define EEPROM_DEF_PART_NO					0x3FD  //Byte
+#define EEPROME_CHIP_VERSION_L				0x3FF
+#define EEPROME_CHIP_VERSION_H				0x3FE
+
+//-------------------------------------------------------------
+//	EEPROM content definitions
+//-------------------------------------------------------------
+#define OS_LINK_SPEED_NORMAL_MASK			BIT3 | BIT2
+#define OS_LINK_SPEED_TEST_MASK				BIT3 | BIT4
+
+#define BOARD_TYPE_NORMAL_MASK				0xE0
+#define BOARD_TYPE_TEST_MASK					0xF
+
+#define BT_COEXISTENCE_TEST					BIT4
+#define BT_COEXISTENCE_NORMAL					BIT5
+
+#define BT_CO_SHIFT_TEST						4
+#define BT_CO_SHIFT_NORMAL					5
+
+#define EP_NUMBER_MASK_TEST					0x30	//bit 4:5 0Eh
+#define EP_NUMBER_SHIFT_TEST					4
+
+#define USB_PHY_PARA_SIZE_TEST				6
+#define USB_PHY_PARA_SIZE_NORMAL				4
+
+//-------------------------------------------------------------
+//	EEPROM default value definitions
+//-------------------------------------------------------------
+// Use 0xABCD instead of 0x8192 for debug
+#define	EEPROM_DEF_ID_0						0xCD	// Byte 0x00
+#define	EEPROM_DEF_ID_1						0xAB	// Byte 0x01
+
+#define EEPROM_DEF_RTK_RSV_A3					0x74	// Byte 0x03
+#define EEPROM_DEF_RTK_RSV_A4					0x6D	// Byte 0x04
+#define EEPROM_DEF_RTK_RSV_A8					0xFF	// Byte 0x08
+
+#define EEPROM_DEF_VID_0						0x0A	// Byte 0x0A
+#define EEPROM_DEF_VID_1						0x0B
+
+#define EEPROM_DEF_PID_0						0x92	// Byte 0x0C
+#define EEPROM_DEF_PID_1						0x81
+
+
+#define EEPROM_TEST_DEF_USB_OPT				0x80	// Byte 0x0E
+#define EEPROM_NORMAL_DEF_USB_OPT			0x00	// Byte 0x0E
+
+#define EEPROM_DEF_CHIRPK						0x15	// Byte 0x0F
+
+#define EEPROM_DEF_USB_PHY_0					0x85	// Byte 0x10
+#define EEPROM_DEF_USB_PHY_1					0x62	// Byte 0x11
+#define EEPROM_DEF_USB_PHY_2					0x9E	// Byte 0x12
+#define EEPROM_DEF_USB_PHY_3					0x06	// Byte 0x13
+
+#define EEPROM_DEF_TSSI_A						0x09	// Byte 0x78
+#define EEPROM_DEF_TSSI_B						0x09	// Byte 0x79
+
+
+#define EEPROM_DEF_THERMAL_METER				0x12	// Byte 0x7A
+
+
+#define	EEPROM_USB_SN							BIT(0)
+#define	EEPROM_USB_REMOTE_WAKEUP			BIT(1)
+#define	EEPROM_USB_DEVICE_PWR				BIT(2)
+#define	EEPROM_EP_NUMBER						(BIT(3)|BIT(4))
+
+#if 0
+#define	EEPROM_CHANNEL_PLAN_FCC					0x0
+#define	EEPROM_CHANNEL_PLAN_IC					0x1
+#define	EEPROM_CHANNEL_PLAN_ETSI				0x2
+#define	EEPROM_CHANNEL_PLAN_SPAIN				0x3
+#define	EEPROM_CHANNEL_PLAN_FRANCE				0x4
+#define	EEPROM_CHANNEL_PLAN_MKK					0x5
+#define	EEPROM_CHANNEL_PLAN_MKK1				0x6
+#define	EEPROM_CHANNEL_PLAN_ISRAEL				0x7
+#define	EEPROM_CHANNEL_PLAN_TELEC				0x8
+#define	EEPROM_CHANNEL_PLAN_GLOBAL_DOMAIN		0x9
+#define	EEPROM_CHANNEL_PLAN_WORLD_WIDE_13		0xA
+#define	EEPROM_CHANNEL_PLAN_BY_HW_MASK			0x80
+
+#define	EEPROM_CID_DEFAULT						0x0
+
+#define	EEPROM_CID_WHQL 						0xFE // added by chiyoko for dtm, 20090108
+
+
+#define	EEPROM_CID_CCX							0x10 // CCX test. By Bruce, 2009-02-25.
+
+#endif
+#endif
+
+
+/*===================================================================
+=====================================================================
+Here the register defines are for 92C. When the define is as same with 92C,
+we will use the 92C's define for the consistency
+So the following defines for 92C is not entire!!!!!!
+=====================================================================
+=====================================================================*/
+/*
+Based on Datasheet V33---090401
+Register Summary
+Current IOREG MAP
+0x0000h ~ 0x00FFh   System Configuration (256 Bytes)
+0x0100h ~ 0x01FFh   MACTOP General Configuration (256 Bytes)
+0x0200h ~ 0x027Fh   TXDMA Configuration (128 Bytes)
+0x0280h ~ 0x02FFh   RXDMA Configuration (128 Bytes)
+0x0300h ~ 0x03FFh   PCIE EMAC Reserved Region (256 Bytes)
+0x0400h ~ 0x04FFh   Protocol Configuration (256 Bytes)
+0x0500h ~ 0x05FFh   EDCA Configuration (256 Bytes)
+0x0600h ~ 0x07FFh   WMAC Configuration (512 Bytes)
+0x2000h ~ 0x3FFFh   8051 FW Download Region (8196 Bytes)
+*/
+
+//----------------------------------------------------------------------------
+//       8192C (RCR) Receive Configuration Register	(Offset 0x608, 32 bits)
+//----------------------------------------------------------------------------
+#define	RCR_APPFCS					BIT31		//WMAC append FCS after pauload
+#define	RCR_APP_MIC				BIT30		//
+#define	RCR_APP_ICV				BIT29       //
+#define	RCR_APP_PHYST_RXFF		BIT28       //
+#define	RCR_APP_BA_SSN			BIT27		//Accept BA SSN
+#define	RCR_ENMBID					BIT24		//Enable Multiple BssId.
+#define	RCR_LSIGEN					BIT23
+#define	RCR_MFBEN					BIT22
+#define	RCR_HTC_LOC_CTRL			BIT14       //MFC<--HTC=1 MFC-->HTC=0
+#define	RCR_AMF					BIT13		//Accept management type frame
+#define	RCR_ACF					BIT12		//Accept control type frame
+#define	RCR_ADF					BIT11		//Accept data type frame
+#define	RCR_AICV					BIT9		//Accept ICV error packet
+#define	RCR_ACRC32					BIT8		//Accept CRC32 error packet
+#define	RCR_CBSSID_BCN			BIT7		//Accept BSSID match packet (Rx beacon, probe rsp)
+#define	RCR_CBSSID_DATA			BIT6		//Accept BSSID match packet (Data)
+#define	RCR_CBSSID					RCR_CBSSID_DATA		//Accept BSSID match packet
+#define	RCR_APWRMGT				BIT5		//Accept power management packet
+#define	RCR_ADD3					BIT4		//Accept address 3 match packet
+#define	RCR_AB						BIT3		//Accept broadcast packet
+#define	RCR_AM						BIT2		//Accept multicast packet
+#define	RCR_APM					BIT1		//Accept physical match packet
+#define	RCR_AAP					BIT0		//Accept all unicast packet
+#define	RCR_MXDMA_OFFSET			8
+#define	RCR_FIFO_OFFSET			13
+
+
+
+//============================================================================
+//       8192c USB specific Regsiter Offset and Content definition,
+//       2009.08.18, added by vivi. for merge 92c and 92C into one driver
+//============================================================================
+//#define APS_FSMCO				0x0004  same with 92Ce
+#define RSV_CTRL					0x001C
+#define RD_CTRL					0x0524
+
+//-----------------------------------------------------
+//
+//	0xFE00h ~ 0xFE55h	USB Configuration
+//
+//-----------------------------------------------------
+#define REG_USB_INFO				0xFE17
+#define REG_USB_SPECIAL_OPTION	0xFE55
+#define REG_USB_DMA_AGG_TO		0xFE5B
+#define REG_USB_AGG_TO				0xFE5C
+#define REG_USB_AGG_TH				0xFE5D
+
+#define REG_USB_VID					0xFE60
+#define REG_USB_PID					0xFE62
+#define REG_USB_OPTIONAL			0xFE64
+#define REG_USB_CHIRP_K			0xFE65
+#define REG_USB_PHY					0xFE66
+#define REG_USB_MAC_ADDR			0xFE70
+
+#define REG_USB_HRPWM				0xFE58
+#define REG_USB_HCPWM				0xFE57
+
+#define InvalidBBRFValue			0x12345678
+
+//============================================================================
+//       8192C Regsiter Bit and Content definition
+//============================================================================
+//-----------------------------------------------------
+//
+//	0x0000h ~ 0x00FFh	System Configuration
+//
+//-----------------------------------------------------
+
+//2 SPS0_CTRL
+#define SW18_FPWM					BIT(3)
+
+
+//2 SYS_ISO_CTRL
+#define ISO_MD2PP					BIT(0)
+#define ISO_UA2USB					BIT(1)
+#define ISO_UD2CORE					BIT(2)
+#define ISO_PA2PCIE					BIT(3)
+#define ISO_PD2CORE					BIT(4)
+#define ISO_IP2MAC					BIT(5)
+#define ISO_DIOP						BIT(6)
+#define ISO_DIOE						BIT(7)
+#define ISO_EB2CORE					BIT(8)
+#define ISO_DIOR						BIT(9)
+
+#define PWC_EV25V					BIT(14)
+#define PWC_EV12V					BIT(15)
+
+
+//2 SYS_FUNC_EN
+#define FEN_BBRSTB					BIT(0)
+#define FEN_BB_GLB_RSTn			BIT(1)
+#define FEN_USBA					BIT(2)
+#define FEN_UPLL					BIT(3)
+#define FEN_USBD					BIT(4)
+#define FEN_DIO_PCIE				BIT(5)
+#define FEN_PCIEA					BIT(6)
+#define FEN_PPLL						BIT(7)
+#define FEN_PCIED					BIT(8)
+#define FEN_DIOE					BIT(9)
+#define FEN_CPUEN					BIT(10)
+#define FEN_DCORE					BIT(11)
+#define FEN_ELDR					BIT(12)
+#define FEN_DIO_RF					BIT(13)
+#define FEN_HWPDN					BIT(14)
+#define FEN_MREGEN					BIT(15)
+
+//2 APS_FSMCO
+#define PFM_LDALL					BIT(0)
+#define PFM_ALDN					BIT(1)
+#define PFM_LDKP					BIT(2)
+#define PFM_WOWL					BIT(3)
+#define EnPDN						BIT(4)
+#define PDN_PL						BIT(5)
+#define APFM_ONMAC					BIT(8)
+#define APFM_OFF					BIT(9)
+#define APFM_RSM					BIT(10)
+#define AFSM_HSUS					BIT(11)
+#define AFSM_PCIE					BIT(12)
+#define APDM_MAC					BIT(13)
+#define APDM_HOST					BIT(14)
+#define APDM_HPDN					BIT(15)
+#define RDY_MACON					BIT(16)
+#define SUS_HOST					BIT(17)
+#define ROP_ALD						BIT(20)
+#define ROP_PWR						BIT(21)
+#define ROP_SPS						BIT(22)
+#define SOP_MRST					BIT(25)
+#define SOP_FUSE					BIT(26)
+#define SOP_ABG						BIT(27)
+#define SOP_AMB						BIT(28)
+#define SOP_RCK						BIT(29)
+#define SOP_A8M						BIT(30)
+#define XOP_BTCK					BIT(31)
+
+//2 SYS_CLKR
+#define ANAD16V_EN					BIT(0)
+#define ANA8M						BIT(1)
+#define MACSLP						BIT(4)
+#define LOADER_CLK_EN				BIT(5)
+#define _80M_SSC_DIS				BIT(7)
+#define _80M_SSC_EN_HO				BIT(8)
+#define PHY_SSC_RSTB				BIT(9)
+#define SEC_CLK_EN					BIT(10)
+#define MAC_CLK_EN					BIT(11)
+#define SYS_CLK_EN					BIT(12)
+#define RING_CLK_EN					BIT(13)
+
+
+//2 9346CR
+
+#define BOOT_FROM_EEPROM			BIT(4)
+#define EEPROM_EN					BIT(5)
+
+
+//2 AFE_MISC
+#define AFE_BGEN					BIT(0)
+#define AFE_MBEN					BIT(1)
+#define MAC_ID_EN					BIT(7)
+
+
+//2 SPS0_CTRL
+
+
+//2 SPS_OCP_CFG
+
+
+//2 RSV_CTRL
+#define WLOCK_ALL					BIT(0)
+#define WLOCK_00					BIT(1)
+#define WLOCK_04					BIT(2)
+#define WLOCK_08					BIT(3)
+#define WLOCK_40					BIT(4)
+#define R_DIS_PRST_0				BIT(5)
+#define R_DIS_PRST_1				BIT(6)
+#define LOCK_ALL_EN					BIT(7)
+
+//2 RF_CTRL
+#define RF_EN						BIT(0)
+#define RF_RSTB						BIT(1)
+#define RF_SDMRSTB					BIT(2)
+
+
+
+//2 LDOA15_CTRL
+#define LDA15_EN					BIT(0)
+#define LDA15_STBY					BIT(1)
+#define LDA15_OBUF					BIT(2)
+#define LDA15_REG_VOS				BIT(3)
+#define _LDA15_VOADJ(x)				(((x) & 0x7) << 4)
+
+
+
+//2 LDOV12D_CTRL
+#define LDV12_EN					BIT(0)
+#define LDV12_SDBY					BIT(1)
+#define LPLDO_HSM					BIT(2)
+#define LPLDO_LSM_DIS				BIT(3)
+#define _LDV12_VADJ(x)				(((x) & 0xF) << 4)
+
+
+//2 AFE_XTAL_CTRL
+#define XTAL_EN						BIT(0)
+#define XTAL_BSEL					BIT(1)
+#define _XTAL_BOSC(x)				(((x) & 0x3) << 2)
+#define _XTAL_CADJ(x)				(((x) & 0xF) << 4)
+#define XTAL_GATE_USB				BIT(8)
+#define _XTAL_USB_DRV(x)			(((x) & 0x3) << 9)
+#define XTAL_GATE_AFE				BIT(11)
+#define _XTAL_AFE_DRV(x)			(((x) & 0x3) << 12)
+#define XTAL_RF_GATE				BIT(14)
+#define _XTAL_RF_DRV(x)				(((x) & 0x3) << 15)
+#define XTAL_GATE_DIG				BIT(17)
+#define _XTAL_DIG_DRV(x)			(((x) & 0x3) << 18)
+#define XTAL_BT_GATE				BIT(20)
+#define _XTAL_BT_DRV(x)				(((x) & 0x3) << 21)
+#define _XTAL_GPIO(x)				(((x) & 0x7) << 23)
+
+
+#define CKDLY_AFE					BIT(26)
+#define CKDLY_USB					BIT(27)
+#define CKDLY_DIG					BIT(28)
+#define CKDLY_BT					BIT(29)
+
+
+//2 AFE_PLL_CTRL
+#define APLL_EN						BIT(0)
+#define APLL_320_EN					BIT(1)
+#define APLL_FREF_SEL				BIT(2)
+#define APLL_EDGE_SEL				BIT(3)
+#define APLL_WDOGB					BIT(4)
+#define APLL_LPFEN					BIT(5)
+
+#define APLL_REF_CLK_13MHZ			0x1
+#define APLL_REF_CLK_19_2MHZ		0x2
+#define APLL_REF_CLK_20MHZ			0x3
+#define APLL_REF_CLK_25MHZ			0x4
+#define APLL_REF_CLK_26MHZ			0x5
+#define APLL_REF_CLK_38_4MHZ		0x6
+#define APLL_REF_CLK_40MHZ			0x7
+
+#define APLL_320EN					BIT(14)
+#define APLL_80EN					BIT(15)
+#define APLL_1MEN					BIT(24)
+
+
+//2 EFUSE_CTRL
+#define ALD_EN						BIT(18)
+#define EF_PD						BIT(19)
+#define EF_FLAG						BIT(31)
+
+//2 EFUSE_TEST
+#define EF_TRPT						BIT(7)
+#define LDOE25_EN					BIT(31)
+
+//2 PWR_DATA
+
+//2 CAL_TIMER
+
+//2 ACLK_MON
+#define RSM_EN						BIT(0)
+#define Timer_EN						BIT(4)
+
+
+//2 GPIO_MUXCFG
+#define TRSW0EN						BIT(2)
+#define TRSW1EN						BIT(3)
+#define EROM_EN						BIT(4)
+#define EnBT							BIT(5)
+#define EnUart						BIT(8)
+#define Uart_910						BIT(9)
+#define EnPMAC						BIT(10)
+#define SIC_SWRST					BIT(11)
+#define EnSIC						BIT(12)
+#define SIC_23						BIT(13)
+#define EnHDP						BIT(14)
+#define SIC_LBK						BIT(15)
+
+//2 GPIO_PIN_CTRL
+
+
+
+//2 GPIO_INTM
+
+//2 LEDCFG
+#define LED0PL 					BIT(4)
+#define LED1PL 					BIT(12)
+#define LED0DIS					BIT(7)
+
+#define  SECCAM_CLR				BIT(30)
+
+//2 FSIMR
+
+//2 FSISR
+
+
+//2 8051FWDL
+//2 MCUFWDL
+#define MCUFWDL_EN					BIT(0)
+#define MCUFWDL_RDY				BIT(1)
+#define FWDL_ChkSum_rpt			BIT(2)
+#define MACINI_RDY					BIT(3)
+#define BBINI_RDY					BIT(4)
+#define RFINI_RDY					BIT(5)
+#define WINTINI_RDY					BIT(6)
+#define MAC1_WINTINI_RDY			BIT(11)// 0X81 BIT3
+#define CPRST						BIT(23)
+
+
+
+
+//2 REG_SYS_CFG
+#define XCLK_VLD						BIT(0)
+#define ACLK_VLD					BIT(1)
+#define UCLK_VLD					BIT(2)
+#define PCLK_VLD						BIT(3)
+#define PCIRSTB						BIT(4)
+#define V15_VLD						BIT(5)
+#define TRP_B15V_EN					BIT(7)
+#define SIC_IDLE						BIT(8)
+#define BD_MAC2						BIT(9)
+#define BD_MAC1						BIT(10)
+#define IC_MACPHY_MODE				BIT(11)
+#define PAD_HWPD_IDN				BIT(22)
+#define TRP_VAUX_EN					BIT(23)
+#define TRP_BT_EN					BIT(24)
+#define BD_PKG_SEL					BIT(25)
+#define BD_HCI_SEL					BIT(26)
+#define TYPE_ID						BIT(27)
+
+#define CHIP_VER_RTL_MASK			0xF000	//Bit 12 ~ 15
+#define CHIP_VER_RTL_SHIFT			12
+
+//-----------------------------------------------------
+//
+//	0x0100h ~ 0x01FFh	MACTOP General Configuration
+//
+//-----------------------------------------------------
+
+
+//2 Function Enable Registers
+//2 CR
+
+#define REG_LBMODE					(REG_CR + 3)
+
+
+#define HCI_TXDMA_EN				BIT(0)
+#define HCI_RXDMA_EN				BIT(1)
+#define TXDMA_EN					BIT(2)
+#define RXDMA_EN					BIT(3)
+#define PROTOCOL_EN					BIT(4)
+#define SCHEDULE_EN					BIT(5)
+#define MACTXEN						BIT(6)
+#define MACRXEN						BIT(7)
+#define ENSWBCN						BIT(8)
+#define ENSEC						BIT(9)
+
+// Network type
+#define _NETTYPE(x)					(((x) & 0x3) << 16)
+#define MASK_NETTYPE				0x30000
+#define NT_NO_LINK					0x0
+#define NT_LINK_AD_HOC				0x1
+#define NT_LINK_AP					0x2
+#define NT_AS_AP					0x3
+
+#define _LBMODE(x)					(((x) & 0xF) << 24)
+#define MASK_LBMODE				0xF000000
+#define LOOPBACK_NORMAL			0x0
+#define LOOPBACK_IMMEDIATELY		0xB
+#define LOOPBACK_MAC_DELAY		0x3
+#define LOOPBACK_PHY				0x1
+#define LOOPBACK_DMA				0x7
+
+
+//2 PBP - Page Size Register
+#define GET_RX_PAGE_SIZE(value)		((value) & 0xF)
+#define GET_TX_PAGE_SIZE(value)		(((value) & 0xF0) >> 4)
+#define _PSRX_MASK					0xF
+#define _PSTX_MASK					0xF0
+#define _PSRX(x)						(x)
+#define _PSTX(x)						((x) << 4)
+
+#define PBP_64						0x0
+#define PBP_128						0x1
+#define PBP_256						0x2
+#define PBP_512						0x3
+#define PBP_1024					0x4
+
+
+//2 TX/RXDMA
+#define RXDMA_ARBBW_EN			BIT(0)
+#define RXSHFT_EN					BIT(1)
+#define RXDMA_AGG_EN				BIT(2)
+#define QS_VO_QUEUE				BIT(8)
+#define QS_VI_QUEUE					BIT(9)
+#define QS_BE_QUEUE				BIT(10)
+#define QS_BK_QUEUE				BIT(11)
+#define QS_MANAGER_QUEUE			BIT(12)
+#define QS_HIGH_QUEUE				BIT(13)
+
+#define HQSEL_VOQ					BIT(0)
+#define HQSEL_VIQ					BIT(1)
+#define HQSEL_BEQ					BIT(2)
+#define HQSEL_BKQ					BIT(3)
+#define HQSEL_MGTQ					BIT(4)
+#define HQSEL_HIQ					BIT(5)
+
+// For normal driver, 0x10C
+#define _TXDMA_HIQ_MAP(x) 	 		(((x)&0x3) << 14)
+#define _TXDMA_MGQ_MAP(x) 	 		(((x)&0x3) << 12)
+#define _TXDMA_BKQ_MAP(x) 	 		(((x)&0x3) << 10)
+#define _TXDMA_BEQ_MAP(x) 	 		(((x)&0x3) << 8 )
+#define _TXDMA_VIQ_MAP(x) 	 		(((x)&0x3) << 6 )
+#define _TXDMA_VOQ_MAP(x) 	 		(((x)&0x3) << 4 )
+
+#define QUEUE_LOW					1
+#define QUEUE_NORMAL				2
+#define QUEUE_HIGH					3
+
+
+
+//2 TRXFF_BNDY
+
+
+//2 LLT_INIT
+#define _LLT_NO_ACTIVE				0x0
+#define _LLT_WRITE_ACCESS			0x1
+#define _LLT_READ_ACCESS			0x2
+
+#define _LLT_INIT_DATA(x)			((x) & 0xFF)
+#define _LLT_INIT_ADDR(x)			(((x) & 0xFF) << 8)
+#define _LLT_OP(x)					(((x) & 0x3) << 30)
+#define _LLT_OP_VALUE(x)			(((x) >> 30) & 0x3)
+
+
+//2 BB_ACCESS_CTRL
+#define BB_WRITE_READ_MASK		(BIT(31) | BIT(30))
+#define BB_WRITE_EN					BIT(30)
+#define BB_READ_EN					BIT(31)
+//#define BB_ADDR_MASK				0xFFF
+//#define _BB_ADDR(x)					((x) & BB_ADDR_MASK)
+
+//-----------------------------------------------------
+//
+//	0x0200h ~ 0x027Fh	TXDMA Configuration
+//
+//-----------------------------------------------------
+//2 RQPN
+#define _HPQ(x)						((x) & 0xFF)
+#define _LPQ(x)						(((x) & 0xFF) << 8)
+#define _PUBQ(x)						(((x) & 0xFF) << 16)
+#define _NPQ(x)						((x) & 0xFF)			// NOTE: in RQPN_NPQ register
+
+
+#define HPQ_PUBLIC_DIS				BIT(24)
+#define LPQ_PUBLIC_DIS				BIT(25)
+#define LD_RQPN						BIT(31)
+
+
+//2 TDECTRL
+#define BCN_VALID					BIT(16)
+#define BCN_HEAD(x)					(((x) & 0xFF) << 8)
+#define	BCN_HEAD_MASK				0xFF00
+
+//2 TDECTL
+#define BLK_DESC_NUM_SHIFT			4
+#define BLK_DESC_NUM_MASK			0xF
+
+
+//2 TXDMA_OFFSET_CHK
+#define DROP_DATA_EN				BIT(9)
+
+//-----------------------------------------------------
+//
+//	0x0400h ~ 0x047Fh	Protocol Configuration
+//
+//-----------------------------------------------------
+//2 FWHW_TXQ_CTRL
+#define EN_AMPDU_RTY_NEW			BIT(7)
+
+//2 INIRTSMCS_SEL
+#define _INIRTSMCS_SEL(x)			((x) & 0x3F)
+
+
+//2 SPEC SIFS
+#define _SPEC_SIFS_CCK(x)			((x) & 0xFF)
+#define _SPEC_SIFS_OFDM(x)			(((x) & 0xFF) << 8)
+
+
+//2 RRSR
+
+#define RATE_REG_BITMAP_ALL			0xFFFFF
+
+#define _RRSC_BITMAP(x)					((x) & 0xFFFFF)
+
+#define _RRSR_RSC(x)						(((x) & 0x3) << 21)
+#define RRSR_RSC_RESERVED				0x0
+#define RRSR_RSC_UPPER_SUBCHANNEL	0x1
+#define RRSR_RSC_LOWER_SUBCHANNEL	0x2
+#define RRSR_RSC_DUPLICATE_MODE		0x3
+
+
+//2 ARFR
+#define USE_SHORT_G1				BIT(20)
+
+//2 AGGLEN_LMT_L
+#define _AGGLMT_MCS0(x)				((x) & 0xF)
+#define _AGGLMT_MCS1(x)				(((x) & 0xF) << 4)
+#define _AGGLMT_MCS2(x)				(((x) & 0xF) << 8)
+#define _AGGLMT_MCS3(x)				(((x) & 0xF) << 12)
+#define _AGGLMT_MCS4(x)				(((x) & 0xF) << 16)
+#define _AGGLMT_MCS5(x)				(((x) & 0xF) << 20)
+#define _AGGLMT_MCS6(x)				(((x) & 0xF) << 24)
+#define _AGGLMT_MCS7(x)				(((x) & 0xF) << 28)
+
+
+//2 RL
+#define	RETRY_LIMIT_SHORT_SHIFT		8
+#define	RETRY_LIMIT_LONG_SHIFT		0
+
+
+//2 DARFRC
+#define _DARF_RC1(x)				((x) & 0x1F)
+#define _DARF_RC2(x)				(((x) & 0x1F) << 8)
+#define _DARF_RC3(x)				(((x) & 0x1F) << 16)
+#define _DARF_RC4(x)				(((x) & 0x1F) << 24)
+// NOTE: shift starting from address (DARFRC + 4)
+#define _DARF_RC5(x)				((x) & 0x1F)
+#define _DARF_RC6(x)				(((x) & 0x1F) << 8)
+#define _DARF_RC7(x)				(((x) & 0x1F) << 16)
+#define _DARF_RC8(x)				(((x) & 0x1F) << 24)
+
+
+//2 RARFRC
+#define _RARF_RC1(x)				((x) & 0x1F)
+#define _RARF_RC2(x)				(((x) & 0x1F) << 8)
+#define _RARF_RC3(x)				(((x) & 0x1F) << 16)
+#define _RARF_RC4(x)				(((x) & 0x1F) << 24)
+// NOTE: shift starting from address (RARFRC + 4)
+#define _RARF_RC5(x)				((x) & 0x1F)
+#define _RARF_RC6(x)				(((x) & 0x1F) << 8)
+#define _RARF_RC7(x)				(((x) & 0x1F) << 16)
+#define _RARF_RC8(x)				(((x) & 0x1F) << 24)
+
+
+
+
+//-----------------------------------------------------
+//
+//	0x0500h ~ 0x05FFh	EDCA Configuration
+//
+//-----------------------------------------------------
+
+
+
+//2 EDCA setting
+#define AC_PARAM_TXOP_LIMIT_OFFSET	16
+#define AC_PARAM_ECW_MAX_OFFSET		12
+#define AC_PARAM_ECW_MIN_OFFSET		8
+#define AC_PARAM_AIFS_OFFSET			0
+
+
+//2 EDCA_VO_PARAM
+#define _AIFS(x)						(x)
+#define _ECW_MAX_MIN(x)			((x) << 8)
+#define _TXOP_LIMIT(x)				((x) << 16)
+
+
+#define _BCNIFS(x)					((x) & 0xFF)
+#define _BCNECW(x)					(((x) & 0xF))<< 8)
+
+
+#define _LRL(x)						((x) & 0x3F)
+#define _SRL(x)						(((x) & 0x3F) << 8)
+
+
+//2 SIFS_CCK
+#define _SIFS_CCK_CTX(x)			((x) & 0xFF)
+#define _SIFS_CCK_TRX(x)			(((x) & 0xFF) << 8);
+
+
+//2 SIFS_OFDM
+#define _SIFS_OFDM_CTX(x)			((x) & 0xFF)
+#define _SIFS_OFDM_TRX(x)			(((x) & 0xFF) << 8);
+
+
+//2 TBTT PROHIBIT
+#define _TBTT_PROHIBIT_HOLD(x)		(((x) & 0xFF) << 8)
+
+
+//2 REG_RD_CTRL
+#define DIS_EDCA_CNT_DWN			BIT(11)
+
+
+//2 BCN_CTRL
+#define EN_MBSSID						BIT(1)
+#define EN_TXBCN_RPT					BIT(2)
+#define EN_BCN_FUNCTION				BIT(3)
+// The same function but different bit field.
+#define DIS_TSF_UDT0_NORMAL_CHIP		BIT(4)
+#define DIS_TSF_UDT0_TEST_CHIP		BIT(5)
+
+//2 ACMHWCTRL
+#define	AcmHw_HwEn					BIT(0)
+#define	AcmHw_BeqEn					BIT(1)
+#define	AcmHw_ViqEn					BIT(2)
+#define	AcmHw_VoqEn					BIT(3)
+#define	AcmHw_BeqStatus				BIT(4)
+#define	AcmHw_ViqStatus				BIT(5)
+#define	AcmHw_VoqStatus				BIT(6)
+
+
+
+//-----------------------------------------------------
+//
+//	0x0600h ~ 0x07FFh	WMAC Configuration
+//
+//-----------------------------------------------------
+
+//2 APSD_CTRL
+#define APSDOFF						BIT(6)
+#define APSDOFF_STATUS				BIT(7)
+
+
+//2 BWOPMODE
+#define BW_20MHZ					BIT(2)
+//#define BW_OPMODE_20MHZ				BIT(2)	// For compability
+
+
+#define RATE_BITMAP_ALL			0xFFFFF
+
+// Only use CCK 1M rate for ACK
+#define RATE_RRSR_CCK_ONLY_1M		0xFFFF1
+#define RATE_RRSR_WITHOUT_CCK		0xFFFF0
+
+//2 TCR
+#define TSFRST						BIT(0)
+#define DIS_GCLK						BIT(1)
+#define PAD_SEL						BIT(2)
+#define PWR_ST						BIT(6)
+#define PWRBIT_OW_EN				BIT(7)
+#define ACRC							BIT(8)
+#define CFENDFORM					BIT(9)
+#define ICV							BIT(10)
+
+
+
+//2 RCR
+#define AAP							BIT(0)
+#define APM							BIT(1)
+#define AM							BIT(2)
+#define AB							BIT(3)
+#define ADD3							BIT(4)
+#define APWRMGT					BIT(5)
+#define CBSSID						BIT(6)
+#define CBSSID_BCN					BIT(7)
+#define ACRC32						BIT(8)
+#define AICV							BIT(9)
+#define ADF							BIT(11)
+#define ACF							BIT(12)
+#define AMF							BIT(13)
+#define HTC_LOC_CTRL				BIT(14)
+#define UC_DATA_EN					BIT(16)
+#define BM_DATA_EN					BIT(17)
+#define MFBEN						BIT(22)
+#define LSIGEN						BIT(23)
+#define EnMBID						BIT(24)
+#define APP_BASSN					BIT(27)
+#define APP_PHYSTS					BIT(28)
+#define APP_ICV						BIT(29)
+#define APP_MIC						BIT(30)
+#define APP_FCS						BIT(31)
+
+//2 RX_PKT_LIMIT
+
+//2 RX_DLK_TIME
+
+//2 MBIDCAMCFG
+
+
+
+//2 AMPDU_MIN_SPACE
+#define _MIN_SPACE(x)				((x) & 0x7)
+#define _SHORT_GI_PADDING(x)		(((x) & 0x1F) << 3)
+
+
+//2 RXERR_RPT
+#define RXERR_TYPE_OFDM_PPDU			0
+#define RXERR_TYPE_OFDM_FALSE_ALARM	1
+#define RXERR_TYPE_OFDM_MPDU_OK		2
+#define RXERR_TYPE_OFDM_MPDU_FAIL	3
+#define RXERR_TYPE_CCK_PPDU			4
+#define RXERR_TYPE_CCK_FALSE_ALARM	5
+#define RXERR_TYPE_CCK_MPDU_OK		6
+#define RXERR_TYPE_CCK_MPDU_FAIL		7
+#define RXERR_TYPE_HT_PPDU				8
+#define RXERR_TYPE_HT_FALSE_ALARM	9
+#define RXERR_TYPE_HT_MPDU_TOTAL		10
+#define RXERR_TYPE_HT_MPDU_OK			11
+#define RXERR_TYPE_HT_MPDU_FAIL		12
+#define RXERR_TYPE_RX_FULL_DROP		15
+
+#define RXERR_COUNTER_MASK			0xFFFFF
+#define RXERR_RPT_RST					BIT(27)
+#define _RXERR_RPT_SEL(type)			((type) << 28)
+
+
+//2 SECCFG
+#define	SCR_TxUseDK					BIT(0)			//Force Tx Use Default Key
+#define	SCR_RxUseDK					BIT(1)			//Force Rx Use Default Key
+#define	SCR_TxEncEnable				BIT(2)			//Enable Tx Encryption
+#define	SCR_RxDecEnable				BIT(3)			//Enable Rx Decryption
+#define	SCR_SKByA2						BIT(4)			//Search kEY BY A2
+#define	SCR_NoSKMC						BIT(5)			//No Key Search Multicast
+#define 	SCR_TXBCUSEDK					BIT(6)			// Force Tx Broadcast packets Use Default Key
+#define 	SCR_RXBCUSEDK					BIT(7)			// Force Rx Broadcast packets Use Default Key
+
+//vivi added for new cam search flow, 20091028
+#ifdef HW_EN_DE_CRYPTION_FOR_NEW_CAM_SEARCH_FLOW
+#define	SCR_TxUseBroadcastDK			BIT6			//Force Tx Use Broadcast Default Key
+#define	SCR_RxUseBroadcastDK			BIT7			//Force Rx Use Broadcast Default Key
+#endif
+
+
+//-----------------------------------------------------
+//
+//	0xFE00h ~ 0xFE55h	USB Configuration
+//
+//-----------------------------------------------------
+
+//2 USB Information (0xFE17)
+#define USB_IS_HIGH_SPEED				0
+#define USB_IS_FULL_SPEED				1
+#define USB_SPEED_MASK					BIT(5)
+
+#define USB_NORMAL_SIE_EP_MASK		0xF
+#define USB_NORMAL_SIE_EP_SHIFT		4
+
+#define USB_TEST_EP_MASK				0x30
+#define USB_TEST_EP_SHIFT				4
+
+//2 Special Option
+#define USB_AGG_EN						BIT(3)
+
+
+//2REG_C2HEVT_CLEAR
+#define C2H_EVT_HOST_CLOSE				0x00	// Set by driver and notify FW that the driver has read the C2H command message
+#define C2H_EVT_FW_CLOSE				0xFF	// Set by FW indicating that FW had set the C2H command message and it's not yet read by driver.
+
+//2 8192D PartNo.
+#define		PARTNO_92D_NIC			(BIT7|BIT6)
+#define		PARTNO_92D_NIC_REMARK (BIT5|BIT4)
+#define		PARTNO_SINGLE_BAND_VS  BIT3
+#define		PARTNO_SINGLE_BAND_VS_REMARK BIT1
+#define		PARTNO_CONCURRENT_BAND_VC (BIT3|BIT2)
+#define		PARTNO_CONCURRENT_BAND_VC_REMARK (BIT1|BIT0)
+//========================================================
+// General definitions
+//========================================================
+
+#define MAC_ADDR_LEN						6
+#define LAST_ENTRY_OF_TX_PKT_BUFFER		255
+#define LAST_ENTRY_OF_TX_PKT_BUFFER_DUAL_MAC	127
+
+#define POLLING_LLT_THRESHOLD				20
+#define POLLING_READY_TIMEOUT_COUNT		1000
+
+// Min Spacing related settings.
+#define	MAX_MSS_DENSITY_2T				0x13
+#define	MAX_MSS_DENSITY_1T				0x0A
+// GPIO BIT
+#define	HAL_8192C_HW_GPIO_WPS_BIT		BIT2
+
+
+#include "basic_types.h"
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_xmit.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_xmit.h
new file mode 100644
index 000000000000..bc651c1de4f3
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtl8192d_xmit.h
@@ -0,0 +1,144 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTL8192D_XMIT_H_
+#define _RTL8192D_XMIT_H_
+
+//
+// Queue Select Value in TxDesc
+//
+#define QSLT_BK							0x2//0x01
+#define QSLT_BE							0x0
+#define QSLT_VI							0x5//0x4
+#define QSLT_VO							0x7//0x6
+#define QSLT_BEACON						0x10
+#define QSLT_HIGH						0x11
+#define QSLT_MGNT						0x12
+#define QSLT_CMD						0x13
+
+//Because we open EM for normal case, we just always insert 2*8 bytes.by wl
+#define USB_92D_DUMMY_OFFSET		2
+#define USB_92D_DUMMY_LENGTH		(USB_92D_DUMMY_OFFSET * PACKET_OFFSET_SZ)
+#define USB_HWDESC_HEADER_LEN	(TXDESC_SIZE + USB_92D_DUMMY_LENGTH)
+
+//For 92D early mode
+#define SET_EARLYMODE_PKTNUM(__pAddr, __Value) SET_BITS_TO_LE_4BYTE(__pAddr, 0, 3, __Value)
+#define SET_EARLYMODE_LEN0(__pAddr, __Value) SET_BITS_TO_LE_4BYTE(__pAddr, 4, 12, __Value)
+#define SET_EARLYMODE_LEN1(__pAddr, __Value) SET_BITS_TO_LE_4BYTE(__pAddr, 16, 12, __Value)
+#define SET_EARLYMODE_LEN2_1(__pAddr, __Value) SET_BITS_TO_LE_4BYTE(__pAddr, 28, 4, __Value)
+#define SET_EARLYMODE_LEN2_2(__pAddr, __Value) SET_BITS_TO_LE_4BYTE(__pAddr+4, 0, 8, __Value)
+#define SET_EARLYMODE_LEN3(__pAddr, __Value) SET_BITS_TO_LE_4BYTE(__pAddr+4, 8, 12, __Value)
+#define SET_EARLYMODE_LEN4(__pAddr, __Value) SET_BITS_TO_LE_4BYTE(__pAddr+4, 20, 12, __Value)
+
+/* Copy from rtl8192c */
+struct txrpt_ccx_8192d {
+	/* offset 0 */
+	u8 retry_cnt:6;
+	u8 rsvd_0:2;
+
+	/* offset 1 */
+	u8 rts_retry_cnt:6;
+	u8 rsvd_1:2;
+
+	/* offset 2 */
+	u8 ccx_qtime0;
+	u8 ccx_qtime1;
+
+	/* offset 4 */
+	u8 missed_pkt_num:5;
+	u8 rsvd_4:3;
+
+	/* offset 5 */
+	u8 mac_id:5;
+	u8 des1_fragssn:3;
+
+	/* offset 6 */
+	u8 rpt_pkt_num:5;
+	u8 pkt_drop:1;
+	u8 lifetime_over:1;
+	u8 retry_over:1;
+
+	/* offset 7*/
+	u8 edca_tx_queue:4;
+	u8 rsvd_7:1;
+	u8 bmc:1;
+	u8 pkt_ok:1;
+	u8 int_ccx:1;
+};
+
+#define txrpt_ccx_qtime_8192d(txrpt_ccx) ((txrpt_ccx)->ccx_qtime0+((txrpt_ccx)->ccx_qtime1<<8))
+
+#ifdef CONFIG_XMIT_ACK
+void dump_txrpt_ccx_8192d(void *buf);
+void handle_txrpt_ccx_8192d(_adapter *adapter, void *buf);
+#else
+#define dump_txrpt_ccx_8192d(buf) do {} while(0)
+#define handle_txrpt_ccx_8192d(adapter, buf) do {} while(0)
+#endif
+
+#ifdef CONFIG_USB_HCI
+
+#ifdef CONFIG_USB_TX_AGGREGATION
+#define MAX_TX_AGG_PACKET_NUMBER 0xFF
+#endif
+
+s32	rtl8192du_init_xmit_priv(_adapter * padapter);
+
+void	rtl8192du_free_xmit_priv(_adapter * padapter);
+
+void rtl8192du_cal_txdesc_chksum(struct tx_desc	*ptxdesc);
+
+s32 rtl8192du_xmitframe_complete(_adapter *padapter, struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf);
+
+s32 rtl8192du_mgnt_xmit(_adapter *padapter, struct xmit_frame *pmgntframe);
+
+s32 rtl8192du_hal_xmit(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+s32	 rtl8192du_hal_xmitframe_enqueue(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+
+#ifdef CONFIG_HOSTAPD_MLME
+s32	rtl8192du_hostap_mgnt_xmit_entry(_adapter *padapter, _pkt *pkt);
+#endif
+
+#endif
+
+#ifdef CONFIG_PCI_HCI
+s32	rtl8192de_init_xmit_priv(_adapter * padapter);
+void	rtl8192de_free_xmit_priv(_adapter * padapter);
+
+s32	rtl8192de_enqueue_xmitbuf(struct rtw_tx_ring *ring, struct xmit_buf *pxmitbuf);
+struct xmit_buf *rtl8192de_dequeue_xmitbuf(struct rtw_tx_ring *ring);
+
+void	rtl8192de_xmitframe_resume(_adapter *padapter);
+
+s32	rtl8192de_mgnt_xmit(_adapter *padapter, struct xmit_frame *pmgntframe);
+
+s32	rtl8192de_hal_xmit(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+s32	 rtl8192de_hal_xmitframe_enqueue(_adapter *padapter, struct xmit_frame *pxmitframe);
+
+#ifdef CONFIG_HOSTAPD_MLME
+s32	rtl8192de_hostap_mgnt_xmit_entry(_adapter *padapter, _pkt *pkt);
+#endif
+
+#endif
+
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_android.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_android.h
new file mode 100644
index 000000000000..468ae77692b0
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_android.h
@@ -0,0 +1,89 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#ifndef __RTW_ANDROID_H__
+#define __RTW_ANDROID_H__
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+
+enum ANDROID_WIFI_CMD {
+	ANDROID_WIFI_CMD_START,
+	ANDROID_WIFI_CMD_STOP,
+	ANDROID_WIFI_CMD_SCAN_ACTIVE,
+	ANDROID_WIFI_CMD_SCAN_PASSIVE,
+	ANDROID_WIFI_CMD_RSSI,
+	ANDROID_WIFI_CMD_LINKSPEED,
+	ANDROID_WIFI_CMD_RXFILTER_START,
+	ANDROID_WIFI_CMD_RXFILTER_STOP,
+	ANDROID_WIFI_CMD_RXFILTER_ADD,
+	ANDROID_WIFI_CMD_RXFILTER_REMOVE,
+	ANDROID_WIFI_CMD_BTCOEXSCAN_START,
+	ANDROID_WIFI_CMD_BTCOEXSCAN_STOP,
+	ANDROID_WIFI_CMD_BTCOEXMODE,
+	ANDROID_WIFI_CMD_SETSUSPENDOPT,
+	ANDROID_WIFI_CMD_P2P_DEV_ADDR,
+	ANDROID_WIFI_CMD_SETFWPATH,
+	ANDROID_WIFI_CMD_SETBAND,
+	ANDROID_WIFI_CMD_GETBAND,
+	ANDROID_WIFI_CMD_COUNTRY,
+	ANDROID_WIFI_CMD_P2P_SET_NOA,
+	ANDROID_WIFI_CMD_P2P_GET_NOA,
+	ANDROID_WIFI_CMD_P2P_SET_PS,
+	ANDROID_WIFI_CMD_SET_AP_WPS_P2P_IE,
+#ifdef PNO_SUPPORT
+	ANDROID_WIFI_CMD_PNOSSIDCLR_SET,
+	ANDROID_WIFI_CMD_PNOSETUP_SET,
+	ANDROID_WIFI_CMD_PNOENABLE_SET,
+	ANDROID_WIFI_CMD_PNODEBUG_SET,
+#endif
+
+	ANDROID_WIFI_CMD_MACADDR,
+
+	ANDROID_WIFI_CMD_BLOCK,
+
+	ANDROID_WIFI_CMD_WFD_ENABLE,
+	ANDROID_WIFI_CMD_WFD_DISABLE,
+
+	ANDROID_WIFI_CMD_WFD_SET_TCPPORT,
+	ANDROID_WIFI_CMD_WFD_SET_MAX_TPUT,
+	ANDROID_WIFI_CMD_WFD_SET_DEVTYPE,
+
+	ANDROID_WIFI_CMD_MAX
+};
+
+int rtw_android_cmdstr_to_num(char *cmdstr);
+int rtw_android_priv_cmd(struct net_device *net, struct ifreq *ifr, int cmd);
+
+#if defined(RTW_ENABLE_WIFI_CONTROL_FUNC)
+int rtw_android_wifictrl_func_add(void);
+void rtw_android_wifictrl_func_del(void);
+void* wl_android_prealloc(int section, unsigned long size);
+
+int wifi_get_irq_number(unsigned long *irq_flags_ptr);
+int wifi_set_power(int on, unsigned long msec);
+int wifi_get_mac_addr(unsigned char *buf);
+void *wifi_get_country_code(char *ccode);
+#else
+static int rtw_android_wifictrl_func_add(void) { return 0; }
+static void rtw_android_wifictrl_func_del(void) {}
+#endif /* defined(RTW_ENABLE_WIFI_CONTROL_FUNC) */
+
+#endif //__RTW_ANDROID_H__
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ap.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ap.h
new file mode 100644
index 000000000000..12651741fc5f
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ap.h
@@ -0,0 +1,63 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_AP_H_
+#define __RTW_AP_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+#ifdef CONFIG_AP_MODE
+
+//external function
+extern void rtw_indicate_sta_assoc_event(_adapter *padapter, struct sta_info *psta);
+extern void rtw_indicate_sta_disassoc_event(_adapter *padapter, struct sta_info *psta);
+
+
+void init_mlme_ap_info(_adapter *padapter);
+void free_mlme_ap_info(_adapter *padapter);
+//void update_BCNTIM(_adapter *padapter);
+void rtw_add_bcn_ie(_adapter *padapter, WLAN_BSSID_EX *pnetwork, u8 index, u8 *data, u8 len);
+void rtw_remove_bcn_ie(_adapter *padapter, WLAN_BSSID_EX *pnetwork, u8 index);
+void update_beacon(_adapter *padapter, u8 ie_id, u8 *oui, u8 tx);
+void expire_timeout_chk(_adapter *padapter);
+void update_sta_info_apmode(_adapter *padapter, struct sta_info *psta);
+int rtw_check_beacon_data(_adapter *padapter, u8 *pbuf,  int len);
+void rtw_ap_restore_network(_adapter *padapter);
+void rtw_set_macaddr_acl(_adapter *padapter, int mode);
+int rtw_acl_add_sta(_adapter *padapter, u8 *addr);
+int rtw_acl_remove_sta(_adapter *padapter, u8 *addr);
+
+#ifdef CONFIG_NATIVEAP_MLME
+void associated_clients_update(_adapter *padapter, u8 updated);
+void bss_cap_update_on_sta_join(_adapter *padapter, struct sta_info *psta);
+u8 bss_cap_update_on_sta_leave(_adapter *padapter, struct sta_info *psta);
+void sta_info_update(_adapter *padapter, struct sta_info *psta);
+void ap_sta_info_defer_update(_adapter *padapter, struct sta_info *psta);
+u8 ap_free_sta(_adapter *padapter, struct sta_info *psta, bool active, u16 reason);
+int rtw_sta_flush(_adapter *padapter);
+int rtw_ap_inform_ch_switch(_adapter *padapter, u8 new_ch, u8 ch_offset);
+void start_ap_mode(_adapter *padapter);
+void stop_ap_mode(_adapter *padapter);
+#endif
+#endif //end of CONFIG_AP_MODE
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_br_ext.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_br_ext.h
new file mode 100644
index 000000000000..1b5709a57924
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_br_ext.h
@@ -0,0 +1,75 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_BR_EXT_H_
+#define _RTW_BR_EXT_H_
+
+#if 1	// rtw_wifi_driver
+#define CL_IPV6_PASS    	1
+#define MACADDRLEN		6
+#define _DEBUG_ERR		printk
+#define _DEBUG_INFO		//printk
+#define DEBUG_WARN		printk
+#define DEBUG_INFO		//printk
+#define DEBUG_ERR		printk
+//#define GET_MY_HWADDR		((GET_MIB(priv))->dot11OperationEntry.hwaddr)
+#define GET_MY_HWADDR(padapter)		((padapter)->eeprompriv.mac_addr)
+#endif	// rtw_wifi_driver
+
+#define NAT25_HASH_BITS		4
+#define NAT25_HASH_SIZE		(1 << NAT25_HASH_BITS)
+#define NAT25_AGEING_TIME	300
+
+#ifdef CL_IPV6_PASS
+#define MAX_NETWORK_ADDR_LEN	17
+#else
+#define MAX_NETWORK_ADDR_LEN	11
+#endif
+
+struct nat25_network_db_entry
+{
+	struct nat25_network_db_entry	*next_hash;
+	struct nat25_network_db_entry	**pprev_hash;
+	atomic_t						use_count;
+	unsigned char					macAddr[6];
+	unsigned long					ageing_timer;
+	unsigned char    				networkAddr[MAX_NETWORK_ADDR_LEN];
+};
+
+enum NAT25_METHOD {
+	NAT25_MIN,
+	NAT25_CHECK,
+	NAT25_INSERT,
+	NAT25_LOOKUP,
+	NAT25_PARSE,
+	NAT25_MAX
+};
+
+struct br_ext_info {
+	unsigned int	nat25_disable;
+	unsigned int	macclone_enable;
+	unsigned int	dhcp_bcst_disable;
+	int		addPPPoETag;		// 1: Add PPPoE relay-SID, 0: disable
+	unsigned char	nat25_dmzMac[MACADDRLEN];
+	unsigned int	nat25sc_disable;
+};
+
+void nat25_db_cleanup(_adapter *priv);
+
+#endif // _RTW_BR_EXT_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_byteorder.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_byteorder.h
new file mode 100644
index 000000000000..757b01d96dbc
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_byteorder.h
@@ -0,0 +1,39 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTL871X_BYTEORDER_H_
+#define _RTL871X_BYTEORDER_H_
+
+#include <drv_conf.h>
+
+#if defined (CONFIG_LITTLE_ENDIAN) && defined (CONFIG_BIG_ENDIAN)
+#error "Shall be CONFIG_LITTLE_ENDIAN or CONFIG_BIG_ENDIAN, but not both!\n"
+#endif
+
+#if defined (CONFIG_LITTLE_ENDIAN)
+#ifndef CONFIG_PLATFORM_MSTAR389
+#  include <byteorder/little_endian.h>
+#endif
+#elif defined (CONFIG_BIG_ENDIAN)
+#  include <byteorder/big_endian.h>
+#else
+#  error "Must be LITTLE/BIG Endian Host"
+#endif
+
+#endif /* _RTL871X_BYTEORDER_H_ */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_cmd.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_cmd.h
new file mode 100644
index 000000000000..525391138e5f
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_cmd.h
@@ -0,0 +1,1166 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_CMD_H_
+#define __RTW_CMD_H_
+
+#include <drv_conf.h>
+#include <wlan_bssdef.h>
+#include <rtw_rf.h>
+#include <rtw_led.h>
+
+#define C2H_MEM_SZ (16*1024)
+
+#ifndef CONFIG_RTL8711FW
+
+	#include <osdep_service.h>
+	#include <ieee80211.h> // <ieee80211/ieee80211.h>
+
+
+	#define FREE_CMDOBJ_SZ	128
+
+	#define MAX_CMDSZ	1024
+	#define MAX_RSPSZ	512
+	#define MAX_EVTSZ	1024
+
+#ifdef PLATFORM_OS_CE
+	#define CMDBUFF_ALIGN_SZ 4
+#else
+	#define CMDBUFF_ALIGN_SZ 512
+#endif
+
+	struct cmd_obj {
+		_adapter *padapter;
+		u16	cmdcode;
+		u8	res;
+		u8	*parmbuf;
+		u32	cmdsz;
+		u8	*rsp;
+		u32	rspsz;
+		//_sema 	cmd_sem;
+		_list	list;
+	};
+
+	struct cmd_priv {
+		_sema	cmd_queue_sema;
+		//_sema	cmd_done_sema;
+		_sema	terminate_cmdthread_sema;
+		_queue	cmd_queue;
+		u8	cmd_seq;
+		u8	*cmd_buf;	//shall be non-paged, and 4 bytes aligned
+		u8	*cmd_allocated_buf;
+		u8	*rsp_buf;	//shall be non-paged, and 4 bytes aligned
+		u8	*rsp_allocated_buf;
+		u32	cmd_issued_cnt;
+		u32	cmd_done_cnt;
+		u32	rsp_cnt;
+		u8 cmdthd_running;
+		u8 stop_req;
+		_adapter *padapter;
+	};
+
+#ifdef CONFIG_EVENT_THREAD_MODE
+	struct evt_obj {
+		u16	evtcode;
+		u8	res;
+		u8	*parmbuf;
+		u32	evtsz;
+		_list	list;
+	};
+#endif
+
+	struct	evt_priv {
+#ifdef CONFIG_EVENT_THREAD_MODE
+		_sema	evt_notify;
+		_sema	terminate_evtthread_sema;
+		_queue	evt_queue;
+#endif
+
+//#define CONFIG_C2H_WK
+#ifdef CONFIG_C2H_WK
+		_workitem c2h_wk;
+		bool c2h_wk_alive;
+		struct rtw_cbuf *c2h_queue;
+		#define C2H_QUEUE_MAX_LEN 10
+#endif
+
+#ifdef CONFIG_H2CLBK
+		_sema	lbkevt_done;
+		u8	lbkevt_limit;
+		u8	lbkevt_num;
+		u8	*cmdevt_parm;
+#endif
+		ATOMIC_T event_seq;
+		u8	*evt_buf;	//shall be non-paged, and 4 bytes aligned
+		u8	*evt_allocated_buf;
+		u32	evt_done_cnt;
+#ifdef CONFIG_SDIO_HCI
+		u8	*c2h_mem;
+		u8	*allocated_c2h_mem;
+#ifdef PLATFORM_OS_XP
+		PMDL	pc2h_mdl;
+#endif
+#endif
+
+	};
+
+#define init_h2fwcmd_w_parm_no_rsp(pcmd, pparm, code) \
+do {\
+	_rtw_init_listhead(&pcmd->list);\
+	pcmd->cmdcode = code;\
+	pcmd->parmbuf = (u8 *)(pparm);\
+	pcmd->cmdsz = sizeof (*pparm);\
+	pcmd->rsp = NULL;\
+	pcmd->rspsz = 0;\
+} while(0)
+
+struct c2h_evt_hdr {
+	u8 id:4;
+	u8 plen:4;
+	u8 seq;
+	u8 payload[0];
+};
+
+#define c2h_evt_exist(c2h_evt) ((c2h_evt)->id || (c2h_evt)->plen)
+
+extern u32 rtw_enqueue_cmd(struct cmd_priv *pcmdpriv, struct cmd_obj *obj);
+extern struct cmd_obj *rtw_dequeue_cmd(struct cmd_priv *pcmdpriv);
+extern void rtw_free_cmd_obj(struct cmd_obj *pcmd);
+
+#ifdef CONFIG_EVENT_THREAD_MODE
+extern u32 rtw_enqueue_evt(struct evt_priv *pevtpriv, struct evt_obj *obj);
+extern struct evt_obj *rtw_dequeue_evt(_queue *queue);
+extern void rtw_free_evt_obj(struct evt_obj *pcmd);
+#endif
+
+void rtw_stop_cmd_thread(_adapter *adapter);
+thread_return rtw_cmd_thread(thread_context context);
+
+extern u32 rtw_init_cmd_priv (struct cmd_priv *pcmdpriv);
+extern void rtw_free_cmd_priv (struct cmd_priv *pcmdpriv);
+
+extern u32 rtw_init_evt_priv (struct evt_priv *pevtpriv);
+extern void rtw_free_evt_priv (struct evt_priv *pevtpriv);
+extern void rtw_cmd_clr_isr(struct cmd_priv *pcmdpriv);
+extern void rtw_evt_notify_isr(struct evt_priv *pevtpriv);
+#ifdef CONFIG_P2P
+u8 p2p_protocol_wk_cmd(_adapter*padapter, int intCmdType );
+#endif //CONFIG_P2P
+
+#else
+	#include <ieee80211.h>
+#endif	/* CONFIG_RTL8711FW */
+
+enum rtw_drvextra_cmd_id
+{
+	NONE_WK_CID,
+	DYNAMIC_CHK_WK_CID,
+	DM_CTRL_WK_CID,
+	PBC_POLLING_WK_CID,
+	POWER_SAVING_CTRL_WK_CID,//IPS,AUTOSuspend
+	LPS_CTRL_WK_CID,
+	ANT_SELECT_WK_CID,
+	P2P_PS_WK_CID,
+	P2P_PROTO_WK_CID,
+	CHECK_HIQ_WK_CID,//for softap mode, check hi queue if empty
+	INTEl_WIDI_WK_CID,
+	C2H_WK_CID,
+	RESET_SECURITYPRIV, // add for CONFIG_IEEE80211W, none 11w also can use
+	FREE_ASSOC_RESOURCES, // add for CONFIG_IEEE80211W, none 11w also can use
+	MAX_WK_CID
+};
+
+enum LPS_CTRL_TYPE
+{
+	LPS_CTRL_SCAN=0,
+	LPS_CTRL_JOINBSS=1,
+	LPS_CTRL_CONNECT=2,
+	LPS_CTRL_DISCONNECT=3,
+	LPS_CTRL_SPECIAL_PACKET=4,
+};
+
+enum RFINTFS {
+	SWSI,
+	HWSI,
+	HWPI,
+};
+
+/*
+Caller Mode: Infra, Ad-HoC(C)
+
+Notes: To enter USB suspend mode
+
+Command Mode
+
+*/
+struct usb_suspend_parm {
+	u32 action;// 1: sleep, 0:resume
+};
+
+/*
+Caller Mode: Infra, Ad-HoC
+
+Notes: To join a known BSS.
+
+Command-Event Mode
+
+*/
+
+/*
+Caller Mode: Infra, Ad-Hoc
+
+Notes: To join the specified bss
+
+Command Event Mode
+
+*/
+struct joinbss_parm {
+	WLAN_BSSID_EX network;
+};
+
+/*
+Caller Mode: Infra, Ad-HoC(C)
+
+Notes: To disconnect the current associated BSS
+
+Command Mode
+
+*/
+struct disconnect_parm {
+	u32 deauth_timeout_ms;
+};
+
+/*
+Caller Mode: AP, Ad-HoC(M)
+
+Notes: To create a BSS
+
+Command Mode
+*/
+struct createbss_parm {
+	WLAN_BSSID_EX network;
+};
+
+/*
+Caller Mode: AP, Ad-HoC, Infra
+
+Notes: To set the NIC mode of RTL8711
+
+Command Mode
+
+The definition of mode:
+
+#define IW_MODE_AUTO	0	// Let the driver decides which AP to join
+#define IW_MODE_ADHOC	1	// Single cell network (Ad-Hoc Clients)
+#define IW_MODE_INFRA	2	// Multi cell network, roaming, ..
+#define IW_MODE_MASTER	3	// Synchronisation master or Access Point
+#define IW_MODE_REPEAT	4	// Wireless Repeater (forwarder)
+#define IW_MODE_SECOND	5	// Secondary master/repeater (backup)
+#define IW_MODE_MONITOR	6	// Passive monitor (listen only)
+
+*/
+struct	setopmode_parm {
+	u8	mode;
+	u8	rsvd[3];
+};
+
+/*
+Caller Mode: AP, Ad-HoC, Infra
+
+Notes: To ask RTL8711 performing site-survey
+
+Command-Event Mode
+
+*/
+
+#define RTW_SSID_SCAN_AMOUNT 9 // for WEXT_CSCAN_AMOUNT 9
+#define RTW_CHANNEL_SCAN_AMOUNT (14+37)
+struct sitesurvey_parm {
+	sint scan_mode;	//active: 1, passive: 0
+	/* sint bsslimit;	// 1 ~ 48 */
+	u8 ssid_num;
+	u8 ch_num;
+	NDIS_802_11_SSID ssid[RTW_SSID_SCAN_AMOUNT];
+	struct rtw_ieee80211_channel ch[RTW_CHANNEL_SCAN_AMOUNT];
+};
+
+/*
+Caller Mode: Any
+
+Notes: To set the auth type of RTL8711. open/shared/802.1x
+
+Command Mode
+
+*/
+struct setauth_parm {
+	u8 mode;  //0: legacy open, 1: legacy shared 2: 802.1x
+	u8 _1x;   //0: PSK, 1: TLS
+	u8 rsvd[2];
+};
+
+/*
+Caller Mode: Infra
+
+a. algorithm: wep40, wep104, tkip & aes
+b. keytype: grp key/unicast key
+c. key contents
+
+when shared key ==> keyid is the camid
+when 802.1x ==> keyid [0:1] ==> grp key
+when 802.1x ==> keyid > 2 ==> unicast key
+
+*/
+struct setkey_parm {
+	u8	algorithm;	// encryption algorithm, could be none, wep40, TKIP, CCMP, wep104
+	u8	keyid;
+	u8 	grpkey;		// 1: this is the grpkey for 802.1x. 0: this is the unicast key for 802.1x
+	u8 	set_tx;		// 1: main tx key for wep. 0: other key.
+	u8	key[16];	// this could be 40 or 104
+};
+
+/*
+When in AP or Ad-Hoc mode, this is used to
+allocate an sw/hw entry for a newly associated sta.
+
+Command
+
+when shared key ==> algorithm/keyid
+
+*/
+struct set_stakey_parm {
+	u8	addr[ETH_ALEN];
+	u8	algorithm;
+	u8 	id;// currently for erasing cam entry if algorithm == _NO_PRIVACY_
+	u8	key[16];
+};
+
+struct set_stakey_rsp {
+	u8	addr[ETH_ALEN];
+	u8	keyid;
+	u8	rsvd;
+};
+
+/*
+Caller Ad-Hoc/AP
+
+Command -Rsp(AID == CAMID) mode
+
+This is to force fw to add an sta_data entry per driver's request.
+
+FW will write an cam entry associated with it.
+
+*/
+struct set_assocsta_parm {
+	u8	addr[ETH_ALEN];
+};
+
+struct set_assocsta_rsp {
+	u8	cam_id;
+	u8	rsvd[3];
+};
+
+/*
+	Caller Ad-Hoc/AP
+
+	Command mode
+
+	This is to force fw to del an sta_data entry per driver's request
+
+	FW will invalidate the cam entry associated with it.
+
+*/
+struct del_assocsta_parm {
+	u8  	addr[ETH_ALEN];
+};
+
+/*
+Caller Mode: AP/Ad-HoC(M)
+
+Notes: To notify fw that given staid has changed its power state
+
+Command Mode
+
+*/
+struct setstapwrstate_parm {
+	u8	staid;
+	u8	status;
+	u8	hwaddr[6];
+};
+
+/*
+Caller Mode: Any
+
+Notes: To setup the basic rate of RTL8711
+
+Command Mode
+
+*/
+struct	setbasicrate_parm {
+	u8	basicrates[NumRates];
+};
+
+/*
+Caller Mode: Any
+
+Notes: To read the current basic rate
+
+Command-Rsp Mode
+
+*/
+struct getbasicrate_parm {
+	u32 rsvd;
+};
+
+struct getbasicrate_rsp {
+	u8 basicrates[NumRates];
+};
+
+/*
+Caller Mode: Any
+
+Notes: To setup the data rate of RTL8711
+
+Command Mode
+
+*/
+struct setdatarate_parm {
+#ifdef MP_FIRMWARE_OFFLOAD
+	u32	curr_rateidx;
+#else
+	u8	mac_id;
+	u8	datarates[NumRates];
+#endif
+};
+
+/*
+Caller Mode: Any
+
+Notes: To read the current data rate
+
+Command-Rsp Mode
+
+*/
+struct getdatarate_parm {
+	u32 rsvd;
+
+};
+struct getdatarate_rsp {
+	u8 datarates[NumRates];
+};
+
+
+/*
+Caller Mode: Any
+AP: AP can use the info for the contents of beacon frame
+Infra: STA can use the info when sitesurveying
+Ad-HoC(M): Like AP
+Ad-HoC(C): Like STA
+
+
+Notes: To set the phy capability of the NIC
+
+Command Mode
+
+*/
+
+struct	setphyinfo_parm {
+	struct regulatory_class class_sets[NUM_REGULATORYS];
+	u8	status;
+};
+
+struct	getphyinfo_parm {
+	u32 rsvd;
+};
+
+struct	getphyinfo_rsp {
+	struct regulatory_class class_sets[NUM_REGULATORYS];
+	u8	status;
+};
+
+/*
+Caller Mode: Any
+
+Notes: To set the channel/modem/band
+This command will be used when channel/modem/band is changed.
+
+Command Mode
+
+*/
+struct	setphy_parm {
+	u8	rfchannel;
+	u8	modem;
+};
+
+/*
+Caller Mode: Any
+
+Notes: To get the current setting of channel/modem/band
+
+Command-Rsp Mode
+
+*/
+struct	getphy_parm {
+	u32 rsvd;
+
+};
+struct	getphy_rsp {
+	u8	rfchannel;
+	u8	modem;
+};
+
+struct readBB_parm {
+	u8	offset;
+};
+struct readBB_rsp {
+	u8	value;
+};
+
+struct readTSSI_parm {
+	u8	offset;
+};
+struct readTSSI_rsp {
+	u8	value;
+};
+
+struct writeBB_parm {
+	u8	offset;
+	u8	value;
+};
+
+struct readRF_parm {
+	u8	offset;
+};
+struct readRF_rsp {
+	u32	value;
+};
+
+struct writeRF_parm {
+	u32	offset;
+	u32	value;
+};
+
+struct getrfintfs_parm {
+	u8	rfintfs;
+};
+
+
+struct Tx_Beacon_param
+{
+	WLAN_BSSID_EX network;
+};
+
+/*
+	Notes: This command is used for H2C/C2H loopback testing
+
+	mac[0] == 0
+	==> CMD mode, return H2C_SUCCESS.
+	The following condition must be ture under CMD mode
+		mac[1] == mac[4], mac[2] == mac[3], mac[0]=mac[5]= 0;
+		s0 == 0x1234, s1 == 0xabcd, w0 == 0x78563412, w1 == 0x5aa5def7;
+		s2 == (b1 << 8 | b0);
+
+	mac[0] == 1
+	==> CMD_RSP mode, return H2C_SUCCESS_RSP
+
+	The rsp layout shall be:
+	rsp: 			parm:
+		mac[0]  =   mac[5];
+		mac[1]  =   mac[4];
+		mac[2]  =   mac[3];
+		mac[3]  =   mac[2];
+		mac[4]  =   mac[1];
+		mac[5]  =   mac[0];
+		s0		=   s1;
+		s1		=   swap16(s0);
+		w0		=  	swap32(w1);
+		b0		= 	b1
+		s2		= 	s0 + s1
+		b1		= 	b0
+		w1		=	w0
+
+	mac[0] == 	2
+	==> CMD_EVENT mode, return 	H2C_SUCCESS
+	The event layout shall be:
+	event:			parm:
+		mac[0]  =   mac[5];
+		mac[1]  =   mac[4];
+		mac[2]  =   event's sequence number, starting from 1 to parm's marc[3]
+		mac[3]  =   mac[2];
+		mac[4]  =   mac[1];
+		mac[5]  =   mac[0];
+		s0		=   swap16(s0) - event.mac[2];
+		s1		=   s1 + event.mac[2];
+		w0		=  	swap32(w0);
+		b0		= 	b1
+		s2		= 	s0 + event.mac[2]
+		b1		= 	b0
+		w1		=	swap32(w1) - event.mac[2];
+
+		parm->mac[3] is the total event counts that host requested.
+
+
+	event will be the same with the cmd's param.
+
+*/
+
+#ifdef CONFIG_H2CLBK
+
+struct seth2clbk_parm {
+	u8 mac[6];
+	u16	s0;
+	u16	s1;
+	u32	w0;
+	u8	b0;
+	u16  s2;
+	u8	b1;
+	u32	w1;
+};
+
+struct geth2clbk_parm {
+	u32 rsv;
+};
+
+struct geth2clbk_rsp {
+	u8	mac[6];
+	u16	s0;
+	u16	s1;
+	u32	w0;
+	u8	b0;
+	u16	s2;
+	u8	b1;
+	u32	w1;
+};
+
+#endif	/* CONFIG_H2CLBK */
+
+// CMD param Formart for driver extra cmd handler
+struct drvextra_cmd_parm {
+	int ec_id; //extra cmd id
+	int type_size; // Can use this field as the type id or command size
+	unsigned char *pbuf;
+};
+
+/*------------------- Below are used for RF/BB tunning ---------------------*/
+
+struct	setantenna_parm {
+	u8	tx_antset;
+	u8	rx_antset;
+	u8	tx_antenna;
+	u8	rx_antenna;
+};
+
+struct	enrateadaptive_parm {
+	u32	en;
+};
+
+struct settxagctbl_parm {
+	u32	txagc[MAX_RATES_LENGTH];
+};
+
+struct gettxagctbl_parm {
+	u32 rsvd;
+};
+struct gettxagctbl_rsp {
+	u32	txagc[MAX_RATES_LENGTH];
+};
+
+struct setagcctrl_parm {
+	u32	agcctrl;		// 0: pure hw, 1: fw
+};
+
+
+struct setssup_parm	{
+	u32	ss_ForceUp[MAX_RATES_LENGTH];
+};
+
+struct getssup_parm	{
+	u32 rsvd;
+};
+struct getssup_rsp	{
+	u8	ss_ForceUp[MAX_RATES_LENGTH];
+};
+
+
+struct setssdlevel_parm	{
+	u8	ss_DLevel[MAX_RATES_LENGTH];
+};
+
+struct getssdlevel_parm	{
+	u32 rsvd;
+};
+struct getssdlevel_rsp	{
+	u8	ss_DLevel[MAX_RATES_LENGTH];
+};
+
+struct setssulevel_parm	{
+	u8	ss_ULevel[MAX_RATES_LENGTH];
+};
+
+struct getssulevel_parm	{
+	u32 rsvd;
+};
+struct getssulevel_rsp	{
+	u8	ss_ULevel[MAX_RATES_LENGTH];
+};
+
+
+struct	setcountjudge_parm {
+	u8	count_judge[MAX_RATES_LENGTH];
+};
+
+struct	getcountjudge_parm {
+	u32 rsvd;
+};
+struct	getcountjudge_rsp {
+	u8	count_judge[MAX_RATES_LENGTH];
+};
+
+
+struct setratable_parm {
+	u8 ss_ForceUp[NumRates];
+	u8 ss_ULevel[NumRates];
+	u8 ss_DLevel[NumRates];
+	u8 count_judge[NumRates];
+};
+
+struct getratable_parm {
+                uint rsvd;
+};
+struct getratable_rsp {
+        u8 ss_ForceUp[NumRates];
+        u8 ss_ULevel[NumRates];
+        u8 ss_DLevel[NumRates];
+        u8 count_judge[NumRates];
+};
+
+
+//to get TX,RX retry count
+struct gettxretrycnt_parm{
+	unsigned int rsvd;
+};
+struct gettxretrycnt_rsp{
+	unsigned long tx_retrycnt;
+};
+
+struct getrxretrycnt_parm{
+	unsigned int rsvd;
+};
+struct getrxretrycnt_rsp{
+	unsigned long rx_retrycnt;
+};
+
+//to get BCNOK,BCNERR count
+struct getbcnokcnt_parm{
+	unsigned int rsvd;
+};
+struct getbcnokcnt_rsp{
+	unsigned long  bcnokcnt;
+};
+
+struct getbcnerrcnt_parm{
+	unsigned int rsvd;
+};
+struct getbcnerrcnt_rsp{
+	unsigned long bcnerrcnt;
+};
+
+// to get current TX power level
+struct getcurtxpwrlevel_parm{
+	unsigned int rsvd;
+};
+struct getcurtxpwrlevel_rsp{
+	unsigned short tx_power;
+};
+
+struct setprobereqextraie_parm {
+	unsigned char e_id;
+	unsigned char ie_len;
+	unsigned char ie[0];
+};
+
+struct setassocreqextraie_parm {
+	unsigned char e_id;
+	unsigned char ie_len;
+	unsigned char ie[0];
+};
+
+struct setproberspextraie_parm {
+	unsigned char e_id;
+	unsigned char ie_len;
+	unsigned char ie[0];
+};
+
+struct setassocrspextraie_parm {
+	unsigned char e_id;
+	unsigned char ie_len;
+	unsigned char ie[0];
+};
+
+
+struct addBaReq_parm
+{
+	unsigned int tid;
+	u8	addr[ETH_ALEN];
+};
+
+/*H2C Handler index: 46 */
+struct set_ch_parm {
+	u8 ch;
+	u8 bw;
+	u8 ch_offset;
+};
+
+#ifdef MP_FIRMWARE_OFFLOAD
+/*H2C Handler index: 47 */
+struct SetTxPower_parm
+{
+	u8 TxPower;
+};
+
+/*H2C Handler index: 48 */
+struct SwitchAntenna_parm
+{
+	u16 antenna_tx;
+	u16 antenna_rx;
+//	R_ANTENNA_SELECT_CCK cck_txrx;
+	u8 cck_txrx;
+};
+
+/*H2C Handler index: 49 */
+struct SetCrystalCap_parm
+{
+	u32 curr_crystalcap;
+};
+
+/*H2C Handler index: 50 */
+struct SetSingleCarrierTx_parm
+{
+	u8 bStart;
+};
+
+/*H2C Handler index: 51 */
+struct SetSingleToneTx_parm
+{
+	u8 bStart;
+	u8 curr_rfpath;
+};
+
+/*H2C Handler index: 52 */
+struct SetCarrierSuppressionTx_parm
+{
+	u8 bStart;
+	u32 curr_rateidx;
+};
+
+/*H2C Handler index: 53 */
+struct SetContinuousTx_parm
+{
+	u8 bStart;
+	u8 CCK_flag; /*1:CCK 2:OFDM*/
+	u32 curr_rateidx;
+};
+
+/*H2C Handler index: 54 */
+struct SwitchBandwidth_parm
+{
+	u8 curr_bandwidth;
+};
+
+#endif	/* MP_FIRMWARE_OFFLOAD */
+
+/*H2C Handler index: 59 */
+struct SetChannelPlan_param
+{
+	u8 channel_plan;
+};
+
+/*H2C Handler index: 60 */
+struct LedBlink_param
+{
+	PLED_871x	 pLed;
+};
+
+/*H2C Handler index: 61 */
+struct SetChannelSwitch_param
+{
+	u8 new_ch_no;
+};
+
+/*H2C Handler index: 62 */
+struct TDLSoption_param
+{
+	u8 addr[ETH_ALEN];
+	u8 option;
+};
+
+#define GEN_CMD_CODE(cmd)	cmd ## _CMD_
+
+
+/*
+
+Result:
+0x00: success
+0x01: sucess, and check Response.
+0x02: cmd ignored due to duplicated sequcne number
+0x03: cmd dropped due to invalid cmd code
+0x04: reserved.
+
+*/
+
+#define H2C_RSP_OFFSET			512
+
+#define H2C_SUCCESS			0x00
+#define H2C_SUCCESS_RSP			0x01
+#define H2C_DUPLICATED			0x02
+#define H2C_DROPPED			0x03
+#define H2C_PARAMETERS_ERROR		0x04
+#define H2C_REJECTED			0x05
+#define H2C_CMD_OVERFLOW		0x06
+#define H2C_RESERVED			0x07
+
+extern u8 rtw_setassocsta_cmd(_adapter  *padapter, u8 *mac_addr);
+extern u8 rtw_setstandby_cmd(_adapter *padapter, uint action);
+u8 rtw_sitesurvey_cmd(_adapter  *padapter, NDIS_802_11_SSID *ssid, int ssid_num, struct rtw_ieee80211_channel *ch, int ch_num);
+extern u8 rtw_createbss_cmd(_adapter  *padapter);
+extern u8 rtw_createbss_cmd_ex(_adapter  *padapter, unsigned char *pbss, unsigned int sz);
+extern u8 rtw_setphy_cmd(_adapter  *padapter, u8 modem, u8 ch);
+extern u8 rtw_setstakey_cmd(_adapter  *padapter, u8 *psta, u8 unicast_key);
+extern u8 rtw_clearstakey_cmd(_adapter *padapter, u8 *psta, u8 entry, u8 enqueue);
+extern u8 rtw_joinbss_cmd(_adapter  *padapter, struct wlan_network* pnetwork);
+u8 rtw_disassoc_cmd(_adapter *padapter, u32 deauth_timeout_ms, bool enqueue);
+extern u8 rtw_setopmode_cmd(_adapter  *padapter, NDIS_802_11_NETWORK_INFRASTRUCTURE networktype);
+extern u8 rtw_setdatarate_cmd(_adapter  *padapter, u8 *rateset);
+extern u8 rtw_setbasicrate_cmd(_adapter  *padapter, u8 *rateset);
+extern u8 rtw_setbbreg_cmd(_adapter * padapter, u8 offset, u8 val);
+extern u8 rtw_setrfreg_cmd(_adapter * padapter, u8 offset, u32 val);
+extern u8 rtw_getbbreg_cmd(_adapter * padapter, u8 offset, u8 * pval);
+extern u8 rtw_getrfreg_cmd(_adapter * padapter, u8 offset, u8 * pval);
+extern u8 rtw_setrfintfs_cmd(_adapter  *padapter, u8 mode);
+extern u8 rtw_setrttbl_cmd(_adapter  *padapter, struct setratable_parm *prate_table);
+extern u8 rtw_getrttbl_cmd(_adapter  *padapter, struct getratable_rsp *pval);
+
+extern u8 rtw_gettssi_cmd(_adapter  *padapter, u8 offset,u8 *pval);
+extern u8 rtw_setfwdig_cmd(_adapter*padapter, u8 type);
+extern u8 rtw_setfwra_cmd(_adapter*padapter, u8 type);
+
+extern u8 rtw_addbareq_cmd(_adapter*padapter, u8 tid, u8 *addr);
+// add for CONFIG_IEEE80211W, none 11w also can use
+extern u8 rtw_reset_securitypriv_cmd(_adapter*padapter);
+extern u8 rtw_free_assoc_resources_cmd(_adapter *padapter);
+extern u8 rtw_dynamic_chk_wk_cmd(_adapter *adapter);
+
+u8 rtw_lps_ctrl_wk_cmd(_adapter*padapter, u8 lps_ctrl_type, u8 enqueue);
+
+#ifdef CONFIG_ANTENNA_DIVERSITY
+extern  u8 rtw_antenna_select_cmd(_adapter*padapter, u8 antenna,u8 enqueue);
+#endif
+
+extern u8 rtw_ps_cmd(_adapter*padapter);
+
+
+#ifdef CONFIG_AP_MODE
+u8 rtw_chk_hi_queue_cmd(_adapter*padapter);
+#endif
+
+u8 rtw_set_ch_cmd(_adapter*padapter, u8 ch, u8 bw, u8 ch_offset, u8 enqueue);
+extern u8 rtw_set_chplan_cmd(_adapter*padapter, u8 chplan, u8 enqueue);
+extern u8 rtw_led_blink_cmd(_adapter*padapter, PLED_871x pLed);
+extern u8 rtw_set_csa_cmd(_adapter*padapter, u8 new_ch_no);
+extern u8 rtw_tdls_cmd(_adapter*padapter, u8 *addr, u8 option);
+
+extern u8 rtw_c2h_wk_cmd(PADAPTER padapter, u8 *c2h_evt);
+
+u8 rtw_drvextra_cmd_hdl(_adapter *padapter, unsigned char *pbuf);
+
+extern void rtw_survey_cmd_callback(_adapter  *padapter, struct cmd_obj *pcmd);
+extern void rtw_disassoc_cmd_callback(_adapter  *padapter, struct cmd_obj *pcmd);
+extern void rtw_joinbss_cmd_callback(_adapter  *padapter, struct cmd_obj *pcmd);
+extern void rtw_createbss_cmd_callback(_adapter  *padapter, struct cmd_obj *pcmd);
+extern void rtw_getbbrfreg_cmdrsp_callback(_adapter  *padapter, struct cmd_obj *pcmd);
+extern void rtw_readtssi_cmdrsp_callback(_adapter*	padapter,  struct cmd_obj *pcmd);
+
+extern void rtw_setstaKey_cmdrsp_callback(_adapter  *padapter,  struct cmd_obj *pcmd);
+extern void rtw_setassocsta_cmdrsp_callback(_adapter  *padapter,  struct cmd_obj *pcmd);
+extern void rtw_getrttbl_cmdrsp_callback(_adapter  *padapter,  struct cmd_obj *pcmd);
+
+
+struct _cmd_callback {
+	u32	cmd_code;
+	void (*callback)(_adapter  *padapter, struct cmd_obj *cmd);
+};
+
+enum rtw_h2c_cmd
+{
+	GEN_CMD_CODE(_Read_MACREG) ,	/*0*/
+	GEN_CMD_CODE(_Write_MACREG) ,
+	GEN_CMD_CODE(_Read_BBREG) ,
+	GEN_CMD_CODE(_Write_BBREG) ,
+	GEN_CMD_CODE(_Read_RFREG) ,
+	GEN_CMD_CODE(_Write_RFREG) , /*5*/
+	GEN_CMD_CODE(_Read_EEPROM) ,
+	GEN_CMD_CODE(_Write_EEPROM) ,
+	GEN_CMD_CODE(_Read_EFUSE) ,
+	GEN_CMD_CODE(_Write_EFUSE) ,
+
+	GEN_CMD_CODE(_Read_CAM) ,	/*10*/
+	GEN_CMD_CODE(_Write_CAM) ,
+	GEN_CMD_CODE(_setBCNITV),
+	GEN_CMD_CODE(_setMBIDCFG),
+	GEN_CMD_CODE(_JoinBss),   /*14*/
+	GEN_CMD_CODE(_DisConnect) , /*15*/
+	GEN_CMD_CODE(_CreateBss) ,
+	GEN_CMD_CODE(_SetOpMode) ,
+	GEN_CMD_CODE(_SiteSurvey),  /*18*/
+	GEN_CMD_CODE(_SetAuth) ,
+
+	GEN_CMD_CODE(_SetKey) ,	/*20*/
+	GEN_CMD_CODE(_SetStaKey) ,
+	GEN_CMD_CODE(_SetAssocSta) ,
+	GEN_CMD_CODE(_DelAssocSta) ,
+	GEN_CMD_CODE(_SetStaPwrState) ,
+	GEN_CMD_CODE(_SetBasicRate) , /*25*/
+	GEN_CMD_CODE(_GetBasicRate) ,
+	GEN_CMD_CODE(_SetDataRate) ,
+	GEN_CMD_CODE(_GetDataRate) ,
+	GEN_CMD_CODE(_SetPhyInfo) ,
+
+	GEN_CMD_CODE(_GetPhyInfo) ,	/*30*/
+	GEN_CMD_CODE(_SetPhy) ,
+	GEN_CMD_CODE(_GetPhy) ,
+	GEN_CMD_CODE(_readRssi) ,
+	GEN_CMD_CODE(_readGain) ,
+	GEN_CMD_CODE(_SetAtim) , /*35*/
+	GEN_CMD_CODE(_SetPwrMode) ,
+	GEN_CMD_CODE(_JoinbssRpt),
+	GEN_CMD_CODE(_SetRaTable) ,
+	GEN_CMD_CODE(_GetRaTable) ,
+
+	GEN_CMD_CODE(_GetCCXReport), /*40*/
+	GEN_CMD_CODE(_GetDTMReport),
+	GEN_CMD_CODE(_GetTXRateStatistics),
+	GEN_CMD_CODE(_SetUsbSuspend),
+	GEN_CMD_CODE(_SetH2cLbk),
+	GEN_CMD_CODE(_AddBAReq) , /*45*/
+	GEN_CMD_CODE(_SetChannel), /*46*/
+	GEN_CMD_CODE(_SetTxPower),
+	GEN_CMD_CODE(_SwitchAntenna),
+	GEN_CMD_CODE(_SetCrystalCap),
+	GEN_CMD_CODE(_SetSingleCarrierTx), /*50*/
+
+	GEN_CMD_CODE(_SetSingleToneTx),/*51*/
+	GEN_CMD_CODE(_SetCarrierSuppressionTx),
+	GEN_CMD_CODE(_SetContinuousTx),
+	GEN_CMD_CODE(_SwitchBandwidth), /*54*/
+	GEN_CMD_CODE(_TX_Beacon), /*55*/
+
+	GEN_CMD_CODE(_Set_MLME_EVT), /*56*/
+	GEN_CMD_CODE(_Set_Drv_Extra), /*57*/
+	GEN_CMD_CODE(_Set_H2C_MSG), /*58*/
+
+	GEN_CMD_CODE(_SetChannelPlan), /*59*/
+	GEN_CMD_CODE(_LedBlink), /*60*/
+
+	GEN_CMD_CODE(_SetChannelSwitch), /*61*/
+	GEN_CMD_CODE(_TDLS), /*62*/
+
+	MAX_H2CCMD
+};
+
+#define _GetBBReg_CMD_		_Read_BBREG_CMD_
+#define _SetBBReg_CMD_ 		_Write_BBREG_CMD_
+#define _GetRFReg_CMD_ 		_Read_RFREG_CMD_
+#define _SetRFReg_CMD_ 		_Write_RFREG_CMD_
+
+#ifdef _RTW_CMD_C_
+struct _cmd_callback 	rtw_cmd_callback[] =
+{
+	{GEN_CMD_CODE(_Read_MACREG), NULL}, /*0*/
+	{GEN_CMD_CODE(_Write_MACREG), NULL},
+	{GEN_CMD_CODE(_Read_BBREG), &rtw_getbbrfreg_cmdrsp_callback},
+	{GEN_CMD_CODE(_Write_BBREG), NULL},
+	{GEN_CMD_CODE(_Read_RFREG), &rtw_getbbrfreg_cmdrsp_callback},
+	{GEN_CMD_CODE(_Write_RFREG), NULL}, /*5*/
+	{GEN_CMD_CODE(_Read_EEPROM), NULL},
+	{GEN_CMD_CODE(_Write_EEPROM), NULL},
+	{GEN_CMD_CODE(_Read_EFUSE), NULL},
+	{GEN_CMD_CODE(_Write_EFUSE), NULL},
+
+	{GEN_CMD_CODE(_Read_CAM),	NULL},	/*10*/
+	{GEN_CMD_CODE(_Write_CAM),	 NULL},
+	{GEN_CMD_CODE(_setBCNITV), NULL},
+	{GEN_CMD_CODE(_setMBIDCFG), NULL},
+	{GEN_CMD_CODE(_JoinBss), &rtw_joinbss_cmd_callback},  /*14*/
+	{GEN_CMD_CODE(_DisConnect), &rtw_disassoc_cmd_callback}, /*15*/
+	{GEN_CMD_CODE(_CreateBss), &rtw_createbss_cmd_callback},
+	{GEN_CMD_CODE(_SetOpMode), NULL},
+	{GEN_CMD_CODE(_SiteSurvey), &rtw_survey_cmd_callback}, /*18*/
+	{GEN_CMD_CODE(_SetAuth), NULL},
+
+	{GEN_CMD_CODE(_SetKey), NULL},	/*20*/
+	{GEN_CMD_CODE(_SetStaKey), &rtw_setstaKey_cmdrsp_callback},
+	{GEN_CMD_CODE(_SetAssocSta), &rtw_setassocsta_cmdrsp_callback},
+	{GEN_CMD_CODE(_DelAssocSta), NULL},
+	{GEN_CMD_CODE(_SetStaPwrState), NULL},
+	{GEN_CMD_CODE(_SetBasicRate), NULL}, /*25*/
+	{GEN_CMD_CODE(_GetBasicRate), NULL},
+	{GEN_CMD_CODE(_SetDataRate), NULL},
+	{GEN_CMD_CODE(_GetDataRate), NULL},
+	{GEN_CMD_CODE(_SetPhyInfo), NULL},
+
+	{GEN_CMD_CODE(_GetPhyInfo), NULL}, /*30*/
+	{GEN_CMD_CODE(_SetPhy), NULL},
+	{GEN_CMD_CODE(_GetPhy), NULL},
+	{GEN_CMD_CODE(_readRssi), NULL},
+	{GEN_CMD_CODE(_readGain), NULL},
+	{GEN_CMD_CODE(_SetAtim), NULL}, /*35*/
+	{GEN_CMD_CODE(_SetPwrMode), NULL},
+	{GEN_CMD_CODE(_JoinbssRpt), NULL},
+	{GEN_CMD_CODE(_SetRaTable), NULL},
+	{GEN_CMD_CODE(_GetRaTable) , NULL},
+
+	{GEN_CMD_CODE(_GetCCXReport), NULL}, /*40*/
+	{GEN_CMD_CODE(_GetDTMReport),	NULL},
+	{GEN_CMD_CODE(_GetTXRateStatistics), NULL},
+	{GEN_CMD_CODE(_SetUsbSuspend), NULL},
+	{GEN_CMD_CODE(_SetH2cLbk), NULL},
+	{GEN_CMD_CODE(_AddBAReq), NULL}, /*45*/
+	{GEN_CMD_CODE(_SetChannel), NULL},		/*46*/
+	{GEN_CMD_CODE(_SetTxPower), NULL},
+	{GEN_CMD_CODE(_SwitchAntenna), NULL},
+	{GEN_CMD_CODE(_SetCrystalCap), NULL},
+	{GEN_CMD_CODE(_SetSingleCarrierTx), NULL},	/*50*/
+
+	{GEN_CMD_CODE(_SetSingleToneTx), NULL}, /*51*/
+	{GEN_CMD_CODE(_SetCarrierSuppressionTx), NULL},
+	{GEN_CMD_CODE(_SetContinuousTx), NULL},
+	{GEN_CMD_CODE(_SwitchBandwidth), NULL},		/*54*/
+	{GEN_CMD_CODE(_TX_Beacon), NULL},/*55*/
+
+	{GEN_CMD_CODE(_Set_MLME_EVT), NULL},/*56*/
+	{GEN_CMD_CODE(_Set_Drv_Extra), NULL},/*57*/
+	{GEN_CMD_CODE(_Set_H2C_MSG), NULL},/*58*/
+	{GEN_CMD_CODE(_SetChannelPlan), NULL},/*59*/
+	{GEN_CMD_CODE(_LedBlink), NULL},/*60*/
+
+	{GEN_CMD_CODE(_SetChannelSwitch), NULL},/*61*/
+	{GEN_CMD_CODE(_TDLS), NULL},/*62*/
+};
+#endif
+
+#endif // _CMD_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_debug.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_debug.h
new file mode 100644
index 000000000000..13db6231fe69
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_debug.h
@@ -0,0 +1,537 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_DEBUG_H__
+#define __RTW_DEBUG_H__
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+#define	_no_debug_			0
+#define _drv_emerg_			1
+#define _drv_alert_			2
+#define _drv_crit_			3
+#define _drv_err_			4
+#define	_drv_warning_		5
+#define _drv_notice_			6
+#define _drv_info_			7
+#define _drv_dump_			8
+#define	_drv_debug_		9
+#define _drv_always_ _drv_emerg_
+
+#define _module_rtl871x_xmit_c_		BIT(0)
+#define _module_xmit_osdep_c_		BIT(1)
+#define _module_rtl871x_recv_c_		BIT(2)
+#define _module_recv_osdep_c_		BIT(3)
+#define _module_rtl871x_mlme_c_		BIT(4)
+#define _module_mlme_osdep_c_		BIT(5)
+#define _module_rtl871x_sta_mgt_c_		BIT(6)
+#define _module_rtl871x_cmd_c_			BIT(7)
+#define _module_cmd_osdep_c_		BIT(8)
+#define _module_rtl871x_io_c_				BIT(9)
+#define _module_io_osdep_c_		BIT(10)
+#define _module_os_intfs_c_			BIT(11)
+#define _module_rtl871x_security_c_		BIT(12)
+#define _module_rtl871x_eeprom_c_			BIT(13)
+#define _module_hal_init_c_		BIT(14)
+#define _module_hci_hal_init_c_		BIT(15)
+#define _module_rtl871x_ioctl_c_		BIT(16)
+#define _module_rtl871x_ioctl_set_c_		BIT(17)
+#define _module_rtl871x_ioctl_query_c_	BIT(18)
+#define _module_rtl871x_pwrctrl_c_			BIT(19)
+#define _module_hci_intfs_c_			BIT(20)
+#define _module_hci_ops_c_			BIT(21)
+#define _module_osdep_service_c_			BIT(22)
+#define _module_mp_			BIT(23)
+#define _module_hci_ops_os_c_			BIT(24)
+#define _module_rtl871x_ioctl_os_c		BIT(25)
+#define _module_rtl8712_cmd_c_		BIT(26)
+//#define _module_efuse_			BIT(27)
+#define	_module_rtl8192c_xmit_c_ BIT(28)
+#define _module_hal_xmit_c_	BIT(28)
+#define _module_efuse_			BIT(29)
+#define _module_rtl8712_recv_c_		BIT(30)
+#define _module_rtl8712_led_c_		BIT(31)
+
+#undef _MODULE_DEFINE_
+
+#if defined _RTW_XMIT_C_
+	#define _MODULE_DEFINE_	_module_rtl871x_xmit_c_
+#elif defined _XMIT_OSDEP_C_
+	#define _MODULE_DEFINE_	_module_xmit_osdep_c_
+#elif defined _RTW_RECV_C_
+	#define _MODULE_DEFINE_	_module_rtl871x_recv_c_
+#elif defined _RECV_OSDEP_C_
+	#define _MODULE_DEFINE_	_module_recv_osdep_c_
+#elif defined _RTW_MLME_C_
+	#define _MODULE_DEFINE_	_module_rtl871x_mlme_c_
+#elif defined _MLME_OSDEP_C_
+	#define _MODULE_DEFINE_	_module_mlme_osdep_c_
+#elif defined _RTW_MLME_EXT_C_
+	#define _MODULE_DEFINE_ 1
+#elif defined _RTW_STA_MGT_C_
+	#define _MODULE_DEFINE_	_module_rtl871x_sta_mgt_c_
+#elif defined _RTW_CMD_C_
+	#define _MODULE_DEFINE_	_module_rtl871x_cmd_c_
+#elif defined _CMD_OSDEP_C_
+	#define _MODULE_DEFINE_	_module_cmd_osdep_c_
+#elif defined _RTW_IO_C_
+	#define _MODULE_DEFINE_	_module_rtl871x_io_c_
+#elif defined _IO_OSDEP_C_
+	#define _MODULE_DEFINE_	_module_io_osdep_c_
+#elif defined _OS_INTFS_C_
+	#define	_MODULE_DEFINE_	_module_os_intfs_c_
+#elif defined _RTW_SECURITY_C_
+	#define	_MODULE_DEFINE_	_module_rtl871x_security_c_
+#elif defined _RTW_EEPROM_C_
+	#define	_MODULE_DEFINE_	_module_rtl871x_eeprom_c_
+#elif defined _HAL_INTF_C_
+	#define	_MODULE_DEFINE_	_module_hal_init_c_
+#elif defined _HCI_HAL_INIT_C_
+	#define	_MODULE_DEFINE_	_module_hci_hal_init_c_
+#elif defined _RTL871X_IOCTL_C_
+	#define	_MODULE_DEFINE_	_module_rtl871x_ioctl_c_
+#elif defined _RTL871X_IOCTL_SET_C_
+	#define	_MODULE_DEFINE_	_module_rtl871x_ioctl_set_c_
+#elif defined _RTL871X_IOCTL_QUERY_C_
+	#define	_MODULE_DEFINE_	_module_rtl871x_ioctl_query_c_
+#elif defined _RTL871X_PWRCTRL_C_
+	#define	_MODULE_DEFINE_	_module_rtl871x_pwrctrl_c_
+#elif defined _RTW_PWRCTRL_C_
+	#define	_MODULE_DEFINE_	1
+#elif defined _HCI_INTF_C_
+	#define	_MODULE_DEFINE_	_module_hci_intfs_c_
+#elif defined _HCI_OPS_C_
+	#define	_MODULE_DEFINE_	_module_hci_ops_c_
+#elif defined _SDIO_OPS_C_
+	#define	_MODULE_DEFINE_ 1
+#elif defined _OSDEP_HCI_INTF_C_
+	#define	_MODULE_DEFINE_	_module_hci_intfs_c_
+#elif defined _OSDEP_SERVICE_C_
+	#define	_MODULE_DEFINE_	_module_osdep_service_c_
+#elif defined _HCI_OPS_OS_C_
+	#define	_MODULE_DEFINE_	_module_hci_ops_os_c_
+#elif defined _RTL871X_IOCTL_LINUX_C_
+	#define	_MODULE_DEFINE_	_module_rtl871x_ioctl_os_c
+#elif defined _RTL8712_CMD_C_
+	#define	_MODULE_DEFINE_	_module_rtl8712_cmd_c_
+#elif defined _RTL8192C_XMIT_C_
+	#define	_MODULE_DEFINE_	1
+#elif defined _RTL8723AS_XMIT_C_
+	#define	_MODULE_DEFINE_	1
+#elif defined _RTL8712_RECV_C_
+	#define	_MODULE_DEFINE_	_module_rtl8712_recv_c_
+#elif defined _RTL8192CU_RECV_C_
+	#define	_MODULE_DEFINE_	_module_rtl8712_recv_c_
+#elif defined _RTL871X_MLME_EXT_C_
+	#define _MODULE_DEFINE_	_module_mlme_osdep_c_
+#elif defined _RTW_MP_C_
+	#define	_MODULE_DEFINE_	_module_mp_
+#elif defined _RTW_MP_IOCTL_C_
+	#define	_MODULE_DEFINE_	_module_mp_
+#elif defined _RTW_EFUSE_C_
+	#define	_MODULE_DEFINE_	_module_efuse_
+#endif
+
+#ifdef PLATFORM_OS_CE
+extern void rtl871x_cedbg(const char *fmt, ...);
+#endif
+
+#define RT_TRACE(_Comp, _Level, Fmt) do{}while(0)
+#define _func_enter_ do{}while(0)
+#define _func_exit_ do{}while(0)
+#define RT_PRINT_DATA(_Comp, _Level, _TitleString, _HexData, _HexDataLen) do{}while(0)
+
+#undef	_dbgdump
+
+#ifdef CONFIG_DEBUG_RTL871X
+
+#ifndef _RTL871X_DEBUG_C_
+	extern u32 GlobalDebugLevel;
+	extern u64 GlobalDebugComponents;
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+	#ifdef PLATFORM_OS_XP
+
+	#define _dbgdump	DbgPrint
+
+	#elif defined PLATFORM_OS_CE
+
+	#define _dbgdump	rtl871x_cedbg
+
+	#endif
+
+#elif defined PLATFORM_LINUX
+
+	#define _dbgdump	printk
+
+#elif defined PLATFORM_FREEBSD
+
+	#define _dbgdump	printf
+
+#endif
+
+#endif /* CONFIG_DEBUG_RTL871X */
+
+
+#if	defined (_dbgdump) && defined (_MODULE_DEFINE_)
+
+		#undef RT_TRACE
+		#define RT_TRACE(_Comp, _Level, Fmt)\
+		do {\
+			if((_Comp & GlobalDebugComponents) && (_Level <= GlobalDebugLevel)) {\
+				_dbgdump("%s [0x%08x,%d]", RTL871X_MODULE_NAME, (unsigned int)_Comp, _Level);\
+				_dbgdump Fmt;\
+			}\
+		}while(0)
+
+#endif
+
+
+#if	defined (_dbgdump)
+
+		#undef  _func_enter_
+		#define _func_enter_ \
+		do {	\
+			if (GlobalDebugLevel >= _drv_debug_) \
+			{																	\
+				_dbgdump("\n %s : %s enters at %d\n", RTL871X_MODULE_NAME, __FUNCTION__, __LINE__);\
+			}		\
+		} while(0)
+
+		#undef  _func_exit_
+		#define _func_exit_ \
+		do {	\
+			if (GlobalDebugLevel >= _drv_debug_) \
+			{																	\
+				_dbgdump("\n %s : %s exits at %d\n", RTL871X_MODULE_NAME, __FUNCTION__, __LINE__); \
+			}	\
+		} while(0)
+
+		#undef RT_PRINT_DATA
+		#define RT_PRINT_DATA(_Comp, _Level, _TitleString, _HexData, _HexDataLen)			\
+			if(((_Comp) & GlobalDebugComponents) && (_Level <= GlobalDebugLevel))	\
+			{									\
+				int __i;								\
+				u8	*ptr = (u8 *)_HexData;				\
+				_dbgdump("Rtl871x: ");						\
+				_dbgdump(_TitleString);						\
+				for( __i=0; __i<(int)_HexDataLen; __i++ )				\
+				{								\
+					_dbgdump("%02X%s", ptr[__i], (((__i + 1) % 4) == 0)?"  ":" ");	\
+					if (((__i + 1) % 16) == 0)	_dbgdump("\n");			\
+				}								\
+				_dbgdump("\n");							\
+			}
+#endif
+
+
+#ifdef CONFIG_DEBUG_RTL819X
+
+#undef	_dbgdump
+
+#ifdef PLATFORM_WINDOWS
+
+	#ifdef PLATFORM_OS_XP
+
+	#define _dbgdump	DbgPrint
+
+	#elif defined PLATFORM_OS_CE
+
+	#define _dbgdump	rtl871x_cedbg
+
+	#endif
+
+#elif defined PLATFORM_LINUX
+
+	#define _dbgdump	printk
+
+#elif defined PLATFORM_FREEBSD
+
+	#define _dbgdump	printf
+
+#endif
+
+#endif /* CONFIG_DEBUG_RTL819X */
+
+
+#ifdef PLATFORM_WINDOWS
+	#define DBG_871X do {} while(0)
+	#define MSG_8192C do {} while(0)
+	#define DBG_8192C do {} while(0)
+	#define WRN_8192C do {} while(0)
+	#define ERR_8192C do {} while(0)
+#endif
+
+#ifdef PLATFORM_LINUX
+	#define DBG_871X(x, ...) do {} while(0)
+	#define MSG_8192C(x, ...) do {} while(0)
+	#define DBG_8192C(x,...) do {} while(0)
+	#define WRN_8192C(x,...) do {} while(0)
+	#define ERR_8192C(x,...) do {} while(0)
+#endif
+
+#ifdef PLATFORM_FREEBSD
+	#define _dbgdump	printf
+	#define DBG_871X(x, ...) do {} while(0)
+	#define MSG_8192C(x, ...) do {} while(0)
+	#define DBG_8192C(x,...) do {} while(0)
+	#define WRN_8192C(x,...) do {} while(0)
+	#define ERR_8192C(x,...) do {} while(0)
+#endif
+
+extern u32 GlobalDebugLevel;
+#define LOG_LEVEL(level, ...)\
+                do {\
+                        if(level <= GlobalDebugLevel) {\
+                                printk(__VA_ARGS__);\
+                        }\
+                }while(0)
+
+#define DBG_871X_LEVEL LOG_LEVEL
+
+#if     defined (_dbgdump)
+        #undef DBG_871X
+//      #define DBG_871X _dbgdump
+        #define DBG_871X(...) LOG_LEVEL(_drv_debug_ , __VA_ARGS__)
+
+        #undef MSG_8192C
+//      #define MSG_8192C _dbgdump
+        #define MSG_8192C(...) LOG_LEVEL(_drv_info_ , __VA_ARGS__)
+
+        #undef DBG_8192C
+//      #define DBG_8192C _dbgdump
+        #define DBG_8192C(...) LOG_LEVEL(_drv_debug_ ,  __VA_ARGS__)
+
+
+	#undef WRN_8192C
+	#define WRN_8192C _dbgdump
+
+	#undef ERR_8192C
+	#define ERR_8192C _dbgdump
+#endif
+
+
+#ifdef CONFIG_PROC_DEBUG
+
+	int proc_get_drv_version(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_log_level(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_set_log_level(struct file *file, const char *buffer,
+			unsigned long count, void *data);
+
+#ifdef DBG_MEM_ALLOC
+	int proc_get_mstat(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+#endif /* DBG_MEM_ALLOC */
+
+	int proc_get_write_reg(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_set_write_reg(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+
+	int proc_get_read_reg(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_set_read_reg(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+
+
+	int proc_get_fwstate(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_sec_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_mlmext_state(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_qos_option(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_ht_option(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_rf_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_ap_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_adapter_state(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_trx_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_mac_reg_dump1(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_mac_reg_dump2(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_mac_reg_dump3(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_bb_reg_dump1(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_bb_reg_dump2(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_bb_reg_dump3(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_rf_reg_dump1(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_rf_reg_dump2(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_rf_reg_dump3(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_rf_reg_dump4(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+#ifdef CONFIG_AP_MODE
+
+	int proc_get_all_sta_info(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+#endif
+
+#ifdef DBG_MEMORY_LEAK
+	int proc_get_malloc_cnt(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+#endif
+
+#ifdef CONFIG_FIND_BEST_CHANNEL
+	int proc_get_best_channel(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+	int proc_set_best_channel(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+#endif
+
+	int proc_get_rx_signal(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_set_rx_signal(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+
+	int proc_get_ht_enable(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_set_ht_enable(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+
+	int proc_get_cbw40_enable(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_set_cbw40_enable(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+
+	int proc_get_ampdu_enable(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_set_ampdu_enable(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+
+	int proc_get_two_path_rssi(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_rx_stbc(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_set_rx_stbc(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+
+
+	int proc_get_vid(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_pid(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_get_rssi_disp(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+
+	int proc_set_rssi_disp(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+
+#if defined(DBG_CONFIG_ERROR_DETECT)
+int proc_get_sreset(char *page, char **start, off_t offset, int count, int *eof, void *data);
+int proc_set_sreset(struct file *file, const char *buffer, unsigned long count, void *data);
+#endif /* DBG_CONFIG_ERROR_DETECT */
+
+#ifdef CONFIG_DM_ADAPTIVITY
+int proc_get_dm_adaptivity(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data);
+int proc_set_dm_adaptivity(struct file *file, const char *buffer,
+		unsigned long count, void *data);
+#endif /* CONFIG_DM_ADAPTIVITY */
+
+#endif //CONFIG_PROC_DEBUG
+
+#endif	//__RTW_DEBUG_H__
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_eeprom.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_eeprom.h
new file mode 100644
index 000000000000..432610974572
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_eeprom.h
@@ -0,0 +1,152 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_EEPROM_H__
+#define __RTW_EEPROM_H__
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#define	RTL8712_EEPROM_ID			0x8712
+#define	EEPROM_MAX_SIZE			256
+#define	CLOCK_RATE					50			//100us
+
+//- EEPROM opcodes
+#define EEPROM_READ_OPCODE		06
+#define EEPROM_WRITE_OPCODE		05
+#define EEPROM_ERASE_OPCODE		07
+#define EEPROM_EWEN_OPCODE		19      // Erase/write enable
+#define EEPROM_EWDS_OPCODE		16      // Erase/write disable
+
+//Country codes
+#define USA							0x555320
+#define EUROPE						0x1 //temp, should be provided later
+#define JAPAN						0x2 //temp, should be provided later
+
+#ifdef CONFIG_SDIO_HCI
+#define eeprom_cis0_sz	17
+#define eeprom_cis1_sz	50
+#endif
+
+#define	EEPROM_CID_DEFAULT			0x0
+#define	EEPROM_CID_ALPHA				0x1
+#define	EEPROM_CID_Senao				0x3
+#define	EEPROM_CID_NetCore				0x5
+#define	EEPROM_CID_CAMEO				0X8
+#define	EEPROM_CID_SITECOM				0x9
+#define	EEPROM_CID_COREGA				0xB
+#define	EEPROM_CID_EDIMAX_BELKIN		0xC
+#define	EEPROM_CID_SERCOMM_BELKIN		0xE
+#define	EEPROM_CID_CAMEO1				0xF
+#define	EEPROM_CID_WNC_COREGA		0x12
+#define	EEPROM_CID_CLEVO				0x13
+#define	EEPROM_CID_WHQL				0xFE // added by chiyoko for dtm, 20090108
+
+//
+// Customer ID, note that:
+// This variable is initiailzed through EEPROM or registry,
+// however, its definition may be different with that in EEPROM for
+// EEPROM size consideration. So, we have to perform proper translation between them.
+// Besides, CustomerID of registry has precedence of that of EEPROM.
+// defined below. 060703, by rcnjko.
+//
+typedef enum _RT_CUSTOMER_ID
+{
+	RT_CID_DEFAULT = 0,
+	RT_CID_8187_ALPHA0 = 1,
+	RT_CID_8187_SERCOMM_PS = 2,
+	RT_CID_8187_HW_LED = 3,
+	RT_CID_8187_NETGEAR = 4,
+	RT_CID_WHQL = 5,
+	RT_CID_819x_CAMEO  = 6,
+	RT_CID_819x_RUNTOP = 7,
+	RT_CID_819x_Senao = 8,
+	RT_CID_TOSHIBA = 9,	// Merge by Jacken, 2008/01/31.
+	RT_CID_819x_Netcore = 10,
+	RT_CID_Nettronix = 11,
+	RT_CID_DLINK = 12,
+	RT_CID_PRONET = 13,
+	RT_CID_COREGA = 14,
+	RT_CID_CHINA_MOBILE = 15,
+	RT_CID_819x_ALPHA = 16,
+	RT_CID_819x_Sitecom = 17,
+	RT_CID_CCX = 18, // It's set under CCX logo test and isn't demanded for CCX functions, but for test behavior like retry limit and tx report. By Bruce, 2009-02-17.
+	RT_CID_819x_Lenovo = 19,
+	RT_CID_819x_QMI = 20,
+	RT_CID_819x_Edimax_Belkin = 21,
+	RT_CID_819x_Sercomm_Belkin = 22,
+	RT_CID_819x_CAMEO1 = 23,
+	RT_CID_819x_MSI = 24,
+	RT_CID_819x_Acer = 25,
+	RT_CID_819x_AzWave_ASUS = 26,
+	RT_CID_819x_AzWave = 27, // For AzWave in PCIe, The ID is AzWave use and not only Asus
+	RT_CID_819x_HP = 28,
+	RT_CID_819x_WNC_COREGA = 29,
+	RT_CID_819x_Arcadyan_Belkin = 30,
+	RT_CID_819x_SAMSUNG = 31,
+	RT_CID_819x_CLEVO = 32,
+	RT_CID_819x_DELL = 33,
+	RT_CID_819x_PRONETS = 34,
+	RT_CID_819x_Edimax_ASUS = 35,
+	RT_CID_819x_CAMEO_NETGEAR = 36,
+}RT_CUSTOMER_ID, *PRT_CUSTOMER_ID;
+
+struct eeprom_priv
+{
+	u8		bautoload_fail_flag;
+	//u8		bempty;
+	//u8		sys_config;
+	u8		mac_addr[6];	//PermanentAddress
+	//u8		config0;
+	u16		channel_plan;
+	//u8		country_string[3];
+	//u8		tx_power_b[15];
+	//u8		tx_power_g[15];
+	//u8		tx_power_a[201];
+
+	u8		EepromOrEfuse;
+
+	u8		efuse_eeprom_data[EEPROM_MAX_SIZE];
+
+#ifdef CONFIG_SDIO_HCI
+	u8		sdio_setting;
+	u32		ocr;
+	u8		cis0[eeprom_cis0_sz];
+	u8		cis1[eeprom_cis1_sz];
+#endif
+};
+
+
+extern void eeprom_write16(_adapter *padapter, u16 reg, u16 data);
+extern u16 eeprom_read16(_adapter *padapter, u16 reg);
+extern void read_eeprom_content(_adapter *padapter);
+extern void eeprom_read_sz(_adapter * padapter, u16 reg,u8* data, u32 sz);
+
+extern void read_eeprom_content_by_attrib(_adapter *	padapter	);
+
+#ifdef PLATFORM_LINUX
+#ifdef CONFIG_ADAPTOR_INFO_CACHING_FILE
+extern int isAdaptorInfoFileValid(void);
+extern int storeAdaptorInfoFile(char *path, struct eeprom_priv * eeprom_priv);
+extern int retriveAdaptorInfoFile(char *path, struct eeprom_priv * eeprom_priv);
+#endif //CONFIG_ADAPTOR_INFO_CACHING_FILE
+#endif //PLATFORM_LINUX
+
+#endif  //__RTL871X_EEPROM_H__
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_efuse.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_efuse.h
new file mode 100644
index 000000000000..dd09b85ea4f2
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_efuse.h
@@ -0,0 +1,123 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_EFUSE_H__
+#define __RTW_EFUSE_H__
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+
+#define	EFUSE_ERROE_HANDLE		1
+
+#define	PG_STATE_HEADER 		0x01
+#define	PG_STATE_WORD_0		0x02
+#define	PG_STATE_WORD_1		0x04
+#define	PG_STATE_WORD_2		0x08
+#define	PG_STATE_WORD_3		0x10
+#define	PG_STATE_DATA			0x20
+
+#define	PG_SWBYTE_H			0x01
+#define	PG_SWBYTE_L			0x02
+
+#define	PGPKT_DATA_SIZE		8
+
+#define	EFUSE_WIFI				0
+#define	EFUSE_BT				1
+
+enum _EFUSE_DEF_TYPE {
+	TYPE_EFUSE_MAX_SECTION				= 0,
+	TYPE_EFUSE_REAL_CONTENT_LEN			= 1,
+	TYPE_AVAILABLE_EFUSE_BYTES_BANK		= 2,
+	TYPE_AVAILABLE_EFUSE_BYTES_TOTAL	= 3,
+	TYPE_EFUSE_MAP_LEN					= 4,
+	TYPE_EFUSE_PROTECT_BYTES_BANK		= 5,
+};
+
+#define		EFUSE_MAX_MAP_LEN		256
+#define		EFUSE_MAX_HW_SIZE		512
+#define		EFUSE_MAX_SECTION_BASE	16
+
+#define EXT_HEADER(header) ((header & 0x1F ) == 0x0F)
+#define ALL_WORDS_DISABLED(wde)	((wde & 0x0F) == 0x0F)
+#define GET_HDR_OFFSET_2_0(header) ( (header & 0xE0) >> 5)
+
+#define		EFUSE_REPEAT_THRESHOLD_			3
+
+//=============================================
+//	The following is for BT Efuse definition
+//=============================================
+#define		EFUSE_BT_MAX_MAP_LEN		1024
+#define		EFUSE_MAX_BANK			4
+#define		EFUSE_MAX_BT_BANK		(EFUSE_MAX_BANK-1)
+//=============================================
+/*--------------------------Define Parameters-------------------------------*/
+#define		EFUSE_MAX_WORD_UNIT			4
+
+/*------------------------------Define structure----------------------------*/
+typedef struct PG_PKT_STRUCT_A{
+	u8 offset;
+	u8 word_en;
+	u8 data[8];
+	u8 word_cnts;
+}PGPKT_STRUCT,*PPGPKT_STRUCT;
+/*------------------------------Define structure----------------------------*/
+
+
+/*------------------------Export global variable----------------------------*/
+extern u8 fakeEfuseBank;
+extern u32 fakeEfuseUsedBytes;
+extern u8 fakeEfuseContent[];
+extern u8 fakeEfuseInitMap[];
+extern u8 fakeEfuseModifiedMap[];
+
+extern u32 BTEfuseUsedBytes;
+extern u8 BTEfuseContent[EFUSE_MAX_BT_BANK][EFUSE_MAX_HW_SIZE];
+extern u8 BTEfuseInitMap[];
+extern u8 BTEfuseModifiedMap[];
+
+extern u32 fakeBTEfuseUsedBytes;
+extern u8 fakeBTEfuseContent[EFUSE_MAX_BT_BANK][EFUSE_MAX_HW_SIZE];
+extern u8 fakeBTEfuseInitMap[];
+extern u8 fakeBTEfuseModifiedMap[];
+/*------------------------Export global variable----------------------------*/
+
+u8	efuse_GetCurrentSize(PADAPTER padapter, u16 *size);
+u16	efuse_GetMaxSize(PADAPTER padapter);
+u8	rtw_efuse_access(PADAPTER padapter, u8 bRead, u16 start_addr, u16 cnts, u8 *data);
+u8	rtw_efuse_map_read(PADAPTER padapter, u16 addr, u16 cnts, u8 *data);
+u8	rtw_efuse_map_write(PADAPTER padapter, u16 addr, u16 cnts, u8 *data);
+
+u16	Efuse_GetCurrentSize(PADAPTER pAdapter, u8 efuseType, BOOLEAN bPseudoTest);
+u8	Efuse_CalculateWordCnts(u8 word_en);
+void	ReadEFuseByte(PADAPTER Adapter, u16 _offset, u8 *pbuf, BOOLEAN bPseudoTest) ;
+void	EFUSE_GetEfuseDefinition(PADAPTER pAdapter, u8 efuseType, u8 type, void *pOut, BOOLEAN bPseudoTest);
+u8	efuse_OneByteRead(PADAPTER pAdapter, u16 addr, u8 *data, BOOLEAN	 bPseudoTest);
+u8	efuse_OneByteWrite(PADAPTER pAdapter, u16 addr, u8 data, BOOLEAN	 bPseudoTest);
+
+void	Efuse_PowerSwitch(PADAPTER pAdapter,u8	bWrite,u8	 PwrState);
+int 	Efuse_PgPacketRead(PADAPTER pAdapter, u8 offset, u8 *data, BOOLEAN bPseudoTest);
+int 	Efuse_PgPacketWrite(PADAPTER pAdapter, u8 offset, u8 word_en, u8 *data, BOOLEAN bPseudoTest);
+void	efuse_WordEnableDataRead(u8 word_en, u8 *sourdata, u8 *targetdata);
+u8	Efuse_WordEnableDataWrite(PADAPTER pAdapter, u16 efuse_addr, u8 word_en, u8 *data, BOOLEAN bPseudoTest);
+
+u8	EFUSE_Read1Byte(PADAPTER pAdapter, u16 Address);
+void	EFUSE_ShadowMapUpdate(PADAPTER pAdapter, u8 efuseType, BOOLEAN bPseudoTest);
+void	EFUSE_ShadowRead(PADAPTER pAdapter, u8 Type, u16 Offset, u32 *Value);
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_event.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_event.h
new file mode 100644
index 000000000000..3a0bbf33317b
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_event.h
@@ -0,0 +1,153 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_EVENT_H_
+#define _RTW_EVENT_H_
+#include <drv_conf.h>
+#include <osdep_service.h>
+
+#ifndef CONFIG_RTL8711FW
+#ifdef PLATFORM_LINUX
+#include <wlan_bssdef.h>
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26))
+#include <asm/semaphore.h>
+#else
+#include <linux/semaphore.h>
+#endif
+#include <linux/sem.h>
+#endif
+#else
+#include <wlan_bssdef.h>
+#endif//CONFIG_RTL8711FW
+
+
+
+#ifdef CONFIG_H2CLBK
+#include <h2clbk.h>
+#endif
+
+/*
+Used to report a bss has been scanned
+
+*/
+struct survey_event	{
+	WLAN_BSSID_EX bss;
+};
+
+/*
+Used to report that the requested site survey has been done.
+
+bss_cnt indicates the number of bss that has been reported.
+
+
+*/
+struct surveydone_event {
+	unsigned int	bss_cnt;
+
+};
+
+/*
+Used to report the link result of joinning the given bss
+
+
+join_res:
+-1: authentication fail
+-2: association fail
+> 0: TID
+
+*/
+struct joinbss_event {
+	struct	wlan_network	network;
+};
+
+/*
+Used to report a given STA has joinned the created BSS.
+It is used in AP/Ad-HoC(M) mode.
+
+
+*/
+struct stassoc_event {
+	unsigned char macaddr[6];
+	unsigned char rsvd[2];
+	int    cam_id;
+
+};
+
+struct stadel_event {
+ unsigned char macaddr[6];
+ unsigned char rsvd[2]; //for reason
+ int mac_id;
+};
+
+struct addba_event
+{
+	unsigned int tid;
+};
+
+
+#ifdef CONFIG_H2CLBK
+struct c2hlbk_event{
+	unsigned char mac[6];
+	unsigned short	s0;
+	unsigned short	s1;
+	unsigned int	w0;
+	unsigned char	b0;
+	unsigned short  s2;
+	unsigned char	b1;
+	unsigned int	w1;
+};
+#endif//CONFIG_H2CLBK
+
+#define GEN_EVT_CODE(event)	event ## _EVT_
+
+
+
+struct fwevent {
+	u32	parmsize;
+	void (*event_callback)(_adapter *dev, u8 *pbuf);
+};
+
+
+#define C2HEVENT_SZ			32
+
+struct event_node{
+	unsigned char *node;
+	unsigned char evt_code;
+	unsigned short evt_sz;
+	volatile int	*caller_ff_tail;
+	int	caller_ff_sz;
+};
+
+struct c2hevent_queue {
+	volatile int	head;
+	volatile int	tail;
+	struct	event_node	nodes[C2HEVENT_SZ];
+	unsigned char	seq;
+};
+
+#define NETWORK_QUEUE_SZ	4
+
+struct network_queue {
+	volatile int	head;
+	volatile int	tail;
+	WLAN_BSSID_EX networks[NETWORK_QUEUE_SZ];
+};
+
+
+#endif // _WLANEVENT_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ht.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ht.h
new file mode 100644
index 000000000000..74e416de33ea
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ht.h
@@ -0,0 +1,49 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_HT_H_
+#define _RTW_HT_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include "wifi.h"
+
+struct ht_priv
+{
+	u32	ht_option;
+	u32	ampdu_enable;//for enable Tx A-MPDU
+	//u8	baddbareq_issued[16];
+	u32	tx_amsdu_enable;//for enable Tx A-MSDU
+	u32	tx_amdsu_maxlen; // 1: 8k, 0:4k ; default:8k, for tx
+	u32	rx_ampdu_maxlen; //for rx reordering ctrl win_sz, updated when join_callback.
+
+	u8	bwmode;//
+	u8	ch_offset;//PRIME_CHNL_OFFSET
+	u8	sgi;//short GI
+
+	//for processing Tx A-MPDU
+	u8	agg_enable_bitmap;
+	//u8	ADDBA_retry_count;
+	u8	candidate_tid_bitmap;
+
+	struct rtw_ieee80211_ht_cap ht_cap;
+
+};
+
+#endif	//_RTL871X_HT_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_io.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_io.h
new file mode 100644
index 000000000000..daf342acb629
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_io.h
@@ -0,0 +1,504 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#ifndef _RTW_IO_H_
+#define _RTW_IO_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <osdep_intf.h>
+
+#ifdef PLATFORM_LINUX
+#include <asm/byteorder.h>
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26))
+#include <asm/semaphore.h>
+#else
+#include <linux/semaphore.h>
+#endif
+#include <linux/list.h>
+//#include <linux/smp_lock.h>
+#include <linux/spinlock.h>
+#include <asm/atomic.h>
+
+#ifdef CONFIG_USB_HCI
+#include <linux/usb.h>
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,21))
+#include <linux/usb_ch9.h>
+#else
+#include <linux/usb/ch9.h>
+#endif
+#endif //CONFIG_USB_HCI
+
+#endif //PLATFORM_LINUX
+
+
+#define NUM_IOREQ		8
+
+#ifdef PLATFORM_WINDOWS
+#define MAX_PROT_SZ	64
+#endif
+#ifdef PLATFORM_LINUX
+#define MAX_PROT_SZ	(64-16)
+#endif
+
+#define _IOREADY			0
+#define _IO_WAIT_COMPLETE   1
+#define _IO_WAIT_RSP        2
+
+// IO COMMAND TYPE
+#define _IOSZ_MASK_		(0x7F)
+#define _IO_WRITE_		BIT(7)
+#define _IO_FIXED_		BIT(8)
+#define _IO_BURST_		BIT(9)
+#define _IO_BYTE_		BIT(10)
+#define _IO_HW_			BIT(11)
+#define _IO_WORD_		BIT(12)
+#define _IO_SYNC_		BIT(13)
+#define _IO_CMDMASK_	(0x1F80)
+
+
+/*
+	For prompt mode accessing, caller shall free io_req
+	Otherwise, io_handler will free io_req
+*/
+
+
+
+// IO STATUS TYPE
+#define _IO_ERR_		BIT(2)
+#define _IO_SUCCESS_	BIT(1)
+#define _IO_DONE_		BIT(0)
+
+
+#define IO_RD32			(_IO_SYNC_ | _IO_WORD_)
+#define IO_RD16			(_IO_SYNC_ | _IO_HW_)
+#define IO_RD8			(_IO_SYNC_ | _IO_BYTE_)
+
+#define IO_RD32_ASYNC	(_IO_WORD_)
+#define IO_RD16_ASYNC	(_IO_HW_)
+#define IO_RD8_ASYNC	(_IO_BYTE_)
+
+#define IO_WR32			(_IO_WRITE_ | _IO_SYNC_ | _IO_WORD_)
+#define IO_WR16			(_IO_WRITE_ | _IO_SYNC_ | _IO_HW_)
+#define IO_WR8			(_IO_WRITE_ | _IO_SYNC_ | _IO_BYTE_)
+
+#define IO_WR32_ASYNC	(_IO_WRITE_ | _IO_WORD_)
+#define IO_WR16_ASYNC	(_IO_WRITE_ | _IO_HW_)
+#define IO_WR8_ASYNC	(_IO_WRITE_ | _IO_BYTE_)
+
+/*
+
+	Only Sync. burst accessing is provided.
+
+*/
+
+#define IO_WR_BURST(x)		(_IO_WRITE_ | _IO_SYNC_ | _IO_BURST_ | ( (x) & _IOSZ_MASK_))
+#define IO_RD_BURST(x)		(_IO_SYNC_ | _IO_BURST_ | ( (x) & _IOSZ_MASK_))
+
+
+
+//below is for the intf_option bit defition...
+
+#define _INTF_ASYNC_	BIT(0)	//support async io
+
+struct intf_priv;
+struct intf_hdl;
+struct io_queue;
+
+struct _io_ops
+{
+		u8 (*_read8)(struct intf_hdl *pintfhdl, u32 addr);
+		u16 (*_read16)(struct intf_hdl *pintfhdl, u32 addr);
+		u32 (*_read32)(struct intf_hdl *pintfhdl, u32 addr);
+
+		int (*_write8)(struct intf_hdl *pintfhdl, u32 addr, u8 val);
+		int (*_write16)(struct intf_hdl *pintfhdl, u32 addr, u16 val);
+		int (*_write32)(struct intf_hdl *pintfhdl, u32 addr, u32 val);
+		int (*_writeN)(struct intf_hdl *pintfhdl, u32 addr, u32 length, u8 *pdata);
+
+		int (*_write8_async)(struct intf_hdl *pintfhdl, u32 addr, u8 val);
+		int (*_write16_async)(struct intf_hdl *pintfhdl, u32 addr, u16 val);
+		int (*_write32_async)(struct intf_hdl *pintfhdl, u32 addr, u32 val);
+
+		void (*_read_mem)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+		void (*_write_mem)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+
+		void (*_sync_irp_protocol_rw)(struct io_queue *pio_q);
+
+		u32 (*_read_interrupt)(struct intf_hdl *pintfhdl, u32 addr);
+
+		u32 (*_read_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+		u32 (*_write_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *pmem);
+
+		u32 (*_write_scsi)(struct intf_hdl *pintfhdl,u32 cnt, u8 *pmem);
+
+		void (*_read_port_cancel)(struct intf_hdl *pintfhdl);
+		void (*_write_port_cancel)(struct intf_hdl *pintfhdl);
+
+};
+
+struct io_req {
+	_list	list;
+	u32	addr;
+	volatile u32	val;
+	u32	command;
+	u32	status;
+	u8	*pbuf;
+	_sema	sema;
+
+#ifdef PLATFORM_OS_CE
+#ifdef CONFIG_USB_HCI
+	// URB handler for rtw_write_mem
+	USB_TRANSFER usb_transfer_write_mem;
+#endif
+#endif
+
+	void (*_async_io_callback)(_adapter *padater, struct io_req *pio_req, u8 *cnxt);
+	u8 *cnxt;
+
+#ifdef PLATFORM_OS_XP
+	PMDL pmdl;
+	PIRP  pirp;
+
+#ifdef CONFIG_SDIO_HCI
+	PSDBUS_REQUEST_PACKET sdrp;
+#endif
+
+#endif
+
+
+};
+
+struct	intf_hdl {
+
+/*
+	u32	intf_option;
+	u32	bus_status;
+	u32	do_flush;
+	u8	*adapter;
+	u8	*intf_dev;
+	struct intf_priv	*pintfpriv;
+	u8	cnt;
+	void (*intf_hdl_init)(u8 *priv);
+	void (*intf_hdl_unload)(u8 *priv);
+	void (*intf_hdl_open)(u8 *priv);
+	void (*intf_hdl_close)(u8 *priv);
+	struct	_io_ops	io_ops;
+	//u8 intf_status;//moved to struct intf_priv
+	u16 len;
+	u16 done_len;
+*/
+	_adapter *padapter;
+	struct dvobj_priv *pintf_dev;//	pointer to &(padapter->dvobjpriv);
+
+	struct _io_ops	io_ops;
+
+};
+
+struct reg_protocol_rd {
+
+#ifdef CONFIG_LITTLE_ENDIAN
+
+	//DW1
+	u32		NumOfTrans:4;
+	u32		Reserved1:4;
+	u32		Reserved2:24;
+	//DW2
+	u32		ByteCount:7;
+	u32		WriteEnable:1;		//0:read, 1:write
+	u32		FixOrContinuous:1;	//0:continuous, 1: Fix
+	u32		BurstMode:1;
+	u32		Byte1Access:1;
+	u32		Byte2Access:1;
+	u32		Byte4Access:1;
+	u32		Reserved3:3;
+	u32		Reserved4:16;
+	//DW3
+	u32		BusAddress;
+	//DW4
+	//u32		Value;
+#else
+
+
+//DW1
+	u32 Reserved1  :4;
+	u32 NumOfTrans :4;
+
+	u32 Reserved2  :24;
+
+	//DW2
+	u32 WriteEnable : 1;
+	u32 ByteCount :7;
+
+
+	u32 Reserved3 : 3;
+	u32 Byte4Access : 1;
+
+	u32 Byte2Access : 1;
+	u32 Byte1Access : 1;
+	u32 BurstMode :1 ;
+	u32 FixOrContinuous : 1;
+
+	u32 Reserved4 : 16;
+
+	//DW3
+	u32		BusAddress;
+
+	//DW4
+	//u32		Value;
+
+#endif
+
+};
+
+
+struct reg_protocol_wt {
+
+
+#ifdef CONFIG_LITTLE_ENDIAN
+
+	//DW1
+	u32		NumOfTrans:4;
+	u32		Reserved1:4;
+	u32		Reserved2:24;
+	//DW2
+	u32		ByteCount:7;
+	u32		WriteEnable:1;		//0:read, 1:write
+	u32		FixOrContinuous:1;	//0:continuous, 1: Fix
+	u32		BurstMode:1;
+	u32		Byte1Access:1;
+	u32		Byte2Access:1;
+	u32		Byte4Access:1;
+	u32		Reserved3:3;
+	u32		Reserved4:16;
+	//DW3
+	u32		BusAddress;
+	//DW4
+	u32		Value;
+
+#else
+	//DW1
+	u32 Reserved1  :4;
+	u32 NumOfTrans :4;
+
+	u32 Reserved2  :24;
+
+	//DW2
+	u32 WriteEnable : 1;
+	u32 ByteCount :7;
+
+	u32 Reserved3 : 3;
+	u32 Byte4Access : 1;
+
+	u32 Byte2Access : 1;
+	u32 Byte1Access : 1;
+	u32 BurstMode :1 ;
+	u32 FixOrContinuous : 1;
+
+	u32 Reserved4 : 16;
+
+	//DW3
+	u32		BusAddress;
+
+	//DW4
+	u32		Value;
+
+#endif
+
+};
+
+
+
+/*
+Below is the data structure used by _io_handler
+
+*/
+
+struct io_queue {
+	_lock	lock;
+	_list  	free_ioreqs;
+	_list		pending;		//The io_req list that will be served in the single protocol read/write.
+	_list		processing;
+	u8	*free_ioreqs_buf; // 4-byte aligned
+	u8	*pallocated_free_ioreqs_buf;
+	struct	intf_hdl	intf;
+};
+
+struct io_priv{
+
+	_adapter *padapter;
+
+	struct intf_hdl intf;
+
+};
+
+extern uint ioreq_flush(_adapter *adapter, struct io_queue *ioqueue);
+extern void sync_ioreq_enqueue(struct io_req *preq,struct io_queue *ioqueue);
+extern uint sync_ioreq_flush(_adapter *adapter, struct io_queue *ioqueue);
+
+
+extern uint free_ioreq(struct io_req *preq, struct io_queue *pio_queue);
+extern struct io_req *alloc_ioreq(struct io_queue *pio_q);
+
+extern uint register_intf_hdl(u8 *dev, struct intf_hdl *pintfhdl);
+extern void unregister_intf_hdl(struct intf_hdl *pintfhdl);
+
+extern void _rtw_attrib_read(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+extern void _rtw_attrib_write(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+
+extern u8 _rtw_read8(_adapter *adapter, u32 addr);
+extern u16 _rtw_read16(_adapter *adapter, u32 addr);
+extern u32 _rtw_read32(_adapter *adapter, u32 addr);
+extern void _rtw_read_mem(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+extern void _rtw_read_port(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+extern void _rtw_read_port_cancel(_adapter *adapter);
+
+
+extern int _rtw_write8(_adapter *adapter, u32 addr, u8 val);
+extern int _rtw_write16(_adapter *adapter, u32 addr, u16 val);
+extern int _rtw_write32(_adapter *adapter, u32 addr, u32 val);
+extern int _rtw_writeN(_adapter *adapter, u32 addr, u32 length, u8 *pdata);
+
+extern int _rtw_write8_async(_adapter *adapter, u32 addr, u8 val);
+extern int _rtw_write16_async(_adapter *adapter, u32 addr, u16 val);
+extern int _rtw_write32_async(_adapter *adapter, u32 addr, u32 val);
+
+extern void _rtw_write_mem(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+extern u32 _rtw_write_port(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+u32 _rtw_write_port_and_wait(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem, int timeout_ms);
+extern void _rtw_write_port_cancel(_adapter *adapter);
+
+#ifdef DBG_IO
+bool match_read_sniff_ranges(u16 addr, u16 len);
+bool match_write_sniff_ranges(u16 addr, u16 len);
+
+extern u8 dbg_rtw_read8(_adapter *adapter, u32 addr, const char *caller, const int line);
+extern u16 dbg_rtw_read16(_adapter *adapter, u32 addr, const char *caller, const int line);
+extern u32 dbg_rtw_read32(_adapter *adapter, u32 addr, const char *caller, const int line);
+
+extern int dbg_rtw_write8(_adapter *adapter, u32 addr, u8 val, const char *caller, const int line);
+extern int dbg_rtw_write16(_adapter *adapter, u32 addr, u16 val, const char *caller, const int line);
+extern int dbg_rtw_write32(_adapter *adapter, u32 addr, u32 val, const char *caller, const int line);
+extern int dbg_rtw_writeN(_adapter *adapter, u32 addr ,u32 length , u8 *data, const char *caller, const int line);
+
+#define rtw_read8(adapter, addr) dbg_rtw_read8((adapter), (addr), __FUNCTION__, __LINE__)
+#define rtw_read16(adapter, addr) dbg_rtw_read16((adapter), (addr), __FUNCTION__, __LINE__)
+#define rtw_read32(adapter, addr) dbg_rtw_read32((adapter), (addr), __FUNCTION__, __LINE__)
+#define rtw_read_mem(adapter, addr, cnt, mem) _rtw_read_mem((adapter), (addr), (cnt), (mem))
+#define rtw_read_port(adapter, addr, cnt, mem) _rtw_read_port((adapter), (addr), (cnt), (mem))
+#define rtw_read_port_cancel(adapter) _rtw_read_port_cancel((adapter))
+
+#define  rtw_write8(adapter, addr, val) dbg_rtw_write8((adapter), (addr), (val), __FUNCTION__, __LINE__)
+#define  rtw_write16(adapter, addr, val) dbg_rtw_write16((adapter), (addr), (val), __FUNCTION__, __LINE__)
+#define  rtw_write32(adapter, addr, val) dbg_rtw_write32((adapter), (addr), (val), __FUNCTION__, __LINE__)
+#define  rtw_writeN(adapter, addr, length, data) dbg_rtw_writeN((adapter), (addr), (length), (data), __FUNCTION__, __LINE__)
+
+#define rtw_write8_async(adapter, addr, val) _rtw_write8_async((adapter), (addr), (val))
+#define rtw_write16_async(adapter, addr, val) _rtw_write16_async((adapter), (addr), (val))
+#define rtw_write32_async(adapter, addr, val) _rtw_write32_async((adapter), (addr), (val))
+
+#define rtw_write_mem(adapter, addr, cnt, mem) _rtw_write_mem((adapter), addr, cnt, mem)
+#define rtw_write_port(adapter, addr, cnt, mem) _rtw_write_port(adapter, addr, cnt, mem)
+#define rtw_write_port_and_wait(adapter, addr, cnt, mem, timeout_ms) _rtw_write_port_and_wait((adapter), (addr), (cnt), (mem), (timeout_ms))
+#define rtw_write_port_cancel(adapter) _rtw_write_port_cancel(adapter)
+#else //DBG_IO
+#define rtw_read8(adapter, addr) _rtw_read8((adapter), (addr))
+#define rtw_read16(adapter, addr) _rtw_read16((adapter), (addr))
+#define rtw_read32(adapter, addr) _rtw_read32((adapter), (addr))
+#define rtw_read_mem(adapter, addr, cnt, mem) _rtw_read_mem((adapter), (addr), (cnt), (mem))
+#define rtw_read_port(adapter, addr, cnt, mem) _rtw_read_port((adapter), (addr), (cnt), (mem))
+#define rtw_read_port_cancel(adapter) _rtw_read_port_cancel((adapter))
+
+#define  rtw_write8(adapter, addr, val) _rtw_write8((adapter), (addr), (val))
+#define  rtw_write16(adapter, addr, val) _rtw_write16((adapter), (addr), (val))
+#define  rtw_write32(adapter, addr, val) _rtw_write32((adapter), (addr), (val))
+#define  rtw_writeN(adapter, addr, length, data) _rtw_writeN((adapter), (addr), (length), (data))
+
+#define rtw_write8_async(adapter, addr, val) _rtw_write8_async((adapter), (addr), (val))
+#define rtw_write16_async(adapter, addr, val) _rtw_write16_async((adapter), (addr), (val))
+#define rtw_write32_async(adapter, addr, val) _rtw_write32_async((adapter), (addr), (val))
+
+#define rtw_write_mem(adapter, addr, cnt, mem) _rtw_write_mem((adapter), (addr), (cnt), (mem))
+#define rtw_write_port(adapter, addr, cnt, mem) _rtw_write_port((adapter), (addr), (cnt), (mem))
+#define rtw_write_port_and_wait(adapter, addr, cnt, mem, timeout_ms) _rtw_write_port_and_wait((adapter), (addr), (cnt), (mem), (timeout_ms))
+#define rtw_write_port_cancel(adapter) _rtw_write_port_cancel((adapter))
+#endif //DBG_IO
+
+extern void rtw_write_scsi(_adapter *adapter, u32 cnt, u8 *pmem);
+
+//ioreq
+extern void ioreq_read8(_adapter *adapter, u32 addr, u8 *pval);
+extern void ioreq_read16(_adapter *adapter, u32 addr, u16 *pval);
+extern void ioreq_read32(_adapter *adapter, u32 addr, u32 *pval);
+extern void ioreq_write8(_adapter *adapter, u32 addr, u8 val);
+extern void ioreq_write16(_adapter *adapter, u32 addr, u16 val);
+extern void ioreq_write32(_adapter *adapter, u32 addr, u32 val);
+
+
+extern uint async_read8(_adapter *adapter, u32 addr, u8 *pbuff,
+	void (*_async_io_callback)(_adapter *padater, struct io_req *pio_req, u8 *cnxt), u8 *cnxt);
+extern uint async_read16(_adapter *adapter, u32 addr,  u8 *pbuff,
+	void (*_async_io_callback)(_adapter *padater, struct io_req *pio_req, u8 *cnxt), u8 *cnxt);
+extern uint async_read32(_adapter *adapter, u32 addr,  u8 *pbuff,
+	void (*_async_io_callback)(_adapter *padater, struct io_req *pio_req, u8 *cnxt), u8 *cnxt);
+
+extern void async_read_mem(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+extern void async_read_port(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+
+extern void async_write8(_adapter *adapter, u32 addr, u8 val,
+	void (*_async_io_callback)(_adapter *padater, struct io_req *pio_req, u8 *cnxt), u8 *cnxt);
+extern void async_write16(_adapter *adapter, u32 addr, u16 val,
+	void (*_async_io_callback)(_adapter *padater, struct io_req *pio_req, u8 *cnxt), u8 *cnxt);
+extern void async_write32(_adapter *adapter, u32 addr, u32 val,
+	void (*_async_io_callback)(_adapter *padater, struct io_req *pio_req, u8 *cnxt), u8 *cnxt);
+
+extern void async_write_mem(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+extern void async_write_port(_adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+
+
+int rtw_init_io_priv(_adapter *padapter, void (*set_intf_ops)(struct _io_ops *pops));
+
+
+extern uint alloc_io_queue(_adapter *adapter);
+extern void free_io_queue(_adapter *adapter);
+extern void async_bus_io(struct io_queue *pio_q);
+extern void bus_sync_io(struct io_queue *pio_q);
+extern u32 _ioreq2rwmem(struct io_queue *pio_q);
+extern void dev_power_down(_adapter * Adapter, u8 bpwrup);
+
+/*
+#define RTL_R8(reg)		rtw_read8(padapter, reg)
+#define RTL_R16(reg)            rtw_read16(padapter, reg)
+#define RTL_R32(reg)            rtw_read32(padapter, reg)
+#define RTL_W8(reg, val8)       rtw_write8(padapter, reg, val8)
+#define RTL_W16(reg, val16)     rtw_write16(padapter, reg, val16)
+#define RTL_W32(reg, val32)     rtw_write32(padapter, reg, val32)
+*/
+
+/*
+#define RTL_W8_ASYNC(reg, val8) rtw_write32_async(padapter, reg, val8)
+#define RTL_W16_ASYNC(reg, val16) rtw_write32_async(padapter, reg, val16)
+#define RTL_W32_ASYNC(reg, val32) rtw_write32_async(padapter, reg, val32)
+
+#define RTL_WRITE_BB(reg, val32)	phy_SetUsbBBReg(padapter, reg, val32)
+#define RTL_READ_BB(reg)	phy_QueryUsbBBReg(padapter, reg)
+*/
+
+#endif	//_RTL8711_IO_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl.h
new file mode 100644
index 000000000000..093e46bda939
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl.h
@@ -0,0 +1,268 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_IOCTL_H_
+#define _RTW_IOCTL_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#ifndef OID_802_11_CAPABILITY
+	#define OID_802_11_CAPABILITY                   0x0d010122
+#endif
+
+#ifndef OID_802_11_PMKID
+	#define OID_802_11_PMKID                        0x0d010123
+#endif
+
+
+// For DDK-defined OIDs
+#define OID_NDIS_SEG1	0x00010100
+#define OID_NDIS_SEG2	0x00010200
+#define OID_NDIS_SEG3	0x00020100
+#define OID_NDIS_SEG4	0x01010100
+#define OID_NDIS_SEG5	0x01020100
+#define OID_NDIS_SEG6	0x01020200
+#define OID_NDIS_SEG7	0xFD010100
+#define OID_NDIS_SEG8	0x0D010100
+#define OID_NDIS_SEG9	0x0D010200
+#define OID_NDIS_SEG10	0x0D020200
+
+#define SZ_OID_NDIS_SEG1		  23
+#define SZ_OID_NDIS_SEG2		    3
+#define SZ_OID_NDIS_SEG3		    6
+#define SZ_OID_NDIS_SEG4		    6
+#define SZ_OID_NDIS_SEG5		    4
+#define SZ_OID_NDIS_SEG6		    8
+#define SZ_OID_NDIS_SEG7		    7
+#define SZ_OID_NDIS_SEG8		  36
+#define SZ_OID_NDIS_SEG9		  24
+#define SZ_OID_NDIS_SEG10		  19
+
+// For Realtek-defined OIDs
+#define OID_MP_SEG1		0xFF871100
+#define OID_MP_SEG2		0xFF818000
+
+#define OID_MP_SEG3		0xFF818700
+#define OID_MP_SEG4		0xFF011100
+
+#define DEBUG_OID(dbg, str)     		\
+       if((!dbg))				    			\
+	{					    			\
+	   RT_TRACE(_module_rtl871x_ioctl_c_,_drv_info_,("%s(%d): %s", __FUNCTION__, __LINE__, str));	\
+	}
+
+
+enum oid_type
+{
+	QUERY_OID,
+	SET_OID
+};
+
+struct oid_funs_node {
+	unsigned int oid_start; //the starting number for OID
+	unsigned int oid_end; //the ending number for OID
+	struct oid_obj_priv *node_array;
+	unsigned int array_sz; //the size of node_array
+	int query_counter; //count the number of query hits for this segment
+	int set_counter; //count the number of set hits for this segment
+};
+
+struct oid_par_priv
+{
+	void		*adapter_context;
+	NDIS_OID	oid;
+	void		*information_buf;
+	u32		information_buf_len;
+	u32		*bytes_rw;
+	u32		*bytes_needed;
+	enum oid_type	type_of_oid;
+	u32		dbg;
+};
+
+struct oid_obj_priv {
+	unsigned char	dbg; // 0: without OID debug message  1: with OID debug message
+	NDIS_STATUS (*oidfuns)(struct oid_par_priv *poid_par_priv);
+};
+
+#if (defined(CONFIG_MP_INCLUDED) && defined(_RTW_MP_IOCTL_C_)) || \
+	(defined(PLATFORM_WINDOWS) && defined(_RTW_IOCTL_RTL_C_))
+static NDIS_STATUS oid_null_function(struct oid_par_priv* poid_par_priv)
+{
+	_func_enter_;
+	_func_exit_;
+	return NDIS_STATUS_SUCCESS;
+}
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+int TranslateNdisPsToRtPs(IN NDIS_802_11_POWER_MODE	ndisPsMode);
+
+//OID Handler for Segment 1
+NDIS_STATUS oid_gen_supported_list_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_hardware_status_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_media_supported_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_media_in_use_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_maximum_lookahead_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_maximum_frame_size_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_link_speed_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_transmit_buffer_space_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_receive_buffer_space_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_transmit_block_size_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_receive_block_size_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_vendor_id_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_vendor_description_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_current_packet_filter_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_current_lookahead_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_driver_version_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_maximum_total_size_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_protocol_options_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_mac_options_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_media_connect_status_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_maximum_send_packets_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_vendor_driver_version_hdl(struct oid_par_priv* poid_par_priv);
+
+
+//OID Handler for Segment 2
+NDIS_STATUS oid_gen_physical_medium_hdl(struct oid_par_priv* poid_par_priv);
+
+//OID Handler for Segment 3
+NDIS_STATUS oid_gen_xmit_ok_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_rcv_ok_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_xmit_error_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_rcv_error_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_gen_rcv_no_buffer_hdl(struct oid_par_priv* poid_par_priv);
+
+
+//OID Handler for Segment 4
+NDIS_STATUS oid_802_3_permanent_address_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_current_address_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_multicast_list_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_maximum_list_size_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_mac_options_hdl(struct oid_par_priv* poid_par_priv);
+
+
+
+//OID Handler for Segment 5
+NDIS_STATUS oid_802_3_rcv_error_alignment_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_xmit_one_collision_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_xmit_more_collisions_hdl(struct oid_par_priv* poid_par_priv);
+
+
+//OID Handler for Segment 6
+NDIS_STATUS oid_802_3_xmit_deferred_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_xmit_max_collisions_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_rcv_overrun_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_xmit_underrun_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_xmit_heartbeat_failure_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_xmit_times_crs_lost_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_3_xmit_late_collisions_hdl(struct oid_par_priv* poid_par_priv);
+
+
+
+//OID Handler for Segment 7
+NDIS_STATUS oid_pnp_capabilities_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_pnp_set_power_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_pnp_query_power_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_pnp_add_wake_up_pattern_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_pnp_remove_wake_up_pattern_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_pnp_wake_up_pattern_list_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_pnp_enable_wake_up_hdl(struct oid_par_priv* poid_par_priv);
+
+
+
+//OID Handler for Segment 8
+NDIS_STATUS oid_802_11_bssid_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_ssid_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_infrastructure_mode_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_add_wep_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_remove_wep_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_disassociate_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_authentication_mode_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_privacy_filter_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_bssid_list_scan_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_encryption_status_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_reload_defaults_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_add_key_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_remove_key_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_association_information_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_test_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_media_stream_mode_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_capability_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_pmkid_hdl(struct oid_par_priv* poid_par_priv);
+
+
+
+
+
+//OID Handler for Segment 9
+NDIS_STATUS oid_802_11_network_types_supported_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_network_type_in_use_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_tx_power_level_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_rssi_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_rssi_trigger_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_fragmentation_threshold_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_rts_threshold_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_number_of_antennas_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_rx_antenna_selected_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_tx_antenna_selected_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_supported_rates_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_desired_rates_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_configuration_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_power_mode_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_802_11_bssid_list_hdl(struct oid_par_priv* poid_par_priv);
+
+
+//OID Handler for Segment 10
+NDIS_STATUS oid_802_11_statistics_hdl(struct oid_par_priv* poid_par_priv);
+
+
+//OID Handler for Segment ED
+NDIS_STATUS oid_rt_mh_vender_id_hdl(struct oid_par_priv* poid_par_priv);
+
+void Set_802_3_MULTICAST_LIST(ADAPTER *pAdapter, UCHAR *MCListbuf, ULONG MCListlen, BOOLEAN bAcceptAllMulticast);
+
+#endif// end of PLATFORM_WINDOWS
+
+
+#if defined(PLATFORM_LINUX) && defined(CONFIG_WIRELESS_EXT)
+extern struct iw_handler_def  rtw_handlers_def;
+#endif
+
+extern	NDIS_STATUS drv_query_info(
+	IN	_nic_hdl		MiniportAdapterContext,
+	IN	NDIS_OID		Oid,
+	IN	void *			InformationBuffer,
+	IN	u32			InformationBufferLength,
+	OUT	u32*			BytesWritten,
+	OUT	u32*			BytesNeeded
+	);
+
+extern	NDIS_STATUS 	drv_set_info(
+	IN	_nic_hdl		MiniportAdapterContext,
+	IN	NDIS_OID		Oid,
+	IN	void *			InformationBuffer,
+	IN	u32			InformationBufferLength,
+	OUT	u32*			BytesRead,
+	OUT	u32*			BytesNeeded
+	);
+
+#endif // #ifndef __INC_CEINFO_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_query.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_query.h
new file mode 100644
index 000000000000..3fcbc549f6bb
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_query.h
@@ -0,0 +1,35 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_IOCTL_QUERY_H_
+#define _RTW_IOCTL_QUERY_H_
+
+#include <drv_conf.h>
+#include <drv_types.h>
+
+
+#ifdef PLATFORM_WINDOWS
+
+u8 query_802_11_capability(_adapter*	padapter,u8*	pucBuf,u32 *	pulOutLen);
+u8 query_802_11_association_information (_adapter * padapter, PNDIS_802_11_ASSOCIATION_INFORMATION pAssocInfo);
+
+#endif
+
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_rtl.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_rtl.h
new file mode 100644
index 000000000000..c01700622795
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_rtl.h
@@ -0,0 +1,83 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_IOCTL_RTL_H_
+#define _RTW_IOCTL_RTL_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+//************** oid_rtl_seg_01_01 **************
+NDIS_STATUS oid_rt_get_signal_quality_hdl(struct oid_par_priv* poid_par_priv);//84
+NDIS_STATUS oid_rt_get_small_packet_crc_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_middle_packet_crc_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_large_packet_crc_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_tx_retry_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_rx_retry_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_rx_total_packet_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_tx_beacon_ok_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_tx_beacon_err_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_pro_set_fw_dig_state_hdl(struct oid_par_priv* poid_par_priv);	//8a
+NDIS_STATUS oid_rt_pro_set_fw_ra_state_hdl(struct oid_par_priv* poid_par_priv);	//8b
+
+NDIS_STATUS oid_rt_get_rx_icv_err_hdl(struct oid_par_priv* poid_par_priv);//93
+NDIS_STATUS oid_rt_set_encryption_algorithm_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_preamble_mode_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_ap_ip_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_channelplan_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_set_channelplan_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_set_preamble_mode_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_set_bcn_intvl_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_dedicate_probe_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_total_tx_bytes_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_total_rx_bytes_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_current_tx_power_level_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_enc_key_mismatch_count_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_enc_key_match_count_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_channel_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_hardware_radio_off_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_key_mismatch_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_supported_wireless_mode_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_channel_list_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_scan_in_progress_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_forced_data_rate_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_wireless_mode_for_scan_list_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_bss_wireless_mode_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_scan_with_magic_packet_hdl(struct oid_par_priv* poid_par_priv);
+
+//**************  oid_rtl_seg_01_03 section start **************
+NDIS_STATUS oid_rt_ap_get_associated_station_list_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_ap_switch_into_ap_mode_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_ap_supported_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_ap_set_passphrase_hdl(struct oid_par_priv* poid_par_priv);
+
+// oid_rtl_seg_01_11
+NDIS_STATUS oid_rt_pro_rf_write_registry_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_rf_read_registry_hdl(struct oid_par_priv* poid_par_priv);
+
+//**************  oid_rtl_seg_03_00 section start **************
+NDIS_STATUS oid_rt_get_connect_state_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_set_default_key_id_hdl(struct oid_par_priv* poid_par_priv);
+
+
+
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_set.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_set.h
new file mode 100644
index 000000000000..225cadc6be3a
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_ioctl_set.h
@@ -0,0 +1,79 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_IOCTL_SET_H_
+#define __RTW_IOCTL_SET_H_
+
+#include <drv_conf.h>
+#include <drv_types.h>
+
+
+typedef u8 NDIS_802_11_PMKID_VALUE[16];
+
+typedef struct _BSSIDInfo {
+	NDIS_802_11_MAC_ADDRESS  BSSID;
+	NDIS_802_11_PMKID_VALUE  PMKID;
+} BSSIDInfo, *PBSSIDInfo;
+
+
+#ifdef PLATFORM_OS_XP
+typedef struct _NDIS_802_11_PMKID {
+	u32	Length;
+	u32	BSSIDInfoCount;
+	BSSIDInfo BSSIDInfo[1];
+} NDIS_802_11_PMKID, *PNDIS_802_11_PMKID;
+#endif
+
+
+#ifdef PLATFORM_WINDOWS
+u8 rtw_set_802_11_reload_defaults(_adapter * padapter, NDIS_802_11_RELOAD_DEFAULTS reloadDefaults);
+u8 rtw_set_802_11_test(_adapter * padapter, NDIS_802_11_TEST * test);
+u8 rtw_set_802_11_pmkid(_adapter *pdapter, NDIS_802_11_PMKID *pmkid);
+
+u8 rtw_pnp_set_power_sleep(_adapter* padapter);
+u8 rtw_pnp_set_power_wakeup(_adapter* padapter);
+
+void rtw_pnp_resume_wk(void *context);
+void rtw_pnp_sleep_wk(void * context);
+
+#endif
+
+u8 rtw_set_802_11_add_key(_adapter * padapter, NDIS_802_11_KEY * key);
+u8 rtw_set_802_11_authentication_mode(_adapter *pdapter, NDIS_802_11_AUTHENTICATION_MODE authmode);
+u8 rtw_set_802_11_bssid(_adapter* padapter, u8 *bssid);
+u8 rtw_set_802_11_add_wep(_adapter * padapter, NDIS_802_11_WEP * wep);
+u8 rtw_set_802_11_disassociate(_adapter * padapter);
+u8 rtw_set_802_11_bssid_list_scan(_adapter* padapter, NDIS_802_11_SSID *pssid, int ssid_max_num);
+u8 rtw_set_802_11_infrastructure_mode(_adapter * padapter, NDIS_802_11_NETWORK_INFRASTRUCTURE networktype);
+u8 rtw_set_802_11_remove_wep(_adapter * padapter, u32 keyindex);
+u8 rtw_set_802_11_ssid(_adapter * padapter, NDIS_802_11_SSID * ssid);
+u8 rtw_set_802_11_connect(_adapter *padapter, const u8 *bssid
+	, NDIS_802_11_SSID *ssid);
+u8 rtw_set_802_11_remove_key(_adapter * padapter, NDIS_802_11_REMOVE_KEY * key);
+
+u8 rtw_validate_bssid(const u8 *bssid);
+u8 rtw_validate_ssid(NDIS_802_11_SSID *ssid);
+
+u16 rtw_get_cur_max_rate(_adapter *adapter);
+int rtw_set_scan_mode(_adapter *adapter, RT_SCAN_TYPE scan_mode);
+int rtw_set_channel_plan(_adapter *adapter, u8 channel_plan);
+int rtw_set_country(_adapter *adapter, const char *country_code);
+int rtw_set_band(_adapter *adapter, enum _BAND band);
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_iol.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_iol.h
new file mode 100644
index 000000000000..59786eed6138
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_iol.h
@@ -0,0 +1,89 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_IOL_H_
+#define __RTW_IOL_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+typedef struct _io_offload_cmd {
+	u8 rsvd0;
+	u8 cmd;
+	u16 address;
+	u32 value;
+} IO_OFFLOAD_CMD, IOL_CMD;
+
+#define IOL_CMD_LLT			0x00
+//#define IOL_CMD_R_EFUSE	0x01
+#define IOL_CMD_WB_REG		0x02
+#define IOL_CMD_WW_REG 	0x03
+#define IOL_CMD_WD_REG		0x04
+//#define IOL_CMD_W_RF		0x05
+#define IOL_CMD_DELAY_US	0x80
+#define IOL_CMD_DELAY_MS	0x81
+//#define IOL_CMD_DELAY_S	0x82
+#define IOL_CMD_END			0x83
+
+/*****************************************************
+CMD					Address			Value
+(B1)					(B2/B3:H/L addr)	(B4:B7 : MSB:LSB)
+******************************************************
+IOL_CMD_LLT			-				B7: PGBNDY
+//IOL_CMD_R_EFUSE	-				-
+IOL_CMD_WB_REG		0x0~0xFFFF		B7
+IOL_CMD_WW_REG	0x0~0xFFFF		B6~B7
+IOL_CMD_WD_REG	0x0~0xFFFF		B4~B7
+//IOL_CMD_W_RF		RF Reg			B5~B7
+IOL_CMD_DELAY_US	-				B6~B7
+IOL_CMD_DELAY_MS	-				B6~B7
+//IOL_CMD_DELAY_S	-				B6~B7
+IOL_CMD_END		-				-
+******************************************************/
+
+struct xmit_frame	*rtw_IOL_accquire_xmit_frame(ADAPTER *adapter);
+int rtw_IOL_append_cmds(struct xmit_frame *xmit_frame, u8 *IOL_cmds, u32 cmd_len);
+int rtw_IOL_append_LLT_cmd(struct xmit_frame *xmit_frame, u8 page_boundary);
+int _rtw_IOL_append_WB_cmd(struct xmit_frame *xmit_frame, u16 addr, u8 value);
+int _rtw_IOL_append_WW_cmd(struct xmit_frame *xmit_frame, u16 addr, u16 value);
+int _rtw_IOL_append_WD_cmd(struct xmit_frame *xmit_frame, u16 addr, u32 value);
+int rtw_IOL_append_DELAY_US_cmd(struct xmit_frame *xmit_frame, u16 us);
+int rtw_IOL_append_DELAY_MS_cmd(struct xmit_frame *xmit_frame, u16 ms);
+int rtw_IOL_append_END_cmd(struct xmit_frame *xmit_frame);
+int rtw_IOL_exec_cmds_sync(ADAPTER *adapter, struct xmit_frame *xmit_frame, u32 max_wating_ms);
+int rtw_IOL_exec_cmd_array_sync(PADAPTER adapter, u8 *IOL_cmds, u32 cmd_num, u32 max_wating_ms);
+int rtw_IOL_exec_empty_cmds_sync(ADAPTER *adapter, u32 max_wating_ms);
+
+#ifdef DBG_IO
+int dbg_rtw_IOL_append_WB_cmd(struct xmit_frame *xmit_frame, u16 addr, u8 value, const char *caller, const int line);
+int dbg_rtw_IOL_append_WW_cmd(struct xmit_frame *xmit_frame, u16 addr, u16 value, const char *caller, const int line);
+int dbg_rtw_IOL_append_WD_cmd(struct xmit_frame *xmit_frame, u16 addr, u32 value, const char *caller, const int line);
+#define rtw_IOL_append_WB_cmd(xmit_frame, addr, value) dbg_rtw_IOL_append_WB_cmd((xmit_frame), (addr), (value), __FUNCTION__, __LINE__)
+#define rtw_IOL_append_WW_cmd(xmit_frame, addr, value) dbg_rtw_IOL_append_WW_cmd((xmit_frame), (addr), (value), __FUNCTION__, __LINE__)
+#define rtw_IOL_append_WD_cmd(xmit_frame, addr, value) dbg_rtw_IOL_append_WD_cmd((xmit_frame), (addr), (value), __FUNCTION__, __LINE__)
+#else
+#define rtw_IOL_append_WB_cmd(xmit_frame, addr, value) _rtw_IOL_append_WB_cmd((xmit_frame), (addr), (value))
+#define rtw_IOL_append_WW_cmd(xmit_frame, addr, value) _rtw_IOL_append_WW_cmd((xmit_frame), (addr), (value))
+#define rtw_IOL_append_WD_cmd(xmit_frame, addr, value) _rtw_IOL_append_WD_cmd((xmit_frame), (addr), (value))
+#endif
+
+bool rtw_IOL_applied(ADAPTER *adapter);
+
+#endif //__RTW_IOL_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_led.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_led.h
new file mode 100644
index 000000000000..7de268e48e03
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_led.h
@@ -0,0 +1,216 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_LED_H_
+#define __RTW_LED_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#define MSECS(t)        (HZ * ((t) / 1000) + (HZ * ((t) % 1000)) / 1000)
+
+typedef enum _LED_CTL_MODE{
+        LED_CTL_POWER_ON = 1,
+        LED_CTL_LINK = 2,
+        LED_CTL_NO_LINK = 3,
+        LED_CTL_TX = 4,
+        LED_CTL_RX = 5,
+        LED_CTL_SITE_SURVEY = 6,
+        LED_CTL_POWER_OFF = 7,
+        LED_CTL_START_TO_LINK = 8,
+        LED_CTL_START_WPS = 9,
+        LED_CTL_STOP_WPS = 10,
+        LED_CTL_START_WPS_BOTTON = 11, //added for runtop
+        LED_CTL_STOP_WPS_FAIL = 12, //added for ALPHA
+	 LED_CTL_STOP_WPS_FAIL_OVERLAP = 13, //added for BELKIN
+}LED_CTL_MODE;
+
+
+#if defined(CONFIG_USB_HCI) || defined(CONFIG_SDIO_HCI)
+//================================================================================
+// LED object.
+//================================================================================
+
+typedef enum _LED_STATE_871x{
+	LED_UNKNOWN = 0,
+	RTW_LED_ON = 1,
+	RTW_LED_OFF = 2,
+	LED_BLINK_NORMAL = 3,
+	LED_BLINK_SLOWLY = 4,
+	LED_POWER_ON_BLINK = 5,
+	LED_SCAN_BLINK = 6, // LED is blinking during scanning period, the # of times to blink is depend on time for scanning.
+	LED_NO_LINK_BLINK = 7, // LED is blinking during no link state.
+	LED_BLINK_StartToBlink = 8,// Customzied for Sercomm Printer Server case
+	LED_BLINK_WPS = 9,	// LED is blinkg during WPS communication
+	LED_TXRX_BLINK = 10,
+	LED_BLINK_WPS_STOP = 11,	//for ALPHA
+	LED_BLINK_WPS_STOP_OVERLAP = 12,	//for BELKIN
+}LED_STATE_871x;
+
+#define IS_LED_WPS_BLINKING(_LED_871x)	(((PLED_871x)_LED_871x)->CurrLedState==LED_BLINK_WPS \
+					|| ((PLED_871x)_LED_871x)->CurrLedState==LED_BLINK_WPS_STOP \
+					|| ((PLED_871x)_LED_871x)->bLedWPSBlinkInProgress)
+
+#define IS_LED_BLINKING(_LED_871x) 	(((PLED_871x)_LED_871x)->bLedWPSBlinkInProgress \
+					||((PLED_871x)_LED_871x)->bLedScanBlinkInProgress)
+
+typedef enum _LED_PIN_871x{
+	LED_PIN_GPIO0,
+	LED_PIN_LED0,
+	LED_PIN_LED1
+}LED_PIN_871x;
+
+typedef struct _LED_871x{
+	_adapter				*padapter;
+	LED_PIN_871x		LedPin;	// Identify how to implement this SW led.
+	LED_STATE_871x		CurrLedState; // Current LED state.
+	u8					bLedOn; // true if LED is ON, false if LED is OFF.
+
+	u8					bSWLedCtrl;
+
+	u8					bLedBlinkInProgress; // true if it is blinking, false o.w..
+	// ALPHA, added by chiyoko, 20090106
+	u8					bLedNoLinkBlinkInProgress;
+	u8					bLedLinkBlinkInProgress;
+	u8					bLedStartToLinkBlinkInProgress;
+	u8					bLedScanBlinkInProgress;
+	u8					bLedWPSBlinkInProgress;
+
+	u32					BlinkTimes; // Number of times to toggle led state for blinking.
+	LED_STATE_871x		BlinkingLedState; // Next state for blinking, either RTW_LED_ON or RTW_LED_OFF are.
+
+	_timer				BlinkTimer; // Timer object for led blinking.
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2,5,0)|| defined PLATFORM_FREEBSD
+	_workitem			BlinkWorkItem; // Workitem used by BlinkTimer to manipulate H/W to blink LED.
+#endif
+} LED_871x, *PLED_871x;
+
+
+//================================================================================
+// LED customization.
+//================================================================================
+
+typedef	enum _LED_STRATEGY_871x{
+	SW_LED_MODE0, // SW control 1 LED via GPIO0. It is default option.
+	SW_LED_MODE1, // 2 LEDs, through LED0 and LED1. For ALPHA.
+	SW_LED_MODE2, // SW control 1 LED via GPIO0, customized for AzWave 8187 minicard.
+	SW_LED_MODE3, // SW control 1 LED via GPIO0, customized for Sercomm Printer Server case.
+	SW_LED_MODE4, //for Edimax / Belkin
+	SW_LED_MODE5, //for Sercomm / Belkin
+	SW_LED_MODE6, //for 88CU minicard, porting from ce SW_LED_MODE7
+	HW_LED, // HW control 2 LEDs, LED0 and LED1 (there are 4 different control modes, see MAC.CONFIG1 for details.)
+}LED_STRATEGY_871x, *PLED_STRATEGY_871x;
+#endif //CONFIG_USB_HCI
+
+#ifdef CONFIG_PCI_HCI
+//================================================================================
+// LED object.
+//================================================================================
+
+typedef	enum _LED_STATE_871x{
+	LED_UNKNOWN = 0,
+	RTW_LED_ON = 1,
+	RTW_LED_OFF = 2,
+	LED_BLINK_NORMAL = 3,
+	LED_BLINK_SLOWLY = 4,
+	LED_POWER_ON_BLINK = 5,
+	LED_SCAN_BLINK = 6, // LED is blinking during scanning period, the # of times to blink is depend on time for scanning.
+	LED_NO_LINK_BLINK = 7, // LED is blinking during no link state.
+	LED_BLINK_StartToBlink = 8,
+	LED_BLINK_TXRX = 9,
+	LED_BLINK_RUNTOP = 10, // Customized for RunTop
+	LED_BLINK_CAMEO = 11,
+}LED_STATE_871x;
+
+typedef enum _LED_PIN_871x{
+	LED_PIN_GPIO0,
+	LED_PIN_LED0,
+	LED_PIN_LED1,
+	LED_PIN_LED2
+}LED_PIN_871x;
+
+typedef struct _LED_871x{
+	_adapter				*padapter;
+
+	LED_PIN_871x		LedPin;	// Identify how to implement this SW led.
+
+	LED_STATE_871x		CurrLedState; // Current LED state.
+	u8					bLedOn; // TRUE if LED is ON, FALSE if LED is OFF.
+
+	u8					bLedBlinkInProgress; // TRUE if it is blinking, FALSE o.w..
+	u8					bLedWPSBlinkInProgress; // TRUE if it is blinking, FALSE o.w..
+
+	u8					bLedSlowBlinkInProgress;//added by vivi, for led new mode
+	u32					BlinkTimes; // Number of times to toggle led state for blinking.
+	LED_STATE_871x		BlinkingLedState; // Next state for blinking, either RTW_LED_ON or RTW_LED_OFF are.
+
+	_timer				BlinkTimer; // Timer object for led blinking.
+
+	u8					bLedLinkBlinkInProgress;
+	u8					bLedNoLinkBlinkInProgress;
+	u8 					bLedScanBlinkInProgress;
+} LED_871x, *PLED_871x;
+
+
+//================================================================================
+// LED customization.
+//================================================================================
+
+typedef	enum _LED_STRATEGY_871x{
+	SW_LED_MODE0, // SW control 1 LED via GPIO0. It is default option.
+	SW_LED_MODE1, // SW control for PCI Express
+	SW_LED_MODE2, // SW control for Cameo.
+	SW_LED_MODE3, // SW contorl for RunTop.
+	SW_LED_MODE4, // SW control for Netcore
+	SW_LED_MODE5, //added by vivi, for led new mode, DLINK
+	SW_LED_MODE6, //added by vivi, for led new mode, PRONET
+	SW_LED_MODE7, //added by chiyokolin, for Lenovo, PCI Express Minicard Spec Rev.1.2 spec
+	SW_LED_MODE8, //added by chiyokolin, for QMI
+	SW_LED_MODE9, //added by chiyokolin, for BITLAND, PCI Express Minicard Spec Rev.1.1
+	SW_LED_MODE10, //added by chiyokolin, for Edimax-ASUS
+	HW_LED, // HW control 2 LEDs, LED0 and LED1 (there are 4 different control modes)
+}LED_STRATEGY_871x, *PLED_STRATEGY_871x;
+
+#define LED_CM8_BLINK_INTERVAL		500	//for QMI
+#endif //CONFIG_PCI_HCI
+
+struct led_priv{
+	/* add for led controll */
+	LED_871x			SwLed0;
+	LED_871x			SwLed1;
+	LED_STRATEGY_871x	LedStrategy;
+	u8					bRegUseLed;
+	void (*LedControlHandler)(_adapter *padapter, LED_CTL_MODE LedAction);
+	/* add for led controll */
+};
+
+#ifdef CONFIG_SW_LED
+#define rtw_led_control(adapter, LedAction) \
+	do { \
+		if((adapter)->ledpriv.LedControlHandler) \
+			(adapter)->ledpriv.LedControlHandler((adapter), (LedAction)); \
+	} while(0)
+#else //CONFIG_SW_LED
+#define rtw_led_control(adapter, LedAction)
+#endif //CONFIG_SW_LED
+
+extern void BlinkHandler(PLED_871x	 pLed);
+
+#endif //__RTW_LED_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mlme.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mlme.h
new file mode 100644
index 000000000000..862326d681b8
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mlme.h
@@ -0,0 +1,843 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_MLME_H_
+#define __RTW_MLME_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <mlme_osdep.h>
+#include <drv_types.h>
+#include <wlan_bssdef.h>
+
+#ifdef CONFIG_INTEL_WIDI
+#include <rtw_intel_widi.h>
+#endif
+
+#define	MAX_BSS_CNT	128
+//#define   MAX_JOIN_TIMEOUT	2000
+//#define   MAX_JOIN_TIMEOUT	2500
+#define   MAX_JOIN_TIMEOUT	6500
+
+//	Commented by Albert 20101105
+//	Increase the scanning timeout because of increasing the SURVEY_TO value.
+
+#define 	SCANNING_TIMEOUT 	8000
+
+#define	SCAN_INTERVAL	(30) // unit:2sec, 30*2=60sec
+
+#ifdef PALTFORM_OS_WINCE
+#define	SCANQUEUE_LIFETIME 12000000 // unit:us
+#else
+#define	SCANQUEUE_LIFETIME 20 // unit:sec
+#endif
+
+#define 	WIFI_NULL_STATE			0x00000000
+
+#define	WIFI_ASOC_STATE			0x00000001		// Under Linked state...
+#define 	WIFI_REASOC_STATE	       	0x00000002
+#define	WIFI_SLEEP_STATE			0x00000004
+#define	WIFI_STATION_STATE		0x00000008
+
+#define	WIFI_AP_STATE				0x00000010
+#define	WIFI_ADHOC_STATE			0x00000020
+#define   WIFI_ADHOC_MASTER_STATE 0x00000040
+#define   WIFI_UNDER_LINKING		0x00000080
+
+#define	WIFI_UNDER_WPS			0x00000100
+//#define	WIFI_UNDER_CMD			0x00000200
+//#define	WIFI_UNDER_P2P			0x00000400
+#define	WIFI_STA_ALIVE_CHK_STATE	0x00000400
+#define	WIFI_SITE_MONITOR			0x00000800		//to indicate the station is under site surveying
+
+#ifdef WDS
+#define	WIFI_WDS					0x00001000
+#define	WIFI_WDS_RX_BEACON		0x00002000		// already rx WDS AP beacon
+#endif
+#ifdef AUTO_CONFIG
+#define	WIFI_AUTOCONF				0x00004000
+#define	WIFI_AUTOCONF_IND		0x00008000
+#endif
+
+/*
+// ========== P2P Section Start ===============
+#define	WIFI_P2P_LISTEN_STATE		0x00010000
+#define	WIFI_P2P_GROUP_FORMATION_STATE		0x00020000
+// ========== P2P Section End ===============
+*/
+
+//#ifdef UNDER_MPTEST
+#define	WIFI_MP_STATE							0x00010000
+#define	WIFI_MP_CTX_BACKGROUND				0x00020000	// in continous tx background
+#define	WIFI_MP_CTX_ST						0x00040000	// in continous tx with single-tone
+#define	WIFI_MP_CTX_BACKGROUND_PENDING	0x00080000	// pending in continous tx background due to out of skb
+#define	WIFI_MP_CTX_CCK_HW					0x00100000	// in continous tx
+#define	WIFI_MP_CTX_CCK_CS					0x00200000	// in continous tx with carrier suppression
+#define   WIFI_MP_LPBK_STATE					0x00400000
+//#endif
+
+//#define _FW_UNDER_CMD		WIFI_UNDER_CMD
+#define _FW_UNDER_LINKING	WIFI_UNDER_LINKING
+#define _FW_LINKED			WIFI_ASOC_STATE
+#define _FW_UNDER_SURVEY	WIFI_SITE_MONITOR
+
+
+enum dot11AuthAlgrthmNum {
+ dot11AuthAlgrthm_Open = 0,
+ dot11AuthAlgrthm_Shared,
+ dot11AuthAlgrthm_8021X,
+ dot11AuthAlgrthm_Auto,
+ dot11AuthAlgrthm_MaxNum
+};
+
+// Scan type including active and passive scan.
+typedef enum _RT_SCAN_TYPE
+{
+	SCAN_PASSIVE,
+	SCAN_ACTIVE,
+	SCAN_MIX,
+}RT_SCAN_TYPE, *PRT_SCAN_TYPE;
+
+enum DriverInterface {
+	DRIVER_WEXT =  1,
+	DRIVER_CFG80211 = 2
+};
+
+enum  _BAND
+{
+	GHZ24_50 = 0,
+	GHZ_50,
+	GHZ_24,
+	GHZ_MAX,
+};
+
+#define rtw_band_valid(band) ((band) >= GHZ24_50 && (band) < GHZ_MAX)
+
+enum SCAN_RESULT_TYPE
+{
+	SCAN_RESULT_P2P_ONLY = 0,		//	Will return all the P2P devices.
+	SCAN_RESULT_ALL = 1,			//	Will return all the scanned device, include AP.
+	SCAN_RESULT_WFD_TYPE = 2		//	Will just return the correct WFD device.
+									//	If this device is Miracast sink device, it will just return all the Miracast source devices.
+};
+
+/*
+
+there are several "locks" in mlme_priv,
+since mlme_priv is a shared resource between many threads,
+like ISR/Call-Back functions, the OID handlers, and even timer functions.
+
+
+Each _queue has its own locks, already.
+Other items are protected by mlme_priv.lock.
+
+To avoid possible dead lock, any thread trying to modifiying mlme_priv
+SHALL not lock up more than one locks at a time!
+
+*/
+
+
+#define traffic_threshold	10
+#define	traffic_scan_period	500
+
+struct sitesurvey_ctrl {
+	u64	last_tx_pkts;
+	uint	last_rx_pkts;
+	sint	traffic_busy;
+	_timer	sitesurvey_ctrl_timer;
+};
+
+typedef struct _RT_LINK_DETECT_T{
+	u32				NumTxOkInPeriod;
+	u32				NumRxOkInPeriod;
+	u32				NumRxUnicastOkInPeriod;
+	BOOLEAN			bBusyTraffic;
+	BOOLEAN			bTxBusyTraffic;
+	BOOLEAN			bRxBusyTraffic;
+	BOOLEAN			bHigherBusyTraffic; // For interrupt migration purpose.
+	BOOLEAN			bHigherBusyRxTraffic; // We may disable Tx interrupt according as Rx traffic.
+	BOOLEAN			bHigherBusyTxTraffic; // We may disable Tx interrupt according as Tx traffic.
+}RT_LINK_DETECT_T, *PRT_LINK_DETECT_T;
+
+struct profile_info {
+	u8	ssidlen;
+	u8	ssid[ WLAN_SSID_MAXLEN ];
+	u8	peermac[ ETH_ALEN ];
+};
+
+struct tx_invite_req_info{
+	u8					token;
+	u8					benable;
+	u8					go_ssid[ WLAN_SSID_MAXLEN ];
+	u8					ssidlen;
+	u8					go_bssid[ ETH_ALEN ];
+	u8					peer_macaddr[ ETH_ALEN ];
+	u8					operating_ch;	//	This information will be set by using the p2p_set op_ch=x
+	u8					peer_ch;		//	The listen channel for peer P2P device
+
+};
+
+struct tx_invite_resp_info{
+	u8					token;	//	Used to record the dialog token of p2p invitation request frame.
+};
+
+#ifdef CONFIG_WFD
+
+struct wifi_display_info{
+	u16							wfd_enable;			//	Eanble/Disable the WFD function.
+	u16							rtsp_ctrlport;		//	TCP port number at which the this WFD device listens for RTSP messages
+	u16							peer_rtsp_ctrlport;	//	TCP port number at which the peer WFD device listens for RTSP messages
+													//	This filed should be filled when receiving the gropu negotiation request
+
+	u8							peer_session_avail;	//	WFD session is available or not for the peer wfd device.
+													//	This variable will be set when sending the provisioning discovery request to peer WFD device.
+													//	And this variable will be reset when it is read by using the iwpriv p2p_get wfd_sa command.
+
+	u8							ip_address[4];
+	u8							peer_ip_address[4];
+	u8							wfd_pc;				//	WFD preferred connection
+													//	0 -> Prefer to use the P2P for WFD connection on peer side.
+													//	1 -> Prefer to use the TDLS for WFD connection on peer side.
+
+	u8							wfd_device_type;	//	WFD Device Type
+													//	0 -> WFD Source Device
+													//	1 -> WFD Primary Sink Device
+	enum	SCAN_RESULT_TYPE	scan_result_type;	//	Used when P2P is enable. This parameter will impact the scan result.
+};
+#endif //CONFIG_WFD
+
+struct tx_provdisc_req_info{
+	u16					wps_config_method_request;	//	Used when sending the provisioning request frame
+	u16					peer_channel_num[2];		//	The channel number which the receiver stands.
+	NDIS_802_11_SSID	ssid;
+	u8					peerDevAddr[ ETH_ALEN ];		//	Peer device address
+	u8					peerIFAddr[ ETH_ALEN ];		//	Peer interface address
+	u8					benable;					//	This provision discovery request frame is trigger to send or not
+};
+
+struct rx_provdisc_req_info{	//When peer device issue prov_disc_req first, we should store the following informations
+	u8					peerDevAddr[ ETH_ALEN ];		//	Peer device address
+	u8					strconfig_method_desc_of_prov_disc_req[4];	//	description for the config method located in the provisioning discovery request frame.
+																	//	The UI must know this information to know which config method the remote p2p device is requiring.
+};
+
+struct tx_nego_req_info{
+	u16					peer_channel_num[2];		//	The channel number which the receiver stands.
+	u8					peerDevAddr[ ETH_ALEN ];		//	Peer device address
+	u8					benable;					//	This negoitation request frame is trigger to send or not
+};
+
+struct group_id_info{
+	u8					go_device_addr[ ETH_ALEN ];	//	The GO's device address of this P2P group
+	u8					ssid[ WLAN_SSID_MAXLEN ];	//	The SSID of this P2P group
+};
+
+struct scan_limit_info{
+	u8					scan_op_ch_only;			//	When this flag is set, the driver should just scan the operation channel
+#ifndef P2P_OP_CHECK_SOCIAL_CH
+	u8					operation_ch[2];				//	Store the operation channel of invitation request frame
+#else
+	u8					operation_ch[5];				//	Store additional channel 1,6,11  for Android 4.2 IOT & Nexus 4
+#endif //P2P_OP_CHECK_SOCIAL_CH
+};
+
+#ifdef CONFIG_IOCTL_CFG80211
+struct cfg80211_wifidirect_info{
+	_timer					remain_on_ch_timer;
+	u8						restore_channel;
+	struct ieee80211_channel	remain_on_ch_channel;
+	enum nl80211_channel_type	remain_on_ch_type;
+	u64						remain_on_ch_cookie;
+	bool is_ro_ch;
+};
+#endif //CONFIG_IOCTL_CFG80211
+
+struct wifidirect_info{
+	_adapter*				padapter;
+	_timer					find_phase_timer;
+	_timer					restore_p2p_state_timer;
+
+	//	Used to do the scanning. After confirming the peer is availalble, the driver transmits the P2P frame to peer.
+	_timer					pre_tx_scan_timer;
+	_timer					reset_ch_sitesurvey;
+	_timer					reset_ch_sitesurvey2;	//	Just for resetting the scan limit function by using p2p nego
+#ifdef CONFIG_CONCURRENT_MODE
+	//	Used to switch the channel between legacy AP and listen state.
+	_timer					ap_p2p_switch_timer;
+#endif
+	struct tx_provdisc_req_info	tx_prov_disc_info;
+	struct rx_provdisc_req_info rx_prov_disc_info;
+	struct tx_invite_req_info	invitereq_info;
+	struct profile_info			profileinfo[ P2P_MAX_PERSISTENT_GROUP_NUM ];	//	Store the profile information of persistent group
+	struct tx_invite_resp_info	inviteresp_info;
+	struct tx_nego_req_info	nego_req_info;
+	struct group_id_info		groupid_info;	//	Store the group id information when doing the group negotiation handshake.
+	struct scan_limit_info		rx_invitereq_info;	//	Used for get the limit scan channel from the Invitation procedure
+	struct scan_limit_info		p2p_info;		//	Used for get the limit scan channel from the P2P negotiation handshake
+#ifdef CONFIG_WFD
+	struct wifi_display_info		*wfd_info;
+#endif
+	enum P2P_ROLE			role;
+	enum P2P_STATE			pre_p2p_state;
+	enum P2P_STATE			p2p_state;
+	u8 						device_addr[ETH_ALEN];	//	The device address should be the mac address of this device.
+	u8						interface_addr[ETH_ALEN];
+	u8						social_chan[4];
+	u8						listen_channel;
+	u8						operating_channel;
+	u8						listen_dwell;		//	This value should be between 1 and 3
+	u8						support_rate[8];
+	u8						p2p_wildcard_ssid[P2P_WILDCARD_SSID_LEN];
+	u8						intent;		//	should only include the intent value.
+	u8						p2p_peer_interface_addr[ ETH_ALEN ];
+	u8						p2p_peer_device_addr[ ETH_ALEN ];
+	u8						peer_intent;	//	Included the intent value and tie breaker value.
+	u8						device_name[ WPS_MAX_DEVICE_NAME_LEN ];	//	Device name for displaying on searching device screen
+	u8						device_name_len;
+	u8						profileindex;	//	Used to point to the index of profileinfo array
+	u8						peer_operating_ch;
+	u8						find_phase_state_exchange_cnt;
+	u16						device_password_id_for_nego;	//	The device password ID for group negotation
+	u8						negotiation_dialog_token;
+	u8						nego_ssid[ WLAN_SSID_MAXLEN ];	//	SSID information for group negotitation
+	u8						nego_ssidlen;
+	u8 						p2p_group_ssid[WLAN_SSID_MAXLEN];
+	u8 						p2p_group_ssid_len;
+	u8						persistent_supported;		//	Flag to know the persistent function should be supported or not.
+														//	In the Sigma test, the Sigma will provide this enable from the sta_set_p2p CAPI.
+														//	0: disable
+														//	1: enable
+	u8						session_available;			//	Flag to set the WFD session available to enable or disable "by Sigma"
+														//	In the Sigma test, the Sigma will disable the session available by using the sta_preset CAPI.
+														//	0: disable
+														//	1: enable
+	u8						wfd_tdls_enable;			//	Flag to enable or disable the TDLS by WFD Sigma
+														//	0: disable
+														//	1: enable
+	u8						wfd_tdls_weaksec;			//	Flag to enable or disable the weak security function for TDLS by WFD Sigma
+														//	0: disable
+														//	In this case, the driver can't issue the tdsl setup request frame.
+														//	1: enable
+														//	In this case, the driver can issue the tdls setup request frame
+														//	even the current security is weak security.
+
+	enum	P2P_WPSINFO		ui_got_wps_info;			//	This field will store the WPS value (PIN value or PBC) that UI had got from the user.
+	u16						supported_wps_cm;			//	This field describes the WPS config method which this driver supported.
+														//	The value should be the combination of config method defined in page104 of WPS v2.0 spec.
+	u8						external_uuid;				//  UUID flag
+	u8						uuid[16];					//  UUID
+	uint						channel_list_attr_len;		//	This field will contain the length of body of P2P Channel List attribute of group negotitation response frame.
+	u8						channel_list_attr[100];		//	This field will contain the body of P2P Channel List attribute of group negotitation response frame.
+														//	We will use the channel_cnt and channel_list fields when constructing the group negotitation confirm frame.
+	u8						driver_interface; 			// Indicate DRIVER_WEXT or DRIVER_CFG80211
+
+#ifdef CONFIG_CONCURRENT_MODE
+	u16						ext_listen_interval;	//	The interval to be available with legacy AP (ms)
+	u16						ext_listen_period;	//	The time period to be available for P2P listen state (ms)
+#endif
+#ifdef CONFIG_P2P_PS
+	enum P2P_PS_MODE		p2p_ps_mode; // indicate p2p ps mode
+	enum P2P_PS_STATE		p2p_ps_state; // indicate p2p ps state
+	u8						noa_index; // Identifies and instance of Notice of Absence timing.
+	u8						ctwindow; // Client traffic window. A period of time in TU after TBTT.
+	u8						opp_ps; // opportunistic power save.
+	u8						noa_num; // number of NoA descriptor in P2P IE.
+	u8						noa_count[P2P_MAX_NOA_NUM]; // Count for owner, Type of client.
+	u32						noa_duration[P2P_MAX_NOA_NUM]; // Max duration for owner, preferred or min acceptable duration for client.
+	u32						noa_interval[P2P_MAX_NOA_NUM]; // Length of interval for owner, preferred or max acceptable interval of client.
+	u32						noa_start_time[P2P_MAX_NOA_NUM]; // schedule expressed in terms of the lower 4 bytes of the TSF timer.
+#endif // CONFIG_P2P_PS
+};
+
+struct tdls_ss_record{	//signal strength record; recording the tdls sta with lowerest ss
+	u8		macaddr[ETH_ALEN];
+	u8		RxPWDBAll;
+	u8		is_tdls_sta;	// _TRUE: direct link sta, _FALSE: else
+};
+
+struct tdls_info{
+	u8					ap_prohibited;
+	uint					setup_state;
+	u8					sta_cnt;
+	u8					sta_maximum;	// 1:tdls sta is equal (NUM_STA-1), reach max direct link number; 0: else;
+	struct tdls_ss_record	ss_record;
+	u8					macid_index;	//macid entry that is ready to write
+	u8					clear_cam;	//cam entry that is trying to clear, using it in direct link teardown
+	u8					ch_sensing;
+	u8					cur_channel;
+	u8					candidate_ch;
+	u8					collect_pkt_num[MAX_CHANNEL_NUM];
+	_lock				cmd_lock;
+	_lock				hdl_lock;
+	u8					watchdog_count;
+	u8					dev_discovered;		//WFD_TDLS: for sigma test
+	u8					enable;
+#ifdef CONFIG_WFD
+	struct wifi_display_info		*wfd_info;
+#endif
+};
+
+struct mlme_priv {
+
+	_lock	lock;
+	sint	fw_state;	//shall we protect this variable? maybe not necessarily...
+
+	u8	to_join; //flag
+	#ifdef CONFIG_LAYER2_ROAMING
+	u8 to_roaming; // roaming trying times
+	#endif
+
+	u8	*nic_hdl;
+
+	u8	not_indic_disco;
+	_list		*pscanned;
+	_queue	free_bss_pool;
+	_queue	scanned_queue;
+	u8		*free_bss_buf;
+	u32	num_of_scanned;
+
+	NDIS_802_11_SSID	assoc_ssid;
+	u8	assoc_bssid[6];
+
+	struct wlan_network	cur_network;
+
+	//uint wireless_mode; no used, remove it
+
+	u32	scan_interval;
+
+	_timer assoc_timer;
+
+	uint assoc_by_bssid;
+	uint assoc_by_rssi;
+
+	_timer scan_to_timer; // driver itself handles scan_timeout status.
+	u32 scan_start_time; // used to evaluate the time spent in scanning
+
+	#ifdef CONFIG_SET_SCAN_DENY_TIMER
+	_timer set_scan_deny_timer;
+	ATOMIC_T set_scan_deny; //0: allowed, 1: deny
+	#endif
+
+	struct qos_priv qospriv;
+
+#ifdef CONFIG_80211N_HT
+
+	/* Number of non-HT AP/stations */
+	int num_sta_no_ht;
+
+	/* Number of HT AP/stations 20 MHz */
+	//int num_sta_ht_20mhz;
+
+
+	int num_FortyMHzIntolerant;
+
+	struct ht_priv	htpriv;
+
+#endif
+
+	RT_LINK_DETECT_T	LinkDetectInfo;
+	_timer	dynamic_chk_timer; //dynamic/periodic check timer
+
+	u8	acm_mask; // for wmm acm mask
+	u8	ChannelPlan;
+	RT_SCAN_TYPE 	scan_mode; // active: 1, passive: 0
+
+	//u8 probereq_wpsie[MAX_WPS_IE_LEN];//added in probe req
+	//int probereq_wpsie_len;
+	u8 *wps_probe_req_ie;
+	u32 wps_probe_req_ie_len;
+
+#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+	/* Number of associated Non-ERP stations (i.e., stations using 802.11b
+	 * in 802.11g BSS) */
+	int num_sta_non_erp;
+
+	/* Number of associated stations that do not support Short Slot Time */
+	int num_sta_no_short_slot_time;
+
+	/* Number of associated stations that do not support Short Preamble */
+	int num_sta_no_short_preamble;
+
+	int olbc; /* Overlapping Legacy BSS Condition */
+
+	/* Number of HT associated stations that do not support greenfield */
+	int num_sta_ht_no_gf;
+
+	/* Number of associated non-HT stations */
+	//int num_sta_no_ht;
+
+	/* Number of HT associated stations 20 MHz */
+	int num_sta_ht_20mhz;
+
+	/* Overlapping BSS information */
+	int olbc_ht;
+
+#ifdef CONFIG_80211N_HT
+	u16 ht_op_mode;
+#endif /* CONFIG_80211N_HT */
+
+	u8 *assoc_req;
+	u32 assoc_req_len;
+	u8 *assoc_rsp;
+	u32 assoc_rsp_len;
+
+	u8 *wps_beacon_ie;
+	//u8 *wps_probe_req_ie;
+	u8 *wps_probe_resp_ie;
+	u8 *wps_assoc_resp_ie; // for CONFIG_IOCTL_CFG80211, this IE could include p2p ie / wfd ie
+
+	u32 wps_beacon_ie_len;
+	//u32 wps_probe_req_ie_len;
+	u32 wps_probe_resp_ie_len;
+	u32 wps_assoc_resp_ie_len; // for CONFIG_IOCTL_CFG80211, this IE len could include p2p ie / wfd ie
+
+	u8 *p2p_beacon_ie;
+	u8 *p2p_probe_req_ie;
+	u8 *p2p_probe_resp_ie;
+	u8 *p2p_go_probe_resp_ie; //for GO
+	u8 *p2p_assoc_req_ie;
+
+	u32 p2p_beacon_ie_len;
+	u32 p2p_probe_req_ie_len;
+	u32 p2p_probe_resp_ie_len;
+	u32 p2p_go_probe_resp_ie_len; //for GO
+	u32 p2p_assoc_req_ie_len;
+/*
+#if defined(CONFIG_P2P) && defined(CONFIG_IOCTL_CFG80211)
+	//u8 *wps_p2p_beacon_ie;
+	u8 *p2p_beacon_ie;
+	u8 *wps_p2p_probe_resp_ie;
+	u8 *wps_p2p_assoc_resp_ie;
+	//u32 wps_p2p_beacon_ie_len;
+	u32 p2p_beacon_ie_len;
+	u32 wps_p2p_probe_resp_ie_len;
+	u32 wps_p2p_assoc_resp_ie_len;
+#endif
+*/
+
+	_lock	bcn_update_lock;
+	u8		update_bcn;
+
+
+#endif //#if defined (CONFIG_AP_MODE) && defined (CONFIG_NATIVEAP_MLME)
+
+#if defined(CONFIG_WFD) && defined(CONFIG_IOCTL_CFG80211)
+
+	u8 *wfd_beacon_ie;
+	u8 *wfd_probe_req_ie;
+	u8 *wfd_probe_resp_ie;
+	u8 *wfd_go_probe_resp_ie; //for GO
+	u8 *wfd_assoc_req_ie;
+
+	u32 wfd_beacon_ie_len;
+	u32 wfd_probe_req_ie_len;
+	u32 wfd_probe_resp_ie_len;
+	u32 wfd_go_probe_resp_ie_len; //for GO
+	u32 wfd_assoc_req_ie_len;
+
+#endif
+
+#ifdef RTK_DMP_PLATFORM
+	// DMP kobject_hotplug function  signal need in passive level
+	_workitem	Linkup_workitem;
+	_workitem	Linkdown_workitem;
+#endif
+
+#ifdef CONFIG_INTEL_WIDI
+	int	widi_state;
+	int	listen_state;
+	_timer	listen_timer;
+	ATOMIC_T	rx_probe_rsp; // 1:receive probe respone from RDS source.
+	u8	*l2sdTaBuffer;
+	u8	channel_idx;
+	s8	group_cnt;	//For WiDi 3.5, they specified another scan algo. for WFD/RDS co-existed
+	u8	sa_ext[L2SDTA_SERVICE_VE_LEN];
+
+	u8	widi_enable;
+	/**
+	 * For WiDi 4; upper layer would set
+	 * p2p_primary_device_type_category_id
+	 * p2p_primary_device_type_sub_category_id
+	 * p2p_secondary_device_type_category_id
+	 * p2p_secondary_device_type_sub_category_id
+	 */
+	u16	p2p_pdt_cid;
+	u16	p2p_pdt_scid;
+	u8	num_p2p_sdt;
+	u16	p2p_sdt_cid[MAX_NUM_P2P_SDT];
+	u16	p2p_sdt_scid[MAX_NUM_P2P_SDT];
+	u8	p2p_reject_disable;	//When starting NL80211 wpa_supplicant/hostapd, it will call netdev_close
+							//such that it will cause p2p disabled. Use this flag to reject.
+#endif // CONFIG_INTEL_WIDI
+
+#ifdef CONFIG_CONCURRENT_MODE
+	u8	scanning_via_buddy_intf;
+#endif
+};
+
+#ifdef CONFIG_AP_MODE
+
+struct hostapd_priv
+{
+	_adapter *padapter;
+
+#ifdef CONFIG_HOSTAPD_MLME
+	struct net_device *pmgnt_netdev;
+	struct usb_anchor anchored;
+#endif
+
+};
+
+extern int hostapd_mode_init(_adapter *padapter);
+extern void hostapd_mode_unload(_adapter *padapter);
+#endif
+
+
+extern void rtw_joinbss_event_prehandle(_adapter *adapter, u8 *pbuf);
+extern void rtw_survey_event_callback(_adapter *adapter, u8 *pbuf);
+extern void rtw_surveydone_event_callback(_adapter *adapter, u8 *pbuf);
+extern void rtw_joinbss_event_callback(_adapter *adapter, u8 *pbuf);
+extern void rtw_stassoc_event_callback(_adapter *adapter, u8 *pbuf);
+extern void rtw_stadel_event_callback(_adapter *adapter, u8 *pbuf);
+extern void rtw_atimdone_event_callback(_adapter *adapter, u8 *pbuf);
+extern void rtw_cpwm_event_callback(_adapter *adapter, u8 *pbuf);
+
+#ifdef PLATFORM_WINDOWS
+extern thread_return event_thread(void *context);
+
+extern void rtw_join_timeout_handler (
+	IN	PVOID					SystemSpecific1,
+	IN	PVOID					FunctionContext,
+	IN	PVOID					SystemSpecific2,
+	IN	PVOID					SystemSpecific3
+	);
+
+extern void _rtw_scan_timeout_handler (
+	IN	PVOID					SystemSpecific1,
+	IN	PVOID					FunctionContext,
+	IN	PVOID					SystemSpecific2,
+	IN	PVOID					SystemSpecific3
+	);
+
+#endif
+
+#if defined (PLATFORM_LINUX)|| defined (PLATFORM_FREEBSD)
+extern int event_thread(void *context);
+extern void rtw_join_timeout_handler(void* FunctionContext);
+extern void _rtw_scan_timeout_handler(void* FunctionContext);
+#endif
+
+extern void rtw_free_network_queue(_adapter *adapter,u8 isfreeall);
+extern int rtw_init_mlme_priv(_adapter *adapter);// (struct mlme_priv *pmlmepriv);
+
+extern void rtw_free_mlme_priv (struct mlme_priv *pmlmepriv);
+
+
+extern sint rtw_select_and_join_from_scanned_queue(struct mlme_priv *pmlmepriv);
+extern sint rtw_set_key(_adapter *adapter,struct security_priv *psecuritypriv,sint keyid, u8 set_tx);
+extern sint rtw_set_auth(_adapter *adapter,struct security_priv *psecuritypriv);
+
+__inline static u8 *get_bssid(struct mlme_priv *pmlmepriv)
+{	//if sta_mode:pmlmepriv->cur_network.network.MacAddress=> bssid
+	// if adhoc_mode:pmlmepriv->cur_network.network.MacAddress=> ibss mac address
+	return pmlmepriv->cur_network.network.MacAddress;
+}
+
+__inline static sint check_fwstate(struct mlme_priv *pmlmepriv, sint state)
+{
+	if (pmlmepriv->fw_state & state)
+		return _TRUE;
+
+	return _FALSE;
+}
+
+__inline static sint get_fwstate(struct mlme_priv *pmlmepriv)
+{
+	return pmlmepriv->fw_state;
+}
+
+/*
+ * No Limit on the calling context,
+ * therefore set it to be the critical section...
+ *
+ * ### NOTE:#### (!!!!)
+ * MUST TAKE CARE THAT BEFORE CALLING THIS FUNC, YOU SHOULD HAVE LOCKED pmlmepriv->lock
+ */
+__inline static void set_fwstate(struct mlme_priv *pmlmepriv, sint state)
+{
+	pmlmepriv->fw_state |= state;
+}
+
+__inline static void _clr_fwstate_(struct mlme_priv *pmlmepriv, sint state)
+{
+	pmlmepriv->fw_state &= ~state;
+}
+
+/*
+ * No Limit on the calling context,
+ * therefore set it to be the critical section...
+ */
+__inline static void clr_fwstate(struct mlme_priv *pmlmepriv, sint state)
+{
+	_irqL irqL;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	if (check_fwstate(pmlmepriv, state) == _TRUE)
+		pmlmepriv->fw_state ^= state;
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+}
+
+__inline static void clr_fwstate_ex(struct mlme_priv *pmlmepriv, sint state)
+{
+	_irqL irqL;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	_clr_fwstate_(pmlmepriv, state);
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+}
+
+__inline static void up_scanned_network(struct mlme_priv *pmlmepriv)
+{
+	_irqL irqL;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	pmlmepriv->num_of_scanned++;
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+}
+
+#ifdef CONFIG_CONCURRENT_MODE
+sint rtw_buddy_adapter_up(_adapter *padapter);
+sint check_buddy_fwstate(_adapter *padapter, sint state);
+#endif //CONFIG_CONCURRENT_MODE
+
+__inline static void down_scanned_network(struct mlme_priv *pmlmepriv)
+{
+	_irqL irqL;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	pmlmepriv->num_of_scanned--;
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+}
+
+__inline static void set_scanned_network_val(struct mlme_priv *pmlmepriv, sint val)
+{
+	_irqL irqL;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	pmlmepriv->num_of_scanned = val;
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+}
+
+extern u16 rtw_get_capability(WLAN_BSSID_EX *bss);
+extern void rtw_update_scanned_network(_adapter *adapter, WLAN_BSSID_EX *target);
+extern void rtw_disconnect_hdl_under_linked(_adapter* adapter, struct sta_info *psta, u8 free_assoc);
+extern void rtw_generate_random_ibss(u8 *pibss);
+extern struct wlan_network* rtw_find_network(_queue *scanned_queue, u8 *addr);
+extern struct wlan_network* rtw_get_oldest_wlan_network(_queue *scanned_queue);
+
+extern void rtw_free_assoc_resources(_adapter* adapter, int lock_scanned_queue);
+extern void rtw_indicate_disconnect(_adapter* adapter);
+extern void rtw_indicate_connect(_adapter* adapter);
+void rtw_indicate_scan_done( _adapter *padapter, bool aborted);
+void rtw_scan_abort(_adapter *adapter);
+
+extern int rtw_restruct_sec_ie(_adapter *adapter,u8 *in_ie,u8 *out_ie,uint in_len);
+extern int rtw_restruct_wmm_ie(_adapter *adapter, u8 *in_ie, u8 *out_ie, uint in_len, uint initial_out_len);
+extern void rtw_init_registrypriv_dev_network(_adapter *adapter);
+
+extern void rtw_update_registrypriv_dev_network(_adapter *adapter);
+
+extern void rtw_get_encrypt_decrypt_from_registrypriv(_adapter *adapter);
+
+extern void _rtw_join_timeout_handler(_adapter *adapter);
+extern void rtw_scan_timeout_handler(_adapter *adapter);
+
+extern void rtw_dynamic_check_timer_handlder(_adapter *adapter);
+#ifdef CONFIG_SET_SCAN_DENY_TIMER
+bool rtw_is_scan_deny(_adapter *adapter);
+void rtw_clear_scan_deny(_adapter *adapter);
+void rtw_set_scan_deny_timer_hdl(_adapter *adapter);
+void rtw_set_scan_deny(_adapter *adapter, u32 ms);
+#else
+#define rtw_is_scan_deny(adapter) _FALSE
+#define rtw_clear_scan_deny(adapter) do {} while (0)
+#define rtw_set_scan_deny_timer_hdl(adapter) do {} while (0)
+#define rtw_set_scan_deny(adapter, ms) do {} while (0)
+#endif
+
+
+extern int _rtw_init_mlme_priv(_adapter *padapter);
+
+void rtw_free_mlme_priv_ie_data(struct mlme_priv *pmlmepriv);
+
+extern void _rtw_free_mlme_priv(struct mlme_priv *pmlmepriv);
+
+extern int _rtw_enqueue_network(_queue *queue, struct wlan_network *pnetwork);
+
+extern struct wlan_network* _rtw_dequeue_network(_queue *queue);
+
+extern struct wlan_network* _rtw_alloc_network(struct mlme_priv *pmlmepriv);
+
+
+extern void _rtw_free_network(struct mlme_priv *pmlmepriv, struct wlan_network *pnetwork, u8 isfreeall);
+extern void _rtw_free_network_nolock(struct mlme_priv *pmlmepriv, struct wlan_network *pnetwork);
+
+
+extern struct wlan_network* _rtw_find_network(_queue *scanned_queue, u8 *addr);
+
+extern void _rtw_free_network_queue(_adapter* padapter, u8 isfreeall);
+
+extern sint rtw_if_up(_adapter *padapter);
+
+
+u8 *rtw_get_capability_from_ie(u8 *ie);
+u8 *rtw_get_timestampe_from_ie(u8 *ie);
+u8 *rtw_get_beacon_interval_from_ie(u8 *ie);
+
+
+void rtw_joinbss_reset(_adapter *padapter);
+
+#ifdef CONFIG_80211N_HT
+unsigned int rtw_restructure_ht_ie(_adapter *padapter, u8 *in_ie, u8 *out_ie, uint in_len, uint *pout_len, u8 channel);
+void rtw_update_ht_cap(_adapter *padapter, u8 *pie, uint ie_len, u8 channel);
+void rtw_issue_addbareq_cmd(_adapter *padapter, struct xmit_frame *pxmitframe);
+#endif
+
+int rtw_is_same_ibss(_adapter *adapter, struct wlan_network *pnetwork);
+int is_same_network(WLAN_BSSID_EX *src, WLAN_BSSID_EX *dst);
+
+#ifdef CONFIG_LAYER2_ROAMING
+void _rtw_roaming(_adapter *adapter, struct wlan_network *tgt_network);
+void rtw_roaming(_adapter *adapter, struct wlan_network *tgt_network);
+void rtw_set_roaming(_adapter *adapter, u8 to_roaming);
+u8 rtw_to_roaming(_adapter *adapter);
+#else
+#define _rtw_roaming(adapter, tgt_network) do {} while(0)
+#define rtw_roaming(adapter, tgt_network) do {} while(0)
+#define rtw_set_roaming(adapter, to_roaming) do {} while(0)
+#define rtw_to_roaming(adapter) 0
+#endif
+
+
+#ifdef CONFIG_INTEL_PROXIM
+void rtw_proxim_enable(_adapter *padapter);
+void rtw_proxim_disable(_adapter *padapter);
+void rtw_proxim_send_packet(_adapter *padapter,u8 *pbuf,u16 len,u8 hw_rate);
+#endif //CONFIG_INTEL_PROXIM
+#endif //__RTL871X_MLME_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mlme_ext.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mlme_ext.h
new file mode 100644
index 000000000000..440324436f04
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mlme_ext.h
@@ -0,0 +1,962 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_MLME_EXT_H_
+#define __RTW_MLME_EXT_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <wlan_bssdef.h>
+
+
+//	Commented by Albert 20101105
+//	Increase the SURVEY_TO value from 100 to 150  ( 100ms to 150ms )
+//	The Realtek 8188CE SoftAP will spend around 100ms to send the probe response after receiving the probe request.
+//	So, this driver tried to extend the dwell time for each scanning channel.
+//	This will increase the chance to receive the probe response from SoftAP.
+
+#define SURVEY_TO		(100)
+#define REAUTH_TO		(300) //(50)
+#define REASSOC_TO		(300) //(50)
+//#define DISCONNECT_TO	(3000)
+#define ADDBA_TO			(2000)
+
+#define LINKED_TO (1) //unit:2 sec, 1x2=2 sec
+
+#define REAUTH_LIMIT	(4)
+#define REASSOC_LIMIT	(4)
+#define READDBA_LIMIT	(2)
+
+//#define	IOCMD_REG0		0x10250370
+//#define	IOCMD_REG1		0x10250374
+//#define	IOCMD_REG2		0x10250378
+
+//#define	FW_DYNAMIC_FUN_SWITCH	0x10250364
+
+//#define	WRITE_BB_CMD		0xF0000001
+//#define	SET_CHANNEL_CMD	0xF3000000
+//#define	UPDATE_RA_CMD	0xFD0000A2
+
+#define	DYNAMIC_FUNC_DISABLE		(0x0)
+#define	DYNAMIC_FUNC_DIG			BIT(0)
+#define	DYNAMIC_FUNC_HP			BIT(1)
+#define	DYNAMIC_FUNC_SS			BIT(2) //Tx Power Tracking
+#define DYNAMIC_FUNC_BT			BIT(3)
+#define DYNAMIC_FUNC_ANT_DIV		BIT(4)
+#define DYNAMIC_FUNC_ADAPTIVITY	BIT(5)
+
+#define _HW_STATE_NOLINK_		0x00
+#define _HW_STATE_ADHOC_		0x01
+#define _HW_STATE_STATION_ 	0x02
+#define _HW_STATE_AP_			0x03
+
+
+#define		_1M_RATE_	0
+#define		_2M_RATE_	1
+#define		_5M_RATE_	2
+#define		_11M_RATE_	3
+#define		_6M_RATE_	4
+#define		_9M_RATE_	5
+#define		_12M_RATE_	6
+#define		_18M_RATE_	7
+#define		_24M_RATE_	8
+#define		_36M_RATE_	9
+#define		_48M_RATE_	10
+#define		_54M_RATE_	11
+
+
+extern unsigned char RTW_WPA_OUI[];
+extern unsigned char WMM_OUI[];
+extern unsigned char WPS_OUI[];
+extern unsigned char WFD_OUI[];
+extern unsigned char P2P_OUI[];
+
+extern unsigned char WMM_INFO_OUI[];
+extern unsigned char WMM_PARA_OUI[];
+
+
+//
+// Channel Plan Type.
+// Note:
+//	We just add new channel plan when the new channel plan is different from any of the following
+//	channel plan.
+//	If you just wnat to customize the acitions(scan period or join actions) about one of the channel plan,
+//	customize them in RT_CHANNEL_INFO in the RT_CHANNEL_LIST.
+//
+typedef enum _RT_CHANNEL_DOMAIN
+{
+	//===== old channel plan mapping =====//
+	RT_CHANNEL_DOMAIN_FCC = 0x00,
+	RT_CHANNEL_DOMAIN_IC = 0x01,
+	RT_CHANNEL_DOMAIN_ETSI = 0x02,
+	RT_CHANNEL_DOMAIN_SPAIN = 0x03,
+	RT_CHANNEL_DOMAIN_FRANCE = 0x04,
+	RT_CHANNEL_DOMAIN_MKK = 0x05,
+	RT_CHANNEL_DOMAIN_MKK1 = 0x06,
+	RT_CHANNEL_DOMAIN_ISRAEL = 0x07,
+	RT_CHANNEL_DOMAIN_TELEC = 0x08,
+	RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN = 0x09,
+	RT_CHANNEL_DOMAIN_WORLD_WIDE_13 = 0x0A,
+	RT_CHANNEL_DOMAIN_TAIWAN = 0x0B,
+	RT_CHANNEL_DOMAIN_CHINA = 0x0C,
+	RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO = 0x0D,
+	RT_CHANNEL_DOMAIN_KOREA = 0x0E,
+	RT_CHANNEL_DOMAIN_TURKEY = 0x0F,
+	RT_CHANNEL_DOMAIN_JAPAN = 0x10,
+	RT_CHANNEL_DOMAIN_FCC_NO_DFS = 0x11,
+	RT_CHANNEL_DOMAIN_JAPAN_NO_DFS = 0x12,
+	RT_CHANNEL_DOMAIN_WORLD_WIDE_5G = 0x13,
+	RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS = 0x14,
+
+	//===== new channel plan mapping, (2GDOMAIN_5GDOMAIN) =====//
+	RT_CHANNEL_DOMAIN_WORLD_NULL = 0x20,
+	RT_CHANNEL_DOMAIN_ETSI1_NULL = 0x21,
+	RT_CHANNEL_DOMAIN_FCC1_NULL = 0x22,
+	RT_CHANNEL_DOMAIN_MKK1_NULL = 0x23,
+	RT_CHANNEL_DOMAIN_ETSI2_NULL = 0x24,
+	RT_CHANNEL_DOMAIN_FCC1_FCC1 = 0x25,
+	RT_CHANNEL_DOMAIN_WORLD_ETSI1 = 0x26,
+	RT_CHANNEL_DOMAIN_MKK1_MKK1 = 0x27,
+	RT_CHANNEL_DOMAIN_WORLD_KCC1 = 0x28,
+	RT_CHANNEL_DOMAIN_WORLD_FCC2 = 0x29,
+	RT_CHANNEL_DOMAIN_WORLD_FCC3 = 0x30,
+	RT_CHANNEL_DOMAIN_WORLD_FCC4 = 0x31,
+	RT_CHANNEL_DOMAIN_WORLD_FCC5 = 0x32,
+	RT_CHANNEL_DOMAIN_WORLD_FCC6 = 0x33,
+	RT_CHANNEL_DOMAIN_FCC1_FCC7 = 0x34,
+	RT_CHANNEL_DOMAIN_WORLD_ETSI2 = 0x35,
+	RT_CHANNEL_DOMAIN_WORLD_ETSI3 = 0x36,
+	RT_CHANNEL_DOMAIN_MKK1_MKK2 = 0x37,
+	RT_CHANNEL_DOMAIN_MKK1_MKK3 = 0x38,
+	RT_CHANNEL_DOMAIN_FCC1_NCC1 = 0x39,
+	RT_CHANNEL_DOMAIN_FCC1_NCC2 = 0x40,
+
+	//===== Add new channel plan above this line===============//
+	RT_CHANNEL_DOMAIN_MAX,
+	RT_CHANNEL_DOMAIN_REALTEK_DEFINE = 0x7F,
+}RT_CHANNEL_DOMAIN, *PRT_CHANNEL_DOMAIN;
+
+typedef enum _RT_CHANNEL_DOMAIN_2G
+{
+	RT_CHANNEL_DOMAIN_2G_WORLD = 0x00,		//Worldwird 13
+	RT_CHANNEL_DOMAIN_2G_ETSI1 = 0x01,		//Europe
+	RT_CHANNEL_DOMAIN_2G_FCC1 = 0x02,		//US
+	RT_CHANNEL_DOMAIN_2G_MKK1 = 0x03,		//Japan
+	RT_CHANNEL_DOMAIN_2G_ETSI2 = 0x04,		//France
+	RT_CHANNEL_DOMAIN_2G_NULL = 0x05,
+	//===== Add new channel plan above this line===============//
+	RT_CHANNEL_DOMAIN_2G_MAX,
+}RT_CHANNEL_DOMAIN_2G, *PRT_CHANNEL_DOMAIN_2G;
+
+typedef enum _RT_CHANNEL_DOMAIN_5G
+{
+	RT_CHANNEL_DOMAIN_5G_NULL = 0x00,
+	RT_CHANNEL_DOMAIN_5G_ETSI1 = 0x01,		//Europe
+	RT_CHANNEL_DOMAIN_5G_ETSI2 = 0x02,		//Australia, New Zealand
+	RT_CHANNEL_DOMAIN_5G_ETSI3 = 0x03,		//Russia
+	RT_CHANNEL_DOMAIN_5G_FCC1 = 0x04,		//US
+	RT_CHANNEL_DOMAIN_5G_FCC2 = 0x05,		//FCC o/w DFS Channels
+	RT_CHANNEL_DOMAIN_5G_FCC3 = 0x06,		//India, Mexico
+	RT_CHANNEL_DOMAIN_5G_FCC4 = 0x07,		//Venezuela
+	RT_CHANNEL_DOMAIN_5G_FCC5 = 0x08,		//China
+	RT_CHANNEL_DOMAIN_5G_FCC6 = 0x09,		//Israel
+	RT_CHANNEL_DOMAIN_5G_FCC7_IC1 = 0x0A,	//US, Canada
+	RT_CHANNEL_DOMAIN_5G_KCC1 = 0x0B,		//Korea
+	RT_CHANNEL_DOMAIN_5G_MKK1 = 0x0C,		//Japan
+	RT_CHANNEL_DOMAIN_5G_MKK2 = 0x0D,		//Japan (W52, W53)
+	RT_CHANNEL_DOMAIN_5G_MKK3 = 0x0E,		//Japan (W56)
+	RT_CHANNEL_DOMAIN_5G_NCC1 = 0x0F,		//Taiwan
+	RT_CHANNEL_DOMAIN_5G_NCC2 = 0x10,		//Taiwan o/w DFS
+	//===== Add new channel plan above this line===============//
+	//===== Driver Self Defined =====//
+	RT_CHANNEL_DOMAIN_5G_FCC = 0x11,
+	RT_CHANNEL_DOMAIN_5G_JAPAN_NO_DFS = 0x12,
+	RT_CHANNEL_DOMAIN_5G_FCC4_NO_DFS = 0x13,
+	RT_CHANNEL_DOMAIN_5G_MAX,
+}RT_CHANNEL_DOMAIN_5G, *PRT_CHANNEL_DOMAIN_5G;
+
+#define rtw_is_channel_plan_valid(chplan) (chplan<RT_CHANNEL_DOMAIN_MAX || chplan == RT_CHANNEL_DOMAIN_REALTEK_DEFINE)
+
+typedef struct _RT_CHANNEL_PLAN
+{
+	unsigned char	Channel[MAX_CHANNEL_NUM];
+	unsigned char	Len;
+}RT_CHANNEL_PLAN, *PRT_CHANNEL_PLAN;
+
+typedef struct _RT_CHANNEL_PLAN_2G
+{
+	unsigned char	Channel[MAX_CHANNEL_NUM_2G];
+	unsigned char	Len;
+}RT_CHANNEL_PLAN_2G, *PRT_CHANNEL_PLAN_2G;
+
+typedef struct _RT_CHANNEL_PLAN_5G
+{
+	unsigned char	Channel[MAX_CHANNEL_NUM_5G];
+	unsigned char	Len;
+}RT_CHANNEL_PLAN_5G, *PRT_CHANNEL_PLAN_5G;
+
+typedef struct _RT_CHANNEL_PLAN_MAP
+{
+	unsigned char	Index2G;
+	unsigned char	Index5G;
+}RT_CHANNEL_PLAN_MAP, *PRT_CHANNEL_PLAN_MAP;
+
+enum Associated_AP
+{
+	atherosAP	= 0,
+	broadcomAP	= 1,
+	ciscoAP		= 2,
+	marvellAP	= 3,
+	ralinkAP	= 4,
+	realtekAP	= 5,
+	airgocapAP 	= 6,
+	unknownAP	= 7,
+	maxAP,
+};
+
+enum SCAN_STATE
+{
+	SCAN_DISABLE = 0,
+	SCAN_START = 1,
+	SCAN_TXNULL = 2,
+	SCAN_PROCESS = 3,
+	SCAN_COMPLETE = 4,
+	SCAN_STATE_MAX,
+};
+
+struct mlme_handler {
+	unsigned int   num;
+	char* str;
+	unsigned int (*func)(_adapter *padapter, union recv_frame *precv_frame);
+};
+
+struct action_handler {
+	unsigned int   num;
+	char* str;
+	unsigned int (*func)(_adapter *padapter, union recv_frame *precv_frame);
+};
+
+struct	ss_res
+{
+	int	state;
+	int	bss_cnt;
+	int	channel_idx;
+	int	scan_mode;
+	u8 ssid_num;
+	u8 ch_num;
+	NDIS_802_11_SSID ssid[RTW_SSID_SCAN_AMOUNT];
+	struct rtw_ieee80211_channel ch[RTW_CHANNEL_SCAN_AMOUNT];
+};
+
+//#define AP_MODE				0x0C
+//#define STATION_MODE	0x08
+//#define AD_HOC_MODE		0x04
+//#define NO_LINK_MODE	0x00
+
+#define 	WIFI_FW_NULL_STATE			_HW_STATE_NOLINK_
+#define	WIFI_FW_STATION_STATE		_HW_STATE_STATION_
+#define	WIFI_FW_AP_STATE				_HW_STATE_AP_
+#define	WIFI_FW_ADHOC_STATE			_HW_STATE_ADHOC_
+
+#define	WIFI_FW_AUTH_NULL			0x00000100
+#define	WIFI_FW_AUTH_STATE			0x00000200
+#define	WIFI_FW_AUTH_SUCCESS			0x00000400
+
+#define	WIFI_FW_ASSOC_STATE			0x00002000
+#define	WIFI_FW_ASSOC_SUCCESS		0x00004000
+
+#define	WIFI_FW_LINKING_STATE		(WIFI_FW_AUTH_NULL | WIFI_FW_AUTH_STATE | WIFI_FW_AUTH_SUCCESS |WIFI_FW_ASSOC_STATE)
+
+#ifdef CONFIG_TDLS
+// 1: Write RCR DATA BIT
+// 2: Issue peer traffic indication
+// 3: Go back to the channel linked with AP, terminating channel switch procedure
+// 4: Init channel sensing, receive all data and mgnt frame
+// 5: Channel sensing and report candidate channel
+// 6: First time set channel to off channel
+// 7: Go back tp the channel linked with AP when set base channel as target channel
+// 8: Set channel back to base channel
+// 9: Set channel back to off channel
+// 10: Restore RCR DATA BIT
+// 11: Check alive
+// 12: Check alive
+// 13: Free TDLS sta
+enum TDLS_option
+{
+	TDLS_WRCR			= 	1,
+	TDLS_SD_PTI		= 	2,
+	TDLS_CS_OFF		= 	3,
+	TDLS_INIT_CH_SEN	= 	4,
+	TDLS_DONE_CH_SEN	=	5,
+	TDLS_OFF_CH		=	6,
+	TDLS_BASE_CH 		=	7,
+	TDLS_P_OFF_CH		=	8,
+	TDLS_P_BASE_CH	= 	9,
+	TDLS_RS_RCR		=	10,
+	TDLS_CKALV_PH1	=	11,
+	TDLS_CKALV_PH2	=	12,
+	TDLS_FREE_STA		=	13,
+	maxTDLS,
+};
+
+#endif //CONFIG_TDLS
+
+struct FW_Sta_Info
+{
+	struct sta_info	*psta;
+	u32	status;
+	u32	rx_pkt;
+	u32	retry;
+	NDIS_802_11_RATES_EX  SupportedRates;
+};
+
+/*
+ * Usage:
+ * When one iface acted as AP mode and the other iface is STA mode and scanning,
+ * it should switch back to AP's operating channel periodically.
+ * Parameters info:
+ * When the driver scanned RTW_SCAN_NUM_OF_CH channels, it would switch back to AP's operating channel for
+ * RTW_STAY_AP_CH_MILLISECOND * SURVEY_TO milliseconds.
+ * Example:
+ * For chip supports 2.4G + 5GHz and AP mode is operating in channel 1,
+ * RTW_SCAN_NUM_OF_CH is 8, RTW_STAY_AP_CH_MILLISECOND is 3 and SURVEY_TO is 100.
+ * When it's STA mode gets set_scan command,
+ * it would
+ * 1. Doing the scan on channel 1.2.3.4.5.6.7.8
+ * 2. Back to channel 1 for 300 milliseconds
+ * 3. Go through doing site survey on channel 9.10.11.36.40.44.48.52
+ * 4. Back to channel 1 for 300 milliseconds
+ * 5. ... and so on, till survey done.
+ */
+#if defined CONFIG_STA_MODE_SCAN_UNDER_AP_MODE && defined CONFIG_CONCURRENT_MODE
+#define RTW_SCAN_NUM_OF_CH			8
+#define RTW_STAY_AP_CH_MILLISECOND	3	// this value is a multiplier,for example, when this value is 3, it would stay AP's op ch for
+											// 3 * SURVEY_TO millisecond.
+#endif //defined CONFIG_STA_MODE_SCAN_UNDER_AP_MODE && defined CONFIG_CONCURRENT_MODE
+
+struct mlme_ext_info
+{
+	u32	state;
+	u32	reauth_count;
+	u32	reassoc_count;
+	u32	link_count;
+	u32	auth_seq;
+	u32	auth_algo;	// 802.11 auth, could be open, shared, auto
+	u32	authModeToggle;
+	u32	enc_algo;//encrypt algorithm;
+	u32	key_index;	// this is only valid for legendary wep, 0~3 for key id.
+	u32	iv;
+	u8	chg_txt[128];
+	u16	aid;
+	u16	bcn_interval;
+	u16	capability;
+	u8	assoc_AP_vendor;
+	u8	slotTime;
+	u8	preamble_mode;
+	u8	WMM_enable;
+	u8	ERP_enable;
+	u8	ERP_IE;
+	u8	HT_enable;
+	u8	HT_caps_enable;
+	u8	HT_info_enable;
+	u8	HT_protection;
+	u8	turboMode_cts2self;
+	u8	turboMode_rtsen;
+	u8	SM_PS;
+	u8	agg_enable_bitmap;
+	u8	ADDBA_retry_count;
+	u8	candidate_tid_bitmap;
+	u8	dialogToken;
+	// Accept ADDBA Request
+	BOOLEAN bAcceptAddbaReq;
+	u8	bwmode_updated;
+	u8	hidden_ssid_mode;
+
+	struct ADDBA_request		ADDBA_req;
+	struct WMM_para_element	WMM_param;
+	struct HT_caps_element	HT_caps;
+	struct HT_info_element		HT_info;
+	WLAN_BSSID_EX			network;//join network or bss_network, if in ap mode, it is the same to cur_network.network
+	struct FW_Sta_Info		FW_sta_info[NUM_STA];
+
+#ifdef CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+	u8 scan_cnt;
+#endif //CONFIG_STA_MODE_SCAN_UNDER_AP_MODE
+};
+
+// The channel information about this channel including joining, scanning, and power constraints.
+typedef struct _RT_CHANNEL_INFO
+{
+	u8				ChannelNum;		// The channel number.
+	RT_SCAN_TYPE	ScanType;		// Scan type such as passive or active scan.
+	//u16				ScanPeriod;		// Listen time in millisecond in this channel.
+	//s32				MaxTxPwrDbm;	// Max allowed tx power.
+	//u32				ExInfo;			// Extended Information for this channel.
+#ifdef CONFIG_FIND_BEST_CHANNEL
+	u32				rx_count;
+#endif
+}RT_CHANNEL_INFO, *PRT_CHANNEL_INFO;
+
+int rtw_ch_set_search_ch(RT_CHANNEL_INFO *ch_set, const u32 ch);
+bool rtw_mlme_band_check(_adapter *adapter, const u32 ch);
+
+// P2P_MAX_REG_CLASSES - Maximum number of regulatory classes
+#define P2P_MAX_REG_CLASSES 10
+
+// P2P_MAX_REG_CLASS_CHANNELS - Maximum number of channels per regulatory class
+#define P2P_MAX_REG_CLASS_CHANNELS 20
+
+//  struct p2p_channels - List of supported channels
+struct p2p_channels {
+	// struct p2p_reg_class - Supported regulatory class
+	struct p2p_reg_class {
+		// reg_class - Regulatory class (IEEE 802.11-2007, Annex J)
+		u8 reg_class;
+
+		// channel - Supported channels
+		u8 channel[P2P_MAX_REG_CLASS_CHANNELS];
+
+		// channels - Number of channel entries in use
+		size_t channels;
+	} reg_class[P2P_MAX_REG_CLASSES];
+
+	// reg_classes - Number of reg_class entries in use
+	size_t reg_classes;
+};
+
+struct p2p_oper_class_map {
+	enum hw_mode {IEEE80211G,IEEE80211A} mode;
+	u8 op_class;
+	u8 min_chan;
+	u8 max_chan;
+	u8 inc;
+	enum { BW20, BW40PLUS, BW40MINUS } bw;
+};
+
+struct mlme_ext_priv
+{
+	_adapter	*padapter;
+	u8	mlmeext_init;
+	ATOMIC_T		event_seq;
+	u16	mgnt_seq;
+#ifdef CONFIG_IEEE80211W
+	u16	sa_query_seq;
+	u64 mgnt_80211w_IPN;
+	u64 mgnt_80211w_IPN_rx;
+#endif //CONFIG_IEEE80211W
+	//struct fw_priv 	fwpriv;
+
+	unsigned char	cur_channel;
+	unsigned char	cur_bwmode;
+	unsigned char	cur_ch_offset;//PRIME_CHNL_OFFSET
+	unsigned char	cur_wireless_mode;
+
+	unsigned char	max_chan_nums;
+	RT_CHANNEL_INFO		channel_set[MAX_CHANNEL_NUM];
+	struct p2p_channels channel_list;
+	unsigned char	basicrate[NumRates];
+	unsigned char	datarate[NumRates];
+
+	struct ss_res		sitesurvey_res;
+	struct mlme_ext_info	mlmext_info;//for sta/adhoc mode, including current scanning/connecting/connected related info.
+                                                     //for ap mode, network includes ap's cap_info
+	_timer		survey_timer;
+	_timer		link_timer;
+#ifdef CONFIG_IEEE80211W
+	_timer		sa_query_timer;
+#endif //CONFIG_IEEE80211W
+	//_timer		ADDBA_timer;
+	u16			chan_scan_time;
+
+	u8	scan_abort;
+	u8	tx_rate; // TXRATE when USERATE is set.
+
+	u32	retry; //retry for issue probereq
+
+	u64 TSFValue;
+
+#ifdef CONFIG_AP_MODE
+	unsigned char bstart_bss;
+#endif
+
+	//recv_decache check for Action_public frame
+        u8 action_public_dialog_token;
+	u16 	 action_public_rxseq;
+
+#ifdef CONFIG_80211D
+	u8 update_channel_plan_by_ap_done;
+#endif
+
+#ifdef CONFIG_ACTIVE_KEEP_ALIVE_CHECK
+	u8 active_keep_alive_check;
+#endif
+
+};
+
+int init_mlme_ext_priv(_adapter* padapter);
+int init_hw_mlme_ext(_adapter *padapter);
+void free_mlme_ext_priv (struct mlme_ext_priv *pmlmeext);
+extern void init_mlme_ext_timer(_adapter *padapter);
+extern void init_addba_retry_timer(_adapter *padapter, struct sta_info *psta);
+extern struct xmit_frame *alloc_mgtxmitframe(struct xmit_priv *pxmitpriv);
+struct xmit_frame *alloc_mgtxmitframe_once(struct xmit_priv *pxmitpriv);
+
+//void fill_fwpriv(_adapter * padapter, struct fw_priv *pfwpriv);
+
+unsigned char networktype_to_raid(unsigned char network_type);
+int judge_network_type(_adapter *padapter, unsigned char *rate, int ratelen);
+void get_rate_set(_adapter *padapter, unsigned char *pbssrate, int *bssrate_len);
+void UpdateBrateTbl(_adapter *padapter,u8 *mBratesOS);
+void UpdateBrateTblForSoftAP(u8 *bssrateset, u32 bssratelen);
+void change_band_update_ie(_adapter *padapter, WLAN_BSSID_EX *pnetwork);
+
+void Save_DM_Func_Flag(_adapter *padapter);
+void Restore_DM_Func_Flag(_adapter *padapter);
+void Switch_DM_Func(_adapter *padapter, u8 mode, u8 enable);
+
+//void Set_NETYPE1_MSR(_adapter *padapter, u8 type);
+//void Set_NETYPE0_MSR(_adapter *padapter, u8 type);
+void Set_MSR(_adapter *padapter, u8 type);
+
+u8 rtw_get_oper_ch(_adapter *adapter);
+void rtw_set_oper_ch(_adapter *adapter, u8 ch);
+u8 rtw_get_oper_bw(_adapter *adapter);
+void rtw_set_oper_bw(_adapter *adapter, u8 bw);
+u8 rtw_get_oper_choffset(_adapter *adapter);
+void rtw_set_oper_choffset(_adapter *adapter, u8 offset);
+u32 rtw_get_on_oper_ch_time(_adapter *adapter);
+u32 rtw_get_on_cur_ch_time(_adapter *adapter);
+
+void set_channel_bwmode(_adapter *padapter, unsigned char channel, unsigned char channel_offset, unsigned short bwmode);
+void SelectChannel(_adapter *padapter, unsigned char channel);
+void SetBWMode(_adapter *padapter, unsigned short bwmode, unsigned char channel_offset);
+
+unsigned int decide_wait_for_beacon_timeout(unsigned int bcn_interval);
+
+void write_cam(_adapter *padapter, u8 entry, u16 ctrl, u8 *mac, u8 *key);
+void clear_cam_entry(_adapter *padapter, u8 entry);
+
+void invalidate_cam_all(_adapter *padapter);
+void CAM_empty_entry(PADAPTER Adapter, u8 ucIndex);
+
+
+int allocate_fw_sta_entry(_adapter *padapter);
+void flush_all_cam_entry(_adapter *padapter);
+
+BOOLEAN IsLegal5GChannel(PADAPTER Adapter, u8 channel);
+
+void site_survey(_adapter *padapter);
+u8 collect_bss_info(_adapter *padapter, union recv_frame *precv_frame, WLAN_BSSID_EX *bssid);
+
+int get_bsstype(unsigned short capability);
+u8* get_my_bssid(WLAN_BSSID_EX *pnetwork);
+u16 get_beacon_interval(WLAN_BSSID_EX *bss);
+
+int is_client_associated_to_ap(_adapter *padapter);
+int is_client_associated_to_ibss(_adapter *padapter);
+int is_IBSS_empty(_adapter *padapter);
+
+unsigned char check_assoc_AP(u8 *pframe, uint len);
+
+int WMM_param_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs	pIE);
+#ifdef CONFIG_WFD
+int WFD_info_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs	pIE);
+#endif
+void WMMOnAssocRsp(_adapter *padapter);
+
+void HT_caps_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs pIE);
+void HT_info_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs pIE);
+void HTOnAssocRsp(_adapter *padapter);
+
+void ERP_IE_handler(_adapter *padapter, PNDIS_802_11_VARIABLE_IEs pIE);
+void VCS_update(_adapter *padapter, struct sta_info *psta);
+
+void update_beacon_info(_adapter *padapter, u8 *pframe, uint len, struct sta_info *psta);
+#ifdef CONFIG_DFS
+void process_csa_ie(_adapter *padapter, u8 *pframe, uint len);
+#endif //CONFIG_DFS
+void update_IOT_info(_adapter *padapter);
+void update_capinfo(PADAPTER Adapter, u16 updateCap);
+void update_wireless_mode(_adapter * padapter);
+void update_tx_basic_rate(_adapter *padapter, u8 modulation);
+void update_bmc_sta_support_rate(_adapter *padapter, u32 mac_id);
+int update_sta_support_rate(_adapter *padapter, u8* pvar_ie, uint var_ie_len, int cam_idx);
+
+//for sta/adhoc mode
+void update_sta_info(_adapter *padapter, struct sta_info *psta);
+unsigned int update_basic_rate(unsigned char *ptn, unsigned int ptn_sz);
+unsigned int update_supported_rate(unsigned char *ptn, unsigned int ptn_sz);
+unsigned int update_MSC_rate(struct HT_caps_element *pHT_caps);
+void Update_RA_Entry(_adapter *padapter, u32 mac_id);
+void set_sta_rate(_adapter *padapter, struct sta_info *psta);
+
+unsigned int receive_disconnect(_adapter *padapter, unsigned char *MacAddr, unsigned short reason);
+
+unsigned char get_highest_rate_idx(u32 mask);
+int support_short_GI(_adapter *padapter, struct HT_caps_element *pHT_caps);
+unsigned int is_ap_in_tkip(_adapter *padapter);
+
+
+void report_join_res(_adapter *padapter, int res);
+void report_survey_event(_adapter *padapter, union recv_frame *precv_frame);
+void report_surveydone_event(_adapter *padapter);
+void report_del_sta_event(_adapter *padapter, unsigned char* MacAddr, unsigned short reason);
+void report_add_sta_event(_adapter *padapter, unsigned char* MacAddr, int cam_idx);
+
+void beacon_timing_control(_adapter *padapter);
+extern u8 set_tx_beacon_cmd(_adapter*padapter);
+unsigned int setup_beacon_frame(_adapter *padapter, unsigned char *beacon_frame);
+void update_mgnt_tx_rate(_adapter *padapter, u8 rate);
+void update_mgntframe_attrib(_adapter *padapter, struct pkt_attrib *pattrib);
+void dump_mgntframe(_adapter *padapter, struct xmit_frame *pmgntframe);
+s32 dump_mgntframe_and_wait(_adapter *padapter, struct xmit_frame *pmgntframe, int timeout_ms);
+s32 dump_mgntframe_and_wait_ack(_adapter *padapter, struct xmit_frame *pmgntframe);
+
+#ifdef CONFIG_P2P
+void issue_probersp_p2p(_adapter *padapter, unsigned char *da);
+void issue_p2p_provision_request( _adapter *padapter, u8* pssid, u8 ussidlen, u8* pdev_raddr);
+void issue_p2p_GO_request(_adapter *padapter, u8* raddr);
+void issue_probereq_p2p(_adapter *padapter, u8 *da);
+int issue_probereq_p2p_ex(_adapter *adapter, u8 *da, int try_cnt, int wait_ms);
+void issue_p2p_invitation_response(_adapter *padapter, u8* raddr, u8 dialogToken, u8 success);
+void issue_p2p_invitation_request(_adapter *padapter, u8* raddr );
+#endif //CONFIG_P2P
+void issue_beacon(_adapter *padapter);
+void issue_probersp(_adapter *padapter, unsigned char *da, u8 is_valid_p2p_probereq);
+void issue_assocreq(_adapter *padapter);
+void issue_asocrsp(_adapter *padapter, unsigned short status, struct sta_info *pstat, int pkt_type);
+void issue_auth(_adapter *padapter, struct sta_info *psta, unsigned short status);
+void issue_probereq(_adapter *padapter, NDIS_802_11_SSID *pssid, u8 *da);
+s32 issue_probereq_ex(_adapter *padapter, NDIS_802_11_SSID *pssid, u8* da, int try_cnt, int wait_ms);
+int issue_nulldata(_adapter *padapter, unsigned char *da, unsigned int power_mode, int try_cnt, int wait_ms);
+int issue_qos_nulldata(_adapter *padapter, unsigned char *da, u16 tid, int try_cnt, int wait_ms);
+int issue_deauth(_adapter *padapter, unsigned char *da, unsigned short reason);
+int issue_deauth_ex(_adapter *padapter, u8 *da, unsigned short reason, int try_cnt, int wait_ms);
+void issue_action_spct_ch_switch(_adapter *padapter, u8 *ra, u8 new_ch, u8 ch_offset);
+void issue_action_BA(_adapter *padapter, unsigned char *raddr, unsigned char action, unsigned short status);
+#ifdef CONFIG_IEEE80211W
+void issue_action_SA_Query(_adapter *padapter, unsigned char *raddr, unsigned char action, unsigned short tid);
+#endif //CONFIG_IEEE80211W
+unsigned int send_delba(_adapter *padapter, u8 initiator, u8 *addr);
+unsigned int send_beacon(_adapter *padapter);
+
+void start_clnt_assoc(_adapter *padapter);
+void start_clnt_auth(_adapter* padapter);
+void start_clnt_join(_adapter* padapter);
+void start_create_ibss(_adapter* padapter);
+
+unsigned int OnAssocReq(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAssocRsp(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnProbeReq(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnProbeRsp(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int DoReserved(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnBeacon(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAtim(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnDisassoc(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAuth(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAuthClient(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnDeAuth(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAction(_adapter *padapter, union recv_frame *precv_frame);
+
+unsigned int on_action_spct(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAction_qos(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAction_dls(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAction_back(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int on_action_public(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAction_ht(_adapter *padapter, union recv_frame *precv_frame);
+#ifdef CONFIG_IEEE80211W
+unsigned int OnAction_sa_query(_adapter *padapter, union recv_frame *precv_frame);
+#endif //CONFIG_IEEE80211W
+unsigned int OnAction_wmm(_adapter *padapter, union recv_frame *precv_frame);
+unsigned int OnAction_p2p(_adapter *padapter, union recv_frame *precv_frame);
+
+
+void mlmeext_joinbss_event_callback(_adapter *padapter, int join_res);
+void mlmeext_sta_del_event_callback(_adapter *padapter);
+void mlmeext_sta_add_event_callback(_adapter *padapter, struct sta_info *psta);
+
+void linked_status_chk(_adapter *padapter);
+
+void survey_timer_hdl (_adapter *padapter);
+void link_timer_hdl (_adapter *padapter);
+void addba_timer_hdl(struct sta_info *psta);
+#ifdef CONFIG_IEEE80211W
+void sa_query_timer_hdl(_adapter *padapter);
+#endif //CONFIG_IEEE80211W
+//void reauth_timer_hdl(_adapter *padapter);
+//void reassoc_timer_hdl(_adapter *padapter);
+
+#define set_survey_timer(mlmeext, ms) \
+	do { \
+		/*DBG_871X("%s set_survey_timer(%p, %d)\n", __FUNCTION__, (mlmeext), (ms));*/ \
+		_set_timer(&(mlmeext)->survey_timer, (ms)); \
+	} while(0)
+
+#define set_link_timer(mlmeext, ms) \
+	do { \
+		/*DBG_871X("%s set_link_timer(%p, %d)\n", __FUNCTION__, (mlmeext), (ms));*/ \
+		_set_timer(&(mlmeext)->link_timer, (ms)); \
+	} while(0)
+#ifdef CONFIG_IEEE80211W
+#define set_sa_query_timer(mlmeext, ms) \
+	do { \
+		DBG_871X("%s set_sa_query_timer(%p, %d)\n", __FUNCTION__, (mlmeext), (ms)); \
+		_set_timer(&(mlmeext)->sa_query_timer, (ms)); \
+	} while(0)
+#endif //CONFIG_IEEE80211W
+extern int cckrates_included(unsigned char *rate, int ratelen);
+extern int cckratesonly_included(unsigned char *rate, int ratelen);
+
+extern void process_addba_req(_adapter *padapter, u8 *paddba_req, u8 *addr);
+
+extern void update_TSF(struct mlme_ext_priv *pmlmeext, u8 *pframe, uint len);
+extern void correct_TSF(_adapter *padapter, struct mlme_ext_priv *pmlmeext);
+
+
+#ifdef CONFIG_CONCURRENT_MODE
+ sint check_buddy_mlmeinfo_state(_adapter *padapter, u32 state);
+void concurrent_chk_joinbss_done(_adapter *padapter, int join_res);
+#endif //CONFIG_CONCURRENT_MODE
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+void	dc_SelectChannel(_adapter *padapter, unsigned char channel);
+void	dc_SetBWMode(_adapter *padapter, unsigned short bwmode, unsigned char channel_offset);
+void	dc_set_channel_bwmode_disconnect(_adapter *padapter);
+u8	dc_handle_join_request(_adapter *padapter);
+void	dc_handle_join_done(_adapter *padapter, u8 join_res);
+sint	dc_check_fwstate(_adapter *padapter, sint fw_state);
+u8	dc_handle_site_survey(_adapter *padapter);
+void	dc_report_survey_event(_adapter *padapter, union recv_frame *precv_frame);
+void	dc_set_channel_bwmode_survey_done(_adapter *padapter);
+void	dc_set_ap_channel_bandwidth(_adapter *padapter, u8 channel, u8 channel_offset, u8 bwmode);
+void	dc_resume_xmit(_adapter *padapter);
+u8	dc_check_xmit(_adapter *padapter);
+#endif
+
+int rtw_chk_start_clnt_join(_adapter *padapter);
+int rtw_get_ch_setting_union(_adapter *adapter, u8 *ch, u8 *bw, u8 *offset);
+
+struct cmd_hdl {
+	uint	parmsize;
+	u8 (*h2cfuns)(struct _ADAPTER *padapter, u8 *pbuf);
+};
+
+
+u8 read_macreg_hdl(_adapter *padapter, u8 *pbuf);
+u8 write_macreg_hdl(_adapter *padapter, u8 *pbuf);
+u8 read_bbreg_hdl(_adapter *padapter, u8 *pbuf);
+u8 write_bbreg_hdl(_adapter *padapter, u8 *pbuf);
+u8 read_rfreg_hdl(_adapter *padapter, u8 *pbuf);
+u8 write_rfreg_hdl(_adapter *padapter, u8 *pbuf);
+
+
+u8 NULL_hdl(_adapter *padapter, u8 *pbuf);
+u8 join_cmd_hdl(_adapter *padapter, u8 *pbuf);
+u8 disconnect_hdl(_adapter *padapter, u8 *pbuf);
+u8 createbss_hdl(_adapter *padapter, u8 *pbuf);
+u8 setopmode_hdl(_adapter *padapter, u8 *pbuf);
+u8 sitesurvey_cmd_hdl(_adapter *padapter, u8 *pbuf);
+u8 setauth_hdl(_adapter *padapter, u8 *pbuf);
+u8 setkey_hdl(_adapter *padapter, u8 *pbuf);
+u8 set_stakey_hdl(_adapter *padapter, u8 *pbuf);
+u8 set_assocsta_hdl(_adapter *padapter, u8 *pbuf);
+u8 del_assocsta_hdl(_adapter *padapter, u8 *pbuf);
+u8 add_ba_hdl(_adapter *padapter, unsigned char *pbuf);
+
+u8 mlme_evt_hdl(_adapter *padapter, unsigned char *pbuf);
+u8 h2c_msg_hdl(_adapter *padapter, unsigned char *pbuf);
+u8 tx_beacon_hdl(_adapter *padapter, unsigned char *pbuf);
+u8 set_ch_hdl(_adapter *padapter, u8 *pbuf);
+u8 set_chplan_hdl(_adapter *padapter, unsigned char *pbuf);
+u8 led_blink_hdl(_adapter *padapter, unsigned char *pbuf);
+u8 set_csa_hdl(_adapter *padapter, unsigned char *pbuf);	//Kurt: Handling DFS channel switch announcement ie.
+u8 tdls_hdl(_adapter *padapter, unsigned char *pbuf);
+
+
+#define GEN_DRV_CMD_HANDLER(size, cmd)	{size, &cmd ## _hdl},
+#define GEN_MLME_EXT_HANDLER(size, cmd)	{size, cmd},
+
+#ifdef _RTW_CMD_C_
+
+struct cmd_hdl wlancmds[] =
+{
+	GEN_DRV_CMD_HANDLER(0, NULL) /*0*/
+	GEN_DRV_CMD_HANDLER(0, NULL)
+	GEN_DRV_CMD_HANDLER(0, NULL)
+	GEN_DRV_CMD_HANDLER(0, NULL)
+	GEN_DRV_CMD_HANDLER(0, NULL)
+	GEN_DRV_CMD_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL) /*10*/
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct joinbss_parm), join_cmd_hdl) /*14*/
+	GEN_MLME_EXT_HANDLER(sizeof (struct disconnect_parm), disconnect_hdl)
+	GEN_MLME_EXT_HANDLER(sizeof (struct createbss_parm), createbss_hdl)
+	GEN_MLME_EXT_HANDLER(sizeof (struct setopmode_parm), setopmode_hdl)
+	GEN_MLME_EXT_HANDLER(sizeof (struct sitesurvey_parm), sitesurvey_cmd_hdl) /*18*/
+	GEN_MLME_EXT_HANDLER(sizeof (struct setauth_parm), setauth_hdl)
+	GEN_MLME_EXT_HANDLER(sizeof (struct setkey_parm), setkey_hdl) /*20*/
+	GEN_MLME_EXT_HANDLER(sizeof (struct set_stakey_parm), set_stakey_hdl)
+	GEN_MLME_EXT_HANDLER(sizeof (struct set_assocsta_parm), NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct del_assocsta_parm), NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct setstapwrstate_parm), NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct setbasicrate_parm), NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct getbasicrate_parm), NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct setdatarate_parm), NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct getdatarate_parm), NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct setphyinfo_parm), NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct getphyinfo_parm), NULL)  /*30*/
+	GEN_MLME_EXT_HANDLER(sizeof (struct setphy_parm), NULL)
+	GEN_MLME_EXT_HANDLER(sizeof (struct getphy_parm), NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)	/*40*/
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(sizeof(struct addBaReq_parm), add_ba_hdl)
+	GEN_MLME_EXT_HANDLER(sizeof(struct set_ch_parm), set_ch_hdl) /* 46 */
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL) /*50*/
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(0, NULL)
+	GEN_MLME_EXT_HANDLER(sizeof(struct Tx_Beacon_param), tx_beacon_hdl) /*55*/
+
+	GEN_MLME_EXT_HANDLER(0, mlme_evt_hdl) /*56*/
+	GEN_MLME_EXT_HANDLER(0, rtw_drvextra_cmd_hdl) /*57*/
+
+	GEN_MLME_EXT_HANDLER(0, h2c_msg_hdl) /*58*/
+	GEN_MLME_EXT_HANDLER(sizeof(struct SetChannelPlan_param), set_chplan_hdl) /*59*/
+	GEN_MLME_EXT_HANDLER(sizeof(struct LedBlink_param), led_blink_hdl) /*60*/
+	GEN_MLME_EXT_HANDLER(sizeof(struct SetChannelSwitch_param), set_csa_hdl) /*61*/
+	GEN_MLME_EXT_HANDLER(sizeof(struct TDLSoption_param), tdls_hdl) /*62*/
+};
+
+#endif
+
+struct C2HEvent_Header
+{
+
+#ifdef CONFIG_LITTLE_ENDIAN
+
+	unsigned int len:16;
+	unsigned int ID:8;
+	unsigned int seq:8;
+
+#elif defined(CONFIG_BIG_ENDIAN)
+
+	unsigned int seq:8;
+	unsigned int ID:8;
+	unsigned int len:16;
+
+#else
+
+#  error "Must be LITTLE or BIG Endian"
+
+#endif
+
+	unsigned int rsvd;
+
+};
+
+void rtw_dummy_event_callback(_adapter *adapter , u8 *pbuf);
+void rtw_fwdbg_event_callback(_adapter *adapter , u8 *pbuf);
+
+enum rtw_c2h_event
+{
+	GEN_EVT_CODE(_Read_MACREG)=0, /*0*/
+	GEN_EVT_CODE(_Read_BBREG),
+	GEN_EVT_CODE(_Read_RFREG),
+	GEN_EVT_CODE(_Read_EEPROM),
+	GEN_EVT_CODE(_Read_EFUSE),
+	GEN_EVT_CODE(_Read_CAM),			/*5*/
+	GEN_EVT_CODE(_Get_BasicRate),
+	GEN_EVT_CODE(_Get_DataRate),
+	GEN_EVT_CODE(_Survey),	 /*8*/
+	GEN_EVT_CODE(_SurveyDone),	 /*9*/
+
+	GEN_EVT_CODE(_JoinBss) , /*10*/
+	GEN_EVT_CODE(_AddSTA),
+	GEN_EVT_CODE(_DelSTA),
+	GEN_EVT_CODE(_AtimDone) ,
+	GEN_EVT_CODE(_TX_Report),
+	GEN_EVT_CODE(_CCX_Report),			/*15*/
+	GEN_EVT_CODE(_DTM_Report),
+	GEN_EVT_CODE(_TX_Rate_Statistics),
+	GEN_EVT_CODE(_C2HLBK),
+	GEN_EVT_CODE(_FWDBG),
+	GEN_EVT_CODE(_C2HFEEDBACK),               /*20*/
+	GEN_EVT_CODE(_ADDBA),
+	GEN_EVT_CODE(_C2HBCN),
+	GEN_EVT_CODE(_ReportPwrState),		//filen: only for PCIE, USB
+	GEN_EVT_CODE(_CloseRF),				//filen: only for PCIE, work around ASPM
+	MAX_C2HEVT
+};
+
+
+#ifdef _RTW_MLME_EXT_C_
+
+static struct fwevent wlanevents[] =
+{
+	{0, rtw_dummy_event_callback}, 	/*0*/
+	{0, NULL},
+	{0, NULL},
+	{0, NULL},
+	{0, NULL},
+	{0, NULL},
+	{0, NULL},
+	{0, NULL},
+	{0, &rtw_survey_event_callback},		/*8*/
+	{sizeof (struct surveydone_event), &rtw_surveydone_event_callback},	/*9*/
+
+	{0, &rtw_joinbss_event_callback},		/*10*/
+	{sizeof(struct stassoc_event), &rtw_stassoc_event_callback},
+	{sizeof(struct stadel_event), &rtw_stadel_event_callback},
+	{0, &rtw_atimdone_event_callback},
+	{0, rtw_dummy_event_callback},
+	{0, NULL},	/*15*/
+	{0, NULL},
+	{0, NULL},
+	{0, NULL},
+	{0, rtw_fwdbg_event_callback},
+	{0, NULL},	 /*20*/
+	{0, NULL},
+	{0, NULL},
+	{0, &rtw_cpwm_event_callback},
+};
+
+#endif//_RTL8192C_CMD_C_
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp.h
new file mode 100644
index 000000000000..06d43b5b6ec4
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp.h
@@ -0,0 +1,711 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_MP_H_
+#define _RTW_MP_H_
+
+#ifndef PLATFORM_WINDOWS
+//	00 - Success
+//	11 - Error
+#define STATUS_SUCCESS				(0x00000000L)
+#define STATUS_PENDING				(0x00000103L)
+
+#define STATUS_UNSUCCESSFUL			(0xC0000001L)
+#define STATUS_INSUFFICIENT_RESOURCES		(0xC000009AL)
+#define STATUS_NOT_SUPPORTED			(0xC00000BBL)
+
+#define NDIS_STATUS_SUCCESS			((NDIS_STATUS)STATUS_SUCCESS)
+#define NDIS_STATUS_PENDING			((NDIS_STATUS)STATUS_PENDING)
+#define NDIS_STATUS_NOT_RECOGNIZED		((NDIS_STATUS)0x00010001L)
+#define NDIS_STATUS_NOT_COPIED			((NDIS_STATUS)0x00010002L)
+#define NDIS_STATUS_NOT_ACCEPTED		((NDIS_STATUS)0x00010003L)
+#define NDIS_STATUS_CALL_ACTIVE			((NDIS_STATUS)0x00010007L)
+
+#define NDIS_STATUS_FAILURE			((NDIS_STATUS)STATUS_UNSUCCESSFUL)
+#define NDIS_STATUS_RESOURCES			((NDIS_STATUS)STATUS_INSUFFICIENT_RESOURCES)
+#define NDIS_STATUS_CLOSING			((NDIS_STATUS)0xC0010002L)
+#define NDIS_STATUS_BAD_VERSION			((NDIS_STATUS)0xC0010004L)
+#define NDIS_STATUS_BAD_CHARACTERISTICS		((NDIS_STATUS)0xC0010005L)
+#define NDIS_STATUS_ADAPTER_NOT_FOUND		((NDIS_STATUS)0xC0010006L)
+#define NDIS_STATUS_OPEN_FAILED			((NDIS_STATUS)0xC0010007L)
+#define NDIS_STATUS_DEVICE_FAILED		((NDIS_STATUS)0xC0010008L)
+#define NDIS_STATUS_MULTICAST_FULL		((NDIS_STATUS)0xC0010009L)
+#define NDIS_STATUS_MULTICAST_EXISTS		((NDIS_STATUS)0xC001000AL)
+#define NDIS_STATUS_MULTICAST_NOT_FOUND		((NDIS_STATUS)0xC001000BL)
+#define NDIS_STATUS_REQUEST_ABORTED		((NDIS_STATUS)0xC001000CL)
+#define NDIS_STATUS_RESET_IN_PROGRESS		((NDIS_STATUS)0xC001000DL)
+#define NDIS_STATUS_CLOSING_INDICATING		((NDIS_STATUS)0xC001000EL)
+#define NDIS_STATUS_NOT_SUPPORTED		((NDIS_STATUS)STATUS_NOT_SUPPORTED)
+#define NDIS_STATUS_INVALID_PACKET		((NDIS_STATUS)0xC001000FL)
+#define NDIS_STATUS_OPEN_LIST_FULL		((NDIS_STATUS)0xC0010010L)
+#define NDIS_STATUS_ADAPTER_NOT_READY		((NDIS_STATUS)0xC0010011L)
+#define NDIS_STATUS_ADAPTER_NOT_OPEN		((NDIS_STATUS)0xC0010012L)
+#define NDIS_STATUS_NOT_INDICATING		((NDIS_STATUS)0xC0010013L)
+#define NDIS_STATUS_INVALID_LENGTH		((NDIS_STATUS)0xC0010014L)
+#define NDIS_STATUS_INVALID_DATA		((NDIS_STATUS)0xC0010015L)
+#define NDIS_STATUS_BUFFER_TOO_SHORT		((NDIS_STATUS)0xC0010016L)
+#define NDIS_STATUS_INVALID_OID			((NDIS_STATUS)0xC0010017L)
+#define NDIS_STATUS_ADAPTER_REMOVED		((NDIS_STATUS)0xC0010018L)
+#define NDIS_STATUS_UNSUPPORTED_MEDIA		((NDIS_STATUS)0xC0010019L)
+#define NDIS_STATUS_GROUP_ADDRESS_IN_USE	((NDIS_STATUS)0xC001001AL)
+#define NDIS_STATUS_FILE_NOT_FOUND		((NDIS_STATUS)0xC001001BL)
+#define NDIS_STATUS_ERROR_READING_FILE		((NDIS_STATUS)0xC001001CL)
+#define NDIS_STATUS_ALREADY_MAPPED		((NDIS_STATUS)0xC001001DL)
+#define NDIS_STATUS_RESOURCE_CONFLICT		((NDIS_STATUS)0xC001001EL)
+#define NDIS_STATUS_NO_CABLE			((NDIS_STATUS)0xC001001FL)
+
+#define NDIS_STATUS_INVALID_SAP			((NDIS_STATUS)0xC0010020L)
+#define NDIS_STATUS_SAP_IN_USE			((NDIS_STATUS)0xC0010021L)
+#define NDIS_STATUS_INVALID_ADDRESS		((NDIS_STATUS)0xC0010022L)
+#define NDIS_STATUS_VC_NOT_ACTIVATED		((NDIS_STATUS)0xC0010023L)
+#define NDIS_STATUS_DEST_OUT_OF_ORDER		((NDIS_STATUS)0xC0010024L)  // cause 27
+#define NDIS_STATUS_VC_NOT_AVAILABLE		((NDIS_STATUS)0xC0010025L)  // cause 35,45
+#define NDIS_STATUS_CELLRATE_NOT_AVAILABLE	((NDIS_STATUS)0xC0010026L)  // cause 37
+#define NDIS_STATUS_INCOMPATABLE_QOS		((NDIS_STATUS)0xC0010027L)  // cause 49
+#define NDIS_STATUS_AAL_PARAMS_UNSUPPORTED	((NDIS_STATUS)0xC0010028L)  // cause 93
+#define NDIS_STATUS_NO_ROUTE_TO_DESTINATION	((NDIS_STATUS)0xC0010029L)  // cause 3
+#endif /* #ifndef PLATFORM_WINDOWS */
+
+#if 0
+#define MPT_NOOP			0
+#define MPT_READ_MAC_1BYTE		1
+#define MPT_READ_MAC_2BYTE		2
+#define MPT_READ_MAC_4BYTE		3
+#define MPT_WRITE_MAC_1BYTE		4
+#define MPT_WRITE_MAC_2BYTE		5
+#define MPT_WRITE_MAC_4BYTE		6
+#define MPT_READ_BB_CCK			7
+#define MPT_WRITE_BB_CCK		8
+#define MPT_READ_BB_OFDM		9
+#define MPT_WRITE_BB_OFDM		10
+#define MPT_READ_RF			11
+#define MPT_WRITE_RF			12
+#define MPT_READ_EEPROM_1BYTE		13
+#define MPT_WRITE_EEPROM_1BYTE		14
+#define MPT_READ_EEPROM_2BYTE		15
+#define MPT_WRITE_EEPROM_2BYTE		16
+#define MPT_SET_CSTHRESHOLD		21
+#define MPT_SET_INITGAIN		22
+#define MPT_SWITCH_BAND			23
+#define MPT_SWITCH_CHANNEL		24
+#define MPT_SET_DATARATE		25
+#define MPT_SWITCH_ANTENNA		26
+#define MPT_SET_TX_POWER		27
+#define MPT_SET_CONT_TX			28
+#define MPT_SET_SINGLE_CARRIER		29
+#define MPT_SET_CARRIER_SUPPRESSION	30
+#define MPT_GET_RATE_TABLE		31
+#define MPT_READ_TSSI			32
+#define MPT_GET_THERMAL_METER		33
+#endif
+
+#define MAX_MP_XMITBUF_SZ 	2048
+#define NR_MP_XMITFRAME		8
+
+struct mp_xmit_frame
+{
+	_list	list;
+
+	struct pkt_attrib attrib;
+
+	_pkt *pkt;
+
+	int frame_tag;
+
+	_adapter *padapter;
+
+#ifdef CONFIG_USB_HCI
+
+	//insert urb, irp, and irpcnt info below...
+	//max frag_cnt = 8
+
+	u8 *mem_addr;
+	u32 sz[8];
+
+#if defined(PLATFORM_OS_XP) || defined(PLATFORM_LINUX)
+	PURB pxmit_urb[8];
+#endif
+
+#ifdef PLATFORM_OS_XP
+	PIRP pxmit_irp[8];
+#endif
+
+	u8 bpending[8];
+	sint ac_tag[8];
+	sint last[8];
+	uint irpcnt;
+	uint fragcnt;
+#endif /* CONFIG_USB_HCI */
+
+	uint mem[(MAX_MP_XMITBUF_SZ >> 2)];
+};
+
+struct mp_wiparam
+{
+	u32 bcompleted;
+	u32 act_type;
+	u32 io_offset;
+	u32 io_value;
+};
+
+typedef void(*wi_act_func)(void* padapter);
+
+#ifdef PLATFORM_WINDOWS
+struct mp_wi_cntx
+{
+	u8 bmpdrv_unload;
+
+	// Work Item
+	NDIS_WORK_ITEM mp_wi;
+	NDIS_EVENT mp_wi_evt;
+	_lock mp_wi_lock;
+	u8 bmp_wi_progress;
+	wi_act_func curractfunc;
+	// Variable needed in each implementation of CurrActFunc.
+	struct mp_wiparam param;
+};
+#endif
+
+struct mp_tx
+{
+	u8 stop;
+	u32 count, sended;
+	u8 payload;
+	struct pkt_attrib attrib;
+	struct tx_desc desc;
+	u8 *pallocated_buf;
+	u8 *buf;
+	u32 buf_size, write_size;
+	_thread_hdl_  PktTxThread;
+};
+
+//#if (MP_DRIVER == 1)
+#if defined(CONFIG_RTL8192C) || defined(CONFIG_RTL8192D) || defined(CONFIG_RTL8723A) || defined(CONFIG_RTL8188E)
+#ifdef CONFIG_RTL8192C
+#include <Hal8192CPhyCfg.h>
+#endif
+#ifdef CONFIG_RTL8192D
+#include <Hal8192DPhyCfg.h>
+#endif
+#ifdef CONFIG_RTL8723A
+#include <Hal8723APhyCfg.h>
+#endif
+#ifdef CONFIG_RTL8188E
+#include <rtl8188e_hal.h>
+#endif
+#define MP_MAX_LINES		1000
+#define MP_MAX_LINES_BYTES	256
+#define u1Byte u8
+#define s1Byte s8
+#define u4Byte u32
+#define s4Byte s32
+typedef VOID (*MPT_WORK_ITEM_HANDLER)(IN PVOID Adapter);
+typedef struct _MPT_CONTEXT
+{
+	// Indicate if we have started Mass Production Test.
+	BOOLEAN			bMassProdTest;
+
+	// Indicate if the driver is unloading or unloaded.
+	BOOLEAN			bMptDrvUnload;
+
+	/* 8190 PCI does not support NDIS_WORK_ITEM. */
+	// Work Item for Mass Production Test.
+	//NDIS_WORK_ITEM	MptWorkItem;
+//	RT_WORK_ITEM		MptWorkItem;
+	// Event used to sync the case unloading driver and MptWorkItem is still in progress.
+//	NDIS_EVENT		MptWorkItemEvent;
+	// To protect the following variables.
+//	NDIS_SPIN_LOCK		MptWorkItemSpinLock;
+	// Indicate a MptWorkItem is scheduled and not yet finished.
+	BOOLEAN			bMptWorkItemInProgress;
+	// An instance which implements function and context of MptWorkItem.
+	MPT_WORK_ITEM_HANDLER	CurrMptAct;
+
+	// 1=Start, 0=Stop from UI.
+	ULONG			MptTestStart;
+	// _TEST_MODE, defined in MPT_Req2.h
+	ULONG			MptTestItem;
+	// Variable needed in each implementation of CurrMptAct.
+	ULONG			MptActType; 	// Type of action performed in CurrMptAct.
+	// The Offset of IO operation is depend of MptActType.
+	ULONG			MptIoOffset;
+	// The Value of IO operation is depend of MptActType.
+	ULONG			MptIoValue;
+	// The RfPath of IO operation is depend of MptActType.
+	ULONG			MptRfPath;
+
+	WIRELESS_MODE		MptWirelessModeToSw;	// Wireless mode to switch.
+	u8			MptChannelToSw; 	// Channel to switch.
+	u8			MptInitGainToSet; 	// Initial gain to set.
+	//ULONG			bMptAntennaA; 		// TRUE if we want to use antenna A.
+	ULONG			MptBandWidth;		// bandwidth to switch.
+	ULONG			MptRateIndex;		// rate index.
+	// Register value kept for Single Carrier Tx test.
+	u8			btMpCckTxPower;
+	// Register value kept for Single Carrier Tx test.
+	u8			btMpOfdmTxPower;
+	// For MP Tx Power index
+	u8			TxPwrLevel[2];	// rf-A, rf-B
+
+	// Content of RCR Regsiter for Mass Production Test.
+	ULONG			MptRCR;
+	// TRUE if we only receive packets with specific pattern.
+	BOOLEAN			bMptFilterPattern;
+	// Rx OK count, statistics used in Mass Production Test.
+	ULONG			MptRxOkCnt;
+	// Rx CRC32 error count, statistics used in Mass Production Test.
+	ULONG			MptRxCrcErrCnt;
+
+	BOOLEAN			bCckContTx;	// TRUE if we are in CCK Continuous Tx test.
+	BOOLEAN			bOfdmContTx;	// TRUE if we are in OFDM Continuous Tx test.
+	BOOLEAN			bStartContTx; 	// TRUE if we have start Continuous Tx test.
+	// TRUE if we are in Single Carrier Tx test.
+	BOOLEAN			bSingleCarrier;
+	// TRUE if we are in Carrier Suppression Tx Test.
+	BOOLEAN			bCarrierSuppression;
+	//TRUE if we are in Single Tone Tx test.
+	BOOLEAN			bSingleTone;
+
+	// ACK counter asked by K.Y..
+	BOOLEAN			bMptEnableAckCounter;
+	ULONG			MptAckCounter;
+
+	// SD3 Willis For 8192S to save 1T/2T RF table for ACUT	Only fro ACUT delete later ~~~!
+	//s1Byte		BufOfLines[2][MAX_LINES_HWCONFIG_TXT][MAX_BYTES_LINE_HWCONFIG_TXT];
+	//s1Byte			BufOfLines[2][MP_MAX_LINES][MP_MAX_LINES_BYTES];
+	//s4Byte			RfReadLine[2];
+
+	u8		APK_bound[2];	//for APK	path A/path B
+	BOOLEAN		bMptIndexEven;
+
+	u8		backup0xc50;
+	u8		backup0xc58;
+	u8		backup0xc30;
+}MPT_CONTEXT, *PMPT_CONTEXT;
+#endif
+//#endif
+
+/* E-Fuse */
+#ifdef CONFIG_RTL8192D
+#define EFUSE_MAP_SIZE		255
+#endif
+#ifdef CONFIG_RTL8192C
+#define EFUSE_MAP_SIZE		128
+#endif
+#ifdef CONFIG_RTL8723A
+#define EFUSE_MAP_SIZE		256
+#endif
+#ifdef CONFIG_RTL8188E
+#define EFUSE_MAP_SIZE		256
+#endif
+#define EFUSE_MAX_SIZE		512
+
+/* end of E-Fuse */
+
+//#define RTPRIV_IOCTL_MP 					( SIOCIWFIRSTPRIV + 0x17)
+enum {
+	WRITE_REG = 1,
+	READ_REG,
+	WRITE_RF,
+	READ_RF,
+	MP_START,
+	MP_STOP,
+	MP_RATE,
+	MP_CHANNEL,
+	MP_BANDWIDTH,
+	MP_TXPOWER,
+	MP_ANT_TX,
+	MP_ANT_RX,
+	MP_CTX,
+	MP_QUERY,
+	MP_ARX,
+	MP_PSD,
+	MP_PWRTRK,
+	MP_THER,
+	MP_IOCTL,
+	EFUSE_GET,
+	EFUSE_SET,
+	MP_RESET_STATS,
+	MP_DUMP,
+	MP_PHYPARA,
+	MP_NULL,
+};
+
+struct mp_priv
+{
+	_adapter *papdater;
+
+	//Testing Flag
+	u32 mode;//0 for normal type packet, 1 for loopback packet (16bytes TXCMD)
+
+	u32 prev_fw_state;
+
+	//OID cmd handler
+	struct mp_wiparam workparam;
+//	u8 act_in_progress;
+
+	//Tx Section
+	u8 TID;
+	u32 tx_pktcount;
+	struct mp_tx tx;
+
+	//Rx Section
+	u32 rx_pktcount;
+	u32 rx_crcerrpktcount;
+	u32 rx_pktloss;
+
+	struct recv_stat rxstat;
+
+	//RF/BB relative
+	u8 channel;
+	u8 bandwidth;
+	u8 prime_channel_offset;
+	u8 txpoweridx;
+	u8 txpoweridx_b;
+	u8 rateidx;
+	u32 preamble;
+//	u8 modem;
+	u32 CrystalCap;
+//	u32 curr_crystalcap;
+
+	u16 antenna_tx;
+	u16 antenna_rx;
+//	u8 curr_rfpath;
+
+	u8 check_mp_pkt;
+
+//	uint ForcedDataRate;
+
+	struct wlan_network mp_network;
+	NDIS_802_11_MAC_ADDRESS network_macaddr;
+
+#ifdef PLATFORM_WINDOWS
+	u32 rx_testcnt;
+	u32 rx_testcnt1;
+	u32 rx_testcnt2;
+	u32 tx_testcnt;
+	u32 tx_testcnt1;
+
+	struct mp_wi_cntx wi_cntx;
+
+	u8 h2c_result;
+	u8 h2c_seqnum;
+	u16 h2c_cmdcode;
+	u8 h2c_resp_parambuf[512];
+	_lock h2c_lock;
+	_lock wkitm_lock;
+	u32 h2c_cmdcnt;
+	NDIS_EVENT h2c_cmd_evt;
+	NDIS_EVENT c2h_set;
+	NDIS_EVENT h2c_clr;
+	NDIS_EVENT cpwm_int;
+
+	NDIS_EVENT scsir_full_evt;
+	NDIS_EVENT scsiw_empty_evt;
+#endif
+
+	u8 *pallocated_mp_xmitframe_buf;
+	u8 *pmp_xmtframe_buf;
+	_queue free_mp_xmitqueue;
+	u32 free_mp_xmitframe_cnt;
+
+	MPT_CONTEXT MptCtx;
+};
+
+typedef struct _IOCMD_STRUCT_ {
+	u8	cmdclass;
+	u16	value;
+	u8	index;
+}IOCMD_STRUCT;
+
+struct rf_reg_param {
+	u32 path;
+	u32 offset;
+	u32 value;
+};
+
+struct bb_reg_param {
+	u32 offset;
+	u32 value;
+};
+//=======================================================================
+
+#define LOWER 	_TRUE
+#define RAISE	_FALSE
+
+/* Hardware Registers */
+#if 0
+#if 0
+#define IOCMD_CTRL_REG			0x102502C0
+#define IOCMD_DATA_REG			0x102502C4
+#else
+#define IOCMD_CTRL_REG			0x10250370
+#define IOCMD_DATA_REG			0x10250374
+#endif
+
+#define IOCMD_GET_THERMAL_METER		0xFD000028
+
+#define IOCMD_CLASS_BB_RF		0xF0
+#define IOCMD_BB_READ_IDX		0x00
+#define IOCMD_BB_WRITE_IDX		0x01
+#define IOCMD_RF_READ_IDX		0x02
+#define IOCMD_RF_WRIT_IDX		0x03
+#endif
+#define BB_REG_BASE_ADDR		0x800
+
+/* MP variables */
+#if 0
+#define _2MAC_MODE_	0
+#define _LOOPBOOK_MODE_	1
+#endif
+typedef enum _MP_MODE_ {
+	MP_OFF,
+	MP_ON,
+	MP_ERR,
+	MP_CONTINUOUS_TX,
+	MP_SINGLE_CARRIER_TX,
+	MP_CARRIER_SUPPRISSION_TX,
+	MP_SINGLE_TONE_TX,
+	MP_PACKET_TX,
+	MP_PACKET_RX
+} MP_MODE;
+
+#ifdef CONFIG_RTL8192C
+#define RF_PATH_A 	RF_PATH_A
+#define RF_PATH_B 	RF_PATH_B
+#define RF_PATH_C 	RF_PATH_C
+#define RF_PATH_D 	RF_PATH_D
+
+#define MAX_RF_PATH_NUMS	RF_PATH_MAX
+#else
+#define RF_PATH_A 	0
+#define RF_PATH_B 	1
+#define RF_PATH_C 	2
+#define RF_PATH_D 	3
+
+#define MAX_RF_PATH_NUMS	2
+#endif
+
+extern u8 mpdatarate[NumRates];
+
+/* MP set force data rate base on the definition. */
+typedef enum _MPT_RATE_INDEX
+{
+	/* CCK rate. */
+	MPT_RATE_1M,	/* 0 */
+	MPT_RATE_2M,
+	MPT_RATE_55M,
+	MPT_RATE_11M,	/* 3 */
+
+	/* OFDM rate. */
+	MPT_RATE_6M,	/* 4 */
+	MPT_RATE_9M,
+	MPT_RATE_12M,
+	MPT_RATE_18M,
+	MPT_RATE_24M,
+	MPT_RATE_36M,
+	MPT_RATE_48M,
+	MPT_RATE_54M,	/* 11 */
+
+	/* HT rate. */
+	MPT_RATE_MCS0,	/* 12 */
+	MPT_RATE_MCS1,
+	MPT_RATE_MCS2,
+	MPT_RATE_MCS3,
+	MPT_RATE_MCS4,
+	MPT_RATE_MCS5,
+	MPT_RATE_MCS6,
+	MPT_RATE_MCS7,	/* 19 */
+	MPT_RATE_MCS8,
+	MPT_RATE_MCS9,
+	MPT_RATE_MCS10,
+	MPT_RATE_MCS11,
+	MPT_RATE_MCS12,
+	MPT_RATE_MCS13,
+	MPT_RATE_MCS14,
+	MPT_RATE_MCS15,	/* 27 */
+	MPT_RATE_LAST
+}MPT_RATE_E, *PMPT_RATE_E;
+
+#if 0
+// Represent Channel Width in HT Capabilities
+typedef enum _HT_CHANNEL_WIDTH {
+	HT_CHANNEL_WIDTH_20 = 0,
+	HT_CHANNEL_WIDTH_40 = 1,
+}HT_CHANNEL_WIDTH, *PHT_CHANNEL_WIDTH;
+#endif
+
+#define MAX_TX_PWR_INDEX_N_MODE 64	// 0x3F
+
+typedef enum _POWER_MODE_ {
+	POWER_LOW = 0,
+	POWER_NORMAL
+}POWER_MODE;
+
+
+#define RX_PKT_BROADCAST	1
+#define RX_PKT_DEST_ADDR	2
+#define RX_PKT_PHY_MATCH	3
+
+#if 0
+#define RPTMaxCount 0x000FFFFF;
+
+// parameter 1 : BitMask
+// 	bit 0  : OFDM PPDU
+//	bit 1  : OFDM False Alarm
+//	bit 2  : OFDM MPDU OK
+//	bit 3  : OFDM MPDU Fail
+//	bit 4  : CCK PPDU
+//	bit 5  : CCK False Alarm
+//	bit 6  : CCK MPDU ok
+//	bit 7  : CCK MPDU fail
+//	bit 8  : HT PPDU counter
+//	bit 9  : HT false alarm
+//	bit 10 : HT MPDU total
+//	bit 11 : HT MPDU OK
+//	bit 12 : HT MPDU fail
+//	bit 15 : RX full drop
+typedef enum _RXPHY_BITMASK_
+{
+	OFDM_PPDU_BIT = 0,
+	OFDM_FALSE_BIT,
+	OFDM_MPDU_OK_BIT,
+	OFDM_MPDU_FAIL_BIT,
+	CCK_PPDU_BIT,
+	CCK_FALSE_BIT,
+	CCK_MPDU_OK_BIT,
+	CCK_MPDU_FAIL_BIT,
+	HT_PPDU_BIT,
+	HT_FALSE_BIT,
+	HT_MPDU_BIT,
+	HT_MPDU_OK_BIT,
+	HT_MPDU_FAIL_BIT,
+} RXPHY_BITMASK;
+#endif
+
+typedef enum _ENCRY_CTRL_STATE_ {
+	HW_CONTROL,		//hw encryption& decryption
+	SW_CONTROL,		//sw encryption& decryption
+	HW_ENCRY_SW_DECRY,	//hw encryption & sw decryption
+	SW_ENCRY_HW_DECRY	//sw encryption & hw decryption
+}ENCRY_CTRL_STATE;
+
+typedef enum _OFDM_TX_MODE {
+	OFDM_ALL_OFF		= 0,
+	OFDM_ContinuousTx	= 1,
+	OFDM_SingleCarrier	= 2,
+	OFDM_SingleTone 	= 4,
+} OFDM_TX_MODE;
+
+//=======================================================================
+//extern struct mp_xmit_frame *alloc_mp_xmitframe(struct mp_priv *pmp_priv);
+//extern int free_mp_xmitframe(struct xmit_priv *pxmitpriv, struct mp_xmit_frame *pmp_xmitframe);
+
+extern s32 init_mp_priv(PADAPTER padapter);
+extern void free_mp_priv(struct mp_priv *pmp_priv);
+extern s32 MPT_InitializeAdapter(PADAPTER padapter, u8 Channel);
+extern void MPT_DeInitAdapter(PADAPTER padapter);
+extern s32 mp_start_test(PADAPTER padapter);
+extern void mp_stop_test(PADAPTER padapter);
+
+//=======================================================================
+//extern void	IQCalibrateBcut(PADAPTER pAdapter);
+
+//extern u32	bb_reg_read(PADAPTER Adapter, u16 offset);
+//extern u8	bb_reg_write(PADAPTER Adapter, u16 offset, u32 value);
+//extern u32	rf_reg_read(PADAPTER Adapter, u8 path, u8 offset);
+//extern u8	rf_reg_write(PADAPTER Adapter, u8 path, u8 offset, u32 value);
+
+//extern u32	get_bb_reg(PADAPTER Adapter, u16 offset, u32 bitmask);
+//extern u8	set_bb_reg(PADAPTER Adapter, u16 offset, u32 bitmask, u32 value);
+//extern u32	get_rf_reg(PADAPTER Adapter, u8 path, u8 offset, u32 bitmask);
+//extern u8	set_rf_reg(PADAPTER Adapter, u8 path, u8 offset, u32 bitmask, u32 value);
+
+extern u32 _read_rfreg(PADAPTER padapter, u8 rfpath, u32 addr, u32 bitmask);
+extern void _write_rfreg(PADAPTER padapter, u8 rfpath, u32 addr, u32 bitmask, u32 val);
+
+extern u32 read_macreg(_adapter *padapter, u32 addr, u32 sz);
+extern void write_macreg(_adapter *padapter, u32 addr, u32 val, u32 sz);
+extern u32 read_bbreg(_adapter *padapter, u32 addr, u32 bitmask);
+extern void write_bbreg(_adapter *padapter, u32 addr, u32 bitmask, u32 val);
+extern u32 read_rfreg(PADAPTER padapter, u8 rfpath, u32 addr);
+extern void write_rfreg(PADAPTER padapter, u8 rfpath, u32 addr, u32 val);
+
+extern void	SetChannel(PADAPTER pAdapter);
+extern void	SetBandwidth(PADAPTER pAdapter);
+extern void	SetTxPower(PADAPTER pAdapter);
+extern void	SetAntennaPathPower(PADAPTER pAdapter);
+//extern void	SetTxAGCOffset(PADAPTER pAdapter, u32 ulTxAGCOffset);
+extern void	SetDataRate(PADAPTER pAdapter);
+
+extern void	SetAntenna(PADAPTER pAdapter);
+
+//extern void	SetCrystalCap(PADAPTER pAdapter);
+
+extern s32	SetThermalMeter(PADAPTER pAdapter, u8 target_ther);
+extern void	GetThermalMeter(PADAPTER pAdapter, u8 *value);
+
+extern void	SetContinuousTx(PADAPTER pAdapter, u8 bStart);
+extern void	SetSingleCarrierTx(PADAPTER pAdapter, u8 bStart);
+extern void	SetSingleToneTx(PADAPTER pAdapter, u8 bStart);
+extern void	SetCarrierSuppressionTx(PADAPTER pAdapter, u8 bStart);
+
+extern void	fill_txdesc_for_mp(PADAPTER padapter, struct tx_desc *ptxdesc);
+extern void	SetPacketTx(PADAPTER padapter);
+extern void	SetPacketRx(PADAPTER pAdapter, u8 bStartRx);
+
+extern void	ResetPhyRxPktCount(PADAPTER pAdapter);
+extern u32	GetPhyRxPktReceived(PADAPTER pAdapter);
+extern u32	GetPhyRxPktCRC32Error(PADAPTER pAdapter);
+
+extern s32	SetPowerTracking(PADAPTER padapter, u8 enable);
+extern void	GetPowerTracking(PADAPTER padapter, u8 *enable);
+
+extern u32	mp_query_psd(PADAPTER pAdapter, u8 *data);
+
+
+extern void Hal_SetAntenna(PADAPTER pAdapter);
+extern void Hal_SetBandwidth(PADAPTER pAdapter);
+
+extern void Hal_SetTxPower(PADAPTER pAdapter);
+extern void Hal_SetCarrierSuppressionTx(PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetSingleToneTx ( PADAPTER pAdapter , u8 bStart );
+extern void Hal_SetSingleCarrierTx (PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetContinuousTx (PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetBandwidth(PADAPTER pAdapter);
+
+extern void Hal_SetDataRate(PADAPTER pAdapter);
+extern void Hal_SetChannel(PADAPTER pAdapter);
+extern void Hal_SetAntennaPathPower(PADAPTER pAdapter);
+extern s32 Hal_SetThermalMeter(PADAPTER pAdapter, u8 target_ther);
+extern s32 Hal_SetPowerTracking(PADAPTER padapter, u8 enable);
+extern void Hal_GetPowerTracking(PADAPTER padapter, u8 * enable);
+extern void Hal_GetThermalMeter(PADAPTER pAdapter, u8 *value);
+extern void Hal_mpt_SwitchRfSetting(PADAPTER pAdapter);
+extern void Hal_MPT_CCKTxPowerAdjust(PADAPTER Adapter, BOOLEAN bInCH14);
+extern void Hal_MPT_CCKTxPowerAdjustbyIndex(PADAPTER pAdapter, BOOLEAN beven);
+extern void Hal_SetCCKTxPower(PADAPTER pAdapter, u8 * TxPower);
+extern void Hal_SetOFDMTxPower(PADAPTER pAdapter, u8 * TxPower);
+extern void Hal_TriggerRFThermalMeter(PADAPTER pAdapter);
+extern u8 Hal_ReadRFThermalMeter(PADAPTER pAdapter);
+extern void Hal_SetCCKContinuousTx(PADAPTER pAdapter, u8 bStart);
+extern void Hal_SetOFDMContinuousTx(PADAPTER pAdapter, u8 bStart);
+extern void Hal_ProSetCrystalCap (PADAPTER pAdapter , u32 CrystalCapVal);
+
+#endif //_RTW_MP_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp_ioctl.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp_ioctl.h
new file mode 100644
index 000000000000..3016a9c68a22
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp_ioctl.h
@@ -0,0 +1,595 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_MP_IOCTL_H_
+#define _RTW_MP_IOCTL_H_
+
+//#include <drv_conf.h>
+//#include <osdep_service.h>
+#include <drv_types.h>
+#include <mp_custom_oid.h>
+#include <rtw_ioctl.h>
+#include <rtw_ioctl_rtl.h>
+#include <rtw_efuse.h>
+#include <rtw_mp.h>
+
+#if 0
+#define TESTFWCMDNUMBER			1000000
+#define TEST_H2CINT_WAIT_TIME		500
+#define TEST_C2HINT_WAIT_TIME		500
+#define HCI_TEST_SYSCFG_HWMASK		1
+#define _BUSCLK_40M			(4 << 2)
+#endif
+//------------------------------------------------------------------------------
+typedef struct CFG_DBG_MSG_STRUCT {
+	u32 DebugLevel;
+	u32 DebugComponent_H32;
+	u32 DebugComponent_L32;
+}CFG_DBG_MSG_STRUCT,*PCFG_DBG_MSG_STRUCT;
+
+typedef struct _RW_REG {
+	u32 offset;
+	u32 width;
+	u32 value;
+}mp_rw_reg,RW_Reg, *pRW_Reg;
+
+//for OID_RT_PRO_READ16_EEPROM & OID_RT_PRO_WRITE16_EEPROM
+typedef struct _EEPROM_RW_PARAM {
+	u32 offset;
+	u16 value;
+}eeprom_rw_param,EEPROM_RWParam, *pEEPROM_RWParam;
+
+typedef struct _EFUSE_ACCESS_STRUCT_ {
+	u16	start_addr;
+	u16	cnts;
+	u8	data[0];
+}EFUSE_ACCESS_STRUCT, *PEFUSE_ACCESS_STRUCT;
+
+typedef struct _BURST_RW_REG {
+	u32 offset;
+	u32 len;
+	u8 Data[256];
+}burst_rw_reg,Burst_RW_Reg, *pBurst_RW_Reg;
+
+typedef struct _USB_VendorReq{
+	u8	bRequest;
+	u16	wValue;
+	u16	wIndex;
+	u16	wLength;
+	u8	u8Dir;//0:OUT, 1:IN
+	u8	u8InData;
+}usb_vendor_req, USB_VendorReq, *pUSB_VendorReq;
+
+typedef struct _DR_VARIABLE_STRUCT_ {
+	u8 offset;
+	u32 variable;
+}DR_VARIABLE_STRUCT;
+
+//int mp_start_joinbss(_adapter *padapter, NDIS_802_11_SSID *pssid);
+
+//void _irqlevel_changed_(_irqL *irqlevel, /*BOOLEAN*/unsigned char bLower);
+#ifdef PLATFORM_OS_XP
+static void _irqlevel_changed_(_irqL *irqlevel, u8 bLower)
+{
+
+	if (bLower == LOWER) {
+		*irqlevel = KeGetCurrentIrql();
+
+		if (*irqlevel > PASSIVE_LEVEL) {
+			KeLowerIrql(PASSIVE_LEVEL);
+		}
+	} else {
+		if (KeGetCurrentIrql() == PASSIVE_LEVEL) {
+			KeRaiseIrql(DISPATCH_LEVEL, irqlevel);
+		}
+	}
+
+}
+#else
+#define _irqlevel_changed_(a,b)
+#endif
+
+//oid_rtl_seg_81_80_00
+NDIS_STATUS oid_rt_pro_set_data_rate_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_start_test_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_stop_test_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_channel_direct_call_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_antenna_bb_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_tx_power_control_hdl(struct oid_par_priv* poid_par_priv);
+//oid_rtl_seg_81_80_20
+NDIS_STATUS oid_rt_pro_query_tx_packet_sent_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_query_rx_packet_received_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_query_rx_packet_crc32_error_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_pro_reset_tx_packet_sent_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_reset_rx_packet_received_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_modulation_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_pro_set_continuous_tx_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_single_carrier_tx_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_carrier_suppression_tx_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_single_tone_tx_hdl(struct oid_par_priv* poid_par_priv);
+
+
+//oid_rtl_seg_81_87
+NDIS_STATUS oid_rt_pro_write_bb_reg_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_read_bb_reg_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_pro_write_rf_reg_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_read_rf_reg_hdl(struct oid_par_priv* poid_par_priv);
+
+
+//oid_rtl_seg_81_85
+NDIS_STATUS oid_rt_wireless_mode_hdl(struct oid_par_priv* poid_par_priv);
+
+
+// oid_rtl_seg_87_11_00
+NDIS_STATUS oid_rt_pro8711_join_bss_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_read_register_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_write_register_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_burst_read_register_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_burst_write_register_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_write_txcmd_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_read16_eeprom_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_write16_eeprom_hdl (struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro8711_wi_poll_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro8711_pkt_loss_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_rd_attrib_mem_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_wr_attrib_mem_hdl (struct oid_par_priv* poid_par_priv);
+NDIS_STATUS  oid_rt_pro_set_rf_intfs_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_poll_rx_status_hdl(struct oid_par_priv* poid_par_priv);
+// oid_rtl_seg_87_11_20
+NDIS_STATUS oid_rt_pro_cfg_debug_message_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_data_rate_ex_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_basic_rate_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_read_tssi_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_power_tracking_hdl(struct oid_par_priv* poid_par_priv);
+//oid_rtl_seg_87_11_50
+NDIS_STATUS oid_rt_pro_qry_pwrstate_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_pwrstate_hdl(struct oid_par_priv* poid_par_priv);
+//oid_rtl_seg_87_11_F0
+NDIS_STATUS oid_rt_pro_h2c_set_rate_table_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_h2c_get_rate_table_hdl(struct oid_par_priv* poid_par_priv);
+
+
+//oid_rtl_seg_87_12_00
+NDIS_STATUS oid_rt_pro_encryption_ctrl_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_add_sta_info_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_dele_sta_info_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_query_dr_variable_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_rx_packet_type_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_pro_read_efuse_hdl(struct oid_par_priv *poid_par_priv);
+NDIS_STATUS oid_rt_pro_write_efuse_hdl(struct oid_par_priv *poid_par_priv);
+NDIS_STATUS oid_rt_pro_rw_efuse_pgpkt_hdl(struct oid_par_priv *poid_par_priv);
+NDIS_STATUS oid_rt_get_efuse_current_size_hdl(struct oid_par_priv *poid_par_priv);
+NDIS_STATUS oid_rt_pro_efuse_hdl(struct oid_par_priv *poid_par_priv);
+NDIS_STATUS oid_rt_pro_efuse_map_hdl(struct oid_par_priv *poid_par_priv);
+
+NDIS_STATUS oid_rt_set_bandwidth_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_set_crystal_cap_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_set_rx_packet_type_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_efuse_max_size_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_pro_set_tx_agc_offset_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_pro_set_pkt_test_mode_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_get_thermal_meter_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_reset_phy_rx_packet_count_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_phy_rx_packet_received_hdl(struct oid_par_priv* poid_par_priv);
+NDIS_STATUS oid_rt_get_phy_rx_packet_crc32_error_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_set_power_down_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_get_power_mode_hdl(struct oid_par_priv* poid_par_priv);
+
+NDIS_STATUS oid_rt_pro_trigger_gpio_hdl(struct oid_par_priv *poid_par_priv);
+
+#ifdef _RTW_MP_IOCTL_C_
+
+const struct oid_obj_priv oid_rtl_seg_81_80_00[] =
+{
+	{1, &oid_null_function},			//0x00	OID_RT_PRO_RESET_DUT
+	{1, &oid_rt_pro_set_data_rate_hdl},		//0x01
+	{1, &oid_rt_pro_start_test_hdl},		//0x02
+	{1, &oid_rt_pro_stop_test_hdl},			//0x03
+	{1, &oid_null_function},			//0x04	OID_RT_PRO_SET_PREAMBLE
+	{1, &oid_null_function},			//0x05	OID_RT_PRO_SET_SCRAMBLER
+	{1, &oid_null_function},			//0x06	OID_RT_PRO_SET_FILTER_BB
+	{1, &oid_null_function},			//0x07	OID_RT_PRO_SET_MANUAL_DIVERSITY_BB
+	{1, &oid_rt_pro_set_channel_direct_call_hdl},	//0x08
+	{1, &oid_null_function},			//0x09	OID_RT_PRO_SET_SLEEP_MODE_DIRECT_CALL
+	{1, &oid_null_function},			//0x0A	OID_RT_PRO_SET_WAKE_MODE_DIRECT_CALL
+	{1, &oid_rt_pro_set_continuous_tx_hdl},		//0x0B	OID_RT_PRO_SET_TX_CONTINUOUS_DIRECT_CALL
+	{1, &oid_rt_pro_set_single_carrier_tx_hdl},	//0x0C	OID_RT_PRO_SET_SINGLE_CARRIER_TX_CONTINUOUS
+	{1, &oid_null_function},			//0x0D	OID_RT_PRO_SET_TX_ANTENNA_BB
+	{1, &oid_rt_pro_set_antenna_bb_hdl},		//0x0E
+	{1, &oid_null_function},			//0x0F	OID_RT_PRO_SET_CR_SCRAMBLER
+	{1, &oid_null_function},			//0x10	OID_RT_PRO_SET_CR_NEW_FILTER
+	{1, &oid_rt_pro_set_tx_power_control_hdl},	//0x11	OID_RT_PRO_SET_TX_POWER_CONTROL
+	{1, &oid_null_function},			//0x12	OID_RT_PRO_SET_CR_TX_CONFIG
+	{1, &oid_null_function},			//0x13	OID_RT_PRO_GET_TX_POWER_CONTROL
+	{1, &oid_null_function},			//0x14	OID_RT_PRO_GET_CR_SIGNAL_QUALITY
+	{1, &oid_null_function},			//0x15	OID_RT_PRO_SET_CR_SETPOINT
+	{1, &oid_null_function},			//0x16	OID_RT_PRO_SET_INTEGRATOR
+	{1, &oid_null_function},			//0x17	OID_RT_PRO_SET_SIGNAL_QUALITY
+	{1, &oid_null_function},			//0x18	OID_RT_PRO_GET_INTEGRATOR
+	{1, &oid_null_function},			//0x19	OID_RT_PRO_GET_SIGNAL_QUALITY
+	{1, &oid_null_function},			//0x1A	OID_RT_PRO_QUERY_EEPROM_TYPE
+	{1, &oid_null_function},			//0x1B	OID_RT_PRO_WRITE_MAC_ADDRESS
+	{1, &oid_null_function},			//0x1C	OID_RT_PRO_READ_MAC_ADDRESS
+	{1, &oid_null_function},			//0x1D	OID_RT_PRO_WRITE_CIS_DATA
+	{1, &oid_null_function},			//0x1E	OID_RT_PRO_READ_CIS_DATA
+	{1, &oid_null_function}				//0x1F	OID_RT_PRO_WRITE_POWER_CONTROL
+
+};
+
+const struct oid_obj_priv oid_rtl_seg_81_80_20[] =
+{
+	{1, &oid_null_function},			//0x20	OID_RT_PRO_READ_POWER_CONTROL
+	{1, &oid_null_function},			//0x21	OID_RT_PRO_WRITE_EEPROM
+	{1, &oid_null_function},			//0x22	OID_RT_PRO_READ_EEPROM
+	{1, &oid_rt_pro_reset_tx_packet_sent_hdl},	//0x23
+	{1, &oid_rt_pro_query_tx_packet_sent_hdl},	//0x24
+	{1, &oid_rt_pro_reset_rx_packet_received_hdl},	//0x25
+	{1, &oid_rt_pro_query_rx_packet_received_hdl},	//0x26
+	{1, &oid_rt_pro_query_rx_packet_crc32_error_hdl},	//0x27
+	{1, &oid_null_function},			//0x28	OID_RT_PRO_QUERY_CURRENT_ADDRESS
+	{1, &oid_null_function},			//0x29	OID_RT_PRO_QUERY_PERMANENT_ADDRESS
+	{1, &oid_null_function},			//0x2A	OID_RT_PRO_SET_PHILIPS_RF_PARAMETERS
+	{1, &oid_rt_pro_set_carrier_suppression_tx_hdl},//0x2B	OID_RT_PRO_SET_CARRIER_SUPPRESSION_TX
+	{1, &oid_null_function},			//0x2C	OID_RT_PRO_RECEIVE_PACKET
+	{1, &oid_null_function},			//0x2D	OID_RT_PRO_WRITE_EEPROM_BYTE
+	{1, &oid_null_function},			//0x2E	OID_RT_PRO_READ_EEPROM_BYTE
+	{1, &oid_rt_pro_set_modulation_hdl}		//0x2F
+
+};
+
+const struct oid_obj_priv oid_rtl_seg_81_80_40[] =
+{
+	{1, &oid_null_function},			//0x40
+	{1, &oid_null_function},			//0x41
+	{1, &oid_null_function},			//0x42
+	{1, &oid_rt_pro_set_single_tone_tx_hdl},	//0x43
+	{1, &oid_null_function},			//0x44
+	{1, &oid_null_function}				//0x45
+};
+
+const struct oid_obj_priv oid_rtl_seg_81_80_80[] =
+{
+	{1, &oid_null_function},			//0x80	OID_RT_DRIVER_OPTION
+	{1, &oid_null_function},			//0x81	OID_RT_RF_OFF
+	{1, &oid_null_function}				//0x82	OID_RT_AUTH_STATUS
+
+};
+
+const struct oid_obj_priv oid_rtl_seg_81_85[] =
+{
+	{1, &oid_rt_wireless_mode_hdl}			//0x00	OID_RT_WIRELESS_MODE
+};
+
+struct oid_obj_priv oid_rtl_seg_81_87[] =
+{
+	{1, &oid_null_function},			//0x80	OID_RT_PRO8187_WI_POLL
+	{1, &oid_rt_pro_write_bb_reg_hdl},		//0x81
+	{1, &oid_rt_pro_read_bb_reg_hdl},		//0x82
+	{1, &oid_rt_pro_write_rf_reg_hdl},		//0x82
+	{1, &oid_rt_pro_read_rf_reg_hdl}		//0x83
+};
+
+struct oid_obj_priv oid_rtl_seg_87_11_00[] =
+{
+	{1, &oid_rt_pro8711_join_bss_hdl},		//0x00  //S
+	{1, &oid_rt_pro_read_register_hdl},		//0x01
+	{1, &oid_rt_pro_write_register_hdl},		//0x02
+	{1, &oid_rt_pro_burst_read_register_hdl},	//0x03
+	{1, &oid_rt_pro_burst_write_register_hdl},	//0x04
+	{1, &oid_rt_pro_write_txcmd_hdl},		//0x05
+	{1, &oid_rt_pro_read16_eeprom_hdl},		//0x06
+	{1, &oid_rt_pro_write16_eeprom_hdl},		//0x07
+	{1, &oid_null_function},			//0x08	OID_RT_PRO_H2C_SET_COMMAND
+	{1, &oid_null_function},			//0x09	OID_RT_PRO_H2C_QUERY_RESULT
+	{1, &oid_rt_pro8711_wi_poll_hdl},		//0x0A
+	{1, &oid_rt_pro8711_pkt_loss_hdl},		//0x0B
+	{1, &oid_rt_rd_attrib_mem_hdl},			//0x0C
+	{1, &oid_rt_wr_attrib_mem_hdl},			//0x0D
+	{1, &oid_null_function},			//0x0E
+	{1, &oid_null_function},			//0x0F
+	{1, &oid_null_function},			//0x10	OID_RT_PRO_H2C_CMD_MODE
+	{1, &oid_null_function},			//0x11	OID_RT_PRO_H2C_CMD_RSP_MODE
+	{1, &oid_null_function},			//0X12	OID_RT_PRO_WAIT_C2H_EVENT
+	{1, &oid_null_function},			//0X13	OID_RT_PRO_RW_ACCESS_PROTOCOL_TEST
+	{1, &oid_null_function},			//0X14	OID_RT_PRO_SCSI_ACCESS_TEST
+	{1, &oid_null_function},			//0X15	OID_RT_PRO_SCSI_TCPIPOFFLOAD_OUT
+	{1, &oid_null_function},			//0X16	OID_RT_PRO_SCSI_TCPIPOFFLOAD_IN
+	{1, &oid_null_function},			//0X17	OID_RT_RRO_RX_PKT_VIA_IOCTRL
+	{1, &oid_null_function},			//0X18	OID_RT_RRO_RX_PKTARRAY_VIA_IOCTRL
+	{1, &oid_null_function},			//0X19	OID_RT_RPO_SET_PWRMGT_TEST
+	{1, &oid_null_function},			//0X1A
+	{1, &oid_null_function},			//0X1B	OID_RT_PRO_QRY_PWRMGT_TEST
+	{1, &oid_null_function},			//0X1C	OID_RT_RPO_ASYNC_RWIO_TEST
+	{1, &oid_null_function},			//0X1D	OID_RT_RPO_ASYNC_RWIO_POLL
+	{1, &oid_rt_pro_set_rf_intfs_hdl},		//0X1E
+	{1, &oid_rt_poll_rx_status_hdl}			//0X1F
+};
+
+struct oid_obj_priv oid_rtl_seg_87_11_20[] =
+{
+	{1, &oid_rt_pro_cfg_debug_message_hdl},		//0x20
+	{1, &oid_rt_pro_set_data_rate_ex_hdl},		//0x21
+	{1, &oid_rt_pro_set_basic_rate_hdl},		//0x22
+	{1, &oid_rt_pro_read_tssi_hdl},			//0x23
+	{1, &oid_rt_pro_set_power_tracking_hdl}		//0x24
+};
+
+
+struct oid_obj_priv oid_rtl_seg_87_11_50[] =
+{
+	{1, &oid_rt_pro_qry_pwrstate_hdl},		//0x50
+	{1, &oid_rt_pro_set_pwrstate_hdl}		//0x51
+};
+
+struct oid_obj_priv oid_rtl_seg_87_11_80[] =
+{
+	{1, &oid_null_function}				//0x80
+};
+
+struct oid_obj_priv oid_rtl_seg_87_11_B0[] =
+{
+	{1, &oid_null_function}				//0xB0
+};
+
+struct oid_obj_priv oid_rtl_seg_87_11_F0[] =
+{
+	{1, &oid_null_function},			//0xF0
+	{1, &oid_null_function},			//0xF1
+	{1, &oid_null_function},			//0xF2
+	{1, &oid_null_function},			//0xF3
+	{1, &oid_null_function},			//0xF4
+	{1, &oid_null_function},			//0xF5
+	{1, &oid_null_function},			//0xF6
+	{1, &oid_null_function},			//0xF7
+	{1, &oid_null_function},			//0xF8
+	{1, &oid_null_function},			//0xF9
+	{1, &oid_null_function},			//0xFA
+	{1, &oid_rt_pro_h2c_set_rate_table_hdl},	//0xFB
+	{1, &oid_rt_pro_h2c_get_rate_table_hdl},	//0xFC
+	{1, &oid_null_function},			//0xFD
+	{1, &oid_null_function},			//0xFE	OID_RT_PRO_H2C_C2H_LBK_TEST
+	{1, &oid_null_function}				//0xFF
+
+};
+
+struct oid_obj_priv oid_rtl_seg_87_12_00[]=
+{
+	{1, &oid_rt_pro_encryption_ctrl_hdl},		//0x00	Q&S
+	{1, &oid_rt_pro_add_sta_info_hdl},		//0x01	S
+	{1, &oid_rt_pro_dele_sta_info_hdl},		//0x02	S
+	{1, &oid_rt_pro_query_dr_variable_hdl},		//0x03	Q
+	{1, &oid_rt_pro_rx_packet_type_hdl},		//0x04	Q,S
+	{1, &oid_rt_pro_read_efuse_hdl},		//0x05	Q	OID_RT_PRO_READ_EFUSE
+	{1, &oid_rt_pro_write_efuse_hdl},		//0x06	S	OID_RT_PRO_WRITE_EFUSE
+	{1, &oid_rt_pro_rw_efuse_pgpkt_hdl},		//0x07	Q,S
+	{1, &oid_rt_get_efuse_current_size_hdl},	//0x08 	Q
+	{1, &oid_rt_set_bandwidth_hdl},			//0x09
+	{1, &oid_rt_set_crystal_cap_hdl},		//0x0a
+	{1, &oid_rt_set_rx_packet_type_hdl},		//0x0b	S
+	{1, &oid_rt_get_efuse_max_size_hdl},		//0x0c
+	{1, &oid_rt_pro_set_tx_agc_offset_hdl},		//0x0d
+	{1, &oid_rt_pro_set_pkt_test_mode_hdl},		//0x0e
+	{1, &oid_null_function},			//0x0f		OID_RT_PRO_FOR_EVM_TEST_SETTING
+	{1, &oid_rt_get_thermal_meter_hdl},		//0x10	Q	OID_RT_PRO_GET_THERMAL_METER
+	{1, &oid_rt_reset_phy_rx_packet_count_hdl},	//0x11	S	OID_RT_RESET_PHY_RX_PACKET_COUNT
+	{1, &oid_rt_get_phy_rx_packet_received_hdl},	//0x12	Q	OID_RT_GET_PHY_RX_PACKET_RECEIVED
+	{1, &oid_rt_get_phy_rx_packet_crc32_error_hdl},	//0x13	Q	OID_RT_GET_PHY_RX_PACKET_CRC32_ERROR
+	{1, &oid_rt_set_power_down_hdl},		//0x14	Q	OID_RT_SET_POWER_DOWN
+	{1, &oid_rt_get_power_mode_hdl}			//0x15	Q	OID_RT_GET_POWER_MODE
+};
+
+#else /* _RTL871X_MP_IOCTL_C_ */
+
+extern struct oid_obj_priv oid_rtl_seg_81_80_00[32];
+extern struct oid_obj_priv oid_rtl_seg_81_80_20[16];
+extern struct oid_obj_priv oid_rtl_seg_81_80_40[6];
+extern struct oid_obj_priv oid_rtl_seg_81_80_80[3];
+
+extern struct oid_obj_priv oid_rtl_seg_81_85[1];
+extern struct oid_obj_priv oid_rtl_seg_81_87[5];
+
+extern struct oid_obj_priv oid_rtl_seg_87_11_00[32];
+extern struct oid_obj_priv oid_rtl_seg_87_11_20[5];
+extern struct oid_obj_priv oid_rtl_seg_87_11_50[2];
+extern struct oid_obj_priv oid_rtl_seg_87_11_80[1];
+extern struct oid_obj_priv oid_rtl_seg_87_11_B0[1];
+extern struct oid_obj_priv oid_rtl_seg_87_11_F0[16];
+
+extern struct oid_obj_priv oid_rtl_seg_87_12_00[32];
+
+#endif /* _RTL871X_MP_IOCTL_C_ */
+
+struct rwreg_param{
+	u32 offset;
+	u32 width;
+	u32 value;
+};
+
+struct bbreg_param{
+	u32 offset;
+	u32 phymask;
+	u32 value;
+};
+/*
+struct rfchannel_param{
+	u32 ch;
+	u32 modem;
+};
+*/
+struct txpower_param{
+	u32 pwr_index;
+};
+
+
+struct datarate_param{
+	u32 rate_index;
+};
+
+
+struct rfintfs_parm {
+	u32 rfintfs;
+};
+
+typedef struct _mp_xmit_parm_ {
+	u8 enable;
+	u32 count;
+	u16 length;
+	u8 payload_type;
+	u8 da[ETH_ALEN];
+}MP_XMIT_PARM, *PMP_XMIT_PARM;
+
+struct mp_xmit_packet {
+	u32 len;
+	u32 mem[MAX_MP_XMITBUF_SZ >> 2];
+};
+
+struct psmode_param {
+	u32 ps_mode;
+	u32 smart_ps;
+};
+
+//for OID_RT_PRO_READ16_EEPROM & OID_RT_PRO_WRITE16_EEPROM
+struct eeprom_rw_param {
+	u32 offset;
+	u16 value;
+};
+
+struct mp_ioctl_handler {
+	u32 paramsize;
+	u32 (*handler)(struct oid_par_priv* poid_par_priv);
+	u32 oid;
+};
+
+struct mp_ioctl_param{
+	u32 subcode;
+	u32 len;
+	u8 data[0];
+};
+
+#define GEN_MP_IOCTL_SUBCODE(code) _MP_IOCTL_ ## code ## _CMD_
+
+enum RTL871X_MP_IOCTL_SUBCODE {
+	GEN_MP_IOCTL_SUBCODE(MP_START),			/*0*/
+	GEN_MP_IOCTL_SUBCODE(MP_STOP),
+	GEN_MP_IOCTL_SUBCODE(READ_REG),
+	GEN_MP_IOCTL_SUBCODE(WRITE_REG),
+	GEN_MP_IOCTL_SUBCODE(READ_BB_REG),
+	GEN_MP_IOCTL_SUBCODE(WRITE_BB_REG),		/*5*/
+	GEN_MP_IOCTL_SUBCODE(READ_RF_REG),
+	GEN_MP_IOCTL_SUBCODE(WRITE_RF_REG),
+	GEN_MP_IOCTL_SUBCODE(SET_CHANNEL),
+	GEN_MP_IOCTL_SUBCODE(SET_TXPOWER),
+	GEN_MP_IOCTL_SUBCODE(SET_DATARATE),		/*10*/
+	GEN_MP_IOCTL_SUBCODE(SET_BANDWIDTH),
+	GEN_MP_IOCTL_SUBCODE(SET_ANTENNA),
+	GEN_MP_IOCTL_SUBCODE(CNTU_TX),
+	GEN_MP_IOCTL_SUBCODE(SC_TX),
+	GEN_MP_IOCTL_SUBCODE(CS_TX),			/*15*/
+	GEN_MP_IOCTL_SUBCODE(ST_TX),
+	GEN_MP_IOCTL_SUBCODE(IOCTL_XMIT_PACKET),
+	GEN_MP_IOCTL_SUBCODE(SET_RX_PKT_TYPE),
+	GEN_MP_IOCTL_SUBCODE(RESET_PHY_RX_PKT_CNT),
+	GEN_MP_IOCTL_SUBCODE(GET_PHY_RX_PKT_RECV),	/*20*/
+	GEN_MP_IOCTL_SUBCODE(GET_PHY_RX_PKT_ERROR),
+	GEN_MP_IOCTL_SUBCODE(READ16_EEPROM),
+	GEN_MP_IOCTL_SUBCODE(WRITE16_EEPROM),
+	GEN_MP_IOCTL_SUBCODE(EFUSE),
+	GEN_MP_IOCTL_SUBCODE(EFUSE_MAP),		/*25*/
+	GEN_MP_IOCTL_SUBCODE(GET_EFUSE_MAX_SIZE),
+	GEN_MP_IOCTL_SUBCODE(GET_EFUSE_CURRENT_SIZE),
+	GEN_MP_IOCTL_SUBCODE(GET_THERMAL_METER),
+	GEN_MP_IOCTL_SUBCODE(SET_PTM),
+	GEN_MP_IOCTL_SUBCODE(SET_POWER_DOWN),		/*30*/
+	GEN_MP_IOCTL_SUBCODE(TRIGGER_GPIO),
+	GEN_MP_IOCTL_SUBCODE(SET_DM_BT),		/*35*/
+	GEN_MP_IOCTL_SUBCODE(DEL_BA),			/*36*/
+	GEN_MP_IOCTL_SUBCODE(GET_WIFI_STATUS),	/*37*/
+	MAX_MP_IOCTL_SUBCODE,
+};
+
+u32 mp_ioctl_xmit_packet_hdl(struct oid_par_priv* poid_par_priv);
+
+#ifdef _RTW_MP_IOCTL_C_
+
+#define GEN_MP_IOCTL_HANDLER(sz, hdl, oid) {sz, hdl, oid},
+
+#define EXT_MP_IOCTL_HANDLER(sz, subcode, oid) {sz, mp_ioctl_ ## subcode ## _hdl, oid},
+
+
+struct mp_ioctl_handler mp_ioctl_hdl[] = {
+
+/*0*/	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_pro_start_test_hdl, OID_RT_PRO_START_TEST)
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_pro_stop_test_hdl, OID_RT_PRO_STOP_TEST)
+
+	GEN_MP_IOCTL_HANDLER(sizeof(struct rwreg_param), oid_rt_pro_read_register_hdl, OID_RT_PRO_READ_REGISTER)
+	GEN_MP_IOCTL_HANDLER(sizeof(struct rwreg_param), oid_rt_pro_write_register_hdl, OID_RT_PRO_WRITE_REGISTER)
+	GEN_MP_IOCTL_HANDLER(sizeof(struct bb_reg_param), oid_rt_pro_read_bb_reg_hdl, OID_RT_PRO_READ_BB_REG)
+/*5*/	GEN_MP_IOCTL_HANDLER(sizeof(struct bb_reg_param), oid_rt_pro_write_bb_reg_hdl, OID_RT_PRO_WRITE_BB_REG)
+	GEN_MP_IOCTL_HANDLER(sizeof(struct rf_reg_param), oid_rt_pro_read_rf_reg_hdl, OID_RT_PRO_RF_READ_REGISTRY)
+	GEN_MP_IOCTL_HANDLER(sizeof(struct rf_reg_param), oid_rt_pro_write_rf_reg_hdl, OID_RT_PRO_RF_WRITE_REGISTRY)
+
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_pro_set_channel_direct_call_hdl, OID_RT_PRO_SET_CHANNEL_DIRECT_CALL)
+	GEN_MP_IOCTL_HANDLER(sizeof(struct txpower_param), oid_rt_pro_set_tx_power_control_hdl, OID_RT_PRO_SET_TX_POWER_CONTROL)
+/*10*/	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_pro_set_data_rate_hdl, OID_RT_PRO_SET_DATA_RATE)
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_set_bandwidth_hdl, OID_RT_SET_BANDWIDTH)
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_pro_set_antenna_bb_hdl, OID_RT_PRO_SET_ANTENNA_BB)
+
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_pro_set_continuous_tx_hdl, OID_RT_PRO_SET_CONTINUOUS_TX)
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_pro_set_single_carrier_tx_hdl, OID_RT_PRO_SET_SINGLE_CARRIER_TX)
+/*15*/	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_pro_set_carrier_suppression_tx_hdl, OID_RT_PRO_SET_CARRIER_SUPPRESSION_TX)
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_pro_set_single_tone_tx_hdl, OID_RT_PRO_SET_SINGLE_TONE_TX)
+
+	EXT_MP_IOCTL_HANDLER(0, xmit_packet, 0)
+
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_set_rx_packet_type_hdl, OID_RT_SET_RX_PACKET_TYPE)
+	GEN_MP_IOCTL_HANDLER(0, oid_rt_reset_phy_rx_packet_count_hdl, OID_RT_RESET_PHY_RX_PACKET_COUNT)
+/*20*/	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_get_phy_rx_packet_received_hdl, OID_RT_GET_PHY_RX_PACKET_RECEIVED)
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_get_phy_rx_packet_crc32_error_hdl, OID_RT_GET_PHY_RX_PACKET_CRC32_ERROR)
+
+	GEN_MP_IOCTL_HANDLER(sizeof(struct eeprom_rw_param), NULL, 0)
+	GEN_MP_IOCTL_HANDLER(sizeof(struct eeprom_rw_param), NULL, 0)
+	GEN_MP_IOCTL_HANDLER(sizeof(EFUSE_ACCESS_STRUCT), oid_rt_pro_efuse_hdl, OID_RT_PRO_EFUSE)
+/*25*/	GEN_MP_IOCTL_HANDLER(0, oid_rt_pro_efuse_map_hdl, OID_RT_PRO_EFUSE_MAP)
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_get_efuse_max_size_hdl, OID_RT_GET_EFUSE_MAX_SIZE)
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_get_efuse_current_size_hdl, OID_RT_GET_EFUSE_CURRENT_SIZE)
+
+	GEN_MP_IOCTL_HANDLER(sizeof(u32), oid_rt_get_thermal_meter_hdl, OID_RT_PRO_GET_THERMAL_METER)
+	GEN_MP_IOCTL_HANDLER(sizeof(u8), oid_rt_pro_set_power_tracking_hdl, OID_RT_PRO_SET_POWER_TRACKING)
+/*30*/	GEN_MP_IOCTL_HANDLER(sizeof(u8), oid_rt_set_power_down_hdl, OID_RT_SET_POWER_DOWN)
+/*31*/	GEN_MP_IOCTL_HANDLER(0, oid_rt_pro_trigger_gpio_hdl, 0)
+
+
+};
+
+#else /* _RTW_MP_IOCTL_C_ */
+
+extern struct mp_ioctl_handler mp_ioctl_hdl[];
+
+#endif /* _RTW_MP_IOCTL_C_ */
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp_phy_regdef.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp_phy_regdef.h
new file mode 100644
index 000000000000..24e662413d38
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_mp_phy_regdef.h
@@ -0,0 +1,1096 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+/*****************************************************************************
+ *
+ * Module:	__RTW_MP_PHY_REGDEF_H_
+ *
+ *
+ * Note:	1. Define PMAC/BB register map
+ *			2. Define RF register map
+ *			3. PMAC/BB register bit mask.
+ *			4. RF reg bit mask.
+ *			5. Other BB/RF relative definition.
+ *
+ *
+ * Export:	Constants, macro, functions(API), global variables(None).
+ *
+ * Abbrev:
+ *
+ * History:
+ *	Data			Who		Remark
+ *	08/07/2007	MHC		1. Porting from 9x series PHYCFG.h.
+ *						2. Reorganize code architecture.
+ *	09/25/2008	MH		1. Add RL6052 register definition
+ *
+ *****************************************************************************/
+#ifndef __RTW_MP_PHY_REGDEF_H_
+#define __RTW_MP_PHY_REGDEF_H_
+
+
+/*--------------------------Define Parameters-------------------------------*/
+
+//============================================================
+//       8192S Regsiter offset definition
+//============================================================
+
+//
+// BB-PHY register PMAC 0x100 PHY 0x800 - 0xEFF
+// 1. PMAC duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF
+// 2. 0x800/0x900/0xA00/0xC00/0xD00/0xE00
+// 3. RF register 0x00-2E
+// 4. Bit Mask for BB/RF register
+// 5. Other defintion for BB/RF R/W
+//
+
+
+//
+// 1. PMAC duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF
+// 1. Page1(0x100)
+//
+#define		rPMAC_Reset					0x100
+#define		rPMAC_TxStart					0x104
+#define		rPMAC_TxLegacySIG				0x108
+#define		rPMAC_TxHTSIG1				0x10c
+#define		rPMAC_TxHTSIG2				0x110
+#define		rPMAC_PHYDebug				0x114
+#define		rPMAC_TxPacketNum				0x118
+#define		rPMAC_TxIdle					0x11c
+#define		rPMAC_TxMACHeader0			0x120
+#define		rPMAC_TxMACHeader1			0x124
+#define		rPMAC_TxMACHeader2			0x128
+#define		rPMAC_TxMACHeader3			0x12c
+#define		rPMAC_TxMACHeader4			0x130
+#define		rPMAC_TxMACHeader5			0x134
+#define		rPMAC_TxDataType				0x138
+#define		rPMAC_TxRandomSeed			0x13c
+#define		rPMAC_CCKPLCPPreamble			0x140
+#define		rPMAC_CCKPLCPHeader			0x144
+#define		rPMAC_CCKCRC16				0x148
+#define		rPMAC_OFDMRxCRC32OK			0x170
+#define		rPMAC_OFDMRxCRC32Er			0x174
+#define		rPMAC_OFDMRxParityEr			0x178
+#define		rPMAC_OFDMRxCRC8Er			0x17c
+#define		rPMAC_CCKCRxRC16Er			0x180
+#define		rPMAC_CCKCRxRC32Er			0x184
+#define		rPMAC_CCKCRxRC32OK			0x188
+#define		rPMAC_TxStatus					0x18c
+
+//
+// 2. Page2(0x200)
+//
+// The following two definition are only used for USB interface.
+//#define		RF_BB_CMD_ADDR				0x02c0	// RF/BB read/write command address.
+//#define		RF_BB_CMD_DATA				0x02c4	// RF/BB read/write command data.
+
+//
+// 3. Page8(0x800)
+//
+#define		rFPGA0_RFMOD				0x800	//RF mode & CCK TxSC // RF BW Setting??
+
+#define		rFPGA0_TxInfo				0x804	// Status report??
+#define		rFPGA0_PSDFunction			0x808
+
+#define		rFPGA0_TxGainStage			0x80c	// Set TX PWR init gain?
+
+#define		rFPGA0_RFTiming1			0x810	// Useless now
+#define		rFPGA0_RFTiming2			0x814
+//#define rFPGA0_XC_RFTiming        		0x818
+//#define rFPGA0_XD_RFTiming        		0x81c
+
+#define		rFPGA0_XA_HSSIParameter1		0x820	// RF 3 wire register
+#define		rFPGA0_XA_HSSIParameter2		0x824
+#define		rFPGA0_XB_HSSIParameter1		0x828
+#define		rFPGA0_XB_HSSIParameter2		0x82c
+#define		rFPGA0_XC_HSSIParameter1		0x830
+#define		rFPGA0_XC_HSSIParameter2		0x834
+#define		rFPGA0_XD_HSSIParameter1		0x838
+#define		rFPGA0_XD_HSSIParameter2		0x83c
+#define		rFPGA0_XA_LSSIParameter		0x840
+#define		rFPGA0_XB_LSSIParameter		0x844
+#define		rFPGA0_XC_LSSIParameter		0x848
+#define		rFPGA0_XD_LSSIParameter		0x84c
+
+#define		rFPGA0_RFWakeUpParameter		0x850	// Useless now
+#define		rFPGA0_RFSleepUpParameter		0x854
+
+#define		rFPGA0_XAB_SwitchControl		0x858	// RF Channel switch
+#define		rFPGA0_XCD_SwitchControl		0x85c
+
+#define		rFPGA0_XA_RFInterfaceOE		0x860	// RF Channel switch
+#define		rFPGA0_XB_RFInterfaceOE		0x864
+#define		rFPGA0_XC_RFInterfaceOE		0x868
+#define		rFPGA0_XD_RFInterfaceOE		0x86c
+
+#define		rFPGA0_XAB_RFInterfaceSW		0x870	// RF Interface Software Control
+#define		rFPGA0_XCD_RFInterfaceSW		0x874
+
+#define		rFPGA0_XAB_RFParameter		0x878	// RF Parameter
+#define		rFPGA0_XCD_RFParameter		0x87c
+
+#define		rFPGA0_AnalogParameter1		0x880	// Crystal cap setting RF-R/W protection for parameter4??
+#define		rFPGA0_AnalogParameter2		0x884
+#define		rFPGA0_AnalogParameter3		0x888	// Useless now
+#define		rFPGA0_AnalogParameter4		0x88c
+
+#define		rFPGA0_XA_LSSIReadBack		0x8a0	// Tranceiver LSSI Readback
+#define		rFPGA0_XB_LSSIReadBack		0x8a4
+#define		rFPGA0_XC_LSSIReadBack		0x8a8
+#define		rFPGA0_XD_LSSIReadBack		0x8ac
+
+#define		rFPGA0_PSDReport				0x8b4	// Useless now
+#define		rFPGA0_XAB_RFInterfaceRB		0x8e0	// Useless now // RF Interface Readback Value
+#define		rFPGA0_XCD_RFInterfaceRB		0x8e4	// Useless now
+
+//
+// 4. Page9(0x900)
+//
+#define		rFPGA1_RFMOD				0x900	//RF mode & OFDM TxSC // RF BW Setting??
+
+#define		rFPGA1_TxBlock				0x904	// Useless now
+#define		rFPGA1_DebugSelect			0x908	// Useless now
+#define		rFPGA1_TxInfo				0x90c	// Useless now // Status report??
+
+//
+// 5. PageA(0xA00)
+//
+// Set Control channel to upper or lower. These settings are required only for 40MHz
+#define		rCCK0_System				0xa00
+
+#define		rCCK0_AFESetting			0xa04	// Disable init gain now // Select RX path by RSSI
+#define		rCCK0_CCA					0xa08	// Disable init gain now // Init gain
+
+#define		rCCK0_RxAGC1				0xa0c 	//AGC default value, saturation level // Antenna Diversity, RX AGC, LNA Threshold, RX LNA Threshold useless now. Not the same as 90 series
+#define		rCCK0_RxAGC2				0xa10 	//AGC & DAGC
+
+#define		rCCK0_RxHP					0xa14
+
+#define		rCCK0_DSPParameter1		0xa18	//Timing recovery & Channel estimation threshold
+#define		rCCK0_DSPParameter2		0xa1c	//SQ threshold
+
+#define		rCCK0_TxFilter1				0xa20
+#define		rCCK0_TxFilter2				0xa24
+#define		rCCK0_DebugPort			0xa28	//debug port and Tx filter3
+#define		rCCK0_FalseAlarmReport		0xa2c	//0xa2d	useless now 0xa30-a4f channel report
+#define		rCCK0_TRSSIReport         		0xa50
+#define		rCCK0_RxReport            		0xa54  //0xa57
+#define		rCCK0_FACounterLower      	0xa5c  //0xa5b
+#define		rCCK0_FACounterUpper      	0xa58  //0xa5c
+
+//
+// 6. PageC(0xC00)
+//
+#define		rOFDM0_LSTF				0xc00
+
+#define		rOFDM0_TRxPathEnable		0xc04
+#define		rOFDM0_TRMuxPar			0xc08
+#define		rOFDM0_TRSWIsolation		0xc0c
+
+#define		rOFDM0_XARxAFE			0xc10  //RxIQ DC offset, Rx digital filter, DC notch filter
+#define		rOFDM0_XARxIQImbalance    	0xc14  //RxIQ imblance matrix
+#define		rOFDM0_XBRxAFE            		0xc18
+#define		rOFDM0_XBRxIQImbalance    	0xc1c
+#define		rOFDM0_XCRxAFE            		0xc20
+#define		rOFDM0_XCRxIQImbalance    	0xc24
+#define		rOFDM0_XDRxAFE            		0xc28
+#define		rOFDM0_XDRxIQImbalance    	0xc2c
+
+#define		rOFDM0_RxDetector1			0xc30  //PD,BW & SBD	// DM tune init gain
+#define		rOFDM0_RxDetector2			0xc34  //SBD & Fame Sync.
+#define		rOFDM0_RxDetector3			0xc38  //Frame Sync.
+#define		rOFDM0_RxDetector4			0xc3c  //PD, SBD, Frame Sync & Short-GI
+
+#define		rOFDM0_RxDSP				0xc40  //Rx Sync Path
+#define		rOFDM0_CFOandDAGC		0xc44  //CFO & DAGC
+#define		rOFDM0_CCADropThreshold	0xc48 //CCA Drop threshold
+#define		rOFDM0_ECCAThreshold		0xc4c // energy CCA
+
+#define		rOFDM0_XAAGCCore1			0xc50	// DIG
+#define		rOFDM0_XAAGCCore2			0xc54
+#define		rOFDM0_XBAGCCore1			0xc58
+#define		rOFDM0_XBAGCCore2			0xc5c
+#define		rOFDM0_XCAGCCore1			0xc60
+#define		rOFDM0_XCAGCCore2			0xc64
+#define		rOFDM0_XDAGCCore1			0xc68
+#define		rOFDM0_XDAGCCore2			0xc6c
+
+#define		rOFDM0_AGCParameter1			0xc70
+#define		rOFDM0_AGCParameter2			0xc74
+#define		rOFDM0_AGCRSSITable			0xc78
+#define		rOFDM0_HTSTFAGC				0xc7c
+
+#define		rOFDM0_XATxIQImbalance		0xc80	// TX PWR TRACK and DIG
+#define		rOFDM0_XATxAFE				0xc84
+#define		rOFDM0_XBTxIQImbalance		0xc88
+#define		rOFDM0_XBTxAFE				0xc8c
+#define		rOFDM0_XCTxIQImbalance		0xc90
+#define		rOFDM0_XCTxAFE            			0xc94
+#define		rOFDM0_XDTxIQImbalance		0xc98
+#define		rOFDM0_XDTxAFE				0xc9c
+#define		rOFDM0_RxIQExtAnta			0xca0
+
+#define		rOFDM0_RxHPParameter			0xce0
+#define		rOFDM0_TxPseudoNoiseWgt		0xce4
+#define		rOFDM0_FrameSync				0xcf0
+#define		rOFDM0_DFSReport				0xcf4
+#define		rOFDM0_TxCoeff1				0xca4
+#define		rOFDM0_TxCoeff2				0xca8
+#define		rOFDM0_TxCoeff3				0xcac
+#define		rOFDM0_TxCoeff4				0xcb0
+#define		rOFDM0_TxCoeff5				0xcb4
+#define		rOFDM0_TxCoeff6				0xcb8
+
+
+//
+// 7. PageD(0xD00)
+//
+#define		rOFDM1_LSTF					0xd00
+#define		rOFDM1_TRxPathEnable			0xd04
+
+#define		rOFDM1_CFO						0xd08	// No setting now
+#define		rOFDM1_CSI1					0xd10
+#define		rOFDM1_SBD						0xd14
+#define		rOFDM1_CSI2					0xd18
+#define		rOFDM1_CFOTracking			0xd2c
+#define		rOFDM1_TRxMesaure1			0xd34
+#define		rOFDM1_IntfDet					0xd3c
+#define		rOFDM1_PseudoNoiseStateAB		0xd50
+#define		rOFDM1_PseudoNoiseStateCD		0xd54
+#define		rOFDM1_RxPseudoNoiseWgt		0xd58
+
+#define		rOFDM_PHYCounter1				0xda0  //cca, parity fail
+#define		rOFDM_PHYCounter2				0xda4  //rate illegal, crc8 fail
+#define		rOFDM_PHYCounter3				0xda8  //MCS not support
+
+#define		rOFDM_ShortCFOAB				0xdac	// No setting now
+#define		rOFDM_ShortCFOCD				0xdb0
+#define		rOFDM_LongCFOAB				0xdb4
+#define		rOFDM_LongCFOCD				0xdb8
+#define		rOFDM_TailCFOAB				0xdbc
+#define		rOFDM_TailCFOCD				0xdc0
+#define		rOFDM_PWMeasure1          		0xdc4
+#define		rOFDM_PWMeasure2          		0xdc8
+#define		rOFDM_BWReport				0xdcc
+#define		rOFDM_AGCReport				0xdd0
+#define		rOFDM_RxSNR					0xdd4
+#define		rOFDM_RxEVMCSI				0xdd8
+#define		rOFDM_SIGReport				0xddc
+
+
+//
+// 8. PageE(0xE00)
+//
+#define		rTxAGC_Rate18_06				0xe00
+#define		rTxAGC_Rate54_24				0xe04
+#define		rTxAGC_CCK_Mcs32				0xe08
+#define		rTxAGC_Mcs03_Mcs00			0xe10
+#define		rTxAGC_Mcs07_Mcs04			0xe14
+#define		rTxAGC_Mcs11_Mcs08			0xe18
+#define		rTxAGC_Mcs15_Mcs12			0xe1c
+
+// Analog- control in RX_WAIT_CCA : REG: EE0 [Analog- Power & Control Register]
+#define 		rRx_Wait_CCCA					0xe70
+#define		rAnapar_Ctrl_BB					0xee0
+
+//
+// 7. RF Register 0x00-0x2E (RF 8256)
+//    RF-0222D 0x00-3F
+//
+//Zebra1
+#define RTL92SE_FPGA_VERIFY 0
+#define		rZebra1_HSSIEnable				0x0	// Useless now
+#define		rZebra1_TRxEnable1				0x1
+#define		rZebra1_TRxEnable2				0x2
+#define		rZebra1_AGC					0x4
+#define		rZebra1_ChargePump			0x5
+//#if (RTL92SE_FPGA_VERIFY == 1)
+#define		rZebra1_Channel				0x7	// RF channel switch
+//#else
+
+//#endif
+#define		rZebra1_TxGain					0x8	// Useless now
+#define		rZebra1_TxLPF					0x9
+#define		rZebra1_RxLPF					0xb
+#define		rZebra1_RxHPFCorner			0xc
+
+//Zebra4
+#define		rGlobalCtrl						0	// Useless now
+#define		rRTL8256_TxLPF					19
+#define		rRTL8256_RxLPF					11
+
+//RTL8258
+#define		rRTL8258_TxLPF					0x11	// Useless now
+#define		rRTL8258_RxLPF					0x13
+#define		rRTL8258_RSSILPF				0xa
+
+//
+// RL6052 Register definition
+//
+#define		RF_AC						0x00	//
+
+#define		RF_IQADJ_G1				0x01	//
+#define		RF_IQADJ_G2				0x02	//
+#define		RF_POW_TRSW				0x05	//
+
+#define		RF_GAIN_RX					0x06	//
+#define		RF_GAIN_TX					0x07	//
+
+#define		RF_TXM_IDAC				0x08	//
+#define		RF_BS_IQGEN				0x0F	//
+
+#define		RF_MODE1					0x10	//
+#define		RF_MODE2					0x11	//
+
+#define		RF_RX_AGC_HP				0x12	//
+#define		RF_TX_AGC					0x13	//
+#define		RF_BIAS						0x14	//
+#define		RF_IPA						0x15	//
+#define		RF_POW_ABILITY			0x17	//
+#define		RF_MODE_AG				0x18	//
+#define		rRfChannel					0x18	// RF channel and BW switch
+#define		RF_CHNLBW					0x18	// RF channel and BW switch
+#define		RF_TOP						0x19	//
+
+#define		RF_RX_G1					0x1A	//
+#define		RF_RX_G2					0x1B	//
+
+#define		RF_RX_BB2					0x1C	//
+#define		RF_RX_BB1					0x1D	//
+
+#define		RF_RCK1					0x1E	//
+#define		RF_RCK2					0x1F	//
+
+#define		RF_TX_G1					0x20	//
+#define		RF_TX_G2					0x21	//
+#define		RF_TX_G3					0x22	//
+
+#define		RF_TX_BB1					0x23	//
+
+#define		RF_T_METER					0x24	//
+
+#define		RF_SYN_G1					0x25	// RF TX Power control
+#define		RF_SYN_G2					0x26	// RF TX Power control
+#define		RF_SYN_G3					0x27	// RF TX Power control
+#define		RF_SYN_G4					0x28	// RF TX Power control
+#define		RF_SYN_G5					0x29	// RF TX Power control
+#define		RF_SYN_G6					0x2A	// RF TX Power control
+#define		RF_SYN_G7					0x2B	// RF TX Power control
+#define		RF_SYN_G8					0x2C	// RF TX Power control
+
+#define		RF_RCK_OS					0x30	// RF TX PA control
+
+#define		RF_TXPA_G1					0x31	// RF TX PA control
+#define		RF_TXPA_G2					0x32	// RF TX PA control
+#define		RF_TXPA_G3					0x33	// RF TX PA control
+
+//
+//Bit Mask
+//
+// 1. Page1(0x100)
+#define		bBBResetB						0x100	// Useless now?
+#define		bGlobalResetB					0x200
+#define		bOFDMTxStart					0x4
+#define		bCCKTxStart						0x8
+#define		bCRC32Debug					0x100
+#define		bPMACLoopback					0x10
+#define		bTxLSIG							0xffffff
+#define		bOFDMTxRate					0xf
+#define		bOFDMTxReserved				0x10
+#define		bOFDMTxLength					0x1ffe0
+#define		bOFDMTxParity					0x20000
+#define		bTxHTSIG1						0xffffff
+#define		bTxHTMCSRate					0x7f
+#define		bTxHTBW						0x80
+#define		bTxHTLength					0xffff00
+#define		bTxHTSIG2						0xffffff
+#define		bTxHTSmoothing					0x1
+#define		bTxHTSounding					0x2
+#define		bTxHTReserved					0x4
+#define		bTxHTAggreation				0x8
+#define		bTxHTSTBC						0x30
+#define		bTxHTAdvanceCoding			0x40
+#define		bTxHTShortGI					0x80
+#define		bTxHTNumberHT_LTF			0x300
+#define		bTxHTCRC8						0x3fc00
+#define		bCounterReset					0x10000
+#define		bNumOfOFDMTx					0xffff
+#define		bNumOfCCKTx					0xffff0000
+#define		bTxIdleInterval					0xffff
+#define		bOFDMService					0xffff0000
+#define		bTxMACHeader					0xffffffff
+#define		bTxDataInit						0xff
+#define		bTxHTMode						0x100
+#define		bTxDataType					0x30000
+#define		bTxRandomSeed					0xffffffff
+#define		bCCKTxPreamble					0x1
+#define		bCCKTxSFD						0xffff0000
+#define		bCCKTxSIG						0xff
+#define		bCCKTxService					0xff00
+#define		bCCKLengthExt					0x8000
+#define		bCCKTxLength					0xffff0000
+#define		bCCKTxCRC16					0xffff
+#define		bCCKTxStatus					0x1
+#define		bOFDMTxStatus					0x2
+
+#define 		IS_BB_REG_OFFSET_92S(_Offset)		((_Offset >= 0x800) && (_Offset <= 0xfff))
+
+// 2. Page8(0x800)
+#define		bRFMOD							0x1	// Reg 0x800 rFPGA0_RFMOD
+#define		bJapanMode						0x2
+#define		bCCKTxSC						0x30
+#define		bCCKEn							0x1000000
+#define		bOFDMEn						0x2000000
+
+#define		bOFDMRxADCPhase           		0x10000	// Useless now
+#define		bOFDMTxDACPhase           		0x40000
+#define		bXATxAGC                  			0x3f
+
+#define		bXBTxAGC                  			0xf00	// Reg 80c rFPGA0_TxGainStage
+#define		bXCTxAGC                  			0xf000
+#define		bXDTxAGC                  			0xf0000
+
+#define		bPAStart                  			0xf0000000	// Useless now
+#define		bTRStart                  			0x00f00000
+#define		bRFStart                  			0x0000f000
+#define		bBBStart                  			0x000000f0
+#define		bBBCCKStart               		0x0000000f
+#define		bPAEnd                    			0xf          //Reg0x814
+#define		bTREnd                    			0x0f000000
+#define		bRFEnd                    			0x000f0000
+#define		bCCAMask                  			0x000000f0   //T2R
+#define		bR2RCCAMask               		0x00000f00
+#define		bHSSI_R2TDelay            		0xf8000000
+#define		bHSSI_T2RDelay            		0xf80000
+#define		bContTxHSSI               		0x400     //chane gain at continue Tx
+#define		bIGFromCCK                		0x200
+#define		bAGCAddress               		0x3f
+#define		bRxHPTx                   			0x7000
+#define		bRxHPT2R                  			0x38000
+#define		bRxHPCCKIni               		0xc0000
+#define		bAGCTxCode                		0xc00000
+#define		bAGCRxCode                		0x300000
+
+#define		b3WireDataLength          		0x800	// Reg 0x820~84f rFPGA0_XA_HSSIParameter1
+#define		b3WireAddressLength       		0x400
+
+#define		b3WireRFPowerDown         		0x1	// Useless now
+//#define bHWSISelect               		0x8
+#define		b5GPAPEPolarity           		0x40000000
+#define		b2GPAPEPolarity           		0x80000000
+#define		bRFSW_TxDefaultAnt        		0x3
+#define		bRFSW_TxOptionAnt         		0x30
+#define		bRFSW_RxDefaultAnt        		0x300
+#define		bRFSW_RxOptionAnt         		0x3000
+#define		bRFSI_3WireData           		0x1
+#define		bRFSI_3WireClock          		0x2
+#define		bRFSI_3WireLoad           		0x4
+#define		bRFSI_3WireRW             		0x8
+#define		bRFSI_3Wire               			0xf
+
+#define		bRFSI_RFENV               		0x10	// Reg 0x870 rFPGA0_XAB_RFInterfaceSW
+
+#define		bRFSI_TRSW                		0x20	// Useless now
+#define		bRFSI_TRSWB               		0x40
+#define		bRFSI_ANTSW               		0x100
+#define		bRFSI_ANTSWB              		0x200
+#define		bRFSI_PAPE                			0x400
+#define		bRFSI_PAPE5G              		0x800
+#define		bBandSelect               			0x1
+#define		bHTSIG2_GI                			0x80
+#define		bHTSIG2_Smoothing         		0x01
+#define		bHTSIG2_Sounding          		0x02
+#define		bHTSIG2_Aggreaton         		0x08
+#define		bHTSIG2_STBC              		0x30
+#define		bHTSIG2_AdvCoding         		0x40
+#define		bHTSIG2_NumOfHTLTF        	0x300
+#define		bHTSIG2_CRC8              		0x3fc
+#define		bHTSIG1_MCS               		0x7f
+#define		bHTSIG1_BandWidth         		0x80
+#define		bHTSIG1_HTLength          		0xffff
+#define		bLSIG_Rate                			0xf
+#define		bLSIG_Reserved            		0x10
+#define		bLSIG_Length              		0x1fffe
+#define		bLSIG_Parity              			0x20
+#define		bCCKRxPhase               		0x4
+#if (RTL92SE_FPGA_VERIFY == 1)
+#define		bLSSIReadAddress          		0x3f000000   //LSSI "Read" Address	// Reg 0x824 rFPGA0_XA_HSSIParameter2
+#else
+#define		bLSSIReadAddress          		0x7f800000   // T65 RF
+#endif
+#define		bLSSIReadEdge             		0x80000000   //LSSI "Read" edge signal
+#if (RTL92SE_FPGA_VERIFY == 1)
+#define		bLSSIReadBackData         		0xfff		// Reg 0x8a0 rFPGA0_XA_LSSIReadBack
+#else
+#define		bLSSIReadBackData         		0xfffff		// T65 RF
+#endif
+#define		bLSSIReadOKFlag           		0x1000	// Useless now
+#define		bCCKSampleRate            		0x8       //0: 44MHz, 1:88MHz
+#define		bRegulator0Standby        		0x1
+#define		bRegulatorPLLStandby      		0x2
+#define		bRegulator1Standby        		0x4
+#define		bPLLPowerUp               		0x8
+#define		bDPLLPowerUp              		0x10
+#define		bDA10PowerUp              		0x20
+#define		bAD7PowerUp               		0x200
+#define		bDA6PowerUp               		0x2000
+#define		bXtalPowerUp              		0x4000
+#define		b40MDClkPowerUP           		0x8000
+#define		bDA6DebugMode             		0x20000
+#define		bDA6Swing                 			0x380000
+
+#define		bADClkPhase               		0x4000000	// Reg 0x880 rFPGA0_AnalogParameter1 20/40 CCK support switch 40/80 BB MHZ
+
+#define		b80MClkDelay              		0x18000000	// Useless
+#define		bAFEWatchDogEnable        		0x20000000
+
+#define		bXtalCap01                			0xc0000000	// Reg 0x884 rFPGA0_AnalogParameter2 Crystal cap
+#define		bXtalCap23                			0x3
+#define		bXtalCap92x					0x0f000000
+#define 		bXtalCap                			0x0f000000
+
+#define		bIntDifClkEnable          		0x400	// Useless
+#define		bExtSigClkEnable         	 	0x800
+#define		bBandgapMbiasPowerUp      	0x10000
+#define		bAD11SHGain               		0xc0000
+#define		bAD11InputRange           		0x700000
+#define		bAD11OPCurrent            		0x3800000
+#define		bIPathLoopback            		0x4000000
+#define		bQPathLoopback            		0x8000000
+#define		bAFELoopback              		0x10000000
+#define		bDA10Swing                		0x7e0
+#define		bDA10Reverse              		0x800
+#define		bDAClkSource              		0x1000
+#define		bAD7InputRange            		0x6000
+#define		bAD7Gain                  			0x38000
+#define		bAD7OutputCMMode          		0x40000
+#define		bAD7InputCMMode           		0x380000
+#define		bAD7Current               			0xc00000
+#define		bRegulatorAdjust          		0x7000000
+#define		bAD11PowerUpAtTx          		0x1
+#define		bDA10PSAtTx               		0x10
+#define		bAD11PowerUpAtRx          		0x100
+#define		bDA10PSAtRx               		0x1000
+#define		bCCKRxAGCFormat           		0x200
+#define		bPSDFFTSamplepPoint       		0xc000
+#define		bPSDAverageNum            		0x3000
+#define		bIQPathControl            		0xc00
+#define		bPSDFreq                  			0x3ff
+#define		bPSDAntennaPath           		0x30
+#define		bPSDIQSwitch              		0x40
+#define		bPSDRxTrigger             		0x400000
+#define		bPSDTxTrigger             		0x80000000
+#define		bPSDSineToneScale        		0x7f000000
+#define		bPSDReport                			0xffff
+
+// 3. Page9(0x900)
+#define		bOFDMTxSC                 		0x30000000	// Useless
+#define		bCCKTxOn                  			0x1
+#define		bOFDMTxOn                 		0x2
+#define		bDebugPage                		0xfff  //reset debug page and also HWord, LWord
+#define		bDebugItem                		0xff   //reset debug page and LWord
+#define		bAntL              	       		0x10
+#define		bAntNonHT           	      			0x100
+#define		bAntHT1               			0x1000
+#define		bAntHT2                   			0x10000
+#define		bAntHT1S1                 			0x100000
+#define		bAntNonHTS1               		0x1000000
+
+// 4. PageA(0xA00)
+#define		bCCKBBMode                		0x3	// Useless
+#define		bCCKTxPowerSaving         		0x80
+#define		bCCKRxPowerSaving         		0x40
+
+#define		bCCKSideBand              		0x10	// Reg 0xa00 rCCK0_System 20/40 switch
+
+#define		bCCKScramble              		0x8	// Useless
+#define		bCCKAntDiversity    		      	0x8000
+#define		bCCKCarrierRecovery   	    	0x4000
+#define		bCCKTxRate           		     	0x3000
+#define		bCCKDCCancel             	 	0x0800
+#define		bCCKISICancel             		0x0400
+#define		bCCKMatchFilter           		0x0200
+#define		bCCKEqualizer             		0x0100
+#define		bCCKPreambleDetect       	 	0x800000
+#define		bCCKFastFalseCCA          		0x400000
+#define		bCCKChEstStart            		0x300000
+#define		bCCKCCACount              		0x080000
+#define		bCCKcs_lim                			0x070000
+#define		bCCKBistMode              		0x80000000
+#define		bCCKCCAMask             	  	0x40000000
+#define		bCCKTxDACPhase         	   	0x4
+#define		bCCKRxADCPhase         	   	0x20000000   //r_rx_clk
+#define		bCCKr_cp_mode0         	   	0x0100
+#define		bCCKTxDCOffset           	 	0xf0
+#define		bCCKRxDCOffset           	 	0xf
+#define		bCCKCCAMode              	 	0xc000
+#define		bCCKFalseCS_lim           		0x3f00
+#define		bCCKCS_ratio              		0xc00000
+#define		bCCKCorgBit_sel           		0x300000
+#define		bCCKPD_lim                			0x0f0000
+#define		bCCKNewCCA                		0x80000000
+#define		bCCKRxHPofIG              		0x8000
+#define		bCCKRxIG                  			0x7f00
+#define		bCCKLNAPolarity           		0x800000
+#define		bCCKRx1stGain             		0x7f0000
+#define		bCCKRFExtend              		0x20000000 //CCK Rx Iinital gain polarity
+#define		bCCKRxAGCSatLevel        	 	0x1f000000
+#define		bCCKRxAGCSatCount       	  	0xe0
+#define		bCCKRxRFSettle            		0x1f       //AGCsamp_dly
+#define		bCCKFixedRxAGC           	 	0x8000
+//#define bCCKRxAGCFormat         	 	0x4000   //remove to HSSI register 0x824
+#define		bCCKAntennaPolarity      	 	0x2000
+#define		bCCKTxFilterType          		0x0c00
+#define		bCCKRxAGCReportType   	   	0x0300
+#define		bCCKRxDAGCEn              		0x80000000
+#define		bCCKRxDAGCPeriod        	  	0x20000000
+#define		bCCKRxDAGCSatLevel     	   	0x1f000000
+#define		bCCKTimingRecovery       	 	0x800000
+#define		bCCKTxC0                  			0x3f0000
+#define		bCCKTxC1                  			0x3f000000
+#define		bCCKTxC2                  			0x3f
+#define		bCCKTxC3                  			0x3f00
+#define		bCCKTxC4                  			0x3f0000
+#define		bCCKTxC5                  			0x3f000000
+#define		bCCKTxC6                  			0x3f
+#define		bCCKTxC7                  			0x3f00
+#define		bCCKDebugPort             		0xff0000
+#define		bCCKDACDebug              		0x0f000000
+#define		bCCKFalseAlarmEnable      		0x8000
+#define		bCCKFalseAlarmRead        		0x4000
+#define		bCCKTRSSI                 			0x7f
+#define		bCCKRxAGCReport           		0xfe
+#define		bCCKRxReport_AntSel       		0x80000000
+#define		bCCKRxReport_MFOff        		0x40000000
+#define		bCCKRxRxReport_SQLoss     	0x20000000
+#define		bCCKRxReport_Pktloss      		0x10000000
+#define		bCCKRxReport_Lockedbit    	0x08000000
+#define		bCCKRxReport_RateError    	0x04000000
+#define		bCCKRxReport_RxRate       		0x03000000
+#define		bCCKRxFACounterLower      	0xff
+#define		bCCKRxFACounterUpper      	0xff000000
+#define		bCCKRxHPAGCStart          		0xe000
+#define		bCCKRxHPAGCFinal          		0x1c00
+#define		bCCKRxFalseAlarmEnable    	0x8000
+#define		bCCKFACounterFreeze       		0x4000
+#define		bCCKTxPathSel             		0x10000000
+#define		bCCKDefaultRxPath         		0xc000000
+#define		bCCKOptionRxPath          		0x3000000
+
+// 5. PageC(0xC00)
+#define		bNumOfSTF                			0x3	// Useless
+#define		bShift_L                 			0xc0
+#define		bGI_TH                   			0xc
+#define		bRxPathA                 			0x1
+#define		bRxPathB                 			0x2
+#define		bRxPathC                 			0x4
+#define		bRxPathD                 			0x8
+#define		bTxPathA                 			0x1
+#define		bTxPathB                 			0x2
+#define		bTxPathC                 			0x4
+#define		bTxPathD                 			0x8
+#define		bTRSSIFreq               			0x200
+#define		bADCBackoff              			0x3000
+#define		bDFIRBackoff             			0xc000
+#define		bTRSSILatchPhase         		0x10000
+#define		bRxIDCOffset             			0xff
+#define		bRxQDCOffset             			0xff00
+#define		bRxDFIRMode              		0x1800000
+#define		bRxDCNFType              		0xe000000
+#define		bRXIQImb_A               			0x3ff
+#define		bRXIQImb_B               			0xfc00
+#define		bRXIQImb_C               			0x3f0000
+#define		bRXIQImb_D               			0xffc00000
+#define		bDC_dc_Notch             		0x60000
+#define		bRxNBINotch              			0x1f000000
+#define		bPD_TH                   			0xf
+#define		bPD_TH_Opt2              		0xc000
+#define		bPWED_TH                 			0x700
+#define		bIfMF_Win_L              			0x800
+#define		bPD_Option               			0x1000
+#define		bMF_Win_L                			0xe000
+#define		bBW_Search_L             		0x30000
+#define		bwin_enh_L               			0xc0000
+#define		bBW_TH                   			0x700000
+#define		bED_TH2                  			0x3800000
+#define		bBW_option               			0x4000000
+#define		bRatio_TH                			0x18000000
+#define		bWindow_L                			0xe0000000
+#define		bSBD_Option              			0x1
+#define		bFrame_TH                			0x1c
+#define		bFS_Option               			0x60
+#define		bDC_Slope_check          		0x80
+#define		bFGuard_Counter_DC_L     		0xe00
+#define		bFrame_Weight_Short      		0x7000
+#define		bSub_Tune                			0xe00000
+#define		bFrame_DC_Length         		0xe000000
+#define		bSBD_start_offset        		0x30000000
+#define		bFrame_TH_2              		0x7
+#define		bFrame_GI2_TH            		0x38
+#define		bGI2_Sync_en             		0x40
+#define		bSarch_Short_Early       		0x300
+#define		bSarch_Short_Late        		0xc00
+#define		bSarch_GI2_Late          		0x70000
+#define		bCFOAntSum               		0x1
+#define		bCFOAcc                  			0x2
+#define		bCFOStartOffset          		0xc
+#define		bCFOLookBack             		0x70
+#define		bCFOSumWeight            		0x80
+#define		bDAGCEnable              			0x10000
+#define		bTXIQImb_A               			0x3ff
+#define		bTXIQImb_B               			0xfc00
+#define		bTXIQImb_C               			0x3f0000
+#define		bTXIQImb_D               			0xffc00000
+#define		bTxIDCOffset             			0xff
+#define		bTxQDCOffset             			0xff00
+#define		bTxDFIRMode              		0x10000
+#define		bTxPesudoNoiseOn         		0x4000000
+#define		bTxPesudoNoise_A         		0xff
+#define		bTxPesudoNoise_B         		0xff00
+#define		bTxPesudoNoise_C         		0xff0000
+#define		bTxPesudoNoise_D         		0xff000000
+#define		bCCADropOption           		0x20000
+#define		bCCADropThres            		0xfff00000
+#define		bEDCCA_H                 			0xf
+#define		bEDCCA_L                 			0xf0
+#define		bLambda_ED               0x300
+#define		bRxInitialGain           0x7f
+#define		bRxAntDivEn              0x80
+#define		bRxAGCAddressForLNA      0x7f00
+#define		bRxHighPowerFlow         0x8000
+#define		bRxAGCFreezeThres        0xc0000
+#define		bRxFreezeStep_AGC1       0x300000
+#define		bRxFreezeStep_AGC2       0xc00000
+#define		bRxFreezeStep_AGC3       0x3000000
+#define		bRxFreezeStep_AGC0       0xc000000
+#define		bRxRssi_Cmp_En           0x10000000
+#define		bRxQuickAGCEn            0x20000000
+#define		bRxAGCFreezeThresMode    0x40000000
+#define		bRxOverFlowCheckType     0x80000000
+#define		bRxAGCShift              0x7f
+#define		bTRSW_Tri_Only           0x80
+#define		bPowerThres              0x300
+#define		bRxAGCEn                 0x1
+#define		bRxAGCTogetherEn         0x2
+#define		bRxAGCMin                0x4
+#define		bRxHP_Ini                0x7
+#define		bRxHP_TRLNA              0x70
+#define		bRxHP_RSSI               0x700
+#define		bRxHP_BBP1               0x7000
+#define		bRxHP_BBP2               0x70000
+#define		bRxHP_BBP3               0x700000
+#define		bRSSI_H                  0x7f0000     //the threshold for high power
+#define		bRSSI_Gen                0x7f000000   //the threshold for ant diversity
+#define		bRxSettle_TRSW           0x7
+#define		bRxSettle_LNA            0x38
+#define		bRxSettle_RSSI           0x1c0
+#define		bRxSettle_BBP            0xe00
+#define		bRxSettle_RxHP           0x7000
+#define		bRxSettle_AntSW_RSSI     0x38000
+#define		bRxSettle_AntSW          0xc0000
+#define		bRxProcessTime_DAGC      0x300000
+#define		bRxSettle_HSSI           0x400000
+#define		bRxProcessTime_BBPPW     0x800000
+#define		bRxAntennaPowerShift     0x3000000
+#define		bRSSITableSelect         0xc000000
+#define		bRxHP_Final              0x7000000
+#define		bRxHTSettle_BBP          0x7
+#define		bRxHTSettle_HSSI         0x8
+#define		bRxHTSettle_RxHP         0x70
+#define		bRxHTSettle_BBPPW        0x80
+#define		bRxHTSettle_Idle         0x300
+#define		bRxHTSettle_Reserved     0x1c00
+#define		bRxHTRxHPEn              0x8000
+#define		bRxHTAGCFreezeThres      0x30000
+#define		bRxHTAGCTogetherEn       0x40000
+#define		bRxHTAGCMin              0x80000
+#define		bRxHTAGCEn               0x100000
+#define		bRxHTDAGCEn              0x200000
+#define		bRxHTRxHP_BBP            0x1c00000
+#define		bRxHTRxHP_Final          0xe0000000
+#define		bRxPWRatioTH             0x3
+#define		bRxPWRatioEn             0x4
+#define		bRxMFHold                0x3800
+#define		bRxPD_Delay_TH1          0x38
+#define		bRxPD_Delay_TH2          0x1c0
+#define		bRxPD_DC_COUNT_MAX       0x600
+//#define bRxMF_Hold               0x3800
+#define		bRxPD_Delay_TH           0x8000
+#define		bRxProcess_Delay         0xf0000
+#define		bRxSearchrange_GI2_Early 0x700000
+#define		bRxFrame_Guard_Counter_L 0x3800000
+#define		bRxSGI_Guard_L           0xc000000
+#define		bRxSGI_Search_L          0x30000000
+#define		bRxSGI_TH                0xc0000000
+#define		bDFSCnt0                 0xff
+#define		bDFSCnt1                 0xff00
+#define		bDFSFlag                 0xf0000
+#define		bMFWeightSum             0x300000
+#define		bMinIdxTH                0x7f000000
+#define		bDAFormat                0x40000
+#define		bTxChEmuEnable           0x01000000
+#define		bTRSWIsolation_A         0x7f
+#define		bTRSWIsolation_B         0x7f00
+#define		bTRSWIsolation_C         0x7f0000
+#define		bTRSWIsolation_D         0x7f000000
+#define		bExtLNAGain              0x7c00
+
+// 6. PageE(0xE00)
+#define		bSTBCEn                  0x4	// Useless
+#define		bAntennaMapping          0x10
+#define		bNss                     0x20
+#define		bCFOAntSumD              0x200
+#define		bPHYCounterReset         0x8000000
+#define		bCFOReportGet            0x4000000
+#define		bOFDMContinueTx          0x10000000
+#define		bOFDMSingleCarrier       0x20000000
+#define		bOFDMSingleTone          0x40000000
+//#define bRxPath1                 0x01
+//#define bRxPath2                 0x02
+//#define bRxPath3                 0x04
+//#define bRxPath4                 0x08
+//#define bTxPath1                 0x10
+//#define bTxPath2                 0x20
+#define		bHTDetect                0x100
+#define		bCFOEn                   0x10000
+#define		bCFOValue                0xfff00000
+#define		bSigTone_Re              0x3f
+#define		bSigTone_Im              0x7f00
+#define		bCounter_CCA             0xffff
+#define		bCounter_ParityFail      0xffff0000
+#define		bCounter_RateIllegal     0xffff
+#define		bCounter_CRC8Fail        0xffff0000
+#define		bCounter_MCSNoSupport    0xffff
+#define		bCounter_FastSync        0xffff
+#define		bShortCFO                0xfff
+#define		bShortCFOTLength         12   //total
+#define		bShortCFOFLength         11   //fraction
+#define		bLongCFO                 0x7ff
+#define		bLongCFOTLength          11
+#define		bLongCFOFLength          11
+#define		bTailCFO                 0x1fff
+#define		bTailCFOTLength          13
+#define		bTailCFOFLength          12
+#define		bmax_en_pwdB             0xffff
+#define		bCC_power_dB             0xffff0000
+#define		bnoise_pwdB              0xffff
+#define		bPowerMeasTLength        10
+#define		bPowerMeasFLength        3
+#define		bRx_HT_BW                0x1
+#define		bRxSC                    0x6
+#define		bRx_HT                   0x8
+#define		bNB_intf_det_on          0x1
+#define		bIntf_win_len_cfg        0x30
+#define		bNB_Intf_TH_cfg          0x1c0
+#define		bRFGain                  0x3f
+#define		bTableSel                0x40
+#define		bTRSW                    0x80
+#define		bRxSNR_A                 0xff
+#define		bRxSNR_B                 0xff00
+#define		bRxSNR_C                 0xff0000
+#define		bRxSNR_D                 0xff000000
+#define		bSNREVMTLength           8
+#define		bSNREVMFLength           1
+#define		bCSI1st                  0xff
+#define		bCSI2nd                  0xff00
+#define		bRxEVM1st                0xff0000
+#define		bRxEVM2nd                0xff000000
+#define		bSIGEVM                  0xff
+#define		bPWDB                    0xff00
+#define		bSGIEN                   0x10000
+
+#define		bSFactorQAM1             0xf	// Useless
+#define		bSFactorQAM2             0xf0
+#define		bSFactorQAM3             0xf00
+#define		bSFactorQAM4             0xf000
+#define		bSFactorQAM5             0xf0000
+#define		bSFactorQAM6             0xf0000
+#define		bSFactorQAM7             0xf00000
+#define		bSFactorQAM8             0xf000000
+#define		bSFactorQAM9             0xf0000000
+#define		bCSIScheme               0x100000
+
+#define		bNoiseLvlTopSet          0x3	// Useless
+#define		bChSmooth                0x4
+#define		bChSmoothCfg1            0x38
+#define		bChSmoothCfg2            0x1c0
+#define		bChSmoothCfg3            0xe00
+#define		bChSmoothCfg4            0x7000
+#define		bMRCMode                 0x800000
+#define		bTHEVMCfg                0x7000000
+
+#define		bLoopFitType             0x1	// Useless
+#define		bUpdCFO                  0x40
+#define		bUpdCFOOffData           0x80
+#define		bAdvUpdCFO               0x100
+#define		bAdvTimeCtrl             0x800
+#define		bUpdClko                 0x1000
+#define		bFC                      0x6000
+#define		bTrackingMode            0x8000
+#define		bPhCmpEnable             0x10000
+#define		bUpdClkoLTF              0x20000
+#define		bComChCFO                0x40000
+#define		bCSIEstiMode             0x80000
+#define		bAdvUpdEqz               0x100000
+#define		bUChCfg                  0x7000000
+#define		bUpdEqz                  0x8000000
+
+#define		bTxAGCRate18_06			0x7f7f7f7f	// Useless
+#define		bTxAGCRate54_24			0x7f7f7f7f
+#define		bTxAGCRateMCS32			0x7f
+#define		bTxAGCRateCCK			0x7f00
+#define		bTxAGCRateMCS3_MCS0		0x7f7f7f7f
+#define		bTxAGCRateMCS7_MCS4		0x7f7f7f7f
+#define		bTxAGCRateMCS11_MCS8	0x7f7f7f7f
+#define		bTxAGCRateMCS15_MCS12	0x7f7f7f7f
+
+//Rx Pseduo noise
+#define		bRxPesudoNoiseOn         0x20000000	// Useless
+#define		bRxPesudoNoise_A         0xff
+#define		bRxPesudoNoise_B         0xff00
+#define		bRxPesudoNoise_C         0xff0000
+#define		bRxPesudoNoise_D         0xff000000
+#define		bPesudoNoiseState_A      0xffff
+#define		bPesudoNoiseState_B      0xffff0000
+#define		bPesudoNoiseState_C      0xffff
+#define		bPesudoNoiseState_D      0xffff0000
+
+//7. RF Register
+//Zebra1
+#define		bZebra1_HSSIEnable        0x8		// Useless
+#define		bZebra1_TRxControl        0xc00
+#define		bZebra1_TRxGainSetting    0x07f
+#define		bZebra1_RxCorner          0xc00
+#define		bZebra1_TxChargePump      0x38
+#define		bZebra1_RxChargePump      0x7
+#define		bZebra1_ChannelNum        0xf80
+#define		bZebra1_TxLPFBW           0x400
+#define		bZebra1_RxLPFBW           0x600
+
+//Zebra4
+#define		bRTL8256RegModeCtrl1      0x100	// Useless
+#define		bRTL8256RegModeCtrl0      0x40
+#define		bRTL8256_TxLPFBW          0x18
+#define		bRTL8256_RxLPFBW          0x600
+
+//RTL8258
+#define		bRTL8258_TxLPFBW          0xc	// Useless
+#define		bRTL8258_RxLPFBW          0xc00
+#define		bRTL8258_RSSILPFBW        0xc0
+
+
+//
+// Other Definition
+//
+
+//byte endable for sb_write
+#define		bByte0                    0x1	// Useless
+#define		bByte1                    0x2
+#define		bByte2                    0x4
+#define		bByte3                    0x8
+#define		bWord0                    0x3
+#define		bWord1                    0xc
+#define		bDWord                    0xf
+
+//for PutRegsetting & GetRegSetting BitMask
+#define		bMaskByte0		0xff	// Reg 0xc50 rOFDM0_XAAGCCore~0xC6f
+#define		bMaskByte1		0xff00
+#define		bMaskByte2		0xff0000
+#define		bMaskByte3		0xff000000
+#define		bMaskHWord		0xffff0000
+#define		bMaskLWord		0x0000ffff
+#define		bMaskDWord		0xffffffff
+#define		bMaskH4Bits		0xf0000000
+#define 	bMaskOFDM_D		0xffc00000
+#define		bMaskCCK		0x3f3f3f3f
+#define		bMask12Bits		0xfff
+
+//for PutRFRegsetting & GetRFRegSetting BitMask
+#if (RTL92SE_FPGA_VERIFY == 1)
+//#define		bMask12Bits               0xfff	// RF Reg mask bits
+//#define		bMask20Bits               0xfff	// RF Reg mask bits T65 RF
+#define 		bRFRegOffsetMask	0xfff
+#else
+//#define		bMask12Bits               0xfffff	// RF Reg mask bits
+//#define		bMask20Bits               0xfffff	// RF Reg mask bits T65 RF
+#define 		bRFRegOffsetMask	0xfffff
+#endif
+#define		bEnable                   0x1	// Useless
+#define		bDisable                  0x0
+
+#define		LeftAntenna               0x0	// Useless
+#define		RightAntenna              0x1
+
+#define		tCheckTxStatus            500   //500ms // Useless
+#define		tUpdateRxCounter          100   //100ms
+
+#define		rateCCK     0	// Useless
+#define		rateOFDM    1
+#define		rateHT      2
+
+//define Register-End
+#define		bPMAC_End                 0x1ff	// Useless
+#define		bFPGAPHY0_End             0x8ff
+#define		bFPGAPHY1_End             0x9ff
+#define		bCCKPHY0_End              0xaff
+#define		bOFDMPHY0_End             0xcff
+#define		bOFDMPHY1_End             0xdff
+
+//define max debug item in each debug page
+//#define bMaxItem_FPGA_PHY0        0x9
+//#define bMaxItem_FPGA_PHY1        0x3
+//#define bMaxItem_PHY_11B          0x16
+//#define bMaxItem_OFDM_PHY0        0x29
+//#define bMaxItem_OFDM_PHY1        0x0
+
+#define		bPMACControl	0x0		// Useless
+#define		bWMACControl	0x1
+#define		bWNICControl	0x2
+
+#if 0
+#define		ANTENNA_A	0x1	// Useless
+#define		ANTENNA_B	0x2
+#define		ANTENNA_AB	0x3	// ANTENNA_A|ANTENNA_B
+
+#define		ANTENNA_C	0x4
+#define		ANTENNA_D	0x8
+#endif
+
+#define RCR_AAP			BIT(0)				// accept all physical address
+#define RCR_APM			BIT(1)				// accept physical match
+#define RCR_AM			BIT(2)				// accept multicast
+#define RCR_AB			BIT(3)				// accept broadcast
+#define RCR_ACRC32		BIT(5)				// accept error packet
+#define RCR_9356SEL		BIT(6)
+#define RCR_AICV		BIT(12)				// Accept ICV error packet
+#define RCR_RXFTH0		(BIT(13)|BIT(14)|BIT(15))	// Rx FIFO threshold
+#define RCR_ADF			BIT(18)				// Accept Data(frame type) frame
+#define RCR_ACF			BIT(19)				// Accept control frame
+#define RCR_AMF			BIT(20)				// Accept management frame
+#define RCR_ADD3		BIT(21)
+#define RCR_APWRMGT		BIT(22)				// Accept power management packet
+#define RCR_CBSSID		BIT(23)				// Accept BSSID match packet
+#define RCR_ENMARP		BIT(28)				// enable mac auto reset phy
+#define RCR_EnCS1		BIT(29)				// enable carrier sense method 1
+#define RCR_EnCS2		BIT(30)				// enable carrier sense method 2
+#define RCR_OnlyErlPkt		BIT(31)				// Rx Early mode is performed for packet size greater than 1536
+
+/*--------------------------Define Parameters-------------------------------*/
+
+
+#endif	//__INC_HAL8192SPHYREG_H
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_p2p.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_p2p.h
new file mode 100644
index 000000000000..b230faf453e5
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_p2p.h
@@ -0,0 +1,160 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_P2P_H_
+#define __RTW_P2P_H_
+
+#include <drv_types.h>
+
+u32 build_beacon_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_probe_resp_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_prov_disc_request_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf, u8* pssid, u8 ussidlen, u8* pdev_raddr );
+u32 build_assoc_resp_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf, u8 status_code);
+u32 build_deauth_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+#ifdef CONFIG_WFD
+u32 build_probe_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_probe_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf, u8 tunneled);
+u32 build_beacon_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_nego_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_nego_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_nego_confirm_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_invitation_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_invitation_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_assoc_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_assoc_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_provdisc_req_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+u32 build_provdisc_resp_wfd_ie(struct wifidirect_info *pwdinfo, u8 *pbuf);
+#endif //CONFIG_WFD
+
+u32 process_probe_req_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pframe, uint len);
+u32 process_assoc_req_p2p_ie(struct wifidirect_info *pwdinfo, u8 *pframe, uint len, struct sta_info *psta);
+u32 process_p2p_devdisc_req(struct wifidirect_info *pwdinfo, u8 *pframe, uint len);
+u32 process_p2p_devdisc_resp(struct wifidirect_info *pwdinfo, u8 *pframe, uint len);
+u8 process_p2p_provdisc_req(struct wifidirect_info *pwdinfo,  u8 *pframe, uint len);
+u8 process_p2p_provdisc_resp(struct wifidirect_info *pwdinfo,  u8 *pframe);
+u8 process_p2p_group_negotation_req( struct wifidirect_info *pwdinfo, u8 *pframe, uint len );
+u8 process_p2p_group_negotation_resp( struct wifidirect_info *pwdinfo, u8 *pframe, uint len );
+u8 process_p2p_group_negotation_confirm( struct wifidirect_info *pwdinfo, u8 *pframe, uint len );
+u8 process_p2p_presence_req(struct wifidirect_info *pwdinfo, u8 *pframe, uint len);
+
+void p2p_protocol_wk_hdl(_adapter *padapter, int intCmdType);
+
+#ifdef CONFIG_P2P_PS
+void	process_p2p_ps_ie(PADAPTER padapter, u8 *IEs, u32 IELength);
+void	p2p_ps_wk_hdl(_adapter *padapter, u8 p2p_ps_state);
+u8	p2p_ps_wk_cmd(_adapter*padapter, u8 p2p_ps_state, u8 enqueue);
+#endif // CONFIG_P2P_PS
+
+#ifdef CONFIG_IOCTL_CFG80211
+void rtw_init_cfg80211_wifidirect_info( _adapter*	padapter);
+int rtw_p2p_check_frames(_adapter *padapter, const u8 *buf, u32 len, u8 tx);
+void rtw_append_wfd_ie(_adapter *padapter, u8 *buf, u32 *len);
+#endif //CONFIG_IOCTL_CFG80211
+
+void reset_global_wifidirect_info( _adapter* padapter );
+int rtw_init_wifi_display_info(_adapter* padapter);
+void rtw_init_wifidirect_timers(_adapter* padapter);
+void rtw_init_wifidirect_addrs(_adapter* padapter, u8 *dev_addr, u8 *iface_addr);
+void init_wifidirect_info( _adapter* padapter, enum P2P_ROLE role);
+int rtw_p2p_enable(_adapter *padapter, enum P2P_ROLE role);
+
+static inline void _rtw_p2p_set_state(struct wifidirect_info *wdinfo, enum P2P_STATE state)
+{
+	if(wdinfo->p2p_state != state) {
+		//wdinfo->pre_p2p_state = wdinfo->p2p_state;
+		wdinfo->p2p_state = state;
+	}
+}
+static inline void _rtw_p2p_set_pre_state(struct wifidirect_info *wdinfo, enum P2P_STATE state)
+{
+	if(wdinfo->pre_p2p_state != state) {
+		wdinfo->pre_p2p_state = state;
+	}
+}
+#if 0
+static inline void _rtw_p2p_restore_state(struct wifidirect_info *wdinfo)
+{
+	if(wdinfo->pre_p2p_state != -1) {
+		wdinfo->p2p_state = wdinfo->pre_p2p_state;
+		wdinfo->pre_p2p_state = -1;
+	}
+}
+#endif
+static inline void _rtw_p2p_set_role(struct wifidirect_info *wdinfo, enum P2P_ROLE role)
+{
+	if(wdinfo->role != role) {
+		wdinfo->role = role;
+	}
+}
+static inline int _rtw_p2p_state(struct wifidirect_info *wdinfo)
+{
+	return wdinfo->p2p_state;
+}
+static inline int _rtw_p2p_pre_state(struct wifidirect_info *wdinfo)
+{
+	return wdinfo->pre_p2p_state;
+}
+static inline int _rtw_p2p_role(struct wifidirect_info *wdinfo)
+{
+	return wdinfo->role;
+}
+static inline bool _rtw_p2p_chk_state(struct wifidirect_info *wdinfo, enum P2P_STATE state)
+{
+	return wdinfo->p2p_state == state;
+}
+static inline bool _rtw_p2p_chk_role(struct wifidirect_info *wdinfo, enum P2P_ROLE role)
+{
+	return wdinfo->role == role;
+}
+
+#ifdef CONFIG_DBG_P2P
+void dbg_rtw_p2p_set_state(struct wifidirect_info *wdinfo, enum P2P_STATE state, const char *caller, int line);
+void dbg_rtw_p2p_set_pre_state(struct wifidirect_info *wdinfo, enum P2P_STATE state, const char *caller, int line);
+//void dbg_rtw_p2p_restore_state(struct wifidirect_info *wdinfo, const char *caller, int line);
+void dbg_rtw_p2p_set_role(struct wifidirect_info *wdinfo, enum P2P_ROLE role, const char *caller, int line);
+#define rtw_p2p_set_state(wdinfo, state) dbg_rtw_p2p_set_state(wdinfo, state, __FUNCTION__, __LINE__)
+#define rtw_p2p_set_pre_state(wdinfo, state) dbg_rtw_p2p_set_pre_state(wdinfo, state, __FUNCTION__, __LINE__)
+#define rtw_p2p_set_role(wdinfo, role) dbg_rtw_p2p_set_role(wdinfo, role, __FUNCTION__, __LINE__)
+//#define rtw_p2p_restore_state(wdinfo) dbg_rtw_p2p_restore_state(wdinfo, __FUNCTION__, __LINE__)
+#else //CONFIG_DBG_P2P
+#define rtw_p2p_set_state(wdinfo, state) _rtw_p2p_set_state(wdinfo, state)
+#define rtw_p2p_set_pre_state(wdinfo, state) _rtw_p2p_set_pre_state(wdinfo, state)
+#define rtw_p2p_set_role(wdinfo, role) _rtw_p2p_set_role(wdinfo, role)
+//#define rtw_p2p_restore_state(wdinfo) _rtw_p2p_restore_state(wdinfo)
+#endif //CONFIG_DBG_P2P
+
+#define rtw_p2p_state(wdinfo) _rtw_p2p_state(wdinfo)
+#define rtw_p2p_pre_state(wdinfo) _rtw_p2p_pre_state(wdinfo)
+#define rtw_p2p_role(wdinfo) _rtw_p2p_role(wdinfo)
+#define rtw_p2p_chk_state(wdinfo, state) _rtw_p2p_chk_state(wdinfo, state)
+#define rtw_p2p_chk_role(wdinfo, role) _rtw_p2p_chk_role(wdinfo, role)
+
+#define rtw_p2p_findphase_ex_set(wdinfo, value) \
+	(wdinfo)->find_phase_state_exchange_cnt = (value)
+
+//is this find phase exchange for social channel scan?
+#define rtw_p2p_findphase_ex_is_social(wdinfo)   \
+	(wdinfo)->find_phase_state_exchange_cnt >= P2P_FINDPHASE_EX_SOCIAL_FIRST
+
+//should we need find phase exchange anymore?
+#define rtw_p2p_findphase_ex_is_needed(wdinfo) \
+	((wdinfo)->find_phase_state_exchange_cnt < P2P_FINDPHASE_EX_MAX && \
+	(wdinfo)->find_phase_state_exchange_cnt != P2P_FINDPHASE_EX_NONE)
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_pwrctrl.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_pwrctrl.h
new file mode 100644
index 000000000000..a867da2430bf
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_pwrctrl.h
@@ -0,0 +1,362 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_PWRCTRL_H_
+#define __RTW_PWRCTRL_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#ifdef CONFIG_HAS_EARLYSUSPEND
+#include <linux/earlysuspend.h>
+#endif //CONFIG_HAS_EARLYSUSPEND
+
+
+#define FW_PWR0	0
+#define FW_PWR1 	1
+#define FW_PWR2 	2
+#define FW_PWR3 	3
+
+
+#define HW_PWR0	7
+#define HW_PWR1 	6
+#define HW_PWR2 	2
+#define HW_PWR3	0
+#define HW_PWR4	8
+
+#define FW_PWRMSK	0x7
+
+
+#define XMIT_ALIVE	BIT(0)
+#define RECV_ALIVE	BIT(1)
+#define CMD_ALIVE	BIT(2)
+#define EVT_ALIVE	BIT(3)
+
+
+enum Power_Mgnt
+{
+	PS_MODE_ACTIVE	= 0	,
+	PS_MODE_MIN			,
+	PS_MODE_MAX			,
+	PS_MODE_DTIM			,
+	PS_MODE_VOIP			,
+	PS_MODE_UAPSD_WMM	,
+	PS_MODE_UAPSD			,
+	PS_MODE_IBSS			,
+	PS_MODE_WWLAN		,
+	PM_Radio_Off			,
+	PM_Card_Disable		,
+	PS_MODE_NUM
+};
+
+
+/*
+	BIT[2:0] = HW state
+	BIT[3] = Protocol PS state,   0: register active state , 1: register sleep state
+	BIT[4] = sub-state
+*/
+
+#define PS_DPS				BIT(0)
+#define PS_LCLK				(PS_DPS)
+#define PS_RF_OFF			BIT(1)
+#define PS_ALL_ON			BIT(2)
+#define PS_ST_ACTIVE		BIT(3)
+
+#define PS_ISR_ENABLE		BIT(4)
+#define PS_IMR_ENABLE		BIT(5)
+#define PS_ACK				BIT(6)
+#define PS_TOGGLE			BIT(7)
+
+#define PS_STATE_MASK		(0x0F)
+#define PS_STATE_HW_MASK	(0x07)
+#define PS_SEQ_MASK			(0xc0)
+
+#define PS_STATE(x)		(PS_STATE_MASK & (x))
+#define PS_STATE_HW(x)	(PS_STATE_HW_MASK & (x))
+#define PS_SEQ(x)		(PS_SEQ_MASK & (x))
+
+#define PS_STATE_S0		(PS_DPS)
+#define PS_STATE_S1		(PS_LCLK)
+#define PS_STATE_S2		(PS_RF_OFF)
+#define PS_STATE_S3		(PS_ALL_ON)
+#define PS_STATE_S4		((PS_ST_ACTIVE) | (PS_ALL_ON))
+
+
+#define PS_IS_RF_ON(x)	((x) & (PS_ALL_ON))
+#define PS_IS_ACTIVE(x)	((x) & (PS_ST_ACTIVE))
+#define CLR_PS_STATE(x)	((x) = ((x) & (0xF0)))
+
+
+struct reportpwrstate_parm {
+	unsigned char mode;
+	unsigned char state; //the CPWM value
+	unsigned short rsvd;
+};
+
+
+typedef _sema _pwrlock;
+
+
+__inline static void _init_pwrlock(_pwrlock *plock)
+{
+	_rtw_init_sema(plock, 1);
+}
+
+__inline static void _free_pwrlock(_pwrlock *plock)
+{
+	_rtw_free_sema(plock);
+}
+
+
+__inline static void _enter_pwrlock(_pwrlock *plock)
+{
+	_rtw_down_sema(plock);
+}
+
+
+__inline static void _exit_pwrlock(_pwrlock *plock)
+{
+	_rtw_up_sema(plock);
+}
+
+#define LPS_DELAY_TIME	1*HZ // 1 sec
+
+#define EXE_PWR_NONE	0x01
+#define EXE_PWR_IPS		0x02
+#define EXE_PWR_LPS		0x04
+
+// RF state.
+typedef enum _rt_rf_power_state
+{
+	rf_on,		// RF is on after RFSleep or RFOff
+	rf_sleep,	// 802.11 Power Save mode
+	rf_off,		// HW/SW Radio OFF or Inactive Power Save
+	//=====Add the new RF state above this line=====//
+	rf_max
+}rt_rf_power_state;
+
+// RF Off Level for IPS or HW/SW radio off
+#define	RT_RF_OFF_LEVL_ASPM			BIT(0)	// PCI ASPM
+#define	RT_RF_OFF_LEVL_CLK_REQ		BIT(1)	// PCI clock request
+#define	RT_RF_OFF_LEVL_PCI_D3			BIT(2)	// PCI D3 mode
+#define	RT_RF_OFF_LEVL_HALT_NIC		BIT(3)	// NIC halt, re-initialize hw parameters
+#define	RT_RF_OFF_LEVL_FREE_FW		BIT(4)	// FW free, re-download the FW
+#define	RT_RF_OFF_LEVL_FW_32K		BIT(5)	// FW in 32k
+#define	RT_RF_PS_LEVEL_ALWAYS_ASPM	BIT(6)	// Always enable ASPM and Clock Req in initialization.
+#define	RT_RF_LPS_DISALBE_2R			BIT(30)	// When LPS is on, disable 2R if no packet is received or transmittd.
+#define	RT_RF_LPS_LEVEL_ASPM			BIT(31)	// LPS with ASPM
+
+#define	RT_IN_PS_LEVEL(ppsc, _PS_FLAG)		((ppsc->cur_ps_level & _PS_FLAG) ? _TRUE : _FALSE)
+#define	RT_CLEAR_PS_LEVEL(ppsc, _PS_FLAG)	(ppsc->cur_ps_level &= (~(_PS_FLAG)))
+#define	RT_SET_PS_LEVEL(ppsc, _PS_FLAG)		(ppsc->cur_ps_level |= _PS_FLAG)
+
+
+enum _PS_BBRegBackup_ {
+	PSBBREG_RF0 = 0,
+	PSBBREG_RF1,
+	PSBBREG_RF2,
+	PSBBREG_AFE0,
+	PSBBREG_TOTALCNT
+};
+
+enum { // for ips_mode
+	IPS_NONE=0,
+	IPS_NORMAL,
+	IPS_LEVEL_2,
+};
+
+struct pwrctrl_priv
+{
+	_pwrlock	lock;
+	volatile u8 rpwm; // requested power state for fw
+	volatile u8 cpwm; // fw current power state. updated when 1. read from HCPWM 2. driver lowers power level
+	volatile u8 tog; // toggling
+	volatile u8 cpwm_tog; // toggling
+	u8	pwr_mode;
+	u8	smart_ps;
+	u32 alives;
+
+	u8	b_hw_radio_off;
+	u8	reg_rfoff;
+	u8	reg_pdnmode; //powerdown mode
+	u32	rfoff_reason;
+
+	//RF OFF Level
+	u32	cur_ps_level;
+	u32	reg_rfps_level;
+
+
+
+#ifdef CONFIG_PCI_HCI
+	//just for PCIE ASPM
+	u8	b_support_aspm; // If it supports ASPM, Offset[560h] = 0x40, otherwise Offset[560h] = 0x00.
+	u8	b_support_backdoor;
+
+	//just for PCIE ASPM
+	u8	const_amdpci_aspm;
+#endif
+
+	uint 	ips_enter_cnts;
+	uint 	ips_leave_cnts;
+
+	u8	ips_mode;
+	u8	ips_mode_req; // used to accept the mode setting request, will update to ipsmode later
+	uint bips_processing;
+	u32 ips_deny_time; /* will deny IPS when system time is smaller than this */
+	u8 ps_processing; /* temporarily used to mark whether in rtw_ps_processor */
+
+	u8	bLeisurePs;
+	u8	LpsIdleCount;
+	u8	power_mgnt;
+	u8	bFwCurrentInPSMode;
+	u32	DelayLPSLastTimeStamp;
+
+	s32		pnp_current_pwr_state;
+	u8		pnp_bstop_trx;
+
+
+	u8		bInternalAutoSuspend;
+	u8		bInSuspend;
+	u8		bSupportRemoteWakeup;
+#ifdef CONFIG_WOWLAN
+	u8		wowlan_mode;
+	u8		wowlan_pattern;
+	u8		wowlan_magic;
+	u8		wowlan_unicast;
+	u8		wowlan_pattern_idx;
+	u32		wowlan_pattern_context[8][5];
+#endif // CONFIG_WOWLAN
+	_timer 	pwr_state_check_timer;
+	int		pwr_state_check_interval;
+	u8		pwr_state_check_cnts;
+
+	int 		ps_flag;
+
+	rt_rf_power_state	rf_pwrstate;//cur power state
+	//rt_rf_power_state 	current_rfpwrstate;
+	rt_rf_power_state	change_rfpwrstate;
+
+	u8		bHWPowerdown;//if support hw power down
+	u8		bHWPwrPindetect;
+	u8		bkeepfwalive;
+	u8		brfoffbyhw;
+	unsigned long PS_BBRegBackup[PSBBREG_TOTALCNT];
+
+	#ifdef CONFIG_RESUME_IN_WORKQUEUE
+	struct workqueue_struct *rtw_workqueue;
+	_workitem resume_work;
+	#endif
+
+	#ifdef CONFIG_HAS_EARLYSUSPEND
+	struct early_suspend early_suspend;
+	u8 do_late_resume;
+	#endif //CONFIG_HAS_EARLYSUSPEND
+
+	#ifdef CONFIG_ANDROID_POWER
+	android_early_suspend_t early_suspend;
+	u8 do_late_resume;
+	#endif
+
+};
+
+#define rtw_get_ips_mode_req(pwrctrlpriv) \
+	(pwrctrlpriv)->ips_mode_req
+
+#define rtw_ips_mode_req(pwrctrlpriv, ips_mode) \
+	(pwrctrlpriv)->ips_mode_req = (ips_mode)
+
+#define RTW_PWR_STATE_CHK_INTERVAL 2000
+
+#define _rtw_set_pwr_state_check_timer(pwrctrlpriv, ms) \
+	do { \
+		/*DBG_871X("%s _rtw_set_pwr_state_check_timer(%p, %d)\n", __FUNCTION__, (pwrctrlpriv), (ms));*/ \
+		_set_timer(&(pwrctrlpriv)->pwr_state_check_timer, (ms)); \
+	} while(0)
+
+#define rtw_set_pwr_state_check_timer(pwrctrlpriv) \
+	_rtw_set_pwr_state_check_timer((pwrctrlpriv), (pwrctrlpriv)->pwr_state_check_interval)
+
+extern void rtw_init_pwrctrl_priv(_adapter *adapter);
+extern void rtw_free_pwrctrl_priv(_adapter * adapter);
+
+#ifdef CONFIG_LPS_LCLK
+extern s32 rtw_register_tx_alive(PADAPTER padapter);
+extern void rtw_unregister_tx_alive(PADAPTER padapter);
+extern s32 rtw_register_rx_alive(PADAPTER padapter);
+extern void rtw_unregister_rx_alive(PADAPTER padapter);
+extern s32 rtw_register_cmd_alive(PADAPTER padapter);
+extern void rtw_unregister_cmd_alive(PADAPTER padapter);
+extern s32 rtw_register_evt_alive(PADAPTER padapter);
+extern void rtw_unregister_evt_alive(PADAPTER padapter);
+extern void cpwm_int_hdl(PADAPTER padapter, struct reportpwrstate_parm *preportpwrstate);
+#endif
+
+extern void rtw_set_ps_mode(_adapter * padapter, u8 ps_mode, u8 smart_ps);
+extern void rtw_set_rpwm(_adapter * padapter, u8 val8);
+extern void LeaveAllPowerSaveMode(PADAPTER Adapter);
+#ifdef CONFIG_IPS
+void _ips_enter(_adapter * padapter);
+void ips_enter(_adapter * padapter);
+int _ips_leave(_adapter * padapter);
+int ips_leave(_adapter * padapter);
+#endif
+
+void rtw_ps_processor(_adapter*padapter);
+
+#ifdef CONFIG_AUTOSUSPEND
+int autoresume_enter(_adapter* padapter);
+#endif
+#ifdef SUPPORT_HW_RFOFF_DETECTED
+rt_rf_power_state RfOnOffDetect(IN	PADAPTER pAdapter );
+#endif
+
+
+#ifdef CONFIG_LPS
+void LPS_Enter(PADAPTER padapter);
+void LPS_Leave(PADAPTER padapter);
+#endif
+
+#ifdef CONFIG_RESUME_IN_WORKQUEUE
+void rtw_resume_in_workqueue(struct pwrctrl_priv *pwrpriv);
+#endif //CONFIG_RESUME_IN_WORKQUEUE
+
+#if defined(CONFIG_HAS_EARLYSUSPEND ) || defined(CONFIG_ANDROID_POWER)
+bool rtw_is_earlysuspend_registered(struct pwrctrl_priv *pwrpriv);
+bool rtw_is_do_late_resume(struct pwrctrl_priv *pwrpriv);
+void rtw_set_do_late_resume(struct pwrctrl_priv *pwrpriv, bool enable);
+void rtw_register_early_suspend(struct pwrctrl_priv *pwrpriv);
+void rtw_unregister_early_suspend(struct pwrctrl_priv *pwrpriv);
+#else
+#define rtw_is_earlysuspend_registered(pwrpriv) _FALSE
+#define rtw_is_do_late_resume(pwrpriv) _FALSE
+#define rtw_set_do_late_resume(pwrpriv, enable) do {} while (0)
+#define rtw_register_early_suspend(pwrpriv) do {} while (0)
+#define rtw_unregister_early_suspend(pwrpriv) do {} while (0)
+#endif /* CONFIG_HAS_EARLYSUSPEND || CONFIG_ANDROID_POWER */
+
+u8 rtw_interface_ps_func(_adapter *padapter,HAL_INTF_PS_FUNC efunc_id,u8* val);
+void rtw_set_ips_deny(_adapter *padapter, u32 ms);
+int _rtw_pwr_wakeup(_adapter *padapter, u32 ips_deffer_ms, const char *caller);
+#define rtw_pwr_wakeup(adapter) _rtw_pwr_wakeup(adapter, RTW_PWR_STATE_CHK_INTERVAL, __FUNCTION__)
+#define rtw_pwr_wakeup_ex(adapter, ips_deffer_ms) _rtw_pwr_wakeup(adapter, ips_deffer_ms, __FUNCTION__)
+int rtw_pm_set_ips(_adapter *padapter, u8 mode);
+int rtw_pm_set_lps(_adapter *padapter, u8 mode);
+
+#endif  //__RTL871X_PWRCTRL_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_qos.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_qos.h
new file mode 100644
index 000000000000..bd15f932ba39
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_qos.h
@@ -0,0 +1,39 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+
+#ifndef _RTW_QOS_H_
+#define _RTW_QOS_H_
+#include <drv_conf.h>
+#include <osdep_service.h>
+
+
+
+
+
+
+struct	qos_priv	{
+
+	unsigned int	  qos_option;	//bit mask option: u-apsd, s-apsd, ts, block ack...
+
+};
+
+
+#endif	//_RTL871X_QOS_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_recv.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_recv.h
new file mode 100644
index 000000000000..28dca0021d32
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_recv.h
@@ -0,0 +1,730 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_RECV_H_
+#define _RTW_RECV_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+#define NR_RECVFRAME 256
+
+#define RXFRAME_ALIGN	8
+#define RXFRAME_ALIGN_SZ	(1<<RXFRAME_ALIGN)
+
+#define MAX_RXFRAME_CNT	512
+#define MAX_RX_NUMBLKS		(32)
+#define RECVFRAME_HDR_ALIGN 128
+
+#define SNAP_SIZE sizeof(struct ieee80211_snap_hdr)
+
+static u8 SNAP_ETH_TYPE_IPX[2] = {0x81, 0x37};
+
+static u8 SNAP_ETH_TYPE_APPLETALK_AARP[2] = {0x80, 0xf3};
+static u8 SNAP_ETH_TYPE_APPLETALK_DDP[2] = {0x80, 0x9b};
+static u8 SNAP_ETH_TYPE_TDLS[2] = {0x89, 0x0d};
+static u8 SNAP_HDR_APPLETALK_DDP[3] = {0x08, 0x00, 0x07}; // Datagram Delivery Protocol
+
+static u8 oui_8021h[] = {0x00, 0x00, 0xf8};
+static u8 oui_rfc1042[]= {0x00,0x00,0x00};
+
+#define MAX_SUBFRAME_COUNT	64
+static u8 rtw_rfc1042_header[] =
+{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
+/* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
+static u8 rtw_bridge_tunnel_header[] =
+{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
+
+//for Rx reordering buffer control
+struct recv_reorder_ctrl
+{
+	_adapter	*padapter;
+	u8 enable;
+	u16 indicate_seq;//=wstart_b, init_value=0xffff
+	u16 wend_b;
+	u8 wsize_b;
+	_queue pending_recvframe_queue;
+	_timer reordering_ctrl_timer;
+};
+
+struct	stainfo_rxcache	{
+	u16 	tid_rxseq[16];
+/*
+	unsigned short 	tid0_rxseq;
+	unsigned short 	tid1_rxseq;
+	unsigned short 	tid2_rxseq;
+	unsigned short 	tid3_rxseq;
+	unsigned short 	tid4_rxseq;
+	unsigned short 	tid5_rxseq;
+	unsigned short 	tid6_rxseq;
+	unsigned short 	tid7_rxseq;
+	unsigned short 	tid8_rxseq;
+	unsigned short 	tid9_rxseq;
+	unsigned short 	tid10_rxseq;
+	unsigned short 	tid11_rxseq;
+	unsigned short 	tid12_rxseq;
+	unsigned short 	tid13_rxseq;
+	unsigned short 	tid14_rxseq;
+	unsigned short 	tid15_rxseq;
+*/
+};
+
+
+struct smooth_rssi_data {
+	u32	elements[100];	//array to store values
+	u32	index;			//index to current array to store
+	u32	total_num;		//num of valid elements
+	u32	total_val;		//sum of valid elements
+};
+
+struct signal_stat {
+	u8	update_req;		//used to indicate
+	u8	avg_val;		//avg of valid elements
+	u32	total_num;		//num of valid elements
+	u32	total_val;		//sum of valid elements
+};
+
+struct rx_pkt_attrib
+{
+	u16	pkt_len;
+	u8	physt;
+	u8	drvinfo_sz;
+	u8	shift_sz;
+	u8	hdrlen; //the WLAN Header Len
+	u8 	to_fr_ds;
+	u8 	amsdu;
+	u8	qos;
+	u8	priority;
+	u8	pw_save;
+	u8	mdata;
+	u16	seq_num;
+	u8	frag_num;
+	u8	mfrag;
+	u8	order;
+	u8	privacy; //in frame_ctrl field
+	u8	bdecrypted;
+	u8	encrypt; //when 0 indicate no encrypt. when non-zero, indicate the encrypt algorith
+	u8	iv_len;
+	u8	icv_len;
+	u8	crc_err;
+	u8	icv_err;
+
+	u16 eth_type;
+
+	u8 	dst[ETH_ALEN];
+	u8 	src[ETH_ALEN];
+	u8 	ta[ETH_ALEN];
+	u8 	ra[ETH_ALEN];
+	u8 	bssid[ETH_ALEN];
+
+	u8 ack_policy;
+
+//#ifdef CONFIG_TCP_CSUM_OFFLOAD_RX
+	u8	tcpchk_valid; // 0: invalid, 1: valid
+	u8	ip_chkrpt; //0: incorrect, 1: correct
+	u8	tcp_chkrpt; //0: incorrect, 1: correct
+//#endif
+	u8 	key_index;
+
+	u8	mcs_rate;
+	u8	rxht;
+	u8 	sgi;
+	u8	signal_qual;
+	s8	rx_mimo_signal_qual[2];
+	u8	signal_strength;
+	u8	rx_rssi[2];  //This value is percentage
+	u8	rx_snr[2];
+	u32	RxPWDBAll;
+	s32	RecvSignalPower;
+};
+
+
+//These definition is used for Rx packet reordering.
+#define SN_LESS(a, b)		(((a-b)&0x800)!=0)
+#define SN_EQUAL(a, b)	(a == b)
+//#define REORDER_WIN_SIZE	128
+//#define REORDER_ENTRY_NUM	128
+#define REORDER_WAIT_TIME	(50) // (ms)
+
+#define RECVBUFF_ALIGN_SZ 8
+
+#define RXDESC_SIZE	24
+#define RXDESC_OFFSET RXDESC_SIZE
+
+struct recv_stat
+{
+	unsigned int rxdw0;
+
+	unsigned int rxdw1;
+
+	unsigned int rxdw2;
+
+	unsigned int rxdw3;
+
+	unsigned int rxdw4;
+
+	unsigned int rxdw5;
+
+#ifdef CONFIG_PCI_HCI
+	unsigned int rxdw6;
+
+	unsigned int rxdw7;
+#endif
+};
+
+#define EOR BIT(30)
+
+#ifdef CONFIG_PCI_HCI
+#define PCI_MAX_RX_QUEUE		1// MSDU packet queue, Rx Command Queue
+#define PCI_MAX_RX_COUNT		128
+
+struct rtw_rx_ring {
+	struct recv_stat	*desc;
+	dma_addr_t		dma;
+	unsigned int		idx;
+	struct sk_buff	*rx_buf[PCI_MAX_RX_COUNT];
+};
+#endif
+
+/*
+accesser of recv_priv: rtw_recv_entry(dispatch / passive level); recv_thread(passive) ; returnpkt(dispatch)
+; halt(passive) ;
+
+using enter_critical section to protect
+*/
+struct recv_priv
+{
+	  _lock	lock;
+
+#ifdef CONFIG_RECV_THREAD_MODE
+	_sema	recv_sema;
+	_sema	terminate_recvthread_sema;
+#endif
+
+	//_queue	blk_strms[MAX_RX_NUMBLKS];    // keeping the block ack frame until return ack
+	_queue	free_recv_queue;
+	_queue	recv_pending_queue;
+	_queue	uc_swdec_pending_queue;
+
+
+	u8 *pallocated_frame_buf;
+	u8 *precv_frame_buf;
+
+	uint free_recvframe_cnt;
+
+	_adapter	*adapter;
+
+#ifdef PLATFORM_WINDOWS
+	_nic_hdl  RxPktPoolHdl;
+	_nic_hdl  RxBufPoolHdl;
+
+#ifdef PLATFORM_OS_XP
+	PMDL	pbytecnt_mdl;
+#endif
+	uint	counter; //record the number that up-layer will return to drv; only when counter==0 can we  release recv_priv
+	NDIS_EVENT 	recv_resource_evt ;
+#endif
+
+	u32	bIsAnyNonBEPkts;
+	u64	rx_bytes;
+	u64	rx_pkts;
+	u64	rx_drop;
+	u64	last_rx_bytes;
+
+	uint  rx_icv_err;
+	uint  rx_largepacket_crcerr;
+	uint  rx_smallpacket_crcerr;
+	uint  rx_middlepacket_crcerr;
+
+#ifdef CONFIG_USB_HCI
+	//u8 *pallocated_urb_buf;
+	_sema allrxreturnevt;
+	uint	ff_hwaddr;
+	u8	rx_pending_cnt;
+
+#ifdef CONFIG_USB_INTERRUPT_IN_PIPE
+#ifdef PLATFORM_LINUX
+	PURB	int_in_urb;
+#endif
+
+	u8	*int_in_buf;
+#endif
+
+#endif
+#if defined(PLATFORM_LINUX) || defined(PLATFORM_FREEBSD)
+#ifdef PLATFORM_FREEBSD
+	struct task irq_prepare_beacon_tasklet;
+	struct task recv_tasklet;
+#else //PLATFORM_FREEBSD
+	struct tasklet_struct irq_prepare_beacon_tasklet;
+	struct tasklet_struct recv_tasklet;
+#endif //PLATFORM_FREEBSD
+	struct sk_buff_head free_recv_skb_queue;
+	struct sk_buff_head rx_skb_queue;
+#ifdef CONFIG_RX_INDICATE_QUEUE
+	struct task rx_indicate_tasklet;
+	struct ifqueue rx_indicate_queue;
+#endif	// CONFIG_RX_INDICATE_QUEUE
+
+#ifdef CONFIG_USE_USB_BUFFER_ALLOC_RX
+	_queue	recv_buf_pending_queue;
+#endif	// CONFIG_USE_USB_BUFFER_ALLOC_RX
+#endif //defined(PLATFORM_LINUX) || defined(PLATFORM_FREEBSD)
+
+	u8 *pallocated_recv_buf;
+	u8 *precv_buf;    // 4 alignment
+	_queue	free_recv_buf_queue;
+	u32	free_recv_buf_queue_cnt;
+
+#ifdef CONFIG_SDIO_HCI
+	_queue	recv_buf_pending_queue;
+#endif
+
+#ifdef CONFIG_PCI_HCI
+	// Rx
+	struct rtw_rx_ring	rx_ring[PCI_MAX_RX_QUEUE];
+	int 	rxringcount;
+	u16	rxbuffersize;
+#endif
+
+	//For display the phy informatiom
+	u8 is_signal_dbg;	// for debug
+	u8 signal_strength_dbg;	// for debug
+	s8 rssi;
+	s8 rxpwdb;
+	u8 signal_strength;
+	u8 signal_qual;
+	u8 noise;
+	int RxSNRdB[2];
+	s8 RxRssi[2];
+	int FalseAlmCnt_all;
+
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	_timer signal_stat_timer;
+	u32 signal_stat_sampling_interval;
+	//u32 signal_stat_converging_constant;
+	struct signal_stat signal_qual_data;
+	struct signal_stat signal_strength_data;
+#else //CONFIG_NEW_SIGNAL_STAT_PROCESS
+	struct smooth_rssi_data signal_qual_data;
+	struct smooth_rssi_data signal_strength_data;
+#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+
+	u32 recvbuf_skb_alloc_fail_cnt;
+	u32 recvbuf_null_cnt;
+	u32 read_port_complete_EINPROGRESS_cnt;
+	u32 read_port_complete_other_urb_err_cnt;
+
+
+};
+
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+#define rtw_set_signal_stat_timer(recvpriv) _set_timer(&(recvpriv)->signal_stat_timer, (recvpriv)->signal_stat_sampling_interval)
+#endif //CONFIG_NEW_SIGNAL_STAT_PROCESS
+
+struct sta_recv_priv {
+
+	_lock	lock;
+	sint	option;
+
+	//_queue	blk_strms[MAX_RX_NUMBLKS];
+	_queue defrag_q;	 //keeping the fragment frame until defrag
+
+	struct	stainfo_rxcache rxcache;
+
+	//uint	sta_rx_bytes;
+	//uint	sta_rx_pkts;
+	//uint	sta_rx_fail;
+
+};
+
+
+struct recv_buf
+{
+	_list list;
+
+	_lock recvbuf_lock;
+
+	u32	ref_cnt;
+
+	PADAPTER adapter;
+
+	u8	*pbuf;
+	u8	*pallocated_buf;
+
+	u32	len;
+	u8	*phead;
+	u8	*pdata;
+	u8	*ptail;
+	u8	*pend;
+
+#ifdef CONFIG_USB_HCI
+
+	#if defined(PLATFORM_OS_XP)||defined(PLATFORM_LINUX)||defined(PLATFORM_FREEBSD)
+	PURB	purb;
+	dma_addr_t dma_transfer_addr;	/* (in) dma addr for transfer_buffer */
+	u32 alloc_sz;
+	#endif
+
+	#ifdef PLATFORM_OS_XP
+	PIRP		pirp;
+	#endif
+
+	#ifdef PLATFORM_OS_CE
+	USB_TRANSFER	usb_transfer_read_port;
+	#endif
+
+	u8  irp_pending;
+	int  transfer_len;
+
+#endif
+
+#ifdef PLATFORM_LINUX
+	_pkt *pskb;
+	u8	reuse;
+#endif
+#ifdef PLATFORM_FREEBSD //skb solution
+	struct sk_buff *pskb;
+	u8	reuse;
+#endif //PLATFORM_FREEBSD //skb solution
+};
+
+
+/*
+	head  ----->
+
+		data  ----->
+
+			payload
+
+		tail  ----->
+
+
+	end   ----->
+
+	len = (unsigned int )(tail - data);
+
+*/
+struct recv_frame_hdr
+{
+	_list	list;
+#ifndef CONFIG_BSD_RX_USE_MBUF
+	struct sk_buff	 *pkt;
+	struct sk_buff	 *pkt_newalloc;
+#else // CONFIG_BSD_RX_USE_MBUF
+	_pkt	*pkt;
+	_pkt *pkt_newalloc;
+#endif // CONFIG_BSD_RX_USE_MBUF
+
+	_adapter  *adapter;
+
+	u8 fragcnt;
+
+	int frame_tag;
+
+	struct rx_pkt_attrib attrib;
+
+	uint  len;
+	u8 *rx_head;
+	u8 *rx_data;
+	u8 *rx_tail;
+	u8 *rx_end;
+
+	void *precvbuf;
+
+
+	//
+	struct sta_info *psta;
+
+	//for A-MPDU Rx reordering buffer control
+	struct recv_reorder_ctrl *preorder_ctrl;
+
+};
+
+
+union recv_frame{
+
+	union{
+		_list list;
+		struct recv_frame_hdr hdr;
+		uint mem[RECVFRAME_HDR_ALIGN>>2];
+	}u;
+
+	//uint mem[MAX_RXSZ>>2];
+
+};
+
+
+extern union recv_frame *_rtw_alloc_recvframe (_queue *pfree_recv_queue);  //get a free recv_frame from pfree_recv_queue
+extern union recv_frame *rtw_alloc_recvframe (_queue *pfree_recv_queue);  //get a free recv_frame from pfree_recv_queue
+extern void rtw_init_recvframe(union recv_frame *precvframe ,struct recv_priv *precvpriv);
+extern int	 rtw_free_recvframe(union recv_frame *precvframe, _queue *pfree_recv_queue);
+
+#define rtw_dequeue_recvframe(queue) rtw_alloc_recvframe(queue)
+extern int _rtw_enqueue_recvframe(union recv_frame *precvframe, _queue *queue);
+extern int rtw_enqueue_recvframe(union recv_frame *precvframe, _queue *queue);
+
+extern void rtw_free_recvframe_queue(_queue *pframequeue,  _queue *pfree_recv_queue);
+u32 rtw_free_uc_swdec_pending_queue(_adapter *adapter);
+
+sint rtw_enqueue_recvbuf_to_head(struct recv_buf *precvbuf, _queue *queue);
+sint rtw_enqueue_recvbuf(struct recv_buf *precvbuf, _queue *queue);
+struct recv_buf *rtw_dequeue_recvbuf (_queue *queue);
+
+void rtw_reordering_ctrl_timeout_handler(void *pcontext);
+
+__inline static u8 *get_rxmem(union recv_frame *precvframe)
+{
+	//always return rx_head...
+	if(precvframe==NULL)
+		return NULL;
+
+	return precvframe->u.hdr.rx_head;
+}
+
+__inline static u8 *get_rx_status(union recv_frame *precvframe)
+{
+
+	return get_rxmem(precvframe);
+
+}
+
+__inline static u8 *get_recvframe_data(union recv_frame *precvframe)
+{
+
+	//alwasy return rx_data
+	if(precvframe==NULL)
+		return NULL;
+
+	return precvframe->u.hdr.rx_data;
+
+}
+
+__inline static u8 *recvframe_push(union recv_frame *precvframe, sint sz)
+{
+	// append data before rx_data
+
+	/* add data to the start of recv_frame
+ *
+ *      This function extends the used data area of the recv_frame at the buffer
+ *      start. rx_data must be still larger than rx_head, after pushing.
+ */
+
+	if(precvframe==NULL)
+		return NULL;
+
+
+	precvframe->u.hdr.rx_data -= sz ;
+	if( precvframe->u.hdr.rx_data < precvframe->u.hdr.rx_head )
+	{
+		precvframe->u.hdr.rx_data += sz ;
+		return NULL;
+	}
+
+	precvframe->u.hdr.len +=sz;
+
+	return precvframe->u.hdr.rx_data;
+
+}
+
+
+__inline static u8 *recvframe_pull(union recv_frame *precvframe, sint sz)
+{
+	// rx_data += sz; move rx_data sz bytes  hereafter
+
+	//used for extract sz bytes from rx_data, update rx_data and return the updated rx_data to the caller
+
+
+	if(precvframe==NULL)
+		return NULL;
+
+
+	precvframe->u.hdr.rx_data += sz;
+
+	if(precvframe->u.hdr.rx_data > precvframe->u.hdr.rx_tail)
+	{
+		precvframe->u.hdr.rx_data -= sz;
+		return NULL;
+	}
+
+	precvframe->u.hdr.len -=sz;
+
+	return precvframe->u.hdr.rx_data;
+
+}
+
+__inline static u8 *recvframe_put(union recv_frame *precvframe, sint sz)
+{
+	// rx_tai += sz; move rx_tail sz bytes  hereafter
+
+	//used for append sz bytes from ptr to rx_tail, update rx_tail and return the updated rx_tail to the caller
+	//after putting, rx_tail must be still larger than rx_end.
+	unsigned char * prev_rx_tail;
+
+	if(precvframe==NULL)
+		return NULL;
+
+	prev_rx_tail = precvframe->u.hdr.rx_tail;
+
+	precvframe->u.hdr.rx_tail += sz;
+
+	if(precvframe->u.hdr.rx_tail > precvframe->u.hdr.rx_end)
+	{
+		precvframe->u.hdr.rx_tail -= sz;
+		return NULL;
+	}
+
+	precvframe->u.hdr.len +=sz;
+
+	return precvframe->u.hdr.rx_tail;
+
+}
+
+
+
+__inline static u8 *recvframe_pull_tail(union recv_frame *precvframe, sint sz)
+{
+	// rmv data from rx_tail (by yitsen)
+
+	//used for extract sz bytes from rx_end, update rx_end and return the updated rx_end to the caller
+	//after pulling, rx_end must be still larger than rx_data.
+
+	if(precvframe==NULL)
+		return NULL;
+
+	precvframe->u.hdr.rx_tail -= sz;
+
+	if(precvframe->u.hdr.rx_tail < precvframe->u.hdr.rx_data)
+	{
+		precvframe->u.hdr.rx_tail += sz;
+		return NULL;
+	}
+
+	precvframe->u.hdr.len -=sz;
+
+	return precvframe->u.hdr.rx_tail;
+
+}
+
+
+
+__inline static _buffer * get_rxbuf_desc(union recv_frame *precvframe)
+{
+	_buffer * buf_desc;
+
+	if(precvframe==NULL)
+		return NULL;
+#ifdef PLATFORM_WINDOWS
+	NdisQueryPacket(precvframe->u.hdr.pkt, NULL, NULL, &buf_desc, NULL);
+#endif
+
+	return buf_desc;
+}
+
+
+__inline static union recv_frame *rxmem_to_recvframe(u8 *rxmem)
+{
+	//due to the design of 2048 bytes alignment of recv_frame, we can reference the union recv_frame
+	//from any given member of recv_frame.
+	// rxmem indicates the any member/address in recv_frame
+
+	return (union recv_frame*)(((SIZE_PTR)rxmem >> RXFRAME_ALIGN) << RXFRAME_ALIGN);
+
+}
+
+__inline static union recv_frame *pkt_to_recvframe(_pkt *pkt)
+{
+
+	u8 * buf_star;
+	union recv_frame * precv_frame;
+#ifdef PLATFORM_WINDOWS
+	_buffer * buf_desc;
+	uint len;
+
+	NdisQueryPacket(pkt, NULL, NULL, &buf_desc, &len);
+	NdisQueryBufferSafe(buf_desc, &buf_star, &len, HighPagePriority);
+#endif
+	precv_frame = rxmem_to_recvframe((unsigned char*)buf_star);
+
+	return precv_frame;
+}
+
+__inline static u8 *pkt_to_recvmem(_pkt *pkt)
+{
+	// return the rx_head
+
+	union recv_frame * precv_frame = pkt_to_recvframe(pkt);
+
+	return 	precv_frame->u.hdr.rx_head;
+
+}
+
+__inline static u8 *pkt_to_recvdata(_pkt *pkt)
+{
+	// return the rx_data
+
+	union recv_frame * precv_frame =pkt_to_recvframe(pkt);
+
+	return 	precv_frame->u.hdr.rx_data;
+
+}
+
+
+__inline static sint get_recvframe_len(union recv_frame *precvframe)
+{
+	return precvframe->u.hdr.len;
+}
+
+__inline static u8 query_rx_pwr_percentage(s8 antpower )
+{
+	if ((antpower <= -100) || (antpower >= 20))
+	{
+		return	0;
+	}
+	else if (antpower >= 0)
+	{
+		return	100;
+	}
+	else
+	{
+		return	(100+antpower);
+	}
+}
+
+__inline static s32 translate_percentage_to_dbm(u32 SignalStrengthIndex)
+{
+	s32	SignalPower; // in dBm.
+
+	// Translate to dBm (x=0.5y-95).
+	SignalPower = (s32)((SignalStrengthIndex + 1) >> 1);
+	SignalPower -= 95;
+
+	return SignalPower;
+}
+
+
+struct sta_info;
+
+extern void _rtw_init_sta_recv_priv(struct sta_recv_priv *psta_recvpriv);
+
+extern void  mgt_dispatcher(_adapter *padapter, union recv_frame *precv_frame);
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_rf.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_rf.h
new file mode 100644
index 000000000000..b8acf930d871
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_rf.h
@@ -0,0 +1,151 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef	__RTW_RF_H_
+#define __RTW_RF_H_
+
+#include <drv_conf.h>
+#include <rtw_cmd.h>
+
+#define OFDM_PHY		1
+#define MIXED_PHY		2
+#define CCK_PHY		3
+
+#define NumRates	(13)
+
+// slot time for 11g
+#define SHORT_SLOT_TIME					9
+#define NON_SHORT_SLOT_TIME				20
+
+#define RTL8711_RF_MAX_SENS 6
+#define RTL8711_RF_DEF_SENS 4
+
+//
+// We now define the following channels as the max channels in each channel plan.
+// 2G, total 14 chnls
+// {1,2,3,4,5,6,7,8,9,10,11,12,13,14}
+// 5G, total 24 chnls
+// {36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,149,153,157,161,165}
+#define	MAX_CHANNEL_NUM_2G				14
+#define	MAX_CHANNEL_NUM_5G				24
+#define	MAX_CHANNEL_NUM					38//14+24
+
+//#define NUM_REGULATORYS	21
+#define NUM_REGULATORYS	1
+
+//Country codes
+#define USA							0x555320
+#define EUROPE						0x1 //temp, should be provided later
+#define JAPAN						0x2 //temp, should be provided later
+
+struct	regulatory_class {
+	u32	starting_freq;					//MHz,
+	u8	channel_set[MAX_CHANNEL_NUM];
+	u8	channel_cck_power[MAX_CHANNEL_NUM];//dbm
+	u8	channel_ofdm_power[MAX_CHANNEL_NUM];//dbm
+	u8	txpower_limit;  				//dbm
+	u8	channel_spacing;				//MHz
+	u8	modem;
+};
+
+typedef enum _CAPABILITY{
+	cESS			= 0x0001,
+	cIBSS			= 0x0002,
+	cPollable		= 0x0004,
+	cPollReq			= 0x0008,
+	cPrivacy		= 0x0010,
+	cShortPreamble	= 0x0020,
+	cPBCC			= 0x0040,
+	cChannelAgility	= 0x0080,
+	cSpectrumMgnt	= 0x0100,
+	cQos			= 0x0200,	// For HCCA, use with CF-Pollable and CF-PollReq
+	cShortSlotTime	= 0x0400,
+	cAPSD			= 0x0800,
+	cRM				= 0x1000,	// RRM (Radio Request Measurement)
+	cDSSS_OFDM	= 0x2000,
+	cDelayedBA		= 0x4000,
+	cImmediateBA	= 0x8000,
+}CAPABILITY, *PCAPABILITY;
+
+enum	_REG_PREAMBLE_MODE{
+	PREAMBLE_LONG	= 1,
+	PREAMBLE_AUTO	= 2,
+	PREAMBLE_SHORT	= 3,
+};
+
+
+enum _RTL8712_RF_MIMO_CONFIG_{
+ RTL8712_RFCONFIG_1T=0x10,
+ RTL8712_RFCONFIG_2T=0x20,
+ RTL8712_RFCONFIG_1R=0x01,
+ RTL8712_RFCONFIG_2R=0x02,
+ RTL8712_RFCONFIG_1T1R=0x11,
+ RTL8712_RFCONFIG_1T2R=0x12,
+ RTL8712_RFCONFIG_TURBO=0x92,
+ RTL8712_RFCONFIG_2T2R=0x22
+};
+
+
+// Bandwidth Offset
+#define HAL_PRIME_CHNL_OFFSET_DONT_CARE	0
+#define HAL_PRIME_CHNL_OFFSET_LOWER	1
+#define HAL_PRIME_CHNL_OFFSET_UPPER	2
+
+// Represent Channel Width in HT Capabilities
+//
+typedef enum _HT_CHANNEL_WIDTH {
+	HT_CHANNEL_WIDTH_20 = 0,
+	HT_CHANNEL_WIDTH_40 = 1,
+}HT_CHANNEL_WIDTH, *PHT_CHANNEL_WIDTH;
+
+//
+// Represent Extention Channel Offset in HT Capabilities
+// This is available only in 40Mhz mode.
+//
+typedef enum _HT_EXTCHNL_OFFSET{
+	HT_EXTCHNL_OFFSET_NO_EXT = 0,
+	HT_EXTCHNL_OFFSET_UPPER = 1,
+	HT_EXTCHNL_OFFSET_NO_DEF = 2,
+	HT_EXTCHNL_OFFSET_LOWER = 3,
+}HT_EXTCHNL_OFFSET, *PHT_EXTCHNL_OFFSET;
+
+/* 2007/11/15 MH Define different RF type. */
+typedef	enum _RT_RF_TYPE_DEFINITION
+{
+	RF_1T2R = 0,
+	RF_2T4R = 1,
+	RF_2T2R = 2,
+	RF_1T1R = 3,
+	RF_2T2R_GREEN = 4,
+	RF_819X_MAX_TYPE = 5,
+}RT_RF_TYPE_DEF_E;
+
+typedef enum _RF_RADIO_PATH{
+	RF_PATH_A = 0,			//Radio Path A
+	RF_PATH_B = 1,			//Radio Path B
+	RF_PATH_C = 2,			//Radio Path C
+	RF_PATH_D = 3,			//Radio Path D
+	//RF_PATH_MAX				//Max RF number 90 support
+}RF_RADIO_PATH_E, *PRF_RADIO_PATH_E;
+
+u32 rtw_ch2freq(u32 ch);
+u32 rtw_freq2ch(u32 freq);
+
+
+#endif //_RTL8711_RF_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_security.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_security.h
new file mode 100644
index 000000000000..0d99c9a03bf7
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_security.h
@@ -0,0 +1,446 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_SECURITY_H_
+#define __RTW_SECURITY_H_
+
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+
+#define _NO_PRIVACY_	0x0
+#define _WEP40_			0x1
+#define _TKIP_			0x2
+#define _TKIP_WTMIC_	0x3
+#define _AES_			0x4
+#define _WEP104_		0x5
+#ifdef CONFIG_IEEE80211W
+#define _BIP_				0x8
+#endif //CONFIG_IEEE80211W
+#define is_wep_enc(alg) (((alg) == _WEP40_) || ((alg) == _WEP104_))
+
+#define _WPA_IE_ID_	0xdd
+#define _WPA2_IE_ID_	0x30
+
+#define SHA256_MAC_LEN 32
+#define AES_BLOCK_SIZE 16
+#define AES_PRIV_SIZE (4 * 44)
+
+#ifndef Ndis802_11AuthModeWPA2
+#define Ndis802_11AuthModeWPA2 (Ndis802_11AuthModeWPANone + 1)
+#endif
+
+#ifndef Ndis802_11AuthModeWPA2PSK
+#define Ndis802_11AuthModeWPA2PSK (Ndis802_11AuthModeWPANone + 2)
+#endif
+
+union pn48	{
+
+	u64	val;
+
+#ifdef CONFIG_LITTLE_ENDIAN
+
+struct {
+  u8 TSC0;
+  u8 TSC1;
+  u8 TSC2;
+  u8 TSC3;
+  u8 TSC4;
+  u8 TSC5;
+  u8 TSC6;
+  u8 TSC7;
+} _byte_;
+
+#elif defined(CONFIG_BIG_ENDIAN)
+
+struct {
+  u8 TSC7;
+  u8 TSC6;
+  u8 TSC5;
+  u8 TSC4;
+  u8 TSC3;
+  u8 TSC2;
+  u8 TSC1;
+  u8 TSC0;
+} _byte_;
+
+#endif
+
+};
+
+union Keytype {
+        u8   skey[16];
+        u32    lkey[4];
+};
+
+
+typedef struct _RT_PMKID_LIST
+{
+	u8						bUsed;
+	u8 						Bssid[6];
+	u8						PMKID[16];
+	u8						SsidBuf[33];
+	u8*						ssid_octet;
+	u16 						ssid_length;
+} RT_PMKID_LIST, *PRT_PMKID_LIST;
+
+
+struct security_priv
+{
+	u32	  dot11AuthAlgrthm;		// 802.11 auth, could be open, shared, 8021x and authswitch
+	u32	  dot11PrivacyAlgrthm;	// This specify the privacy for shared auth. algorithm.
+
+	/* WEP */
+	u32	  dot11PrivacyKeyIndex;	// this is only valid for legendary wep, 0~3 for key id. (tx key index)
+	union Keytype dot11DefKey[4];			// this is only valid for def. key
+	u32 	dot11DefKeylen[4];
+	u8 	key_mask; /* use to restore wep key after hal_init */
+
+	u32 dot118021XGrpPrivacy;	// This specify the privacy algthm. used for Grp key
+	u32	dot118021XGrpKeyid;		// key id used for Grp Key ( tx key index)
+	union Keytype	dot118021XGrpKey[4];	// 802.1x Group Key, for inx0 and inx1
+	union Keytype	dot118021XGrptxmickey[4];
+	union Keytype	dot118021XGrprxmickey[4];
+	union pn48		dot11Grptxpn;			// PN48 used for Grp Key xmit.
+	union pn48		dot11Grprxpn;			// PN48 used for Grp Key recv.
+#ifdef CONFIG_IEEE80211W
+	u32	dot11wBIPKeyid;						// key id used for BIP Key ( tx key index)
+	union Keytype	dot11wBIPKey[6];		// BIP Key, for index4 and index5
+	union pn48		dot11wBIPtxpn;			// PN48 used for Grp Key xmit.
+	union pn48		dot11wBIPrxpn;			// PN48 used for Grp Key recv.
+#endif //CONFIG_IEEE80211W
+#ifdef CONFIG_AP_MODE
+	//extend security capabilities for AP_MODE
+	unsigned int dot8021xalg;//0:disable, 1:psk, 2:802.1x
+	unsigned int wpa_psk;//0:disable, bit(0): WPA, bit(1):WPA2
+	unsigned int wpa_group_cipher;
+	unsigned int wpa2_group_cipher;
+	unsigned int wpa_pairwise_cipher;
+	unsigned int wpa2_pairwise_cipher;
+#endif
+
+	u8 wps_ie[MAX_WPS_IE_LEN];//added in assoc req
+	int wps_ie_len;
+
+
+	u8	binstallGrpkey;
+#ifdef CONFIG_IEEE80211W
+	u8	binstallBIPkey;
+#endif //CONFIG_IEEE80211W
+	u8	busetkipkey;
+	//_timer tkip_timer;
+	u8	bcheck_grpkey;
+	u8	bgrpkey_handshake;
+
+	//u8	packet_cnt;//unused, removed
+
+	s32	sw_encrypt;//from registry_priv
+	s32	sw_decrypt;//from registry_priv
+
+	s32 	hw_decrypted;//if the rx packets is hw_decrypted==_FALSE, it means the hw has not been ready.
+
+
+	//keeps the auth_type & enc_status from upper layer ioctl(wpa_supplicant or wzc)
+	u32 ndisauthtype;	// NDIS_802_11_AUTHENTICATION_MODE
+	u32 ndisencryptstatus;	// NDIS_802_11_ENCRYPTION_STATUS
+
+	WLAN_BSSID_EX sec_bss;  //for joinbss (h2c buffer) usage
+
+	NDIS_802_11_WEP ndiswep;
+#ifdef PLATFORM_WINDOWS
+	u8 KeyMaterial[16];// variable length depending on above field.
+#endif
+
+	u8 assoc_info[600];
+	u8 szofcapability[256]; //for wpa2 usage
+	u8 oidassociation[512]; //for wpa/wpa2 usage
+	u8 authenticator_ie[256];  //store ap security information element
+	u8 supplicant_ie[256];  //store sta security information element
+
+
+	//for tkip countermeasure
+	u32 last_mic_err_time;
+	u8	btkip_countermeasure;
+	u8	btkip_wait_report;
+	u32 btkip_countermeasure_time;
+
+	//---------------------------------------------------------------------------
+	// For WPA2 Pre-Authentication.
+	//---------------------------------------------------------------------------
+	//u8				RegEnablePreAuth;				// Default value: Pre-Authentication enabled or not, from registry "EnablePreAuth". Added by Annie, 2005-11-01.
+	//u8				EnablePreAuthentication;			// Current Value: Pre-Authentication enabled or not.
+	RT_PMKID_LIST		PMKIDList[NUM_PMKID_CACHE];	// Renamed from PreAuthKey[NUM_PRE_AUTH_KEY]. Annie, 2006-10-13.
+	u8				PMKIDIndex;
+	//u32				PMKIDCount;						// Added by Annie, 2006-10-13.
+	//u8				szCapability[256];				// For WPA2-PSK using zero-config, by Annie, 2005-09-20.
+
+	u8 bWepDefaultKeyIdxSet;
+};
+
+struct sha256_state {
+	u64 length;
+	u32 state[8], curlen;
+	u8 buf[64];
+};
+
+#define GET_ENCRY_ALGO(psecuritypriv, psta, encry_algo, bmcst)\
+do{\
+	switch(psecuritypriv->dot11AuthAlgrthm)\
+	{\
+		case dot11AuthAlgrthm_Open:\
+		case dot11AuthAlgrthm_Shared:\
+		case dot11AuthAlgrthm_Auto:\
+			encry_algo = (u8)psecuritypriv->dot11PrivacyAlgrthm;\
+			break;\
+		case dot11AuthAlgrthm_8021X:\
+			if(bmcst)\
+				encry_algo = (u8)psecuritypriv->dot118021XGrpPrivacy;\
+			else\
+				encry_algo =(u8) psta->dot118021XPrivacy;\
+			break;\
+	}\
+}while(0)
+
+
+#define SET_ICE_IV_LEN( iv_len, icv_len, encrypt)\
+do{\
+	switch(encrypt)\
+	{\
+		case _WEP40_:\
+		case _WEP104_:\
+			iv_len = 4;\
+			icv_len = 4;\
+			break;\
+		case _TKIP_:\
+			iv_len = 8;\
+			icv_len = 4;\
+			break;\
+		case _AES_:\
+			iv_len = 8;\
+			icv_len = 8;\
+			break;\
+		default:\
+			iv_len = 0;\
+			icv_len = 0;\
+			break;\
+	}\
+}while(0)
+
+
+#define GET_TKIP_PN(iv,dot11txpn)\
+do{\
+	dot11txpn._byte_.TSC0=iv[2];\
+	dot11txpn._byte_.TSC1=iv[0];\
+	dot11txpn._byte_.TSC2=iv[4];\
+	dot11txpn._byte_.TSC3=iv[5];\
+	dot11txpn._byte_.TSC4=iv[6];\
+	dot11txpn._byte_.TSC5=iv[7];\
+}while(0)
+
+
+#define ROL32( A, n )	( ((A) << (n)) | ( ((A)>>(32-(n)))  & ( (1UL << (n)) - 1 ) ) )
+#define ROR32( A, n ) 	ROL32( (A), 32-(n) )
+
+struct mic_data
+{
+	u32  K0, K1;         // Key
+	u32  L, R;           // Current state
+	u32  M;              // Message accumulator (single word)
+	u32     nBytesInM;      // # bytes in M
+};
+
+extern const u32 Te0[256];
+extern const u32 Te1[256];
+extern const u32 Te2[256];
+extern const u32 Te3[256];
+extern const u32 Te4[256];
+extern const u32 Td0[256];
+extern const u32 Td1[256];
+extern const u32 Td2[256];
+extern const u32 Td3[256];
+extern const u32 Td4[256];
+extern const u32 rcon[10];
+extern const u8 Td4s[256];
+extern const u8 rcons[10];
+
+#define RCON(i) (rcons[(i)] << 24)
+
+static inline u32 rotr(u32 val, int bits)
+{
+	return (val >> bits) | (val << (32 - bits));
+}
+
+#define TE0(i) Te0[((i) >> 24) & 0xff]
+#define TE1(i) rotr(Te0[((i) >> 16) & 0xff], 8)
+#define TE2(i) rotr(Te0[((i) >> 8) & 0xff], 16)
+#define TE3(i) rotr(Te0[(i) & 0xff], 24)
+#define TE41(i) ((Te0[((i) >> 24) & 0xff] << 8) & 0xff000000)
+#define TE42(i) (Te0[((i) >> 16) & 0xff] & 0x00ff0000)
+#define TE43(i) (Te0[((i) >> 8) & 0xff] & 0x0000ff00)
+#define TE44(i) ((Te0[(i) & 0xff] >> 8) & 0x000000ff)
+#define TE421(i) ((Te0[((i) >> 16) & 0xff] << 8) & 0xff000000)
+#define TE432(i) (Te0[((i) >> 8) & 0xff] & 0x00ff0000)
+#define TE443(i) (Te0[(i) & 0xff] & 0x0000ff00)
+#define TE414(i) ((Te0[((i) >> 24) & 0xff] >> 8) & 0x000000ff)
+#define TE4(i) ((Te0[(i)] >> 8) & 0x000000ff)
+
+#define TD0(i) Td0[((i) >> 24) & 0xff]
+#define TD1(i) rotr(Td0[((i) >> 16) & 0xff], 8)
+#define TD2(i) rotr(Td0[((i) >> 8) & 0xff], 16)
+#define TD3(i) rotr(Td0[(i) & 0xff], 24)
+#define TD41(i) (Td4s[((i) >> 24) & 0xff] << 24)
+#define TD42(i) (Td4s[((i) >> 16) & 0xff] << 16)
+#define TD43(i) (Td4s[((i) >> 8) & 0xff] << 8)
+#define TD44(i) (Td4s[(i) & 0xff])
+#define TD0_(i) Td0[(i) & 0xff]
+#define TD1_(i) rotr(Td0[(i) & 0xff], 8)
+#define TD2_(i) rotr(Td0[(i) & 0xff], 16)
+#define TD3_(i) rotr(Td0[(i) & 0xff], 24)
+
+#define GETU32(pt) (((u32)(pt)[0] << 24) ^ ((u32)(pt)[1] << 16) ^ \
+			((u32)(pt)[2] <<  8) ^ ((u32)(pt)[3]))
+
+#define PUTU32(ct, st) { \
+(ct)[0] = (u8)((st) >> 24); (ct)[1] = (u8)((st) >> 16); \
+(ct)[2] = (u8)((st) >>  8); (ct)[3] = (u8)(st); }
+
+#define WPA_GET_BE32(a) ((((u32) (a)[0]) << 24) | (((u32) (a)[1]) << 16) | \
+			 (((u32) (a)[2]) << 8) | ((u32) (a)[3]))
+
+#define WPA_PUT_LE16(a, val)			\
+	do {					\
+		(a)[1] = ((u16) (val)) >> 8;	\
+		(a)[0] = ((u16) (val)) & 0xff;	\
+	} while (0)
+
+#define WPA_PUT_BE32(a, val)					\
+	do {							\
+		(a)[0] = (u8) ((((u32) (val)) >> 24) & 0xff);	\
+		(a)[1] = (u8) ((((u32) (val)) >> 16) & 0xff);	\
+		(a)[2] = (u8) ((((u32) (val)) >> 8) & 0xff);	\
+		(a)[3] = (u8) (((u32) (val)) & 0xff);		\
+	} while (0)
+
+#define WPA_PUT_BE64(a, val)				\
+	do {						\
+		(a)[0] = (u8) (((u64) (val)) >> 56);	\
+		(a)[1] = (u8) (((u64) (val)) >> 48);	\
+		(a)[2] = (u8) (((u64) (val)) >> 40);	\
+		(a)[3] = (u8) (((u64) (val)) >> 32);	\
+		(a)[4] = (u8) (((u64) (val)) >> 24);	\
+		(a)[5] = (u8) (((u64) (val)) >> 16);	\
+		(a)[6] = (u8) (((u64) (val)) >> 8);	\
+		(a)[7] = (u8) (((u64) (val)) & 0xff);	\
+	} while (0)
+
+/* ===== start - public domain SHA256 implementation ===== */
+
+/* This is based on SHA256 implementation in LibTomCrypt that was released into
+ * public domain by Tom St Denis. */
+
+/* the K array */
+static const unsigned long K[64] = {
+	0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL, 0x3956c25bUL,
+	0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL, 0xd807aa98UL, 0x12835b01UL,
+	0x243185beUL, 0x550c7dc3UL, 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL,
+	0xc19bf174UL, 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
+	0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL, 0x983e5152UL,
+	0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL, 0xc6e00bf3UL, 0xd5a79147UL,
+	0x06ca6351UL, 0x14292967UL, 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL,
+	0x53380d13UL, 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
+	0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL, 0xd192e819UL,
+	0xd6990624UL, 0xf40e3585UL, 0x106aa070UL, 0x19a4c116UL, 0x1e376c08UL,
+	0x2748774cUL, 0x34b0bcb5UL, 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL,
+	0x682e6ff3UL, 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
+	0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
+};
+
+
+/* Various logical functions */
+#define RORc(x, y) \
+( ((((unsigned long) (x) & 0xFFFFFFFFUL) >> (unsigned long) ((y) & 31)) | \
+   ((unsigned long) (x) << (unsigned long) (32 - ((y) & 31)))) & 0xFFFFFFFFUL)
+#define Ch(x,y,z)       (z ^ (x & (y ^ z)))
+#define Maj(x,y,z)      (((x | y) & z) | (x & y))
+#define S(x, n)         RORc((x), (n))
+#define R(x, n)         (((x)&0xFFFFFFFFUL)>>(n))
+#define Sigma0(x)       (S(x, 2) ^ S(x, 13) ^ S(x, 22))
+#define Sigma1(x)       (S(x, 6) ^ S(x, 11) ^ S(x, 25))
+#define Gamma0(x)       (S(x, 7) ^ S(x, 18) ^ R(x, 3))
+#define Gamma1(x)       (S(x, 17) ^ S(x, 19) ^ R(x, 10))
+#ifndef MIN
+#define MIN(x, y) (((x) < (y)) ? (x) : (y))
+#endif
+#ifdef CONFIG_IEEE80211W
+int omac1_aes_128(u8 *key, u8 *data, size_t data_len, u8 *mac);
+#endif //CONFIG_IEEE80211W
+void rtw_secmicsetkey(struct mic_data *pmicdata, u8 * key );
+void rtw_secmicappendbyte(struct mic_data *pmicdata, u8 b );
+void rtw_secmicappend(struct mic_data *pmicdata, u8 * src, u32 nBytes );
+void rtw_secgetmic(struct mic_data *pmicdata, u8 * dst );
+
+void rtw_seccalctkipmic(
+	u8 * key,
+	u8 *header,
+	u8 *data,
+	u32 data_len,
+	u8 *Miccode,
+	u8   priority);
+
+u32 rtw_aes_encrypt(_adapter *padapter, u8 *pxmitframe);
+u32 rtw_tkip_encrypt(_adapter *padapter, u8 *pxmitframe);
+void rtw_wep_encrypt(_adapter *padapter, u8  *pxmitframe);
+
+u32 rtw_aes_decrypt(_adapter *padapter, u8  *precvframe);
+u32 rtw_tkip_decrypt(_adapter *padapter, u8  *precvframe);
+void rtw_wep_decrypt(_adapter *padapter, u8  *precvframe);
+#ifdef CONFIG_IEEE80211W
+u32	rtw_BIP_verify(_adapter *padapter, u8 *precvframe);
+#endif //CONFIG_IEEE80211W
+#ifdef CONFIG_TDLS
+void wpa_tdls_generate_tpk(_adapter *padapter, struct sta_info *psta);
+int wpa_tdls_ftie_mic(u8 *kck, u8 trans_seq,
+						u8 *lnkid, u8 *rsnie, u8 *timeoutie, u8 *ftie,
+						u8 *mic);
+int tdls_verify_mic(u8 *kck, u8 trans_seq,
+						u8 *lnkid, u8 *rsnie, u8 *timeoutie, u8 *ftie);
+#endif //CONFIG_TDLS
+
+#ifdef PLATFORM_WINDOWS
+void rtw_use_tkipkey_handler (
+	IN	PVOID					SystemSpecific1,
+	IN	PVOID					FunctionContext,
+	IN	PVOID					SystemSpecific2,
+	IN	PVOID					SystemSpecific3
+	);
+#endif
+#ifdef PLATFORM_LINUX
+void rtw_use_tkipkey_handler(void* FunctionContext);
+#endif
+
+#ifdef PLATFORM_FREEBSD
+void rtw_use_tkipkey_handler(void* FunctionContext);
+#endif //PLATFORM_FREEBSD
+
+void rtw_sec_restore_wep_key(_adapter *adapter);
+u8 rtw_handle_tkip_countermeasure(_adapter* adapter, const char *caller);
+
+#endif	//__RTL871X_SECURITY_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_sreset.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_sreset.h
new file mode 100644
index 000000000000..f2d5dc721b97
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_sreset.h
@@ -0,0 +1,73 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_SRESET_C_
+#define _RTW_SRESET_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+enum {
+	SRESET_TGP_NULL = 0,
+	SRESET_TGP_XMIT_STATUS = 1,
+	SRESET_TGP_LINK_STATUS = 2,
+};
+
+struct sreset_priv {
+	_mutex 	silentreset_mutex;
+	u8 	silent_reset_inprogress;
+	u8	Wifi_Error_Status;
+	unsigned long last_tx_time;
+	unsigned long last_tx_complete_time;
+
+	s32 dbg_trigger_point;
+};
+
+#ifdef CONFIG_RTL8192C
+#include <rtl8192c_hal.h>
+#endif
+#ifdef CONFIG_RTL8192D
+#include <rtl8192d_hal.h>
+#endif
+#ifdef CONFIG_RTL8723A
+#include <rtl8723a_hal.h>
+#endif
+#ifdef CONFIG_RTL8188E
+#include <rtl8188e_hal.h>
+#endif
+
+#define	WIFI_STATUS_SUCCESS 		0
+#define	USB_VEN_REQ_CMD_FAIL 	BIT0
+#define	USB_READ_PORT_FAIL 		BIT1
+#define	USB_WRITE_PORT_FAIL		BIT2
+#define	WIFI_MAC_TXDMA_ERROR 	BIT3
+#define   WIFI_TX_HANG				BIT4
+#define	WIFI_RX_HANG				BIT5
+#define 	WIFI_IF_NOT_EXIST			BIT6
+
+void sreset_init_value(_adapter *padapter);
+void sreset_reset_value(_adapter *padapter);
+u8 sreset_get_wifi_status(_adapter *padapter);
+void sreset_set_wifi_error_status(_adapter *padapter, u32 status);
+void sreset_set_trigger_point(_adapter *padapter, s32 tgp);
+bool sreset_inprogress(_adapter *padapter);
+void sreset_reset(_adapter *padapter);
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_tdls.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_tdls.h
new file mode 100644
index 000000000000..cbf996f6e5a5
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_tdls.h
@@ -0,0 +1,142 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __RTW_TDLS_H_
+#define __RTW_TDLS_H_
+
+#include <drv_types.h>
+
+#ifdef CONFIG_TDLS
+/* TDLS STA state */
+#define	TDLS_STATE_NONE				0x00000000	//default state
+#define	TDLS_INITIATOR_STATE			0x10000000
+#define	TDLS_RESPONDER_STATE			0x20000000
+#define	TDLS_LINKED_STATE				0x40000000
+#define	TDLS_CH_SWITCH_ON_STATE		0x01000000
+#define	TDLS_PEER_AT_OFF_STATE		0x02000000	//could send pkt on target ch
+#define	TDLS_AT_OFF_CH_STATE			0x04000000
+#define	TDLS_CH_SW_INITIATOR_STATE	0x08000000	//avoiding duplicated or unconditional ch. switch rsp.
+#define	TDLS_APSD_CHSW_STATE		0x00100000	//in APSD and want to setup channel switch
+#define	TDLS_PEER_SLEEP_STATE		0x00200000	//peer sta is sleeping
+#define	TDLS_SW_OFF_STATE			0x00400000	//terminate channel swithcing
+#define	TDLS_ALIVE_STATE				0x00010000	//Check if peer sta is alived.
+
+#define	TPK_RESEND_COUNT				301
+#define 	CH_SWITCH_TIME				10
+#define 	CH_SWITCH_TIMEOUT			30
+#define	TDLS_STAY_TIME				500
+#define	TDLS_SIGNAL_THRESH			0x20
+#define	TDLS_WATCHDOG_PERIOD		10	//Periodically sending tdls discovery request in TDLS_WATCHDOG_PERIOD * 2 sec
+#define	TDLS_ALIVE_TIMER_PH1			5000
+#define	TDLS_ALIVE_TIMER_PH2			2000
+#define	TDLS_STAY_TIME				500
+#define	TDLS_HANDSHAKE_TIME			2000
+#define	TDLS_ALIVE_COUNT				3
+#define	TDLS_INI_MACID_ENTRY			6
+
+/* TDLS */
+#define TDLS_MIC_LEN 16
+#define WPA_NONCE_LEN 32
+#define TDLS_TIMEOUT_LEN 4
+
+struct wpa_tdls_ftie {
+	u8 ie_type; /* FTIE */
+	u8 ie_len;
+	u8 mic_ctrl[2];
+	u8 mic[TDLS_MIC_LEN];
+	u8 Anonce[WPA_NONCE_LEN]; /* Responder Nonce in TDLS */
+	u8 Snonce[WPA_NONCE_LEN]; /* Initiator Nonce in TDLS */
+	/* followed by optional elements */
+} ;
+
+struct wpa_tdls_lnkid {
+	u8 ie_type; /* Link Identifier IE */
+	u8 ie_len;
+	u8 bssid[ETH_ALEN];
+	u8 init_sta[ETH_ALEN];
+	u8 resp_sta[ETH_ALEN];
+} ;
+
+static u8 TDLS_RSNIE[]={	0x01, 0x00,	//version shall be set to 1
+						0x00, 0x0f, 0xac, 0x07,	//group sipher suite
+						0x01, 0x00,	//pairwise cipher suite count
+						0x00, 0x0f, 0xac, 0x04,	//pairwise cipher suite list; CCMP only
+						0x01, 0x00,	//AKM suite count
+						0x00, 0x0f, 0xac, 0x07,	//TPK Handshake
+						0x00, 0x02,
+						//PMKID shall not be present
+						};
+
+static u8 TDLS_WMMIE[]={0x00, 0x50, 0xf2, 0x02, 0x00, 0x01, 0x00};	//Qos info all set zero
+
+static u8 TDLS_EXT_CAPIE[] = {0x00, 0x00, 0x00, 0x50, 0x20};	//bit(28), bit(30), bit(37)
+
+//	SRC: Supported Regulatory Classes
+static u8 TDLS_SRC[] = { 0x01, 0x01, 0x02, 0x03, 0x04, 0x0c, 0x16, 0x17, 0x18, 0x19, 0x1b, 0x1c, 0x1d, 0x1e, 0x20, 0x21 };
+
+void rtw_reset_tdls_info(_adapter* padapter);
+int rtw_init_tdls_info(_adapter* padapter);
+void rtw_free_tdls_info(struct tdls_info *ptdlsinfo);
+void issue_nulldata_to_TDLS_peer_STA(_adapter *padapter, struct sta_info *ptdls_sta, unsigned int power_mode);
+void init_TPK_timer(_adapter *padapter, struct sta_info *psta);
+void init_ch_switch_timer(_adapter *padapter, struct sta_info *psta);
+void init_base_ch_timer(_adapter *padapter, struct sta_info *psta);
+void init_off_ch_timer(_adapter *padapter, struct sta_info *psta);
+void init_tdls_alive_timer(_adapter *padapter, struct sta_info *psta);
+void init_handshake_timer(_adapter *padapter, struct sta_info *psta);
+void free_tdls_sta(_adapter *padapter, struct sta_info *ptdls_sta);
+#ifdef CONFIG_WFD
+void issue_tunneled_probe_req(_adapter *padapter);
+void issue_tunneled_probe_rsp(_adapter *padapter, union recv_frame *precv_frame);
+#endif //CONFIG_WFD
+void issue_tdls_dis_req(_adapter *padapter, u8 *mac_addr);
+void issue_tdls_setup_req(_adapter *padapter, u8 *mac_addr);
+void issue_tdls_setup_rsp(_adapter *padapter, union recv_frame *precv_frame);
+void issue_tdls_setup_cfm(_adapter *padapter, union recv_frame *precv_frame);
+void issue_tdls_dis_rsp(_adapter * padapter, union recv_frame * precv_frame, u8 dialog);
+void issue_tdls_teardown(_adapter *padapter, u8 *mac_addr);
+void issue_tdls_peer_traffic_indication(_adapter *padapter, struct sta_info *psta);
+void issue_tdls_ch_switch_req(_adapter *padapter, u8 *mac_addr);
+void issue_tdls_ch_switch_rsp(_adapter *padapter, u8 *mac_addr);
+sint On_TDLS_Dis_Rsp(_adapter *adapter, union recv_frame *precv_frame);
+sint On_TDLS_Setup_Req(_adapter *adapter, union recv_frame *precv_frame);
+sint On_TDLS_Setup_Rsp(_adapter *adapter, union recv_frame *precv_frame);
+sint On_TDLS_Setup_Cfm(_adapter *adapter, union recv_frame *precv_frame);
+sint On_TDLS_Dis_Req(_adapter *adapter, union recv_frame *precv_frame);
+sint On_TDLS_Teardown(_adapter *adapter, union recv_frame *precv_frame);
+sint On_TDLS_Peer_Traffic_Rsp(_adapter *adapter, union recv_frame *precv_frame);
+sint On_TDLS_Ch_Switch_Req(_adapter *adapter, union recv_frame *precv_frame);
+sint On_TDLS_Ch_Switch_Rsp(_adapter *adapter, union recv_frame *precv_frame);
+void rtw_build_tdls_setup_req_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+void rtw_build_tdls_setup_rsp_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+void rtw_build_tdls_setup_cfm_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+void rtw_build_tdls_teardown_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+void rtw_build_tdls_dis_req_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+void rtw_build_tdls_dis_rsp_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe, u8 dialog);
+void rtw_build_tdls_peer_traffic_indication_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+void rtw_build_tdls_ch_switch_req_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+void rtw_build_tdls_ch_switch_rsp_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+void rtw_build_tunneled_probe_req_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+void rtw_build_tunneled_probe_rsp_ies(_adapter * padapter, struct xmit_frame * pxmitframe, u8 *pframe);
+
+int update_sgi_tdls(_adapter *padapter, struct sta_info *psta);
+u32 update_mask_tdls(_adapter *padapter, struct sta_info *psta);
+#endif //CONFIG_TDLS
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_version.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_version.h
new file mode 100644
index 000000000000..4fb9dd437109
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_version.h
@@ -0,0 +1 @@
+#define DRIVERVERSION	"v4.0.2_9000.20130911"
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/rtw_xmit.h b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_xmit.h
new file mode 100644
index 000000000000..11c67c4966f9
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/rtw_xmit.h
@@ -0,0 +1,753 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _RTW_XMIT_H_
+#define _RTW_XMIT_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#ifdef PLATFORM_FREEBSD
+#include <if_ether.h>
+#endif //PLATFORM_FREEBSD
+
+#ifdef CONFIG_SDIO_HCI
+//#define MAX_XMITBUF_SZ (30720)//	(2048)
+#define MAX_XMITBUF_SZ (12288)
+#define NR_XMITBUFF	(16)
+
+#elif defined (CONFIG_USB_HCI)
+#ifdef CONFIG_USB_TX_AGGREGATION
+	#if defined(CONFIG_PLATFORM_ARM_SUNxI) || defined(CONFIG_PLATFORM_ARM_SUN6I)
+		#define MAX_XMITBUF_SZ (12288)  //12k 1536*8
+	#elif defined (CONFIG_PLATFORM_MSTAR)
+		#define MAX_XMITBUF_SZ	7680	// 7.5k
+	#else
+		#define MAX_XMITBUF_SZ	(20480)	// 20k
+	#endif
+#else
+#define MAX_XMITBUF_SZ	(2048)
+#endif //CONFIG_USB_TX_AGGREGATION
+#ifdef CONFIG_SINGLE_XMIT_BUF
+#define NR_XMITBUFF	(1)
+#else
+#define NR_XMITBUFF	(4)
+#endif //CONFIG_SINGLE_XMIT_BUF
+
+#elif defined (CONFIG_PCI_HCI)
+#define MAX_XMITBUF_SZ	(1664)
+#define NR_XMITBUFF	(128)
+#endif
+
+#ifdef PLATFORM_OS_CE
+#define XMITBUF_ALIGN_SZ 4
+#else
+#ifdef CONFIG_PCI_HCI
+#define XMITBUF_ALIGN_SZ 4
+#else
+#define XMITBUF_ALIGN_SZ 512
+#endif
+#endif
+
+// xmit extension buff defination
+#define MAX_XMIT_EXTBUF_SZ	(1536)
+#ifdef CONFIG_SINGLE_XMIT_BUF
+#define NR_XMIT_EXTBUFF	(1)
+#else
+#define NR_XMIT_EXTBUFF	(32)
+#endif //CONFIG_SINGLE_XMIT_BUF
+
+#define MAX_NUMBLKS		(1)
+
+#define XMIT_VO_QUEUE (0)
+#define XMIT_VI_QUEUE (1)
+#define XMIT_BE_QUEUE (2)
+#define XMIT_BK_QUEUE (3)
+
+#define VO_QUEUE_INX		0
+#define VI_QUEUE_INX		1
+#define BE_QUEUE_INX		2
+#define BK_QUEUE_INX		3
+#define BCN_QUEUE_INX		4
+#define MGT_QUEUE_INX		5
+#define HIGH_QUEUE_INX		6
+#define TXCMD_QUEUE_INX	7
+
+#define HW_QUEUE_ENTRY	8
+
+#ifdef CONFIG_PCI_HCI
+//#define TXDESC_NUM						64
+#define TXDESC_NUM						128
+#define TXDESC_NUM_BE_QUEUE			128
+#endif
+
+#define WEP_IV(pattrib_iv, dot11txpn, keyidx)\
+do{\
+	pattrib_iv[0] = dot11txpn._byte_.TSC0;\
+	pattrib_iv[1] = dot11txpn._byte_.TSC1;\
+	pattrib_iv[2] = dot11txpn._byte_.TSC2;\
+	pattrib_iv[3] = ((keyidx & 0x3)<<6);\
+	dot11txpn.val = (dot11txpn.val == 0xffffff) ? 0: (dot11txpn.val+1);\
+}while(0)
+
+
+#define TKIP_IV(pattrib_iv, dot11txpn, keyidx)\
+do{\
+	pattrib_iv[0] = dot11txpn._byte_.TSC1;\
+	pattrib_iv[1] = (dot11txpn._byte_.TSC1 | 0x20) & 0x7f;\
+	pattrib_iv[2] = dot11txpn._byte_.TSC0;\
+	pattrib_iv[3] = BIT(5) | ((keyidx & 0x3)<<6);\
+	pattrib_iv[4] = dot11txpn._byte_.TSC2;\
+	pattrib_iv[5] = dot11txpn._byte_.TSC3;\
+	pattrib_iv[6] = dot11txpn._byte_.TSC4;\
+	pattrib_iv[7] = dot11txpn._byte_.TSC5;\
+	dot11txpn.val = dot11txpn.val == 0xffffffffffffULL ? 0: (dot11txpn.val+1);\
+}while(0)
+
+#define AES_IV(pattrib_iv, dot11txpn, keyidx)\
+do{\
+	pattrib_iv[0] = dot11txpn._byte_.TSC0;\
+	pattrib_iv[1] = dot11txpn._byte_.TSC1;\
+	pattrib_iv[2] = 0;\
+	pattrib_iv[3] = BIT(5) | ((keyidx & 0x3)<<6);\
+	pattrib_iv[4] = dot11txpn._byte_.TSC2;\
+	pattrib_iv[5] = dot11txpn._byte_.TSC3;\
+	pattrib_iv[6] = dot11txpn._byte_.TSC4;\
+	pattrib_iv[7] = dot11txpn._byte_.TSC5;\
+	dot11txpn.val = dot11txpn.val == 0xffffffffffffULL ? 0: (dot11txpn.val+1);\
+}while(0)
+
+
+#define HWXMIT_ENTRY	4
+
+#define TXDESC_SIZE 32
+
+#ifdef CONFIG_SDIO_HCI
+#define TXDESC_OFFSET TXDESC_SIZE
+#endif
+
+#ifdef CONFIG_USB_HCI
+#define PACKET_OFFSET_SZ (8)
+#define TXDESC_OFFSET (TXDESC_SIZE + PACKET_OFFSET_SZ)
+#endif
+
+#ifdef CONFIG_PCI_HCI
+#define TXDESC_OFFSET 0
+#define TX_DESC_NEXT_DESC_OFFSET	40
+#endif
+
+//
+//defined for TX DESC Operation
+//
+
+#define MAX_TID (15)
+
+//OFFSET 0
+#define OFFSET_SZ	0
+#define OFFSET_SHT	16
+#define BMC		BIT(24)
+#define LSG		BIT(26)
+#define FSG		BIT(27)
+#define OWN 		BIT(31)
+
+//OFFSET 4
+#define PKT_OFFSET_SZ	0
+#define BK		BIT(6)
+#define QSEL_SHT	8
+#define Rate_ID_SHT	16
+#define NAVUSEHDR	BIT(20)
+#define PKT_OFFSET_SHT	26
+#define HWPC		BIT(31)
+
+//OFFSET 8
+#define AGG_EN		BIT(29)
+
+//OFFSET 12
+#define SEQ_SHT		16
+
+//OFFSET 16
+#define QoS		BIT(6)
+#define HW_SEQ_EN	BIT(7)
+#define USERATE		BIT(8)
+#define DISDATAFB	BIT(10)
+#define DATA_SHORT	BIT(24)
+#define DATA_BW		BIT(25)
+
+//OFFSET 20
+#define SGI		BIT(6)
+
+struct tx_desc{
+
+	//DWORD 0
+	unsigned int txdw0;
+
+	unsigned int txdw1;
+
+	unsigned int txdw2;
+
+	unsigned int txdw3;
+
+	unsigned int txdw4;
+
+	unsigned int txdw5;
+
+	unsigned int txdw6;
+
+	unsigned int txdw7;
+#ifdef CONFIG_PCI_HCI
+	unsigned int txdw8;
+
+	unsigned int txdw9;
+
+	unsigned int txdw10;
+
+	unsigned int txdw11;
+
+	// 2008/05/15 MH Because PCIE HW memory R/W 4K limit. And now,  our descriptor
+	// size is 40 bytes. If you use more than 102 descriptor( 103*40>4096), HW will execute
+	// memoryR/W CRC error. And then all DMA fetch will fail. We must decrease descriptor
+	// number or enlarge descriptor size as 64 bytes.
+	unsigned int txdw12;
+
+	unsigned int txdw13;
+
+	unsigned int txdw14;
+
+	unsigned int txdw15;
+#endif
+};
+
+
+union txdesc {
+	struct tx_desc txdesc;
+	unsigned int value[TXDESC_SIZE>>2];
+};
+
+#ifdef CONFIG_PCI_HCI
+#define PCI_MAX_TX_QUEUE_COUNT	8
+
+struct rtw_tx_ring {
+	struct tx_desc	*desc;
+	dma_addr_t		dma;
+	unsigned int		idx;
+	unsigned int		entries;
+	_queue			queue;
+	u32				qlen;
+};
+#endif
+
+struct	hw_xmit	{
+	//_lock xmit_lock;
+	//_list	pending;
+	_queue *sta_queue;
+	//struct hw_txqueue *phwtxqueue;
+	//sint	txcmdcnt;
+	int	accnt;
+};
+
+#if 0
+struct pkt_attrib
+{
+	u8	type;
+	u8	subtype;
+	u8	bswenc;
+	u8	dhcp_pkt;
+	u16	ether_type;
+	int	pktlen;		//the original 802.3 pkt raw_data len (not include ether_hdr data)
+	int	pkt_hdrlen;	//the original 802.3 pkt header len
+	int	hdrlen;		//the WLAN Header Len
+	int	nr_frags;
+	int	last_txcmdsz;
+	int	encrypt;	//when 0 indicate no encrypt. when non-zero, indicate the encrypt algorith
+	u8	iv[8];
+	int	iv_len;
+	u8	icv[8];
+	int	icv_len;
+	int	priority;
+	int	ack_policy;
+	int	mac_id;
+	int	vcs_mode;	//virtual carrier sense method
+
+	u8 	dst[ETH_ALEN];
+	u8	src[ETH_ALEN];
+	u8	ta[ETH_ALEN];
+	u8 	ra[ETH_ALEN];
+
+	u8	key_idx;
+
+	u8	qos_en;
+	u8	ht_en;
+	u8	raid;//rate adpative id
+	u8	bwmode;
+	u8	ch_offset;//PRIME_CHNL_OFFSET
+	u8	sgi;//short GI
+	u8	ampdu_en;//tx ampdu enable
+	u8	mdata;//more data bit
+	u8	eosp;
+
+	u8	pctrl;//per packet txdesc control enable
+	u8	triggered;//for ap mode handling Power Saving sta
+
+	u32	qsel;
+	u16	seqnum;
+
+	struct sta_info * psta;
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_TX
+	u8	hw_tcp_csum;
+#endif
+};
+#else
+//reduce size
+struct pkt_attrib
+{
+	u8	type;
+	u8	subtype;
+	u8	bswenc;
+	u8	dhcp_pkt;
+	u16	ether_type;
+	u16	seqnum;
+	u16	pkt_hdrlen;	//the original 802.3 pkt header len
+	u16	hdrlen;		//the WLAN Header Len
+	u32	pktlen;		//the original 802.3 pkt raw_data len (not include ether_hdr data)
+	u32	last_txcmdsz;
+	u8	nr_frags;
+	u8	encrypt;	//when 0 indicate no encrypt. when non-zero, indicate the encrypt algorith
+	u8	iv_len;
+	u8	icv_len;
+	u8	iv[8];
+	u8	icv[8];
+	u8	priority;
+	u8	ack_policy;
+	u8	mac_id;
+	u8	vcs_mode;	//virtual carrier sense method
+	u8 	dst[ETH_ALEN];
+	u8	src[ETH_ALEN];
+	u8	ta[ETH_ALEN];
+	u8 	ra[ETH_ALEN];
+	u8	key_idx;
+	u8	qos_en;
+	u8	ht_en;
+	u8	raid;//rate adpative id
+	u8	bwmode;
+	u8	ch_offset;//PRIME_CHNL_OFFSET
+	u8	sgi;//short GI
+	u8	ampdu_en;//tx ampdu enable
+	u8	mdata;//more data bit
+	u8	pctrl;//per packet txdesc control enable
+	u8	triggered;//for ap mode handling Power Saving sta
+	u8	qsel;
+	u8	eosp;
+	u8	rate;
+	u8	intel_proxim;
+	u8 	retry_ctrl;
+	struct sta_info * psta;
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_TX
+	u8	hw_tcp_csum;
+#endif
+	union Keytype	dot11tkiptxmickey;
+	//union Keytype	dot11tkiprxmickey;
+	union Keytype	dot118021x_UncstKey;
+};
+#endif
+
+#ifdef PLATFORM_FREEBSD
+#define ETH_ALEN	6		/* Octets in one ethernet addr	 */
+#define ETH_HLEN	14		/* Total octets in header.	 */
+#define ETH_P_IP	0x0800		/* Internet Protocol packet	*/
+
+/*struct rtw_ieee80211_hdr {
+	uint16_t frame_control;
+	uint16_t duration_id;
+	u8 addr1[6];
+	u8 addr2[6];
+	u8 addr3[6];
+	uint16_t seq_ctrl;
+	u8 addr4[6];
+} ;*/
+#endif //PLATFORM_FREEBSD
+
+#define WLANHDR_OFFSET	64
+
+#define NULL_FRAMETAG		(0x0)
+#define DATA_FRAMETAG		0x01
+#define L2_FRAMETAG		0x02
+#define MGNT_FRAMETAG		0x03
+#define AMSDU_FRAMETAG	0x04
+
+#define EII_FRAMETAG		0x05
+#define IEEE8023_FRAMETAG  0x06
+
+#define MP_FRAMETAG		0x07
+
+#define TXAGG_FRAMETAG 	0x08
+
+struct  submit_ctx{
+	u32 submit_time; /* */
+	u32 timeout_ms; /* <0: not synchronous, 0: wait forever, >0: up to ms waiting */
+	int status; /* status for operation */
+#ifdef PLATFORM_LINUX
+	struct completion done;
+#endif
+};
+
+enum {
+	RTW_SCTX_SUBMITTED = -1,
+	RTW_SCTX_DONE_SUCCESS = 0,
+	RTW_SCTX_DONE_UNKNOWN,
+	RTW_SCTX_DONE_TIMEOUT,
+	RTW_SCTX_DONE_BUF_ALLOC,
+	RTW_SCTX_DONE_BUF_FREE,
+	RTW_SCTX_DONE_WRITE_PORT_ERR,
+	RTW_SCTX_DONE_TX_DESC_NA,
+	RTW_SCTX_DONE_TX_DENY,
+	RTW_SCTX_DONE_CCX_PKT_FAIL,
+	RTW_SCTX_DONE_DRV_STOP,
+	RTW_SCTX_DONE_DEV_REMOVE,
+};
+
+
+void rtw_sctx_init(struct submit_ctx *sctx, int timeout_ms);
+int rtw_sctx_wait(struct submit_ctx *sctx);
+void rtw_sctx_done_err(struct submit_ctx **sctx, int status);
+void rtw_sctx_done(struct submit_ctx **sctx);
+
+struct xmit_buf
+{
+	_list	list;
+
+	_adapter *padapter;
+
+	u8 *pallocated_buf;
+
+	u8 *pbuf;
+
+	void *priv_data;
+
+	u16 ext_tag; // 0: Normal xmitbuf, 1: extension xmitbuf.
+	u16 flags;
+	u32 alloc_sz;
+
+	struct submit_ctx *sctx;
+
+#ifdef CONFIG_USB_HCI
+
+	u32 sz[8];
+
+#if defined(PLATFORM_OS_XP)||defined(PLATFORM_LINUX) || defined(PLATFORM_FREEBSD)
+	PURB	pxmit_urb[8];
+	dma_addr_t dma_transfer_addr;	/* (in) dma addr for transfer_buffer */
+#endif
+
+#ifdef PLATFORM_OS_XP
+	PIRP		pxmit_irp[8];
+#endif
+
+#ifdef PLATFORM_OS_CE
+	USB_TRANSFER	usb_transfer_write_port;
+#endif
+
+	u8 bpending[8];
+
+	sint last[8];
+
+#endif
+
+#ifdef CONFIG_SDIO_HCI
+	u32  len;
+	u8 *phead;
+	u8 *pdata;
+	u8 *ptail;
+	u8 *pend;
+	u32 ff_hwaddr;
+#ifdef PLATFORM_OS_XP
+	PMDL pxmitbuf_mdl;
+	PIRP  pxmitbuf_irp;
+	PSDBUS_REQUEST_PACKET pxmitbuf_sdrp;
+#endif
+#endif
+
+#ifdef CONFIG_PCI_HCI
+	u32  len;
+#endif
+
+#ifdef DBG_XMIT_BUF
+	u8 no;
+#endif
+
+};
+
+struct xmit_frame
+{
+	_list	list;
+
+	struct pkt_attrib attrib;
+
+	_pkt *pkt;
+
+	int	frame_tag;
+
+	_adapter *padapter;
+
+	u8	*buf_addr;
+
+	struct xmit_buf *pxmitbuf;
+
+#ifdef CONFIG_SDIO_HCI
+	u8	pg_num;
+	u8	agg_num;
+#endif
+
+#ifdef CONFIG_USB_HCI
+#ifdef CONFIG_USB_TX_AGGREGATION
+	u8	agg_num;
+#endif
+	u8	pkt_offset;
+#ifdef CONFIG_RTL8192D
+	u8	EMPktNum;
+	u16	EMPktLen[5];//The max value by HW
+#endif
+#endif
+#ifdef CONFIG_XMIT_ACK
+	u8 ack_report;
+#endif
+
+	u8 *alloc_addr; /* the actual address this xmitframe allocated */
+	u8 ext_tag; /* 0:data, 1:mgmt */
+
+};
+
+struct tx_servq {
+	_list	tx_pending;
+	_queue	sta_pending;
+	int qcnt;
+};
+
+
+
+struct sta_xmit_priv
+{
+	_lock	lock;
+	sint	option;
+	sint	apsd_setting;	//When bit mask is on, the associated edca queue supports APSD.
+
+
+	//struct tx_servq blk_q[MAX_NUMBLKS];
+	struct tx_servq	be_q;			//priority == 0,3
+	struct tx_servq	bk_q;			//priority == 1,2
+	struct tx_servq	vi_q;			//priority == 4,5
+	struct tx_servq	vo_q;			//priority == 6,7
+	_list 	legacy_dz;
+	_list  apsd;
+
+	u16 txseq_tid[16];
+
+	//uint	sta_tx_bytes;
+	//u64	sta_tx_pkts;
+	//uint	sta_tx_fail;
+
+};
+
+
+struct	hw_txqueue	{
+	volatile sint	head;
+	volatile sint	tail;
+	volatile sint 	free_sz;	//in units of 64 bytes
+	volatile sint      free_cmdsz;
+	volatile sint	 txsz[8];
+	uint	ff_hwaddr;
+	uint	cmd_hwaddr;
+	sint	ac_tag;
+};
+
+
+struct	xmit_priv	{
+
+	_lock	lock;
+
+	_sema	xmit_sema;
+	_sema	terminate_xmitthread_sema;
+
+	//_queue	blk_strms[MAX_NUMBLKS];
+	_queue	be_pending;
+	_queue	bk_pending;
+	_queue	vi_pending;
+	_queue	vo_pending;
+	_queue	bm_pending;
+
+	//_queue	legacy_dz_queue;
+	//_queue	apsd_queue;
+
+	u8 *pallocated_frame_buf;
+	u8 *pxmit_frame_buf;
+	uint free_xmitframe_cnt;
+	_queue	free_xmit_queue;
+
+	//uint mapping_addr;
+	//uint pkt_sz;
+
+	u8 *xframe_ext_alloc_addr;
+	u8 *xframe_ext;
+	uint free_xframe_ext_cnt;
+	_queue free_xframe_ext_queue;
+
+	//struct	hw_txqueue	be_txqueue;
+	//struct	hw_txqueue	bk_txqueue;
+	//struct	hw_txqueue	vi_txqueue;
+	//struct	hw_txqueue	vo_txqueue;
+	//struct	hw_txqueue	bmc_txqueue;
+
+	uint	frag_len;
+
+	_adapter	*adapter;
+
+	u8   vcs_setting;
+	u8	vcs;
+	u8	vcs_type;
+	//u16  rts_thresh;
+
+	u64	tx_bytes;
+	u64	tx_pkts;
+	u64	tx_drop;
+	u64	last_tx_bytes;
+	u64	last_tx_pkts;
+
+	struct hw_xmit *hwxmits;
+	u8	hwxmit_entry;
+
+#ifdef CONFIG_USB_HCI
+	_sema	tx_retevt;//all tx return event;
+	u8		txirp_cnt;//
+
+#ifdef PLATFORM_OS_CE
+	USB_TRANSFER	usb_transfer_write_port;
+//	USB_TRANSFER	usb_transfer_write_mem;
+#endif
+#ifdef PLATFORM_LINUX
+	struct tasklet_struct xmit_tasklet;
+#endif
+#ifdef PLATFORM_FREEBSD
+	struct task xmit_tasklet;
+#endif
+	//per AC pending irp
+	int beq_cnt;
+	int bkq_cnt;
+	int viq_cnt;
+	int voq_cnt;
+
+#endif
+
+#ifdef CONFIG_PCI_HCI
+	// Tx
+	struct rtw_tx_ring	tx_ring[PCI_MAX_TX_QUEUE_COUNT];
+	int	txringcount[PCI_MAX_TX_QUEUE_COUNT];
+#ifdef PLATFORM_LINUX
+	struct tasklet_struct xmit_tasklet;
+#endif
+#endif
+
+	_queue free_xmitbuf_queue;
+	_queue pending_xmitbuf_queue;
+	u8 *pallocated_xmitbuf;
+	u8 *pxmitbuf;
+	uint free_xmitbuf_cnt;
+
+	_queue free_xmit_extbuf_queue;
+	u8 *pallocated_xmit_extbuf;
+	u8 *pxmit_extbuf;
+	uint free_xmit_extbuf_cnt;
+
+	u16	nqos_ssn;
+
+#ifdef CONFIG_XMIT_ACK
+	int	ack_tx;
+	_mutex ack_tx_mutex;
+	struct submit_ctx ack_tx_ops;
+#endif
+	_lock lock_sctx;
+};
+
+extern struct xmit_buf *rtw_alloc_xmitbuf_ext(struct xmit_priv *pxmitpriv);
+extern s32 rtw_free_xmitbuf_ext(struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf);
+
+extern struct xmit_buf *rtw_alloc_xmitbuf(struct xmit_priv *pxmitpriv);
+extern s32 rtw_free_xmitbuf(struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf);
+
+void rtw_count_tx_stats(_adapter *padapter, struct xmit_frame *pxmitframe, int sz);
+extern void rtw_update_protection(_adapter *padapter, u8 *ie, uint ie_len);
+extern s32 rtw_make_wlanhdr(_adapter *padapter, u8 *hdr, struct pkt_attrib *pattrib);
+extern s32 rtw_put_snap(u8 *data, u16 h_proto);
+
+extern struct xmit_frame *rtw_alloc_xmitframe(struct xmit_priv *pxmitpriv);
+struct xmit_frame *rtw_alloc_xmitframe_ext(struct xmit_priv *pxmitpriv);
+struct xmit_frame *rtw_alloc_xmitframe_once(struct xmit_priv *pxmitpriv);
+extern s32 rtw_free_xmitframe(struct xmit_priv *pxmitpriv, struct xmit_frame *pxmitframe);
+extern void rtw_free_xmitframe_queue(struct xmit_priv *pxmitpriv, _queue *pframequeue);
+struct tx_servq *rtw_get_sta_pending(_adapter *padapter, struct sta_info *psta, sint up, u8 *ac);
+extern s32 rtw_xmitframe_enqueue(_adapter *padapter, struct xmit_frame *pxmitframe);
+extern struct xmit_frame* rtw_dequeue_xframe(struct xmit_priv *pxmitpriv, struct hw_xmit *phwxmit_i, sint entry);
+
+extern s32 rtw_xmit_classifier(_adapter *padapter, struct xmit_frame *pxmitframe);
+extern thread_return rtw_xmit_thread(thread_context context);
+extern u32 rtw_calculate_wlan_pkt_size_by_attribue(struct pkt_attrib *pattrib);
+#define rtw_wlan_pkt_size(f) rtw_calculate_wlan_pkt_size_by_attribue(&f->attrib)
+extern s32 rtw_xmitframe_coalesce(_adapter *padapter, _pkt *pkt, struct xmit_frame *pxmitframe);
+#ifdef CONFIG_IEEE80211W
+extern s32 rtw_mgmt_xmitframe_coalesce(_adapter *padapter, _pkt *pkt, struct xmit_frame *pxmitframe);
+#endif //CONFIG_IEEE80211W
+#ifdef CONFIG_TDLS
+s32 rtw_xmit_tdls_coalesce(_adapter *padapter, struct xmit_frame *pxmitframe, u8 action);
+#endif //CONFIG_TDLS
+s32 _rtw_init_hw_txqueue(struct hw_txqueue* phw_txqueue, u8 ac_tag);
+void _rtw_init_sta_xmit_priv(struct sta_xmit_priv *psta_xmitpriv);
+
+
+s32 rtw_txframes_pending(_adapter *padapter);
+s32 rtw_txframes_sta_ac_pending(_adapter *padapter, struct pkt_attrib *pattrib);
+void rtw_init_hwxmits(struct hw_xmit *phwxmit, sint entry);
+
+
+s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, _adapter *padapter);
+void _rtw_free_xmit_priv (struct xmit_priv *pxmitpriv);
+
+
+void rtw_alloc_hwxmits(_adapter *padapter);
+void rtw_free_hwxmits(_adapter *padapter);
+
+
+s32 rtw_xmit(_adapter *padapter, _pkt **pkt);
+
+#if defined(CONFIG_AP_MODE) || defined(CONFIG_TDLS)
+sint xmitframe_enqueue_for_sleeping_sta(_adapter *padapter, struct xmit_frame *pxmitframe);
+void stop_sta_xmit(_adapter *padapter, struct sta_info *psta);
+void wakeup_sta_to_xmit(_adapter *padapter, struct sta_info *psta);
+void xmit_delivery_enabled_frames(_adapter *padapter, struct sta_info *psta);
+#endif
+
+u8	qos_acm(u8 acm_mask, u8 priority);
+
+#ifdef CONFIG_XMIT_ACK
+int rtw_ack_tx_wait(struct xmit_priv *pxmitpriv, u32 timeout_ms);
+void rtw_ack_tx_done(struct xmit_priv *pxmitpriv, int status);
+#endif //CONFIG_XMIT_ACK
+
+
+//include after declaring struct xmit_buf, in order to avoid warning
+#include <xmit_osdep.h>
+
+#endif	//_RTL871X_XMIT_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/sta_info.h b/drivers/net/wireless/realtek/rtl8192cu/include/sta_info.h
new file mode 100644
index 000000000000..9cbf934fdf7f
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/sta_info.h
@@ -0,0 +1,431 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __STA_INFO_H_
+#define __STA_INFO_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <wifi.h>
+
+#define IBSS_START_MAC_ID	2
+#define NUM_STA 32
+#define NUM_ACL 16
+
+
+//if mode ==0, then the sta is allowed once the addr is hit.
+//if mode ==1, then the sta is rejected once the addr is non-hit.
+struct rtw_wlan_acl_node {
+        _list		        list;
+        u8       addr[ETH_ALEN];
+        u8       valid;
+};
+
+//mode=0, disable
+//mode=1, accept unless in deny list
+//mode=2, deny unless in accept list
+struct wlan_acl_pool {
+	int mode;
+	int num;
+	struct rtw_wlan_acl_node aclnode[NUM_ACL];
+	_queue	acl_node_q;
+};
+
+typedef struct _RSSI_STA{
+	s32	UndecoratedSmoothedPWDB;
+	s32	UndecoratedSmoothedCCK;
+	s32	UndecoratedSmoothedOFDM;
+	u64	PacketMap;
+	u8	ValidBit;
+}RSSI_STA, *PRSSI_STA;
+
+struct	stainfo_stats	{
+
+	u64 rx_mgnt_pkts;
+		u64 rx_beacon_pkts;
+		u64 rx_probereq_pkts;
+		u64 rx_probersp_pkts;
+		u64 rx_probersp_bm_pkts;
+		u64 rx_probersp_uo_pkts;
+	u64 rx_ctrl_pkts;
+	u64 rx_data_pkts;
+
+	u64	last_rx_mgnt_pkts;
+		u64 last_rx_beacon_pkts;
+		u64 last_rx_probereq_pkts;
+		u64 last_rx_probersp_pkts;
+		u64 last_rx_probersp_bm_pkts;
+		u64 last_rx_probersp_uo_pkts;
+	u64	last_rx_ctrl_pkts;
+	u64	last_rx_data_pkts;
+
+	u64	rx_bytes;
+	u64	rx_drops;
+
+	u64	tx_pkts;
+	u64	tx_bytes;
+	u64  tx_drops;
+
+};
+
+#ifdef CONFIG_TDLS
+struct TDLS_PeerKey {
+	u8 kck[16]; /* TPK-KCK */
+	u8 tk[16]; /* TPK-TK; only CCMP will be used */
+} ;
+#endif //CONFIG_TDLS
+
+struct sta_info {
+
+	_lock	lock;
+	_list	list; //free_sta_queue
+	_list	hash_list; //sta_hash
+	//_list asoc_list; //20061114
+	//_list sleep_list;//sleep_q
+	//_list wakeup_list;//wakeup_q
+
+	struct sta_xmit_priv sta_xmitpriv;
+	struct sta_recv_priv sta_recvpriv;
+
+	_queue sleep_q;
+	unsigned int sleepq_len;
+
+	uint state;
+	uint aid;
+	uint mac_id;
+	uint qos_option;
+	u8	hwaddr[ETH_ALEN];
+
+	uint	ieee8021x_blocked;	//0: allowed, 1:blocked
+	uint	dot118021XPrivacy; //aes, tkip...
+	union Keytype	dot11tkiptxmickey;
+	union Keytype	dot11tkiprxmickey;
+	union Keytype	dot118021x_UncstKey;
+	union pn48		dot11txpn;			// PN48 used for Unicast xmit.
+#ifdef CONFIG_IEEE80211W
+	union pn48		dot11wtxpn;			// PN48 used for Unicast mgmt xmit.
+#endif //CONFIG_IEEE80211W
+	union pn48		dot11rxpn;			// PN48 used for Unicast recv.
+
+
+	u8	bssrateset[16];
+	u32	bssratelen;
+	s32  rssi;
+	s32	signal_quality;
+
+	u8	cts2self;
+	u8	rtsen;
+
+	u8	raid;
+	u8 	init_rate;
+	u32	ra_mask;
+	struct stainfo_stats sta_stats;
+
+#ifdef CONFIG_TDLS
+	u32	tdls_sta_state;
+	u8	dialog;
+	u8	SNonce[32];
+	u8	ANonce[32];
+	u32	TDLS_PeerKey_Lifetime;
+	u16	TPK_count;
+	_timer	TPK_timer;
+	struct TDLS_PeerKey	tpk;
+	_adapter *padapter;
+	u16	stat_code;
+	u8	off_ch;
+	u16	ch_switch_time;
+	u16	ch_switch_timeout;
+	u8	option;
+	_timer	option_timer;
+	_timer	base_ch_timer;
+	_timer	off_ch_timer;
+
+	_timer handshake_timer;
+	_timer alive_timer1;
+	_timer alive_timer2;
+	u8 timer_flag;
+	u8 alive_count;
+#endif //CONFIG_TDLS
+
+	//for A-MPDU TX, ADDBA timeout check
+	_timer addba_retry_timer;
+
+	//for A-MPDU Rx reordering buffer control
+	struct recv_reorder_ctrl recvreorder_ctrl[16];
+
+	//for A-MPDU Tx
+	//unsigned char		ampdu_txen_bitmap;
+	u16	BA_starting_seqctrl[16];
+
+
+#ifdef CONFIG_80211N_HT
+	struct ht_priv	htpriv;
+#endif
+
+	//Notes:
+	//STA_Mode:
+	//curr_network(mlme_priv/security_priv/qos/ht) + sta_info: (STA & AP) CAP/INFO
+	//scan_q: AP CAP/INFO
+
+	//AP_Mode:
+	//curr_network(mlme_priv/security_priv/qos/ht) : AP CAP/INFO
+	//sta_info: (AP & STA) CAP/INFO
+
+#ifdef CONFIG_AP_MODE
+
+	_list asoc_list;
+	_list auth_list;
+
+	unsigned int expire_to;
+	unsigned int auth_seq;
+	unsigned int authalg;
+	unsigned char chg_txt[128];
+
+	u16 capability;
+	int flags;
+
+	int dot8021xalg;//0:disable, 1:psk, 2:802.1x
+	int wpa_psk;//0:disable, bit(0): WPA, bit(1):WPA2
+	int wpa_group_cipher;
+	int wpa2_group_cipher;
+	int wpa_pairwise_cipher;
+	int wpa2_pairwise_cipher;
+
+	u8 bpairwise_key_installed;
+
+#ifdef CONFIG_NATIVEAP_MLME
+	u8 wpa_ie[32];
+
+	u8 nonerp_set;
+	u8 no_short_slot_time_set;
+	u8 no_short_preamble_set;
+	u8 no_ht_gf_set;
+	u8 no_ht_set;
+	u8 ht_20mhz_set;
+#endif	// CONFIG_NATIVEAP_MLME
+
+	unsigned int tx_ra_bitmap;
+	u8 qos_info;
+
+	u8 max_sp_len;
+	u8 uapsd_bk;//BIT(0): Delivery enabled, BIT(1): Trigger enabled
+	u8 uapsd_be;
+	u8 uapsd_vi;
+	u8 uapsd_vo;
+
+	u8 has_legacy_ac;
+	unsigned int sleepq_ac_len;
+
+#ifdef CONFIG_P2P
+	//p2p priv data
+	u8 is_p2p_device;
+	u8 p2p_status_code;
+
+	//p2p client info
+	u8 dev_addr[ETH_ALEN];
+	//u8 iface_addr[ETH_ALEN];//= hwaddr[ETH_ALEN]
+	u8 dev_cap;
+	u16 config_methods;
+	u8 primary_dev_type[8];
+	u8 num_of_secdev_type;
+	u8 secdev_types_list[32];// 32/8 == 4;
+	u16 dev_name_len;
+	u8 dev_name[32];
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_TX_MCAST2UNI
+	u8 under_exist_checking;
+#endif	// CONFIG_TX_MCAST2UNI
+
+	u8 keep_alive_trycnt;
+
+#endif	// CONFIG_AP_MODE
+
+#ifdef CONFIG_IOCTL_CFG80211
+	u8 *passoc_req;
+	u32 assoc_req_len;
+#endif
+
+	//for DM
+	RSSI_STA	 rssi_stat;
+
+        /* To store the sequence number of received management frame */
+	u16 RxMgmtFrameSeqNum;
+};
+
+#define sta_rx_pkts(sta) \
+	(sta->sta_stats.rx_mgnt_pkts \
+	+ sta->sta_stats.rx_ctrl_pkts \
+	+ sta->sta_stats.rx_data_pkts)
+
+#define sta_last_rx_pkts(sta) \
+	(sta->sta_stats.last_rx_mgnt_pkts \
+	+ sta->sta_stats.last_rx_ctrl_pkts \
+	+ sta->sta_stats.last_rx_data_pkts)
+
+#define sta_rx_data_pkts(sta) \
+	(sta->sta_stats.rx_data_pkts)
+
+#define sta_last_rx_data_pkts(sta) \
+	(sta->sta_stats.last_rx_data_pkts)
+
+#define sta_rx_mgnt_pkts(sta) \
+	(sta->sta_stats.rx_mgnt_pkts)
+
+#define sta_last_rx_mgnt_pkts(sta) \
+	(sta->sta_stats.last_rx_mgnt_pkts)
+
+#define sta_rx_beacon_pkts(sta) \
+	(sta->sta_stats.rx_beacon_pkts)
+
+#define sta_last_rx_beacon_pkts(sta) \
+	(sta->sta_stats.last_rx_beacon_pkts)
+
+#define sta_rx_probereq_pkts(sta) \
+	(sta->sta_stats.rx_probereq_pkts)
+
+#define sta_last_rx_probereq_pkts(sta) \
+	(sta->sta_stats.last_rx_probereq_pkts)
+
+#define sta_rx_probersp_pkts(sta) \
+	(sta->sta_stats.rx_probersp_pkts)
+
+#define sta_last_rx_probersp_pkts(sta) \
+	(sta->sta_stats.last_rx_probersp_pkts)
+
+#define sta_rx_probersp_bm_pkts(sta) \
+	(sta->sta_stats.rx_probersp_bm_pkts)
+
+#define sta_last_rx_probersp_bm_pkts(sta) \
+	(sta->sta_stats.last_rx_probersp_bm_pkts)
+
+#define sta_rx_probersp_uo_pkts(sta) \
+	(sta->sta_stats.rx_probersp_uo_pkts)
+
+#define sta_last_rx_probersp_uo_pkts(sta) \
+	(sta->sta_stats.last_rx_probersp_uo_pkts)
+
+#define sta_update_last_rx_pkts(sta) \
+	do { \
+		sta->sta_stats.last_rx_mgnt_pkts = sta->sta_stats.rx_mgnt_pkts; \
+		sta->sta_stats.last_rx_beacon_pkts = sta->sta_stats.rx_beacon_pkts; \
+		sta->sta_stats.last_rx_probereq_pkts = sta->sta_stats.rx_probereq_pkts; \
+		sta->sta_stats.last_rx_probersp_pkts = sta->sta_stats.rx_probersp_pkts; \
+		sta->sta_stats.last_rx_probersp_bm_pkts = sta->sta_stats.rx_probersp_bm_pkts; \
+		sta->sta_stats.last_rx_probersp_uo_pkts = sta->sta_stats.rx_probersp_uo_pkts; \
+		sta->sta_stats.last_rx_ctrl_pkts = sta->sta_stats.rx_ctrl_pkts; \
+		sta->sta_stats.last_rx_data_pkts = sta->sta_stats.rx_data_pkts; \
+	} while(0)
+
+#define STA_RX_PKTS_ARG(sta) \
+	sta->sta_stats.rx_mgnt_pkts \
+	, sta->sta_stats.rx_ctrl_pkts \
+	, sta->sta_stats.rx_data_pkts
+
+#define STA_LAST_RX_PKTS_ARG(sta) \
+	sta->sta_stats.last_rx_mgnt_pkts \
+	, sta->sta_stats.last_rx_ctrl_pkts \
+	, sta->sta_stats.last_rx_data_pkts
+
+#define STA_RX_PKTS_DIFF_ARG(sta) \
+	sta->sta_stats.rx_mgnt_pkts - sta->sta_stats.last_rx_mgnt_pkts \
+	, sta->sta_stats.rx_ctrl_pkts - sta->sta_stats.last_rx_ctrl_pkts \
+	, sta->sta_stats.rx_data_pkts -sta->sta_stats.last_rx_data_pkts
+
+#define STA_PKTS_FMT "(m:%llu, c:%llu, d:%llu)"
+
+struct	sta_priv {
+
+	u8 *pallocated_stainfo_buf;
+	u8 *pstainfo_buf;
+	_queue	free_sta_queue;
+
+	_lock sta_hash_lock;
+	_list   sta_hash[NUM_STA];
+	int asoc_sta_count;
+	_queue sleep_q;
+	_queue wakeup_q;
+
+	_adapter *padapter;
+
+
+#ifdef CONFIG_AP_MODE
+	_list asoc_list;
+	_list auth_list;
+	_lock asoc_list_lock;
+	_lock auth_list_lock;
+	u8 asoc_list_cnt;
+	u8 auth_list_cnt;
+
+	unsigned int auth_to;  //sec, time to expire in authenticating.
+	unsigned int assoc_to; //sec, time to expire before associating.
+	unsigned int expire_to; //sec , time to expire after associated.
+
+	/* pointers to STA info; based on allocated AID or NULL if AID free
+	 * AID is in the range 1-2007, so sta_aid[0] corresponders to AID 1
+	 * and so on
+	 */
+	struct sta_info *sta_aid[NUM_STA];
+
+	u16 sta_dz_bitmap;//only support 15 stations, staion aid bitmap for sleeping sta.
+	u16 tim_bitmap;//only support 15 stations, aid=0~15 mapping bit0~bit15
+
+	u16 max_num_sta;
+
+	struct wlan_acl_pool acl_list;
+#endif
+
+};
+
+
+__inline static u32 wifi_mac_hash(const u8 *mac)
+{
+        u32 x;
+
+        x = mac[0];
+        x = (x << 2) ^ mac[1];
+        x = (x << 2) ^ mac[2];
+        x = (x << 2) ^ mac[3];
+        x = (x << 2) ^ mac[4];
+        x = (x << 2) ^ mac[5];
+
+        x ^= x >> 8;
+        x  = x & (NUM_STA - 1);
+
+        return x;
+}
+
+
+extern u32	_rtw_init_sta_priv(struct sta_priv *pstapriv);
+extern u32	_rtw_free_sta_priv(struct sta_priv *pstapriv);
+
+#define stainfo_offset_valid(offset) (offset < NUM_STA && offset >= 0)
+int rtw_stainfo_offset(struct sta_priv *stapriv, struct sta_info *sta);
+struct sta_info *rtw_get_stainfo_by_offset(struct sta_priv *stapriv, int offset);
+
+extern struct sta_info *rtw_alloc_stainfo(struct	sta_priv *pstapriv, u8 *hwaddr);
+extern u32	rtw_free_stainfo(_adapter *padapter , struct sta_info *psta);
+extern void rtw_free_all_stainfo(_adapter *padapter);
+extern struct sta_info *rtw_get_stainfo(struct sta_priv *pstapriv, const u8 *hwaddr);
+extern u32 rtw_init_bcmc_stainfo(_adapter* padapter);
+extern struct sta_info* rtw_get_bcmc_stainfo(_adapter* padapter);
+extern u8 rtw_access_ctrl(_adapter *padapter, u8 *mac_addr);
+
+#endif //_STA_INFO_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/usb_hal.h b/drivers/net/wireless/realtek/rtl8192cu/include/usb_hal.h
new file mode 100644
index 000000000000..ff29ea887aaf
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/usb_hal.h
@@ -0,0 +1,36 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __USB_HAL_H__
+#define __USB_HAL_H__
+
+
+void rtl8192cu_set_hal_ops(_adapter * padapter);
+
+void rtl8192du_set_hal_ops(_adapter * padapter);
+#ifdef CONFIG_INTEL_PROXIM
+extern _adapter  *rtw_usb_get_sw_pointer(void);
+#endif	//CONFIG_INTEL_PROXIM
+#ifdef CONFIG_WOWLAN
+#ifdef CONFIG_WOWLAN_MANUAL
+extern int rtw_suspend_toshiba(PADAPTER Adapter);
+extern int rtw_resume_toshiba(PADAPTER Adapter);
+#endif // CONFIG_WOWLAN_MANUAL
+#endif //CONFIG_WOWLAN
+#endif //__USB_HAL_H__
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/usb_ops.h b/drivers/net/wireless/realtek/rtl8192cu/include/usb_ops.h
new file mode 100644
index 000000000000..3160fc9647e8
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/usb_ops.h
@@ -0,0 +1,109 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __USB_OPS_H_
+#define __USB_OPS_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <osdep_intf.h>
+
+#define REALTEK_USB_VENQT_READ		0xC0
+#define REALTEK_USB_VENQT_WRITE		0x40
+#define REALTEK_USB_VENQT_CMD_REQ	0x05
+#define REALTEK_USB_VENQT_CMD_IDX	0x00
+
+enum{
+	VENDOR_WRITE = 0x00,
+	VENDOR_READ = 0x01,
+};
+#define ALIGNMENT_UNIT				16
+#define MAX_VENDOR_REQ_CMD_SIZE	254		//8188cu SIE Support
+#define MAX_USB_IO_CTL_SIZE		(MAX_VENDOR_REQ_CMD_SIZE +ALIGNMENT_UNIT)
+
+#ifdef PLATFORM_LINUX
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,12))
+#define rtw_usb_control_msg(dev, pipe, request, requesttype, value, index, data, size, timeout_ms) \
+	usb_control_msg((dev), (pipe), (request), (requesttype), (value), (index), (data), (size), (timeout_ms))
+#define rtw_usb_bulk_msg(usb_dev, pipe, data, len, actual_length, timeout_ms) \
+	usb_bulk_msg((usb_dev), (pipe), (data), (len), (actual_length), (timeout_ms))
+#else
+#define rtw_usb_control_msg(dev, pipe, request, requesttype, value, index, data, size,timeout_ms) \
+	usb_control_msg((dev), (pipe), (request), (requesttype), (value), (index), (data), (size), \
+		((timeout_ms) == 0) ||((timeout_ms)*HZ/1000>0)?((timeout_ms)*HZ/1000):1)
+#define rtw_usb_bulk_msg(usb_dev, pipe, data, len, actual_length, timeout_ms) \
+	usb_bulk_msg((usb_dev), (pipe), (data), (len), (actual_length), \
+		((timeout_ms) == 0) ||((timeout_ms)*HZ/1000>0)?((timeout_ms)*HZ/1000):1)
+#endif
+#include <usb_ops_linux.h>
+#endif //PLATFORM_LINUX
+
+#ifdef CONFIG_RTL8192C
+void rtl8192cu_set_intf_ops(struct _io_ops *pops);
+#define usb_set_intf_ops	rtl8192cu_set_intf_ops
+
+void rtl8192cu_recv_tasklet(void *priv);
+
+void rtl8192cu_xmit_tasklet(void *priv);
+#endif
+
+#ifdef CONFIG_RTL8192D
+void rtl8192du_set_intf_ops(struct _io_ops *pops);
+#define usb_set_intf_ops	rtl8192du_set_intf_ops
+
+#ifndef PLATFORM_FREEBSD
+void rtl8192du_recv_tasklet(void *priv);
+#else	// PLATFORM_FREEBSD
+void rtl8192du_recv_tasklet(void *priv, int npending);
+#ifdef CONFIG_RX_INDICATE_QUEUE
+void rtw_rx_indicate_tasklet(void *priv, int npending);
+#endif	// CONFIG_RX_INDICATE_QUEUE
+#endif	// PLATFORM_FREEBSD
+
+void rtl8192du_xmit_tasklet(void *priv);
+#endif
+
+/*
+* Increase and check if the continual_urb_error of this @param dvobjprive is larger than MAX_CONTINUAL_URB_ERR
+* @return _TRUE:
+* @return _FALSE:
+*/
+static inline int rtw_inc_and_chk_continual_urb_error(struct dvobj_priv *dvobj)
+{
+	int ret = _FALSE;
+	int value;
+	if( (value=ATOMIC_INC_RETURN(&dvobj->continual_urb_error)) > MAX_CONTINUAL_URB_ERR) {
+		DBG_871X("[dvobj:%p][ERROR] continual_urb_error:%d > %d\n", dvobj, value, MAX_CONTINUAL_URB_ERR);
+		ret = _TRUE;
+	} else {
+		//DBG_871X("[dvobj:%p] continual_urb_error:%d\n", dvobj, value);
+	}
+	return ret;
+}
+
+/*
+* Set the continual_urb_error of this @param dvobjprive to 0
+*/
+static inline void rtw_reset_continual_urb_error(struct dvobj_priv *dvobj)
+{
+	ATOMIC_SET(&dvobj->continual_urb_error, 0);
+}
+
+#endif //__USB_OPS_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/usb_ops_linux.h b/drivers/net/wireless/realtek/rtl8192cu/include/usb_ops_linux.h
new file mode 100644
index 000000000000..d3a55073664b
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/usb_ops_linux.h
@@ -0,0 +1,62 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __USB_OPS_LINUX_H__
+#define __USB_OPS_LINUX_H__
+
+#define VENDOR_CMD_MAX_DATA_LEN	254
+
+#define RTW_USB_CONTROL_MSG_TIMEOUT_TEST	10//ms
+#define RTW_USB_CONTROL_MSG_TIMEOUT	500//ms
+
+#if defined(CONFIG_VENDOR_REQ_RETRY) && defined(CONFIG_USB_VENDOR_REQ_MUTEX)
+/* vendor req retry should be in the situation when each vendor req is atomically submitted from others */
+#define MAX_USBCTRL_VENDORREQ_TIMES	10
+#else
+#define MAX_USBCTRL_VENDORREQ_TIMES	1
+#endif
+
+#define RTW_USB_BULKOUT_TIMEOUT	5000//ms
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)) || (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,18))
+#define _usbctrl_vendorreq_async_callback(urb, regs)	_usbctrl_vendorreq_async_callback(urb)
+#define usb_bulkout_zero_complete(purb, regs)	usb_bulkout_zero_complete(purb)
+#define usb_write_mem_complete(purb, regs)	usb_write_mem_complete(purb)
+#define usb_write_port_complete(purb, regs)	usb_write_port_complete(purb)
+#define usb_read_port_complete(purb, regs)	usb_read_port_complete(purb)
+#define usb_read_interrupt_complete(purb, regs)	usb_read_interrupt_complete(purb)
+#endif
+
+#ifdef CONFIG_USB_SUPPORT_ASYNC_VDN_REQ
+int usb_async_write8(struct intf_hdl *pintfhdl, u32 addr, u8 val);
+int usb_async_write16(struct intf_hdl *pintfhdl, u32 addr, u16 val);
+int usb_async_write32(struct intf_hdl *pintfhdl, u32 addr, u32 val);
+#endif /* CONFIG_USB_SUPPORT_ASYNC_VDN_REQ */
+
+unsigned int ffaddr2pipehdl(struct dvobj_priv *pdvobj, u32 addr);
+
+void usb_read_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem);
+void usb_write_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem);
+
+void usb_read_port_cancel(struct intf_hdl *pintfhdl);
+
+u32 usb_write_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem);
+void usb_write_port_cancel(struct intf_hdl *pintfhdl);
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/usb_osintf.h b/drivers/net/wireless/realtek/rtl8192cu/include/usb_osintf.h
new file mode 100644
index 000000000000..6003ebb554ee
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/usb_osintf.h
@@ -0,0 +1,37 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __USB_OSINTF_H
+#define __USB_OSINTF_H
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <usb_vendor_req.h>
+
+#define USBD_HALTED(Status) ((ULONG)(Status) >> 30 == 3)
+
+
+//uint usb_dvobj_init(_adapter * adapter);
+//void usb_dvobj_deinit(_adapter * adapter);
+
+u8 usbvendorrequest(struct dvobj_priv *pdvobjpriv, RT_USB_BREQUEST brequest, RT_USB_WVALUE wvalue, u8 windex, void* data, u8 datalen, u8 isdirectionin);
+
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/usb_vendor_req.h b/drivers/net/wireless/realtek/rtl8192cu/include/usb_vendor_req.h
new file mode 100644
index 000000000000..0f67122fded6
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/usb_vendor_req.h
@@ -0,0 +1,59 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _USB_VENDOR_REQUEST_H_
+#define _USB_VENDOR_REQUEST_H_
+
+//4	Set/Get Register related wIndex/Data
+#define	RT_USB_RESET_MASK_OFF		0
+#define	RT_USB_RESET_MASK_ON		1
+#define	RT_USB_SLEEP_MASK_OFF		0
+#define	RT_USB_SLEEP_MASK_ON		1
+#define	RT_USB_LDO_ON				1
+#define	RT_USB_LDO_OFF				0
+
+//4	Set/Get SYSCLK related	wValue or Data
+#define	RT_USB_SYSCLK_32KHZ		0
+#define	RT_USB_SYSCLK_40MHZ		1
+#define	RT_USB_SYSCLK_60MHZ		2
+
+
+typedef enum _RT_USB_BREQUEST {
+	RT_USB_SET_REGISTER		= 1,
+	RT_USB_SET_SYSCLK		= 2,
+	RT_USB_GET_SYSCLK		= 3,
+	RT_USB_GET_REGISTER		= 4
+} RT_USB_BREQUEST;
+
+
+typedef enum _RT_USB_WVALUE {
+	RT_USB_RESET_MASK	=	1,
+	RT_USB_SLEEP_MASK	=	2,
+	RT_USB_USB_HRCPWM	=	3,
+	RT_USB_LDO			=	4,
+	RT_USB_BOOT_TYPE	=	5
+} RT_USB_WVALUE;
+
+
+//BOOLEAN usbvendorrequest(PCE_USB_DEVICE	CEdevice, RT_USB_BREQUEST bRequest, RT_USB_WVALUE wValue, UCHAR wIndex, PVOID Data, UCHAR DataLength, BOOLEAN isDirectionIn);
+//BOOLEAN CEusbGetStatusRequest(PCE_USB_DEVICE CEdevice, IN USHORT Op, IN USHORT Index, PVOID Data);
+//BOOLEAN CEusbFeatureRequest(PCE_USB_DEVICE CEdevice, IN USHORT Op, IN USHORT FeatureSelector, IN USHORT Index);
+//BOOLEAN CEusbGetDescriptorRequest(PCE_USB_DEVICE CEdevice, IN short urbLength, IN UCHAR DescriptorType, IN UCHAR Index, IN USHORT LanguageId, IN PVOID  TransferBuffer, IN ULONG TransferBufferLength);
+
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/wifi.h b/drivers/net/wireless/realtek/rtl8192cu/include/wifi.h
new file mode 100644
index 000000000000..c0a748811e08
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/wifi.h
@@ -0,0 +1,1245 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef _WIFI_H_
+#define _WIFI_H_
+
+#include <rtw_byteorder.h>
+
+#ifdef BIT
+//#error	"BIT define occurred earlier elsewhere!\n"
+#undef BIT
+#endif
+#define BIT(x)	(1 << (x))
+
+
+#define WLAN_ETHHDR_LEN		14
+#define WLAN_ETHADDR_LEN	6
+#define WLAN_IEEE_OUI_LEN	3
+#define WLAN_ADDR_LEN		6
+#define WLAN_CRC_LEN		4
+#define WLAN_BSSID_LEN		6
+#define WLAN_BSS_TS_LEN		8
+#define WLAN_HDR_A3_LEN		24
+#define WLAN_HDR_A4_LEN		30
+#define WLAN_HDR_A3_QOS_LEN	26
+#define WLAN_HDR_A4_QOS_LEN	32
+#define WLAN_SSID_MAXLEN	32
+#define WLAN_DATA_MAXLEN	2312
+
+#define WLAN_A3_PN_OFFSET	24
+#define WLAN_A4_PN_OFFSET	30
+
+#define WLAN_MIN_ETHFRM_LEN	60
+#define WLAN_MAX_ETHFRM_LEN	1514
+#define WLAN_ETHHDR_LEN		14
+
+#define P80211CAPTURE_VERSION	0x80211001
+
+#ifdef GREEN_HILL
+#pragma pack(1)
+#endif
+
+enum WIFI_FRAME_TYPE {
+	WIFI_MGT_TYPE  =	(0),
+	WIFI_CTRL_TYPE =	(BIT(2)),
+	WIFI_DATA_TYPE =	(BIT(3)),
+	WIFI_QOS_DATA_TYPE	= (BIT(7)|BIT(3)),	//!< QoS Data
+};
+
+enum WIFI_FRAME_SUBTYPE {
+
+    // below is for mgt frame
+    WIFI_ASSOCREQ       = (0 | WIFI_MGT_TYPE),
+    WIFI_ASSOCRSP       = (BIT(4) | WIFI_MGT_TYPE),
+    WIFI_REASSOCREQ     = (BIT(5) | WIFI_MGT_TYPE),
+    WIFI_REASSOCRSP     = (BIT(5) | BIT(4) | WIFI_MGT_TYPE),
+    WIFI_PROBEREQ       = (BIT(6) | WIFI_MGT_TYPE),
+    WIFI_PROBERSP       = (BIT(6) | BIT(4) | WIFI_MGT_TYPE),
+    WIFI_BEACON         = (BIT(7) | WIFI_MGT_TYPE),
+    WIFI_ATIM           = (BIT(7) | BIT(4) | WIFI_MGT_TYPE),
+    WIFI_DISASSOC       = (BIT(7) | BIT(5) | WIFI_MGT_TYPE),
+    WIFI_AUTH           = (BIT(7) | BIT(5) | BIT(4) | WIFI_MGT_TYPE),
+    WIFI_DEAUTH         = (BIT(7) | BIT(6) | WIFI_MGT_TYPE),
+    WIFI_ACTION         = (BIT(7) | BIT(6) | BIT(4) | WIFI_MGT_TYPE),
+
+    // below is for control frame
+    WIFI_PSPOLL         = (BIT(7) | BIT(5) | WIFI_CTRL_TYPE),
+    WIFI_RTS            = (BIT(7) | BIT(5) | BIT(4) | WIFI_CTRL_TYPE),
+    WIFI_CTS            = (BIT(7) | BIT(6) | WIFI_CTRL_TYPE),
+    WIFI_ACK            = (BIT(7) | BIT(6) | BIT(4) | WIFI_CTRL_TYPE),
+    WIFI_CFEND          = (BIT(7) | BIT(6) | BIT(5) | WIFI_CTRL_TYPE),
+    WIFI_CFEND_CFACK    = (BIT(7) | BIT(6) | BIT(5) | BIT(4) | WIFI_CTRL_TYPE),
+
+    // below is for data frame
+    WIFI_DATA           = (0 | WIFI_DATA_TYPE),
+    WIFI_DATA_CFACK     = (BIT(4) | WIFI_DATA_TYPE),
+    WIFI_DATA_CFPOLL    = (BIT(5) | WIFI_DATA_TYPE),
+    WIFI_DATA_CFACKPOLL = (BIT(5) | BIT(4) | WIFI_DATA_TYPE),
+    WIFI_DATA_NULL      = (BIT(6) | WIFI_DATA_TYPE),
+    WIFI_CF_ACK         = (BIT(6) | BIT(4) | WIFI_DATA_TYPE),
+    WIFI_CF_POLL        = (BIT(6) | BIT(5) | WIFI_DATA_TYPE),
+    WIFI_CF_ACKPOLL     = (BIT(6) | BIT(5) | BIT(4) | WIFI_DATA_TYPE),
+    WIFI_QOS_DATA_NULL	= (BIT(6) | WIFI_QOS_DATA_TYPE),
+};
+
+enum WIFI_REASON_CODE	{
+	_RSON_RESERVED_					= 0,
+	_RSON_UNSPECIFIED_				= 1,
+	_RSON_AUTH_NO_LONGER_VALID_		= 2,
+	_RSON_DEAUTH_STA_LEAVING_		= 3,
+	_RSON_INACTIVITY_				= 4,
+	_RSON_UNABLE_HANDLE_			= 5,
+	_RSON_CLS2_						= 6,
+	_RSON_CLS3_						= 7,
+	_RSON_DISAOC_STA_LEAVING_		= 8,
+	_RSON_ASOC_NOT_AUTH_			= 9,
+
+	// WPA reason
+	_RSON_INVALID_IE_				= 13,
+	_RSON_MIC_FAILURE_				= 14,
+	_RSON_4WAY_HNDSHK_TIMEOUT_		= 15,
+	_RSON_GROUP_KEY_UPDATE_TIMEOUT_	= 16,
+	_RSON_DIFF_IE_					= 17,
+	_RSON_MLTCST_CIPHER_NOT_VALID_	= 18,
+	_RSON_UNICST_CIPHER_NOT_VALID_	= 19,
+	_RSON_AKMP_NOT_VALID_			= 20,
+	_RSON_UNSUPPORT_RSNE_VER_		= 21,
+	_RSON_INVALID_RSNE_CAP_			= 22,
+	_RSON_IEEE_802DOT1X_AUTH_FAIL_	= 23,
+
+	//belowing are Realtek definition
+	_RSON_PMK_NOT_AVAILABLE_		= 24,
+	_RSON_TDLS_TEAR_TOOFAR_			= 25,
+	_RSON_TDLS_TEAR_UN_RSN_			= 26,
+};
+
+/* Reason codes (IEEE 802.11-2007, 7.3.1.7, Table 7-22) */
+#if 0
+#define WLAN_REASON_UNSPECIFIED 1
+#define WLAN_REASON_PREV_AUTH_NOT_VALID 2
+#define WLAN_REASON_DEAUTH_LEAVING 3
+#define WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY 4
+#define WLAN_REASON_DISASSOC_AP_BUSY 5
+#define WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA 6
+#define WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA 7
+#define WLAN_REASON_DISASSOC_STA_HAS_LEFT 8
+#define WLAN_REASON_STA_REQ_ASSOC_WITHOUT_AUTH 9
+#endif
+/* IEEE 802.11h */
+#define WLAN_REASON_PWR_CAPABILITY_NOT_VALID 10
+#define WLAN_REASON_SUPPORTED_CHANNEL_NOT_VALID 11
+#if 0
+/* IEEE 802.11i */
+#define WLAN_REASON_INVALID_IE 13
+#define WLAN_REASON_MICHAEL_MIC_FAILURE 14
+#define WLAN_REASON_4WAY_HANDSHAKE_TIMEOUT 15
+#define WLAN_REASON_GROUP_KEY_UPDATE_TIMEOUT 16
+#define WLAN_REASON_IE_IN_4WAY_DIFFERS 17
+#define WLAN_REASON_GROUP_CIPHER_NOT_VALID 18
+#define WLAN_REASON_PAIRWISE_CIPHER_NOT_VALID 19
+#define WLAN_REASON_AKMP_NOT_VALID 20
+#define WLAN_REASON_UNSUPPORTED_RSN_IE_VERSION 21
+#define WLAN_REASON_INVALID_RSN_IE_CAPAB 22
+#define WLAN_REASON_IEEE_802_1X_AUTH_FAILED 23
+#define WLAN_REASON_CIPHER_SUITE_REJECTED 24
+#endif
+
+enum WIFI_STATUS_CODE {
+	_STATS_SUCCESSFUL_			= 0,
+	_STATS_FAILURE_				= 1,
+	_STATS_CAP_FAIL_			= 10,
+	_STATS_NO_ASOC_				= 11,
+	_STATS_OTHER_				= 12,
+	_STATS_NO_SUPP_ALG_			= 13,
+	_STATS_OUT_OF_AUTH_SEQ_		= 14,
+	_STATS_CHALLENGE_FAIL_		= 15,
+	_STATS_AUTH_TIMEOUT_		= 16,
+	_STATS_UNABLE_HANDLE_STA_	= 17,
+	_STATS_RATE_FAIL_			= 18,
+};
+
+/* Status codes (IEEE 802.11-2007, 7.3.1.9, Table 7-23) */
+#if 0
+#define WLAN_STATUS_SUCCESS 0
+#define WLAN_STATUS_UNSPECIFIED_FAILURE 1
+#define WLAN_STATUS_CAPS_UNSUPPORTED 10
+#define WLAN_STATUS_REASSOC_NO_ASSOC 11
+#define WLAN_STATUS_ASSOC_DENIED_UNSPEC 12
+#define WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG 13
+#define WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION 14
+#define WLAN_STATUS_CHALLENGE_FAIL 15
+#define WLAN_STATUS_AUTH_TIMEOUT 16
+#define WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA 17
+#define WLAN_STATUS_ASSOC_DENIED_RATES 18
+#endif
+//entended
+/* IEEE 802.11b */
+#define WLAN_STATUS_ASSOC_DENIED_NOSHORT 19
+#define WLAN_STATUS_ASSOC_DENIED_NOPBCC 20
+#define WLAN_STATUS_ASSOC_DENIED_NOAGILITY 21
+/* IEEE 802.11h */
+#define WLAN_STATUS_SPEC_MGMT_REQUIRED 22
+#define WLAN_STATUS_PWR_CAPABILITY_NOT_VALID 23
+#define WLAN_STATUS_SUPPORTED_CHANNEL_NOT_VALID 24
+/* IEEE 802.11g */
+#define WLAN_STATUS_ASSOC_DENIED_NO_SHORT_SLOT_TIME 25
+#define WLAN_STATUS_ASSOC_DENIED_NO_ER_PBCC 26
+#define WLAN_STATUS_ASSOC_DENIED_NO_DSSS_OFDM 27
+/* IEEE 802.11w */
+#define WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY 30
+#define WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION 31
+/* IEEE 802.11i */
+#define WLAN_STATUS_INVALID_IE 40
+#define WLAN_STATUS_GROUP_CIPHER_NOT_VALID 41
+#define WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID 42
+#define WLAN_STATUS_AKMP_NOT_VALID 43
+#define WLAN_STATUS_UNSUPPORTED_RSN_IE_VERSION 44
+#define WLAN_STATUS_INVALID_RSN_IE_CAPAB 45
+#define WLAN_STATUS_CIPHER_REJECTED_PER_POLICY 46
+#define WLAN_STATUS_TS_NOT_CREATED 47
+#define WLAN_STATUS_DIRECT_LINK_NOT_ALLOWED 48
+#define WLAN_STATUS_DEST_STA_NOT_PRESENT 49
+#define WLAN_STATUS_DEST_STA_NOT_QOS_STA 50
+#define WLAN_STATUS_ASSOC_DENIED_LISTEN_INT_TOO_LARGE 51
+/* IEEE 802.11r */
+#define WLAN_STATUS_INVALID_FT_ACTION_FRAME_COUNT 52
+#define WLAN_STATUS_INVALID_PMKID 53
+#define WLAN_STATUS_INVALID_MDIE 54
+#define WLAN_STATUS_INVALID_FTIE 55
+
+
+enum WIFI_REG_DOMAIN {
+	DOMAIN_FCC		= 1,
+	DOMAIN_IC		= 2,
+	DOMAIN_ETSI		= 3,
+	DOMAIN_SPAIN	= 4,
+	DOMAIN_FRANCE	= 5,
+	DOMAIN_MKK		= 6,
+	DOMAIN_ISRAEL	= 7,
+	DOMAIN_MKK1		= 8,
+	DOMAIN_MKK2		= 9,
+	DOMAIN_MKK3		= 10,
+	DOMAIN_MAX
+};
+
+#define _TO_DS_		BIT(8)
+#define _FROM_DS_	BIT(9)
+#define _MORE_FRAG_	BIT(10)
+#define _RETRY_		BIT(11)
+#define _PWRMGT_	BIT(12)
+#define _MORE_DATA_	BIT(13)
+#define _PRIVACY_	BIT(14)
+#define _ORDER_			BIT(15)
+
+#define SetToDs(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16(_TO_DS_); \
+	} while(0)
+
+#define GetToDs(pbuf)	(((*(unsigned short *)(pbuf)) & le16_to_cpu(_TO_DS_)) != 0)
+
+#define ClearToDs(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) &= (~cpu_to_le16(_TO_DS_)); \
+	} while(0)
+
+#define SetFrDs(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16(_FROM_DS_); \
+	} while(0)
+
+#define GetFrDs(pbuf)	(((*(unsigned short *)(pbuf)) & le16_to_cpu(_FROM_DS_)) != 0)
+
+#define ClearFrDs(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) &= (~cpu_to_le16(_FROM_DS_)); \
+	} while(0)
+
+#define get_tofr_ds(pframe)	((GetToDs(pframe) << 1) | GetFrDs(pframe))
+
+
+#define SetMFrag(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16(_MORE_FRAG_); \
+	} while(0)
+
+#define GetMFrag(pbuf)	(((*(unsigned short *)(pbuf)) & le16_to_cpu(_MORE_FRAG_)) != 0)
+
+#define ClearMFrag(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) &= (~cpu_to_le16(_MORE_FRAG_)); \
+	} while(0)
+
+#define SetRetry(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16(_RETRY_); \
+	} while(0)
+
+#define GetRetry(pbuf)	(((*(unsigned short *)(pbuf)) & le16_to_cpu(_RETRY_)) != 0)
+
+#define ClearRetry(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) &= (~cpu_to_le16(_RETRY_)); \
+	} while(0)
+
+#define SetPwrMgt(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16(_PWRMGT_); \
+	} while(0)
+
+#define GetPwrMgt(pbuf)	(((*(unsigned short *)(pbuf)) & le16_to_cpu(_PWRMGT_)) != 0)
+
+#define ClearPwrMgt(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) &= (~cpu_to_le16(_PWRMGT_)); \
+	} while(0)
+
+#define SetMData(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16(_MORE_DATA_); \
+	} while(0)
+
+#define GetMData(pbuf)	(((*(unsigned short *)(pbuf)) & le16_to_cpu(_MORE_DATA_)) != 0)
+
+#define ClearMData(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) &= (~cpu_to_le16(_MORE_DATA_)); \
+	} while(0)
+
+#define SetPrivacy(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16(_PRIVACY_); \
+	} while(0)
+
+#define GetPrivacy(pbuf)	(((*(unsigned short *)(pbuf)) & le16_to_cpu(_PRIVACY_)) != 0)
+
+#define ClearPrivacy(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) &= (~cpu_to_le16(_PRIVACY_)); \
+	} while(0)
+
+
+#define GetOrder(pbuf)	(((*(unsigned short *)(pbuf)) & le16_to_cpu(_ORDER_)) != 0)
+
+#define GetFrameType(pbuf)	(le16_to_cpu(*(unsigned short *)(pbuf)) & (BIT(3) | BIT(2)))
+
+#define SetFrameType(pbuf,type)	\
+	do { 	\
+		*(unsigned short *)(pbuf) &= __constant_cpu_to_le16(~(BIT(3) | BIT(2))); \
+		*(unsigned short *)(pbuf) |= __constant_cpu_to_le16(type); \
+	} while(0)
+
+#define GetFrameSubType(pbuf)	(cpu_to_le16(*(unsigned short *)(pbuf)) & (BIT(7) | BIT(6) | BIT(5) | BIT(4) | BIT(3) | BIT(2)))
+
+#define SetFrameSubType(pbuf,type) \
+	do {    \
+		*(unsigned short *)(pbuf) &= cpu_to_le16(~(BIT(7) | BIT(6) | BIT(5) | BIT(4) | BIT(3) | BIT(2))); \
+		*(unsigned short *)(pbuf) |= cpu_to_le16(type); \
+	} while(0)
+
+#define GetSequence(pbuf)	(cpu_to_le16(*(unsigned short *)((SIZE_PTR)(pbuf) + 22)) >> 4)
+
+#define GetFragNum(pbuf)	(cpu_to_le16(*(unsigned short *)((SIZE_PTR)(pbuf) + 22)) & 0x0f)
+
+#define GetTupleCache(pbuf)	(cpu_to_le16(*(unsigned short *)((SIZE_PTR)(pbuf) + 22)))
+
+#define SetFragNum(pbuf, num) \
+	do {    \
+		*(unsigned short *)((SIZE_PTR)(pbuf) + 22) = \
+			((*(unsigned short *)((SIZE_PTR)(pbuf) + 22)) & le16_to_cpu(~(0x000f))) | \
+			cpu_to_le16(0x0f & (num));     \
+	} while(0)
+
+#define SetSeqNum(pbuf, num) \
+	do {    \
+		*(unsigned short *)((SIZE_PTR)(pbuf) + 22) = \
+			((*(unsigned short *)((SIZE_PTR)(pbuf) + 22)) & le16_to_cpu((unsigned short)~0xfff0)) | \
+			le16_to_cpu((unsigned short)(0xfff0 & (num << 4))); \
+	} while(0)
+
+#define SetDuration(pbuf, dur) \
+	do {    \
+		*(unsigned short *)((SIZE_PTR)(pbuf) + 2) = cpu_to_le16(0xffff & (dur)); \
+	} while(0)
+
+
+#define SetPriority(pbuf, tid)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16(tid & 0xf); \
+	} while(0)
+
+#define GetPriority(pbuf)	((le16_to_cpu(*(unsigned short *)(pbuf))) & 0xf)
+
+#define SetEOSP(pbuf, eosp)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16( (eosp & 1) << 4); \
+	} while(0)
+
+#define SetAckpolicy(pbuf, ack)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16( (ack & 3) << 5); \
+	} while(0)
+
+#define GetAckpolicy(pbuf) (((le16_to_cpu(*(unsigned short *)pbuf)) >> 5) & 0x3)
+
+#define GetAMsdu(pbuf) (((le16_to_cpu(*(unsigned short *)pbuf)) >> 7) & 0x1)
+
+#define SetAMsdu(pbuf, amsdu)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16( (amsdu & 1) << 7); \
+	} while(0)
+
+#define GetAid(pbuf)	(cpu_to_le16(*(unsigned short *)((SIZE_PTR)(pbuf) + 2)) & 0x3fff)
+
+#define GetTid(pbuf)	(cpu_to_le16(*(unsigned short *)((SIZE_PTR)(pbuf) + (((GetToDs(pbuf)<<1)|GetFrDs(pbuf))==3?30:24))) & 0x000f)
+
+#define GetAddr1Ptr(pbuf)	((unsigned char *)((SIZE_PTR)(pbuf) + 4))
+
+#define GetAddr2Ptr(pbuf)	((unsigned char *)((SIZE_PTR)(pbuf) + 10))
+
+#define GetAddr3Ptr(pbuf)	((unsigned char *)((SIZE_PTR)(pbuf) + 16))
+
+#define GetAddr4Ptr(pbuf)	((unsigned char *)((SIZE_PTR)(pbuf) + 24))
+
+#define MacAddr_isBcst(addr) \
+( \
+	( (addr[0] == 0xff) && (addr[1] == 0xff) && \
+		(addr[2] == 0xff) && (addr[3] == 0xff) && \
+		(addr[4] == 0xff) && (addr[5] == 0xff) )  ? _TRUE : _FALSE \
+)
+
+__inline static int IS_MCAST(const unsigned char *da)
+{
+	if ((*da) & 0x01)
+		return _TRUE;
+	else
+		return _FALSE;
+}
+
+
+__inline static unsigned char * get_da(unsigned char *pframe)
+{
+	unsigned char 	*da;
+	unsigned int	to_fr_ds	= (GetToDs(pframe) << 1) | GetFrDs(pframe);
+
+	switch (to_fr_ds) {
+		case 0x00:	// ToDs=0, FromDs=0
+			da = GetAddr1Ptr(pframe);
+			break;
+		case 0x01:	// ToDs=0, FromDs=1
+			da = GetAddr1Ptr(pframe);
+			break;
+		case 0x02:	// ToDs=1, FromDs=0
+			da = GetAddr3Ptr(pframe);
+			break;
+		default:	// ToDs=1, FromDs=1
+			da = GetAddr3Ptr(pframe);
+			break;
+	}
+
+	return da;
+}
+
+
+__inline static unsigned char * get_sa(unsigned char *pframe)
+{
+	unsigned char 	*sa;
+	unsigned int	to_fr_ds	= (GetToDs(pframe) << 1) | GetFrDs(pframe);
+
+	switch (to_fr_ds) {
+		case 0x00:	// ToDs=0, FromDs=0
+			sa = GetAddr2Ptr(pframe);
+			break;
+		case 0x01:	// ToDs=0, FromDs=1
+			sa = GetAddr3Ptr(pframe);
+			break;
+		case 0x02:	// ToDs=1, FromDs=0
+			sa = GetAddr2Ptr(pframe);
+			break;
+		default:	// ToDs=1, FromDs=1
+			sa = GetAddr4Ptr(pframe);
+			break;
+	}
+
+	return sa;
+}
+
+__inline static unsigned char * get_hdr_bssid(unsigned char *pframe)
+{
+	unsigned char 	*sa;
+	unsigned int	to_fr_ds	= (GetToDs(pframe) << 1) | GetFrDs(pframe);
+
+	switch (to_fr_ds) {
+		case 0x00:	// ToDs=0, FromDs=0
+			sa = GetAddr3Ptr(pframe);
+			break;
+		case 0x01:	// ToDs=0, FromDs=1
+			sa = GetAddr2Ptr(pframe);
+			break;
+		case 0x02:	// ToDs=1, FromDs=0
+			sa = GetAddr1Ptr(pframe);
+			break;
+		case 0x03:	// ToDs=1, FromDs=1
+			sa = GetAddr1Ptr(pframe);
+			break;
+		default:
+			sa =NULL; //???????
+			break;
+	}
+
+	return sa;
+}
+
+
+__inline static int IsFrameTypeCtrl(unsigned char *pframe)
+{
+	if(WIFI_CTRL_TYPE == GetFrameType(pframe))
+		return _TRUE;
+	else
+		return _FALSE;
+}
+/*-----------------------------------------------------------------------------
+			Below is for the security related definition
+------------------------------------------------------------------------------*/
+#define _RESERVED_FRAME_TYPE_	0
+#define _SKB_FRAME_TYPE_		2
+#define _PRE_ALLOCMEM_			1
+#define _PRE_ALLOCHDR_			3
+#define _PRE_ALLOCLLCHDR_		4
+#define _PRE_ALLOCICVHDR_		5
+#define _PRE_ALLOCMICHDR_		6
+
+#define _SIFSTIME_				((priv->pmib->dot11BssType.net_work_type&WIRELESS_11A)?16:10)
+#define _ACKCTSLNG_				14	//14 bytes long, including crclng
+#define _CRCLNG_				4
+
+#define _ASOCREQ_IE_OFFSET_		4	// excluding wlan_hdr
+#define	_ASOCRSP_IE_OFFSET_		6
+#define _REASOCREQ_IE_OFFSET_	10
+#define _REASOCRSP_IE_OFFSET_	6
+#define _PROBEREQ_IE_OFFSET_	0
+#define	_PROBERSP_IE_OFFSET_	12
+#define _AUTH_IE_OFFSET_		6
+#define _DEAUTH_IE_OFFSET_		0
+#define _BEACON_IE_OFFSET_		12
+#define _PUBLIC_ACTION_IE_OFFSET_	8
+
+#define _FIXED_IE_LENGTH_			_BEACON_IE_OFFSET_
+
+#define _SSID_IE_				0
+#define _SUPPORTEDRATES_IE_	1
+#define _DSSET_IE_				3
+#define _TIM_IE_					5
+#define _IBSS_PARA_IE_			6
+#define _COUNTRY_IE_			7
+#define _CHLGETXT_IE_			16
+#define _POW_CAP_IE_			33
+#define _SUPPORTED_CH_IE_		36
+#define _CH_SWTICH_ANNOUNCE_	37	//Secondary Channel Offset
+#define _RSN_IE_2_				48
+#define _SSN_IE_1_					221
+#define _ERPINFO_IE_			42
+#define _EXT_SUPPORTEDRATES_IE_	50
+
+#define _HT_CAPABILITY_IE_			45
+#define _FTIE_						55
+#define _TIMEOUT_ITVL_IE_			56
+#define _SRC_IE_				59
+#define _HT_EXTRA_INFO_IE_			61
+#define _HT_ADD_INFO_IE_			61 //_HT_EXTRA_INFO_IE_
+
+#define	EID_BSSCoexistence			72 // 20/40 BSS Coexistence
+#define	EID_BSSIntolerantChlReport	73
+#define _RIC_Descriptor_IE_			75
+
+#ifdef CONFIG_IEEE80211W
+#define _MME_IE_					76 //802.11w Management MIC element
+#endif //CONFIG_IEEE80211W
+#define _LINK_ID_IE_					101
+#define _CH_SWITCH_TIMING_		104
+#define _PTI_BUFFER_STATUS_		106
+#define _EXT_CAP_IE_				127
+#define _VENDOR_SPECIFIC_IE_		221
+
+#define	_RESERVED47_				47
+
+/* ---------------------------------------------------------------------------
+					Below is the fixed elements...
+-----------------------------------------------------------------------------*/
+#define _AUTH_ALGM_NUM_			2
+#define _AUTH_SEQ_NUM_			2
+#define _BEACON_ITERVAL_		2
+#define _CAPABILITY_			2
+#define _CURRENT_APADDR_		6
+#define _LISTEN_INTERVAL_		2
+#define _RSON_CODE_				2
+#define _ASOC_ID_				2
+#define _STATUS_CODE_			2
+#define _TIMESTAMP_				8
+
+#define AUTH_ODD_TO				0
+#define AUTH_EVEN_TO			1
+
+#define WLAN_ETHCONV_ENCAP		1
+#define WLAN_ETHCONV_RFC1042	2
+#define WLAN_ETHCONV_8021h		3
+
+#define cap_ESS BIT(0)
+#define cap_IBSS BIT(1)
+#define cap_CFPollable BIT(2)
+#define cap_CFRequest BIT(3)
+#define cap_Privacy BIT(4)
+#define cap_ShortPremble BIT(5)
+#define cap_PBCC	BIT(6)
+#define cap_ChAgility	BIT(7)
+#define cap_SpecMgmt	BIT(8)
+#define cap_QoS	BIT(9)
+#define cap_ShortSlot	BIT(10)
+
+/*-----------------------------------------------------------------------------
+				Below is the definition for 802.11i / 802.1x
+------------------------------------------------------------------------------*/
+#define _IEEE8021X_MGT_			1		// WPA
+#define _IEEE8021X_PSK_			2		// WPA with pre-shared key
+
+/*
+#define _NO_PRIVACY_			0
+#define _WEP_40_PRIVACY_		1
+#define _TKIP_PRIVACY_			2
+#define _WRAP_PRIVACY_			3
+#define _CCMP_PRIVACY_			4
+#define _WEP_104_PRIVACY_		5
+#define _WEP_WPA_MIXED_PRIVACY_ 6	// WEP + WPA
+*/
+
+#ifdef CONFIG_IEEE80211W
+#define _MME_IE_LENGTH_  18
+#endif //CONFIG_IEEE80211W
+/*-----------------------------------------------------------------------------
+				Below is the definition for WMM
+------------------------------------------------------------------------------*/
+#define _WMM_IE_Length_				7  // for WMM STA
+#define _WMM_Para_Element_Length_		24
+
+
+/*-----------------------------------------------------------------------------
+				Below is the definition for 802.11n
+------------------------------------------------------------------------------*/
+
+/* block-ack parameters */
+#define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
+#define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
+#define RTW_IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
+#define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
+#define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
+
+//#ifdef CONFIG_80211N_HT
+
+#define SetOrderBit(pbuf)	\
+	do	{	\
+		*(unsigned short *)(pbuf) |= cpu_to_le16(_ORDER_); \
+	} while(0)
+
+#define GetOrderBit(pbuf)	(((*(unsigned short *)(pbuf)) & le16_to_cpu(_ORDER_)) != 0)
+
+
+/**
+ * struct rtw_ieee80211_bar - HT Block Ack Request
+ *
+ * This structure refers to "HT BlockAckReq" as
+ * described in 802.11n draft section 7.2.1.7.1
+ */
+ #if defined(PLATFORM_LINUX) || defined(CONFIG_RTL8712FW)
+struct rtw_ieee80211_bar {
+	unsigned short frame_control;
+	unsigned short duration;
+	unsigned char ra[6];
+	unsigned char ta[6];
+	unsigned short control;
+	unsigned short start_seq_num;
+} __attribute__((packed));
+ #endif
+
+/* 802.11 BAR control masks */
+#define IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL     0x0000
+#define IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA  0x0004
+
+
+ #if defined(PLATFORM_LINUX) || defined(CONFIG_RTL8712FW) || defined(PLATFORM_FREEBSD)
+
+
+
+ /**
+ * struct rtw_ieee80211_ht_cap - HT capabilities
+ *
+ * This structure refers to "HT capabilities element" as
+ * described in 802.11n draft section 7.3.2.52
+ */
+
+struct rtw_ieee80211_ht_cap {
+	unsigned short 	cap_info;
+	unsigned char 	ampdu_params_info;
+	unsigned char 	supp_mcs_set[16];
+	unsigned short 	extended_ht_cap_info;
+	unsigned int		tx_BF_cap_info;
+	unsigned char	       antenna_selection_info;
+} __attribute__ ((packed));
+
+/**
+ * struct rtw_ieee80211_ht_cap - HT additional information
+ *
+ * This structure refers to "HT information element" as
+ * described in 802.11n draft section 7.3.2.53
+ */
+struct ieee80211_ht_addt_info {
+	unsigned char 	control_chan;
+	unsigned char		ht_param;
+	unsigned short	operation_mode;
+	unsigned short	stbc_param;
+	unsigned char		basic_set[16];
+} __attribute__ ((packed));
+
+
+struct HT_caps_element
+{
+	union
+	{
+		struct
+		{
+			unsigned short	HT_caps_info;
+			unsigned char	AMPDU_para;
+			unsigned char	MCS_rate[16];
+			unsigned short	HT_ext_caps;
+			unsigned int	Beamforming_caps;
+			unsigned char	ASEL_caps;
+		} HT_cap_element;
+		unsigned char HT_cap[26];
+	}u;
+} __attribute__ ((packed));
+
+struct HT_info_element
+{
+	unsigned char	primary_channel;
+	unsigned char	infos[5];
+	unsigned char	MCS_rate[16];
+}  __attribute__ ((packed));
+
+struct AC_param
+{
+	unsigned char		ACI_AIFSN;
+	unsigned char		CW;
+	unsigned short	TXOP_limit;
+}  __attribute__ ((packed));
+
+struct WMM_para_element
+{
+	unsigned char		QoS_info;
+	unsigned char		reserved;
+	struct AC_param	ac_param[4];
+}  __attribute__ ((packed));
+
+struct ADDBA_request
+{
+	unsigned char		dialog_token;
+	unsigned short	BA_para_set;
+	unsigned short	BA_timeout_value;
+	unsigned short	BA_starting_seqctrl;
+}  __attribute__ ((packed));
+
+
+
+#endif
+
+
+#ifdef PLATFORM_WINDOWS
+
+#pragma pack(1)
+
+struct rtw_ieee80211_ht_cap {
+	unsigned short 	cap_info;
+	unsigned char 	ampdu_params_info;
+	unsigned char 	supp_mcs_set[16];
+	unsigned short 	extended_ht_cap_info;
+	unsigned int		tx_BF_cap_info;
+	unsigned char	       antenna_selection_info;
+};
+
+
+struct ieee80211_ht_addt_info {
+	unsigned char 	control_chan;
+	unsigned char		ht_param;
+	unsigned short	operation_mode;
+	unsigned short	stbc_param;
+	unsigned char		basic_set[16];
+};
+
+struct HT_caps_element
+{
+	union
+	{
+		struct
+		{
+			unsigned short	HT_caps_info;
+			unsigned char	AMPDU_para;
+			unsigned char	MCS_rate[16];
+			unsigned short	HT_ext_caps;
+			unsigned int	Beamforming_caps;
+			unsigned char	ASEL_caps;
+		} HT_cap_element;
+		unsigned char HT_cap[26];
+	};
+};
+
+struct HT_info_element
+{
+	unsigned char	primary_channel;
+	unsigned char	infos[5];
+	unsigned char	MCS_rate[16];
+};
+
+struct AC_param
+{
+	unsigned char		ACI_AIFSN;
+	unsigned char		CW;
+	unsigned short	TXOP_limit;
+};
+
+struct WMM_para_element
+{
+	unsigned char		QoS_info;
+	unsigned char		reserved;
+	struct AC_param	ac_param[4];
+};
+
+struct ADDBA_request
+{
+	unsigned char		dialog_token;
+	unsigned short	BA_para_set;
+	unsigned short	BA_timeout_value;
+	unsigned short	BA_starting_seqctrl;
+};
+
+
+#pragma pack()
+
+#endif
+
+
+/* 802.11n HT capabilities masks */
+#define IEEE80211_HT_CAP_SUP_WIDTH		0x0002
+#define IEEE80211_HT_CAP_SM_PS			0x000C
+#define IEEE80211_HT_CAP_GRN_FLD		0x0010
+#define IEEE80211_HT_CAP_SGI_20			0x0020
+#define IEEE80211_HT_CAP_SGI_40			0x0040
+#define IEEE80211_HT_CAP_TX_STBC			0x0080
+#define IEEE80211_HT_CAP_RX_STBC		0x0300
+#define IEEE80211_HT_CAP_DELAY_BA		0x0400
+#define IEEE80211_HT_CAP_MAX_AMSDU		0x0800
+#define IEEE80211_HT_CAP_DSSSCCK40		0x1000
+/* 802.11n HT capability AMPDU settings */
+#define IEEE80211_HT_CAP_AMPDU_FACTOR		0x03
+#define IEEE80211_HT_CAP_AMPDU_DENSITY		0x1C
+/* 802.11n HT capability MSC set */
+#define IEEE80211_SUPP_MCS_SET_UEQM		4
+#define IEEE80211_HT_CAP_MAX_STREAMS		4
+#define IEEE80211_SUPP_MCS_SET_LEN		10
+/* maximum streams the spec allows */
+#define IEEE80211_HT_CAP_MCS_TX_DEFINED		0x01
+#define IEEE80211_HT_CAP_MCS_TX_RX_DIFF		0x02
+#define IEEE80211_HT_CAP_MCS_TX_STREAMS		0x0C
+#define IEEE80211_HT_CAP_MCS_TX_UEQM		0x10
+/* 802.11n HT IE masks */
+#define IEEE80211_HT_IE_CHA_SEC_OFFSET		0x03
+#define IEEE80211_HT_IE_CHA_SEC_NONE	 	0x00
+#define IEEE80211_HT_IE_CHA_SEC_ABOVE 		0x01
+#define IEEE80211_HT_IE_CHA_SEC_BELOW 		0x03
+#define IEEE80211_HT_IE_CHA_WIDTH		0x04
+#define IEEE80211_HT_IE_HT_PROTECTION		0x0003
+#define IEEE80211_HT_IE_NON_GF_STA_PRSNT	0x0004
+#define IEEE80211_HT_IE_NON_HT_STA_PRSNT	0x0010
+
+/* block-ack parameters */
+#define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
+#define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
+#define RTW_IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
+#define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
+#define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
+
+/*
+ * A-PMDU buffer sizes
+ * According to IEEE802.11n spec size varies from 8K to 64K (in powers of 2)
+ */
+#define IEEE80211_MIN_AMPDU_BUF 0x8
+#define IEEE80211_MAX_AMPDU_BUF 0x40
+
+
+/* Spatial Multiplexing Power Save Modes */
+#define WLAN_HT_CAP_SM_PS_STATIC		0
+#define WLAN_HT_CAP_SM_PS_DYNAMIC	1
+#define WLAN_HT_CAP_SM_PS_INVALID	2
+#define WLAN_HT_CAP_SM_PS_DISABLED	3
+
+
+#define OP_MODE_PURE                    0
+#define OP_MODE_MAY_BE_LEGACY_STAS      1
+#define OP_MODE_20MHZ_HT_STA_ASSOCED    2
+#define OP_MODE_MIXED                   3
+
+#define HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK	((u8) BIT(0) | BIT(1))
+#define HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE		((u8) BIT(0))
+#define HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW		((u8) BIT(0) | BIT(1))
+#define HT_INFO_HT_PARAM_REC_TRANS_CHNL_WIDTH		((u8) BIT(2))
+#define HT_INFO_HT_PARAM_RIFS_MODE			((u8) BIT(3))
+#define HT_INFO_HT_PARAM_CTRL_ACCESS_ONLY		((u8) BIT(4))
+#define HT_INFO_HT_PARAM_SRV_INTERVAL_GRANULARITY	((u8) BIT(5))
+
+#define HT_INFO_OPERATION_MODE_OP_MODE_MASK	\
+		((u16) (0x0001 | 0x0002))
+#define HT_INFO_OPERATION_MODE_OP_MODE_OFFSET		0
+#define HT_INFO_OPERATION_MODE_NON_GF_DEVS_PRESENT	((u8) BIT(2))
+#define HT_INFO_OPERATION_MODE_TRANSMIT_BURST_LIMIT	((u8) BIT(3))
+#define HT_INFO_OPERATION_MODE_NON_HT_STA_PRESENT	((u8) BIT(4))
+
+#define HT_INFO_STBC_PARAM_DUAL_BEACON			((u16) BIT(6))
+#define HT_INFO_STBC_PARAM_DUAL_STBC_PROTECT		((u16) BIT(7))
+#define HT_INFO_STBC_PARAM_SECONDARY_BCN		((u16) BIT(8))
+#define HT_INFO_STBC_PARAM_LSIG_TXOP_PROTECT_ALLOWED	((u16) BIT(9))
+#define HT_INFO_STBC_PARAM_PCO_ACTIVE			((u16) BIT(10))
+#define HT_INFO_STBC_PARAM_PCO_PHASE			((u16) BIT(11))
+
+
+
+//#endif
+
+//	===============WPS Section===============
+//	For WPSv1.0
+#define WPSOUI							0x0050f204
+//	WPS attribute ID
+#define WPS_ATTR_VER1					0x104A
+#define WPS_ATTR_SIMPLE_CONF_STATE	0x1044
+#define WPS_ATTR_RESP_TYPE			0x103B
+#define WPS_ATTR_UUID_E				0x1047
+#define WPS_ATTR_MANUFACTURER		0x1021
+#define WPS_ATTR_MODEL_NAME			0x1023
+#define WPS_ATTR_MODEL_NUMBER		0x1024
+#define WPS_ATTR_SERIAL_NUMBER		0x1042
+#define WPS_ATTR_PRIMARY_DEV_TYPE	0x1054
+#define WPS_ATTR_SEC_DEV_TYPE_LIST	0x1055
+#define WPS_ATTR_DEVICE_NAME			0x1011
+#define WPS_ATTR_CONF_METHOD			0x1008
+#define WPS_ATTR_RF_BANDS				0x103C
+#define WPS_ATTR_DEVICE_PWID			0x1012
+#define WPS_ATTR_REQUEST_TYPE			0x103A
+#define WPS_ATTR_ASSOCIATION_STATE	0x1002
+#define WPS_ATTR_CONFIG_ERROR			0x1009
+#define WPS_ATTR_VENDOR_EXT			0x1049
+#define WPS_ATTR_SELECTED_REGISTRAR	0x1041
+
+//	Value of WPS attribute "WPS_ATTR_DEVICE_NAME
+#define WPS_MAX_DEVICE_NAME_LEN		32
+
+//	Value of WPS Request Type Attribute
+#define WPS_REQ_TYPE_ENROLLEE_INFO_ONLY			0x00
+#define WPS_REQ_TYPE_ENROLLEE_OPEN_8021X		0x01
+#define WPS_REQ_TYPE_REGISTRAR					0x02
+#define WPS_REQ_TYPE_WLAN_MANAGER_REGISTRAR	0x03
+
+//	Value of WPS Response Type Attribute
+#define WPS_RESPONSE_TYPE_INFO_ONLY	0x00
+#define WPS_RESPONSE_TYPE_8021X		0x01
+#define WPS_RESPONSE_TYPE_REGISTRAR	0x02
+#define WPS_RESPONSE_TYPE_AP			0x03
+
+//	Value of WPS WiFi Simple Configuration State Attribute
+#define WPS_WSC_STATE_NOT_CONFIG	0x01
+#define WPS_WSC_STATE_CONFIG			0x02
+
+//	Value of WPS Version Attribute
+#define WPS_VERSION_1					0x10
+
+//	Value of WPS Configuration Method Attribute
+#define WPS_CONFIG_METHOD_FLASH		0x0001
+#define WPS_CONFIG_METHOD_ETHERNET	0x0002
+#define WPS_CONFIG_METHOD_LABEL		0x0004
+#define WPS_CONFIG_METHOD_DISPLAY	0x0008
+#define WPS_CONFIG_METHOD_E_NFC		0x0010
+#define WPS_CONFIG_METHOD_I_NFC		0x0020
+#define WPS_CONFIG_METHOD_NFC		0x0040
+#define WPS_CONFIG_METHOD_PBC		0x0080
+#define WPS_CONFIG_METHOD_KEYPAD	0x0100
+#define WPS_CONFIG_METHOD_VPBC		0x0280
+#define WPS_CONFIG_METHOD_PPBC		0x0480
+#define WPS_CONFIG_METHOD_VDISPLAY	0x2008
+#define WPS_CONFIG_METHOD_PDISPLAY	0x4008
+
+//	Value of Category ID of WPS Primary Device Type Attribute
+#define WPS_PDT_CID_DISPLAYS			0x0007
+#define WPS_PDT_CID_MULIT_MEDIA		0x0008
+#define WPS_PDT_CID_RTK_WIDI			WPS_PDT_CID_MULIT_MEDIA
+
+//	Value of Sub Category ID of WPS Primary Device Type Attribute
+#define WPS_PDT_SCID_MEDIA_SERVER	0x0005
+#define WPS_PDT_SCID_RTK_DMP			WPS_PDT_SCID_MEDIA_SERVER
+
+//	Value of Device Password ID
+#define WPS_DPID_PIN					0x0000
+#define WPS_DPID_USER_SPEC			0x0001
+#define WPS_DPID_MACHINE_SPEC			0x0002
+#define WPS_DPID_REKEY					0x0003
+#define WPS_DPID_PBC					0x0004
+#define WPS_DPID_REGISTRAR_SPEC		0x0005
+
+//	Value of WPS RF Bands Attribute
+#define WPS_RF_BANDS_2_4_GHZ		0x01
+#define WPS_RF_BANDS_5_GHZ		0x02
+
+//	Value of WPS Association State Attribute
+#define WPS_ASSOC_STATE_NOT_ASSOCIATED			0x00
+#define WPS_ASSOC_STATE_CONNECTION_SUCCESS		0x01
+#define WPS_ASSOC_STATE_CONFIGURATION_FAILURE	0x02
+#define WPS_ASSOC_STATE_ASSOCIATION_FAILURE		0x03
+#define WPS_ASSOC_STATE_IP_FAILURE				0x04
+
+//	=====================P2P Section=====================
+//	For P2P
+#define	P2POUI							0x506F9A09
+
+//	P2P Attribute ID
+#define	P2P_ATTR_STATUS					0x00
+#define	P2P_ATTR_MINOR_REASON_CODE		0x01
+#define	P2P_ATTR_CAPABILITY				0x02
+#define	P2P_ATTR_DEVICE_ID				0x03
+#define	P2P_ATTR_GO_INTENT				0x04
+#define	P2P_ATTR_CONF_TIMEOUT			0x05
+#define	P2P_ATTR_LISTEN_CH				0x06
+#define	P2P_ATTR_GROUP_BSSID				0x07
+#define	P2P_ATTR_EX_LISTEN_TIMING		0x08
+#define	P2P_ATTR_INTENTED_IF_ADDR		0x09
+#define	P2P_ATTR_MANAGEABILITY			0x0A
+#define	P2P_ATTR_CH_LIST					0x0B
+#define	P2P_ATTR_NOA						0x0C
+#define	P2P_ATTR_DEVICE_INFO				0x0D
+#define	P2P_ATTR_GROUP_INFO				0x0E
+#define	P2P_ATTR_GROUP_ID					0x0F
+#define	P2P_ATTR_INTERFACE				0x10
+#define	P2P_ATTR_OPERATING_CH			0x11
+#define	P2P_ATTR_INVITATION_FLAGS		0x12
+
+//	Value of Status Attribute
+#define	P2P_STATUS_SUCCESS						0x00
+#define	P2P_STATUS_FAIL_INFO_UNAVAILABLE		0x01
+#define	P2P_STATUS_FAIL_INCOMPATIBLE_PARAM		0x02
+#define	P2P_STATUS_FAIL_LIMIT_REACHED			0x03
+#define	P2P_STATUS_FAIL_INVALID_PARAM			0x04
+#define	P2P_STATUS_FAIL_REQUEST_UNABLE			0x05
+#define	P2P_STATUS_FAIL_PREVOUS_PROTO_ERR		0x06
+#define	P2P_STATUS_FAIL_NO_COMMON_CH			0x07
+#define	P2P_STATUS_FAIL_UNKNOWN_P2PGROUP		0x08
+#define	P2P_STATUS_FAIL_BOTH_GOINTENT_15		0x09
+#define	P2P_STATUS_FAIL_INCOMPATIBLE_PROVSION	0x0A
+#define	P2P_STATUS_FAIL_USER_REJECT				0x0B
+
+//	Value of Inviation Flags Attribute
+#define	P2P_INVITATION_FLAGS_PERSISTENT			BIT(0)
+
+#define	DMP_P2P_DEVCAP_SUPPORT	(P2P_DEVCAP_SERVICE_DISCOVERY | \
+									P2P_DEVCAP_CLIENT_DISCOVERABILITY | \
+									P2P_DEVCAP_CONCURRENT_OPERATION | \
+									P2P_DEVCAP_INVITATION_PROC)
+
+#define	DMP_P2P_GRPCAP_SUPPORT	(P2P_GRPCAP_INTRABSS)
+
+//	Value of Device Capability Bitmap
+#define	P2P_DEVCAP_SERVICE_DISCOVERY		BIT(0)
+#define	P2P_DEVCAP_CLIENT_DISCOVERABILITY	BIT(1)
+#define	P2P_DEVCAP_CONCURRENT_OPERATION	BIT(2)
+#define	P2P_DEVCAP_INFRA_MANAGED			BIT(3)
+#define	P2P_DEVCAP_DEVICE_LIMIT				BIT(4)
+#define	P2P_DEVCAP_INVITATION_PROC			BIT(5)
+
+//	Value of Group Capability Bitmap
+#define	P2P_GRPCAP_GO							BIT(0)
+#define	P2P_GRPCAP_PERSISTENT_GROUP			BIT(1)
+#define	P2P_GRPCAP_GROUP_LIMIT				BIT(2)
+#define	P2P_GRPCAP_INTRABSS					BIT(3)
+#define	P2P_GRPCAP_CROSS_CONN				BIT(4)
+#define	P2P_GRPCAP_PERSISTENT_RECONN		BIT(5)
+#define	P2P_GRPCAP_GROUP_FORMATION			BIT(6)
+
+//	P2P Public Action Frame ( Management Frame )
+#define	P2P_PUB_ACTION_ACTION				0x09
+
+//	P2P Public Action Frame Type
+#define	P2P_GO_NEGO_REQ						0
+#define	P2P_GO_NEGO_RESP						1
+#define	P2P_GO_NEGO_CONF						2
+#define	P2P_INVIT_REQ							3
+#define	P2P_INVIT_RESP							4
+#define	P2P_DEVDISC_REQ						5
+#define	P2P_DEVDISC_RESP						6
+#define	P2P_PROVISION_DISC_REQ				7
+#define	P2P_PROVISION_DISC_RESP				8
+
+//	P2P Action Frame Type
+#define	P2P_NOTICE_OF_ABSENCE	0
+#define	P2P_PRESENCE_REQUEST		1
+#define	P2P_PRESENCE_RESPONSE	2
+#define	P2P_GO_DISC_REQUEST		3
+
+
+#define	P2P_MAX_PERSISTENT_GROUP_NUM		10
+
+#define	P2P_PROVISIONING_SCAN_CNT			3
+
+#define	P2P_WILDCARD_SSID_LEN				7
+
+#define	P2P_FINDPHASE_EX_NONE				0	// default value, used when: (1)p2p disabed or (2)p2p enabled but only do 1 scan phase
+#define	P2P_FINDPHASE_EX_FULL				1	// used when p2p enabled and want to do 1 scan phase and P2P_FINDPHASE_EX_MAX-1 find phase
+#define	P2P_FINDPHASE_EX_SOCIAL_FIRST		(P2P_FINDPHASE_EX_FULL+1)
+#define	P2P_FINDPHASE_EX_MAX					4
+#define	P2P_FINDPHASE_EX_SOCIAL_LAST		P2P_FINDPHASE_EX_MAX
+
+#define	P2P_PROVISION_TIMEOUT				5000	//	5 seconds timeout for sending the provision discovery request
+#define	P2P_CONCURRENT_PROVISION_TIMEOUT	3000	//	3 seconds timeout for sending the provision discovery request under concurrent mode
+#define	P2P_GO_NEGO_TIMEOUT					5000	//	5 seconds timeout for receiving the group negotation response
+#define	P2P_CONCURRENT_GO_NEGO_TIMEOUT		3000	//	3 seconds timeout for sending the negotiation request under concurrent mode
+#define	P2P_TX_PRESCAN_TIMEOUT				100		//	100ms
+#define	P2P_INVITE_TIMEOUT					5000	//	5 seconds timeout for sending the invitation request
+#define	P2P_CONCURRENT_INVITE_TIMEOUT		3000	//	3 seconds timeout for sending the invitation request under concurrent mode
+#define	P2P_RESET_SCAN_CH						15000	//	15 seconds timeout to reset the scan channel ( based on channel plan )
+#define	P2P_MAX_INTENT						15
+
+#define	P2P_MAX_NOA_NUM						2
+
+//	WPS Configuration Method
+#define	WPS_CM_NONE							0x0000
+#define	WPS_CM_LABEL							0x0004
+#define	WPS_CM_DISPLYA						0x0008
+#define	WPS_CM_EXTERNAL_NFC_TOKEN			0x0010
+#define	WPS_CM_INTEGRATED_NFC_TOKEN		0x0020
+#define	WPS_CM_NFC_INTERFACE					0x0040
+#define	WPS_CM_PUSH_BUTTON					0x0080
+#define	WPS_CM_KEYPAD						0x0100
+#define	WPS_CM_SW_PUHS_BUTTON				0x0280
+#define	WPS_CM_HW_PUHS_BUTTON				0x0480
+#define	WPS_CM_SW_DISPLAY_PIN				0x2008
+#define	WPS_CM_LCD_DISPLAY_PIN				0x4008
+
+enum P2P_ROLE {
+	P2P_ROLE_DISABLE = 0,
+	P2P_ROLE_DEVICE = 1,
+	P2P_ROLE_CLIENT = 2,
+	P2P_ROLE_GO = 3
+};
+
+enum P2P_STATE {
+	P2P_STATE_NONE = 0,							//	P2P disable
+	P2P_STATE_IDLE = 1,								//	P2P had enabled and do nothing
+	P2P_STATE_LISTEN = 2,							//	In pure listen state
+	P2P_STATE_SCAN = 3,							//	In scan phase
+	P2P_STATE_FIND_PHASE_LISTEN = 4,				//	In the listen state of find phase
+	P2P_STATE_FIND_PHASE_SEARCH = 5,				//	In the search state of find phase
+	P2P_STATE_TX_PROVISION_DIS_REQ = 6,			//	In P2P provisioning discovery
+	P2P_STATE_RX_PROVISION_DIS_RSP = 7,
+	P2P_STATE_RX_PROVISION_DIS_REQ = 8,
+	P2P_STATE_GONEGO_ING = 9,						//	Doing the group owner negoitation handshake
+	P2P_STATE_GONEGO_OK = 10,						//	finish the group negoitation handshake with success
+	P2P_STATE_GONEGO_FAIL = 11,					//	finish the group negoitation handshake with failure
+	P2P_STATE_RECV_INVITE_REQ_MATCH = 12,		//	receiving the P2P Inviation request and match with the profile.
+	P2P_STATE_PROVISIONING_ING = 13,				//	Doing the P2P WPS
+	P2P_STATE_PROVISIONING_DONE = 14,			//	Finish the P2P WPS
+	P2P_STATE_TX_INVITE_REQ = 15,					//	Transmit the P2P Invitation request
+	P2P_STATE_RX_INVITE_RESP_OK = 16,				//	Receiving the P2P Invitation response with sucess
+	P2P_STATE_RECV_INVITE_REQ_DISMATCH = 17,	//	receiving the P2P Inviation request and dismatch with the profile.
+	P2P_STATE_RECV_INVITE_REQ_GO = 18,			//	receiving the P2P Inviation request and this wifi is GO.
+	P2P_STATE_RECV_INVITE_REQ_JOIN = 19,			//	receiving the P2P Inviation request to join an existing P2P Group.
+	P2P_STATE_RX_INVITE_RESP_FAIL = 20,			//	recveing the P2P Inviation response with failure
+	P2P_STATE_RX_INFOR_NOREADY = 21, 			// receiving p2p negoitation response with information is not available
+	P2P_STATE_TX_INFOR_NOREADY = 22, 			// sending p2p negoitation response with information is not available
+};
+
+enum P2P_WPSINFO {
+	P2P_NO_WPSINFO						= 0,
+	P2P_GOT_WPSINFO_PEER_DISPLAY_PIN	= 1,
+	P2P_GOT_WPSINFO_SELF_DISPLAY_PIN	= 2,
+	P2P_GOT_WPSINFO_PBC					= 3,
+};
+
+#define	P2P_PRIVATE_IOCTL_SET_LEN		64
+
+enum P2P_PROTO_WK_ID
+{
+	P2P_FIND_PHASE_WK = 0,
+	P2P_RESTORE_STATE_WK = 1,
+	P2P_PRE_TX_PROVDISC_PROCESS_WK = 2,
+	P2P_PRE_TX_NEGOREQ_PROCESS_WK = 3,
+	P2P_PRE_TX_INVITEREQ_PROCESS_WK = 4,
+	P2P_AP_P2P_CH_SWITCH_PROCESS_WK =5,
+	P2P_RO_CH_WK = 6,
+};
+
+#ifdef CONFIG_P2P_PS
+enum P2P_PS_STATE
+{
+	P2P_PS_DISABLE = 0,
+	P2P_PS_ENABLE = 1,
+	P2P_PS_SCAN = 2,
+	P2P_PS_SCAN_DONE = 3,
+	P2P_PS_ALLSTASLEEP = 4, // for P2P GO
+};
+
+enum P2P_PS_MODE
+{
+	P2P_PS_NONE = 0,
+	P2P_PS_CTWINDOW = 1,
+	P2P_PS_NOA	 = 2,
+	P2P_PS_MIX = 3, // CTWindow and NoA
+};
+#endif // CONFIG_P2P_PS
+
+//	=====================WFD Section=====================
+//	For Wi-Fi Display
+#define	WFD_ATTR_DEVICE_INFO			0x00
+#define	WFD_ATTR_ASSOC_BSSID			0x01
+#define	WFD_ATTR_COUPLED_SINK_INFO	0x06
+#define	WFD_ATTR_LOCAL_IP_ADDR		0x08
+#define	WFD_ATTR_SESSION_INFO		0x09
+#define	WFD_ATTR_ALTER_MAC			0x0a
+
+//	For WFD Device Information Attribute
+#define	WFD_DEVINFO_SOURCE					0x0000
+#define	WFD_DEVINFO_PSINK					0x0001
+#define	WFD_DEVINFO_SSINK					0x0002
+#define	WFD_DEVINFO_DUAL 					0x0003
+
+#define	WFD_DEVINFO_SESSION_AVAIL			0x0010
+#define	WFD_DEVINFO_WSD						0x0040
+#define	WFD_DEVINFO_PC_TDLS					0x0080
+#define	WFD_DEVINFO_HDCP_SUPPORT			0x0100
+
+
+#ifdef  CONFIG_TX_MCAST2UNI
+#define IP_MCAST_MAC(mac)		((mac[0]==0x01)&&(mac[1]==0x00)&&(mac[2]==0x5e))
+#define ICMPV6_MCAST_MAC(mac)	((mac[0]==0x33)&&(mac[1]==0x33)&&(mac[2]!=0xff))
+#endif	// CONFIG_TX_MCAST2UNI
+
+
+
+#endif // _WIFI_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/wlan_bssdef.h b/drivers/net/wireless/realtek/rtl8192cu/include/wlan_bssdef.h
new file mode 100644
index 000000000000..641b7e9b3d8f
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/wlan_bssdef.h
@@ -0,0 +1,702 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __WLAN_BSSDEF_H__
+#define __WLAN_BSSDEF_H__
+
+
+#define MAX_IE_SZ	768
+
+
+#ifdef PLATFORM_LINUX
+
+#define NDIS_802_11_LENGTH_SSID         32
+#define NDIS_802_11_LENGTH_RATES        8
+#define NDIS_802_11_LENGTH_RATES_EX     16
+
+typedef unsigned char   NDIS_802_11_MAC_ADDRESS[6];
+typedef long    		NDIS_802_11_RSSI;           // in dBm
+typedef unsigned char   NDIS_802_11_RATES[NDIS_802_11_LENGTH_RATES];        // Set of 8 data rates
+typedef unsigned char   NDIS_802_11_RATES_EX[NDIS_802_11_LENGTH_RATES_EX];  // Set of 16 data rates
+
+
+typedef  ULONG  NDIS_802_11_KEY_INDEX;
+typedef unsigned long long NDIS_802_11_KEY_RSC;
+
+
+typedef struct _NDIS_802_11_SSID
+{
+  ULONG  SsidLength;
+  UCHAR  Ssid[32];
+} NDIS_802_11_SSID, *PNDIS_802_11_SSID;
+
+typedef enum _NDIS_802_11_NETWORK_TYPE
+{
+    Ndis802_11FH,
+    Ndis802_11DS,
+    Ndis802_11OFDM5,
+    Ndis802_11OFDM24,
+    Ndis802_11NetworkTypeMax    // not a real type, defined as an upper bound
+} NDIS_802_11_NETWORK_TYPE, *PNDIS_802_11_NETWORK_TYPE;
+
+typedef struct _NDIS_802_11_CONFIGURATION_FH
+{
+    ULONG           Length;             // Length of structure
+    ULONG           HopPattern;         // As defined by 802.11, MSB set
+    ULONG           HopSet;             // to one if non-802.11
+    ULONG           DwellTime;          // units are Kusec
+} NDIS_802_11_CONFIGURATION_FH, *PNDIS_802_11_CONFIGURATION_FH;
+
+
+/*
+	FW will only save the channel number in DSConfig.
+	ODI Handler will convert the channel number to freq. number.
+*/
+typedef struct _NDIS_802_11_CONFIGURATION
+{
+    ULONG           Length;             // Length of structure
+    ULONG           BeaconPeriod;       // units are Kusec
+    ULONG           ATIMWindow;         // units are Kusec
+    ULONG           DSConfig;           // Frequency, units are kHz
+    NDIS_802_11_CONFIGURATION_FH    FHConfig;
+} NDIS_802_11_CONFIGURATION, *PNDIS_802_11_CONFIGURATION;
+
+
+
+typedef enum _NDIS_802_11_NETWORK_INFRASTRUCTURE
+{
+    Ndis802_11IBSS,
+    Ndis802_11Infrastructure,
+    Ndis802_11AutoUnknown,
+    Ndis802_11InfrastructureMax,     // Not a real value, defined as upper bound
+    Ndis802_11APMode
+} NDIS_802_11_NETWORK_INFRASTRUCTURE, *PNDIS_802_11_NETWORK_INFRASTRUCTURE;
+
+
+
+
+
+typedef struct _NDIS_802_11_FIXED_IEs
+{
+  UCHAR  Timestamp[8];
+  USHORT  BeaconInterval;
+  USHORT  Capabilities;
+} NDIS_802_11_FIXED_IEs, *PNDIS_802_11_FIXED_IEs;
+
+
+
+typedef struct _NDIS_802_11_VARIABLE_IEs
+{
+  UCHAR  ElementID;
+  UCHAR  Length;
+  UCHAR  data[1];
+} NDIS_802_11_VARIABLE_IEs, *PNDIS_802_11_VARIABLE_IEs;
+
+
+
+/*
+
+
+
+Length is the 4 bytes multiples of the sume of
+	sizeof (NDIS_802_11_MAC_ADDRESS) + 2 + sizeof (NDIS_802_11_SSID) + sizeof (ULONG)
++   sizeof (NDIS_802_11_RSSI) + sizeof (NDIS_802_11_NETWORK_TYPE) + sizeof (NDIS_802_11_CONFIGURATION)
++   sizeof (NDIS_802_11_RATES_EX) + IELength
+
+Except the IELength, all other fields are fixed length. Therefore, we can define a marco to present the
+partial sum.
+
+*/
+#if 0
+typedef struct _NDIS_WLAN_BSSID_EX
+{
+  ULONG  Length;
+  NDIS_802_11_MAC_ADDRESS  MacAddress;
+  UCHAR  Reserved[2];//[0]: IS beacon frame, [1]:optimum_antenna=>For antenna diversity;
+  NDIS_802_11_SSID  Ssid;
+  ULONG  Privacy;
+  NDIS_802_11_RSSI  Rssi;
+  NDIS_802_11_NETWORK_TYPE  NetworkTypeInUse;
+  NDIS_802_11_CONFIGURATION  Configuration;
+  NDIS_802_11_NETWORK_INFRASTRUCTURE  InfrastructureMode;
+  NDIS_802_11_RATES_EX  SupportedRates;
+  ULONG  IELength;
+  UCHAR  IEs[MAX_IE_SZ];	//(timestamp, beacon interval, and capability information)
+} NDIS_WLAN_BSSID_EX, *PNDIS_WLAN_BSSID_EX;
+
+
+typedef struct _NDIS_802_11_BSSID_LIST_EX
+{
+  ULONG  NumberOfItems;
+  NDIS_WLAN_BSSID_EX  Bssid[1];
+} NDIS_802_11_BSSID_LIST_EX, *PNDIS_802_11_BSSID_LIST_EX;
+#endif
+
+typedef enum _NDIS_802_11_AUTHENTICATION_MODE
+{
+    Ndis802_11AuthModeOpen,
+    Ndis802_11AuthModeShared,
+    Ndis802_11AuthModeAutoSwitch,
+    Ndis802_11AuthModeWPA,
+    Ndis802_11AuthModeWPAPSK,
+    Ndis802_11AuthModeWPANone,
+    Ndis802_11AuthModeMax               // Not a real mode, defined as upper bound
+} NDIS_802_11_AUTHENTICATION_MODE, *PNDIS_802_11_AUTHENTICATION_MODE;
+
+typedef enum _NDIS_802_11_WEP_STATUS
+{
+    Ndis802_11WEPEnabled,
+    Ndis802_11Encryption1Enabled = Ndis802_11WEPEnabled,
+    Ndis802_11WEPDisabled,
+    Ndis802_11EncryptionDisabled = Ndis802_11WEPDisabled,
+    Ndis802_11WEPKeyAbsent,
+    Ndis802_11Encryption1KeyAbsent = Ndis802_11WEPKeyAbsent,
+    Ndis802_11WEPNotSupported,
+    Ndis802_11EncryptionNotSupported = Ndis802_11WEPNotSupported,
+    Ndis802_11Encryption2Enabled,
+    Ndis802_11Encryption2KeyAbsent,
+    Ndis802_11Encryption3Enabled,
+    Ndis802_11Encryption3KeyAbsent
+} NDIS_802_11_WEP_STATUS, *PNDIS_802_11_WEP_STATUS,
+  NDIS_802_11_ENCRYPTION_STATUS, *PNDIS_802_11_ENCRYPTION_STATUS;
+
+
+#define NDIS_802_11_AI_REQFI_CAPABILITIES      1
+#define NDIS_802_11_AI_REQFI_LISTENINTERVAL    2
+#define NDIS_802_11_AI_REQFI_CURRENTAPADDRESS  4
+
+#define NDIS_802_11_AI_RESFI_CAPABILITIES      1
+#define NDIS_802_11_AI_RESFI_STATUSCODE        2
+#define NDIS_802_11_AI_RESFI_ASSOCIATIONID     4
+
+typedef struct _NDIS_802_11_AI_REQFI
+{
+    USHORT Capabilities;
+    USHORT ListenInterval;
+    NDIS_802_11_MAC_ADDRESS  CurrentAPAddress;
+} NDIS_802_11_AI_REQFI, *PNDIS_802_11_AI_REQFI;
+
+typedef struct _NDIS_802_11_AI_RESFI
+{
+    USHORT Capabilities;
+    USHORT StatusCode;
+    USHORT AssociationId;
+} NDIS_802_11_AI_RESFI, *PNDIS_802_11_AI_RESFI;
+
+typedef struct _NDIS_802_11_ASSOCIATION_INFORMATION
+{
+    ULONG                   Length;
+    USHORT                  AvailableRequestFixedIEs;
+    NDIS_802_11_AI_REQFI    RequestFixedIEs;
+    ULONG                   RequestIELength;
+    ULONG                   OffsetRequestIEs;
+    USHORT                  AvailableResponseFixedIEs;
+    NDIS_802_11_AI_RESFI    ResponseFixedIEs;
+    ULONG                   ResponseIELength;
+    ULONG                   OffsetResponseIEs;
+} NDIS_802_11_ASSOCIATION_INFORMATION, *PNDIS_802_11_ASSOCIATION_INFORMATION;
+
+typedef enum _NDIS_802_11_RELOAD_DEFAULTS
+{
+   Ndis802_11ReloadWEPKeys
+} NDIS_802_11_RELOAD_DEFAULTS, *PNDIS_802_11_RELOAD_DEFAULTS;
+
+
+// Key mapping keys require a BSSID
+typedef struct _NDIS_802_11_KEY
+{
+    ULONG           Length;             // Length of this structure
+    ULONG           KeyIndex;
+    ULONG           KeyLength;          // length of key in bytes
+    NDIS_802_11_MAC_ADDRESS BSSID;
+    NDIS_802_11_KEY_RSC KeyRSC;
+    UCHAR           KeyMaterial[32];     // variable length depending on above field
+} NDIS_802_11_KEY, *PNDIS_802_11_KEY;
+
+typedef struct _NDIS_802_11_REMOVE_KEY
+{
+    ULONG                   Length;        // Length of this structure
+    ULONG                   KeyIndex;
+    NDIS_802_11_MAC_ADDRESS BSSID;
+} NDIS_802_11_REMOVE_KEY, *PNDIS_802_11_REMOVE_KEY;
+
+typedef struct _NDIS_802_11_WEP
+{
+    ULONG     Length;        // Length of this structure
+    ULONG     KeyIndex;      // 0 is the per-client key, 1-N are the global keys
+    ULONG     KeyLength;     // length of key in bytes
+    UCHAR     KeyMaterial[16];// variable length depending on above field
+} NDIS_802_11_WEP, *PNDIS_802_11_WEP;
+
+typedef struct _NDIS_802_11_AUTHENTICATION_REQUEST
+{
+    ULONG Length;            // Length of structure
+    NDIS_802_11_MAC_ADDRESS Bssid;
+    ULONG Flags;
+} NDIS_802_11_AUTHENTICATION_REQUEST, *PNDIS_802_11_AUTHENTICATION_REQUEST;
+
+typedef enum _NDIS_802_11_STATUS_TYPE
+{
+	Ndis802_11StatusType_Authentication,
+	Ndis802_11StatusType_MediaStreamMode,
+	Ndis802_11StatusType_PMKID_CandidateList,
+	Ndis802_11StatusTypeMax    // not a real type, defined as an upper bound
+} NDIS_802_11_STATUS_TYPE, *PNDIS_802_11_STATUS_TYPE;
+
+typedef struct _NDIS_802_11_STATUS_INDICATION
+{
+    NDIS_802_11_STATUS_TYPE StatusType;
+} NDIS_802_11_STATUS_INDICATION, *PNDIS_802_11_STATUS_INDICATION;
+
+// mask for authentication/integrity fields
+#define NDIS_802_11_AUTH_REQUEST_AUTH_FIELDS        0x0f
+#define NDIS_802_11_AUTH_REQUEST_REAUTH			0x01
+#define NDIS_802_11_AUTH_REQUEST_KEYUPDATE		0x02
+#define NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR		0x06
+#define NDIS_802_11_AUTH_REQUEST_GROUP_ERROR		0x0E
+
+// MIC check time, 60 seconds.
+#define MIC_CHECK_TIME	60000000
+
+typedef struct _NDIS_802_11_AUTHENTICATION_EVENT
+{
+    NDIS_802_11_STATUS_INDICATION       Status;
+    NDIS_802_11_AUTHENTICATION_REQUEST  Request[1];
+} NDIS_802_11_AUTHENTICATION_EVENT, *PNDIS_802_11_AUTHENTICATION_EVENT;
+
+typedef struct _NDIS_802_11_TEST
+{
+    ULONG Length;
+    ULONG Type;
+    union
+    {
+        NDIS_802_11_AUTHENTICATION_EVENT AuthenticationEvent;
+        NDIS_802_11_RSSI RssiTrigger;
+    }tt;
+} NDIS_802_11_TEST, *PNDIS_802_11_TEST;
+
+
+#endif //end of #ifdef PLATFORM_LINUX
+
+#ifdef PLATFORM_FREEBSD
+
+#define NDIS_802_11_LENGTH_SSID         32
+#define NDIS_802_11_LENGTH_RATES        8
+#define NDIS_802_11_LENGTH_RATES_EX     16
+
+typedef unsigned char   NDIS_802_11_MAC_ADDRESS[6];
+typedef long    		NDIS_802_11_RSSI;           // in dBm
+typedef unsigned char   NDIS_802_11_RATES[NDIS_802_11_LENGTH_RATES];        // Set of 8 data rates
+typedef unsigned char   NDIS_802_11_RATES_EX[NDIS_802_11_LENGTH_RATES_EX];  // Set of 16 data rates
+
+
+typedef  ULONG  NDIS_802_11_KEY_INDEX;
+typedef unsigned long long NDIS_802_11_KEY_RSC;
+
+
+typedef struct _NDIS_802_11_SSID
+{
+  ULONG  SsidLength;
+  UCHAR  Ssid[32];
+} NDIS_802_11_SSID, *PNDIS_802_11_SSID;
+
+typedef enum _NDIS_802_11_NETWORK_TYPE
+{
+    Ndis802_11FH,
+    Ndis802_11DS,
+    Ndis802_11OFDM5,
+    Ndis802_11OFDM24,
+    Ndis802_11NetworkTypeMax    // not a real type, defined as an upper bound
+} NDIS_802_11_NETWORK_TYPE, *PNDIS_802_11_NETWORK_TYPE;
+
+typedef struct _NDIS_802_11_CONFIGURATION_FH
+{
+    ULONG           Length;             // Length of structure
+    ULONG           HopPattern;         // As defined by 802.11, MSB set
+    ULONG           HopSet;             // to one if non-802.11
+    ULONG           DwellTime;          // units are Kusec
+} NDIS_802_11_CONFIGURATION_FH, *PNDIS_802_11_CONFIGURATION_FH;
+
+
+/*
+	FW will only save the channel number in DSConfig.
+	ODI Handler will convert the channel number to freq. number.
+*/
+typedef struct _NDIS_802_11_CONFIGURATION
+{
+    ULONG           Length;             // Length of structure
+    ULONG           BeaconPeriod;       // units are Kusec
+    ULONG           ATIMWindow;         // units are Kusec
+    ULONG           DSConfig;           // Frequency, units are kHz
+    NDIS_802_11_CONFIGURATION_FH    FHConfig;
+} NDIS_802_11_CONFIGURATION, *PNDIS_802_11_CONFIGURATION;
+
+
+
+typedef enum _NDIS_802_11_NETWORK_INFRASTRUCTURE
+{
+    Ndis802_11IBSS,
+    Ndis802_11Infrastructure,
+    Ndis802_11AutoUnknown,
+    Ndis802_11InfrastructureMax,     // Not a real value, defined as upper bound
+    Ndis802_11APMode
+} NDIS_802_11_NETWORK_INFRASTRUCTURE, *PNDIS_802_11_NETWORK_INFRASTRUCTURE;
+
+
+
+
+
+typedef struct _NDIS_802_11_FIXED_IEs
+{
+  UCHAR  Timestamp[8];
+  USHORT  BeaconInterval;
+  USHORT  Capabilities;
+} NDIS_802_11_FIXED_IEs, *PNDIS_802_11_FIXED_IEs;
+
+
+
+typedef struct _NDIS_802_11_VARIABLE_IEs
+{
+  UCHAR  ElementID;
+  UCHAR  Length;
+  UCHAR  data[1];
+} NDIS_802_11_VARIABLE_IEs, *PNDIS_802_11_VARIABLE_IEs;
+
+
+
+/*
+
+
+
+Length is the 4 bytes multiples of the sume of
+	sizeof (NDIS_802_11_MAC_ADDRESS) + 2 + sizeof (NDIS_802_11_SSID) + sizeof (ULONG)
++   sizeof (NDIS_802_11_RSSI) + sizeof (NDIS_802_11_NETWORK_TYPE) + sizeof (NDIS_802_11_CONFIGURATION)
++   sizeof (NDIS_802_11_RATES_EX) + IELength
+
+Except the IELength, all other fields are fixed length. Therefore, we can define a marco to present the
+partial sum.
+
+*/
+#if 0
+typedef struct _NDIS_WLAN_BSSID_EX
+{
+  ULONG  Length;
+  NDIS_802_11_MAC_ADDRESS  MacAddress;
+  UCHAR  Reserved[2];//[0]: IS beacon frame, [1]:optimum_antenna=>For antenna diversity;
+  NDIS_802_11_SSID  Ssid;
+  ULONG  Privacy;
+  NDIS_802_11_RSSI  Rssi;
+  NDIS_802_11_NETWORK_TYPE  NetworkTypeInUse;
+  NDIS_802_11_CONFIGURATION  Configuration;
+  NDIS_802_11_NETWORK_INFRASTRUCTURE  InfrastructureMode;
+  NDIS_802_11_RATES_EX  SupportedRates;
+  ULONG  IELength;
+  UCHAR  IEs[MAX_IE_SZ];	//(timestamp, beacon interval, and capability information)
+} NDIS_WLAN_BSSID_EX, *PNDIS_WLAN_BSSID_EX;
+
+
+typedef struct _NDIS_802_11_BSSID_LIST_EX
+{
+  ULONG  NumberOfItems;
+  NDIS_WLAN_BSSID_EX  Bssid[1];
+} NDIS_802_11_BSSID_LIST_EX, *PNDIS_802_11_BSSID_LIST_EX;
+#endif
+
+typedef enum _NDIS_802_11_AUTHENTICATION_MODE
+{
+    Ndis802_11AuthModeOpen,
+    Ndis802_11AuthModeShared,
+    Ndis802_11AuthModeAutoSwitch,
+    Ndis802_11AuthModeWPA,
+    Ndis802_11AuthModeWPAPSK,
+    Ndis802_11AuthModeWPANone,
+    Ndis802_11AuthModeMax               // Not a real mode, defined as upper bound
+} NDIS_802_11_AUTHENTICATION_MODE, *PNDIS_802_11_AUTHENTICATION_MODE;
+
+typedef enum _NDIS_802_11_WEP_STATUS
+{
+    Ndis802_11WEPEnabled,
+    Ndis802_11Encryption1Enabled = Ndis802_11WEPEnabled,
+    Ndis802_11WEPDisabled,
+    Ndis802_11EncryptionDisabled = Ndis802_11WEPDisabled,
+    Ndis802_11WEPKeyAbsent,
+    Ndis802_11Encryption1KeyAbsent = Ndis802_11WEPKeyAbsent,
+    Ndis802_11WEPNotSupported,
+    Ndis802_11EncryptionNotSupported = Ndis802_11WEPNotSupported,
+    Ndis802_11Encryption2Enabled,
+    Ndis802_11Encryption2KeyAbsent,
+    Ndis802_11Encryption3Enabled,
+    Ndis802_11Encryption3KeyAbsent
+} NDIS_802_11_WEP_STATUS, *PNDIS_802_11_WEP_STATUS,
+  NDIS_802_11_ENCRYPTION_STATUS, *PNDIS_802_11_ENCRYPTION_STATUS;
+
+
+#define NDIS_802_11_AI_REQFI_CAPABILITIES      1
+#define NDIS_802_11_AI_REQFI_LISTENINTERVAL    2
+#define NDIS_802_11_AI_REQFI_CURRENTAPADDRESS  4
+
+#define NDIS_802_11_AI_RESFI_CAPABILITIES      1
+#define NDIS_802_11_AI_RESFI_STATUSCODE        2
+#define NDIS_802_11_AI_RESFI_ASSOCIATIONID     4
+
+typedef struct _NDIS_802_11_AI_REQFI
+{
+    USHORT Capabilities;
+    USHORT ListenInterval;
+    NDIS_802_11_MAC_ADDRESS  CurrentAPAddress;
+} NDIS_802_11_AI_REQFI, *PNDIS_802_11_AI_REQFI;
+
+typedef struct _NDIS_802_11_AI_RESFI
+{
+    USHORT Capabilities;
+    USHORT StatusCode;
+    USHORT AssociationId;
+} NDIS_802_11_AI_RESFI, *PNDIS_802_11_AI_RESFI;
+
+typedef struct _NDIS_802_11_ASSOCIATION_INFORMATION
+{
+    ULONG                   Length;
+    USHORT                  AvailableRequestFixedIEs;
+    NDIS_802_11_AI_REQFI    RequestFixedIEs;
+    ULONG                   RequestIELength;
+    ULONG                   OffsetRequestIEs;
+    USHORT                  AvailableResponseFixedIEs;
+    NDIS_802_11_AI_RESFI    ResponseFixedIEs;
+    ULONG                   ResponseIELength;
+    ULONG                   OffsetResponseIEs;
+} NDIS_802_11_ASSOCIATION_INFORMATION, *PNDIS_802_11_ASSOCIATION_INFORMATION;
+
+typedef enum _NDIS_802_11_RELOAD_DEFAULTS
+{
+   Ndis802_11ReloadWEPKeys
+} NDIS_802_11_RELOAD_DEFAULTS, *PNDIS_802_11_RELOAD_DEFAULTS;
+
+
+// Key mapping keys require a BSSID
+typedef struct _NDIS_802_11_KEY
+{
+    ULONG           Length;             // Length of this structure
+    ULONG           KeyIndex;
+    ULONG           KeyLength;          // length of key in bytes
+    NDIS_802_11_MAC_ADDRESS BSSID;
+    NDIS_802_11_KEY_RSC KeyRSC;
+    UCHAR           KeyMaterial[32];     // variable length depending on above field
+} NDIS_802_11_KEY, *PNDIS_802_11_KEY;
+
+typedef struct _NDIS_802_11_REMOVE_KEY
+{
+    ULONG                   Length;        // Length of this structure
+    ULONG                   KeyIndex;
+    NDIS_802_11_MAC_ADDRESS BSSID;
+} NDIS_802_11_REMOVE_KEY, *PNDIS_802_11_REMOVE_KEY;
+
+typedef struct _NDIS_802_11_WEP
+{
+    ULONG     Length;        // Length of this structure
+    ULONG     KeyIndex;      // 0 is the per-client key, 1-N are the global keys
+    ULONG     KeyLength;     // length of key in bytes
+    UCHAR     KeyMaterial[16];// variable length depending on above field
+} NDIS_802_11_WEP, *PNDIS_802_11_WEP;
+
+typedef struct _NDIS_802_11_AUTHENTICATION_REQUEST
+{
+    ULONG Length;            // Length of structure
+    NDIS_802_11_MAC_ADDRESS Bssid;
+    ULONG Flags;
+} NDIS_802_11_AUTHENTICATION_REQUEST, *PNDIS_802_11_AUTHENTICATION_REQUEST;
+
+typedef enum _NDIS_802_11_STATUS_TYPE
+{
+	Ndis802_11StatusType_Authentication,
+	Ndis802_11StatusType_MediaStreamMode,
+	Ndis802_11StatusType_PMKID_CandidateList,
+	Ndis802_11StatusTypeMax    // not a real type, defined as an upper bound
+} NDIS_802_11_STATUS_TYPE, *PNDIS_802_11_STATUS_TYPE;
+
+typedef struct _NDIS_802_11_STATUS_INDICATION
+{
+    NDIS_802_11_STATUS_TYPE StatusType;
+} NDIS_802_11_STATUS_INDICATION, *PNDIS_802_11_STATUS_INDICATION;
+
+// mask for authentication/integrity fields
+#define NDIS_802_11_AUTH_REQUEST_AUTH_FIELDS        0x0f
+#define NDIS_802_11_AUTH_REQUEST_REAUTH			0x01
+#define NDIS_802_11_AUTH_REQUEST_KEYUPDATE		0x02
+#define NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR		0x06
+#define NDIS_802_11_AUTH_REQUEST_GROUP_ERROR		0x0E
+
+// MIC check time, 60 seconds.
+#define MIC_CHECK_TIME	60000000
+
+typedef struct _NDIS_802_11_AUTHENTICATION_EVENT
+{
+    NDIS_802_11_STATUS_INDICATION       Status;
+    NDIS_802_11_AUTHENTICATION_REQUEST  Request[1];
+} NDIS_802_11_AUTHENTICATION_EVENT, *PNDIS_802_11_AUTHENTICATION_EVENT;
+
+typedef struct _NDIS_802_11_TEST
+{
+    ULONG Length;
+    ULONG Type;
+    union
+    {
+        NDIS_802_11_AUTHENTICATION_EVENT AuthenticationEvent;
+        NDIS_802_11_RSSI RssiTrigger;
+    }tt;
+} NDIS_802_11_TEST, *PNDIS_802_11_TEST;
+
+
+#endif //PLATFORM_FREEBSD
+#ifndef Ndis802_11APMode
+#define Ndis802_11APMode (Ndis802_11InfrastructureMax+1)
+#endif
+
+typedef struct _WLAN_PHY_INFO
+{
+	u8	SignalStrength;//(in percentage)
+	u8	SignalQuality;//(in percentage)
+	u8	Optimum_antenna;  //for Antenna diversity
+	u8  	Reserved_0;
+}WLAN_PHY_INFO,*PWLAN_PHY_INFO;
+
+/* temporally add #pragma pack for structure alignment issue of
+*   WLAN_BSSID_EX and get_WLAN_BSSID_EX_sz()
+*/
+#ifdef PLATFORM_WINDOWS
+#pragma pack(push)
+#pragma pack(1)
+#endif
+typedef struct _WLAN_BSSID_EX
+{
+  ULONG  Length;
+  NDIS_802_11_MAC_ADDRESS  MacAddress;
+  UCHAR  Reserved[2];//[0]: IS beacon frame
+  NDIS_802_11_SSID  Ssid;
+  ULONG  Privacy;
+  NDIS_802_11_RSSI  Rssi;//(in dBM,raw data ,get from PHY)
+  NDIS_802_11_NETWORK_TYPE  NetworkTypeInUse;
+  NDIS_802_11_CONFIGURATION  Configuration;
+  NDIS_802_11_NETWORK_INFRASTRUCTURE  InfrastructureMode;
+  NDIS_802_11_RATES_EX  SupportedRates;
+  WLAN_PHY_INFO	PhyInfo;
+  ULONG  IELength;
+  UCHAR  IEs[MAX_IE_SZ];	//(timestamp, beacon interval, and capability information)
+}
+#ifndef PLATFORM_WINDOWS
+__attribute__((packed))
+#endif
+WLAN_BSSID_EX, *PWLAN_BSSID_EX;
+#ifdef PLATFORM_WINDOWS
+#pragma pack(pop)
+#endif
+
+__inline  static uint get_WLAN_BSSID_EX_sz(WLAN_BSSID_EX *bss)
+{
+	return (sizeof(WLAN_BSSID_EX) - MAX_IE_SZ + bss->IELength);
+}
+
+struct	wlan_network {
+	_list	list;
+	int	network_type;	//refer to ieee80211.h for WIRELESS_11A/B/G
+	int	fixed;			// set to fixed when not to be removed as site-surveying
+	unsigned long	last_scanned; //timestamp for the network
+	int	aid;			//will only be valid when a BSS is joinned.
+	int	join_res;
+	WLAN_BSSID_EX	network; //must be the last item
+#ifdef PLATFORM_WINDOWS
+	unsigned char  iebuf[MAX_IE_SZ];
+#endif
+
+};
+
+enum VRTL_CARRIER_SENSE
+{
+    DISABLE_VCS,
+    ENABLE_VCS,
+    AUTO_VCS
+};
+
+enum VCS_TYPE
+{
+    NONE_VCS,
+    RTS_CTS,
+    CTS_TO_SELF
+};
+
+
+
+
+#define PWR_CAM 0
+#define PWR_MINPS 1
+#define PWR_MAXPS 2
+#define PWR_UAPSD 3
+#define PWR_VOIP 4
+
+
+enum UAPSD_MAX_SP
+{
+	NO_LIMIT,
+       TWO_MSDU,
+       FOUR_MSDU,
+       SIX_MSDU
+};
+
+
+//john
+#define NUM_PRE_AUTH_KEY 16
+#define NUM_PMKID_CACHE NUM_PRE_AUTH_KEY
+
+/*
+* 	WPA2
+*/
+
+#ifndef PLATFORM_OS_CE
+typedef struct _PMKID_CANDIDATE {
+    NDIS_802_11_MAC_ADDRESS BSSID;
+    ULONG Flags;
+} PMKID_CANDIDATE, *PPMKID_CANDIDATE;
+
+typedef struct _NDIS_802_11_PMKID_CANDIDATE_LIST
+{
+    ULONG Version;       // Version of the structure
+    ULONG NumCandidates; // No. of pmkid candidates
+    PMKID_CANDIDATE CandidateList[1];
+} NDIS_802_11_PMKID_CANDIDATE_LIST, *PNDIS_802_11_PMKID_CANDIDATE_LIST;
+
+
+typedef struct _NDIS_802_11_AUTHENTICATION_ENCRYPTION
+{
+	NDIS_802_11_AUTHENTICATION_MODE AuthModeSupported;
+	NDIS_802_11_ENCRYPTION_STATUS EncryptStatusSupported;
+
+} NDIS_802_11_AUTHENTICATION_ENCRYPTION, *PNDIS_802_11_AUTHENTICATION_ENCRYPTION;
+
+typedef struct _NDIS_802_11_CAPABILITY
+{
+	ULONG  Length;
+	ULONG  Version;
+	ULONG  NoOfPMKIDs;
+	ULONG  NoOfAuthEncryptPairsSupported;
+	NDIS_802_11_AUTHENTICATION_ENCRYPTION AuthenticationEncryptionSupported[1];
+
+} NDIS_802_11_CAPABILITY, *PNDIS_802_11_CAPABILITY;
+#endif
+
+
+#endif //#ifndef WLAN_BSSDEF_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/include/xmit_osdep.h b/drivers/net/wireless/realtek/rtl8192cu/include/xmit_osdep.h
new file mode 100644
index 000000000000..0f6d09237bcf
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/include/xmit_osdep.h
@@ -0,0 +1,94 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#ifndef __XMIT_OSDEP_H_
+#define __XMIT_OSDEP_H_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+struct pkt_file {
+	_pkt *pkt;
+	SIZE_T pkt_len;	 //the remainder length of the open_file
+	_buffer *cur_buffer;
+	u8 *buf_start;
+	u8 *cur_addr;
+	SIZE_T buf_len;
+};
+
+#ifdef PLATFORM_WINDOWS
+
+#ifdef PLATFORM_OS_XP
+#ifdef CONFIG_USB_HCI
+#include <usb.h>
+#include <usbdlib.h>
+#include <usbioctl.h>
+#endif
+#endif
+
+#define NR_XMITFRAME     128
+
+#define ETH_ALEN	6
+
+extern NDIS_STATUS rtw_xmit_entry(
+IN _nic_hdl		cnxt,
+IN NDIS_PACKET		*pkt,
+IN UINT				flags
+);
+
+#endif
+
+#ifdef PLATFORM_FREEBSD
+#define NR_XMITFRAME	256
+extern int rtw_xmit_entry(_pkt *pkt, _nic_hdl pnetdev);
+extern void rtw_xmit_entry_wrap (struct ifnet * pifp);
+#endif //PLATFORM_FREEBSD
+
+#ifdef PLATFORM_LINUX
+
+#define NR_XMITFRAME	256
+
+struct xmit_priv;
+struct pkt_attrib;
+struct sta_xmit_priv;
+struct xmit_frame;
+struct xmit_buf;
+
+extern int _rtw_xmit_entry(_pkt *pkt, _nic_hdl pnetdev);
+extern int rtw_xmit_entry(_pkt *pkt, _nic_hdl pnetdev);
+
+#endif
+
+void rtw_os_xmit_schedule(_adapter *padapter);
+
+int rtw_os_xmit_resource_alloc(_adapter *padapter, struct xmit_buf *pxmitbuf,u32 alloc_sz);
+void rtw_os_xmit_resource_free(_adapter *padapter, struct xmit_buf *pxmitbuf,u32 free_sz);
+
+extern void rtw_set_tx_chksum_offload(_pkt *pkt, struct pkt_attrib *pattrib);
+
+extern uint rtw_remainder_len(struct pkt_file *pfile);
+extern void _rtw_open_pktfile(_pkt *pkt, struct pkt_file *pfile);
+extern uint _rtw_pktfile_read (struct pkt_file *pfile, u8 *rmem, uint rlen);
+extern sint rtw_endofpktfile (struct pkt_file *pfile);
+
+extern void rtw_os_pkt_complete(_adapter *padapter, _pkt *pkt);
+extern void rtw_os_xmit_complete(_adapter *padapter, struct xmit_frame *pxframe);
+
+#endif //__XMIT_OSDEP_H_
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/ioctl_cfg80211.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/ioctl_cfg80211.c
new file mode 100644
index 000000000000..f7a9c01b6c30
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/ioctl_cfg80211.c
@@ -0,0 +1,5585 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define  _IOCTL_CFG80211_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <rtw_ioctl.h>
+#include <rtw_ioctl_set.h>
+#include <rtw_ioctl_query.h>
+#include <xmit_osdep.h>
+
+#ifdef CONFIG_IOCTL_CFG80211
+
+#include "ioctl_cfg80211.h"
+
+#define RTW_MAX_MGMT_TX_CNT (8)
+
+#define RTW_SCAN_IE_LEN_MAX      2304
+#define RTW_MAX_REMAIN_ON_CHANNEL_DURATION 65535 //ms
+#define RTW_MAX_NUM_PMKIDS 4
+
+#define RTW_CH_MAX_2G_CHANNEL               14      /* Max channel in 2G band */
+
+static const u32 rtw_cipher_suites[] = {
+	WLAN_CIPHER_SUITE_WEP40,
+	WLAN_CIPHER_SUITE_WEP104,
+	WLAN_CIPHER_SUITE_TKIP,
+	WLAN_CIPHER_SUITE_CCMP,
+#ifdef CONFIG_IEEE80211W
+	WLAN_CIPHER_SUITE_AES_CMAC,
+#endif //CONFIG_IEEE80211W
+};
+
+#define RATETAB_ENT(_rate, _rateid, _flags) \
+	{								\
+		.bitrate	= (_rate),				\
+		.hw_value	= (_rateid),				\
+		.flags		= (_flags),				\
+	}
+
+#define CHAN2G(_channel, _freq, _flags) {			\
+	.band			= NL80211_BAND_2GHZ,		\
+	.center_freq		= (_freq),			\
+	.hw_value		= (_channel),			\
+	.flags			= (_flags),			\
+	.max_antenna_gain	= 0,				\
+	.max_power		= 30,				\
+}
+
+#define CHAN5G(_channel, _flags) {				\
+	.band			= NL80211_BAND_5GHZ,		\
+	.center_freq		= 5000 + (5 * (_channel)),	\
+	.hw_value		= (_channel),			\
+	.flags			= (_flags),			\
+	.max_antenna_gain	= 0,				\
+	.max_power		= 30,				\
+}
+
+static struct ieee80211_rate rtw_rates[] = {
+	RATETAB_ENT(10,  0x1,   0),
+	RATETAB_ENT(20,  0x2,   0),
+	RATETAB_ENT(55,  0x4,   0),
+	RATETAB_ENT(110, 0x8,   0),
+	RATETAB_ENT(60,  0x10,  0),
+	RATETAB_ENT(90,  0x20,  0),
+	RATETAB_ENT(120, 0x40,  0),
+	RATETAB_ENT(180, 0x80,  0),
+	RATETAB_ENT(240, 0x100, 0),
+	RATETAB_ENT(360, 0x200, 0),
+	RATETAB_ENT(480, 0x400, 0),
+	RATETAB_ENT(540, 0x800, 0),
+};
+
+#define rtw_a_rates		(rtw_rates + 4)
+#define RTW_A_RATES_NUM	8
+#define rtw_g_rates		(rtw_rates + 0)
+#define RTW_G_RATES_NUM	12
+
+#define RTW_2G_CHANNELS_NUM 14
+#define RTW_5G_CHANNELS_NUM 37
+
+static struct ieee80211_channel rtw_2ghz_channels[] = {
+	CHAN2G(1, 2412, 0),
+	CHAN2G(2, 2417, 0),
+	CHAN2G(3, 2422, 0),
+	CHAN2G(4, 2427, 0),
+	CHAN2G(5, 2432, 0),
+	CHAN2G(6, 2437, 0),
+	CHAN2G(7, 2442, 0),
+	CHAN2G(8, 2447, 0),
+	CHAN2G(9, 2452, 0),
+	CHAN2G(10, 2457, 0),
+	CHAN2G(11, 2462, 0),
+	CHAN2G(12, 2467, 0),
+	CHAN2G(13, 2472, 0),
+	CHAN2G(14, 2484, 0),
+};
+
+static struct ieee80211_channel rtw_5ghz_a_channels[] = {
+	CHAN5G(34, 0),		CHAN5G(36, 0),
+	CHAN5G(38, 0),		CHAN5G(40, 0),
+	CHAN5G(42, 0),		CHAN5G(44, 0),
+	CHAN5G(46, 0),		CHAN5G(48, 0),
+	CHAN5G(52, 0),		CHAN5G(56, 0),
+	CHAN5G(60, 0),		CHAN5G(64, 0),
+	CHAN5G(100, 0),		CHAN5G(104, 0),
+	CHAN5G(108, 0),		CHAN5G(112, 0),
+	CHAN5G(116, 0),		CHAN5G(120, 0),
+	CHAN5G(124, 0),		CHAN5G(128, 0),
+	CHAN5G(132, 0),		CHAN5G(136, 0),
+	CHAN5G(140, 0),		CHAN5G(149, 0),
+	CHAN5G(153, 0),		CHAN5G(157, 0),
+	CHAN5G(161, 0),		CHAN5G(165, 0),
+	CHAN5G(184, 0),		CHAN5G(188, 0),
+	CHAN5G(192, 0),		CHAN5G(196, 0),
+	CHAN5G(200, 0),		CHAN5G(204, 0),
+	CHAN5G(208, 0),		CHAN5G(212, 0),
+	CHAN5G(216, 0),
+};
+
+
+void rtw_2g_channels_init(struct ieee80211_channel *channels)
+{
+	_rtw_memcpy((void*)channels, (void*)rtw_2ghz_channels,
+		sizeof(struct ieee80211_channel)*RTW_2G_CHANNELS_NUM
+	);
+}
+
+void rtw_5g_channels_init(struct ieee80211_channel *channels)
+{
+	_rtw_memcpy((void*)channels, (void*)rtw_5ghz_a_channels,
+		sizeof(struct ieee80211_channel)*RTW_5G_CHANNELS_NUM
+	);
+}
+
+void rtw_2g_rates_init(struct ieee80211_rate *rates)
+{
+	_rtw_memcpy(rates, rtw_g_rates,
+		sizeof(struct ieee80211_rate)*RTW_G_RATES_NUM
+	);
+}
+
+void rtw_5g_rates_init(struct ieee80211_rate *rates)
+{
+	_rtw_memcpy(rates, rtw_a_rates,
+		sizeof(struct ieee80211_rate)*RTW_A_RATES_NUM
+	);
+}
+
+struct ieee80211_supported_band *rtw_spt_band_alloc(
+	enum nl80211_band band
+	)
+{
+	struct ieee80211_supported_band *spt_band = NULL;
+	int n_channels, n_bitrates;
+
+	if(band == NL80211_BAND_2GHZ)
+	{
+		n_channels = RTW_2G_CHANNELS_NUM;
+		n_bitrates = RTW_G_RATES_NUM;
+	}
+	else if(band == NL80211_BAND_5GHZ)
+	{
+		n_channels = RTW_5G_CHANNELS_NUM;
+		n_bitrates = RTW_A_RATES_NUM;
+	}
+	else
+	{
+		goto exit;
+	}
+
+	spt_band = (struct ieee80211_supported_band *)rtw_zmalloc(
+		sizeof(struct ieee80211_supported_band)
+		+ sizeof(struct ieee80211_channel)*n_channels
+		+ sizeof(struct ieee80211_rate)*n_bitrates
+	);
+	if(!spt_band)
+		goto exit;
+
+	spt_band->channels = (struct ieee80211_channel*)(((u8*)spt_band)+sizeof(struct ieee80211_supported_band));
+	spt_band->bitrates= (struct ieee80211_rate*)(((u8*)spt_band->channels)+sizeof(struct ieee80211_channel)*n_channels);
+	spt_band->band = band;
+	spt_band->n_channels = n_channels;
+	spt_band->n_bitrates = n_bitrates;
+
+	if(band == NL80211_BAND_2GHZ)
+	{
+		rtw_2g_channels_init(spt_band->channels);
+		rtw_2g_rates_init(spt_band->bitrates);
+	}
+	else if(band == NL80211_BAND_5GHZ)
+	{
+		rtw_5g_channels_init(spt_band->channels);
+		rtw_5g_rates_init(spt_band->bitrates);
+	}
+
+	//spt_band.ht_cap
+
+exit:
+
+	return spt_band;
+}
+
+void rtw_spt_band_free(struct ieee80211_supported_band *spt_band)
+{
+	u32 size = 0;
+
+	if(!spt_band)
+		return;
+
+	if(spt_band->band == NL80211_BAND_2GHZ)
+	{
+		size = sizeof(struct ieee80211_supported_band)
+			+ sizeof(struct ieee80211_channel)*RTW_2G_CHANNELS_NUM
+			+ sizeof(struct ieee80211_rate)*RTW_G_RATES_NUM;
+	}
+	else if(spt_band->band == NL80211_BAND_5GHZ)
+	{
+		size = sizeof(struct ieee80211_supported_band)
+			+ sizeof(struct ieee80211_channel)*RTW_5G_CHANNELS_NUM
+			+ sizeof(struct ieee80211_rate)*RTW_A_RATES_NUM;
+	}
+	else
+	{
+
+	}
+	rtw_mfree((u8*)spt_band, size);
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+static const struct ieee80211_txrx_stypes
+rtw_cfg80211_default_mgmt_stypes[NUM_NL80211_IFTYPES] = {
+	[NL80211_IFTYPE_ADHOC] = {
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ACTION >> 4)
+	},
+	[NL80211_IFTYPE_STATION] = {
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+	},
+	[NL80211_IFTYPE_AP] = {
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+		BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+		BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+		BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+		BIT(IEEE80211_STYPE_AUTH >> 4) |
+		BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+		BIT(IEEE80211_STYPE_ACTION >> 4)
+	},
+	[NL80211_IFTYPE_AP_VLAN] = {
+		/* copy AP */
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+		BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+		BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+		BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+		BIT(IEEE80211_STYPE_AUTH >> 4) |
+		BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+		BIT(IEEE80211_STYPE_ACTION >> 4)
+	},
+	[NL80211_IFTYPE_P2P_CLIENT] = {
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+	},
+	[NL80211_IFTYPE_P2P_GO] = {
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+		BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+		BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+		BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+		BIT(IEEE80211_STYPE_AUTH >> 4) |
+		BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+		BIT(IEEE80211_STYPE_ACTION >> 4)
+	},
+};
+#endif
+
+static int rtw_ieee80211_channel_to_frequency(int chan, int band)
+{
+	/* see 802.11 17.3.8.3.2 and Annex J
+	* there are overlapping channel numbers in 5GHz and 2GHz bands */
+
+	if (band == NL80211_BAND_5GHZ) {
+	if (chan >= 182 && chan <= 196)
+			return 4000 + chan * 5;
+             else
+                    return 5000 + chan * 5;
+       } else { /* NL80211_BAND_2GHZ */
+		if (chan == 14)
+			return 2484;
+             else if (chan < 14)
+			return 2407 + chan * 5;
+             else
+			return 0; /* not supported */
+	}
+}
+
+#define MAX_BSSINFO_LEN 1000
+static int rtw_cfg80211_inform_bss(_adapter *padapter, struct wlan_network *pnetwork)
+{
+	int ret=0;
+	struct ieee80211_channel *notify_channel;
+	struct cfg80211_bss *bss;
+	//struct ieee80211_supported_band *band;
+	u16 channel;
+	u32 freq;
+	u64 notify_timestamp;
+	u16 notify_capability;
+	u16 notify_interval;
+	u8 *notify_ie;
+	size_t notify_ielen;
+	s32 notify_signal;
+	u8 *buf, *pbuf;
+	size_t len,bssinf_len=0;
+	struct rtw_ieee80211_hdr *pwlanhdr;
+	unsigned short *fctrl;
+	u8	bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+
+	struct wireless_dev *wdev = padapter->rtw_wdev;
+	struct wiphy *wiphy = wdev->wiphy;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+
+	//DBG_8192C("%s\n", __func__);
+
+	bssinf_len = pnetwork->network.IELength+sizeof (struct rtw_ieee80211_hdr_3addr);
+	if(bssinf_len > MAX_BSSINFO_LEN){
+		DBG_871X("%s IE Length too long > %d byte \n",__FUNCTION__,MAX_BSSINFO_LEN);
+		goto exit;
+	}
+
+	//To reduce PBC Overlap rate
+	//_enter_critical_bh(&pwdev_priv->scan_req_lock, &irqL);
+	if(wdev_to_priv(wdev)->scan_request != NULL)
+	{
+		u8 *psr=NULL, sr = 0;
+		NDIS_802_11_SSID *pssid = &pnetwork->network.Ssid;
+		struct cfg80211_scan_request *request = wdev_to_priv(wdev)->scan_request;
+		struct cfg80211_ssid *ssids = request->ssids;
+		u32 wpsielen=0;
+		u8 *wpsie=NULL;
+
+		wpsie = rtw_get_wps_ie(pnetwork->network.IEs+_FIXED_IE_LENGTH_, pnetwork->network.IELength-_FIXED_IE_LENGTH_, NULL, &wpsielen);
+
+		if(wpsie && wpsielen>0)
+			psr = rtw_get_wps_attr_content(wpsie,  wpsielen, WPS_ATTR_SELECTED_REGISTRAR, (u8*)(&sr), NULL);
+
+		if (sr != 0)
+		{
+			if(request->n_ssids == 1  && request->n_channels == 1) // it means under processing WPS
+			{
+				DBG_8192C("ssid=%s, len=%d\n", pssid->Ssid, pssid->SsidLength);
+
+				if(pssid->SsidLength == ssids[0].ssid_len &&
+					_rtw_memcmp(pssid->Ssid, ssids[0].ssid, ssids[0].ssid_len))
+				{
+					DBG_871X("%s, got sr and ssid match!\n", __func__);
+				}
+				else
+				{
+					if(psr !=NULL)
+						*psr = 0; //clear sr
+
+#if 0
+					WLAN_BSSID_EX  *pselect_network = &pnetwork->network;
+					struct cfg80211_bss *pselect_bss = NULL;
+					struct ieee80211_channel *notify_channel = NULL;
+					u32 freq;
+
+					DBG_871X("%s, got sr, but ssid mismatch, to remove this bss\n", __func__);
+
+					if (pselect_network->Configuration.DSConfig <= RTW_CH_MAX_2G_CHANNEL)
+						freq = rtw_ieee80211_channel_to_frequency(pselect_network->Configuration.DSConfig, NL80211_BAND_2GHZ);
+					else
+						freq = rtw_ieee80211_channel_to_frequency(pselect_network->Configuration.DSConfig, NL80211_BAND_5GHZ);
+
+					notify_channel = ieee80211_get_channel(wiphy, freq);
+					pselect_bss = cfg80211_get_bss(wiphy, NULL/*notify_channel*/,
+								pselect_network->MacAddress, pselect_network->Ssid.Ssid,
+								pselect_network->Ssid.SsidLength, 0/*WLAN_CAPABILITY_ESS*/,
+								0/*WLAN_CAPABILITY_ESS*/);
+
+					if(pselect_bss)
+					{
+						DBG_871X("%s, got bss for cfg80211 for unlinking bss\n", __func__);
+
+						cfg80211_unlink_bss(wiphy, pselect_bss);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0)
+						cfg80211_put_bss(wiphy, pselect_bss);
+#else
+						cfg80211_put_bss(pselect_bss);
+#endif
+
+					}
+
+					goto exit;
+#endif
+				}
+			}
+		}
+	}
+	//_exit_critical_bh(&pwdev_priv->scan_req_lock, &irqL);
+
+	channel = pnetwork->network.Configuration.DSConfig;
+	if (channel <= RTW_CH_MAX_2G_CHANNEL)
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_2GHZ);
+	else
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_5GHZ);
+
+	notify_channel = ieee80211_get_channel(wiphy, freq);
+
+	//rtw_get_timestampe_from_ie()
+	notify_timestamp = jiffies_to_msecs(jiffies)*1000; /* uSec */
+
+	notify_interval = le16_to_cpu(*(u16*)rtw_get_beacon_interval_from_ie(pnetwork->network.IEs));
+	notify_capability = le16_to_cpu(*(u16*)rtw_get_capability_from_ie(pnetwork->network.IEs));
+
+
+	notify_ie = pnetwork->network.IEs+_FIXED_IE_LENGTH_;
+	notify_ielen = pnetwork->network.IELength-_FIXED_IE_LENGTH_;
+
+	//We've set wiphy's signal_type as CFG80211_SIGNAL_TYPE_MBM: signal strength in mBm (100*dBm)
+	if ( check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE &&
+		is_same_network(&pmlmepriv->cur_network.network, &pnetwork->network)) {
+		notify_signal = 100*translate_percentage_to_dbm(padapter->recvpriv.signal_strength);//dbm
+	} else {
+		notify_signal = 100*translate_percentage_to_dbm(pnetwork->network.PhyInfo.SignalStrength);//dbm
+	}
+
+/*
+	DBG_8192C("bssid: %2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X\n",
+                        pnetwork->network.MacAddress[0], pnetwork->network.MacAddress[1], pnetwork->network.MacAddress[2],
+                        pnetwork->network.MacAddress[3], pnetwork->network.MacAddress[4], pnetwork->network.MacAddress[5]);
+	DBG_8192C("Channel: %d(%d)\n", channel, freq);
+	DBG_8192C("Capability: %X\n", notify_capability);
+	DBG_8192C("Beacon interval: %d\n", notify_interval);
+	DBG_8192C("Signal: %d\n", notify_signal);
+	DBG_8192C("notify_timestamp: %#018llx\n", notify_timestamp);
+*/
+
+	buf = rtw_zmalloc(MAX_BSSINFO_LEN);
+	pbuf = buf;
+
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pbuf;
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	SetSeqNum(pwlanhdr, 0/*pmlmeext->mgnt_seq*/);
+	//pmlmeext->mgnt_seq++;
+
+	if (pnetwork->network.Reserved[0] == 1) { // WIFI_BEACON
+		_rtw_memcpy(pwlanhdr->addr1, bc_addr, ETH_ALEN);
+		SetFrameSubType(pbuf, WIFI_BEACON);
+	} else {
+		_rtw_memcpy(pwlanhdr->addr1, myid(&(padapter->eeprompriv)), ETH_ALEN);
+		SetFrameSubType(pbuf, WIFI_PROBERSP);
+	}
+
+	_rtw_memcpy(pwlanhdr->addr2, pnetwork->network.MacAddress, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, pnetwork->network.MacAddress, ETH_ALEN);
+
+
+	pbuf += sizeof(struct rtw_ieee80211_hdr_3addr);
+	len = sizeof (struct rtw_ieee80211_hdr_3addr);
+
+	_rtw_memcpy(pbuf, pnetwork->network.IEs, pnetwork->network.IELength);
+	len += pnetwork->network.IELength;
+
+	rtw_mfree(buf, MAX_BSSINFO_LEN);
+
+	//#ifdef CONFIG_P2P
+	//if(rtw_get_p2p_ie(pnetwork->network.IEs+12, pnetwork->network.IELength-12, NULL, NULL))
+	//{
+	//	DBG_8192C("%s, got p2p_ie\n", __func__);
+	//}
+	//#endif
+
+
+#if 1
+	bss = cfg80211_inform_bss_frame(wiphy, notify_channel, (struct ieee80211_mgmt *)buf,
+		len, notify_signal, GFP_ATOMIC);
+#else
+
+	bss = cfg80211_inform_bss(wiphy, notify_channel, (const u8 *)pnetwork->network.MacAddress,
+                notify_timestamp, notify_capability, notify_interval, notify_ie,
+                notify_ielen, notify_signal, GFP_ATOMIC/*GFP_KERNEL*/);
+#endif
+
+	if (unlikely(!bss)) {
+		DBG_8192C("rtw_cfg80211_inform_bss error\n");
+		return -EINVAL;
+	}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,38))
+#ifndef COMPAT_KERNEL_RELEASE
+	//patch for cfg80211, update beacon ies to information_elements
+	if (pnetwork->network.Reserved[0] == 1) { // WIFI_BEACON
+
+		 if(bss->len_information_elements != bss->len_beacon_ies)
+		 {
+			bss->information_elements = bss->beacon_ies;
+			bss->len_information_elements =  bss->len_beacon_ies;
+		 }
+	}
+#endif //COMPAT_KERNEL_RELEASE
+#endif //LINUX_VERSION_CODE < KERNEL_VERSION(2,6,38)
+
+/*
+	{
+		if( bss->information_elements == bss->proberesp_ies)
+		{
+			if( bss->len_information_elements !=  bss->len_proberesp_ies)
+			{
+				DBG_8192C("error!, len_information_elements !=  bss->len_proberesp_ies\n");
+			}
+
+		}
+		else if(bss->len_information_elements <  bss->len_beacon_ies)
+		{
+			bss->information_elements = bss->beacon_ies;
+			bss->len_information_elements =  bss->len_beacon_ies;
+		}
+	}
+*/
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0)
+	cfg80211_put_bss(wiphy, bss);
+#else
+	cfg80211_put_bss(bss);
+#endif
+
+exit:
+	return ret;
+
+}
+
+/*
+	Check the given bss is valid by kernel API cfg80211_get_bss()
+	@padapter : the given adapter
+
+	return _TRUE if bss is valid,  _FALSE for not found.
+*/
+int rtw_cfg80211_check_bss(_adapter *padapter)
+{
+	WLAN_BSSID_EX  *pnetwork = &(padapter->mlmeextpriv.mlmext_info.network);
+	struct cfg80211_bss *bss = NULL;
+	struct ieee80211_channel *notify_channel = NULL;
+	u32 freq;
+
+	if (!(pnetwork) || !(padapter->rtw_wdev))
+		return _FALSE;
+
+	if (pnetwork->Configuration.DSConfig <= RTW_CH_MAX_2G_CHANNEL)
+		freq = rtw_ieee80211_channel_to_frequency(pnetwork->Configuration.DSConfig, NL80211_BAND_2GHZ);
+	else
+		freq = rtw_ieee80211_channel_to_frequency(pnetwork->Configuration.DSConfig, NL80211_BAND_5GHZ);
+
+	notify_channel = ieee80211_get_channel(padapter->rtw_wdev->wiphy, freq);
+	bss = cfg80211_get_bss(padapter->rtw_wdev->wiphy, notify_channel,
+			pnetwork->MacAddress, pnetwork->Ssid.Ssid,
+			pnetwork->Ssid.SsidLength,
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 1, 0)
+			WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
+#else
+			IEEE80211_BSS_TYPE_ESS, IEEE80211_PRIVACY_ANY);
+#endif
+
+	return 	(bss!=NULL);
+}
+
+void rtw_cfg80211_indicate_connect(_adapter *padapter)
+{
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct wlan_network  *cur_network = &(pmlmepriv->cur_network);
+	struct wireless_dev *pwdev = padapter->rtw_wdev;
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+#endif
+	struct cfg80211_bss *bss = NULL;
+
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+	if (pwdev->iftype != NL80211_IFTYPE_STATION
+		#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+		&& pwdev->iftype != NL80211_IFTYPE_P2P_CLIENT
+		#endif
+	) {
+		return;
+	}
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+		return;
+
+#ifdef CONFIG_P2P
+	if(pwdinfo->driver_interface == DRIVER_CFG80211 )
+	{
+		if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		{
+			rtw_p2p_set_pre_state(pwdinfo, rtw_p2p_state(pwdinfo));
+			rtw_p2p_set_role(pwdinfo, P2P_ROLE_CLIENT);
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_OK);
+			DBG_8192C("%s, role=%d, p2p_state=%d, pre_p2p_state=%d\n", __func__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo), rtw_p2p_pre_state(pwdinfo));
+		}
+	}
+#endif //CONFIG_P2P
+
+	#ifdef CONFIG_LAYER2_ROAMING
+	if (rtw_to_roaming(padapter) > 0) {
+		#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39) || defined(COMPAT_KERNEL_RELEASE)
+		struct wiphy *wiphy = pwdev->wiphy;
+		struct ieee80211_channel *notify_channel;
+		u32 freq;
+		u16 channel = cur_network->network.Configuration.DSConfig;
+
+		if (channel <= RTW_CH_MAX_2G_CHANNEL)
+			freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_2GHZ);
+		else
+			freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_5GHZ);
+
+		notify_channel = ieee80211_get_channel(wiphy, freq);
+		#endif
+
+		DBG_871X("%s call cfg80211_roamed\n", __FUNCTION__);
+		#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)
+		{
+			struct cfg80211_roam_info roam_info = {
+				.channel = notify_channel,
+				.bssid = cur_network->network.MacAddress,
+				.req_ie = pmlmepriv->assoc_req+sizeof(struct rtw_ieee80211_hdr_3addr)+2,
+				.req_ie_len = pmlmepriv->assoc_req_len-sizeof(struct rtw_ieee80211_hdr_3addr)-2,
+				.resp_ie = pmlmepriv->assoc_rsp+sizeof(struct rtw_ieee80211_hdr_3addr)+6,
+				.resp_ie_len = pmlmepriv->assoc_rsp_len-sizeof(struct rtw_ieee80211_hdr_3addr)-6,
+			};
+			cfg80211_roamed(padapter->pnetdev, &roam_info, GFP_ATOMIC);
+		}
+		#else
+		cfg80211_roamed(padapter->pnetdev
+			#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)
+			, notify_channel
+			#endif
+			, cur_network->network.MacAddress
+			, pmlmepriv->assoc_req+sizeof(struct rtw_ieee80211_hdr_3addr)+2
+			, pmlmepriv->assoc_req_len-sizeof(struct rtw_ieee80211_hdr_3addr)-2
+			, pmlmepriv->assoc_rsp+sizeof(struct rtw_ieee80211_hdr_3addr)+6
+			, pmlmepriv->assoc_rsp_len-sizeof(struct rtw_ieee80211_hdr_3addr)-6
+			, GFP_ATOMIC);
+		#endif
+	}
+	else
+	#endif
+	{
+		DBG_8192C("pwdev->sme_state(b)=%d\n", pwdev->sme_state);
+		cfg80211_connect_result(padapter->pnetdev, cur_network->network.MacAddress
+			, pmlmepriv->assoc_req+sizeof(struct rtw_ieee80211_hdr_3addr)+2
+			, pmlmepriv->assoc_req_len-sizeof(struct rtw_ieee80211_hdr_3addr)-2
+			, pmlmepriv->assoc_rsp+sizeof(struct rtw_ieee80211_hdr_3addr)+6
+			, pmlmepriv->assoc_rsp_len-sizeof(struct rtw_ieee80211_hdr_3addr)-6
+			, WLAN_STATUS_SUCCESS, GFP_ATOMIC);
+		DBG_8192C("pwdev->sme_state(a)=%d\n", pwdev->sme_state);
+	}
+}
+
+void rtw_cfg80211_indicate_disconnect(_adapter *padapter)
+{
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct wireless_dev *pwdev = padapter->rtw_wdev;
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+#endif
+
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+
+	if (pwdev->iftype != NL80211_IFTYPE_STATION
+		#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+		&& pwdev->iftype != NL80211_IFTYPE_P2P_CLIENT
+		#endif
+	) {
+		return;
+	}
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+		return;
+
+#ifdef CONFIG_P2P
+	if( pwdinfo->driver_interface == DRIVER_CFG80211 )
+	{
+		if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		{
+			_cancel_timer_ex( &pwdinfo->find_phase_timer );
+			_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+			_cancel_timer_ex( &pwdinfo->pre_tx_scan_timer);
+
+			rtw_p2p_set_state(pwdinfo, rtw_p2p_pre_state(pwdinfo));
+			rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+
+			DBG_8192C("%s, role=%d, p2p_state=%d, pre_p2p_state=%d\n", __func__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo), rtw_p2p_pre_state(pwdinfo));
+		}
+	}
+#endif //CONFIG_P2P
+
+	if (!padapter->mlmepriv.not_indic_disco) {
+		DBG_8192C("pwdev->sme_state(b)=%d\n", pwdev->sme_state);
+
+		if (check_fwstate(pmlmepriv, WIFI_UNDER_LINKING)) {
+			cfg80211_connect_result(padapter->pnetdev, NULL, NULL, 0, NULL, 0,
+				WLAN_STATUS_UNSPECIFIED_FAILURE, GFP_ATOMIC/*GFP_KERNEL*/);
+		} else {
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4,2,0)
+			cfg80211_disconnected(padapter->pnetdev, 0, NULL, 0, GFP_ATOMIC);
+#else
+			cfg80211_disconnected(padapter->pnetdev, 0, NULL, 0, false, GFP_ATOMIC);
+#endif
+        }
+
+		DBG_8192C("pwdev->sme_state(a)=%d\n", pwdev->sme_state);
+	}
+}
+
+
+#ifdef CONFIG_AP_MODE
+static u8 set_pairwise_key(_adapter *padapter, struct sta_info *psta)
+{
+	struct cmd_obj*			ph2c;
+	struct set_stakey_parm	*psetstakey_para;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if ( ph2c == NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	psetstakey_para = (struct set_stakey_parm*)rtw_zmalloc(sizeof(struct set_stakey_parm));
+	if(psetstakey_para==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct cmd_obj));
+		res=_FAIL;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, psetstakey_para, _SetStaKey_CMD_);
+
+
+	psetstakey_para->algorithm = (u8)psta->dot118021XPrivacy;
+
+	_rtw_memcpy(psetstakey_para->addr, psta->hwaddr, ETH_ALEN);
+
+	_rtw_memcpy(psetstakey_para->key, &psta->dot118021x_UncstKey, 16);
+
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+exit:
+
+	return res;
+
+}
+
+static int set_group_key(_adapter *padapter, u8 *key, u8 alg, int keyid)
+{
+	u8 keylen;
+	struct cmd_obj* pcmd;
+	struct setkey_parm *psetkeyparm;
+	struct cmd_priv	*pcmdpriv=&(padapter->cmdpriv);
+	int res=_SUCCESS;
+
+	DBG_8192C("%s\n", __FUNCTION__);
+
+	pcmd = (struct cmd_obj*)rtw_zmalloc(sizeof(struct	cmd_obj));
+	if(pcmd==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+	psetkeyparm=(struct setkey_parm*)rtw_zmalloc(sizeof(struct setkey_parm));
+	if(psetkeyparm==NULL){
+		rtw_mfree((unsigned char *)pcmd, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	_rtw_memset(psetkeyparm, 0, sizeof(struct setkey_parm));
+
+	psetkeyparm->keyid=(u8)keyid;
+	if (is_wep_enc(alg))
+		padapter->securitypriv.key_mask |= BIT(psetkeyparm->keyid);
+
+	psetkeyparm->algorithm = alg;
+
+	psetkeyparm->set_tx = 1;
+
+	switch(alg)
+	{
+		case _WEP40_:
+			keylen = 5;
+			break;
+		case _WEP104_:
+			keylen = 13;
+			break;
+		case _TKIP_:
+		case _TKIP_WTMIC_:
+		case _AES_:
+			keylen = 16;
+			break;
+		default:
+			keylen = 16;
+	}
+
+	_rtw_memcpy(&(psetkeyparm->key[0]), key, keylen);
+
+	pcmd->cmdcode = _SetKey_CMD_;
+	pcmd->parmbuf = (u8 *)psetkeyparm;
+	pcmd->cmdsz =  (sizeof(struct setkey_parm));
+	pcmd->rsp = NULL;
+	pcmd->rspsz = 0;
+
+
+	_rtw_init_listhead(&pcmd->list);
+
+	res = rtw_enqueue_cmd(pcmdpriv, pcmd);
+
+exit:
+
+	return res;
+
+
+}
+
+static int set_wep_key(_adapter *padapter, u8 *key, u8 keylen, int keyid)
+{
+	u8 alg;
+
+	switch(keylen)
+	{
+		case 5:
+			alg =_WEP40_;
+			break;
+		case 13:
+			alg =_WEP104_;
+			break;
+		default:
+			alg =_NO_PRIVACY_;
+	}
+
+	return set_group_key(padapter, key, alg, keyid);
+
+}
+
+static int rtw_cfg80211_ap_set_encryption(struct net_device *dev, struct ieee_param *param, u32 param_len)
+{
+	int ret = 0;
+	u32 wep_key_idx, wep_key_len,wep_total_len;
+	struct sta_info *psta = NULL, *pbcmc_sta = NULL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv 	*pmlmepriv = &padapter->mlmepriv;
+	struct security_priv* psecuritypriv=&(padapter->securitypriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	DBG_8192C("%s\n", __FUNCTION__);
+
+	param->u.crypt.err = 0;
+	param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN - 1] = '\0';
+
+	//sizeof(struct ieee_param) = 64 bytes;
+	//if (param_len !=  (u32) ((u8 *) param->u.crypt.key - (u8 *) param) + param->u.crypt.key_len)
+	if (param_len !=  sizeof(struct ieee_param) + param->u.crypt.key_len)
+	{
+		ret =  -EINVAL;
+		goto exit;
+	}
+
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff)
+	{
+		if (param->u.crypt.idx >= WEP_KEYS)
+		{
+			ret = -EINVAL;
+			goto exit;
+		}
+	}
+	else
+	{
+		psta = rtw_get_stainfo(pstapriv, param->sta_addr);
+		if(!psta)
+		{
+			//ret = -EINVAL;
+			DBG_8192C("rtw_set_encryption(), sta has already been removed or never been added\n");
+			goto exit;
+		}
+	}
+
+	if (strcmp(param->u.crypt.alg, "none") == 0 && (psta==NULL))
+	{
+		//todo:clear default encryption keys
+
+		DBG_8192C("clear default encryption keys, keyid=%d\n", param->u.crypt.idx);
+
+		goto exit;
+	}
+
+
+	if (strcmp(param->u.crypt.alg, "WEP") == 0 && (psta==NULL))
+	{
+		DBG_8192C("r871x_set_encryption, crypt.alg = WEP\n");
+
+		wep_key_idx = param->u.crypt.idx;
+		wep_key_len = param->u.crypt.key_len;
+
+		DBG_8192C("r871x_set_encryption, wep_key_idx=%d, len=%d\n", wep_key_idx, wep_key_len);
+
+		if((wep_key_idx >= WEP_KEYS) || (wep_key_len<=0))
+		{
+			ret = -EINVAL;
+			goto exit;
+		}
+
+		if (wep_key_len > 0)
+		{
+			wep_key_len = wep_key_len <= 5 ? 5 : 13;
+		}
+
+		if (psecuritypriv->bWepDefaultKeyIdxSet == 0)
+		{
+			//wep default key has not been set, so use this key index as default key.
+
+			psecuritypriv->ndisencryptstatus = Ndis802_11Encryption1Enabled;
+			psecuritypriv->dot11PrivacyAlgrthm=_WEP40_;
+			psecuritypriv->dot118021XGrpPrivacy=_WEP40_;
+
+			if(wep_key_len == 13)
+			{
+				psecuritypriv->dot11PrivacyAlgrthm=_WEP104_;
+				psecuritypriv->dot118021XGrpPrivacy=_WEP104_;
+			}
+
+			psecuritypriv->dot11PrivacyKeyIndex = wep_key_idx;
+		}
+
+		_rtw_memcpy(&(psecuritypriv->dot11DefKey[wep_key_idx].skey[0]), param->u.crypt.key, wep_key_len);
+
+		psecuritypriv->dot11DefKeylen[wep_key_idx] = wep_key_len;
+
+		set_wep_key(padapter, param->u.crypt.key, wep_key_len, wep_key_idx);
+
+		goto exit;
+
+	}
+
+
+	if(!psta && check_fwstate(pmlmepriv, WIFI_AP_STATE)) // //group key
+	{
+		if(param->u.crypt.set_tx == 0) //group key
+		{
+			if(strcmp(param->u.crypt.alg, "WEP") == 0)
+			{
+				DBG_8192C("%s, set group_key, WEP\n", __FUNCTION__);
+
+				_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+
+				psecuritypriv->dot118021XGrpPrivacy = _WEP40_;
+				if(param->u.crypt.key_len==13)
+				{
+						psecuritypriv->dot118021XGrpPrivacy = _WEP104_;
+				}
+
+			}
+			else if(strcmp(param->u.crypt.alg, "TKIP") == 0)
+			{
+				DBG_8192C("%s, set group_key, TKIP\n", __FUNCTION__);
+
+				psecuritypriv->dot118021XGrpPrivacy = _TKIP_;
+
+				_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+
+				//DEBUG_ERR("set key length :param->u.crypt.key_len=%d\n", param->u.crypt.key_len);
+				//set mic key
+				_rtw_memcpy(psecuritypriv->dot118021XGrptxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[16]), 8);
+				_rtw_memcpy(psecuritypriv->dot118021XGrprxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[24]), 8);
+
+				psecuritypriv->busetkipkey = _TRUE;
+
+			}
+			else if(strcmp(param->u.crypt.alg, "CCMP") == 0)
+			{
+				DBG_8192C("%s, set group_key, CCMP\n", __FUNCTION__);
+
+				psecuritypriv->dot118021XGrpPrivacy = _AES_;
+
+				_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+			}
+			else
+			{
+				DBG_8192C("%s, set group_key, none\n", __FUNCTION__);
+
+				psecuritypriv->dot118021XGrpPrivacy = _NO_PRIVACY_;
+			}
+
+			psecuritypriv->dot118021XGrpKeyid = param->u.crypt.idx;
+
+			psecuritypriv->binstallGrpkey = _TRUE;
+
+			psecuritypriv->dot11PrivacyAlgrthm = psecuritypriv->dot118021XGrpPrivacy;//!!!
+
+			set_group_key(padapter, param->u.crypt.key, psecuritypriv->dot118021XGrpPrivacy, param->u.crypt.idx);
+
+			pbcmc_sta=rtw_get_bcmc_stainfo(padapter);
+			if(pbcmc_sta)
+			{
+				pbcmc_sta->ieee8021x_blocked = _FALSE;
+				pbcmc_sta->dot118021XPrivacy= psecuritypriv->dot118021XGrpPrivacy;//rx will use bmc_sta's dot118021XPrivacy
+			}
+
+		}
+
+		goto exit;
+
+	}
+
+	if(psecuritypriv->dot11AuthAlgrthm == dot11AuthAlgrthm_8021X && psta) // psk/802_1x
+	{
+		if(check_fwstate(pmlmepriv, WIFI_AP_STATE))
+		{
+			if(param->u.crypt.set_tx ==1) //pairwise key
+			{
+				_rtw_memcpy(psta->dot118021x_UncstKey.skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+
+				if(strcmp(param->u.crypt.alg, "WEP") == 0)
+				{
+					DBG_8192C("%s, set pairwise key, WEP\n", __FUNCTION__);
+
+					psta->dot118021XPrivacy = _WEP40_;
+					if(param->u.crypt.key_len==13)
+					{
+						psta->dot118021XPrivacy = _WEP104_;
+					}
+				}
+				else if(strcmp(param->u.crypt.alg, "TKIP") == 0)
+				{
+					DBG_8192C("%s, set pairwise key, TKIP\n", __FUNCTION__);
+
+					psta->dot118021XPrivacy = _TKIP_;
+
+					//DEBUG_ERR("set key length :param->u.crypt.key_len=%d\n", param->u.crypt.key_len);
+					//set mic key
+					_rtw_memcpy(psta->dot11tkiptxmickey.skey, &(param->u.crypt.key[16]), 8);
+					_rtw_memcpy(psta->dot11tkiprxmickey.skey, &(param->u.crypt.key[24]), 8);
+
+					psecuritypriv->busetkipkey = _TRUE;
+
+				}
+				else if(strcmp(param->u.crypt.alg, "CCMP") == 0)
+				{
+
+					DBG_8192C("%s, set pairwise key, CCMP\n", __FUNCTION__);
+
+					psta->dot118021XPrivacy = _AES_;
+				}
+				else
+				{
+					DBG_8192C("%s, set pairwise key, none\n", __FUNCTION__);
+
+					psta->dot118021XPrivacy = _NO_PRIVACY_;
+				}
+
+				set_pairwise_key(padapter, psta);
+
+				psta->ieee8021x_blocked = _FALSE;
+
+				psta->bpairwise_key_installed = _TRUE;
+
+			}
+			else//group key???
+			{
+				if(strcmp(param->u.crypt.alg, "WEP") == 0)
+				{
+					_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+
+					psecuritypriv->dot118021XGrpPrivacy = _WEP40_;
+					if(param->u.crypt.key_len==13)
+					{
+						psecuritypriv->dot118021XGrpPrivacy = _WEP104_;
+					}
+				}
+				else if(strcmp(param->u.crypt.alg, "TKIP") == 0)
+				{
+					psecuritypriv->dot118021XGrpPrivacy = _TKIP_;
+
+					_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+
+					//DEBUG_ERR("set key length :param->u.crypt.key_len=%d\n", param->u.crypt.key_len);
+					//set mic key
+					_rtw_memcpy(psecuritypriv->dot118021XGrptxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[16]), 8);
+					_rtw_memcpy(psecuritypriv->dot118021XGrprxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[24]), 8);
+
+					psecuritypriv->busetkipkey = _TRUE;
+
+				}
+				else if(strcmp(param->u.crypt.alg, "CCMP") == 0)
+				{
+					psecuritypriv->dot118021XGrpPrivacy = _AES_;
+
+					_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+				}
+				else
+				{
+					psecuritypriv->dot118021XGrpPrivacy = _NO_PRIVACY_;
+				}
+
+				psecuritypriv->dot118021XGrpKeyid = param->u.crypt.idx;
+
+				psecuritypriv->binstallGrpkey = _TRUE;
+
+				psecuritypriv->dot11PrivacyAlgrthm = psecuritypriv->dot118021XGrpPrivacy;//!!!
+
+				set_group_key(padapter, param->u.crypt.key, psecuritypriv->dot118021XGrpPrivacy, param->u.crypt.idx);
+
+				pbcmc_sta=rtw_get_bcmc_stainfo(padapter);
+				if(pbcmc_sta)
+				{
+					pbcmc_sta->ieee8021x_blocked = _FALSE;
+					pbcmc_sta->dot118021XPrivacy= psecuritypriv->dot118021XGrpPrivacy;//rx will use bmc_sta's dot118021XPrivacy
+				}
+
+			}
+
+		}
+
+	}
+
+exit:
+
+	return ret;
+
+}
+#endif
+
+static int rtw_cfg80211_set_encryption(struct net_device *dev, struct ieee_param *param, u32 param_len)
+{
+	int ret = 0;
+	u32 wep_key_idx, wep_key_len,wep_total_len;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv 	*pmlmepriv = &padapter->mlmepriv;
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+#ifdef CONFIG_P2P
+	struct wifidirect_info* pwdinfo = &padapter->wdinfo;
+#endif //CONFIG_P2P
+
+_func_enter_;
+
+	DBG_8192C("%s\n", __func__);
+
+	param->u.crypt.err = 0;
+	param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN - 1] = '\0';
+
+	if (param_len < (u32) ((u8 *) param->u.crypt.key - (u8 *) param) + param->u.crypt.key_len)
+	{
+		ret =  -EINVAL;
+		goto exit;
+	}
+
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff)
+	{
+		if (param->u.crypt.idx >= WEP_KEYS
+#ifdef CONFIG_IEEE80211W
+			&& param->u.crypt.idx > BIP_MAX_KEYID
+#endif //CONFIG_IEEE80211W
+		)
+		{
+			ret = -EINVAL;
+			goto exit;
+		}
+	} else {
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	if (strcmp(param->u.crypt.alg, "WEP") == 0)
+	{
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("wpa_set_encryption, crypt.alg = WEP\n"));
+		DBG_8192C("wpa_set_encryption, crypt.alg = WEP\n");
+
+		wep_key_idx = param->u.crypt.idx;
+		wep_key_len = param->u.crypt.key_len;
+
+		if ((wep_key_idx > WEP_KEYS) || (wep_key_len <= 0))
+		{
+			ret = -EINVAL;
+			goto exit;
+		}
+
+		if (psecuritypriv->bWepDefaultKeyIdxSet == 0)
+		{
+			//wep default key has not been set, so use this key index as default key.
+
+			wep_key_len = wep_key_len <= 5 ? 5 : 13;
+
+		psecuritypriv->ndisencryptstatus = Ndis802_11Encryption1Enabled;
+			psecuritypriv->dot11PrivacyAlgrthm = _WEP40_;
+			psecuritypriv->dot118021XGrpPrivacy = _WEP40_;
+
+			if(wep_key_len==13)
+			{
+				psecuritypriv->dot11PrivacyAlgrthm = _WEP104_;
+				psecuritypriv->dot118021XGrpPrivacy = _WEP104_;
+			}
+
+			psecuritypriv->dot11PrivacyKeyIndex = wep_key_idx;
+		}
+
+		_rtw_memcpy(&(psecuritypriv->dot11DefKey[wep_key_idx].skey[0]), param->u.crypt.key, wep_key_len);
+
+		psecuritypriv->dot11DefKeylen[wep_key_idx] = wep_key_len;
+
+		rtw_set_key(padapter, psecuritypriv, wep_key_idx, 0);
+
+		goto exit;
+	}
+
+	if(padapter->securitypriv.dot11AuthAlgrthm == dot11AuthAlgrthm_8021X) // 802_1x
+	{
+		struct sta_info * psta,*pbcmc_sta;
+		struct sta_priv * pstapriv = &padapter->stapriv;
+
+		//DBG_8192C("%s, : dot11AuthAlgrthm == dot11AuthAlgrthm_8021X \n", __func__);
+
+		if (check_fwstate(pmlmepriv, WIFI_STATION_STATE | WIFI_MP_STATE) == _TRUE) //sta mode
+		{
+			psta = rtw_get_stainfo(pstapriv, get_bssid(pmlmepriv));
+			if (psta == NULL) {
+				//DEBUG_ERR( ("Set wpa_set_encryption: Obtain Sta_info fail \n"));
+				DBG_8192C("%s, : Obtain Sta_info fail \n", __func__);
+			}
+			else
+			{
+				//Jeff: don't disable ieee8021x_blocked while clearing key
+				if (strcmp(param->u.crypt.alg, "none") != 0)
+					psta->ieee8021x_blocked = _FALSE;
+
+
+				if((padapter->securitypriv.ndisencryptstatus == Ndis802_11Encryption2Enabled)||
+						(padapter->securitypriv.ndisencryptstatus ==  Ndis802_11Encryption3Enabled))
+				{
+					psta->dot118021XPrivacy = padapter->securitypriv.dot11PrivacyAlgrthm;
+				}
+
+				if(param->u.crypt.set_tx ==1)//pairwise key
+				{
+
+					DBG_8192C("%s, : param->u.crypt.set_tx ==1 \n", __func__);
+
+					_rtw_memcpy(psta->dot118021x_UncstKey.skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+
+					if(strcmp(param->u.crypt.alg, "TKIP") == 0)//set mic key
+					{
+						//DEBUG_ERR(("\nset key length :param->u.crypt.key_len=%d\n", param->u.crypt.key_len));
+						_rtw_memcpy(psta->dot11tkiptxmickey.skey, &(param->u.crypt.key[16]), 8);
+						_rtw_memcpy(psta->dot11tkiprxmickey.skey, &(param->u.crypt.key[24]), 8);
+
+						padapter->securitypriv.busetkipkey=_FALSE;
+						//_set_timer(&padapter->securitypriv.tkip_timer, 50);
+					}
+
+					//DEBUG_ERR((" param->u.crypt.key_len=%d\n",param->u.crypt.key_len));
+					DBG_871X(" ~~~~set sta key:unicastkey\n");
+
+					rtw_setstakey_cmd(padapter, (unsigned char *)psta, _TRUE);
+				}
+				else//group key
+				{
+					if(strcmp(param->u.crypt.alg, "TKIP") == 0 || strcmp(param->u.crypt.alg, "CCMP") == 0)
+					{
+						_rtw_memcpy(padapter->securitypriv.dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key,(param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+						_rtw_memcpy(padapter->securitypriv.dot118021XGrptxmickey[param->u.crypt.idx].skey,&(param->u.crypt.key[16]),8);
+						_rtw_memcpy(padapter->securitypriv.dot118021XGrprxmickey[param->u.crypt.idx].skey,&(param->u.crypt.key[24]),8);
+	                                        padapter->securitypriv.binstallGrpkey = _TRUE;
+						//DEBUG_ERR((" param->u.crypt.key_len=%d\n", param->u.crypt.key_len));
+						DBG_871X(" ~~~~set sta key:groupkey\n");
+
+						padapter->securitypriv.dot118021XGrpKeyid = param->u.crypt.idx;
+
+						rtw_set_key(padapter,&padapter->securitypriv,param->u.crypt.idx, 1);
+					}
+#ifdef CONFIG_IEEE80211W
+					else if(strcmp(param->u.crypt.alg, "BIP") == 0)
+					{
+						int no;
+						//DBG_871X("BIP key_len=%d , index=%d @@@@@@@@@@@@@@@@@@\n", param->u.crypt.key_len, param->u.crypt.idx);
+						//save the IGTK key, length 16 bytes
+						_rtw_memcpy(padapter->securitypriv.dot11wBIPKey[param->u.crypt.idx].skey,  param->u.crypt.key,(param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+						/*DBG_871X("IGTK key below:\n");
+						for(no=0;no<16;no++)
+							printk(" %02x ", padapter->securitypriv.dot11wBIPKey[param->u.crypt.idx].skey[no]);
+						DBG_871X("\n");*/
+						padapter->securitypriv.dot11wBIPKeyid = param->u.crypt.idx;
+						padapter->securitypriv.binstallBIPkey = _TRUE;
+						DBG_871X(" ~~~~set sta key:IGKT\n");
+					}
+#endif //CONFIG_IEEE80211W
+
+#ifdef CONFIG_P2P
+					if(pwdinfo->driver_interface == DRIVER_CFG80211 )
+					{
+						if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_PROVISIONING_ING))
+						{
+							rtw_p2p_set_state(pwdinfo, P2P_STATE_PROVISIONING_DONE);
+						}
+					}
+#endif //CONFIG_P2P
+
+				}
+			}
+
+			pbcmc_sta=rtw_get_bcmc_stainfo(padapter);
+			if(pbcmc_sta==NULL)
+			{
+				//DEBUG_ERR( ("Set OID_802_11_ADD_KEY: bcmc stainfo is null \n"));
+			}
+			else
+			{
+				//Jeff: don't disable ieee8021x_blocked while clearing key
+				if (strcmp(param->u.crypt.alg, "none") != 0)
+					pbcmc_sta->ieee8021x_blocked = _FALSE;
+
+				if((padapter->securitypriv.ndisencryptstatus == Ndis802_11Encryption2Enabled)||
+						(padapter->securitypriv.ndisencryptstatus ==  Ndis802_11Encryption3Enabled))
+				{
+					pbcmc_sta->dot118021XPrivacy = padapter->securitypriv.dot11PrivacyAlgrthm;
+				}
+			}
+		}
+		else if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) //adhoc mode
+		{
+		}
+	}
+
+exit:
+
+	DBG_8192C("%s, ret=%d\n", __func__, ret);
+
+	_func_exit_;
+
+	return ret;
+}
+
+static int cfg80211_rtw_add_key(struct wiphy *wiphy, struct net_device *ndev,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+				u8 key_index, bool pairwise, const u8 *mac_addr,
+#else	// (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+				u8 key_index, const u8 *mac_addr,
+#endif	// (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+				struct key_params *params)
+{
+	char *alg_name;
+	u32 param_len;
+	struct ieee_param *param = NULL;
+	int ret=0;
+	struct wireless_dev *rtw_wdev = wiphy_to_wdev(wiphy);
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+	DBG_871X(FUNC_NDEV_FMT" adding key for %pM\n", FUNC_NDEV_ARG(ndev), mac_addr);
+	DBG_871X("cipher=0x%x\n", params->cipher);
+	DBG_871X("key_len=0x%x\n", params->key_len);
+	DBG_871X("seq_len=0x%x\n", params->seq_len);
+	DBG_871X("key_index=%d\n", key_index);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+	DBG_871X("pairwise=%d\n", pairwise);
+#endif	// (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+
+	param_len = sizeof(struct ieee_param) + params->key_len;
+	param = (struct ieee_param *)rtw_malloc(param_len);
+	if (param == NULL)
+		return -1;
+
+	_rtw_memset(param, 0, param_len);
+
+	param->cmd = IEEE_CMD_SET_ENCRYPTION;
+	_rtw_memset(param->sta_addr, 0xff, ETH_ALEN);
+
+	switch (params->cipher) {
+	case IW_AUTH_CIPHER_NONE:
+		//todo: remove key
+		//remove = 1;
+		alg_name = "none";
+		break;
+	case WLAN_CIPHER_SUITE_WEP40:
+	case WLAN_CIPHER_SUITE_WEP104:
+		alg_name = "WEP";
+		break;
+	case WLAN_CIPHER_SUITE_TKIP:
+		alg_name = "TKIP";
+		break;
+	case WLAN_CIPHER_SUITE_CCMP:
+		alg_name = "CCMP";
+		break;
+#ifdef CONFIG_IEEE80211W
+	case WLAN_CIPHER_SUITE_AES_CMAC:
+		alg_name = "BIP";
+		break;
+#endif //CONFIG_IEEE80211W
+	default:
+		return -ENOTSUPP;
+	}
+
+	strncpy((char *)param->u.crypt.alg, alg_name, IEEE_CRYPT_ALG_NAME_LEN);
+
+
+	if (!mac_addr || is_broadcast_ether_addr(mac_addr))
+	{
+		param->u.crypt.set_tx = 0; //for wpa/wpa2 group key
+	} else {
+		param->u.crypt.set_tx = 1; //for wpa/wpa2 pairwise key
+	}
+
+
+	//param->u.crypt.idx = key_index - 1;
+	param->u.crypt.idx = key_index;
+
+	if (params->seq_len && params->seq)
+	{
+		_rtw_memcpy(param->u.crypt.seq, params->seq, params->seq_len);
+	}
+
+	if(params->key_len && params->key)
+	{
+		param->u.crypt.key_len = params->key_len;
+		_rtw_memcpy(param->u.crypt.key, params->key, params->key_len);
+	}
+
+	if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE)
+	{
+		ret =  rtw_cfg80211_set_encryption(ndev, param, param_len);
+	}
+	else if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+#ifdef CONFIG_AP_MODE
+		if(mac_addr)
+			_rtw_memcpy(param->sta_addr, (void*)mac_addr, ETH_ALEN);
+
+		ret = rtw_cfg80211_ap_set_encryption(ndev, param, param_len);
+#endif
+	}
+	else
+	{
+		DBG_8192C("error! fw_state=0x%x, iftype=%d\n", pmlmepriv->fw_state, rtw_wdev->iftype);
+
+	}
+
+	if(param)
+	{
+		rtw_mfree((u8*)param, param_len);
+	}
+
+	return ret;
+
+}
+
+static int cfg80211_rtw_get_key(struct wiphy *wiphy, struct net_device *ndev,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+				u8 key_index, bool pairwise, const u8 *mac_addr,
+#else	// (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+				u8 key_index, const u8 *mac_addr,
+#endif	// (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+				void *cookie,
+				void (*callback)(void *cookie,
+						 struct key_params*))
+{
+#if 0
+	struct iwm_priv *iwm = ndev_to_iwm(ndev);
+	struct iwm_key *key = &iwm->keys[key_index];
+	struct key_params params;
+
+	IWM_DBG_WEXT(iwm, DBG, "Getting key %d\n", key_index);
+
+	memset(&params, 0, sizeof(params));
+
+	params.cipher = key->cipher;
+	params.key_len = key->key_len;
+	params.seq_len = key->seq_len;
+	params.seq = key->seq;
+	params.key = key->key;
+
+	callback(cookie, &params);
+
+	return key->key_len ? 0 : -ENOENT;
+#endif
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	return 0;
+}
+
+static int cfg80211_rtw_del_key(struct wiphy *wiphy, struct net_device *ndev,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+				u8 key_index, bool pairwise, const u8 *mac_addr)
+#else	// (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+				u8 key_index, const u8 *mac_addr)
+#endif	// (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(ndev);
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+
+	DBG_871X(FUNC_NDEV_FMT" key_index=%d\n", FUNC_NDEV_ARG(ndev), key_index);
+
+	if (key_index == psecuritypriv->dot11PrivacyKeyIndex)
+	{
+		//clear the flag of wep default key set.
+		psecuritypriv->bWepDefaultKeyIdxSet = 0;
+	}
+
+	return 0;
+}
+
+static int cfg80211_rtw_set_default_key(struct wiphy *wiphy,
+	struct net_device *ndev, u8 key_index
+	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)) || defined(COMPAT_KERNEL_RELEASE)
+	, bool unicast, bool multicast
+	#endif
+	)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(ndev);
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+
+		DBG_871X(FUNC_NDEV_FMT" key_index=%d"
+		#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)) || defined(COMPAT_KERNEL_RELEASE)
+		", unicast=%d, multicast=%d"
+		#endif
+		".\n", FUNC_NDEV_ARG(ndev), key_index
+		#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)) || defined(COMPAT_KERNEL_RELEASE)
+		, unicast, multicast
+		#endif
+		);
+
+	if ((key_index < WEP_KEYS) && ((psecuritypriv->dot11PrivacyAlgrthm == _WEP40_) || (psecuritypriv->dot11PrivacyAlgrthm == _WEP104_))) //set wep default key
+	{
+		psecuritypriv->ndisencryptstatus = Ndis802_11Encryption1Enabled;
+
+		psecuritypriv->dot11PrivacyKeyIndex = key_index;
+
+		psecuritypriv->dot11PrivacyAlgrthm = _WEP40_;
+		psecuritypriv->dot118021XGrpPrivacy = _WEP40_;
+		if (psecuritypriv->dot11DefKeylen[key_index] == 13)
+		{
+			psecuritypriv->dot11PrivacyAlgrthm = _WEP104_;
+			psecuritypriv->dot118021XGrpPrivacy = _WEP104_;
+		}
+
+		psecuritypriv->bWepDefaultKeyIdxSet = 1; //set the flag to represent that wep default key has been set
+	}
+
+	return 0;
+
+}
+
+static int cfg80211_rtw_get_station(struct wiphy *wiphy,
+				    struct net_device *ndev,
+				    const u8 *mac, struct station_info *sinfo)
+{
+	int ret = 0;
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct sta_info *psta = NULL;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	sinfo->filled = 0;
+
+	if (!mac) {
+		DBG_871X(FUNC_NDEV_FMT" mac==%p\n", FUNC_NDEV_ARG(ndev), mac);
+		ret = -ENOENT;
+		goto exit;
+	}
+
+	psta = rtw_get_stainfo(pstapriv, mac);
+	if (psta == NULL) {
+		DBG_8192C("%s, sta_info is null\n", __func__);
+		ret = -ENOENT;
+		goto exit;
+	}
+
+#ifdef CONFIG_DEBUG_CFG80211
+	DBG_871X(FUNC_NDEV_FMT" mac="MAC_FMT"\n", FUNC_NDEV_ARG(ndev), MAC_ARG(mac));
+#endif
+
+	//for infra./P2PClient mode
+	if(	check_fwstate(pmlmepriv, WIFI_STATION_STATE)
+		&& check_fwstate(pmlmepriv, _FW_LINKED)
+	)
+	{
+		struct wlan_network  *cur_network = &(pmlmepriv->cur_network);
+
+		if (_rtw_memcmp(mac, cur_network->network.MacAddress, ETH_ALEN) == _FALSE) {
+			DBG_871X("%s, mismatch bssid="MAC_FMT"\n", __func__, MAC_ARG(cur_network->network.MacAddress));
+			ret = -ENOENT;
+			goto exit;
+		}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,0,0))
+		sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
+#else
+		sinfo->filled |= STATION_INFO_SIGNAL;
+#endif
+		sinfo->signal = translate_percentage_to_dbm(padapter->recvpriv.signal_strength);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,0,0))
+		sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
+#else
+		sinfo->filled |= STATION_INFO_TX_BITRATE;
+#endif
+		sinfo->txrate.legacy = rtw_get_cur_max_rate(padapter);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,0,0))
+		sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS);
+#else
+		sinfo->filled |= STATION_INFO_RX_PACKETS;
+#endif
+		sinfo->rx_packets = sta_rx_data_pkts(psta);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,0,0))
+		sinfo->filled |= BIT(NL80211_STA_INFO_TX_PACKETS);
+#else
+		sinfo->filled |= STATION_INFO_TX_PACKETS;
+#endif
+		sinfo->tx_packets = psta->sta_stats.tx_pkts;
+
+	}
+
+	//for Ad-Hoc/AP mode
+	if ((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)
+			||check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)
+			||check_fwstate(pmlmepriv, WIFI_AP_STATE))
+		&& check_fwstate(pmlmepriv, _FW_LINKED)
+	)
+	{
+		//TODO: should acquire station info...
+	}
+
+exit:
+	return ret;
+}
+
+extern int netdev_open(struct net_device *pnetdev);
+#ifdef CONFIG_CONCURRENT_MODE
+extern int netdev_if2_open(struct net_device *pnetdev);
+#endif
+
+/*
+enum nl80211_iftype {
+	NL80211_IFTYPE_UNSPECIFIED,
+       NL80211_IFTYPE_ADHOC, //1
+       NL80211_IFTYPE_STATION, //2
+       NL80211_IFTYPE_AP, //3
+       NL80211_IFTYPE_AP_VLAN,
+       NL80211_IFTYPE_WDS,
+       NL80211_IFTYPE_MONITOR, //6
+       NL80211_IFTYPE_MESH_POINT,
+       NL80211_IFTYPE_P2P_CLIENT, //8
+	NL80211_IFTYPE_P2P_GO, //9
+       //keep last
+       NUM_NL80211_IFTYPES,
+       NL80211_IFTYPE_MAX = NUM_NL80211_IFTYPES - 1
+};
+*/
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)
+static int cfg80211_rtw_change_iface(struct wiphy *wiphy,
+				     struct net_device *ndev,
+				     enum nl80211_iftype type,
+				     struct vif_params *params)
+#else
+static int cfg80211_rtw_change_iface(struct wiphy *wiphy,
+				     struct net_device *ndev,
+				     enum nl80211_iftype type, u32 *flags,
+				     struct vif_params *params)
+#endif
+{
+	enum nl80211_iftype old_type;
+	NDIS_802_11_NETWORK_INFRASTRUCTURE networkType ;
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct wireless_dev *rtw_wdev = wiphy_to_wdev(wiphy);
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	_irqL irqL;
+	_queue *queue = &pmlmepriv->scanned_queue;
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+#endif
+	int ret = 0;
+	u8 change = _FALSE;
+
+	if (adapter_to_dvobj(padapter)->processing_dev_remove == _TRUE) {
+		ret= -EPERM;
+		goto exit;
+	}
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->adapter_type == SECONDARY_ADAPTER)
+	{
+		DBG_871X(FUNC_NDEV_FMT" call netdev_if2_open\n", FUNC_NDEV_ARG(ndev));
+		if(netdev_if2_open(ndev) != 0) {
+			ret= -EPERM;
+			goto exit;
+		}
+	}
+	else if(padapter->adapter_type == PRIMARY_ADAPTER)
+#endif //CONFIG_CONCURRENT_MODE
+	{
+		DBG_871X(FUNC_NDEV_FMT" call netdev_open\n", FUNC_NDEV_ARG(ndev));
+		if(netdev_open(ndev) != 0) {
+			ret= -EPERM;
+			goto exit;
+		}
+	}
+
+	if(_FAIL == rtw_pwr_wakeup(padapter)) {
+		ret= -EPERM;
+		goto exit;
+	}
+
+	old_type = rtw_wdev->iftype;
+	DBG_871X(FUNC_NDEV_FMT" old_iftype=%d, new_iftype=%d\n",
+		FUNC_NDEV_ARG(ndev), old_type, type);
+
+	if(old_type != type)
+	{
+		change = _TRUE;
+		pmlmeext->action_public_rxseq = 0xffff;
+		pmlmeext->action_public_dialog_token = 0xff;
+	}
+
+	switch (type) {
+	case NL80211_IFTYPE_ADHOC:
+		networkType = Ndis802_11IBSS;
+		break;
+#if defined(CONFIG_P2P) && ((LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE))
+	case NL80211_IFTYPE_P2P_CLIENT:
+#endif
+	case NL80211_IFTYPE_STATION:
+		networkType = Ndis802_11Infrastructure;
+		#ifdef CONFIG_P2P
+		if(pwdinfo->driver_interface == DRIVER_CFG80211 )
+		{
+			if(change && rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+			{
+				_cancel_timer_ex( &pwdinfo->find_phase_timer );
+				_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+				_cancel_timer_ex( &pwdinfo->pre_tx_scan_timer);
+
+				//it means remove GO and change mode from AP(GO) to station(P2P DEVICE)
+				rtw_p2p_set_role(pwdinfo, P2P_ROLE_DEVICE);
+				rtw_p2p_set_state(pwdinfo, rtw_p2p_pre_state(pwdinfo));
+
+				DBG_8192C("%s, role=%d, p2p_state=%d, pre_p2p_state=%d\n", __func__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo), rtw_p2p_pre_state(pwdinfo));
+			}
+		}
+		#endif //CONFIG_P2P
+		break;
+#if defined(CONFIG_P2P) && ((LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE))
+	case NL80211_IFTYPE_P2P_GO:
+#endif
+	case NL80211_IFTYPE_AP:
+		networkType = Ndis802_11APMode;
+		#ifdef CONFIG_P2P
+		if(pwdinfo->driver_interface == DRIVER_CFG80211 )
+		{
+			if(change && !rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+			{
+				//it means P2P Group created, we will be GO and change mode from  P2P DEVICE to AP(GO)
+				rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO);
+			}
+		}
+		#endif //CONFIG_P2P
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	rtw_wdev->iftype = type;
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	_enter_critical_bh(&queue->lock, &irqL);
+
+	if (rtw_set_802_11_infrastructure_mode(padapter, networkType) ==_FALSE)
+	{
+		rtw_wdev->iftype = old_type;
+		ret = -EPERM;
+		_exit_critical_bh(&queue->lock, &irqL);
+		_exit_critical_bh(&pmlmepriv->lock, &irqL);
+		goto exit;
+	}
+	_exit_critical_bh(&queue->lock, &irqL);
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+	rtw_setopmode_cmd(padapter, networkType);
+
+exit:
+
+	return ret;
+}
+
+void rtw_cfg80211_indicate_scan_done(struct rtw_wdev_priv *pwdev_priv, bool aborted)
+{
+	_irqL	irqL;
+
+	_enter_critical_bh(&pwdev_priv->scan_req_lock, &irqL);
+	if(pwdev_priv->scan_request != NULL)
+	{
+		//struct cfg80211_scan_request *scan_request = pwdev_priv->scan_request;
+
+		#ifdef CONFIG_DEBUG_CFG80211
+		DBG_871X("%s with scan req\n", __FUNCTION__);
+		#endif
+
+		//avoid WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
+		//if(scan_request == wiphy_to_dev(scan_request->wiphy)->scan_req)
+		if(pwdev_priv->scan_request->wiphy != pwdev_priv->rtw_wdev->wiphy)
+		{
+			DBG_8192C("error wiphy compare\n");
+		}
+		else
+		{
+			#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 8, 0))
+			cfg80211_scan_done(pwdev_priv->scan_request, aborted);
+			#else
+			struct cfg80211_scan_info info = {
+				.aborted = aborted,
+			};
+ 	 
+			cfg80211_scan_done(pwdev_priv->scan_request, &info);
+			#endif
+		}
+
+		pwdev_priv->scan_request = NULL;
+
+	} else {
+		#ifdef CONFIG_DEBUG_CFG80211
+		DBG_871X("%s without scan req\n", __FUNCTION__);
+		#endif
+	}
+	_exit_critical_bh(&pwdev_priv->scan_req_lock, &irqL);
+}
+
+void rtw_cfg80211_surveydone_event_callback(_adapter *padapter)
+{
+	_irqL	irqL;
+	_list					*plist, *phead;
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	_queue				*queue	= &(pmlmepriv->scanned_queue);
+	struct	wlan_network	*pnetwork = NULL;
+	u32 cnt=0;
+	u32 wait_for_surveydone;
+	sint wait_status;
+#ifdef CONFIG_P2P
+	struct	wifidirect_info*	pwdinfo = &padapter->wdinfo;
+#endif //CONFIG_P2P
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(padapter->rtw_wdev);
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+
+#ifdef CONFIG_DEBUG_CFG80211
+	DBG_8192C("%s\n", __func__);
+#endif
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while(1)
+	{
+		if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+			break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+
+		//report network only if the current channel set contains the channel to which this network belongs
+		if(rtw_ch_set_search_ch(padapter->mlmeextpriv.channel_set, pnetwork->network.Configuration.DSConfig) >= 0
+			&& rtw_mlme_band_check(padapter, pnetwork->network.Configuration.DSConfig) == _TRUE
+			&& _TRUE == rtw_validate_ssid(&(pnetwork->network.Ssid))
+		)
+		{
+			//ev=translate_scan(padapter, a, pnetwork, ev, stop);
+			rtw_cfg80211_inform_bss(padapter, pnetwork);
+		}
+
+		plist = get_next(plist);
+
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	//call this after other things have been done
+	rtw_cfg80211_indicate_scan_done(wdev_to_priv(padapter->rtw_wdev), _FALSE);
+}
+
+static int rtw_cfg80211_set_probe_req_wpsp2pie(_adapter *padapter, char *buf, int len)
+{
+	int ret = 0;
+	uint wps_ielen = 0;
+	u8 *wps_ie;
+	u32	p2p_ielen = 0;
+	u8 *p2p_ie;
+	u32	wfd_ielen = 0;
+	u8 *wfd_ie;
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+#ifdef CONFIG_DEBUG_CFG80211
+	DBG_8192C("%s, ielen=%d\n", __func__, len);
+#endif
+
+	if(len>0)
+	{
+		if((wps_ie = rtw_get_wps_ie(buf, len, NULL, &wps_ielen)))
+		{
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("probe_req_wps_ielen=%d\n", wps_ielen);
+			#endif
+
+			if(pmlmepriv->wps_probe_req_ie)
+			{
+				u32 free_len = pmlmepriv->wps_probe_req_ie_len;
+				pmlmepriv->wps_probe_req_ie_len = 0;
+				rtw_mfree(pmlmepriv->wps_probe_req_ie, free_len);
+				pmlmepriv->wps_probe_req_ie = NULL;
+			}
+
+			pmlmepriv->wps_probe_req_ie = rtw_malloc(wps_ielen);
+			if ( pmlmepriv->wps_probe_req_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				return -EINVAL;
+
+			}
+			_rtw_memcpy(pmlmepriv->wps_probe_req_ie, wps_ie, wps_ielen);
+			pmlmepriv->wps_probe_req_ie_len = wps_ielen;
+		}
+
+		//buf += wps_ielen;
+		//len -= wps_ielen;
+
+		#ifdef CONFIG_P2P
+		if((p2p_ie=rtw_get_p2p_ie(buf, len, NULL, &p2p_ielen)))
+		{
+			struct wifidirect_info *wdinfo = &padapter->wdinfo;
+			u32 attr_contentlen = 0;
+			u8 listen_ch_attr[5];
+
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("probe_req_p2p_ielen=%d\n", p2p_ielen);
+			#endif
+
+			if(pmlmepriv->p2p_probe_req_ie)
+			{
+				u32 free_len = pmlmepriv->p2p_probe_req_ie_len;
+				pmlmepriv->p2p_probe_req_ie_len = 0;
+				rtw_mfree(pmlmepriv->p2p_probe_req_ie, free_len);
+				pmlmepriv->p2p_probe_req_ie = NULL;
+			}
+
+			pmlmepriv->p2p_probe_req_ie = rtw_malloc(p2p_ielen);
+			if ( pmlmepriv->p2p_probe_req_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				return -EINVAL;
+
+			}
+			_rtw_memcpy(pmlmepriv->p2p_probe_req_ie, p2p_ie, p2p_ielen);
+			pmlmepriv->p2p_probe_req_ie_len = p2p_ielen;
+
+			if(rtw_get_p2p_attr_content(p2p_ie, p2p_ielen, P2P_ATTR_LISTEN_CH, (u8*)listen_ch_attr, (uint*) &attr_contentlen)
+				&& attr_contentlen == 5)
+			{
+				if (wdinfo->listen_channel !=  listen_ch_attr[4]) {
+					DBG_871X(FUNC_ADPT_FMT" listen channel - country:%c%c%c, class:%u, ch:%u\n",
+						FUNC_ADPT_ARG(padapter), listen_ch_attr[0], listen_ch_attr[1], listen_ch_attr[2],
+						listen_ch_attr[3], listen_ch_attr[4]);
+					wdinfo->listen_channel = listen_ch_attr[4];
+				}
+			}
+		}
+		#endif //CONFIG_P2P
+
+		//buf += p2p_ielen;
+		//len -= p2p_ielen;
+
+		#ifdef CONFIG_WFD
+		if(rtw_get_wfd_ie(buf, len, NULL, &wfd_ielen))
+		{
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("probe_req_wfd_ielen=%d\n", wfd_ielen);
+			#endif
+
+			if(pmlmepriv->wfd_probe_req_ie)
+			{
+				u32 free_len = pmlmepriv->wfd_probe_req_ie_len;
+				pmlmepriv->wfd_probe_req_ie_len = 0;
+				rtw_mfree(pmlmepriv->wfd_probe_req_ie, free_len);
+				pmlmepriv->wfd_probe_req_ie = NULL;
+			}
+
+			pmlmepriv->wfd_probe_req_ie = rtw_malloc(wfd_ielen);
+			if ( pmlmepriv->wfd_probe_req_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				return -EINVAL;
+
+			}
+			rtw_get_wfd_ie(buf, len, pmlmepriv->wfd_probe_req_ie, &pmlmepriv->wfd_probe_req_ie_len);
+		}
+		#endif //CONFIG_WFD
+
+	}
+
+	return ret;
+
+}
+
+static int cfg80211_rtw_scan(struct wiphy *wiphy
+	#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
+	, struct net_device *ndev
+	#endif
+	, struct cfg80211_scan_request *request)
+{
+	int i;
+	u8 _status = _FALSE;
+	int ret = 0;
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+	struct mlme_priv *pmlmepriv= &padapter->mlmepriv;
+	NDIS_802_11_SSID ssid[RTW_SSID_SCAN_AMOUNT];
+	struct rtw_ieee80211_channel ch[RTW_CHANNEL_SCAN_AMOUNT];
+	_irqL	irqL;
+	u8 *wps_ie=NULL;
+	uint wps_ielen=0;
+	u8 *p2p_ie=NULL;
+	uint p2p_ielen=0;
+	u8 survey_times=3;
+	u8 survey_times_for_one_ch=6;
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+#endif //CONFIG_P2P
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(padapter->rtw_wdev);
+	struct cfg80211_ssid *ssids = request->ssids;
+	int social_channel = 0, j = 0;
+	bool need_indicate_scan_done = _FALSE;
+#ifdef CONFIG_CONCURRENT_MODE
+	PADAPTER pbuddy_adapter = NULL;
+	struct mlme_priv *pbuddy_mlmepriv = NULL;
+#endif //CONFIG_CONCURRENT_MODE
+
+//#ifdef CONFIG_DEBUG_CFG80211
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+//#endif
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (padapter->pbuddy_adapter) {
+		pbuddy_adapter = padapter->pbuddy_adapter;
+		pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+	}
+#endif //CONFIG_CONCURRENT_MODE
+
+#ifdef CONFIG_MP_INCLUDED
+	if (check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE)
+	{
+		ret = -EPERM;
+		goto exit;
+	}
+#endif
+
+	_enter_critical_bh(&pwdev_priv->scan_req_lock, &irqL);
+	pwdev_priv->scan_request = request;
+	_exit_critical_bh(&pwdev_priv->scan_req_lock, &irqL);
+
+	if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+#ifdef CONFIG_DEBUG_CFG80211
+		DBG_871X("%s under WIFI_AP_STATE\n", __FUNCTION__);
+#endif
+
+		if (check_fwstate(pmlmepriv, WIFI_UNDER_WPS|_FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE)
+		{
+			DBG_8192C("%s, fwstate=0x%x\n", __func__, pmlmepriv->fw_state);
+
+			if(check_fwstate(pmlmepriv, WIFI_UNDER_WPS))
+			{
+				DBG_8192C("AP mode process WPS \n");
+			}
+
+			need_indicate_scan_done = _TRUE;
+			goto check_need_indicate_scan_done;
+		}
+	}
+
+	if(_FAIL == rtw_pwr_wakeup(padapter)) {
+		need_indicate_scan_done = _TRUE;
+		goto check_need_indicate_scan_done;
+	}
+
+	#ifdef CONFIG_P2P
+	if( pwdinfo->driver_interface == DRIVER_CFG80211 )
+	{
+		if(ssids->ssid != NULL
+			&& _rtw_memcmp(ssids->ssid, "DIRECT-", 7)
+			&& rtw_get_p2p_ie((u8 *)request->ie, request->ie_len, NULL, NULL)
+		)
+		{
+			if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+			{
+				u32 initialgain = 0x30;
+				rtw_p2p_enable(padapter, P2P_ROLE_DEVICE);
+				wdev_to_priv(padapter->rtw_wdev)->p2p_enabled = _TRUE;
+				padapter->HalFunc.SetHwRegHandler(padapter, HW_VAR_INITIAL_GAIN, (u8 *)&(initialgain));
+				padapter->HalFunc.SetHwRegHandler(padapter, HW_VAR_INITIAL_GAIN, (u8 *)&(initialgain));
+			}
+			else
+			{
+				rtw_p2p_set_pre_state(pwdinfo, rtw_p2p_state(pwdinfo));
+				#ifdef CONFIG_DEBUG_CFG80211
+				DBG_8192C("%s, role=%d, p2p_state=%d\n", __func__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo));
+				#endif
+			}
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_LISTEN);
+
+			if(request->n_channels == 3 &&
+				request->channels[0]->hw_value == 1 &&
+				request->channels[1]->hw_value == 6 &&
+				request->channels[2]->hw_value == 11
+			)
+			{
+				social_channel = 1;
+			}
+		}
+	}
+	#endif //CONFIG_P2P
+
+	if(request->ie && request->ie_len>0)
+	{
+		rtw_cfg80211_set_probe_req_wpsp2pie(padapter, (u8 *)request->ie, request->ie_len );
+	}
+
+	if (pmlmepriv->LinkDetectInfo.bBusyTraffic == _TRUE)
+	{
+		DBG_8192C("%s, bBusyTraffic == _TRUE\n", __func__);
+		need_indicate_scan_done = _TRUE;
+		goto check_need_indicate_scan_done;
+	}
+	if (rtw_is_scan_deny(padapter)){
+		DBG_871X(FUNC_ADPT_FMT  ": scan deny\n", FUNC_ADPT_ARG(padapter));
+		need_indicate_scan_done = _TRUE;
+		goto check_need_indicate_scan_done;
+	}
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(pbuddy_mlmepriv && (pbuddy_mlmepriv->LinkDetectInfo.bBusyTraffic == _TRUE))
+	{
+		DBG_8192C("%s, bBusyTraffic == _TRUE at buddy_intf\n", __func__);
+		need_indicate_scan_done = _TRUE;
+		goto check_need_indicate_scan_done;
+	}
+#endif //CONFIG_CONCURRENT_MODE
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE)
+	{
+		DBG_8192C("%s, fwstate=0x%x\n", __func__, pmlmepriv->fw_state);
+		need_indicate_scan_done = _TRUE;
+		goto check_need_indicate_scan_done;
+	}
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (check_buddy_fwstate(padapter,
+		_FW_UNDER_SURVEY|_FW_UNDER_LINKING|WIFI_UNDER_WPS) == _TRUE)
+	{
+		if(check_buddy_fwstate(padapter, _FW_UNDER_SURVEY))
+		{
+			DBG_8192C("scanning_via_buddy_intf\n");
+			pmlmepriv->scanning_via_buddy_intf = _TRUE;
+		}
+
+		DBG_8192C("buddy_intf's mlme state:0x%x\n", pbuddy_mlmepriv->fw_state);
+
+		need_indicate_scan_done = _TRUE;
+		goto check_need_indicate_scan_done;
+	}
+#endif
+
+
+#ifdef CONFIG_P2P
+	if( pwdinfo->driver_interface == DRIVER_CFG80211 )
+	{
+		if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE) && !rtw_p2p_chk_state(pwdinfo, P2P_STATE_IDLE))
+		{
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_FIND_PHASE_SEARCH);
+			rtw_free_network_queue(padapter, _TRUE);
+
+			if(social_channel == 0)
+				rtw_p2p_findphase_ex_set(pwdinfo, P2P_FINDPHASE_EX_NONE);
+			else
+				rtw_p2p_findphase_ex_set(pwdinfo, P2P_FINDPHASE_EX_SOCIAL_LAST);
+		}
+	}
+#endif //CONFIG_P2P
+
+
+	_rtw_memset(ssid, 0, sizeof(NDIS_802_11_SSID)*RTW_SSID_SCAN_AMOUNT);
+	//parsing request ssids, n_ssids
+	for (i = 0; i < request->n_ssids && i < RTW_SSID_SCAN_AMOUNT; i++) {
+		#ifdef CONFIG_DEBUG_CFG80211
+		DBG_8192C("ssid=%s, len=%d\n", ssids[i].ssid, ssids[i].ssid_len);
+		#endif
+		_rtw_memcpy(ssid[i].Ssid, ssids[i].ssid, ssids[i].ssid_len);
+		ssid[i].SsidLength = ssids[i].ssid_len;
+	}
+
+
+	/* parsing channels, n_channels */
+	_rtw_memset(ch, 0, sizeof(struct rtw_ieee80211_channel)*RTW_CHANNEL_SCAN_AMOUNT);
+	for (i=0;i<request->n_channels && i<RTW_CHANNEL_SCAN_AMOUNT;i++) {
+		#ifdef CONFIG_DEBUG_CFG80211
+		DBG_871X(FUNC_ADPT_FMT CHAN_FMT"\n", FUNC_ADPT_ARG(padapter), CHAN_ARG(request->channels[i]));
+		#endif
+		ch[i].hw_value = request->channels[i]->hw_value;
+		ch[i].flags = request->channels[i]->flags;
+	}
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	if (request->n_channels == 1) {
+		for(i=1;i<survey_times_for_one_ch;i++)
+			_rtw_memcpy(&ch[i], &ch[0], sizeof(struct rtw_ieee80211_channel));
+		_status = rtw_sitesurvey_cmd(padapter, ssid, RTW_SSID_SCAN_AMOUNT, ch, survey_times_for_one_ch);
+	} else if (request->n_channels == 2) {
+		_rtw_memcpy(&ch[3], &ch[1], sizeof(struct rtw_ieee80211_channel));
+		for(i=1;i<survey_times;i++) {
+			_rtw_memcpy(&ch[i], &ch[0], sizeof(struct rtw_ieee80211_channel));
+			_rtw_memcpy(&ch[i+3], &ch[3], sizeof(struct rtw_ieee80211_channel));
+		}
+		_status = rtw_sitesurvey_cmd(padapter, ssid, RTW_SSID_SCAN_AMOUNT, ch, survey_times * 2);
+	} else {
+		_status = rtw_sitesurvey_cmd(padapter, ssid, RTW_SSID_SCAN_AMOUNT, NULL, 0);
+	}
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+
+	if(_status == _FALSE)
+	{
+		ret = -1;
+	}
+
+check_need_indicate_scan_done:
+	if(need_indicate_scan_done)
+		rtw_cfg80211_surveydone_event_callback(padapter);
+
+exit:
+
+	return ret;
+
+}
+
+static int cfg80211_rtw_set_wiphy_params(struct wiphy *wiphy, u32 changed)
+{
+#if 0
+	struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
+
+	if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
+	    (iwm->conf.rts_threshold != wiphy->rts_threshold)) {
+		int ret;
+
+		iwm->conf.rts_threshold = wiphy->rts_threshold;
+
+		ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
+					     CFG_RTS_THRESHOLD,
+					     iwm->conf.rts_threshold);
+		if (ret < 0)
+			return ret;
+	}
+
+	if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
+	    (iwm->conf.frag_threshold != wiphy->frag_threshold)) {
+		int ret;
+
+		iwm->conf.frag_threshold = wiphy->frag_threshold;
+
+		ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_FA_CFG_FIX,
+					     CFG_FRAG_THRESHOLD,
+					     iwm->conf.frag_threshold);
+		if (ret < 0)
+			return ret;
+	}
+#endif
+	DBG_8192C("%s\n", __func__);
+	return 0;
+}
+
+static int cfg80211_rtw_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
+				  struct cfg80211_ibss_params *params)
+{
+#if 0
+	struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
+	struct ieee80211_channel *chan = params->channel;
+
+	if (!test_bit(IWM_STATUS_READY, &iwm->status))
+		return -EIO;
+
+	/* UMAC doesn't support creating or joining an IBSS network
+	 * with specified bssid. */
+	if (params->bssid)
+		return -EOPNOTSUPP;
+
+	iwm->channel = ieee80211_frequency_to_channel(chan->center_freq);
+	iwm->umac_profile->ibss.band = chan->band;
+	iwm->umac_profile->ibss.channel = iwm->channel;
+	iwm->umac_profile->ssid.ssid_len = params->ssid_len;
+	memcpy(iwm->umac_profile->ssid.ssid, params->ssid, params->ssid_len);
+
+	return iwm_send_mlme_profile(iwm);
+#endif
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	return 0;
+}
+
+static int cfg80211_rtw_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
+{
+#if 0
+	struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
+
+	if (iwm->umac_profile_active)
+		return iwm_invalidate_mlme_profile(iwm);
+#endif
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	return 0;
+}
+
+static int rtw_cfg80211_set_wpa_version(struct security_priv *psecuritypriv, u32 wpa_version)
+{
+	DBG_8192C("%s, wpa_version=%d\n", __func__, wpa_version);
+
+	if (!wpa_version) {
+		psecuritypriv->ndisauthtype = Ndis802_11AuthModeOpen;
+		return 0;
+	}
+
+
+	if (wpa_version & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2))
+	{
+		psecuritypriv->ndisauthtype = Ndis802_11AuthModeWPAPSK;
+	}
+
+/*
+	if (wpa_version & NL80211_WPA_VERSION_2)
+	{
+		psecuritypriv->ndisauthtype = Ndis802_11AuthModeWPA2PSK;
+	}
+*/
+
+	return 0;
+
+}
+
+static int rtw_cfg80211_set_auth_type(struct security_priv *psecuritypriv,
+			     enum nl80211_auth_type sme_auth_type)
+{
+	DBG_8192C("%s, nl80211_auth_type=%d\n", __func__, sme_auth_type);
+
+
+	switch (sme_auth_type) {
+	case NL80211_AUTHTYPE_AUTOMATIC:
+
+		psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_Auto;
+
+		break;
+	case NL80211_AUTHTYPE_OPEN_SYSTEM:
+
+		psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_Open;
+
+		if(psecuritypriv->ndisauthtype>Ndis802_11AuthModeWPA)
+			psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_8021X;
+
+		break;
+	case NL80211_AUTHTYPE_SHARED_KEY:
+
+		psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_Shared;
+
+		psecuritypriv->ndisencryptstatus = Ndis802_11Encryption1Enabled;
+
+
+		break;
+	default:
+		psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_Open;
+		//return -ENOTSUPP;
+	}
+
+	return 0;
+
+}
+
+static int rtw_cfg80211_set_cipher(struct security_priv *psecuritypriv, u32 cipher, bool ucast)
+{
+	u32 ndisencryptstatus = Ndis802_11EncryptionDisabled;
+
+	u32 *profile_cipher = ucast ? &psecuritypriv->dot11PrivacyAlgrthm :
+		&psecuritypriv->dot118021XGrpPrivacy;
+
+	DBG_8192C("%s, ucast=%d, cipher=0x%x\n", __func__, ucast, cipher);
+
+
+	if (!cipher) {
+		*profile_cipher = _NO_PRIVACY_;
+		psecuritypriv->ndisencryptstatus = ndisencryptstatus;
+		return 0;
+	}
+
+	switch (cipher) {
+	case IW_AUTH_CIPHER_NONE:
+		*profile_cipher = _NO_PRIVACY_;
+		ndisencryptstatus = Ndis802_11EncryptionDisabled;
+		break;
+	case WLAN_CIPHER_SUITE_WEP40:
+		*profile_cipher = _WEP40_;
+		ndisencryptstatus = Ndis802_11Encryption1Enabled;
+		break;
+	case WLAN_CIPHER_SUITE_WEP104:
+		*profile_cipher = _WEP104_;
+		ndisencryptstatus = Ndis802_11Encryption1Enabled;
+		break;
+	case WLAN_CIPHER_SUITE_TKIP:
+		*profile_cipher = _TKIP_;
+		ndisencryptstatus = Ndis802_11Encryption2Enabled;
+		break;
+	case WLAN_CIPHER_SUITE_CCMP:
+		*profile_cipher = _AES_;
+		ndisencryptstatus = Ndis802_11Encryption3Enabled;
+		break;
+	default:
+		DBG_8192C("Unsupported cipher: 0x%x\n", cipher);
+		return -ENOTSUPP;
+	}
+
+	if(ucast)
+	{
+		psecuritypriv->ndisencryptstatus = ndisencryptstatus;
+
+		//if(psecuritypriv->dot11PrivacyAlgrthm >= _AES_)
+		//	psecuritypriv->ndisauthtype = Ndis802_11AuthModeWPA2PSK;
+	}
+
+	return 0;
+}
+
+static int rtw_cfg80211_set_key_mgt(struct security_priv *psecuritypriv, u32 key_mgt)
+{
+	DBG_8192C("%s, key_mgt=0x%x\n", __func__, key_mgt);
+
+	if (key_mgt == WLAN_AKM_SUITE_8021X)
+		//*auth_type = UMAC_AUTH_TYPE_8021X;
+		psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_8021X;
+	else if (key_mgt == WLAN_AKM_SUITE_PSK) {
+		psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_8021X;
+	} else {
+		DBG_8192C("Invalid key mgt: 0x%x\n", key_mgt);
+		//return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int rtw_cfg80211_set_wpa_ie(_adapter *padapter, const u8 *pie, size_t ielen)
+{
+	u8 *buf=NULL, *pos=NULL;
+	u32 left;
+	int group_cipher = 0, pairwise_cipher = 0;
+	int ret = 0;
+	int wpa_ielen=0;
+	int wpa2_ielen=0;
+	u8 *pwpa, *pwpa2;
+	u8 null_addr[]= {0,0,0,0,0,0};
+
+	if (pie == NULL || !ielen) {
+		/* Treat this as normal case, but need to clear WIFI_UNDER_WPS */
+		_clr_fwstate_(&padapter->mlmepriv, WIFI_UNDER_WPS);
+		goto exit;
+	}
+
+	if (ielen > MAX_WPA_IE_LEN+MAX_WPS_IE_LEN+MAX_P2P_IE_LEN) {
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	buf = rtw_zmalloc(ielen);
+	if (buf == NULL){
+		ret =  -ENOMEM;
+		goto exit;
+	}
+
+	_rtw_memcpy(buf, pie , ielen);
+
+	//dump
+	{
+		int i;
+		DBG_8192C("set wpa_ie(length:%zu):\n", ielen);
+		for(i=0;i<ielen;i=i+8)
+			DBG_8192C("0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x \n",buf[i],buf[i+1],buf[i+2],buf[i+3],buf[i+4],buf[i+5],buf[i+6],buf[i+7]);
+	}
+
+	pos = buf;
+	if(ielen < RSN_HEADER_LEN){
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("Ie len too short %d\n", ielen));
+		ret  = -1;
+		goto exit;
+	}
+
+	pwpa = rtw_get_wpa_ie(buf, &wpa_ielen, ielen);
+	if(pwpa && wpa_ielen>0)
+	{
+		if(rtw_parse_wpa_ie(pwpa, wpa_ielen+2, &group_cipher, &pairwise_cipher) == _SUCCESS)
+		{
+			padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_8021X;
+			padapter->securitypriv.ndisauthtype=Ndis802_11AuthModeWPAPSK;
+			_rtw_memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen+2);
+
+			DBG_8192C("got wpa_ie, wpa_ielen:%u\n", wpa_ielen);
+		}
+	}
+
+	pwpa2 = rtw_get_wpa2_ie(buf, &wpa2_ielen, ielen);
+	if(pwpa2 && wpa2_ielen>0)
+	{
+		if(rtw_parse_wpa2_ie(pwpa2, wpa2_ielen+2, &group_cipher, &pairwise_cipher) == _SUCCESS)
+		{
+			padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_8021X;
+			padapter->securitypriv.ndisauthtype=Ndis802_11AuthModeWPA2PSK;
+			_rtw_memcpy(padapter->securitypriv.supplicant_ie, &pwpa2[0], wpa2_ielen+2);
+
+			DBG_8192C("got wpa2_ie, wpa2_ielen:%u\n", wpa2_ielen);
+		}
+	}
+
+	if (group_cipher == 0)
+	{
+		group_cipher = WPA_CIPHER_NONE;
+	}
+	if (pairwise_cipher == 0)
+	{
+		pairwise_cipher = WPA_CIPHER_NONE;
+	}
+
+	switch(group_cipher)
+	{
+		case WPA_CIPHER_NONE:
+			padapter->securitypriv.dot118021XGrpPrivacy=_NO_PRIVACY_;
+			padapter->securitypriv.ndisencryptstatus=Ndis802_11EncryptionDisabled;
+			break;
+		case WPA_CIPHER_WEP40:
+			padapter->securitypriv.dot118021XGrpPrivacy=_WEP40_;
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+			break;
+		case WPA_CIPHER_TKIP:
+			padapter->securitypriv.dot118021XGrpPrivacy=_TKIP_;
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption2Enabled;
+			break;
+		case WPA_CIPHER_CCMP:
+			padapter->securitypriv.dot118021XGrpPrivacy=_AES_;
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption3Enabled;
+			break;
+		case WPA_CIPHER_WEP104:
+			padapter->securitypriv.dot118021XGrpPrivacy=_WEP104_;
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+			break;
+	}
+
+	switch(pairwise_cipher)
+	{
+		case WPA_CIPHER_NONE:
+			padapter->securitypriv.dot11PrivacyAlgrthm=_NO_PRIVACY_;
+			padapter->securitypriv.ndisencryptstatus=Ndis802_11EncryptionDisabled;
+			break;
+		case WPA_CIPHER_WEP40:
+			padapter->securitypriv.dot11PrivacyAlgrthm=_WEP40_;
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+			break;
+		case WPA_CIPHER_TKIP:
+			padapter->securitypriv.dot11PrivacyAlgrthm=_TKIP_;
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption2Enabled;
+			break;
+		case WPA_CIPHER_CCMP:
+			padapter->securitypriv.dot11PrivacyAlgrthm=_AES_;
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption3Enabled;
+			break;
+		case WPA_CIPHER_WEP104:
+			padapter->securitypriv.dot11PrivacyAlgrthm=_WEP104_;
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+			break;
+	}
+
+	{/* handle wps_ie */
+		uint wps_ielen;
+		u8 *wps_ie;
+
+		wps_ie = rtw_get_wps_ie(buf, ielen, NULL, &wps_ielen);
+		if (wps_ie && wps_ielen > 0) {
+			DBG_8192C("got wps_ie, wps_ielen:%u\n", wps_ielen);
+			padapter->securitypriv.wps_ie_len = wps_ielen<MAX_WPS_IE_LEN?wps_ielen:MAX_WPS_IE_LEN;
+			_rtw_memcpy(padapter->securitypriv.wps_ie, wps_ie, padapter->securitypriv.wps_ie_len);
+			set_fwstate(&padapter->mlmepriv, WIFI_UNDER_WPS);
+		} else {
+			_clr_fwstate_(&padapter->mlmepriv, WIFI_UNDER_WPS);
+		}
+	}
+
+	#ifdef CONFIG_P2P
+	{//check p2p_ie for assoc req;
+		uint p2p_ielen=0;
+		u8 *p2p_ie;
+		struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+		if((p2p_ie=rtw_get_p2p_ie(buf, ielen, NULL, &p2p_ielen)))
+		{
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("%s p2p_assoc_req_ielen=%d\n", __FUNCTION__, p2p_ielen);
+			#endif
+
+			if(pmlmepriv->p2p_assoc_req_ie)
+			{
+				u32 free_len = pmlmepriv->p2p_assoc_req_ie_len;
+				pmlmepriv->p2p_assoc_req_ie_len = 0;
+				rtw_mfree(pmlmepriv->p2p_assoc_req_ie, free_len);
+				pmlmepriv->p2p_assoc_req_ie = NULL;
+			}
+
+			pmlmepriv->p2p_assoc_req_ie = rtw_malloc(p2p_ielen);
+			if ( pmlmepriv->p2p_assoc_req_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				goto exit;
+			}
+			_rtw_memcpy(pmlmepriv->p2p_assoc_req_ie, p2p_ie, p2p_ielen);
+			pmlmepriv->p2p_assoc_req_ie_len = p2p_ielen;
+		}
+	}
+	#endif //CONFIG_P2P
+
+	#ifdef CONFIG_WFD
+	{//check wfd_ie for assoc req;
+		uint wfd_ielen=0;
+		u8 *wfd_ie;
+		struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+		if(rtw_get_wfd_ie(buf, ielen, NULL, &wfd_ielen))
+		{
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("%s wfd_assoc_req_ielen=%d\n", __FUNCTION__, wfd_ielen);
+			#endif
+
+			if(pmlmepriv->wfd_assoc_req_ie)
+			{
+				u32 free_len = pmlmepriv->wfd_assoc_req_ie_len;
+				pmlmepriv->wfd_assoc_req_ie_len = 0;
+				rtw_mfree(pmlmepriv->wfd_assoc_req_ie, free_len);
+				pmlmepriv->wfd_assoc_req_ie = NULL;
+			}
+
+			pmlmepriv->wfd_assoc_req_ie = rtw_malloc(wfd_ielen);
+			if ( pmlmepriv->wfd_assoc_req_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				goto exit;
+			}
+			rtw_get_wfd_ie(buf, ielen, pmlmepriv->wfd_assoc_req_ie, &pmlmepriv->wfd_assoc_req_ie_len);
+		}
+	}
+	#endif //CONFIG_WFD
+
+	//TKIP and AES disallow multicast packets until installing group key
+	if(padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_
+		|| padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_WTMIC_
+		|| padapter->securitypriv.dot11PrivacyAlgrthm == _AES_)
+		//WPS open need to enable multicast
+		//|| check_fwstate(&padapter->mlmepriv, WIFI_UNDER_WPS) == _TRUE)
+		rtw_hal_set_hwreg(padapter, HW_VAR_OFF_RCR_AM, null_addr);
+
+	RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_info_,
+		("rtw_set_wpa_ie: pairwise_cipher=0x%08x padapter->securitypriv.ndisencryptstatus=%d padapter->securitypriv.ndisauthtype=%d\n",
+		pairwise_cipher, padapter->securitypriv.ndisencryptstatus, padapter->securitypriv.ndisauthtype));
+
+exit:
+	if (buf)
+		rtw_mfree(buf, ielen);
+	if (ret)
+		_clr_fwstate_(&padapter->mlmepriv, WIFI_UNDER_WPS);
+	return ret;
+}
+
+static int cfg80211_rtw_connect(struct wiphy *wiphy, struct net_device *ndev,
+				 struct cfg80211_connect_params *sme)
+{
+	int ret=0;
+	_irqL irqL;
+	_list *phead;
+	struct wlan_network *pnetwork = NULL;
+	NDIS_802_11_AUTHENTICATION_MODE authmode;
+	NDIS_802_11_SSID ndis_ssid;
+	u8 *dst_ssid, *src_ssid;
+	u8 *dst_bssid, *src_bssid;
+	//u8 matched_by_bssid=_FALSE;
+	//u8 matched_by_ssid=_FALSE;
+	u8 matched=_FALSE;
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+	_queue *queue = &pmlmepriv->scanned_queue;
+
+	DBG_871X("=>"FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	DBG_871X("privacy=%d, key=%p, key_len=%d, key_idx=%d\n",
+		sme->privacy, sme->key, sme->key_len, sme->key_idx);
+
+
+	if(wdev_to_priv(padapter->rtw_wdev)->block == _TRUE)
+	{
+		ret = -EBUSY;
+		DBG_871X("%s wdev_priv.block is set\n", __FUNCTION__);
+		goto exit;
+	}
+
+#ifdef CONFIG_PLATFORM_MSTAR
+	printk("MStar Android!\n");
+	if((wdev_to_priv(padapter->rtw_wdev))->bandroid_scan == _FALSE)
+	{
+#ifdef CONFIG_P2P
+		struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+		if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+#endif //CONFIG_P2P
+		{
+			ret = -EBUSY;
+			printk("Android hasn't attached yet!\n");
+			goto exit;
+		}
+	}
+#endif
+
+	if(_FAIL == rtw_pwr_wakeup(padapter)) {
+		ret= -EPERM;
+		goto exit;
+	}
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
+		ret = -EPERM;
+		goto exit;
+	}
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (check_buddy_fwstate(padapter, _FW_UNDER_LINKING) == _TRUE) {
+		DBG_8192C("%s, but buddy_intf is under linking\n", __FUNCTION__);
+		ret = -EINVAL;
+		goto exit;
+	}
+	if (check_buddy_fwstate(padapter, _FW_UNDER_SURVEY) == _TRUE) {
+		rtw_scan_abort(padapter->pbuddy_adapter);
+	}
+#endif
+
+	if (!sme->ssid || !sme->ssid_len)
+	{
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	if (sme->ssid_len > IW_ESSID_MAX_SIZE){
+
+		ret= -E2BIG;
+		goto exit;
+	}
+
+	_rtw_memset(&ndis_ssid, 0, sizeof(NDIS_802_11_SSID));
+	ndis_ssid.SsidLength = sme->ssid_len;
+	_rtw_memcpy(ndis_ssid.Ssid, sme->ssid, sme->ssid_len);
+
+	DBG_8192C("ssid=%s, len=%zu\n", ndis_ssid.Ssid, sme->ssid_len);
+
+
+	if (sme->bssid)
+		DBG_8192C("bssid="MAC_FMT"\n", MAC_ARG(sme->bssid));
+
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_LINKING) == _TRUE) {
+		ret = -EBUSY;
+		DBG_8192C("%s, fw_state=0x%x, goto exit\n", __FUNCTION__, pmlmepriv->fw_state);
+		goto exit;
+	}
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE) {
+		rtw_scan_abort(padapter);
+	}
+
+	psecuritypriv->ndisencryptstatus = Ndis802_11EncryptionDisabled;
+	psecuritypriv->dot11PrivacyAlgrthm = _NO_PRIVACY_;
+	psecuritypriv->dot118021XGrpPrivacy = _NO_PRIVACY_;
+	psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_Open; //open system
+	psecuritypriv->ndisauthtype = Ndis802_11AuthModeOpen;
+
+
+	ret = rtw_cfg80211_set_wpa_version(psecuritypriv, sme->crypto.wpa_versions);
+	if (ret < 0)
+		goto exit;
+
+	ret = rtw_cfg80211_set_auth_type(psecuritypriv, sme->auth_type);
+	if (ret < 0)
+		goto exit;
+
+	DBG_8192C("%s, ie_len=%zu\n", __func__, sme->ie_len);
+
+	ret = rtw_cfg80211_set_wpa_ie(padapter, sme->ie, sme->ie_len);
+	if (ret < 0)
+		goto exit;
+
+	if (sme->crypto.n_ciphers_pairwise) {
+		ret = rtw_cfg80211_set_cipher(psecuritypriv, sme->crypto.ciphers_pairwise[0], _TRUE);
+		if (ret < 0)
+			goto exit;
+	}
+
+	//For WEP Shared auth
+	if((psecuritypriv->dot11AuthAlgrthm == dot11AuthAlgrthm_Shared
+		|| psecuritypriv->dot11AuthAlgrthm == dot11AuthAlgrthm_Auto) && sme->key
+	)
+	{
+		u32 wep_key_idx, wep_key_len,wep_total_len;
+		NDIS_802_11_WEP	 *pwep = NULL;
+		DBG_871X("%s(): Shared/Auto WEP\n",__FUNCTION__);
+
+		wep_key_idx = sme->key_idx;
+		wep_key_len = sme->key_len;
+
+		if (sme->key_idx > WEP_KEYS) {
+			ret = -EINVAL;
+			goto exit;
+		}
+
+		if (wep_key_len > 0)
+		{
+			wep_key_len = wep_key_len <= 5 ? 5 : 13;
+			wep_total_len = wep_key_len + FIELD_OFFSET(NDIS_802_11_WEP, KeyMaterial);
+			pwep =(NDIS_802_11_WEP	 *) rtw_malloc(wep_total_len);
+			if(pwep == NULL){
+				DBG_871X(" wpa_set_encryption: pwep allocate fail !!!\n");
+				ret = -ENOMEM;
+				goto exit;
+			}
+
+			_rtw_memset(pwep, 0, wep_total_len);
+
+			pwep->KeyLength = wep_key_len;
+			pwep->Length = wep_total_len;
+
+			if(wep_key_len==13)
+			{
+				padapter->securitypriv.dot11PrivacyAlgrthm=_WEP104_;
+				padapter->securitypriv.dot118021XGrpPrivacy=_WEP104_;
+			}
+		}
+		else {
+			ret = -EINVAL;
+			goto exit;
+		}
+
+		pwep->KeyIndex = wep_key_idx;
+		pwep->KeyIndex |= 0x80000000;
+
+		_rtw_memcpy(pwep->KeyMaterial,  (void *)sme->key, pwep->KeyLength);
+
+		if(rtw_set_802_11_add_wep(padapter, pwep) == (u8)_FAIL)
+		{
+			ret = -EOPNOTSUPP ;
+		}
+
+		if (pwep) {
+			rtw_mfree((u8 *)pwep,wep_total_len);
+		}
+
+		if(ret < 0)
+			goto exit;
+	}
+
+	ret = rtw_cfg80211_set_cipher(psecuritypriv, sme->crypto.cipher_group, _FALSE);
+	if (ret < 0)
+		return ret;
+
+	if (sme->crypto.n_akm_suites) {
+		ret = rtw_cfg80211_set_key_mgt(psecuritypriv, sme->crypto.akm_suites[0]);
+		if (ret < 0)
+			goto exit;
+	}
+
+	authmode = psecuritypriv->ndisauthtype;
+	rtw_set_802_11_authentication_mode(padapter, authmode);
+
+	//rtw_set_802_11_encryption_mode(padapter, padapter->securitypriv.ndisencryptstatus);
+
+	if (rtw_set_802_11_connect(padapter, sme->bssid, &ndis_ssid) == _FALSE) {
+		ret = -1;
+		goto exit;
+	}
+
+	DBG_8192C("set ssid:dot11AuthAlgrthm=%d, dot11PrivacyAlgrthm=%d, dot118021XGrpPrivacy=%d\n", psecuritypriv->dot11AuthAlgrthm, psecuritypriv->dot11PrivacyAlgrthm, psecuritypriv->dot118021XGrpPrivacy);
+
+exit:
+
+	DBG_8192C("<=%s, ret %d\n",__FUNCTION__, ret);
+
+	return ret;
+}
+
+static int cfg80211_rtw_disconnect(struct wiphy *wiphy, struct net_device *ndev,
+				   u16 reason_code)
+{
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+	rtw_set_roaming(padapter, 0);
+
+	if(check_fwstate(&padapter->mlmepriv, _FW_LINKED))
+	{
+		rtw_scan_abort(padapter);
+		LeaveAllPowerSaveMode(padapter);
+		rtw_disassoc_cmd(padapter, 500, _FALSE);
+
+		DBG_871X("%s...call rtw_indicate_disconnect\n", __FUNCTION__);
+
+		padapter->mlmepriv.not_indic_disco = _TRUE;
+		rtw_indicate_disconnect(padapter);
+		padapter->mlmepriv.not_indic_disco = _FALSE;
+
+		rtw_free_assoc_resources(padapter, 1);
+	}
+
+	return 0;
+}
+
+static int cfg80211_rtw_set_txpower(struct wiphy *wiphy,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,8,0))
+	struct wireless_dev *wdev,
+#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,36)) || defined(COMPAT_KERNEL_RELEASE)
+	enum nl80211_tx_power_setting type, int mbm)
+#else
+	enum tx_power_setting type, int dbm)
+#endif
+{
+#if 0
+	struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
+	int ret;
+
+	switch (type) {
+	case NL80211_TX_POWER_AUTOMATIC:
+		return 0;
+	case NL80211_TX_POWER_FIXED:
+		if (mbm < 0 || (mbm % 100))
+			return -EOPNOTSUPP;
+
+		if (!test_bit(IWM_STATUS_READY, &iwm->status))
+			return 0;
+
+		ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
+					      CFG_TX_PWR_LIMIT_USR,
+					      MBM_TO_DBM(mbm) * 2);
+		if (ret < 0)
+			return ret;
+
+		return iwm_tx_power_trigger(iwm);
+	default:
+		IWM_ERR(iwm, "Unsupported power type: %d\n", type);
+		return -EOPNOTSUPP;
+	}
+#endif
+	DBG_8192C("%s\n", __func__);
+	return 0;
+}
+
+static int cfg80211_rtw_get_txpower(struct wiphy *wiphy,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,8,0))
+	struct wireless_dev *wdev,
+#endif
+	int *dbm)
+{
+	//_adapter *padapter = wiphy_to_adapter(wiphy);
+
+	DBG_8192C("%s\n", __func__);
+
+	*dbm = (12);
+
+	return 0;
+}
+
+inline bool rtw_cfg80211_pwr_mgmt(_adapter *adapter)
+{
+	struct rtw_wdev_priv *rtw_wdev_priv = wdev_to_priv(adapter->rtw_wdev);
+	return rtw_wdev_priv->power_mgmt;
+}
+
+static int cfg80211_rtw_set_power_mgmt(struct wiphy *wiphy,
+				       struct net_device *ndev,
+				       bool enabled, int timeout)
+{
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+	struct rtw_wdev_priv *rtw_wdev_priv = wdev_to_priv(padapter->rtw_wdev);
+
+	DBG_871X(FUNC_NDEV_FMT" enabled:%u, timeout:%d\n", FUNC_NDEV_ARG(ndev),
+		enabled, timeout);
+
+	rtw_wdev_priv->power_mgmt = enabled;
+
+	#ifdef CONFIG_LPS
+	if (!enabled)
+		LPS_Leave(padapter);
+	#endif
+
+	return 0;
+}
+
+static int cfg80211_rtw_set_pmksa(struct wiphy *wiphy,
+				  struct net_device *netdev,
+				  struct cfg80211_pmksa *pmksa)
+{
+	u8	index,blInserted = _FALSE;
+	_adapter	*padapter = wiphy_to_adapter(wiphy);
+	struct security_priv	*psecuritypriv = &padapter->securitypriv;
+	u8	strZeroMacAddress[ ETH_ALEN ] = { 0x00 };
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(netdev));
+
+	if ( _rtw_memcmp( pmksa->bssid, strZeroMacAddress, ETH_ALEN ) == _TRUE )
+	{
+		return -EINVAL;
+	}
+
+	blInserted = _FALSE;
+
+	//overwrite PMKID
+	for(index=0 ; index<NUM_PMKID_CACHE; index++)
+	{
+		if( _rtw_memcmp( psecuritypriv->PMKIDList[index].Bssid, pmksa->bssid, ETH_ALEN) ==_TRUE )
+		{ // BSSID is matched, the same AP => rewrite with new PMKID.
+			DBG_871X(FUNC_NDEV_FMT" BSSID exists in the PMKList.\n", FUNC_NDEV_ARG(netdev));
+
+			_rtw_memcpy( psecuritypriv->PMKIDList[index].PMKID, pmksa->pmkid, WLAN_PMKID_LEN);
+			psecuritypriv->PMKIDList[index].bUsed = _TRUE;
+			psecuritypriv->PMKIDIndex = index+1;
+			blInserted = _TRUE;
+			break;
+		}
+	}
+
+	if(!blInserted)
+	{
+		// Find a new entry
+		DBG_871X(FUNC_NDEV_FMT" Use the new entry index = %d for this PMKID.\n",
+			FUNC_NDEV_ARG(netdev), psecuritypriv->PMKIDIndex );
+
+		_rtw_memcpy(psecuritypriv->PMKIDList[psecuritypriv->PMKIDIndex].Bssid, pmksa->bssid, ETH_ALEN);
+		_rtw_memcpy(psecuritypriv->PMKIDList[psecuritypriv->PMKIDIndex].PMKID, pmksa->pmkid, WLAN_PMKID_LEN);
+
+		psecuritypriv->PMKIDList[psecuritypriv->PMKIDIndex].bUsed = _TRUE;
+		psecuritypriv->PMKIDIndex++ ;
+		if(psecuritypriv->PMKIDIndex==16)
+		{
+			psecuritypriv->PMKIDIndex =0;
+		}
+	}
+
+	return 0;
+}
+
+static int cfg80211_rtw_del_pmksa(struct wiphy *wiphy,
+				  struct net_device *netdev,
+				  struct cfg80211_pmksa *pmksa)
+{
+	u8	index, bMatched = _FALSE;
+	_adapter	*padapter = wiphy_to_adapter(wiphy);
+	struct security_priv	*psecuritypriv = &padapter->securitypriv;
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(netdev));
+
+	for(index=0 ; index<NUM_PMKID_CACHE; index++)
+	{
+		if( _rtw_memcmp( psecuritypriv->PMKIDList[index].Bssid, pmksa->bssid, ETH_ALEN) ==_TRUE )
+		{ // BSSID is matched, the same AP => Remove this PMKID information and reset it.
+			_rtw_memset( psecuritypriv->PMKIDList[index].Bssid, 0x00, ETH_ALEN );
+			_rtw_memset( psecuritypriv->PMKIDList[index].PMKID, 0x00, WLAN_PMKID_LEN );
+			psecuritypriv->PMKIDList[index].bUsed = _FALSE;
+			bMatched = _TRUE;
+			break;
+		}
+	}
+
+	if(_FALSE == bMatched)
+	{
+		DBG_871X(FUNC_NDEV_FMT" do not have matched BSSID\n"
+			, FUNC_NDEV_ARG(netdev));
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int cfg80211_rtw_flush_pmksa(struct wiphy *wiphy,
+				    struct net_device *netdev)
+{
+	_adapter	*padapter = wiphy_to_adapter(wiphy);
+	struct security_priv	*psecuritypriv = &padapter->securitypriv;
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(netdev));
+
+	_rtw_memset( &psecuritypriv->PMKIDList[ 0 ], 0x00, sizeof( RT_PMKID_LIST ) * NUM_PMKID_CACHE );
+	psecuritypriv->PMKIDIndex = 0;
+
+	return 0;
+}
+
+#ifdef CONFIG_AP_MODE
+void rtw_cfg80211_indicate_sta_assoc(_adapter *padapter, u8 *pmgmt_frame, uint frame_len)
+{
+	s32 freq;
+	int channel;
+	struct wireless_dev *pwdev = padapter->rtw_wdev;
+	struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
+	struct net_device *ndev = padapter->pnetdev;
+
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+
+#if defined(RTW_USE_CFG80211_STA_EVENT) || defined(COMPAT_KERNEL_RELEASE)
+	{
+		struct station_info sinfo;
+		u8 ie_offset;
+		if (GetFrameSubType(pmgmt_frame) == WIFI_ASSOCREQ)
+			ie_offset = _ASOCREQ_IE_OFFSET_;
+		else // WIFI_REASSOCREQ
+			ie_offset = _REASOCREQ_IE_OFFSET_;
+
+		sinfo.filled = 0;
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,0,0))
+		sinfo.filled = STATION_INFO_ASSOC_REQ_IES;
+#endif
+		sinfo.assoc_req_ies = pmgmt_frame + WLAN_HDR_A3_LEN + ie_offset;
+		sinfo.assoc_req_ies_len = frame_len - WLAN_HDR_A3_LEN - ie_offset;
+		cfg80211_new_sta(ndev, GetAddr2Ptr(pmgmt_frame), &sinfo, GFP_ATOMIC);
+	}
+#else /* defined(RTW_USE_CFG80211_STA_EVENT) */
+	channel = pmlmeext->cur_channel;
+	if (channel <= RTW_CH_MAX_2G_CHANNEL)
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_2GHZ);
+	else
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_5GHZ);
+
+	#ifdef COMPAT_KERNEL_RELEASE
+	rtw_cfg80211_rx_mgmt(padapter, freq, 0, pmgmt_frame, frame_len, GFP_ATOMIC);
+	#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) && !defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+	rtw_cfg80211_rx_mgmt(padapter, freq, 0, pmgmt_frame, frame_len, GFP_ATOMIC);
+	#else //COMPAT_KERNEL_RELEASE
+	{
+		//to avoid WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION)  when calling cfg80211_send_rx_assoc()
+		#ifndef CONFIG_PLATFORM_MSTAR
+		pwdev->iftype = NL80211_IFTYPE_STATION;
+		#endif //CONFIG_PLATFORM_MSTAR
+		DBG_8192C("iftype=%d before call cfg80211_send_rx_assoc()\n", pwdev->iftype);
+		rtw_cfg80211_send_rx_assoc(padapter, NULL, pmgmt_frame, frame_len);
+		DBG_8192C("iftype=%d after call cfg80211_send_rx_assoc()\n", pwdev->iftype);
+		pwdev->iftype = NL80211_IFTYPE_AP;
+		//cfg80211_rx_action(padapter->pnetdev, freq, pmgmt_frame, frame_len, GFP_ATOMIC);
+	}
+	#endif //COMPAT_KERNEL_RELEASE
+#endif /* defined(RTW_USE_CFG80211_STA_EVENT) */
+
+}
+
+void rtw_cfg80211_indicate_sta_disassoc(_adapter *padapter, unsigned char *da, unsigned short reason)
+{
+	s32 freq;
+	int channel;
+	u8 *pmgmt_frame;
+	uint frame_len;
+	struct rtw_ieee80211_hdr *pwlanhdr;
+	unsigned short *fctrl;
+	u8 mgmt_buf[128] = {0};
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct net_device *ndev = padapter->pnetdev;
+
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+
+#if defined(RTW_USE_CFG80211_STA_EVENT) || defined(COMPAT_KERNEL_RELEASE)
+	cfg80211_del_sta(ndev, da, GFP_ATOMIC);
+#else /* defined(RTW_USE_CFG80211_STA_EVENT) */
+	channel = pmlmeext->cur_channel;
+	if (channel <= RTW_CH_MAX_2G_CHANNEL)
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_2GHZ);
+	else
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_5GHZ);
+
+	pmgmt_frame = mgmt_buf;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pmgmt_frame;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	//_rtw_memcpy(pwlanhdr->addr1, da, ETH_ALEN);
+	//_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr1, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, da, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pmgmt_frame, WIFI_DEAUTH);
+
+	pmgmt_frame += sizeof(struct rtw_ieee80211_hdr_3addr);
+	frame_len = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	reason = cpu_to_le16(reason);
+	pmgmt_frame = rtw_set_fixed_ie(pmgmt_frame, _RSON_CODE_ , (unsigned char *)&reason, &frame_len);
+
+	#ifdef COMPAT_KERNEL_RELEASE
+	rtw_cfg80211_rx_mgmt(padapter, freq, 0, mgmt_buf, frame_len, GFP_ATOMIC);
+	#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) && !defined(CONFIG_CFG80211_FORCE_COMPATIBLE_2_6_37_UNDER)
+	rtw_cfg80211_rx_mgmt(padapter, freq, 0, mgmt_buf, frame_len, GFP_ATOMIC);
+	#else //COMPAT_KERNEL_RELEASE
+	cfg80211_send_disassoc(padapter->pnetdev, mgmt_buf, frame_len);
+	//cfg80211_rx_action(padapter->pnetdev, freq, mgmt_buf, frame_len, GFP_ATOMIC);
+	#endif //COMPAT_KERNEL_RELEASE
+#endif /* defined(RTW_USE_CFG80211_STA_EVENT) */
+}
+
+static int rtw_cfg80211_monitor_if_open(struct net_device *ndev)
+{
+	int ret = 0;
+
+	DBG_8192C("%s\n", __func__);
+
+	return ret;
+}
+
+static int rtw_cfg80211_monitor_if_close(struct net_device *ndev)
+{
+	int ret = 0;
+
+	DBG_8192C("%s\n", __func__);
+
+	return ret;
+}
+
+static int rtw_cfg80211_monitor_if_xmit_entry(struct sk_buff *skb, struct net_device *ndev)
+{
+	int ret = 0;
+	int rtap_len;
+	int qos_len = 0;
+	int dot11_hdr_len = 24;
+	int snap_len = 6;
+	unsigned char *pdata;
+	u16 frame_ctl;
+	unsigned char src_mac_addr[6];
+	unsigned char dst_mac_addr[6];
+	struct ieee80211_hdr *dot11_hdr;
+	struct ieee80211_radiotap_header *rtap_hdr;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(ndev);
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+	if (skb)
+		rtw_mstat_update(MSTAT_TYPE_SKB, MSTAT_ALLOC_SUCCESS, skb->truesize);
+
+	if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
+		goto fail;
+
+	rtap_hdr = (struct ieee80211_radiotap_header *)skb->data;
+	if (unlikely(rtap_hdr->it_version))
+		goto fail;
+
+	rtap_len = ieee80211_get_radiotap_len(skb->data);
+	if (unlikely(skb->len < rtap_len))
+		goto fail;
+
+	if(rtap_len != 14)
+	{
+		DBG_8192C("radiotap len (should be 14): %d\n", rtap_len);
+		goto fail;
+	}
+
+	/* Skip the ratio tap header */
+	skb_pull(skb, rtap_len);
+
+	dot11_hdr = (struct ieee80211_hdr *)skb->data;
+	frame_ctl = le16_to_cpu(dot11_hdr->frame_control);
+	/* Check if the QoS bit is set */
+	if ((frame_ctl & RTW_IEEE80211_FCTL_FTYPE) == RTW_IEEE80211_FTYPE_DATA) {
+		/* Check if this ia a Wireless Distribution System (WDS) frame
+		 * which has 4 MAC addresses
+		 */
+		if (dot11_hdr->frame_control & 0x0080)
+			qos_len = 2;
+		if ((dot11_hdr->frame_control & 0x0300) == 0x0300)
+			dot11_hdr_len += 6;
+
+		memcpy(dst_mac_addr, dot11_hdr->addr1, sizeof(dst_mac_addr));
+		memcpy(src_mac_addr, dot11_hdr->addr2, sizeof(src_mac_addr));
+
+		/* Skip the 802.11 header, QoS (if any) and SNAP, but leave spaces for
+		 * for two MAC addresses
+		 */
+		skb_pull(skb, dot11_hdr_len + qos_len + snap_len - sizeof(src_mac_addr) * 2);
+		pdata = (unsigned char*)skb->data;
+		memcpy(pdata, dst_mac_addr, sizeof(dst_mac_addr));
+		memcpy(pdata + sizeof(dst_mac_addr), src_mac_addr, sizeof(src_mac_addr));
+
+		DBG_8192C("should be eapol packet\n");
+
+		/* Use the real net device to transmit the packet */
+		ret = _rtw_xmit_entry(skb, padapter->pnetdev);
+
+		return ret;
+
+	}
+	else if ((frame_ctl & (RTW_IEEE80211_FCTL_FTYPE|RTW_IEEE80211_FCTL_STYPE))
+		== (RTW_IEEE80211_FTYPE_MGMT|RTW_IEEE80211_STYPE_ACTION)
+	)
+	{
+		//only for action frames
+		struct xmit_frame		*pmgntframe;
+		struct pkt_attrib	*pattrib;
+		unsigned char	*pframe;
+		//u8 category, action, OUI_Subtype, dialogToken=0;
+		//unsigned char	*frame_body;
+		struct rtw_ieee80211_hdr *pwlanhdr;
+		struct xmit_priv	*pxmitpriv = &(padapter->xmitpriv);
+		struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+		u8 *buf = skb->data;
+		u32 len = skb->len;
+		u8 category, action;
+		int type = -1;
+
+		if (rtw_action_frame_parse(buf, len, &category, &action) == _FALSE) {
+			DBG_8192C(FUNC_NDEV_FMT" frame_control:0x%x\n", FUNC_NDEV_ARG(ndev),
+				le16_to_cpu(((struct rtw_ieee80211_hdr_3addr *)buf)->frame_ctl));
+			goto fail;
+		}
+
+		DBG_8192C("RTW_Tx:da="MAC_FMT" via "FUNC_NDEV_FMT"\n",
+			MAC_ARG(GetAddr1Ptr(buf)), FUNC_NDEV_ARG(ndev));
+		#ifdef CONFIG_P2P
+		if((type = rtw_p2p_check_frames(padapter, buf, len, _TRUE)) >= 0)
+			goto dump;
+		#endif
+		if (category == RTW_WLAN_CATEGORY_PUBLIC)
+			DBG_871X("RTW_Tx:%s\n", action_public_str(action));
+		else
+			DBG_871X("RTW_Tx:category(%u), action(%u)\n", category, action);
+
+dump:
+		//starting alloc mgmt frame to dump it
+		if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+		{
+			goto fail;
+		}
+
+		//update attribute
+		pattrib = &pmgntframe->attrib;
+		update_mgntframe_attrib(padapter, pattrib);
+		pattrib->retry_ctrl = _FALSE;
+
+		_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+		pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+
+		_rtw_memcpy(pframe, (void*)buf, len);
+		#ifdef CONFIG_WFD
+		if (type >= 0)
+		{
+			struct wifi_display_info		*pwfd_info;
+
+			pwfd_info = padapter->wdinfo.wfd_info;
+
+			if ( _TRUE == pwfd_info->wfd_enable )
+			{
+				rtw_append_wfd_ie( padapter, pframe, &len );
+			}
+		}
+		#endif // CONFIG_WFD
+		pattrib->pktlen = len;
+
+		pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+		//update seq number
+		pmlmeext->mgnt_seq = GetSequence(pwlanhdr);
+		pattrib->seqnum = pmlmeext->mgnt_seq;
+		pmlmeext->mgnt_seq++;
+
+
+		pattrib->last_txcmdsz = pattrib->pktlen;
+
+		dump_mgntframe(padapter, pmgntframe);
+
+	}
+	else
+	{
+		DBG_8192C("frame_ctl=0x%x\n", frame_ctl & (RTW_IEEE80211_FCTL_FTYPE|RTW_IEEE80211_FCTL_STYPE));
+	}
+
+
+fail:
+
+	dev_kfree_skb(skb);
+
+	return 0;
+
+}
+
+static void rtw_cfg80211_monitor_if_set_multicast_list(struct net_device *ndev)
+{
+	DBG_8192C("%s\n", __func__);
+}
+
+static int rtw_cfg80211_monitor_if_set_mac_address(struct net_device *ndev, void *addr)
+{
+	int ret = 0;
+
+	DBG_8192C("%s\n", __func__);
+
+	return ret;
+}
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+static const struct net_device_ops rtw_cfg80211_monitor_if_ops = {
+	.ndo_open = rtw_cfg80211_monitor_if_open,
+       .ndo_stop = rtw_cfg80211_monitor_if_close,
+       .ndo_start_xmit = rtw_cfg80211_monitor_if_xmit_entry,
+       #if (LINUX_VERSION_CODE < KERNEL_VERSION(3,2,0))
+       .ndo_set_multicast_list = rtw_cfg80211_monitor_if_set_multicast_list,
+       #endif
+       .ndo_set_mac_address = rtw_cfg80211_monitor_if_set_mac_address,
+};
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,1,0))
+static int rtw_cfg80211_add_monitor_if(_adapter *padapter, char *name, unsigned char name_assign_type, struct net_device **ndev)
+#else
+static int rtw_cfg80211_add_monitor_if(_adapter *padapter, char *name, struct net_device **ndev)
+#endif
+{
+	int ret = 0;
+	struct net_device* mon_ndev = NULL;
+	struct wireless_dev* mon_wdev = NULL;
+	struct rtw_netdev_priv_indicator *pnpi;
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(padapter->rtw_wdev);
+
+	if (!name ) {
+		DBG_871X(FUNC_ADPT_FMT" without specific name\n", FUNC_ADPT_ARG(padapter));
+		ret = -EINVAL;
+		goto out;
+	}
+
+	if (pwdev_priv->pmon_ndev) {
+		DBG_871X(FUNC_ADPT_FMT" monitor interface exist: "NDEV_FMT"\n",
+			FUNC_ADPT_ARG(padapter), NDEV_ARG(pwdev_priv->pmon_ndev));
+		ret = -EBUSY;
+		goto out;
+	}
+
+	mon_ndev = alloc_etherdev(sizeof(struct rtw_netdev_priv_indicator));
+	if (!mon_ndev) {
+		DBG_871X(FUNC_ADPT_FMT" allocate ndev fail\n", FUNC_ADPT_ARG(padapter));
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	mon_ndev->type = ARPHRD_IEEE80211_RADIOTAP;
+	strncpy(mon_ndev->name, name, IFNAMSIZ);
+	mon_ndev->name[IFNAMSIZ - 1] = 0;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,1,0))
+	mon_ndev->name_assign_type = name_assign_type;
+#endif
+	mon_ndev->needs_free_netdev = true;
+	mon_ndev->priv_destructor = rtw_ndev_destructor;
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+	mon_ndev->netdev_ops = &rtw_cfg80211_monitor_if_ops;
+#else
+	mon_ndev->open = rtw_cfg80211_monitor_if_open;
+	mon_ndev->stop = rtw_cfg80211_monitor_if_close;
+	mon_ndev->hard_start_xmit = rtw_cfg80211_monitor_if_xmit_entry;
+	mon_ndev->set_mac_address = rtw_cfg80211_monitor_if_set_mac_address;
+#endif
+
+	pnpi = netdev_priv(mon_ndev);
+	pnpi->priv = padapter;
+	pnpi->sizeof_priv = sizeof(_adapter);
+
+	/*  wdev */
+	mon_wdev = (struct wireless_dev *)rtw_zmalloc(sizeof(struct wireless_dev));
+	if (!mon_wdev) {
+		DBG_871X(FUNC_ADPT_FMT" allocate mon_wdev fail\n", FUNC_ADPT_ARG(padapter));
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	mon_wdev->wiphy = padapter->rtw_wdev->wiphy;
+	mon_wdev->netdev = mon_ndev;
+	mon_wdev->iftype = NL80211_IFTYPE_MONITOR;
+	mon_ndev->ieee80211_ptr = mon_wdev;
+
+	ret = register_netdevice(mon_ndev);
+	if (ret) {
+		goto out;
+	}
+
+	*ndev = pwdev_priv->pmon_ndev = mon_ndev;
+	_rtw_memcpy(pwdev_priv->ifname_mon, name, IFNAMSIZ+1);
+
+out:
+	if (ret && mon_wdev) {
+		rtw_mfree((u8*)mon_wdev, sizeof(struct wireless_dev));
+		mon_wdev = NULL;
+	}
+
+	if (ret && mon_ndev) {
+		free_netdev(mon_ndev);
+		*ndev = mon_ndev = NULL;
+	}
+
+	return ret;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0))
+static struct wireless_dev *
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)) || defined(COMPAT_KERNEL_RELEASE)
+static struct net_device *
+#else
+static int
+#endif
+	cfg80211_rtw_add_virtual_intf(
+		struct wiphy *wiphy,
+	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,7,0))
+		const char *name,
+	#else
+		char *name,
+	#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,1,0))
+		unsigned char name_assign_type,
+#endif
+	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0))
+		enum nl80211_iftype type, struct vif_params *params)
+	#else
+		enum nl80211_iftype type, u32 *flags, struct vif_params *params)
+	#endif
+{
+	int ret = 0;
+	struct net_device* ndev = NULL;
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+
+	DBG_871X(FUNC_ADPT_FMT " wiphy:%s, name:%s, type:%d\n",
+		FUNC_ADPT_ARG(padapter), wiphy_name(wiphy), name, type);
+
+	switch (type) {
+	case NL80211_IFTYPE_ADHOC:
+	case NL80211_IFTYPE_AP_VLAN:
+	case NL80211_IFTYPE_WDS:
+	case NL80211_IFTYPE_MESH_POINT:
+		ret = -ENODEV;
+		break;
+	case NL80211_IFTYPE_MONITOR:
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,1,0))
+		ret = rtw_cfg80211_add_monitor_if(padapter, (char *)name, name_assign_type, &ndev);
+#else
+		ret = rtw_cfg80211_add_monitor_if(padapter, (char *)name, &ndev);
+#endif
+		break;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+	case NL80211_IFTYPE_P2P_CLIENT:
+#endif
+	case NL80211_IFTYPE_STATION:
+		ret = -ENODEV;
+		break;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+	case NL80211_IFTYPE_P2P_GO:
+#endif
+	case NL80211_IFTYPE_AP:
+		ret = -ENODEV;
+		break;
+	default:
+		ret = -ENODEV;
+		DBG_871X("Unsupported interface type\n");
+		break;
+	}
+
+	DBG_871X(FUNC_ADPT_FMT" ndev:%p, ret:%d\n", FUNC_ADPT_ARG(padapter), ndev, ret);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0))
+	return ndev ? ndev->ieee80211_ptr : ERR_PTR(ret);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)) || defined(COMPAT_KERNEL_RELEASE)
+	return ndev ? ndev : ERR_PTR(ret);
+#else
+	return ret;
+#endif
+}
+
+static int cfg80211_rtw_del_virtual_intf(struct wiphy *wiphy,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0))
+	struct wireless_dev *wdev
+#else
+	struct net_device *ndev
+#endif
+)
+{
+	struct rtw_wdev_priv *pwdev_priv = (struct rtw_wdev_priv *)wiphy_priv(wiphy);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0))
+	struct net_device *ndev;
+	ndev = wdev ? wdev->netdev : NULL;
+#endif
+
+	if (!ndev)
+		goto exit;
+
+	unregister_netdevice(ndev);
+
+	if (ndev == pwdev_priv->pmon_ndev) {
+		pwdev_priv->pmon_ndev = NULL;
+		pwdev_priv->ifname_mon[0] = '\0';
+		DBG_871X(FUNC_NDEV_FMT" remove monitor interface\n", FUNC_NDEV_ARG(ndev));
+	}
+
+exit:
+	return 0;
+}
+
+static int rtw_add_beacon(_adapter *adapter, const u8 *head, size_t head_len, const u8 *tail, size_t tail_len)
+{
+	int ret=0;
+	u8 *pbuf = NULL;
+	uint len, wps_ielen=0;
+	uint p2p_ielen=0;
+	u8 *p2p_ie;
+	u8 got_p2p_ie = _FALSE;
+	struct mlme_priv *pmlmepriv = &(adapter->mlmepriv);
+	//struct sta_priv *pstapriv = &padapter->stapriv;
+
+
+	DBG_8192C("%s beacon_head_len=%zu, beacon_tail_len=%zu\n", __FUNCTION__, head_len, tail_len);
+
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EINVAL;
+
+	if(head_len<24)
+		return -EINVAL;
+
+
+	pbuf = rtw_zmalloc(head_len+tail_len);
+	if(!pbuf)
+		return -ENOMEM;
+
+
+	//_rtw_memcpy(&pstapriv->max_num_sta, param->u.bcn_ie.reserved, 2);
+
+	//if((pstapriv->max_num_sta>NUM_STA) || (pstapriv->max_num_sta<=0))
+	//	pstapriv->max_num_sta = NUM_STA;
+
+
+	_rtw_memcpy(pbuf, (void *)head+24, head_len-24);// 24=beacon header len.
+	_rtw_memcpy(pbuf+head_len-24, (void *)tail, tail_len);
+
+	len = head_len+tail_len-24;
+
+	//check wps ie if inclued
+	if(rtw_get_wps_ie(pbuf+_FIXED_IE_LENGTH_, len-_FIXED_IE_LENGTH_, NULL, &wps_ielen))
+		DBG_8192C("add bcn, wps_ielen=%d\n", wps_ielen);
+
+#ifdef CONFIG_P2P
+	//check p2p ie if inclued
+	if( adapter->wdinfo.driver_interface == DRIVER_CFG80211 )
+	{
+		//check p2p if enable
+		if(rtw_get_p2p_ie(pbuf+_FIXED_IE_LENGTH_, len-_FIXED_IE_LENGTH_, NULL, &p2p_ielen))
+		{
+			struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
+			struct wifidirect_info *pwdinfo= &(adapter->wdinfo);
+
+			DBG_8192C("got p2p_ie, len=%d\n", p2p_ielen);
+			got_p2p_ie = _TRUE;
+
+			if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+			{
+				DBG_8192C("Enable P2P function for the first time\n");
+				rtw_p2p_enable(adapter, P2P_ROLE_GO);
+				wdev_to_priv(adapter->rtw_wdev)->p2p_enabled = _TRUE;
+			}
+			else
+			{
+				_cancel_timer_ex( &pwdinfo->find_phase_timer );
+				_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+				_cancel_timer_ex( &pwdinfo->pre_tx_scan_timer);
+
+				DBG_8192C("enter GO Mode, p2p_ielen=%d\n", p2p_ielen);
+
+				rtw_p2p_set_role(pwdinfo, P2P_ROLE_GO);
+				rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_OK);
+				pwdinfo->intent = 15;
+			}
+		}
+	}
+#endif // CONFIG_P2P
+
+	/* pbss_network->IEs will not include p2p_ie, wfd ie */
+	rtw_ies_remove_ie(pbuf, &len, _BEACON_IE_OFFSET_, _VENDOR_SPECIFIC_IE_, P2P_OUI, 4);
+	rtw_ies_remove_ie(pbuf, &len, _BEACON_IE_OFFSET_, _VENDOR_SPECIFIC_IE_, WFD_OUI, 4);
+
+	if (rtw_check_beacon_data(adapter, pbuf,  len) == _SUCCESS)
+	{
+#ifdef  CONFIG_P2P
+		//check p2p if enable
+		if(got_p2p_ie == _TRUE)
+		{
+			struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
+			struct wifidirect_info *pwdinfo= &(adapter->wdinfo);
+			pwdinfo->operating_channel = pmlmeext->cur_channel;
+		}
+#endif //CONFIG_P2P
+		ret = 0;
+	}
+	else
+	{
+		ret = -EINVAL;
+	}
+
+
+	rtw_mfree(pbuf, head_len+tail_len);
+
+	return ret;
+}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,4,0)) && !defined(COMPAT_KERNEL_RELEASE)
+static int	cfg80211_rtw_add_beacon(struct wiphy *wiphy, struct net_device *ndev,
+			      struct beacon_parameters *info)
+{
+	int ret=0;
+	_adapter *adapter = wiphy_to_adapter(wiphy);
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	ret = rtw_add_beacon(adapter, info->head, info->head_len, info->tail, info->tail_len);
+
+	return ret;
+}
+
+static int	cfg80211_rtw_set_beacon(struct wiphy *wiphy, struct net_device *ndev,
+			      struct beacon_parameters *info)
+{
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+	pmlmeext->bstart_bss = _TRUE;
+
+	cfg80211_rtw_add_beacon(wiphy, ndev, info);
+
+	return 0;
+}
+
+static int	cfg80211_rtw_del_beacon(struct wiphy *wiphy, struct net_device *ndev)
+{
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+	return 0;
+}
+#else
+static int cfg80211_rtw_start_ap(struct wiphy *wiphy, struct net_device *ndev,
+								struct cfg80211_ap_settings *settings)
+{
+	int ret = 0;
+	_adapter *adapter = wiphy_to_adapter(wiphy);
+
+	DBG_871X(FUNC_NDEV_FMT" hidden_ssid:%d, auth_type:%d\n", FUNC_NDEV_ARG(ndev),
+		settings->hidden_ssid, settings->auth_type);
+
+	ret = rtw_add_beacon(adapter, settings->beacon.head, settings->beacon.head_len,
+		settings->beacon.tail, settings->beacon.tail_len);
+
+	adapter->mlmeextpriv.mlmext_info.hidden_ssid_mode = settings->hidden_ssid;
+
+	if (settings->ssid && settings->ssid_len) {
+		WLAN_BSSID_EX *pbss_network = &adapter->mlmepriv.cur_network.network;
+		WLAN_BSSID_EX *pbss_network_ext = &adapter->mlmeextpriv.mlmext_info.network;
+
+		if(0)
+		DBG_871X(FUNC_ADPT_FMT" ssid:(%s,%d), from ie:(%s,%d)\n", FUNC_ADPT_ARG(adapter),
+			settings->ssid, settings->ssid_len,
+			pbss_network->Ssid.Ssid, pbss_network->Ssid.SsidLength);
+
+		_rtw_memcpy(pbss_network->Ssid.Ssid, (void *)settings->ssid, settings->ssid_len);
+		pbss_network->Ssid.SsidLength = settings->ssid_len;
+		_rtw_memcpy(pbss_network_ext->Ssid.Ssid, (void *)settings->ssid, settings->ssid_len);
+		pbss_network_ext->Ssid.SsidLength = settings->ssid_len;
+
+		if(0)
+		DBG_871X(FUNC_ADPT_FMT" after ssid:(%s,%d), (%s,%d)\n", FUNC_ADPT_ARG(adapter),
+			pbss_network->Ssid.Ssid, pbss_network->Ssid.SsidLength,
+			pbss_network_ext->Ssid.Ssid, pbss_network_ext->Ssid.SsidLength);
+	}
+
+	return ret;
+}
+
+static int cfg80211_rtw_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
+                                struct cfg80211_beacon_data *info)
+{
+	int ret = 0;
+	_adapter *adapter = wiphy_to_adapter(wiphy);
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+	ret = rtw_add_beacon(adapter, info->head, info->head_len, info->tail, info->tail_len);
+
+	return ret;
+}
+
+static int cfg80211_rtw_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
+{
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	return 0;
+}
+
+#endif //(LINUX_VERSION_CODE < KERNEL_VERSION(3,4,0))
+
+static int	cfg80211_rtw_add_station(struct wiphy *wiphy, struct net_device *ndev,
+			       const u8 *mac, struct station_parameters *params)
+{
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+	return 0;
+}
+
+static int	cfg80211_rtw_del_station(struct wiphy *wiphy, struct net_device *ndev,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,15,0))
+			       u8 *mac) {
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(4,1,0))
+                   const u8 *mac) {
+#else
+                   struct station_del_parameters *params)
+{
+    const u8 *mac = params->mac;
+#endif
+	int ret=0;
+	_irqL irqL;
+	_list	*phead, *plist;
+	u8 updated = _FALSE;
+	struct sta_info *psta = NULL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(ndev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	DBG_871X("+"FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+	if(check_fwstate(pmlmepriv, (_FW_LINKED|WIFI_AP_STATE)) != _TRUE)
+	{
+		DBG_8192C("%s, fw_state != FW_LINKED|WIFI_AP_STATE\n", __func__);
+		return -EINVAL;
+	}
+
+
+	if(!mac)
+	{
+		DBG_8192C("flush all sta, and cam_entry\n");
+
+		flush_all_cam_entry(padapter);	//clear CAM
+
+		ret = rtw_sta_flush(padapter);
+
+		return ret;
+	}
+
+
+	DBG_8192C("free sta macaddr =" MAC_FMT "\n", MAC_ARG(mac));
+
+	if (mac[0] == 0xff && mac[1] == 0xff &&
+	    mac[2] == 0xff && mac[3] == 0xff &&
+	    mac[4] == 0xff && mac[5] == 0xff)
+	{
+		return -EINVAL;
+	}
+
+
+	_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	phead = &pstapriv->asoc_list;
+	plist = get_next(phead);
+
+	//check asoc_queue
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+	{
+		psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
+
+		plist = get_next(plist);
+
+		if(_rtw_memcmp(mac, psta->hwaddr, ETH_ALEN))
+		{
+			if(psta->dot8021xalg == 1 && psta->bpairwise_key_installed == _FALSE)
+			{
+				DBG_8192C("%s, sta's dot8021xalg = 1 and key_installed = _FALSE\n", __func__);
+			}
+			else
+			{
+				DBG_8192C("free psta=%p, aid=%d\n", psta, psta->aid);
+
+				rtw_list_delete(&psta->asoc_list);
+				pstapriv->asoc_list_cnt--;
+
+				//_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+				updated = ap_free_sta(padapter, psta, _TRUE, WLAN_REASON_DEAUTH_LEAVING);
+				//_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+				psta = NULL;
+
+				break;
+			}
+
+		}
+
+	}
+
+	_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	associated_clients_update(padapter, updated);
+
+	DBG_871X("-"FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+	return ret;
+
+}
+
+static int	cfg80211_rtw_change_station(struct wiphy *wiphy, struct net_device *ndev,
+				  const u8 *mac, struct station_parameters *params)
+{
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+	return 0;
+}
+
+static int	cfg80211_rtw_dump_station(struct wiphy *wiphy, struct net_device *ndev,
+			       int idx, u8 *mac, struct station_info *sinfo)
+{
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+	//TODO: dump scanned queue
+
+	return -ENOENT;
+}
+
+static int	cfg80211_rtw_change_bss(struct wiphy *wiphy, struct net_device *ndev,
+			      struct bss_parameters *params)
+{
+	u8 i;
+
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+/*
+	DBG_8192C("use_cts_prot=%d\n", params->use_cts_prot);
+	DBG_8192C("use_short_preamble=%d\n", params->use_short_preamble);
+	DBG_8192C("use_short_slot_time=%d\n", params->use_short_slot_time);
+	DBG_8192C("ap_isolate=%d\n", params->ap_isolate);
+
+	DBG_8192C("basic_rates_len=%d\n", params->basic_rates_len);
+	for(i=0; i<params->basic_rates_len; i++)
+	{
+		DBG_8192C("basic_rates=%d\n", params->basic_rates[i]);
+
+	}
+*/
+	return 0;
+
+}
+
+static int	cfg80211_rtw_set_channel(struct wiphy *wiphy
+	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
+	, struct net_device *ndev
+	#endif
+	, struct ieee80211_channel *chan, enum nl80211_channel_type channel_type)
+{
+	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+	#endif
+
+	return 0;
+}
+
+static int	cfg80211_rtw_auth(struct wiphy *wiphy, struct net_device *ndev,
+			struct cfg80211_auth_request *req)
+{
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+	return 0;
+}
+
+static int	cfg80211_rtw_assoc(struct wiphy *wiphy, struct net_device *ndev,
+			 struct cfg80211_assoc_request *req)
+{
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+	return 0;
+}
+#endif //CONFIG_AP_MODE
+
+void rtw_cfg80211_rx_action_p2p(_adapter *padapter, u8 *pmgmt_frame, uint frame_len)
+{
+	int type;
+	s32 freq;
+	int channel;
+	struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
+	u8 category, action;
+
+	channel = rtw_get_oper_ch(padapter);
+
+	DBG_8192C("RTW_Rx:cur_ch=%d\n", channel);
+	#ifdef CONFIG_P2P
+	type = rtw_p2p_check_frames(padapter, pmgmt_frame, frame_len, _FALSE);
+	if (type >= 0)
+		goto indicate;
+	#endif
+	rtw_action_frame_parse(pmgmt_frame, frame_len, &category, &action);
+	DBG_871X("RTW_Rx:category(%u), action(%u)\n", category, action);
+
+indicate:
+	if (channel <= RTW_CH_MAX_2G_CHANNEL)
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_2GHZ);
+	else
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_5GHZ);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+	rtw_cfg80211_rx_mgmt(padapter, freq, 0, pmgmt_frame, frame_len, GFP_ATOMIC);
+#else
+	cfg80211_rx_action(padapter->pnetdev, freq, pmgmt_frame, frame_len, GFP_ATOMIC);
+#endif
+}
+
+void rtw_cfg80211_rx_p2p_action_public(_adapter *padapter, u8 *pmgmt_frame, uint frame_len)
+{
+	int type;
+	s32 freq;
+	int channel;
+	struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
+	u8 category, action;
+
+	channel = rtw_get_oper_ch(padapter);
+
+	DBG_8192C("RTW_Rx:cur_ch=%d\n", channel);
+	#ifdef CONFIG_P2P
+	type = rtw_p2p_check_frames(padapter, pmgmt_frame, frame_len, _FALSE);
+	if (type >= 0) {
+		switch (type) {
+		case P2P_GO_NEGO_CONF:
+		case P2P_PROVISION_DISC_RESP:
+		case P2P_INVIT_RESP:
+			rtw_set_scan_deny(padapter, 2000);
+			rtw_clear_scan_deny(padapter);
+		}
+		goto indicate;
+	}
+	#endif
+	rtw_action_frame_parse(pmgmt_frame, frame_len, &category, &action);
+	DBG_871X("RTW_Rx:category(%u), action(%u)\n", category, action);
+
+indicate:
+	if (channel <= RTW_CH_MAX_2G_CHANNEL)
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_2GHZ);
+	else
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_5GHZ);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+	rtw_cfg80211_rx_mgmt(padapter, freq, 0, pmgmt_frame, frame_len, GFP_ATOMIC);
+#else
+	cfg80211_rx_action(padapter->pnetdev, freq, pmgmt_frame, frame_len, GFP_ATOMIC);
+#endif
+}
+
+void rtw_cfg80211_rx_action(_adapter *adapter, u8 *frame, uint frame_len, const char*msg)
+{
+	s32 freq;
+	int channel;
+	struct mlme_ext_priv *pmlmeext = &(adapter->mlmeextpriv);
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(adapter->rtw_wdev);
+	u8 category, action;
+
+	channel = rtw_get_oper_ch(adapter);
+
+	rtw_action_frame_parse(frame, frame_len, &category, &action);
+
+	DBG_8192C("RTW_Rx:cur_ch=%d\n", channel);
+	if (msg)
+		DBG_871X("RTW_Rx:%s\n", msg);
+	else
+		DBG_871X("RTW_Rx:category(%u), action(%u)\n", category, action);
+
+	if (channel <= RTW_CH_MAX_2G_CHANNEL)
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_2GHZ);
+	else
+		freq = rtw_ieee80211_channel_to_frequency(channel, NL80211_BAND_5GHZ);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+	rtw_cfg80211_rx_mgmt(adapter, freq, 0, frame, frame_len, GFP_ATOMIC);
+#else
+	cfg80211_rx_action(adapter->pnetdev, freq, frame, frame_len, GFP_ATOMIC);
+#endif
+
+}
+
+#ifdef CONFIG_P2P
+void rtw_cfg80211_issue_p2p_provision_request(_adapter *padapter, const u8 *buf, size_t len)
+{
+	u16	wps_devicepassword_id = 0x0000;
+	uint	wps_devicepassword_id_len = 0;
+	u8			wpsie[ 255 ] = { 0x00 }, p2p_ie[ 255 ] = { 0x00 };
+	uint			p2p_ielen = 0;
+	uint			wpsielen = 0;
+	u32	devinfo_contentlen = 0;
+	u8	devinfo_content[64] = { 0x00 };
+	u16	capability = 0;
+	uint capability_len = 0;
+
+	unsigned char category = RTW_WLAN_CATEGORY_PUBLIC;
+	u8			action = P2P_PUB_ACTION_ACTION;
+	u8			dialogToken = 1;
+	u32			p2poui = cpu_to_be32(P2POUI);
+	u8			oui_subtype = P2P_PROVISION_DISC_REQ;
+	u32			p2pielen = 0;
+#ifdef CONFIG_WFD
+	u32					wfdielen = 0;
+#endif //CONFIG_WFD
+
+	struct xmit_frame			*pmgntframe;
+	struct pkt_attrib			*pattrib;
+	unsigned char					*pframe;
+	struct rtw_ieee80211_hdr	*pwlanhdr;
+	unsigned short				*fctrl;
+	struct xmit_priv			*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
+	u8 *frame_body = (unsigned char *)(buf + sizeof(struct rtw_ieee80211_hdr_3addr));
+	size_t frame_body_len = len - sizeof(struct rtw_ieee80211_hdr_3addr);
+
+
+	DBG_871X( "[%s] In\n", __FUNCTION__ );
+
+	//prepare for building provision_request frame
+	_rtw_memcpy(pwdinfo->tx_prov_disc_info.peerIFAddr, GetAddr1Ptr(buf), ETH_ALEN);
+	_rtw_memcpy(pwdinfo->tx_prov_disc_info.peerDevAddr, GetAddr1Ptr(buf), ETH_ALEN);
+
+	pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_PUSH_BUTTON;
+
+	rtw_get_wps_ie( frame_body + _PUBLIC_ACTION_IE_OFFSET_, frame_body_len - _PUBLIC_ACTION_IE_OFFSET_, wpsie, &wpsielen);
+	rtw_get_wps_attr_content( wpsie, wpsielen, WPS_ATTR_DEVICE_PWID, (u8*) &wps_devicepassword_id, &wps_devicepassword_id_len);
+	wps_devicepassword_id = be16_to_cpu( wps_devicepassword_id );
+
+	switch(wps_devicepassword_id)
+	{
+		case WPS_DPID_PIN:
+			pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_LABEL;
+			break;
+		case WPS_DPID_USER_SPEC:
+			pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_DISPLYA;
+			break;
+		case WPS_DPID_MACHINE_SPEC:
+			break;
+		case WPS_DPID_REKEY:
+			break;
+		case WPS_DPID_PBC:
+			pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_PUSH_BUTTON;
+			break;
+		case WPS_DPID_REGISTRAR_SPEC:
+			pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_KEYPAD;
+			break;
+		default:
+			break;
+	}
+
+
+	if ( rtw_get_p2p_ie( frame_body + _PUBLIC_ACTION_IE_OFFSET_, frame_body_len - _PUBLIC_ACTION_IE_OFFSET_, p2p_ie, &p2p_ielen ) )
+	{
+
+		rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_DEVICE_INFO, devinfo_content, &devinfo_contentlen);
+		rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_CAPABILITY, (u8*)&capability, &capability_len);
+
+	}
+
+
+	//start to build provision_request frame
+	_rtw_memset(wpsie, 0, sizeof(wpsie));
+	_rtw_memset(p2p_ie, 0, sizeof(p2p_ie));
+	p2p_ielen = 0;
+
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		return;
+	}
+
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+
+	fctrl = &(pwlanhdr->frame_ctl);
+	*(fctrl) = 0;
+
+	_rtw_memcpy(pwlanhdr->addr1, pwdinfo->tx_prov_disc_info.peerDevAddr, ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
+	_rtw_memcpy(pwlanhdr->addr3, pwdinfo->tx_prov_disc_info.peerDevAddr, ETH_ALEN);
+
+	SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
+	pmlmeext->mgnt_seq++;
+	SetFrameSubType(pframe, WIFI_ACTION);
+
+	pframe += sizeof(struct rtw_ieee80211_hdr_3addr);
+	pattrib->pktlen = sizeof(struct rtw_ieee80211_hdr_3addr);
+
+	pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *) &(p2poui), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(oui_subtype), &(pattrib->pktlen));
+	pframe = rtw_set_fixed_ie(pframe, 1, &(dialogToken), &(pattrib->pktlen));
+
+
+	//build_prov_disc_request_p2p_ie
+	//	P2P OUI
+	p2pielen = 0;
+	p2p_ie[ p2pielen++ ] = 0x50;
+	p2p_ie[ p2pielen++ ] = 0x6F;
+	p2p_ie[ p2pielen++ ] = 0x9A;
+	p2p_ie[ p2pielen++ ] = 0x09;	//	WFA P2P v1.0
+
+	//	Commented by Albert 20110301
+	//	According to the P2P Specification, the provision discovery request frame should contain 3 P2P attributes
+	//	1. P2P Capability
+	//	2. Device Info
+	//	3. Group ID ( When joining an operating P2P Group )
+
+	//	P2P Capability ATTR
+	//	Type:
+	p2p_ie[ p2pielen++ ] = P2P_ATTR_CAPABILITY;
+
+	//	Length:
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 0x0002 );
+	RTW_PUT_LE16(p2p_ie + p2pielen, 0x0002);
+	p2pielen += 2;
+
+	//	Value:
+	//	Device Capability Bitmap, 1 byte
+	//	Group Capability Bitmap, 1 byte
+	_rtw_memcpy(p2p_ie + p2pielen, &capability, 2);
+	p2pielen += 2;
+
+
+	//	Device Info ATTR
+	//	Type:
+	p2p_ie[ p2pielen++ ] = P2P_ATTR_DEVICE_INFO;
+
+	//	Length:
+	//	21 -> P2P Device Address (6bytes) + Config Methods (2bytes) + Primary Device Type (8bytes)
+	//	+ NumofSecondDevType (1byte) + WPS Device Name ID field (2bytes) + WPS Device Name Len field (2bytes)
+	//*(u16*) ( p2pie + p2pielen ) = cpu_to_le16( 21 + pwdinfo->device_name_len );
+	RTW_PUT_LE16(p2p_ie + p2pielen, devinfo_contentlen);
+	p2pielen += 2;
+
+	//	Value:
+	_rtw_memcpy(p2p_ie + p2pielen, devinfo_content, devinfo_contentlen);
+	p2pielen += devinfo_contentlen;
+
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, p2pielen, (unsigned char *) p2p_ie, &p2p_ielen);
+	//p2pielen = build_prov_disc_request_p2p_ie( pwdinfo, pframe, NULL, 0, pwdinfo->tx_prov_disc_info.peerDevAddr);
+	//pframe += p2pielen;
+	pattrib->pktlen += p2p_ielen;
+
+	wpsielen = 0;
+	//	WPS OUI
+	*(u32*) ( wpsie ) = cpu_to_be32( WPSOUI );
+	wpsielen += 4;
+
+	//	WPS version
+	//	Type:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_VER1 );
+	wpsielen += 2;
+
+	//	Length:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0001 );
+	wpsielen += 2;
+
+	//	Value:
+	wpsie[wpsielen++] = WPS_VERSION_1;	//	Version 1.0
+
+	//	Config Method
+	//	Type:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( WPS_ATTR_CONF_METHOD );
+	wpsielen += 2;
+
+	//	Length:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( 0x0002 );
+	wpsielen += 2;
+
+	//	Value:
+	*(u16*) ( wpsie + wpsielen ) = cpu_to_be16( pwdinfo->tx_prov_disc_info.wps_config_method_request );
+	wpsielen += 2;
+
+	pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, wpsielen, (unsigned char *) wpsie, &pattrib->pktlen );
+
+
+#ifdef CONFIG_WFD
+	wfdielen = build_provdisc_req_wfd_ie(pwdinfo, pframe);
+	pframe += wfdielen;
+	pattrib->pktlen += wfdielen;
+#endif //CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	//dump_mgntframe(padapter, pmgntframe);
+	if (dump_mgntframe_and_wait_ack(padapter, pmgntframe) != _SUCCESS)
+		DBG_8192C("%s, ack to\n", __func__);
+
+	//if(wps_devicepassword_id == WPS_DPID_REGISTRAR_SPEC)
+	//{
+	//	DBG_8192C("waiting for p2p peer key-in PIN CODE\n");
+	//	rtw_msleep_os(15000); // 15 sec for key in PIN CODE, workaround for GS2 before issuing Nego Req.
+	//}
+
+}
+
+static s32 cfg80211_rtw_remain_on_channel(struct wiphy *wiphy,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0))
+	struct wireless_dev *wdev,
+#else
+	struct net_device *ndev,
+#endif
+	struct ieee80211_channel * channel,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
+	enum nl80211_channel_type channel_type,
+#endif
+	unsigned int duration, u64 *cookie)
+{
+	s32 err = 0;
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(padapter->rtw_wdev);
+	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+	struct wifidirect_info *pwdinfo = &padapter->wdinfo;
+	struct cfg80211_wifidirect_info *pcfg80211_wdinfo = &padapter->cfg80211_wdinfo;
+	u8 remain_ch = (u8) ieee80211_frequency_to_channel(channel->center_freq);
+	u8 ready_on_channel = _FALSE;
+
+	DBG_871X(FUNC_ADPT_FMT" ch:%u duration:%d\n", FUNC_ADPT_ARG(padapter), remain_ch, duration);
+
+	if(pcfg80211_wdinfo->is_ro_ch == _TRUE)
+	{
+		DBG_8192C("%s, cancel ro ch timer\n", __func__);
+
+		_cancel_timer_ex(&padapter->cfg80211_wdinfo.remain_on_ch_timer);
+
+#ifdef CONFIG_CONCURRENT_MODE
+                ATOMIC_SET(&pwdev_priv->ro_ch_to, 1);
+#endif //CONFIG_CONCURRENT_MODE
+
+		p2p_protocol_wk_hdl(padapter, P2P_RO_CH_WK);
+	}
+
+	pcfg80211_wdinfo->is_ro_ch = _TRUE;
+
+	if(_FAIL == rtw_pwr_wakeup(padapter)) {
+		err = -EFAULT;
+		goto exit;
+	}
+
+	_rtw_memcpy(&pcfg80211_wdinfo->remain_on_ch_channel, channel, sizeof(struct ieee80211_channel));
+	#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
+	pcfg80211_wdinfo->remain_on_ch_type= channel_type;
+	#endif
+	pcfg80211_wdinfo->remain_on_ch_cookie= *cookie;
+
+	rtw_scan_abort(padapter);
+#ifdef CONFIG_CONCURRENT_MODE
+	if(rtw_buddy_adapter_up(padapter))
+		rtw_scan_abort(padapter->pbuddy_adapter);
+#endif //CONFIG_CONCURRENT_MODE
+
+	//if(!rtw_p2p_chk_role(pwdinfo, P2P_ROLE_CLIENT) && !rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		rtw_p2p_enable(padapter, P2P_ROLE_DEVICE);
+		wdev_to_priv(padapter->rtw_wdev)->p2p_enabled = _TRUE;
+	}
+	else
+	{
+		rtw_p2p_set_pre_state(pwdinfo, rtw_p2p_state(pwdinfo));
+#ifdef CONFIG_DEBUG_CFG80211
+		DBG_8192C("%s, role=%d, p2p_state=%d\n", __func__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo));
+#endif
+	}
+
+
+	rtw_p2p_set_state(pwdinfo, P2P_STATE_LISTEN);
+
+
+	if(duration < 400)
+		duration = duration*3;//extend from exper.
+
+
+#ifdef	CONFIG_CONCURRENT_MODE
+	if(check_buddy_fwstate(padapter, _FW_LINKED) &&
+		(duration<pwdinfo->ext_listen_interval))
+	{
+		duration = duration + 	pwdinfo->ext_listen_interval;
+	}
+#endif
+
+	pcfg80211_wdinfo->restore_channel = rtw_get_oper_ch(padapter);
+
+	if(rtw_ch_set_search_ch(pmlmeext->channel_set, remain_ch) >= 0) {
+#ifdef	CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+		{
+			PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+			struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+			if(remain_ch != pbuddy_mlmeext->cur_channel)
+			{
+				if(ATOMIC_READ(&pwdev_priv->switch_ch_to)==1 ||
+					(remain_ch != pmlmeext->cur_channel))
+				{
+					DBG_8192C("%s, issue nulldata pwrbit=1\n", __func__);
+					issue_nulldata(padapter->pbuddy_adapter, NULL, 1, 3, 500);
+
+					ATOMIC_SET(&pwdev_priv->switch_ch_to, 0);
+
+					DBG_8192C("%s, set switch ch timer, duration=%d\n", __func__, duration-pwdinfo->ext_listen_interval);
+					_set_timer(&pwdinfo->ap_p2p_switch_timer, duration-pwdinfo->ext_listen_interval);
+				}
+			}
+
+			ready_on_channel = _TRUE;
+			//pmlmeext->cur_channel = remain_ch;
+			//set_channel_bwmode(padapter, remain_ch, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+		}else
+#endif //CONFIG_CONCURRENT_MODE
+		if(remain_ch != pmlmeext->cur_channel )
+		{
+			ready_on_channel = _TRUE;
+			//pmlmeext->cur_channel = remain_ch;
+			//set_channel_bwmode(padapter, remain_ch, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+		}
+	} else {
+		DBG_871X("%s remain_ch:%u not in channel plan!!!!\n", __FUNCTION__, remain_ch);
+	}
+
+
+	//call this after other things have been done
+#ifdef	CONFIG_CONCURRENT_MODE
+	if(ATOMIC_READ(&pwdev_priv->ro_ch_to)==1 ||
+		(remain_ch != pmlmeext->cur_channel))
+	{
+		u8 co_channel = 0xff;
+		ATOMIC_SET(&pwdev_priv->ro_ch_to, 0);
+#endif
+
+		if(ready_on_channel == _TRUE)
+		{
+			if ( !check_fwstate(&padapter->mlmepriv, _FW_LINKED ) )
+				pmlmeext->cur_channel = remain_ch;
+
+#ifdef	CONFIG_CONCURRENT_MODE
+			co_channel = rtw_get_oper_ch(padapter);
+
+			if(co_channel !=remain_ch)
+#endif
+			{
+				if (!padapter->mlmepriv.LinkDetectInfo.bBusyTraffic)
+					set_channel_bwmode(padapter, remain_ch, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+			}
+		}
+		DBG_8192C("%s, set ro ch timer, duration=%d\n", __func__, duration);
+		_set_timer( &pcfg80211_wdinfo->remain_on_ch_timer, duration);
+
+#ifdef	CONFIG_CONCURRENT_MODE
+	}
+#endif
+
+	rtw_cfg80211_ready_on_channel(padapter, *cookie, channel, channel_type, duration, GFP_KERNEL);
+
+exit:
+	if (err)
+		pcfg80211_wdinfo->is_ro_ch = _FALSE;
+
+	return err;
+}
+
+static s32 cfg80211_rtw_cancel_remain_on_channel(struct wiphy *wiphy,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0))
+	struct wireless_dev *wdev,
+#else
+	struct net_device *ndev,
+#endif
+	u64 cookie)
+{
+	s32 err = 0;
+	_adapter *padapter = wiphy_to_adapter(wiphy);
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(padapter->rtw_wdev);
+	struct wifidirect_info *pwdinfo = &padapter->wdinfo;
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct cfg80211_wifidirect_info *pcfg80211_wdinfo = &padapter->cfg80211_wdinfo;
+
+	DBG_871X(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
+
+	if (pcfg80211_wdinfo->is_ro_ch == _TRUE) {
+		DBG_8192C("%s, cancel ro ch timer\n", __func__);
+		_cancel_timer_ex(&padapter->cfg80211_wdinfo.remain_on_ch_timer);
+		#ifdef CONFIG_CONCURRENT_MODE
+		ATOMIC_SET(&pwdev_priv->ro_ch_to, 1);
+		#endif
+		p2p_protocol_wk_hdl(padapter, P2P_RO_CH_WK);
+	}
+
+	#if 0
+	//	Disable P2P Listen State
+	if(!rtw_p2p_chk_role(pwdinfo, P2P_ROLE_CLIENT) && !rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+	{
+		if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		{
+			_cancel_timer_ex( &pwdinfo->find_phase_timer );
+			_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+			_cancel_timer_ex( &pwdinfo->pre_tx_scan_timer);
+
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_NONE);
+			_rtw_memset(pwdinfo, 0x00, sizeof(struct wifidirect_info));
+		}
+	}
+	else
+	#endif
+	{
+		 rtw_p2p_set_state(pwdinfo, rtw_p2p_pre_state(pwdinfo));
+#ifdef CONFIG_DEBUG_CFG80211
+		 DBG_8192C("%s, role=%d, p2p_state=%d\n", __func__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo));
+#endif
+	}
+	pcfg80211_wdinfo->is_ro_ch = _FALSE;
+
+	return err;
+}
+
+#endif //CONFIG_P2P
+
+static int _cfg80211_rtw_mgmt_tx(_adapter *padapter, u8 tx_ch, const u8 *buf, size_t len)
+{
+	struct xmit_frame	*pmgntframe;
+	struct pkt_attrib	*pattrib;
+	unsigned char	*pframe;
+	int ret = _FAIL;
+	bool ack = _TRUE;
+	struct rtw_ieee80211_hdr *pwlanhdr;
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(padapter->rtw_wdev);
+	struct xmit_priv	*pxmitpriv = &(padapter->xmitpriv);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct wifidirect_info *pwdinfo = &padapter->wdinfo;
+	//struct cfg80211_wifidirect_info *pcfg80211_wdinfo = &padapter->cfg80211_wdinfo;
+
+	if(_FAIL == rtw_pwr_wakeup(padapter)) {
+		ret = -EFAULT;
+		goto exit;
+	}
+
+	rtw_set_scan_deny(padapter, 1000);
+
+	rtw_scan_abort(padapter);
+	#ifdef CONFIG_CONCURRENT_MODE
+	if(rtw_buddy_adapter_up(padapter))
+		rtw_scan_abort(padapter->pbuddy_adapter);
+	#endif /* CONFIG_CONCURRENT_MODE */
+
+	if (padapter->cfg80211_wdinfo.is_ro_ch == _TRUE) {
+		//DBG_8192C("%s, cancel ro ch timer\n", __func__);
+		//_cancel_timer_ex(&padapter->cfg80211_wdinfo.remain_on_ch_timer);
+		//padapter->cfg80211_wdinfo.is_ro_ch = _FALSE;
+		#ifdef CONFIG_CONCURRENT_MODE
+		if (!check_fwstate(&padapter->mlmepriv, _FW_LINKED ))
+		{
+			DBG_8192C("%s, extend ro ch time\n", __func__);
+			_set_timer( &padapter->cfg80211_wdinfo.remain_on_ch_timer, pwdinfo->ext_listen_period);
+		}
+		#endif //CONFIG_CONCURRENT_MODE
+	}
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (check_buddy_fwstate(padapter, _FW_LINKED )) {
+		u8 co_channel=0xff;
+		PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+		struct mlme_ext_priv *pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+		co_channel = rtw_get_oper_ch(padapter);
+
+		if (tx_ch != pbuddy_mlmeext->cur_channel) {
+
+			u16 ext_listen_period;
+
+			if (ATOMIC_READ(&pwdev_priv->switch_ch_to)==1) {
+				DBG_8192C("%s, issue nulldata pwrbit=1\n", __func__);
+				issue_nulldata(padapter->pbuddy_adapter, NULL, 1, 3, 500);
+
+				ATOMIC_SET(&pwdev_priv->switch_ch_to, 0);
+
+				//DBG_8192C("%s, set switch ch timer, period=%d\n", __func__, pwdinfo->ext_listen_period);
+				//_set_timer(&pwdinfo->ap_p2p_switch_timer, pwdinfo->ext_listen_period);
+			}
+
+			if (check_fwstate(&padapter->mlmepriv, _FW_LINKED ))
+			{
+				ext_listen_period = 500;// 500ms
+			}
+			else
+			{
+				ext_listen_period = pwdinfo->ext_listen_period;
+			}
+
+			DBG_8192C("%s, set switch ch timer, period=%d\n", __func__, ext_listen_period);
+			_set_timer(&pwdinfo->ap_p2p_switch_timer, ext_listen_period);
+
+		}
+
+		if (!check_fwstate(&padapter->mlmepriv, _FW_LINKED ))
+			pmlmeext->cur_channel = tx_ch;
+
+		if (tx_ch != co_channel)
+			set_channel_bwmode(padapter, tx_ch, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+	}else
+#endif //CONFIG_CONCURRENT_MODE
+	//if (tx_ch != pmlmeext->cur_channel) {
+	if(tx_ch != rtw_get_oper_ch(padapter)) {
+		if (!check_fwstate(&padapter->mlmepriv, _FW_LINKED ))
+			pmlmeext->cur_channel = tx_ch;
+		set_channel_bwmode(padapter, tx_ch, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+	}
+
+	//starting alloc mgmt frame to dump it
+	if ((pmgntframe = alloc_mgtxmitframe(pxmitpriv)) == NULL)
+	{
+		//ret = -ENOMEM;
+		ret = _FAIL;
+		goto exit;
+	}
+
+	//update attribute
+	pattrib = &pmgntframe->attrib;
+	update_mgntframe_attrib(padapter, pattrib);
+	pattrib->retry_ctrl = _FALSE;
+
+	_rtw_memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
+
+	pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
+
+	_rtw_memcpy(pframe, (void*)buf, len);
+	pattrib->pktlen = len;
+
+	pwlanhdr = (struct rtw_ieee80211_hdr *)pframe;
+	//update seq number
+	pmlmeext->mgnt_seq = GetSequence(pwlanhdr);
+	pattrib->seqnum = pmlmeext->mgnt_seq;
+	pmlmeext->mgnt_seq++;
+
+#ifdef CONFIG_WFD
+	{
+		struct wifi_display_info	*pwfd_info;
+
+		pwfd_info = padapter->wdinfo.wfd_info;
+
+		if ( _TRUE == pwfd_info->wfd_enable )
+		{
+			rtw_append_wfd_ie( padapter, pframe, &pattrib->pktlen );
+		}
+	}
+#endif // CONFIG_WFD
+
+	pattrib->last_txcmdsz = pattrib->pktlen;
+
+	if (dump_mgntframe_and_wait_ack(padapter, pmgntframe) != _SUCCESS)
+	{
+		ack = _FALSE;
+		ret = _FAIL;
+
+		#ifdef CONFIG_DEBUG_CFG80211
+		DBG_8192C("%s, ack == _FAIL\n", __func__);
+		#endif
+	}
+	else
+	{
+		#ifdef CONFIG_DEBUG_CFG80211
+		DBG_8192C("%s, ack=%d, ok!\n", __func__, ack);
+		#endif
+		ret = _SUCCESS;
+	}
+
+exit:
+
+	#ifdef CONFIG_DEBUG_CFG80211
+	DBG_8192C("%s, ret=%d\n", __func__, ret);
+	#endif
+
+	return ret;
+
+}
+
+static int cfg80211_rtw_mgmt_tx(struct wiphy *wiphy,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,6,0))
+	struct wireless_dev *wdev,
+#else
+	struct net_device *ndev,
+#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
+	struct cfg80211_mgmt_tx_params *params,
+#else
+	struct ieee80211_channel *chan,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)) || defined(COMPAT_KERNEL_RELEASE)
+	bool offchan,
+#endif
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
+	enum nl80211_channel_type channel_type,
+	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+	bool channel_type_valid,
+	#endif
+#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)) || defined(COMPAT_KERNEL_RELEASE)
+	unsigned int wait,
+#endif
+	const u8 *buf, size_t len,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,2,0))
+	bool no_cck,
+#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,3,0))
+	bool dont_wait_for_ack,
+#endif
+#endif
+	u64 *cookie)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,14,0))
+	struct ieee80211_channel *chan = params->chan;
+	const u8 *buf = params->buf;
+	size_t len = params->len;
+#endif
+
+	_adapter *padapter = (_adapter *)wiphy_to_adapter(wiphy);
+	struct rtw_wdev_priv *pwdev_priv = wdev_to_priv(padapter->rtw_wdev);
+	int ret = 0;
+	int tx_ret;
+	u32 dump_limit = RTW_MAX_MGMT_TX_CNT;
+	u32 dump_cnt = 0;
+	bool ack = _TRUE;
+	u8 tx_ch = (u8)ieee80211_frequency_to_channel(chan->center_freq);
+	u8 category, action;
+	int type = (-1);
+	u32 start = rtw_get_current_time();
+
+	/* cookie generation */
+	*cookie = (unsigned long) buf;
+
+#ifdef CONFIG_DEBUG_CFG80211
+	DBG_871X(FUNC_ADPT_FMT" len=%zu, ch=%d"
+	#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
+		", ch_type=%d"
+		#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+		", channel_type_valid=%d"
+		#endif
+	#endif
+		"\n", FUNC_ADPT_ARG(padapter),
+		len, tx_ch
+	#if (LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0))
+		, channel_type
+		#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+		, channel_type_valid
+		#endif
+	#endif
+	);
+#endif /* CONFIG_DEBUG_CFG80211 */
+
+	/* indicate ack before issue frame to avoid racing with rsp frame */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+	rtw_cfg80211_mgmt_tx_status(padapter, *cookie, buf, len, ack, GFP_KERNEL);
+#elif  (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,34) && LINUX_VERSION_CODE<=KERNEL_VERSION(2,6,35))
+	cfg80211_action_tx_status(ndev, *cookie, buf, len, ack, GFP_KERNEL);
+#endif
+
+	if (rtw_action_frame_parse(buf, len, &category, &action) == _FALSE) {
+		DBG_8192C(FUNC_ADPT_FMT" frame_control:0x%x\n", FUNC_ADPT_ARG(padapter),
+			le16_to_cpu(((struct rtw_ieee80211_hdr_3addr *)buf)->frame_ctl));
+		goto exit;
+	}
+
+	DBG_8192C("RTW_Tx:tx_ch=%d, da="MAC_FMT"\n", tx_ch, MAC_ARG(GetAddr1Ptr(buf)));
+	#ifdef CONFIG_P2P
+	if((type = rtw_p2p_check_frames(padapter, buf, len, _TRUE)) >= 0) {
+		goto dump;
+	}
+	#endif
+	if (category == RTW_WLAN_CATEGORY_PUBLIC)
+		DBG_871X("RTW_Tx:%s\n", action_public_str(action));
+	else
+		DBG_871X("RTW_Tx:category(%u), action(%u)\n", category, action);
+
+dump:
+	do {
+		dump_cnt++;
+		tx_ret = _cfg80211_rtw_mgmt_tx(padapter, tx_ch, buf, len);
+	} while (dump_cnt < dump_limit && tx_ret != _SUCCESS);
+
+	if (tx_ret != _SUCCESS || dump_cnt > 1) {
+		DBG_871X(FUNC_ADPT_FMT" %s (%d/%d) in %d ms\n", FUNC_ADPT_ARG(padapter),
+			tx_ret==_SUCCESS?"OK":"FAIL", dump_cnt, dump_limit, rtw_get_passing_time_ms(start));
+	}
+
+	switch (type) {
+	case P2P_GO_NEGO_CONF:
+		rtw_clear_scan_deny(padapter);
+		break;
+	case P2P_INVIT_RESP:
+		if (pwdev_priv->invit_info.flags & BIT(0)
+			&& pwdev_priv->invit_info.status == 0)
+		{
+			DBG_871X(FUNC_ADPT_FMT" agree with invitation of persistent group\n",
+				FUNC_ADPT_ARG(padapter));
+			rtw_set_scan_deny(padapter, 5000);
+			rtw_pwr_wakeup_ex(padapter, 5000);
+			rtw_clear_scan_deny(padapter);
+		}
+		break;
+	}
+
+exit:
+	return ret;
+}
+
+static void cfg80211_rtw_mgmt_frame_register(struct wiphy *wiphy,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+	struct wireless_dev *wdev,
+#else
+	struct net_device *ndev,
+#endif
+	u16 frame_type, bool reg)
+{
+	_adapter *adapter = wiphy_to_adapter(wiphy);
+
+#ifdef CONFIG_DEBUG_CFG80211
+	DBG_871X(FUNC_ADPT_FMT" frame_type:%x, reg:%d\n", FUNC_ADPT_ARG(adapter),
+		frame_type, reg);
+#endif
+
+	if (frame_type != (IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_REQ))
+		return;
+
+	return;
+}
+
+static int rtw_cfg80211_set_beacon_wpsp2pie(struct net_device *ndev, char *buf, int len)
+{
+	int ret = 0;
+	uint wps_ielen = 0;
+	u8 *wps_ie;
+	u32	p2p_ielen = 0;
+	u8 wps_oui[8]={0x0,0x50,0xf2,0x04};
+	u8 *p2p_ie;
+	u32	wfd_ielen = 0;
+	u8 *wfd_ie;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(ndev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
+
+	DBG_871X(FUNC_NDEV_FMT" ielen=%d\n", FUNC_NDEV_ARG(ndev), len);
+
+	if(len>0)
+	{
+		if((wps_ie = rtw_get_wps_ie(buf, len, NULL, &wps_ielen)))
+		{
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("bcn_wps_ielen=%d\n", wps_ielen);
+			#endif
+
+			if(pmlmepriv->wps_beacon_ie)
+			{
+				u32 free_len = pmlmepriv->wps_beacon_ie_len;
+				pmlmepriv->wps_beacon_ie_len = 0;
+				rtw_mfree(pmlmepriv->wps_beacon_ie, free_len);
+				pmlmepriv->wps_beacon_ie = NULL;
+			}
+
+			pmlmepriv->wps_beacon_ie = rtw_malloc(wps_ielen);
+			if ( pmlmepriv->wps_beacon_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				return -EINVAL;
+
+			}
+
+			_rtw_memcpy(pmlmepriv->wps_beacon_ie, wps_ie, wps_ielen);
+			pmlmepriv->wps_beacon_ie_len = wps_ielen;
+
+			update_beacon(padapter, _VENDOR_SPECIFIC_IE_, wps_oui, _TRUE);
+
+		}
+
+		//buf += wps_ielen;
+		//len -= wps_ielen;
+
+		#ifdef CONFIG_P2P
+		if((p2p_ie=rtw_get_p2p_ie(buf, len, NULL, &p2p_ielen)))
+		{
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("bcn_p2p_ielen=%d\n", p2p_ielen);
+			#endif
+
+			if(pmlmepriv->p2p_beacon_ie)
+			{
+				u32 free_len = pmlmepriv->p2p_beacon_ie_len;
+				pmlmepriv->p2p_beacon_ie_len = 0;
+				rtw_mfree(pmlmepriv->p2p_beacon_ie, free_len);
+				pmlmepriv->p2p_beacon_ie = NULL;
+			}
+
+			pmlmepriv->p2p_beacon_ie = rtw_malloc(p2p_ielen);
+			if ( pmlmepriv->p2p_beacon_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				return -EINVAL;
+
+			}
+
+			_rtw_memcpy(pmlmepriv->p2p_beacon_ie, p2p_ie, p2p_ielen);
+			pmlmepriv->p2p_beacon_ie_len = p2p_ielen;
+
+		}
+		#endif //CONFIG_P2P
+
+		//buf += p2p_ielen;
+		//len -= p2p_ielen;
+
+		#ifdef CONFIG_WFD
+		if(rtw_get_wfd_ie(buf, len, NULL, &wfd_ielen))
+		{
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("bcn_wfd_ielen=%d\n", wfd_ielen);
+			#endif
+
+			if(pmlmepriv->wfd_beacon_ie)
+			{
+				u32 free_len = pmlmepriv->wfd_beacon_ie_len;
+				pmlmepriv->wfd_beacon_ie_len = 0;
+				rtw_mfree(pmlmepriv->wfd_beacon_ie, free_len);
+				pmlmepriv->wfd_beacon_ie = NULL;
+			}
+
+			pmlmepriv->wfd_beacon_ie = rtw_malloc(wfd_ielen);
+			if ( pmlmepriv->wfd_beacon_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				return -EINVAL;
+
+			}
+			rtw_get_wfd_ie(buf, len, pmlmepriv->wfd_beacon_ie, &pmlmepriv->wfd_beacon_ie_len);
+		}
+		#endif //CONFIG_WFD
+
+		pmlmeext->bstart_bss = _TRUE;
+
+	}
+
+	return ret;
+
+}
+
+static int rtw_cfg80211_set_probe_resp_wpsp2pie(struct net_device *net, char *buf, int len)
+{
+	int ret = 0;
+	uint wps_ielen = 0;
+	u8 *wps_ie;
+	u32	p2p_ielen = 0;
+	u8 *p2p_ie;
+	u32	wfd_ielen = 0;
+	u8 *wfd_ie;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(net);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+#ifdef CONFIG_DEBUG_CFG80211
+	DBG_8192C("%s, ielen=%d\n", __func__, len);
+#endif
+
+	if(len>0)
+	{
+		if((wps_ie = rtw_get_wps_ie(buf, len, NULL, &wps_ielen)))
+		{
+			uint	attr_contentlen = 0;
+			u16	uconfig_method, *puconfig_method = NULL;
+
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("probe_resp_wps_ielen=%d\n", wps_ielen);
+			#endif
+
+			if(check_fwstate(pmlmepriv, WIFI_UNDER_WPS))
+			{
+				u8 sr = 0;
+				rtw_get_wps_attr_content(wps_ie,  wps_ielen, WPS_ATTR_SELECTED_REGISTRAR, (u8*)(&sr), NULL);
+
+				if (sr != 0)
+				{
+					DBG_871X("%s, got sr\n", __func__);
+				}
+				else
+				{
+					DBG_8192C("GO mode process WPS under site-survey,  sr no set\n");
+					return ret;
+				}
+			}
+
+			if(pmlmepriv->wps_probe_resp_ie)
+			{
+				u32 free_len = pmlmepriv->wps_probe_resp_ie_len;
+				pmlmepriv->wps_probe_resp_ie_len = 0;
+				rtw_mfree(pmlmepriv->wps_probe_resp_ie, free_len);
+				pmlmepriv->wps_probe_resp_ie = NULL;
+			}
+
+			pmlmepriv->wps_probe_resp_ie = rtw_malloc(wps_ielen);
+			if ( pmlmepriv->wps_probe_resp_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				return -EINVAL;
+
+			}
+
+			//add PUSH_BUTTON config_method by driver self in wpsie of probe_resp at GO Mode
+			if ( (puconfig_method = (u16*)rtw_get_wps_attr_content( wps_ie, wps_ielen, WPS_ATTR_CONF_METHOD , NULL, &attr_contentlen)) != NULL )
+			{
+				#ifdef CONFIG_DEBUG_CFG80211
+				//printk("config_method in wpsie of probe_resp = 0x%x\n", be16_to_cpu(*puconfig_method));
+				#endif
+
+				uconfig_method = WPS_CM_PUSH_BUTTON;
+				uconfig_method = cpu_to_be16( uconfig_method );
+
+				*puconfig_method |= uconfig_method;
+			}
+
+			_rtw_memcpy(pmlmepriv->wps_probe_resp_ie, wps_ie, wps_ielen);
+			pmlmepriv->wps_probe_resp_ie_len = wps_ielen;
+
+		}
+
+		//buf += wps_ielen;
+		//len -= wps_ielen;
+
+		#ifdef CONFIG_P2P
+		if((p2p_ie=rtw_get_p2p_ie(buf, len, NULL, &p2p_ielen)))
+		{
+			u8 is_GO = _FALSE;
+			u32 attr_contentlen = 0;
+			u16 cap_attr=0;
+
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("probe_resp_p2p_ielen=%d\n", p2p_ielen);
+			#endif
+
+			//Check P2P Capability ATTR
+			if( rtw_get_p2p_attr_content( p2p_ie, p2p_ielen, P2P_ATTR_CAPABILITY, (u8*)&cap_attr, (uint*) &attr_contentlen) )
+			{
+				u8 grp_cap=0;
+				//DBG_8192C( "[%s] Got P2P Capability Attr!!\n", __FUNCTION__ );
+				cap_attr = le16_to_cpu(cap_attr);
+				grp_cap = (u8)((cap_attr >> 8)&0xff);
+
+				is_GO = (grp_cap&BIT(0)) ? _TRUE:_FALSE;
+
+				if(is_GO)
+					DBG_8192C("Got P2P Capability Attr, grp_cap=0x%x, is_GO\n", grp_cap);
+			}
+
+
+			if(is_GO == _FALSE)
+			{
+				if(pmlmepriv->p2p_probe_resp_ie)
+				{
+					u32 free_len = pmlmepriv->p2p_probe_resp_ie_len;
+					pmlmepriv->p2p_probe_resp_ie_len = 0;
+					rtw_mfree(pmlmepriv->p2p_probe_resp_ie, free_len);
+					pmlmepriv->p2p_probe_resp_ie = NULL;
+				}
+
+				pmlmepriv->p2p_probe_resp_ie = rtw_malloc(p2p_ielen);
+				if ( pmlmepriv->p2p_probe_resp_ie == NULL) {
+					DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+					return -EINVAL;
+
+				}
+				_rtw_memcpy(pmlmepriv->p2p_probe_resp_ie, p2p_ie, p2p_ielen);
+				pmlmepriv->p2p_probe_resp_ie_len = p2p_ielen;
+			}
+			else
+			{
+				if(pmlmepriv->p2p_go_probe_resp_ie)
+				{
+					u32 free_len = pmlmepriv->p2p_go_probe_resp_ie_len;
+					pmlmepriv->p2p_go_probe_resp_ie_len = 0;
+					rtw_mfree(pmlmepriv->p2p_go_probe_resp_ie, free_len);
+					pmlmepriv->p2p_go_probe_resp_ie = NULL;
+				}
+
+				pmlmepriv->p2p_go_probe_resp_ie = rtw_malloc(p2p_ielen);
+				if ( pmlmepriv->p2p_go_probe_resp_ie == NULL) {
+					DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+					return -EINVAL;
+
+				}
+				_rtw_memcpy(pmlmepriv->p2p_go_probe_resp_ie, p2p_ie, p2p_ielen);
+				pmlmepriv->p2p_go_probe_resp_ie_len = p2p_ielen;
+			}
+
+		}
+		#endif //CONFIG_P2P
+
+		//buf += p2p_ielen;
+		//len -= p2p_ielen;
+
+		#ifdef CONFIG_WFD
+		if(rtw_get_wfd_ie(buf, len, NULL, &wfd_ielen))
+		{
+			#ifdef CONFIG_DEBUG_CFG80211
+			DBG_8192C("probe_resp_wfd_ielen=%d\n", wfd_ielen);
+			#endif
+
+			if(pmlmepriv->wfd_probe_resp_ie)
+			{
+				u32 free_len = pmlmepriv->wfd_probe_resp_ie_len;
+				pmlmepriv->wfd_probe_resp_ie_len = 0;
+				rtw_mfree(pmlmepriv->wfd_probe_resp_ie, free_len);
+				pmlmepriv->wfd_probe_resp_ie = NULL;
+			}
+
+			pmlmepriv->wfd_probe_resp_ie = rtw_malloc(wfd_ielen);
+			if ( pmlmepriv->wfd_probe_resp_ie == NULL) {
+				DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				return -EINVAL;
+
+			}
+			rtw_get_wfd_ie(buf, len, pmlmepriv->wfd_probe_resp_ie, &pmlmepriv->wfd_probe_resp_ie_len);
+		}
+		#endif //CONFIG_WFD
+
+	}
+
+	return ret;
+
+}
+
+static int rtw_cfg80211_set_assoc_resp_wpsp2pie(struct net_device *net, char *buf, int len)
+{
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(net);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+	DBG_8192C("%s, ielen=%d\n", __func__, len);
+
+	if(len>0)
+	{
+		if(pmlmepriv->wps_assoc_resp_ie)
+		{
+			u32 free_len = pmlmepriv->wps_assoc_resp_ie_len;
+			pmlmepriv->wps_assoc_resp_ie_len = 0;
+			rtw_mfree(pmlmepriv->wps_assoc_resp_ie, free_len);
+			pmlmepriv->wps_assoc_resp_ie = NULL;
+		}
+
+		pmlmepriv->wps_assoc_resp_ie = rtw_malloc(len);
+		if ( pmlmepriv->wps_assoc_resp_ie == NULL) {
+			DBG_8192C("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+			return -EINVAL;
+
+		}
+		_rtw_memcpy(pmlmepriv->wps_assoc_resp_ie, buf, len);
+		pmlmepriv->wps_assoc_resp_ie_len = len;
+	}
+
+	return ret;
+
+}
+
+int rtw_cfg80211_set_mgnt_wpsp2pie(struct net_device *net, char *buf, int len,
+	int type)
+{
+	int ret = 0;
+	uint wps_ielen = 0;
+	u32	p2p_ielen = 0;
+
+#ifdef CONFIG_DEBUG_CFG80211
+	DBG_8192C("%s, ielen=%d\n", __func__, len);
+#endif
+
+	if(	(rtw_get_wps_ie(buf, len, NULL, &wps_ielen) && (wps_ielen>0))
+		#ifdef CONFIG_P2P
+		|| (rtw_get_p2p_ie(buf, len, NULL, &p2p_ielen) && (p2p_ielen>0))
+		#endif
+	)
+	{
+		if (net != NULL)
+		{
+			switch (type)
+			{
+				case 0x1: //BEACON
+				ret = rtw_cfg80211_set_beacon_wpsp2pie(net, buf, len);
+				break;
+				case 0x2: //PROBE_RESP
+				ret = rtw_cfg80211_set_probe_resp_wpsp2pie(net, buf, len);
+				break;
+				case 0x4: //ASSOC_RESP
+				ret = rtw_cfg80211_set_assoc_resp_wpsp2pie(net, buf, len);
+				break;
+			}
+		}
+	}
+
+	return ret;
+
+}
+
+static struct cfg80211_ops rtw_cfg80211_ops = {
+	.change_virtual_intf = cfg80211_rtw_change_iface,
+	.add_key = cfg80211_rtw_add_key,
+	.get_key = cfg80211_rtw_get_key,
+	.del_key = cfg80211_rtw_del_key,
+	.set_default_key = cfg80211_rtw_set_default_key,
+	.get_station = cfg80211_rtw_get_station,
+	.scan = cfg80211_rtw_scan,
+	.set_wiphy_params = cfg80211_rtw_set_wiphy_params,
+	.connect = cfg80211_rtw_connect,
+	.disconnect = cfg80211_rtw_disconnect,
+	.join_ibss = cfg80211_rtw_join_ibss,
+	.leave_ibss = cfg80211_rtw_leave_ibss,
+	.set_tx_power = cfg80211_rtw_set_txpower,
+	.get_tx_power = cfg80211_rtw_get_txpower,
+	.set_power_mgmt = cfg80211_rtw_set_power_mgmt,
+	.set_pmksa = cfg80211_rtw_set_pmksa,
+	.del_pmksa = cfg80211_rtw_del_pmksa,
+	.flush_pmksa = cfg80211_rtw_flush_pmksa,
+
+#ifdef CONFIG_AP_MODE
+	.add_virtual_intf = cfg80211_rtw_add_virtual_intf,
+	.del_virtual_intf = cfg80211_rtw_del_virtual_intf,
+
+	#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 4, 0)) && !defined(COMPAT_KERNEL_RELEASE)
+	.add_beacon = cfg80211_rtw_add_beacon,
+	.set_beacon = cfg80211_rtw_set_beacon,
+	.del_beacon = cfg80211_rtw_del_beacon,
+	#else
+	.start_ap = cfg80211_rtw_start_ap,
+	.change_beacon = cfg80211_rtw_change_beacon,
+	.stop_ap = cfg80211_rtw_stop_ap,
+	#endif
+
+	.add_station = cfg80211_rtw_add_station,
+	.del_station = cfg80211_rtw_del_station,
+	.change_station = cfg80211_rtw_change_station,
+	.dump_station = cfg80211_rtw_dump_station,
+	.change_bss = cfg80211_rtw_change_bss,
+	#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
+	.set_channel = cfg80211_rtw_set_channel,
+	#endif
+	//.auth = cfg80211_rtw_auth,
+	//.assoc = cfg80211_rtw_assoc,
+#endif //CONFIG_AP_MODE
+
+#ifdef CONFIG_P2P
+	.remain_on_channel = cfg80211_rtw_remain_on_channel,
+	.cancel_remain_on_channel = cfg80211_rtw_cancel_remain_on_channel,
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+	.mgmt_tx = cfg80211_rtw_mgmt_tx,
+	.mgmt_frame_register = cfg80211_rtw_mgmt_frame_register,
+#elif  (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,34) && LINUX_VERSION_CODE<=KERNEL_VERSION(2,6,35))
+	.action = cfg80211_rtw_mgmt_tx,
+#endif
+};
+
+static void rtw_cfg80211_init_ht_capab(struct ieee80211_sta_ht_cap *ht_cap, enum nl80211_band band, u8 rf_type)
+{
+
+#define MAX_BIT_RATE_40MHZ_MCS15 	300	/* Mbps */
+#define MAX_BIT_RATE_40MHZ_MCS7 	150	/* Mbps */
+
+	ht_cap->ht_supported = _TRUE;
+
+	ht_cap->cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+					IEEE80211_HT_CAP_SGI_40 | IEEE80211_HT_CAP_SGI_20 |
+					IEEE80211_HT_CAP_DSSSCCK40 | IEEE80211_HT_CAP_MAX_AMSDU;
+
+	/*
+	 *Maximum length of AMPDU that the STA can receive.
+	 *Length = 2 ^ (13 + max_ampdu_length_exp) - 1 (octets)
+	 */
+	ht_cap->ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
+
+	/*Minimum MPDU start spacing , */
+	ht_cap->ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
+
+	ht_cap->mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+
+	/*
+	 *hw->wiphy->bands[NL80211_BAND_2GHZ]
+	 *base on ant_num
+	 *rx_mask: RX mask
+	 *if rx_ant =1 rx_mask[0]=0xff;==>MCS0-MCS7
+	 *if rx_ant =2 rx_mask[1]=0xff;==>MCS8-MCS15
+	 *if rx_ant >=3 rx_mask[2]=0xff;
+	 *if BW_40 rx_mask[4]=0x01;
+	 *highest supported RX rate
+	 */
+	if(rf_type == RF_1T1R)
+	{
+		ht_cap->mcs.rx_mask[0] = 0xFF;
+		ht_cap->mcs.rx_mask[1] = 0x00;
+		ht_cap->mcs.rx_mask[4] = 0x01;
+
+		ht_cap->mcs.rx_highest = MAX_BIT_RATE_40MHZ_MCS7;
+	}
+	else if((rf_type == RF_1T2R) || (rf_type==RF_2T2R))
+	{
+		ht_cap->mcs.rx_mask[0] = 0xFF;
+		ht_cap->mcs.rx_mask[1] = 0xFF;
+		ht_cap->mcs.rx_mask[4] = 0x01;
+
+		ht_cap->mcs.rx_highest = MAX_BIT_RATE_40MHZ_MCS15;
+	}
+	else
+	{
+		DBG_8192C("%s, error rf_type=%d\n", __func__, rf_type);
+	}
+
+}
+
+void rtw_cfg80211_init_wiphy(_adapter *padapter)
+{
+	u8 rf_type;
+	struct ieee80211_supported_band *bands;
+	struct wireless_dev *pwdev = padapter->rtw_wdev;
+	struct wiphy *wiphy = pwdev->wiphy;
+
+	rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+
+	DBG_8192C("%s:rf_type=%d\n", __func__, rf_type);
+
+	/* if (padapter->registrypriv.wireless_mode & WIRELESS_11G) */
+	{
+		bands = wiphy->bands[NL80211_BAND_2GHZ];
+		if(bands)
+			rtw_cfg80211_init_ht_capab(&bands->ht_cap, NL80211_BAND_2GHZ, rf_type);
+	}
+
+	/* if (padapter->registrypriv.wireless_mode & WIRELESS_11A) */
+	{
+		bands = wiphy->bands[NL80211_BAND_5GHZ];
+		if(bands)
+			rtw_cfg80211_init_ht_capab(&bands->ht_cap, NL80211_BAND_5GHZ, rf_type);
+	}
+}
+
+/*
+struct ieee80211_iface_limit rtw_limits[] = {
+	{ .max = 1, .types = BIT(NL80211_IFTYPE_STATION)
+					| BIT(NL80211_IFTYPE_ADHOC)
+#ifdef CONFIG_AP_MODE
+					| BIT(NL80211_IFTYPE_AP)
+#endif
+#if defined(CONFIG_P2P) && ((LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE))
+					| BIT(NL80211_IFTYPE_P2P_CLIENT)
+					| BIT(NL80211_IFTYPE_P2P_GO)
+#endif
+	},
+	{.max = 1, .types = BIT(NL80211_IFTYPE_MONITOR)},
+};
+
+struct ieee80211_iface_combination rtw_combinations = {
+	.limits = rtw_limits,
+	.n_limits = ARRAY_SIZE(rtw_limits),
+	.max_interfaces = 2,
+	.num_different_channels = 1,
+};
+*/
+
+static void rtw_cfg80211_preinit_wiphy(_adapter *padapter, struct wiphy *wiphy)
+{
+
+	wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
+
+	wiphy->max_scan_ssids = RTW_SSID_SCAN_AMOUNT;
+	wiphy->max_scan_ie_len = RTW_SCAN_IE_LEN_MAX;
+	wiphy->max_num_pmkids = RTW_MAX_NUM_PMKIDS;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38)) || defined(COMPAT_KERNEL_RELEASE)
+	wiphy->max_remain_on_channel_duration = RTW_MAX_REMAIN_ON_CHANNEL_DURATION;
+#endif
+
+	wiphy->interface_modes =	BIT(NL80211_IFTYPE_STATION)
+								| BIT(NL80211_IFTYPE_ADHOC)
+#ifdef CONFIG_AP_MODE
+								| BIT(NL80211_IFTYPE_AP)
+								| BIT(NL80211_IFTYPE_MONITOR)
+#endif
+#if defined(CONFIG_P2P) && ((LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE))
+								| BIT(NL80211_IFTYPE_P2P_CLIENT)
+								| BIT(NL80211_IFTYPE_P2P_GO)
+#endif
+								;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37)) || defined(COMPAT_KERNEL_RELEASE)
+#ifdef CONFIG_AP_MODE
+	wiphy->mgmt_stypes = rtw_cfg80211_default_mgmt_stypes;
+#endif //CONFIG_AP_MODE
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,0,0))
+	wiphy->software_iftypes |= BIT(NL80211_IFTYPE_MONITOR);
+#endif
+
+	/*
+	wiphy->iface_combinations = &rtw_combinations;
+	wiphy->n_iface_combinations = 1;
+	*/
+
+	wiphy->cipher_suites = rtw_cipher_suites;
+	wiphy->n_cipher_suites = ARRAY_SIZE(rtw_cipher_suites);
+
+	/* if (padapter->registrypriv.wireless_mode & WIRELESS_11G) */
+		wiphy->bands[NL80211_BAND_2GHZ] = rtw_spt_band_alloc(NL80211_BAND_2GHZ);
+	/* if (padapter->registrypriv.wireless_mode & WIRELESS_11A) */
+		wiphy->bands[NL80211_BAND_5GHZ] = rtw_spt_band_alloc(NL80211_BAND_5GHZ);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,38) && LINUX_VERSION_CODE < KERNEL_VERSION(3,0,0))
+	wiphy->flags |= WIPHY_FLAG_SUPPORTS_SEPARATE_DEFAULT_KEYS;
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,3,0))
+	wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
+	wiphy->flags |= WIPHY_FLAG_OFFCHAN_TX | WIPHY_FLAG_HAVE_AP_SME;
+#endif
+
+	if(padapter->registrypriv.power_mgnt != PS_MODE_ACTIVE)
+		wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
+	else
+		wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+}
+
+int rtw_wdev_alloc(_adapter *padapter, struct device *dev)
+{
+	int ret = 0;
+	struct wiphy *wiphy;
+	struct wireless_dev *wdev;
+	struct rtw_wdev_priv *pwdev_priv;
+	struct net_device *pnetdev = padapter->pnetdev;
+
+	DBG_8192C("%s(padapter=%p)\n", __func__, padapter);
+
+	/* wiphy */
+	wiphy = wiphy_new(&rtw_cfg80211_ops, sizeof(struct rtw_wdev_priv));
+	if (!wiphy) {
+		DBG_8192C("Couldn't allocate wiphy device\n");
+		ret = -ENOMEM;
+		goto exit;
+	}
+	set_wiphy_dev(wiphy, dev);
+	rtw_cfg80211_preinit_wiphy(padapter, wiphy);
+
+	ret = wiphy_register(wiphy);
+	if (ret < 0) {
+		DBG_8192C("Couldn't register wiphy device\n");
+		goto free_wiphy;
+	}
+
+	/*  wdev */
+	wdev = (struct wireless_dev *)rtw_zmalloc(sizeof(struct wireless_dev));
+	if (!wdev) {
+		DBG_8192C("Couldn't allocate wireless device\n");
+		ret = -ENOMEM;
+		goto unregister_wiphy;
+	}
+	wdev->wiphy = wiphy;
+	wdev->netdev = pnetdev;
+
+	wdev->iftype = NL80211_IFTYPE_STATION; // will be init in rtw_hal_init()
+	                                       // Must sync with _rtw_init_mlme_priv()
+	                                       // pmlmepriv->fw_state = WIFI_STATION_STATE
+	//wdev->iftype = NL80211_IFTYPE_MONITOR; // for rtw_setopmode_cmd() in cfg80211_rtw_change_iface()
+	padapter->rtw_wdev = wdev;
+	pnetdev->ieee80211_ptr = wdev;
+
+	//init pwdev_priv
+	pwdev_priv = wdev_to_priv(wdev);
+	pwdev_priv->rtw_wdev = wdev;
+	pwdev_priv->pmon_ndev = NULL;
+	pwdev_priv->ifname_mon[0] = '\0';
+	pwdev_priv->padapter = padapter;
+	pwdev_priv->scan_request = NULL;
+	_rtw_spinlock_init(&pwdev_priv->scan_req_lock);
+
+	pwdev_priv->p2p_enabled = _FALSE;
+	pwdev_priv->provdisc_req_issued = _FALSE;
+	rtw_wdev_invit_info_init(&pwdev_priv->invit_info);
+	rtw_wdev_nego_info_init(&pwdev_priv->nego_info);
+
+	pwdev_priv->bandroid_scan = _FALSE;
+
+	if(padapter->registrypriv.power_mgnt != PS_MODE_ACTIVE)
+		pwdev_priv->power_mgmt = _TRUE;
+	else
+		pwdev_priv->power_mgmt = _FALSE;
+
+#ifdef CONFIG_CONCURRENT_MODE
+	ATOMIC_SET(&pwdev_priv->switch_ch_to, 1);
+	ATOMIC_SET(&pwdev_priv->ro_ch_to, 1);
+#endif
+
+	return ret;
+
+	rtw_mfree((u8*)wdev, sizeof(struct wireless_dev));
+unregister_wiphy:
+	wiphy_unregister(wiphy);
+ free_wiphy:
+	wiphy_free(wiphy);
+exit:
+	return ret;
+
+}
+
+void rtw_wdev_free(struct wireless_dev *wdev)
+{
+	struct rtw_wdev_priv *pwdev_priv;
+
+	DBG_8192C("%s(wdev=%p)\n", __func__, wdev);
+
+	if (!wdev)
+		return;
+
+	pwdev_priv = wdev_to_priv(wdev);
+
+	rtw_spt_band_free(wdev->wiphy->bands[NL80211_BAND_2GHZ]);
+	rtw_spt_band_free(wdev->wiphy->bands[NL80211_BAND_5GHZ]);
+
+	wiphy_free(wdev->wiphy);
+
+	rtw_mfree((u8*)wdev, sizeof(struct wireless_dev));
+}
+
+void rtw_wdev_unregister(struct wireless_dev *wdev)
+{
+	struct rtw_wdev_priv *pwdev_priv;
+
+	DBG_8192C("%s(wdev=%p)\n", __func__, wdev);
+
+	if (!wdev)
+		return;
+
+	pwdev_priv = wdev_to_priv(wdev);
+
+	rtw_cfg80211_indicate_scan_done(pwdev_priv, _TRUE);
+
+	if (pwdev_priv->pmon_ndev) {
+		DBG_8192C("%s, unregister monitor interface\n", __func__);
+		unregister_netdev(pwdev_priv->pmon_ndev);
+	}
+
+	wiphy_unregister(wdev->wiphy);
+}
+
+#endif //CONFIG_IOCTL_CFG80211
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/ioctl_linux.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/ioctl_linux.c
new file mode 100644
index 000000000000..2af84222d0b0
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/ioctl_linux.c
@@ -0,0 +1,11908 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define  _IOCTL_LINUX_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <wlan_bssdef.h>
+#include <rtw_debug.h>
+#include <wifi.h>
+#include <rtw_mlme.h>
+#include <rtw_mlme_ext.h>
+#include <rtw_ioctl.h>
+#include <rtw_ioctl_set.h>
+#include <rtw_ioctl_query.h>
+
+//#ifdef CONFIG_MP_INCLUDED
+#include <rtw_mp_ioctl.h>
+//#endif
+
+#ifdef CONFIG_USB_HCI
+#include <usb_ops.h>
+#endif //CONFIG_USB_HCI
+#include <rtw_version.h>
+
+#ifdef CONFIG_MP_INCLUDED
+#include <rtw_mp.h>
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,27))
+#define  iwe_stream_add_event(a, b, c, d, e)  iwe_stream_add_event(b, c, d, e)
+#define  iwe_stream_add_point(a, b, c, d, e)  iwe_stream_add_point(b, c, d, e)
+#endif
+
+
+#define RTL_IOCTL_WPA_SUPPLICANT	SIOCIWFIRSTPRIV+30
+
+#define SCAN_ITEM_SIZE 768
+#define MAX_CUSTOM_LEN 64
+#define RATE_COUNT 4
+
+#ifdef CONFIG_GLOBAL_UI_PID
+extern int ui_pid[3];
+#endif
+
+// combo scan
+#define WEXT_CSCAN_AMOUNT 9
+#define WEXT_CSCAN_BUF_LEN		360
+#define WEXT_CSCAN_HEADER		"CSCAN S\x01\x00\x00S\x00"
+#define WEXT_CSCAN_HEADER_SIZE		12
+#define WEXT_CSCAN_SSID_SECTION		'S'
+#define WEXT_CSCAN_CHANNEL_SECTION	'C'
+#define WEXT_CSCAN_NPROBE_SECTION	'N'
+#define WEXT_CSCAN_ACTV_DWELL_SECTION	'A'
+#define WEXT_CSCAN_PASV_DWELL_SECTION	'P'
+#define WEXT_CSCAN_HOME_DWELL_SECTION	'H'
+#define WEXT_CSCAN_TYPE_SECTION		'T'
+
+
+extern u8 key_2char2num(u8 hch, u8 lch);
+extern u8 str_2char2num(u8 hch, u8 lch);
+extern u8 convert_ip_addr(u8 hch, u8 mch, u8 lch);
+
+u32 rtw_rates[] = {1000000,2000000,5500000,11000000,
+	6000000,9000000,12000000,18000000,24000000,36000000,48000000,54000000};
+
+static const char * const iw_operation_mode[] =
+{
+	"Auto", "Ad-Hoc", "Managed",  "Master", "Repeater", "Secondary", "Monitor"
+};
+
+static int hex2num_i(char c)
+{
+	if (c >= '0' && c <= '9')
+		return c - '0';
+	if (c >= 'a' && c <= 'f')
+		return c - 'a' + 10;
+	if (c >= 'A' && c <= 'F')
+		return c - 'A' + 10;
+	return -1;
+}
+
+static int hex2byte_i(const char *hex)
+{
+	int a, b;
+	a = hex2num_i(*hex++);
+	if (a < 0)
+		return -1;
+	b = hex2num_i(*hex++);
+	if (b < 0)
+		return -1;
+	return (a << 4) | b;
+}
+
+/**
+ * hwaddr_aton - Convert ASCII string to MAC address
+ * @txt: MAC address as a string (e.g., "00:11:22:33:44:55")
+ * @addr: Buffer for the MAC address (ETH_ALEN = 6 bytes)
+ * Returns: 0 on success, -1 on failure (e.g., string not a MAC address)
+ */
+static int hwaddr_aton_i(const char *txt, u8 *addr)
+{
+	int i;
+
+	for (i = 0; i < 6; i++) {
+		int a, b;
+
+		a = hex2num_i(*txt++);
+		if (a < 0)
+			return -1;
+		b = hex2num_i(*txt++);
+		if (b < 0)
+			return -1;
+		*addr++ = (a << 4) | b;
+		if (i < 5 && *txt++ != ':')
+			return -1;
+	}
+
+	return 0;
+}
+
+static void indicate_wx_custom_event(_adapter *padapter, char *msg)
+{
+#ifndef CONFIG_IOCTL_CFG80211
+	u8 *buff, *p;
+	union iwreq_data wrqu;
+
+	if ((u32)strlen(msg) > IW_CUSTOM_MAX) {
+		DBG_871X("%s strlen(msg):%u > IW_CUSTOM_MAX:%u\n", __FUNCTION__ ,(u32)strlen(msg), IW_CUSTOM_MAX);
+		return;
+	}
+
+	buff = rtw_zmalloc(IW_CUSTOM_MAX+1);
+	if(!buff)
+		return;
+
+	_rtw_memcpy(buff, msg, strlen(msg));
+
+	_rtw_memset(&wrqu,0,sizeof(wrqu));
+	wrqu.data.length = strlen(msg);
+
+	DBG_871X("%s %s\n", __FUNCTION__, buff);
+	wireless_send_event(padapter->pnetdev, IWEVCUSTOM, &wrqu, buff);
+
+	rtw_mfree(buff, IW_CUSTOM_MAX+1);
+#endif
+}
+
+
+static void request_wps_pbc_event(_adapter *padapter)
+{
+#ifndef CONFIG_IOCTL_CFG80211
+	u8 *buff, *p;
+	union iwreq_data wrqu;
+
+	buff = rtw_malloc(IW_CUSTOM_MAX);
+	if(!buff)
+		return;
+
+	_rtw_memset(buff, 0, IW_CUSTOM_MAX);
+
+	p=buff;
+
+	p+=sprintf(p, "WPS_PBC_START.request=TRUE");
+
+	_rtw_memset(&wrqu,0,sizeof(wrqu));
+
+	wrqu.data.length = p-buff;
+
+	wrqu.data.length = (wrqu.data.length<IW_CUSTOM_MAX) ? wrqu.data.length:IW_CUSTOM_MAX;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	wireless_send_event(padapter->pnetdev, IWEVCUSTOM, &wrqu, buff);
+
+	if(buff)
+	{
+		rtw_mfree(buff, IW_CUSTOM_MAX);
+	}
+#endif
+}
+
+
+void indicate_wx_scan_complete_event(_adapter *padapter)
+{
+#ifndef CONFIG_IOCTL_CFG80211
+	union iwreq_data wrqu;
+	struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+	_rtw_memset(&wrqu, 0, sizeof(union iwreq_data));
+
+	//DBG_871X("+rtw_indicate_wx_scan_complete_event\n");
+	wireless_send_event(padapter->pnetdev, SIOCGIWSCAN, &wrqu, NULL);
+#endif
+}
+
+
+void rtw_indicate_wx_assoc_event(_adapter *padapter)
+{
+#ifndef CONFIG_IOCTL_CFG80211
+	union iwreq_data wrqu;
+	struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+	_rtw_memset(&wrqu, 0, sizeof(union iwreq_data));
+
+	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+
+	_rtw_memcpy(wrqu.ap_addr.sa_data, pmlmepriv->cur_network.network.MacAddress, ETH_ALEN);
+
+	//DBG_871X("+rtw_indicate_wx_assoc_event\n");
+	wireless_send_event(padapter->pnetdev, SIOCGIWAP, &wrqu, NULL);
+#endif
+}
+
+void rtw_indicate_wx_disassoc_event(_adapter *padapter)
+{
+#ifndef CONFIG_IOCTL_CFG80211
+	union iwreq_data wrqu;
+
+	_rtw_memset(&wrqu, 0, sizeof(union iwreq_data));
+
+	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+	_rtw_memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
+
+	//DBG_871X("+rtw_indicate_wx_disassoc_event\n");
+	wireless_send_event(padapter->pnetdev, SIOCGIWAP, &wrqu, NULL);
+#endif
+}
+
+/*
+uint	rtw_is_cckrates_included(u8 *rate)
+{
+		u32	i = 0;
+
+		while(rate[i]!=0)
+		{
+			if  (  (((rate[i]) & 0x7f) == 2)	|| (((rate[i]) & 0x7f) == 4) ||
+			(((rate[i]) & 0x7f) == 11)  || (((rate[i]) & 0x7f) == 22) )
+			return _TRUE;
+			i++;
+		}
+
+		return _FALSE;
+}
+
+uint	rtw_is_cckratesonly_included(u8 *rate)
+{
+	u32 i = 0;
+
+	while(rate[i]!=0)
+	{
+			if  (  (((rate[i]) & 0x7f) != 2) && (((rate[i]) & 0x7f) != 4) &&
+				(((rate[i]) & 0x7f) != 11)  && (((rate[i]) & 0x7f) != 22) )
+			return _FALSE;
+			i++;
+	}
+
+	return _TRUE;
+}
+*/
+
+static char *translate_scan(_adapter *padapter,
+				struct iw_request_info* info, struct wlan_network *pnetwork,
+				char *start, char *stop)
+{
+	struct iw_event iwe;
+	u16 cap;
+	u32 ht_ielen = 0;
+	char custom[MAX_CUSTOM_LEN];
+	char *p;
+	u16 max_rate=0, rate, ht_cap=_FALSE;
+	u32 i = 0;
+	char	*current_val;
+	long rssi;
+	u8 bw_40MHz=0, short_GI=0;
+	u16 mcs_rate=0;
+	struct registry_priv *pregpriv = &padapter->registrypriv;
+#ifdef CONFIG_P2P
+	struct wifidirect_info	*pwdinfo = &padapter->wdinfo;
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_P2P
+#ifdef CONFIG_WFD
+	if ( SCAN_RESULT_ALL == pwdinfo->wfd_info->scan_result_type )
+	{
+
+	}
+	else if ( ( SCAN_RESULT_P2P_ONLY == pwdinfo->wfd_info->scan_result_type ) ||
+		      ( SCAN_RESULT_WFD_TYPE == pwdinfo->wfd_info->scan_result_type ) )
+#endif // CONFIG_WFD
+	{
+		if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		{
+			u32	blnGotP2PIE = _FALSE;
+
+			//	User is doing the P2P device discovery
+			//	The prefix of SSID should be "DIRECT-" and the IE should contains the P2P IE.
+			//	If not, the driver should ignore this AP and go to the next AP.
+
+			//	Verifying the SSID
+			if ( _rtw_memcmp( pnetwork->network.Ssid.Ssid, pwdinfo->p2p_wildcard_ssid, P2P_WILDCARD_SSID_LEN ) )
+			{
+				u32	p2pielen = 0;
+
+				//	Verifying the P2P IE
+				if ( rtw_get_p2p_ie( &pnetwork->network.IEs[12], pnetwork->network.IELength - 12, NULL, &p2pielen) )
+				{
+					blnGotP2PIE = _TRUE;
+				}
+			}
+
+			if ( blnGotP2PIE == _FALSE )
+			{
+				return start;
+			}
+
+		}
+	}
+
+#ifdef CONFIG_WFD
+	if ( SCAN_RESULT_WFD_TYPE == pwdinfo->wfd_info->scan_result_type )
+	{
+		u32	blnGotWFD = _FALSE;
+		u8	wfd_ie[ 128 ] = { 0x00 };
+		uint	wfd_ielen = 0;
+
+		if ( rtw_get_wfd_ie( &pnetwork->network.IEs[12], pnetwork->network.IELength - 12,  wfd_ie, &wfd_ielen ) )
+		{
+			u8	wfd_devinfo[ 6 ] = { 0x00 };
+			uint	wfd_devlen = 6;
+
+			if ( rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_DEVICE_INFO, wfd_devinfo, &wfd_devlen) )
+			{
+				if ( pwdinfo->wfd_info->wfd_device_type == WFD_DEVINFO_PSINK )
+				{
+					//	the first two bits will indicate the WFD device type
+					if ( ( wfd_devinfo[ 1 ] & 0x03 ) == WFD_DEVINFO_SOURCE )
+					{
+						//	If this device is Miracast PSink device, the scan reuslt should just provide the Miracast source.
+						blnGotWFD = _TRUE;
+					}
+				}
+				else if ( pwdinfo->wfd_info->wfd_device_type == WFD_DEVINFO_SOURCE )
+				{
+					//	the first two bits will indicate the WFD device type
+					if ( ( wfd_devinfo[ 1 ] & 0x03 ) == WFD_DEVINFO_PSINK )
+					{
+						//	If this device is Miracast source device, the scan reuslt should just provide the Miracast PSink.
+						//	Todo: How about the SSink?!
+						blnGotWFD = _TRUE;
+					}
+				}
+			}
+		}
+
+		if ( blnGotWFD == _FALSE )
+		{
+			return start;
+		}
+	}
+#endif // CONFIG_WFD
+
+#endif //CONFIG_P2P
+	/*  AP MAC address  */
+	iwe.cmd = SIOCGIWAP;
+	iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+
+	_rtw_memcpy(iwe.u.ap_addr.sa_data, pnetwork->network.MacAddress, ETH_ALEN);
+	start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_ADDR_LEN);
+
+	/* Add the ESSID */
+	iwe.cmd = SIOCGIWESSID;
+	iwe.u.data.flags = 1;
+	iwe.u.data.length = min((u16)pnetwork->network.Ssid.SsidLength, (u16)32);
+	start = iwe_stream_add_point(info, start, stop, &iwe, pnetwork->network.Ssid.Ssid);
+
+	//parsing HT_CAP_IE
+		p = rtw_get_ie(&pnetwork->network.IEs[12], _HT_CAPABILITY_IE_, &ht_ielen, pnetwork->network.IELength-12);
+
+	if(p && ht_ielen>0)
+	{
+		struct rtw_ieee80211_ht_cap *pht_capie;
+		ht_cap = _TRUE;
+		pht_capie = (struct rtw_ieee80211_ht_cap *)(p+2);
+		_rtw_memcpy(&mcs_rate , pht_capie->supp_mcs_set, 2);
+		bw_40MHz = (pht_capie->cap_info&IEEE80211_HT_CAP_SUP_WIDTH) ? 1:0;
+		short_GI = (pht_capie->cap_info&(IEEE80211_HT_CAP_SGI_20|IEEE80211_HT_CAP_SGI_40)) ? 1:0;
+	}
+
+	/* Add the protocol name */
+	iwe.cmd = SIOCGIWNAME;
+	if ((rtw_is_cckratesonly_included((u8*)&pnetwork->network.SupportedRates)) == _TRUE)
+	{
+		if(ht_cap == _TRUE)
+			snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11bn");
+		else
+		snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11b");
+	}
+	else if ((rtw_is_cckrates_included((u8*)&pnetwork->network.SupportedRates)) == _TRUE)
+	{
+		if(ht_cap == _TRUE)
+			snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11bgn");
+		else
+		snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11bg");
+	}
+	else
+	{
+		if(pnetwork->network.Configuration.DSConfig > 14)
+		{
+			if(ht_cap == _TRUE)
+				snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11an");
+			else
+				snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11a");
+		}
+		else
+		{
+			if(ht_cap == _TRUE)
+				snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11gn");
+			else
+				snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11g");
+		}
+	}
+
+	start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_CHAR_LEN);
+
+	  /* Add mode */
+        iwe.cmd = SIOCGIWMODE;
+	_rtw_memcpy((u8 *)&cap, rtw_get_capability_from_ie(pnetwork->network.IEs), 2);
+
+
+	cap = le16_to_cpu(cap);
+
+	if(cap & (WLAN_CAPABILITY_IBSS |WLAN_CAPABILITY_BSS)){
+		if (cap & WLAN_CAPABILITY_BSS)
+			iwe.u.mode = IW_MODE_MASTER;
+		else
+			iwe.u.mode = IW_MODE_ADHOC;
+
+		start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_UINT_LEN);
+	}
+
+	if(pnetwork->network.Configuration.DSConfig<1 /*|| pnetwork->network.Configuration.DSConfig>14*/)
+		pnetwork->network.Configuration.DSConfig = 1;
+
+	 /* Add frequency/channel */
+	iwe.cmd = SIOCGIWFREQ;
+	iwe.u.freq.m = rtw_ch2freq(pnetwork->network.Configuration.DSConfig) * 100000;
+	iwe.u.freq.e = 1;
+	iwe.u.freq.i = pnetwork->network.Configuration.DSConfig;
+	start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_FREQ_LEN);
+
+	/* Add encryption capability */
+	iwe.cmd = SIOCGIWENCODE;
+	if (cap & WLAN_CAPABILITY_PRIVACY)
+		iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+	else
+		iwe.u.data.flags = IW_ENCODE_DISABLED;
+	iwe.u.data.length = 0;
+	start = iwe_stream_add_point(info, start, stop, &iwe, pnetwork->network.Ssid.Ssid);
+
+	/*Add basic and extended rates */
+	max_rate = 0;
+	p = custom;
+	p += snprintf(p, MAX_CUSTOM_LEN - (p - custom), " Rates (Mb/s): ");
+	while(pnetwork->network.SupportedRates[i]!=0)
+	{
+		rate = pnetwork->network.SupportedRates[i]&0x7F;
+		if (rate > max_rate)
+			max_rate = rate;
+		p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
+			      "%d%s ", rate >> 1, (rate & 1) ? ".5" : "");
+		i++;
+	}
+
+	if(ht_cap == _TRUE)
+	{
+		if(mcs_rate&0x8000)//MCS15
+		{
+			max_rate = (bw_40MHz) ? ((short_GI)?300:270):((short_GI)?144:130);
+
+		}
+		else if(mcs_rate&0x0080)//MCS7
+		{
+			max_rate = (bw_40MHz) ? ((short_GI)?150:135):((short_GI)?72:65);
+		}
+		else//default MCS7
+		{
+			DBG_871X("wx_get_scan, mcs_rate_bitmap=0x%x\n", mcs_rate);
+			max_rate = (bw_40MHz) ? ((short_GI)?150:135):((short_GI)?72:65);
+		}
+
+		max_rate = max_rate*2;//Mbps/2;
+	}
+
+	iwe.cmd = SIOCGIWRATE;
+	iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
+	iwe.u.bitrate.value = max_rate * 500000;
+	start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_PARAM_LEN);
+
+	//parsing WPA/WPA2 IE
+	{
+		u8 buf[MAX_WPA_IE_LEN];
+		u8 wpa_ie[255],rsn_ie[255];
+		u16 wpa_len=0,rsn_len=0;
+		u8 *p;
+		sint out_len=0;
+		out_len=rtw_get_sec_ie(pnetwork->network.IEs ,pnetwork->network.IELength,rsn_ie,&rsn_len,wpa_ie,&wpa_len);
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("rtw_wx_get_scan: ssid=%s\n",pnetwork->network.Ssid.Ssid));
+		RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("rtw_wx_get_scan: wpa_len=%d rsn_len=%d\n",wpa_len,rsn_len));
+
+		if (wpa_len > 0)
+		{
+			p=buf;
+			_rtw_memset(buf, 0, MAX_WPA_IE_LEN);
+			p += sprintf(p, "wpa_ie=");
+			for (i = 0; i < wpa_len; i++) {
+				p += sprintf(p, "%02x", wpa_ie[i]);
+			}
+
+			_rtw_memset(&iwe, 0, sizeof(iwe));
+			iwe.cmd = IWEVCUSTOM;
+			iwe.u.data.length = strlen(buf);
+			start = iwe_stream_add_point(info, start, stop, &iwe,buf);
+
+			_rtw_memset(&iwe, 0, sizeof(iwe));
+			iwe.cmd =IWEVGENIE;
+			iwe.u.data.length = wpa_len;
+			start = iwe_stream_add_point(info, start, stop, &iwe, wpa_ie);
+		}
+		if (rsn_len > 0)
+		{
+			p = buf;
+			_rtw_memset(buf, 0, MAX_WPA_IE_LEN);
+			p += sprintf(p, "rsn_ie=");
+			for (i = 0; i < rsn_len; i++) {
+				p += sprintf(p, "%02x", rsn_ie[i]);
+			}
+			_rtw_memset(&iwe, 0, sizeof(iwe));
+			iwe.cmd = IWEVCUSTOM;
+			iwe.u.data.length = strlen(buf);
+			start = iwe_stream_add_point(info, start, stop, &iwe,buf);
+
+			_rtw_memset(&iwe, 0, sizeof(iwe));
+			iwe.cmd =IWEVGENIE;
+			iwe.u.data.length = rsn_len;
+			start = iwe_stream_add_point(info, start, stop, &iwe, rsn_ie);
+		}
+	}
+
+	{ //parsing WPS IE
+		uint cnt = 0,total_ielen;
+		u8 *wpsie_ptr=NULL;
+		uint wps_ielen = 0;
+
+		u8 *ie_ptr = pnetwork->network.IEs +_FIXED_IE_LENGTH_;
+		total_ielen= pnetwork->network.IELength - _FIXED_IE_LENGTH_;
+
+		while(cnt < total_ielen)
+		{
+			if(rtw_is_wps_ie(&ie_ptr[cnt], &wps_ielen) && (wps_ielen>2))
+			{
+				wpsie_ptr = &ie_ptr[cnt];
+				iwe.cmd =IWEVGENIE;
+				iwe.u.data.length = (u16)wps_ielen;
+				start = iwe_stream_add_point(info, start, stop, &iwe, wpsie_ptr);
+			}
+			cnt+=ie_ptr[cnt+1]+2; //goto next
+		}
+	}
+
+
+{
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	u8 ss, sq;
+
+	/* Add quality statistics */
+	iwe.cmd = IWEVQUAL;
+	iwe.u.qual.updated = IW_QUAL_QUAL_UPDATED | IW_QUAL_LEVEL_UPDATED | IW_QUAL_NOISE_INVALID
+	#ifdef CONFIG_SIGNAL_DISPLAY_DBM
+		| IW_QUAL_DBM
+	#endif
+	;
+
+	if ( check_fwstate(pmlmepriv, _FW_LINKED)== _TRUE &&
+		is_same_network(&pmlmepriv->cur_network.network, &pnetwork->network)) {
+		ss = padapter->recvpriv.signal_strength;
+		sq = padapter->recvpriv.signal_qual;
+	} else {
+		ss = pnetwork->network.PhyInfo.SignalStrength;
+		sq = pnetwork->network.PhyInfo.SignalQuality;
+	}
+
+
+	#ifdef CONFIG_SIGNAL_DISPLAY_DBM
+	iwe.u.qual.level = (u8) translate_percentage_to_dbm(ss);//dbm
+	#else
+	iwe.u.qual.level = (u8)ss;//%
+	#endif
+
+	iwe.u.qual.qual = (u8)sq;   // signal quality
+
+	#ifdef CONFIG_PLATFORM_ROCKCHIPS
+	iwe.u.qual.noise = -100; // noise level suggest by zhf@rockchips
+	#else
+	iwe.u.qual.noise = 0; // noise level
+	#endif //CONFIG_PLATFORM_ROCKCHIPS
+
+	//DBG_871X("iqual=%d, ilevel=%d, inoise=%d, iupdated=%d\n", iwe.u.qual.qual, iwe.u.qual.level , iwe.u.qual.noise, iwe.u.qual.updated);
+
+	start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_QUAL_LEN);
+}
+
+	return start;
+}
+
+static int wpa_set_auth_algs(struct net_device *dev, u32 value)
+{
+	_adapter *padapter = (_adapter *) rtw_netdev_priv(dev);
+	int ret = 0;
+
+	if ((value & AUTH_ALG_SHARED_KEY)&&(value & AUTH_ALG_OPEN_SYSTEM))
+	{
+		DBG_871X("wpa_set_auth_algs, AUTH_ALG_SHARED_KEY and  AUTH_ALG_OPEN_SYSTEM [value:0x%x]\n",value);
+		padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+		padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeAutoSwitch;
+		padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Auto;
+	}
+	else if (value & AUTH_ALG_SHARED_KEY)
+	{
+		DBG_871X("wpa_set_auth_algs, AUTH_ALG_SHARED_KEY  [value:0x%x]\n",value);
+		padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+
+#ifdef CONFIG_PLATFORM_MT53XX
+		padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeAutoSwitch;
+		padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Auto;
+#else
+		padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeShared;
+		padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Shared;
+#endif
+	}
+	else if(value & AUTH_ALG_OPEN_SYSTEM)
+	{
+		DBG_871X("wpa_set_auth_algs, AUTH_ALG_OPEN_SYSTEM\n");
+		//padapter->securitypriv.ndisencryptstatus = Ndis802_11EncryptionDisabled;
+		if(padapter->securitypriv.ndisauthtype < Ndis802_11AuthModeWPAPSK)
+		{
+#ifdef CONFIG_PLATFORM_MT53XX
+			padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeAutoSwitch;
+			padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Auto;
+#else
+			padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeOpen;
+			padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Open;
+#endif
+		}
+
+	}
+	else if(value & AUTH_ALG_LEAP)
+	{
+		DBG_871X("wpa_set_auth_algs, AUTH_ALG_LEAP\n");
+	}
+	else
+	{
+		DBG_871X("wpa_set_auth_algs, error!\n");
+		ret = -EINVAL;
+	}
+
+	return ret;
+
+}
+
+static int wpa_set_encryption(struct net_device *dev, struct ieee_param *param, u32 param_len)
+{
+	int ret = 0;
+	u32 wep_key_idx, wep_key_len,wep_total_len;
+	NDIS_802_11_WEP	 *pwep = NULL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv 	*pmlmepriv = &padapter->mlmepriv;
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+#ifdef CONFIG_P2P
+	struct wifidirect_info* pwdinfo = &padapter->wdinfo;
+#endif //CONFIG_P2P
+
+_func_enter_;
+
+	param->u.crypt.err = 0;
+	param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN - 1] = '\0';
+
+	if (param_len < (u32) ((u8 *) param->u.crypt.key - (u8 *) param) + param->u.crypt.key_len)
+	{
+		ret =  -EINVAL;
+		goto exit;
+	}
+
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff)
+	{
+
+		if (param->u.crypt.idx >= WEP_KEYS
+#ifdef CONFIG_IEEE80211W
+			&& param->u.crypt.idx > BIP_MAX_KEYID
+#endif //CONFIG_IEEE80211W
+			)
+		{
+			ret = -EINVAL;
+			goto exit;
+		}
+	}
+	else
+	{
+
+		{
+			ret = -EINVAL;
+			goto exit;
+		}
+	}
+
+	if (strcmp(param->u.crypt.alg, "WEP") == 0)
+	{
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("wpa_set_encryption, crypt.alg = WEP\n"));
+		DBG_871X("wpa_set_encryption, crypt.alg = WEP\n");
+
+		padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+		padapter->securitypriv.dot11PrivacyAlgrthm=_WEP40_;
+		padapter->securitypriv.dot118021XGrpPrivacy=_WEP40_;
+
+		wep_key_idx = param->u.crypt.idx;
+		wep_key_len = param->u.crypt.key_len;
+
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_info_,("(1)wep_key_idx=%d\n", wep_key_idx));
+		DBG_871X("(1)wep_key_idx=%d\n", wep_key_idx);
+
+		if (wep_key_idx > WEP_KEYS)
+			return -EINVAL;
+
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_info_,("(2)wep_key_idx=%d\n", wep_key_idx));
+
+		if (wep_key_len > 0)
+		{
+			wep_key_len = wep_key_len <= 5 ? 5 : 13;
+			wep_total_len = wep_key_len + FIELD_OFFSET(NDIS_802_11_WEP, KeyMaterial);
+			pwep =(NDIS_802_11_WEP	 *) rtw_malloc(wep_total_len);
+			if(pwep == NULL){
+				RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,(" wpa_set_encryption: pwep allocate fail !!!\n"));
+				goto exit;
+			}
+
+			_rtw_memset(pwep, 0, wep_total_len);
+
+			pwep->KeyLength = wep_key_len;
+			pwep->Length = wep_total_len;
+
+			if(wep_key_len==13)
+			{
+				padapter->securitypriv.dot11PrivacyAlgrthm=_WEP104_;
+				padapter->securitypriv.dot118021XGrpPrivacy=_WEP104_;
+			}
+		}
+		else {
+			ret = -EINVAL;
+			goto exit;
+		}
+
+		pwep->KeyIndex = wep_key_idx;
+		pwep->KeyIndex |= 0x80000000;
+
+		_rtw_memcpy(pwep->KeyMaterial,  param->u.crypt.key, pwep->KeyLength);
+
+		if(param->u.crypt.set_tx)
+		{
+			DBG_871X("wep, set_tx=1\n");
+
+			if(rtw_set_802_11_add_wep(padapter, pwep) == (u8)_FAIL)
+			{
+				ret = -EOPNOTSUPP ;
+			}
+		}
+		else
+		{
+			DBG_871X("wep, set_tx=0\n");
+
+			//don't update "psecuritypriv->dot11PrivacyAlgrthm" and
+			//"psecuritypriv->dot11PrivacyKeyIndex=keyid", but can rtw_set_key to fw/cam
+
+			if (wep_key_idx >= WEP_KEYS) {
+				ret = -EOPNOTSUPP ;
+				goto exit;
+			}
+
+		      _rtw_memcpy(&(psecuritypriv->dot11DefKey[wep_key_idx].skey[0]), pwep->KeyMaterial, pwep->KeyLength);
+			psecuritypriv->dot11DefKeylen[wep_key_idx]=pwep->KeyLength;
+			rtw_set_key(padapter, psecuritypriv, wep_key_idx, 0);
+		}
+
+		goto exit;
+	}
+
+	if(padapter->securitypriv.dot11AuthAlgrthm == dot11AuthAlgrthm_8021X) // 802_1x
+	{
+		struct sta_info * psta,*pbcmc_sta;
+		struct sta_priv * pstapriv = &padapter->stapriv;
+
+		if (check_fwstate(pmlmepriv, WIFI_STATION_STATE | WIFI_MP_STATE) == _TRUE) //sta mode
+		{
+			psta = rtw_get_stainfo(pstapriv, get_bssid(pmlmepriv));
+			if (psta == NULL) {
+				//DEBUG_ERR( ("Set wpa_set_encryption: Obtain Sta_info fail \n"));
+			}
+			else
+			{
+				//Jeff: don't disable ieee8021x_blocked while clearing key
+				if (strcmp(param->u.crypt.alg, "none") != 0)
+					psta->ieee8021x_blocked = _FALSE;
+
+				if((padapter->securitypriv.ndisencryptstatus == Ndis802_11Encryption2Enabled)||
+						(padapter->securitypriv.ndisencryptstatus ==  Ndis802_11Encryption3Enabled))
+				{
+					psta->dot118021XPrivacy = padapter->securitypriv.dot11PrivacyAlgrthm;
+				}
+
+				if(param->u.crypt.set_tx ==1)//pairwise key
+				{
+					_rtw_memcpy(psta->dot118021x_UncstKey.skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+
+					if(strcmp(param->u.crypt.alg, "TKIP") == 0)//set mic key
+					{
+						//DEBUG_ERR(("\nset key length :param->u.crypt.key_len=%d\n", param->u.crypt.key_len));
+						_rtw_memcpy(psta->dot11tkiptxmickey.skey, &(param->u.crypt.key[16]), 8);
+						_rtw_memcpy(psta->dot11tkiprxmickey.skey, &(param->u.crypt.key[24]), 8);
+
+						padapter->securitypriv.busetkipkey=_FALSE;
+						//_set_timer(&padapter->securitypriv.tkip_timer, 50);
+					}
+
+					//DEBUG_ERR(("\n param->u.crypt.key_len=%d\n",param->u.crypt.key_len));
+					//DEBUG_ERR(("\n ~~~~stastakey:unicastkey\n"));
+					DBG_871X("\n ~~~~stastakey:unicastkey\n");
+
+					rtw_setstakey_cmd(padapter, (unsigned char *)psta, _TRUE);
+				}
+				else//group key
+				{
+					if(strcmp(param->u.crypt.alg, "TKIP") == 0 || strcmp(param->u.crypt.alg, "CCMP") == 0)
+					{
+						_rtw_memcpy(padapter->securitypriv.dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key,(param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+						//only TKIP group key need to install this
+						if(param->u.crypt.key_len > 16)
+						{
+							_rtw_memcpy(padapter->securitypriv.dot118021XGrptxmickey[param->u.crypt.idx].skey,&(param->u.crypt.key[16]),8);
+							_rtw_memcpy(padapter->securitypriv.dot118021XGrprxmickey[param->u.crypt.idx].skey,&(param->u.crypt.key[24]),8);
+						}
+						padapter->securitypriv.binstallGrpkey = _TRUE;
+						//DEBUG_ERR((" param->u.crypt.key_len=%d\n", param->u.crypt.key_len));
+						DBG_871X(" ~~~~set sta key:groupkey\n");
+
+						padapter->securitypriv.dot118021XGrpKeyid = param->u.crypt.idx;
+
+						rtw_set_key(padapter,&padapter->securitypriv,param->u.crypt.idx, 1);
+					}
+#ifdef CONFIG_IEEE80211W
+					else if(strcmp(param->u.crypt.alg, "BIP") == 0)
+					{
+						int no;
+						//printk("BIP key_len=%d , index=%d @@@@@@@@@@@@@@@@@@\n", param->u.crypt.key_len, param->u.crypt.idx);
+						//save the IGTK key, length 16 bytes
+						_rtw_memcpy(padapter->securitypriv.dot11wBIPKey[param->u.crypt.idx].skey,  param->u.crypt.key,(param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+						/*printk("IGTK key below:\n");
+						for(no=0;no<16;no++)
+							printk(" %02x ", padapter->securitypriv.dot11wBIPKey[param->u.crypt.idx].skey[no]);
+						printk("\n");*/
+						padapter->securitypriv.dot11wBIPKeyid = param->u.crypt.idx;
+						padapter->securitypriv.binstallBIPkey = _TRUE;
+						DBG_871X(" ~~~~set sta key:IGKT\n");
+					}
+#endif //CONFIG_IEEE80211W
+
+#ifdef CONFIG_P2P
+					if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_PROVISIONING_ING))
+					{
+						rtw_p2p_set_state(pwdinfo, P2P_STATE_PROVISIONING_DONE);
+					}
+#endif //CONFIG_P2P
+
+				}
+			}
+
+			pbcmc_sta=rtw_get_bcmc_stainfo(padapter);
+			if(pbcmc_sta==NULL)
+			{
+				//DEBUG_ERR( ("Set OID_802_11_ADD_KEY: bcmc stainfo is null \n"));
+			}
+			else
+			{
+				//Jeff: don't disable ieee8021x_blocked while clearing key
+				if (strcmp(param->u.crypt.alg, "none") != 0)
+					pbcmc_sta->ieee8021x_blocked = _FALSE;
+
+				if((padapter->securitypriv.ndisencryptstatus == Ndis802_11Encryption2Enabled)||
+						(padapter->securitypriv.ndisencryptstatus ==  Ndis802_11Encryption3Enabled))
+				{
+					pbcmc_sta->dot118021XPrivacy = padapter->securitypriv.dot11PrivacyAlgrthm;
+				}
+			}
+		}
+		else if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)) //adhoc mode
+		{
+		}
+	}
+
+exit:
+
+	if (pwep) {
+		rtw_mfree((u8 *)pwep, wep_total_len);
+	}
+
+	_func_exit_;
+
+	return ret;
+}
+
+static int rtw_set_wpa_ie(_adapter *padapter, char *pie, unsigned short ielen)
+{
+	u8 *buf=NULL, *pos=NULL;
+	u32 left;
+	int group_cipher = 0, pairwise_cipher = 0;
+	int ret = 0;
+	u8	null_addr[]= {0,0,0,0,0,0};
+#ifdef CONFIG_P2P
+	struct wifidirect_info* pwdinfo = &padapter->wdinfo;
+#endif //CONFIG_P2P
+
+	if((ielen > MAX_WPA_IE_LEN) || (pie == NULL)){
+		_clr_fwstate_(&padapter->mlmepriv, WIFI_UNDER_WPS);
+		if(pie == NULL)
+			return ret;
+		else
+			return -EINVAL;
+	}
+
+	if(ielen)
+	{
+		buf = rtw_zmalloc(ielen);
+		if (buf == NULL){
+			ret =  -ENOMEM;
+			goto exit;
+		}
+
+		_rtw_memcpy(buf, pie , ielen);
+
+		//dump
+		{
+			int i;
+			DBG_871X("\n wpa_ie(length:%d):\n", ielen);
+			for(i=0;i<ielen;i=i+8)
+				DBG_871X("0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x \n",buf[i],buf[i+1],buf[i+2],buf[i+3],buf[i+4],buf[i+5],buf[i+6],buf[i+7]);
+		}
+
+		pos = buf;
+		if(ielen < RSN_HEADER_LEN){
+			RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("Ie len too short %d\n", ielen));
+			ret  = -1;
+			goto exit;
+		}
+
+#if 0
+		pos += RSN_HEADER_LEN;
+		left  = ielen - RSN_HEADER_LEN;
+
+		if (left >= RSN_SELECTOR_LEN){
+			pos += RSN_SELECTOR_LEN;
+			left -= RSN_SELECTOR_LEN;
+		}
+		else if (left > 0){
+			RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("Ie length mismatch, %u too much \n", left));
+			ret =-1;
+			goto exit;
+		}
+#endif
+
+		if(rtw_parse_wpa_ie(buf, ielen, &group_cipher, &pairwise_cipher) == _SUCCESS)
+		{
+			padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_8021X;
+			padapter->securitypriv.ndisauthtype=Ndis802_11AuthModeWPAPSK;
+			_rtw_memcpy(padapter->securitypriv.supplicant_ie, &buf[0], ielen);
+		}
+
+		if(rtw_parse_wpa2_ie(buf, ielen, &group_cipher, &pairwise_cipher) == _SUCCESS)
+		{
+			padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_8021X;
+			padapter->securitypriv.ndisauthtype=Ndis802_11AuthModeWPA2PSK;
+			_rtw_memcpy(padapter->securitypriv.supplicant_ie, &buf[0], ielen);
+		}
+
+		if (group_cipher == 0)
+		{
+			group_cipher = WPA_CIPHER_NONE;
+		}
+		if (pairwise_cipher == 0)
+		{
+			pairwise_cipher = WPA_CIPHER_NONE;
+		}
+
+		switch(group_cipher)
+		{
+			case WPA_CIPHER_NONE:
+				padapter->securitypriv.dot118021XGrpPrivacy=_NO_PRIVACY_;
+				padapter->securitypriv.ndisencryptstatus=Ndis802_11EncryptionDisabled;
+				break;
+			case WPA_CIPHER_WEP40:
+				padapter->securitypriv.dot118021XGrpPrivacy=_WEP40_;
+				padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+				break;
+			case WPA_CIPHER_TKIP:
+				padapter->securitypriv.dot118021XGrpPrivacy=_TKIP_;
+				padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption2Enabled;
+				break;
+			case WPA_CIPHER_CCMP:
+				padapter->securitypriv.dot118021XGrpPrivacy=_AES_;
+				padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption3Enabled;
+				break;
+			case WPA_CIPHER_WEP104:
+				padapter->securitypriv.dot118021XGrpPrivacy=_WEP104_;
+				padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+				break;
+		}
+
+		switch(pairwise_cipher)
+		{
+			case WPA_CIPHER_NONE:
+				padapter->securitypriv.dot11PrivacyAlgrthm=_NO_PRIVACY_;
+				padapter->securitypriv.ndisencryptstatus=Ndis802_11EncryptionDisabled;
+				break;
+			case WPA_CIPHER_WEP40:
+				padapter->securitypriv.dot11PrivacyAlgrthm=_WEP40_;
+				padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+				break;
+			case WPA_CIPHER_TKIP:
+				padapter->securitypriv.dot11PrivacyAlgrthm=_TKIP_;
+				padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption2Enabled;
+				break;
+			case WPA_CIPHER_CCMP:
+				padapter->securitypriv.dot11PrivacyAlgrthm=_AES_;
+				padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption3Enabled;
+				break;
+			case WPA_CIPHER_WEP104:
+				padapter->securitypriv.dot11PrivacyAlgrthm=_WEP104_;
+				padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+				break;
+		}
+
+		_clr_fwstate_(&padapter->mlmepriv, WIFI_UNDER_WPS);
+		{//set wps_ie
+			u16 cnt = 0;
+			u8 eid, wps_oui[4]={0x0,0x50,0xf2,0x04};
+
+			while( cnt < ielen )
+			{
+				eid = buf[cnt];
+
+				if((eid==_VENDOR_SPECIFIC_IE_)&&(_rtw_memcmp(&buf[cnt+2], wps_oui, 4)==_TRUE))
+				{
+					DBG_871X("SET WPS_IE\n");
+
+					padapter->securitypriv.wps_ie_len = ( (buf[cnt+1]+2) < (MAX_WPA_IE_LEN<<2)) ? (buf[cnt+1]+2):(MAX_WPA_IE_LEN<<2);
+
+					_rtw_memcpy(padapter->securitypriv.wps_ie, &buf[cnt], padapter->securitypriv.wps_ie_len);
+
+					set_fwstate(&padapter->mlmepriv, WIFI_UNDER_WPS);
+
+#ifdef CONFIG_P2P
+					if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_GONEGO_OK))
+					{
+						rtw_p2p_set_state(pwdinfo, P2P_STATE_PROVISIONING_ING);
+					}
+#endif //CONFIG_P2P
+					cnt += buf[cnt+1]+2;
+
+					break;
+				} else {
+					cnt += buf[cnt+1]+2; //goto next
+				}
+			}
+		}
+	}
+
+	//TKIP and AES disallow multicast packets until installing group key
+	if(padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_
+		|| padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_WTMIC_
+		|| padapter->securitypriv.dot11PrivacyAlgrthm == _AES_)
+		//WPS open need to enable multicast
+		//|| check_fwstate(&padapter->mlmepriv, WIFI_UNDER_WPS) == _TRUE)
+		rtw_hal_set_hwreg(padapter, HW_VAR_OFF_RCR_AM, null_addr);
+
+	RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_info_,
+		 ("rtw_set_wpa_ie: pairwise_cipher=0x%08x padapter->securitypriv.ndisencryptstatus=%d padapter->securitypriv.ndisauthtype=%d\n",
+		  pairwise_cipher, padapter->securitypriv.ndisencryptstatus, padapter->securitypriv.ndisauthtype));
+
+exit:
+
+	if (buf) rtw_mfree(buf, ielen);
+
+	return ret;
+}
+
+static int rtw_wx_get_name(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u16 cap;
+	u32 ht_ielen = 0;
+	char *p;
+	u8 ht_cap=_FALSE;
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	WLAN_BSSID_EX  *pcur_bss = &pmlmepriv->cur_network.network;
+	NDIS_802_11_RATES_EX* prates = NULL;
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("cmd_code=%x\n", info->cmd));
+
+	_func_enter_;
+
+	if (check_fwstate(pmlmepriv, _FW_LINKED|WIFI_ADHOC_MASTER_STATE) == _TRUE)
+	{
+		//parsing HT_CAP_IE
+		p = rtw_get_ie(&pcur_bss->IEs[12], _HT_CAPABILITY_IE_, &ht_ielen, pcur_bss->IELength-12);
+		if(p && ht_ielen>0)
+		{
+			ht_cap = _TRUE;
+		}
+
+		prates = &pcur_bss->SupportedRates;
+
+		if (rtw_is_cckratesonly_included((u8*)prates) == _TRUE)
+		{
+			if(ht_cap == _TRUE)
+				snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11bn");
+			else
+				snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11b");
+		}
+		else if ((rtw_is_cckrates_included((u8*)prates)) == _TRUE)
+		{
+			if(ht_cap == _TRUE)
+				snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11bgn");
+			else
+				snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11bg");
+		}
+		else
+		{
+			if(pcur_bss->Configuration.DSConfig > 14)
+			{
+				if(ht_cap == _TRUE)
+					snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11an");
+				else
+					snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11a");
+			}
+			else
+			{
+				if(ht_cap == _TRUE)
+					snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11gn");
+				else
+					snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11g");
+			}
+		}
+	}
+	else
+	{
+		//prates = &padapter->registrypriv.dev_network.SupportedRates;
+		//snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11g");
+		snprintf(wrqu->name, IFNAMSIZ, "unassociated");
+	}
+
+	_func_exit_;
+
+	return 0;
+}
+
+static int rtw_wx_set_freq(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	_func_enter_;
+
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_, ("+rtw_wx_set_freq\n"));
+
+	_func_exit_;
+
+	return 0;
+}
+
+static int rtw_wx_get_freq(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	WLAN_BSSID_EX  *pcur_bss = &pmlmepriv->cur_network.network;
+
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE)
+	{
+		//wrqu->freq.m = ieee80211_wlan_frequencies[pcur_bss->Configuration.DSConfig-1] * 100000;
+		wrqu->freq.m = rtw_ch2freq(pcur_bss->Configuration.DSConfig) * 100000;
+		wrqu->freq.e = 1;
+		wrqu->freq.i = pcur_bss->Configuration.DSConfig;
+
+	}
+	else{
+		wrqu->freq.m = rtw_ch2freq(padapter->mlmeextpriv.cur_channel) * 100000;
+		wrqu->freq.e = 1;
+		wrqu->freq.i = padapter->mlmeextpriv.cur_channel;
+	}
+
+	return 0;
+}
+
+static int rtw_wx_set_mode(struct net_device *dev, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	NDIS_802_11_NETWORK_INFRASTRUCTURE networkType ;
+	int ret = 0;
+	_irqL irqL;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	_queue *queue = &pmlmepriv->scanned_queue;
+	_func_enter_;
+
+	if(_FAIL == rtw_pwr_wakeup(padapter)) {
+		ret= -EPERM;
+		goto exit;
+	}
+
+	if (padapter->hw_init_completed==_FALSE){
+		ret = -EPERM;
+		goto exit;
+	}
+
+	switch(wrqu->mode)
+	{
+		case IW_MODE_AUTO:
+			networkType = Ndis802_11AutoUnknown;
+			DBG_871X("set_mode = IW_MODE_AUTO\n");
+			break;
+		case IW_MODE_ADHOC:
+			networkType = Ndis802_11IBSS;
+			DBG_871X("set_mode = IW_MODE_ADHOC\n");
+			break;
+		case IW_MODE_MASTER:
+			networkType = Ndis802_11APMode;
+			DBG_871X("set_mode = IW_MODE_MASTER\n");
+                        //rtw_setopmode_cmd(padapter, networkType);
+			break;
+		case IW_MODE_INFRA:
+			networkType = Ndis802_11Infrastructure;
+			DBG_871X("set_mode = IW_MODE_INFRA\n");
+			break;
+
+		default :
+			ret = -EINVAL;;
+			RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("\n Mode: %s is not supported  \n", iw_operation_mode[wrqu->mode]));
+			goto exit;
+	}
+
+/*
+	if(Ndis802_11APMode == networkType)
+	{
+		rtw_setopmode_cmd(padapter, networkType);
+	}
+	else
+	{
+		rtw_setopmode_cmd(padapter, Ndis802_11AutoUnknown);
+	}
+*/
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	_enter_critical_bh(&queue->lock, &irqL);
+	if (rtw_set_802_11_infrastructure_mode(padapter, networkType) ==_FALSE){
+
+		ret = -EPERM;
+		_exit_critical_bh(&queue->lock, &irqL);
+		_exit_critical_bh(&pmlmepriv->lock, &irqL);
+		goto exit;
+
+	}
+	_exit_critical_bh(&queue->lock, &irqL);
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+	rtw_setopmode_cmd(padapter, networkType);
+
+exit:
+
+	_func_exit_;
+
+	return ret;
+
+}
+
+static int rtw_wx_get_mode(struct net_device *dev, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,(" rtw_wx_get_mode \n"));
+
+	_func_enter_;
+
+	if (check_fwstate(pmlmepriv, WIFI_STATION_STATE) == _TRUE)
+	{
+		wrqu->mode = IW_MODE_INFRA;
+	}
+	else if  ((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE) ||
+		       (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE))
+
+	{
+		wrqu->mode = IW_MODE_ADHOC;
+	}
+	else if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+		wrqu->mode = IW_MODE_MASTER;
+	}
+	else
+	{
+		wrqu->mode = IW_MODE_AUTO;
+	}
+
+	_func_exit_;
+
+	return 0;
+
+}
+
+
+static int rtw_wx_set_pmkid(struct net_device *dev,
+	                     struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u8          j,blInserted = _FALSE;
+	int         intReturn = _FALSE;
+	struct mlme_priv  *pmlmepriv = &padapter->mlmepriv;
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+        struct iw_pmksa*  pPMK = ( struct iw_pmksa* ) extra;
+        u8     strZeroMacAddress[ ETH_ALEN ] = { 0x00 };
+        u8     strIssueBssid[ ETH_ALEN ] = { 0x00 };
+
+/*
+        struct iw_pmksa
+        {
+            __u32   cmd;
+            struct sockaddr bssid;
+            __u8    pmkid[IW_PMKID_LEN];   //IW_PMKID_LEN=16
+        }
+        There are the BSSID information in the bssid.sa_data array.
+        If cmd is IW_PMKSA_FLUSH, it means the wpa_suppplicant wants to clear all the PMKID information.
+        If cmd is IW_PMKSA_ADD, it means the wpa_supplicant wants to add a PMKID/BSSID to driver.
+        If cmd is IW_PMKSA_REMOVE, it means the wpa_supplicant wants to remove a PMKID/BSSID from driver.
+        */
+
+	_rtw_memcpy( strIssueBssid, pPMK->bssid.sa_data, ETH_ALEN);
+        if ( pPMK->cmd == IW_PMKSA_ADD )
+        {
+                DBG_871X( "[rtw_wx_set_pmkid] IW_PMKSA_ADD!\n" );
+                if ( _rtw_memcmp( strIssueBssid, strZeroMacAddress, ETH_ALEN ) == _TRUE )
+                {
+                    return( intReturn );
+                }
+                else
+                {
+                    intReturn = _TRUE;
+                }
+		blInserted = _FALSE;
+
+		//overwrite PMKID
+		for(j=0 ; j<NUM_PMKID_CACHE; j++)
+		{
+			if( _rtw_memcmp( psecuritypriv->PMKIDList[j].Bssid, strIssueBssid, ETH_ALEN) ==_TRUE )
+			{ // BSSID is matched, the same AP => rewrite with new PMKID.
+
+                                DBG_871X( "[rtw_wx_set_pmkid] BSSID exists in the PMKList.\n" );
+
+				_rtw_memcpy( psecuritypriv->PMKIDList[j].PMKID, pPMK->pmkid, IW_PMKID_LEN);
+                                psecuritypriv->PMKIDList[ j ].bUsed = _TRUE;
+				psecuritypriv->PMKIDIndex = j+1;
+				blInserted = _TRUE;
+				break;
+			}
+	        }
+
+	        if(!blInserted)
+                {
+		    // Find a new entry
+                    DBG_871X( "[rtw_wx_set_pmkid] Use the new entry index = %d for this PMKID.\n",
+                            psecuritypriv->PMKIDIndex );
+
+	            _rtw_memcpy(psecuritypriv->PMKIDList[psecuritypriv->PMKIDIndex].Bssid, strIssueBssid, ETH_ALEN);
+		    _rtw_memcpy(psecuritypriv->PMKIDList[psecuritypriv->PMKIDIndex].PMKID, pPMK->pmkid, IW_PMKID_LEN);
+
+                    psecuritypriv->PMKIDList[ psecuritypriv->PMKIDIndex ].bUsed = _TRUE;
+		    psecuritypriv->PMKIDIndex++ ;
+		    if(psecuritypriv->PMKIDIndex==16)
+                    {
+		        psecuritypriv->PMKIDIndex =0;
+                    }
+		}
+        }
+        else if ( pPMK->cmd == IW_PMKSA_REMOVE )
+        {
+                DBG_871X( "[rtw_wx_set_pmkid] IW_PMKSA_REMOVE!\n" );
+                intReturn = _TRUE;
+		for(j=0 ; j<NUM_PMKID_CACHE; j++)
+		{
+			if( _rtw_memcmp( psecuritypriv->PMKIDList[j].Bssid, strIssueBssid, ETH_ALEN) ==_TRUE )
+			{ // BSSID is matched, the same AP => Remove this PMKID information and reset it.
+                                _rtw_memset( psecuritypriv->PMKIDList[ j ].Bssid, 0x00, ETH_ALEN );
+                                psecuritypriv->PMKIDList[ j ].bUsed = _FALSE;
+				break;
+			}
+	        }
+        }
+        else if ( pPMK->cmd == IW_PMKSA_FLUSH )
+        {
+            DBG_871X( "[rtw_wx_set_pmkid] IW_PMKSA_FLUSH!\n" );
+            _rtw_memset( &psecuritypriv->PMKIDList[ 0 ], 0x00, sizeof( RT_PMKID_LIST ) * NUM_PMKID_CACHE );
+            psecuritypriv->PMKIDIndex = 0;
+            intReturn = _TRUE;
+        }
+    return( intReturn );
+}
+
+static int rtw_wx_get_sens(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	#ifdef CONFIG_PLATFORM_ROCKCHIPS
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+	/*
+	*  20110311 Commented by Jeff
+	*  For rockchip platform's wpa_driver_wext_get_rssi
+	*/
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) {
+		//wrqu->sens.value=-padapter->recvpriv.signal_strength;
+		wrqu->sens.value=-padapter->recvpriv.rssi;
+		//DBG_871X("%s: %d\n", __FUNCTION__, wrqu->sens.value);
+		wrqu->sens.fixed = 0; /* no auto select */
+	} else
+	#endif
+	{
+		wrqu->sens.value = 0;
+		wrqu->sens.fixed = 0;	/* no auto select */
+		wrqu->sens.disabled = 1;
+	}
+	return 0;
+}
+
+static int rtw_wx_get_range(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	struct iw_range *range = (struct iw_range *)extra;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+
+	u16 val;
+	int i;
+
+	_func_enter_;
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("rtw_wx_get_range. cmd_code=%x\n", info->cmd));
+
+	wrqu->data.length = sizeof(*range);
+	_rtw_memset(range, 0, sizeof(*range));
+
+	/* Let's try to keep this struct in the same order as in
+	 * linux/include/wireless.h
+	 */
+
+	/* TODO: See what values we can set, and remove the ones we can't
+	 * set, or fill them with some default data.
+	 */
+
+	/* ~5 Mb/s real (802.11b) */
+	range->throughput = 5 * 1000 * 1000;
+
+	// TODO: Not used in 802.11b?
+//	range->min_nwid;	/* Minimal NWID we are able to set */
+	// TODO: Not used in 802.11b?
+//	range->max_nwid;	/* Maximal NWID we are able to set */
+
+        /* Old Frequency (backward compat - moved lower ) */
+//	range->old_num_channels;
+//	range->old_num_frequency;
+//	range->old_freq[6]; /* Filler to keep "version" at the same offset */
+
+	/* signal level threshold range */
+
+	//percent values between 0 and 100.
+	range->max_qual.qual = 100;
+	range->max_qual.level = 100;
+	range->max_qual.noise = 100;
+	range->max_qual.updated = 7; /* Updated all three */
+
+
+	range->avg_qual.qual = 92; /* > 8% missed beacons is 'bad' */
+	/* TODO: Find real 'good' to 'bad' threshol value for RSSI */
+	range->avg_qual.level = 20 + -98;
+	range->avg_qual.noise = 0;
+	range->avg_qual.updated = 7; /* Updated all three */
+
+	range->num_bitrates = RATE_COUNT;
+
+	for (i = 0; i < RATE_COUNT && i < IW_MAX_BITRATES; i++) {
+		range->bitrate[i] = rtw_rates[i];
+	}
+
+	range->min_frag = MIN_FRAG_THRESHOLD;
+	range->max_frag = MAX_FRAG_THRESHOLD;
+
+	range->pm_capa = 0;
+
+	range->we_version_compiled = WIRELESS_EXT;
+	range->we_version_source = 16;
+
+//	range->retry_capa;	/* What retry options are supported */
+//	range->retry_flags;	/* How to decode max/min retry limit */
+//	range->r_time_flags;	/* How to decode max/min retry life */
+//	range->min_retry;	/* Minimal number of retries */
+//	range->max_retry;	/* Maximal number of retries */
+//	range->min_r_time;	/* Minimal retry lifetime */
+//	range->max_r_time;	/* Maximal retry lifetime */
+
+	for (i = 0, val = 0; i < MAX_CHANNEL_NUM; i++) {
+
+		// Include only legal frequencies for some countries
+		if(pmlmeext->channel_set[i].ChannelNum != 0)
+		{
+			range->freq[val].i = pmlmeext->channel_set[i].ChannelNum;
+			range->freq[val].m = rtw_ch2freq(pmlmeext->channel_set[i].ChannelNum) * 100000;
+			range->freq[val].e = 1;
+			val++;
+		}
+
+		if (val == IW_MAX_FREQUENCIES)
+			break;
+	}
+
+	range->num_channels = val;
+	range->num_frequency = val;
+
+// Commented by Albert 2009/10/13
+// The following code will proivde the security capability to network manager.
+// If the driver doesn't provide this capability to network manager,
+// the WPA/WPA2 routers can't be choosen in the network manager.
+
+/*
+#define IW_SCAN_CAPA_NONE		0x00
+#define IW_SCAN_CAPA_ESSID		0x01
+#define IW_SCAN_CAPA_BSSID		0x02
+#define IW_SCAN_CAPA_CHANNEL	0x04
+#define IW_SCAN_CAPA_MODE		0x08
+#define IW_SCAN_CAPA_RATE		0x10
+#define IW_SCAN_CAPA_TYPE		0x20
+#define IW_SCAN_CAPA_TIME		0x40
+*/
+
+#if WIRELESS_EXT > 17
+	range->enc_capa = IW_ENC_CAPA_WPA|IW_ENC_CAPA_WPA2|
+			  IW_ENC_CAPA_CIPHER_TKIP|IW_ENC_CAPA_CIPHER_CCMP;
+#endif
+
+#ifdef IW_SCAN_CAPA_ESSID //WIRELESS_EXT > 21
+	range->scan_capa = IW_SCAN_CAPA_ESSID | IW_SCAN_CAPA_TYPE |IW_SCAN_CAPA_BSSID|
+					IW_SCAN_CAPA_CHANNEL|IW_SCAN_CAPA_MODE|IW_SCAN_CAPA_RATE;
+#endif
+
+
+	_func_exit_;
+
+	return 0;
+
+}
+
+//set bssid flow
+//s1. rtw_set_802_11_infrastructure_mode()
+//s2. rtw_set_802_11_authentication_mode()
+//s3. set_802_11_encryption_mode()
+//s4. rtw_set_802_11_bssid()
+static int rtw_wx_set_wap(struct net_device *dev,
+			 struct iw_request_info *info,
+			 union iwreq_data *awrq,
+			 char *extra)
+{
+	_irqL	irqL;
+	uint ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct sockaddr *temp = (struct sockaddr *)awrq;
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	_list	*phead;
+	u8 *dst_bssid, *src_bssid;
+	_queue	*queue	= &(pmlmepriv->scanned_queue);
+	struct	wlan_network	*pnetwork = NULL;
+	NDIS_802_11_AUTHENTICATION_MODE	authmode;
+
+	_func_enter_;
+/*
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->iface_type > PRIMARY_IFACE)
+	{
+		ret = -EINVAL;
+		goto exit;
+	}
+#endif
+*/
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (check_buddy_fwstate(padapter, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE)
+	{
+		printk("set bssid, but buddy_intf is under scanning or linking\n");
+
+		ret = -EINVAL;
+
+		goto exit;
+	}
+#endif
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	if (dc_check_fwstate(padapter, _FW_UNDER_SURVEY|_FW_UNDER_LINKING)== _TRUE)
+	{
+		printk("set bssid, but buddy_intf is under scanning or linking\n");
+		ret = -EINVAL;
+		goto exit;
+	}
+#endif
+
+	if(_FAIL == rtw_pwr_wakeup(padapter))
+	{
+		ret= -1;
+		goto exit;
+	}
+
+	if(!padapter->bup){
+		ret = -1;
+		goto exit;
+	}
+
+
+	if (temp->sa_family != ARPHRD_ETHER){
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	authmode = padapter->securitypriv.ndisauthtype;
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	_enter_critical_bh(&queue->lock, &irqL);
+       phead = get_list_head(queue);
+       pmlmepriv->pscanned = get_next(phead);
+
+	while (1)
+	 {
+
+		if ((rtw_end_of_queue_search(phead, pmlmepriv->pscanned)) == _TRUE)
+		{
+#if 0
+			ret = -EINVAL;
+			goto exit;
+
+			if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE)
+			{
+				rtw_set_802_11_bssid(padapter, temp->sa_data);
+				goto exit;
+			}
+			else
+			{
+				ret = -EINVAL;
+				goto exit;
+			}
+#endif
+
+			break;
+		}
+
+		pnetwork = LIST_CONTAINOR(pmlmepriv->pscanned, struct wlan_network, list);
+
+		pmlmepriv->pscanned = get_next(pmlmepriv->pscanned);
+
+		dst_bssid = pnetwork->network.MacAddress;
+
+		src_bssid = temp->sa_data;
+
+		if ((_rtw_memcmp(dst_bssid, src_bssid, ETH_ALEN)) == _TRUE)
+		{
+			if(!rtw_set_802_11_infrastructure_mode(padapter, pnetwork->network.InfrastructureMode))
+			{
+				ret = -1;
+				_exit_critical_bh(&queue->lock, &irqL);
+				_exit_critical_bh(&pmlmepriv->lock, &irqL);
+				goto exit;
+			}
+
+				break;
+		}
+
+	}
+	_exit_critical_bh(&queue->lock, &irqL);
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+	rtw_set_802_11_authentication_mode(padapter, authmode);
+	//set_802_11_encryption_mode(padapter, padapter->securitypriv.ndisencryptstatus);
+	if (rtw_set_802_11_bssid(padapter, temp->sa_data) == _FALSE) {
+		ret = -1;
+		goto exit;
+	}
+
+exit:
+
+	_func_exit_;
+
+	return ret;
+}
+
+static int rtw_wx_get_wap(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	WLAN_BSSID_EX  *pcur_bss = &pmlmepriv->cur_network.network;
+
+	wrqu->ap_addr.sa_family = ARPHRD_ETHER;
+
+	_rtw_memset(wrqu->ap_addr.sa_data, 0, ETH_ALEN);
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("rtw_wx_get_wap\n"));
+
+	_func_enter_;
+
+	if  ( ((check_fwstate(pmlmepriv, _FW_LINKED)) == _TRUE) ||
+			((check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) == _TRUE) ||
+			((check_fwstate(pmlmepriv, WIFI_AP_STATE)) == _TRUE) )
+	{
+
+		_rtw_memcpy(wrqu->ap_addr.sa_data, pcur_bss->MacAddress, ETH_ALEN);
+	}
+	else
+	{
+		_rtw_memset(wrqu->ap_addr.sa_data, 0, ETH_ALEN);
+	}
+
+	_func_exit_;
+
+	return 0;
+
+}
+
+static int rtw_wx_set_mlme(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+#if 0
+/* SIOCSIWMLME data */
+struct	iw_mlme
+{
+	__u16		cmd; /* IW_MLME_* */
+	__u16		reason_code;
+	struct sockaddr	addr;
+};
+#endif
+
+	int ret=0;
+	u16 reason;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_mlme *mlme = (struct iw_mlme *) extra;
+
+
+	if(mlme==NULL)
+		return -1;
+
+	printk("%s\n", __FUNCTION__);
+
+	reason = cpu_to_le16(mlme->reason_code);
+
+
+	printk("%s, cmd=%d, reason=%d\n", __FUNCTION__, mlme->cmd, reason);
+
+	switch (mlme->cmd)
+	{
+		case IW_MLME_DEAUTH:
+				if(!rtw_set_802_11_disassociate(padapter))
+				ret = -1;
+				break;
+
+		case IW_MLME_DISASSOC:
+				if(!rtw_set_802_11_disassociate(padapter))
+						ret = -1;
+
+				break;
+
+		default:
+			return -EOPNOTSUPP;
+	}
+
+	return ret;
+
+}
+
+static int rtw_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *extra)
+{
+	u8 _status = _FALSE;
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv= &padapter->mlmepriv;
+	NDIS_802_11_SSID ssid[RTW_SSID_SCAN_AMOUNT];
+	_irqL	irqL;
+#ifdef CONFIG_P2P
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+#endif //CONFIG_P2P
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("rtw_wx_set_scan\n"));
+
+_func_enter_;
+
+	#ifdef DBG_IOCTL
+	DBG_871X("DBG_IOCTL %s:%d\n",__FUNCTION__, __LINE__);
+	#endif
+/*
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->iface_type > PRIMARY_IFACE)
+	{
+		ret = -1;
+		goto exit;
+	}
+#endif
+*/
+
+#ifdef CONFIG_MP_INCLUDED
+	if (check_fwstate(pmlmepriv, WIFI_MP_STATE) == _TRUE)
+	{
+		ret = -1;
+		goto exit;
+	}
+#endif
+
+	if(_FAIL == rtw_pwr_wakeup(padapter))
+	{
+		ret= -1;
+		goto exit;
+	}
+
+	if(padapter->bDriverStopped){
+           DBG_871X("bDriverStopped=%d\n", padapter->bDriverStopped);
+		ret= -1;
+		goto exit;
+	}
+
+	if(!padapter->bup){
+		ret = -1;
+		goto exit;
+	}
+
+	if (padapter->hw_init_completed==_FALSE){
+		ret = -1;
+		goto exit;
+	}
+
+	// When Busy Traffic, driver do not site survey. So driver return success.
+	// wpa_supplicant will not issue SIOCSIWSCAN cmd again after scan timeout.
+	// modify by thomas 2011-02-22.
+	if (pmlmepriv->LinkDetectInfo.bBusyTraffic == _TRUE)
+	{
+		indicate_wx_scan_complete_event(padapter);
+		goto exit;
+	}
+
+	if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE)
+	{
+		indicate_wx_scan_complete_event(padapter);
+		goto exit;
+	}
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (check_buddy_fwstate(padapter,
+		_FW_UNDER_SURVEY|_FW_UNDER_LINKING|WIFI_UNDER_WPS) == _TRUE)
+	{
+		if(check_buddy_fwstate(padapter, _FW_UNDER_SURVEY))
+		{
+			printk("scanning_via_buddy_intf\n");
+			pmlmepriv->scanning_via_buddy_intf = _TRUE;
+		}
+
+		indicate_wx_scan_complete_event(padapter);
+
+		goto exit;
+	}
+#endif
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	if (dc_check_fwstate(padapter, _FW_UNDER_SURVEY|_FW_UNDER_LINKING)== _TRUE)
+	{
+		indicate_wx_scan_complete_event(padapter);
+		goto exit;
+	}
+#endif
+
+//	Mareded by Albert 20101103
+//	For the DMP WiFi Display project, the driver won't to scan because
+//	the pmlmepriv->scan_interval is always equal to 3.
+//	So, the wpa_supplicant won't find out the WPS SoftAP.
+
+/*
+	if(pmlmepriv->scan_interval>10)
+		pmlmepriv->scan_interval = 0;
+
+	if(pmlmepriv->scan_interval > 0)
+	{
+		DBG_871X("scan done\n");
+		ret = 0;
+		goto exit;
+	}
+
+*/
+#ifdef CONFIG_P2P
+	if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		rtw_p2p_set_pre_state( pwdinfo, rtw_p2p_state( pwdinfo ) );
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_FIND_PHASE_SEARCH);
+		rtw_p2p_findphase_ex_set(pwdinfo, P2P_FINDPHASE_EX_FULL);
+		rtw_free_network_queue(padapter, _TRUE);
+	}
+#endif //CONFIG_P2P
+
+	_rtw_memset(ssid, 0, sizeof(NDIS_802_11_SSID)*RTW_SSID_SCAN_AMOUNT);
+
+#if WIRELESS_EXT >= 17
+	if (wrqu->data.length == sizeof(struct iw_scan_req))
+	{
+		struct iw_scan_req *req = (struct iw_scan_req *)extra;
+
+		if (wrqu->data.flags & IW_SCAN_THIS_ESSID)
+		{
+			int len = min((int)req->essid_len, IW_ESSID_MAX_SIZE);
+
+			_rtw_memcpy(ssid[0].Ssid, req->essid, len);
+			ssid[0].SsidLength = len;
+
+			DBG_871X("IW_SCAN_THIS_ESSID, ssid=%s, len=%d\n", req->essid, req->essid_len);
+
+			_enter_critical_bh(&pmlmepriv->lock, &irqL);
+
+			_status = rtw_sitesurvey_cmd(padapter, ssid, 1, NULL, 0);
+
+			_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+		}
+		else if (req->scan_type == IW_SCAN_TYPE_PASSIVE)
+		{
+			DBG_871X("rtw_wx_set_scan, req->scan_type == IW_SCAN_TYPE_PASSIVE\n");
+		}
+
+	}
+	else
+#endif
+
+	if(	wrqu->data.length >= WEXT_CSCAN_HEADER_SIZE
+		&& _rtw_memcmp(extra, WEXT_CSCAN_HEADER, WEXT_CSCAN_HEADER_SIZE) == _TRUE
+	)
+	{
+		int len = wrqu->data.length -WEXT_CSCAN_HEADER_SIZE;
+		char *pos = extra+WEXT_CSCAN_HEADER_SIZE;
+		char section;
+		char sec_len;
+		int ssid_index = 0;
+
+		//DBG_871X("%s COMBO_SCAN header is recognized\n", __FUNCTION__);
+
+		while(len >= 1) {
+			section = *(pos++); len-=1;
+
+			switch(section) {
+				case WEXT_CSCAN_SSID_SECTION:
+					//DBG_871X("WEXT_CSCAN_SSID_SECTION\n");
+					if(len < 1) {
+						len = 0;
+						break;
+					}
+
+					sec_len = *(pos++); len-=1;
+
+					if(sec_len>0 && sec_len<=len) {
+						ssid[ssid_index].SsidLength = sec_len;
+						_rtw_memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength);
+						//DBG_871X("%s COMBO_SCAN with specific ssid:%s, %d\n", __FUNCTION__
+						//	, ssid[ssid_index].Ssid, ssid[ssid_index].SsidLength);
+						ssid_index++;
+					}
+
+					pos+=sec_len; len-=sec_len;
+					break;
+
+
+				case WEXT_CSCAN_CHANNEL_SECTION:
+					//DBG_871X("WEXT_CSCAN_CHANNEL_SECTION\n");
+					pos+=1; len-=1;
+					break;
+				case WEXT_CSCAN_ACTV_DWELL_SECTION:
+					//DBG_871X("WEXT_CSCAN_ACTV_DWELL_SECTION\n");
+					pos+=2; len-=2;
+					break;
+				case WEXT_CSCAN_PASV_DWELL_SECTION:
+					//DBG_871X("WEXT_CSCAN_PASV_DWELL_SECTION\n");
+					pos+=2; len-=2;
+					break;
+				case WEXT_CSCAN_HOME_DWELL_SECTION:
+					//DBG_871X("WEXT_CSCAN_HOME_DWELL_SECTION\n");
+					pos+=2; len-=2;
+					break;
+				case WEXT_CSCAN_TYPE_SECTION:
+					//DBG_871X("WEXT_CSCAN_TYPE_SECTION\n");
+					pos+=1; len-=1;
+					break;
+				#if 0
+				case WEXT_CSCAN_NPROBE_SECTION:
+					DBG_871X("WEXT_CSCAN_NPROBE_SECTION\n");
+					break;
+				#endif
+
+				default:
+					//DBG_871X("Unknown CSCAN section %c\n", section);
+					len = 0; // stop parsing
+			}
+			//DBG_871X("len:%d\n", len);
+
+		}
+
+		//jeff: it has still some scan paramater to parse, we only do this now...
+		_status = rtw_set_802_11_bssid_list_scan(padapter, ssid, RTW_SSID_SCAN_AMOUNT);
+
+	} else
+
+	{
+		_status = rtw_set_802_11_bssid_list_scan(padapter, NULL, 0);
+	}
+
+	if(_status == _FALSE)
+		ret = -1;
+
+exit:
+	#ifdef DBG_IOCTL
+	DBG_871X("DBG_IOCTL %s:%d return %d\n",__FUNCTION__, __LINE__, ret);
+	#endif
+
+_func_exit_;
+
+	return ret;
+}
+
+static int rtw_wx_get_scan(struct net_device *dev, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *extra)
+{
+	_irqL	irqL;
+	_list					*plist, *phead;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	_queue				*queue	= &(pmlmepriv->scanned_queue);
+	struct	wlan_network	*pnetwork = NULL;
+	char *ev = extra;
+	char *stop = ev + wrqu->data.length;
+	u32 ret = 0;
+	u32 cnt=0;
+	u32 wait_for_surveydone;
+	sint wait_status;
+#ifdef CONFIG_CONCURRENT_MODE
+	//PADAPTER pbuddy_adapter = padapter->pbuddy_adapter;
+	//struct mlme_priv *pbuddy_mlmepriv = &(pbuddy_adapter->mlmepriv);
+#endif
+#ifdef CONFIG_P2P
+	struct	wifidirect_info*	pwdinfo = &padapter->wdinfo;
+#endif //CONFIG_P2P
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("rtw_wx_get_scan\n"));
+	RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_info_, (" Start of Query SIOCGIWSCAN .\n"));
+
+	_func_enter_;
+
+	#ifdef DBG_IOCTL
+	DBG_871X("DBG_IOCTL %s:%d\n",__FUNCTION__, __LINE__);
+	#endif
+
+/*
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->iface_type > PRIMARY_IFACE)
+	{
+		ret = -EINVAL;
+		goto exit;
+	}
+#endif
+*/
+	if(padapter->pwrctrlpriv.brfoffbyhw && padapter->bDriverStopped)
+	{
+		ret = -EINVAL;
+		goto exit;
+	}
+
+#ifdef CONFIG_P2P
+	if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		//	P2P is enabled
+		if ( padapter->chip_type == RTL8192D )
+			wait_for_surveydone = 300;	//	Because the 8192du supports more channels.
+		else
+			wait_for_surveydone = 200;
+	}
+	else
+	{
+		//	P2P is disabled
+		wait_for_surveydone = 100;
+	}
+#else
+	{
+		wait_for_surveydone = 100;
+	}
+#endif //CONFIG_P2P
+
+/*
+#ifdef CONFIG_CONCURRENT_MODE
+	if(pmlmepriv->scanning_via_buddy_intf == _TRUE)
+	{
+		pmlmepriv->scanning_via_buddy_intf = _FALSE;//reset
+
+		// change pointers to buddy interface
+		padapter = pbuddy_adapter;
+		pmlmepriv = pbuddy_mlmepriv;
+		queue = &(pbuddy_mlmepriv->scanned_queue);
+
+	}
+#endif // CONFIG_CONCURRENT_MODE
+*/
+
+	wait_status = _FW_UNDER_SURVEY
+		#ifndef CONFIG_ANDROID
+		|_FW_UNDER_LINKING
+		#endif
+	;
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	while(dc_check_fwstate(padapter, wait_status)== _TRUE)
+	{
+		rtw_msleep_os(30);
+		cnt++;
+		if(cnt > wait_for_surveydone )
+			break;
+	}
+#endif // CONFIG_DUALMAC_CONCURRENT
+
+	while(check_fwstate(pmlmepriv, wait_status) == _TRUE)
+	{
+		rtw_msleep_os(30);
+		cnt++;
+		if(cnt > wait_for_surveydone )
+			break;
+	}
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while(1)
+	{
+		if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+			break;
+
+		if((stop - ev) < SCAN_ITEM_SIZE) {
+			ret = -E2BIG;
+			break;
+		}
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+
+		//report network only if the current channel set contains the channel to which this network belongs
+		if(rtw_ch_set_search_ch(padapter->mlmeextpriv.channel_set, pnetwork->network.Configuration.DSConfig) >= 0
+			&& rtw_mlme_band_check(padapter, pnetwork->network.Configuration.DSConfig) == _TRUE
+			&& _TRUE == rtw_validate_ssid(&(pnetwork->network.Ssid))
+		)
+		{
+			ev=translate_scan(padapter, a, pnetwork, ev, stop);
+		}
+
+		plist = get_next(plist);
+
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+       wrqu->data.length = ev-extra;
+	wrqu->data.flags = 0;
+
+exit:
+
+	_func_exit_;
+
+	#ifdef DBG_IOCTL
+	DBG_871X("DBG_IOCTL %s:%d return %d\n",__FUNCTION__, __LINE__, ret);
+	#endif
+
+	return ret ;
+
+}
+
+//set ssid flow
+//s1. rtw_set_802_11_infrastructure_mode()
+//s2. set_802_11_authenticaion_mode()
+//s3. set_802_11_encryption_mode()
+//s4. rtw_set_802_11_ssid()
+static int rtw_wx_set_essid(struct net_device *dev,
+			      struct iw_request_info *a,
+			      union iwreq_data *wrqu, char *extra)
+{
+	_irqL irqL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	_queue *queue = &pmlmepriv->scanned_queue;
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	_list *phead;
+	s8 status = _TRUE;
+	struct wlan_network *pnetwork = NULL;
+	NDIS_802_11_AUTHENTICATION_MODE authmode;
+	NDIS_802_11_SSID ndis_ssid;
+	u8 *dst_ssid, *src_ssid;
+
+	uint ret = 0, len;
+
+	_func_enter_;
+
+	#ifdef DBG_IOCTL
+	DBG_871X("DBG_IOCTL %s:%d\n",__FUNCTION__, __LINE__);
+	#endif
+
+/*
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->iface_type > PRIMARY_IFACE)
+	{
+		ret = -EINVAL;
+		goto exit;
+	}
+#endif
+*/
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if (check_buddy_fwstate(padapter, _FW_UNDER_SURVEY|_FW_UNDER_LINKING) == _TRUE)
+	{
+		printk("set ssid, but buddy_intf is under scanning or linking\n");
+
+		ret = -EINVAL;
+
+		goto exit;
+	}
+#endif
+
+#ifdef CONFIG_DUALMAC_CONCURRENT
+	if (dc_check_fwstate(padapter, _FW_UNDER_SURVEY|_FW_UNDER_LINKING)== _TRUE)
+	{
+		printk("set bssid, but buddy_intf is under scanning or linking\n");
+		ret = -EINVAL;
+		goto exit;
+	}
+#endif
+
+	RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_info_,
+		 ("+rtw_wx_set_essid: fw_state=0x%08x\n", get_fwstate(pmlmepriv)));
+	if(_FAIL == rtw_pwr_wakeup(padapter))
+	{
+		ret = -1;
+		goto exit;
+	}
+
+	if(!padapter->bup){
+		ret = -1;
+		goto exit;
+	}
+
+#if WIRELESS_EXT <= 20
+	if ((wrqu->essid.length-1) > IW_ESSID_MAX_SIZE){
+#else
+	if (wrqu->essid.length > IW_ESSID_MAX_SIZE){
+#endif
+		ret= -E2BIG;
+		goto exit;
+	}
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
+		ret = -1;
+		goto exit;
+	}
+
+	authmode = padapter->securitypriv.ndisauthtype;
+	DBG_871X("=>%s\n",__FUNCTION__);
+	if (wrqu->essid.flags && wrqu->essid.length)
+	{
+		// Commented by Albert 20100519
+		// We got the codes in "set_info" function of iwconfig source code.
+		//	=========================================
+		//	wrq.u.essid.length = strlen(essid) + 1;
+		//	if(we_kernel_version > 20)
+		//		wrq.u.essid.length--;
+		//	=========================================
+		//	That means, if the WIRELESS_EXT less than or equal to 20, the correct ssid len should subtract 1.
+#if WIRELESS_EXT <= 20
+		len = ((wrqu->essid.length-1) < IW_ESSID_MAX_SIZE) ? (wrqu->essid.length-1) : IW_ESSID_MAX_SIZE;
+#else
+		len = (wrqu->essid.length < IW_ESSID_MAX_SIZE) ? wrqu->essid.length : IW_ESSID_MAX_SIZE;
+#endif
+
+		if( wrqu->essid.length != 33 )
+			DBG_871X("ssid=%s, len=%d\n", extra, wrqu->essid.length);
+
+		_rtw_memset(&ndis_ssid, 0, sizeof(NDIS_802_11_SSID));
+		ndis_ssid.SsidLength = len;
+		_rtw_memcpy(ndis_ssid.Ssid, extra, len);
+		src_ssid = ndis_ssid.Ssid;
+
+		RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_info_, ("rtw_wx_set_essid: ssid=[%s]\n", src_ssid));
+		_enter_critical_bh(&pmlmepriv->lock, &irqL);
+		_enter_critical_bh(&queue->lock, &irqL);
+	       phead = get_list_head(queue);
+              pmlmepriv->pscanned = get_next(phead);
+
+		while (1)
+		{
+			if (rtw_end_of_queue_search(phead, pmlmepriv->pscanned) == _TRUE)
+			{
+#if 0
+				if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE)
+				{
+					rtw_set_802_11_ssid(padapter, &ndis_ssid);
+
+					goto exit;
+				}
+				else
+				{
+					RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_info_,("rtw_wx_set_ssid(): scanned_queue is empty\n"));
+					ret = -EINVAL;
+					goto exit;
+				}
+#endif
+			        RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_warning_,
+					 ("rtw_wx_set_essid: scan_q is empty, set ssid to check if scanning again!\n"));
+
+				break;
+			}
+
+			pnetwork = LIST_CONTAINOR(pmlmepriv->pscanned, struct wlan_network, list);
+
+			pmlmepriv->pscanned = get_next(pmlmepriv->pscanned);
+
+			dst_ssid = pnetwork->network.Ssid.Ssid;
+
+			RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_info_,
+				 ("rtw_wx_set_essid: dst_ssid=%s\n",
+				  pnetwork->network.Ssid.Ssid));
+
+			if ((_rtw_memcmp(dst_ssid, src_ssid, ndis_ssid.SsidLength) == _TRUE) &&
+				(pnetwork->network.Ssid.SsidLength==ndis_ssid.SsidLength))
+			{
+				RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_info_,
+					 ("rtw_wx_set_essid: find match, set infra mode\n"));
+
+				if(check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == _TRUE)
+				{
+					if(pnetwork->network.InfrastructureMode != pmlmepriv->cur_network.network.InfrastructureMode)
+						continue;
+				}
+
+				if (rtw_set_802_11_infrastructure_mode(padapter, pnetwork->network.InfrastructureMode) == _FALSE)
+				{
+					ret = -1;
+					_exit_critical_bh(&queue->lock, &irqL);
+					_exit_critical_bh(&pmlmepriv->lock, &irqL);
+					goto exit;
+				}
+
+				break;
+			}
+		}
+		_exit_critical_bh(&queue->lock, &irqL);
+		_exit_critical_bh(&pmlmepriv->lock, &irqL);
+		RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_info_,
+			 ("set ssid: set_802_11_auth. mode=%d\n", authmode));
+		rtw_set_802_11_authentication_mode(padapter, authmode);
+		//set_802_11_encryption_mode(padapter, padapter->securitypriv.ndisencryptstatus);
+		if (rtw_set_802_11_ssid(padapter, &ndis_ssid) == _FALSE) {
+			ret = -1;
+			goto exit;
+		}
+	}
+
+exit:
+
+	DBG_871X("<=%s, ret %d\n",__FUNCTION__, ret);
+
+	#ifdef DBG_IOCTL
+	DBG_871X("DBG_IOCTL %s:%d return %d\n",__FUNCTION__, __LINE__, ret);
+	#endif
+
+	_func_exit_;
+
+	return ret;
+}
+
+static int rtw_wx_get_essid(struct net_device *dev,
+			      struct iw_request_info *a,
+			      union iwreq_data *wrqu, char *extra)
+{
+	u32 len,ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	WLAN_BSSID_EX  *pcur_bss = &pmlmepriv->cur_network.network;
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,("rtw_wx_get_essid\n"));
+
+	_func_enter_;
+
+	if ( (check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) ||
+	      (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == _TRUE))
+	{
+		len = pcur_bss->Ssid.SsidLength;
+
+		wrqu->essid.length = len;
+
+		_rtw_memcpy(extra, pcur_bss->Ssid.Ssid, len);
+
+		wrqu->essid.flags = 1;
+	}
+	else
+	{
+		ret = -1;
+		goto exit;
+	}
+
+exit:
+
+	_func_exit_;
+
+	return ret;
+
+}
+
+static int rtw_wx_set_rate(struct net_device *dev,
+			      struct iw_request_info *a,
+			      union iwreq_data *wrqu, char *extra)
+{
+	int	i, ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u8	datarates[NumRates];
+	u32	target_rate = wrqu->bitrate.value;
+	u32	fixed = wrqu->bitrate.fixed;
+	u32	ratevalue = 0;
+	 u8 mpdatarate[NumRates]={11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0, 0xff};
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_mlme_c_,_drv_info_,(" rtw_wx_set_rate \n"));
+	RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_info_,("target_rate = %d, fixed = %d\n",target_rate,fixed));
+
+	if(target_rate == -1){
+		ratevalue = 11;
+		goto set_rate;
+	}
+	target_rate = target_rate/100000;
+
+	switch(target_rate){
+		case 10:
+			ratevalue = 0;
+			break;
+		case 20:
+			ratevalue = 1;
+			break;
+		case 55:
+			ratevalue = 2;
+			break;
+		case 60:
+			ratevalue = 3;
+			break;
+		case 90:
+			ratevalue = 4;
+			break;
+		case 110:
+			ratevalue = 5;
+			break;
+		case 120:
+			ratevalue = 6;
+			break;
+		case 180:
+			ratevalue = 7;
+			break;
+		case 240:
+			ratevalue = 8;
+			break;
+		case 360:
+			ratevalue = 9;
+			break;
+		case 480:
+			ratevalue = 10;
+			break;
+		case 540:
+			ratevalue = 11;
+			break;
+		default:
+			ratevalue = 11;
+			break;
+	}
+
+set_rate:
+
+	for(i=0; i<NumRates; i++)
+	{
+		if(ratevalue==mpdatarate[i])
+		{
+			datarates[i] = mpdatarate[i];
+			if(fixed == 0)
+				break;
+		}
+		else{
+			datarates[i] = 0xff;
+		}
+
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_info_,("datarate_inx=%d\n",datarates[i]));
+	}
+
+	if( rtw_setdatarate_cmd(padapter, datarates) !=_SUCCESS){
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("rtw_wx_set_rate Fail!!!\n"));
+		ret = -1;
+	}
+
+_func_exit_;
+
+	return ret;
+}
+
+static int rtw_wx_get_rate(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	u16 max_rate = 0;
+
+	max_rate = rtw_get_cur_max_rate((_adapter *)rtw_netdev_priv(dev));
+
+	if(max_rate == 0)
+		return -EPERM;
+
+	wrqu->bitrate.fixed = 0;	/* no auto select */
+	wrqu->bitrate.value = max_rate * 100000;
+
+	return 0;
+}
+
+static int rtw_wx_set_rts(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	_func_enter_;
+
+	if (wrqu->rts.disabled)
+		padapter->registrypriv.rts_thresh = 2347;
+	else {
+		if (wrqu->rts.value < 0 ||
+		    wrqu->rts.value > 2347)
+			return -EINVAL;
+
+		padapter->registrypriv.rts_thresh = wrqu->rts.value;
+	}
+
+	DBG_871X("%s, rts_thresh=%d\n", __func__, padapter->registrypriv.rts_thresh);
+
+	_func_exit_;
+
+	return 0;
+
+}
+
+static int rtw_wx_get_rts(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	_func_enter_;
+
+	DBG_871X("%s, rts_thresh=%d\n", __func__, padapter->registrypriv.rts_thresh);
+
+	wrqu->rts.value = padapter->registrypriv.rts_thresh;
+	wrqu->rts.fixed = 0;	/* no auto select */
+	//wrqu->rts.disabled = (wrqu->rts.value == DEFAULT_RTS_THRESHOLD);
+
+	_func_exit_;
+
+	return 0;
+}
+
+static int rtw_wx_set_frag(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	_func_enter_;
+
+	if (wrqu->frag.disabled)
+		padapter->xmitpriv.frag_len = MAX_FRAG_THRESHOLD;
+	else {
+		if (wrqu->frag.value < MIN_FRAG_THRESHOLD ||
+		    wrqu->frag.value > MAX_FRAG_THRESHOLD)
+			return -EINVAL;
+
+		padapter->xmitpriv.frag_len = wrqu->frag.value & ~0x1;
+	}
+
+	DBG_871X("%s, frag_len=%d\n", __func__, padapter->xmitpriv.frag_len);
+
+	_func_exit_;
+
+	return 0;
+
+}
+
+static int rtw_wx_get_frag(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	_func_enter_;
+
+	DBG_871X("%s, frag_len=%d\n", __func__, padapter->xmitpriv.frag_len);
+
+	wrqu->frag.value = padapter->xmitpriv.frag_len;
+	wrqu->frag.fixed = 0;	/* no auto select */
+	//wrqu->frag.disabled = (wrqu->frag.value == DEFAULT_FRAG_THRESHOLD);
+
+	_func_exit_;
+
+	return 0;
+}
+
+static int rtw_wx_get_retry(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	//_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+
+	wrqu->retry.value = 7;
+	wrqu->retry.fixed = 0;	/* no auto select */
+	wrqu->retry.disabled = 1;
+
+	return 0;
+
+}
+
+#if 0
+#define IW_ENCODE_INDEX		0x00FF	/* Token index (if needed) */
+#define IW_ENCODE_FLAGS		0xFF00	/* Flags defined below */
+#define IW_ENCODE_MODE		0xF000	/* Modes defined below */
+#define IW_ENCODE_DISABLED	0x8000	/* Encoding disabled */
+#define IW_ENCODE_ENABLED	0x0000	/* Encoding enabled */
+#define IW_ENCODE_RESTRICTED	0x4000	/* Refuse non-encoded packets */
+#define IW_ENCODE_OPEN		0x2000	/* Accept non-encoded packets */
+#define IW_ENCODE_NOKEY		0x0800  /* Key is write only, so not present */
+#define IW_ENCODE_TEMP		0x0400  /* Temporary key */
+/*
+iwconfig wlan0 key on -> flags = 0x6001 -> maybe it means auto
+iwconfig wlan0 key off -> flags = 0x8800
+iwconfig wlan0 key open -> flags = 0x2800
+iwconfig wlan0 key open 1234567890 -> flags = 0x2000
+iwconfig wlan0 key restricted -> flags = 0x4800
+iwconfig wlan0 key open [3] 1234567890 -> flags = 0x2003
+iwconfig wlan0 key restricted [2] 1234567890 -> flags = 0x4002
+iwconfig wlan0 key open [3] -> flags = 0x2803
+iwconfig wlan0 key restricted [2] -> flags = 0x4802
+*/
+#endif
+
+static int rtw_wx_set_enc(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *keybuf)
+{
+	u32 key, ret = 0;
+	u32 keyindex_provided;
+	NDIS_802_11_WEP	 wep;
+	NDIS_802_11_AUTHENTICATION_MODE authmode;
+
+	struct iw_point *erq = &(wrqu->encoding);
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	DBG_871X("+rtw_wx_set_enc, flags=0x%x\n", erq->flags);
+
+	_rtw_memset(&wep, 0, sizeof(NDIS_802_11_WEP));
+
+	key = erq->flags & IW_ENCODE_INDEX;
+
+	_func_enter_;
+
+	if (erq->flags & IW_ENCODE_DISABLED)
+	{
+		DBG_871X("EncryptionDisabled\n");
+		padapter->securitypriv.ndisencryptstatus = Ndis802_11EncryptionDisabled;
+		padapter->securitypriv.dot11PrivacyAlgrthm=_NO_PRIVACY_;
+		padapter->securitypriv.dot118021XGrpPrivacy=_NO_PRIVACY_;
+		padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_Open; //open system
+		authmode = Ndis802_11AuthModeOpen;
+		padapter->securitypriv.ndisauthtype=authmode;
+
+		goto exit;
+	}
+
+	if (key) {
+		if (key > WEP_KEYS)
+			return -EINVAL;
+		key--;
+		keyindex_provided = 1;
+	}
+	else
+	{
+		keyindex_provided = 0;
+		key = padapter->securitypriv.dot11PrivacyKeyIndex;
+		DBG_871X("rtw_wx_set_enc, key=%d\n", key);
+	}
+
+	//set authentication mode
+	if(erq->flags & IW_ENCODE_OPEN)
+	{
+		DBG_871X("rtw_wx_set_enc():IW_ENCODE_OPEN\n");
+		padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;//Ndis802_11EncryptionDisabled;
+
+#ifdef CONFIG_PLATFORM_MT53XX
+		padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Auto;
+#else
+		padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_Open;
+#endif
+
+		padapter->securitypriv.dot11PrivacyAlgrthm=_NO_PRIVACY_;
+		padapter->securitypriv.dot118021XGrpPrivacy=_NO_PRIVACY_;
+		authmode = Ndis802_11AuthModeOpen;
+		padapter->securitypriv.ndisauthtype=authmode;
+	}
+	else if(erq->flags & IW_ENCODE_RESTRICTED)
+	{
+		DBG_871X("rtw_wx_set_enc():IW_ENCODE_RESTRICTED\n");
+		padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;
+
+#ifdef CONFIG_PLATFORM_MT53XX
+		padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Auto;
+#else
+		padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_Shared;
+#endif
+
+		padapter->securitypriv.dot11PrivacyAlgrthm=_WEP40_;
+		padapter->securitypriv.dot118021XGrpPrivacy=_WEP40_;
+		authmode = Ndis802_11AuthModeShared;
+		padapter->securitypriv.ndisauthtype=authmode;
+	}
+	else
+	{
+		DBG_871X("rtw_wx_set_enc():erq->flags=0x%x\n", erq->flags);
+
+		padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled;//Ndis802_11EncryptionDisabled;
+		padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_Open; //open system
+		padapter->securitypriv.dot11PrivacyAlgrthm=_NO_PRIVACY_;
+		padapter->securitypriv.dot118021XGrpPrivacy=_NO_PRIVACY_;
+		authmode = Ndis802_11AuthModeOpen;
+		padapter->securitypriv.ndisauthtype=authmode;
+	}
+
+	wep.KeyIndex = key;
+	if (erq->length > 0)
+	{
+		wep.KeyLength = erq->length <= 5 ? 5 : 13;
+
+		wep.Length = wep.KeyLength + FIELD_OFFSET(NDIS_802_11_WEP, KeyMaterial);
+	}
+	else
+	{
+		wep.KeyLength = 0 ;
+
+		if(keyindex_provided == 1)// set key_id only, no given KeyMaterial(erq->length==0).
+		{
+			padapter->securitypriv.dot11PrivacyKeyIndex = key;
+
+			DBG_871X("(keyindex_provided == 1), keyid=%d, key_len=%d\n", key, padapter->securitypriv.dot11DefKeylen[key]);
+
+			switch(padapter->securitypriv.dot11DefKeylen[key])
+			{
+				case 5:
+					padapter->securitypriv.dot11PrivacyAlgrthm=_WEP40_;
+					break;
+				case 13:
+					padapter->securitypriv.dot11PrivacyAlgrthm=_WEP104_;
+					break;
+				default:
+					padapter->securitypriv.dot11PrivacyAlgrthm=_NO_PRIVACY_;
+					break;
+			}
+
+			goto exit;
+
+		}
+
+	}
+
+	wep.KeyIndex |= 0x80000000;
+
+	_rtw_memcpy(wep.KeyMaterial, keybuf, wep.KeyLength);
+
+	if (rtw_set_802_11_add_wep(padapter, &wep) == _FALSE) {
+		if(rf_on == pwrpriv->rf_pwrstate )
+			ret = -EOPNOTSUPP;
+		goto exit;
+	}
+
+exit:
+
+	_func_exit_;
+
+	return ret;
+
+}
+
+static int rtw_wx_get_enc(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *keybuf)
+{
+	uint key, ret =0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *erq = &(wrqu->encoding);
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+
+	_func_enter_;
+
+	if(check_fwstate(pmlmepriv, _FW_LINKED) != _TRUE)
+	{
+		 if(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) != _TRUE)
+		 {
+		erq->length = 0;
+		erq->flags |= IW_ENCODE_DISABLED;
+		return 0;
+	}
+	}
+
+
+	key = erq->flags & IW_ENCODE_INDEX;
+
+	if (key) {
+		if (key > WEP_KEYS)
+			return -EINVAL;
+		key--;
+	} else
+	{
+		key = padapter->securitypriv.dot11PrivacyKeyIndex;
+	}
+
+	erq->flags = key + 1;
+
+	//if(padapter->securitypriv.ndisauthtype == Ndis802_11AuthModeOpen)
+	//{
+	//      erq->flags |= IW_ENCODE_OPEN;
+	//}
+
+	switch(padapter->securitypriv.ndisencryptstatus)
+	{
+		case Ndis802_11EncryptionNotSupported:
+		case Ndis802_11EncryptionDisabled:
+
+		erq->length = 0;
+		erq->flags |= IW_ENCODE_DISABLED;
+
+		break;
+
+		case Ndis802_11Encryption1Enabled:
+
+		erq->length = padapter->securitypriv.dot11DefKeylen[key];
+
+		if(erq->length)
+		{
+			_rtw_memcpy(keybuf, padapter->securitypriv.dot11DefKey[key].skey, padapter->securitypriv.dot11DefKeylen[key]);
+
+		erq->flags |= IW_ENCODE_ENABLED;
+
+			if(padapter->securitypriv.ndisauthtype == Ndis802_11AuthModeOpen)
+			{
+				erq->flags |= IW_ENCODE_OPEN;
+			}
+			else if(padapter->securitypriv.ndisauthtype == Ndis802_11AuthModeShared)
+			{
+		erq->flags |= IW_ENCODE_RESTRICTED;
+			}
+		}
+		else
+		{
+			erq->length = 0;
+			erq->flags |= IW_ENCODE_DISABLED;
+		}
+
+		break;
+
+		case Ndis802_11Encryption2Enabled:
+		case Ndis802_11Encryption3Enabled:
+
+		erq->length = 16;
+		erq->flags |= (IW_ENCODE_ENABLED | IW_ENCODE_OPEN | IW_ENCODE_NOKEY);
+
+		break;
+
+		default:
+		erq->length = 0;
+		erq->flags |= IW_ENCODE_DISABLED;
+
+		break;
+
+	}
+
+	_func_exit_;
+
+	return ret;
+
+}
+
+static int rtw_wx_get_power(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	//_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	wrqu->power.value = 0;
+	wrqu->power.fixed = 0;	/* no auto select */
+	wrqu->power.disabled = 1;
+
+	return 0;
+
+}
+
+static int rtw_wx_set_gen_ie(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	int ret;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+       ret = rtw_set_wpa_ie(padapter, extra, wrqu->data.length);
+
+	return ret;
+}
+
+static int rtw_wx_set_auth(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_param *param = (struct iw_param*)&(wrqu->param);
+	int ret = 0;
+
+	switch (param->flags & IW_AUTH_INDEX) {
+	case IW_AUTH_WPA_VERSION:
+		break;
+	case IW_AUTH_CIPHER_PAIRWISE:
+
+		break;
+	case IW_AUTH_CIPHER_GROUP:
+
+		break;
+	case IW_AUTH_KEY_MGMT:
+		/*
+		 *  ??? does not use these parameters
+		 */
+		break;
+
+	case IW_AUTH_TKIP_COUNTERMEASURES:
+        {
+	    if ( param->value )
+            {  // wpa_supplicant is enabling the tkip countermeasure.
+               padapter->securitypriv.btkip_countermeasure = _TRUE;
+            }
+            else
+            {  // wpa_supplicant is disabling the tkip countermeasure.
+               padapter->securitypriv.btkip_countermeasure = _FALSE;
+            }
+		break;
+        }
+	case IW_AUTH_DROP_UNENCRYPTED:
+		{
+			/* HACK:
+			 *
+			 * wpa_supplicant calls set_wpa_enabled when the driver
+			 * is loaded and unloaded, regardless of if WPA is being
+			 * used.  No other calls are made which can be used to
+			 * determine if encryption will be used or not prior to
+			 * association being expected.  If encryption is not being
+			 * used, drop_unencrypted is set to false, else true -- we
+			 * can use this to determine if the CAP_PRIVACY_ON bit should
+			 * be set.
+			 */
+
+			if(padapter->securitypriv.ndisencryptstatus == Ndis802_11Encryption1Enabled)
+			{
+				break;//it means init value, or using wep, ndisencryptstatus = Ndis802_11Encryption1Enabled,
+						// then it needn't reset it;
+			}
+
+			if(param->value){
+				padapter->securitypriv.ndisencryptstatus = Ndis802_11EncryptionDisabled;
+				padapter->securitypriv.dot11PrivacyAlgrthm=_NO_PRIVACY_;
+				padapter->securitypriv.dot118021XGrpPrivacy=_NO_PRIVACY_;
+				padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_Open; //open system
+				padapter->securitypriv.ndisauthtype=Ndis802_11AuthModeOpen;
+			}
+
+			break;
+		}
+
+	case IW_AUTH_80211_AUTH_ALG:
+
+		#if defined(CONFIG_ANDROID) || 1
+		/*
+		 *  It's the starting point of a link layer connection using wpa_supplicant
+		*/
+		if(check_fwstate(&padapter->mlmepriv, _FW_LINKED)) {
+			LeaveAllPowerSaveMode(padapter);
+			rtw_disassoc_cmd(padapter, 500, _FALSE);
+			DBG_871X("%s...call rtw_indicate_disconnect\n ",__FUNCTION__);
+			rtw_indicate_disconnect(padapter);
+			rtw_free_assoc_resources(padapter, 1);
+		}
+		#endif
+
+
+		ret = wpa_set_auth_algs(dev, (u32)param->value);
+
+		break;
+
+	case IW_AUTH_WPA_ENABLED:
+
+		//if(param->value)
+		//	padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; //802.1x
+		//else
+		//	padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Open;//open system
+
+		//_disassociate(priv);
+
+		break;
+
+	case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+		//ieee->ieee802_1x = param->value;
+		break;
+
+	case IW_AUTH_PRIVACY_INVOKED:
+		//ieee->privacy_invoked = param->value;
+		break;
+
+	default:
+		return -EOPNOTSUPP;
+
+	}
+
+	return ret;
+
+}
+
+static int rtw_wx_set_enc_ext(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	char *alg_name;
+	u32 param_len;
+	struct ieee_param *param = NULL;
+	struct iw_point *pencoding = &wrqu->encoding;
+	struct iw_encode_ext *pext = (struct iw_encode_ext *)extra;
+	int ret=0;
+
+	param_len = sizeof(struct ieee_param) + pext->key_len;
+	param = (struct ieee_param *)rtw_malloc(param_len);
+	if (param == NULL)
+		return -1;
+
+	_rtw_memset(param, 0, param_len);
+
+	param->cmd = IEEE_CMD_SET_ENCRYPTION;
+	_rtw_memset(param->sta_addr, 0xff, ETH_ALEN);
+
+
+	switch (pext->alg) {
+	case IW_ENCODE_ALG_NONE:
+		//todo: remove key
+		//remove = 1;
+		alg_name = "none";
+		break;
+	case IW_ENCODE_ALG_WEP:
+		alg_name = "WEP";
+		break;
+	case IW_ENCODE_ALG_TKIP:
+		alg_name = "TKIP";
+		break;
+	case IW_ENCODE_ALG_CCMP:
+		alg_name = "CCMP";
+		break;
+#ifdef CONFIG_IEEE80211W
+	case IW_ENCODE_ALG_AES_CMAC:
+		alg_name = "BIP";
+		break;
+#endif //CONFIG_IEEE80211W
+	default:
+		return -1;
+	}
+
+	strncpy((char *)param->u.crypt.alg, alg_name, IEEE_CRYPT_ALG_NAME_LEN);
+
+
+	if((pext->ext_flags & IW_ENCODE_EXT_GROUP_KEY)//?
+#ifdef CONFIG_IEEE80211W
+		|| (pext->ext_flags & IW_ENCODE_ALG_AES_CMAC)
+#endif //CONFIG_IEEE80211W
+	)
+	{
+		param->u.crypt.set_tx = 0;
+	}
+
+	if (pext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)//?
+	{
+		param->u.crypt.set_tx = 1;
+	}
+
+	param->u.crypt.idx = (pencoding->flags&0x00FF) -1 ;
+
+	if (pext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID)
+	{
+		_rtw_memcpy(param->u.crypt.seq, pext->rx_seq, 8);
+	}
+
+	if(pext->key_len)
+	{
+		param->u.crypt.key_len = pext->key_len;
+		//_rtw_memcpy(param + 1, pext + 1, pext->key_len);
+		_rtw_memcpy(param->u.crypt.key, pext + 1, pext->key_len);
+	}
+
+
+	if (pencoding->flags & IW_ENCODE_DISABLED)
+	{
+		//todo: remove key
+		//remove = 1;
+	}
+
+	ret =  wpa_set_encryption(dev, param, param_len);
+
+
+	if(param)
+	{
+		rtw_mfree((u8*)param, param_len);
+	}
+
+
+	return ret;
+
+}
+
+
+static int rtw_wx_get_nick(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	//_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	 //struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	 //struct security_priv *psecuritypriv = &padapter->securitypriv;
+
+	if(extra)
+	{
+		wrqu->data.length = 14;
+		wrqu->data.flags = 1;
+		_rtw_memcpy(extra, "<WIFI@REALTEK>", 14);
+	}
+
+	//rtw_signal_process(pid, SIGUSR1); //for test
+
+	//dump debug info here
+/*
+	u32 dot11AuthAlgrthm;		// 802.11 auth, could be open, shared, and 8021x
+	u32 dot11PrivacyAlgrthm;	// This specify the privacy for shared auth. algorithm.
+	u32 dot118021XGrpPrivacy;	// This specify the privacy algthm. used for Grp key
+	u32 ndisauthtype;
+	u32 ndisencryptstatus;
+*/
+
+	//DBG_871X("auth_alg=0x%x, enc_alg=0x%x, auth_type=0x%x, enc_type=0x%x\n",
+	//		psecuritypriv->dot11AuthAlgrthm, psecuritypriv->dot11PrivacyAlgrthm,
+	//		psecuritypriv->ndisauthtype, psecuritypriv->ndisencryptstatus);
+
+	//DBG_871X("enc_alg=0x%x\n", psecuritypriv->dot11PrivacyAlgrthm);
+	//DBG_871X("auth_type=0x%x\n", psecuritypriv->ndisauthtype);
+	//DBG_871X("enc_type=0x%x\n", psecuritypriv->ndisencryptstatus);
+
+#if 0
+	DBG_871X("dbg(0x210)=0x%x\n", rtw_read32(padapter, 0x210));
+	DBG_871X("dbg(0x608)=0x%x\n", rtw_read32(padapter, 0x608));
+	DBG_871X("dbg(0x280)=0x%x\n", rtw_read32(padapter, 0x280));
+	DBG_871X("dbg(0x284)=0x%x\n", rtw_read32(padapter, 0x284));
+	DBG_871X("dbg(0x288)=0x%x\n", rtw_read32(padapter, 0x288));
+
+	DBG_871X("dbg(0x664)=0x%x\n", rtw_read32(padapter, 0x664));
+
+
+	DBG_871X("\n");
+
+	DBG_871X("dbg(0x430)=0x%x\n", rtw_read32(padapter, 0x430));
+	DBG_871X("dbg(0x438)=0x%x\n", rtw_read32(padapter, 0x438));
+
+	DBG_871X("dbg(0x440)=0x%x\n", rtw_read32(padapter, 0x440));
+
+	DBG_871X("dbg(0x458)=0x%x\n", rtw_read32(padapter, 0x458));
+
+	DBG_871X("dbg(0x484)=0x%x\n", rtw_read32(padapter, 0x484));
+	DBG_871X("dbg(0x488)=0x%x\n", rtw_read32(padapter, 0x488));
+
+	DBG_871X("dbg(0x444)=0x%x\n", rtw_read32(padapter, 0x444));
+	DBG_871X("dbg(0x448)=0x%x\n", rtw_read32(padapter, 0x448));
+	DBG_871X("dbg(0x44c)=0x%x\n", rtw_read32(padapter, 0x44c));
+	DBG_871X("dbg(0x450)=0x%x\n", rtw_read32(padapter, 0x450));
+#endif
+
+	return 0;
+
+}
+
+static int rtw_wx_read32(struct net_device *dev,
+                            struct iw_request_info *info,
+                            union iwreq_data *wrqu, char *extra)
+{
+	PADAPTER padapter;
+	struct iw_point *p;
+	u16 len;
+	u32 addr;
+	u32 data32;
+	u32 bytes;
+	u8 *ptmp;
+
+
+	padapter = (PADAPTER)rtw_netdev_priv(dev);
+	p = &wrqu->data;
+	len = p->length;
+	ptmp = (u8*)rtw_malloc(len);
+	if (NULL == ptmp)
+		return -ENOMEM;
+
+	if (copy_from_user(ptmp, p->pointer, len)) {
+		rtw_mfree(ptmp, len);
+		return -EFAULT;
+	}
+
+	bytes = 0;
+	addr = 0;
+	sscanf(ptmp, "%d,%x", &bytes, &addr);
+
+	switch (bytes) {
+		case 1:
+			data32 = rtw_read8(padapter, addr);
+			sprintf(extra, "0x%02X", data32);
+			break;
+		case 2:
+			data32 = rtw_read16(padapter, addr);
+			sprintf(extra, "0x%04X", data32);
+			break;
+		case 4:
+			data32 = rtw_read32(padapter, addr);
+			sprintf(extra, "0x%08X", data32);
+			break;
+		default:
+			printk(KERN_INFO "%s: usage> read [bytes],[address(hex)]\n", __func__);
+			return -EINVAL;
+	}
+	printk(KERN_INFO "%s: addr=0x%08X data=%s\n", __func__, addr, extra);
+
+	rtw_mfree(ptmp, len);
+
+	return 0;
+}
+
+static int rtw_wx_write32(struct net_device *dev,
+                            struct iw_request_info *info,
+                            union iwreq_data *wrqu, char *extra)
+{
+	PADAPTER padapter = (PADAPTER)rtw_netdev_priv(dev);
+
+	u32 addr;
+	u32 data32;
+	u32 bytes;
+
+
+	bytes = 0;
+	addr = 0;
+	data32 = 0;
+	sscanf(extra, "%d,%x,%x", &bytes, &addr, &data32);
+
+	switch (bytes) {
+		case 1:
+			rtw_write8(padapter, addr, (u8)data32);
+			printk(KERN_INFO "%s: addr=0x%08X data=0x%02X\n", __func__, addr, (u8)data32);
+			break;
+		case 2:
+			rtw_write16(padapter, addr, (u16)data32);
+			printk(KERN_INFO "%s: addr=0x%08X data=0x%04X\n", __func__, addr, (u16)data32);
+			break;
+		case 4:
+			rtw_write32(padapter, addr, data32);
+			printk(KERN_INFO "%s: addr=0x%08X data=0x%08X\n", __func__, addr, data32);
+			break;
+		default:
+			printk(KERN_INFO "%s: usage> write [bytes],[address(hex)],[data(hex)]\n", __func__);
+			return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int rtw_wx_read_rf(struct net_device *dev,
+                            struct iw_request_info *info,
+                            union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u32 path, addr, data32;
+
+
+	path = *(u32*)extra;
+	addr = *((u32*)extra + 1);
+	data32 = rtw_hal_read_rfreg(padapter, path, addr, 0xFFFFF);
+//	DBG_871X("%s: path=%d addr=0x%02x data=0x%05x\n", __func__, path, addr, data32);
+	/*
+	 * IMPORTANT!!
+	 * Only when wireless private ioctl is at odd order,
+	 * "extra" would be copied to user space.
+	 */
+	sprintf(extra, "0x%05x", data32);
+
+	return 0;
+}
+
+static int rtw_wx_write_rf(struct net_device *dev,
+                            struct iw_request_info *info,
+                            union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u32 path, addr, data32;
+
+
+	path = *(u32*)extra;
+	addr = *((u32*)extra + 1);
+	data32 = *((u32*)extra + 2);
+//	DBG_871X("%s: path=%d addr=0x%02x data=0x%05x\n", __func__, path, addr, data32);
+	rtw_hal_write_rfreg(padapter, path, addr, 0xFFFFF, data32);
+
+	return 0;
+}
+
+static int rtw_wx_priv_null(struct net_device *dev, struct iw_request_info *a,
+		 union iwreq_data *wrqu, char *b)
+{
+	return -1;
+}
+
+static int dummy(struct net_device *dev, struct iw_request_info *a,
+		 union iwreq_data *wrqu, char *b)
+{
+	//_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	//struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+	//DBG_871X("cmd_code=%x, fwstate=0x%x\n", a->cmd, get_fwstate(pmlmepriv));
+
+	return -1;
+
+}
+
+static int rtw_wx_set_channel_plan(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct registry_priv *pregistrypriv = &padapter->registrypriv;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	extern int rtw_channel_plan;
+	u8 channel_plan_req = (u8) (*((int *)wrqu));
+
+	#if 0
+	rtw_channel_plan = (int)wrqu->data.pointer;
+	pregistrypriv->channel_plan = rtw_channel_plan;
+	pmlmepriv->ChannelPlan = pregistrypriv->channel_plan;
+	#endif
+
+	if( _SUCCESS == rtw_set_chplan_cmd(padapter, channel_plan_req, 1) ) {
+		DBG_871X("%s set channel_plan = 0x%02X\n", __func__, pmlmepriv->ChannelPlan);
+	} else
+		return -EPERM;
+
+	return 0;
+}
+
+static int rtw_wx_set_mtk_wps_probe_ie(struct net_device *dev,
+		struct iw_request_info *a,
+		union iwreq_data *wrqu, char *b)
+{
+#ifdef CONFIG_PLATFORM_MT53XX
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+	RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_notice_,
+		 ("WLAN IOCTL: cmd_code=%x, fwstate=0x%x\n",
+		  a->cmd, get_fwstate(pmlmepriv)));
+#endif
+	return 0;
+}
+
+static int rtw_wx_get_sensitivity(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *buf)
+{
+#ifdef CONFIG_PLATFORM_MT53XX
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	//	Modified by Albert 20110914
+	//	This is in dbm format for MTK platform.
+	wrqu->qual.level = padapter->recvpriv.rssi;
+	DBG_871X(" level = %u\n",  wrqu->qual.level );
+#endif
+	return 0;
+}
+
+static int rtw_wx_set_mtk_wps_ie(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+#ifdef CONFIG_PLATFORM_MT53XX
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	return rtw_set_wpa_ie(padapter, wrqu->data.pointer, wrqu->data.length);
+#else
+	return 0;
+#endif
+}
+
+/*
+typedef int (*iw_handler)(struct net_device *dev, struct iw_request_info *info,
+			  union iwreq_data *wrqu, char *extra);
+*/
+/*
+ *	For all data larger than 16 octets, we need to use a
+ *	pointer to memory allocated in user space.
+ */
+static  int rtw_drvext_hdl(struct net_device *dev, struct iw_request_info *info,
+						union iwreq_data *wrqu, char *extra)
+{
+
+ #if 0
+struct	iw_point
+{
+  void __user	*pointer;	/* Pointer to the data  (in user space) */
+  __u16		length;		/* number of fields or size in bytes */
+  __u16		flags;		/* Optional params */
+};
+ #endif
+
+#ifdef CONFIG_DRVEXT_MODULE
+	u8 res;
+	struct drvext_handler *phandler;
+	struct drvext_oidparam *poidparam;
+	int ret;
+	u16 len;
+	u8 *pparmbuf, bset;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *p = &wrqu->data;
+
+	if( (!p->length) || (!p->pointer)){
+		ret = -EINVAL;
+		goto _rtw_drvext_hdl_exit;
+	}
+
+
+	bset = (u8)(p->flags&0xFFFF);
+	len = p->length;
+	pparmbuf = (u8*)rtw_malloc(len);
+	if (pparmbuf == NULL){
+		ret = -ENOMEM;
+		goto _rtw_drvext_hdl_exit;
+	}
+
+	if(bset)//set info
+	{
+		if (copy_from_user(pparmbuf, p->pointer,len)) {
+			rtw_mfree(pparmbuf, len);
+			ret = -EFAULT;
+			goto _rtw_drvext_hdl_exit;
+		}
+	}
+	else//query info
+	{
+
+	}
+
+
+	//
+	poidparam = (struct drvext_oidparam *)pparmbuf;
+
+	RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_info_,("drvext set oid subcode [%d], len[%d], InformationBufferLength[%d]\r\n",
+						 poidparam->subcode, poidparam->len, len));
+
+
+	//check subcode
+	if ( poidparam->subcode >= MAX_DRVEXT_HANDLERS)
+	{
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("no matching drvext handlers\r\n"));
+		ret = -EINVAL;
+		goto _rtw_drvext_hdl_exit;
+	}
+
+
+	if ( poidparam->subcode >= MAX_DRVEXT_OID_SUBCODES)
+	{
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("no matching drvext subcodes\r\n"));
+		ret = -EINVAL;
+		goto _rtw_drvext_hdl_exit;
+	}
+
+
+	phandler = drvextoidhandlers + poidparam->subcode;
+
+	if (poidparam->len != phandler->parmsize)
+	{
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_err_,("no matching drvext param size %d vs %d\r\n",
+						poidparam->len , phandler->parmsize));
+		ret = -EINVAL;
+		goto _rtw_drvext_hdl_exit;
+	}
+
+
+	res = phandler->handler(&padapter->drvextpriv, bset, poidparam->data);
+
+	if(res==0)
+	{
+		ret = 0;
+
+		if (bset == 0x00) {//query info
+			//_rtw_memcpy(p->pointer, pparmbuf, len);
+			if (copy_to_user(p->pointer, pparmbuf, len))
+				ret = -EFAULT;
+		}
+	}
+	else
+		ret = -EFAULT;
+
+
+_rtw_drvext_hdl_exit:
+
+	return ret;
+
+#endif
+
+	return 0;
+
+}
+
+static void rtw_dbg_mode_hdl(_adapter *padapter, u32 id, u8 *pdata, u32 len)
+{
+	pRW_Reg 	RegRWStruct;
+	struct rf_reg_param *prfreg;
+	u8 path;
+	u8 offset;
+	u32 value;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	switch(id)
+	{
+		case GEN_MP_IOCTL_SUBCODE(MP_START):
+			DBG_871X("871x_driver is only for normal mode, can't enter mp mode\n");
+			break;
+		case GEN_MP_IOCTL_SUBCODE(READ_REG):
+			RegRWStruct = (pRW_Reg)pdata;
+			switch (RegRWStruct->width)
+			{
+				case 1:
+					RegRWStruct->value = rtw_read8(padapter, RegRWStruct->offset);
+					break;
+				case 2:
+					RegRWStruct->value = rtw_read16(padapter, RegRWStruct->offset);
+					break;
+				case 4:
+					RegRWStruct->value = rtw_read32(padapter, RegRWStruct->offset);
+					break;
+				default:
+					break;
+			}
+
+			break;
+		case GEN_MP_IOCTL_SUBCODE(WRITE_REG):
+			RegRWStruct = (pRW_Reg)pdata;
+			switch (RegRWStruct->width)
+			{
+				case 1:
+					rtw_write8(padapter, RegRWStruct->offset, (u8)RegRWStruct->value);
+					break;
+				case 2:
+					rtw_write16(padapter, RegRWStruct->offset, (u16)RegRWStruct->value);
+					break;
+				case 4:
+					rtw_write32(padapter, RegRWStruct->offset, (u32)RegRWStruct->value);
+					break;
+				default:
+				break;
+			}
+
+			break;
+		case GEN_MP_IOCTL_SUBCODE(READ_RF_REG):
+
+			prfreg = (struct rf_reg_param *)pdata;
+
+			path = (u8)prfreg->path;
+			offset = (u8)prfreg->offset;
+
+			value = rtw_hal_read_rfreg(padapter, path, offset, 0xffffffff);
+
+			prfreg->value = value;
+
+			break;
+		case GEN_MP_IOCTL_SUBCODE(WRITE_RF_REG):
+
+			prfreg = (struct rf_reg_param *)pdata;
+
+			path = (u8)prfreg->path;
+			offset = (u8)prfreg->offset;
+			value = prfreg->value;
+
+			rtw_hal_write_rfreg(padapter, path, offset, 0xffffffff, value);
+
+			break;
+                case GEN_MP_IOCTL_SUBCODE(TRIGGER_GPIO):
+			DBG_871X("==> trigger gpio 0\n");
+			rtw_hal_set_hwreg(padapter, HW_VAR_TRIGGER_GPIO_0, 0);
+			break;
+#ifdef CONFIG_BT_COEXIST
+		case GEN_MP_IOCTL_SUBCODE(SET_DM_BT):
+			DBG_871X("==> set dm_bt_coexist:%x\n",*(u8 *)pdata);
+			rtw_hal_set_hwreg(padapter, HW_VAR_BT_SET_COEXIST, pdata);
+			break;
+		case GEN_MP_IOCTL_SUBCODE(DEL_BA):
+			DBG_871X("==> delete ba:%x\n",*(u8 *)pdata);
+			rtw_hal_set_hwreg(padapter, HW_VAR_BT_ISSUE_DELBA, pdata);
+			break;
+#endif
+#ifdef DBG_CONFIG_ERROR_DETECT
+		case GEN_MP_IOCTL_SUBCODE(GET_WIFI_STATUS):
+			*pdata = rtw_hal_sreset_get_wifi_status(padapter);
+			break;
+#endif
+
+		default:
+			break;
+	}
+
+}
+
+static int rtw_mp_ioctl_hdl(struct net_device *dev, struct iw_request_info *info,
+						union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+	u32 BytesRead, BytesWritten, BytesNeeded;
+	struct oid_par_priv	oid_par;
+	struct mp_ioctl_handler	*phandler;
+	struct mp_ioctl_param	*poidparam;
+	uint status=0;
+	u16 len;
+	u8 *pparmbuf = NULL, bset;
+	PADAPTER padapter = (PADAPTER)rtw_netdev_priv(dev);
+	struct iw_point *p = &wrqu->data;
+
+	//DBG_871X("+rtw_mp_ioctl_hdl\n");
+
+	//mutex_lock(&ioctl_mutex);
+
+	if ((!p->length) || (!p->pointer)) {
+		ret = -EINVAL;
+		goto _rtw_mp_ioctl_hdl_exit;
+	}
+
+	pparmbuf = NULL;
+	bset = (u8)(p->flags & 0xFFFF);
+	len = p->length;
+	pparmbuf = (u8*)rtw_malloc(len);
+	if (pparmbuf == NULL){
+		ret = -ENOMEM;
+		goto _rtw_mp_ioctl_hdl_exit;
+	}
+
+	if (copy_from_user(pparmbuf, p->pointer, len)) {
+		ret = -EFAULT;
+		goto _rtw_mp_ioctl_hdl_exit;
+	}
+
+	poidparam = (struct mp_ioctl_param *)pparmbuf;
+	RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_info_,
+		 ("rtw_mp_ioctl_hdl: subcode [%d], len[%d], buffer_len[%d]\r\n",
+		  poidparam->subcode, poidparam->len, len));
+
+	if (poidparam->subcode >= MAX_MP_IOCTL_SUBCODE) {
+		RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_err_, ("no matching drvext subcodes\r\n"));
+		ret = -EINVAL;
+		goto _rtw_mp_ioctl_hdl_exit;
+	}
+
+	//DBG_871X("%s: %d\n", __func__, poidparam->subcode);
+
+#ifdef CONFIG_MP_INCLUDED
+	phandler = mp_ioctl_hdl + poidparam->subcode;
+
+	if ((phandler->paramsize != 0) && (poidparam->len < phandler->paramsize))
+	{
+		RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_err_,
+			 ("no matching drvext param size %d vs %d\r\n",
+			  poidparam->len, phandler->paramsize));
+		ret = -EINVAL;
+		goto _rtw_mp_ioctl_hdl_exit;
+	}
+
+	if (phandler->handler)
+	{
+		oid_par.adapter_context = padapter;
+		oid_par.oid = phandler->oid;
+		oid_par.information_buf = poidparam->data;
+		oid_par.information_buf_len = poidparam->len;
+		oid_par.dbg = 0;
+
+		BytesWritten = 0;
+		BytesNeeded = 0;
+
+		if (bset) {
+			oid_par.bytes_rw = &BytesRead;
+			oid_par.bytes_needed = &BytesNeeded;
+			oid_par.type_of_oid = SET_OID;
+		} else {
+			oid_par.bytes_rw = &BytesWritten;
+			oid_par.bytes_needed = &BytesNeeded;
+			oid_par.type_of_oid = QUERY_OID;
+		}
+
+		status = phandler->handler(&oid_par);
+
+		//todo:check status, BytesNeeded, etc.
+	}
+	else {
+		DBG_871X("rtw_mp_ioctl_hdl(): err!, subcode=%d, oid=%d, handler=%p\n",
+			poidparam->subcode, phandler->oid, phandler->handler);
+		ret = -EFAULT;
+		goto _rtw_mp_ioctl_hdl_exit;
+	}
+#else
+
+	rtw_dbg_mode_hdl(padapter, poidparam->subcode, poidparam->data, poidparam->len);
+
+#endif
+
+	if (bset == 0x00) {//query info
+		if (copy_to_user(p->pointer, pparmbuf, len))
+			ret = -EFAULT;
+	}
+
+	if (status) {
+		ret = -EFAULT;
+		goto _rtw_mp_ioctl_hdl_exit;
+	}
+
+_rtw_mp_ioctl_hdl_exit:
+
+	if (pparmbuf)
+		rtw_mfree(pparmbuf, len);
+
+	//mutex_unlock(&ioctl_mutex);
+
+	return ret;
+}
+
+static int rtw_get_ap_info(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	int bssid_match, ret = 0;
+	u32 cnt=0, wpa_ielen;
+	_irqL	irqL;
+	_list	*plist, *phead;
+	unsigned char *pbuf;
+	u8 bssid[ETH_ALEN];
+	char data[32];
+	struct wlan_network *pnetwork = NULL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	_queue *queue = &(pmlmepriv->scanned_queue);
+	struct iw_point *pdata = &wrqu->data;
+
+	DBG_871X("+rtw_get_aplist_info\n");
+
+	if((padapter->bDriverStopped) || (pdata==NULL))
+	{
+		ret= -EINVAL;
+		goto exit;
+	}
+
+	while((check_fwstate(pmlmepriv, (_FW_UNDER_SURVEY|_FW_UNDER_LINKING))) == _TRUE)
+	{
+		rtw_msleep_os(30);
+		cnt++;
+		if(cnt > 100)
+			break;
+	}
+
+
+	//pdata->length = 0;//?
+	pdata->flags = 0;
+	if(pdata->length>=32)
+	{
+		if(copy_from_user(data, pdata->pointer, 32))
+		{
+			ret= -EINVAL;
+			goto exit;
+		}
+	}
+	else
+	{
+		ret= -EINVAL;
+		goto exit;
+	}
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while(1)
+	{
+		if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+			break;
+
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+
+		//if(hwaddr_aton_i(pdata->pointer, bssid))
+		if(hwaddr_aton_i(data, bssid))
+		{
+			DBG_871X("Invalid BSSID '%s'.\n", (u8*)data);
+			_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+			return -EINVAL;
+		}
+
+
+		if(_rtw_memcmp(bssid, pnetwork->network.MacAddress, ETH_ALEN) == _TRUE)//BSSID match, then check if supporting wpa/wpa2
+		{
+			DBG_871X("BSSID:" MAC_FMT "\n", MAC_ARG(bssid));
+
+			pbuf = rtw_get_wpa_ie(&pnetwork->network.IEs[12], &wpa_ielen, pnetwork->network.IELength-12);
+			if(pbuf && (wpa_ielen>0))
+			{
+				pdata->flags = 1;
+				break;
+			}
+
+			pbuf = rtw_get_wpa2_ie(&pnetwork->network.IEs[12], &wpa_ielen, pnetwork->network.IELength-12);
+			if(pbuf && (wpa_ielen>0))
+			{
+				pdata->flags = 2;
+				break;
+			}
+
+		}
+
+		plist = get_next(plist);
+
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	if(pdata->length>=34)
+	{
+		if(copy_to_user((u8*)pdata->pointer+32, (u8*)&pdata->flags, 1))
+		{
+			ret= -EINVAL;
+			goto exit;
+		}
+	}
+
+exit:
+
+	return ret;
+
+}
+
+static int rtw_set_pid(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter *padapter = rtw_netdev_priv(dev);
+	int *pdata = (int *)wrqu;
+	int selector;
+
+	if((padapter->bDriverStopped) || (pdata==NULL))
+	{
+		ret= -EINVAL;
+		goto exit;
+	}
+
+	selector = *pdata;
+	if(selector < 3 && selector >=0) {
+		padapter->pid[selector] = *(pdata+1);
+		#ifdef CONFIG_GLOBAL_UI_PID
+		ui_pid[selector] = *(pdata+1);
+		#endif
+		DBG_871X("%s set pid[%d]=%d\n", __FUNCTION__, selector ,padapter->pid[selector]);
+	}
+	else
+		DBG_871X("%s selector %d error\n", __FUNCTION__, selector);
+
+exit:
+
+	return ret;
+
+}
+
+static int rtw_wps_start(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *pdata = &wrqu->data;
+	u32   u32wps_start = 0;
+        unsigned int uintRet = 0;
+
+        uintRet = copy_from_user( ( void* ) &u32wps_start, pdata->pointer, 4 );
+
+	if((padapter->bDriverStopped) || (pdata==NULL))
+	{
+		ret= -EINVAL;
+		goto exit;
+	}
+
+	if ( u32wps_start == 0 )
+	{
+		u32wps_start = *extra;
+	}
+
+	DBG_871X( "[%s] wps_start = %d\n", __FUNCTION__, u32wps_start );
+
+	if ( u32wps_start == 1 ) // WPS Start
+	{
+		rtw_led_control(padapter, LED_CTL_START_WPS);
+	}
+	else if ( u32wps_start == 2 ) // WPS Stop because of wps success
+	{
+		rtw_led_control(padapter, LED_CTL_STOP_WPS);
+	}
+	else if ( u32wps_start == 3 ) // WPS Stop because of wps fail
+	{
+		rtw_led_control(padapter, LED_CTL_STOP_WPS_FAIL);
+	}
+
+#ifdef CONFIG_INTEL_WIDI
+	process_intel_widi_wps_status(padapter, u32wps_start);
+#endif //CONFIG_INTEL_WIDI
+
+exit:
+
+	return ret;
+
+}
+
+#ifdef CONFIG_P2P
+static int rtw_wext_p2p_enable(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	enum P2P_ROLE init_role = P2P_ROLE_DISABLE;
+
+	if(*extra == '0' )
+		init_role = P2P_ROLE_DISABLE;
+	else if(*extra == '1')
+		init_role = P2P_ROLE_DEVICE;
+	else if(*extra == '2')
+		init_role = P2P_ROLE_CLIENT;
+	else if(*extra == '3')
+		init_role = P2P_ROLE_GO;
+
+	if(_FAIL == rtw_p2p_enable(padapter, init_role))
+	{
+		ret = -EFAULT;
+		goto exit;
+	}
+
+	//set channel/bandwidth
+	if(init_role != P2P_ROLE_DISABLE)
+	{
+		u8 channel, ch_offset;
+		u16 bwmode;
+
+		if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_LISTEN))
+		{
+			//	Stay at the listen state and wait for discovery.
+			channel = pwdinfo->listen_channel;
+			pwdinfo->operating_channel = pwdinfo->listen_channel;
+			ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+			bwmode = HT_CHANNEL_WIDTH_20;
+		}
+#ifdef CONFIG_CONCURRENT_MODE
+		else if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_IDLE))
+		{
+			_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+			//struct wifidirect_info	*pbuddy_wdinfo = &pbuddy_adapter->wdinfo;
+			struct mlme_priv		*pbuddy_mlmepriv = &pbuddy_adapter->mlmepriv;
+			struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+
+			_set_timer( &pwdinfo->ap_p2p_switch_timer, pwdinfo->ext_listen_interval );
+			if ( check_fwstate( pbuddy_mlmepriv, _FW_LINKED ) )
+			{
+				pwdinfo->operating_channel = pbuddy_mlmeext->cur_channel;
+				//	How about the ch_offset and bwmode ??
+			}
+			else
+			{
+				pwdinfo->operating_channel = pwdinfo->listen_channel;
+			}
+
+			channel = pbuddy_mlmeext->cur_channel;
+			ch_offset = pbuddy_mlmeext->cur_ch_offset;
+			bwmode = pbuddy_mlmeext->cur_bwmode;
+		}
+#endif
+		else
+		{
+			pwdinfo->operating_channel = pmlmeext->cur_channel;
+
+			channel = pwdinfo->operating_channel;
+			ch_offset = pmlmeext->cur_ch_offset;
+			bwmode = pmlmeext->cur_bwmode;
+		}
+
+		set_channel_bwmode(padapter, channel, ch_offset, bwmode);
+	}
+
+exit:
+	return ret;
+
+}
+
+static int rtw_p2p_set_go_nego_ssid(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+
+	DBG_871X( "[%s] ssid = %s, len = %d\n", __FUNCTION__, extra, (u32)strlen( extra ) );
+	_rtw_memcpy( pwdinfo->nego_ssid, extra, strlen( extra ) );
+	pwdinfo->nego_ssidlen = strlen( extra );
+
+	return ret;
+
+}
+
+
+static int rtw_p2p_set_intent(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	int 							ret = 0;
+	_adapter 						*padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info 			*pwdinfo= &(padapter->wdinfo);
+	u8							intent = pwdinfo->intent;
+
+	extra[ wrqu->data.length ] = 0x00;
+
+	intent = rtw_atoi( extra );
+
+	if ( intent <= 15 )
+	{
+		pwdinfo->intent= intent;
+	}
+	else
+	{
+		ret = -1;
+	}
+
+	DBG_871X( "[%s] intent = %d\n", __FUNCTION__, intent);
+
+	return ret;
+
+}
+
+static int rtw_p2p_set_listen_ch(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+	u8	listen_ch = pwdinfo->listen_channel;	//	Listen channel number
+
+	extra[ wrqu->data.length ] = 0x00;
+	listen_ch = rtw_atoi( extra );
+
+	if ( ( listen_ch == 1 ) || ( listen_ch == 6 ) || ( listen_ch == 11 ) )
+	{
+		pwdinfo->listen_channel = listen_ch;
+		set_channel_bwmode(padapter, pwdinfo->listen_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+	}
+	else
+	{
+		ret = -1;
+	}
+
+	DBG_871X( "[%s] listen_ch = %d\n", __FUNCTION__, pwdinfo->listen_channel );
+
+	return ret;
+
+}
+
+static int rtw_p2p_set_op_ch(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+//	Commented by Albert 20110524
+//	This function is used to set the operating channel if the driver will become the group owner
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+	u8	op_ch = pwdinfo->operating_channel;	//	Operating channel number
+
+	extra[ wrqu->data.length ] = 0x00;
+
+	op_ch = ( u8 ) rtw_atoi( extra );
+	if ( op_ch > 0 )
+	{
+		pwdinfo->operating_channel = op_ch;
+	}
+	else
+	{
+		ret = -1;
+	}
+
+	DBG_871X( "[%s] op_ch = %d\n", __FUNCTION__, pwdinfo->operating_channel );
+
+	return ret;
+
+}
+
+
+static int rtw_p2p_profilefound(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+
+	//	Comment by Albert 2010/10/13
+	//	Input data format:
+	//	Ex:  0
+	//	Ex:  1XX:XX:XX:XX:XX:XXYYSSID
+	//	0 => Reflush the profile record list.
+	//	1 => Add the profile list
+	//	XX:XX:XX:XX:XX:XX => peer's MAC Address ( ex: 00:E0:4C:00:00:01 )
+	//	YY => SSID Length
+	//	SSID => SSID for persistence group
+
+	DBG_871X( "[%s] In value = %s, len = %d \n", __FUNCTION__, extra, wrqu->data.length -1);
+
+
+	//	The upper application should pass the SSID to driver by using this rtw_p2p_profilefound function.
+	if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		if ( extra[ 0 ] == '0' )
+		{
+			//	Remove all the profile information of wifidirect_info structure.
+			_rtw_memset( &pwdinfo->profileinfo[ 0 ], 0x00, sizeof( struct profile_info ) * P2P_MAX_PERSISTENT_GROUP_NUM );
+			pwdinfo->profileindex = 0;
+		}
+		else
+		{
+			if ( pwdinfo->profileindex >= P2P_MAX_PERSISTENT_GROUP_NUM )
+		{
+				ret = -1;
+		}
+		else
+		{
+				int jj, kk;
+
+				//	Add this profile information into pwdinfo->profileinfo
+				//	Ex:  1XX:XX:XX:XX:XX:XXYYSSID
+				for( jj = 0, kk = 1; jj < ETH_ALEN; jj++, kk += 3 )
+				{
+					pwdinfo->profileinfo[ pwdinfo->profileindex ].peermac[ jj ] = key_2char2num(extra[ kk ], extra[ kk+ 1 ]);
+				}
+
+				//pwdinfo->profileinfo[ pwdinfo->profileindex ].ssidlen = ( extra[18] - '0' ) * 10 + ( extra[ 19 ] - '0' );
+				//_rtw_memcpy( pwdinfo->profileinfo[ pwdinfo->profileindex ].ssid, &extra[ 20 ], pwdinfo->profileinfo[ pwdinfo->profileindex ].ssidlen );
+				pwdinfo->profileindex++;
+			}
+		}
+	}
+
+	return ret;
+
+}
+
+static int rtw_p2p_setDN(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+
+
+	DBG_871X( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	_rtw_memset( pwdinfo->device_name, 0x00, WPS_MAX_DEVICE_NAME_LEN );
+	_rtw_memcpy( pwdinfo->device_name, extra, wrqu->data.length - 1 );
+	pwdinfo->device_name_len = wrqu->data.length - 1;
+	return ret;
+
+}
+
+
+static int rtw_p2p_get_status(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+
+	if ( padapter->bShowGetP2PState )
+	{
+		DBG_871X( "[%s] Role = %d, Status = %d, peer addr = %.2X:%.2X:%.2X:%.2X:%.2X:%.2X\n", __FUNCTION__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo),
+				pwdinfo->p2p_peer_interface_addr[ 0 ], pwdinfo->p2p_peer_interface_addr[ 1 ], pwdinfo->p2p_peer_interface_addr[ 2 ],
+				pwdinfo->p2p_peer_interface_addr[ 3 ], pwdinfo->p2p_peer_interface_addr[ 4 ], pwdinfo->p2p_peer_interface_addr[ 5 ]);
+	}
+
+	//	Commented by Albert 2010/10/12
+	//	Because of the output size limitation, I had removed the "Role" information.
+	//	About the "Role" information, we will use the new private IOCTL to get the "Role" information.
+	sprintf( extra, "\n\nStatus=%.2d\n", rtw_p2p_state(pwdinfo) );
+	wrqu->data.length = strlen( extra );
+
+	return ret;
+
+}
+
+//	Commented by Albert 20110520
+//	This function will return the config method description
+//	This config method description will show us which config method the remote P2P device is intented to use
+//	by sending the provisioning discovery request frame.
+
+static int rtw_p2p_get_req_cm(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+	sprintf( extra, "\n\nCM=%s\n", pwdinfo->rx_prov_disc_info.strconfig_method_desc_of_prov_disc_req );
+	wrqu->data.length = strlen( extra );
+	return ret;
+
+}
+
+
+static int rtw_p2p_get_role(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+
+	DBG_871X( "[%s] Role = %d, Status = %d, peer addr = %.2X:%.2X:%.2X:%.2X:%.2X:%.2X\n", __FUNCTION__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo),
+			pwdinfo->p2p_peer_interface_addr[ 0 ], pwdinfo->p2p_peer_interface_addr[ 1 ], pwdinfo->p2p_peer_interface_addr[ 2 ],
+			pwdinfo->p2p_peer_interface_addr[ 3 ], pwdinfo->p2p_peer_interface_addr[ 4 ], pwdinfo->p2p_peer_interface_addr[ 5 ]);
+
+	sprintf( extra, "\n\nRole=%.2d\n", rtw_p2p_role(pwdinfo) );
+	wrqu->data.length = strlen( extra );
+	return ret;
+
+}
+
+
+static int rtw_p2p_get_peer_ifaddr(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+
+	DBG_871X( "[%s] Role = %d, Status = %d, peer addr = %.2X:%.2X:%.2X:%.2X:%.2X:%.2X\n", __FUNCTION__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo),
+			pwdinfo->p2p_peer_interface_addr[ 0 ], pwdinfo->p2p_peer_interface_addr[ 1 ], pwdinfo->p2p_peer_interface_addr[ 2 ],
+			pwdinfo->p2p_peer_interface_addr[ 3 ], pwdinfo->p2p_peer_interface_addr[ 4 ], pwdinfo->p2p_peer_interface_addr[ 5 ]);
+
+	sprintf( extra, "\nMAC %.2X:%.2X:%.2X:%.2X:%.2X:%.2X",
+			pwdinfo->p2p_peer_interface_addr[ 0 ], pwdinfo->p2p_peer_interface_addr[ 1 ], pwdinfo->p2p_peer_interface_addr[ 2 ],
+			pwdinfo->p2p_peer_interface_addr[ 3 ], pwdinfo->p2p_peer_interface_addr[ 4 ], pwdinfo->p2p_peer_interface_addr[ 5 ]);
+	wrqu->data.length = strlen( extra );
+	return ret;
+
+}
+
+static int rtw_p2p_get_peer_devaddr(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+	DBG_871X( "[%s] Role = %d, Status = %d, peer addr = %.2X:%.2X:%.2X:%.2X:%.2X:%.2X\n", __FUNCTION__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo),
+			pwdinfo->rx_prov_disc_info.peerDevAddr[ 0 ], pwdinfo->rx_prov_disc_info.peerDevAddr[ 1 ],
+			pwdinfo->rx_prov_disc_info.peerDevAddr[ 2 ], pwdinfo->rx_prov_disc_info.peerDevAddr[ 3 ],
+			pwdinfo->rx_prov_disc_info.peerDevAddr[ 4 ], pwdinfo->rx_prov_disc_info.peerDevAddr[ 5 ]);
+	sprintf( extra, "\n%.2X%.2X%.2X%.2X%.2X%.2X",
+			pwdinfo->rx_prov_disc_info.peerDevAddr[ 0 ], pwdinfo->rx_prov_disc_info.peerDevAddr[ 1 ],
+			pwdinfo->rx_prov_disc_info.peerDevAddr[ 2 ], pwdinfo->rx_prov_disc_info.peerDevAddr[ 3 ],
+			pwdinfo->rx_prov_disc_info.peerDevAddr[ 4 ], pwdinfo->rx_prov_disc_info.peerDevAddr[ 5 ]);
+	wrqu->data.length = strlen( extra );
+	return ret;
+
+}
+
+static int rtw_p2p_get_peer_devaddr_by_invitation(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+	DBG_871X( "[%s] Role = %d, Status = %d, peer addr = %.2X:%.2X:%.2X:%.2X:%.2X:%.2X\n", __FUNCTION__, rtw_p2p_role(pwdinfo), rtw_p2p_state(pwdinfo),
+			pwdinfo->p2p_peer_device_addr[ 0 ], pwdinfo->p2p_peer_device_addr[ 1 ],
+			pwdinfo->p2p_peer_device_addr[ 2 ], pwdinfo->p2p_peer_device_addr[ 3 ],
+			pwdinfo->p2p_peer_device_addr[ 4 ], pwdinfo->p2p_peer_device_addr[ 5 ]);
+	sprintf( extra, "\nMAC %.2X:%.2X:%.2X:%.2X:%.2X:%.2X",
+			pwdinfo->p2p_peer_device_addr[ 0 ], pwdinfo->p2p_peer_device_addr[ 1 ],
+			pwdinfo->p2p_peer_device_addr[ 2 ], pwdinfo->p2p_peer_device_addr[ 3 ],
+			pwdinfo->p2p_peer_device_addr[ 4 ], pwdinfo->p2p_peer_device_addr[ 5 ]);
+	wrqu->data.length = strlen( extra );
+	return ret;
+
+}
+
+static int rtw_p2p_get_groupid(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+	sprintf( extra, "\n%.2X:%.2X:%.2X:%.2X:%.2X:%.2X %s",
+			pwdinfo->groupid_info.go_device_addr[ 0 ], pwdinfo->groupid_info.go_device_addr[ 1 ],
+			pwdinfo->groupid_info.go_device_addr[ 2 ], pwdinfo->groupid_info.go_device_addr[ 3 ],
+			pwdinfo->groupid_info.go_device_addr[ 4 ], pwdinfo->groupid_info.go_device_addr[ 5 ],
+			pwdinfo->groupid_info.ssid);
+	wrqu->data.length = strlen( extra );
+	return ret;
+
+}
+
+static int rtw_p2p_get_op_ch(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+
+	DBG_871X( "[%s] Op_ch = %02x\n", __FUNCTION__, pwdinfo->operating_channel);
+
+	sprintf( extra, "\n\nOp_ch=%.2d\n", pwdinfo->operating_channel );
+	wrqu->data.length = strlen( extra );
+	return ret;
+
+}
+
+inline static void macstr2num(u8 *dst, u8 *src)
+{
+	int	jj, kk;
+	for (jj = 0, kk = 0; jj < ETH_ALEN; jj++, kk += 3)
+	{
+		dst[jj] = key_2char2num(src[kk], src[kk + 1]);
+	}
+}
+
+static int rtw_p2p_get_wps_configmethod(struct net_device *dev,
+										struct iw_request_info *info,
+										union iwreq_data *wrqu, char *extra, char *subcmd)
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u8 peerMAC[ETH_ALEN] = { 0x00 };
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	_irqL irqL;
+	_list * plist,*phead;
+	_queue *queue = &(pmlmepriv->scanned_queue);
+	struct wlan_network *pnetwork = NULL;
+	u8 blnMatch = 0;
+	u16	attr_content = 0;
+	uint attr_contentlen = 0;
+	u8	attr_content_str[P2P_PRIVATE_IOCTL_SET_LEN] = { 0x00 };
+
+	//	Commented by Albert 20110727
+	//	The input data is the MAC address which the application wants to know its WPS config method.
+	//	After knowing its WPS config method, the application can decide the config method for provisioning discovery.
+	//	Format: iwpriv wlanx p2p_get_wpsCM 00:E0:4C:00:00:05
+
+	DBG_871X("[%s] data = %s\n", __FUNCTION__, subcmd);
+
+	macstr2num(peerMAC, subcmd);
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while (1)
+	{
+		if (rtw_end_of_queue_search(phead, plist) == _TRUE) break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+		if (_rtw_memcmp(pnetwork->network.MacAddress, peerMAC, ETH_ALEN))
+		{
+			u8 *wpsie;
+			uint	wpsie_len = 0;
+
+			//	The mac address is matched.
+
+			if ((wpsie = rtw_get_wps_ie(&pnetwork->network.IEs[12], pnetwork->network.IELength - 12, NULL, &wpsie_len)))
+			{
+				rtw_get_wps_attr_content(wpsie, wpsie_len, WPS_ATTR_CONF_METHOD, (u8 *)&attr_content, &attr_contentlen);
+				if (attr_contentlen)
+				{
+					attr_content = be16_to_cpu(attr_content);
+					sprintf(attr_content_str, "\n\nM=%.4d", attr_content);
+					blnMatch = 1;
+				}
+			}
+
+			break;
+		}
+
+		plist = get_next(plist);
+
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	if (!blnMatch)
+	{
+		sprintf(attr_content_str, "\n\nM=0000");
+	}
+
+	wrqu->data.length = strlen(attr_content_str);
+	_rtw_memcpy(extra, attr_content_str, wrqu->data.length);
+
+	return ret;
+
+}
+
+#ifdef CONFIG_WFD
+static int rtw_p2p_get_peer_wfd_port(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+	DBG_871X( "[%s] p2p_state = %d\n", __FUNCTION__, rtw_p2p_state(pwdinfo) );
+
+	sprintf( extra, "\n\nPort=%d\n", pwdinfo->wfd_info->peer_rtsp_ctrlport );
+	DBG_871X( "[%s] remote port = %d\n", __FUNCTION__, pwdinfo->wfd_info->peer_rtsp_ctrlport );
+
+	wrqu->data.length = strlen( extra );
+	return ret;
+
+}
+
+static int rtw_p2p_get_peer_wfd_preferred_connection(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+	sprintf( extra, "\n\nwfd_pc=%d\n", pwdinfo->wfd_info->wfd_pc );
+	DBG_871X( "[%s] wfd_pc = %d\n", __FUNCTION__, pwdinfo->wfd_info->wfd_pc );
+
+	wrqu->data.length = strlen( extra );
+	pwdinfo->wfd_info->wfd_pc = _FALSE;	//	Reset the WFD preferred connection to P2P
+	return ret;
+
+}
+
+static int rtw_p2p_get_peer_wfd_session_available(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+	sprintf( extra, "\n\nwfd_sa=%d\n", pwdinfo->wfd_info->peer_session_avail );
+	DBG_871X( "[%s] wfd_sa = %d\n", __FUNCTION__, pwdinfo->wfd_info->peer_session_avail );
+
+	wrqu->data.length = strlen( extra );
+	pwdinfo->wfd_info->peer_session_avail = _TRUE;	//	Reset the WFD session available
+	return ret;
+
+}
+
+#endif // CONFIG_WFD
+
+static int rtw_p2p_get_go_device_address(struct net_device *dev,
+										 struct iw_request_info *info,
+										 union iwreq_data *wrqu, char *extra, char *subcmd)
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u8 peerMAC[ETH_ALEN] = { 0x00 };
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	_irqL irqL;
+	_list *plist, *phead;
+	_queue *queue	= &(pmlmepriv->scanned_queue);
+	struct wlan_network *pnetwork = NULL;
+	u8 blnMatch = 0;
+	u8 *p2pie;
+	uint p2pielen = 0, attr_contentlen = 0;
+	u8 attr_content[100] = { 0x00 };
+	u8 go_devadd_str[P2P_PRIVATE_IOCTL_SET_LEN] = { 0x00 };
+
+	//	Commented by Albert 20121209
+	//	The input data is the GO's interface address which the application wants to know its device address.
+	//	Format: iwpriv wlanx p2p_get2 go_devadd=00:E0:4C:00:00:05
+
+	DBG_871X("[%s] data = %s\n", __FUNCTION__, subcmd);
+
+	macstr2num(peerMAC, subcmd);
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while (1)
+	{
+		if (rtw_end_of_queue_search(phead, plist) == _TRUE) break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+		if (_rtw_memcmp(pnetwork->network.MacAddress, peerMAC, ETH_ALEN))
+		{
+			//	Commented by Albert 2011/05/18
+			//	Match the device address located in the P2P IE
+			//	This is for the case that the P2P device address is not the same as the P2P interface address.
+
+			if ((p2pie = rtw_get_p2p_ie(&pnetwork->network.IEs[12], pnetwork->network.IELength - 12, NULL, &p2pielen)))
+			{
+				while (p2pie)
+				{
+					//	The P2P Device ID attribute is included in the Beacon frame.
+					//	The P2P Device Info attribute is included in the probe response frame.
+
+					_rtw_memset(attr_content, 0x00, 100);
+					if (rtw_get_p2p_attr_content(p2pie, p2pielen, P2P_ATTR_DEVICE_ID, attr_content, &attr_contentlen))
+					{
+						//	Handle the P2P Device ID attribute of Beacon first
+						blnMatch = 1;
+						break;
+
+					} else if (rtw_get_p2p_attr_content(p2pie, p2pielen, P2P_ATTR_DEVICE_INFO, attr_content, &attr_contentlen))
+					{
+						//	Handle the P2P Device Info attribute of probe response
+						blnMatch = 1;
+						break;
+					}
+
+					//Get the next P2P IE
+					p2pie = rtw_get_p2p_ie(p2pie + p2pielen, pnetwork->network.IELength - 12 - (p2pie - &pnetwork->network.IEs[12] + p2pielen), NULL, &p2pielen);
+				}
+			}
+		}
+
+		plist = get_next(plist);
+
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	if (!blnMatch)
+	{
+		sprintf(go_devadd_str, "\n\ndev_add=NULL");
+	} else
+	{
+		sprintf(go_devadd_str, "\n\ndev_add=%.2X:%.2X:%.2X:%.2X:%.2X:%.2X",
+				attr_content[0], attr_content[1], attr_content[2], attr_content[3], attr_content[4], attr_content[5]);
+	}
+
+	wrqu->data.length = strlen(go_devadd_str);
+	_rtw_memcpy(extra, go_devadd_str, wrqu->data.length);
+
+	return ret;
+
+}
+
+static int rtw_p2p_get_device_type(struct net_device *dev,
+								   struct iw_request_info *info,
+								   union iwreq_data *wrqu, char *extra, char *subcmd)
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u8 peerMAC[ETH_ALEN] = { 0x00 };
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	_irqL irqL;
+	_list *plist, *phead;
+	_queue *queue = &(pmlmepriv->scanned_queue);
+	struct wlan_network *pnetwork = NULL;
+	u8 blnMatch = 0;
+	u8 dev_type[8] = { 0x00 };
+	uint dev_type_len = 0;
+	u8 dev_type_str[P2P_PRIVATE_IOCTL_SET_LEN] = { 0x00 };    // +9 is for the str "dev_type=", we have to clear it at wrqu->data.pointer
+
+	//	Commented by Albert 20121209
+	//	The input data is the MAC address which the application wants to know its device type.
+	//	Such user interface could know the device type.
+	//	Format: iwpriv wlanx p2p_get2 dev_type=00:E0:4C:00:00:05
+
+	DBG_871X("[%s] data = %s\n", __FUNCTION__, subcmd);
+
+	macstr2num(peerMAC, subcmd);
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while (1)
+	{
+		if (rtw_end_of_queue_search(phead, plist) == _TRUE) break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+		if (_rtw_memcmp(pnetwork->network.MacAddress, peerMAC, ETH_ALEN))
+		{
+			u8 *wpsie;
+			uint	wpsie_len = 0;
+
+			//	The mac address is matched.
+
+			if ((wpsie = rtw_get_wps_ie(&pnetwork->network.IEs[12], pnetwork->network.IELength - 12, NULL, &wpsie_len)))
+			{
+				rtw_get_wps_attr_content(wpsie, wpsie_len, WPS_ATTR_PRIMARY_DEV_TYPE, dev_type, &dev_type_len);
+				if (dev_type_len)
+				{
+					u16	type = 0;
+
+					_rtw_memcpy(&type, dev_type, 2);
+					type = be16_to_cpu(type);
+					sprintf(dev_type_str, "\n\nN=%.2d", type);
+					blnMatch = 1;
+				}
+			}
+			break;
+		}
+
+		plist = get_next(plist);
+
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	if (!blnMatch)
+	{
+		sprintf(dev_type_str, "\n\nN=00");
+	}
+
+	wrqu->data.length = strlen(dev_type_str);
+	_rtw_memcpy(extra, dev_type_str, wrqu->data.length);
+
+	return ret;
+
+}
+
+static int rtw_p2p_get_device_name(struct net_device *dev,
+								   struct iw_request_info *info,
+								   union iwreq_data *wrqu, char *extra, char *subcmd)
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u8 peerMAC[ETH_ALEN] = { 0x00 };
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	_irqL irqL;
+	_list *plist, *phead;
+	_queue *queue = &(pmlmepriv->scanned_queue);
+	struct wlan_network *pnetwork = NULL;
+	u8 blnMatch = 0;
+	u8 dev_name[WPS_MAX_DEVICE_NAME_LEN] = { 0x00 };
+	uint dev_len = 0;
+	u8 dev_name_str[P2P_PRIVATE_IOCTL_SET_LEN] = { 0x00 };
+
+	//	Commented by Albert 20121225
+	//	The input data is the MAC address which the application wants to know its device name.
+	//	Such user interface could show peer device's device name instead of ssid.
+	//	Format: iwpriv wlanx p2p_get2 devN=00:E0:4C:00:00:05
+
+	DBG_871X("[%s] data = %s\n", __FUNCTION__, subcmd);
+
+	macstr2num(peerMAC, subcmd);
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while (1)
+	{
+		if (rtw_end_of_queue_search(phead, plist) == _TRUE) break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+		if (_rtw_memcmp(pnetwork->network.MacAddress, peerMAC, ETH_ALEN))
+		{
+			u8 *wpsie;
+			uint	wpsie_len = 0;
+
+			//	The mac address is matched.
+
+			if ((wpsie = rtw_get_wps_ie(&pnetwork->network.IEs[12], pnetwork->network.IELength - 12, NULL, &wpsie_len)))
+			{
+				rtw_get_wps_attr_content(wpsie, wpsie_len, WPS_ATTR_DEVICE_NAME, dev_name, &dev_len);
+				if (dev_len)
+				{
+					sprintf(dev_name_str, "\n\nN=%s", dev_name);
+					blnMatch = 1;
+				}
+			}
+			break;
+		}
+
+		plist = get_next(plist);
+
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	if (!blnMatch)
+	{
+		sprintf(dev_name_str, "\n\nN=0000");
+	}
+
+	wrqu->data.length = strlen(dev_name_str);
+	_rtw_memcpy(extra, dev_name_str, wrqu->data.length);
+
+	return ret;
+
+}
+
+static int rtw_p2p_get_invitation_procedure(struct net_device *dev,
+											struct iw_request_info *info,
+											union iwreq_data *wrqu, char *extra, char *subcmd)
+{
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u8 peerMAC[ETH_ALEN] = { 0x00 };
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	_irqL irqL;
+	_list *plist, *phead;
+	_queue *queue	= &(pmlmepriv->scanned_queue);
+	struct wlan_network *pnetwork = NULL;
+	u8 blnMatch = 0;
+	u8 *p2pie;
+	uint p2pielen = 0, attr_contentlen = 0;
+	u8 attr_content[2] = { 0x00 };
+	u8 inv_proc_str[P2P_PRIVATE_IOCTL_SET_LEN] = { 0x00 };
+
+	//	Commented by Ouden 20121226
+	//	The application wants to know P2P initation procedure is support or not.
+	//	Format: iwpriv wlanx p2p_get2 InvProc=00:E0:4C:00:00:05
+
+	DBG_871X("[%s] data = %s\n", __FUNCTION__, subcmd);
+
+	macstr2num(peerMAC, subcmd);
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while (1)
+	{
+		if (rtw_end_of_queue_search(phead, plist) == _TRUE) break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+		if (_rtw_memcmp(pnetwork->network.MacAddress, peerMAC, ETH_ALEN))
+		{
+			//	Commented by Albert 20121226
+			//	Match the device address located in the P2P IE
+			//	This is for the case that the P2P device address is not the same as the P2P interface address.
+
+			if ((p2pie = rtw_get_p2p_ie(&pnetwork->network.IEs[12], pnetwork->network.IELength - 12, NULL, &p2pielen)))
+			{
+				while (p2pie)
+				{
+					//_rtw_memset( attr_content, 0x00, 2);
+					if (rtw_get_p2p_attr_content(p2pie, p2pielen, P2P_ATTR_CAPABILITY, attr_content, &attr_contentlen))
+					{
+						//	Handle the P2P capability attribute
+						blnMatch = 1;
+						break;
+
+					}
+
+					//Get the next P2P IE
+					p2pie = rtw_get_p2p_ie(p2pie + p2pielen, pnetwork->network.IELength - 12 - (p2pie - &pnetwork->network.IEs[12] + p2pielen), NULL, &p2pielen);
+				}
+			}
+		}
+
+		plist = get_next(plist);
+
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	if (!blnMatch)
+	{
+		sprintf(inv_proc_str, "\nIP=-1");
+	} else
+	{
+		if (attr_content[0] && 0x20)
+		{
+			sprintf(inv_proc_str, "\nIP=1");
+		} else
+		{
+			sprintf(inv_proc_str, "\nIP=0");
+		}
+	}
+
+	wrqu->data.length = strlen(inv_proc_str);
+	_rtw_memcpy(extra, inv_proc_str, wrqu->data.length);
+
+	return ret;
+
+}
+
+static int rtw_p2p_connect(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter 				*padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+	u8					peerMAC[ ETH_ALEN ] = { 0x00 };
+	int 					jj,kk;
+	u8   					peerMACStr[ ETH_ALEN * 2 ] = { 0x00 };
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	_irqL				irqL;
+	_list					*plist, *phead;
+	_queue				*queue	= &(pmlmepriv->scanned_queue);
+	struct	wlan_network	*pnetwork = NULL;
+	uint					uintPeerChannel = 0;
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+#endif // CONFIG_CONCURRENT_MODE
+
+
+	//	Commented by Albert 20110304
+	//	The input data contains two informations.
+	//	1. First information is the MAC address which wants to formate with
+	//	2. Second information is the WPS PINCode or "pbc" string for push button method
+	//	Format: 00:E0:4C:00:00:05
+	//	Format: 00:E0:4C:00:00:05
+
+	DBG_871X( "[%s] data = %s\n", __FUNCTION__, extra );
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		DBG_871X( "[%s] WiFi Direct is disable!\n", __FUNCTION__ );
+		return ret;
+	}
+
+	if ( pwdinfo->ui_got_wps_info == P2P_NO_WPSINFO )
+	{
+		return -1;
+	}
+
+	for( jj = 0, kk = 0; jj < ETH_ALEN; jj++, kk += 3 )
+	{
+		peerMAC[ jj ] = key_2char2num( extra[kk], extra[kk+ 1] );
+	}
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while(1)
+	{
+		if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+			break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+		if ( _rtw_memcmp( pnetwork->network.MacAddress, peerMAC, ETH_ALEN ) )
+		{
+			uintPeerChannel = pnetwork->network.Configuration.DSConfig;
+			break;
+              }
+
+		plist = get_next(plist);
+
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	if ( uintPeerChannel )
+	{
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+		{
+			_cancel_timer_ex( &pwdinfo->ap_p2p_switch_timer );
+		}
+#endif // CONFIG_CONCURRENT_MODE
+
+		_rtw_memset( &pwdinfo->nego_req_info, 0x00, sizeof( struct tx_nego_req_info ) );
+		_rtw_memset( &pwdinfo->groupid_info, 0x00, sizeof( struct group_id_info ) );
+
+		pwdinfo->nego_req_info.peer_channel_num[ 0 ] = uintPeerChannel;
+		_rtw_memcpy( pwdinfo->nego_req_info.peerDevAddr, pnetwork->network.MacAddress, ETH_ALEN );
+		pwdinfo->nego_req_info.benable = _TRUE;
+
+		_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+		if ( rtw_p2p_state(pwdinfo) != P2P_STATE_GONEGO_OK )
+		{
+			//	Restore to the listen state if the current p2p state is not nego OK
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_LISTEN );
+		}
+
+		rtw_p2p_set_pre_state(pwdinfo, rtw_p2p_state(pwdinfo));
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_GONEGO_ING);
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+		{
+			//	Have to enter the power saving with the AP
+			set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+
+			issue_nulldata(pbuddy_adapter, NULL, 1, 3, 500);
+		}
+#endif // CONFIG_CONCURRENT_MODE
+
+		DBG_871X( "[%s] Start PreTx Procedure!\n", __FUNCTION__ );
+		_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+		{
+			_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_CONCURRENT_GO_NEGO_TIMEOUT );
+		}
+		else
+		{
+			_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_GO_NEGO_TIMEOUT );
+		}
+#else
+		_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_GO_NEGO_TIMEOUT );
+#endif // CONFIG_CONCURRENT_MODE
+
+	}
+	else
+	{
+		DBG_871X( "[%s] Not Found in Scanning Queue~\n", __FUNCTION__ );
+		ret = -1;
+	}
+exit:
+	return ret;
+}
+
+static int rtw_p2p_invite_req(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter 					*padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point 			*pdata = &wrqu->data;
+	struct wifidirect_info		*pwdinfo = &( padapter->wdinfo );
+	int 						jj,kk;
+	u8   						peerMACStr[ ETH_ALEN * 2 ] = { 0x00 };
+	struct mlme_priv			*pmlmepriv = &padapter->mlmepriv;
+	_list						*plist, *phead;
+	_queue					*queue	= &(pmlmepriv->scanned_queue);
+	struct	wlan_network		*pnetwork = NULL;
+	uint						uintPeerChannel = 0;
+	u8						attr_content[50] = { 0x00 }, _status = 0;
+	u8 						*p2pie;
+	uint						p2pielen = 0, attr_contentlen = 0;
+	_irqL					irqL;
+	struct tx_invite_req_info*	pinvite_req_info = &pwdinfo->invitereq_info;
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter					*pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_priv			*pbuddy_mlmepriv = &pbuddy_adapter->mlmepriv;
+	struct mlme_ext_priv		*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+#endif // CONFIG_CONCURRENT_MODE
+
+#ifdef CONFIG_WFD
+	struct wifi_display_info*	pwfd_info = pwdinfo->wfd_info;
+#endif // CONFIG_WFD
+
+	//	Commented by Albert 20120321
+	//	The input data contains two informations.
+	//	1. First information is the P2P device address which you want to send to.
+	//	2. Second information is the group id which combines with GO's mac address, space and GO's ssid.
+	//	Command line sample: iwpriv wlan0 p2p_set invite="00:11:22:33:44:55 00:E0:4C:00:00:05 DIRECT-xy"
+	//	Format: 00:11:22:33:44:55 00:E0:4C:00:00:05 DIRECT-xy
+
+	DBG_871X( "[%s] data = %s\n", __FUNCTION__, extra );
+
+	if ( wrqu->data.length <=  37 )
+	{
+		DBG_871X( "[%s] Wrong format!\n", __FUNCTION__ );
+		return ret;
+	}
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		DBG_871X( "[%s] WiFi Direct is disable!\n", __FUNCTION__ );
+		return ret;
+	}
+	else
+	{
+		//	Reset the content of struct tx_invite_req_info
+		pinvite_req_info->benable = _FALSE;
+		_rtw_memset( pinvite_req_info->go_bssid, 0x00, ETH_ALEN );
+		_rtw_memset( pinvite_req_info->go_ssid, 0x00, WLAN_SSID_MAXLEN );
+		pinvite_req_info->ssidlen = 0x00;
+		pinvite_req_info->operating_ch = pwdinfo->operating_channel;
+		_rtw_memset( pinvite_req_info->peer_macaddr, 0x00, ETH_ALEN );
+		pinvite_req_info->token = 3;
+	}
+
+	for( jj = 0, kk = 0; jj < ETH_ALEN; jj++, kk += 3 )
+	{
+		pinvite_req_info->peer_macaddr[ jj ] = key_2char2num( extra[kk], extra[kk+ 1] );
+	}
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while(1)
+	{
+		if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+			break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+
+		//	Commented by Albert 2011/05/18
+		//	Match the device address located in the P2P IE
+		//	This is for the case that the P2P device address is not the same as the P2P interface address.
+
+		if ( (p2pie=rtw_get_p2p_ie( &pnetwork->network.IEs[12], pnetwork->network.IELength - 12, NULL, &p2pielen)) )
+		{
+			//	The P2P Device ID attribute is included in the Beacon frame.
+			//	The P2P Device Info attribute is included in the probe response frame.
+
+			if ( rtw_get_p2p_attr_content( p2pie, p2pielen, P2P_ATTR_DEVICE_ID, attr_content, &attr_contentlen) )
+			{
+				//	Handle the P2P Device ID attribute of Beacon first
+				if ( _rtw_memcmp( attr_content, pinvite_req_info->peer_macaddr, ETH_ALEN ) )
+				{
+					uintPeerChannel = pnetwork->network.Configuration.DSConfig;
+					break;
+				}
+			}
+			else if ( rtw_get_p2p_attr_content( p2pie, p2pielen, P2P_ATTR_DEVICE_INFO, attr_content, &attr_contentlen) )
+			{
+				//	Handle the P2P Device Info attribute of probe response
+				if ( _rtw_memcmp( attr_content, pinvite_req_info->peer_macaddr, ETH_ALEN ) )
+				{
+					uintPeerChannel = pnetwork->network.Configuration.DSConfig;
+					break;
+				}
+			}
+
+		}
+
+		plist = get_next(plist);
+
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+#ifdef CONFIG_WFD
+	if ( uintPeerChannel )
+	{
+		u8	wfd_ie[ 128 ] = { 0x00 };
+		uint	wfd_ielen = 0;
+
+		if ( rtw_get_wfd_ie( &pnetwork->network.IEs[12], pnetwork->network.IELength - 12,  wfd_ie, &wfd_ielen ) )
+		{
+			u8	wfd_devinfo[ 6 ] = { 0x00 };
+			uint	wfd_devlen = 6;
+
+			DBG_871X( "[%s] Found WFD IE!\n", __FUNCTION__ );
+			if ( rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_DEVICE_INFO, wfd_devinfo, &wfd_devlen ) )
+			{
+				u16	wfd_devinfo_field = 0;
+
+				//	Commented by Albert 20120319
+				//	The first two bytes are the WFD device information field of WFD device information subelement.
+				//	In big endian format.
+				wfd_devinfo_field = RTW_GET_BE16(wfd_devinfo);
+				if ( wfd_devinfo_field & WFD_DEVINFO_SESSION_AVAIL )
+				{
+					pwfd_info->peer_session_avail = _TRUE;
+				}
+				else
+				{
+					pwfd_info->peer_session_avail = _FALSE;
+				}
+			}
+		}
+
+		if ( _FALSE == pwfd_info->peer_session_avail )
+		{
+			DBG_871X( "[%s] WFD Session not avaiable!\n", __FUNCTION__ );
+			goto exit;
+		}
+	}
+#endif // CONFIG_WFD
+
+	if ( uintPeerChannel )
+	{
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_fwstate( pbuddy_mlmepriv, _FW_LINKED ) )
+		{
+			_cancel_timer_ex( &pwdinfo->ap_p2p_switch_timer );
+		}
+#endif // CONFIG_CONCURRENT_MODE
+
+		//	Store the GO's bssid
+		for( jj = 0, kk = 18; jj < ETH_ALEN; jj++, kk += 3 )
+		{
+			pinvite_req_info->go_bssid[ jj ] = key_2char2num( extra[kk], extra[kk+ 1] );
+		}
+
+		//	Store the GO's ssid
+		pinvite_req_info->ssidlen = wrqu->data.length - 36;
+		_rtw_memcpy( pinvite_req_info->go_ssid, &extra[ 36 ], (u32) pinvite_req_info->ssidlen );
+		pinvite_req_info->benable = _TRUE;
+		pinvite_req_info->peer_ch = uintPeerChannel;
+
+		rtw_p2p_set_pre_state(pwdinfo, rtw_p2p_state(pwdinfo));
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_TX_INVITE_REQ);
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_fwstate( pbuddy_mlmepriv, _FW_LINKED ) )
+		{
+			//	Have to enter the power saving with the AP
+			set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+
+			issue_nulldata(pbuddy_adapter, NULL, 1, 3, 500);
+		}
+		else
+		{
+			set_channel_bwmode(padapter, uintPeerChannel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+		}
+#else
+		set_channel_bwmode(padapter, uintPeerChannel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+#endif
+
+		_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_fwstate( pbuddy_mlmepriv, _FW_LINKED ) )
+		{
+			_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_CONCURRENT_INVITE_TIMEOUT );
+		}
+		else
+		{
+			_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_INVITE_TIMEOUT );
+		}
+#else
+		_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_INVITE_TIMEOUT );
+#endif // CONFIG_CONCURRENT_MODE
+
+
+	}
+	else
+	{
+		DBG_871X( "[%s] NOT Found in the Scanning Queue!\n", __FUNCTION__ );
+	}
+exit:
+
+	return ret;
+
+}
+
+static int rtw_p2p_set_persistent(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter 					*padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point 			*pdata = &wrqu->data;
+	struct wifidirect_info		*pwdinfo = &( padapter->wdinfo );
+	int 						jj,kk;
+	u8   						peerMACStr[ ETH_ALEN * 2 ] = { 0x00 };
+	struct mlme_priv			*pmlmepriv = &padapter->mlmepriv;
+	_list						*plist, *phead;
+	_queue					*queue	= &(pmlmepriv->scanned_queue);
+	struct	wlan_network		*pnetwork = NULL;
+	uint						uintPeerChannel = 0;
+	u8						attr_content[50] = { 0x00 }, _status = 0;
+	u8 						*p2pie;
+	uint						p2pielen = 0, attr_contentlen = 0;
+	_irqL					irqL;
+	struct tx_invite_req_info*	pinvite_req_info = &pwdinfo->invitereq_info;
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter					*pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_priv			*pbuddy_mlmepriv = &pbuddy_adapter->mlmepriv;
+	struct mlme_ext_priv		*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+#endif // CONFIG_CONCURRENT_MODE
+
+#ifdef CONFIG_WFD
+	struct wifi_display_info*	pwfd_info = pwdinfo->wfd_info;
+#endif // CONFIG_WFD
+
+	//	Commented by Albert 20120328
+	//	The input data is 0 or 1
+	//	0: disable persistent group functionality
+	//	1: enable persistent group founctionality
+
+	DBG_871X( "[%s] data = %s\n", __FUNCTION__, extra );
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		DBG_871X( "[%s] WiFi Direct is disable!\n", __FUNCTION__ );
+		return ret;
+	}
+	else
+	{
+		if ( extra[ 0 ] == '0' )	//	Disable the persistent group function.
+		{
+			pwdinfo->persistent_supported = _FALSE;
+		}
+		else if ( extra[ 0 ] == '1' )	//	Enable the persistent group function.
+		{
+			pwdinfo->persistent_supported = _TRUE;
+		}
+		else
+		{
+			pwdinfo->persistent_supported = _FALSE;
+		}
+	}
+	printk( "[%s] persistent_supported = %d\n", __FUNCTION__, pwdinfo->persistent_supported );
+
+exit:
+
+	return ret;
+
+}
+
+static int hexstr2bin(const char *hex, u8 *buf, size_t len)
+{
+	size_t i;
+	int a;
+	const char *ipos = hex;
+	u8 *opos = buf;
+
+	for (i = 0; i < len; i++) {
+		a = hex2byte_i(ipos);
+		if (a < 0)
+			return -1;
+		*opos++ = a;
+		ipos += 2;
+	}
+	return 0;
+}
+
+static int uuid_str2bin(const char *str, u8 *bin)
+{
+	const char *pos;
+	u8 *opos;
+
+	pos = str;
+	opos = bin;
+
+	if (hexstr2bin(pos, opos, 4))
+		return -1;
+	pos += 8;
+	opos += 4;
+
+	if (*pos++ != '-' || hexstr2bin(pos, opos, 2))
+		return -1;
+	pos += 4;
+	opos += 2;
+
+	if (*pos++ != '-' || hexstr2bin(pos, opos, 2))
+		return -1;
+	pos += 4;
+	opos += 2;
+
+	if (*pos++ != '-' || hexstr2bin(pos, opos, 2))
+		return -1;
+	pos += 4;
+	opos += 2;
+
+	if (*pos++ != '-' || hexstr2bin(pos, opos, 6))
+		return -1;
+
+	return 0;
+}
+
+static int rtw_p2p_set_wps_uuid(struct net_device *dev,
+	struct iw_request_info *info,
+	union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter				*padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info			*pwdinfo = &(padapter->wdinfo);
+
+	DBG_871X("[%s] data = %s\n", __FUNCTION__, extra);
+
+	if ((36 == strlen(extra)) && (uuid_str2bin(extra, pwdinfo->uuid) == 0))
+	{
+		pwdinfo->external_uuid = 1;
+	} else {
+		pwdinfo->external_uuid = 0;
+		ret = -EINVAL;
+	}
+
+	return ret;
+
+}
+#ifdef CONFIG_WFD
+static int rtw_p2p_set_pc(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter 				*padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point 		*pdata = &wrqu->data;
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+	u8					peerMAC[ ETH_ALEN ] = { 0x00 };
+	int 					jj,kk;
+	u8   					peerMACStr[ ETH_ALEN * 2 ] = { 0x00 };
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	_list					*plist, *phead;
+	_queue				*queue	= &(pmlmepriv->scanned_queue);
+	struct	wlan_network	*pnetwork = NULL;
+	u8					attr_content[50] = { 0x00 }, _status = 0;
+	u8 *p2pie;
+	uint					p2pielen = 0, attr_contentlen = 0;
+	_irqL				irqL;
+	uint					uintPeerChannel = 0;
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+#endif // CONFIG_CONCURRENT_MODE
+	struct wifi_display_info*	pwfd_info = pwdinfo->wfd_info;
+
+	//	Commented by Albert 20120512
+	//	1. Input information is the MAC address which wants to know the Preferred Connection bit (PC bit)
+	//	Format: 00:E0:4C:00:00:05
+
+	DBG_871X( "[%s] data = %s\n", __FUNCTION__, extra );
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		DBG_871X( "[%s] WiFi Direct is disable!\n", __FUNCTION__ );
+		return ret;
+	}
+
+	for( jj = 0, kk = 0; jj < ETH_ALEN; jj++, kk += 3 )
+	{
+		peerMAC[ jj ] = key_2char2num( extra[kk], extra[kk+ 1] );
+	}
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while(1)
+	{
+		if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+			break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+
+		//	Commented by Albert 2011/05/18
+		//	Match the device address located in the P2P IE
+		//	This is for the case that the P2P device address is not the same as the P2P interface address.
+
+		if ( (p2pie=rtw_get_p2p_ie( &pnetwork->network.IEs[12], pnetwork->network.IELength - 12, NULL, &p2pielen)) )
+		{
+			//	The P2P Device ID attribute is included in the Beacon frame.
+			//	The P2P Device Info attribute is included in the probe response frame.
+			printk( "[%s] Got P2P IE\n", __FUNCTION__ );
+			if ( rtw_get_p2p_attr_content( p2pie, p2pielen, P2P_ATTR_DEVICE_ID, attr_content, &attr_contentlen) )
+			{
+				//	Handle the P2P Device ID attribute of Beacon first
+				printk( "[%s] P2P_ATTR_DEVICE_ID \n", __FUNCTION__ );
+				if ( _rtw_memcmp( attr_content, peerMAC, ETH_ALEN ) )
+				{
+					uintPeerChannel = pnetwork->network.Configuration.DSConfig;
+					break;
+				}
+			}
+			else if ( rtw_get_p2p_attr_content( p2pie, p2pielen, P2P_ATTR_DEVICE_INFO, attr_content, &attr_contentlen) )
+			{
+				//	Handle the P2P Device Info attribute of probe response
+				printk( "[%s] P2P_ATTR_DEVICE_INFO \n", __FUNCTION__ );
+				if ( _rtw_memcmp( attr_content, peerMAC, ETH_ALEN ) )
+				{
+					uintPeerChannel = pnetwork->network.Configuration.DSConfig;
+					break;
+				}
+			}
+
+		}
+
+		plist = get_next(plist);
+
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+	printk( "[%s] channel = %d\n", __FUNCTION__, uintPeerChannel );
+
+	if ( uintPeerChannel )
+	{
+		u8	wfd_ie[ 128 ] = { 0x00 };
+		uint	wfd_ielen = 0;
+
+		if ( rtw_get_wfd_ie( &pnetwork->network.IEs[12], pnetwork->network.IELength - 12,  wfd_ie, &wfd_ielen ) )
+		{
+			u8	wfd_devinfo[ 6 ] = { 0x00 };
+			uint	wfd_devlen = 6;
+
+			DBG_871X( "[%s] Found WFD IE!\n", __FUNCTION__ );
+			if ( rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_DEVICE_INFO, wfd_devinfo, &wfd_devlen ) )
+			{
+				u16	wfd_devinfo_field = 0;
+
+				//	Commented by Albert 20120319
+				//	The first two bytes are the WFD device information field of WFD device information subelement.
+				//	In big endian format.
+				wfd_devinfo_field = RTW_GET_BE16(wfd_devinfo);
+				if ( wfd_devinfo_field & WFD_DEVINFO_PC_TDLS )
+				{
+					pwfd_info->wfd_pc = _TRUE;
+				}
+				else
+				{
+					pwfd_info->wfd_pc = _FALSE;
+				}
+			}
+		}
+	}
+	else
+	{
+		DBG_871X( "[%s] NOT Found in the Scanning Queue!\n", __FUNCTION__ );
+	}
+
+exit:
+
+	return ret;
+
+}
+
+static int rtw_p2p_set_wfd_device_type(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter 					*padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point 			*pdata = &wrqu->data;
+	struct wifidirect_info		*pwdinfo = &( padapter->wdinfo );
+	struct wifi_display_info		*pwfd_info = pwdinfo->wfd_info;
+
+	//	Commented by Albert 20120328
+	//	The input data is 0 or 1
+	//	0: specify to Miracast source device
+	//	1 or others: specify to Miracast sink device (display device)
+
+	DBG_871X( "[%s] data = %s\n", __FUNCTION__, extra );
+
+	if ( extra[ 0 ] == '0' )	//	Set to Miracast source device.
+	{
+		pwfd_info->wfd_device_type = WFD_DEVINFO_SOURCE;
+	}
+	else					//	Set to Miracast sink device.
+	{
+		pwfd_info->wfd_device_type = WFD_DEVINFO_PSINK;
+	}
+
+exit:
+
+	return ret;
+
+}
+
+static int rtw_p2p_set_scan_result_type(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter 					*padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point 			*pdata = &wrqu->data;
+	struct wifidirect_info		*pwdinfo = &( padapter->wdinfo );
+	struct wifi_display_info		*pwfd_info = pwdinfo->wfd_info;
+
+	//	Commented by Albert 20120328
+	//	The input data is 0 , 1 , 2
+	//	0: when the P2P is enabled, the scan result will return all the found P2P device.
+	//	1: when the P2P is enabled, the scan result will return all the found P2P device and AP.
+	//	2: when the P2P is enabled, the scan result will show up the found Miracast devices base on...
+	//	It will show up all the Miracast source device if this device is sink.
+	//	It will show up all the Miracast sink device if this device is source.
+
+	DBG_871X( "[%s] data = %s\n", __FUNCTION__, extra );
+
+	if ( extra[ 0 ] == '0' )
+	{
+		pwfd_info->scan_result_type = SCAN_RESULT_P2P_ONLY;
+	}
+	else if ( extra[ 0 ] == '1' )
+	{
+		pwfd_info->scan_result_type = SCAN_RESULT_ALL;
+	}
+	else if ( extra[ 0 ] == '2' )
+	{
+		pwfd_info->scan_result_type = SCAN_RESULT_WFD_TYPE;
+	}
+	else
+	{
+		pwfd_info->scan_result_type = SCAN_RESULT_P2P_ONLY;
+	}
+
+exit:
+
+	return ret;
+
+}
+
+static int rtw_p2p_set_wfd_enable(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+//	Commented by Kurt 20121206
+//	This function is used to set wfd enabled
+
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+
+	if(*extra == '0' )
+		pwdinfo->wfd_info->wfd_enable = _FALSE;
+	else if(*extra == '1')
+		pwdinfo->wfd_info->wfd_enable = _TRUE;
+
+	DBG_871X( "[%s] wfd_enable = %d\n", __FUNCTION__, pwdinfo->wfd_info->wfd_enable );
+
+	return ret;
+
+}
+
+static int rtw_p2p_set_driver_iface(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+//	Commented by Kurt 20121206
+//	This function is used to set driver iface is WEXT or CFG80211
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+
+	if(*extra == '1' )
+	{
+		pwdinfo->driver_interface = DRIVER_WEXT;
+		DBG_871X( "[%s] driver_interface = WEXT\n", __FUNCTION__);
+	}
+	else if(*extra == '2')
+	{
+		pwdinfo->driver_interface = DRIVER_CFG80211;
+		DBG_871X( "[%s] driver_interface = CFG80211\n", __FUNCTION__);
+	}
+
+	return ret;
+
+}
+
+//	To set the WFD session available to enable or disable
+static int rtw_p2p_set_sa(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter 					*padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point 			*pdata = &wrqu->data;
+	struct wifidirect_info		*pwdinfo = &( padapter->wdinfo );
+	struct wifi_display_info		*pwfd_info = pwdinfo->wfd_info;
+
+	DBG_871X( "[%s] data = %s\n", __FUNCTION__, extra );
+
+	if( 0 )
+	{
+		DBG_871X( "[%s] WiFi Direct is disable!\n", __FUNCTION__ );
+		return ret;
+	}
+	else
+	{
+		if ( extra[ 0 ] == '0' )	//	Disable the session available.
+		{
+			pwdinfo->session_available = _FALSE;
+		}
+		else if ( extra[ 0 ] == '1' )	//	Enable the session available.
+		{
+			pwdinfo->session_available = _TRUE;
+		}
+		else
+		{
+			pwdinfo->session_available = _FALSE;
+		}
+	}
+	printk( "[%s] session available = %d\n", __FUNCTION__, pwdinfo->session_available );
+
+exit:
+
+	return ret;
+
+}
+#endif //CONFIG_WFD
+
+static int rtw_p2p_prov_disc(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+	_adapter 				*padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+	u8					peerMAC[ ETH_ALEN ] = { 0x00 };
+	int 					jj,kk;
+	u8   					peerMACStr[ ETH_ALEN * 2 ] = { 0x00 };
+	struct mlme_priv		*pmlmepriv = &padapter->mlmepriv;
+	_list					*plist, *phead;
+	_queue				*queue	= &(pmlmepriv->scanned_queue);
+	struct	wlan_network	*pnetwork = NULL;
+	uint					uintPeerChannel = 0;
+	u8					attr_content[100] = { 0x00 }, _status = 0;
+	u8 *p2pie;
+	uint					p2pielen = 0, attr_contentlen = 0;
+	_irqL				irqL;
+	u8 					ie_offset;
+#ifdef CONFIG_CONCURRENT_MODE
+	_adapter				*pbuddy_adapter = padapter->pbuddy_adapter;
+	struct mlme_ext_priv	*pbuddy_mlmeext = &pbuddy_adapter->mlmeextpriv;
+#endif // CONFIG_CONCURRENT_MODE
+
+#ifdef CONFIG_WFD
+	struct wifi_display_info*	pwfd_info = pwdinfo->wfd_info;
+#endif // CONFIG_WFD
+
+	//	Commented by Albert 20110301
+	//	The input data contains two informations.
+	//	1. First information is the MAC address which wants to issue the provisioning discovery request frame.
+	//	2. Second information is the WPS configuration method which wants to discovery
+	//	Format: 00:E0:4C:00:00:05_display
+	//	Format: 00:E0:4C:00:00:05_keypad
+	//	Format: 00:E0:4C:00:00:05_pbc
+	//	Format: 00:E0:4C:00:00:05_label
+
+	DBG_871X( "[%s] data = %s\n", __FUNCTION__, extra );
+
+	if(rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+	{
+		DBG_871X( "[%s] WiFi Direct is disable!\n", __FUNCTION__ );
+		return ret;
+	}
+	else
+	{
+#ifdef CONFIG_INTEL_WIDI
+		if(check_fwstate(pmlmepriv, _FW_UNDER_SURVEY) == _TRUE){
+			DBG_871X( "[%s] WiFi is under survey!\n", __FUNCTION__ );
+			return ret;
+		}
+#endif //CONFIG_INTEL_WIDI
+
+		//	Reset the content of struct tx_provdisc_req_info excluded the wps_config_method_request.
+		_rtw_memset( pwdinfo->tx_prov_disc_info.peerDevAddr, 0x00, ETH_ALEN );
+		_rtw_memset( pwdinfo->tx_prov_disc_info.peerIFAddr, 0x00, ETH_ALEN );
+		_rtw_memset( &pwdinfo->tx_prov_disc_info.ssid, 0x00, sizeof( NDIS_802_11_SSID ) );
+		pwdinfo->tx_prov_disc_info.peer_channel_num[ 0 ] = 0;
+		pwdinfo->tx_prov_disc_info.peer_channel_num[ 1 ] = 0;
+		pwdinfo->tx_prov_disc_info.benable = _FALSE;
+	}
+
+	for( jj = 0, kk = 0; jj < ETH_ALEN; jj++, kk += 3 )
+	{
+		peerMAC[ jj ] = key_2char2num( extra[kk], extra[kk+ 1] );
+	}
+
+	if ( _rtw_memcmp( &extra[ 18 ], "display", 7 ) )
+	{
+		pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_DISPLYA;
+	}
+	else if ( _rtw_memcmp( &extra[ 18 ], "keypad", 7 ) )
+	{
+		pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_KEYPAD;
+	}
+	else if ( _rtw_memcmp( &extra[ 18 ], "pbc", 3 ) )
+	{
+		pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_PUSH_BUTTON;
+	}
+	else if ( _rtw_memcmp( &extra[ 18 ], "label", 5 ) )
+	{
+		pwdinfo->tx_prov_disc_info.wps_config_method_request = WPS_CM_LABEL;
+	}
+	else
+	{
+		DBG_871X( "[%s] Unknown WPS config methodn", __FUNCTION__ );
+		return( ret );
+	}
+
+
+	_enter_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	phead = get_list_head(queue);
+	plist = get_next(phead);
+
+	while(1)
+	{
+		if (rtw_end_of_queue_search(phead,plist)== _TRUE)
+			break;
+
+		if( uintPeerChannel != 0 )
+			break;
+
+		pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
+
+		//	Commented by Albert 2011/05/18
+		//	Match the device address located in the P2P IE
+		//	This is for the case that the P2P device address is not the same as the P2P interface address.
+
+		if (pnetwork->network.Reserved[0] == 2) { // Probe Request
+			ie_offset = 0;
+		} else { // Beacon or Probe Respones
+			ie_offset = 12;
+		}
+		if ( (p2pie=rtw_get_p2p_ie( &pnetwork->network.IEs[ie_offset], pnetwork->network.IELength - ie_offset, NULL, &p2pielen)) )
+		{
+			while ( p2pie )
+			{
+				//	The P2P Device ID attribute is included in the Beacon frame.
+				//	The P2P Device Info attribute is included in the probe response frame.
+
+				if ( rtw_get_p2p_attr_content( p2pie, p2pielen, P2P_ATTR_DEVICE_ID, attr_content, &attr_contentlen) )
+				{
+					//	Handle the P2P Device ID attribute of Beacon first
+					if ( _rtw_memcmp( attr_content, peerMAC, ETH_ALEN ) )
+					{
+						uintPeerChannel = pnetwork->network.Configuration.DSConfig;
+						break;
+					}
+				}
+				else if ( rtw_get_p2p_attr_content( p2pie, p2pielen, P2P_ATTR_DEVICE_INFO, attr_content, &attr_contentlen) )
+				{
+					//	Handle the P2P Device Info attribute of probe response
+					if ( _rtw_memcmp( attr_content, peerMAC, ETH_ALEN ) )
+					{
+						uintPeerChannel = pnetwork->network.Configuration.DSConfig;
+						break;
+					}
+				}
+
+				//Get the next P2P IE
+				p2pie = rtw_get_p2p_ie(p2pie+p2pielen, pnetwork->network.IELength - ie_offset -(p2pie -&pnetwork->network.IEs[ie_offset] + p2pielen), NULL, &p2pielen);
+			}
+		}
+
+#ifdef CONFIG_INTEL_WIDI
+			// Some Intel WiDi source may not provide P2P IE,
+			// so we could only compare mac addr by 802.11 Source Address
+			if( pmlmepriv->widi_state == INTEL_WIDI_STATE_WFD_CONNECTION
+				&& uintPeerChannel == 0 )
+			{
+				if ( _rtw_memcmp( pnetwork->network.MacAddress, peerMAC, ETH_ALEN ) )
+				{
+					uintPeerChannel = pnetwork->network.Configuration.DSConfig;
+					break;
+				}
+			}
+#endif //CONFIG_INTEL_WIDI
+
+		plist = get_next(plist);
+
+	}
+
+	_exit_critical_bh(&(pmlmepriv->scanned_queue.lock), &irqL);
+
+	if ( uintPeerChannel )
+	{
+#ifdef CONFIG_WFD
+	{
+		u8	wfd_ie[ 128 ] = { 0x00 };
+		uint	wfd_ielen = 0;
+
+		if ( rtw_get_wfd_ie( &pnetwork->network.IEs[12], pnetwork->network.IELength - 12,  wfd_ie, &wfd_ielen ) )
+		{
+			u8	wfd_devinfo[ 6 ] = { 0x00 };
+			uint	wfd_devlen = 6;
+
+			DBG_871X( "[%s] Found WFD IE!\n", __FUNCTION__ );
+			if ( rtw_get_wfd_attr_content( wfd_ie, wfd_ielen, WFD_ATTR_DEVICE_INFO, wfd_devinfo, &wfd_devlen ) )
+			{
+				u16	wfd_devinfo_field = 0;
+
+				//	Commented by Albert 20120319
+				//	The first two bytes are the WFD device information field of WFD device information subelement.
+				//	In big endian format.
+				wfd_devinfo_field = RTW_GET_BE16(wfd_devinfo);
+				if ( wfd_devinfo_field & WFD_DEVINFO_SESSION_AVAIL )
+				{
+					pwfd_info->peer_session_avail = _TRUE;
+				}
+				else
+				{
+					pwfd_info->peer_session_avail = _FALSE;
+				}
+			}
+		}
+
+		if ( _FALSE == pwfd_info->peer_session_avail )
+		{
+			DBG_871X( "[%s] WFD Session not avaiable!\n", __FUNCTION__ );
+			goto exit;
+		}
+	}
+#endif // CONFIG_WFD
+
+		DBG_871X( "[%s] peer channel: %d!\n", __FUNCTION__, uintPeerChannel );
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+		{
+			_cancel_timer_ex( &pwdinfo->ap_p2p_switch_timer );
+		}
+#endif // CONFIG_CONCURRENT_MODE
+		_rtw_memcpy( pwdinfo->tx_prov_disc_info.peerIFAddr, pnetwork->network.MacAddress, ETH_ALEN );
+		_rtw_memcpy( pwdinfo->tx_prov_disc_info.peerDevAddr, peerMAC, ETH_ALEN );
+		pwdinfo->tx_prov_disc_info.peer_channel_num[0] = ( u16 ) uintPeerChannel;
+		pwdinfo->tx_prov_disc_info.benable = _TRUE;
+		rtw_p2p_set_pre_state(pwdinfo, rtw_p2p_state(pwdinfo));
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_TX_PROVISION_DIS_REQ);
+
+		if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_CLIENT))
+		{
+			_rtw_memcpy( &pwdinfo->tx_prov_disc_info.ssid, &pnetwork->network.Ssid, sizeof( NDIS_802_11_SSID ) );
+		}
+		else if(rtw_p2p_chk_role(pwdinfo, P2P_ROLE_DEVICE) || rtw_p2p_chk_role(pwdinfo, P2P_ROLE_GO))
+		{
+			_rtw_memcpy( pwdinfo->tx_prov_disc_info.ssid.Ssid, pwdinfo->p2p_wildcard_ssid, P2P_WILDCARD_SSID_LEN );
+			pwdinfo->tx_prov_disc_info.ssid.SsidLength= P2P_WILDCARD_SSID_LEN;
+		}
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+		{
+			//	Have to enter the power saving with the AP
+			set_channel_bwmode(padapter, pbuddy_mlmeext->cur_channel, pbuddy_mlmeext->cur_ch_offset, pbuddy_mlmeext->cur_bwmode);
+
+			issue_nulldata(pbuddy_adapter, NULL, 1, 3, 500);
+		}
+		else
+		{
+			set_channel_bwmode(padapter, uintPeerChannel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+		}
+#else
+		set_channel_bwmode(padapter, uintPeerChannel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
+#endif
+
+		_set_timer( &pwdinfo->pre_tx_scan_timer, P2P_TX_PRESCAN_TIMEOUT );
+
+#ifdef CONFIG_CONCURRENT_MODE
+		if ( check_buddy_fwstate(padapter, _FW_LINKED ) )
+		{
+			_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_CONCURRENT_PROVISION_TIMEOUT );
+		}
+		else
+		{
+			_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_PROVISION_TIMEOUT );
+		}
+#else
+		_set_timer( &pwdinfo->restore_p2p_state_timer, P2P_PROVISION_TIMEOUT );
+#endif // CONFIG_CONCURRENT_MODE
+
+
+	}
+	else
+	{
+		DBG_871X( "[%s] NOT Found in the Scanning Queue!\n", __FUNCTION__ );
+#ifdef CONFIG_INTEL_WIDI
+		rtw_p2p_set_state(pwdinfo, P2P_STATE_FIND_PHASE_SEARCH);
+		rtw_p2p_findphase_ex_set(pwdinfo, P2P_FINDPHASE_EX_NONE);
+		rtw_free_network_queue(padapter, _TRUE);
+		_enter_critical_bh(&pmlmepriv->lock, &irqL);
+		rtw_sitesurvey_cmd(padapter, NULL, 0, NULL, 0);
+		_exit_critical_bh(&pmlmepriv->lock, &irqL);
+#endif //CONFIG_INTEL_WIDI
+	}
+exit:
+
+	return ret;
+
+}
+
+//	Added by Albert 20110328
+//	This function is used to inform the driver the user had specified the pin code value or pbc
+//	to application.
+
+static int rtw_p2p_got_wpsinfo(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+	_adapter 				*padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct wifidirect_info	*pwdinfo = &( padapter->wdinfo );
+
+
+	DBG_871X( "[%s] data = %s\n", __FUNCTION__, extra );
+	//	Added by Albert 20110328
+	//	if the input data is P2P_NO_WPSINFO -> reset the wpsinfo
+	//	if the input data is P2P_GOT_WPSINFO_PEER_DISPLAY_PIN -> the utility just input the PIN code got from the peer P2P device.
+	//	if the input data is P2P_GOT_WPSINFO_SELF_DISPLAY_PIN -> the utility just got the PIN code from itself.
+	//	if the input data is P2P_GOT_WPSINFO_PBC -> the utility just determine to use the PBC
+
+	if ( *extra == '0' )
+	{
+		pwdinfo->ui_got_wps_info = P2P_NO_WPSINFO;
+	}
+	else if ( *extra == '1' )
+	{
+		pwdinfo->ui_got_wps_info = P2P_GOT_WPSINFO_PEER_DISPLAY_PIN;
+	}
+	else if ( *extra == '2' )
+	{
+		pwdinfo->ui_got_wps_info = P2P_GOT_WPSINFO_SELF_DISPLAY_PIN;
+	}
+	else if ( *extra == '3' )
+	{
+		pwdinfo->ui_got_wps_info = P2P_GOT_WPSINFO_PBC;
+	}
+	else
+	{
+		pwdinfo->ui_got_wps_info = P2P_NO_WPSINFO;
+	}
+
+	return ret;
+
+}
+
+#endif //CONFIG_P2P
+
+static int rtw_p2p_set(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+#ifdef CONFIG_P2P
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+
+	DBG_871X( "[%s] extra = %s\n", __FUNCTION__, extra );
+
+	if ( _rtw_memcmp( extra, "enable=", 7 ) )
+	{
+		rtw_wext_p2p_enable( dev, info, wrqu, &extra[7] );
+	}
+	else if ( _rtw_memcmp( extra, "setDN=", 6 ) )
+	{
+		wrqu->data.length -= 6;
+		rtw_p2p_setDN( dev, info, wrqu, &extra[6] );
+	}
+	else if ( _rtw_memcmp( extra, "profilefound=", 13 ) )
+	{
+		wrqu->data.length -= 13;
+		rtw_p2p_profilefound( dev, info, wrqu, &extra[13] );
+	}
+	else if ( _rtw_memcmp( extra, "prov_disc=", 10 ) )
+	{
+		wrqu->data.length -= 10;
+		rtw_p2p_prov_disc( dev, info, wrqu, &extra[10] );
+	}
+	else if ( _rtw_memcmp( extra, "nego=", 5 ) )
+	{
+		wrqu->data.length -= 5;
+		rtw_p2p_connect( dev, info, wrqu, &extra[5] );
+	}
+	else if ( _rtw_memcmp( extra, "intent=", 7 ) )
+	{
+		//	Commented by Albert 2011/03/23
+		//	The wrqu->data.length will include the null character
+		//	So, we will decrease 7 + 1
+		wrqu->data.length -= 8;
+		rtw_p2p_set_intent( dev, info, wrqu, &extra[7] );
+	}
+	else if ( _rtw_memcmp( extra, "ssid=", 5 ) )
+	{
+		wrqu->data.length -= 5;
+		rtw_p2p_set_go_nego_ssid( dev, info, wrqu, &extra[5] );
+	}
+	else if ( _rtw_memcmp( extra, "got_wpsinfo=", 12 ) )
+	{
+		wrqu->data.length -= 12;
+		rtw_p2p_got_wpsinfo( dev, info, wrqu, &extra[12] );
+	}
+	else if ( _rtw_memcmp( extra, "listen_ch=", 10 ) )
+	{
+		//	Commented by Albert 2011/05/24
+		//	The wrqu->data.length will include the null character
+		//	So, we will decrease (10 + 1)
+		wrqu->data.length -= 11;
+		rtw_p2p_set_listen_ch( dev, info, wrqu, &extra[10] );
+	}
+	else if ( _rtw_memcmp( extra, "op_ch=", 6 ) )
+	{
+		//	Commented by Albert 2011/05/24
+		//	The wrqu->data.length will include the null character
+		//	So, we will decrease (6 + 1)
+		wrqu->data.length -= 7;
+		rtw_p2p_set_op_ch( dev, info, wrqu, &extra[6] );
+	}
+	else if ( _rtw_memcmp( extra, "invite=", 7 ) )
+	{
+		wrqu->data.length -= 8;
+		rtw_p2p_invite_req( dev, info, wrqu, &extra[7] );
+	}
+	else if ( _rtw_memcmp( extra, "persistent=", 11 ) )
+	{
+		wrqu->data.length -= 11;
+		rtw_p2p_set_persistent( dev, info, wrqu, &extra[11] );
+	}
+	else if ( _rtw_memcmp ( extra, "uuid=", 5) )
+	{
+		wrqu->data.length -= 5;
+		ret = rtw_p2p_set_wps_uuid( dev, info, wrqu, &extra[5] );
+	}
+#ifdef CONFIG_WFD
+	else if ( _rtw_memcmp( extra, "sa=", 3 ) )
+	{
+		//	sa: WFD Session Available information
+		wrqu->data.length -= 3;
+		rtw_p2p_set_sa( dev, info, wrqu, &extra[3] );
+	}
+	else if ( _rtw_memcmp( extra, "pc=", 3 ) )
+	{
+		//	pc: WFD Preferred Connection
+		wrqu->data.length -= 3;
+		rtw_p2p_set_pc( dev, info, wrqu, &extra[3] );
+	}
+	else if ( _rtw_memcmp( extra, "wfd_type=", 9 ) )
+	{
+		//	Specify this device is Mircast source or sink
+		wrqu->data.length -= 9;
+		rtw_p2p_set_wfd_device_type( dev, info, wrqu, &extra[9] );
+	}
+	else if ( _rtw_memcmp( extra, "scan_type=", 10 ) )
+	{
+		wrqu->data.length -= 10;
+		rtw_p2p_set_scan_result_type( dev, info, wrqu, &extra[10] );
+	}
+	else if ( _rtw_memcmp( extra, "wfd_enable=", 11 ) )
+	{
+		wrqu->data.length -= 11;
+		rtw_p2p_set_wfd_enable( dev, info, wrqu, &extra[11] );
+	}
+	else if ( _rtw_memcmp( extra, "driver_iface=", 13 ) )
+	{
+		wrqu->data.length -= 13;
+		rtw_p2p_set_driver_iface( dev, info, wrqu, &extra[13] );
+	}
+#endif //CONFIG_WFD
+#endif //CONFIG_P2P
+
+	return ret;
+
+}
+
+static int rtw_p2p_get(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+
+#ifdef CONFIG_P2P
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct iw_point *pdata = &wrqu->data;
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+
+	if ( padapter->bShowGetP2PState )
+	{
+		DBG_871X( "[%s] extra = %s\n", __FUNCTION__, (char*) wrqu->data.pointer );
+	}
+
+	if ( _rtw_memcmp( wrqu->data.pointer, "status", 6 ) )
+	{
+		rtw_p2p_get_status( dev, info, wrqu, extra );
+	}
+	else if ( _rtw_memcmp( wrqu->data.pointer, "role", 4 ) )
+	{
+		rtw_p2p_get_role( dev, info, wrqu, extra);
+	}
+	else if ( _rtw_memcmp( wrqu->data.pointer, "peer_ifa", 8 ) )
+	{
+		rtw_p2p_get_peer_ifaddr( dev, info, wrqu, extra);
+	}
+	else if ( _rtw_memcmp( wrqu->data.pointer, "req_cm", 6 ) )
+	{
+		rtw_p2p_get_req_cm( dev, info, wrqu, extra);
+	}
+	else if ( _rtw_memcmp( wrqu->data.pointer, "peer_deva", 9 ) )
+	{
+		//	Get the P2P device address when receiving the provision discovery request frame.
+		rtw_p2p_get_peer_devaddr( dev, info, wrqu, extra);
+	}
+	else if ( _rtw_memcmp( wrqu->data.pointer, "group_id", 8 ) )
+	{
+		rtw_p2p_get_groupid( dev, info, wrqu, extra);
+	}
+	else if ( _rtw_memcmp( wrqu->data.pointer, "inv_peer_deva", 13 ) )
+	{
+		//	Get the P2P device address when receiving the P2P Invitation request frame.
+		rtw_p2p_get_peer_devaddr_by_invitation( dev, info, wrqu, extra);
+	}
+	else if ( _rtw_memcmp( wrqu->data.pointer, "op_ch", 5 ) )
+	{
+		rtw_p2p_get_op_ch( dev, info, wrqu, extra);
+	}
+#ifdef CONFIG_WFD
+	else if ( _rtw_memcmp( wrqu->data.pointer, "peer_port", 9 ) )
+	{
+		rtw_p2p_get_peer_wfd_port( dev, info, wrqu, extra );
+	}
+	else if ( _rtw_memcmp( wrqu->data.pointer, "wfd_sa", 6 ) )
+	{
+		rtw_p2p_get_peer_wfd_session_available( dev, info, wrqu, extra );
+	}
+	else if ( _rtw_memcmp( wrqu->data.pointer, "wfd_pc", 6 ) )
+	{
+		rtw_p2p_get_peer_wfd_preferred_connection( dev, info, wrqu, extra );
+	}
+#endif // CONFIG_WFD
+
+#endif //CONFIG_P2P
+
+	return ret;
+
+}
+
+static int rtw_p2p_get2(struct net_device *dev,
+						struct iw_request_info *info,
+						union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+
+#ifdef CONFIG_P2P
+
+	int length = wrqu->data.length;
+	char *buffer = (u8 *)rtw_malloc(length);
+
+	if (buffer == NULL)
+	{
+		ret = -ENOMEM;
+		goto bad;
+	}
+
+	if (copy_from_user(buffer, wrqu->data.pointer, wrqu->data.length))
+	{
+		ret - EFAULT;
+		goto bad;
+	}
+
+	DBG_871X("[%s] buffer = %s\n", __FUNCTION__, buffer);
+
+	if (_rtw_memcmp(buffer, "wpsCM=", 6))
+	{
+		ret = rtw_p2p_get_wps_configmethod(dev, info, wrqu, extra, &buffer[6]);
+	} else if (_rtw_memcmp(buffer, "devN=", 5))
+	{
+		ret = rtw_p2p_get_device_name(dev, info, wrqu, extra, &buffer[5]);
+	} else if (_rtw_memcmp(buffer, "dev_type=", 9))
+	{
+		ret = rtw_p2p_get_device_type(dev, info, wrqu, extra, &buffer[9]);
+	} else if (_rtw_memcmp(buffer, "go_devadd=", 10))
+	{
+		ret = rtw_p2p_get_go_device_address(dev, info, wrqu, extra, &buffer[10]);
+	} else if (_rtw_memcmp(buffer, "InvProc=", 8))
+	{
+		ret = rtw_p2p_get_invitation_procedure(dev, info, wrqu, extra, &buffer[8]);
+	} else
+	{
+		snprintf(extra, sizeof("Command not found."), "Command not found.");
+		wrqu->data.length = strlen(extra);
+	}
+
+bad:
+	if (buffer)
+	{
+		rtw_mfree(buffer, length);
+	}
+
+#endif //CONFIG_P2P
+
+	return ret;
+
+}
+
+extern int rtw_change_ifname(_adapter *padapter, const char *ifname);
+static int rtw_rereg_nd_name(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+	_adapter *padapter = rtw_netdev_priv(dev);
+	struct rereg_nd_name_data *rereg_priv = &padapter->rereg_nd_name_priv;
+	char new_ifname[IFNAMSIZ];
+
+	if(rereg_priv->old_ifname[0] == 0) {
+		char *reg_ifname;
+#ifdef CONFIG_CONCURRENT_MODE
+		if (padapter->isprimary)
+			reg_ifname = padapter->registrypriv.ifname;
+		else
+#endif
+		reg_ifname = padapter->registrypriv.if2name;
+
+		strncpy(rereg_priv->old_ifname, reg_ifname, IFNAMSIZ);
+		rereg_priv->old_ifname[IFNAMSIZ-1] = 0;
+	}
+
+	//DBG_871X("%s wrqu->data.length:%d\n", __FUNCTION__, wrqu->data.length);
+	if(wrqu->data.length > IFNAMSIZ)
+		return -EFAULT;
+
+	if ( copy_from_user(new_ifname, wrqu->data.pointer, IFNAMSIZ) ) {
+		return -EFAULT;
+	}
+
+	if( 0 == strcmp(rereg_priv->old_ifname, new_ifname) ) {
+		return ret;
+	}
+
+	DBG_871X("%s new_ifname:%s\n", __FUNCTION__, new_ifname);
+	if( 0 != (ret = rtw_change_ifname(padapter, new_ifname)) ) {
+		goto exit;
+	}
+
+	if(_rtw_memcmp(rereg_priv->old_ifname, "disable%d", 9) == _TRUE) {
+		padapter->ledpriv.bRegUseLed= rereg_priv->old_bRegUseLed;
+		rtw_hal_sw_led_init(padapter);
+		rtw_ips_mode_req(&padapter->pwrctrlpriv, rereg_priv->old_ips_mode);
+	}
+
+	strncpy(rereg_priv->old_ifname, new_ifname, IFNAMSIZ);
+	rereg_priv->old_ifname[IFNAMSIZ-1] = 0;
+
+	if(_rtw_memcmp(new_ifname, "disable%d", 9) == _TRUE) {
+
+		DBG_871X("%s disable\n", __FUNCTION__);
+		// free network queue for Android's timming issue
+		rtw_free_network_queue(padapter, _TRUE);
+
+		// close led
+		rtw_led_control(padapter, LED_CTL_POWER_OFF);
+		rereg_priv->old_bRegUseLed = padapter->ledpriv.bRegUseLed;
+		padapter->ledpriv.bRegUseLed= _FALSE;
+		rtw_hal_sw_led_deinit(padapter);
+
+		// the interface is being "disabled", we can do deeper IPS
+		rereg_priv->old_ips_mode = rtw_get_ips_mode_req(&padapter->pwrctrlpriv);
+		rtw_ips_mode_req(&padapter->pwrctrlpriv, IPS_NORMAL);
+	}
+exit:
+	return ret;
+
+}
+
+#if 0
+void mac_reg_dump(_adapter *padapter)
+{
+	int i,j=1;
+	DBG_871X("\n======= MAC REG =======\n");
+	for(i=0x0;i<0x300;i+=4)
+	{
+		if(j%4==1)	DBG_871X("0x%02x",i);
+		DBG_871X(" 0x%08x ",rtw_read32(padapter,i));
+		if((j++)%4 == 0)	DBG_871X("\n");
+	}
+	for(i=0x400;i<0x800;i+=4)
+	{
+		if(j%4==1)	DBG_871X("0x%02x",i);
+		DBG_871X(" 0x%08x ",rtw_read32(padapter,i));
+		if((j++)%4 == 0)	DBG_871X("\n");
+	}
+}
+void bb_reg_dump(_adapter *padapter)
+{
+	int i,j=1;
+	DBG_871X("\n======= BB REG =======\n");
+	for(i=0x800;i<0x1000;i+=4)
+	{
+		if(j%4==1) DBG_871X("0x%02x",i);
+
+		DBG_871X(" 0x%08x ",rtw_read32(padapter,i));
+		if((j++)%4 == 0)	DBG_871X("\n");
+	}
+}
+void rf_reg_dump(_adapter *padapter)
+{
+	int i,j=1,path;
+	u32 value;
+	DBG_871X("\n======= RF REG =======\n");
+	for(path=0;path<2;path++)
+	{
+		DBG_871X("\nRF_Path(%x)\n",path);
+		for(i=0;i<0x100;i++)
+		{
+			value = PHY_QueryRFReg(padapter, (RF90_RADIO_PATH_E)path,i, bMaskDWord);
+			if(j%4==1)	DBG_871X("0x%02x ",i);
+			DBG_871X(" 0x%08x ",value);
+			if((j++)%4==0)	DBG_871X("\n");
+		}
+	}
+}
+
+#endif
+
+void mac_reg_dump(_adapter *padapter)
+{
+	int i,j=1;
+	DBG_871X("\n======= MAC REG =======\n");
+	for(i=0x0;i<0x300;i+=4)
+	{
+		if(j%4==1)	DBG_871X("0x%02x",i);
+		DBG_871X(" 0x%08x ",rtw_read32(padapter,i));
+		if((j++)%4 == 0)	DBG_871X("\n");
+	}
+	for(i=0x400;i<0x800;i+=4)
+	{
+		if(j%4==1)	DBG_871X("0x%02x",i);
+		DBG_871X(" 0x%08x ",rtw_read32(padapter,i));
+		if((j++)%4 == 0)	DBG_871X("\n");
+	}
+}
+void bb_reg_dump(_adapter *padapter)
+{
+	int i,j=1;
+	DBG_871X("\n======= BB REG =======\n");
+	for(i=0x800;i<0x1000;i+=4)
+	{
+		if(j%4==1) DBG_871X("0x%02x",i);
+
+		DBG_871X(" 0x%08x ",rtw_read32(padapter,i));
+		if((j++)%4 == 0)	DBG_871X("\n");
+	}
+}
+void rf_reg_dump(_adapter *padapter)
+{
+	int i,j=1,path;
+	u32 value;
+	u8 rf_type,path_nums = 0;
+	rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+
+	DBG_871X("\n======= RF REG =======\n");
+	if((RF_1T2R == rf_type) ||(RF_1T1R ==rf_type ))
+		path_nums = 1;
+	else
+		path_nums = 2;
+
+	for(path=0;path<path_nums;path++)
+	{
+		DBG_871X("\nRF_Path(%x)\n",path);
+		for(i=0;i<0x100;i++)
+		{
+			//value = PHY_QueryRFReg(padapter, (RF90_RADIO_PATH_E)path,i, bMaskDWord);
+			value =rtw_hal_read_rfreg(padapter, path, i, 0xffffffff);
+			if(j%4==1)	DBG_871X("0x%02x ",i);
+			DBG_871X(" 0x%08x ",value);
+			if((j++)%4==0)	DBG_871X("\n");
+		}
+	}
+}
+
+#ifdef CONFIG_IOL
+#include <rtw_iol.h>
+#endif
+#ifdef DBG_CONFIG_ERROR_DETECT
+#include <rtw_sreset.h>
+#endif
+static int rtw_dbg_port(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	_irqL irqL;
+	int ret = 0;
+	u8 major_cmd, minor_cmd;
+	u16 arg;
+	u32 extra_arg, *pdata, val32;
+	struct sta_info *psta;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+	struct wlan_network *cur_network = &(pmlmepriv->cur_network);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+
+	pdata = (u32*)&wrqu->data;
+
+	val32 = *pdata;
+	arg = (u16)(val32&0x0000ffff);
+	major_cmd = (u8)(val32>>24);
+	minor_cmd = (u8)((val32>>16)&0x00ff);
+
+	extra_arg = *(pdata+1);
+
+	switch(major_cmd)
+	{
+		case 0x70://read_reg
+			switch(minor_cmd)
+			{
+				case 1:
+					DBG_871X("rtw_read8(0x%x)=0x%02x\n", arg, rtw_read8(padapter, arg));
+					break;
+				case 2:
+					DBG_871X("rtw_read16(0x%x)=0x%04x\n", arg, rtw_read16(padapter, arg));
+					break;
+				case 4:
+					DBG_871X("rtw_read32(0x%x)=0x%08x\n", arg, rtw_read32(padapter, arg));
+					break;
+			}
+			break;
+		case 0x71://write_reg
+			switch(minor_cmd)
+			{
+				case 1:
+					rtw_write8(padapter, arg, extra_arg);
+					DBG_871X("rtw_write8(0x%x)=0x%02x\n", arg, rtw_read8(padapter, arg));
+					break;
+				case 2:
+					rtw_write16(padapter, arg, extra_arg);
+					DBG_871X("rtw_write16(0x%x)=0x%04x\n", arg, rtw_read16(padapter, arg));
+					break;
+				case 4:
+					rtw_write32(padapter, arg, extra_arg);
+					DBG_871X("rtw_write32(0x%x)=0x%08x\n", arg, rtw_read32(padapter, arg));
+					break;
+			}
+			break;
+		case 0x72://read_bb
+			DBG_871X("read_bbreg(0x%x)=0x%x\n", arg, rtw_hal_read_bbreg(padapter, arg, 0xffffffff));
+			break;
+		case 0x73://write_bb
+			rtw_hal_write_bbreg(padapter, arg, 0xffffffff, extra_arg);
+			DBG_871X("write_bbreg(0x%x)=0x%x\n", arg, rtw_hal_read_bbreg(padapter, arg, 0xffffffff));
+			break;
+		case 0x74://read_rf
+			DBG_871X("read RF_reg path(0x%02x),offset(0x%x),value(0x%08x)\n",minor_cmd,arg,rtw_hal_read_rfreg(padapter, minor_cmd, arg, 0xffffffff));
+			break;
+		case 0x75://write_rf
+			rtw_hal_write_rfreg(padapter, minor_cmd, arg, 0xffffffff, extra_arg);
+			DBG_871X("write RF_reg path(0x%02x),offset(0x%x),value(0x%08x)\n",minor_cmd,arg, rtw_hal_read_rfreg(padapter, minor_cmd, arg, 0xffffffff));
+			break;
+
+		case 0x76:
+			switch(minor_cmd)
+			{
+				case 0x00: //normal mode,
+					padapter->recvpriv.is_signal_dbg = 0;
+					break;
+				case 0x01: //dbg mode
+					padapter->recvpriv.is_signal_dbg = 1;
+					extra_arg = extra_arg>100?100:extra_arg;
+					padapter->recvpriv.signal_strength_dbg=extra_arg;
+					break;
+			}
+			break;
+		case 0x78: //IOL test
+			switch(minor_cmd)
+			{
+				#ifdef CONFIG_IOL
+				case 0x04: //LLT table initialization test
+				{
+					u8 page_boundary = 0xf9;
+					{
+						struct xmit_frame	*xmit_frame;
+
+						if((xmit_frame=rtw_IOL_accquire_xmit_frame(padapter)) == NULL) {
+							ret = -ENOMEM;
+							break;
+						}
+
+						rtw_IOL_append_LLT_cmd(xmit_frame, page_boundary);
+
+
+						if(_SUCCESS != rtw_IOL_exec_cmds_sync(padapter, xmit_frame, 500) )
+							ret = -EPERM;
+					}
+				}
+					break;
+				case 0x05: //blink LED test
+				{
+					u16 reg = 0x4c;
+					u32 blink_num = 50;
+					u32 blink_delay_ms = 200;
+					int i;
+
+					{
+						struct xmit_frame	*xmit_frame;
+
+						if((xmit_frame=rtw_IOL_accquire_xmit_frame(padapter)) == NULL) {
+							ret = -ENOMEM;
+							break;
+						}
+
+						for(i=0;i<blink_num;i++){
+							rtw_IOL_append_WB_cmd(xmit_frame, reg, 0x00);
+							rtw_IOL_append_DELAY_MS_cmd(xmit_frame, blink_delay_ms);
+							rtw_IOL_append_WB_cmd(xmit_frame, reg, 0x08);
+							rtw_IOL_append_DELAY_MS_cmd(xmit_frame, blink_delay_ms);
+						}
+						if(_SUCCESS != rtw_IOL_exec_cmds_sync(padapter, xmit_frame, (blink_delay_ms*blink_num*2)+200) )
+							ret = -EPERM;
+					}
+				}
+					break;
+
+				case 0x06: //continuous wirte byte test
+				{
+					u16 reg = arg;
+					u16 start_value = 0;
+					u32 write_num = extra_arg;
+					int i;
+					u8 final;
+
+					{
+						struct xmit_frame	*xmit_frame;
+
+						if((xmit_frame=rtw_IOL_accquire_xmit_frame(padapter)) == NULL) {
+							ret = -ENOMEM;
+							break;
+						}
+
+						for(i=0;i<write_num;i++){
+							rtw_IOL_append_WB_cmd(xmit_frame, reg, i+start_value);
+						}
+						if(_SUCCESS != rtw_IOL_exec_cmds_sync(padapter, xmit_frame, 5000))
+							ret = -EPERM;
+					}
+
+					if(start_value+write_num-1 == (final=rtw_read8(padapter, reg)) ) {
+						DBG_871X("continuous IOL_CMD_WB_REG to 0x%x %u times Success, start:%u, final:%u\n", reg, write_num, start_value, final);
+					} else {
+						DBG_871X("continuous IOL_CMD_WB_REG to 0x%x %u times Fail, start:%u, final:%u\n", reg, write_num, start_value, final);
+					}
+				}
+					break;
+
+				case 0x07: //continuous wirte word test
+				{
+					u16 reg = arg;
+					u16 start_value = 200;
+					u32 write_num = extra_arg;
+
+					int i;
+					u16 final;
+
+					{
+						struct xmit_frame	*xmit_frame;
+
+						if((xmit_frame=rtw_IOL_accquire_xmit_frame(padapter)) == NULL) {
+							ret = -ENOMEM;
+							break;
+						}
+
+						for(i=0;i<write_num;i++){
+							rtw_IOL_append_WW_cmd(xmit_frame, reg, i+start_value);
+						}
+						if(_SUCCESS !=rtw_IOL_exec_cmds_sync(padapter, xmit_frame, 5000))
+							ret = -EPERM;
+					}
+
+					if(start_value+write_num-1 == (final=rtw_read16(padapter, reg)) ) {
+						DBG_871X("continuous IOL_CMD_WW_REG to 0x%x %u times Success, start:%u, final:%u\n", reg, write_num, start_value, final);
+					} else {
+						DBG_871X("continuous IOL_CMD_WW_REG to 0x%x %u times Fail, start:%u, final:%u\n", reg, write_num, start_value, final);
+					}
+				}
+					break;
+
+				case 0x08: //continuous wirte dword test
+				{
+					u16 reg = arg;
+					u32 start_value = 0x110000c7;
+					u32 write_num = extra_arg;
+
+					int i;
+					u32 final;
+
+					{
+						struct xmit_frame	*xmit_frame;
+
+						if((xmit_frame=rtw_IOL_accquire_xmit_frame(padapter)) == NULL) {
+							ret = -ENOMEM;
+							break;
+						}
+
+						for(i=0;i<write_num;i++){
+							rtw_IOL_append_WD_cmd(xmit_frame, reg, i+start_value);
+						}
+						if(_SUCCESS !=rtw_IOL_exec_cmds_sync(padapter, xmit_frame, 5000))
+							ret = -EPERM;
+
+					}
+
+					if(start_value+write_num-1 == (final=rtw_read32(padapter, reg)) ) {
+						DBG_871X("continuous IOL_CMD_WD_REG to 0x%x %u times Success, start:%u, final:%u\n", reg, write_num, start_value, final);
+					} else {
+						DBG_871X("continuous IOL_CMD_WD_REG to 0x%x %u times Fail, start:%u, final:%u\n", reg, write_num, start_value, final);
+					}
+				}
+					break;
+				#endif //CONFIG_IOL
+			}
+			break;
+		case 0x7a:
+			receive_disconnect(padapter, pmlmeinfo->network.MacAddress
+				, WLAN_REASON_EXPIRATION_CHK);
+			break;
+
+		case 0x7F:
+			switch(minor_cmd)
+			{
+				case 0x0:
+					DBG_871X("fwstate=0x%x\n", get_fwstate(pmlmepriv));
+					break;
+				case 0x01:
+					DBG_871X("auth_alg=0x%x, enc_alg=0x%x, auth_type=0x%x, enc_type=0x%x\n",
+						psecuritypriv->dot11AuthAlgrthm, psecuritypriv->dot11PrivacyAlgrthm,
+						psecuritypriv->ndisauthtype, psecuritypriv->ndisencryptstatus);
+					break;
+				case 0x02:
+					DBG_871X("pmlmeinfo->state=0x%x\n", pmlmeinfo->state);
+					break;
+				case 0x03:
+					DBG_871X("qos_option=%d\n", pmlmepriv->qospriv.qos_option);
+					DBG_871X("ht_option=%d\n", pmlmepriv->htpriv.ht_option);
+					break;
+				case 0x04:
+					DBG_871X("cur_ch=%d\n", pmlmeext->cur_channel);
+					DBG_871X("cur_bw=%d\n", pmlmeext->cur_bwmode);
+					DBG_871X("cur_ch_off=%d\n", pmlmeext->cur_ch_offset);
+					break;
+				case 0x05:
+					psta = rtw_get_stainfo(pstapriv, cur_network->network.MacAddress);
+					if(psta)
+					{
+						int i;
+						struct recv_reorder_ctrl *preorder_ctrl;
+
+						DBG_871X("SSID=%s\n", cur_network->network.Ssid.Ssid);
+						DBG_871X("sta's macaddr:" MAC_FMT "\n", MAC_ARG(psta->hwaddr));
+						DBG_871X("cur_channel=%d, cur_bwmode=%d, cur_ch_offset=%d\n", pmlmeext->cur_channel, pmlmeext->cur_bwmode, pmlmeext->cur_ch_offset);
+						DBG_871X("rtsen=%d, cts2slef=%d\n", psta->rtsen, psta->cts2self);
+						DBG_871X("qos_en=%d, ht_en=%d, init_rate=%d\n", psta->qos_option, psta->htpriv.ht_option, psta->init_rate);
+						DBG_871X("state=0x%x, aid=%d, macid=%d, raid=%d\n", psta->state, psta->aid, psta->mac_id, psta->raid);
+						DBG_871X("bwmode=%d, ch_offset=%d, sgi=%d\n", psta->htpriv.bwmode, psta->htpriv.ch_offset, psta->htpriv.sgi);
+						DBG_871X("ampdu_enable = %d\n", psta->htpriv.ampdu_enable);
+						DBG_871X("agg_enable_bitmap=%x, candidate_tid_bitmap=%x\n", psta->htpriv.agg_enable_bitmap, psta->htpriv.candidate_tid_bitmap);
+
+						for(i=0;i<16;i++)
+						{
+							preorder_ctrl = &psta->recvreorder_ctrl[i];
+							if(preorder_ctrl->enable)
+							{
+								DBG_871X("tid=%d, indicate_seq=%d\n", i, preorder_ctrl->indicate_seq);
+							}
+						}
+
+					}
+					else
+					{
+						DBG_871X("can't get sta's macaddr, cur_network's macaddr:" MAC_FMT "\n", MAC_ARG(cur_network->network.MacAddress));
+					}
+					break;
+				case 0x06:
+					{
+						u8	DMFlag;
+						rtw_hal_get_hwreg(padapter, HW_VAR_DM_FLAG, (u8 *)(&DMFlag));
+						DBG_871X("(B)DMFlag=0x%x, arg=0x%x\n", DMFlag, arg);
+						DMFlag = (u8)(0x0f&arg);
+						DBG_871X("(A)DMFlag=0x%x\n", DMFlag);
+						rtw_hal_set_hwreg(padapter, HW_VAR_DM_FLAG, (u8 *)(&DMFlag));
+					}
+					break;
+				case 0x07:
+					DBG_871X("bSurpriseRemoved=%d, bDriverStopped=%d\n",
+						padapter->bSurpriseRemoved, padapter->bDriverStopped);
+					break;
+                                case 0x08:
+					{
+						struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+						struct recv_priv  *precvpriv = &padapter->recvpriv;
+
+						DBG_871X("free_xmitbuf_cnt=%d, free_xmitframe_cnt=%d"
+							", free_xmit_extbuf_cnt=%d, free_xframe_ext_cnt=%d"
+							", free_recvframe_cnt=%d\n",
+							pxmitpriv->free_xmitbuf_cnt, pxmitpriv->free_xmitframe_cnt,
+							pxmitpriv->free_xmit_extbuf_cnt, pxmitpriv->free_xframe_ext_cnt,
+							precvpriv->free_recvframe_cnt);
+						#ifdef CONFIG_USB_HCI
+						DBG_871X("rx_urb_pending_cn=%d\n", precvpriv->rx_pending_cnt);
+						#endif
+					}
+					break;
+				case 0x09:
+					{
+						int i, j;
+						_list	*plist, *phead;
+						struct recv_reorder_ctrl *preorder_ctrl;
+
+#ifdef CONFIG_AP_MODE
+						DBG_871X("sta_dz_bitmap=0x%x, tim_bitmap=0x%x\n", pstapriv->sta_dz_bitmap, pstapriv->tim_bitmap);
+#endif
+						_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+						for(i=0; i< NUM_STA; i++)
+						{
+							phead = &(pstapriv->sta_hash[i]);
+							plist = get_next(phead);
+
+							while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+							{
+								psta = LIST_CONTAINOR(plist, struct sta_info, hash_list);
+
+								plist = get_next(plist);
+
+								if(extra_arg == psta->aid)
+								{
+									DBG_871X("sta's macaddr:" MAC_FMT "\n", MAC_ARG(psta->hwaddr));
+									DBG_871X("rtsen=%d, cts2slef=%d\n", psta->rtsen, psta->cts2self);
+									DBG_871X("qos_en=%d, ht_en=%d, init_rate=%d\n", psta->qos_option, psta->htpriv.ht_option, psta->init_rate);
+									DBG_871X("state=0x%x, aid=%d, macid=%d, raid=%d\n", psta->state, psta->aid, psta->mac_id, psta->raid);
+									DBG_871X("bwmode=%d, ch_offset=%d, sgi=%d\n", psta->htpriv.bwmode, psta->htpriv.ch_offset, psta->htpriv.sgi);
+									DBG_871X("ampdu_enable = %d\n", psta->htpriv.ampdu_enable);
+									DBG_871X("agg_enable_bitmap=%x, candidate_tid_bitmap=%x\n", psta->htpriv.agg_enable_bitmap, psta->htpriv.candidate_tid_bitmap);
+#ifdef CONFIG_AP_MODE
+									DBG_871X("capability=0x%x\n", psta->capability);
+									DBG_871X("flags=0x%x\n", psta->flags);
+									DBG_871X("wpa_psk=0x%x\n", psta->wpa_psk);
+									DBG_871X("wpa2_group_cipher=0x%x\n", psta->wpa2_group_cipher);
+									DBG_871X("wpa2_pairwise_cipher=0x%x\n", psta->wpa2_pairwise_cipher);
+									DBG_871X("qos_info=0x%x\n", psta->qos_info);
+#endif
+									DBG_871X("dot118021XPrivacy=0x%x\n", psta->dot118021XPrivacy);
+
+
+
+									for(j=0;j<16;j++)
+									{
+										preorder_ctrl = &psta->recvreorder_ctrl[j];
+										if(preorder_ctrl->enable)
+										{
+											DBG_871X("tid=%d, indicate_seq=%d\n", j, preorder_ctrl->indicate_seq);
+										}
+									}
+
+								}
+
+							}
+						}
+
+						_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+					}
+					break;
+
+                                case 0x0c://dump rx packet
+					{
+						DBG_871X("dump rx packet (%d)\n",extra_arg);
+						//pHalData->bDumpRxPkt =extra_arg;
+						rtw_hal_set_def_var(padapter, HAL_DEF_DBG_DUMP_RXPKT, &(extra_arg));
+					}
+					break;
+#if 0
+					case 0x0d://dump cam
+					{
+						//u8 entry = (u8) extra_arg;
+						u8 entry=0;
+						//dump cam
+						for(entry=0;entry<32;entry++)
+							read_cam(padapter,entry);
+					}
+					break;
+#endif
+		#ifdef DBG_CONFIG_ERROR_DETECT
+				case 0x0f:
+						{
+							if(extra_arg == 0){
+								DBG_871X("###### silent reset test.......#####\n");
+								rtw_hal_sreset_reset(padapter);
+							} else {
+								sreset_set_trigger_point(padapter, extra_arg);
+							}
+
+						}
+				break;
+				case 0x15:
+					{
+						struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+						DBG_871X("==>silent resete cnts:%d\n",pwrpriv->ips_enter_cnts);
+					}
+					break;
+
+		#endif
+
+				case 0x10:// driver version display
+					DBG_871X("rtw driver version=%s\n", DRIVERVERSION);
+					break;
+				case 0x11:
+					{
+						DBG_871X("turn %s Rx RSSI display function\n",(extra_arg==1)?"on":"off");
+						padapter->bRxRSSIDisplay = extra_arg ;
+					}
+					break;
+				case 0x12: //set rx_stbc
+				{
+					struct registry_priv	*pregpriv = &padapter->registrypriv;
+					// 0: disable, bit(0):enable 2.4g, bit(1):enable 5g, 0x3: enable both 2.4g and 5g
+					//default is set to enable 2.4GHZ for IOT issue with bufflao's AP at 5GHZ
+					if( pregpriv && (extra_arg == 0 || extra_arg == 1|| extra_arg == 2 || extra_arg == 3))
+					{
+						pregpriv->rx_stbc= extra_arg;
+						DBG_871X("set rx_stbc=%d\n",pregpriv->rx_stbc);
+					}
+					else
+						DBG_871X("get rx_stbc=%d\n",pregpriv->rx_stbc);
+
+				}
+				break;
+				case 0x13: //set ampdu_enable
+				{
+					struct registry_priv	*pregpriv = &padapter->registrypriv;
+					// 0: disable, 0x1:enable (but wifi_spec should be 0), 0x2: force enable (don't care wifi_spec)
+					if( pregpriv && extra_arg < 3 )
+					{
+						pregpriv->ampdu_enable= extra_arg;
+						DBG_871X("set ampdu_enable=%d\n",pregpriv->ampdu_enable);
+					}
+					else
+						DBG_871X("get ampdu_enable=%d\n",pregpriv->ampdu_enable);
+
+				}
+				break;
+				case 0x14: //get wifi_spec
+				{
+					struct registry_priv	*pregpriv = &padapter->registrypriv;
+					DBG_871X("get wifi_spec=%d\n",pregpriv->wifi_spec);
+
+				}
+				break;
+				case 0x22:
+					{
+						DBG_871X("turn %s the ForceWriteInitGain Variable\n",(extra_arg==1)?"on":"off");
+						padapter->bForceWriteInitGain = extra_arg;
+						break;
+					}
+				case 0x23:
+					{
+						DBG_871X("turn %s the bNotifyChannelChange Variable\n",(extra_arg==1)?"on":"off");
+						padapter->bNotifyChannelChange = extra_arg;
+						break;
+					}
+				case 0x24:
+					{
+#ifdef CONFIG_P2P
+						DBG_871X("turn %s the bShowGetP2PState Variable\n",(extra_arg==1)?"on":"off");
+						padapter->bShowGetP2PState = extra_arg;
+#endif // CONFIG_P2P
+						break;
+					}
+#if 1
+				case 0xdd://registers dump , 0 for mac reg,1 for bb reg, 2 for rf reg
+					{
+						if(extra_arg==0){
+							mac_reg_dump(padapter);
+						}
+						else if(extra_arg==1){
+							bb_reg_dump(padapter);
+						}
+						else if(extra_arg==2){
+							rf_reg_dump(padapter);
+						}
+
+					}
+					break;
+#endif
+				case 0xee://turn on/off dynamic funcs
+					{
+						u8 dm_flag;
+
+						if(0xf==extra_arg){
+							rtw_hal_get_def_var(padapter, HAL_DEF_DBG_DM_FUNC,&dm_flag);
+							DBG_871X(" === DMFlag(0x%02x) === \n",dm_flag);
+							DBG_871X("extra_arg = 0  - disable all dynamic func \n");
+							DBG_871X("extra_arg = 1  - disable DIG- BIT(0)\n");
+							DBG_871X("extra_arg = 2  - disable High power - BIT(1)\n");
+							DBG_871X("extra_arg = 3  - disable tx power tracking - BIT(2)\n");
+							DBG_871X("extra_arg = 4  - disable BT coexistence - BIT(3)\n");
+							DBG_871X("extra_arg = 5  - disable antenna diversity - BIT(4)\n");
+							DBG_871X("extra_arg = 6  - enable all dynamic func \n");
+						}
+						else{
+							/*	extra_arg = 0  - disable all dynamic func
+								extra_arg = 1  - disable DIG
+								extra_arg = 2  - disable tx power tracking
+								extra_arg = 3  - turn on all dynamic func
+							*/
+							rtw_hal_set_def_var(padapter, HAL_DEF_DBG_DM_FUNC, &(extra_arg));
+							rtw_hal_get_def_var(padapter, HAL_DEF_DBG_DM_FUNC,&dm_flag);
+							DBG_871X(" === DMFlag(0x%02x) === \n",dm_flag);
+						}
+					}
+					break;
+
+				case 0xfd:
+					rtw_write8(padapter, 0xc50, arg);
+					DBG_871X("wr(0xc50)=0x%x\n", rtw_read8(padapter, 0xc50));
+					rtw_write8(padapter, 0xc58, arg);
+					DBG_871X("wr(0xc58)=0x%x\n", rtw_read8(padapter, 0xc58));
+					break;
+				case 0xfe:
+					DBG_871X("rd(0xc50)=0x%x\n", rtw_read8(padapter, 0xc50));
+					DBG_871X("rd(0xc58)=0x%x\n", rtw_read8(padapter, 0xc58));
+					break;
+				case 0xff:
+					{
+						DBG_871X("dbg(0x210)=0x%x\n", rtw_read32(padapter, 0x210));
+						DBG_871X("dbg(0x608)=0x%x\n", rtw_read32(padapter, 0x608));
+						DBG_871X("dbg(0x280)=0x%x\n", rtw_read32(padapter, 0x280));
+						DBG_871X("dbg(0x284)=0x%x\n", rtw_read32(padapter, 0x284));
+						DBG_871X("dbg(0x288)=0x%x\n", rtw_read32(padapter, 0x288));
+
+						DBG_871X("dbg(0x664)=0x%x\n", rtw_read32(padapter, 0x664));
+
+
+						DBG_871X("\n");
+
+						DBG_871X("dbg(0x430)=0x%x\n", rtw_read32(padapter, 0x430));
+						DBG_871X("dbg(0x438)=0x%x\n", rtw_read32(padapter, 0x438));
+
+						DBG_871X("dbg(0x440)=0x%x\n", rtw_read32(padapter, 0x440));
+
+						DBG_871X("dbg(0x458)=0x%x\n", rtw_read32(padapter, 0x458));
+
+						DBG_871X("dbg(0x484)=0x%x\n", rtw_read32(padapter, 0x484));
+						DBG_871X("dbg(0x488)=0x%x\n", rtw_read32(padapter, 0x488));
+
+						DBG_871X("dbg(0x444)=0x%x\n", rtw_read32(padapter, 0x444));
+						DBG_871X("dbg(0x448)=0x%x\n", rtw_read32(padapter, 0x448));
+						DBG_871X("dbg(0x44c)=0x%x\n", rtw_read32(padapter, 0x44c));
+						DBG_871X("dbg(0x450)=0x%x\n", rtw_read32(padapter, 0x450));
+					}
+					break;
+			}
+			break;
+		default:
+			DBG_871X("error dbg cmd!\n");
+			break;
+	}
+
+
+	return ret;
+
+}
+
+static int wpa_set_param(struct net_device *dev, u8 name, u32 value)
+{
+	uint ret=0;
+	u32 flags;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	switch (name){
+	case IEEE_PARAM_WPA_ENABLED:
+
+		padapter->securitypriv.dot11AuthAlgrthm= dot11AuthAlgrthm_8021X; //802.1x
+
+		//ret = ieee80211_wpa_enable(ieee, value);
+
+		switch((value)&0xff)
+		{
+			case 1 : //WPA
+			padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPAPSK; //WPA_PSK
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption2Enabled;
+				break;
+			case 2: //WPA2
+			padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPA2PSK; //WPA2_PSK
+			padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption3Enabled;
+				break;
+		}
+
+		RT_TRACE(_module_rtl871x_ioctl_os_c,_drv_info_,("wpa_set_param:padapter->securitypriv.ndisauthtype=%d\n", padapter->securitypriv.ndisauthtype));
+
+		break;
+
+	case IEEE_PARAM_TKIP_COUNTERMEASURES:
+		//ieee->tkip_countermeasures=value;
+		break;
+
+	case IEEE_PARAM_DROP_UNENCRYPTED:
+	{
+		/* HACK:
+		 *
+		 * wpa_supplicant calls set_wpa_enabled when the driver
+		 * is loaded and unloaded, regardless of if WPA is being
+		 * used.  No other calls are made which can be used to
+		 * determine if encryption will be used or not prior to
+		 * association being expected.  If encryption is not being
+		 * used, drop_unencrypted is set to false, else true -- we
+		 * can use this to determine if the CAP_PRIVACY_ON bit should
+		 * be set.
+		 */
+
+#if 0
+		struct ieee80211_security sec = {
+			.flags = SEC_ENABLED,
+			.enabled = value,
+		};
+		ieee->drop_unencrypted = value;
+		/* We only change SEC_LEVEL for open mode. Others
+		 * are set by ipw_wpa_set_encryption.
+		 */
+		if (!value) {
+			sec.flags |= SEC_LEVEL;
+			sec.level = SEC_LEVEL_0;
+		}
+		else {
+			sec.flags |= SEC_LEVEL;
+			sec.level = SEC_LEVEL_1;
+		}
+		if (ieee->set_security)
+			ieee->set_security(ieee->dev, &sec);
+#endif
+		break;
+
+	}
+	case IEEE_PARAM_PRIVACY_INVOKED:
+
+		//ieee->privacy_invoked=value;
+
+		break;
+
+	case IEEE_PARAM_AUTH_ALGS:
+
+		ret = wpa_set_auth_algs(dev, value);
+
+		break;
+
+	case IEEE_PARAM_IEEE_802_1X:
+
+		//ieee->ieee802_1x=value;
+
+		break;
+
+	case IEEE_PARAM_WPAX_SELECT:
+
+		// added for WPA2 mixed mode
+		//DBG_871X(KERN_WARNING "------------------------>wpax value = %x\n", value);
+		/*
+		spin_lock_irqsave(&ieee->wpax_suitlist_lock,flags);
+		ieee->wpax_type_set = 1;
+		ieee->wpax_type_notify = value;
+		spin_unlock_irqrestore(&ieee->wpax_suitlist_lock,flags);
+		*/
+
+		break;
+
+	default:
+
+
+
+		ret = -EOPNOTSUPP;
+
+
+		break;
+
+	}
+
+	return ret;
+
+}
+
+static int wpa_mlme(struct net_device *dev, u32 command, u32 reason)
+{
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	switch (command)
+	{
+		case IEEE_MLME_STA_DEAUTH:
+
+			if(!rtw_set_802_11_disassociate(padapter))
+				ret = -1;
+
+			break;
+
+		case IEEE_MLME_STA_DISASSOC:
+
+			if(!rtw_set_802_11_disassociate(padapter))
+				ret = -1;
+
+			break;
+
+		default:
+			ret = -EOPNOTSUPP;
+			break;
+	}
+
+	return ret;
+
+}
+
+static int wpa_supplicant_ioctl(struct net_device *dev, struct iw_point *p)
+{
+	struct ieee_param *param;
+	uint ret=0;
+
+	//down(&ieee->wx_sem);
+
+	if (p->length < sizeof(struct ieee_param) || !p->pointer){
+		ret = -EINVAL;
+		goto out;
+	}
+
+	param = (struct ieee_param *)rtw_malloc(p->length);
+	if (param == NULL)
+	{
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	if (copy_from_user(param, p->pointer, p->length))
+	{
+		rtw_mfree((u8*)param, p->length);
+		ret = -EFAULT;
+		goto out;
+	}
+
+	switch (param->cmd) {
+
+	case IEEE_CMD_SET_WPA_PARAM:
+		ret = wpa_set_param(dev, param->u.wpa_param.name, param->u.wpa_param.value);
+		break;
+
+	case IEEE_CMD_SET_WPA_IE:
+		//ret = wpa_set_wpa_ie(dev, param, p->length);
+		ret =  rtw_set_wpa_ie((_adapter *)rtw_netdev_priv(dev), (char*)param->u.wpa_ie.data, (u16)param->u.wpa_ie.len);
+		break;
+
+	case IEEE_CMD_SET_ENCRYPTION:
+		ret = wpa_set_encryption(dev, param, p->length);
+		break;
+
+	case IEEE_CMD_MLME:
+		ret = wpa_mlme(dev, param->u.mlme.command, param->u.mlme.reason_code);
+		break;
+
+	default:
+		DBG_871X("Unknown WPA supplicant request: %d\n", param->cmd);
+		ret = -EOPNOTSUPP;
+		break;
+
+	}
+
+	if (ret == 0 && copy_to_user(p->pointer, param, p->length))
+		ret = -EFAULT;
+
+	rtw_mfree((u8 *)param, p->length);
+
+out:
+
+	//up(&ieee->wx_sem);
+
+	return ret;
+
+}
+
+#ifdef CONFIG_AP_MODE
+static u8 set_pairwise_key(_adapter *padapter, struct sta_info *psta)
+{
+	struct cmd_obj*			ph2c;
+	struct set_stakey_parm	*psetstakey_para;
+	struct cmd_priv 			*pcmdpriv=&padapter->cmdpriv;
+	u8	res=_SUCCESS;
+
+	ph2c = (struct cmd_obj*)rtw_zmalloc(sizeof(struct cmd_obj));
+	if ( ph2c == NULL){
+		res= _FAIL;
+		goto exit;
+	}
+
+	psetstakey_para = (struct set_stakey_parm*)rtw_zmalloc(sizeof(struct set_stakey_parm));
+	if(psetstakey_para==NULL){
+		rtw_mfree((u8 *) ph2c, sizeof(struct cmd_obj));
+		res=_FAIL;
+		goto exit;
+	}
+
+	init_h2fwcmd_w_parm_no_rsp(ph2c, psetstakey_para, _SetStaKey_CMD_);
+
+
+	psetstakey_para->algorithm = (u8)psta->dot118021XPrivacy;
+
+	_rtw_memcpy(psetstakey_para->addr, psta->hwaddr, ETH_ALEN);
+
+	_rtw_memcpy(psetstakey_para->key, &psta->dot118021x_UncstKey, 16);
+
+
+	res = rtw_enqueue_cmd(pcmdpriv, ph2c);
+
+exit:
+
+	return res;
+
+}
+
+static int set_group_key(_adapter *padapter, u8 *key, u8 alg, int keyid)
+{
+	u8 keylen;
+	struct cmd_obj* pcmd;
+	struct setkey_parm *psetkeyparm;
+	struct cmd_priv	*pcmdpriv=&(padapter->cmdpriv);
+	int res=_SUCCESS;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	pcmd = (struct cmd_obj*)rtw_zmalloc(sizeof(struct	cmd_obj));
+	if(pcmd==NULL){
+		res= _FAIL;
+		goto exit;
+	}
+	psetkeyparm=(struct setkey_parm*)rtw_zmalloc(sizeof(struct setkey_parm));
+	if(psetkeyparm==NULL){
+		rtw_mfree((unsigned char *)pcmd, sizeof(struct cmd_obj));
+		res= _FAIL;
+		goto exit;
+	}
+
+	_rtw_memset(psetkeyparm, 0, sizeof(struct setkey_parm));
+
+	psetkeyparm->keyid=(u8)keyid;
+	if (is_wep_enc(alg))
+		padapter->securitypriv.key_mask |= BIT(psetkeyparm->keyid);
+
+	psetkeyparm->algorithm = alg;
+
+	psetkeyparm->set_tx = 1;
+
+	switch(alg)
+	{
+		case _WEP40_:
+			keylen = 5;
+			break;
+		case _WEP104_:
+			keylen = 13;
+			break;
+		case _TKIP_:
+		case _TKIP_WTMIC_:
+		case _AES_:
+			keylen = 16;
+			break;
+		default:
+			keylen = 16;
+	}
+
+	_rtw_memcpy(&(psetkeyparm->key[0]), key, keylen);
+
+	pcmd->cmdcode = _SetKey_CMD_;
+	pcmd->parmbuf = (u8 *)psetkeyparm;
+	pcmd->cmdsz =  (sizeof(struct setkey_parm));
+	pcmd->rsp = NULL;
+	pcmd->rspsz = 0;
+
+
+	_rtw_init_listhead(&pcmd->list);
+
+	res = rtw_enqueue_cmd(pcmdpriv, pcmd);
+
+exit:
+
+	return res;
+
+
+}
+
+static int set_wep_key(_adapter *padapter, u8 *key, u8 keylen, int keyid)
+{
+	u8 alg;
+
+	switch(keylen)
+	{
+		case 5:
+			alg =_WEP40_;
+			break;
+		case 13:
+			alg =_WEP104_;
+			break;
+		default:
+			alg =_NO_PRIVACY_;
+	}
+
+	return set_group_key(padapter, key, alg, keyid);
+
+}
+
+
+static int rtw_set_encryption(struct net_device *dev, struct ieee_param *param, u32 param_len)
+{
+	int ret = 0;
+	u32 wep_key_idx, wep_key_len,wep_total_len;
+	NDIS_802_11_WEP	 *pwep = NULL;
+	struct sta_info *psta = NULL, *pbcmc_sta = NULL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv 	*pmlmepriv = &padapter->mlmepriv;
+	struct security_priv* psecuritypriv=&(padapter->securitypriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	param->u.crypt.err = 0;
+	param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN - 1] = '\0';
+
+	//sizeof(struct ieee_param) = 64 bytes;
+	//if (param_len !=  (u32) ((u8 *) param->u.crypt.key - (u8 *) param) + param->u.crypt.key_len)
+	if (param_len !=  sizeof(struct ieee_param) + param->u.crypt.key_len)
+	{
+		ret =  -EINVAL;
+		goto exit;
+	}
+
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff)
+	{
+		if (param->u.crypt.idx >= WEP_KEYS)
+		{
+			ret = -EINVAL;
+			goto exit;
+		}
+	}
+	else
+	{
+		psta = rtw_get_stainfo(pstapriv, param->sta_addr);
+		if(!psta)
+		{
+			//ret = -EINVAL;
+			DBG_871X("rtw_set_encryption(), sta has already been removed or never been added\n");
+			goto exit;
+		}
+	}
+
+	if (strcmp(param->u.crypt.alg, "none") == 0 && (psta==NULL))
+	{
+		//todo:clear default encryption keys
+
+		DBG_871X("clear default encryption keys, keyid=%d\n", param->u.crypt.idx);
+
+		goto exit;
+	}
+
+
+	if (strcmp(param->u.crypt.alg, "WEP") == 0 && (psta==NULL))
+	{
+		DBG_871X("r871x_set_encryption, crypt.alg = WEP\n");
+
+		wep_key_idx = param->u.crypt.idx;
+		wep_key_len = param->u.crypt.key_len;
+
+		DBG_871X("r871x_set_encryption, wep_key_idx=%d, len=%d\n", wep_key_idx, wep_key_len);
+
+		if((wep_key_idx >= WEP_KEYS) || (wep_key_len<=0))
+		{
+			ret = -EINVAL;
+			goto exit;
+		}
+
+
+		if (wep_key_len > 0)
+		{
+			wep_key_len = wep_key_len <= 5 ? 5 : 13;
+			wep_total_len = wep_key_len + FIELD_OFFSET(NDIS_802_11_WEP, KeyMaterial);
+			pwep =(NDIS_802_11_WEP *)rtw_malloc(wep_total_len);
+			if(pwep == NULL){
+				DBG_871X(" r871x_set_encryption: pwep allocate fail !!!\n");
+				goto exit;
+			}
+
+			_rtw_memset(pwep, 0, wep_total_len);
+
+			pwep->KeyLength = wep_key_len;
+			pwep->Length = wep_total_len;
+
+		}
+
+		pwep->KeyIndex = wep_key_idx;
+
+		_rtw_memcpy(pwep->KeyMaterial,  param->u.crypt.key, pwep->KeyLength);
+
+		if(param->u.crypt.set_tx)
+		{
+			DBG_871X("wep, set_tx=1\n");
+
+			psecuritypriv->ndisencryptstatus = Ndis802_11Encryption1Enabled;
+			psecuritypriv->dot11PrivacyAlgrthm=_WEP40_;
+			psecuritypriv->dot118021XGrpPrivacy=_WEP40_;
+
+			if(pwep->KeyLength==13)
+			{
+				psecuritypriv->dot11PrivacyAlgrthm=_WEP104_;
+				psecuritypriv->dot118021XGrpPrivacy=_WEP104_;
+			}
+
+
+			psecuritypriv->dot11PrivacyKeyIndex = wep_key_idx;
+
+			_rtw_memcpy(&(psecuritypriv->dot11DefKey[wep_key_idx].skey[0]), pwep->KeyMaterial, pwep->KeyLength);
+
+			psecuritypriv->dot11DefKeylen[wep_key_idx]=pwep->KeyLength;
+
+			set_wep_key(padapter, pwep->KeyMaterial, pwep->KeyLength, wep_key_idx);
+
+
+		}
+		else
+		{
+			DBG_871X("wep, set_tx=0\n");
+
+			//don't update "psecuritypriv->dot11PrivacyAlgrthm" and
+			//"psecuritypriv->dot11PrivacyKeyIndex=keyid", but can rtw_set_key to cam
+
+		      _rtw_memcpy(&(psecuritypriv->dot11DefKey[wep_key_idx].skey[0]), pwep->KeyMaterial, pwep->KeyLength);
+
+			psecuritypriv->dot11DefKeylen[wep_key_idx] = pwep->KeyLength;
+
+			set_wep_key(padapter, pwep->KeyMaterial, pwep->KeyLength, wep_key_idx);
+
+		}
+
+		goto exit;
+
+	}
+
+
+	if(!psta && check_fwstate(pmlmepriv, WIFI_AP_STATE)) // //group key
+	{
+		if(param->u.crypt.set_tx ==1)
+		{
+			if(strcmp(param->u.crypt.alg, "WEP") == 0)
+			{
+				DBG_871X("%s, set group_key, WEP\n", __FUNCTION__);
+
+				_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+
+				psecuritypriv->dot118021XGrpPrivacy = _WEP40_;
+				if(param->u.crypt.key_len==13)
+				{
+						psecuritypriv->dot118021XGrpPrivacy = _WEP104_;
+				}
+
+			}
+			else if(strcmp(param->u.crypt.alg, "TKIP") == 0)
+			{
+				DBG_871X("%s, set group_key, TKIP\n", __FUNCTION__);
+
+				psecuritypriv->dot118021XGrpPrivacy = _TKIP_;
+
+				_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+
+				//DEBUG_ERR("set key length :param->u.crypt.key_len=%d\n", param->u.crypt.key_len);
+				//set mic key
+				_rtw_memcpy(psecuritypriv->dot118021XGrptxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[16]), 8);
+				_rtw_memcpy(psecuritypriv->dot118021XGrprxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[24]), 8);
+
+				psecuritypriv->busetkipkey = _TRUE;
+
+			}
+			else if(strcmp(param->u.crypt.alg, "CCMP") == 0)
+			{
+				DBG_871X("%s, set group_key, CCMP\n", __FUNCTION__);
+
+				psecuritypriv->dot118021XGrpPrivacy = _AES_;
+
+				_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+			}
+			else
+			{
+				DBG_871X("%s, set group_key, none\n", __FUNCTION__);
+
+				psecuritypriv->dot118021XGrpPrivacy = _NO_PRIVACY_;
+			}
+
+			psecuritypriv->dot118021XGrpKeyid = param->u.crypt.idx;
+
+			psecuritypriv->binstallGrpkey = _TRUE;
+
+			psecuritypriv->dot11PrivacyAlgrthm = psecuritypriv->dot118021XGrpPrivacy;//!!!
+
+			set_group_key(padapter, param->u.crypt.key, psecuritypriv->dot118021XGrpPrivacy, param->u.crypt.idx);
+
+			pbcmc_sta=rtw_get_bcmc_stainfo(padapter);
+			if(pbcmc_sta)
+			{
+				pbcmc_sta->ieee8021x_blocked = _FALSE;
+				pbcmc_sta->dot118021XPrivacy= psecuritypriv->dot118021XGrpPrivacy;//rx will use bmc_sta's dot118021XPrivacy
+			}
+
+		}
+
+		goto exit;
+
+	}
+
+	if(psecuritypriv->dot11AuthAlgrthm == dot11AuthAlgrthm_8021X && psta) // psk/802_1x
+	{
+		if(check_fwstate(pmlmepriv, WIFI_AP_STATE))
+		{
+			if(param->u.crypt.set_tx ==1)
+			{
+				_rtw_memcpy(psta->dot118021x_UncstKey.skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+
+				if(strcmp(param->u.crypt.alg, "WEP") == 0)
+				{
+					DBG_871X("%s, set pairwise key, WEP\n", __FUNCTION__);
+
+					psta->dot118021XPrivacy = _WEP40_;
+					if(param->u.crypt.key_len==13)
+					{
+						psta->dot118021XPrivacy = _WEP104_;
+					}
+				}
+				else if(strcmp(param->u.crypt.alg, "TKIP") == 0)
+				{
+					DBG_871X("%s, set pairwise key, TKIP\n", __FUNCTION__);
+
+					psta->dot118021XPrivacy = _TKIP_;
+
+					//DEBUG_ERR("set key length :param->u.crypt.key_len=%d\n", param->u.crypt.key_len);
+					//set mic key
+					_rtw_memcpy(psta->dot11tkiptxmickey.skey, &(param->u.crypt.key[16]), 8);
+					_rtw_memcpy(psta->dot11tkiprxmickey.skey, &(param->u.crypt.key[24]), 8);
+
+					psecuritypriv->busetkipkey = _TRUE;
+
+				}
+				else if(strcmp(param->u.crypt.alg, "CCMP") == 0)
+				{
+
+					DBG_871X("%s, set pairwise key, CCMP\n", __FUNCTION__);
+
+					psta->dot118021XPrivacy = _AES_;
+				}
+				else
+				{
+					DBG_871X("%s, set pairwise key, none\n", __FUNCTION__);
+
+					psta->dot118021XPrivacy = _NO_PRIVACY_;
+				}
+
+				set_pairwise_key(padapter, psta);
+
+				psta->ieee8021x_blocked = _FALSE;
+
+			}
+			else//group key???
+			{
+				if(strcmp(param->u.crypt.alg, "WEP") == 0)
+				{
+					_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+
+					psecuritypriv->dot118021XGrpPrivacy = _WEP40_;
+					if(param->u.crypt.key_len==13)
+					{
+						psecuritypriv->dot118021XGrpPrivacy = _WEP104_;
+					}
+				}
+				else if(strcmp(param->u.crypt.alg, "TKIP") == 0)
+				{
+					psecuritypriv->dot118021XGrpPrivacy = _TKIP_;
+
+					_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+
+					//DEBUG_ERR("set key length :param->u.crypt.key_len=%d\n", param->u.crypt.key_len);
+					//set mic key
+					_rtw_memcpy(psecuritypriv->dot118021XGrptxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[16]), 8);
+					_rtw_memcpy(psecuritypriv->dot118021XGrprxmickey[param->u.crypt.idx].skey, &(param->u.crypt.key[24]), 8);
+
+					psecuritypriv->busetkipkey = _TRUE;
+
+				}
+				else if(strcmp(param->u.crypt.alg, "CCMP") == 0)
+				{
+					psecuritypriv->dot118021XGrpPrivacy = _AES_;
+
+					_rtw_memcpy(psecuritypriv->dot118021XGrpKey[param->u.crypt.idx].skey,  param->u.crypt.key, (param->u.crypt.key_len>16 ?16:param->u.crypt.key_len));
+				}
+				else
+				{
+					psecuritypriv->dot118021XGrpPrivacy = _NO_PRIVACY_;
+				}
+
+				psecuritypriv->dot118021XGrpKeyid = param->u.crypt.idx;
+
+				psecuritypriv->binstallGrpkey = _TRUE;
+
+				psecuritypriv->dot11PrivacyAlgrthm = psecuritypriv->dot118021XGrpPrivacy;//!!!
+
+				set_group_key(padapter, param->u.crypt.key, psecuritypriv->dot118021XGrpPrivacy, param->u.crypt.idx);
+
+				pbcmc_sta=rtw_get_bcmc_stainfo(padapter);
+				if(pbcmc_sta)
+				{
+					pbcmc_sta->ieee8021x_blocked = _FALSE;
+					pbcmc_sta->dot118021XPrivacy= psecuritypriv->dot118021XGrpPrivacy;//rx will use bmc_sta's dot118021XPrivacy
+				}
+
+			}
+
+		}
+
+	}
+
+exit:
+
+	if(pwep)
+	{
+		rtw_mfree((u8 *)pwep,wep_total_len);
+	}
+
+	return ret;
+
+}
+
+static int rtw_set_beacon(struct net_device *dev, struct ieee_param *param, int len)
+{
+	int ret=0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	unsigned char *pbuf = param->u.bcn_ie.buf;
+
+
+	DBG_871X("%s, len=%d\n", __FUNCTION__, len);
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EINVAL;
+
+	_rtw_memcpy(&pstapriv->max_num_sta, param->u.bcn_ie.reserved, 2);
+
+	if((pstapriv->max_num_sta>NUM_STA) || (pstapriv->max_num_sta<=0))
+		pstapriv->max_num_sta = NUM_STA;
+
+
+	if(rtw_check_beacon_data(padapter, pbuf,  (len-12-2)) == _SUCCESS)// 12 = param header, 2:no packed
+		ret = 0;
+	else
+		ret = -EINVAL;
+
+
+	return ret;
+
+}
+
+static int rtw_hostapd_sta_flush(struct net_device *dev)
+{
+	//_irqL irqL;
+	//_list	*phead, *plist;
+	int ret=0;
+	//struct sta_info *psta = NULL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	//struct sta_priv *pstapriv = &padapter->stapriv;
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	flush_all_cam_entry(padapter);	//clear CAM
+
+	ret = rtw_sta_flush(padapter);
+
+	return ret;
+
+}
+
+static int rtw_add_sta(struct net_device *dev, struct ieee_param *param)
+{
+	_irqL irqL;
+	int ret=0;
+	struct sta_info *psta = NULL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	DBG_871X("rtw_add_sta(aid=%d)=" MAC_FMT "\n", param->u.add_sta.aid, MAC_ARG(param->sta_addr));
+
+	if(check_fwstate(pmlmepriv, (_FW_LINKED|WIFI_AP_STATE)) != _TRUE)
+	{
+		return -EINVAL;
+	}
+
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff)
+	{
+		return -EINVAL;
+	}
+
+/*
+	psta = rtw_get_stainfo(pstapriv, param->sta_addr);
+	if(psta)
+	{
+		DBG_871X("rtw_add_sta(), free has been added psta=%p\n", psta);
+		_enter_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+		rtw_free_stainfo(padapter,  psta);
+		_exit_critical_bh(&(pstapriv->sta_hash_lock), &irqL);
+
+		psta = NULL;
+	}
+*/
+	//psta = rtw_alloc_stainfo(pstapriv, param->sta_addr);
+	psta = rtw_get_stainfo(pstapriv, param->sta_addr);
+	if(psta)
+	{
+		int flags = param->u.add_sta.flags;
+
+		//DBG_871X("rtw_add_sta(), init sta's variables, psta=%p\n", psta);
+
+		psta->aid = param->u.add_sta.aid;//aid=1~2007
+
+		_rtw_memcpy(psta->bssrateset, param->u.add_sta.tx_supp_rates, 16);
+
+
+		//check wmm cap.
+		if(WLAN_STA_WME&flags)
+			psta->qos_option = 1;
+		else
+			psta->qos_option = 0;
+
+		if(pmlmepriv->qospriv.qos_option == 0)
+			psta->qos_option = 0;
+
+
+#ifdef CONFIG_80211N_HT
+		//chec 802.11n ht cap.
+		if(WLAN_STA_HT&flags)
+		{
+			psta->htpriv.ht_option = _TRUE;
+			psta->qos_option = 1;
+			_rtw_memcpy((void*)&psta->htpriv.ht_cap, (void*)&param->u.add_sta.ht_cap, sizeof(struct rtw_ieee80211_ht_cap));
+		}
+		else
+		{
+			psta->htpriv.ht_option = _FALSE;
+		}
+
+		if(pmlmepriv->htpriv.ht_option == _FALSE)
+			psta->htpriv.ht_option = _FALSE;
+#endif
+
+
+		update_sta_info_apmode(padapter, psta);
+
+
+	}
+	else
+	{
+		ret = -ENOMEM;
+	}
+
+	return ret;
+
+}
+
+static int rtw_del_sta(struct net_device *dev, struct ieee_param *param)
+{
+	_irqL irqL;
+	int ret=0;
+	struct sta_info *psta = NULL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	DBG_871X("rtw_del_sta=" MAC_FMT "\n", MAC_ARG(param->sta_addr));
+
+	if(check_fwstate(pmlmepriv, (_FW_LINKED|WIFI_AP_STATE)) != _TRUE)
+	{
+		return -EINVAL;
+	}
+
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff)
+	{
+		return -EINVAL;
+	}
+
+	psta = rtw_get_stainfo(pstapriv, param->sta_addr);
+	if(psta)
+	{
+		u8 updated=_FALSE;
+
+		//DBG_871X("free psta=%p, aid=%d\n", psta, psta->aid);
+
+		_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+		if(rtw_is_list_empty(&psta->asoc_list)==_FALSE)
+		{
+			rtw_list_delete(&psta->asoc_list);
+			pstapriv->asoc_list_cnt--;
+			updated = ap_free_sta(padapter, psta, _TRUE, WLAN_REASON_DEAUTH_LEAVING);
+
+		}
+		_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+		associated_clients_update(padapter, updated);
+
+		psta = NULL;
+
+	}
+	else
+	{
+		DBG_871X("rtw_del_sta(), sta has already been removed or never been added\n");
+
+		//ret = -1;
+	}
+
+
+	return ret;
+
+}
+
+static int rtw_ioctl_get_sta_data(struct net_device *dev, struct ieee_param *param, int len)
+{
+	int ret=0;
+	struct sta_info *psta = NULL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+	struct ieee_param_ex *param_ex = (struct ieee_param_ex *)param;
+	struct sta_data *psta_data = (struct sta_data *)param_ex->data;
+
+	DBG_871X("rtw_ioctl_get_sta_info, sta_addr: " MAC_FMT "\n", MAC_ARG(param_ex->sta_addr));
+
+	if(check_fwstate(pmlmepriv, (_FW_LINKED|WIFI_AP_STATE)) != _TRUE)
+	{
+		return -EINVAL;
+	}
+
+	if (param_ex->sta_addr[0] == 0xff && param_ex->sta_addr[1] == 0xff &&
+	    param_ex->sta_addr[2] == 0xff && param_ex->sta_addr[3] == 0xff &&
+	    param_ex->sta_addr[4] == 0xff && param_ex->sta_addr[5] == 0xff)
+	{
+		return -EINVAL;
+	}
+
+	psta = rtw_get_stainfo(pstapriv, param_ex->sta_addr);
+	if(psta)
+	{
+#if 0
+		struct {
+			u16 aid;
+			u16 capability;
+			int flags;
+			u32 sta_set;
+			u8 tx_supp_rates[16];
+			u32 tx_supp_rates_len;
+			struct rtw_ieee80211_ht_cap ht_cap;
+			u64	rx_pkts;
+			u64	rx_bytes;
+			u64	rx_drops;
+			u64	tx_pkts;
+			u64	tx_bytes;
+			u64	tx_drops;
+		} get_sta;
+#endif
+		psta_data->aid = (u16)psta->aid;
+		psta_data->capability = psta->capability;
+		psta_data->flags = psta->flags;
+
+/*
+		nonerp_set : BIT(0)
+		no_short_slot_time_set : BIT(1)
+		no_short_preamble_set : BIT(2)
+		no_ht_gf_set : BIT(3)
+		no_ht_set : BIT(4)
+		ht_20mhz_set : BIT(5)
+*/
+
+		psta_data->sta_set =((psta->nonerp_set) |
+							(psta->no_short_slot_time_set <<1) |
+							(psta->no_short_preamble_set <<2) |
+							(psta->no_ht_gf_set <<3) |
+							(psta->no_ht_set <<4) |
+							(psta->ht_20mhz_set <<5));
+
+		psta_data->tx_supp_rates_len =  psta->bssratelen;
+		_rtw_memcpy(psta_data->tx_supp_rates, psta->bssrateset, psta->bssratelen);
+
+		_rtw_memcpy(&psta_data->ht_cap, &psta->htpriv.ht_cap, sizeof(struct rtw_ieee80211_ht_cap));
+
+		psta_data->rx_pkts = psta->sta_stats.rx_data_pkts;
+		psta_data->rx_bytes = psta->sta_stats.rx_bytes;
+		psta_data->rx_drops = psta->sta_stats.rx_drops;
+
+		psta_data->tx_pkts = psta->sta_stats.tx_pkts;
+		psta_data->tx_bytes = psta->sta_stats.tx_bytes;
+		psta_data->tx_drops = psta->sta_stats.tx_drops;
+
+
+	}
+	else
+	{
+		ret = -1;
+	}
+
+	return ret;
+
+}
+
+static int rtw_get_sta_wpaie(struct net_device *dev, struct ieee_param *param)
+{
+	int ret=0;
+	struct sta_info *psta = NULL;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	DBG_871X("rtw_get_sta_wpaie, sta_addr: " MAC_FMT "\n", MAC_ARG(param->sta_addr));
+
+	if(check_fwstate(pmlmepriv, (_FW_LINKED|WIFI_AP_STATE)) != _TRUE)
+	{
+		return -EINVAL;
+	}
+
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff)
+	{
+		return -EINVAL;
+	}
+
+	psta = rtw_get_stainfo(pstapriv, param->sta_addr);
+	if(psta)
+	{
+		if((psta->wpa_ie[0] == WLAN_EID_RSN) || (psta->wpa_ie[0] == WLAN_EID_GENERIC))
+		{
+			int wpa_ie_len;
+			int copy_len;
+
+			wpa_ie_len = psta->wpa_ie[1];
+
+			copy_len = ((wpa_ie_len+2) > sizeof(psta->wpa_ie)) ? (sizeof(psta->wpa_ie)):(wpa_ie_len+2);
+
+			param->u.wpa_ie.len = copy_len;
+
+			_rtw_memcpy(param->u.wpa_ie.reserved, psta->wpa_ie, copy_len);
+		}
+		else
+		{
+			//ret = -1;
+			DBG_871X("sta's wpa_ie is NONE\n");
+		}
+	}
+	else
+	{
+		ret = -1;
+	}
+
+	return ret;
+
+}
+
+static int rtw_set_wps_beacon(struct net_device *dev, struct ieee_param *param, int len)
+{
+	int ret=0;
+	unsigned char wps_oui[4]={0x0,0x50,0xf2,0x04};
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	int ie_len;
+
+	DBG_871X("%s, len=%d\n", __FUNCTION__, len);
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EINVAL;
+
+	ie_len = len-12-2;// 12 = param header, 2:no packed
+
+
+	if(pmlmepriv->wps_beacon_ie)
+	{
+		rtw_mfree(pmlmepriv->wps_beacon_ie, pmlmepriv->wps_beacon_ie_len);
+		pmlmepriv->wps_beacon_ie = NULL;
+	}
+
+	if(ie_len>0)
+	{
+		pmlmepriv->wps_beacon_ie = rtw_malloc(ie_len);
+		pmlmepriv->wps_beacon_ie_len = ie_len;
+		if ( pmlmepriv->wps_beacon_ie == NULL) {
+			DBG_871X("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+			return -EINVAL;
+		}
+
+		_rtw_memcpy(pmlmepriv->wps_beacon_ie, param->u.bcn_ie.buf, ie_len);
+
+		update_beacon(padapter, _VENDOR_SPECIFIC_IE_, wps_oui, _TRUE);
+
+		pmlmeext->bstart_bss = _TRUE;
+
+	}
+
+
+	return ret;
+
+}
+
+static int rtw_set_wps_probe_resp(struct net_device *dev, struct ieee_param *param, int len)
+{
+	int ret=0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	int ie_len;
+
+	DBG_871X("%s, len=%d\n", __FUNCTION__, len);
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EINVAL;
+
+	ie_len = len-12-2;// 12 = param header, 2:no packed
+
+
+	if(pmlmepriv->wps_probe_resp_ie)
+	{
+		rtw_mfree(pmlmepriv->wps_probe_resp_ie, pmlmepriv->wps_probe_resp_ie_len);
+		pmlmepriv->wps_probe_resp_ie = NULL;
+	}
+
+	if(ie_len>0)
+	{
+		pmlmepriv->wps_probe_resp_ie = rtw_malloc(ie_len);
+		pmlmepriv->wps_probe_resp_ie_len = ie_len;
+		if ( pmlmepriv->wps_probe_resp_ie == NULL) {
+			DBG_871X("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+			return -EINVAL;
+		}
+		_rtw_memcpy(pmlmepriv->wps_probe_resp_ie, param->u.bcn_ie.buf, ie_len);
+	}
+
+
+	return ret;
+
+}
+
+static int rtw_set_wps_assoc_resp(struct net_device *dev, struct ieee_param *param, int len)
+{
+	int ret=0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+	int ie_len;
+
+	DBG_871X("%s, len=%d\n", __FUNCTION__, len);
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EINVAL;
+
+	ie_len = len-12-2;// 12 = param header, 2:no packed
+
+
+	if(pmlmepriv->wps_assoc_resp_ie)
+	{
+		rtw_mfree(pmlmepriv->wps_assoc_resp_ie, pmlmepriv->wps_assoc_resp_ie_len);
+		pmlmepriv->wps_assoc_resp_ie = NULL;
+	}
+
+	if(ie_len>0)
+	{
+		pmlmepriv->wps_assoc_resp_ie = rtw_malloc(ie_len);
+		pmlmepriv->wps_assoc_resp_ie_len = ie_len;
+		if ( pmlmepriv->wps_assoc_resp_ie == NULL) {
+			DBG_871X("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+			return -EINVAL;
+		}
+
+		_rtw_memcpy(pmlmepriv->wps_assoc_resp_ie, param->u.bcn_ie.buf, ie_len);
+	}
+
+
+	return ret;
+
+}
+
+static int rtw_set_hidden_ssid(struct net_device *dev, struct ieee_param *param, int len)
+{
+	int ret=0;
+	_adapter *adapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *mlmepriv = &(adapter->mlmepriv);
+	struct mlme_ext_priv	*mlmeext = &(adapter->mlmeextpriv);
+	struct mlme_ext_info	*mlmeinfo = &(mlmeext->mlmext_info);
+	int ie_len;
+	u8 *ssid_ie;
+	char ssid[NDIS_802_11_LENGTH_SSID + 1];
+	sint ssid_len;
+	u8 ignore_broadcast_ssid;
+
+	if(check_fwstate(mlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EPERM;
+
+	if (param->u.bcn_ie.reserved[0] != 0xea)
+		return -EINVAL;
+
+	mlmeinfo->hidden_ssid_mode = ignore_broadcast_ssid = param->u.bcn_ie.reserved[1];
+
+	ie_len = len-12-2;// 12 = param header, 2:no packed
+	ssid_ie = rtw_get_ie(param->u.bcn_ie.buf,  WLAN_EID_SSID, &ssid_len, ie_len);
+
+	if (ssid_ie && ssid_len) {
+		WLAN_BSSID_EX *pbss_network = &mlmepriv->cur_network.network;
+		WLAN_BSSID_EX *pbss_network_ext = &mlmeinfo->network;
+
+		_rtw_memcpy(ssid, ssid_ie+2, ssid_len);
+		ssid[ssid_len>NDIS_802_11_LENGTH_SSID?NDIS_802_11_LENGTH_SSID:ssid_len] = 0x0;
+
+		if(0)
+		DBG_871X(FUNC_ADPT_FMT" ssid:(%s,%d), from ie:(%s,%d), (%s,%d)\n", FUNC_ADPT_ARG(adapter),
+			ssid, ssid_len,
+			pbss_network->Ssid.Ssid, pbss_network->Ssid.SsidLength,
+			pbss_network_ext->Ssid.Ssid, pbss_network_ext->Ssid.SsidLength);
+
+		_rtw_memcpy(pbss_network->Ssid.Ssid, (void *)ssid, ssid_len);
+		pbss_network->Ssid.SsidLength = ssid_len;
+		_rtw_memcpy(pbss_network_ext->Ssid.Ssid, (void *)ssid, ssid_len);
+		pbss_network_ext->Ssid.SsidLength = ssid_len;
+
+		if(0)
+		DBG_871X(FUNC_ADPT_FMT" after ssid:(%s,%d), (%s,%d)\n", FUNC_ADPT_ARG(adapter),
+			pbss_network->Ssid.Ssid, pbss_network->Ssid.SsidLength,
+			pbss_network_ext->Ssid.Ssid, pbss_network_ext->Ssid.SsidLength);
+	}
+
+	DBG_871X(FUNC_ADPT_FMT" ignore_broadcast_ssid:%d, %s,%d\n", FUNC_ADPT_ARG(adapter),
+		ignore_broadcast_ssid, ssid, ssid_len);
+
+	return ret;
+}
+
+static int rtw_ioctl_acl_remove_sta(struct net_device *dev, struct ieee_param *param, int len)
+{
+	int ret=0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EINVAL;
+
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff)
+	{
+		return -EINVAL;
+	}
+
+	ret = rtw_acl_remove_sta(padapter, param->sta_addr);
+
+	return ret;
+
+}
+
+static int rtw_ioctl_acl_add_sta(struct net_device *dev, struct ieee_param *param, int len)
+{
+	int ret=0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EINVAL;
+
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff)
+	{
+		return -EINVAL;
+	}
+
+	ret = rtw_acl_add_sta(padapter, param->sta_addr);
+
+	return ret;
+
+}
+
+static int rtw_ioctl_set_macaddr_acl(struct net_device *dev, struct ieee_param *param, int len)
+{
+	int ret=0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) != _TRUE)
+		return -EINVAL;
+
+	rtw_set_macaddr_acl(padapter, param->u.mlme.command);
+
+	return ret;
+}
+
+static int rtw_hostapd_ioctl(struct net_device *dev, struct iw_point *p)
+{
+	struct ieee_param *param;
+	int ret=0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	/*
+	* this function is expect to call in master mode, which allows no power saving
+	* so, we just check hw_init_completed instead of call rfpwrstate_check()
+	*/
+
+	if (padapter->hw_init_completed==_FALSE){
+		ret = -EPERM;
+		goto out;
+	}
+
+
+	//if (p->length < sizeof(struct ieee_param) || !p->pointer){
+	if(!p->pointer){
+		ret = -EINVAL;
+		goto out;
+	}
+
+	param = (struct ieee_param *)rtw_malloc(p->length);
+	if (param == NULL)
+	{
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	if (copy_from_user(param, p->pointer, p->length))
+	{
+		rtw_mfree((u8*)param, p->length);
+		ret = -EFAULT;
+		goto out;
+	}
+
+	//DBG_871X("%s, cmd=%d\n", __FUNCTION__, param->cmd);
+
+	switch (param->cmd)
+	{
+		case RTL871X_HOSTAPD_FLUSH:
+
+			ret = rtw_hostapd_sta_flush(dev);
+
+			break;
+
+		case RTL871X_HOSTAPD_ADD_STA:
+
+			ret = rtw_add_sta(dev, param);
+
+			break;
+
+		case RTL871X_HOSTAPD_REMOVE_STA:
+
+			ret = rtw_del_sta(dev, param);
+
+			break;
+
+		case RTL871X_HOSTAPD_SET_BEACON:
+
+			ret = rtw_set_beacon(dev, param, p->length);
+
+			break;
+
+		case RTL871X_SET_ENCRYPTION:
+
+			ret = rtw_set_encryption(dev, param, p->length);
+
+			break;
+
+		case RTL871X_HOSTAPD_GET_WPAIE_STA:
+
+			ret = rtw_get_sta_wpaie(dev, param);
+
+			break;
+
+		case RTL871X_HOSTAPD_SET_WPS_BEACON:
+
+			ret = rtw_set_wps_beacon(dev, param, p->length);
+
+			break;
+
+		case RTL871X_HOSTAPD_SET_WPS_PROBE_RESP:
+
+			ret = rtw_set_wps_probe_resp(dev, param, p->length);
+
+			break;
+
+		case RTL871X_HOSTAPD_SET_WPS_ASSOC_RESP:
+
+			ret = rtw_set_wps_assoc_resp(dev, param, p->length);
+
+			break;
+
+		case RTL871X_HOSTAPD_SET_HIDDEN_SSID:
+
+			ret = rtw_set_hidden_ssid(dev, param, p->length);
+
+			break;
+
+		case RTL871X_HOSTAPD_GET_INFO_STA:
+
+			ret = rtw_ioctl_get_sta_data(dev, param, p->length);
+
+			break;
+
+		case RTL871X_HOSTAPD_SET_MACADDR_ACL:
+
+			ret = rtw_ioctl_set_macaddr_acl(dev, param, p->length);
+
+			break;
+
+		case RTL871X_HOSTAPD_ACL_ADD_STA:
+
+			ret = rtw_ioctl_acl_add_sta(dev, param, p->length);
+
+			break;
+
+		case RTL871X_HOSTAPD_ACL_REMOVE_STA:
+
+			ret = rtw_ioctl_acl_remove_sta(dev, param, p->length);
+
+			break;
+
+		default:
+			DBG_871X("Unknown hostapd request: %d\n", param->cmd);
+			ret = -EOPNOTSUPP;
+			break;
+
+	}
+
+	if (ret == 0 && copy_to_user(p->pointer, param, p->length))
+		ret = -EFAULT;
+
+
+	rtw_mfree((u8 *)param, p->length);
+
+out:
+
+	return ret;
+
+}
+#endif
+
+#include <rtw_android.h>
+static int rtw_wx_set_priv(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *awrq,
+				char *extra)
+{
+
+#ifdef CONFIG_DEBUG_RTW_WX_SET_PRIV
+	char *ext_dbg;
+#endif
+
+	int ret = 0;
+	int len = 0;
+	char *ext;
+	int i;
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct iw_point *dwrq = (struct iw_point*)awrq;
+
+	//RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_notice_, ("+rtw_wx_set_priv\n"));
+	if(dwrq->length == 0)
+		return -EFAULT;
+	len = dwrq->length;
+	if (!(ext = rtw_vmalloc(len)))
+		return -ENOMEM;
+
+	if (copy_from_user(ext, dwrq->pointer, len)) {
+		rtw_vmfree(ext, len);
+		return -EFAULT;
+	}
+
+
+	//RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_notice_,
+	//	 ("rtw_wx_set_priv: %s req=%s\n",
+	//	  dev->name, ext));
+
+	#ifdef CONFIG_DEBUG_RTW_WX_SET_PRIV
+	if (!(ext_dbg = rtw_vmalloc(len)))
+	{
+		rtw_vmfree(ext, len);
+		return -ENOMEM;
+	}
+
+	_rtw_memcpy(ext_dbg, ext, len);
+	#endif
+
+	//added for wps2.0 @20110524
+	if(dwrq->flags == 0x8766 && len > 8)
+	{
+		u32 cp_sz;
+		struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+		u8 *probereq_wpsie = ext;
+		int probereq_wpsie_len = len;
+		u8 wps_oui[4]={0x0,0x50,0xf2,0x04};
+
+		if((_VENDOR_SPECIFIC_IE_ == probereq_wpsie[0]) &&
+			(_rtw_memcmp(&probereq_wpsie[2], wps_oui, 4) ==_TRUE))
+		{
+			cp_sz = probereq_wpsie_len>MAX_WPS_IE_LEN ? MAX_WPS_IE_LEN:probereq_wpsie_len;
+
+			//_rtw_memcpy(pmlmepriv->probereq_wpsie, probereq_wpsie, cp_sz);
+			//pmlmepriv->probereq_wpsie_len = cp_sz;
+
+			printk("probe_req_wps_ielen=%d\n", cp_sz);
+
+			if(pmlmepriv->wps_probe_req_ie)
+			{
+				u32 free_len = pmlmepriv->wps_probe_req_ie_len;
+				pmlmepriv->wps_probe_req_ie_len = 0;
+				rtw_mfree(pmlmepriv->wps_probe_req_ie, free_len);
+				pmlmepriv->wps_probe_req_ie = NULL;
+			}
+
+			pmlmepriv->wps_probe_req_ie = rtw_malloc(cp_sz);
+			if ( pmlmepriv->wps_probe_req_ie == NULL) {
+				printk("%s()-%d: rtw_malloc() ERROR!\n", __FUNCTION__, __LINE__);
+				ret =  -EINVAL;
+				goto FREE_EXT;
+
+			}
+
+			_rtw_memcpy(pmlmepriv->wps_probe_req_ie, probereq_wpsie, cp_sz);
+			pmlmepriv->wps_probe_req_ie_len = cp_sz;
+
+		}
+
+		goto FREE_EXT;
+
+	}
+
+	if(	len >= WEXT_CSCAN_HEADER_SIZE
+		&& _rtw_memcmp(ext, WEXT_CSCAN_HEADER, WEXT_CSCAN_HEADER_SIZE) == _TRUE
+	){
+		ret = rtw_wx_set_scan(dev, info, awrq, ext);
+		goto FREE_EXT;
+	}
+
+#ifdef CONFIG_ANDROID
+	//DBG_871X("rtw_wx_set_priv: %s req=%s\n", dev->name, ext);
+
+	i = rtw_android_cmdstr_to_num(ext);
+
+	switch(i) {
+		case ANDROID_WIFI_CMD_START :
+			indicate_wx_custom_event(padapter, "START");
+			break;
+		case ANDROID_WIFI_CMD_STOP :
+			indicate_wx_custom_event(padapter, "STOP");
+			break;
+		case ANDROID_WIFI_CMD_RSSI :
+			{
+				struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+				struct	wlan_network	*pcur_network = &pmlmepriv->cur_network;
+
+				if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) {
+					sprintf(ext, "%s rssi %d", pcur_network->network.Ssid.Ssid, padapter->recvpriv.rssi);
+				} else {
+					sprintf(ext, "OK");
+				}
+			}
+			break;
+		case ANDROID_WIFI_CMD_LINKSPEED :
+			{
+				u16 mbps = rtw_get_cur_max_rate(padapter)/10;
+				sprintf(ext, "LINKSPEED %d", mbps);
+			}
+			break;
+		case ANDROID_WIFI_CMD_MACADDR :
+			sprintf(ext, "MACADDR = " MAC_FMT, MAC_ARG(dev->dev_addr));
+			break;
+		case ANDROID_WIFI_CMD_SCAN_ACTIVE :
+			{
+				//rtw_set_scan_mode(padapter, SCAN_ACTIVE);
+				sprintf(ext, "OK");
+			}
+			break;
+		case ANDROID_WIFI_CMD_SCAN_PASSIVE :
+			{
+				//rtw_set_scan_mode(padapter, SCAN_PASSIVE);
+				sprintf(ext, "OK");
+			}
+			break;
+
+		case ANDROID_WIFI_CMD_COUNTRY :
+			{
+				char country_code[10];
+				sscanf(ext, "%*s %s", country_code);
+				rtw_set_country(padapter, country_code);
+				sprintf(ext, "OK");
+			}
+			break;
+		default :
+			#ifdef  CONFIG_DEBUG_RTW_WX_SET_PRIV
+			DBG_871X("%s: %s unknowned req=%s\n", __FUNCTION__,
+				dev->name, ext_dbg);
+			#endif
+
+			sprintf(ext, "OK");
+
+	}
+
+	if (copy_to_user(dwrq->pointer, ext, min(dwrq->length, (u16)(strlen(ext)+1)) ) )
+		ret = -EFAULT;
+
+	#ifdef CONFIG_DEBUG_RTW_WX_SET_PRIV
+	DBG_871X("%s: %s req=%s rep=%s dwrq->length=%d, strlen(ext)+1=%d\n", __FUNCTION__,
+		dev->name, ext_dbg ,ext, dwrq->length, (u16)(strlen(ext)+1));
+	#endif
+#endif //end of CONFIG_ANDROID
+
+
+FREE_EXT:
+
+	rtw_vmfree(ext, len);
+	#ifdef CONFIG_DEBUG_RTW_WX_SET_PRIV
+	rtw_vmfree(ext_dbg, len);
+	#endif
+
+	//DBG_871X("rtw_wx_set_priv: (SIOCSIWPRIV) %s ret=%d\n",
+	//		dev->name, ret);
+
+	return ret;
+
+}
+
+static int rtw_mp_efuse_get(struct net_device *dev,
+			struct iw_request_info *info,
+			union iwreq_data *wdata, char *extra)
+{
+	struct iw_point *wrqu = (struct iw_point *)wdata;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	struct mp_priv *pmp_priv;
+
+	int i,j =0;
+	u8 data[EFUSE_MAP_SIZE];
+	u8 rawdata[EFUSE_MAX_SIZE];
+	u16 mapLen=0;
+	char *pch, *ptmp, *token, *tmp[3]={0x00,0x00,0x00};
+	u16 addr = 0, cnts = 0, max_available_size = 0,raw_cursize = 0 ,raw_maxsize = 0;
+
+	_rtw_memset(data, '\0', sizeof(data));
+	_rtw_memset(rawdata, '\0', sizeof(rawdata));
+
+	if (copy_from_user(extra, wrqu->pointer, wrqu->length))
+		return -EFAULT;
+
+	pch = extra;
+	DBG_871X("%s: in=%s\n", __func__, extra);
+
+	i=0;
+	//mac 16 "00e04c871200" rmap,00,2
+	while ( (token = strsep (&pch,",") )!=NULL )
+	{
+			if(i>2) break;
+			tmp[i] = token;
+			i++;
+	}
+
+	if ( strcmp(tmp[0],"realmap") == 0 ) {
+
+		DBG_871X("strcmp OK =	%s \n" ,tmp[0]);
+
+		mapLen = EFUSE_MAP_SIZE;
+
+		if (rtw_efuse_map_read(padapter, 0, mapLen, data) == _SUCCESS){
+			DBG_871X("\t  rtw_efuse_map_read \n");
+		}else {
+			DBG_871X("\t  rtw_efuse_map_read : Fail \n");
+			return -EFAULT;
+		}
+		_rtw_memset(extra, '\0', sizeof(extra));
+		DBG_871X("\tOFFSET\tVALUE(hex)\n");
+		sprintf(extra, "%s \n", extra);
+		for ( i = 0; i < EFUSE_MAP_SIZE; i += 16 )
+		{
+			DBG_871X("\t0x%02x\t", i);
+			sprintf(extra, "%s \t0x%02x\t", extra,i);
+			for (j = 0; j < 8; j++)
+			{
+				DBG_871X("%02X ", data[i+j]);
+				sprintf(extra, "%s %02X", extra, data[i+j]);
+			}
+			DBG_871X("\t");
+			sprintf(extra,"%s\t",extra);
+			for (; j < 16; j++){
+				DBG_871X("%02X ", data[i+j]);
+				sprintf(extra, "%s %02X", extra, data[i+j]);
+			}
+			DBG_871X("\n");
+			sprintf(extra,"%s\n",extra);
+		}
+		DBG_871X("\n");
+		wrqu->length = strlen(extra);
+
+		return 0;
+	}
+	else if ( strcmp(tmp[0],"rmap") == 0 ) {
+		if ( tmp[1]==NULL || tmp[2]==NULL ) return	-EINVAL;
+		// rmap addr cnts
+		addr = simple_strtoul(tmp[1], &ptmp, 16);
+
+		DBG_871X("addr = %x \n" ,addr);
+
+		cnts=simple_strtoul(tmp[2], &ptmp,10);
+		if(cnts==0) return -EINVAL;
+
+		DBG_871X("cnts = %d \n" ,cnts);
+		//_rtw_memset(extra, '\0', wrqu->data.length);
+
+		EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+		if ((addr + cnts) > max_available_size) {
+			DBG_871X("(addr + cnts parameter error \n");
+			return -EFAULT;
+		}
+
+		if (rtw_efuse_map_read(padapter, addr, cnts, data) == _FAIL)
+		{
+			DBG_871X("rtw_efuse_access error \n");
+		}
+		else{
+			DBG_871X("rtw_efuse_access ok \n");
+		}
+
+		_rtw_memset(extra, '\0', sizeof(extra));
+		for ( i = 0; i < cnts; i ++) {
+			DBG_871X("0x%02x", data[i]);
+			sprintf(extra, "%s 0x%02X", extra, data[i]);
+			DBG_871X(" ");
+			sprintf(extra,"%s ",extra);
+		}
+
+		wrqu->length = strlen(extra)+1;
+
+		DBG_871X("extra = %s ", extra);
+
+		return 0;
+	}
+	else if ( strcmp(tmp[0],"realraw") == 0 ) {
+		addr=0;
+		mapLen = EFUSE_MAX_SIZE;
+
+		if (rtw_efuse_access(padapter, _FALSE, addr, mapLen, rawdata) == _FAIL)
+		{
+			DBG_871X("\t  rtw_efuse_map_read : Fail \n");
+			return -EFAULT;
+		} else
+		{
+			DBG_871X("\t  rtw_efuse_access raw ok \n");
+		}
+
+		_rtw_memset(extra, '\0', sizeof(extra));
+		for ( i=0; i<mapLen; i++ ) {
+			DBG_871X(" %02x", rawdata[i]);
+			sprintf(extra, "%s %02x", extra, rawdata[i] );
+
+			if ((i & 0xF) == 0xF){
+				DBG_871X("\n\t");
+				sprintf(extra, "%s\n\t", extra);
+			}
+			else if ((i & 0x7) == 0x7){
+				DBG_871X("\t");
+				sprintf(extra, "%s\t", extra);
+			}
+		}
+		wrqu->length = strlen(extra);
+		return 0;
+	}
+	else if ( strcmp(tmp[0],"mac") == 0 ) {
+		if ( tmp[1]==NULL || tmp[2]==NULL ) return	-EINVAL;
+		#ifdef CONFIG_RTL8192C
+		addr = 0x16;
+		cnts = 6;
+		#endif
+		#ifdef CONFIG_RTL8192D
+		addr = 0x19;
+		cnts = 6;
+		#endif
+		EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+		if ((addr + mapLen) > max_available_size) {
+			DBG_871X("(addr + cnts parameter error \n");
+			return -EFAULT;
+		}
+		if (rtw_efuse_map_read(padapter, addr, cnts, data) == _FAIL)
+		{
+			DBG_871X("rtw_efuse_access error \n");
+		}
+		else{
+			DBG_871X("rtw_efuse_access ok \n");
+		}
+		_rtw_memset(extra, '\0', sizeof(extra));
+		for ( i = 0; i < cnts; i ++) {
+			DBG_871X("0x%02x", data[i]);
+			sprintf(extra, "%s 0x%02X", extra, data[i+j]);
+			DBG_871X(" ");
+			sprintf(extra,"%s ",extra);
+		}
+		wrqu->length = strlen(extra);
+		return 0;
+	}
+	else if ( strcmp(tmp[0],"vidpid") == 0 ) {
+		if ( tmp[1]==NULL || tmp[2]==NULL ) return	-EINVAL;
+		#ifdef CONFIG_RTL8192C
+		addr=0x0a;
+		#endif
+		#ifdef CONFIG_RTL8192D
+		addr = 0x0c;
+		#endif
+		cnts = 4;
+		EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+		if ((addr + mapLen) > max_available_size) {
+			DBG_871X("(addr + cnts parameter error \n");
+			return -EFAULT;
+		}
+		if (rtw_efuse_map_read(padapter, addr, cnts, data) == _FAIL)
+		{
+			DBG_871X("rtw_efuse_access error \n");
+		}
+		else{
+			DBG_871X("rtw_efuse_access ok \n");
+		}
+		_rtw_memset(extra, '\0', sizeof(extra));
+		for ( i = 0; i < cnts; i ++) {
+			DBG_871X("0x%02x", data[i]);
+			sprintf(extra, "%s 0x%02X", extra, data[i+j]);
+			DBG_871X(" ");
+			sprintf(extra,"%s ",extra);
+		}
+		wrqu->length = strlen(extra);
+		return 0;
+	}
+	else if ( strcmp(tmp[0],"ableraw") == 0 ) {
+		efuse_GetCurrentSize(padapter,&raw_cursize);
+		raw_maxsize = efuse_GetMaxSize(padapter);
+		sprintf(extra, "%s : [ available raw size] = %d",extra,raw_maxsize-raw_cursize);
+		wrqu->length = strlen(extra);
+
+		return 0;
+	}else
+	{
+		 sprintf(extra, "%s : Command not found\n",extra);
+		  wrqu->length = strlen(extra);
+		  return 0;
+	}
+
+	return 0;
+}
+
+static int rtw_mp_efuse_set(struct net_device *dev,
+			struct iw_request_info *info,
+			union iwreq_data *wdata, char *extra)
+{
+	struct iw_point *wrqu = (struct iw_point *)wdata;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+	u8 buffer[40];
+	u32 i,jj,kk;
+	u8 setdata[EFUSE_MAP_SIZE];
+	u8 setrawdata[EFUSE_MAX_SIZE];
+	char *pch, *ptmp, *token, *edata,*tmp[3]={0x00,0x00,0x00};
+
+	u16 addr = 0, max_available_size = 0;
+	u32  cnts = 0;
+
+	pch = extra;
+	DBG_871X("%s: in=%s\n", __func__, extra);
+
+	i=0;
+	while ( (token = strsep (&pch,",") )!=NULL )
+	{
+		if(i>2) break;
+		tmp[i] = token;
+		i++;
+	}
+
+	// tmp[0],[1],[2]
+	// wmap,addr,00e04c871200
+	if ( strcmp(tmp[0],"wmap") == 0 ) {
+		 if ( tmp[1]==NULL || tmp[2]==NULL ) return 	-EINVAL;
+			if ( ! strlen( tmp[2] )/2 > 1 ) return -EFAULT;
+
+			addr = simple_strtoul( tmp[1], &ptmp, 16 );
+			addr = addr & 0xFF;
+			DBG_871X("addr = %x \n" ,addr);
+
+			cnts = strlen( tmp[2] )/2;
+			if ( cnts == 0) return -EFAULT;
+
+			DBG_871X("cnts = %d \n" ,cnts);
+			DBG_871X("target data = %s \n" ,tmp[2]);
+
+			for( jj = 0, kk = 0; jj < cnts; jj++, kk += 2 )
+			{
+				setdata[jj] = key_2char2num( tmp[2][kk], tmp[2][kk+ 1] );
+			}
+
+			EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+
+			if ((addr + cnts) > max_available_size) {
+						DBG_871X("parameter error \n");
+						return -EFAULT;
+			}
+			if (rtw_efuse_map_write(padapter, addr, cnts, setdata) == _FAIL) {
+					DBG_871X("rtw_efuse_map_write error \n");
+					return -EFAULT;
+			} else
+			   DBG_871X("rtw_efuse_map_write ok \n");
+
+		return 0;
+	}
+	else if ( strcmp(tmp[0],"wraw") == 0 ) {
+			 if ( tmp[1]==NULL || tmp[2]==NULL ) return 	-EINVAL;
+			 if ( ! strlen( tmp[2] )/2 > 1 ) return -EFAULT;
+			addr = simple_strtoul( tmp[1], &ptmp, 16 );
+			addr = addr & 0xFF;
+			DBG_871X("addr = %x \n" ,addr);
+
+			cnts=strlen( tmp[2] )/2;
+			if ( cnts == 0) return -EFAULT;
+
+			DBG_871X(" cnts = %d \n" ,cnts );
+			DBG_871X("target data = %s \n" ,tmp[2] );
+
+			for( jj = 0, kk = 0; jj < cnts; jj++, kk += 2 )
+			{
+					setrawdata[jj] = key_2char2num( tmp[2][kk], tmp[2][kk+ 1] );
+			}
+
+			if ( rtw_efuse_access( padapter, _TRUE, addr, cnts, setrawdata ) == _FAIL ){
+					DBG_871X("\t  rtw_efuse_map_read : Fail \n");
+						return -EFAULT;
+			} else
+			  DBG_871X("\t  rtw_efuse_access raw ok \n");
+
+					return 0;
+		}
+	else if ( strcmp(tmp[0],"mac") == 0 ) {
+			 if ( tmp[1]==NULL || tmp[2]==NULL ) return 	-EINVAL;
+			//mac,00e04c871200
+			#ifdef CONFIG_RTL8192C
+				addr = 0x16;
+			#endif
+			#ifdef CONFIG_RTL8192D
+				addr = 0x19;
+			#endif
+				cnts = strlen( tmp[1] )/2;
+				if ( cnts == 0) return -EFAULT;
+				if ( cnts > 6 ){
+						DBG_871X("error data for mac addr = %s \n" ,tmp[1]);
+						return -EFAULT;
+				}
+
+				DBG_871X("target data = %s \n" ,tmp[1]);
+
+				for( jj = 0, kk = 0; jj < cnts; jj++, kk += 2 )
+				{
+					setdata[jj] = key_2char2num(tmp[1][kk], tmp[1][kk+ 1]);
+				}
+
+				EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+
+				if ((addr + cnts) > max_available_size) {
+						DBG_871X("parameter error \n");
+						return -EFAULT;
+					}
+				if ( rtw_efuse_map_write(padapter, addr, cnts, setdata) == _FAIL ) {
+					DBG_871X("rtw_efuse_map_write error \n");
+					return -EFAULT;
+				} else
+					DBG_871X("rtw_efuse_map_write ok \n");
+
+			return 0;
+		}
+		else if ( strcmp(tmp[0],"vidpid") == 0 ) {
+			 if ( tmp[1]==NULL || tmp[2]==NULL ) return 	-EINVAL;
+				// pidvid,da0b7881
+				#ifdef CONFIG_RTL8192C
+					   addr=0x0a;
+				#endif
+				#ifdef CONFIG_RTL8192D
+					addr = 0x0c;
+				#endif
+
+				cnts=strlen( tmp[1] )/2;
+				if ( cnts == 0) return -EFAULT;
+				DBG_871X("target data = %s \n" ,tmp[1]);
+
+				for( jj = 0, kk = 0; jj < cnts; jj++, kk += 2 )
+				{
+					setdata[jj] = key_2char2num(tmp[1][kk], tmp[1][kk+ 1]);
+				}
+
+				EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+
+				if ((addr + cnts) > max_available_size) {
+						DBG_871X("parameter error \n");
+						return -EFAULT;
+					}
+
+				if ( rtw_efuse_map_write(padapter, addr, cnts, setdata) == _FAIL ) {
+					DBG_871X("rtw_efuse_map_write error \n");
+					return -EFAULT;
+				} else
+					DBG_871X("rtw_efuse_map_write ok \n");
+
+				return 0;
+		}
+		else{
+				 DBG_871X("Command not found\n");
+			   return 0;
+		}
+
+	  return 0;
+}
+
+
+
+#if defined(CONFIG_MP_INCLUDED) && defined(CONFIG_MP_IWPRIV_SUPPORT)
+
+/*
+ * Input Format: %s,%d,%d
+ *	%s is width, could be
+ *		"b" for 1 byte
+ *		"w" for WORD (2 bytes)
+ *		"dw" for DWORD (4 bytes)
+ *	1st %d is address(offset)
+ *	2st %d is data to write
+ */
+static int rtw_mp_write_reg(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	char *pch, *pnext, *ptmp;
+	char *width_str;
+	char width;
+	u32 addr, data;
+	int ret;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+
+	pch = extra;
+	pnext = strpbrk(pch, " ,.-");
+	if (pnext == NULL) return -EINVAL;
+	*pnext = 0;
+	width_str = pch;
+
+	pch = pnext + 1;
+	pnext = strpbrk(pch, " ,.-");
+	if (pnext == NULL) return -EINVAL;
+	*pnext = 0;
+	addr = simple_strtoul(pch, &ptmp, 16);
+	if (addr > 0x3FFF) return -EINVAL;
+
+	pch = pnext + 1;
+	if ((pch - extra) >= wrqu->length) return -EINVAL;
+	data = simple_strtoul(pch, &ptmp, 16);
+
+	ret = 0;
+	width = width_str[0];
+	switch (width) {
+		case 'b':
+			// 1 byte
+			if (data > 0xFF) {
+				ret = -EINVAL;
+				break;
+			}
+			rtw_write8(padapter, addr, data);
+			break;
+		case 'w':
+			// 2 bytes
+			if (data > 0xFFFF) {
+				ret = -EINVAL;
+				break;
+			}
+			rtw_write16(padapter, addr, data);
+			break;
+		case 'd':
+			// 4 bytes
+			rtw_write32(padapter, addr, data);
+			break;
+		default:
+			ret = -EINVAL;
+			break;
+	}
+
+	return ret;
+}
+
+/*
+ * Input Format: %s,%d
+ *	%s is width, could be
+ *		"b" for 1 byte
+ *		"w" for WORD (2 bytes)
+ *		"dw" for DWORD (4 bytes)
+ *	%d is address(offset)
+ *
+ * Return:
+ *	%d for data readed
+ */
+static int rtw_mp_read_reg(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	char input[wrqu->length];
+	char *pch, *pnext, *ptmp;
+	char *width_str;
+	char width;
+	char data[20],tmp[20];
+	u32 addr;
+	//u32 *data = (u32*)extra;
+	u32 ret, i=0, j=0, strtout=0;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+	if (wrqu->length > 128) return -EFAULT;
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+		return -EFAULT;
+
+	_rtw_memset(data, 0, 20);
+	_rtw_memset(tmp, 0, 20);
+	_rtw_memset(extra, 0, wrqu->length);
+
+	pch = input;
+	pnext = strpbrk(pch, " ,.-");
+	if (pnext == NULL) return -EINVAL;
+	*pnext = 0;
+	width_str = pch;
+
+	pch = pnext + 1;
+	if ((pch - input) >= wrqu->length) return -EINVAL;
+
+	addr = simple_strtoul(pch, &ptmp, 16);
+	if (addr > 0x3FFF) return -EINVAL;
+
+	ret = 0;
+	width = width_str[0];
+	switch (width) {
+		case 'b':
+			// 1 byte
+			// *(u8*)data = rtw_read8(padapter, addr);
+			sprintf(extra, "%d\n",  rtw_read8(padapter, addr));
+			wrqu->length = strlen(extra);
+			break;
+		case 'w':
+			// 2 bytes
+			//*(u16*)data = rtw_read16(padapter, addr);
+			sprintf(data, "%04d\n", rtw_read16(padapter, addr));
+			for( i=0 ; i <= strlen(data) ; i++)
+				{
+					  if( i%2==0 )
+					  {
+						   tmp[j]=' ';
+						   j++;
+					  }
+					  if ( data[i] != '\0' )
+						 tmp[j] = data[i];
+
+						 j++;
+				}
+				pch = tmp;
+				DBG_871X("pch=%s",pch);
+
+				while( *pch != '\0' )
+				{
+					pnext = strpbrk(pch, " ");
+					pnext++;
+					if ( *pnext != '\0' )
+					{
+						  strtout = simple_strtoul (pnext , &ptmp, 16);
+						  sprintf( extra, "%s %d" ,extra ,strtout );
+					}
+					else{
+						  break;
+					}
+					pch = pnext;
+				}
+			wrqu->length = 6;
+			break;
+		case 'd':
+			// 4 bytes
+			//*data = rtw_read32(padapter, addr);
+			sprintf(data, "%08x", rtw_read32(padapter, addr));
+				//add read data format blank
+				for( i=0 ; i <= strlen(data) ; i++)
+				{
+					  if( i%2==0 )
+					  {
+						   tmp[j]=' ';
+						   j++;
+					  }
+					  tmp[j] = data[i];
+					  j++;
+				}
+				pch = tmp;
+				DBG_871X("pch=%s",pch);
+
+				while( *pch != '\0' )
+				{
+					pnext = strpbrk(pch, " ");
+					pnext++;
+					if ( *pnext != '\0' )
+					{
+						  strtout = simple_strtoul (pnext , &ptmp, 16);
+						  sprintf( extra, "%s %d" ,extra ,strtout );
+					}
+					else{
+			break;
+					}
+					pch = pnext;
+				}
+			wrqu->length = strlen(extra);
+			break;
+
+		default:
+			wrqu->length = 0;
+			ret = -EINVAL;
+			break;
+
+	}
+
+	return ret;
+}
+
+/*
+ * Input Format: %d,%x,%x
+ *	%d is RF path, should be smaller than MAX_RF_PATH_NUMS
+ *	1st %x is address(offset)
+ *	2st %x is data to write
+ */
+ static int rtw_mp_write_rf(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+/*static int rtw_mp_write_rf(struct net_device *dev,
+			struct iw_request_info *info,
+			union iwreq_data *wrqu, char *extra)
+*/
+	u32 path, addr, data;
+	int ret;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+
+	ret = sscanf(extra, "%d,%x,%x", &path, &addr, &data);
+	if (ret < 3) return -EINVAL;
+
+	if (path >= MAX_RF_PATH_NUMS) return -EINVAL;
+	if (addr > 0xFF) return -EINVAL;
+	if (data > 0xFFFFF) return -EINVAL;
+	_rtw_memset(extra, 0, wrqu->length);
+
+	write_rfreg(padapter, path, addr, data);
+
+	sprintf(extra, "write_rf completed \n");
+
+	return 0;
+}
+
+/*
+ * Input Format: %d,%x
+ *	%d is RF path, should be smaller than MAX_RF_PATH_NUMS
+ *	%x is address(offset)
+ *
+ * Return:
+ *	%d for data readed
+ */
+static int rtw_mp_read_rf(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	char input[wrqu->length];
+	char *pch, *pnext, *ptmp;
+	char data[20],tmp[20];
+	//u32 *data = (u32*)extra;
+	u32 path, addr;
+	u32 ret,i=0 ,j=0,strtou=0;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+
+	if (wrqu->length > 128) return -EFAULT;
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+		return -EFAULT;
+
+	ret = sscanf(input, "%d,%x", &path, &addr);
+	if (ret < 2) return -EINVAL;
+
+	if (path >= MAX_RF_PATH_NUMS) return -EINVAL;
+	if (addr > 0xFF) return -EINVAL;
+
+	_rtw_memset(extra, 0, wrqu->length);
+
+	//*data = read_rfreg(padapter, path, addr);
+	sprintf(data, "%08x", read_rfreg(padapter, path, addr));
+				//add read data format blank
+				for( i=0 ; i <= strlen(data) ; i++)
+				{
+					  if( i%2==0 )
+					  {
+						   tmp[j]=' ';
+						   j++;
+					  }
+					  tmp[j] = data[i];
+					  j++;
+				}
+				pch = tmp;
+				DBG_871X("pch=%s",pch);
+
+				while( *pch != '\0' )
+				{
+					pnext = strpbrk(pch, " ");
+					pnext++;
+					if ( *pnext != '\0' )
+					{
+						  strtou = simple_strtoul (pnext , &ptmp, 16);
+						  sprintf( extra, "%s %d" ,extra ,strtou );
+					}
+					else{
+						  break;
+					}
+					pch = pnext;
+				}
+			wrqu->length = strlen(extra);
+
+	return 0;
+}
+
+static int rtw_mp_start(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u8 val8;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+
+	if (padapter->registrypriv.mp_mode == 0)
+		return -EPERM;
+
+	if (padapter->mppriv.mode == MP_OFF) {
+		if (mp_start_test(padapter) == _FAIL)
+			return -EPERM;
+		padapter->mppriv.mode = MP_ON;
+	}
+
+	return 0;
+}
+
+static int rtw_mp_stop(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+
+	if (padapter->mppriv.mode != MP_OFF) {
+		mp_stop_test(padapter);
+		padapter->mppriv.mode = MP_OFF;
+	}
+
+	return 0;
+}
+
+extern int wifirate2_ratetbl_inx(unsigned char rate);
+
+static int rtw_mp_rate(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u32 rate = MPT_RATE_1M;
+	u8 		input[wrqu->length];
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+			return -EFAULT;
+
+	rate = rtw_atoi(input);
+	sprintf( extra, "Set data rate to %d" , rate );
+
+	if(rate <= 0x7f)
+		rate = wifirate2_ratetbl_inx( (u8)rate);
+	else
+		rate =(rate-0x80+MPT_RATE_MCS0);
+
+	//DBG_871X("%s: rate=%d\n", __func__, rate);
+
+	if (rate >= MPT_RATE_LAST )
+	return -EINVAL;
+
+	padapter->mppriv.rateidx = rate;
+	Hal_SetDataRate(padapter);
+
+	wrqu->length = strlen(extra) + 1;
+	return 0;
+}
+
+static int rtw_mp_channel(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	u8 		input[wrqu->length];
+	u32 	channel = 1;
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+			return -EFAULT;
+
+	channel = rtw_atoi(input);
+	//DBG_871X("%s: channel=%d\n", __func__, channel);
+	sprintf( extra, "Change channel %d to channel %d", padapter->mppriv.channel , channel );
+
+	padapter->mppriv.channel = channel;
+	Hal_SetChannel(padapter);
+
+	wrqu->length = strlen(extra) + 1;
+	return 0;
+}
+
+static int rtw_mp_bandwidth(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u32 bandwidth=0, sg=0;
+	//u8 buffer[40];
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	//if (copy_from_user(buffer, (void*)wrqu->data.pointer, wrqu->data.length))
+    //            return -EFAULT;
+
+	//DBG_871X("%s:iwpriv in=%s\n", __func__, extra);
+
+	sscanf(extra, "40M=%d,shortGI=%d", &bandwidth, &sg);
+
+	if (bandwidth != HT_CHANNEL_WIDTH_40)
+		bandwidth = HT_CHANNEL_WIDTH_20;
+
+	//DBG_871X("%s: bw=%d sg=%d \n", __func__, bandwidth , sg);
+
+	padapter->mppriv.bandwidth = (u8)bandwidth;
+	padapter->mppriv.preamble = sg;
+
+	SetBandwidth(padapter);
+
+	return 0;
+}
+
+static int rtw_mp_txpower(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u32		idx_a=0,idx_b=0;
+	u8 		input[wrqu->length];
+
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+			return -EFAULT;
+
+	sscanf(input,"patha=%d,pathb=%d",&idx_a,&idx_b);
+	//DBG_871X("%s: tx_pwr_idx_a=%x b=%x\n", __func__, idx_a, idx_b);
+
+	sprintf( extra, "Set power level path_A:%d path_B:%d", idx_a , idx_b );
+	padapter->mppriv.txpoweridx = (u8)idx_a;
+	padapter->mppriv.txpoweridx_b = (u8)idx_b;
+
+	Hal_SetAntennaPathPower(padapter);
+
+	wrqu->length = strlen(extra) + 1;
+	return 0;
+}
+
+static int rtw_mp_ant_tx(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u8 i;
+	u8 		input[wrqu->length];
+	u16 antenna = 0;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+			return -EFAULT;
+
+	//DBG_871X("%s: input=%s\n", __func__, input);
+
+	sprintf( extra, "switch Tx antenna to %s", input );
+
+	for (i=0; i < strlen(input); i++)
+	{
+		switch(input[i])
+			{
+				case 'a' :
+								antenna|=ANTENNA_A;
+								break;
+				case 'b':
+								antenna|=ANTENNA_B;
+								break;
+			}
+	}
+	//antenna |= BIT(extra[i]-'a');
+	//DBG_871X("%s: antenna=0x%x\n", __func__, antenna);
+	padapter->mppriv.antenna_tx = antenna;
+	//DBG_871X("%s:mppriv.antenna_rx=%d\n", __func__, padapter->mppriv.antenna_tx);
+
+	Hal_SetAntenna(padapter);
+
+	wrqu->length = strlen(extra) + 1;
+	return 0;
+}
+
+static int rtw_mp_ant_rx(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u8 i;
+	u16 antenna = 0;
+	u8 		input[wrqu->length];
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+			return -EFAULT;
+	//DBG_871X("%s: input=%s\n", __func__, input);
+	_rtw_memset(extra, 0, wrqu->length);
+
+	sprintf( extra, "switch Rx antenna to %s", input );
+
+	for (i=0; i < strlen(input); i++) {
+
+	switch( input[i] )
+			{
+				case 'a' :
+								antenna|=ANTENNA_A;
+								break;
+				case 'b':
+								antenna|=ANTENNA_B;
+								break;
+			}
+	}
+
+	//DBG_871X("%s: antenna=0x%x\n", __func__, antenna);
+	padapter->mppriv.antenna_rx = antenna;
+	//DBG_871X("%s:mppriv.antenna_rx=%d\n", __func__, padapter->mppriv.antenna_rx);
+	Hal_SetAntenna(padapter);
+	wrqu->length = strlen(extra);
+
+	return 0;
+}
+
+static int rtw_mp_ctx(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u32 pkTx = 1, countPkTx = 1, cotuTx = 1, CarrSprTx = 1, scTx = 1, sgleTx = 1, stop = 1;
+	u32 bStartTest = 1;
+	u32 count = 0;
+	struct mp_priv *pmp_priv;
+	struct pkt_attrib *pattrib;
+
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+
+	pmp_priv = &padapter->mppriv;
+
+	if (copy_from_user(extra, wrqu->pointer, wrqu->length))
+			return -EFAULT;
+
+	DBG_871X("%s: in=%s\n", __func__, extra);
+
+	countPkTx = strncmp(extra, "count=", 5); // strncmp TRUE is 0
+	cotuTx = strncmp(extra, "background", 20);
+	CarrSprTx = strncmp(extra, "background,cs", 20);
+	scTx = strncmp(extra, "background,sc", 20);
+	sgleTx = strncmp(extra, "background,stone", 20);
+	pkTx = strncmp(extra, "background,pkt", 20);
+	stop = strncmp(extra, "stop", 5);
+	sscanf(extra, "count=%d,pkt", &count);
+
+	//DBG_871X("%s: count=%d countPkTx=%d cotuTx=%d CarrSprTx=%d scTx=%d sgleTx=%d pkTx=%d stop=%d\n", __func__, count, countPkTx, cotuTx, CarrSprTx, pkTx, sgleTx, scTx, stop);
+	_rtw_memset(extra, '\0', sizeof(extra));
+
+	if (stop == 0) {
+		bStartTest = 0; // To set Stop
+		pmp_priv->tx.stop = 1;
+		sprintf( extra, "Stop continuous Tx");
+	} else {
+		bStartTest = 1;
+		if (pmp_priv->mode != MP_ON) {
+			if (pmp_priv->tx.stop != 1) {
+				DBG_871X("%s: MP_MODE != ON %d\n", __func__, pmp_priv->mode);
+				return  -EFAULT;
+			}
+		}
+	}
+
+	if (pkTx == 0 || countPkTx == 0)
+		pmp_priv->mode = MP_PACKET_TX;
+	if (sgleTx == 0)
+		pmp_priv->mode = MP_SINGLE_TONE_TX;
+	if (cotuTx == 0)
+		pmp_priv->mode = MP_CONTINUOUS_TX;
+	if (CarrSprTx == 0)
+		pmp_priv->mode = MP_CARRIER_SUPPRISSION_TX;
+	if (scTx == 0)
+		pmp_priv->mode = MP_SINGLE_CARRIER_TX;
+
+	switch (pmp_priv->mode)
+	{
+		case MP_PACKET_TX:
+
+			//DBG_871X("%s:pkTx %d\n", __func__,bStartTest);
+			if (bStartTest == 0)
+			{
+				pmp_priv->tx.stop = 1;
+				pmp_priv->mode = MP_ON;
+				sprintf( extra, "Stop continuous Tx");
+			}
+			else if (pmp_priv->tx.stop == 1)
+			{
+				sprintf( extra, "Start continuous DA=ffffffffffff len=1500 count=%u,\n",count);
+				//DBG_871X("%s:countPkTx %d\n", __func__,count);
+				pmp_priv->tx.stop = 0;
+				pmp_priv->tx.count = count;
+				pmp_priv->tx.payload = 2;
+				pattrib = &pmp_priv->tx.attrib;
+				pattrib->pktlen = 1460;
+				_rtw_memset(pattrib->dst, 0xFF, ETH_ALEN);
+				SetPacketTx(padapter);
+			}
+			else {
+				//DBG_871X("%s: pkTx not stop\n", __func__);
+				return -EFAULT;
+			}
+				wrqu->length = strlen(extra);
+				return 0;
+
+		case MP_SINGLE_TONE_TX:
+			//DBG_871X("%s: sgleTx %d \n", __func__, bStartTest);
+			if (bStartTest != 0){
+				sprintf( extra, "Start continuous DA=ffffffffffff len=1500 \n infinite=yes.");
+
+			 }
+			Hal_SetSingleToneTx(padapter, (u8)bStartTest);
+			break;
+
+		case MP_CONTINUOUS_TX:
+			DBG_871X("%s: cotuTx %d\n", __func__, bStartTest);
+			if (bStartTest != 0){
+				sprintf( extra, "Start continuous DA=ffffffffffff len=1500 \n infinite=yes.");
+			 }
+			 Hal_SetContinuousTx(padapter, (u8)bStartTest);
+			break;
+
+		case MP_CARRIER_SUPPRISSION_TX:
+			//DBG_871X("%s: CarrSprTx %d\n", __func__, bStartTest);
+			if (bStartTest != 0){
+				if( pmp_priv->rateidx <= MPT_RATE_11M )
+				{
+					sprintf( extra, "Start continuous DA=ffffffffffff len=1500 \n infinite=yes.");
+				}else
+					sprintf( extra, "Specify carrier suppression but not CCK rate");
+			}
+			Hal_SetCarrierSuppressionTx(padapter, (u8)bStartTest);
+			break;
+
+		case MP_SINGLE_CARRIER_TX:
+			//DBG_871X("%s: scTx %d\n", __func__, bStartTest);
+			if (bStartTest != 0){
+				sprintf( extra, "Start continuous DA=ffffffffffff len=1500 \n infinite=yes.");
+			}
+			Hal_SetSingleCarrierTx(padapter, (u8)bStartTest);
+			break;
+
+		default:
+			//DBG_871X("%s:No Match MP_MODE\n", __func__);
+			sprintf( extra, "Error! Continuous-Tx is not on-going.");
+			return -EFAULT;
+	}
+
+	if (bStartTest) {
+		struct mp_priv *pmp_priv = &padapter->mppriv;
+		if (pmp_priv->tx.stop == 0) {
+			pmp_priv->tx.stop = 1;
+			//DBG_871X("%s: pkt tx is running...\n", __func__);
+			rtw_msleep_os(5);
+		}
+		pmp_priv->tx.stop = 0;
+		pmp_priv->tx.count = 1;
+		SetPacketTx(padapter);
+	} else {
+		pmp_priv->mode = MP_ON;
+	}
+
+	wrqu->length = strlen(extra);
+	return 0;
+}
+
+static int rtw_mp_arx(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u8 bStartRx=0,bStopRx=0;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	u8 		input[wrqu->length];
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+			return -EFAULT;
+
+	DBG_871X("%s: %s\n", __func__, input);
+
+	bStartRx = (strncmp(input, "start", 5)==0)?1:0; // strncmp TRUE is 0
+	bStopRx = (strncmp(input, "stop", 5)==0)?1:0; // strncmp TRUE is 0
+	SetPacketRx(padapter, bStartRx);
+
+	if(bStartRx)
+	{
+		sprintf( extra, "start");
+		wrqu->length = strlen(extra) + 1;
+	}
+	else if(bStopRx)
+	{
+		sprintf( extra, "Received packet OK:%d CRC error:%d",padapter->mppriv.rx_pktcount,
+														padapter->mppriv.rx_crcerrpktcount);
+		wrqu->length = strlen(extra) + 1;
+	}
+
+
+	return 0;
+}
+
+static int rtw_mp_trx_query(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u32 txok,txfail,rxok,rxfail;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	//if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length))
+	//	return -EFAULT;
+
+	txok=padapter->mppriv.tx.sended;
+	txfail=0;
+	rxok = padapter->mppriv.rx_pktcount;
+	rxfail = padapter->mppriv.rx_crcerrpktcount;
+
+	_rtw_memset(extra, '\0', 128);
+
+	sprintf(extra, "Tx OK:%d, Tx Fail:%d, Rx OK:%d, CRC error:%d ", txok, txfail,rxok,rxfail);
+
+	wrqu->length=strlen(extra)+1;
+
+	return 0;
+}
+
+static int rtw_mp_pwrtrk(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u8 enable;
+	u32 thermal;
+	s32 ret;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	u8 		input[wrqu->length];
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+			return -EFAULT;
+
+	_rtw_memset(extra, 0, wrqu->length);
+
+	enable = 1;
+	if (wrqu->length > 1) { // not empty string
+		if (strncmp(input, "stop", 4) == 0)
+		{
+			enable = 0;
+			sprintf(extra, "mp tx power tracking stop");
+		}
+		else if (sscanf(input, "ther=%d", &thermal)) {
+				ret = Hal_SetThermalMeter(padapter, (u8)thermal);
+				if (ret == _FAIL) return -EPERM;
+				sprintf(extra, "mp tx power tracking start,target value=%d ok ",thermal);
+		}else	{
+			return -EINVAL;
+		}
+	}
+
+	ret = Hal_SetPowerTracking(padapter, enable);
+	if (ret == _FAIL) return -EPERM;
+
+	wrqu->length = strlen(extra);
+
+	return 0;
+}
+
+static int rtw_mp_psd(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	u8 		input[wrqu->length];
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+		return -EFAULT;
+
+	strcpy(extra,input);
+
+	wrqu->length = mp_query_psd(padapter, extra);
+
+	return 0;
+}
+
+static int rtw_mp_thermal(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	u8 val;
+	u16 bwrite=1;
+	#ifdef CONFIG_RTL8192C
+		u16 addr=0x78;
+	#endif
+	#ifdef CONFIG_RTL8192D
+		u16 addr=0xc3;
+	#endif
+	u16 cnt=1;
+	u16 max_available_size=0;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+	if (copy_from_user(extra, wrqu->pointer, wrqu->length))
+		return -EFAULT;
+
+	//DBG_871X("print extra %s \n",extra);
+
+	 bwrite = strncmp(extra, "write", 6); // strncmp TRUE is 0
+
+	 Hal_GetThermalMeter(padapter, &val);
+
+	 if( bwrite == 0 )
+	 {
+		 //DBG_871X("to write val:%d",val);
+			EFUSE_GetEfuseDefinition(padapter, EFUSE_WIFI, TYPE_AVAILABLE_EFUSE_BYTES_TOTAL, (PVOID)&max_available_size, _FALSE);
+			if( 2 > max_available_size )
+			{
+				DBG_871X("no available efuse!\n");
+				return -EFAULT;
+			}
+			if ( rtw_efuse_map_write(padapter, addr, cnt, &val) == _FAIL )
+			{
+				DBG_871X("rtw_efuse_map_write error \n");
+				return -EFAULT;
+			}
+			else
+			{
+				 sprintf(extra, " efuse write ok :%d", val);
+			}
+	  }
+	  else
+	  {
+			 sprintf(extra, "%d", val);
+	  }
+	wrqu->length = strlen(extra);
+
+	return 0;
+}
+
+static int rtw_mp_reset_stats(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	struct mp_priv *pmp_priv;
+	struct pkt_attrib *pattrib;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+	pmp_priv = &padapter->mppriv;
+
+	pmp_priv->tx.sended = 0;
+	padapter->mppriv.rx_pktcount = 0;
+	padapter->mppriv.rx_crcerrpktcount = 0;
+
+	return 0;
+}
+
+static int rtw_mp_dump(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+	struct mp_priv *pmp_priv;
+	struct pkt_attrib *pattrib;
+        u32 value;
+	u8 rf_type,path_nums = 0;
+	u32 i,j=1,path;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+	pmp_priv = &padapter->mppriv;
+
+
+	//if (copy_from_user(extra, wrqu->data.pointer, wrqu->data.length))
+	//	return -EFAULT;
+
+	if ( strncmp(extra, "all", 4)==0 )
+	{
+			DBG_871X("\n======= MAC REG =======\n");
+			for ( i=0x0;i<0x300;i+=4 )
+			{
+				if(j%4==1)	DBG_871X("0x%02x",i);
+				DBG_871X(" 0x%08x ",rtw_read32(padapter,i));
+				if((j++)%4 == 0)	DBG_871X("\n");
+			}
+			for( i=0x400;i<0x800;i+=4 )
+			{
+				if(j%4==1)	DBG_871X("0x%02x",i);
+				DBG_871X(" 0x%08x ",rtw_read32(padapter,i));
+				if((j++)%4 == 0)	DBG_871X("\n");
+			}
+
+			i,j=1;
+			rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+
+			DBG_871X("\n======= RF REG =======\n");
+			if(( RF_1T2R == rf_type ) ||( RF_1T1R ==rf_type ))
+				path_nums = 1;
+			else
+				path_nums = 2;
+
+			for(path=0;path<path_nums;path++)
+			{
+#ifdef CONFIG_RTL8192D
+			  for (i = 0; i < 0x50; i++)
+#else
+			 for (i = 0; i < 0x34; i++)
+#endif
+				{
+					//value = PHY_QueryRFReg(padapter, (RF90_RADIO_PATH_E)path,i, bMaskDWord);
+					value =rtw_hal_read_rfreg(padapter, path, i, 0xffffffff);
+					if(j%4==1)	DBG_871X("0x%02x ",i);
+					DBG_871X(" 0x%08x ",value);
+					if((j++)%4==0)	DBG_871X("\n");
+				}
+			}
+	}
+	return 0;
+}
+
+static int rtw_mp_phypara(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+
+	PADAPTER padapter = rtw_netdev_priv(dev);
+	char 	input[wrqu->length];
+	u32		valxcap;
+
+	if (copy_from_user(input, wrqu->pointer, wrqu->length))
+			return -EFAULT;
+
+	DBG_871X("%s:iwpriv in=%s\n", __func__, input);
+
+	sscanf(input, "xcap=%d", &valxcap);
+
+	if (!IS_HARDWARE_TYPE_8192D(padapter))
+			return 0;
+#ifdef CONFIG_RTL8192D
+	Hal_ProSetCrystalCap( padapter , valxcap );
+#endif
+
+	sprintf( extra, "Set xcap=%d",valxcap );
+	wrqu->length = strlen(extra) + 1;
+
+return 0;
+
+}
+
+
+/* update Tx AGC offset */
+static int rtw_mp_antBdiff(struct net_device *dev,
+			struct iw_request_info *info,
+			struct iw_point *wrqu, char *extra)
+{
+
+
+	// MPT_ProSetTxAGCOffset
+	return 0;
+}
+
+
+static int rtw_mp_set(struct net_device *dev,
+			struct iw_request_info *info,
+			union iwreq_data *wdata, char *extra)
+{
+	struct iw_point *wrqu = (struct iw_point *)wdata;
+	u32 subcmd = wrqu->flags;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+	if (padapter == NULL)
+	{
+		return -ENETDOWN;
+	}
+
+	//_rtw_memset(extra, 0x00, IW_PRIV_SIZE_MASK);
+
+	if (extra == NULL)
+	{
+		wrqu->length = 0;
+		return -EIO;
+	}
+
+	switch(subcmd)
+	{
+	case WRITE_REG :
+			rtw_mp_write_reg (dev,info,wrqu,extra);
+			 break;
+
+	case WRITE_RF:
+			rtw_mp_write_rf (dev,info,wrqu,extra);
+			 break;
+
+	case MP_START:
+			DBG_871X("set case mp_start \n");
+			rtw_mp_start (dev,info,wrqu,extra);
+			 break;
+
+	case MP_STOP:
+			DBG_871X("set case mp_stop \n");
+			rtw_mp_stop (dev,info,wrqu,extra);
+			 break;
+
+	case MP_BANDWIDTH:
+			DBG_871X("set case mp_bandwidth \n");
+			rtw_mp_bandwidth (dev,info,wrqu,extra);
+			break;
+
+	case MP_RESET_STATS:
+			DBG_871X("set case MP_RESET_STATS \n");
+			rtw_mp_reset_stats	(dev,info,wrqu,extra);
+			break;
+
+	case EFUSE_SET:
+			DBG_871X("efuse set \n");
+			rtw_mp_efuse_set (dev,info,wdata,extra);
+			break;
+
+	}
+
+
+	return 0;
+}
+
+
+static int rtw_mp_get(struct net_device *dev,
+			struct iw_request_info *info,
+			union iwreq_data *wdata, char *extra)
+{
+	struct iw_point *wrqu = (struct iw_point *)wdata;
+	u32 subcmd = wrqu->flags;
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+	//DBG_871X("in mp_get extra= %s \n",extra);
+
+	if (padapter == NULL)
+	{
+		return -ENETDOWN;
+	}
+	if (extra == NULL)
+	{
+		wrqu->length = 0;
+		return -EIO;
+	}
+
+	switch(subcmd)
+	{
+	case MP_PHYPARA:
+			DBG_871X("mp_get  MP_PHYPARA \n");
+			rtw_mp_phypara(dev,info,wrqu,extra);
+			break;
+
+	case MP_CHANNEL:
+			DBG_871X("set case mp_channel \n");
+			rtw_mp_channel (dev,info,wrqu,extra);
+			break;
+
+	case READ_REG:
+			DBG_871X("mp_get  READ_REG \n");
+			rtw_mp_read_reg (dev,info,wrqu,extra);
+			 break;
+	case READ_RF:
+			DBG_871X("mp_get  READ_RF \n");
+			rtw_mp_read_rf (dev,info,wrqu,extra);
+			break;
+
+	case MP_RATE:
+			DBG_871X("set case mp_rate \n");
+			rtw_mp_rate (dev,info,wrqu,extra);
+			break;
+
+	case MP_TXPOWER:
+			DBG_871X("set case MP_TXPOWER \n");
+			rtw_mp_txpower (dev,info,wrqu,extra);
+			break;
+
+	case MP_ANT_TX:
+			DBG_871X("set case MP_ANT_TX \n");
+			rtw_mp_ant_tx (dev,info,wrqu,extra);
+			break;
+
+	case MP_ANT_RX:
+			DBG_871X("set case MP_ANT_RX \n");
+			rtw_mp_ant_rx (dev,info,wrqu,extra);
+			break;
+
+	case MP_QUERY:
+			DBG_871X("mp_get mp_query MP_QUERY \n");
+			rtw_mp_trx_query(dev,info,wrqu,extra);
+			break;
+
+	case MP_CTX:
+			DBG_871X("set case MP_CTX \n");
+			rtw_mp_ctx (dev,info,wrqu,extra);
+			break;
+
+	case MP_ARX:
+			DBG_871X("set case MP_ARX \n");
+			rtw_mp_arx (dev,info,wrqu,extra);
+			break;
+
+	case EFUSE_GET:
+			DBG_871X("efuse get EFUSE_GET \n");
+			rtw_mp_efuse_get(dev,info,wdata,extra);
+		 break;
+
+	case MP_DUMP:
+			DBG_871X("set case MP_DUMP \n");
+			rtw_mp_dump (dev,info,wrqu,extra);
+		 break;
+	case MP_PSD:
+			DBG_871X("set case MP_PSD \n");
+			rtw_mp_psd (dev,info,wrqu,extra);
+		 break;
+
+	case MP_THER:
+			DBG_871X("set case MP_THER \n");
+			rtw_mp_thermal (dev,info,wrqu,extra);
+		break;
+
+	case MP_PWRTRK:
+			DBG_871X("set case MP_PWRTRK \n");
+			rtw_mp_pwrtrk (dev,info,wrqu,extra);
+			break;
+	}
+
+return 0;
+}
+
+#endif //#if defined(CONFIG_MP_INCLUDED) && defined(CONFIG_MP_IWPRIV_SUPPORT)
+
+static int rtw_wfd_tdls_enable(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+#ifdef CONFIG_WFD
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	if ( extra[ 0 ] == '0' )
+	{
+		padapter->wdinfo.wfd_tdls_enable = 0;
+	}
+	else
+	{
+		padapter->wdinfo.wfd_tdls_enable = 1;
+	}
+
+#endif //CONFIG_WFD
+#endif //CONFIG_TDLS
+
+	return ret;
+}
+
+static int rtw_tdls_weaksec(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+
+	u8 i, j;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	DBG_871X( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	if ( extra[ 0 ] == '0' )
+	{
+		padapter->wdinfo.wfd_tdls_weaksec = 0;
+	}
+	else
+	{
+		padapter->wdinfo.wfd_tdls_weaksec = 1;
+	}
+#endif
+
+	return ret;
+}
+
+
+static int rtw_tdls_enable(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct tdls_info	*ptdlsinfo = &padapter->tdlsinfo;
+	_irqL	 irqL;
+	_list	*plist, *phead;
+	s32	index;
+	struct sta_info *psta = NULL;
+	struct	sta_priv *pstapriv = &padapter->stapriv;
+	u8 tdls_sta[NUM_STA][ETH_ALEN];
+	u8 empty_hwaddr[ETH_ALEN] = { 0x00 };
+
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	_rtw_memset(tdls_sta, 0x00, sizeof(tdls_sta));
+
+	if ( extra[ 0 ] == '0' )
+	{
+		ptdlsinfo->enable = 0;
+
+		if(pstapriv->asoc_sta_count==1)
+			return ret;
+
+		_enter_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+		for(index=0; index< NUM_STA; index++)
+		{
+			phead = &(pstapriv->sta_hash[index]);
+			plist = get_next(phead);
+
+			while ((rtw_end_of_queue_search(phead, plist)) == _FALSE)
+			{
+				psta = LIST_CONTAINOR(plist, struct sta_info ,hash_list);
+
+				plist = get_next(plist);
+
+				if(psta->tdls_sta_state != TDLS_STATE_NONE)
+				{
+					_rtw_memcpy(tdls_sta[index], psta->hwaddr, ETH_ALEN);
+				}
+			}
+		}
+		_exit_critical_bh(&pstapriv->sta_hash_lock, &irqL);
+
+		for(index=0; index< NUM_STA; index++)
+		{
+			if( !_rtw_memcmp(tdls_sta[index], empty_hwaddr, ETH_ALEN) )
+			{
+				printk("issue tear down to "MAC_FMT"\n", MAC_ARG(tdls_sta[index]));
+				issue_tdls_teardown(padapter, tdls_sta[index]);
+			}
+		}
+		rtw_tdls_cmd(padapter, myid(&(padapter->eeprompriv)), TDLS_RS_RCR);
+		rtw_reset_tdls_info(padapter);
+	}
+	else if ( extra[ 0 ] == '1' )
+	{
+		ptdlsinfo->enable = 1;
+	}
+#endif //CONFIG_TDLS
+
+	return ret;
+}
+
+static int rtw_tdls_setup(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+
+	u8 i, j;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u8 mac_addr[ETH_ALEN];
+
+#ifdef CONFIG_WFD
+	struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
+#endif // CONFIG_WFD
+
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	for( i=0, j=0 ; i < ETH_ALEN; i++, j+=3 ){
+		mac_addr[i]=key_2char2num(*(extra+j), *(extra+j+1));
+	}
+
+#ifdef CONFIG_WFD
+	if ( _AES_ != padapter->securitypriv.dot11PrivacyAlgrthm )
+	{
+		//	Weak Security situation with AP.
+		if ( 0 == pwdinfo->wfd_tdls_weaksec )
+		{
+			//	Can't send the tdls setup request out!!
+			DBG_871X( "[%s] Current link is not AES, SKIP sending the tdls setup request!!\n", __FUNCTION__ );
+		}
+		else
+		{
+			issue_tdls_setup_req(padapter, mac_addr);
+		}
+	}
+	else
+#endif // CONFIG_WFD
+	{
+		issue_tdls_setup_req(padapter, mac_addr);
+	}
+#endif
+
+	return ret;
+}
+
+static int rtw_tdls_teardown(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+
+	u8 i,j;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct sta_info *ptdls_sta = NULL;
+	u8 mac_addr[ETH_ALEN];
+
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	for( i=0, j=0 ; i < ETH_ALEN; i++, j+=3 ){
+		mac_addr[i]=key_2char2num(*(extra+j), *(extra+j+1));
+	}
+
+	ptdls_sta = rtw_get_stainfo( &(padapter->stapriv), mac_addr);
+
+	if(ptdls_sta != NULL)
+	{
+		ptdls_sta->stat_code = _RSON_TDLS_TEAR_UN_RSN_;
+		issue_tdls_teardown(padapter, mac_addr);
+	}
+
+#endif //CONFIG_TDLS
+
+	return ret;
+}
+
+static int rtw_tdls_discovery(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	issue_tdls_dis_req(padapter, NULL);
+
+#endif //CONFIG_TDLS
+
+	return ret;
+}
+
+static int rtw_tdls_ch_switch(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct tdls_info	*ptdlsinfo = &padapter->tdlsinfo;
+	u8 i, j, mac_addr[ETH_ALEN];
+	struct sta_info *ptdls_sta = NULL;
+
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	for( i=0, j=0 ; i < ETH_ALEN; i++, j+=3 ){
+		mac_addr[i]=key_2char2num(*(extra+j), *(extra+j+1));
+	}
+
+	ptdls_sta = rtw_get_stainfo(&padapter->stapriv, mac_addr);
+	if( ptdls_sta == NULL )
+		return ret;
+	ptdlsinfo->ch_sensing=1;
+
+	rtw_tdls_cmd(padapter, ptdls_sta->hwaddr, TDLS_INIT_CH_SEN);
+
+#endif //CONFIG_TDLS
+
+		return ret;
+}
+
+static int rtw_tdls_pson(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 i, j, mac_addr[ETH_ALEN];
+	struct sta_info *ptdls_sta = NULL;
+
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	for( i=0, j=0 ; i < ETH_ALEN; i++, j+=3 ){
+		mac_addr[i]=key_2char2num(*(extra+j), *(extra+j+1));
+	}
+
+	ptdls_sta = rtw_get_stainfo(&padapter->stapriv, mac_addr);
+
+	issue_nulldata_to_TDLS_peer_STA(padapter, ptdls_sta, 1);
+
+#endif //CONFIG_TDLS
+
+		return ret;
+}
+
+static int rtw_tdls_psoff(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct mlme_ext_priv	*pmlmeext = &(padapter->mlmeextpriv);
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	u8 i, j, mac_addr[ETH_ALEN];
+	struct sta_info *ptdls_sta = NULL;
+
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	for( i=0, j=0 ; i < ETH_ALEN; i++, j+=3 ){
+		mac_addr[i]=key_2char2num(*(extra+j), *(extra+j+1));
+	}
+
+	ptdls_sta = rtw_get_stainfo(&padapter->stapriv, mac_addr);
+
+	issue_nulldata_to_TDLS_peer_STA(padapter, ptdls_sta, 0);
+
+#endif //CONFIG_TDLS
+
+	return ret;
+}
+
+static int rtw_tdls_setip(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+#ifdef CONFIG_WFD
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	struct wifi_display_info *pwfd_info = ptdlsinfo->wfd_info;
+	u8 i=0, j=0, k=0, tag=0, ip[3] = { 0xff }, *ptr = extra;
+
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length - 1  );
+
+
+	while( i < 4 )
+	{
+		for( j=0; j < 4; j++)
+		{
+			if( *( extra + j + tag ) == '.' || *( extra + j + tag ) == '\0' )
+			{
+				if( j == 1 )
+					pwfd_info->ip_address[i]=convert_ip_addr( '0', '0', *(extra+(j-1)+tag));
+				if( j == 2 )
+					pwfd_info->ip_address[i]=convert_ip_addr( '0', *(extra+(j-2)+tag), *(extra+(j-1)+tag));
+				if( j == 3 )
+					pwfd_info->ip_address[i]=convert_ip_addr( *(extra+(j-3)+tag), *(extra+(j-2)+tag), *(extra+(j-1)+tag));
+
+				tag += j + 1;
+				break;
+			}
+		}
+		i++;
+	}
+
+	printk( "[%s] Set IP = %u.%u.%u.%u \n", __FUNCTION__,
+		ptdlsinfo->wfd_info->ip_address[0], ptdlsinfo->wfd_info->ip_address[1],
+		ptdlsinfo->wfd_info->ip_address[2], ptdlsinfo->wfd_info->ip_address[3]
+	);
+
+#endif //CONFIG_WFD
+#endif //CONFIG_TDLS
+
+	return ret;
+}
+
+static int rtw_tdls_getip(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+#ifdef CONFIG_WFD
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	struct wifi_display_info *pwfd_info = ptdlsinfo->wfd_info;
+
+	printk( "[%s]\n", __FUNCTION__);
+
+	sprintf( extra, "\n\n%u.%u.%u.%u\n",
+		pwfd_info->peer_ip_address[0], pwfd_info->peer_ip_address[1],
+		pwfd_info->peer_ip_address[2], pwfd_info->peer_ip_address[3]
+		);
+
+	printk( "[%s] IP=%u.%u.%u.%u\n", __FUNCTION__,
+		pwfd_info->peer_ip_address[0], pwfd_info->peer_ip_address[1],
+		pwfd_info->peer_ip_address[2], pwfd_info->peer_ip_address[3]
+		);
+
+	wrqu->data.length = strlen( extra );
+
+#endif //CONFIG_WFD
+#endif //CONFIG_TDLS
+
+	return ret;
+}
+
+static int rtw_tdls_getport(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+#ifdef CONFIG_WFD
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	struct wifi_display_info *pwfd_info = ptdlsinfo->wfd_info;
+
+	printk( "[%s]\n", __FUNCTION__);
+
+	sprintf( extra, "\n\n%d\n", pwfd_info->peer_rtsp_ctrlport );
+	printk( "[%s] remote port = %d\n", __FUNCTION__, pwfd_info->peer_rtsp_ctrlport );
+
+	wrqu->data.length = strlen( extra );
+
+#endif //CONFIG_WFD
+#endif //CONFIG_TDLS
+
+	return ret;
+
+}
+
+//WFDTDLS, for sigma test
+static int rtw_tdls_dis_result(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+#ifdef CONFIG_WFD
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	struct wifi_display_info *pwfd_info = ptdlsinfo->wfd_info;
+
+	printk( "[%s]\n", __FUNCTION__);
+
+	if(ptdlsinfo->dev_discovered == 1 )
+	{
+		sprintf( extra, "\n\nDis=1\n" );
+		ptdlsinfo->dev_discovered = 0;
+	}
+
+	wrqu->data.length = strlen( extra );
+
+#endif //CONFIG_WFD
+#endif //CONFIG_TDLS
+
+	return ret;
+
+}
+
+//WFDTDLS, for sigma test
+static int rtw_wfd_tdls_status(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+#ifdef CONFIG_WFD
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	struct tdls_info *ptdlsinfo = &padapter->tdlsinfo;
+	struct wifi_display_info *pwfd_info = ptdlsinfo->wfd_info;
+
+	printk( "[%s]\n", __FUNCTION__);
+
+	if(ptdlsinfo->setup_state == TDLS_LINKED_STATE )
+	{
+		sprintf( extra, "\n\nStatus=1\n" );
+	}
+	else
+	{
+		sprintf( extra, "\n\nStatus=0\n" );
+	}
+
+	wrqu->data.length = strlen( extra );
+
+#endif //CONFIG_WFD
+#endif //CONFIG_TDLS
+
+	return ret;
+
+}
+
+static int rtw_tdls_ch_switch_off(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	u8 i, j, mac_addr[ETH_ALEN];
+	struct sta_info *ptdls_sta = NULL;
+
+	printk( "[%s] %s %d\n", __FUNCTION__, extra, wrqu->data.length -1  );
+
+	for( i=0, j=0 ; i < ETH_ALEN; i++, j+=3 ){
+		mac_addr[i]=key_2char2num(*(extra+j), *(extra+j+1));
+	}
+
+	ptdls_sta = rtw_get_stainfo(&padapter->stapriv, mac_addr);
+
+	ptdls_sta->tdls_sta_state |= TDLS_SW_OFF_STATE;
+/*
+	if((ptdls_sta->tdls_sta_state & TDLS_AT_OFF_CH_STATE) && (ptdls_sta->tdls_sta_state & TDLS_PEER_AT_OFF_STATE)){
+		pmlmeinfo->tdls_candidate_ch= pmlmeext->cur_channel;
+		issue_tdls_ch_switch_req(padapter, mac_addr);
+		DBG_871X("issue tdls ch switch req back to base channel\n");
+	}
+*/
+
+#endif //CONFIG_TDLS
+
+	return ret;
+}
+
+static int rtw_tdls(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_TDLS
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	printk( "[%s] extra = %s\n", __FUNCTION__, extra );
+	//	WFD Sigma will use the tdls enable command to let the driver know we want to test the tdls now!
+	if ( _rtw_memcmp( extra, "wfdenable=", 10 ) )
+	{
+		wrqu->data.length -=10;
+		rtw_wfd_tdls_enable( dev, info, wrqu, &extra[10] );
+		return ret;
+	}
+	else if ( _rtw_memcmp( extra, "weaksec=", 8 ) )
+	{
+		wrqu->data.length -=8;
+		rtw_tdls_weaksec( dev, info, wrqu, &extra[8] );
+		return ret;
+	}
+	else if ( _rtw_memcmp( extra, "tdlsenable=", 11 ) )
+	{
+		wrqu->data.length -=11;
+		rtw_tdls_enable( dev, info, wrqu, &extra[11] );
+		return ret;
+	}
+
+	if( padapter->tdlsinfo.enable == 0 )
+	{
+		printk("tdls haven't enabled\n");
+		return 0;
+	}
+
+	if ( _rtw_memcmp( extra, "setup=", 6 ) )
+	{
+		wrqu->data.length -=6;
+		rtw_tdls_setup( dev, info, wrqu, &extra[6] );
+	}
+	else if (_rtw_memcmp( extra, "tear=", 5 ) )
+	{
+		wrqu->data.length -= 5;
+		rtw_tdls_teardown( dev, info, wrqu, &extra[5] );
+	}
+	else if (_rtw_memcmp( extra, "dis=", 4 ) )
+	{
+		wrqu->data.length -= 4;
+		rtw_tdls_discovery( dev, info, wrqu, &extra[4] );
+	}
+	else if (_rtw_memcmp( extra, "sw=", 3 ) )
+	{
+		wrqu->data.length -= 3;
+		rtw_tdls_ch_switch( dev, info, wrqu, &extra[3] );
+	}
+	else if (_rtw_memcmp( extra, "swoff=", 6 ) )
+	{
+		wrqu->data.length -= 6;
+		rtw_tdls_ch_switch_off( dev, info, wrqu, &extra[6] );
+	}
+	else if (_rtw_memcmp( extra, "pson=", 5 ) )
+	{
+		wrqu->data.length -= 5;
+		rtw_tdls_pson( dev, info, wrqu, &extra[5] );
+	}
+	else if (_rtw_memcmp( extra, "psoff=", 6 ) )
+	{
+		wrqu->data.length -= 6;
+		rtw_tdls_psoff( dev, info, wrqu, &extra[6] );
+	}
+#ifdef CONFIG_WFD
+	else if (_rtw_memcmp( extra, "setip=", 6 ) )
+	{
+		wrqu->data.length -= 6;
+		rtw_tdls_setip( dev, info, wrqu, &extra[6] );
+	}
+	else if (_rtw_memcmp( extra, "tprobe=", 6 ) )
+	{
+		issue_tunneled_probe_req((_adapter *)rtw_netdev_priv(dev));
+	}
+#endif //CONFIG_WFD
+
+#endif //CONFIG_TDLS
+
+	return ret;
+}
+
+
+static int rtw_tdls_get(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+
+#ifdef CONFIG_WFD
+
+	DBG_871X( "[%s] extra = %s\n", __FUNCTION__, (char*) wrqu->data.pointer );
+
+	if ( _rtw_memcmp( wrqu->data.pointer, "ip", 2 ) )
+	{
+		rtw_tdls_getip( dev, info, wrqu, extra );
+	}
+	if ( _rtw_memcmp( wrqu->data.pointer, "port", 4 ) )
+	{
+		rtw_tdls_getport( dev, info, wrqu, extra );
+	}
+
+	//WFDTDLS, for sigma test
+	if ( _rtw_memcmp( wrqu->data.pointer, "dis", 3 ) )
+	{
+		rtw_tdls_dis_result( dev, info, wrqu, extra );
+	}
+	if ( _rtw_memcmp( wrqu->data.pointer, "status", 6 ) )
+	{
+		rtw_wfd_tdls_status( dev, info, wrqu, extra );
+	}
+
+#endif //CONFIG_WFD
+
+	return ret;
+}
+
+static int rtw_pm_set(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+	unsigned	mode = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	DBG_871X( "[%s] extra = %s\n", __FUNCTION__, extra );
+
+	if ( _rtw_memcmp( extra, "lps=", 4 ) )
+	{
+		sscanf(extra+4, "%u", &mode);
+		ret = rtw_pm_set_lps(padapter,mode);
+	}
+	else if ( _rtw_memcmp( extra, "ips=", 4 ) )
+	{
+		sscanf(extra+4, "%u", &mode);
+		ret = rtw_pm_set_ips(padapter,mode);
+	}
+	else{
+		ret = -EINVAL;
+	}
+
+	return ret;
+}
+
+#ifdef CONFIG_WOWLAN
+static int rtw_wowlan_ctrl(struct net_device *dev,
+	struct iw_request_info *info,
+	union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+	struct oid_par_priv	oid_par;
+	struct wowlan_ioctl_param *poidparam;
+	uint status=0;
+	u16 len;
+	u8 *pparmbuf = NULL, bset;
+	_adapter *padapter =  (_adapter *)rtw_netdev_priv(dev);
+
+	struct iw_point *p = &wrqu->data;
+
+	//DBG_871X("+rtw_wowlan_ctrl\n");
+
+	//mutex_lock(&ioctl_mutex);
+
+	if ((!p->length) || (!p->pointer)) {
+		ret = -EINVAL;
+		goto _rtw_wowlan_ctrl_exit;
+	}
+
+	pparmbuf = NULL;
+	bset = (u8)(p->flags & 0xFFFF);
+	len = p->length;
+	pparmbuf = (u8*)rtw_malloc(len);
+	if (pparmbuf == NULL){
+		ret = -ENOMEM;
+		goto _rtw_wowlan_ctrl_exit;
+	}
+
+	if (copy_from_user(pparmbuf, p->pointer, len)) {
+		ret = -EFAULT;
+		goto _rtw_wowlan_ctrl_exit_free;
+	}
+	poidparam = (struct wowlan_ioctl_param *)pparmbuf;
+
+	if(padapter->pwrctrlpriv.bSupportRemoteWakeup==_FALSE){
+		ret = -EPERM;
+		DBG_871X("+rtw_wowlan_ctrl: Device didn't support the remote wakeup!!\n");
+		goto _rtw_wowlan_ctrl_exit_free;
+	}
+	rtw_hal_set_hwreg(padapter,HW_VAR_WOWLAN,(u8 *)poidparam);
+
+	DBG_871X("rtw_wowlan_ctrl: subcode [%d], len[%d], buffer_len[%d]\r\n",
+		  poidparam->subcode, poidparam->len, len);
+
+	if (copy_to_user(p->pointer, pparmbuf, len)) {
+		ret = -EFAULT;
+	}
+
+
+_rtw_wowlan_ctrl_exit_free:
+	//DBG_871X("-rtw_wowlan_ctrl( subcode = %d)\n", poidparam->subcode);
+	rtw_mfree(pparmbuf, len);
+_rtw_wowlan_ctrl_exit:
+
+
+	return ret;
+}
+#endif //CONFIG_WOWLAN
+
+#ifdef CONFIG_INTEL_WIDI
+static int rtw_widi_set(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	process_intel_widi_cmd(padapter, extra);
+
+	return ret;
+}
+
+static int rtw_widi_set_probe_request(struct net_device *dev,
+                               struct iw_request_info *info,
+                               union iwreq_data *wrqu, char *extra)
+{
+	int	ret = 0;
+	u8	*pbuf = NULL;
+	_adapter	*padapter = (_adapter *)rtw_netdev_priv(dev);
+
+	pbuf = rtw_malloc(sizeof(l2_msg_t));
+	if(pbuf)
+	{
+		copy_from_user(pbuf, wrqu->data.pointer, wrqu->data.length);
+		//_rtw_memcpy(pbuf, wrqu->data.pointer, wrqu->data.length);
+
+		if( wrqu->data.flags == 0 )
+		intel_widi_wk_cmd(padapter, INTEL_WIDI_ISSUE_PROB_WK, pbuf);
+		else if( wrqu->data.flags == 1 )
+			rtw_set_wfd_rds_sink_info( padapter, (l2_msg_t *)pbuf );
+	}
+	return ret;
+}
+
+#endif // CONFIG_INTEL_WIDI
+
+#ifdef RTL8723A_SDIO_LOOPBACK
+#include <rtl8723a_hal.h>
+
+static s32 initLoopback(PADAPTER padapter)
+{
+	PLOOPBACKDATA ploopback;
+
+
+	if (padapter->ploopback == NULL) {
+		ploopback = (PLOOPBACKDATA)rtw_zmalloc(sizeof(LOOPBACKDATA));
+		if (ploopback == NULL) return -ENOMEM;
+
+		_rtw_init_sema(&ploopback->sema, 0);
+
+		ploopback->bstop = _TRUE;
+		ploopback->cnt = 0;
+		ploopback->size = 300;
+		_rtw_memset(ploopback->msg, 0, sizeof(ploopback->msg));
+
+		padapter->ploopback = ploopback;
+	}
+
+	return 0;
+}
+
+static void freeLoopback(PADAPTER padapter)
+{
+	PLOOPBACKDATA ploopback;
+
+
+	ploopback = padapter->ploopback;
+	if (ploopback) {
+		rtw_mfree((u8*)ploopback, sizeof(LOOPBACKDATA));
+		padapter->ploopback = NULL;
+	}
+}
+
+static s32 initpseudoadhoc(PADAPTER padapter)
+{
+	NDIS_802_11_NETWORK_INFRASTRUCTURE networkType;
+	s32 err;
+	_irqL irqL;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	_queue *queue = &pmlmepriv->scanned_queue;
+
+	networkType = Ndis802_11IBSS;
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	_enter_critical_bh(&queue->lock, &irqL);
+	err = rtw_set_802_11_infrastructure_mode(padapter, networkType);
+	_exit_critical_bh(&queue->lock, &irqL);
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+	if (err == _FALSE) return _FAIL;
+
+	err = rtw_setopmode_cmd(padapter, networkType);
+	if (err == _FAIL) return _FAIL;
+
+	return _SUCCESS;
+}
+
+static s32 createpseudoadhoc(PADAPTER padapter)
+{
+	NDIS_802_11_AUTHENTICATION_MODE authmode;
+	struct mlme_priv *pmlmepriv;
+	NDIS_802_11_SSID *passoc_ssid;
+	WLAN_BSSID_EX *pdev_network;
+	u8 *pibss;
+	u8 ssid[] = "pseduo_ad-hoc";
+	s32 err;
+	_irqL irqL;
+
+
+	pmlmepriv = &padapter->mlmepriv;
+
+	authmode = Ndis802_11AuthModeOpen;
+	err = rtw_set_802_11_authentication_mode(padapter, authmode);
+	if (err == _FALSE) return _FAIL;
+
+	passoc_ssid = &pmlmepriv->assoc_ssid;
+	_rtw_memset(passoc_ssid, 0, sizeof(NDIS_802_11_SSID));
+	passoc_ssid->SsidLength = sizeof(ssid) - 1;
+	_rtw_memcpy(passoc_ssid->Ssid, ssid, passoc_ssid->SsidLength);
+
+	pdev_network = &padapter->registrypriv.dev_network;
+	pibss = padapter->registrypriv.dev_network.MacAddress;
+	_rtw_memcpy(&pdev_network->Ssid, passoc_ssid, sizeof(NDIS_802_11_SSID));
+
+	rtw_update_registrypriv_dev_network(padapter);
+	rtw_generate_random_ibss(pibss);
+
+	_enter_critical_bh(&pmlmepriv->lock, &irqL);
+	pmlmepriv->fw_state = WIFI_ADHOC_MASTER_STATE;
+	_exit_critical_bh(&pmlmepriv->lock, &irqL);
+
+#if 0
+	err = rtw_createbss_cmd(padapter);
+	if (err == _FAIL) return _FAIL;
+#else
+{
+	struct wlan_network *pcur_network;
+	struct sta_info *psta;
+
+	//3  create a new psta
+	pcur_network = &pmlmepriv->cur_network;
+
+	//clear psta in the cur_network, if any
+	psta = rtw_get_stainfo(&padapter->stapriv, pcur_network->network.MacAddress);
+	if (psta) rtw_free_stainfo(padapter, psta);
+
+	psta = rtw_alloc_stainfo(&padapter->stapriv, pibss);
+	if (psta == NULL) return _FAIL;
+
+	//3  join psudo AdHoc
+	pcur_network->join_res = 1;
+	pcur_network->aid = psta->aid = 1;
+	_rtw_memcpy(&pcur_network->network, pdev_network, get_WLAN_BSSID_EX_sz(pdev_network));
+
+	// set msr to WIFI_FW_ADHOC_STATE
+#if 0
+	Set_NETYPE0_MSR(padapter, WIFI_FW_ADHOC_STATE);
+#else
+	{
+		u8 val8;
+
+		val8 = rtw_read8(padapter, MSR);
+		val8 &= 0xFC; // clear NETYPE0
+		val8 |= WIFI_FW_ADHOC_STATE & 0x3;
+		rtw_write8(padapter, MSR, val8);
+	}
+#endif
+}
+#endif
+
+	return _SUCCESS;
+}
+
+extern void rtl8723a_cal_txdesc_chksum(struct tx_desc *ptxdesc);
+extern void rtl8723a_fill_default_txdesc(struct xmit_frame *pxmitframe, u8 *pbuf);
+
+static struct xmit_frame* createloopbackpkt(PADAPTER padapter, u32 size)
+{
+	struct xmit_priv *pxmitpriv;
+	struct xmit_frame *pframe;
+	struct xmit_buf *pxmitbuf;
+	struct pkt_attrib *pattrib;
+	struct tx_desc *desc;
+	u8 *pkt_start, *pkt_end, *ptr;
+	struct rtw_ieee80211_hdr *hdr;
+	s32 bmcast;
+	_irqL irqL;
+
+
+	if ((TXDESC_SIZE + WLANHDR_OFFSET + size) > MAX_XMITBUF_SZ) return NULL;
+
+	pxmitpriv = &padapter->xmitpriv;
+	pframe = NULL;
+
+	//2 1. allocate xmit frame
+	pframe = rtw_alloc_xmitframe(pxmitpriv);
+	if (pframe == NULL) return NULL;
+	pframe->padapter = padapter;
+
+	//2 2. allocate xmit buffer
+	_enter_critical_bh(&pxmitpriv->lock, &irqL);
+	pxmitbuf = rtw_alloc_xmitbuf(pxmitpriv);
+	_exit_critical_bh(&pxmitpriv->lock, &irqL);
+	if (pxmitbuf == NULL) {
+		rtw_free_xmitframe(pxmitpriv, pframe);
+		return NULL;
+	}
+
+	pframe->pxmitbuf = pxmitbuf;
+	pframe->buf_addr = pxmitbuf->pbuf;
+	pxmitbuf->priv_data = pframe;
+
+	//2 3. update_attrib()
+	pattrib = &pframe->attrib;
+
+	// init xmitframe attribute
+	_rtw_memset(pattrib, 0, sizeof(struct pkt_attrib));
+
+	pattrib->ether_type = 0x8723;
+	_rtw_memcpy(pattrib->src, padapter->eeprompriv.mac_addr, ETH_ALEN);
+	_rtw_memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
+	_rtw_memset(pattrib->dst, 0xFF, ETH_ALEN);
+	_rtw_memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
+//	pattrib->pctrl = 0;
+//	pattrib->dhcp_pkt = 0;
+//	pattrib->pktlen = 0;
+	pattrib->ack_policy = 0;
+//	pattrib->pkt_hdrlen = ETH_HLEN;
+	pattrib->hdrlen = WLAN_HDR_A3_LEN;
+	pattrib->subtype = WIFI_DATA;
+	pattrib->priority = 0;
+	pattrib->qsel = pattrib->priority;
+//	do_queue_select(padapter, pattrib);
+	pattrib->nr_frags = 1;
+	pattrib->encrypt = 0;
+	pattrib->bswenc = _FALSE;
+	pattrib->qos_en = _FALSE;
+
+	bmcast = IS_MCAST(pattrib->ra);
+	if (bmcast) {
+		pattrib->mac_id = 1;
+		pattrib->psta = rtw_get_bcmc_stainfo(padapter);
+	} else {
+		pattrib->mac_id = 0;
+		pattrib->psta = rtw_get_stainfo(&padapter->stapriv, get_bssid(&padapter->mlmepriv));
+	}
+
+	pattrib->pktlen = size;
+	pattrib->last_txcmdsz = pattrib->hdrlen + pattrib->pktlen;
+
+	//2 4. fill TX descriptor
+	desc = (struct tx_desc*)pframe->buf_addr;
+	_rtw_memset(desc, 0, TXDESC_SIZE);
+
+	rtl8723a_fill_default_txdesc(pframe, (u8*)desc);
+
+	// Hw set sequence number
+	((PTXDESC)desc)->hwseq_en = 0; // HWSEQ_EN, 0:disable, 1:enable
+//	((PTXDESC)desc)->hwseq_sel = 0; // HWSEQ_SEL
+
+	((PTXDESC)desc)->disdatafb = 1;
+
+	// convert to little endian
+	desc->txdw0 = cpu_to_le32(desc->txdw0);
+	desc->txdw1 = cpu_to_le32(desc->txdw1);
+	desc->txdw2 = cpu_to_le32(desc->txdw2);
+	desc->txdw3 = cpu_to_le32(desc->txdw3);
+	desc->txdw4 = cpu_to_le32(desc->txdw4);
+	desc->txdw5 = cpu_to_le32(desc->txdw5);
+	desc->txdw6 = cpu_to_le32(desc->txdw6);
+	desc->txdw7 = cpu_to_le32(desc->txdw7);
+#ifdef CONFIG_PCI_HCI
+	desc->txdw8 = cpu_to_le32(desc->txdw8);
+	desc->txdw9 = cpu_to_le32(desc->txdw9);
+	desc->txdw10 = cpu_to_le32(desc->txdw10);
+	desc->txdw11 = cpu_to_le32(desc->txdw11);
+	desc->txdw12 = cpu_to_le32(desc->txdw12);
+	desc->txdw13 = cpu_to_le32(desc->txdw13);
+	desc->txdw14 = cpu_to_le32(desc->txdw14);
+	desc->txdw15 = cpu_to_le32(desc->txdw15);
+#endif
+
+	rtl8723a_cal_txdesc_chksum(desc);
+
+	//2 5. coalesce
+	pkt_start = pframe->buf_addr + TXDESC_SIZE;
+	pkt_end = pkt_start + pattrib->last_txcmdsz;
+
+	//3 5.1. make wlan header, make_wlanhdr()
+	hdr = (struct rtw_ieee80211_hdr *)pkt_start;
+	SetFrameSubType(&hdr->frame_ctl, pattrib->subtype);
+	_rtw_memcpy(hdr->addr1, pattrib->dst, ETH_ALEN); // DA
+	_rtw_memcpy(hdr->addr2, pattrib->src, ETH_ALEN); // SA
+	_rtw_memcpy(hdr->addr3, get_bssid(&padapter->mlmepriv), ETH_ALEN); // RA, BSSID
+
+	//3 5.2. make payload
+	ptr = pkt_start + pattrib->hdrlen;
+	get_random_bytes(ptr, pkt_end - ptr);
+
+	pxmitbuf->len = TXDESC_SIZE + pattrib->last_txcmdsz;
+	pxmitbuf->ptail += pxmitbuf->len;
+
+	return pframe;
+}
+
+static void freeloopbackpkt(PADAPTER padapter, struct xmit_frame *pframe)
+{
+	struct xmit_priv *pxmitpriv;
+	struct xmit_buf *pxmitbuf;
+
+
+	pxmitpriv = &padapter->xmitpriv;
+	pxmitbuf = pframe->pxmitbuf;
+
+	rtw_free_xmitframe(pxmitpriv, pframe);
+	rtw_free_xmitbuf(pxmitpriv, pxmitbuf);
+}
+
+extern u32 get_txfifo_hwaddr(struct xmit_frame *pxmitframe);
+
+thread_return lbk_thread(thread_context context)
+{
+	s32 err;
+	PADAPTER padapter;
+	PLOOPBACKDATA ploopback;
+	struct xmit_frame *pxmitframe;
+	u32 cnt, ok, fail, i, headerlen;
+	u32 pktsize;
+	u32 ff_hwaddr;
+
+
+	padapter = (PADAPTER)context;
+	ploopback = padapter->ploopback;
+	if (ploopback == NULL) return -1;
+	cnt = 0;
+	ok = 0;
+	fail = 0;
+
+	daemonize("%s", "RTW_LBK_THREAD");
+	allow_signal(SIGTERM);
+
+	do {
+		if (ploopback->size == 0) {
+			get_random_bytes(&pktsize, 4);
+			pktsize = (pktsize % 1535) + 1; // 1~1535
+		} else
+			pktsize = ploopback->size;
+
+		pxmitframe = createloopbackpkt(padapter, pktsize);
+		if (pxmitframe == NULL) {
+			sprintf(ploopback->msg, "loopback FAIL! 3. create Packet FAIL!");
+			break;
+		}
+
+		ploopback->txsize = TXDESC_SIZE + pxmitframe->attrib.last_txcmdsz;
+		_rtw_memcpy(ploopback->txbuf, pxmitframe->buf_addr, ploopback->txsize);
+
+		ff_hwaddr = get_txfifo_hwaddr(pxmitframe);
+		rtw_write_port(padapter, ff_hwaddr, ploopback->txsize, ploopback->txbuf);
+		cnt++;
+
+		_rtw_down_sema(&ploopback->sema);
+
+{
+		PHAL_DATA_TYPE phal;
+		struct recv_stat *prxstat;
+		struct recv_stat report;
+		PRXREPORT prxreport;
+		u32 drvinfosize;
+		u32 rxpktsize;
+		u8 fcssize;
+
+		prxstat = (struct recv_stat*)ploopback->rxbuf;
+		report.rxdw0 = le32_to_cpu(prxstat->rxdw0);
+		report.rxdw1 = le32_to_cpu(prxstat->rxdw1);
+		report.rxdw2 = le32_to_cpu(prxstat->rxdw2);
+		report.rxdw3 = le32_to_cpu(prxstat->rxdw3);
+		report.rxdw4 = le32_to_cpu(prxstat->rxdw4);
+		report.rxdw5 = le32_to_cpu(prxstat->rxdw5);
+
+		prxreport = (PRXREPORT)&report;
+		drvinfosize = prxreport->drvinfosize << 3;
+		rxpktsize = prxreport->pktlen;
+
+		phal = GET_HAL_DATA(padapter);
+		if (phal->ReceiveConfig & RCR_APPFCS) fcssize = IEEE80211_FCS_LEN;
+		else fcssize = 0;
+
+		if ((ploopback->txsize - TXDESC_SIZE) != (rxpktsize - fcssize)) {
+			printk("%s: cnt=%d, size not match! tx=%d rx=%d\n",
+				__func__, i, ploopback->txsize - TXDESC_SIZE,
+				rxpktsize - fcssize);
+			err = _FALSE;
+		} else {
+			err = _rtw_memcmp(ploopback->txbuf + TXDESC_SIZE,\
+							  ploopback->rxbuf + RXDESC_SIZE + drvinfosize,\
+							  ploopback->txsize - TXDESC_SIZE);
+		}
+}
+
+		if (err == _TRUE)
+			ok++;
+		else
+			fail++;
+
+		ploopback->txsize = 0;
+		_rtw_memset(ploopback->txbuf, 0, 0x8000);
+		ploopback->rxsize = 0;
+		_rtw_memset(ploopback->rxbuf, 0, 0x8000);
+
+		freeloopbackpkt(padapter, pxmitframe);
+		pxmitframe = NULL;
+
+		if (signal_pending(current)) {
+			flush_signals(current);
+		}
+
+		if ((ploopback->bstop == _TRUE) ||
+			((ploopback->cnt != 0) && (ploopback->cnt == cnt)))
+		{
+			u32 ok_rate, fail_rate;
+			ok_rate = (ok*100)/cnt;
+			fail_rate = (fail*100)/cnt;
+			sprintf(ploopback->msg, "loopback result: ok=%d%%(%d/%d),error=%d%%(%d/%d)", ok_rate, ok, cnt, fail_rate, fail, cnt);
+			break;
+		}
+	} while (1);
+
+	ploopback->bstop = _TRUE;
+
+	thread_exit();
+}
+
+static void loopbackTest(PADAPTER padapter, u32 cnt, u32 size, u8* pmsg)
+{
+	PLOOPBACKDATA ploopback;
+	u32 len;
+	s32 err;
+
+
+	ploopback = padapter->ploopback;
+
+	if (ploopback)
+	{
+		ploopback->bstop = _TRUE;
+		len = 0;
+		do {
+			len = strlen(ploopback->msg);
+			if (len) break;
+			rtw_msleep_os(1);
+		} while (1);
+		_rtw_memcpy(pmsg, ploopback->msg, len+1);
+		freeLoopback(padapter);
+		return;
+	}
+
+	// create pseudo ad-hoc connection
+	err = initpseudoadhoc(padapter);
+	if (err == _FAIL) {
+		sprintf(pmsg, "loopback FAIL! 1.1 init ad-hoc FAIL!");
+		return;
+	}
+
+	err = createpseudoadhoc(padapter);
+	if (err == _FAIL) {
+		sprintf(pmsg, "loopback FAIL! 1.2 create ad-hoc master FAIL!");
+		return;
+	}
+
+	err = initLoopback(padapter);
+	if (err) {
+		sprintf(pmsg, "loopback FAIL! 2. init FAIL! error code=%d", err);
+		return;
+	}
+
+	ploopback = padapter->ploopback;
+
+	ploopback->bstop = _FALSE;
+	ploopback->cnt = cnt;
+	ploopback->size = size;
+	ploopback->lbkthread = kthread_run(lbk_thread, padapter, "RTW_LBK_THREAD");
+	if (IS_ERR(padapter->lbkthread))
+	{
+		freeLoopback(padapter);
+		sprintf(pmsg, "loopback start FAIL! cnt=%d", cnt);
+		return;
+	}
+
+	sprintf(pmsg, "loopback start! cnt=%d", cnt);
+}
+
+extern u8 _InitPowerOn(PADAPTER padapter);
+extern s32 rtl8723a_FirmwareDownload(PADAPTER padapter);
+
+static int rtw_test(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	union iwreq_data *wrqu, char *extra)
+{
+	u32 len;
+	u8 *pbuf, *pch;
+	char *ptmp;
+	u8 *delim = ",";
+	PADAPTER padapter = rtw_netdev_priv(dev);
+
+
+	printk("+%s\n", __func__);
+	len = wrqu->data.length;
+
+	pbuf = (u8*)rtw_zmalloc(len);
+	if (pbuf == NULL) {
+		printk("%s: no memory!\n", __func__);
+		return -ENOMEM;
+	}
+
+	if (copy_from_user(pbuf, wrqu->data.pointer, len)) {
+		rtw_mfree(pbuf, len);
+		printk("%s: copy from user fail!\n", __func__);
+		return -EFAULT;
+	}
+	printk("%s: string=\"%s\"\n", __func__, pbuf);
+
+	ptmp = (char*)pbuf;
+	pch = strsep(&ptmp, delim);
+	if ((pch == NULL) || (strlen(pch) == 0)) {
+		rtw_mfree(pbuf, len);
+		printk("%s: parameter error(level 1)!\n", __func__);
+		return -EFAULT;
+	}
+
+#ifdef RTL8723A_SDIO_LOOPBACK
+	if (strcmp(pch, "loopback") == 0)
+	{
+		s32 cnt = 0;
+		u32 size = 64;
+
+		pch = strsep(&ptmp, delim);
+		if ((pch == NULL) || (strlen(pch) == 0)) {
+			rtw_mfree(pbuf, len);
+			printk("%s: parameter error(level 2)!\n", __func__);
+			return -EFAULT;
+		}
+
+		sscanf(pch, "%d", &cnt);
+		printk("%s: loopback cnt=%d\n", __func__, cnt);
+
+		pch = strsep(&ptmp, delim);
+		if ((pch == NULL) || (strlen(pch) == 0)) {
+			rtw_mfree(pbuf, len);
+			printk("%s: parameter error(level 2)!\n", __func__);
+			return -EFAULT;
+		}
+
+		sscanf(pch, "%d", &size);
+		printk("%s: loopback size=%d\n", __func__, size);
+
+		loopbackTest(padapter, cnt, size, extra);
+		wrqu->data.length = strlen(extra) + 1;
+
+		rtw_mfree(pbuf, len);
+		return 0;
+	}
+#endif
+
+	if (strcmp(pch, "poweron") == 0)
+	{
+		s32 ret;
+
+		ret = _InitPowerOn(padapter);
+		if (_FAIL == ret)
+			printk("%s: power on FAIL!\n", __func__);
+		else
+			printk("%s: power on OK.\n", __func__);
+
+		rtw_mfree(pbuf, len);
+		return 0;
+	}
+
+	if (strcmp(pch, "dlfw") == 0)
+	{
+		s32 ret;
+
+		ret = rtl8723a_FirmwareDownload(padapter);
+		if (_FAIL == ret)
+			printk("%s: download FW FAIL!\n", __func__);
+		else
+			printk("%s: download FW OK.\n", __func__);
+
+		rtw_mfree(pbuf, len);
+		return 0;
+	}
+
+	rtw_mfree(pbuf, len);
+	return 0;
+}
+#else
+static int rtw_test(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	union iwreq_data *wrqu, char *extra)
+{
+	printk("%s\n", __func__);
+	return 0;
+}
+#endif //RTL8723A_SDIO_LOOPBACK
+
+#include <rtw_android.h>
+int rtw_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+{
+	struct iwreq *wrq = (struct iwreq *)rq;
+	int ret=0;
+
+	switch (cmd)
+	{
+	    case RTL_IOCTL_WPA_SUPPLICANT:
+			ret = wpa_supplicant_ioctl(dev, &wrq->u.data);
+			break;
+#ifdef CONFIG_AP_MODE
+		case RTL_IOCTL_HOSTAPD:
+			ret = rtw_hostapd_ioctl(dev, &wrq->u.data);
+			break;
+#ifdef CONFIG_NO_WIRELESS_HANDLERS
+		case SIOCSIWMODE:
+			ret = rtw_wx_set_mode(dev, NULL, &wrq->u, NULL);
+			break;
+#endif
+#endif
+		case (SIOCDEVPRIVATE+1):
+			ret = rtw_android_priv_cmd(dev, rq, cmd);
+			break;
+	    default:
+			ret = -EOPNOTSUPP;
+			break;
+	}
+
+	return ret;
+}
+
+static iw_handler rtw_handlers[] =
+{
+	NULL,					/* SIOCSIWCOMMIT */
+	rtw_wx_get_name,		/* SIOCGIWNAME */
+	dummy,					/* SIOCSIWNWID */
+	dummy,					/* SIOCGIWNWID */
+	rtw_wx_set_freq,		/* SIOCSIWFREQ */
+	rtw_wx_get_freq,		/* SIOCGIWFREQ */
+	rtw_wx_set_mode,		/* SIOCSIWMODE */
+	rtw_wx_get_mode,		/* SIOCGIWMODE */
+	dummy,					/* SIOCSIWSENS */
+	rtw_wx_get_sens,		/* SIOCGIWSENS */
+	NULL,					/* SIOCSIWRANGE */
+	rtw_wx_get_range,		/* SIOCGIWRANGE */
+	rtw_wx_set_priv,		/* SIOCSIWPRIV */
+	NULL,					/* SIOCGIWPRIV */
+	NULL,					/* SIOCSIWSTATS */
+	NULL,					/* SIOCGIWSTATS */
+	dummy,					/* SIOCSIWSPY */
+	dummy,					/* SIOCGIWSPY */
+	NULL,					/* SIOCGIWTHRSPY */
+	NULL,					/* SIOCWIWTHRSPY */
+	rtw_wx_set_wap,		/* SIOCSIWAP */
+	rtw_wx_get_wap,		/* SIOCGIWAP */
+	rtw_wx_set_mlme,		/* request MLME operation; uses struct iw_mlme */
+	dummy,					/* SIOCGIWAPLIST -- depricated */
+	rtw_wx_set_scan,		/* SIOCSIWSCAN */
+	rtw_wx_get_scan,		/* SIOCGIWSCAN */
+	rtw_wx_set_essid,		/* SIOCSIWESSID */
+	rtw_wx_get_essid,		/* SIOCGIWESSID */
+	dummy,					/* SIOCSIWNICKN */
+	rtw_wx_get_nick,		/* SIOCGIWNICKN */
+	NULL,					/* -- hole -- */
+	NULL,					/* -- hole -- */
+	rtw_wx_set_rate,		/* SIOCSIWRATE */
+	rtw_wx_get_rate,		/* SIOCGIWRATE */
+	rtw_wx_set_rts,			/* SIOCSIWRTS */
+	rtw_wx_get_rts,			/* SIOCGIWRTS */
+	rtw_wx_set_frag,		/* SIOCSIWFRAG */
+	rtw_wx_get_frag,		/* SIOCGIWFRAG */
+	dummy,					/* SIOCSIWTXPOW */
+	dummy,					/* SIOCGIWTXPOW */
+	dummy,					/* SIOCSIWRETRY */
+	rtw_wx_get_retry,		/* SIOCGIWRETRY */
+	rtw_wx_set_enc,			/* SIOCSIWENCODE */
+	rtw_wx_get_enc,			/* SIOCGIWENCODE */
+	dummy,					/* SIOCSIWPOWER */
+	rtw_wx_get_power,		/* SIOCGIWPOWER */
+	NULL,					/*---hole---*/
+	NULL,					/*---hole---*/
+	rtw_wx_set_gen_ie,		/* SIOCSIWGENIE */
+	NULL,					/* SIOCGWGENIE */
+	rtw_wx_set_auth,		/* SIOCSIWAUTH */
+	NULL,					/* SIOCGIWAUTH */
+	rtw_wx_set_enc_ext,		/* SIOCSIWENCODEEXT */
+	NULL,					/* SIOCGIWENCODEEXT */
+	rtw_wx_set_pmkid,		/* SIOCSIWPMKSA */
+	NULL,					/*---hole---*/
+};
+
+#if defined(CONFIG_MP_INCLUDED) && defined(CONFIG_MP_IWPRIV_SUPPORT)
+
+static const struct iw_priv_args rtw_private_args[] =
+{
+	{ SIOCIWFIRSTPRIV + 0x00, IW_PRIV_TYPE_CHAR | 1024, 0 , ""},  //set
+	{ SIOCIWFIRSTPRIV + 0x01, IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK , ""},//get
+/* --- sub-ioctls definitions --- */
+		{ MP_START , IW_PRIV_TYPE_CHAR | 1024, 0, "mp_start" }, //set
+		{ MP_PHYPARA, IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_phypara" },//get
+		{ MP_STOP , IW_PRIV_TYPE_CHAR | 1024, 0, "mp_stop" }, //set
+		{ MP_CHANNEL , IW_PRIV_TYPE_CHAR | 1024 , IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_channel" },//get
+		{ MP_BANDWIDTH , IW_PRIV_TYPE_CHAR | 1024, 0, "mp_bandwidth"}, //set
+		{ MP_RATE , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_rate" },//get
+		{ MP_RESET_STATS , IW_PRIV_TYPE_CHAR | 1024, 0, "mp_reset_stats"},
+		{ MP_QUERY , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK , "mp_query"}, //get
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ READ_REG , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "read_reg" },
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ MP_RATE , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_rate" },
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ READ_RF , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "read_rf" },
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ MP_PSD , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_psd"},
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ MP_DUMP, IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_dump" },
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ MP_TXPOWER , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_txpower"},
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ MP_ANT_TX , IW_PRIV_TYPE_CHAR | 1024,  IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_ant_tx"},
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ MP_ANT_RX , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_ant_rx"},
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ WRITE_REG , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "write_reg" },
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ WRITE_RF , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "write_rf" },
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ MP_CTX , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_ctx"},
+		{ MP_NULL, IW_PRIV_TYPE_CHAR | 128, 0,"NULL"},//set
+		{ MP_ARX , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_arx"},
+		{ MP_ANT_RX , IW_PRIV_TYPE_CHAR | 1024, 0, "mp_ant_rx"},
+		{ MP_THER , IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_ther"},
+		{ EFUSE_SET, IW_PRIV_TYPE_CHAR | 1024, 0, "efuse_set" },
+		{ EFUSE_GET, IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "efuse_get" },
+		{ MP_NULL , IW_PRIV_TYPE_CHAR | 1024, 0, "NULL"},
+		{ MP_PWRTRK, IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "mp_pwrtrk" },
+		{ MP_IOCTL, IW_PRIV_TYPE_CHAR | 1024, 0, "mp_ioctl"}, // mp_ioctl
+
+
+	{ SIOCIWFIRSTPRIV + 0x02, IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK , "test"},//set
+};
+
+
+static iw_handler rtw_private_handler[] =
+{
+	rtw_mp_set,
+	rtw_mp_get,
+};
+
+#else // not inlucde MP
+
+static const struct iw_priv_args rtw_private_args[] = {
+	{
+		SIOCIWFIRSTPRIV + 0x0,
+		IW_PRIV_TYPE_CHAR | 0x7FF, 0, "write"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x1,
+		IW_PRIV_TYPE_CHAR | 0x7FF,
+		IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | IFNAMSIZ, "read"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x2, 0, 0, "driver_ext"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x3, 0, 0, "mp_ioctl"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x4,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "apinfo"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x5,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, 0, "setpid"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x6,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "wps_start"
+	},
+//for PLATFORM_MT53XX
+	{
+		SIOCIWFIRSTPRIV + 0x7,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "get_sensitivity"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x8,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "wps_prob_req_ie"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x9,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "wps_assoc_req_ie"
+	},
+
+//for RTK_DMP_PLATFORM
+	{
+		SIOCIWFIRSTPRIV + 0xA,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "channel_plan"
+	},
+
+	{
+		SIOCIWFIRSTPRIV + 0xB,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, 0, "dbg"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0xC,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 3, 0, "rfw"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0xD,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | IFNAMSIZ, "rfr"
+	},
+#ifdef CONFIG_WOWLAN
+	{
+		SIOCIWFIRSTPRIV + 0xE,0,0, "wowlan_ctrl"
+	},
+#endif // CONFIG_WOWLAN
+	{
+		SIOCIWFIRSTPRIV + 0x10,
+		IW_PRIV_TYPE_CHAR | 1024, 0, "p2p_set"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x11,
+		IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK , "p2p_get"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x12, 0, 0, "NULL"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x13,
+		IW_PRIV_TYPE_CHAR | 64, IW_PRIV_TYPE_CHAR | 64 , "p2p_get2"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x14,
+		IW_PRIV_TYPE_CHAR  | 64, 0, "tdls"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x15,
+		IW_PRIV_TYPE_CHAR | P2P_PRIVATE_IOCTL_SET_LEN, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | P2P_PRIVATE_IOCTL_SET_LEN , "tdls_get"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x16,
+		IW_PRIV_TYPE_CHAR | 64, 0, "pm_set"
+	},
+
+	{SIOCIWFIRSTPRIV + 0x18, IW_PRIV_TYPE_CHAR | IFNAMSIZ , 0 , "rereg_nd_name"},
+
+	{SIOCIWFIRSTPRIV + 0x1A, IW_PRIV_TYPE_CHAR | 128, 0, "efuse_set"},
+	{SIOCIWFIRSTPRIV + 0x1B, IW_PRIV_TYPE_CHAR | 128, IW_PRIV_TYPE_CHAR |IW_PRIV_SIZE_FIXED |0x700 ,"efuse_get"},
+	{
+		SIOCIWFIRSTPRIV + 0x1D,
+		IW_PRIV_TYPE_CHAR | 40, IW_PRIV_TYPE_CHAR | 0x7FF, "test"
+	},
+#ifdef CONFIG_INTEL_WIDI
+	{
+		SIOCIWFIRSTPRIV + 0x1E,
+		IW_PRIV_TYPE_CHAR | 1024, 0, "widi_set"
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x1F,
+		IW_PRIV_TYPE_CHAR | 128, 0, "widi_prob_req"
+	},
+#endif // CONFIG_INTEL_WIDI
+};
+
+static iw_handler rtw_private_handler[] =
+{
+	rtw_wx_write32,					//0x00
+	rtw_wx_read32,					//0x01
+	rtw_drvext_hdl,					//0x02
+	rtw_mp_ioctl_hdl,				//0x03
+
+// for MM DTV platform
+	rtw_get_ap_info,					//0x04
+
+	rtw_set_pid,						//0x05
+	rtw_wps_start,					//0x06
+
+// for PLATFORM_MT53XX
+	rtw_wx_get_sensitivity,			//0x07
+	rtw_wx_set_mtk_wps_probe_ie,	//0x08
+	rtw_wx_set_mtk_wps_ie,			//0x09
+
+// for RTK_DMP_PLATFORM
+// Set Channel depend on the country code
+	rtw_wx_set_channel_plan,		//0x0A
+
+	rtw_dbg_port,					//0x0B
+	rtw_wx_write_rf,					//0x0C
+	rtw_wx_read_rf,					//0x0D
+
+#ifdef CONFIG_WOWLAN
+	rtw_wowlan_ctrl,					//0x0E
+#else
+	rtw_wx_priv_null,				//0x0E
+#endif //CONFIG_WOWLAN
+	rtw_wx_priv_null,				//0x0F
+
+	rtw_p2p_set,					//0x10
+	rtw_p2p_get,					//0x11
+	NULL,							//0x12
+	rtw_p2p_get2,					//0x13
+
+	rtw_tdls,						//0x14
+	rtw_tdls_get,					//0x15
+
+	rtw_pm_set,						//0x16
+	rtw_wx_priv_null,				//0x17
+	rtw_rereg_nd_name,				//0x18
+	rtw_wx_priv_null,				//0x19
+
+	rtw_mp_efuse_set,				//0x1A
+	rtw_mp_efuse_get,				//0x1B
+	NULL,							// 0x1C is reserved for hostapd
+	rtw_test	,						// 0x1D
+#ifdef CONFIG_INTEL_WIDI
+	rtw_widi_set,					//0x1E
+	rtw_widi_set_probe_request,		//0x1F
+#endif // CONFIG_INTEL_WIDI
+};
+
+#endif // #if defined(CONFIG_MP_INCLUDED) && defined(CONFIG_MP_IWPRIV_SUPPORT)
+
+#if WIRELESS_EXT >= 17
+static struct iw_statistics *rtw_get_wireless_stats(struct net_device *dev)
+{
+       _adapter *padapter = (_adapter *)rtw_netdev_priv(dev);
+	   struct iw_statistics *piwstats=&padapter->iwstats;
+	int tmp_level = 0;
+	int tmp_qual = 0;
+	int tmp_noise = 0;
+
+	if (check_fwstate(&padapter->mlmepriv, _FW_LINKED) != _TRUE)
+	{
+		piwstats->qual.qual = 0;
+		piwstats->qual.level = 0;
+		piwstats->qual.noise = 0;
+		//DBG_871X("No link  level:%d, qual:%d, noise:%d\n", tmp_level, tmp_qual, tmp_noise);
+	}
+	else{
+		#ifdef CONFIG_SIGNAL_DISPLAY_DBM
+		tmp_level = translate_percentage_to_dbm(padapter->recvpriv.signal_strength);
+		#else
+		tmp_level = padapter->recvpriv.signal_strength;
+		#endif
+
+		tmp_qual = padapter->recvpriv.signal_qual;
+		tmp_noise =padapter->recvpriv.noise;
+		//DBG_871X("level:%d, qual:%d, noise:%d, rssi (%d)\n", tmp_level, tmp_qual, tmp_noise,padapter->recvpriv.rssi);
+
+		piwstats->qual.level = tmp_level;
+		piwstats->qual.qual = tmp_qual;
+		piwstats->qual.noise = tmp_noise;
+	}
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,14))
+	piwstats->qual.updated = IW_QUAL_ALL_UPDATED ;//|IW_QUAL_DBM;
+#else
+#ifdef RTK_DMP_PLATFORM
+	//IW_QUAL_DBM= 0x8, if driver use this flag, wireless extension will show value of dbm.
+	//remove this flag for show percentage 0~100
+	piwstats->qual.updated = 0x07;
+#else
+	piwstats->qual.updated = 0x0f;
+#endif
+#endif
+
+	#ifdef CONFIG_SIGNAL_DISPLAY_DBM
+	piwstats->qual.updated = piwstats->qual.updated | IW_QUAL_DBM;
+	#endif
+
+	return &padapter->iwstats;
+}
+#endif
+
+#ifdef CONFIG_WIRELESS_EXT
+struct iw_handler_def rtw_handlers_def =
+{
+	.standard = rtw_handlers,
+	.num_standard = sizeof(rtw_handlers) / sizeof(iw_handler),
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,33)) || defined(CONFIG_WEXT_PRIV)
+	.private = rtw_private_handler,
+	.private_args = (struct iw_priv_args *)rtw_private_args,
+	.num_private = sizeof(rtw_private_handler) / sizeof(iw_handler),
+	.num_private_args = sizeof(rtw_private_args) / sizeof(struct iw_priv_args),
+#endif
+#if WIRELESS_EXT >= 17
+	.get_wireless_stats = rtw_get_wireless_stats,
+#endif
+};
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/mlme_linux.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/mlme_linux.c
new file mode 100644
index 000000000000..d5183950afd9
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/mlme_linux.c
@@ -0,0 +1,585 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+
+#define _MLME_OSDEP_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <mlme_osdep.h>
+
+
+#ifdef RTK_DMP_PLATFORM
+void Linkup_workitem_callback(struct work_struct *work)
+{
+	struct mlme_priv *pmlmepriv = container_of(work, struct mlme_priv, Linkup_workitem);
+	_adapter *padapter = container_of(pmlmepriv, _adapter, mlmepriv);
+
+_func_enter_;
+
+	RT_TRACE(_module_mlme_osdep_c_,_drv_info_,("+ Linkup_workitem_callback\n"));
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,12))
+	kobject_uevent(&padapter->pnetdev->dev.kobj, KOBJ_LINKUP);
+#else
+	kobject_hotplug(&padapter->pnetdev->class_dev.kobj, KOBJ_LINKUP);
+#endif
+
+_func_exit_;
+}
+
+void Linkdown_workitem_callback(struct work_struct *work)
+{
+	struct mlme_priv *pmlmepriv = container_of(work, struct mlme_priv, Linkdown_workitem);
+	_adapter *padapter = container_of(pmlmepriv, _adapter, mlmepriv);
+
+_func_enter_;
+
+	RT_TRACE(_module_mlme_osdep_c_,_drv_info_,("+ Linkdown_workitem_callback\n"));
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,12))
+	kobject_uevent(&padapter->pnetdev->dev.kobj, KOBJ_LINKDOWN);
+#else
+	kobject_hotplug(&padapter->pnetdev->class_dev.kobj, KOBJ_LINKDOWN);
+#endif
+
+_func_exit_;
+}
+#endif
+
+
+/*
+void sitesurvey_ctrl_handler(void *FunctionContext)
+{
+	_adapter *adapter = (_adapter *)FunctionContext;
+
+	_sitesurvey_ctrl_handler(adapter);
+
+	_set_timer(&adapter->mlmepriv.sitesurveyctrl.sitesurvey_ctrl_timer, 3000);
+}
+*/
+
+void rtw_join_timeout_handler (void *FunctionContext)
+{
+	_adapter *adapter = (_adapter *)FunctionContext;
+	_rtw_join_timeout_handler(adapter);
+}
+
+
+void _rtw_scan_timeout_handler (void *FunctionContext)
+{
+	_adapter *adapter = (_adapter *)FunctionContext;
+	rtw_scan_timeout_handler(adapter);
+}
+
+
+void _dynamic_check_timer_handlder (void *FunctionContext)
+{
+	_adapter *adapter = (_adapter *)FunctionContext;
+
+	rtw_dynamic_check_timer_handlder(adapter);
+
+	_set_timer(&adapter->mlmepriv.dynamic_chk_timer, 2000);
+}
+
+#ifdef CONFIG_SET_SCAN_DENY_TIMER
+void _rtw_set_scan_deny_timer_hdl(void *FunctionContext)
+{
+	_adapter *adapter = (_adapter *)FunctionContext;
+	rtw_set_scan_deny_timer_hdl(adapter);
+}
+#endif
+
+
+void rtw_init_mlme_timer(_adapter *padapter)
+{
+	struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+	_init_timer(&(pmlmepriv->assoc_timer), padapter->pnetdev, rtw_join_timeout_handler, padapter);
+	//_init_timer(&(pmlmepriv->sitesurveyctrl.sitesurvey_ctrl_timer), padapter->pnetdev, sitesurvey_ctrl_handler, padapter);
+	_init_timer(&(pmlmepriv->scan_to_timer), padapter->pnetdev, _rtw_scan_timeout_handler, padapter);
+
+	_init_timer(&(pmlmepriv->dynamic_chk_timer), padapter->pnetdev, _dynamic_check_timer_handlder, padapter);
+
+	#ifdef CONFIG_SET_SCAN_DENY_TIMER
+	_init_timer(&(pmlmepriv->set_scan_deny_timer), padapter->pnetdev, _rtw_set_scan_deny_timer_hdl, padapter);
+	#endif
+
+#ifdef RTK_DMP_PLATFORM
+	_init_workitem(&(pmlmepriv->Linkup_workitem), Linkup_workitem_callback, padapter);
+	_init_workitem(&(pmlmepriv->Linkdown_workitem), Linkdown_workitem_callback, padapter);
+#endif
+
+}
+
+extern void rtw_indicate_wx_assoc_event(_adapter *padapter);
+extern void rtw_indicate_wx_disassoc_event(_adapter *padapter);
+
+void rtw_os_indicate_connect(_adapter *adapter)
+{
+
+_func_enter_;
+
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_cfg80211_indicate_connect(adapter);
+#endif //CONFIG_IOCTL_CFG80211
+
+	rtw_indicate_wx_assoc_event(adapter);
+	netif_carrier_on(adapter->pnetdev);
+
+	if(adapter->pid[2] !=0)
+		rtw_signal_process(adapter->pid[2], SIGALRM);
+
+#ifdef RTK_DMP_PLATFORM
+	_set_workitem(&adapter->mlmepriv.Linkup_workitem);
+#endif
+
+_func_exit_;
+
+}
+
+extern void indicate_wx_scan_complete_event(_adapter *padapter);
+void rtw_os_indicate_scan_done( _adapter *padapter, bool aborted)
+{
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_cfg80211_indicate_scan_done(wdev_to_priv(padapter->rtw_wdev), aborted);
+#endif
+	indicate_wx_scan_complete_event(padapter);
+}
+
+static RT_PMKID_LIST   backupPMKIDList[ NUM_PMKID_CACHE ];
+void rtw_reset_securitypriv( _adapter *adapter )
+{
+	u8	backupPMKIDIndex = 0;
+	u8	backupTKIPCountermeasure = 0x00;
+	u32	backupTKIPcountermeasure_time = 0;
+	// add for CONFIG_IEEE80211W, none 11w also can use
+	_irqL irqL;
+	struct mlme_ext_priv	*pmlmeext = &adapter->mlmeextpriv;
+
+	_enter_critical_bh(&adapter->security_key_mutex, &irqL);
+
+	if(adapter->securitypriv.dot11AuthAlgrthm == dot11AuthAlgrthm_8021X)//802.1x
+	{
+		// Added by Albert 2009/02/18
+		// We have to backup the PMK information for WiFi PMK Caching test item.
+		//
+		// Backup the btkip_countermeasure information.
+		// When the countermeasure is trigger, the driver have to disconnect with AP for 60 seconds.
+
+		_rtw_memset( &backupPMKIDList[ 0 ], 0x00, sizeof( RT_PMKID_LIST ) * NUM_PMKID_CACHE );
+
+		_rtw_memcpy( &backupPMKIDList[ 0 ], &adapter->securitypriv.PMKIDList[ 0 ], sizeof( RT_PMKID_LIST ) * NUM_PMKID_CACHE );
+		backupPMKIDIndex = adapter->securitypriv.PMKIDIndex;
+		backupTKIPCountermeasure = adapter->securitypriv.btkip_countermeasure;
+		backupTKIPcountermeasure_time = adapter->securitypriv.btkip_countermeasure_time;
+#ifdef CONFIG_IEEE80211W
+		//reset RX BIP packet number
+		pmlmeext->mgnt_80211w_IPN_rx = 0;
+#endif //CONFIG_IEEE80211W
+		_rtw_memset((unsigned char *)&adapter->securitypriv, 0, sizeof (struct security_priv));
+		//_init_timer(&(adapter->securitypriv.tkip_timer),adapter->pnetdev, rtw_use_tkipkey_handler, adapter);
+
+		// Added by Albert 2009/02/18
+		// Restore the PMK information to securitypriv structure for the following connection.
+		_rtw_memcpy( &adapter->securitypriv.PMKIDList[ 0 ], &backupPMKIDList[ 0 ], sizeof( RT_PMKID_LIST ) * NUM_PMKID_CACHE );
+		adapter->securitypriv.PMKIDIndex = backupPMKIDIndex;
+		adapter->securitypriv.btkip_countermeasure = backupTKIPCountermeasure;
+		adapter->securitypriv.btkip_countermeasure_time = backupTKIPcountermeasure_time;
+
+		adapter->securitypriv.ndisauthtype = Ndis802_11AuthModeOpen;
+		adapter->securitypriv.ndisencryptstatus = Ndis802_11WEPDisabled;
+
+	}
+	else //reset values in securitypriv
+	{
+		//if(adapter->mlmepriv.fw_state & WIFI_STATION_STATE)
+		//{
+		struct security_priv *psec_priv=&adapter->securitypriv;
+
+		psec_priv->dot11AuthAlgrthm =dot11AuthAlgrthm_Open;  //open system
+		psec_priv->dot11PrivacyAlgrthm = _NO_PRIVACY_;
+		psec_priv->dot11PrivacyKeyIndex = 0;
+
+		psec_priv->dot118021XGrpPrivacy = _NO_PRIVACY_;
+		psec_priv->dot118021XGrpKeyid = 1;
+
+		psec_priv->ndisauthtype = Ndis802_11AuthModeOpen;
+		psec_priv->ndisencryptstatus = Ndis802_11WEPDisabled;
+		//}
+	}
+	// add for CONFIG_IEEE80211W, none 11w also can use
+	_exit_critical_bh(&adapter->security_key_mutex, &irqL);
+}
+
+void rtw_os_indicate_disconnect( _adapter *adapter )
+{
+   //RT_PMKID_LIST   backupPMKIDList[ NUM_PMKID_CACHE ];
+
+_func_enter_;
+
+	netif_carrier_off(adapter->pnetdev); // Do it first for tx broadcast pkt after disconnection issue!
+
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_cfg80211_indicate_disconnect(adapter);
+#endif //CONFIG_IOCTL_CFG80211
+
+	rtw_indicate_wx_disassoc_event(adapter);
+
+#ifdef RTK_DMP_PLATFORM
+	_set_workitem(&adapter->mlmepriv.Linkdown_workitem);
+#endif
+	 //modify for CONFIG_IEEE80211W, none 11w also can use the same command
+	 rtw_reset_securitypriv_cmd(adapter);
+
+_func_exit_;
+
+}
+
+void rtw_report_sec_ie(_adapter *adapter,u8 authmode,u8 *sec_ie)
+{
+	uint	len;
+	u8	*buff,*p,i;
+	union iwreq_data wrqu;
+
+_func_enter_;
+
+	RT_TRACE(_module_mlme_osdep_c_,_drv_info_,("+rtw_report_sec_ie, authmode=%d\n", authmode));
+
+	buff = NULL;
+	if(authmode==_WPA_IE_ID_)
+	{
+		RT_TRACE(_module_mlme_osdep_c_,_drv_info_,("rtw_report_sec_ie, authmode=%d\n", authmode));
+
+		buff = rtw_malloc(IW_CUSTOM_MAX);
+
+		_rtw_memset(buff,0,IW_CUSTOM_MAX);
+
+		p=buff;
+
+		p+=sprintf(p,"ASSOCINFO(ReqIEs=");
+
+		len = sec_ie[1]+2;
+		len =  (len < IW_CUSTOM_MAX) ? len:IW_CUSTOM_MAX;
+
+		for(i=0;i<len;i++){
+			p+=sprintf(p,"%02x",sec_ie[i]);
+		}
+
+		p+=sprintf(p,")");
+
+		_rtw_memset(&wrqu,0,sizeof(wrqu));
+
+		wrqu.data.length=p-buff;
+
+		wrqu.data.length = (wrqu.data.length<IW_CUSTOM_MAX) ? wrqu.data.length:IW_CUSTOM_MAX;
+
+		wireless_send_event(adapter->pnetdev,IWEVCUSTOM,&wrqu,buff);
+
+		if(buff)
+		    rtw_mfree(buff, IW_CUSTOM_MAX);
+
+	}
+
+_func_exit_;
+
+}
+
+void _survey_timer_hdl (void *FunctionContext)
+{
+	_adapter *padapter = (_adapter *)FunctionContext;
+
+	survey_timer_hdl(padapter);
+}
+
+void _link_timer_hdl (void *FunctionContext)
+{
+	_adapter *padapter = (_adapter *)FunctionContext;
+	link_timer_hdl(padapter);
+}
+
+void _addba_timer_hdl(void *FunctionContext)
+{
+	struct sta_info *psta = (struct sta_info *)FunctionContext;
+	addba_timer_hdl(psta);
+}
+
+#ifdef CONFIG_IEEE80211W
+void _sa_query_timer_hdl (void *FunctionContext)
+{
+	_adapter *padapter = (_adapter *)FunctionContext;
+	sa_query_timer_hdl(padapter);
+}
+#endif //CONFIG_IEEE80211W
+
+void init_addba_retry_timer(_adapter *padapter, struct sta_info *psta)
+{
+
+	_init_timer(&psta->addba_retry_timer, padapter->pnetdev, _addba_timer_hdl, psta);
+}
+
+/*
+void _reauth_timer_hdl(void *FunctionContext)
+{
+	_adapter *padapter = (_adapter *)FunctionContext;
+	reauth_timer_hdl(padapter);
+}
+
+void _reassoc_timer_hdl(void *FunctionContext)
+{
+	_adapter *padapter = (_adapter *)FunctionContext;
+	reassoc_timer_hdl(padapter);
+}
+*/
+
+void init_mlme_ext_timer(_adapter *padapter)
+{
+	struct	mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+
+	_init_timer(&pmlmeext->survey_timer, padapter->pnetdev, _survey_timer_hdl, padapter);
+	_init_timer(&pmlmeext->link_timer, padapter->pnetdev, _link_timer_hdl, padapter);
+#ifdef CONFIG_IEEE80211W
+	_init_timer(&pmlmeext->sa_query_timer, padapter->pnetdev, _sa_query_timer_hdl, padapter);
+#endif //CONFIG_IEEE80211W
+	//_init_timer(&pmlmeext->ADDBA_timer, padapter->pnetdev, _addba_timer_hdl, padapter);
+
+	//_init_timer(&pmlmeext->reauth_timer, padapter->pnetdev, _reauth_timer_hdl, padapter);
+	//_init_timer(&pmlmeext->reassoc_timer, padapter->pnetdev, _reassoc_timer_hdl, padapter);
+}
+
+#ifdef CONFIG_AP_MODE
+
+void rtw_indicate_sta_assoc_event(_adapter *padapter, struct sta_info *psta)
+{
+	union iwreq_data wrqu;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	if(psta==NULL)
+		return;
+
+	if(psta->aid > NUM_STA)
+		return;
+
+	if(pstapriv->sta_aid[psta->aid - 1] != psta)
+		return;
+
+
+	wrqu.addr.sa_family = ARPHRD_ETHER;
+
+	_rtw_memcpy(wrqu.addr.sa_data, psta->hwaddr, ETH_ALEN);
+
+	DBG_871X("+rtw_indicate_sta_assoc_event\n");
+
+	wireless_send_event(padapter->pnetdev, IWEVREGISTERED, &wrqu, NULL);
+
+}
+
+void rtw_indicate_sta_disassoc_event(_adapter *padapter, struct sta_info *psta)
+{
+	union iwreq_data wrqu;
+	struct sta_priv *pstapriv = &padapter->stapriv;
+
+	if(psta==NULL)
+		return;
+
+	if(psta->aid > NUM_STA)
+		return;
+
+	if(pstapriv->sta_aid[psta->aid - 1] != psta)
+		return;
+
+
+	wrqu.addr.sa_family = ARPHRD_ETHER;
+
+	_rtw_memcpy(wrqu.addr.sa_data, psta->hwaddr, ETH_ALEN);
+
+	DBG_871X("+rtw_indicate_sta_disassoc_event\n");
+
+	wireless_send_event(padapter->pnetdev, IWEVEXPIRED, &wrqu, NULL);
+
+}
+
+
+#ifdef CONFIG_HOSTAPD_MLME
+
+static int mgnt_xmit_entry(struct sk_buff *skb, struct net_device *pnetdev)
+{
+	struct hostapd_priv *phostapdpriv = rtw_netdev_priv(pnetdev);
+	_adapter *padapter = (_adapter *)phostapdpriv->padapter;
+
+	//DBG_871X("%s\n", __FUNCTION__);
+
+	return rtw_hal_hostap_mgnt_xmit_entry(padapter, skb);
+}
+
+static int mgnt_netdev_open(struct net_device *pnetdev)
+{
+	struct hostapd_priv *phostapdpriv = rtw_netdev_priv(pnetdev);
+
+	DBG_871X("mgnt_netdev_open: MAC Address:" MAC_FMT "\n", MAC_ARG(pnetdev->dev_addr));
+
+
+	init_usb_anchor(&phostapdpriv->anchored);
+
+	if(!rtw_netif_queue_stopped(pnetdev))
+		rtw_netif_start_queue(pnetdev);
+	else
+		rtw_netif_wake_queue(pnetdev);
+
+
+	netif_carrier_on(pnetdev);
+
+	//rtw_write16(phostapdpriv->padapter, 0x0116, 0x0100);//only excluding beacon
+
+	return 0;
+}
+static int mgnt_netdev_close(struct net_device *pnetdev)
+{
+	struct hostapd_priv *phostapdpriv = rtw_netdev_priv(pnetdev);
+
+	DBG_871X("%s\n", __FUNCTION__);
+
+	usb_kill_anchored_urbs(&phostapdpriv->anchored);
+
+	netif_carrier_off(pnetdev);
+
+	if (!rtw_netif_queue_stopped(pnetdev))
+		rtw_netif_stop_queue(pnetdev);
+
+	//rtw_write16(phostapdpriv->padapter, 0x0116, 0x3f3f);
+
+	return 0;
+}
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+static const struct net_device_ops rtl871x_mgnt_netdev_ops = {
+	.ndo_open = mgnt_netdev_open,
+       .ndo_stop = mgnt_netdev_close,
+       .ndo_start_xmit = mgnt_xmit_entry,
+       //.ndo_set_mac_address = r871x_net_set_mac_address,
+       //.ndo_get_stats = r871x_net_get_stats,
+       //.ndo_do_ioctl = r871x_mp_ioctl,
+};
+#endif
+
+int hostapd_mode_init(_adapter *padapter)
+{
+	unsigned char mac[ETH_ALEN];
+	struct hostapd_priv *phostapdpriv;
+	struct net_device *pnetdev;
+
+	pnetdev = rtw_alloc_etherdev(sizeof(struct hostapd_priv));
+	if (!pnetdev)
+	   return -ENOMEM;
+
+	//SET_MODULE_OWNER(pnetdev);
+       ether_setup(pnetdev);
+
+	//pnetdev->type = ARPHRD_IEEE80211;
+
+	phostapdpriv = rtw_netdev_priv(pnetdev);
+	phostapdpriv->pmgnt_netdev = pnetdev;
+	phostapdpriv->padapter= padapter;
+	padapter->phostapdpriv = phostapdpriv;
+
+	//pnetdev->init = NULL;
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+
+	DBG_871X("register rtl871x_mgnt_netdev_ops to netdev_ops\n");
+
+	pnetdev->netdev_ops = &rtl871x_mgnt_netdev_ops;
+
+#else
+
+	pnetdev->open = mgnt_netdev_open;
+
+	pnetdev->stop = mgnt_netdev_close;
+
+	pnetdev->hard_start_xmit = mgnt_xmit_entry;
+
+	//pnetdev->set_mac_address = r871x_net_set_mac_address;
+
+	//pnetdev->get_stats = r871x_net_get_stats;
+
+	//pnetdev->do_ioctl = r871x_mp_ioctl;
+
+#endif
+
+	pnetdev->watchdog_timeo = HZ; /* 1 second timeout */
+
+	//pnetdev->wireless_handlers = NULL;
+
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_TX
+	pnetdev->features |= NETIF_F_IP_CSUM;
+#endif
+
+
+
+	if(dev_alloc_name(pnetdev,"mgnt.wlan%d") < 0)
+	{
+		DBG_871X("hostapd_mode_init(): dev_alloc_name, fail! \n");
+	}
+
+
+	//SET_NETDEV_DEV(pnetdev, pintfpriv->udev);
+
+
+	mac[0]=0x00;
+	mac[1]=0xe0;
+	mac[2]=0x4c;
+	mac[3]=0x87;
+	mac[4]=0x11;
+	mac[5]=0x12;
+
+	_rtw_memcpy(pnetdev->dev_addr, mac, ETH_ALEN);
+
+
+	netif_carrier_off(pnetdev);
+
+
+	/* Tell the network stack we exist */
+	if (register_netdev(pnetdev) != 0)
+	{
+		DBG_871X("hostapd_mode_init(): register_netdev fail!\n");
+
+		if(pnetdev)
+		{
+			rtw_free_netdev(pnetdev);
+		}
+	}
+
+	return 0;
+
+}
+
+void hostapd_mode_unload(_adapter *padapter)
+{
+	struct hostapd_priv *phostapdpriv = padapter->phostapdpriv;
+	struct net_device *pnetdev = phostapdpriv->pmgnt_netdev;
+
+	unregister_netdev(pnetdev);
+	rtw_free_netdev(pnetdev);
+
+}
+
+#endif
+#endif
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/os_intfs.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/os_intfs.c
new file mode 100644
index 000000000000..596eda72899a
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/os_intfs.c
@@ -0,0 +1,2756 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _OS_INTFS_C_
+
+#include <drv_conf.h>
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+
+#error "Shall be Linux or Windows, but not both!\n"
+
+#endif
+
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <xmit_osdep.h>
+#include <recv_osdep.h>
+#include <hal_intf.h>
+#include <rtw_ioctl.h>
+#include <rtw_version.h>
+
+#ifdef CONFIG_USB_HCI
+#include <usb_osintf.h>
+#endif
+
+#ifdef CONFIG_PCI_HCI
+#include <pci_osintf.h>
+#endif
+
+#ifdef CONFIG_BR_EXT
+#include <rtw_br_ext.h>
+#endif //CONFIG_BR_EXT
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Realtek Wireless Lan Driver");
+MODULE_AUTHOR("Realtek Semiconductor Corp.");
+MODULE_VERSION(DRIVERVERSION);
+
+/* module param defaults */
+int rtw_chip_version = 0x00;
+int rtw_rfintfs = HWPI;
+int rtw_lbkmode = 0;//RTL8712_AIR_TRX;
+
+
+int rtw_network_mode = Ndis802_11IBSS;//Ndis802_11Infrastructure;//infra, ad-hoc, auto
+//NDIS_802_11_SSID	ssid;
+int rtw_channel = 1;//ad-hoc support requirement
+int rtw_wireless_mode = WIRELESS_11BG_24N;
+int rtw_vrtl_carrier_sense = AUTO_VCS;
+int rtw_vcs_type = RTS_CTS;//*
+int rtw_rts_thresh = 2347;//*
+int rtw_frag_thresh = 2346;//*
+int rtw_preamble = PREAMBLE_LONG;//long, short, auto
+int rtw_scan_mode = 1;//active, passive
+int rtw_adhoc_tx_pwr = 1;
+int rtw_soft_ap = 0;
+//int smart_ps = 1;
+#ifdef CONFIG_POWER_SAVING
+int rtw_power_mgnt = 1;
+#ifdef CONFIG_IPS_LEVEL_2
+int rtw_ips_mode = IPS_LEVEL_2;
+#else
+int rtw_ips_mode = IPS_NORMAL;
+#endif
+#else
+int rtw_power_mgnt = PS_MODE_ACTIVE;
+int rtw_ips_mode = IPS_NONE;
+#endif
+module_param(rtw_ips_mode, int, 0644);
+MODULE_PARM_DESC(rtw_ips_mode,"The default IPS mode");
+
+int rtw_radio_enable = 1;
+int rtw_long_retry_lmt = 7;
+int rtw_short_retry_lmt = 7;
+int rtw_busy_thresh = 40;
+//int qos_enable = 0; //*
+int rtw_ack_policy = NORMAL_ACK;
+#ifdef CONFIG_MP_INCLUDED
+int rtw_mp_mode = 1;
+#else
+int rtw_mp_mode = 0;
+#endif
+int rtw_software_encrypt = 0;
+int rtw_software_decrypt = 0;
+
+int rtw_acm_method = 0;// 0:By SW 1:By HW.
+
+int rtw_wmm_enable = 1;// default is set to enable the wmm.
+int rtw_uapsd_enable = 0;
+int rtw_uapsd_max_sp = NO_LIMIT;
+int rtw_uapsd_acbk_en = 0;
+int rtw_uapsd_acbe_en = 0;
+int rtw_uapsd_acvi_en = 0;
+int rtw_uapsd_acvo_en = 0;
+
+#ifdef CONFIG_80211N_HT
+int rtw_ht_enable = 1;
+int rtw_cbw40_enable = 3; // 0 :diable, bit(0): enable 2.4g, bit(1): enable 5g
+int rtw_ampdu_enable = 1;//for enable tx_ampdu
+int rtw_rx_stbc = 1;// 0: disable, bit(0):enable 2.4g, bit(1):enable 5g, default is set to enable 2.4GHZ for IOT issue with bufflao's AP at 5GHZ
+int rtw_ampdu_amsdu = 0;// 0: disabled, 1:enabled, 2:auto
+#endif
+
+int rtw_lowrate_two_xmit = 1;//Use 2 path Tx to transmit MCS0~7 and legacy mode
+
+//int rf_config = RF_1T2R;  // 1T2R
+int rtw_rf_config = RF_819X_MAX_TYPE;  //auto
+int rtw_low_power = 0;
+#ifdef CONFIG_WIFI_TEST
+int rtw_wifi_spec = 1;//for wifi test
+#else
+int rtw_wifi_spec = 0;
+#endif
+
+int rtw_special_rf_path = 0; //0: 2T2R ,1: only turn on path A 1T1R, 2: only turn on path B 1T1R
+
+int rtw_channel_plan = RT_CHANNEL_DOMAIN_MAX;
+
+#ifdef CONFIG_BT_COEXIST
+int rtw_bt_iso = 2;// 0:Low, 1:High, 2:From Efuse
+int rtw_bt_sco = 3;// 0:Idle, 1:None-SCO, 2:SCO, 3:From Counter, 4.Busy, 5.OtherBusy
+int rtw_bt_ampdu =1 ;// 0:Disable BT control A-MPDU, 1:Enable BT control A-MPDU.
+#endif
+int rtw_AcceptAddbaReq = _TRUE;// 0:Reject AP's Add BA req, 1:Accept AP's Add BA req.
+
+int  rtw_antdiv_cfg = 2; // 0:OFF , 1:ON, 2:decide by Efuse config
+
+#ifdef CONFIG_USB_AUTOSUSPEND
+int rtw_enusbss = 1;//0:disable,1:enable
+#else
+int rtw_enusbss = 0;//0:disable,1:enable
+#endif
+
+int rtw_hwpdn_mode=2;//0:disable,1:enable,2: by EFUSE config
+
+#ifdef CONFIG_HW_PWRP_DETECTION
+int rtw_hwpwrp_detect = 1;
+#else
+int rtw_hwpwrp_detect = 0; //HW power  ping detect 0:disable , 1:enable
+#endif
+
+#ifdef CONFIG_USB_HCI
+int rtw_hw_wps_pbc = 1;
+#else
+int rtw_hw_wps_pbc = 0;
+#endif
+
+#ifdef CONFIG_TX_MCAST2UNI
+int rtw_mc2u_disable = 0;
+#endif	// CONFIG_TX_MCAST2UNI
+
+int rtw_mac_phy_mode = 0; //0:by efuse, 1:smsp, 2:dmdp, 3:dmsp.
+
+#ifdef CONFIG_80211D
+int rtw_80211d = 0;
+#endif
+
+char* ifname = "wlan%d";
+module_param(ifname, charp, 0644);
+MODULE_PARM_DESC(ifname, "The default name to allocate for first interface");
+
+char* if2name = "wlan%d";
+module_param(if2name, charp, 0644);
+MODULE_PARM_DESC(if2name, "The default name to allocate for second interface");
+
+char* rtw_initmac = 0;  // temp mac address if users want to use instead of the mac address in Efuse
+
+#ifdef CONFIG_MULTI_VIR_IFACES
+int rtw_ext_iface_num  = 1;//primary/secondary iface is excluded
+module_param(rtw_ext_iface_num, int, 0644);
+#endif //CONFIG_MULTI_VIR_IFACES
+
+module_param(rtw_initmac, charp, 0644);
+module_param(rtw_channel_plan, int, 0644);
+module_param(rtw_chip_version, int, 0644);
+module_param(rtw_rfintfs, int, 0644);
+module_param(rtw_lbkmode, int, 0644);
+module_param(rtw_network_mode, int, 0644);
+module_param(rtw_channel, int, 0644);
+module_param(rtw_mp_mode, int, 0644);
+module_param(rtw_wmm_enable, int, 0644);
+module_param(rtw_vrtl_carrier_sense, int, 0644);
+module_param(rtw_vcs_type, int, 0644);
+module_param(rtw_busy_thresh, int, 0644);
+#ifdef CONFIG_80211N_HT
+module_param(rtw_ht_enable, int, 0644);
+module_param(rtw_cbw40_enable, int, 0644);
+module_param(rtw_ampdu_enable, int, 0644);
+module_param(rtw_rx_stbc, int, 0644);
+module_param(rtw_ampdu_amsdu, int, 0644);
+#endif
+
+module_param(rtw_lowrate_two_xmit, int, 0644);
+
+module_param(rtw_rf_config, int, 0644);
+module_param(rtw_power_mgnt, int, 0644);
+module_param(rtw_low_power, int, 0644);
+module_param(rtw_wifi_spec, int, 0644);
+
+module_param(rtw_special_rf_path, int, 0644);
+
+module_param(rtw_antdiv_cfg, int, 0644);
+
+
+module_param(rtw_enusbss, int, 0644);
+module_param(rtw_hwpdn_mode, int, 0644);
+module_param(rtw_hwpwrp_detect, int, 0644);
+
+module_param(rtw_hw_wps_pbc, int, 0644);
+
+#ifdef CONFIG_ADAPTOR_INFO_CACHING_FILE
+char *rtw_adaptor_info_caching_file_path= "/data/misc/wifi/rtw_cache";
+module_param(rtw_adaptor_info_caching_file_path, charp, 0644);
+MODULE_PARM_DESC(rtw_adaptor_info_caching_file_path, "The path of adapter info cache file");
+#endif //CONFIG_ADAPTOR_INFO_CACHING_FILE
+
+#ifdef CONFIG_LAYER2_ROAMING
+uint rtw_max_roaming_times=2;
+module_param(rtw_max_roaming_times, uint, 0644);
+MODULE_PARM_DESC(rtw_max_roaming_times,"The max roaming times to try");
+#endif //CONFIG_LAYER2_ROAMING
+
+#ifdef CONFIG_IOL
+bool rtw_force_iol=_FALSE;
+module_param(rtw_force_iol, bool, 0644);
+MODULE_PARM_DESC(rtw_force_iol,"Force to enable IOL");
+#endif //CONFIG_IOL
+
+#ifdef CONFIG_FILE_FWIMG
+char *rtw_fw_file_path= "";
+module_param(rtw_fw_file_path, charp, 0644);
+MODULE_PARM_DESC(rtw_fw_file_path, "The path of fw image");
+#endif //CONFIG_FILE_FWIMG
+
+#ifdef CONFIG_TX_MCAST2UNI
+module_param(rtw_mc2u_disable, int, 0644);
+#endif	// CONFIG_TX_MCAST2UNI
+
+module_param(rtw_mac_phy_mode, int, 0644);
+
+#ifdef CONFIG_80211D
+module_param(rtw_80211d, int, 0644);
+#endif
+
+uint rtw_notch_filter = RTW_NOTCH_FILTER;
+module_param(rtw_notch_filter, uint, 0644);
+MODULE_PARM_DESC(rtw_notch_filter, "0:Disable, 1:Enable, 2:Enable only for P2P");
+
+static uint loadparam( _adapter *padapter,  _nic_hdl	pnetdev);
+int _netdev_open(struct net_device *pnetdev);
+int netdev_open (struct net_device *pnetdev);
+static int netdev_close (struct net_device *pnetdev);
+
+//#ifdef RTK_DMP_PLATFORM
+#ifdef CONFIG_PROC_DEBUG
+#define RTL8192C_PROC_NAME "rtl819xC"
+#define RTL8192D_PROC_NAME "rtl819xD"
+static char rtw_proc_name[IFNAMSIZ];
+static struct proc_dir_entry *rtw_proc = NULL;
+static int	rtw_proc_cnt = 0;
+
+#define RTW_PROC_NAME DRV_NAME
+
+void rtw_proc_init_one(struct net_device *dev)
+{
+	struct proc_dir_entry *dir_dev = NULL;
+	struct proc_dir_entry *entry=NULL;
+	_adapter	*padapter = rtw_netdev_priv(dev);
+	u8 rf_type;
+
+	if(rtw_proc == NULL)
+	{
+		if(padapter->chip_type == RTL8188C_8192C)
+		{
+			_rtw_memcpy(rtw_proc_name, RTL8192C_PROC_NAME, sizeof(RTL8192C_PROC_NAME));
+		}
+		else if(padapter->chip_type == RTL8192D)
+		{
+			_rtw_memcpy(rtw_proc_name, RTL8192D_PROC_NAME, sizeof(RTL8192D_PROC_NAME));
+		}
+		else if(padapter->chip_type == RTL8723A)
+		{
+			_rtw_memcpy(rtw_proc_name, RTW_PROC_NAME, sizeof(RTW_PROC_NAME));
+		}
+		else if(padapter->chip_type == RTL8188E)
+		{
+			_rtw_memcpy(rtw_proc_name, RTW_PROC_NAME, sizeof(RTW_PROC_NAME));
+		}
+		else
+		{
+			_rtw_memcpy(rtw_proc_name, RTW_PROC_NAME, sizeof(RTW_PROC_NAME));
+		}
+
+#if(LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24))
+		rtw_proc=create_proc_entry(rtw_proc_name, S_IFDIR, proc_net);
+#else
+		rtw_proc=create_proc_entry(rtw_proc_name, S_IFDIR, init_net.proc_net);
+#endif
+		if (rtw_proc == NULL) {
+			DBG_871X(KERN_ERR "Unable to create rtw_proc directory\n");
+			return;
+		}
+
+		entry = create_proc_read_entry("ver_info", S_IFREG | S_IRUGO, rtw_proc, proc_get_drv_version, dev);
+		if (!entry) {
+			DBG_871X("Unable to create_proc_read_entry!\n");
+			return;
+		}
+
+		entry = create_proc_read_entry("log_level", S_IFREG | S_IRUGO,
+				   rtw_proc, proc_get_log_level, dev);
+		if (!entry) {
+			DBG_871X("Unable to create_proc_read_entry!\n");
+			return;
+		}
+		entry->write_proc = proc_set_log_level;
+
+#ifdef DBG_MEM_ALLOC
+		entry = create_proc_read_entry("mstat", S_IFREG | S_IRUGO,
+				   rtw_proc, proc_get_mstat, dev);
+		if (!entry) {
+			DBG_871X("Unable to create_proc_read_entry!\n");
+			return;
+		}
+#endif /* DBG_MEM_ALLOC */
+	}
+
+
+
+	if(padapter->dir_dev == NULL)
+	{
+		padapter->dir_dev = create_proc_entry(dev->name,
+					  S_IFDIR | S_IRUGO | S_IXUGO,
+					  rtw_proc);
+
+		dir_dev = padapter->dir_dev;
+
+		if(dir_dev==NULL)
+		{
+			if(rtw_proc_cnt == 0)
+			{
+				if(rtw_proc){
+#if(LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24))
+					remove_proc_entry(rtw_proc_name, proc_net);
+#else
+					remove_proc_entry(rtw_proc_name, init_net.proc_net);
+#endif
+					rtw_proc = NULL;
+				}
+			}
+
+			DBG_871X("Unable to create dir_dev directory\n");
+			return;
+		}
+	}
+	else
+	{
+		return;
+	}
+
+	rtw_proc_cnt++;
+
+	entry = create_proc_read_entry("write_reg", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_write_reg, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_write_reg;
+
+	entry = create_proc_read_entry("read_reg", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_read_reg, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_read_reg;
+
+
+	entry = create_proc_read_entry("fwstate", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_fwstate, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+
+	entry = create_proc_read_entry("sec_info", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_sec_info, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+
+	entry = create_proc_read_entry("mlmext_state", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_mlmext_state, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+
+	entry = create_proc_read_entry("qos_option", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_qos_option, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("ht_option", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_ht_option, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("rf_info", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_rf_info, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("ap_info", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_ap_info, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("adapter_state", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_adapter_state, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("trx_info", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_trx_info, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("mac_reg_dump1", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_mac_reg_dump1, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("mac_reg_dump2", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_mac_reg_dump2, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("mac_reg_dump3", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_mac_reg_dump3, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("bb_reg_dump1", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_bb_reg_dump1, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("bb_reg_dump2", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_bb_reg_dump2, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("bb_reg_dump3", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_bb_reg_dump3, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("rf_reg_dump1", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_rf_reg_dump1, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("rf_reg_dump2", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_rf_reg_dump2, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+	if((RF_1T2R == rf_type) ||(RF_1T1R ==rf_type ))	{
+		entry = create_proc_read_entry("rf_reg_dump3", S_IFREG | S_IRUGO,
+					   dir_dev, proc_get_rf_reg_dump3, dev);
+		if (!entry) {
+			DBG_871X("Unable to create_proc_read_entry!\n");
+			return;
+		}
+
+		entry = create_proc_read_entry("rf_reg_dump4", S_IFREG | S_IRUGO,
+					   dir_dev, proc_get_rf_reg_dump4, dev);
+		if (!entry) {
+			DBG_871X("Unable to create_proc_read_entry!\n");
+			return;
+		}
+	}
+
+#ifdef CONFIG_AP_MODE
+
+	entry = create_proc_read_entry("all_sta_info", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_all_sta_info, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+#endif
+
+#ifdef DBG_MEMORY_LEAK
+	entry = create_proc_read_entry("_malloc_cnt", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_malloc_cnt, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+#endif
+
+#ifdef CONFIG_FIND_BEST_CHANNEL
+	entry = create_proc_read_entry("best_channel", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_best_channel, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_best_channel;
+#endif
+
+	entry = create_proc_read_entry("rx_signal", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_rx_signal, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_rx_signal;
+
+	entry = create_proc_read_entry("ht_enable", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_ht_enable, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_ht_enable;
+
+	entry = create_proc_read_entry("cbw40_enable", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_cbw40_enable, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_cbw40_enable;
+
+	entry = create_proc_read_entry("ampdu_enable", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_ampdu_enable, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_ampdu_enable;
+
+	entry = create_proc_read_entry("rx_stbc", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_rx_stbc, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_rx_stbc;
+
+
+	entry = create_proc_read_entry("path_rssi", S_IFREG | S_IRUGO,
+					dir_dev, proc_get_two_path_rssi, dev);
+
+	entry = create_proc_read_entry("vid", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_vid, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("pid", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_pid, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+
+	entry = create_proc_read_entry("rssi_disp", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_rssi_disp, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_rssi_disp;
+
+#if defined(DBG_CONFIG_ERROR_DETECT)
+	entry = create_proc_read_entry("sreset", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_sreset, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_sreset;
+#endif /* DBG_CONFIG_ERROR_DETECT */
+
+#ifdef CONFIG_DM_ADAPTIVITY
+	entry = create_proc_read_entry("dm_adaptivity", S_IFREG | S_IRUGO,
+				   dir_dev, proc_get_dm_adaptivity, dev);
+	if (!entry) {
+		DBG_871X("Unable to create_proc_read_entry!\n");
+		return;
+	}
+	entry->write_proc = proc_set_dm_adaptivity;
+#endif /* CONFIG_DM_ADAPTIVITY */
+
+}
+
+void rtw_proc_remove_one(struct net_device *dev)
+{
+	struct proc_dir_entry *dir_dev = NULL;
+	_adapter	*padapter = rtw_netdev_priv(dev);
+	u8 rf_type;
+
+	dir_dev = padapter->dir_dev;
+	padapter->dir_dev = NULL;
+
+	if (dir_dev) {
+
+		remove_proc_entry("write_reg", dir_dev);
+		remove_proc_entry("read_reg", dir_dev);
+		remove_proc_entry("fwstate", dir_dev);
+		remove_proc_entry("sec_info", dir_dev);
+		remove_proc_entry("mlmext_state", dir_dev);
+		remove_proc_entry("qos_option", dir_dev);
+		remove_proc_entry("ht_option", dir_dev);
+		remove_proc_entry("rf_info", dir_dev);
+		remove_proc_entry("ap_info", dir_dev);
+		remove_proc_entry("adapter_state", dir_dev);
+		remove_proc_entry("trx_info", dir_dev);
+
+		remove_proc_entry("mac_reg_dump1", dir_dev);
+		remove_proc_entry("mac_reg_dump2", dir_dev);
+		remove_proc_entry("mac_reg_dump3", dir_dev);
+		remove_proc_entry("bb_reg_dump1", dir_dev);
+		remove_proc_entry("bb_reg_dump2", dir_dev);
+		remove_proc_entry("bb_reg_dump3", dir_dev);
+		remove_proc_entry("rf_reg_dump1", dir_dev);
+		remove_proc_entry("rf_reg_dump2", dir_dev);
+		rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
+		if((RF_1T2R == rf_type) ||(RF_1T1R ==rf_type ))	{
+			remove_proc_entry("rf_reg_dump3", dir_dev);
+			remove_proc_entry("rf_reg_dump4", dir_dev);
+		}
+#ifdef CONFIG_AP_MODE
+		remove_proc_entry("all_sta_info", dir_dev);
+#endif
+
+#ifdef DBG_MEMORY_LEAK
+		remove_proc_entry("_malloc_cnt", dir_dev);
+#endif
+
+#ifdef CONFIG_FIND_BEST_CHANNEL
+		remove_proc_entry("best_channel", dir_dev);
+#endif
+		remove_proc_entry("rx_signal", dir_dev);
+
+		remove_proc_entry("cbw40_enable", dir_dev);
+
+		remove_proc_entry("ht_enable", dir_dev);
+
+		remove_proc_entry("ampdu_enable", dir_dev);
+
+		remove_proc_entry("rx_stbc", dir_dev);
+
+		remove_proc_entry("path_rssi", dir_dev);
+
+		remove_proc_entry("vid", dir_dev);
+
+		remove_proc_entry("pid", dir_dev);
+
+		remove_proc_entry("rssi_disp", dir_dev);
+
+#if defined(DBG_CONFIG_ERROR_DETECT)
+		remove_proc_entry("sreset", dir_dev);
+#endif /* DBG_CONFIG_ERROR_DETECT */
+
+#ifdef CONFIG_DM_ADAPTIVITY
+		remove_proc_entry("dm_adaptivity", dir_dev);
+#endif
+
+		remove_proc_entry(dev->name, rtw_proc);
+		dir_dev = NULL;
+
+	}
+	else
+	{
+		return;
+	}
+
+	rtw_proc_cnt--;
+
+	if(rtw_proc_cnt == 0)
+	{
+		if(rtw_proc){
+			remove_proc_entry("ver_info", rtw_proc);
+
+			remove_proc_entry("log_level", rtw_proc);
+			#ifdef DBG_MEM_ALLOC
+			remove_proc_entry("mstat", rtw_proc);
+			#endif /* DBG_MEM_ALLOC */
+#if(LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24))
+			remove_proc_entry(rtw_proc_name, proc_net);
+#else
+			remove_proc_entry(rtw_proc_name, init_net.proc_net);
+#endif
+			rtw_proc = NULL;
+		}
+	}
+}
+#endif
+
+uint loadparam( _adapter *padapter,  _nic_hdl	pnetdev);
+uint loadparam( _adapter *padapter,  _nic_hdl	pnetdev)
+{
+
+	uint status = _SUCCESS;
+	struct registry_priv  *registry_par = &padapter->registrypriv;
+
+_func_enter_;
+
+	registry_par->chip_version = (u8)rtw_chip_version;
+	registry_par->rfintfs = (u8)rtw_rfintfs;
+	registry_par->lbkmode = (u8)rtw_lbkmode;
+	//registry_par->hci = (u8)hci;
+	registry_par->network_mode  = (u8)rtw_network_mode;
+
+	_rtw_memcpy(registry_par->ssid.Ssid, "ANY", 3);
+	registry_par->ssid.SsidLength = 3;
+
+	registry_par->channel = (u8)rtw_channel;
+	registry_par->wireless_mode = (u8)rtw_wireless_mode;
+	registry_par->vrtl_carrier_sense = (u8)rtw_vrtl_carrier_sense ;
+	registry_par->vcs_type = (u8)rtw_vcs_type;
+	registry_par->rts_thresh=(u16)rtw_rts_thresh;
+	registry_par->frag_thresh=(u16)rtw_frag_thresh;
+	registry_par->preamble = (u8)rtw_preamble;
+	registry_par->scan_mode = (u8)rtw_scan_mode;
+	registry_par->adhoc_tx_pwr = (u8)rtw_adhoc_tx_pwr;
+	registry_par->soft_ap=  (u8)rtw_soft_ap;
+	//registry_par->smart_ps =  (u8)rtw_smart_ps;
+	registry_par->power_mgnt = (u8)rtw_power_mgnt;
+	registry_par->ips_mode = (u8)rtw_ips_mode;
+	registry_par->radio_enable = (u8)rtw_radio_enable;
+	registry_par->long_retry_lmt = (u8)rtw_long_retry_lmt;
+	registry_par->short_retry_lmt = (u8)rtw_short_retry_lmt;
+	registry_par->busy_thresh = (u16)rtw_busy_thresh;
+	//registry_par->qos_enable = (u8)rtw_qos_enable;
+	registry_par->ack_policy = (u8)rtw_ack_policy;
+	registry_par->mp_mode = (u8)rtw_mp_mode;
+	registry_par->software_encrypt = (u8)rtw_software_encrypt;
+	registry_par->software_decrypt = (u8)rtw_software_decrypt;
+
+	registry_par->acm_method = (u8)rtw_acm_method;
+
+	 //UAPSD
+	registry_par->wmm_enable = (u8)rtw_wmm_enable;
+	registry_par->uapsd_enable = (u8)rtw_uapsd_enable;
+	registry_par->uapsd_max_sp = (u8)rtw_uapsd_max_sp;
+	registry_par->uapsd_acbk_en = (u8)rtw_uapsd_acbk_en;
+	registry_par->uapsd_acbe_en = (u8)rtw_uapsd_acbe_en;
+	registry_par->uapsd_acvi_en = (u8)rtw_uapsd_acvi_en;
+	registry_par->uapsd_acvo_en = (u8)rtw_uapsd_acvo_en;
+
+#ifdef CONFIG_80211N_HT
+	registry_par->ht_enable = (u8)rtw_ht_enable;
+	registry_par->cbw40_enable = (u8)rtw_cbw40_enable;
+	registry_par->ampdu_enable = (u8)rtw_ampdu_enable;
+	registry_par->rx_stbc = (u8)rtw_rx_stbc;
+	registry_par->ampdu_amsdu = (u8)rtw_ampdu_amsdu;
+#endif
+
+	registry_par->lowrate_two_xmit = (u8)rtw_lowrate_two_xmit;
+	registry_par->rf_config = (u8)rtw_rf_config;
+	registry_par->low_power = (u8)rtw_low_power;
+
+
+	registry_par->wifi_spec = (u8)rtw_wifi_spec;
+	registry_par->special_rf_path = (u8)rtw_special_rf_path;
+	registry_par->channel_plan = (u8)rtw_channel_plan;
+
+#ifdef CONFIG_BT_COEXIST
+	registry_par->bt_iso = (u8)rtw_bt_iso;
+	registry_par->bt_sco = (u8)rtw_bt_sco;
+	registry_par->bt_ampdu = (u8)rtw_bt_ampdu;
+#endif
+	registry_par->bAcceptAddbaReq = (u8)rtw_AcceptAddbaReq;
+
+	registry_par->antdiv_cfg = (u8)rtw_antdiv_cfg;
+
+#ifdef CONFIG_AUTOSUSPEND
+	registry_par->usbss_enable = (u8)rtw_enusbss;//0:disable,1:enable
+#endif
+#ifdef SUPPORT_HW_RFOFF_DETECTED
+	registry_par->hwpdn_mode = (u8)rtw_hwpdn_mode;//0:disable,1:enable,2:by EFUSE config
+	registry_par->hwpwrp_detect = (u8)rtw_hwpwrp_detect;//0:disable,1:enable
+#endif
+
+	registry_par->hw_wps_pbc = (u8)rtw_hw_wps_pbc;
+
+#ifdef CONFIG_ADAPTOR_INFO_CACHING_FILE
+	snprintf(registry_par->adaptor_info_caching_file_path, PATH_LENGTH_MAX, "%s", rtw_adaptor_info_caching_file_path);
+	registry_par->adaptor_info_caching_file_path[PATH_LENGTH_MAX-1]=0;
+#endif
+
+#ifdef CONFIG_LAYER2_ROAMING
+	registry_par->max_roaming_times = (u8)rtw_max_roaming_times;
+#ifdef CONFIG_INTEL_WIDI
+	registry_par->max_roaming_times = (u8)rtw_max_roaming_times + 2;
+#endif // CONFIG_INTEL_WIDI
+#endif
+
+#ifdef CONFIG_IOL
+	registry_par->force_iol = rtw_force_iol;
+#endif
+
+	registry_par->mac_phy_mode = rtw_mac_phy_mode;
+
+#ifdef CONFIG_80211D
+	registry_par->enable80211d = (u8)rtw_80211d;
+#endif
+
+	snprintf(registry_par->ifname, 16, "%s", ifname);
+	snprintf(registry_par->if2name, 16, "%s", if2name);
+
+	registry_par->notch_filter = (u8)rtw_notch_filter;
+
+#ifdef CONFIG_MULTI_VIR_IFACES
+	registry_par->ext_iface_num = (u8)rtw_ext_iface_num;
+#endif //CONFIG_MULTI_VIR_IFACES
+
+_func_exit_;
+
+	return status;
+}
+
+static int rtw_net_set_mac_address(struct net_device *pnetdev, void *p)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+	struct sockaddr *addr = p;
+
+	if(padapter->bup == _FALSE)
+	{
+		//DBG_871X("r8711_net_set_mac_address(), MAC=%x:%x:%x:%x:%x:%x\n", addr->sa_data[0], addr->sa_data[1], addr->sa_data[2], addr->sa_data[3],
+		//addr->sa_data[4], addr->sa_data[5]);
+		_rtw_memcpy(padapter->eeprompriv.mac_addr, addr->sa_data, ETH_ALEN);
+		//_rtw_memcpy(pnetdev->dev_addr, addr->sa_data, ETH_ALEN);
+		//padapter->bset_hwaddr = _TRUE;
+	}
+
+	return 0;
+}
+
+static struct net_device_stats *rtw_net_get_stats(struct net_device *pnetdev)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+	struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
+	struct recv_priv *precvpriv = &(padapter->recvpriv);
+
+	padapter->stats.tx_packets = pxmitpriv->tx_pkts;//pxmitpriv->tx_pkts++;
+	padapter->stats.rx_packets = precvpriv->rx_pkts;//precvpriv->rx_pkts++;
+	padapter->stats.tx_dropped = pxmitpriv->tx_drop;
+	padapter->stats.rx_dropped = precvpriv->rx_drop;
+	padapter->stats.tx_bytes = pxmitpriv->tx_bytes;
+	padapter->stats.rx_bytes = precvpriv->rx_bytes;
+
+	return &padapter->stats;
+}
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+/*
+ * AC to queue mapping
+ *
+ * AC_VO -> queue 0
+ * AC_VI -> queue 1
+ * AC_BE -> queue 2
+ * AC_BK -> queue 3
+ */
+static const u16 rtw_1d_to_queue[8] = { 2, 3, 3, 2, 1, 1, 0, 0 };
+
+/* Given a data frame determine the 802.1p/1d tag to use. */
+unsigned int rtw_classify8021d(struct sk_buff *skb)
+{
+	unsigned int dscp;
+
+	/* skb->priority values from 256->263 are magic values to
+	 * directly indicate a specific 802.1d priority.  This is used
+	 * to allow 802.1d priority to be passed directly in from VLAN
+	 * tags, etc.
+	 */
+	if (skb->priority >= 256 && skb->priority <= 263)
+		return skb->priority - 256;
+
+	switch (skb->protocol) {
+	case htons(ETH_P_IP):
+		dscp = ip_hdr(skb)->tos & 0xfc;
+		break;
+	default:
+		return 0;
+	}
+
+	return dscp >> 5;
+}
+
+static u16 rtw_select_queue(struct net_device *dev, struct sk_buff *skb
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0)
+				, void *accel_priv
+#endif
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(3,14,0))
+			    , select_queue_fallback_t fallback
+#endif
+)
+{
+	_adapter	*padapter = rtw_netdev_priv(dev);
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+	skb->priority = rtw_classify8021d(skb);
+
+	if(pmlmepriv->acm_mask != 0)
+	{
+		skb->priority = qos_acm(pmlmepriv->acm_mask, skb->priority);
+	}
+
+	return rtw_1d_to_queue[skb->priority];
+}
+
+u16 rtw_recv_select_queue(struct sk_buff *skb)
+{
+	struct iphdr *piphdr;
+	unsigned int dscp;
+	u16	eth_type;
+	u32 priority;
+	u8 *pdata = skb->data;
+
+	_rtw_memcpy(&eth_type, pdata+(ETH_ALEN<<1), 2);
+
+	switch (eth_type) {
+		case htons(ETH_P_IP):
+
+			piphdr = (struct iphdr *)(pdata+ETH_HLEN);
+
+			dscp = piphdr->tos & 0xfc;
+
+			priority = dscp >> 5;
+
+			break;
+		default:
+			priority = 0;
+	}
+
+	return rtw_1d_to_queue[priority];
+
+}
+
+#endif
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+static const struct net_device_ops rtw_netdev_ops = {
+	.ndo_open = netdev_open,
+	.ndo_stop = netdev_close,
+	.ndo_start_xmit = rtw_xmit_entry,
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+	.ndo_select_queue	= rtw_select_queue,
+#endif
+	.ndo_set_mac_address = rtw_net_set_mac_address,
+	.ndo_get_stats = rtw_net_get_stats,
+	.ndo_do_ioctl = rtw_ioctl,
+};
+#endif
+
+int rtw_init_netdev_name(struct net_device *pnetdev, const char *ifname)
+{
+	_adapter *padapter = rtw_netdev_priv(pnetdev);
+
+#ifdef CONFIG_EASY_REPLACEMENT
+	struct net_device	*TargetNetdev = NULL;
+	_adapter			*TargetAdapter = NULL;
+	struct net 		*devnet = NULL;
+
+	if(padapter->bDongle == 1)
+	{
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24))
+		TargetNetdev = dev_get_by_name("wlan0");
+#else
+	#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26))
+		devnet = pnetdev->nd_net;
+	#else
+		devnet = dev_net(pnetdev);
+	#endif
+		TargetNetdev = dev_get_by_name(devnet, "wlan0");
+#endif
+		if(TargetNetdev) {
+			DBG_871X("Force onboard module driver disappear !!!\n");
+			TargetAdapter = rtw_netdev_priv(TargetNetdev);
+			TargetAdapter->DriverState = DRIVER_DISAPPEAR;
+
+			padapter->pid[0] = TargetAdapter->pid[0];
+			padapter->pid[1] = TargetAdapter->pid[1];
+			padapter->pid[2] = TargetAdapter->pid[2];
+
+			dev_put(TargetNetdev);
+			unregister_netdev(TargetNetdev);
+
+			if(TargetAdapter->chip_type == padapter->chip_type)
+				rtw_proc_remove_one(TargetNetdev);
+
+			padapter->DriverState = DRIVER_REPLACE_DONGLE;
+		}
+	}
+#endif //CONFIG_EASY_REPLACEMENT
+
+	if(dev_alloc_name(pnetdev, ifname) < 0)
+	{
+		RT_TRACE(_module_os_intfs_c_,_drv_err_,("dev_alloc_name, fail! \n"));
+	}
+
+	netif_carrier_off(pnetdev);
+	//rtw_netif_stop_queue(pnetdev);
+
+	return 0;
+}
+
+static const struct device_type wlan_type = {
+	.name = "wlan",
+};
+
+struct net_device *rtw_init_netdev(_adapter *old_padapter)
+{
+	_adapter *padapter;
+	struct net_device *pnetdev;
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("+init_net_dev\n"));
+
+	if(old_padapter != NULL)
+		pnetdev = rtw_alloc_etherdev_with_old_priv(sizeof(_adapter), (void *)old_padapter);
+	else
+		pnetdev = rtw_alloc_etherdev(sizeof(_adapter));
+
+	if (!pnetdev)
+		return NULL;
+
+	pnetdev->dev.type = &wlan_type;
+	padapter = rtw_netdev_priv(pnetdev);
+	padapter->pnetdev = pnetdev;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24)
+	SET_MODULE_OWNER(pnetdev);
+#endif
+
+	//pnetdev->init = NULL;
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+	DBG_871X("register rtw_netdev_ops to netdev_ops\n");
+	pnetdev->netdev_ops = &rtw_netdev_ops;
+#else
+	pnetdev->open = netdev_open;
+	pnetdev->stop = netdev_close;
+	pnetdev->hard_start_xmit = rtw_xmit_entry;
+	pnetdev->set_mac_address = rtw_net_set_mac_address;
+	pnetdev->get_stats = rtw_net_get_stats;
+	pnetdev->do_ioctl = rtw_ioctl;
+#endif
+
+
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_TX
+	pnetdev->features |= NETIF_F_IP_CSUM;
+#endif
+	//pnetdev->tx_timeout = NULL;
+	pnetdev->watchdog_timeo = HZ*3; /* 3 second timeout */
+#ifdef CONFIG_WIRELESS_EXT
+	pnetdev->wireless_handlers = (struct iw_handler_def *)&rtw_handlers_def;
+#endif
+
+#ifdef WIRELESS_SPY
+	//priv->wireless_data.spy_data = &priv->spy_data;
+	//pnetdev->wireless_data = &priv->wireless_data;
+#endif
+
+	//step 2.
+	loadparam(padapter, pnetdev);
+
+	return pnetdev;
+
+}
+
+void rtw_unregister_netdevs(struct dvobj_priv *dvobj)
+{
+	int i;
+	_adapter *padapter = NULL;
+
+	for (i=0;i<dvobj->iface_nums;i++) {
+		struct net_device *pnetdev = NULL;
+
+		padapter = dvobj->padapters[i];
+
+		if (padapter == NULL)
+			continue;
+
+		pnetdev = padapter->pnetdev;
+
+		if((padapter->DriverState != DRIVER_DISAPPEAR) && pnetdev) {
+			unregister_netdev(pnetdev); //will call netdev_close()
+			rtw_proc_remove_one(pnetdev);
+		}
+
+		#ifdef CONFIG_IOCTL_CFG80211
+		rtw_wdev_unregister(padapter->rtw_wdev);
+		#endif
+	}
+
+}
+
+u32 rtw_start_drv_threads(_adapter *padapter)
+{
+
+	u32 _status = _SUCCESS;
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("+rtw_start_drv_threads\n"));
+#ifdef CONFIG_XMIT_THREAD_MODE
+	padapter->xmitThread = kthread_run(rtw_xmit_thread, padapter, "RTW_XMIT_THREAD");
+	if(IS_ERR(padapter->xmitThread))
+		_status = _FAIL;
+#endif
+
+#ifdef CONFIG_RECV_THREAD_MODE
+	padapter->recvThread = kthread_run(rtw_recv_thread, padapter, "RTW_RECV_THREAD");
+	if(IS_ERR(padapter->recvThread))
+		_status = _FAIL;
+#endif
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->isprimary == _TRUE)
+#endif //CONFIG_CONCURRENT_MODE
+	{
+		padapter->cmdThread = kthread_run(rtw_cmd_thread, padapter, "RTW_CMD_THREAD");
+		if(IS_ERR(padapter->cmdThread))
+			_status = _FAIL;
+		else
+			_rtw_down_sema(&padapter->cmdpriv.terminate_cmdthread_sema); //wait for cmd_thread to run
+	}
+
+
+#ifdef CONFIG_EVENT_THREAD_MODE
+	padapter->evtThread = kthread_run(event_thread, padapter, "RTW_EVENT_THREAD");
+	if(IS_ERR(padapter->evtThread))
+		_status = _FAIL;
+#endif
+
+	return _status;
+
+}
+
+void rtw_stop_drv_threads (_adapter *padapter)
+{
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("+rtw_stop_drv_threads\n"));
+
+#ifdef CONFIG_CONCURRENT_MODE
+	if(padapter->isprimary == _TRUE)
+#endif //CONFIG_CONCURRENT_MODE
+	{
+		rtw_stop_cmd_thread(padapter);
+	}
+
+#ifdef CONFIG_EVENT_THREAD_MODE
+        _rtw_up_sema(&padapter->evtpriv.evt_notify);
+	if(padapter->evtThread){
+		_rtw_down_sema(&padapter->evtpriv.terminate_evtthread_sema);
+	}
+#endif
+
+#ifdef CONFIG_XMIT_THREAD_MODE
+	// Below is to termindate tx_thread...
+	_rtw_up_sema(&padapter->xmitpriv.xmit_sema);
+	_rtw_down_sema(&padapter->xmitpriv.terminate_xmitthread_sema);
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("\n drv_halt: rtw_xmit_thread can be terminated ! \n"));
+#endif
+
+#ifdef CONFIG_RECV_THREAD_MODE
+	// Below is to termindate rx_thread...
+	_rtw_up_sema(&padapter->recvpriv.recv_sema);
+	_rtw_down_sema(&padapter->recvpriv.terminate_recvthread_sema);
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("\n drv_halt:recv_thread can be terminated! \n"));
+#endif
+
+
+}
+
+u8 rtw_init_default_value(_adapter *padapter);
+u8 rtw_init_default_value(_adapter *padapter)
+{
+	u8 ret  = _SUCCESS;
+	struct registry_priv* pregistrypriv = &padapter->registrypriv;
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+	struct mlme_priv *pmlmepriv= &padapter->mlmepriv;
+	struct security_priv *psecuritypriv = &padapter->securitypriv;
+
+	//xmit_priv
+	pxmitpriv->vcs_setting = pregistrypriv->vrtl_carrier_sense;
+	pxmitpriv->vcs = pregistrypriv->vcs_type;
+	pxmitpriv->vcs_type = pregistrypriv->vcs_type;
+	//pxmitpriv->rts_thresh = pregistrypriv->rts_thresh;
+	pxmitpriv->frag_len = pregistrypriv->frag_thresh;
+
+
+
+	//recv_priv
+
+
+	//mlme_priv
+	pmlmepriv->scan_interval = SCAN_INTERVAL;// 30*2 sec = 60sec
+	pmlmepriv->scan_mode = SCAN_ACTIVE;
+
+	//qos_priv
+	//pmlmepriv->qospriv.qos_option = pregistrypriv->wmm_enable;
+
+	//ht_priv
+#ifdef CONFIG_80211N_HT
+	pmlmepriv->htpriv.ampdu_enable = _FALSE;//set to disabled
+#endif
+
+	//security_priv
+	//rtw_get_encrypt_decrypt_from_registrypriv(padapter);
+	psecuritypriv->binstallGrpkey = _FAIL;
+	psecuritypriv->sw_encrypt=pregistrypriv->software_encrypt;
+	psecuritypriv->sw_decrypt=pregistrypriv->software_decrypt;
+
+	psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_Open; //open system
+	psecuritypriv->dot11PrivacyAlgrthm = _NO_PRIVACY_;
+
+	psecuritypriv->dot11PrivacyKeyIndex = 0;
+
+	psecuritypriv->dot118021XGrpPrivacy = _NO_PRIVACY_;
+	psecuritypriv->dot118021XGrpKeyid = 1;
+
+	psecuritypriv->ndisauthtype = Ndis802_11AuthModeOpen;
+	psecuritypriv->ndisencryptstatus = Ndis802_11WEPDisabled;
+
+
+	//pwrctrl_priv
+
+
+	//registry_priv
+	rtw_init_registrypriv_dev_network(padapter);
+	rtw_update_registrypriv_dev_network(padapter);
+
+
+	//hal_priv
+	rtw_hal_def_value_init(padapter);
+
+	//misc.
+	padapter->bReadPortCancel = _FALSE;
+	padapter->bWritePortCancel = _FALSE;
+	padapter->bRxRSSIDisplay = 0;
+	padapter->bForceWriteInitGain = 1;
+	padapter->bNotifyChannelChange = 0;
+#ifdef CONFIG_P2P
+	padapter->bShowGetP2PState = 1;
+#endif
+	return ret;
+}
+
+struct dvobj_priv *devobj_init(void)
+{
+	struct dvobj_priv *pdvobj = NULL;
+
+	if ((pdvobj = (struct dvobj_priv*)rtw_zmalloc(sizeof(*pdvobj))) == NULL)
+		return NULL;
+
+	_rtw_mutex_init(&pdvobj->hw_init_mutex);
+	_rtw_mutex_init(&pdvobj->h2c_fwcmd_mutex);
+	_rtw_mutex_init(&pdvobj->setch_mutex);
+	_rtw_mutex_init(&pdvobj->setbw_mutex);
+
+	pdvobj->processing_dev_remove = _FALSE;
+
+	return pdvobj;
+}
+
+void devobj_deinit(struct dvobj_priv *pdvobj)
+{
+	if(!pdvobj)
+		return;
+
+	_rtw_mutex_free(&pdvobj->hw_init_mutex);
+	_rtw_mutex_free(&pdvobj->h2c_fwcmd_mutex);
+	_rtw_mutex_free(&pdvobj->setch_mutex);
+	_rtw_mutex_free(&pdvobj->setbw_mutex);
+
+	rtw_mfree((u8*)pdvobj, sizeof(*pdvobj));
+}
+
+u8 rtw_reset_drv_sw(_adapter *padapter)
+{
+	u8	ret8=_SUCCESS;
+	struct mlme_priv *pmlmepriv= &padapter->mlmepriv;
+	struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv;
+
+	//hal_priv
+	rtw_hal_def_value_init(padapter);
+	padapter->bReadPortCancel = _FALSE;
+	padapter->bWritePortCancel = _FALSE;
+	padapter->bRxRSSIDisplay = 0;
+	pmlmepriv->scan_interval = SCAN_INTERVAL;// 30*2 sec = 60sec
+
+	pwrctrlpriv->bips_processing = _FALSE;
+	pwrctrlpriv->rf_pwrstate = rf_on;
+
+	padapter->xmitpriv.tx_pkts = 0;
+	padapter->recvpriv.rx_pkts = 0;
+
+	pmlmepriv->LinkDetectInfo.bBusyTraffic = _FALSE;
+
+	_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY |_FW_UNDER_LINKING);
+
+#ifdef CONFIG_AUTOSUSPEND
+	#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,22) && LINUX_VERSION_CODE<=KERNEL_VERSION(2,6,34))
+		adapter_to_dvobj(padapter)->pusbdev->autosuspend_disabled = 1;//autosuspend disabled by the user
+	#endif
+#endif
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+	rtw_hal_sreset_reset_value(padapter);
+#endif
+	pwrctrlpriv->pwr_state_check_cnts = 0;
+
+	//mlmeextpriv
+	padapter->mlmeextpriv.sitesurvey_res.state= SCAN_DISABLE;
+
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	rtw_set_signal_stat_timer(&padapter->recvpriv);
+#endif
+
+	return ret8;
+}
+
+
+u8 rtw_init_drv_sw(_adapter *padapter)
+{
+
+	u8	ret8=_SUCCESS;
+
+_func_enter_;
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("+rtw_init_drv_sw\n"));
+
+	if ((rtw_init_cmd_priv(&padapter->cmdpriv)) == _FAIL)
+	{
+		RT_TRACE(_module_os_intfs_c_,_drv_err_,("\n Can't init cmd_priv\n"));
+		ret8=_FAIL;
+		goto exit;
+	}
+
+	padapter->cmdpriv.padapter=padapter;
+
+	if ((rtw_init_evt_priv(&padapter->evtpriv)) == _FAIL)
+	{
+		RT_TRACE(_module_os_intfs_c_,_drv_err_,("\n Can't init evt_priv\n"));
+		ret8=_FAIL;
+		goto exit;
+	}
+
+
+	if (rtw_init_mlme_priv(padapter) == _FAIL)
+	{
+		RT_TRACE(_module_os_intfs_c_,_drv_err_,("\n Can't init mlme_priv\n"));
+		ret8=_FAIL;
+		goto exit;
+	}
+
+#ifdef CONFIG_P2P
+	rtw_init_wifidirect_timers(padapter);
+	init_wifidirect_info(padapter, P2P_ROLE_DISABLE);
+	reset_global_wifidirect_info(padapter);
+	#ifdef CONFIG_IOCTL_CFG80211
+	rtw_init_cfg80211_wifidirect_info(padapter);
+	#endif
+#ifdef CONFIG_WFD
+	if(rtw_init_wifi_display_info(padapter) == _FAIL)
+		RT_TRACE(_module_os_intfs_c_,_drv_err_,("\n Can't init init_wifi_display_info\n"));
+#endif
+#endif /* CONFIG_P2P */
+
+	if(init_mlme_ext_priv(padapter) == _FAIL)
+	{
+		RT_TRACE(_module_os_intfs_c_,_drv_err_,("\n Can't init mlme_ext_priv\n"));
+		ret8=_FAIL;
+		goto exit;
+	}
+
+#ifdef CONFIG_TDLS
+	if(rtw_init_tdls_info(padapter) == _FAIL)
+	{
+		DBG_871X("Can't rtw_init_tdls_info\n");
+		ret8=_FAIL;
+		goto exit;
+	}
+#endif //CONFIG_TDLS
+
+	if(_rtw_init_xmit_priv(&padapter->xmitpriv, padapter) == _FAIL)
+	{
+		DBG_871X("Can't _rtw_init_xmit_priv\n");
+		ret8=_FAIL;
+		goto exit;
+	}
+
+	if(_rtw_init_recv_priv(&padapter->recvpriv, padapter) == _FAIL)
+	{
+		DBG_871X("Can't _rtw_init_recv_priv\n");
+		ret8=_FAIL;
+		goto exit;
+	}
+	// add for CONFIG_IEEE80211W, none 11w also can use
+	_rtw_spinlock_init(&padapter->security_key_mutex);
+
+	// We don't need to memset padapter->XXX to zero, because adapter is allocated by rtw_zvmalloc().
+	//_rtw_memset((unsigned char *)&padapter->securitypriv, 0, sizeof (struct security_priv));
+
+	//_init_timer(&(padapter->securitypriv.tkip_timer), padapter->pifp, rtw_use_tkipkey_handler, padapter);
+
+	if(_rtw_init_sta_priv(&padapter->stapriv) == _FAIL)
+	{
+		DBG_871X("Can't _rtw_init_sta_priv\n");
+		ret8=_FAIL;
+		goto exit;
+	}
+
+	padapter->stapriv.padapter = padapter;
+	padapter->setband = GHZ24_50;
+	rtw_init_bcmc_stainfo(padapter);
+
+	rtw_init_pwrctrl_priv(padapter);
+
+	//_rtw_memset((u8 *)&padapter->qospriv, 0, sizeof (struct qos_priv));//move to mlme_priv
+
+#ifdef CONFIG_MP_INCLUDED
+	if (init_mp_priv(padapter) == _FAIL) {
+		DBG_871X("%s: initialize MP private data Fail!\n", __func__);
+	}
+#endif
+
+	ret8 = rtw_init_default_value(padapter);
+
+	rtw_hal_dm_init(padapter);
+	rtw_hal_sw_led_init(padapter);
+
+#ifdef DBG_CONFIG_ERROR_DETECT
+	rtw_hal_sreset_init(padapter);
+#endif
+
+#ifdef CONFIG_INTEL_WIDI
+	if(rtw_init_intel_widi(padapter) == _FAIL)
+	{
+		DBG_871X("Can't rtw_init_intel_widi\n");
+		ret8=_FAIL;
+		goto exit;
+	}
+#endif //CONFIG_INTEL_WIDI
+
+#ifdef CONFIG_BR_EXT
+	_rtw_spinlock_init(&padapter->br_ext_lock);
+#endif	// CONFIG_BR_EXT
+
+exit:
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("-rtw_init_drv_sw\n"));
+
+	_func_exit_;
+
+	return ret8;
+
+}
+
+void rtw_cancel_all_timer(_adapter *padapter)
+{
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("+rtw_cancel_all_timer\n"));
+
+	_cancel_timer_ex(&padapter->mlmepriv.assoc_timer);
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("rtw_cancel_all_timer:cancel association timer complete! \n"));
+
+	//_cancel_timer_ex(&padapter->securitypriv.tkip_timer);
+	//RT_TRACE(_module_os_intfs_c_,_drv_info_,("rtw_cancel_all_timer:cancel tkip_timer! \n"));
+
+	_cancel_timer_ex(&padapter->mlmepriv.scan_to_timer);
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("rtw_cancel_all_timer:cancel scan_to_timer! \n"));
+
+	_cancel_timer_ex(&padapter->mlmepriv.dynamic_chk_timer);
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("rtw_cancel_all_timer:cancel dynamic_chk_timer! \n"));
+
+	// cancel sw led timer
+	rtw_hal_sw_led_deinit(padapter);
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("rtw_cancel_all_timer:cancel DeInitSwLeds! \n"));
+
+	_cancel_timer_ex(&padapter->pwrctrlpriv.pwr_state_check_timer);
+
+#ifdef CONFIG_IOCTL_CFG80211
+#ifdef CONFIG_P2P
+	_cancel_timer_ex(&padapter->cfg80211_wdinfo.remain_on_ch_timer);
+#endif //CONFIG_P2P
+#endif //CONFIG_IOCTL_CFG80211
+
+#ifdef CONFIG_SET_SCAN_DENY_TIMER
+	_cancel_timer_ex(&padapter->mlmepriv.set_scan_deny_timer);
+	rtw_clear_scan_deny(padapter);
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("rtw_cancel_all_timer:cancel set_scan_deny_timer! \n"));
+#endif
+
+#ifdef CONFIG_NEW_SIGNAL_STAT_PROCESS
+	_cancel_timer_ex(&padapter->recvpriv.signal_stat_timer);
+#endif
+
+	// cancel dm  timer
+	rtw_hal_dm_deinit(padapter);
+
+#ifdef CONFIG_PLATFORM_FS_MX61
+	msleep(50);
+#endif
+}
+
+u8 rtw_free_drv_sw(_adapter *padapter)
+{
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("==>rtw_free_drv_sw"));
+
+
+	//we can call rtw_p2p_enable here, but:
+	// 1. rtw_p2p_enable may have IO operation
+	// 2. rtw_p2p_enable is bundled with wext interface
+	#ifdef CONFIG_P2P
+	{
+		struct wifidirect_info *pwdinfo = &padapter->wdinfo;
+		if(!rtw_p2p_chk_state(pwdinfo, P2P_STATE_NONE))
+		{
+			_cancel_timer_ex( &pwdinfo->find_phase_timer );
+			_cancel_timer_ex( &pwdinfo->restore_p2p_state_timer );
+			_cancel_timer_ex( &pwdinfo->pre_tx_scan_timer);
+#ifdef CONFIG_CONCURRENT_MODE
+			_cancel_timer_ex( &pwdinfo->ap_p2p_switch_timer );
+#endif // CONFIG_CONCURRENT_MODE
+			rtw_p2p_set_state(pwdinfo, P2P_STATE_NONE);
+		}
+	}
+	#endif
+	// add for CONFIG_IEEE80211W, none 11w also can use
+	_rtw_spinlock_free(&padapter->security_key_mutex);
+
+#ifdef CONFIG_BR_EXT
+	_rtw_spinlock_free(&padapter->br_ext_lock);
+#endif	// CONFIG_BR_EXT
+
+#ifdef CONFIG_INTEL_WIDI
+	rtw_free_intel_widi(padapter);
+#endif //CONFIG_INTEL_WIDI
+
+	free_mlme_ext_priv(&padapter->mlmeextpriv);
+
+#ifdef CONFIG_TDLS
+	//rtw_free_tdls_info(&padapter->tdlsinfo);
+#endif //CONFIG_TDLS
+
+	rtw_free_cmd_priv(&padapter->cmdpriv);
+
+	rtw_free_evt_priv(&padapter->evtpriv);
+
+	rtw_free_mlme_priv(&padapter->mlmepriv);
+
+	//free_io_queue(padapter);
+
+	_rtw_free_xmit_priv(&padapter->xmitpriv);
+
+	_rtw_free_sta_priv(&padapter->stapriv); //will free bcmc_stainfo here
+
+	_rtw_free_recv_priv(&padapter->recvpriv);
+
+	rtw_free_pwrctrl_priv(padapter);
+
+	//rtw_mfree((void *)padapter, sizeof (padapter));
+
+#ifdef CONFIG_DRVEXT_MODULE
+	free_drvext(&padapter->drvextpriv);
+#endif
+
+	rtw_hal_free_data(padapter);
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("<==rtw_free_drv_sw\n"));
+
+	//free the old_pnetdev
+	if(padapter->rereg_nd_name_priv.old_pnetdev) {
+		free_netdev(padapter->rereg_nd_name_priv.old_pnetdev);
+		padapter->rereg_nd_name_priv.old_pnetdev = NULL;
+	}
+
+	// clear pbuddy_adapter to avoid access wrong pointer.
+	if(padapter->pbuddy_adapter != NULL)
+	{
+		padapter->pbuddy_adapter->pbuddy_adapter = NULL;
+	}
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("-rtw_free_drv_sw\n"));
+
+	return _SUCCESS;
+
+}
+
+#ifdef CONFIG_CONCURRENT_MODE
+
+#ifdef CONFIG_USB_HCI
+	#include <usb_hal.h>
+#endif
+
+#ifdef CONFIG_MULTI_VIR_IFACES
+int _netdev_vir_if_open(struct net_device *pnetdev)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+	_adapter *primary_padapter = GET_PRIMARY_ADAPTER(padapter);
+
+	DBG_871X(FUNC_NDEV_FMT" enter\n", FUNC_NDEV_ARG(pnetdev));
+
+	if(!primary_padapter)
+		goto _netdev_virtual_iface_open_error;
+
+	if(primary_padapter->bup == _FALSE || primary_padapter->hw_init_completed == _FALSE)
+	{
+		_netdev_open(primary_padapter->pnetdev);
+	}
+
+	if(padapter->bup == _FALSE && primary_padapter->bup == _TRUE &&
+		primary_padapter->hw_init_completed == _TRUE)
+	{
+		int i;
+
+		padapter->bDriverStopped = _FALSE;
+		padapter->bSurpriseRemoved = _FALSE;
+		padapter->bCardDisableWOHSM = _FALSE;
+
+		_rtw_memcpy(padapter->HalData, primary_padapter->HalData, padapter->hal_data_sz);
+
+		padapter->bFWReady = primary_padapter->bFWReady;
+
+		if(rtw_start_drv_threads(padapter) == _FAIL)
+		{
+			goto _netdev_virtual_iface_open_error;
+		}
+
+		padapter->dir_dev = NULL;
+		rtw_proc_init_one(pnetdev);
+
+#ifdef CONFIG_IOCTL_CFG80211
+		rtw_cfg80211_init_wiphy(padapter);
+#endif
+
+		padapter->bup = _TRUE;
+		padapter->hw_init_completed = _TRUE;
+	}
+
+	padapter->net_closed = _FALSE;
+
+	_set_timer(&padapter->mlmepriv.dynamic_chk_timer, 2000);
+
+	if(!rtw_netif_queue_stopped(pnetdev))
+		rtw_netif_start_queue(pnetdev);
+	else
+		rtw_netif_wake_queue(pnetdev);
+
+
+	DBG_871X(FUNC_NDEV_FMT" exit\n", FUNC_NDEV_ARG(pnetdev));
+	return 0;
+
+_netdev_virtual_iface_open_error:
+
+	padapter->bup = _FALSE;
+
+	netif_carrier_off(pnetdev);
+	rtw_netif_stop_queue(pnetdev);
+
+	return (-1);
+
+}
+
+int netdev_vir_if_open(struct net_device *pnetdev)
+{
+	int ret;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+
+	_enter_critical_mutex(&(adapter_to_dvobj(padapter)->hw_init_mutex), NULL);
+	ret = _netdev_vir_if_open(pnetdev);
+	_exit_critical_mutex(&(adapter_to_dvobj(padapter)->hw_init_mutex), NULL);
+	return ret;
+}
+
+static int netdev_vir_if_close(struct net_device *pnetdev)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+
+	padapter->net_closed = _TRUE;
+
+	if(pnetdev)
+	{
+		if (!rtw_netif_queue_stopped(pnetdev))
+			rtw_netif_stop_queue(pnetdev);
+	}
+
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_scan_abort(padapter);
+	wdev_to_priv(padapter->rtw_wdev)->bandroid_scan = _FALSE;
+#endif
+
+	return 0;
+}
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+static const struct net_device_ops rtw_netdev_vir_if_ops = {
+	 .ndo_open = netdev_vir_if_open,
+        .ndo_stop = netdev_vir_if_close,
+        .ndo_start_xmit = rtw_xmit_entry,
+        .ndo_set_mac_address = rtw_net_set_mac_address,
+        .ndo_get_stats = rtw_net_get_stats,
+        .ndo_do_ioctl = rtw_ioctl,
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+	.ndo_select_queue	= rtw_select_queue,
+#endif
+};
+#endif
+
+_adapter *rtw_drv_add_vir_if(_adapter *primary_padapter, void (*set_intf_ops)(struct _io_ops *pops))
+{
+
+	int res = _FAIL;
+	struct net_device *pnetdev=NULL;
+	_adapter *padapter = NULL;
+	struct dvobj_priv *pdvobjpriv;
+	u8 mac[ETH_ALEN];
+
+/*
+	if((primary_padapter->bup == _FALSE) ||
+		(rtw_buddy_adapter_up(primary_padapter) == _FALSE))
+	{
+		goto error_rtw_drv_add_iface;
+	}
+
+*/
+	/****** init netdev ******/
+	pnetdev = rtw_init_netdev(NULL);
+	if (!pnetdev)
+		goto error_rtw_drv_add_iface;
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+	DBG_871X("register rtw_netdev_virtual_iface_ops to netdev_ops\n");
+	pnetdev->netdev_ops = &rtw_netdev_vir_if_ops;
+#else
+	pnetdev->open = netdev_vir_if_open;
+	pnetdev->stop = netdev_vir_if_close;
+#endif
+
+#ifdef CONFIG_NO_WIRELESS_HANDLERS
+	pnetdev->wireless_handlers = NULL;
+#endif
+
+	/****** init adapter ******/
+	padapter = rtw_netdev_priv(pnetdev);
+	_rtw_memcpy(padapter, primary_padapter, sizeof(_adapter));
+
+	//
+	padapter->bup = _FALSE;
+	padapter->net_closed = _TRUE;
+	padapter->hw_init_completed = _FALSE;
+
+
+	//set adapter_type/iface type
+	padapter->isprimary = _FALSE;
+	padapter->adapter_type = MAX_ADAPTER;
+	padapter->pbuddy_adapter = primary_padapter;
+#if 0
+#ifndef CONFIG_HWPORT_SWAP	//Port0 -> Pri , Port1 -> Sec
+	padapter->iface_type = IFACE_PORT1;
+#else
+	padapter->iface_type = IFACE_PORT0;
+#endif  //CONFIG_HWPORT_SWAP
+#else
+	//extended virtual interfaces always are set to port0
+	padapter->iface_type = IFACE_PORT0;
+#endif
+	//
+	padapter->pnetdev = pnetdev;
+
+	/****** setup dvobj ******/
+	pdvobjpriv = adapter_to_dvobj(padapter);
+	padapter->iface_id = pdvobjpriv->iface_nums;
+	pdvobjpriv->padapters[pdvobjpriv->iface_nums++] = padapter;
+
+	SET_NETDEV_DEV(pnetdev, dvobj_to_dev(pdvobjpriv));
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_wdev_alloc(padapter, dvobj_to_dev(pdvobjpriv));
+#endif //CONFIG_IOCTL_CFG80211
+
+	//set interface_type/chip_type/HardwareType
+	padapter->interface_type = primary_padapter->interface_type;
+	padapter->chip_type = primary_padapter->chip_type;
+	padapter->HardwareType = primary_padapter->HardwareType;
+
+	//set hal data & hal ops
+#if defined(CONFIG_RTL8192C)
+	#if defined(CONFIG_PCI_HCI)
+		rtl8192ce_set_hal_ops(padapter);
+	#elif defined(CONFIG_USB_HCI)
+		rtl8192cu_set_hal_ops(padapter);
+	#endif
+#elif defined(CONFIG_RTL8192D)
+	#if defined(CONFIG_PCI_HCI)
+		rtl8192de_set_hal_ops(padapter);
+	#elif defined(CONFIG_USB_HCI)
+		rtl8192du_set_hal_ops(padapter);
+	#endif
+#endif
+
+	padapter->HalFunc.inirp_init = NULL;
+	padapter->HalFunc.inirp_deinit = NULL;
+	padapter->intf_start = NULL;
+	padapter->intf_stop = NULL;
+
+	//step init_io_priv
+	if ((rtw_init_io_priv(padapter, set_intf_ops)) == _FAIL) {
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,(" \n Can't init io_reqs\n"));
+	}
+
+	//step read_chip_version
+	rtw_hal_read_chip_version(padapter);
+
+	//step usb endpoint mapping
+	rtw_hal_chip_configure(padapter);
+
+
+	//init drv data
+	if(rtw_init_drv_sw(padapter)!= _SUCCESS)
+		goto error_rtw_drv_add_iface;
+
+
+	//get mac address from primary_padapter
+	_rtw_memcpy(mac, primary_padapter->eeprompriv.mac_addr, ETH_ALEN);
+
+	if (((mac[0]==0xff) &&(mac[1]==0xff) && (mac[2]==0xff) &&
+	     (mac[3]==0xff) && (mac[4]==0xff) &&(mac[5]==0xff)) ||
+	    ((mac[0]==0x0) && (mac[1]==0x0) && (mac[2]==0x0) &&
+	     (mac[3]==0x0) && (mac[4]==0x0) &&(mac[5]==0x0)))
+	{
+		mac[0] = 0x00;
+		mac[1] = 0xe0;
+		mac[2] = 0x4c;
+		mac[3] = 0x87;
+		mac[4] = 0x11;
+		mac[5] = 0x22;
+	}
+	else
+	{
+		//If the BIT1 is 0, the address is universally administered.
+		//If it is 1, the address is locally administered
+#if 1 //needs enable MBSSID CAM
+		mac[0] |= BIT(1); // locally administered
+		mac[0] |= (padapter->iface_id-1)<<4;
+#endif
+	}
+
+	_rtw_memcpy(padapter->eeprompriv.mac_addr, mac, ETH_ALEN);
+
+	padapter->dir_dev = NULL;
+
+	res = _SUCCESS;
+
+	return padapter;
+
+
+error_rtw_drv_add_iface:
+
+	if(padapter)
+		rtw_free_drv_sw(padapter);
+
+	if (pnetdev)
+		rtw_free_netdev(pnetdev);
+
+	return NULL;
+
+}
+
+void rtw_drv_stop_vir_if(_adapter *padapter)
+{
+	struct net_device *pnetdev=NULL;
+
+	if (padapter == NULL)
+		return;
+
+	pnetdev = padapter->pnetdev;
+
+	rtw_cancel_all_timer(padapter);
+
+	if(padapter->bup == _TRUE)
+	{
+		padapter->bDriverStopped = _TRUE;
+
+		#ifdef CONFIG_XMIT_ACK
+		if (padapter->xmitpriv.ack_tx)
+			rtw_ack_tx_done(&padapter->xmitpriv, RTW_SCTX_DONE_DRV_STOP);
+		#endif
+
+		if(padapter->intf_stop)
+		{
+			padapter->intf_stop(padapter);
+		}
+
+		rtw_stop_drv_threads(padapter);
+
+		padapter->bup = _FALSE;
+	}
+}
+
+void rtw_drv_free_vir_if(_adapter *padapter)
+{
+	struct net_device *pnetdev=NULL;
+
+	if (padapter == NULL)
+		return;
+
+	padapter->pbuddy_adapter = NULL;
+
+	pnetdev = padapter->pnetdev;
+
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_wdev_free(padapter->rtw_wdev);
+#endif //CONFIG_IOCTL_CFG80211
+
+	rtw_free_drv_sw(padapter);
+
+	rtw_free_netdev(pnetdev);
+}
+
+void rtw_drv_stop_vir_ifaces(struct dvobj_priv *dvobj)
+{
+	int i;
+	//struct dvobj_priv *dvobj = primary_padapter->dvobj;
+
+	for(i=2;i<dvobj->iface_nums;i++)
+	{
+		rtw_drv_stop_vir_if(dvobj->padapters[i]);
+	}
+}
+
+void rtw_drv_free_vir_ifaces(struct dvobj_priv *dvobj)
+{
+	int i;
+	//struct dvobj_priv *dvobj = primary_padapter->dvobj;
+
+	for(i=2;i<dvobj->iface_nums;i++)
+	{
+		rtw_drv_free_vir_if(dvobj->padapters[i]);
+	}
+}
+
+void rtw_drv_del_vir_if(_adapter *padapter)
+{
+	rtw_drv_stop_vir_if(padapter);
+	rtw_drv_free_vir_if(padapter);
+}
+
+void rtw_drv_del_vir_ifaces(_adapter *primary_padapter)
+{
+	int i;
+	struct dvobj_priv *dvobj = primary_padapter->dvobj;
+
+	for(i=2;i<dvobj->iface_nums;i++)
+	{
+		rtw_drv_del_vir_if(dvobj->padapters[i]);
+	}
+}
+#endif //CONFIG_MULTI_VIR_IFACES
+
+int _netdev_if2_open(struct net_device *pnetdev)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+	_adapter *primary_padapter = padapter->pbuddy_adapter;
+
+	DBG_871X("+871x_drv - if2_open, bup=%d\n", padapter->bup);
+
+	if(primary_padapter->bup == _FALSE || primary_padapter->hw_init_completed == _FALSE)
+	{
+		_netdev_open(primary_padapter->pnetdev);
+	}
+
+	if(padapter->bup == _FALSE && primary_padapter->bup == _TRUE &&
+		primary_padapter->hw_init_completed == _TRUE)
+	{
+		int i;
+
+		padapter->bDriverStopped = _FALSE;
+		padapter->bSurpriseRemoved = _FALSE;
+		padapter->bCardDisableWOHSM = _FALSE;
+
+		_rtw_memcpy(padapter->HalData, primary_padapter->HalData, padapter->hal_data_sz);
+
+		padapter->bFWReady = primary_padapter->bFWReady;
+
+		rtw_hal_set_hwreg(padapter, HW_VAR_DM_INIT_PWDB, NULL);
+
+		//if (init_mlme_ext_priv(padapter) == _FAIL)
+		//	goto netdev_if2_open_error;
+
+
+		if(rtw_start_drv_threads(padapter) == _FAIL)
+		{
+			goto netdev_if2_open_error;
+		}
+
+
+		if(padapter->intf_start)
+		{
+			padapter->intf_start(padapter);
+		}
+
+
+		padapter->hw_init_completed = _TRUE;
+
+		padapter->dir_dev = NULL;
+		rtw_proc_init_one(pnetdev);
+
+
+#ifdef CONFIG_IOCTL_CFG80211
+		rtw_cfg80211_init_wiphy(padapter);
+#endif
+
+		padapter->bup = _TRUE;
+
+	}
+
+	padapter->net_closed = _FALSE;
+
+	_set_timer(&padapter->mlmepriv.dynamic_chk_timer, 2000);
+
+	if(!rtw_netif_queue_stopped(pnetdev))
+		rtw_netif_start_queue(pnetdev);
+	else
+		rtw_netif_wake_queue(pnetdev);
+
+	DBG_871X("-871x_drv - if2_open, bup=%d\n", padapter->bup);
+	return 0;
+
+netdev_if2_open_error:
+
+	padapter->bup = _FALSE;
+
+	netif_carrier_off(pnetdev);
+	rtw_netif_stop_queue(pnetdev);
+
+	return (-1);
+
+}
+
+int netdev_if2_open(struct net_device *pnetdev)
+{
+	int ret;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+
+	_enter_critical_mutex(&(adapter_to_dvobj(padapter)->hw_init_mutex), NULL);
+	ret = _netdev_if2_open(pnetdev);
+	_exit_critical_mutex(&(adapter_to_dvobj(padapter)->hw_init_mutex), NULL);
+	return ret;
+}
+
+static int netdev_if2_close(struct net_device *pnetdev)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+
+	padapter->net_closed = _TRUE;
+
+	if(pnetdev)
+	{
+		if (!rtw_netif_queue_stopped(pnetdev))
+			rtw_netif_stop_queue(pnetdev);
+	}
+
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_scan_abort(padapter);
+	wdev_to_priv(padapter->rtw_wdev)->bandroid_scan = _FALSE;
+#endif
+
+	return 0;
+}
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+static const struct net_device_ops rtw_netdev_if2_ops = {
+	.ndo_open = netdev_if2_open,
+        .ndo_stop = netdev_if2_close,
+        .ndo_start_xmit = rtw_xmit_entry,
+        .ndo_set_mac_address = rtw_net_set_mac_address,
+        .ndo_get_stats = rtw_net_get_stats,
+        .ndo_do_ioctl = rtw_ioctl,
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+	.ndo_select_queue	= rtw_select_queue,
+#endif
+};
+#endif
+
+_adapter *rtw_drv_if2_init(_adapter *primary_padapter, void (*set_intf_ops)(struct _io_ops *pops))
+{
+	int res = _FAIL;
+	struct net_device *pnetdev =  NULL;
+	_adapter *padapter = NULL;
+	struct dvobj_priv *pdvobjpriv;
+	u8 mac[ETH_ALEN];
+
+	/****** init netdev ******/
+	pnetdev = rtw_init_netdev(NULL);
+	if (!pnetdev)
+		goto error_rtw_drv_if2_init;
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,29))
+	DBG_871X("register rtw_netdev_if2_ops to netdev_ops\n");
+	pnetdev->netdev_ops = &rtw_netdev_if2_ops;
+#else
+	pnetdev->open = netdev_if2_open;
+	pnetdev->stop = netdev_if2_close;
+#endif
+
+#ifdef CONFIG_NO_WIRELESS_HANDLERS
+	pnetdev->wireless_handlers = NULL;
+#endif
+
+	/****** init adapter ******/
+	padapter = rtw_netdev_priv(pnetdev);
+	_rtw_memcpy(padapter, primary_padapter, sizeof(_adapter));
+
+	//
+	padapter->bup = _FALSE;
+	padapter->net_closed = _TRUE;
+	padapter->hw_init_completed = _FALSE;
+
+	//set adapter_type/iface type
+	padapter->isprimary = _FALSE;
+	padapter->adapter_type = SECONDARY_ADAPTER;
+	padapter->pbuddy_adapter = primary_padapter;
+        padapter->iface_id = IFACE_ID1;
+#ifndef CONFIG_HWPORT_SWAP			//Port0 -> Pri , Port1 -> Sec
+	padapter->iface_type = IFACE_PORT1;
+#else
+	padapter->iface_type = IFACE_PORT0;
+#endif  //CONFIG_HWPORT_SWAP
+	//
+	padapter->pnetdev = pnetdev;
+
+	/****** setup dvobj ******/
+	pdvobjpriv = adapter_to_dvobj(padapter);
+	pdvobjpriv->if2 = padapter;
+	pdvobjpriv->padapters[pdvobjpriv->iface_nums++] = padapter;
+
+	SET_NETDEV_DEV(pnetdev, dvobj_to_dev(pdvobjpriv));
+	#ifdef CONFIG_IOCTL_CFG80211
+	rtw_wdev_alloc(padapter, dvobj_to_dev(pdvobjpriv));
+	#endif //CONFIG_IOCTL_CFG80211
+
+	//set interface_type/chip_type/HardwareType
+	padapter->interface_type = primary_padapter->interface_type;
+	padapter->chip_type = primary_padapter->chip_type;
+	padapter->HardwareType = primary_padapter->HardwareType;
+
+	//set hal data & hal ops
+#if defined(CONFIG_RTL8192C)
+	#if defined(CONFIG_PCI_HCI)
+		rtl8192ce_set_hal_ops(padapter);
+	#elif defined(CONFIG_USB_HCI)
+		rtl8192cu_set_hal_ops(padapter);
+	#endif
+#elif defined(CONFIG_RTL8192D)
+	#if defined(CONFIG_PCI_HCI)
+		rtl8192de_set_hal_ops(padapter);
+	#elif defined(CONFIG_USB_HCI)
+		rtl8192du_set_hal_ops(padapter);
+	#endif
+#endif
+
+	padapter->HalFunc.inirp_init = NULL;
+	padapter->HalFunc.inirp_deinit = NULL;
+
+	//
+	padapter->intf_start = primary_padapter->intf_start;
+	padapter->intf_stop = primary_padapter->intf_stop;
+
+	//step init_io_priv
+	if ((rtw_init_io_priv(padapter, set_intf_ops)) == _FAIL) {
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,(" \n Can't init io_reqs\n"));
+	}
+
+	//step read_chip_version
+	rtw_hal_read_chip_version(padapter);
+
+	//step usb endpoint mapping
+	rtw_hal_chip_configure(padapter);
+
+
+	//init drv data
+	if(rtw_init_drv_sw(padapter)!= _SUCCESS)
+		goto error_rtw_drv_if2_init;
+
+	//get mac address from primary_padapter
+	_rtw_memcpy(mac, primary_padapter->eeprompriv.mac_addr, ETH_ALEN);
+
+	if (((mac[0]==0xff) &&(mac[1]==0xff) && (mac[2]==0xff) &&
+	     (mac[3]==0xff) && (mac[4]==0xff) &&(mac[5]==0xff)) ||
+	    ((mac[0]==0x0) && (mac[1]==0x0) && (mac[2]==0x0) &&
+	     (mac[3]==0x0) && (mac[4]==0x0) &&(mac[5]==0x0)))
+	{
+		mac[0] = 0x00;
+		mac[1] = 0xe0;
+		mac[2] = 0x4c;
+		mac[3] = 0x87;
+		mac[4] = 0x11;
+		mac[5] = 0x22;
+	}
+	else
+	{
+		//If the BIT1 is 0, the address is universally administered.
+		//If it is 1, the address is locally administered
+		mac[0] |= BIT(1); // locally administered
+
+	}
+
+	_rtw_memcpy(padapter->eeprompriv.mac_addr, mac, ETH_ALEN);
+	rtw_init_wifidirect_addrs(padapter, padapter->eeprompriv.mac_addr, padapter->eeprompriv.mac_addr);
+
+	primary_padapter->pbuddy_adapter = padapter;
+
+	padapter->dir_dev = NULL;
+
+	res = _SUCCESS;
+
+	return padapter;
+
+
+error_rtw_drv_if2_init:
+
+	if(padapter)
+		rtw_free_drv_sw(padapter);
+
+	if (pnetdev)
+		rtw_free_netdev(pnetdev);
+
+	return NULL;
+
+}
+
+void rtw_drv_if2_free(_adapter *if2)
+{
+	_adapter *padapter = if2;
+	struct net_device *pnetdev = NULL;
+
+	if (padapter == NULL)
+		return;
+
+	pnetdev = padapter->pnetdev;
+
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_wdev_free(padapter->rtw_wdev);
+#endif /* CONFIG_IOCTL_CFG80211 */
+
+
+	rtw_free_drv_sw(padapter);
+
+	rtw_free_netdev(pnetdev);
+
+}
+
+void rtw_drv_if2_stop(_adapter *if2)
+{
+	_adapter *padapter = if2;
+
+	if (padapter == NULL)
+		return;
+
+	rtw_cancel_all_timer(padapter);
+
+	if (padapter->bup == _TRUE) {
+		padapter->bDriverStopped = _TRUE;
+		#ifdef CONFIG_XMIT_ACK
+		if (padapter->xmitpriv.ack_tx)
+			rtw_ack_tx_done(&padapter->xmitpriv, RTW_SCTX_DONE_DRV_STOP);
+		#endif
+
+		if(padapter->intf_stop)
+		{
+			padapter->intf_stop(padapter);
+		}
+
+		rtw_stop_drv_threads(padapter);
+
+		padapter->bup = _FALSE;
+	}
+}
+#endif //end of CONFIG_CONCURRENT_MODE
+
+#ifdef CONFIG_BR_EXT
+void netdev_br_init(struct net_device *netdev)
+{
+	_adapter *adapter = (_adapter *)rtw_netdev_priv(netdev);
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35))
+	rcu_read_lock();
+#endif	// (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35))
+
+	//if(check_fwstate(pmlmepriv, WIFI_STATION_STATE|WIFI_ADHOC_STATE) == _TRUE)
+	{
+		//struct net_bridge	*br = netdev->br_port->br;//->dev->dev_addr;
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+		if (netdev->br_port)
+#else   // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+		if (rcu_dereference(adapter->pnetdev->rx_handler_data))
+#endif  // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+		{
+			struct net_device *br_netdev;
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24))
+			br_netdev = dev_get_by_name(CONFIG_BR_EXT_BRNAME);
+#else	// (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24))
+			struct net *devnet = NULL;
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26))
+			devnet = netdev->nd_net;
+#else	// (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26))
+			devnet = dev_net(netdev);
+#endif	// (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26))
+
+			br_netdev = dev_get_by_name(devnet, CONFIG_BR_EXT_BRNAME);
+#endif	// (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24))
+
+			if (br_netdev) {
+				memcpy(adapter->br_mac, br_netdev->dev_addr, ETH_ALEN);
+				dev_put(br_netdev);
+			} else
+				printk("%s()-%d: dev_get_by_name(%s) failed!", __FUNCTION__, __LINE__, CONFIG_BR_EXT_BRNAME);
+		}
+
+		adapter->ethBrExtInfo.addPPPoETag = 1;
+	}
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35))
+	rcu_read_unlock();
+#endif	// (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35))
+}
+#endif //CONFIG_BR_EXT
+
+static int _rtw_drv_register_netdev(_adapter *padapter, char *name)
+{
+	int ret = _SUCCESS;
+	struct net_device *pnetdev = padapter->pnetdev;
+
+	/* alloc netdev name */
+	rtw_init_netdev_name(pnetdev, name);
+
+	_rtw_memcpy(pnetdev->dev_addr, padapter->eeprompriv.mac_addr, ETH_ALEN);
+
+	/* Tell the network stack we exist */
+	if (register_netdev(pnetdev) != 0) {
+		DBG_871X(FUNC_NDEV_FMT "Failed!\n", FUNC_NDEV_ARG(pnetdev));
+		ret = _FAIL;
+		goto error_register_netdev;
+	}
+
+	DBG_871X("%s, MAC Address (if%d) = " MAC_FMT "\n", __FUNCTION__, (padapter->iface_id+1), MAC_ARG(pnetdev->dev_addr));
+
+	return ret;
+
+error_register_netdev:
+
+	if(padapter->iface_id > IFACE_ID0)
+	{
+		rtw_free_drv_sw(padapter);
+
+		rtw_free_netdev(pnetdev);
+	}
+
+	return ret;
+}
+
+int rtw_drv_register_netdev(_adapter *if1)
+{
+	int i, status = _SUCCESS;
+	struct dvobj_priv *dvobj = if1->dvobj;
+
+	if(dvobj->iface_nums < IFACE_ID_MAX)
+	{
+		for(i=0; i<dvobj->iface_nums; i++)
+		{
+			_adapter *padapter = dvobj->padapters[i];
+
+			if(padapter)
+			{
+				char *name;
+
+				if(padapter->iface_id == IFACE_ID0)
+					name = if1->registrypriv.ifname;
+				else if(padapter->iface_id == IFACE_ID1)
+					name = if1->registrypriv.if2name;
+				else
+					name = "wlan%d";
+
+				if((status = _rtw_drv_register_netdev(padapter, name)) != _SUCCESS) {
+					break;
+				}
+			}
+		}
+	}
+
+	return status;
+}
+
+int _netdev_open(struct net_device *pnetdev)
+{
+	uint status;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+	struct pwrctrl_priv *pwrctrlpriv = &padapter->pwrctrlpriv;
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("+871x_drv - dev_open\n"));
+	DBG_871X("+871x_drv - drv_open, bup=%d\n", padapter->bup);
+
+	if(pwrctrlpriv->ps_flag == _TRUE){
+		padapter->net_closed = _FALSE;
+		goto netdev_open_normal_process;
+	}
+
+	if(padapter->bup == _FALSE)
+	{
+		padapter->bDriverStopped = _FALSE;
+		padapter->bSurpriseRemoved = _FALSE;
+		padapter->bCardDisableWOHSM = _FALSE;
+
+		status = rtw_hal_init(padapter);
+		if (status ==_FAIL)
+		{
+			RT_TRACE(_module_os_intfs_c_,_drv_err_,("rtl871x_hal_init(): Can't init h/w!\n"));
+			goto netdev_open_error;
+		}
+
+		DBG_871X("MAC Address = "MAC_FMT"\n", MAC_ARG(pnetdev->dev_addr));
+
+
+		status=rtw_start_drv_threads(padapter);
+		if(status ==_FAIL)
+		{
+			RT_TRACE(_module_os_intfs_c_,_drv_err_,("Initialize driver software resource Failed!\n"));
+			goto netdev_open_error;
+		}
+
+#ifdef CONFIG_DRVEXT_MODULE
+		init_drvext(padapter);
+#endif
+
+		if(padapter->intf_start)
+		{
+			padapter->intf_start(padapter);
+		}
+
+#ifndef RTK_DMP_PLATFORM
+		rtw_proc_init_one(pnetdev);
+#endif
+
+#ifdef CONFIG_IOCTL_CFG80211
+		rtw_cfg80211_init_wiphy(padapter);
+#endif
+
+		rtw_led_control(padapter, LED_CTL_NO_LINK);
+
+		padapter->bup = _TRUE;
+	}
+	padapter->net_closed = _FALSE;
+
+	_set_timer(&padapter->mlmepriv.dynamic_chk_timer, 2000);
+
+	padapter->pwrctrlpriv.bips_processing = _FALSE;
+	rtw_set_pwr_state_check_timer(&padapter->pwrctrlpriv);
+
+	//netif_carrier_on(pnetdev);//call this func when rtw_joinbss_event_callback return success
+	if(!rtw_netif_queue_stopped(pnetdev))
+		rtw_netif_start_queue(pnetdev);
+	else
+		rtw_netif_wake_queue(pnetdev);
+
+#ifdef CONFIG_BR_EXT
+	netdev_br_init(pnetdev);
+#endif	// CONFIG_BR_EXT
+
+netdev_open_normal_process:
+
+	#ifdef CONFIG_CONCURRENT_MODE
+	{
+		_adapter *sec_adapter = padapter->pbuddy_adapter;
+		if(sec_adapter && (sec_adapter->bup == _FALSE || sec_adapter->hw_init_completed == _FALSE))
+			_netdev_if2_open(sec_adapter->pnetdev);
+	}
+	#endif
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("-871x_drv - dev_open\n"));
+	DBG_871X("-871x_drv - drv_open, bup=%d\n", padapter->bup);
+
+	return 0;
+
+netdev_open_error:
+
+	padapter->bup = _FALSE;
+
+	netif_carrier_off(pnetdev);
+	rtw_netif_stop_queue(pnetdev);
+
+	RT_TRACE(_module_os_intfs_c_,_drv_err_,("-871x_drv - dev_open, fail!\n"));
+	DBG_871X("-871x_drv - drv_open fail, bup=%d\n", padapter->bup);
+
+	return (-1);
+
+}
+
+int netdev_open(struct net_device *pnetdev)
+{
+	int ret;
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+
+	_enter_critical_mutex(&(adapter_to_dvobj(padapter)->hw_init_mutex), NULL);
+	ret = _netdev_open(pnetdev);
+	_exit_critical_mutex(&(adapter_to_dvobj(padapter)->hw_init_mutex), NULL);
+
+	return ret;
+}
+
+#ifdef CONFIG_IPS
+int  ips_netdrv_open(_adapter *padapter)
+{
+	int status = _SUCCESS;
+	padapter->net_closed = _FALSE;
+	DBG_871X("===> %s.........\n",__FUNCTION__);
+
+
+	padapter->bDriverStopped = _FALSE;
+	padapter->bCardDisableWOHSM = _FALSE;
+	//padapter->bup = _TRUE;
+
+	status = rtw_hal_init(padapter);
+	if (status ==_FAIL)
+	{
+		RT_TRACE(_module_os_intfs_c_,_drv_err_,("ips_netdrv_open(): Can't init h/w!\n"));
+		goto netdev_open_error;
+	}
+
+	if(padapter->intf_start)
+	{
+		padapter->intf_start(padapter);
+	}
+
+	rtw_set_pwr_state_check_timer(&padapter->pwrctrlpriv);
+	_set_timer(&padapter->mlmepriv.dynamic_chk_timer,5000);
+
+	 return _SUCCESS;
+
+netdev_open_error:
+	//padapter->bup = _FALSE;
+	DBG_871X("-ips_netdrv_open - drv_open failure, bup=%d\n", padapter->bup);
+
+	return _FAIL;
+}
+
+
+int rtw_ips_pwr_up(_adapter *padapter)
+{
+	int result;
+	u32 start_time = rtw_get_current_time();
+	DBG_871X("===>  rtw_ips_pwr_up..............\n");
+	rtw_reset_drv_sw(padapter);
+
+	result = ips_netdrv_open(padapter);
+
+	rtw_led_control(padapter, LED_CTL_NO_LINK);
+
+	DBG_871X("<===  rtw_ips_pwr_up.............. in %dms\n", rtw_get_passing_time_ms(start_time));
+	return result;
+
+}
+
+void rtw_ips_pwr_down(_adapter *padapter)
+{
+	u32 start_time = rtw_get_current_time();
+	DBG_871X("===> rtw_ips_pwr_down...................\n");
+
+	padapter->bCardDisableWOHSM = _TRUE;
+	padapter->net_closed = _TRUE;
+
+	rtw_led_control(padapter, LED_CTL_POWER_OFF);
+
+	rtw_ips_dev_unload(padapter);
+	padapter->bCardDisableWOHSM = _FALSE;
+	DBG_871X("<=== rtw_ips_pwr_down..................... in %dms\n", rtw_get_passing_time_ms(start_time));
+}
+#endif
+void rtw_ips_dev_unload(_adapter *padapter)
+{
+	struct net_device *pnetdev= (struct net_device*)padapter->pnetdev;
+	struct xmit_priv	*pxmitpriv = &(padapter->xmitpriv);
+	DBG_871X("====> %s...\n",__FUNCTION__);
+
+	rtw_hal_set_hwreg(padapter, HW_VAR_FIFO_CLEARN_UP, 0);
+
+	if(padapter->intf_stop)
+	{
+		padapter->intf_stop(padapter);
+	}
+
+	//s5.
+	if(padapter->bSurpriseRemoved == _FALSE)
+	{
+		rtw_hal_deinit(padapter);
+	}
+
+}
+
+int pm_netdev_open(struct net_device *pnetdev,u8 bnormal)
+{
+	int status;
+	if(bnormal)
+		status = netdev_open(pnetdev);
+#ifdef CONFIG_IPS
+	else
+		status =  (_SUCCESS == ips_netdrv_open((_adapter *)rtw_netdev_priv(pnetdev)))?(0):(-1);
+#endif
+
+	return status;
+}
+
+static int netdev_close(struct net_device *pnetdev)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("+871x_drv - drv_close\n"));
+
+	if(padapter->pwrctrlpriv.bInternalAutoSuspend == _TRUE)
+	{
+		//rtw_pwr_wakeup(padapter);
+		if(padapter->pwrctrlpriv.rf_pwrstate == rf_off)
+			padapter->pwrctrlpriv.ps_flag = _TRUE;
+	}
+	padapter->net_closed = _TRUE;
+
+/*	if(!padapter->hw_init_completed)
+	{
+		DBG_871X("(1)871x_drv - drv_close, bup=%d, hw_init_completed=%d\n", padapter->bup, padapter->hw_init_completed);
+
+		padapter->bDriverStopped = _TRUE;
+
+		rtw_dev_unload(padapter);
+	}
+	else*/
+	if(padapter->pwrctrlpriv.rf_pwrstate == rf_on){
+		DBG_871X("(2)871x_drv - drv_close, bup=%d, hw_init_completed=%d\n", padapter->bup, padapter->hw_init_completed);
+
+		//s1.
+		if(pnetdev)
+		{
+			if (!rtw_netif_queue_stopped(pnetdev))
+				rtw_netif_stop_queue(pnetdev);
+		}
+
+#ifndef CONFIG_ANDROID
+		//s2.
+		LeaveAllPowerSaveMode(padapter);
+		rtw_disassoc_cmd(padapter, 500, _FALSE);
+		//s2-2.  indicate disconnect to os
+		rtw_indicate_disconnect(padapter);
+		//s2-3.
+		rtw_free_assoc_resources(padapter, 1);
+		//s2-4.
+		rtw_free_network_queue(padapter,_TRUE);
+#endif
+		// Close LED
+		rtw_led_control(padapter, LED_CTL_POWER_OFF);
+	}
+
+#ifdef CONFIG_BR_EXT
+	//if (OPMODE & (WIFI_STATION_STATE | WIFI_ADHOC_STATE))
+	{
+		//void nat25_db_cleanup(_adapter *priv);
+		nat25_db_cleanup(padapter);
+	}
+#endif	// CONFIG_BR_EXT
+
+#ifdef CONFIG_P2P
+#ifdef CONFIG_IOCTL_CFG80211
+	if( padapter->wdinfo.driver_interface == DRIVER_CFG80211 )
+	{
+		if(wdev_to_priv(padapter->rtw_wdev)->p2p_enabled == _TRUE)
+			wdev_to_priv(padapter->rtw_wdev)->p2p_enabled = _FALSE;
+	}
+#endif //CONFIG_IOCTL_CFG80211
+	rtw_p2p_enable(padapter, P2P_ROLE_DISABLE);
+#endif //CONFIG_P2P
+
+#ifdef CONFIG_IOCTL_CFG80211
+	rtw_scan_abort(padapter);
+	wdev_to_priv(padapter->rtw_wdev)->bandroid_scan = _FALSE;
+	padapter->rtw_wdev->iftype = NL80211_IFTYPE_MONITOR; //set this at the end
+#endif //CONFIG_IOCTL_CFG80211
+
+	RT_TRACE(_module_os_intfs_c_,_drv_info_,("-871x_drv - drv_close\n"));
+	DBG_871X("-871x_drv - drv_close, bup=%d\n", padapter->bup);
+
+	return 0;
+}
+
+void rtw_ndev_destructor(struct net_device *ndev)
+{
+	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if (ndev->ieee80211_ptr)
+		rtw_mfree((u8 *)ndev->ieee80211_ptr, sizeof(struct wireless_dev));
+#endif
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/pci_intf.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/pci_intf.c
new file mode 100644
index 000000000000..15f5d9b9e0bf
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/pci_intf.c
@@ -0,0 +1,1996 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _HCI_INTF_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#include <xmit_osdep.h>
+#include <hal_intf.h>
+#include <rtw_version.h>
+
+#ifndef CONFIG_PCI_HCI
+
+#error "CONFIG_PCI_HCI shall be on!\n"
+
+#endif
+
+#include <pci_ops.h>
+#include <pci_osintf.h>
+#include <pci_hal.h>
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+
+#error "Shall be Linux or Windows, but not both!\n"
+
+#endif
+
+#ifdef CONFIG_80211N_HT
+extern int rtw_ht_enable;
+extern int rtw_cbw40_enable;
+extern int rtw_ampdu_enable;//for enable tx_ampdu
+#endif
+
+#ifdef CONFIG_PM
+extern int pm_netdev_open(struct net_device *pnetdev);
+static int rtw_suspend(struct pci_dev *pdev, pm_message_t state);
+static int rtw_resume(struct pci_dev *pdev);
+#endif
+
+
+static int rtw_drv_init(struct pci_dev *pdev, const struct pci_device_id *pdid);
+static void rtw_dev_remove(struct pci_dev *pdev);
+
+static struct specific_device_id specific_device_id_tbl[] = {
+	{.idVendor=0x0b05, .idProduct=0x1791, .flags=SPEC_DEV_ID_DISABLE_HT},
+	{.idVendor=0x13D3, .idProduct=0x3311, .flags=SPEC_DEV_ID_DISABLE_HT},
+	{}
+};
+
+struct pci_device_id rtw_pci_id_tbl[] = {
+#ifdef CONFIG_RTL8192C
+	{PCI_DEVICE(PCI_VENDER_ID_REALTEK, 0x8191)},
+	{PCI_DEVICE(PCI_VENDER_ID_REALTEK, 0x8178)},
+	{PCI_DEVICE(PCI_VENDER_ID_REALTEK, 0x8177)},
+	{PCI_DEVICE(PCI_VENDER_ID_REALTEK, 0x8176)},
+#endif
+#ifdef CONFIG_RTL8192D
+	{PCI_DEVICE(PCI_VENDER_ID_REALTEK, 0x8193)},
+	{PCI_DEVICE(PCI_VENDER_ID_REALTEK, 0x002B)},
+#endif
+	{},
+};
+
+struct pci_drv_priv {
+	struct pci_driver rtw_pci_drv;
+	int drv_registered;
+};
+
+
+static struct pci_drv_priv pci_drvpriv = {
+	.rtw_pci_drv.name = (char*)DRV_NAME,
+	.rtw_pci_drv.probe = rtw_drv_init,
+	.rtw_pci_drv.remove = rtw_dev_remove,
+	.rtw_pci_drv.id_table = rtw_pci_id_tbl,
+#ifdef CONFIG_PM
+	.rtw_pci_drv.suspend = rtw_suspend,
+	.rtw_pci_drv.resume = rtw_resume,
+#else
+	.rtw_pci_drv.suspend = NULL,
+	.rtw_pci_drv.resume = NULL,
+#endif
+};
+
+
+MODULE_DEVICE_TABLE(pci, rtw_pci_id_tbl);
+
+
+static u16 pcibridge_vendors[PCI_BRIDGE_VENDOR_MAX] = {
+	INTEL_VENDOR_ID,
+	ATI_VENDOR_ID,
+	AMD_VENDOR_ID,
+	SIS_VENDOR_ID
+};
+
+static u8 rtw_pci_platform_switch_device_pci_aspm(_adapter *padapter, u8 value)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	u8	bresult = _SUCCESS;
+	int	error;
+
+	value |= 0x40;
+
+	error = pci_write_config_byte(pdvobjpriv->ppcidev, 0x80, value);
+
+	if(error != 0)
+	{
+		bresult = _FALSE;
+		DBG_871X("rtw_pci_platform_switch_device_pci_aspm error (%d)\n",error);
+	}
+
+	return bresult;
+}
+
+//
+// When we set 0x01 to enable clk request. Set 0x0 to disable clk req.
+//
+static u8 rtw_pci_switch_clk_req(_adapter *padapter, u8 value)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	u8	buffer, bresult = _SUCCESS;
+	int	error;
+
+	buffer = value;
+
+	if(!padapter->hw_init_completed)
+		return bresult;
+
+	error = pci_write_config_byte(pdvobjpriv->ppcidev, 0x81, value);
+
+	if(error != 0)
+	{
+		bresult = _FALSE;
+		DBG_871X("rtw_pci_switch_clk_req error (%d)\n",error);
+	}
+
+	return bresult;
+}
+
+#if 0
+//Description:
+//Disable RTL8192SE ASPM & Disable Pci Bridge ASPM
+void rtw_pci_disable_aspm(_adapter *padapter)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct pwrctrl_priv	*pwrpriv = &padapter->pwrctrlpriv;
+	struct pci_priv	*pcipriv = &(pdvobjpriv->pcipriv);
+	u32	pcicfg_addrport = 0;
+	u8	num4bytes;
+	u8	linkctrl_reg;
+	u16	pcibridge_linkctrlreg, aspmlevel = 0;
+
+	// When there exists anyone's busnum, devnum, and funcnum that are set to 0xff,
+	// we do not execute any action and return.
+	// if it is not intel bus then don't enable ASPM.
+	if ((pcipriv->busnumber == 0xff
+		&& pcipriv->devnumber == 0xff
+		&& pcipriv->funcnumber == 0xff)
+		|| (pcipriv->pcibridge_busnum == 0xff
+		&& pcipriv->pcibridge_devnum == 0xff
+		&& pcipriv->pcibridge_funcnum == 0xff))
+	{
+		DBG_871X("PlatformEnableASPM(): Fail to enable ASPM. Cannot find the Bus of PCI(Bridge).\n");
+		return;
+	}
+
+	if (pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_UNKNOWN) {
+		DBG_871X("%s(): Disable ASPM. Recognize the Bus of PCI(Bridge) as UNKNOWN.\n", __func__);
+	}
+
+	if (pwrpriv->reg_rfps_level & RT_RF_OFF_LEVL_CLK_REQ) {
+		RT_CLEAR_PS_LEVEL(pwrpriv, RT_RF_OFF_LEVL_CLK_REQ);
+		rtw_pci_switch_clk_req(padapter, 0x0);
+	}
+
+	{
+		// Suggested by SD1 for promising device will in L0 state after an I/O.
+		u8 tmp_u1b;
+
+		pci_read_config_byte(pdvobjpriv->ppcidev, 0x80, &tmp_u1b);
+	}
+
+	// Retrieve original configuration settings.
+	linkctrl_reg = pcipriv->linkctrl_reg;
+	pcibridge_linkctrlreg = pcipriv->pcibridge_linkctrlreg;
+
+	// Set corresponding value.
+	aspmlevel |= BIT(0) | BIT(1);
+	linkctrl_reg &= ~aspmlevel;
+	pcibridge_linkctrlreg &= ~(BIT(0) | BIT(1));
+
+	rtw_pci_platform_switch_device_pci_aspm(padapter, linkctrl_reg);
+	rtw_udelay_os(50);
+
+	//When there exists anyone's busnum, devnum, and funcnum that are set to 0xff,
+	// we do not execute any action and return.
+	if ((pcipriv->busnumber == 0xff &&
+		pcipriv->devnumber == 0xff &&
+		pcipriv->funcnumber == 0xff) ||
+		(pcipriv->pcibridge_busnum == 0xff &&
+		pcipriv->pcibridge_devnum == 0xff
+		&& pcipriv->pcibridge_funcnum == 0xff))
+	{
+		//Do Nothing!!
+	}
+	else
+	{
+		//4 //Disable Pci Bridge ASPM
+		pcicfg_addrport = (pcipriv->pcibridge_busnum << 16) |
+						(pcipriv->pcibridge_devnum << 11) |
+						(pcipriv->pcibridge_funcnum << 8) | (1 << 31);
+		num4bytes = (pcipriv->pcibridge_pciehdr_offset + 0x10) / 4;
+
+		// set up address port at 0xCF8 offset field= 0 (dev|vend)
+		NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (num4bytes << 2));
+
+		// now grab data port with device|vendor 4 byte dword
+		NdisRawWritePortUchar(PCI_CONF_DATA, pcibridge_linkctrlreg);
+
+		DBG_871X("rtw_pci_disable_aspm():PciBridge busnumber[%x], DevNumbe[%x], funcnumber[%x], Write reg[%x] = %x\n",
+			pcipriv->pcibridge_busnum, pcipriv->pcibridge_devnum,
+			pcipriv->pcibridge_funcnum,
+			(pcipriv->pcibridge_pciehdr_offset+0x10), pcibridge_linkctrlreg);
+
+		rtw_udelay_os(50);
+	}
+}
+
+//[ASPM]
+//Description:
+//              Enable RTL8192SE ASPM & Enable Pci Bridge ASPM for power saving
+//              We should follow the sequence to enable RTL8192SE first then enable Pci Bridge ASPM
+//              or the system will show bluescreen.
+void rtw_pci_enable_aspm(_adapter *padapter)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct pwrctrl_priv	*pwrpriv = &padapter->pwrctrlpriv;
+	struct pci_priv	*pcipriv = &(pdvobjpriv->pcipriv);
+	u16	aspmlevel = 0;
+	u32	pcicfg_addrport = 0;
+	u8	num4bytes;
+	u8	u_pcibridge_aspmsetting = 0;
+	u8	u_device_aspmsetting = 0;
+
+	// When there exists anyone's busnum, devnum, and funcnum that are set to 0xff,
+	// we do not execute any action and return.
+	// if it is not intel bus then don't enable ASPM.
+
+	if ((pcipriv->busnumber == 0xff
+		&& pcipriv->devnumber == 0xff
+		&& pcipriv->funcnumber == 0xff)
+		|| (pcipriv->pcibridge_busnum == 0xff
+		&& pcipriv->pcibridge_devnum == 0xff
+		&& pcipriv->pcibridge_funcnum == 0xff))
+	{
+		DBG_871X("PlatformEnableASPM(): Fail to enable ASPM. Cannot find the Bus of PCI(Bridge).\n");
+		return;
+	}
+
+	//4 Enable Pci Bridge ASPM
+	pcicfg_addrport = (pcipriv->pcibridge_busnum << 16)
+					| (pcipriv->pcibridge_devnum << 11)
+					| (pcipriv->pcibridge_funcnum << 8) | (1 << 31);
+	num4bytes = (pcipriv->pcibridge_pciehdr_offset + 0x10) / 4;
+	// set up address port at 0xCF8 offset field= 0 (dev|vend)
+	NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (num4bytes << 2));
+	// now grab data port with device|vendor 4 byte dword
+
+	u_pcibridge_aspmsetting = pcipriv->pcibridge_linkctrlreg | pdvobjpriv->const_hostpci_aspm_setting;
+
+	if (pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_INTEL ||
+		pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_SIS)
+		u_pcibridge_aspmsetting &= ~BIT(0);
+
+	NdisRawWritePortUchar(PCI_CONF_DATA, u_pcibridge_aspmsetting);
+
+	DBG_871X("PlatformEnableASPM():PciBridge busnumber[%x], DevNumbe[%x], funcnumber[%x], Write reg[%x] = %x\n",
+		pcipriv->pcibridge_busnum,
+		pcipriv->pcibridge_devnum,
+		pcipriv->pcibridge_funcnum,
+		(pcipriv->pcibridge_pciehdr_offset+0x10),
+		u_pcibridge_aspmsetting);
+
+	rtw_udelay_os(50);
+
+	// Get ASPM level (with/without Clock Req)
+	aspmlevel |= pdvobjpriv->const_devicepci_aspm_setting;
+	u_device_aspmsetting = pcipriv->linkctrl_reg;
+	u_device_aspmsetting |= aspmlevel;
+
+	rtw_pci_platform_switch_device_pci_aspm(padapter, u_device_aspmsetting);	//(priv->linkctrl_reg | ASPMLevel));
+
+	if (pwrpriv->reg_rfps_level & RT_RF_OFF_LEVL_CLK_REQ) {
+		rtw_pci_switch_clk_req(padapter, (pwrpriv->reg_rfps_level & RT_RF_OFF_LEVL_CLK_REQ) ? 1 : 0);
+		RT_SET_PS_LEVEL(pwrpriv, RT_RF_OFF_LEVL_CLK_REQ);
+	}
+
+	rtw_udelay_os(50);
+}
+
+//
+//Description:
+//To get link control field by searching from PCIe capability lists.
+//
+static u8
+rtw_get_link_control_field(_adapter *padapter, u8 busnum, u8 devnum,
+				u8 funcnum)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct pci_priv	*pcipriv = &(pdvobjpriv->pcipriv);
+	struct rt_pci_capabilities_header capability_hdr;
+	u8	capability_offset, num4bytes;
+	u32	pcicfg_addrport = 0;
+	u8	linkctrl_reg;
+	u8	status = _FALSE;
+
+	//If busnum, devnum, funcnum are set to 0xff.
+	if (busnum == 0xff && devnum == 0xff && funcnum == 0xff) {
+		DBG_871X("GetLinkControlField(): Fail to find PCIe Capability\n");
+		return _FALSE;
+	}
+
+	pcicfg_addrport = (busnum << 16) | (devnum << 11) | (funcnum << 8) | (1 << 31);
+
+	//2PCIeCap
+
+	// The device supports capability lists. Find the capabilities.
+	num4bytes = 0x34 / 4;
+	//get capability_offset
+	// set up address port at 0xCF8 offset field= 0 (dev|vend)
+	NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (num4bytes << 2));
+	// now grab data port with device|vendor 4 byte dword
+	NdisRawReadPortUchar(PCI_CONF_DATA, &capability_offset);
+
+	// Loop through the capabilities in search of the power management capability.
+	// The list is NULL-terminated, so the last offset will always be zero.
+
+	while (capability_offset != 0) {
+		// First find the number of 4 Byte.
+		num4bytes = capability_offset / 4;
+
+		// Read the header of the capability at  this offset. If the retrieved capability is not
+		// the power management capability that we are looking for, follow the link to the
+		// next capability and continue looping.
+
+		//4 get capability_hdr
+		// set up address port at 0xCF8 offset field= 0 (dev|vend)
+		NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (num4bytes << 2));
+		// now grab data port with device|vendor 4 byte dword
+		NdisRawReadPortUshort(PCI_CONF_DATA, (u16 *) & capability_hdr);
+
+		// Found the PCI express capability
+		if (capability_hdr.capability_id == PCI_CAPABILITY_ID_PCI_EXPRESS)
+		{
+			break;
+		}
+		else
+		{
+			// This is some other capability. Keep looking for the PCI express capability.
+			capability_offset = capability_hdr.next;
+		}
+	}
+
+	if (capability_hdr.capability_id == PCI_CAPABILITY_ID_PCI_EXPRESS)	//
+	{
+		num4bytes = (capability_offset + 0x10) / 4;
+
+		//4 Read  Link Control Register
+		// set up address port at 0xCF8 offset field= 0 (dev|vend)
+		NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (num4bytes << 2));
+		// now grab data port with device|vendor 4 byte dword
+		NdisRawReadPortUchar(PCI_CONF_DATA, &linkctrl_reg);
+
+		pcipriv->pcibridge_pciehdr_offset = capability_offset;
+		pcipriv->pcibridge_linkctrlreg = linkctrl_reg;
+
+		status = _TRUE;
+	}
+	else
+	{
+		// We didn't find a PCIe capability.
+		DBG_871X("GetLinkControlField(): Cannot Find PCIe Capability\n");
+	}
+
+	return status;
+}
+
+//
+//Description:
+//To get PCI bus infomation and return busnum, devnum, and funcnum about
+//the bus(bridge) which the device binds.
+//
+static u8
+rtw_get_pci_bus_info(_adapter *padapter,
+			  u16 vendorid,
+			  u16 deviceid,
+			  u8 irql, u8 basecode, u8 subclass, u8 filed19val,
+			  u8 * busnum, u8 * devnum, u8 * funcnum)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct pci_dev	*pdev = pdvobjpriv->ppcidev;
+	u8	busnum_idx, devicenum_idx, functionnum_idx;
+	u32	pcicfg_addrport = 0;
+	u32	dev_venid = 0, classcode, field19, headertype;
+	u16	venId, devId;
+	u8	basec, subc, irqline;
+	u16	regoffset;
+	u8	b_singlefunc = _FALSE;
+	u8	b_bridgechk = _FALSE;
+
+	*busnum = 0xFF;
+	*devnum = 0xFF;
+	*funcnum = 0xFF;
+
+	//DBG_871X("==============>vendorid:%x,deviceid:%x,irql:%x\n", vendorid,deviceid,irql);
+	if ((basecode == PCI_CLASS_BRIDGE_DEV) &&
+		(subclass == PCI_SUBCLASS_BR_PCI_TO_PCI)
+		&& (filed19val == U1DONTCARE))
+		b_bridgechk = _TRUE;
+
+	// perform a complete pci bus scan operation
+	for (busnum_idx = 0; busnum_idx < PCI_MAX_BRIDGE_NUMBER; busnum_idx++)	//255
+	{
+		for (devicenum_idx = 0; devicenum_idx < PCI_MAX_DEVICES; devicenum_idx++)	//32
+		{
+			b_singlefunc = _FALSE;
+			for (functionnum_idx = 0; functionnum_idx < PCI_MAX_FUNCTION; functionnum_idx++)	//8
+			{
+				//
+				// <Roger_Notes> We have to skip redundant Bus scan to prevent unexpected system hang
+				// if single function is present in this device.
+				// 2009.02.26.
+				//
+				if (functionnum_idx == 0) {
+					//4 get header type (DWORD #3)
+					pcicfg_addrport = (busnum_idx << 16) | (devicenum_idx << 11) | (functionnum_idx << 8) | (1 << 31);
+					NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (3 << 2));
+					NdisRawReadPortUlong(PCI_CONF_DATA, &headertype);
+					headertype = ((headertype >> 16) & 0x0080) >> 7;	// address 0x0e[7].
+					if (headertype == 0)	//Single function
+						b_singlefunc = _TRUE;
+				}
+				else
+				{//By pass the following scan process.
+					if (b_singlefunc == _TRUE)
+						break;
+				}
+
+				// Set access enable control.
+				pcicfg_addrport = (busnum_idx << 16) | (devicenum_idx << 11) | (functionnum_idx << 8) | (1 << 31);
+
+				//4 // Get vendorid/ deviceid
+				// set up address port at 0xCF8 offset field= 0 (dev|vend)
+				NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport);
+				// now grab data port with device|vendor 4 byte dword
+				NdisRawReadPortUlong(PCI_CONF_DATA, &dev_venid);
+
+				// if data port is full of 1s, no device is present
+				// some broken boards return 0 if a slot is empty:
+				if (dev_venid == 0xFFFFFFFF || dev_venid == 0)
+					continue;	//PCI_INVALID_VENDORID
+
+				// 4 // Get irql
+				regoffset = 0x3C;
+				pcicfg_addrport = (busnum_idx << 16) | (devicenum_idx << 11) | (functionnum_idx << 8) | (1 << 31) | (regoffset & 0xFFFFFFFC);
+				NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport);
+				NdisRawReadPortUchar((PCI_CONF_DATA +(regoffset & 0x3)), &irqline);
+
+				venId = (u16) (dev_venid >> 0) & 0xFFFF;
+				devId = (u16) (dev_venid >> 16) & 0xFFFF;
+
+				// Check Vendor ID
+				if (!b_bridgechk && (venId != vendorid) && (vendorid != U2DONTCARE))
+					continue;
+
+				// Check Device ID
+				if (!b_bridgechk && (devId != deviceid) && (deviceid != U2DONTCARE))
+					continue;
+
+				// Check irql
+				if (!b_bridgechk && (irqline != irql) && (irql != U1DONTCARE))
+					continue;
+
+				//4 get Class Code
+				pcicfg_addrport = (busnum_idx << 16) | (devicenum_idx << 11) | (functionnum_idx << 8) | (1 << 31);
+				NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (2 << 2));
+				NdisRawReadPortUlong(PCI_CONF_DATA, &classcode);
+				classcode = classcode >> 8;
+
+				basec = (u8) (classcode >> 16) & 0xFF;
+				subc = (u8) (classcode >> 8) & 0xFF;
+				if (b_bridgechk && (venId != vendorid) && (basec == basecode) && (subc == subclass))
+					return _TRUE;
+
+				// Check Vendor ID
+				if (b_bridgechk && (venId != vendorid) && (vendorid != U2DONTCARE))
+					continue;
+
+				// Check Device ID
+				if (b_bridgechk && (devId != deviceid) && (deviceid != U2DONTCARE))
+					continue;
+
+				// Check irql
+				if (b_bridgechk && (irqline != irql) && (irql != U1DONTCARE))
+					continue;
+
+				//4 get field 0x19 value  (DWORD #6)
+				NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (6 << 2));
+				NdisRawReadPortUlong(PCI_CONF_DATA, &field19);
+				field19 = (field19 >> 8) & 0xFF;
+
+				//4 Matching Class Code and filed19.
+				if ((basec == basecode) && (subc == subclass) && ((field19 == filed19val) || (filed19val == U1DONTCARE))) {
+					*busnum = busnum_idx;
+					*devnum = devicenum_idx;
+					*funcnum = functionnum_idx;
+
+					DBG_871X("GetPciBusInfo(): Find Device(%X:%X)  bus=%d dev=%d, func=%d\n",
+						vendorid, deviceid, busnum_idx, devicenum_idx, functionnum_idx);
+					return _TRUE;
+				}
+			}
+		}
+	}
+
+	DBG_871X("GetPciBusInfo(): Cannot Find Device(%X:%X:%X)\n", vendorid, deviceid, dev_venid);
+
+	return _FALSE;
+}
+
+static u8
+rtw_get_pci_brideg_info(_adapter *padapter,
+			     u8 basecode,
+			     u8 subclass,
+			     u8 filed19val, u8 * busnum, u8 * devnum,
+			     u8 * funcnum, u16 * vendorid, u16 * deviceid)
+{
+	u8	busnum_idx, devicenum_idx, functionnum_idx;
+	u32	pcicfg_addrport = 0;
+	u32	dev_venid, classcode, field19, headertype;
+	u16	venId, devId;
+	u8	basec, subc, irqline;
+	u16	regoffset;
+	u8	b_singlefunc = _FALSE;
+
+	*busnum = 0xFF;
+	*devnum = 0xFF;
+	*funcnum = 0xFF;
+
+	// perform a complete pci bus scan operation
+	for (busnum_idx = 0; busnum_idx < PCI_MAX_BRIDGE_NUMBER; busnum_idx++)	//255
+	{
+		for (devicenum_idx = 0; devicenum_idx < PCI_MAX_DEVICES; devicenum_idx++)	//32
+		{
+			b_singlefunc = _FALSE;
+			for (functionnum_idx = 0; functionnum_idx < PCI_MAX_FUNCTION; functionnum_idx++)	//8
+			{
+				//
+				// <Roger_Notes> We have to skip redundant Bus scan to prevent unexpected system hang
+				// if single function is present in this device.
+				// 2009.02.26.
+				//
+				if (functionnum_idx == 0)
+				{
+					//4 get header type (DWORD #3)
+					pcicfg_addrport = (busnum_idx << 16) | (devicenum_idx << 11) | (functionnum_idx << 8) | (1 << 31);
+					//NdisRawWritePortUlong((ULONG_PTR)PCI_CONF_ADDRESS ,  pcicfg_addrport + (3 << 2));
+					//NdisRawReadPortUlong((ULONG_PTR)PCI_CONF_DATA, &headertype);
+					NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (3 << 2));
+					NdisRawReadPortUlong(PCI_CONF_DATA, &headertype);
+					headertype = ((headertype >> 16) & 0x0080) >> 7;	// address 0x0e[7].
+					if (headertype == 0)	//Single function
+						b_singlefunc = _TRUE;
+				}
+				else
+				{//By pass the following scan process.
+					if (b_singlefunc == _TRUE)
+						break;
+				}
+
+				pcicfg_addrport = (busnum_idx << 16) | (devicenum_idx << 11) | (functionnum_idx << 8) | (1 << 31);
+
+				//4 // Get vendorid/ deviceid
+				// set up address port at 0xCF8 offset field= 0 (dev|vend)
+				NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport);
+				// now grab data port with device|vendor 4 byte dword
+				NdisRawReadPortUlong(PCI_CONF_DATA, &dev_venid);
+
+				//4 Get irql
+				regoffset = 0x3C;
+				pcicfg_addrport = (busnum_idx << 16) | (devicenum_idx << 11) | (functionnum_idx << 8) | (1 << 31) | (regoffset & 0xFFFFFFFC);
+				NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport);
+				NdisRawReadPortUchar((PCI_CONF_DATA + (regoffset & 0x3)), &irqline);
+
+				venId = (u16) (dev_venid >> 0) & 0xFFFF;
+				devId = (u16) (dev_venid >> 16) & 0xFFFF;
+
+				//4 get Class Code
+				pcicfg_addrport = (busnum_idx << 16) | (devicenum_idx << 11) | (functionnum_idx << 8) | (1 << 31);
+				NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (2 << 2));
+				NdisRawReadPortUlong(PCI_CONF_DATA, &classcode);
+				classcode = classcode >> 8;
+
+				basec = (u8) (classcode >> 16) & 0xFF;
+				subc = (u8) (classcode >> 8) & 0xFF;
+
+				//4 get field 0x19 value  (DWORD #6)
+				NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (6 << 2));
+				NdisRawReadPortUlong(PCI_CONF_DATA, &field19);
+				field19 = (field19 >> 8) & 0xFF;
+
+				//4 Matching Class Code and filed19.
+				if ((basec == basecode) && (subc == subclass) && ((field19 == filed19val) || (filed19val == U1DONTCARE))) {
+					*busnum = busnum_idx;
+					*devnum = devicenum_idx;
+					*funcnum = functionnum_idx;
+					*vendorid = venId;
+					*deviceid = devId;
+
+					DBG_871X("GetPciBridegInfo : Find Device(%X:%X)  bus=%d dev=%d, func=%d\n",
+						venId, devId, busnum_idx, devicenum_idx, functionnum_idx);
+
+					return _TRUE;
+				}
+			}
+		}
+	}
+
+	DBG_871X("GetPciBridegInfo(): Cannot Find PciBridge for Device\n");
+
+	return _FALSE;
+}				// end of GetPciBridegInfo
+
+//
+//Description:
+//To find specific bridge information.
+//
+static void rtw_find_bridge_info(_adapter *padapter)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct pci_priv	*pcipriv = &(pdvobjpriv->pcipriv);
+	u8	pcibridge_busnum = 0xff;
+	u8	pcibridge_devnum = 0xff;
+	u8	pcibridge_funcnum = 0xff;
+	u16	pcibridge_vendorid = 0xff;
+	u16	pcibridge_deviceid = 0xff;
+	u8	tmp = 0;
+
+	rtw_get_pci_brideg_info(padapter,
+				     PCI_CLASS_BRIDGE_DEV,
+				     PCI_SUBCLASS_BR_PCI_TO_PCI,
+				     pcipriv->busnumber,
+				     &pcibridge_busnum,
+				     &pcibridge_devnum, &pcibridge_funcnum,
+				     &pcibridge_vendorid, &pcibridge_deviceid);
+
+	// match the array of vendor id and regonize which chipset is used.
+	pcipriv->pcibridge_vendor = PCI_BRIDGE_VENDOR_UNKNOWN;
+
+	for (tmp = 0; tmp < PCI_BRIDGE_VENDOR_MAX; tmp++) {
+		if (pcibridge_vendorid == pcibridge_vendors[tmp]) {
+			pcipriv->pcibridge_vendor = tmp;
+			DBG_871X("Pci Bridge Vendor is found index: %d\n", tmp);
+			break;
+		}
+	}
+	DBG_871X("Pci Bridge Vendor is %x\n", pcibridge_vendors[tmp]);
+
+	// Update corresponding PCI bus info.
+	pcipriv->pcibridge_busnum = pcibridge_busnum;
+	pcipriv->pcibridge_devnum = pcibridge_devnum;
+	pcipriv->pcibridge_funcnum = pcibridge_funcnum;
+	pcipriv->pcibridge_vendorid = pcibridge_vendorid;
+	pcipriv->pcibridge_deviceid = pcibridge_deviceid;
+
+}
+
+static u8
+rtw_get_amd_l1_patch(_adapter *padapter, u8 busnum, u8 devnum,
+			  u8 funcnum)
+{
+	u8	status = _FALSE;
+	u8	offset_e0;
+	unsigned	offset_e4;
+	u32	pcicfg_addrport = 0;
+
+	pcicfg_addrport = (busnum << 16) | (devnum << 11) | (funcnum << 8) | (1 << 31);
+
+	NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + 0xE0);
+	NdisRawWritePortUchar(PCI_CONF_DATA, 0xA0);
+
+	NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + 0xE0);
+	NdisRawReadPortUchar(PCI_CONF_DATA, &offset_e0);
+
+	if (offset_e0 == 0xA0)
+	{
+		NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + 0xE4);
+		NdisRawReadPortUlong(PCI_CONF_DATA, &offset_e4);
+		//DbgPrint("Offset E4 %x\n", offset_e4);
+		if (offset_e4 & BIT(23))
+			status = _TRUE;
+	}
+
+	return status;
+}
+#else
+/*Disable RTL8192SE ASPM & Disable Pci Bridge ASPM*/
+void rtw_pci_disable_aspm(_adapter *padapter)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct pwrctrl_priv	*pwrpriv = &padapter->pwrctrlpriv;
+	struct pci_dev	*pdev = pdvobjpriv->ppcidev;
+	struct pci_dev	*bridge_pdev = pdev->bus->self;
+	struct pci_priv	*pcipriv = &(pdvobjpriv->pcipriv);
+	u8	linkctrl_reg;
+	u16	pcibridge_linkctrlreg;
+	u16	aspmlevel = 0;
+
+	// We do not diable/enable ASPM by driver, in the future, the BIOS will enable host and NIC ASPM.
+	// Advertised by SD1 victorh. Added by tynli. 2009.11.23.
+	if(pdvobjpriv->const_pci_aspm == 0)
+		return;
+
+	if(!padapter->hw_init_completed)
+		return;
+
+	if (pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_UNKNOWN) {
+		RT_TRACE(_module_hci_intfs_c_, _drv_err_, ("%s(): PCI(Bridge) UNKNOWN.\n", __FUNCTION__));
+		return;
+	}
+
+	linkctrl_reg = pcipriv->linkctrl_reg;
+	pcibridge_linkctrlreg = pcipriv->pcibridge_linkctrlreg;
+
+	// Set corresponding value.
+	aspmlevel |= BIT(0) | BIT(1);
+	linkctrl_reg &=~aspmlevel;
+	pcibridge_linkctrlreg &=~aspmlevel;
+
+	if (pwrpriv->reg_rfps_level & RT_RF_OFF_LEVL_CLK_REQ) {
+		RT_CLEAR_PS_LEVEL(pwrpriv, RT_RF_OFF_LEVL_CLK_REQ);
+		rtw_pci_switch_clk_req(padapter, 0x0);
+	}
+
+	{
+		/*for promising device will in L0 state after an I/O.*/
+		u8 tmp_u1b;
+		pci_read_config_byte(pdev, 0x80, &tmp_u1b);
+	}
+
+	rtw_pci_platform_switch_device_pci_aspm(padapter, linkctrl_reg);
+	rtw_udelay_os(50);
+
+	//When there exists anyone's BusNum, DevNum, and FuncNum that are set to 0xff,
+	// we do not execute any action and return. Added by tynli.
+	if( (pcipriv->busnumber == 0xff && pcipriv->devnumber == 0xff && pcipriv->funcnumber == 0xff) ||
+		(pcipriv->pcibridge_busnum == 0xff && pcipriv->pcibridge_devnum == 0xff && pcipriv->pcibridge_funcnum == 0xff) )
+	{
+		// Do Nothing!!
+	}
+	else
+	{
+		/*Disable Pci Bridge ASPM*/
+		//NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + (num4bytes << 2));
+		//NdisRawWritePortUchar(PCI_CONF_DATA, pcibridge_linkctrlreg);
+		pci_write_config_byte(bridge_pdev, pcipriv->pcibridge_pciehdr_offset + 0x10, pcibridge_linkctrlreg);
+
+		DBG_871X("rtw_pci_disable_aspm():PciBridge busnumber[%x], DevNumbe[%x], funcnumber[%x], Write reg[%x] = %x\n",
+			pcipriv->pcibridge_busnum, pcipriv->pcibridge_devnum,
+			pcipriv->pcibridge_funcnum,
+			(pcipriv->pcibridge_pciehdr_offset+0x10), pcibridge_linkctrlreg);
+
+		rtw_udelay_os(50);
+	}
+
+}
+
+/*Enable RTL8192SE ASPM & Enable Pci Bridge ASPM for
+power saving We should follow the sequence to enable
+RTL8192SE first then enable Pci Bridge ASPM
+or the system will show bluescreen.*/
+void rtw_pci_enable_aspm(_adapter *padapter)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct pwrctrl_priv	*pwrpriv = &padapter->pwrctrlpriv;
+	struct pci_dev	*pdev = pdvobjpriv->ppcidev;
+	struct pci_dev	*bridge_pdev = pdev->bus->self;
+	struct pci_priv	*pcipriv = &(pdvobjpriv->pcipriv);
+	u16	aspmlevel = 0;
+	u8	u_pcibridge_aspmsetting = 0;
+	u8	u_device_aspmsetting = 0;
+	u32	u_device_aspmsupportsetting = 0;
+
+	// We do not diable/enable ASPM by driver, in the future, the BIOS will enable host and NIC ASPM.
+	// Advertised by SD1 victorh. Added by tynli. 2009.11.23.
+	if(pdvobjpriv->const_pci_aspm == 0)
+		return;
+
+	//When there exists anyone's BusNum, DevNum, and FuncNum that are set to 0xff,
+	// we do not execute any action and return. Added by tynli.
+	if( (pcipriv->busnumber == 0xff && pcipriv->devnumber == 0xff && pcipriv->funcnumber == 0xff) ||
+		(pcipriv->pcibridge_busnum == 0xff && pcipriv->pcibridge_devnum == 0xff && pcipriv->pcibridge_funcnum == 0xff) )
+	{
+		DBG_871X("rtw_pci_enable_aspm(): Fail to enable ASPM. Cannot find the Bus of PCI(Bridge).\n");
+		return;
+	}
+
+//Get Bridge ASPM Support
+//not to enable bridge aspm if bridge does not support
+//Added by sherry 20100803
+	if (IS_HARDWARE_TYPE_8192DE(padapter))
+	{
+		//PciCfgAddrPort = (pcipriv->pcibridge_busnum << 16)|(pcipriv->pcibridge_devnum<< 11)|(pcipriv->pcibridge_funcnum <<  8)|(1 << 31);
+		//Num4Bytes = (pcipriv->pcibridge_pciehdr_offset+0x0C)/4;
+		//NdisRawWritePortUlong((ULONG_PTR)PCI_CONF_ADDRESS , PciCfgAddrPort+(Num4Bytes << 2));
+		//NdisRawReadPortUlong((ULONG_PTR)PCI_CONF_DATA,&uDeviceASPMSupportSetting);
+		pci_read_config_dword(bridge_pdev, (pcipriv->pcibridge_pciehdr_offset+0x0C), &u_device_aspmsupportsetting);
+		DBG_871X("rtw_pci_enable_aspm(): Bridge ASPM support %x \n",u_device_aspmsupportsetting);
+		if(((u_device_aspmsupportsetting & BIT(11)) != BIT(11)) || ((u_device_aspmsupportsetting & BIT(10)) != BIT(10)))
+		{
+			if(pdvobjpriv->const_devicepci_aspm_setting == 3)
+			{
+				DBG_871X("rtw_pci_enable_aspm(): Bridge not support L0S or L1\n");
+				return;
+			}
+			else if(pdvobjpriv->const_devicepci_aspm_setting == 2)
+			{
+				if((u_device_aspmsupportsetting & BIT(11)) != BIT(11))
+				{
+					DBG_871X("rtw_pci_enable_aspm(): Bridge not support L1 \n");
+					return;
+				}
+			}
+			else if(pdvobjpriv->const_devicepci_aspm_setting == 1)
+			{
+				if((u_device_aspmsupportsetting & BIT(10)) != BIT(10))
+				{
+					DBG_871X("rtw_pci_enable_aspm(): Bridge not support L0s \n");
+					return;
+				}
+
+			}
+		}
+		else
+		{
+			DBG_871X("rtw_pci_enable_aspm(): Bridge support L0s and L1 \n");
+		}
+	}
+
+
+	/*Enable Pci Bridge ASPM*/
+	//PciCfgAddrPort = (pcipriv->pcibridge_busnum << 16)|(pcipriv->pcibridge_devnum<< 11) |(pcipriv->pcibridge_funcnum <<  8)|(1 << 31);
+	//Num4Bytes = (pcipriv->pcibridge_pciehdr_offset+0x10)/4;
+	// set up address port at 0xCF8 offset field= 0 (dev|vend)
+	//NdisRawWritePortUlong(PCI_CONF_ADDRESS, PciCfgAddrPort + (Num4Bytes << 2));
+	// now grab data port with device|vendor 4 byte dword
+
+	u_pcibridge_aspmsetting = pcipriv->pcibridge_linkctrlreg;
+	u_pcibridge_aspmsetting |= pdvobjpriv->const_hostpci_aspm_setting;
+
+	if (pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_INTEL ||
+		pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_SIS )
+		u_pcibridge_aspmsetting &= ~BIT(0); // for intel host 42 device 43
+
+	//NdisRawWritePortUchar(PCI_CONF_DATA, u_pcibridge_aspmsetting);
+	pci_write_config_byte(bridge_pdev, (pcipriv->pcibridge_pciehdr_offset+0x10), u_pcibridge_aspmsetting);
+
+	DBG_871X("PlatformEnableASPM():PciBridge busnumber[%x], DevNumbe[%x], funcnumber[%x], Write reg[%x] = %x\n",
+		pcipriv->pcibridge_busnum, pcipriv->pcibridge_devnum, pcipriv->pcibridge_funcnum,
+		(pcipriv->pcibridge_pciehdr_offset+0x10),
+		u_pcibridge_aspmsetting);
+
+	rtw_udelay_os(50);
+
+	/*Get ASPM level (with/without Clock Req)*/
+	aspmlevel |= pdvobjpriv->const_devicepci_aspm_setting;
+	u_device_aspmsetting = pcipriv->linkctrl_reg;
+	u_device_aspmsetting |= aspmlevel; // device 43
+
+	rtw_pci_platform_switch_device_pci_aspm(padapter, u_device_aspmsetting);
+
+	if (pwrpriv->reg_rfps_level & RT_RF_OFF_LEVL_CLK_REQ) {
+		rtw_pci_switch_clk_req(padapter, (pwrpriv->reg_rfps_level & RT_RF_OFF_LEVL_CLK_REQ) ? 1 : 0);
+		RT_SET_PS_LEVEL(pwrpriv, RT_RF_OFF_LEVL_CLK_REQ);
+	}
+
+	rtw_udelay_os(50);
+}
+
+static u8 rtw_pci_get_amd_l1_patch(struct dvobj_priv *dvobj)
+{
+	struct pci_dev	*pdev = dvobj->ppcidev;
+	struct pci_dev	*bridge_pdev = pdev->bus->self;
+	u8	status = _FALSE;
+	u8	offset_e0;
+	u32	offset_e4;
+
+	//NdisRawWritePortUlong(PCI_CONF_ADDRESS,pcicfg_addrport + 0xE0);
+	//NdisRawWritePortUchar(PCI_CONF_DATA, 0xA0);
+	pci_write_config_byte(bridge_pdev, 0xE0, 0xA0);
+
+	//NdisRawWritePortUlong(PCI_CONF_ADDRESS,pcicfg_addrport + 0xE0);
+	//NdisRawReadPortUchar(PCI_CONF_DATA, &offset_e0);
+	pci_read_config_byte(bridge_pdev, 0xE0, &offset_e0);
+
+	if (offset_e0 == 0xA0) {
+		//NdisRawWritePortUlong(PCI_CONF_ADDRESS, pcicfg_addrport + 0xE4);
+		//NdisRawReadPortUlong(PCI_CONF_DATA, &offset_e4);
+		pci_read_config_dword(bridge_pdev, 0xE4, &offset_e4);
+		if (offset_e4 & BIT(23))
+			status = _TRUE;
+	}
+
+	return status;
+}
+
+static void rtw_pci_get_linkcontrol_field(struct dvobj_priv *dvobj)
+{
+	struct pci_priv	*pcipriv = &(dvobj->pcipriv);
+	struct pci_dev	*pdev = dvobj->ppcidev;
+	struct pci_dev	*bridge_pdev = pdev->bus->self;
+	u8	capabilityoffset = pcipriv->pcibridge_pciehdr_offset;
+	u8	linkctrl_reg;
+
+	/*Read  Link Control Register*/
+	pci_read_config_byte(bridge_pdev, capabilityoffset + PCI_EXP_LNKCTL, &linkctrl_reg);
+
+	pcipriv->pcibridge_linkctrlreg = linkctrl_reg;
+}
+#endif
+
+static void rtw_pci_parse_configuration(struct dvobj_priv *dvobj)
+{
+	struct pci_dev	*pdev = dvobj->ppcidev;
+	struct pci_priv	*pcipriv = &(dvobj->pcipriv);
+	u8 tmp;
+	int pos;
+	u8 linkctrl_reg;
+
+	//Link Control Register
+	pos = pci_find_capability(pdev, PCI_CAP_ID_EXP);
+	pci_read_config_byte(pdev, pos + PCI_EXP_LNKCTL, &linkctrl_reg);
+	pcipriv->linkctrl_reg = linkctrl_reg;
+
+	//DBG_871X("Link Control Register = %x\n", pcipriv->linkctrl_reg);
+
+	pci_read_config_byte(pdev, 0x98, &tmp);
+	tmp |= BIT(4);
+	pci_write_config_byte(pdev, 0x98, tmp);
+
+	//tmp = 0x17;
+	//pci_write_config_byte(pdev, 0x70f, tmp);
+}
+
+//
+// Update PCI dependent default settings.
+//
+static void rtw_pci_update_default_setting(_adapter *padapter)
+{
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct pci_priv	*pcipriv = &(pdvobjpriv->pcipriv);
+	struct pwrctrl_priv	*pwrpriv = &padapter->pwrctrlpriv;
+
+	//reset pPSC->reg_rfps_level & priv->b_support_aspm
+	pwrpriv->reg_rfps_level = 0;
+	pwrpriv->b_support_aspm = 0;
+
+	// Dynamic Mechanism,
+	//rtw_hal_set_def_var(pAdapter, HAL_DEF_INIT_GAIN, &(pDevice->InitGainState));
+
+	// Update PCI ASPM setting
+	pwrpriv->const_amdpci_aspm = pdvobjpriv->const_amdpci_aspm;
+	switch (pdvobjpriv->const_pci_aspm) {
+		case 0:		// No ASPM
+			break;
+
+		case 1:		// ASPM dynamically enabled/disable.
+			pwrpriv->reg_rfps_level |= RT_RF_LPS_LEVEL_ASPM;
+			break;
+
+		case 2:		// ASPM with Clock Req dynamically enabled/disable.
+			pwrpriv->reg_rfps_level |= (RT_RF_LPS_LEVEL_ASPM | RT_RF_OFF_LEVL_CLK_REQ);
+			break;
+
+		case 3:		// Always enable ASPM and Clock Req from initialization to halt.
+			pwrpriv->reg_rfps_level &= ~(RT_RF_LPS_LEVEL_ASPM);
+			pwrpriv->reg_rfps_level |= (RT_RF_PS_LEVEL_ALWAYS_ASPM | RT_RF_OFF_LEVL_CLK_REQ);
+			break;
+
+		case 4:		// Always enable ASPM without Clock Req from initialization to halt.
+			pwrpriv->reg_rfps_level &= ~(RT_RF_LPS_LEVEL_ASPM | RT_RF_OFF_LEVL_CLK_REQ);
+			pwrpriv->reg_rfps_level |= RT_RF_PS_LEVEL_ALWAYS_ASPM;
+			break;
+	}
+
+	pwrpriv->reg_rfps_level |= RT_RF_OFF_LEVL_HALT_NIC;
+
+	// Update Radio OFF setting
+	switch (pdvobjpriv->const_hwsw_rfoff_d3) {
+		case 1:
+			if (pwrpriv->reg_rfps_level & RT_RF_LPS_LEVEL_ASPM)
+				pwrpriv->reg_rfps_level |= RT_RF_OFF_LEVL_ASPM;
+			break;
+
+		case 2:
+			if (pwrpriv->reg_rfps_level & RT_RF_LPS_LEVEL_ASPM)
+				pwrpriv->reg_rfps_level |= RT_RF_OFF_LEVL_ASPM;
+			pwrpriv->reg_rfps_level |= RT_RF_OFF_LEVL_HALT_NIC;
+			break;
+
+		case 3:
+			pwrpriv->reg_rfps_level |= RT_RF_OFF_LEVL_PCI_D3;
+			break;
+	}
+
+	// Update Rx 2R setting
+	//pPSC->reg_rfps_level |= ((pDevice->RegLPS2RDisable) ? RT_RF_LPS_DISALBE_2R : 0);
+
+	//
+	// Set HW definition to determine if it supports ASPM.
+	//
+	switch (pdvobjpriv->const_support_pciaspm) {
+		case 0:	// Not support ASPM.
+			{
+				u8	b_support_aspm = _FALSE;
+				pwrpriv->b_support_aspm = b_support_aspm;
+			}
+			break;
+
+		case 1:	// Support ASPM.
+			{
+				u8	b_support_aspm = _TRUE;
+				u8	b_support_backdoor = _TRUE;
+
+				pwrpriv->b_support_aspm = b_support_aspm;
+
+				/*if(pAdapter->MgntInfo.CustomerID == RT_CID_TOSHIBA &&
+					pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_AMD &&
+					!pcipriv->amd_l1_patch)
+					b_support_backdoor = _FALSE;*/
+
+				pwrpriv->b_support_backdoor = b_support_backdoor;
+			}
+			break;
+
+		case 2:	// Set by Chipset.
+			// ASPM value set by chipset.
+			if (pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_INTEL) {
+				u8	b_support_aspm = _TRUE;
+				pwrpriv->b_support_aspm = b_support_aspm;
+			}
+			break;
+
+		default:
+			// Do nothing. Set when finding the chipset.
+			break;
+	}
+}
+
+static void rtw_pci_initialize_adapter_common(_adapter *padapter)
+{
+	struct pwrctrl_priv	*pwrpriv = &padapter->pwrctrlpriv;
+
+	rtw_pci_update_default_setting(padapter);
+
+	if (pwrpriv->reg_rfps_level & RT_RF_PS_LEVEL_ALWAYS_ASPM) {
+		// Always enable ASPM & Clock Req.
+		rtw_pci_enable_aspm(padapter);
+		RT_SET_PS_LEVEL(pwrpriv, RT_RF_PS_LEVEL_ALWAYS_ASPM);
+	}
+
+}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)) || (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,18))
+#define rtw_pci_interrupt(x,y,z) rtw_pci_interrupt(x,y)
+#endif
+
+static irqreturn_t rtw_pci_interrupt(int irq, void *priv, struct pt_regs *regs)
+{
+	struct dvobj_priv *dvobj = (struct dvobj_priv *)priv;
+	_adapter *adapter = dvobj->if1;
+
+	if (dvobj->irq_enabled == 0) {
+		return IRQ_HANDLED;
+	}
+
+	if(rtw_hal_interrupt_handler(adapter) == _FAIL)
+		return IRQ_HANDLED;
+		//return IRQ_NONE;
+
+	return IRQ_HANDLED;
+}
+
+#ifdef RTK_DMP_PLATFORM
+#define pci_iounmap(x,y) iounmap(y)
+#endif
+
+int pci_alloc_irq(struct dvobj_priv *dvobj)
+{
+	int err;
+	struct pci_dev *pdev = dvobj->ppcidev;
+
+#if defined(IRQF_SHARED)
+	err = request_irq(pdev->irq, &rtw_pci_interrupt, IRQF_SHARED, DRV_NAME, dvobj);
+#else
+	err = request_irq(pdev->irq, &rtw_pci_interrupt, SA_SHIRQ, DRV_NAME, dvobj);
+#endif
+	if (err) {
+		DBG_871X("Error allocating IRQ %d",pdev->irq);
+	} else {
+		dvobj->irq_alloc = 1;
+		DBG_871X("Request_irq OK, IRQ %d\n",pdev->irq);
+	}
+
+	return err?_FAIL:_SUCCESS;
+}
+
+static struct dvobj_priv *pci_dvobj_init(struct pci_dev *pdev)
+{
+	int err;
+	u32	status = _FAIL;
+	struct dvobj_priv *dvobj = NULL;
+	struct pci_priv	*pcipriv = NULL;
+	struct pci_dev *bridge_pdev = pdev->bus->self;
+	unsigned long pmem_start, pmem_len, pmem_flags;
+	u8	tmp;
+
+_func_enter_;
+
+	if ((dvobj = devobj_init()) == NULL) {
+		goto exit;
+	}
+	dvobj->ppcidev = pdev;
+	pcipriv = &(dvobj->pcipriv);
+	pci_set_drvdata(pdev, dvobj);
+
+	if ( (err = pci_enable_device(pdev)) != 0) {
+		DBG_871X(KERN_ERR "%s : Cannot enable new PCI device\n", pci_name(pdev));
+		goto free_dvobj;
+	}
+
+#ifdef CONFIG_64BIT_DMA
+	if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
+		DBG_871X("RTL819xCE: Using 64bit DMA\n");
+		if ((err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) != 0) {
+			DBG_871X(KERN_ERR "Unable to obtain 64bit DMA for consistent allocations\n");
+			goto disable_picdev;
+		}
+		dvobj->bdma64 = _TRUE;
+	} else
+#endif
+	{
+		if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(32))) {
+			if ((err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32))) != 0) {
+				DBG_871X(KERN_ERR "Unable to obtain 32bit DMA for consistent allocations\n");
+				goto disable_picdev;
+			}
+		}
+	}
+
+	pci_set_master(pdev);
+
+	if ((err = pci_request_regions(pdev, DRV_NAME)) != 0) {
+		DBG_871X(KERN_ERR "Can't obtain PCI resources\n");
+		goto disable_picdev;
+	}
+	//MEM map
+	pmem_start = pci_resource_start(pdev, 2);
+	pmem_len = pci_resource_len(pdev, 2);
+	pmem_flags = pci_resource_flags(pdev, 2);
+
+#ifdef RTK_DMP_PLATFORM
+	dvobj->pci_mem_start = (unsigned long)ioremap_nocache(pmem_start, pmem_len);
+#else
+	dvobj->pci_mem_start = (unsigned long)pci_iomap(pdev, 2, pmem_len); /* shared mem start */
+#endif
+	if (dvobj->pci_mem_start == 0) {
+		DBG_871X(KERN_ERR "Can't map PCI mem\n");
+		goto release_regions;
+	}
+
+	DBG_871X("Memory mapped space start: 0x%08lx len:%08lx flags:%08lx, after map:0x%08lx\n",
+		pmem_start, pmem_len, pmem_flags, dvobj->pci_mem_start);
+
+	// Disable Clk Request */
+	pci_write_config_byte(pdev, 0x81, 0);
+	// leave D3 mode */
+	pci_write_config_byte(pdev, 0x44, 0);
+	pci_write_config_byte(pdev, 0x04, 0x06);
+	pci_write_config_byte(pdev, 0x04, 0x07);
+
+
+#if 1
+	/*find bus info*/
+	pcipriv->busnumber = pdev->bus->number;
+	pcipriv->devnumber = PCI_SLOT(pdev->devfn);
+	pcipriv->funcnumber = PCI_FUNC(pdev->devfn);
+
+	/*find bridge info*/
+	pcipriv->pcibridge_vendor = PCI_BRIDGE_VENDOR_UNKNOWN;
+	if(bridge_pdev){
+		pcipriv->pcibridge_vendorid = bridge_pdev->vendor;
+		for (tmp = 0; tmp < PCI_BRIDGE_VENDOR_MAX; tmp++) {
+			if (bridge_pdev->vendor == pcibridge_vendors[tmp]) {
+				pcipriv->pcibridge_vendor = tmp;
+				DBG_871X("Pci Bridge Vendor is found index: %d, %x\n", tmp, pcibridge_vendors[tmp]);
+				break;
+			}
+		}
+	}
+
+	//if (pcipriv->pcibridge_vendor != PCI_BRIDGE_VENDOR_UNKNOWN) {
+	if(bridge_pdev){
+		pcipriv->pcibridge_busnum = bridge_pdev->bus->number;
+		pcipriv->pcibridge_devnum = PCI_SLOT(bridge_pdev->devfn);
+		pcipriv->pcibridge_funcnum = PCI_FUNC(bridge_pdev->devfn);
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,34))
+		pcipriv->pcibridge_pciehdr_offset = pci_find_capability(bridge_pdev, PCI_CAP_ID_EXP);
+#else
+		pcipriv->pcibridge_pciehdr_offset = bridge_pdev->pcie_cap;
+#endif
+
+		rtw_pci_get_linkcontrol_field(dvobj);
+
+		if (pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_AMD) {
+			pcipriv->amd_l1_patch = rtw_pci_get_amd_l1_patch(dvobj);
+		}
+	}
+#else
+	//
+	// Find bridge related info.
+	//
+	rtw_get_pci_bus_info(padapter,
+				  pdev->vendor,
+				  pdev->device,
+				  (u8) pdvobjpriv->irqline,
+				  0x02, 0x80, U1DONTCARE,
+				  &pcipriv->busnumber,
+				  &pcipriv->devnumber,
+				  &pcipriv->funcnumber);
+
+	rtw_find_bridge_info(padapter);
+
+	if (pcipriv->pcibridge_vendor != PCI_BRIDGE_VENDOR_UNKNOWN) {
+		rtw_get_link_control_field(padapter,
+						pcipriv->pcibridge_busnum,
+						pcipriv->pcibridge_devnum,
+						pcipriv->pcibridge_funcnum);
+
+		if (pcipriv->pcibridge_vendor == PCI_BRIDGE_VENDOR_AMD) {
+			pcipriv->amd_l1_patch =
+				rtw_get_amd_l1_patch(padapter,
+							pcipriv->pcibridge_busnum,
+							pcipriv->pcibridge_devnum,
+							pcipriv->pcibridge_funcnum);
+		}
+	}
+#endif
+
+	//
+	// Allow the hardware to look at PCI config information.
+	//
+	rtw_pci_parse_configuration(dvobj);
+
+	DBG_871X("pcidev busnumber:devnumber:funcnumber:"
+		"vendor:link_ctl %d:%d:%d:%x:%x\n",
+		pcipriv->busnumber,
+		pcipriv->devnumber,
+		pcipriv->funcnumber,
+		pdev->vendor,
+		pcipriv->linkctrl_reg);
+
+	DBG_871X("pci_bridge busnumber:devnumber:funcnumber:vendor:"
+		"pcie_cap:link_ctl_reg: %d:%d:%d:%x:%x:%x:%x\n",
+		pcipriv->pcibridge_busnum,
+		pcipriv->pcibridge_devnum,
+		pcipriv->pcibridge_funcnum,
+		pcibridge_vendors[pcipriv->pcibridge_vendor],
+		pcipriv->pcibridge_pciehdr_offset,
+		pcipriv->pcibridge_linkctrlreg,
+		pcipriv->amd_l1_patch);
+
+	status = _SUCCESS;
+
+iounmap:
+	if (status != _SUCCESS && dvobj->pci_mem_start != 0) {
+		pci_iounmap(pdev, (void *)dvobj->pci_mem_start);
+		dvobj->pci_mem_start = 0;
+	}
+release_regions:
+	if (status != _SUCCESS)
+		pci_release_regions(pdev);
+disable_picdev:
+	if (status != _SUCCESS)
+		pci_disable_device(pdev);
+free_dvobj:
+	if (status != _SUCCESS && dvobj) {
+		pci_set_drvdata(pdev, NULL);
+		devobj_deinit(dvobj);
+		dvobj = NULL;
+	}
+exit:
+_func_exit_;
+	return dvobj;
+}
+
+static void pci_dvobj_deinit(struct pci_dev *pdev)
+{
+	struct dvobj_priv *dvobj = pci_get_drvdata(pdev);
+_func_enter_;
+
+	pci_set_drvdata(pdev, NULL);
+	if (dvobj) {
+		if (dvobj->irq_alloc) {
+			free_irq(pdev->irq, dvobj);
+			dvobj->irq_alloc = 0;
+		}
+
+		if (dvobj->pci_mem_start != 0) {
+			pci_iounmap(pdev, (void *)dvobj->pci_mem_start);
+			dvobj->pci_mem_start = 0;
+		}
+
+		devobj_deinit(dvobj);
+	}
+
+	pci_release_regions(pdev);
+	pci_disable_device(pdev);
+
+_func_exit_;
+}
+
+static void decide_chip_type_by_pci_device_id(_adapter *padapter, struct pci_dev *pdev)
+{
+	u16	venderid, deviceid, irqline;
+	u8	revisionid;
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+
+
+	venderid = pdev->vendor;
+	deviceid = pdev->device;
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,23))
+	pci_read_config_byte(pdev, PCI_REVISION_ID, &revisionid); // PCI_REVISION_ID 0x08
+#else
+	revisionid = pdev->revision;
+#endif
+	pci_read_config_word(pdev, PCI_INTERRUPT_LINE, &irqline); // PCI_INTERRUPT_LINE 0x3c
+	pdvobjpriv->irqline = irqline;
+
+
+	//
+	// Decide hardware type here.
+	//
+	if( deviceid == HAL_HW_PCI_8185_DEVICE_ID ||
+	    deviceid == HAL_HW_PCI_8188_DEVICE_ID ||
+	    deviceid == HAL_HW_PCI_8198_DEVICE_ID)
+	{
+		DBG_871X("Adapter (8185/8185B) is found- VendorID/DeviceID=%x/%x\n", venderid, deviceid);
+		padapter->HardwareType=HARDWARE_TYPE_RTL8185;
+	}
+	else if (deviceid == HAL_HW_PCI_8190_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_0045_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_0046_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_DLINK_DEVICE_ID)
+	{
+		DBG_871X("Adapter(8190 PCI) is found - vendorid/deviceid=%x/%x\n", venderid, deviceid);
+		padapter->HardwareType = HARDWARE_TYPE_RTL8190P;
+	}
+	else if (deviceid == HAL_HW_PCI_8192_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_0044_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_0047_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_8192SE_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_8174_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_8173_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_8172_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_8171_DEVICE_ID)
+	{
+		// 8192e and and 8192se may have the same device ID 8192. However, their Revision
+		// ID is different
+		// Added for 92DE. We deferentiate it from SVID,SDID.
+		if( pdev->subsystem_vendor == 0x10EC && pdev->subsystem_device == 0xE020){
+			padapter->HardwareType = HARDWARE_TYPE_RTL8192DE;
+			DBG_871X("Adapter(8192DE) is found - VendorID/DeviceID/RID=%X/%X/%X\n", venderid, deviceid, revisionid);
+		}else{
+			switch (revisionid) {
+				case HAL_HW_PCI_REVISION_ID_8192PCIE:
+					DBG_871X("Adapter(8192 PCI-E) is found - vendorid/deviceid=%x/%x\n", venderid, deviceid);
+					padapter->HardwareType = HARDWARE_TYPE_RTL8192E;
+					break;
+				case HAL_HW_PCI_REVISION_ID_8192SE:
+					DBG_871X("Adapter(8192SE) is found - vendorid/deviceid=%x/%x\n", venderid, deviceid);
+					padapter->HardwareType = HARDWARE_TYPE_RTL8192SE;
+					break;
+				default:
+					DBG_871X("Err: Unknown device - vendorid/deviceid=%x/%x\n", venderid, deviceid);
+					padapter->HardwareType = HARDWARE_TYPE_RTL8192SE;
+					break;
+			}
+		}
+	}
+	else if(deviceid==HAL_HW_PCI_8723E_DEVICE_ID )
+	{//RTL8723E may have the same device ID with RTL8192CET
+		padapter->HardwareType = HARDWARE_TYPE_RTL8723AE;
+		DBG_871X("Adapter(8723 PCI-E) is found - VendorID/DeviceID=%x/%x\n", venderid, deviceid);
+	}
+	else if (deviceid == HAL_HW_PCI_8192CET_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_8192CE_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_8191CE_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_8188CE_DEVICE_ID)
+	{
+		DBG_871X("Adapter(8192C PCI-E) is found - vendorid/deviceid=%x/%x\n", venderid, deviceid);
+		padapter->HardwareType = HARDWARE_TYPE_RTL8192CE;
+	}
+	else if (deviceid == HAL_HW_PCI_8192DE_DEVICE_ID ||
+		deviceid == HAL_HW_PCI_002B_DEVICE_ID ){
+		padapter->HardwareType = HARDWARE_TYPE_RTL8192DE;
+		DBG_871X("Adapter(8192DE) is found - VendorID/DeviceID/RID=%X/%X/%X\n", venderid, deviceid, revisionid);
+	}
+	else
+	{
+		DBG_871X("Err: Unknown device - vendorid/deviceid=%x/%x\n", venderid, deviceid);
+		//padapter->HardwareType = HAL_DEFAULT_HARDWARE_TYPE;
+	}
+
+
+	padapter->chip_type = NULL_CHIP_TYPE;
+
+	//TODO:
+#ifdef CONFIG_RTL8192C
+	padapter->chip_type = RTL8188C_8192C;
+	padapter->HardwareType = HARDWARE_TYPE_RTL8192CE;
+#endif
+#ifdef CONFIG_RTL8192D
+	pdvobjpriv->InterfaceNumber = revisionid;
+
+	padapter->chip_type = RTL8192D;
+	padapter->HardwareType = HARDWARE_TYPE_RTL8192DE;
+#endif
+
+}
+
+static void pci_intf_start(_adapter *padapter)
+{
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+pci_intf_start\n"));
+	DBG_871X("+pci_intf_start\n");
+
+#ifdef CONFIG_PCILED_BLINK
+	rtw_led_control(padapter, LED_CTL_NO_LINK);
+#endif
+	//Enable hw interrupt
+	rtw_hal_enable_interrupt(padapter);
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("-pci_intf_start\n"));
+	DBG_871X("-pci_intf_start\n");
+}
+
+static void pci_intf_stop(_adapter *padapter)
+{
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+pci_intf_stop\n"));
+
+	//Disable hw interrupt
+	if(padapter->bSurpriseRemoved == _FALSE)
+	{
+		//device still exists, so driver can do i/o operation
+		rtw_hal_disable_interrupt(padapter);
+		tasklet_disable(&(padapter->recvpriv.recv_tasklet));
+		tasklet_disable(&(padapter->recvpriv.irq_prepare_beacon_tasklet));
+		tasklet_disable(&(padapter->xmitpriv.xmit_tasklet));
+
+#ifdef CONFIG_CONCURRENT_MODE
+		/*	This function only be called at driver removing. disable buddy_adapter too
+			don't disable interrupt of buddy_adapter because it is same as primary.
+		*/
+		if (padapter->pbuddy_adapter){
+			tasklet_disable(&(padapter->pbuddy_adapter->recvpriv.recv_tasklet));
+			tasklet_disable(&(padapter->pbuddy_adapter->recvpriv.irq_prepare_beacon_tasklet));
+			tasklet_disable(&(padapter->pbuddy_adapter->xmitpriv.xmit_tasklet));
+		}
+#endif
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,("pci_intf_stop: SurpriseRemoved==_FALSE\n"));
+	}
+	else
+	{
+		// Clear irq_enabled to prevent handle interrupt function.
+		adapter_to_dvobj(padapter)->irq_enabled = 0;
+	}
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("-pci_intf_stop\n"));
+
+}
+
+
+static void rtw_dev_unload(_adapter *padapter)
+{
+	struct net_device *pnetdev= (struct net_device*)padapter->pnetdev;
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+rtw_dev_unload\n"));
+
+	if(padapter->bup == _TRUE)
+	{
+		DBG_871X("+rtw_dev_unload\n");
+
+		padapter->bDriverStopped = _TRUE;
+		#ifdef CONFIG_XMIT_ACK
+		if (padapter->xmitpriv.ack_tx)
+			rtw_ack_tx_done(&padapter->xmitpriv, RTW_SCTX_DONE_DRV_STOP);
+		#endif
+
+		//s3.
+		if(padapter->intf_stop)
+		{
+			padapter->intf_stop(padapter);
+		}
+
+		//s4.
+		rtw_stop_drv_threads(padapter);
+
+
+		//s5.
+		if(padapter->bSurpriseRemoved == _FALSE)
+		{
+			DBG_871X("r871x_dev_unload()->rtl871x_hal_deinit()\n");
+			rtw_hal_deinit(padapter);
+
+			padapter->bSurpriseRemoved = _TRUE;
+		}
+
+		padapter->bup = _FALSE;
+
+	}
+	else
+	{
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,("r871x_dev_unload():padapter->bup == _FALSE\n" ));
+	}
+
+	DBG_871X("-rtw_dev_unload\n");
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("-rtw_dev_unload\n"));
+
+}
+
+static void disable_ht_for_spec_devid(const struct pci_device_id *pdid)
+{
+#ifdef CONFIG_80211N_HT
+	u16 vid, pid;
+	u32 flags;
+	int i;
+	int num = sizeof(specific_device_id_tbl)/sizeof(struct specific_device_id);
+
+	for(i=0; i<num; i++)
+	{
+		vid = specific_device_id_tbl[i].idVendor;
+		pid = specific_device_id_tbl[i].idProduct;
+		flags = specific_device_id_tbl[i].flags;
+
+		if((pdid->vendor==vid) && (pdid->device==pid) && (flags&SPEC_DEV_ID_DISABLE_HT))
+		{
+			 rtw_ht_enable = 0;
+			 rtw_cbw40_enable = 0;
+			 rtw_ampdu_enable = 0;
+		}
+
+	}
+#endif
+}
+
+#ifdef CONFIG_PM
+static int rtw_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+	_func_enter_;
+
+
+	_func_exit_;
+	return 0;
+}
+
+static int rtw_resume(struct pci_dev *pdev)
+{
+	_func_enter_;
+
+
+	_func_exit_;
+
+	return 0;
+}
+#endif
+
+_adapter *rtw_pci_if1_init(struct dvobj_priv * dvobj, struct pci_dev *pdev,
+	const struct pci_device_id *pdid)
+{
+	_adapter *padapter = NULL;
+	struct net_device *pnetdev = NULL;
+	int status = _FAIL;
+
+	if ((padapter = (_adapter *)rtw_zvmalloc(sizeof(*padapter))) == NULL) {
+		goto exit;
+	}
+	padapter->dvobj = dvobj;
+	dvobj->if1 = padapter;
+
+	padapter->bDriverStopped=_TRUE;
+
+	dvobj->padapters[dvobj->iface_nums++] = padapter;
+	padapter->iface_id = IFACE_ID0;
+
+#if defined(CONFIG_CONCURRENT_MODE) || defined(CONFIG_DUALMAC_CONCURRENT)
+	//set adapter_type/iface type for primary padapter
+	padapter->isprimary = _TRUE;
+	padapter->adapter_type = PRIMARY_ADAPTER;
+	#ifndef CONFIG_HWPORT_SWAP
+	padapter->iface_type = IFACE_PORT0;
+	#else
+	padapter->iface_type = IFACE_PORT1;
+	#endif
+#endif
+
+	//step 1-1., decide the chip_type via vid/pid
+	padapter->interface_type = RTW_PCIE;
+	decide_chip_type_by_pci_device_id(padapter, pdev);
+
+	if((pnetdev = rtw_init_netdev(padapter)) == NULL) {
+		goto free_adapter;
+	}
+	if (dvobj->bdma64)
+		pnetdev->features |= NETIF_F_HIGHDMA;
+	pnetdev->irq = pdev->irq;
+	SET_NETDEV_DEV(pnetdev, dvobj_to_dev(dvobj));
+	padapter = rtw_netdev_priv(pnetdev);
+
+	//step 2. hook HalFunc, allocate HalData
+	if (padapter->chip_type == RTL8188C_8192C) {
+		#ifdef CONFIG_RTL8192C
+		rtl8192ce_set_hal_ops(padapter);
+		#endif
+	} else if (padapter->chip_type == RTL8192D) {
+		#ifdef CONFIG_RTL8192D
+		rtl8192de_set_hal_ops(padapter);
+		#endif
+	} else {
+		DBG_871X("Detect NULL_CHIP_TYPE\n");
+		goto free_hal_data;
+	}
+
+	//step 3.	initialize the dvobj_priv
+	padapter->intf_start=&pci_intf_start;
+	padapter->intf_stop=&pci_intf_stop;
+
+
+	//.2
+	if ((rtw_init_io_priv(padapter, pci_set_intf_ops)) == _FAIL) {
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,(" \n Can't init io_reqs\n"));
+		goto free_hal_data;
+	}
+
+	//.3
+	rtw_hal_read_chip_version(padapter);
+
+	//.4
+	rtw_hal_chip_configure(padapter);
+
+	//step 4. read efuse/eeprom data and get mac_addr
+	rtw_hal_read_chip_info(padapter);
+
+	if (rtw_handle_dualmac(padapter, 1) != _SUCCESS)
+		goto free_hal_data;
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if(rtw_wdev_alloc(padapter, dvobj_to_dev(dvobj)) != 0) {
+		goto handle_dualmac;
+	}
+#endif
+
+	//step 5.
+	if (rtw_init_drv_sw(padapter) == _FAIL) {
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,("Initialize driver software resource Failed!\n"));
+		goto free_wdev;
+	}
+
+	status = rtw_hal_inirp_init(padapter);
+	if(status ==_FAIL){
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,("Initialize PCI desc ring Failed!\n"));
+		goto free_drv_sw;
+	}
+
+	rtw_macaddr_cfg(padapter->eeprompriv.mac_addr);
+	rtw_init_wifidirect_addrs(padapter, padapter->eeprompriv.mac_addr, padapter->eeprompriv.mac_addr);
+
+
+	rtw_hal_disable_interrupt(padapter);
+
+	//step 6. Init pci related configuration
+	rtw_pci_initialize_adapter_common(padapter);
+
+	DBG_871X("bDriverStopped:%d, bSurpriseRemoved:%d, bup:%d, hw_init_completed:%d\n"
+		,padapter->bDriverStopped
+		,padapter->bSurpriseRemoved
+		,padapter->bup
+		,padapter->hw_init_completed
+	);
+
+	status = _SUCCESS;
+
+inirp_deinit:
+	if (status != _SUCCESS)
+		rtw_hal_inirp_deinit(padapter);
+free_drv_sw:
+	if (status != _SUCCESS)
+		rtw_free_drv_sw(padapter);
+free_wdev:
+	if (status != _SUCCESS) {
+		#ifdef CONFIG_IOCTL_CFG80211
+		rtw_wdev_unregister(padapter->rtw_wdev);
+		rtw_wdev_free(padapter->rtw_wdev);
+		#endif
+	}
+handle_dualmac:
+	if (status != _SUCCESS)
+		rtw_handle_dualmac(padapter, 0);
+free_hal_data:
+	if (status != _SUCCESS && padapter->HalData)
+		rtw_mfree(padapter->HalData, sizeof(*(padapter->HalData)));
+free_adapter:
+	if (status != _SUCCESS) {
+		if (pnetdev)
+			rtw_free_netdev(pnetdev);
+		else if (padapter)
+			rtw_vmfree((u8*)padapter, sizeof(*padapter));
+		padapter = NULL;
+	}
+exit:
+	return padapter;
+}
+
+static void rtw_pci_if1_deinit(_adapter *if1)
+{
+	struct net_device *pnetdev = if1->pnetdev;
+	struct mlme_priv *pmlmepriv= &if1->mlmepriv;
+
+	//	padapter->intf_stop(padapter);
+
+	if(check_fwstate(pmlmepriv, _FW_LINKED))
+		rtw_disassoc_cmd(if1, 0, _FALSE);
+
+#ifdef CONFIG_AP_MODE
+	free_mlme_ap_info(if1);
+	#ifdef CONFIG_HOSTAPD_MLME
+	hostapd_mode_unload(if1);
+	#endif
+#endif
+
+	rtw_cancel_all_timer(if1);
+#ifdef CONFIG_WOWLAN
+	if1->pwrctrlpriv.wowlan_mode=_FALSE;
+#endif //CONFIG_WOWLAN
+	rtw_dev_unload(if1);
+
+	DBG_871X("%s, hw_init_completed=%d\n", __func__, if1->hw_init_completed);
+
+	//s6.
+	rtw_handle_dualmac(if1, 0);
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if (if1->rtw_wdev)
+		rtw_wdev_free(if1->rtw_wdev);
+#endif //CONFIG_IOCTL_CFG80211
+
+	rtw_hal_inirp_deinit(if1);
+	rtw_free_drv_sw(if1);
+
+	if(pnetdev)
+		rtw_free_netdev(pnetdev);
+
+#ifdef CONFIG_PLATFORM_RTD2880B
+	DBG_871X("wlan link down\n");
+	rtd2885_wlan_netlink_sendMsg("linkdown", "8712");
+#endif
+}
+
+/*
+ * drv_init() - a device potentially for us
+ *
+ * notes: drv_init() is called when the bus driver has located a card for us to support.
+ *        We accept the new device by returning 0.
+*/
+static int rtw_drv_init(struct pci_dev *pdev, const struct pci_device_id *did)
+{
+	int i, err = -ENODEV;
+
+	int status;
+	_adapter *if1 = NULL, *if2 = NULL;
+	struct dvobj_priv *dvobj;
+
+	RT_TRACE(_module_hci_intfs_c_, _drv_err_, ("+rtw_drv_init\n"));
+
+	//step 0.
+	disable_ht_for_spec_devid(did);
+
+	/* Initialize dvobj_priv */
+	if ((dvobj = pci_dvobj_init(pdev)) == NULL) {
+		RT_TRACE(_module_hci_intfs_c_, _drv_err_, ("initialize device object priv Failed!\n"));
+		goto exit;
+	}
+
+	/* Initialize if1 */
+	if ((if1 = rtw_pci_if1_init(dvobj, pdev, did)) == NULL) {
+		DBG_871X("rtw_pci_if1_init Failed!\n");
+		goto free_dvobj;
+	}
+
+	/* Initialize if2 */
+#ifdef CONFIG_CONCURRENT_MODE
+	if((if2 = rtw_drv_if2_init(if1, pci_set_intf_ops)) == NULL) {
+		goto free_if1;
+	}
+#endif
+
+#ifdef CONFIG_GLOBAL_UI_PID
+	if (ui_pid[1]!=0) {
+		DBG_871X("ui_pid[1]:%d\n",ui_pid[1]);
+		rtw_signal_process(ui_pid[1], SIGUSR2);
+	}
+#endif
+
+	//dev_alloc_name && register_netdev
+	if((status = rtw_drv_register_netdev(if1)) != _SUCCESS) {
+		goto free_if1;
+	}
+
+#ifdef CONFIG_HOSTAPD_MLME
+	hostapd_mode_init(if1);
+#endif
+
+#ifdef CONFIG_PLATFORM_RTD2880B
+	DBG_871X("wlan link up\n");
+	rtd2885_wlan_netlink_sendMsg("linkup", "8712");
+#endif
+
+#ifdef RTK_DMP_PLATFORM
+	rtw_proc_init_one(if1->pnetdev);
+#endif
+
+
+	/* alloc irq */
+	if (pci_alloc_irq(dvobj) != _SUCCESS)
+		goto free_if2;
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("-871x_drv - drv_init, success!\n"));
+	//DBG_871X("-871x_drv - drv_init, success!\n");
+
+	status = _SUCCESS;
+
+free_if2:
+	if(status != _SUCCESS && if2) {
+		#ifdef CONFIG_CONCURRENT_MODE
+		rtw_drv_if2_stop(if2);
+		rtw_drv_if2_free(if2);
+		#endif
+	}
+free_if1:
+	if (status != _SUCCESS && if1) {
+		rtw_pci_if1_deinit(if1);
+	}
+free_dvobj:
+	if (status != _SUCCESS)
+		pci_dvobj_deinit(pdev);
+exit:
+	return status == _SUCCESS?0:-ENODEV;
+}
+
+/*
+ * dev_remove() - our device is being removed
+*/
+//rmmod module & unplug(SurpriseRemoved) will call r871xu_dev_remove() => how to recognize both
+static void rtw_dev_remove(struct pci_dev *pdev)
+{
+	struct dvobj_priv *pdvobjpriv = pci_get_drvdata(pdev);
+	_adapter *padapter = pdvobjpriv->if1;
+	struct net_device *pnetdev = padapter->pnetdev;
+
+_func_exit_;
+
+	DBG_871X("+rtw_dev_remove\n");
+
+	pdvobjpriv->processing_dev_remove = _TRUE;
+
+	if (unlikely(!padapter)) {
+		return;
+	}
+
+	rtw_unregister_netdevs(pdvobjpriv);
+
+	#if 0
+#ifdef RTK_DMP_PLATFORM
+	padapter->bSurpriseRemoved = _FALSE;	// always trate as device exists
+											// this will let the driver to disable it's interrupt
+#else
+	if(pci_drvpriv.drv_registered == _TRUE)
+	{
+		//DBG_871X("r871xu_dev_remove():padapter->bSurpriseRemoved == _TRUE\n");
+		padapter->bSurpriseRemoved = _TRUE;
+	}
+	/*else
+	{
+		//DBG_871X("r871xu_dev_remove():module removed\n");
+		padapter->hw_init_completed = _FALSE;
+	}*/
+#endif
+	#endif
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) || defined(CONFIG_ANDROID_POWER)
+	rtw_unregister_early_suspend(&padapter->pwrctrlpriv);
+#endif
+
+	rtw_pm_set_ips(padapter, IPS_NONE);
+	rtw_pm_set_lps(padapter, PS_MODE_ACTIVE);
+
+	LeaveAllPowerSaveMode(padapter);
+
+	rtw_hal_disable_interrupt(padapter);
+
+#ifdef CONFIG_CONCURRENT_MODE
+	rtw_drv_if2_stop(pdvobjpriv->if2);
+#endif //CONFIG_CONCURRENT_MODE
+
+	rtw_pci_if1_deinit(padapter);
+
+#ifdef CONFIG_CONCURRENT_MODE
+	rtw_drv_if2_free(pdvobjpriv->if2);
+#endif
+
+	pci_dvobj_deinit(pdev);
+
+	DBG_871X("-r871xu_dev_remove, done\n");
+
+_func_exit_;
+	return;
+}
+
+
+static int __init rtw_drv_entry(void)
+{
+	int ret = 0;
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+rtw_drv_entry\n"));
+	DBG_871X("rtw driver version=%s\n", DRIVERVERSION);
+	DBG_871X("Build at: %s %s\n", __DATE__, __TIME__);
+	pci_drvpriv.drv_registered = _TRUE;
+
+	rtw_suspend_lock_init();
+
+	ret = pci_register_driver(&pci_drvpriv.rtw_pci_drv);
+	if (ret) {
+		RT_TRACE(_module_hci_intfs_c_, _drv_err_, (": No device found\n"));
+	}
+
+	return ret;
+}
+
+static void __exit rtw_drv_halt(void)
+{
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+rtw_drv_halt\n"));
+	DBG_871X("+rtw_drv_halt\n");
+
+	pci_drvpriv.drv_registered = _FALSE;
+
+	pci_unregister_driver(&pci_drvpriv.rtw_pci_drv);
+
+	rtw_suspend_lock_uninit();
+	DBG_871X("-rtw_drv_halt\n");
+
+	rtw_mstat_dump();
+}
+
+
+module_init(rtw_drv_entry);
+module_exit(rtw_drv_halt);
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/pci_ops_linux.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/pci_ops_linux.c
new file mode 100644
index 000000000000..5eed11a6a71c
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/pci_ops_linux.c
@@ -0,0 +1,21 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *******************************************************************************/
+#define _PCI_OPS_LINUX_C_
+
+#include <drv_types.h>
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/recv_linux.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/recv_linux.c
new file mode 100644
index 000000000000..c02046db6149
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/recv_linux.c
@@ -0,0 +1,447 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _RECV_OSDEP_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#include <wifi.h>
+#include <recv_osdep.h>
+
+#include <osdep_intf.h>
+#include <ethernet.h>
+
+#ifdef CONFIG_USB_HCI
+#include <usb_ops.h>
+#endif
+
+//init os related resource in struct recv_priv
+int rtw_os_recv_resource_init(struct recv_priv *precvpriv, _adapter *padapter)
+{
+	int	res=_SUCCESS;
+
+	return res;
+}
+
+//alloc os related resource in union recv_frame
+int rtw_os_recv_resource_alloc(_adapter *padapter, union recv_frame *precvframe)
+{
+	int	res=_SUCCESS;
+
+	precvframe->u.hdr.pkt_newalloc = precvframe->u.hdr.pkt = NULL;
+
+	return res;
+
+}
+
+//free os related resource in union recv_frame
+void rtw_os_recv_resource_free(struct recv_priv *precvpriv)
+{
+
+}
+
+
+//alloc os related resource in struct recv_buf
+int rtw_os_recvbuf_resource_alloc(_adapter *padapter, struct recv_buf *precvbuf)
+{
+	int res=_SUCCESS;
+
+#ifdef CONFIG_USB_HCI
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct usb_device	*pusbd = pdvobjpriv->pusbdev;
+
+	precvbuf->irp_pending = _FALSE;
+	precvbuf->purb = usb_alloc_urb(0, GFP_KERNEL);
+	if(precvbuf->purb == NULL){
+		res = _FAIL;
+	}
+
+	precvbuf->pskb = NULL;
+
+	precvbuf->reuse = _FALSE;
+
+	precvbuf->pallocated_buf  = precvbuf->pbuf = NULL;
+
+	precvbuf->pdata = precvbuf->phead = precvbuf->ptail = precvbuf->pend = NULL;
+
+	precvbuf->transfer_len = 0;
+
+	precvbuf->len = 0;
+
+	#ifdef CONFIG_USE_USB_BUFFER_ALLOC_RX
+	precvbuf->pallocated_buf = rtw_usb_buffer_alloc(pusbd, (size_t)precvbuf->alloc_sz, &precvbuf->dma_transfer_addr);
+	precvbuf->pbuf = precvbuf->pallocated_buf;
+	if(precvbuf->pallocated_buf == NULL)
+		return _FAIL;
+	#endif //CONFIG_USE_USB_BUFFER_ALLOC_RX
+
+#endif //CONFIG_USB_HCI
+
+	return res;
+}
+
+//free os related resource in struct recv_buf
+int rtw_os_recvbuf_resource_free(_adapter *padapter, struct recv_buf *precvbuf)
+{
+	int ret = _SUCCESS;
+
+#ifdef CONFIG_USB_HCI
+
+#ifdef CONFIG_USE_USB_BUFFER_ALLOC_RX
+
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct usb_device	*pusbd = pdvobjpriv->pusbdev;
+
+	rtw_usb_buffer_free(pusbd, (size_t)precvbuf->alloc_sz, precvbuf->pallocated_buf, precvbuf->dma_transfer_addr);
+	precvbuf->pallocated_buf =  NULL;
+	precvbuf->dma_transfer_addr = 0;
+
+#endif //CONFIG_USE_USB_BUFFER_ALLOC_RX
+
+	if(precvbuf->purb)
+	{
+		//usb_kill_urb(precvbuf->purb);
+		usb_free_urb(precvbuf->purb);
+	}
+
+#endif //CONFIG_USB_HCI
+
+
+	if(precvbuf->pskb)
+		rtw_skb_free(precvbuf->pskb);
+
+
+	return ret;
+
+}
+
+void rtw_handle_tkip_mic_err(_adapter *padapter,u8 bgroup)
+{
+#ifdef CONFIG_IOCTL_CFG80211
+	enum nl80211_key_type key_type = 0;
+#endif
+	union iwreq_data wrqu;
+	struct iw_michaelmicfailure    ev;
+	struct mlme_priv*              pmlmepriv  = &padapter->mlmepriv;
+	struct security_priv	*psecuritypriv = &padapter->securitypriv;
+	u32 cur_time = 0;
+
+	if( psecuritypriv->last_mic_err_time == 0 )
+	{
+		psecuritypriv->last_mic_err_time = rtw_get_current_time();
+	}
+	else
+	{
+		cur_time = rtw_get_current_time();
+
+		if( cur_time - psecuritypriv->last_mic_err_time < 60*HZ )
+		{
+			psecuritypriv->btkip_countermeasure = _TRUE;
+			psecuritypriv->last_mic_err_time = 0;
+			psecuritypriv->btkip_countermeasure_time = cur_time;
+		}
+		else
+		{
+			psecuritypriv->last_mic_err_time = rtw_get_current_time();
+		}
+	}
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if ( bgroup )
+	{
+		key_type |= NL80211_KEYTYPE_GROUP;
+	}
+	else
+	{
+		key_type |= NL80211_KEYTYPE_PAIRWISE;
+	}
+
+	cfg80211_michael_mic_failure(padapter->pnetdev, (u8 *)&pmlmepriv->assoc_bssid[ 0 ], key_type, -1,
+		NULL, GFP_ATOMIC);
+#endif
+
+	_rtw_memset( &ev, 0x00, sizeof( ev ) );
+	if ( bgroup )
+	{
+	    ev.flags |= IW_MICFAILURE_GROUP;
+	}
+	else
+	{
+	    ev.flags |= IW_MICFAILURE_PAIRWISE;
+	}
+
+	ev.src_addr.sa_family = ARPHRD_ETHER;
+	_rtw_memcpy( ev.src_addr.sa_data, &pmlmepriv->assoc_bssid[ 0 ], ETH_ALEN );
+
+	_rtw_memset( &wrqu, 0x00, sizeof( wrqu ) );
+	wrqu.data.length = sizeof( ev );
+
+	wireless_send_event( padapter->pnetdev, IWEVMICHAELMICFAILURE, &wrqu, (char*) &ev );
+}
+
+void rtw_hostapd_mlme_rx(_adapter *padapter, union recv_frame *precv_frame)
+{
+#ifdef CONFIG_HOSTAPD_MLME
+	_pkt *skb;
+	struct hostapd_priv *phostapdpriv  = padapter->phostapdpriv;
+	struct net_device *pmgnt_netdev = phostapdpriv->pmgnt_netdev;
+
+	RT_TRACE(_module_recv_osdep_c_, _drv_info_, ("+rtw_hostapd_mlme_rx\n"));
+
+	skb = precv_frame->u.hdr.pkt;
+
+	if (skb == NULL)
+		return;
+
+	skb->data = precv_frame->u.hdr.rx_data;
+	skb->tail = precv_frame->u.hdr.rx_tail;
+	skb->len = precv_frame->u.hdr.len;
+
+	//pskb_copy = rtw_skb_copy(skb);
+//	if(skb == NULL) goto _exit;
+
+	skb->dev = pmgnt_netdev;
+	skb->ip_summed = CHECKSUM_NONE;
+	skb->pkt_type = PACKET_OTHERHOST;
+	//skb->protocol = __constant_htons(0x0019); /*ETH_P_80211_RAW*/
+	skb->protocol = __constant_htons(0x0003); /*ETH_P_80211_RAW*/
+
+	//DBG_871X("(1)data=0x%x, head=0x%x, tail=0x%x, mac_header=0x%x, len=%d\n", skb->data, skb->head, skb->tail, skb->mac_header, skb->len);
+
+	//skb->mac.raw = skb->data;
+	skb_reset_mac_header(skb);
+
+       //skb_pull(skb, 24);
+       _rtw_memset(skb->cb, 0, sizeof(skb->cb));
+
+	rtw_netif_rx(pmgnt_netdev, skb);
+
+	precv_frame->u.hdr.pkt = NULL; // set pointer to NULL before rtw_free_recvframe() if call rtw_netif_rx()
+#endif
+}
+
+int rtw_recv_indicatepkt(_adapter *padapter, union recv_frame *precv_frame)
+{
+	struct recv_priv *precvpriv;
+	_queue	*pfree_recv_queue;
+	_pkt *skb;
+	struct mlme_priv*pmlmepriv = &padapter->mlmepriv;
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_RX
+	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
+#endif
+
+#ifdef CONFIG_BR_EXT
+	void *br_port = NULL;
+#endif
+
+_func_enter_;
+
+	precvpriv = &(padapter->recvpriv);
+	pfree_recv_queue = &(precvpriv->free_recv_queue);
+
+#ifdef CONFIG_DRVEXT_MODULE
+	if (drvext_rx_handler(padapter, precv_frame->u.hdr.rx_data, precv_frame->u.hdr.len) == _SUCCESS)
+	{
+		goto _recv_indicatepkt_drop;
+	}
+#endif
+
+	skb = precv_frame->u.hdr.pkt;
+	if(skb == NULL)
+	{
+		RT_TRACE(_module_recv_osdep_c_,_drv_err_,("rtw_recv_indicatepkt():skb==NULL something wrong!!!!\n"));
+		goto _recv_indicatepkt_drop;
+	}
+
+	RT_TRACE(_module_recv_osdep_c_,_drv_info_,("rtw_recv_indicatepkt():skb != NULL !!!\n"));
+	RT_TRACE(_module_recv_osdep_c_,_drv_info_,("rtw_recv_indicatepkt():precv_frame->u.hdr.rx_head=%p  precv_frame->hdr.rx_data=%p\n", precv_frame->u.hdr.rx_head, precv_frame->u.hdr.rx_data));
+	RT_TRACE(_module_recv_osdep_c_,_drv_info_,("precv_frame->hdr.rx_tail=%p precv_frame->u.hdr.rx_end=%p precv_frame->hdr.len=%d \n", precv_frame->u.hdr.rx_tail, precv_frame->u.hdr.rx_end, precv_frame->u.hdr.len));
+
+	skb->data = precv_frame->u.hdr.rx_data;
+
+	skb_set_tail_pointer(skb, precv_frame->u.hdr.len);
+
+	skb->len = precv_frame->u.hdr.len;
+
+	RT_TRACE(_module_recv_osdep_c_,_drv_info_,("\n skb->head=%p skb->data=%p skb->tail=%p skb->end=%p skb->len=%d\n", skb->head, skb->data, skb->tail, skb->end, skb->len));
+
+	if(check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE)
+	{
+		_pkt *pskb2=NULL;
+		struct sta_info *psta = NULL;
+		struct sta_priv *pstapriv = &padapter->stapriv;
+		struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
+		int bmcast = IS_MCAST(pattrib->dst);
+
+		//DBG_871X("bmcast=%d\n", bmcast);
+
+		if(_rtw_memcmp(pattrib->dst, myid(&padapter->eeprompriv), ETH_ALEN)==_FALSE)
+		{
+			//DBG_871X("not ap psta=%p, addr=%pM\n", psta, pattrib->dst);
+
+			if(bmcast)
+			{
+				psta = rtw_get_bcmc_stainfo(padapter);
+				pskb2 = rtw_skb_clone(skb);
+			} else {
+				psta = rtw_get_stainfo(pstapriv, pattrib->dst);
+			}
+
+			if(psta)
+			{
+				struct net_device *pnetdev= (struct net_device*)padapter->pnetdev;
+
+				//DBG_871X("directly forwarding to the rtw_xmit_entry\n");
+
+				//skb->ip_summed = CHECKSUM_NONE;
+				skb->dev = pnetdev;
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+				skb_set_queue_mapping(skb, rtw_recv_select_queue(skb));
+#endif //LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35)
+
+				_rtw_xmit_entry(skb, pnetdev);
+
+				if(bmcast)
+					skb = pskb2;
+				else
+					goto _recv_indicatepkt_end;
+			}
+
+
+		}
+		else// to APself
+		{
+			//DBG_871X("to APSelf\n");
+		}
+	}
+
+
+#ifdef CONFIG_BR_EXT
+
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+	br_port = padapter->pnetdev->br_port;
+#else   // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+	rcu_read_lock();
+	br_port = rcu_dereference(padapter->pnetdev->rx_handler_data);
+	rcu_read_unlock();
+#endif  // (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 35))
+
+	if( br_port	&& (check_fwstate(pmlmepriv, WIFI_STATION_STATE|WIFI_ADHOC_STATE) == _TRUE) )
+	{
+		int nat25_handle_frame(_adapter *priv, struct sk_buff *skb);
+		if (nat25_handle_frame(padapter, skb) == -1) {
+			//priv->ext_stats.rx_data_drops++;
+			//DEBUG_ERR("RX DROP: nat25_handle_frame fail!\n");
+			//return FAIL;
+#if 1
+			// bypass this frame to upper layer!!
+#else
+			goto _recv_indicatepkt_drop;
+#endif
+		}
+	}
+
+#endif	// CONFIG_BR_EXT
+
+
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_RX
+	if ( (pattrib->tcpchk_valid == 1) && (pattrib->tcp_chkrpt == 1) ) {
+		skb->ip_summed = CHECKSUM_UNNECESSARY;
+		//DBG_871X("CHECKSUM_UNNECESSARY \n");
+	} else {
+		skb->ip_summed = CHECKSUM_NONE;
+		//DBG_871X("CHECKSUM_NONE(%d, %d) \n", pattrib->tcpchk_valid, pattrib->tcp_chkrpt);
+	}
+#else /* !CONFIG_TCP_CSUM_OFFLOAD_RX */
+
+	skb->ip_summed = CHECKSUM_NONE;
+
+#endif
+
+	skb->dev = padapter->pnetdev;
+	skb->protocol = eth_type_trans(skb, padapter->pnetdev);
+
+	rtw_netif_rx(padapter->pnetdev, skb);
+
+_recv_indicatepkt_end:
+
+	precv_frame->u.hdr.pkt = NULL; // pointers to NULL before rtw_free_recvframe()
+
+	rtw_free_recvframe(precv_frame, pfree_recv_queue);
+
+	RT_TRACE(_module_recv_osdep_c_,_drv_info_,("\n rtw_recv_indicatepkt :after rtw_netif_rx!!!!\n"));
+
+_func_exit_;
+
+        return _SUCCESS;
+
+_recv_indicatepkt_drop:
+
+	 //enqueue back to free_recv_queue
+	 if(precv_frame)
+		 rtw_free_recvframe(precv_frame, pfree_recv_queue);
+
+	 return _FAIL;
+
+_func_exit_;
+
+}
+
+void rtw_os_read_port(_adapter *padapter, struct recv_buf *precvbuf)
+{
+	struct recv_priv *precvpriv = &padapter->recvpriv;
+
+#ifdef CONFIG_USB_HCI
+
+	precvbuf->ref_cnt--;
+
+	//free skb in recv_buf
+	rtw_skb_free(precvbuf->pskb);
+
+	precvbuf->pskb = NULL;
+	precvbuf->reuse = _FALSE;
+
+	if(precvbuf->irp_pending == _FALSE)
+	{
+		rtw_read_port(padapter, precvpriv->ff_hwaddr, 0, (unsigned char *)precvbuf);
+	}
+
+
+#endif
+#ifdef CONFIG_SDIO_HCI
+		precvbuf->pskb = NULL;
+#endif
+
+}
+void _rtw_reordering_ctrl_timeout_handler (void *FunctionContext);
+void _rtw_reordering_ctrl_timeout_handler (void *FunctionContext)
+{
+	struct recv_reorder_ctrl *preorder_ctrl = (struct recv_reorder_ctrl *)FunctionContext;
+	rtw_reordering_ctrl_timeout_handler(preorder_ctrl);
+}
+
+void rtw_init_recv_timer(struct recv_reorder_ctrl *preorder_ctrl)
+{
+	_adapter *padapter = preorder_ctrl->padapter;
+
+	_init_timer(&(preorder_ctrl->reordering_ctrl_timer), padapter->pnetdev, _rtw_reordering_ctrl_timeout_handler, preorder_ctrl);
+
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/rtw_android.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/rtw_android.c
new file mode 100644
index 000000000000..bbd22ef1b819
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/rtw_android.c
@@ -0,0 +1,832 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+
+#include <rtw_android.h>
+#include <osdep_service.h>
+#include <rtw_debug.h>
+#include <ioctl_cfg80211.h>
+#include <rtw_ioctl_set.h>
+
+#if defined(RTW_ENABLE_WIFI_CONTROL_FUNC)
+#include <linux/platform_device.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35))
+#include <linux/wlan_plat.h>
+#else
+#include <linux/wifi_tiwlan.h>
+#endif
+#endif /* defined(RTW_ENABLE_WIFI_CONTROL_FUNC) */
+
+const char *android_wifi_cmd_str[ANDROID_WIFI_CMD_MAX] = {
+	"START",
+	"STOP",
+	"SCAN-ACTIVE",
+	"SCAN-PASSIVE",
+	"RSSI",
+	"LINKSPEED",
+	"RXFILTER-START",
+	"RXFILTER-STOP",
+	"RXFILTER-ADD",
+	"RXFILTER-REMOVE",
+	"BTCOEXSCAN-START",
+	"BTCOEXSCAN-STOP",
+	"BTCOEXMODE",
+	"SETSUSPENDOPT",
+	"P2P_DEV_ADDR",
+	"SETFWPATH",
+	"SETBAND",
+	"GETBAND",
+	"COUNTRY",
+	"P2P_SET_NOA",
+	"P2P_GET_NOA",
+	"P2P_SET_PS",
+	"SET_AP_WPS_P2P_IE",
+#ifdef PNO_SUPPORT
+	"PNOSSIDCLR",
+	"PNOSETUP ",
+	"PNOFORCE",
+	"PNODEBUG",
+#endif
+
+	"MACADDR",
+
+	"BLOCK",
+	"WFD-ENABLE",
+	"WFD-DISABLE",
+	"WFD-SET-TCPPORT",
+	"WFD-SET-MAXTPUT",
+	"WFD-SET-DEVTYPE",
+};
+
+#ifdef PNO_SUPPORT
+#define PNO_TLV_PREFIX			'S'
+#define PNO_TLV_VERSION			'1'
+#define PNO_TLV_SUBVERSION 		'2'
+#define PNO_TLV_RESERVED		'0'
+#define PNO_TLV_TYPE_SSID_IE		'S'
+#define PNO_TLV_TYPE_TIME		'T'
+#define PNO_TLV_FREQ_REPEAT		'R'
+#define PNO_TLV_FREQ_EXPO_MAX		'M'
+
+typedef struct cmd_tlv {
+	char prefix;
+	char version;
+	char subver;
+	char reserved;
+} cmd_tlv_t;
+#endif /* PNO_SUPPORT */
+
+typedef struct android_wifi_priv_cmd {
+	char *buf;
+	int used_len;
+	int total_len;
+} android_wifi_priv_cmd;
+
+/**
+ * Local (static) functions and variables
+ */
+
+/* Initialize g_wifi_on to 1 so dhd_bus_start will be called for the first
+ * time (only) in dhd_open, subsequential wifi on will be handled by
+ * wl_android_wifi_on
+ */
+static int g_wifi_on = _TRUE;
+
+
+#ifdef PNO_SUPPORT
+static int wl_android_set_pno_setup(struct net_device *dev, char *command, int total_len)
+{
+	wlc_ssid_t ssids_local[MAX_PFN_LIST_COUNT];
+	int res = -1;
+	int nssid = 0;
+	cmd_tlv_t *cmd_tlv_temp;
+	char *str_ptr;
+	int tlv_size_left;
+	int pno_time = 0;
+	int pno_repeat = 0;
+	int pno_freq_expo_max = 0;
+
+#ifdef PNO_SET_DEBUG
+	int i;
+	char pno_in_example[] = {
+		'P', 'N', 'O', 'S', 'E', 'T', 'U', 'P', ' ',
+		'S', '1', '2', '0',
+		'S',
+		0x05,
+		'd', 'l', 'i', 'n', 'k',
+		'S',
+		0x04,
+		'G', 'O', 'O', 'G',
+		'T',
+		'0', 'B',
+		'R',
+		'2',
+		'M',
+		'2',
+		0x00
+		};
+#endif /* PNO_SET_DEBUG */
+
+	DHD_INFO(("%s: command=%s, len=%d\n", __FUNCTION__, command, total_len));
+
+	if (total_len < (strlen(CMD_PNOSETUP_SET) + sizeof(cmd_tlv_t))) {
+		DBG_871X("%s argument=%d less min size\n", __FUNCTION__, total_len);
+		goto exit_proc;
+	}
+
+#ifdef PNO_SET_DEBUG
+	memcpy(command, pno_in_example, sizeof(pno_in_example));
+	for (i = 0; i < sizeof(pno_in_example); i++)
+		printf("%02X ", command[i]);
+	printf("\n");
+	total_len = sizeof(pno_in_example);
+#endif
+
+	str_ptr = command + strlen(CMD_PNOSETUP_SET);
+	tlv_size_left = total_len - strlen(CMD_PNOSETUP_SET);
+
+	cmd_tlv_temp = (cmd_tlv_t *)str_ptr;
+	memset(ssids_local, 0, sizeof(ssids_local));
+
+	if ((cmd_tlv_temp->prefix == PNO_TLV_PREFIX) &&
+		(cmd_tlv_temp->version == PNO_TLV_VERSION) &&
+		(cmd_tlv_temp->subver == PNO_TLV_SUBVERSION)) {
+
+		str_ptr += sizeof(cmd_tlv_t);
+		tlv_size_left -= sizeof(cmd_tlv_t);
+
+		if ((nssid = wl_iw_parse_ssid_list_tlv(&str_ptr, ssids_local,
+			MAX_PFN_LIST_COUNT, &tlv_size_left)) <= 0) {
+			DBG_871X("SSID is not presented or corrupted ret=%d\n", nssid);
+			goto exit_proc;
+		} else {
+			if ((str_ptr[0] != PNO_TLV_TYPE_TIME) || (tlv_size_left <= 1)) {
+				DBG_871X("%s scan duration corrupted field size %d\n",
+					__FUNCTION__, tlv_size_left);
+				goto exit_proc;
+			}
+			str_ptr++;
+			pno_time = simple_strtoul(str_ptr, &str_ptr, 16);
+			DHD_INFO(("%s: pno_time=%d\n", __FUNCTION__, pno_time));
+
+			if (str_ptr[0] != 0) {
+				if ((str_ptr[0] != PNO_TLV_FREQ_REPEAT)) {
+					DBG_871X("%s pno repeat : corrupted field\n",
+						__FUNCTION__);
+					goto exit_proc;
+				}
+				str_ptr++;
+				pno_repeat = simple_strtoul(str_ptr, &str_ptr, 16);
+				DHD_INFO(("%s :got pno_repeat=%d\n", __FUNCTION__, pno_repeat));
+				if (str_ptr[0] != PNO_TLV_FREQ_EXPO_MAX) {
+					DBG_871X("%s FREQ_EXPO_MAX corrupted field size\n",
+						__FUNCTION__);
+					goto exit_proc;
+				}
+				str_ptr++;
+				pno_freq_expo_max = simple_strtoul(str_ptr, &str_ptr, 16);
+				DHD_INFO(("%s: pno_freq_expo_max=%d\n",
+					__FUNCTION__, pno_freq_expo_max));
+			}
+		}
+	} else {
+		DBG_871X("%s get wrong TLV command\n", __FUNCTION__);
+		goto exit_proc;
+	}
+
+	res = dhd_dev_pno_set(dev, ssids_local, nssid, pno_time, pno_repeat, pno_freq_expo_max);
+
+exit_proc:
+	return res;
+}
+#endif /* PNO_SUPPORT */
+
+int rtw_android_cmdstr_to_num(char *cmdstr)
+{
+	int cmd_num;
+	for(cmd_num=0 ; cmd_num<ANDROID_WIFI_CMD_MAX; cmd_num++)
+		if(0 == strncasecmp(cmdstr , android_wifi_cmd_str[cmd_num], strlen(android_wifi_cmd_str[cmd_num])) )
+			break;
+
+	return cmd_num;
+}
+
+int rtw_android_get_rssi(struct net_device *net, char *command, int total_len)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(net);
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	struct	wlan_network	*pcur_network = &pmlmepriv->cur_network;
+	int bytes_written = 0;
+
+	if(check_fwstate(pmlmepriv, _FW_LINKED) == _TRUE) {
+		bytes_written += snprintf(&command[bytes_written], total_len, "%s rssi %d",
+			pcur_network->network.Ssid.Ssid, padapter->recvpriv.rssi);
+	}
+
+	return bytes_written;
+}
+
+int rtw_android_get_link_speed(struct net_device *net, char *command, int total_len)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(net);
+	struct	mlme_priv	*pmlmepriv = &(padapter->mlmepriv);
+	struct	wlan_network	*pcur_network = &pmlmepriv->cur_network;
+	int bytes_written = 0;
+	u16 link_speed = 0;
+
+	link_speed = rtw_get_cur_max_rate(padapter)/10;
+	bytes_written = snprintf(command, total_len, "LinkSpeed %d", link_speed);
+
+	return bytes_written;
+}
+
+int rtw_android_get_macaddr(struct net_device *net, char *command, int total_len)
+{
+	_adapter *adapter = (_adapter *)rtw_netdev_priv(net);
+	int bytes_written = 0;
+
+	bytes_written = snprintf(command, total_len, "Macaddr = "MAC_FMT, MAC_ARG(net->dev_addr));
+	return bytes_written;
+}
+
+int rtw_android_set_country(struct net_device *net, char *command, int total_len)
+{
+	_adapter *adapter = (_adapter *)rtw_netdev_priv(net);
+	char *country_code = command + strlen(android_wifi_cmd_str[ANDROID_WIFI_CMD_COUNTRY]) + 1;
+	int ret = _FAIL;
+
+	ret = rtw_set_country(adapter, country_code);
+
+	return (ret==_SUCCESS)?0:-1;
+}
+
+int rtw_android_get_p2p_dev_addr(struct net_device *net, char *command, int total_len)
+{
+	int bytes_written = 0;
+
+	//We use the same address as our HW MAC address
+	_rtw_memcpy(command, net->dev_addr, ETH_ALEN);
+
+	bytes_written = ETH_ALEN;
+	return bytes_written;
+}
+
+int rtw_android_set_block(struct net_device *net, char *command, int total_len)
+{
+	_adapter *adapter = (_adapter *)rtw_netdev_priv(net);
+	char *block_value = command + strlen(android_wifi_cmd_str[ANDROID_WIFI_CMD_BLOCK]) + 1;
+
+	#ifdef CONFIG_IOCTL_CFG80211
+	wdev_to_priv(adapter->rtw_wdev)->block = (*block_value=='0')?_FALSE:_TRUE;
+	#endif
+
+	return 0;
+}
+
+int rtw_android_setband(struct net_device *net, char *command, int total_len)
+{
+	_adapter *adapter = (_adapter *)rtw_netdev_priv(net);
+	char *arg = command + strlen(android_wifi_cmd_str[ANDROID_WIFI_CMD_SETBAND]) + 1;
+	u32 band = GHZ_MAX;
+	int ret = _FAIL;
+
+	sscanf(arg, "%u", &band);
+	ret = rtw_set_band(adapter, band);
+
+	return (ret==_SUCCESS)?0:-1;
+}
+
+int rtw_android_getband(struct net_device *net, char *command, int total_len)
+{
+	_adapter *adapter = (_adapter *)rtw_netdev_priv(net);
+	int bytes_written = 0;
+
+	bytes_written = snprintf(command, total_len, "%u", adapter->setband);
+
+	return bytes_written;
+}
+
+int get_int_from_command( char* pcmd )
+{
+	int i = 0;
+
+	for( i = 0; i < strlen( pcmd ); i++ )
+	{
+		if ( pcmd[ i ] == '=' )
+		{
+			//	Skip the '=' and space characters.
+			i += 2;
+			break;
+		}
+	}
+	return ( rtw_atoi( pcmd + i ) );
+}
+
+int rtw_android_priv_cmd(struct net_device *net, struct ifreq *ifr, int cmd)
+{
+	int ret = 0;
+	char *command = NULL;
+	int cmd_num;
+	int bytes_written = 0;
+	android_wifi_priv_cmd priv_cmd;
+
+	rtw_lock_suspend();
+
+	if (!ifr->ifr_data) {
+		ret = -EINVAL;
+		goto exit;
+	}
+	if (copy_from_user(&priv_cmd, ifr->ifr_data, sizeof(android_wifi_priv_cmd))) {
+		ret = -EFAULT;
+		goto exit;
+	}
+
+	command = rtw_zmalloc(priv_cmd.total_len);
+	if (!command)
+	{
+		DBG_871X("%s: failed to allocate memory\n", __FUNCTION__);
+		ret = -ENOMEM;
+		goto exit;
+	}
+
+	if (!access_ok(VERIFY_READ, priv_cmd.buf, priv_cmd.total_len)){
+		DBG_871X("%s: failed to access memory\n", __FUNCTION__);
+		ret = -EFAULT;
+		goto exit;
+	 }
+	if (copy_from_user(command, (void *)priv_cmd.buf, priv_cmd.total_len)) {
+		ret = -EFAULT;
+		goto exit;
+	}
+
+	DBG_871X("%s: Android private cmd \"%s\" on %s\n"
+		, __FUNCTION__, command, ifr->ifr_name);
+
+	cmd_num = rtw_android_cmdstr_to_num(command);
+
+	switch(cmd_num) {
+	case ANDROID_WIFI_CMD_START:
+		//bytes_written = wl_android_wifi_on(net);
+		goto response;
+	case ANDROID_WIFI_CMD_SETFWPATH:
+		goto response;
+	}
+
+	if (!g_wifi_on) {
+		DBG_871X("%s: Ignore private cmd \"%s\" - iface %s is down\n"
+			,__FUNCTION__, command, ifr->ifr_name);
+		ret = 0;
+		goto exit;
+	}
+
+	switch(cmd_num) {
+
+	case ANDROID_WIFI_CMD_STOP:
+		//bytes_written = wl_android_wifi_off(net);
+		break;
+
+	case ANDROID_WIFI_CMD_SCAN_ACTIVE:
+		//rtw_set_scan_mode((_adapter *)rtw_netdev_priv(net), SCAN_ACTIVE);
+#ifdef CONFIG_PLATFORM_MSTAR
+#ifdef CONFIG_IOCTL_CFG80211
+		(wdev_to_priv(net->ieee80211_ptr))->bandroid_scan = _TRUE;
+#endif //CONFIG_IOCTL_CFG80211
+#endif //CONFIG_PLATFORM_MSTAR
+		break;
+	case ANDROID_WIFI_CMD_SCAN_PASSIVE:
+		//rtw_set_scan_mode((_adapter *)rtw_netdev_priv(net), SCAN_PASSIVE);
+		break;
+
+	case ANDROID_WIFI_CMD_RSSI:
+		bytes_written = rtw_android_get_rssi(net, command, priv_cmd.total_len);
+		break;
+	case ANDROID_WIFI_CMD_LINKSPEED:
+		bytes_written = rtw_android_get_link_speed(net, command, priv_cmd.total_len);
+		break;
+
+	case ANDROID_WIFI_CMD_MACADDR:
+		bytes_written = rtw_android_get_macaddr(net, command, priv_cmd.total_len);
+		break;
+
+	case ANDROID_WIFI_CMD_BLOCK:
+		bytes_written = rtw_android_set_block(net, command, priv_cmd.total_len);
+		break;
+
+	case ANDROID_WIFI_CMD_RXFILTER_START:
+		//bytes_written = net_os_set_packet_filter(net, 1);
+		break;
+	case ANDROID_WIFI_CMD_RXFILTER_STOP:
+		//bytes_written = net_os_set_packet_filter(net, 0);
+		break;
+	case ANDROID_WIFI_CMD_RXFILTER_ADD:
+		//int filter_num = *(command + strlen(CMD_RXFILTER_ADD) + 1) - '0';
+		//bytes_written = net_os_rxfilter_add_remove(net, TRUE, filter_num);
+		break;
+	case ANDROID_WIFI_CMD_RXFILTER_REMOVE:
+		//int filter_num = *(command + strlen(CMD_RXFILTER_REMOVE) + 1) - '0';
+		//bytes_written = net_os_rxfilter_add_remove(net, FALSE, filter_num);
+		break;
+
+	case ANDROID_WIFI_CMD_BTCOEXSCAN_START:
+		/* TBD: BTCOEXSCAN-START */
+		break;
+	case ANDROID_WIFI_CMD_BTCOEXSCAN_STOP:
+		/* TBD: BTCOEXSCAN-STOP */
+		break;
+	case ANDROID_WIFI_CMD_BTCOEXMODE:
+		#if 0
+		uint mode = *(command + strlen(CMD_BTCOEXMODE) + 1) - '0';
+		if (mode == 1)
+			net_os_set_packet_filter(net, 0); /* DHCP starts */
+		else
+			net_os_set_packet_filter(net, 1); /* DHCP ends */
+#ifdef WL_CFG80211
+		bytes_written = wl_cfg80211_set_btcoex_dhcp(net, command);
+#endif
+		#endif
+		break;
+
+	case ANDROID_WIFI_CMD_SETSUSPENDOPT:
+		//bytes_written = wl_android_set_suspendopt(net, command, priv_cmd.total_len);
+		break;
+
+	case ANDROID_WIFI_CMD_SETBAND:
+		bytes_written = rtw_android_setband(net, command, priv_cmd.total_len);
+		break;
+
+	case ANDROID_WIFI_CMD_GETBAND:
+		bytes_written = rtw_android_getband(net, command, priv_cmd.total_len);
+		break;
+
+	case ANDROID_WIFI_CMD_COUNTRY:
+		bytes_written = rtw_android_set_country(net, command, priv_cmd.total_len);
+		break;
+
+#ifdef PNO_SUPPORT
+	case ANDROID_WIFI_CMD_PNOSSIDCLR_SET:
+		//bytes_written = dhd_dev_pno_reset(net);
+		break;
+	case ANDROID_WIFI_CMD_PNOSETUP_SET:
+		//bytes_written = wl_android_set_pno_setup(net, command, priv_cmd.total_len);
+		break;
+	case ANDROID_WIFI_CMD_PNOENABLE_SET:
+		//uint pfn_enabled = *(command + strlen(CMD_PNOENABLE_SET) + 1) - '0';
+		//bytes_written = dhd_dev_pno_enable(net, pfn_enabled);
+		break;
+#endif
+
+	case ANDROID_WIFI_CMD_P2P_DEV_ADDR:
+		bytes_written = rtw_android_get_p2p_dev_addr(net, command, priv_cmd.total_len);
+		break;
+	case ANDROID_WIFI_CMD_P2P_SET_NOA:
+		//int skip = strlen(CMD_P2P_SET_NOA) + 1;
+		//bytes_written = wl_cfg80211_set_p2p_noa(net, command + skip, priv_cmd.total_len - skip);
+		break;
+	case ANDROID_WIFI_CMD_P2P_GET_NOA:
+		//bytes_written = wl_cfg80211_get_p2p_noa(net, command, priv_cmd.total_len);
+		break;
+	case ANDROID_WIFI_CMD_P2P_SET_PS:
+		//int skip = strlen(CMD_P2P_SET_PS) + 1;
+		//bytes_written = wl_cfg80211_set_p2p_ps(net, command + skip, priv_cmd.total_len - skip);
+		break;
+
+#ifdef CONFIG_IOCTL_CFG80211
+	case ANDROID_WIFI_CMD_SET_AP_WPS_P2P_IE:
+	{
+		int skip = strlen(android_wifi_cmd_str[ANDROID_WIFI_CMD_SET_AP_WPS_P2P_IE]) + 3;
+		bytes_written = rtw_cfg80211_set_mgnt_wpsp2pie(net, command + skip, priv_cmd.total_len - skip, *(command + skip - 2) - '0');
+		break;
+	}
+#endif //CONFIG_IOCTL_CFG80211
+
+#ifdef CONFIG_WFD
+	case ANDROID_WIFI_CMD_WFD_ENABLE:
+	{
+		//	Commented by Albert 2012/07/24
+		//	We can enable the WFD function by using the following command:
+		//	wpa_cli driver wfd-enable
+
+		struct wifi_display_info		*pwfd_info;
+		_adapter*	padapter = ( _adapter * ) rtw_netdev_priv(net);
+
+		pwfd_info = &padapter->wfd_info;
+		if( padapter->wdinfo.driver_interface == DRIVER_CFG80211 )
+			pwfd_info->wfd_enable = _TRUE;
+		break;
+	}
+
+	case ANDROID_WIFI_CMD_WFD_DISABLE:
+	{
+		//	Commented by Albert 2012/07/24
+		//	We can disable the WFD function by using the following command:
+		//	wpa_cli driver wfd-disable
+
+		struct wifi_display_info		*pwfd_info;
+		_adapter*	padapter = ( _adapter * ) rtw_netdev_priv(net);
+
+		pwfd_info = &padapter->wfd_info;
+		if( padapter->wdinfo.driver_interface == DRIVER_CFG80211 )
+			pwfd_info->wfd_enable = _FALSE;
+		break;
+	}
+	case ANDROID_WIFI_CMD_WFD_SET_TCPPORT:
+	{
+		//	Commented by Albert 2012/07/24
+		//	We can set the tcp port number by using the following command:
+		//	wpa_cli driver wfd-set-tcpport = 554
+
+		struct wifi_display_info		*pwfd_info;
+		_adapter*	padapter = ( _adapter * ) rtw_netdev_priv(net);
+
+		pwfd_info = &padapter->wfd_info;
+		if( padapter->wdinfo.driver_interface == DRIVER_CFG80211 )
+			pwfd_info->rtsp_ctrlport = ( u16 ) get_int_from_command( priv_cmd.buf );
+		break;
+	}
+	case ANDROID_WIFI_CMD_WFD_SET_MAX_TPUT:
+	{
+
+
+		break;
+	}
+	case ANDROID_WIFI_CMD_WFD_SET_DEVTYPE:
+	{
+		//	Commented by Albert 2012/08/28
+		//	Specify the WFD device type ( WFD source/primary sink )
+
+		struct wifi_display_info		*pwfd_info;
+		_adapter*	padapter = ( _adapter * ) rtw_netdev_priv(net);
+
+		pwfd_info = &padapter->wfd_info;
+		if( padapter->wdinfo.driver_interface == DRIVER_CFG80211 )
+		{
+			pwfd_info->wfd_device_type = ( u8 ) get_int_from_command( priv_cmd.buf );
+
+			pwfd_info->wfd_device_type &= WFD_DEVINFO_DUAL;
+		}
+		break;
+	}
+#endif
+	default:
+		DBG_871X("Unknown PRIVATE command %s - ignored\n", command);
+		snprintf(command, 3, "OK");
+		bytes_written = strlen("OK");
+	}
+
+response:
+	if (bytes_written >= 0) {
+		if ((bytes_written == 0) && (priv_cmd.total_len > 0))
+			command[0] = '\0';
+		if (bytes_written >= priv_cmd.total_len) {
+			DBG_871X("%s: bytes_written = %d\n", __FUNCTION__, bytes_written);
+			bytes_written = priv_cmd.total_len;
+		} else {
+			bytes_written++;
+		}
+		priv_cmd.used_len = bytes_written;
+		if (copy_to_user((void *)priv_cmd.buf, command, bytes_written)) {
+			DBG_871X("%s: failed to copy data to user buffer\n", __FUNCTION__);
+			ret = -EFAULT;
+		}
+	}
+	else {
+		ret = bytes_written;
+	}
+
+exit:
+	rtw_unlock_suspend();
+	if (command) {
+		rtw_mfree(command, priv_cmd.total_len);
+	}
+
+	return ret;
+}
+
+
+/**
+ * Functions for Android WiFi card detection
+ */
+#if defined(RTW_ENABLE_WIFI_CONTROL_FUNC)
+
+static int g_wifidev_registered = 0;
+static struct semaphore wifi_control_sem;
+static struct wifi_platform_data *wifi_control_data = NULL;
+static struct resource *wifi_irqres = NULL;
+
+static int wifi_add_dev(void);
+static void wifi_del_dev(void);
+
+int rtw_android_wifictrl_func_add(void)
+{
+	int ret = 0;
+	sema_init(&wifi_control_sem, 0);
+
+	ret = wifi_add_dev();
+	if (ret) {
+		DBG_871X("%s: platform_driver_register failed\n", __FUNCTION__);
+		return ret;
+	}
+	g_wifidev_registered = 1;
+
+	/* Waiting callback after platform_driver_register is done or exit with error */
+	if (down_timeout(&wifi_control_sem,  msecs_to_jiffies(1000)) != 0) {
+		ret = -EINVAL;
+		DBG_871X("%s: platform_driver_register timeout\n", __FUNCTION__);
+	}
+
+	return ret;
+}
+
+void rtw_android_wifictrl_func_del(void)
+{
+	if (g_wifidev_registered)
+	{
+		wifi_del_dev();
+		g_wifidev_registered = 0;
+	}
+}
+
+void *wl_android_prealloc(int section, unsigned long size)
+{
+	void *alloc_ptr = NULL;
+	if (wifi_control_data && wifi_control_data->mem_prealloc) {
+		alloc_ptr = wifi_control_data->mem_prealloc(section, size);
+		if (alloc_ptr) {
+			DBG_871X("success alloc section %d\n", section);
+			if (size != 0L)
+				memset(alloc_ptr, 0, size);
+			return alloc_ptr;
+		}
+	}
+
+	DBG_871X("can't alloc section %d\n", section);
+	return NULL;
+}
+
+int wifi_get_irq_number(unsigned long *irq_flags_ptr)
+{
+	if (wifi_irqres) {
+		*irq_flags_ptr = wifi_irqres->flags & IRQF_TRIGGER_MASK;
+		return (int)wifi_irqres->start;
+	}
+#ifdef CUSTOM_OOB_GPIO_NUM
+	return CUSTOM_OOB_GPIO_NUM;
+#else
+	return -1;
+#endif
+}
+
+int wifi_set_power(int on, unsigned long msec)
+{
+	DBG_871X("%s = %d\n", __FUNCTION__, on);
+	if (wifi_control_data && wifi_control_data->set_power) {
+		wifi_control_data->set_power(on);
+	}
+	if (msec)
+		msleep(msec);
+	return 0;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35))
+int wifi_get_mac_addr(unsigned char *buf)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+	if (!buf)
+		return -EINVAL;
+	if (wifi_control_data && wifi_control_data->get_mac_addr) {
+		return wifi_control_data->get_mac_addr(buf);
+	}
+	return -EOPNOTSUPP;
+}
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)) || defined(COMPAT_KERNEL_RELEASE)
+void *wifi_get_country_code(char *ccode)
+{
+	DBG_871X("%s\n", __FUNCTION__);
+	if (!ccode)
+		return NULL;
+	if (wifi_control_data && wifi_control_data->get_country_code) {
+		return wifi_control_data->get_country_code(ccode);
+	}
+	return NULL;
+}
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)) */
+
+static int wifi_set_carddetect(int on)
+{
+	DBG_871X("%s = %d\n", __FUNCTION__, on);
+	if (wifi_control_data && wifi_control_data->set_carddetect) {
+		wifi_control_data->set_carddetect(on);
+	}
+	return 0;
+}
+
+static int wifi_probe(struct platform_device *pdev)
+{
+	struct wifi_platform_data *wifi_ctrl =
+		(struct wifi_platform_data *)(pdev->dev.platform_data);
+
+	DBG_871X("## %s\n", __FUNCTION__);
+	wifi_irqres = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "bcmdhd_wlan_irq");
+	if (wifi_irqres == NULL)
+		wifi_irqres = platform_get_resource_byname(pdev,
+			IORESOURCE_IRQ, "bcm4329_wlan_irq");
+	wifi_control_data = wifi_ctrl;
+
+	wifi_set_power(1, 0);	/* Power On */
+	wifi_set_carddetect(1);	/* CardDetect (0->1) */
+
+	up(&wifi_control_sem);
+	return 0;
+}
+
+static int wifi_remove(struct platform_device *pdev)
+{
+	struct wifi_platform_data *wifi_ctrl =
+		(struct wifi_platform_data *)(pdev->dev.platform_data);
+
+	DBG_871X("## %s\n", __FUNCTION__);
+	wifi_control_data = wifi_ctrl;
+
+	wifi_set_power(0, 0);	/* Power Off */
+	wifi_set_carddetect(0);	/* CardDetect (1->0) */
+
+	up(&wifi_control_sem);
+	return 0;
+}
+
+static int wifi_suspend(struct platform_device *pdev, pm_message_t state)
+{
+	DBG_871X("##> %s\n", __FUNCTION__);
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 39)) && defined(OOB_INTR_ONLY)
+	bcmsdh_oob_intr_set(0);
+#endif
+	return 0;
+}
+
+static int wifi_resume(struct platform_device *pdev)
+{
+	DBG_871X("##> %s\n", __FUNCTION__);
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 39)) && defined(OOB_INTR_ONLY)
+	if (dhd_os_check_if_up(bcmsdh_get_drvdata()))
+		bcmsdh_oob_intr_set(1);
+#endif
+	return 0;
+}
+
+/* temporarily use these two */
+static struct platform_driver wifi_device = {
+	.probe          = wifi_probe,
+	.remove         = wifi_remove,
+	.suspend        = wifi_suspend,
+	.resume         = wifi_resume,
+	.driver         = {
+	.name   = "bcmdhd_wlan",
+	}
+};
+
+static struct platform_driver wifi_device_legacy = {
+	.probe          = wifi_probe,
+	.remove         = wifi_remove,
+	.suspend        = wifi_suspend,
+	.resume         = wifi_resume,
+	.driver         = {
+	.name   = "bcm4329_wlan",
+	}
+};
+
+static int wifi_add_dev(void)
+{
+	DBG_871X("## Calling platform_driver_register\n");
+	platform_driver_register(&wifi_device);
+	platform_driver_register(&wifi_device_legacy);
+	return 0;
+}
+
+static void wifi_del_dev(void)
+{
+	DBG_871X("## Unregister platform_driver_register\n");
+	platform_driver_unregister(&wifi_device);
+	platform_driver_unregister(&wifi_device_legacy);
+}
+#endif /* defined(RTW_ENABLE_WIFI_CONTROL_FUNC) */
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/usb_intf.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/usb_intf.c
new file mode 100644
index 000000000000..be72304d0a07
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/usb_intf.c
@@ -0,0 +1,1660 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _HCI_INTF_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#include <xmit_osdep.h>
+#include <hal_intf.h>
+#include <rtw_version.h>
+
+#ifndef CONFIG_USB_HCI
+
+#error "CONFIG_USB_HCI shall be on!\n"
+
+#endif
+
+#include <usb_vendor_req.h>
+#include <usb_ops.h>
+#include <usb_osintf.h>
+#include <usb_hal.h>
+#ifdef CONFIG_PLATFORM_RTK_DMP
+#include <asm/io.h>
+#endif
+
+#if defined (PLATFORM_LINUX) && defined (PLATFORM_WINDOWS)
+
+#error "Shall be Linux or Windows, but not both!\n"
+
+#endif
+
+#ifdef CONFIG_80211N_HT
+extern int rtw_ht_enable;
+extern int rtw_cbw40_enable;
+extern int rtw_ampdu_enable;//for enable tx_ampdu
+#endif
+
+#ifdef CONFIG_GLOBAL_UI_PID
+int ui_pid[3] = {0, 0, 0};
+#endif
+
+
+extern int pm_netdev_open(struct net_device *pnetdev,u8 bnormal);
+static int rtw_suspend(struct usb_interface *intf, pm_message_t message);
+static int rtw_resume(struct usb_interface *intf);
+int rtw_resume_process(_adapter *padapter);
+
+
+static int rtw_drv_init(struct usb_interface *pusb_intf,const struct usb_device_id *pdid);
+static void rtw_dev_remove(struct usb_interface *pusb_intf);
+
+#define USB_VENDER_ID_REALTEK		0x0BDA
+
+/* DID_USB_v915_20121224 */
+#define RTL8192C_USB_IDS \
+	/*=== Realtek demoboard ===*/ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8191)},/* Default ID */ \
+	/****** 8188CUS ********/ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8176)},/* 8188cu 1*1 dongole */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8170)},/* 8188CE-VAU USB minCard */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817E)},/* 8188CE-VAU USB minCard */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817A)},/* 8188cu Slim Solo */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817B)},/* 8188cu Slim Combo */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817D)},/* 8188RU High-power USB Dongle */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8754)},/* 8188 Combo for BC4 */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817F)},/* 8188RU */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x818A)},/* RTL8188CUS-VL */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x018A)},/* RTL8188CTV */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x17C0)}, /* RTK demoboard - USB-N10E */ \
+	/****** 8192CUS ********/ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8177)},/* 8191cu 1*2 */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8178)},/* 8192cu 2*2 */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817C)},/* 8192CE-VAU USB minCard */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8191)},/* 8192CU 2*2 */ \
+	{USB_DEVICE(0x1058, 0x0631)},/* Alpha, 8192CU */ \
+	/*=== Customer ID ===*/	 \
+	/****** 8188CUS Dongle ********/ \
+	{USB_DEVICE(0x2019, 0xED17)},/* PCI - Edimax */ \
+	{USB_DEVICE(0x0DF6, 0x0052)},/* Sitecom - Edimax */ \
+	{USB_DEVICE(0x7392, 0x7811)},/* Edimax - Edimax */ \
+	{USB_DEVICE(0x07B8, 0x8189)},/* Abocom - Abocom */ \
+	{USB_DEVICE(0x0EB0, 0x9071)},/* NO Brand - Etop */ \
+	{USB_DEVICE(0x06F8, 0xE033)},/* Hercules - Edimax */ \
+	{USB_DEVICE(0x103C, 0x1629)},/* HP - Lite-On ,8188CUS Slim Combo */ \
+	{USB_DEVICE(0x2001, 0x3308)},/* D-Link - Alpha */ \
+	{USB_DEVICE(0x050D, 0x1102)},/* Belkin - Edimax */ \
+	{USB_DEVICE(0x050D, 0x11F2)},/* ISY - Edimax */ \
+	{USB_DEVICE(0x2019, 0xAB2A)},/* Planex - Abocom */ \
+	{USB_DEVICE(0x20F4, 0x648B)},/* TRENDnet - Cameo */ \
+	{USB_DEVICE(0x4855, 0x0090)},/*  - Feixun */ \
+	{USB_DEVICE(0x13D3, 0x3357)},/*  - AzureWave */ \
+	{USB_DEVICE(0x0DF6, 0x005C)},/* Sitecom - Edimax */ \
+	{USB_DEVICE(0x0BDA, 0x5088)},/* Thinkware - CC&C */ \
+	{USB_DEVICE(0x4856, 0x0091)},/* NetweeN - Feixun */ \
+	{USB_DEVICE(0x0846, 0x9041)}, /* Netgear - Cameo */ \
+	{USB_DEVICE(0x0846, 0x9042)}, /* On Networks - N150MA */ \
+	{USB_DEVICE(0x0846, 0x9043)}, /* Netgear N150 -WNA1000M */ \
+	{USB_DEVICE(0x2019, 0x4902)},/* Planex - Etop */ \
+	{USB_DEVICE(0x2019, 0xAB2E)},/* SW-WF02-AD15 -Abocom */ \
+	{USB_DEVICE(0x2001, 0x330B)}, /* D-LINK - T&W */ \
+	{USB_DEVICE(0xCDAB, 0x8010)}, /* - - compare */ \
+	{USB_DEVICE(0x0B05, 0x17BA)}, /* ASUS - Edimax */ \
+	{USB_DEVICE(0x0BDA, 0x1E1E)}, /* Intel - - */ \
+	{USB_DEVICE(0x04BB, 0x094c)}, /* I-O DATA - Edimax */ \
+	{USB_DEVICE(0X0BDA, 0x8176)}, /* TP-Link TL-WN723N */ \
+	/****** 8188CTV ********/ \
+	{USB_DEVICE(0xCDAB, 0x8011)}, /* - - compare */ \
+	{USB_DEVICE(0x0BDA, 0x0A8A)}, /* Sony - Foxconn */ \
+	/****** 8188 RU ********/ \
+	{USB_DEVICE(0x0BDA, 0x317F)},/* Netcore,Netcore */ \
+	/****** 8188CE-VAU ********/ \
+	{USB_DEVICE(0x13D3, 0x3359)},/*  - Azwave */ \
+	{USB_DEVICE(0x13D3, 0x3358)},/*  - Azwave */ \
+	/****** 8188CUS Slim Solo********/ \
+	{USB_DEVICE(0x04F2, 0xAFF7)},/* XAVI - XAVI */ \
+	{USB_DEVICE(0x04F2, 0xAFF9)},/* XAVI - XAVI */ \
+	{USB_DEVICE(0x04F2, 0xAFFA)},/* XAVI - XAVI */ \
+	/****** 8188CUS Slim Combo ********/ \
+	{USB_DEVICE(0x04F2, 0xAFF8)},/* XAVI - XAVI */ \
+	{USB_DEVICE(0x04F2, 0xAFFB)},/* XAVI - XAVI */ \
+	{USB_DEVICE(0x04F2, 0xAFFC)},/* XAVI - XAVI */ \
+	{USB_DEVICE(0x2019, 0x1201)},/* Planex - Vencer */ \
+	/****** 8192CUS Dongle ********/ \
+	{USB_DEVICE(0x2001, 0x3307)},/* D-Link - Cameo */ \
+	{USB_DEVICE(0x2001, 0x330A)},/* D-Link - Alpha */ \
+	{USB_DEVICE(0x2001, 0x3309)},/* D-Link - Alpha */ \
+	{USB_DEVICE(0x2001, 0x330D)},/* D-Link - DWA 131 */ \
+	{USB_DEVICE(0x0586, 0x341F)},/* Zyxel - Abocom */ \
+	{USB_DEVICE(0x7392, 0x7822)},/* Edimax - Edimax */ \
+	{USB_DEVICE(0x2019, 0xAB2B)},/* Planex - Abocom */ \
+	{USB_DEVICE(0x07B8, 0x8178)},/* Abocom - Abocom */ \
+	{USB_DEVICE(0x07AA, 0x0056)},/* ATKK - Gemtek */ \
+	{USB_DEVICE(0x4855, 0x0091)},/*  - Feixun */ \
+	{USB_DEVICE(0x050D, 0x2102)},/* Belkin - Sercomm */ \
+	{USB_DEVICE(0x050D, 0x2103)},/* Belkin - Edimax */ \
+	{USB_DEVICE(0x20F4, 0x624D)},/* TRENDnet */ \
+	{USB_DEVICE(0x0DF6, 0x0061)},/* Sitecom - Edimax */ \
+	{USB_DEVICE(0x0B05, 0x17AB)},/* ASUS - Edimax */ \
+	{USB_DEVICE(0x0846, 0x9021)},/* Netgear - Sercomm */ \
+	{USB_DEVICE(0x0846, 0xF001)}, /* Netgear - Sercomm */ \
+	{USB_DEVICE(0x0E66, 0x0019)},/* Hawking,Edimax */ \
+	{USB_DEVICE(0x0E66, 0x0020)}, /* Hawking  - Edimax */ \
+	{USB_DEVICE(0x050D, 0x1004)}, /* Belkin - Edimax */ \
+	{USB_DEVICE(0x0BDA, 0x2E2E)}, /* Intel - - */ \
+	{USB_DEVICE(0x2357, 0x0100)}, /* TP-Link - TP-Link */ \
+	{USB_DEVICE(0x06F8, 0xE035)}, /* Hercules - Edimax */ \
+	{USB_DEVICE(0x04BB, 0x0950)}, /* IO-DATA - Edimax */ \
+	{USB_DEVICE(0x0DF6, 0x0070)}, /* Sitecom - Edimax */ \
+	{USB_DEVICE(0x0789, 0x016D)}, /* LOGITEC - Edimax */ \
+	/****** 8192CE-VAU  ********/ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8186)},/* Intel-Xavi( Azwave) */
+
+#define RTL8192D_USB_IDS \
+	/*=== Realtek demoboard ===*/ \
+	/****** 8192DU ********/ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8193)},/* 8192DU-VC */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8194)},/* 8192DU-VS */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8111)},/* Realtek 5G dongle for WiFi Display */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x0193)},/* 8192DE-VAU */ \
+	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8171)},/* 8192DU-VC */ \
+	/*=== Customer ID ===*/ \
+	/****** 8192DU-VC ********/ \
+	{USB_DEVICE(0x2019, 0xAB2C)},/* PCI - Abocm */ \
+	{USB_DEVICE(0x2019, 0x4903)},/* PCI - ETOP */ \
+	{USB_DEVICE(0x2019, 0x4904)},/* PCI - ETOP */ \
+	{USB_DEVICE(0x07B8, 0x8193)},/* Abocom - Abocom */ \
+	/****** 8192DU-VS ********/ \
+	{USB_DEVICE(0x20F4, 0x664B)}, /* TRENDnet - Cameo */ \
+	{USB_DEVICE(0x04DD, 0x954F)},  /* Sharp */ \
+	{USB_DEVICE(0x04DD, 0x96A6)},  /* Sharp */ \
+	{USB_DEVICE(0x050D, 0x110A)}, /* Belkin - Edimax */ \
+	{USB_DEVICE(0x050D, 0x1105)}, /* Belkin - Edimax */ \
+	{USB_DEVICE(0x050D, 0x120A)}, /* Belkin - Edimax */ \
+	{USB_DEVICE(0x1668, 0x8102)}, /*  -  */ \
+	{USB_DEVICE(0x0BDA, 0xE194)}, /*  - Edimax */ \
+	/****** 8192DU-WiFi Display Dongle ********/ \
+	{USB_DEVICE(0x2019, 0xAB2D)},/* Planex - Abocom ,5G dongle for WiFi Display */
+
+#ifndef CONFIG_RTL8192C
+	#undef RTL8192C_USB_IDS
+	#define RTL8192C_USB_IDS
+#endif
+#ifndef CONFIG_RTL8192D
+	#undef RTL8192D_USB_IDS
+	#define RTL8192D_USB_IDS
+#endif
+
+
+static struct usb_device_id rtw_usb_id_tbl[] ={
+	RTL8192C_USB_IDS
+	RTL8192D_USB_IDS
+	{}	/* Terminating entry */
+};
+MODULE_DEVICE_TABLE(usb, rtw_usb_id_tbl);
+
+int const rtw_usb_id_len = sizeof(rtw_usb_id_tbl) / sizeof(struct usb_device_id);
+
+static struct specific_device_id specific_device_id_tbl[] = {
+	{.idVendor=USB_VENDER_ID_REALTEK, .idProduct=0x8177, .flags=SPEC_DEV_ID_DISABLE_HT},//8188cu 1*1 dongole, (b/g mode only)
+	{.idVendor=USB_VENDER_ID_REALTEK, .idProduct=0x817E, .flags=SPEC_DEV_ID_DISABLE_HT},//8188CE-VAU USB minCard (b/g mode only)
+	{.idVendor=0x0b05, .idProduct=0x1791, .flags=SPEC_DEV_ID_DISABLE_HT},
+	{.idVendor=0x13D3, .idProduct=0x3311, .flags=SPEC_DEV_ID_DISABLE_HT},
+	{.idVendor=0x13D3, .idProduct=0x3359, .flags=SPEC_DEV_ID_DISABLE_HT},//Russian customer -Azwave (8188CE-VAU  g mode)
+#ifdef RTK_DMP_PLATFORM
+	{.idVendor=USB_VENDER_ID_REALTEK, .idProduct=0x8111, .flags=SPEC_DEV_ID_ASSIGN_IFNAME}, // Realtek 5G dongle for WiFi Display
+	{.idVendor=0x2019, .idProduct=0xAB2D, .flags=SPEC_DEV_ID_ASSIGN_IFNAME}, // PCI-Abocom 5G dongle for WiFi Display
+#endif /* RTK_DMP_PLATFORM */
+	{}
+};
+
+struct rtw_usb_drv {
+	struct usb_driver usbdrv;
+	int drv_registered;
+};
+
+static void rtw_dev_shutdown(struct device *dev)
+{
+	struct usb_interface *usb_intf = container_of(dev, struct usb_interface, dev);
+	struct dvobj_priv *dvobj = usb_get_intfdata(usb_intf);
+	_adapter *adapter = dvobj->if1;
+	int i;
+
+	DBG_871X("%s\n", __func__);
+
+	for (i = 0; i<dvobj->iface_nums; i++) {
+		adapter = dvobj->padapters[i];
+		adapter->bSurpriseRemoved = _TRUE;
+	}
+
+	ATOMIC_SET(&dvobj->continual_urb_error, MAX_CONTINUAL_URB_ERR+1);
+}
+
+#ifdef CONFIG_RTL8192C
+static struct usb_device_id rtl8192c_usb_id_tbl[] ={
+	RTL8192C_USB_IDS
+	{}	/* Terminating entry */
+};
+
+struct rtw_usb_drv rtl8192c_usb_drv = {
+	.usbdrv.name = (char*)"rtl8192cu",
+	.usbdrv.probe = rtw_drv_init,
+	.usbdrv.disconnect = rtw_dev_remove,
+	.usbdrv.id_table = rtl8192c_usb_id_tbl,
+	.usbdrv.suspend =  rtw_suspend,
+	.usbdrv.resume = rtw_resume,
+	#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 22))
+	.usbdrv.reset_resume   = rtw_resume,
+	#endif
+	#ifdef CONFIG_AUTOSUSPEND
+	.usbdrv.supports_autosuspend = 1,
+	#endif
+
+	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19))
+	.usbdrv.drvwrap.driver.shutdown = rtw_dev_shutdown,
+	#else
+	.usbdrv.driver.shutdown = rtw_dev_shutdown,
+	#endif
+};
+
+static struct rtw_usb_drv *usb_drv = &rtl8192c_usb_drv;
+#endif /* CONFIG_RTL8192C */
+
+#ifdef CONFIG_RTL8192D
+static struct usb_device_id rtl8192d_usb_id_tbl[] ={
+	RTL8192D_USB_IDS
+	{}	/* Terminating entry */
+};
+
+struct rtw_usb_drv rtl8192d_usb_drv = {
+	.usbdrv.name = (char*)"rtl8192du",
+	.usbdrv.probe = rtw_drv_init,
+	.usbdrv.disconnect = rtw_dev_remove,
+	.usbdrv.id_table = rtl8192d_usb_id_tbl,
+	.usbdrv.suspend =  rtw_suspend,
+	.usbdrv.resume = rtw_resume,
+	#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 22))
+	.usbdrv.reset_resume   = rtw_resume,
+	#endif
+	#ifdef CONFIG_AUTOSUSPEND
+	.usbdrv.supports_autosuspend = 1,
+	#endif
+
+	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19))
+	.usbdrv.drvwrap.driver.shutdown = rtw_dev_shutdown,
+	#else
+	.usbdrv.driver.shutdown = rtw_dev_shutdown,
+	#endif
+};
+static struct rtw_usb_drv *usb_drv = &rtl8192d_usb_drv;
+#endif /* CONFIG_RTL8192D */
+
+static inline int RT_usb_endpoint_dir_in(const struct usb_endpoint_descriptor *epd)
+{
+	return ((epd->bEndpointAddress & USB_ENDPOINT_DIR_MASK) == USB_DIR_IN);
+}
+
+static inline int RT_usb_endpoint_dir_out(const struct usb_endpoint_descriptor *epd)
+{
+	return ((epd->bEndpointAddress & USB_ENDPOINT_DIR_MASK) == USB_DIR_OUT);
+}
+
+static inline int RT_usb_endpoint_xfer_int(const struct usb_endpoint_descriptor *epd)
+{
+	return ((epd->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) == USB_ENDPOINT_XFER_INT);
+}
+
+static inline int RT_usb_endpoint_xfer_bulk(const struct usb_endpoint_descriptor *epd)
+{
+	return ((epd->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) == USB_ENDPOINT_XFER_BULK);
+}
+
+static inline int RT_usb_endpoint_is_bulk_in(const struct usb_endpoint_descriptor *epd)
+{
+	return (RT_usb_endpoint_xfer_bulk(epd) && RT_usb_endpoint_dir_in(epd));
+}
+
+static inline int RT_usb_endpoint_is_bulk_out(const struct usb_endpoint_descriptor *epd)
+{
+	return (RT_usb_endpoint_xfer_bulk(epd) && RT_usb_endpoint_dir_out(epd));
+}
+
+static inline int RT_usb_endpoint_is_int_in(const struct usb_endpoint_descriptor *epd)
+{
+	return (RT_usb_endpoint_xfer_int(epd) && RT_usb_endpoint_dir_in(epd));
+}
+
+static inline int RT_usb_endpoint_num(const struct usb_endpoint_descriptor *epd)
+{
+	return epd->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
+}
+
+static u8 rtw_init_intf_priv(struct dvobj_priv *dvobj)
+{
+	u8 rst = _SUCCESS;
+
+	#ifdef CONFIG_USB_VENDOR_REQ_MUTEX
+	_rtw_mutex_init(&dvobj->usb_vendor_req_mutex);
+	#endif
+
+
+	#ifdef CONFIG_USB_VENDOR_REQ_BUFFER_PREALLOC
+	dvobj->usb_alloc_vendor_req_buf = rtw_zmalloc(MAX_USB_IO_CTL_SIZE);
+	if (dvobj->usb_alloc_vendor_req_buf == NULL) {
+		DBG_871X("alloc usb_vendor_req_buf failed... /n");
+		rst = _FAIL;
+		goto exit;
+	}
+	dvobj->usb_vendor_req_buf  =
+		(u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(dvobj->usb_alloc_vendor_req_buf ), ALIGNMENT_UNIT);
+exit:
+	#endif
+
+	return rst;
+
+}
+
+static u8 rtw_deinit_intf_priv(struct dvobj_priv *dvobj)
+{
+	u8 rst = _SUCCESS;
+
+	#ifdef CONFIG_USB_VENDOR_REQ_BUFFER_PREALLOC
+	if(dvobj->usb_vendor_req_buf)
+		rtw_mfree(dvobj->usb_alloc_vendor_req_buf, MAX_USB_IO_CTL_SIZE);
+	#endif
+
+	#ifdef CONFIG_USB_VENDOR_REQ_MUTEX
+	_rtw_mutex_free(&dvobj->usb_vendor_req_mutex);
+	#endif
+
+	return rst;
+}
+
+static struct dvobj_priv *usb_dvobj_init(struct usb_interface *usb_intf)
+{
+	int	i;
+	u8	val8;
+	int	status = _FAIL;
+	struct dvobj_priv *pdvobjpriv = NULL;
+	struct usb_device				*pusbd;
+	struct usb_device_descriptor 	*pdev_desc;
+	struct usb_host_config			*phost_conf;
+	struct usb_config_descriptor		*pconf_desc;
+	struct usb_host_interface		*phost_iface;
+	struct usb_interface_descriptor	*piface_desc;
+	struct usb_host_endpoint		*phost_endp;
+	struct usb_endpoint_descriptor	*pendp_desc;
+
+_func_enter_;
+
+	if((pdvobjpriv = devobj_init()) == NULL) {
+		goto exit;
+	}
+
+	pdvobjpriv->pusbintf = usb_intf ;
+	pusbd = pdvobjpriv->pusbdev = interface_to_usbdev(usb_intf);
+	usb_set_intfdata(usb_intf, pdvobjpriv);
+
+	pdvobjpriv->RtNumInPipes = 0;
+	pdvobjpriv->RtNumOutPipes = 0;
+
+
+	pdev_desc = &pusbd->descriptor;
+#if 0
+	DBG_871X("\n8712_usb_device_descriptor:\n");
+	DBG_871X("bLength=%x\n", pdev_desc->bLength);
+	DBG_871X("bDescriptorType=%x\n", pdev_desc->bDescriptorType);
+	DBG_871X("bcdUSB=%x\n", pdev_desc->bcdUSB);
+	DBG_871X("bDeviceClass=%x\n", pdev_desc->bDeviceClass);
+	DBG_871X("bDeviceSubClass=%x\n", pdev_desc->bDeviceSubClass);
+	DBG_871X("bDeviceProtocol=%x\n", pdev_desc->bDeviceProtocol);
+	DBG_871X("bMaxPacketSize0=%x\n", pdev_desc->bMaxPacketSize0);
+	DBG_871X("idVendor=%x\n", pdev_desc->idVendor);
+	DBG_871X("idProduct=%x\n", pdev_desc->idProduct);
+	DBG_871X("bcdDevice=%x\n", pdev_desc->bcdDevice);
+	DBG_871X("iManufacturer=%x\n", pdev_desc->iManufacturer);
+	DBG_871X("iProduct=%x\n", pdev_desc->iProduct);
+	DBG_871X("iSerialNumber=%x\n", pdev_desc->iSerialNumber);
+	DBG_871X("bNumConfigurations=%x\n", pdev_desc->bNumConfigurations);
+#endif
+
+	phost_conf = pusbd->actconfig;
+	pconf_desc = &phost_conf->desc;
+
+#if 0
+	DBG_871X("\n8712_usb_configuration_descriptor:\n");
+	DBG_871X("bLength=%x\n", pconf_desc->bLength);
+	DBG_871X("bDescriptorType=%x\n", pconf_desc->bDescriptorType);
+	DBG_871X("wTotalLength=%x\n", pconf_desc->wTotalLength);
+	DBG_871X("bNumInterfaces=%x\n", pconf_desc->bNumInterfaces);
+	DBG_871X("bConfigurationValue=%x\n", pconf_desc->bConfigurationValue);
+	DBG_871X("iConfiguration=%x\n", pconf_desc->iConfiguration);
+	DBG_871X("bmAttributes=%x\n", pconf_desc->bmAttributes);
+	DBG_871X("bMaxPower=%x\n", pconf_desc->bMaxPower);
+#endif
+
+	//DBG_871X("\n/****** num of altsetting = (%d) ******/\n", usb_intf->num_altsetting);
+
+	phost_iface = &usb_intf->altsetting[0];
+	piface_desc = &phost_iface->desc;
+
+#if 0
+	DBG_871X("\n8712_usb_interface_descriptor:\n");
+	DBG_871X("bLength=%x\n", piface_desc->bLength);
+	DBG_871X("bDescriptorType=%x\n", piface_desc->bDescriptorType);
+	DBG_871X("bInterfaceNumber=%x\n", piface_desc->bInterfaceNumber);
+	DBG_871X("bAlternateSetting=%x\n", piface_desc->bAlternateSetting);
+	DBG_871X("bNumEndpoints=%x\n", piface_desc->bNumEndpoints);
+	DBG_871X("bInterfaceClass=%x\n", piface_desc->bInterfaceClass);
+	DBG_871X("bInterfaceSubClass=%x\n", piface_desc->bInterfaceSubClass);
+	DBG_871X("bInterfaceProtocol=%x\n", piface_desc->bInterfaceProtocol);
+	DBG_871X("iInterface=%x\n", piface_desc->iInterface);
+#endif
+
+	pdvobjpriv->NumInterfaces = pconf_desc->bNumInterfaces;
+	pdvobjpriv->InterfaceNumber = piface_desc->bInterfaceNumber;
+	pdvobjpriv->nr_endpoint = piface_desc->bNumEndpoints;
+
+	//DBG_871X("\ndump usb_endpoint_descriptor:\n");
+
+	for (i = 0; i < pdvobjpriv->nr_endpoint; i++)
+	{
+		phost_endp = phost_iface->endpoint + i;
+		if (phost_endp)
+		{
+			pendp_desc = &phost_endp->desc;
+
+			DBG_871X("\nusb_endpoint_descriptor(%d):\n", i);
+			DBG_871X("bLength=%x\n",pendp_desc->bLength);
+			DBG_871X("bDescriptorType=%x\n",pendp_desc->bDescriptorType);
+			DBG_871X("bEndpointAddress=%x\n",pendp_desc->bEndpointAddress);
+			//DBG_871X("bmAttributes=%x\n",pendp_desc->bmAttributes);
+			//DBG_871X("wMaxPacketSize=%x\n",pendp_desc->wMaxPacketSize);
+			DBG_871X("wMaxPacketSize=%x\n",le16_to_cpu(pendp_desc->wMaxPacketSize));
+			DBG_871X("bInterval=%x\n",pendp_desc->bInterval);
+			//DBG_871X("bRefresh=%x\n",pendp_desc->bRefresh);
+			//DBG_871X("bSynchAddress=%x\n",pendp_desc->bSynchAddress);
+
+			if (RT_usb_endpoint_is_bulk_in(pendp_desc))
+			{
+				DBG_871X("RT_usb_endpoint_is_bulk_in = %x\n", RT_usb_endpoint_num(pendp_desc));
+				pdvobjpriv->RtNumInPipes++;
+			}
+			else if (RT_usb_endpoint_is_int_in(pendp_desc))
+			{
+				DBG_871X("RT_usb_endpoint_is_int_in = %x, Interval = %x\n", RT_usb_endpoint_num(pendp_desc),pendp_desc->bInterval);
+				pdvobjpriv->RtNumInPipes++;
+			}
+			else if (RT_usb_endpoint_is_bulk_out(pendp_desc))
+			{
+				DBG_871X("RT_usb_endpoint_is_bulk_out = %x\n", RT_usb_endpoint_num(pendp_desc));
+				pdvobjpriv->RtNumOutPipes++;
+			}
+			pdvobjpriv->ep_num[i] = RT_usb_endpoint_num(pendp_desc);
+		}
+	}
+
+	DBG_871X("nr_endpoint=%d, in_num=%d, out_num=%d\n\n", pdvobjpriv->nr_endpoint, pdvobjpriv->RtNumInPipes, pdvobjpriv->RtNumOutPipes);
+
+	if (pusbd->speed == USB_SPEED_HIGH) {
+		pdvobjpriv->ishighspeed = _TRUE;
+		DBG_871X("USB_SPEED_HIGH\n");
+	} else {
+		pdvobjpriv->ishighspeed = _FALSE;
+		DBG_871X("NON USB_SPEED_HIGH\n");
+	}
+
+	if (rtw_init_intf_priv(pdvobjpriv) == _FAIL) {
+		RT_TRACE(_module_os_intfs_c_,_drv_err_,("\n Can't INIT rtw_init_intf_priv\n"));
+		goto free_dvobj;
+	}
+
+	//.3 misc
+	_rtw_init_sema(&(pdvobjpriv->usb_suspend_sema), 0);
+
+	rtw_reset_continual_urb_error(pdvobjpriv);
+
+	usb_get_dev(pusbd);
+
+	//DBG_871X("%s %d\n", __func__, ATOMIC_READ(&usb_intf->dev.kobj.kref.refcount));
+
+	status = _SUCCESS;
+
+free_dvobj:
+	if (status != _SUCCESS && pdvobjpriv) {
+		usb_set_intfdata(usb_intf, NULL);
+		devobj_deinit(pdvobjpriv);
+		pdvobjpriv = NULL;
+	}
+exit:
+_func_exit_;
+	return pdvobjpriv;
+}
+
+static void usb_dvobj_deinit(struct usb_interface *usb_intf)
+{
+	struct dvobj_priv *dvobj = usb_get_intfdata(usb_intf);
+
+_func_enter_;
+
+	usb_set_intfdata(usb_intf, NULL);
+	if (dvobj) {
+		//Modify condition for 92DU DMDP 2010.11.18, by Thomas
+		/*if ((dvobj->NumInterfaces == 1)
+			|| ((dvobj->InterfaceNumber == 1) && (dvobj->DualMacMode == _TRUE))) {
+			if (interface_to_usbdev(usb_intf)->state != USB_STATE_NOTATTACHED) {
+				//If we didn't unplug usb dongle and remove/insert modlue, driver fails on sitesurvey for the first time when device is up .
+				//Reset usb port for sitesurvey fail issue. 2009.8.13, by Thomas
+				DBG_871X("usb attached..., try to reset usb device\n");
+				usb_reset_device(interface_to_usbdev(usb_intf));
+			}
+		}*/
+		rtw_deinit_intf_priv(dvobj);
+		devobj_deinit(dvobj);
+	}
+
+	//DBG_871X("%s %d\n", __func__, ATOMIC_READ(&usb_intf->dev.kobj.kref.refcount));
+	usb_put_dev(interface_to_usbdev(usb_intf));
+
+_func_exit_;
+}
+
+static void decide_chip_type_by_usb_device_id(_adapter *padapter, const struct usb_device_id *pdid)
+{
+	padapter->chip_type = NULL_CHIP_TYPE;
+#ifdef CONFIG_RTL8192C
+	padapter->chip_type = RTL8188C_8192C;
+	padapter->HardwareType = HARDWARE_TYPE_RTL8192CU;
+	DBG_871X("CHIP TYPE: RTL8188C_8192C\n");
+#endif
+
+#ifdef CONFIG_RTL8192D
+	padapter->chip_type = RTL8192D;
+	padapter->HardwareType = HARDWARE_TYPE_RTL8192DU;
+	DBG_871X("CHIP TYPE: RTL8192D\n");
+#endif
+}
+
+static void usb_intf_start(_adapter *padapter)
+{
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+usb_intf_start\n"));
+	rtw_hal_inirp_init(padapter);
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("-usb_intf_start\n"));
+}
+
+static void usb_intf_stop(_adapter *padapter)
+{
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+usb_intf_stop\n"));
+
+	//disabel_hw_interrupt
+	if(padapter->bSurpriseRemoved == _FALSE)
+	{
+		//device still exists, so driver can do i/o operation
+		//TODO:
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,("SurpriseRemoved==_FALSE\n"));
+	}
+
+	//cancel in irp
+	rtw_hal_inirp_deinit(padapter);
+
+	//cancel out irp
+	rtw_write_port_cancel(padapter);
+
+	//todo:cancel other irps
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("-usb_intf_stop\n"));
+
+}
+
+static void rtw_dev_unload(_adapter *padapter)
+{
+	struct net_device *pnetdev= (struct net_device*)padapter->pnetdev;
+	u8 val8;
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+rtw_dev_unload\n"));
+
+	if(padapter->bup == _TRUE)
+	{
+		DBG_871X("===> rtw_dev_unload\n");
+
+		padapter->bDriverStopped = _TRUE;
+		#ifdef CONFIG_XMIT_ACK
+		if (padapter->xmitpriv.ack_tx)
+			rtw_ack_tx_done(&padapter->xmitpriv, RTW_SCTX_DONE_DRV_STOP);
+		#endif
+
+		//s3.
+		if(padapter->intf_stop)
+		{
+			padapter->intf_stop(padapter);
+		}
+
+		//s4.
+		if(!padapter->pwrctrlpriv.bInternalAutoSuspend )
+		rtw_stop_drv_threads(padapter);
+
+
+		//s5.
+		if(padapter->bSurpriseRemoved == _FALSE)
+		{
+			//DBG_871X("r871x_dev_unload()->rtl871x_hal_deinit()\n");
+#ifdef CONFIG_WOWLAN
+			if((padapter->pwrctrlpriv.bSupportRemoteWakeup==_TRUE)&&(padapter->pwrctrlpriv.wowlan_mode==_TRUE)){
+				DBG_871X("%s bSupportWakeOnWlan==_TRUE  do not run rtw_hal_deinit()\n",__FUNCTION__);
+			}
+			else
+#endif //CONFIG_WOWLAN
+			{
+				rtw_hal_deinit(padapter);
+			}
+			padapter->bSurpriseRemoved = _TRUE;
+		}
+
+		padapter->bup = _FALSE;
+#ifdef CONFIG_WOWLAN
+		padapter->hw_init_completed=_FALSE;
+#endif //CONFIG_WOWLAN
+	}
+	else
+	{
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,("r871x_dev_unload():padapter->bup == _FALSE\n" ));
+	}
+
+	DBG_871X("<=== rtw_dev_unload\n");
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("-rtw_dev_unload\n"));
+
+}
+
+static void process_spec_devid(const struct usb_device_id *pdid)
+{
+	u16 vid, pid;
+	u32 flags;
+	int i;
+	int num = sizeof(specific_device_id_tbl)/sizeof(struct specific_device_id);
+
+	for(i=0; i<num; i++)
+	{
+		vid = specific_device_id_tbl[i].idVendor;
+		pid = specific_device_id_tbl[i].idProduct;
+		flags = specific_device_id_tbl[i].flags;
+
+#ifdef CONFIG_80211N_HT
+		if((pdid->idVendor==vid) && (pdid->idProduct==pid) && (flags&SPEC_DEV_ID_DISABLE_HT))
+		{
+			 rtw_ht_enable = 0;
+			 rtw_cbw40_enable = 0;
+			 rtw_ampdu_enable = 0;
+		}
+#endif
+
+#ifdef RTK_DMP_PLATFORM
+		// Change the ifname to wlan10 when PC side WFD dongle plugin on DMP platform.
+		// It is used to distinguish between normal and PC-side wifi dongle/module.
+		if((pdid->idVendor==vid) && (pdid->idProduct==pid) && (flags&SPEC_DEV_ID_ASSIGN_IFNAME))
+		{
+			extern char* ifname;
+			strncpy(ifname, "wlan10", 6);
+			//DBG_871X("%s()-%d: ifname=%s, vid=%04X, pid=%04X\n", __FUNCTION__, __LINE__, ifname, vid, pid);
+		}
+#endif /* RTK_DMP_PLATFORM */
+
+	}
+}
+
+#ifdef SUPPORT_HW_RFOFF_DETECTED
+int rtw_hw_suspend(_adapter *padapter )
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct usb_interface *pusb_intf = adapter_to_dvobj(padapter)->pusbintf;
+	struct net_device *pnetdev = padapter->pnetdev;
+
+	_func_enter_;
+
+	if((!padapter->bup) || (padapter->bDriverStopped)||(padapter->bSurpriseRemoved))
+	{
+		DBG_871X("padapter->bup=%d bDriverStopped=%d bSurpriseRemoved = %d\n",
+			padapter->bup, padapter->bDriverStopped,padapter->bSurpriseRemoved);
+		goto error_exit;
+	}
+
+	if(padapter)//system suspend
+	{
+		LeaveAllPowerSaveMode(padapter);
+
+		DBG_871X("==> rtw_hw_suspend\n");
+		_enter_pwrlock(&pwrpriv->lock);
+		pwrpriv->bips_processing = _TRUE;
+		//padapter->net_closed = _TRUE;
+		//s1.
+		if(pnetdev)
+		{
+			netif_carrier_off(pnetdev);
+			rtw_netif_stop_queue(pnetdev);
+		}
+
+		//s2.
+		rtw_disassoc_cmd(padapter, 500, _FALSE);
+
+		//s2-2.  indicate disconnect to os
+		//rtw_indicate_disconnect(padapter);
+		{
+			struct	mlme_priv *pmlmepriv = &padapter->mlmepriv;
+
+			if(check_fwstate(pmlmepriv, _FW_LINKED))
+			{
+				_clr_fwstate_(pmlmepriv, _FW_LINKED);
+
+				rtw_led_control(padapter, LED_CTL_NO_LINK);
+
+				rtw_os_indicate_disconnect(padapter);
+
+				#ifdef CONFIG_LPS
+				//donnot enqueue cmd
+				rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_DISCONNECT, 0);
+				#endif
+			}
+
+		}
+		//s2-3.
+		rtw_free_assoc_resources(padapter, 1);
+
+		//s2-4.
+		rtw_free_network_queue(padapter,_TRUE);
+		#ifdef CONFIG_IPS
+		rtw_ips_dev_unload(padapter);
+		#endif
+		pwrpriv->rf_pwrstate = rf_off;
+		pwrpriv->bips_processing = _FALSE;
+
+		_exit_pwrlock(&pwrpriv->lock);
+	}
+	else
+		goto error_exit;
+
+	_func_exit_;
+	return 0;
+
+error_exit:
+	DBG_871X("%s, failed \n",__FUNCTION__);
+	return (-1);
+
+}
+
+int rtw_hw_resume(_adapter *padapter)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct usb_interface *pusb_intf = adapter_to_dvobj(padapter)->pusbintf;
+	struct net_device *pnetdev = padapter->pnetdev;
+
+	_func_enter_;
+
+	if(padapter)//system resume
+	{
+		DBG_871X("==> rtw_hw_resume\n");
+		_enter_pwrlock(&pwrpriv->lock);
+		pwrpriv->bips_processing = _TRUE;
+		rtw_reset_drv_sw(padapter);
+
+		if(pm_netdev_open(pnetdev,_FALSE) != 0)
+		{
+			_exit_pwrlock(&pwrpriv->lock);
+			goto error_exit;
+		}
+
+		netif_device_attach(pnetdev);
+		netif_carrier_on(pnetdev);
+
+		if(!rtw_netif_queue_stopped(pnetdev))
+			rtw_netif_start_queue(pnetdev);
+		else
+			rtw_netif_wake_queue(pnetdev);
+
+		pwrpriv->bkeepfwalive = _FALSE;
+		pwrpriv->brfoffbyhw = _FALSE;
+
+		pwrpriv->rf_pwrstate = rf_on;
+		pwrpriv->bips_processing = _FALSE;
+
+		_exit_pwrlock(&pwrpriv->lock);
+	}
+	else
+	{
+		goto error_exit;
+	}
+
+	_func_exit_;
+
+	return 0;
+error_exit:
+	DBG_871X("%s, Open net dev failed \n",__FUNCTION__);
+	return (-1);
+}
+#endif
+
+static int rtw_suspend(struct usb_interface *pusb_intf, pm_message_t message)
+{
+	struct dvobj_priv *dvobj = usb_get_intfdata(pusb_intf);
+	_adapter *padapter = dvobj->if1;
+	struct net_device *pnetdev = padapter->pnetdev;
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct usb_device *usb_dev = interface_to_usbdev(pusb_intf);
+#ifdef CONFIG_WOWLAN
+	struct wowlan_ioctl_param poidparam;
+#endif // CONFIG_WOWLAN
+	int ret = 0;
+	u32 start_time = rtw_get_current_time();
+	_func_enter_;
+
+	DBG_871X("==> %s (%s:%d)\n",__FUNCTION__, current->comm, current->pid);
+
+	if((!padapter->bup) || (padapter->bDriverStopped)||(padapter->bSurpriseRemoved))
+	{
+		DBG_871X("padapter->bup=%d bDriverStopped=%d bSurpriseRemoved = %d\n",
+			padapter->bup, padapter->bDriverStopped,padapter->bSurpriseRemoved);
+		goto exit;
+	}
+
+	if(pwrpriv->bInternalAutoSuspend )
+	{
+	#ifdef CONFIG_AUTOSUSPEND
+	#ifdef SUPPORT_HW_RFOFF_DETECTED
+		// The FW command register update must after MAC and FW init ready.
+		if((padapter->bFWReady) && ( padapter->pwrctrlpriv.bHWPwrPindetect ) && (padapter->registrypriv.usbss_enable ))
+		{
+			u8 bOpen = _TRUE;
+			rtw_interface_ps_func(padapter,HAL_USB_SELECT_SUSPEND,&bOpen);
+			//rtl8192c_set_FwSelectSuspend_cmd(padapter,_TRUE ,500);//note fw to support hw power down ping detect
+		}
+	#endif
+	#endif
+	}
+	pwrpriv->bInSuspend = _TRUE;
+	rtw_cancel_all_timer(padapter);
+	LeaveAllPowerSaveMode(padapter);
+
+	rtw_stop_cmd_thread(padapter);
+
+	_enter_pwrlock(&pwrpriv->lock);
+	//padapter->net_closed = _TRUE;
+	//s1.
+	if(pnetdev)
+	{
+		netif_carrier_off(pnetdev);
+		rtw_netif_stop_queue(pnetdev);
+	}
+#ifdef CONFIG_WOWLAN
+	if(padapter->pwrctrlpriv.bSupportRemoteWakeup==_TRUE&&padapter->pwrctrlpriv.wowlan_mode==_TRUE){
+		u8 ps_mode=PS_MODE_MIN;
+		//set H2C command
+		poidparam.subcode=WOWLAN_ENABLE;
+		rtw_hal_set_hwreg(padapter,HW_VAR_WOWLAN,(u8 *)&poidparam);
+		//rtw_hal_set_hwreg(padapter, HW_VAR_H2C_FW_PWRMODE, &ps_mode);
+		//rtw_set_rpwm(padapter, PS_STATE_S2);
+	}
+	else
+#endif //CONFIG_WOWLAN
+	{
+		//s2.
+		rtw_disassoc_cmd(padapter, 0, _FALSE);
+	}
+
+#ifdef CONFIG_LAYER2_ROAMING_RESUME
+	if(check_fwstate(pmlmepriv, WIFI_STATION_STATE) && check_fwstate(pmlmepriv, _FW_LINKED) )
+	{
+		//printk("%s:%d assoc_ssid:%s\n", __FUNCTION__, __LINE__, pmlmepriv->assoc_ssid.Ssid);
+		DBG_871X("%s:%d %s(" MAC_FMT "), length:%d assoc_ssid.length:%d\n",__FUNCTION__, __LINE__,
+				pmlmepriv->cur_network.network.Ssid.Ssid,
+				MAC_ARG(pmlmepriv->cur_network.network.MacAddress),
+				pmlmepriv->cur_network.network.Ssid.SsidLength,
+				pmlmepriv->assoc_ssid.SsidLength);
+		rtw_set_roaming(padapter, 1);
+		}
+#endif
+	//s2-2.  indicate disconnect to os
+	rtw_indicate_disconnect(padapter);
+	//s2-3.
+	rtw_free_assoc_resources(padapter, 1);
+#ifdef CONFIG_AUTOSUSPEND
+	if(!pwrpriv->bInternalAutoSuspend )
+#endif
+	//s2-4.
+	rtw_free_network_queue(padapter, _TRUE);
+
+	rtw_dev_unload(padapter);
+#ifdef CONFIG_AUTOSUSPEND
+	pwrpriv->rf_pwrstate = rf_off;
+	pwrpriv->bips_processing = _FALSE;
+#endif
+	_exit_pwrlock(&pwrpriv->lock);
+
+	if(check_fwstate(pmlmepriv, _FW_UNDER_SURVEY))
+		rtw_indicate_scan_done(padapter, 1);
+
+	if(check_fwstate(pmlmepriv, _FW_UNDER_LINKING))
+		rtw_indicate_disconnect(padapter);
+
+exit:
+	DBG_871X("<===  %s return %d.............. in %dms\n", __FUNCTION__
+		, ret, rtw_get_passing_time_ms(start_time));
+
+	_func_exit_;
+	return ret;
+}
+
+static int rtw_resume(struct usb_interface *pusb_intf)
+{
+	struct dvobj_priv *dvobj = usb_get_intfdata(pusb_intf);
+	_adapter *padapter = dvobj->if1;
+	struct net_device *pnetdev = padapter->pnetdev;
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	 int ret = 0;
+
+	if(pwrpriv->bInternalAutoSuspend ){
+		ret = rtw_resume_process(padapter);
+	} else {
+#ifdef CONFIG_RESUME_IN_WORKQUEUE
+		rtw_resume_in_workqueue(pwrpriv);
+#else
+		if (rtw_is_earlysuspend_registered(pwrpriv)
+			#ifdef CONFIG_WOWLAN
+			&& !padapter->pwrctrlpriv.wowlan_mode
+			#endif /* CONFIG_WOWLAN */
+		) {
+			/* jeff: bypass resume here, do in late_resume */
+			rtw_set_do_late_resume(pwrpriv, _TRUE);
+		} else {
+			ret = rtw_resume_process(padapter);
+		}
+#endif /* CONFIG_RESUME_IN_WORKQUEUE */
+	}
+
+	return ret;
+
+}
+
+int rtw_resume_process(_adapter *padapter)
+{
+	struct net_device *pnetdev;
+	struct pwrctrl_priv *pwrpriv=NULL;
+	int ret = -1;
+	u32 start_time = rtw_get_current_time();
+	_func_enter_;
+
+	DBG_871X("==> %s (%s:%d)\n",__FUNCTION__, current->comm, current->pid);
+
+	if(padapter) {
+		pnetdev= padapter->pnetdev;
+		pwrpriv = &padapter->pwrctrlpriv;
+	} else {
+		goto exit;
+	}
+
+	_enter_pwrlock(&pwrpriv->lock);
+	rtw_reset_drv_sw(padapter);
+	pwrpriv->bkeepfwalive = _FALSE;
+
+	DBG_871X("bkeepfwalive(%x)\n",pwrpriv->bkeepfwalive);
+	if(pm_netdev_open(pnetdev,_TRUE) != 0) {
+		_exit_pwrlock(&pwrpriv->lock);
+		goto exit;
+	}
+
+	netif_device_attach(pnetdev);
+	netif_carrier_on(pnetdev);
+
+#ifdef CONFIG_AUTOSUSPEND
+	if(pwrpriv->bInternalAutoSuspend )
+	{
+		#ifdef CONFIG_AUTOSUSPEND
+		#ifdef SUPPORT_HW_RFOFF_DETECTED
+			// The FW command register update must after MAC and FW init ready.
+		if((padapter->bFWReady) && ( padapter->pwrctrlpriv.bHWPwrPindetect ) && (padapter->registrypriv.usbss_enable ))
+		{
+			//rtl8192c_set_FwSelectSuspend_cmd(padapter,_FALSE ,500);//note fw to support hw power down ping detect
+			u8 bOpen = _FALSE;
+			rtw_interface_ps_func(padapter,HAL_USB_SELECT_SUSPEND,&bOpen);
+		}
+		#endif
+		#endif
+
+		pwrpriv->bInternalAutoSuspend = _FALSE;
+		pwrpriv->brfoffbyhw = _FALSE;
+	}
+#endif
+	_exit_pwrlock(&pwrpriv->lock);
+
+	if( padapter->pid[1]!=0) {
+		DBG_871X("pid[1]:%d\n",padapter->pid[1]);
+		rtw_signal_process(padapter->pid[1], SIGUSR2);
+	}
+
+	#ifdef CONFIG_LAYER2_ROAMING_RESUME
+	rtw_roaming(padapter, NULL);
+	#endif
+
+	ret = 0;
+exit:
+	#ifdef CONFIG_RESUME_IN_WORKQUEUE
+	rtw_unlock_suspend();
+	#endif //CONFIG_RESUME_IN_WORKQUEUE
+
+	if (pwrpriv)
+		pwrpriv->bInSuspend = _FALSE;
+	DBG_871X("<===  %s return %d.............. in %dms\n", __FUNCTION__
+		, ret, rtw_get_passing_time_ms(start_time));
+
+	_func_exit_;
+
+	return ret;
+}
+
+#ifdef CONFIG_AUTOSUSPEND
+void autosuspend_enter(_adapter* padapter)
+{
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct dvobj_priv *dvobj = adapter_to_dvobj(padapter);
+
+	pwrpriv->bInternalAutoSuspend = _TRUE;
+	pwrpriv->bips_processing = _TRUE;
+
+	DBG_871X("==>autosuspend_enter...........\n");
+
+	if(rf_off == pwrpriv->change_rfpwrstate )
+	{
+		#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+		usb_enable_autosuspend(dvobj->pusbdev);
+		#else
+		dvobj->pusbdev->autosuspend_disabled = 0;//autosuspend disabled by the user
+		#endif
+
+		#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,33))
+			usb_autopm_put_interface(dvobj->pusbintf);
+		#elif (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,20))
+			usb_autopm_enable(dvobj->pusbintf);
+		#else
+			usb_autosuspend_device(dvobj->pusbdev, 1);
+		#endif
+	}
+	#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,32))
+	DBG_871X("...pm_usage_cnt(%d).....\n", atomic_read(&(dvobj->pusbintf->pm_usage_cnt)));
+	#else
+	DBG_871X("...pm_usage_cnt(%d).....\n", dvobj->pusbintf->pm_usage_cnt);
+	#endif
+
+}
+int autoresume_enter(_adapter* padapter)
+{
+	int result = _SUCCESS;
+	struct pwrctrl_priv *pwrpriv = &padapter->pwrctrlpriv;
+	struct security_priv* psecuritypriv=&(padapter->securitypriv);
+	struct mlme_ext_priv	*pmlmeext = &padapter->mlmeextpriv;
+	struct mlme_ext_info	*pmlmeinfo = &(pmlmeext->mlmext_info);
+	struct dvobj_priv *dvobj = adapter_to_dvobj(padapter);
+
+
+	DBG_871X("====> autoresume_enter \n");
+
+	if(rf_off == pwrpriv->rf_pwrstate )
+	{
+		pwrpriv->ps_flag = _FALSE;
+		#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,33))
+			if (usb_autopm_get_interface(dvobj->pusbintf) < 0)
+			{
+				DBG_871X( "can't get autopm: %d\n", result);
+				result = _FAIL;
+				goto error_exit;
+			}
+		#elif (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,20))
+			usb_autopm_disable(dvobj->pusbintf);
+		#else
+			usb_autoresume_device(dvobj->pusbdev, 1);
+		#endif
+
+		#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,32))
+		DBG_871X("...pm_usage_cnt(%d).....\n", atomic_read(&(dvobj->pusbintf->pm_usage_cnt)));
+		#else
+		DBG_871X("...pm_usage_cnt(%d).....\n", dvobj->pusbintf->pm_usage_cnt);
+		#endif
+	}
+	DBG_871X("<==== autoresume_enter \n");
+error_exit:
+
+	return result;
+}
+#endif
+
+#ifdef CONFIG_PLATFORM_RTD2880B
+extern void rtd2885_wlan_netlink_sendMsg(char *action_string, char *name);
+#endif
+
+#ifdef CONFIG_PLATFORM_ARM_SUNxI
+#include <mach/sys_config.h>
+extern int sw_usb_disable_hcd(__u32 usbc_no);
+extern int sw_usb_enable_hcd(__u32 usbc_no);
+static int usb_wifi_host = 2;
+#endif
+
+#ifdef CONFIG_PLATFORM_ARM_SUN6I
+#include <mach/sys_config.h>
+extern int sw_usb_disable_hcd(__u32 usbc_no);
+extern int sw_usb_enable_hcd(__u32 usbc_no);
+extern void wifi_pm_power(int on);
+static script_item_u item;
+#endif
+
+_adapter *rtw_usb_if1_init(struct dvobj_priv *dvobj,
+	struct usb_interface *pusb_intf, const struct usb_device_id *pdid)
+{
+	_adapter *padapter = NULL;
+	struct net_device *pnetdev = NULL;
+	int status = _FAIL;
+
+	if ((padapter = (_adapter *)rtw_zvmalloc(sizeof(*padapter))) == NULL) {
+		goto exit;
+	}
+	padapter->dvobj = dvobj;
+	dvobj->if1 = padapter;
+
+	padapter->bDriverStopped=_TRUE;
+
+	dvobj->padapters[dvobj->iface_nums++] = padapter;
+	padapter->iface_id = IFACE_ID0;
+
+#if defined(CONFIG_CONCURRENT_MODE) || defined(CONFIG_DUALMAC_CONCURRENT)
+	//set adapter_type/iface type for primary padapter
+	padapter->isprimary = _TRUE;
+	padapter->adapter_type = PRIMARY_ADAPTER;
+	#ifndef CONFIG_HWPORT_SWAP
+	padapter->iface_type = IFACE_PORT0;
+	#else
+	padapter->iface_type = IFACE_PORT1;
+	#endif
+#endif
+
+	#ifndef RTW_DVOBJ_CHIP_HW_TYPE
+	//step 1-1., decide the chip_type via vid/pid
+	padapter->interface_type = RTW_USB;
+	decide_chip_type_by_usb_device_id(padapter, pdid);
+	#endif
+
+	if((pnetdev = rtw_init_netdev(padapter)) == NULL) {
+		goto free_adapter;
+	}
+	SET_NETDEV_DEV(pnetdev, dvobj_to_dev(dvobj));
+	padapter = rtw_netdev_priv(pnetdev);
+
+	//step 2. hook HalFunc, allocate HalData
+	if(padapter->chip_type == RTL8188C_8192C) {
+		#ifdef CONFIG_RTL8192C
+		rtl8192cu_set_hal_ops(padapter);
+		#endif
+	} else if(padapter->chip_type == RTL8192D) {
+		#ifdef CONFIG_RTL8192D
+		rtl8192du_set_hal_ops(padapter);
+		#endif
+	} else {
+		DBG_871X("Detect NULL_CHIP_TYPE\n");
+		goto free_hal_data;
+	}
+
+	//step 3.
+	padapter->intf_start=&usb_intf_start;
+	padapter->intf_stop=&usb_intf_stop;
+
+	//.2
+	if ((rtw_init_io_priv(padapter, usb_set_intf_ops)) == _FAIL) {
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,(" \n Can't init io_reqs\n"));
+		goto free_hal_data;
+	}
+
+	rtw_hal_read_chip_version(padapter);
+
+	//.4 usb endpoint mapping
+	rtw_hal_chip_configure(padapter);
+
+	//step 4. read efuse/eeprom data and get mac_addr
+	rtw_hal_read_chip_info(padapter);
+
+	if (rtw_handle_dualmac(padapter, 1) != _SUCCESS)
+		goto free_hal_data;
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if(rtw_wdev_alloc(padapter, dvobj_to_dev(dvobj)) != 0) {
+		goto handle_dualmac;
+	}
+#endif
+
+	//step 5.
+	if (rtw_init_drv_sw(padapter) == _FAIL) {
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,("Initialize driver software resource Failed!\n"));
+		goto free_wdev;
+	}
+
+#ifdef CONFIG_PM
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,18))
+	if(padapter->pwrctrlpriv.bSupportRemoteWakeup)
+	{
+		dvobj->pusbdev->do_remote_wakeup=1;
+		pusb_intf->needs_remote_wakeup = 1;
+		device_init_wakeup(&pusb_intf->dev, 1);
+		DBG_871X("\n  padapter->pwrctrlpriv.bSupportRemoteWakeup~~~~~~\n");
+		DBG_871X("\n  padapter->pwrctrlpriv.bSupportRemoteWakeup~~~[%d]~~~\n",device_may_wakeup(&pusb_intf->dev));
+	}
+#endif
+#endif
+
+#ifdef CONFIG_AUTOSUSPEND
+	if( padapter->registrypriv.power_mgnt != PS_MODE_ACTIVE )
+	{
+		if(padapter->registrypriv.usbss_enable ){ 	/* autosuspend (2s delay) */
+			#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,38))
+			dvobj->pusbdev->dev.power.autosuspend_delay = 0 * HZ;//15 * HZ; idle-delay time
+			#else
+			dvobj->pusbdev->autosuspend_delay = 0 * HZ;//15 * HZ; idle-delay time
+			#endif
+
+			#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+			usb_enable_autosuspend(dvobj->pusbdev);
+			#elif  (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,22) && LINUX_VERSION_CODE<=KERNEL_VERSION(2,6,34))
+			padapter->bDisableAutosuspend = dvobj->pusbdev->autosuspend_disabled ;
+			dvobj->pusbdev->autosuspend_disabled = 0;//autosuspend disabled by the user
+			#endif
+
+			usb_autopm_get_interface(dvobj->pusbintf );//init pm_usage_cnt ,let it start from 1
+
+			#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,32))
+			DBG_871X("%s...pm_usage_cnt(%d).....\n",__FUNCTION__, atomic_read(&(dvobj->pusbintf ->pm_usage_cnt)));
+			#else
+			DBG_871X("%s...pm_usage_cnt(%d).....\n",__FUNCTION__, dvobj->pusbintf ->pm_usage_cnt);
+			#endif
+		}
+	}
+#endif
+
+	// set mac addr
+	rtw_macaddr_cfg(padapter->eeprompriv.mac_addr);
+	rtw_init_wifidirect_addrs(padapter, padapter->eeprompriv.mac_addr, padapter->eeprompriv.mac_addr);
+
+	DBG_871X("bDriverStopped:%d, bSurpriseRemoved:%d, bup:%d, hw_init_completed:%d\n"
+		,padapter->bDriverStopped
+		,padapter->bSurpriseRemoved
+		,padapter->bup
+		,padapter->hw_init_completed
+	);
+
+	status = _SUCCESS;
+
+free_wdev:
+	if(status != _SUCCESS) {
+		#ifdef CONFIG_IOCTL_CFG80211
+		rtw_wdev_unregister(padapter->rtw_wdev);
+		rtw_wdev_free(padapter->rtw_wdev);
+		#endif
+	}
+handle_dualmac:
+	if (status != _SUCCESS)
+		rtw_handle_dualmac(padapter, 0);
+free_hal_data:
+	if(status != _SUCCESS && padapter->HalData)
+		rtw_mfree(padapter->HalData, sizeof(*(padapter->HalData)));
+free_adapter:
+	if (status != _SUCCESS) {
+		if (pnetdev)
+			rtw_free_netdev(pnetdev);
+		else if (padapter)
+			rtw_vmfree((u8*)padapter, sizeof(*padapter));
+		padapter = NULL;
+	}
+exit:
+	return padapter;
+}
+
+static void rtw_usb_if1_deinit(_adapter *if1)
+{
+	struct net_device *pnetdev = if1->pnetdev;
+	struct mlme_priv *pmlmepriv= &if1->mlmepriv;
+
+	if(check_fwstate(pmlmepriv, _FW_LINKED))
+		rtw_disassoc_cmd(if1, 0, _FALSE);
+
+#ifdef CONFIG_AP_MODE
+	free_mlme_ap_info(if1);
+	#ifdef CONFIG_HOSTAPD_MLME
+	hostapd_mode_unload(if1);
+	#endif
+#endif
+
+	rtw_cancel_all_timer(if1);
+#ifdef CONFIG_WOWLAN
+	if1->pwrctrlpriv.wowlan_mode=_FALSE;
+#endif //CONFIG_WOWLAN
+	rtw_dev_unload(if1);
+
+	DBG_871X("%s, hw_init_completed=%d\n", __func__, if1->hw_init_completed);
+
+	//s6.
+	rtw_handle_dualmac(if1, 0);
+
+#ifdef CONFIG_IOCTL_CFG80211
+	if (if1->rtw_wdev)
+		rtw_wdev_free(if1->rtw_wdev);
+#endif //CONFIG_IOCTL_CFG80211
+
+	rtw_free_drv_sw(if1);
+
+	if(pnetdev)
+		rtw_free_netdev(pnetdev);
+
+#ifdef CONFIG_PLATFORM_RTD2880B
+	DBG_871X("wlan link down\n");
+	rtd2885_wlan_netlink_sendMsg("linkdown", "8712");
+#endif
+
+}
+
+/*
+ * drv_init() - a device potentially for us
+ *
+ * notes: drv_init() is called when the bus driver has located a card for us to support.
+ *        We accept the new device by returning 0.
+*/
+
+_adapter  *rtw_sw_export = NULL;
+
+static int rtw_drv_init(struct usb_interface *pusb_intf, const struct usb_device_id *did)
+{
+	int i;
+	uint status = _FAIL;
+	_adapter *if1 = NULL, *if2 = NULL;
+	struct dvobj_priv *dvobj = NULL;
+
+
+	RT_TRACE(_module_hci_intfs_c_, _drv_err_, ("+rtw_drv_init\n"));
+
+
+	//step 0.
+	process_spec_devid(did);
+
+	/* Initialize dvobj_priv */
+	if ((dvobj = usb_dvobj_init(pusb_intf)) == NULL) {
+		RT_TRACE(_module_hci_intfs_c_, _drv_err_, ("initialize device object priv Failed!\n"));
+		goto exit;
+	}
+
+	/* Initialize if1 */
+	if ((if1 = rtw_usb_if1_init(dvobj, pusb_intf, did)) == NULL) {
+		DBG_871X("rtw_usb_if1_init Failed!\n");
+		goto free_dvobj;
+	}
+
+	/* Initialize if2 */
+#ifdef CONFIG_CONCURRENT_MODE
+	if((if2 = rtw_drv_if2_init(if1, usb_set_intf_ops)) == NULL) {
+		goto free_if1;
+	}
+#ifdef CONFIG_MULTI_VIR_IFACES
+	for(i=0; i<if1->registrypriv.ext_iface_num;i++)
+	{
+		if(rtw_drv_add_vir_if(if1, usb_set_intf_ops) == NULL)
+		{
+			DBG_871X("rtw_drv_add_iface failed! (%d)\n", i);
+			goto free_if1;
+		}
+	}
+#endif //CONFIG_MULTI_VIR_IFACES
+#endif
+
+#ifdef CONFIG_INTEL_PROXIM
+	rtw_sw_export=if1;
+#endif
+
+#ifdef CONFIG_GLOBAL_UI_PID
+	if (ui_pid[1]!=0) {
+		DBG_871X("ui_pid[1]:%d\n",ui_pid[1]);
+		rtw_signal_process(ui_pid[1], SIGUSR2);
+	}
+#endif
+
+	//dev_alloc_name && register_netdev
+	if((status = rtw_drv_register_netdev(if1)) != _SUCCESS) {
+		goto free_if1;
+	}
+
+#ifdef CONFIG_HOSTAPD_MLME
+	hostapd_mode_init(if1);
+#endif
+
+#ifdef CONFIG_PLATFORM_RTD2880B
+	DBG_871X("wlan link up\n");
+	rtd2885_wlan_netlink_sendMsg("linkup", "8712");
+#endif
+
+#ifdef RTK_DMP_PLATFORM
+	rtw_proc_init_one(if1->pnetdev);
+#endif
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("-871x_drv - drv_init, success!\n"));
+
+	status = _SUCCESS;
+
+free_if1:
+	if (status != _SUCCESS && if1) {
+		rtw_usb_if1_deinit(if1);
+	}
+free_dvobj:
+	if (status != _SUCCESS)
+		usb_dvobj_deinit(pusb_intf);
+exit:
+	return status == _SUCCESS?0:-ENODEV;
+}
+
+/*
+ * dev_remove() - our device is being removed
+*/
+//rmmod module & unplug(SurpriseRemoved) will call r871xu_dev_remove() => how to recognize both
+static void rtw_dev_remove(struct usb_interface *pusb_intf)
+{
+	struct dvobj_priv *dvobj = usb_get_intfdata(pusb_intf);
+	_adapter *padapter = dvobj->if1;
+
+_func_exit_;
+
+	DBG_871X("+rtw_dev_remove\n");
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+dev_remove()\n"));
+
+	dvobj->processing_dev_remove = _TRUE;
+
+	rtw_unregister_netdevs(dvobj);
+
+	if(usb_drv->drv_registered == _TRUE)
+	{
+		//DBG_871X("r871xu_dev_remove():padapter->bSurpriseRemoved == _TRUE\n");
+		padapter->bSurpriseRemoved = _TRUE;
+	}
+	/*else
+	{
+		//DBG_871X("r871xu_dev_remove():module removed\n");
+		padapter->hw_init_completed = _FALSE;
+	}*/
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) || defined(CONFIG_ANDROID_POWER)
+	rtw_unregister_early_suspend(&padapter->pwrctrlpriv);
+#endif
+
+	rtw_pm_set_ips(padapter, IPS_NONE);
+	rtw_pm_set_lps(padapter, PS_MODE_ACTIVE);
+
+	LeaveAllPowerSaveMode(padapter);
+
+#ifdef CONFIG_CONCURRENT_MODE
+#ifdef CONFIG_MULTI_VIR_IFACES
+	rtw_drv_stop_vir_ifaces(dvobj);
+#endif //CONFIG_MULTI_VIR_IFACES
+	rtw_drv_if2_stop(dvobj->if2);
+#endif	//CONFIG_CONCURRENT_MODE
+
+	rtw_usb_if1_deinit(padapter);
+
+#ifdef CONFIG_CONCURRENT_MODE
+#ifdef CONFIG_MULTI_VIR_IFACES
+	rtw_drv_free_vir_ifaces(dvobj);
+#endif //CONFIG_MULTI_VIR_IFACES
+	rtw_drv_if2_free(dvobj->if2);
+#endif //CONFIG_CONCURRENT_MODE
+
+	usb_dvobj_deinit(pusb_intf);
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("-dev_remove()\n"));
+	DBG_871X("-r871xu_dev_remove, done\n");
+
+
+#ifdef CONFIG_INTEL_PROXIM
+	rtw_sw_export=NULL;
+#endif
+
+_func_exit_;
+
+	return;
+
+}
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+extern int console_suspend_enabled;
+#endif
+
+static int __init rtw_drv_entry(void)
+{
+#ifdef CONFIG_PLATFORM_RTK_DMP
+	u32 tmp;
+	tmp=readl((volatile unsigned int*)0xb801a608);
+	tmp &= 0xffffff00;
+	tmp |= 0x55;
+	writel(tmp,(volatile unsigned int*)0xb801a608);//write dummy register for 1055
+#endif
+#ifdef CONFIG_PLATFORM_ARM_SUNxI
+#ifndef CONFIG_RTL8723A
+	int ret = 0;
+	/* ----------get usb_wifi_usbc_num------------- */
+	ret = script_parser_fetch("usb_wifi_para", "usb_wifi_usbc_num", (int *)&usb_wifi_host, 64);
+	if(ret != 0){
+		printk("ERR: script_parser_fetch usb_wifi_usbc_num failed\n");
+		ret = -ENOMEM;
+		return ret;
+	}
+	printk("sw_usb_enable_hcd: usbc_num = %d\n", usb_wifi_host);
+	sw_usb_enable_hcd(usb_wifi_host);
+#endif //CONFIG_RTL8723A
+#endif //CONFIG_PLATFORM_ARM_SUNxI
+
+#ifdef CONFIG_PLATFORM_ARM_SUN6I
+	script_item_value_type_e type;
+
+	type = script_get_item("wifi_para", "wifi_usbc_id", &item);
+	if(SCIRPT_ITEM_VALUE_TYPE_INT != type){
+		printk("ERR: script_get_item wifi_usbc_id failed\n");
+		return -ENOMEM;
+	}
+
+	printk("sw_usb_enable_hcd: usbc_num = %d\n", item.val);
+	wifi_pm_power(1);
+	mdelay(10);
+	sw_usb_enable_hcd(item.val);
+#endif //CONFIG_PLATFORM_ARM_SUN6I
+
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+rtw_drv_entry\n"));
+
+	DBG_871X(DRV_NAME " driver version=%s\n", DRIVERVERSION);
+	DBG_871X("build time: %s %s\n", __DATE__, __TIME__);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24))
+	//console_suspend_enabled=0;
+#endif
+
+	rtw_suspend_lock_init();
+
+	usb_drv->drv_registered = _TRUE;
+	return usb_register(&usb_drv->usbdrv);
+}
+
+static void __exit rtw_drv_halt(void)
+{
+	RT_TRACE(_module_hci_intfs_c_,_drv_err_,("+rtw_drv_halt\n"));
+	DBG_871X("+rtw_drv_halt\n");
+
+	usb_drv->drv_registered = _FALSE;
+	usb_deregister(&usb_drv->usbdrv);
+
+#ifdef CONFIG_PLATFORM_ARM_SUNxI
+#ifndef CONFIG_RTL8723A
+	printk("sw_usb_disable_hcd: usbc_num = %d\n", usb_wifi_host);
+	sw_usb_disable_hcd(usb_wifi_host);
+#endif //ifndef CONFIG_RTL8723A
+#endif	//CONFIG_PLATFORM_ARM_SUNxI
+#ifdef CONFIG_PLATFORM_ARM_SUN6I
+	sw_usb_disable_hcd(item.val);
+	wifi_pm_power(0);
+#endif
+
+	rtw_suspend_lock_uninit();
+	DBG_871X("-rtw_drv_halt\n");
+
+	rtw_mstat_dump();
+}
+
+
+module_init(rtw_drv_entry);
+module_exit(rtw_drv_halt);
+
+#ifdef CONFIG_WOWLAN
+#ifdef CONFIG_WOWLAN_MANUAL
+
+int rtw_resume_toshiba(PADAPTER Adapter)
+{
+	struct dvobj_priv *pdvobjpriv;
+	pdvobjpriv = adapter_to_dvobj(Adapter);
+
+	rtw_resume(pdvobjpriv->pusbintf);
+	return 0;
+}
+
+int rtw_suspend_toshiba(PADAPTER Adapter)
+{
+	pm_message_t msg;
+	struct dvobj_priv *pdvobjpriv;
+	pdvobjpriv = adapter_to_dvobj(Adapter);
+	msg.event=0;
+	//for Toshiba only, they should call rtw_suspend before suspend
+	rtw_suspend(pdvobjpriv->pusbintf, msg);
+	return 0;
+}
+EXPORT_SYMBOL(rtw_suspend_toshiba);
+EXPORT_SYMBOL(rtw_resume_toshiba);
+#endif //CONFIG_WOWLAN_MANUAL
+#endif //CONFIG_WOWLAN
+
+#ifdef CONFIG_INTEL_PROXIM
+_adapter  *rtw_usb_get_sw_pointer(void)
+{
+	return rtw_sw_export;
+}
+EXPORT_SYMBOL(rtw_usb_get_sw_pointer);
+#endif	//CONFIG_INTEL_PROXIM
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/usb_ops_linux.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/usb_ops_linux.c
new file mode 100644
index 000000000000..acb58ef82d21
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/usb_ops_linux.c
@@ -0,0 +1,648 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *******************************************************************************/
+#define _USB_OPS_LINUX_C_
+
+#include <drv_types.h>
+#include <usb_ops_linux.h>
+#include <rtw_sreset.h>
+
+#ifdef CONFIG_USB_SUPPORT_ASYNC_VDN_REQ
+static void _usbctrl_vendorreq_async_callback(struct urb *urb, struct pt_regs *regs)
+{
+	if (urb) {
+		if (urb->context) {
+			rtw_mfree(urb->context);
+		}
+		usb_free_urb(urb);
+	}
+}
+
+static int _usbctrl_vendorreq_async_write(struct usb_device *udev, u8 request,
+	u16 value, u16 index, void *pdata, u16 len, u8 requesttype)
+{
+	int rc;
+	unsigned int pipe;
+	u8 reqtype;
+	struct usb_ctrlrequest *dr;
+	struct urb *urb;
+	struct rtl819x_async_write_data {
+		u8 data[VENDOR_CMD_MAX_DATA_LEN];
+		struct usb_ctrlrequest dr;
+	} *buf;
+
+
+	if (requesttype == VENDOR_READ) {
+		pipe = usb_rcvctrlpipe(udev, 0);//read_in
+		reqtype =  REALTEK_USB_VENQT_READ;
+	}
+	else {
+		pipe = usb_sndctrlpipe(udev, 0);//write_out
+		reqtype =  REALTEK_USB_VENQT_WRITE;
+	}
+
+	buf = (struct rtl819x_async_write_data *)rtw_zmalloc(sizeof(*buf));
+	if (!buf) {
+		rc = -ENOMEM;
+		goto exit;
+	}
+
+	urb = usb_alloc_urb(0, GFP_ATOMIC);
+	if (!urb) {
+		rtw_mfree((u8*)buf, sizeof(*buf));
+		rc = -ENOMEM;
+		goto exit;
+	}
+
+	dr = &buf->dr;
+
+	dr->bRequestType = reqtype;
+	dr->bRequest = request;
+	dr->wValue = cpu_to_le16(value);
+	dr->wIndex = cpu_to_le16(index);
+	dr->wLength = cpu_to_le16(len);
+
+	_rtw_memcpy(buf, pdata, len);
+
+	usb_fill_control_urb(urb, udev, pipe, (unsigned char *)dr, buf, len,
+		_usbctrl_vendorreq_async_callback, buf);
+
+	rc = usb_submit_urb(urb, GFP_ATOMIC);
+	if (rc < 0) {
+		rtw_mfree((u8*)buf, sizeof(*buf));
+		usb_free_urb(urb);
+	}
+
+exit:
+	return rc;
+}
+
+int usb_write_async(struct usb_device *udev, u32 addr, void *pdata, u16 len)
+{
+	u8 request;
+	u8 requesttype;
+	u16 wvalue;
+	u16 index;
+
+	int ret;
+
+	requesttype = VENDOR_WRITE;//write_out
+	request = REALTEK_USB_VENQT_CMD_REQ;
+	index = REALTEK_USB_VENQT_CMD_IDX;//n/a
+
+	wvalue = (u16)(addr&0x0000ffff);
+
+	ret = _usbctrl_vendorreq_async_write(udev, request, wvalue, index, pdata, len, requesttype);
+
+	return ret;
+}
+
+int usb_async_write8(struct intf_hdl *pintfhdl, u32 addr, u8 val)
+{
+	u8 data;
+	int ret;
+	struct dvobj_priv  *pdvobjpriv = (struct dvobj_priv  *)pintfhdl->pintf_dev;
+	struct usb_device *udev=pdvobjpriv->pusbdev;
+
+	_func_enter_;
+	data = val;
+	ret = usb_write_async(udev, addr, &data, 1);
+	_func_exit_;
+
+	return ret;
+}
+
+int usb_async_write16(struct intf_hdl *pintfhdl, u32 addr, u16 val)
+{
+	u16 data;
+	int ret;
+	struct dvobj_priv  *pdvobjpriv = (struct dvobj_priv  *)pintfhdl->pintf_dev;
+	struct usb_device *udev=pdvobjpriv->pusbdev;
+
+	_func_enter_;
+	data = val;
+	ret = usb_write_async(udev, addr, &data, 2);
+	_func_exit_;
+
+	return ret;
+}
+
+int usb_async_write32(struct intf_hdl *pintfhdl, u32 addr, u32 val)
+{
+	u32 data;
+	int ret;
+	struct dvobj_priv  *pdvobjpriv = (struct dvobj_priv  *)pintfhdl->pintf_dev;
+	struct usb_device *udev=pdvobjpriv->pusbdev;
+
+	_func_enter_;
+	data = val;
+	ret = usb_write_async(udev, addr, &data, 4);
+	_func_exit_;
+
+	return ret;
+}
+#endif /* CONFIG_USB_SUPPORT_ASYNC_VDN_REQ */
+
+unsigned int ffaddr2pipehdl(struct dvobj_priv *pdvobj, u32 addr)
+{
+	unsigned int pipe=0;
+	int ep_num=0;
+	_adapter *padapter = pdvobj->if1;
+	struct usb_device *pusbd = pdvobj->pusbdev;
+	HAL_DATA_TYPE *pHalData = GET_HAL_DATA(padapter);
+
+	if (addr == RECV_BULK_IN_ADDR) {
+		pipe=usb_rcvbulkpipe(pusbd, pHalData->RtBulkInPipe);
+
+	} else if (addr == RECV_INT_IN_ADDR) {
+		pipe=usb_rcvbulkpipe(pusbd, pHalData->RtIntInPipe);
+
+	} else if (addr < HW_QUEUE_ENTRY) {
+		ep_num = pHalData->Queue2EPNum[addr];
+		pipe = usb_sndbulkpipe(pusbd, ep_num);
+	}
+
+	return pipe;
+}
+
+struct zero_bulkout_context{
+	void *pbuf;
+	void *purb;
+	void *pirp;
+	void *padapter;
+};
+
+static void usb_bulkout_zero_complete(struct urb *purb, struct pt_regs *regs)
+{
+	struct zero_bulkout_context *pcontext = (struct zero_bulkout_context *)purb->context;
+
+	//DBG_8192C("+usb_bulkout_zero_complete\n");
+
+	if(pcontext)
+	{
+		if(pcontext->pbuf)
+		{
+			rtw_mfree(pcontext->pbuf, sizeof(int));
+		}
+
+		if(pcontext->purb && (pcontext->purb==purb))
+		{
+			usb_free_urb(pcontext->purb);
+		}
+
+
+		rtw_mfree((u8*)pcontext, sizeof(struct zero_bulkout_context));
+	}
+
+
+}
+
+static u32 usb_bulkout_zero(struct intf_hdl *pintfhdl, u32 addr)
+{
+	int pipe, status, len;
+	u32 ret;
+	unsigned char *pbuf;
+	struct zero_bulkout_context *pcontext;
+	PURB	purb = NULL;
+	_adapter *padapter = (_adapter *)pintfhdl->padapter;
+	struct dvobj_priv *pdvobj = adapter_to_dvobj(padapter);
+	struct usb_device *pusbd = pdvobj->pusbdev;
+
+	//DBG_871X("%s\n", __func__);
+
+
+	if((padapter->bDriverStopped) || (padapter->bSurpriseRemoved) ||(padapter->pwrctrlpriv.pnp_bstop_trx))
+	{
+		return _FAIL;
+	}
+
+
+	pcontext = (struct zero_bulkout_context *)rtw_zmalloc(sizeof(struct zero_bulkout_context));
+
+	pbuf = (unsigned char *)rtw_zmalloc(sizeof(int));
+	purb = usb_alloc_urb(0, GFP_ATOMIC);
+
+	len = 0;
+	pcontext->pbuf = pbuf;
+	pcontext->purb = purb;
+	pcontext->pirp = NULL;
+	pcontext->padapter = padapter;
+
+
+	//translate DMA FIFO addr to pipehandle
+	//pipe = ffaddr2pipehdl(pdvobj, addr);
+
+	usb_fill_bulk_urb(purb, pusbd, pipe,
+				pbuf,
+				len,
+				usb_bulkout_zero_complete,
+				pcontext);//context is pcontext
+
+	status = usb_submit_urb(purb, GFP_ATOMIC);
+
+	if (!status)
+	{
+		ret= _SUCCESS;
+	}
+	else
+	{
+		ret= _FAIL;
+	}
+
+
+	return _SUCCESS;
+
+}
+
+void usb_read_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *rmem)
+{
+
+}
+
+void usb_write_mem(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem)
+{
+
+}
+
+
+void usb_read_port_cancel(struct intf_hdl *pintfhdl)
+{
+	int i;
+	struct recv_buf *precvbuf;
+	_adapter	*padapter = pintfhdl->padapter;
+	precvbuf = (struct recv_buf *)padapter->recvpriv.precv_buf;
+
+	DBG_871X("%s\n", __func__);
+
+	padapter->bReadPortCancel = _TRUE;
+
+	for (i=0; i < NR_RECVBUFF ; i++) {
+
+		precvbuf->reuse = _TRUE;
+		if (precvbuf->purb)	 {
+			//DBG_8192C("usb_read_port_cancel : usb_kill_urb \n");
+			usb_kill_urb(precvbuf->purb);
+		}
+		precvbuf++;
+	}
+
+#ifdef CONFIG_USB_INTERRUPT_IN_PIPE
+	usb_kill_urb(padapter->recvpriv.int_in_urb);
+#endif
+}
+
+static void usb_write_port_complete(struct urb *purb, struct pt_regs *regs)
+{
+	_irqL irqL;
+	int i;
+	struct xmit_buf *pxmitbuf = (struct xmit_buf *)purb->context;
+	//struct xmit_frame *pxmitframe = (struct xmit_frame *)pxmitbuf->priv_data;
+	//_adapter			*padapter = pxmitframe->padapter;
+	_adapter	*padapter = pxmitbuf->padapter;
+       struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+	//struct pkt_attrib *pattrib = &pxmitframe->attrib;
+
+_func_enter_;
+
+	switch(pxmitbuf->flags)
+	{
+		case VO_QUEUE_INX:
+			pxmitpriv->voq_cnt--;
+			break;
+		case VI_QUEUE_INX:
+			pxmitpriv->viq_cnt--;
+			break;
+		case BE_QUEUE_INX:
+			pxmitpriv->beq_cnt--;
+			break;
+		case BK_QUEUE_INX:
+			pxmitpriv->bkq_cnt--;
+			break;
+		case HIGH_QUEUE_INX:
+#ifdef CONFIG_AP_MODE
+			rtw_chk_hi_queue_cmd(padapter);
+#endif
+			break;
+		default:
+			break;
+	}
+
+
+/*
+	_enter_critical(&pxmitpriv->lock, &irqL);
+
+	pxmitpriv->txirp_cnt--;
+
+	switch(pattrib->priority)
+	{
+		case 1:
+		case 2:
+			pxmitpriv->bkq_cnt--;
+			//DBG_8192C("pxmitpriv->bkq_cnt=%d\n", pxmitpriv->bkq_cnt);
+			break;
+		case 4:
+		case 5:
+			pxmitpriv->viq_cnt--;
+			//DBG_8192C("pxmitpriv->viq_cnt=%d\n", pxmitpriv->viq_cnt);
+			break;
+		case 6:
+		case 7:
+			pxmitpriv->voq_cnt--;
+			//DBG_8192C("pxmitpriv->voq_cnt=%d\n", pxmitpriv->voq_cnt);
+			break;
+		case 0:
+		case 3:
+		default:
+			pxmitpriv->beq_cnt--;
+			//DBG_8192C("pxmitpriv->beq_cnt=%d\n", pxmitpriv->beq_cnt);
+			break;
+
+	}
+
+	_exit_critical(&pxmitpriv->lock, &irqL);
+
+
+	if(pxmitpriv->txirp_cnt==0)
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete: txirp_cnt== 0, set allrxreturnevt!\n"));
+		_rtw_up_sema(&(pxmitpriv->tx_retevt));
+	}
+*/
+        //rtw_free_xmitframe(pxmitpriv, pxmitframe);
+
+	if(padapter->bSurpriseRemoved || padapter->bDriverStopped ||padapter->bWritePortCancel)
+	{
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete:bDriverStopped(%d) OR bSurpriseRemoved(%d)", padapter->bDriverStopped, padapter->bSurpriseRemoved));
+		DBG_8192C("%s(): TX Warning! bDriverStopped(%d) OR bSurpriseRemoved(%d) bWritePortCancel(%d) pxmitbuf->ext_tag(%x) \n",
+		__FUNCTION__,padapter->bDriverStopped, padapter->bSurpriseRemoved,padapter->bReadPortCancel,pxmitbuf->ext_tag);
+
+		goto check_completion;
+	}
+
+
+	if (purb->status==0) {
+
+	} else {
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete : purb->status(%d) != 0 \n", purb->status));
+		DBG_871X("###=> urb_write_port_complete status(%d)\n",purb->status);
+		if((purb->status==-EPIPE)||(purb->status==-EPROTO))
+		{
+			//usb_clear_halt(pusbdev, purb->pipe);
+			//msleep(10);
+			sreset_set_wifi_error_status(padapter, USB_WRITE_PORT_FAIL);
+		} else if (purb->status == -EINPROGRESS) {
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete: EINPROGESS\n"));
+			goto check_completion;
+
+		} else if (purb->status == -ENOENT) {
+			DBG_871X("%s: -ENOENT\n", __func__);
+			goto check_completion;
+
+		} else if (purb->status == -ECONNRESET) {
+			DBG_871X("%s: -ECONNRESET\n", __func__);
+			goto check_completion;
+
+		} else if (purb->status == -ESHUTDOWN) {
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete: ESHUTDOWN\n"));
+			padapter->bDriverStopped=_TRUE;
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete:bDriverStopped=TRUE\n"));
+
+			goto check_completion;
+		}
+		else
+		{
+			padapter->bSurpriseRemoved=_TRUE;
+			DBG_8192C("bSurpriseRemoved=TRUE\n");
+			//rtl8192cu_trigger_gpio_0(padapter);
+			RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port_complete:bSurpriseRemoved=TRUE\n"));
+
+			goto check_completion;
+		}
+	}
+
+	#ifdef DBG_CONFIG_ERROR_DETECT
+	{
+		HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+		pHalData->srestpriv.last_tx_complete_time = rtw_get_current_time();
+	}
+	#endif
+
+check_completion:
+	_enter_critical(&pxmitpriv->lock_sctx, &irqL);
+	rtw_sctx_done_err(&pxmitbuf->sctx,
+		purb->status ? RTW_SCTX_DONE_WRITE_PORT_ERR : RTW_SCTX_DONE_SUCCESS);
+	_exit_critical(&pxmitpriv->lock_sctx, &irqL);
+
+	rtw_free_xmitbuf(pxmitpriv, pxmitbuf);
+
+	//if(rtw_txframes_pending(padapter))
+	{
+		tasklet_hi_schedule(&pxmitpriv->xmit_tasklet);
+	}
+
+_func_exit_;
+
+}
+
+u32 usb_write_port(struct intf_hdl *pintfhdl, u32 addr, u32 cnt, u8 *wmem)
+{
+	_irqL irqL;
+	unsigned int pipe;
+	int status;
+	u32 ret = _FAIL, bwritezero = _FALSE;
+	PURB	purb = NULL;
+	_adapter *padapter = (_adapter *)pintfhdl->padapter;
+	struct dvobj_priv	*pdvobj = adapter_to_dvobj(padapter);
+	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
+	struct xmit_buf *pxmitbuf = (struct xmit_buf *)wmem;
+	struct xmit_frame *pxmitframe = (struct xmit_frame *)pxmitbuf->priv_data;
+	struct usb_device *pusbd = pdvobj->pusbdev;
+	struct pkt_attrib *pattrib = &pxmitframe->attrib;
+
+_func_enter_;
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("+usb_write_port\n"));
+
+	if ((padapter->bDriverStopped) || (padapter->bSurpriseRemoved) ||(padapter->pwrctrlpriv.pnp_bstop_trx)) {
+		#ifdef DBG_TX
+		DBG_871X(" DBG_TX %s:%d bDriverStopped%d, bSurpriseRemoved:%d, pnp_bstop_trx:%d\n",__FUNCTION__, __LINE__
+			,padapter->bDriverStopped, padapter->bSurpriseRemoved, padapter->pwrctrlpriv.pnp_bstop_trx );
+		#endif
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port:( padapter->bDriverStopped ||padapter->bSurpriseRemoved ||adapter->pwrctrlpriv.pnp_bstop_trx)!!!\n"));
+		rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_TX_DENY);
+		goto exit;
+	}
+
+	_enter_critical(&pxmitpriv->lock, &irqL);
+
+	switch(addr)
+	{
+		case VO_QUEUE_INX:
+			pxmitpriv->voq_cnt++;
+			pxmitbuf->flags = VO_QUEUE_INX;
+			break;
+		case VI_QUEUE_INX:
+			pxmitpriv->viq_cnt++;
+			pxmitbuf->flags = VI_QUEUE_INX;
+			break;
+		case BE_QUEUE_INX:
+			pxmitpriv->beq_cnt++;
+			pxmitbuf->flags = BE_QUEUE_INX;
+			break;
+		case BK_QUEUE_INX:
+			pxmitpriv->bkq_cnt++;
+			pxmitbuf->flags = BK_QUEUE_INX;
+			break;
+		case HIGH_QUEUE_INX:
+			pxmitbuf->flags = HIGH_QUEUE_INX;
+			break;
+		default:
+			pxmitbuf->flags = MGT_QUEUE_INX;
+			break;
+	}
+
+	_exit_critical(&pxmitpriv->lock, &irqL);
+
+	purb	= pxmitbuf->pxmit_urb[0];
+
+#if 0
+	if(pdvobj->ishighspeed)
+	{
+		if(cnt> 0 && cnt%512 == 0)
+		{
+			//DBG_8192C("ishighspeed, cnt=%d\n", cnt);
+			bwritezero = _TRUE;
+		}
+	}
+	else
+	{
+		if(cnt > 0 && cnt%64 == 0)
+		{
+			//DBG_8192C("cnt=%d\n", cnt);
+			bwritezero = _TRUE;
+		}
+	}
+#endif
+
+	//translate DMA FIFO addr to pipehandle
+	pipe = ffaddr2pipehdl(pdvobj, addr);
+
+#ifdef CONFIG_REDUCE_USB_TX_INT
+	if ( (pxmitpriv->free_xmitbuf_cnt%NR_XMITBUFF == 0)
+		|| (pxmitbuf->ext_tag == _TRUE) )
+	{
+		purb->transfer_flags  &=  (~URB_NO_INTERRUPT);
+	} else {
+		purb->transfer_flags  |=  URB_NO_INTERRUPT;
+		//DBG_8192C("URB_NO_INTERRUPT ");
+	}
+#endif
+
+
+	usb_fill_bulk_urb(purb, pusbd, pipe,
+				pxmitframe->buf_addr, //= pxmitbuf->pbuf
+				cnt,
+				usb_write_port_complete,
+				pxmitbuf);//context is pxmitbuf
+
+#ifdef CONFIG_USE_USB_BUFFER_ALLOC_TX
+	purb->transfer_dma = pxmitbuf->dma_transfer_addr;
+	purb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+	purb->transfer_flags |= URB_ZERO_PACKET;
+#endif	// CONFIG_USE_USB_BUFFER_ALLOC_TX
+
+#if 0
+	if (bwritezero)
+        {
+            purb->transfer_flags |= URB_ZERO_PACKET;
+        }
+#endif
+
+	status = usb_submit_urb(purb, GFP_ATOMIC);
+	if (!status) {
+		#ifdef DBG_CONFIG_ERROR_DETECT
+		{
+			HAL_DATA_TYPE	*pHalData = GET_HAL_DATA(padapter);
+			pHalData->srestpriv.last_tx_time = rtw_get_current_time();
+		}
+		#endif
+	} else {
+		rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_WRITE_PORT_ERR);
+		DBG_871X("usb_write_port, status=%d\n", status);
+		RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("usb_write_port(): usb_submit_urb, status=%x\n", status));
+
+		switch (status) {
+		case -ENODEV:
+			padapter->bDriverStopped=_TRUE;
+			break;
+		default:
+			break;
+		}
+		goto exit;
+	}
+
+	ret= _SUCCESS;
+
+//   Commented by Albert 2009/10/13
+//   We add the URB_ZERO_PACKET flag to urb so that the host will send the zero packet automatically.
+/*
+	if(bwritezero == _TRUE)
+	{
+		usb_bulkout_zero(pintfhdl, addr);
+	}
+*/
+
+	RT_TRACE(_module_hci_ops_os_c_,_drv_err_,("-usb_write_port\n"));
+
+exit:
+	if (ret != _SUCCESS)
+		rtw_free_xmitbuf(pxmitpriv, pxmitbuf);
+_func_exit_;
+	return ret;
+
+}
+
+void usb_write_port_cancel(struct intf_hdl *pintfhdl)
+{
+	int i, j;
+	_adapter	*padapter = pintfhdl->padapter;
+	struct xmit_buf *pxmitbuf = (struct xmit_buf *)padapter->xmitpriv.pxmitbuf;
+
+	DBG_871X("%s \n", __func__);
+
+	padapter->bWritePortCancel = _TRUE;
+
+	for (i=0; i<NR_XMITBUFF; i++) {
+		for (j=0; j<8; j++) {
+			if (pxmitbuf->pxmit_urb[j]) {
+				usb_kill_urb(pxmitbuf->pxmit_urb[j]);
+			}
+		}
+		pxmitbuf++;
+	}
+
+	pxmitbuf = (struct xmit_buf*)padapter->xmitpriv.pxmit_extbuf;
+	for (i = 0; i < NR_XMIT_EXTBUFF; i++) {
+		for (j=0; j<8; j++) {
+			if(pxmitbuf->pxmit_urb[j]) {
+				usb_kill_urb(pxmitbuf->pxmit_urb[j]);
+			}
+		}
+		pxmitbuf++;
+	}
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/xmit_linux.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/xmit_linux.c
new file mode 100644
index 000000000000..13dc4465fc3d
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/linux/xmit_linux.c
@@ -0,0 +1,420 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+#define _XMIT_OSDEP_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+
+#include <if_ether.h>
+#include <ip.h>
+#include <rtw_byteorder.h>
+#include <wifi.h>
+#include <mlme_osdep.h>
+#include <xmit_osdep.h>
+#include <osdep_intf.h>
+#include <circ_buf.h>
+
+
+uint rtw_remainder_len(struct pkt_file *pfile)
+{
+	return (pfile->buf_len - ((SIZE_PTR)(pfile->cur_addr) - (SIZE_PTR)(pfile->buf_start)));
+}
+
+void _rtw_open_pktfile (_pkt *pktptr, struct pkt_file *pfile)
+{
+_func_enter_;
+
+	pfile->pkt = pktptr;
+	pfile->cur_addr = pfile->buf_start = pktptr->data;
+	pfile->pkt_len = pfile->buf_len = pktptr->len;
+
+	pfile->cur_buffer = pfile->buf_start ;
+
+_func_exit_;
+}
+
+uint _rtw_pktfile_read (struct pkt_file *pfile, u8 *rmem, uint rlen)
+{
+	uint	len = 0;
+
+_func_enter_;
+
+       len =  rtw_remainder_len(pfile);
+	len = (rlen > len)? len: rlen;
+
+       if(rmem)
+	  skb_copy_bits(pfile->pkt, pfile->buf_len-pfile->pkt_len, rmem, len);
+
+       pfile->cur_addr += len;
+       pfile->pkt_len -= len;
+
+_func_exit_;
+
+	return len;
+}
+
+sint rtw_endofpktfile(struct pkt_file *pfile)
+{
+_func_enter_;
+
+	if (pfile->pkt_len == 0) {
+_func_exit_;
+		return _TRUE;
+	}
+
+_func_exit_;
+
+	return _FALSE;
+}
+
+void rtw_set_tx_chksum_offload(_pkt *pkt, struct pkt_attrib *pattrib)
+{
+
+#ifdef CONFIG_TCP_CSUM_OFFLOAD_TX
+	struct sk_buff *skb = (struct sk_buff *)pkt;
+	pattrib->hw_tcp_csum = 0;
+
+	if (skb->ip_summed == CHECKSUM_PARTIAL) {
+		if (skb_shinfo(skb)->nr_frags == 0)
+		{
+                        const struct iphdr *ip = ip_hdr(skb);
+                        if (ip->protocol == IPPROTO_TCP) {
+                                // TCP checksum offload by HW
+                                DBG_871X("CHECKSUM_PARTIAL TCP\n");
+                                pattrib->hw_tcp_csum = 1;
+                                //skb_checksum_help(skb);
+                        } else if (ip->protocol == IPPROTO_UDP) {
+                                //DBG_871X("CHECKSUM_PARTIAL UDP\n");
+#if 1
+                                skb_checksum_help(skb);
+#else
+                                // Set UDP checksum = 0 to skip checksum check
+                                struct udphdr *udp = skb_transport_header(skb);
+                                udp->check = 0;
+#endif
+                        } else {
+				DBG_871X("%s-%d TCP CSUM offload Error!!\n", __FUNCTION__, __LINE__);
+                                WARN_ON(1);     /* we need a WARN() */
+			    }
+		}
+		else { // IP fragmentation case
+			DBG_871X("%s-%d nr_frags != 0, using skb_checksum_help(skb);!!\n", __FUNCTION__, __LINE__);
+			skb_checksum_help(skb);
+		}
+	}
+#endif
+
+}
+
+int rtw_os_xmit_resource_alloc(_adapter *padapter, struct xmit_buf *pxmitbuf,u32 alloc_sz)
+{
+#ifdef CONFIG_USB_HCI
+	int i;
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct usb_device	*pusbd = pdvobjpriv->pusbdev;
+
+#ifdef CONFIG_USE_USB_BUFFER_ALLOC_TX
+	pxmitbuf->pallocated_buf = rtw_usb_buffer_alloc(pusbd, (size_t)alloc_sz, &pxmitbuf->dma_transfer_addr);
+	pxmitbuf->pbuf = pxmitbuf->pallocated_buf;
+	if(pxmitbuf->pallocated_buf == NULL)
+		return _FAIL;
+#else // CONFIG_USE_USB_BUFFER_ALLOC_TX
+
+	pxmitbuf->pallocated_buf = rtw_zmalloc(alloc_sz);
+	if (pxmitbuf->pallocated_buf == NULL)
+	{
+		return _FAIL;
+	}
+
+	pxmitbuf->pbuf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitbuf->pallocated_buf), XMITBUF_ALIGN_SZ);
+	pxmitbuf->dma_transfer_addr = 0;
+
+#endif // CONFIG_USE_USB_BUFFER_ALLOC_TX
+
+	for(i=0; i<8; i++)
+	{
+		pxmitbuf->pxmit_urb[i] = usb_alloc_urb(0, GFP_KERNEL);
+		if(pxmitbuf->pxmit_urb[i] == NULL)
+		{
+			DBG_871X("pxmitbuf->pxmit_urb[i]==NULL");
+			return _FAIL;
+		}
+
+	}
+#endif
+#if defined(CONFIG_PCI_HCI) || defined(CONFIG_SDIO_HCI)
+	pxmitbuf->pallocated_buf = rtw_zmalloc(alloc_sz);
+	if (pxmitbuf->pallocated_buf == NULL)
+	{
+		return _FAIL;
+	}
+
+	pxmitbuf->pbuf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitbuf->pallocated_buf), XMITBUF_ALIGN_SZ);
+#endif
+
+	return _SUCCESS;
+}
+
+void rtw_os_xmit_resource_free(_adapter *padapter, struct xmit_buf *pxmitbuf,u32 free_sz)
+{
+#ifdef CONFIG_USB_HCI
+	int i;
+	struct dvobj_priv	*pdvobjpriv = adapter_to_dvobj(padapter);
+	struct usb_device	*pusbd = pdvobjpriv->pusbdev;
+
+
+	for(i=0; i<8; i++)
+	{
+		if(pxmitbuf->pxmit_urb[i])
+		{
+			//usb_kill_urb(pxmitbuf->pxmit_urb[i]);
+			usb_free_urb(pxmitbuf->pxmit_urb[i]);
+		}
+	}
+
+#ifdef CONFIG_USE_USB_BUFFER_ALLOC_TX
+	rtw_usb_buffer_free(pusbd, (size_t)free_sz, pxmitbuf->pallocated_buf, pxmitbuf->dma_transfer_addr);
+	pxmitbuf->pallocated_buf =  NULL;
+	pxmitbuf->dma_transfer_addr = 0;
+#else	// CONFIG_USE_USB_BUFFER_ALLOC_TX
+	if(pxmitbuf->pallocated_buf)
+		rtw_mfree(pxmitbuf->pallocated_buf, free_sz);
+#endif	// CONFIG_USE_USB_BUFFER_ALLOC_TX
+
+#endif
+#if defined(CONFIG_PCI_HCI) || defined(CONFIG_SDIO_HCI)
+	if(pxmitbuf->pallocated_buf)
+		rtw_mfree(pxmitbuf->pallocated_buf, free_sz);
+#endif
+}
+
+void rtw_os_pkt_complete(_adapter *padapter, _pkt *pkt)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
+	u16	queue;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+
+	queue = skb_get_queue_mapping(pkt);
+	if(__netif_subqueue_stopped(padapter->pnetdev, queue) &&
+		(pxmitpriv->hwxmits[queue].accnt < NR_XMITFRAME/2))
+	{
+		netif_wake_subqueue(padapter->pnetdev, queue);
+	}
+#else
+	if (netif_queue_stopped(padapter->pnetdev))
+		netif_wake_queue(padapter->pnetdev);
+#endif
+
+	rtw_skb_free(pkt);
+}
+
+void rtw_os_xmit_complete(_adapter *padapter, struct xmit_frame *pxframe)
+{
+	if(pxframe->pkt)
+		rtw_os_pkt_complete(padapter, pxframe->pkt);
+
+	pxframe->pkt = NULL;
+}
+
+void rtw_os_xmit_schedule(_adapter *padapter)
+{
+#ifdef CONFIG_SDIO_HCI
+	if(!padapter)
+		return;
+
+	if (rtw_txframes_pending(padapter))
+		_rtw_up_sema(&padapter->xmitpriv.xmit_sema);
+#else
+	_irqL  irqL;
+	struct xmit_priv *pxmitpriv;
+
+	if(!padapter)
+		return;
+
+	pxmitpriv = &padapter->xmitpriv;
+
+	_enter_critical_bh(&pxmitpriv->lock, &irqL);
+
+	if(rtw_txframes_pending(padapter))
+	{
+		tasklet_hi_schedule(&pxmitpriv->xmit_tasklet);
+	}
+
+	_exit_critical_bh(&pxmitpriv->lock, &irqL);
+#endif
+}
+
+
+
+#ifdef CONFIG_TX_MCAST2UNI
+int rtw_mlcst2unicst(_adapter *padapter, struct sk_buff *skb)
+{
+	struct	sta_priv *pstapriv = &padapter->stapriv;
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+	_irqL	irqL;
+	_list	*phead, *plist;
+	struct sk_buff *newskb;
+	struct sta_info *psta = NULL;
+	u8 chk_alive_num = 0;
+	char chk_alive_list[NUM_STA];
+	u8 bc_addr[6]={0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+	u8 null_addr[6]={0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+	int i;
+	s32	res;
+
+	_enter_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+	phead = &pstapriv->asoc_list;
+	plist = get_next(phead);
+
+	//free sta asoc_queue
+	while ((rtw_end_of_queue_search(phead, plist)) == _FALSE) {
+		int stainfo_offset;
+		psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
+		plist = get_next(plist);
+
+		stainfo_offset = rtw_stainfo_offset(pstapriv, psta);
+		if (stainfo_offset_valid(stainfo_offset)) {
+			chk_alive_list[chk_alive_num++] = stainfo_offset;
+		}
+	}
+	_exit_critical_bh(&pstapriv->asoc_list_lock, &irqL);
+
+	for (i = 0; i < chk_alive_num; i++) {
+		psta = rtw_get_stainfo_by_offset(pstapriv, chk_alive_list[i]);
+
+		/* avoid come from STA1 and send back STA1 */
+		if (_rtw_memcmp(psta->hwaddr, &skb->data[6], 6) == _TRUE
+			|| _rtw_memcmp(psta->hwaddr, null_addr, 6) == _TRUE
+			|| _rtw_memcmp(psta->hwaddr, bc_addr, 6) == _TRUE
+		)
+			continue;
+
+		newskb = rtw_skb_copy(skb);
+
+		if (newskb) {
+			_rtw_memcpy(newskb->data, psta->hwaddr, 6);
+			res = rtw_xmit(padapter, &newskb);
+			if (res < 0) {
+				DBG_871X("%s()-%d: rtw_xmit() return error!\n", __FUNCTION__, __LINE__);
+				pxmitpriv->tx_drop++;
+				rtw_skb_free(newskb);
+			} else
+				pxmitpriv->tx_pkts++;
+		} else {
+			DBG_871X("%s-%d: rtw_skb_copy() failed!\n", __FUNCTION__, __LINE__);
+			pxmitpriv->tx_drop++;
+			//rtw_skb_free(skb);
+			return _FALSE;	// Caller shall tx this multicast frame via normal way.
+		}
+	}
+
+	rtw_skb_free(skb);
+	return _TRUE;
+}
+#endif	// CONFIG_TX_MCAST2UNI
+
+
+int _rtw_xmit_entry(_pkt *pkt, _nic_hdl pnetdev)
+{
+	_adapter *padapter = (_adapter *)rtw_netdev_priv(pnetdev);
+	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
+#ifdef CONFIG_TX_MCAST2UNI
+	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
+	extern int rtw_mc2u_disable;
+#endif	// CONFIG_TX_MCAST2UNI
+	s32 res = 0;
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+	u16 queue;
+#endif
+
+_func_enter_;
+
+	RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("+xmit_enry\n"));
+
+	if (rtw_if_up(padapter) == _FALSE) {
+		RT_TRACE(_module_xmit_osdep_c_, _drv_err_, ("rtw_xmit_entry: rtw_if_up fail\n"));
+		#ifdef DBG_TX_DROP_FRAME
+		DBG_871X("DBG_TX_DROP_FRAME %s if_up fail\n", __FUNCTION__);
+		#endif
+		goto drop_packet;
+	}
+
+#if (LINUX_VERSION_CODE>=KERNEL_VERSION(2,6,35))
+	queue = skb_get_queue_mapping(pkt);
+	/* No free space for Tx, tx_worker is too slow */
+	if (pxmitpriv->hwxmits[queue].accnt > NR_XMITFRAME/2) {
+		//DBG_871X("%s(): stop netif_subqueue[%d]\n", __FUNCTION__, queue);
+		netif_stop_subqueue(padapter->pnetdev, queue);
+		return NETDEV_TX_BUSY;
+	}
+#endif
+
+#ifdef CONFIG_TX_MCAST2UNI
+	if ( !rtw_mc2u_disable
+		&& check_fwstate(pmlmepriv, WIFI_AP_STATE) == _TRUE
+		&& ( IP_MCAST_MAC(pkt->data)
+			|| ICMPV6_MCAST_MAC(pkt->data) )
+		&& (padapter->registrypriv.wifi_spec == 0)
+		)
+	{
+		if ( pxmitpriv->free_xmitframe_cnt > (NR_XMITFRAME/4) ) {
+			res = rtw_mlcst2unicst(padapter, pkt);
+			if (res == _TRUE) {
+				goto exit;
+			}
+		} else {
+			//DBG_871X("Stop M2U(%d, %d)! ", pxmitpriv->free_xmitframe_cnt, pxmitpriv->free_xmitbuf_cnt);
+			//DBG_871X("!m2u );
+		}
+	}
+#endif	// CONFIG_TX_MCAST2UNI
+
+	res = rtw_xmit(padapter, &pkt);
+	if (res < 0) {
+		#ifdef DBG_TX_DROP_FRAME
+		DBG_871X("DBG_TX_DROP_FRAME %s rtw_xmit fail\n", __FUNCTION__);
+		#endif
+		goto drop_packet;
+	}
+
+	pxmitpriv->tx_pkts++;
+	RT_TRACE(_module_xmit_osdep_c_, _drv_info_, ("rtw_xmit_entry: tx_pkts=%d\n", (u32)pxmitpriv->tx_pkts));
+	goto exit;
+
+drop_packet:
+	pxmitpriv->tx_drop++;
+	rtw_skb_free(pkt);
+	RT_TRACE(_module_xmit_osdep_c_, _drv_notice_, ("rtw_xmit_entry: drop, tx_drop=%d\n", (u32)pxmitpriv->tx_drop));
+
+exit:
+
+_func_exit_;
+
+	return 0;
+}
+
+int rtw_xmit_entry(_pkt *pkt, _nic_hdl pnetdev)
+{
+	if (pkt)
+		rtw_mstat_update(MSTAT_TYPE_SKB, MSTAT_ALLOC_SUCCESS, pkt->truesize);
+	return _rtw_xmit_entry(pkt, pnetdev);
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/os_dep/osdep_service.c b/drivers/net/wireless/realtek/rtl8192cu/os_dep/osdep_service.c
new file mode 100644
index 000000000000..4b113e945351
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/os_dep/osdep_service.c
@@ -0,0 +1,2299 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ *
+ ******************************************************************************/
+
+
+#define _OSDEP_SERVICE_C_
+
+#include <drv_conf.h>
+#include <osdep_service.h>
+#include <drv_types.h>
+#include <recv_osdep.h>
+#ifdef PLATFORM_LINUX
+#include <linux/vmalloc.h>
+#endif
+#ifdef PLATFORM_FREEBSD
+#include <sys/malloc.h>
+#include <sys/time.h>
+#endif /* PLATFORM_FREEBSD */
+#ifdef RTK_DMP_PLATFORM
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,12))
+#include <linux/pageremap.h>
+#endif
+#endif
+
+#define RT_TAG	'1178'
+
+#ifdef DBG_MEMORY_LEAK
+#ifdef PLATFORM_LINUX
+#include <asm/atomic.h>
+atomic_t _malloc_cnt = ATOMIC_INIT(0);
+atomic_t _malloc_size = ATOMIC_INIT(0);
+#endif
+#endif /* DBG_MEMORY_LEAK */
+
+
+#if defined(PLATFORM_LINUX)
+/*
+* Translate the OS dependent @param error_code to OS independent RTW_STATUS_CODE
+* @return: one of RTW_STATUS_CODE
+*/
+inline int RTW_STATUS_CODE(int error_code){
+	if(error_code >=0)
+		return _SUCCESS;
+
+	switch(error_code) {
+		//case -ETIMEDOUT:
+		//	return RTW_STATUS_TIMEDOUT;
+		default:
+			return _FAIL;
+	}
+}
+#else
+inline int RTW_STATUS_CODE(int error_code){
+	return error_code;
+}
+#endif
+
+u32 rtw_atoi(u8* s)
+{
+
+	int num=0,flag=0;
+	int i;
+	for(i=0;i<=strlen(s);i++)
+	{
+	  if(s[i] >= '0' && s[i] <= '9')
+		 num = num * 10 + s[i] -'0';
+	  else if(s[0] == '-' && i==0)
+		 flag =1;
+	  else
+		  break;
+	 }
+
+	if(flag == 1)
+	   num = num * -1;
+
+	 return(num);
+
+}
+
+inline u8* _rtw_vmalloc(u32 sz)
+{
+	u8 	*pbuf;
+#ifdef PLATFORM_LINUX
+	pbuf = vmalloc(sz);
+#endif
+#ifdef PLATFORM_FREEBSD
+	pbuf = malloc(sz,M_DEVBUF,M_NOWAIT);
+#endif
+
+#ifdef PLATFORM_WINDOWS
+	NdisAllocateMemoryWithTag(&pbuf,sz, RT_TAG);
+#endif
+
+#ifdef DBG_MEMORY_LEAK
+#ifdef PLATFORM_LINUX
+	if ( pbuf != NULL) {
+		atomic_inc(&_malloc_cnt);
+		atomic_add(sz, &_malloc_size);
+	}
+#endif
+#endif /* DBG_MEMORY_LEAK */
+
+	return pbuf;
+}
+
+inline u8* _rtw_zvmalloc(u32 sz)
+{
+	u8 	*pbuf;
+#ifdef PLATFORM_LINUX
+	pbuf = _rtw_vmalloc(sz);
+	if (pbuf != NULL)
+		memset(pbuf, 0, sz);
+#endif
+#ifdef PLATFORM_FREEBSD
+	pbuf = malloc(sz,M_DEVBUF,M_ZERO|M_NOWAIT);
+#endif
+#ifdef PLATFORM_WINDOWS
+	NdisAllocateMemoryWithTag(&pbuf,sz, RT_TAG);
+	if (pbuf != NULL)
+		NdisFillMemory(pbuf, sz, 0);
+#endif
+
+	return pbuf;
+}
+
+inline void _rtw_vmfree(u8 *pbuf, u32 sz)
+{
+#ifdef	PLATFORM_LINUX
+	vfree(pbuf);
+#endif
+#ifdef PLATFORM_FREEBSD
+	free(pbuf,M_DEVBUF);
+#endif
+#ifdef PLATFORM_WINDOWS
+	NdisFreeMemory(pbuf,sz, 0);
+#endif
+
+#ifdef DBG_MEMORY_LEAK
+#ifdef PLATFORM_LINUX
+	atomic_dec(&_malloc_cnt);
+	atomic_sub(sz, &_malloc_size);
+#endif
+#endif /* DBG_MEMORY_LEAK */
+}
+
+u8* _rtw_malloc(u32 sz)
+{
+
+	u8 	*pbuf=NULL;
+
+#ifdef PLATFORM_LINUX
+#ifdef RTK_DMP_PLATFORM
+	if(sz > 0x4000)
+		pbuf = (u8 *)dvr_malloc(sz);
+	else
+#endif
+		pbuf = kmalloc(sz,in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	pbuf = malloc(sz,M_DEVBUF,M_NOWAIT);
+#endif
+#ifdef PLATFORM_WINDOWS
+
+	NdisAllocateMemoryWithTag(&pbuf,sz, RT_TAG);
+
+#endif
+
+#ifdef DBG_MEMORY_LEAK
+#ifdef PLATFORM_LINUX
+	if ( pbuf != NULL) {
+		atomic_inc(&_malloc_cnt);
+		atomic_add(sz, &_malloc_size);
+	}
+#endif
+#endif /* DBG_MEMORY_LEAK */
+
+	return pbuf;
+
+}
+
+
+u8* _rtw_zmalloc(u32 sz)
+{
+#ifdef PLATFORM_FREEBSD
+	return malloc(sz,M_DEVBUF,M_ZERO|M_NOWAIT);
+#else // PLATFORM_FREEBSD
+	u8 	*pbuf = _rtw_malloc(sz);
+
+	if (pbuf != NULL) {
+
+#ifdef PLATFORM_LINUX
+		memset(pbuf, 0, sz);
+#endif
+
+#ifdef PLATFORM_WINDOWS
+		NdisFillMemory(pbuf, sz, 0);
+#endif
+
+	}
+
+	return pbuf;
+#endif // PLATFORM_FREEBSD
+}
+
+void	_rtw_mfree(u8 *pbuf, u32 sz)
+{
+
+#ifdef	PLATFORM_LINUX
+#ifdef RTK_DMP_PLATFORM
+	if(sz > 0x4000)
+		dvr_free(pbuf);
+	else
+#endif
+		kfree(pbuf);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	free(pbuf,M_DEVBUF);
+#endif
+#ifdef PLATFORM_WINDOWS
+
+	NdisFreeMemory(pbuf,sz, 0);
+
+#endif
+
+#ifdef DBG_MEMORY_LEAK
+#ifdef PLATFORM_LINUX
+	atomic_dec(&_malloc_cnt);
+	atomic_sub(sz, &_malloc_size);
+#endif
+#endif /* DBG_MEMORY_LEAK */
+
+}
+
+#ifdef PLATFORM_FREEBSD
+//review again
+struct sk_buff * dev_alloc_skb(unsigned int size)
+{
+	struct sk_buff *skb=NULL;
+	u8 *data=NULL;
+
+	//skb = (struct sk_buff *)_rtw_zmalloc(sizeof(struct sk_buff)); // for skb->len, etc.
+	skb = (struct sk_buff *)_rtw_malloc(sizeof(struct sk_buff));
+	if(!skb)
+		goto out;
+	data = _rtw_malloc(size);
+	if(!data)
+		goto nodata;
+
+	skb->head = (unsigned char*)data;
+	skb->data = (unsigned char*)data;
+	skb->tail = (unsigned char*)data;
+	skb->end = (unsigned char*)data + size;
+	skb->len = 0;
+	//printf("%s()-%d: skb=%p, skb->head = %p\n", __FUNCTION__, __LINE__, skb, skb->head);
+
+out:
+	return skb;
+nodata:
+	_rtw_mfree((u8 *)skb, sizeof(struct sk_buff));
+	skb = NULL;
+goto out;
+
+}
+
+void dev_kfree_skb_any(struct sk_buff *skb)
+{
+	//printf("%s()-%d: skb->head = %p\n", __FUNCTION__, __LINE__, skb->head);
+	if(skb->head)
+		_rtw_mfree(skb->head, 0);
+	//printf("%s()-%d: skb = %p\n", __FUNCTION__, __LINE__, skb);
+	if(skb)
+		_rtw_mfree((u8 *)skb, 0);
+}
+struct sk_buff *skb_clone(const struct sk_buff *skb)
+{
+	return NULL;
+}
+
+#endif /* PLATFORM_FREEBSD */
+
+inline struct sk_buff *_rtw_skb_alloc(u32 sz)
+{
+#ifdef PLATFORM_LINUX
+	return __dev_alloc_skb(sz, in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
+#endif /* PLATFORM_LINUX */
+
+#ifdef PLATFORM_FREEBSD
+	return dev_alloc_skb(sz);
+#endif /* PLATFORM_FREEBSD */
+}
+
+inline void _rtw_skb_free(struct sk_buff *skb)
+{
+	dev_kfree_skb_any(skb);
+}
+
+inline struct sk_buff *_rtw_skb_copy(const struct sk_buff *skb)
+{
+#ifdef PLATFORM_LINUX
+	return skb_copy(skb, in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
+#endif /* PLATFORM_LINUX */
+
+#ifdef PLATFORM_FREEBSD
+	return NULL;
+#endif /* PLATFORM_FREEBSD */
+}
+
+inline struct sk_buff *_rtw_skb_clone(struct sk_buff *skb)
+{
+#ifdef PLATFORM_LINUX
+	return skb_clone(skb, in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
+#endif /* PLATFORM_LINUX */
+
+#ifdef PLATFORM_FREEBSD
+	return skb_clone(skb);
+#endif /* PLATFORM_FREEBSD */
+}
+
+inline int _rtw_netif_rx(_nic_hdl ndev, struct sk_buff *skb)
+{
+#ifdef PLATFORM_LINUX
+	skb->dev = ndev;
+	return netif_rx(skb);
+#endif /* PLATFORM_LINUX */
+
+#ifdef PLATFORM_FREEBSD
+	return (*ndev->if_input)(ndev, skb);
+#endif /* PLATFORM_FREEBSD */
+}
+
+void _rtw_skb_queue_purge(struct sk_buff_head *list)
+{
+	struct sk_buff *skb;
+
+	while ((skb = skb_dequeue(list)) != NULL)
+		_rtw_skb_free(skb);
+}
+
+#ifdef CONFIG_USB_HCI
+inline void *_rtw_usb_buffer_alloc(struct usb_device *dev, size_t size, dma_addr_t *dma)
+{
+#ifdef PLATFORM_LINUX
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
+	return usb_alloc_coherent(dev, size, (in_interrupt() ? GFP_ATOMIC : GFP_KERNEL), dma);
+#else
+	return usb_buffer_alloc(dev, size, (in_interrupt() ? GFP_ATOMIC : GFP_KERNEL), dma);
+#endif
+#endif /* PLATFORM_LINUX */
+
+#ifdef PLATFORM_FREEBSD
+	return (malloc(size, M_USBDEV, M_NOWAIT | M_ZERO));
+#endif /* PLATFORM_FREEBSD */
+}
+inline void _rtw_usb_buffer_free(struct usb_device *dev, size_t size, void *addr, dma_addr_t dma)
+{
+#ifdef PLATFORM_LINUX
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
+	usb_free_coherent(dev, size, addr, dma);
+#else
+	usb_buffer_free(dev, size, addr, dma);
+#endif
+#endif /* PLATFORM_LINUX */
+
+#ifdef PLATFORM_FREEBSD
+	free(addr, M_USBDEV);
+#endif /* PLATFORM_FREEBSD */
+}
+#endif /* CONFIG_USB_HCI */
+
+#ifdef DBG_MEM_ALLOC
+
+struct rtw_mem_stat {
+	ATOMIC_T alloc; // the memory bytes we allocate currently
+	ATOMIC_T peak; // the peak memory bytes we allocate
+	ATOMIC_T alloc_cnt; // the alloc count for alloc currently
+	ATOMIC_T alloc_err_cnt; // the error times we fail to allocate memory
+};
+
+struct rtw_mem_stat rtw_mem_type_stat[mstat_tf_idx(MSTAT_TYPE_MAX)];
+struct rtw_mem_stat rtw_mem_func_stat[mstat_ff_idx(MSTAT_FUNC_MAX)];
+
+char *MSTAT_TYPE_str[] = {
+	"VIR",
+	"PHY",
+	"SKB",
+	"USB",
+};
+
+char *MSTAT_FUNC_str[] = {
+	"UNSP",
+	"IO",
+	"TXIO",
+	"RXIO",
+	"TX",
+	"RX",
+};
+
+int _rtw_mstat_dump(char *buf, int len)
+{
+	int cnt = 0;
+	int i;
+	int value_t[4][mstat_tf_idx(MSTAT_TYPE_MAX)];
+	int value_f[4][mstat_ff_idx(MSTAT_FUNC_MAX)];
+
+	int vir_alloc, vir_peak, vir_alloc_err, phy_alloc, phy_peak, phy_alloc_err;
+	int tx_alloc, tx_peak, tx_alloc_err, rx_alloc, rx_peak, rx_alloc_err;
+
+	for(i=0;i<mstat_tf_idx(MSTAT_TYPE_MAX);i++) {
+		value_t[0][i] = ATOMIC_READ(&(rtw_mem_type_stat[i].alloc));
+		value_t[1][i] = ATOMIC_READ(&(rtw_mem_type_stat[i].peak));
+		value_t[2][i] = ATOMIC_READ(&(rtw_mem_type_stat[i].alloc_cnt));
+		value_t[3][i] = ATOMIC_READ(&(rtw_mem_type_stat[i].alloc_err_cnt));
+	}
+
+	#if 0
+	for(i=0;i<mstat_ff_idx(MSTAT_FUNC_MAX);i++) {
+		value_f[0][i] = ATOMIC_READ(&(rtw_mem_func_stat[i].alloc));
+		value_f[1][i] = ATOMIC_READ(&(rtw_mem_func_stat[i].peak));
+		value_f[2][i] = ATOMIC_READ(&(rtw_mem_func_stat[i].alloc_cnt));
+		value_f[3][i] = ATOMIC_READ(&(rtw_mem_func_stat[i].alloc_err_cnt));
+	}
+	#endif
+
+	cnt += snprintf(buf+cnt, len-cnt, "===================== MSTAT =====================\n");
+	cnt += snprintf(buf+cnt, len-cnt, "%4s %10s %10s %10s %10s\n", "TAG", "alloc", "peak", "aloc_cnt", "err_cnt");
+	cnt += snprintf(buf+cnt, len-cnt, "-------------------------------------------------\n");
+	for(i=0;i<mstat_tf_idx(MSTAT_TYPE_MAX);i++) {
+		cnt += snprintf(buf+cnt, len-cnt, "%4s %10d %10d %10d %10d\n", MSTAT_TYPE_str[i], value_t[0][i], value_t[1][i], value_t[2][i], value_t[3][i]);
+	}
+	#if 0
+	cnt += snprintf(buf+cnt, len-cnt, "-------------------------------------------------\n");
+	for(i=0;i<mstat_ff_idx(MSTAT_FUNC_MAX);i++) {
+		cnt += snprintf(buf+cnt, len-cnt, "%4s %10d %10d %10d %10d\n", MSTAT_FUNC_str[i], value_f[0][i], value_f[1][i], value_f[2][i], value_f[3][i]);
+	}
+	#endif
+
+	return cnt;
+}
+
+void rtw_mstat_dump(void)
+{
+	char buf[768] = {0};
+
+	_rtw_mstat_dump(buf, 768);
+	DBG_871X("\n%s", buf);
+}
+
+void rtw_mstat_update(const enum mstat_f flags, const MSTAT_STATUS status, u32 sz)
+{
+	static u32 update_time = 0;
+	int peak, alloc;
+	int i;
+
+	/* initialization */
+	if(!update_time) {
+		for(i=0;i<mstat_tf_idx(MSTAT_TYPE_MAX);i++) {
+			ATOMIC_SET(&(rtw_mem_type_stat[i].alloc), 0);
+			ATOMIC_SET(&(rtw_mem_type_stat[i].peak), 0);
+			ATOMIC_SET(&(rtw_mem_type_stat[i].alloc_cnt), 0);
+			ATOMIC_SET(&(rtw_mem_type_stat[i].alloc_err_cnt), 0);
+		}
+		for(i=0;i<mstat_ff_idx(MSTAT_FUNC_MAX);i++) {
+			ATOMIC_SET(&(rtw_mem_func_stat[i].alloc), 0);
+			ATOMIC_SET(&(rtw_mem_func_stat[i].peak), 0);
+			ATOMIC_SET(&(rtw_mem_func_stat[i].alloc_cnt), 0);
+			ATOMIC_SET(&(rtw_mem_func_stat[i].alloc_err_cnt), 0);
+		}
+	}
+
+	switch(status) {
+		case MSTAT_ALLOC_SUCCESS:
+			ATOMIC_INC(&(rtw_mem_type_stat[mstat_tf_idx(flags)].alloc_cnt));
+			alloc = ATOMIC_ADD_RETURN(&(rtw_mem_type_stat[mstat_tf_idx(flags)].alloc), sz);
+			peak=ATOMIC_READ(&(rtw_mem_type_stat[mstat_tf_idx(flags)].peak));
+			if (peak<alloc)
+				ATOMIC_SET(&(rtw_mem_type_stat[mstat_tf_idx(flags)].peak), alloc);
+
+			ATOMIC_INC(&(rtw_mem_func_stat[mstat_ff_idx(flags)].alloc_cnt));
+			alloc = ATOMIC_ADD_RETURN(&(rtw_mem_func_stat[mstat_ff_idx(flags)].alloc), sz);
+			peak=ATOMIC_READ(&(rtw_mem_func_stat[mstat_ff_idx(flags)].peak));
+			if (peak<alloc)
+				ATOMIC_SET(&(rtw_mem_func_stat[mstat_ff_idx(flags)].peak), alloc);
+			break;
+
+		case MSTAT_ALLOC_FAIL:
+			ATOMIC_INC(&(rtw_mem_type_stat[mstat_tf_idx(flags)].alloc_err_cnt));
+
+			ATOMIC_INC(&(rtw_mem_func_stat[mstat_ff_idx(flags)].alloc_err_cnt));
+			break;
+
+		case MSTAT_FREE:
+			ATOMIC_DEC(&(rtw_mem_type_stat[mstat_tf_idx(flags)].alloc_cnt));
+			ATOMIC_SUB(&(rtw_mem_type_stat[mstat_tf_idx(flags)].alloc), sz);
+
+			ATOMIC_DEC(&(rtw_mem_func_stat[mstat_ff_idx(flags)].alloc_cnt));
+			ATOMIC_SUB(&(rtw_mem_func_stat[mstat_ff_idx(flags)].alloc), sz);
+			break;
+	};
+
+	//if (rtw_get_passing_time_ms(update_time) > 5000) {
+	//	rtw_mstat_dump();
+		update_time=rtw_get_current_time();
+	//}
+}
+
+
+
+inline u8* dbg_rtw_vmalloc(u32 sz, const enum mstat_f flags, const char *func, const int line)
+{
+	u8  *p;
+	//DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d)\n", func,  line, __FUNCTION__, (sz));
+
+	p=_rtw_vmalloc((sz));
+
+	rtw_mstat_update(
+		flags
+		, p ? MSTAT_ALLOC_SUCCESS : MSTAT_ALLOC_FAIL
+		, sz
+	);
+
+	return p;
+}
+
+inline u8* dbg_rtw_zvmalloc(u32 sz, const enum mstat_f flags, const char *func, const int line)
+{
+	u8 *p;
+	//DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d)\n", func, line, __FUNCTION__, (sz));
+
+	p=_rtw_zvmalloc((sz));
+
+	rtw_mstat_update(
+		flags
+		, p ? MSTAT_ALLOC_SUCCESS : MSTAT_ALLOC_FAIL
+		, sz
+	);
+
+	return p;
+}
+
+inline void dbg_rtw_vmfree(u8 *pbuf, u32 sz, const enum mstat_f flags, const char *func, const int line)
+{
+	//DBG_871X("DBG_MEM_ALLOC %s:%d %s(%p,%d)\n",  func, line, __FUNCTION__, (pbuf), (sz));
+
+	_rtw_vmfree((pbuf), (sz));
+
+	rtw_mstat_update(
+		flags
+		, MSTAT_FREE
+		, sz
+	);
+}
+
+inline u8* dbg_rtw_malloc(u32 sz, const enum mstat_f flags, const char *func, const int line)
+{
+	u8 *p;
+
+	//if(sz>=153 && sz<=306)
+	//	DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d)\n", func, line, __FUNCTION__, (sz));
+
+	//if((sz)>4096)
+	//	DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d)\n", func, line, __FUNCTION__, (sz));
+
+	p=_rtw_malloc((sz));
+
+	rtw_mstat_update(
+		flags
+		, p ? MSTAT_ALLOC_SUCCESS : MSTAT_ALLOC_FAIL
+		, sz
+	);
+
+	return p;
+}
+
+inline u8* dbg_rtw_zmalloc(u32 sz, const enum mstat_f flags, const char *func, const int line)
+{
+	u8 *p;
+
+	//if(sz>=153 && sz<=306)
+	//	DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d)\n", func, line, __FUNCTION__, (sz));
+
+	//if((sz)>4096)
+	//	DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d)\n", func, line, __FUNCTION__, (sz));
+
+	p = _rtw_zmalloc((sz));
+
+	rtw_mstat_update(
+		flags
+		, p ? MSTAT_ALLOC_SUCCESS : MSTAT_ALLOC_FAIL
+		, sz
+	);
+
+	return p;
+}
+
+inline void dbg_rtw_mfree(u8 *pbuf, u32 sz, const enum mstat_f flags, const char *func, const int line)
+{
+	//if(sz>=153 && sz<=306)
+	//	DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d)\n", func, line, __FUNCTION__, (sz));
+
+	//if((sz)>4096)
+	//	DBG_871X("DBG_MEM_ALLOC %s:%d %s(%p,%d)\n", func, line, __FUNCTION__, (pbuf), (sz));
+
+	_rtw_mfree((pbuf), (sz));
+
+	rtw_mstat_update(
+		flags
+		, MSTAT_FREE
+		, sz
+	);
+}
+
+inline struct sk_buff * dbg_rtw_skb_alloc(unsigned int size, const enum mstat_f flags, const char *func, int line)
+{
+	struct sk_buff *skb;
+	unsigned int truesize = 0;
+
+	skb = _rtw_skb_alloc(size);
+
+	if(skb)
+		truesize = skb->truesize;
+
+	if(!skb || truesize < size /*|| size > 4096*/)
+		DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d), skb:%p, truesize=%u\n", func, line, __FUNCTION__, size, skb, truesize);
+
+	rtw_mstat_update(
+		flags
+		, skb ? MSTAT_ALLOC_SUCCESS : MSTAT_ALLOC_FAIL
+		, truesize
+	);
+
+	return skb;
+}
+
+inline void dbg_rtw_skb_free(struct sk_buff *skb, const enum mstat_f flags, const char *func, int line)
+{
+	unsigned int truesize = skb->truesize;
+
+	//if(truesize > 4096)
+	//	DBG_871X("DBG_MEM_ALLOC %s:%d %s, truesize=%u\n", func, line, __FUNCTION__, truesize);
+
+	_rtw_skb_free(skb);
+
+	rtw_mstat_update(
+		flags
+		, MSTAT_FREE
+		, truesize
+	);
+}
+
+inline struct sk_buff *dbg_rtw_skb_copy(const struct sk_buff *skb, const enum mstat_f flags, const char *func, const int line)
+{
+	struct sk_buff *skb_cp;
+	unsigned int truesize = skb->truesize;
+	unsigned int cp_truesize = 0;
+
+	skb_cp = _rtw_skb_copy(skb);
+	if(skb_cp)
+		cp_truesize = skb_cp->truesize;
+
+	if(!skb_cp || cp_truesize != truesize /*||cp_truesize > 4096*/)
+		DBG_871X("DBG_MEM_ALLOC %s:%d %s(%u), skb_cp:%p, cp_truesize=%u\n", func, line, __FUNCTION__, truesize, skb_cp, cp_truesize);
+
+	rtw_mstat_update(
+		flags
+		, skb_cp ? MSTAT_ALLOC_SUCCESS : MSTAT_ALLOC_FAIL
+		, truesize
+	);
+
+	return skb_cp;
+}
+
+inline struct sk_buff *dbg_rtw_skb_clone(struct sk_buff *skb, const enum mstat_f flags, const char *func, const int line)
+{
+	struct sk_buff *skb_cl;
+	unsigned int truesize = skb->truesize;
+	unsigned int cl_truesize = 0;
+
+	skb_cl = _rtw_skb_clone(skb);
+	if(skb_cl)
+		cl_truesize = skb_cl->truesize;
+
+	if(!skb_cl || cl_truesize != truesize /*|| cl_truesize > 4096*/)
+		DBG_871X("DBG_MEM_ALLOC %s:%d %s(%u), skb_cl:%p, cl_truesize=%u\n", func, line, __FUNCTION__, truesize, skb_cl, cl_truesize);
+
+	rtw_mstat_update(
+		flags
+		, skb_cl ? MSTAT_ALLOC_SUCCESS : MSTAT_ALLOC_FAIL
+		, truesize
+	);
+
+	return skb_cl;
+}
+
+inline int dbg_rtw_netif_rx(_nic_hdl ndev, struct sk_buff *skb, const enum mstat_f flags, const char *func, int line)
+{
+	int ret;
+	unsigned int truesize = skb->truesize;
+
+	//if(truesize > 4096)
+	//	DBG_871X("DBG_MEM_ALLOC %s:%d %s, truesize=%u\n", func, line, __FUNCTION__, truesize);
+
+	ret = _rtw_netif_rx(ndev, skb);
+
+	rtw_mstat_update(
+		flags
+		, MSTAT_FREE
+		, truesize
+	);
+
+	return ret;
+}
+
+inline void dbg_rtw_skb_queue_purge(struct sk_buff_head *list, enum mstat_f flags, const char *func, int line)
+{
+	struct sk_buff *skb;
+
+	while ((skb = skb_dequeue(list)) != NULL)
+		dbg_rtw_skb_free(skb, flags, func, line);
+}
+
+#ifdef CONFIG_USB_HCI
+inline void *dbg_rtw_usb_buffer_alloc(struct usb_device *dev, size_t size, dma_addr_t *dma, const enum mstat_f flags, const char *func, int line)
+{
+	void *p;
+	//DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d)\n", func, line, __FUNCTION__, size);
+
+	p = _rtw_usb_buffer_alloc(dev, size, dma);
+
+	rtw_mstat_update(
+		flags
+		, p ? MSTAT_ALLOC_SUCCESS : MSTAT_ALLOC_FAIL
+		, size
+	);
+
+	return p;
+}
+
+inline void dbg_rtw_usb_buffer_free(struct usb_device *dev, size_t size, void *addr, dma_addr_t dma, const enum mstat_f flags, const char *func, int line)
+{
+	//DBG_871X("DBG_MEM_ALLOC %s:%d %s(%d)\n", func, line, __FUNCTION__, size);
+
+	_rtw_usb_buffer_free(dev, size, addr, dma);
+
+	rtw_mstat_update(
+		flags
+		, MSTAT_FREE
+		, size
+	);
+}
+#endif /* CONFIG_USB_HCI */
+#endif /* DBG_MEM_ALLOC */
+
+void* rtw_malloc2d(int h, int w, int size)
+{
+	int j;
+
+	void **a = (void **) rtw_zmalloc( h*sizeof(void *) + h*w*size );
+	if(a == NULL)
+	{
+		DBG_871X("%s: alloc memory fail!\n", __FUNCTION__);
+		return NULL;
+	}
+
+	for( j=0; j<h; j++ )
+		a[j] = ((char *)(a+h)) + j*w*size;
+
+	return a;
+}
+
+void rtw_mfree2d(void *pbuf, int h, int w, int size)
+{
+	rtw_mfree((u8 *)pbuf, h*sizeof(void*) + w*h*size);
+}
+
+void _rtw_memcpy(void* dst, const void* src, u32 sz)
+{
+
+#if defined (PLATFORM_LINUX)|| defined (PLATFORM_FREEBSD)
+
+	memcpy(dst, src, sz);
+
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+	NdisMoveMemory(dst, src, sz);
+
+#endif
+
+}
+
+int	_rtw_memcmp(const void *dst, const void *src, u32 sz)
+{
+
+#if defined (PLATFORM_LINUX)|| defined (PLATFORM_FREEBSD)
+//under Linux/GNU/GLibc, the return value of memcmp for two same mem. chunk is 0
+
+	if (!(memcmp(dst, src, sz)))
+		return _TRUE;
+	else
+		return _FALSE;
+#endif
+
+
+#ifdef PLATFORM_WINDOWS
+//under Windows, the return value of NdisEqualMemory for two same mem. chunk is 1
+
+	if (NdisEqualMemory (dst, src, sz))
+		return _TRUE;
+	else
+		return _FALSE;
+
+#endif
+
+
+
+}
+
+void _rtw_memset(void *pbuf, int c, u32 sz)
+{
+
+#if defined (PLATFORM_LINUX)|| defined (PLATFORM_FREEBSD)
+
+        memset(pbuf, c, sz);
+
+#endif
+
+#ifdef PLATFORM_WINDOWS
+#if 0
+	NdisZeroMemory(pbuf, sz);
+	if (c != 0) memset(pbuf, c, sz);
+#else
+	NdisFillMemory(pbuf, sz, c);
+#endif
+#endif
+
+}
+
+#ifdef PLATFORM_FREEBSD
+static inline void __list_add(_list *pnew, _list *pprev, _list *pnext)
+ {
+         pnext->prev = pnew;
+         pnew->next = pnext;
+         pnew->prev = pprev;
+         pprev->next = pnew;
+}
+#endif /* PLATFORM_FREEBSD */
+
+void _rtw_init_listhead(_list *list)
+{
+
+#ifdef PLATFORM_LINUX
+
+        INIT_LIST_HEAD(list);
+
+#endif
+
+#ifdef PLATFORM_FREEBSD
+         list->next = list;
+         list->prev = list;
+#endif
+#ifdef PLATFORM_WINDOWS
+
+        NdisInitializeListHead(list);
+
+#endif
+
+}
+
+
+/*
+For the following list_xxx operations,
+caller must guarantee the atomic context.
+Otherwise, there will be racing condition.
+*/
+u32	rtw_is_list_empty(_list *phead)
+{
+
+#ifdef PLATFORM_LINUX
+
+	if (list_empty(phead))
+		return _TRUE;
+	else
+		return _FALSE;
+
+#endif
+#ifdef PLATFORM_FREEBSD
+
+	if (phead->next == phead)
+		return _TRUE;
+	else
+		return _FALSE;
+
+#endif
+
+
+#ifdef PLATFORM_WINDOWS
+
+	if (IsListEmpty(phead))
+		return _TRUE;
+	else
+		return _FALSE;
+
+#endif
+
+
+}
+
+void rtw_list_insert_head(_list *plist, _list *phead)
+{
+
+#ifdef PLATFORM_LINUX
+	list_add(plist, phead);
+#endif
+
+#ifdef PLATFORM_FREEBSD
+	__list_add(plist, phead, phead->next);
+#endif
+
+#ifdef PLATFORM_WINDOWS
+	InsertHeadList(phead, plist);
+#endif
+}
+
+void rtw_list_insert_tail(_list *plist, _list *phead)
+{
+
+#ifdef PLATFORM_LINUX
+
+	list_add_tail(plist, phead);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+
+	__list_add(plist, phead->prev, phead);
+
+#endif
+#ifdef PLATFORM_WINDOWS
+
+  InsertTailList(phead, plist);
+
+#endif
+
+}
+
+
+/*
+
+Caller must check if the list is empty before calling rtw_list_delete
+
+*/
+
+
+void _rtw_init_sema(_sema	*sema, int init_val)
+{
+
+#ifdef PLATFORM_LINUX
+
+	sema_init(sema, init_val);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	sema_init(sema, init_val, "rtw_drv");
+#endif
+#ifdef PLATFORM_OS_XP
+
+	KeInitializeSemaphore(sema, init_val,  SEMA_UPBND); // count=0;
+
+#endif
+
+#ifdef PLATFORM_OS_CE
+	if(*sema == NULL)
+		*sema = CreateSemaphore(NULL, init_val, SEMA_UPBND, NULL);
+#endif
+
+}
+
+void _rtw_free_sema(_sema	*sema)
+{
+#ifdef PLATFORM_FREEBSD
+	sema_destroy(sema);
+#endif
+#ifdef PLATFORM_OS_CE
+	CloseHandle(*sema);
+#endif
+
+}
+
+void _rtw_up_sema(_sema	*sema)
+{
+
+#ifdef PLATFORM_LINUX
+
+	up(sema);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	sema_post(sema);
+#endif
+#ifdef PLATFORM_OS_XP
+
+	KeReleaseSemaphore(sema, IO_NETWORK_INCREMENT, 1,  FALSE );
+
+#endif
+
+#ifdef PLATFORM_OS_CE
+	ReleaseSemaphore(*sema,  1,  NULL );
+#endif
+}
+
+u32 _rtw_down_sema(_sema *sema)
+{
+
+#ifdef PLATFORM_LINUX
+
+	if (down_interruptible(sema))
+		return _FAIL;
+	else
+		return _SUCCESS;
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	sema_wait(sema);
+	return  _SUCCESS;
+#endif
+#ifdef PLATFORM_OS_XP
+
+	if(STATUS_SUCCESS == KeWaitForSingleObject(sema, Executive, KernelMode, TRUE, NULL))
+		return  _SUCCESS;
+	else
+		return _FAIL;
+#endif
+
+#ifdef PLATFORM_OS_CE
+	if(WAIT_OBJECT_0 == WaitForSingleObject(*sema, INFINITE ))
+		return _SUCCESS;
+	else
+		return _FAIL;
+#endif
+}
+
+
+
+void	_rtw_mutex_init(_mutex *pmutex)
+{
+#ifdef PLATFORM_LINUX
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+	mutex_init(pmutex);
+#else
+	init_MUTEX(pmutex);
+#endif
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	mtx_init(pmutex, "", NULL, MTX_DEF|MTX_RECURSE);
+#endif
+#ifdef PLATFORM_OS_XP
+
+	KeInitializeMutex(pmutex, 0);
+
+#endif
+
+#ifdef PLATFORM_OS_CE
+	*pmutex =  CreateMutex( NULL, _FALSE, NULL);
+#endif
+}
+
+void	_rtw_mutex_free(_mutex *pmutex);
+void	_rtw_mutex_free(_mutex *pmutex)
+{
+#ifdef PLATFORM_LINUX
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,37))
+	mutex_destroy(pmutex);
+#else
+#endif
+
+#ifdef PLATFORM_FREEBSD
+	sema_destroy(pmutex);
+#endif
+
+#endif
+
+#ifdef PLATFORM_OS_XP
+
+#endif
+
+#ifdef PLATFORM_OS_CE
+
+#endif
+}
+
+void	_rtw_spinlock_init(_lock *plock)
+{
+
+#ifdef PLATFORM_LINUX
+
+	spin_lock_init(plock);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+		mtx_init(plock, "", NULL, MTX_DEF|MTX_RECURSE);
+#endif
+#ifdef PLATFORM_WINDOWS
+
+	NdisAllocateSpinLock(plock);
+
+#endif
+
+}
+
+void	_rtw_spinlock_free(_lock *plock)
+{
+#ifdef PLATFORM_FREEBSD
+	 mtx_destroy(plock);
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+	NdisFreeSpinLock(plock);
+
+#endif
+
+}
+#ifdef PLATFORM_FREEBSD
+extern PADAPTER prtw_lock;
+
+void rtw_mtx_lock(_lock *plock){
+	if(prtw_lock){
+		mtx_lock(&prtw_lock->glock);
+	}
+	else{
+		printf("%s prtw_lock==NULL",__FUNCTION__);
+	}
+}
+void rtw_mtx_unlock(_lock *plock){
+	if(prtw_lock){
+		mtx_unlock(&prtw_lock->glock);
+	}
+	else{
+		printf("%s prtw_lock==NULL",__FUNCTION__);
+	}
+
+}
+#endif //PLATFORM_FREEBSD
+
+
+void	_rtw_spinlock(_lock	*plock)
+{
+
+#ifdef PLATFORM_LINUX
+
+	spin_lock(plock);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	mtx_lock(plock);
+#endif
+#ifdef PLATFORM_WINDOWS
+
+	NdisAcquireSpinLock(plock);
+
+#endif
+
+}
+
+void	_rtw_spinunlock(_lock *plock)
+{
+
+#ifdef PLATFORM_LINUX
+
+	spin_unlock(plock);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	mtx_unlock(plock);
+#endif
+#ifdef PLATFORM_WINDOWS
+
+	NdisReleaseSpinLock(plock);
+
+#endif
+}
+
+
+void	_rtw_spinlock_ex(_lock	*plock)
+{
+
+#ifdef PLATFORM_LINUX
+
+	spin_lock(plock);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	mtx_lock(plock);
+#endif
+#ifdef PLATFORM_WINDOWS
+
+	NdisDprAcquireSpinLock(plock);
+
+#endif
+
+}
+
+void	_rtw_spinunlock_ex(_lock *plock)
+{
+
+#ifdef PLATFORM_LINUX
+
+	spin_unlock(plock);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	mtx_unlock(plock);
+#endif
+#ifdef PLATFORM_WINDOWS
+
+	NdisDprReleaseSpinLock(plock);
+
+#endif
+}
+
+
+
+void	_rtw_init_queue(_queue	*pqueue)
+{
+
+	_rtw_init_listhead(&(pqueue->queue));
+
+	_rtw_spinlock_init(&(pqueue->lock));
+
+}
+
+u32	  _rtw_queue_empty(_queue	*pqueue)
+{
+	return (rtw_is_list_empty(&(pqueue->queue)));
+}
+
+
+u32 rtw_end_of_queue_search(_list *head, _list *plist)
+{
+	if (head == plist)
+		return _TRUE;
+	else
+		return _FALSE;
+}
+
+
+u32	rtw_get_current_time(void)
+{
+
+#ifdef PLATFORM_LINUX
+	return jiffies;
+#endif
+#ifdef PLATFORM_FREEBSD
+	struct timeval tvp;
+	getmicrotime(&tvp);
+	return tvp.tv_sec;
+#endif
+#ifdef PLATFORM_WINDOWS
+	LARGE_INTEGER	SystemTime;
+	NdisGetCurrentSystemTime(&SystemTime);
+	return (u32)(SystemTime.LowPart);// count of 100-nanosecond intervals
+#endif
+}
+
+inline u32 rtw_systime_to_ms(u32 systime)
+{
+#ifdef PLATFORM_LINUX
+	return systime * 1000 / HZ;
+#endif
+#ifdef PLATFORM_FREEBSD
+	return systime * 1000;
+#endif
+#ifdef PLATFORM_WINDOWS
+	return systime / 10000 ;
+#endif
+}
+
+inline u32 rtw_ms_to_systime(u32 ms)
+{
+#ifdef PLATFORM_LINUX
+	return ms * HZ / 1000;
+#endif
+#ifdef PLATFORM_FREEBSD
+	return ms /1000;
+#endif
+#ifdef PLATFORM_WINDOWS
+	return ms * 10000 ;
+#endif
+}
+
+// the input parameter start use the same unit as returned by rtw_get_current_time
+inline s32 rtw_get_passing_time_ms(u32 start)
+{
+#ifdef PLATFORM_LINUX
+	return rtw_systime_to_ms(jiffies-start);
+#endif
+#ifdef PLATFORM_FREEBSD
+	return rtw_systime_to_ms(rtw_get_current_time());
+#endif
+#ifdef PLATFORM_WINDOWS
+	LARGE_INTEGER	SystemTime;
+	NdisGetCurrentSystemTime(&SystemTime);
+	return rtw_systime_to_ms((u32)(SystemTime.LowPart) - start) ;
+#endif
+}
+
+inline s32 rtw_get_time_interval_ms(u32 start, u32 end)
+{
+#ifdef PLATFORM_LINUX
+	return rtw_systime_to_ms(end-start);
+#endif
+#ifdef PLATFORM_FREEBSD
+	return rtw_systime_to_ms(rtw_get_current_time());
+#endif
+#ifdef PLATFORM_WINDOWS
+	return rtw_systime_to_ms(end-start);
+#endif
+}
+
+
+void rtw_sleep_schedulable(int ms)
+{
+
+#ifdef PLATFORM_LINUX
+
+    u32 delta;
+
+    delta = (ms * HZ)/1000;//(ms)
+    if (delta == 0) {
+        delta = 1;// 1 ms
+    }
+    set_current_state(TASK_INTERRUPTIBLE);
+    if (schedule_timeout(delta) != 0) {
+        return ;
+    }
+    return;
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	DELAY(ms*1000);
+	return ;
+#endif
+
+#ifdef PLATFORM_WINDOWS
+
+	NdisMSleep(ms*1000); //(us)*1000=(ms)
+
+#endif
+
+}
+
+
+void rtw_msleep_os(int ms)
+{
+
+#ifdef PLATFORM_LINUX
+
+	msleep((unsigned int)ms);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+       //Delay for delay microseconds
+	DELAY(ms*1000);
+	return ;
+#endif
+#ifdef PLATFORM_WINDOWS
+
+	NdisMSleep(ms*1000); //(us)*1000=(ms)
+
+#endif
+
+
+}
+void rtw_usleep_os(int us)
+{
+
+#ifdef PLATFORM_LINUX
+
+      // msleep((unsigned int)us);
+      if ( 1 < (us/1000) )
+                msleep(1);
+      else
+		msleep( (us/1000) + 1);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	//Delay for delay microseconds
+	DELAY(us);
+
+	return ;
+#endif
+#ifdef PLATFORM_WINDOWS
+
+	NdisMSleep(us); //(us)
+
+#endif
+
+
+}
+
+
+#ifdef DBG_DELAY_OS
+void _rtw_mdelay_os(int ms, const char *func, const int line)
+{
+	#if 0
+	if(ms>10)
+		DBG_871X("%s:%d %s(%d)\n", func, line, __FUNCTION__, ms);
+		rtw_msleep_os(ms);
+	return;
+	#endif
+
+
+	DBG_871X("%s:%d %s(%d)\n", func, line, __FUNCTION__, ms);
+
+#if defined(PLATFORM_LINUX)
+
+	mdelay((unsigned long)ms);
+
+#elif defined(PLATFORM_WINDOWS)
+
+	NdisStallExecution(ms*1000); //(us)*1000=(ms)
+
+#endif
+
+
+}
+void _rtw_udelay_os(int us, const char *func, const int line)
+{
+
+	#if 0
+	if(us > 1000) {
+	DBG_871X("%s:%d %s(%d)\n", func, line, __FUNCTION__, us);
+		rtw_usleep_os(us);
+		return;
+	}
+	#endif
+
+
+	DBG_871X("%s:%d %s(%d)\n", func, line, __FUNCTION__, us);
+
+
+#if defined(PLATFORM_LINUX)
+
+      udelay((unsigned long)us);
+
+#elif defined(PLATFORM_WINDOWS)
+
+	NdisStallExecution(us); //(us)
+
+#endif
+
+}
+#else
+void rtw_mdelay_os(int ms)
+{
+
+#ifdef PLATFORM_LINUX
+
+	mdelay((unsigned long)ms);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	DELAY(ms*1000);
+	return ;
+#endif
+#ifdef PLATFORM_WINDOWS
+
+	NdisStallExecution(ms*1000); //(us)*1000=(ms)
+
+#endif
+
+
+}
+void rtw_udelay_os(int us)
+{
+
+#ifdef PLATFORM_LINUX
+
+      udelay((unsigned long)us);
+
+#endif
+#ifdef PLATFORM_FREEBSD
+	//Delay for delay microseconds
+	DELAY(us);
+	return ;
+#endif
+#ifdef PLATFORM_WINDOWS
+
+	NdisStallExecution(us); //(us)
+
+#endif
+
+}
+#endif
+
+void rtw_yield_os()
+{
+#ifdef PLATFORM_LINUX
+	yield();
+#endif
+#ifdef PLATFORM_FREEBSD
+	yield();
+#endif
+#ifdef PLATFORM_WINDOWS
+	SwitchToThread();
+#endif
+}
+
+#define RTW_SUSPEND_LOCK_NAME "rtw_wifi"
+
+#ifdef CONFIG_WAKELOCK
+static struct wake_lock rtw_suspend_lock;
+#elif defined(CONFIG_ANDROID_POWER)
+static android_suspend_lock_t rtw_suspend_lock ={
+	.name = RTW_SUSPEND_LOCK_NAME
+};
+#endif
+
+inline void rtw_suspend_lock_init()
+{
+	#ifdef CONFIG_WAKELOCK
+	wake_lock_init(&rtw_suspend_lock, WAKE_LOCK_SUSPEND, RTW_SUSPEND_LOCK_NAME);
+	#elif defined(CONFIG_ANDROID_POWER)
+	android_init_suspend_lock(&rtw_suspend_lock);
+	#endif
+}
+
+inline void rtw_suspend_lock_uninit()
+{
+	#ifdef CONFIG_WAKELOCK
+	wake_lock_destroy(&rtw_suspend_lock);
+	#elif defined(CONFIG_ANDROID_POWER)
+	android_uninit_suspend_lock(&rtw_suspend_lock);
+	#endif
+}
+
+inline void rtw_lock_suspend()
+{
+	#ifdef CONFIG_WAKELOCK
+	wake_lock(&rtw_suspend_lock);
+	#elif defined(CONFIG_ANDROID_POWER)
+	android_lock_suspend(&rtw_suspend_lock);
+	#endif
+}
+
+inline void rtw_unlock_suspend()
+{
+	#ifdef CONFIG_WAKELOCK
+	wake_unlock(&rtw_suspend_lock);
+	#elif defined(CONFIG_ANDROID_POWER)
+	android_unlock_suspend(&rtw_suspend_lock);
+	#endif
+}
+
+inline void rtw_lock_suspend_timeout(u32 timeout_ms)
+{
+	#ifdef CONFIG_WAKELOCK
+	wake_lock_timeout(&rtw_suspend_lock, rtw_ms_to_systime(timeout_ms));
+	#elif defined(CONFIG_ANDROID_POWER)
+	android_lock_suspend_auto_expire(&rtw_suspend_lock, rtw_ms_to_systime(timeout_ms));
+	#endif
+}
+
+inline void ATOMIC_SET(ATOMIC_T *v, int i)
+{
+	#ifdef PLATFORM_LINUX
+	atomic_set(v,i);
+	#elif defined(PLATFORM_WINDOWS)
+	*v=i;// other choice????
+	#elif defined(PLATFORM_FREEBSD)
+	atomic_set_int(v,i);
+	#endif
+}
+
+inline int ATOMIC_READ(ATOMIC_T *v)
+{
+	#ifdef PLATFORM_LINUX
+	return atomic_read(v);
+	#elif defined(PLATFORM_WINDOWS)
+	return *v; // other choice????
+	#elif defined(PLATFORM_FREEBSD)
+	return atomic_load_acq_32(v);
+	#endif
+}
+
+inline void ATOMIC_ADD(ATOMIC_T *v, int i)
+{
+	#ifdef PLATFORM_LINUX
+	atomic_add(i,v);
+	#elif defined(PLATFORM_WINDOWS)
+	InterlockedAdd(v,i);
+	#elif defined(PLATFORM_FREEBSD)
+	atomic_add_int(v,i);
+	#endif
+}
+inline void ATOMIC_SUB(ATOMIC_T *v, int i)
+{
+	#ifdef PLATFORM_LINUX
+	atomic_sub(i,v);
+	#elif defined(PLATFORM_WINDOWS)
+	InterlockedAdd(v,-i);
+	#elif defined(PLATFORM_FREEBSD)
+	atomic_subtract_int(v,i);
+	#endif
+}
+
+inline void ATOMIC_INC(ATOMIC_T *v)
+{
+	#ifdef PLATFORM_LINUX
+	atomic_inc(v);
+	#elif defined(PLATFORM_WINDOWS)
+	InterlockedIncrement(v);
+	#elif defined(PLATFORM_FREEBSD)
+	atomic_add_int(v,1);
+	#endif
+}
+
+inline void ATOMIC_DEC(ATOMIC_T *v)
+{
+	#ifdef PLATFORM_LINUX
+	atomic_dec(v);
+	#elif defined(PLATFORM_WINDOWS)
+	InterlockedDecrement(v);
+	#elif defined(PLATFORM_FREEBSD)
+	atomic_subtract_int(v,1);
+	#endif
+}
+
+inline int ATOMIC_ADD_RETURN(ATOMIC_T *v, int i)
+{
+	#ifdef PLATFORM_LINUX
+	return atomic_add_return(i,v);
+	#elif defined(PLATFORM_WINDOWS)
+	return InterlockedAdd(v,i);
+	#elif defined(PLATFORM_FREEBSD)
+	atomic_add_int(v,i);
+	return atomic_load_acq_32(v);
+	#endif
+}
+
+inline int ATOMIC_SUB_RETURN(ATOMIC_T *v, int i)
+{
+	#ifdef PLATFORM_LINUX
+	return atomic_sub_return(i,v);
+	#elif defined(PLATFORM_WINDOWS)
+	return InterlockedAdd(v,-i);
+	#elif defined(PLATFORM_FREEBSD)
+	atomic_subtract_int(v,i);
+	return atomic_load_acq_32(v);
+	#endif
+}
+
+inline int ATOMIC_INC_RETURN(ATOMIC_T *v)
+{
+	#ifdef PLATFORM_LINUX
+	return atomic_inc_return(v);
+	#elif defined(PLATFORM_WINDOWS)
+	return InterlockedIncrement(v);
+	#elif defined(PLATFORM_FREEBSD)
+	atomic_add_int(v,1);
+	return atomic_load_acq_32(v);
+	#endif
+}
+
+inline int ATOMIC_DEC_RETURN(ATOMIC_T *v)
+{
+	#ifdef PLATFORM_LINUX
+	return atomic_dec_return(v);
+	#elif defined(PLATFORM_WINDOWS)
+	return InterlockedDecrement(v);
+	#elif defined(PLATFORM_FREEBSD)
+	atomic_subtract_int(v,1);
+	return atomic_load_acq_32(v);
+	#endif
+}
+
+
+#ifdef PLATFORM_LINUX
+/*
+* Open a file with the specific @param path, @param flag, @param mode
+* @param fpp the pointer of struct file pointer to get struct file pointer while file opening is success
+* @param path the path of the file to open
+* @param flag file operation flags, please refer to linux document
+* @param mode please refer to linux document
+* @return Linux specific error code
+*/
+static int openFile(struct file **fpp, char *path, int flag, int mode)
+{
+	struct file *fp;
+
+	fp=filp_open(path, flag, mode);
+	if(IS_ERR(fp)) {
+		*fpp=NULL;
+		return PTR_ERR(fp);
+	}
+	else {
+		*fpp=fp;
+		return 0;
+	}
+}
+
+/*
+* Close the file with the specific @param fp
+* @param fp the pointer of struct file to close
+* @return always 0
+*/
+static int closeFile(struct file *fp)
+{
+	filp_close(fp,NULL);
+	return 0;
+}
+
+static int readFile(struct file *fp,char *buf,int len)
+{
+	int rlen=0, sum=0;
+
+	if (!fp->f_op || !fp->f_op->read)
+		return -EPERM;
+
+	while(sum<len) {
+		rlen=fp->f_op->read(fp,buf+sum,len-sum, &fp->f_pos);
+		if(rlen>0)
+			sum+=rlen;
+		else if(0 != rlen)
+			return rlen;
+		else
+			break;
+	}
+
+	return  sum;
+
+}
+
+static int writeFile(struct file *fp,char *buf,int len)
+{
+	int wlen=0, sum=0;
+
+	if (!fp->f_op || !fp->f_op->write)
+		return -EPERM;
+
+	while(sum<len) {
+		wlen=fp->f_op->write(fp,buf+sum,len-sum, &fp->f_pos);
+		if(wlen>0)
+			sum+=wlen;
+		else if(0 != wlen)
+			return wlen;
+		else
+			break;
+	}
+
+	return sum;
+
+}
+
+/*
+* Test if the specifi @param path is a file and readable
+* @param path the path of the file to test
+* @return Linux specific error code
+*/
+static int isFileReadable(char *path)
+{
+	struct file *fp;
+	int ret = 0;
+	mm_segment_t oldfs;
+	char buf;
+
+	fp=filp_open(path, O_RDONLY, 0);
+	if(IS_ERR(fp)) {
+		ret = PTR_ERR(fp);
+	}
+	else {
+		oldfs = get_fs(); set_fs(get_ds());
+
+		if(1!=readFile(fp, &buf, 1))
+			ret = PTR_ERR(fp);
+
+		set_fs(oldfs);
+		filp_close(fp,NULL);
+	}
+	return ret;
+}
+
+/*
+* Open the file with @param path and retrive the file content into memory starting from @param buf for @param sz at most
+* @param path the path of the file to open and read
+* @param buf the starting address of the buffer to store file content
+* @param sz how many bytes to read at most
+* @return the byte we've read, or Linux specific error code
+*/
+static int retriveFromFile(char *path, u8* buf, u32 sz)
+{
+	int ret =-1;
+	mm_segment_t oldfs;
+	struct file *fp;
+
+	if(path && buf) {
+		if( 0 == (ret=openFile(&fp,path, O_RDONLY, 0)) ){
+			DBG_871X("%s openFile path:%s fp=%p\n",__FUNCTION__, path ,fp);
+
+			oldfs = get_fs(); set_fs(get_ds());
+			ret=readFile(fp, buf, sz);
+			set_fs(oldfs);
+			closeFile(fp);
+
+			DBG_871X("%s readFile, ret:%d\n",__FUNCTION__, ret);
+
+		} else {
+			DBG_871X("%s openFile path:%s Fail, ret:%d\n",__FUNCTION__, path, ret);
+		}
+	} else {
+		DBG_871X("%s NULL pointer\n",__FUNCTION__);
+		ret =  -EINVAL;
+	}
+	return ret;
+}
+
+/*
+* Open the file with @param path and wirte @param sz byte of data starting from @param buf into the file
+* @param path the path of the file to open and write
+* @param buf the starting address of the data to write into file
+* @param sz how many bytes to write at most
+* @return the byte we've written, or Linux specific error code
+*/
+static int storeToFile(char *path, u8* buf, u32 sz)
+{
+	int ret =0;
+	mm_segment_t oldfs;
+	struct file *fp;
+
+	if(path && buf) {
+		if( 0 == (ret=openFile(&fp, path, O_CREAT|O_WRONLY, 0666)) ) {
+			DBG_871X("%s openFile path:%s fp=%p\n",__FUNCTION__, path ,fp);
+
+			oldfs = get_fs(); set_fs(get_ds());
+			ret=writeFile(fp, buf, sz);
+			set_fs(oldfs);
+			closeFile(fp);
+
+			DBG_871X("%s writeFile, ret:%d\n",__FUNCTION__, ret);
+
+		} else {
+			DBG_871X("%s openFile path:%s Fail, ret:%d\n",__FUNCTION__, path, ret);
+		}
+	} else {
+		DBG_871X("%s NULL pointer\n",__FUNCTION__);
+		ret =  -EINVAL;
+	}
+	return ret;
+}
+#endif //PLATFORM_LINUX
+
+/*
+* Test if the specifi @param path is a file and readable
+* @param path the path of the file to test
+* @return _TRUE or _FALSE
+*/
+int rtw_is_file_readable(char *path)
+{
+#ifdef PLATFORM_LINUX
+	if(isFileReadable(path) == 0)
+		return _TRUE;
+	else
+		return _FALSE;
+#else
+	//Todo...
+	return _FALSE;
+#endif
+}
+
+/*
+* Open the file with @param path and retrive the file content into memory starting from @param buf for @param sz at most
+* @param path the path of the file to open and read
+* @param buf the starting address of the buffer to store file content
+* @param sz how many bytes to read at most
+* @return the byte we've read
+*/
+int rtw_retrive_from_file(char *path, u8* buf, u32 sz)
+{
+#ifdef PLATFORM_LINUX
+	int ret =retriveFromFile(path, buf, sz);
+	return ret>=0?ret:0;
+#else
+	//Todo...
+	return 0;
+#endif
+}
+
+/*
+* Open the file with @param path and wirte @param sz byte of data starting from @param buf into the file
+* @param path the path of the file to open and write
+* @param buf the starting address of the data to write into file
+* @param sz how many bytes to write at most
+* @return the byte we've written
+*/
+int rtw_store_to_file(char *path, u8* buf, u32 sz)
+{
+#ifdef PLATFORM_LINUX
+	int ret =storeToFile(path, buf, sz);
+	return ret>=0?ret:0;
+#else
+	//Todo...
+	return 0;
+#endif
+}
+
+#if 1 //#ifdef MEM_ALLOC_REFINE_ADAPTOR
+#ifdef PLATFORM_LINUX
+struct net_device *rtw_alloc_etherdev_with_old_priv(int sizeof_priv, void *old_priv)
+{
+	struct net_device *pnetdev;
+	struct rtw_netdev_priv_indicator *pnpi;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
+	pnetdev = alloc_etherdev_mq(sizeof(struct rtw_netdev_priv_indicator), 4);
+#else
+	pnetdev = alloc_etherdev(sizeof(struct rtw_netdev_priv_indicator));
+#endif
+	if (!pnetdev)
+		goto RETURN;
+
+	pnpi = netdev_priv(pnetdev);
+	pnpi->priv=old_priv;
+	pnpi->sizeof_priv=sizeof_priv;
+
+RETURN:
+	return pnetdev;
+}
+
+struct net_device *rtw_alloc_etherdev(int sizeof_priv)
+{
+	struct net_device *pnetdev;
+	struct rtw_netdev_priv_indicator *pnpi;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
+	pnetdev = alloc_etherdev_mq(sizeof(struct rtw_netdev_priv_indicator), 4);
+#else
+	pnetdev = alloc_etherdev(sizeof(struct rtw_netdev_priv_indicator));
+#endif
+	if (!pnetdev)
+		goto RETURN;
+
+	pnpi = netdev_priv(pnetdev);
+
+	pnpi->priv = rtw_zvmalloc(sizeof_priv);
+	if (!pnpi->priv) {
+		free_netdev(pnetdev);
+		pnetdev = NULL;
+		goto RETURN;
+	}
+
+	pnpi->sizeof_priv=sizeof_priv;
+RETURN:
+	return pnetdev;
+}
+
+void rtw_free_netdev(struct net_device * netdev)
+{
+	struct rtw_netdev_priv_indicator *pnpi;
+
+	if(!netdev)
+		goto RETURN;
+
+	pnpi = netdev_priv(netdev);
+
+	if(!pnpi->priv)
+		goto RETURN;
+
+	rtw_vmfree(pnpi->priv, pnpi->sizeof_priv);
+	free_netdev(netdev);
+
+RETURN:
+	return;
+}
+
+/*
+* Jeff: this function should be called under ioctl (rtnl_lock is accquired) while
+* LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26)
+*/
+int rtw_change_ifname(_adapter *padapter, const char *ifname)
+{
+	struct net_device *pnetdev;
+	struct net_device *cur_pnetdev = padapter->pnetdev;
+	struct rereg_nd_name_data *rereg_priv;
+	int ret;
+
+	if(!padapter)
+		goto error;
+
+	rereg_priv = &padapter->rereg_nd_name_priv;
+
+	//free the old_pnetdev
+	if(rereg_priv->old_pnetdev) {
+		free_netdev(rereg_priv->old_pnetdev);
+		rereg_priv->old_pnetdev = NULL;
+	}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,26))
+	if(!rtnl_is_locked())
+		unregister_netdev(cur_pnetdev);
+	else
+#endif
+		unregister_netdevice(cur_pnetdev);
+
+	rtw_proc_remove_one(cur_pnetdev);
+
+	rereg_priv->old_pnetdev=cur_pnetdev;
+
+	pnetdev = rtw_init_netdev(padapter);
+	if (!pnetdev)  {
+		ret = -1;
+		goto error;
+	}
+
+	SET_NETDEV_DEV(pnetdev, dvobj_to_dev(adapter_to_dvobj(padapter)));
+
+	rtw_init_netdev_name(pnetdev, ifname);
+
+	_rtw_memcpy(pnetdev->dev_addr, padapter->eeprompriv.mac_addr, ETH_ALEN);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,26))
+	if(!rtnl_is_locked())
+		ret = register_netdev(pnetdev);
+	else
+#endif
+		ret = register_netdevice(pnetdev);
+
+	if ( ret != 0) {
+		RT_TRACE(_module_hci_intfs_c_,_drv_err_,("register_netdev() failed\n"));
+		goto error;
+	}
+
+	rtw_proc_init_one(pnetdev);
+
+	return 0;
+
+error:
+
+	return -1;
+
+}
+#endif
+#endif //MEM_ALLOC_REFINE_ADAPTOR
+
+#ifdef PLATFORM_FREEBSD
+/*
+ * Copy a buffer from userspace and write into kernel address
+ * space.
+ *
+ * This emulation just calls the FreeBSD copyin function (to
+ * copy data from user space buffer into a kernel space buffer)
+ * and is designed to be used with the above io_write_wrapper.
+ *
+ * This function should return the number of bytes not copied.
+ * I.e. success results in a zero value.
+ * Negative error values are not returned.
+ */
+unsigned long
+copy_from_user(void *to, const void *from, unsigned long n)
+{
+        if ( copyin(from, to, n) != 0 ) {
+                /* Any errors will be treated as a failure
+                   to copy any of the requested bytes */
+                return n;
+        }
+
+        return 0;
+}
+
+unsigned long
+copy_to_user(void *to, const void *from, unsigned long n)
+{
+	if ( copyout(from, to, n) != 0 ) {
+		/* Any errors will be treated as a failure
+		   to copy any of the requested bytes */
+		return n;
+	}
+
+	return 0;
+}
+
+
+/*
+ * The usb_register and usb_deregister functions are used to register
+ * usb drivers with the usb subsystem. In this compatibility layer
+ * emulation a list of drivers (struct usb_driver) is maintained
+ * and is used for probing/attaching etc.
+ *
+ * usb_register and usb_deregister simply call these functions.
+ */
+int
+usb_register(struct usb_driver *driver)
+{
+        rtw_usb_linux_register(driver);
+        return 0;
+}
+
+
+int
+usb_deregister(struct usb_driver *driver)
+{
+        rtw_usb_linux_deregister(driver);
+        return 0;
+}
+
+void module_init_exit_wrapper(void *arg)
+{
+        int (*func)(void) = arg;
+        func();
+        return;
+}
+
+#endif //PLATFORM_FREEBSD
+u64 rtw_modular64(u64 x, u64 y)
+{
+#ifdef PLATFORM_LINUX
+	return do_div(x, y);
+#elif defined(PLATFORM_WINDOWS)
+	return (x % y);
+#elif defined(PLATFORM_FREEBSD)
+	return (x %y);
+#endif
+}
+
+u64 rtw_division64(u64 x, u64 y)
+{
+#ifdef PLATFORM_LINUX
+	do_div(x, y);
+	return x;
+#elif defined(PLATFORM_WINDOWS)
+	return (x / y);
+#elif defined(PLATFORM_FREEBSD)
+	return (x / y);
+#endif
+}
+
+void rtw_buf_free(u8 **buf, u32 *buf_len)
+{
+	u32 ori_len;
+
+	if (!buf || !buf_len)
+		return;
+
+	ori_len = *buf_len;
+
+	if (*buf) {
+		u32 tmp_buf_len = *buf_len;
+		*buf_len = 0;
+		rtw_mfree(*buf, tmp_buf_len);
+		*buf = NULL;
+	}
+}
+
+void rtw_buf_update(u8 **buf, u32 *buf_len, u8 *src, u32 src_len)
+{
+	u32 ori_len = 0, dup_len = 0;
+	u8 *ori = NULL;
+	u8 *dup = NULL;
+
+	if (!buf || !buf_len)
+		return;
+
+	if (!src || !src_len)
+		goto keep_ori;
+
+	/* duplicate src */
+	dup = rtw_malloc(src_len);
+	if (dup) {
+		dup_len = src_len;
+		_rtw_memcpy(dup, src, dup_len);
+	}
+
+keep_ori:
+	ori = *buf;
+	ori_len = *buf_len;
+
+	/* replace buf with dup */
+	*buf_len = 0;
+	*buf = dup;
+	*buf_len = dup_len;
+
+	/* free ori */
+	if (ori && ori_len > 0)
+		rtw_mfree(ori, ori_len);
+}
+
+
+/**
+ * rtw_cbuf_full - test if cbuf is full
+ * @cbuf: pointer of struct rtw_cbuf
+ *
+ * Returns: _TRUE if cbuf is full
+ */
+inline bool rtw_cbuf_full(struct rtw_cbuf *cbuf)
+{
+	return (cbuf->write == cbuf->read-1)? _TRUE : _FALSE;
+}
+
+/**
+ * rtw_cbuf_empty - test if cbuf is empty
+ * @cbuf: pointer of struct rtw_cbuf
+ *
+ * Returns: _TRUE if cbuf is empty
+ */
+inline bool rtw_cbuf_empty(struct rtw_cbuf *cbuf)
+{
+	return (cbuf->write == cbuf->read)? _TRUE : _FALSE;
+}
+
+/**
+ * rtw_cbuf_push - push a pointer into cbuf
+ * @cbuf: pointer of struct rtw_cbuf
+ * @buf: pointer to push in
+ *
+ * Lock free operation, be careful of the use scheme
+ * Returns: _TRUE push success
+ */
+bool rtw_cbuf_push(struct rtw_cbuf *cbuf, void *buf)
+{
+	if (rtw_cbuf_full(cbuf))
+		return _FAIL;
+
+	if (0)
+		DBG_871X("%s on %u\n", __func__, cbuf->write);
+	cbuf->bufs[cbuf->write] = buf;
+	cbuf->write = (cbuf->write+1)%cbuf->size;
+
+	return _SUCCESS;
+}
+
+/**
+ * rtw_cbuf_pop - pop a pointer from cbuf
+ * @cbuf: pointer of struct rtw_cbuf
+ *
+ * Lock free operation, be careful of the use scheme
+ * Returns: pointer popped out
+ */
+void *rtw_cbuf_pop(struct rtw_cbuf *cbuf)
+{
+	void *buf;
+	if (rtw_cbuf_empty(cbuf))
+		return NULL;
+
+	if (0)
+		DBG_871X("%s on %u\n", __func__, cbuf->read);
+	buf = cbuf->bufs[cbuf->read];
+	cbuf->read = (cbuf->read+1)%cbuf->size;
+
+	return buf;
+}
+
+/**
+ * rtw_cbuf_alloc - allocte a rtw_cbuf with given size and do initialization
+ * @size: size of pointer
+ *
+ * Returns: pointer of srtuct rtw_cbuf, NULL for allocation failure
+ */
+struct rtw_cbuf *rtw_cbuf_alloc(u32 size)
+{
+	struct rtw_cbuf *cbuf;
+
+	cbuf = (struct rtw_cbuf *)rtw_malloc(sizeof(*cbuf) + sizeof(void*)*size);
+
+	if (cbuf) {
+		cbuf->write = cbuf->read = 0;
+		cbuf->size = size;
+	}
+
+	return cbuf;
+}
+
+/**
+ * rtw_cbuf_free - free the given rtw_cbuf
+ * @cbuf: pointer of struct rtw_cbuf to free
+ */
+void rtw_cbuf_free(struct rtw_cbuf *cbuf)
+{
+	rtw_mfree((u8*)cbuf, sizeof(*cbuf) + sizeof(void*)*cbuf->size);
+}
diff --git a/drivers/net/wireless/realtek/rtl8192cu/runwpa b/drivers/net/wireless/realtek/rtl8192cu/runwpa
new file mode 100755
index 000000000000..17616d8326d5
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/runwpa
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+if [ "`which iwconfig`" = "" ] ; then
+	echo "WARNING:Wireless tool not exist!"
+	echo "        Please install it!"
+	exit
+else
+	if [ `uname -r | cut -d. -f2` -eq 4 ]; then
+		wpa_supplicant -D ipw -c wpa1.conf -i wlan0
+	else
+	if [ `iwconfig -v |awk '{print $4}' | head -n 1` -lt  18 ] ; then
+		wpa_supplicant -D ipw -c wpa1.conf -i wlan0
+	else
+		wpa_supplicant -D wext -c wpa1.conf -i wlan0
+	fi
+
+	fi
+fi
diff --git a/drivers/net/wireless/realtek/rtl8192cu/wlan0dhcp b/drivers/net/wireless/realtek/rtl8192cu/wlan0dhcp
new file mode 100755
index 000000000000..24ab3720bef6
--- /dev/null
+++ b/drivers/net/wireless/realtek/rtl8192cu/wlan0dhcp
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+var0=`ps aux|awk '/dhclient wlan0/'|awk '$11!="awk"{print $2}'`
+
+kill $var0
+cp ifcfg-wlan0 /etc/sysconfig/network-scripts/
+
+dhclient wlan0
+
+var1=`ifconfig wlan0 |awk '/inet/{print $2}'|awk -F: '{print $2}'`
+
+
+rm -f /etc/sysconfig/network-scripts/ifcfg-wlan0
+
+echo "get ip: $var1"
diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
index ba7b034b2b91..de0da10d66e6 100644
--- a/drivers/of/Kconfig
+++ b/drivers/of/Kconfig
@@ -112,4 +112,11 @@ config OF_OVERLAY
 config OF_NUMA
 	bool
 
+config OF_CONFIGFS
+	bool "Device Tree Overlay ConfigFS interface"
+	select CONFIGFS_FS
+	select OF_OVERLAY
+	help
+	  Enable a simple user-space driven DT overlay interface.
+
 endif # OF
diff --git a/drivers/of/Makefile b/drivers/of/Makefile
index 8f19d342eed8..7afce596322d 100644
--- a/drivers/of/Makefile
+++ b/drivers/of/Makefile
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-y = base.o device.o platform.o property.o
+obj-$(CONFIG_OF_CONFIGFS) += configfs.o
 obj-$(CONFIG_OF_DYNAMIC) += dynamic.o
 obj-$(CONFIG_OF_FLATTREE) += fdt.o
 obj-$(CONFIG_OF_EARLY_FLATTREE) += fdt_address.o
diff --git a/drivers/of/configfs.c b/drivers/of/configfs.c
new file mode 100644
index 000000000000..0037e6868a6c
--- /dev/null
+++ b/drivers/of/configfs.c
@@ -0,0 +1,311 @@
+/*
+ * Configfs entries for device-tree
+ *
+ * Copyright (C) 2013 - Pantelis Antoniou <panto@antoniou-consulting.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+#include <linux/ctype.h>
+#include <linux/cpu.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_fdt.h>
+#include <linux/spinlock.h>
+#include <linux/slab.h>
+#include <linux/proc_fs.h>
+#include <linux/configfs.h>
+#include <linux/types.h>
+#include <linux/stat.h>
+#include <linux/limits.h>
+#include <linux/file.h>
+#include <linux/vmalloc.h>
+#include <linux/firmware.h>
+#include <linux/sizes.h>
+
+#include "of_private.h"
+
+struct cfs_overlay_item {
+	struct config_item	item;
+
+	char			path[PATH_MAX];
+
+	const struct firmware	*fw;
+	struct device_node	*overlay;
+	int			ov_id;
+
+	void			*dtbo;
+	int			dtbo_size;
+};
+
+static int create_overlay(struct cfs_overlay_item *overlay, void *blob)
+{
+	int err;
+
+	/* unflatten the tree */
+	of_fdt_unflatten_tree(blob, NULL, &overlay->overlay);
+	if (overlay->overlay == NULL) {
+		pr_err("%s: failed to unflatten tree\n", __func__);
+		err = -EINVAL;
+		goto out_err;
+	}
+	pr_debug("%s: unflattened OK\n", __func__);
+
+	/* mark it as detached */
+	of_node_set_flag(overlay->overlay, OF_DETACHED);
+
+	/* perform resolution */
+	err = of_resolve_phandles(overlay->overlay);
+	if (err != 0) {
+		pr_err("%s: Failed to resolve tree\n", __func__);
+		goto out_err;
+	}
+	pr_debug("%s: resolved OK\n", __func__);
+
+	err = of_overlay_create(overlay->overlay);
+	if (err < 0) {
+		pr_err("%s: Failed to create overlay (err=%d)\n",
+				__func__, err);
+		goto out_err;
+	}
+	overlay->ov_id = err;
+
+out_err:
+	return err;
+}
+
+static inline struct cfs_overlay_item *to_cfs_overlay_item(
+		struct config_item *item)
+{
+	return item ? container_of(item, struct cfs_overlay_item, item) : NULL;
+}
+
+static ssize_t cfs_overlay_item_path_show(struct config_item *item,
+		char *page)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+	return sprintf(page, "%s\n", overlay->path);
+}
+
+static ssize_t cfs_overlay_item_path_store(struct config_item *item,
+		const char *page, size_t count)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+	const char *p = page;
+	char *s;
+	int err;
+
+	/* if it's set do not allow changes */
+	if (overlay->path[0] != '\0' || overlay->dtbo_size > 0)
+		return -EPERM;
+
+	/* copy to path buffer (and make sure it's always zero terminated */
+	count = snprintf(overlay->path, sizeof(overlay->path) - 1, "%s", p);
+	overlay->path[sizeof(overlay->path) - 1] = '\0';
+
+	/* strip trailing newlines */
+	s = overlay->path + strlen(overlay->path);
+	while (s > overlay->path && *--s == '\n')
+		*s = '\0';
+
+	pr_debug("%s: path is '%s'\n", __func__, overlay->path);
+
+	err = request_firmware(&overlay->fw, overlay->path, NULL);
+	if (err != 0)
+		goto out_err;
+
+	err = create_overlay(overlay, (void *)overlay->fw->data);
+	if (err != 0)
+		goto out_err;
+
+	return count;
+
+out_err:
+
+	release_firmware(overlay->fw);
+	overlay->fw = NULL;
+
+	overlay->path[0] = '\0';
+	return err;
+}
+
+static ssize_t cfs_overlay_item_status_show(struct config_item *item,
+		char *page)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+
+	return sprintf(page, "%s\n",
+			overlay->ov_id >= 0 ? "applied" : "unapplied");
+}
+
+CONFIGFS_ATTR(cfs_overlay_item_, path);
+CONFIGFS_ATTR_RO(cfs_overlay_item_, status);
+
+static struct configfs_attribute *cfs_overlay_attrs[] = {
+	&cfs_overlay_item_attr_path,
+	&cfs_overlay_item_attr_status,
+	NULL,
+};
+
+ssize_t cfs_overlay_item_dtbo_read(struct config_item *item,
+		void *buf, size_t max_count)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+
+	pr_debug("%s: buf=%p max_count=%zu\n", __func__,
+			buf, max_count);
+
+	if (overlay->dtbo == NULL)
+		return 0;
+
+	/* copy if buffer provided */
+	if (buf != NULL) {
+		/* the buffer must be large enough */
+		if (overlay->dtbo_size > max_count)
+			return -ENOSPC;
+
+		memcpy(buf, overlay->dtbo, overlay->dtbo_size);
+	}
+
+	return overlay->dtbo_size;
+}
+
+ssize_t cfs_overlay_item_dtbo_write(struct config_item *item,
+		const void *buf, size_t count)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+	int err;
+
+	/* if it's set do not allow changes */
+	if (overlay->path[0] != '\0' || overlay->dtbo_size > 0)
+		return -EPERM;
+
+	/* copy the contents */
+	overlay->dtbo = kmemdup(buf, count, GFP_KERNEL);
+	if (overlay->dtbo == NULL)
+		return -ENOMEM;
+
+	overlay->dtbo_size = count;
+
+	err = create_overlay(overlay, overlay->dtbo);
+	if (err != 0)
+		goto out_err;
+
+	return count;
+
+out_err:
+	kfree(overlay->dtbo);
+	overlay->dtbo = NULL;
+	overlay->dtbo_size = 0;
+
+	return err;
+}
+
+CONFIGFS_BIN_ATTR(cfs_overlay_item_, dtbo, NULL, SZ_1M);
+
+static struct configfs_bin_attribute *cfs_overlay_bin_attrs[] = {
+	&cfs_overlay_item_attr_dtbo,
+	NULL,
+};
+
+static void cfs_overlay_release(struct config_item *item)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+
+	if (overlay->ov_id >= 0)
+		of_overlay_destroy(overlay->ov_id);
+	if (overlay->fw)
+		release_firmware(overlay->fw);
+	/* kfree with NULL is safe */
+	kfree(overlay->dtbo);
+	kfree(overlay);
+}
+
+static struct configfs_item_operations cfs_overlay_item_ops = {
+	.release	= cfs_overlay_release,
+};
+
+static struct config_item_type cfs_overlay_type = {
+	.ct_item_ops	= &cfs_overlay_item_ops,
+	.ct_attrs	= cfs_overlay_attrs,
+	.ct_bin_attrs	= cfs_overlay_bin_attrs,
+	.ct_owner	= THIS_MODULE,
+};
+
+static struct config_item *cfs_overlay_group_make_item(
+		struct config_group *group, const char *name)
+{
+	struct cfs_overlay_item *overlay;
+
+	overlay = kzalloc(sizeof(*overlay), GFP_KERNEL);
+	if (!overlay)
+		return ERR_PTR(-ENOMEM);
+	overlay->ov_id = -1;
+
+	config_item_init_type_name(&overlay->item, name, &cfs_overlay_type);
+	return &overlay->item;
+}
+
+static void cfs_overlay_group_drop_item(struct config_group *group,
+		struct config_item *item)
+{
+	struct cfs_overlay_item *overlay = to_cfs_overlay_item(item);
+
+	config_item_put(&overlay->item);
+}
+
+static struct configfs_group_operations overlays_ops = {
+	.make_item	= cfs_overlay_group_make_item,
+	.drop_item	= cfs_overlay_group_drop_item,
+};
+
+static struct config_item_type overlays_type = {
+	.ct_group_ops   = &overlays_ops,
+	.ct_owner       = THIS_MODULE,
+};
+
+static struct configfs_group_operations of_cfs_ops = {
+	/* empty - we don't allow anything to be created */
+};
+
+static struct config_item_type of_cfs_type = {
+	.ct_group_ops   = &of_cfs_ops,
+	.ct_owner       = THIS_MODULE,
+};
+
+struct config_group of_cfs_overlay_group;
+
+static struct configfs_subsystem of_cfs_subsys = {
+	.su_group = {
+		.cg_item = {
+			.ci_namebuf = "device-tree",
+			.ci_type = &of_cfs_type,
+		},
+	},
+	.su_mutex = __MUTEX_INITIALIZER(of_cfs_subsys.su_mutex),
+};
+
+static int __init of_cfs_init(void)
+{
+	int ret;
+
+	pr_info("%s\n", __func__);
+
+	config_group_init(&of_cfs_subsys.su_group);
+	config_group_init_type_name(&of_cfs_overlay_group, "overlays",
+			&overlays_type);
+	configfs_add_default_group(&of_cfs_overlay_group,
+			&of_cfs_subsys.su_group);
+
+	ret = configfs_register_subsystem(&of_cfs_subsys);
+	if (ret != 0) {
+		pr_err("%s: failed to register subsys\n", __func__);
+		goto out;
+	}
+	pr_info("%s: OK\n", __func__);
+out:
+	return ret;
+}
+late_initcall(of_cfs_init);
diff --git a/drivers/perf/Kconfig b/drivers/perf/Kconfig
index e5197ffb7422..736c22e00e8f 100644
--- a/drivers/perf/Kconfig
+++ b/drivers/perf/Kconfig
@@ -43,4 +43,11 @@ config XGENE_PMU
         help
           Say y if you want to use APM X-Gene SoC performance monitors.
 
+config RPI_AXIPERF
+        depends on ARCH_BCM2835
+        tristate "RaspberryPi AXI Performance monitors"
+        default n
+        help
+          Say y if you want to use Raspberry Pi AXI performance monitors, m if
+          you want to build it as a module.
 endmenu
diff --git a/drivers/perf/Makefile b/drivers/perf/Makefile
index 9402dc8ff22c..6f358671af46 100644
--- a/drivers/perf/Makefile
+++ b/drivers/perf/Makefile
@@ -4,3 +4,4 @@ obj-$(CONFIG_ARM_PMU_ACPI) += arm_pmu_acpi.o
 obj-$(CONFIG_QCOM_L2_PMU)	+= qcom_l2_pmu.o
 obj-$(CONFIG_QCOM_L3_PMU) += qcom_l3_pmu.o
 obj-$(CONFIG_XGENE_PMU) += xgene_pmu.o
+obj-$(CONFIG_RPI_AXIPERF) += raspberrypi_axi_monitor.o
diff --git a/drivers/perf/raspberrypi_axi_monitor.c b/drivers/perf/raspberrypi_axi_monitor.c
new file mode 100644
index 000000000000..bafe03b6c000
--- /dev/null
+++ b/drivers/perf/raspberrypi_axi_monitor.c
@@ -0,0 +1,637 @@
+/*
+ * raspberrypi_axi_monitor.c
+ *
+ * Author: james.hughes@raspberrypi.org
+ *
+ * Raspberry Pi AXI performance counters.
+ *
+ * Copyright (C) 2017 Raspberry Pi Trading Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/devcoredump.h>
+#include <linux/device.h>
+#include <linux/kthread.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/mutex.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+#define NUM_MONITORS 2
+#define NUM_BUS_WATCHERS_PER_MONITOR 3
+
+#define SYSTEM_MONITOR 0
+#define VPU_MONITOR 1
+
+#define MAX_BUSES 16
+#define DEFAULT_SAMPLE_TIME 100
+
+#define NUM_BUS_WATCHER_RESULTS 9
+
+struct bus_watcher_data {
+	union	{
+		u32 results[NUM_BUS_WATCHER_RESULTS];
+		struct {
+			u32 atrans;
+			u32 atwait;
+			u32 amax;
+			u32 wtrans;
+			u32 wtwait;
+			u32 wmax;
+			u32 rtrans;
+			u32 rtwait;
+			u32 rmax;
+		};
+	};
+};
+
+
+struct rpi_axiperf {
+	struct platform_device *dev;
+	struct dentry *root_folder;
+
+	struct task_struct *monitor_thread;
+	struct mutex lock;
+
+	struct rpi_firmware *firmware;
+
+	/* Sample time spent on for each bus */
+	int sample_time;
+
+	/* Now storage for the per monitor settings and the resulting
+	 * performance figures
+	 */
+	struct {
+		/* Bit field of buses we want to monitor */
+		int bus_enabled;
+		/* Bit field of buses to filter by */
+		int bus_filter;
+		/* The current buses being monitored on this monitor */
+		int current_bus[NUM_BUS_WATCHERS_PER_MONITOR];
+		/* The last bus monitored on this monitor */
+		int last_monitored;
+
+		/* Set true if this mailbox must use the mailbox interface
+		 * rather than access registers directly.
+		 */
+		int use_mailbox_interface;
+
+		/* Current result values */
+		struct bus_watcher_data results[MAX_BUSES];
+
+		struct dentry *debugfs_entry;
+		void __iomem *base_address;
+
+	}  monitor[NUM_MONITORS];
+
+};
+
+static struct rpi_axiperf *state;
+
+/* Two monitors, System and VPU, each with the following register sets.
+ * Each monitor can only monitor one bus at a time, so we time share them,
+ * giving each bus 100ms (default, settable via debugfs) of time on its
+ * associated monitor
+ * Record results from the three Bus watchers per monitor and push to the sysfs
+ */
+
+/* general registers */
+const int GEN_CTRL;
+
+const int GEN_CTL_ENABLE_BIT	= BIT(0);
+const int GEN_CTL_RESET_BIT	= BIT(1);
+
+/* Bus watcher registers */
+const int BW_PITCH		= 0x40;
+
+const int BW0_CTRL		= 0x40;
+const int BW1_CTRL		= 0x80;
+const int BW2_CTRL		= 0xc0;
+
+const int BW_ATRANS_OFFSET	= 0x04;
+const int BW_ATWAIT_OFFSET	= 0x08;
+const int BW_AMAX_OFFSET	= 0x0c;
+const int BW_WTRANS_OFFSET	= 0x10;
+const int BW_WTWAIT_OFFSET	= 0x14;
+const int BW_WMAX_OFFSET	= 0x18;
+const int BW_RTRANS_OFFSET	= 0x1c;
+const int BW_RTWAIT_OFFSET	= 0x20;
+const int BW_RMAX_OFFSET	= 0x24;
+
+const int BW_CTRL_RESET_BIT	= BIT(31);
+const int BW_CTRL_ENABLE_BIT	= BIT(30);
+const int BW_CTRL_ENABLE_ID_FILTER_BIT	= BIT(29);
+const int BW_CTRL_LIMIT_HALT_BIT	= BIT(28);
+
+const int BW_CTRL_SOURCE_SHIFT	= 8;
+const int BW_CTRL_SOURCE_MASK	= GENMASK(12, 8); // 5 bits
+const int BW_CTRL_BUS_WATCH_SHIFT;
+const int BW_CTRL_BUS_WATCH_MASK = GENMASK(5, 0); // 6 bits
+const int BW_CTRL_BUS_FILTER_SHIFT = 8;
+
+const static char *bus_filter_strings[] = {
+	"",
+	"CORE0_V",
+	"ICACHE0",
+	"DCACHE0",
+	"CORE1_V",
+	"ICACHE1",
+	"DCACHE1",
+	"L2_MAIN",
+	"HOST_PORT",
+	"HOST_PORT2",
+	"HVS",
+	"ISP",
+	"VIDEO_DCT",
+	"VIDEO_SD2AXI",
+	"CAM0",
+	"CAM1",
+	"DMA0",
+	"DMA1",
+	"DMA2_VPU",
+	"JPEG",
+	"VIDEO_CME",
+	"TRANSPOSER",
+	"VIDEO_FME",
+	"CCP2TX",
+	"USB",
+	"V3D0",
+	"V3D1",
+	"V3D2",
+	"AVE",
+	"DEBUG",
+	"CPU",
+	"M30"
+};
+
+const int num_bus_filters = ARRAY_SIZE(bus_filter_strings);
+
+const static char *system_bus_string[] = {
+	"DMA_L2",
+	"TRANS",
+	"JPEG",
+	"SYSTEM_UC",
+	"DMA_UC",
+	"SYSTEM_L2",
+	"CCP2TX",
+	"MPHI_RX",
+	"MPHI_TX",
+	"HVS",
+	"H264",
+	"ISP",
+	"V3D",
+	"PERIPHERAL",
+	"CPU_UC",
+	"CPU_L2"
+};
+
+const int num_system_buses = ARRAY_SIZE(system_bus_string);
+
+const static char *vpu_bus_string[] = {
+	"VPU1_D_L2",
+	"VPU0_D_L2",
+	"VPU1_I_L2",
+	"VPU0_I_L2",
+	"SYSTEM_L2",
+	"L2_FLUSH",
+	"DMA_L2",
+	"VPU1_D_UC",
+	"VPU0_D_UC",
+	"VPU1_I_UC",
+	"VPU0_I_UC",
+	"SYSTEM_UC",
+	"L2_OUT",
+	"DMA_UC",
+	"SDRAM",
+	"L2_IN"
+};
+
+const int num_vpu_buses = ARRAY_SIZE(vpu_bus_string);
+
+const static char *monitor_name[] = {
+	"System",
+	"VPU"
+};
+
+static inline void write_reg(int monitor, int reg, u32 value)
+{
+	writel(value, state->monitor[monitor].base_address + reg);
+}
+
+static inline u32 read_reg(int monitor, u32 reg)
+{
+	return readl(state->monitor[monitor].base_address + reg);
+}
+
+static void read_bus_watcher(int monitor, int watcher, u32 *results)
+{
+	if (state->monitor[monitor].use_mailbox_interface) {
+		/* We have 9 results, plus the overheads of start address and
+		 * length So 11 u32 to define
+		 */
+		u32 tmp[11];
+		int err;
+
+		tmp[0] = (u32)(state->monitor[monitor].base_address + watcher
+				+ BW_ATRANS_OFFSET);
+		tmp[1] = NUM_BUS_WATCHER_RESULTS;
+
+		err = rpi_firmware_property(state->firmware,
+					    RPI_FIRMWARE_GET_PERIPH_REG,
+					    tmp, sizeof(tmp));
+
+		if (err < 0 || tmp[1] != NUM_BUS_WATCHER_RESULTS)
+			dev_err_once(&state->dev->dev,
+				     "Failed to read bus watcher");
+		else
+			memcpy(results, &tmp[2],
+			       NUM_BUS_WATCHER_RESULTS * sizeof(u32));
+	} else {
+		int i;
+		void __iomem *addr = state->monitor[monitor].base_address
+				+ watcher + BW_ATRANS_OFFSET;
+		for (i = 0; i < NUM_BUS_WATCHER_RESULTS; i++, addr += 4)
+			*results++ = readl(addr);
+	}
+}
+
+static void set_monitor_control(int monitor, u32 set)
+{
+	if (state->monitor[monitor].use_mailbox_interface) {
+		u32 tmp[3] = {(u32)(state->monitor[monitor].base_address +
+				GEN_CTRL), 1, set};
+		int err = rpi_firmware_property(state->firmware,
+						RPI_FIRMWARE_SET_PERIPH_REG,
+						tmp, sizeof(tmp));
+
+		if (err < 0 || tmp[1] != 1)
+			dev_err_once(&state->dev->dev,
+				"Failed to set monitor control");
+	} else
+		write_reg(monitor, GEN_CTRL, set);
+}
+
+static void set_bus_watcher_control(int monitor, int watcher, u32 set)
+{
+	if (state->monitor[monitor].use_mailbox_interface) {
+		u32 tmp[3] = {(u32)(state->monitor[monitor].base_address +
+				    watcher), 1, set};
+		int err = rpi_firmware_property(state->firmware,
+						RPI_FIRMWARE_SET_PERIPH_REG,
+						tmp, sizeof(tmp));
+		if (err < 0 || tmp[1] != 1)
+			dev_err_once(&state->dev->dev,
+				"Failed to set bus watcher control");
+	} else
+		write_reg(monitor, watcher, set);
+}
+
+static void monitor(struct rpi_axiperf *state)
+{
+	int monitor, num_buses[NUM_MONITORS];
+
+	mutex_lock(&state->lock);
+
+	for (monitor = 0; monitor < NUM_MONITORS; monitor++) {
+		typeof(state->monitor[0]) *mon = &(state->monitor[monitor]);
+
+		/* Anything enabled? */
+		if (mon->bus_enabled == 0) {
+			/* No, disable all monitoring for this monitor */
+			set_monitor_control(monitor, GEN_CTL_RESET_BIT);
+		} else {
+			int i;
+
+			/* Find out how many busses we want to monitor, and
+			 * spread our 3 actual monitors over them
+			 */
+			num_buses[monitor] = hweight32(mon->bus_enabled);
+			num_buses[monitor] = min(num_buses[monitor],
+						 NUM_BUS_WATCHERS_PER_MONITOR);
+
+			for (i = 0; i < num_buses[monitor]; i++) {
+				int bus_control;
+
+				do {
+					mon->last_monitored++;
+					mon->last_monitored &= 0xf;
+				} while ((mon->bus_enabled &
+					 (1 << mon->last_monitored)) == 0);
+
+				mon->current_bus[i] = mon->last_monitored;
+
+				/* Reset the counters */
+				set_bus_watcher_control(monitor,
+							BW0_CTRL +
+							i*BW_PITCH,
+							BW_CTRL_RESET_BIT);
+
+				bus_control = BW_CTRL_ENABLE_BIT |
+						mon->current_bus[i];
+
+				if (mon->bus_filter) {
+					bus_control |=
+						BW_CTRL_ENABLE_ID_FILTER_BIT;
+					bus_control |=
+						((mon->bus_filter & 0x1f)
+						<< BW_CTRL_BUS_FILTER_SHIFT);
+				}
+
+				// Start capture
+				set_bus_watcher_control(monitor,
+							BW0_CTRL + i*BW_PITCH,
+							bus_control);
+			}
+		}
+
+		/* start monitoring */
+		set_monitor_control(monitor, GEN_CTL_ENABLE_BIT);
+	}
+
+	mutex_unlock(&state->lock);
+
+	msleep(state->sample_time);
+
+	/* Now read the results */
+
+	mutex_lock(&state->lock);
+	for (monitor = 0; monitor < NUM_MONITORS; monitor++) {
+		typeof(state->monitor[0]) *mon = &(state->monitor[monitor]);
+
+		/* Anything enabled? */
+		if (mon->bus_enabled == 0) {
+			/* No, disable all monitoring for this monitor */
+			set_monitor_control(monitor, 0);
+		} else {
+			int i;
+
+			for (i = 0; i < num_buses[monitor]; i++) {
+				int bus = mon->current_bus[i];
+
+				read_bus_watcher(monitor,
+					BW0_CTRL + i*BW_PITCH,
+					(u32 *)&mon->results[bus].results);
+			}
+		}
+	}
+	mutex_unlock(&state->lock);
+}
+
+static int monitor_thread(void *data)
+{
+	struct rpi_axiperf *state  = data;
+
+	while (1) {
+		monitor(state);
+
+		if (kthread_should_stop())
+			return 0;
+	}
+	return 0;
+}
+
+static ssize_t myreader(struct file *fp, char __user *user_buffer,
+			size_t count, loff_t *position)
+{
+#define INIT_BUFF_SIZE 2048
+
+	int i;
+	int idx = (int)(fp->private_data);
+	int num_buses, cnt;
+	char *string_buffer;
+	int buff_size = INIT_BUFF_SIZE;
+	char *p;
+	typeof(state->monitor[0]) *mon = &(state->monitor[idx]);
+
+	if (idx < 0 || idx > NUM_MONITORS)
+		idx = 0;
+
+	num_buses = idx == SYSTEM_MONITOR ? num_system_buses : num_vpu_buses;
+
+	string_buffer = kmalloc(buff_size, GFP_KERNEL);
+
+	if (!string_buffer) {
+		dev_err(&state->dev->dev,
+				"Failed temporary string allocation\n");
+		return 0;
+	}
+
+	p = string_buffer;
+
+	mutex_lock(&state->lock);
+
+	if (mon->bus_filter) {
+		int filt = min(mon->bus_filter & 0x1f, num_bus_filters);
+
+		cnt = snprintf(p, buff_size,
+			       "\nMonitoring transactions from %s only\n",
+			       bus_filter_strings[filt]);
+		p += cnt;
+		buff_size -= cnt;
+	}
+
+	cnt = snprintf(p, buff_size, "     Bus   |    Atrans    Atwait      AMax    Wtrans    Wtwait      WMax    Rtrans    Rtwait      RMax\n"
+				     "======================================================================================================\n");
+
+	if (cnt >= buff_size)
+		goto done;
+
+	p += cnt;
+	buff_size -= cnt;
+
+	for (i = 0; i < num_buses; i++) {
+		if (mon->bus_enabled & (1 << i)) {
+#define DIVIDER (1024)
+			typeof(mon->results[0]) *res = &(mon->results[i]);
+
+			cnt = snprintf(p, buff_size,
+					"%10s | %8uK %8uK %8uK %8uK %8uK %8uK %8uK %8uK %8uK\n",
+					idx == SYSTEM_MONITOR ?
+						system_bus_string[i] :
+						vpu_bus_string[i],
+					res->atrans/DIVIDER,
+					res->atwait/DIVIDER,
+					res->amax/DIVIDER,
+					res->wtrans/DIVIDER,
+					res->wtwait/DIVIDER,
+					res->wmax/DIVIDER,
+					res->rtrans/DIVIDER,
+					res->rtwait/DIVIDER,
+					res->rmax/DIVIDER
+					);
+			if (cnt >= buff_size)
+				goto done;
+
+			p += cnt;
+			buff_size -= cnt;
+		}
+	}
+
+	mutex_unlock(&state->lock);
+
+done:
+
+	/* did the last string entry exceeed our buffer size? ie out of string
+	 * buffer space. Null terminate, use what we have.
+	 */
+	if (cnt >= buff_size) {
+		buff_size = 0;
+		string_buffer[INIT_BUFF_SIZE] = 0;
+	}
+
+	cnt = simple_read_from_buffer(user_buffer, count, position,
+				      string_buffer,
+				      INIT_BUFF_SIZE - buff_size);
+
+	kfree(string_buffer);
+
+	return cnt;
+}
+
+static ssize_t mywriter(struct file *fp, const char __user *user_buffer,
+			size_t count, loff_t *position)
+{
+	int idx = (int)(fp->private_data);
+
+	if (idx < 0 || idx > NUM_MONITORS)
+		idx = 0;
+
+	/* At the moment, this does nothing, but in the future it could be
+	 * used to reset counters etc
+	 */
+	return count;
+}
+
+static const struct file_operations fops_debug = {
+	.read = myreader,
+	.write = mywriter,
+	.open = simple_open
+};
+
+static int rpi_axiperf_probe(struct platform_device *pdev)
+{
+	int ret = 0, i;
+	struct device *dev = &pdev->dev;
+	struct device_node *np = dev->of_node;
+	struct device_node *fw_node;
+
+	state = kzalloc(sizeof(struct rpi_axiperf), GFP_KERNEL);
+	if (!state)
+		return -ENOMEM;
+
+	/* Get the firmware handle for future rpi-firmware-xxx calls */
+	fw_node = of_parse_phandle(np, "firmware", 0);
+	if (!fw_node) {
+		dev_err(dev, "Missing firmware node\n");
+		return -ENOENT;
+	}
+
+	state->firmware = rpi_firmware_get(fw_node);
+	if (!state->firmware)
+		return -EPROBE_DEFER;
+
+	/* Special case for the VPU monitor, we must use the mailbox interface
+	 * as it is not accessible from the ARM address space.
+	 */
+	state->monitor[VPU_MONITOR].use_mailbox_interface = 1;
+	state->monitor[SYSTEM_MONITOR].use_mailbox_interface = 0;
+
+	for (i = 0; i < NUM_MONITORS; i++) {
+		if (state->monitor[i].use_mailbox_interface) {
+			 of_property_read_u32_index(np, "reg", i*2,
+				(u32 *)(&state->monitor[i].base_address));
+		} else {
+			struct resource *resource =
+				platform_get_resource(pdev, IORESOURCE_MEM, i);
+
+			state->monitor[i].base_address =
+				devm_ioremap_resource(&pdev->dev, resource);
+		}
+
+		if (IS_ERR(state->monitor[i].base_address))
+			return PTR_ERR(state->monitor[i].base_address);
+
+		/* Enable all buses by default */
+		state->monitor[i].bus_enabled = 0xffff;
+	}
+
+	state->dev = pdev;
+	platform_set_drvdata(pdev, state);
+
+	state->sample_time = DEFAULT_SAMPLE_TIME;
+
+	/* Set up all the debugfs stuff */
+	state->root_folder = debugfs_create_dir(KBUILD_MODNAME, NULL);
+
+	for (i = 0; i < NUM_MONITORS; i++) {
+		state->monitor[i].debugfs_entry =
+			debugfs_create_dir(monitor_name[i], state->root_folder);
+		if (IS_ERR(state->monitor[i].debugfs_entry))
+			state->monitor[i].debugfs_entry = NULL;
+
+		debugfs_create_file("data", 0444,
+				    state->monitor[i].debugfs_entry,
+				    (void *)i, &fops_debug);
+		debugfs_create_u32("enable", 0644,
+				   state->monitor[i].debugfs_entry,
+				   &state->monitor[i].bus_enabled);
+		debugfs_create_u32("filter", 0644,
+				   state->monitor[i].debugfs_entry,
+				   &state->monitor[i].bus_filter);
+		debugfs_create_u32("sample_time", 0644,
+				   state->monitor[i].debugfs_entry,
+				   &state->sample_time);
+	}
+
+	mutex_init(&state->lock);
+
+	state->monitor_thread = kthread_run(monitor_thread, state,
+					    "rpi-axiperfmon");
+
+	return ret;
+
+}
+
+static int rpi_axiperf_remove(struct platform_device *dev)
+{
+	int ret = 0;
+
+	kthread_stop(state->monitor_thread);
+
+	debugfs_remove_recursive(state->root_folder);
+	state->root_folder = NULL;
+
+	return ret;
+}
+
+static const struct of_device_id rpi_axiperf_match[] = {
+	{
+		.compatible = "brcm,bcm2835-axiperf",
+	},
+	{},
+};
+MODULE_DEVICE_TABLE(of, rpi_axiperf_match);
+
+static struct platform_driver rpi_axiperf_driver  = {
+	.probe =	rpi_axiperf_probe,
+	.remove =	rpi_axiperf_remove,
+	.driver = {
+		.name   = "rpi-bcm2835-axiperf",
+		.of_match_table = of_match_ptr(rpi_axiperf_match),
+	},
+};
+
+module_platform_driver(rpi_axiperf_driver);
+
+/* Module information */
+MODULE_AUTHOR("James Hughes <james.hughes@raspberrypi.org>");
+MODULE_DESCRIPTION("RPI AXI Performance monitor driver");
+MODULE_LICENSE("GPL");
+
diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
index ff782445dfb7..786efcddb5e5 100644
--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
@@ -362,7 +362,7 @@ static const struct gpio_chip bcm2835_gpio_chip = {
 	.get_direction = bcm2835_gpio_get_direction,
 	.get = bcm2835_gpio_get,
 	.set = bcm2835_gpio_set,
-	.base = -1,
+	.base = 0,
 	.ngpio = BCM2835_NUM_GPIOS,
 	.can_sleep = false,
 };
diff --git a/drivers/power/reset/gpio-poweroff.c b/drivers/power/reset/gpio-poweroff.c
index be3d81ff51cc..7ed2d824e482 100644
--- a/drivers/power/reset/gpio-poweroff.c
+++ b/drivers/power/reset/gpio-poweroff.c
@@ -49,9 +49,12 @@ static int gpio_poweroff_probe(struct platform_device *pdev)
 {
 	bool input = false;
 	enum gpiod_flags flags;
+	bool force = false;
+	bool export = false;
 
 	/* If a pm_power_off function has already been added, leave it alone */
-	if (pm_power_off != NULL) {
+	force = of_property_read_bool(pdev->dev.of_node, "force");
+	if (!force && (pm_power_off != NULL)) {
 		dev_err(&pdev->dev,
 			"%s: pm_power_off function already registered",
 		       __func__);
@@ -68,6 +71,12 @@ static int gpio_poweroff_probe(struct platform_device *pdev)
 	if (IS_ERR(reset_gpio))
 		return PTR_ERR(reset_gpio);
 
+	export = of_property_read_bool(pdev->dev.of_node, "export");
+	if (export) {
+		gpiod_export(reset_gpio, false);
+		gpiod_export_link(&pdev->dev, "poweroff-gpio", reset_gpio);
+	}
+
 	pm_power_off = &gpio_poweroff_do_poweroff;
 	return 0;
 }
@@ -77,6 +86,8 @@ static int gpio_poweroff_remove(struct platform_device *pdev)
 	if (pm_power_off == &gpio_poweroff_do_poweroff)
 		pm_power_off = NULL;
 
+	gpiod_unexport(reset_gpio);
+
 	return 0;
 }
 
diff --git a/drivers/pps/clients/pps-gpio.c b/drivers/pps/clients/pps-gpio.c
index 333ad7d5b45b..ec9c4de48070 100644
--- a/drivers/pps/clients/pps-gpio.c
+++ b/drivers/pps/clients/pps-gpio.c
@@ -119,6 +119,9 @@ static int pps_gpio_probe(struct platform_device *pdev)
 
 		if (of_get_property(np, "assert-falling-edge", NULL))
 			data->assert_falling_edge = true;
+
+                if (of_get_property(np, "capture-clear", NULL))
+                        data->capture_clear = true;
 	}
 
 	/* GPIO setup */
diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
index a813239300c3..83f2b0b15712 100644
--- a/drivers/pwm/sysfs.c
+++ b/drivers/pwm/sysfs.c
@@ -263,6 +263,7 @@ static int pwm_export_child(struct device *parent, struct pwm_device *pwm)
 	export->pwm = pwm;
 	mutex_init(&export->lock);
 
+	export->child.class = parent->class;
 	export->child.release = pwm_export_release;
 	export->child.parent = parent;
 	export->child.devt = MKDEV(0, 0);
diff --git a/drivers/rtc/rtc-pcf2123.c b/drivers/rtc/rtc-pcf2123.c
index 8895f77726e8..1833b8853ceb 100644
--- a/drivers/rtc/rtc-pcf2123.c
+++ b/drivers/rtc/rtc-pcf2123.c
@@ -472,3 +472,4 @@ module_spi_driver(pcf2123_driver);
 MODULE_AUTHOR("Chris Verges <chrisv@cyberswitching.com>");
 MODULE_DESCRIPTION("NXP PCF2123 RTC driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("spi:rtc-pcf2123");
diff --git a/drivers/soc/bcm/Kconfig b/drivers/soc/bcm/Kconfig
index 49f1e2a75d61..dccd2374ed00 100644
--- a/drivers/soc/bcm/Kconfig
+++ b/drivers/soc/bcm/Kconfig
@@ -4,6 +4,7 @@ config RASPBERRYPI_POWER
 	bool "Raspberry Pi power domain driver"
 	depends on ARCH_BCM2835 || (COMPILE_TEST && OF)
 	depends on RASPBERRYPI_FIRMWARE=y
+	depends on PM
 	select PM_GENERIC_DOMAINS if PM
 	help
 	  This enables support for the RPi power domains which can be enabled
diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index f35cc10772f6..33d75ad38a7f 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -679,15 +679,8 @@ static void bcm2835_spi_set_cs(struct spi_device *spi, bool gpio_level)
 	bcm2835_wr(bs, BCM2835_SPI_CS, cs);
 }
 
-static int chip_match_name(struct gpio_chip *chip, void *data)
-{
-	return !strcmp(chip->label, data);
-}
-
 static int bcm2835_spi_setup(struct spi_device *spi)
 {
-	int err;
-	struct gpio_chip *chip;
 	/*
 	 * sanity checking the native-chipselects
 	 */
@@ -704,29 +697,6 @@ static int bcm2835_spi_setup(struct spi_device *spi)
 			"setup: only two native chip-selects are supported\n");
 		return -EINVAL;
 	}
-	/* now translate native cs to GPIO */
-
-	/* get the gpio chip for the base */
-	chip = gpiochip_find("pinctrl-bcm2835", chip_match_name);
-	if (!chip)
-		return 0;
-
-	/* and calculate the real CS */
-	spi->cs_gpio = chip->base + 8 - spi->chip_select;
-
-	/* and set up the "mode" and level */
-	dev_info(&spi->dev, "setting up native-CS%i as GPIO %i\n",
-		 spi->chip_select, spi->cs_gpio);
-
-	/* set up GPIO as output and pull to the correct level */
-	err = gpio_direction_output(spi->cs_gpio,
-				    (spi->mode & SPI_CS_HIGH) ? 0 : 1);
-	if (err) {
-		dev_err(&spi->dev,
-			"could not set CS%i gpio %i as output: %i",
-			spi->chip_select, spi->cs_gpio, err);
-		return err;
-	}
 
 	return 0;
 }
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index cda10719d1d1..4f3779d3aa09 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -669,6 +669,7 @@ static const struct of_device_id spidev_dt_ids[] = {
 	{ .compatible = "lineartechnology,ltc2488" },
 	{ .compatible = "ge,achc" },
 	{ .compatible = "semtech,sx1301" },
+	{ .compatible = "spidev" },
 	{},
 };
 MODULE_DEVICE_TABLE(of, spidev_dt_ids);
diff --git a/drivers/staging/media/lirc/Kconfig b/drivers/staging/media/lirc/Kconfig
index 3e350a9922de..2224542f8eb8 100644
--- a/drivers/staging/media/lirc/Kconfig
+++ b/drivers/staging/media/lirc/Kconfig
@@ -12,6 +12,12 @@ menuconfig LIRC_STAGING
 
 if LIRC_STAGING
 
+config LIRC_RPI
+	tristate "Homebrew GPIO Port Receiver/Transmitter for the RaspberryPi"
+	depends on LIRC
+	help
+	  Driver for Homebrew GPIO Port Receiver/Transmitter for the RaspberryPi
+
 config LIRC_ZILOG
 	tristate "Zilog/Hauppauge IR Transmitter"
 	depends on LIRC && I2C
diff --git a/drivers/staging/media/lirc/Makefile b/drivers/staging/media/lirc/Makefile
index 665562436e30..9bb9f1455759 100644
--- a/drivers/staging/media/lirc/Makefile
+++ b/drivers/staging/media/lirc/Makefile
@@ -3,4 +3,5 @@
 
 # Each configuration option enables a list of files.
 
+obj-$(CONFIG_LIRC_RPI)		+= lirc_rpi.o
 obj-$(CONFIG_LIRC_ZILOG)	+= lirc_zilog.o
diff --git a/drivers/staging/media/lirc/lirc_rpi.c b/drivers/staging/media/lirc/lirc_rpi.c
new file mode 100644
index 000000000000..84f0d94a71d9
--- /dev/null
+++ b/drivers/staging/media/lirc/lirc_rpi.c
@@ -0,0 +1,733 @@
+/*
+ * lirc_rpi.c
+ *
+ * lirc_rpi - Device driver that records pulse- and pause-lengths
+ *	      (space-lengths) (just like the lirc_serial driver does)
+ *	      between GPIO interrupt events on the Raspberry Pi.
+ *	      Lots of code has been taken from the lirc_serial module,
+ *	      so I would like say thanks to the authors.
+ *
+ * Copyright (C) 2012 Aron Robert Szabo <aron@reon.hu>,
+ *		      Michael Bishop <cleverca22@gmail.com>
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <linux/module.h>
+#include <linux/errno.h>
+#include <linux/interrupt.h>
+#include <linux/sched.h>
+#include <linux/kernel.h>
+#include <linux/time.h>
+#include <linux/timex.h>
+#include <linux/timekeeping.h>
+#include <linux/string.h>
+#include <linux/delay.h>
+#include <linux/platform_device.h>
+#include <linux/irq.h>
+#include <linux/spinlock.h>
+#include <media/lirc.h>
+#include <media/lirc_dev.h>
+#include <linux/gpio.h>
+#include <linux/of_platform.h>
+#include <linux/platform_data/bcm2708.h>
+
+#define LIRC_DRIVER_NAME "lirc_rpi"
+#define RBUF_LEN 256
+#define LIRC_TRANSMITTER_LATENCY 50
+
+#ifndef MAX_UDELAY_MS
+#define MAX_UDELAY_US 5000
+#else
+#define MAX_UDELAY_US (MAX_UDELAY_MS*1000)
+#endif
+
+#define dprintk(fmt, args...)					\
+	do {							\
+		if (debug)					\
+			printk(KERN_DEBUG LIRC_DRIVER_NAME ": "	\
+			       fmt, ## args);			\
+	} while (0)
+
+/* module parameters */
+
+/* set the default GPIO input pin */
+static int gpio_in_pin = 18;
+/* set the default pull behaviour for input pin */
+static int gpio_in_pull = BCM2708_PULL_DOWN;
+/* set the default GPIO output pin */
+static int gpio_out_pin = 17;
+/* enable debugging messages */
+static bool debug;
+/* -1 = auto, 0 = active high, 1 = active low */
+static int sense = -1;
+/* use softcarrier by default */
+static bool softcarrier = 1;
+/* 0 = do not invert output, 1 = invert output */
+static bool invert = 0;
+
+struct gpio_chip *gpiochip;
+static int irq_num;
+static int auto_sense = 1;
+
+/* forward declarations */
+static long send_pulse(unsigned long length);
+static void send_space(long length);
+static void lirc_rpi_exit(void);
+
+static struct platform_device *lirc_rpi_dev;
+static struct timeval lasttv = { 0, 0 };
+static struct lirc_buffer rbuf;
+static spinlock_t lock;
+
+/* initialized/set in init_timing_params() */
+static unsigned int freq = 38000;
+static unsigned int duty_cycle = 50;
+static unsigned long period;
+static unsigned long pulse_width;
+static unsigned long space_width;
+
+static void safe_udelay(unsigned long usecs)
+{
+	while (usecs > MAX_UDELAY_US) {
+		udelay(MAX_UDELAY_US);
+		usecs -= MAX_UDELAY_US;
+	}
+	udelay(usecs);
+}
+
+static unsigned long read_current_us(void)
+{
+	struct timespec now;
+	getnstimeofday(&now);
+	return (now.tv_sec * 1000000) + (now.tv_nsec/1000);
+}
+
+static int init_timing_params(unsigned int new_duty_cycle,
+	unsigned int new_freq)
+{
+	if (1000 * 1000000L / new_freq * new_duty_cycle / 100 <=
+	    LIRC_TRANSMITTER_LATENCY)
+		return -EINVAL;
+	if (1000 * 1000000L / new_freq * (100 - new_duty_cycle) / 100 <=
+	    LIRC_TRANSMITTER_LATENCY)
+		return -EINVAL;
+	duty_cycle = new_duty_cycle;
+	freq = new_freq;
+	period = 1000 * 1000000L / freq;
+	pulse_width = period * duty_cycle / 100;
+	space_width = period - pulse_width;
+	dprintk("in init_timing_params, freq=%d pulse=%ld, "
+		"space=%ld\n", freq, pulse_width, space_width);
+	return 0;
+}
+
+static long send_pulse_softcarrier(unsigned long length)
+{
+	int flag;
+	unsigned long actual, target;
+	unsigned long actual_us, initial_us, target_us;
+
+	length *= 1000;
+
+	actual = 0; target = 0; flag = 0;
+	actual_us = read_current_us();
+
+	while (actual < length) {
+		if (flag) {
+			gpiochip->set(gpiochip, gpio_out_pin, invert);
+			target += space_width;
+		} else {
+			gpiochip->set(gpiochip, gpio_out_pin, !invert);
+			target += pulse_width;
+		}
+		initial_us = actual_us;
+		target_us = actual_us + (target - actual) / 1000;
+		/*
+		 * Note - we've checked in ioctl that the pulse/space
+		 * widths are big enough so that d is > 0
+		 */
+		if  ((int)(target_us - actual_us) > 0)
+			udelay(target_us - actual_us);
+		actual_us = read_current_us();
+		actual += (actual_us - initial_us) * 1000;
+		flag = !flag;
+	}
+	return (actual-length) / 1000;
+}
+
+static long send_pulse(unsigned long length)
+{
+	if (length <= 0)
+		return 0;
+
+	if (softcarrier) {
+		return send_pulse_softcarrier(length);
+	} else {
+		gpiochip->set(gpiochip, gpio_out_pin, !invert);
+		safe_udelay(length);
+		return 0;
+	}
+}
+
+static void send_space(long length)
+{
+	gpiochip->set(gpiochip, gpio_out_pin, invert);
+	if (length <= 0)
+		return;
+	safe_udelay(length);
+}
+
+static void rbwrite(int l)
+{
+	if (lirc_buffer_full(&rbuf)) {
+		/* no new signals will be accepted */
+		dprintk("Buffer overrun\n");
+		return;
+	}
+	lirc_buffer_write(&rbuf, (void *)&l);
+}
+
+static void frbwrite(int l)
+{
+	/* simple noise filter */
+	static int pulse, space;
+	static unsigned int ptr;
+
+	if (ptr > 0 && (l & PULSE_BIT)) {
+		pulse += l & PULSE_MASK;
+		if (pulse > 250) {
+			rbwrite(space);
+			rbwrite(pulse | PULSE_BIT);
+			ptr = 0;
+			pulse = 0;
+		}
+		return;
+	}
+	if (!(l & PULSE_BIT)) {
+		if (ptr == 0) {
+			if (l > 20000) {
+				space = l;
+				ptr++;
+				return;
+			}
+		} else {
+			if (l > 20000) {
+				space += pulse;
+				if (space > PULSE_MASK)
+					space = PULSE_MASK;
+				space += l;
+				if (space > PULSE_MASK)
+					space = PULSE_MASK;
+				pulse = 0;
+				return;
+			}
+			rbwrite(space);
+			rbwrite(pulse | PULSE_BIT);
+			ptr = 0;
+			pulse = 0;
+		}
+	}
+	rbwrite(l);
+}
+
+static irqreturn_t irq_handler(int i, void *blah, struct pt_regs *regs)
+{
+	struct timeval tv;
+	long deltv;
+	int data;
+	int signal;
+
+	/* use the GPIO signal level */
+	signal = gpiochip->get(gpiochip, gpio_in_pin);
+
+	if (sense != -1) {
+		/* get current time */
+		do_gettimeofday(&tv);
+
+		/* calc time since last interrupt in microseconds */
+		deltv = tv.tv_sec-lasttv.tv_sec;
+		if (tv.tv_sec < lasttv.tv_sec ||
+		    (tv.tv_sec == lasttv.tv_sec &&
+		     tv.tv_usec < lasttv.tv_usec)) {
+			printk(KERN_WARNING LIRC_DRIVER_NAME
+			       ": AIEEEE: your clock just jumped backwards\n");
+			printk(KERN_WARNING LIRC_DRIVER_NAME
+			       ": %d %d %lx %lx %lx %lx\n", signal, sense,
+			       tv.tv_sec, lasttv.tv_sec,
+			       tv.tv_usec, lasttv.tv_usec);
+			data = PULSE_MASK;
+		} else if (deltv > 15) {
+			data = PULSE_MASK; /* really long time */
+			if (!(signal^sense)) {
+				/* sanity check */
+				printk(KERN_DEBUG LIRC_DRIVER_NAME
+				       ": AIEEEE: %d %d %lx %lx %lx %lx\n",
+				       signal, sense, tv.tv_sec, lasttv.tv_sec,
+				       tv.tv_usec, lasttv.tv_usec);
+				/*
+				 * detecting pulse while this
+				 * MUST be a space!
+				 */
+				if (auto_sense) {
+					sense = sense ? 0 : 1;
+				}
+			}
+		} else {
+			data = (int) (deltv*1000000 +
+				      (tv.tv_usec - lasttv.tv_usec));
+		}
+		frbwrite(signal^sense ? data : (data|PULSE_BIT));
+		lasttv = tv;
+		wake_up_interruptible(&rbuf.wait_poll);
+	}
+
+	return IRQ_HANDLED;
+}
+
+static int is_right_chip(struct gpio_chip *chip, void *data)
+{
+	dprintk("is_right_chip %s %d\n", chip->label, strcmp(data, chip->label));
+
+	if (strcmp(data, chip->label) == 0)
+		return 1;
+	return 0;
+}
+
+static inline int read_bool_property(const struct device_node *np,
+				     const char *propname,
+				     bool *out_value)
+{
+	u32 value = 0;
+	int err = of_property_read_u32(np, propname, &value);
+	if (err == 0)
+		*out_value = (value != 0);
+	return err;
+}
+
+static void read_pin_settings(struct device_node *node)
+{
+	u32 pin;
+	int index;
+
+	for (index = 0;
+	     of_property_read_u32_index(
+		     node,
+		     "brcm,pins",
+		     index,
+		     &pin) == 0;
+	     index++) {
+		u32 function;
+		int err;
+		err = of_property_read_u32_index(
+			node,
+			"brcm,function",
+			index,
+			&function);
+		if (err == 0) {
+			if (function == 1) /* Output */
+				gpio_out_pin = pin;
+			else if (function == 0) /* Input */
+				gpio_in_pin = pin;
+		}
+	}
+}
+
+static int init_port(void)
+{
+	int i, nlow, nhigh;
+	struct device_node *node;
+
+	node = lirc_rpi_dev->dev.of_node;
+
+	gpiochip = gpiochip_find("bcm2708_gpio", is_right_chip);
+
+	/*
+	 * Because of the lack of a setpull function, only support
+	 * pinctrl-bcm2835 if using device tree.
+	*/
+	if (!gpiochip && node)
+		gpiochip = gpiochip_find("pinctrl-bcm2835", is_right_chip);
+
+	if (!gpiochip) {
+		pr_err(LIRC_DRIVER_NAME ": gpio chip not found!\n");
+		return -ENODEV;
+	}
+
+	if (node) {
+		struct device_node *pins_node;
+
+		pins_node = of_parse_phandle(node, "pinctrl-0", 0);
+		if (!pins_node) {
+			printk(KERN_ERR LIRC_DRIVER_NAME
+			       ": pinctrl settings not found!\n");
+			return -EINVAL;
+		}
+
+		read_pin_settings(pins_node);
+
+		of_property_read_u32(node, "rpi,sense", &sense);
+
+		read_bool_property(node, "rpi,softcarrier", &softcarrier);
+
+		read_bool_property(node, "rpi,invert", &invert);
+
+		read_bool_property(node, "rpi,debug", &debug);
+
+	} else {
+		return -EINVAL;
+	}
+
+	gpiochip->set(gpiochip, gpio_out_pin, invert);
+
+	irq_num = gpiochip->to_irq(gpiochip, gpio_in_pin);
+	dprintk("to_irq %d\n", irq_num);
+
+	/* if pin is high, then this must be an active low receiver. */
+	if (sense == -1) {
+		/* wait 1/2 sec for the power supply */
+		msleep(500);
+
+		/*
+		 * probe 9 times every 0.04s, collect "votes" for
+		 * active high/low
+		 */
+		nlow = 0;
+		nhigh = 0;
+		for (i = 0; i < 9; i++) {
+			if (gpiochip->get(gpiochip, gpio_in_pin))
+				nlow++;
+			else
+				nhigh++;
+			msleep(40);
+		}
+		sense = (nlow >= nhigh ? 1 : 0);
+		printk(KERN_INFO LIRC_DRIVER_NAME
+		       ": auto-detected active %s receiver on GPIO pin %d\n",
+		       sense ? "low" : "high", gpio_in_pin);
+	} else {
+		printk(KERN_INFO LIRC_DRIVER_NAME
+		       ": manually using active %s receiver on GPIO pin %d\n",
+		       sense ? "low" : "high", gpio_in_pin);
+		auto_sense = 0;
+	}
+
+	return 0;
+}
+
+// called when the character device is opened
+static int set_use_inc(void *data)
+{
+	int result;
+
+	/* initialize timestamp */
+	do_gettimeofday(&lasttv);
+
+	result = request_irq(irq_num,
+			     (irq_handler_t) irq_handler,
+			     IRQ_TYPE_EDGE_RISING | IRQ_TYPE_EDGE_FALLING,
+			     LIRC_DRIVER_NAME, (void*) 0);
+
+	switch (result) {
+	case -EBUSY:
+		printk(KERN_ERR LIRC_DRIVER_NAME
+		       ": IRQ %d is busy\n",
+		       irq_num);
+		return -EBUSY;
+	case -EINVAL:
+		printk(KERN_ERR LIRC_DRIVER_NAME
+		       ": Bad irq number or handler\n");
+		return -EINVAL;
+	default:
+		dprintk("Interrupt %d obtained\n",
+			irq_num);
+		break;
+	};
+
+	/* initialize pulse/space widths */
+	init_timing_params(duty_cycle, freq);
+
+	return 0;
+}
+
+static void set_use_dec(void *data)
+{
+	/* GPIO Pin Falling/Rising Edge Detect Disable */
+	irq_set_irq_type(irq_num, 0);
+	disable_irq(irq_num);
+
+	free_irq(irq_num, (void *) 0);
+
+	dprintk(KERN_INFO LIRC_DRIVER_NAME
+		": freed IRQ %d\n", irq_num);
+}
+
+static ssize_t lirc_write(struct file *file, const char *buf,
+	size_t n, loff_t *ppos)
+{
+	int i, count;
+	unsigned long flags;
+	long delta = 0;
+	int *wbuf;
+
+	count = n / sizeof(int);
+	if (n % sizeof(int) || count % 2 == 0)
+		return -EINVAL;
+	wbuf = memdup_user(buf, n);
+	if (IS_ERR(wbuf))
+		return PTR_ERR(wbuf);
+	spin_lock_irqsave(&lock, flags);
+
+	for (i = 0; i < count; i++) {
+		if (i%2)
+			send_space(wbuf[i] - delta);
+		else
+			delta = send_pulse(wbuf[i]);
+	}
+	gpiochip->set(gpiochip, gpio_out_pin, invert);
+
+	spin_unlock_irqrestore(&lock, flags);
+	kfree(wbuf);
+	return n;
+}
+
+static long lirc_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+{
+	int result;
+	__u32 value;
+
+	switch (cmd) {
+	case LIRC_GET_SEND_MODE:
+		return -ENOIOCTLCMD;
+		break;
+
+	case LIRC_SET_SEND_MODE:
+		result = get_user(value, (__u32 *) arg);
+		if (result)
+			return result;
+		/* only LIRC_MODE_PULSE supported */
+		if (value != LIRC_MODE_PULSE)
+			return -ENOSYS;
+		break;
+
+	case LIRC_GET_LENGTH:
+		return -ENOSYS;
+		break;
+
+	case LIRC_SET_SEND_DUTY_CYCLE:
+		dprintk("SET_SEND_DUTY_CYCLE\n");
+		result = get_user(value, (__u32 *) arg);
+		if (result)
+			return result;
+		if (value <= 0 || value > 100)
+			return -EINVAL;
+		return init_timing_params(value, freq);
+		break;
+
+	case LIRC_SET_SEND_CARRIER:
+		dprintk("SET_SEND_CARRIER\n");
+		result = get_user(value, (__u32 *) arg);
+		if (result)
+			return result;
+		if (value > 500000 || value < 20000)
+			return -EINVAL;
+		return init_timing_params(duty_cycle, value);
+		break;
+
+	default:
+		return lirc_dev_fop_ioctl(filep, cmd, arg);
+	}
+	return 0;
+}
+
+static const struct file_operations lirc_fops = {
+	.owner		= THIS_MODULE,
+	.write		= lirc_write,
+	.unlocked_ioctl	= lirc_ioctl,
+	.read		= lirc_dev_fop_read,
+	.poll		= lirc_dev_fop_poll,
+	.open		= lirc_dev_fop_open,
+	.release	= lirc_dev_fop_close,
+	.llseek		= no_llseek,
+};
+
+static struct lirc_driver driver = {
+	.name		= LIRC_DRIVER_NAME,
+	.minor		= -1,
+	.code_length	= 1,
+	.data		= NULL,
+	.rbuf		= &rbuf,
+	.fops		= &lirc_fops,
+	.dev		= NULL,
+	.owner		= THIS_MODULE,
+};
+
+static const struct of_device_id lirc_rpi_of_match[] = {
+	{ .compatible = "rpi,lirc-rpi", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, lirc_rpi_of_match);
+
+static struct platform_driver lirc_rpi_driver = {
+	.driver = {
+		.name   = LIRC_DRIVER_NAME,
+		.owner  = THIS_MODULE,
+		.of_match_table = of_match_ptr(lirc_rpi_of_match),
+	},
+};
+
+static int __init lirc_rpi_init(void)
+{
+	struct device_node *node;
+	int result;
+
+	/* Init read buffer. */
+	result = lirc_buffer_init(&rbuf, sizeof(int), RBUF_LEN);
+	if (result < 0)
+		return -ENOMEM;
+
+	result = platform_driver_register(&lirc_rpi_driver);
+	if (result) {
+		printk(KERN_ERR LIRC_DRIVER_NAME
+		       ": lirc register returned %d\n", result);
+		goto exit_buffer_free;
+	}
+
+	node = of_find_compatible_node(NULL, NULL,
+				       lirc_rpi_of_match[0].compatible);
+
+	if (node) {
+		/* DT-enabled */
+		lirc_rpi_dev = of_find_device_by_node(node);
+		WARN_ON(lirc_rpi_dev->dev.of_node != node);
+		of_node_put(node);
+	}
+	else {
+		lirc_rpi_dev = platform_device_alloc(LIRC_DRIVER_NAME, 0);
+		if (!lirc_rpi_dev) {
+			result = -ENOMEM;
+			goto exit_driver_unregister;
+		}
+
+		result = platform_device_add(lirc_rpi_dev);
+		if (result)
+			goto exit_device_put;
+	}
+
+	return 0;
+
+	exit_device_put:
+	platform_device_put(lirc_rpi_dev);
+
+	exit_driver_unregister:
+	platform_driver_unregister(&lirc_rpi_driver);
+
+	exit_buffer_free:
+	lirc_buffer_free(&rbuf);
+
+	return result;
+}
+
+static void lirc_rpi_exit(void)
+{
+	set_use_dec(NULL);
+	if (!lirc_rpi_dev->dev.of_node)
+		platform_device_unregister(lirc_rpi_dev);
+	platform_driver_unregister(&lirc_rpi_driver);
+	lirc_buffer_free(&rbuf);
+}
+
+static int __init lirc_rpi_init_module(void)
+{
+	int result;
+
+	result = lirc_rpi_init();
+	if (result)
+		return result;
+
+	result = init_port();
+	if (result < 0)
+		goto exit_rpi;
+
+	driver.features = LIRC_CAN_SET_SEND_DUTY_CYCLE |
+			  LIRC_CAN_SET_SEND_CARRIER |
+			  LIRC_CAN_SEND_PULSE |
+			  LIRC_CAN_REC_MODE2;
+
+	driver.dev = &lirc_rpi_dev->dev;
+	driver.minor = lirc_register_driver(&driver);
+
+	if (driver.minor < 0) {
+		printk(KERN_ERR LIRC_DRIVER_NAME
+		       ": device registration failed with %d\n", result);
+		result = -EIO;
+		goto exit_rpi;
+	}
+
+	printk(KERN_INFO LIRC_DRIVER_NAME ": driver registered!\n");
+
+	set_use_inc(NULL);
+
+	return 0;
+
+	exit_rpi:
+	lirc_rpi_exit();
+
+	return result;
+}
+
+static void __exit lirc_rpi_exit_module(void)
+{
+	lirc_unregister_driver(driver.minor);
+
+	gpio_free(gpio_out_pin);
+	gpio_free(gpio_in_pin);
+
+	lirc_rpi_exit();
+
+	printk(KERN_INFO LIRC_DRIVER_NAME ": cleaned up module\n");
+}
+
+module_init(lirc_rpi_init_module);
+module_exit(lirc_rpi_exit_module);
+
+MODULE_DESCRIPTION("Infra-red receiver and blaster driver for Raspberry Pi GPIO.");
+MODULE_AUTHOR("Aron Robert Szabo <aron@reon.hu>");
+MODULE_AUTHOR("Michael Bishop <cleverca22@gmail.com>");
+MODULE_LICENSE("GPL");
+
+module_param(gpio_out_pin, int, S_IRUGO);
+MODULE_PARM_DESC(gpio_out_pin, "GPIO output/transmitter pin number of the BCM"
+		 " processor. (default 17");
+
+module_param(gpio_in_pin, int, S_IRUGO);
+MODULE_PARM_DESC(gpio_in_pin, "GPIO input pin number of the BCM processor."
+		 " (default 18");
+
+module_param(gpio_in_pull, int, S_IRUGO);
+MODULE_PARM_DESC(gpio_in_pull, "GPIO input pin pull configuration."
+		 " (0 = off, 1 = up, 2 = down, default down)");
+
+module_param(sense, int, S_IRUGO);
+MODULE_PARM_DESC(sense, "Override autodetection of IR receiver circuit"
+		 " (0 = active high, 1 = active low )");
+
+module_param(softcarrier, bool, S_IRUGO);
+MODULE_PARM_DESC(softcarrier, "Software carrier (0 = off, 1 = on, default on)");
+
+module_param(invert, bool, S_IRUGO);
+MODULE_PARM_DESC(invert, "Invert output (0 = off, 1 = on, default off");
+
+module_param(debug, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Enable debugging messages");
diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
index be936b8fe317..f01eea3af694 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
@@ -341,44 +341,48 @@ static void buffer_cb(struct vchiq_mmal_instance *instance,
 		}
 	} else {
 		if (dev->capture.frame_count) {
-			if (dev->capture.vc_start_timestamp != -1 &&
-			    pts != 0) {
-				struct timeval timestamp;
+			if (dev->capture.vc_start_timestamp == -1) {
+				buf->vb.vb2_buf.timestamp = ktime_get_ns();
+				v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+				 "Buffer time set as current time - %lld",
+				 buf->vb.vb2_buf.timestamp);
+
+			} else if(pts != 0) {
 				s64 runtime_us = pts -
 				    dev->capture.vc_start_timestamp;
-				u32 div = 0;
-				u32 rem = 0;
-
-				div =
-				    div_u64_rem(runtime_us, USEC_PER_SEC, &rem);
-				timestamp.tv_sec =
-				    dev->capture.kernel_start_ts.tv_sec + div;
-				timestamp.tv_usec =
-				    dev->capture.kernel_start_ts.tv_usec + rem;
-
-				if (timestamp.tv_usec >=
-				    USEC_PER_SEC) {
-					timestamp.tv_sec++;
-					timestamp.tv_usec -=
-					    USEC_PER_SEC;
-				}
+				buf->vb.vb2_buf.timestamp = (runtime_us * NSEC_PER_USEC) +
+				    dev->capture.kernel_start_timestamp;
 				v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
-					 "Convert start time %d.%06d and %llu "
-					 "with offset %llu to %d.%06d\n",
-					 (int)dev->capture.kernel_start_ts.
-					 tv_sec,
-					 (int)dev->capture.kernel_start_ts.
-					 tv_usec,
-					 dev->capture.vc_start_timestamp, pts,
-					 (int)timestamp.tv_sec,
-					 (int)timestamp.tv_usec);
-				buf->vb.vb2_buf.timestamp = timestamp.tv_sec * 1000000000ULL +
-					timestamp.tv_usec * 1000ULL;
+					 "Buffer time set as converted timestamp - %llu "
+					 "= (pts [%lld usec] - vc start time [%llu usec]) "
+					 "+ kernel start time [%llu nsec]\n",
+					 buf->vb.vb2_buf.timestamp,
+					 pts, dev->capture.vc_start_timestamp,
+					 dev->capture.kernel_start_timestamp);
 			} else {
-				buf->vb.vb2_buf.timestamp = ktime_get_ns();
+				if (dev->capture.last_timestamp) {
+					buf->vb.vb2_buf.timestamp = dev->capture.last_timestamp;
+					v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+					 "Buffer time set as last timestamp - %lld",
+					 buf->vb.vb2_buf.timestamp);
+				}
+				else {
+					buf->vb.vb2_buf.timestamp =
+					dev->capture.kernel_start_timestamp;
+					v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+					 "Buffer time set as start timestamp - %lld",
+					 buf->vb.vb2_buf.timestamp);
+				}
 			}
+			dev->capture.last_timestamp = buf->vb.vb2_buf.timestamp;
 
 			vb2_set_plane_payload(&buf->vb.vb2_buf, 0, length);
+			if (mmal_flags & MMAL_BUFFER_HEADER_FLAG_KEYFRAME)
+				buf->vb.flags |= V4L2_BUF_FLAG_KEYFRAME;
+
+			v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
+				"Buffer has ts %llu",
+				dev->capture.last_timestamp);
 			vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_DONE);
 
 			if (mmal_flags & MMAL_BUFFER_HEADER_FLAG_EOS &&
@@ -547,7 +551,9 @@ static int start_streaming(struct vb2_queue *vq, unsigned int count)
 			 "Start time %lld size %d\n",
 			 dev->capture.vc_start_timestamp, parameter_size);
 
-	v4l2_get_timestamp(&dev->capture.kernel_start_ts);
+	dev->capture.last_timestamp = 0;
+
+	dev->capture.kernel_start_timestamp = ktime_get_ns();
 
 	/* enable the camera port */
 	dev->capture.port->cb_ctx = dev;
diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
index 404037476bc5..31333f57c602 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
+++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.h
@@ -92,7 +92,9 @@ struct bm2835_mmal_dev {
 		/* VC start timestamp for streaming */
 		s64         vc_start_timestamp;
 		/* Kernel start timestamp for streaming */
-		struct timeval kernel_start_ts;
+		u64         kernel_start_timestamp;
+		/* Timestamp of last frame */
+		u64 		last_timestamp;
 
 		struct vchiq_mmal_port  *port; /* port being used for capture */
 		/* camera port being used for capture */
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index 314ffac50bb8..fe99c96fc6fc 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -1732,7 +1732,6 @@ vchiq_open(struct inode *inode, struct file *file)
 	vchiq_log_info(vchiq_arm_log_level, "vchiq_open");
 	switch (dev) {
 	case VCHIQ_MINOR: {
-		int ret;
 		VCHIQ_STATE_T *state = vchiq_get_state();
 		VCHIQ_INSTANCE_T instance;
 
@@ -1749,11 +1748,7 @@ vchiq_open(struct inode *inode, struct file *file)
 		instance->state = state;
 		instance->pid = current->tgid;
 
-		ret = vchiq_debugfs_add_instance(instance);
-		if (ret != 0) {
-			kfree(instance);
-			return ret;
-		}
+		(void)vchiq_debugfs_add_instance(instance);
 
 		sema_init(&instance->insert_event, 0);
 		sema_init(&instance->remove_event, 0);
diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
index 07002df4f83a..e3f0d1fd1720 100644
--- a/drivers/thermal/Kconfig
+++ b/drivers/thermal/Kconfig
@@ -408,7 +408,7 @@ config MTK_THERMAL
 	  controller present in Mediatek SoCs
 
 menu "Broadcom thermal drivers"
-depends on ARCH_BCM || COMPILE_TEST
+depends on ARCH_BCM || ARCH_BCM2835 || COMPILE_TEST
 source "drivers/thermal/broadcom/Kconfig"
 endmenu
 
diff --git a/drivers/tty/serial/8250/8250_bcm2835aux.c b/drivers/tty/serial/8250/8250_bcm2835aux.c
index a23c7da42ea8..4f8b8c971868 100644
--- a/drivers/tty/serial/8250/8250_bcm2835aux.c
+++ b/drivers/tty/serial/8250/8250_bcm2835aux.c
@@ -54,7 +54,8 @@ static int bcm2835aux_serial_probe(struct platform_device *pdev)
 	data->clk = devm_clk_get(&pdev->dev, NULL);
 	ret = PTR_ERR_OR_ZERO(data->clk);
 	if (ret) {
-		dev_err(&pdev->dev, "could not get clk: %d\n", ret);
+		if (ret != -EPROBE_DEFER)
+			dev_err(&pdev->dev, "could not get clk: %d\n", ret);
 		return ret;
 	}
 
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 111e6a950779..3b743cf8a94c 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -1403,6 +1403,7 @@ static bool pl011_tx_char(struct uart_amba_port *uap, unsigned char c,
 		return false; /* unable to transmit character */
 
 	pl011_write(c, uap, REG_DR);
+	mb();
 	uap->port.icount.tx++;
 
 	return true;
@@ -1672,6 +1673,23 @@ static void pl011_put_poll_char(struct uart_port *port,
 
 #endif /* CONFIG_CONSOLE_POLL */
 
+unsigned long pl011_clk_round(unsigned long clk)
+{
+	unsigned long scaler;
+
+	/*
+	 * If increasing a clock by less than 0.1% changes it
+	 * from ..999.. to ..000.., round up.
+	 */
+	scaler = 1;
+	while (scaler * 100000 < clk)
+		scaler *= 10;
+	if ((clk + scaler - 1)/scaler % 1000 == 0)
+		clk = (clk/scaler + 1) * scaler;
+
+	return clk;
+}
+
 static int pl011_hwinit(struct uart_port *port)
 {
 	struct uart_amba_port *uap =
@@ -1688,7 +1706,7 @@ static int pl011_hwinit(struct uart_port *port)
 	if (retval)
 		return retval;
 
-	uap->port.uartclk = clk_get_rate(uap->clk);
+	uap->port.uartclk = pl011_clk_round(clk_get_rate(uap->clk));
 
 	/* Clear pending error and receive interrupts */
 	pl011_write(UART011_OEIS | UART011_BEIS | UART011_PEIS |
@@ -2029,9 +2047,11 @@ pl011_set_termios(struct uart_port *port, struct ktermios *termios,
 
 		old_cr |= UART011_CR_CTSEN;
 		uap->autorts = true;
+		port->status |= UPSTAT_AUTOCTS;
 	} else {
 		old_cr &= ~(UART011_CR_CTSEN | UART011_CR_RTSEN);
 		uap->autorts = false;
+		port->status &= ~UPSTAT_AUTOCTS;
 	}
 
 	if (uap->vendor->oversampling) {
@@ -2328,7 +2348,7 @@ static int __init pl011_console_setup(struct console *co, char *options)
 			plat->init();
 	}
 
-	uap->port.uartclk = clk_get_rate(uap->clk);
+	uap->port.uartclk = pl011_clk_round(clk_get_rate(uap->clk));
 
 	if (uap->vendor->fixed_options) {
 		baud = uap->fixed_baud;
@@ -2513,6 +2533,7 @@ static struct uart_driver amba_reg = {
 	.cons			= AMBA_CONSOLE,
 };
 
+#if 0
 static int pl011_probe_dt_alias(int index, struct device *dev)
 {
 	struct device_node *np;
@@ -2544,6 +2565,7 @@ static int pl011_probe_dt_alias(int index, struct device *dev)
 
 	return ret;
 }
+#endif
 
 /* unregisters the driver also if no more ports are left */
 static void pl011_unregister_port(struct uart_amba_port *uap)
@@ -2582,7 +2604,12 @@ static int pl011_setup_port(struct device *dev, struct uart_amba_port *uap,
 	if (IS_ERR(base))
 		return PTR_ERR(base);
 
+	/* Don't use DT serial<n> aliases - it causes the device to
+	   be renumbered to ttyAMA1 if it is the second serial port in the
+	   system, even though the other one is ttyS0. The 8250 driver
+	   doesn't use this logic, so always remains ttyS0.
 	index = pl011_probe_dt_alias(index, dev);
+	*/
 
 	uap->old_cr = 0;
 	uap->port.dev = dev;
@@ -2640,6 +2667,11 @@ static int pl011_probe(struct amba_device *dev, const struct amba_id *id)
 	if (IS_ERR(uap->clk))
 		return PTR_ERR(uap->clk);
 
+	if (of_property_read_bool(dev->dev.of_node, "cts-event-workaround")) {
+	    vendor->cts_event_workaround = true;
+	    dev_info(&dev->dev, "cts_event_workaround enabled\n");
+	}
+
 	uap->reg_offset = vendor->reg_offset;
 	uap->vendor = vendor;
 	uap->fifosize = vendor->get_fifosize(dev);
diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index ca54ce074a5f..e8b928877e66 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -662,7 +662,7 @@ static void sc16is7xx_handle_tx(struct uart_port *port)
 		uart_write_wakeup(port);
 }
 
-static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno)
+static bool sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno)
 {
 	struct uart_port *port = &s->p[portno].port;
 
@@ -671,7 +671,7 @@ static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno)
 
 		iir = sc16is7xx_port_read(port, SC16IS7XX_IIR_REG);
 		if (iir & SC16IS7XX_IIR_NO_INT_BIT)
-			break;
+			return false;
 
 		iir &= SC16IS7XX_IIR_ID_MASK;
 
@@ -693,16 +693,26 @@ static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno)
 					    port->line, iir);
 			break;
 		}
-	} while (1);
+	} while (0);
+	return true;
 }
 
 static void sc16is7xx_ist(struct kthread_work *ws)
 {
 	struct sc16is7xx_port *s = to_sc16is7xx_port(ws, irq_work);
-	int i;
 
-	for (i = 0; i < s->devtype->nr_uart; ++i)
-		sc16is7xx_port_irq(s, i);
+	while (1)
+	{
+		bool keep_polling = false;
+		int i;
+
+		for (i = 0; i < s->devtype->nr_uart; ++i)
+		{
+			keep_polling |= sc16is7xx_port_irq(s, i);
+		}
+		if (!keep_polling)
+			break;
+	}
 }
 
 static irqreturn_t sc16is7xx_irq(int irq, void *dev_id)
diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index 060643a1b5c8..00809104ba9d 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -8,6 +8,7 @@
 obj-$(CONFIG_USB)		+= core/
 obj-$(CONFIG_USB_SUPPORT)	+= phy/
 
+obj-$(CONFIG_USB_DWCOTG)	+= host/
 obj-$(CONFIG_USB_DWC3)		+= dwc3/
 obj-$(CONFIG_USB_DWC2)		+= dwc2/
 obj-$(CONFIG_USB_ISP1760)	+= isp1760/
diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
index 212289c55b6f..0991626957a3 100644
--- a/drivers/usb/core/generic.c
+++ b/drivers/usb/core/generic.c
@@ -154,6 +154,7 @@ int usb_choose_configuration(struct usb_device *udev)
 		dev_warn(&udev->dev,
 			"no configuration chosen from %d choice%s\n",
 			num_configs, plural(num_configs));
+		dev_warn(&udev->dev, "No support over %dmA\n", udev->bus_mA);
 	}
 	return i;
 }
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 442be7f312f6..0af62cc8ed07 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -5072,7 +5072,7 @@ static void port_event(struct usb_hub *hub, int port1)
 	if (portchange & USB_PORT_STAT_C_OVERCURRENT) {
 		u16 status = 0, unused;
 
-		dev_dbg(&port_dev->dev, "over-current change\n");
+		dev_notice(&port_dev->dev, "over-current change\n");
 		usb_clear_port_feature(hdev, port1,
 				USB_PORT_FEAT_C_OVER_CURRENT);
 		msleep(100);	/* Cool down */
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index dd29e6ec1c43..d97e12643815 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1913,6 +1913,85 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
 	if (cp->string == NULL &&
 			!(dev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
 		cp->string = usb_cache_string(dev, cp->desc.iConfiguration);
+/* Uncomment this define to enable the HS Electrical Test support */
+#define DWC_HS_ELECT_TST 1
+#ifdef DWC_HS_ELECT_TST
+		/* Here we implement the HS Electrical Test support. The
+		 * tester uses a vendor ID of 0x1A0A to indicate we should
+		 * run a special test sequence. The product ID tells us
+		 * which sequence to run. We invoke the test sequence by
+		 * sending a non-standard SetFeature command to our root
+		 * hub port. Our dwc_otg_hcd_hub_control() routine will
+		 * recognize the command and perform the desired test
+		 * sequence.
+		 */
+		if (dev->descriptor.idVendor == 0x1A0A) {
+			/* HSOTG Electrical Test */
+			dev_warn(&dev->dev, "VID from HSOTG Electrical Test Fixture\n");
+
+			if (dev->bus && dev->bus->root_hub) {
+				struct usb_device *hdev = dev->bus->root_hub;
+				dev_warn(&dev->dev, "Got PID 0x%x\n", dev->descriptor.idProduct);
+
+				switch (dev->descriptor.idProduct) {
+				case 0x0101:	/* TEST_SE0_NAK */
+					dev_warn(&dev->dev, "TEST_SE0_NAK\n");
+					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+							USB_REQ_SET_FEATURE, USB_RT_PORT,
+							USB_PORT_FEAT_TEST, 0x300, NULL, 0, HZ);
+					break;
+
+				case 0x0102:	/* TEST_J */
+					dev_warn(&dev->dev, "TEST_J\n");
+					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+							USB_REQ_SET_FEATURE, USB_RT_PORT,
+							USB_PORT_FEAT_TEST, 0x100, NULL, 0, HZ);
+					break;
+
+				case 0x0103:	/* TEST_K */
+					dev_warn(&dev->dev, "TEST_K\n");
+					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+							USB_REQ_SET_FEATURE, USB_RT_PORT,
+							USB_PORT_FEAT_TEST, 0x200, NULL, 0, HZ);
+					break;
+
+				case 0x0104:	/* TEST_PACKET */
+					dev_warn(&dev->dev, "TEST_PACKET\n");
+					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+							USB_REQ_SET_FEATURE, USB_RT_PORT,
+							USB_PORT_FEAT_TEST, 0x400, NULL, 0, HZ);
+					break;
+
+				case 0x0105:	/* TEST_FORCE_ENABLE */
+					dev_warn(&dev->dev, "TEST_FORCE_ENABLE\n");
+					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+							USB_REQ_SET_FEATURE, USB_RT_PORT,
+							USB_PORT_FEAT_TEST, 0x500, NULL, 0, HZ);
+					break;
+
+				case 0x0106:	/* HS_HOST_PORT_SUSPEND_RESUME */
+					dev_warn(&dev->dev, "HS_HOST_PORT_SUSPEND_RESUME\n");
+					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+							USB_REQ_SET_FEATURE, USB_RT_PORT,
+							USB_PORT_FEAT_TEST, 0x600, NULL, 0, 40 * HZ);
+					break;
+
+				case 0x0107:	/* SINGLE_STEP_GET_DEVICE_DESCRIPTOR setup */
+					dev_warn(&dev->dev, "SINGLE_STEP_GET_DEVICE_DESCRIPTOR setup\n");
+					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+							USB_REQ_SET_FEATURE, USB_RT_PORT,
+							USB_PORT_FEAT_TEST, 0x700, NULL, 0, 40 * HZ);
+					break;
+
+				case 0x0108:	/* SINGLE_STEP_GET_DEVICE_DESCRIPTOR execute */
+					dev_warn(&dev->dev, "SINGLE_STEP_GET_DEVICE_DESCRIPTOR execute\n");
+					usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+							USB_REQ_SET_FEATURE, USB_RT_PORT,
+							USB_PORT_FEAT_TEST, 0x800, NULL, 0, 40 * HZ);
+				}
+			}
+		}
+#endif /* DWC_HS_ELECT_TST */
 
 	/* Now that the interfaces are installed, re-enable LPM. */
 	usb_unlocked_enable_lpm(dev);
diff --git a/drivers/usb/core/otg_whitelist.h b/drivers/usb/core/otg_whitelist.h
index 085049d37d7a..63a461a21cc1 100644
--- a/drivers/usb/core/otg_whitelist.h
+++ b/drivers/usb/core/otg_whitelist.h
@@ -19,33 +19,82 @@
 static struct usb_device_id whitelist_table[] = {
 
 /* hubs are optional in OTG, but very handy ... */
+#define CERT_WITHOUT_HUBS
+#if defined(CERT_WITHOUT_HUBS)
+{ USB_DEVICE( 0x0000, 0x0000 ), }, /* Root HUB Only*/
+#else
 { USB_DEVICE_INFO(USB_CLASS_HUB, 0, 0), },
 { USB_DEVICE_INFO(USB_CLASS_HUB, 0, 1), },
+{ USB_DEVICE_INFO(USB_CLASS_HUB, 0, 2), },
+#endif
 
 #ifdef	CONFIG_USB_PRINTER		/* ignoring nonstatic linkage! */
 /* FIXME actually, printers are NOT supposed to use device classes;
  * they're supposed to use interface classes...
  */
-{ USB_DEVICE_INFO(7, 1, 1) },
-{ USB_DEVICE_INFO(7, 1, 2) },
-{ USB_DEVICE_INFO(7, 1, 3) },
+//{ USB_DEVICE_INFO(7, 1, 1) },
+//{ USB_DEVICE_INFO(7, 1, 2) },
+//{ USB_DEVICE_INFO(7, 1, 3) },
 #endif
 
 #ifdef	CONFIG_USB_NET_CDCETHER
 /* Linux-USB CDC Ethernet gadget */
-{ USB_DEVICE(0x0525, 0xa4a1), },
+//{ USB_DEVICE(0x0525, 0xa4a1), },
 /* Linux-USB CDC Ethernet + RNDIS gadget */
-{ USB_DEVICE(0x0525, 0xa4a2), },
+//{ USB_DEVICE(0x0525, 0xa4a2), },
 #endif
 
 #if	IS_ENABLED(CONFIG_USB_TEST)
 /* gadget zero, for testing */
-{ USB_DEVICE(0x0525, 0xa4a0), },
+//{ USB_DEVICE(0x0525, 0xa4a0), },
 #endif
 
+/* OPT Tester */
+{ USB_DEVICE( 0x1a0a, 0x0101 ), }, /* TEST_SE0_NAK */
+{ USB_DEVICE( 0x1a0a, 0x0102 ), }, /* Test_J */
+{ USB_DEVICE( 0x1a0a, 0x0103 ), }, /* Test_K */
+{ USB_DEVICE( 0x1a0a, 0x0104 ), }, /* Test_PACKET */
+{ USB_DEVICE( 0x1a0a, 0x0105 ), }, /* Test_FORCE_ENABLE */
+{ USB_DEVICE( 0x1a0a, 0x0106 ), }, /* HS_PORT_SUSPEND_RESUME  */
+{ USB_DEVICE( 0x1a0a, 0x0107 ), }, /* SINGLE_STEP_GET_DESCRIPTOR setup */
+{ USB_DEVICE( 0x1a0a, 0x0108 ), }, /* SINGLE_STEP_GET_DESCRIPTOR execute */
+
+/* Sony cameras */
+{ USB_DEVICE_VER(0x054c,0x0010,0x0410, 0x0500), },
+
+/* Memory Devices */
+//{ USB_DEVICE( 0x0781, 0x5150 ), }, /* SanDisk */
+//{ USB_DEVICE( 0x05DC, 0x0080 ), }, /* Lexar */
+//{ USB_DEVICE( 0x4146, 0x9281 ), }, /* IOMEGA */
+//{ USB_DEVICE( 0x067b, 0x2507 ), }, /* Hammer 20GB External HD  */
+{ USB_DEVICE( 0x0EA0, 0x2168 ), }, /* Ours Technology Inc. (BUFFALO ClipDrive)*/
+//{ USB_DEVICE( 0x0457, 0x0150 ), }, /* Silicon Integrated Systems Corp. */
+
+/* HP Printers */
+//{ USB_DEVICE( 0x03F0, 0x1102 ), }, /* HP Photosmart 245 */
+//{ USB_DEVICE( 0x03F0, 0x1302 ), }, /* HP Photosmart 370 Series */
+
+/* Speakers */
+//{ USB_DEVICE( 0x0499, 0x3002 ), }, /* YAMAHA YST-MS35D USB Speakers */
+//{ USB_DEVICE( 0x0672, 0x1041 ), }, /* Labtec USB Headset */
+
 { }	/* Terminating entry */
 };
 
+static inline void report_errors(struct usb_device *dev)
+{
+	/* OTG MESSAGE: report errors here, customize to match your product */
+	dev_info(&dev->dev, "device Vendor:%04x Product:%04x is not supported\n",
+		 le16_to_cpu(dev->descriptor.idVendor),
+		 le16_to_cpu(dev->descriptor.idProduct));
+        if (USB_CLASS_HUB == dev->descriptor.bDeviceClass){
+                dev_printk(KERN_CRIT, &dev->dev, "Unsupported Hub Topology\n");
+        } else {
+                dev_printk(KERN_CRIT, &dev->dev, "Attached Device is not Supported\n");
+        }
+}
+
+
 static int is_targeted(struct usb_device *dev)
 {
 	struct usb_device_id	*id = whitelist_table;
@@ -95,16 +144,57 @@ static int is_targeted(struct usb_device *dev)
 			continue;
 
 		return 1;
-	}
+		/* NOTE: can't use usb_match_id() since interface caches
+		 * aren't set up yet. this is cut/paste from that code.
+		 */
+		for (id = whitelist_table; id->match_flags; id++) {
+#ifdef DEBUG
+			dev_dbg(&dev->dev,
+				"ID: V:%04x P:%04x DC:%04x SC:%04x PR:%04x \n",
+				id->idVendor,
+				id->idProduct,
+				id->bDeviceClass,
+				id->bDeviceSubClass,
+				id->bDeviceProtocol);
+#endif
 
-	/* add other match criteria here ... */
+			if ((id->match_flags & USB_DEVICE_ID_MATCH_VENDOR) &&
+			    id->idVendor != le16_to_cpu(dev->descriptor.idVendor))
+				continue;
 
+			if ((id->match_flags & USB_DEVICE_ID_MATCH_PRODUCT) &&
+			    id->idProduct != le16_to_cpu(dev->descriptor.idProduct))
+				continue;
 
-	/* OTG MESSAGE: report errors here, customize to match your product */
-	dev_err(&dev->dev, "device v%04x p%04x is not supported\n",
-		le16_to_cpu(dev->descriptor.idVendor),
-		le16_to_cpu(dev->descriptor.idProduct));
+			/* No need to test id->bcdDevice_lo != 0, since 0 is never
+			   greater than any unsigned number. */
+			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_LO) &&
+			    (id->bcdDevice_lo > le16_to_cpu(dev->descriptor.bcdDevice)))
+				continue;
+
+			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_HI) &&
+			    (id->bcdDevice_hi < le16_to_cpu(dev->descriptor.bcdDevice)))
+				continue;
+
+			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_CLASS) &&
+			    (id->bDeviceClass != dev->descriptor.bDeviceClass))
+				continue;
+
+			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_SUBCLASS) &&
+			    (id->bDeviceSubClass != dev->descriptor.bDeviceSubClass))
+				continue;
+
+			if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_PROTOCOL) &&
+			    (id->bDeviceProtocol != dev->descriptor.bDeviceProtocol))
+				continue;
+
+			return 1;
+		}
+	}
+
+	/* add other match criteria here ... */
 
+	report_errors(dev);
 	return 0;
 }
 
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
new file mode 100644
index 000000000000..a896d73f7a93
--- /dev/null
+++ b/drivers/usb/gadget/file_storage.c
@@ -0,0 +1,3676 @@
+/*
+ * file_storage.c -- File-backed USB Storage Gadget, for USB development
+ *
+ * Copyright (C) 2003-2008 Alan Stern
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+/*
+ * The File-backed Storage Gadget acts as a USB Mass Storage device,
+ * appearing to the host as a disk drive or as a CD-ROM drive.  In addition
+ * to providing an example of a genuinely useful gadget driver for a USB
+ * device, it also illustrates a technique of double-buffering for increased
+ * throughput.  Last but not least, it gives an easy way to probe the
+ * behavior of the Mass Storage drivers in a USB host.
+ *
+ * Backing storage is provided by a regular file or a block device, specified
+ * by the "file" module parameter.  Access can be limited to read-only by
+ * setting the optional "ro" module parameter.  (For CD-ROM emulation,
+ * access is always read-only.)  The gadget will indicate that it has
+ * removable media if the optional "removable" module parameter is set.
+ *
+ * The gadget supports the Control-Bulk (CB), Control-Bulk-Interrupt (CBI),
+ * and Bulk-Only (also known as Bulk-Bulk-Bulk or BBB) transports, selected
+ * by the optional "transport" module parameter.  It also supports the
+ * following protocols: RBC (0x01), ATAPI or SFF-8020i (0x02), QIC-157 (0c03),
+ * UFI (0x04), SFF-8070i (0x05), and transparent SCSI (0x06), selected by
+ * the optional "protocol" module parameter.  In addition, the default
+ * Vendor ID, Product ID, release number and serial number can be overridden.
+ *
+ * There is support for multiple logical units (LUNs), each of which has
+ * its own backing file.  The number of LUNs can be set using the optional
+ * "luns" module parameter (anywhere from 1 to 8), and the corresponding
+ * files are specified using comma-separated lists for "file" and "ro".
+ * The default number of LUNs is taken from the number of "file" elements;
+ * it is 1 if "file" is not given.  If "removable" is not set then a backing
+ * file must be specified for each LUN.  If it is set, then an unspecified
+ * or empty backing filename means the LUN's medium is not loaded.  Ideally
+ * each LUN would be settable independently as a disk drive or a CD-ROM
+ * drive, but currently all LUNs have to be the same type.  The CD-ROM
+ * emulation includes a single data track and no audio tracks; hence there
+ * need be only one backing file per LUN.
+ *
+ * Requirements are modest; only a bulk-in and a bulk-out endpoint are
+ * needed (an interrupt-out endpoint is also needed for CBI).  The memory
+ * requirement amounts to two 16K buffers, size configurable by a parameter.
+ * Support is included for both full-speed and high-speed operation.
+ *
+ * Note that the driver is slightly non-portable in that it assumes a
+ * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
+ * interrupt-in endpoints.  With most device controllers this isn't an
+ * issue, but there may be some with hardware restrictions that prevent
+ * a buffer from being used by more than one endpoint.
+ *
+ * Module options:
+ *
+ *	file=filename[,filename...]
+ *				Required if "removable" is not set, names of
+ *					the files or block devices used for
+ *					backing storage
+ *	serial=HHHH...		Required serial number (string of hex chars)
+ *	ro=b[,b...]		Default false, booleans for read-only access
+ *	removable		Default false, boolean for removable media
+ *	luns=N			Default N = number of filenames, number of
+ *					LUNs to support
+ *	nofua=b[,b...]		Default false, booleans for ignore FUA flag
+ *					in SCSI WRITE(10,12) commands
+ *	stall			Default determined according to the type of
+ *					USB device controller (usually true),
+ *					boolean to permit the driver to halt
+ *					bulk endpoints
+ *	cdrom			Default false, boolean for whether to emulate
+ *					a CD-ROM drive
+ *	transport=XXX		Default BBB, transport name (CB, CBI, or BBB)
+ *	protocol=YYY		Default SCSI, protocol name (RBC, 8020 or
+ *					ATAPI, QIC, UFI, 8070, or SCSI;
+ *					also 1 - 6)
+ *	vendor=0xVVVV		Default 0x0525 (NetChip), USB Vendor ID
+ *	product=0xPPPP		Default 0xa4a5 (FSG), USB Product ID
+ *	release=0xRRRR		Override the USB release number (bcdDevice)
+ *	buflen=N		Default N=16384, buffer size used (will be
+ *					rounded down to a multiple of
+ *					PAGE_CACHE_SIZE)
+ *
+ * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "serial", "ro",
+ * "removable", "luns", "nofua", "stall", and "cdrom" options are available;
+ * default values are used for everything else.
+ *
+ * The pathnames of the backing files and the ro settings are available in
+ * the attribute files "file", "nofua", and "ro" in the lun<n> subdirectory of
+ * the gadget's sysfs directory.  If the "removable" option is set, writing to
+ * these files will simulate ejecting/loading the medium (writing an empty
+ * line means eject) and adjusting a write-enable tab.  Changes to the ro
+ * setting are not allowed when the medium is loaded or if CD-ROM emulation
+ * is being used.
+ *
+ * This gadget driver is heavily based on "Gadget Zero" by David Brownell.
+ * The driver's SCSI command interface was based on the "Information
+ * technology - Small Computer System Interface - 2" document from
+ * X3T9.2 Project 375D, Revision 10L, 7-SEP-93, available at
+ * <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>.  The single exception
+ * is opcode 0x23 (READ FORMAT CAPACITIES), which was based on the
+ * "Universal Serial Bus Mass Storage Class UFI Command Specification"
+ * document, Revision 1.0, December 14, 1998, available at
+ * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
+ */
+
+
+/*
+ *				Driver Design
+ *
+ * The FSG driver is fairly straightforward.  There is a main kernel
+ * thread that handles most of the work.  Interrupt routines field
+ * callbacks from the controller driver: bulk- and interrupt-request
+ * completion notifications, endpoint-0 events, and disconnect events.
+ * Completion events are passed to the main thread by wakeup calls.  Many
+ * ep0 requests are handled at interrupt time, but SetInterface,
+ * SetConfiguration, and device reset requests are forwarded to the
+ * thread in the form of "exceptions" using SIGUSR1 signals (since they
+ * should interrupt any ongoing file I/O operations).
+ *
+ * The thread's main routine implements the standard command/data/status
+ * parts of a SCSI interaction.  It and its subroutines are full of tests
+ * for pending signals/exceptions -- all this polling is necessary since
+ * the kernel has no setjmp/longjmp equivalents.  (Maybe this is an
+ * indication that the driver really wants to be running in userspace.)
+ * An important point is that so long as the thread is alive it keeps an
+ * open reference to the backing file.  This will prevent unmounting
+ * the backing file's underlying filesystem and could cause problems
+ * during system shutdown, for example.  To prevent such problems, the
+ * thread catches INT, TERM, and KILL signals and converts them into
+ * an EXIT exception.
+ *
+ * In normal operation the main thread is started during the gadget's
+ * fsg_bind() callback and stopped during fsg_unbind().  But it can also
+ * exit when it receives a signal, and there's no point leaving the
+ * gadget running when the thread is dead.  So just before the thread
+ * exits, it deregisters the gadget driver.  This makes things a little
+ * tricky: The driver is deregistered at two places, and the exiting
+ * thread can indirectly call fsg_unbind() which in turn can tell the
+ * thread to exit.  The first problem is resolved through the use of the
+ * REGISTERED atomic bitflag; the driver will only be deregistered once.
+ * The second problem is resolved by having fsg_unbind() check
+ * fsg->state; it won't try to stop the thread if the state is already
+ * FSG_STATE_TERMINATED.
+ *
+ * To provide maximum throughput, the driver uses a circular pipeline of
+ * buffer heads (struct fsg_buffhd).  In principle the pipeline can be
+ * arbitrarily long; in practice the benefits don't justify having more
+ * than 2 stages (i.e., double buffering).  But it helps to think of the
+ * pipeline as being a long one.  Each buffer head contains a bulk-in and
+ * a bulk-out request pointer (since the buffer can be used for both
+ * output and input -- directions always are given from the host's
+ * point of view) as well as a pointer to the buffer and various state
+ * variables.
+ *
+ * Use of the pipeline follows a simple protocol.  There is a variable
+ * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
+ * At any time that buffer head may still be in use from an earlier
+ * request, so each buffer head has a state variable indicating whether
+ * it is EMPTY, FULL, or BUSY.  Typical use involves waiting for the
+ * buffer head to be EMPTY, filling the buffer either by file I/O or by
+ * USB I/O (during which the buffer head is BUSY), and marking the buffer
+ * head FULL when the I/O is complete.  Then the buffer will be emptied
+ * (again possibly by USB I/O, during which it is marked BUSY) and
+ * finally marked EMPTY again (possibly by a completion routine).
+ *
+ * A module parameter tells the driver to avoid stalling the bulk
+ * endpoints wherever the transport specification allows.  This is
+ * necessary for some UDCs like the SuperH, which cannot reliably clear a
+ * halt on a bulk endpoint.  However, under certain circumstances the
+ * Bulk-only specification requires a stall.  In such cases the driver
+ * will halt the endpoint and set a flag indicating that it should clear
+ * the halt in software during the next device reset.  Hopefully this
+ * will permit everything to work correctly.  Furthermore, although the
+ * specification allows the bulk-out endpoint to halt when the host sends
+ * too much data, implementing this would cause an unavoidable race.
+ * The driver will always use the "no-stall" approach for OUT transfers.
+ *
+ * One subtle point concerns sending status-stage responses for ep0
+ * requests.  Some of these requests, such as device reset, can involve
+ * interrupting an ongoing file I/O operation, which might take an
+ * arbitrarily long time.  During that delay the host might give up on
+ * the original ep0 request and issue a new one.  When that happens the
+ * driver should not notify the host about completion of the original
+ * request, as the host will no longer be waiting for it.  So the driver
+ * assigns to each ep0 request a unique tag, and it keeps track of the
+ * tag value of the request associated with a long-running exception
+ * (device-reset, interface-change, or configuration-change).  When the
+ * exception handler is finished, the status-stage response is submitted
+ * only if the current ep0 request tag is equal to the exception request
+ * tag.  Thus only the most recently received ep0 request will get a
+ * status-stage response.
+ *
+ * Warning: This driver source file is too long.  It ought to be split up
+ * into a header file plus about 3 separate .c files, to handle the details
+ * of the Gadget, USB Mass Storage, and SCSI protocols.
+ */
+
+
+/* #define VERBOSE_DEBUG */
+/* #define DUMP_MSGS */
+
+
+#include <linux/blkdev.h>
+#include <linux/completion.h>
+#include <linux/dcache.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/fcntl.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/kref.h>
+#include <linux/kthread.h>
+#include <linux/limits.h>
+#include <linux/module.h>
+#include <linux/rwsem.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/string.h>
+#include <linux/freezer.h>
+#include <linux/utsname.h>
+
+#include <linux/usb/ch9.h>
+#include <linux/usb/gadget.h>
+
+#include "gadget_chips.h"
+
+
+
+/*
+ * Kbuild is not very cooperative with respect to linking separately
+ * compiled library objects into one module.  So for now we won't use
+ * separate compilation ... ensuring init/exit sections work to shrink
+ * the runtime footprint, and giving us at least some parts of what
+ * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
+ */
+#include "usbstring.c"
+#include "config.c"
+#include "epautoconf.c"
+
+/*-------------------------------------------------------------------------*/
+
+#define DRIVER_DESC		"File-backed Storage Gadget"
+#define DRIVER_NAME		"g_file_storage"
+#define DRIVER_VERSION		"1 September 2010"
+
+static       char fsg_string_manufacturer[64];
+static const char fsg_string_product[] = DRIVER_DESC;
+static const char fsg_string_config[] = "Self-powered";
+static const char fsg_string_interface[] = "Mass Storage";
+
+
+#include "storage_common.c"
+
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR("Alan Stern");
+MODULE_LICENSE("Dual BSD/GPL");
+
+/*
+ * This driver assumes self-powered hardware and has no way for users to
+ * trigger remote wakeup.  It uses autoconfiguration to select endpoints
+ * and endpoint addresses.
+ */
+
+
+/*-------------------------------------------------------------------------*/
+
+
+/* Encapsulate the module parameter settings */
+
+static struct {
+	char		*file[FSG_MAX_LUNS];
+	char		*serial;
+	bool		ro[FSG_MAX_LUNS];
+	bool		nofua[FSG_MAX_LUNS];
+	unsigned int	num_filenames;
+	unsigned int	num_ros;
+	unsigned int	num_nofuas;
+	unsigned int	nluns;
+
+	bool		removable;
+	bool		can_stall;
+	bool		cdrom;
+
+	char		*transport_parm;
+	char		*protocol_parm;
+	unsigned short	vendor;
+	unsigned short	product;
+	unsigned short	release;
+	unsigned int	buflen;
+
+	int		transport_type;
+	char		*transport_name;
+	int		protocol_type;
+	char		*protocol_name;
+
+} mod_data = {					// Default values
+	.transport_parm		= "BBB",
+	.protocol_parm		= "SCSI",
+	.removable		= 0,
+	.can_stall		= 1,
+	.cdrom			= 0,
+	.vendor			= FSG_VENDOR_ID,
+	.product		= FSG_PRODUCT_ID,
+	.release		= 0xffff,	// Use controller chip type
+	.buflen			= 16384,
+	};
+
+
+module_param_array_named(file, mod_data.file, charp, &mod_data.num_filenames,
+		S_IRUGO);
+MODULE_PARM_DESC(file, "names of backing files or devices");
+
+module_param_named(serial, mod_data.serial, charp, S_IRUGO);
+MODULE_PARM_DESC(serial, "USB serial number");
+
+module_param_array_named(ro, mod_data.ro, bool, &mod_data.num_ros, S_IRUGO);
+MODULE_PARM_DESC(ro, "true to force read-only");
+
+module_param_array_named(nofua, mod_data.nofua, bool, &mod_data.num_nofuas,
+		S_IRUGO);
+MODULE_PARM_DESC(nofua, "true to ignore SCSI WRITE(10,12) FUA bit");
+
+module_param_named(luns, mod_data.nluns, uint, S_IRUGO);
+MODULE_PARM_DESC(luns, "number of LUNs");
+
+module_param_named(removable, mod_data.removable, bool, S_IRUGO);
+MODULE_PARM_DESC(removable, "true to simulate removable media");
+
+module_param_named(stall, mod_data.can_stall, bool, S_IRUGO);
+MODULE_PARM_DESC(stall, "false to prevent bulk stalls");
+
+module_param_named(cdrom, mod_data.cdrom, bool, S_IRUGO);
+MODULE_PARM_DESC(cdrom, "true to emulate cdrom instead of disk");
+
+/* In the non-TEST version, only the module parameters listed above
+ * are available. */
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+
+module_param_named(transport, mod_data.transport_parm, charp, S_IRUGO);
+MODULE_PARM_DESC(transport, "type of transport (BBB, CBI, or CB)");
+
+module_param_named(protocol, mod_data.protocol_parm, charp, S_IRUGO);
+MODULE_PARM_DESC(protocol, "type of protocol (RBC, 8020, QIC, UFI, "
+		"8070, or SCSI)");
+
+module_param_named(vendor, mod_data.vendor, ushort, S_IRUGO);
+MODULE_PARM_DESC(vendor, "USB Vendor ID");
+
+module_param_named(product, mod_data.product, ushort, S_IRUGO);
+MODULE_PARM_DESC(product, "USB Product ID");
+
+module_param_named(release, mod_data.release, ushort, S_IRUGO);
+MODULE_PARM_DESC(release, "USB release number");
+
+module_param_named(buflen, mod_data.buflen, uint, S_IRUGO);
+MODULE_PARM_DESC(buflen, "I/O buffer size");
+
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+
+/*
+ * These definitions will permit the compiler to avoid generating code for
+ * parts of the driver that aren't used in the non-TEST version.  Even gcc
+ * can recognize when a test of a constant expression yields a dead code
+ * path.
+ */
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+
+#define transport_is_bbb()	(mod_data.transport_type == USB_PR_BULK)
+#define transport_is_cbi()	(mod_data.transport_type == USB_PR_CBI)
+#define protocol_is_scsi()	(mod_data.protocol_type == USB_SC_SCSI)
+
+#else
+
+#define transport_is_bbb()	1
+#define transport_is_cbi()	0
+#define protocol_is_scsi()	1
+
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+
+/*-------------------------------------------------------------------------*/
+
+
+struct fsg_dev {
+	/* lock protects: state, all the req_busy's, and cbbuf_cmnd */
+	spinlock_t		lock;
+	struct usb_gadget	*gadget;
+
+	/* filesem protects: backing files in use */
+	struct rw_semaphore	filesem;
+
+	/* reference counting: wait until all LUNs are released */
+	struct kref		ref;
+
+	struct usb_ep		*ep0;		// Handy copy of gadget->ep0
+	struct usb_request	*ep0req;	// For control responses
+	unsigned int		ep0_req_tag;
+	const char		*ep0req_name;
+
+	struct usb_request	*intreq;	// For interrupt responses
+	int			intreq_busy;
+	struct fsg_buffhd	*intr_buffhd;
+
+	unsigned int		bulk_out_maxpacket;
+	enum fsg_state		state;		// For exception handling
+	unsigned int		exception_req_tag;
+
+	u8			config, new_config;
+
+	unsigned int		running : 1;
+	unsigned int		bulk_in_enabled : 1;
+	unsigned int		bulk_out_enabled : 1;
+	unsigned int		intr_in_enabled : 1;
+	unsigned int		phase_error : 1;
+	unsigned int		short_packet_received : 1;
+	unsigned int		bad_lun_okay : 1;
+
+	unsigned long		atomic_bitflags;
+#define REGISTERED		0
+#define IGNORE_BULK_OUT		1
+#define SUSPENDED		2
+
+	struct usb_ep		*bulk_in;
+	struct usb_ep		*bulk_out;
+	struct usb_ep		*intr_in;
+
+	struct fsg_buffhd	*next_buffhd_to_fill;
+	struct fsg_buffhd	*next_buffhd_to_drain;
+
+	int			thread_wakeup_needed;
+	struct completion	thread_notifier;
+	struct task_struct	*thread_task;
+
+	int			cmnd_size;
+	u8			cmnd[MAX_COMMAND_SIZE];
+	enum data_direction	data_dir;
+	u32			data_size;
+	u32			data_size_from_cmnd;
+	u32			tag;
+	unsigned int		lun;
+	u32			residue;
+	u32			usb_amount_left;
+
+	/* The CB protocol offers no way for a host to know when a command
+	 * has completed.  As a result the next command may arrive early,
+	 * and we will still have to handle it.  For that reason we need
+	 * a buffer to store new commands when using CB (or CBI, which
+	 * does not oblige a host to wait for command completion either). */
+	int			cbbuf_cmnd_size;
+	u8			cbbuf_cmnd[MAX_COMMAND_SIZE];
+
+	unsigned int		nluns;
+	struct fsg_lun		*luns;
+	struct fsg_lun		*curlun;
+	/* Must be the last entry */
+	struct fsg_buffhd	buffhds[];
+};
+
+typedef void (*fsg_routine_t)(struct fsg_dev *);
+
+static int exception_in_progress(struct fsg_dev *fsg)
+{
+	return (fsg->state > FSG_STATE_IDLE);
+}
+
+/* Make bulk-out requests be divisible by the maxpacket size */
+static void set_bulk_out_req_length(struct fsg_dev *fsg,
+		struct fsg_buffhd *bh, unsigned int length)
+{
+	unsigned int	rem;
+
+	bh->bulk_out_intended_length = length;
+	rem = length % fsg->bulk_out_maxpacket;
+	if (rem > 0)
+		length += fsg->bulk_out_maxpacket - rem;
+	bh->outreq->length = length;
+}
+
+static struct fsg_dev			*the_fsg;
+static struct usb_gadget_driver		fsg_driver;
+
+
+/*-------------------------------------------------------------------------*/
+
+static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
+{
+	const char	*name;
+
+	if (ep == fsg->bulk_in)
+		name = "bulk-in";
+	else if (ep == fsg->bulk_out)
+		name = "bulk-out";
+	else
+		name = ep->name;
+	DBG(fsg, "%s set halt\n", name);
+	return usb_ep_set_halt(ep);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * DESCRIPTORS ... most are static, but strings and (full) configuration
+ * descriptors are built on demand.  Also the (static) config and interface
+ * descriptors are adjusted during fsg_bind().
+ */
+
+/* There is only one configuration. */
+#define	CONFIG_VALUE		1
+
+static struct usb_device_descriptor
+device_desc = {
+	.bLength =		sizeof device_desc,
+	.bDescriptorType =	USB_DT_DEVICE,
+
+	.bcdUSB =		cpu_to_le16(0x0200),
+	.bDeviceClass =		USB_CLASS_PER_INTERFACE,
+
+	/* The next three values can be overridden by module parameters */
+	.idVendor =		cpu_to_le16(FSG_VENDOR_ID),
+	.idProduct =		cpu_to_le16(FSG_PRODUCT_ID),
+	.bcdDevice =		cpu_to_le16(0xffff),
+
+	.iManufacturer =	FSG_STRING_MANUFACTURER,
+	.iProduct =		FSG_STRING_PRODUCT,
+	.iSerialNumber =	FSG_STRING_SERIAL,
+	.bNumConfigurations =	1,
+};
+
+static struct usb_config_descriptor
+config_desc = {
+	.bLength =		sizeof config_desc,
+	.bDescriptorType =	USB_DT_CONFIG,
+
+	/* wTotalLength computed by usb_gadget_config_buf() */
+	.bNumInterfaces =	1,
+	.bConfigurationValue =	CONFIG_VALUE,
+	.iConfiguration =	FSG_STRING_CONFIG,
+	.bmAttributes =		USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
+	.bMaxPower =		CONFIG_USB_GADGET_VBUS_DRAW / 2,
+};
+
+
+static struct usb_qualifier_descriptor
+dev_qualifier = {
+	.bLength =		sizeof dev_qualifier,
+	.bDescriptorType =	USB_DT_DEVICE_QUALIFIER,
+
+	.bcdUSB =		cpu_to_le16(0x0200),
+	.bDeviceClass =		USB_CLASS_PER_INTERFACE,
+
+	.bNumConfigurations =	1,
+};
+
+static int populate_bos(struct fsg_dev *fsg, u8 *buf)
+{
+	memcpy(buf, &fsg_bos_desc, USB_DT_BOS_SIZE);
+	buf += USB_DT_BOS_SIZE;
+
+	memcpy(buf, &fsg_ext_cap_desc, USB_DT_USB_EXT_CAP_SIZE);
+	buf += USB_DT_USB_EXT_CAP_SIZE;
+
+	memcpy(buf, &fsg_ss_cap_desc, USB_DT_USB_SS_CAP_SIZE);
+
+	return USB_DT_BOS_SIZE + USB_DT_USB_SS_CAP_SIZE
+		+ USB_DT_USB_EXT_CAP_SIZE;
+}
+
+/*
+ * Config descriptors must agree with the code that sets configurations
+ * and with code managing interfaces and their altsettings.  They must
+ * also handle different speeds and other-speed requests.
+ */
+static int populate_config_buf(struct usb_gadget *gadget,
+		u8 *buf, u8 type, unsigned index)
+{
+	enum usb_device_speed			speed = gadget->speed;
+	int					len;
+	const struct usb_descriptor_header	**function;
+
+	if (index > 0)
+		return -EINVAL;
+
+	if (gadget_is_dualspeed(gadget) && type == USB_DT_OTHER_SPEED_CONFIG)
+		speed = (USB_SPEED_FULL + USB_SPEED_HIGH) - speed;
+	function = gadget_is_dualspeed(gadget) && speed == USB_SPEED_HIGH
+		? (const struct usb_descriptor_header **)fsg_hs_function
+		: (const struct usb_descriptor_header **)fsg_fs_function;
+
+	/* for now, don't advertise srp-only devices */
+	if (!gadget_is_otg(gadget))
+		function++;
+
+	len = usb_gadget_config_buf(&config_desc, buf, EP0_BUFSIZE, function);
+	((struct usb_config_descriptor *) buf)->bDescriptorType = type;
+	return len;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* These routines may be called in process context or in_irq */
+
+/* Caller must hold fsg->lock */
+static void wakeup_thread(struct fsg_dev *fsg)
+{
+	/* Tell the main thread that something has happened */
+	fsg->thread_wakeup_needed = 1;
+	if (fsg->thread_task)
+		wake_up_process(fsg->thread_task);
+}
+
+
+static void raise_exception(struct fsg_dev *fsg, enum fsg_state new_state)
+{
+	unsigned long		flags;
+
+	/* Do nothing if a higher-priority exception is already in progress.
+	 * If a lower-or-equal priority exception is in progress, preempt it
+	 * and notify the main thread by sending it a signal. */
+	spin_lock_irqsave(&fsg->lock, flags);
+	if (fsg->state <= new_state) {
+		fsg->exception_req_tag = fsg->ep0_req_tag;
+		fsg->state = new_state;
+		if (fsg->thread_task)
+			send_sig_info(SIGUSR1, SEND_SIG_FORCED,
+					fsg->thread_task);
+	}
+	spin_unlock_irqrestore(&fsg->lock, flags);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* The disconnect callback and ep0 routines.  These always run in_irq,
+ * except that ep0_queue() is called in the main thread to acknowledge
+ * completion of various requests: set config, set interface, and
+ * Bulk-only device reset. */
+
+static void fsg_disconnect(struct usb_gadget *gadget)
+{
+	struct fsg_dev		*fsg = get_gadget_data(gadget);
+
+	DBG(fsg, "disconnect or port reset\n");
+	raise_exception(fsg, FSG_STATE_DISCONNECT);
+}
+
+
+static int ep0_queue(struct fsg_dev *fsg)
+{
+	int	rc;
+
+	rc = usb_ep_queue(fsg->ep0, fsg->ep0req, GFP_ATOMIC);
+	if (rc != 0 && rc != -ESHUTDOWN) {
+
+		/* We can't do much more than wait for a reset */
+		WARNING(fsg, "error in submission: %s --> %d\n",
+				fsg->ep0->name, rc);
+	}
+	return rc;
+}
+
+static void ep0_complete(struct usb_ep *ep, struct usb_request *req)
+{
+	struct fsg_dev		*fsg = ep->driver_data;
+
+	if (req->actual > 0)
+		dump_msg(fsg, fsg->ep0req_name, req->buf, req->actual);
+	if (req->status || req->actual != req->length)
+		DBG(fsg, "%s --> %d, %u/%u\n", __func__,
+				req->status, req->actual, req->length);
+	if (req->status == -ECONNRESET)		// Request was cancelled
+		usb_ep_fifo_flush(ep);
+
+	if (req->status == 0 && req->context)
+		((fsg_routine_t) (req->context))(fsg);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Bulk and interrupt endpoint completion handlers.
+ * These always run in_irq. */
+
+static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
+{
+	struct fsg_dev		*fsg = ep->driver_data;
+	struct fsg_buffhd	*bh = req->context;
+
+	if (req->status || req->actual != req->length)
+		DBG(fsg, "%s --> %d, %u/%u\n", __func__,
+				req->status, req->actual, req->length);
+	if (req->status == -ECONNRESET)		// Request was cancelled
+		usb_ep_fifo_flush(ep);
+
+	/* Hold the lock while we update the request and buffer states */
+	smp_wmb();
+	spin_lock(&fsg->lock);
+	bh->inreq_busy = 0;
+	bh->state = BUF_STATE_EMPTY;
+	wakeup_thread(fsg);
+	spin_unlock(&fsg->lock);
+}
+
+static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
+{
+	struct fsg_dev		*fsg = ep->driver_data;
+	struct fsg_buffhd	*bh = req->context;
+
+	dump_msg(fsg, "bulk-out", req->buf, req->actual);
+	if (req->status || req->actual != bh->bulk_out_intended_length)
+		DBG(fsg, "%s --> %d, %u/%u\n", __func__,
+				req->status, req->actual,
+				bh->bulk_out_intended_length);
+	if (req->status == -ECONNRESET)		// Request was cancelled
+		usb_ep_fifo_flush(ep);
+
+	/* Hold the lock while we update the request and buffer states */
+	smp_wmb();
+	spin_lock(&fsg->lock);
+	bh->outreq_busy = 0;
+	bh->state = BUF_STATE_FULL;
+	wakeup_thread(fsg);
+	spin_unlock(&fsg->lock);
+}
+
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
+{
+	struct fsg_dev		*fsg = ep->driver_data;
+	struct fsg_buffhd	*bh = req->context;
+
+	if (req->status || req->actual != req->length)
+		DBG(fsg, "%s --> %d, %u/%u\n", __func__,
+				req->status, req->actual, req->length);
+	if (req->status == -ECONNRESET)		// Request was cancelled
+		usb_ep_fifo_flush(ep);
+
+	/* Hold the lock while we update the request and buffer states */
+	smp_wmb();
+	spin_lock(&fsg->lock);
+	fsg->intreq_busy = 0;
+	bh->state = BUF_STATE_EMPTY;
+	wakeup_thread(fsg);
+	spin_unlock(&fsg->lock);
+}
+
+#else
+static void intr_in_complete(struct usb_ep *ep, struct usb_request *req)
+{}
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Ep0 class-specific handlers.  These always run in_irq. */
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	struct usb_request	*req = fsg->ep0req;
+	static u8		cbi_reset_cmnd[6] = {
+			SEND_DIAGNOSTIC, 4, 0xff, 0xff, 0xff, 0xff};
+
+	/* Error in command transfer? */
+	if (req->status || req->length != req->actual ||
+			req->actual < 6 || req->actual > MAX_COMMAND_SIZE) {
+
+		/* Not all controllers allow a protocol stall after
+		 * receiving control-out data, but we'll try anyway. */
+		fsg_set_halt(fsg, fsg->ep0);
+		return;			// Wait for reset
+	}
+
+	/* Is it the special reset command? */
+	if (req->actual >= sizeof cbi_reset_cmnd &&
+			memcmp(req->buf, cbi_reset_cmnd,
+				sizeof cbi_reset_cmnd) == 0) {
+
+		/* Raise an exception to stop the current operation
+		 * and reinitialize our state. */
+		DBG(fsg, "cbi reset request\n");
+		raise_exception(fsg, FSG_STATE_RESET);
+		return;
+	}
+
+	VDBG(fsg, "CB[I] accept device-specific command\n");
+	spin_lock(&fsg->lock);
+
+	/* Save the command for later */
+	if (fsg->cbbuf_cmnd_size)
+		WARNING(fsg, "CB[I] overwriting previous command\n");
+	fsg->cbbuf_cmnd_size = req->actual;
+	memcpy(fsg->cbbuf_cmnd, req->buf, fsg->cbbuf_cmnd_size);
+
+	wakeup_thread(fsg);
+	spin_unlock(&fsg->lock);
+}
+
+#else
+static void received_cbi_adsc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{}
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+
+static int class_setup_req(struct fsg_dev *fsg,
+		const struct usb_ctrlrequest *ctrl)
+{
+	struct usb_request	*req = fsg->ep0req;
+	int			value = -EOPNOTSUPP;
+	u16			w_index = le16_to_cpu(ctrl->wIndex);
+	u16                     w_value = le16_to_cpu(ctrl->wValue);
+	u16			w_length = le16_to_cpu(ctrl->wLength);
+
+	if (!fsg->config)
+		return value;
+
+	/* Handle Bulk-only class-specific requests */
+	if (transport_is_bbb()) {
+		switch (ctrl->bRequest) {
+
+		case US_BULK_RESET_REQUEST:
+			if (ctrl->bRequestType != (USB_DIR_OUT |
+					USB_TYPE_CLASS | USB_RECIP_INTERFACE))
+				break;
+			if (w_index != 0 || w_value != 0 || w_length != 0) {
+				value = -EDOM;
+				break;
+			}
+
+			/* Raise an exception to stop the current operation
+			 * and reinitialize our state. */
+			DBG(fsg, "bulk reset request\n");
+			raise_exception(fsg, FSG_STATE_RESET);
+			value = DELAYED_STATUS;
+			break;
+
+		case US_BULK_GET_MAX_LUN:
+			if (ctrl->bRequestType != (USB_DIR_IN |
+					USB_TYPE_CLASS | USB_RECIP_INTERFACE))
+				break;
+			if (w_index != 0 || w_value != 0 || w_length != 1) {
+				value = -EDOM;
+				break;
+			}
+			VDBG(fsg, "get max LUN\n");
+			*(u8 *) req->buf = fsg->nluns - 1;
+			value = 1;
+			break;
+		}
+	}
+
+	/* Handle CBI class-specific requests */
+	else {
+		switch (ctrl->bRequest) {
+
+		case USB_CBI_ADSC_REQUEST:
+			if (ctrl->bRequestType != (USB_DIR_OUT |
+					USB_TYPE_CLASS | USB_RECIP_INTERFACE))
+				break;
+			if (w_index != 0 || w_value != 0) {
+				value = -EDOM;
+				break;
+			}
+			if (w_length > MAX_COMMAND_SIZE) {
+				value = -EOVERFLOW;
+				break;
+			}
+			value = w_length;
+			fsg->ep0req->context = received_cbi_adsc;
+			break;
+		}
+	}
+
+	if (value == -EOPNOTSUPP)
+		VDBG(fsg,
+			"unknown class-specific control req "
+			"%02x.%02x v%04x i%04x l%u\n",
+			ctrl->bRequestType, ctrl->bRequest,
+			le16_to_cpu(ctrl->wValue), w_index, w_length);
+	return value;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Ep0 standard request handlers.  These always run in_irq. */
+
+static int standard_setup_req(struct fsg_dev *fsg,
+		const struct usb_ctrlrequest *ctrl)
+{
+	struct usb_request	*req = fsg->ep0req;
+	int			value = -EOPNOTSUPP;
+	u16			w_index = le16_to_cpu(ctrl->wIndex);
+	u16			w_value = le16_to_cpu(ctrl->wValue);
+
+	/* Usually this just stores reply data in the pre-allocated ep0 buffer,
+	 * but config change events will also reconfigure hardware. */
+	switch (ctrl->bRequest) {
+
+	case USB_REQ_GET_DESCRIPTOR:
+		if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
+				USB_RECIP_DEVICE))
+			break;
+		switch (w_value >> 8) {
+
+		case USB_DT_DEVICE:
+			VDBG(fsg, "get device descriptor\n");
+			device_desc.bMaxPacketSize0 = fsg->ep0->maxpacket;
+			value = sizeof device_desc;
+			memcpy(req->buf, &device_desc, value);
+			break;
+		case USB_DT_DEVICE_QUALIFIER:
+			VDBG(fsg, "get device qualifier\n");
+			if (!gadget_is_dualspeed(fsg->gadget) ||
+					fsg->gadget->speed == USB_SPEED_SUPER)
+				break;
+			/*
+			 * Assume ep0 uses the same maxpacket value for both
+			 * speeds
+			 */
+			dev_qualifier.bMaxPacketSize0 = fsg->ep0->maxpacket;
+			value = sizeof dev_qualifier;
+			memcpy(req->buf, &dev_qualifier, value);
+			break;
+
+		case USB_DT_OTHER_SPEED_CONFIG:
+			VDBG(fsg, "get other-speed config descriptor\n");
+			if (!gadget_is_dualspeed(fsg->gadget) ||
+					fsg->gadget->speed == USB_SPEED_SUPER)
+				break;
+			goto get_config;
+		case USB_DT_CONFIG:
+			VDBG(fsg, "get configuration descriptor\n");
+get_config:
+			value = populate_config_buf(fsg->gadget,
+					req->buf,
+					w_value >> 8,
+					w_value & 0xff);
+			break;
+
+		case USB_DT_STRING:
+			VDBG(fsg, "get string descriptor\n");
+
+			/* wIndex == language code */
+			value = usb_gadget_get_string(&fsg_stringtab,
+					w_value & 0xff, req->buf);
+			break;
+
+		case USB_DT_BOS:
+			VDBG(fsg, "get bos descriptor\n");
+
+			if (gadget_is_superspeed(fsg->gadget))
+				value = populate_bos(fsg, req->buf);
+			break;
+		}
+
+		break;
+
+	/* One config, two speeds */
+	case USB_REQ_SET_CONFIGURATION:
+		if (ctrl->bRequestType != (USB_DIR_OUT | USB_TYPE_STANDARD |
+				USB_RECIP_DEVICE))
+			break;
+		VDBG(fsg, "set configuration\n");
+		if (w_value == CONFIG_VALUE || w_value == 0) {
+			fsg->new_config = w_value;
+
+			/* Raise an exception to wipe out previous transaction
+			 * state (queued bufs, etc) and set the new config. */
+			raise_exception(fsg, FSG_STATE_CONFIG_CHANGE);
+			value = DELAYED_STATUS;
+		}
+		break;
+	case USB_REQ_GET_CONFIGURATION:
+		if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
+				USB_RECIP_DEVICE))
+			break;
+		VDBG(fsg, "get configuration\n");
+		*(u8 *) req->buf = fsg->config;
+		value = 1;
+		break;
+
+	case USB_REQ_SET_INTERFACE:
+		if (ctrl->bRequestType != (USB_DIR_OUT| USB_TYPE_STANDARD |
+				USB_RECIP_INTERFACE))
+			break;
+		if (fsg->config && w_index == 0) {
+
+			/* Raise an exception to wipe out previous transaction
+			 * state (queued bufs, etc) and install the new
+			 * interface altsetting. */
+			raise_exception(fsg, FSG_STATE_INTERFACE_CHANGE);
+			value = DELAYED_STATUS;
+		}
+		break;
+	case USB_REQ_GET_INTERFACE:
+		if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_STANDARD |
+				USB_RECIP_INTERFACE))
+			break;
+		if (!fsg->config)
+			break;
+		if (w_index != 0) {
+			value = -EDOM;
+			break;
+		}
+		VDBG(fsg, "get interface\n");
+		*(u8 *) req->buf = 0;
+		value = 1;
+		break;
+
+	default:
+		VDBG(fsg,
+			"unknown control req %02x.%02x v%04x i%04x l%u\n",
+			ctrl->bRequestType, ctrl->bRequest,
+			w_value, w_index, le16_to_cpu(ctrl->wLength));
+	}
+
+	return value;
+}
+
+
+static int fsg_setup(struct usb_gadget *gadget,
+		const struct usb_ctrlrequest *ctrl)
+{
+	struct fsg_dev		*fsg = get_gadget_data(gadget);
+	int			rc;
+	int			w_length = le16_to_cpu(ctrl->wLength);
+
+	++fsg->ep0_req_tag;		// Record arrival of a new request
+	fsg->ep0req->context = NULL;
+	fsg->ep0req->length = 0;
+	dump_msg(fsg, "ep0-setup", (u8 *) ctrl, sizeof(*ctrl));
+
+	if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS)
+		rc = class_setup_req(fsg, ctrl);
+	else
+		rc = standard_setup_req(fsg, ctrl);
+
+	/* Respond with data/status or defer until later? */
+	if (rc >= 0 && rc != DELAYED_STATUS) {
+		rc = min(rc, w_length);
+		fsg->ep0req->length = rc;
+		fsg->ep0req->zero = rc < w_length;
+		fsg->ep0req_name = (ctrl->bRequestType & USB_DIR_IN ?
+				"ep0-in" : "ep0-out");
+		rc = ep0_queue(fsg);
+	}
+
+	/* Device either stalls (rc < 0) or reports success */
+	return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* All the following routines run in process context */
+
+
+/* Use this for bulk or interrupt transfers, not ep0 */
+static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
+		struct usb_request *req, int *pbusy,
+		enum fsg_buffer_state *state)
+{
+	int	rc;
+
+	if (ep == fsg->bulk_in)
+		dump_msg(fsg, "bulk-in", req->buf, req->length);
+	else if (ep == fsg->intr_in)
+		dump_msg(fsg, "intr-in", req->buf, req->length);
+
+	spin_lock_irq(&fsg->lock);
+	*pbusy = 1;
+	*state = BUF_STATE_BUSY;
+	spin_unlock_irq(&fsg->lock);
+	rc = usb_ep_queue(ep, req, GFP_KERNEL);
+	if (rc != 0) {
+		*pbusy = 0;
+		*state = BUF_STATE_EMPTY;
+
+		/* We can't do much more than wait for a reset */
+
+		/* Note: currently the net2280 driver fails zero-length
+		 * submissions if DMA is enabled. */
+		if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
+						req->length == 0))
+			WARNING(fsg, "error in submission: %s --> %d\n",
+					ep->name, rc);
+	}
+}
+
+
+static int sleep_thread(struct fsg_dev *fsg)
+{
+	int	rc = 0;
+
+	/* Wait until a signal arrives or we are woken up */
+	for (;;) {
+		try_to_freeze();
+		set_current_state(TASK_INTERRUPTIBLE);
+		if (signal_pending(current)) {
+			rc = -EINTR;
+			break;
+		}
+		if (fsg->thread_wakeup_needed)
+			break;
+		schedule();
+	}
+	__set_current_state(TASK_RUNNING);
+	fsg->thread_wakeup_needed = 0;
+	return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_read(struct fsg_dev *fsg)
+{
+	struct fsg_lun		*curlun = fsg->curlun;
+	u32			lba;
+	struct fsg_buffhd	*bh;
+	int			rc;
+	u32			amount_left;
+	loff_t			file_offset, file_offset_tmp;
+	unsigned int		amount;
+	ssize_t			nread;
+
+	/* Get the starting Logical Block Address and check that it's
+	 * not too big */
+	if (fsg->cmnd[0] == READ_6)
+		lba = get_unaligned_be24(&fsg->cmnd[1]);
+	else {
+		lba = get_unaligned_be32(&fsg->cmnd[2]);
+
+		/* We allow DPO (Disable Page Out = don't save data in the
+		 * cache) and FUA (Force Unit Access = don't read from the
+		 * cache), but we don't implement them. */
+		if ((fsg->cmnd[1] & ~0x18) != 0) {
+			curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+			return -EINVAL;
+		}
+	}
+	if (lba >= curlun->num_sectors) {
+		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+		return -EINVAL;
+	}
+	file_offset = ((loff_t) lba) << curlun->blkbits;
+
+	/* Carry out the file reads */
+	amount_left = fsg->data_size_from_cmnd;
+	if (unlikely(amount_left == 0))
+		return -EIO;		// No default reply
+
+	for (;;) {
+
+		/* Figure out how much we need to read:
+		 * Try to read the remaining amount.
+		 * But don't read more than the buffer size.
+		 * And don't try to read past the end of the file.
+		 */
+		amount = min((unsigned int) amount_left, mod_data.buflen);
+		amount = min((loff_t) amount,
+				curlun->file_length - file_offset);
+
+		/* Wait for the next buffer to become available */
+		bh = fsg->next_buffhd_to_fill;
+		while (bh->state != BUF_STATE_EMPTY) {
+			rc = sleep_thread(fsg);
+			if (rc)
+				return rc;
+		}
+
+		/* If we were asked to read past the end of file,
+		 * end with an empty buffer. */
+		if (amount == 0) {
+			curlun->sense_data =
+					SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+			curlun->sense_data_info = file_offset >> curlun->blkbits;
+			curlun->info_valid = 1;
+			bh->inreq->length = 0;
+			bh->state = BUF_STATE_FULL;
+			break;
+		}
+
+		/* Perform the read */
+		file_offset_tmp = file_offset;
+		nread = vfs_read(curlun->filp,
+				(char __user *) bh->buf,
+				amount, &file_offset_tmp);
+		VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
+				(unsigned long long) file_offset,
+				(int) nread);
+		if (signal_pending(current))
+			return -EINTR;
+
+		if (nread < 0) {
+			LDBG(curlun, "error in file read: %d\n",
+					(int) nread);
+			nread = 0;
+		} else if (nread < amount) {
+			LDBG(curlun, "partial file read: %d/%u\n",
+					(int) nread, amount);
+			nread = round_down(nread, curlun->blksize);
+		}
+		file_offset  += nread;
+		amount_left  -= nread;
+		fsg->residue -= nread;
+
+		/* Except at the end of the transfer, nread will be
+		 * equal to the buffer size, which is divisible by the
+		 * bulk-in maxpacket size.
+		 */
+		bh->inreq->length = nread;
+		bh->state = BUF_STATE_FULL;
+
+		/* If an error occurred, report it and its position */
+		if (nread < amount) {
+			curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
+			curlun->sense_data_info = file_offset >> curlun->blkbits;
+			curlun->info_valid = 1;
+			break;
+		}
+
+		if (amount_left == 0)
+			break;		// No more left to read
+
+		/* Send this buffer and go read some more */
+		bh->inreq->zero = 0;
+		start_transfer(fsg, fsg->bulk_in, bh->inreq,
+				&bh->inreq_busy, &bh->state);
+		fsg->next_buffhd_to_fill = bh->next;
+	}
+
+	return -EIO;		// No default reply
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_write(struct fsg_dev *fsg)
+{
+	struct fsg_lun		*curlun = fsg->curlun;
+	u32			lba;
+	struct fsg_buffhd	*bh;
+	int			get_some_more;
+	u32			amount_left_to_req, amount_left_to_write;
+	loff_t			usb_offset, file_offset, file_offset_tmp;
+	unsigned int		amount;
+	ssize_t			nwritten;
+	int			rc;
+
+	if (curlun->ro) {
+		curlun->sense_data = SS_WRITE_PROTECTED;
+		return -EINVAL;
+	}
+	spin_lock(&curlun->filp->f_lock);
+	curlun->filp->f_flags &= ~O_SYNC;	// Default is not to wait
+	spin_unlock(&curlun->filp->f_lock);
+
+	/* Get the starting Logical Block Address and check that it's
+	 * not too big */
+	if (fsg->cmnd[0] == WRITE_6)
+		lba = get_unaligned_be24(&fsg->cmnd[1]);
+	else {
+		lba = get_unaligned_be32(&fsg->cmnd[2]);
+
+		/* We allow DPO (Disable Page Out = don't save data in the
+		 * cache) and FUA (Force Unit Access = write directly to the
+		 * medium).  We don't implement DPO; we implement FUA by
+		 * performing synchronous output. */
+		if ((fsg->cmnd[1] & ~0x18) != 0) {
+			curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+			return -EINVAL;
+		}
+		/* FUA */
+		if (!curlun->nofua && (fsg->cmnd[1] & 0x08)) {
+			spin_lock(&curlun->filp->f_lock);
+			curlun->filp->f_flags |= O_DSYNC;
+			spin_unlock(&curlun->filp->f_lock);
+		}
+	}
+	if (lba >= curlun->num_sectors) {
+		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+		return -EINVAL;
+	}
+
+	/* Carry out the file writes */
+	get_some_more = 1;
+	file_offset = usb_offset = ((loff_t) lba) << curlun->blkbits;
+	amount_left_to_req = amount_left_to_write = fsg->data_size_from_cmnd;
+
+	while (amount_left_to_write > 0) {
+
+		/* Queue a request for more data from the host */
+		bh = fsg->next_buffhd_to_fill;
+		if (bh->state == BUF_STATE_EMPTY && get_some_more) {
+
+			/* Figure out how much we want to get:
+			 * Try to get the remaining amount,
+			 * but not more than the buffer size.
+			 */
+			amount = min(amount_left_to_req, mod_data.buflen);
+
+			/* Beyond the end of the backing file? */
+			if (usb_offset >= curlun->file_length) {
+				get_some_more = 0;
+				curlun->sense_data =
+					SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+				curlun->sense_data_info = usb_offset >> curlun->blkbits;
+				curlun->info_valid = 1;
+				continue;
+			}
+
+			/* Get the next buffer */
+			usb_offset += amount;
+			fsg->usb_amount_left -= amount;
+			amount_left_to_req -= amount;
+			if (amount_left_to_req == 0)
+				get_some_more = 0;
+
+			/* Except at the end of the transfer, amount will be
+			 * equal to the buffer size, which is divisible by
+			 * the bulk-out maxpacket size.
+			 */
+			set_bulk_out_req_length(fsg, bh, amount);
+			start_transfer(fsg, fsg->bulk_out, bh->outreq,
+					&bh->outreq_busy, &bh->state);
+			fsg->next_buffhd_to_fill = bh->next;
+			continue;
+		}
+
+		/* Write the received data to the backing file */
+		bh = fsg->next_buffhd_to_drain;
+		if (bh->state == BUF_STATE_EMPTY && !get_some_more)
+			break;			// We stopped early
+		if (bh->state == BUF_STATE_FULL) {
+			smp_rmb();
+			fsg->next_buffhd_to_drain = bh->next;
+			bh->state = BUF_STATE_EMPTY;
+
+			/* Did something go wrong with the transfer? */
+			if (bh->outreq->status != 0) {
+				curlun->sense_data = SS_COMMUNICATION_FAILURE;
+				curlun->sense_data_info = file_offset >> curlun->blkbits;
+				curlun->info_valid = 1;
+				break;
+			}
+
+			amount = bh->outreq->actual;
+			if (curlun->file_length - file_offset < amount) {
+				LERROR(curlun,
+	"write %u @ %llu beyond end %llu\n",
+	amount, (unsigned long long) file_offset,
+	(unsigned long long) curlun->file_length);
+				amount = curlun->file_length - file_offset;
+			}
+
+			/* Don't accept excess data.  The spec doesn't say
+			 * what to do in this case.  We'll ignore the error.
+			 */
+			amount = min(amount, bh->bulk_out_intended_length);
+
+			/* Don't write a partial block */
+			amount = round_down(amount, curlun->blksize);
+			if (amount == 0)
+				goto empty_write;
+
+			/* Perform the write */
+			file_offset_tmp = file_offset;
+			nwritten = vfs_write(curlun->filp,
+					(char __user *) bh->buf,
+					amount, &file_offset_tmp);
+			VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
+					(unsigned long long) file_offset,
+					(int) nwritten);
+			if (signal_pending(current))
+				return -EINTR;		// Interrupted!
+
+			if (nwritten < 0) {
+				LDBG(curlun, "error in file write: %d\n",
+						(int) nwritten);
+				nwritten = 0;
+			} else if (nwritten < amount) {
+				LDBG(curlun, "partial file write: %d/%u\n",
+						(int) nwritten, amount);
+				nwritten = round_down(nwritten, curlun->blksize);
+			}
+			file_offset += nwritten;
+			amount_left_to_write -= nwritten;
+			fsg->residue -= nwritten;
+
+			/* If an error occurred, report it and its position */
+			if (nwritten < amount) {
+				curlun->sense_data = SS_WRITE_ERROR;
+				curlun->sense_data_info = file_offset >> curlun->blkbits;
+				curlun->info_valid = 1;
+				break;
+			}
+
+ empty_write:
+			/* Did the host decide to stop early? */
+			if (bh->outreq->actual < bh->bulk_out_intended_length) {
+				fsg->short_packet_received = 1;
+				break;
+			}
+			continue;
+		}
+
+		/* Wait for something to happen */
+		rc = sleep_thread(fsg);
+		if (rc)
+			return rc;
+	}
+
+	return -EIO;		// No default reply
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_synchronize_cache(struct fsg_dev *fsg)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+	int		rc;
+
+	/* We ignore the requested LBA and write out all file's
+	 * dirty data buffers. */
+	rc = fsg_lun_fsync_sub(curlun);
+	if (rc)
+		curlun->sense_data = SS_WRITE_ERROR;
+	return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static void invalidate_sub(struct fsg_lun *curlun)
+{
+	struct file	*filp = curlun->filp;
+	struct inode	*inode = filp->f_path.dentry->d_inode;
+	unsigned long	rc;
+
+	rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
+	VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc);
+}
+
+static int do_verify(struct fsg_dev *fsg)
+{
+	struct fsg_lun		*curlun = fsg->curlun;
+	u32			lba;
+	u32			verification_length;
+	struct fsg_buffhd	*bh = fsg->next_buffhd_to_fill;
+	loff_t			file_offset, file_offset_tmp;
+	u32			amount_left;
+	unsigned int		amount;
+	ssize_t			nread;
+
+	/* Get the starting Logical Block Address and check that it's
+	 * not too big */
+	lba = get_unaligned_be32(&fsg->cmnd[2]);
+	if (lba >= curlun->num_sectors) {
+		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+		return -EINVAL;
+	}
+
+	/* We allow DPO (Disable Page Out = don't save data in the
+	 * cache) but we don't implement it. */
+	if ((fsg->cmnd[1] & ~0x10) != 0) {
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+
+	verification_length = get_unaligned_be16(&fsg->cmnd[7]);
+	if (unlikely(verification_length == 0))
+		return -EIO;		// No default reply
+
+	/* Prepare to carry out the file verify */
+	amount_left = verification_length << curlun->blkbits;
+	file_offset = ((loff_t) lba) << curlun->blkbits;
+
+	/* Write out all the dirty buffers before invalidating them */
+	fsg_lun_fsync_sub(curlun);
+	if (signal_pending(current))
+		return -EINTR;
+
+	invalidate_sub(curlun);
+	if (signal_pending(current))
+		return -EINTR;
+
+	/* Just try to read the requested blocks */
+	while (amount_left > 0) {
+
+		/* Figure out how much we need to read:
+		 * Try to read the remaining amount, but not more than
+		 * the buffer size.
+		 * And don't try to read past the end of the file.
+		 */
+		amount = min((unsigned int) amount_left, mod_data.buflen);
+		amount = min((loff_t) amount,
+				curlun->file_length - file_offset);
+		if (amount == 0) {
+			curlun->sense_data =
+					SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+			curlun->sense_data_info = file_offset >> curlun->blkbits;
+			curlun->info_valid = 1;
+			break;
+		}
+
+		/* Perform the read */
+		file_offset_tmp = file_offset;
+		nread = vfs_read(curlun->filp,
+				(char __user *) bh->buf,
+				amount, &file_offset_tmp);
+		VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
+				(unsigned long long) file_offset,
+				(int) nread);
+		if (signal_pending(current))
+			return -EINTR;
+
+		if (nread < 0) {
+			LDBG(curlun, "error in file verify: %d\n",
+					(int) nread);
+			nread = 0;
+		} else if (nread < amount) {
+			LDBG(curlun, "partial file verify: %d/%u\n",
+					(int) nread, amount);
+			nread = round_down(nread, curlun->blksize);
+		}
+		if (nread == 0) {
+			curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
+			curlun->sense_data_info = file_offset >> curlun->blkbits;
+			curlun->info_valid = 1;
+			break;
+		}
+		file_offset += nread;
+		amount_left -= nread;
+	}
+	return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	u8	*buf = (u8 *) bh->buf;
+
+	static char vendor_id[] = "Linux   ";
+	static char product_disk_id[] = "File-Stor Gadget";
+	static char product_cdrom_id[] = "File-CD Gadget  ";
+
+	if (!fsg->curlun) {		// Unsupported LUNs are okay
+		fsg->bad_lun_okay = 1;
+		memset(buf, 0, 36);
+		buf[0] = 0x7f;		// Unsupported, no device-type
+		buf[4] = 31;		// Additional length
+		return 36;
+	}
+
+	memset(buf, 0, 8);
+	buf[0] = (mod_data.cdrom ? TYPE_ROM : TYPE_DISK);
+	if (mod_data.removable)
+		buf[1] = 0x80;
+	buf[2] = 2;		// ANSI SCSI level 2
+	buf[3] = 2;		// SCSI-2 INQUIRY data format
+	buf[4] = 31;		// Additional length
+				// No special options
+	sprintf(buf + 8, "%-8s%-16s%04x", vendor_id,
+			(mod_data.cdrom ? product_cdrom_id :
+				product_disk_id),
+			mod_data.release);
+	return 36;
+}
+
+
+static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+	u8		*buf = (u8 *) bh->buf;
+	u32		sd, sdinfo;
+	int		valid;
+
+	/*
+	 * From the SCSI-2 spec., section 7.9 (Unit attention condition):
+	 *
+	 * If a REQUEST SENSE command is received from an initiator
+	 * with a pending unit attention condition (before the target
+	 * generates the contingent allegiance condition), then the
+	 * target shall either:
+	 *   a) report any pending sense data and preserve the unit
+	 *	attention condition on the logical unit, or,
+	 *   b) report the unit attention condition, may discard any
+	 *	pending sense data, and clear the unit attention
+	 *	condition on the logical unit for that initiator.
+	 *
+	 * FSG normally uses option a); enable this code to use option b).
+	 */
+#if 0
+	if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
+		curlun->sense_data = curlun->unit_attention_data;
+		curlun->unit_attention_data = SS_NO_SENSE;
+	}
+#endif
+
+	if (!curlun) {		// Unsupported LUNs are okay
+		fsg->bad_lun_okay = 1;
+		sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
+		sdinfo = 0;
+		valid = 0;
+	} else {
+		sd = curlun->sense_data;
+		sdinfo = curlun->sense_data_info;
+		valid = curlun->info_valid << 7;
+		curlun->sense_data = SS_NO_SENSE;
+		curlun->sense_data_info = 0;
+		curlun->info_valid = 0;
+	}
+
+	memset(buf, 0, 18);
+	buf[0] = valid | 0x70;			// Valid, current error
+	buf[2] = SK(sd);
+	put_unaligned_be32(sdinfo, &buf[3]);	/* Sense information */
+	buf[7] = 18 - 8;			// Additional sense length
+	buf[12] = ASC(sd);
+	buf[13] = ASCQ(sd);
+	return 18;
+}
+
+
+static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+	u32		lba = get_unaligned_be32(&fsg->cmnd[2]);
+	int		pmi = fsg->cmnd[8];
+	u8		*buf = (u8 *) bh->buf;
+
+	/* Check the PMI and LBA fields */
+	if (pmi > 1 || (pmi == 0 && lba != 0)) {
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+
+	put_unaligned_be32(curlun->num_sectors - 1, &buf[0]);
+						/* Max logical block */
+	put_unaligned_be32(curlun->blksize, &buf[4]);	/* Block length */
+	return 8;
+}
+
+
+static int do_read_header(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+	int		msf = fsg->cmnd[1] & 0x02;
+	u32		lba = get_unaligned_be32(&fsg->cmnd[2]);
+	u8		*buf = (u8 *) bh->buf;
+
+	if ((fsg->cmnd[1] & ~0x02) != 0) {		/* Mask away MSF */
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+	if (lba >= curlun->num_sectors) {
+		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+		return -EINVAL;
+	}
+
+	memset(buf, 0, 8);
+	buf[0] = 0x01;		/* 2048 bytes of user data, rest is EC */
+	store_cdrom_address(&buf[4], msf, lba);
+	return 8;
+}
+
+
+static int do_read_toc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+	int		msf = fsg->cmnd[1] & 0x02;
+	int		start_track = fsg->cmnd[6];
+	u8		*buf = (u8 *) bh->buf;
+
+	if ((fsg->cmnd[1] & ~0x02) != 0 ||		/* Mask away MSF */
+			start_track > 1) {
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+
+	memset(buf, 0, 20);
+	buf[1] = (20-2);		/* TOC data length */
+	buf[2] = 1;			/* First track number */
+	buf[3] = 1;			/* Last track number */
+	buf[5] = 0x16;			/* Data track, copying allowed */
+	buf[6] = 0x01;			/* Only track is number 1 */
+	store_cdrom_address(&buf[8], msf, 0);
+
+	buf[13] = 0x16;			/* Lead-out track is data */
+	buf[14] = 0xAA;			/* Lead-out track number */
+	store_cdrom_address(&buf[16], msf, curlun->num_sectors);
+	return 20;
+}
+
+
+static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+	int		mscmnd = fsg->cmnd[0];
+	u8		*buf = (u8 *) bh->buf;
+	u8		*buf0 = buf;
+	int		pc, page_code;
+	int		changeable_values, all_pages;
+	int		valid_page = 0;
+	int		len, limit;
+
+	if ((fsg->cmnd[1] & ~0x08) != 0) {		// Mask away DBD
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+	pc = fsg->cmnd[2] >> 6;
+	page_code = fsg->cmnd[2] & 0x3f;
+	if (pc == 3) {
+		curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
+		return -EINVAL;
+	}
+	changeable_values = (pc == 1);
+	all_pages = (page_code == 0x3f);
+
+	/* Write the mode parameter header.  Fixed values are: default
+	 * medium type, no cache control (DPOFUA), and no block descriptors.
+	 * The only variable value is the WriteProtect bit.  We will fill in
+	 * the mode data length later. */
+	memset(buf, 0, 8);
+	if (mscmnd == MODE_SENSE) {
+		buf[2] = (curlun->ro ? 0x80 : 0x00);		// WP, DPOFUA
+		buf += 4;
+		limit = 255;
+	} else {			// MODE_SENSE_10
+		buf[3] = (curlun->ro ? 0x80 : 0x00);		// WP, DPOFUA
+		buf += 8;
+		limit = 65535;		// Should really be mod_data.buflen
+	}
+
+	/* No block descriptors */
+
+	/* The mode pages, in numerical order.  The only page we support
+	 * is the Caching page. */
+	if (page_code == 0x08 || all_pages) {
+		valid_page = 1;
+		buf[0] = 0x08;		// Page code
+		buf[1] = 10;		// Page length
+		memset(buf+2, 0, 10);	// None of the fields are changeable
+
+		if (!changeable_values) {
+			buf[2] = 0x04;	// Write cache enable,
+					// Read cache not disabled
+					// No cache retention priorities
+			put_unaligned_be16(0xffff, &buf[4]);
+					/* Don't disable prefetch */
+					/* Minimum prefetch = 0 */
+			put_unaligned_be16(0xffff, &buf[8]);
+					/* Maximum prefetch */
+			put_unaligned_be16(0xffff, &buf[10]);
+					/* Maximum prefetch ceiling */
+		}
+		buf += 12;
+	}
+
+	/* Check that a valid page was requested and the mode data length
+	 * isn't too long. */
+	len = buf - buf0;
+	if (!valid_page || len > limit) {
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+
+	/*  Store the mode data length */
+	if (mscmnd == MODE_SENSE)
+		buf0[0] = len - 1;
+	else
+		put_unaligned_be16(len - 2, buf0);
+	return len;
+}
+
+
+static int do_start_stop(struct fsg_dev *fsg)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+	int		loej, start;
+
+	if (!mod_data.removable) {
+		curlun->sense_data = SS_INVALID_COMMAND;
+		return -EINVAL;
+	}
+
+	// int immed = fsg->cmnd[1] & 0x01;
+	loej = fsg->cmnd[4] & 0x02;
+	start = fsg->cmnd[4] & 0x01;
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+	if ((fsg->cmnd[1] & ~0x01) != 0 ||		// Mask away Immed
+			(fsg->cmnd[4] & ~0x03) != 0) {	// Mask LoEj, Start
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+
+	if (!start) {
+
+		/* Are we allowed to unload the media? */
+		if (curlun->prevent_medium_removal) {
+			LDBG(curlun, "unload attempt prevented\n");
+			curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
+			return -EINVAL;
+		}
+		if (loej) {		// Simulate an unload/eject
+			up_read(&fsg->filesem);
+			down_write(&fsg->filesem);
+			fsg_lun_close(curlun);
+			up_write(&fsg->filesem);
+			down_read(&fsg->filesem);
+		}
+	} else {
+
+		/* Our emulation doesn't support mounting; the medium is
+		 * available for use as soon as it is loaded. */
+		if (!fsg_lun_is_open(curlun)) {
+			curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
+			return -EINVAL;
+		}
+	}
+#endif
+	return 0;
+}
+
+
+static int do_prevent_allow(struct fsg_dev *fsg)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+	int		prevent;
+
+	if (!mod_data.removable) {
+		curlun->sense_data = SS_INVALID_COMMAND;
+		return -EINVAL;
+	}
+
+	prevent = fsg->cmnd[4] & 0x01;
+	if ((fsg->cmnd[4] & ~0x01) != 0) {		// Mask away Prevent
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+
+	if (curlun->prevent_medium_removal && !prevent)
+		fsg_lun_fsync_sub(curlun);
+	curlun->prevent_medium_removal = prevent;
+	return 0;
+}
+
+
+static int do_read_format_capacities(struct fsg_dev *fsg,
+			struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+	u8		*buf = (u8 *) bh->buf;
+
+	buf[0] = buf[1] = buf[2] = 0;
+	buf[3] = 8;		// Only the Current/Maximum Capacity Descriptor
+	buf += 4;
+
+	put_unaligned_be32(curlun->num_sectors, &buf[0]);
+						/* Number of blocks */
+	put_unaligned_be32(curlun->blksize, &buf[4]);	/* Block length */
+	buf[4] = 0x02;				/* Current capacity */
+	return 12;
+}
+
+
+static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = fsg->curlun;
+
+	/* We don't support MODE SELECT */
+	curlun->sense_data = SS_INVALID_COMMAND;
+	return -EINVAL;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
+{
+	int	rc;
+
+	rc = fsg_set_halt(fsg, fsg->bulk_in);
+	if (rc == -EAGAIN)
+		VDBG(fsg, "delayed bulk-in endpoint halt\n");
+	while (rc != 0) {
+		if (rc != -EAGAIN) {
+			WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
+			rc = 0;
+			break;
+		}
+
+		/* Wait for a short time and then try again */
+		if (msleep_interruptible(100) != 0)
+			return -EINTR;
+		rc = usb_ep_set_halt(fsg->bulk_in);
+	}
+	return rc;
+}
+
+static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
+{
+	int	rc;
+
+	DBG(fsg, "bulk-in set wedge\n");
+	rc = usb_ep_set_wedge(fsg->bulk_in);
+	if (rc == -EAGAIN)
+		VDBG(fsg, "delayed bulk-in endpoint wedge\n");
+	while (rc != 0) {
+		if (rc != -EAGAIN) {
+			WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
+			rc = 0;
+			break;
+		}
+
+		/* Wait for a short time and then try again */
+		if (msleep_interruptible(100) != 0)
+			return -EINTR;
+		rc = usb_ep_set_wedge(fsg->bulk_in);
+	}
+	return rc;
+}
+
+static int throw_away_data(struct fsg_dev *fsg)
+{
+	struct fsg_buffhd	*bh;
+	u32			amount;
+	int			rc;
+
+	while ((bh = fsg->next_buffhd_to_drain)->state != BUF_STATE_EMPTY ||
+			fsg->usb_amount_left > 0) {
+
+		/* Throw away the data in a filled buffer */
+		if (bh->state == BUF_STATE_FULL) {
+			smp_rmb();
+			bh->state = BUF_STATE_EMPTY;
+			fsg->next_buffhd_to_drain = bh->next;
+
+			/* A short packet or an error ends everything */
+			if (bh->outreq->actual < bh->bulk_out_intended_length ||
+					bh->outreq->status != 0) {
+				raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
+				return -EINTR;
+			}
+			continue;
+		}
+
+		/* Try to submit another request if we need one */
+		bh = fsg->next_buffhd_to_fill;
+		if (bh->state == BUF_STATE_EMPTY && fsg->usb_amount_left > 0) {
+			amount = min(fsg->usb_amount_left,
+					(u32) mod_data.buflen);
+
+			/* Except at the end of the transfer, amount will be
+			 * equal to the buffer size, which is divisible by
+			 * the bulk-out maxpacket size.
+			 */
+			set_bulk_out_req_length(fsg, bh, amount);
+			start_transfer(fsg, fsg->bulk_out, bh->outreq,
+					&bh->outreq_busy, &bh->state);
+			fsg->next_buffhd_to_fill = bh->next;
+			fsg->usb_amount_left -= amount;
+			continue;
+		}
+
+		/* Otherwise wait for something to happen */
+		rc = sleep_thread(fsg);
+		if (rc)
+			return rc;
+	}
+	return 0;
+}
+
+
+static int finish_reply(struct fsg_dev *fsg)
+{
+	struct fsg_buffhd	*bh = fsg->next_buffhd_to_fill;
+	int			rc = 0;
+
+	switch (fsg->data_dir) {
+	case DATA_DIR_NONE:
+		break;			// Nothing to send
+
+	/* If we don't know whether the host wants to read or write,
+	 * this must be CB or CBI with an unknown command.  We mustn't
+	 * try to send or receive any data.  So stall both bulk pipes
+	 * if we can and wait for a reset. */
+	case DATA_DIR_UNKNOWN:
+		if (mod_data.can_stall) {
+			fsg_set_halt(fsg, fsg->bulk_out);
+			rc = halt_bulk_in_endpoint(fsg);
+		}
+		break;
+
+	/* All but the last buffer of data must have already been sent */
+	case DATA_DIR_TO_HOST:
+		if (fsg->data_size == 0)
+			;		// Nothing to send
+
+		/* If there's no residue, simply send the last buffer */
+		else if (fsg->residue == 0) {
+			bh->inreq->zero = 0;
+			start_transfer(fsg, fsg->bulk_in, bh->inreq,
+					&bh->inreq_busy, &bh->state);
+			fsg->next_buffhd_to_fill = bh->next;
+		}
+
+		/* There is a residue.  For CB and CBI, simply mark the end
+		 * of the data with a short packet.  However, if we are
+		 * allowed to stall, there was no data at all (residue ==
+		 * data_size), and the command failed (invalid LUN or
+		 * sense data is set), then halt the bulk-in endpoint
+		 * instead. */
+		else if (!transport_is_bbb()) {
+			if (mod_data.can_stall &&
+					fsg->residue == fsg->data_size &&
+	(!fsg->curlun || fsg->curlun->sense_data != SS_NO_SENSE)) {
+				bh->state = BUF_STATE_EMPTY;
+				rc = halt_bulk_in_endpoint(fsg);
+			} else {
+				bh->inreq->zero = 1;
+				start_transfer(fsg, fsg->bulk_in, bh->inreq,
+						&bh->inreq_busy, &bh->state);
+				fsg->next_buffhd_to_fill = bh->next;
+			}
+		}
+
+		/*
+		 * For Bulk-only, mark the end of the data with a short
+		 * packet.  If we are allowed to stall, halt the bulk-in
+		 * endpoint.  (Note: This violates the Bulk-Only Transport
+		 * specification, which requires us to pad the data if we
+		 * don't halt the endpoint.  Presumably nobody will mind.)
+		 */
+		else {
+			bh->inreq->zero = 1;
+			start_transfer(fsg, fsg->bulk_in, bh->inreq,
+					&bh->inreq_busy, &bh->state);
+			fsg->next_buffhd_to_fill = bh->next;
+			if (mod_data.can_stall)
+				rc = halt_bulk_in_endpoint(fsg);
+		}
+		break;
+
+	/* We have processed all we want from the data the host has sent.
+	 * There may still be outstanding bulk-out requests. */
+	case DATA_DIR_FROM_HOST:
+		if (fsg->residue == 0)
+			;		// Nothing to receive
+
+		/* Did the host stop sending unexpectedly early? */
+		else if (fsg->short_packet_received) {
+			raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
+			rc = -EINTR;
+		}
+
+		/* We haven't processed all the incoming data.  Even though
+		 * we may be allowed to stall, doing so would cause a race.
+		 * The controller may already have ACK'ed all the remaining
+		 * bulk-out packets, in which case the host wouldn't see a
+		 * STALL.  Not realizing the endpoint was halted, it wouldn't
+		 * clear the halt -- leading to problems later on. */
+#if 0
+		else if (mod_data.can_stall) {
+			fsg_set_halt(fsg, fsg->bulk_out);
+			raise_exception(fsg, FSG_STATE_ABORT_BULK_OUT);
+			rc = -EINTR;
+		}
+#endif
+
+		/* We can't stall.  Read in the excess data and throw it
+		 * all away. */
+		else
+			rc = throw_away_data(fsg);
+		break;
+	}
+	return rc;
+}
+
+
+static int send_status(struct fsg_dev *fsg)
+{
+	struct fsg_lun		*curlun = fsg->curlun;
+	struct fsg_buffhd	*bh;
+	int			rc;
+	u8			status = US_BULK_STAT_OK;
+	u32			sd, sdinfo = 0;
+
+	/* Wait for the next buffer to become available */
+	bh = fsg->next_buffhd_to_fill;
+	while (bh->state != BUF_STATE_EMPTY) {
+		rc = sleep_thread(fsg);
+		if (rc)
+			return rc;
+	}
+
+	if (curlun) {
+		sd = curlun->sense_data;
+		sdinfo = curlun->sense_data_info;
+	} else if (fsg->bad_lun_okay)
+		sd = SS_NO_SENSE;
+	else
+		sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
+
+	if (fsg->phase_error) {
+		DBG(fsg, "sending phase-error status\n");
+		status = US_BULK_STAT_PHASE;
+		sd = SS_INVALID_COMMAND;
+	} else if (sd != SS_NO_SENSE) {
+		DBG(fsg, "sending command-failure status\n");
+		status = US_BULK_STAT_FAIL;
+		VDBG(fsg, "  sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
+				"  info x%x\n",
+				SK(sd), ASC(sd), ASCQ(sd), sdinfo);
+	}
+
+	if (transport_is_bbb()) {
+		struct bulk_cs_wrap	*csw = bh->buf;
+
+		/* Store and send the Bulk-only CSW */
+		csw->Signature = cpu_to_le32(US_BULK_CS_SIGN);
+		csw->Tag = fsg->tag;
+		csw->Residue = cpu_to_le32(fsg->residue);
+		csw->Status = status;
+
+		bh->inreq->length = US_BULK_CS_WRAP_LEN;
+		bh->inreq->zero = 0;
+		start_transfer(fsg, fsg->bulk_in, bh->inreq,
+				&bh->inreq_busy, &bh->state);
+
+	} else if (mod_data.transport_type == USB_PR_CB) {
+
+		/* Control-Bulk transport has no status phase! */
+		return 0;
+
+	} else {			// USB_PR_CBI
+		struct interrupt_data	*buf = bh->buf;
+
+		/* Store and send the Interrupt data.  UFI sends the ASC
+		 * and ASCQ bytes.  Everything else sends a Type (which
+		 * is always 0) and the status Value. */
+		if (mod_data.protocol_type == USB_SC_UFI) {
+			buf->bType = ASC(sd);
+			buf->bValue = ASCQ(sd);
+		} else {
+			buf->bType = 0;
+			buf->bValue = status;
+		}
+		fsg->intreq->length = CBI_INTERRUPT_DATA_LEN;
+
+		fsg->intr_buffhd = bh;		// Point to the right buffhd
+		fsg->intreq->buf = bh->inreq->buf;
+		fsg->intreq->context = bh;
+		start_transfer(fsg, fsg->intr_in, fsg->intreq,
+				&fsg->intreq_busy, &bh->state);
+	}
+
+	fsg->next_buffhd_to_fill = bh->next;
+	return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Check whether the command is properly formed and whether its data size
+ * and direction agree with the values we already have. */
+static int check_command(struct fsg_dev *fsg, int cmnd_size,
+		enum data_direction data_dir, unsigned int mask,
+		int needs_medium, const char *name)
+{
+	int			i;
+	int			lun = fsg->cmnd[1] >> 5;
+	static const char	dirletter[4] = {'u', 'o', 'i', 'n'};
+	char			hdlen[20];
+	struct fsg_lun		*curlun;
+
+	/* Adjust the expected cmnd_size for protocol encapsulation padding.
+	 * Transparent SCSI doesn't pad. */
+	if (protocol_is_scsi())
+		;
+
+	/* There's some disagreement as to whether RBC pads commands or not.
+	 * We'll play it safe and accept either form. */
+	else if (mod_data.protocol_type == USB_SC_RBC) {
+		if (fsg->cmnd_size == 12)
+			cmnd_size = 12;
+
+	/* All the other protocols pad to 12 bytes */
+	} else
+		cmnd_size = 12;
+
+	hdlen[0] = 0;
+	if (fsg->data_dir != DATA_DIR_UNKNOWN)
+		sprintf(hdlen, ", H%c=%u", dirletter[(int) fsg->data_dir],
+				fsg->data_size);
+	VDBG(fsg, "SCSI command: %s;  Dc=%d, D%c=%u;  Hc=%d%s\n",
+			name, cmnd_size, dirletter[(int) data_dir],
+			fsg->data_size_from_cmnd, fsg->cmnd_size, hdlen);
+
+	/* We can't reply at all until we know the correct data direction
+	 * and size. */
+	if (fsg->data_size_from_cmnd == 0)
+		data_dir = DATA_DIR_NONE;
+	if (fsg->data_dir == DATA_DIR_UNKNOWN) {	// CB or CBI
+		fsg->data_dir = data_dir;
+		fsg->data_size = fsg->data_size_from_cmnd;
+
+	} else {					// Bulk-only
+		if (fsg->data_size < fsg->data_size_from_cmnd) {
+
+			/* Host data size < Device data size is a phase error.
+			 * Carry out the command, but only transfer as much
+			 * as we are allowed. */
+			fsg->data_size_from_cmnd = fsg->data_size;
+			fsg->phase_error = 1;
+		}
+	}
+	fsg->residue = fsg->usb_amount_left = fsg->data_size;
+
+	/* Conflicting data directions is a phase error */
+	if (fsg->data_dir != data_dir && fsg->data_size_from_cmnd > 0) {
+		fsg->phase_error = 1;
+		return -EINVAL;
+	}
+
+	/* Verify the length of the command itself */
+	if (cmnd_size != fsg->cmnd_size) {
+
+		/* Special case workaround: There are plenty of buggy SCSI
+		 * implementations. Many have issues with cbw->Length
+		 * field passing a wrong command size. For those cases we
+		 * always try to work around the problem by using the length
+		 * sent by the host side provided it is at least as large
+		 * as the correct command length.
+		 * Examples of such cases would be MS-Windows, which issues
+		 * REQUEST SENSE with cbw->Length == 12 where it should
+		 * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
+		 * REQUEST SENSE with cbw->Length == 10 where it should
+		 * be 6 as well.
+		 */
+		if (cmnd_size <= fsg->cmnd_size) {
+			DBG(fsg, "%s is buggy! Expected length %d "
+					"but we got %d\n", name,
+					cmnd_size, fsg->cmnd_size);
+			cmnd_size = fsg->cmnd_size;
+		} else {
+			fsg->phase_error = 1;
+			return -EINVAL;
+		}
+	}
+
+	/* Check that the LUN values are consistent */
+	if (transport_is_bbb()) {
+		if (fsg->lun != lun)
+			DBG(fsg, "using LUN %d from CBW, "
+					"not LUN %d from CDB\n",
+					fsg->lun, lun);
+	}
+
+	/* Check the LUN */
+	curlun = fsg->curlun;
+	if (curlun) {
+		if (fsg->cmnd[0] != REQUEST_SENSE) {
+			curlun->sense_data = SS_NO_SENSE;
+			curlun->sense_data_info = 0;
+			curlun->info_valid = 0;
+		}
+	} else {
+		fsg->bad_lun_okay = 0;
+
+		/* INQUIRY and REQUEST SENSE commands are explicitly allowed
+		 * to use unsupported LUNs; all others may not. */
+		if (fsg->cmnd[0] != INQUIRY &&
+				fsg->cmnd[0] != REQUEST_SENSE) {
+			DBG(fsg, "unsupported LUN %d\n", fsg->lun);
+			return -EINVAL;
+		}
+	}
+
+	/* If a unit attention condition exists, only INQUIRY and
+	 * REQUEST SENSE commands are allowed; anything else must fail. */
+	if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
+			fsg->cmnd[0] != INQUIRY &&
+			fsg->cmnd[0] != REQUEST_SENSE) {
+		curlun->sense_data = curlun->unit_attention_data;
+		curlun->unit_attention_data = SS_NO_SENSE;
+		return -EINVAL;
+	}
+
+	/* Check that only command bytes listed in the mask are non-zero */
+	fsg->cmnd[1] &= 0x1f;			// Mask away the LUN
+	for (i = 1; i < cmnd_size; ++i) {
+		if (fsg->cmnd[i] && !(mask & (1 << i))) {
+			if (curlun)
+				curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+			return -EINVAL;
+		}
+	}
+
+	/* If the medium isn't mounted and the command needs to access
+	 * it, return an error. */
+	if (curlun && !fsg_lun_is_open(curlun) && needs_medium) {
+		curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/* wrapper of check_command for data size in blocks handling */
+static int check_command_size_in_blocks(struct fsg_dev *fsg, int cmnd_size,
+		enum data_direction data_dir, unsigned int mask,
+		int needs_medium, const char *name)
+{
+	if (fsg->curlun)
+		fsg->data_size_from_cmnd <<= fsg->curlun->blkbits;
+	return check_command(fsg, cmnd_size, data_dir,
+			mask, needs_medium, name);
+}
+
+static int do_scsi_command(struct fsg_dev *fsg)
+{
+	struct fsg_buffhd	*bh;
+	int			rc;
+	int			reply = -EINVAL;
+	int			i;
+	static char		unknown[16];
+
+	dump_cdb(fsg);
+
+	/* Wait for the next buffer to become available for data or status */
+	bh = fsg->next_buffhd_to_drain = fsg->next_buffhd_to_fill;
+	while (bh->state != BUF_STATE_EMPTY) {
+		rc = sleep_thread(fsg);
+		if (rc)
+			return rc;
+	}
+	fsg->phase_error = 0;
+	fsg->short_packet_received = 0;
+
+	down_read(&fsg->filesem);	// We're using the backing file
+	switch (fsg->cmnd[0]) {
+
+	case INQUIRY:
+		fsg->data_size_from_cmnd = fsg->cmnd[4];
+		if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
+				(1<<4), 0,
+				"INQUIRY")) == 0)
+			reply = do_inquiry(fsg, bh);
+		break;
+
+	case MODE_SELECT:
+		fsg->data_size_from_cmnd = fsg->cmnd[4];
+		if ((reply = check_command(fsg, 6, DATA_DIR_FROM_HOST,
+				(1<<1) | (1<<4), 0,
+				"MODE SELECT(6)")) == 0)
+			reply = do_mode_select(fsg, bh);
+		break;
+
+	case MODE_SELECT_10:
+		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+		if ((reply = check_command(fsg, 10, DATA_DIR_FROM_HOST,
+				(1<<1) | (3<<7), 0,
+				"MODE SELECT(10)")) == 0)
+			reply = do_mode_select(fsg, bh);
+		break;
+
+	case MODE_SENSE:
+		fsg->data_size_from_cmnd = fsg->cmnd[4];
+		if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
+				(1<<1) | (1<<2) | (1<<4), 0,
+				"MODE SENSE(6)")) == 0)
+			reply = do_mode_sense(fsg, bh);
+		break;
+
+	case MODE_SENSE_10:
+		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+				(1<<1) | (1<<2) | (3<<7), 0,
+				"MODE SENSE(10)")) == 0)
+			reply = do_mode_sense(fsg, bh);
+		break;
+
+	case ALLOW_MEDIUM_REMOVAL:
+		fsg->data_size_from_cmnd = 0;
+		if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
+				(1<<4), 0,
+				"PREVENT-ALLOW MEDIUM REMOVAL")) == 0)
+			reply = do_prevent_allow(fsg);
+		break;
+
+	case READ_6:
+		i = fsg->cmnd[4];
+		fsg->data_size_from_cmnd = (i == 0) ? 256 : i;
+		if ((reply = check_command_size_in_blocks(fsg, 6,
+				DATA_DIR_TO_HOST,
+				(7<<1) | (1<<4), 1,
+				"READ(6)")) == 0)
+			reply = do_read(fsg);
+		break;
+
+	case READ_10:
+		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+		if ((reply = check_command_size_in_blocks(fsg, 10,
+				DATA_DIR_TO_HOST,
+				(1<<1) | (0xf<<2) | (3<<7), 1,
+				"READ(10)")) == 0)
+			reply = do_read(fsg);
+		break;
+
+	case READ_12:
+		fsg->data_size_from_cmnd = get_unaligned_be32(&fsg->cmnd[6]);
+		if ((reply = check_command_size_in_blocks(fsg, 12,
+				DATA_DIR_TO_HOST,
+				(1<<1) | (0xf<<2) | (0xf<<6), 1,
+				"READ(12)")) == 0)
+			reply = do_read(fsg);
+		break;
+
+	case READ_CAPACITY:
+		fsg->data_size_from_cmnd = 8;
+		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+				(0xf<<2) | (1<<8), 1,
+				"READ CAPACITY")) == 0)
+			reply = do_read_capacity(fsg, bh);
+		break;
+
+	case READ_HEADER:
+		if (!mod_data.cdrom)
+			goto unknown_cmnd;
+		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+				(3<<7) | (0x1f<<1), 1,
+				"READ HEADER")) == 0)
+			reply = do_read_header(fsg, bh);
+		break;
+
+	case READ_TOC:
+		if (!mod_data.cdrom)
+			goto unknown_cmnd;
+		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+				(7<<6) | (1<<1), 1,
+				"READ TOC")) == 0)
+			reply = do_read_toc(fsg, bh);
+		break;
+
+	case READ_FORMAT_CAPACITIES:
+		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+		if ((reply = check_command(fsg, 10, DATA_DIR_TO_HOST,
+				(3<<7), 1,
+				"READ FORMAT CAPACITIES")) == 0)
+			reply = do_read_format_capacities(fsg, bh);
+		break;
+
+	case REQUEST_SENSE:
+		fsg->data_size_from_cmnd = fsg->cmnd[4];
+		if ((reply = check_command(fsg, 6, DATA_DIR_TO_HOST,
+				(1<<4), 0,
+				"REQUEST SENSE")) == 0)
+			reply = do_request_sense(fsg, bh);
+		break;
+
+	case START_STOP:
+		fsg->data_size_from_cmnd = 0;
+		if ((reply = check_command(fsg, 6, DATA_DIR_NONE,
+				(1<<1) | (1<<4), 0,
+				"START-STOP UNIT")) == 0)
+			reply = do_start_stop(fsg);
+		break;
+
+	case SYNCHRONIZE_CACHE:
+		fsg->data_size_from_cmnd = 0;
+		if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
+				(0xf<<2) | (3<<7), 1,
+				"SYNCHRONIZE CACHE")) == 0)
+			reply = do_synchronize_cache(fsg);
+		break;
+
+	case TEST_UNIT_READY:
+		fsg->data_size_from_cmnd = 0;
+		reply = check_command(fsg, 6, DATA_DIR_NONE,
+				0, 1,
+				"TEST UNIT READY");
+		break;
+
+	/* Although optional, this command is used by MS-Windows.  We
+	 * support a minimal version: BytChk must be 0. */
+	case VERIFY:
+		fsg->data_size_from_cmnd = 0;
+		if ((reply = check_command(fsg, 10, DATA_DIR_NONE,
+				(1<<1) | (0xf<<2) | (3<<7), 1,
+				"VERIFY")) == 0)
+			reply = do_verify(fsg);
+		break;
+
+	case WRITE_6:
+		i = fsg->cmnd[4];
+		fsg->data_size_from_cmnd = (i == 0) ? 256 : i;
+		if ((reply = check_command_size_in_blocks(fsg, 6,
+				DATA_DIR_FROM_HOST,
+				(7<<1) | (1<<4), 1,
+				"WRITE(6)")) == 0)
+			reply = do_write(fsg);
+		break;
+
+	case WRITE_10:
+		fsg->data_size_from_cmnd = get_unaligned_be16(&fsg->cmnd[7]);
+		if ((reply = check_command_size_in_blocks(fsg, 10,
+				DATA_DIR_FROM_HOST,
+				(1<<1) | (0xf<<2) | (3<<7), 1,
+				"WRITE(10)")) == 0)
+			reply = do_write(fsg);
+		break;
+
+	case WRITE_12:
+		fsg->data_size_from_cmnd = get_unaligned_be32(&fsg->cmnd[6]);
+		if ((reply = check_command_size_in_blocks(fsg, 12,
+				DATA_DIR_FROM_HOST,
+				(1<<1) | (0xf<<2) | (0xf<<6), 1,
+				"WRITE(12)")) == 0)
+			reply = do_write(fsg);
+		break;
+
+	/* Some mandatory commands that we recognize but don't implement.
+	 * They don't mean much in this setting.  It's left as an exercise
+	 * for anyone interested to implement RESERVE and RELEASE in terms
+	 * of Posix locks. */
+	case FORMAT_UNIT:
+	case RELEASE:
+	case RESERVE:
+	case SEND_DIAGNOSTIC:
+		// Fall through
+
+	default:
+ unknown_cmnd:
+		fsg->data_size_from_cmnd = 0;
+		sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
+		if ((reply = check_command(fsg, fsg->cmnd_size,
+				DATA_DIR_UNKNOWN, ~0, 0, unknown)) == 0) {
+			fsg->curlun->sense_data = SS_INVALID_COMMAND;
+			reply = -EINVAL;
+		}
+		break;
+	}
+	up_read(&fsg->filesem);
+
+	if (reply == -EINTR || signal_pending(current))
+		return -EINTR;
+
+	/* Set up the single reply buffer for finish_reply() */
+	if (reply == -EINVAL)
+		reply = 0;		// Error reply length
+	if (reply >= 0 && fsg->data_dir == DATA_DIR_TO_HOST) {
+		reply = min((u32) reply, fsg->data_size_from_cmnd);
+		bh->inreq->length = reply;
+		bh->state = BUF_STATE_FULL;
+		fsg->residue -= reply;
+	}				// Otherwise it's already set
+
+	return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	struct usb_request		*req = bh->outreq;
+	struct bulk_cb_wrap	*cbw = req->buf;
+
+	/* Was this a real packet?  Should it be ignored? */
+	if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
+		return -EINVAL;
+
+	/* Is the CBW valid? */
+	if (req->actual != US_BULK_CB_WRAP_LEN ||
+			cbw->Signature != cpu_to_le32(
+				US_BULK_CB_SIGN)) {
+		DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
+				req->actual,
+				le32_to_cpu(cbw->Signature));
+
+		/* The Bulk-only spec says we MUST stall the IN endpoint
+		 * (6.6.1), so it's unavoidable.  It also says we must
+		 * retain this state until the next reset, but there's
+		 * no way to tell the controller driver it should ignore
+		 * Clear-Feature(HALT) requests.
+		 *
+		 * We aren't required to halt the OUT endpoint; instead
+		 * we can simply accept and discard any data received
+		 * until the next reset. */
+		wedge_bulk_in_endpoint(fsg);
+		set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
+		return -EINVAL;
+	}
+
+	/* Is the CBW meaningful? */
+	if (cbw->Lun >= FSG_MAX_LUNS || cbw->Flags & ~US_BULK_FLAG_IN ||
+			cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
+		DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
+				"cmdlen %u\n",
+				cbw->Lun, cbw->Flags, cbw->Length);
+
+		/* We can do anything we want here, so let's stall the
+		 * bulk pipes if we are allowed to. */
+		if (mod_data.can_stall) {
+			fsg_set_halt(fsg, fsg->bulk_out);
+			halt_bulk_in_endpoint(fsg);
+		}
+		return -EINVAL;
+	}
+
+	/* Save the command for later */
+	fsg->cmnd_size = cbw->Length;
+	memcpy(fsg->cmnd, cbw->CDB, fsg->cmnd_size);
+	if (cbw->Flags & US_BULK_FLAG_IN)
+		fsg->data_dir = DATA_DIR_TO_HOST;
+	else
+		fsg->data_dir = DATA_DIR_FROM_HOST;
+	fsg->data_size = le32_to_cpu(cbw->DataTransferLength);
+	if (fsg->data_size == 0)
+		fsg->data_dir = DATA_DIR_NONE;
+	fsg->lun = cbw->Lun;
+	fsg->tag = cbw->Tag;
+	return 0;
+}
+
+
+static int get_next_command(struct fsg_dev *fsg)
+{
+	struct fsg_buffhd	*bh;
+	int			rc = 0;
+
+	if (transport_is_bbb()) {
+
+		/* Wait for the next buffer to become available */
+		bh = fsg->next_buffhd_to_fill;
+		while (bh->state != BUF_STATE_EMPTY) {
+			rc = sleep_thread(fsg);
+			if (rc)
+				return rc;
+		}
+
+		/* Queue a request to read a Bulk-only CBW */
+		set_bulk_out_req_length(fsg, bh, US_BULK_CB_WRAP_LEN);
+		start_transfer(fsg, fsg->bulk_out, bh->outreq,
+				&bh->outreq_busy, &bh->state);
+
+		/* We will drain the buffer in software, which means we
+		 * can reuse it for the next filling.  No need to advance
+		 * next_buffhd_to_fill. */
+
+		/* Wait for the CBW to arrive */
+		while (bh->state != BUF_STATE_FULL) {
+			rc = sleep_thread(fsg);
+			if (rc)
+				return rc;
+		}
+		smp_rmb();
+		rc = received_cbw(fsg, bh);
+		bh->state = BUF_STATE_EMPTY;
+
+	} else {		// USB_PR_CB or USB_PR_CBI
+
+		/* Wait for the next command to arrive */
+		while (fsg->cbbuf_cmnd_size == 0) {
+			rc = sleep_thread(fsg);
+			if (rc)
+				return rc;
+		}
+
+		/* Is the previous status interrupt request still busy?
+		 * The host is allowed to skip reading the status,
+		 * so we must cancel it. */
+		if (fsg->intreq_busy)
+			usb_ep_dequeue(fsg->intr_in, fsg->intreq);
+
+		/* Copy the command and mark the buffer empty */
+		fsg->data_dir = DATA_DIR_UNKNOWN;
+		spin_lock_irq(&fsg->lock);
+		fsg->cmnd_size = fsg->cbbuf_cmnd_size;
+		memcpy(fsg->cmnd, fsg->cbbuf_cmnd, fsg->cmnd_size);
+		fsg->cbbuf_cmnd_size = 0;
+		spin_unlock_irq(&fsg->lock);
+
+		/* Use LUN from the command */
+		fsg->lun = fsg->cmnd[1] >> 5;
+	}
+
+	/* Update current lun */
+	if (fsg->lun >= 0 && fsg->lun < fsg->nluns)
+		fsg->curlun = &fsg->luns[fsg->lun];
+	else
+		fsg->curlun = NULL;
+
+	return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int enable_endpoint(struct fsg_dev *fsg, struct usb_ep *ep,
+		const struct usb_endpoint_descriptor *d)
+{
+	int	rc;
+
+	ep->driver_data = fsg;
+	ep->desc = d;
+	rc = usb_ep_enable(ep);
+	if (rc)
+		ERROR(fsg, "can't enable %s, result %d\n", ep->name, rc);
+	return rc;
+}
+
+static int alloc_request(struct fsg_dev *fsg, struct usb_ep *ep,
+		struct usb_request **preq)
+{
+	*preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
+	if (*preq)
+		return 0;
+	ERROR(fsg, "can't allocate request for %s\n", ep->name);
+	return -ENOMEM;
+}
+
+/*
+ * Reset interface setting and re-init endpoint state (toggle etc).
+ * Call with altsetting < 0 to disable the interface.  The only other
+ * available altsetting is 0, which enables the interface.
+ */
+static int do_set_interface(struct fsg_dev *fsg, int altsetting)
+{
+	int	rc = 0;
+	int	i;
+	const struct usb_endpoint_descriptor	*d;
+
+	if (fsg->running)
+		DBG(fsg, "reset interface\n");
+
+reset:
+	/* Deallocate the requests */
+	for (i = 0; i < fsg_num_buffers; ++i) {
+		struct fsg_buffhd *bh = &fsg->buffhds[i];
+
+		if (bh->inreq) {
+			usb_ep_free_request(fsg->bulk_in, bh->inreq);
+			bh->inreq = NULL;
+		}
+		if (bh->outreq) {
+			usb_ep_free_request(fsg->bulk_out, bh->outreq);
+			bh->outreq = NULL;
+		}
+	}
+	if (fsg->intreq) {
+		usb_ep_free_request(fsg->intr_in, fsg->intreq);
+		fsg->intreq = NULL;
+	}
+
+	/* Disable the endpoints */
+	if (fsg->bulk_in_enabled) {
+		usb_ep_disable(fsg->bulk_in);
+		fsg->bulk_in_enabled = 0;
+	}
+	if (fsg->bulk_out_enabled) {
+		usb_ep_disable(fsg->bulk_out);
+		fsg->bulk_out_enabled = 0;
+	}
+	if (fsg->intr_in_enabled) {
+		usb_ep_disable(fsg->intr_in);
+		fsg->intr_in_enabled = 0;
+	}
+
+	fsg->running = 0;
+	if (altsetting < 0 || rc != 0)
+		return rc;
+
+	DBG(fsg, "set interface %d\n", altsetting);
+
+	/* Enable the endpoints */
+	d = fsg_ep_desc(fsg->gadget,
+			&fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc,
+			&fsg_ss_bulk_in_desc);
+	if ((rc = enable_endpoint(fsg, fsg->bulk_in, d)) != 0)
+		goto reset;
+	fsg->bulk_in_enabled = 1;
+
+	d = fsg_ep_desc(fsg->gadget,
+			&fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc,
+			&fsg_ss_bulk_out_desc);
+	if ((rc = enable_endpoint(fsg, fsg->bulk_out, d)) != 0)
+		goto reset;
+	fsg->bulk_out_enabled = 1;
+	fsg->bulk_out_maxpacket = usb_endpoint_maxp(d);
+	clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
+
+	if (transport_is_cbi()) {
+		d = fsg_ep_desc(fsg->gadget,
+				&fsg_fs_intr_in_desc, &fsg_hs_intr_in_desc,
+				&fsg_ss_intr_in_desc);
+		if ((rc = enable_endpoint(fsg, fsg->intr_in, d)) != 0)
+			goto reset;
+		fsg->intr_in_enabled = 1;
+	}
+
+	/* Allocate the requests */
+	for (i = 0; i < fsg_num_buffers; ++i) {
+		struct fsg_buffhd	*bh = &fsg->buffhds[i];
+
+		if ((rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq)) != 0)
+			goto reset;
+		if ((rc = alloc_request(fsg, fsg->bulk_out, &bh->outreq)) != 0)
+			goto reset;
+		bh->inreq->buf = bh->outreq->buf = bh->buf;
+		bh->inreq->context = bh->outreq->context = bh;
+		bh->inreq->complete = bulk_in_complete;
+		bh->outreq->complete = bulk_out_complete;
+	}
+	if (transport_is_cbi()) {
+		if ((rc = alloc_request(fsg, fsg->intr_in, &fsg->intreq)) != 0)
+			goto reset;
+		fsg->intreq->complete = intr_in_complete;
+	}
+
+	fsg->running = 1;
+	for (i = 0; i < fsg->nluns; ++i)
+		fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
+	return rc;
+}
+
+
+/*
+ * Change our operational configuration.  This code must agree with the code
+ * that returns config descriptors, and with interface altsetting code.
+ *
+ * It's also responsible for power management interactions.  Some
+ * configurations might not work with our current power sources.
+ * For now we just assume the gadget is always self-powered.
+ */
+static int do_set_config(struct fsg_dev *fsg, u8 new_config)
+{
+	int	rc = 0;
+
+	/* Disable the single interface */
+	if (fsg->config != 0) {
+		DBG(fsg, "reset config\n");
+		fsg->config = 0;
+		rc = do_set_interface(fsg, -1);
+	}
+
+	/* Enable the interface */
+	if (new_config != 0) {
+		fsg->config = new_config;
+		if ((rc = do_set_interface(fsg, 0)) != 0)
+			fsg->config = 0;	// Reset on errors
+		else
+			INFO(fsg, "%s config #%d\n",
+			     usb_speed_string(fsg->gadget->speed),
+			     fsg->config);
+	}
+	return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static void handle_exception(struct fsg_dev *fsg)
+{
+	siginfo_t		info;
+	int			sig;
+	int			i;
+	int			num_active;
+	struct fsg_buffhd	*bh;
+	enum fsg_state		old_state;
+	u8			new_config;
+	struct fsg_lun		*curlun;
+	unsigned int		exception_req_tag;
+	int			rc;
+
+	/* Clear the existing signals.  Anything but SIGUSR1 is converted
+	 * into a high-priority EXIT exception. */
+	for (;;) {
+		sig = dequeue_signal_lock(current, &current->blocked, &info);
+		if (!sig)
+			break;
+		if (sig != SIGUSR1) {
+			if (fsg->state < FSG_STATE_EXIT)
+				DBG(fsg, "Main thread exiting on signal\n");
+			raise_exception(fsg, FSG_STATE_EXIT);
+		}
+	}
+
+	/* Cancel all the pending transfers */
+	if (fsg->intreq_busy)
+		usb_ep_dequeue(fsg->intr_in, fsg->intreq);
+	for (i = 0; i < fsg_num_buffers; ++i) {
+		bh = &fsg->buffhds[i];
+		if (bh->inreq_busy)
+			usb_ep_dequeue(fsg->bulk_in, bh->inreq);
+		if (bh->outreq_busy)
+			usb_ep_dequeue(fsg->bulk_out, bh->outreq);
+	}
+
+	/* Wait until everything is idle */
+	for (;;) {
+		num_active = fsg->intreq_busy;
+		for (i = 0; i < fsg_num_buffers; ++i) {
+			bh = &fsg->buffhds[i];
+			num_active += bh->inreq_busy + bh->outreq_busy;
+		}
+		if (num_active == 0)
+			break;
+		if (sleep_thread(fsg))
+			return;
+	}
+
+	/* Clear out the controller's fifos */
+	if (fsg->bulk_in_enabled)
+		usb_ep_fifo_flush(fsg->bulk_in);
+	if (fsg->bulk_out_enabled)
+		usb_ep_fifo_flush(fsg->bulk_out);
+	if (fsg->intr_in_enabled)
+		usb_ep_fifo_flush(fsg->intr_in);
+
+	/* Reset the I/O buffer states and pointers, the SCSI
+	 * state, and the exception.  Then invoke the handler. */
+	spin_lock_irq(&fsg->lock);
+
+	for (i = 0; i < fsg_num_buffers; ++i) {
+		bh = &fsg->buffhds[i];
+		bh->state = BUF_STATE_EMPTY;
+	}
+	fsg->next_buffhd_to_fill = fsg->next_buffhd_to_drain =
+			&fsg->buffhds[0];
+
+	exception_req_tag = fsg->exception_req_tag;
+	new_config = fsg->new_config;
+	old_state = fsg->state;
+
+	if (old_state == FSG_STATE_ABORT_BULK_OUT)
+		fsg->state = FSG_STATE_STATUS_PHASE;
+	else {
+		for (i = 0; i < fsg->nluns; ++i) {
+			curlun = &fsg->luns[i];
+			curlun->prevent_medium_removal = 0;
+			curlun->sense_data = curlun->unit_attention_data =
+					SS_NO_SENSE;
+			curlun->sense_data_info = 0;
+			curlun->info_valid = 0;
+		}
+		fsg->state = FSG_STATE_IDLE;
+	}
+	spin_unlock_irq(&fsg->lock);
+
+	/* Carry out any extra actions required for the exception */
+	switch (old_state) {
+	default:
+		break;
+
+	case FSG_STATE_ABORT_BULK_OUT:
+		send_status(fsg);
+		spin_lock_irq(&fsg->lock);
+		if (fsg->state == FSG_STATE_STATUS_PHASE)
+			fsg->state = FSG_STATE_IDLE;
+		spin_unlock_irq(&fsg->lock);
+		break;
+
+	case FSG_STATE_RESET:
+		/* In case we were forced against our will to halt a
+		 * bulk endpoint, clear the halt now.  (The SuperH UDC
+		 * requires this.) */
+		if (test_and_clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
+			usb_ep_clear_halt(fsg->bulk_in);
+
+		if (transport_is_bbb()) {
+			if (fsg->ep0_req_tag == exception_req_tag)
+				ep0_queue(fsg);	// Complete the status stage
+
+		} else if (transport_is_cbi())
+			send_status(fsg);	// Status by interrupt pipe
+
+		/* Technically this should go here, but it would only be
+		 * a waste of time.  Ditto for the INTERFACE_CHANGE and
+		 * CONFIG_CHANGE cases. */
+		// for (i = 0; i < fsg->nluns; ++i)
+		//	fsg->luns[i].unit_attention_data = SS_RESET_OCCURRED;
+		break;
+
+	case FSG_STATE_INTERFACE_CHANGE:
+		rc = do_set_interface(fsg, 0);
+		if (fsg->ep0_req_tag != exception_req_tag)
+			break;
+		if (rc != 0)			// STALL on errors
+			fsg_set_halt(fsg, fsg->ep0);
+		else				// Complete the status stage
+			ep0_queue(fsg);
+		break;
+
+	case FSG_STATE_CONFIG_CHANGE:
+		rc = do_set_config(fsg, new_config);
+		if (fsg->ep0_req_tag != exception_req_tag)
+			break;
+		if (rc != 0)			// STALL on errors
+			fsg_set_halt(fsg, fsg->ep0);
+		else				// Complete the status stage
+			ep0_queue(fsg);
+		break;
+
+	case FSG_STATE_DISCONNECT:
+		for (i = 0; i < fsg->nluns; ++i)
+			fsg_lun_fsync_sub(fsg->luns + i);
+		do_set_config(fsg, 0);		// Unconfigured state
+		break;
+
+	case FSG_STATE_EXIT:
+	case FSG_STATE_TERMINATED:
+		do_set_config(fsg, 0);			// Free resources
+		spin_lock_irq(&fsg->lock);
+		fsg->state = FSG_STATE_TERMINATED;	// Stop the thread
+		spin_unlock_irq(&fsg->lock);
+		break;
+	}
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int fsg_main_thread(void *fsg_)
+{
+	struct fsg_dev		*fsg = fsg_;
+
+	/* Allow the thread to be killed by a signal, but set the signal mask
+	 * to block everything but INT, TERM, KILL, and USR1. */
+	allow_signal(SIGINT);
+	allow_signal(SIGTERM);
+	allow_signal(SIGKILL);
+	allow_signal(SIGUSR1);
+
+	/* Allow the thread to be frozen */
+	set_freezable();
+
+	/* Arrange for userspace references to be interpreted as kernel
+	 * pointers.  That way we can pass a kernel pointer to a routine
+	 * that expects a __user pointer and it will work okay. */
+	set_fs(get_ds());
+
+	/* The main loop */
+	while (fsg->state != FSG_STATE_TERMINATED) {
+		if (exception_in_progress(fsg) || signal_pending(current)) {
+			handle_exception(fsg);
+			continue;
+		}
+
+		if (!fsg->running) {
+			sleep_thread(fsg);
+			continue;
+		}
+
+		if (get_next_command(fsg))
+			continue;
+
+		spin_lock_irq(&fsg->lock);
+		if (!exception_in_progress(fsg))
+			fsg->state = FSG_STATE_DATA_PHASE;
+		spin_unlock_irq(&fsg->lock);
+
+		if (do_scsi_command(fsg) || finish_reply(fsg))
+			continue;
+
+		spin_lock_irq(&fsg->lock);
+		if (!exception_in_progress(fsg))
+			fsg->state = FSG_STATE_STATUS_PHASE;
+		spin_unlock_irq(&fsg->lock);
+
+		if (send_status(fsg))
+			continue;
+
+		spin_lock_irq(&fsg->lock);
+		if (!exception_in_progress(fsg))
+			fsg->state = FSG_STATE_IDLE;
+		spin_unlock_irq(&fsg->lock);
+		}
+
+	spin_lock_irq(&fsg->lock);
+	fsg->thread_task = NULL;
+	spin_unlock_irq(&fsg->lock);
+
+	/* If we are exiting because of a signal, unregister the
+	 * gadget driver. */
+	if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
+		usb_gadget_unregister_driver(&fsg_driver);
+
+	/* Let the unbind and cleanup routines know the thread has exited */
+	complete_and_exit(&fsg->thread_notifier, 0);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+
+/* The write permissions and store_xxx pointers are set in fsg_bind() */
+static DEVICE_ATTR(ro, 0444, fsg_show_ro, NULL);
+static DEVICE_ATTR(nofua, 0644, fsg_show_nofua, NULL);
+static DEVICE_ATTR(file, 0444, fsg_show_file, NULL);
+
+
+/*-------------------------------------------------------------------------*/
+
+static void fsg_release(struct kref *ref)
+{
+	struct fsg_dev	*fsg = container_of(ref, struct fsg_dev, ref);
+
+	kfree(fsg->luns);
+	kfree(fsg);
+}
+
+static void lun_release(struct device *dev)
+{
+	struct rw_semaphore	*filesem = dev_get_drvdata(dev);
+	struct fsg_dev		*fsg =
+		container_of(filesem, struct fsg_dev, filesem);
+
+	kref_put(&fsg->ref, fsg_release);
+}
+
+static void /* __init_or_exit */ fsg_unbind(struct usb_gadget *gadget)
+{
+	struct fsg_dev		*fsg = get_gadget_data(gadget);
+	int			i;
+	struct fsg_lun		*curlun;
+	struct usb_request	*req = fsg->ep0req;
+
+	DBG(fsg, "unbind\n");
+	clear_bit(REGISTERED, &fsg->atomic_bitflags);
+
+	/* If the thread isn't already dead, tell it to exit now */
+	if (fsg->state != FSG_STATE_TERMINATED) {
+		raise_exception(fsg, FSG_STATE_EXIT);
+		wait_for_completion(&fsg->thread_notifier);
+
+		/* The cleanup routine waits for this completion also */
+		complete(&fsg->thread_notifier);
+	}
+
+	/* Unregister the sysfs attribute files and the LUNs */
+	for (i = 0; i < fsg->nluns; ++i) {
+		curlun = &fsg->luns[i];
+		if (curlun->registered) {
+			device_remove_file(&curlun->dev, &dev_attr_nofua);
+			device_remove_file(&curlun->dev, &dev_attr_ro);
+			device_remove_file(&curlun->dev, &dev_attr_file);
+			fsg_lun_close(curlun);
+			device_unregister(&curlun->dev);
+			curlun->registered = 0;
+		}
+	}
+
+	/* Free the data buffers */
+	for (i = 0; i < fsg_num_buffers; ++i)
+		kfree(fsg->buffhds[i].buf);
+
+	/* Free the request and buffer for endpoint 0 */
+	if (req) {
+		kfree(req->buf);
+		usb_ep_free_request(fsg->ep0, req);
+	}
+
+	set_gadget_data(gadget, NULL);
+}
+
+
+static int __init check_parameters(struct fsg_dev *fsg)
+{
+	int	prot;
+	int	gcnum;
+
+	/* Store the default values */
+	mod_data.transport_type = USB_PR_BULK;
+	mod_data.transport_name = "Bulk-only";
+	mod_data.protocol_type = USB_SC_SCSI;
+	mod_data.protocol_name = "Transparent SCSI";
+
+	/* Some peripheral controllers are known not to be able to
+	 * halt bulk endpoints correctly.  If one of them is present,
+	 * disable stalls.
+	 */
+	if (gadget_is_at91(fsg->gadget))
+		mod_data.can_stall = 0;
+
+	if (mod_data.release == 0xffff) {	// Parameter wasn't set
+		gcnum = usb_gadget_controller_number(fsg->gadget);
+		if (gcnum >= 0)
+			mod_data.release = 0x0300 + gcnum;
+		else {
+			WARNING(fsg, "controller '%s' not recognized\n",
+				fsg->gadget->name);
+			mod_data.release = 0x0399;
+		}
+	}
+
+	prot = simple_strtol(mod_data.protocol_parm, NULL, 0);
+
+#ifdef CONFIG_USB_FILE_STORAGE_TEST
+	if (strnicmp(mod_data.transport_parm, "BBB", 10) == 0) {
+		;		// Use default setting
+	} else if (strnicmp(mod_data.transport_parm, "CB", 10) == 0) {
+		mod_data.transport_type = USB_PR_CB;
+		mod_data.transport_name = "Control-Bulk";
+	} else if (strnicmp(mod_data.transport_parm, "CBI", 10) == 0) {
+		mod_data.transport_type = USB_PR_CBI;
+		mod_data.transport_name = "Control-Bulk-Interrupt";
+	} else {
+		ERROR(fsg, "invalid transport: %s\n", mod_data.transport_parm);
+		return -EINVAL;
+	}
+
+	if (strnicmp(mod_data.protocol_parm, "SCSI", 10) == 0 ||
+			prot == USB_SC_SCSI) {
+		;		// Use default setting
+	} else if (strnicmp(mod_data.protocol_parm, "RBC", 10) == 0 ||
+			prot == USB_SC_RBC) {
+		mod_data.protocol_type = USB_SC_RBC;
+		mod_data.protocol_name = "RBC";
+	} else if (strnicmp(mod_data.protocol_parm, "8020", 4) == 0 ||
+			strnicmp(mod_data.protocol_parm, "ATAPI", 10) == 0 ||
+			prot == USB_SC_8020) {
+		mod_data.protocol_type = USB_SC_8020;
+		mod_data.protocol_name = "8020i (ATAPI)";
+	} else if (strnicmp(mod_data.protocol_parm, "QIC", 3) == 0 ||
+			prot == USB_SC_QIC) {
+		mod_data.protocol_type = USB_SC_QIC;
+		mod_data.protocol_name = "QIC-157";
+	} else if (strnicmp(mod_data.protocol_parm, "UFI", 10) == 0 ||
+			prot == USB_SC_UFI) {
+		mod_data.protocol_type = USB_SC_UFI;
+		mod_data.protocol_name = "UFI";
+	} else if (strnicmp(mod_data.protocol_parm, "8070", 4) == 0 ||
+			prot == USB_SC_8070) {
+		mod_data.protocol_type = USB_SC_8070;
+		mod_data.protocol_name = "8070i";
+	} else {
+		ERROR(fsg, "invalid protocol: %s\n", mod_data.protocol_parm);
+		return -EINVAL;
+	}
+
+	mod_data.buflen &= PAGE_CACHE_MASK;
+	if (mod_data.buflen <= 0) {
+		ERROR(fsg, "invalid buflen\n");
+		return -ETOOSMALL;
+	}
+
+#endif /* CONFIG_USB_FILE_STORAGE_TEST */
+
+	/* Serial string handling.
+	 * On a real device, the serial string would be loaded
+	 * from permanent storage. */
+	if (mod_data.serial) {
+		const char *ch;
+		unsigned len = 0;
+
+		/* Sanity check :
+		 * The CB[I] specification limits the serial string to
+		 * 12 uppercase hexadecimal characters.
+		 * BBB need at least 12 uppercase hexadecimal characters,
+		 * with a maximum of 126. */
+		for (ch = mod_data.serial; *ch; ++ch) {
+			++len;
+			if ((*ch < '0' || *ch > '9') &&
+			    (*ch < 'A' || *ch > 'F')) { /* not uppercase hex */
+				WARNING(fsg,
+					"Invalid serial string character: %c\n",
+					*ch);
+				goto no_serial;
+			}
+		}
+		if (len > 126 ||
+		    (mod_data.transport_type == USB_PR_BULK && len < 12) ||
+		    (mod_data.transport_type != USB_PR_BULK && len > 12)) {
+			WARNING(fsg, "Invalid serial string length!\n");
+			goto no_serial;
+		}
+		fsg_strings[FSG_STRING_SERIAL - 1].s = mod_data.serial;
+	} else {
+		WARNING(fsg, "No serial-number string provided!\n");
+ no_serial:
+		device_desc.iSerialNumber = 0;
+	}
+
+	return 0;
+}
+
+
+static int __init fsg_bind(struct usb_gadget *gadget)
+{
+	struct fsg_dev		*fsg = the_fsg;
+	int			rc;
+	int			i;
+	struct fsg_lun		*curlun;
+	struct usb_ep		*ep;
+	struct usb_request	*req;
+	char			*pathbuf, *p;
+
+	fsg->gadget = gadget;
+	set_gadget_data(gadget, fsg);
+	fsg->ep0 = gadget->ep0;
+	fsg->ep0->driver_data = fsg;
+
+	if ((rc = check_parameters(fsg)) != 0)
+		goto out;
+
+	if (mod_data.removable) {	// Enable the store_xxx attributes
+		dev_attr_file.attr.mode = 0644;
+		dev_attr_file.store = fsg_store_file;
+		if (!mod_data.cdrom) {
+			dev_attr_ro.attr.mode = 0644;
+			dev_attr_ro.store = fsg_store_ro;
+		}
+	}
+
+	/* Only for removable media? */
+	dev_attr_nofua.attr.mode = 0644;
+	dev_attr_nofua.store = fsg_store_nofua;
+
+	/* Find out how many LUNs there should be */
+	i = mod_data.nluns;
+	if (i == 0)
+		i = max(mod_data.num_filenames, 1u);
+	if (i > FSG_MAX_LUNS) {
+		ERROR(fsg, "invalid number of LUNs: %d\n", i);
+		rc = -EINVAL;
+		goto out;
+	}
+
+	/* Create the LUNs, open their backing files, and register the
+	 * LUN devices in sysfs. */
+	fsg->luns = kzalloc(i * sizeof(struct fsg_lun), GFP_KERNEL);
+	if (!fsg->luns) {
+		rc = -ENOMEM;
+		goto out;
+	}
+	fsg->nluns = i;
+
+	for (i = 0; i < fsg->nluns; ++i) {
+		curlun = &fsg->luns[i];
+		curlun->cdrom = !!mod_data.cdrom;
+		curlun->ro = mod_data.cdrom || mod_data.ro[i];
+		curlun->initially_ro = curlun->ro;
+		curlun->removable = mod_data.removable;
+		curlun->nofua = mod_data.nofua[i];
+		curlun->dev.release = lun_release;
+		curlun->dev.parent = &gadget->dev;
+		curlun->dev.driver = &fsg_driver.driver;
+		dev_set_drvdata(&curlun->dev, &fsg->filesem);
+		dev_set_name(&curlun->dev,"%s-lun%d",
+			     dev_name(&gadget->dev), i);
+
+		kref_get(&fsg->ref);
+		rc = device_register(&curlun->dev);
+		if (rc) {
+			INFO(fsg, "failed to register LUN%d: %d\n", i, rc);
+			put_device(&curlun->dev);
+			goto out;
+		}
+		curlun->registered = 1;
+
+		rc = device_create_file(&curlun->dev, &dev_attr_ro);
+		if (rc)
+			goto out;
+		rc = device_create_file(&curlun->dev, &dev_attr_nofua);
+		if (rc)
+			goto out;
+		rc = device_create_file(&curlun->dev, &dev_attr_file);
+		if (rc)
+			goto out;
+
+		if (mod_data.file[i] && *mod_data.file[i]) {
+			rc = fsg_lun_open(curlun, mod_data.file[i]);
+			if (rc)
+				goto out;
+		} else if (!mod_data.removable) {
+			ERROR(fsg, "no file given for LUN%d\n", i);
+			rc = -EINVAL;
+			goto out;
+		}
+	}
+
+	/* Find all the endpoints we will use */
+	usb_ep_autoconfig_reset(gadget);
+	ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc);
+	if (!ep)
+		goto autoconf_fail;
+	ep->driver_data = fsg;		// claim the endpoint
+	fsg->bulk_in = ep;
+
+	ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc);
+	if (!ep)
+		goto autoconf_fail;
+	ep->driver_data = fsg;		// claim the endpoint
+	fsg->bulk_out = ep;
+
+	if (transport_is_cbi()) {
+		ep = usb_ep_autoconfig(gadget, &fsg_fs_intr_in_desc);
+		if (!ep)
+			goto autoconf_fail;
+		ep->driver_data = fsg;		// claim the endpoint
+		fsg->intr_in = ep;
+	}
+
+	/* Fix up the descriptors */
+	device_desc.idVendor = cpu_to_le16(mod_data.vendor);
+	device_desc.idProduct = cpu_to_le16(mod_data.product);
+	device_desc.bcdDevice = cpu_to_le16(mod_data.release);
+
+	i = (transport_is_cbi() ? 3 : 2);	// Number of endpoints
+	fsg_intf_desc.bNumEndpoints = i;
+	fsg_intf_desc.bInterfaceSubClass = mod_data.protocol_type;
+	fsg_intf_desc.bInterfaceProtocol = mod_data.transport_type;
+	fsg_fs_function[i + FSG_FS_FUNCTION_PRE_EP_ENTRIES] = NULL;
+
+	if (gadget_is_dualspeed(gadget)) {
+		fsg_hs_function[i + FSG_HS_FUNCTION_PRE_EP_ENTRIES] = NULL;
+
+		/* Assume endpoint addresses are the same for both speeds */
+		fsg_hs_bulk_in_desc.bEndpointAddress =
+			fsg_fs_bulk_in_desc.bEndpointAddress;
+		fsg_hs_bulk_out_desc.bEndpointAddress =
+			fsg_fs_bulk_out_desc.bEndpointAddress;
+		fsg_hs_intr_in_desc.bEndpointAddress =
+			fsg_fs_intr_in_desc.bEndpointAddress;
+	}
+
+	if (gadget_is_superspeed(gadget)) {
+		unsigned		max_burst;
+
+		fsg_ss_function[i + FSG_SS_FUNCTION_PRE_EP_ENTRIES] = NULL;
+
+		/* Calculate bMaxBurst, we know packet size is 1024 */
+		max_burst = min_t(unsigned, mod_data.buflen / 1024, 15);
+
+		/* Assume endpoint addresses are the same for both speeds */
+		fsg_ss_bulk_in_desc.bEndpointAddress =
+			fsg_fs_bulk_in_desc.bEndpointAddress;
+		fsg_ss_bulk_in_comp_desc.bMaxBurst = max_burst;
+
+		fsg_ss_bulk_out_desc.bEndpointAddress =
+			fsg_fs_bulk_out_desc.bEndpointAddress;
+		fsg_ss_bulk_out_comp_desc.bMaxBurst = max_burst;
+	}
+
+	if (gadget_is_otg(gadget))
+		fsg_otg_desc.bmAttributes |= USB_OTG_HNP;
+
+	rc = -ENOMEM;
+
+	/* Allocate the request and buffer for endpoint 0 */
+	fsg->ep0req = req = usb_ep_alloc_request(fsg->ep0, GFP_KERNEL);
+	if (!req)
+		goto out;
+	req->buf = kmalloc(EP0_BUFSIZE, GFP_KERNEL);
+	if (!req->buf)
+		goto out;
+	req->complete = ep0_complete;
+
+	/* Allocate the data buffers */
+	for (i = 0; i < fsg_num_buffers; ++i) {
+		struct fsg_buffhd	*bh = &fsg->buffhds[i];
+
+		/* Allocate for the bulk-in endpoint.  We assume that
+		 * the buffer will also work with the bulk-out (and
+		 * interrupt-in) endpoint. */
+		bh->buf = kmalloc(mod_data.buflen, GFP_KERNEL);
+		if (!bh->buf)
+			goto out;
+		bh->next = bh + 1;
+	}
+	fsg->buffhds[fsg_num_buffers - 1].next = &fsg->buffhds[0];
+
+	/* This should reflect the actual gadget power source */
+	usb_gadget_set_selfpowered(gadget);
+
+	snprintf(fsg_string_manufacturer, sizeof fsg_string_manufacturer,
+			"%s %s with %s",
+			init_utsname()->sysname, init_utsname()->release,
+			gadget->name);
+
+	fsg->thread_task = kthread_create(fsg_main_thread, fsg,
+			"file-storage-gadget");
+	if (IS_ERR(fsg->thread_task)) {
+		rc = PTR_ERR(fsg->thread_task);
+		goto out;
+	}
+
+	INFO(fsg, DRIVER_DESC ", version: " DRIVER_VERSION "\n");
+	INFO(fsg, "NOTE: This driver is deprecated.  "
+			"Consider using g_mass_storage instead.\n");
+	INFO(fsg, "Number of LUNs=%d\n", fsg->nluns);
+
+	pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
+	for (i = 0; i < fsg->nluns; ++i) {
+		curlun = &fsg->luns[i];
+		if (fsg_lun_is_open(curlun)) {
+			p = NULL;
+			if (pathbuf) {
+				p = d_path(&curlun->filp->f_path,
+					   pathbuf, PATH_MAX);
+				if (IS_ERR(p))
+					p = NULL;
+			}
+			LINFO(curlun, "ro=%d, nofua=%d, file: %s\n",
+			      curlun->ro, curlun->nofua, (p ? p : "(error)"));
+		}
+	}
+	kfree(pathbuf);
+
+	DBG(fsg, "transport=%s (x%02x)\n",
+			mod_data.transport_name, mod_data.transport_type);
+	DBG(fsg, "protocol=%s (x%02x)\n",
+			mod_data.protocol_name, mod_data.protocol_type);
+	DBG(fsg, "VendorID=x%04x, ProductID=x%04x, Release=x%04x\n",
+			mod_data.vendor, mod_data.product, mod_data.release);
+	DBG(fsg, "removable=%d, stall=%d, cdrom=%d, buflen=%u\n",
+			mod_data.removable, mod_data.can_stall,
+			mod_data.cdrom, mod_data.buflen);
+	DBG(fsg, "I/O thread pid: %d\n", task_pid_nr(fsg->thread_task));
+
+	set_bit(REGISTERED, &fsg->atomic_bitflags);
+
+	/* Tell the thread to start working */
+	wake_up_process(fsg->thread_task);
+	return 0;
+
+autoconf_fail:
+	ERROR(fsg, "unable to autoconfigure all endpoints\n");
+	rc = -ENOTSUPP;
+
+out:
+	fsg->state = FSG_STATE_TERMINATED;	// The thread is dead
+	fsg_unbind(gadget);
+	complete(&fsg->thread_notifier);
+	return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static void fsg_suspend(struct usb_gadget *gadget)
+{
+	struct fsg_dev		*fsg = get_gadget_data(gadget);
+
+	DBG(fsg, "suspend\n");
+	set_bit(SUSPENDED, &fsg->atomic_bitflags);
+}
+
+static void fsg_resume(struct usb_gadget *gadget)
+{
+	struct fsg_dev		*fsg = get_gadget_data(gadget);
+
+	DBG(fsg, "resume\n");
+	clear_bit(SUSPENDED, &fsg->atomic_bitflags);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static struct usb_gadget_driver		fsg_driver = {
+	.max_speed	= USB_SPEED_SUPER,
+	.function	= (char *) fsg_string_product,
+	.unbind		= fsg_unbind,
+	.disconnect	= fsg_disconnect,
+	.setup		= fsg_setup,
+	.suspend	= fsg_suspend,
+	.resume		= fsg_resume,
+
+	.driver		= {
+		.name		= DRIVER_NAME,
+		.owner		= THIS_MODULE,
+		// .release = ...
+		// .suspend = ...
+		// .resume = ...
+	},
+};
+
+
+static int __init fsg_alloc(void)
+{
+	struct fsg_dev		*fsg;
+
+	fsg = kzalloc(sizeof *fsg +
+		      fsg_num_buffers * sizeof *(fsg->buffhds), GFP_KERNEL);
+
+	if (!fsg)
+		return -ENOMEM;
+	spin_lock_init(&fsg->lock);
+	init_rwsem(&fsg->filesem);
+	kref_init(&fsg->ref);
+	init_completion(&fsg->thread_notifier);
+
+	the_fsg = fsg;
+	return 0;
+}
+
+
+static int __init fsg_init(void)
+{
+	int		rc;
+	struct fsg_dev	*fsg;
+
+	rc = fsg_num_buffers_validate();
+	if (rc != 0)
+		return rc;
+
+	if ((rc = fsg_alloc()) != 0)
+		return rc;
+	fsg = the_fsg;
+	if ((rc = usb_gadget_probe_driver(&fsg_driver, fsg_bind)) != 0)
+		kref_put(&fsg->ref, fsg_release);
+	return rc;
+}
+module_init(fsg_init);
+
+
+static void __exit fsg_cleanup(void)
+{
+	struct fsg_dev	*fsg = the_fsg;
+
+	/* Unregister the driver iff the thread hasn't already done so */
+	if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
+		usb_gadget_unregister_driver(&fsg_driver);
+
+	/* Wait for the thread to finish up */
+	wait_for_completion(&fsg->thread_notifier);
+
+	kref_put(&fsg->ref, fsg_release);
+}
+module_exit(fsg_cleanup);
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index 92b19721b595..9205b080370f 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -763,6 +763,16 @@ config USB_HWA_HCD
 	  To compile this driver a module, choose M here: the module
 	  will be called "hwa-hc".
 
+config USB_DWCOTG
+	bool "Synopsis DWC host support"
+	depends on USB && (FIQ || ARM64)
+	help
+	  The Synopsis DWC controller is a dual-role
+	  host/peripheral/OTG ("On The Go") USB controllers.
+
+	  Enable this option to support this IP in host controller mode.
+	  If unsure, say N.
+
 config USB_IMX21_HCD
        tristate "i.MX21 HCD support"
        depends on ARM && ARCH_MXC
diff --git a/drivers/usb/host/Makefile b/drivers/usb/host/Makefile
index 4ab2689c8952..1711c9525478 100644
--- a/drivers/usb/host/Makefile
+++ b/drivers/usb/host/Makefile
@@ -73,6 +73,8 @@ obj-$(CONFIG_USB_SL811_CS)	+= sl811_cs.o
 obj-$(CONFIG_USB_U132_HCD)	+= u132-hcd.o
 obj-$(CONFIG_USB_R8A66597_HCD)	+= r8a66597-hcd.o
 obj-$(CONFIG_USB_HWA_HCD)	+= hwa-hc.o
+
+obj-$(CONFIG_USB_DWCOTG)        += dwc_otg/ dwc_common_port/
 obj-$(CONFIG_USB_IMX21_HCD)	+= imx21-hcd.o
 obj-$(CONFIG_USB_FSL_USB2)	+= fsl-mph-dr-of.o
 obj-$(CONFIG_USB_EHCI_FSL)	+= fsl-mph-dr-of.o
diff --git a/drivers/usb/host/dwc_common_port/Makefile b/drivers/usb/host/dwc_common_port/Makefile
new file mode 100644
index 000000000000..f10d466d1aea
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/Makefile
@@ -0,0 +1,58 @@
+#
+# Makefile for DWC_common library
+#
+
+ifneq ($(KERNELRELEASE),)
+
+ccflags-y	+= -DDWC_LINUX
+#ccflags-y	+= -DDEBUG
+#ccflags-y	+= -DDWC_DEBUG_REGS
+#ccflags-y	+= -DDWC_DEBUG_MEMORY
+
+ccflags-y	+= -DDWC_LIBMODULE
+ccflags-y	+= -DDWC_CCLIB
+#ccflags-y	+= -DDWC_CRYPTOLIB
+ccflags-y	+= -DDWC_NOTIFYLIB
+ccflags-y	+= -DDWC_UTFLIB
+
+obj-$(CONFIG_USB_DWCOTG)	+= dwc_common_port_lib.o
+dwc_common_port_lib-objs := dwc_cc.o dwc_modpow.o dwc_dh.o \
+			    dwc_crypto.o dwc_notifier.o \
+			    dwc_common_linux.o dwc_mem.o
+
+kernrelwd := $(subst ., ,$(KERNELRELEASE))
+kernrel3 := $(word 1,$(kernrelwd)).$(word 2,$(kernrelwd)).$(word 3,$(kernrelwd))
+
+ifneq ($(kernrel3),2.6.20)
+# grayg - I only know that we use ccflags-y in 2.6.31 actually
+ccflags-y += $(CPPFLAGS)
+endif
+
+else
+
+#ifeq ($(KDIR),)
+#$(error Must give "KDIR=/path/to/kernel/source" on command line or in environment)
+#endif
+
+ifeq ($(ARCH),)
+$(error Must give "ARCH=<arch>" on command line or in environment. Also, if \
+ cross-compiling, must give "CROSS_COMPILE=/path/to/compiler/plus/tool-prefix-")
+endif
+
+ifeq ($(DOXYGEN),)
+DOXYGEN		:= doxygen
+endif
+
+default:
+	$(MAKE) -C$(KDIR) M=$(PWD) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules
+
+docs:	$(wildcard *.[hc]) doc/doxygen.cfg
+	$(DOXYGEN) doc/doxygen.cfg
+
+tags:	$(wildcard *.[hc])
+	$(CTAGS) -e $(wildcard *.[hc]) $(wildcard linux/*.[hc]) $(wildcard $(KDIR)/include/linux/usb*.h)
+
+endif
+
+clean:
+	rm -rf *.o *.ko .*.cmd *.mod.c .*.o.d .*.o.tmp modules.order Module.markers Module.symvers .tmp_versions/
diff --git a/drivers/usb/host/dwc_common_port/Makefile.fbsd b/drivers/usb/host/dwc_common_port/Makefile.fbsd
new file mode 100644
index 000000000000..45db9915b9d3
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/Makefile.fbsd
@@ -0,0 +1,17 @@
+CFLAGS	+= -I/sys/i386/compile/GENERIC -I/sys/i386/include -I/usr/include
+CFLAGS	+= -DDWC_FREEBSD
+CFLAGS	+= -DDEBUG
+#CFLAGS	+= -DDWC_DEBUG_REGS
+#CFLAGS	+= -DDWC_DEBUG_MEMORY
+
+#CFLAGS	+= -DDWC_LIBMODULE
+#CFLAGS	+= -DDWC_CCLIB
+#CFLAGS	+= -DDWC_CRYPTOLIB
+#CFLAGS	+= -DDWC_NOTIFYLIB
+#CFLAGS	+= -DDWC_UTFLIB
+
+KMOD = dwc_common_port_lib
+SRCS = dwc_cc.c dwc_modpow.c dwc_dh.c dwc_crypto.c dwc_notifier.c \
+       dwc_common_fbsd.c dwc_mem.c
+
+.include <bsd.kmod.mk>
diff --git a/drivers/usb/host/dwc_common_port/Makefile.linux b/drivers/usb/host/dwc_common_port/Makefile.linux
new file mode 100644
index 000000000000..0cef7b461bd5
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/Makefile.linux
@@ -0,0 +1,49 @@
+#
+# Makefile for DWC_common library
+#
+ifneq ($(KERNELRELEASE),)
+
+ccflags-y	+= -DDWC_LINUX
+#ccflags-y	+= -DDEBUG
+#ccflags-y	+= -DDWC_DEBUG_REGS
+#ccflags-y	+= -DDWC_DEBUG_MEMORY
+
+ccflags-y	+= -DDWC_LIBMODULE
+ccflags-y	+= -DDWC_CCLIB
+ccflags-y	+= -DDWC_CRYPTOLIB
+ccflags-y	+= -DDWC_NOTIFYLIB
+ccflags-y	+= -DDWC_UTFLIB
+
+obj-m			 := dwc_common_port_lib.o
+dwc_common_port_lib-objs := dwc_cc.o dwc_modpow.o dwc_dh.o \
+			    dwc_crypto.o dwc_notifier.o \
+			    dwc_common_linux.o dwc_mem.o
+
+else
+
+ifeq ($(KDIR),)
+$(error Must give "KDIR=/path/to/kernel/source" on command line or in environment)
+endif
+
+ifeq ($(ARCH),)
+$(error Must give "ARCH=<arch>" on command line or in environment. Also, if \
+ cross-compiling, must give "CROSS_COMPILE=/path/to/compiler/plus/tool-prefix-")
+endif
+
+ifeq ($(DOXYGEN),)
+DOXYGEN		:= doxygen
+endif
+
+default:
+	$(MAKE) -C$(KDIR) M=$(PWD) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules
+
+docs:	$(wildcard *.[hc]) doc/doxygen.cfg
+	$(DOXYGEN) doc/doxygen.cfg
+
+tags:	$(wildcard *.[hc])
+	$(CTAGS) -e $(wildcard *.[hc]) $(wildcard linux/*.[hc]) $(wildcard $(KDIR)/include/linux/usb*.h)
+
+endif
+
+clean:
+	rm -rf *.o *.ko .*.cmd *.mod.c .*.o.d .*.o.tmp modules.order Module.markers Module.symvers .tmp_versions/
diff --git a/drivers/usb/host/dwc_common_port/changes.txt b/drivers/usb/host/dwc_common_port/changes.txt
new file mode 100644
index 000000000000..f6839f92c276
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/changes.txt
@@ -0,0 +1,174 @@
+
+dwc_read_reg32() and friends now take an additional parameter, a pointer to an
+IO context struct. The IO context struct should live in an os-dependent struct
+in your driver. As an example, the dwc_usb3 driver has an os-dependent struct
+named 'os_dep' embedded in the main device struct. So there these calls look
+like this:
+
+	dwc_read_reg32(&usb3_dev->os_dep.ioctx, &pcd->dev_global_regs->dcfg);
+
+	dwc_write_reg32(&usb3_dev->os_dep.ioctx,
+			&pcd->dev_global_regs->dcfg, 0);
+
+Note that for the existing Linux driver ports, it is not necessary to actually
+define the 'ioctx' member in the os-dependent struct. Since Linux does not
+require an IO context, its macros for dwc_read_reg32() and friends do not
+use the context pointer, so it is optimized away by the compiler. But it is
+necessary to add the pointer parameter to all of the call sites, to be ready
+for any future ports (such as FreeBSD) which do require an IO context.
+
+
+Similarly, dwc_alloc(), dwc_alloc_atomic(), dwc_strdup(), and dwc_free() now
+take an additional parameter, a pointer to a memory context. Examples:
+
+	addr = dwc_alloc(&usb3_dev->os_dep.memctx, size);
+
+	dwc_free(&usb3_dev->os_dep.memctx, addr);
+
+Again, for the Linux ports, it is not necessary to actually define the memctx
+member, but it is necessary to add the pointer parameter to all of the call
+sites.
+
+
+Same for dwc_dma_alloc() and dwc_dma_free(). Examples:
+
+	virt_addr = dwc_dma_alloc(&usb3_dev->os_dep.dmactx, size, &phys_addr);
+
+	dwc_dma_free(&usb3_dev->os_dep.dmactx, size, virt_addr, phys_addr);
+
+
+Same for dwc_mutex_alloc() and dwc_mutex_free(). Examples:
+
+	mutex = dwc_mutex_alloc(&usb3_dev->os_dep.mtxctx);
+
+	dwc_mutex_free(&usb3_dev->os_dep.mtxctx, mutex);
+
+
+Same for dwc_spinlock_alloc() and dwc_spinlock_free(). Examples:
+
+	lock = dwc_spinlock_alloc(&usb3_dev->osdep.splctx);
+
+	dwc_spinlock_free(&usb3_dev->osdep.splctx, lock);
+
+
+Same for dwc_timer_alloc(). Example:
+
+	timer = dwc_timer_alloc(&usb3_dev->os_dep.tmrctx, "dwc_usb3_tmr1",
+				cb_func, cb_data);
+
+
+Same for dwc_waitq_alloc(). Example:
+
+	waitq = dwc_waitq_alloc(&usb3_dev->os_dep.wtqctx);
+
+
+Same for dwc_thread_run(). Example:
+
+	thread = dwc_thread_run(&usb3_dev->os_dep.thdctx, func,
+				"dwc_usb3_thd1", data);
+
+
+Same for dwc_workq_alloc(). Example:
+
+	workq = dwc_workq_alloc(&usb3_dev->osdep.wkqctx, "dwc_usb3_wkq1");
+
+
+Same for dwc_task_alloc(). Example:
+
+	task = dwc_task_alloc(&usb3_dev->os_dep.tskctx, "dwc_usb3_tsk1",
+			      cb_func, cb_data);
+
+
+In addition to the context pointer additions, a few core functions have had
+other changes made to their parameters:
+
+The 'flags' parameter to dwc_spinlock_irqsave() and dwc_spinunlock_irqrestore()
+has been changed from a uint64_t to a dwc_irqflags_t.
+
+dwc_thread_should_stop() now takes a 'dwc_thread_t *' parameter, because the
+FreeBSD equivalent of that function requires it.
+
+And, in addition to the context pointer, dwc_task_alloc() also adds a
+'char *name' parameter, to be consistent with dwc_thread_run() and
+dwc_workq_alloc(), and because the FreeBSD equivalent of that function
+requires a unique name.
+
+
+Here is a complete list of the core functions that now take a pointer to a
+context as their first parameter:
+
+	dwc_read_reg32
+	dwc_read_reg64
+	dwc_write_reg32
+	dwc_write_reg64
+	dwc_modify_reg32
+	dwc_modify_reg64
+	dwc_alloc
+	dwc_alloc_atomic
+	dwc_strdup
+	dwc_free
+	dwc_dma_alloc
+	dwc_dma_free
+	dwc_mutex_alloc
+	dwc_mutex_free
+	dwc_spinlock_alloc
+	dwc_spinlock_free
+	dwc_timer_alloc
+	dwc_waitq_alloc
+	dwc_thread_run
+	dwc_workq_alloc
+	dwc_task_alloc     Also adds a 'char *name' as its 2nd parameter
+
+And here are the core functions that have other changes to their parameters:
+
+	dwc_spinlock_irqsave      'flags' param is now a 'dwc_irqflags_t *'
+	dwc_spinunlock_irqrestore 'flags' param is now a 'dwc_irqflags_t'
+	dwc_thread_should_stop    Adds a 'dwc_thread_t *' parameter
+
+
+
+The changes to the core functions also require some of the other library
+functions to change:
+
+	dwc_cc_if_alloc() and dwc_cc_if_free() now take a 'void *memctx'
+	(for memory allocation) as the 1st param and a 'void *mtxctx'
+	(for mutex allocation) as the 2nd param.
+
+	dwc_cc_clear(), dwc_cc_add(), dwc_cc_change(), dwc_cc_remove(),
+	dwc_cc_data_for_save(), and dwc_cc_restore_from_data() now take a
+	'void *memctx' as the 1st param.
+
+	dwc_dh_modpow(), dwc_dh_pk(), and dwc_dh_derive_keys() now take a
+	'void *memctx' as the 1st param.
+
+	dwc_modpow() now takes a 'void *memctx' as the 1st param.
+
+	dwc_alloc_notification_manager() now takes a 'void *memctx' as the
+	1st param and a 'void *wkqctx' (for work queue allocation) as the 2nd
+	param, and also now returns an integer value that is non-zero if
+	allocation of its data structures or work queue fails.
+
+	dwc_register_notifier() now takes a 'void *memctx' as the 1st param.
+
+	dwc_memory_debug_start() now takes a 'void *mem_ctx' as the first
+	param, and also now returns an integer value that is non-zero if
+	allocation of its data structures fails.
+
+
+
+Other miscellaneous changes:
+
+The DEBUG_MEMORY and DEBUG_REGS #define's have been renamed to
+DWC_DEBUG_MEMORY and DWC_DEBUG_REGS.
+
+The following #define's have been added to allow selectively compiling library
+features:
+
+	DWC_CCLIB
+	DWC_CRYPTOLIB
+	DWC_NOTIFYLIB
+	DWC_UTFLIB
+
+A DWC_LIBMODULE #define has also been added. If this is not defined, then the
+module code in dwc_common_linux.c is not compiled in. This allows linking the
+library code directly into a driver module, instead of as a standalone module.
diff --git a/drivers/usb/host/dwc_common_port/doc/doxygen.cfg b/drivers/usb/host/dwc_common_port/doc/doxygen.cfg
new file mode 100644
index 000000000000..89aa887af29d
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/doc/doxygen.cfg
@@ -0,0 +1,270 @@
+# Doxyfile 1.4.5
+
+#---------------------------------------------------------------------------
+# Project related configuration options
+#---------------------------------------------------------------------------
+PROJECT_NAME           = "Synopsys DWC Portability and Common Library for UWB"
+PROJECT_NUMBER         =
+OUTPUT_DIRECTORY       = doc
+CREATE_SUBDIRS         = NO
+OUTPUT_LANGUAGE        = English
+BRIEF_MEMBER_DESC      = YES
+REPEAT_BRIEF           = YES
+ABBREVIATE_BRIEF       = "The $name class" \
+                         "The $name widget" \
+                         "The $name file" \
+                         is \
+                         provides \
+                         specifies \
+                         contains \
+                         represents \
+                         a \
+                         an \
+                         the
+ALWAYS_DETAILED_SEC    = YES
+INLINE_INHERITED_MEMB  = NO
+FULL_PATH_NAMES        = NO
+STRIP_FROM_PATH        = ..
+STRIP_FROM_INC_PATH    =
+SHORT_NAMES            = NO
+JAVADOC_AUTOBRIEF      = YES
+MULTILINE_CPP_IS_BRIEF = NO
+DETAILS_AT_TOP         = YES
+INHERIT_DOCS           = YES
+SEPARATE_MEMBER_PAGES  = NO
+TAB_SIZE               = 8
+ALIASES                =
+OPTIMIZE_OUTPUT_FOR_C  = YES
+OPTIMIZE_OUTPUT_JAVA   = NO
+BUILTIN_STL_SUPPORT    = NO
+DISTRIBUTE_GROUP_DOC   = NO
+SUBGROUPING            = NO
+#---------------------------------------------------------------------------
+# Build related configuration options
+#---------------------------------------------------------------------------
+EXTRACT_ALL            = NO
+EXTRACT_PRIVATE        = NO
+EXTRACT_STATIC         = YES
+EXTRACT_LOCAL_CLASSES  = NO
+EXTRACT_LOCAL_METHODS  = NO
+HIDE_UNDOC_MEMBERS     = NO
+HIDE_UNDOC_CLASSES     = NO
+HIDE_FRIEND_COMPOUNDS  = NO
+HIDE_IN_BODY_DOCS      = NO
+INTERNAL_DOCS          = NO
+CASE_SENSE_NAMES       = YES
+HIDE_SCOPE_NAMES       = NO
+SHOW_INCLUDE_FILES     = NO
+INLINE_INFO            = YES
+SORT_MEMBER_DOCS       = NO
+SORT_BRIEF_DOCS        = NO
+SORT_BY_SCOPE_NAME     = NO
+GENERATE_TODOLIST      = YES
+GENERATE_TESTLIST      = YES
+GENERATE_BUGLIST       = YES
+GENERATE_DEPRECATEDLIST= YES
+ENABLED_SECTIONS       =
+MAX_INITIALIZER_LINES  = 30
+SHOW_USED_FILES        = YES
+SHOW_DIRECTORIES       = YES
+FILE_VERSION_FILTER    =
+#---------------------------------------------------------------------------
+# configuration options related to warning and progress messages
+#---------------------------------------------------------------------------
+QUIET                  = YES
+WARNINGS               = YES
+WARN_IF_UNDOCUMENTED   = NO
+WARN_IF_DOC_ERROR      = YES
+WARN_NO_PARAMDOC       = YES
+WARN_FORMAT            = "$file:$line: $text"
+WARN_LOGFILE           =
+#---------------------------------------------------------------------------
+# configuration options related to the input files
+#---------------------------------------------------------------------------
+INPUT                  = .
+FILE_PATTERNS          = *.c \
+                         *.cc \
+                         *.cxx \
+                         *.cpp \
+                         *.c++ \
+                         *.d \
+                         *.java \
+                         *.ii \
+                         *.ixx \
+                         *.ipp \
+                         *.i++ \
+                         *.inl \
+                         *.h \
+                         *.hh \
+                         *.hxx \
+                         *.hpp \
+                         *.h++ \
+                         *.idl \
+                         *.odl \
+                         *.cs \
+                         *.php \
+                         *.php3 \
+                         *.inc \
+                         *.m \
+                         *.mm \
+                         *.dox \
+                         *.py \
+                         *.C \
+                         *.CC \
+                         *.C++ \
+                         *.II \
+                         *.I++ \
+                         *.H \
+                         *.HH \
+                         *.H++ \
+                         *.CS \
+                         *.PHP \
+                         *.PHP3 \
+                         *.M \
+                         *.MM \
+                         *.PY
+RECURSIVE              = NO
+EXCLUDE                =
+EXCLUDE_SYMLINKS       = NO
+EXCLUDE_PATTERNS       =
+EXAMPLE_PATH           =
+EXAMPLE_PATTERNS       = *
+EXAMPLE_RECURSIVE      = NO
+IMAGE_PATH             =
+INPUT_FILTER           =
+FILTER_PATTERNS        =
+FILTER_SOURCE_FILES    = NO
+#---------------------------------------------------------------------------
+# configuration options related to source browsing
+#---------------------------------------------------------------------------
+SOURCE_BROWSER         = NO
+INLINE_SOURCES         = NO
+STRIP_CODE_COMMENTS    = YES
+REFERENCED_BY_RELATION = YES
+REFERENCES_RELATION    = YES
+USE_HTAGS              = NO
+VERBATIM_HEADERS       = NO
+#---------------------------------------------------------------------------
+# configuration options related to the alphabetical class index
+#---------------------------------------------------------------------------
+ALPHABETICAL_INDEX     = NO
+COLS_IN_ALPHA_INDEX    = 5
+IGNORE_PREFIX          =
+#---------------------------------------------------------------------------
+# configuration options related to the HTML output
+#---------------------------------------------------------------------------
+GENERATE_HTML          = YES
+HTML_OUTPUT            = html
+HTML_FILE_EXTENSION    = .html
+HTML_HEADER            =
+HTML_FOOTER            =
+HTML_STYLESHEET        =
+HTML_ALIGN_MEMBERS     = YES
+GENERATE_HTMLHELP      = NO
+CHM_FILE               =
+HHC_LOCATION           =
+GENERATE_CHI           = NO
+BINARY_TOC             = NO
+TOC_EXPAND             = NO
+DISABLE_INDEX          = NO
+ENUM_VALUES_PER_LINE   = 4
+GENERATE_TREEVIEW      = YES
+TREEVIEW_WIDTH         = 250
+#---------------------------------------------------------------------------
+# configuration options related to the LaTeX output
+#---------------------------------------------------------------------------
+GENERATE_LATEX         = NO
+LATEX_OUTPUT           = latex
+LATEX_CMD_NAME         = latex
+MAKEINDEX_CMD_NAME     = makeindex
+COMPACT_LATEX          = NO
+PAPER_TYPE             = a4wide
+EXTRA_PACKAGES         =
+LATEX_HEADER           =
+PDF_HYPERLINKS         = NO
+USE_PDFLATEX           = NO
+LATEX_BATCHMODE        = NO
+LATEX_HIDE_INDICES     = NO
+#---------------------------------------------------------------------------
+# configuration options related to the RTF output
+#---------------------------------------------------------------------------
+GENERATE_RTF           = NO
+RTF_OUTPUT             = rtf
+COMPACT_RTF            = NO
+RTF_HYPERLINKS         = NO
+RTF_STYLESHEET_FILE    =
+RTF_EXTENSIONS_FILE    =
+#---------------------------------------------------------------------------
+# configuration options related to the man page output
+#---------------------------------------------------------------------------
+GENERATE_MAN           = NO
+MAN_OUTPUT             = man
+MAN_EXTENSION          = .3
+MAN_LINKS              = NO
+#---------------------------------------------------------------------------
+# configuration options related to the XML output
+#---------------------------------------------------------------------------
+GENERATE_XML           = NO
+XML_OUTPUT             = xml
+XML_SCHEMA             =
+XML_DTD                =
+XML_PROGRAMLISTING     = YES
+#---------------------------------------------------------------------------
+# configuration options for the AutoGen Definitions output
+#---------------------------------------------------------------------------
+GENERATE_AUTOGEN_DEF   = NO
+#---------------------------------------------------------------------------
+# configuration options related to the Perl module output
+#---------------------------------------------------------------------------
+GENERATE_PERLMOD       = NO
+PERLMOD_LATEX          = NO
+PERLMOD_PRETTY         = YES
+PERLMOD_MAKEVAR_PREFIX =
+#---------------------------------------------------------------------------
+# Configuration options related to the preprocessor
+#---------------------------------------------------------------------------
+ENABLE_PREPROCESSING   = YES
+MACRO_EXPANSION        = NO
+EXPAND_ONLY_PREDEF     = NO
+SEARCH_INCLUDES        = YES
+INCLUDE_PATH           =
+INCLUDE_FILE_PATTERNS  =
+PREDEFINED             = DEBUG DEBUG_MEMORY
+EXPAND_AS_DEFINED      =
+SKIP_FUNCTION_MACROS   = YES
+#---------------------------------------------------------------------------
+# Configuration::additions related to external references
+#---------------------------------------------------------------------------
+TAGFILES               =
+GENERATE_TAGFILE       =
+ALLEXTERNALS           = NO
+EXTERNAL_GROUPS        = YES
+PERL_PATH              = /usr/bin/perl
+#---------------------------------------------------------------------------
+# Configuration options related to the dot tool
+#---------------------------------------------------------------------------
+CLASS_DIAGRAMS         = YES
+HIDE_UNDOC_RELATIONS   = YES
+HAVE_DOT               = NO
+CLASS_GRAPH            = YES
+COLLABORATION_GRAPH    = YES
+GROUP_GRAPHS           = YES
+UML_LOOK               = NO
+TEMPLATE_RELATIONS     = NO
+INCLUDE_GRAPH          = NO
+INCLUDED_BY_GRAPH      = YES
+CALL_GRAPH             = NO
+GRAPHICAL_HIERARCHY    = YES
+DIRECTORY_GRAPH        = YES
+DOT_IMAGE_FORMAT       = png
+DOT_PATH               =
+DOTFILE_DIRS           =
+MAX_DOT_GRAPH_DEPTH    = 1000
+DOT_TRANSPARENT        = NO
+DOT_MULTI_TARGETS      = NO
+GENERATE_LEGEND        = YES
+DOT_CLEANUP            = YES
+#---------------------------------------------------------------------------
+# Configuration::additions related to the search engine
+#---------------------------------------------------------------------------
+SEARCHENGINE           = NO
diff --git a/drivers/usb/host/dwc_common_port/dwc_cc.c b/drivers/usb/host/dwc_common_port/dwc_cc.c
new file mode 100644
index 000000000000..5ec2ae28698c
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_cc.c
@@ -0,0 +1,532 @@
+/* =========================================================================
+ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_cc.c $
+ * $Revision: #4 $
+ * $Date: 2010/11/04 $
+ * $Change: 1621692 $
+ *
+ * Synopsys Portability Library Software and documentation
+ * (hereinafter, "Software") is an Unsupported proprietary work of
+ * Synopsys, Inc. unless otherwise expressly agreed to in writing
+ * between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product
+ * under any End User Software License Agreement or Agreement for
+ * Licensed Product with Synopsys or any supplement thereto. You are
+ * permitted to use and redistribute this Software in source and binary
+ * forms, with or without modification, provided that redistributions
+ * of source code must retain this notice. You may not view, use,
+ * disclose, copy or distribute this file or any information contained
+ * herein except pursuant to this license grant from Synopsys. If you
+ * do not agree with this notice, including the disclaimer below, then
+ * you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
+ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
+ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================= */
+#ifdef DWC_CCLIB
+
+#include "dwc_cc.h"
+
+typedef struct dwc_cc
+{
+	uint32_t uid;
+	uint8_t chid[16];
+	uint8_t cdid[16];
+	uint8_t ck[16];
+	uint8_t *name;
+	uint8_t length;
+        DWC_CIRCLEQ_ENTRY(dwc_cc) list_entry;
+} dwc_cc_t;
+
+DWC_CIRCLEQ_HEAD(context_list, dwc_cc);
+
+/** The main structure for CC management.  */
+struct dwc_cc_if
+{
+	dwc_mutex_t *mutex;
+	char *filename;
+
+	unsigned is_host:1;
+
+	dwc_notifier_t *notifier;
+
+	struct context_list list;
+};
+
+#ifdef DEBUG
+static inline void dump_bytes(char *name, uint8_t *bytes, int len)
+{
+	int i;
+	DWC_PRINTF("%s: ", name);
+	for (i=0; i<len; i++) {
+		DWC_PRINTF("%02x ", bytes[i]);
+	}
+	DWC_PRINTF("\n");
+}
+#else
+#define dump_bytes(x...)
+#endif
+
+static dwc_cc_t *alloc_cc(void *mem_ctx, uint8_t *name, uint32_t length)
+{
+	dwc_cc_t *cc = dwc_alloc(mem_ctx, sizeof(dwc_cc_t));
+	if (!cc) {
+		return NULL;
+	}
+	DWC_MEMSET(cc, 0, sizeof(dwc_cc_t));
+
+	if (name) {
+		cc->length = length;
+		cc->name = dwc_alloc(mem_ctx, length);
+		if (!cc->name) {
+			dwc_free(mem_ctx, cc);
+			return NULL;
+		}
+
+		DWC_MEMCPY(cc->name, name, length);
+	}
+
+	return cc;
+}
+
+static void free_cc(void *mem_ctx, dwc_cc_t *cc)
+{
+	if (cc->name) {
+		dwc_free(mem_ctx, cc->name);
+	}
+	dwc_free(mem_ctx, cc);
+}
+
+static uint32_t next_uid(dwc_cc_if_t *cc_if)
+{
+	uint32_t uid = 0;
+	dwc_cc_t *cc;
+	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
+		if (cc->uid > uid) {
+			uid = cc->uid;
+		}
+	}
+
+	if (uid == 0) {
+		uid = 255;
+	}
+
+	return uid + 1;
+}
+
+static dwc_cc_t *cc_find(dwc_cc_if_t *cc_if, uint32_t uid)
+{
+	dwc_cc_t *cc;
+	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
+		if (cc->uid == uid) {
+			return cc;
+		}
+	}
+	return NULL;
+}
+
+static unsigned int cc_data_size(dwc_cc_if_t *cc_if)
+{
+	unsigned int size = 0;
+	dwc_cc_t *cc;
+	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
+		size += (48 + 1);
+		if (cc->name) {
+			size += cc->length;
+		}
+	}
+	return size;
+}
+
+static uint32_t cc_match_chid(dwc_cc_if_t *cc_if, uint8_t *chid)
+{
+	uint32_t uid = 0;
+	dwc_cc_t *cc;
+
+	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
+		if (DWC_MEMCMP(cc->chid, chid, 16) == 0) {
+			uid = cc->uid;
+			break;
+		}
+	}
+	return uid;
+}
+static uint32_t cc_match_cdid(dwc_cc_if_t *cc_if, uint8_t *cdid)
+{
+	uint32_t uid = 0;
+	dwc_cc_t *cc;
+
+	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
+		if (DWC_MEMCMP(cc->cdid, cdid, 16) == 0) {
+			uid = cc->uid;
+			break;
+		}
+	}
+	return uid;
+}
+
+/* Internal cc_add */
+static int32_t cc_add(void *mem_ctx, dwc_cc_if_t *cc_if, uint8_t *chid,
+		      uint8_t *cdid, uint8_t *ck, uint8_t *name, uint8_t length)
+{
+	dwc_cc_t *cc;
+	uint32_t uid;
+
+	if (cc_if->is_host) {
+		uid = cc_match_cdid(cc_if, cdid);
+	}
+	else {
+		uid = cc_match_chid(cc_if, chid);
+	}
+
+	if (uid) {
+		DWC_DEBUGC("Replacing previous connection context id=%d name=%p name_len=%d", uid, name, length);
+		cc = cc_find(cc_if, uid);
+	}
+	else {
+		cc = alloc_cc(mem_ctx, name, length);
+		cc->uid = next_uid(cc_if);
+		DWC_CIRCLEQ_INSERT_TAIL(&cc_if->list, cc, list_entry);
+	}
+
+	DWC_MEMCPY(&(cc->chid[0]), chid, 16);
+	DWC_MEMCPY(&(cc->cdid[0]), cdid, 16);
+	DWC_MEMCPY(&(cc->ck[0]), ck, 16);
+
+	DWC_DEBUGC("Added connection context id=%d name=%p name_len=%d", cc->uid, name, length);
+	dump_bytes("CHID", cc->chid, 16);
+	dump_bytes("CDID", cc->cdid, 16);
+	dump_bytes("CK", cc->ck, 16);
+	return cc->uid;
+}
+
+/* Internal cc_clear */
+static void cc_clear(void *mem_ctx, dwc_cc_if_t *cc_if)
+{
+	while (!DWC_CIRCLEQ_EMPTY(&cc_if->list)) {
+		dwc_cc_t *cc = DWC_CIRCLEQ_FIRST(&cc_if->list);
+		DWC_CIRCLEQ_REMOVE_INIT(&cc_if->list, cc, list_entry);
+		free_cc(mem_ctx, cc);
+	}
+}
+
+dwc_cc_if_t *dwc_cc_if_alloc(void *mem_ctx, void *mtx_ctx,
+			     dwc_notifier_t *notifier, unsigned is_host)
+{
+	dwc_cc_if_t *cc_if = NULL;
+
+	/* Allocate a common_cc_if structure */
+	cc_if = dwc_alloc(mem_ctx, sizeof(dwc_cc_if_t));
+
+	if (!cc_if)
+		return NULL;
+
+#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
+	DWC_MUTEX_ALLOC_LINUX_DEBUG(cc_if->mutex);
+#else
+	cc_if->mutex = dwc_mutex_alloc(mtx_ctx);
+#endif
+	if (!cc_if->mutex) {
+		dwc_free(mem_ctx, cc_if);
+		return NULL;
+	}
+
+	DWC_CIRCLEQ_INIT(&cc_if->list);
+	cc_if->is_host = is_host;
+	cc_if->notifier = notifier;
+	return cc_if;
+}
+
+void dwc_cc_if_free(void *mem_ctx, void *mtx_ctx, dwc_cc_if_t *cc_if)
+{
+#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
+	DWC_MUTEX_FREE(cc_if->mutex);
+#else
+	dwc_mutex_free(mtx_ctx, cc_if->mutex);
+#endif
+	cc_clear(mem_ctx, cc_if);
+	dwc_free(mem_ctx, cc_if);
+}
+
+static void cc_changed(dwc_cc_if_t *cc_if)
+{
+	if (cc_if->notifier) {
+		dwc_notify(cc_if->notifier, DWC_CC_LIST_CHANGED_NOTIFICATION, cc_if);
+	}
+}
+
+void dwc_cc_clear(void *mem_ctx, dwc_cc_if_t *cc_if)
+{
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	cc_clear(mem_ctx, cc_if);
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+	cc_changed(cc_if);
+}
+
+int32_t dwc_cc_add(void *mem_ctx, dwc_cc_if_t *cc_if, uint8_t *chid,
+		   uint8_t *cdid, uint8_t *ck, uint8_t *name, uint8_t length)
+{
+	uint32_t uid;
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	uid = cc_add(mem_ctx, cc_if, chid, cdid, ck, name, length);
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+	cc_changed(cc_if);
+
+	return uid;
+}
+
+void dwc_cc_change(void *mem_ctx, dwc_cc_if_t *cc_if, int32_t id, uint8_t *chid,
+		   uint8_t *cdid, uint8_t *ck, uint8_t *name, uint8_t length)
+{
+	dwc_cc_t* cc;
+
+	DWC_DEBUGC("Change connection context %d", id);
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	cc = cc_find(cc_if, id);
+	if (!cc) {
+		DWC_ERROR("Uid %d not found in cc list\n", id);
+		DWC_MUTEX_UNLOCK(cc_if->mutex);
+		return;
+	}
+
+	if (chid) {
+		DWC_MEMCPY(&(cc->chid[0]), chid, 16);
+	}
+	if (cdid) {
+		DWC_MEMCPY(&(cc->cdid[0]), cdid, 16);
+	}
+	if (ck) {
+		DWC_MEMCPY(&(cc->ck[0]), ck, 16);
+	}
+
+	if (name) {
+		if (cc->name) {
+			dwc_free(mem_ctx, cc->name);
+		}
+		cc->name = dwc_alloc(mem_ctx, length);
+		if (!cc->name) {
+			DWC_ERROR("Out of memory in dwc_cc_change()\n");
+			DWC_MUTEX_UNLOCK(cc_if->mutex);
+			return;
+		}
+		cc->length = length;
+		DWC_MEMCPY(cc->name, name, length);
+	}
+
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+
+	cc_changed(cc_if);
+
+	DWC_DEBUGC("Changed connection context id=%d\n", id);
+	dump_bytes("New CHID", cc->chid, 16);
+	dump_bytes("New CDID", cc->cdid, 16);
+	dump_bytes("New CK", cc->ck, 16);
+}
+
+void dwc_cc_remove(void *mem_ctx, dwc_cc_if_t *cc_if, int32_t id)
+{
+	dwc_cc_t *cc;
+
+	DWC_DEBUGC("Removing connection context %d", id);
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	cc = cc_find(cc_if, id);
+	if (!cc) {
+		DWC_ERROR("Uid %d not found in cc list\n", id);
+		DWC_MUTEX_UNLOCK(cc_if->mutex);
+		return;
+	}
+
+	DWC_CIRCLEQ_REMOVE_INIT(&cc_if->list, cc, list_entry);
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+	free_cc(mem_ctx, cc);
+
+	cc_changed(cc_if);
+}
+
+uint8_t *dwc_cc_data_for_save(void *mem_ctx, dwc_cc_if_t *cc_if, unsigned int *length)
+{
+	uint8_t *buf, *x;
+	uint8_t zero = 0;
+	dwc_cc_t *cc;
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	*length = cc_data_size(cc_if);
+	if (!(*length)) {
+		DWC_MUTEX_UNLOCK(cc_if->mutex);
+		return NULL;
+	}
+
+	DWC_DEBUGC("Creating data for saving (length=%d)", *length);
+
+	buf = dwc_alloc(mem_ctx, *length);
+	if (!buf) {
+		*length = 0;
+		DWC_MUTEX_UNLOCK(cc_if->mutex);
+		return NULL;
+	}
+
+	x = buf;
+	DWC_CIRCLEQ_FOREACH(cc, &cc_if->list, list_entry) {
+		DWC_MEMCPY(x, cc->chid, 16);
+		x += 16;
+		DWC_MEMCPY(x, cc->cdid, 16);
+		x += 16;
+		DWC_MEMCPY(x, cc->ck, 16);
+		x += 16;
+		if (cc->name) {
+			DWC_MEMCPY(x, &cc->length, 1);
+			x += 1;
+			DWC_MEMCPY(x, cc->name, cc->length);
+			x += cc->length;
+		}
+		else {
+			DWC_MEMCPY(x, &zero, 1);
+			x += 1;
+		}
+	}
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+
+	return buf;
+}
+
+void dwc_cc_restore_from_data(void *mem_ctx, dwc_cc_if_t *cc_if, uint8_t *data, uint32_t length)
+{
+	uint8_t name_length;
+	uint8_t *name;
+	uint8_t *chid;
+	uint8_t *cdid;
+	uint8_t *ck;
+	uint32_t i = 0;
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	cc_clear(mem_ctx, cc_if);
+
+	while (i < length) {
+		chid = &data[i];
+		i += 16;
+		cdid = &data[i];
+		i += 16;
+		ck = &data[i];
+		i += 16;
+
+		name_length = data[i];
+		i ++;
+
+		if (name_length) {
+			name = &data[i];
+			i += name_length;
+		}
+		else {
+			name = NULL;
+		}
+
+		/* check to see if we haven't overflown the buffer */
+		if (i > length) {
+			DWC_ERROR("Data format error while attempting to load CCs "
+				  "(nlen=%d, iter=%d, buflen=%d).\n", name_length, i, length);
+			break;
+		}
+
+		cc_add(mem_ctx, cc_if, chid, cdid, ck, name, name_length);
+	}
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+
+	cc_changed(cc_if);
+}
+
+uint32_t dwc_cc_match_chid(dwc_cc_if_t *cc_if, uint8_t *chid)
+{
+	uint32_t uid = 0;
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	uid = cc_match_chid(cc_if, chid);
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+	return uid;
+}
+uint32_t dwc_cc_match_cdid(dwc_cc_if_t *cc_if, uint8_t *cdid)
+{
+	uint32_t uid = 0;
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	uid = cc_match_cdid(cc_if, cdid);
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+	return uid;
+}
+
+uint8_t *dwc_cc_ck(dwc_cc_if_t *cc_if, int32_t id)
+{
+	uint8_t *ck = NULL;
+	dwc_cc_t *cc;
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	cc = cc_find(cc_if, id);
+	if (cc) {
+		ck = cc->ck;
+	}
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+
+	return ck;
+
+}
+
+uint8_t *dwc_cc_chid(dwc_cc_if_t *cc_if, int32_t id)
+{
+	uint8_t *retval = NULL;
+	dwc_cc_t *cc;
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	cc = cc_find(cc_if, id);
+	if (cc) {
+		retval = cc->chid;
+	}
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+
+	return retval;
+}
+
+uint8_t *dwc_cc_cdid(dwc_cc_if_t *cc_if, int32_t id)
+{
+	uint8_t *retval = NULL;
+	dwc_cc_t *cc;
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	cc = cc_find(cc_if, id);
+	if (cc) {
+		retval = cc->cdid;
+	}
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+
+	return retval;
+}
+
+uint8_t *dwc_cc_name(dwc_cc_if_t *cc_if, int32_t id, uint8_t *length)
+{
+	uint8_t *retval = NULL;
+	dwc_cc_t *cc;
+
+	DWC_MUTEX_LOCK(cc_if->mutex);
+	*length = 0;
+	cc = cc_find(cc_if, id);
+	if (cc) {
+		*length = cc->length;
+		retval = cc->name;
+	}
+	DWC_MUTEX_UNLOCK(cc_if->mutex);
+
+	return retval;
+}
+
+#endif	/* DWC_CCLIB */
diff --git a/drivers/usb/host/dwc_common_port/dwc_cc.h b/drivers/usb/host/dwc_common_port/dwc_cc.h
new file mode 100644
index 000000000000..f86e6f21792b
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_cc.h
@@ -0,0 +1,224 @@
+/* =========================================================================
+ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_cc.h $
+ * $Revision: #4 $
+ * $Date: 2010/09/28 $
+ * $Change: 1596182 $
+ *
+ * Synopsys Portability Library Software and documentation
+ * (hereinafter, "Software") is an Unsupported proprietary work of
+ * Synopsys, Inc. unless otherwise expressly agreed to in writing
+ * between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product
+ * under any End User Software License Agreement or Agreement for
+ * Licensed Product with Synopsys or any supplement thereto. You are
+ * permitted to use and redistribute this Software in source and binary
+ * forms, with or without modification, provided that redistributions
+ * of source code must retain this notice. You may not view, use,
+ * disclose, copy or distribute this file or any information contained
+ * herein except pursuant to this license grant from Synopsys. If you
+ * do not agree with this notice, including the disclaimer below, then
+ * you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
+ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
+ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================= */
+#ifndef _DWC_CC_H_
+#define _DWC_CC_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** @file
+ *
+ * This file defines the Context Context library.
+ *
+ * The main data structure is dwc_cc_if_t which is returned by either the
+ * dwc_cc_if_alloc function or returned by the module to the user via a provided
+ * function. The data structure is opaque and should only be manipulated via the
+ * functions provied in this API.
+ *
+ * It manages a list of connection contexts and operations can be performed to
+ * add, remove, query, search, and change, those contexts.  Additionally,
+ * a dwc_notifier_t object can be requested from the manager so that
+ * the user can be notified whenever the context list has changed.
+ */
+
+#include "dwc_os.h"
+#include "dwc_list.h"
+#include "dwc_notifier.h"
+
+
+/* Notifications */
+#define DWC_CC_LIST_CHANGED_NOTIFICATION "DWC_CC_LIST_CHANGED_NOTIFICATION"
+
+struct dwc_cc_if;
+typedef struct dwc_cc_if dwc_cc_if_t;
+
+
+/** @name Connection Context Operations */
+/** @{ */
+
+/** This function allocates memory for a dwc_cc_if_t structure, initializes
+ * fields to default values, and returns a pointer to the structure or NULL on
+ * error. */
+extern dwc_cc_if_t *dwc_cc_if_alloc(void *mem_ctx, void *mtx_ctx,
+				    dwc_notifier_t *notifier, unsigned is_host);
+
+/** Frees the memory for the specified CC structure allocated from
+ * dwc_cc_if_alloc(). */
+extern void dwc_cc_if_free(void *mem_ctx, void *mtx_ctx, dwc_cc_if_t *cc_if);
+
+/** Removes all contexts from the connection context list */
+extern void dwc_cc_clear(void *mem_ctx, dwc_cc_if_t *cc_if);
+
+/** Adds a connection context (CHID, CK, CDID, Name) to the connection context list.
+ * If a CHID already exists, the CK and name are overwritten.  Statistics are
+ * not overwritten.
+ *
+ * @param cc_if The cc_if structure.
+ * @param chid A pointer to the 16-byte CHID.  This value will be copied.
+ * @param ck A pointer to the 16-byte CK.  This value will be copied.
+ * @param cdid A pointer to the 16-byte CDID.  This value will be copied.
+ * @param name An optional host friendly name as defined in the association model
+ * spec.  Must be a UTF16-LE unicode string.  Can be NULL to indicated no name.
+ * @param length The length othe unicode string.
+ * @return A unique identifier used to refer to this context that is valid for
+ * as long as this context is still in the list. */
+extern int32_t dwc_cc_add(void *mem_ctx, dwc_cc_if_t *cc_if, uint8_t *chid,
+			  uint8_t *cdid, uint8_t *ck, uint8_t *name,
+			  uint8_t length);
+
+/** Changes the CHID, CK, CDID, or Name values of a connection context in the
+ * list, preserving any accumulated statistics.  This would typically be called
+ * if the host decideds to change the context with a SET_CONNECTION request.
+ *
+ * @param cc_if The cc_if structure.
+ * @param id The identifier of the connection context.
+ * @param chid A pointer to the 16-byte CHID.  This value will be copied.  NULL
+ * indicates no change.
+ * @param cdid A pointer to the 16-byte CDID.  This value will be copied.  NULL
+ * indicates no change.
+ * @param ck A pointer to the 16-byte CK.  This value will be copied.  NULL
+ * indicates no change.
+ * @param name Host friendly name UTF16-LE.  NULL indicates no change.
+ * @param length Length of name. */
+extern void dwc_cc_change(void *mem_ctx, dwc_cc_if_t *cc_if, int32_t id,
+			  uint8_t *chid, uint8_t *cdid, uint8_t *ck,
+			  uint8_t *name, uint8_t length);
+
+/** Remove the specified connection context.
+ * @param cc_if The cc_if structure.
+ * @param id The identifier of the connection context to remove. */
+extern void dwc_cc_remove(void *mem_ctx, dwc_cc_if_t *cc_if, int32_t id);
+
+/** Get a binary block of data for the connection context list and attributes.
+ * This data can be used by the OS specific driver to save the connection
+ * context list into non-volatile memory.
+ *
+ * @param cc_if The cc_if structure.
+ * @param length Return the length of the data buffer.
+ * @return A pointer to the data buffer.  The memory for this buffer should be
+ * freed with DWC_FREE() after use. */
+extern uint8_t *dwc_cc_data_for_save(void *mem_ctx, dwc_cc_if_t *cc_if,
+				     unsigned int *length);
+
+/** Restore the connection context list from the binary data that was previously
+ * returned from a call to dwc_cc_data_for_save.  This can be used by the OS specific
+ * driver to load a connection context list from non-volatile memory.
+ *
+ * @param cc_if The cc_if structure.
+ * @param data The data bytes as returned from dwc_cc_data_for_save.
+ * @param length The length of the data. */
+extern void dwc_cc_restore_from_data(void *mem_ctx, dwc_cc_if_t *cc_if,
+				     uint8_t *data, unsigned int length);
+
+/** Find the connection context from the specified CHID.
+ *
+ * @param cc_if The cc_if structure.
+ * @param chid A pointer to the CHID data.
+ * @return A non-zero identifier of the connection context if the CHID matches.
+ * Otherwise returns 0. */
+extern uint32_t dwc_cc_match_chid(dwc_cc_if_t *cc_if, uint8_t *chid);
+
+/** Find the connection context from the specified CDID.
+ *
+ * @param cc_if The cc_if structure.
+ * @param cdid A pointer to the CDID data.
+ * @return A non-zero identifier of the connection context if the CHID matches.
+ * Otherwise returns 0. */
+extern uint32_t dwc_cc_match_cdid(dwc_cc_if_t *cc_if, uint8_t *cdid);
+
+/** Retrieve the CK from the specified connection context.
+ *
+ * @param cc_if The cc_if structure.
+ * @param id The identifier of the connection context.
+ * @return A pointer to the CK data.  The memory does not need to be freed. */
+extern uint8_t *dwc_cc_ck(dwc_cc_if_t *cc_if, int32_t id);
+
+/** Retrieve the CHID from the specified connection context.
+ *
+ * @param cc_if The cc_if structure.
+ * @param id The identifier of the connection context.
+ * @return A pointer to the CHID data.  The memory does not need to be freed. */
+extern uint8_t *dwc_cc_chid(dwc_cc_if_t *cc_if, int32_t id);
+
+/** Retrieve the CDID from the specified connection context.
+ *
+ * @param cc_if The cc_if structure.
+ * @param id The identifier of the connection context.
+ * @return A pointer to the CDID data.  The memory does not need to be freed. */
+extern uint8_t *dwc_cc_cdid(dwc_cc_if_t *cc_if, int32_t id);
+
+extern uint8_t *dwc_cc_name(dwc_cc_if_t *cc_if, int32_t id, uint8_t *length);
+
+/** Checks a buffer for non-zero.
+ * @param id A pointer to a 16 byte buffer.
+ * @return true if the 16 byte value is non-zero. */
+static inline unsigned dwc_assoc_is_not_zero_id(uint8_t *id) {
+	int i;
+	for (i=0; i<16; i++) {
+		if (id[i]) return 1;
+	}
+	return 0;
+}
+
+/** Checks a buffer for zero.
+ * @param id A pointer to a 16 byte buffer.
+ * @return true if the 16 byte value is zero. */
+static inline unsigned dwc_assoc_is_zero_id(uint8_t *id) {
+	return !dwc_assoc_is_not_zero_id(id);
+}
+
+/** Prints an ASCII representation for the 16-byte chid, cdid, or ck, into
+ * buffer. */
+static inline int dwc_print_id_string(char *buffer, uint8_t *id) {
+	char *ptr = buffer;
+	int i;
+	for (i=0; i<16; i++) {
+		ptr += DWC_SPRINTF(ptr, "%02x", id[i]);
+		if (i < 15) {
+			ptr += DWC_SPRINTF(ptr, " ");
+		}
+	}
+	return ptr - buffer;
+}
+
+/** @} */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _DWC_CC_H_ */
diff --git a/drivers/usb/host/dwc_common_port/dwc_common_fbsd.c b/drivers/usb/host/dwc_common_port/dwc_common_fbsd.c
new file mode 100644
index 000000000000..6dd04b58f8f6
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_common_fbsd.c
@@ -0,0 +1,1308 @@
+#include "dwc_os.h"
+#include "dwc_list.h"
+
+#ifdef DWC_CCLIB
+# include "dwc_cc.h"
+#endif
+
+#ifdef DWC_CRYPTOLIB
+# include "dwc_modpow.h"
+# include "dwc_dh.h"
+# include "dwc_crypto.h"
+#endif
+
+#ifdef DWC_NOTIFYLIB
+# include "dwc_notifier.h"
+#endif
+
+/* OS-Level Implementations */
+
+/* This is the FreeBSD 7.0 kernel implementation of the DWC platform library. */
+
+
+/* MISC */
+
+void *DWC_MEMSET(void *dest, uint8_t byte, uint32_t size)
+{
+	return memset(dest, byte, size);
+}
+
+void *DWC_MEMCPY(void *dest, void const *src, uint32_t size)
+{
+	return memcpy(dest, src, size);
+}
+
+void *DWC_MEMMOVE(void *dest, void *src, uint32_t size)
+{
+	bcopy(src, dest, size);
+	return dest;
+}
+
+int DWC_MEMCMP(void *m1, void *m2, uint32_t size)
+{
+	return memcmp(m1, m2, size);
+}
+
+int DWC_STRNCMP(void *s1, void *s2, uint32_t size)
+{
+	return strncmp(s1, s2, size);
+}
+
+int DWC_STRCMP(void *s1, void *s2)
+{
+	return strcmp(s1, s2);
+}
+
+int DWC_STRLEN(char const *str)
+{
+	return strlen(str);
+}
+
+char *DWC_STRCPY(char *to, char const *from)
+{
+	return strcpy(to, from);
+}
+
+char *DWC_STRDUP(char const *str)
+{
+	int len = DWC_STRLEN(str) + 1;
+	char *new = DWC_ALLOC_ATOMIC(len);
+
+	if (!new) {
+		return NULL;
+	}
+
+	DWC_MEMCPY(new, str, len);
+	return new;
+}
+
+int DWC_ATOI(char *str, int32_t *value)
+{
+	char *end = NULL;
+
+	*value = strtol(str, &end, 0);
+	if (*end == '\0') {
+		return 0;
+	}
+
+	return -1;
+}
+
+int DWC_ATOUI(char *str, uint32_t *value)
+{
+	char *end = NULL;
+
+	*value = strtoul(str, &end, 0);
+	if (*end == '\0') {
+		return 0;
+	}
+
+	return -1;
+}
+
+
+#ifdef DWC_UTFLIB
+/* From usbstring.c */
+
+int DWC_UTF8_TO_UTF16LE(uint8_t const *s, uint16_t *cp, unsigned len)
+{
+	int	count = 0;
+	u8	c;
+	u16	uchar;
+
+	/* this insists on correct encodings, though not minimal ones.
+	 * BUT it currently rejects legit 4-byte UTF-8 code points,
+	 * which need surrogate pairs.  (Unicode 3.1 can use them.)
+	 */
+	while (len != 0 && (c = (u8) *s++) != 0) {
+		if (unlikely(c & 0x80)) {
+			// 2-byte sequence:
+			// 00000yyyyyxxxxxx = 110yyyyy 10xxxxxx
+			if ((c & 0xe0) == 0xc0) {
+				uchar = (c & 0x1f) << 6;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c;
+
+			// 3-byte sequence (most CJKV characters):
+			// zzzzyyyyyyxxxxxx = 1110zzzz 10yyyyyy 10xxxxxx
+			} else if ((c & 0xf0) == 0xe0) {
+				uchar = (c & 0x0f) << 12;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c << 6;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c;
+
+				/* no bogus surrogates */
+				if (0xd800 <= uchar && uchar <= 0xdfff)
+					goto fail;
+
+			// 4-byte sequence (surrogate pairs, currently rare):
+			// 11101110wwwwzzzzyy + 110111yyyyxxxxxx
+			//     = 11110uuu 10uuzzzz 10yyyyyy 10xxxxxx
+			// (uuuuu = wwww + 1)
+			// FIXME accept the surrogate code points (only)
+			} else
+				goto fail;
+		} else
+			uchar = c;
+		put_unaligned (cpu_to_le16 (uchar), cp++);
+		count++;
+		len--;
+	}
+	return count;
+fail:
+	return -1;
+}
+
+#endif	/* DWC_UTFLIB */
+
+
+/* dwc_debug.h */
+
+dwc_bool_t DWC_IN_IRQ(void)
+{
+//	return in_irq();
+	return 0;
+}
+
+dwc_bool_t DWC_IN_BH(void)
+{
+//	return in_softirq();
+	return 0;
+}
+
+void DWC_VPRINTF(char *format, va_list args)
+{
+	vprintf(format, args);
+}
+
+int DWC_VSNPRINTF(char *str, int size, char *format, va_list args)
+{
+	return vsnprintf(str, size, format, args);
+}
+
+void DWC_PRINTF(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+
+int DWC_SPRINTF(char *buffer, char *format, ...)
+{
+	int retval;
+	va_list args;
+
+	va_start(args, format);
+	retval = vsprintf(buffer, format, args);
+	va_end(args);
+	return retval;
+}
+
+int DWC_SNPRINTF(char *buffer, int size, char *format, ...)
+{
+	int retval;
+	va_list args;
+
+	va_start(args, format);
+	retval = vsnprintf(buffer, size, format, args);
+	va_end(args);
+	return retval;
+}
+
+void __DWC_WARN(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+
+void __DWC_ERROR(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+
+void DWC_EXCEPTION(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+//	BUG_ON(1);	???
+}
+
+#ifdef DEBUG
+void __DWC_DEBUG(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+#endif
+
+
+/* dwc_mem.h */
+
+#if 0
+dwc_pool_t *DWC_DMA_POOL_CREATE(uint32_t size,
+				uint32_t align,
+				uint32_t alloc)
+{
+	struct dma_pool *pool = dma_pool_create("Pool", NULL,
+						size, align, alloc);
+	return (dwc_pool_t *)pool;
+}
+
+void DWC_DMA_POOL_DESTROY(dwc_pool_t *pool)
+{
+	dma_pool_destroy((struct dma_pool *)pool);
+}
+
+void *DWC_DMA_POOL_ALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
+{
+//	return dma_pool_alloc((struct dma_pool *)pool, GFP_KERNEL, dma_addr);
+	return dma_pool_alloc((struct dma_pool *)pool, M_WAITOK, dma_addr);
+}
+
+void *DWC_DMA_POOL_ZALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
+{
+	void *vaddr = DWC_DMA_POOL_ALLOC(pool, dma_addr);
+	memset(..);
+}
+
+void DWC_DMA_POOL_FREE(dwc_pool_t *pool, void *vaddr, void *daddr)
+{
+	dma_pool_free(pool, vaddr, daddr);
+}
+#endif
+
+static void dmamap_cb(void *arg, bus_dma_segment_t *segs, int nseg, int error)
+{
+	if (error)
+		return;
+	*(bus_addr_t *)arg = segs[0].ds_addr;
+}
+
+void *__DWC_DMA_ALLOC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr)
+{
+	dwc_dmactx_t *dma = (dwc_dmactx_t *)dma_ctx;
+	int error;
+
+	error = bus_dma_tag_create(
+#if __FreeBSD_version >= 700000
+			bus_get_dma_tag(dma->dev),	/* parent */
+#else
+			NULL,				/* parent */
+#endif
+			4, 0,				/* alignment, bounds */
+			BUS_SPACE_MAXADDR_32BIT,	/* lowaddr */
+			BUS_SPACE_MAXADDR,		/* highaddr */
+			NULL, NULL,			/* filter, filterarg */
+			size,				/* maxsize */
+			1,				/* nsegments */
+			size,				/* maxsegsize */
+			0,				/* flags */
+			NULL,				/* lockfunc */
+			NULL,				/* lockarg */
+			&dma->dma_tag);
+	if (error) {
+		device_printf(dma->dev, "%s: bus_dma_tag_create failed: %d\n",
+			      __func__, error);
+		goto fail_0;
+	}
+
+	error = bus_dmamem_alloc(dma->dma_tag, &dma->dma_vaddr,
+				 BUS_DMA_NOWAIT | BUS_DMA_COHERENT, &dma->dma_map);
+	if (error) {
+		device_printf(dma->dev, "%s: bus_dmamem_alloc(%ju) failed: %d\n",
+			      __func__, (uintmax_t)size, error);
+		goto fail_1;
+	}
+
+	dma->dma_paddr = 0;
+	error = bus_dmamap_load(dma->dma_tag, dma->dma_map, dma->dma_vaddr, size,
+				dmamap_cb, &dma->dma_paddr, BUS_DMA_NOWAIT);
+	if (error || dma->dma_paddr == 0) {
+		device_printf(dma->dev, "%s: bus_dmamap_load failed: %d\n",
+			      __func__, error);
+		goto fail_2;
+	}
+
+	*dma_addr = dma->dma_paddr;
+	return dma->dma_vaddr;
+
+fail_2:
+	bus_dmamap_unload(dma->dma_tag, dma->dma_map);
+fail_1:
+	bus_dmamem_free(dma->dma_tag, dma->dma_vaddr, dma->dma_map);
+	bus_dma_tag_destroy(dma->dma_tag);
+fail_0:
+	dma->dma_map = NULL;
+	dma->dma_tag = NULL;
+
+	return NULL;
+}
+
+void __DWC_DMA_FREE(void *dma_ctx, uint32_t size, void *virt_addr, dwc_dma_t dma_addr)
+{
+	dwc_dmactx_t *dma = (dwc_dmactx_t *)dma_ctx;
+
+	if (dma->dma_tag == NULL)
+		return;
+	if (dma->dma_map != NULL) {
+		bus_dmamap_sync(dma->dma_tag, dma->dma_map,
+				BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
+		bus_dmamap_unload(dma->dma_tag, dma->dma_map);
+		bus_dmamem_free(dma->dma_tag, dma->dma_vaddr, dma->dma_map);
+		dma->dma_map = NULL;
+	}
+
+	bus_dma_tag_destroy(dma->dma_tag);
+	dma->dma_tag = NULL;
+}
+
+void *__DWC_ALLOC(void *mem_ctx, uint32_t size)
+{
+	return malloc(size, M_DEVBUF, M_WAITOK | M_ZERO);
+}
+
+void *__DWC_ALLOC_ATOMIC(void *mem_ctx, uint32_t size)
+{
+	return malloc(size, M_DEVBUF, M_NOWAIT | M_ZERO);
+}
+
+void __DWC_FREE(void *mem_ctx, void *addr)
+{
+	free(addr, M_DEVBUF);
+}
+
+
+#ifdef DWC_CRYPTOLIB
+/* dwc_crypto.h */
+
+void DWC_RANDOM_BYTES(uint8_t *buffer, uint32_t length)
+{
+	get_random_bytes(buffer, length);
+}
+
+int DWC_AES_CBC(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t iv[16], uint8_t *out)
+{
+	struct crypto_blkcipher *tfm;
+	struct blkcipher_desc desc;
+	struct scatterlist sgd;
+	struct scatterlist sgs;
+
+	tfm = crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
+	if (tfm == NULL) {
+		printk("failed to load transform for aes CBC\n");
+		return -1;
+	}
+
+	crypto_blkcipher_setkey(tfm, key, keylen);
+	crypto_blkcipher_set_iv(tfm, iv, 16);
+
+	sg_init_one(&sgd, out, messagelen);
+	sg_init_one(&sgs, message, messagelen);
+
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	if (crypto_blkcipher_encrypt(&desc, &sgd, &sgs, messagelen)) {
+		crypto_free_blkcipher(tfm);
+		DWC_ERROR("AES CBC encryption failed");
+		return -1;
+	}
+
+	crypto_free_blkcipher(tfm);
+	return 0;
+}
+
+int DWC_SHA256(uint8_t *message, uint32_t len, uint8_t *out)
+{
+	struct crypto_hash *tfm;
+	struct hash_desc desc;
+	struct scatterlist sg;
+
+	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(tfm)) {
+		DWC_ERROR("Failed to load transform for sha256: %ld", PTR_ERR(tfm));
+		return 0;
+	}
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	sg_init_one(&sg, message, len);
+	crypto_hash_digest(&desc, &sg, len, out);
+	crypto_free_hash(tfm);
+
+	return 1;
+}
+
+int DWC_HMAC_SHA256(uint8_t *message, uint32_t messagelen,
+		    uint8_t *key, uint32_t keylen, uint8_t *out)
+{
+	struct crypto_hash *tfm;
+	struct hash_desc desc;
+	struct scatterlist sg;
+
+	tfm = crypto_alloc_hash("hmac(sha256)", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(tfm)) {
+		DWC_ERROR("Failed to load transform for hmac(sha256): %ld", PTR_ERR(tfm));
+		return 0;
+	}
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	sg_init_one(&sg, message, messagelen);
+	crypto_hash_setkey(tfm, key, keylen);
+	crypto_hash_digest(&desc, &sg, messagelen, out);
+	crypto_free_hash(tfm);
+
+	return 1;
+}
+
+#endif	/* DWC_CRYPTOLIB */
+
+
+/* Byte Ordering Conversions */
+
+uint32_t DWC_CPU_TO_LE32(uint32_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint32_t DWC_CPU_TO_BE32(uint32_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint32_t DWC_LE32_TO_CPU(uint32_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint32_t DWC_BE32_TO_CPU(uint32_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint16_t DWC_CPU_TO_LE16(uint16_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+uint16_t DWC_CPU_TO_BE16(uint16_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+uint16_t DWC_LE16_TO_CPU(uint16_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+uint16_t DWC_BE16_TO_CPU(uint16_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+
+/* Registers */
+
+uint32_t DWC_READ_REG32(void *io_ctx, uint32_t volatile *reg)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	return bus_space_read_4(io->iot, io->ioh, ior);
+}
+
+#if 0
+uint64_t DWC_READ_REG64(void *io_ctx, uint64_t volatile *reg)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	return bus_space_read_8(io->iot, io->ioh, ior);
+}
+#endif
+
+void DWC_WRITE_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t value)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	bus_space_write_4(io->iot, io->ioh, ior, value);
+}
+
+#if 0
+void DWC_WRITE_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t value)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	bus_space_write_8(io->iot, io->ioh, ior, value);
+}
+#endif
+
+void DWC_MODIFY_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t clear_mask,
+		      uint32_t set_mask)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	bus_space_write_4(io->iot, io->ioh, ior,
+			  (bus_space_read_4(io->iot, io->ioh, ior) &
+			   ~clear_mask) | set_mask);
+}
+
+#if 0
+void DWC_MODIFY_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t clear_mask,
+		      uint64_t set_mask)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	bus_space_write_8(io->iot, io->ioh, ior,
+			  (bus_space_read_8(io->iot, io->ioh, ior) &
+			   ~clear_mask) | set_mask);
+}
+#endif
+
+
+/* Locking */
+
+dwc_spinlock_t *DWC_SPINLOCK_ALLOC(void)
+{
+	struct mtx *sl = DWC_ALLOC(sizeof(*sl));
+
+	if (!sl) {
+		DWC_ERROR("Cannot allocate memory for spinlock");
+		return NULL;
+	}
+
+	mtx_init(sl, "dw3spn", NULL, MTX_SPIN);
+	return (dwc_spinlock_t *)sl;
+}
+
+void DWC_SPINLOCK_FREE(dwc_spinlock_t *lock)
+{
+	struct mtx *sl = (struct mtx *)lock;
+
+	mtx_destroy(sl);
+	DWC_FREE(sl);
+}
+
+void DWC_SPINLOCK(dwc_spinlock_t *lock)
+{
+	mtx_lock_spin((struct mtx *)lock);	// ???
+}
+
+void DWC_SPINUNLOCK(dwc_spinlock_t *lock)
+{
+	mtx_unlock_spin((struct mtx *)lock);	// ???
+}
+
+void DWC_SPINLOCK_IRQSAVE(dwc_spinlock_t *lock, dwc_irqflags_t *flags)
+{
+	mtx_lock_spin((struct mtx *)lock);
+}
+
+void DWC_SPINUNLOCK_IRQRESTORE(dwc_spinlock_t *lock, dwc_irqflags_t flags)
+{
+	mtx_unlock_spin((struct mtx *)lock);
+}
+
+dwc_mutex_t *DWC_MUTEX_ALLOC(void)
+{
+	struct mtx *m;
+	dwc_mutex_t *mutex = (dwc_mutex_t *)DWC_ALLOC(sizeof(struct mtx));
+
+	if (!mutex) {
+		DWC_ERROR("Cannot allocate memory for mutex");
+		return NULL;
+	}
+
+	m = (struct mtx *)mutex;
+	mtx_init(m, "dw3mtx", NULL, MTX_DEF);
+	return mutex;
+}
+
+#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
+#else
+void DWC_MUTEX_FREE(dwc_mutex_t *mutex)
+{
+	mtx_destroy((struct mtx *)mutex);
+	DWC_FREE(mutex);
+}
+#endif
+
+void DWC_MUTEX_LOCK(dwc_mutex_t *mutex)
+{
+	struct mtx *m = (struct mtx *)mutex;
+
+	mtx_lock(m);
+}
+
+int DWC_MUTEX_TRYLOCK(dwc_mutex_t *mutex)
+{
+	struct mtx *m = (struct mtx *)mutex;
+
+	return mtx_trylock(m);
+}
+
+void DWC_MUTEX_UNLOCK(dwc_mutex_t *mutex)
+{
+	struct mtx *m = (struct mtx *)mutex;
+
+	mtx_unlock(m);
+}
+
+
+/* Timing */
+
+void DWC_UDELAY(uint32_t usecs)
+{
+	DELAY(usecs);
+}
+
+void DWC_MDELAY(uint32_t msecs)
+{
+	do {
+		DELAY(1000);
+	} while (--msecs);
+}
+
+void DWC_MSLEEP(uint32_t msecs)
+{
+	struct timeval tv;
+
+	tv.tv_sec = msecs / 1000;
+	tv.tv_usec = (msecs - tv.tv_sec * 1000) * 1000;
+	pause("dw3slp", tvtohz(&tv));
+}
+
+uint32_t DWC_TIME(void)
+{
+	struct timeval tv;
+
+	microuptime(&tv);	// or getmicrouptime? (less precise, but faster)
+	return tv.tv_sec * 1000 + tv.tv_usec / 1000;
+}
+
+
+/* Timers */
+
+struct dwc_timer {
+	struct callout t;
+	char *name;
+	dwc_spinlock_t *lock;
+	dwc_timer_callback_t cb;
+	void *data;
+};
+
+dwc_timer_t *DWC_TIMER_ALLOC(char *name, dwc_timer_callback_t cb, void *data)
+{
+	dwc_timer_t *t = DWC_ALLOC(sizeof(*t));
+
+	if (!t) {
+		DWC_ERROR("Cannot allocate memory for timer");
+		return NULL;
+	}
+
+	callout_init(&t->t, 1);
+
+	t->name = DWC_STRDUP(name);
+	if (!t->name) {
+		DWC_ERROR("Cannot allocate memory for timer->name");
+		goto no_name;
+	}
+
+	t->lock = DWC_SPINLOCK_ALLOC();
+	if (!t->lock) {
+		DWC_ERROR("Cannot allocate memory for lock");
+		goto no_lock;
+	}
+
+	t->cb = cb;
+	t->data = data;
+
+	return t;
+
+ no_lock:
+	DWC_FREE(t->name);
+ no_name:
+	DWC_FREE(t);
+
+	return NULL;
+}
+
+void DWC_TIMER_FREE(dwc_timer_t *timer)
+{
+	callout_stop(&timer->t);
+	DWC_SPINLOCK_FREE(timer->lock);
+	DWC_FREE(timer->name);
+	DWC_FREE(timer);
+}
+
+void DWC_TIMER_SCHEDULE(dwc_timer_t *timer, uint32_t time)
+{
+	struct timeval tv;
+
+	tv.tv_sec = time / 1000;
+	tv.tv_usec = (time - tv.tv_sec * 1000) * 1000;
+	callout_reset(&timer->t, tvtohz(&tv), timer->cb, timer->data);
+}
+
+void DWC_TIMER_CANCEL(dwc_timer_t *timer)
+{
+	callout_stop(&timer->t);
+}
+
+
+/* Wait Queues */
+
+struct dwc_waitq {
+	struct mtx lock;
+	int abort;
+};
+
+dwc_waitq_t *DWC_WAITQ_ALLOC(void)
+{
+	dwc_waitq_t *wq = DWC_ALLOC(sizeof(*wq));
+
+	if (!wq) {
+		DWC_ERROR("Cannot allocate memory for waitqueue");
+		return NULL;
+	}
+
+	mtx_init(&wq->lock, "dw3wtq", NULL, MTX_DEF);
+	wq->abort = 0;
+
+	return wq;
+}
+
+void DWC_WAITQ_FREE(dwc_waitq_t *wq)
+{
+	mtx_destroy(&wq->lock);
+	DWC_FREE(wq);
+}
+
+int32_t DWC_WAITQ_WAIT(dwc_waitq_t *wq, dwc_waitq_condition_t cond, void *data)
+{
+//	intrmask_t ipl;
+	int result = 0;
+
+	mtx_lock(&wq->lock);
+//	ipl = splbio();
+
+	/* Skip the sleep if already aborted or triggered */
+	if (!wq->abort && !cond(data)) {
+//		splx(ipl);
+		result = msleep(wq, &wq->lock, PCATCH, "dw3wat", 0); // infinite timeout
+//		ipl = splbio();
+	}
+
+	if (result == ERESTART) {	// signaled - restart
+		result = -DWC_E_RESTART;
+
+	} else if (result == EINTR) {	// signaled - interrupt
+		result = -DWC_E_ABORT;
+
+	} else if (wq->abort) {
+		result = -DWC_E_ABORT;
+
+	} else {
+		result = 0;
+	}
+
+	wq->abort = 0;
+//	splx(ipl);
+	mtx_unlock(&wq->lock);
+	return result;
+}
+
+int32_t DWC_WAITQ_WAIT_TIMEOUT(dwc_waitq_t *wq, dwc_waitq_condition_t cond,
+			       void *data, int32_t msecs)
+{
+	struct timeval tv, tv1, tv2;
+//	intrmask_t ipl;
+	int result = 0;
+
+	tv.tv_sec = msecs / 1000;
+	tv.tv_usec = (msecs - tv.tv_sec * 1000) * 1000;
+
+	mtx_lock(&wq->lock);
+//	ipl = splbio();
+
+	/* Skip the sleep if already aborted or triggered */
+	if (!wq->abort && !cond(data)) {
+//		splx(ipl);
+		getmicrouptime(&tv1);
+		result = msleep(wq, &wq->lock, PCATCH, "dw3wto", tvtohz(&tv));
+		getmicrouptime(&tv2);
+//		ipl = splbio();
+	}
+
+	if (result == 0) {			// awoken
+		if (wq->abort) {
+			result = -DWC_E_ABORT;
+		} else {
+			tv2.tv_usec -= tv1.tv_usec;
+			if (tv2.tv_usec < 0) {
+				tv2.tv_usec += 1000000;
+				tv2.tv_sec--;
+			}
+
+			tv2.tv_sec -= tv1.tv_sec;
+			result = tv2.tv_sec * 1000 + tv2.tv_usec / 1000;
+			result = msecs - result;
+			if (result <= 0)
+				result = 1;
+		}
+	} else if (result == ERESTART) {	// signaled - restart
+		result = -DWC_E_RESTART;
+
+	} else if (result == EINTR) {		// signaled - interrupt
+		result = -DWC_E_ABORT;
+
+	} else {				// timed out
+		result = -DWC_E_TIMEOUT;
+	}
+
+	wq->abort = 0;
+//	splx(ipl);
+	mtx_unlock(&wq->lock);
+	return result;
+}
+
+void DWC_WAITQ_TRIGGER(dwc_waitq_t *wq)
+{
+	wakeup(wq);
+}
+
+void DWC_WAITQ_ABORT(dwc_waitq_t *wq)
+{
+//	intrmask_t ipl;
+
+	mtx_lock(&wq->lock);
+//	ipl = splbio();
+	wq->abort = 1;
+	wakeup(wq);
+//	splx(ipl);
+	mtx_unlock(&wq->lock);
+}
+
+
+/* Threading */
+
+struct dwc_thread {
+	struct proc *proc;
+	int abort;
+};
+
+dwc_thread_t *DWC_THREAD_RUN(dwc_thread_function_t func, char *name, void *data)
+{
+	int retval;
+	dwc_thread_t *thread = DWC_ALLOC(sizeof(*thread));
+
+	if (!thread) {
+		return NULL;
+	}
+
+	thread->abort = 0;
+	retval = kthread_create((void (*)(void *))func, data, &thread->proc,
+				RFPROC | RFNOWAIT, 0, "%s", name);
+	if (retval) {
+		DWC_FREE(thread);
+		return NULL;
+	}
+
+	return thread;
+}
+
+int DWC_THREAD_STOP(dwc_thread_t *thread)
+{
+	int retval;
+
+	thread->abort = 1;
+	retval = tsleep(&thread->abort, 0, "dw3stp", 60 * hz);
+
+	if (retval == 0) {
+		/* DWC_THREAD_EXIT() will free the thread struct */
+		return 0;
+	}
+
+	/* NOTE: We leak the thread struct if thread doesn't die */
+
+	if (retval == EWOULDBLOCK) {
+		return -DWC_E_TIMEOUT;
+	}
+
+	return -DWC_E_UNKNOWN;
+}
+
+dwc_bool_t DWC_THREAD_SHOULD_STOP(dwc_thread_t *thread)
+{
+	return thread->abort;
+}
+
+void DWC_THREAD_EXIT(dwc_thread_t *thread)
+{
+	wakeup(&thread->abort);
+	DWC_FREE(thread);
+	kthread_exit(0);
+}
+
+
+/* tasklets
+ - Runs in interrupt context (cannot sleep)
+ - Each tasklet runs on a single CPU [ How can we ensure this on FreeBSD? Does it matter? ]
+ - Different tasklets can be running simultaneously on different CPUs [ shouldn't matter ]
+ */
+struct dwc_tasklet {
+	struct task t;
+	dwc_tasklet_callback_t cb;
+	void *data;
+};
+
+static void tasklet_callback(void *data, int pending)	// what to do with pending ???
+{
+	dwc_tasklet_t *task = (dwc_tasklet_t *)data;
+
+	task->cb(task->data);
+}
+
+dwc_tasklet_t *DWC_TASK_ALLOC(char *name, dwc_tasklet_callback_t cb, void *data)
+{
+	dwc_tasklet_t *task = DWC_ALLOC(sizeof(*task));
+
+	if (task) {
+		task->cb = cb;
+		task->data = data;
+		TASK_INIT(&task->t, 0, tasklet_callback, task);
+	} else {
+		DWC_ERROR("Cannot allocate memory for tasklet");
+	}
+
+	return task;
+}
+
+void DWC_TASK_FREE(dwc_tasklet_t *task)
+{
+	taskqueue_drain(taskqueue_fast, &task->t);	// ???
+	DWC_FREE(task);
+}
+
+void DWC_TASK_SCHEDULE(dwc_tasklet_t *task)
+{
+	/* Uses predefined system queue */
+	taskqueue_enqueue_fast(taskqueue_fast, &task->t);
+}
+
+
+/* workqueues
+ - Runs in process context (can sleep)
+ */
+typedef struct work_container {
+	dwc_work_callback_t cb;
+	void *data;
+	dwc_workq_t *wq;
+	char *name;
+	int hz;
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_ENTRY(work_container) entry;
+#endif
+	struct task task;
+} work_container_t;
+
+#ifdef DEBUG
+DWC_CIRCLEQ_HEAD(work_container_queue, work_container);
+#endif
+
+struct dwc_workq {
+	struct taskqueue *taskq;
+	dwc_spinlock_t *lock;
+	dwc_waitq_t *waitq;
+	int pending;
+
+#ifdef DEBUG
+	struct work_container_queue entries;
+#endif
+};
+
+static void do_work(void *data, int pending)	// what to do with pending ???
+{
+	work_container_t *container = (work_container_t *)data;
+	dwc_workq_t *wq = container->wq;
+	dwc_irqflags_t flags;
+
+	if (container->hz) {
+		pause("dw3wrk", container->hz);
+	}
+
+	container->cb(container->data);
+	DWC_DEBUG("Work done: %s, container=%p", container->name, container);
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_REMOVE(&wq->entries, container, entry);
+#endif
+	if (container->name)
+		DWC_FREE(container->name);
+	DWC_FREE(container);
+	wq->pending--;
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+	DWC_WAITQ_TRIGGER(wq->waitq);
+}
+
+static int work_done(void *data)
+{
+	dwc_workq_t *workq = (dwc_workq_t *)data;
+
+	return workq->pending == 0;
+}
+
+int DWC_WORKQ_WAIT_WORK_DONE(dwc_workq_t *workq, int timeout)
+{
+	return DWC_WAITQ_WAIT_TIMEOUT(workq->waitq, work_done, workq, timeout);
+}
+
+dwc_workq_t *DWC_WORKQ_ALLOC(char *name)
+{
+	dwc_workq_t *wq = DWC_ALLOC(sizeof(*wq));
+
+	if (!wq) {
+		DWC_ERROR("Cannot allocate memory for workqueue");
+		return NULL;
+	}
+
+	wq->taskq = taskqueue_create(name, M_NOWAIT, taskqueue_thread_enqueue, &wq->taskq);
+	if (!wq->taskq) {
+		DWC_ERROR("Cannot allocate memory for taskqueue");
+		goto no_taskq;
+	}
+
+	wq->pending = 0;
+
+	wq->lock = DWC_SPINLOCK_ALLOC();
+	if (!wq->lock) {
+		DWC_ERROR("Cannot allocate memory for spinlock");
+		goto no_lock;
+	}
+
+	wq->waitq = DWC_WAITQ_ALLOC();
+	if (!wq->waitq) {
+		DWC_ERROR("Cannot allocate memory for waitqueue");
+		goto no_waitq;
+	}
+
+	taskqueue_start_threads(&wq->taskq, 1, PWAIT, "%s taskq", "dw3tsk");
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_INIT(&wq->entries);
+#endif
+	return wq;
+
+ no_waitq:
+	DWC_SPINLOCK_FREE(wq->lock);
+ no_lock:
+	taskqueue_free(wq->taskq);
+ no_taskq:
+	DWC_FREE(wq);
+
+	return NULL;
+}
+
+void DWC_WORKQ_FREE(dwc_workq_t *wq)
+{
+#ifdef DEBUG
+	dwc_irqflags_t flags;
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+
+	if (wq->pending != 0) {
+		struct work_container *container;
+
+		DWC_ERROR("Destroying work queue with pending work");
+
+		DWC_CIRCLEQ_FOREACH(container, &wq->entries, entry) {
+			DWC_ERROR("Work %s still pending", container->name);
+		}
+	}
+
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+#endif
+	DWC_WAITQ_FREE(wq->waitq);
+	DWC_SPINLOCK_FREE(wq->lock);
+	taskqueue_free(wq->taskq);
+	DWC_FREE(wq);
+}
+
+void DWC_WORKQ_SCHEDULE(dwc_workq_t *wq, dwc_work_callback_t cb, void *data,
+			char *format, ...)
+{
+	dwc_irqflags_t flags;
+	work_container_t *container;
+	static char name[128];
+	va_list args;
+
+	va_start(args, format);
+	DWC_VSNPRINTF(name, 128, format, args);
+	va_end(args);
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+	wq->pending++;
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+	DWC_WAITQ_TRIGGER(wq->waitq);
+
+	container = DWC_ALLOC_ATOMIC(sizeof(*container));
+	if (!container) {
+		DWC_ERROR("Cannot allocate memory for container");
+		return;
+	}
+
+	container->name = DWC_STRDUP(name);
+	if (!container->name) {
+		DWC_ERROR("Cannot allocate memory for container->name");
+		DWC_FREE(container);
+		return;
+	}
+
+	container->cb = cb;
+	container->data = data;
+	container->wq = wq;
+	container->hz = 0;
+
+	DWC_DEBUG("Queueing work: %s, container=%p", container->name, container);
+
+	TASK_INIT(&container->task, 0, do_work, container);
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_INSERT_TAIL(&wq->entries, container, entry);
+#endif
+	taskqueue_enqueue_fast(wq->taskq, &container->task);
+}
+
+void DWC_WORKQ_SCHEDULE_DELAYED(dwc_workq_t *wq, dwc_work_callback_t cb,
+				void *data, uint32_t time, char *format, ...)
+{
+	dwc_irqflags_t flags;
+	work_container_t *container;
+	static char name[128];
+	struct timeval tv;
+	va_list args;
+
+	va_start(args, format);
+	DWC_VSNPRINTF(name, 128, format, args);
+	va_end(args);
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+	wq->pending++;
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+	DWC_WAITQ_TRIGGER(wq->waitq);
+
+	container = DWC_ALLOC_ATOMIC(sizeof(*container));
+	if (!container) {
+		DWC_ERROR("Cannot allocate memory for container");
+		return;
+	}
+
+	container->name = DWC_STRDUP(name);
+	if (!container->name) {
+		DWC_ERROR("Cannot allocate memory for container->name");
+		DWC_FREE(container);
+		return;
+	}
+
+	container->cb = cb;
+	container->data = data;
+	container->wq = wq;
+
+	tv.tv_sec = time / 1000;
+	tv.tv_usec = (time - tv.tv_sec * 1000) * 1000;
+	container->hz = tvtohz(&tv);
+
+	DWC_DEBUG("Queueing work: %s, container=%p", container->name, container);
+
+	TASK_INIT(&container->task, 0, do_work, container);
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_INSERT_TAIL(&wq->entries, container, entry);
+#endif
+	taskqueue_enqueue_fast(wq->taskq, &container->task);
+}
+
+int DWC_WORKQ_PENDING(dwc_workq_t *wq)
+{
+	return wq->pending;
+}
diff --git a/drivers/usb/host/dwc_common_port/dwc_common_linux.c b/drivers/usb/host/dwc_common_port/dwc_common_linux.c
new file mode 100644
index 000000000000..0d641e6da24b
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_common_linux.c
@@ -0,0 +1,1418 @@
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/kthread.h>
+
+#ifdef DWC_CCLIB
+# include "dwc_cc.h"
+#endif
+
+#ifdef DWC_CRYPTOLIB
+# include "dwc_modpow.h"
+# include "dwc_dh.h"
+# include "dwc_crypto.h"
+#endif
+
+#ifdef DWC_NOTIFYLIB
+# include "dwc_notifier.h"
+#endif
+
+/* OS-Level Implementations */
+
+/* This is the Linux kernel implementation of the DWC platform library. */
+#include <linux/moduleparam.h>
+#include <linux/ctype.h>
+#include <linux/crypto.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/dma-mapping.h>
+#include <linux/cdev.h>
+#include <linux/errno.h>
+#include <linux/interrupt.h>
+#include <linux/jiffies.h>
+#include <linux/list.h>
+#include <linux/pci.h>
+#include <linux/random.h>
+#include <linux/scatterlist.h>
+#include <linux/slab.h>
+#include <linux/stat.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/usb.h>
+
+#include <linux/version.h>
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24)
+# include <linux/usb/gadget.h>
+#else
+# include <linux/usb_gadget.h>
+#endif
+
+#include <asm/io.h>
+#include <asm/page.h>
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+
+#include "dwc_os.h"
+#include "dwc_list.h"
+
+
+/* MISC */
+
+void *DWC_MEMSET(void *dest, uint8_t byte, uint32_t size)
+{
+	return memset(dest, byte, size);
+}
+
+void *DWC_MEMCPY(void *dest, void const *src, uint32_t size)
+{
+	return memcpy(dest, src, size);
+}
+
+void *DWC_MEMMOVE(void *dest, void *src, uint32_t size)
+{
+	return memmove(dest, src, size);
+}
+
+int DWC_MEMCMP(void *m1, void *m2, uint32_t size)
+{
+	return memcmp(m1, m2, size);
+}
+
+int DWC_STRNCMP(void *s1, void *s2, uint32_t size)
+{
+	return strncmp(s1, s2, size);
+}
+
+int DWC_STRCMP(void *s1, void *s2)
+{
+	return strcmp(s1, s2);
+}
+
+int DWC_STRLEN(char const *str)
+{
+	return strlen(str);
+}
+
+char *DWC_STRCPY(char *to, char const *from)
+{
+	return strcpy(to, from);
+}
+
+char *DWC_STRDUP(char const *str)
+{
+	int len = DWC_STRLEN(str) + 1;
+	char *new = DWC_ALLOC_ATOMIC(len);
+
+	if (!new) {
+		return NULL;
+	}
+
+	DWC_MEMCPY(new, str, len);
+	return new;
+}
+
+int DWC_ATOI(const char *str, int32_t *value)
+{
+	char *end = NULL;
+
+	*value = simple_strtol(str, &end, 0);
+	if (*end == '\0') {
+		return 0;
+	}
+
+	return -1;
+}
+
+int DWC_ATOUI(const char *str, uint32_t *value)
+{
+	char *end = NULL;
+
+	*value = simple_strtoul(str, &end, 0);
+	if (*end == '\0') {
+		return 0;
+	}
+
+	return -1;
+}
+
+
+#ifdef DWC_UTFLIB
+/* From usbstring.c */
+
+int DWC_UTF8_TO_UTF16LE(uint8_t const *s, uint16_t *cp, unsigned len)
+{
+	int	count = 0;
+	u8	c;
+	u16	uchar;
+
+	/* this insists on correct encodings, though not minimal ones.
+	 * BUT it currently rejects legit 4-byte UTF-8 code points,
+	 * which need surrogate pairs.  (Unicode 3.1 can use them.)
+	 */
+	while (len != 0 && (c = (u8) *s++) != 0) {
+		if (unlikely(c & 0x80)) {
+			// 2-byte sequence:
+			// 00000yyyyyxxxxxx = 110yyyyy 10xxxxxx
+			if ((c & 0xe0) == 0xc0) {
+				uchar = (c & 0x1f) << 6;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c;
+
+			// 3-byte sequence (most CJKV characters):
+			// zzzzyyyyyyxxxxxx = 1110zzzz 10yyyyyy 10xxxxxx
+			} else if ((c & 0xf0) == 0xe0) {
+				uchar = (c & 0x0f) << 12;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c << 6;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c;
+
+				/* no bogus surrogates */
+				if (0xd800 <= uchar && uchar <= 0xdfff)
+					goto fail;
+
+			// 4-byte sequence (surrogate pairs, currently rare):
+			// 11101110wwwwzzzzyy + 110111yyyyxxxxxx
+			//     = 11110uuu 10uuzzzz 10yyyyyy 10xxxxxx
+			// (uuuuu = wwww + 1)
+			// FIXME accept the surrogate code points (only)
+			} else
+				goto fail;
+		} else
+			uchar = c;
+		put_unaligned (cpu_to_le16 (uchar), cp++);
+		count++;
+		len--;
+	}
+	return count;
+fail:
+	return -1;
+}
+#endif	/* DWC_UTFLIB */
+
+
+/* dwc_debug.h */
+
+dwc_bool_t DWC_IN_IRQ(void)
+{
+	return in_irq();
+}
+
+dwc_bool_t DWC_IN_BH(void)
+{
+	return in_softirq();
+}
+
+void DWC_VPRINTF(char *format, va_list args)
+{
+	vprintk(format, args);
+}
+
+int DWC_VSNPRINTF(char *str, int size, char *format, va_list args)
+{
+	return vsnprintf(str, size, format, args);
+}
+
+void DWC_PRINTF(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+
+int DWC_SPRINTF(char *buffer, char *format, ...)
+{
+	int retval;
+	va_list args;
+
+	va_start(args, format);
+	retval = vsprintf(buffer, format, args);
+	va_end(args);
+	return retval;
+}
+
+int DWC_SNPRINTF(char *buffer, int size, char *format, ...)
+{
+	int retval;
+	va_list args;
+
+	va_start(args, format);
+	retval = vsnprintf(buffer, size, format, args);
+	va_end(args);
+	return retval;
+}
+
+void __DWC_WARN(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_PRINTF(KERN_WARNING);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+
+void __DWC_ERROR(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_PRINTF(KERN_ERR);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+
+void DWC_EXCEPTION(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_PRINTF(KERN_ERR);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+	BUG_ON(1);
+}
+
+#ifdef DEBUG
+void __DWC_DEBUG(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_PRINTF(KERN_DEBUG);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+#endif
+
+
+/* dwc_mem.h */
+
+#if 0
+dwc_pool_t *DWC_DMA_POOL_CREATE(uint32_t size,
+				uint32_t align,
+				uint32_t alloc)
+{
+	struct dma_pool *pool = dma_pool_create("Pool", NULL,
+						size, align, alloc);
+	return (dwc_pool_t *)pool;
+}
+
+void DWC_DMA_POOL_DESTROY(dwc_pool_t *pool)
+{
+	dma_pool_destroy((struct dma_pool *)pool);
+}
+
+void *DWC_DMA_POOL_ALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
+{
+	return dma_pool_alloc((struct dma_pool *)pool, GFP_KERNEL, dma_addr);
+}
+
+void *DWC_DMA_POOL_ZALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
+{
+	void *vaddr = DWC_DMA_POOL_ALLOC(pool, dma_addr);
+	memset(..);
+}
+
+void DWC_DMA_POOL_FREE(dwc_pool_t *pool, void *vaddr, void *daddr)
+{
+	dma_pool_free(pool, vaddr, daddr);
+}
+#endif
+
+void *__DWC_DMA_ALLOC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr)
+{
+	return dma_zalloc_coherent(dma_ctx, size, dma_addr, GFP_KERNEL | GFP_DMA32);
+}
+
+void *__DWC_DMA_ALLOC_ATOMIC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr)
+{
+	return dma_zalloc_coherent(dma_ctx, size, dma_addr, GFP_ATOMIC);
+}
+
+void __DWC_DMA_FREE(void *dma_ctx, uint32_t size, void *virt_addr, dwc_dma_t dma_addr)
+{
+	dma_free_coherent(dma_ctx, size, virt_addr, dma_addr);
+}
+
+void *__DWC_ALLOC(void *mem_ctx, uint32_t size)
+{
+	return kzalloc(size, GFP_KERNEL);
+}
+
+void *__DWC_ALLOC_ATOMIC(void *mem_ctx, uint32_t size)
+{
+	return kzalloc(size, GFP_ATOMIC);
+}
+
+void __DWC_FREE(void *mem_ctx, void *addr)
+{
+	kfree(addr);
+}
+
+
+#ifdef DWC_CRYPTOLIB
+/* dwc_crypto.h */
+
+void DWC_RANDOM_BYTES(uint8_t *buffer, uint32_t length)
+{
+	get_random_bytes(buffer, length);
+}
+
+int DWC_AES_CBC(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t iv[16], uint8_t *out)
+{
+	struct crypto_blkcipher *tfm;
+	struct blkcipher_desc desc;
+	struct scatterlist sgd;
+	struct scatterlist sgs;
+
+	tfm = crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
+	if (tfm == NULL) {
+		printk("failed to load transform for aes CBC\n");
+		return -1;
+	}
+
+	crypto_blkcipher_setkey(tfm, key, keylen);
+	crypto_blkcipher_set_iv(tfm, iv, 16);
+
+	sg_init_one(&sgd, out, messagelen);
+	sg_init_one(&sgs, message, messagelen);
+
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	if (crypto_blkcipher_encrypt(&desc, &sgd, &sgs, messagelen)) {
+		crypto_free_blkcipher(tfm);
+		DWC_ERROR("AES CBC encryption failed");
+		return -1;
+	}
+
+	crypto_free_blkcipher(tfm);
+	return 0;
+}
+
+int DWC_SHA256(uint8_t *message, uint32_t len, uint8_t *out)
+{
+	struct crypto_hash *tfm;
+	struct hash_desc desc;
+	struct scatterlist sg;
+
+	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(tfm)) {
+		DWC_ERROR("Failed to load transform for sha256: %ld\n", PTR_ERR(tfm));
+		return 0;
+	}
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	sg_init_one(&sg, message, len);
+	crypto_hash_digest(&desc, &sg, len, out);
+	crypto_free_hash(tfm);
+
+	return 1;
+}
+
+int DWC_HMAC_SHA256(uint8_t *message, uint32_t messagelen,
+		    uint8_t *key, uint32_t keylen, uint8_t *out)
+{
+	struct crypto_hash *tfm;
+	struct hash_desc desc;
+	struct scatterlist sg;
+
+	tfm = crypto_alloc_hash("hmac(sha256)", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(tfm)) {
+		DWC_ERROR("Failed to load transform for hmac(sha256): %ld\n", PTR_ERR(tfm));
+		return 0;
+	}
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	sg_init_one(&sg, message, messagelen);
+	crypto_hash_setkey(tfm, key, keylen);
+	crypto_hash_digest(&desc, &sg, messagelen, out);
+	crypto_free_hash(tfm);
+
+	return 1;
+}
+#endif	/* DWC_CRYPTOLIB */
+
+
+/* Byte Ordering Conversions */
+
+uint32_t DWC_CPU_TO_LE32(uint32_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint32_t DWC_CPU_TO_BE32(uint32_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint32_t DWC_LE32_TO_CPU(uint32_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint32_t DWC_BE32_TO_CPU(uint32_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint16_t DWC_CPU_TO_LE16(uint16_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+uint16_t DWC_CPU_TO_BE16(uint16_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+uint16_t DWC_LE16_TO_CPU(uint16_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+uint16_t DWC_BE16_TO_CPU(uint16_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+
+/* Registers */
+
+uint32_t DWC_READ_REG32(uint32_t volatile *reg)
+{
+	return readl(reg);
+}
+
+#if 0
+uint64_t DWC_READ_REG64(uint64_t volatile *reg)
+{
+}
+#endif
+
+void DWC_WRITE_REG32(uint32_t volatile *reg, uint32_t value)
+{
+	writel(value, reg);
+}
+
+#if 0
+void DWC_WRITE_REG64(uint64_t volatile *reg, uint64_t value)
+{
+}
+#endif
+
+void DWC_MODIFY_REG32(uint32_t volatile *reg, uint32_t clear_mask, uint32_t set_mask)
+{
+	writel((readl(reg) & ~clear_mask) | set_mask, reg);
+}
+
+#if 0
+void DWC_MODIFY_REG64(uint64_t volatile *reg, uint64_t clear_mask, uint64_t set_mask)
+{
+}
+#endif
+
+
+/* Locking */
+
+dwc_spinlock_t *DWC_SPINLOCK_ALLOC(void)
+{
+	spinlock_t *sl = (spinlock_t *)1;
+
+#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
+	sl = DWC_ALLOC(sizeof(*sl));
+	if (!sl) {
+		DWC_ERROR("Cannot allocate memory for spinlock\n");
+		return NULL;
+	}
+
+	spin_lock_init(sl);
+#endif
+	return (dwc_spinlock_t *)sl;
+}
+
+void DWC_SPINLOCK_FREE(dwc_spinlock_t *lock)
+{
+#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
+	DWC_FREE(lock);
+#endif
+}
+
+void DWC_SPINLOCK(dwc_spinlock_t *lock)
+{
+#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
+	spin_lock((spinlock_t *)lock);
+#endif
+}
+
+void DWC_SPINUNLOCK(dwc_spinlock_t *lock)
+{
+#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
+	spin_unlock((spinlock_t *)lock);
+#endif
+}
+
+void DWC_SPINLOCK_IRQSAVE(dwc_spinlock_t *lock, dwc_irqflags_t *flags)
+{
+	dwc_irqflags_t f;
+
+#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
+	spin_lock_irqsave((spinlock_t *)lock, f);
+#else
+	local_irq_save(f);
+#endif
+	*flags = f;
+}
+
+void DWC_SPINUNLOCK_IRQRESTORE(dwc_spinlock_t *lock, dwc_irqflags_t flags)
+{
+#if defined(CONFIG_PREEMPT) || defined(CONFIG_SMP)
+	spin_unlock_irqrestore((spinlock_t *)lock, flags);
+#else
+	local_irq_restore(flags);
+#endif
+}
+
+dwc_mutex_t *DWC_MUTEX_ALLOC(void)
+{
+	struct mutex *m;
+	dwc_mutex_t *mutex = (dwc_mutex_t *)DWC_ALLOC(sizeof(struct mutex));
+
+	if (!mutex) {
+		DWC_ERROR("Cannot allocate memory for mutex\n");
+		return NULL;
+	}
+
+	m = (struct mutex *)mutex;
+	mutex_init(m);
+	return mutex;
+}
+
+#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
+#else
+void DWC_MUTEX_FREE(dwc_mutex_t *mutex)
+{
+	mutex_destroy((struct mutex *)mutex);
+	DWC_FREE(mutex);
+}
+#endif
+
+void DWC_MUTEX_LOCK(dwc_mutex_t *mutex)
+{
+	struct mutex *m = (struct mutex *)mutex;
+	mutex_lock(m);
+}
+
+int DWC_MUTEX_TRYLOCK(dwc_mutex_t *mutex)
+{
+	struct mutex *m = (struct mutex *)mutex;
+	return mutex_trylock(m);
+}
+
+void DWC_MUTEX_UNLOCK(dwc_mutex_t *mutex)
+{
+	struct mutex *m = (struct mutex *)mutex;
+	mutex_unlock(m);
+}
+
+
+/* Timing */
+
+void DWC_UDELAY(uint32_t usecs)
+{
+	udelay(usecs);
+}
+
+void DWC_MDELAY(uint32_t msecs)
+{
+	mdelay(msecs);
+}
+
+void DWC_MSLEEP(uint32_t msecs)
+{
+	msleep(msecs);
+}
+
+uint32_t DWC_TIME(void)
+{
+	return jiffies_to_msecs(jiffies);
+}
+
+
+/* Timers */
+
+struct dwc_timer {
+	struct timer_list *t;
+	char *name;
+	dwc_timer_callback_t cb;
+	void *data;
+	uint8_t scheduled;
+	dwc_spinlock_t *lock;
+};
+
+static void timer_callback(unsigned long data)
+{
+	dwc_timer_t *timer = (dwc_timer_t *)data;
+	dwc_irqflags_t flags;
+
+	DWC_SPINLOCK_IRQSAVE(timer->lock, &flags);
+	timer->scheduled = 0;
+	DWC_SPINUNLOCK_IRQRESTORE(timer->lock, flags);
+	DWC_DEBUGC("Timer %s callback", timer->name);
+	timer->cb(timer->data);
+}
+
+dwc_timer_t *DWC_TIMER_ALLOC(char *name, dwc_timer_callback_t cb, void *data)
+{
+	dwc_timer_t *t = DWC_ALLOC(sizeof(*t));
+
+	if (!t) {
+		DWC_ERROR("Cannot allocate memory for timer");
+		return NULL;
+	}
+
+	t->t = DWC_ALLOC(sizeof(*t->t));
+	if (!t->t) {
+		DWC_ERROR("Cannot allocate memory for timer->t");
+		goto no_timer;
+	}
+
+	t->name = DWC_STRDUP(name);
+	if (!t->name) {
+		DWC_ERROR("Cannot allocate memory for timer->name");
+		goto no_name;
+	}
+
+#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK))
+	DWC_SPINLOCK_ALLOC_LINUX_DEBUG(t->lock);
+#else
+	t->lock = DWC_SPINLOCK_ALLOC();
+#endif
+	if (!t->lock) {
+		DWC_ERROR("Cannot allocate memory for lock");
+		goto no_lock;
+	}
+
+	t->scheduled = 0;
+	t->t->expires = jiffies;
+	setup_timer(t->t, timer_callback, (unsigned long)t);
+
+	t->cb = cb;
+	t->data = data;
+
+	return t;
+
+ no_lock:
+	DWC_FREE(t->name);
+ no_name:
+	DWC_FREE(t->t);
+ no_timer:
+	DWC_FREE(t);
+	return NULL;
+}
+
+void DWC_TIMER_FREE(dwc_timer_t *timer)
+{
+	dwc_irqflags_t flags;
+
+	DWC_SPINLOCK_IRQSAVE(timer->lock, &flags);
+
+	if (timer->scheduled) {
+		del_timer(timer->t);
+		timer->scheduled = 0;
+	}
+
+	DWC_SPINUNLOCK_IRQRESTORE(timer->lock, flags);
+	DWC_SPINLOCK_FREE(timer->lock);
+	DWC_FREE(timer->t);
+	DWC_FREE(timer->name);
+	DWC_FREE(timer);
+}
+
+void DWC_TIMER_SCHEDULE(dwc_timer_t *timer, uint32_t time)
+{
+	dwc_irqflags_t flags;
+
+	DWC_SPINLOCK_IRQSAVE(timer->lock, &flags);
+
+	if (!timer->scheduled) {
+		timer->scheduled = 1;
+		DWC_DEBUGC("Scheduling timer %s to expire in +%d msec", timer->name, time);
+		timer->t->expires = jiffies + msecs_to_jiffies(time);
+		add_timer(timer->t);
+	} else {
+		DWC_DEBUGC("Modifying timer %s to expire in +%d msec", timer->name, time);
+		mod_timer(timer->t, jiffies + msecs_to_jiffies(time));
+	}
+
+	DWC_SPINUNLOCK_IRQRESTORE(timer->lock, flags);
+}
+
+void DWC_TIMER_CANCEL(dwc_timer_t *timer)
+{
+	del_timer(timer->t);
+}
+
+
+/* Wait Queues */
+
+struct dwc_waitq {
+	wait_queue_head_t queue;
+	int abort;
+};
+
+dwc_waitq_t *DWC_WAITQ_ALLOC(void)
+{
+	dwc_waitq_t *wq = DWC_ALLOC(sizeof(*wq));
+
+	if (!wq) {
+		DWC_ERROR("Cannot allocate memory for waitqueue\n");
+		return NULL;
+	}
+
+	init_waitqueue_head(&wq->queue);
+	wq->abort = 0;
+	return wq;
+}
+
+void DWC_WAITQ_FREE(dwc_waitq_t *wq)
+{
+	DWC_FREE(wq);
+}
+
+int32_t DWC_WAITQ_WAIT(dwc_waitq_t *wq, dwc_waitq_condition_t cond, void *data)
+{
+	int result = wait_event_interruptible(wq->queue,
+					      cond(data) || wq->abort);
+	if (result == -ERESTARTSYS) {
+		wq->abort = 0;
+		return -DWC_E_RESTART;
+	}
+
+	if (wq->abort == 1) {
+		wq->abort = 0;
+		return -DWC_E_ABORT;
+	}
+
+	wq->abort = 0;
+
+	if (result == 0) {
+		return 0;
+	}
+
+	return -DWC_E_UNKNOWN;
+}
+
+int32_t DWC_WAITQ_WAIT_TIMEOUT(dwc_waitq_t *wq, dwc_waitq_condition_t cond,
+			       void *data, int32_t msecs)
+{
+	int32_t tmsecs;
+	int result = wait_event_interruptible_timeout(wq->queue,
+						      cond(data) || wq->abort,
+						      msecs_to_jiffies(msecs));
+	if (result == -ERESTARTSYS) {
+		wq->abort = 0;
+		return -DWC_E_RESTART;
+	}
+
+	if (wq->abort == 1) {
+		wq->abort = 0;
+		return -DWC_E_ABORT;
+	}
+
+	wq->abort = 0;
+
+	if (result > 0) {
+		tmsecs = jiffies_to_msecs(result);
+		if (!tmsecs) {
+			return 1;
+		}
+
+		return tmsecs;
+	}
+
+	if (result == 0) {
+		return -DWC_E_TIMEOUT;
+	}
+
+	return -DWC_E_UNKNOWN;
+}
+
+void DWC_WAITQ_TRIGGER(dwc_waitq_t *wq)
+{
+	wq->abort = 0;
+	wake_up_interruptible(&wq->queue);
+}
+
+void DWC_WAITQ_ABORT(dwc_waitq_t *wq)
+{
+	wq->abort = 1;
+	wake_up_interruptible(&wq->queue);
+}
+
+
+/* Threading */
+
+dwc_thread_t *DWC_THREAD_RUN(dwc_thread_function_t func, char *name, void *data)
+{
+	struct task_struct *thread = kthread_run(func, data, name);
+
+	if (thread == ERR_PTR(-ENOMEM)) {
+		return NULL;
+	}
+
+	return (dwc_thread_t *)thread;
+}
+
+int DWC_THREAD_STOP(dwc_thread_t *thread)
+{
+	return kthread_stop((struct task_struct *)thread);
+}
+
+dwc_bool_t DWC_THREAD_SHOULD_STOP(void)
+{
+	return kthread_should_stop();
+}
+
+
+/* tasklets
+ - run in interrupt context (cannot sleep)
+ - each tasklet runs on a single CPU
+ - different tasklets can be running simultaneously on different CPUs
+ */
+struct dwc_tasklet {
+	struct tasklet_struct t;
+	dwc_tasklet_callback_t cb;
+	void *data;
+};
+
+static void tasklet_callback(unsigned long data)
+{
+	dwc_tasklet_t *t = (dwc_tasklet_t *)data;
+	t->cb(t->data);
+}
+
+dwc_tasklet_t *DWC_TASK_ALLOC(char *name, dwc_tasklet_callback_t cb, void *data)
+{
+	dwc_tasklet_t *t = DWC_ALLOC(sizeof(*t));
+
+	if (t) {
+		t->cb = cb;
+		t->data = data;
+		tasklet_init(&t->t, tasklet_callback, (unsigned long)t);
+	} else {
+		DWC_ERROR("Cannot allocate memory for tasklet\n");
+	}
+
+	return t;
+}
+
+void DWC_TASK_FREE(dwc_tasklet_t *task)
+{
+	DWC_FREE(task);
+}
+
+void DWC_TASK_SCHEDULE(dwc_tasklet_t *task)
+{
+	tasklet_schedule(&task->t);
+}
+
+void DWC_TASK_HI_SCHEDULE(dwc_tasklet_t *task)
+{
+	tasklet_hi_schedule(&task->t);
+}
+
+
+/* workqueues
+ - run in process context (can sleep)
+ */
+typedef struct work_container {
+	dwc_work_callback_t cb;
+	void *data;
+	dwc_workq_t *wq;
+	char *name;
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_ENTRY(work_container) entry;
+#endif
+	struct delayed_work work;
+} work_container_t;
+
+#ifdef DEBUG
+DWC_CIRCLEQ_HEAD(work_container_queue, work_container);
+#endif
+
+struct dwc_workq {
+	struct workqueue_struct *wq;
+	dwc_spinlock_t *lock;
+	dwc_waitq_t *waitq;
+	int pending;
+
+#ifdef DEBUG
+	struct work_container_queue entries;
+#endif
+};
+
+static void do_work(struct work_struct *work)
+{
+	dwc_irqflags_t flags;
+	struct delayed_work *dw = container_of(work, struct delayed_work, work);
+	work_container_t *container = container_of(dw, struct work_container, work);
+	dwc_workq_t *wq = container->wq;
+
+	container->cb(container->data);
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_REMOVE(&wq->entries, container, entry);
+#endif
+	DWC_DEBUGC("Work done: %s, container=%p", container->name, container);
+	if (container->name) {
+		DWC_FREE(container->name);
+	}
+	DWC_FREE(container);
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+	wq->pending--;
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+	DWC_WAITQ_TRIGGER(wq->waitq);
+}
+
+static int work_done(void *data)
+{
+	dwc_workq_t *workq = (dwc_workq_t *)data;
+	return workq->pending == 0;
+}
+
+int DWC_WORKQ_WAIT_WORK_DONE(dwc_workq_t *workq, int timeout)
+{
+	return DWC_WAITQ_WAIT_TIMEOUT(workq->waitq, work_done, workq, timeout);
+}
+
+dwc_workq_t *DWC_WORKQ_ALLOC(char *name)
+{
+	dwc_workq_t *wq = DWC_ALLOC(sizeof(*wq));
+
+	if (!wq) {
+		return NULL;
+	}
+
+	wq->wq = create_singlethread_workqueue(name);
+	if (!wq->wq) {
+		goto no_wq;
+	}
+
+	wq->pending = 0;
+
+#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK))
+	DWC_SPINLOCK_ALLOC_LINUX_DEBUG(wq->lock);
+#else
+	wq->lock = DWC_SPINLOCK_ALLOC();
+#endif
+	if (!wq->lock) {
+		goto no_lock;
+	}
+
+	wq->waitq = DWC_WAITQ_ALLOC();
+	if (!wq->waitq) {
+		goto no_waitq;
+	}
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_INIT(&wq->entries);
+#endif
+	return wq;
+
+ no_waitq:
+	DWC_SPINLOCK_FREE(wq->lock);
+ no_lock:
+	destroy_workqueue(wq->wq);
+ no_wq:
+	DWC_FREE(wq);
+
+	return NULL;
+}
+
+void DWC_WORKQ_FREE(dwc_workq_t *wq)
+{
+#ifdef DEBUG
+	if (wq->pending != 0) {
+		struct work_container *wc;
+		DWC_ERROR("Destroying work queue with pending work");
+		DWC_CIRCLEQ_FOREACH(wc, &wq->entries, entry) {
+			DWC_ERROR("Work %s still pending", wc->name);
+		}
+	}
+#endif
+	destroy_workqueue(wq->wq);
+	DWC_SPINLOCK_FREE(wq->lock);
+	DWC_WAITQ_FREE(wq->waitq);
+	DWC_FREE(wq);
+}
+
+void DWC_WORKQ_SCHEDULE(dwc_workq_t *wq, dwc_work_callback_t cb, void *data,
+			char *format, ...)
+{
+	dwc_irqflags_t flags;
+	work_container_t *container;
+	static char name[128];
+	va_list args;
+
+	va_start(args, format);
+	DWC_VSNPRINTF(name, 128, format, args);
+	va_end(args);
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+	wq->pending++;
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+	DWC_WAITQ_TRIGGER(wq->waitq);
+
+	container = DWC_ALLOC_ATOMIC(sizeof(*container));
+	if (!container) {
+		DWC_ERROR("Cannot allocate memory for container\n");
+		return;
+	}
+
+	container->name = DWC_STRDUP(name);
+	if (!container->name) {
+		DWC_ERROR("Cannot allocate memory for container->name\n");
+		DWC_FREE(container);
+		return;
+	}
+
+	container->cb = cb;
+	container->data = data;
+	container->wq = wq;
+	DWC_DEBUGC("Queueing work: %s, container=%p", container->name, container);
+	INIT_WORK(&container->work.work, do_work);
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_INSERT_TAIL(&wq->entries, container, entry);
+#endif
+	queue_work(wq->wq, &container->work.work);
+}
+
+void DWC_WORKQ_SCHEDULE_DELAYED(dwc_workq_t *wq, dwc_work_callback_t cb,
+				void *data, uint32_t time, char *format, ...)
+{
+	dwc_irqflags_t flags;
+	work_container_t *container;
+	static char name[128];
+	va_list args;
+
+	va_start(args, format);
+	DWC_VSNPRINTF(name, 128, format, args);
+	va_end(args);
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+	wq->pending++;
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+	DWC_WAITQ_TRIGGER(wq->waitq);
+
+	container = DWC_ALLOC_ATOMIC(sizeof(*container));
+	if (!container) {
+		DWC_ERROR("Cannot allocate memory for container\n");
+		return;
+	}
+
+	container->name = DWC_STRDUP(name);
+	if (!container->name) {
+		DWC_ERROR("Cannot allocate memory for container->name\n");
+		DWC_FREE(container);
+		return;
+	}
+
+	container->cb = cb;
+	container->data = data;
+	container->wq = wq;
+	DWC_DEBUGC("Queueing work: %s, container=%p", container->name, container);
+	INIT_DELAYED_WORK(&container->work, do_work);
+
+#ifdef DEBUG
+	DWC_CIRCLEQ_INSERT_TAIL(&wq->entries, container, entry);
+#endif
+	queue_delayed_work(wq->wq, &container->work, msecs_to_jiffies(time));
+}
+
+int DWC_WORKQ_PENDING(dwc_workq_t *wq)
+{
+	return wq->pending;
+}
+
+
+#ifdef DWC_LIBMODULE
+
+#ifdef DWC_CCLIB
+/* CC */
+EXPORT_SYMBOL(dwc_cc_if_alloc);
+EXPORT_SYMBOL(dwc_cc_if_free);
+EXPORT_SYMBOL(dwc_cc_clear);
+EXPORT_SYMBOL(dwc_cc_add);
+EXPORT_SYMBOL(dwc_cc_remove);
+EXPORT_SYMBOL(dwc_cc_change);
+EXPORT_SYMBOL(dwc_cc_data_for_save);
+EXPORT_SYMBOL(dwc_cc_restore_from_data);
+EXPORT_SYMBOL(dwc_cc_match_chid);
+EXPORT_SYMBOL(dwc_cc_match_cdid);
+EXPORT_SYMBOL(dwc_cc_ck);
+EXPORT_SYMBOL(dwc_cc_chid);
+EXPORT_SYMBOL(dwc_cc_cdid);
+EXPORT_SYMBOL(dwc_cc_name);
+#endif	/* DWC_CCLIB */
+
+#ifdef DWC_CRYPTOLIB
+# ifndef CONFIG_MACH_IPMATE
+/* Modpow */
+EXPORT_SYMBOL(dwc_modpow);
+
+/* DH */
+EXPORT_SYMBOL(dwc_dh_modpow);
+EXPORT_SYMBOL(dwc_dh_derive_keys);
+EXPORT_SYMBOL(dwc_dh_pk);
+# endif	/* CONFIG_MACH_IPMATE */
+
+/* Crypto */
+EXPORT_SYMBOL(dwc_wusb_aes_encrypt);
+EXPORT_SYMBOL(dwc_wusb_cmf);
+EXPORT_SYMBOL(dwc_wusb_prf);
+EXPORT_SYMBOL(dwc_wusb_fill_ccm_nonce);
+EXPORT_SYMBOL(dwc_wusb_gen_nonce);
+EXPORT_SYMBOL(dwc_wusb_gen_key);
+EXPORT_SYMBOL(dwc_wusb_gen_mic);
+#endif	/* DWC_CRYPTOLIB */
+
+/* Notification */
+#ifdef DWC_NOTIFYLIB
+EXPORT_SYMBOL(dwc_alloc_notification_manager);
+EXPORT_SYMBOL(dwc_free_notification_manager);
+EXPORT_SYMBOL(dwc_register_notifier);
+EXPORT_SYMBOL(dwc_unregister_notifier);
+EXPORT_SYMBOL(dwc_add_observer);
+EXPORT_SYMBOL(dwc_remove_observer);
+EXPORT_SYMBOL(dwc_notify);
+#endif
+
+/* Memory Debugging Routines */
+#ifdef DWC_DEBUG_MEMORY
+EXPORT_SYMBOL(dwc_alloc_debug);
+EXPORT_SYMBOL(dwc_alloc_atomic_debug);
+EXPORT_SYMBOL(dwc_free_debug);
+EXPORT_SYMBOL(dwc_dma_alloc_debug);
+EXPORT_SYMBOL(dwc_dma_free_debug);
+#endif
+
+EXPORT_SYMBOL(DWC_MEMSET);
+EXPORT_SYMBOL(DWC_MEMCPY);
+EXPORT_SYMBOL(DWC_MEMMOVE);
+EXPORT_SYMBOL(DWC_MEMCMP);
+EXPORT_SYMBOL(DWC_STRNCMP);
+EXPORT_SYMBOL(DWC_STRCMP);
+EXPORT_SYMBOL(DWC_STRLEN);
+EXPORT_SYMBOL(DWC_STRCPY);
+EXPORT_SYMBOL(DWC_STRDUP);
+EXPORT_SYMBOL(DWC_ATOI);
+EXPORT_SYMBOL(DWC_ATOUI);
+
+#ifdef DWC_UTFLIB
+EXPORT_SYMBOL(DWC_UTF8_TO_UTF16LE);
+#endif	/* DWC_UTFLIB */
+
+EXPORT_SYMBOL(DWC_IN_IRQ);
+EXPORT_SYMBOL(DWC_IN_BH);
+EXPORT_SYMBOL(DWC_VPRINTF);
+EXPORT_SYMBOL(DWC_VSNPRINTF);
+EXPORT_SYMBOL(DWC_PRINTF);
+EXPORT_SYMBOL(DWC_SPRINTF);
+EXPORT_SYMBOL(DWC_SNPRINTF);
+EXPORT_SYMBOL(__DWC_WARN);
+EXPORT_SYMBOL(__DWC_ERROR);
+EXPORT_SYMBOL(DWC_EXCEPTION);
+
+#ifdef DEBUG
+EXPORT_SYMBOL(__DWC_DEBUG);
+#endif
+
+EXPORT_SYMBOL(__DWC_DMA_ALLOC);
+EXPORT_SYMBOL(__DWC_DMA_ALLOC_ATOMIC);
+EXPORT_SYMBOL(__DWC_DMA_FREE);
+EXPORT_SYMBOL(__DWC_ALLOC);
+EXPORT_SYMBOL(__DWC_ALLOC_ATOMIC);
+EXPORT_SYMBOL(__DWC_FREE);
+
+#ifdef DWC_CRYPTOLIB
+EXPORT_SYMBOL(DWC_RANDOM_BYTES);
+EXPORT_SYMBOL(DWC_AES_CBC);
+EXPORT_SYMBOL(DWC_SHA256);
+EXPORT_SYMBOL(DWC_HMAC_SHA256);
+#endif
+
+EXPORT_SYMBOL(DWC_CPU_TO_LE32);
+EXPORT_SYMBOL(DWC_CPU_TO_BE32);
+EXPORT_SYMBOL(DWC_LE32_TO_CPU);
+EXPORT_SYMBOL(DWC_BE32_TO_CPU);
+EXPORT_SYMBOL(DWC_CPU_TO_LE16);
+EXPORT_SYMBOL(DWC_CPU_TO_BE16);
+EXPORT_SYMBOL(DWC_LE16_TO_CPU);
+EXPORT_SYMBOL(DWC_BE16_TO_CPU);
+EXPORT_SYMBOL(DWC_READ_REG32);
+EXPORT_SYMBOL(DWC_WRITE_REG32);
+EXPORT_SYMBOL(DWC_MODIFY_REG32);
+
+#if 0
+EXPORT_SYMBOL(DWC_READ_REG64);
+EXPORT_SYMBOL(DWC_WRITE_REG64);
+EXPORT_SYMBOL(DWC_MODIFY_REG64);
+#endif
+
+EXPORT_SYMBOL(DWC_SPINLOCK_ALLOC);
+EXPORT_SYMBOL(DWC_SPINLOCK_FREE);
+EXPORT_SYMBOL(DWC_SPINLOCK);
+EXPORT_SYMBOL(DWC_SPINUNLOCK);
+EXPORT_SYMBOL(DWC_SPINLOCK_IRQSAVE);
+EXPORT_SYMBOL(DWC_SPINUNLOCK_IRQRESTORE);
+EXPORT_SYMBOL(DWC_MUTEX_ALLOC);
+
+#if (!defined(DWC_LINUX) || !defined(CONFIG_DEBUG_MUTEXES))
+EXPORT_SYMBOL(DWC_MUTEX_FREE);
+#endif
+
+EXPORT_SYMBOL(DWC_MUTEX_LOCK);
+EXPORT_SYMBOL(DWC_MUTEX_TRYLOCK);
+EXPORT_SYMBOL(DWC_MUTEX_UNLOCK);
+EXPORT_SYMBOL(DWC_UDELAY);
+EXPORT_SYMBOL(DWC_MDELAY);
+EXPORT_SYMBOL(DWC_MSLEEP);
+EXPORT_SYMBOL(DWC_TIME);
+EXPORT_SYMBOL(DWC_TIMER_ALLOC);
+EXPORT_SYMBOL(DWC_TIMER_FREE);
+EXPORT_SYMBOL(DWC_TIMER_SCHEDULE);
+EXPORT_SYMBOL(DWC_TIMER_CANCEL);
+EXPORT_SYMBOL(DWC_WAITQ_ALLOC);
+EXPORT_SYMBOL(DWC_WAITQ_FREE);
+EXPORT_SYMBOL(DWC_WAITQ_WAIT);
+EXPORT_SYMBOL(DWC_WAITQ_WAIT_TIMEOUT);
+EXPORT_SYMBOL(DWC_WAITQ_TRIGGER);
+EXPORT_SYMBOL(DWC_WAITQ_ABORT);
+EXPORT_SYMBOL(DWC_THREAD_RUN);
+EXPORT_SYMBOL(DWC_THREAD_STOP);
+EXPORT_SYMBOL(DWC_THREAD_SHOULD_STOP);
+EXPORT_SYMBOL(DWC_TASK_ALLOC);
+EXPORT_SYMBOL(DWC_TASK_FREE);
+EXPORT_SYMBOL(DWC_TASK_SCHEDULE);
+EXPORT_SYMBOL(DWC_WORKQ_WAIT_WORK_DONE);
+EXPORT_SYMBOL(DWC_WORKQ_ALLOC);
+EXPORT_SYMBOL(DWC_WORKQ_FREE);
+EXPORT_SYMBOL(DWC_WORKQ_SCHEDULE);
+EXPORT_SYMBOL(DWC_WORKQ_SCHEDULE_DELAYED);
+EXPORT_SYMBOL(DWC_WORKQ_PENDING);
+
+static int dwc_common_port_init_module(void)
+{
+	int result = 0;
+
+	printk(KERN_DEBUG "Module dwc_common_port init\n" );
+
+#ifdef DWC_DEBUG_MEMORY
+	result = dwc_memory_debug_start(NULL);
+	if (result) {
+		printk(KERN_ERR
+		       "dwc_memory_debug_start() failed with error %d\n",
+		       result);
+		return result;
+	}
+#endif
+
+#ifdef DWC_NOTIFYLIB
+	result = dwc_alloc_notification_manager(NULL, NULL);
+	if (result) {
+		printk(KERN_ERR
+		       "dwc_alloc_notification_manager() failed with error %d\n",
+		       result);
+		return result;
+	}
+#endif
+	return result;
+}
+
+static void dwc_common_port_exit_module(void)
+{
+	printk(KERN_DEBUG "Module dwc_common_port exit\n" );
+
+#ifdef DWC_NOTIFYLIB
+	dwc_free_notification_manager();
+#endif
+
+#ifdef DWC_DEBUG_MEMORY
+	dwc_memory_debug_stop();
+#endif
+}
+
+module_init(dwc_common_port_init_module);
+module_exit(dwc_common_port_exit_module);
+
+MODULE_DESCRIPTION("DWC Common Library - Portable version");
+MODULE_AUTHOR("Synopsys Inc.");
+MODULE_LICENSE ("GPL");
+
+#endif	/* DWC_LIBMODULE */
diff --git a/drivers/usb/host/dwc_common_port/dwc_common_nbsd.c b/drivers/usb/host/dwc_common_port/dwc_common_nbsd.c
new file mode 100644
index 000000000000..49b07e172264
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_common_nbsd.c
@@ -0,0 +1,1275 @@
+#include "dwc_os.h"
+#include "dwc_list.h"
+
+#ifdef DWC_CCLIB
+# include "dwc_cc.h"
+#endif
+
+#ifdef DWC_CRYPTOLIB
+# include "dwc_modpow.h"
+# include "dwc_dh.h"
+# include "dwc_crypto.h"
+#endif
+
+#ifdef DWC_NOTIFYLIB
+# include "dwc_notifier.h"
+#endif
+
+/* OS-Level Implementations */
+
+/* This is the NetBSD 4.0.1 kernel implementation of the DWC platform library. */
+
+
+/* MISC */
+
+void *DWC_MEMSET(void *dest, uint8_t byte, uint32_t size)
+{
+	return memset(dest, byte, size);
+}
+
+void *DWC_MEMCPY(void *dest, void const *src, uint32_t size)
+{
+	return memcpy(dest, src, size);
+}
+
+void *DWC_MEMMOVE(void *dest, void *src, uint32_t size)
+{
+	bcopy(src, dest, size);
+	return dest;
+}
+
+int DWC_MEMCMP(void *m1, void *m2, uint32_t size)
+{
+	return memcmp(m1, m2, size);
+}
+
+int DWC_STRNCMP(void *s1, void *s2, uint32_t size)
+{
+	return strncmp(s1, s2, size);
+}
+
+int DWC_STRCMP(void *s1, void *s2)
+{
+	return strcmp(s1, s2);
+}
+
+int DWC_STRLEN(char const *str)
+{
+	return strlen(str);
+}
+
+char *DWC_STRCPY(char *to, char const *from)
+{
+	return strcpy(to, from);
+}
+
+char *DWC_STRDUP(char const *str)
+{
+	int len = DWC_STRLEN(str) + 1;
+	char *new = DWC_ALLOC_ATOMIC(len);
+
+	if (!new) {
+		return NULL;
+	}
+
+	DWC_MEMCPY(new, str, len);
+	return new;
+}
+
+int DWC_ATOI(char *str, int32_t *value)
+{
+	char *end = NULL;
+
+	/* NetBSD doesn't have 'strtol' in the kernel, but 'strtoul'
+	 * should be equivalent on 2's complement machines
+	 */
+	*value = strtoul(str, &end, 0);
+	if (*end == '\0') {
+		return 0;
+	}
+
+	return -1;
+}
+
+int DWC_ATOUI(char *str, uint32_t *value)
+{
+	char *end = NULL;
+
+	*value = strtoul(str, &end, 0);
+	if (*end == '\0') {
+		return 0;
+	}
+
+	return -1;
+}
+
+
+#ifdef DWC_UTFLIB
+/* From usbstring.c */
+
+int DWC_UTF8_TO_UTF16LE(uint8_t const *s, uint16_t *cp, unsigned len)
+{
+	int	count = 0;
+	u8	c;
+	u16	uchar;
+
+	/* this insists on correct encodings, though not minimal ones.
+	 * BUT it currently rejects legit 4-byte UTF-8 code points,
+	 * which need surrogate pairs.  (Unicode 3.1 can use them.)
+	 */
+	while (len != 0 && (c = (u8) *s++) != 0) {
+		if (unlikely(c & 0x80)) {
+			// 2-byte sequence:
+			// 00000yyyyyxxxxxx = 110yyyyy 10xxxxxx
+			if ((c & 0xe0) == 0xc0) {
+				uchar = (c & 0x1f) << 6;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c;
+
+			// 3-byte sequence (most CJKV characters):
+			// zzzzyyyyyyxxxxxx = 1110zzzz 10yyyyyy 10xxxxxx
+			} else if ((c & 0xf0) == 0xe0) {
+				uchar = (c & 0x0f) << 12;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c << 6;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c;
+
+				/* no bogus surrogates */
+				if (0xd800 <= uchar && uchar <= 0xdfff)
+					goto fail;
+
+			// 4-byte sequence (surrogate pairs, currently rare):
+			// 11101110wwwwzzzzyy + 110111yyyyxxxxxx
+			//     = 11110uuu 10uuzzzz 10yyyyyy 10xxxxxx
+			// (uuuuu = wwww + 1)
+			// FIXME accept the surrogate code points (only)
+			} else
+				goto fail;
+		} else
+			uchar = c;
+		put_unaligned (cpu_to_le16 (uchar), cp++);
+		count++;
+		len--;
+	}
+	return count;
+fail:
+	return -1;
+}
+
+#endif	/* DWC_UTFLIB */
+
+
+/* dwc_debug.h */
+
+dwc_bool_t DWC_IN_IRQ(void)
+{
+//	return in_irq();
+	return 0;
+}
+
+dwc_bool_t DWC_IN_BH(void)
+{
+//	return in_softirq();
+	return 0;
+}
+
+void DWC_VPRINTF(char *format, va_list args)
+{
+	vprintf(format, args);
+}
+
+int DWC_VSNPRINTF(char *str, int size, char *format, va_list args)
+{
+	return vsnprintf(str, size, format, args);
+}
+
+void DWC_PRINTF(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+
+int DWC_SPRINTF(char *buffer, char *format, ...)
+{
+	int retval;
+	va_list args;
+
+	va_start(args, format);
+	retval = vsprintf(buffer, format, args);
+	va_end(args);
+	return retval;
+}
+
+int DWC_SNPRINTF(char *buffer, int size, char *format, ...)
+{
+	int retval;
+	va_list args;
+
+	va_start(args, format);
+	retval = vsnprintf(buffer, size, format, args);
+	va_end(args);
+	return retval;
+}
+
+void __DWC_WARN(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+
+void __DWC_ERROR(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+
+void DWC_EXCEPTION(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+//	BUG_ON(1);	???
+}
+
+#ifdef DEBUG
+void __DWC_DEBUG(char *format, ...)
+{
+	va_list args;
+
+	va_start(args, format);
+	DWC_VPRINTF(format, args);
+	va_end(args);
+}
+#endif
+
+
+/* dwc_mem.h */
+
+#if 0
+dwc_pool_t *DWC_DMA_POOL_CREATE(uint32_t size,
+				uint32_t align,
+				uint32_t alloc)
+{
+	struct dma_pool *pool = dma_pool_create("Pool", NULL,
+						size, align, alloc);
+	return (dwc_pool_t *)pool;
+}
+
+void DWC_DMA_POOL_DESTROY(dwc_pool_t *pool)
+{
+	dma_pool_destroy((struct dma_pool *)pool);
+}
+
+void *DWC_DMA_POOL_ALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
+{
+//	return dma_pool_alloc((struct dma_pool *)pool, GFP_KERNEL, dma_addr);
+	return dma_pool_alloc((struct dma_pool *)pool, M_WAITOK, dma_addr);
+}
+
+void *DWC_DMA_POOL_ZALLOC(dwc_pool_t *pool, uint64_t *dma_addr)
+{
+	void *vaddr = DWC_DMA_POOL_ALLOC(pool, dma_addr);
+	memset(..);
+}
+
+void DWC_DMA_POOL_FREE(dwc_pool_t *pool, void *vaddr, void *daddr)
+{
+	dma_pool_free(pool, vaddr, daddr);
+}
+#endif
+
+void *__DWC_DMA_ALLOC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr)
+{
+	dwc_dmactx_t *dma = (dwc_dmactx_t *)dma_ctx;
+	int error;
+
+	error = bus_dmamem_alloc(dma->dma_tag, size, 1, size, dma->segs,
+				 sizeof(dma->segs) / sizeof(dma->segs[0]),
+				 &dma->nsegs, BUS_DMA_NOWAIT);
+	if (error) {
+		printf("%s: bus_dmamem_alloc(%ju) failed: %d\n", __func__,
+		       (uintmax_t)size, error);
+		goto fail_0;
+	}
+
+	error = bus_dmamem_map(dma->dma_tag, dma->segs, dma->nsegs, size,
+			       (caddr_t *)&dma->dma_vaddr,
+			       BUS_DMA_NOWAIT | BUS_DMA_COHERENT);
+	if (error) {
+		printf("%s: bus_dmamem_map failed: %d\n", __func__, error);
+		goto fail_1;
+	}
+
+	error = bus_dmamap_create(dma->dma_tag, size, 1, size, 0,
+				  BUS_DMA_NOWAIT, &dma->dma_map);
+	if (error) {
+		printf("%s: bus_dmamap_create failed: %d\n", __func__, error);
+		goto fail_2;
+	}
+
+	error = bus_dmamap_load(dma->dma_tag, dma->dma_map, dma->dma_vaddr,
+				size, NULL, BUS_DMA_NOWAIT);
+	if (error) {
+		printf("%s: bus_dmamap_load failed: %d\n", __func__, error);
+		goto fail_3;
+	}
+
+	dma->dma_paddr = (bus_addr_t)dma->segs[0].ds_addr;
+	*dma_addr = dma->dma_paddr;
+	return dma->dma_vaddr;
+
+fail_3:
+	bus_dmamap_destroy(dma->dma_tag, dma->dma_map);
+fail_2:
+	bus_dmamem_unmap(dma->dma_tag, dma->dma_vaddr, size);
+fail_1:
+	bus_dmamem_free(dma->dma_tag, dma->segs, dma->nsegs);
+fail_0:
+	dma->dma_map = NULL;
+	dma->dma_vaddr = NULL;
+	dma->nsegs = 0;
+
+	return NULL;
+}
+
+void __DWC_DMA_FREE(void *dma_ctx, uint32_t size, void *virt_addr, dwc_dma_t dma_addr)
+{
+	dwc_dmactx_t *dma = (dwc_dmactx_t *)dma_ctx;
+
+	if (dma->dma_map != NULL) {
+		bus_dmamap_sync(dma->dma_tag, dma->dma_map, 0, size,
+				BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
+		bus_dmamap_unload(dma->dma_tag, dma->dma_map);
+		bus_dmamap_destroy(dma->dma_tag, dma->dma_map);
+		bus_dmamem_unmap(dma->dma_tag, dma->dma_vaddr, size);
+		bus_dmamem_free(dma->dma_tag, dma->segs, dma->nsegs);
+		dma->dma_paddr = 0;
+		dma->dma_map = NULL;
+		dma->dma_vaddr = NULL;
+		dma->nsegs = 0;
+	}
+}
+
+void *__DWC_ALLOC(void *mem_ctx, uint32_t size)
+{
+	return malloc(size, M_DEVBUF, M_WAITOK | M_ZERO);
+}
+
+void *__DWC_ALLOC_ATOMIC(void *mem_ctx, uint32_t size)
+{
+	return malloc(size, M_DEVBUF, M_NOWAIT | M_ZERO);
+}
+
+void __DWC_FREE(void *mem_ctx, void *addr)
+{
+	free(addr, M_DEVBUF);
+}
+
+
+#ifdef DWC_CRYPTOLIB
+/* dwc_crypto.h */
+
+void DWC_RANDOM_BYTES(uint8_t *buffer, uint32_t length)
+{
+	get_random_bytes(buffer, length);
+}
+
+int DWC_AES_CBC(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t iv[16], uint8_t *out)
+{
+	struct crypto_blkcipher *tfm;
+	struct blkcipher_desc desc;
+	struct scatterlist sgd;
+	struct scatterlist sgs;
+
+	tfm = crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
+	if (tfm == NULL) {
+		printk("failed to load transform for aes CBC\n");
+		return -1;
+	}
+
+	crypto_blkcipher_setkey(tfm, key, keylen);
+	crypto_blkcipher_set_iv(tfm, iv, 16);
+
+	sg_init_one(&sgd, out, messagelen);
+	sg_init_one(&sgs, message, messagelen);
+
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	if (crypto_blkcipher_encrypt(&desc, &sgd, &sgs, messagelen)) {
+		crypto_free_blkcipher(tfm);
+		DWC_ERROR("AES CBC encryption failed");
+		return -1;
+	}
+
+	crypto_free_blkcipher(tfm);
+	return 0;
+}
+
+int DWC_SHA256(uint8_t *message, uint32_t len, uint8_t *out)
+{
+	struct crypto_hash *tfm;
+	struct hash_desc desc;
+	struct scatterlist sg;
+
+	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(tfm)) {
+		DWC_ERROR("Failed to load transform for sha256: %ld", PTR_ERR(tfm));
+		return 0;
+	}
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	sg_init_one(&sg, message, len);
+	crypto_hash_digest(&desc, &sg, len, out);
+	crypto_free_hash(tfm);
+
+	return 1;
+}
+
+int DWC_HMAC_SHA256(uint8_t *message, uint32_t messagelen,
+		    uint8_t *key, uint32_t keylen, uint8_t *out)
+{
+	struct crypto_hash *tfm;
+	struct hash_desc desc;
+	struct scatterlist sg;
+
+	tfm = crypto_alloc_hash("hmac(sha256)", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(tfm)) {
+		DWC_ERROR("Failed to load transform for hmac(sha256): %ld", PTR_ERR(tfm));
+		return 0;
+	}
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	sg_init_one(&sg, message, messagelen);
+	crypto_hash_setkey(tfm, key, keylen);
+	crypto_hash_digest(&desc, &sg, messagelen, out);
+	crypto_free_hash(tfm);
+
+	return 1;
+}
+
+#endif	/* DWC_CRYPTOLIB */
+
+
+/* Byte Ordering Conversions */
+
+uint32_t DWC_CPU_TO_LE32(uint32_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint32_t DWC_CPU_TO_BE32(uint32_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint32_t DWC_LE32_TO_CPU(uint32_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint32_t DWC_BE32_TO_CPU(uint32_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+
+	return (u_p[3] | (u_p[2] << 8) | (u_p[1] << 16) | (u_p[0] << 24));
+#endif
+}
+
+uint16_t DWC_CPU_TO_LE16(uint16_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+uint16_t DWC_CPU_TO_BE16(uint16_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+uint16_t DWC_LE16_TO_CPU(uint16_t *p)
+{
+#ifdef __LITTLE_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+uint16_t DWC_BE16_TO_CPU(uint16_t *p)
+{
+#ifdef __BIG_ENDIAN
+	return *p;
+#else
+	uint8_t *u_p = (uint8_t *)p;
+	return (u_p[1] | (u_p[0] << 8));
+#endif
+}
+
+
+/* Registers */
+
+uint32_t DWC_READ_REG32(void *io_ctx, uint32_t volatile *reg)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	return bus_space_read_4(io->iot, io->ioh, ior);
+}
+
+#if 0
+uint64_t DWC_READ_REG64(void *io_ctx, uint64_t volatile *reg)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	return bus_space_read_8(io->iot, io->ioh, ior);
+}
+#endif
+
+void DWC_WRITE_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t value)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	bus_space_write_4(io->iot, io->ioh, ior, value);
+}
+
+#if 0
+void DWC_WRITE_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t value)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	bus_space_write_8(io->iot, io->ioh, ior, value);
+}
+#endif
+
+void DWC_MODIFY_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t clear_mask,
+		      uint32_t set_mask)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	bus_space_write_4(io->iot, io->ioh, ior,
+			  (bus_space_read_4(io->iot, io->ioh, ior) &
+			   ~clear_mask) | set_mask);
+}
+
+#if 0
+void DWC_MODIFY_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t clear_mask,
+		      uint64_t set_mask)
+{
+	dwc_ioctx_t *io = (dwc_ioctx_t *)io_ctx;
+	bus_size_t ior = (bus_size_t)reg;
+
+	bus_space_write_8(io->iot, io->ioh, ior,
+			  (bus_space_read_8(io->iot, io->ioh, ior) &
+			   ~clear_mask) | set_mask);
+}
+#endif
+
+
+/* Locking */
+
+dwc_spinlock_t *DWC_SPINLOCK_ALLOC(void)
+{
+	struct simplelock *sl = DWC_ALLOC(sizeof(*sl));
+
+	if (!sl) {
+		DWC_ERROR("Cannot allocate memory for spinlock");
+		return NULL;
+	}
+
+	simple_lock_init(sl);
+	return (dwc_spinlock_t *)sl;
+}
+
+void DWC_SPINLOCK_FREE(dwc_spinlock_t *lock)
+{
+	struct simplelock *sl = (struct simplelock *)lock;
+
+	DWC_FREE(sl);
+}
+
+void DWC_SPINLOCK(dwc_spinlock_t *lock)
+{
+	simple_lock((struct simplelock *)lock);
+}
+
+void DWC_SPINUNLOCK(dwc_spinlock_t *lock)
+{
+	simple_unlock((struct simplelock *)lock);
+}
+
+void DWC_SPINLOCK_IRQSAVE(dwc_spinlock_t *lock, dwc_irqflags_t *flags)
+{
+	simple_lock((struct simplelock *)lock);
+	*flags = splbio();
+}
+
+void DWC_SPINUNLOCK_IRQRESTORE(dwc_spinlock_t *lock, dwc_irqflags_t flags)
+{
+	splx(flags);
+	simple_unlock((struct simplelock *)lock);
+}
+
+dwc_mutex_t *DWC_MUTEX_ALLOC(void)
+{
+	dwc_mutex_t *mutex = DWC_ALLOC(sizeof(struct lock));
+
+	if (!mutex) {
+		DWC_ERROR("Cannot allocate memory for mutex");
+		return NULL;
+	}
+
+	lockinit((struct lock *)mutex, 0, "dw3mtx", 0, 0);
+	return mutex;
+}
+
+#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES))
+#else
+void DWC_MUTEX_FREE(dwc_mutex_t *mutex)
+{
+	DWC_FREE(mutex);
+}
+#endif
+
+void DWC_MUTEX_LOCK(dwc_mutex_t *mutex)
+{
+	lockmgr((struct lock *)mutex, LK_EXCLUSIVE, NULL);
+}
+
+int DWC_MUTEX_TRYLOCK(dwc_mutex_t *mutex)
+{
+	int status;
+
+	status = lockmgr((struct lock *)mutex, LK_EXCLUSIVE | LK_NOWAIT, NULL);
+	return status == 0;
+}
+
+void DWC_MUTEX_UNLOCK(dwc_mutex_t *mutex)
+{
+	lockmgr((struct lock *)mutex, LK_RELEASE, NULL);
+}
+
+
+/* Timing */
+
+void DWC_UDELAY(uint32_t usecs)
+{
+	DELAY(usecs);
+}
+
+void DWC_MDELAY(uint32_t msecs)
+{
+	do {
+		DELAY(1000);
+	} while (--msecs);
+}
+
+void DWC_MSLEEP(uint32_t msecs)
+{
+	struct timeval tv;
+
+	tv.tv_sec = msecs / 1000;
+	tv.tv_usec = (msecs - tv.tv_sec * 1000) * 1000;
+	tsleep(&tv, 0, "dw3slp", tvtohz(&tv));
+}
+
+uint32_t DWC_TIME(void)
+{
+	struct timeval tv;
+
+	microuptime(&tv);	// or getmicrouptime? (less precise, but faster)
+	return tv.tv_sec * 1000 + tv.tv_usec / 1000;
+}
+
+
+/* Timers */
+
+struct dwc_timer {
+	struct callout t;
+	char *name;
+	dwc_spinlock_t *lock;
+	dwc_timer_callback_t cb;
+	void *data;
+};
+
+dwc_timer_t *DWC_TIMER_ALLOC(char *name, dwc_timer_callback_t cb, void *data)
+{
+	dwc_timer_t *t = DWC_ALLOC(sizeof(*t));
+
+	if (!t) {
+		DWC_ERROR("Cannot allocate memory for timer");
+		return NULL;
+	}
+
+	callout_init(&t->t);
+
+	t->name = DWC_STRDUP(name);
+	if (!t->name) {
+		DWC_ERROR("Cannot allocate memory for timer->name");
+		goto no_name;
+	}
+
+	t->lock = DWC_SPINLOCK_ALLOC();
+	if (!t->lock) {
+		DWC_ERROR("Cannot allocate memory for timer->lock");
+		goto no_lock;
+	}
+
+	t->cb = cb;
+	t->data = data;
+
+	return t;
+
+ no_lock:
+	DWC_FREE(t->name);
+ no_name:
+	DWC_FREE(t);
+
+	return NULL;
+}
+
+void DWC_TIMER_FREE(dwc_timer_t *timer)
+{
+	callout_stop(&timer->t);
+	DWC_SPINLOCK_FREE(timer->lock);
+	DWC_FREE(timer->name);
+	DWC_FREE(timer);
+}
+
+void DWC_TIMER_SCHEDULE(dwc_timer_t *timer, uint32_t time)
+{
+	struct timeval tv;
+
+	tv.tv_sec = time / 1000;
+	tv.tv_usec = (time - tv.tv_sec * 1000) * 1000;
+	callout_reset(&timer->t, tvtohz(&tv), timer->cb, timer->data);
+}
+
+void DWC_TIMER_CANCEL(dwc_timer_t *timer)
+{
+	callout_stop(&timer->t);
+}
+
+
+/* Wait Queues */
+
+struct dwc_waitq {
+	struct simplelock lock;
+	int abort;
+};
+
+dwc_waitq_t *DWC_WAITQ_ALLOC(void)
+{
+	dwc_waitq_t *wq = DWC_ALLOC(sizeof(*wq));
+
+	if (!wq) {
+		DWC_ERROR("Cannot allocate memory for waitqueue");
+		return NULL;
+	}
+
+	simple_lock_init(&wq->lock);
+	wq->abort = 0;
+
+	return wq;
+}
+
+void DWC_WAITQ_FREE(dwc_waitq_t *wq)
+{
+	DWC_FREE(wq);
+}
+
+int32_t DWC_WAITQ_WAIT(dwc_waitq_t *wq, dwc_waitq_condition_t cond, void *data)
+{
+	int ipl;
+	int result = 0;
+
+	simple_lock(&wq->lock);
+	ipl = splbio();
+
+	/* Skip the sleep if already aborted or triggered */
+	if (!wq->abort && !cond(data)) {
+		splx(ipl);
+		result = ltsleep(wq, PCATCH, "dw3wat", 0, &wq->lock); // infinite timeout
+		ipl = splbio();
+	}
+
+	if (result == 0) {			// awoken
+		if (wq->abort) {
+			wq->abort = 0;
+			result = -DWC_E_ABORT;
+		} else {
+			result = 0;
+		}
+
+		splx(ipl);
+		simple_unlock(&wq->lock);
+	} else {
+		wq->abort = 0;
+		splx(ipl);
+		simple_unlock(&wq->lock);
+
+		if (result == ERESTART) {	// signaled - restart
+			result = -DWC_E_RESTART;
+		} else {			// signaled - must be EINTR
+			result = -DWC_E_ABORT;
+		}
+	}
+
+	return result;
+}
+
+int32_t DWC_WAITQ_WAIT_TIMEOUT(dwc_waitq_t *wq, dwc_waitq_condition_t cond,
+			       void *data, int32_t msecs)
+{
+	struct timeval tv, tv1, tv2;
+	int ipl;
+	int result = 0;
+
+	tv.tv_sec = msecs / 1000;
+	tv.tv_usec = (msecs - tv.tv_sec * 1000) * 1000;
+
+	simple_lock(&wq->lock);
+	ipl = splbio();
+
+	/* Skip the sleep if already aborted or triggered */
+	if (!wq->abort && !cond(data)) {
+		splx(ipl);
+		getmicrouptime(&tv1);
+		result = ltsleep(wq, PCATCH, "dw3wto", tvtohz(&tv), &wq->lock);
+		getmicrouptime(&tv2);
+		ipl = splbio();
+	}
+
+	if (result == 0) {			// awoken
+		if (wq->abort) {
+			wq->abort = 0;
+			splx(ipl);
+			simple_unlock(&wq->lock);
+			result = -DWC_E_ABORT;
+		} else {
+			splx(ipl);
+			simple_unlock(&wq->lock);
+
+			tv2.tv_usec -= tv1.tv_usec;
+			if (tv2.tv_usec < 0) {
+				tv2.tv_usec += 1000000;
+				tv2.tv_sec--;
+			}
+
+			tv2.tv_sec -= tv1.tv_sec;
+			result = tv2.tv_sec * 1000 + tv2.tv_usec / 1000;
+			result = msecs - result;
+			if (result <= 0)
+				result = 1;
+		}
+	} else {
+		wq->abort = 0;
+		splx(ipl);
+		simple_unlock(&wq->lock);
+
+		if (result == ERESTART) {	// signaled - restart
+			result = -DWC_E_RESTART;
+
+		} else if (result == EINTR) {		// signaled - interrupt
+			result = -DWC_E_ABORT;
+
+		} else {				// timed out
+			result = -DWC_E_TIMEOUT;
+		}
+	}
+
+	return result;
+}
+
+void DWC_WAITQ_TRIGGER(dwc_waitq_t *wq)
+{
+	wakeup(wq);
+}
+
+void DWC_WAITQ_ABORT(dwc_waitq_t *wq)
+{
+	int ipl;
+
+	simple_lock(&wq->lock);
+	ipl = splbio();
+	wq->abort = 1;
+	wakeup(wq);
+	splx(ipl);
+	simple_unlock(&wq->lock);
+}
+
+
+/* Threading */
+
+struct dwc_thread {
+	struct proc *proc;
+	int abort;
+};
+
+dwc_thread_t *DWC_THREAD_RUN(dwc_thread_function_t func, char *name, void *data)
+{
+	int retval;
+	dwc_thread_t *thread = DWC_ALLOC(sizeof(*thread));
+
+	if (!thread) {
+		return NULL;
+	}
+
+	thread->abort = 0;
+	retval = kthread_create1((void (*)(void *))func, data, &thread->proc,
+				 "%s", name);
+	if (retval) {
+		DWC_FREE(thread);
+		return NULL;
+	}
+
+	return thread;
+}
+
+int DWC_THREAD_STOP(dwc_thread_t *thread)
+{
+	int retval;
+
+	thread->abort = 1;
+	retval = tsleep(&thread->abort, 0, "dw3stp", 60 * hz);
+
+	if (retval == 0) {
+		/* DWC_THREAD_EXIT() will free the thread struct */
+		return 0;
+	}
+
+	/* NOTE: We leak the thread struct if thread doesn't die */
+
+	if (retval == EWOULDBLOCK) {
+		return -DWC_E_TIMEOUT;
+	}
+
+	return -DWC_E_UNKNOWN;
+}
+
+dwc_bool_t DWC_THREAD_SHOULD_STOP(dwc_thread_t *thread)
+{
+	return thread->abort;
+}
+
+void DWC_THREAD_EXIT(dwc_thread_t *thread)
+{
+	wakeup(&thread->abort);
+	DWC_FREE(thread);
+	kthread_exit(0);
+}
+
+/* tasklets
+ - Runs in interrupt context (cannot sleep)
+ - Each tasklet runs on a single CPU
+ - Different tasklets can be running simultaneously on different CPUs
+ [ On NetBSD there is no corresponding mechanism, drivers don't have bottom-
+   halves. So we just call the callback directly from DWC_TASK_SCHEDULE() ]
+ */
+struct dwc_tasklet {
+	dwc_tasklet_callback_t cb;
+	void *data;
+};
+
+static void tasklet_callback(void *data)
+{
+	dwc_tasklet_t *task = (dwc_tasklet_t *)data;
+
+	task->cb(task->data);
+}
+
+dwc_tasklet_t *DWC_TASK_ALLOC(char *name, dwc_tasklet_callback_t cb, void *data)
+{
+	dwc_tasklet_t *task = DWC_ALLOC(sizeof(*task));
+
+	if (task) {
+		task->cb = cb;
+		task->data = data;
+	} else {
+		DWC_ERROR("Cannot allocate memory for tasklet");
+	}
+
+	return task;
+}
+
+void DWC_TASK_FREE(dwc_tasklet_t *task)
+{
+	DWC_FREE(task);
+}
+
+void DWC_TASK_SCHEDULE(dwc_tasklet_t *task)
+{
+	tasklet_callback(task);
+}
+
+
+/* workqueues
+ - Runs in process context (can sleep)
+ */
+typedef struct work_container {
+	dwc_work_callback_t cb;
+	void *data;
+	dwc_workq_t *wq;
+	char *name;
+	int hz;
+	struct work task;
+} work_container_t;
+
+struct dwc_workq {
+	struct workqueue *taskq;
+	dwc_spinlock_t *lock;
+	dwc_waitq_t *waitq;
+	int pending;
+	struct work_container *container;
+};
+
+static void do_work(struct work *task, void *data)
+{
+	dwc_workq_t *wq = (dwc_workq_t *)data;
+	work_container_t *container = wq->container;
+	dwc_irqflags_t flags;
+
+	if (container->hz) {
+		tsleep(container, 0, "dw3wrk", container->hz);
+	}
+
+	container->cb(container->data);
+	DWC_DEBUG("Work done: %s, container=%p", container->name, container);
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+	if (container->name)
+		DWC_FREE(container->name);
+	DWC_FREE(container);
+	wq->pending--;
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+	DWC_WAITQ_TRIGGER(wq->waitq);
+}
+
+static int work_done(void *data)
+{
+	dwc_workq_t *workq = (dwc_workq_t *)data;
+
+	return workq->pending == 0;
+}
+
+int DWC_WORKQ_WAIT_WORK_DONE(dwc_workq_t *workq, int timeout)
+{
+	return DWC_WAITQ_WAIT_TIMEOUT(workq->waitq, work_done, workq, timeout);
+}
+
+dwc_workq_t *DWC_WORKQ_ALLOC(char *name)
+{
+	int result;
+	dwc_workq_t *wq = DWC_ALLOC(sizeof(*wq));
+
+	if (!wq) {
+		DWC_ERROR("Cannot allocate memory for workqueue");
+		return NULL;
+	}
+
+	result = workqueue_create(&wq->taskq, name, do_work, wq, 0 /*PWAIT*/,
+				  IPL_BIO, 0);
+	if (result) {
+		DWC_ERROR("Cannot create workqueue");
+		goto no_taskq;
+	}
+
+	wq->pending = 0;
+
+	wq->lock = DWC_SPINLOCK_ALLOC();
+	if (!wq->lock) {
+		DWC_ERROR("Cannot allocate memory for spinlock");
+		goto no_lock;
+	}
+
+	wq->waitq = DWC_WAITQ_ALLOC();
+	if (!wq->waitq) {
+		DWC_ERROR("Cannot allocate memory for waitqueue");
+		goto no_waitq;
+	}
+
+	return wq;
+
+ no_waitq:
+	DWC_SPINLOCK_FREE(wq->lock);
+ no_lock:
+	workqueue_destroy(wq->taskq);
+ no_taskq:
+	DWC_FREE(wq);
+
+	return NULL;
+}
+
+void DWC_WORKQ_FREE(dwc_workq_t *wq)
+{
+#ifdef DEBUG
+	dwc_irqflags_t flags;
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+
+	if (wq->pending != 0) {
+		struct work_container *container = wq->container;
+
+		DWC_ERROR("Destroying work queue with pending work");
+
+		if (container && container->name) {
+			DWC_ERROR("Work %s still pending", container->name);
+		}
+	}
+
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+#endif
+	DWC_WAITQ_FREE(wq->waitq);
+	DWC_SPINLOCK_FREE(wq->lock);
+	workqueue_destroy(wq->taskq);
+	DWC_FREE(wq);
+}
+
+void DWC_WORKQ_SCHEDULE(dwc_workq_t *wq, dwc_work_callback_t cb, void *data,
+			char *format, ...)
+{
+	dwc_irqflags_t flags;
+	work_container_t *container;
+	static char name[128];
+	va_list args;
+
+	va_start(args, format);
+	DWC_VSNPRINTF(name, 128, format, args);
+	va_end(args);
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+	wq->pending++;
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+	DWC_WAITQ_TRIGGER(wq->waitq);
+
+	container = DWC_ALLOC_ATOMIC(sizeof(*container));
+	if (!container) {
+		DWC_ERROR("Cannot allocate memory for container");
+		return;
+	}
+
+	container->name = DWC_STRDUP(name);
+	if (!container->name) {
+		DWC_ERROR("Cannot allocate memory for container->name");
+		DWC_FREE(container);
+		return;
+	}
+
+	container->cb = cb;
+	container->data = data;
+	container->wq = wq;
+	container->hz = 0;
+	wq->container = container;
+
+	DWC_DEBUG("Queueing work: %s, container=%p", container->name, container);
+	workqueue_enqueue(wq->taskq, &container->task);
+}
+
+void DWC_WORKQ_SCHEDULE_DELAYED(dwc_workq_t *wq, dwc_work_callback_t cb,
+				void *data, uint32_t time, char *format, ...)
+{
+	dwc_irqflags_t flags;
+	work_container_t *container;
+	static char name[128];
+	struct timeval tv;
+	va_list args;
+
+	va_start(args, format);
+	DWC_VSNPRINTF(name, 128, format, args);
+	va_end(args);
+
+	DWC_SPINLOCK_IRQSAVE(wq->lock, &flags);
+	wq->pending++;
+	DWC_SPINUNLOCK_IRQRESTORE(wq->lock, flags);
+	DWC_WAITQ_TRIGGER(wq->waitq);
+
+	container = DWC_ALLOC_ATOMIC(sizeof(*container));
+	if (!container) {
+		DWC_ERROR("Cannot allocate memory for container");
+		return;
+	}
+
+	container->name = DWC_STRDUP(name);
+	if (!container->name) {
+		DWC_ERROR("Cannot allocate memory for container->name");
+		DWC_FREE(container);
+		return;
+	}
+
+	container->cb = cb;
+	container->data = data;
+	container->wq = wq;
+	tv.tv_sec = time / 1000;
+	tv.tv_usec = (time - tv.tv_sec * 1000) * 1000;
+	container->hz = tvtohz(&tv);
+	wq->container = container;
+
+	DWC_DEBUG("Queueing work: %s, container=%p", container->name, container);
+	workqueue_enqueue(wq->taskq, &container->task);
+}
+
+int DWC_WORKQ_PENDING(dwc_workq_t *wq)
+{
+	return wq->pending;
+}
diff --git a/drivers/usb/host/dwc_common_port/dwc_crypto.c b/drivers/usb/host/dwc_common_port/dwc_crypto.c
new file mode 100644
index 000000000000..3b0353296148
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_crypto.c
@@ -0,0 +1,308 @@
+/* =========================================================================
+ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_crypto.c $
+ * $Revision: #5 $
+ * $Date: 2010/09/28 $
+ * $Change: 1596182 $
+ *
+ * Synopsys Portability Library Software and documentation
+ * (hereinafter, "Software") is an Unsupported proprietary work of
+ * Synopsys, Inc. unless otherwise expressly agreed to in writing
+ * between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product
+ * under any End User Software License Agreement or Agreement for
+ * Licensed Product with Synopsys or any supplement thereto. You are
+ * permitted to use and redistribute this Software in source and binary
+ * forms, with or without modification, provided that redistributions
+ * of source code must retain this notice. You may not view, use,
+ * disclose, copy or distribute this file or any information contained
+ * herein except pursuant to this license grant from Synopsys. If you
+ * do not agree with this notice, including the disclaimer below, then
+ * you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
+ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
+ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================= */
+
+/** @file
+ * This file contains the WUSB cryptographic routines.
+ */
+
+#ifdef DWC_CRYPTOLIB
+
+#include "dwc_crypto.h"
+#include "usb.h"
+
+#ifdef DEBUG
+static inline void dump_bytes(char *name, uint8_t *bytes, int len)
+{
+	int i;
+	DWC_PRINTF("%s: ", name);
+	for (i=0; i<len; i++) {
+		DWC_PRINTF("%02x ", bytes[i]);
+	}
+	DWC_PRINTF("\n");
+}
+#else
+#define dump_bytes(x...)
+#endif
+
+/* Display a block */
+void show_block(const u8 *blk, const char *prefix, const char *suffix, int a)
+{
+#ifdef DWC_DEBUG_CRYPTO
+	int i, blksize = 16;
+
+	DWC_DEBUG("%s", prefix);
+
+	if (suffix == NULL) {
+		suffix = "\n";
+		blksize = a;
+	}
+
+	for (i = 0; i < blksize; i++)
+		DWC_PRINT("%02x%s", *blk++, ((i & 3) == 3) ? "  " : " ");
+	DWC_PRINT(suffix);
+#endif
+}
+
+/**
+ * Encrypts an array of bytes using the AES encryption engine.
+ * If <code>dst</code> == <code>src</code>, then the bytes will be encrypted
+ * in-place.
+ *
+ * @return  0 on success, negative error code on error.
+ */
+int dwc_wusb_aes_encrypt(u8 *src, u8 *key, u8 *dst)
+{
+	u8 block_t[16];
+	DWC_MEMSET(block_t, 0, 16);
+
+	return DWC_AES_CBC(src, 16, key, 16, block_t, dst);
+}
+
+/**
+ * The CCM-MAC-FUNCTION described in section 6.5 of the WUSB spec.
+ * This function takes a data string and returns the encrypted CBC
+ * Counter-mode MIC.
+ *
+ * @param key     The 128-bit symmetric key.
+ * @param nonce   The CCM nonce.
+ * @param label   The unique 14-byte ASCII text label.
+ * @param bytes   The byte array to be encrypted.
+ * @param len     Length of the byte array.
+ * @param result  Byte array to receive the 8-byte encrypted MIC.
+ */
+void dwc_wusb_cmf(u8 *key, u8 *nonce,
+		  char *label, u8 *bytes, int len, u8 *result)
+{
+	u8 block_m[16];
+	u8 block_x[16];
+	u8 block_t[8];
+	int idx, blkNum;
+	u16 la = (u16)(len + 14);
+
+	/* Set the AES-128 key */
+	//dwc_aes_setkey(tfm, key, 16);
+
+	/* Fill block B0 from flags = 0x59, N, and l(m) = 0 */
+	block_m[0] = 0x59;
+	for (idx = 0; idx < 13; idx++)
+		block_m[idx + 1] = nonce[idx];
+	block_m[14] = 0;
+	block_m[15] = 0;
+
+	/* Produce the CBC IV */
+	dwc_wusb_aes_encrypt(block_m, key, block_x);
+	show_block(block_m, "CBC IV in: ", "\n", 0);
+	show_block(block_x, "CBC IV out:", "\n", 0);
+
+	/* Fill block B1 from l(a) = Blen + 14, and A */
+	block_x[0] ^= (u8)(la >> 8);
+	block_x[1] ^= (u8)la;
+	for (idx = 0; idx < 14; idx++)
+		block_x[idx + 2] ^= label[idx];
+	show_block(block_x, "After xor: ", "b1\n", 16);
+
+	dwc_wusb_aes_encrypt(block_x, key, block_x);
+	show_block(block_x, "After AES: ", "b1\n", 16);
+
+	idx = 0;
+	blkNum = 0;
+
+	/* Fill remaining blocks with B */
+	while (len-- > 0) {
+		block_x[idx] ^= *bytes++;
+		if (++idx >= 16) {
+			idx = 0;
+			show_block(block_x, "After xor: ", "\n", blkNum);
+			dwc_wusb_aes_encrypt(block_x, key, block_x);
+			show_block(block_x, "After AES: ", "\n", blkNum);
+			blkNum++;
+		}
+	}
+
+	/* Handle partial last block */
+	if (idx > 0) {
+		show_block(block_x, "After xor: ", "\n", blkNum);
+		dwc_wusb_aes_encrypt(block_x, key, block_x);
+		show_block(block_x, "After AES: ", "\n", blkNum);
+	}
+
+	/* Save the MIC tag */
+	DWC_MEMCPY(block_t, block_x, 8);
+	show_block(block_t, "MIC tag  : ", NULL, 8);
+
+	/* Fill block A0 from flags = 0x01, N, and counter = 0 */
+	block_m[0] = 0x01;
+	block_m[14] = 0;
+	block_m[15] = 0;
+
+	/* Encrypt the counter */
+	dwc_wusb_aes_encrypt(block_m, key, block_x);
+	show_block(block_x, "CTR[MIC] : ", NULL, 8);
+
+	/* XOR with MIC tag */
+	for (idx = 0; idx < 8; idx++) {
+		block_t[idx] ^= block_x[idx];
+	}
+
+	/* Return result to caller */
+	DWC_MEMCPY(result, block_t, 8);
+	show_block(result, "CCM-MIC  : ", NULL, 8);
+
+}
+
+/**
+ * The PRF function described in section 6.5 of the WUSB spec. This function
+ * concatenates MIC values returned from dwc_cmf() to create a value of
+ * the requested length.
+ *
+ * @param prf_len  Length of the PRF function in bits (64, 128, or 256).
+ * @param key, nonce, label, bytes, len  Same as for dwc_cmf().
+ * @param result   Byte array to receive the result.
+ */
+void dwc_wusb_prf(int prf_len, u8 *key,
+		  u8 *nonce, char *label, u8 *bytes, int len, u8 *result)
+{
+	int i;
+
+	nonce[0] = 0;
+	for (i = 0; i < prf_len >> 6; i++, nonce[0]++) {
+		dwc_wusb_cmf(key, nonce, label, bytes, len, result);
+		result += 8;
+	}
+}
+
+/**
+ * Fills in CCM Nonce per the WUSB spec.
+ *
+ * @param[in] haddr Host address.
+ * @param[in] daddr Device address.
+ * @param[in] tkid Session Key(PTK) identifier.
+ * @param[out] nonce Pointer to where the CCM Nonce output is to be written.
+ */
+void dwc_wusb_fill_ccm_nonce(uint16_t haddr, uint16_t daddr, uint8_t *tkid,
+			     uint8_t *nonce)
+{
+
+	DWC_DEBUG("%s %x %x\n", __func__, daddr, haddr);
+
+	DWC_MEMSET(&nonce[0], 0, 16);
+
+	DWC_MEMCPY(&nonce[6], tkid, 3);
+	nonce[9] = daddr & 0xFF;
+	nonce[10] = (daddr >> 8) & 0xFF;
+	nonce[11] = haddr & 0xFF;
+	nonce[12] = (haddr >> 8) & 0xFF;
+
+	dump_bytes("CCM nonce", nonce, 16);
+}
+
+/**
+ * Generates a 16-byte cryptographic-grade random number for the Host/Device
+ * Nonce.
+ */
+void dwc_wusb_gen_nonce(uint16_t addr, uint8_t *nonce)
+{
+	uint8_t inonce[16];
+	uint32_t temp[4];
+
+	/* Fill in the Nonce */
+	DWC_MEMSET(&inonce[0], 0, sizeof(inonce));
+	inonce[9] = addr & 0xFF;
+	inonce[10] = (addr >> 8) & 0xFF;
+	inonce[11] = inonce[9];
+	inonce[12] = inonce[10];
+
+	/* Collect "randomness samples" */
+	DWC_RANDOM_BYTES((uint8_t *)temp, 16);
+
+	dwc_wusb_prf_128((uint8_t *)temp, nonce,
+			 "Random Numbers", (uint8_t *)temp, sizeof(temp),
+			 nonce);
+}
+
+/**
+ * Generates the Session Key (PTK) and Key Confirmation Key (KCK) per the
+ * WUSB spec.
+ *
+ * @param[in] ccm_nonce Pointer to CCM Nonce.
+ * @param[in] mk Master Key to derive the session from
+ * @param[in] hnonce Pointer to Host Nonce.
+ * @param[in] dnonce Pointer to Device Nonce.
+ * @param[out] kck Pointer to where the KCK output is to be written.
+ * @param[out] ptk Pointer to where the PTK output is to be written.
+ */
+void dwc_wusb_gen_key(uint8_t *ccm_nonce, uint8_t *mk, uint8_t *hnonce,
+		      uint8_t *dnonce, uint8_t *kck, uint8_t *ptk)
+{
+	uint8_t idata[32];
+	uint8_t odata[32];
+
+	dump_bytes("ck", mk, 16);
+	dump_bytes("hnonce", hnonce, 16);
+	dump_bytes("dnonce", dnonce, 16);
+
+	/* The data is the HNonce and DNonce concatenated */
+	DWC_MEMCPY(&idata[0], hnonce, 16);
+	DWC_MEMCPY(&idata[16], dnonce, 16);
+
+	dwc_wusb_prf_256(mk, ccm_nonce, "Pair-wise keys", idata, 32, odata);
+
+	/* Low 16 bytes of the result is the KCK, high 16 is the PTK */
+	DWC_MEMCPY(kck, &odata[0], 16);
+	DWC_MEMCPY(ptk, &odata[16], 16);
+
+	dump_bytes("kck", kck, 16);
+	dump_bytes("ptk", ptk, 16);
+}
+
+/**
+ * Generates the Message Integrity Code over the Handshake data per the
+ * WUSB spec.
+ *
+ * @param ccm_nonce Pointer to CCM Nonce.
+ * @param kck   Pointer to Key Confirmation Key.
+ * @param data  Pointer to Handshake data to be checked.
+ * @param mic   Pointer to where the MIC output is to be written.
+ */
+void dwc_wusb_gen_mic(uint8_t *ccm_nonce, uint8_t *kck,
+		      uint8_t *data, uint8_t *mic)
+{
+
+	dwc_wusb_prf_64(kck, ccm_nonce, "out-of-bandMIC",
+			data, WUSB_HANDSHAKE_LEN_FOR_MIC, mic);
+}
+
+#endif	/* DWC_CRYPTOLIB */
diff --git a/drivers/usb/host/dwc_common_port/dwc_crypto.h b/drivers/usb/host/dwc_common_port/dwc_crypto.h
new file mode 100644
index 000000000000..26fcddcfe9ba
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_crypto.h
@@ -0,0 +1,111 @@
+/* =========================================================================
+ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_crypto.h $
+ * $Revision: #3 $
+ * $Date: 2010/09/28 $
+ * $Change: 1596182 $
+ *
+ * Synopsys Portability Library Software and documentation
+ * (hereinafter, "Software") is an Unsupported proprietary work of
+ * Synopsys, Inc. unless otherwise expressly agreed to in writing
+ * between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product
+ * under any End User Software License Agreement or Agreement for
+ * Licensed Product with Synopsys or any supplement thereto. You are
+ * permitted to use and redistribute this Software in source and binary
+ * forms, with or without modification, provided that redistributions
+ * of source code must retain this notice. You may not view, use,
+ * disclose, copy or distribute this file or any information contained
+ * herein except pursuant to this license grant from Synopsys. If you
+ * do not agree with this notice, including the disclaimer below, then
+ * you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
+ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
+ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================= */
+
+#ifndef _DWC_CRYPTO_H_
+#define _DWC_CRYPTO_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** @file
+ *
+ * This file contains declarations for the WUSB Cryptographic routines as
+ * defined in the WUSB spec.  They are only to be used internally by the DWC UWB
+ * modules.
+ */
+
+#include "dwc_os.h"
+
+int dwc_wusb_aes_encrypt(u8 *src, u8 *key, u8 *dst);
+
+void dwc_wusb_cmf(u8 *key, u8 *nonce,
+		  char *label, u8 *bytes, int len, u8 *result);
+void dwc_wusb_prf(int prf_len, u8 *key,
+		  u8 *nonce, char *label, u8 *bytes, int len, u8 *result);
+
+/**
+ * The PRF-64 function described in section 6.5 of the WUSB spec.
+ *
+ * @param key, nonce, label, bytes, len, result  Same as for dwc_prf().
+ */
+static inline void dwc_wusb_prf_64(u8 *key, u8 *nonce,
+				   char *label, u8 *bytes, int len, u8 *result)
+{
+	dwc_wusb_prf(64, key, nonce, label, bytes, len, result);
+}
+
+/**
+ * The PRF-128 function described in section 6.5 of the WUSB spec.
+ *
+ * @param key, nonce, label, bytes, len, result  Same as for dwc_prf().
+ */
+static inline void dwc_wusb_prf_128(u8 *key, u8 *nonce,
+				    char *label, u8 *bytes, int len, u8 *result)
+{
+	dwc_wusb_prf(128, key, nonce, label, bytes, len, result);
+}
+
+/**
+ * The PRF-256 function described in section 6.5 of the WUSB spec.
+ *
+ * @param key, nonce, label, bytes, len, result  Same as for dwc_prf().
+ */
+static inline void dwc_wusb_prf_256(u8 *key, u8 *nonce,
+				    char *label, u8 *bytes, int len, u8 *result)
+{
+	dwc_wusb_prf(256, key, nonce, label, bytes, len, result);
+}
+
+
+void dwc_wusb_fill_ccm_nonce(uint16_t haddr, uint16_t daddr, uint8_t *tkid,
+			       uint8_t *nonce);
+void dwc_wusb_gen_nonce(uint16_t addr,
+			  uint8_t *nonce);
+
+void dwc_wusb_gen_key(uint8_t *ccm_nonce, uint8_t *mk,
+			uint8_t *hnonce, uint8_t *dnonce,
+			uint8_t *kck, uint8_t *ptk);
+
+
+void dwc_wusb_gen_mic(uint8_t *ccm_nonce, uint8_t
+			*kck, uint8_t *data, uint8_t *mic);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _DWC_CRYPTO_H_ */
diff --git a/drivers/usb/host/dwc_common_port/dwc_dh.c b/drivers/usb/host/dwc_common_port/dwc_dh.c
new file mode 100644
index 000000000000..2b429a32aaf0
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_dh.c
@@ -0,0 +1,291 @@
+/* =========================================================================
+ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_dh.c $
+ * $Revision: #3 $
+ * $Date: 2010/09/28 $
+ * $Change: 1596182 $
+ *
+ * Synopsys Portability Library Software and documentation
+ * (hereinafter, "Software") is an Unsupported proprietary work of
+ * Synopsys, Inc. unless otherwise expressly agreed to in writing
+ * between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product
+ * under any End User Software License Agreement or Agreement for
+ * Licensed Product with Synopsys or any supplement thereto. You are
+ * permitted to use and redistribute this Software in source and binary
+ * forms, with or without modification, provided that redistributions
+ * of source code must retain this notice. You may not view, use,
+ * disclose, copy or distribute this file or any information contained
+ * herein except pursuant to this license grant from Synopsys. If you
+ * do not agree with this notice, including the disclaimer below, then
+ * you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
+ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
+ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================= */
+#ifdef DWC_CRYPTOLIB
+
+#ifndef CONFIG_MACH_IPMATE
+
+#include "dwc_dh.h"
+#include "dwc_modpow.h"
+
+#ifdef DEBUG
+/* This function prints out a buffer in the format described in the Association
+ * Model specification. */
+static void dh_dump(char *str, void *_num, int len)
+{
+	uint8_t *num = _num;
+	int i;
+	DWC_PRINTF("%s\n", str);
+	for (i = 0; i < len; i ++) {
+		DWC_PRINTF("%02x", num[i]);
+		if (((i + 1) % 2) == 0) DWC_PRINTF(" ");
+		if (((i + 1) % 26) == 0) DWC_PRINTF("\n");
+	}
+
+	DWC_PRINTF("\n");
+}
+#else
+#define dh_dump(_x...) do {; } while(0)
+#endif
+
+/* Constant g value */
+static __u32 dh_g[] = {
+	0x02000000,
+};
+
+/* Constant p value */
+static __u32 dh_p[] = {
+	0xFFFFFFFF, 0xFFFFFFFF, 0xA2DA0FC9, 0x34C26821, 0x8B62C6C4, 0xD11CDC80, 0x084E0229, 0x74CC678A,
+	0xA6BE0B02, 0x229B133B, 0x79084A51, 0xDD04348E, 0xB31995EF, 0x1B433ACD, 0x6D0A2B30, 0x37145FF2,
+	0x6D35E14F, 0x45C2516D, 0x76B585E4, 0xC67E5E62, 0xE9424CF4, 0x6BED37A6, 0xB65CFF0B, 0xEDB706F4,
+	0xFB6B38EE, 0xA59F895A, 0x11249FAE, 0xE61F4B7C, 0x51662849, 0x3D5BE4EC, 0xB87C00C2, 0x05BF63A1,
+	0x3648DA98, 0x9AD3551C, 0xA83F1669, 0x5FCF24FD, 0x235D6583, 0x96ADA3DC, 0x56F3621C, 0xBB528520,
+	0x0729D59E, 0x6D969670, 0x4E350C67, 0x0498BC4A, 0x086C74F1, 0x7C2118CA, 0x465E9032, 0x3BCE362E,
+	0x2C779EE3, 0x03860E18, 0xA283279B, 0x8FA207EC, 0xF05DC5B5, 0xC9524C6F, 0xF6CB2BDE, 0x18175895,
+	0x7C499539, 0xE56A95EA, 0x1826D215, 0x1005FA98, 0x5A8E7215, 0x2DC4AA8A, 0x0D1733AD, 0x337A5004,
+	0xAB2155A8, 0x64BA1CDF, 0x0485FBEC, 0x0AEFDB58, 0x5771EA8A, 0x7D0C065D, 0x850F97B3, 0xC7E4E1A6,
+	0x8CAEF5AB, 0xD73309DB, 0xE0948C1E, 0x9D61254A, 0x26D2E3CE, 0x6BEED21A, 0x06FA2FF1, 0x64088AD9,
+	0x730276D8, 0x646AC83E, 0x182B1F52, 0x0C207B17, 0x5717E1BB, 0x6C5D617A, 0xC0880977, 0xE246D9BA,
+	0xA04FE208, 0x31ABE574, 0xFC5BDB43, 0x8E10FDE0, 0x20D1824B, 0xCAD23AA9, 0xFFFFFFFF, 0xFFFFFFFF,
+};
+
+static void dh_swap_bytes(void *_in, void *_out, uint32_t len)
+{
+	uint8_t *in = _in;
+	uint8_t *out = _out;
+	int i;
+	for (i=0; i<len; i++) {
+		out[i] = in[len-1-i];
+	}
+}
+
+/* Computes the modular exponentiation (num^exp % mod).  num, exp, and mod are
+ * big endian numbers of size len, in bytes.  Each len value must be a multiple
+ * of 4. */
+int dwc_dh_modpow(void *mem_ctx, void *num, uint32_t num_len,
+		  void *exp, uint32_t exp_len,
+		  void *mod, uint32_t mod_len,
+		  void *out)
+{
+	/* modpow() takes little endian numbers.  AM uses big-endian.  This
+	 * function swaps bytes of numbers before passing onto modpow. */
+
+	int retval = 0;
+	uint32_t *result;
+
+	uint32_t *bignum_num = dwc_alloc(mem_ctx, num_len + 4);
+	uint32_t *bignum_exp = dwc_alloc(mem_ctx, exp_len + 4);
+	uint32_t *bignum_mod = dwc_alloc(mem_ctx, mod_len + 4);
+
+	dh_swap_bytes(num, &bignum_num[1], num_len);
+	bignum_num[0] = num_len / 4;
+
+	dh_swap_bytes(exp, &bignum_exp[1], exp_len);
+	bignum_exp[0] = exp_len / 4;
+
+	dh_swap_bytes(mod, &bignum_mod[1], mod_len);
+	bignum_mod[0] = mod_len / 4;
+
+	result = dwc_modpow(mem_ctx, bignum_num, bignum_exp, bignum_mod);
+	if (!result) {
+		retval = -1;
+		goto dh_modpow_nomem;
+	}
+
+	dh_swap_bytes(&result[1], out, result[0] * 4);
+	dwc_free(mem_ctx, result);
+
+ dh_modpow_nomem:
+	dwc_free(mem_ctx, bignum_num);
+	dwc_free(mem_ctx, bignum_exp);
+	dwc_free(mem_ctx, bignum_mod);
+	return retval;
+}
+
+
+int dwc_dh_pk(void *mem_ctx, uint8_t nd, uint8_t *exp, uint8_t *pk, uint8_t *hash)
+{
+	int retval;
+	uint8_t m3[385];
+
+#ifndef DH_TEST_VECTORS
+	DWC_RANDOM_BYTES(exp, 32);
+#endif
+
+	/* Compute the pkd */
+	if ((retval = dwc_dh_modpow(mem_ctx, dh_g, 4,
+				    exp, 32,
+				    dh_p, 384, pk))) {
+		return retval;
+	}
+
+	m3[384] = nd;
+	DWC_MEMCPY(&m3[0], pk, 384);
+	DWC_SHA256(m3, 385, hash);
+
+	dh_dump("PK", pk, 384);
+	dh_dump("SHA-256(M3)", hash, 32);
+	return 0;
+}
+
+int dwc_dh_derive_keys(void *mem_ctx, uint8_t nd, uint8_t *pkh, uint8_t *pkd,
+		       uint8_t *exp, int is_host,
+		       char *dd, uint8_t *ck, uint8_t *kdk)
+{
+	int retval;
+	uint8_t mv[784];
+	uint8_t sha_result[32];
+	uint8_t dhkey[384];
+	uint8_t shared_secret[384];
+	char *message;
+	uint32_t vd;
+
+	uint8_t *pk;
+
+	if (is_host) {
+		pk = pkd;
+	}
+	else {
+		pk = pkh;
+	}
+
+	if ((retval = dwc_dh_modpow(mem_ctx, pk, 384,
+				    exp, 32,
+				    dh_p, 384, shared_secret))) {
+		return retval;
+	}
+	dh_dump("Shared Secret", shared_secret, 384);
+
+	DWC_SHA256(shared_secret, 384, dhkey);
+	dh_dump("DHKEY", dhkey, 384);
+
+	DWC_MEMCPY(&mv[0], pkd, 384);
+	DWC_MEMCPY(&mv[384], pkh, 384);
+	DWC_MEMCPY(&mv[768], "displayed digest", 16);
+	dh_dump("MV", mv, 784);
+
+	DWC_SHA256(mv, 784, sha_result);
+	dh_dump("SHA-256(MV)", sha_result, 32);
+	dh_dump("First 32-bits of SHA-256(MV)", sha_result, 4);
+
+	dh_swap_bytes(sha_result, &vd, 4);
+#ifdef DEBUG
+	DWC_PRINTF("Vd (decimal) = %d\n", vd);
+#endif
+
+	switch (nd) {
+	case 2:
+		vd = vd % 100;
+		DWC_SPRINTF(dd, "%02d", vd);
+		break;
+	case 3:
+		vd = vd % 1000;
+		DWC_SPRINTF(dd, "%03d", vd);
+		break;
+	case 4:
+		vd = vd % 10000;
+		DWC_SPRINTF(dd, "%04d", vd);
+		break;
+	}
+#ifdef DEBUG
+	DWC_PRINTF("Display Digits: %s\n", dd);
+#endif
+
+	message = "connection key";
+	DWC_HMAC_SHA256(message, DWC_STRLEN(message), dhkey, 32, sha_result);
+	dh_dump("HMAC(SHA-256, DHKey, connection key)", sha_result, 32);
+	DWC_MEMCPY(ck, sha_result, 16);
+
+	message = "key derivation key";
+	DWC_HMAC_SHA256(message, DWC_STRLEN(message), dhkey, 32, sha_result);
+	dh_dump("HMAC(SHA-256, DHKey, key derivation key)", sha_result, 32);
+	DWC_MEMCPY(kdk, sha_result, 32);
+
+	return 0;
+}
+
+
+#ifdef DH_TEST_VECTORS
+
+static __u8 dh_a[] = {
+	0x44, 0x00, 0x51, 0xd6,
+	0xf0, 0xb5, 0x5e, 0xa9,
+	0x67, 0xab, 0x31, 0xc6,
+	0x8a, 0x8b, 0x5e, 0x37,
+	0xd9, 0x10, 0xda, 0xe0,
+	0xe2, 0xd4, 0x59, 0xa4,
+	0x86, 0x45, 0x9c, 0xaa,
+	0xdf, 0x36, 0x75, 0x16,
+};
+
+static __u8 dh_b[] = {
+	0x5d, 0xae, 0xc7, 0x86,
+	0x79, 0x80, 0xa3, 0x24,
+	0x8c, 0xe3, 0x57, 0x8f,
+	0xc7, 0x5f, 0x1b, 0x0f,
+	0x2d, 0xf8, 0x9d, 0x30,
+	0x6f, 0xa4, 0x52, 0xcd,
+	0xe0, 0x7a, 0x04, 0x8a,
+	0xde, 0xd9, 0x26, 0x56,
+};
+
+void dwc_run_dh_test_vectors(void *mem_ctx)
+{
+	uint8_t pkd[384];
+	uint8_t pkh[384];
+	uint8_t hashd[32];
+	uint8_t hashh[32];
+	uint8_t ck[16];
+	uint8_t kdk[32];
+	char dd[5];
+
+	DWC_PRINTF("\n\n\nDH_TEST_VECTORS\n\n");
+
+	/* compute the PKd and SHA-256(PKd || Nd) */
+	DWC_PRINTF("Computing PKd\n");
+	dwc_dh_pk(mem_ctx, 2, dh_a, pkd, hashd);
+
+	/* compute the PKd and SHA-256(PKh || Nd) */
+	DWC_PRINTF("Computing PKh\n");
+	dwc_dh_pk(mem_ctx, 2, dh_b, pkh, hashh);
+
+	/* compute the dhkey */
+	dwc_dh_derive_keys(mem_ctx, 2, pkh, pkd, dh_a, 0, dd, ck, kdk);
+}
+#endif /* DH_TEST_VECTORS */
+
+#endif /* !CONFIG_MACH_IPMATE */
+
+#endif /* DWC_CRYPTOLIB */
diff --git a/drivers/usb/host/dwc_common_port/dwc_dh.h b/drivers/usb/host/dwc_common_port/dwc_dh.h
new file mode 100644
index 000000000000..25c1cc0d588a
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_dh.h
@@ -0,0 +1,106 @@
+/* =========================================================================
+ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_dh.h $
+ * $Revision: #4 $
+ * $Date: 2010/09/28 $
+ * $Change: 1596182 $
+ *
+ * Synopsys Portability Library Software and documentation
+ * (hereinafter, "Software") is an Unsupported proprietary work of
+ * Synopsys, Inc. unless otherwise expressly agreed to in writing
+ * between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product
+ * under any End User Software License Agreement or Agreement for
+ * Licensed Product with Synopsys or any supplement thereto. You are
+ * permitted to use and redistribute this Software in source and binary
+ * forms, with or without modification, provided that redistributions
+ * of source code must retain this notice. You may not view, use,
+ * disclose, copy or distribute this file or any information contained
+ * herein except pursuant to this license grant from Synopsys. If you
+ * do not agree with this notice, including the disclaimer below, then
+ * you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
+ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
+ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================= */
+#ifndef _DWC_DH_H_
+#define _DWC_DH_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "dwc_os.h"
+
+/** @file
+ *
+ * This file defines the common functions on device and host for performing
+ * numeric association as defined in the WUSB spec.  They are only to be
+ * used internally by the DWC UWB modules. */
+
+extern int dwc_dh_sha256(uint8_t *message, uint32_t len, uint8_t *out);
+extern int dwc_dh_hmac_sha256(uint8_t *message, uint32_t messagelen,
+			      uint8_t *key, uint32_t keylen,
+			      uint8_t *out);
+extern int dwc_dh_modpow(void *mem_ctx, void *num, uint32_t num_len,
+			 void *exp, uint32_t exp_len,
+			 void *mod, uint32_t mod_len,
+			 void *out);
+
+/** Computes PKD or PKH, and SHA-256(PKd || Nd)
+ *
+ * PK = g^exp mod p.
+ *
+ * Input:
+ * Nd = Number of digits on the device.
+ *
+ * Output:
+ * exp = A 32-byte buffer to be filled with a randomly generated number.
+ *       used as either A or B.
+ * pk = A 384-byte buffer to be filled with the PKH or PKD.
+ * hash = A 32-byte buffer to be filled with SHA-256(PK || ND).
+ */
+extern int dwc_dh_pk(void *mem_ctx, uint8_t nd, uint8_t *exp, uint8_t *pkd, uint8_t *hash);
+
+/** Computes the DHKEY, and VD.
+ *
+ * If called from host, then it will comput DHKEY=PKD^exp % p.
+ * If called from device, then it will comput DHKEY=PKH^exp % p.
+ *
+ * Input:
+ * pkd = The PKD value.
+ * pkh = The PKH value.
+ * exp = The A value (if device) or B value (if host) generated in dwc_wudev_dh_pk.
+ * is_host = Set to non zero if a WUSB host is calling this function.
+ *
+ * Output:
+
+ * dd = A pointer to an buffer to be set to the displayed digits string to be shown
+ *      to the user.  This buffer should be at 5 bytes long to hold 4 digits plus a
+ *      null termination character.  This buffer can be used directly for display.
+ * ck = A 16-byte buffer to be filled with the CK.
+ * kdk = A 32-byte buffer to be filled with the KDK.
+ */
+extern int dwc_dh_derive_keys(void *mem_ctx, uint8_t nd, uint8_t *pkh, uint8_t *pkd,
+			      uint8_t *exp, int is_host,
+			      char *dd, uint8_t *ck, uint8_t *kdk);
+
+#ifdef DH_TEST_VECTORS
+extern void dwc_run_dh_test_vectors(void);
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _DWC_DH_H_ */
diff --git a/drivers/usb/host/dwc_common_port/dwc_list.h b/drivers/usb/host/dwc_common_port/dwc_list.h
new file mode 100644
index 000000000000..4ce560df0cae
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_list.h
@@ -0,0 +1,594 @@
+/*	$OpenBSD: queue.h,v 1.26 2004/05/04 16:59:32 grange Exp $	*/
+/*	$NetBSD: queue.h,v 1.11 1996/05/16 05:17:14 mycroft Exp $	*/
+
+/*
+ * Copyright (c) 1991, 1993
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ *	@(#)queue.h	8.5 (Berkeley) 8/20/94
+ */
+
+#ifndef _DWC_LIST_H_
+#define _DWC_LIST_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** @file
+ *
+ * This file defines linked list operations.  It is derived from BSD with
+ * only the MACRO names being prefixed with DWC_.  This is because a few of
+ * these names conflict with those on Linux.  For documentation on use, see the
+ * inline comments in the source code.  The original license for this source
+ * code applies and is preserved in the dwc_list.h source file.
+ */
+
+/*
+ * This file defines five types of data structures: singly-linked lists,
+ * lists, simple queues, tail queues, and circular queues.
+ *
+ *
+ * A singly-linked list is headed by a single forward pointer. The elements
+ * are singly linked for minimum space and pointer manipulation overhead at
+ * the expense of O(n) removal for arbitrary elements. New elements can be
+ * added to the list after an existing element or at the head of the list.
+ * Elements being removed from the head of the list should use the explicit
+ * macro for this purpose for optimum efficiency. A singly-linked list may
+ * only be traversed in the forward direction.  Singly-linked lists are ideal
+ * for applications with large datasets and few or no removals or for
+ * implementing a LIFO queue.
+ *
+ * A list is headed by a single forward pointer (or an array of forward
+ * pointers for a hash table header). The elements are doubly linked
+ * so that an arbitrary element can be removed without a need to
+ * traverse the list. New elements can be added to the list before
+ * or after an existing element or at the head of the list. A list
+ * may only be traversed in the forward direction.
+ *
+ * A simple queue is headed by a pair of pointers, one the head of the
+ * list and the other to the tail of the list. The elements are singly
+ * linked to save space, so elements can only be removed from the
+ * head of the list. New elements can be added to the list before or after
+ * an existing element, at the head of the list, or at the end of the
+ * list. A simple queue may only be traversed in the forward direction.
+ *
+ * A tail queue is headed by a pair of pointers, one to the head of the
+ * list and the other to the tail of the list. The elements are doubly
+ * linked so that an arbitrary element can be removed without a need to
+ * traverse the list. New elements can be added to the list before or
+ * after an existing element, at the head of the list, or at the end of
+ * the list. A tail queue may be traversed in either direction.
+ *
+ * A circle queue is headed by a pair of pointers, one to the head of the
+ * list and the other to the tail of the list. The elements are doubly
+ * linked so that an arbitrary element can be removed without a need to
+ * traverse the list. New elements can be added to the list before or after
+ * an existing element, at the head of the list, or at the end of the list.
+ * A circle queue may be traversed in either direction, but has a more
+ * complex end of list detection.
+ *
+ * For details on the use of these macros, see the queue(3) manual page.
+ */
+
+/*
+ * Double-linked List.
+ */
+
+typedef struct dwc_list_link {
+	struct dwc_list_link *next;
+	struct dwc_list_link *prev;
+} dwc_list_link_t;
+
+#define DWC_LIST_INIT(link) do {	\
+	(link)->next = (link);		\
+	(link)->prev = (link);		\
+} while (0)
+
+#define DWC_LIST_FIRST(link)	((link)->next)
+#define DWC_LIST_LAST(link)	((link)->prev)
+#define DWC_LIST_END(link)	(link)
+#define DWC_LIST_NEXT(link)	((link)->next)
+#define DWC_LIST_PREV(link)	((link)->prev)
+#define DWC_LIST_EMPTY(link)	\
+	(DWC_LIST_FIRST(link) == DWC_LIST_END(link))
+#define DWC_LIST_ENTRY(link, type, field)			\
+	(type *)((uint8_t *)(link) - (size_t)(&((type *)0)->field))
+
+#if 0
+#define DWC_LIST_INSERT_HEAD(list, link) do {			\
+	(link)->next = (list)->next;				\
+	(link)->prev = (list);					\
+	(list)->next->prev = (link);				\
+	(list)->next = (link);					\
+} while (0)
+
+#define DWC_LIST_INSERT_TAIL(list, link) do {			\
+	(link)->next = (list);					\
+	(link)->prev = (list)->prev;				\
+	(list)->prev->next = (link);				\
+	(list)->prev = (link);					\
+} while (0)
+#else
+#define DWC_LIST_INSERT_HEAD(list, link) do {			\
+	dwc_list_link_t *__next__ = (list)->next;		\
+	__next__->prev = (link);				\
+	(link)->next = __next__;				\
+	(link)->prev = (list);					\
+	(list)->next = (link);					\
+} while (0)
+
+#define DWC_LIST_INSERT_TAIL(list, link) do {			\
+	dwc_list_link_t *__prev__ = (list)->prev;		\
+	(list)->prev = (link);					\
+	(link)->next = (list);					\
+	(link)->prev = __prev__;				\
+	__prev__->next = (link);				\
+} while (0)
+#endif
+
+#if 0
+static inline void __list_add(struct list_head *new,
+                              struct list_head *prev,
+                              struct list_head *next)
+{
+        next->prev = new;
+        new->next = next;
+        new->prev = prev;
+        prev->next = new;
+}
+
+static inline void list_add(struct list_head *new, struct list_head *head)
+{
+        __list_add(new, head, head->next);
+}
+
+static inline void list_add_tail(struct list_head *new, struct list_head *head)
+{
+        __list_add(new, head->prev, head);
+}
+
+static inline void __list_del(struct list_head * prev, struct list_head * next)
+{
+        next->prev = prev;
+        prev->next = next;
+}
+
+static inline void list_del(struct list_head *entry)
+{
+        __list_del(entry->prev, entry->next);
+        entry->next = LIST_POISON1;
+        entry->prev = LIST_POISON2;
+}
+#endif
+
+#define DWC_LIST_REMOVE(link) do {				\
+	(link)->next->prev = (link)->prev;			\
+	(link)->prev->next = (link)->next;			\
+} while (0)
+
+#define DWC_LIST_REMOVE_INIT(link) do {				\
+	DWC_LIST_REMOVE(link);					\
+	DWC_LIST_INIT(link);					\
+} while (0)
+
+#define DWC_LIST_MOVE_HEAD(list, link) do {			\
+	DWC_LIST_REMOVE(link);					\
+	DWC_LIST_INSERT_HEAD(list, link);			\
+} while (0)
+
+#define DWC_LIST_MOVE_TAIL(list, link) do {			\
+	DWC_LIST_REMOVE(link);					\
+	DWC_LIST_INSERT_TAIL(list, link);			\
+} while (0)
+
+#define DWC_LIST_FOREACH(var, list)				\
+	for((var) = DWC_LIST_FIRST(list);			\
+	    (var) != DWC_LIST_END(list);			\
+	    (var) = DWC_LIST_NEXT(var))
+
+#define DWC_LIST_FOREACH_SAFE(var, var2, list)			\
+	for((var) = DWC_LIST_FIRST(list), (var2) = DWC_LIST_NEXT(var);	\
+	    (var) != DWC_LIST_END(list);			\
+	    (var) = (var2), (var2) = DWC_LIST_NEXT(var2))
+
+#define DWC_LIST_FOREACH_REVERSE(var, list)			\
+	for((var) = DWC_LIST_LAST(list);			\
+	    (var) != DWC_LIST_END(list);			\
+	    (var) = DWC_LIST_PREV(var))
+
+/*
+ * Singly-linked List definitions.
+ */
+#define DWC_SLIST_HEAD(name, type)					\
+struct name {								\
+	struct type *slh_first;	/* first element */			\
+}
+
+#define DWC_SLIST_HEAD_INITIALIZER(head)				\
+	{ NULL }
+
+#define DWC_SLIST_ENTRY(type)						\
+struct {								\
+	struct type *sle_next;	/* next element */			\
+}
+
+/*
+ * Singly-linked List access methods.
+ */
+#define DWC_SLIST_FIRST(head)	((head)->slh_first)
+#define DWC_SLIST_END(head)		NULL
+#define DWC_SLIST_EMPTY(head)	(SLIST_FIRST(head) == SLIST_END(head))
+#define DWC_SLIST_NEXT(elm, field)	((elm)->field.sle_next)
+
+#define DWC_SLIST_FOREACH(var, head, field)				\
+	for((var) = SLIST_FIRST(head);					\
+	    (var) != SLIST_END(head);					\
+	    (var) = SLIST_NEXT(var, field))
+
+#define DWC_SLIST_FOREACH_PREVPTR(var, varp, head, field)		\
+	for((varp) = &SLIST_FIRST((head));				\
+	    ((var) = *(varp)) != SLIST_END(head);			\
+	    (varp) = &SLIST_NEXT((var), field))
+
+/*
+ * Singly-linked List functions.
+ */
+#define DWC_SLIST_INIT(head) {						\
+	SLIST_FIRST(head) = SLIST_END(head);				\
+}
+
+#define DWC_SLIST_INSERT_AFTER(slistelm, elm, field) do {		\
+	(elm)->field.sle_next = (slistelm)->field.sle_next;		\
+	(slistelm)->field.sle_next = (elm);				\
+} while (0)
+
+#define DWC_SLIST_INSERT_HEAD(head, elm, field) do {			\
+	(elm)->field.sle_next = (head)->slh_first;			\
+	(head)->slh_first = (elm);					\
+} while (0)
+
+#define DWC_SLIST_REMOVE_NEXT(head, elm, field) do {			\
+	(elm)->field.sle_next = (elm)->field.sle_next->field.sle_next;	\
+} while (0)
+
+#define DWC_SLIST_REMOVE_HEAD(head, field) do {				\
+	(head)->slh_first = (head)->slh_first->field.sle_next;		\
+} while (0)
+
+#define DWC_SLIST_REMOVE(head, elm, type, field) do {			\
+	if ((head)->slh_first == (elm)) {				\
+		SLIST_REMOVE_HEAD((head), field);			\
+	}								\
+	else {								\
+		struct type *curelm = (head)->slh_first;		\
+		while( curelm->field.sle_next != (elm) )		\
+			curelm = curelm->field.sle_next;		\
+		curelm->field.sle_next =				\
+		    curelm->field.sle_next->field.sle_next;		\
+	}								\
+} while (0)
+
+/*
+ * Simple queue definitions.
+ */
+#define DWC_SIMPLEQ_HEAD(name, type)					\
+struct name {								\
+	struct type *sqh_first;	/* first element */			\
+	struct type **sqh_last;	/* addr of last next element */		\
+}
+
+#define DWC_SIMPLEQ_HEAD_INITIALIZER(head)				\
+	{ NULL, &(head).sqh_first }
+
+#define DWC_SIMPLEQ_ENTRY(type)						\
+struct {								\
+	struct type *sqe_next;	/* next element */			\
+}
+
+/*
+ * Simple queue access methods.
+ */
+#define DWC_SIMPLEQ_FIRST(head)	    ((head)->sqh_first)
+#define DWC_SIMPLEQ_END(head)	    NULL
+#define DWC_SIMPLEQ_EMPTY(head)	    (SIMPLEQ_FIRST(head) == SIMPLEQ_END(head))
+#define DWC_SIMPLEQ_NEXT(elm, field)    ((elm)->field.sqe_next)
+
+#define DWC_SIMPLEQ_FOREACH(var, head, field)				\
+	for((var) = SIMPLEQ_FIRST(head);				\
+	    (var) != SIMPLEQ_END(head);					\
+	    (var) = SIMPLEQ_NEXT(var, field))
+
+/*
+ * Simple queue functions.
+ */
+#define DWC_SIMPLEQ_INIT(head) do {					\
+	(head)->sqh_first = NULL;					\
+	(head)->sqh_last = &(head)->sqh_first;				\
+} while (0)
+
+#define DWC_SIMPLEQ_INSERT_HEAD(head, elm, field) do {			\
+	if (((elm)->field.sqe_next = (head)->sqh_first) == NULL)	\
+		(head)->sqh_last = &(elm)->field.sqe_next;		\
+	(head)->sqh_first = (elm);					\
+} while (0)
+
+#define DWC_SIMPLEQ_INSERT_TAIL(head, elm, field) do {			\
+	(elm)->field.sqe_next = NULL;					\
+	*(head)->sqh_last = (elm);					\
+	(head)->sqh_last = &(elm)->field.sqe_next;			\
+} while (0)
+
+#define DWC_SIMPLEQ_INSERT_AFTER(head, listelm, elm, field) do {	\
+	if (((elm)->field.sqe_next = (listelm)->field.sqe_next) == NULL)\
+		(head)->sqh_last = &(elm)->field.sqe_next;		\
+	(listelm)->field.sqe_next = (elm);				\
+} while (0)
+
+#define DWC_SIMPLEQ_REMOVE_HEAD(head, field) do {			\
+	if (((head)->sqh_first = (head)->sqh_first->field.sqe_next) == NULL) \
+		(head)->sqh_last = &(head)->sqh_first;			\
+} while (0)
+
+/*
+ * Tail queue definitions.
+ */
+#define DWC_TAILQ_HEAD(name, type)					\
+struct name {								\
+	struct type *tqh_first;	/* first element */			\
+	struct type **tqh_last;	/* addr of last next element */		\
+}
+
+#define DWC_TAILQ_HEAD_INITIALIZER(head)				\
+	{ NULL, &(head).tqh_first }
+
+#define DWC_TAILQ_ENTRY(type)						\
+struct {								\
+	struct type *tqe_next;	/* next element */			\
+	struct type **tqe_prev;	/* address of previous next element */	\
+}
+
+/*
+ * tail queue access methods
+ */
+#define DWC_TAILQ_FIRST(head)		((head)->tqh_first)
+#define DWC_TAILQ_END(head)		NULL
+#define DWC_TAILQ_NEXT(elm, field)	((elm)->field.tqe_next)
+#define DWC_TAILQ_LAST(head, headname)					\
+	(*(((struct headname *)((head)->tqh_last))->tqh_last))
+/* XXX */
+#define DWC_TAILQ_PREV(elm, headname, field)				\
+	(*(((struct headname *)((elm)->field.tqe_prev))->tqh_last))
+#define DWC_TAILQ_EMPTY(head)						\
+	(DWC_TAILQ_FIRST(head) == DWC_TAILQ_END(head))
+
+#define DWC_TAILQ_FOREACH(var, head, field)				\
+	for ((var) = DWC_TAILQ_FIRST(head);				\
+	    (var) != DWC_TAILQ_END(head);				\
+	    (var) = DWC_TAILQ_NEXT(var, field))
+
+#define DWC_TAILQ_FOREACH_REVERSE(var, head, headname, field)		\
+	for ((var) = DWC_TAILQ_LAST(head, headname);			\
+	    (var) != DWC_TAILQ_END(head);				\
+	    (var) = DWC_TAILQ_PREV(var, headname, field))
+
+/*
+ * Tail queue functions.
+ */
+#define DWC_TAILQ_INIT(head) do {					\
+	(head)->tqh_first = NULL;					\
+	(head)->tqh_last = &(head)->tqh_first;				\
+} while (0)
+
+#define DWC_TAILQ_INSERT_HEAD(head, elm, field) do {			\
+	if (((elm)->field.tqe_next = (head)->tqh_first) != NULL)	\
+		(head)->tqh_first->field.tqe_prev =			\
+		    &(elm)->field.tqe_next;				\
+	else								\
+		(head)->tqh_last = &(elm)->field.tqe_next;		\
+	(head)->tqh_first = (elm);					\
+	(elm)->field.tqe_prev = &(head)->tqh_first;			\
+} while (0)
+
+#define DWC_TAILQ_INSERT_TAIL(head, elm, field) do {			\
+	(elm)->field.tqe_next = NULL;					\
+	(elm)->field.tqe_prev = (head)->tqh_last;			\
+	*(head)->tqh_last = (elm);					\
+	(head)->tqh_last = &(elm)->field.tqe_next;			\
+} while (0)
+
+#define DWC_TAILQ_INSERT_AFTER(head, listelm, elm, field) do {		\
+	if (((elm)->field.tqe_next = (listelm)->field.tqe_next) != NULL)\
+		(elm)->field.tqe_next->field.tqe_prev =			\
+		    &(elm)->field.tqe_next;				\
+	else								\
+		(head)->tqh_last = &(elm)->field.tqe_next;		\
+	(listelm)->field.tqe_next = (elm);				\
+	(elm)->field.tqe_prev = &(listelm)->field.tqe_next;		\
+} while (0)
+
+#define DWC_TAILQ_INSERT_BEFORE(listelm, elm, field) do {		\
+	(elm)->field.tqe_prev = (listelm)->field.tqe_prev;		\
+	(elm)->field.tqe_next = (listelm);				\
+	*(listelm)->field.tqe_prev = (elm);				\
+	(listelm)->field.tqe_prev = &(elm)->field.tqe_next;		\
+} while (0)
+
+#define DWC_TAILQ_REMOVE(head, elm, field) do {				\
+	if (((elm)->field.tqe_next) != NULL)				\
+		(elm)->field.tqe_next->field.tqe_prev =			\
+		    (elm)->field.tqe_prev;				\
+	else								\
+		(head)->tqh_last = (elm)->field.tqe_prev;		\
+	*(elm)->field.tqe_prev = (elm)->field.tqe_next;			\
+} while (0)
+
+#define DWC_TAILQ_REPLACE(head, elm, elm2, field) do {			\
+	if (((elm2)->field.tqe_next = (elm)->field.tqe_next) != NULL)	\
+		(elm2)->field.tqe_next->field.tqe_prev =		\
+		    &(elm2)->field.tqe_next;				\
+	else								\
+		(head)->tqh_last = &(elm2)->field.tqe_next;		\
+	(elm2)->field.tqe_prev = (elm)->field.tqe_prev;			\
+	*(elm2)->field.tqe_prev = (elm2);				\
+} while (0)
+
+/*
+ * Circular queue definitions.
+ */
+#define DWC_CIRCLEQ_HEAD(name, type)					\
+struct name {								\
+	struct type *cqh_first;		/* first element */		\
+	struct type *cqh_last;		/* last element */		\
+}
+
+#define DWC_CIRCLEQ_HEAD_INITIALIZER(head)				\
+	{ DWC_CIRCLEQ_END(&head), DWC_CIRCLEQ_END(&head) }
+
+#define DWC_CIRCLEQ_ENTRY(type)						\
+struct {								\
+	struct type *cqe_next;		/* next element */		\
+	struct type *cqe_prev;		/* previous element */		\
+}
+
+/*
+ * Circular queue access methods
+ */
+#define DWC_CIRCLEQ_FIRST(head)		((head)->cqh_first)
+#define DWC_CIRCLEQ_LAST(head)		((head)->cqh_last)
+#define DWC_CIRCLEQ_END(head)		((void *)(head))
+#define DWC_CIRCLEQ_NEXT(elm, field)	((elm)->field.cqe_next)
+#define DWC_CIRCLEQ_PREV(elm, field)	((elm)->field.cqe_prev)
+#define DWC_CIRCLEQ_EMPTY(head)						\
+	(DWC_CIRCLEQ_FIRST(head) == DWC_CIRCLEQ_END(head))
+
+#define DWC_CIRCLEQ_EMPTY_ENTRY(elm, field) (((elm)->field.cqe_next == NULL) && ((elm)->field.cqe_prev == NULL))
+
+#define DWC_CIRCLEQ_FOREACH(var, head, field)				\
+	for((var) = DWC_CIRCLEQ_FIRST(head);				\
+	    (var) != DWC_CIRCLEQ_END(head);				\
+	    (var) = DWC_CIRCLEQ_NEXT(var, field))
+
+#define DWC_CIRCLEQ_FOREACH_SAFE(var, var2, head, field)			\
+	for((var) = DWC_CIRCLEQ_FIRST(head), var2 = DWC_CIRCLEQ_NEXT(var, field); \
+	    (var) != DWC_CIRCLEQ_END(head);					\
+	    (var) = var2, var2 = DWC_CIRCLEQ_NEXT(var, field))
+
+#define DWC_CIRCLEQ_FOREACH_REVERSE(var, head, field)			\
+	for((var) = DWC_CIRCLEQ_LAST(head);				\
+	    (var) != DWC_CIRCLEQ_END(head);				\
+	    (var) = DWC_CIRCLEQ_PREV(var, field))
+
+/*
+ * Circular queue functions.
+ */
+#define DWC_CIRCLEQ_INIT(head) do {					\
+	(head)->cqh_first = DWC_CIRCLEQ_END(head);			\
+	(head)->cqh_last = DWC_CIRCLEQ_END(head);			\
+} while (0)
+
+#define DWC_CIRCLEQ_INIT_ENTRY(elm, field) do {				\
+	(elm)->field.cqe_next = NULL;					\
+	(elm)->field.cqe_prev = NULL;					\
+} while (0)
+
+#define DWC_CIRCLEQ_INSERT_AFTER(head, listelm, elm, field) do {	\
+	(elm)->field.cqe_next = (listelm)->field.cqe_next;		\
+	(elm)->field.cqe_prev = (listelm);				\
+	if ((listelm)->field.cqe_next == DWC_CIRCLEQ_END(head))		\
+		(head)->cqh_last = (elm);				\
+	else								\
+		(listelm)->field.cqe_next->field.cqe_prev = (elm);	\
+	(listelm)->field.cqe_next = (elm);				\
+} while (0)
+
+#define DWC_CIRCLEQ_INSERT_BEFORE(head, listelm, elm, field) do {	\
+	(elm)->field.cqe_next = (listelm);				\
+	(elm)->field.cqe_prev = (listelm)->field.cqe_prev;		\
+	if ((listelm)->field.cqe_prev == DWC_CIRCLEQ_END(head))		\
+		(head)->cqh_first = (elm);				\
+	else								\
+		(listelm)->field.cqe_prev->field.cqe_next = (elm);	\
+	(listelm)->field.cqe_prev = (elm);				\
+} while (0)
+
+#define DWC_CIRCLEQ_INSERT_HEAD(head, elm, field) do {			\
+	(elm)->field.cqe_next = (head)->cqh_first;			\
+	(elm)->field.cqe_prev = DWC_CIRCLEQ_END(head);			\
+	if ((head)->cqh_last == DWC_CIRCLEQ_END(head))			\
+		(head)->cqh_last = (elm);				\
+	else								\
+		(head)->cqh_first->field.cqe_prev = (elm);		\
+	(head)->cqh_first = (elm);					\
+} while (0)
+
+#define DWC_CIRCLEQ_INSERT_TAIL(head, elm, field) do {			\
+	(elm)->field.cqe_next = DWC_CIRCLEQ_END(head);			\
+	(elm)->field.cqe_prev = (head)->cqh_last;			\
+	if ((head)->cqh_first == DWC_CIRCLEQ_END(head))			\
+		(head)->cqh_first = (elm);				\
+	else								\
+		(head)->cqh_last->field.cqe_next = (elm);		\
+	(head)->cqh_last = (elm);					\
+} while (0)
+
+#define DWC_CIRCLEQ_REMOVE(head, elm, field) do {			\
+	if ((elm)->field.cqe_next == DWC_CIRCLEQ_END(head))		\
+		(head)->cqh_last = (elm)->field.cqe_prev;		\
+	else								\
+		(elm)->field.cqe_next->field.cqe_prev =			\
+		    (elm)->field.cqe_prev;				\
+	if ((elm)->field.cqe_prev == DWC_CIRCLEQ_END(head))		\
+		(head)->cqh_first = (elm)->field.cqe_next;		\
+	else								\
+		(elm)->field.cqe_prev->field.cqe_next =			\
+		    (elm)->field.cqe_next;				\
+} while (0)
+
+#define DWC_CIRCLEQ_REMOVE_INIT(head, elm, field) do {			\
+	DWC_CIRCLEQ_REMOVE(head, elm, field);				\
+	DWC_CIRCLEQ_INIT_ENTRY(elm, field);				\
+} while (0)
+
+#define DWC_CIRCLEQ_REPLACE(head, elm, elm2, field) do {		\
+	if (((elm2)->field.cqe_next = (elm)->field.cqe_next) ==		\
+	    DWC_CIRCLEQ_END(head))					\
+		(head).cqh_last = (elm2);				\
+	else								\
+		(elm2)->field.cqe_next->field.cqe_prev = (elm2);	\
+	if (((elm2)->field.cqe_prev = (elm)->field.cqe_prev) ==		\
+	    DWC_CIRCLEQ_END(head))					\
+		(head).cqh_first = (elm2);				\
+	else								\
+		(elm2)->field.cqe_prev->field.cqe_next = (elm2);	\
+} while (0)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _DWC_LIST_H_ */
diff --git a/drivers/usb/host/dwc_common_port/dwc_mem.c b/drivers/usb/host/dwc_common_port/dwc_mem.c
new file mode 100644
index 000000000000..ad645ff1ba7e
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_mem.c
@@ -0,0 +1,245 @@
+/* Memory Debugging */
+#ifdef DWC_DEBUG_MEMORY
+
+#include "dwc_os.h"
+#include "dwc_list.h"
+
+struct allocation {
+	void *addr;
+	void *ctx;
+	char *func;
+	int line;
+	uint32_t size;
+	int dma;
+	DWC_CIRCLEQ_ENTRY(allocation) entry;
+};
+
+DWC_CIRCLEQ_HEAD(allocation_queue, allocation);
+
+struct allocation_manager {
+	void *mem_ctx;
+	struct allocation_queue allocations;
+
+	/* statistics */
+	int num;
+	int num_freed;
+	int num_active;
+	uint32_t total;
+	uint32_t cur;
+	uint32_t max;
+};
+
+static struct allocation_manager *manager = NULL;
+
+static int add_allocation(void *ctx, uint32_t size, char const *func, int line, void *addr,
+			  int dma)
+{
+	struct allocation *a;
+
+	DWC_ASSERT(manager != NULL, "manager not allocated");
+
+	a = __DWC_ALLOC_ATOMIC(manager->mem_ctx, sizeof(*a));
+	if (!a) {
+		return -DWC_E_NO_MEMORY;
+	}
+
+	a->func = __DWC_ALLOC_ATOMIC(manager->mem_ctx, DWC_STRLEN(func) + 1);
+	if (!a->func) {
+		__DWC_FREE(manager->mem_ctx, a);
+		return -DWC_E_NO_MEMORY;
+	}
+
+	DWC_MEMCPY(a->func, func, DWC_STRLEN(func) + 1);
+	a->addr = addr;
+	a->ctx = ctx;
+	a->line = line;
+	a->size = size;
+	a->dma = dma;
+	DWC_CIRCLEQ_INSERT_TAIL(&manager->allocations, a, entry);
+
+	/* Update stats */
+	manager->num++;
+	manager->num_active++;
+	manager->total += size;
+	manager->cur += size;
+
+	if (manager->max < manager->cur) {
+		manager->max = manager->cur;
+	}
+
+	return 0;
+}
+
+static struct allocation *find_allocation(void *ctx, void *addr)
+{
+	struct allocation *a;
+
+	DWC_CIRCLEQ_FOREACH(a, &manager->allocations, entry) {
+		if (a->ctx == ctx && a->addr == addr) {
+			return a;
+		}
+	}
+
+	return NULL;
+}
+
+static void free_allocation(void *ctx, void *addr, char const *func, int line)
+{
+	struct allocation *a = find_allocation(ctx, addr);
+
+	if (!a) {
+		DWC_ASSERT(0,
+			   "Free of address %p that was never allocated or already freed %s:%d",
+			   addr, func, line);
+		return;
+	}
+
+	DWC_CIRCLEQ_REMOVE(&manager->allocations, a, entry);
+
+	manager->num_active--;
+	manager->num_freed++;
+	manager->cur -= a->size;
+	__DWC_FREE(manager->mem_ctx, a->func);
+	__DWC_FREE(manager->mem_ctx, a);
+}
+
+int dwc_memory_debug_start(void *mem_ctx)
+{
+	DWC_ASSERT(manager == NULL, "Memory debugging has already started\n");
+
+	if (manager) {
+		return -DWC_E_BUSY;
+	}
+
+	manager = __DWC_ALLOC(mem_ctx, sizeof(*manager));
+	if (!manager) {
+		return -DWC_E_NO_MEMORY;
+	}
+
+	DWC_CIRCLEQ_INIT(&manager->allocations);
+	manager->mem_ctx = mem_ctx;
+	manager->num = 0;
+	manager->num_freed = 0;
+	manager->num_active = 0;
+	manager->total = 0;
+	manager->cur = 0;
+	manager->max = 0;
+
+	return 0;
+}
+
+void dwc_memory_debug_stop(void)
+{
+	struct allocation *a;
+
+	dwc_memory_debug_report();
+
+	DWC_CIRCLEQ_FOREACH(a, &manager->allocations, entry) {
+		DWC_ERROR("Memory leaked from %s:%d\n", a->func, a->line);
+		free_allocation(a->ctx, a->addr, NULL, -1);
+	}
+
+	__DWC_FREE(manager->mem_ctx, manager);
+}
+
+void dwc_memory_debug_report(void)
+{
+	struct allocation *a;
+
+	DWC_PRINTF("\n\n\n----------------- Memory Debugging Report -----------------\n\n");
+	DWC_PRINTF("Num Allocations = %d\n", manager->num);
+	DWC_PRINTF("Freed = %d\n", manager->num_freed);
+	DWC_PRINTF("Active = %d\n", manager->num_active);
+	DWC_PRINTF("Current Memory Used = %d\n", manager->cur);
+	DWC_PRINTF("Total Memory Used = %d\n", manager->total);
+	DWC_PRINTF("Maximum Memory Used at Once = %d\n", manager->max);
+	DWC_PRINTF("Unfreed allocations:\n");
+
+	DWC_CIRCLEQ_FOREACH(a, &manager->allocations, entry) {
+		DWC_PRINTF("    addr=%p, size=%d from %s:%d, DMA=%d\n",
+			   a->addr, a->size, a->func, a->line, a->dma);
+	}
+}
+
+/* The replacement functions */
+void *dwc_alloc_debug(void *mem_ctx, uint32_t size, char const *func, int line)
+{
+	void *addr = __DWC_ALLOC(mem_ctx, size);
+
+	if (!addr) {
+		return NULL;
+	}
+
+	if (add_allocation(mem_ctx, size, func, line, addr, 0)) {
+		__DWC_FREE(mem_ctx, addr);
+		return NULL;
+	}
+
+	return addr;
+}
+
+void *dwc_alloc_atomic_debug(void *mem_ctx, uint32_t size, char const *func,
+			     int line)
+{
+	void *addr = __DWC_ALLOC_ATOMIC(mem_ctx, size);
+
+	if (!addr) {
+		return NULL;
+	}
+
+	if (add_allocation(mem_ctx, size, func, line, addr, 0)) {
+		__DWC_FREE(mem_ctx, addr);
+		return NULL;
+	}
+
+	return addr;
+}
+
+void dwc_free_debug(void *mem_ctx, void *addr, char const *func, int line)
+{
+	free_allocation(mem_ctx, addr, func, line);
+	__DWC_FREE(mem_ctx, addr);
+}
+
+void *dwc_dma_alloc_debug(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr,
+			  char const *func, int line)
+{
+	void *addr = __DWC_DMA_ALLOC(dma_ctx, size, dma_addr);
+
+	if (!addr) {
+		return NULL;
+	}
+
+	if (add_allocation(dma_ctx, size, func, line, addr, 1)) {
+		__DWC_DMA_FREE(dma_ctx, size, addr, *dma_addr);
+		return NULL;
+	}
+
+	return addr;
+}
+
+void *dwc_dma_alloc_atomic_debug(void *dma_ctx, uint32_t size,
+				 dwc_dma_t *dma_addr, char const *func, int line)
+{
+	void *addr = __DWC_DMA_ALLOC_ATOMIC(dma_ctx, size, dma_addr);
+
+	if (!addr) {
+		return NULL;
+	}
+
+	if (add_allocation(dma_ctx, size, func, line, addr, 1)) {
+		__DWC_DMA_FREE(dma_ctx, size, addr, *dma_addr);
+		return NULL;
+	}
+
+	return addr;
+}
+
+void dwc_dma_free_debug(void *dma_ctx, uint32_t size, void *virt_addr,
+			dwc_dma_t dma_addr, char const *func, int line)
+{
+	free_allocation(dma_ctx, virt_addr, func, line);
+	__DWC_DMA_FREE(dma_ctx, size, virt_addr, dma_addr);
+}
+
+#endif /* DWC_DEBUG_MEMORY */
diff --git a/drivers/usb/host/dwc_common_port/dwc_modpow.c b/drivers/usb/host/dwc_common_port/dwc_modpow.c
new file mode 100644
index 000000000000..20045381208a
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_modpow.c
@@ -0,0 +1,636 @@
+/* Bignum routines adapted from PUTTY sources.  PuTTY copyright notice follows.
+ *
+ * PuTTY is copyright 1997-2007 Simon Tatham.
+ *
+ * Portions copyright Robert de Bath, Joris van Rantwijk, Delian
+ * Delchev, Andreas Schultz, Jeroen Massar, Wez Furlong, Nicolas Barry,
+ * Justin Bradford, Ben Harris, Malcolm Smith, Ahmad Khalifa, Markus
+ * Kuhn, and CORE SDI S.A.
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation files
+ * (the "Software"), to deal in the Software without restriction,
+ * including without limitation the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT.  IN NO EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE
+ * FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
+ * CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+#ifdef DWC_CRYPTOLIB
+
+#ifndef CONFIG_MACH_IPMATE
+
+#include "dwc_modpow.h"
+
+#define BIGNUM_INT_MASK  0xFFFFFFFFUL
+#define BIGNUM_TOP_BIT   0x80000000UL
+#define BIGNUM_INT_BITS  32
+
+
+static void *snmalloc(void *mem_ctx, size_t n, size_t size)
+{
+    void *p;
+    size *= n;
+    if (size == 0) size = 1;
+    p = dwc_alloc(mem_ctx, size);
+    return p;
+}
+
+#define snewn(ctx, n, type) ((type *)snmalloc((ctx), (n), sizeof(type)))
+#define sfree dwc_free
+
+/*
+ * Usage notes:
+ *  * Do not call the DIVMOD_WORD macro with expressions such as array
+ *    subscripts, as some implementations object to this (see below).
+ *  * Note that none of the division methods below will cope if the
+ *    quotient won't fit into BIGNUM_INT_BITS. Callers should be careful
+ *    to avoid this case.
+ *    If this condition occurs, in the case of the x86 DIV instruction,
+ *    an overflow exception will occur, which (according to a correspondent)
+ *    will manifest on Windows as something like
+ *      0xC0000095: Integer overflow
+ *    The C variant won't give the right answer, either.
+ */
+
+#define MUL_WORD(w1, w2) ((BignumDblInt)w1 * w2)
+
+#if defined __GNUC__ && defined __i386__
+#define DIVMOD_WORD(q, r, hi, lo, w) \
+    __asm__("div %2" : \
+	    "=d" (r), "=a" (q) : \
+	    "r" (w), "d" (hi), "a" (lo))
+#else
+#define DIVMOD_WORD(q, r, hi, lo, w) do { \
+    BignumDblInt n = (((BignumDblInt)hi) << BIGNUM_INT_BITS) | lo; \
+    q = n / w; \
+    r = n % w; \
+} while (0)
+#endif
+
+//    q = n / w;
+//    r = n % w;
+
+#define BIGNUM_INT_BYTES (BIGNUM_INT_BITS / 8)
+
+#define BIGNUM_INTERNAL
+
+static Bignum newbn(void *mem_ctx, int length)
+{
+    Bignum b = snewn(mem_ctx, length + 1, BignumInt);
+    //if (!b)
+    //abort();		       /* FIXME */
+    DWC_MEMSET(b, 0, (length + 1) * sizeof(*b));
+    b[0] = length;
+    return b;
+}
+
+void freebn(void *mem_ctx, Bignum b)
+{
+    /*
+     * Burn the evidence, just in case.
+     */
+    DWC_MEMSET(b, 0, sizeof(b[0]) * (b[0] + 1));
+    sfree(mem_ctx, b);
+}
+
+/*
+ * Compute c = a * b.
+ * Input is in the first len words of a and b.
+ * Result is returned in the first 2*len words of c.
+ */
+static void internal_mul(BignumInt *a, BignumInt *b,
+			 BignumInt *c, int len)
+{
+    int i, j;
+    BignumDblInt t;
+
+    for (j = 0; j < 2 * len; j++)
+	c[j] = 0;
+
+    for (i = len - 1; i >= 0; i--) {
+	t = 0;
+	for (j = len - 1; j >= 0; j--) {
+	    t += MUL_WORD(a[i], (BignumDblInt) b[j]);
+	    t += (BignumDblInt) c[i + j + 1];
+	    c[i + j + 1] = (BignumInt) t;
+	    t = t >> BIGNUM_INT_BITS;
+	}
+	c[i] = (BignumInt) t;
+    }
+}
+
+static void internal_add_shifted(BignumInt *number,
+				 unsigned n, int shift)
+{
+    int word = 1 + (shift / BIGNUM_INT_BITS);
+    int bshift = shift % BIGNUM_INT_BITS;
+    BignumDblInt addend;
+
+    addend = (BignumDblInt)n << bshift;
+
+    while (addend) {
+	addend += number[word];
+	number[word] = (BignumInt) addend & BIGNUM_INT_MASK;
+	addend >>= BIGNUM_INT_BITS;
+	word++;
+    }
+}
+
+/*
+ * Compute a = a % m.
+ * Input in first alen words of a and first mlen words of m.
+ * Output in first alen words of a
+ * (of which first alen-mlen words will be zero).
+ * The MSW of m MUST have its high bit set.
+ * Quotient is accumulated in the `quotient' array, which is a Bignum
+ * rather than the internal bigendian format. Quotient parts are shifted
+ * left by `qshift' before adding into quot.
+ */
+static void internal_mod(BignumInt *a, int alen,
+			 BignumInt *m, int mlen,
+			 BignumInt *quot, int qshift)
+{
+    BignumInt m0, m1;
+    unsigned int h;
+    int i, k;
+
+    m0 = m[0];
+    if (mlen > 1)
+	m1 = m[1];
+    else
+	m1 = 0;
+
+    for (i = 0; i <= alen - mlen; i++) {
+	BignumDblInt t;
+	unsigned int q, r, c, ai1;
+
+	if (i == 0) {
+	    h = 0;
+	} else {
+	    h = a[i - 1];
+	    a[i - 1] = 0;
+	}
+
+	if (i == alen - 1)
+	    ai1 = 0;
+	else
+	    ai1 = a[i + 1];
+
+	/* Find q = h:a[i] / m0 */
+	if (h >= m0) {
+	    /*
+	     * Special case.
+	     *
+	     * To illustrate it, suppose a BignumInt is 8 bits, and
+	     * we are dividing (say) A1:23:45:67 by A1:B2:C3. Then
+	     * our initial division will be 0xA123 / 0xA1, which
+	     * will give a quotient of 0x100 and a divide overflow.
+	     * However, the invariants in this division algorithm
+	     * are not violated, since the full number A1:23:... is
+	     * _less_ than the quotient prefix A1:B2:... and so the
+	     * following correction loop would have sorted it out.
+	     *
+	     * In this situation we set q to be the largest
+	     * quotient we _can_ stomach (0xFF, of course).
+	     */
+	    q = BIGNUM_INT_MASK;
+	} else {
+	    /* Macro doesn't want an array subscript expression passed
+	     * into it (see definition), so use a temporary. */
+	    BignumInt tmplo = a[i];
+	    DIVMOD_WORD(q, r, h, tmplo, m0);
+
+	    /* Refine our estimate of q by looking at
+	     h:a[i]:a[i+1] / m0:m1 */
+	    t = MUL_WORD(m1, q);
+	    if (t > ((BignumDblInt) r << BIGNUM_INT_BITS) + ai1) {
+		q--;
+		t -= m1;
+		r = (r + m0) & BIGNUM_INT_MASK;     /* overflow? */
+		if (r >= (BignumDblInt) m0 &&
+		    t > ((BignumDblInt) r << BIGNUM_INT_BITS) + ai1) q--;
+	    }
+	}
+
+	/* Subtract q * m from a[i...] */
+	c = 0;
+	for (k = mlen - 1; k >= 0; k--) {
+	    t = MUL_WORD(q, m[k]);
+	    t += c;
+	    c = (unsigned)(t >> BIGNUM_INT_BITS);
+	    if ((BignumInt) t > a[i + k])
+		c++;
+	    a[i + k] -= (BignumInt) t;
+	}
+
+	/* Add back m in case of borrow */
+	if (c != h) {
+	    t = 0;
+	    for (k = mlen - 1; k >= 0; k--) {
+		t += m[k];
+		t += a[i + k];
+		a[i + k] = (BignumInt) t;
+		t = t >> BIGNUM_INT_BITS;
+	    }
+	    q--;
+	}
+	if (quot)
+	    internal_add_shifted(quot, q, qshift + BIGNUM_INT_BITS * (alen - mlen - i));
+    }
+}
+
+/*
+ * Compute p % mod.
+ * The most significant word of mod MUST be non-zero.
+ * We assume that the result array is the same size as the mod array.
+ * We optionally write out a quotient if `quotient' is non-NULL.
+ * We can avoid writing out the result if `result' is NULL.
+ */
+void bigdivmod(void *mem_ctx, Bignum p, Bignum mod, Bignum result, Bignum quotient)
+{
+    BignumInt *n, *m;
+    int mshift;
+    int plen, mlen, i, j;
+
+    /* Allocate m of size mlen, copy mod to m */
+    /* We use big endian internally */
+    mlen = mod[0];
+    m = snewn(mem_ctx, mlen, BignumInt);
+    //if (!m)
+    //abort();		       /* FIXME */
+    for (j = 0; j < mlen; j++)
+	m[j] = mod[mod[0] - j];
+
+    /* Shift m left to make msb bit set */
+    for (mshift = 0; mshift < BIGNUM_INT_BITS-1; mshift++)
+	if ((m[0] << mshift) & BIGNUM_TOP_BIT)
+	    break;
+    if (mshift) {
+	for (i = 0; i < mlen - 1; i++)
+	    m[i] = (m[i] << mshift) | (m[i + 1] >> (BIGNUM_INT_BITS - mshift));
+	m[mlen - 1] = m[mlen - 1] << mshift;
+    }
+
+    plen = p[0];
+    /* Ensure plen > mlen */
+    if (plen <= mlen)
+	plen = mlen + 1;
+
+    /* Allocate n of size plen, copy p to n */
+    n = snewn(mem_ctx, plen, BignumInt);
+    //if (!n)
+    //abort();		       /* FIXME */
+    for (j = 0; j < plen; j++)
+	n[j] = 0;
+    for (j = 1; j <= (int)p[0]; j++)
+	n[plen - j] = p[j];
+
+    /* Main computation */
+    internal_mod(n, plen, m, mlen, quotient, mshift);
+
+    /* Fixup result in case the modulus was shifted */
+    if (mshift) {
+	for (i = plen - mlen - 1; i < plen - 1; i++)
+	    n[i] = (n[i] << mshift) | (n[i + 1] >> (BIGNUM_INT_BITS - mshift));
+	n[plen - 1] = n[plen - 1] << mshift;
+	internal_mod(n, plen, m, mlen, quotient, 0);
+	for (i = plen - 1; i >= plen - mlen; i--)
+	    n[i] = (n[i] >> mshift) | (n[i - 1] << (BIGNUM_INT_BITS - mshift));
+    }
+
+    /* Copy result to buffer */
+    if (result) {
+	for (i = 1; i <= (int)result[0]; i++) {
+	    int j = plen - i;
+	    result[i] = j >= 0 ? n[j] : 0;
+	}
+    }
+
+    /* Free temporary arrays */
+    for (i = 0; i < mlen; i++)
+	m[i] = 0;
+    sfree(mem_ctx, m);
+    for (i = 0; i < plen; i++)
+	n[i] = 0;
+    sfree(mem_ctx, n);
+}
+
+/*
+ * Simple remainder.
+ */
+Bignum bigmod(void *mem_ctx, Bignum a, Bignum b)
+{
+    Bignum r = newbn(mem_ctx, b[0]);
+    bigdivmod(mem_ctx, a, b, r, NULL);
+    return r;
+}
+
+/*
+ * Compute (base ^ exp) % mod.
+ */
+Bignum dwc_modpow(void *mem_ctx, Bignum base_in, Bignum exp, Bignum mod)
+{
+    BignumInt *a, *b, *n, *m;
+    int mshift;
+    int mlen, i, j;
+    Bignum base, result;
+
+    /*
+     * The most significant word of mod needs to be non-zero. It
+     * should already be, but let's make sure.
+     */
+    //assert(mod[mod[0]] != 0);
+
+    /*
+     * Make sure the base is smaller than the modulus, by reducing
+     * it modulo the modulus if not.
+     */
+    base = bigmod(mem_ctx, base_in, mod);
+
+    /* Allocate m of size mlen, copy mod to m */
+    /* We use big endian internally */
+    mlen = mod[0];
+    m = snewn(mem_ctx, mlen, BignumInt);
+    //if (!m)
+    //abort();		       /* FIXME */
+    for (j = 0; j < mlen; j++)
+	m[j] = mod[mod[0] - j];
+
+    /* Shift m left to make msb bit set */
+    for (mshift = 0; mshift < BIGNUM_INT_BITS - 1; mshift++)
+	if ((m[0] << mshift) & BIGNUM_TOP_BIT)
+	    break;
+    if (mshift) {
+	for (i = 0; i < mlen - 1; i++)
+	    m[i] =
+		(m[i] << mshift) | (m[i + 1] >>
+				    (BIGNUM_INT_BITS - mshift));
+	m[mlen - 1] = m[mlen - 1] << mshift;
+    }
+
+    /* Allocate n of size mlen, copy base to n */
+    n = snewn(mem_ctx, mlen, BignumInt);
+    //if (!n)
+    //abort();		       /* FIXME */
+    i = mlen - base[0];
+    for (j = 0; j < i; j++)
+	n[j] = 0;
+    for (j = 0; j < base[0]; j++)
+	n[i + j] = base[base[0] - j];
+
+    /* Allocate a and b of size 2*mlen. Set a = 1 */
+    a = snewn(mem_ctx, 2 * mlen, BignumInt);
+    //if (!a)
+    //abort();		       /* FIXME */
+    b = snewn(mem_ctx, 2 * mlen, BignumInt);
+    //if (!b)
+    //abort();		       /* FIXME */
+    for (i = 0; i < 2 * mlen; i++)
+	a[i] = 0;
+    a[2 * mlen - 1] = 1;
+
+    /* Skip leading zero bits of exp. */
+    i = 0;
+    j = BIGNUM_INT_BITS - 1;
+    while (i < exp[0] && (exp[exp[0] - i] & (1 << j)) == 0) {
+	j--;
+	if (j < 0) {
+	    i++;
+	    j = BIGNUM_INT_BITS - 1;
+	}
+    }
+
+    /* Main computation */
+    while (i < exp[0]) {
+	while (j >= 0) {
+	    internal_mul(a + mlen, a + mlen, b, mlen);
+	    internal_mod(b, mlen * 2, m, mlen, NULL, 0);
+	    if ((exp[exp[0] - i] & (1 << j)) != 0) {
+		internal_mul(b + mlen, n, a, mlen);
+		internal_mod(a, mlen * 2, m, mlen, NULL, 0);
+	    } else {
+		BignumInt *t;
+		t = a;
+		a = b;
+		b = t;
+	    }
+	    j--;
+	}
+	i++;
+	j = BIGNUM_INT_BITS - 1;
+    }
+
+    /* Fixup result in case the modulus was shifted */
+    if (mshift) {
+	for (i = mlen - 1; i < 2 * mlen - 1; i++)
+	    a[i] =
+		(a[i] << mshift) | (a[i + 1] >>
+				    (BIGNUM_INT_BITS - mshift));
+	a[2 * mlen - 1] = a[2 * mlen - 1] << mshift;
+	internal_mod(a, mlen * 2, m, mlen, NULL, 0);
+	for (i = 2 * mlen - 1; i >= mlen; i--)
+	    a[i] =
+		(a[i] >> mshift) | (a[i - 1] <<
+				    (BIGNUM_INT_BITS - mshift));
+    }
+
+    /* Copy result to buffer */
+    result = newbn(mem_ctx, mod[0]);
+    for (i = 0; i < mlen; i++)
+	result[result[0] - i] = a[i + mlen];
+    while (result[0] > 1 && result[result[0]] == 0)
+	result[0]--;
+
+    /* Free temporary arrays */
+    for (i = 0; i < 2 * mlen; i++)
+	a[i] = 0;
+    sfree(mem_ctx, a);
+    for (i = 0; i < 2 * mlen; i++)
+	b[i] = 0;
+    sfree(mem_ctx, b);
+    for (i = 0; i < mlen; i++)
+	m[i] = 0;
+    sfree(mem_ctx, m);
+    for (i = 0; i < mlen; i++)
+	n[i] = 0;
+    sfree(mem_ctx, n);
+
+    freebn(mem_ctx, base);
+
+    return result;
+}
+
+
+#ifdef UNITTEST
+
+static __u32 dh_p[] = {
+	96,
+	0xFFFFFFFF,
+	0xFFFFFFFF,
+	0xA93AD2CA,
+	0x4B82D120,
+	0xE0FD108E,
+	0x43DB5BFC,
+	0x74E5AB31,
+	0x08E24FA0,
+	0xBAD946E2,
+	0x770988C0,
+	0x7A615D6C,
+	0xBBE11757,
+	0x177B200C,
+	0x521F2B18,
+	0x3EC86A64,
+	0xD8760273,
+	0xD98A0864,
+	0xF12FFA06,
+	0x1AD2EE6B,
+	0xCEE3D226,
+	0x4A25619D,
+	0x1E8C94E0,
+	0xDB0933D7,
+	0xABF5AE8C,
+	0xA6E1E4C7,
+	0xB3970F85,
+	0x5D060C7D,
+	0x8AEA7157,
+	0x58DBEF0A,
+	0xECFB8504,
+	0xDF1CBA64,
+	0xA85521AB,
+	0x04507A33,
+	0xAD33170D,
+	0x8AAAC42D,
+	0x15728E5A,
+	0x98FA0510,
+	0x15D22618,
+	0xEA956AE5,
+	0x3995497C,
+	0x95581718,
+	0xDE2BCBF6,
+	0x6F4C52C9,
+	0xB5C55DF0,
+	0xEC07A28F,
+	0x9B2783A2,
+	0x180E8603,
+	0xE39E772C,
+	0x2E36CE3B,
+	0x32905E46,
+	0xCA18217C,
+	0xF1746C08,
+	0x4ABC9804,
+	0x670C354E,
+	0x7096966D,
+	0x9ED52907,
+	0x208552BB,
+	0x1C62F356,
+	0xDCA3AD96,
+	0x83655D23,
+	0xFD24CF5F,
+	0x69163FA8,
+	0x1C55D39A,
+	0x98DA4836,
+	0xA163BF05,
+	0xC2007CB8,
+	0xECE45B3D,
+	0x49286651,
+	0x7C4B1FE6,
+	0xAE9F2411,
+	0x5A899FA5,
+	0xEE386BFB,
+	0xF406B7ED,
+	0x0BFF5CB6,
+	0xA637ED6B,
+	0xF44C42E9,
+	0x625E7EC6,
+	0xE485B576,
+	0x6D51C245,
+	0x4FE1356D,
+	0xF25F1437,
+	0x302B0A6D,
+	0xCD3A431B,
+	0xEF9519B3,
+	0x8E3404DD,
+	0x514A0879,
+	0x3B139B22,
+	0x020BBEA6,
+	0x8A67CC74,
+	0x29024E08,
+	0x80DC1CD1,
+	0xC4C6628B,
+	0x2168C234,
+	0xC90FDAA2,
+	0xFFFFFFFF,
+	0xFFFFFFFF,
+};
+
+static __u32 dh_a[] = {
+	8,
+	0xdf367516,
+	0x86459caa,
+	0xe2d459a4,
+	0xd910dae0,
+	0x8a8b5e37,
+	0x67ab31c6,
+	0xf0b55ea9,
+	0x440051d6,
+};
+
+static __u32 dh_b[] = {
+	8,
+	0xded92656,
+	0xe07a048a,
+	0x6fa452cd,
+	0x2df89d30,
+	0xc75f1b0f,
+	0x8ce3578f,
+	0x7980a324,
+	0x5daec786,
+};
+
+static __u32 dh_g[] = {
+	1,
+	2,
+};
+
+int main(void)
+{
+	int i;
+	__u32 *k;
+	k = dwc_modpow(NULL, dh_g, dh_a, dh_p);
+
+	printf("\n\n");
+	for (i=0; i<k[0]; i++) {
+		__u32 word32 = k[k[0] - i];
+		__u16 l = word32 & 0xffff;
+		__u16 m = (word32 & 0xffff0000) >> 16;
+		printf("%04x %04x ", m, l);
+		if (!((i + 1)%13)) printf("\n");
+	}
+	printf("\n\n");
+
+	if ((k[0] == 0x60) && (k[1] == 0x28e490e5) && (k[0x60] == 0x5a0d3d4e)) {
+		printf("PASS\n\n");
+	}
+	else {
+		printf("FAIL\n\n");
+	}
+
+}
+
+#endif /* UNITTEST */
+
+#endif /* CONFIG_MACH_IPMATE */
+
+#endif /*DWC_CRYPTOLIB */
diff --git a/drivers/usb/host/dwc_common_port/dwc_modpow.h b/drivers/usb/host/dwc_common_port/dwc_modpow.h
new file mode 100644
index 000000000000..64f00c276e71
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_modpow.h
@@ -0,0 +1,34 @@
+/*
+ * dwc_modpow.h
+ * See dwc_modpow.c for license and changes
+ */
+#ifndef _DWC_MODPOW_H
+#define _DWC_MODPOW_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "dwc_os.h"
+
+/** @file
+ *
+ * This file defines the module exponentiation function which is only used
+ * internally by the DWC UWB modules for calculation of PKs during numeric
+ * association.  The routine is taken from the PUTTY, an open source terminal
+ * emulator.  The PUTTY License is preserved in the dwc_modpow.c file.
+ *
+ */
+
+typedef uint32_t BignumInt;
+typedef uint64_t BignumDblInt;
+typedef BignumInt *Bignum;
+
+/* Compute modular exponentiaion */
+extern Bignum dwc_modpow(void *mem_ctx, Bignum base_in, Bignum exp, Bignum mod);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _LINUX_BIGNUM_H */
diff --git a/drivers/usb/host/dwc_common_port/dwc_notifier.c b/drivers/usb/host/dwc_common_port/dwc_notifier.c
new file mode 100644
index 000000000000..8b3772afe11d
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_notifier.c
@@ -0,0 +1,319 @@
+#ifdef DWC_NOTIFYLIB
+
+#include "dwc_notifier.h"
+#include "dwc_list.h"
+
+typedef struct dwc_observer {
+	void *observer;
+	dwc_notifier_callback_t callback;
+	void *data;
+	char *notification;
+	DWC_CIRCLEQ_ENTRY(dwc_observer) list_entry;
+} observer_t;
+
+DWC_CIRCLEQ_HEAD(observer_queue, dwc_observer);
+
+typedef struct dwc_notifier {
+	void *mem_ctx;
+	void *object;
+	struct observer_queue observers;
+	DWC_CIRCLEQ_ENTRY(dwc_notifier) list_entry;
+} notifier_t;
+
+DWC_CIRCLEQ_HEAD(notifier_queue, dwc_notifier);
+
+typedef struct manager {
+	void *mem_ctx;
+	void *wkq_ctx;
+	dwc_workq_t *wq;
+//	dwc_mutex_t *mutex;
+	struct notifier_queue notifiers;
+} manager_t;
+
+static manager_t *manager = NULL;
+
+static int create_manager(void *mem_ctx, void *wkq_ctx)
+{
+	manager = dwc_alloc(mem_ctx, sizeof(manager_t));
+	if (!manager) {
+		return -DWC_E_NO_MEMORY;
+	}
+
+	DWC_CIRCLEQ_INIT(&manager->notifiers);
+
+	manager->wq = dwc_workq_alloc(wkq_ctx, "DWC Notification WorkQ");
+	if (!manager->wq) {
+		return -DWC_E_NO_MEMORY;
+	}
+
+	return 0;
+}
+
+static void free_manager(void)
+{
+	dwc_workq_free(manager->wq);
+
+	/* All notifiers must have unregistered themselves before this module
+	 * can be removed.  Hitting this assertion indicates a programmer
+	 * error. */
+	DWC_ASSERT(DWC_CIRCLEQ_EMPTY(&manager->notifiers),
+		   "Notification manager being freed before all notifiers have been removed");
+	dwc_free(manager->mem_ctx, manager);
+}
+
+#ifdef DEBUG
+static void dump_manager(void)
+{
+	notifier_t *n;
+	observer_t *o;
+
+	DWC_ASSERT(manager, "Notification manager not found");
+
+	DWC_DEBUG("List of all notifiers and observers:\n");
+	DWC_CIRCLEQ_FOREACH(n, &manager->notifiers, list_entry) {
+		DWC_DEBUG("Notifier %p has observers:\n", n->object);
+		DWC_CIRCLEQ_FOREACH(o, &n->observers, list_entry) {
+			DWC_DEBUG("    %p watching %s\n", o->observer, o->notification);
+		}
+	}
+}
+#else
+#define dump_manager(...)
+#endif
+
+static observer_t *alloc_observer(void *mem_ctx, void *observer, char *notification,
+				  dwc_notifier_callback_t callback, void *data)
+{
+	observer_t *new_observer = dwc_alloc(mem_ctx, sizeof(observer_t));
+
+	if (!new_observer) {
+		return NULL;
+	}
+
+	DWC_CIRCLEQ_INIT_ENTRY(new_observer, list_entry);
+	new_observer->observer = observer;
+	new_observer->notification = notification;
+	new_observer->callback = callback;
+	new_observer->data = data;
+	return new_observer;
+}
+
+static void free_observer(void *mem_ctx, observer_t *observer)
+{
+	dwc_free(mem_ctx, observer);
+}
+
+static notifier_t *alloc_notifier(void *mem_ctx, void *object)
+{
+	notifier_t *notifier;
+
+	if (!object) {
+		return NULL;
+	}
+
+	notifier = dwc_alloc(mem_ctx, sizeof(notifier_t));
+	if (!notifier) {
+		return NULL;
+	}
+
+	DWC_CIRCLEQ_INIT(&notifier->observers);
+	DWC_CIRCLEQ_INIT_ENTRY(notifier, list_entry);
+
+	notifier->mem_ctx = mem_ctx;
+	notifier->object = object;
+	return notifier;
+}
+
+static void free_notifier(notifier_t *notifier)
+{
+	observer_t *observer;
+
+	DWC_CIRCLEQ_FOREACH(observer, &notifier->observers, list_entry) {
+		free_observer(notifier->mem_ctx, observer);
+	}
+
+	dwc_free(notifier->mem_ctx, notifier);
+}
+
+static notifier_t *find_notifier(void *object)
+{
+	notifier_t *notifier;
+
+	DWC_ASSERT(manager, "Notification manager not found");
+
+	if (!object) {
+		return NULL;
+	}
+
+	DWC_CIRCLEQ_FOREACH(notifier, &manager->notifiers, list_entry) {
+		if (notifier->object == object) {
+			return notifier;
+		}
+	}
+
+	return NULL;
+}
+
+int dwc_alloc_notification_manager(void *mem_ctx, void *wkq_ctx)
+{
+	return create_manager(mem_ctx, wkq_ctx);
+}
+
+void dwc_free_notification_manager(void)
+{
+	free_manager();
+}
+
+dwc_notifier_t *dwc_register_notifier(void *mem_ctx, void *object)
+{
+	notifier_t *notifier;
+
+	DWC_ASSERT(manager, "Notification manager not found");
+
+	notifier = find_notifier(object);
+	if (notifier) {
+		DWC_ERROR("Notifier %p is already registered\n", object);
+		return NULL;
+	}
+
+	notifier = alloc_notifier(mem_ctx, object);
+	if (!notifier) {
+		return NULL;
+	}
+
+	DWC_CIRCLEQ_INSERT_TAIL(&manager->notifiers, notifier, list_entry);
+
+	DWC_INFO("Notifier %p registered", object);
+	dump_manager();
+
+	return notifier;
+}
+
+void dwc_unregister_notifier(dwc_notifier_t *notifier)
+{
+	DWC_ASSERT(manager, "Notification manager not found");
+
+	if (!DWC_CIRCLEQ_EMPTY(&notifier->observers)) {
+		observer_t *o;
+
+		DWC_ERROR("Notifier %p has active observers when removing\n", notifier->object);
+		DWC_CIRCLEQ_FOREACH(o, &notifier->observers, list_entry) {
+			DWC_DEBUGC("    %p watching %s\n", o->observer, o->notification);
+		}
+
+		DWC_ASSERT(DWC_CIRCLEQ_EMPTY(&notifier->observers),
+			   "Notifier %p has active observers when removing", notifier);
+	}
+
+	DWC_CIRCLEQ_REMOVE_INIT(&manager->notifiers, notifier, list_entry);
+	free_notifier(notifier);
+
+	DWC_INFO("Notifier unregistered");
+	dump_manager();
+}
+
+/* Add an observer to observe the notifier for a particular state, event, or notification. */
+int dwc_add_observer(void *observer, void *object, char *notification,
+		     dwc_notifier_callback_t callback, void *data)
+{
+	notifier_t *notifier = find_notifier(object);
+	observer_t *new_observer;
+
+	if (!notifier) {
+		DWC_ERROR("Notifier %p is not found when adding observer\n", object);
+		return -DWC_E_INVALID;
+	}
+
+	new_observer = alloc_observer(notifier->mem_ctx, observer, notification, callback, data);
+	if (!new_observer) {
+		return -DWC_E_NO_MEMORY;
+	}
+
+	DWC_CIRCLEQ_INSERT_TAIL(&notifier->observers, new_observer, list_entry);
+
+	DWC_INFO("Added observer %p to notifier %p observing notification %s, callback=%p, data=%p",
+		 observer, object, notification, callback, data);
+
+	dump_manager();
+	return 0;
+}
+
+int dwc_remove_observer(void *observer)
+{
+	notifier_t *n;
+
+	DWC_ASSERT(manager, "Notification manager not found");
+
+	DWC_CIRCLEQ_FOREACH(n, &manager->notifiers, list_entry) {
+		observer_t *o;
+		observer_t *o2;
+
+		DWC_CIRCLEQ_FOREACH_SAFE(o, o2, &n->observers, list_entry) {
+			if (o->observer == observer) {
+				DWC_CIRCLEQ_REMOVE_INIT(&n->observers, o, list_entry);
+				DWC_INFO("Removing observer %p from notifier %p watching notification %s:",
+					 o->observer, n->object, o->notification);
+				free_observer(n->mem_ctx, o);
+			}
+		}
+	}
+
+	dump_manager();
+	return 0;
+}
+
+typedef struct callback_data {
+	void *mem_ctx;
+	dwc_notifier_callback_t cb;
+	void *observer;
+	void *data;
+	void *object;
+	char *notification;
+	void *notification_data;
+} cb_data_t;
+
+static void cb_task(void *data)
+{
+	cb_data_t *cb = (cb_data_t *)data;
+
+	cb->cb(cb->object, cb->notification, cb->observer, cb->notification_data, cb->data);
+	dwc_free(cb->mem_ctx, cb);
+}
+
+void dwc_notify(dwc_notifier_t *notifier, char *notification, void *notification_data)
+{
+	observer_t *o;
+
+	DWC_ASSERT(manager, "Notification manager not found");
+
+	DWC_CIRCLEQ_FOREACH(o, &notifier->observers, list_entry) {
+		int len = DWC_STRLEN(notification);
+
+		if (DWC_STRLEN(o->notification) != len) {
+			continue;
+		}
+
+		if (DWC_STRNCMP(o->notification, notification, len) == 0) {
+			cb_data_t *cb_data = dwc_alloc(notifier->mem_ctx, sizeof(cb_data_t));
+
+			if (!cb_data) {
+				DWC_ERROR("Failed to allocate callback data\n");
+				return;
+			}
+
+			cb_data->mem_ctx = notifier->mem_ctx;
+			cb_data->cb = o->callback;
+			cb_data->observer = o->observer;
+			cb_data->data = o->data;
+			cb_data->object = notifier->object;
+			cb_data->notification = notification;
+			cb_data->notification_data = notification_data;
+			DWC_DEBUGC("Observer found %p for notification %s\n", o->observer, notification);
+			DWC_WORKQ_SCHEDULE(manager->wq, cb_task, cb_data,
+					   "Notify callback from %p for Notification %s, to observer %p",
+					   cb_data->object, notification, cb_data->observer);
+		}
+	}
+}
+
+#endif	/* DWC_NOTIFYLIB */
diff --git a/drivers/usb/host/dwc_common_port/dwc_notifier.h b/drivers/usb/host/dwc_common_port/dwc_notifier.h
new file mode 100644
index 000000000000..4a8cdfe565b1
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_notifier.h
@@ -0,0 +1,122 @@
+
+#ifndef __DWC_NOTIFIER_H__
+#define __DWC_NOTIFIER_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "dwc_os.h"
+
+/** @file
+ *
+ * A simple implementation of the Observer pattern.  Any "module" can
+ * register as an observer or notifier.  The notion of "module" is abstract and
+ * can mean anything used to identify either an observer or notifier.  Usually
+ * it will be a pointer to a data structure which contains some state, ie an
+ * object.
+ *
+ * Before any notifiers can be added, the global notification manager must be
+ * brought up with dwc_alloc_notification_manager().
+ * dwc_free_notification_manager() will bring it down and free all resources.
+ * These would typically be called upon module load and unload.  The
+ * notification manager is a single global instance that handles all registered
+ * observable modules and observers so this should be done only once.
+ *
+ * A module can be observable by using Notifications to publicize some general
+ * information about it's state or operation.  It does not care who listens, or
+ * even if anyone listens, or what they do with the information.  The observable
+ * modules do not need to know any information about it's observers or their
+ * interface, or their state or data.
+ *
+ * Any module can register to emit Notifications.  It should publish a list of
+ * notifications that it can emit and their behavior, such as when they will get
+ * triggered, and what information will be provided to the observer.  Then it
+ * should register itself as an observable module. See dwc_register_notifier().
+ *
+ * Any module can observe any observable, registered module, provided it has a
+ * handle to the other module and knows what notifications to observe.  See
+ * dwc_add_observer().
+ *
+ * A function of type dwc_notifier_callback_t is called whenever a notification
+ * is triggered with one or more observers observing it.  This function is
+ * called in it's own process so it may sleep or block if needed.  It is
+ * guaranteed to be called sometime after the notification has occurred and will
+ * be called once per each time the notification is triggered.  It will NOT be
+ * called in the same process context used to trigger the notification.
+ *
+ * @section Limitiations
+ *
+ * Keep in mind that Notifications that can be triggered in rapid sucession may
+ * schedule too many processes too handle.  Be aware of this limitation when
+ * designing to use notifications, and only add notifications for appropriate
+ * observable information.
+ *
+ * Also Notification callbacks are not synchronous.  If you need to synchronize
+ * the behavior between module/observer you must use other means.  And perhaps
+ * that will mean Notifications are not the proper solution.
+ */
+
+struct dwc_notifier;
+typedef struct dwc_notifier dwc_notifier_t;
+
+/** The callback function must be of this type.
+ *
+ * @param object This is the object that is being observed.
+ * @param notification This is the notification that was triggered.
+ * @param observer This is the observer
+ * @param notification_data This is notification-specific data that the notifier
+ * has included in this notification.  The value of this should be published in
+ * the documentation of the observable module with the notifications.
+ * @param user_data This is any custom data that the observer provided when
+ * adding itself as an observer to the notification. */
+typedef void (*dwc_notifier_callback_t)(void *object, char *notification, void *observer,
+					void *notification_data, void *user_data);
+
+/** Brings up the notification manager. */
+extern int dwc_alloc_notification_manager(void *mem_ctx, void *wkq_ctx);
+/** Brings down the notification manager. */
+extern void dwc_free_notification_manager(void);
+
+/** This function registers an observable module.  A dwc_notifier_t object is
+ * returned to the observable module.  This is an opaque object that is used by
+ * the observable module to trigger notifications.  This object should only be
+ * accessible to functions that are authorized to trigger notifications for this
+ * module.  Observers do not need this object. */
+extern dwc_notifier_t *dwc_register_notifier(void *mem_ctx, void *object);
+
+/** This function unregisters an observable module.  All observers have to be
+ * removed prior to unregistration. */
+extern void dwc_unregister_notifier(dwc_notifier_t *notifier);
+
+/** Add a module as an observer to the observable module.  The observable module
+ * needs to have previously registered with the notification manager.
+ *
+ * @param observer The observer module
+ * @param object The module to observe
+ * @param notification The notification to observe
+ * @param callback The callback function to call
+ * @param user_data Any additional user data to pass into the callback function */
+extern int dwc_add_observer(void *observer, void *object, char *notification,
+			    dwc_notifier_callback_t callback, void *user_data);
+
+/** Removes the specified observer from all notifications that it is currently
+ * observing. */
+extern int dwc_remove_observer(void *observer);
+
+/** This function triggers a Notification.  It should be called by the
+ * observable module, or any module or library which the observable module
+ * allows to trigger notification on it's behalf.  Such as the dwc_cc_t.
+ *
+ * dwc_notify is a non-blocking function.  Callbacks are scheduled called in
+ * their own process context for each trigger.  Callbacks can be blocking.
+ * dwc_notify can be called from interrupt context if needed.
+ *
+ */
+void dwc_notify(dwc_notifier_t *notifier, char *notification, void *notification_data);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __DWC_NOTIFIER_H__ */
diff --git a/drivers/usb/host/dwc_common_port/dwc_os.h b/drivers/usb/host/dwc_common_port/dwc_os.h
new file mode 100644
index 000000000000..9a86d299403b
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/dwc_os.h
@@ -0,0 +1,1276 @@
+/* =========================================================================
+ * $File: //dwh/usb_iip/dev/software/dwc_common_port_2/dwc_os.h $
+ * $Revision: #14 $
+ * $Date: 2010/11/04 $
+ * $Change: 1621695 $
+ *
+ * Synopsys Portability Library Software and documentation
+ * (hereinafter, "Software") is an Unsupported proprietary work of
+ * Synopsys, Inc. unless otherwise expressly agreed to in writing
+ * between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product
+ * under any End User Software License Agreement or Agreement for
+ * Licensed Product with Synopsys or any supplement thereto. You are
+ * permitted to use and redistribute this Software in source and binary
+ * forms, with or without modification, provided that redistributions
+ * of source code must retain this notice. You may not view, use,
+ * disclose, copy or distribute this file or any information contained
+ * herein except pursuant to this license grant from Synopsys. If you
+ * do not agree with this notice, including the disclaimer below, then
+ * you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS"
+ * BASIS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. IN NO EVENT SHALL
+ * SYNOPSYS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================= */
+#ifndef _DWC_OS_H_
+#define _DWC_OS_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** @file
+ *
+ * DWC portability library, low level os-wrapper functions
+ *
+ */
+
+/* These basic types need to be defined by some OS header file or custom header
+ * file for your specific target architecture.
+ *
+ * uint8_t, int8_t, uint16_t, int16_t, uint32_t, int32_t, uint64_t, int64_t
+ *
+ * Any custom or alternate header file must be added and enabled here.
+ */
+
+#ifdef DWC_LINUX
+# include <linux/types.h>
+# ifdef CONFIG_DEBUG_MUTEXES
+#  include <linux/mutex.h>
+# endif
+# include <linux/spinlock.h>
+# include <linux/errno.h>
+# include <stdarg.h>
+#endif
+
+#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
+# include <os_dep.h>
+#endif
+
+
+/** @name Primitive Types and Values */
+
+/** We define a boolean type for consistency.  Can be either YES or NO */
+typedef uint8_t dwc_bool_t;
+#define YES  1
+#define NO   0
+
+#ifdef DWC_LINUX
+
+/** @name Error Codes */
+#define DWC_E_INVALID		EINVAL
+#define DWC_E_NO_MEMORY		ENOMEM
+#define DWC_E_NO_DEVICE		ENODEV
+#define DWC_E_NOT_SUPPORTED	EOPNOTSUPP
+#define DWC_E_TIMEOUT		ETIMEDOUT
+#define DWC_E_BUSY		EBUSY
+#define DWC_E_AGAIN		EAGAIN
+#define DWC_E_RESTART		ERESTART
+#define DWC_E_ABORT		ECONNABORTED
+#define DWC_E_SHUTDOWN		ESHUTDOWN
+#define DWC_E_NO_DATA		ENODATA
+#define DWC_E_DISCONNECT	ECONNRESET
+#define DWC_E_UNKNOWN		EINVAL
+#define DWC_E_NO_STREAM_RES	ENOSR
+#define DWC_E_COMMUNICATION	ECOMM
+#define DWC_E_OVERFLOW		EOVERFLOW
+#define DWC_E_PROTOCOL		EPROTO
+#define DWC_E_IN_PROGRESS	EINPROGRESS
+#define DWC_E_PIPE		EPIPE
+#define DWC_E_IO		EIO
+#define DWC_E_NO_SPACE		ENOSPC
+
+#else
+
+/** @name Error Codes */
+#define DWC_E_INVALID		1001
+#define DWC_E_NO_MEMORY		1002
+#define DWC_E_NO_DEVICE		1003
+#define DWC_E_NOT_SUPPORTED	1004
+#define DWC_E_TIMEOUT		1005
+#define DWC_E_BUSY		1006
+#define DWC_E_AGAIN		1007
+#define DWC_E_RESTART		1008
+#define DWC_E_ABORT		1009
+#define DWC_E_SHUTDOWN		1010
+#define DWC_E_NO_DATA		1011
+#define DWC_E_DISCONNECT	2000
+#define DWC_E_UNKNOWN		3000
+#define DWC_E_NO_STREAM_RES	4001
+#define DWC_E_COMMUNICATION	4002
+#define DWC_E_OVERFLOW		4003
+#define DWC_E_PROTOCOL		4004
+#define DWC_E_IN_PROGRESS	4005
+#define DWC_E_PIPE		4006
+#define DWC_E_IO		4007
+#define DWC_E_NO_SPACE		4008
+
+#endif
+
+
+/** @name Tracing/Logging Functions
+ *
+ * These function provide the capability to add tracing, debugging, and error
+ * messages, as well exceptions as assertions.  The WUDEV uses these
+ * extensively.  These could be logged to the main console, the serial port, an
+ * internal buffer, etc.  These functions could also be no-op if they are too
+ * expensive on your system.  By default undefining the DEBUG macro already
+ * no-ops some of these functions. */
+
+/** Returns non-zero if in interrupt context. */
+extern dwc_bool_t DWC_IN_IRQ(void);
+#define dwc_in_irq DWC_IN_IRQ
+
+/** Returns "IRQ" if DWC_IN_IRQ is true. */
+static inline char *dwc_irq(void) {
+	return DWC_IN_IRQ() ? "IRQ" : "";
+}
+
+/** Returns non-zero if in bottom-half context. */
+extern dwc_bool_t DWC_IN_BH(void);
+#define dwc_in_bh DWC_IN_BH
+
+/** Returns "BH" if DWC_IN_BH is true. */
+static inline char *dwc_bh(void) {
+	return DWC_IN_BH() ? "BH" : "";
+}
+
+/**
+ * A vprintf() clone.  Just call vprintf if you've got it.
+ */
+extern void DWC_VPRINTF(char *format, va_list args);
+#define dwc_vprintf DWC_VPRINTF
+
+/**
+ * A vsnprintf() clone.  Just call vprintf if you've got it.
+ */
+extern int DWC_VSNPRINTF(char *str, int size, char *format, va_list args);
+#define dwc_vsnprintf DWC_VSNPRINTF
+
+/**
+ * printf() clone.  Just call printf if you've go it.
+ */
+extern void DWC_PRINTF(char *format, ...)
+/* This provides compiler level static checking of the parameters if you're
+ * using GCC. */
+#ifdef __GNUC__
+	__attribute__ ((format(printf, 1, 2)));
+#else
+	;
+#endif
+#define dwc_printf DWC_PRINTF
+
+/**
+ * sprintf() clone.  Just call sprintf if you've got it.
+ */
+extern int DWC_SPRINTF(char *string, char *format, ...)
+#ifdef __GNUC__
+	__attribute__ ((format(printf, 2, 3)));
+#else
+	;
+#endif
+#define dwc_sprintf DWC_SPRINTF
+
+/**
+ * snprintf() clone.  Just call snprintf if you've got it.
+ */
+extern int DWC_SNPRINTF(char *string, int size, char *format, ...)
+#ifdef __GNUC__
+	__attribute__ ((format(printf, 3, 4)));
+#else
+	;
+#endif
+#define dwc_snprintf DWC_SNPRINTF
+
+/**
+ * Prints a WARNING message.  On systems that don't differentiate between
+ * warnings and regular log messages, just print it.  Indicates that something
+ * may be wrong with the driver.  Works like printf().
+ *
+ * Use the DWC_WARN macro to call this function.
+ */
+extern void __DWC_WARN(char *format, ...)
+#ifdef __GNUC__
+	__attribute__ ((format(printf, 1, 2)));
+#else
+	;
+#endif
+
+/**
+ * Prints an error message.  On systems that don't differentiate between errors
+ * and regular log messages, just print it.  Indicates that something went wrong
+ * with the driver.  Works like printf().
+ *
+ * Use the DWC_ERROR macro to call this function.
+ */
+extern void __DWC_ERROR(char *format, ...)
+#ifdef __GNUC__
+	__attribute__ ((format(printf, 1, 2)));
+#else
+	;
+#endif
+
+/**
+ * Prints an exception error message and takes some user-defined action such as
+ * print out a backtrace or trigger a breakpoint.  Indicates that something went
+ * abnormally wrong with the driver such as programmer error, or other
+ * exceptional condition.  It should not be ignored so even on systems without
+ * printing capability, some action should be taken to notify the developer of
+ * it.  Works like printf().
+ */
+extern void DWC_EXCEPTION(char *format, ...)
+#ifdef __GNUC__
+	__attribute__ ((format(printf, 1, 2)));
+#else
+	;
+#endif
+#define dwc_exception DWC_EXCEPTION
+
+#ifndef DWC_OTG_DEBUG_LEV
+#define DWC_OTG_DEBUG_LEV 0
+#endif
+
+#ifdef DEBUG
+/**
+ * Prints out a debug message.  Used for logging/trace messages.
+ *
+ * Use the DWC_DEBUG macro to call this function
+ */
+extern void __DWC_DEBUG(char *format, ...)
+#ifdef __GNUC__
+	__attribute__ ((format(printf, 1, 2)));
+#else
+	;
+#endif
+#else
+#define __DWC_DEBUG printk
+#endif
+
+/**
+ * Prints out a Debug message.
+ */
+#define DWC_DEBUG(_format, _args...) __DWC_DEBUG("DEBUG:%s:%s: " _format "\n", \
+						 __func__, dwc_irq(), ## _args)
+#define dwc_debug DWC_DEBUG
+/**
+ * Prints out a Debug message if enabled at compile time.
+ */
+#if DWC_OTG_DEBUG_LEV > 0
+#define DWC_DEBUGC(_format, _args...) DWC_DEBUG(_format, ##_args )
+#else
+#define DWC_DEBUGC(_format, _args...)
+#endif
+#define dwc_debugc DWC_DEBUGC
+/**
+ * Prints out an informative message.
+ */
+#define DWC_INFO(_format, _args...) DWC_PRINTF("INFO:%s: " _format "\n", \
+					       dwc_irq(), ## _args)
+#define dwc_info DWC_INFO
+/**
+ * Prints out an informative message if enabled at compile time.
+ */
+#if DWC_OTG_DEBUG_LEV > 1
+#define DWC_INFOC(_format, _args...) DWC_INFO(_format, ##_args )
+#else
+#define DWC_INFOC(_format, _args...)
+#endif
+#define dwc_infoc DWC_INFOC
+/**
+ * Prints out a warning message.
+ */
+#define DWC_WARN(_format, _args...) __DWC_WARN("WARN:%s:%s:%d: " _format "\n", \
+					dwc_irq(), __func__, __LINE__, ## _args)
+#define dwc_warn DWC_WARN
+/**
+ * Prints out an error message.
+ */
+#define DWC_ERROR(_format, _args...) __DWC_ERROR("ERROR:%s:%s:%d: " _format "\n", \
+					dwc_irq(), __func__, __LINE__, ## _args)
+#define dwc_error DWC_ERROR
+
+#define DWC_PROTO_ERROR(_format, _args...) __DWC_WARN("ERROR:%s:%s:%d: " _format "\n", \
+						dwc_irq(), __func__, __LINE__, ## _args)
+#define dwc_proto_error DWC_PROTO_ERROR
+
+#ifdef DEBUG
+/** Prints out a exception error message if the _expr expression fails.  Disabled
+ * if DEBUG is not enabled. */
+#define DWC_ASSERT(_expr, _format, _args...) do { \
+	if (!(_expr)) { DWC_EXCEPTION("%s:%s:%d: " _format "\n", dwc_irq(), \
+				      __FILE__, __LINE__, ## _args); } \
+	} while (0)
+#else
+#define DWC_ASSERT(_x...)
+#endif
+#define dwc_assert DWC_ASSERT
+
+
+/** @name Byte Ordering
+ * The following functions are for conversions between processor's byte ordering
+ * and specific ordering you want.
+ */
+
+/** Converts 32 bit data in CPU byte ordering to little endian. */
+extern uint32_t DWC_CPU_TO_LE32(uint32_t *p);
+#define dwc_cpu_to_le32 DWC_CPU_TO_LE32
+
+/** Converts 32 bit data in CPU byte orderint to big endian. */
+extern uint32_t DWC_CPU_TO_BE32(uint32_t *p);
+#define dwc_cpu_to_be32 DWC_CPU_TO_BE32
+
+/** Converts 32 bit little endian data to CPU byte ordering. */
+extern uint32_t DWC_LE32_TO_CPU(uint32_t *p);
+#define dwc_le32_to_cpu DWC_LE32_TO_CPU
+
+/** Converts 32 bit big endian data to CPU byte ordering. */
+extern uint32_t DWC_BE32_TO_CPU(uint32_t *p);
+#define dwc_be32_to_cpu DWC_BE32_TO_CPU
+
+/** Converts 16 bit data in CPU byte ordering to little endian. */
+extern uint16_t DWC_CPU_TO_LE16(uint16_t *p);
+#define dwc_cpu_to_le16 DWC_CPU_TO_LE16
+
+/** Converts 16 bit data in CPU byte orderint to big endian. */
+extern uint16_t DWC_CPU_TO_BE16(uint16_t *p);
+#define dwc_cpu_to_be16 DWC_CPU_TO_BE16
+
+/** Converts 16 bit little endian data to CPU byte ordering. */
+extern uint16_t DWC_LE16_TO_CPU(uint16_t *p);
+#define dwc_le16_to_cpu DWC_LE16_TO_CPU
+
+/** Converts 16 bit bi endian data to CPU byte ordering. */
+extern uint16_t DWC_BE16_TO_CPU(uint16_t *p);
+#define dwc_be16_to_cpu DWC_BE16_TO_CPU
+
+
+/** @name Register Read/Write
+ *
+ * The following six functions should be implemented to read/write registers of
+ * 32-bit and 64-bit sizes.  All modules use this to read/write register values.
+ * The reg value is a pointer to the register calculated from the void *base
+ * variable passed into the driver when it is started.  */
+
+#ifdef DWC_LINUX
+/* Linux doesn't need any extra parameters for register read/write, so we
+ * just throw away the IO context parameter.
+ */
+/** Reads the content of a 32-bit register. */
+extern uint32_t DWC_READ_REG32(uint32_t volatile *reg);
+#define dwc_read_reg32(_ctx_,_reg_) DWC_READ_REG32(_reg_)
+
+/** Reads the content of a 64-bit register. */
+extern uint64_t DWC_READ_REG64(uint64_t volatile *reg);
+#define dwc_read_reg64(_ctx_,_reg_) DWC_READ_REG64(_reg_)
+
+/** Writes to a 32-bit register. */
+extern void DWC_WRITE_REG32(uint32_t volatile *reg, uint32_t value);
+#define dwc_write_reg32(_ctx_,_reg_,_val_) DWC_WRITE_REG32(_reg_, _val_)
+
+/** Writes to a 64-bit register. */
+extern void DWC_WRITE_REG64(uint64_t volatile *reg, uint64_t value);
+#define dwc_write_reg64(_ctx_,_reg_,_val_) DWC_WRITE_REG64(_reg_, _val_)
+
+/**
+ * Modify bit values in a register.  Using the
+ * algorithm: (reg_contents & ~clear_mask) | set_mask.
+ */
+extern void DWC_MODIFY_REG32(uint32_t volatile *reg, uint32_t clear_mask, uint32_t set_mask);
+#define dwc_modify_reg32(_ctx_,_reg_,_cmsk_,_smsk_) DWC_MODIFY_REG32(_reg_,_cmsk_,_smsk_)
+extern void DWC_MODIFY_REG64(uint64_t volatile *reg, uint64_t clear_mask, uint64_t set_mask);
+#define dwc_modify_reg64(_ctx_,_reg_,_cmsk_,_smsk_) DWC_MODIFY_REG64(_reg_,_cmsk_,_smsk_)
+
+#endif	/* DWC_LINUX */
+
+#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
+typedef struct dwc_ioctx {
+	struct device *dev;
+	bus_space_tag_t iot;
+	bus_space_handle_t ioh;
+} dwc_ioctx_t;
+
+/** BSD needs two extra parameters for register read/write, so we pass
+ * them in using the IO context parameter.
+ */
+/** Reads the content of a 32-bit register. */
+extern uint32_t DWC_READ_REG32(void *io_ctx, uint32_t volatile *reg);
+#define dwc_read_reg32 DWC_READ_REG32
+
+/** Reads the content of a 64-bit register. */
+extern uint64_t DWC_READ_REG64(void *io_ctx, uint64_t volatile *reg);
+#define dwc_read_reg64 DWC_READ_REG64
+
+/** Writes to a 32-bit register. */
+extern void DWC_WRITE_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t value);
+#define dwc_write_reg32 DWC_WRITE_REG32
+
+/** Writes to a 64-bit register. */
+extern void DWC_WRITE_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t value);
+#define dwc_write_reg64 DWC_WRITE_REG64
+
+/**
+ * Modify bit values in a register.  Using the
+ * algorithm: (reg_contents & ~clear_mask) | set_mask.
+ */
+extern void DWC_MODIFY_REG32(void *io_ctx, uint32_t volatile *reg, uint32_t clear_mask, uint32_t set_mask);
+#define dwc_modify_reg32 DWC_MODIFY_REG32
+extern void DWC_MODIFY_REG64(void *io_ctx, uint64_t volatile *reg, uint64_t clear_mask, uint64_t set_mask);
+#define dwc_modify_reg64 DWC_MODIFY_REG64
+
+#endif	/* DWC_FREEBSD || DWC_NETBSD */
+
+/** @cond */
+
+/** @name Some convenience MACROS used internally.  Define DWC_DEBUG_REGS to log the
+ * register writes. */
+
+#ifdef DWC_LINUX
+
+# ifdef DWC_DEBUG_REGS
+
+#define dwc_define_read_write_reg_n(_reg,_container_type) \
+static inline uint32_t dwc_read_##_reg##_n(_container_type *container, int num) { \
+	return DWC_READ_REG32(&container->regs->_reg[num]); \
+} \
+static inline void dwc_write_##_reg##_n(_container_type *container, int num, uint32_t data) { \
+	DWC_DEBUG("WRITING %8s[%d]: %p: %08x", #_reg, num, \
+		  &(((uint32_t*)container->regs->_reg)[num]), data); \
+	DWC_WRITE_REG32(&(((uint32_t*)container->regs->_reg)[num]), data); \
+}
+
+#define dwc_define_read_write_reg(_reg,_container_type) \
+static inline uint32_t dwc_read_##_reg(_container_type *container) { \
+	return DWC_READ_REG32(&container->regs->_reg); \
+} \
+static inline void dwc_write_##_reg(_container_type *container, uint32_t data) { \
+	DWC_DEBUG("WRITING %11s: %p: %08x", #_reg, &container->regs->_reg, data); \
+	DWC_WRITE_REG32(&container->regs->_reg, data); \
+}
+
+# else	/* DWC_DEBUG_REGS */
+
+#define dwc_define_read_write_reg_n(_reg,_container_type) \
+static inline uint32_t dwc_read_##_reg##_n(_container_type *container, int num) { \
+	return DWC_READ_REG32(&container->regs->_reg[num]); \
+} \
+static inline void dwc_write_##_reg##_n(_container_type *container, int num, uint32_t data) { \
+	DWC_WRITE_REG32(&(((uint32_t*)container->regs->_reg)[num]), data); \
+}
+
+#define dwc_define_read_write_reg(_reg,_container_type) \
+static inline uint32_t dwc_read_##_reg(_container_type *container) { \
+	return DWC_READ_REG32(&container->regs->_reg); \
+} \
+static inline void dwc_write_##_reg(_container_type *container, uint32_t data) { \
+	DWC_WRITE_REG32(&container->regs->_reg, data); \
+}
+
+# endif	/* DWC_DEBUG_REGS */
+
+#endif	/* DWC_LINUX */
+
+#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
+
+# ifdef DWC_DEBUG_REGS
+
+#define dwc_define_read_write_reg_n(_reg,_container_type) \
+static inline uint32_t dwc_read_##_reg##_n(void *io_ctx, _container_type *container, int num) { \
+	return DWC_READ_REG32(io_ctx, &container->regs->_reg[num]); \
+} \
+static inline void dwc_write_##_reg##_n(void *io_ctx, _container_type *container, int num, uint32_t data) { \
+	DWC_DEBUG("WRITING %8s[%d]: %p: %08x", #_reg, num, \
+		  &(((uint32_t*)container->regs->_reg)[num]), data); \
+	DWC_WRITE_REG32(io_ctx, &(((uint32_t*)container->regs->_reg)[num]), data); \
+}
+
+#define dwc_define_read_write_reg(_reg,_container_type) \
+static inline uint32_t dwc_read_##_reg(void *io_ctx, _container_type *container) { \
+	return DWC_READ_REG32(io_ctx, &container->regs->_reg); \
+} \
+static inline void dwc_write_##_reg(void *io_ctx, _container_type *container, uint32_t data) { \
+	DWC_DEBUG("WRITING %11s: %p: %08x", #_reg, &container->regs->_reg, data); \
+	DWC_WRITE_REG32(io_ctx, &container->regs->_reg, data); \
+}
+
+# else	/* DWC_DEBUG_REGS */
+
+#define dwc_define_read_write_reg_n(_reg,_container_type) \
+static inline uint32_t dwc_read_##_reg##_n(void *io_ctx, _container_type *container, int num) { \
+	return DWC_READ_REG32(io_ctx, &container->regs->_reg[num]); \
+} \
+static inline void dwc_write_##_reg##_n(void *io_ctx, _container_type *container, int num, uint32_t data) { \
+	DWC_WRITE_REG32(io_ctx, &(((uint32_t*)container->regs->_reg)[num]), data); \
+}
+
+#define dwc_define_read_write_reg(_reg,_container_type) \
+static inline uint32_t dwc_read_##_reg(void *io_ctx, _container_type *container) { \
+	return DWC_READ_REG32(io_ctx, &container->regs->_reg); \
+} \
+static inline void dwc_write_##_reg(void *io_ctx, _container_type *container, uint32_t data) { \
+	DWC_WRITE_REG32(io_ctx, &container->regs->_reg, data); \
+}
+
+# endif	/* DWC_DEBUG_REGS */
+
+#endif	/* DWC_FREEBSD || DWC_NETBSD */
+
+/** @endcond */
+
+
+#ifdef DWC_CRYPTOLIB
+/** @name Crypto Functions
+ *
+ * These are the low-level cryptographic functions used by the driver. */
+
+/** Perform AES CBC */
+extern int DWC_AES_CBC(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t iv[16], uint8_t *out);
+#define dwc_aes_cbc DWC_AES_CBC
+
+/** Fill the provided buffer with random bytes.  These should be cryptographic grade random numbers. */
+extern void DWC_RANDOM_BYTES(uint8_t *buffer, uint32_t length);
+#define dwc_random_bytes DWC_RANDOM_BYTES
+
+/** Perform the SHA-256 hash function */
+extern int DWC_SHA256(uint8_t *message, uint32_t len, uint8_t *out);
+#define dwc_sha256 DWC_SHA256
+
+/** Calculated the HMAC-SHA256 */
+extern int DWC_HMAC_SHA256(uint8_t *message, uint32_t messagelen, uint8_t *key, uint32_t keylen, uint8_t *out);
+#define dwc_hmac_sha256 DWC_HMAC_SHA256
+
+#endif	/* DWC_CRYPTOLIB */
+
+
+/** @name Memory Allocation
+ *
+ * These function provide access to memory allocation.  There are only 2 DMA
+ * functions and 3 Regular memory functions that need to be implemented.  None
+ * of the memory debugging routines need to be implemented.  The allocation
+ * routines all ZERO the contents of the memory.
+ *
+ * Defining DWC_DEBUG_MEMORY turns on memory debugging and statistic gathering.
+ * This checks for memory leaks, keeping track of alloc/free pairs.  It also
+ * keeps track of how much memory the driver is using at any given time. */
+
+#define DWC_PAGE_SIZE 4096
+#define DWC_PAGE_OFFSET(addr) (((uint32_t)addr) & 0xfff)
+#define DWC_PAGE_ALIGNED(addr) ((((uint32_t)addr) & 0xfff) == 0)
+
+#define DWC_INVALID_DMA_ADDR 0x0
+
+#ifdef DWC_LINUX
+/** Type for a DMA address */
+typedef dma_addr_t dwc_dma_t;
+#endif
+
+#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
+typedef bus_addr_t dwc_dma_t;
+#endif
+
+#ifdef DWC_FREEBSD
+typedef struct dwc_dmactx {
+	struct device *dev;
+	bus_dma_tag_t dma_tag;
+	bus_dmamap_t dma_map;
+	bus_addr_t dma_paddr;
+	void *dma_vaddr;
+} dwc_dmactx_t;
+#endif
+
+#ifdef DWC_NETBSD
+typedef struct dwc_dmactx {
+	struct device *dev;
+	bus_dma_tag_t dma_tag;
+	bus_dmamap_t dma_map;
+	bus_dma_segment_t segs[1];
+	int nsegs;
+	bus_addr_t dma_paddr;
+	void *dma_vaddr;
+} dwc_dmactx_t;
+#endif
+
+/* @todo these functions will be added in the future */
+#if 0
+/**
+ * Creates a DMA pool from which you can allocate DMA buffers.  Buffers
+ * allocated from this pool will be guaranteed to meet the size, alignment, and
+ * boundary requirements specified.
+ *
+ * @param[in] size Specifies the size of the buffers that will be allocated from
+ * this pool.
+ * @param[in] align Specifies the byte alignment requirements of the buffers
+ * allocated from this pool.  Must be a power of 2.
+ * @param[in] boundary Specifies the N-byte boundary that buffers allocated from
+ * this pool must not cross.
+ *
+ * @returns A pointer to an internal opaque structure which is not to be
+ * accessed outside of these library functions.  Use this handle to specify
+ * which pools to allocate/free DMA buffers from and also to destroy the pool,
+ * when you are done with it.
+ */
+extern dwc_pool_t *DWC_DMA_POOL_CREATE(uint32_t size, uint32_t align, uint32_t boundary);
+
+/**
+ * Destroy a DMA pool.  All buffers allocated from that pool must be freed first.
+ */
+extern void DWC_DMA_POOL_DESTROY(dwc_pool_t *pool);
+
+/**
+ * Allocate a buffer from the specified DMA pool and zeros its contents.
+ */
+extern void *DWC_DMA_POOL_ALLOC(dwc_pool_t *pool, uint64_t *dma_addr);
+
+/**
+ * Free a previously allocated buffer from the DMA pool.
+ */
+extern void DWC_DMA_POOL_FREE(dwc_pool_t *pool, void *vaddr, void *daddr);
+#endif
+
+/** Allocates a DMA capable buffer and zeroes its contents. */
+extern void *__DWC_DMA_ALLOC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr);
+
+/** Allocates a DMA capable buffer and zeroes its contents in atomic contest */
+extern void *__DWC_DMA_ALLOC_ATOMIC(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr);
+
+/** Frees a previously allocated buffer. */
+extern void __DWC_DMA_FREE(void *dma_ctx, uint32_t size, void *virt_addr, dwc_dma_t dma_addr);
+
+/** Allocates a block of memory and zeroes its contents. */
+extern void *__DWC_ALLOC(void *mem_ctx, uint32_t size);
+
+/** Allocates a block of memory and zeroes its contents, in an atomic manner
+ * which can be used inside interrupt context.  The size should be sufficiently
+ * small, a few KB at most, such that failures are not likely to occur.  Can just call
+ * __DWC_ALLOC if it is atomic. */
+extern void *__DWC_ALLOC_ATOMIC(void *mem_ctx, uint32_t size);
+
+/** Frees a previously allocated buffer. */
+extern void __DWC_FREE(void *mem_ctx, void *addr);
+
+#ifndef DWC_DEBUG_MEMORY
+
+#define DWC_ALLOC(_size_) __DWC_ALLOC(NULL, _size_)
+#define DWC_ALLOC_ATOMIC(_size_) __DWC_ALLOC_ATOMIC(NULL, _size_)
+#define DWC_FREE(_addr_) __DWC_FREE(NULL, _addr_)
+
+# ifdef DWC_LINUX
+#define DWC_DMA_ALLOC(_dev, _size_, _dma_) __DWC_DMA_ALLOC(_dev, _size_, _dma_)
+#define DWC_DMA_ALLOC_ATOMIC(_dev, _size_, _dma_) __DWC_DMA_ALLOC_ATOMIC(_dev, _size_, _dma_)
+#define DWC_DMA_FREE(_dev, _size_,_virt_, _dma_) __DWC_DMA_FREE(_dev, _size_, _virt_, _dma_)
+# endif
+
+# if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
+#define DWC_DMA_ALLOC __DWC_DMA_ALLOC
+#define DWC_DMA_FREE __DWC_DMA_FREE
+# endif
+extern void *dwc_dma_alloc_atomic_debug(uint32_t size, dwc_dma_t *dma_addr, char const *func, int line);
+
+#else	/* DWC_DEBUG_MEMORY */
+
+extern void *dwc_alloc_debug(void *mem_ctx, uint32_t size, char const *func, int line);
+extern void *dwc_alloc_atomic_debug(void *mem_ctx, uint32_t size, char const *func, int line);
+extern void dwc_free_debug(void *mem_ctx, void *addr, char const *func, int line);
+extern void *dwc_dma_alloc_debug(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr,
+				 char const *func, int line);
+extern void *dwc_dma_alloc_atomic_debug(void *dma_ctx, uint32_t size, dwc_dma_t *dma_addr,
+				char const *func, int line);
+extern void dwc_dma_free_debug(void *dma_ctx, uint32_t size, void *virt_addr,
+			       dwc_dma_t dma_addr, char const *func, int line);
+
+extern int dwc_memory_debug_start(void *mem_ctx);
+extern void dwc_memory_debug_stop(void);
+extern void dwc_memory_debug_report(void);
+
+#define DWC_ALLOC(_size_) dwc_alloc_debug(NULL, _size_, __func__, __LINE__)
+#define DWC_ALLOC_ATOMIC(_size_) dwc_alloc_atomic_debug(NULL, _size_, \
+							__func__, __LINE__)
+#define DWC_FREE(_addr_) dwc_free_debug(NULL, _addr_, __func__, __LINE__)
+
+# ifdef DWC_LINUX
+#define DWC_DMA_ALLOC(_dev, _size_, _dma_) \
+	dwc_dma_alloc_debug(_dev, _size_, _dma_, __func__, __LINE__)
+#define DWC_DMA_ALLOC_ATOMIC(_dev, _size_, _dma_) \
+	dwc_dma_alloc_atomic_debug(_dev, _size_, _dma_, __func__, __LINE__)
+#define DWC_DMA_FREE(_dev, _size_, _virt_, _dma_) \
+	dwc_dma_free_debug(_dev, _size_, _virt_, _dma_, __func__, __LINE__)
+# endif
+
+# if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
+#define DWC_DMA_ALLOC(_ctx_,_size_,_dma_) dwc_dma_alloc_debug(_ctx_, _size_, \
+						_dma_, __func__, __LINE__)
+#define DWC_DMA_FREE(_ctx_,_size_,_virt_,_dma_) dwc_dma_free_debug(_ctx_, _size_, \
+						 _virt_, _dma_, __func__, __LINE__)
+# endif
+
+#endif /* DWC_DEBUG_MEMORY */
+
+#define dwc_alloc(_ctx_,_size_) DWC_ALLOC(_size_)
+#define dwc_alloc_atomic(_ctx_,_size_) DWC_ALLOC_ATOMIC(_size_)
+#define dwc_free(_ctx_,_addr_) DWC_FREE(_addr_)
+
+#ifdef DWC_LINUX
+/* Linux doesn't need any extra parameters for DMA buffer allocation, so we
+ * just throw away the DMA context parameter.
+ */
+#define dwc_dma_alloc(_ctx_,_size_,_dma_) DWC_DMA_ALLOC(_size_, _dma_)
+#define dwc_dma_alloc_atomic(_ctx_,_size_,_dma_) DWC_DMA_ALLOC_ATOMIC(_size_, _dma_)
+#define dwc_dma_free(_ctx_,_size_,_virt_,_dma_) DWC_DMA_FREE(_size_, _virt_, _dma_)
+#endif
+
+#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
+/** BSD needs several extra parameters for DMA buffer allocation, so we pass
+ * them in using the DMA context parameter.
+ */
+#define dwc_dma_alloc DWC_DMA_ALLOC
+#define dwc_dma_free DWC_DMA_FREE
+#endif
+
+
+/** @name Memory and String Processing */
+
+/** memset() clone */
+extern void *DWC_MEMSET(void *dest, uint8_t byte, uint32_t size);
+#define dwc_memset DWC_MEMSET
+
+/** memcpy() clone */
+extern void *DWC_MEMCPY(void *dest, void const *src, uint32_t size);
+#define dwc_memcpy DWC_MEMCPY
+
+/** memmove() clone */
+extern void *DWC_MEMMOVE(void *dest, void *src, uint32_t size);
+#define dwc_memmove DWC_MEMMOVE
+
+/** memcmp() clone */
+extern int DWC_MEMCMP(void *m1, void *m2, uint32_t size);
+#define dwc_memcmp DWC_MEMCMP
+
+/** strcmp() clone */
+extern int DWC_STRCMP(void *s1, void *s2);
+#define dwc_strcmp DWC_STRCMP
+
+/** strncmp() clone */
+extern int DWC_STRNCMP(void *s1, void *s2, uint32_t size);
+#define dwc_strncmp DWC_STRNCMP
+
+/** strlen() clone, for NULL terminated ASCII strings */
+extern int DWC_STRLEN(char const *str);
+#define dwc_strlen DWC_STRLEN
+
+/** strcpy() clone, for NULL terminated ASCII strings */
+extern char *DWC_STRCPY(char *to, const char *from);
+#define dwc_strcpy DWC_STRCPY
+
+/** strdup() clone.  If you wish to use memory allocation debugging, this
+ * implementation of strdup should use the DWC_* memory routines instead of
+ * calling a predefined strdup.  Otherwise the memory allocated by this routine
+ * will not be seen by the debugging routines. */
+extern char *DWC_STRDUP(char const *str);
+#define dwc_strdup(_ctx_,_str_) DWC_STRDUP(_str_)
+
+/** NOT an atoi() clone.  Read the description carefully.  Returns an integer
+ * converted from the string str in base 10 unless the string begins with a "0x"
+ * in which case it is base 16.  String must be a NULL terminated sequence of
+ * ASCII characters and may optionally begin with whitespace, a + or -, and a
+ * "0x" prefix if base 16.  The remaining characters must be valid digits for
+ * the number and end with a NULL character.  If any invalid characters are
+ * encountered or it returns with a negative error code and the results of the
+ * conversion are undefined.  On sucess it returns 0.  Overflow conditions are
+ * undefined.  An example implementation using atoi() can be referenced from the
+ * Linux implementation. */
+extern int DWC_ATOI(const char *str, int32_t *value);
+#define dwc_atoi DWC_ATOI
+
+/** Same as above but for unsigned. */
+extern int DWC_ATOUI(const char *str, uint32_t *value);
+#define dwc_atoui DWC_ATOUI
+
+#ifdef DWC_UTFLIB
+/** This routine returns a UTF16LE unicode encoded string from a UTF8 string. */
+extern int DWC_UTF8_TO_UTF16LE(uint8_t const *utf8string, uint16_t *utf16string, unsigned len);
+#define dwc_utf8_to_utf16le DWC_UTF8_TO_UTF16LE
+#endif
+
+
+/** @name Wait queues
+ *
+ * Wait queues provide a means of synchronizing between threads or processes.  A
+ * process can block on a waitq if some condition is not true, waiting for it to
+ * become true.  When the waitq is triggered all waiting process will get
+ * unblocked and the condition will be check again.  Waitqs should be triggered
+ * every time a condition can potentially change.*/
+struct dwc_waitq;
+
+/** Type for a waitq */
+typedef struct dwc_waitq dwc_waitq_t;
+
+/** The type of waitq condition callback function.  This is called every time
+ * condition is evaluated. */
+typedef int (*dwc_waitq_condition_t)(void *data);
+
+/** Allocate a waitq */
+extern dwc_waitq_t *DWC_WAITQ_ALLOC(void);
+#define dwc_waitq_alloc(_ctx_) DWC_WAITQ_ALLOC()
+
+/** Free a waitq */
+extern void DWC_WAITQ_FREE(dwc_waitq_t *wq);
+#define dwc_waitq_free DWC_WAITQ_FREE
+
+/** Check the condition and if it is false, block on the waitq.  When unblocked, check the
+ * condition again.  The function returns when the condition becomes true.  The return value
+ * is 0 on condition true, DWC_WAITQ_ABORTED on abort or killed, or DWC_WAITQ_UNKNOWN on error. */
+extern int32_t DWC_WAITQ_WAIT(dwc_waitq_t *wq, dwc_waitq_condition_t cond, void *data);
+#define dwc_waitq_wait DWC_WAITQ_WAIT
+
+/** Check the condition and if it is false, block on the waitq.  When unblocked,
+ * check the condition again.  The function returns when the condition become
+ * true or the timeout has passed.  The return value is 0 on condition true or
+ * DWC_TIMED_OUT on timeout, or DWC_WAITQ_ABORTED, or DWC_WAITQ_UNKNOWN on
+ * error. */
+extern int32_t DWC_WAITQ_WAIT_TIMEOUT(dwc_waitq_t *wq, dwc_waitq_condition_t cond,
+				      void *data, int32_t msecs);
+#define dwc_waitq_wait_timeout DWC_WAITQ_WAIT_TIMEOUT
+
+/** Trigger a waitq, unblocking all processes.  This should be called whenever a condition
+ * has potentially changed. */
+extern void DWC_WAITQ_TRIGGER(dwc_waitq_t *wq);
+#define dwc_waitq_trigger DWC_WAITQ_TRIGGER
+
+/** Unblock all processes waiting on the waitq with an ABORTED result. */
+extern void DWC_WAITQ_ABORT(dwc_waitq_t *wq);
+#define dwc_waitq_abort DWC_WAITQ_ABORT
+
+
+/** @name Threads
+ *
+ * A thread must be explicitly stopped.  It must check DWC_THREAD_SHOULD_STOP
+ * whenever it is woken up, and then return.  The DWC_THREAD_STOP function
+ * returns the value from the thread.
+ */
+
+struct dwc_thread;
+
+/** Type for a thread */
+typedef struct dwc_thread dwc_thread_t;
+
+/** The thread function */
+typedef int (*dwc_thread_function_t)(void *data);
+
+/** Create a thread and start it running the thread_function.  Returns a handle
+ * to the thread */
+extern dwc_thread_t *DWC_THREAD_RUN(dwc_thread_function_t func, char *name, void *data);
+#define dwc_thread_run(_ctx_,_func_,_name_,_data_) DWC_THREAD_RUN(_func_, _name_, _data_)
+
+/** Stops a thread.  Return the value returned by the thread.  Or will return
+ * DWC_ABORT if the thread never started. */
+extern int DWC_THREAD_STOP(dwc_thread_t *thread);
+#define dwc_thread_stop DWC_THREAD_STOP
+
+/** Signifies to the thread that it must stop. */
+#ifdef DWC_LINUX
+/* Linux doesn't need any parameters for kthread_should_stop() */
+extern dwc_bool_t DWC_THREAD_SHOULD_STOP(void);
+#define dwc_thread_should_stop(_thrd_) DWC_THREAD_SHOULD_STOP()
+
+/* No thread_exit function in Linux */
+#define dwc_thread_exit(_thrd_)
+#endif
+
+#if defined(DWC_FREEBSD) || defined(DWC_NETBSD)
+/** BSD needs the thread pointer for kthread_suspend_check() */
+extern dwc_bool_t DWC_THREAD_SHOULD_STOP(dwc_thread_t *thread);
+#define dwc_thread_should_stop DWC_THREAD_SHOULD_STOP
+
+/** The thread must call this to exit. */
+extern void DWC_THREAD_EXIT(dwc_thread_t *thread);
+#define dwc_thread_exit DWC_THREAD_EXIT
+#endif
+
+
+/** @name Work queues
+ *
+ * Workqs are used to queue a callback function to be called at some later time,
+ * in another thread. */
+struct dwc_workq;
+
+/** Type for a workq */
+typedef struct dwc_workq dwc_workq_t;
+
+/** The type of the callback function to be called. */
+typedef void (*dwc_work_callback_t)(void *data);
+
+/** Allocate a workq */
+extern dwc_workq_t *DWC_WORKQ_ALLOC(char *name);
+#define dwc_workq_alloc(_ctx_,_name_) DWC_WORKQ_ALLOC(_name_)
+
+/** Free a workq.  All work must be completed before being freed. */
+extern void DWC_WORKQ_FREE(dwc_workq_t *workq);
+#define dwc_workq_free DWC_WORKQ_FREE
+
+/** Schedule a callback on the workq, passing in data.  The function will be
+ * scheduled at some later time. */
+extern void DWC_WORKQ_SCHEDULE(dwc_workq_t *workq, dwc_work_callback_t cb,
+			       void *data, char *format, ...)
+#ifdef __GNUC__
+	__attribute__ ((format(printf, 4, 5)));
+#else
+	;
+#endif
+#define dwc_workq_schedule DWC_WORKQ_SCHEDULE
+
+/** Schedule a callback on the workq, that will be called until at least
+ * given number miliseconds have passed. */
+extern void DWC_WORKQ_SCHEDULE_DELAYED(dwc_workq_t *workq, dwc_work_callback_t cb,
+				       void *data, uint32_t time, char *format, ...)
+#ifdef __GNUC__
+	__attribute__ ((format(printf, 5, 6)));
+#else
+	;
+#endif
+#define dwc_workq_schedule_delayed DWC_WORKQ_SCHEDULE_DELAYED
+
+/** The number of processes in the workq */
+extern int DWC_WORKQ_PENDING(dwc_workq_t *workq);
+#define dwc_workq_pending DWC_WORKQ_PENDING
+
+/** Blocks until all the work in the workq is complete or timed out.  Returns <
+ * 0 on timeout. */
+extern int DWC_WORKQ_WAIT_WORK_DONE(dwc_workq_t *workq, int timeout);
+#define dwc_workq_wait_work_done DWC_WORKQ_WAIT_WORK_DONE
+
+
+/** @name Tasklets
+ *
+ */
+struct dwc_tasklet;
+
+/** Type for a tasklet */
+typedef struct dwc_tasklet dwc_tasklet_t;
+
+/** The type of the callback function to be called */
+typedef void (*dwc_tasklet_callback_t)(void *data);
+
+/** Allocates a tasklet */
+extern dwc_tasklet_t *DWC_TASK_ALLOC(char *name, dwc_tasklet_callback_t cb, void *data);
+#define dwc_task_alloc(_ctx_,_name_,_cb_,_data_) DWC_TASK_ALLOC(_name_, _cb_, _data_)
+
+/** Frees a tasklet */
+extern void DWC_TASK_FREE(dwc_tasklet_t *task);
+#define dwc_task_free DWC_TASK_FREE
+
+/** Schedules a tasklet to run */
+extern void DWC_TASK_SCHEDULE(dwc_tasklet_t *task);
+#define dwc_task_schedule DWC_TASK_SCHEDULE
+
+extern void DWC_TASK_HI_SCHEDULE(dwc_tasklet_t *task);
+#define dwc_task_hi_schedule DWC_TASK_HI_SCHEDULE
+
+/** @name Timer
+ *
+ * Callbacks must be small and atomic.
+ */
+struct dwc_timer;
+
+/** Type for a timer */
+typedef struct dwc_timer dwc_timer_t;
+
+/** The type of the callback function to be called */
+typedef void (*dwc_timer_callback_t)(void *data);
+
+/** Allocates a timer */
+extern dwc_timer_t *DWC_TIMER_ALLOC(char *name, dwc_timer_callback_t cb, void *data);
+#define dwc_timer_alloc(_ctx_,_name_,_cb_,_data_) DWC_TIMER_ALLOC(_name_,_cb_,_data_)
+
+/** Frees a timer */
+extern void DWC_TIMER_FREE(dwc_timer_t *timer);
+#define dwc_timer_free DWC_TIMER_FREE
+
+/** Schedules the timer to run at time ms from now.  And will repeat at every
+ * repeat_interval msec therafter
+ *
+ * Modifies a timer that is still awaiting execution to a new expiration time.
+ * The mod_time is added to the old time.  */
+extern void DWC_TIMER_SCHEDULE(dwc_timer_t *timer, uint32_t time);
+#define dwc_timer_schedule DWC_TIMER_SCHEDULE
+
+/** Disables the timer from execution. */
+extern void DWC_TIMER_CANCEL(dwc_timer_t *timer);
+#define dwc_timer_cancel DWC_TIMER_CANCEL
+
+
+/** @name Spinlocks
+ *
+ * These locks are used when the work between the lock/unlock is atomic and
+ * short.  Interrupts are also disabled during the lock/unlock and thus they are
+ * suitable to lock between interrupt/non-interrupt context.  They also lock
+ * between processes if you have multiple CPUs or Preemption.  If you don't have
+ * multiple CPUS or Preemption, then the you can simply implement the
+ * DWC_SPINLOCK and DWC_SPINUNLOCK to disable and enable interrupts.  Because
+ * the work between the lock/unlock is atomic, the process context will never
+ * change, and so you never have to lock between processes.  */
+
+struct dwc_spinlock;
+
+/** Type for a spinlock */
+typedef struct dwc_spinlock dwc_spinlock_t;
+
+/** Type for the 'flags' argument to spinlock funtions */
+typedef unsigned long dwc_irqflags_t;
+
+/** Returns an initialized lock variable.  This function should allocate and
+ * initialize the OS-specific data structure used for locking.  This data
+ * structure is to be used for the DWC_LOCK and DWC_UNLOCK functions and should
+ * be freed by the DWC_FREE_LOCK when it is no longer used.
+ *
+ * For Linux Spinlock Debugging make it macro because the debugging routines use
+ * the symbol name to determine recursive locking. Using a wrapper function
+ * makes it falsely think recursive locking occurs. */
+#if defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK)
+#define DWC_SPINLOCK_ALLOC_LINUX_DEBUG(lock) ({ \
+	lock = DWC_ALLOC(sizeof(spinlock_t)); \
+	if (lock) { \
+		spin_lock_init((spinlock_t *)lock); \
+	} \
+})
+#else
+extern dwc_spinlock_t *DWC_SPINLOCK_ALLOC(void);
+#define dwc_spinlock_alloc(_ctx_) DWC_SPINLOCK_ALLOC()
+#endif
+
+/** Frees an initialized lock variable. */
+extern void DWC_SPINLOCK_FREE(dwc_spinlock_t *lock);
+#define dwc_spinlock_free(_ctx_,_lock_) DWC_SPINLOCK_FREE(_lock_)
+
+/** Disables interrupts and blocks until it acquires the lock.
+ *
+ * @param lock Pointer to the spinlock.
+ * @param flags Unsigned long for irq flags storage.
+ */
+extern void DWC_SPINLOCK_IRQSAVE(dwc_spinlock_t *lock, dwc_irqflags_t *flags);
+#define dwc_spinlock_irqsave DWC_SPINLOCK_IRQSAVE
+
+/** Re-enables the interrupt and releases the lock.
+ *
+ * @param lock Pointer to the spinlock.
+ * @param flags Unsigned long for irq flags storage.  Must be the same as was
+ * passed into DWC_LOCK.
+ */
+extern void DWC_SPINUNLOCK_IRQRESTORE(dwc_spinlock_t *lock, dwc_irqflags_t flags);
+#define dwc_spinunlock_irqrestore DWC_SPINUNLOCK_IRQRESTORE
+
+/** Blocks until it acquires the lock.
+ *
+ * @param lock Pointer to the spinlock.
+ */
+extern void DWC_SPINLOCK(dwc_spinlock_t *lock);
+#define dwc_spinlock DWC_SPINLOCK
+
+/** Releases the lock.
+ *
+ * @param lock Pointer to the spinlock.
+ */
+extern void DWC_SPINUNLOCK(dwc_spinlock_t *lock);
+#define dwc_spinunlock DWC_SPINUNLOCK
+
+
+/** @name Mutexes
+ *
+ * Unlike spinlocks Mutexes lock only between processes and the work between the
+ * lock/unlock CAN block, therefore it CANNOT be called from interrupt context.
+ */
+
+struct dwc_mutex;
+
+/** Type for a mutex */
+typedef struct dwc_mutex dwc_mutex_t;
+
+/* For Linux Mutex Debugging make it inline because the debugging routines use
+ * the symbol to determine recursive locking.  This makes it falsely think
+ * recursive locking occurs. */
+#if defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES)
+#define DWC_MUTEX_ALLOC_LINUX_DEBUG(__mutexp) ({ \
+	__mutexp = (dwc_mutex_t *)DWC_ALLOC(sizeof(struct mutex)); \
+	mutex_init((struct mutex *)__mutexp); \
+})
+#endif
+
+/** Allocate a mutex */
+extern dwc_mutex_t *DWC_MUTEX_ALLOC(void);
+#define dwc_mutex_alloc(_ctx_) DWC_MUTEX_ALLOC()
+
+/* For memory leak debugging when using Linux Mutex Debugging */
+#if defined(DWC_LINUX) && defined(CONFIG_DEBUG_MUTEXES)
+#define DWC_MUTEX_FREE(__mutexp) do { \
+	mutex_destroy((struct mutex *)__mutexp); \
+	DWC_FREE(__mutexp); \
+} while(0)
+#else
+/** Free a mutex */
+extern void DWC_MUTEX_FREE(dwc_mutex_t *mutex);
+#define dwc_mutex_free(_ctx_,_mutex_) DWC_MUTEX_FREE(_mutex_)
+#endif
+
+/** Lock a mutex */
+extern void DWC_MUTEX_LOCK(dwc_mutex_t *mutex);
+#define dwc_mutex_lock DWC_MUTEX_LOCK
+
+/** Non-blocking lock returns 1 on successful lock. */
+extern int DWC_MUTEX_TRYLOCK(dwc_mutex_t *mutex);
+#define dwc_mutex_trylock DWC_MUTEX_TRYLOCK
+
+/** Unlock a mutex */
+extern void DWC_MUTEX_UNLOCK(dwc_mutex_t *mutex);
+#define dwc_mutex_unlock DWC_MUTEX_UNLOCK
+
+
+/** @name Time */
+
+/** Microsecond delay.
+ *
+ * @param usecs  Microseconds to delay.
+ */
+extern void DWC_UDELAY(uint32_t usecs);
+#define dwc_udelay DWC_UDELAY
+
+/** Millisecond delay.
+ *
+ * @param msecs  Milliseconds to delay.
+ */
+extern void DWC_MDELAY(uint32_t msecs);
+#define dwc_mdelay DWC_MDELAY
+
+/** Non-busy waiting.
+ * Sleeps for specified number of milliseconds.
+ *
+ * @param msecs Milliseconds to sleep.
+ */
+extern void DWC_MSLEEP(uint32_t msecs);
+#define dwc_msleep DWC_MSLEEP
+
+/**
+ * Returns number of milliseconds since boot.
+ */
+extern uint32_t DWC_TIME(void);
+#define dwc_time DWC_TIME
+
+
+
+
+/* @mainpage DWC Portability and Common Library
+ *
+ * This is the documentation for the DWC Portability and Common Library.
+ *
+ * @section intro Introduction
+ *
+ * The DWC Portability library consists of wrapper calls and data structures to
+ * all low-level functions which are typically provided by the OS.  The WUDEV
+ * driver uses only these functions.  In order to port the WUDEV driver, only
+ * the functions in this library need to be re-implemented, with the same
+ * behavior as documented here.
+ *
+ * The Common library consists of higher level functions, which rely only on
+ * calling the functions from the DWC Portability library.  These common
+ * routines are shared across modules.  Some of the common libraries need to be
+ * used directly by the driver programmer when porting WUDEV.  Such as the
+ * parameter and notification libraries.
+ *
+ * @section low Portability Library OS Wrapper Functions
+ *
+ * Any function starting with DWC and in all CAPS is a low-level OS-wrapper that
+ * needs to be implemented when porting, for example DWC_MUTEX_ALLOC().  All of
+ * these functions are included in the dwc_os.h file.
+ *
+ * There are many functions here covering a wide array of OS services.  Please
+ * see dwc_os.h for details, and implementation notes for each function.
+ *
+ * @section common Common Library Functions
+ *
+ * Any function starting with dwc and in all lowercase is a common library
+ * routine.  These functions have a portable implementation and do not need to
+ * be reimplemented when porting.  The common routines can be used by any
+ * driver, and some must be used by the end user to control the drivers.  For
+ * example, you must use the Parameter common library in order to set the
+ * parameters in the WUDEV module.
+ *
+ * The common libraries consist of the following:
+ *
+ * - Connection Contexts - Used internally and can be used by end-user.  See dwc_cc.h
+ * - Parameters - Used internally and can be used by end-user.  See dwc_params.h
+ * - Notifications - Used internally and can be used by end-user.  See dwc_notifier.h
+ * - Lists - Used internally and can be used by end-user.  See dwc_list.h
+ * - Memory Debugging - Used internally and can be used by end-user.  See dwc_os.h
+ * - Modpow - Used internally only.  See dwc_modpow.h
+ * - DH - Used internally only.  See dwc_dh.h
+ * - Crypto - Used internally only.  See dwc_crypto.h
+ *
+ *
+ * @section prereq Prerequistes For dwc_os.h
+ * @subsection types Data Types
+ *
+ * The dwc_os.h file assumes that several low-level data types are pre defined for the
+ * compilation environment.  These data types are:
+ *
+ * - uint8_t - unsigned 8-bit data type
+ * - int8_t - signed 8-bit data type
+ * - uint16_t - unsigned 16-bit data type
+ * - int16_t - signed 16-bit data type
+ * - uint32_t - unsigned 32-bit data type
+ * - int32_t - signed 32-bit data type
+ * - uint64_t - unsigned 64-bit data type
+ * - int64_t - signed 64-bit data type
+ *
+ * Ensure that these are defined before using dwc_os.h.  The easiest way to do
+ * that is to modify the top of the file to include the appropriate header.
+ * This is already done for the Linux environment.  If the DWC_LINUX macro is
+ * defined, the correct header will be added.  A standard header <stdint.h> is
+ * also used for environments where standard C headers are available.
+ *
+ * @subsection stdarg Variable Arguments
+ *
+ * Variable arguments are provided by a standard C header <stdarg.h>.  it is
+ * available in Both the Linux and ANSI C enviornment.  An equivalent must be
+ * provided in your enviornment in order to use dwc_os.h with the debug and
+ * tracing message functionality.
+ *
+ * @subsection thread Threading
+ *
+ * WUDEV Core must be run on an operating system that provides for multiple
+ * threads/processes.  Threading can be implemented in many ways, even in
+ * embedded systems without an operating system.  At the bare minimum, the
+ * system should be able to start any number of processes at any time to handle
+ * special work.  It need not be a pre-emptive system.  Process context can
+ * change upon a call to a blocking function.  The hardware interrupt context
+ * that calls the module's ISR() function must be differentiable from process
+ * context, even if your processes are impemented via a hardware interrupt.
+ * Further locking mechanism between process must exist (or be implemented), and
+ * process context must have a way to disable interrupts for a period of time to
+ * lock them out.  If all of this exists, the functions in dwc_os.h related to
+ * threading should be able to be implemented with the defined behavior.
+ *
+ */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _DWC_OS_H_ */
diff --git a/drivers/usb/host/dwc_common_port/usb.h b/drivers/usb/host/dwc_common_port/usb.h
new file mode 100644
index 000000000000..27bda82dac2e
--- /dev/null
+++ b/drivers/usb/host/dwc_common_port/usb.h
@@ -0,0 +1,946 @@
+/*
+ * Copyright (c) 1998 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Lennart Augustsson (lennart@augustsson.net) at
+ * Carlstedt Research & Technology.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *        This product includes software developed by the NetBSD
+ *        Foundation, Inc. and its contributors.
+ * 4. Neither the name of The NetBSD Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* Modified by Synopsys, Inc, 12/12/2007 */
+
+
+#ifndef _USB_H_
+#define _USB_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * The USB records contain some unaligned little-endian word
+ * components.  The U[SG]ETW macros take care of both the alignment
+ * and endian problem and should always be used to access non-byte
+ * values.
+ */
+typedef u_int8_t uByte;
+typedef u_int8_t uWord[2];
+typedef u_int8_t uDWord[4];
+
+#define USETW2(w,h,l) ((w)[0] = (u_int8_t)(l), (w)[1] = (u_int8_t)(h))
+#define UCONSTW(x)	{ (x) & 0xff, ((x) >> 8) & 0xff }
+#define UCONSTDW(x)	{ (x) & 0xff, ((x) >> 8) & 0xff, \
+			  ((x) >> 16) & 0xff, ((x) >> 24) & 0xff }
+
+#if 1
+#define UGETW(w) ((w)[0] | ((w)[1] << 8))
+#define USETW(w,v) ((w)[0] = (u_int8_t)(v), (w)[1] = (u_int8_t)((v) >> 8))
+#define UGETDW(w) ((w)[0] | ((w)[1] << 8) | ((w)[2] << 16) | ((w)[3] << 24))
+#define USETDW(w,v) ((w)[0] = (u_int8_t)(v), \
+		     (w)[1] = (u_int8_t)((v) >> 8), \
+		     (w)[2] = (u_int8_t)((v) >> 16), \
+		     (w)[3] = (u_int8_t)((v) >> 24))
+#else
+/*
+ * On little-endian machines that can handle unanliged accesses
+ * (e.g. i386) these macros can be replaced by the following.
+ */
+#define UGETW(w) (*(u_int16_t *)(w))
+#define USETW(w,v) (*(u_int16_t *)(w) = (v))
+#define UGETDW(w) (*(u_int32_t *)(w))
+#define USETDW(w,v) (*(u_int32_t *)(w) = (v))
+#endif
+
+/*
+ * Macros for accessing UAS IU fields, which are big-endian
+ */
+#define IUSETW2(w,h,l) ((w)[0] = (u_int8_t)(h), (w)[1] = (u_int8_t)(l))
+#define IUCONSTW(x)	{ ((x) >> 8) & 0xff, (x) & 0xff }
+#define IUCONSTDW(x)	{ ((x) >> 24) & 0xff, ((x) >> 16) & 0xff, \
+			((x) >> 8) & 0xff, (x) & 0xff }
+#define IUGETW(w) (((w)[0] << 8) | (w)[1])
+#define IUSETW(w,v) ((w)[0] = (u_int8_t)((v) >> 8), (w)[1] = (u_int8_t)(v))
+#define IUGETDW(w) (((w)[0] << 24) | ((w)[1] << 16) | ((w)[2] << 8) | (w)[3])
+#define IUSETDW(w,v) ((w)[0] = (u_int8_t)((v) >> 24), \
+		      (w)[1] = (u_int8_t)((v) >> 16), \
+		      (w)[2] = (u_int8_t)((v) >> 8), \
+		      (w)[3] = (u_int8_t)(v))
+
+#define UPACKED __attribute__((__packed__))
+
+typedef struct {
+	uByte		bmRequestType;
+	uByte		bRequest;
+	uWord		wValue;
+	uWord		wIndex;
+	uWord		wLength;
+} UPACKED usb_device_request_t;
+
+#define UT_GET_DIR(a) ((a) & 0x80)
+#define UT_WRITE		0x00
+#define UT_READ			0x80
+
+#define UT_GET_TYPE(a) ((a) & 0x60)
+#define UT_STANDARD		0x00
+#define UT_CLASS		0x20
+#define UT_VENDOR		0x40
+
+#define UT_GET_RECIPIENT(a) ((a) & 0x1f)
+#define UT_DEVICE		0x00
+#define UT_INTERFACE		0x01
+#define UT_ENDPOINT		0x02
+#define UT_OTHER		0x03
+
+#define UT_READ_DEVICE		(UT_READ  | UT_STANDARD | UT_DEVICE)
+#define UT_READ_INTERFACE	(UT_READ  | UT_STANDARD | UT_INTERFACE)
+#define UT_READ_ENDPOINT	(UT_READ  | UT_STANDARD | UT_ENDPOINT)
+#define UT_WRITE_DEVICE		(UT_WRITE | UT_STANDARD | UT_DEVICE)
+#define UT_WRITE_INTERFACE	(UT_WRITE | UT_STANDARD | UT_INTERFACE)
+#define UT_WRITE_ENDPOINT	(UT_WRITE | UT_STANDARD | UT_ENDPOINT)
+#define UT_READ_CLASS_DEVICE	(UT_READ  | UT_CLASS | UT_DEVICE)
+#define UT_READ_CLASS_INTERFACE	(UT_READ  | UT_CLASS | UT_INTERFACE)
+#define UT_READ_CLASS_OTHER	(UT_READ  | UT_CLASS | UT_OTHER)
+#define UT_READ_CLASS_ENDPOINT	(UT_READ  | UT_CLASS | UT_ENDPOINT)
+#define UT_WRITE_CLASS_DEVICE	(UT_WRITE | UT_CLASS | UT_DEVICE)
+#define UT_WRITE_CLASS_INTERFACE (UT_WRITE | UT_CLASS | UT_INTERFACE)
+#define UT_WRITE_CLASS_OTHER	(UT_WRITE | UT_CLASS | UT_OTHER)
+#define UT_WRITE_CLASS_ENDPOINT	(UT_WRITE | UT_CLASS | UT_ENDPOINT)
+#define UT_READ_VENDOR_DEVICE	(UT_READ  | UT_VENDOR | UT_DEVICE)
+#define UT_READ_VENDOR_INTERFACE (UT_READ  | UT_VENDOR | UT_INTERFACE)
+#define UT_READ_VENDOR_OTHER	(UT_READ  | UT_VENDOR | UT_OTHER)
+#define UT_READ_VENDOR_ENDPOINT	(UT_READ  | UT_VENDOR | UT_ENDPOINT)
+#define UT_WRITE_VENDOR_DEVICE	(UT_WRITE | UT_VENDOR | UT_DEVICE)
+#define UT_WRITE_VENDOR_INTERFACE (UT_WRITE | UT_VENDOR | UT_INTERFACE)
+#define UT_WRITE_VENDOR_OTHER	(UT_WRITE | UT_VENDOR | UT_OTHER)
+#define UT_WRITE_VENDOR_ENDPOINT (UT_WRITE | UT_VENDOR | UT_ENDPOINT)
+
+/* Requests */
+#define UR_GET_STATUS		0x00
+#define  USTAT_STANDARD_STATUS  0x00
+#define  WUSTAT_WUSB_FEATURE    0x01
+#define  WUSTAT_CHANNEL_INFO    0x02
+#define  WUSTAT_RECEIVED_DATA   0x03
+#define  WUSTAT_MAS_AVAILABILITY 0x04
+#define  WUSTAT_CURRENT_TRANSMIT_POWER 0x05
+#define UR_CLEAR_FEATURE	0x01
+#define UR_SET_FEATURE		0x03
+#define UR_SET_AND_TEST_FEATURE 0x0c
+#define UR_SET_ADDRESS		0x05
+#define UR_GET_DESCRIPTOR	0x06
+#define  UDESC_DEVICE		0x01
+#define  UDESC_CONFIG		0x02
+#define  UDESC_STRING		0x03
+#define  UDESC_INTERFACE	0x04
+#define  UDESC_ENDPOINT		0x05
+#define  UDESC_SS_USB_COMPANION	0x30
+#define  UDESC_DEVICE_QUALIFIER	0x06
+#define  UDESC_OTHER_SPEED_CONFIGURATION 0x07
+#define  UDESC_INTERFACE_POWER	0x08
+#define  UDESC_OTG		0x09
+#define  WUDESC_SECURITY	0x0c
+#define  WUDESC_KEY		0x0d
+#define   WUD_GET_KEY_INDEX(_wValue_) ((_wValue_) & 0xf)
+#define   WUD_GET_KEY_TYPE(_wValue_) (((_wValue_) & 0x30) >> 4)
+#define    WUD_KEY_TYPE_ASSOC    0x01
+#define    WUD_KEY_TYPE_GTK      0x02
+#define   WUD_GET_KEY_ORIGIN(_wValue_) (((_wValue_) & 0x40) >> 6)
+#define    WUD_KEY_ORIGIN_HOST   0x00
+#define    WUD_KEY_ORIGIN_DEVICE 0x01
+#define  WUDESC_ENCRYPTION_TYPE	0x0e
+#define  WUDESC_BOS		0x0f
+#define  WUDESC_DEVICE_CAPABILITY 0x10
+#define  WUDESC_WIRELESS_ENDPOINT_COMPANION 0x11
+#define  UDESC_BOS		0x0f
+#define  UDESC_DEVICE_CAPABILITY 0x10
+#define  UDESC_CS_DEVICE	0x21	/* class specific */
+#define  UDESC_CS_CONFIG	0x22
+#define  UDESC_CS_STRING	0x23
+#define  UDESC_CS_INTERFACE	0x24
+#define  UDESC_CS_ENDPOINT	0x25
+#define  UDESC_HUB		0x29
+#define UR_SET_DESCRIPTOR	0x07
+#define UR_GET_CONFIG		0x08
+#define UR_SET_CONFIG		0x09
+#define UR_GET_INTERFACE	0x0a
+#define UR_SET_INTERFACE	0x0b
+#define UR_SYNCH_FRAME		0x0c
+#define WUR_SET_ENCRYPTION      0x0d
+#define WUR_GET_ENCRYPTION	0x0e
+#define WUR_SET_HANDSHAKE	0x0f
+#define WUR_GET_HANDSHAKE	0x10
+#define WUR_SET_CONNECTION	0x11
+#define WUR_SET_SECURITY_DATA	0x12
+#define WUR_GET_SECURITY_DATA	0x13
+#define WUR_SET_WUSB_DATA	0x14
+#define  WUDATA_DRPIE_INFO	0x01
+#define  WUDATA_TRANSMIT_DATA	0x02
+#define  WUDATA_TRANSMIT_PARAMS	0x03
+#define  WUDATA_RECEIVE_PARAMS	0x04
+#define  WUDATA_TRANSMIT_POWER	0x05
+#define WUR_LOOPBACK_DATA_WRITE	0x15
+#define WUR_LOOPBACK_DATA_READ	0x16
+#define WUR_SET_INTERFACE_DS	0x17
+
+/* Feature numbers */
+#define UF_ENDPOINT_HALT	0
+#define UF_DEVICE_REMOTE_WAKEUP	1
+#define UF_TEST_MODE		2
+#define UF_DEVICE_B_HNP_ENABLE	3
+#define UF_DEVICE_A_HNP_SUPPORT	4
+#define UF_DEVICE_A_ALT_HNP_SUPPORT 5
+#define WUF_WUSB		3
+#define  WUF_TX_DRPIE		0x0
+#define  WUF_DEV_XMIT_PACKET	0x1
+#define  WUF_COUNT_PACKETS	0x2
+#define  WUF_CAPTURE_PACKETS	0x3
+#define UF_FUNCTION_SUSPEND	0
+#define UF_U1_ENABLE		48
+#define UF_U2_ENABLE		49
+#define UF_LTM_ENABLE		50
+
+/* Class requests from the USB 2.0 hub spec, table 11-15 */
+#define UCR_CLEAR_HUB_FEATURE		(0x2000 | UR_CLEAR_FEATURE)
+#define UCR_CLEAR_PORT_FEATURE		(0x2300 | UR_CLEAR_FEATURE)
+#define UCR_GET_HUB_DESCRIPTOR		(0xa000 | UR_GET_DESCRIPTOR)
+#define UCR_GET_HUB_STATUS		(0xa000 | UR_GET_STATUS)
+#define UCR_GET_PORT_STATUS		(0xa300 | UR_GET_STATUS)
+#define UCR_SET_HUB_FEATURE		(0x2000 | UR_SET_FEATURE)
+#define UCR_SET_PORT_FEATURE		(0x2300 | UR_SET_FEATURE)
+#define UCR_SET_AND_TEST_PORT_FEATURE	(0xa300 | UR_SET_AND_TEST_FEATURE)
+
+#ifdef _MSC_VER
+#include <pshpack1.h>
+#endif
+
+typedef struct {
+	uByte		bLength;
+	uByte		bDescriptorType;
+	uByte		bDescriptorSubtype;
+} UPACKED usb_descriptor_t;
+
+typedef struct {
+	uByte		bLength;
+	uByte		bDescriptorType;
+} UPACKED usb_descriptor_header_t;
+
+typedef struct {
+	uByte		bLength;
+	uByte		bDescriptorType;
+	uWord		bcdUSB;
+#define UD_USB_2_0		0x0200
+#define UD_IS_USB2(d) (UGETW((d)->bcdUSB) >= UD_USB_2_0)
+	uByte		bDeviceClass;
+	uByte		bDeviceSubClass;
+	uByte		bDeviceProtocol;
+	uByte		bMaxPacketSize;
+	/* The fields below are not part of the initial descriptor. */
+	uWord		idVendor;
+	uWord		idProduct;
+	uWord		bcdDevice;
+	uByte		iManufacturer;
+	uByte		iProduct;
+	uByte		iSerialNumber;
+	uByte		bNumConfigurations;
+} UPACKED usb_device_descriptor_t;
+#define USB_DEVICE_DESCRIPTOR_SIZE 18
+
+typedef struct {
+	uByte		bLength;
+	uByte		bDescriptorType;
+	uWord		wTotalLength;
+	uByte		bNumInterface;
+	uByte		bConfigurationValue;
+	uByte		iConfiguration;
+#define UC_ATT_ONE		(1 << 7)	/* must be set */
+#define UC_ATT_SELFPOWER	(1 << 6)	/* self powered */
+#define UC_ATT_WAKEUP		(1 << 5)	/* can wakeup */
+#define UC_ATT_BATTERY		(1 << 4)	/* battery powered */
+	uByte		bmAttributes;
+#define UC_BUS_POWERED		0x80
+#define UC_SELF_POWERED		0x40
+#define UC_REMOTE_WAKEUP	0x20
+	uByte		bMaxPower; /* max current in 2 mA units */
+#define UC_POWER_FACTOR 2
+} UPACKED usb_config_descriptor_t;
+#define USB_CONFIG_DESCRIPTOR_SIZE 9
+
+typedef struct {
+	uByte		bLength;
+	uByte		bDescriptorType;
+	uByte		bInterfaceNumber;
+	uByte		bAlternateSetting;
+	uByte		bNumEndpoints;
+	uByte		bInterfaceClass;
+	uByte		bInterfaceSubClass;
+	uByte		bInterfaceProtocol;
+	uByte		iInterface;
+} UPACKED usb_interface_descriptor_t;
+#define USB_INTERFACE_DESCRIPTOR_SIZE 9
+
+typedef struct {
+	uByte		bLength;
+	uByte		bDescriptorType;
+	uByte		bEndpointAddress;
+#define UE_GET_DIR(a)	((a) & 0x80)
+#define UE_SET_DIR(a,d)	((a) | (((d)&1) << 7))
+#define UE_DIR_IN	0x80
+#define UE_DIR_OUT	0x00
+#define UE_ADDR		0x0f
+#define UE_GET_ADDR(a)	((a) & UE_ADDR)
+	uByte		bmAttributes;
+#define UE_XFERTYPE	0x03
+#define  UE_CONTROL	0x00
+#define  UE_ISOCHRONOUS	0x01
+#define  UE_BULK	0x02
+#define  UE_INTERRUPT	0x03
+#define UE_GET_XFERTYPE(a)	((a) & UE_XFERTYPE)
+#define UE_ISO_TYPE	0x0c
+#define  UE_ISO_ASYNC	0x04
+#define  UE_ISO_ADAPT	0x08
+#define  UE_ISO_SYNC	0x0c
+#define UE_GET_ISO_TYPE(a)	((a) & UE_ISO_TYPE)
+	uWord		wMaxPacketSize;
+	uByte		bInterval;
+} UPACKED usb_endpoint_descriptor_t;
+#define USB_ENDPOINT_DESCRIPTOR_SIZE 7
+
+typedef struct ss_endpoint_companion_descriptor {
+	uByte bLength;
+	uByte bDescriptorType;
+	uByte bMaxBurst;
+#define USSE_GET_MAX_STREAMS(a)		((a) & 0x1f)
+#define USSE_SET_MAX_STREAMS(a, b)	((a) | ((b) & 0x1f))
+#define USSE_GET_MAX_PACKET_NUM(a)	((a) & 0x03)
+#define USSE_SET_MAX_PACKET_NUM(a, b)	((a) | ((b) & 0x03))
+	uByte bmAttributes;
+	uWord wBytesPerInterval;
+} UPACKED ss_endpoint_companion_descriptor_t;
+#define USB_SS_ENDPOINT_COMPANION_DESCRIPTOR_SIZE 6
+
+typedef struct {
+	uByte		bLength;
+	uByte		bDescriptorType;
+	uWord		bString[127];
+} UPACKED usb_string_descriptor_t;
+#define USB_MAX_STRING_LEN 128
+#define USB_LANGUAGE_TABLE 0	/* # of the string language id table */
+
+/* Hub specific request */
+#define UR_GET_BUS_STATE	0x02
+#define UR_CLEAR_TT_BUFFER	0x08
+#define UR_RESET_TT		0x09
+#define UR_GET_TT_STATE		0x0a
+#define UR_STOP_TT		0x0b
+
+/* Hub features */
+#define UHF_C_HUB_LOCAL_POWER	0
+#define UHF_C_HUB_OVER_CURRENT	1
+#define UHF_PORT_CONNECTION	0
+#define UHF_PORT_ENABLE		1
+#define UHF_PORT_SUSPEND	2
+#define UHF_PORT_OVER_CURRENT	3
+#define UHF_PORT_RESET		4
+#define UHF_PORT_L1		5
+#define UHF_PORT_POWER		8
+#define UHF_PORT_LOW_SPEED	9
+#define UHF_PORT_HIGH_SPEED	10
+#define UHF_C_PORT_CONNECTION	16
+#define UHF_C_PORT_ENABLE	17
+#define UHF_C_PORT_SUSPEND	18
+#define UHF_C_PORT_OVER_CURRENT	19
+#define UHF_C_PORT_RESET	20
+#define UHF_C_PORT_L1		23
+#define UHF_PORT_TEST		21
+#define UHF_PORT_INDICATOR	22
+
+typedef struct {
+	uByte		bDescLength;
+	uByte		bDescriptorType;
+	uByte		bNbrPorts;
+	uWord		wHubCharacteristics;
+#define UHD_PWR			0x0003
+#define  UHD_PWR_GANGED		0x0000
+#define  UHD_PWR_INDIVIDUAL	0x0001
+#define  UHD_PWR_NO_SWITCH	0x0002
+#define UHD_COMPOUND		0x0004
+#define UHD_OC			0x0018
+#define  UHD_OC_GLOBAL		0x0000
+#define  UHD_OC_INDIVIDUAL	0x0008
+#define  UHD_OC_NONE		0x0010
+#define UHD_TT_THINK		0x0060
+#define  UHD_TT_THINK_8		0x0000
+#define  UHD_TT_THINK_16	0x0020
+#define  UHD_TT_THINK_24	0x0040
+#define  UHD_TT_THINK_32	0x0060
+#define UHD_PORT_IND		0x0080
+	uByte		bPwrOn2PwrGood;	/* delay in 2 ms units */
+#define UHD_PWRON_FACTOR 2
+	uByte		bHubContrCurrent;
+	uByte		DeviceRemovable[32]; /* max 255 ports */
+#define UHD_NOT_REMOV(desc, i) \
+    (((desc)->DeviceRemovable[(i)/8] >> ((i) % 8)) & 1)
+	/* deprecated */ uByte		PortPowerCtrlMask[1];
+} UPACKED usb_hub_descriptor_t;
+#define USB_HUB_DESCRIPTOR_SIZE 9 /* includes deprecated PortPowerCtrlMask */
+
+typedef struct {
+	uByte		bLength;
+	uByte		bDescriptorType;
+	uWord		bcdUSB;
+	uByte		bDeviceClass;
+	uByte		bDeviceSubClass;
+	uByte		bDeviceProtocol;
+	uByte		bMaxPacketSize0;
+	uByte		bNumConfigurations;
+	uByte		bReserved;
+} UPACKED usb_device_qualifier_t;
+#define USB_DEVICE_QUALIFIER_SIZE 10
+
+typedef struct {
+	uByte		bLength;
+	uByte		bDescriptorType;
+	uByte		bmAttributes;
+#define UOTG_SRP	0x01
+#define UOTG_HNP	0x02
+} UPACKED usb_otg_descriptor_t;
+
+/* OTG feature selectors */
+#define UOTG_B_HNP_ENABLE	3
+#define UOTG_A_HNP_SUPPORT	4
+#define UOTG_A_ALT_HNP_SUPPORT	5
+
+typedef struct {
+	uWord		wStatus;
+/* Device status flags */
+#define UDS_SELF_POWERED		0x0001
+#define UDS_REMOTE_WAKEUP		0x0002
+/* Endpoint status flags */
+#define UES_HALT			0x0001
+} UPACKED usb_status_t;
+
+typedef struct {
+	uWord		wHubStatus;
+#define UHS_LOCAL_POWER			0x0001
+#define UHS_OVER_CURRENT		0x0002
+	uWord		wHubChange;
+} UPACKED usb_hub_status_t;
+
+typedef struct {
+	uWord		wPortStatus;
+#define UPS_CURRENT_CONNECT_STATUS	0x0001
+#define UPS_PORT_ENABLED		0x0002
+#define UPS_SUSPEND			0x0004
+#define UPS_OVERCURRENT_INDICATOR	0x0008
+#define UPS_RESET			0x0010
+#define UPS_PORT_POWER			0x0100
+#define UPS_LOW_SPEED			0x0200
+#define UPS_HIGH_SPEED			0x0400
+#define UPS_PORT_TEST			0x0800
+#define UPS_PORT_INDICATOR		0x1000
+	uWord		wPortChange;
+#define UPS_C_CONNECT_STATUS		0x0001
+#define UPS_C_PORT_ENABLED		0x0002
+#define UPS_C_SUSPEND			0x0004
+#define UPS_C_OVERCURRENT_INDICATOR	0x0008
+#define UPS_C_PORT_RESET		0x0010
+} UPACKED usb_port_status_t;
+
+#ifdef _MSC_VER
+#include <poppack.h>
+#endif
+
+/* Device class codes */
+#define UDCLASS_IN_INTERFACE	0x00
+#define UDCLASS_COMM		0x02
+#define UDCLASS_HUB		0x09
+#define  UDSUBCLASS_HUB		0x00
+#define  UDPROTO_FSHUB		0x00
+#define  UDPROTO_HSHUBSTT	0x01
+#define  UDPROTO_HSHUBMTT	0x02
+#define UDCLASS_DIAGNOSTIC	0xdc
+#define UDCLASS_WIRELESS	0xe0
+#define  UDSUBCLASS_RF		0x01
+#define   UDPROTO_BLUETOOTH	0x01
+#define UDCLASS_VENDOR		0xff
+
+/* Interface class codes */
+#define UICLASS_UNSPEC		0x00
+
+#define UICLASS_AUDIO		0x01
+#define  UISUBCLASS_AUDIOCONTROL	1
+#define  UISUBCLASS_AUDIOSTREAM		2
+#define  UISUBCLASS_MIDISTREAM		3
+
+#define UICLASS_CDC		0x02 /* communication */
+#define  UISUBCLASS_DIRECT_LINE_CONTROL_MODEL	1
+#define  UISUBCLASS_ABSTRACT_CONTROL_MODEL	2
+#define  UISUBCLASS_TELEPHONE_CONTROL_MODEL	3
+#define  UISUBCLASS_MULTICHANNEL_CONTROL_MODEL	4
+#define  UISUBCLASS_CAPI_CONTROLMODEL		5
+#define  UISUBCLASS_ETHERNET_NETWORKING_CONTROL_MODEL 6
+#define  UISUBCLASS_ATM_NETWORKING_CONTROL_MODEL 7
+#define   UIPROTO_CDC_AT			1
+
+#define UICLASS_HID		0x03
+#define  UISUBCLASS_BOOT	1
+#define  UIPROTO_BOOT_KEYBOARD	1
+
+#define UICLASS_PHYSICAL	0x05
+
+#define UICLASS_IMAGE		0x06
+
+#define UICLASS_PRINTER		0x07
+#define  UISUBCLASS_PRINTER	1
+#define  UIPROTO_PRINTER_UNI	1
+#define  UIPROTO_PRINTER_BI	2
+#define  UIPROTO_PRINTER_1284	3
+
+#define UICLASS_MASS		0x08
+#define  UISUBCLASS_RBC		1
+#define  UISUBCLASS_SFF8020I	2
+#define  UISUBCLASS_QIC157	3
+#define  UISUBCLASS_UFI		4
+#define  UISUBCLASS_SFF8070I	5
+#define  UISUBCLASS_SCSI	6
+#define  UIPROTO_MASS_CBI_I	0
+#define  UIPROTO_MASS_CBI	1
+#define  UIPROTO_MASS_BBB_OLD	2	/* Not in the spec anymore */
+#define  UIPROTO_MASS_BBB	80	/* 'P' for the Iomega Zip drive */
+
+#define UICLASS_HUB		0x09
+#define  UISUBCLASS_HUB		0
+#define  UIPROTO_FSHUB		0
+#define  UIPROTO_HSHUBSTT	0 /* Yes, same as previous */
+#define  UIPROTO_HSHUBMTT	1
+
+#define UICLASS_CDC_DATA	0x0a
+#define  UISUBCLASS_DATA		0
+#define   UIPROTO_DATA_ISDNBRI		0x30    /* Physical iface */
+#define   UIPROTO_DATA_HDLC		0x31    /* HDLC */
+#define   UIPROTO_DATA_TRANSPARENT	0x32    /* Transparent */
+#define   UIPROTO_DATA_Q921M		0x50    /* Management for Q921 */
+#define   UIPROTO_DATA_Q921		0x51    /* Data for Q921 */
+#define   UIPROTO_DATA_Q921TM		0x52    /* TEI multiplexer for Q921 */
+#define   UIPROTO_DATA_V42BIS		0x90    /* Data compression */
+#define   UIPROTO_DATA_Q931		0x91    /* Euro-ISDN */
+#define   UIPROTO_DATA_V120		0x92    /* V.24 rate adaption */
+#define   UIPROTO_DATA_CAPI		0x93    /* CAPI 2.0 commands */
+#define   UIPROTO_DATA_HOST_BASED	0xfd    /* Host based driver */
+#define   UIPROTO_DATA_PUF		0xfe    /* see Prot. Unit Func. Desc.*/
+#define   UIPROTO_DATA_VENDOR		0xff    /* Vendor specific */
+
+#define UICLASS_SMARTCARD	0x0b
+
+/*#define UICLASS_FIRM_UPD	0x0c*/
+
+#define UICLASS_SECURITY	0x0d
+
+#define UICLASS_DIAGNOSTIC	0xdc
+
+#define UICLASS_WIRELESS	0xe0
+#define  UISUBCLASS_RF			0x01
+#define   UIPROTO_BLUETOOTH		0x01
+
+#define UICLASS_APPL_SPEC	0xfe
+#define  UISUBCLASS_FIRMWARE_DOWNLOAD	1
+#define  UISUBCLASS_IRDA		2
+#define  UIPROTO_IRDA			0
+
+#define UICLASS_VENDOR		0xff
+
+#define USB_HUB_MAX_DEPTH 5
+
+/*
+ * Minimum time a device needs to be powered down to go through
+ * a power cycle.  XXX Are these time in the spec?
+ */
+#define USB_POWER_DOWN_TIME	200 /* ms */
+#define USB_PORT_POWER_DOWN_TIME	100 /* ms */
+
+#if 0
+/* These are the values from the spec. */
+#define USB_PORT_RESET_DELAY	10  /* ms */
+#define USB_PORT_ROOT_RESET_DELAY 50  /* ms */
+#define USB_PORT_RESET_RECOVERY	10  /* ms */
+#define USB_PORT_POWERUP_DELAY	100 /* ms */
+#define USB_SET_ADDRESS_SETTLE	2   /* ms */
+#define USB_RESUME_DELAY	(20*5)  /* ms */
+#define USB_RESUME_WAIT		10  /* ms */
+#define USB_RESUME_RECOVERY	10  /* ms */
+#define USB_EXTRA_POWER_UP_TIME	0   /* ms */
+#else
+/* Allow for marginal (i.e. non-conforming) devices. */
+#define USB_PORT_RESET_DELAY	50  /* ms */
+#define USB_PORT_ROOT_RESET_DELAY 250  /* ms */
+#define USB_PORT_RESET_RECOVERY	250  /* ms */
+#define USB_PORT_POWERUP_DELAY	300 /* ms */
+#define USB_SET_ADDRESS_SETTLE	10  /* ms */
+#define USB_RESUME_DELAY	(50*5)  /* ms */
+#define USB_RESUME_WAIT		50  /* ms */
+#define USB_RESUME_RECOVERY	50  /* ms */
+#define USB_EXTRA_POWER_UP_TIME	20  /* ms */
+#endif
+
+#define USB_MIN_POWER		100 /* mA */
+#define USB_MAX_POWER		500 /* mA */
+
+#define USB_BUS_RESET_DELAY	100 /* ms XXX?*/
+
+#define USB_UNCONFIG_NO 0
+#define USB_UNCONFIG_INDEX (-1)
+
+/*** ioctl() related stuff ***/
+
+struct usb_ctl_request {
+	int	ucr_addr;
+	usb_device_request_t ucr_request;
+	void	*ucr_data;
+	int	ucr_flags;
+#define USBD_SHORT_XFER_OK	0x04	/* allow short reads */
+	int	ucr_actlen;		/* actual length transferred */
+};
+
+struct usb_alt_interface {
+	int	uai_config_index;
+	int	uai_interface_index;
+	int	uai_alt_no;
+};
+
+#define USB_CURRENT_CONFIG_INDEX (-1)
+#define USB_CURRENT_ALT_INDEX (-1)
+
+struct usb_config_desc {
+	int	ucd_config_index;
+	usb_config_descriptor_t ucd_desc;
+};
+
+struct usb_interface_desc {
+	int	uid_config_index;
+	int	uid_interface_index;
+	int	uid_alt_index;
+	usb_interface_descriptor_t uid_desc;
+};
+
+struct usb_endpoint_desc {
+	int	ued_config_index;
+	int	ued_interface_index;
+	int	ued_alt_index;
+	int	ued_endpoint_index;
+	usb_endpoint_descriptor_t ued_desc;
+};
+
+struct usb_full_desc {
+	int	ufd_config_index;
+	u_int	ufd_size;
+	u_char	*ufd_data;
+};
+
+struct usb_string_desc {
+	int	usd_string_index;
+	int	usd_language_id;
+	usb_string_descriptor_t usd_desc;
+};
+
+struct usb_ctl_report_desc {
+	int	ucrd_size;
+	u_char	ucrd_data[1024];	/* filled data size will vary */
+};
+
+typedef struct { u_int32_t cookie; } usb_event_cookie_t;
+
+#define USB_MAX_DEVNAMES 4
+#define USB_MAX_DEVNAMELEN 16
+struct usb_device_info {
+	u_int8_t	udi_bus;
+	u_int8_t	udi_addr;	/* device address */
+	usb_event_cookie_t udi_cookie;
+	char		udi_product[USB_MAX_STRING_LEN];
+	char		udi_vendor[USB_MAX_STRING_LEN];
+	char		udi_release[8];
+	u_int16_t	udi_productNo;
+	u_int16_t	udi_vendorNo;
+	u_int16_t	udi_releaseNo;
+	u_int8_t	udi_class;
+	u_int8_t	udi_subclass;
+	u_int8_t	udi_protocol;
+	u_int8_t	udi_config;
+	u_int8_t	udi_speed;
+#define USB_SPEED_UNKNOWN	0
+#define USB_SPEED_LOW		1
+#define USB_SPEED_FULL		2
+#define USB_SPEED_HIGH		3
+#define USB_SPEED_VARIABLE	4
+#define USB_SPEED_SUPER		5
+	int		udi_power;	/* power consumption in mA, 0 if selfpowered */
+	int		udi_nports;
+	char		udi_devnames[USB_MAX_DEVNAMES][USB_MAX_DEVNAMELEN];
+	u_int8_t	udi_ports[16];/* hub only: addresses of devices on ports */
+#define USB_PORT_ENABLED 0xff
+#define USB_PORT_SUSPENDED 0xfe
+#define USB_PORT_POWERED 0xfd
+#define USB_PORT_DISABLED 0xfc
+};
+
+struct usb_ctl_report {
+	int	ucr_report;
+	u_char	ucr_data[1024];	/* filled data size will vary */
+};
+
+struct usb_device_stats {
+	u_long	uds_requests[4];	/* indexed by transfer type UE_* */
+};
+
+#define WUSB_MIN_IE			0x80
+#define WUSB_WCTA_IE			0x80
+#define WUSB_WCONNECTACK_IE		0x81
+#define WUSB_WHOSTINFO_IE		0x82
+#define  WUHI_GET_CA(_bmAttributes_) ((_bmAttributes_) & 0x3)
+#define   WUHI_CA_RECONN		0x00
+#define   WUHI_CA_LIMITED		0x01
+#define   WUHI_CA_ALL			0x03
+#define  WUHI_GET_MLSI(_bmAttributes_) (((_bmAttributes_) & 0x38) >> 3)
+#define WUSB_WCHCHANGEANNOUNCE_IE	0x83
+#define WUSB_WDEV_DISCONNECT_IE		0x84
+#define WUSB_WHOST_DISCONNECT_IE	0x85
+#define WUSB_WRELEASE_CHANNEL_IE	0x86
+#define WUSB_WWORK_IE			0x87
+#define WUSB_WCHANNEL_STOP_IE		0x88
+#define WUSB_WDEV_KEEPALIVE_IE		0x89
+#define WUSB_WISOCH_DISCARD_IE		0x8A
+#define WUSB_WRESETDEVICE_IE		0x8B
+#define WUSB_WXMIT_PACKET_ADJUST_IE	0x8C
+#define WUSB_MAX_IE			0x8C
+
+/* Device Notification Types */
+
+#define WUSB_DN_MIN			0x01
+#define WUSB_DN_CONNECT			0x01
+# define WUSB_DA_OLDCONN	0x00
+# define WUSB_DA_NEWCONN	0x01
+# define WUSB_DA_SELF_BEACON	0x02
+# define WUSB_DA_DIR_BEACON	0x04
+# define WUSB_DA_NO_BEACON	0x06
+#define WUSB_DN_DISCONNECT		0x02
+#define WUSB_DN_EPRDY			0x03
+#define WUSB_DN_MASAVAILCHANGED		0x04
+#define WUSB_DN_REMOTEWAKEUP		0x05
+#define WUSB_DN_SLEEP			0x06
+#define WUSB_DN_ALIVE			0x07
+#define WUSB_DN_MAX			0x07
+
+#ifdef _MSC_VER
+#include <pshpack1.h>
+#endif
+
+/* WUSB Handshake Data.  Used during the SET/GET HANDSHAKE requests */
+typedef struct wusb_hndshk_data {
+	uByte bMessageNumber;
+	uByte bStatus;
+	uByte tTKID[3];
+	uByte bReserved;
+	uByte CDID[16];
+	uByte Nonce[16];
+	uByte MIC[8];
+} UPACKED wusb_hndshk_data_t;
+#define WUSB_HANDSHAKE_LEN_FOR_MIC	38
+
+/* WUSB Connection Context */
+typedef struct wusb_conn_context {
+	uByte CHID [16];
+	uByte CDID [16];
+	uByte CK [16];
+} UPACKED wusb_conn_context_t;
+
+/* WUSB Security Descriptor */
+typedef struct wusb_security_desc {
+	uByte bLength;
+	uByte bDescriptorType;
+	uWord wTotalLength;
+	uByte bNumEncryptionTypes;
+} UPACKED wusb_security_desc_t;
+
+/* WUSB Encryption Type Descriptor */
+typedef struct wusb_encrypt_type_desc {
+	uByte bLength;
+	uByte bDescriptorType;
+
+	uByte bEncryptionType;
+#define WUETD_UNSECURE		0
+#define WUETD_WIRED		1
+#define WUETD_CCM_1		2
+#define WUETD_RSA_1		3
+
+	uByte bEncryptionValue;
+	uByte bAuthKeyIndex;
+} UPACKED wusb_encrypt_type_desc_t;
+
+/* WUSB Key Descriptor */
+typedef struct wusb_key_desc {
+	uByte bLength;
+	uByte bDescriptorType;
+	uByte tTKID[3];
+	uByte bReserved;
+	uByte KeyData[1];	/* variable length */
+} UPACKED wusb_key_desc_t;
+
+/* WUSB BOS Descriptor (Binary device Object Store) */
+typedef struct wusb_bos_desc {
+	uByte bLength;
+	uByte bDescriptorType;
+	uWord wTotalLength;
+	uByte bNumDeviceCaps;
+} UPACKED wusb_bos_desc_t;
+
+#define USB_DEVICE_CAPABILITY_20_EXTENSION	0x02
+typedef struct usb_dev_cap_20_ext_desc {
+	uByte bLength;
+	uByte bDescriptorType;
+	uByte bDevCapabilityType;
+#define USB_20_EXT_LPM				0x02
+	uDWord bmAttributes;
+} UPACKED usb_dev_cap_20_ext_desc_t;
+
+#define USB_DEVICE_CAPABILITY_SS_USB		0x03
+typedef struct usb_dev_cap_ss_usb {
+	uByte bLength;
+	uByte bDescriptorType;
+	uByte bDevCapabilityType;
+#define USB_DC_SS_USB_LTM_CAPABLE		0x02
+	uByte bmAttributes;
+#define USB_DC_SS_USB_SPEED_SUPPORT_LOW		0x01
+#define USB_DC_SS_USB_SPEED_SUPPORT_FULL	0x02
+#define USB_DC_SS_USB_SPEED_SUPPORT_HIGH	0x04
+#define USB_DC_SS_USB_SPEED_SUPPORT_SS		0x08
+	uWord wSpeedsSupported;
+	uByte bFunctionalitySupport;
+	uByte bU1DevExitLat;
+	uWord wU2DevExitLat;
+} UPACKED usb_dev_cap_ss_usb_t;
+
+#define USB_DEVICE_CAPABILITY_CONTAINER_ID	0x04
+typedef struct usb_dev_cap_container_id {
+	uByte bLength;
+	uByte bDescriptorType;
+	uByte bDevCapabilityType;
+	uByte bReserved;
+	uByte containerID[16];
+} UPACKED usb_dev_cap_container_id_t;
+
+/* Device Capability Type Codes */
+#define WUSB_DEVICE_CAPABILITY_WIRELESS_USB 0x01
+
+/* Device Capability Descriptor */
+typedef struct wusb_dev_cap_desc {
+	uByte bLength;
+	uByte bDescriptorType;
+	uByte bDevCapabilityType;
+	uByte caps[1];	/* Variable length */
+} UPACKED wusb_dev_cap_desc_t;
+
+/* Device Capability Descriptor */
+typedef struct wusb_dev_cap_uwb_desc {
+	uByte bLength;
+	uByte bDescriptorType;
+	uByte bDevCapabilityType;
+	uByte bmAttributes;
+	uWord wPHYRates;	/* Bitmap */
+	uByte bmTFITXPowerInfo;
+	uByte bmFFITXPowerInfo;
+	uWord bmBandGroup;
+	uByte bReserved;
+} UPACKED wusb_dev_cap_uwb_desc_t;
+
+/* Wireless USB Endpoint Companion Descriptor */
+typedef struct wusb_endpoint_companion_desc {
+	uByte bLength;
+	uByte bDescriptorType;
+	uByte bMaxBurst;
+	uByte bMaxSequence;
+	uWord wMaxStreamDelay;
+	uWord wOverTheAirPacketSize;
+	uByte bOverTheAirInterval;
+	uByte bmCompAttributes;
+} UPACKED wusb_endpoint_companion_desc_t;
+
+/* Wireless USB Numeric Association M1 Data Structure */
+typedef struct wusb_m1_data {
+	uByte version;
+	uWord langId;
+	uByte deviceFriendlyNameLength;
+	uByte sha_256_m3[32];
+	uByte deviceFriendlyName[256];
+} UPACKED wusb_m1_data_t;
+
+typedef struct wusb_m2_data {
+	uByte version;
+	uWord langId;
+	uByte hostFriendlyNameLength;
+	uByte pkh[384];
+	uByte hostFriendlyName[256];
+} UPACKED wusb_m2_data_t;
+
+typedef struct wusb_m3_data {
+	uByte pkd[384];
+	uByte nd;
+} UPACKED wusb_m3_data_t;
+
+typedef struct wusb_m4_data {
+	uDWord _attributeTypeIdAndLength_1;
+	uWord  associationTypeId;
+
+	uDWord _attributeTypeIdAndLength_2;
+	uWord  associationSubTypeId;
+
+	uDWord _attributeTypeIdAndLength_3;
+	uDWord length;
+
+	uDWord _attributeTypeIdAndLength_4;
+	uDWord associationStatus;
+
+	uDWord _attributeTypeIdAndLength_5;
+	uByte  chid[16];
+
+	uDWord _attributeTypeIdAndLength_6;
+	uByte  cdid[16];
+
+	uDWord _attributeTypeIdAndLength_7;
+	uByte  bandGroups[2];
+} UPACKED wusb_m4_data_t;
+
+#ifdef _MSC_VER
+#include <poppack.h>
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _USB_H_ */
diff --git a/drivers/usb/host/dwc_otg/Makefile b/drivers/usb/host/dwc_otg/Makefile
new file mode 100644
index 000000000000..4872b8113b68
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/Makefile
@@ -0,0 +1,85 @@
+#
+# Makefile for DWC_otg Highspeed USB controller driver
+#
+
+ifneq ($(KERNELRELEASE),)
+
+# Use the BUS_INTERFACE variable to compile the software for either
+# PCI(PCI_INTERFACE) or LM(LM_INTERFACE) bus.
+ifeq ($(BUS_INTERFACE),)
+#	BUS_INTERFACE = -DPCI_INTERFACE
+#	BUS_INTERFACE = -DLM_INTERFACE
+        BUS_INTERFACE = -DPLATFORM_INTERFACE
+endif
+
+#ccflags-y	+= -DDEBUG
+#ccflags-y	+= -DDWC_OTG_DEBUGLEV=1 # reduce common debug msgs
+
+# Use one of the following flags to compile the software in host-only or
+# device-only mode.
+#ccflags-y        += -DDWC_HOST_ONLY
+#ccflags-y        += -DDWC_DEVICE_ONLY
+
+ccflags-y	+= -Dlinux -DDWC_HS_ELECT_TST
+#ccflags-y	+= -DDWC_EN_ISOC
+ccflags-y   	+= -I$(obj)/../dwc_common_port
+#ccflags-y   	+= -I$(PORTLIB)
+ccflags-y   	+= -DDWC_LINUX
+ccflags-y   	+= $(CFI)
+ccflags-y	+= $(BUS_INTERFACE)
+#ccflags-y	+= -DDWC_DEV_SRPCAP
+
+obj-$(CONFIG_USB_DWCOTG) += dwc_otg.o
+
+dwc_otg-objs	:= dwc_otg_driver.o dwc_otg_attr.o
+dwc_otg-objs	+= dwc_otg_cil.o dwc_otg_cil_intr.o
+dwc_otg-objs	+= dwc_otg_pcd_linux.o dwc_otg_pcd.o dwc_otg_pcd_intr.o
+dwc_otg-objs	+= dwc_otg_hcd.o dwc_otg_hcd_linux.o dwc_otg_hcd_intr.o dwc_otg_hcd_queue.o dwc_otg_hcd_ddma.o
+dwc_otg-objs	+= dwc_otg_adp.o
+dwc_otg-objs	+= dwc_otg_fiq_fsm.o
+ifneq ($(CONFIG_ARM64),y)
+dwc_otg-objs	+= dwc_otg_fiq_stub.o
+endif
+
+ifneq ($(CFI),)
+dwc_otg-objs	+= dwc_otg_cfi.o
+endif
+
+kernrelwd := $(subst ., ,$(KERNELRELEASE))
+kernrel3 := $(word 1,$(kernrelwd)).$(word 2,$(kernrelwd)).$(word 3,$(kernrelwd))
+
+ifneq ($(kernrel3),2.6.20)
+ccflags-y += $(CPPFLAGS)
+endif
+
+else
+
+PWD		:= $(shell pwd)
+PORTLIB		:= $(PWD)/../dwc_common_port
+
+# Command paths
+CTAGS		:= $(CTAGS)
+DOXYGEN		:= $(DOXYGEN)
+
+default: portlib
+	$(MAKE) -C$(KDIR) M=$(PWD) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules
+
+install: default
+	$(MAKE) -C$(KDIR) M=$(PORTLIB) modules_install
+	$(MAKE) -C$(KDIR) M=$(PWD) modules_install
+
+portlib:
+	$(MAKE) -C$(KDIR) M=$(PORTLIB) ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) modules
+	cp $(PORTLIB)/Module.symvers $(PWD)/
+
+docs:	$(wildcard *.[hc]) doc/doxygen.cfg
+	$(DOXYGEN) doc/doxygen.cfg
+
+tags:	$(wildcard *.[hc])
+	$(CTAGS) -e $(wildcard *.[hc]) $(wildcard linux/*.[hc]) $(wildcard $(KDIR)/include/linux/usb*.h)
+
+
+clean:
+	rm -rf   *.o *.ko .*cmd *.mod.c .tmp_versions Module.symvers
+
+endif
diff --git a/drivers/usb/host/dwc_otg/doc/doxygen.cfg b/drivers/usb/host/dwc_otg/doc/doxygen.cfg
new file mode 100644
index 000000000000..712b057ef7c2
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/doc/doxygen.cfg
@@ -0,0 +1,224 @@
+# Doxyfile 1.3.9.1
+
+#---------------------------------------------------------------------------
+# Project related configuration options
+#---------------------------------------------------------------------------
+PROJECT_NAME           = "DesignWare USB 2.0 OTG Controller (DWC_otg) Device Driver"
+PROJECT_NUMBER         = v3.00a
+OUTPUT_DIRECTORY       = ./doc/
+CREATE_SUBDIRS         = NO
+OUTPUT_LANGUAGE        = English
+BRIEF_MEMBER_DESC      = YES
+REPEAT_BRIEF           = YES
+ABBREVIATE_BRIEF       = "The $name class" \
+                         "The $name widget" \
+                         "The $name file" \
+                         is \
+                         provides \
+                         specifies \
+                         contains \
+                         represents \
+                         a \
+                         an \
+                         the
+ALWAYS_DETAILED_SEC    = NO
+INLINE_INHERITED_MEMB  = NO
+FULL_PATH_NAMES        = NO
+STRIP_FROM_PATH        =
+STRIP_FROM_INC_PATH    =
+SHORT_NAMES            = NO
+JAVADOC_AUTOBRIEF      = YES
+MULTILINE_CPP_IS_BRIEF = NO
+INHERIT_DOCS           = YES
+DISTRIBUTE_GROUP_DOC   = NO
+TAB_SIZE               = 8
+ALIASES                =
+OPTIMIZE_OUTPUT_FOR_C  = YES
+OPTIMIZE_OUTPUT_JAVA   = NO
+SUBGROUPING            = YES
+#---------------------------------------------------------------------------
+# Build related configuration options
+#---------------------------------------------------------------------------
+EXTRACT_ALL            = NO
+EXTRACT_PRIVATE        = YES
+EXTRACT_STATIC         = YES
+EXTRACT_LOCAL_CLASSES  = YES
+EXTRACT_LOCAL_METHODS  = NO
+HIDE_UNDOC_MEMBERS     = NO
+HIDE_UNDOC_CLASSES     = NO
+HIDE_FRIEND_COMPOUNDS  = NO
+HIDE_IN_BODY_DOCS      = NO
+INTERNAL_DOCS          = NO
+CASE_SENSE_NAMES       = NO
+HIDE_SCOPE_NAMES       = NO
+SHOW_INCLUDE_FILES     = YES
+INLINE_INFO            = YES
+SORT_MEMBER_DOCS       = NO
+SORT_BRIEF_DOCS        = NO
+SORT_BY_SCOPE_NAME     = NO
+GENERATE_TODOLIST      = YES
+GENERATE_TESTLIST      = YES
+GENERATE_BUGLIST       = YES
+GENERATE_DEPRECATEDLIST= YES
+ENABLED_SECTIONS       =
+MAX_INITIALIZER_LINES  = 30
+SHOW_USED_FILES        = YES
+SHOW_DIRECTORIES       = YES
+#---------------------------------------------------------------------------
+# configuration options related to warning and progress messages
+#---------------------------------------------------------------------------
+QUIET                  = YES
+WARNINGS               = YES
+WARN_IF_UNDOCUMENTED   = NO
+WARN_IF_DOC_ERROR      = YES
+WARN_FORMAT            = "$file:$line: $text"
+WARN_LOGFILE           =
+#---------------------------------------------------------------------------
+# configuration options related to the input files
+#---------------------------------------------------------------------------
+INPUT                  = .
+FILE_PATTERNS          = *.c \
+                         *.h \
+                         ./linux/*.c \
+                         ./linux/*.h
+RECURSIVE              = NO
+EXCLUDE                = ./test/ \
+                         ./dwc_otg/.AppleDouble/
+EXCLUDE_SYMLINKS       = YES
+EXCLUDE_PATTERNS       = *.mod.*
+EXAMPLE_PATH           =
+EXAMPLE_PATTERNS       = *
+EXAMPLE_RECURSIVE      = NO
+IMAGE_PATH             =
+INPUT_FILTER           =
+FILTER_PATTERNS        =
+FILTER_SOURCE_FILES    = NO
+#---------------------------------------------------------------------------
+# configuration options related to source browsing
+#---------------------------------------------------------------------------
+SOURCE_BROWSER         = YES
+INLINE_SOURCES         = NO
+STRIP_CODE_COMMENTS    = YES
+REFERENCED_BY_RELATION = NO
+REFERENCES_RELATION    = NO
+VERBATIM_HEADERS       = NO
+#---------------------------------------------------------------------------
+# configuration options related to the alphabetical class index
+#---------------------------------------------------------------------------
+ALPHABETICAL_INDEX     = NO
+COLS_IN_ALPHA_INDEX    = 5
+IGNORE_PREFIX          =
+#---------------------------------------------------------------------------
+# configuration options related to the HTML output
+#---------------------------------------------------------------------------
+GENERATE_HTML          = YES
+HTML_OUTPUT            = html
+HTML_FILE_EXTENSION    = .html
+HTML_HEADER            =
+HTML_FOOTER            =
+HTML_STYLESHEET        =
+HTML_ALIGN_MEMBERS     = YES
+GENERATE_HTMLHELP      = NO
+CHM_FILE               =
+HHC_LOCATION           =
+GENERATE_CHI           = NO
+BINARY_TOC             = NO
+TOC_EXPAND             = NO
+DISABLE_INDEX          = NO
+ENUM_VALUES_PER_LINE   = 4
+GENERATE_TREEVIEW      = YES
+TREEVIEW_WIDTH         = 250
+#---------------------------------------------------------------------------
+# configuration options related to the LaTeX output
+#---------------------------------------------------------------------------
+GENERATE_LATEX         = NO
+LATEX_OUTPUT           = latex
+LATEX_CMD_NAME         = latex
+MAKEINDEX_CMD_NAME     = makeindex
+COMPACT_LATEX          = NO
+PAPER_TYPE             = a4wide
+EXTRA_PACKAGES         =
+LATEX_HEADER           =
+PDF_HYPERLINKS         = NO
+USE_PDFLATEX           = NO
+LATEX_BATCHMODE        = NO
+LATEX_HIDE_INDICES     = NO
+#---------------------------------------------------------------------------
+# configuration options related to the RTF output
+#---------------------------------------------------------------------------
+GENERATE_RTF           = NO
+RTF_OUTPUT             = rtf
+COMPACT_RTF            = NO
+RTF_HYPERLINKS         = NO
+RTF_STYLESHEET_FILE    =
+RTF_EXTENSIONS_FILE    =
+#---------------------------------------------------------------------------
+# configuration options related to the man page output
+#---------------------------------------------------------------------------
+GENERATE_MAN           = NO
+MAN_OUTPUT             = man
+MAN_EXTENSION          = .3
+MAN_LINKS              = NO
+#---------------------------------------------------------------------------
+# configuration options related to the XML output
+#---------------------------------------------------------------------------
+GENERATE_XML           = NO
+XML_OUTPUT             = xml
+XML_SCHEMA             =
+XML_DTD                =
+XML_PROGRAMLISTING     = YES
+#---------------------------------------------------------------------------
+# configuration options for the AutoGen Definitions output
+#---------------------------------------------------------------------------
+GENERATE_AUTOGEN_DEF   = NO
+#---------------------------------------------------------------------------
+# configuration options related to the Perl module output
+#---------------------------------------------------------------------------
+GENERATE_PERLMOD       = NO
+PERLMOD_LATEX          = NO
+PERLMOD_PRETTY         = YES
+PERLMOD_MAKEVAR_PREFIX =
+#---------------------------------------------------------------------------
+# Configuration options related to the preprocessor
+#---------------------------------------------------------------------------
+ENABLE_PREPROCESSING   = YES
+MACRO_EXPANSION        = YES
+EXPAND_ONLY_PREDEF     = YES
+SEARCH_INCLUDES        = YES
+INCLUDE_PATH           =
+INCLUDE_FILE_PATTERNS  =
+PREDEFINED             = DEVICE_ATTR DWC_EN_ISOC
+EXPAND_AS_DEFINED      = DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW DWC_OTG_DEVICE_ATTR_BITFIELD_STORE DWC_OTG_DEVICE_ATTR_BITFIELD_RW DWC_OTG_DEVICE_ATTR_BITFIELD_RO DWC_OTG_DEVICE_ATTR_REG_SHOW DWC_OTG_DEVICE_ATTR_REG_STORE DWC_OTG_DEVICE_ATTR_REG32_RW DWC_OTG_DEVICE_ATTR_REG32_RO DWC_EN_ISOC
+SKIP_FUNCTION_MACROS   = NO
+#---------------------------------------------------------------------------
+# Configuration::additions related to external references
+#---------------------------------------------------------------------------
+TAGFILES               =
+GENERATE_TAGFILE       =
+ALLEXTERNALS           = NO
+EXTERNAL_GROUPS        = YES
+PERL_PATH              = /usr/bin/perl
+#---------------------------------------------------------------------------
+# Configuration options related to the dot tool
+#---------------------------------------------------------------------------
+CLASS_DIAGRAMS         = YES
+HIDE_UNDOC_RELATIONS   = YES
+HAVE_DOT               = NO
+CLASS_GRAPH            = YES
+COLLABORATION_GRAPH    = YES
+UML_LOOK               = NO
+TEMPLATE_RELATIONS     = NO
+INCLUDE_GRAPH          = YES
+INCLUDED_BY_GRAPH      = YES
+CALL_GRAPH             = NO
+GRAPHICAL_HIERARCHY    = YES
+DOT_IMAGE_FORMAT       = png
+DOT_PATH               =
+DOTFILE_DIRS           =
+MAX_DOT_GRAPH_DEPTH    = 1000
+GENERATE_LEGEND        = YES
+DOT_CLEANUP            = YES
+#---------------------------------------------------------------------------
+# Configuration::additions related to the search engine
+#---------------------------------------------------------------------------
+SEARCHENGINE           = NO
diff --git a/drivers/usb/host/dwc_otg/dummy_audio.c b/drivers/usb/host/dwc_otg/dummy_audio.c
new file mode 100644
index 000000000000..f827102fa644
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dummy_audio.c
@@ -0,0 +1,1574 @@
+/*
+ * zero.c -- Gadget Zero, for USB development
+ *
+ * Copyright (C) 2003-2004 David Brownell
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+/*
+ * Gadget Zero only needs two bulk endpoints, and is an example of how you
+ * can write a hardware-agnostic gadget driver running inside a USB device.
+ *
+ * Hardware details are visible (see CONFIG_USB_ZERO_* below) but don't
+ * affect most of the driver.
+ *
+ * Use it with the Linux host/master side "usbtest" driver to get a basic
+ * functional test of your device-side usb stack, or with "usb-skeleton".
+ *
+ * It supports two similar configurations.  One sinks whatever the usb host
+ * writes, and in return sources zeroes.  The other loops whatever the host
+ * writes back, so the host can read it.  Module options include:
+ *
+ *   buflen=N		default N=4096, buffer size used
+ *   qlen=N		default N=32, how many buffers in the loopback queue
+ *   loopdefault	default false, list loopback config first
+ *
+ * Many drivers will only have one configuration, letting them be much
+ * simpler if they also don't support high speed operation (like this
+ * driver does).
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/delay.h>
+#include <linux/ioport.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/smp_lock.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/timer.h>
+#include <linux/list.h>
+#include <linux/interrupt.h>
+#include <linux/uts.h>
+#include <linux/version.h>
+#include <linux/device.h>
+#include <linux/moduleparam.h>
+#include <linux/proc_fs.h>
+
+#include <asm/byteorder.h>
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/system.h>
+#include <asm/unaligned.h>
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
+# include <linux/usb/ch9.h>
+#else
+# include <linux/usb_ch9.h>
+#endif
+
+#include <linux/usb_gadget.h>
+
+
+/*-------------------------------------------------------------------------*/
+/*-------------------------------------------------------------------------*/
+
+
+static int utf8_to_utf16le(const char *s, u16 *cp, unsigned len)
+{
+	int	count = 0;
+	u8	c;
+	u16	uchar;
+
+	/* this insists on correct encodings, though not minimal ones.
+	 * BUT it currently rejects legit 4-byte UTF-8 code points,
+	 * which need surrogate pairs.  (Unicode 3.1 can use them.)
+	 */
+	while (len != 0 && (c = (u8) *s++) != 0) {
+		if (unlikely(c & 0x80)) {
+			// 2-byte sequence:
+			// 00000yyyyyxxxxxx = 110yyyyy 10xxxxxx
+			if ((c & 0xe0) == 0xc0) {
+				uchar = (c & 0x1f) << 6;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c;
+
+			// 3-byte sequence (most CJKV characters):
+			// zzzzyyyyyyxxxxxx = 1110zzzz 10yyyyyy 10xxxxxx
+			} else if ((c & 0xf0) == 0xe0) {
+				uchar = (c & 0x0f) << 12;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c << 6;
+
+				c = (u8) *s++;
+				if ((c & 0xc0) != 0xc0)
+					goto fail;
+				c &= 0x3f;
+				uchar |= c;
+
+				/* no bogus surrogates */
+				if (0xd800 <= uchar && uchar <= 0xdfff)
+					goto fail;
+
+			// 4-byte sequence (surrogate pairs, currently rare):
+			// 11101110wwwwzzzzyy + 110111yyyyxxxxxx
+			//     = 11110uuu 10uuzzzz 10yyyyyy 10xxxxxx
+			// (uuuuu = wwww + 1)
+			// FIXME accept the surrogate code points (only)
+
+			} else
+				goto fail;
+		} else
+			uchar = c;
+		put_unaligned (cpu_to_le16 (uchar), cp++);
+		count++;
+		len--;
+	}
+	return count;
+fail:
+	return -1;
+}
+
+
+/**
+ * usb_gadget_get_string - fill out a string descriptor
+ * @table: of c strings encoded using UTF-8
+ * @id: string id, from low byte of wValue in get string descriptor
+ * @buf: at least 256 bytes
+ *
+ * Finds the UTF-8 string matching the ID, and converts it into a
+ * string descriptor in utf16-le.
+ * Returns length of descriptor (always even) or negative errno
+ *
+ * If your driver needs stings in multiple languages, you'll probably
+ * "switch (wIndex) { ... }"  in your ep0 string descriptor logic,
+ * using this routine after choosing which set of UTF-8 strings to use.
+ * Note that US-ASCII is a strict subset of UTF-8; any string bytes with
+ * the eighth bit set will be multibyte UTF-8 characters, not ISO-8859/1
+ * characters (which are also widely used in C strings).
+ */
+int
+usb_gadget_get_string (struct usb_gadget_strings *table, int id, u8 *buf)
+{
+	struct usb_string	*s;
+	int			len;
+
+	/* descriptor 0 has the language id */
+	if (id == 0) {
+		buf [0] = 4;
+		buf [1] = USB_DT_STRING;
+		buf [2] = (u8) table->language;
+		buf [3] = (u8) (table->language >> 8);
+		return 4;
+	}
+	for (s = table->strings; s && s->s; s++)
+		if (s->id == id)
+			break;
+
+	/* unrecognized: stall. */
+	if (!s || !s->s)
+		return -EINVAL;
+
+	/* string descriptors have length, tag, then UTF16-LE text */
+	len = min ((size_t) 126, strlen (s->s));
+	memset (buf + 2, 0, 2 * len);	/* zero all the bytes */
+	len = utf8_to_utf16le(s->s, (u16 *)&buf[2], len);
+	if (len < 0)
+		return -EINVAL;
+	buf [0] = (len + 1) * 2;
+	buf [1] = USB_DT_STRING;
+	return buf [0];
+}
+
+
+/*-------------------------------------------------------------------------*/
+/*-------------------------------------------------------------------------*/
+
+
+/**
+ * usb_descriptor_fillbuf - fill buffer with descriptors
+ * @buf: Buffer to be filled
+ * @buflen: Size of buf
+ * @src: Array of descriptor pointers, terminated by null pointer.
+ *
+ * Copies descriptors into the buffer, returning the length or a
+ * negative error code if they can't all be copied.  Useful when
+ * assembling descriptors for an associated set of interfaces used
+ * as part of configuring a composite device; or in other cases where
+ * sets of descriptors need to be marshaled.
+ */
+int
+usb_descriptor_fillbuf(void *buf, unsigned buflen,
+		const struct usb_descriptor_header **src)
+{
+	u8	*dest = buf;
+
+	if (!src)
+		return -EINVAL;
+
+	/* fill buffer from src[] until null descriptor ptr */
+	for (; 0 != *src; src++) {
+		unsigned		len = (*src)->bLength;
+
+		if (len > buflen)
+			return -EINVAL;
+		memcpy(dest, *src, len);
+		buflen -= len;
+		dest += len;
+	}
+	return dest - (u8 *)buf;
+}
+
+
+/**
+ * usb_gadget_config_buf - builts a complete configuration descriptor
+ * @config: Header for the descriptor, including characteristics such
+ *	as power requirements and number of interfaces.
+ * @desc: Null-terminated vector of pointers to the descriptors (interface,
+ *	endpoint, etc) defining all functions in this device configuration.
+ * @buf: Buffer for the resulting configuration descriptor.
+ * @length: Length of buffer.  If this is not big enough to hold the
+ *	entire configuration descriptor, an error code will be returned.
+ *
+ * This copies descriptors into the response buffer, building a descriptor
+ * for that configuration.  It returns the buffer length or a negative
+ * status code.  The config.wTotalLength field is set to match the length
+ * of the result, but other descriptor fields (including power usage and
+ * interface count) must be set by the caller.
+ *
+ * Gadget drivers could use this when constructing a config descriptor
+ * in response to USB_REQ_GET_DESCRIPTOR.  They will need to patch the
+ * resulting bDescriptorType value if USB_DT_OTHER_SPEED_CONFIG is needed.
+ */
+int usb_gadget_config_buf(
+	const struct usb_config_descriptor	*config,
+	void					*buf,
+	unsigned				length,
+	const struct usb_descriptor_header	**desc
+)
+{
+	struct usb_config_descriptor		*cp = buf;
+	int					len;
+
+	/* config descriptor first */
+	if (length < USB_DT_CONFIG_SIZE || !desc)
+		return -EINVAL;
+	*cp = *config;
+
+	/* then interface/endpoint/class/vendor/... */
+	len = usb_descriptor_fillbuf(USB_DT_CONFIG_SIZE + (u8*)buf,
+			length - USB_DT_CONFIG_SIZE, desc);
+	if (len < 0)
+		return len;
+	len += USB_DT_CONFIG_SIZE;
+	if (len > 0xffff)
+		return -EINVAL;
+
+	/* patch up the config descriptor */
+	cp->bLength = USB_DT_CONFIG_SIZE;
+	cp->bDescriptorType = USB_DT_CONFIG;
+	cp->wTotalLength = cpu_to_le16(len);
+	cp->bmAttributes |= USB_CONFIG_ATT_ONE;
+	return len;
+}
+
+/*-------------------------------------------------------------------------*/
+/*-------------------------------------------------------------------------*/
+
+
+#define RBUF_LEN (1024*1024)
+static int rbuf_start;
+static int rbuf_len;
+static __u8 rbuf[RBUF_LEN];
+
+/*-------------------------------------------------------------------------*/
+
+#define DRIVER_VERSION		"St Patrick's Day 2004"
+
+static const char shortname [] = "zero";
+static const char longname [] = "YAMAHA YST-MS35D USB Speaker  ";
+
+static const char source_sink [] = "source and sink data";
+static const char loopback [] = "loop input to output";
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * driver assumes self-powered hardware, and
+ * has no way for users to trigger remote wakeup.
+ *
+ * this version autoconfigures as much as possible,
+ * which is reasonable for most "bulk-only" drivers.
+ */
+static const char *EP_IN_NAME;		/* source */
+static const char *EP_OUT_NAME;		/* sink */
+
+/*-------------------------------------------------------------------------*/
+
+/* big enough to hold our biggest descriptor */
+#define USB_BUFSIZ	512
+
+struct zero_dev {
+	spinlock_t		lock;
+	struct usb_gadget	*gadget;
+	struct usb_request	*req;		/* for control responses */
+
+	/* when configured, we have one of two configs:
+	 * - source data (in to host) and sink it (out from host)
+	 * - or loop it back (out from host back in to host)
+	 */
+	u8			config;
+	struct usb_ep		*in_ep, *out_ep;
+
+	/* autoresume timer */
+	struct timer_list	resume;
+};
+
+#define xprintk(d,level,fmt,args...) \
+	dev_printk(level , &(d)->gadget->dev , fmt , ## args)
+
+#ifdef DEBUG
+#define DBG(dev,fmt,args...) \
+	xprintk(dev , KERN_DEBUG , fmt , ## args)
+#else
+#define DBG(dev,fmt,args...) \
+	do { } while (0)
+#endif /* DEBUG */
+
+#ifdef VERBOSE
+#define VDBG	DBG
+#else
+#define VDBG(dev,fmt,args...) \
+	do { } while (0)
+#endif /* VERBOSE */
+
+#define ERROR(dev,fmt,args...) \
+	xprintk(dev , KERN_ERR , fmt , ## args)
+#define WARN(dev,fmt,args...) \
+	xprintk(dev , KERN_WARNING , fmt , ## args)
+#define INFO(dev,fmt,args...) \
+	xprintk(dev , KERN_INFO , fmt , ## args)
+
+/*-------------------------------------------------------------------------*/
+
+static unsigned buflen = 4096;
+static unsigned qlen = 32;
+static unsigned pattern = 0;
+
+module_param (buflen, uint, S_IRUGO|S_IWUSR);
+module_param (qlen, uint, S_IRUGO|S_IWUSR);
+module_param (pattern, uint, S_IRUGO|S_IWUSR);
+
+/*
+ * if it's nonzero, autoresume says how many seconds to wait
+ * before trying to wake up the host after suspend.
+ */
+static unsigned autoresume = 0;
+module_param (autoresume, uint, 0);
+
+/*
+ * Normally the "loopback" configuration is second (index 1) so
+ * it's not the default.  Here's where to change that order, to
+ * work better with hosts where config changes are problematic.
+ * Or controllers (like superh) that only support one config.
+ */
+static int loopdefault = 0;
+
+module_param (loopdefault, bool, S_IRUGO|S_IWUSR);
+
+/*-------------------------------------------------------------------------*/
+
+/* Thanks to NetChip Technologies for donating this product ID.
+ *
+ * DO NOT REUSE THESE IDs with a protocol-incompatible driver!!  Ever!!
+ * Instead:  allocate your own, using normal USB-IF procedures.
+ */
+#ifndef	CONFIG_USB_ZERO_HNPTEST
+#define DRIVER_VENDOR_NUM	0x0525		/* NetChip */
+#define DRIVER_PRODUCT_NUM	0xa4a0		/* Linux-USB "Gadget Zero" */
+#else
+#define DRIVER_VENDOR_NUM	0x1a0a		/* OTG test device IDs */
+#define DRIVER_PRODUCT_NUM	0xbadd
+#endif
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * DESCRIPTORS ... most are static, but strings and (full)
+ * configuration descriptors are built on demand.
+ */
+
+/*
+#define STRING_MANUFACTURER		25
+#define STRING_PRODUCT			42
+#define STRING_SERIAL			101
+*/
+#define STRING_MANUFACTURER		1
+#define STRING_PRODUCT			2
+#define STRING_SERIAL			3
+
+#define STRING_SOURCE_SINK		250
+#define STRING_LOOPBACK			251
+
+/*
+ * This device advertises two configurations; these numbers work
+ * on a pxa250 as well as more flexible hardware.
+ */
+#define	CONFIG_SOURCE_SINK	3
+#define	CONFIG_LOOPBACK		2
+
+/*
+static struct usb_device_descriptor
+device_desc = {
+	.bLength =		sizeof device_desc,
+	.bDescriptorType =	USB_DT_DEVICE,
+
+	.bcdUSB =		__constant_cpu_to_le16 (0x0200),
+	.bDeviceClass =		USB_CLASS_VENDOR_SPEC,
+
+	.idVendor =		__constant_cpu_to_le16 (DRIVER_VENDOR_NUM),
+	.idProduct =		__constant_cpu_to_le16 (DRIVER_PRODUCT_NUM),
+	.iManufacturer =	STRING_MANUFACTURER,
+	.iProduct =		STRING_PRODUCT,
+	.iSerialNumber =	STRING_SERIAL,
+	.bNumConfigurations =	2,
+};
+*/
+static struct usb_device_descriptor
+device_desc = {
+	.bLength =		sizeof device_desc,
+	.bDescriptorType =	USB_DT_DEVICE,
+	.bcdUSB =		__constant_cpu_to_le16 (0x0100),
+	.bDeviceClass =		USB_CLASS_PER_INTERFACE,
+	.bDeviceSubClass =      0,
+	.bDeviceProtocol =      0,
+	.bMaxPacketSize0 =      64,
+	.bcdDevice =            __constant_cpu_to_le16 (0x0100),
+	.idVendor =		__constant_cpu_to_le16 (0x0499),
+	.idProduct =		__constant_cpu_to_le16 (0x3002),
+	.iManufacturer =	STRING_MANUFACTURER,
+	.iProduct =		STRING_PRODUCT,
+	.iSerialNumber =	STRING_SERIAL,
+	.bNumConfigurations =	1,
+};
+
+static struct usb_config_descriptor
+z_config = {
+	.bLength =		sizeof z_config,
+	.bDescriptorType =	USB_DT_CONFIG,
+
+	/* compute wTotalLength on the fly */
+	.bNumInterfaces =	2,
+	.bConfigurationValue =	1,
+	.iConfiguration =	0,
+	.bmAttributes =		0x40,
+	.bMaxPower =		0,	/* self-powered */
+};
+
+
+static struct usb_otg_descriptor
+otg_descriptor = {
+	.bLength =		sizeof otg_descriptor,
+	.bDescriptorType =	USB_DT_OTG,
+
+	.bmAttributes =		USB_OTG_SRP,
+};
+
+/* one interface in each configuration */
+#ifdef	CONFIG_USB_GADGET_DUALSPEED
+
+/*
+ * usb 2.0 devices need to expose both high speed and full speed
+ * descriptors, unless they only run at full speed.
+ *
+ * that means alternate endpoint descriptors (bigger packets)
+ * and a "device qualifier" ... plus more construction options
+ * for the config descriptor.
+ */
+
+static struct usb_qualifier_descriptor
+dev_qualifier = {
+	.bLength =		sizeof dev_qualifier,
+	.bDescriptorType =	USB_DT_DEVICE_QUALIFIER,
+
+	.bcdUSB =		__constant_cpu_to_le16 (0x0200),
+	.bDeviceClass =		USB_CLASS_VENDOR_SPEC,
+
+	.bNumConfigurations =	2,
+};
+
+
+struct usb_cs_as_general_descriptor {
+	__u8  bLength;
+	__u8  bDescriptorType;
+
+	__u8  bDescriptorSubType;
+	__u8  bTerminalLink;
+	__u8  bDelay;
+	__u16  wFormatTag;
+} __attribute__ ((packed));
+
+struct usb_cs_as_format_descriptor {
+	__u8  bLength;
+	__u8  bDescriptorType;
+
+	__u8  bDescriptorSubType;
+	__u8  bFormatType;
+	__u8  bNrChannels;
+	__u8  bSubframeSize;
+	__u8  bBitResolution;
+	__u8  bSamfreqType;
+	__u8  tLowerSamFreq[3];
+	__u8  tUpperSamFreq[3];
+} __attribute__ ((packed));
+
+static const struct usb_interface_descriptor
+z_audio_control_if_desc = {
+	.bLength =		sizeof z_audio_control_if_desc,
+	.bDescriptorType =	USB_DT_INTERFACE,
+	.bInterfaceNumber = 0,
+	.bAlternateSetting = 0,
+	.bNumEndpoints = 0,
+	.bInterfaceClass = USB_CLASS_AUDIO,
+	.bInterfaceSubClass = 0x1,
+	.bInterfaceProtocol = 0,
+	.iInterface = 0,
+};
+
+static const struct usb_interface_descriptor
+z_audio_if_desc = {
+	.bLength =		sizeof z_audio_if_desc,
+	.bDescriptorType =	USB_DT_INTERFACE,
+	.bInterfaceNumber = 1,
+	.bAlternateSetting = 0,
+	.bNumEndpoints = 0,
+	.bInterfaceClass = USB_CLASS_AUDIO,
+	.bInterfaceSubClass = 0x2,
+	.bInterfaceProtocol = 0,
+	.iInterface = 0,
+};
+
+static const struct usb_interface_descriptor
+z_audio_if_desc2 = {
+	.bLength =		sizeof z_audio_if_desc,
+	.bDescriptorType =	USB_DT_INTERFACE,
+	.bInterfaceNumber = 1,
+	.bAlternateSetting = 1,
+	.bNumEndpoints = 1,
+	.bInterfaceClass = USB_CLASS_AUDIO,
+	.bInterfaceSubClass = 0x2,
+	.bInterfaceProtocol = 0,
+	.iInterface = 0,
+};
+
+static const struct usb_cs_as_general_descriptor
+z_audio_cs_as_if_desc = {
+	.bLength = 7,
+	.bDescriptorType = 0x24,
+
+	.bDescriptorSubType = 0x01,
+	.bTerminalLink = 0x01,
+	.bDelay = 0x0,
+	.wFormatTag = __constant_cpu_to_le16 (0x0001)
+};
+
+
+static const struct usb_cs_as_format_descriptor
+z_audio_cs_as_format_desc = {
+	.bLength = 0xe,
+	.bDescriptorType = 0x24,
+
+	.bDescriptorSubType = 2,
+	.bFormatType = 1,
+	.bNrChannels = 1,
+	.bSubframeSize = 1,
+	.bBitResolution = 8,
+	.bSamfreqType = 0,
+	.tLowerSamFreq = {0x7e, 0x13, 0x00},
+	.tUpperSamFreq = {0xe2, 0xd6, 0x00},
+};
+
+static const struct usb_endpoint_descriptor
+z_iso_ep = {
+	.bLength = 0x09,
+	.bDescriptorType = 0x05,
+	.bEndpointAddress = 0x04,
+	.bmAttributes = 0x09,
+	.wMaxPacketSize = 0x0038,
+	.bInterval = 0x01,
+	.bRefresh = 0x00,
+	.bSynchAddress = 0x00,
+};
+
+static char z_iso_ep2[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
+
+// 9 bytes
+static char z_ac_interface_header_desc[] =
+{ 0x09, 0x24, 0x01, 0x00, 0x01, 0x2b, 0x00, 0x01, 0x01 };
+
+// 12 bytes
+static char z_0[] = {0x0c, 0x24, 0x02, 0x01, 0x01, 0x01, 0x00, 0x02,
+		     0x03, 0x00, 0x00, 0x00};
+// 13 bytes
+static char z_1[] = {0x0d, 0x24, 0x06, 0x02, 0x01, 0x02, 0x15, 0x00,
+		     0x02, 0x00, 0x02, 0x00, 0x00};
+// 9 bytes
+static char z_2[] = {0x09, 0x24, 0x03, 0x03, 0x01, 0x03, 0x00, 0x02,
+		     0x00};
+
+static char za_0[] = {0x09, 0x04, 0x01, 0x02, 0x01, 0x01, 0x02, 0x00,
+		      0x00};
+
+static char za_1[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
+
+static char za_2[] = {0x0e, 0x24, 0x02, 0x01, 0x02, 0x01, 0x08, 0x00,
+		      0x7e, 0x13, 0x00, 0xe2, 0xd6, 0x00};
+
+static char za_3[] = {0x09, 0x05, 0x04, 0x09, 0x70, 0x00, 0x01, 0x00,
+		      0x00};
+
+static char za_4[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
+
+static char za_5[] = {0x09, 0x04, 0x01, 0x03, 0x01, 0x01, 0x02, 0x00,
+		      0x00};
+
+static char za_6[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
+
+static char za_7[] = {0x0e, 0x24, 0x02, 0x01, 0x01, 0x02, 0x10, 0x00,
+		      0x7e, 0x13, 0x00, 0xe2, 0xd6, 0x00};
+
+static char za_8[] = {0x09, 0x05, 0x04, 0x09, 0x70, 0x00, 0x01, 0x00,
+		      0x00};
+
+static char za_9[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
+
+static char za_10[] = {0x09, 0x04, 0x01, 0x04, 0x01, 0x01, 0x02, 0x00,
+		       0x00};
+
+static char za_11[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
+
+static char za_12[] = {0x0e, 0x24, 0x02, 0x01, 0x02, 0x02, 0x10, 0x00,
+		       0x73, 0x13, 0x00, 0xe2, 0xd6, 0x00};
+
+static char za_13[] = {0x09, 0x05, 0x04, 0x09, 0xe0, 0x00, 0x01, 0x00,
+		       0x00};
+
+static char za_14[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
+
+static char za_15[] = {0x09, 0x04, 0x01, 0x05, 0x01, 0x01, 0x02, 0x00,
+		       0x00};
+
+static char za_16[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
+
+static char za_17[] = {0x0e, 0x24, 0x02, 0x01, 0x01, 0x03, 0x14, 0x00,
+		       0x7e, 0x13, 0x00, 0xe2, 0xd6, 0x00};
+
+static char za_18[] = {0x09, 0x05, 0x04, 0x09, 0xa8, 0x00, 0x01, 0x00,
+		       0x00};
+
+static char za_19[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
+
+static char za_20[] = {0x09, 0x04, 0x01, 0x06, 0x01, 0x01, 0x02, 0x00,
+		       0x00};
+
+static char za_21[] = {0x07, 0x24, 0x01, 0x01, 0x00, 0x01, 0x00};
+
+static char za_22[] = {0x0e, 0x24, 0x02, 0x01, 0x02, 0x03, 0x14, 0x00,
+		       0x7e, 0x13, 0x00, 0xe2, 0xd6, 0x00};
+
+static char za_23[] = {0x09, 0x05, 0x04, 0x09, 0x50, 0x01, 0x01, 0x00,
+		       0x00};
+
+static char za_24[] = {0x07, 0x25, 0x01, 0x00, 0x02, 0x00, 0x02};
+
+
+
+static const struct usb_descriptor_header *z_function [] = {
+	(struct usb_descriptor_header *) &z_audio_control_if_desc,
+	(struct usb_descriptor_header *) &z_ac_interface_header_desc,
+	(struct usb_descriptor_header *) &z_0,
+	(struct usb_descriptor_header *) &z_1,
+	(struct usb_descriptor_header *) &z_2,
+	(struct usb_descriptor_header *) &z_audio_if_desc,
+	(struct usb_descriptor_header *) &z_audio_if_desc2,
+	(struct usb_descriptor_header *) &z_audio_cs_as_if_desc,
+	(struct usb_descriptor_header *) &z_audio_cs_as_format_desc,
+	(struct usb_descriptor_header *) &z_iso_ep,
+	(struct usb_descriptor_header *) &z_iso_ep2,
+	(struct usb_descriptor_header *) &za_0,
+	(struct usb_descriptor_header *) &za_1,
+	(struct usb_descriptor_header *) &za_2,
+	(struct usb_descriptor_header *) &za_3,
+	(struct usb_descriptor_header *) &za_4,
+	(struct usb_descriptor_header *) &za_5,
+	(struct usb_descriptor_header *) &za_6,
+	(struct usb_descriptor_header *) &za_7,
+	(struct usb_descriptor_header *) &za_8,
+	(struct usb_descriptor_header *) &za_9,
+	(struct usb_descriptor_header *) &za_10,
+	(struct usb_descriptor_header *) &za_11,
+	(struct usb_descriptor_header *) &za_12,
+	(struct usb_descriptor_header *) &za_13,
+	(struct usb_descriptor_header *) &za_14,
+	(struct usb_descriptor_header *) &za_15,
+	(struct usb_descriptor_header *) &za_16,
+	(struct usb_descriptor_header *) &za_17,
+	(struct usb_descriptor_header *) &za_18,
+	(struct usb_descriptor_header *) &za_19,
+	(struct usb_descriptor_header *) &za_20,
+	(struct usb_descriptor_header *) &za_21,
+	(struct usb_descriptor_header *) &za_22,
+	(struct usb_descriptor_header *) &za_23,
+	(struct usb_descriptor_header *) &za_24,
+	NULL,
+};
+
+/* maxpacket and other transfer characteristics vary by speed. */
+#define ep_desc(g,hs,fs) (((g)->speed==USB_SPEED_HIGH)?(hs):(fs))
+
+#else
+
+/* if there's no high speed support, maxpacket doesn't change. */
+#define ep_desc(g,hs,fs) fs
+
+#endif	/* !CONFIG_USB_GADGET_DUALSPEED */
+
+static char				manufacturer [40];
+//static char				serial [40];
+static char				serial [] = "Ser 00 em";
+
+/* static strings, in UTF-8 */
+static struct usb_string		strings [] = {
+	{ STRING_MANUFACTURER, manufacturer, },
+	{ STRING_PRODUCT, longname, },
+	{ STRING_SERIAL, serial, },
+	{ STRING_LOOPBACK, loopback, },
+	{ STRING_SOURCE_SINK, source_sink, },
+	{  }			/* end of list */
+};
+
+static struct usb_gadget_strings	stringtab = {
+	.language	= 0x0409,	/* en-us */
+	.strings	= strings,
+};
+
+/*
+ * config descriptors are also handcrafted.  these must agree with code
+ * that sets configurations, and with code managing interfaces and their
+ * altsettings.  other complexity may come from:
+ *
+ *  - high speed support, including "other speed config" rules
+ *  - multiple configurations
+ *  - interfaces with alternate settings
+ *  - embedded class or vendor-specific descriptors
+ *
+ * this handles high speed, and has a second config that could as easily
+ * have been an alternate interface setting (on most hardware).
+ *
+ * NOTE:  to demonstrate (and test) more USB capabilities, this driver
+ * should include an altsetting to test interrupt transfers, including
+ * high bandwidth modes at high speed.  (Maybe work like Intel's test
+ * device?)
+ */
+static int
+config_buf (struct usb_gadget *gadget, u8 *buf, u8 type, unsigned index)
+{
+	int len;
+	const struct usb_descriptor_header **function;
+
+	function = z_function;
+	len = usb_gadget_config_buf (&z_config, buf, USB_BUFSIZ, function);
+	if (len < 0)
+		return len;
+	((struct usb_config_descriptor *) buf)->bDescriptorType = type;
+	return len;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static struct usb_request *
+alloc_ep_req (struct usb_ep *ep, unsigned length)
+{
+	struct usb_request	*req;
+
+	req = usb_ep_alloc_request (ep, GFP_ATOMIC);
+	if (req) {
+		req->length = length;
+		req->buf = usb_ep_alloc_buffer (ep, length,
+				&req->dma, GFP_ATOMIC);
+		if (!req->buf) {
+			usb_ep_free_request (ep, req);
+			req = NULL;
+		}
+	}
+	return req;
+}
+
+static void free_ep_req (struct usb_ep *ep, struct usb_request *req)
+{
+	if (req->buf)
+		usb_ep_free_buffer (ep, req->buf, req->dma, req->length);
+	usb_ep_free_request (ep, req);
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* optionally require specific source/sink data patterns  */
+
+static int
+check_read_data (
+	struct zero_dev		*dev,
+	struct usb_ep		*ep,
+	struct usb_request	*req
+)
+{
+	unsigned	i;
+	u8		*buf = req->buf;
+
+	for (i = 0; i < req->actual; i++, buf++) {
+		switch (pattern) {
+		/* all-zeroes has no synchronization issues */
+		case 0:
+			if (*buf == 0)
+				continue;
+			break;
+		/* mod63 stays in sync with short-terminated transfers,
+		 * or otherwise when host and gadget agree on how large
+		 * each usb transfer request should be.  resync is done
+		 * with set_interface or set_config.
+		 */
+		case 1:
+			if (*buf == (u8)(i % 63))
+				continue;
+			break;
+		}
+		ERROR (dev, "bad OUT byte, buf [%d] = %d\n", i, *buf);
+		usb_ep_set_halt (ep);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static void zero_reset_config (struct zero_dev *dev)
+{
+	if (dev->config == 0)
+		return;
+
+	DBG (dev, "reset config\n");
+
+	/* just disable endpoints, forcing completion of pending i/o.
+	 * all our completion handlers free their requests in this case.
+	 */
+	if (dev->in_ep) {
+		usb_ep_disable (dev->in_ep);
+		dev->in_ep = NULL;
+	}
+	if (dev->out_ep) {
+		usb_ep_disable (dev->out_ep);
+		dev->out_ep = NULL;
+	}
+	dev->config = 0;
+	del_timer (&dev->resume);
+}
+
+#define _write(f, buf, sz) (f->f_op->write(f, buf, sz, &f->f_pos))
+
+static void
+zero_isoc_complete (struct usb_ep *ep, struct usb_request *req)
+{
+	struct zero_dev	*dev = ep->driver_data;
+	int		status = req->status;
+	int i, j;
+
+	switch (status) {
+
+	case 0: 			/* normal completion? */
+		//printk ("\nzero ---------------> isoc normal completion %d bytes\n", req->actual);
+		for (i=0, j=rbuf_start; i<req->actual; i++) {
+			//printk ("%02x ", ((__u8*)req->buf)[i]);
+			rbuf[j] = ((__u8*)req->buf)[i];
+			j++;
+			if (j >= RBUF_LEN) j=0;
+		}
+		rbuf_start = j;
+		//printk ("\n\n");
+
+		if (rbuf_len < RBUF_LEN) {
+			rbuf_len += req->actual;
+			if (rbuf_len > RBUF_LEN) {
+				rbuf_len = RBUF_LEN;
+			}
+		}
+
+		break;
+
+	/* this endpoint is normally active while we're configured */
+	case -ECONNABORTED: 		/* hardware forced ep reset */
+	case -ECONNRESET:		/* request dequeued */
+	case -ESHUTDOWN:		/* disconnect from host */
+		VDBG (dev, "%s gone (%d), %d/%d\n", ep->name, status,
+				req->actual, req->length);
+		if (ep == dev->out_ep)
+			check_read_data (dev, ep, req);
+		free_ep_req (ep, req);
+		return;
+
+	case -EOVERFLOW:		/* buffer overrun on read means that
+					 * we didn't provide a big enough
+					 * buffer.
+					 */
+	default:
+#if 1
+		DBG (dev, "%s complete --> %d, %d/%d\n", ep->name,
+				status, req->actual, req->length);
+#endif
+	case -EREMOTEIO:		/* short read */
+		break;
+	}
+
+	status = usb_ep_queue (ep, req, GFP_ATOMIC);
+	if (status) {
+		ERROR (dev, "kill %s:  resubmit %d bytes --> %d\n",
+				ep->name, req->length, status);
+		usb_ep_set_halt (ep);
+		/* FIXME recover later ... somehow */
+	}
+}
+
+static struct usb_request *
+zero_start_isoc_ep (struct usb_ep *ep, int gfp_flags)
+{
+	struct usb_request	*req;
+	int			status;
+
+	req = alloc_ep_req (ep, 512);
+	if (!req)
+		return NULL;
+
+	req->complete = zero_isoc_complete;
+
+	status = usb_ep_queue (ep, req, gfp_flags);
+	if (status) {
+		struct zero_dev	*dev = ep->driver_data;
+
+		ERROR (dev, "start %s --> %d\n", ep->name, status);
+		free_ep_req (ep, req);
+		req = NULL;
+	}
+
+	return req;
+}
+
+/* change our operational config.  this code must agree with the code
+ * that returns config descriptors, and altsetting code.
+ *
+ * it's also responsible for power management interactions. some
+ * configurations might not work with our current power sources.
+ *
+ * note that some device controller hardware will constrain what this
+ * code can do, perhaps by disallowing more than one configuration or
+ * by limiting configuration choices (like the pxa2xx).
+ */
+static int
+zero_set_config (struct zero_dev *dev, unsigned number, int gfp_flags)
+{
+	int			result = 0;
+	struct usb_gadget	*gadget = dev->gadget;
+	const struct usb_endpoint_descriptor	*d;
+	struct usb_ep		*ep;
+
+	if (number == dev->config)
+		return 0;
+
+	zero_reset_config (dev);
+
+	gadget_for_each_ep (ep, gadget) {
+
+		if (strcmp (ep->name, "ep4") == 0) {
+
+			d = (struct usb_endpoint_descripter *)&za_23; // isoc ep desc for audio i/f alt setting 6
+			result = usb_ep_enable (ep, d);
+
+			if (result == 0) {
+				ep->driver_data = dev;
+				dev->in_ep = ep;
+
+				if (zero_start_isoc_ep (ep, gfp_flags) != 0) {
+
+					dev->in_ep = ep;
+					continue;
+				}
+
+				usb_ep_disable (ep);
+				result = -EIO;
+			}
+		}
+
+	}
+
+	dev->config = number;
+	return result;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static void zero_setup_complete (struct usb_ep *ep, struct usb_request *req)
+{
+	if (req->status || req->actual != req->length)
+		DBG ((struct zero_dev *) ep->driver_data,
+				"setup complete --> %d, %d/%d\n",
+				req->status, req->actual, req->length);
+}
+
+/*
+ * The setup() callback implements all the ep0 functionality that's
+ * not handled lower down, in hardware or the hardware driver (like
+ * device and endpoint feature flags, and their status).  It's all
+ * housekeeping for the gadget function we're implementing.  Most of
+ * the work is in config-specific setup.
+ */
+static int
+zero_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
+{
+	struct zero_dev		*dev = get_gadget_data (gadget);
+	struct usb_request	*req = dev->req;
+	int			value = -EOPNOTSUPP;
+
+	/* usually this stores reply data in the pre-allocated ep0 buffer,
+	 * but config change events will reconfigure hardware.
+	 */
+	req->zero = 0;
+	switch (ctrl->bRequest) {
+
+	case USB_REQ_GET_DESCRIPTOR:
+
+		switch (ctrl->wValue >> 8) {
+
+		case USB_DT_DEVICE:
+			value = min (ctrl->wLength, (u16) sizeof device_desc);
+			memcpy (req->buf, &device_desc, value);
+			break;
+#ifdef CONFIG_USB_GADGET_DUALSPEED
+		case USB_DT_DEVICE_QUALIFIER:
+			if (!gadget->is_dualspeed)
+				break;
+			value = min (ctrl->wLength, (u16) sizeof dev_qualifier);
+			memcpy (req->buf, &dev_qualifier, value);
+			break;
+
+		case USB_DT_OTHER_SPEED_CONFIG:
+			if (!gadget->is_dualspeed)
+				break;
+			// FALLTHROUGH
+#endif /* CONFIG_USB_GADGET_DUALSPEED */
+		case USB_DT_CONFIG:
+			value = config_buf (gadget, req->buf,
+					ctrl->wValue >> 8,
+					ctrl->wValue & 0xff);
+			if (value >= 0)
+				value = min (ctrl->wLength, (u16) value);
+			break;
+
+		case USB_DT_STRING:
+			/* wIndex == language code.
+			 * this driver only handles one language, you can
+			 * add string tables for other languages, using
+			 * any UTF-8 characters
+			 */
+			value = usb_gadget_get_string (&stringtab,
+					ctrl->wValue & 0xff, req->buf);
+			if (value >= 0) {
+				value = min (ctrl->wLength, (u16) value);
+			}
+			break;
+		}
+		break;
+
+	/* currently two configs, two speeds */
+	case USB_REQ_SET_CONFIGURATION:
+		if (ctrl->bRequestType != 0)
+			goto unknown;
+
+		spin_lock (&dev->lock);
+		value = zero_set_config (dev, ctrl->wValue, GFP_ATOMIC);
+		spin_unlock (&dev->lock);
+		break;
+	case USB_REQ_GET_CONFIGURATION:
+		if (ctrl->bRequestType != USB_DIR_IN)
+			goto unknown;
+		*(u8 *)req->buf = dev->config;
+		value = min (ctrl->wLength, (u16) 1);
+		break;
+
+	/* until we add altsetting support, or other interfaces,
+	 * only 0/0 are possible.  pxa2xx only supports 0/0 (poorly)
+	 * and already killed pending endpoint I/O.
+	 */
+	case USB_REQ_SET_INTERFACE:
+
+		if (ctrl->bRequestType != USB_RECIP_INTERFACE)
+			goto unknown;
+		spin_lock (&dev->lock);
+		if (dev->config) {
+			u8		config = dev->config;
+
+			/* resets interface configuration, forgets about
+			 * previous transaction state (queued bufs, etc)
+			 * and re-inits endpoint state (toggle etc)
+			 * no response queued, just zero status == success.
+			 * if we had more than one interface we couldn't
+			 * use this "reset the config" shortcut.
+			 */
+			zero_reset_config (dev);
+			zero_set_config (dev, config, GFP_ATOMIC);
+			value = 0;
+		}
+		spin_unlock (&dev->lock);
+		break;
+	case USB_REQ_GET_INTERFACE:
+		if ((ctrl->bRequestType == 0x21) && (ctrl->wIndex == 0x02)) {
+			value = ctrl->wLength;
+			break;
+		}
+		else {
+			if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
+				goto unknown;
+			if (!dev->config)
+				break;
+			if (ctrl->wIndex != 0) {
+				value = -EDOM;
+				break;
+			}
+			*(u8 *)req->buf = 0;
+			value = min (ctrl->wLength, (u16) 1);
+		}
+		break;
+
+	/*
+	 * These are the same vendor-specific requests supported by
+	 * Intel's USB 2.0 compliance test devices.  We exceed that
+	 * device spec by allowing multiple-packet requests.
+	 */
+	case 0x5b:	/* control WRITE test -- fill the buffer */
+		if (ctrl->bRequestType != (USB_DIR_OUT|USB_TYPE_VENDOR))
+			goto unknown;
+		if (ctrl->wValue || ctrl->wIndex)
+			break;
+		/* just read that many bytes into the buffer */
+		if (ctrl->wLength > USB_BUFSIZ)
+			break;
+		value = ctrl->wLength;
+		break;
+	case 0x5c:	/* control READ test -- return the buffer */
+		if (ctrl->bRequestType != (USB_DIR_IN|USB_TYPE_VENDOR))
+			goto unknown;
+		if (ctrl->wValue || ctrl->wIndex)
+			break;
+		/* expect those bytes are still in the buffer; send back */
+		if (ctrl->wLength > USB_BUFSIZ
+				|| ctrl->wLength != req->length)
+			break;
+		value = ctrl->wLength;
+		break;
+
+	case 0x01: // SET_CUR
+	case 0x02:
+	case 0x03:
+	case 0x04:
+	case 0x05:
+		value = ctrl->wLength;
+		break;
+	case 0x81:
+		switch (ctrl->wValue) {
+		case 0x0201:
+		case 0x0202:
+			((u8*)req->buf)[0] = 0x00;
+			((u8*)req->buf)[1] = 0xe3;
+			break;
+		case 0x0300:
+		case 0x0500:
+			((u8*)req->buf)[0] = 0x00;
+			break;
+		}
+		//((u8*)req->buf)[0] = 0x81;
+		//((u8*)req->buf)[1] = 0x81;
+		value = ctrl->wLength;
+		break;
+	case 0x82:
+		switch (ctrl->wValue) {
+		case 0x0201:
+		case 0x0202:
+			((u8*)req->buf)[0] = 0x00;
+			((u8*)req->buf)[1] = 0xc3;
+			break;
+		case 0x0300:
+		case 0x0500:
+			((u8*)req->buf)[0] = 0x00;
+			break;
+		}
+		//((u8*)req->buf)[0] = 0x82;
+		//((u8*)req->buf)[1] = 0x82;
+		value = ctrl->wLength;
+		break;
+	case 0x83:
+		switch (ctrl->wValue) {
+		case 0x0201:
+		case 0x0202:
+			((u8*)req->buf)[0] = 0x00;
+			((u8*)req->buf)[1] = 0x00;
+			break;
+		case 0x0300:
+			((u8*)req->buf)[0] = 0x60;
+			break;
+		case 0x0500:
+			((u8*)req->buf)[0] = 0x18;
+			break;
+		}
+		//((u8*)req->buf)[0] = 0x83;
+		//((u8*)req->buf)[1] = 0x83;
+		value = ctrl->wLength;
+		break;
+	case 0x84:
+		switch (ctrl->wValue) {
+		case 0x0201:
+		case 0x0202:
+			((u8*)req->buf)[0] = 0x00;
+			((u8*)req->buf)[1] = 0x01;
+			break;
+		case 0x0300:
+		case 0x0500:
+			((u8*)req->buf)[0] = 0x08;
+			break;
+		}
+		//((u8*)req->buf)[0] = 0x84;
+		//((u8*)req->buf)[1] = 0x84;
+		value = ctrl->wLength;
+		break;
+	case 0x85:
+		((u8*)req->buf)[0] = 0x85;
+		((u8*)req->buf)[1] = 0x85;
+		value = ctrl->wLength;
+		break;
+
+
+	default:
+unknown:
+		printk("unknown control req%02x.%02x v%04x i%04x l%d\n",
+			ctrl->bRequestType, ctrl->bRequest,
+			ctrl->wValue, ctrl->wIndex, ctrl->wLength);
+	}
+
+	/* respond with data transfer before status phase? */
+	if (value >= 0) {
+		req->length = value;
+		req->zero = value < ctrl->wLength
+				&& (value % gadget->ep0->maxpacket) == 0;
+		value = usb_ep_queue (gadget->ep0, req, GFP_ATOMIC);
+		if (value < 0) {
+			DBG (dev, "ep_queue < 0 --> %d\n", value);
+			req->status = 0;
+			zero_setup_complete (gadget->ep0, req);
+		}
+	}
+
+	/* device either stalls (value < 0) or reports success */
+	return value;
+}
+
+static void
+zero_disconnect (struct usb_gadget *gadget)
+{
+	struct zero_dev		*dev = get_gadget_data (gadget);
+	unsigned long		flags;
+
+	spin_lock_irqsave (&dev->lock, flags);
+	zero_reset_config (dev);
+
+	/* a more significant application might have some non-usb
+	 * activities to quiesce here, saving resources like power
+	 * or pushing the notification up a network stack.
+	 */
+	spin_unlock_irqrestore (&dev->lock, flags);
+
+	/* next we may get setup() calls to enumerate new connections;
+	 * or an unbind() during shutdown (including removing module).
+	 */
+}
+
+static void
+zero_autoresume (unsigned long _dev)
+{
+	struct zero_dev	*dev = (struct zero_dev *) _dev;
+	int		status;
+
+	/* normally the host would be woken up for something
+	 * more significant than just a timer firing...
+	 */
+	if (dev->gadget->speed != USB_SPEED_UNKNOWN) {
+		status = usb_gadget_wakeup (dev->gadget);
+		DBG (dev, "wakeup --> %d\n", status);
+	}
+}
+
+/*-------------------------------------------------------------------------*/
+
+static void
+zero_unbind (struct usb_gadget *gadget)
+{
+	struct zero_dev		*dev = get_gadget_data (gadget);
+
+	DBG (dev, "unbind\n");
+
+	/* we've already been disconnected ... no i/o is active */
+	if (dev->req)
+		free_ep_req (gadget->ep0, dev->req);
+	del_timer_sync (&dev->resume);
+	kfree (dev);
+	set_gadget_data (gadget, NULL);
+}
+
+static int
+zero_bind (struct usb_gadget *gadget)
+{
+	struct zero_dev		*dev;
+	//struct usb_ep		*ep;
+
+	printk("binding\n");
+	/*
+	 * DRIVER POLICY CHOICE:  you may want to do this differently.
+	 * One thing to avoid is reusing a bcdDevice revision code
+	 * with different host-visible configurations or behavior
+	 * restrictions -- using ep1in/ep2out vs ep1out/ep3in, etc
+	 */
+	//device_desc.bcdDevice = __constant_cpu_to_le16 (0x0201);
+
+
+	/* ok, we made sense of the hardware ... */
+	dev = kzalloc (sizeof *dev, SLAB_KERNEL);
+	if (!dev)
+		return -ENOMEM;
+	spin_lock_init (&dev->lock);
+	dev->gadget = gadget;
+	set_gadget_data (gadget, dev);
+
+	/* preallocate control response and buffer */
+	dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL);
+	if (!dev->req)
+		goto enomem;
+	dev->req->buf = usb_ep_alloc_buffer (gadget->ep0, USB_BUFSIZ,
+				&dev->req->dma, GFP_KERNEL);
+	if (!dev->req->buf)
+		goto enomem;
+
+	dev->req->complete = zero_setup_complete;
+
+	device_desc.bMaxPacketSize0 = gadget->ep0->maxpacket;
+
+#ifdef CONFIG_USB_GADGET_DUALSPEED
+	/* assume ep0 uses the same value for both speeds ... */
+	dev_qualifier.bMaxPacketSize0 = device_desc.bMaxPacketSize0;
+
+	/* and that all endpoints are dual-speed */
+	//hs_source_desc.bEndpointAddress = fs_source_desc.bEndpointAddress;
+	//hs_sink_desc.bEndpointAddress = fs_sink_desc.bEndpointAddress;
+#endif
+
+	usb_gadget_set_selfpowered (gadget);
+
+	init_timer (&dev->resume);
+	dev->resume.function = zero_autoresume;
+	dev->resume.data = (unsigned long) dev;
+
+	gadget->ep0->driver_data = dev;
+
+	INFO (dev, "%s, version: " DRIVER_VERSION "\n", longname);
+	INFO (dev, "using %s, OUT %s IN %s\n", gadget->name,
+		EP_OUT_NAME, EP_IN_NAME);
+
+	snprintf (manufacturer, sizeof manufacturer,
+		UTS_SYSNAME " " UTS_RELEASE " with %s",
+		gadget->name);
+
+	return 0;
+
+enomem:
+	zero_unbind (gadget);
+	return -ENOMEM;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static void
+zero_suspend (struct usb_gadget *gadget)
+{
+	struct zero_dev		*dev = get_gadget_data (gadget);
+
+	if (gadget->speed == USB_SPEED_UNKNOWN)
+		return;
+
+	if (autoresume) {
+		mod_timer (&dev->resume, jiffies + (HZ * autoresume));
+		DBG (dev, "suspend, wakeup in %d seconds\n", autoresume);
+	} else
+		DBG (dev, "suspend\n");
+}
+
+static void
+zero_resume (struct usb_gadget *gadget)
+{
+	struct zero_dev		*dev = get_gadget_data (gadget);
+
+	DBG (dev, "resume\n");
+	del_timer (&dev->resume);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static struct usb_gadget_driver zero_driver = {
+#ifdef CONFIG_USB_GADGET_DUALSPEED
+	.speed		= USB_SPEED_HIGH,
+#else
+	.speed		= USB_SPEED_FULL,
+#endif
+	.function	= (char *) longname,
+	.bind		= zero_bind,
+	.unbind		= zero_unbind,
+
+	.setup		= zero_setup,
+	.disconnect	= zero_disconnect,
+
+	.suspend	= zero_suspend,
+	.resume		= zero_resume,
+
+	.driver 	= {
+		.name		= (char *) shortname,
+		// .shutdown = ...
+		// .suspend = ...
+		// .resume = ...
+	},
+};
+
+MODULE_AUTHOR ("David Brownell");
+MODULE_LICENSE ("Dual BSD/GPL");
+
+static struct proc_dir_entry *pdir, *pfile;
+
+static int isoc_read_data (char *page, char **start,
+			   off_t off, int count,
+			   int *eof, void *data)
+{
+	int i;
+	static int c = 0;
+	static int done = 0;
+	static int s = 0;
+
+/*
+	printk ("\ncount: %d\n", count);
+	printk ("rbuf_start: %d\n", rbuf_start);
+	printk ("rbuf_len: %d\n", rbuf_len);
+	printk ("off: %d\n", off);
+	printk ("start: %p\n\n", *start);
+*/
+	if (done) {
+		c = 0;
+		done = 0;
+		*eof = 1;
+		return 0;
+	}
+
+	if (c == 0) {
+		if (rbuf_len == RBUF_LEN)
+			s = rbuf_start;
+		else s = 0;
+	}
+
+	for (i=0; i<count && c<rbuf_len; i++, c++) {
+		page[i] = rbuf[(c+s) % RBUF_LEN];
+	}
+	*start = page;
+
+	if (c >= rbuf_len) {
+		*eof = 1;
+		done = 1;
+	}
+
+
+	return i;
+}
+
+static int __init init (void)
+{
+
+	int retval = 0;
+
+	pdir = proc_mkdir("isoc_test", NULL);
+	if(pdir == NULL) {
+		retval = -ENOMEM;
+		printk("Error creating dir\n");
+		goto done;
+	}
+	pdir->owner = THIS_MODULE;
+
+	pfile = create_proc_read_entry("isoc_data",
+				       0444, pdir,
+				       isoc_read_data,
+				       NULL);
+	if (pfile == NULL) {
+		retval = -ENOMEM;
+		printk("Error creating file\n");
+		goto no_file;
+	}
+	pfile->owner = THIS_MODULE;
+
+	return usb_gadget_register_driver (&zero_driver);
+
+ no_file:
+	remove_proc_entry("isoc_data", NULL);
+ done:
+	return retval;
+}
+module_init (init);
+
+static void __exit cleanup (void)
+{
+
+	usb_gadget_unregister_driver (&zero_driver);
+
+	remove_proc_entry("isoc_data", pdir);
+	remove_proc_entry("isoc_test", NULL);
+}
+module_exit (cleanup);
diff --git a/drivers/usb/host/dwc_otg/dwc_cfi_common.h b/drivers/usb/host/dwc_otg/dwc_cfi_common.h
new file mode 100644
index 000000000000..7770e201ad3b
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_cfi_common.h
@@ -0,0 +1,142 @@
+/* ==========================================================================
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+#if !defined(__DWC_CFI_COMMON_H__)
+#define __DWC_CFI_COMMON_H__
+
+//#include <linux/types.h>
+
+/**
+ * @file
+ *
+ * This file contains the CFI specific common constants, interfaces
+ * (functions and macros) and structures for Linux. No PCD specific
+ * data structure or definition is to be included in this file.
+ *
+ */
+
+/** This is a request for all Core Features */
+#define VEN_CORE_GET_FEATURES		0xB1
+
+/** This is a request to get the value of a specific Core Feature */
+#define VEN_CORE_GET_FEATURE		0xB2
+
+/** This command allows the host to set the value of a specific Core Feature */
+#define VEN_CORE_SET_FEATURE		0xB3
+
+/** This command allows the host to set the default values of
+ * either all or any specific Core Feature
+ */
+#define VEN_CORE_RESET_FEATURES		0xB4
+
+/** This command forces the PCD to write the deferred values of a Core Features */
+#define VEN_CORE_ACTIVATE_FEATURES	0xB5
+
+/** This request reads a DWORD value from a register at the specified offset */
+#define VEN_CORE_READ_REGISTER		0xB6
+
+/** This request writes a DWORD value into a register at the specified offset */
+#define VEN_CORE_WRITE_REGISTER		0xB7
+
+/** This structure is the header of the Core Features dataset returned to
+ *  the Host
+ */
+struct cfi_all_features_header {
+/** The features header structure length is */
+#define CFI_ALL_FEATURES_HDR_LEN		8
+	/**
+	 * The total length of the features dataset returned to the Host
+	 */
+	uint16_t wTotalLen;
+
+	/**
+	 * CFI version number inBinary-Coded Decimal (i.e., 1.00 is 100H).
+	 * This field identifies the version of the CFI Specification with which
+	 * the device is compliant.
+	 */
+	uint16_t wVersion;
+
+	/** The ID of the Core */
+	uint16_t wCoreID;
+#define CFI_CORE_ID_UDC		1
+#define CFI_CORE_ID_OTG		2
+#define CFI_CORE_ID_WUDEV	3
+
+	/** Number of features returned by VEN_CORE_GET_FEATURES request */
+	uint16_t wNumFeatures;
+} UPACKED;
+
+typedef struct cfi_all_features_header cfi_all_features_header_t;
+
+/** This structure is a header of the Core Feature descriptor dataset returned to
+ *  the Host after the VEN_CORE_GET_FEATURES request
+ */
+struct cfi_feature_desc_header {
+#define CFI_FEATURE_DESC_HDR_LEN	8
+
+	/** The feature ID */
+	uint16_t wFeatureID;
+
+	/** Length of this feature descriptor in bytes - including the
+	 * length of the feature name string
+	 */
+	uint16_t wLength;
+
+	/** The data length of this feature in bytes */
+	uint16_t wDataLength;
+
+	/**
+	 * Attributes of this features
+	 * D0: Access rights
+	 * 0 - Read/Write
+	 * 1 - Read only
+	 */
+	uint8_t bmAttributes;
+#define CFI_FEATURE_ATTR_RO		1
+#define CFI_FEATURE_ATTR_RW		0
+
+	/** Length of the feature name in bytes */
+	uint8_t bNameLen;
+
+	/** The feature name buffer */
+	//uint8_t *name;
+} UPACKED;
+
+typedef struct cfi_feature_desc_header cfi_feature_desc_header_t;
+
+/**
+ * This structure describes a NULL terminated string referenced by its id field.
+ * It is very similar to usb_string structure but has the id field type set to 16-bit.
+ */
+struct cfi_string {
+	uint16_t id;
+	const uint8_t *s;
+};
+typedef struct cfi_string cfi_string_t;
+
+#endif
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_adp.c b/drivers/usb/host/dwc_otg/dwc_otg_adp.c
new file mode 100644
index 000000000000..ce0618dd3f4a
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_adp.c
@@ -0,0 +1,854 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_adp.c $
+ * $Revision: #12 $
+ * $Date: 2011/10/26 $
+ * $Change: 1873028 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+#include "dwc_os.h"
+#include "dwc_otg_regs.h"
+#include "dwc_otg_cil.h"
+#include "dwc_otg_adp.h"
+
+/** @file
+ *
+ * This file contains the most of the Attach Detect Protocol implementation for
+ * the driver to support OTG Rev2.0.
+ *
+ */
+
+void dwc_otg_adp_write_reg(dwc_otg_core_if_t * core_if, uint32_t value)
+{
+	adpctl_data_t adpctl;
+
+	adpctl.d32 = value;
+	adpctl.b.ar = 0x2;
+
+	DWC_WRITE_REG32(&core_if->core_global_regs->adpctl, adpctl.d32);
+
+	while (adpctl.b.ar) {
+		adpctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->adpctl);
+	}
+
+}
+
+/**
+ * Function is called to read ADP registers
+ */
+uint32_t dwc_otg_adp_read_reg(dwc_otg_core_if_t * core_if)
+{
+	adpctl_data_t adpctl;
+
+	adpctl.d32 = 0;
+	adpctl.b.ar = 0x1;
+
+	DWC_WRITE_REG32(&core_if->core_global_regs->adpctl, adpctl.d32);
+
+	while (adpctl.b.ar) {
+		adpctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->adpctl);
+	}
+
+	return adpctl.d32;
+}
+
+/**
+ * Function is called to read ADPCTL register and filter Write-clear bits
+ */
+uint32_t dwc_otg_adp_read_reg_filter(dwc_otg_core_if_t * core_if)
+{
+	adpctl_data_t adpctl;
+
+	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
+	adpctl.b.adp_tmout_int = 0;
+	adpctl.b.adp_prb_int = 0;
+	adpctl.b.adp_tmout_int = 0;
+
+	return adpctl.d32;
+}
+
+/**
+ * Function is called to write ADP registers
+ */
+void dwc_otg_adp_modify_reg(dwc_otg_core_if_t * core_if, uint32_t clr,
+			    uint32_t set)
+{
+	dwc_otg_adp_write_reg(core_if,
+			      (dwc_otg_adp_read_reg(core_if) & (~clr)) | set);
+}
+
+static void adp_sense_timeout(void *ptr)
+{
+	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) ptr;
+	core_if->adp.sense_timer_started = 0;
+	DWC_PRINTF("ADP SENSE TIMEOUT\n");
+	if (core_if->adp_enable) {
+		dwc_otg_adp_sense_stop(core_if);
+		dwc_otg_adp_probe_start(core_if);
+	}
+}
+
+/**
+ * This function is called when the ADP vbus timer expires. Timeout is 1.1s.
+ */
+static void adp_vbuson_timeout(void *ptr)
+{
+	gpwrdn_data_t gpwrdn;
+	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) ptr;
+	hprt0_data_t hprt0 = {.d32 = 0 };
+	pcgcctl_data_t pcgcctl = {.d32 = 0 };
+	DWC_PRINTF("%s: 1.1 seconds expire after turning on VBUS\n",__FUNCTION__);
+	if (core_if) {
+		core_if->adp.vbuson_timer_started = 0;
+		/* Turn off vbus */
+		hprt0.b.prtpwr = 1;
+		DWC_MODIFY_REG32(core_if->host_if->hprt0, hprt0.d32, 0);
+		gpwrdn.d32 = 0;
+
+		/* Power off the core */
+		if (core_if->power_down == 2) {
+			/* Enable Wakeup Logic */
+//                      gpwrdn.b.wkupactiv = 1;
+			gpwrdn.b.pmuactv = 0;
+			gpwrdn.b.pwrdnrstn = 1;
+			gpwrdn.b.pwrdnclmp = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0,
+					 gpwrdn.d32);
+
+			/* Suspend the Phy Clock */
+			pcgcctl.b.stoppclk = 1;
+			DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
+
+			/* Switch on VDD */
+//                      gpwrdn.b.wkupactiv = 1;
+			gpwrdn.b.pmuactv = 1;
+			gpwrdn.b.pwrdnrstn = 1;
+			gpwrdn.b.pwrdnclmp = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0,
+					 gpwrdn.d32);
+		} else {
+			/* Enable Power Down Logic */
+			gpwrdn.b.pmuintsel = 1;
+			gpwrdn.b.pmuactv = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+		}
+
+		/* Power off the core */
+		if (core_if->power_down == 2) {
+			gpwrdn.d32 = 0;
+			gpwrdn.b.pwrdnswtch = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn,
+					 gpwrdn.d32, 0);
+		}
+
+		/* Unmask SRP detected interrupt from Power Down Logic */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.srp_det_msk = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+
+		dwc_otg_adp_probe_start(core_if);
+		dwc_otg_dump_global_registers(core_if);
+		dwc_otg_dump_host_registers(core_if);
+	}
+
+}
+
+/**
+ * Start the ADP Initial Probe timer to detect if Port Connected interrupt is
+ * not asserted within 1.1 seconds.
+ *
+ * @param core_if the pointer to core_if strucure.
+ */
+void dwc_otg_adp_vbuson_timer_start(dwc_otg_core_if_t * core_if)
+{
+	core_if->adp.vbuson_timer_started = 1;
+	if (core_if->adp.vbuson_timer)
+	{
+		DWC_PRINTF("SCHEDULING VBUSON TIMER\n");
+		/* 1.1 secs + 60ms necessary for cil_hcd_start*/
+		DWC_TIMER_SCHEDULE(core_if->adp.vbuson_timer, 1160);
+	} else {
+		DWC_WARN("VBUSON_TIMER = %p\n",core_if->adp.vbuson_timer);
+	}
+}
+
+#if 0
+/**
+ * Masks all DWC OTG core interrupts
+ *
+ */
+static void mask_all_interrupts(dwc_otg_core_if_t * core_if)
+{
+	int i;
+	gahbcfg_data_t ahbcfg = {.d32 = 0 };
+
+	/* Mask Host Interrupts */
+
+	/* Clear and disable HCINTs */
+	for (i = 0; i < core_if->core_params->host_channels; i++) {
+		DWC_WRITE_REG32(&core_if->host_if->hc_regs[i]->hcintmsk, 0);
+		DWC_WRITE_REG32(&core_if->host_if->hc_regs[i]->hcint, 0xFFFFFFFF);
+
+	}
+
+	/* Clear and disable HAINT */
+	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->haintmsk, 0x0000);
+	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->haint, 0xFFFFFFFF);
+
+	/* Mask Device Interrupts */
+	if (!core_if->multiproc_int_enable) {
+		/* Clear and disable IN Endpoint interrupts */
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->diepmsk, 0);
+		for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
+			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->
+					diepint, 0xFFFFFFFF);
+		}
+
+		/* Clear and disable OUT Endpoint interrupts */
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->doepmsk, 0);
+		for (i = 0; i <= core_if->dev_if->num_out_eps; i++) {
+			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[i]->
+					doepint, 0xFFFFFFFF);
+		}
+
+		/* Clear and disable DAINT */
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->daint,
+				0xFFFFFFFF);
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->daintmsk, 0);
+	} else {
+		for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
+			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->
+					diepeachintmsk[i], 0);
+			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->
+					diepint, 0xFFFFFFFF);
+		}
+
+		for (i = 0; i < core_if->dev_if->num_out_eps; ++i) {
+			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->
+					doepeachintmsk[i], 0);
+			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[i]->
+					doepint, 0xFFFFFFFF);
+		}
+
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->deachintmsk,
+				0);
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->deachint,
+				0xFFFFFFFF);
+
+	}
+
+	/* Disable interrupts */
+	ahbcfg.b.glblintrmsk = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gahbcfg, ahbcfg.d32, 0);
+
+	/* Disable all interrupts. */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, 0);
+
+	/* Clear any pending interrupts */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+
+	/* Clear any pending OTG Interrupts */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gotgint, 0xFFFFFFFF);
+}
+
+/**
+ * Unmask Port Connection Detected interrupt
+ *
+ */
+static void unmask_conn_det_intr(dwc_otg_core_if_t * core_if)
+{
+	gintmsk_data_t gintmsk = {.d32 = 0,.b.portintr = 1 };
+
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gintmsk.d32);
+}
+#endif
+
+/**
+ * Starts the ADP Probing
+ *
+ * @param core_if the pointer to core_if structure.
+ */
+uint32_t dwc_otg_adp_probe_start(dwc_otg_core_if_t * core_if)
+{
+
+	adpctl_data_t adpctl = {.d32 = 0};
+	gpwrdn_data_t gpwrdn;
+#if 0
+	adpctl_data_t adpctl_int = {.d32 = 0, .b.adp_prb_int = 1,
+								.b.adp_sns_int = 1, b.adp_tmout_int};
+#endif
+	dwc_otg_disable_global_interrupts(core_if);
+	DWC_PRINTF("ADP Probe Start\n");
+	core_if->adp.probe_enabled = 1;
+
+	adpctl.b.adpres = 1;
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+
+	while (adpctl.b.adpres) {
+		adpctl.d32 = dwc_otg_adp_read_reg(core_if);
+	}
+
+	adpctl.d32 = 0;
+	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+
+	/* In Host mode unmask SRP detected interrupt */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.sts_chngint_msk = 1;
+	if (!gpwrdn.b.idsts) {
+		gpwrdn.b.srp_det_msk = 1;
+	}
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+
+	adpctl.b.adp_tmout_int_msk = 1;
+	adpctl.b.adp_prb_int_msk = 1;
+	adpctl.b.prb_dschg = 1;
+	adpctl.b.prb_delta = 1;
+	adpctl.b.prb_per = 1;
+	adpctl.b.adpen = 1;
+	adpctl.b.enaprb = 1;
+
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+	DWC_PRINTF("ADP Probe Finish\n");
+	return 0;
+}
+
+/**
+ * Starts the ADP Sense timer to detect if ADP Sense interrupt is not asserted
+ * within 3 seconds.
+ *
+ * @param core_if the pointer to core_if strucure.
+ */
+void dwc_otg_adp_sense_timer_start(dwc_otg_core_if_t * core_if)
+{
+	core_if->adp.sense_timer_started = 1;
+	DWC_TIMER_SCHEDULE(core_if->adp.sense_timer, 3000 /* 3 secs */ );
+}
+
+/**
+ * Starts the ADP Sense
+ *
+ * @param core_if the pointer to core_if strucure.
+ */
+uint32_t dwc_otg_adp_sense_start(dwc_otg_core_if_t * core_if)
+{
+	adpctl_data_t adpctl;
+
+	DWC_PRINTF("ADP Sense Start\n");
+
+	/* Unmask ADP sense interrupt and mask all other from the core */
+	adpctl.d32 = dwc_otg_adp_read_reg_filter(core_if);
+	adpctl.b.adp_sns_int_msk = 1;
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+	dwc_otg_disable_global_interrupts(core_if); // vahrama
+
+	/* Set ADP reset bit*/
+	adpctl.d32 = dwc_otg_adp_read_reg_filter(core_if);
+	adpctl.b.adpres = 1;
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+
+	while (adpctl.b.adpres) {
+		adpctl.d32 = dwc_otg_adp_read_reg(core_if);
+	}
+
+	adpctl.b.adpres = 0;
+	adpctl.b.adpen = 1;
+	adpctl.b.enasns = 1;
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+
+	dwc_otg_adp_sense_timer_start(core_if);
+
+	return 0;
+}
+
+/**
+ * Stops the ADP Probing
+ *
+ * @param core_if the pointer to core_if strucure.
+ */
+uint32_t dwc_otg_adp_probe_stop(dwc_otg_core_if_t * core_if)
+{
+
+	adpctl_data_t adpctl;
+	DWC_PRINTF("Stop ADP probe\n");
+	core_if->adp.probe_enabled = 0;
+	core_if->adp.probe_counter = 0;
+	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
+
+	adpctl.b.adpen = 0;
+	adpctl.b.adp_prb_int = 1;
+	adpctl.b.adp_tmout_int = 1;
+	adpctl.b.adp_sns_int = 1;
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+
+	return 0;
+}
+
+/**
+ * Stops the ADP Sensing
+ *
+ * @param core_if the pointer to core_if strucure.
+ */
+uint32_t dwc_otg_adp_sense_stop(dwc_otg_core_if_t * core_if)
+{
+	adpctl_data_t adpctl;
+
+	core_if->adp.sense_enabled = 0;
+
+	adpctl.d32 = dwc_otg_adp_read_reg_filter(core_if);
+	adpctl.b.enasns = 0;
+	adpctl.b.adp_sns_int = 1;
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+
+	return 0;
+}
+
+/**
+ * Called to turn on the VBUS after initial ADP probe in host mode.
+ * If port power was already enabled in cil_hcd_start function then
+ * only schedule a timer.
+ *
+ * @param core_if the pointer to core_if structure.
+ */
+void dwc_otg_adp_turnon_vbus(dwc_otg_core_if_t * core_if)
+{
+	hprt0_data_t hprt0 = {.d32 = 0 };
+	hprt0.d32 = dwc_otg_read_hprt0(core_if);
+	DWC_PRINTF("Turn on VBUS for 1.1s, port power is %d\n", hprt0.b.prtpwr);
+
+	if (hprt0.b.prtpwr == 0) {
+		hprt0.b.prtpwr = 1;
+		//DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+	}
+
+	dwc_otg_adp_vbuson_timer_start(core_if);
+}
+
+/**
+ * Called right after driver is loaded
+ * to perform initial actions for ADP
+ *
+ * @param core_if the pointer to core_if structure.
+ * @param is_host - flag for current mode of operation either from GINTSTS or GPWRDN
+ */
+void dwc_otg_adp_start(dwc_otg_core_if_t * core_if, uint8_t is_host)
+{
+	gpwrdn_data_t gpwrdn;
+
+	DWC_PRINTF("ADP Initial Start\n");
+	core_if->adp.adp_started = 1;
+
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+	dwc_otg_disable_global_interrupts(core_if);
+	if (is_host) {
+		DWC_PRINTF("HOST MODE\n");
+		/* Enable Power Down Logic Interrupt*/
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pmuintsel = 1;
+		gpwrdn.b.pmuactv = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+		/* Initialize first ADP probe to obtain Ramp Time value */
+		core_if->adp.initial_probe = 1;
+		dwc_otg_adp_probe_start(core_if);
+	} else {
+		gotgctl_data_t gotgctl;
+		gotgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
+		DWC_PRINTF("DEVICE MODE\n");
+		if (gotgctl.b.bsesvld == 0) {
+			/* Enable Power Down Logic Interrupt*/
+			gpwrdn.d32 = 0;
+			DWC_PRINTF("VBUS is not valid - start ADP probe\n");
+			gpwrdn.b.pmuintsel = 1;
+			gpwrdn.b.pmuactv = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+			core_if->adp.initial_probe = 1;
+			dwc_otg_adp_probe_start(core_if);
+		} else {
+			DWC_PRINTF("VBUS is valid - initialize core as a Device\n");
+			core_if->op_state = B_PERIPHERAL;
+			dwc_otg_core_init(core_if);
+			dwc_otg_enable_global_interrupts(core_if);
+			cil_pcd_start(core_if);
+			dwc_otg_dump_global_registers(core_if);
+			dwc_otg_dump_dev_registers(core_if);
+		}
+	}
+}
+
+void dwc_otg_adp_init(dwc_otg_core_if_t * core_if)
+{
+	core_if->adp.adp_started = 0;
+	core_if->adp.initial_probe = 0;
+	core_if->adp.probe_timer_values[0] = -1;
+	core_if->adp.probe_timer_values[1] = -1;
+	core_if->adp.probe_enabled = 0;
+	core_if->adp.sense_enabled = 0;
+	core_if->adp.sense_timer_started = 0;
+	core_if->adp.vbuson_timer_started = 0;
+	core_if->adp.probe_counter = 0;
+	core_if->adp.gpwrdn = 0;
+	core_if->adp.attached = DWC_OTG_ADP_UNKOWN;
+	/* Initialize timers */
+	core_if->adp.sense_timer =
+	    DWC_TIMER_ALLOC("ADP SENSE TIMER", adp_sense_timeout, core_if);
+	core_if->adp.vbuson_timer =
+	    DWC_TIMER_ALLOC("ADP VBUS ON TIMER", adp_vbuson_timeout, core_if);
+	if (!core_if->adp.sense_timer || !core_if->adp.vbuson_timer)
+	{
+		DWC_ERROR("Could not allocate memory for ADP timers\n");
+	}
+}
+
+void dwc_otg_adp_remove(dwc_otg_core_if_t * core_if)
+{
+	gpwrdn_data_t gpwrdn = { .d32 = 0 };
+	gpwrdn.b.pmuintsel = 1;
+	gpwrdn.b.pmuactv = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	if (core_if->adp.probe_enabled)
+		dwc_otg_adp_probe_stop(core_if);
+	if (core_if->adp.sense_enabled)
+		dwc_otg_adp_sense_stop(core_if);
+	if (core_if->adp.sense_timer_started)
+		DWC_TIMER_CANCEL(core_if->adp.sense_timer);
+	if (core_if->adp.vbuson_timer_started)
+		DWC_TIMER_CANCEL(core_if->adp.vbuson_timer);
+	DWC_TIMER_FREE(core_if->adp.sense_timer);
+	DWC_TIMER_FREE(core_if->adp.vbuson_timer);
+}
+
+/////////////////////////////////////////////////////////////////////
+////////////// ADP Interrupt Handlers ///////////////////////////////
+/////////////////////////////////////////////////////////////////////
+/**
+ * This function sets Ramp Timer values
+ */
+static uint32_t set_timer_value(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	if (core_if->adp.probe_timer_values[0] == -1) {
+		core_if->adp.probe_timer_values[0] = val;
+		core_if->adp.probe_timer_values[1] = -1;
+		return 1;
+	} else {
+		core_if->adp.probe_timer_values[1] =
+		    core_if->adp.probe_timer_values[0];
+		core_if->adp.probe_timer_values[0] = val;
+		return 0;
+	}
+}
+
+/**
+ * This function compares Ramp Timer values
+ */
+static uint32_t compare_timer_values(dwc_otg_core_if_t * core_if)
+{
+	uint32_t diff;
+	if (core_if->adp.probe_timer_values[0]>=core_if->adp.probe_timer_values[1])
+			diff = core_if->adp.probe_timer_values[0]-core_if->adp.probe_timer_values[1];
+	else
+			diff = core_if->adp.probe_timer_values[1]-core_if->adp.probe_timer_values[0];
+	if(diff < 2) {
+		return 0;
+	} else {
+		return 1;
+	}
+}
+
+/**
+ * This function handles ADP Probe Interrupts
+ */
+static int32_t dwc_otg_adp_handle_prb_intr(dwc_otg_core_if_t * core_if,
+						 uint32_t val)
+{
+	adpctl_data_t adpctl = {.d32 = 0 };
+	gpwrdn_data_t gpwrdn, temp;
+	adpctl.d32 = val;
+
+	temp.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+	core_if->adp.probe_counter++;
+	core_if->adp.gpwrdn = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+	if (adpctl.b.rtim == 0 && !temp.b.idsts){
+		DWC_PRINTF("RTIM value is 0\n");
+		goto exit;
+	}
+	if (set_timer_value(core_if, adpctl.b.rtim) &&
+	    core_if->adp.initial_probe) {
+		core_if->adp.initial_probe = 0;
+		dwc_otg_adp_probe_stop(core_if);
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pmuactv = 1;
+		gpwrdn.b.pmuintsel = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+
+		/* check which value is for device mode and which for Host mode */
+		if (!temp.b.idsts) {	/* considered host mode value is 0 */
+			/*
+			 * Turn on VBUS after initial ADP probe.
+			 */
+			core_if->op_state = A_HOST;
+			dwc_otg_enable_global_interrupts(core_if);
+			DWC_SPINUNLOCK(core_if->lock);
+			cil_hcd_start(core_if);
+			dwc_otg_adp_turnon_vbus(core_if);
+			DWC_SPINLOCK(core_if->lock);
+		} else {
+			/*
+			 * Initiate SRP after initial ADP probe.
+			 */
+			dwc_otg_enable_global_interrupts(core_if);
+			dwc_otg_initiate_srp(core_if);
+		}
+	} else if (core_if->adp.probe_counter > 2){
+		gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+		if (compare_timer_values(core_if)) {
+			DWC_PRINTF("Difference in timer values !!! \n");
+//                      core_if->adp.attached = DWC_OTG_ADP_ATTACHED;
+			dwc_otg_adp_probe_stop(core_if);
+
+			/* Power on the core */
+			if (core_if->power_down == 2) {
+				gpwrdn.b.pwrdnswtch = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+			}
+
+			/* check which value is for device mode and which for Host mode */
+			if (!temp.b.idsts) {	/* considered host mode value is 0 */
+				/* Disable Interrupt from Power Down Logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pmuintsel = 1;
+				gpwrdn.b.pmuactv = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, gpwrdn.d32, 0);
+
+				/*
+				 * Initialize the Core for Host mode.
+				 */
+				core_if->op_state = A_HOST;
+				dwc_otg_core_init(core_if);
+				dwc_otg_enable_global_interrupts(core_if);
+				cil_hcd_start(core_if);
+			} else {
+				gotgctl_data_t gotgctl;
+				/* Mask SRP detected interrupt from Power Down Logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.srp_det_msk = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, gpwrdn.d32, 0);
+
+				/* Disable Power Down Logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pmuintsel = 1;
+				gpwrdn.b.pmuactv = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, gpwrdn.d32, 0);
+
+				/*
+				 * Initialize the Core for Device mode.
+				 */
+				core_if->op_state = B_PERIPHERAL;
+				dwc_otg_core_init(core_if);
+				dwc_otg_enable_global_interrupts(core_if);
+				cil_pcd_start(core_if);
+
+				gotgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
+				if (!gotgctl.b.bsesvld) {
+					dwc_otg_initiate_srp(core_if);
+				}
+			}
+		}
+		if (core_if->power_down == 2) {
+			if (gpwrdn.b.bsessvld) {
+				/* Mask SRP detected interrupt from Power Down Logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.srp_det_msk = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+				/* Disable Power Down Logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pmuactv = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+				/*
+				 * Initialize the Core for Device mode.
+				 */
+				core_if->op_state = B_PERIPHERAL;
+				dwc_otg_core_init(core_if);
+				dwc_otg_enable_global_interrupts(core_if);
+				cil_pcd_start(core_if);
+			}
+		}
+	}
+exit:
+	/* Clear interrupt */
+	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
+	adpctl.b.adp_prb_int = 1;
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+
+	return 0;
+}
+
+/**
+ * This function hadles ADP Sense Interrupt
+ */
+static int32_t dwc_otg_adp_handle_sns_intr(dwc_otg_core_if_t * core_if)
+{
+	adpctl_data_t adpctl;
+	/* Stop ADP Sense timer */
+	DWC_TIMER_CANCEL(core_if->adp.sense_timer);
+
+	/* Restart ADP Sense timer */
+	dwc_otg_adp_sense_timer_start(core_if);
+
+	/* Clear interrupt */
+	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
+	adpctl.b.adp_sns_int = 1;
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+
+	return 0;
+}
+
+/**
+ * This function handles ADP Probe Interrupts
+ */
+static int32_t dwc_otg_adp_handle_prb_tmout_intr(dwc_otg_core_if_t * core_if,
+						 uint32_t val)
+{
+	adpctl_data_t adpctl = {.d32 = 0 };
+	adpctl.d32 = val;
+	set_timer_value(core_if, adpctl.b.rtim);
+
+	/* Clear interrupt */
+	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
+	adpctl.b.adp_tmout_int = 1;
+	dwc_otg_adp_write_reg(core_if, adpctl.d32);
+
+	return 0;
+}
+
+/**
+ * ADP Interrupt handler.
+ *
+ */
+int32_t dwc_otg_adp_handle_intr(dwc_otg_core_if_t * core_if)
+{
+	int retval = 0;
+	adpctl_data_t adpctl = {.d32 = 0};
+
+	adpctl.d32 = dwc_otg_adp_read_reg(core_if);
+	DWC_PRINTF("ADPCTL = %08x\n",adpctl.d32);
+
+	if (adpctl.b.adp_sns_int & adpctl.b.adp_sns_int_msk) {
+		DWC_PRINTF("ADP Sense interrupt\n");
+		retval |= dwc_otg_adp_handle_sns_intr(core_if);
+	}
+	if (adpctl.b.adp_tmout_int & adpctl.b.adp_tmout_int_msk) {
+		DWC_PRINTF("ADP timeout interrupt\n");
+		retval |= dwc_otg_adp_handle_prb_tmout_intr(core_if, adpctl.d32);
+	}
+	if (adpctl.b.adp_prb_int & adpctl.b.adp_prb_int_msk) {
+		DWC_PRINTF("ADP Probe interrupt\n");
+		adpctl.b.adp_prb_int = 1;
+		retval |= dwc_otg_adp_handle_prb_intr(core_if, adpctl.d32);
+	}
+
+//	dwc_otg_adp_modify_reg(core_if, adpctl.d32, 0);
+	//dwc_otg_adp_write_reg(core_if, adpctl.d32);
+	DWC_PRINTF("RETURN FROM ADP ISR\n");
+
+	return retval;
+}
+
+/**
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+int32_t dwc_otg_adp_handle_srp_intr(dwc_otg_core_if_t * core_if)
+{
+
+#ifndef DWC_HOST_ONLY
+	hprt0_data_t hprt0;
+	gpwrdn_data_t gpwrdn;
+	DWC_DEBUGPL(DBG_ANY, "++ Power Down Logic Session Request Interrupt++\n");
+
+	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+	/* check which value is for device mode and which for Host mode */
+	if (!gpwrdn.b.idsts) {	/* considered host mode value is 0 */
+		DWC_PRINTF("SRP: Host mode\n");
+
+		if (core_if->adp_enable) {
+			dwc_otg_adp_probe_stop(core_if);
+
+			/* Power on the core */
+			if (core_if->power_down == 2) {
+				gpwrdn.b.pwrdnswtch = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+			}
+
+			core_if->op_state = A_HOST;
+			dwc_otg_core_init(core_if);
+			dwc_otg_enable_global_interrupts(core_if);
+			cil_hcd_start(core_if);
+		}
+
+		/* Turn on the port power bit. */
+		hprt0.d32 = dwc_otg_read_hprt0(core_if);
+		hprt0.b.prtpwr = 1;
+		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+
+		/* Start the Connection timer. So a message can be displayed
+		 * if connect does not occur within 10 seconds. */
+		cil_hcd_session_start(core_if);
+	} else {
+		DWC_PRINTF("SRP: Device mode %s\n", __FUNCTION__);
+		if (core_if->adp_enable) {
+			dwc_otg_adp_probe_stop(core_if);
+
+			/* Power on the core */
+			if (core_if->power_down == 2) {
+				gpwrdn.b.pwrdnswtch = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+			}
+
+			gpwrdn.d32 = 0;
+			gpwrdn.b.pmuactv = 0;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0,
+					 gpwrdn.d32);
+
+			core_if->op_state = B_PERIPHERAL;
+			dwc_otg_core_init(core_if);
+			dwc_otg_enable_global_interrupts(core_if);
+			cil_pcd_start(core_if);
+		}
+	}
+#endif
+	return 1;
+}
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_adp.h b/drivers/usb/host/dwc_otg/dwc_otg_adp.h
new file mode 100644
index 000000000000..4110b25d2002
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_adp.h
@@ -0,0 +1,80 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_adp.h $
+ * $Revision: #7 $
+ * $Date: 2011/10/24 $
+ * $Change: 1871159 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+#ifndef __DWC_OTG_ADP_H__
+#define __DWC_OTG_ADP_H__
+
+/**
+ * @file
+ *
+ * This file contains the Attach Detect Protocol interfaces and defines
+ * (functions) and structures for Linux.
+ *
+ */
+
+#define DWC_OTG_ADP_UNATTACHED	0
+#define DWC_OTG_ADP_ATTACHED	1
+#define DWC_OTG_ADP_UNKOWN	2
+
+typedef struct dwc_otg_adp {
+	uint32_t adp_started;
+	uint32_t initial_probe;
+	int32_t probe_timer_values[2];
+	uint32_t probe_enabled;
+	uint32_t sense_enabled;
+	dwc_timer_t *sense_timer;
+	uint32_t sense_timer_started;
+	dwc_timer_t *vbuson_timer;
+	uint32_t vbuson_timer_started;
+	uint32_t attached;
+	uint32_t probe_counter;
+	uint32_t gpwrdn;
+} dwc_otg_adp_t;
+
+/**
+ * Attach Detect Protocol functions
+ */
+
+extern void dwc_otg_adp_write_reg(dwc_otg_core_if_t * core_if, uint32_t value);
+extern uint32_t dwc_otg_adp_read_reg(dwc_otg_core_if_t * core_if);
+extern uint32_t dwc_otg_adp_probe_start(dwc_otg_core_if_t * core_if);
+extern uint32_t dwc_otg_adp_sense_start(dwc_otg_core_if_t * core_if);
+extern uint32_t dwc_otg_adp_probe_stop(dwc_otg_core_if_t * core_if);
+extern uint32_t dwc_otg_adp_sense_stop(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_adp_start(dwc_otg_core_if_t * core_if, uint8_t is_host);
+extern void dwc_otg_adp_init(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_adp_remove(dwc_otg_core_if_t * core_if);
+extern int32_t dwc_otg_adp_handle_intr(dwc_otg_core_if_t * core_if);
+extern int32_t dwc_otg_adp_handle_srp_intr(dwc_otg_core_if_t * core_if);
+
+#endif //__DWC_OTG_ADP_H__
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_attr.c b/drivers/usb/host/dwc_otg/dwc_otg_attr.c
new file mode 100644
index 000000000000..2f8ea77c3892
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_attr.c
@@ -0,0 +1,1212 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_attr.c $
+ * $Revision: #44 $
+ * $Date: 2010/11/29 $
+ * $Change: 1636033 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+/** @file
+ *
+ * The diagnostic interface will provide access to the controller for
+ * bringing up the hardware and testing.  The Linux driver attributes
+ * feature will be used to provide the Linux Diagnostic
+ * Interface. These attributes are accessed through sysfs.
+ */
+
+/** @page "Linux Module Attributes"
+ *
+ * The Linux module attributes feature is used to provide the Linux
+ * Diagnostic Interface.  These attributes are accessed through sysfs.
+ * The diagnostic interface will provide access to the controller for
+ * bringing up the hardware and testing.
+
+ The following table shows the attributes.
+ <table>
+ <tr>
+ <td><b> Name</b></td>
+ <td><b> Description</b></td>
+ <td><b> Access</b></td>
+ </tr>
+
+ <tr>
+ <td> mode </td>
+ <td> Returns the current mode: 0 for device mode, 1 for host mode</td>
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> hnpcapable </td>
+ <td> Gets or sets the "HNP-capable" bit in the Core USB Configuraton Register.
+ Read returns the current value.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> srpcapable </td>
+ <td> Gets or sets the "SRP-capable" bit in the Core USB Configuraton Register.
+ Read returns the current value.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> hsic_connect </td>
+ <td> Gets or sets the "HSIC-Connect" bit in the GLPMCFG Register.
+ Read returns the current value.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> inv_sel_hsic </td>
+ <td> Gets or sets the "Invert Select HSIC" bit in the GLPMFG Register.
+ Read returns the current value.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> hnp </td>
+ <td> Initiates the Host Negotiation Protocol.  Read returns the status.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> srp </td>
+ <td> Initiates the Session Request Protocol.  Read returns the status.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> buspower </td>
+ <td> Gets or sets the Power State of the bus (0 - Off or 1 - On)</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> bussuspend </td>
+ <td> Suspends the USB bus.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> busconnected </td>
+ <td> Gets the connection status of the bus</td>
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> gotgctl </td>
+ <td> Gets or sets the Core Control Status Register.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> gusbcfg </td>
+ <td> Gets or sets the Core USB Configuration Register</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> grxfsiz </td>
+ <td> Gets or sets the Receive FIFO Size Register</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> gnptxfsiz </td>
+ <td> Gets or sets the non-periodic Transmit Size Register</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> gpvndctl </td>
+ <td> Gets or sets the PHY Vendor Control Register</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> ggpio </td>
+ <td> Gets the value in the lower 16-bits of the General Purpose IO Register
+ or sets the upper 16 bits.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> guid </td>
+ <td> Gets or sets the value of the User ID Register</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> gsnpsid </td>
+ <td> Gets the value of the Synopsys ID Regester</td>
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> devspeed </td>
+ <td> Gets or sets the device speed setting in the DCFG register</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> enumspeed </td>
+ <td> Gets the device enumeration Speed.</td>
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> hptxfsiz </td>
+ <td> Gets the value of the Host Periodic Transmit FIFO</td>
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> hprt0 </td>
+ <td> Gets or sets the value in the Host Port Control and Status Register</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> regoffset </td>
+ <td> Sets the register offset for the next Register Access</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> regvalue </td>
+ <td> Gets or sets the value of the register at the offset in the regoffset attribute.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> remote_wakeup </td>
+ <td> On read, shows the status of Remote Wakeup. On write, initiates a remote
+ wakeup of the host. When bit 0 is 1 and Remote Wakeup is enabled, the Remote
+ Wakeup signalling bit in the Device Control Register is set for 1
+ milli-second.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> rem_wakeup_pwrdn </td>
+ <td> On read, shows the status core - hibernated or not. On write, initiates
+ a remote wakeup of the device from Hibernation. </td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> mode_ch_tim_en </td>
+ <td> This bit is used to enable or disable the host core to wait for 200 PHY
+ clock cycles at the end of Resume to change the opmode signal to the PHY to 00
+ after Suspend or LPM. </td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> fr_interval </td>
+ <td> On read, shows the value of HFIR Frame Interval. On write, dynamically
+ reload HFIR register during runtime. The application can write a value to this
+ register only after the Port Enable bit of the Host Port Control and Status
+ register (HPRT.PrtEnaPort) has been set </td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> disconnect_us </td>
+ <td> On read, shows the status of disconnect_device_us. On write, sets disconnect_us
+ which causes soft disconnect for 100us. Applicable only for device mode of operation.</td>
+ <td> Read/Write</td>
+ </tr>
+
+ <tr>
+ <td> regdump </td>
+ <td> Dumps the contents of core registers.</td>
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> spramdump </td>
+ <td> Dumps the contents of core registers.</td>
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> hcddump </td>
+ <td> Dumps the current HCD state.</td>
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> hcd_frrem </td>
+ <td> Shows the average value of the Frame Remaining
+ field in the Host Frame Number/Frame Remaining register when an SOF interrupt
+ occurs. This can be used to determine the average interrupt latency. Also
+ shows the average Frame Remaining value for start_transfer and the "a" and
+ "b" sample points. The "a" and "b" sample points may be used during debugging
+ bto determine how long it takes to execute a section of the HCD code.</td>
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> rd_reg_test </td>
+ <td> Displays the time required to read the GNPTXFSIZ register many times
+ (the output shows the number of times the register is read).
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> wr_reg_test </td>
+ <td> Displays the time required to write the GNPTXFSIZ register many times
+ (the output shows the number of times the register is written).
+ <td> Read</td>
+ </tr>
+
+ <tr>
+ <td> lpm_response </td>
+ <td> Gets or sets lpm_response mode. Applicable only in device mode.
+ <td> Write</td>
+ </tr>
+
+ <tr>
+ <td> sleep_status </td>
+ <td> Shows sleep status of device.
+ <td> Read</td>
+ </tr>
+
+ </table>
+
+ Example usage:
+ To get the current mode:
+ cat /sys/devices/lm0/mode
+
+ To power down the USB:
+ echo 0 > /sys/devices/lm0/buspower
+ */
+
+#include "dwc_otg_os_dep.h"
+#include "dwc_os.h"
+#include "dwc_otg_driver.h"
+#include "dwc_otg_attr.h"
+#include "dwc_otg_core_if.h"
+#include "dwc_otg_pcd_if.h"
+#include "dwc_otg_hcd_if.h"
+
+/*
+ * MACROs for defining sysfs attribute
+ */
+#ifdef LM_INTERFACE
+
+#define DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
+{ \
+	struct lm_device *lm_dev = container_of(_dev, struct lm_device, dev); \
+	dwc_otg_device_t *otg_dev = lm_get_drvdata(lm_dev);		\
+	uint32_t val; \
+	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
+	return sprintf (buf, "%s = 0x%x\n", _string_, val); \
+}
+#define DWC_OTG_DEVICE_ATTR_BITFIELD_STORE(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
+					const char *buf, size_t count) \
+{ \
+	struct lm_device *lm_dev = container_of(_dev, struct lm_device, dev); \
+	dwc_otg_device_t *otg_dev = lm_get_drvdata(lm_dev); \
+	uint32_t set = simple_strtoul(buf, NULL, 16); \
+	dwc_otg_set_##_otg_attr_name_(otg_dev->core_if, set);\
+	return count; \
+}
+
+#elif defined(PCI_INTERFACE)
+
+#define DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
+{ \
+	dwc_otg_device_t *otg_dev = dev_get_drvdata(_dev);	\
+	uint32_t val; \
+	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
+	return sprintf (buf, "%s = 0x%x\n", _string_, val); \
+}
+#define DWC_OTG_DEVICE_ATTR_BITFIELD_STORE(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
+					const char *buf, size_t count) \
+{ \
+	dwc_otg_device_t *otg_dev = dev_get_drvdata(_dev);  \
+	uint32_t set = simple_strtoul(buf, NULL, 16); \
+	dwc_otg_set_##_otg_attr_name_(otg_dev->core_if, set);\
+	return count; \
+}
+
+#elif defined(PLATFORM_INTERFACE)
+
+#define DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
+{ \
+        struct platform_device *platform_dev = \
+                container_of(_dev, struct platform_device, dev); \
+        dwc_otg_device_t *otg_dev = platform_get_drvdata(platform_dev);  \
+	uint32_t val; \
+	DWC_PRINTF("%s(%p) -> platform_dev %p, otg_dev %p\n", \
+                    __func__, _dev, platform_dev, otg_dev); \
+	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
+	return sprintf (buf, "%s = 0x%x\n", _string_, val); \
+}
+#define DWC_OTG_DEVICE_ATTR_BITFIELD_STORE(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
+					const char *buf, size_t count) \
+{ \
+        struct platform_device *platform_dev = container_of(_dev, struct platform_device, dev); \
+        dwc_otg_device_t *otg_dev = platform_get_drvdata(platform_dev); \
+	uint32_t set = simple_strtoul(buf, NULL, 16); \
+	dwc_otg_set_##_otg_attr_name_(otg_dev->core_if, set);\
+	return count; \
+}
+#endif
+
+/*
+ * MACROs for defining sysfs attribute for 32-bit registers
+ */
+#ifdef LM_INTERFACE
+#define DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
+{ \
+	struct lm_device *lm_dev = container_of(_dev, struct lm_device, dev); \
+	dwc_otg_device_t *otg_dev = lm_get_drvdata(lm_dev); \
+	uint32_t val; \
+	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
+	return sprintf (buf, "%s = 0x%08x\n", _string_, val); \
+}
+#define DWC_OTG_DEVICE_ATTR_REG_STORE(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
+					const char *buf, size_t count) \
+{ \
+	struct lm_device *lm_dev = container_of(_dev, struct lm_device, dev); \
+	dwc_otg_device_t *otg_dev = lm_get_drvdata(lm_dev); \
+	uint32_t val = simple_strtoul(buf, NULL, 16); \
+	dwc_otg_set_##_otg_attr_name_ (otg_dev->core_if, val); \
+	return count; \
+}
+#elif defined(PCI_INTERFACE)
+#define DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
+{ \
+	dwc_otg_device_t *otg_dev = dev_get_drvdata(_dev);  \
+	uint32_t val; \
+	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
+	return sprintf (buf, "%s = 0x%08x\n", _string_, val); \
+}
+#define DWC_OTG_DEVICE_ATTR_REG_STORE(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
+					const char *buf, size_t count) \
+{ \
+	dwc_otg_device_t *otg_dev = dev_get_drvdata(_dev);  \
+	uint32_t val = simple_strtoul(buf, NULL, 16); \
+	dwc_otg_set_##_otg_attr_name_ (otg_dev->core_if, val); \
+	return count; \
+}
+
+#elif defined(PLATFORM_INTERFACE)
+#include "dwc_otg_dbg.h"
+#define DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_show (struct device *_dev, struct device_attribute *attr, char *buf) \
+{ \
+	struct platform_device *platform_dev = container_of(_dev, struct platform_device, dev); \
+	dwc_otg_device_t *otg_dev = platform_get_drvdata(platform_dev); \
+	uint32_t val; \
+	DWC_PRINTF("%s(%p) -> platform_dev %p, otg_dev %p\n", \
+                    __func__, _dev, platform_dev, otg_dev); \
+	val = dwc_otg_get_##_otg_attr_name_ (otg_dev->core_if); \
+	return sprintf (buf, "%s = 0x%08x\n", _string_, val); \
+}
+#define DWC_OTG_DEVICE_ATTR_REG_STORE(_otg_attr_name_,_string_) \
+static ssize_t _otg_attr_name_##_store (struct device *_dev, struct device_attribute *attr, \
+					const char *buf, size_t count) \
+{ \
+	struct platform_device *platform_dev = container_of(_dev, struct platform_device, dev); \
+	dwc_otg_device_t *otg_dev = platform_get_drvdata(platform_dev); \
+	uint32_t val = simple_strtoul(buf, NULL, 16); \
+	dwc_otg_set_##_otg_attr_name_ (otg_dev->core_if, val); \
+	return count; \
+}
+
+#endif
+
+#define DWC_OTG_DEVICE_ATTR_BITFIELD_RW(_otg_attr_name_,_string_) \
+DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
+DWC_OTG_DEVICE_ATTR_BITFIELD_STORE(_otg_attr_name_,_string_) \
+DEVICE_ATTR(_otg_attr_name_,0644,_otg_attr_name_##_show,_otg_attr_name_##_store);
+
+#define DWC_OTG_DEVICE_ATTR_BITFIELD_RO(_otg_attr_name_,_string_) \
+DWC_OTG_DEVICE_ATTR_BITFIELD_SHOW(_otg_attr_name_,_string_) \
+DEVICE_ATTR(_otg_attr_name_,0444,_otg_attr_name_##_show,NULL);
+
+#define DWC_OTG_DEVICE_ATTR_REG32_RW(_otg_attr_name_,_addr_,_string_) \
+DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
+DWC_OTG_DEVICE_ATTR_REG_STORE(_otg_attr_name_,_string_) \
+DEVICE_ATTR(_otg_attr_name_,0644,_otg_attr_name_##_show,_otg_attr_name_##_store);
+
+#define DWC_OTG_DEVICE_ATTR_REG32_RO(_otg_attr_name_,_addr_,_string_) \
+DWC_OTG_DEVICE_ATTR_REG_SHOW(_otg_attr_name_,_string_) \
+DEVICE_ATTR(_otg_attr_name_,0444,_otg_attr_name_##_show,NULL);
+
+/** @name Functions for Show/Store of Attributes */
+/**@{*/
+
+/**
+ * Helper function returning the otg_device structure of the given device
+ */
+static dwc_otg_device_t *dwc_otg_drvdev(struct device *_dev)
+{
+        dwc_otg_device_t *otg_dev;
+        DWC_OTG_GETDRVDEV(otg_dev, _dev);
+        return otg_dev;
+}
+
+/**
+ * Show the register offset of the Register Access.
+ */
+static ssize_t regoffset_show(struct device *_dev,
+			      struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	return snprintf(buf, sizeof("0xFFFFFFFF\n") + 1, "0x%08x\n",
+			otg_dev->os_dep.reg_offset);
+}
+
+/**
+ * Set the register offset for the next Register Access 	Read/Write
+ */
+static ssize_t regoffset_store(struct device *_dev,
+			       struct device_attribute *attr,
+			       const char *buf, size_t count)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t offset = simple_strtoul(buf, NULL, 16);
+#if defined(LM_INTERFACE) || defined(PLATFORM_INTERFACE)
+	if (offset < SZ_256K) {
+#elif  defined(PCI_INTERFACE)
+	if (offset < 0x00040000) {
+#endif
+		otg_dev->os_dep.reg_offset = offset;
+	} else {
+		dev_err(_dev, "invalid offset\n");
+	}
+
+	return count;
+}
+
+DEVICE_ATTR(regoffset, S_IRUGO | S_IWUSR, regoffset_show, regoffset_store);
+
+/**
+ * Show the value of the register at the offset in the reg_offset
+ * attribute.
+ */
+static ssize_t regvalue_show(struct device *_dev,
+			     struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t val;
+	volatile uint32_t *addr;
+
+	if (otg_dev->os_dep.reg_offset != 0xFFFFFFFF && 0 != otg_dev->os_dep.base) {
+		/* Calculate the address */
+		addr = (uint32_t *) (otg_dev->os_dep.reg_offset +
+				     (uint8_t *) otg_dev->os_dep.base);
+		val = DWC_READ_REG32(addr);
+		return snprintf(buf,
+				sizeof("Reg@0xFFFFFFFF = 0xFFFFFFFF\n") + 1,
+				"Reg@0x%06x = 0x%08x\n", otg_dev->os_dep.reg_offset,
+				val);
+	} else {
+		dev_err(_dev, "Invalid offset (0x%0x)\n", otg_dev->os_dep.reg_offset);
+		return sprintf(buf, "invalid offset\n");
+	}
+}
+
+/**
+ * Store the value in the register at the offset in the reg_offset
+ * attribute.
+ *
+ */
+static ssize_t regvalue_store(struct device *_dev,
+			      struct device_attribute *attr,
+			      const char *buf, size_t count)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	volatile uint32_t *addr;
+	uint32_t val = simple_strtoul(buf, NULL, 16);
+	//dev_dbg(_dev, "Offset=0x%08x Val=0x%08x\n", otg_dev->reg_offset, val);
+	if (otg_dev->os_dep.reg_offset != 0xFFFFFFFF && 0 != otg_dev->os_dep.base) {
+		/* Calculate the address */
+		addr = (uint32_t *) (otg_dev->os_dep.reg_offset +
+				     (uint8_t *) otg_dev->os_dep.base);
+		DWC_WRITE_REG32(addr, val);
+	} else {
+		dev_err(_dev, "Invalid Register Offset (0x%08x)\n",
+			otg_dev->os_dep.reg_offset);
+	}
+	return count;
+}
+
+DEVICE_ATTR(regvalue, S_IRUGO | S_IWUSR, regvalue_show, regvalue_store);
+
+/*
+ * Attributes
+ */
+DWC_OTG_DEVICE_ATTR_BITFIELD_RO(mode, "Mode");
+DWC_OTG_DEVICE_ATTR_BITFIELD_RW(hnpcapable, "HNPCapable");
+DWC_OTG_DEVICE_ATTR_BITFIELD_RW(srpcapable, "SRPCapable");
+DWC_OTG_DEVICE_ATTR_BITFIELD_RW(hsic_connect, "HSIC Connect");
+DWC_OTG_DEVICE_ATTR_BITFIELD_RW(inv_sel_hsic, "Invert Select HSIC");
+
+//DWC_OTG_DEVICE_ATTR_BITFIELD_RW(buspower,&(otg_dev->core_if->core_global_regs->gotgctl),(1<<8),8,"Mode");
+//DWC_OTG_DEVICE_ATTR_BITFIELD_RW(bussuspend,&(otg_dev->core_if->core_global_regs->gotgctl),(1<<8),8,"Mode");
+DWC_OTG_DEVICE_ATTR_BITFIELD_RO(busconnected, "Bus Connected");
+
+DWC_OTG_DEVICE_ATTR_REG32_RW(gotgctl, 0, "GOTGCTL");
+DWC_OTG_DEVICE_ATTR_REG32_RW(gusbcfg,
+			     &(otg_dev->core_if->core_global_regs->gusbcfg),
+			     "GUSBCFG");
+DWC_OTG_DEVICE_ATTR_REG32_RW(grxfsiz,
+			     &(otg_dev->core_if->core_global_regs->grxfsiz),
+			     "GRXFSIZ");
+DWC_OTG_DEVICE_ATTR_REG32_RW(gnptxfsiz,
+			     &(otg_dev->core_if->core_global_regs->gnptxfsiz),
+			     "GNPTXFSIZ");
+DWC_OTG_DEVICE_ATTR_REG32_RW(gpvndctl,
+			     &(otg_dev->core_if->core_global_regs->gpvndctl),
+			     "GPVNDCTL");
+DWC_OTG_DEVICE_ATTR_REG32_RW(ggpio,
+			     &(otg_dev->core_if->core_global_regs->ggpio),
+			     "GGPIO");
+DWC_OTG_DEVICE_ATTR_REG32_RW(guid, &(otg_dev->core_if->core_global_regs->guid),
+			     "GUID");
+DWC_OTG_DEVICE_ATTR_REG32_RO(gsnpsid,
+			     &(otg_dev->core_if->core_global_regs->gsnpsid),
+			     "GSNPSID");
+DWC_OTG_DEVICE_ATTR_BITFIELD_RW(devspeed, "Device Speed");
+DWC_OTG_DEVICE_ATTR_BITFIELD_RO(enumspeed, "Device Enumeration Speed");
+
+DWC_OTG_DEVICE_ATTR_REG32_RO(hptxfsiz,
+			     &(otg_dev->core_if->core_global_regs->hptxfsiz),
+			     "HPTXFSIZ");
+DWC_OTG_DEVICE_ATTR_REG32_RW(hprt0, otg_dev->core_if->host_if->hprt0, "HPRT0");
+
+/**
+ * @todo Add code to initiate the HNP.
+ */
+/**
+ * Show the HNP status bit
+ */
+static ssize_t hnp_show(struct device *_dev,
+			struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	return sprintf(buf, "HstNegScs = 0x%x\n",
+		       dwc_otg_get_hnpstatus(otg_dev->core_if));
+}
+
+/**
+ * Set the HNP Request bit
+ */
+static ssize_t hnp_store(struct device *_dev,
+			 struct device_attribute *attr,
+			 const char *buf, size_t count)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t in = simple_strtoul(buf, NULL, 16);
+	dwc_otg_set_hnpreq(otg_dev->core_if, in);
+	return count;
+}
+
+DEVICE_ATTR(hnp, 0644, hnp_show, hnp_store);
+
+/**
+ * @todo Add code to initiate the SRP.
+ */
+/**
+ * Show the SRP status bit
+ */
+static ssize_t srp_show(struct device *_dev,
+			struct device_attribute *attr, char *buf)
+{
+#ifndef DWC_HOST_ONLY
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	return sprintf(buf, "SesReqScs = 0x%x\n",
+		       dwc_otg_get_srpstatus(otg_dev->core_if));
+#else
+	return sprintf(buf, "Host Only Mode!\n");
+#endif
+}
+
+/**
+ * Set the SRP Request bit
+ */
+static ssize_t srp_store(struct device *_dev,
+			 struct device_attribute *attr,
+			 const char *buf, size_t count)
+{
+#ifndef DWC_HOST_ONLY
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	dwc_otg_pcd_initiate_srp(otg_dev->pcd);
+#endif
+	return count;
+}
+
+DEVICE_ATTR(srp, 0644, srp_show, srp_store);
+
+/**
+ * @todo Need to do more for power on/off?
+ */
+/**
+ * Show the Bus Power status
+ */
+static ssize_t buspower_show(struct device *_dev,
+			     struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	return sprintf(buf, "Bus Power = 0x%x\n",
+		       dwc_otg_get_prtpower(otg_dev->core_if));
+}
+
+/**
+ * Set the Bus Power status
+ */
+static ssize_t buspower_store(struct device *_dev,
+			      struct device_attribute *attr,
+			      const char *buf, size_t count)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t on = simple_strtoul(buf, NULL, 16);
+	dwc_otg_set_prtpower(otg_dev->core_if, on);
+	return count;
+}
+
+DEVICE_ATTR(buspower, 0644, buspower_show, buspower_store);
+
+/**
+ * @todo Need to do more for suspend?
+ */
+/**
+ * Show the Bus Suspend status
+ */
+static ssize_t bussuspend_show(struct device *_dev,
+			       struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	return sprintf(buf, "Bus Suspend = 0x%x\n",
+		       dwc_otg_get_prtsuspend(otg_dev->core_if));
+}
+
+/**
+ * Set the Bus Suspend status
+ */
+static ssize_t bussuspend_store(struct device *_dev,
+				struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t in = simple_strtoul(buf, NULL, 16);
+	dwc_otg_set_prtsuspend(otg_dev->core_if, in);
+	return count;
+}
+
+DEVICE_ATTR(bussuspend, 0644, bussuspend_show, bussuspend_store);
+
+/**
+ * Show the Mode Change Ready Timer status
+ */
+static ssize_t mode_ch_tim_en_show(struct device *_dev,
+				   struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	return sprintf(buf, "Mode Change Ready Timer Enable = 0x%x\n",
+		       dwc_otg_get_mode_ch_tim(otg_dev->core_if));
+}
+
+/**
+ * Set the Mode Change Ready Timer status
+ */
+static ssize_t mode_ch_tim_en_store(struct device *_dev,
+				    struct device_attribute *attr,
+				    const char *buf, size_t count)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t in = simple_strtoul(buf, NULL, 16);
+	dwc_otg_set_mode_ch_tim(otg_dev->core_if, in);
+	return count;
+}
+
+DEVICE_ATTR(mode_ch_tim_en, 0644, mode_ch_tim_en_show, mode_ch_tim_en_store);
+
+/**
+ * Show the value of HFIR Frame Interval bitfield
+ */
+static ssize_t fr_interval_show(struct device *_dev,
+				struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	return sprintf(buf, "Frame Interval = 0x%x\n",
+		       dwc_otg_get_fr_interval(otg_dev->core_if));
+}
+
+/**
+ * Set the HFIR Frame Interval value
+ */
+static ssize_t fr_interval_store(struct device *_dev,
+				 struct device_attribute *attr,
+				 const char *buf, size_t count)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t in = simple_strtoul(buf, NULL, 10);
+	dwc_otg_set_fr_interval(otg_dev->core_if, in);
+	return count;
+}
+
+DEVICE_ATTR(fr_interval, 0644, fr_interval_show, fr_interval_store);
+
+/**
+ * Show the status of Remote Wakeup.
+ */
+static ssize_t remote_wakeup_show(struct device *_dev,
+				  struct device_attribute *attr, char *buf)
+{
+#ifndef DWC_HOST_ONLY
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+
+	return sprintf(buf,
+		       "Remote Wakeup Sig = %d Enabled = %d LPM Remote Wakeup = %d\n",
+		       dwc_otg_get_remotewakesig(otg_dev->core_if),
+		       dwc_otg_pcd_get_rmwkup_enable(otg_dev->pcd),
+		       dwc_otg_get_lpm_remotewakeenabled(otg_dev->core_if));
+#else
+	return sprintf(buf, "Host Only Mode!\n");
+#endif /* DWC_HOST_ONLY */
+}
+
+/**
+ * Initiate a remote wakeup of the host.  The Device control register
+ * Remote Wakeup Signal bit is written if the PCD Remote wakeup enable
+ * flag is set.
+ *
+ */
+static ssize_t remote_wakeup_store(struct device *_dev,
+				   struct device_attribute *attr,
+				   const char *buf, size_t count)
+{
+#ifndef DWC_HOST_ONLY
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t val = simple_strtoul(buf, NULL, 16);
+
+	if (val & 1) {
+		dwc_otg_pcd_remote_wakeup(otg_dev->pcd, 1);
+	} else {
+		dwc_otg_pcd_remote_wakeup(otg_dev->pcd, 0);
+	}
+#endif /* DWC_HOST_ONLY */
+	return count;
+}
+
+DEVICE_ATTR(remote_wakeup, S_IRUGO | S_IWUSR, remote_wakeup_show,
+	    remote_wakeup_store);
+
+/**
+ * Show the whether core is hibernated or not.
+ */
+static ssize_t rem_wakeup_pwrdn_show(struct device *_dev,
+				     struct device_attribute *attr, char *buf)
+{
+#ifndef DWC_HOST_ONLY
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+
+	if (dwc_otg_get_core_state(otg_dev->core_if)) {
+		DWC_PRINTF("Core is in hibernation\n");
+	} else {
+		DWC_PRINTF("Core is not in hibernation\n");
+	}
+#endif /* DWC_HOST_ONLY */
+	return 0;
+}
+
+extern int dwc_otg_device_hibernation_restore(dwc_otg_core_if_t * core_if,
+					      int rem_wakeup, int reset);
+
+/**
+ * Initiate a remote wakeup of the device to exit from hibernation.
+ */
+static ssize_t rem_wakeup_pwrdn_store(struct device *_dev,
+				      struct device_attribute *attr,
+				      const char *buf, size_t count)
+{
+#ifndef DWC_HOST_ONLY
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	dwc_otg_device_hibernation_restore(otg_dev->core_if, 1, 0);
+#endif
+	return count;
+}
+
+DEVICE_ATTR(rem_wakeup_pwrdn, S_IRUGO | S_IWUSR, rem_wakeup_pwrdn_show,
+	    rem_wakeup_pwrdn_store);
+
+static ssize_t disconnect_us(struct device *_dev,
+			     struct device_attribute *attr,
+			     const char *buf, size_t count)
+{
+
+#ifndef DWC_HOST_ONLY
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t val = simple_strtoul(buf, NULL, 16);
+	DWC_PRINTF("The Passed value is %04x\n", val);
+
+	dwc_otg_pcd_disconnect_us(otg_dev->pcd, 50);
+
+#endif /* DWC_HOST_ONLY */
+	return count;
+}
+
+DEVICE_ATTR(disconnect_us, S_IWUSR, 0, disconnect_us);
+
+/**
+ * Dump global registers and either host or device registers (depending on the
+ * current mode of the core).
+ */
+static ssize_t regdump_show(struct device *_dev,
+			    struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+
+	dwc_otg_dump_global_registers(otg_dev->core_if);
+	if (dwc_otg_is_host_mode(otg_dev->core_if)) {
+		dwc_otg_dump_host_registers(otg_dev->core_if);
+	} else {
+		dwc_otg_dump_dev_registers(otg_dev->core_if);
+
+	}
+	return sprintf(buf, "Register Dump\n");
+}
+
+DEVICE_ATTR(regdump, S_IRUGO, regdump_show, 0);
+
+/**
+ * Dump global registers and either host or device registers (depending on the
+ * current mode of the core).
+ */
+static ssize_t spramdump_show(struct device *_dev,
+			      struct device_attribute *attr, char *buf)
+{
+#if 0
+	dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+
+	dwc_otg_dump_spram(otg_dev->core_if);
+#endif
+
+	return sprintf(buf, "SPRAM Dump\n");
+}
+
+DEVICE_ATTR(spramdump, S_IRUGO, spramdump_show, 0);
+
+/**
+ * Dump the current hcd state.
+ */
+static ssize_t hcddump_show(struct device *_dev,
+			    struct device_attribute *attr, char *buf)
+{
+#ifndef DWC_DEVICE_ONLY
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	dwc_otg_hcd_dump_state(otg_dev->hcd);
+#endif /* DWC_DEVICE_ONLY */
+	return sprintf(buf, "HCD Dump\n");
+}
+
+DEVICE_ATTR(hcddump, S_IRUGO, hcddump_show, 0);
+
+/**
+ * Dump the average frame remaining at SOF. This can be used to
+ * determine average interrupt latency. Frame remaining is also shown for
+ * start transfer and two additional sample points.
+ */
+static ssize_t hcd_frrem_show(struct device *_dev,
+			      struct device_attribute *attr, char *buf)
+{
+#ifndef DWC_DEVICE_ONLY
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+
+	dwc_otg_hcd_dump_frrem(otg_dev->hcd);
+#endif /* DWC_DEVICE_ONLY */
+	return sprintf(buf, "HCD Dump Frame Remaining\n");
+}
+
+DEVICE_ATTR(hcd_frrem, S_IRUGO, hcd_frrem_show, 0);
+
+/**
+ * Displays the time required to read the GNPTXFSIZ register many times (the
+ * output shows the number of times the register is read).
+ */
+#define RW_REG_COUNT 10000000
+#define MSEC_PER_JIFFIE 1000/HZ
+static ssize_t rd_reg_test_show(struct device *_dev,
+				struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	int i;
+	int time;
+	int start_jiffies;
+
+	printk("HZ %d, MSEC_PER_JIFFIE %d, loops_per_jiffy %lu\n",
+	       HZ, MSEC_PER_JIFFIE, loops_per_jiffy);
+	start_jiffies = jiffies;
+	for (i = 0; i < RW_REG_COUNT; i++) {
+		dwc_otg_get_gnptxfsiz(otg_dev->core_if);
+	}
+	time = jiffies - start_jiffies;
+	return sprintf(buf,
+		       "Time to read GNPTXFSIZ reg %d times: %d msecs (%d jiffies)\n",
+		       RW_REG_COUNT, time * MSEC_PER_JIFFIE, time);
+}
+
+DEVICE_ATTR(rd_reg_test, S_IRUGO, rd_reg_test_show, 0);
+
+/**
+ * Displays the time required to write the GNPTXFSIZ register many times (the
+ * output shows the number of times the register is written).
+ */
+static ssize_t wr_reg_test_show(struct device *_dev,
+				struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t reg_val;
+	int i;
+	int time;
+	int start_jiffies;
+
+	printk("HZ %d, MSEC_PER_JIFFIE %d, loops_per_jiffy %lu\n",
+	       HZ, MSEC_PER_JIFFIE, loops_per_jiffy);
+	reg_val = dwc_otg_get_gnptxfsiz(otg_dev->core_if);
+	start_jiffies = jiffies;
+	for (i = 0; i < RW_REG_COUNT; i++) {
+		dwc_otg_set_gnptxfsiz(otg_dev->core_if, reg_val);
+	}
+	time = jiffies - start_jiffies;
+	return sprintf(buf,
+		       "Time to write GNPTXFSIZ reg %d times: %d msecs (%d jiffies)\n",
+		       RW_REG_COUNT, time * MSEC_PER_JIFFIE, time);
+}
+
+DEVICE_ATTR(wr_reg_test, S_IRUGO, wr_reg_test_show, 0);
+
+#ifdef CONFIG_USB_DWC_OTG_LPM
+
+/**
+* Show the lpm_response attribute.
+*/
+static ssize_t lpmresp_show(struct device *_dev,
+			    struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+
+	if (!dwc_otg_get_param_lpm_enable(otg_dev->core_if))
+		return sprintf(buf, "** LPM is DISABLED **\n");
+
+	if (!dwc_otg_is_device_mode(otg_dev->core_if)) {
+		return sprintf(buf, "** Current mode is not device mode\n");
+	}
+	return sprintf(buf, "lpm_response = %d\n",
+		       dwc_otg_get_lpmresponse(otg_dev->core_if));
+}
+
+/**
+* Store the lpm_response attribute.
+*/
+static ssize_t lpmresp_store(struct device *_dev,
+			     struct device_attribute *attr,
+			     const char *buf, size_t count)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	uint32_t val = simple_strtoul(buf, NULL, 16);
+
+	if (!dwc_otg_get_param_lpm_enable(otg_dev->core_if)) {
+		return 0;
+	}
+
+	if (!dwc_otg_is_device_mode(otg_dev->core_if)) {
+		return 0;
+	}
+
+	dwc_otg_set_lpmresponse(otg_dev->core_if, val);
+	return count;
+}
+
+DEVICE_ATTR(lpm_response, S_IRUGO | S_IWUSR, lpmresp_show, lpmresp_store);
+
+/**
+* Show the sleep_status attribute.
+*/
+static ssize_t sleepstatus_show(struct device *_dev,
+				struct device_attribute *attr, char *buf)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	return sprintf(buf, "Sleep Status = %d\n",
+		       dwc_otg_get_lpm_portsleepstatus(otg_dev->core_if));
+}
+
+/**
+ * Store the sleep_status attribure.
+ */
+static ssize_t sleepstatus_store(struct device *_dev,
+				 struct device_attribute *attr,
+				 const char *buf, size_t count)
+{
+        dwc_otg_device_t *otg_dev = dwc_otg_drvdev(_dev);
+	dwc_otg_core_if_t *core_if = otg_dev->core_if;
+
+	if (dwc_otg_get_lpm_portsleepstatus(otg_dev->core_if)) {
+		if (dwc_otg_is_host_mode(core_if)) {
+
+			DWC_PRINTF("Host initiated resume\n");
+			dwc_otg_set_prtresume(otg_dev->core_if, 1);
+		}
+	}
+
+	return count;
+}
+
+DEVICE_ATTR(sleep_status, S_IRUGO | S_IWUSR, sleepstatus_show,
+	    sleepstatus_store);
+
+#endif /* CONFIG_USB_DWC_OTG_LPM_ENABLE */
+
+/**@}*/
+
+/**
+ * Create the device files
+ */
+void dwc_otg_attr_create(
+#ifdef LM_INTERFACE
+	struct lm_device *dev
+#elif  defined(PCI_INTERFACE)
+	struct pci_dev *dev
+#elif  defined(PLATFORM_INTERFACE)
+        struct platform_device *dev
+#endif
+    )
+{
+	int error;
+
+	error = device_create_file(&dev->dev, &dev_attr_regoffset);
+	error = device_create_file(&dev->dev, &dev_attr_regvalue);
+	error = device_create_file(&dev->dev, &dev_attr_mode);
+	error = device_create_file(&dev->dev, &dev_attr_hnpcapable);
+	error = device_create_file(&dev->dev, &dev_attr_srpcapable);
+	error = device_create_file(&dev->dev, &dev_attr_hsic_connect);
+	error = device_create_file(&dev->dev, &dev_attr_inv_sel_hsic);
+	error = device_create_file(&dev->dev, &dev_attr_hnp);
+	error = device_create_file(&dev->dev, &dev_attr_srp);
+	error = device_create_file(&dev->dev, &dev_attr_buspower);
+	error = device_create_file(&dev->dev, &dev_attr_bussuspend);
+	error = device_create_file(&dev->dev, &dev_attr_mode_ch_tim_en);
+	error = device_create_file(&dev->dev, &dev_attr_fr_interval);
+	error = device_create_file(&dev->dev, &dev_attr_busconnected);
+	error = device_create_file(&dev->dev, &dev_attr_gotgctl);
+	error = device_create_file(&dev->dev, &dev_attr_gusbcfg);
+	error = device_create_file(&dev->dev, &dev_attr_grxfsiz);
+	error = device_create_file(&dev->dev, &dev_attr_gnptxfsiz);
+	error = device_create_file(&dev->dev, &dev_attr_gpvndctl);
+	error = device_create_file(&dev->dev, &dev_attr_ggpio);
+	error = device_create_file(&dev->dev, &dev_attr_guid);
+	error = device_create_file(&dev->dev, &dev_attr_gsnpsid);
+	error = device_create_file(&dev->dev, &dev_attr_devspeed);
+	error = device_create_file(&dev->dev, &dev_attr_enumspeed);
+	error = device_create_file(&dev->dev, &dev_attr_hptxfsiz);
+	error = device_create_file(&dev->dev, &dev_attr_hprt0);
+	error = device_create_file(&dev->dev, &dev_attr_remote_wakeup);
+	error = device_create_file(&dev->dev, &dev_attr_rem_wakeup_pwrdn);
+	error = device_create_file(&dev->dev, &dev_attr_disconnect_us);
+	error = device_create_file(&dev->dev, &dev_attr_regdump);
+	error = device_create_file(&dev->dev, &dev_attr_spramdump);
+	error = device_create_file(&dev->dev, &dev_attr_hcddump);
+	error = device_create_file(&dev->dev, &dev_attr_hcd_frrem);
+	error = device_create_file(&dev->dev, &dev_attr_rd_reg_test);
+	error = device_create_file(&dev->dev, &dev_attr_wr_reg_test);
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	error = device_create_file(&dev->dev, &dev_attr_lpm_response);
+	error = device_create_file(&dev->dev, &dev_attr_sleep_status);
+#endif
+}
+
+/**
+ * Remove the device files
+ */
+void dwc_otg_attr_remove(
+#ifdef LM_INTERFACE
+	struct lm_device *dev
+#elif  defined(PCI_INTERFACE)
+	struct pci_dev *dev
+#elif  defined(PLATFORM_INTERFACE)
+	struct platform_device *dev
+#endif
+    )
+{
+	device_remove_file(&dev->dev, &dev_attr_regoffset);
+	device_remove_file(&dev->dev, &dev_attr_regvalue);
+	device_remove_file(&dev->dev, &dev_attr_mode);
+	device_remove_file(&dev->dev, &dev_attr_hnpcapable);
+	device_remove_file(&dev->dev, &dev_attr_srpcapable);
+	device_remove_file(&dev->dev, &dev_attr_hsic_connect);
+	device_remove_file(&dev->dev, &dev_attr_inv_sel_hsic);
+	device_remove_file(&dev->dev, &dev_attr_hnp);
+	device_remove_file(&dev->dev, &dev_attr_srp);
+	device_remove_file(&dev->dev, &dev_attr_buspower);
+	device_remove_file(&dev->dev, &dev_attr_bussuspend);
+	device_remove_file(&dev->dev, &dev_attr_mode_ch_tim_en);
+	device_remove_file(&dev->dev, &dev_attr_fr_interval);
+	device_remove_file(&dev->dev, &dev_attr_busconnected);
+	device_remove_file(&dev->dev, &dev_attr_gotgctl);
+	device_remove_file(&dev->dev, &dev_attr_gusbcfg);
+	device_remove_file(&dev->dev, &dev_attr_grxfsiz);
+	device_remove_file(&dev->dev, &dev_attr_gnptxfsiz);
+	device_remove_file(&dev->dev, &dev_attr_gpvndctl);
+	device_remove_file(&dev->dev, &dev_attr_ggpio);
+	device_remove_file(&dev->dev, &dev_attr_guid);
+	device_remove_file(&dev->dev, &dev_attr_gsnpsid);
+	device_remove_file(&dev->dev, &dev_attr_devspeed);
+	device_remove_file(&dev->dev, &dev_attr_enumspeed);
+	device_remove_file(&dev->dev, &dev_attr_hptxfsiz);
+	device_remove_file(&dev->dev, &dev_attr_hprt0);
+	device_remove_file(&dev->dev, &dev_attr_remote_wakeup);
+	device_remove_file(&dev->dev, &dev_attr_rem_wakeup_pwrdn);
+	device_remove_file(&dev->dev, &dev_attr_disconnect_us);
+	device_remove_file(&dev->dev, &dev_attr_regdump);
+	device_remove_file(&dev->dev, &dev_attr_spramdump);
+	device_remove_file(&dev->dev, &dev_attr_hcddump);
+	device_remove_file(&dev->dev, &dev_attr_hcd_frrem);
+	device_remove_file(&dev->dev, &dev_attr_rd_reg_test);
+	device_remove_file(&dev->dev, &dev_attr_wr_reg_test);
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	device_remove_file(&dev->dev, &dev_attr_lpm_response);
+	device_remove_file(&dev->dev, &dev_attr_sleep_status);
+#endif
+}
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_attr.h b/drivers/usb/host/dwc_otg/dwc_otg_attr.h
new file mode 100644
index 000000000000..e10b67f97c52
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_attr.h
@@ -0,0 +1,89 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_attr.h $
+ * $Revision: #13 $
+ * $Date: 2010/06/21 $
+ * $Change: 1532021 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+#if !defined(__DWC_OTG_ATTR_H__)
+#define __DWC_OTG_ATTR_H__
+
+/** @file
+ * This file contains the interface to the Linux device attributes.
+ */
+extern struct device_attribute dev_attr_regoffset;
+extern struct device_attribute dev_attr_regvalue;
+
+extern struct device_attribute dev_attr_mode;
+extern struct device_attribute dev_attr_hnpcapable;
+extern struct device_attribute dev_attr_srpcapable;
+extern struct device_attribute dev_attr_hnp;
+extern struct device_attribute dev_attr_srp;
+extern struct device_attribute dev_attr_buspower;
+extern struct device_attribute dev_attr_bussuspend;
+extern struct device_attribute dev_attr_mode_ch_tim_en;
+extern struct device_attribute dev_attr_fr_interval;
+extern struct device_attribute dev_attr_busconnected;
+extern struct device_attribute dev_attr_gotgctl;
+extern struct device_attribute dev_attr_gusbcfg;
+extern struct device_attribute dev_attr_grxfsiz;
+extern struct device_attribute dev_attr_gnptxfsiz;
+extern struct device_attribute dev_attr_gpvndctl;
+extern struct device_attribute dev_attr_ggpio;
+extern struct device_attribute dev_attr_guid;
+extern struct device_attribute dev_attr_gsnpsid;
+extern struct device_attribute dev_attr_devspeed;
+extern struct device_attribute dev_attr_enumspeed;
+extern struct device_attribute dev_attr_hptxfsiz;
+extern struct device_attribute dev_attr_hprt0;
+#ifdef CONFIG_USB_DWC_OTG_LPM
+extern struct device_attribute dev_attr_lpm_response;
+extern struct device_attribute devi_attr_sleep_status;
+#endif
+
+void dwc_otg_attr_create(
+#ifdef LM_INTERFACE
+				struct lm_device *dev
+#elif  defined(PCI_INTERFACE)
+				struct pci_dev *dev
+#elif  defined(PLATFORM_INTERFACE)
+	struct platform_device *dev
+#endif
+    );
+
+void dwc_otg_attr_remove(
+#ifdef LM_INTERFACE
+				struct lm_device *dev
+#elif  defined(PCI_INTERFACE)
+				struct pci_dev *dev
+#elif  defined(PLATFORM_INTERFACE)
+	struct platform_device *dev
+#endif
+    );
+#endif
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_cfi.c b/drivers/usb/host/dwc_otg/dwc_otg_cfi.c
new file mode 100644
index 000000000000..bbb3d32093d0
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_cfi.c
@@ -0,0 +1,1876 @@
+/* ==========================================================================
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+/** @file
+ *
+ * This file contains the most of the CFI(Core Feature Interface)
+ * implementation for the OTG.
+ */
+
+#ifdef DWC_UTE_CFI
+
+#include "dwc_otg_pcd.h"
+#include "dwc_otg_cfi.h"
+
+/** This definition should actually migrate to the Portability Library */
+#define DWC_CONSTANT_CPU_TO_LE16(x) (x)
+
+extern dwc_otg_pcd_ep_t *get_ep_by_addr(dwc_otg_pcd_t * pcd, u16 wIndex);
+
+static int cfi_core_features_buf(uint8_t * buf, uint16_t buflen);
+static int cfi_get_feature_value(uint8_t * buf, uint16_t buflen,
+				 struct dwc_otg_pcd *pcd,
+				 struct cfi_usb_ctrlrequest *ctrl_req);
+static int cfi_set_feature_value(struct dwc_otg_pcd *pcd);
+static int cfi_ep_get_sg_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
+			     struct cfi_usb_ctrlrequest *req);
+static int cfi_ep_get_concat_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
+				 struct cfi_usb_ctrlrequest *req);
+static int cfi_ep_get_align_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
+				struct cfi_usb_ctrlrequest *req);
+static int cfi_preproc_reset(struct dwc_otg_pcd *pcd,
+			     struct cfi_usb_ctrlrequest *req);
+static void cfi_free_ep_bs_dyn_data(cfi_ep_t * cfiep);
+
+static uint16_t get_dfifo_size(dwc_otg_core_if_t * core_if);
+static int32_t get_rxfifo_size(dwc_otg_core_if_t * core_if, uint16_t wValue);
+static int32_t get_txfifo_size(struct dwc_otg_pcd *pcd, uint16_t wValue);
+
+static uint8_t resize_fifos(dwc_otg_core_if_t * core_if);
+
+/** This is the header of the all features descriptor */
+static cfi_all_features_header_t all_props_desc_header = {
+	.wVersion = DWC_CONSTANT_CPU_TO_LE16(0x100),
+	.wCoreID = DWC_CONSTANT_CPU_TO_LE16(CFI_CORE_ID_OTG),
+	.wNumFeatures = DWC_CONSTANT_CPU_TO_LE16(9),
+};
+
+/** This is an array of statically allocated feature descriptors */
+static cfi_feature_desc_header_t prop_descs[] = {
+
+	/* FT_ID_DMA_MODE */
+	{
+	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_MODE),
+	 .bmAttributes = CFI_FEATURE_ATTR_RW,
+	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(1),
+	 },
+
+	/* FT_ID_DMA_BUFFER_SETUP */
+	{
+	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_BUFFER_SETUP),
+	 .bmAttributes = CFI_FEATURE_ATTR_RW,
+	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(6),
+	 },
+
+	/* FT_ID_DMA_BUFF_ALIGN */
+	{
+	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_BUFF_ALIGN),
+	 .bmAttributes = CFI_FEATURE_ATTR_RW,
+	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(2),
+	 },
+
+	/* FT_ID_DMA_CONCAT_SETUP */
+	{
+	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_CONCAT_SETUP),
+	 .bmAttributes = CFI_FEATURE_ATTR_RW,
+	 //.wDataLength  = DWC_CONSTANT_CPU_TO_LE16(6),
+	 },
+
+	/* FT_ID_DMA_CIRCULAR */
+	{
+	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DMA_CIRCULAR),
+	 .bmAttributes = CFI_FEATURE_ATTR_RW,
+	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(6),
+	 },
+
+	/* FT_ID_THRESHOLD_SETUP */
+	{
+	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_THRESHOLD_SETUP),
+	 .bmAttributes = CFI_FEATURE_ATTR_RW,
+	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(6),
+	 },
+
+	/* FT_ID_DFIFO_DEPTH */
+	{
+	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_DFIFO_DEPTH),
+	 .bmAttributes = CFI_FEATURE_ATTR_RO,
+	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(2),
+	 },
+
+	/* FT_ID_TX_FIFO_DEPTH */
+	{
+	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_TX_FIFO_DEPTH),
+	 .bmAttributes = CFI_FEATURE_ATTR_RW,
+	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(2),
+	 },
+
+	/* FT_ID_RX_FIFO_DEPTH */
+	{
+	 .wFeatureID = DWC_CONSTANT_CPU_TO_LE16(FT_ID_RX_FIFO_DEPTH),
+	 .bmAttributes = CFI_FEATURE_ATTR_RW,
+	 .wDataLength = DWC_CONSTANT_CPU_TO_LE16(2),
+	 }
+};
+
+/** The table of feature names */
+cfi_string_t prop_name_table[] = {
+	{FT_ID_DMA_MODE, "dma_mode"},
+	{FT_ID_DMA_BUFFER_SETUP, "buffer_setup"},
+	{FT_ID_DMA_BUFF_ALIGN, "buffer_align"},
+	{FT_ID_DMA_CONCAT_SETUP, "concat_setup"},
+	{FT_ID_DMA_CIRCULAR, "buffer_circular"},
+	{FT_ID_THRESHOLD_SETUP, "threshold_setup"},
+	{FT_ID_DFIFO_DEPTH, "dfifo_depth"},
+	{FT_ID_TX_FIFO_DEPTH, "txfifo_depth"},
+	{FT_ID_RX_FIFO_DEPTH, "rxfifo_depth"},
+	{}
+};
+
+/************************************************************************/
+
+/**
+ * Returns the name of the feature by its ID
+ * or NULL if no featute ID matches.
+ *
+ */
+const uint8_t *get_prop_name(uint16_t prop_id, int *len)
+{
+	cfi_string_t *pstr;
+	*len = 0;
+
+	for (pstr = prop_name_table; pstr && pstr->s; pstr++) {
+		if (pstr->id == prop_id) {
+			*len = DWC_STRLEN(pstr->s);
+			return pstr->s;
+		}
+	}
+	return NULL;
+}
+
+/**
+ * This function handles all CFI specific control requests.
+ *
+ * Return a negative value to stall the DCE.
+ */
+int cfi_setup(struct dwc_otg_pcd *pcd, struct cfi_usb_ctrlrequest *ctrl)
+{
+	int retval = 0;
+	dwc_otg_pcd_ep_t *ep = NULL;
+	cfiobject_t *cfi = pcd->cfi;
+	struct dwc_otg_core_if *coreif = GET_CORE_IF(pcd);
+	uint16_t wLen = DWC_LE16_TO_CPU(&ctrl->wLength);
+	uint16_t wValue = DWC_LE16_TO_CPU(&ctrl->wValue);
+	uint16_t wIndex = DWC_LE16_TO_CPU(&ctrl->wIndex);
+	uint32_t regaddr = 0;
+	uint32_t regval = 0;
+
+	/* Save this Control Request in the CFI object.
+	 * The data field will be assigned in the data stage completion CB function.
+	 */
+	cfi->ctrl_req = *ctrl;
+	cfi->ctrl_req.data = NULL;
+
+	cfi->need_gadget_att = 0;
+	cfi->need_status_in_complete = 0;
+
+	switch (ctrl->bRequest) {
+	case VEN_CORE_GET_FEATURES:
+		retval = cfi_core_features_buf(cfi->buf_in.buf, CFI_IN_BUF_LEN);
+		if (retval >= 0) {
+			//dump_msg(cfi->buf_in.buf, retval);
+			ep = &pcd->ep0;
+
+			retval = min((uint16_t) retval, wLen);
+			/* Transfer this buffer to the host through the EP0-IN EP */
+			ep->dwc_ep.dma_addr = cfi->buf_in.addr;
+			ep->dwc_ep.start_xfer_buff = cfi->buf_in.buf;
+			ep->dwc_ep.xfer_buff = cfi->buf_in.buf;
+			ep->dwc_ep.xfer_len = retval;
+			ep->dwc_ep.xfer_count = 0;
+			ep->dwc_ep.sent_zlp = 0;
+			ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
+
+			pcd->ep0_pending = 1;
+			dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
+		}
+		retval = 0;
+		break;
+
+	case VEN_CORE_GET_FEATURE:
+		CFI_INFO("VEN_CORE_GET_FEATURE\n");
+		retval = cfi_get_feature_value(cfi->buf_in.buf, CFI_IN_BUF_LEN,
+					       pcd, ctrl);
+		if (retval >= 0) {
+			ep = &pcd->ep0;
+
+			retval = min((uint16_t) retval, wLen);
+			/* Transfer this buffer to the host through the EP0-IN EP */
+			ep->dwc_ep.dma_addr = cfi->buf_in.addr;
+			ep->dwc_ep.start_xfer_buff = cfi->buf_in.buf;
+			ep->dwc_ep.xfer_buff = cfi->buf_in.buf;
+			ep->dwc_ep.xfer_len = retval;
+			ep->dwc_ep.xfer_count = 0;
+			ep->dwc_ep.sent_zlp = 0;
+			ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
+
+			pcd->ep0_pending = 1;
+			dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
+		}
+		CFI_INFO("VEN_CORE_GET_FEATURE=%d\n", retval);
+		dump_msg(cfi->buf_in.buf, retval);
+		break;
+
+	case VEN_CORE_SET_FEATURE:
+		CFI_INFO("VEN_CORE_SET_FEATURE\n");
+		/* Set up an XFER to get the data stage of the control request,
+		 * which is the new value of the feature to be modified.
+		 */
+		ep = &pcd->ep0;
+		ep->dwc_ep.is_in = 0;
+		ep->dwc_ep.dma_addr = cfi->buf_out.addr;
+		ep->dwc_ep.start_xfer_buff = cfi->buf_out.buf;
+		ep->dwc_ep.xfer_buff = cfi->buf_out.buf;
+		ep->dwc_ep.xfer_len = wLen;
+		ep->dwc_ep.xfer_count = 0;
+		ep->dwc_ep.sent_zlp = 0;
+		ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
+
+		pcd->ep0_pending = 1;
+		/* Read the control write's data stage */
+		dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
+		retval = 0;
+		break;
+
+	case VEN_CORE_RESET_FEATURES:
+		CFI_INFO("VEN_CORE_RESET_FEATURES\n");
+		cfi->need_gadget_att = 1;
+		cfi->need_status_in_complete = 1;
+		retval = cfi_preproc_reset(pcd, ctrl);
+		CFI_INFO("VEN_CORE_RESET_FEATURES = (%d)\n", retval);
+		break;
+
+	case VEN_CORE_ACTIVATE_FEATURES:
+		CFI_INFO("VEN_CORE_ACTIVATE_FEATURES\n");
+		break;
+
+	case VEN_CORE_READ_REGISTER:
+		CFI_INFO("VEN_CORE_READ_REGISTER\n");
+		/* wValue optionally contains the HI WORD of the register offset and
+		 * wIndex contains the LOW WORD of the register offset
+		 */
+		if (wValue == 0) {
+			/* @TODO - MAS - fix the access to the base field */
+			regaddr = 0;
+			//regaddr = (uint32_t) pcd->otg_dev->os_dep.base;
+			//GET_CORE_IF(pcd)->co
+			regaddr |= wIndex;
+		} else {
+			regaddr = (wValue << 16) | wIndex;
+		}
+
+		/* Read a 32-bit value of the memory at the regaddr */
+		regval = DWC_READ_REG32((uint32_t *) regaddr);
+
+		ep = &pcd->ep0;
+		dwc_memcpy(cfi->buf_in.buf, &regval, sizeof(uint32_t));
+		ep->dwc_ep.is_in = 1;
+		ep->dwc_ep.dma_addr = cfi->buf_in.addr;
+		ep->dwc_ep.start_xfer_buff = cfi->buf_in.buf;
+		ep->dwc_ep.xfer_buff = cfi->buf_in.buf;
+		ep->dwc_ep.xfer_len = wLen;
+		ep->dwc_ep.xfer_count = 0;
+		ep->dwc_ep.sent_zlp = 0;
+		ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
+
+		pcd->ep0_pending = 1;
+		dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
+		cfi->need_gadget_att = 0;
+		retval = 0;
+		break;
+
+	case VEN_CORE_WRITE_REGISTER:
+		CFI_INFO("VEN_CORE_WRITE_REGISTER\n");
+		/* Set up an XFER to get the data stage of the control request,
+		 * which is the new value of the register to be modified.
+		 */
+		ep = &pcd->ep0;
+		ep->dwc_ep.is_in = 0;
+		ep->dwc_ep.dma_addr = cfi->buf_out.addr;
+		ep->dwc_ep.start_xfer_buff = cfi->buf_out.buf;
+		ep->dwc_ep.xfer_buff = cfi->buf_out.buf;
+		ep->dwc_ep.xfer_len = wLen;
+		ep->dwc_ep.xfer_count = 0;
+		ep->dwc_ep.sent_zlp = 0;
+		ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
+
+		pcd->ep0_pending = 1;
+		/* Read the control write's data stage */
+		dwc_otg_ep0_start_transfer(coreif, &ep->dwc_ep);
+		retval = 0;
+		break;
+
+	default:
+		retval = -DWC_E_NOT_SUPPORTED;
+		break;
+	}
+
+	return retval;
+}
+
+/**
+ * This function prepares the core features descriptors and copies its
+ * raw representation into the buffer <buf>.
+ *
+ * The buffer structure is as follows:
+ *	all_features_header (8 bytes)
+ *	features_#1 (8 bytes + feature name string length)
+ *	features_#2 (8 bytes + feature name string length)
+ *	.....
+ *	features_#n - where n=the total count of feature descriptors
+ */
+static int cfi_core_features_buf(uint8_t * buf, uint16_t buflen)
+{
+	cfi_feature_desc_header_t *prop_hdr = prop_descs;
+	cfi_feature_desc_header_t *prop;
+	cfi_all_features_header_t *all_props_hdr = &all_props_desc_header;
+	cfi_all_features_header_t *tmp;
+	uint8_t *tmpbuf = buf;
+	const uint8_t *pname = NULL;
+	int i, j, namelen = 0, totlen;
+
+	/* Prepare and copy the core features into the buffer */
+	CFI_INFO("%s:\n", __func__);
+
+	tmp = (cfi_all_features_header_t *) tmpbuf;
+	*tmp = *all_props_hdr;
+	tmpbuf += CFI_ALL_FEATURES_HDR_LEN;
+
+	j = sizeof(prop_descs) / sizeof(cfi_all_features_header_t);
+	for (i = 0; i < j; i++, prop_hdr++) {
+		pname = get_prop_name(prop_hdr->wFeatureID, &namelen);
+		prop = (cfi_feature_desc_header_t *) tmpbuf;
+		*prop = *prop_hdr;
+
+		prop->bNameLen = namelen;
+		prop->wLength =
+		    DWC_CONSTANT_CPU_TO_LE16(CFI_FEATURE_DESC_HDR_LEN +
+					     namelen);
+
+		tmpbuf += CFI_FEATURE_DESC_HDR_LEN;
+		dwc_memcpy(tmpbuf, pname, namelen);
+		tmpbuf += namelen;
+	}
+
+	totlen = tmpbuf - buf;
+
+	if (totlen > 0) {
+		tmp = (cfi_all_features_header_t *) buf;
+		tmp->wTotalLen = DWC_CONSTANT_CPU_TO_LE16(totlen);
+	}
+
+	return totlen;
+}
+
+/**
+ * This function releases all the dynamic memory in the CFI object.
+ */
+static void cfi_release(cfiobject_t * cfiobj)
+{
+	cfi_ep_t *cfiep;
+	dwc_list_link_t *tmp;
+
+	CFI_INFO("%s\n", __func__);
+
+	if (cfiobj->buf_in.buf) {
+		DWC_DMA_FREE(CFI_IN_BUF_LEN, cfiobj->buf_in.buf,
+			     cfiobj->buf_in.addr);
+		cfiobj->buf_in.buf = NULL;
+	}
+
+	if (cfiobj->buf_out.buf) {
+		DWC_DMA_FREE(CFI_OUT_BUF_LEN, cfiobj->buf_out.buf,
+			     cfiobj->buf_out.addr);
+		cfiobj->buf_out.buf = NULL;
+	}
+
+	/* Free the Buffer Setup values for each EP */
+	//list_for_each_entry(cfiep, &cfiobj->active_eps, lh) {
+	DWC_LIST_FOREACH(tmp, &cfiobj->active_eps) {
+		cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
+		cfi_free_ep_bs_dyn_data(cfiep);
+	}
+}
+
+/**
+ * This function frees the dynamically allocated EP buffer setup data.
+ */
+static void cfi_free_ep_bs_dyn_data(cfi_ep_t * cfiep)
+{
+	if (cfiep->bm_sg) {
+		DWC_FREE(cfiep->bm_sg);
+		cfiep->bm_sg = NULL;
+	}
+
+	if (cfiep->bm_align) {
+		DWC_FREE(cfiep->bm_align);
+		cfiep->bm_align = NULL;
+	}
+
+	if (cfiep->bm_concat) {
+		if (NULL != cfiep->bm_concat->wTxBytes) {
+			DWC_FREE(cfiep->bm_concat->wTxBytes);
+			cfiep->bm_concat->wTxBytes = NULL;
+		}
+		DWC_FREE(cfiep->bm_concat);
+		cfiep->bm_concat = NULL;
+	}
+}
+
+/**
+ * This function initializes the default values of the features
+ * for a specific endpoint and should be called only once when
+ * the EP is enabled first time.
+ */
+static int cfi_ep_init_defaults(struct dwc_otg_pcd *pcd, cfi_ep_t * cfiep)
+{
+	int retval = 0;
+
+	cfiep->bm_sg = DWC_ALLOC(sizeof(ddma_sg_buffer_setup_t));
+	if (NULL == cfiep->bm_sg) {
+		CFI_INFO("Failed to allocate memory for SG feature value\n");
+		return -DWC_E_NO_MEMORY;
+	}
+	dwc_memset(cfiep->bm_sg, 0, sizeof(ddma_sg_buffer_setup_t));
+
+	/* For the Concatenation feature's default value we do not allocate
+	 * memory for the wTxBytes field - it will be done in the set_feature_value
+	 * request handler.
+	 */
+	cfiep->bm_concat = DWC_ALLOC(sizeof(ddma_concat_buffer_setup_t));
+	if (NULL == cfiep->bm_concat) {
+		CFI_INFO
+		    ("Failed to allocate memory for CONCATENATION feature value\n");
+		DWC_FREE(cfiep->bm_sg);
+		return -DWC_E_NO_MEMORY;
+	}
+	dwc_memset(cfiep->bm_concat, 0, sizeof(ddma_concat_buffer_setup_t));
+
+	cfiep->bm_align = DWC_ALLOC(sizeof(ddma_align_buffer_setup_t));
+	if (NULL == cfiep->bm_align) {
+		CFI_INFO
+		    ("Failed to allocate memory for Alignment feature value\n");
+		DWC_FREE(cfiep->bm_sg);
+		DWC_FREE(cfiep->bm_concat);
+		return -DWC_E_NO_MEMORY;
+	}
+	dwc_memset(cfiep->bm_align, 0, sizeof(ddma_align_buffer_setup_t));
+
+	return retval;
+}
+
+/**
+ * The callback function that notifies the CFI on the activation of
+ * an endpoint in the PCD. The following steps are done in this function:
+ *
+ *	Create a dynamically allocated cfi_ep_t object (a CFI wrapper to the PCD's
+ *		active endpoint)
+ *	Create MAX_DMA_DESCS_PER_EP count DMA Descriptors for the EP
+ *	Set the Buffer Mode to standard
+ *	Initialize the default values for all EP modes (SG, Circular, Concat, Align)
+ *	Add the cfi_ep_t object to the list of active endpoints in the CFI object
+ */
+static int cfi_ep_enable(struct cfiobject *cfi, struct dwc_otg_pcd *pcd,
+			 struct dwc_otg_pcd_ep *ep)
+{
+	cfi_ep_t *cfiep;
+	int retval = -DWC_E_NOT_SUPPORTED;
+
+	CFI_INFO("%s: epname=%s; epnum=0x%02x\n", __func__,
+		 "EP_" /*ep->ep.name */ , ep->desc->bEndpointAddress);
+	/* MAS - Check whether this endpoint already is in the list */
+	cfiep = get_cfi_ep_by_pcd_ep(cfi, ep);
+
+	if (NULL == cfiep) {
+		/* Allocate a cfi_ep_t object */
+		cfiep = DWC_ALLOC(sizeof(cfi_ep_t));
+		if (NULL == cfiep) {
+			CFI_INFO
+			    ("Unable to allocate memory for <cfiep> in function %s\n",
+			     __func__);
+			return -DWC_E_NO_MEMORY;
+		}
+		dwc_memset(cfiep, 0, sizeof(cfi_ep_t));
+
+		/* Save the dwc_otg_pcd_ep pointer in the cfiep object */
+		cfiep->ep = ep;
+
+		/* Allocate the DMA Descriptors chain of MAX_DMA_DESCS_PER_EP count */
+		ep->dwc_ep.descs =
+		    DWC_DMA_ALLOC(MAX_DMA_DESCS_PER_EP *
+				  sizeof(dwc_otg_dma_desc_t),
+				  &ep->dwc_ep.descs_dma_addr);
+
+		if (NULL == ep->dwc_ep.descs) {
+			DWC_FREE(cfiep);
+			return -DWC_E_NO_MEMORY;
+		}
+
+		DWC_LIST_INIT(&cfiep->lh);
+
+		/* Set the buffer mode to BM_STANDARD. It will be modified
+		 * when building descriptors for a specific buffer mode */
+		ep->dwc_ep.buff_mode = BM_STANDARD;
+
+		/* Create and initialize the default values for this EP's Buffer modes */
+		if ((retval = cfi_ep_init_defaults(pcd, cfiep)) < 0)
+			return retval;
+
+		/* Add the cfi_ep_t object to the CFI object's list of active endpoints */
+		DWC_LIST_INSERT_TAIL(&cfi->active_eps, &cfiep->lh);
+		retval = 0;
+	} else {		/* The sought EP already is in the list */
+		CFI_INFO("%s: The sought EP already is in the list\n",
+			 __func__);
+	}
+
+	return retval;
+}
+
+/**
+ * This function is called when the data stage of a 3-stage Control Write request
+ * is complete.
+ *
+ */
+static int cfi_ctrl_write_complete(struct cfiobject *cfi,
+				   struct dwc_otg_pcd *pcd)
+{
+	uint32_t addr, reg_value;
+	uint16_t wIndex, wValue;
+	uint8_t bRequest;
+	uint8_t *buf = cfi->buf_out.buf;
+	//struct usb_ctrlrequest *ctrl_req = &cfi->ctrl_req_saved;
+	struct cfi_usb_ctrlrequest *ctrl_req = &cfi->ctrl_req;
+	int retval = -DWC_E_NOT_SUPPORTED;
+
+	CFI_INFO("%s\n", __func__);
+
+	bRequest = ctrl_req->bRequest;
+	wIndex = DWC_CONSTANT_CPU_TO_LE16(ctrl_req->wIndex);
+	wValue = DWC_CONSTANT_CPU_TO_LE16(ctrl_req->wValue);
+
+	/*
+	 * Save the pointer to the data stage in the ctrl_req's <data> field.
+	 * The request should be already saved in the command stage by now.
+	 */
+	ctrl_req->data = cfi->buf_out.buf;
+	cfi->need_status_in_complete = 0;
+	cfi->need_gadget_att = 0;
+
+	switch (bRequest) {
+	case VEN_CORE_WRITE_REGISTER:
+		/* The buffer contains raw data of the new value for the register */
+		reg_value = *((uint32_t *) buf);
+		if (wValue == 0) {
+			addr = 0;
+			//addr = (uint32_t) pcd->otg_dev->os_dep.base;
+			addr += wIndex;
+		} else {
+			addr = (wValue << 16) | wIndex;
+		}
+
+		//writel(reg_value, addr);
+
+		retval = 0;
+		cfi->need_status_in_complete = 1;
+		break;
+
+	case VEN_CORE_SET_FEATURE:
+		/* The buffer contains raw data of the new value of the feature */
+		retval = cfi_set_feature_value(pcd);
+		if (retval < 0)
+			return retval;
+
+		cfi->need_status_in_complete = 1;
+		break;
+
+	default:
+		break;
+	}
+
+	return retval;
+}
+
+/**
+ * This function builds the DMA descriptors for the SG buffer mode.
+ */
+static void cfi_build_sg_descs(struct cfiobject *cfi, cfi_ep_t * cfiep,
+			       dwc_otg_pcd_request_t * req)
+{
+	struct dwc_otg_pcd_ep *ep = cfiep->ep;
+	ddma_sg_buffer_setup_t *sgval = cfiep->bm_sg;
+	struct dwc_otg_dma_desc *desc = cfiep->ep->dwc_ep.descs;
+	struct dwc_otg_dma_desc *desc_last = cfiep->ep->dwc_ep.descs;
+	dma_addr_t buff_addr = req->dma;
+	int i;
+	uint32_t txsize, off;
+
+	txsize = sgval->wSize;
+	off = sgval->bOffset;
+
+//      CFI_INFO("%s: %s TXSIZE=0x%08x; OFFSET=0x%08x\n",
+//              __func__, cfiep->ep->ep.name, txsize, off);
+
+	for (i = 0; i < sgval->bCount; i++) {
+		desc->status.b.bs = BS_HOST_BUSY;
+		desc->buf = buff_addr;
+		desc->status.b.l = 0;
+		desc->status.b.ioc = 0;
+		desc->status.b.sp = 0;
+		desc->status.b.bytes = txsize;
+		desc->status.b.bs = BS_HOST_READY;
+
+		/* Set the next address of the buffer */
+		buff_addr += txsize + off;
+		desc_last = desc;
+		desc++;
+	}
+
+	/* Set the last, ioc and sp bits on the Last DMA Descriptor */
+	desc_last->status.b.l = 1;
+	desc_last->status.b.ioc = 1;
+	desc_last->status.b.sp = ep->dwc_ep.sent_zlp;
+	/* Save the last DMA descriptor pointer */
+	cfiep->dma_desc_last = desc_last;
+	cfiep->desc_count = sgval->bCount;
+}
+
+/**
+ * This function builds the DMA descriptors for the Concatenation buffer mode.
+ */
+static void cfi_build_concat_descs(struct cfiobject *cfi, cfi_ep_t * cfiep,
+				   dwc_otg_pcd_request_t * req)
+{
+	struct dwc_otg_pcd_ep *ep = cfiep->ep;
+	ddma_concat_buffer_setup_t *concatval = cfiep->bm_concat;
+	struct dwc_otg_dma_desc *desc = cfiep->ep->dwc_ep.descs;
+	struct dwc_otg_dma_desc *desc_last = cfiep->ep->dwc_ep.descs;
+	dma_addr_t buff_addr = req->dma;
+	int i;
+	uint16_t *txsize;
+
+	txsize = concatval->wTxBytes;
+
+	for (i = 0; i < concatval->hdr.bDescCount; i++) {
+		desc->buf = buff_addr;
+		desc->status.b.bs = BS_HOST_BUSY;
+		desc->status.b.l = 0;
+		desc->status.b.ioc = 0;
+		desc->status.b.sp = 0;
+		desc->status.b.bytes = *txsize;
+		desc->status.b.bs = BS_HOST_READY;
+
+		txsize++;
+		/* Set the next address of the buffer */
+		buff_addr += UGETW(ep->desc->wMaxPacketSize);
+		desc_last = desc;
+		desc++;
+	}
+
+	/* Set the last, ioc and sp bits on the Last DMA Descriptor */
+	desc_last->status.b.l = 1;
+	desc_last->status.b.ioc = 1;
+	desc_last->status.b.sp = ep->dwc_ep.sent_zlp;
+	cfiep->dma_desc_last = desc_last;
+	cfiep->desc_count = concatval->hdr.bDescCount;
+}
+
+/**
+ * This function builds the DMA descriptors for the Circular buffer mode
+ */
+static void cfi_build_circ_descs(struct cfiobject *cfi, cfi_ep_t * cfiep,
+				 dwc_otg_pcd_request_t * req)
+{
+	/* @todo: MAS - add implementation when this feature needs to be tested */
+}
+
+/**
+ * This function builds the DMA descriptors for the Alignment buffer mode
+ */
+static void cfi_build_align_descs(struct cfiobject *cfi, cfi_ep_t * cfiep,
+				  dwc_otg_pcd_request_t * req)
+{
+	struct dwc_otg_pcd_ep *ep = cfiep->ep;
+	ddma_align_buffer_setup_t *alignval = cfiep->bm_align;
+	struct dwc_otg_dma_desc *desc = cfiep->ep->dwc_ep.descs;
+	dma_addr_t buff_addr = req->dma;
+
+	desc->status.b.bs = BS_HOST_BUSY;
+	desc->status.b.l = 1;
+	desc->status.b.ioc = 1;
+	desc->status.b.sp = ep->dwc_ep.sent_zlp;
+	desc->status.b.bytes = req->length;
+	/* Adjust the buffer alignment */
+	desc->buf = (buff_addr + alignval->bAlign);
+	desc->status.b.bs = BS_HOST_READY;
+	cfiep->dma_desc_last = desc;
+	cfiep->desc_count = 1;
+}
+
+/**
+ * This function builds the DMA descriptors chain for different modes of the
+ * buffer setup of an endpoint.
+ */
+static void cfi_build_descriptors(struct cfiobject *cfi,
+				  struct dwc_otg_pcd *pcd,
+				  struct dwc_otg_pcd_ep *ep,
+				  dwc_otg_pcd_request_t * req)
+{
+	cfi_ep_t *cfiep;
+
+	/* Get the cfiep by the dwc_otg_pcd_ep */
+	cfiep = get_cfi_ep_by_pcd_ep(cfi, ep);
+	if (NULL == cfiep) {
+		CFI_INFO("%s: Unable to find a matching active endpoint\n",
+			 __func__);
+		return;
+	}
+
+	cfiep->xfer_len = req->length;
+
+	/* Iterate through all the DMA descriptors */
+	switch (cfiep->ep->dwc_ep.buff_mode) {
+	case BM_SG:
+		cfi_build_sg_descs(cfi, cfiep, req);
+		break;
+
+	case BM_CONCAT:
+		cfi_build_concat_descs(cfi, cfiep, req);
+		break;
+
+	case BM_CIRCULAR:
+		cfi_build_circ_descs(cfi, cfiep, req);
+		break;
+
+	case BM_ALIGN:
+		cfi_build_align_descs(cfi, cfiep, req);
+		break;
+
+	default:
+		break;
+	}
+}
+
+/**
+ * Allocate DMA buffer for different Buffer modes.
+ */
+static void *cfi_ep_alloc_buf(struct cfiobject *cfi, struct dwc_otg_pcd *pcd,
+			      struct dwc_otg_pcd_ep *ep, dma_addr_t * dma,
+			      unsigned size, gfp_t flags)
+{
+	return DWC_DMA_ALLOC(size, dma);
+}
+
+/**
+ * This function initializes the CFI object.
+ */
+int init_cfi(cfiobject_t * cfiobj)
+{
+	CFI_INFO("%s\n", __func__);
+
+	/* Allocate a buffer for IN XFERs */
+	cfiobj->buf_in.buf =
+	    DWC_DMA_ALLOC(CFI_IN_BUF_LEN, &cfiobj->buf_in.addr);
+	if (NULL == cfiobj->buf_in.buf) {
+		CFI_INFO("Unable to allocate buffer for INs\n");
+		return -DWC_E_NO_MEMORY;
+	}
+
+	/* Allocate a buffer for OUT XFERs */
+	cfiobj->buf_out.buf =
+	    DWC_DMA_ALLOC(CFI_OUT_BUF_LEN, &cfiobj->buf_out.addr);
+	if (NULL == cfiobj->buf_out.buf) {
+		CFI_INFO("Unable to allocate buffer for OUT\n");
+		return -DWC_E_NO_MEMORY;
+	}
+
+	/* Initialize the callback function pointers */
+	cfiobj->ops.release = cfi_release;
+	cfiobj->ops.ep_enable = cfi_ep_enable;
+	cfiobj->ops.ctrl_write_complete = cfi_ctrl_write_complete;
+	cfiobj->ops.build_descriptors = cfi_build_descriptors;
+	cfiobj->ops.ep_alloc_buf = cfi_ep_alloc_buf;
+
+	/* Initialize the list of active endpoints in the CFI object */
+	DWC_LIST_INIT(&cfiobj->active_eps);
+
+	return 0;
+}
+
+/**
+ * This function reads the required feature's current value into the buffer
+ *
+ * @retval: Returns negative as error, or the data length of the feature
+ */
+static int cfi_get_feature_value(uint8_t * buf, uint16_t buflen,
+				 struct dwc_otg_pcd *pcd,
+				 struct cfi_usb_ctrlrequest *ctrl_req)
+{
+	int retval = -DWC_E_NOT_SUPPORTED;
+	struct dwc_otg_core_if *coreif = GET_CORE_IF(pcd);
+	uint16_t dfifo, rxfifo, txfifo;
+
+	switch (ctrl_req->wIndex) {
+		/* Whether the DDMA is enabled or not */
+	case FT_ID_DMA_MODE:
+		*buf = (coreif->dma_enable && coreif->dma_desc_enable) ? 1 : 0;
+		retval = 1;
+		break;
+
+	case FT_ID_DMA_BUFFER_SETUP:
+		retval = cfi_ep_get_sg_val(buf, pcd, ctrl_req);
+		break;
+
+	case FT_ID_DMA_BUFF_ALIGN:
+		retval = cfi_ep_get_align_val(buf, pcd, ctrl_req);
+		break;
+
+	case FT_ID_DMA_CONCAT_SETUP:
+		retval = cfi_ep_get_concat_val(buf, pcd, ctrl_req);
+		break;
+
+	case FT_ID_DMA_CIRCULAR:
+		CFI_INFO("GetFeature value (FT_ID_DMA_CIRCULAR)\n");
+		break;
+
+	case FT_ID_THRESHOLD_SETUP:
+		CFI_INFO("GetFeature value (FT_ID_THRESHOLD_SETUP)\n");
+		break;
+
+	case FT_ID_DFIFO_DEPTH:
+		dfifo = get_dfifo_size(coreif);
+		*((uint16_t *) buf) = dfifo;
+		retval = sizeof(uint16_t);
+		break;
+
+	case FT_ID_TX_FIFO_DEPTH:
+		retval = get_txfifo_size(pcd, ctrl_req->wValue);
+		if (retval >= 0) {
+			txfifo = retval;
+			*((uint16_t *) buf) = txfifo;
+			retval = sizeof(uint16_t);
+		}
+		break;
+
+	case FT_ID_RX_FIFO_DEPTH:
+		retval = get_rxfifo_size(coreif, ctrl_req->wValue);
+		if (retval >= 0) {
+			rxfifo = retval;
+			*((uint16_t *) buf) = rxfifo;
+			retval = sizeof(uint16_t);
+		}
+		break;
+	}
+
+	return retval;
+}
+
+/**
+ * This function resets the SG for the specified EP to its default value
+ */
+static int cfi_reset_sg_val(cfi_ep_t * cfiep)
+{
+	dwc_memset(cfiep->bm_sg, 0, sizeof(ddma_sg_buffer_setup_t));
+	return 0;
+}
+
+/**
+ * This function resets the Alignment for the specified EP to its default value
+ */
+static int cfi_reset_align_val(cfi_ep_t * cfiep)
+{
+	dwc_memset(cfiep->bm_sg, 0, sizeof(ddma_sg_buffer_setup_t));
+	return 0;
+}
+
+/**
+ * This function resets the Concatenation for the specified EP to its default value
+ * This function will also set the value of the wTxBytes field to NULL after
+ * freeing the memory previously allocated for this field.
+ */
+static int cfi_reset_concat_val(cfi_ep_t * cfiep)
+{
+	/* First we need to free the wTxBytes field */
+	if (cfiep->bm_concat->wTxBytes) {
+		DWC_FREE(cfiep->bm_concat->wTxBytes);
+		cfiep->bm_concat->wTxBytes = NULL;
+	}
+
+	dwc_memset(cfiep->bm_concat, 0, sizeof(ddma_concat_buffer_setup_t));
+	return 0;
+}
+
+/**
+ * This function resets all the buffer setups of the specified endpoint
+ */
+static int cfi_ep_reset_all_setup_vals(cfi_ep_t * cfiep)
+{
+	cfi_reset_sg_val(cfiep);
+	cfi_reset_align_val(cfiep);
+	cfi_reset_concat_val(cfiep);
+	return 0;
+}
+
+static int cfi_handle_reset_fifo_val(struct dwc_otg_pcd *pcd, uint8_t ep_addr,
+				     uint8_t rx_rst, uint8_t tx_rst)
+{
+	int retval = -DWC_E_INVALID;
+	uint16_t tx_siz[15];
+	uint16_t rx_siz = 0;
+	dwc_otg_pcd_ep_t *ep = NULL;
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_core_params_t *params = GET_CORE_IF(pcd)->core_params;
+
+	if (rx_rst) {
+		rx_siz = params->dev_rx_fifo_size;
+		params->dev_rx_fifo_size = GET_CORE_IF(pcd)->init_rxfsiz;
+	}
+
+	if (tx_rst) {
+		if (ep_addr == 0) {
+			int i;
+
+			for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+				tx_siz[i] =
+				    core_if->core_params->dev_tx_fifo_size[i];
+				core_if->core_params->dev_tx_fifo_size[i] =
+				    core_if->init_txfsiz[i];
+			}
+		} else {
+
+			ep = get_ep_by_addr(pcd, ep_addr);
+
+			if (NULL == ep) {
+				CFI_INFO
+				    ("%s: Unable to get the endpoint addr=0x%02x\n",
+				     __func__, ep_addr);
+				return -DWC_E_INVALID;
+			}
+
+			tx_siz[0] =
+			    params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num -
+						     1];
+			params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num - 1] =
+			    GET_CORE_IF(pcd)->init_txfsiz[ep->
+							  dwc_ep.tx_fifo_num -
+							  1];
+		}
+	}
+
+	if (resize_fifos(GET_CORE_IF(pcd))) {
+		retval = 0;
+	} else {
+		CFI_INFO
+		    ("%s: Error resetting the feature Reset All(FIFO size)\n",
+		     __func__);
+		if (rx_rst) {
+			params->dev_rx_fifo_size = rx_siz;
+		}
+
+		if (tx_rst) {
+			if (ep_addr == 0) {
+				int i;
+				for (i = 0; i < core_if->hwcfg4.b.num_in_eps;
+				     i++) {
+					core_if->
+					    core_params->dev_tx_fifo_size[i] =
+					    tx_siz[i];
+				}
+			} else {
+				params->dev_tx_fifo_size[ep->
+							 dwc_ep.tx_fifo_num -
+							 1] = tx_siz[0];
+			}
+		}
+		retval = -DWC_E_INVALID;
+	}
+	return retval;
+}
+
+static int cfi_handle_reset_all(struct dwc_otg_pcd *pcd, uint8_t addr)
+{
+	int retval = 0;
+	cfi_ep_t *cfiep;
+	cfiobject_t *cfi = pcd->cfi;
+	dwc_list_link_t *tmp;
+
+	retval = cfi_handle_reset_fifo_val(pcd, addr, 1, 1);
+	if (retval < 0) {
+		return retval;
+	}
+
+	/* If the EP address is known then reset the features for only that EP */
+	if (addr) {
+		cfiep = get_cfi_ep_by_addr(pcd->cfi, addr);
+		if (NULL == cfiep) {
+			CFI_INFO("%s: Error getting the EP address 0x%02x\n",
+				 __func__, addr);
+			return -DWC_E_INVALID;
+		}
+		retval = cfi_ep_reset_all_setup_vals(cfiep);
+		cfiep->ep->dwc_ep.buff_mode = BM_STANDARD;
+	}
+	/* Otherwise (wValue == 0), reset all features of all EP's */
+	else {
+		/* Traverse all the active EP's and reset the feature(s) value(s) */
+		//list_for_each_entry(cfiep, &cfi->active_eps, lh) {
+		DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
+			cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
+			retval = cfi_ep_reset_all_setup_vals(cfiep);
+			cfiep->ep->dwc_ep.buff_mode = BM_STANDARD;
+			if (retval < 0) {
+				CFI_INFO
+				    ("%s: Error resetting the feature Reset All\n",
+				     __func__);
+				return retval;
+			}
+		}
+	}
+	return retval;
+}
+
+static int cfi_handle_reset_dma_buff_setup(struct dwc_otg_pcd *pcd,
+					   uint8_t addr)
+{
+	int retval = 0;
+	cfi_ep_t *cfiep;
+	cfiobject_t *cfi = pcd->cfi;
+	dwc_list_link_t *tmp;
+
+	/* If the EP address is known then reset the features for only that EP */
+	if (addr) {
+		cfiep = get_cfi_ep_by_addr(pcd->cfi, addr);
+		if (NULL == cfiep) {
+			CFI_INFO("%s: Error getting the EP address 0x%02x\n",
+				 __func__, addr);
+			return -DWC_E_INVALID;
+		}
+		retval = cfi_reset_sg_val(cfiep);
+	}
+	/* Otherwise (wValue == 0), reset all features of all EP's */
+	else {
+		/* Traverse all the active EP's and reset the feature(s) value(s) */
+		//list_for_each_entry(cfiep, &cfi->active_eps, lh) {
+		DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
+			cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
+			retval = cfi_reset_sg_val(cfiep);
+			if (retval < 0) {
+				CFI_INFO
+				    ("%s: Error resetting the feature Buffer Setup\n",
+				     __func__);
+				return retval;
+			}
+		}
+	}
+	return retval;
+}
+
+static int cfi_handle_reset_concat_val(struct dwc_otg_pcd *pcd, uint8_t addr)
+{
+	int retval = 0;
+	cfi_ep_t *cfiep;
+	cfiobject_t *cfi = pcd->cfi;
+	dwc_list_link_t *tmp;
+
+	/* If the EP address is known then reset the features for only that EP */
+	if (addr) {
+		cfiep = get_cfi_ep_by_addr(pcd->cfi, addr);
+		if (NULL == cfiep) {
+			CFI_INFO("%s: Error getting the EP address 0x%02x\n",
+				 __func__, addr);
+			return -DWC_E_INVALID;
+		}
+		retval = cfi_reset_concat_val(cfiep);
+	}
+	/* Otherwise (wValue == 0), reset all features of all EP's */
+	else {
+		/* Traverse all the active EP's and reset the feature(s) value(s) */
+		//list_for_each_entry(cfiep, &cfi->active_eps, lh) {
+		DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
+			cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
+			retval = cfi_reset_concat_val(cfiep);
+			if (retval < 0) {
+				CFI_INFO
+				    ("%s: Error resetting the feature Concatenation Value\n",
+				     __func__);
+				return retval;
+			}
+		}
+	}
+	return retval;
+}
+
+static int cfi_handle_reset_align_val(struct dwc_otg_pcd *pcd, uint8_t addr)
+{
+	int retval = 0;
+	cfi_ep_t *cfiep;
+	cfiobject_t *cfi = pcd->cfi;
+	dwc_list_link_t *tmp;
+
+	/* If the EP address is known then reset the features for only that EP */
+	if (addr) {
+		cfiep = get_cfi_ep_by_addr(pcd->cfi, addr);
+		if (NULL == cfiep) {
+			CFI_INFO("%s: Error getting the EP address 0x%02x\n",
+				 __func__, addr);
+			return -DWC_E_INVALID;
+		}
+		retval = cfi_reset_align_val(cfiep);
+	}
+	/* Otherwise (wValue == 0), reset all features of all EP's */
+	else {
+		/* Traverse all the active EP's and reset the feature(s) value(s) */
+		//list_for_each_entry(cfiep, &cfi->active_eps, lh) {
+		DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
+			cfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
+			retval = cfi_reset_align_val(cfiep);
+			if (retval < 0) {
+				CFI_INFO
+				    ("%s: Error resetting the feature Aliignment Value\n",
+				     __func__);
+				return retval;
+			}
+		}
+	}
+	return retval;
+
+}
+
+static int cfi_preproc_reset(struct dwc_otg_pcd *pcd,
+			     struct cfi_usb_ctrlrequest *req)
+{
+	int retval = 0;
+
+	switch (req->wIndex) {
+	case 0:
+		/* Reset all features */
+		retval = cfi_handle_reset_all(pcd, req->wValue & 0xff);
+		break;
+
+	case FT_ID_DMA_BUFFER_SETUP:
+		/* Reset the SG buffer setup */
+		retval =
+		    cfi_handle_reset_dma_buff_setup(pcd, req->wValue & 0xff);
+		break;
+
+	case FT_ID_DMA_CONCAT_SETUP:
+		/* Reset the Concatenation buffer setup */
+		retval = cfi_handle_reset_concat_val(pcd, req->wValue & 0xff);
+		break;
+
+	case FT_ID_DMA_BUFF_ALIGN:
+		/* Reset the Alignment buffer setup */
+		retval = cfi_handle_reset_align_val(pcd, req->wValue & 0xff);
+		break;
+
+	case FT_ID_TX_FIFO_DEPTH:
+		retval =
+		    cfi_handle_reset_fifo_val(pcd, req->wValue & 0xff, 0, 1);
+		pcd->cfi->need_gadget_att = 0;
+		break;
+
+	case FT_ID_RX_FIFO_DEPTH:
+		retval = cfi_handle_reset_fifo_val(pcd, 0, 1, 0);
+		pcd->cfi->need_gadget_att = 0;
+		break;
+	default:
+		break;
+	}
+	return retval;
+}
+
+/**
+ * This function sets a new value for the SG buffer setup.
+ */
+static int cfi_ep_set_sg_val(uint8_t * buf, struct dwc_otg_pcd *pcd)
+{
+	uint8_t inaddr, outaddr;
+	cfi_ep_t *epin, *epout;
+	ddma_sg_buffer_setup_t *psgval;
+	uint32_t desccount, size;
+
+	CFI_INFO("%s\n", __func__);
+
+	psgval = (ddma_sg_buffer_setup_t *) buf;
+	desccount = (uint32_t) psgval->bCount;
+	size = (uint32_t) psgval->wSize;
+
+	/* Check the DMA descriptor count */
+	if ((desccount > MAX_DMA_DESCS_PER_EP) || (desccount == 0)) {
+		CFI_INFO
+		    ("%s: The count of DMA Descriptors should be between 1 and %d\n",
+		     __func__, MAX_DMA_DESCS_PER_EP);
+		return -DWC_E_INVALID;
+	}
+
+	/* Check the DMA descriptor count */
+
+	if (size == 0) {
+
+		CFI_INFO("%s: The transfer size should be at least 1 byte\n",
+			 __func__);
+
+		return -DWC_E_INVALID;
+
+	}
+
+	inaddr = psgval->bInEndpointAddress;
+	outaddr = psgval->bOutEndpointAddress;
+
+	epin = get_cfi_ep_by_addr(pcd->cfi, inaddr);
+	epout = get_cfi_ep_by_addr(pcd->cfi, outaddr);
+
+	if (NULL == epin || NULL == epout) {
+		CFI_INFO
+		    ("%s: Unable to get the endpoints inaddr=0x%02x outaddr=0x%02x\n",
+		     __func__, inaddr, outaddr);
+		return -DWC_E_INVALID;
+	}
+
+	epin->ep->dwc_ep.buff_mode = BM_SG;
+	dwc_memcpy(epin->bm_sg, psgval, sizeof(ddma_sg_buffer_setup_t));
+
+	epout->ep->dwc_ep.buff_mode = BM_SG;
+	dwc_memcpy(epout->bm_sg, psgval, sizeof(ddma_sg_buffer_setup_t));
+
+	return 0;
+}
+
+/**
+ * This function sets a new value for the buffer Alignment setup.
+ */
+static int cfi_ep_set_alignment_val(uint8_t * buf, struct dwc_otg_pcd *pcd)
+{
+	cfi_ep_t *ep;
+	uint8_t addr;
+	ddma_align_buffer_setup_t *palignval;
+
+	palignval = (ddma_align_buffer_setup_t *) buf;
+	addr = palignval->bEndpointAddress;
+
+	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
+
+	if (NULL == ep) {
+		CFI_INFO("%s: Unable to get the endpoint addr=0x%02x\n",
+			 __func__, addr);
+		return -DWC_E_INVALID;
+	}
+
+	ep->ep->dwc_ep.buff_mode = BM_ALIGN;
+	dwc_memcpy(ep->bm_align, palignval, sizeof(ddma_align_buffer_setup_t));
+
+	return 0;
+}
+
+/**
+ * This function sets a new value for the Concatenation buffer setup.
+ */
+static int cfi_ep_set_concat_val(uint8_t * buf, struct dwc_otg_pcd *pcd)
+{
+	uint8_t addr;
+	cfi_ep_t *ep;
+	struct _ddma_concat_buffer_setup_hdr *pConcatValHdr;
+	uint16_t *pVals;
+	uint32_t desccount;
+	int i;
+	uint16_t mps;
+
+	pConcatValHdr = (struct _ddma_concat_buffer_setup_hdr *)buf;
+	desccount = (uint32_t) pConcatValHdr->bDescCount;
+	pVals = (uint16_t *) (buf + BS_CONCAT_VAL_HDR_LEN);
+
+	/* Check the DMA descriptor count */
+	if (desccount > MAX_DMA_DESCS_PER_EP) {
+		CFI_INFO("%s: Maximum DMA Descriptor count should be %d\n",
+			 __func__, MAX_DMA_DESCS_PER_EP);
+		return -DWC_E_INVALID;
+	}
+
+	addr = pConcatValHdr->bEndpointAddress;
+	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
+	if (NULL == ep) {
+		CFI_INFO("%s: Unable to get the endpoint addr=0x%02x\n",
+			 __func__, addr);
+		return -DWC_E_INVALID;
+	}
+
+	mps = UGETW(ep->ep->desc->wMaxPacketSize);
+
+#if 0
+	for (i = 0; i < desccount; i++) {
+		CFI_INFO("%s: wTxSize[%d]=0x%04x\n", __func__, i, pVals[i]);
+	}
+	CFI_INFO("%s: epname=%s; mps=%d\n", __func__, ep->ep->ep.name, mps);
+#endif
+
+	/* Check the wTxSizes to be less than or equal to the mps */
+	for (i = 0; i < desccount; i++) {
+		if (pVals[i] > mps) {
+			CFI_INFO
+			    ("%s: ERROR - the wTxSize[%d] should be <= MPS (wTxSize=%d)\n",
+			     __func__, i, pVals[i]);
+			return -DWC_E_INVALID;
+		}
+	}
+
+	ep->ep->dwc_ep.buff_mode = BM_CONCAT;
+	dwc_memcpy(ep->bm_concat, pConcatValHdr, BS_CONCAT_VAL_HDR_LEN);
+
+	/* Free the previously allocated storage for the wTxBytes */
+	if (ep->bm_concat->wTxBytes) {
+		DWC_FREE(ep->bm_concat->wTxBytes);
+	}
+
+	/* Allocate a new storage for the wTxBytes field */
+	ep->bm_concat->wTxBytes =
+	    DWC_ALLOC(sizeof(uint16_t) * pConcatValHdr->bDescCount);
+	if (NULL == ep->bm_concat->wTxBytes) {
+		CFI_INFO("%s: Unable to allocate memory\n", __func__);
+		return -DWC_E_NO_MEMORY;
+	}
+
+	/* Copy the new values into the wTxBytes filed */
+	dwc_memcpy(ep->bm_concat->wTxBytes, buf + BS_CONCAT_VAL_HDR_LEN,
+		   sizeof(uint16_t) * pConcatValHdr->bDescCount);
+
+	return 0;
+}
+
+/**
+ * This function calculates the total of all FIFO sizes
+ *
+ * @param core_if Programming view of DWC_otg controller
+ *
+ * @return The total of data FIFO sizes.
+ *
+ */
+static uint16_t get_dfifo_size(dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_core_params_t *params = core_if->core_params;
+	uint16_t dfifo_total = 0;
+	int i;
+
+	/* The shared RxFIFO size */
+	dfifo_total =
+	    params->dev_rx_fifo_size + params->dev_nperio_tx_fifo_size;
+
+	/* Add up each TxFIFO size to the total */
+	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+		dfifo_total += params->dev_tx_fifo_size[i];
+	}
+
+	return dfifo_total;
+}
+
+/**
+ * This function returns Rx FIFO size
+ *
+ * @param core_if Programming view of DWC_otg controller
+ *
+ * @return The total of data FIFO sizes.
+ *
+ */
+static int32_t get_rxfifo_size(dwc_otg_core_if_t * core_if, uint16_t wValue)
+{
+	switch (wValue >> 8) {
+	case 0:
+		return (core_if->pwron_rxfsiz <
+			32768) ? core_if->pwron_rxfsiz : 32768;
+		break;
+	case 1:
+		return core_if->core_params->dev_rx_fifo_size;
+		break;
+	default:
+		return -DWC_E_INVALID;
+		break;
+	}
+}
+
+/**
+ * This function returns Tx FIFO size for IN EP
+ *
+ * @param core_if Programming view of DWC_otg controller
+ *
+ * @return The total of data FIFO sizes.
+ *
+ */
+static int32_t get_txfifo_size(struct dwc_otg_pcd *pcd, uint16_t wValue)
+{
+	dwc_otg_pcd_ep_t *ep;
+
+	ep = get_ep_by_addr(pcd, wValue & 0xff);
+
+	if (NULL == ep) {
+		CFI_INFO("%s: Unable to get the endpoint addr=0x%02x\n",
+			 __func__, wValue & 0xff);
+		return -DWC_E_INVALID;
+	}
+
+	if (!ep->dwc_ep.is_in) {
+		CFI_INFO
+		    ("%s: No Tx FIFO assingned to the Out endpoint addr=0x%02x\n",
+		     __func__, wValue & 0xff);
+		return -DWC_E_INVALID;
+	}
+
+	switch (wValue >> 8) {
+	case 0:
+		return (GET_CORE_IF(pcd)->pwron_txfsiz
+			[ep->dwc_ep.tx_fifo_num - 1] <
+			768) ? GET_CORE_IF(pcd)->pwron_txfsiz[ep->
+							      dwc_ep.tx_fifo_num
+							      - 1] : 32768;
+		break;
+	case 1:
+		return GET_CORE_IF(pcd)->core_params->
+		    dev_tx_fifo_size[ep->dwc_ep.num - 1];
+		break;
+	default:
+		return -DWC_E_INVALID;
+		break;
+	}
+}
+
+/**
+ * This function checks if the submitted combination of
+ * device mode FIFO sizes is possible or not.
+ *
+ * @param core_if Programming view of DWC_otg controller
+ *
+ * @return 1 if possible, 0 otherwise.
+ *
+ */
+static uint8_t check_fifo_sizes(dwc_otg_core_if_t * core_if)
+{
+	uint16_t dfifo_actual = 0;
+	dwc_otg_core_params_t *params = core_if->core_params;
+	uint16_t start_addr = 0;
+	int i;
+
+	dfifo_actual =
+	    params->dev_rx_fifo_size + params->dev_nperio_tx_fifo_size;
+
+	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+		dfifo_actual += params->dev_tx_fifo_size[i];
+	}
+
+	if (dfifo_actual > core_if->total_fifo_size) {
+		return 0;
+	}
+
+	if (params->dev_rx_fifo_size > 32768 || params->dev_rx_fifo_size < 16)
+		return 0;
+
+	if (params->dev_nperio_tx_fifo_size > 32768
+	    || params->dev_nperio_tx_fifo_size < 16)
+		return 0;
+
+	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+
+		if (params->dev_tx_fifo_size[i] > 768
+		    || params->dev_tx_fifo_size[i] < 4)
+			return 0;
+	}
+
+	if (params->dev_rx_fifo_size > core_if->pwron_rxfsiz)
+		return 0;
+	start_addr = params->dev_rx_fifo_size;
+
+	if (params->dev_nperio_tx_fifo_size > core_if->pwron_gnptxfsiz)
+		return 0;
+	start_addr += params->dev_nperio_tx_fifo_size;
+
+	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+
+		if (params->dev_tx_fifo_size[i] > core_if->pwron_txfsiz[i])
+			return 0;
+		start_addr += params->dev_tx_fifo_size[i];
+	}
+
+	return 1;
+}
+
+/**
+ * This function resizes Device mode FIFOs
+ *
+ * @param core_if Programming view of DWC_otg controller
+ *
+ * @return 1 if successful, 0 otherwise
+ *
+ */
+static uint8_t resize_fifos(dwc_otg_core_if_t * core_if)
+{
+	int i = 0;
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	dwc_otg_core_params_t *params = core_if->core_params;
+	uint32_t rx_fifo_size;
+	fifosize_data_t nptxfifosize;
+	fifosize_data_t txfifosize[15];
+
+	uint32_t rx_fsz_bak;
+	uint32_t nptxfsz_bak;
+	uint32_t txfsz_bak[15];
+
+	uint16_t start_address;
+	uint8_t retval = 1;
+
+	if (!check_fifo_sizes(core_if)) {
+		return 0;
+	}
+
+	/* Configure data FIFO sizes */
+	if (core_if->hwcfg2.b.dynamic_fifo && params->enable_dynamic_fifo) {
+		rx_fsz_bak = DWC_READ_REG32(&global_regs->grxfsiz);
+		rx_fifo_size = params->dev_rx_fifo_size;
+		DWC_WRITE_REG32(&global_regs->grxfsiz, rx_fifo_size);
+
+		/*
+		 * Tx FIFOs These FIFOs are numbered from 1 to 15.
+		 * Indexes of the FIFO size module parameters in the
+		 * dev_tx_fifo_size array and the FIFO size registers in
+		 * the dtxfsiz array run from 0 to 14.
+		 */
+
+		/* Non-periodic Tx FIFO */
+		nptxfsz_bak = DWC_READ_REG32(&global_regs->gnptxfsiz);
+		nptxfifosize.b.depth = params->dev_nperio_tx_fifo_size;
+		start_address = params->dev_rx_fifo_size;
+		nptxfifosize.b.startaddr = start_address;
+
+		DWC_WRITE_REG32(&global_regs->gnptxfsiz, nptxfifosize.d32);
+
+		start_address += nptxfifosize.b.depth;
+
+		for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+			txfsz_bak[i] = DWC_READ_REG32(&global_regs->dtxfsiz[i]);
+
+			txfifosize[i].b.depth = params->dev_tx_fifo_size[i];
+			txfifosize[i].b.startaddr = start_address;
+			DWC_WRITE_REG32(&global_regs->dtxfsiz[i],
+					txfifosize[i].d32);
+
+			start_address += txfifosize[i].b.depth;
+		}
+
+		/** Check if register values are set correctly */
+		if (rx_fifo_size != DWC_READ_REG32(&global_regs->grxfsiz)) {
+			retval = 0;
+		}
+
+		if (nptxfifosize.d32 != DWC_READ_REG32(&global_regs->gnptxfsiz)) {
+			retval = 0;
+		}
+
+		for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+			if (txfifosize[i].d32 !=
+			    DWC_READ_REG32(&global_regs->dtxfsiz[i])) {
+				retval = 0;
+			}
+		}
+
+		/** If register values are not set correctly, reset old values */
+		if (retval == 0) {
+			DWC_WRITE_REG32(&global_regs->grxfsiz, rx_fsz_bak);
+
+			/* Non-periodic Tx FIFO */
+			DWC_WRITE_REG32(&global_regs->gnptxfsiz, nptxfsz_bak);
+
+			for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+				DWC_WRITE_REG32(&global_regs->dtxfsiz[i],
+						txfsz_bak[i]);
+			}
+		}
+	} else {
+		return 0;
+	}
+
+	/* Flush the FIFOs */
+	dwc_otg_flush_tx_fifo(core_if, 0x10);	/* all Tx FIFOs */
+	dwc_otg_flush_rx_fifo(core_if);
+
+	return retval;
+}
+
+/**
+ * This function sets a new value for the buffer Alignment setup.
+ */
+static int cfi_ep_set_tx_fifo_val(uint8_t * buf, dwc_otg_pcd_t * pcd)
+{
+	int retval;
+	uint32_t fsiz;
+	uint16_t size;
+	uint16_t ep_addr;
+	dwc_otg_pcd_ep_t *ep;
+	dwc_otg_core_params_t *params = GET_CORE_IF(pcd)->core_params;
+	tx_fifo_size_setup_t *ptxfifoval;
+
+	ptxfifoval = (tx_fifo_size_setup_t *) buf;
+	ep_addr = ptxfifoval->bEndpointAddress;
+	size = ptxfifoval->wDepth;
+
+	ep = get_ep_by_addr(pcd, ep_addr);
+
+	CFI_INFO
+	    ("%s: Set Tx FIFO size: endpoint addr=0x%02x, depth=%d, FIFO Num=%d\n",
+	     __func__, ep_addr, size, ep->dwc_ep.tx_fifo_num);
+
+	if (NULL == ep) {
+		CFI_INFO("%s: Unable to get the endpoint addr=0x%02x\n",
+			 __func__, ep_addr);
+		return -DWC_E_INVALID;
+	}
+
+	fsiz = params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num - 1];
+	params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num - 1] = size;
+
+	if (resize_fifos(GET_CORE_IF(pcd))) {
+		retval = 0;
+	} else {
+		CFI_INFO
+		    ("%s: Error setting the feature Tx FIFO Size for EP%d\n",
+		     __func__, ep_addr);
+		params->dev_tx_fifo_size[ep->dwc_ep.tx_fifo_num - 1] = fsiz;
+		retval = -DWC_E_INVALID;
+	}
+
+	return retval;
+}
+
+/**
+ * This function sets a new value for the buffer Alignment setup.
+ */
+static int cfi_set_rx_fifo_val(uint8_t * buf, dwc_otg_pcd_t * pcd)
+{
+	int retval;
+	uint32_t fsiz;
+	uint16_t size;
+	dwc_otg_core_params_t *params = GET_CORE_IF(pcd)->core_params;
+	rx_fifo_size_setup_t *prxfifoval;
+
+	prxfifoval = (rx_fifo_size_setup_t *) buf;
+	size = prxfifoval->wDepth;
+
+	fsiz = params->dev_rx_fifo_size;
+	params->dev_rx_fifo_size = size;
+
+	if (resize_fifos(GET_CORE_IF(pcd))) {
+		retval = 0;
+	} else {
+		CFI_INFO("%s: Error setting the feature Rx FIFO Size\n",
+			 __func__);
+		params->dev_rx_fifo_size = fsiz;
+		retval = -DWC_E_INVALID;
+	}
+
+	return retval;
+}
+
+/**
+ * This function reads the SG of an EP's buffer setup into the buffer buf
+ */
+static int cfi_ep_get_sg_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
+			     struct cfi_usb_ctrlrequest *req)
+{
+	int retval = -DWC_E_INVALID;
+	uint8_t addr;
+	cfi_ep_t *ep;
+
+	/* The Low Byte of the wValue contains a non-zero address of the endpoint */
+	addr = req->wValue & 0xFF;
+	if (addr == 0)		/* The address should be non-zero */
+		return retval;
+
+	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
+	if (NULL == ep) {
+		CFI_INFO("%s: Unable to get the endpoint address(0x%02x)\n",
+			 __func__, addr);
+		return retval;
+	}
+
+	dwc_memcpy(buf, ep->bm_sg, BS_SG_VAL_DESC_LEN);
+	retval = BS_SG_VAL_DESC_LEN;
+	return retval;
+}
+
+/**
+ * This function reads the Concatenation value of an EP's buffer mode into
+ * the buffer buf
+ */
+static int cfi_ep_get_concat_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
+				 struct cfi_usb_ctrlrequest *req)
+{
+	int retval = -DWC_E_INVALID;
+	uint8_t addr;
+	cfi_ep_t *ep;
+	uint8_t desc_count;
+
+	/* The Low Byte of the wValue contains a non-zero address of the endpoint */
+	addr = req->wValue & 0xFF;
+	if (addr == 0)		/* The address should be non-zero */
+		return retval;
+
+	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
+	if (NULL == ep) {
+		CFI_INFO("%s: Unable to get the endpoint address(0x%02x)\n",
+			 __func__, addr);
+		return retval;
+	}
+
+	/* Copy the header to the buffer */
+	dwc_memcpy(buf, ep->bm_concat, BS_CONCAT_VAL_HDR_LEN);
+	/* Advance the buffer pointer by the header size */
+	buf += BS_CONCAT_VAL_HDR_LEN;
+
+	desc_count = ep->bm_concat->hdr.bDescCount;
+	/* Copy alll the wTxBytes to the buffer */
+	dwc_memcpy(buf, ep->bm_concat->wTxBytes, sizeof(uid16_t) * desc_count);
+
+	retval = BS_CONCAT_VAL_HDR_LEN + sizeof(uid16_t) * desc_count;
+	return retval;
+}
+
+/**
+ * This function reads the buffer Alignment value of an EP's buffer mode into
+ * the buffer buf
+ *
+ * @return The total number of bytes copied to the buffer or negative error code.
+ */
+static int cfi_ep_get_align_val(uint8_t * buf, struct dwc_otg_pcd *pcd,
+				struct cfi_usb_ctrlrequest *req)
+{
+	int retval = -DWC_E_INVALID;
+	uint8_t addr;
+	cfi_ep_t *ep;
+
+	/* The Low Byte of the wValue contains a non-zero address of the endpoint */
+	addr = req->wValue & 0xFF;
+	if (addr == 0)		/* The address should be non-zero */
+		return retval;
+
+	ep = get_cfi_ep_by_addr(pcd->cfi, addr);
+	if (NULL == ep) {
+		CFI_INFO("%s: Unable to get the endpoint address(0x%02x)\n",
+			 __func__, addr);
+		return retval;
+	}
+
+	dwc_memcpy(buf, ep->bm_align, BS_ALIGN_VAL_HDR_LEN);
+	retval = BS_ALIGN_VAL_HDR_LEN;
+
+	return retval;
+}
+
+/**
+ * This function sets a new value for the specified feature
+ *
+ * @param	pcd	A pointer to the PCD object
+ *
+ * @return 0 if successful, negative error code otherwise to stall the DCE.
+ */
+static int cfi_set_feature_value(struct dwc_otg_pcd *pcd)
+{
+	int retval = -DWC_E_NOT_SUPPORTED;
+	uint16_t wIndex, wValue;
+	uint8_t bRequest;
+	struct dwc_otg_core_if *coreif;
+	cfiobject_t *cfi = pcd->cfi;
+	struct cfi_usb_ctrlrequest *ctrl_req;
+	uint8_t *buf;
+	ctrl_req = &cfi->ctrl_req;
+
+	buf = pcd->cfi->ctrl_req.data;
+
+	coreif = GET_CORE_IF(pcd);
+	bRequest = ctrl_req->bRequest;
+	wIndex = DWC_CONSTANT_CPU_TO_LE16(ctrl_req->wIndex);
+	wValue = DWC_CONSTANT_CPU_TO_LE16(ctrl_req->wValue);
+
+	/* See which feature is to be modified */
+	switch (wIndex) {
+	case FT_ID_DMA_BUFFER_SETUP:
+		/* Modify the feature */
+		if ((retval = cfi_ep_set_sg_val(buf, pcd)) < 0)
+			return retval;
+
+		/* And send this request to the gadget */
+		cfi->need_gadget_att = 1;
+		break;
+
+	case FT_ID_DMA_BUFF_ALIGN:
+		if ((retval = cfi_ep_set_alignment_val(buf, pcd)) < 0)
+			return retval;
+		cfi->need_gadget_att = 1;
+		break;
+
+	case FT_ID_DMA_CONCAT_SETUP:
+		/* Modify the feature */
+		if ((retval = cfi_ep_set_concat_val(buf, pcd)) < 0)
+			return retval;
+		cfi->need_gadget_att = 1;
+		break;
+
+	case FT_ID_DMA_CIRCULAR:
+		CFI_INFO("FT_ID_DMA_CIRCULAR\n");
+		break;
+
+	case FT_ID_THRESHOLD_SETUP:
+		CFI_INFO("FT_ID_THRESHOLD_SETUP\n");
+		break;
+
+	case FT_ID_DFIFO_DEPTH:
+		CFI_INFO("FT_ID_DFIFO_DEPTH\n");
+		break;
+
+	case FT_ID_TX_FIFO_DEPTH:
+		CFI_INFO("FT_ID_TX_FIFO_DEPTH\n");
+		if ((retval = cfi_ep_set_tx_fifo_val(buf, pcd)) < 0)
+			return retval;
+		cfi->need_gadget_att = 0;
+		break;
+
+	case FT_ID_RX_FIFO_DEPTH:
+		CFI_INFO("FT_ID_RX_FIFO_DEPTH\n");
+		if ((retval = cfi_set_rx_fifo_val(buf, pcd)) < 0)
+			return retval;
+		cfi->need_gadget_att = 0;
+		break;
+	}
+
+	return retval;
+}
+
+#endif //DWC_UTE_CFI
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_cfi.h b/drivers/usb/host/dwc_otg/dwc_otg_cfi.h
new file mode 100644
index 000000000000..55fd337a283c
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_cfi.h
@@ -0,0 +1,320 @@
+/* ==========================================================================
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+#if !defined(__DWC_OTG_CFI_H__)
+#define __DWC_OTG_CFI_H__
+
+#include "dwc_otg_pcd.h"
+#include "dwc_cfi_common.h"
+
+/**
+ * @file
+ * This file contains the CFI related OTG PCD specific common constants,
+ * interfaces(functions and macros) and data structures.The CFI Protocol is an
+ * optional interface for internal testing purposes that a DUT may implement to
+ * support testing of configurable features.
+ *
+ */
+
+struct dwc_otg_pcd;
+struct dwc_otg_pcd_ep;
+
+/** OTG CFI Features (properties) ID constants */
+/** This is a request for all Core Features */
+#define FT_ID_DMA_MODE					0x0001
+#define FT_ID_DMA_BUFFER_SETUP			0x0002
+#define FT_ID_DMA_BUFF_ALIGN			0x0003
+#define FT_ID_DMA_CONCAT_SETUP			0x0004
+#define FT_ID_DMA_CIRCULAR				0x0005
+#define FT_ID_THRESHOLD_SETUP			0x0006
+#define FT_ID_DFIFO_DEPTH				0x0007
+#define FT_ID_TX_FIFO_DEPTH				0x0008
+#define FT_ID_RX_FIFO_DEPTH				0x0009
+
+/**********************************************************/
+#define CFI_INFO_DEF
+
+#ifdef CFI_INFO_DEF
+#define CFI_INFO(fmt...)	DWC_PRINTF("CFI: " fmt);
+#else
+#define CFI_INFO(fmt...)
+#endif
+
+#define min(x,y) ({ \
+	x < y ? x : y; })
+
+#define max(x,y) ({ \
+	x > y ? x : y; })
+
+/**
+ * Descriptor DMA SG Buffer setup structure (SG buffer). This structure is
+ * also used for setting up a buffer for Circular DDMA.
+ */
+struct _ddma_sg_buffer_setup {
+#define BS_SG_VAL_DESC_LEN	6
+	/* The OUT EP address */
+	uint8_t bOutEndpointAddress;
+	/* The IN EP address */
+	uint8_t bInEndpointAddress;
+	/* Number of bytes to put between transfer segments (must be DWORD boundaries) */
+	uint8_t bOffset;
+	/* The number of transfer segments (a DMA descriptors per each segment) */
+	uint8_t bCount;
+	/* Size (in byte) of each transfer segment */
+	uint16_t wSize;
+} __attribute__ ((packed));
+typedef struct _ddma_sg_buffer_setup ddma_sg_buffer_setup_t;
+
+/** Descriptor DMA Concatenation Buffer setup structure */
+struct _ddma_concat_buffer_setup_hdr {
+#define BS_CONCAT_VAL_HDR_LEN	4
+	/* The endpoint for which the buffer is to be set up */
+	uint8_t bEndpointAddress;
+	/* The count of descriptors to be used */
+	uint8_t bDescCount;
+	/* The total size of the transfer */
+	uint16_t wSize;
+} __attribute__ ((packed));
+typedef struct _ddma_concat_buffer_setup_hdr ddma_concat_buffer_setup_hdr_t;
+
+/** Descriptor DMA Concatenation Buffer setup structure */
+struct _ddma_concat_buffer_setup {
+	/* The SG header */
+	ddma_concat_buffer_setup_hdr_t hdr;
+
+	/* The XFER sizes pointer (allocated dynamically) */
+	uint16_t *wTxBytes;
+} __attribute__ ((packed));
+typedef struct _ddma_concat_buffer_setup ddma_concat_buffer_setup_t;
+
+/** Descriptor DMA Alignment Buffer setup structure */
+struct _ddma_align_buffer_setup {
+#define BS_ALIGN_VAL_HDR_LEN	2
+	uint8_t bEndpointAddress;
+	uint8_t bAlign;
+} __attribute__ ((packed));
+typedef struct _ddma_align_buffer_setup ddma_align_buffer_setup_t;
+
+/** Transmit FIFO Size setup structure */
+struct _tx_fifo_size_setup {
+	uint8_t bEndpointAddress;
+	uint16_t wDepth;
+} __attribute__ ((packed));
+typedef struct _tx_fifo_size_setup tx_fifo_size_setup_t;
+
+/** Transmit FIFO Size setup structure */
+struct _rx_fifo_size_setup {
+	uint16_t wDepth;
+} __attribute__ ((packed));
+typedef struct _rx_fifo_size_setup rx_fifo_size_setup_t;
+
+/**
+ * struct cfi_usb_ctrlrequest - the CFI implementation of the struct usb_ctrlrequest
+ * This structure encapsulates the standard usb_ctrlrequest and adds a pointer
+ * to the data returned in the data stage of a 3-stage Control Write requests.
+ */
+struct cfi_usb_ctrlrequest {
+	uint8_t bRequestType;
+	uint8_t bRequest;
+	uint16_t wValue;
+	uint16_t wIndex;
+	uint16_t wLength;
+	uint8_t *data;
+} UPACKED;
+
+/*---------------------------------------------------------------------------*/
+
+/**
+ * The CFI wrapper of the enabled and activated dwc_otg_pcd_ep structures.
+ * This structure is used to store the buffer setup data for any
+ * enabled endpoint in the PCD.
+ */
+struct cfi_ep {
+	/* Entry for the list container */
+	dwc_list_link_t lh;
+	/* Pointer to the active PCD endpoint structure */
+	struct dwc_otg_pcd_ep *ep;
+	/* The last descriptor in the chain of DMA descriptors of the endpoint */
+	struct dwc_otg_dma_desc *dma_desc_last;
+	/* The SG feature value */
+	ddma_sg_buffer_setup_t *bm_sg;
+	/* The Circular feature value */
+	ddma_sg_buffer_setup_t *bm_circ;
+	/* The Concatenation feature value */
+	ddma_concat_buffer_setup_t *bm_concat;
+	/* The Alignment feature value */
+	ddma_align_buffer_setup_t *bm_align;
+	/* XFER length */
+	uint32_t xfer_len;
+	/*
+	 * Count of DMA descriptors currently used.
+	 * The total should not exceed the MAX_DMA_DESCS_PER_EP value
+	 * defined in the dwc_otg_cil.h
+	 */
+	uint32_t desc_count;
+};
+typedef struct cfi_ep cfi_ep_t;
+
+typedef struct cfi_dma_buff {
+#define CFI_IN_BUF_LEN	1024
+#define CFI_OUT_BUF_LEN	1024
+	dma_addr_t addr;
+	uint8_t *buf;
+} cfi_dma_buff_t;
+
+struct cfiobject;
+
+/**
+ * This is the interface for the CFI operations.
+ *
+ * @param	ep_enable			Called when any endpoint is enabled and activated.
+ * @param	release				Called when the CFI object is released and it needs to correctly
+ *								deallocate the dynamic memory
+ * @param	ctrl_write_complete	Called when the data stage of the request is complete
+ */
+typedef struct cfi_ops {
+	int (*ep_enable) (struct cfiobject * cfi, struct dwc_otg_pcd * pcd,
+			  struct dwc_otg_pcd_ep * ep);
+	void *(*ep_alloc_buf) (struct cfiobject * cfi, struct dwc_otg_pcd * pcd,
+			       struct dwc_otg_pcd_ep * ep, dma_addr_t * dma,
+			       unsigned size, gfp_t flags);
+	void (*release) (struct cfiobject * cfi);
+	int (*ctrl_write_complete) (struct cfiobject * cfi,
+				    struct dwc_otg_pcd * pcd);
+	void (*build_descriptors) (struct cfiobject * cfi,
+				   struct dwc_otg_pcd * pcd,
+				   struct dwc_otg_pcd_ep * ep,
+				   dwc_otg_pcd_request_t * req);
+} cfi_ops_t;
+
+struct cfiobject {
+	cfi_ops_t ops;
+	struct dwc_otg_pcd *pcd;
+	struct usb_gadget *gadget;
+
+	/* Buffers used to send/receive CFI-related request data */
+	cfi_dma_buff_t buf_in;
+	cfi_dma_buff_t buf_out;
+
+	/* CFI specific Control request wrapper */
+	struct cfi_usb_ctrlrequest ctrl_req;
+
+	/* The list of active EP's in the PCD of type cfi_ep_t */
+	dwc_list_link_t active_eps;
+
+	/* This flag shall control the propagation of a specific request
+	 * to the gadget's processing routines.
+	 * 0 - no gadget handling
+	 * 1 - the gadget needs to know about this request (w/o completing a status
+	 * phase - just return a 0 to the _setup callback)
+	 */
+	uint8_t need_gadget_att;
+
+	/* Flag indicating whether the status IN phase needs to be
+	 * completed by the PCD
+	 */
+	uint8_t need_status_in_complete;
+};
+typedef struct cfiobject cfiobject_t;
+
+#define DUMP_MSG
+
+#if defined(DUMP_MSG)
+static inline void dump_msg(const u8 * buf, unsigned int length)
+{
+	unsigned int start, num, i;
+	char line[52], *p;
+
+	if (length >= 512)
+		return;
+
+	start = 0;
+	while (length > 0) {
+		num = min(length, 16u);
+		p = line;
+		for (i = 0; i < num; ++i) {
+			if (i == 8)
+				*p++ = ' ';
+			DWC_SPRINTF(p, " %02x", buf[i]);
+			p += 3;
+		}
+		*p = 0;
+		DWC_DEBUG("%6x: %s\n", start, line);
+		buf += num;
+		start += num;
+		length -= num;
+	}
+}
+#else
+static inline void dump_msg(const u8 * buf, unsigned int length)
+{
+}
+#endif
+
+/**
+ * This function returns a pointer to cfi_ep_t object with the addr address.
+ */
+static inline struct cfi_ep *get_cfi_ep_by_addr(struct cfiobject *cfi,
+						uint8_t addr)
+{
+	struct cfi_ep *pcfiep;
+	dwc_list_link_t *tmp;
+
+	DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
+		pcfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
+
+		if (pcfiep->ep->desc->bEndpointAddress == addr) {
+			return pcfiep;
+		}
+	}
+
+	return NULL;
+}
+
+/**
+ * This function returns a pointer to cfi_ep_t object that matches
+ * the dwc_otg_pcd_ep object.
+ */
+static inline struct cfi_ep *get_cfi_ep_by_pcd_ep(struct cfiobject *cfi,
+						  struct dwc_otg_pcd_ep *ep)
+{
+	struct cfi_ep *pcfiep = NULL;
+	dwc_list_link_t *tmp;
+
+	DWC_LIST_FOREACH(tmp, &cfi->active_eps) {
+		pcfiep = DWC_LIST_ENTRY(tmp, struct cfi_ep, lh);
+		if (pcfiep->ep == ep) {
+			return pcfiep;
+		}
+	}
+	return NULL;
+}
+
+int cfi_setup(struct dwc_otg_pcd *pcd, struct cfi_usb_ctrlrequest *ctrl);
+
+#endif /* (__DWC_OTG_CFI_H__) */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_cil.c b/drivers/usb/host/dwc_otg/dwc_otg_cil.c
new file mode 100644
index 000000000000..14300ad0f2af
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_cil.c
@@ -0,0 +1,7146 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_cil.c $
+ * $Revision: #191 $
+ * $Date: 2012/08/10 $
+ * $Change: 2047372 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+/** @file
+ *
+ * The Core Interface Layer provides basic services for accessing and
+ * managing the DWC_otg hardware. These services are used by both the
+ * Host Controller Driver and the Peripheral Controller Driver.
+ *
+ * The CIL manages the memory map for the core so that the HCD and PCD
+ * don't have to do this separately. It also handles basic tasks like
+ * reading/writing the registers and data FIFOs in the controller.
+ * Some of the data access functions provide encapsulation of several
+ * operations required to perform a task, such as writing multiple
+ * registers to start a transfer. Finally, the CIL performs basic
+ * services that are not specific to either the host or device modes
+ * of operation. These services include management of the OTG Host
+ * Negotiation Protocol (HNP) and Session Request Protocol (SRP). A
+ * Diagnostic API is also provided to allow testing of the controller
+ * hardware.
+ *
+ * The Core Interface Layer has the following requirements:
+ * - Provides basic controller operations.
+ * - Minimal use of OS services.
+ * - The OS services used will be abstracted by using inline functions
+ *	 or macros.
+ *
+ */
+
+#include "dwc_os.h"
+#include "dwc_otg_regs.h"
+#include "dwc_otg_cil.h"
+
+extern bool cil_force_host;
+
+static int dwc_otg_setup_params(dwc_otg_core_if_t * core_if);
+
+/**
+ * This function is called to initialize the DWC_otg CSR data
+ * structures. The register addresses in the device and host
+ * structures are initialized from the base address supplied by the
+ * caller. The calling function must make the OS calls to get the
+ * base address of the DWC_otg controller registers. The core_params
+ * argument holds the parameters that specify how the core should be
+ * configured.
+ *
+ * @param reg_base_addr Base address of DWC_otg core registers
+ *
+ */
+dwc_otg_core_if_t *dwc_otg_cil_init(const uint32_t * reg_base_addr)
+{
+	dwc_otg_core_if_t *core_if = 0;
+	dwc_otg_dev_if_t *dev_if = 0;
+	dwc_otg_host_if_t *host_if = 0;
+	uint8_t *reg_base = (uint8_t *) reg_base_addr;
+	int i = 0;
+
+	DWC_DEBUGPL(DBG_CILV, "%s(%p)\n", __func__, reg_base_addr);
+
+	core_if = DWC_ALLOC(sizeof(dwc_otg_core_if_t));
+
+	if (core_if == NULL) {
+		DWC_DEBUGPL(DBG_CIL,
+			    "Allocation of dwc_otg_core_if_t failed\n");
+		return 0;
+	}
+	core_if->core_global_regs = (dwc_otg_core_global_regs_t *) reg_base;
+
+	/*
+	 * Allocate the Device Mode structures.
+	 */
+	dev_if = DWC_ALLOC(sizeof(dwc_otg_dev_if_t));
+
+	if (dev_if == NULL) {
+		DWC_DEBUGPL(DBG_CIL, "Allocation of dwc_otg_dev_if_t failed\n");
+		DWC_FREE(core_if);
+		return 0;
+	}
+
+	dev_if->dev_global_regs =
+	    (dwc_otg_device_global_regs_t *) (reg_base +
+					      DWC_DEV_GLOBAL_REG_OFFSET);
+
+	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
+		dev_if->in_ep_regs[i] = (dwc_otg_dev_in_ep_regs_t *)
+		    (reg_base + DWC_DEV_IN_EP_REG_OFFSET +
+		     (i * DWC_EP_REG_OFFSET));
+
+		dev_if->out_ep_regs[i] = (dwc_otg_dev_out_ep_regs_t *)
+		    (reg_base + DWC_DEV_OUT_EP_REG_OFFSET +
+		     (i * DWC_EP_REG_OFFSET));
+		DWC_DEBUGPL(DBG_CILV, "in_ep_regs[%d]->diepctl=%p\n",
+			    i, &dev_if->in_ep_regs[i]->diepctl);
+		DWC_DEBUGPL(DBG_CILV, "out_ep_regs[%d]->doepctl=%p\n",
+			    i, &dev_if->out_ep_regs[i]->doepctl);
+	}
+
+	dev_if->speed = 0;	// unknown
+
+	core_if->dev_if = dev_if;
+
+	/*
+	 * Allocate the Host Mode structures.
+	 */
+	host_if = DWC_ALLOC(sizeof(dwc_otg_host_if_t));
+
+	if (host_if == NULL) {
+		DWC_DEBUGPL(DBG_CIL,
+			    "Allocation of dwc_otg_host_if_t failed\n");
+		DWC_FREE(dev_if);
+		DWC_FREE(core_if);
+		return 0;
+	}
+
+	host_if->host_global_regs = (dwc_otg_host_global_regs_t *)
+	    (reg_base + DWC_OTG_HOST_GLOBAL_REG_OFFSET);
+
+	host_if->hprt0 =
+	    (uint32_t *) (reg_base + DWC_OTG_HOST_PORT_REGS_OFFSET);
+
+	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
+		host_if->hc_regs[i] = (dwc_otg_hc_regs_t *)
+		    (reg_base + DWC_OTG_HOST_CHAN_REGS_OFFSET +
+		     (i * DWC_OTG_CHAN_REGS_OFFSET));
+		DWC_DEBUGPL(DBG_CILV, "hc_reg[%d]->hcchar=%p\n",
+			    i, &host_if->hc_regs[i]->hcchar);
+	}
+
+	host_if->num_host_channels = MAX_EPS_CHANNELS;
+	core_if->host_if = host_if;
+
+	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
+		core_if->data_fifo[i] =
+		    (uint32_t *) (reg_base + DWC_OTG_DATA_FIFO_OFFSET +
+				  (i * DWC_OTG_DATA_FIFO_SIZE));
+		DWC_DEBUGPL(DBG_CILV, "data_fifo[%d]=0x%08lx\n",
+			    i, (unsigned long)core_if->data_fifo[i]);
+	}
+
+	core_if->pcgcctl = (uint32_t *) (reg_base + DWC_OTG_PCGCCTL_OFFSET);
+
+	/* Initiate lx_state to L3 disconnected state */
+	core_if->lx_state = DWC_OTG_L3;
+	/*
+	 * Store the contents of the hardware configuration registers here for
+	 * easy access later.
+	 */
+	core_if->hwcfg1.d32 =
+	    DWC_READ_REG32(&core_if->core_global_regs->ghwcfg1);
+	core_if->hwcfg2.d32 =
+	    DWC_READ_REG32(&core_if->core_global_regs->ghwcfg2);
+	core_if->hwcfg3.d32 =
+	    DWC_READ_REG32(&core_if->core_global_regs->ghwcfg3);
+	core_if->hwcfg4.d32 =
+	    DWC_READ_REG32(&core_if->core_global_regs->ghwcfg4);
+
+	/* Force host mode to get HPTXFSIZ exact power on value */
+	{
+		gusbcfg_data_t gusbcfg = {.d32 = 0 };
+		gusbcfg.d32 =  DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+		gusbcfg.b.force_host_mode = 1;
+		DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, gusbcfg.d32);
+		dwc_mdelay(100);
+		core_if->hptxfsiz.d32 =
+		DWC_READ_REG32(&core_if->core_global_regs->hptxfsiz);
+		gusbcfg.d32 =  DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+		if (cil_force_host)
+			gusbcfg.b.force_host_mode = 1;
+		else
+			gusbcfg.b.force_host_mode = 0;
+		DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, gusbcfg.d32);
+		dwc_mdelay(100);
+	}
+
+	DWC_DEBUGPL(DBG_CILV, "hwcfg1=%08x\n", core_if->hwcfg1.d32);
+	DWC_DEBUGPL(DBG_CILV, "hwcfg2=%08x\n", core_if->hwcfg2.d32);
+	DWC_DEBUGPL(DBG_CILV, "hwcfg3=%08x\n", core_if->hwcfg3.d32);
+	DWC_DEBUGPL(DBG_CILV, "hwcfg4=%08x\n", core_if->hwcfg4.d32);
+
+	core_if->hcfg.d32 =
+	    DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
+	core_if->dcfg.d32 =
+	    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
+
+	DWC_DEBUGPL(DBG_CILV, "hcfg=%08x\n", core_if->hcfg.d32);
+	DWC_DEBUGPL(DBG_CILV, "dcfg=%08x\n", core_if->dcfg.d32);
+
+	DWC_DEBUGPL(DBG_CILV, "op_mode=%0x\n", core_if->hwcfg2.b.op_mode);
+	DWC_DEBUGPL(DBG_CILV, "arch=%0x\n", core_if->hwcfg2.b.architecture);
+	DWC_DEBUGPL(DBG_CILV, "num_dev_ep=%d\n", core_if->hwcfg2.b.num_dev_ep);
+	DWC_DEBUGPL(DBG_CILV, "num_host_chan=%d\n",
+		    core_if->hwcfg2.b.num_host_chan);
+	DWC_DEBUGPL(DBG_CILV, "nonperio_tx_q_depth=0x%0x\n",
+		    core_if->hwcfg2.b.nonperio_tx_q_depth);
+	DWC_DEBUGPL(DBG_CILV, "host_perio_tx_q_depth=0x%0x\n",
+		    core_if->hwcfg2.b.host_perio_tx_q_depth);
+	DWC_DEBUGPL(DBG_CILV, "dev_token_q_depth=0x%0x\n",
+		    core_if->hwcfg2.b.dev_token_q_depth);
+
+	DWC_DEBUGPL(DBG_CILV, "Total FIFO SZ=%d\n",
+		    core_if->hwcfg3.b.dfifo_depth);
+	DWC_DEBUGPL(DBG_CILV, "xfer_size_cntr_width=%0x\n",
+		    core_if->hwcfg3.b.xfer_size_cntr_width);
+
+	/*
+	 * Set the SRP sucess bit for FS-I2c
+	 */
+	core_if->srp_success = 0;
+	core_if->srp_timer_started = 0;
+
+	/*
+	 * Create new workqueue and init works
+	 */
+	core_if->wq_otg = DWC_WORKQ_ALLOC("dwc_otg");
+	if (core_if->wq_otg == 0) {
+		DWC_WARN("DWC_WORKQ_ALLOC failed\n");
+		DWC_FREE(host_if);
+		DWC_FREE(dev_if);
+		DWC_FREE(core_if);
+		return 0;
+	}
+
+	core_if->snpsid = DWC_READ_REG32(&core_if->core_global_regs->gsnpsid);
+
+	DWC_PRINTF("Core Release: %x.%x%x%x\n",
+		   (core_if->snpsid >> 12 & 0xF),
+		   (core_if->snpsid >> 8 & 0xF),
+		   (core_if->snpsid >> 4 & 0xF), (core_if->snpsid & 0xF));
+
+	core_if->wkp_timer = DWC_TIMER_ALLOC("Wake Up Timer",
+					     w_wakeup_detected, core_if);
+	if (core_if->wkp_timer == 0) {
+		DWC_WARN("DWC_TIMER_ALLOC failed\n");
+		DWC_FREE(host_if);
+		DWC_FREE(dev_if);
+		DWC_WORKQ_FREE(core_if->wq_otg);
+		DWC_FREE(core_if);
+		return 0;
+	}
+
+	if (dwc_otg_setup_params(core_if)) {
+		DWC_WARN("Error while setting core params\n");
+	}
+
+	core_if->hibernation_suspend = 0;
+
+	/** ADP initialization */
+	dwc_otg_adp_init(core_if);
+
+	return core_if;
+}
+
+/**
+ * This function frees the structures allocated by dwc_otg_cil_init().
+ *
+ * @param core_if The core interface pointer returned from
+ * 		  dwc_otg_cil_init().
+ *
+ */
+void dwc_otg_cil_remove(dwc_otg_core_if_t * core_if)
+{
+	dctl_data_t dctl = {.d32 = 0 };
+	DWC_DEBUGPL(DBG_CILV, "%s(%p)\n", __func__, core_if);
+
+	/* Disable all interrupts */
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gahbcfg, 1, 0);
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, 0);
+
+	dctl.b.sftdiscon = 1;
+	if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0,
+				 dctl.d32);
+	}
+
+	if (core_if->wq_otg) {
+		DWC_WORKQ_WAIT_WORK_DONE(core_if->wq_otg, 500);
+		DWC_WORKQ_FREE(core_if->wq_otg);
+	}
+	if (core_if->dev_if) {
+		DWC_FREE(core_if->dev_if);
+	}
+	if (core_if->host_if) {
+		DWC_FREE(core_if->host_if);
+	}
+
+	/** Remove ADP Stuff  */
+	dwc_otg_adp_remove(core_if);
+	if (core_if->core_params) {
+		DWC_FREE(core_if->core_params);
+	}
+	if (core_if->wkp_timer) {
+		DWC_TIMER_FREE(core_if->wkp_timer);
+	}
+	if (core_if->srp_timer) {
+		DWC_TIMER_FREE(core_if->srp_timer);
+	}
+	DWC_FREE(core_if);
+}
+
+/**
+ * This function enables the controller's Global Interrupt in the AHB Config
+ * register.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+void dwc_otg_enable_global_interrupts(dwc_otg_core_if_t * core_if)
+{
+	gahbcfg_data_t ahbcfg = {.d32 = 0 };
+	ahbcfg.b.glblintrmsk = 1;	/* Enable interrupts */
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gahbcfg, 0, ahbcfg.d32);
+}
+
+/**
+ * This function disables the controller's Global Interrupt in the AHB Config
+ * register.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+void dwc_otg_disable_global_interrupts(dwc_otg_core_if_t * core_if)
+{
+	gahbcfg_data_t ahbcfg = {.d32 = 0 };
+	ahbcfg.b.glblintrmsk = 1;	/* Disable interrupts */
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gahbcfg, ahbcfg.d32, 0);
+}
+
+/**
+ * This function initializes the commmon interrupts, used in both
+ * device and host modes.
+ *
+ * @param core_if Programming view of the DWC_otg controller
+ *
+ */
+static void dwc_otg_enable_common_interrupts(dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	/* Clear any pending OTG Interrupts */
+	DWC_WRITE_REG32(&global_regs->gotgint, 0xFFFFFFFF);
+
+	/* Clear any pending interrupts */
+	DWC_WRITE_REG32(&global_regs->gintsts, 0xFFFFFFFF);
+
+	/*
+	 * Enable the interrupts in the GINTMSK.
+	 */
+	intr_mask.b.modemismatch = 1;
+	intr_mask.b.otgintr = 1;
+
+	if (!core_if->dma_enable) {
+		intr_mask.b.rxstsqlvl = 1;
+	}
+
+	intr_mask.b.conidstschng = 1;
+	intr_mask.b.wkupintr = 1;
+	intr_mask.b.disconnect = 0;
+	intr_mask.b.usbsuspend = 1;
+	intr_mask.b.sessreqintr = 1;
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	if (core_if->core_params->lpm_enable) {
+		intr_mask.b.lpmtranrcvd = 1;
+	}
+#endif
+	DWC_WRITE_REG32(&global_regs->gintmsk, intr_mask.d32);
+}
+
+/*
+ * The restore operation is modified to support Synopsys Emulated Powerdown and
+ * Hibernation. This function is for exiting from Device mode hibernation by
+ * Host Initiated Resume/Reset and Device Initiated Remote-Wakeup.
+ * @param core_if Programming view of DWC_otg controller.
+ * @param rem_wakeup - indicates whether resume is initiated by Device or Host.
+ * @param reset - indicates whether resume is initiated by Reset.
+ */
+int dwc_otg_device_hibernation_restore(dwc_otg_core_if_t * core_if,
+				       int rem_wakeup, int reset)
+{
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+	pcgcctl_data_t pcgcctl = {.d32 = 0 };
+	dctl_data_t dctl = {.d32 = 0 };
+
+	int timeout = 2000;
+
+	if (!core_if->hibernation_suspend) {
+		DWC_PRINTF("Already exited from Hibernation\n");
+		return 1;
+	}
+
+	DWC_DEBUGPL(DBG_PCD, "%s called\n", __FUNCTION__);
+	/* Switch-on voltage to the core */
+	gpwrdn.b.pwrdnswtch = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Reset core */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Assert Restore signal */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.restore = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+	dwc_udelay(10);
+
+	/* Disable power clamps */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnclmp = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	if (rem_wakeup) {
+		dwc_udelay(70);
+	}
+
+	/* Deassert Reset core */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+	dwc_udelay(10);
+
+	/* Disable PMU interrupt */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuintsel = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	/* Mask interrupts from gpwrdn */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.connect_det_msk = 1;
+	gpwrdn.b.srp_det_msk = 1;
+	gpwrdn.b.disconn_det_msk = 1;
+	gpwrdn.b.rst_det_msk = 1;
+	gpwrdn.b.lnstchng_msk = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	/* Indicates that we are going out from hibernation */
+	core_if->hibernation_suspend = 0;
+
+	/*
+	 * Set Restore Essential Regs bit in PCGCCTL register, restore_mode = 1
+	 * indicates restore from remote_wakeup
+	 */
+	restore_essential_regs(core_if, rem_wakeup, 0);
+
+	/*
+	 * Wait a little for seeing new value of variable hibernation_suspend if
+	 * Restore done interrupt received before polling
+	 */
+	dwc_udelay(10);
+
+	if (core_if->hibernation_suspend == 0) {
+		/*
+		 * Wait For Restore_done Interrupt. This mechanism of polling the
+		 * interrupt is introduced to avoid any possible race conditions
+		 */
+		do {
+			gintsts_data_t gintsts;
+			gintsts.d32 =
+			    DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+			if (gintsts.b.restoredone) {
+				gintsts.d32 = 0;
+				gintsts.b.restoredone = 1;
+				DWC_WRITE_REG32(&core_if->core_global_regs->
+						gintsts, gintsts.d32);
+				DWC_PRINTF("Restore Done Interrupt seen\n");
+				break;
+			}
+			dwc_udelay(10);
+		} while (--timeout);
+		if (!timeout) {
+			DWC_PRINTF("Restore Done interrupt wasn't generated here\n");
+		}
+	}
+	/* Clear all pending interupts */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+
+	/* De-assert Restore */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.restore = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	if (!rem_wakeup) {
+		pcgcctl.d32 = 0;
+		pcgcctl.b.rstpdwnmodule = 1;
+		DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
+	}
+
+	/* Restore GUSBCFG and DCFG */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg,
+			core_if->gr_backup->gusbcfg_local);
+	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg,
+			core_if->dr_backup->dcfg);
+
+	/* De-assert Wakeup Logic */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuactv = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	if (!rem_wakeup) {
+		/* Set Device programming done bit */
+		dctl.b.pwronprgdone = 1;
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
+	} else {
+		/* Start Remote Wakeup Signaling */
+		dctl.d32 = core_if->dr_backup->dctl;
+		dctl.b.rmtwkupsig = 1;
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32);
+	}
+
+	dwc_mdelay(2);
+	/* Clear all pending interupts */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+
+	/* Restore global registers */
+	dwc_otg_restore_global_regs(core_if);
+	/* Restore device global registers */
+	dwc_otg_restore_dev_regs(core_if, rem_wakeup);
+
+	if (rem_wakeup) {
+		dwc_mdelay(7);
+		dctl.d32 = 0;
+		dctl.b.rmtwkupsig = 1;
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32, 0);
+	}
+
+	core_if->hibernation_suspend = 0;
+	/* The core will be in ON STATE */
+	core_if->lx_state = DWC_OTG_L0;
+	DWC_PRINTF("Hibernation recovery completes here\n");
+
+	return 1;
+}
+
+/*
+ * The restore operation is modified to support Synopsys Emulated Powerdown and
+ * Hibernation. This function is for exiting from Host mode hibernation by
+ * Host Initiated Resume/Reset and Device Initiated Remote-Wakeup.
+ * @param core_if Programming view of DWC_otg controller.
+ * @param rem_wakeup - indicates whether resume is initiated by Device or Host.
+ * @param reset - indicates whether resume is initiated by Reset.
+ */
+int dwc_otg_host_hibernation_restore(dwc_otg_core_if_t * core_if,
+				     int rem_wakeup, int reset)
+{
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+	hprt0_data_t hprt0 = {.d32 = 0 };
+
+	int timeout = 2000;
+
+	DWC_DEBUGPL(DBG_HCD, "%s called\n", __FUNCTION__);
+	/* Switch-on voltage to the core */
+	gpwrdn.b.pwrdnswtch = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Reset core */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Assert Restore signal */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.restore = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+	dwc_udelay(10);
+
+	/* Disable power clamps */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnclmp = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	if (!rem_wakeup) {
+		dwc_udelay(50);
+	}
+
+	/* Deassert Reset core */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+	dwc_udelay(10);
+
+	/* Disable PMU interrupt */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuintsel = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	gpwrdn.d32 = 0;
+	gpwrdn.b.connect_det_msk = 1;
+	gpwrdn.b.srp_det_msk = 1;
+	gpwrdn.b.disconn_det_msk = 1;
+	gpwrdn.b.rst_det_msk = 1;
+	gpwrdn.b.lnstchng_msk = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	/* Indicates that we are going out from hibernation */
+	core_if->hibernation_suspend = 0;
+
+	/* Set Restore Essential Regs bit in PCGCCTL register */
+	restore_essential_regs(core_if, rem_wakeup, 1);
+
+	/* Wait a little for seeing new value of variable hibernation_suspend if
+	 * Restore done interrupt received before polling */
+	dwc_udelay(10);
+
+	if (core_if->hibernation_suspend == 0) {
+		/* Wait For Restore_done Interrupt. This mechanism of polling the
+		 * interrupt is introduced to avoid any possible race conditions
+		 */
+		do {
+			gintsts_data_t gintsts;
+			gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+			if (gintsts.b.restoredone) {
+				gintsts.d32 = 0;
+				gintsts.b.restoredone = 1;
+			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+				DWC_DEBUGPL(DBG_HCD,"Restore Done Interrupt seen\n");
+				break;
+			}
+			dwc_udelay(10);
+		} while (--timeout);
+		if (!timeout) {
+			DWC_WARN("Restore Done interrupt wasn't generated\n");
+		}
+	}
+
+	/* Set the flag's value to 0 again after receiving restore done interrupt */
+	core_if->hibernation_suspend = 0;
+
+	/* This step is not described in functional spec but if not wait for this
+	 * delay, mismatch interrupts occurred because just after restore core is
+	 * in Device mode(gintsts.curmode == 0) */
+	dwc_mdelay(100);
+
+	/* Clear all pending interrupts */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+
+	/* De-assert Restore */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.restore = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Restore GUSBCFG and HCFG */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg,
+			core_if->gr_backup->gusbcfg_local);
+	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg,
+			core_if->hr_backup->hcfg_local);
+
+	/* De-assert Wakeup Logic */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuactv = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Start the Resume operation by programming HPRT0 */
+	hprt0.d32 = core_if->hr_backup->hprt0_local;
+	hprt0.b.prtpwr = 1;
+	hprt0.b.prtena = 0;
+	hprt0.b.prtsusp = 0;
+	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+
+	DWC_PRINTF("Resume Starts Now\n");
+	if (!reset) {		// Indicates it is Resume Operation
+		hprt0.d32 = core_if->hr_backup->hprt0_local;
+		hprt0.b.prtres = 1;
+		hprt0.b.prtpwr = 1;
+		hprt0.b.prtena = 0;
+		hprt0.b.prtsusp = 0;
+		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+
+		if (!rem_wakeup)
+			hprt0.b.prtres = 0;
+		/* Wait for Resume time and then program HPRT again */
+		dwc_mdelay(100);
+		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+
+	} else {		// Indicates it is Reset Operation
+		hprt0.d32 = core_if->hr_backup->hprt0_local;
+		hprt0.b.prtrst = 1;
+		hprt0.b.prtpwr = 1;
+		hprt0.b.prtena = 0;
+		hprt0.b.prtsusp = 0;
+		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+		/* Wait for Reset time and then program HPRT again */
+		dwc_mdelay(60);
+		hprt0.b.prtrst = 0;
+		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+	}
+	/* Clear all interrupt status */
+	hprt0.d32 = dwc_otg_read_hprt0(core_if);
+	hprt0.b.prtconndet = 1;
+	hprt0.b.prtenchng = 1;
+	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+
+	/* Clear all pending interupts */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+
+	/* Restore global registers */
+	dwc_otg_restore_global_regs(core_if);
+	/* Restore host global registers */
+	dwc_otg_restore_host_regs(core_if, reset);
+
+	/* The core will be in ON STATE */
+	core_if->lx_state = DWC_OTG_L0;
+	DWC_PRINTF("Hibernation recovery is complete here\n");
+	return 0;
+}
+
+/** Saves some register values into system memory. */
+int dwc_otg_save_global_regs(dwc_otg_core_if_t * core_if)
+{
+	struct dwc_otg_global_regs_backup *gr;
+	int i;
+
+	gr = core_if->gr_backup;
+	if (!gr) {
+		gr = DWC_ALLOC(sizeof(*gr));
+		if (!gr) {
+			return -DWC_E_NO_MEMORY;
+		}
+		core_if->gr_backup = gr;
+	}
+
+	gr->gotgctl_local = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
+	gr->gintmsk_local = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
+	gr->gahbcfg_local = DWC_READ_REG32(&core_if->core_global_regs->gahbcfg);
+	gr->gusbcfg_local = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+	gr->grxfsiz_local = DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
+	gr->gnptxfsiz_local = DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz);
+	gr->hptxfsiz_local = DWC_READ_REG32(&core_if->core_global_regs->hptxfsiz);
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	gr->glpmcfg_local = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+#endif
+	gr->gi2cctl_local = DWC_READ_REG32(&core_if->core_global_regs->gi2cctl);
+	gr->pcgcctl_local = DWC_READ_REG32(core_if->pcgcctl);
+	gr->gdfifocfg_local =
+	    DWC_READ_REG32(&core_if->core_global_regs->gdfifocfg);
+	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
+		gr->dtxfsiz_local[i] =
+		    DWC_READ_REG32(&(core_if->core_global_regs->dtxfsiz[i]));
+	}
+
+	DWC_DEBUGPL(DBG_ANY, "===========Backing Global registers==========\n");
+	DWC_DEBUGPL(DBG_ANY, "Backed up gotgctl   = %08x\n", gr->gotgctl_local);
+	DWC_DEBUGPL(DBG_ANY, "Backed up gintmsk   = %08x\n", gr->gintmsk_local);
+	DWC_DEBUGPL(DBG_ANY, "Backed up gahbcfg   = %08x\n", gr->gahbcfg_local);
+	DWC_DEBUGPL(DBG_ANY, "Backed up gusbcfg   = %08x\n", gr->gusbcfg_local);
+	DWC_DEBUGPL(DBG_ANY, "Backed up grxfsiz   = %08x\n", gr->grxfsiz_local);
+	DWC_DEBUGPL(DBG_ANY, "Backed up gnptxfsiz = %08x\n",
+		    gr->gnptxfsiz_local);
+	DWC_DEBUGPL(DBG_ANY, "Backed up hptxfsiz  = %08x\n",
+		    gr->hptxfsiz_local);
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	DWC_DEBUGPL(DBG_ANY, "Backed up glpmcfg   = %08x\n", gr->glpmcfg_local);
+#endif
+	DWC_DEBUGPL(DBG_ANY, "Backed up gi2cctl   = %08x\n", gr->gi2cctl_local);
+	DWC_DEBUGPL(DBG_ANY, "Backed up pcgcctl   = %08x\n", gr->pcgcctl_local);
+	DWC_DEBUGPL(DBG_ANY,"Backed up gdfifocfg   = %08x\n",gr->gdfifocfg_local);
+
+	return 0;
+}
+
+/** Saves GINTMSK register before setting the msk bits. */
+int dwc_otg_save_gintmsk_reg(dwc_otg_core_if_t * core_if)
+{
+	struct dwc_otg_global_regs_backup *gr;
+
+	gr = core_if->gr_backup;
+	if (!gr) {
+		gr = DWC_ALLOC(sizeof(*gr));
+		if (!gr) {
+			return -DWC_E_NO_MEMORY;
+		}
+		core_if->gr_backup = gr;
+	}
+
+	gr->gintmsk_local = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
+
+	DWC_DEBUGPL(DBG_ANY,"=============Backing GINTMSK registers============\n");
+	DWC_DEBUGPL(DBG_ANY, "Backed up gintmsk   = %08x\n", gr->gintmsk_local);
+
+	return 0;
+}
+
+int dwc_otg_save_dev_regs(dwc_otg_core_if_t * core_if)
+{
+	struct dwc_otg_dev_regs_backup *dr;
+	int i;
+
+	dr = core_if->dr_backup;
+	if (!dr) {
+		dr = DWC_ALLOC(sizeof(*dr));
+		if (!dr) {
+			return -DWC_E_NO_MEMORY;
+		}
+		core_if->dr_backup = dr;
+	}
+
+	dr->dcfg = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
+	dr->dctl = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
+	dr->daintmsk =
+	    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daintmsk);
+	dr->diepmsk =
+	    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->diepmsk);
+	dr->doepmsk =
+	    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->doepmsk);
+
+	for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
+		dr->diepctl[i] =
+		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[i]->diepctl);
+		dr->dieptsiz[i] =
+		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[i]->dieptsiz);
+		dr->diepdma[i] =
+		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[i]->diepdma);
+	}
+
+	DWC_DEBUGPL(DBG_ANY,
+		    "=============Backing Host registers==============\n");
+	DWC_DEBUGPL(DBG_ANY, "Backed up dcfg            = %08x\n", dr->dcfg);
+	DWC_DEBUGPL(DBG_ANY, "Backed up dctl        = %08x\n", dr->dctl);
+	DWC_DEBUGPL(DBG_ANY, "Backed up daintmsk            = %08x\n",
+		    dr->daintmsk);
+	DWC_DEBUGPL(DBG_ANY, "Backed up diepmsk        = %08x\n", dr->diepmsk);
+	DWC_DEBUGPL(DBG_ANY, "Backed up doepmsk        = %08x\n", dr->doepmsk);
+	for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
+		DWC_DEBUGPL(DBG_ANY, "Backed up diepctl[%d]        = %08x\n", i,
+			    dr->diepctl[i]);
+		DWC_DEBUGPL(DBG_ANY, "Backed up dieptsiz[%d]        = %08x\n",
+			    i, dr->dieptsiz[i]);
+		DWC_DEBUGPL(DBG_ANY, "Backed up diepdma[%d]        = %08x\n", i,
+			    dr->diepdma[i]);
+	}
+
+	return 0;
+}
+
+int dwc_otg_save_host_regs(dwc_otg_core_if_t * core_if)
+{
+	struct dwc_otg_host_regs_backup *hr;
+	int i;
+
+	hr = core_if->hr_backup;
+	if (!hr) {
+		hr = DWC_ALLOC(sizeof(*hr));
+		if (!hr) {
+			return -DWC_E_NO_MEMORY;
+		}
+		core_if->hr_backup = hr;
+	}
+
+	hr->hcfg_local =
+	    DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
+	hr->haintmsk_local =
+	    DWC_READ_REG32(&core_if->host_if->host_global_regs->haintmsk);
+	for (i = 0; i < dwc_otg_get_param_host_channels(core_if); ++i) {
+		hr->hcintmsk_local[i] =
+		    DWC_READ_REG32(&core_if->host_if->hc_regs[i]->hcintmsk);
+	}
+	hr->hprt0_local = DWC_READ_REG32(core_if->host_if->hprt0);
+	hr->hfir_local =
+	    DWC_READ_REG32(&core_if->host_if->host_global_regs->hfir);
+
+	DWC_DEBUGPL(DBG_ANY,
+		    "=============Backing Host registers===============\n");
+	DWC_DEBUGPL(DBG_ANY, "Backed up hcfg		= %08x\n",
+		    hr->hcfg_local);
+	DWC_DEBUGPL(DBG_ANY, "Backed up haintmsk = %08x\n", hr->haintmsk_local);
+	for (i = 0; i < dwc_otg_get_param_host_channels(core_if); ++i) {
+		DWC_DEBUGPL(DBG_ANY, "Backed up hcintmsk[%02d]=%08x\n", i,
+			    hr->hcintmsk_local[i]);
+	}
+	DWC_DEBUGPL(DBG_ANY, "Backed up hprt0           = %08x\n",
+		    hr->hprt0_local);
+	DWC_DEBUGPL(DBG_ANY, "Backed up hfir           = %08x\n",
+		    hr->hfir_local);
+
+	return 0;
+}
+
+int dwc_otg_restore_global_regs(dwc_otg_core_if_t *core_if)
+{
+	struct dwc_otg_global_regs_backup *gr;
+	int i;
+
+	gr = core_if->gr_backup;
+	if (!gr) {
+		return -DWC_E_INVALID;
+	}
+
+	DWC_WRITE_REG32(&core_if->core_global_regs->gotgctl, gr->gotgctl_local);
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gr->gintmsk_local);
+	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, gr->gusbcfg_local);
+	DWC_WRITE_REG32(&core_if->core_global_regs->gahbcfg, gr->gahbcfg_local);
+	DWC_WRITE_REG32(&core_if->core_global_regs->grxfsiz, gr->grxfsiz_local);
+	DWC_WRITE_REG32(&core_if->core_global_regs->gnptxfsiz,
+			gr->gnptxfsiz_local);
+	DWC_WRITE_REG32(&core_if->core_global_regs->hptxfsiz,
+			gr->hptxfsiz_local);
+	DWC_WRITE_REG32(&core_if->core_global_regs->gdfifocfg,
+			gr->gdfifocfg_local);
+	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
+		DWC_WRITE_REG32(&core_if->core_global_regs->dtxfsiz[i],
+				gr->dtxfsiz_local[i]);
+	}
+
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+	DWC_WRITE_REG32(core_if->host_if->hprt0, 0x0000100A);
+	DWC_WRITE_REG32(&core_if->core_global_regs->gahbcfg,
+			(gr->gahbcfg_local));
+	return 0;
+}
+
+int dwc_otg_restore_dev_regs(dwc_otg_core_if_t * core_if, int rem_wakeup)
+{
+	struct dwc_otg_dev_regs_backup *dr;
+	int i;
+
+	dr = core_if->dr_backup;
+
+	if (!dr) {
+		return -DWC_E_INVALID;
+	}
+
+	if (!rem_wakeup) {
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl,
+				dr->dctl);
+	}
+
+	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->daintmsk, dr->daintmsk);
+	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->diepmsk, dr->diepmsk);
+	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->doepmsk, dr->doepmsk);
+
+	for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
+		DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->dieptsiz, dr->dieptsiz[i]);
+		DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->diepdma, dr->diepdma[i]);
+		DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[i]->diepctl, dr->diepctl[i]);
+	}
+
+	return 0;
+}
+
+int dwc_otg_restore_host_regs(dwc_otg_core_if_t * core_if, int reset)
+{
+	struct dwc_otg_host_regs_backup *hr;
+	int i;
+	hr = core_if->hr_backup;
+
+	if (!hr) {
+		return -DWC_E_INVALID;
+	}
+
+	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg, hr->hcfg_local);
+	//if (!reset)
+	//{
+	//      DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hfir, hr->hfir_local);
+	//}
+
+	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->haintmsk,
+			hr->haintmsk_local);
+	for (i = 0; i < dwc_otg_get_param_host_channels(core_if); ++i) {
+		DWC_WRITE_REG32(&core_if->host_if->hc_regs[i]->hcintmsk,
+				hr->hcintmsk_local[i]);
+	}
+
+	return 0;
+}
+
+int restore_lpm_i2c_regs(dwc_otg_core_if_t * core_if)
+{
+	struct dwc_otg_global_regs_backup *gr;
+
+	gr = core_if->gr_backup;
+
+	/* Restore values for LPM and I2C */
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, gr->glpmcfg_local);
+#endif
+	DWC_WRITE_REG32(&core_if->core_global_regs->gi2cctl, gr->gi2cctl_local);
+
+	return 0;
+}
+
+int restore_essential_regs(dwc_otg_core_if_t * core_if, int rmode, int is_host)
+{
+	struct dwc_otg_global_regs_backup *gr;
+	pcgcctl_data_t pcgcctl = {.d32 = 0 };
+	gahbcfg_data_t gahbcfg = {.d32 = 0 };
+	gusbcfg_data_t gusbcfg = {.d32 = 0 };
+	gintmsk_data_t gintmsk = {.d32 = 0 };
+
+	/* Restore LPM and I2C registers */
+	restore_lpm_i2c_regs(core_if);
+
+	/* Set PCGCCTL to 0 */
+	DWC_WRITE_REG32(core_if->pcgcctl, 0x00000000);
+
+	gr = core_if->gr_backup;
+	/* Load restore values for [31:14] bits */
+	DWC_WRITE_REG32(core_if->pcgcctl,
+			((gr->pcgcctl_local & 0xffffc000) | 0x00020000));
+
+	/* Umnask global Interrupt in GAHBCFG and restore it */
+	gahbcfg.d32 = gr->gahbcfg_local;
+	gahbcfg.b.glblintrmsk = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gahbcfg, gahbcfg.d32);
+
+	/* Clear all pending interupts */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+
+	/* Unmask restore done interrupt */
+	gintmsk.b.restoredone = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gintmsk.d32);
+
+	/* Restore GUSBCFG and HCFG/DCFG */
+	gusbcfg.d32 = core_if->gr_backup->gusbcfg_local;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, gusbcfg.d32);
+
+	if (is_host) {
+		hcfg_data_t hcfg = {.d32 = 0 };
+		hcfg.d32 = core_if->hr_backup->hcfg_local;
+		DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg,
+				hcfg.d32);
+
+		/* Load restore values for [31:14] bits */
+		pcgcctl.d32 = gr->pcgcctl_local & 0xffffc000;
+		pcgcctl.d32 = gr->pcgcctl_local | 0x00020000;
+
+		if (rmode)
+			pcgcctl.b.restoremode = 1;
+		DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
+		dwc_udelay(10);
+
+		/* Load restore values for [31:14] bits and set EssRegRestored bit */
+		pcgcctl.d32 = gr->pcgcctl_local | 0xffffc000;
+		pcgcctl.d32 = gr->pcgcctl_local & 0xffffc000;
+		pcgcctl.b.ess_reg_restored = 1;
+		if (rmode)
+			pcgcctl.b.restoremode = 1;
+		DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
+	} else {
+		dcfg_data_t dcfg = {.d32 = 0 };
+		dcfg.d32 = core_if->dr_backup->dcfg;
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg, dcfg.d32);
+
+		/* Load restore values for [31:14] bits */
+		pcgcctl.d32 = gr->pcgcctl_local & 0xffffc000;
+		pcgcctl.d32 = gr->pcgcctl_local | 0x00020000;
+		if (!rmode) {
+			pcgcctl.d32 |= 0x208;
+		}
+		DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
+		dwc_udelay(10);
+
+		/* Load restore values for [31:14] bits */
+		pcgcctl.d32 = gr->pcgcctl_local & 0xffffc000;
+		pcgcctl.d32 = gr->pcgcctl_local | 0x00020000;
+		pcgcctl.b.ess_reg_restored = 1;
+		if (!rmode)
+			pcgcctl.d32 |= 0x208;
+		DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
+	}
+
+	return 0;
+}
+
+/**
+ * Initializes the FSLSPClkSel field of the HCFG register depending on the PHY
+ * type.
+ */
+static void init_fslspclksel(dwc_otg_core_if_t * core_if)
+{
+	uint32_t val;
+	hcfg_data_t hcfg;
+
+	if (((core_if->hwcfg2.b.hs_phy_type == 2) &&
+	     (core_if->hwcfg2.b.fs_phy_type == 1) &&
+	     (core_if->core_params->ulpi_fs_ls)) ||
+	    (core_if->core_params->phy_type == DWC_PHY_TYPE_PARAM_FS)) {
+		/* Full speed PHY */
+		val = DWC_HCFG_48_MHZ;
+	} else {
+		/* High speed PHY running at full speed or high speed */
+		val = DWC_HCFG_30_60_MHZ;
+	}
+
+	DWC_DEBUGPL(DBG_CIL, "Initializing HCFG.FSLSPClkSel to 0x%1x\n", val);
+	hcfg.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
+	hcfg.b.fslspclksel = val;
+	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg, hcfg.d32);
+}
+
+/**
+ * Initializes the DevSpd field of the DCFG register depending on the PHY type
+ * and the enumeration speed of the device.
+ */
+static void init_devspd(dwc_otg_core_if_t * core_if)
+{
+	uint32_t val;
+	dcfg_data_t dcfg;
+
+	if (((core_if->hwcfg2.b.hs_phy_type == 2) &&
+	     (core_if->hwcfg2.b.fs_phy_type == 1) &&
+	     (core_if->core_params->ulpi_fs_ls)) ||
+	    (core_if->core_params->phy_type == DWC_PHY_TYPE_PARAM_FS)) {
+		/* Full speed PHY */
+		val = 0x3;
+	} else if (core_if->core_params->speed == DWC_SPEED_PARAM_FULL) {
+		/* High speed PHY running at full speed */
+		val = 0x1;
+	} else {
+		/* High speed PHY running at high speed */
+		val = 0x0;
+	}
+
+	DWC_DEBUGPL(DBG_CIL, "Initializing DCFG.DevSpd to 0x%1x\n", val);
+
+	dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
+	dcfg.b.devspd = val;
+	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg, dcfg.d32);
+}
+
+/**
+ * This function calculates the number of IN EPS
+ * using GHWCFG1 and GHWCFG2 registers values
+ *
+ * @param core_if Programming view of the DWC_otg controller
+ */
+static uint32_t calc_num_in_eps(dwc_otg_core_if_t * core_if)
+{
+	uint32_t num_in_eps = 0;
+	uint32_t num_eps = core_if->hwcfg2.b.num_dev_ep;
+	uint32_t hwcfg1 = core_if->hwcfg1.d32 >> 3;
+	uint32_t num_tx_fifos = core_if->hwcfg4.b.num_in_eps;
+	int i;
+
+	for (i = 0; i < num_eps; ++i) {
+		if (!(hwcfg1 & 0x1))
+			num_in_eps++;
+
+		hwcfg1 >>= 2;
+	}
+
+	if (core_if->hwcfg4.b.ded_fifo_en) {
+		num_in_eps =
+		    (num_in_eps > num_tx_fifos) ? num_tx_fifos : num_in_eps;
+	}
+
+	return num_in_eps;
+}
+
+/**
+ * This function calculates the number of OUT EPS
+ * using GHWCFG1 and GHWCFG2 registers values
+ *
+ * @param core_if Programming view of the DWC_otg controller
+ */
+static uint32_t calc_num_out_eps(dwc_otg_core_if_t * core_if)
+{
+	uint32_t num_out_eps = 0;
+	uint32_t num_eps = core_if->hwcfg2.b.num_dev_ep;
+	uint32_t hwcfg1 = core_if->hwcfg1.d32 >> 2;
+	int i;
+
+	for (i = 0; i < num_eps; ++i) {
+		if (!(hwcfg1 & 0x1))
+			num_out_eps++;
+
+		hwcfg1 >>= 2;
+	}
+	return num_out_eps;
+}
+
+/**
+ * This function initializes the DWC_otg controller registers and
+ * prepares the core for device mode or host mode operation.
+ *
+ * @param core_if Programming view of the DWC_otg controller
+ *
+ */
+void dwc_otg_core_init(dwc_otg_core_if_t * core_if)
+{
+	int i = 0;
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	gahbcfg_data_t ahbcfg = {.d32 = 0 };
+	gusbcfg_data_t usbcfg = {.d32 = 0 };
+	gi2cctl_data_t i2cctl = {.d32 = 0 };
+
+	DWC_DEBUGPL(DBG_CILV, "dwc_otg_core_init(%p) regs at %p\n",
+                    core_if, global_regs);
+
+	/* Common Initialization */
+	usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
+
+	/* Program the ULPI External VBUS bit if needed */
+	usbcfg.b.ulpi_ext_vbus_drv =
+	    (core_if->core_params->phy_ulpi_ext_vbus ==
+	     DWC_PHY_ULPI_EXTERNAL_VBUS) ? 1 : 0;
+
+	/* Set external TS Dline pulsing */
+	usbcfg.b.term_sel_dl_pulse =
+	    (core_if->core_params->ts_dline == 1) ? 1 : 0;
+	DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
+
+	/* Reset the Controller */
+	dwc_otg_core_reset(core_if);
+
+	core_if->adp_enable = core_if->core_params->adp_supp_enable;
+	core_if->power_down = core_if->core_params->power_down;
+	core_if->otg_sts = 0;
+
+	/* Initialize parameters from Hardware configuration registers. */
+	dev_if->num_in_eps = calc_num_in_eps(core_if);
+	dev_if->num_out_eps = calc_num_out_eps(core_if);
+
+	DWC_DEBUGPL(DBG_CIL, "num_dev_perio_in_ep=%d\n",
+		    core_if->hwcfg4.b.num_dev_perio_in_ep);
+
+	for (i = 0; i < core_if->hwcfg4.b.num_dev_perio_in_ep; i++) {
+		dev_if->perio_tx_fifo_size[i] =
+		    DWC_READ_REG32(&global_regs->dtxfsiz[i]) >> 16;
+		DWC_DEBUGPL(DBG_CIL, "Periodic Tx FIFO SZ #%d=0x%0x\n",
+			    i, dev_if->perio_tx_fifo_size[i]);
+	}
+
+	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+		dev_if->tx_fifo_size[i] =
+		    DWC_READ_REG32(&global_regs->dtxfsiz[i]) >> 16;
+		DWC_DEBUGPL(DBG_CIL, "Tx FIFO SZ #%d=0x%0x\n",
+			    i, dev_if->tx_fifo_size[i]);
+	}
+
+	core_if->total_fifo_size = core_if->hwcfg3.b.dfifo_depth;
+	core_if->rx_fifo_size = DWC_READ_REG32(&global_regs->grxfsiz);
+	core_if->nperio_tx_fifo_size =
+	    DWC_READ_REG32(&global_regs->gnptxfsiz) >> 16;
+
+	DWC_DEBUGPL(DBG_CIL, "Total FIFO SZ=%d\n", core_if->total_fifo_size);
+	DWC_DEBUGPL(DBG_CIL, "Rx FIFO SZ=%d\n", core_if->rx_fifo_size);
+	DWC_DEBUGPL(DBG_CIL, "NP Tx FIFO SZ=%d\n",
+		    core_if->nperio_tx_fifo_size);
+
+	/* This programming sequence needs to happen in FS mode before any other
+	 * programming occurs */
+	if ((core_if->core_params->speed == DWC_SPEED_PARAM_FULL) &&
+	    (core_if->core_params->phy_type == DWC_PHY_TYPE_PARAM_FS)) {
+		/* If FS mode with FS PHY */
+
+		/* core_init() is now called on every switch so only call the
+		 * following for the first time through. */
+		if (!core_if->phy_init_done) {
+			core_if->phy_init_done = 1;
+			DWC_DEBUGPL(DBG_CIL, "FS_PHY detected\n");
+			usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
+			usbcfg.b.physel = 1;
+			DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
+
+			/* Reset after a PHY select */
+			dwc_otg_core_reset(core_if);
+		}
+
+		/* Program DCFG.DevSpd or HCFG.FSLSPclkSel to 48Mhz in FS.      Also
+		 * do this on HNP Dev/Host mode switches (done in dev_init and
+		 * host_init). */
+		if (dwc_otg_is_host_mode(core_if)) {
+			init_fslspclksel(core_if);
+		} else {
+			init_devspd(core_if);
+		}
+
+		if (core_if->core_params->i2c_enable) {
+			DWC_DEBUGPL(DBG_CIL, "FS_PHY Enabling I2c\n");
+			/* Program GUSBCFG.OtgUtmifsSel to I2C */
+			usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
+			usbcfg.b.otgutmifssel = 1;
+			DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
+
+			/* Program GI2CCTL.I2CEn */
+			i2cctl.d32 = DWC_READ_REG32(&global_regs->gi2cctl);
+			i2cctl.b.i2cdevaddr = 1;
+			i2cctl.b.i2cen = 0;
+			DWC_WRITE_REG32(&global_regs->gi2cctl, i2cctl.d32);
+			i2cctl.b.i2cen = 1;
+			DWC_WRITE_REG32(&global_regs->gi2cctl, i2cctl.d32);
+		}
+
+	} /* endif speed == DWC_SPEED_PARAM_FULL */
+	else {
+		/* High speed PHY. */
+		if (!core_if->phy_init_done) {
+			core_if->phy_init_done = 1;
+			/* HS PHY parameters.  These parameters are preserved
+			 * during soft reset so only program the first time.  Do
+			 * a soft reset immediately after setting phyif.  */
+
+			if (core_if->core_params->phy_type == 2) {
+				/* ULPI interface */
+				usbcfg.b.ulpi_utmi_sel = 1;
+				usbcfg.b.phyif = 0;
+				usbcfg.b.ddrsel =
+				    core_if->core_params->phy_ulpi_ddr;
+			} else if (core_if->core_params->phy_type == 1) {
+				/* UTMI+ interface */
+				usbcfg.b.ulpi_utmi_sel = 0;
+				if (core_if->core_params->phy_utmi_width == 16) {
+					usbcfg.b.phyif = 1;
+
+				} else {
+					usbcfg.b.phyif = 0;
+				}
+			} else {
+				DWC_ERROR("FS PHY TYPE\n");
+			}
+			DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
+			/* Reset after setting the PHY parameters */
+			dwc_otg_core_reset(core_if);
+		}
+	}
+
+	if ((core_if->hwcfg2.b.hs_phy_type == 2) &&
+	    (core_if->hwcfg2.b.fs_phy_type == 1) &&
+	    (core_if->core_params->ulpi_fs_ls)) {
+		DWC_DEBUGPL(DBG_CIL, "Setting ULPI FSLS\n");
+		usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
+		usbcfg.b.ulpi_fsls = 1;
+		usbcfg.b.ulpi_clk_sus_m = 1;
+		DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
+	} else {
+		usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
+		usbcfg.b.ulpi_fsls = 0;
+		usbcfg.b.ulpi_clk_sus_m = 0;
+		DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
+	}
+
+	/* Program the GAHBCFG Register. */
+	switch (core_if->hwcfg2.b.architecture) {
+
+	case DWC_SLAVE_ONLY_ARCH:
+		DWC_DEBUGPL(DBG_CIL, "Slave Only Mode\n");
+		ahbcfg.b.nptxfemplvl_txfemplvl =
+		    DWC_GAHBCFG_TXFEMPTYLVL_HALFEMPTY;
+		ahbcfg.b.ptxfemplvl = DWC_GAHBCFG_TXFEMPTYLVL_HALFEMPTY;
+		core_if->dma_enable = 0;
+		core_if->dma_desc_enable = 0;
+		break;
+
+	case DWC_EXT_DMA_ARCH:
+		DWC_DEBUGPL(DBG_CIL, "External DMA Mode\n");
+		{
+			uint8_t brst_sz = core_if->core_params->dma_burst_size;
+			ahbcfg.b.hburstlen = 0;
+			while (brst_sz > 1) {
+				ahbcfg.b.hburstlen++;
+				brst_sz >>= 1;
+			}
+		}
+		core_if->dma_enable = (core_if->core_params->dma_enable != 0);
+		core_if->dma_desc_enable =
+		    (core_if->core_params->dma_desc_enable != 0);
+		break;
+
+	case DWC_INT_DMA_ARCH:
+		DWC_DEBUGPL(DBG_CIL, "Internal DMA Mode\n");
+		/* Old value was DWC_GAHBCFG_INT_DMA_BURST_INCR - done for
+		  Host mode ISOC in issue fix - vahrama */
+		/* Broadcom had altered to (1<<3)|(0<<0) - WRESP=1, max 4 beats */
+		ahbcfg.b.hburstlen = (1<<3)|(0<<0);//DWC_GAHBCFG_INT_DMA_BURST_INCR4;
+		core_if->dma_enable = (core_if->core_params->dma_enable != 0);
+		core_if->dma_desc_enable =
+		    (core_if->core_params->dma_desc_enable != 0);
+		break;
+
+	}
+	if (core_if->dma_enable) {
+		if (core_if->dma_desc_enable) {
+			DWC_PRINTF("Using Descriptor DMA mode\n");
+		} else {
+			DWC_PRINTF("Using Buffer DMA mode\n");
+
+		}
+	} else {
+		DWC_PRINTF("Using Slave mode\n");
+		core_if->dma_desc_enable = 0;
+	}
+
+	if (core_if->core_params->ahb_single) {
+		ahbcfg.b.ahbsingle = 1;
+	}
+
+	ahbcfg.b.dmaenable = core_if->dma_enable;
+	DWC_WRITE_REG32(&global_regs->gahbcfg, ahbcfg.d32);
+
+	core_if->en_multiple_tx_fifo = core_if->hwcfg4.b.ded_fifo_en;
+
+	core_if->pti_enh_enable = core_if->core_params->pti_enable != 0;
+	core_if->multiproc_int_enable = core_if->core_params->mpi_enable;
+	DWC_PRINTF("Periodic Transfer Interrupt Enhancement - %s\n",
+		   ((core_if->pti_enh_enable) ? "enabled" : "disabled"));
+	DWC_PRINTF("Multiprocessor Interrupt Enhancement - %s\n",
+		   ((core_if->multiproc_int_enable) ? "enabled" : "disabled"));
+
+	/*
+	 * Program the GUSBCFG register.
+	 */
+	usbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
+
+	switch (core_if->hwcfg2.b.op_mode) {
+	case DWC_MODE_HNP_SRP_CAPABLE:
+		usbcfg.b.hnpcap = (core_if->core_params->otg_cap ==
+				   DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE);
+		usbcfg.b.srpcap = (core_if->core_params->otg_cap !=
+				   DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
+		break;
+
+	case DWC_MODE_SRP_ONLY_CAPABLE:
+		usbcfg.b.hnpcap = 0;
+		usbcfg.b.srpcap = (core_if->core_params->otg_cap !=
+				   DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
+		break;
+
+	case DWC_MODE_NO_HNP_SRP_CAPABLE:
+		usbcfg.b.hnpcap = 0;
+		usbcfg.b.srpcap = 0;
+		break;
+
+	case DWC_MODE_SRP_CAPABLE_DEVICE:
+		usbcfg.b.hnpcap = 0;
+		usbcfg.b.srpcap = (core_if->core_params->otg_cap !=
+				   DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
+		break;
+
+	case DWC_MODE_NO_SRP_CAPABLE_DEVICE:
+		usbcfg.b.hnpcap = 0;
+		usbcfg.b.srpcap = 0;
+		break;
+
+	case DWC_MODE_SRP_CAPABLE_HOST:
+		usbcfg.b.hnpcap = 0;
+		usbcfg.b.srpcap = (core_if->core_params->otg_cap !=
+				   DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
+		break;
+
+	case DWC_MODE_NO_SRP_CAPABLE_HOST:
+		usbcfg.b.hnpcap = 0;
+		usbcfg.b.srpcap = 0;
+		break;
+	}
+
+	DWC_WRITE_REG32(&global_regs->gusbcfg, usbcfg.d32);
+
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	if (core_if->core_params->lpm_enable) {
+		glpmcfg_data_t lpmcfg = {.d32 = 0 };
+
+		/* To enable LPM support set lpm_cap_en bit */
+		lpmcfg.b.lpm_cap_en = 1;
+
+		/* Make AppL1Res ACK */
+		lpmcfg.b.appl_resp = 1;
+
+		/* Retry 3 times */
+		lpmcfg.b.retry_count = 3;
+
+		DWC_MODIFY_REG32(&core_if->core_global_regs->glpmcfg,
+				 0, lpmcfg.d32);
+
+	}
+#endif
+	if (core_if->core_params->ic_usb_cap) {
+		gusbcfg_data_t gusbcfg = {.d32 = 0 };
+		gusbcfg.b.ic_usb_cap = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gusbcfg,
+				 0, gusbcfg.d32);
+	}
+	{
+		gotgctl_data_t gotgctl = {.d32 = 0 };
+		gotgctl.b.otgver = core_if->core_params->otg_ver;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gotgctl, 0,
+				 gotgctl.d32);
+		/* Set OTG version supported */
+		core_if->otg_ver = core_if->core_params->otg_ver;
+		DWC_PRINTF("OTG VER PARAM: %d, OTG VER FLAG: %d\n",
+			   core_if->core_params->otg_ver, core_if->otg_ver);
+	}
+
+
+	/* Enable common interrupts */
+	dwc_otg_enable_common_interrupts(core_if);
+
+	/* Do device or host intialization based on mode during PCD
+	 * and HCD initialization  */
+	if (dwc_otg_is_host_mode(core_if)) {
+		DWC_DEBUGPL(DBG_ANY, "Host Mode\n");
+		core_if->op_state = A_HOST;
+	} else {
+		DWC_DEBUGPL(DBG_ANY, "Device Mode\n");
+		core_if->op_state = B_PERIPHERAL;
+#ifdef DWC_DEVICE_ONLY
+		dwc_otg_core_dev_init(core_if);
+#endif
+	}
+}
+
+/**
+ * This function enables the Device mode interrupts.
+ *
+ * @param core_if Programming view of DWC_otg controller
+ */
+void dwc_otg_enable_device_interrupts(dwc_otg_core_if_t * core_if)
+{
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+
+	DWC_DEBUGPL(DBG_CIL, "%s()\n", __func__);
+
+	/* Disable all interrupts. */
+	DWC_WRITE_REG32(&global_regs->gintmsk, 0);
+
+	/* Clear any pending interrupts */
+	DWC_WRITE_REG32(&global_regs->gintsts, 0xFFFFFFFF);
+
+	/* Enable the common interrupts */
+	dwc_otg_enable_common_interrupts(core_if);
+
+	/* Enable interrupts */
+	intr_mask.b.usbreset = 1;
+	intr_mask.b.enumdone = 1;
+	/* Disable Disconnect interrupt in Device mode */
+	intr_mask.b.disconnect = 0;
+
+	if (!core_if->multiproc_int_enable) {
+		intr_mask.b.inepintr = 1;
+		intr_mask.b.outepintr = 1;
+	}
+
+	intr_mask.b.erlysuspend = 1;
+
+	if (core_if->en_multiple_tx_fifo == 0) {
+		intr_mask.b.epmismatch = 1;
+	}
+
+	//intr_mask.b.incomplisoout = 1;
+	intr_mask.b.incomplisoin = 1;
+
+/* Enable the ignore frame number for ISOC xfers - MAS */
+/* Disable to support high bandwith ISOC transfers - manukz */
+#if 0
+#ifdef DWC_UTE_PER_IO
+	if (core_if->dma_enable) {
+		if (core_if->dma_desc_enable) {
+			dctl_data_t dctl1 = {.d32 = 0 };
+			dctl1.b.ifrmnum = 1;
+			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
+					 dctl, 0, dctl1.d32);
+			DWC_DEBUG("----Enabled Ignore frame number (0x%08x)",
+				  DWC_READ_REG32(&core_if->dev_if->
+						 dev_global_regs->dctl));
+		}
+	}
+#endif
+#endif
+#ifdef DWC_EN_ISOC
+	if (core_if->dma_enable) {
+		if (core_if->dma_desc_enable == 0) {
+			if (core_if->pti_enh_enable) {
+				dctl_data_t dctl = {.d32 = 0 };
+				dctl.b.ifrmnum = 1;
+				DWC_MODIFY_REG32(&core_if->
+						 dev_if->dev_global_regs->dctl,
+						 0, dctl.d32);
+			} else {
+				intr_mask.b.incomplisoin = 1;
+				intr_mask.b.incomplisoout = 1;
+			}
+		}
+	} else {
+		intr_mask.b.incomplisoin = 1;
+		intr_mask.b.incomplisoout = 1;
+	}
+#endif /* DWC_EN_ISOC */
+
+	/** @todo NGS: Should this be a module parameter? */
+#ifdef USE_PERIODIC_EP
+	intr_mask.b.isooutdrop = 1;
+	intr_mask.b.eopframe = 1;
+	intr_mask.b.incomplisoin = 1;
+	intr_mask.b.incomplisoout = 1;
+#endif
+
+	DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32, intr_mask.d32);
+
+	DWC_DEBUGPL(DBG_CIL, "%s() gintmsk=%0x\n", __func__,
+		    DWC_READ_REG32(&global_regs->gintmsk));
+}
+
+/**
+ * This function initializes the DWC_otg controller registers for
+ * device mode.
+ *
+ * @param core_if Programming view of DWC_otg controller
+ *
+ */
+void dwc_otg_core_dev_init(dwc_otg_core_if_t * core_if)
+{
+	int i;
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	dwc_otg_core_params_t *params = core_if->core_params;
+	dcfg_data_t dcfg = {.d32 = 0 };
+	depctl_data_t diepctl = {.d32 = 0 };
+	grstctl_t resetctl = {.d32 = 0 };
+	uint32_t rx_fifo_size;
+	fifosize_data_t nptxfifosize;
+	fifosize_data_t txfifosize;
+	dthrctl_data_t dthrctl;
+	fifosize_data_t ptxfifosize;
+	uint16_t rxfsiz, nptxfsiz;
+	gdfifocfg_data_t gdfifocfg = {.d32 = 0 };
+	hwcfg3_data_t hwcfg3 = {.d32 = 0 };
+
+	/* Restart the Phy Clock */
+	DWC_WRITE_REG32(core_if->pcgcctl, 0);
+
+	/* Device configuration register */
+	init_devspd(core_if);
+	dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
+	dcfg.b.descdma = (core_if->dma_desc_enable) ? 1 : 0;
+	dcfg.b.perfrint = DWC_DCFG_FRAME_INTERVAL_80;
+	/* Enable Device OUT NAK in case of DDMA mode*/
+	if (core_if->core_params->dev_out_nak) {
+		dcfg.b.endevoutnak = 1;
+	}
+
+	if (core_if->core_params->cont_on_bna) {
+		dctl_data_t dctl = {.d32 = 0 };
+		dctl.b.encontonbna = 1;
+		DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, 0, dctl.d32);
+	}
+
+
+	DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
+
+	/* Configure data FIFO sizes */
+	if (core_if->hwcfg2.b.dynamic_fifo && params->enable_dynamic_fifo) {
+		DWC_DEBUGPL(DBG_CIL, "Total FIFO Size=%d\n",
+			    core_if->total_fifo_size);
+		DWC_DEBUGPL(DBG_CIL, "Rx FIFO Size=%d\n",
+			    params->dev_rx_fifo_size);
+		DWC_DEBUGPL(DBG_CIL, "NP Tx FIFO Size=%d\n",
+			    params->dev_nperio_tx_fifo_size);
+
+		/* Rx FIFO */
+		DWC_DEBUGPL(DBG_CIL, "initial grxfsiz=%08x\n",
+			    DWC_READ_REG32(&global_regs->grxfsiz));
+
+#ifdef DWC_UTE_CFI
+		core_if->pwron_rxfsiz = DWC_READ_REG32(&global_regs->grxfsiz);
+		core_if->init_rxfsiz = params->dev_rx_fifo_size;
+#endif
+		rx_fifo_size = params->dev_rx_fifo_size;
+		DWC_WRITE_REG32(&global_regs->grxfsiz, rx_fifo_size);
+
+		DWC_DEBUGPL(DBG_CIL, "new grxfsiz=%08x\n",
+			    DWC_READ_REG32(&global_regs->grxfsiz));
+
+		/** Set Periodic Tx FIFO Mask all bits 0 */
+		core_if->p_tx_msk = 0;
+
+		/** Set Tx FIFO Mask all bits 0 */
+		core_if->tx_msk = 0;
+
+		if (core_if->en_multiple_tx_fifo == 0) {
+			/* Non-periodic Tx FIFO */
+			DWC_DEBUGPL(DBG_CIL, "initial gnptxfsiz=%08x\n",
+				    DWC_READ_REG32(&global_regs->gnptxfsiz));
+
+			nptxfifosize.b.depth = params->dev_nperio_tx_fifo_size;
+			nptxfifosize.b.startaddr = params->dev_rx_fifo_size;
+
+			DWC_WRITE_REG32(&global_regs->gnptxfsiz,
+					nptxfifosize.d32);
+
+			DWC_DEBUGPL(DBG_CIL, "new gnptxfsiz=%08x\n",
+				    DWC_READ_REG32(&global_regs->gnptxfsiz));
+
+			/**@todo NGS: Fix Periodic FIFO Sizing! */
+			/*
+			 * Periodic Tx FIFOs These FIFOs are numbered from 1 to 15.
+			 * Indexes of the FIFO size module parameters in the
+			 * dev_perio_tx_fifo_size array and the FIFO size registers in
+			 * the dptxfsiz array run from 0 to 14.
+			 */
+			/** @todo Finish debug of this */
+			ptxfifosize.b.startaddr =
+			    nptxfifosize.b.startaddr + nptxfifosize.b.depth;
+			for (i = 0; i < core_if->hwcfg4.b.num_dev_perio_in_ep; i++) {
+				ptxfifosize.b.depth =
+				    params->dev_perio_tx_fifo_size[i];
+				DWC_DEBUGPL(DBG_CIL,
+					    "initial dtxfsiz[%d]=%08x\n", i,
+					    DWC_READ_REG32(&global_regs->dtxfsiz
+							   [i]));
+				DWC_WRITE_REG32(&global_regs->dtxfsiz[i],
+						ptxfifosize.d32);
+				DWC_DEBUGPL(DBG_CIL, "new dtxfsiz[%d]=%08x\n",
+					    i,
+					    DWC_READ_REG32(&global_regs->dtxfsiz
+							   [i]));
+				ptxfifosize.b.startaddr += ptxfifosize.b.depth;
+			}
+		} else {
+			/*
+			 * Tx FIFOs These FIFOs are numbered from 1 to 15.
+			 * Indexes of the FIFO size module parameters in the
+			 * dev_tx_fifo_size array and the FIFO size registers in
+			 * the dtxfsiz array run from 0 to 14.
+			 */
+
+			/* Non-periodic Tx FIFO */
+			DWC_DEBUGPL(DBG_CIL, "initial gnptxfsiz=%08x\n",
+				    DWC_READ_REG32(&global_regs->gnptxfsiz));
+
+#ifdef DWC_UTE_CFI
+			core_if->pwron_gnptxfsiz =
+			    (DWC_READ_REG32(&global_regs->gnptxfsiz) >> 16);
+			core_if->init_gnptxfsiz =
+			    params->dev_nperio_tx_fifo_size;
+#endif
+			nptxfifosize.b.depth = params->dev_nperio_tx_fifo_size;
+			nptxfifosize.b.startaddr = params->dev_rx_fifo_size;
+
+			DWC_WRITE_REG32(&global_regs->gnptxfsiz,
+					nptxfifosize.d32);
+
+			DWC_DEBUGPL(DBG_CIL, "new gnptxfsiz=%08x\n",
+				    DWC_READ_REG32(&global_regs->gnptxfsiz));
+
+			txfifosize.b.startaddr =
+			    nptxfifosize.b.startaddr + nptxfifosize.b.depth;
+
+			for (i = 0; i < core_if->hwcfg4.b.num_in_eps; i++) {
+
+				txfifosize.b.depth =
+				    params->dev_tx_fifo_size[i];
+
+				DWC_DEBUGPL(DBG_CIL,
+					    "initial dtxfsiz[%d]=%08x\n",
+					    i,
+					    DWC_READ_REG32(&global_regs->dtxfsiz
+							   [i]));
+
+#ifdef DWC_UTE_CFI
+				core_if->pwron_txfsiz[i] =
+				    (DWC_READ_REG32
+				     (&global_regs->dtxfsiz[i]) >> 16);
+				core_if->init_txfsiz[i] =
+				    params->dev_tx_fifo_size[i];
+#endif
+				DWC_WRITE_REG32(&global_regs->dtxfsiz[i],
+						txfifosize.d32);
+
+				DWC_DEBUGPL(DBG_CIL,
+					    "new dtxfsiz[%d]=%08x\n",
+					    i,
+					    DWC_READ_REG32(&global_regs->dtxfsiz
+							   [i]));
+
+				txfifosize.b.startaddr += txfifosize.b.depth;
+			}
+			if (core_if->snpsid <= OTG_CORE_REV_2_94a) {
+				/* Calculating DFIFOCFG for Device mode to include RxFIFO and NPTXFIFO */
+				gdfifocfg.d32 = DWC_READ_REG32(&global_regs->gdfifocfg);
+				hwcfg3.d32 = DWC_READ_REG32(&global_regs->ghwcfg3);
+				gdfifocfg.b.gdfifocfg = (DWC_READ_REG32(&global_regs->ghwcfg3) >> 16);
+				DWC_WRITE_REG32(&global_regs->gdfifocfg, gdfifocfg.d32);
+				rxfsiz = (DWC_READ_REG32(&global_regs->grxfsiz) & 0x0000ffff);
+				nptxfsiz = (DWC_READ_REG32(&global_regs->gnptxfsiz) >> 16);
+				gdfifocfg.b.epinfobase = rxfsiz + nptxfsiz;
+				DWC_WRITE_REG32(&global_regs->gdfifocfg, gdfifocfg.d32);
+			}
+		}
+
+		/* Flush the FIFOs */
+		dwc_otg_flush_tx_fifo(core_if, 0x10);	/* all Tx FIFOs */
+		dwc_otg_flush_rx_fifo(core_if);
+
+		/* Flush the Learning Queue. */
+		resetctl.b.intknqflsh = 1;
+		DWC_WRITE_REG32(&core_if->core_global_regs->grstctl, resetctl.d32);
+
+		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable) {
+			core_if->start_predict = 0;
+			for (i = 0; i<= core_if->dev_if->num_in_eps; ++i) {
+				core_if->nextep_seq[i] = 0xff;	// 0xff - EP not active
+			}
+			core_if->nextep_seq[0] = 0;
+			core_if->first_in_nextep_seq = 0;
+			diepctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl);
+			diepctl.b.nextep = 0;
+			DWC_WRITE_REG32(&dev_if->in_ep_regs[0]->diepctl, diepctl.d32);
+
+			/* Update IN Endpoint Mismatch Count by active IN NP EP count + 1 */
+			dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
+			dcfg.b.epmscnt = 2;
+			DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
+
+			DWC_DEBUGPL(DBG_CILV,"%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
+				__func__, core_if->first_in_nextep_seq);
+			for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
+				DWC_DEBUGPL(DBG_CILV, "%2d ", core_if->nextep_seq[i]);
+			}
+			DWC_DEBUGPL(DBG_CILV,"\n");
+		}
+
+		/* Clear all pending Device Interrupts */
+		/** @todo - if the condition needed to be checked
+		 *  or in any case all pending interrutps should be cleared?
+	     */
+		if (core_if->multiproc_int_enable) {
+			for (i = 0; i < core_if->dev_if->num_in_eps; ++i) {
+				DWC_WRITE_REG32(&dev_if->
+						dev_global_regs->diepeachintmsk[i], 0);
+			}
+		}
+
+		for (i = 0; i < core_if->dev_if->num_out_eps; ++i) {
+			DWC_WRITE_REG32(&dev_if->
+					dev_global_regs->doepeachintmsk[i], 0);
+		}
+
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->deachint, 0xFFFFFFFF);
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->deachintmsk, 0);
+	} else {
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->diepmsk, 0);
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->doepmsk, 0);
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->daint, 0xFFFFFFFF);
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->daintmsk, 0);
+	}
+
+	for (i = 0; i <= dev_if->num_in_eps; i++) {
+		depctl_data_t depctl;
+		depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
+		if (depctl.b.epena) {
+			depctl.d32 = 0;
+			depctl.b.epdis = 1;
+			depctl.b.snak = 1;
+		} else {
+			depctl.d32 = 0;
+		}
+
+		DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepctl, depctl.d32);
+
+		DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->dieptsiz, 0);
+		DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepdma, 0);
+		DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepint, 0xFF);
+	}
+
+	for (i = 0; i <= dev_if->num_out_eps; i++) {
+		depctl_data_t depctl;
+		depctl.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[i]->doepctl);
+		if (depctl.b.epena) {
+			dctl_data_t dctl = {.d32 = 0 };
+			gintmsk_data_t gintsts = {.d32 = 0 };
+			doepint_data_t doepint = {.d32 = 0 };
+			dctl.b.sgoutnak = 1;
+			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
+			do {
+				dwc_udelay(10);
+				gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+			} while (!gintsts.b.goutnakeff);
+			gintsts.d32 = 0;
+			gintsts.b.goutnakeff = 1;
+			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+			depctl.d32 = 0;
+			depctl.b.epdis = 1;
+			depctl.b.snak = 1;
+			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[i]->doepctl, depctl.d32);
+			do {
+				dwc_udelay(10);
+				doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
+					out_ep_regs[i]->doepint);
+			} while (!doepint.b.epdisabled);
+
+			doepint.b.epdisabled = 1;
+			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[i]->doepint, doepint.d32);
+
+			dctl.d32 = 0;
+			dctl.b.cgoutnak = 1;
+			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
+		} else {
+			depctl.d32 = 0;
+		}
+
+		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepctl, depctl.d32);
+
+		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doeptsiz, 0);
+		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepdma, 0);
+		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepint, 0xFF);
+	}
+
+	if (core_if->en_multiple_tx_fifo && core_if->dma_enable) {
+		dev_if->non_iso_tx_thr_en = params->thr_ctl & 0x1;
+		dev_if->iso_tx_thr_en = (params->thr_ctl >> 1) & 0x1;
+		dev_if->rx_thr_en = (params->thr_ctl >> 2) & 0x1;
+
+		dev_if->rx_thr_length = params->rx_thr_length;
+		dev_if->tx_thr_length = params->tx_thr_length;
+
+		dev_if->setup_desc_index = 0;
+
+		dthrctl.d32 = 0;
+		dthrctl.b.non_iso_thr_en = dev_if->non_iso_tx_thr_en;
+		dthrctl.b.iso_thr_en = dev_if->iso_tx_thr_en;
+		dthrctl.b.tx_thr_len = dev_if->tx_thr_length;
+		dthrctl.b.rx_thr_en = dev_if->rx_thr_en;
+		dthrctl.b.rx_thr_len = dev_if->rx_thr_length;
+		dthrctl.b.ahb_thr_ratio = params->ahb_thr_ratio;
+
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->dtknqr3_dthrctl,
+				dthrctl.d32);
+
+		DWC_DEBUGPL(DBG_CIL,
+			    "Non ISO Tx Thr - %d\nISO Tx Thr - %d\nRx Thr - %d\nTx Thr Len - %d\nRx Thr Len - %d\n",
+			    dthrctl.b.non_iso_thr_en, dthrctl.b.iso_thr_en,
+			    dthrctl.b.rx_thr_en, dthrctl.b.tx_thr_len,
+			    dthrctl.b.rx_thr_len);
+
+	}
+
+	dwc_otg_enable_device_interrupts(core_if);
+
+	{
+		diepmsk_data_t msk = {.d32 = 0 };
+		msk.b.txfifoundrn = 1;
+		if (core_if->multiproc_int_enable) {
+			DWC_MODIFY_REG32(&dev_if->dev_global_regs->
+					 diepeachintmsk[0], msk.d32, msk.d32);
+		} else {
+			DWC_MODIFY_REG32(&dev_if->dev_global_regs->diepmsk,
+					 msk.d32, msk.d32);
+		}
+	}
+
+	if (core_if->multiproc_int_enable) {
+		/* Set NAK on Babble */
+		dctl_data_t dctl = {.d32 = 0 };
+		dctl.b.nakonbble = 1;
+		DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, 0, dctl.d32);
+	}
+
+	if (core_if->snpsid >= OTG_CORE_REV_2_94a) {
+		dctl_data_t dctl = {.d32 = 0 };
+		dctl.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dctl);
+		dctl.b.sftdiscon = 0;
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->dctl, dctl.d32);
+	}
+}
+
+/**
+ * This function enables the Host mode interrupts.
+ *
+ * @param core_if Programming view of DWC_otg controller
+ */
+void dwc_otg_enable_host_interrupts(dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_DEBUGPL(DBG_CIL, "%s(%p)\n", __func__, core_if);
+
+	/* Disable all interrupts. */
+	DWC_WRITE_REG32(&global_regs->gintmsk, 0);
+
+	/* Clear any pending interrupts. */
+	DWC_WRITE_REG32(&global_regs->gintsts, 0xFFFFFFFF);
+
+	/* Enable the common interrupts */
+	dwc_otg_enable_common_interrupts(core_if);
+
+	/*
+	 * Enable host mode interrupts without disturbing common
+	 * interrupts.
+	 */
+
+	intr_mask.b.disconnect = 1;
+	intr_mask.b.portintr = 1;
+	intr_mask.b.hcintr = 1;
+
+	DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32, intr_mask.d32);
+}
+
+/**
+ * This function disables the Host Mode interrupts.
+ *
+ * @param core_if Programming view of DWC_otg controller
+ */
+void dwc_otg_disable_host_interrupts(dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_DEBUGPL(DBG_CILV, "%s()\n", __func__);
+
+	/*
+	 * Disable host mode interrupts without disturbing common
+	 * interrupts.
+	 */
+	intr_mask.b.sofintr = 1;
+	intr_mask.b.portintr = 1;
+	intr_mask.b.hcintr = 1;
+	intr_mask.b.ptxfempty = 1;
+	intr_mask.b.nptxfempty = 1;
+
+	DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32, 0);
+}
+
+/**
+ * This function initializes the DWC_otg controller registers for
+ * host mode.
+ *
+ * This function flushes the Tx and Rx FIFOs and it flushes any entries in the
+ * request queues. Host channels are reset to ensure that they are ready for
+ * performing transfers.
+ *
+ * @param core_if Programming view of DWC_otg controller
+ *
+ */
+void dwc_otg_core_host_init(dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	dwc_otg_host_if_t *host_if = core_if->host_if;
+	dwc_otg_core_params_t *params = core_if->core_params;
+	hprt0_data_t hprt0 = {.d32 = 0 };
+	fifosize_data_t nptxfifosize;
+	fifosize_data_t ptxfifosize;
+	uint16_t rxfsiz, nptxfsiz, hptxfsiz;
+	gdfifocfg_data_t gdfifocfg = {.d32 = 0 };
+	int i;
+	hcchar_data_t hcchar;
+	hcfg_data_t hcfg;
+	hfir_data_t hfir;
+	dwc_otg_hc_regs_t *hc_regs;
+	int num_channels;
+	gotgctl_data_t gotgctl = {.d32 = 0 };
+
+	DWC_DEBUGPL(DBG_CILV, "%s(%p)\n", __func__, core_if);
+
+	/* Restart the Phy Clock */
+	DWC_WRITE_REG32(core_if->pcgcctl, 0);
+
+	/* Initialize Host Configuration Register */
+	init_fslspclksel(core_if);
+	if (core_if->core_params->speed == DWC_SPEED_PARAM_FULL) {
+		hcfg.d32 = DWC_READ_REG32(&host_if->host_global_regs->hcfg);
+		hcfg.b.fslssupp = 1;
+		DWC_WRITE_REG32(&host_if->host_global_regs->hcfg, hcfg.d32);
+
+	}
+
+	/* This bit allows dynamic reloading of the HFIR register
+	 * during runtime. This bit needs to be programmed during
+	 * initial configuration and its value must not be changed
+	 * during runtime.*/
+	if (core_if->core_params->reload_ctl == 1) {
+		hfir.d32 = DWC_READ_REG32(&host_if->host_global_regs->hfir);
+		hfir.b.hfirrldctrl = 1;
+		DWC_WRITE_REG32(&host_if->host_global_regs->hfir, hfir.d32);
+	}
+
+	if (core_if->core_params->dma_desc_enable) {
+		uint8_t op_mode = core_if->hwcfg2.b.op_mode;
+		if (!
+		    (core_if->hwcfg4.b.desc_dma
+		     && (core_if->snpsid >= OTG_CORE_REV_2_90a)
+		     && ((op_mode == DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG)
+			 || (op_mode == DWC_HWCFG2_OP_MODE_SRP_ONLY_CAPABLE_OTG)
+			 || (op_mode ==
+			     DWC_HWCFG2_OP_MODE_NO_HNP_SRP_CAPABLE_OTG)
+			 || (op_mode == DWC_HWCFG2_OP_MODE_SRP_CAPABLE_HOST)
+			 || (op_mode ==
+			     DWC_HWCFG2_OP_MODE_NO_SRP_CAPABLE_HOST)))) {
+
+			DWC_ERROR("Host can't operate in Descriptor DMA mode.\n"
+				  "Either core version is below 2.90a or "
+				  "GHWCFG2, GHWCFG4 registers' values do not allow Descriptor DMA in host mode.\n"
+				  "To run the driver in Buffer DMA host mode set dma_desc_enable "
+				  "module parameter to 0.\n");
+			return;
+		}
+		hcfg.d32 = DWC_READ_REG32(&host_if->host_global_regs->hcfg);
+		hcfg.b.descdma = 1;
+		DWC_WRITE_REG32(&host_if->host_global_regs->hcfg, hcfg.d32);
+	}
+
+	/* Configure data FIFO sizes */
+	if (core_if->hwcfg2.b.dynamic_fifo && params->enable_dynamic_fifo) {
+		DWC_DEBUGPL(DBG_CIL, "Total FIFO Size=%d\n",
+			    core_if->total_fifo_size);
+		DWC_DEBUGPL(DBG_CIL, "Rx FIFO Size=%d\n",
+			    params->host_rx_fifo_size);
+		DWC_DEBUGPL(DBG_CIL, "NP Tx FIFO Size=%d\n",
+			    params->host_nperio_tx_fifo_size);
+		DWC_DEBUGPL(DBG_CIL, "P Tx FIFO Size=%d\n",
+			    params->host_perio_tx_fifo_size);
+
+		/* Rx FIFO */
+		DWC_DEBUGPL(DBG_CIL, "initial grxfsiz=%08x\n",
+			    DWC_READ_REG32(&global_regs->grxfsiz));
+		DWC_WRITE_REG32(&global_regs->grxfsiz,
+				params->host_rx_fifo_size);
+		DWC_DEBUGPL(DBG_CIL, "new grxfsiz=%08x\n",
+			    DWC_READ_REG32(&global_regs->grxfsiz));
+
+		/* Non-periodic Tx FIFO */
+		DWC_DEBUGPL(DBG_CIL, "initial gnptxfsiz=%08x\n",
+			    DWC_READ_REG32(&global_regs->gnptxfsiz));
+		nptxfifosize.b.depth = params->host_nperio_tx_fifo_size;
+		nptxfifosize.b.startaddr = params->host_rx_fifo_size;
+		DWC_WRITE_REG32(&global_regs->gnptxfsiz, nptxfifosize.d32);
+		DWC_DEBUGPL(DBG_CIL, "new gnptxfsiz=%08x\n",
+			    DWC_READ_REG32(&global_regs->gnptxfsiz));
+
+		/* Periodic Tx FIFO */
+		DWC_DEBUGPL(DBG_CIL, "initial hptxfsiz=%08x\n",
+			    DWC_READ_REG32(&global_regs->hptxfsiz));
+		ptxfifosize.b.depth = params->host_perio_tx_fifo_size;
+		ptxfifosize.b.startaddr =
+		    nptxfifosize.b.startaddr + nptxfifosize.b.depth;
+		DWC_WRITE_REG32(&global_regs->hptxfsiz, ptxfifosize.d32);
+		DWC_DEBUGPL(DBG_CIL, "new hptxfsiz=%08x\n",
+			    DWC_READ_REG32(&global_regs->hptxfsiz));
+
+		if (core_if->en_multiple_tx_fifo
+		    && core_if->snpsid <= OTG_CORE_REV_2_94a) {
+			/* Global DFIFOCFG calculation for Host mode - include RxFIFO, NPTXFIFO and HPTXFIFO */
+			gdfifocfg.d32 = DWC_READ_REG32(&global_regs->gdfifocfg);
+			rxfsiz = (DWC_READ_REG32(&global_regs->grxfsiz) & 0x0000ffff);
+			nptxfsiz = (DWC_READ_REG32(&global_regs->gnptxfsiz) >> 16);
+			hptxfsiz = (DWC_READ_REG32(&global_regs->hptxfsiz) >> 16);
+			gdfifocfg.b.epinfobase = rxfsiz + nptxfsiz + hptxfsiz;
+			DWC_WRITE_REG32(&global_regs->gdfifocfg, gdfifocfg.d32);
+		}
+	}
+
+	/* TODO - check this */
+	/* Clear Host Set HNP Enable in the OTG Control Register */
+	gotgctl.b.hstsethnpen = 1;
+	DWC_MODIFY_REG32(&global_regs->gotgctl, gotgctl.d32, 0);
+	/* Make sure the FIFOs are flushed. */
+	dwc_otg_flush_tx_fifo(core_if, 0x10 /* all TX FIFOs */ );
+	dwc_otg_flush_rx_fifo(core_if);
+
+	/* Clear Host Set HNP Enable in the OTG Control Register */
+	gotgctl.b.hstsethnpen = 1;
+	DWC_MODIFY_REG32(&global_regs->gotgctl, gotgctl.d32, 0);
+
+	if (!core_if->core_params->dma_desc_enable) {
+		/* Flush out any leftover queued requests. */
+		num_channels = core_if->core_params->host_channels;
+
+		for (i = 0; i < num_channels; i++) {
+			hc_regs = core_if->host_if->hc_regs[i];
+			hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+			hcchar.b.chen = 0;
+			hcchar.b.chdis = 1;
+			hcchar.b.epdir = 0;
+			DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+		}
+
+		/* Halt all channels to put them into a known state. */
+		for (i = 0; i < num_channels; i++) {
+			int count = 0;
+			hc_regs = core_if->host_if->hc_regs[i];
+			hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+			hcchar.b.chen = 1;
+			hcchar.b.chdis = 1;
+			hcchar.b.epdir = 0;
+			DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+			DWC_DEBUGPL(DBG_HCDV, "%s: Halt channel %d regs %p\n", __func__, i, hc_regs);
+			do {
+				hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+				if (++count > 1000) {
+					DWC_ERROR
+					    ("%s: Unable to clear halt on channel %d (timeout HCCHAR 0x%X @%p)\n",
+					     __func__, i, hcchar.d32, &hc_regs->hcchar);
+					break;
+				}
+				dwc_udelay(1);
+			} while (hcchar.b.chen);
+		}
+	}
+
+	/* Turn on the vbus power. */
+	DWC_PRINTF("Init: Port Power? op_state=%d\n", core_if->op_state);
+	if (core_if->op_state == A_HOST) {
+		hprt0.d32 = dwc_otg_read_hprt0(core_if);
+		DWC_PRINTF("Init: Power Port (%d)\n", hprt0.b.prtpwr);
+		if (hprt0.b.prtpwr == 0) {
+			hprt0.b.prtpwr = 1;
+			DWC_WRITE_REG32(host_if->hprt0, hprt0.d32);
+		}
+	}
+
+	dwc_otg_enable_host_interrupts(core_if);
+}
+
+/**
+ * Prepares a host channel for transferring packets to/from a specific
+ * endpoint. The HCCHARn register is set up with the characteristics specified
+ * in _hc. Host channel interrupts that may need to be serviced while this
+ * transfer is in progress are enabled.
+ *
+ * @param core_if Programming view of DWC_otg controller
+ * @param hc Information needed to initialize the host channel
+ */
+void dwc_otg_hc_init(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
+{
+	hcintmsk_data_t hc_intr_mask;
+	hcchar_data_t hcchar;
+	hcsplt_data_t hcsplt;
+
+	uint8_t hc_num = hc->hc_num;
+	dwc_otg_host_if_t *host_if = core_if->host_if;
+	dwc_otg_hc_regs_t *hc_regs = host_if->hc_regs[hc_num];
+
+	/* Clear old interrupt conditions for this host channel. */
+	hc_intr_mask.d32 = 0xFFFFFFFF;
+	hc_intr_mask.b.reserved14_31 = 0;
+	DWC_WRITE_REG32(&hc_regs->hcint, hc_intr_mask.d32);
+
+	/* Enable channel interrupts required for this transfer. */
+	hc_intr_mask.d32 = 0;
+	hc_intr_mask.b.chhltd = 1;
+	if (core_if->dma_enable) {
+		/* For Descriptor DMA mode core halts the channel on AHB error. Interrupt is not required */
+		if (!core_if->dma_desc_enable)
+			hc_intr_mask.b.ahberr = 1;
+		else {
+			if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)
+				hc_intr_mask.b.xfercompl = 1;
+		}
+
+		if (hc->error_state && !hc->do_split &&
+		    hc->ep_type != DWC_OTG_EP_TYPE_ISOC) {
+			hc_intr_mask.b.ack = 1;
+			if (hc->ep_is_in) {
+				hc_intr_mask.b.datatglerr = 1;
+				if (hc->ep_type != DWC_OTG_EP_TYPE_INTR) {
+					hc_intr_mask.b.nak = 1;
+				}
+			}
+		}
+	} else {
+		switch (hc->ep_type) {
+		case DWC_OTG_EP_TYPE_CONTROL:
+		case DWC_OTG_EP_TYPE_BULK:
+			hc_intr_mask.b.xfercompl = 1;
+			hc_intr_mask.b.stall = 1;
+			hc_intr_mask.b.xacterr = 1;
+			hc_intr_mask.b.datatglerr = 1;
+			if (hc->ep_is_in) {
+				hc_intr_mask.b.bblerr = 1;
+			} else {
+				hc_intr_mask.b.nak = 1;
+				hc_intr_mask.b.nyet = 1;
+				if (hc->do_ping) {
+					hc_intr_mask.b.ack = 1;
+				}
+			}
+
+			if (hc->do_split) {
+				hc_intr_mask.b.nak = 1;
+				if (hc->complete_split) {
+					hc_intr_mask.b.nyet = 1;
+				} else {
+					hc_intr_mask.b.ack = 1;
+				}
+			}
+
+			if (hc->error_state) {
+				hc_intr_mask.b.ack = 1;
+			}
+			break;
+		case DWC_OTG_EP_TYPE_INTR:
+			hc_intr_mask.b.xfercompl = 1;
+			hc_intr_mask.b.nak = 1;
+			hc_intr_mask.b.stall = 1;
+			hc_intr_mask.b.xacterr = 1;
+			hc_intr_mask.b.datatglerr = 1;
+			hc_intr_mask.b.frmovrun = 1;
+
+			if (hc->ep_is_in) {
+				hc_intr_mask.b.bblerr = 1;
+			}
+			if (hc->error_state) {
+				hc_intr_mask.b.ack = 1;
+			}
+			if (hc->do_split) {
+				if (hc->complete_split) {
+					hc_intr_mask.b.nyet = 1;
+				} else {
+					hc_intr_mask.b.ack = 1;
+				}
+			}
+			break;
+		case DWC_OTG_EP_TYPE_ISOC:
+			hc_intr_mask.b.xfercompl = 1;
+			hc_intr_mask.b.frmovrun = 1;
+			hc_intr_mask.b.ack = 1;
+
+			if (hc->ep_is_in) {
+				hc_intr_mask.b.xacterr = 1;
+				hc_intr_mask.b.bblerr = 1;
+			}
+			break;
+		}
+	}
+	DWC_WRITE_REG32(&hc_regs->hcintmsk, hc_intr_mask.d32);
+
+	/*
+	 * Program the HCCHARn register with the endpoint characteristics for
+	 * the current transfer.
+	 */
+	hcchar.d32 = 0;
+	hcchar.b.devaddr = hc->dev_addr;
+	hcchar.b.epnum = hc->ep_num;
+	hcchar.b.epdir = hc->ep_is_in;
+	hcchar.b.lspddev = (hc->speed == DWC_OTG_EP_SPEED_LOW);
+	hcchar.b.eptype = hc->ep_type;
+	hcchar.b.mps = hc->max_packet;
+
+	DWC_WRITE_REG32(&host_if->hc_regs[hc_num]->hcchar, hcchar.d32);
+
+	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d, Dev Addr %d, EP #%d\n",
+                    __func__, hc->hc_num, hcchar.b.devaddr, hcchar.b.epnum);
+	DWC_DEBUGPL(DBG_HCDV, "	 Is In %d, Is Low Speed %d, EP Type %d, "
+                                "Max Pkt %d, Multi Cnt %d\n",
+                    hcchar.b.epdir, hcchar.b.lspddev, hcchar.b.eptype,
+                    hcchar.b.mps, hcchar.b.multicnt);
+
+	/*
+	 * Program the HCSPLIT register for SPLITs
+	 */
+	hcsplt.d32 = 0;
+	if (hc->do_split) {
+		DWC_DEBUGPL(DBG_HCDV, "Programming HC %d with split --> %s\n",
+			    hc->hc_num,
+			    hc->complete_split ? "CSPLIT" : "SSPLIT");
+		hcsplt.b.compsplt = hc->complete_split;
+		hcsplt.b.xactpos = hc->xact_pos;
+		hcsplt.b.hubaddr = hc->hub_addr;
+		hcsplt.b.prtaddr = hc->port_addr;
+		DWC_DEBUGPL(DBG_HCDV, "\t  comp split %d\n", hc->complete_split);
+		DWC_DEBUGPL(DBG_HCDV, "\t  xact pos %d\n", hc->xact_pos);
+		DWC_DEBUGPL(DBG_HCDV, "\t  hub addr %d\n", hc->hub_addr);
+		DWC_DEBUGPL(DBG_HCDV, "\t  port addr %d\n", hc->port_addr);
+		DWC_DEBUGPL(DBG_HCDV, "\t  is_in %d\n", hc->ep_is_in);
+		DWC_DEBUGPL(DBG_HCDV, "\t  Max Pkt: %d\n", hcchar.b.mps);
+		DWC_DEBUGPL(DBG_HCDV, "\t  xferlen: %d\n", hc->xfer_len);
+	}
+	DWC_WRITE_REG32(&host_if->hc_regs[hc_num]->hcsplt, hcsplt.d32);
+
+}
+
+/**
+ * Attempts to halt a host channel. This function should only be called in
+ * Slave mode or to abort a transfer in either Slave mode or DMA mode. Under
+ * normal circumstances in DMA mode, the controller halts the channel when the
+ * transfer is complete or a condition occurs that requires application
+ * intervention.
+ *
+ * In slave mode, checks for a free request queue entry, then sets the Channel
+ * Enable and Channel Disable bits of the Host Channel Characteristics
+ * register of the specified channel to intiate the halt. If there is no free
+ * request queue entry, sets only the Channel Disable bit of the HCCHARn
+ * register to flush requests for this channel. In the latter case, sets a
+ * flag to indicate that the host channel needs to be halted when a request
+ * queue slot is open.
+ *
+ * In DMA mode, always sets the Channel Enable and Channel Disable bits of the
+ * HCCHARn register. The controller ensures there is space in the request
+ * queue before submitting the halt request.
+ *
+ * Some time may elapse before the core flushes any posted requests for this
+ * host channel and halts. The Channel Halted interrupt handler completes the
+ * deactivation of the host channel.
+ *
+ * @param core_if Controller register interface.
+ * @param hc Host channel to halt.
+ * @param halt_status Reason for halting the channel.
+ */
+void dwc_otg_hc_halt(dwc_otg_core_if_t * core_if,
+		     dwc_hc_t * hc, dwc_otg_halt_status_e halt_status)
+{
+	gnptxsts_data_t nptxsts;
+	hptxsts_data_t hptxsts;
+	hcchar_data_t hcchar;
+	dwc_otg_hc_regs_t *hc_regs;
+	dwc_otg_core_global_regs_t *global_regs;
+	dwc_otg_host_global_regs_t *host_global_regs;
+
+	hc_regs = core_if->host_if->hc_regs[hc->hc_num];
+	global_regs = core_if->core_global_regs;
+	host_global_regs = core_if->host_if->host_global_regs;
+
+	DWC_ASSERT(!(halt_status == DWC_OTG_HC_XFER_NO_HALT_STATUS),
+		   "halt_status = %d\n", halt_status);
+
+	if (halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE ||
+	    halt_status == DWC_OTG_HC_XFER_AHB_ERR) {
+		/*
+		 * Disable all channel interrupts except Ch Halted. The QTD
+		 * and QH state associated with this transfer has been cleared
+		 * (in the case of URB_DEQUEUE), so the channel needs to be
+		 * shut down carefully to prevent crashes.
+		 */
+		hcintmsk_data_t hcintmsk;
+		hcintmsk.d32 = 0;
+		hcintmsk.b.chhltd = 1;
+		DWC_WRITE_REG32(&hc_regs->hcintmsk, hcintmsk.d32);
+
+		/*
+		 * Make sure no other interrupts besides halt are currently
+		 * pending. Handling another interrupt could cause a crash due
+		 * to the QTD and QH state.
+		 */
+		DWC_WRITE_REG32(&hc_regs->hcint, ~hcintmsk.d32);
+
+		/*
+		 * Make sure the halt status is set to URB_DEQUEUE or AHB_ERR
+		 * even if the channel was already halted for some other
+		 * reason.
+		 */
+		hc->halt_status = halt_status;
+
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+		if (hcchar.b.chen == 0) {
+			/*
+			 * The channel is either already halted or it hasn't
+			 * started yet. In DMA mode, the transfer may halt if
+			 * it finishes normally or a condition occurs that
+			 * requires driver intervention. Don't want to halt
+			 * the channel again. In either Slave or DMA mode,
+			 * it's possible that the transfer has been assigned
+			 * to a channel, but not started yet when an URB is
+			 * dequeued. Don't want to halt a channel that hasn't
+			 * started yet.
+			 */
+			return;
+		}
+	}
+	if (hc->halt_pending) {
+		/*
+		 * A halt has already been issued for this channel. This might
+		 * happen when a transfer is aborted by a higher level in
+		 * the stack.
+		 */
+#ifdef DEBUG
+		DWC_PRINTF
+		    ("*** %s: Channel %d, _hc->halt_pending already set ***\n",
+		     __func__, hc->hc_num);
+
+#endif
+		return;
+	}
+
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+	/* No need to set the bit in DDMA for disabling the channel */
+	//TODO check it everywhere channel is disabled
+	if (!core_if->core_params->dma_desc_enable)
+		hcchar.b.chen = 1;
+	hcchar.b.chdis = 1;
+
+	if (!core_if->dma_enable) {
+		/* Check for space in the request queue to issue the halt. */
+		if (hc->ep_type == DWC_OTG_EP_TYPE_CONTROL ||
+		    hc->ep_type == DWC_OTG_EP_TYPE_BULK) {
+			nptxsts.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
+			if (nptxsts.b.nptxqspcavail == 0) {
+				hcchar.b.chen = 0;
+			}
+		} else {
+			hptxsts.d32 =
+			    DWC_READ_REG32(&host_global_regs->hptxsts);
+			if ((hptxsts.b.ptxqspcavail == 0)
+			    || (core_if->queuing_high_bandwidth)) {
+				hcchar.b.chen = 0;
+			}
+		}
+	}
+	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+
+	hc->halt_status = halt_status;
+
+	if (hcchar.b.chen) {
+		hc->halt_pending = 1;
+		hc->halt_on_queue = 0;
+	} else {
+		hc->halt_on_queue = 1;
+	}
+
+	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
+	DWC_DEBUGPL(DBG_HCDV, "	 hcchar: 0x%08x\n", hcchar.d32);
+	DWC_DEBUGPL(DBG_HCDV, "	 halt_pending: %d\n", hc->halt_pending);
+	DWC_DEBUGPL(DBG_HCDV, "	 halt_on_queue: %d\n", hc->halt_on_queue);
+	DWC_DEBUGPL(DBG_HCDV, "	 halt_status: %d\n", hc->halt_status);
+
+	return;
+}
+
+/**
+ * Clears the transfer state for a host channel. This function is normally
+ * called after a transfer is done and the host channel is being released.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param hc Identifies the host channel to clean up.
+ */
+void dwc_otg_hc_cleanup(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
+{
+	dwc_otg_hc_regs_t *hc_regs;
+
+	hc->xfer_started = 0;
+
+	/*
+	 * Clear channel interrupt enables and any unhandled channel interrupt
+	 * conditions.
+	 */
+	hc_regs = core_if->host_if->hc_regs[hc->hc_num];
+	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0);
+	DWC_WRITE_REG32(&hc_regs->hcint, 0xFFFFFFFF);
+#ifdef DEBUG
+	DWC_TIMER_CANCEL(core_if->hc_xfer_timer[hc->hc_num]);
+#endif
+}
+
+/**
+ * Sets the channel property that indicates in which frame a periodic transfer
+ * should occur. This is always set to the _next_ frame. This function has no
+ * effect on non-periodic transfers.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param hc Identifies the host channel to set up and its properties.
+ * @param hcchar Current value of the HCCHAR register for the specified host
+ * channel.
+ */
+static inline void hc_set_even_odd_frame(dwc_otg_core_if_t * core_if,
+					 dwc_hc_t * hc, hcchar_data_t * hcchar)
+{
+	if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
+	    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
+		hfnum_data_t hfnum;
+		hfnum.d32 =
+		    DWC_READ_REG32(&core_if->host_if->host_global_regs->hfnum);
+
+		/* 1 if _next_ frame is odd, 0 if it's even */
+		hcchar->b.oddfrm = (hfnum.b.frnum & 0x1) ? 0 : 1;
+#ifdef DEBUG
+		if (hc->ep_type == DWC_OTG_EP_TYPE_INTR && hc->do_split
+		    && !hc->complete_split) {
+			switch (hfnum.b.frnum & 0x7) {
+			case 7:
+				core_if->hfnum_7_samples++;
+				core_if->hfnum_7_frrem_accum += hfnum.b.frrem;
+				break;
+			case 0:
+				core_if->hfnum_0_samples++;
+				core_if->hfnum_0_frrem_accum += hfnum.b.frrem;
+				break;
+			default:
+				core_if->hfnum_other_samples++;
+				core_if->hfnum_other_frrem_accum +=
+				    hfnum.b.frrem;
+				break;
+			}
+		}
+#endif
+	}
+}
+
+#ifdef DEBUG
+void hc_xfer_timeout(void *ptr)
+{
+	hc_xfer_info_t *xfer_info = NULL;
+	int hc_num = 0;
+
+	if (ptr)
+		xfer_info = (hc_xfer_info_t *) ptr;
+
+	if (!xfer_info->hc) {
+		DWC_ERROR("xfer_info->hc = %p\n", xfer_info->hc);
+		return;
+	}
+
+	hc_num = xfer_info->hc->hc_num;
+	DWC_WARN("%s: timeout on channel %d\n", __func__, hc_num);
+	DWC_WARN("	start_hcchar_val 0x%08x\n",
+		 xfer_info->core_if->start_hcchar_val[hc_num]);
+}
+#endif
+
+void ep_xfer_timeout(void *ptr)
+{
+	ep_xfer_info_t *xfer_info = NULL;
+	int ep_num = 0;
+	dctl_data_t dctl = {.d32 = 0 };
+	gintsts_data_t gintsts = {.d32 = 0 };
+	gintmsk_data_t gintmsk = {.d32 = 0 };
+
+	if (ptr)
+		xfer_info = (ep_xfer_info_t *) ptr;
+
+	if (!xfer_info->ep) {
+		DWC_ERROR("xfer_info->ep = %p\n", xfer_info->ep);
+		return;
+	}
+
+	ep_num = xfer_info->ep->num;
+	DWC_WARN("%s: timeout on endpoit %d\n", __func__, ep_num);
+	/* Put the sate to 2 as it was time outed */
+	xfer_info->state = 2;
+
+	dctl.d32 =
+	    DWC_READ_REG32(&xfer_info->core_if->dev_if->dev_global_regs->dctl);
+	gintsts.d32 =
+	    DWC_READ_REG32(&xfer_info->core_if->core_global_regs->gintsts);
+	gintmsk.d32 =
+	    DWC_READ_REG32(&xfer_info->core_if->core_global_regs->gintmsk);
+
+	if (!gintmsk.b.goutnakeff) {
+		/* Unmask it */
+		gintmsk.b.goutnakeff = 1;
+		DWC_WRITE_REG32(&xfer_info->core_if->core_global_regs->gintmsk,
+				gintmsk.d32);
+
+	}
+
+	if (!gintsts.b.goutnakeff) {
+		dctl.b.sgoutnak = 1;
+	}
+	DWC_WRITE_REG32(&xfer_info->core_if->dev_if->dev_global_regs->dctl,
+			dctl.d32);
+
+}
+
+void set_pid_isoc(dwc_hc_t * hc)
+{
+	/* Set up the initial PID for the transfer. */
+	if (hc->speed == DWC_OTG_EP_SPEED_HIGH) {
+		if (hc->ep_is_in) {
+			if (hc->multi_count == 1) {
+				hc->data_pid_start = DWC_OTG_HC_PID_DATA0;
+			} else if (hc->multi_count == 2) {
+				hc->data_pid_start = DWC_OTG_HC_PID_DATA1;
+			} else {
+				hc->data_pid_start = DWC_OTG_HC_PID_DATA2;
+			}
+		} else {
+			if (hc->multi_count == 1) {
+				hc->data_pid_start = DWC_OTG_HC_PID_DATA0;
+			} else {
+				hc->data_pid_start = DWC_OTG_HC_PID_MDATA;
+			}
+		}
+	} else {
+		hc->data_pid_start = DWC_OTG_HC_PID_DATA0;
+	}
+}
+
+/**
+ * This function does the setup for a data transfer for a host channel and
+ * starts the transfer. May be called in either Slave mode or DMA mode. In
+ * Slave mode, the caller must ensure that there is sufficient space in the
+ * request queue and Tx Data FIFO.
+ *
+ * For an OUT transfer in Slave mode, it loads a data packet into the
+ * appropriate FIFO. If necessary, additional data packets will be loaded in
+ * the Host ISR.
+ *
+ * For an IN transfer in Slave mode, a data packet is requested. The data
+ * packets are unloaded from the Rx FIFO in the Host ISR. If necessary,
+ * additional data packets are requested in the Host ISR.
+ *
+ * For a PING transfer in Slave mode, the Do Ping bit is set in the HCTSIZ
+ * register along with a packet count of 1 and the channel is enabled. This
+ * causes a single PING transaction to occur. Other fields in HCTSIZ are
+ * simply set to 0 since no data transfer occurs in this case.
+ *
+ * For a PING transfer in DMA mode, the HCTSIZ register is initialized with
+ * all the information required to perform the subsequent data transfer. In
+ * addition, the Do Ping bit is set in the HCTSIZ register. In this case, the
+ * controller performs the entire PING protocol, then starts the data
+ * transfer.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param hc Information needed to initialize the host channel. The xfer_len
+ * value may be reduced to accommodate the max widths of the XferSize and
+ * PktCnt fields in the HCTSIZn register. The multi_count value may be changed
+ * to reflect the final xfer_len value.
+ */
+void dwc_otg_hc_start_transfer(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
+{
+	hcchar_data_t hcchar;
+	hctsiz_data_t hctsiz;
+	uint16_t num_packets;
+	uint32_t max_hc_xfer_size = core_if->core_params->max_transfer_size;
+	uint16_t max_hc_pkt_count = core_if->core_params->max_packet_count;
+	dwc_otg_hc_regs_t *hc_regs = core_if->host_if->hc_regs[hc->hc_num];
+
+	hctsiz.d32 = 0;
+
+	if (hc->do_ping) {
+		if (!core_if->dma_enable) {
+			dwc_otg_hc_do_ping(core_if, hc);
+			hc->xfer_started = 1;
+			return;
+		} else {
+			hctsiz.b.dopng = 1;
+		}
+	}
+
+	if (hc->do_split) {
+		num_packets = 1;
+
+		if (hc->complete_split && !hc->ep_is_in) {
+			/* For CSPLIT OUT Transfer, set the size to 0 so the
+			 * core doesn't expect any data written to the FIFO */
+			hc->xfer_len = 0;
+		} else if (hc->ep_is_in || (hc->xfer_len > hc->max_packet)) {
+			hc->xfer_len = hc->max_packet;
+		} else if (!hc->ep_is_in && (hc->xfer_len > 188)) {
+			hc->xfer_len = 188;
+		}
+
+		hctsiz.b.xfersize = hc->xfer_len;
+	} else {
+		/*
+		 * Ensure that the transfer length and packet count will fit
+		 * in the widths allocated for them in the HCTSIZn register.
+		 */
+		if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
+		    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
+			/*
+			 * Make sure the transfer size is no larger than one
+			 * (micro)frame's worth of data. (A check was done
+			 * when the periodic transfer was accepted to ensure
+			 * that a (micro)frame's worth of data can be
+			 * programmed into a channel.)
+			 */
+			uint32_t max_periodic_len =
+			    hc->multi_count * hc->max_packet;
+			if (hc->xfer_len > max_periodic_len) {
+				hc->xfer_len = max_periodic_len;
+			} else {
+			}
+		} else if (hc->xfer_len > max_hc_xfer_size) {
+			/* Make sure that xfer_len is a multiple of max packet size. */
+			hc->xfer_len = max_hc_xfer_size - hc->max_packet + 1;
+		}
+
+		if (hc->xfer_len > 0) {
+			num_packets =
+			    (hc->xfer_len + hc->max_packet -
+			     1) / hc->max_packet;
+			if (num_packets > max_hc_pkt_count) {
+				num_packets = max_hc_pkt_count;
+				hc->xfer_len = num_packets * hc->max_packet;
+			}
+		} else {
+			/* Need 1 packet for transfer length of 0. */
+			num_packets = 1;
+		}
+
+		if (hc->ep_is_in) {
+			/* Always program an integral # of max packets for IN transfers. */
+			hc->xfer_len = num_packets * hc->max_packet;
+		}
+
+		if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
+		    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
+			/*
+			 * Make sure that the multi_count field matches the
+			 * actual transfer length.
+			 */
+			hc->multi_count = num_packets;
+		}
+
+		if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)
+			set_pid_isoc(hc);
+
+		hctsiz.b.xfersize = hc->xfer_len;
+	}
+
+	hc->start_pkt_count = num_packets;
+	hctsiz.b.pktcnt = num_packets;
+	hctsiz.b.pid = hc->data_pid_start;
+	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
+
+	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
+	DWC_DEBUGPL(DBG_HCDV, "	 Xfer Size: %d\n", hctsiz.b.xfersize);
+	DWC_DEBUGPL(DBG_HCDV, "	 Num Pkts: %d\n", hctsiz.b.pktcnt);
+	DWC_DEBUGPL(DBG_HCDV, "	 Start PID: %d\n", hctsiz.b.pid);
+
+	if (core_if->dma_enable) {
+		dwc_dma_t dma_addr;
+		if (hc->align_buff) {
+			dma_addr = hc->align_buff;
+		} else {
+			dma_addr = ((unsigned long)hc->xfer_buff & 0xffffffff);
+		}
+		DWC_WRITE_REG32(&hc_regs->hcdma, dma_addr);
+	}
+
+	/* Start the split */
+	if (hc->do_split) {
+		hcsplt_data_t hcsplt;
+		hcsplt.d32 = DWC_READ_REG32(&hc_regs->hcsplt);
+		hcsplt.b.spltena = 1;
+		DWC_WRITE_REG32(&hc_regs->hcsplt, hcsplt.d32);
+	}
+
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	hcchar.b.multicnt = hc->multi_count;
+	hc_set_even_odd_frame(core_if, hc, &hcchar);
+#ifdef DEBUG
+	core_if->start_hcchar_val[hc->hc_num] = hcchar.d32;
+	if (hcchar.b.chdis) {
+		DWC_WARN("%s: chdis set, channel %d, hcchar 0x%08x\n",
+			 __func__, hc->hc_num, hcchar.d32);
+	}
+#endif
+
+	/* Set host channel enable after all other setup is complete. */
+	hcchar.b.chen = 1;
+	hcchar.b.chdis = 0;
+	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+
+	hc->xfer_started = 1;
+	hc->requests++;
+
+	if (!core_if->dma_enable && !hc->ep_is_in && hc->xfer_len > 0) {
+		/* Load OUT packet into the appropriate Tx FIFO. */
+		dwc_otg_hc_write_packet(core_if, hc);
+	}
+#ifdef DEBUG
+	if (hc->ep_type != DWC_OTG_EP_TYPE_INTR) {
+                DWC_DEBUGPL(DBG_HCDV, "transfer %d from core_if %p\n",
+                            hc->hc_num, core_if);//GRAYG
+		core_if->hc_xfer_info[hc->hc_num].core_if = core_if;
+		core_if->hc_xfer_info[hc->hc_num].hc = hc;
+
+		/* Start a timer for this transfer. */
+		DWC_TIMER_SCHEDULE(core_if->hc_xfer_timer[hc->hc_num], 10000);
+	}
+#endif
+}
+
+/**
+ * This function does the setup for a data transfer for a host channel
+ * and starts the transfer in Descriptor DMA mode.
+ *
+ * Initializes HCTSIZ register. For a PING transfer the Do Ping bit is set.
+ * Sets PID and NTD values. For periodic transfers
+ * initializes SCHED_INFO field with micro-frame bitmap.
+ *
+ * Initializes HCDMA register with descriptor list address and CTD value
+ * then starts the transfer via enabling the channel.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param hc Information needed to initialize the host channel.
+ */
+void dwc_otg_hc_start_transfer_ddma(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
+{
+	dwc_otg_hc_regs_t *hc_regs = core_if->host_if->hc_regs[hc->hc_num];
+	hcchar_data_t hcchar;
+	hctsiz_data_t hctsiz;
+	hcdma_data_t hcdma;
+
+	hctsiz.d32 = 0;
+
+	if (hc->do_ping)
+		hctsiz.b_ddma.dopng = 1;
+
+	if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)
+		set_pid_isoc(hc);
+
+	/* Packet Count and Xfer Size are not used in Descriptor DMA mode */
+	hctsiz.b_ddma.pid = hc->data_pid_start;
+	hctsiz.b_ddma.ntd = hc->ntd - 1;	/* 0 - 1 descriptor, 1 - 2 descriptors, etc. */
+	hctsiz.b_ddma.schinfo = hc->schinfo;	/* Non-zero only for high-speed interrupt endpoints */
+
+	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
+	DWC_DEBUGPL(DBG_HCDV, "	 Start PID: %d\n", hctsiz.b.pid);
+	DWC_DEBUGPL(DBG_HCDV, "	 NTD: %d\n", hctsiz.b_ddma.ntd);
+
+	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
+
+	hcdma.d32 = 0;
+	hcdma.b.dma_addr = ((uint32_t) hc->desc_list_addr) >> 11;
+
+	/* Always start from first descriptor. */
+	hcdma.b.ctd = 0;
+	DWC_WRITE_REG32(&hc_regs->hcdma, hcdma.d32);
+
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	hcchar.b.multicnt = hc->multi_count;
+
+#ifdef DEBUG
+	core_if->start_hcchar_val[hc->hc_num] = hcchar.d32;
+	if (hcchar.b.chdis) {
+		DWC_WARN("%s: chdis set, channel %d, hcchar 0x%08x\n",
+			 __func__, hc->hc_num, hcchar.d32);
+	}
+#endif
+
+	/* Set host channel enable after all other setup is complete. */
+	hcchar.b.chen = 1;
+	hcchar.b.chdis = 0;
+
+	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+
+	hc->xfer_started = 1;
+	hc->requests++;
+
+#ifdef DEBUG
+	if ((hc->ep_type != DWC_OTG_EP_TYPE_INTR)
+	    && (hc->ep_type != DWC_OTG_EP_TYPE_ISOC)) {
+                DWC_DEBUGPL(DBG_HCDV, "DMA transfer %d from core_if %p\n",
+                            hc->hc_num, core_if);//GRAYG
+		core_if->hc_xfer_info[hc->hc_num].core_if = core_if;
+		core_if->hc_xfer_info[hc->hc_num].hc = hc;
+		/* Start a timer for this transfer. */
+		DWC_TIMER_SCHEDULE(core_if->hc_xfer_timer[hc->hc_num], 10000);
+	}
+#endif
+
+}
+
+/**
+ * This function continues a data transfer that was started by previous call
+ * to <code>dwc_otg_hc_start_transfer</code>. The caller must ensure there is
+ * sufficient space in the request queue and Tx Data FIFO. This function
+ * should only be called in Slave mode. In DMA mode, the controller acts
+ * autonomously to complete transfers programmed to a host channel.
+ *
+ * For an OUT transfer, a new data packet is loaded into the appropriate FIFO
+ * if there is any data remaining to be queued. For an IN transfer, another
+ * data packet is always requested. For the SETUP phase of a control transfer,
+ * this function does nothing.
+ *
+ * @return 1 if a new request is queued, 0 if no more requests are required
+ * for this transfer.
+ */
+int dwc_otg_hc_continue_transfer(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
+{
+	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
+
+	if (hc->do_split) {
+		/* SPLITs always queue just once per channel */
+		return 0;
+	} else if (hc->data_pid_start == DWC_OTG_HC_PID_SETUP) {
+		/* SETUPs are queued only once since they can't be NAKed. */
+		return 0;
+	} else if (hc->ep_is_in) {
+		/*
+		 * Always queue another request for other IN transfers. If
+		 * back-to-back INs are issued and NAKs are received for both,
+		 * the driver may still be processing the first NAK when the
+		 * second NAK is received. When the interrupt handler clears
+		 * the NAK interrupt for the first NAK, the second NAK will
+		 * not be seen. So we can't depend on the NAK interrupt
+		 * handler to requeue a NAKed request. Instead, IN requests
+		 * are issued each time this function is called. When the
+		 * transfer completes, the extra requests for the channel will
+		 * be flushed.
+		 */
+		hcchar_data_t hcchar;
+		dwc_otg_hc_regs_t *hc_regs =
+		    core_if->host_if->hc_regs[hc->hc_num];
+
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+		hc_set_even_odd_frame(core_if, hc, &hcchar);
+		hcchar.b.chen = 1;
+		hcchar.b.chdis = 0;
+		DWC_DEBUGPL(DBG_HCDV, "	 IN xfer: hcchar = 0x%08x\n",
+			    hcchar.d32);
+		DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+		hc->requests++;
+		return 1;
+	} else {
+		/* OUT transfers. */
+		if (hc->xfer_count < hc->xfer_len) {
+			if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
+			    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
+				hcchar_data_t hcchar;
+				dwc_otg_hc_regs_t *hc_regs;
+				hc_regs = core_if->host_if->hc_regs[hc->hc_num];
+				hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+				hc_set_even_odd_frame(core_if, hc, &hcchar);
+			}
+
+			/* Load OUT packet into the appropriate Tx FIFO. */
+			dwc_otg_hc_write_packet(core_if, hc);
+			hc->requests++;
+			return 1;
+		} else {
+			return 0;
+		}
+	}
+}
+
+/**
+ * Starts a PING transfer. This function should only be called in Slave mode.
+ * The Do Ping bit is set in the HCTSIZ register, then the channel is enabled.
+ */
+void dwc_otg_hc_do_ping(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
+{
+	hcchar_data_t hcchar;
+	hctsiz_data_t hctsiz;
+	dwc_otg_hc_regs_t *hc_regs = core_if->host_if->hc_regs[hc->hc_num];
+
+	DWC_DEBUGPL(DBG_HCDV, "%s: Channel %d\n", __func__, hc->hc_num);
+
+	hctsiz.d32 = 0;
+	hctsiz.b.dopng = 1;
+	hctsiz.b.pktcnt = 1;
+	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
+
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	hcchar.b.chen = 1;
+	hcchar.b.chdis = 0;
+	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+}
+
+/*
+ * This function writes a packet into the Tx FIFO associated with the Host
+ * Channel. For a channel associated with a non-periodic EP, the non-periodic
+ * Tx FIFO is written. For a channel associated with a periodic EP, the
+ * periodic Tx FIFO is written. This function should only be called in Slave
+ * mode.
+ *
+ * Upon return the xfer_buff and xfer_count fields in _hc are incremented by
+ * then number of bytes written to the Tx FIFO.
+ */
+void dwc_otg_hc_write_packet(dwc_otg_core_if_t * core_if, dwc_hc_t * hc)
+{
+	uint32_t i;
+	uint32_t remaining_count;
+	uint32_t byte_count;
+	uint32_t dword_count;
+
+	uint32_t *data_buff = (uint32_t *) (hc->xfer_buff);
+	uint32_t *data_fifo = core_if->data_fifo[hc->hc_num];
+
+	remaining_count = hc->xfer_len - hc->xfer_count;
+	if (remaining_count > hc->max_packet) {
+		byte_count = hc->max_packet;
+	} else {
+		byte_count = remaining_count;
+	}
+
+	dword_count = (byte_count + 3) / 4;
+
+	if ((((unsigned long)data_buff) & 0x3) == 0) {
+		/* xfer_buff is DWORD aligned. */
+		for (i = 0; i < dword_count; i++, data_buff++) {
+			DWC_WRITE_REG32(data_fifo, *data_buff);
+		}
+	} else {
+		/* xfer_buff is not DWORD aligned. */
+		for (i = 0; i < dword_count; i++, data_buff++) {
+			uint32_t data;
+			data =
+			    (data_buff[0] | data_buff[1] << 8 | data_buff[2] <<
+			     16 | data_buff[3] << 24);
+			DWC_WRITE_REG32(data_fifo, data);
+		}
+	}
+
+	hc->xfer_count += byte_count;
+	hc->xfer_buff += byte_count;
+}
+
+/**
+ * Gets the current USB frame number. This is the frame number from the last
+ * SOF packet.
+ */
+uint32_t dwc_otg_get_frame_number(dwc_otg_core_if_t * core_if)
+{
+	dsts_data_t dsts;
+	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
+
+	/* read current frame/microframe number from DSTS register */
+	return dsts.b.soffn;
+}
+
+/**
+ * Calculates and gets the frame Interval value of HFIR register according PHY
+ * type and speed.The application can modify a value of HFIR register only after
+ * the Port Enable bit of the Host Port Control and Status register
+ * (HPRT.PrtEnaPort) has been set.
+*/
+
+uint32_t calc_frame_interval(dwc_otg_core_if_t * core_if)
+{
+	gusbcfg_data_t usbcfg;
+	hwcfg2_data_t hwcfg2;
+	hprt0_data_t hprt0;
+	int clock = 60;		// default value
+	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+	hwcfg2.d32 = DWC_READ_REG32(&core_if->core_global_regs->ghwcfg2);
+	hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
+	if (!usbcfg.b.physel && usbcfg.b.ulpi_utmi_sel && !usbcfg.b.phyif)
+		clock = 60;
+	if (usbcfg.b.physel && hwcfg2.b.fs_phy_type == 3)
+		clock = 48;
+	if (!usbcfg.b.phylpwrclksel && !usbcfg.b.physel &&
+	    !usbcfg.b.ulpi_utmi_sel && usbcfg.b.phyif)
+		clock = 30;
+	if (!usbcfg.b.phylpwrclksel && !usbcfg.b.physel &&
+	    !usbcfg.b.ulpi_utmi_sel && !usbcfg.b.phyif)
+		clock = 60;
+	if (usbcfg.b.phylpwrclksel && !usbcfg.b.physel &&
+	    !usbcfg.b.ulpi_utmi_sel && usbcfg.b.phyif)
+		clock = 48;
+	if (usbcfg.b.physel && !usbcfg.b.phyif && hwcfg2.b.fs_phy_type == 2)
+		clock = 48;
+	if (usbcfg.b.physel && hwcfg2.b.fs_phy_type == 1)
+		clock = 48;
+	if (hprt0.b.prtspd == 0)
+		/* High speed case */
+		return 125 * clock - 1;
+	else
+		/* FS/LS case */
+		return 1000 * clock - 1;
+}
+
+/**
+ * This function reads a setup packet from the Rx FIFO into the destination
+ * buffer. This function is called from the Rx Status Queue Level (RxStsQLvl)
+ * Interrupt routine when a SETUP packet has been received in Slave mode.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param dest Destination buffer for packet data.
+ */
+void dwc_otg_read_setup_packet(dwc_otg_core_if_t * core_if, uint32_t * dest)
+{
+	device_grxsts_data_t status;
+	/* Get the 8 bytes of a setup transaction data */
+
+	/* Pop 2 DWORDS off the receive data FIFO into memory */
+	dest[0] = DWC_READ_REG32(core_if->data_fifo[0]);
+	dest[1] = DWC_READ_REG32(core_if->data_fifo[0]);
+	if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
+		status.d32 =
+		    DWC_READ_REG32(&core_if->core_global_regs->grxstsp);
+		DWC_DEBUGPL(DBG_ANY,
+			    "EP:%d BCnt:%d " "pktsts:%x Frame:%d(0x%0x)\n",
+			    status.b.epnum, status.b.bcnt, status.b.pktsts,
+			    status.b.fn, status.b.fn);
+	}
+}
+
+/**
+ * This function enables EP0 OUT to receive SETUP packets and configures EP0
+ * IN for transmitting packets. It is normally called when the
+ * "Enumeration Done" interrupt occurs.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP0 data.
+ */
+void dwc_otg_ep0_activate(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	dsts_data_t dsts;
+	depctl_data_t diepctl;
+	depctl_data_t doepctl;
+	dctl_data_t dctl = {.d32 = 0 };
+
+	ep->stp_rollover = 0;
+	/* Read the Device Status and Endpoint 0 Control registers */
+	dsts.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dsts);
+	diepctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl);
+	doepctl.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl);
+
+	/* Set the MPS of the IN EP based on the enumeration speed */
+	switch (dsts.b.enumspd) {
+	case DWC_DSTS_ENUMSPD_HS_PHY_30MHZ_OR_60MHZ:
+	case DWC_DSTS_ENUMSPD_FS_PHY_30MHZ_OR_60MHZ:
+	case DWC_DSTS_ENUMSPD_FS_PHY_48MHZ:
+		diepctl.b.mps = DWC_DEP0CTL_MPS_64;
+		break;
+	case DWC_DSTS_ENUMSPD_LS_PHY_6MHZ:
+		diepctl.b.mps = DWC_DEP0CTL_MPS_8;
+		break;
+	}
+
+	DWC_WRITE_REG32(&dev_if->in_ep_regs[0]->diepctl, diepctl.d32);
+
+	/* Enable OUT EP for receive */
+	if (core_if->snpsid <= OTG_CORE_REV_2_94a) {
+	doepctl.b.epena = 1;
+	DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doepctl, doepctl.d32);
+	}
+#ifdef VERBOSE
+	DWC_DEBUGPL(DBG_PCDV, "doepctl0=%0x\n",
+		    DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl));
+	DWC_DEBUGPL(DBG_PCDV, "diepctl0=%0x\n",
+		    DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl));
+#endif
+	dctl.b.cgnpinnak = 1;
+
+	DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
+	DWC_DEBUGPL(DBG_PCDV, "dctl=%0x\n",
+		    DWC_READ_REG32(&dev_if->dev_global_regs->dctl));
+
+}
+
+/**
+ * This function activates an EP.  The Device EP control register for
+ * the EP is configured as defined in the ep structure. Note: This
+ * function is not used for EP0.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to activate.
+ */
+void dwc_otg_ep_activate(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	depctl_data_t depctl;
+	volatile uint32_t *addr;
+	daint_data_t daintmsk = {.d32 = 0 };
+	dcfg_data_t dcfg;
+	uint8_t i;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s() EP%d-%s\n", __func__, ep->num,
+		    (ep->is_in ? "IN" : "OUT"));
+
+#ifdef DWC_UTE_PER_IO
+	ep->xiso_frame_num = 0xFFFFFFFF;
+	ep->xiso_active_xfers = 0;
+	ep->xiso_queued_xfers = 0;
+#endif
+	/* Read DEPCTLn register */
+	if (ep->is_in == 1) {
+		addr = &dev_if->in_ep_regs[ep->num]->diepctl;
+		daintmsk.ep.in = 1 << ep->num;
+	} else {
+		addr = &dev_if->out_ep_regs[ep->num]->doepctl;
+		daintmsk.ep.out = 1 << ep->num;
+	}
+
+	/* If the EP is already active don't change the EP Control
+	 * register. */
+	depctl.d32 = DWC_READ_REG32(addr);
+	if (!depctl.b.usbactep) {
+		depctl.b.mps = ep->maxpacket;
+		depctl.b.eptype = ep->type;
+		depctl.b.txfnum = ep->tx_fifo_num;
+
+		if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
+			depctl.b.setd0pid = 1;	// ???
+		} else {
+			depctl.b.setd0pid = 1;
+		}
+		depctl.b.usbactep = 1;
+
+		/* Update nextep_seq array and EPMSCNT in DCFG*/
+		if (!(depctl.b.eptype & 1) && (ep->is_in == 1)) {	// NP IN EP
+			for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
+				if (core_if->nextep_seq[i] == core_if->first_in_nextep_seq)
+				break;
+			}
+			core_if->nextep_seq[i] = ep->num;
+			core_if->nextep_seq[ep->num] = core_if->first_in_nextep_seq;
+			depctl.b.nextep = core_if->nextep_seq[ep->num];
+			dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
+			dcfg.b.epmscnt++;
+			DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
+
+			DWC_DEBUGPL(DBG_PCDV,
+				    "%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
+				__func__, core_if->first_in_nextep_seq);
+			for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
+				DWC_DEBUGPL(DBG_PCDV, "%2d\n",
+					    core_if->nextep_seq[i]);
+			}
+
+		}
+
+
+		DWC_WRITE_REG32(addr, depctl.d32);
+		DWC_DEBUGPL(DBG_PCDV, "DEPCTL=%08x\n", DWC_READ_REG32(addr));
+	}
+
+	/* Enable the Interrupt for this EP */
+	if (core_if->multiproc_int_enable) {
+		if (ep->is_in == 1) {
+			diepmsk_data_t diepmsk = {.d32 = 0 };
+			diepmsk.b.xfercompl = 1;
+			diepmsk.b.timeout = 1;
+			diepmsk.b.epdisabled = 1;
+			diepmsk.b.ahberr = 1;
+			diepmsk.b.intknepmis = 1;
+			if (!core_if->en_multiple_tx_fifo && core_if->dma_enable)
+				diepmsk.b.intknepmis = 0;
+			diepmsk.b.txfifoundrn = 1;	//?????
+			if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
+				diepmsk.b.nak = 1;
+			}
+
+
+
+/*
+			if (core_if->dma_desc_enable) {
+				diepmsk.b.bna = 1;
+			}
+*/
+/*
+			if (core_if->dma_enable) {
+				doepmsk.b.nak = 1;
+			}
+*/
+			DWC_WRITE_REG32(&dev_if->dev_global_regs->
+					diepeachintmsk[ep->num], diepmsk.d32);
+
+		} else {
+			doepmsk_data_t doepmsk = {.d32 = 0 };
+			doepmsk.b.xfercompl = 1;
+			doepmsk.b.ahberr = 1;
+			doepmsk.b.epdisabled = 1;
+			if (ep->type == DWC_OTG_EP_TYPE_ISOC)
+				doepmsk.b.outtknepdis = 1;
+
+/*
+
+			if (core_if->dma_desc_enable) {
+				doepmsk.b.bna = 1;
+			}
+*/
+/*
+			doepmsk.b.babble = 1;
+			doepmsk.b.nyet = 1;
+			doepmsk.b.nak = 1;
+*/
+			DWC_WRITE_REG32(&dev_if->dev_global_regs->
+					doepeachintmsk[ep->num], doepmsk.d32);
+		}
+		DWC_MODIFY_REG32(&dev_if->dev_global_regs->deachintmsk,
+				 0, daintmsk.d32);
+	} else {
+		if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
+			if (ep->is_in) {
+				diepmsk_data_t diepmsk = {.d32 = 0 };
+				diepmsk.b.nak = 1;
+				DWC_MODIFY_REG32(&dev_if->dev_global_regs->diepmsk, 0, diepmsk.d32);
+			} else {
+				doepmsk_data_t doepmsk = {.d32 = 0 };
+				doepmsk.b.outtknepdis = 1;
+				DWC_MODIFY_REG32(&dev_if->dev_global_regs->doepmsk, 0, doepmsk.d32);
+			}
+		}
+		DWC_MODIFY_REG32(&dev_if->dev_global_regs->daintmsk,
+				 0, daintmsk.d32);
+	}
+
+	DWC_DEBUGPL(DBG_PCDV, "DAINTMSK=%0x\n",
+		    DWC_READ_REG32(&dev_if->dev_global_regs->daintmsk));
+
+	ep->stall_clear_flag = 0;
+
+	return;
+}
+
+/**
+ * This function deactivates an EP. This is done by clearing the USB Active
+ * EP bit in the Device EP control register. Note: This function is not used
+ * for EP0. EP0 cannot be deactivated.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to deactivate.
+ */
+void dwc_otg_ep_deactivate(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	depctl_data_t depctl = {.d32 = 0 };
+	volatile uint32_t *addr;
+	daint_data_t daintmsk = {.d32 = 0 };
+	dcfg_data_t dcfg;
+	uint8_t i = 0;
+
+#ifdef DWC_UTE_PER_IO
+	ep->xiso_frame_num = 0xFFFFFFFF;
+	ep->xiso_active_xfers = 0;
+	ep->xiso_queued_xfers = 0;
+#endif
+
+	/* Read DEPCTLn register */
+	if (ep->is_in == 1) {
+		addr = &core_if->dev_if->in_ep_regs[ep->num]->diepctl;
+		daintmsk.ep.in = 1 << ep->num;
+	} else {
+		addr = &core_if->dev_if->out_ep_regs[ep->num]->doepctl;
+		daintmsk.ep.out = 1 << ep->num;
+	}
+
+	depctl.d32 = DWC_READ_REG32(addr);
+
+	depctl.b.usbactep = 0;
+
+	/* Update nextep_seq array and EPMSCNT in DCFG*/
+	if (!(depctl.b.eptype & 1) && ep->is_in == 1) {	// NP EP IN
+		for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
+			if (core_if->nextep_seq[i] == ep->num)
+			break;
+		}
+		core_if->nextep_seq[i] = core_if->nextep_seq[ep->num];
+		if (core_if->first_in_nextep_seq == ep->num)
+			core_if->first_in_nextep_seq = i;
+		core_if->nextep_seq[ep->num] = 0xff;
+		depctl.b.nextep = 0;
+		dcfg.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
+		dcfg.b.epmscnt--;
+		DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg,
+				dcfg.d32);
+
+		DWC_DEBUGPL(DBG_PCDV,
+			    "%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
+				__func__, core_if->first_in_nextep_seq);
+			for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
+				DWC_DEBUGPL(DBG_PCDV, "%2d\n", core_if->nextep_seq[i]);
+			}
+	}
+
+	if (ep->is_in == 1)
+		depctl.b.txfnum = 0;
+
+	if (core_if->dma_desc_enable)
+		depctl.b.epdis = 1;
+
+	DWC_WRITE_REG32(addr, depctl.d32);
+	depctl.d32 = DWC_READ_REG32(addr);
+	if (core_if->dma_enable && ep->type == DWC_OTG_EP_TYPE_ISOC
+	    && depctl.b.epena) {
+		depctl_data_t depctl = {.d32 = 0};
+		if (ep->is_in) {
+			diepint_data_t diepint = {.d32 = 0};
+
+			depctl.b.snak = 1;
+			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
+					diepctl, depctl.d32);
+			do {
+				dwc_udelay(10);
+				diepint.d32 =
+				    DWC_READ_REG32(&core_if->
+						   dev_if->in_ep_regs[ep->num]->
+						   diepint);
+			} while (!diepint.b.inepnakeff);
+			diepint.b.inepnakeff = 1;
+			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
+					diepint, diepint.d32);
+			depctl.d32 = 0;
+			depctl.b.epdis = 1;
+			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
+					diepctl, depctl.d32);
+			do {
+				dwc_udelay(10);
+				diepint.d32 =
+				    DWC_READ_REG32(&core_if->
+						   dev_if->in_ep_regs[ep->num]->
+						   diepint);
+			} while (!diepint.b.epdisabled);
+			diepint.b.epdisabled = 1;
+			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
+					diepint, diepint.d32);
+		} else {
+			dctl_data_t dctl = {.d32 = 0};
+			gintmsk_data_t gintsts = {.d32 = 0};
+			doepint_data_t doepint = {.d32 = 0};
+			dctl.b.sgoutnak = 1;
+			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
+					 dctl, 0, dctl.d32);
+			do {
+				dwc_udelay(10);
+				gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+			} while (!gintsts.b.goutnakeff);
+			gintsts.d32 = 0;
+			gintsts.b.goutnakeff = 1;
+			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+			depctl.d32 = 0;
+			depctl.b.epdis = 1;
+			depctl.b.snak = 1;
+			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[ep->num]->doepctl, depctl.d32);
+			do
+			{
+				dwc_udelay(10);
+				doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
+											out_ep_regs[ep->num]->doepint);
+			} while (!doepint.b.epdisabled);
+
+			doepint.b.epdisabled = 1;
+			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[ep->num]->doepint, doepint.d32);
+
+			dctl.d32 = 0;
+			dctl.b.cgoutnak = 1;
+			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
+		}
+	}
+
+	/* Disable the Interrupt for this EP */
+	if (core_if->multiproc_int_enable) {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->deachintmsk,
+				 daintmsk.d32, 0);
+
+		if (ep->is_in == 1) {
+			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->
+					diepeachintmsk[ep->num], 0);
+		} else {
+			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->
+					doepeachintmsk[ep->num], 0);
+		}
+	} else {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->daintmsk,
+				 daintmsk.d32, 0);
+	}
+
+}
+
+/**
+ * This function initializes dma descriptor chain.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ */
+static void init_dma_desc_chain(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	dwc_otg_dev_dma_desc_t *dma_desc;
+	uint32_t offset;
+	uint32_t xfer_est;
+	int i;
+	unsigned maxxfer_local, total_len;
+
+	if (!ep->is_in && ep->type == DWC_OTG_EP_TYPE_INTR &&
+					(ep->maxpacket%4)) {
+		maxxfer_local = ep->maxpacket;
+		total_len = ep->xfer_len;
+	} else {
+		maxxfer_local = ep->maxxfer;
+		total_len = ep->total_len;
+	}
+
+	ep->desc_cnt = (total_len / maxxfer_local) +
+            ((total_len % maxxfer_local) ? 1 : 0);
+
+	if (!ep->desc_cnt)
+		ep->desc_cnt = 1;
+
+	if (ep->desc_cnt > MAX_DMA_DESC_CNT)
+		ep->desc_cnt = MAX_DMA_DESC_CNT;
+
+	dma_desc = ep->desc_addr;
+	if (maxxfer_local == ep->maxpacket) {
+		if ((total_len % maxxfer_local) &&
+				(total_len/maxxfer_local < MAX_DMA_DESC_CNT)) {
+			xfer_est = (ep->desc_cnt - 1) * maxxfer_local +
+					(total_len % maxxfer_local);
+		} else
+			xfer_est = ep->desc_cnt * maxxfer_local;
+	} else
+		xfer_est = total_len;
+	offset = 0;
+	for (i = 0; i < ep->desc_cnt; ++i) {
+		/** DMA Descriptor Setup */
+		if (xfer_est > maxxfer_local) {
+			dma_desc->status.b.bs = BS_HOST_BUSY;
+			dma_desc->status.b.l = 0;
+			dma_desc->status.b.ioc = 0;
+			dma_desc->status.b.sp = 0;
+			dma_desc->status.b.bytes = maxxfer_local;
+			dma_desc->buf = ep->dma_addr + offset;
+			dma_desc->status.b.sts = 0;
+			dma_desc->status.b.bs = BS_HOST_READY;
+
+			xfer_est -= maxxfer_local;
+			offset += maxxfer_local;
+		} else {
+			dma_desc->status.b.bs = BS_HOST_BUSY;
+			dma_desc->status.b.l = 1;
+			dma_desc->status.b.ioc = 1;
+			if (ep->is_in) {
+				dma_desc->status.b.sp =
+				    (xfer_est %
+				     ep->maxpacket) ? 1 : ((ep->
+							    sent_zlp) ? 1 : 0);
+				dma_desc->status.b.bytes = xfer_est;
+			} else {
+				if (maxxfer_local == ep->maxpacket)
+					dma_desc->status.b.bytes = xfer_est;
+				else
+					dma_desc->status.b.bytes =
+						xfer_est + ((4 - (xfer_est & 0x3)) & 0x3);
+			}
+
+			dma_desc->buf = ep->dma_addr + offset;
+			dma_desc->status.b.sts = 0;
+			dma_desc->status.b.bs = BS_HOST_READY;
+		}
+		dma_desc++;
+	}
+}
+/**
+ * This function is called when to write ISOC data into appropriate dedicated
+ * periodic FIFO.
+ */
+static int32_t write_isoc_tx_fifo(dwc_otg_core_if_t * core_if, dwc_ep_t * dwc_ep)
+{
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	dwc_otg_dev_in_ep_regs_t *ep_regs;
+	dtxfsts_data_t txstatus = {.d32 = 0 };
+	uint32_t len = 0;
+	int epnum = dwc_ep->num;
+	int dwords;
+
+	DWC_DEBUGPL(DBG_PCD, "Dedicated TxFifo Empty: %d \n", epnum);
+
+	ep_regs = core_if->dev_if->in_ep_regs[epnum];
+
+	len = dwc_ep->xfer_len - dwc_ep->xfer_count;
+
+	if (len > dwc_ep->maxpacket) {
+		len = dwc_ep->maxpacket;
+	}
+
+	dwords = (len + 3) / 4;
+
+	/* While there is space in the queue and space in the FIFO and
+	 * More data to tranfer, Write packets to the Tx FIFO */
+	txstatus.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts);
+	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", epnum, txstatus.d32);
+
+	while (txstatus.b.txfspcavail > dwords &&
+	       dwc_ep->xfer_count < dwc_ep->xfer_len && dwc_ep->xfer_len != 0) {
+		/* Write the FIFO */
+		dwc_otg_ep_write_packet(core_if, dwc_ep, 0);
+
+		len = dwc_ep->xfer_len - dwc_ep->xfer_count;
+		if (len > dwc_ep->maxpacket) {
+			len = dwc_ep->maxpacket;
+		}
+
+		dwords = (len + 3) / 4;
+		txstatus.d32 =
+		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts);
+		DWC_DEBUGPL(DBG_PCDV, "dtxfsts[%d]=0x%08x\n", epnum,
+			    txstatus.d32);
+	}
+
+	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", epnum,
+		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts));
+
+	return 1;
+}
+/**
+ * This function does the setup for a data transfer for an EP and
+ * starts the transfer. For an IN transfer, the packets will be
+ * loaded into the appropriate Tx FIFO in the ISR. For OUT transfers,
+ * the packets are unloaded from the Rx FIFO in the ISR.  the ISR.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ */
+
+void dwc_otg_ep_start_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	depctl_data_t depctl;
+	deptsiz_data_t deptsiz;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "%s()\n", __func__);
+	DWC_DEBUGPL(DBG_PCD, "ep%d-%s xfer_len=%d xfer_cnt=%d "
+		    "xfer_buff=%p start_xfer_buff=%p, total_len = %d\n",
+		    ep->num, (ep->is_in ? "IN" : "OUT"), ep->xfer_len,
+		    ep->xfer_count, ep->xfer_buff, ep->start_xfer_buff,
+		    ep->total_len);
+	/* IN endpoint */
+	if (ep->is_in == 1) {
+		dwc_otg_dev_in_ep_regs_t *in_regs =
+		    core_if->dev_if->in_ep_regs[ep->num];
+
+		gnptxsts_data_t gtxstatus;
+
+		gtxstatus.d32 =
+		    DWC_READ_REG32(&core_if->core_global_regs->gnptxsts);
+
+		if (core_if->en_multiple_tx_fifo == 0
+		    && gtxstatus.b.nptxqspcavail == 0 && !core_if->dma_enable) {
+#ifdef DEBUG
+			DWC_PRINTF("TX Queue Full (0x%0x)\n", gtxstatus.d32);
+#endif
+			return;
+		}
+
+		depctl.d32 = DWC_READ_REG32(&(in_regs->diepctl));
+		deptsiz.d32 = DWC_READ_REG32(&(in_regs->dieptsiz));
+
+		if (ep->maxpacket > ep->maxxfer / MAX_PKT_CNT)
+			ep->xfer_len += (ep->maxxfer < (ep->total_len - ep->xfer_len)) ?
+				ep->maxxfer : (ep->total_len - ep->xfer_len);
+		else
+			ep->xfer_len += (MAX_PKT_CNT * ep->maxpacket < (ep->total_len - ep->xfer_len)) ?
+				 MAX_PKT_CNT * ep->maxpacket : (ep->total_len - ep->xfer_len);
+
+
+		/* Zero Length Packet? */
+		if ((ep->xfer_len - ep->xfer_count) == 0) {
+			deptsiz.b.xfersize = 0;
+			deptsiz.b.pktcnt = 1;
+		} else {
+			/* Program the transfer size and packet count
+			 *      as follows: xfersize = N * maxpacket +
+			 *      short_packet pktcnt = N + (short_packet
+			 *      exist ? 1 : 0)
+			 */
+			deptsiz.b.xfersize = ep->xfer_len - ep->xfer_count;
+			deptsiz.b.pktcnt =
+			    (ep->xfer_len - ep->xfer_count - 1 +
+			     ep->maxpacket) / ep->maxpacket;
+			if (deptsiz.b.pktcnt > MAX_PKT_CNT) {
+				deptsiz.b.pktcnt = MAX_PKT_CNT;
+				deptsiz.b.xfersize = deptsiz.b.pktcnt * ep->maxpacket;
+			}
+			if (ep->type == DWC_OTG_EP_TYPE_ISOC)
+				deptsiz.b.mc = deptsiz.b.pktcnt;
+		}
+
+		/* Write the DMA register */
+		if (core_if->dma_enable) {
+			if (core_if->dma_desc_enable == 0) {
+				if (ep->type != DWC_OTG_EP_TYPE_ISOC)
+					deptsiz.b.mc = 1;
+				DWC_WRITE_REG32(&in_regs->dieptsiz,
+						deptsiz.d32);
+				DWC_WRITE_REG32(&(in_regs->diepdma),
+						(uint32_t) ep->dma_addr);
+			} else {
+#ifdef DWC_UTE_CFI
+				/* The descriptor chain should be already initialized by now */
+				if (ep->buff_mode != BM_STANDARD) {
+					DWC_WRITE_REG32(&in_regs->diepdma,
+							ep->descs_dma_addr);
+				} else {
+#endif
+					init_dma_desc_chain(core_if, ep);
+				/** DIEPDMAn Register write */
+					DWC_WRITE_REG32(&in_regs->diepdma,
+							ep->dma_desc_addr);
+#ifdef DWC_UTE_CFI
+				}
+#endif
+			}
+		} else {
+			DWC_WRITE_REG32(&in_regs->dieptsiz, deptsiz.d32);
+			if (ep->type != DWC_OTG_EP_TYPE_ISOC) {
+				/**
+				 * Enable the Non-Periodic Tx FIFO empty interrupt,
+				 * or the Tx FIFO epmty interrupt in dedicated Tx FIFO mode,
+				 * the data will be written into the fifo by the ISR.
+				 */
+				if (core_if->en_multiple_tx_fifo == 0) {
+					intr_mask.b.nptxfempty = 1;
+					DWC_MODIFY_REG32
+					    (&core_if->core_global_regs->gintmsk,
+					     intr_mask.d32, intr_mask.d32);
+				} else {
+					/* Enable the Tx FIFO Empty Interrupt for this EP */
+					if (ep->xfer_len > 0) {
+						uint32_t fifoemptymsk = 0;
+						fifoemptymsk = 1 << ep->num;
+						DWC_MODIFY_REG32
+						    (&core_if->dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
+						     0, fifoemptymsk);
+
+					}
+				}
+			}  else {
+					 write_isoc_tx_fifo(core_if, ep);
+			}
+		}
+		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable)
+			depctl.b.nextep = core_if->nextep_seq[ep->num];
+
+		if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
+			dsts_data_t dsts = {.d32 = 0};
+			if (ep->bInterval == 1) {
+				dsts.d32 =
+				    DWC_READ_REG32(&core_if->dev_if->
+						   dev_global_regs->dsts);
+				ep->frame_num = dsts.b.soffn + ep->bInterval;
+				if (ep->frame_num > 0x3FFF) {
+					ep->frm_overrun = 1;
+					ep->frame_num &= 0x3FFF;
+				} else
+					ep->frm_overrun = 0;
+				if (ep->frame_num & 0x1) {
+					depctl.b.setd1pid = 1;
+				} else {
+					depctl.b.setd0pid = 1;
+				}
+			}
+		}
+		/* EP enable, IN data in FIFO */
+		depctl.b.cnak = 1;
+		depctl.b.epena = 1;
+		DWC_WRITE_REG32(&in_regs->diepctl, depctl.d32);
+
+	} else {
+		/* OUT endpoint */
+		dwc_otg_dev_out_ep_regs_t *out_regs =
+		    core_if->dev_if->out_ep_regs[ep->num];
+
+		depctl.d32 = DWC_READ_REG32(&(out_regs->doepctl));
+		deptsiz.d32 = DWC_READ_REG32(&(out_regs->doeptsiz));
+
+		if (!core_if->dma_desc_enable) {
+			if (ep->maxpacket > ep->maxxfer / MAX_PKT_CNT)
+				ep->xfer_len += (ep->maxxfer < (ep->total_len - ep->xfer_len)) ?
+				ep->maxxfer : (ep->total_len - ep->xfer_len);
+                else
+					ep->xfer_len += (MAX_PKT_CNT * ep->maxpacket < (ep->total_len
+					- ep->xfer_len)) ? MAX_PKT_CNT * ep->maxpacket : (ep->total_len - ep->xfer_len);
+		}
+
+		/* Program the transfer size and packet count as follows:
+		 *
+		 *      pktcnt = N
+		 *      xfersize = N * maxpacket
+		 */
+		if ((ep->xfer_len - ep->xfer_count) == 0) {
+			/* Zero Length Packet */
+			deptsiz.b.xfersize = ep->maxpacket;
+			deptsiz.b.pktcnt = 1;
+		} else {
+			deptsiz.b.pktcnt =
+			    (ep->xfer_len - ep->xfer_count +
+			     (ep->maxpacket - 1)) / ep->maxpacket;
+			if (deptsiz.b.pktcnt > MAX_PKT_CNT) {
+				deptsiz.b.pktcnt = MAX_PKT_CNT;
+			}
+			if (!core_if->dma_desc_enable) {
+				ep->xfer_len =
+					deptsiz.b.pktcnt * ep->maxpacket + ep->xfer_count;
+			}
+			deptsiz.b.xfersize = ep->xfer_len - ep->xfer_count;
+		}
+
+		DWC_DEBUGPL(DBG_PCDV, "ep%d xfersize=%d pktcnt=%d\n",
+			    ep->num, deptsiz.b.xfersize, deptsiz.b.pktcnt);
+
+		if (core_if->dma_enable) {
+			if (!core_if->dma_desc_enable) {
+				DWC_WRITE_REG32(&out_regs->doeptsiz,
+						deptsiz.d32);
+
+				DWC_WRITE_REG32(&(out_regs->doepdma),
+						(uint32_t) ep->dma_addr);
+			} else {
+#ifdef DWC_UTE_CFI
+				/* The descriptor chain should be already initialized by now */
+				if (ep->buff_mode != BM_STANDARD) {
+					DWC_WRITE_REG32(&out_regs->doepdma,
+							ep->descs_dma_addr);
+				} else {
+#endif
+					/** This is used for interrupt out transfers*/
+					if (!ep->xfer_len)
+						ep->xfer_len = ep->total_len;
+					init_dma_desc_chain(core_if, ep);
+
+					if (core_if->core_params->dev_out_nak) {
+						if (ep->type == DWC_OTG_EP_TYPE_BULK) {
+							deptsiz.b.pktcnt = (ep->total_len +
+								(ep->maxpacket - 1)) / ep->maxpacket;
+							deptsiz.b.xfersize = ep->total_len;
+							/* Remember initial value of doeptsiz */
+							core_if->start_doeptsiz_val[ep->num] = deptsiz.d32;
+							DWC_WRITE_REG32(&out_regs->doeptsiz,
+								deptsiz.d32);
+						}
+					}
+				/** DOEPDMAn Register write */
+					DWC_WRITE_REG32(&out_regs->doepdma,
+							ep->dma_desc_addr);
+#ifdef DWC_UTE_CFI
+				}
+#endif
+			}
+		} else {
+			DWC_WRITE_REG32(&out_regs->doeptsiz, deptsiz.d32);
+		}
+
+		if (ep->type == DWC_OTG_EP_TYPE_ISOC) {
+			dsts_data_t dsts = {.d32 = 0};
+			if (ep->bInterval == 1) {
+				dsts.d32 =
+				    DWC_READ_REG32(&core_if->dev_if->
+						   dev_global_regs->dsts);
+				ep->frame_num = dsts.b.soffn + ep->bInterval;
+				if (ep->frame_num > 0x3FFF) {
+					ep->frm_overrun = 1;
+					ep->frame_num &= 0x3FFF;
+				} else
+					ep->frm_overrun = 0;
+
+				if (ep->frame_num & 0x1) {
+					depctl.b.setd1pid = 1;
+				} else {
+					depctl.b.setd0pid = 1;
+				}
+			}
+		}
+
+		/* EP enable */
+		depctl.b.cnak = 1;
+		depctl.b.epena = 1;
+
+		DWC_WRITE_REG32(&out_regs->doepctl, depctl.d32);
+
+		DWC_DEBUGPL(DBG_PCD, "DOEPCTL=%08x DOEPTSIZ=%08x\n",
+			    DWC_READ_REG32(&out_regs->doepctl),
+			    DWC_READ_REG32(&out_regs->doeptsiz));
+		DWC_DEBUGPL(DBG_PCD, "DAINTMSK=%08x GINTMSK=%08x\n",
+			    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->
+					   daintmsk),
+			    DWC_READ_REG32(&core_if->core_global_regs->
+					   gintmsk));
+
+		/* Timer is scheduling only for out bulk transfers for
+		 * "Device DDMA OUT NAK Enhancement" feature to inform user
+		 * about received data payload in case of timeout
+		 */
+		if (core_if->core_params->dev_out_nak) {
+			if (ep->type == DWC_OTG_EP_TYPE_BULK) {
+				core_if->ep_xfer_info[ep->num].core_if = core_if;
+				core_if->ep_xfer_info[ep->num].ep = ep;
+				core_if->ep_xfer_info[ep->num].state = 1;
+
+				/* Start a timer for this transfer. */
+				DWC_TIMER_SCHEDULE(core_if->ep_xfer_timer[ep->num], 10000);
+			}
+		}
+	}
+}
+
+/**
+ * This function setup a zero length transfer in Buffer DMA and
+ * Slave modes for usb requests with zero field set
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ *
+ */
+void dwc_otg_ep_start_zl_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+
+	depctl_data_t depctl;
+	deptsiz_data_t deptsiz;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "%s()\n", __func__);
+	DWC_PRINTF("zero length transfer is called\n");
+
+	/* IN endpoint */
+	if (ep->is_in == 1) {
+		dwc_otg_dev_in_ep_regs_t *in_regs =
+		    core_if->dev_if->in_ep_regs[ep->num];
+
+		depctl.d32 = DWC_READ_REG32(&(in_regs->diepctl));
+		deptsiz.d32 = DWC_READ_REG32(&(in_regs->dieptsiz));
+
+		deptsiz.b.xfersize = 0;
+		deptsiz.b.pktcnt = 1;
+
+		/* Write the DMA register */
+		if (core_if->dma_enable) {
+			if (core_if->dma_desc_enable == 0) {
+				deptsiz.b.mc = 1;
+				DWC_WRITE_REG32(&in_regs->dieptsiz,
+						deptsiz.d32);
+				DWC_WRITE_REG32(&(in_regs->diepdma),
+						(uint32_t) ep->dma_addr);
+			}
+		} else {
+			DWC_WRITE_REG32(&in_regs->dieptsiz, deptsiz.d32);
+			/**
+			 * Enable the Non-Periodic Tx FIFO empty interrupt,
+			 * or the Tx FIFO epmty interrupt in dedicated Tx FIFO mode,
+			 * the data will be written into the fifo by the ISR.
+			 */
+			if (core_if->en_multiple_tx_fifo == 0) {
+				intr_mask.b.nptxfempty = 1;
+				DWC_MODIFY_REG32(&core_if->
+						 core_global_regs->gintmsk,
+						 intr_mask.d32, intr_mask.d32);
+			} else {
+				/* Enable the Tx FIFO Empty Interrupt for this EP */
+				if (ep->xfer_len > 0) {
+					uint32_t fifoemptymsk = 0;
+					fifoemptymsk = 1 << ep->num;
+					DWC_MODIFY_REG32(&core_if->
+							 dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
+							 0, fifoemptymsk);
+				}
+			}
+		}
+
+		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable)
+			depctl.b.nextep = core_if->nextep_seq[ep->num];
+		/* EP enable, IN data in FIFO */
+		depctl.b.cnak = 1;
+		depctl.b.epena = 1;
+		DWC_WRITE_REG32(&in_regs->diepctl, depctl.d32);
+
+	} else {
+		/* OUT endpoint */
+		dwc_otg_dev_out_ep_regs_t *out_regs =
+		    core_if->dev_if->out_ep_regs[ep->num];
+
+		depctl.d32 = DWC_READ_REG32(&(out_regs->doepctl));
+		deptsiz.d32 = DWC_READ_REG32(&(out_regs->doeptsiz));
+
+		/* Zero Length Packet */
+		deptsiz.b.xfersize = ep->maxpacket;
+		deptsiz.b.pktcnt = 1;
+
+		if (core_if->dma_enable) {
+			if (!core_if->dma_desc_enable) {
+				DWC_WRITE_REG32(&out_regs->doeptsiz,
+						deptsiz.d32);
+
+				DWC_WRITE_REG32(&(out_regs->doepdma),
+						(uint32_t) ep->dma_addr);
+			}
+		} else {
+			DWC_WRITE_REG32(&out_regs->doeptsiz, deptsiz.d32);
+		}
+
+		/* EP enable */
+		depctl.b.cnak = 1;
+		depctl.b.epena = 1;
+
+		DWC_WRITE_REG32(&out_regs->doepctl, depctl.d32);
+
+	}
+}
+
+/**
+ * This function does the setup for a data transfer for EP0 and starts
+ * the transfer.  For an IN transfer, the packets will be loaded into
+ * the appropriate Tx FIFO in the ISR. For OUT transfers, the packets are
+ * unloaded from the Rx FIFO in the ISR.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP0 data.
+ */
+void dwc_otg_ep0_start_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	depctl_data_t depctl;
+	deptsiz0_data_t deptsiz;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	dwc_otg_dev_dma_desc_t *dma_desc;
+
+	DWC_DEBUGPL(DBG_PCD, "ep%d-%s xfer_len=%d xfer_cnt=%d "
+		    "xfer_buff=%p start_xfer_buff=%p \n",
+		    ep->num, (ep->is_in ? "IN" : "OUT"), ep->xfer_len,
+		    ep->xfer_count, ep->xfer_buff, ep->start_xfer_buff);
+
+	ep->total_len = ep->xfer_len;
+
+	/* IN endpoint */
+	if (ep->is_in == 1) {
+		dwc_otg_dev_in_ep_regs_t *in_regs =
+		    core_if->dev_if->in_ep_regs[0];
+
+		gnptxsts_data_t gtxstatus;
+
+		if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
+			depctl.d32 = DWC_READ_REG32(&in_regs->diepctl);
+			if (depctl.b.epena)
+				return;
+		}
+
+		gtxstatus.d32 =
+		    DWC_READ_REG32(&core_if->core_global_regs->gnptxsts);
+
+		/* If dedicated FIFO every time flush fifo before enable ep*/
+		if (core_if->en_multiple_tx_fifo && core_if->snpsid >= OTG_CORE_REV_3_00a)
+			dwc_otg_flush_tx_fifo(core_if, ep->tx_fifo_num);
+
+		if (core_if->en_multiple_tx_fifo == 0
+		    && gtxstatus.b.nptxqspcavail == 0
+		    && !core_if->dma_enable) {
+#ifdef DEBUG
+			deptsiz.d32 = DWC_READ_REG32(&in_regs->dieptsiz);
+			DWC_DEBUGPL(DBG_PCD, "DIEPCTL0=%0x\n",
+				    DWC_READ_REG32(&in_regs->diepctl));
+			DWC_DEBUGPL(DBG_PCD, "DIEPTSIZ0=%0x (sz=%d, pcnt=%d)\n",
+				    deptsiz.d32,
+				    deptsiz.b.xfersize, deptsiz.b.pktcnt);
+			DWC_PRINTF("TX Queue or FIFO Full (0x%0x)\n",
+				   gtxstatus.d32);
+#endif
+			return;
+		}
+
+		depctl.d32 = DWC_READ_REG32(&in_regs->diepctl);
+		deptsiz.d32 = DWC_READ_REG32(&in_regs->dieptsiz);
+
+		/* Zero Length Packet? */
+		if (ep->xfer_len == 0) {
+			deptsiz.b.xfersize = 0;
+			deptsiz.b.pktcnt = 1;
+		} else {
+			/* Program the transfer size and packet count
+			 *      as follows: xfersize = N * maxpacket +
+			 *      short_packet pktcnt = N + (short_packet
+			 *      exist ? 1 : 0)
+			 */
+			if (ep->xfer_len > ep->maxpacket) {
+				ep->xfer_len = ep->maxpacket;
+				deptsiz.b.xfersize = ep->maxpacket;
+			} else {
+				deptsiz.b.xfersize = ep->xfer_len;
+			}
+			deptsiz.b.pktcnt = 1;
+
+		}
+		DWC_DEBUGPL(DBG_PCDV,
+			    "IN len=%d  xfersize=%d pktcnt=%d [%08x]\n",
+			    ep->xfer_len, deptsiz.b.xfersize, deptsiz.b.pktcnt,
+			    deptsiz.d32);
+
+		/* Write the DMA register */
+		if (core_if->dma_enable) {
+			if (core_if->dma_desc_enable == 0) {
+				DWC_WRITE_REG32(&in_regs->dieptsiz,
+						deptsiz.d32);
+
+				DWC_WRITE_REG32(&(in_regs->diepdma),
+						(uint32_t) ep->dma_addr);
+			} else {
+				dma_desc = core_if->dev_if->in_desc_addr;
+
+				/** DMA Descriptor Setup */
+				dma_desc->status.b.bs = BS_HOST_BUSY;
+				dma_desc->status.b.l = 1;
+				dma_desc->status.b.ioc = 1;
+				dma_desc->status.b.sp =
+				    (ep->xfer_len == ep->maxpacket) ? 0 : 1;
+				dma_desc->status.b.bytes = ep->xfer_len;
+				dma_desc->buf = ep->dma_addr;
+				dma_desc->status.b.sts = 0;
+				dma_desc->status.b.bs = BS_HOST_READY;
+
+				/** DIEPDMA0 Register write */
+				DWC_WRITE_REG32(&in_regs->diepdma,
+						core_if->
+						dev_if->dma_in_desc_addr);
+			}
+		} else {
+			DWC_WRITE_REG32(&in_regs->dieptsiz, deptsiz.d32);
+		}
+
+		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable)
+			depctl.b.nextep = core_if->nextep_seq[ep->num];
+		/* EP enable, IN data in FIFO */
+		depctl.b.cnak = 1;
+		depctl.b.epena = 1;
+		DWC_WRITE_REG32(&in_regs->diepctl, depctl.d32);
+
+		/**
+		 * Enable the Non-Periodic Tx FIFO empty interrupt, the
+		 * data will be written into the fifo by the ISR.
+		 */
+		if (!core_if->dma_enable) {
+			if (core_if->en_multiple_tx_fifo == 0) {
+				intr_mask.b.nptxfempty = 1;
+				DWC_MODIFY_REG32(&core_if->
+						 core_global_regs->gintmsk,
+						 intr_mask.d32, intr_mask.d32);
+			} else {
+				/* Enable the Tx FIFO Empty Interrupt for this EP */
+				if (ep->xfer_len > 0) {
+					uint32_t fifoemptymsk = 0;
+					fifoemptymsk |= 1 << ep->num;
+					DWC_MODIFY_REG32(&core_if->
+							 dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
+							 0, fifoemptymsk);
+				}
+			}
+		}
+	} else {
+		/* OUT endpoint */
+		dwc_otg_dev_out_ep_regs_t *out_regs =
+		    core_if->dev_if->out_ep_regs[0];
+
+		depctl.d32 = DWC_READ_REG32(&out_regs->doepctl);
+		deptsiz.d32 = DWC_READ_REG32(&out_regs->doeptsiz);
+
+		/* Program the transfer size and packet count as follows:
+		 *      xfersize = N * (maxpacket + 4 - (maxpacket % 4))
+		 *      pktcnt = N                                                                                      */
+		/* Zero Length Packet */
+		deptsiz.b.xfersize = ep->maxpacket;
+		deptsiz.b.pktcnt = 1;
+		if (core_if->snpsid >= OTG_CORE_REV_3_00a)
+			deptsiz.b.supcnt = 3;
+
+		DWC_DEBUGPL(DBG_PCDV, "len=%d  xfersize=%d pktcnt=%d\n",
+			    ep->xfer_len, deptsiz.b.xfersize, deptsiz.b.pktcnt);
+
+		if (core_if->dma_enable) {
+			if (!core_if->dma_desc_enable) {
+				DWC_WRITE_REG32(&out_regs->doeptsiz,
+						deptsiz.d32);
+
+				DWC_WRITE_REG32(&(out_regs->doepdma),
+						(uint32_t) ep->dma_addr);
+			} else {
+				dma_desc = core_if->dev_if->out_desc_addr;
+
+				/** DMA Descriptor Setup */
+				dma_desc->status.b.bs = BS_HOST_BUSY;
+				if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
+					dma_desc->status.b.mtrf = 0;
+					dma_desc->status.b.sr = 0;
+				}
+				dma_desc->status.b.l = 1;
+				dma_desc->status.b.ioc = 1;
+				dma_desc->status.b.bytes = ep->maxpacket;
+				dma_desc->buf = ep->dma_addr;
+				dma_desc->status.b.sts = 0;
+				dma_desc->status.b.bs = BS_HOST_READY;
+
+				/** DOEPDMA0 Register write */
+				DWC_WRITE_REG32(&out_regs->doepdma,
+						core_if->dev_if->
+						dma_out_desc_addr);
+			}
+		} else {
+			DWC_WRITE_REG32(&out_regs->doeptsiz, deptsiz.d32);
+		}
+
+		/* EP enable */
+		depctl.b.cnak = 1;
+		depctl.b.epena = 1;
+		DWC_WRITE_REG32(&(out_regs->doepctl), depctl.d32);
+	}
+}
+
+/**
+ * This function continues control IN transfers started by
+ * dwc_otg_ep0_start_transfer, when the transfer does not fit in a
+ * single packet.  NOTE: The DIEPCTL0/DOEPCTL0 registers only have one
+ * bit for the packet count.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP0 data.
+ */
+void dwc_otg_ep0_continue_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	depctl_data_t depctl;
+	deptsiz0_data_t deptsiz;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	dwc_otg_dev_dma_desc_t *dma_desc;
+
+	if (ep->is_in == 1) {
+		dwc_otg_dev_in_ep_regs_t *in_regs =
+		    core_if->dev_if->in_ep_regs[0];
+		gnptxsts_data_t tx_status = {.d32 = 0 };
+
+		tx_status.d32 =
+		    DWC_READ_REG32(&core_if->core_global_regs->gnptxsts);
+		/** @todo Should there be check for room in the Tx
+		 * Status Queue.  If not remove the code above this comment. */
+
+		depctl.d32 = DWC_READ_REG32(&in_regs->diepctl);
+		deptsiz.d32 = DWC_READ_REG32(&in_regs->dieptsiz);
+
+		/* Program the transfer size and packet count
+		 *      as follows: xfersize = N * maxpacket +
+		 *      short_packet pktcnt = N + (short_packet
+		 *      exist ? 1 : 0)
+		 */
+
+		if (core_if->dma_desc_enable == 0) {
+			deptsiz.b.xfersize =
+			    (ep->total_len - ep->xfer_count) >
+			    ep->maxpacket ? ep->maxpacket : (ep->total_len -
+							     ep->xfer_count);
+			deptsiz.b.pktcnt = 1;
+			if (core_if->dma_enable == 0) {
+				ep->xfer_len += deptsiz.b.xfersize;
+			} else {
+				ep->xfer_len = deptsiz.b.xfersize;
+			}
+			DWC_WRITE_REG32(&in_regs->dieptsiz, deptsiz.d32);
+		} else {
+			ep->xfer_len =
+			    (ep->total_len - ep->xfer_count) >
+			    ep->maxpacket ? ep->maxpacket : (ep->total_len -
+							     ep->xfer_count);
+
+			dma_desc = core_if->dev_if->in_desc_addr;
+
+			/** DMA Descriptor Setup */
+			dma_desc->status.b.bs = BS_HOST_BUSY;
+			dma_desc->status.b.l = 1;
+			dma_desc->status.b.ioc = 1;
+			dma_desc->status.b.sp =
+			    (ep->xfer_len == ep->maxpacket) ? 0 : 1;
+			dma_desc->status.b.bytes = ep->xfer_len;
+			dma_desc->buf = ep->dma_addr;
+			dma_desc->status.b.sts = 0;
+			dma_desc->status.b.bs = BS_HOST_READY;
+
+			/** DIEPDMA0 Register write */
+			DWC_WRITE_REG32(&in_regs->diepdma,
+					core_if->dev_if->dma_in_desc_addr);
+		}
+
+		DWC_DEBUGPL(DBG_PCDV,
+			    "IN len=%d  xfersize=%d pktcnt=%d [%08x]\n",
+			    ep->xfer_len, deptsiz.b.xfersize, deptsiz.b.pktcnt,
+			    deptsiz.d32);
+
+		/* Write the DMA register */
+		if (core_if->hwcfg2.b.architecture == DWC_INT_DMA_ARCH) {
+			if (core_if->dma_desc_enable == 0)
+				DWC_WRITE_REG32(&(in_regs->diepdma),
+						(uint32_t) ep->dma_addr);
+		}
+		if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable)
+			depctl.b.nextep = core_if->nextep_seq[ep->num];
+		/* EP enable, IN data in FIFO */
+		depctl.b.cnak = 1;
+		depctl.b.epena = 1;
+		DWC_WRITE_REG32(&in_regs->diepctl, depctl.d32);
+
+		/**
+		 * Enable the Non-Periodic Tx FIFO empty interrupt, the
+		 * data will be written into the fifo by the ISR.
+		 */
+		if (!core_if->dma_enable) {
+			if (core_if->en_multiple_tx_fifo == 0) {
+				/* First clear it from GINTSTS */
+				intr_mask.b.nptxfempty = 1;
+				DWC_MODIFY_REG32(&core_if->
+						 core_global_regs->gintmsk,
+						 intr_mask.d32, intr_mask.d32);
+
+			} else {
+				/* Enable the Tx FIFO Empty Interrupt for this EP */
+				if (ep->xfer_len > 0) {
+					uint32_t fifoemptymsk = 0;
+					fifoemptymsk |= 1 << ep->num;
+					DWC_MODIFY_REG32(&core_if->
+							 dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
+							 0, fifoemptymsk);
+				}
+			}
+		}
+	} else {
+		dwc_otg_dev_out_ep_regs_t *out_regs =
+		    core_if->dev_if->out_ep_regs[0];
+
+		depctl.d32 = DWC_READ_REG32(&out_regs->doepctl);
+		deptsiz.d32 = DWC_READ_REG32(&out_regs->doeptsiz);
+
+		/* Program the transfer size and packet count
+		 *      as follows: xfersize = N * maxpacket +
+		 *      short_packet pktcnt = N + (short_packet
+		 *      exist ? 1 : 0)
+		 */
+		deptsiz.b.xfersize = ep->maxpacket;
+		deptsiz.b.pktcnt = 1;
+
+		if (core_if->dma_desc_enable == 0) {
+			DWC_WRITE_REG32(&out_regs->doeptsiz, deptsiz.d32);
+		} else {
+			dma_desc = core_if->dev_if->out_desc_addr;
+
+			/** DMA Descriptor Setup */
+			dma_desc->status.b.bs = BS_HOST_BUSY;
+			dma_desc->status.b.l = 1;
+			dma_desc->status.b.ioc = 1;
+			dma_desc->status.b.bytes = ep->maxpacket;
+			dma_desc->buf = ep->dma_addr;
+			dma_desc->status.b.sts = 0;
+			dma_desc->status.b.bs = BS_HOST_READY;
+
+			/** DOEPDMA0 Register write */
+			DWC_WRITE_REG32(&out_regs->doepdma,
+					core_if->dev_if->dma_out_desc_addr);
+		}
+
+		DWC_DEBUGPL(DBG_PCDV,
+			    "IN len=%d  xfersize=%d pktcnt=%d [%08x]\n",
+			    ep->xfer_len, deptsiz.b.xfersize, deptsiz.b.pktcnt,
+			    deptsiz.d32);
+
+		/* Write the DMA register */
+		if (core_if->hwcfg2.b.architecture == DWC_INT_DMA_ARCH) {
+			if (core_if->dma_desc_enable == 0)
+				DWC_WRITE_REG32(&(out_regs->doepdma),
+						(uint32_t) ep->dma_addr);
+
+		}
+
+		/* EP enable, IN data in FIFO */
+		depctl.b.cnak = 1;
+		depctl.b.epena = 1;
+		DWC_WRITE_REG32(&out_regs->doepctl, depctl.d32);
+
+	}
+}
+
+#ifdef DEBUG
+void dump_msg(const u8 * buf, unsigned int length)
+{
+	unsigned int start, num, i;
+	char line[52], *p;
+
+	if (length >= 512)
+		return;
+	start = 0;
+	while (length > 0) {
+		num = length < 16u ? length : 16u;
+		p = line;
+		for (i = 0; i < num; ++i) {
+			if (i == 8)
+				*p++ = ' ';
+			DWC_SPRINTF(p, " %02x", buf[i]);
+			p += 3;
+		}
+		*p = 0;
+		DWC_PRINTF("%6x: %s\n", start, line);
+		buf += num;
+		start += num;
+		length -= num;
+	}
+}
+#else
+static inline void dump_msg(const u8 * buf, unsigned int length)
+{
+}
+#endif
+
+/**
+ * This function writes a packet into the Tx FIFO associated with the
+ * EP. For non-periodic EPs the non-periodic Tx FIFO is written.  For
+ * periodic EPs the periodic Tx FIFO associated with the EP is written
+ * with all packets for the next micro-frame.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to write packet for.
+ * @param dma Indicates if DMA is being used.
+ */
+void dwc_otg_ep_write_packet(dwc_otg_core_if_t * core_if, dwc_ep_t * ep,
+			     int dma)
+{
+	/**
+	 * The buffer is padded to DWORD on a per packet basis in
+	 * slave/dma mode if the MPS is not DWORD aligned. The last
+	 * packet, if short, is also padded to a multiple of DWORD.
+	 *
+	 * ep->xfer_buff always starts DWORD aligned in memory and is a
+	 * multiple of DWORD in length
+	 *
+	 * ep->xfer_len can be any number of bytes
+	 *
+	 * ep->xfer_count is a multiple of ep->maxpacket until the last
+	 *	packet
+	 *
+	 * FIFO access is DWORD */
+
+	uint32_t i;
+	uint32_t byte_count;
+	uint32_t dword_count;
+	uint32_t *fifo;
+	uint32_t *data_buff = (uint32_t *) ep->xfer_buff;
+
+	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "%s(%p,%p)\n", __func__, core_if,
+		    ep);
+	if (ep->xfer_count >= ep->xfer_len) {
+		DWC_WARN("%s() No data for EP%d!!!\n", __func__, ep->num);
+		return;
+	}
+
+	/* Find the byte length of the packet either short packet or MPS */
+	if ((ep->xfer_len - ep->xfer_count) < ep->maxpacket) {
+		byte_count = ep->xfer_len - ep->xfer_count;
+	} else {
+		byte_count = ep->maxpacket;
+	}
+
+	/* Find the DWORD length, padded by extra bytes as neccessary if MPS
+	 * is not a multiple of DWORD */
+	dword_count = (byte_count + 3) / 4;
+
+#ifdef VERBOSE
+	dump_msg(ep->xfer_buff, byte_count);
+#endif
+
+	/**@todo NGS Where are the Periodic Tx FIFO addresses
+	 * intialized?	What should this be? */
+
+	fifo = core_if->data_fifo[ep->num];
+
+	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "fifo=%p buff=%p *p=%08x bc=%d\n",
+		    fifo, data_buff, *data_buff, byte_count);
+
+	if (!dma) {
+		for (i = 0; i < dword_count; i++, data_buff++) {
+			DWC_WRITE_REG32(fifo, *data_buff);
+		}
+	}
+
+	ep->xfer_count += byte_count;
+	ep->xfer_buff += byte_count;
+	ep->dma_addr += byte_count;
+}
+
+/**
+ * Set the EP STALL.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to set the stall on.
+ */
+void dwc_otg_ep_set_stall(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	depctl_data_t depctl;
+	volatile uint32_t *depctl_addr;
+
+	DWC_DEBUGPL(DBG_PCD, "%s ep%d-%s\n", __func__, ep->num,
+		    (ep->is_in ? "IN" : "OUT"));
+
+	if (ep->is_in == 1) {
+		depctl_addr = &(core_if->dev_if->in_ep_regs[ep->num]->diepctl);
+		depctl.d32 = DWC_READ_REG32(depctl_addr);
+
+		/* set the disable and stall bits */
+		if (depctl.b.epena) {
+			depctl.b.epdis = 1;
+		}
+		depctl.b.stall = 1;
+		DWC_WRITE_REG32(depctl_addr, depctl.d32);
+	} else {
+		depctl_addr = &(core_if->dev_if->out_ep_regs[ep->num]->doepctl);
+		depctl.d32 = DWC_READ_REG32(depctl_addr);
+
+		/* set the stall bit */
+		depctl.b.stall = 1;
+		DWC_WRITE_REG32(depctl_addr, depctl.d32);
+	}
+
+	DWC_DEBUGPL(DBG_PCD, "DEPCTL=%0x\n", DWC_READ_REG32(depctl_addr));
+
+	return;
+}
+
+/**
+ * Clear the EP STALL.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to clear stall from.
+ */
+void dwc_otg_ep_clear_stall(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	depctl_data_t depctl;
+	volatile uint32_t *depctl_addr;
+
+	DWC_DEBUGPL(DBG_PCD, "%s ep%d-%s\n", __func__, ep->num,
+		    (ep->is_in ? "IN" : "OUT"));
+
+	if (ep->is_in == 1) {
+		depctl_addr = &(core_if->dev_if->in_ep_regs[ep->num]->diepctl);
+	} else {
+		depctl_addr = &(core_if->dev_if->out_ep_regs[ep->num]->doepctl);
+	}
+
+	depctl.d32 = DWC_READ_REG32(depctl_addr);
+
+	/* clear the stall bits */
+	depctl.b.stall = 0;
+
+	/*
+	 * USB Spec 9.4.5: For endpoints using data toggle, regardless
+	 * of whether an endpoint has the Halt feature set, a
+	 * ClearFeature(ENDPOINT_HALT) request always results in the
+	 * data toggle being reinitialized to DATA0.
+	 */
+	if (ep->type == DWC_OTG_EP_TYPE_INTR ||
+	    ep->type == DWC_OTG_EP_TYPE_BULK) {
+		depctl.b.setd0pid = 1;	/* DATA0 */
+	}
+
+	DWC_WRITE_REG32(depctl_addr, depctl.d32);
+	DWC_DEBUGPL(DBG_PCD, "DEPCTL=%0x\n", DWC_READ_REG32(depctl_addr));
+	return;
+}
+
+/**
+ * This function reads a packet from the Rx FIFO into the destination
+ * buffer. To read SETUP data use dwc_otg_read_setup_packet.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param dest	  Destination buffer for the packet.
+ * @param bytes  Number of bytes to copy to the destination.
+ */
+void dwc_otg_read_packet(dwc_otg_core_if_t * core_if,
+			 uint8_t * dest, uint16_t bytes)
+{
+	int i;
+	int word_count = (bytes + 3) / 4;
+
+	volatile uint32_t *fifo = core_if->data_fifo[0];
+	uint32_t *data_buff = (uint32_t *) dest;
+
+	/**
+	 * @todo Account for the case where _dest is not dword aligned. This
+	 * requires reading data from the FIFO into a uint32_t temp buffer,
+	 * then moving it into the data buffer.
+	 */
+
+	DWC_DEBUGPL((DBG_PCDV | DBG_CILV), "%s(%p,%p,%d)\n", __func__,
+		    core_if, dest, bytes);
+
+	for (i = 0; i < word_count; i++, data_buff++) {
+		*data_buff = DWC_READ_REG32(fifo);
+	}
+
+	return;
+}
+
+/**
+ * This functions reads the device registers and prints them
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+void dwc_otg_dump_dev_registers(dwc_otg_core_if_t * core_if)
+{
+	int i;
+	volatile uint32_t *addr;
+
+	DWC_PRINTF("Device Global Registers\n");
+	addr = &core_if->dev_if->dev_global_regs->dcfg;
+	DWC_PRINTF("DCFG		 @0x%08lX : 0x%08X\n",
+		   (unsigned long)addr, DWC_READ_REG32(addr));
+	addr = &core_if->dev_if->dev_global_regs->dctl;
+	DWC_PRINTF("DCTL		 @0x%08lX : 0x%08X\n",
+		   (unsigned long)addr, DWC_READ_REG32(addr));
+	addr = &core_if->dev_if->dev_global_regs->dsts;
+	DWC_PRINTF("DSTS		 @0x%08lX : 0x%08X\n",
+		   (unsigned long)addr, DWC_READ_REG32(addr));
+	addr = &core_if->dev_if->dev_global_regs->diepmsk;
+	DWC_PRINTF("DIEPMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->dev_if->dev_global_regs->doepmsk;
+	DWC_PRINTF("DOEPMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->dev_if->dev_global_regs->daint;
+	DWC_PRINTF("DAINT	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->dev_if->dev_global_regs->daintmsk;
+	DWC_PRINTF("DAINTMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->dev_if->dev_global_regs->dtknqr1;
+	DWC_PRINTF("DTKNQR1	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	if (core_if->hwcfg2.b.dev_token_q_depth > 6) {
+		addr = &core_if->dev_if->dev_global_regs->dtknqr2;
+		DWC_PRINTF("DTKNQR2	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+	}
+
+	addr = &core_if->dev_if->dev_global_regs->dvbusdis;
+	DWC_PRINTF("DVBUSID	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+
+	addr = &core_if->dev_if->dev_global_regs->dvbuspulse;
+	DWC_PRINTF("DVBUSPULSE	@0x%08lX : 0x%08X\n",
+		   (unsigned long)addr, DWC_READ_REG32(addr));
+
+	addr = &core_if->dev_if->dev_global_regs->dtknqr3_dthrctl;
+	DWC_PRINTF("DTKNQR3_DTHRCTL	 @0x%08lX : 0x%08X\n",
+		   (unsigned long)addr, DWC_READ_REG32(addr));
+
+	if (core_if->hwcfg2.b.dev_token_q_depth > 22) {
+		addr = &core_if->dev_if->dev_global_regs->dtknqr4_fifoemptymsk;
+		DWC_PRINTF("DTKNQR4	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+	}
+
+	addr = &core_if->dev_if->dev_global_regs->dtknqr4_fifoemptymsk;
+	DWC_PRINTF("FIFOEMPMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+
+	if (core_if->hwcfg2.b.multi_proc_int) {
+
+		addr = &core_if->dev_if->dev_global_regs->deachint;
+		DWC_PRINTF("DEACHINT	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->dev_if->dev_global_regs->deachintmsk;
+		DWC_PRINTF("DEACHINTMSK	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+
+		for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
+			addr =
+			    &core_if->dev_if->
+			    dev_global_regs->diepeachintmsk[i];
+			DWC_PRINTF("DIEPEACHINTMSK[%d]	 @0x%08lX : 0x%08X\n",
+				   i, (unsigned long)addr,
+				   DWC_READ_REG32(addr));
+		}
+
+		for (i = 0; i <= core_if->dev_if->num_out_eps; i++) {
+			addr =
+			    &core_if->dev_if->
+			    dev_global_regs->doepeachintmsk[i];
+			DWC_PRINTF("DOEPEACHINTMSK[%d]	 @0x%08lX : 0x%08X\n",
+				   i, (unsigned long)addr,
+				   DWC_READ_REG32(addr));
+		}
+	}
+
+	for (i = 0; i <= core_if->dev_if->num_in_eps; i++) {
+		DWC_PRINTF("Device IN EP %d Registers\n", i);
+		addr = &core_if->dev_if->in_ep_regs[i]->diepctl;
+		DWC_PRINTF("DIEPCTL	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->dev_if->in_ep_regs[i]->diepint;
+		DWC_PRINTF("DIEPINT	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->dev_if->in_ep_regs[i]->dieptsiz;
+		DWC_PRINTF("DIETSIZ	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->dev_if->in_ep_regs[i]->diepdma;
+		DWC_PRINTF("DIEPDMA	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->dev_if->in_ep_regs[i]->dtxfsts;
+		DWC_PRINTF("DTXFSTS	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->dev_if->in_ep_regs[i]->diepdmab;
+		DWC_PRINTF("DIEPDMAB	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, 0 /*DWC_READ_REG32(addr) */ );
+	}
+
+	for (i = 0; i <= core_if->dev_if->num_out_eps; i++) {
+		DWC_PRINTF("Device OUT EP %d Registers\n", i);
+		addr = &core_if->dev_if->out_ep_regs[i]->doepctl;
+		DWC_PRINTF("DOEPCTL	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->dev_if->out_ep_regs[i]->doepint;
+		DWC_PRINTF("DOEPINT	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->dev_if->out_ep_regs[i]->doeptsiz;
+		DWC_PRINTF("DOETSIZ	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->dev_if->out_ep_regs[i]->doepdma;
+		DWC_PRINTF("DOEPDMA	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		if (core_if->dma_enable) {	/* Don't access this register in SLAVE mode */
+			addr = &core_if->dev_if->out_ep_regs[i]->doepdmab;
+			DWC_PRINTF("DOEPDMAB	 @0x%08lX : 0x%08X\n",
+				   (unsigned long)addr, DWC_READ_REG32(addr));
+		}
+
+	}
+}
+
+/**
+ * This functions reads the SPRAM and prints its content
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+void dwc_otg_dump_spram(dwc_otg_core_if_t * core_if)
+{
+	volatile uint8_t *addr, *start_addr, *end_addr;
+
+	DWC_PRINTF("SPRAM Data:\n");
+	start_addr = (void *)core_if->core_global_regs;
+	DWC_PRINTF("Base Address: 0x%8lX\n", (unsigned long)start_addr);
+	start_addr += 0x00028000;
+	end_addr = (void *)core_if->core_global_regs;
+	end_addr += 0x000280e0;
+
+	for (addr = start_addr; addr < end_addr; addr += 16) {
+		DWC_PRINTF
+		    ("0x%8lX:\t%2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X %2X\n",
+		     (unsigned long)addr, addr[0], addr[1], addr[2], addr[3],
+		     addr[4], addr[5], addr[6], addr[7], addr[8], addr[9],
+		     addr[10], addr[11], addr[12], addr[13], addr[14], addr[15]
+		    );
+	}
+
+	return;
+}
+
+/**
+ * This function reads the host registers and prints them
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+void dwc_otg_dump_host_registers(dwc_otg_core_if_t * core_if)
+{
+	int i;
+	volatile uint32_t *addr;
+
+	DWC_PRINTF("Host Global Registers\n");
+	addr = &core_if->host_if->host_global_regs->hcfg;
+	DWC_PRINTF("HCFG		 @0x%08lX : 0x%08X\n",
+		   (unsigned long)addr, DWC_READ_REG32(addr));
+	addr = &core_if->host_if->host_global_regs->hfir;
+	DWC_PRINTF("HFIR		 @0x%08lX : 0x%08X\n",
+		   (unsigned long)addr, DWC_READ_REG32(addr));
+	addr = &core_if->host_if->host_global_regs->hfnum;
+	DWC_PRINTF("HFNUM	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->host_if->host_global_regs->hptxsts;
+	DWC_PRINTF("HPTXSTS	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->host_if->host_global_regs->haint;
+	DWC_PRINTF("HAINT	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->host_if->host_global_regs->haintmsk;
+	DWC_PRINTF("HAINTMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	if (core_if->dma_desc_enable) {
+		addr = &core_if->host_if->host_global_regs->hflbaddr;
+		DWC_PRINTF("HFLBADDR	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+	}
+
+	addr = core_if->host_if->hprt0;
+	DWC_PRINTF("HPRT0	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+
+	for (i = 0; i < core_if->core_params->host_channels; i++) {
+		DWC_PRINTF("Host Channel %d Specific Registers\n", i);
+		addr = &core_if->host_if->hc_regs[i]->hcchar;
+		DWC_PRINTF("HCCHAR	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->host_if->hc_regs[i]->hcsplt;
+		DWC_PRINTF("HCSPLT	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->host_if->hc_regs[i]->hcint;
+		DWC_PRINTF("HCINT	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->host_if->hc_regs[i]->hcintmsk;
+		DWC_PRINTF("HCINTMSK	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->host_if->hc_regs[i]->hctsiz;
+		DWC_PRINTF("HCTSIZ	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		addr = &core_if->host_if->hc_regs[i]->hcdma;
+		DWC_PRINTF("HCDMA	 @0x%08lX : 0x%08X\n",
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+		if (core_if->dma_desc_enable) {
+			addr = &core_if->host_if->hc_regs[i]->hcdmab;
+			DWC_PRINTF("HCDMAB	 @0x%08lX : 0x%08X\n",
+				   (unsigned long)addr, DWC_READ_REG32(addr));
+		}
+
+	}
+	return;
+}
+
+/**
+ * This function reads the core global registers and prints them
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+void dwc_otg_dump_global_registers(dwc_otg_core_if_t * core_if)
+{
+	int i, ep_num;
+	volatile uint32_t *addr;
+	char *txfsiz;
+
+	DWC_PRINTF("Core Global Registers\n");
+	addr = &core_if->core_global_regs->gotgctl;
+	DWC_PRINTF("GOTGCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gotgint;
+	DWC_PRINTF("GOTGINT	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gahbcfg;
+	DWC_PRINTF("GAHBCFG	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gusbcfg;
+	DWC_PRINTF("GUSBCFG	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->grstctl;
+	DWC_PRINTF("GRSTCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gintsts;
+	DWC_PRINTF("GINTSTS	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gintmsk;
+	DWC_PRINTF("GINTMSK	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->grxstsr;
+	DWC_PRINTF("GRXSTSR	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->grxfsiz;
+	DWC_PRINTF("GRXFSIZ	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gnptxfsiz;
+	DWC_PRINTF("GNPTXFSIZ @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gnptxsts;
+	DWC_PRINTF("GNPTXSTS	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gi2cctl;
+	DWC_PRINTF("GI2CCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gpvndctl;
+	DWC_PRINTF("GPVNDCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->ggpio;
+	DWC_PRINTF("GGPIO	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->guid;
+	DWC_PRINTF("GUID		 @0x%08lX : 0x%08X\n",
+		   (unsigned long)addr, DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gsnpsid;
+	DWC_PRINTF("GSNPSID	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->ghwcfg1;
+	DWC_PRINTF("GHWCFG1	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->ghwcfg2;
+	DWC_PRINTF("GHWCFG2	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->ghwcfg3;
+	DWC_PRINTF("GHWCFG3	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->ghwcfg4;
+	DWC_PRINTF("GHWCFG4	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->glpmcfg;
+	DWC_PRINTF("GLPMCFG	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gpwrdn;
+	DWC_PRINTF("GPWRDN	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->gdfifocfg;
+	DWC_PRINTF("GDFIFOCFG	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+	addr = &core_if->core_global_regs->adpctl;
+	DWC_PRINTF("ADPCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   dwc_otg_adp_read_reg(core_if));
+	addr = &core_if->core_global_regs->hptxfsiz;
+	DWC_PRINTF("HPTXFSIZ	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+
+	if (core_if->en_multiple_tx_fifo == 0) {
+		ep_num = core_if->hwcfg4.b.num_dev_perio_in_ep;
+		txfsiz = "DPTXFSIZ";
+	} else {
+		ep_num = core_if->hwcfg4.b.num_in_eps;
+		txfsiz = "DIENPTXF";
+	}
+	for (i = 0; i < ep_num; i++) {
+		addr = &core_if->core_global_regs->dtxfsiz[i];
+		DWC_PRINTF("%s[%d] @0x%08lX : 0x%08X\n", txfsiz, i + 1,
+			   (unsigned long)addr, DWC_READ_REG32(addr));
+	}
+	addr = core_if->pcgcctl;
+	DWC_PRINTF("PCGCCTL	 @0x%08lX : 0x%08X\n", (unsigned long)addr,
+		   DWC_READ_REG32(addr));
+}
+
+/**
+ * Flush a Tx FIFO.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param num Tx FIFO to flush.
+ */
+void dwc_otg_flush_tx_fifo(dwc_otg_core_if_t * core_if, const int num)
+{
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	volatile grstctl_t greset = {.d32 = 0 };
+	int count = 0;
+
+	DWC_DEBUGPL((DBG_CIL | DBG_PCDV), "Flush Tx FIFO %d\n", num);
+
+	greset.b.txfflsh = 1;
+	greset.b.txfnum = num;
+	DWC_WRITE_REG32(&global_regs->grstctl, greset.d32);
+
+	do {
+		greset.d32 = DWC_READ_REG32(&global_regs->grstctl);
+		if (++count > 10000) {
+			DWC_WARN("%s() HANG! GRSTCTL=%0x GNPTXSTS=0x%08x\n",
+				 __func__, greset.d32,
+				 DWC_READ_REG32(&global_regs->gnptxsts));
+			break;
+		}
+		dwc_udelay(1);
+	} while (greset.b.txfflsh == 1);
+
+	/* Wait for 3 PHY Clocks */
+	dwc_udelay(1);
+}
+
+/**
+ * Flush Rx FIFO.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+void dwc_otg_flush_rx_fifo(dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	volatile grstctl_t greset = {.d32 = 0 };
+	int count = 0;
+
+	DWC_DEBUGPL((DBG_CIL | DBG_PCDV), "%s\n", __func__);
+	/*
+	 *
+	 */
+	greset.b.rxfflsh = 1;
+	DWC_WRITE_REG32(&global_regs->grstctl, greset.d32);
+
+	do {
+		greset.d32 = DWC_READ_REG32(&global_regs->grstctl);
+		if (++count > 10000) {
+			DWC_WARN("%s() HANG! GRSTCTL=%0x\n", __func__,
+				 greset.d32);
+			break;
+		}
+		dwc_udelay(1);
+	} while (greset.b.rxfflsh == 1);
+
+	/* Wait for 3 PHY Clocks */
+	dwc_udelay(1);
+}
+
+/**
+ * Do core a soft reset of the core.  Be careful with this because it
+ * resets all the internal state machines of the core.
+ */
+void dwc_otg_core_reset(dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	volatile grstctl_t greset = {.d32 = 0 };
+	int count = 0;
+
+	DWC_DEBUGPL(DBG_CILV, "%s\n", __func__);
+	/* Wait for AHB master IDLE state. */
+	do {
+		dwc_udelay(10);
+		greset.d32 = DWC_READ_REG32(&global_regs->grstctl);
+		if (++count > 100000) {
+			DWC_WARN("%s() HANG! AHB Idle GRSTCTL=%0x\n", __func__,
+				 greset.d32);
+			return;
+		}
+	}
+	while (greset.b.ahbidle == 0);
+
+	/* Core Soft Reset */
+	count = 0;
+	greset.b.csftrst = 1;
+	DWC_WRITE_REG32(&global_regs->grstctl, greset.d32);
+	do {
+		greset.d32 = DWC_READ_REG32(&global_regs->grstctl);
+		if (++count > 10000) {
+			DWC_WARN("%s() HANG! Soft Reset GRSTCTL=%0x\n",
+				 __func__, greset.d32);
+			break;
+		}
+		dwc_udelay(1);
+	}
+	while (greset.b.csftrst == 1);
+
+	/* Wait for 3 PHY Clocks */
+	dwc_mdelay(100);
+}
+
+uint8_t dwc_otg_is_device_mode(dwc_otg_core_if_t * _core_if)
+{
+	return (dwc_otg_mode(_core_if) != DWC_HOST_MODE);
+}
+
+uint8_t dwc_otg_is_host_mode(dwc_otg_core_if_t * _core_if)
+{
+	return (dwc_otg_mode(_core_if) == DWC_HOST_MODE);
+}
+
+/**
+ * Register HCD callbacks. The callbacks are used to start and stop
+ * the HCD for interrupt processing.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param cb the HCD callback structure.
+ * @param p pointer to be passed to callback function (usb_hcd*).
+ */
+void dwc_otg_cil_register_hcd_callbacks(dwc_otg_core_if_t * core_if,
+					dwc_otg_cil_callbacks_t * cb, void *p)
+{
+	core_if->hcd_cb = cb;
+	cb->p = p;
+}
+
+/**
+ * Register PCD callbacks. The callbacks are used to start and stop
+ * the PCD for interrupt processing.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param cb the PCD callback structure.
+ * @param p pointer to be passed to callback function (pcd*).
+ */
+void dwc_otg_cil_register_pcd_callbacks(dwc_otg_core_if_t * core_if,
+					dwc_otg_cil_callbacks_t * cb, void *p)
+{
+	core_if->pcd_cb = cb;
+	cb->p = p;
+}
+
+#ifdef DWC_EN_ISOC
+
+/**
+ * This function writes isoc data per 1 (micro)frame into tx fifo
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ *
+ */
+void write_isoc_frame_data(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	dwc_otg_dev_in_ep_regs_t *ep_regs;
+	dtxfsts_data_t txstatus = {.d32 = 0 };
+	uint32_t len = 0;
+	uint32_t dwords;
+
+	ep->xfer_len = ep->data_per_frame;
+	ep->xfer_count = 0;
+
+	ep_regs = core_if->dev_if->in_ep_regs[ep->num];
+
+	len = ep->xfer_len - ep->xfer_count;
+
+	if (len > ep->maxpacket) {
+		len = ep->maxpacket;
+	}
+
+	dwords = (len + 3) / 4;
+
+	/* While there is space in the queue and space in the FIFO and
+	 * More data to tranfer, Write packets to the Tx FIFO */
+	txstatus.d32 =
+	    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[ep->num]->dtxfsts);
+	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", ep->num, txstatus.d32);
+
+	while (txstatus.b.txfspcavail > dwords &&
+	       ep->xfer_count < ep->xfer_len && ep->xfer_len != 0) {
+		/* Write the FIFO */
+		dwc_otg_ep_write_packet(core_if, ep, 0);
+
+		len = ep->xfer_len - ep->xfer_count;
+		if (len > ep->maxpacket) {
+			len = ep->maxpacket;
+		}
+
+		dwords = (len + 3) / 4;
+		txstatus.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
+				   dtxfsts);
+		DWC_DEBUGPL(DBG_PCDV, "dtxfsts[%d]=0x%08x\n", ep->num,
+			    txstatus.d32);
+	}
+}
+
+/**
+ * This function initializes a descriptor chain for Isochronous transfer
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ *
+ */
+void dwc_otg_iso_ep_start_frm_transfer(dwc_otg_core_if_t * core_if,
+				       dwc_ep_t * ep)
+{
+	deptsiz_data_t deptsiz = {.d32 = 0 };
+	depctl_data_t depctl = {.d32 = 0 };
+	dsts_data_t dsts = {.d32 = 0 };
+	volatile uint32_t *addr;
+
+	if (ep->is_in) {
+		addr = &core_if->dev_if->in_ep_regs[ep->num]->diepctl;
+	} else {
+		addr = &core_if->dev_if->out_ep_regs[ep->num]->doepctl;
+	}
+
+	ep->xfer_len = ep->data_per_frame;
+	ep->xfer_count = 0;
+	ep->xfer_buff = ep->cur_pkt_addr;
+	ep->dma_addr = ep->cur_pkt_dma_addr;
+
+	if (ep->is_in) {
+		/* Program the transfer size and packet count
+		 *      as follows: xfersize = N * maxpacket +
+		 *      short_packet pktcnt = N + (short_packet
+		 *      exist ? 1 : 0)
+		 */
+		deptsiz.b.xfersize = ep->xfer_len;
+		deptsiz.b.pktcnt =
+		    (ep->xfer_len - 1 + ep->maxpacket) / ep->maxpacket;
+		deptsiz.b.mc = deptsiz.b.pktcnt;
+		DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->dieptsiz,
+				deptsiz.d32);
+
+		/* Write the DMA register */
+		if (core_if->dma_enable) {
+			DWC_WRITE_REG32(&
+					(core_if->dev_if->in_ep_regs[ep->num]->
+					 diepdma), (uint32_t) ep->dma_addr);
+		}
+	} else {
+		deptsiz.b.pktcnt =
+		    (ep->xfer_len + (ep->maxpacket - 1)) / ep->maxpacket;
+		deptsiz.b.xfersize = deptsiz.b.pktcnt * ep->maxpacket;
+
+		DWC_WRITE_REG32(&core_if->dev_if->
+				out_ep_regs[ep->num]->doeptsiz, deptsiz.d32);
+
+		if (core_if->dma_enable) {
+			DWC_WRITE_REG32(&
+					(core_if->dev_if->
+					 out_ep_regs[ep->num]->doepdma),
+					(uint32_t) ep->dma_addr);
+		}
+	}
+
+	/** Enable endpoint, clear nak  */
+
+	depctl.d32 = 0;
+	if (ep->bInterval == 1) {
+		dsts.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
+		ep->next_frame = dsts.b.soffn + ep->bInterval;
+
+		if (ep->next_frame & 0x1) {
+			depctl.b.setd1pid = 1;
+		} else {
+			depctl.b.setd0pid = 1;
+		}
+	} else {
+		ep->next_frame += ep->bInterval;
+
+		if (ep->next_frame & 0x1) {
+			depctl.b.setd1pid = 1;
+		} else {
+			depctl.b.setd0pid = 1;
+		}
+	}
+	depctl.b.epena = 1;
+	depctl.b.cnak = 1;
+
+	DWC_MODIFY_REG32(addr, 0, depctl.d32);
+	depctl.d32 = DWC_READ_REG32(addr);
+
+	if (ep->is_in && core_if->dma_enable == 0) {
+		write_isoc_frame_data(core_if, ep);
+	}
+
+}
+#endif /* DWC_EN_ISOC */
+
+static void dwc_otg_set_uninitialized(int32_t * p, int size)
+{
+	int i;
+	for (i = 0; i < size; i++) {
+		p[i] = -1;
+	}
+}
+
+static int dwc_otg_param_initialized(int32_t val)
+{
+	return val != -1;
+}
+
+static int dwc_otg_setup_params(dwc_otg_core_if_t * core_if)
+{
+	int i;
+	core_if->core_params = DWC_ALLOC(sizeof(*core_if->core_params));
+	if (!core_if->core_params) {
+		return -DWC_E_NO_MEMORY;
+	}
+	dwc_otg_set_uninitialized((int32_t *) core_if->core_params,
+				  sizeof(*core_if->core_params) /
+				  sizeof(int32_t));
+	DWC_PRINTF("Setting default values for core params\n");
+	dwc_otg_set_param_otg_cap(core_if, dwc_param_otg_cap_default);
+	dwc_otg_set_param_dma_enable(core_if, dwc_param_dma_enable_default);
+	dwc_otg_set_param_dma_desc_enable(core_if,
+					  dwc_param_dma_desc_enable_default);
+	dwc_otg_set_param_opt(core_if, dwc_param_opt_default);
+	dwc_otg_set_param_dma_burst_size(core_if,
+					 dwc_param_dma_burst_size_default);
+	dwc_otg_set_param_host_support_fs_ls_low_power(core_if,
+						       dwc_param_host_support_fs_ls_low_power_default);
+	dwc_otg_set_param_enable_dynamic_fifo(core_if,
+					      dwc_param_enable_dynamic_fifo_default);
+	dwc_otg_set_param_data_fifo_size(core_if,
+					 dwc_param_data_fifo_size_default);
+	dwc_otg_set_param_dev_rx_fifo_size(core_if,
+					   dwc_param_dev_rx_fifo_size_default);
+	dwc_otg_set_param_dev_nperio_tx_fifo_size(core_if,
+						  dwc_param_dev_nperio_tx_fifo_size_default);
+	dwc_otg_set_param_host_rx_fifo_size(core_if,
+					    dwc_param_host_rx_fifo_size_default);
+	dwc_otg_set_param_host_nperio_tx_fifo_size(core_if,
+						   dwc_param_host_nperio_tx_fifo_size_default);
+	dwc_otg_set_param_host_perio_tx_fifo_size(core_if,
+						  dwc_param_host_perio_tx_fifo_size_default);
+	dwc_otg_set_param_max_transfer_size(core_if,
+					    dwc_param_max_transfer_size_default);
+	dwc_otg_set_param_max_packet_count(core_if,
+					   dwc_param_max_packet_count_default);
+	dwc_otg_set_param_host_channels(core_if,
+					dwc_param_host_channels_default);
+	dwc_otg_set_param_dev_endpoints(core_if,
+					dwc_param_dev_endpoints_default);
+	dwc_otg_set_param_phy_type(core_if, dwc_param_phy_type_default);
+	dwc_otg_set_param_speed(core_if, dwc_param_speed_default);
+	dwc_otg_set_param_host_ls_low_power_phy_clk(core_if,
+						    dwc_param_host_ls_low_power_phy_clk_default);
+	dwc_otg_set_param_phy_ulpi_ddr(core_if, dwc_param_phy_ulpi_ddr_default);
+	dwc_otg_set_param_phy_ulpi_ext_vbus(core_if,
+					    dwc_param_phy_ulpi_ext_vbus_default);
+	dwc_otg_set_param_phy_utmi_width(core_if,
+					 dwc_param_phy_utmi_width_default);
+	dwc_otg_set_param_ts_dline(core_if, dwc_param_ts_dline_default);
+	dwc_otg_set_param_i2c_enable(core_if, dwc_param_i2c_enable_default);
+	dwc_otg_set_param_ulpi_fs_ls(core_if, dwc_param_ulpi_fs_ls_default);
+	dwc_otg_set_param_en_multiple_tx_fifo(core_if,
+					      dwc_param_en_multiple_tx_fifo_default);
+	for (i = 0; i < 15; i++) {
+		dwc_otg_set_param_dev_perio_tx_fifo_size(core_if,
+							 dwc_param_dev_perio_tx_fifo_size_default,
+							 i);
+	}
+
+	for (i = 0; i < 15; i++) {
+		dwc_otg_set_param_dev_tx_fifo_size(core_if,
+						   dwc_param_dev_tx_fifo_size_default,
+						   i);
+	}
+	dwc_otg_set_param_thr_ctl(core_if, dwc_param_thr_ctl_default);
+	dwc_otg_set_param_mpi_enable(core_if, dwc_param_mpi_enable_default);
+	dwc_otg_set_param_pti_enable(core_if, dwc_param_pti_enable_default);
+	dwc_otg_set_param_lpm_enable(core_if, dwc_param_lpm_enable_default);
+	dwc_otg_set_param_ic_usb_cap(core_if, dwc_param_ic_usb_cap_default);
+	dwc_otg_set_param_tx_thr_length(core_if,
+					dwc_param_tx_thr_length_default);
+	dwc_otg_set_param_rx_thr_length(core_if,
+					dwc_param_rx_thr_length_default);
+	dwc_otg_set_param_ahb_thr_ratio(core_if,
+					dwc_param_ahb_thr_ratio_default);
+	dwc_otg_set_param_power_down(core_if, dwc_param_power_down_default);
+	dwc_otg_set_param_reload_ctl(core_if, dwc_param_reload_ctl_default);
+	dwc_otg_set_param_dev_out_nak(core_if, dwc_param_dev_out_nak_default);
+	dwc_otg_set_param_cont_on_bna(core_if, dwc_param_cont_on_bna_default);
+	dwc_otg_set_param_ahb_single(core_if, dwc_param_ahb_single_default);
+	dwc_otg_set_param_otg_ver(core_if, dwc_param_otg_ver_default);
+	dwc_otg_set_param_adp_enable(core_if, dwc_param_adp_enable_default);
+	DWC_PRINTF("Finished setting default values for core params\n");
+
+	return 0;
+}
+
+uint8_t dwc_otg_is_dma_enable(dwc_otg_core_if_t * core_if)
+{
+	return core_if->dma_enable;
+}
+
+/* Checks if the parameter is outside of its valid range of values */
+#define DWC_OTG_PARAM_TEST(_param_, _low_, _high_) \
+		(((_param_) < (_low_)) || \
+		((_param_) > (_high_)))
+
+/* Parameter access functions */
+int dwc_otg_set_param_otg_cap(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int valid;
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 2)) {
+		DWC_WARN("Wrong value for otg_cap parameter\n");
+		DWC_WARN("otg_cap parameter must be 0,1 or 2\n");
+		retval = -DWC_E_INVALID;
+		goto out;
+	}
+
+	valid = 1;
+	switch (val) {
+	case DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE:
+		if (core_if->hwcfg2.b.op_mode !=
+		    DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG)
+			valid = 0;
+		break;
+	case DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE:
+		if ((core_if->hwcfg2.b.op_mode !=
+		     DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG)
+		    && (core_if->hwcfg2.b.op_mode !=
+			DWC_HWCFG2_OP_MODE_SRP_ONLY_CAPABLE_OTG)
+		    && (core_if->hwcfg2.b.op_mode !=
+			DWC_HWCFG2_OP_MODE_SRP_CAPABLE_DEVICE)
+		    && (core_if->hwcfg2.b.op_mode !=
+			DWC_HWCFG2_OP_MODE_SRP_CAPABLE_HOST)) {
+			valid = 0;
+		}
+		break;
+	case DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE:
+		/* always valid */
+		break;
+	}
+	if (!valid) {
+		if (dwc_otg_param_initialized(core_if->core_params->otg_cap)) {
+			DWC_ERROR
+			    ("%d invalid for otg_cap paremter. Check HW configuration.\n",
+			     val);
+		}
+		val =
+		    (((core_if->hwcfg2.b.op_mode ==
+		       DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG)
+		      || (core_if->hwcfg2.b.op_mode ==
+			  DWC_HWCFG2_OP_MODE_SRP_ONLY_CAPABLE_OTG)
+		      || (core_if->hwcfg2.b.op_mode ==
+			  DWC_HWCFG2_OP_MODE_SRP_CAPABLE_DEVICE)
+		      || (core_if->hwcfg2.b.op_mode ==
+			  DWC_HWCFG2_OP_MODE_SRP_CAPABLE_HOST)) ?
+		     DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE :
+		     DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE);
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->otg_cap = val;
+out:
+	return retval;
+}
+
+int32_t dwc_otg_get_param_otg_cap(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->otg_cap;
+}
+
+int dwc_otg_set_param_opt(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong value for opt parameter\n");
+		return -DWC_E_INVALID;
+	}
+	core_if->core_params->opt = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_opt(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->opt;
+}
+
+int dwc_otg_set_param_dma_enable(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong value for dma enable\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val == 1) && (core_if->hwcfg2.b.architecture == 0)) {
+		if (dwc_otg_param_initialized(core_if->core_params->dma_enable)) {
+			DWC_ERROR
+			    ("%d invalid for dma_enable paremter. Check HW configuration.\n",
+			     val);
+		}
+		val = 0;
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->dma_enable = val;
+	if (val == 0) {
+		dwc_otg_set_param_dma_desc_enable(core_if, 0);
+	}
+	return retval;
+}
+
+int32_t dwc_otg_get_param_dma_enable(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->dma_enable;
+}
+
+int dwc_otg_set_param_dma_desc_enable(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong value for dma_enable\n");
+		DWC_WARN("dma_desc_enable must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val == 1)
+	    && ((dwc_otg_get_param_dma_enable(core_if) == 0)
+		|| (core_if->hwcfg4.b.desc_dma == 0))) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->dma_desc_enable)) {
+			DWC_ERROR
+			    ("%d invalid for dma_desc_enable paremter. Check HW configuration.\n",
+			     val);
+		}
+		val = 0;
+		retval = -DWC_E_INVALID;
+	}
+	core_if->core_params->dma_desc_enable = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_dma_desc_enable(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->dma_desc_enable;
+}
+
+int dwc_otg_set_param_host_support_fs_ls_low_power(dwc_otg_core_if_t * core_if,
+						   int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong value for host_support_fs_low_power\n");
+		DWC_WARN("host_support_fs_low_power must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+	core_if->core_params->host_support_fs_ls_low_power = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_host_support_fs_ls_low_power(dwc_otg_core_if_t *
+						       core_if)
+{
+	return core_if->core_params->host_support_fs_ls_low_power;
+}
+
+int dwc_otg_set_param_enable_dynamic_fifo(dwc_otg_core_if_t * core_if,
+					  int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong value for enable_dynamic_fifo\n");
+		DWC_WARN("enable_dynamic_fifo must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val == 1) && (core_if->hwcfg2.b.dynamic_fifo == 0)) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->enable_dynamic_fifo)) {
+			DWC_ERROR
+			    ("%d invalid for enable_dynamic_fifo paremter. Check HW configuration.\n",
+			     val);
+		}
+		val = 0;
+		retval = -DWC_E_INVALID;
+	}
+	core_if->core_params->enable_dynamic_fifo = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_enable_dynamic_fifo(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->enable_dynamic_fifo;
+}
+
+int dwc_otg_set_param_data_fifo_size(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 32, 32768)) {
+		DWC_WARN("Wrong value for data_fifo_size\n");
+		DWC_WARN("data_fifo_size must be 32-32768\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val > core_if->hwcfg3.b.dfifo_depth) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->data_fifo_size)) {
+			DWC_ERROR
+			    ("%d invalid for data_fifo_size parameter. Check HW configuration.\n",
+			     val);
+		}
+		val = core_if->hwcfg3.b.dfifo_depth;
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->data_fifo_size = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_data_fifo_size(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->data_fifo_size;
+}
+
+int dwc_otg_set_param_dev_rx_fifo_size(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
+		DWC_WARN("Wrong value for dev_rx_fifo_size\n");
+		DWC_WARN("dev_rx_fifo_size must be 16-32768\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val > DWC_READ_REG32(&core_if->core_global_regs->grxfsiz)) {
+		if (dwc_otg_param_initialized(core_if->core_params->dev_rx_fifo_size)) {
+		DWC_WARN("%d invalid for dev_rx_fifo_size parameter\n", val);
+		}
+		val = DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->dev_rx_fifo_size = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_dev_rx_fifo_size(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->dev_rx_fifo_size;
+}
+
+int dwc_otg_set_param_dev_nperio_tx_fifo_size(dwc_otg_core_if_t * core_if,
+					      int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
+		DWC_WARN("Wrong value for dev_nperio_tx_fifo\n");
+		DWC_WARN("dev_nperio_tx_fifo must be 16-32768\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val > (DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz) >> 16)) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->dev_nperio_tx_fifo_size)) {
+			DWC_ERROR
+			    ("%d invalid for dev_nperio_tx_fifo_size. Check HW configuration.\n",
+			     val);
+		}
+		val =
+		    (DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz) >>
+		     16);
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->dev_nperio_tx_fifo_size = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_dev_nperio_tx_fifo_size(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->dev_nperio_tx_fifo_size;
+}
+
+int dwc_otg_set_param_host_rx_fifo_size(dwc_otg_core_if_t * core_if,
+					int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
+		DWC_WARN("Wrong value for host_rx_fifo_size\n");
+		DWC_WARN("host_rx_fifo_size must be 16-32768\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val > DWC_READ_REG32(&core_if->core_global_regs->grxfsiz)) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->host_rx_fifo_size)) {
+			DWC_ERROR
+			    ("%d invalid for host_rx_fifo_size. Check HW configuration.\n",
+			     val);
+		}
+		val = DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->host_rx_fifo_size = val;
+	return retval;
+
+}
+
+int32_t dwc_otg_get_param_host_rx_fifo_size(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->host_rx_fifo_size;
+}
+
+int dwc_otg_set_param_host_nperio_tx_fifo_size(dwc_otg_core_if_t * core_if,
+					       int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
+		DWC_WARN("Wrong value for host_nperio_tx_fifo_size\n");
+		DWC_WARN("host_nperio_tx_fifo_size must be 16-32768\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val > (DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz) >> 16)) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->host_nperio_tx_fifo_size)) {
+			DWC_ERROR
+			    ("%d invalid for host_nperio_tx_fifo_size. Check HW configuration.\n",
+			     val);
+		}
+		val =
+		    (DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz) >>
+		     16);
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->host_nperio_tx_fifo_size = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_host_nperio_tx_fifo_size(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->host_nperio_tx_fifo_size;
+}
+
+int dwc_otg_set_param_host_perio_tx_fifo_size(dwc_otg_core_if_t * core_if,
+					      int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 16, 32768)) {
+		DWC_WARN("Wrong value for host_perio_tx_fifo_size\n");
+		DWC_WARN("host_perio_tx_fifo_size must be 16-32768\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val > ((core_if->hptxfsiz.d32) >> 16)) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->host_perio_tx_fifo_size)) {
+			DWC_ERROR
+			    ("%d invalid for host_perio_tx_fifo_size. Check HW configuration.\n",
+			     val);
+		}
+		val = (core_if->hptxfsiz.d32) >> 16;
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->host_perio_tx_fifo_size = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_host_perio_tx_fifo_size(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->host_perio_tx_fifo_size;
+}
+
+int dwc_otg_set_param_max_transfer_size(dwc_otg_core_if_t * core_if,
+					int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 2047, 524288)) {
+		DWC_WARN("Wrong value for max_transfer_size\n");
+		DWC_WARN("max_transfer_size must be 2047-524288\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val >= (1 << (core_if->hwcfg3.b.xfer_size_cntr_width + 11))) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->max_transfer_size)) {
+			DWC_ERROR
+			    ("%d invalid for max_transfer_size. Check HW configuration.\n",
+			     val);
+		}
+		val =
+		    ((1 << (core_if->hwcfg3.b.packet_size_cntr_width + 11)) -
+		     1);
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->max_transfer_size = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_max_transfer_size(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->max_transfer_size;
+}
+
+int dwc_otg_set_param_max_packet_count(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 15, 511)) {
+		DWC_WARN("Wrong value for max_packet_count\n");
+		DWC_WARN("max_packet_count must be 15-511\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val > (1 << (core_if->hwcfg3.b.packet_size_cntr_width + 4))) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->max_packet_count)) {
+			DWC_ERROR
+			    ("%d invalid for max_packet_count. Check HW configuration.\n",
+			     val);
+		}
+		val =
+		    ((1 << (core_if->hwcfg3.b.packet_size_cntr_width + 4)) - 1);
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->max_packet_count = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_max_packet_count(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->max_packet_count;
+}
+
+int dwc_otg_set_param_host_channels(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 1, 16)) {
+		DWC_WARN("Wrong value for host_channels\n");
+		DWC_WARN("host_channels must be 1-16\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val > (core_if->hwcfg2.b.num_host_chan + 1)) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->host_channels)) {
+			DWC_ERROR
+			    ("%d invalid for host_channels. Check HW configurations.\n",
+			     val);
+		}
+		val = (core_if->hwcfg2.b.num_host_chan + 1);
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->host_channels = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_host_channels(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->host_channels;
+}
+
+int dwc_otg_set_param_dev_endpoints(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 1, 15)) {
+		DWC_WARN("Wrong value for dev_endpoints\n");
+		DWC_WARN("dev_endpoints must be 1-15\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val > (core_if->hwcfg2.b.num_dev_ep)) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->dev_endpoints)) {
+			DWC_ERROR
+			    ("%d invalid for dev_endpoints. Check HW configurations.\n",
+			     val);
+		}
+		val = core_if->hwcfg2.b.num_dev_ep;
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->dev_endpoints = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_dev_endpoints(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->dev_endpoints;
+}
+
+int dwc_otg_set_param_phy_type(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	int valid = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 2)) {
+		DWC_WARN("Wrong value for phy_type\n");
+		DWC_WARN("phy_type must be 0,1 or 2\n");
+		return -DWC_E_INVALID;
+	}
+#ifndef NO_FS_PHY_HW_CHECKS
+	if ((val == DWC_PHY_TYPE_PARAM_UTMI) &&
+	    ((core_if->hwcfg2.b.hs_phy_type == 1) ||
+	     (core_if->hwcfg2.b.hs_phy_type == 3))) {
+		valid = 1;
+	} else if ((val == DWC_PHY_TYPE_PARAM_ULPI) &&
+		   ((core_if->hwcfg2.b.hs_phy_type == 2) ||
+		    (core_if->hwcfg2.b.hs_phy_type == 3))) {
+		valid = 1;
+	} else if ((val == DWC_PHY_TYPE_PARAM_FS) &&
+		   (core_if->hwcfg2.b.fs_phy_type == 1)) {
+		valid = 1;
+	}
+	if (!valid) {
+		if (dwc_otg_param_initialized(core_if->core_params->phy_type)) {
+			DWC_ERROR
+			    ("%d invalid for phy_type. Check HW configurations.\n",
+			     val);
+		}
+		if (core_if->hwcfg2.b.hs_phy_type) {
+			if ((core_if->hwcfg2.b.hs_phy_type == 3) ||
+			    (core_if->hwcfg2.b.hs_phy_type == 1)) {
+				val = DWC_PHY_TYPE_PARAM_UTMI;
+			} else {
+				val = DWC_PHY_TYPE_PARAM_ULPI;
+			}
+		}
+		retval = -DWC_E_INVALID;
+	}
+#endif
+	core_if->core_params->phy_type = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_phy_type(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->phy_type;
+}
+
+int dwc_otg_set_param_speed(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong value for speed parameter\n");
+		DWC_WARN("max_speed parameter must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+	if ((val == 0)
+	    && dwc_otg_get_param_phy_type(core_if) == DWC_PHY_TYPE_PARAM_FS) {
+		if (dwc_otg_param_initialized(core_if->core_params->speed)) {
+			DWC_ERROR
+			    ("%d invalid for speed paremter. Check HW configuration.\n",
+			     val);
+		}
+		val =
+		    (dwc_otg_get_param_phy_type(core_if) ==
+		     DWC_PHY_TYPE_PARAM_FS ? 1 : 0);
+		retval = -DWC_E_INVALID;
+	}
+	core_if->core_params->speed = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_speed(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->speed;
+}
+
+int dwc_otg_set_param_host_ls_low_power_phy_clk(dwc_otg_core_if_t * core_if,
+						int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN
+		    ("Wrong value for host_ls_low_power_phy_clk parameter\n");
+		DWC_WARN("host_ls_low_power_phy_clk must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val == DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_48MHZ)
+	    && (dwc_otg_get_param_phy_type(core_if) == DWC_PHY_TYPE_PARAM_FS)) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->host_ls_low_power_phy_clk)) {
+			DWC_ERROR
+			    ("%d invalid for host_ls_low_power_phy_clk. Check HW configuration.\n",
+			     val);
+		}
+		val =
+		    (dwc_otg_get_param_phy_type(core_if) ==
+		     DWC_PHY_TYPE_PARAM_FS) ?
+		    DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_6MHZ :
+		    DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_48MHZ;
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->host_ls_low_power_phy_clk = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_host_ls_low_power_phy_clk(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->host_ls_low_power_phy_clk;
+}
+
+int dwc_otg_set_param_phy_ulpi_ddr(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong value for phy_ulpi_ddr\n");
+		DWC_WARN("phy_upli_ddr must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	core_if->core_params->phy_ulpi_ddr = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_phy_ulpi_ddr(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->phy_ulpi_ddr;
+}
+
+int dwc_otg_set_param_phy_ulpi_ext_vbus(dwc_otg_core_if_t * core_if,
+					int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong valaue for phy_ulpi_ext_vbus\n");
+		DWC_WARN("phy_ulpi_ext_vbus must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	core_if->core_params->phy_ulpi_ext_vbus = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_phy_ulpi_ext_vbus(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->phy_ulpi_ext_vbus;
+}
+
+int dwc_otg_set_param_phy_utmi_width(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 8, 8) && DWC_OTG_PARAM_TEST(val, 16, 16)) {
+		DWC_WARN("Wrong valaue for phy_utmi_width\n");
+		DWC_WARN("phy_utmi_width must be 8 or 16\n");
+		return -DWC_E_INVALID;
+	}
+
+	core_if->core_params->phy_utmi_width = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_phy_utmi_width(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->phy_utmi_width;
+}
+
+int dwc_otg_set_param_ulpi_fs_ls(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong valaue for ulpi_fs_ls\n");
+		DWC_WARN("ulpi_fs_ls must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	core_if->core_params->ulpi_fs_ls = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_ulpi_fs_ls(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->ulpi_fs_ls;
+}
+
+int dwc_otg_set_param_ts_dline(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong valaue for ts_dline\n");
+		DWC_WARN("ts_dline must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	core_if->core_params->ts_dline = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_ts_dline(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->ts_dline;
+}
+
+int dwc_otg_set_param_i2c_enable(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong valaue for i2c_enable\n");
+		DWC_WARN("i2c_enable must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+#ifndef NO_FS_PHY_HW_CHECK
+	if (val == 1 && core_if->hwcfg3.b.i2c == 0) {
+		if (dwc_otg_param_initialized(core_if->core_params->i2c_enable)) {
+			DWC_ERROR
+			    ("%d invalid for i2c_enable. Check HW configuration.\n",
+			     val);
+		}
+		val = 0;
+		retval = -DWC_E_INVALID;
+	}
+#endif
+
+	core_if->core_params->i2c_enable = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_i2c_enable(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->i2c_enable;
+}
+
+int dwc_otg_set_param_dev_perio_tx_fifo_size(dwc_otg_core_if_t * core_if,
+					     int32_t val, int fifo_num)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 4, 768)) {
+		DWC_WARN("Wrong value for dev_perio_tx_fifo_size\n");
+		DWC_WARN("dev_perio_tx_fifo_size must be 4-768\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val >
+	    (DWC_READ_REG32(&core_if->core_global_regs->dtxfsiz[fifo_num]))) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->dev_perio_tx_fifo_size[fifo_num])) {
+			DWC_ERROR
+			    ("`%d' invalid for parameter `dev_perio_fifo_size_%d'. Check HW configuration.\n",
+			     val, fifo_num);
+		}
+		val = (DWC_READ_REG32(&core_if->core_global_regs->dtxfsiz[fifo_num]));
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->dev_perio_tx_fifo_size[fifo_num] = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_dev_perio_tx_fifo_size(dwc_otg_core_if_t * core_if,
+						 int fifo_num)
+{
+	return core_if->core_params->dev_perio_tx_fifo_size[fifo_num];
+}
+
+int dwc_otg_set_param_en_multiple_tx_fifo(dwc_otg_core_if_t * core_if,
+					  int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong valaue for en_multiple_tx_fifo,\n");
+		DWC_WARN("en_multiple_tx_fifo must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val == 1 && core_if->hwcfg4.b.ded_fifo_en == 0) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->en_multiple_tx_fifo)) {
+			DWC_ERROR
+			    ("%d invalid for parameter en_multiple_tx_fifo. Check HW configuration.\n",
+			     val);
+		}
+		val = 0;
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->en_multiple_tx_fifo = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_en_multiple_tx_fifo(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->en_multiple_tx_fifo;
+}
+
+int dwc_otg_set_param_dev_tx_fifo_size(dwc_otg_core_if_t * core_if, int32_t val,
+				       int fifo_num)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 4, 768)) {
+		DWC_WARN("Wrong value for dev_tx_fifo_size\n");
+		DWC_WARN("dev_tx_fifo_size must be 4-768\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val >
+	    (DWC_READ_REG32(&core_if->core_global_regs->dtxfsiz[fifo_num]))) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->dev_tx_fifo_size[fifo_num])) {
+			DWC_ERROR
+			    ("`%d' invalid for parameter `dev_tx_fifo_size_%d'. Check HW configuration.\n",
+			     val, fifo_num);
+		}
+		val = (DWC_READ_REG32(&core_if->core_global_regs->dtxfsiz[fifo_num]));
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->dev_tx_fifo_size[fifo_num] = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_dev_tx_fifo_size(dwc_otg_core_if_t * core_if,
+					   int fifo_num)
+{
+	return core_if->core_params->dev_tx_fifo_size[fifo_num];
+}
+
+int dwc_otg_set_param_thr_ctl(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 7)) {
+		DWC_WARN("Wrong value for thr_ctl\n");
+		DWC_WARN("thr_ctl must be 0-7\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val != 0) &&
+	    (!dwc_otg_get_param_dma_enable(core_if) ||
+	     !core_if->hwcfg4.b.ded_fifo_en)) {
+		if (dwc_otg_param_initialized(core_if->core_params->thr_ctl)) {
+			DWC_ERROR
+			    ("%d invalid for parameter thr_ctl. Check HW configuration.\n",
+			     val);
+		}
+		val = 0;
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->thr_ctl = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_thr_ctl(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->thr_ctl;
+}
+
+int dwc_otg_set_param_lpm_enable(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("Wrong value for lpm_enable\n");
+		DWC_WARN("lpm_enable must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val && !core_if->hwcfg3.b.otg_lpm_en) {
+		if (dwc_otg_param_initialized(core_if->core_params->lpm_enable)) {
+			DWC_ERROR
+			    ("%d invalid for parameter lpm_enable. Check HW configuration.\n",
+			     val);
+		}
+		val = 0;
+		retval = -DWC_E_INVALID;
+	}
+
+	core_if->core_params->lpm_enable = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_lpm_enable(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->lpm_enable;
+}
+
+int dwc_otg_set_param_tx_thr_length(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 8, 128)) {
+		DWC_WARN("Wrong valaue for tx_thr_length\n");
+		DWC_WARN("tx_thr_length must be 8 - 128\n");
+		return -DWC_E_INVALID;
+	}
+
+	core_if->core_params->tx_thr_length = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_tx_thr_length(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->tx_thr_length;
+}
+
+int dwc_otg_set_param_rx_thr_length(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 8, 128)) {
+		DWC_WARN("Wrong valaue for rx_thr_length\n");
+		DWC_WARN("rx_thr_length must be 8 - 128\n");
+		return -DWC_E_INVALID;
+	}
+
+	core_if->core_params->rx_thr_length = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_rx_thr_length(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->rx_thr_length;
+}
+
+int dwc_otg_set_param_dma_burst_size(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	if (DWC_OTG_PARAM_TEST(val, 1, 1) &&
+	    DWC_OTG_PARAM_TEST(val, 4, 4) &&
+	    DWC_OTG_PARAM_TEST(val, 8, 8) &&
+	    DWC_OTG_PARAM_TEST(val, 16, 16) &&
+	    DWC_OTG_PARAM_TEST(val, 32, 32) &&
+	    DWC_OTG_PARAM_TEST(val, 64, 64) &&
+	    DWC_OTG_PARAM_TEST(val, 128, 128) &&
+	    DWC_OTG_PARAM_TEST(val, 256, 256)) {
+		DWC_WARN("`%d' invalid for parameter `dma_burst_size'\n", val);
+		return -DWC_E_INVALID;
+	}
+	core_if->core_params->dma_burst_size = val;
+	return 0;
+}
+
+int32_t dwc_otg_get_param_dma_burst_size(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->dma_burst_size;
+}
+
+int dwc_otg_set_param_pti_enable(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("`%d' invalid for parameter `pti_enable'\n", val);
+		return -DWC_E_INVALID;
+	}
+	if (val && (core_if->snpsid < OTG_CORE_REV_2_72a)) {
+		if (dwc_otg_param_initialized(core_if->core_params->pti_enable)) {
+			DWC_ERROR
+			    ("%d invalid for parameter pti_enable. Check HW configuration.\n",
+			     val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+	core_if->core_params->pti_enable = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_pti_enable(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->pti_enable;
+}
+
+int dwc_otg_set_param_mpi_enable(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("`%d' invalid for parameter `mpi_enable'\n", val);
+		return -DWC_E_INVALID;
+	}
+	if (val && (core_if->hwcfg2.b.multi_proc_int == 0)) {
+		if (dwc_otg_param_initialized(core_if->core_params->mpi_enable)) {
+			DWC_ERROR
+			    ("%d invalid for parameter mpi_enable. Check HW configuration.\n",
+			     val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+	core_if->core_params->mpi_enable = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_mpi_enable(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->mpi_enable;
+}
+
+int dwc_otg_set_param_adp_enable(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("`%d' invalid for parameter `adp_enable'\n", val);
+		return -DWC_E_INVALID;
+	}
+	if (val && (core_if->hwcfg3.b.adp_supp == 0)) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->adp_supp_enable)) {
+			DWC_ERROR
+			    ("%d invalid for parameter adp_enable. Check HW configuration.\n",
+			     val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+	core_if->core_params->adp_supp_enable = val;
+	/*Set OTG version 2.0 in case of enabling ADP*/
+	if (val)
+		dwc_otg_set_param_otg_ver(core_if, 1);
+
+	return retval;
+}
+
+int32_t dwc_otg_get_param_adp_enable(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->adp_supp_enable;
+}
+
+int dwc_otg_set_param_ic_usb_cap(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("`%d' invalid for parameter `ic_usb_cap'\n", val);
+		DWC_WARN("ic_usb_cap must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val && (core_if->hwcfg2.b.otg_enable_ic_usb == 0)) {
+		if (dwc_otg_param_initialized(core_if->core_params->ic_usb_cap)) {
+			DWC_ERROR
+			    ("%d invalid for parameter ic_usb_cap. Check HW configuration.\n",
+			     val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+	core_if->core_params->ic_usb_cap = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_ic_usb_cap(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->ic_usb_cap;
+}
+
+int dwc_otg_set_param_ahb_thr_ratio(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	int valid = 1;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 3)) {
+		DWC_WARN("`%d' invalid for parameter `ahb_thr_ratio'\n", val);
+		DWC_WARN("ahb_thr_ratio must be 0 - 3\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (val
+	    && (core_if->snpsid < OTG_CORE_REV_2_81a
+		|| !dwc_otg_get_param_thr_ctl(core_if))) {
+		valid = 0;
+	} else if (val
+		   && ((dwc_otg_get_param_tx_thr_length(core_if) / (1 << val)) <
+		       4)) {
+		valid = 0;
+	}
+	if (valid == 0) {
+		if (dwc_otg_param_initialized
+		    (core_if->core_params->ahb_thr_ratio)) {
+			DWC_ERROR
+			    ("%d invalid for parameter ahb_thr_ratio. Check HW configuration.\n",
+			     val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+
+	core_if->core_params->ahb_thr_ratio = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_ahb_thr_ratio(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->ahb_thr_ratio;
+}
+
+int dwc_otg_set_param_power_down(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	int valid = 1;
+	hwcfg4_data_t hwcfg4 = {.d32 = 0 };
+	hwcfg4.d32 = DWC_READ_REG32(&core_if->core_global_regs->ghwcfg4);
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 3)) {
+		DWC_WARN("`%d' invalid for parameter `power_down'\n", val);
+		DWC_WARN("power_down must be 0 - 2\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val == 2) && (core_if->snpsid < OTG_CORE_REV_2_91a)) {
+		valid = 0;
+	}
+	if ((val == 3)
+	    && ((core_if->snpsid < OTG_CORE_REV_3_00a)
+		|| (hwcfg4.b.xhiber == 0))) {
+		valid = 0;
+	}
+	if (valid == 0) {
+		if (dwc_otg_param_initialized(core_if->core_params->power_down)) {
+			DWC_ERROR
+			    ("%d invalid for parameter power_down. Check HW configuration.\n",
+			     val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+	core_if->core_params->power_down = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_power_down(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->power_down;
+}
+
+int dwc_otg_set_param_reload_ctl(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	int valid = 1;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("`%d' invalid for parameter `reload_ctl'\n", val);
+		DWC_WARN("reload_ctl must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val == 1) && (core_if->snpsid < OTG_CORE_REV_2_92a)) {
+		valid = 0;
+	}
+	if (valid == 0) {
+		if (dwc_otg_param_initialized(core_if->core_params->reload_ctl)) {
+			DWC_ERROR("%d invalid for parameter reload_ctl."
+				  "Check HW configuration.\n", val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+	core_if->core_params->reload_ctl = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_reload_ctl(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->reload_ctl;
+}
+
+int dwc_otg_set_param_dev_out_nak(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	int valid = 1;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("`%d' invalid for parameter `dev_out_nak'\n", val);
+		DWC_WARN("dev_out_nak must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val == 1) && ((core_if->snpsid < OTG_CORE_REV_2_93a) ||
+		!(core_if->core_params->dma_desc_enable))) {
+		valid = 0;
+	}
+	if (valid == 0) {
+		if (dwc_otg_param_initialized(core_if->core_params->dev_out_nak)) {
+			DWC_ERROR("%d invalid for parameter dev_out_nak."
+				"Check HW configuration.\n", val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+	core_if->core_params->dev_out_nak = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_dev_out_nak(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->dev_out_nak;
+}
+
+int dwc_otg_set_param_cont_on_bna(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	int valid = 1;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("`%d' invalid for parameter `cont_on_bna'\n", val);
+		DWC_WARN("cont_on_bna must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val == 1) && ((core_if->snpsid < OTG_CORE_REV_2_94a) ||
+		!(core_if->core_params->dma_desc_enable))) {
+			valid = 0;
+	}
+	if (valid == 0) {
+		if (dwc_otg_param_initialized(core_if->core_params->cont_on_bna)) {
+			DWC_ERROR("%d invalid for parameter cont_on_bna."
+				"Check HW configuration.\n", val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+	core_if->core_params->cont_on_bna = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_cont_on_bna(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->cont_on_bna;
+}
+
+int dwc_otg_set_param_ahb_single(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+	int valid = 1;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("`%d' invalid for parameter `ahb_single'\n", val);
+		DWC_WARN("ahb_single must be 0 or 1\n");
+		return -DWC_E_INVALID;
+	}
+
+	if ((val == 1) && (core_if->snpsid < OTG_CORE_REV_2_94a)) {
+			valid = 0;
+	}
+	if (valid == 0) {
+		if (dwc_otg_param_initialized(core_if->core_params->ahb_single)) {
+			DWC_ERROR("%d invalid for parameter ahb_single."
+				"Check HW configuration.\n", val);
+		}
+		retval = -DWC_E_INVALID;
+		val = 0;
+	}
+	core_if->core_params->ahb_single = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_ahb_single(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->ahb_single;
+}
+
+int dwc_otg_set_param_otg_ver(dwc_otg_core_if_t * core_if, int32_t val)
+{
+	int retval = 0;
+
+	if (DWC_OTG_PARAM_TEST(val, 0, 1)) {
+		DWC_WARN("`%d' invalid for parameter `otg_ver'\n", val);
+		DWC_WARN
+		    ("otg_ver must be 0(for OTG 1.3 support) or 1(for OTG 2.0 support)\n");
+		return -DWC_E_INVALID;
+	}
+
+	core_if->core_params->otg_ver = val;
+	return retval;
+}
+
+int32_t dwc_otg_get_param_otg_ver(dwc_otg_core_if_t * core_if)
+{
+	return core_if->core_params->otg_ver;
+}
+
+uint32_t dwc_otg_get_hnpstatus(dwc_otg_core_if_t * core_if)
+{
+	gotgctl_data_t otgctl;
+	otgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
+	return otgctl.b.hstnegscs;
+}
+
+uint32_t dwc_otg_get_srpstatus(dwc_otg_core_if_t * core_if)
+{
+	gotgctl_data_t otgctl;
+	otgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
+	return otgctl.b.sesreqscs;
+}
+
+void dwc_otg_set_hnpreq(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	if(core_if->otg_ver == 0) {
+		gotgctl_data_t otgctl;
+		otgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
+		otgctl.b.hnpreq = val;
+		DWC_WRITE_REG32(&core_if->core_global_regs->gotgctl, otgctl.d32);
+	} else {
+		core_if->otg_sts = val;
+	}
+}
+
+uint32_t dwc_otg_get_gsnpsid(dwc_otg_core_if_t * core_if)
+{
+	return core_if->snpsid;
+}
+
+uint32_t dwc_otg_get_mode(dwc_otg_core_if_t * core_if)
+{
+	gintsts_data_t gintsts;
+	gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+	return gintsts.b.curmode;
+}
+
+uint32_t dwc_otg_get_hnpcapable(dwc_otg_core_if_t * core_if)
+{
+	gusbcfg_data_t usbcfg;
+	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+	return usbcfg.b.hnpcap;
+}
+
+void dwc_otg_set_hnpcapable(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	gusbcfg_data_t usbcfg;
+	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+	usbcfg.b.hnpcap = val;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, usbcfg.d32);
+}
+
+uint32_t dwc_otg_get_srpcapable(dwc_otg_core_if_t * core_if)
+{
+	gusbcfg_data_t usbcfg;
+	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+	return usbcfg.b.srpcap;
+}
+
+void dwc_otg_set_srpcapable(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	gusbcfg_data_t usbcfg;
+	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+	usbcfg.b.srpcap = val;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, usbcfg.d32);
+}
+
+uint32_t dwc_otg_get_devspeed(dwc_otg_core_if_t * core_if)
+{
+	dcfg_data_t dcfg;
+	/* originally: dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg); */
+
+        dcfg.d32 = -1; //GRAYG
+        DWC_DEBUGPL(DBG_CILV, "%s - core_if(%p)\n", __func__, core_if);
+        if (NULL == core_if)
+                DWC_ERROR("reg request with NULL core_if\n");
+        DWC_DEBUGPL(DBG_CILV, "%s - core_if(%p)->dev_if(%p)\n", __func__,
+                    core_if, core_if->dev_if);
+        if (NULL == core_if->dev_if)
+                DWC_ERROR("reg request with NULL dev_if\n");
+        DWC_DEBUGPL(DBG_CILV, "%s - core_if(%p)->dev_if(%p)->"
+                    "dev_global_regs(%p)\n", __func__,
+                    core_if, core_if->dev_if,
+                    core_if->dev_if->dev_global_regs);
+        if (NULL == core_if->dev_if->dev_global_regs)
+                DWC_ERROR("reg request with NULL dev_global_regs\n");
+        else {
+                DWC_DEBUGPL(DBG_CILV, "%s - &core_if(%p)->dev_if(%p)->"
+                            "dev_global_regs(%p)->dcfg = %p\n", __func__,
+                            core_if, core_if->dev_if,
+                            core_if->dev_if->dev_global_regs,
+                            &core_if->dev_if->dev_global_regs->dcfg);
+		dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
+        }
+	return dcfg.b.devspd;
+}
+
+void dwc_otg_set_devspeed(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	dcfg_data_t dcfg;
+	dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
+	dcfg.b.devspd = val;
+	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg, dcfg.d32);
+}
+
+uint32_t dwc_otg_get_busconnected(dwc_otg_core_if_t * core_if)
+{
+	hprt0_data_t hprt0;
+	hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
+	return hprt0.b.prtconnsts;
+}
+
+uint32_t dwc_otg_get_enumspeed(dwc_otg_core_if_t * core_if)
+{
+	dsts_data_t dsts;
+	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
+	return dsts.b.enumspd;
+}
+
+uint32_t dwc_otg_get_prtpower(dwc_otg_core_if_t * core_if)
+{
+	hprt0_data_t hprt0;
+	hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
+	return hprt0.b.prtpwr;
+
+}
+
+uint32_t dwc_otg_get_core_state(dwc_otg_core_if_t * core_if)
+{
+	return core_if->hibernation_suspend;
+}
+
+void dwc_otg_set_prtpower(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	hprt0_data_t hprt0;
+	hprt0.d32 = dwc_otg_read_hprt0(core_if);
+	hprt0.b.prtpwr = val;
+	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+}
+
+uint32_t dwc_otg_get_prtsuspend(dwc_otg_core_if_t * core_if)
+{
+	hprt0_data_t hprt0;
+	hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
+	return hprt0.b.prtsusp;
+
+}
+
+void dwc_otg_set_prtsuspend(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	hprt0_data_t hprt0;
+	hprt0.d32 = dwc_otg_read_hprt0(core_if);
+	hprt0.b.prtsusp = val;
+	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+}
+
+uint32_t dwc_otg_get_fr_interval(dwc_otg_core_if_t * core_if)
+{
+	hfir_data_t hfir;
+	hfir.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hfir);
+	return hfir.b.frint;
+
+}
+
+void dwc_otg_set_fr_interval(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	hfir_data_t hfir;
+	uint32_t fram_int;
+	fram_int = calc_frame_interval(core_if);
+	hfir.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hfir);
+	if (!core_if->core_params->reload_ctl) {
+		DWC_WARN("\nCannot reload HFIR register.HFIR.HFIRRldCtrl bit is"
+			 "not set to 1.\nShould load driver with reload_ctl=1"
+			 " module parameter\n");
+		return;
+	}
+	switch (fram_int) {
+	case 3750:
+		if ((val < 3350) || (val > 4150)) {
+			DWC_WARN("HFIR interval for HS core and 30 MHz"
+				 "clock freq should be from 3350 to 4150\n");
+			return;
+		}
+		break;
+	case 30000:
+		if ((val < 26820) || (val > 33180)) {
+			DWC_WARN("HFIR interval for FS/LS core and 30 MHz"
+				 "clock freq should be from 26820 to 33180\n");
+			return;
+		}
+		break;
+	case 6000:
+		if ((val < 5360) || (val > 6640)) {
+			DWC_WARN("HFIR interval for HS core and 48 MHz"
+				 "clock freq should be from 5360 to 6640\n");
+			return;
+		}
+		break;
+	case 48000:
+		if ((val < 42912) || (val > 53088)) {
+			DWC_WARN("HFIR interval for FS/LS core and 48 MHz"
+				 "clock freq should be from 42912 to 53088\n");
+			return;
+		}
+		break;
+	case 7500:
+		if ((val < 6700) || (val > 8300)) {
+			DWC_WARN("HFIR interval for HS core and 60 MHz"
+				 "clock freq should be from 6700 to 8300\n");
+			return;
+		}
+		break;
+	case 60000:
+		if ((val < 53640) || (val > 65536)) {
+			DWC_WARN("HFIR interval for FS/LS core and 60 MHz"
+				 "clock freq should be from 53640 to 65536\n");
+			return;
+		}
+		break;
+	default:
+		DWC_WARN("Unknown frame interval\n");
+		return;
+		break;
+
+	}
+	hfir.b.frint = val;
+	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hfir, hfir.d32);
+}
+
+uint32_t dwc_otg_get_mode_ch_tim(dwc_otg_core_if_t * core_if)
+{
+	hcfg_data_t hcfg;
+	hcfg.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
+	return hcfg.b.modechtimen;
+
+}
+
+void dwc_otg_set_mode_ch_tim(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	hcfg_data_t hcfg;
+	hcfg.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->hcfg);
+	hcfg.b.modechtimen = val;
+	DWC_WRITE_REG32(&core_if->host_if->host_global_regs->hcfg, hcfg.d32);
+}
+
+void dwc_otg_set_prtresume(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	hprt0_data_t hprt0;
+	hprt0.d32 = dwc_otg_read_hprt0(core_if);
+	hprt0.b.prtres = val;
+	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+}
+
+uint32_t dwc_otg_get_remotewakesig(dwc_otg_core_if_t * core_if)
+{
+	dctl_data_t dctl;
+	dctl.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
+	return dctl.b.rmtwkupsig;
+}
+
+uint32_t dwc_otg_get_lpm_portsleepstatus(dwc_otg_core_if_t * core_if)
+{
+	glpmcfg_data_t lpmcfg;
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+
+	DWC_ASSERT(!
+		   ((core_if->lx_state == DWC_OTG_L1) ^ lpmcfg.b.prt_sleep_sts),
+		   "lx_state = %d, lmpcfg.prt_sleep_sts = %d\n",
+		   core_if->lx_state, lpmcfg.b.prt_sleep_sts);
+
+	return lpmcfg.b.prt_sleep_sts;
+}
+
+uint32_t dwc_otg_get_lpm_remotewakeenabled(dwc_otg_core_if_t * core_if)
+{
+	glpmcfg_data_t lpmcfg;
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	return lpmcfg.b.rem_wkup_en;
+}
+
+uint32_t dwc_otg_get_lpmresponse(dwc_otg_core_if_t * core_if)
+{
+	glpmcfg_data_t lpmcfg;
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	return lpmcfg.b.appl_resp;
+}
+
+void dwc_otg_set_lpmresponse(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	glpmcfg_data_t lpmcfg;
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	lpmcfg.b.appl_resp = val;
+	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, lpmcfg.d32);
+}
+
+uint32_t dwc_otg_get_hsic_connect(dwc_otg_core_if_t * core_if)
+{
+	glpmcfg_data_t lpmcfg;
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	return lpmcfg.b.hsic_connect;
+}
+
+void dwc_otg_set_hsic_connect(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	glpmcfg_data_t lpmcfg;
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	lpmcfg.b.hsic_connect = val;
+	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, lpmcfg.d32);
+}
+
+uint32_t dwc_otg_get_inv_sel_hsic(dwc_otg_core_if_t * core_if)
+{
+	glpmcfg_data_t lpmcfg;
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	return lpmcfg.b.inv_sel_hsic;
+
+}
+
+void dwc_otg_set_inv_sel_hsic(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	glpmcfg_data_t lpmcfg;
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	lpmcfg.b.inv_sel_hsic = val;
+	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, lpmcfg.d32);
+}
+
+uint32_t dwc_otg_get_gotgctl(dwc_otg_core_if_t * core_if)
+{
+	return DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
+}
+
+void dwc_otg_set_gotgctl(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	DWC_WRITE_REG32(&core_if->core_global_regs->gotgctl, val);
+}
+
+uint32_t dwc_otg_get_gusbcfg(dwc_otg_core_if_t * core_if)
+{
+	return DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+}
+
+void dwc_otg_set_gusbcfg(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, val);
+}
+
+uint32_t dwc_otg_get_grxfsiz(dwc_otg_core_if_t * core_if)
+{
+	return DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
+}
+
+void dwc_otg_set_grxfsiz(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	DWC_WRITE_REG32(&core_if->core_global_regs->grxfsiz, val);
+}
+
+uint32_t dwc_otg_get_gnptxfsiz(dwc_otg_core_if_t * core_if)
+{
+	return DWC_READ_REG32(&core_if->core_global_regs->gnptxfsiz);
+}
+
+void dwc_otg_set_gnptxfsiz(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	DWC_WRITE_REG32(&core_if->core_global_regs->gnptxfsiz, val);
+}
+
+uint32_t dwc_otg_get_gpvndctl(dwc_otg_core_if_t * core_if)
+{
+	return DWC_READ_REG32(&core_if->core_global_regs->gpvndctl);
+}
+
+void dwc_otg_set_gpvndctl(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	DWC_WRITE_REG32(&core_if->core_global_regs->gpvndctl, val);
+}
+
+uint32_t dwc_otg_get_ggpio(dwc_otg_core_if_t * core_if)
+{
+	return DWC_READ_REG32(&core_if->core_global_regs->ggpio);
+}
+
+void dwc_otg_set_ggpio(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	DWC_WRITE_REG32(&core_if->core_global_regs->ggpio, val);
+}
+
+uint32_t dwc_otg_get_hprt0(dwc_otg_core_if_t * core_if)
+{
+	return DWC_READ_REG32(core_if->host_if->hprt0);
+
+}
+
+void dwc_otg_set_hprt0(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	DWC_WRITE_REG32(core_if->host_if->hprt0, val);
+}
+
+uint32_t dwc_otg_get_guid(dwc_otg_core_if_t * core_if)
+{
+	return DWC_READ_REG32(&core_if->core_global_regs->guid);
+}
+
+void dwc_otg_set_guid(dwc_otg_core_if_t * core_if, uint32_t val)
+{
+	DWC_WRITE_REG32(&core_if->core_global_regs->guid, val);
+}
+
+uint32_t dwc_otg_get_hptxfsiz(dwc_otg_core_if_t * core_if)
+{
+	return DWC_READ_REG32(&core_if->core_global_regs->hptxfsiz);
+}
+
+uint16_t dwc_otg_get_otg_version(dwc_otg_core_if_t * core_if)
+{
+	return ((core_if->otg_ver == 1) ? (uint16_t)0x0200 : (uint16_t)0x0103);
+}
+
+/**
+ * Start the SRP timer to detect when the SRP does not complete within
+ * 6 seconds.
+ *
+ * @param core_if the pointer to core_if strucure.
+ */
+void dwc_otg_pcd_start_srp_timer(dwc_otg_core_if_t * core_if)
+{
+	core_if->srp_timer_started = 1;
+	DWC_TIMER_SCHEDULE(core_if->srp_timer, 6000 /* 6 secs */ );
+}
+
+void dwc_otg_initiate_srp(dwc_otg_core_if_t * core_if)
+{
+	uint32_t *addr = (uint32_t *) & (core_if->core_global_regs->gotgctl);
+	gotgctl_data_t mem;
+	gotgctl_data_t val;
+
+	val.d32 = DWC_READ_REG32(addr);
+	if (val.b.sesreq) {
+		DWC_ERROR("Session Request Already active!\n");
+		return;
+	}
+
+	DWC_INFO("Session Request Initated\n");	//NOTICE
+	mem.d32 = DWC_READ_REG32(addr);
+	mem.b.sesreq = 1;
+	DWC_WRITE_REG32(addr, mem.d32);
+
+	/* Start the SRP timer */
+	dwc_otg_pcd_start_srp_timer(core_if);
+	return;
+}
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_cil.h b/drivers/usb/host/dwc_otg/dwc_otg_cil.h
new file mode 100644
index 000000000000..79dbf8374f02
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_cil.h
@@ -0,0 +1,1464 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_cil.h $
+ * $Revision: #123 $
+ * $Date: 2012/08/10 $
+ * $Change: 2047372 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+#if !defined(__DWC_CIL_H__)
+#define __DWC_CIL_H__
+
+#include "dwc_list.h"
+#include "dwc_otg_dbg.h"
+#include "dwc_otg_regs.h"
+
+#include "dwc_otg_core_if.h"
+#include "dwc_otg_adp.h"
+
+/**
+ * @file
+ * This file contains the interface to the Core Interface Layer.
+ */
+
+#ifdef DWC_UTE_CFI
+
+#define MAX_DMA_DESCS_PER_EP	256
+
+/**
+ * Enumeration for the data buffer mode
+ */
+typedef enum _data_buffer_mode {
+	BM_STANDARD = 0,	/* data buffer is in normal mode */
+	BM_SG = 1,		/* data buffer uses the scatter/gather mode */
+	BM_CONCAT = 2,		/* data buffer uses the concatenation mode */
+	BM_CIRCULAR = 3,	/* data buffer uses the circular DMA mode */
+	BM_ALIGN = 4		/* data buffer is in buffer alignment mode */
+} data_buffer_mode_e;
+#endif //DWC_UTE_CFI
+
+/** Macros defined for DWC OTG HW Release version */
+
+#define OTG_CORE_REV_2_60a	0x4F54260A
+#define OTG_CORE_REV_2_71a	0x4F54271A
+#define OTG_CORE_REV_2_72a	0x4F54272A
+#define OTG_CORE_REV_2_80a	0x4F54280A
+#define OTG_CORE_REV_2_81a	0x4F54281A
+#define OTG_CORE_REV_2_90a	0x4F54290A
+#define OTG_CORE_REV_2_91a	0x4F54291A
+#define OTG_CORE_REV_2_92a	0x4F54292A
+#define OTG_CORE_REV_2_93a	0x4F54293A
+#define OTG_CORE_REV_2_94a	0x4F54294A
+#define OTG_CORE_REV_3_00a	0x4F54300A
+
+/**
+ * Information for each ISOC packet.
+ */
+typedef struct iso_pkt_info {
+	uint32_t offset;
+	uint32_t length;
+	int32_t status;
+} iso_pkt_info_t;
+
+/**
+ * The <code>dwc_ep</code> structure represents the state of a single
+ * endpoint when acting in device mode. It contains the data items
+ * needed for an endpoint to be activated and transfer packets.
+ */
+typedef struct dwc_ep {
+	/** EP number used for register address lookup */
+	uint8_t num;
+	/** EP direction 0 = OUT */
+	unsigned is_in:1;
+	/** EP active. */
+	unsigned active:1;
+
+	/**
+	 * Periodic Tx FIFO # for IN EPs For INTR EP set to 0 to use non-periodic
+	 * Tx FIFO. If dedicated Tx FIFOs are enabled Tx FIFO # FOR IN EPs*/
+	unsigned tx_fifo_num:4;
+	/** EP type: 0 - Control, 1 - ISOC,	 2 - BULK,	3 - INTR */
+	unsigned type:2;
+#define DWC_OTG_EP_TYPE_CONTROL	   0
+#define DWC_OTG_EP_TYPE_ISOC	   1
+#define DWC_OTG_EP_TYPE_BULK	   2
+#define DWC_OTG_EP_TYPE_INTR	   3
+
+	/** DATA start PID for INTR and BULK EP */
+	unsigned data_pid_start:1;
+	/** Frame (even/odd) for ISOC EP */
+	unsigned even_odd_frame:1;
+	/** Max Packet bytes */
+	unsigned maxpacket:11;
+
+	/** Max Transfer size */
+	uint32_t maxxfer;
+
+	/** @name Transfer state */
+	/** @{ */
+
+	/**
+	 * Pointer to the beginning of the transfer buffer -- do not modify
+	 * during transfer.
+	 */
+
+	dwc_dma_t dma_addr;
+
+	dwc_dma_t dma_desc_addr;
+	dwc_otg_dev_dma_desc_t *desc_addr;
+
+	uint8_t *start_xfer_buff;
+	/** pointer to the transfer buffer */
+	uint8_t *xfer_buff;
+	/** Number of bytes to transfer */
+	unsigned xfer_len:19;
+	/** Number of bytes transferred. */
+	unsigned xfer_count:19;
+	/** Sent ZLP */
+	unsigned sent_zlp:1;
+	/** Total len for control transfer */
+	unsigned total_len:19;
+
+	/** stall clear flag */
+	unsigned stall_clear_flag:1;
+
+	/** SETUP pkt cnt rollover flag for EP0 out*/
+	unsigned stp_rollover;
+
+#ifdef DWC_UTE_CFI
+	/* The buffer mode */
+	data_buffer_mode_e buff_mode;
+
+	/* The chain of DMA descriptors.
+	 * MAX_DMA_DESCS_PER_EP will be allocated for each active EP.
+	 */
+	dwc_otg_dma_desc_t *descs;
+
+	/* The DMA address of the descriptors chain start */
+	dma_addr_t descs_dma_addr;
+	/** This variable stores the length of the last enqueued request */
+	uint32_t cfi_req_len;
+#endif				//DWC_UTE_CFI
+
+/** Max DMA Descriptor count for any EP */
+#define MAX_DMA_DESC_CNT 256
+	/** Allocated DMA Desc count */
+	uint32_t desc_cnt;
+
+	/** bInterval */
+	uint32_t bInterval;
+	/** Next frame num to setup next ISOC transfer */
+	uint32_t frame_num;
+	/** Indicates SOF number overrun in DSTS */
+	uint8_t frm_overrun;
+
+#ifdef DWC_UTE_PER_IO
+	/** Next frame num for which will be setup DMA Desc */
+	uint32_t xiso_frame_num;
+	/** bInterval */
+	uint32_t xiso_bInterval;
+	/** Count of currently active transfers - shall be either 0 or 1 */
+	int xiso_active_xfers;
+	int xiso_queued_xfers;
+#endif
+#ifdef DWC_EN_ISOC
+	/**
+	 * Variables specific for ISOC EPs
+	 *
+	 */
+	/** DMA addresses of ISOC buffers */
+	dwc_dma_t dma_addr0;
+	dwc_dma_t dma_addr1;
+
+	dwc_dma_t iso_dma_desc_addr;
+	dwc_otg_dev_dma_desc_t *iso_desc_addr;
+
+	/** pointer to the transfer buffers */
+	uint8_t *xfer_buff0;
+	uint8_t *xfer_buff1;
+
+	/** number of ISOC Buffer is processing */
+	uint32_t proc_buf_num;
+	/** Interval of ISOC Buffer processing */
+	uint32_t buf_proc_intrvl;
+	/** Data size for regular frame */
+	uint32_t data_per_frame;
+
+	/* todo - pattern data support is to be implemented in the future */
+	/** Data size for pattern frame */
+	uint32_t data_pattern_frame;
+	/** Frame number of pattern data */
+	uint32_t sync_frame;
+
+	/** bInterval */
+	uint32_t bInterval;
+	/** ISO Packet number per frame */
+	uint32_t pkt_per_frm;
+	/** Next frame num for which will be setup DMA Desc */
+	uint32_t next_frame;
+	/** Number of packets per buffer processing */
+	uint32_t pkt_cnt;
+	/** Info for all isoc packets */
+	iso_pkt_info_t *pkt_info;
+	/** current pkt number */
+	uint32_t cur_pkt;
+	/** current pkt number */
+	uint8_t *cur_pkt_addr;
+	/** current pkt number */
+	uint32_t cur_pkt_dma_addr;
+#endif				/* DWC_EN_ISOC */
+
+/** @} */
+} dwc_ep_t;
+
+/*
+ * Reasons for halting a host channel.
+ */
+typedef enum dwc_otg_halt_status {
+	DWC_OTG_HC_XFER_NO_HALT_STATUS,
+	DWC_OTG_HC_XFER_COMPLETE,
+	DWC_OTG_HC_XFER_URB_COMPLETE,
+	DWC_OTG_HC_XFER_ACK,
+	DWC_OTG_HC_XFER_NAK,
+	DWC_OTG_HC_XFER_NYET,
+	DWC_OTG_HC_XFER_STALL,
+	DWC_OTG_HC_XFER_XACT_ERR,
+	DWC_OTG_HC_XFER_FRAME_OVERRUN,
+	DWC_OTG_HC_XFER_BABBLE_ERR,
+	DWC_OTG_HC_XFER_DATA_TOGGLE_ERR,
+	DWC_OTG_HC_XFER_AHB_ERR,
+	DWC_OTG_HC_XFER_PERIODIC_INCOMPLETE,
+	DWC_OTG_HC_XFER_URB_DEQUEUE
+} dwc_otg_halt_status_e;
+
+/**
+ * Host channel descriptor. This structure represents the state of a single
+ * host channel when acting in host mode. It contains the data items needed to
+ * transfer packets to an endpoint via a host channel.
+ */
+typedef struct dwc_hc {
+	/** Host channel number used for register address lookup */
+	uint8_t hc_num;
+
+	/** Device to access */
+	unsigned dev_addr:7;
+
+	/** EP to access */
+	unsigned ep_num:4;
+
+	/** EP direction. 0: OUT, 1: IN */
+	unsigned ep_is_in:1;
+
+	/**
+	 * EP speed.
+	 * One of the following values:
+	 *	- DWC_OTG_EP_SPEED_LOW
+	 *	- DWC_OTG_EP_SPEED_FULL
+	 *	- DWC_OTG_EP_SPEED_HIGH
+	 */
+	unsigned speed:2;
+#define DWC_OTG_EP_SPEED_LOW	0
+#define DWC_OTG_EP_SPEED_FULL	1
+#define DWC_OTG_EP_SPEED_HIGH	2
+
+	/**
+	 * Endpoint type.
+	 * One of the following values:
+	 *	- DWC_OTG_EP_TYPE_CONTROL: 0
+	 *	- DWC_OTG_EP_TYPE_ISOC: 1
+	 *	- DWC_OTG_EP_TYPE_BULK: 2
+	 *	- DWC_OTG_EP_TYPE_INTR: 3
+	 */
+	unsigned ep_type:2;
+
+	/** Max packet size in bytes */
+	unsigned max_packet:11;
+
+	/**
+	 * PID for initial transaction.
+	 * 0: DATA0,<br>
+	 * 1: DATA2,<br>
+	 * 2: DATA1,<br>
+	 * 3: MDATA (non-Control EP),
+	 *	  SETUP (Control EP)
+	 */
+	unsigned data_pid_start:2;
+#define DWC_OTG_HC_PID_DATA0 0
+#define DWC_OTG_HC_PID_DATA2 1
+#define DWC_OTG_HC_PID_DATA1 2
+#define DWC_OTG_HC_PID_MDATA 3
+#define DWC_OTG_HC_PID_SETUP 3
+
+	/** Number of periodic transactions per (micro)frame */
+	unsigned multi_count:2;
+
+	/** @name Transfer State */
+	/** @{ */
+
+	/** Pointer to the current transfer buffer position. */
+	uint8_t *xfer_buff;
+	/**
+	 * In Buffer DMA mode this buffer will be used
+	 * if xfer_buff is not DWORD aligned.
+	 */
+	dwc_dma_t align_buff;
+	/** Total number of bytes to transfer. */
+	uint32_t xfer_len;
+	/** Number of bytes transferred so far. */
+	uint32_t xfer_count;
+	/** Packet count at start of transfer.*/
+	uint16_t start_pkt_count;
+
+	/**
+	 * Flag to indicate whether the transfer has been started. Set to 1 if
+	 * it has been started, 0 otherwise.
+	 */
+	uint8_t xfer_started;
+
+	/**
+	 * Set to 1 to indicate that a PING request should be issued on this
+	 * channel. If 0, process normally.
+	 */
+	uint8_t do_ping;
+
+	/**
+	 * Set to 1 to indicate that the error count for this transaction is
+	 * non-zero. Set to 0 if the error count is 0.
+	 */
+	uint8_t error_state;
+
+	/**
+	 * Set to 1 to indicate that this channel should be halted the next
+	 * time a request is queued for the channel. This is necessary in
+	 * slave mode if no request queue space is available when an attempt
+	 * is made to halt the channel.
+	 */
+	uint8_t halt_on_queue;
+
+	/**
+	 * Set to 1 if the host channel has been halted, but the core is not
+	 * finished flushing queued requests. Otherwise 0.
+	 */
+	uint8_t halt_pending;
+
+	/**
+	 * Reason for halting the host channel.
+	 */
+	dwc_otg_halt_status_e halt_status;
+
+	/*
+	 * Split settings for the host channel
+	 */
+	uint8_t do_split;		   /**< Enable split for the channel */
+	uint8_t complete_split;	   /**< Enable complete split */
+	uint8_t hub_addr;		   /**< Address of high speed hub */
+
+	uint8_t port_addr;		   /**< Port of the low/full speed device */
+	/** Split transaction position
+	 * One of the following values:
+	 *	  - DWC_HCSPLIT_XACTPOS_MID
+	 *	  - DWC_HCSPLIT_XACTPOS_BEGIN
+	 *	  - DWC_HCSPLIT_XACTPOS_END
+	 *	  - DWC_HCSPLIT_XACTPOS_ALL */
+	uint8_t xact_pos;
+
+	/** Set when the host channel does a short read. */
+	uint8_t short_read;
+
+	/**
+	 * Number of requests issued for this channel since it was assigned to
+	 * the current transfer (not counting PINGs).
+	 */
+	uint8_t requests;
+
+	/**
+	 * Queue Head for the transfer being processed by this channel.
+	 */
+	struct dwc_otg_qh *qh;
+
+	/** @} */
+
+	/** Entry in list of host channels. */
+	 DWC_CIRCLEQ_ENTRY(dwc_hc) hc_list_entry;
+
+	/** @name Descriptor DMA support */
+	/** @{ */
+
+	/** Number of Transfer Descriptors */
+	uint16_t ntd;
+
+	/** Descriptor List DMA address */
+	dwc_dma_t desc_list_addr;
+
+	/** Scheduling micro-frame bitmap. */
+	uint8_t schinfo;
+
+	/** @} */
+} dwc_hc_t;
+
+/**
+ * The following parameters may be specified when starting the module. These
+ * parameters define how the DWC_otg controller should be configured.
+ */
+typedef struct dwc_otg_core_params {
+	int32_t opt;
+
+	/**
+	 * Specifies the OTG capabilities. The driver will automatically
+	 * detect the value for this parameter if none is specified.
+	 * 0 - HNP and SRP capable (default)
+	 * 1 - SRP Only capable
+	 * 2 - No HNP/SRP capable
+	 */
+	int32_t otg_cap;
+
+	/**
+	 * Specifies whether to use slave or DMA mode for accessing the data
+	 * FIFOs. The driver will automatically detect the value for this
+	 * parameter if none is specified.
+	 * 0 - Slave
+	 * 1 - DMA (default, if available)
+	 */
+	int32_t dma_enable;
+
+	/**
+	 * When DMA mode is enabled specifies whether to use address DMA or DMA
+	 * Descriptor mode for accessing the data FIFOs in device mode. The driver
+	 * will automatically detect the value for this if none is specified.
+	 * 0 - address DMA
+	 * 1 - DMA Descriptor(default, if available)
+	 */
+	int32_t dma_desc_enable;
+	/** The DMA Burst size (applicable only for External DMA
+	 * Mode). 1, 4, 8 16, 32, 64, 128, 256 (default 32)
+	 */
+	int32_t dma_burst_size;	/* Translate this to GAHBCFG values */
+
+	/**
+	 * Specifies the maximum speed of operation in host and device mode.
+	 * The actual speed depends on the speed of the attached device and
+	 * the value of phy_type. The actual speed depends on the speed of the
+	 * attached device.
+	 * 0 - High Speed (default)
+	 * 1 - Full Speed
+	 */
+	int32_t speed;
+	/** Specifies whether low power mode is supported when attached
+	 *	to a Full Speed or Low Speed device in host mode.
+	 * 0 - Don't support low power mode (default)
+	 * 1 - Support low power mode
+	 */
+	int32_t host_support_fs_ls_low_power;
+
+	/** Specifies the PHY clock rate in low power mode when connected to a
+	 * Low Speed device in host mode. This parameter is applicable only if
+	 * HOST_SUPPORT_FS_LS_LOW_POWER is enabled. If PHY_TYPE is set to FS
+	 * then defaults to 6 MHZ otherwise 48 MHZ.
+	 *
+	 * 0 - 48 MHz
+	 * 1 - 6 MHz
+	 */
+	int32_t host_ls_low_power_phy_clk;
+
+	/**
+	 * 0 - Use cC FIFO size parameters
+	 * 1 - Allow dynamic FIFO sizing (default)
+	 */
+	int32_t enable_dynamic_fifo;
+
+	/** Total number of 4-byte words in the data FIFO memory. This
+	 * memory includes the Rx FIFO, non-periodic Tx FIFO, and periodic
+	 * Tx FIFOs.
+	 * 32 to 32768 (default 8192)
+	 * Note: The total FIFO memory depth in the FPGA configuration is 8192.
+	 */
+	int32_t data_fifo_size;
+
+	/** Number of 4-byte words in the Rx FIFO in device mode when dynamic
+	 * FIFO sizing is enabled.
+	 * 16 to 32768 (default 1064)
+	 */
+	int32_t dev_rx_fifo_size;
+
+	/** Number of 4-byte words in the non-periodic Tx FIFO in device mode
+	 * when dynamic FIFO sizing is enabled.
+	 * 16 to 32768 (default 1024)
+	 */
+	int32_t dev_nperio_tx_fifo_size;
+
+	/** Number of 4-byte words in each of the periodic Tx FIFOs in device
+	 * mode when dynamic FIFO sizing is enabled.
+	 * 4 to 768 (default 256)
+	 */
+	uint32_t dev_perio_tx_fifo_size[MAX_PERIO_FIFOS];
+
+	/** Number of 4-byte words in the Rx FIFO in host mode when dynamic
+	 * FIFO sizing is enabled.
+	 * 16 to 32768 (default 1024)
+	 */
+	int32_t host_rx_fifo_size;
+
+	/** Number of 4-byte words in the non-periodic Tx FIFO in host mode
+	 * when Dynamic FIFO sizing is enabled in the core.
+	 * 16 to 32768 (default 1024)
+	 */
+	int32_t host_nperio_tx_fifo_size;
+
+	/** Number of 4-byte words in the host periodic Tx FIFO when dynamic
+	 * FIFO sizing is enabled.
+	 * 16 to 32768 (default 1024)
+	 */
+	int32_t host_perio_tx_fifo_size;
+
+	/** The maximum transfer size supported in bytes.
+	 * 2047 to 65,535  (default 65,535)
+	 */
+	int32_t max_transfer_size;
+
+	/** The maximum number of packets in a transfer.
+	 * 15 to 511  (default 511)
+	 */
+	int32_t max_packet_count;
+
+	/** The number of host channel registers to use.
+	 * 1 to 16 (default 12)
+	 * Note: The FPGA configuration supports a maximum of 12 host channels.
+	 */
+	int32_t host_channels;
+
+	/** The number of endpoints in addition to EP0 available for device
+	 * mode operations.
+	 * 1 to 15 (default 6 IN and OUT)
+	 * Note: The FPGA configuration supports a maximum of 6 IN and OUT
+	 * endpoints in addition to EP0.
+	 */
+	int32_t dev_endpoints;
+
+		/**
+		 * Specifies the type of PHY interface to use. By default, the driver
+		 * will automatically detect the phy_type.
+		 *
+		 * 0 - Full Speed PHY
+		 * 1 - UTMI+ (default)
+		 * 2 - ULPI
+		 */
+	int32_t phy_type;
+
+	/**
+	 * Specifies the UTMI+ Data Width. This parameter is
+	 * applicable for a PHY_TYPE of UTMI+ or ULPI. (For a ULPI
+	 * PHY_TYPE, this parameter indicates the data width between
+	 * the MAC and the ULPI Wrapper.) Also, this parameter is
+	 * applicable only if the OTG_HSPHY_WIDTH cC parameter was set
+	 * to "8 and 16 bits", meaning that the core has been
+	 * configured to work at either data path width.
+	 *
+	 * 8 or 16 bits (default 16)
+	 */
+	int32_t phy_utmi_width;
+
+	/**
+	 * Specifies whether the ULPI operates at double or single
+	 * data rate. This parameter is only applicable if PHY_TYPE is
+	 * ULPI.
+	 *
+	 * 0 - single data rate ULPI interface with 8 bit wide data
+	 * bus (default)
+	 * 1 - double data rate ULPI interface with 4 bit wide data
+	 * bus
+	 */
+	int32_t phy_ulpi_ddr;
+
+	/**
+	 * Specifies whether to use the internal or external supply to
+	 * drive the vbus with a ULPI phy.
+	 */
+	int32_t phy_ulpi_ext_vbus;
+
+	/**
+	 * Specifies whether to use the I2Cinterface for full speed PHY. This
+	 * parameter is only applicable if PHY_TYPE is FS.
+	 * 0 - No (default)
+	 * 1 - Yes
+	 */
+	int32_t i2c_enable;
+
+	int32_t ulpi_fs_ls;
+
+	int32_t ts_dline;
+
+	/**
+	 * Specifies whether dedicated transmit FIFOs are
+	 * enabled for non periodic IN endpoints in device mode
+	 * 0 - No
+	 * 1 - Yes
+	 */
+	int32_t en_multiple_tx_fifo;
+
+	/** Number of 4-byte words in each of the Tx FIFOs in device
+	 * mode when dynamic FIFO sizing is enabled.
+	 * 4 to 768 (default 256)
+	 */
+	uint32_t dev_tx_fifo_size[MAX_TX_FIFOS];
+
+	/** Thresholding enable flag-
+	 * bit 0 - enable non-ISO Tx thresholding
+	 * bit 1 - enable ISO Tx thresholding
+	 * bit 2 - enable Rx thresholding
+	 */
+	uint32_t thr_ctl;
+
+	/** Thresholding length for Tx
+	 *	FIFOs in 32 bit DWORDs
+	 */
+	uint32_t tx_thr_length;
+
+	/** Thresholding length for Rx
+	 *	FIFOs in 32 bit DWORDs
+	 */
+	uint32_t rx_thr_length;
+
+	/**
+	 * Specifies whether LPM (Link Power Management) support is enabled
+	 */
+	int32_t lpm_enable;
+
+	/** Per Transfer Interrupt
+	 *	mode enable flag
+	 * 1 - Enabled
+	 * 0 - Disabled
+	 */
+	int32_t pti_enable;
+
+	/** Multi Processor Interrupt
+	 *	mode enable flag
+	 * 1 - Enabled
+	 * 0 - Disabled
+	 */
+	int32_t mpi_enable;
+
+	/** IS_USB Capability
+	 * 1 - Enabled
+	 * 0 - Disabled
+	 */
+	int32_t ic_usb_cap;
+
+	/** AHB Threshold Ratio
+	 * 2'b00 AHB Threshold = 	MAC Threshold
+	 * 2'b01 AHB Threshold = 1/2 	MAC Threshold
+	 * 2'b10 AHB Threshold = 1/4	MAC Threshold
+	 * 2'b11 AHB Threshold = 1/8	MAC Threshold
+	 */
+	int32_t ahb_thr_ratio;
+
+	/** ADP Support
+	 * 1 - Enabled
+	 * 0 - Disabled
+	 */
+	int32_t adp_supp_enable;
+
+	/** HFIR Reload Control
+	 * 0 - The HFIR cannot be reloaded dynamically.
+	 * 1 - Allow dynamic reloading of the HFIR register during runtime.
+	 */
+	int32_t reload_ctl;
+
+	/** DCFG: Enable device Out NAK
+	 * 0 - The core does not set NAK after Bulk Out transfer complete.
+	 * 1 - The core sets NAK after Bulk OUT transfer complete.
+	 */
+	int32_t dev_out_nak;
+
+	/** DCFG: Enable Continue on BNA
+	 * After receiving BNA interrupt the core disables the endpoint,when the
+	 * endpoint is re-enabled by the application the core starts processing
+	 * 0 - from the DOEPDMA descriptor
+	 * 1 - from the descriptor which received the BNA.
+	 */
+	int32_t cont_on_bna;
+
+	/** GAHBCFG: AHB Single Support
+	 * This bit when programmed supports SINGLE transfers for remainder
+	 * data in a transfer for DMA mode of operation.
+	 * 0 - in this case the remainder data will be sent using INCR burst size.
+	 * 1 - in this case the remainder data will be sent using SINGLE burst size.
+	 */
+	int32_t ahb_single;
+
+	/** Core Power down mode
+	 * 0 - No Power Down is enabled
+	 * 1 - Reserved
+	 * 2 - Complete Power Down (Hibernation)
+	 */
+	int32_t power_down;
+
+	/** OTG revision supported
+	 * 0 - OTG 1.3 revision
+	 * 1 - OTG 2.0 revision
+	 */
+	int32_t otg_ver;
+
+} dwc_otg_core_params_t;
+
+#ifdef DEBUG
+struct dwc_otg_core_if;
+typedef struct hc_xfer_info {
+	struct dwc_otg_core_if *core_if;
+	dwc_hc_t *hc;
+} hc_xfer_info_t;
+#endif
+
+typedef struct ep_xfer_info {
+	struct dwc_otg_core_if *core_if;
+	dwc_ep_t *ep;
+	uint8_t state;
+} ep_xfer_info_t;
+/*
+ * Device States
+ */
+typedef enum dwc_otg_lx_state {
+	/** On state */
+	DWC_OTG_L0,
+	/** LPM sleep state*/
+	DWC_OTG_L1,
+	/** USB suspend state*/
+	DWC_OTG_L2,
+	/** Off state*/
+	DWC_OTG_L3
+} dwc_otg_lx_state_e;
+
+struct dwc_otg_global_regs_backup {
+	uint32_t gotgctl_local;
+	uint32_t gintmsk_local;
+	uint32_t gahbcfg_local;
+	uint32_t gusbcfg_local;
+	uint32_t grxfsiz_local;
+	uint32_t gnptxfsiz_local;
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	uint32_t glpmcfg_local;
+#endif
+	uint32_t gi2cctl_local;
+	uint32_t hptxfsiz_local;
+	uint32_t pcgcctl_local;
+	uint32_t gdfifocfg_local;
+	uint32_t dtxfsiz_local[MAX_EPS_CHANNELS];
+	uint32_t gpwrdn_local;
+	uint32_t xhib_pcgcctl;
+	uint32_t xhib_gpwrdn;
+};
+
+struct dwc_otg_host_regs_backup {
+	uint32_t hcfg_local;
+	uint32_t haintmsk_local;
+	uint32_t hcintmsk_local[MAX_EPS_CHANNELS];
+	uint32_t hprt0_local;
+	uint32_t hfir_local;
+};
+
+struct dwc_otg_dev_regs_backup {
+	uint32_t dcfg;
+	uint32_t dctl;
+	uint32_t daintmsk;
+	uint32_t diepmsk;
+	uint32_t doepmsk;
+	uint32_t diepctl[MAX_EPS_CHANNELS];
+	uint32_t dieptsiz[MAX_EPS_CHANNELS];
+	uint32_t diepdma[MAX_EPS_CHANNELS];
+};
+/**
+ * The <code>dwc_otg_core_if</code> structure contains information needed to manage
+ * the DWC_otg controller acting in either host or device mode. It
+ * represents the programming view of the controller as a whole.
+ */
+struct dwc_otg_core_if {
+	/** Parameters that define how the core should be configured.*/
+	dwc_otg_core_params_t *core_params;
+
+	/** Core Global registers starting at offset 000h. */
+	dwc_otg_core_global_regs_t *core_global_regs;
+
+	/** Device-specific information */
+	dwc_otg_dev_if_t *dev_if;
+	/** Host-specific information */
+	dwc_otg_host_if_t *host_if;
+
+	/** Value from SNPSID register */
+	uint32_t snpsid;
+
+	/*
+	 * Set to 1 if the core PHY interface bits in USBCFG have been
+	 * initialized.
+	 */
+	uint8_t phy_init_done;
+
+	/*
+	 * SRP Success flag, set by srp success interrupt in FS I2C mode
+	 */
+	uint8_t srp_success;
+	uint8_t srp_timer_started;
+	/** Timer for SRP. If it expires before SRP is successful
+	 * clear the SRP. */
+	dwc_timer_t *srp_timer;
+
+#ifdef DWC_DEV_SRPCAP
+	/* This timer is needed to power on the hibernated host core if SRP is not
+	 * initiated on connected SRP capable device for limited period of time
+	 */
+	uint8_t pwron_timer_started;
+	dwc_timer_t *pwron_timer;
+#endif
+	/* Common configuration information */
+	/** Power and Clock Gating Control Register */
+	volatile uint32_t *pcgcctl;
+#define DWC_OTG_PCGCCTL_OFFSET 0xE00
+
+	/** Push/pop addresses for endpoints or host channels.*/
+	uint32_t *data_fifo[MAX_EPS_CHANNELS];
+#define DWC_OTG_DATA_FIFO_OFFSET 0x1000
+#define DWC_OTG_DATA_FIFO_SIZE 0x1000
+
+	/** Total RAM for FIFOs (Bytes) */
+	uint16_t total_fifo_size;
+	/** Size of Rx FIFO (Bytes) */
+	uint16_t rx_fifo_size;
+	/** Size of Non-periodic Tx FIFO (Bytes) */
+	uint16_t nperio_tx_fifo_size;
+
+	/** 1 if DMA is enabled, 0 otherwise. */
+	uint8_t dma_enable;
+
+	/** 1 if DMA descriptor is enabled, 0 otherwise. */
+	uint8_t dma_desc_enable;
+
+	/** 1 if PTI Enhancement mode is enabled, 0 otherwise. */
+	uint8_t pti_enh_enable;
+
+	/** 1 if MPI Enhancement mode is enabled, 0 otherwise. */
+	uint8_t multiproc_int_enable;
+
+	/** 1 if dedicated Tx FIFOs are enabled, 0 otherwise. */
+	uint8_t en_multiple_tx_fifo;
+
+	/** Set to 1 if multiple packets of a high-bandwidth transfer is in
+	 * process of being queued */
+	uint8_t queuing_high_bandwidth;
+
+	/** Hardware Configuration -- stored here for convenience.*/
+	hwcfg1_data_t hwcfg1;
+	hwcfg2_data_t hwcfg2;
+	hwcfg3_data_t hwcfg3;
+	hwcfg4_data_t hwcfg4;
+	fifosize_data_t hptxfsiz;
+
+	/** Host and Device Configuration -- stored here for convenience.*/
+	hcfg_data_t hcfg;
+	dcfg_data_t dcfg;
+
+	/** The operational State, during transations
+	 * (a_host>>a_peripherial and b_device=>b_host) this may not
+	 * match the core but allows the software to determine
+	 * transitions.
+	 */
+	uint8_t op_state;
+
+	/**
+	 * Set to 1 if the HCD needs to be restarted on a session request
+	 * interrupt. This is required if no connector ID status change has
+	 * occurred since the HCD was last disconnected.
+	 */
+	uint8_t restart_hcd_on_session_req;
+
+	/** HCD callbacks */
+	/** A-Device is a_host */
+#define A_HOST		(1)
+	/** A-Device is a_suspend */
+#define A_SUSPEND	(2)
+	/** A-Device is a_peripherial */
+#define A_PERIPHERAL	(3)
+	/** B-Device is operating as a Peripheral. */
+#define B_PERIPHERAL	(4)
+	/** B-Device is operating as a Host. */
+#define B_HOST		(5)
+
+	/** HCD callbacks */
+	struct dwc_otg_cil_callbacks *hcd_cb;
+	/** PCD callbacks */
+	struct dwc_otg_cil_callbacks *pcd_cb;
+
+	/** Device mode Periodic Tx FIFO Mask */
+	uint32_t p_tx_msk;
+	/** Device mode Periodic Tx FIFO Mask */
+	uint32_t tx_msk;
+
+	/** Workqueue object used for handling several interrupts */
+	dwc_workq_t *wq_otg;
+
+	/** Timer object used for handling "Wakeup Detected" Interrupt */
+	dwc_timer_t *wkp_timer;
+	/** This arrays used for debug purposes for DEV OUT NAK enhancement */
+	uint32_t start_doeptsiz_val[MAX_EPS_CHANNELS];
+	ep_xfer_info_t ep_xfer_info[MAX_EPS_CHANNELS];
+	dwc_timer_t *ep_xfer_timer[MAX_EPS_CHANNELS];
+#ifdef DEBUG
+	uint32_t start_hcchar_val[MAX_EPS_CHANNELS];
+
+	hc_xfer_info_t hc_xfer_info[MAX_EPS_CHANNELS];
+	dwc_timer_t *hc_xfer_timer[MAX_EPS_CHANNELS];
+
+	uint32_t hfnum_7_samples;
+	uint64_t hfnum_7_frrem_accum;
+	uint32_t hfnum_0_samples;
+	uint64_t hfnum_0_frrem_accum;
+	uint32_t hfnum_other_samples;
+	uint64_t hfnum_other_frrem_accum;
+#endif
+
+#ifdef DWC_UTE_CFI
+	uint16_t pwron_rxfsiz;
+	uint16_t pwron_gnptxfsiz;
+	uint16_t pwron_txfsiz[15];
+
+	uint16_t init_rxfsiz;
+	uint16_t init_gnptxfsiz;
+	uint16_t init_txfsiz[15];
+#endif
+
+	/** Lx state of device */
+	dwc_otg_lx_state_e lx_state;
+
+	/** Saved Core Global registers */
+	struct dwc_otg_global_regs_backup *gr_backup;
+	/** Saved Host registers */
+	struct dwc_otg_host_regs_backup *hr_backup;
+	/** Saved Device registers */
+	struct dwc_otg_dev_regs_backup *dr_backup;
+
+	/** Power Down Enable */
+	uint32_t power_down;
+
+	/** ADP support Enable */
+	uint32_t adp_enable;
+
+	/** ADP structure object */
+	dwc_otg_adp_t adp;
+
+	/** hibernation/suspend flag */
+	int hibernation_suspend;
+
+	/** Device mode extended hibernation flag */
+	int xhib;
+
+	/** OTG revision supported */
+	uint32_t otg_ver;
+
+	/** OTG status flag used for HNP polling */
+	uint8_t otg_sts;
+
+	/** Pointer to either hcd->lock or pcd->lock */
+	dwc_spinlock_t *lock;
+
+	/** Start predict NextEP based on Learning Queue if equal 1,
+	 * also used as counter of disabled NP IN EP's */
+	uint8_t start_predict;
+
+	/** NextEp sequence, including EP0: nextep_seq[] = EP if non-periodic and
+	 * active, 0xff otherwise */
+	uint8_t nextep_seq[MAX_EPS_CHANNELS];
+
+	/** Index of fisrt EP in nextep_seq array which should be re-enabled **/
+	uint8_t first_in_nextep_seq;
+
+	/** Frame number while entering to ISR - needed for ISOCs **/
+	uint32_t frame_num;
+
+};
+
+#ifdef DEBUG
+/*
+ * This function is called when transfer is timed out.
+ */
+extern void hc_xfer_timeout(void *ptr);
+#endif
+
+/*
+ * This function is called when transfer is timed out on endpoint.
+ */
+extern void ep_xfer_timeout(void *ptr);
+
+/*
+ * The following functions are functions for works
+ * using during handling some interrupts
+ */
+extern void w_conn_id_status_change(void *p);
+
+extern void w_wakeup_detected(void *p);
+
+/** Saves global register values into system memory. */
+extern int dwc_otg_save_global_regs(dwc_otg_core_if_t * core_if);
+/** Saves device register values into system memory. */
+extern int dwc_otg_save_dev_regs(dwc_otg_core_if_t * core_if);
+/** Saves host register values into system memory. */
+extern int dwc_otg_save_host_regs(dwc_otg_core_if_t * core_if);
+/** Restore global register values. */
+extern int dwc_otg_restore_global_regs(dwc_otg_core_if_t * core_if);
+/** Restore host register values. */
+extern int dwc_otg_restore_host_regs(dwc_otg_core_if_t * core_if, int reset);
+/** Restore device register values. */
+extern int dwc_otg_restore_dev_regs(dwc_otg_core_if_t * core_if,
+				    int rem_wakeup);
+extern int restore_lpm_i2c_regs(dwc_otg_core_if_t * core_if);
+extern int restore_essential_regs(dwc_otg_core_if_t * core_if, int rmode,
+				  int is_host);
+
+extern int dwc_otg_host_hibernation_restore(dwc_otg_core_if_t * core_if,
+					    int restore_mode, int reset);
+extern int dwc_otg_device_hibernation_restore(dwc_otg_core_if_t * core_if,
+					      int rem_wakeup, int reset);
+
+/*
+ * The following functions support initialization of the CIL driver component
+ * and the DWC_otg controller.
+ */
+extern void dwc_otg_core_host_init(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_core_dev_init(dwc_otg_core_if_t * _core_if);
+
+/** @name Device CIL Functions
+ * The following functions support managing the DWC_otg controller in device
+ * mode.
+ */
+/**@{*/
+extern void dwc_otg_wakeup(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_read_setup_packet(dwc_otg_core_if_t * _core_if,
+				      uint32_t * _dest);
+extern uint32_t dwc_otg_get_frame_number(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_ep0_activate(dwc_otg_core_if_t * _core_if, dwc_ep_t * _ep);
+extern void dwc_otg_ep_activate(dwc_otg_core_if_t * _core_if, dwc_ep_t * _ep);
+extern void dwc_otg_ep_deactivate(dwc_otg_core_if_t * _core_if, dwc_ep_t * _ep);
+extern void dwc_otg_ep_start_transfer(dwc_otg_core_if_t * _core_if,
+				      dwc_ep_t * _ep);
+extern void dwc_otg_ep_start_zl_transfer(dwc_otg_core_if_t * _core_if,
+					 dwc_ep_t * _ep);
+extern void dwc_otg_ep0_start_transfer(dwc_otg_core_if_t * _core_if,
+				       dwc_ep_t * _ep);
+extern void dwc_otg_ep0_continue_transfer(dwc_otg_core_if_t * _core_if,
+					  dwc_ep_t * _ep);
+extern void dwc_otg_ep_write_packet(dwc_otg_core_if_t * _core_if,
+				    dwc_ep_t * _ep, int _dma);
+extern void dwc_otg_ep_set_stall(dwc_otg_core_if_t * _core_if, dwc_ep_t * _ep);
+extern void dwc_otg_ep_clear_stall(dwc_otg_core_if_t * _core_if,
+				   dwc_ep_t * _ep);
+extern void dwc_otg_enable_device_interrupts(dwc_otg_core_if_t * _core_if);
+
+#ifdef DWC_EN_ISOC
+extern void dwc_otg_iso_ep_start_frm_transfer(dwc_otg_core_if_t * core_if,
+					      dwc_ep_t * ep);
+extern void dwc_otg_iso_ep_start_buf_transfer(dwc_otg_core_if_t * core_if,
+					      dwc_ep_t * ep);
+#endif /* DWC_EN_ISOC */
+/**@}*/
+
+/** @name Host CIL Functions
+ * The following functions support managing the DWC_otg controller in host
+ * mode.
+ */
+/**@{*/
+extern void dwc_otg_hc_init(dwc_otg_core_if_t * _core_if, dwc_hc_t * _hc);
+extern void dwc_otg_hc_halt(dwc_otg_core_if_t * _core_if,
+			    dwc_hc_t * _hc, dwc_otg_halt_status_e _halt_status);
+extern void dwc_otg_hc_cleanup(dwc_otg_core_if_t * _core_if, dwc_hc_t * _hc);
+extern void dwc_otg_hc_start_transfer(dwc_otg_core_if_t * _core_if,
+				      dwc_hc_t * _hc);
+extern int dwc_otg_hc_continue_transfer(dwc_otg_core_if_t * _core_if,
+					dwc_hc_t * _hc);
+extern void dwc_otg_hc_do_ping(dwc_otg_core_if_t * _core_if, dwc_hc_t * _hc);
+extern void dwc_otg_hc_write_packet(dwc_otg_core_if_t * _core_if,
+				    dwc_hc_t * _hc);
+extern void dwc_otg_enable_host_interrupts(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_disable_host_interrupts(dwc_otg_core_if_t * _core_if);
+
+extern void dwc_otg_hc_start_transfer_ddma(dwc_otg_core_if_t * core_if,
+					   dwc_hc_t * hc);
+
+extern uint32_t calc_frame_interval(dwc_otg_core_if_t * core_if);
+
+/* Macro used to clear one channel interrupt */
+#define clear_hc_int(_hc_regs_, _intr_) \
+do { \
+	hcint_data_t hcint_clear = {.d32 = 0}; \
+	hcint_clear.b._intr_ = 1; \
+	DWC_WRITE_REG32(&(_hc_regs_)->hcint, hcint_clear.d32); \
+} while (0)
+
+/*
+ * Macro used to disable one channel interrupt. Channel interrupts are
+ * disabled when the channel is halted or released by the interrupt handler.
+ * There is no need to handle further interrupts of that type until the
+ * channel is re-assigned. In fact, subsequent handling may cause crashes
+ * because the channel structures are cleaned up when the channel is released.
+ */
+#define disable_hc_int(_hc_regs_, _intr_) \
+do { \
+	hcintmsk_data_t hcintmsk = {.d32 = 0}; \
+	hcintmsk.b._intr_ = 1; \
+	DWC_MODIFY_REG32(&(_hc_regs_)->hcintmsk, hcintmsk.d32, 0); \
+} while (0)
+
+/**
+ * This function Reads HPRT0 in preparation to modify. It keeps the
+ * WC bits 0 so that if they are read as 1, they won't clear when you
+ * write it back
+ */
+static inline uint32_t dwc_otg_read_hprt0(dwc_otg_core_if_t * _core_if)
+{
+	hprt0_data_t hprt0;
+	hprt0.d32 = DWC_READ_REG32(_core_if->host_if->hprt0);
+	hprt0.b.prtena = 0;
+	hprt0.b.prtconndet = 0;
+	hprt0.b.prtenchng = 0;
+	hprt0.b.prtovrcurrchng = 0;
+	return hprt0.d32;
+}
+
+/**@}*/
+
+/** @name Common CIL Functions
+ * The following functions support managing the DWC_otg controller in either
+ * device or host mode.
+ */
+/**@{*/
+
+extern void dwc_otg_read_packet(dwc_otg_core_if_t * core_if,
+				uint8_t * dest, uint16_t bytes);
+
+extern void dwc_otg_flush_tx_fifo(dwc_otg_core_if_t * _core_if, const int _num);
+extern void dwc_otg_flush_rx_fifo(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_core_reset(dwc_otg_core_if_t * _core_if);
+
+/**
+ * This function returns the Core Interrupt register.
+ */
+static inline uint32_t dwc_otg_read_core_intr(dwc_otg_core_if_t * core_if)
+{
+	return (DWC_READ_REG32(&core_if->core_global_regs->gintsts) &
+		DWC_READ_REG32(&core_if->core_global_regs->gintmsk));
+}
+
+/**
+ * This function returns the OTG Interrupt register.
+ */
+static inline uint32_t dwc_otg_read_otg_intr(dwc_otg_core_if_t * core_if)
+{
+	return (DWC_READ_REG32(&core_if->core_global_regs->gotgint));
+}
+
+/**
+ * This function reads the Device All Endpoints Interrupt register and
+ * returns the IN endpoint interrupt bits.
+ */
+static inline uint32_t dwc_otg_read_dev_all_in_ep_intr(dwc_otg_core_if_t *
+						       core_if)
+{
+
+	uint32_t v;
+
+	if (core_if->multiproc_int_enable) {
+		v = DWC_READ_REG32(&core_if->dev_if->
+				   dev_global_regs->deachint) &
+		    DWC_READ_REG32(&core_if->
+				   dev_if->dev_global_regs->deachintmsk);
+	} else {
+		v = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daint) &
+		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daintmsk);
+	}
+	return (v & 0xffff);
+}
+
+/**
+ * This function reads the Device All Endpoints Interrupt register and
+ * returns the OUT endpoint interrupt bits.
+ */
+static inline uint32_t dwc_otg_read_dev_all_out_ep_intr(dwc_otg_core_if_t *
+							core_if)
+{
+	uint32_t v;
+
+	if (core_if->multiproc_int_enable) {
+		v = DWC_READ_REG32(&core_if->dev_if->
+				   dev_global_regs->deachint) &
+		    DWC_READ_REG32(&core_if->
+				   dev_if->dev_global_regs->deachintmsk);
+	} else {
+		v = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daint) &
+		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->daintmsk);
+	}
+
+	return ((v & 0xffff0000) >> 16);
+}
+
+/**
+ * This function returns the Device IN EP Interrupt register
+ */
+static inline uint32_t dwc_otg_read_dev_in_ep_intr(dwc_otg_core_if_t * core_if,
+						   dwc_ep_t * ep)
+{
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	uint32_t v, msk, emp;
+
+	if (core_if->multiproc_int_enable) {
+		msk =
+		    DWC_READ_REG32(&dev_if->
+				   dev_global_regs->diepeachintmsk[ep->num]);
+		emp =
+		    DWC_READ_REG32(&dev_if->
+				   dev_global_regs->dtknqr4_fifoemptymsk);
+		msk |= ((emp >> ep->num) & 0x1) << 7;
+		v = DWC_READ_REG32(&dev_if->in_ep_regs[ep->num]->diepint) & msk;
+	} else {
+		msk = DWC_READ_REG32(&dev_if->dev_global_regs->diepmsk);
+		emp =
+		    DWC_READ_REG32(&dev_if->
+				   dev_global_regs->dtknqr4_fifoemptymsk);
+		msk |= ((emp >> ep->num) & 0x1) << 7;
+		v = DWC_READ_REG32(&dev_if->in_ep_regs[ep->num]->diepint) & msk;
+	}
+
+	return v;
+}
+
+/**
+ * This function returns the Device OUT EP Interrupt register
+ */
+static inline uint32_t dwc_otg_read_dev_out_ep_intr(dwc_otg_core_if_t *
+						    _core_if, dwc_ep_t * _ep)
+{
+	dwc_otg_dev_if_t *dev_if = _core_if->dev_if;
+	uint32_t v;
+	doepmsk_data_t msk = {.d32 = 0 };
+
+	if (_core_if->multiproc_int_enable) {
+		msk.d32 =
+		    DWC_READ_REG32(&dev_if->
+				   dev_global_regs->doepeachintmsk[_ep->num]);
+		if (_core_if->pti_enh_enable) {
+			msk.b.pktdrpsts = 1;
+		}
+		v = DWC_READ_REG32(&dev_if->
+				   out_ep_regs[_ep->num]->doepint) & msk.d32;
+	} else {
+		msk.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->doepmsk);
+		if (_core_if->pti_enh_enable) {
+			msk.b.pktdrpsts = 1;
+		}
+		v = DWC_READ_REG32(&dev_if->
+				   out_ep_regs[_ep->num]->doepint) & msk.d32;
+	}
+	return v;
+}
+
+/**
+ * This function returns the Host All Channel Interrupt register
+ */
+static inline uint32_t dwc_otg_read_host_all_channels_intr(dwc_otg_core_if_t *
+							   _core_if)
+{
+	return (DWC_READ_REG32(&_core_if->host_if->host_global_regs->haint));
+}
+
+static inline uint32_t dwc_otg_read_host_channel_intr(dwc_otg_core_if_t *
+						      _core_if, dwc_hc_t * _hc)
+{
+	return (DWC_READ_REG32
+		(&_core_if->host_if->hc_regs[_hc->hc_num]->hcint));
+}
+
+/**
+ * This function returns the mode of the operation, host or device.
+ *
+ * @return 0 - Device Mode, 1 - Host Mode
+ */
+static inline uint32_t dwc_otg_mode(dwc_otg_core_if_t * _core_if)
+{
+	return (DWC_READ_REG32(&_core_if->core_global_regs->gintsts) & 0x1);
+}
+
+/**@}*/
+
+/**
+ * DWC_otg CIL callback structure. This structure allows the HCD and
+ * PCD to register functions used for starting and stopping the PCD
+ * and HCD for role change on for a DRD.
+ */
+typedef struct dwc_otg_cil_callbacks {
+	/** Start function for role change */
+	int (*start) (void *_p);
+	/** Stop Function for role change */
+	int (*stop) (void *_p);
+	/** Disconnect Function for role change */
+	int (*disconnect) (void *_p);
+	/** Resume/Remote wakeup Function */
+	int (*resume_wakeup) (void *_p);
+	/** Suspend function */
+	int (*suspend) (void *_p);
+	/** Session Start (SRP) */
+	int (*session_start) (void *_p);
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	/** Sleep (switch to L0 state) */
+	int (*sleep) (void *_p);
+#endif
+	/** Pointer passed to start() and stop() */
+	void *p;
+} dwc_otg_cil_callbacks_t;
+
+extern void dwc_otg_cil_register_pcd_callbacks(dwc_otg_core_if_t * _core_if,
+					       dwc_otg_cil_callbacks_t * _cb,
+					       void *_p);
+extern void dwc_otg_cil_register_hcd_callbacks(dwc_otg_core_if_t * _core_if,
+					       dwc_otg_cil_callbacks_t * _cb,
+					       void *_p);
+
+void dwc_otg_initiate_srp(dwc_otg_core_if_t * core_if);
+
+//////////////////////////////////////////////////////////////////////
+/** Start the HCD.  Helper function for using the HCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_hcd_start(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->hcd_cb && core_if->hcd_cb->start) {
+		core_if->hcd_cb->start(core_if->hcd_cb->p);
+	}
+}
+
+/** Stop the HCD.  Helper function for using the HCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_hcd_stop(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->hcd_cb && core_if->hcd_cb->stop) {
+		core_if->hcd_cb->stop(core_if->hcd_cb->p);
+	}
+}
+
+/** Disconnect the HCD.  Helper function for using the HCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_hcd_disconnect(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->hcd_cb && core_if->hcd_cb->disconnect) {
+		core_if->hcd_cb->disconnect(core_if->hcd_cb->p);
+	}
+}
+
+/** Inform the HCD the a New Session has begun.  Helper function for
+ * using the HCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_hcd_session_start(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->hcd_cb && core_if->hcd_cb->session_start) {
+		core_if->hcd_cb->session_start(core_if->hcd_cb->p);
+	}
+}
+
+#ifdef CONFIG_USB_DWC_OTG_LPM
+/**
+ * Inform the HCD about LPM sleep.
+ * Helper function for using the HCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_hcd_sleep(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->hcd_cb && core_if->hcd_cb->sleep) {
+		core_if->hcd_cb->sleep(core_if->hcd_cb->p);
+	}
+}
+#endif
+
+/** Resume the HCD.  Helper function for using the HCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_hcd_resume(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->hcd_cb && core_if->hcd_cb->resume_wakeup) {
+		core_if->hcd_cb->resume_wakeup(core_if->hcd_cb->p);
+	}
+}
+
+/** Start the PCD.  Helper function for using the PCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_pcd_start(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->pcd_cb && core_if->pcd_cb->start) {
+		core_if->pcd_cb->start(core_if->pcd_cb->p);
+	}
+}
+
+/** Stop the PCD.  Helper function for using the PCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_pcd_stop(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->pcd_cb && core_if->pcd_cb->stop) {
+		core_if->pcd_cb->stop(core_if->pcd_cb->p);
+	}
+}
+
+/** Suspend the PCD.  Helper function for using the PCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_pcd_suspend(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->pcd_cb && core_if->pcd_cb->suspend) {
+		core_if->pcd_cb->suspend(core_if->pcd_cb->p);
+	}
+}
+
+/** Resume the PCD.  Helper function for using the PCD callbacks.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static inline void cil_pcd_resume(dwc_otg_core_if_t * core_if)
+{
+	if (core_if->pcd_cb && core_if->pcd_cb->resume_wakeup) {
+		core_if->pcd_cb->resume_wakeup(core_if->pcd_cb->p);
+	}
+}
+
+//////////////////////////////////////////////////////////////////////
+
+#endif
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c b/drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c
new file mode 100644
index 000000000000..9fb7229f43ae
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_cil_intr.c
@@ -0,0 +1,1596 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_cil_intr.c $
+ * $Revision: #32 $
+ * $Date: 2012/08/10 $
+ * $Change: 2047372 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+/** @file
+ *
+ * The Core Interface Layer provides basic services for accessing and
+ * managing the DWC_otg hardware. These services are used by both the
+ * Host Controller Driver and the Peripheral Controller Driver.
+ *
+ * This file contains the Common Interrupt handlers.
+ */
+#include "dwc_os.h"
+#include "dwc_otg_regs.h"
+#include "dwc_otg_cil.h"
+#include "dwc_otg_driver.h"
+#include "dwc_otg_pcd.h"
+#include "dwc_otg_hcd.h"
+
+#ifdef DEBUG
+inline const char *op_state_str(dwc_otg_core_if_t * core_if)
+{
+	return (core_if->op_state == A_HOST ? "a_host" :
+		(core_if->op_state == A_SUSPEND ? "a_suspend" :
+		 (core_if->op_state == A_PERIPHERAL ? "a_peripheral" :
+		  (core_if->op_state == B_PERIPHERAL ? "b_peripheral" :
+		   (core_if->op_state == B_HOST ? "b_host" : "unknown")))));
+}
+#endif
+
+/** This function will log a debug message
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+int32_t dwc_otg_handle_mode_mismatch_intr(dwc_otg_core_if_t * core_if)
+{
+	gintsts_data_t gintsts;
+	DWC_WARN("Mode Mismatch Interrupt: currently in %s mode\n",
+		 dwc_otg_mode(core_if) ? "Host" : "Device");
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.modemismatch = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+	return 1;
+}
+
+/**
+ * This function handles the OTG Interrupts. It reads the OTG
+ * Interrupt Register (GOTGINT) to determine what interrupt has
+ * occurred.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+int32_t dwc_otg_handle_otg_intr(dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	gotgint_data_t gotgint;
+	gotgctl_data_t gotgctl;
+	gintmsk_data_t gintmsk;
+	gpwrdn_data_t gpwrdn;
+
+	gotgint.d32 = DWC_READ_REG32(&global_regs->gotgint);
+	gotgctl.d32 = DWC_READ_REG32(&global_regs->gotgctl);
+	DWC_DEBUGPL(DBG_CIL, "++OTG Interrupt gotgint=%0x [%s]\n", gotgint.d32,
+		    op_state_str(core_if));
+
+	if (gotgint.b.sesenddet) {
+		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: "
+			    "Session End Detected++ (%s)\n",
+			    op_state_str(core_if));
+		gotgctl.d32 = DWC_READ_REG32(&global_regs->gotgctl);
+
+		if (core_if->op_state == B_HOST) {
+			cil_pcd_start(core_if);
+			core_if->op_state = B_PERIPHERAL;
+		} else {
+			/* If not B_HOST and Device HNP still set. HNP
+			 * Did not succeed!*/
+			if (gotgctl.b.devhnpen) {
+				DWC_DEBUGPL(DBG_ANY, "Session End Detected\n");
+				__DWC_ERROR("Device Not Connected/Responding!\n");
+			}
+
+			/* If Session End Detected the B-Cable has
+			 * been disconnected. */
+			/* Reset PCD and Gadget driver to a
+			 * clean state. */
+			core_if->lx_state = DWC_OTG_L0;
+			DWC_SPINUNLOCK(core_if->lock);
+			cil_pcd_stop(core_if);
+			DWC_SPINLOCK(core_if->lock);
+
+			if (core_if->adp_enable) {
+				if (core_if->power_down == 2) {
+					gpwrdn.d32 = 0;
+					gpwrdn.b.pwrdnswtch = 1;
+					DWC_MODIFY_REG32(&core_if->
+							 core_global_regs->
+							 gpwrdn, gpwrdn.d32, 0);
+				}
+
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pmuintsel = 1;
+				gpwrdn.b.pmuactv = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+
+				dwc_otg_adp_sense_start(core_if);
+			}
+		}
+
+		gotgctl.d32 = 0;
+		gotgctl.b.devhnpen = 1;
+		DWC_MODIFY_REG32(&global_regs->gotgctl, gotgctl.d32, 0);
+	}
+	if (gotgint.b.sesreqsucstschng) {
+		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: "
+			    "Session Reqeust Success Status Change++\n");
+		gotgctl.d32 = DWC_READ_REG32(&global_regs->gotgctl);
+		if (gotgctl.b.sesreqscs) {
+
+			if ((core_if->core_params->phy_type ==
+			     DWC_PHY_TYPE_PARAM_FS) && (core_if->core_params->i2c_enable)) {
+				core_if->srp_success = 1;
+			} else {
+				DWC_SPINUNLOCK(core_if->lock);
+				cil_pcd_resume(core_if);
+				DWC_SPINLOCK(core_if->lock);
+				/* Clear Session Request */
+				gotgctl.d32 = 0;
+				gotgctl.b.sesreq = 1;
+				DWC_MODIFY_REG32(&global_regs->gotgctl,
+						 gotgctl.d32, 0);
+			}
+		}
+	}
+	if (gotgint.b.hstnegsucstschng) {
+		/* Print statements during the HNP interrupt handling
+		 * can cause it to fail.*/
+		gotgctl.d32 = DWC_READ_REG32(&global_regs->gotgctl);
+		/* WA for 3.00a- HW is not setting cur_mode, even sometimes
+		 * this does not help*/
+		if (core_if->snpsid >= OTG_CORE_REV_3_00a)
+			dwc_udelay(100);
+		if (gotgctl.b.hstnegscs) {
+			if (dwc_otg_is_host_mode(core_if)) {
+				core_if->op_state = B_HOST;
+				/*
+				 * Need to disable SOF interrupt immediately.
+				 * When switching from device to host, the PCD
+				 * interrupt handler won't handle the
+				 * interrupt if host mode is already set. The
+				 * HCD interrupt handler won't get called if
+				 * the HCD state is HALT. This means that the
+				 * interrupt does not get handled and Linux
+				 * complains loudly.
+				 */
+				gintmsk.d32 = 0;
+				gintmsk.b.sofintr = 1;
+				DWC_MODIFY_REG32(&global_regs->gintmsk,
+						 gintmsk.d32, 0);
+				/* Call callback function with spin lock released */
+				DWC_SPINUNLOCK(core_if->lock);
+				cil_pcd_stop(core_if);
+				/*
+				 * Initialize the Core for Host mode.
+				 */
+				cil_hcd_start(core_if);
+				DWC_SPINLOCK(core_if->lock);
+				core_if->op_state = B_HOST;
+			}
+		} else {
+			gotgctl.d32 = 0;
+			gotgctl.b.hnpreq = 1;
+			gotgctl.b.devhnpen = 1;
+			DWC_MODIFY_REG32(&global_regs->gotgctl, gotgctl.d32, 0);
+			DWC_DEBUGPL(DBG_ANY, "HNP Failed\n");
+			__DWC_ERROR("Device Not Connected/Responding\n");
+		}
+	}
+	if (gotgint.b.hstnegdet) {
+		/* The disconnect interrupt is set at the same time as
+		 * Host Negotiation Detected.  During the mode
+		 * switch all interrupts are cleared so the disconnect
+		 * interrupt handler will not get executed.
+		 */
+		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: "
+			    "Host Negotiation Detected++ (%s)\n",
+			    (dwc_otg_is_host_mode(core_if) ? "Host" :
+			     "Device"));
+		if (dwc_otg_is_device_mode(core_if)) {
+			DWC_DEBUGPL(DBG_ANY, "a_suspend->a_peripheral (%d)\n",
+				    core_if->op_state);
+			DWC_SPINUNLOCK(core_if->lock);
+			cil_hcd_disconnect(core_if);
+			cil_pcd_start(core_if);
+			DWC_SPINLOCK(core_if->lock);
+			core_if->op_state = A_PERIPHERAL;
+		} else {
+			/*
+			 * Need to disable SOF interrupt immediately. When
+			 * switching from device to host, the PCD interrupt
+			 * handler won't handle the interrupt if host mode is
+			 * already set. The HCD interrupt handler won't get
+			 * called if the HCD state is HALT. This means that
+			 * the interrupt does not get handled and Linux
+			 * complains loudly.
+			 */
+			gintmsk.d32 = 0;
+			gintmsk.b.sofintr = 1;
+			DWC_MODIFY_REG32(&global_regs->gintmsk, gintmsk.d32, 0);
+			DWC_SPINUNLOCK(core_if->lock);
+			cil_pcd_stop(core_if);
+			cil_hcd_start(core_if);
+			DWC_SPINLOCK(core_if->lock);
+			core_if->op_state = A_HOST;
+		}
+	}
+	if (gotgint.b.adevtoutchng) {
+		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: "
+			    "A-Device Timeout Change++\n");
+	}
+	if (gotgint.b.debdone) {
+		DWC_DEBUGPL(DBG_ANY, " ++OTG Interrupt: " "Debounce Done++\n");
+	}
+
+	/* Clear GOTGINT */
+	DWC_WRITE_REG32(&core_if->core_global_regs->gotgint, gotgint.d32);
+
+	return 1;
+}
+
+void w_conn_id_status_change(void *p)
+{
+	dwc_otg_core_if_t *core_if = p;
+	uint32_t count = 0;
+	gotgctl_data_t gotgctl = {.d32 = 0 };
+
+	gotgctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
+	DWC_DEBUGPL(DBG_CIL, "gotgctl=%0x\n", gotgctl.d32);
+	DWC_DEBUGPL(DBG_CIL, "gotgctl.b.conidsts=%d\n", gotgctl.b.conidsts);
+
+	/* B-Device connector (Device Mode) */
+	if (gotgctl.b.conidsts) {
+		/* Wait for switch to device mode. */
+		while (!dwc_otg_is_device_mode(core_if)) {
+			DWC_PRINTF("Waiting for Peripheral Mode, Mode=%s\n",
+				   (dwc_otg_is_host_mode(core_if) ? "Host" :
+				    "Peripheral"));
+			dwc_mdelay(100);
+			if (++count > 10000)
+				break;
+		}
+		DWC_ASSERT(++count < 10000,
+			   "Connection id status change timed out");
+		core_if->op_state = B_PERIPHERAL;
+		dwc_otg_core_init(core_if);
+		dwc_otg_enable_global_interrupts(core_if);
+		cil_pcd_start(core_if);
+	} else {
+		/* A-Device connector (Host Mode) */
+		while (!dwc_otg_is_host_mode(core_if)) {
+			DWC_PRINTF("Waiting for Host Mode, Mode=%s\n",
+				   (dwc_otg_is_host_mode(core_if) ? "Host" :
+				    "Peripheral"));
+			dwc_mdelay(100);
+			if (++count > 10000)
+				break;
+		}
+		DWC_ASSERT(++count < 10000,
+			   "Connection id status change timed out");
+		core_if->op_state = A_HOST;
+		/*
+		 * Initialize the Core for Host mode.
+		 */
+		dwc_otg_core_init(core_if);
+		dwc_otg_enable_global_interrupts(core_if);
+		cil_hcd_start(core_if);
+	}
+}
+
+/**
+ * This function handles the Connector ID Status Change Interrupt.  It
+ * reads the OTG Interrupt Register (GOTCTL) to determine whether this
+ * is a Device to Host Mode transition or a Host Mode to Device
+ * Transition.
+ *
+ * This only occurs when the cable is connected/removed from the PHY
+ * connector.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+int32_t dwc_otg_handle_conn_id_status_change_intr(dwc_otg_core_if_t * core_if)
+{
+
+	/*
+	 * Need to disable SOF interrupt immediately. If switching from device
+	 * to host, the PCD interrupt handler won't handle the interrupt if
+	 * host mode is already set. The HCD interrupt handler won't get
+	 * called if the HCD state is HALT. This means that the interrupt does
+	 * not get handled and Linux complains loudly.
+	 */
+	gintmsk_data_t gintmsk = {.d32 = 0 };
+	gintsts_data_t gintsts = {.d32 = 0 };
+
+	gintmsk.b.sofintr = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, gintmsk.d32, 0);
+
+	DWC_DEBUGPL(DBG_CIL,
+		    " ++Connector ID Status Change Interrupt++  (%s)\n",
+		    (dwc_otg_is_host_mode(core_if) ? "Host" : "Device"));
+
+	DWC_SPINUNLOCK(core_if->lock);
+
+	/*
+	 * Need to schedule a work, as there are possible DELAY function calls
+	 * Release lock before scheduling workq as it holds spinlock during scheduling
+	 */
+
+	DWC_WORKQ_SCHEDULE(core_if->wq_otg, w_conn_id_status_change,
+			   core_if, "connection id status change");
+	DWC_SPINLOCK(core_if->lock);
+
+	/* Set flag and clear interrupt */
+	gintsts.b.conidstschng = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * This interrupt indicates that a device is initiating the Session
+ * Request Protocol to request the host to turn on bus power so a new
+ * session can begin. The handler responds by turning on bus power. If
+ * the DWC_otg controller is in low power mode, the handler brings the
+ * controller out of low power mode before turning on bus power.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+int32_t dwc_otg_handle_session_req_intr(dwc_otg_core_if_t * core_if)
+{
+	gintsts_data_t gintsts;
+
+#ifndef DWC_HOST_ONLY
+	DWC_DEBUGPL(DBG_ANY, "++Session Request Interrupt++\n");
+
+	if (dwc_otg_is_device_mode(core_if)) {
+		DWC_PRINTF("SRP: Device mode\n");
+	} else {
+		hprt0_data_t hprt0;
+		DWC_PRINTF("SRP: Host mode\n");
+
+		/* Turn on the port power bit. */
+		hprt0.d32 = dwc_otg_read_hprt0(core_if);
+		hprt0.b.prtpwr = 1;
+		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+
+		/* Start the Connection timer. So a message can be displayed
+		 * if connect does not occur within 10 seconds. */
+		cil_hcd_session_start(core_if);
+	}
+#endif
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.sessreqintr = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+	return 1;
+}
+
+void w_wakeup_detected(void *p)
+{
+	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) p;
+	/*
+	 * Clear the Resume after 70ms. (Need 20 ms minimum. Use 70 ms
+	 * so that OPT tests pass with all PHYs).
+	 */
+	hprt0_data_t hprt0 = {.d32 = 0 };
+#if 0
+	pcgcctl_data_t pcgcctl = {.d32 = 0 };
+	/* Restart the Phy Clock */
+	pcgcctl.b.stoppclk = 1;
+	DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
+	dwc_udelay(10);
+#endif //0
+	hprt0.d32 = dwc_otg_read_hprt0(core_if);
+	DWC_DEBUGPL(DBG_ANY, "Resume: HPRT0=%0x\n", hprt0.d32);
+//      dwc_mdelay(70);
+	hprt0.b.prtres = 0;	/* Resume */
+	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+	DWC_DEBUGPL(DBG_ANY, "Clear Resume: HPRT0=%0x\n",
+		    DWC_READ_REG32(core_if->host_if->hprt0));
+
+	cil_hcd_resume(core_if);
+
+	/** Change to L0 state*/
+	core_if->lx_state = DWC_OTG_L0;
+}
+
+/**
+ * This interrupt indicates that the DWC_otg controller has detected a
+ * resume or remote wakeup sequence. If the DWC_otg controller is in
+ * low power mode, the handler must brings the controller out of low
+ * power mode. The controller automatically begins resume
+ * signaling. The handler schedules a time to stop resume signaling.
+ */
+int32_t dwc_otg_handle_wakeup_detected_intr(dwc_otg_core_if_t * core_if)
+{
+	gintsts_data_t gintsts;
+
+	DWC_DEBUGPL(DBG_ANY,
+		    "++Resume and Remote Wakeup Detected Interrupt++\n");
+
+	DWC_PRINTF("%s lxstate = %d\n", __func__, core_if->lx_state);
+
+	if (dwc_otg_is_device_mode(core_if)) {
+		dctl_data_t dctl = {.d32 = 0 };
+		DWC_DEBUGPL(DBG_PCD, "DSTS=0x%0x\n",
+			    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->
+					   dsts));
+		if (core_if->lx_state == DWC_OTG_L2) {
+#ifdef PARTIAL_POWER_DOWN
+			if (core_if->hwcfg4.b.power_optimiz) {
+				pcgcctl_data_t power = {.d32 = 0 };
+
+				power.d32 = DWC_READ_REG32(core_if->pcgcctl);
+				DWC_DEBUGPL(DBG_CIL, "PCGCCTL=%0x\n",
+					    power.d32);
+
+				power.b.stoppclk = 0;
+				DWC_WRITE_REG32(core_if->pcgcctl, power.d32);
+
+				power.b.pwrclmp = 0;
+				DWC_WRITE_REG32(core_if->pcgcctl, power.d32);
+
+				power.b.rstpdwnmodule = 0;
+				DWC_WRITE_REG32(core_if->pcgcctl, power.d32);
+			}
+#endif
+			/* Clear the Remote Wakeup Signaling */
+			dctl.b.rmtwkupsig = 1;
+			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
+					 dctl, dctl.d32, 0);
+
+			DWC_SPINUNLOCK(core_if->lock);
+			if (core_if->pcd_cb && core_if->pcd_cb->resume_wakeup) {
+				core_if->pcd_cb->resume_wakeup(core_if->pcd_cb->p);
+			}
+			DWC_SPINLOCK(core_if->lock);
+		} else {
+			glpmcfg_data_t lpmcfg;
+			lpmcfg.d32 =
+			    DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+			lpmcfg.b.hird_thres &= (~(1 << 4));
+			DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg,
+					lpmcfg.d32);
+		}
+		/** Change to L0 state*/
+		core_if->lx_state = DWC_OTG_L0;
+	} else {
+		if (core_if->lx_state != DWC_OTG_L1) {
+			pcgcctl_data_t pcgcctl = {.d32 = 0 };
+
+			/* Restart the Phy Clock */
+			pcgcctl.b.stoppclk = 1;
+			DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
+			DWC_TIMER_SCHEDULE(core_if->wkp_timer, 71);
+		} else {
+			/** Change to L0 state*/
+			core_if->lx_state = DWC_OTG_L0;
+		}
+	}
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.wkupintr = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * This interrupt indicates that the Wakeup Logic has detected a
+ * Device disconnect.
+ */
+static int32_t dwc_otg_handle_pwrdn_disconnect_intr(dwc_otg_core_if_t *core_if)
+{
+	gpwrdn_data_t gpwrdn = { .d32 = 0 };
+	gpwrdn_data_t gpwrdn_temp = { .d32 = 0 };
+	gpwrdn_temp.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+
+	DWC_PRINTF("%s called\n", __FUNCTION__);
+
+	if (!core_if->hibernation_suspend) {
+		DWC_PRINTF("Already exited from Hibernation\n");
+		return 1;
+	}
+
+	/* Switch on the voltage to the core */
+	gpwrdn.b.pwrdnswtch = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Reset the core */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Disable power clamps*/
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnclmp = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	/* Remove reset the core signal */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+	dwc_udelay(10);
+
+	/* Disable PMU interrupt */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuintsel = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	core_if->hibernation_suspend = 0;
+
+	/* Disable PMU */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuactv = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	if (gpwrdn_temp.b.idsts) {
+		core_if->op_state = B_PERIPHERAL;
+		dwc_otg_core_init(core_if);
+		dwc_otg_enable_global_interrupts(core_if);
+		cil_pcd_start(core_if);
+	} else {
+		core_if->op_state = A_HOST;
+		dwc_otg_core_init(core_if);
+		dwc_otg_enable_global_interrupts(core_if);
+		cil_hcd_start(core_if);
+	}
+
+	return 1;
+}
+
+/**
+ * This interrupt indicates that the Wakeup Logic has detected a
+ * remote wakeup sequence.
+ */
+static int32_t dwc_otg_handle_pwrdn_wakeup_detected_intr(dwc_otg_core_if_t * core_if)
+{
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+	DWC_DEBUGPL(DBG_ANY,
+		    "++Powerdown Remote Wakeup Detected Interrupt++\n");
+
+	if (!core_if->hibernation_suspend) {
+		DWC_PRINTF("Already exited from Hibernation\n");
+		return 1;
+	}
+
+	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+	if (gpwrdn.b.idsts) {	// Device Mode
+		if ((core_if->power_down == 2)
+		    && (core_if->hibernation_suspend == 1)) {
+			dwc_otg_device_hibernation_restore(core_if, 0, 0);
+		}
+	} else {
+		if ((core_if->power_down == 2)
+		    && (core_if->hibernation_suspend == 1)) {
+			dwc_otg_host_hibernation_restore(core_if, 1, 0);
+		}
+	}
+	return 1;
+}
+
+static int32_t dwc_otg_handle_pwrdn_idsts_change(dwc_otg_device_t *otg_dev)
+{
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+	gpwrdn_data_t gpwrdn_temp = {.d32 = 0 };
+	dwc_otg_core_if_t *core_if = otg_dev->core_if;
+
+	DWC_DEBUGPL(DBG_ANY, "%s called\n", __FUNCTION__);
+	gpwrdn_temp.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+	if (core_if->power_down == 2) {
+		if (!core_if->hibernation_suspend) {
+			DWC_PRINTF("Already exited from Hibernation\n");
+			return 1;
+		}
+		DWC_DEBUGPL(DBG_ANY, "Exit from hibernation on ID sts change\n");
+		/* Switch on the voltage to the core */
+		gpwrdn.b.pwrdnswtch = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		dwc_udelay(10);
+
+		/* Reset the core */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pwrdnrstn = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		dwc_udelay(10);
+
+		/* Disable power clamps */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pwrdnclmp = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+		/* Remove reset the core signal */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pwrdnrstn = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+		dwc_udelay(10);
+
+		/* Disable PMU interrupt */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pmuintsel = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+		/*Indicates that we are exiting from hibernation */
+		core_if->hibernation_suspend = 0;
+
+		/* Disable PMU */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pmuactv = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		dwc_udelay(10);
+
+		gpwrdn.d32 = core_if->gr_backup->gpwrdn_local;
+		if (gpwrdn.b.dis_vbus == 1) {
+			gpwrdn.d32 = 0;
+			gpwrdn.b.dis_vbus = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		}
+
+		if (gpwrdn_temp.b.idsts) {
+			core_if->op_state = B_PERIPHERAL;
+			dwc_otg_core_init(core_if);
+			dwc_otg_enable_global_interrupts(core_if);
+			cil_pcd_start(core_if);
+		} else {
+			core_if->op_state = A_HOST;
+			dwc_otg_core_init(core_if);
+			dwc_otg_enable_global_interrupts(core_if);
+			cil_hcd_start(core_if);
+		}
+	}
+
+	if (core_if->adp_enable) {
+		uint8_t is_host = 0;
+		DWC_SPINUNLOCK(core_if->lock);
+		/* Change the core_if's lock to hcd/pcd lock depend on mode? */
+#ifndef DWC_HOST_ONLY
+		if (gpwrdn_temp.b.idsts)
+			core_if->lock = otg_dev->pcd->lock;
+#endif
+#ifndef DWC_DEVICE_ONLY
+		if (!gpwrdn_temp.b.idsts) {
+				core_if->lock = otg_dev->hcd->lock;
+				is_host = 1;
+		}
+#endif
+		DWC_PRINTF("RESTART ADP\n");
+		if (core_if->adp.probe_enabled)
+			dwc_otg_adp_probe_stop(core_if);
+		if (core_if->adp.sense_enabled)
+			dwc_otg_adp_sense_stop(core_if);
+		if (core_if->adp.sense_timer_started)
+			DWC_TIMER_CANCEL(core_if->adp.sense_timer);
+		if (core_if->adp.vbuson_timer_started)
+			DWC_TIMER_CANCEL(core_if->adp.vbuson_timer);
+		core_if->adp.probe_timer_values[0] = -1;
+		core_if->adp.probe_timer_values[1] = -1;
+		core_if->adp.sense_timer_started = 0;
+		core_if->adp.vbuson_timer_started = 0;
+		core_if->adp.probe_counter = 0;
+		core_if->adp.gpwrdn = 0;
+
+		/* Disable PMU and restart ADP */
+		gpwrdn_temp.d32 = 0;
+		gpwrdn_temp.b.pmuactv = 1;
+		gpwrdn_temp.b.pmuintsel = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		DWC_PRINTF("Check point 1\n");
+		dwc_mdelay(110);
+		dwc_otg_adp_start(core_if, is_host);
+		DWC_SPINLOCK(core_if->lock);
+	}
+
+
+	return 1;
+}
+
+static int32_t dwc_otg_handle_pwrdn_session_change(dwc_otg_core_if_t * core_if)
+{
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+	int32_t otg_cap_param = core_if->core_params->otg_cap;
+	DWC_DEBUGPL(DBG_ANY, "%s called\n", __FUNCTION__);
+
+	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+	if (core_if->power_down == 2) {
+		if (!core_if->hibernation_suspend) {
+			DWC_PRINTF("Already exited from Hibernation\n");
+			return 1;
+		}
+
+		if ((otg_cap_param != DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE ||
+			 otg_cap_param != DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE) &&
+			gpwrdn.b.bsessvld == 0) {
+			/* Save gpwrdn register for further usage if stschng interrupt */
+			core_if->gr_backup->gpwrdn_local =
+				DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+			/*Exit from ISR and wait for stschng interrupt with bsessvld = 1 */
+			return 1;
+		}
+
+		/* Switch on the voltage to the core */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pwrdnswtch = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		dwc_udelay(10);
+
+		/* Reset the core */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pwrdnrstn = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		dwc_udelay(10);
+
+		/* Disable power clamps */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pwrdnclmp = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+		/* Remove reset the core signal */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pwrdnrstn = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+		dwc_udelay(10);
+
+		/* Disable PMU interrupt */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pmuintsel = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		dwc_udelay(10);
+
+		/*Indicates that we are exiting from hibernation */
+		core_if->hibernation_suspend = 0;
+
+		/* Disable PMU */
+		gpwrdn.d32 = 0;
+		gpwrdn.b.pmuactv = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+		dwc_udelay(10);
+
+		core_if->op_state = B_PERIPHERAL;
+		dwc_otg_core_init(core_if);
+		dwc_otg_enable_global_interrupts(core_if);
+		cil_pcd_start(core_if);
+
+		if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE ||
+			otg_cap_param == DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE) {
+			/*
+			 * Initiate SRP after initial ADP probe.
+			 */
+			dwc_otg_initiate_srp(core_if);
+		}
+	}
+
+	return 1;
+}
+/**
+ * This interrupt indicates that the Wakeup Logic has detected a
+ * status change either on IDDIG or BSessVld.
+ */
+static uint32_t dwc_otg_handle_pwrdn_stschng_intr(dwc_otg_device_t *otg_dev)
+{
+	int retval;
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+	gpwrdn_data_t gpwrdn_temp = {.d32 = 0 };
+	dwc_otg_core_if_t *core_if = otg_dev->core_if;
+
+	DWC_PRINTF("%s called\n", __FUNCTION__);
+
+	if (core_if->power_down == 2) {
+		if (core_if->hibernation_suspend <= 0) {
+			DWC_PRINTF("Already exited from Hibernation\n");
+			return 1;
+		} else
+			gpwrdn_temp.d32 = core_if->gr_backup->gpwrdn_local;
+
+	} else {
+		gpwrdn_temp.d32 = core_if->adp.gpwrdn;
+	}
+
+	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+
+	if (gpwrdn.b.idsts ^ gpwrdn_temp.b.idsts) {
+		retval = dwc_otg_handle_pwrdn_idsts_change(otg_dev);
+	} else if (gpwrdn.b.bsessvld ^ gpwrdn_temp.b.bsessvld) {
+		retval = dwc_otg_handle_pwrdn_session_change(core_if);
+	}
+
+	return retval;
+}
+
+/**
+ * This interrupt indicates that the Wakeup Logic has detected a
+ * SRP.
+ */
+static int32_t dwc_otg_handle_pwrdn_srp_intr(dwc_otg_core_if_t * core_if)
+{
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+
+	DWC_PRINTF("%s called\n", __FUNCTION__);
+
+	if (!core_if->hibernation_suspend) {
+		DWC_PRINTF("Already exited from Hibernation\n");
+		return 1;
+	}
+#ifdef DWC_DEV_SRPCAP
+	if (core_if->pwron_timer_started) {
+		core_if->pwron_timer_started = 0;
+		DWC_TIMER_CANCEL(core_if->pwron_timer);
+	}
+#endif
+
+	/* Switch on the voltage to the core */
+	gpwrdn.b.pwrdnswtch = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Reset the core */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Disable power clamps */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnclmp = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	/* Remove reset the core signal */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+	dwc_udelay(10);
+
+	/* Disable PMU interrupt */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuintsel = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	/* Indicates that we are exiting from hibernation */
+	core_if->hibernation_suspend = 0;
+
+	/* Disable PMU */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuactv = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Programm Disable VBUS to 0 */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.dis_vbus = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	/*Initialize the core as Host */
+	core_if->op_state = A_HOST;
+	dwc_otg_core_init(core_if);
+	dwc_otg_enable_global_interrupts(core_if);
+	cil_hcd_start(core_if);
+
+	return 1;
+}
+
+/** This interrupt indicates that restore command after Hibernation
+ * was completed by the core. */
+int32_t dwc_otg_handle_restore_done_intr(dwc_otg_core_if_t * core_if)
+{
+	pcgcctl_data_t pcgcctl;
+	DWC_DEBUGPL(DBG_ANY, "++Restore Done Interrupt++\n");
+
+	//TODO De-assert restore signal. 8.a
+	pcgcctl.d32 = DWC_READ_REG32(core_if->pcgcctl);
+	if (pcgcctl.b.restoremode == 1) {
+		gintmsk_data_t gintmsk = {.d32 = 0 };
+		/*
+		 * If restore mode is Remote Wakeup,
+		 * unmask Remote Wakeup interrupt.
+		 */
+		gintmsk.b.wkupintr = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk,
+				 0, gintmsk.d32);
+	}
+
+	return 1;
+}
+
+/**
+ * This interrupt indicates that a device has been disconnected from
+ * the root port.
+ */
+int32_t dwc_otg_handle_disconnect_intr(dwc_otg_core_if_t * core_if)
+{
+	gintsts_data_t gintsts;
+
+	DWC_DEBUGPL(DBG_ANY, "++Disconnect Detected Interrupt++ (%s) %s\n",
+		    (dwc_otg_is_host_mode(core_if) ? "Host" : "Device"),
+		    op_state_str(core_if));
+
+/** @todo Consolidate this if statement. */
+#ifndef DWC_HOST_ONLY
+	if (core_if->op_state == B_HOST) {
+		/* If in device mode Disconnect and stop the HCD, then
+		 * start the PCD. */
+		DWC_SPINUNLOCK(core_if->lock);
+		cil_hcd_disconnect(core_if);
+		cil_pcd_start(core_if);
+		DWC_SPINLOCK(core_if->lock);
+		core_if->op_state = B_PERIPHERAL;
+	} else if (dwc_otg_is_device_mode(core_if)) {
+		gotgctl_data_t gotgctl = {.d32 = 0 };
+		gotgctl.d32 =
+		    DWC_READ_REG32(&core_if->core_global_regs->gotgctl);
+		if (gotgctl.b.hstsethnpen == 1) {
+			/* Do nothing, if HNP in process the OTG
+			 * interrupt "Host Negotiation Detected"
+			 * interrupt will do the mode switch.
+			 */
+		} else if (gotgctl.b.devhnpen == 0) {
+			/* If in device mode Disconnect and stop the HCD, then
+			 * start the PCD. */
+			DWC_SPINUNLOCK(core_if->lock);
+			cil_hcd_disconnect(core_if);
+			cil_pcd_start(core_if);
+			DWC_SPINLOCK(core_if->lock);
+			core_if->op_state = B_PERIPHERAL;
+		} else {
+			DWC_DEBUGPL(DBG_ANY, "!a_peripheral && !devhnpen\n");
+		}
+	} else {
+		if (core_if->op_state == A_HOST) {
+			/* A-Cable still connected but device disconnected. */
+			DWC_SPINUNLOCK(core_if->lock);
+			cil_hcd_disconnect(core_if);
+			DWC_SPINLOCK(core_if->lock);
+			if (core_if->adp_enable) {
+				gpwrdn_data_t gpwrdn = { .d32 = 0 };
+				cil_hcd_stop(core_if);
+				/* Enable Power Down Logic */
+				gpwrdn.b.pmuintsel = 1;
+				gpwrdn.b.pmuactv = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+				dwc_otg_adp_probe_start(core_if);
+
+				/* Power off the core */
+				if (core_if->power_down == 2) {
+					gpwrdn.d32 = 0;
+					gpwrdn.b.pwrdnswtch = 1;
+					DWC_MODIFY_REG32
+					    (&core_if->core_global_regs->gpwrdn,
+					     gpwrdn.d32, 0);
+				}
+			}
+		}
+	}
+#endif
+	/* Change to L3(OFF) state */
+	core_if->lx_state = DWC_OTG_L3;
+
+	gintsts.d32 = 0;
+	gintsts.b.disconnect = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+	return 1;
+}
+
+/**
+ * This interrupt indicates that SUSPEND state has been detected on
+ * the USB.
+ *
+ * For HNP the USB Suspend interrupt signals the change from
+ * "a_peripheral" to "a_host".
+ *
+ * When power management is enabled the core will be put in low power
+ * mode.
+ */
+int32_t dwc_otg_handle_usb_suspend_intr(dwc_otg_core_if_t * core_if)
+{
+	dsts_data_t dsts;
+	gintsts_data_t gintsts;
+	dcfg_data_t dcfg;
+
+	DWC_DEBUGPL(DBG_ANY, "USB SUSPEND\n");
+
+	if (dwc_otg_is_device_mode(core_if)) {
+		/* Check the Device status register to determine if the Suspend
+		 * state is active. */
+		dsts.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
+		DWC_DEBUGPL(DBG_PCD, "DSTS=0x%0x\n", dsts.d32);
+		DWC_DEBUGPL(DBG_PCD, "DSTS.Suspend Status=%d "
+			    "HWCFG4.power Optimize=%d\n",
+			    dsts.b.suspsts, core_if->hwcfg4.b.power_optimiz);
+
+#ifdef PARTIAL_POWER_DOWN
+/** @todo Add a module parameter for power management. */
+
+		if (dsts.b.suspsts && core_if->hwcfg4.b.power_optimiz) {
+			pcgcctl_data_t power = {.d32 = 0 };
+			DWC_DEBUGPL(DBG_CIL, "suspend\n");
+
+			power.b.pwrclmp = 1;
+			DWC_WRITE_REG32(core_if->pcgcctl, power.d32);
+
+			power.b.rstpdwnmodule = 1;
+			DWC_MODIFY_REG32(core_if->pcgcctl, 0, power.d32);
+
+			power.b.stoppclk = 1;
+			DWC_MODIFY_REG32(core_if->pcgcctl, 0, power.d32);
+
+		} else {
+			DWC_DEBUGPL(DBG_ANY, "disconnect?\n");
+		}
+#endif
+		/* PCD callback for suspend. Release the lock inside of callback function */
+		cil_pcd_suspend(core_if);
+		if (core_if->power_down == 2)
+		{
+			dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
+			DWC_DEBUGPL(DBG_ANY,"lx_state = %08x\n",core_if->lx_state);
+			DWC_DEBUGPL(DBG_ANY," device address = %08d\n",dcfg.b.devaddr);
+
+			if (core_if->lx_state != DWC_OTG_L3 && dcfg.b.devaddr) {
+				pcgcctl_data_t pcgcctl = {.d32 = 0 };
+				gpwrdn_data_t gpwrdn = {.d32 = 0 };
+				gusbcfg_data_t gusbcfg = {.d32 = 0 };
+
+				/* Change to L2(suspend) state */
+				core_if->lx_state = DWC_OTG_L2;
+
+				/* Clear interrupt in gintsts */
+				gintsts.d32 = 0;
+				gintsts.b.usbsuspend = 1;
+				DWC_WRITE_REG32(&core_if->core_global_regs->
+						gintsts, gintsts.d32);
+				DWC_PRINTF("Start of hibernation completed\n");
+				dwc_otg_save_global_regs(core_if);
+				dwc_otg_save_dev_regs(core_if);
+
+				gusbcfg.d32 =
+				    DWC_READ_REG32(&core_if->core_global_regs->
+						   gusbcfg);
+				if (gusbcfg.b.ulpi_utmi_sel == 1) {
+					/* ULPI interface */
+					/* Suspend the Phy Clock */
+					pcgcctl.d32 = 0;
+					pcgcctl.b.stoppclk = 1;
+					DWC_MODIFY_REG32(core_if->pcgcctl, 0,
+							 pcgcctl.d32);
+					dwc_udelay(10);
+					gpwrdn.b.pmuactv = 1;
+					DWC_MODIFY_REG32(&core_if->
+							 core_global_regs->
+							 gpwrdn, 0, gpwrdn.d32);
+				} else {
+					/* UTMI+ Interface */
+					gpwrdn.b.pmuactv = 1;
+					DWC_MODIFY_REG32(&core_if->
+							 core_global_regs->
+							 gpwrdn, 0, gpwrdn.d32);
+					dwc_udelay(10);
+					pcgcctl.b.stoppclk = 1;
+					DWC_MODIFY_REG32(core_if->pcgcctl, 0,
+							 pcgcctl.d32);
+					dwc_udelay(10);
+				}
+
+				/* Set flag to indicate that we are in hibernation */
+				core_if->hibernation_suspend = 1;
+				/* Enable interrupts from wake up logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pmuintsel = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+				dwc_udelay(10);
+
+				/* Unmask device mode interrupts in GPWRDN */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.rst_det_msk = 1;
+				gpwrdn.b.lnstchng_msk = 1;
+				gpwrdn.b.sts_chngint_msk = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+				dwc_udelay(10);
+
+				/* Enable Power Down Clamp */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pwrdnclmp = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+				dwc_udelay(10);
+
+				/* Switch off VDD */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pwrdnswtch = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+
+				/* Save gpwrdn register for further usage if stschng interrupt */
+				core_if->gr_backup->gpwrdn_local =
+							DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+				DWC_PRINTF("Hibernation completed\n");
+
+				return 1;
+			}
+		} else if (core_if->power_down == 3) {
+			pcgcctl_data_t pcgcctl = {.d32 = 0 };
+			dcfg.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dcfg);
+			DWC_DEBUGPL(DBG_ANY, "lx_state = %08x\n",core_if->lx_state);
+			DWC_DEBUGPL(DBG_ANY, " device address = %08d\n",dcfg.b.devaddr);
+
+			if (core_if->lx_state != DWC_OTG_L3 && dcfg.b.devaddr) {
+				DWC_DEBUGPL(DBG_ANY, "Start entering to extended hibernation\n");
+				core_if->xhib = 1;
+
+				/* Clear interrupt in gintsts */
+				gintsts.d32 = 0;
+				gintsts.b.usbsuspend = 1;
+				DWC_WRITE_REG32(&core_if->core_global_regs->
+					gintsts, gintsts.d32);
+
+				dwc_otg_save_global_regs(core_if);
+				dwc_otg_save_dev_regs(core_if);
+
+				/* Wait for 10 PHY clocks */
+				dwc_udelay(10);
+
+				/* Program GPIO register while entering to xHib */
+				DWC_WRITE_REG32(&core_if->core_global_regs->ggpio, 0x1);
+
+				pcgcctl.b.enbl_extnd_hiber = 1;
+				DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
+				DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
+
+				pcgcctl.d32 = 0;
+				pcgcctl.b.extnd_hiber_pwrclmp = 1;
+				DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
+
+				pcgcctl.d32 = 0;
+				pcgcctl.b.extnd_hiber_switch = 1;
+				core_if->gr_backup->xhib_gpwrdn = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+				core_if->gr_backup->xhib_pcgcctl = DWC_READ_REG32(core_if->pcgcctl) | pcgcctl.d32;
+				DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
+
+				DWC_DEBUGPL(DBG_ANY, "Finished entering to extended hibernation\n");
+
+				return 1;
+			}
+		}
+	} else {
+		if (core_if->op_state == A_PERIPHERAL) {
+			DWC_DEBUGPL(DBG_ANY, "a_peripheral->a_host\n");
+			/* Clear the a_peripheral flag, back to a_host. */
+			DWC_SPINUNLOCK(core_if->lock);
+			cil_pcd_stop(core_if);
+			cil_hcd_start(core_if);
+			DWC_SPINLOCK(core_if->lock);
+			core_if->op_state = A_HOST;
+		}
+	}
+
+	/* Change to L2(suspend) state */
+	core_if->lx_state = DWC_OTG_L2;
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.usbsuspend = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+	return 1;
+}
+
+static int32_t dwc_otg_handle_xhib_exit_intr(dwc_otg_core_if_t * core_if)
+{
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+	pcgcctl_data_t pcgcctl = {.d32 = 0 };
+	gahbcfg_data_t gahbcfg = {.d32 = 0 };
+
+	dwc_udelay(10);
+
+	/* Program GPIO register while entering to xHib */
+	DWC_WRITE_REG32(&core_if->core_global_regs->ggpio, 0x0);
+
+	pcgcctl.d32 = core_if->gr_backup->xhib_pcgcctl;
+	pcgcctl.b.extnd_hiber_pwrclmp = 0;
+	DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
+	dwc_udelay(10);
+
+	gpwrdn.d32 = core_if->gr_backup->xhib_gpwrdn;
+	gpwrdn.b.restore = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32);
+	dwc_udelay(10);
+
+	restore_lpm_i2c_regs(core_if);
+
+	pcgcctl.d32 = core_if->gr_backup->pcgcctl_local & (0x3FFFF << 14);
+	pcgcctl.b.max_xcvrselect = 1;
+	pcgcctl.b.ess_reg_restored = 0;
+	pcgcctl.b.extnd_hiber_switch = 0;
+	pcgcctl.b.extnd_hiber_pwrclmp = 0;
+	pcgcctl.b.enbl_extnd_hiber = 1;
+	DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
+
+	gahbcfg.d32 = core_if->gr_backup->gahbcfg_local;
+	gahbcfg.b.glblintrmsk = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gahbcfg, gahbcfg.d32);
+
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, 0xFFFFFFFF);
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, 0x1 << 16);
+
+	DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg,
+			core_if->gr_backup->gusbcfg_local);
+	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg,
+			core_if->dr_backup->dcfg);
+
+	pcgcctl.d32 = 0;
+	pcgcctl.d32 = core_if->gr_backup->pcgcctl_local & (0x3FFFF << 14);
+	pcgcctl.b.max_xcvrselect = 1;
+	pcgcctl.d32 |= 0x608;
+	DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
+	dwc_udelay(10);
+
+	pcgcctl.d32 = 0;
+	pcgcctl.d32 = core_if->gr_backup->pcgcctl_local & (0x3FFFF << 14);
+	pcgcctl.b.max_xcvrselect = 1;
+	pcgcctl.b.ess_reg_restored = 1;
+	pcgcctl.b.enbl_extnd_hiber = 1;
+	pcgcctl.b.rstpdwnmodule = 1;
+	pcgcctl.b.restoremode = 1;
+	DWC_WRITE_REG32(core_if->pcgcctl, pcgcctl.d32);
+
+	DWC_DEBUGPL(DBG_ANY, "%s called\n", __FUNCTION__);
+
+	return 1;
+}
+
+#ifdef CONFIG_USB_DWC_OTG_LPM
+/**
+ * This function hadles LPM transaction received interrupt.
+ */
+static int32_t dwc_otg_handle_lpm_intr(dwc_otg_core_if_t * core_if)
+{
+	glpmcfg_data_t lpmcfg;
+	gintsts_data_t gintsts;
+
+	if (!core_if->core_params->lpm_enable) {
+		DWC_PRINTF("Unexpected LPM interrupt\n");
+	}
+
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	DWC_PRINTF("LPM config register = 0x%08x\n", lpmcfg.d32);
+
+	if (dwc_otg_is_host_mode(core_if)) {
+		cil_hcd_sleep(core_if);
+	} else {
+		lpmcfg.b.hird_thres |= (1 << 4);
+		DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg,
+				lpmcfg.d32);
+	}
+
+	/* Examine prt_sleep_sts after TL1TokenTetry period max (10 us) */
+	dwc_udelay(10);
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	if (lpmcfg.b.prt_sleep_sts) {
+		/* Save the current state */
+		core_if->lx_state = DWC_OTG_L1;
+	}
+
+	/* Clear interrupt  */
+	gintsts.d32 = 0;
+	gintsts.b.lpmtranrcvd = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+	return 1;
+}
+#endif /* CONFIG_USB_DWC_OTG_LPM */
+
+/**
+ * This function returns the Core Interrupt register.
+ */
+static inline uint32_t dwc_otg_read_common_intr(dwc_otg_core_if_t * core_if, gintmsk_data_t *reenable_gintmsk, dwc_otg_hcd_t *hcd)
+{
+	gahbcfg_data_t gahbcfg = {.d32 = 0 };
+	gintsts_data_t gintsts;
+	gintmsk_data_t gintmsk;
+	gintmsk_data_t gintmsk_common = {.d32 = 0 };
+	gintmsk_common.b.wkupintr = 1;
+	gintmsk_common.b.sessreqintr = 1;
+	gintmsk_common.b.conidstschng = 1;
+	gintmsk_common.b.otgintr = 1;
+	gintmsk_common.b.modemismatch = 1;
+	gintmsk_common.b.disconnect = 1;
+	gintmsk_common.b.usbsuspend = 1;
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	gintmsk_common.b.lpmtranrcvd = 1;
+#endif
+	gintmsk_common.b.restoredone = 1;
+	if(dwc_otg_is_device_mode(core_if))
+	{
+		/** @todo: The port interrupt occurs while in device
+		 * mode. Added code to CIL to clear the interrupt for now!
+		 */
+		gintmsk_common.b.portintr = 1;
+	}
+	gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+	gintmsk.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
+	if(fiq_enable) {
+		local_fiq_disable();
+		/* Pull in the interrupts that the FIQ has masked */
+		gintmsk.d32 |= ~(hcd->fiq_state->gintmsk_saved.d32);
+		gintmsk.d32 |= gintmsk_common.d32;
+		/* for the upstairs function to reenable - have to read it here in case FIQ triggers again */
+		reenable_gintmsk->d32 = gintmsk.d32;
+		local_fiq_enable();
+	}
+
+	gahbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gahbcfg);
+
+#ifdef DEBUG
+	/* if any common interrupts set */
+	if (gintsts.d32 & gintmsk_common.d32) {
+		DWC_DEBUGPL(DBG_ANY, "common_intr: gintsts=%08x  gintmsk=%08x\n",
+			    gintsts.d32, gintmsk.d32);
+	}
+#endif
+	if (!fiq_enable){
+		if (gahbcfg.b.glblintrmsk)
+			return ((gintsts.d32 & gintmsk.d32) & gintmsk_common.d32);
+		else
+			return 0;
+	} else {
+		/* Our IRQ kicker is no longer the USB hardware, it's the MPHI interface.
+		 * Can't trust the global interrupt mask bit in this case.
+		 */
+		return ((gintsts.d32 & gintmsk.d32) & gintmsk_common.d32);
+	}
+
+}
+
+/* MACRO for clearing interupt bits in GPWRDN register */
+#define CLEAR_GPWRDN_INTR(__core_if,__intr) \
+do { \
+		gpwrdn_data_t gpwrdn = {.d32=0}; \
+		gpwrdn.b.__intr = 1; \
+		DWC_MODIFY_REG32(&__core_if->core_global_regs->gpwrdn, \
+		0, gpwrdn.d32); \
+} while (0)
+
+/**
+ * Common interrupt handler.
+ *
+ * The common interrupts are those that occur in both Host and Device mode.
+ * This handler handles the following interrupts:
+ * - Mode Mismatch Interrupt
+ * - Disconnect Interrupt
+ * - OTG Interrupt
+ * - Connector ID Status Change Interrupt
+ * - Session Request Interrupt.
+ * - Resume / Remote Wakeup Detected Interrupt.
+ * - LPM Transaction Received Interrupt
+ * - ADP Transaction Received Interrupt
+ *
+ */
+int32_t dwc_otg_handle_common_intr(void *dev)
+{
+	int retval = 0;
+	gintsts_data_t gintsts;
+	gintmsk_data_t gintmsk_reenable = { .d32 = 0 };
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+	dwc_otg_device_t *otg_dev = dev;
+	dwc_otg_core_if_t *core_if = otg_dev->core_if;
+	gpwrdn.d32 = DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+	if (dwc_otg_is_device_mode(core_if))
+		core_if->frame_num = dwc_otg_get_frame_number(core_if);
+
+	if (core_if->lock)
+		DWC_SPINLOCK(core_if->lock);
+
+	if (core_if->power_down == 3 && core_if->xhib == 1) {
+		DWC_DEBUGPL(DBG_ANY, "Exiting from xHIB state\n");
+		retval |= dwc_otg_handle_xhib_exit_intr(core_if);
+		core_if->xhib = 2;
+		if (core_if->lock)
+			DWC_SPINUNLOCK(core_if->lock);
+
+		return retval;
+	}
+
+	if (core_if->hibernation_suspend <= 0) {
+		/* read_common will have to poke the FIQ's saved mask. We must then clear this mask at the end
+		 * of this handler - god only knows why it's done like this
+		 */
+		gintsts.d32 = dwc_otg_read_common_intr(core_if, &gintmsk_reenable, otg_dev->hcd);
+
+		if (gintsts.b.modemismatch) {
+			retval |= dwc_otg_handle_mode_mismatch_intr(core_if);
+		}
+		if (gintsts.b.otgintr) {
+			retval |= dwc_otg_handle_otg_intr(core_if);
+		}
+		if (gintsts.b.conidstschng) {
+			retval |=
+			    dwc_otg_handle_conn_id_status_change_intr(core_if);
+		}
+		if (gintsts.b.disconnect) {
+			retval |= dwc_otg_handle_disconnect_intr(core_if);
+		}
+		if (gintsts.b.sessreqintr) {
+			retval |= dwc_otg_handle_session_req_intr(core_if);
+		}
+		if (gintsts.b.wkupintr) {
+			retval |= dwc_otg_handle_wakeup_detected_intr(core_if);
+		}
+		if (gintsts.b.usbsuspend) {
+			retval |= dwc_otg_handle_usb_suspend_intr(core_if);
+		}
+#ifdef CONFIG_USB_DWC_OTG_LPM
+		if (gintsts.b.lpmtranrcvd) {
+			retval |= dwc_otg_handle_lpm_intr(core_if);
+		}
+#endif
+		if (gintsts.b.restoredone) {
+			gintsts.d32 = 0;
+	                if (core_if->power_down == 2)
+				core_if->hibernation_suspend = -1;
+			else if (core_if->power_down == 3 && core_if->xhib == 2) {
+				gpwrdn_data_t gpwrdn = {.d32 = 0 };
+				pcgcctl_data_t pcgcctl = {.d32 = 0 };
+				dctl_data_t dctl = {.d32 = 0 };
+
+				DWC_WRITE_REG32(&core_if->core_global_regs->
+						gintsts, 0xFFFFFFFF);
+
+				DWC_DEBUGPL(DBG_ANY,
+					    "RESTORE DONE generated\n");
+
+				gpwrdn.b.restore = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+				dwc_udelay(10);
+
+				pcgcctl.b.rstpdwnmodule = 1;
+				DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
+
+				DWC_WRITE_REG32(&core_if->core_global_regs->gusbcfg, core_if->gr_backup->gusbcfg_local);
+				DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dcfg, core_if->dr_backup->dcfg);
+				DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, core_if->dr_backup->dctl);
+				dwc_udelay(50);
+
+				dctl.b.pwronprgdone = 1;
+				DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
+				dwc_udelay(10);
+
+				dwc_otg_restore_global_regs(core_if);
+				dwc_otg_restore_dev_regs(core_if, 0);
+
+				dctl.d32 = 0;
+				dctl.b.pwronprgdone = 1;
+				DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32, 0);
+				dwc_udelay(10);
+
+				pcgcctl.d32 = 0;
+				pcgcctl.b.enbl_extnd_hiber = 1;
+				DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
+
+				/* The core will be in ON STATE */
+				core_if->lx_state = DWC_OTG_L0;
+				core_if->xhib = 0;
+
+				DWC_SPINUNLOCK(core_if->lock);
+				if (core_if->pcd_cb && core_if->pcd_cb->resume_wakeup) {
+					core_if->pcd_cb->resume_wakeup(core_if->pcd_cb->p);
+				}
+				DWC_SPINLOCK(core_if->lock);
+
+			}
+
+			gintsts.b.restoredone = 1;
+			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts,gintsts.d32);
+			DWC_PRINTF(" --Restore done interrupt received-- \n");
+			retval |= 1;
+		}
+		if (gintsts.b.portintr && dwc_otg_is_device_mode(core_if)) {
+			/* The port interrupt occurs while in device mode with HPRT0
+			 * Port Enable/Disable.
+			 */
+			gintsts.d32 = 0;
+			gintsts.b.portintr = 1;
+			DWC_WRITE_REG32(&core_if->core_global_regs->gintsts,gintsts.d32);
+			retval |= 1;
+			gintmsk_reenable.b.portintr = 1;
+
+		}
+		/* Did we actually handle anything? if so, unmask the interrupt */
+//		fiq_print(FIQDBG_INT, otg_dev->hcd->fiq_state, "CILOUT %1d", retval);
+//		fiq_print(FIQDBG_INT, otg_dev->hcd->fiq_state, "%08x", gintsts.d32);
+//		fiq_print(FIQDBG_INT, otg_dev->hcd->fiq_state, "%08x", gintmsk_reenable.d32);
+		if (retval && fiq_enable) {
+			DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gintmsk_reenable.d32);
+		}
+
+	} else {
+		DWC_DEBUGPL(DBG_ANY, "gpwrdn=%08x\n", gpwrdn.d32);
+
+		if (gpwrdn.b.disconn_det && gpwrdn.b.disconn_det_msk) {
+			CLEAR_GPWRDN_INTR(core_if, disconn_det);
+			if (gpwrdn.b.linestate == 0) {
+				dwc_otg_handle_pwrdn_disconnect_intr(core_if);
+			} else {
+				DWC_PRINTF("Disconnect detected while linestate is not 0\n");
+			}
+
+			retval |= 1;
+		}
+		if (gpwrdn.b.lnstschng && gpwrdn.b.lnstchng_msk) {
+			CLEAR_GPWRDN_INTR(core_if, lnstschng);
+			/* remote wakeup from hibernation */
+			if (gpwrdn.b.linestate == 2 || gpwrdn.b.linestate == 1) {
+				dwc_otg_handle_pwrdn_wakeup_detected_intr(core_if);
+			} else {
+				DWC_PRINTF("gpwrdn.linestate = %d\n", gpwrdn.b.linestate);
+			}
+			retval |= 1;
+		}
+		if (gpwrdn.b.rst_det && gpwrdn.b.rst_det_msk) {
+			CLEAR_GPWRDN_INTR(core_if, rst_det);
+			if (gpwrdn.b.linestate == 0) {
+				DWC_PRINTF("Reset detected\n");
+				retval |= dwc_otg_device_hibernation_restore(core_if, 0, 1);
+			}
+		}
+		if (gpwrdn.b.srp_det && gpwrdn.b.srp_det_msk) {
+			CLEAR_GPWRDN_INTR(core_if, srp_det);
+			dwc_otg_handle_pwrdn_srp_intr(core_if);
+			retval |= 1;
+		}
+	}
+	/* Handle ADP interrupt here */
+	if (gpwrdn.b.adp_int) {
+		DWC_PRINTF("ADP interrupt\n");
+		CLEAR_GPWRDN_INTR(core_if, adp_int);
+		dwc_otg_adp_handle_intr(core_if);
+		retval |= 1;
+	}
+	if (gpwrdn.b.sts_chngint && gpwrdn.b.sts_chngint_msk) {
+		DWC_PRINTF("STS CHNG interrupt asserted\n");
+		CLEAR_GPWRDN_INTR(core_if, sts_chngint);
+		dwc_otg_handle_pwrdn_stschng_intr(otg_dev);
+
+		retval |= 1;
+	}
+	if (core_if->lock)
+		DWC_SPINUNLOCK(core_if->lock);
+	return retval;
+}
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_core_if.h b/drivers/usb/host/dwc_otg/dwc_otg_core_if.h
new file mode 100644
index 000000000000..4138fd173337
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_core_if.h
@@ -0,0 +1,705 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_core_if.h $
+ * $Revision: #13 $
+ * $Date: 2012/08/10 $
+ * $Change: 2047372 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#if !defined(__DWC_CORE_IF_H__)
+#define __DWC_CORE_IF_H__
+
+#include "dwc_os.h"
+
+/** @file
+ * This file defines DWC_OTG Core API
+ */
+
+struct dwc_otg_core_if;
+typedef struct dwc_otg_core_if dwc_otg_core_if_t;
+
+/** Maximum number of Periodic FIFOs */
+#define MAX_PERIO_FIFOS 15
+/** Maximum number of Periodic FIFOs */
+#define MAX_TX_FIFOS 15
+
+/** Maximum number of Endpoints/HostChannels */
+#define MAX_EPS_CHANNELS 16
+
+extern dwc_otg_core_if_t *dwc_otg_cil_init(const uint32_t * _reg_base_addr);
+extern void dwc_otg_core_init(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_cil_remove(dwc_otg_core_if_t * _core_if);
+
+extern void dwc_otg_enable_global_interrupts(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_disable_global_interrupts(dwc_otg_core_if_t * _core_if);
+
+extern uint8_t dwc_otg_is_device_mode(dwc_otg_core_if_t * _core_if);
+extern uint8_t dwc_otg_is_host_mode(dwc_otg_core_if_t * _core_if);
+
+extern uint8_t dwc_otg_is_dma_enable(dwc_otg_core_if_t * core_if);
+
+/** This function should be called on every hardware interrupt. */
+extern int32_t dwc_otg_handle_common_intr(void *otg_dev);
+
+/** @name OTG Core Parameters */
+/** @{ */
+
+/**
+ * Specifies the OTG capabilities. The driver will automatically
+ * detect the value for this parameter if none is specified.
+ * 0 - HNP and SRP capable (default)
+ * 1 - SRP Only capable
+ * 2 - No HNP/SRP capable
+ */
+extern int dwc_otg_set_param_otg_cap(dwc_otg_core_if_t * core_if, int32_t val);
+extern int32_t dwc_otg_get_param_otg_cap(dwc_otg_core_if_t * core_if);
+#define DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE 0
+#define DWC_OTG_CAP_PARAM_SRP_ONLY_CAPABLE 1
+#define DWC_OTG_CAP_PARAM_NO_HNP_SRP_CAPABLE 2
+#define dwc_param_otg_cap_default DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE
+
+extern int dwc_otg_set_param_opt(dwc_otg_core_if_t * core_if, int32_t val);
+extern int32_t dwc_otg_get_param_opt(dwc_otg_core_if_t * core_if);
+#define dwc_param_opt_default 1
+
+/**
+ * Specifies whether to use slave or DMA mode for accessing the data
+ * FIFOs. The driver will automatically detect the value for this
+ * parameter if none is specified.
+ * 0 - Slave
+ * 1 - DMA (default, if available)
+ */
+extern int dwc_otg_set_param_dma_enable(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_dma_enable(dwc_otg_core_if_t * core_if);
+#define dwc_param_dma_enable_default 1
+
+/**
+ * When DMA mode is enabled specifies whether to use
+ * address DMA or DMA Descritor mode for accessing the data
+ * FIFOs in device mode. The driver will automatically detect
+ * the value for this parameter if none is specified.
+ * 0 - address DMA
+ * 1 - DMA Descriptor(default, if available)
+ */
+extern int dwc_otg_set_param_dma_desc_enable(dwc_otg_core_if_t * core_if,
+					     int32_t val);
+extern int32_t dwc_otg_get_param_dma_desc_enable(dwc_otg_core_if_t * core_if);
+//#define dwc_param_dma_desc_enable_default 1
+#define dwc_param_dma_desc_enable_default 0 // Broadcom BCM2708
+
+/** The DMA Burst size (applicable only for External DMA
+ * Mode). 1, 4, 8 16, 32, 64, 128, 256 (default 32)
+ */
+extern int dwc_otg_set_param_dma_burst_size(dwc_otg_core_if_t * core_if,
+					    int32_t val);
+extern int32_t dwc_otg_get_param_dma_burst_size(dwc_otg_core_if_t * core_if);
+#define dwc_param_dma_burst_size_default 32
+
+/**
+ * Specifies the maximum speed of operation in host and device mode.
+ * The actual speed depends on the speed of the attached device and
+ * the value of phy_type. The actual speed depends on the speed of the
+ * attached device.
+ * 0 - High Speed (default)
+ * 1 - Full Speed
+ */
+extern int dwc_otg_set_param_speed(dwc_otg_core_if_t * core_if, int32_t val);
+extern int32_t dwc_otg_get_param_speed(dwc_otg_core_if_t * core_if);
+#define dwc_param_speed_default 0
+#define DWC_SPEED_PARAM_HIGH 0
+#define DWC_SPEED_PARAM_FULL 1
+
+/** Specifies whether low power mode is supported when attached
+ *	to a Full Speed or Low Speed device in host mode.
+ * 0 - Don't support low power mode (default)
+ * 1 - Support low power mode
+ */
+extern int dwc_otg_set_param_host_support_fs_ls_low_power(dwc_otg_core_if_t *
+							  core_if, int32_t val);
+extern int32_t dwc_otg_get_param_host_support_fs_ls_low_power(dwc_otg_core_if_t
+							      * core_if);
+#define dwc_param_host_support_fs_ls_low_power_default 0
+
+/** Specifies the PHY clock rate in low power mode when connected to a
+ * Low Speed device in host mode. This parameter is applicable only if
+ * HOST_SUPPORT_FS_LS_LOW_POWER is enabled. If PHY_TYPE is set to FS
+ * then defaults to 6 MHZ otherwise 48 MHZ.
+ *
+ * 0 - 48 MHz
+ * 1 - 6 MHz
+ */
+extern int dwc_otg_set_param_host_ls_low_power_phy_clk(dwc_otg_core_if_t *
+						       core_if, int32_t val);
+extern int32_t dwc_otg_get_param_host_ls_low_power_phy_clk(dwc_otg_core_if_t *
+							   core_if);
+#define dwc_param_host_ls_low_power_phy_clk_default 0
+#define DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_48MHZ 0
+#define DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_6MHZ 1
+
+/**
+ * 0 - Use cC FIFO size parameters
+ * 1 - Allow dynamic FIFO sizing (default)
+ */
+extern int dwc_otg_set_param_enable_dynamic_fifo(dwc_otg_core_if_t * core_if,
+						 int32_t val);
+extern int32_t dwc_otg_get_param_enable_dynamic_fifo(dwc_otg_core_if_t *
+						     core_if);
+#define dwc_param_enable_dynamic_fifo_default 1
+
+/** Total number of 4-byte words in the data FIFO memory. This
+ * memory includes the Rx FIFO, non-periodic Tx FIFO, and periodic
+ * Tx FIFOs.
+ * 32 to 32768 (default 8192)
+ * Note: The total FIFO memory depth in the FPGA configuration is 8192.
+ */
+extern int dwc_otg_set_param_data_fifo_size(dwc_otg_core_if_t * core_if,
+					    int32_t val);
+extern int32_t dwc_otg_get_param_data_fifo_size(dwc_otg_core_if_t * core_if);
+//#define dwc_param_data_fifo_size_default 8192
+#define dwc_param_data_fifo_size_default 0xFF0 // Broadcom BCM2708
+
+/** Number of 4-byte words in the Rx FIFO in device mode when dynamic
+ * FIFO sizing is enabled.
+ * 16 to 32768 (default 1064)
+ */
+extern int dwc_otg_set_param_dev_rx_fifo_size(dwc_otg_core_if_t * core_if,
+					      int32_t val);
+extern int32_t dwc_otg_get_param_dev_rx_fifo_size(dwc_otg_core_if_t * core_if);
+#define dwc_param_dev_rx_fifo_size_default 1064
+
+/** Number of 4-byte words in the non-periodic Tx FIFO in device mode
+ * when dynamic FIFO sizing is enabled.
+ * 16 to 32768 (default 1024)
+ */
+extern int dwc_otg_set_param_dev_nperio_tx_fifo_size(dwc_otg_core_if_t *
+						     core_if, int32_t val);
+extern int32_t dwc_otg_get_param_dev_nperio_tx_fifo_size(dwc_otg_core_if_t *
+							 core_if);
+#define dwc_param_dev_nperio_tx_fifo_size_default 1024
+
+/** Number of 4-byte words in each of the periodic Tx FIFOs in device
+ * mode when dynamic FIFO sizing is enabled.
+ * 4 to 768 (default 256)
+ */
+extern int dwc_otg_set_param_dev_perio_tx_fifo_size(dwc_otg_core_if_t * core_if,
+						    int32_t val, int fifo_num);
+extern int32_t dwc_otg_get_param_dev_perio_tx_fifo_size(dwc_otg_core_if_t *
+							core_if, int fifo_num);
+#define dwc_param_dev_perio_tx_fifo_size_default 256
+
+/** Number of 4-byte words in the Rx FIFO in host mode when dynamic
+ * FIFO sizing is enabled.
+ * 16 to 32768 (default 1024)
+ */
+extern int dwc_otg_set_param_host_rx_fifo_size(dwc_otg_core_if_t * core_if,
+					       int32_t val);
+extern int32_t dwc_otg_get_param_host_rx_fifo_size(dwc_otg_core_if_t * core_if);
+//#define dwc_param_host_rx_fifo_size_default 1024
+#define dwc_param_host_rx_fifo_size_default 774 // Broadcom BCM2708
+
+/** Number of 4-byte words in the non-periodic Tx FIFO in host mode
+ * when Dynamic FIFO sizing is enabled in the core.
+ * 16 to 32768 (default 1024)
+ */
+extern int dwc_otg_set_param_host_nperio_tx_fifo_size(dwc_otg_core_if_t *
+						      core_if, int32_t val);
+extern int32_t dwc_otg_get_param_host_nperio_tx_fifo_size(dwc_otg_core_if_t *
+							  core_if);
+//#define dwc_param_host_nperio_tx_fifo_size_default 1024
+#define dwc_param_host_nperio_tx_fifo_size_default 0x100 // Broadcom BCM2708
+
+/** Number of 4-byte words in the host periodic Tx FIFO when dynamic
+ * FIFO sizing is enabled.
+ * 16 to 32768 (default 1024)
+ */
+extern int dwc_otg_set_param_host_perio_tx_fifo_size(dwc_otg_core_if_t *
+						     core_if, int32_t val);
+extern int32_t dwc_otg_get_param_host_perio_tx_fifo_size(dwc_otg_core_if_t *
+							 core_if);
+//#define dwc_param_host_perio_tx_fifo_size_default 1024
+#define dwc_param_host_perio_tx_fifo_size_default 0x200 // Broadcom BCM2708
+
+/** The maximum transfer size supported in bytes.
+ * 2047 to 65,535  (default 65,535)
+ */
+extern int dwc_otg_set_param_max_transfer_size(dwc_otg_core_if_t * core_if,
+					       int32_t val);
+extern int32_t dwc_otg_get_param_max_transfer_size(dwc_otg_core_if_t * core_if);
+#define dwc_param_max_transfer_size_default 65535
+
+/** The maximum number of packets in a transfer.
+ * 15 to 511  (default 511)
+ */
+extern int dwc_otg_set_param_max_packet_count(dwc_otg_core_if_t * core_if,
+					      int32_t val);
+extern int32_t dwc_otg_get_param_max_packet_count(dwc_otg_core_if_t * core_if);
+#define dwc_param_max_packet_count_default 511
+
+/** The number of host channel registers to use.
+ * 1 to 16 (default 12)
+ * Note: The FPGA configuration supports a maximum of 12 host channels.
+ */
+extern int dwc_otg_set_param_host_channels(dwc_otg_core_if_t * core_if,
+					   int32_t val);
+extern int32_t dwc_otg_get_param_host_channels(dwc_otg_core_if_t * core_if);
+//#define dwc_param_host_channels_default 12
+#define dwc_param_host_channels_default 8 // Broadcom BCM2708
+
+/** The number of endpoints in addition to EP0 available for device
+ * mode operations.
+ * 1 to 15 (default 6 IN and OUT)
+ * Note: The FPGA configuration supports a maximum of 6 IN and OUT
+ * endpoints in addition to EP0.
+ */
+extern int dwc_otg_set_param_dev_endpoints(dwc_otg_core_if_t * core_if,
+					   int32_t val);
+extern int32_t dwc_otg_get_param_dev_endpoints(dwc_otg_core_if_t * core_if);
+#define dwc_param_dev_endpoints_default 6
+
+/**
+ * Specifies the type of PHY interface to use. By default, the driver
+ * will automatically detect the phy_type.
+ *
+ * 0 - Full Speed PHY
+ * 1 - UTMI+ (default)
+ * 2 - ULPI
+ */
+extern int dwc_otg_set_param_phy_type(dwc_otg_core_if_t * core_if, int32_t val);
+extern int32_t dwc_otg_get_param_phy_type(dwc_otg_core_if_t * core_if);
+#define DWC_PHY_TYPE_PARAM_FS 0
+#define DWC_PHY_TYPE_PARAM_UTMI 1
+#define DWC_PHY_TYPE_PARAM_ULPI 2
+#define dwc_param_phy_type_default DWC_PHY_TYPE_PARAM_UTMI
+
+/**
+ * Specifies the UTMI+ Data Width. This parameter is
+ * applicable for a PHY_TYPE of UTMI+ or ULPI. (For a ULPI
+ * PHY_TYPE, this parameter indicates the data width between
+ * the MAC and the ULPI Wrapper.) Also, this parameter is
+ * applicable only if the OTG_HSPHY_WIDTH cC parameter was set
+ * to "8 and 16 bits", meaning that the core has been
+ * configured to work at either data path width.
+ *
+ * 8 or 16 bits (default 16)
+ */
+extern int dwc_otg_set_param_phy_utmi_width(dwc_otg_core_if_t * core_if,
+					    int32_t val);
+extern int32_t dwc_otg_get_param_phy_utmi_width(dwc_otg_core_if_t * core_if);
+//#define dwc_param_phy_utmi_width_default 16
+#define dwc_param_phy_utmi_width_default 8 // Broadcom BCM2708
+
+/**
+ * Specifies whether the ULPI operates at double or single
+ * data rate. This parameter is only applicable if PHY_TYPE is
+ * ULPI.
+ *
+ * 0 - single data rate ULPI interface with 8 bit wide data
+ * bus (default)
+ * 1 - double data rate ULPI interface with 4 bit wide data
+ * bus
+ */
+extern int dwc_otg_set_param_phy_ulpi_ddr(dwc_otg_core_if_t * core_if,
+					  int32_t val);
+extern int32_t dwc_otg_get_param_phy_ulpi_ddr(dwc_otg_core_if_t * core_if);
+#define dwc_param_phy_ulpi_ddr_default 0
+
+/**
+ * Specifies whether to use the internal or external supply to
+ * drive the vbus with a ULPI phy.
+ */
+extern int dwc_otg_set_param_phy_ulpi_ext_vbus(dwc_otg_core_if_t * core_if,
+					       int32_t val);
+extern int32_t dwc_otg_get_param_phy_ulpi_ext_vbus(dwc_otg_core_if_t * core_if);
+#define DWC_PHY_ULPI_INTERNAL_VBUS 0
+#define DWC_PHY_ULPI_EXTERNAL_VBUS 1
+#define dwc_param_phy_ulpi_ext_vbus_default DWC_PHY_ULPI_INTERNAL_VBUS
+
+/**
+ * Specifies whether to use the I2Cinterface for full speed PHY. This
+ * parameter is only applicable if PHY_TYPE is FS.
+ * 0 - No (default)
+ * 1 - Yes
+ */
+extern int dwc_otg_set_param_i2c_enable(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_i2c_enable(dwc_otg_core_if_t * core_if);
+#define dwc_param_i2c_enable_default 0
+
+extern int dwc_otg_set_param_ulpi_fs_ls(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_ulpi_fs_ls(dwc_otg_core_if_t * core_if);
+#define dwc_param_ulpi_fs_ls_default 0
+
+extern int dwc_otg_set_param_ts_dline(dwc_otg_core_if_t * core_if, int32_t val);
+extern int32_t dwc_otg_get_param_ts_dline(dwc_otg_core_if_t * core_if);
+#define dwc_param_ts_dline_default 0
+
+/**
+ * Specifies whether dedicated transmit FIFOs are
+ * enabled for non periodic IN endpoints in device mode
+ * 0 - No
+ * 1 - Yes
+ */
+extern int dwc_otg_set_param_en_multiple_tx_fifo(dwc_otg_core_if_t * core_if,
+						 int32_t val);
+extern int32_t dwc_otg_get_param_en_multiple_tx_fifo(dwc_otg_core_if_t *
+						     core_if);
+#define dwc_param_en_multiple_tx_fifo_default 1
+
+/** Number of 4-byte words in each of the Tx FIFOs in device
+ * mode when dynamic FIFO sizing is enabled.
+ * 4 to 768 (default 256)
+ */
+extern int dwc_otg_set_param_dev_tx_fifo_size(dwc_otg_core_if_t * core_if,
+					      int fifo_num, int32_t val);
+extern int32_t dwc_otg_get_param_dev_tx_fifo_size(dwc_otg_core_if_t * core_if,
+						  int fifo_num);
+#define dwc_param_dev_tx_fifo_size_default 768
+
+/** Thresholding enable flag-
+ * bit 0 - enable non-ISO Tx thresholding
+ * bit 1 - enable ISO Tx thresholding
+ * bit 2 - enable Rx thresholding
+ */
+extern int dwc_otg_set_param_thr_ctl(dwc_otg_core_if_t * core_if, int32_t val);
+extern int32_t dwc_otg_get_thr_ctl(dwc_otg_core_if_t * core_if, int fifo_num);
+#define dwc_param_thr_ctl_default 0
+
+/** Thresholding length for Tx
+ * FIFOs in 32 bit DWORDs
+ */
+extern int dwc_otg_set_param_tx_thr_length(dwc_otg_core_if_t * core_if,
+					   int32_t val);
+extern int32_t dwc_otg_get_tx_thr_length(dwc_otg_core_if_t * core_if);
+#define dwc_param_tx_thr_length_default 64
+
+/** Thresholding length for Rx
+ *	FIFOs in 32 bit DWORDs
+ */
+extern int dwc_otg_set_param_rx_thr_length(dwc_otg_core_if_t * core_if,
+					   int32_t val);
+extern int32_t dwc_otg_get_rx_thr_length(dwc_otg_core_if_t * core_if);
+#define dwc_param_rx_thr_length_default 64
+
+/**
+ * Specifies whether LPM (Link Power Management) support is enabled
+ */
+extern int dwc_otg_set_param_lpm_enable(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_lpm_enable(dwc_otg_core_if_t * core_if);
+#define dwc_param_lpm_enable_default 1
+
+/**
+ * Specifies whether PTI enhancement is enabled
+ */
+extern int dwc_otg_set_param_pti_enable(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_pti_enable(dwc_otg_core_if_t * core_if);
+#define dwc_param_pti_enable_default 0
+
+/**
+ * Specifies whether MPI enhancement is enabled
+ */
+extern int dwc_otg_set_param_mpi_enable(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_mpi_enable(dwc_otg_core_if_t * core_if);
+#define dwc_param_mpi_enable_default 0
+
+/**
+ * Specifies whether ADP capability is enabled
+ */
+extern int dwc_otg_set_param_adp_enable(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_adp_enable(dwc_otg_core_if_t * core_if);
+#define dwc_param_adp_enable_default 0
+
+/**
+ * Specifies whether IC_USB capability is enabled
+ */
+
+extern int dwc_otg_set_param_ic_usb_cap(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_ic_usb_cap(dwc_otg_core_if_t * core_if);
+#define dwc_param_ic_usb_cap_default 0
+
+extern int dwc_otg_set_param_ahb_thr_ratio(dwc_otg_core_if_t * core_if,
+					   int32_t val);
+extern int32_t dwc_otg_get_param_ahb_thr_ratio(dwc_otg_core_if_t * core_if);
+#define dwc_param_ahb_thr_ratio_default 0
+
+extern int dwc_otg_set_param_power_down(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_power_down(dwc_otg_core_if_t * core_if);
+#define dwc_param_power_down_default 0
+
+extern int dwc_otg_set_param_reload_ctl(dwc_otg_core_if_t * core_if,
+					int32_t val);
+extern int32_t dwc_otg_get_param_reload_ctl(dwc_otg_core_if_t * core_if);
+#define dwc_param_reload_ctl_default 0
+
+extern int dwc_otg_set_param_dev_out_nak(dwc_otg_core_if_t * core_if,
+										int32_t val);
+extern int32_t dwc_otg_get_param_dev_out_nak(dwc_otg_core_if_t * core_if);
+#define dwc_param_dev_out_nak_default 0
+
+extern int dwc_otg_set_param_cont_on_bna(dwc_otg_core_if_t * core_if,
+										 int32_t val);
+extern int32_t dwc_otg_get_param_cont_on_bna(dwc_otg_core_if_t * core_if);
+#define dwc_param_cont_on_bna_default 0
+
+extern int dwc_otg_set_param_ahb_single(dwc_otg_core_if_t * core_if,
+										 int32_t val);
+extern int32_t dwc_otg_get_param_ahb_single(dwc_otg_core_if_t * core_if);
+#define dwc_param_ahb_single_default 0
+
+extern int dwc_otg_set_param_otg_ver(dwc_otg_core_if_t * core_if, int32_t val);
+extern int32_t dwc_otg_get_param_otg_ver(dwc_otg_core_if_t * core_if);
+#define dwc_param_otg_ver_default 0
+
+/** @} */
+
+/** @name Access to registers and bit-fields */
+
+/**
+ * Dump core registers and SPRAM
+ */
+extern void dwc_otg_dump_dev_registers(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_dump_spram(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_dump_host_registers(dwc_otg_core_if_t * _core_if);
+extern void dwc_otg_dump_global_registers(dwc_otg_core_if_t * _core_if);
+
+/**
+ * Get host negotiation status.
+ */
+extern uint32_t dwc_otg_get_hnpstatus(dwc_otg_core_if_t * core_if);
+
+/**
+ * Get srp status
+ */
+extern uint32_t dwc_otg_get_srpstatus(dwc_otg_core_if_t * core_if);
+
+/**
+ * Set hnpreq bit in the GOTGCTL register.
+ */
+extern void dwc_otg_set_hnpreq(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get Content of SNPSID register.
+ */
+extern uint32_t dwc_otg_get_gsnpsid(dwc_otg_core_if_t * core_if);
+
+/**
+ * Get current mode.
+ * Returns 0 if in device mode, and 1 if in host mode.
+ */
+extern uint32_t dwc_otg_get_mode(dwc_otg_core_if_t * core_if);
+
+/**
+ * Get value of hnpcapable field in the GUSBCFG register
+ */
+extern uint32_t dwc_otg_get_hnpcapable(dwc_otg_core_if_t * core_if);
+/**
+ * Set value of hnpcapable field in the GUSBCFG register
+ */
+extern void dwc_otg_set_hnpcapable(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get value of srpcapable field in the GUSBCFG register
+ */
+extern uint32_t dwc_otg_get_srpcapable(dwc_otg_core_if_t * core_if);
+/**
+ * Set value of srpcapable field in the GUSBCFG register
+ */
+extern void dwc_otg_set_srpcapable(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get value of devspeed field in the DCFG register
+ */
+extern uint32_t dwc_otg_get_devspeed(dwc_otg_core_if_t * core_if);
+/**
+ * Set value of devspeed field in the DCFG register
+ */
+extern void dwc_otg_set_devspeed(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get the value of busconnected field from the HPRT0 register
+ */
+extern uint32_t dwc_otg_get_busconnected(dwc_otg_core_if_t * core_if);
+
+/**
+ * Gets the device enumeration Speed.
+ */
+extern uint32_t dwc_otg_get_enumspeed(dwc_otg_core_if_t * core_if);
+
+/**
+ * Get value of prtpwr field from the HPRT0 register
+ */
+extern uint32_t dwc_otg_get_prtpower(dwc_otg_core_if_t * core_if);
+
+/**
+ * Get value of flag indicating core state - hibernated or not
+ */
+extern uint32_t dwc_otg_get_core_state(dwc_otg_core_if_t * core_if);
+
+/**
+ * Set value of prtpwr field from the HPRT0 register
+ */
+extern void dwc_otg_set_prtpower(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get value of prtsusp field from the HPRT0 regsiter
+ */
+extern uint32_t dwc_otg_get_prtsuspend(dwc_otg_core_if_t * core_if);
+/**
+ * Set value of prtpwr field from the HPRT0 register
+ */
+extern void dwc_otg_set_prtsuspend(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get value of ModeChTimEn field from the HCFG regsiter
+ */
+extern uint32_t dwc_otg_get_mode_ch_tim(dwc_otg_core_if_t * core_if);
+/**
+ * Set value of ModeChTimEn field from the HCFG regsiter
+ */
+extern void dwc_otg_set_mode_ch_tim(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get value of Fram Interval field from the HFIR regsiter
+ */
+extern uint32_t dwc_otg_get_fr_interval(dwc_otg_core_if_t * core_if);
+/**
+ * Set value of Frame Interval field from the HFIR regsiter
+ */
+extern void dwc_otg_set_fr_interval(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Set value of prtres field from the HPRT0 register
+ *FIXME Remove?
+ */
+extern void dwc_otg_set_prtresume(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get value of rmtwkupsig bit in DCTL register
+ */
+extern uint32_t dwc_otg_get_remotewakesig(dwc_otg_core_if_t * core_if);
+
+/**
+ * Get value of prt_sleep_sts field from the GLPMCFG register
+ */
+extern uint32_t dwc_otg_get_lpm_portsleepstatus(dwc_otg_core_if_t * core_if);
+
+/**
+ * Get value of rem_wkup_en field from the GLPMCFG register
+ */
+extern uint32_t dwc_otg_get_lpm_remotewakeenabled(dwc_otg_core_if_t * core_if);
+
+/**
+ * Get value of appl_resp field from the GLPMCFG register
+ */
+extern uint32_t dwc_otg_get_lpmresponse(dwc_otg_core_if_t * core_if);
+/**
+ * Set value of appl_resp field from the GLPMCFG register
+ */
+extern void dwc_otg_set_lpmresponse(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get value of hsic_connect field from the GLPMCFG register
+ */
+extern uint32_t dwc_otg_get_hsic_connect(dwc_otg_core_if_t * core_if);
+/**
+ * Set value of hsic_connect field from the GLPMCFG register
+ */
+extern void dwc_otg_set_hsic_connect(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * Get value of inv_sel_hsic field from the GLPMCFG register.
+ */
+extern uint32_t dwc_otg_get_inv_sel_hsic(dwc_otg_core_if_t * core_if);
+/**
+ * Set value of inv_sel_hsic field from the GLPMFG register.
+ */
+extern void dwc_otg_set_inv_sel_hsic(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/*
+ * Some functions for accessing registers
+ */
+
+/**
+ *  GOTGCTL register
+ */
+extern uint32_t dwc_otg_get_gotgctl(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_set_gotgctl(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * GUSBCFG register
+ */
+extern uint32_t dwc_otg_get_gusbcfg(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_set_gusbcfg(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * GRXFSIZ register
+ */
+extern uint32_t dwc_otg_get_grxfsiz(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_set_grxfsiz(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * GNPTXFSIZ register
+ */
+extern uint32_t dwc_otg_get_gnptxfsiz(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_set_gnptxfsiz(dwc_otg_core_if_t * core_if, uint32_t val);
+
+extern uint32_t dwc_otg_get_gpvndctl(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_set_gpvndctl(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * GGPIO register
+ */
+extern uint32_t dwc_otg_get_ggpio(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_set_ggpio(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * GUID register
+ */
+extern uint32_t dwc_otg_get_guid(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_set_guid(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * HPRT0 register
+ */
+extern uint32_t dwc_otg_get_hprt0(dwc_otg_core_if_t * core_if);
+extern void dwc_otg_set_hprt0(dwc_otg_core_if_t * core_if, uint32_t val);
+
+/**
+ * GHPTXFSIZE
+ */
+extern uint32_t dwc_otg_get_hptxfsiz(dwc_otg_core_if_t * core_if);
+
+/** @} */
+
+#endif				/* __DWC_CORE_IF_H__ */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_dbg.h b/drivers/usb/host/dwc_otg/dwc_otg_dbg.h
new file mode 100644
index 000000000000..ccc24e010e44
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_dbg.h
@@ -0,0 +1,117 @@
+/* ==========================================================================
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+#ifndef __DWC_OTG_DBG_H__
+#define __DWC_OTG_DBG_H__
+
+/** @file
+ * This file defines debug levels.
+ * Debugging support vanishes in non-debug builds.
+ */
+
+/**
+ * The Debug Level bit-mask variable.
+ */
+extern uint32_t g_dbg_lvl;
+/**
+ * Set the Debug Level variable.
+ */
+static inline uint32_t SET_DEBUG_LEVEL(const uint32_t new)
+{
+	uint32_t old = g_dbg_lvl;
+	g_dbg_lvl = new;
+	return old;
+}
+
+#define DBG_USER	(0x1)
+/** When debug level has the DBG_CIL bit set, display CIL Debug messages. */
+#define DBG_CIL		(0x2)
+/** When debug level has the DBG_CILV bit set, display CIL Verbose debug
+ * messages */
+#define DBG_CILV	(0x20)
+/**  When debug level has the DBG_PCD bit set, display PCD (Device) debug
+ *  messages */
+#define DBG_PCD		(0x4)
+/** When debug level has the DBG_PCDV set, display PCD (Device) Verbose debug
+ * messages */
+#define DBG_PCDV	(0x40)
+/** When debug level has the DBG_HCD bit set, display Host debug messages */
+#define DBG_HCD		(0x8)
+/** When debug level has the DBG_HCDV bit set, display Verbose Host debug
+ * messages */
+#define DBG_HCDV	(0x80)
+/** When debug level has the DBG_HCD_URB bit set, display enqueued URBs in host
+ *  mode. */
+#define DBG_HCD_URB	(0x800)
+/** When debug level has the DBG_HCDI bit set, display host interrupt
+ *  messages. */
+#define DBG_HCDI	(0x1000)
+
+/** When debug level has any bit set, display debug messages */
+#define DBG_ANY		(0xFF)
+
+/** All debug messages off */
+#define DBG_OFF		0
+
+/** Prefix string for DWC_DEBUG print macros. */
+#define USB_DWC "DWC_otg: "
+
+/**
+ * Print a debug message when the Global debug level variable contains
+ * the bit defined in <code>lvl</code>.
+ *
+ * @param[in] lvl - Debug level, use one of the DBG_ constants above.
+ * @param[in] x - like printf
+ *
+ *    Example:<p>
+ * <code>
+ *      DWC_DEBUGPL( DBG_ANY, "%s(%p)\n", __func__, _reg_base_addr);
+ * </code>
+ * <br>
+ * results in:<br>
+ * <code>
+ * usb-DWC_otg: dwc_otg_cil_init(ca867000)
+ * </code>
+ */
+#ifdef DEBUG
+
+# define DWC_DEBUGPL(lvl, x...) do{ if ((lvl)&g_dbg_lvl)__DWC_DEBUG(USB_DWC x ); }while(0)
+# define DWC_DEBUGP(x...)	DWC_DEBUGPL(DBG_ANY, x )
+
+# define CHK_DEBUG_LEVEL(level) ((level) & g_dbg_lvl)
+
+#else
+
+# define DWC_DEBUGPL(lvl, x...) do{}while(0)
+# define DWC_DEBUGP(x...)
+
+# define CHK_DEBUG_LEVEL(level) (0)
+
+#endif /*DEBUG*/
+#endif
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_driver.c b/drivers/usb/host/dwc_otg/dwc_otg_driver.c
new file mode 100644
index 000000000000..e945900c503c
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_driver.c
@@ -0,0 +1,1767 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_driver.c $
+ * $Revision: #92 $
+ * $Date: 2012/08/10 $
+ * $Change: 2047372 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+/** @file
+ * The dwc_otg_driver module provides the initialization and cleanup entry
+ * points for the DWC_otg driver. This module will be dynamically installed
+ * after Linux is booted using the insmod command. When the module is
+ * installed, the dwc_otg_driver_init function is called. When the module is
+ * removed (using rmmod), the dwc_otg_driver_cleanup function is called.
+ *
+ * This module also defines a data structure for the dwc_otg_driver, which is
+ * used in conjunction with the standard ARM lm_device structure. These
+ * structures allow the OTG driver to comply with the standard Linux driver
+ * model in which devices and drivers are registered with a bus driver. This
+ * has the benefit that Linux can expose attributes of the driver and device
+ * in its special sysfs file system. Users can then read or write files in
+ * this file system to perform diagnostics on the driver components or the
+ * device.
+ */
+
+#include "dwc_otg_os_dep.h"
+#include "dwc_os.h"
+#include "dwc_otg_dbg.h"
+#include "dwc_otg_driver.h"
+#include "dwc_otg_attr.h"
+#include "dwc_otg_core_if.h"
+#include "dwc_otg_pcd_if.h"
+#include "dwc_otg_hcd_if.h"
+#include "dwc_otg_fiq_fsm.h"
+
+#define DWC_DRIVER_VERSION	"3.00a 10-AUG-2012"
+#define DWC_DRIVER_DESC		"HS OTG USB Controller driver"
+
+bool microframe_schedule=true;
+
+static const char dwc_driver_name[] = "dwc_otg";
+
+
+extern int pcd_init(
+#ifdef LM_INTERFACE
+			   struct lm_device *_dev
+#elif  defined(PCI_INTERFACE)
+			   struct pci_dev *_dev
+#elif  defined(PLATFORM_INTERFACE)
+	struct platform_device *dev
+#endif
+    );
+extern int hcd_init(
+#ifdef LM_INTERFACE
+			   struct lm_device *_dev
+#elif  defined(PCI_INTERFACE)
+			   struct pci_dev *_dev
+#elif  defined(PLATFORM_INTERFACE)
+	struct platform_device *dev
+#endif
+    );
+
+extern int pcd_remove(
+#ifdef LM_INTERFACE
+			     struct lm_device *_dev
+#elif  defined(PCI_INTERFACE)
+			     struct pci_dev *_dev
+#elif  defined(PLATFORM_INTERFACE)
+	struct platform_device *_dev
+#endif
+    );
+
+extern void hcd_remove(
+#ifdef LM_INTERFACE
+			      struct lm_device *_dev
+#elif  defined(PCI_INTERFACE)
+			      struct pci_dev *_dev
+#elif  defined(PLATFORM_INTERFACE)
+	struct platform_device *_dev
+#endif
+    );
+
+extern void dwc_otg_adp_start(dwc_otg_core_if_t * core_if, uint8_t is_host);
+
+/*-------------------------------------------------------------------------*/
+/* Encapsulate the module parameter settings */
+
+struct dwc_otg_driver_module_params {
+	int32_t opt;
+	int32_t otg_cap;
+	int32_t dma_enable;
+	int32_t dma_desc_enable;
+	int32_t dma_burst_size;
+	int32_t speed;
+	int32_t host_support_fs_ls_low_power;
+	int32_t host_ls_low_power_phy_clk;
+	int32_t enable_dynamic_fifo;
+	int32_t data_fifo_size;
+	int32_t dev_rx_fifo_size;
+	int32_t dev_nperio_tx_fifo_size;
+	uint32_t dev_perio_tx_fifo_size[MAX_PERIO_FIFOS];
+	int32_t host_rx_fifo_size;
+	int32_t host_nperio_tx_fifo_size;
+	int32_t host_perio_tx_fifo_size;
+	int32_t max_transfer_size;
+	int32_t max_packet_count;
+	int32_t host_channels;
+	int32_t dev_endpoints;
+	int32_t phy_type;
+	int32_t phy_utmi_width;
+	int32_t phy_ulpi_ddr;
+	int32_t phy_ulpi_ext_vbus;
+	int32_t i2c_enable;
+	int32_t ulpi_fs_ls;
+	int32_t ts_dline;
+	int32_t en_multiple_tx_fifo;
+	uint32_t dev_tx_fifo_size[MAX_TX_FIFOS];
+	uint32_t thr_ctl;
+	uint32_t tx_thr_length;
+	uint32_t rx_thr_length;
+	int32_t pti_enable;
+	int32_t mpi_enable;
+	int32_t lpm_enable;
+	int32_t ic_usb_cap;
+	int32_t ahb_thr_ratio;
+	int32_t power_down;
+	int32_t reload_ctl;
+	int32_t dev_out_nak;
+	int32_t cont_on_bna;
+	int32_t ahb_single;
+	int32_t otg_ver;
+	int32_t adp_enable;
+};
+
+static struct dwc_otg_driver_module_params dwc_otg_module_params = {
+	.opt = -1,
+	.otg_cap = -1,
+	.dma_enable = -1,
+	.dma_desc_enable = -1,
+	.dma_burst_size = -1,
+	.speed = -1,
+	.host_support_fs_ls_low_power = -1,
+	.host_ls_low_power_phy_clk = -1,
+	.enable_dynamic_fifo = -1,
+	.data_fifo_size = -1,
+	.dev_rx_fifo_size = -1,
+	.dev_nperio_tx_fifo_size = -1,
+	.dev_perio_tx_fifo_size = {
+				   /* dev_perio_tx_fifo_size_1 */
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1,
+				   -1
+				   /* 15 */
+				   },
+	.host_rx_fifo_size = -1,
+	.host_nperio_tx_fifo_size = -1,
+	.host_perio_tx_fifo_size = -1,
+	.max_transfer_size = -1,
+	.max_packet_count = -1,
+	.host_channels = -1,
+	.dev_endpoints = -1,
+	.phy_type = -1,
+	.phy_utmi_width = -1,
+	.phy_ulpi_ddr = -1,
+	.phy_ulpi_ext_vbus = -1,
+	.i2c_enable = -1,
+	.ulpi_fs_ls = -1,
+	.ts_dline = -1,
+	.en_multiple_tx_fifo = -1,
+	.dev_tx_fifo_size = {
+			     /* dev_tx_fifo_size */
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1,
+			     -1
+			     /* 15 */
+			     },
+	.thr_ctl = -1,
+	.tx_thr_length = -1,
+	.rx_thr_length = -1,
+	.pti_enable = -1,
+	.mpi_enable = -1,
+	.lpm_enable = 0,
+	.ic_usb_cap = -1,
+	.ahb_thr_ratio = -1,
+	.power_down = -1,
+	.reload_ctl = -1,
+	.dev_out_nak = -1,
+	.cont_on_bna = -1,
+	.ahb_single = -1,
+	.otg_ver = -1,
+	.adp_enable = -1,
+};
+
+//Global variable to switch the fiq fix on or off
+bool fiq_enable = 1;
+// Global variable to enable the split transaction fix
+bool fiq_fsm_enable = true;
+//Bulk split-transaction NAK holdoff in microframes
+uint16_t nak_holdoff = 8;
+
+//Force host mode during CIL re-init
+bool cil_force_host = true;
+
+unsigned short fiq_fsm_mask = 0x0F;
+
+unsigned short int_ep_interval_min = 0;
+/**
+ * This function shows the Driver Version.
+ */
+static ssize_t version_show(struct device_driver *dev, char *buf)
+{
+	return snprintf(buf, sizeof(DWC_DRIVER_VERSION) + 2, "%s\n",
+			DWC_DRIVER_VERSION);
+}
+
+static DRIVER_ATTR_RO(version);
+
+/**
+ * Global Debug Level Mask.
+ */
+uint32_t g_dbg_lvl = 0;		/* OFF */
+
+/**
+ * This function shows the driver Debug Level.
+ */
+static ssize_t debuglevel_show(struct device_driver *drv, char *buf)
+{
+	return sprintf(buf, "0x%0x\n", g_dbg_lvl);
+}
+
+/**
+ * This function stores the driver Debug Level.
+ */
+static ssize_t debuglevel_store(struct device_driver *drv, const char *buf,
+			       size_t count)
+{
+	g_dbg_lvl = simple_strtoul(buf, NULL, 16);
+	return count;
+}
+
+static DRIVER_ATTR_RW(debuglevel);
+
+/**
+ * This function is called during module intialization
+ * to pass module parameters to the DWC_OTG CORE.
+ */
+static int set_parameters(dwc_otg_core_if_t * core_if)
+{
+	int retval = 0;
+	int i;
+
+	if (dwc_otg_module_params.otg_cap != -1) {
+		retval +=
+		    dwc_otg_set_param_otg_cap(core_if,
+					      dwc_otg_module_params.otg_cap);
+	}
+	if (dwc_otg_module_params.dma_enable != -1) {
+		retval +=
+		    dwc_otg_set_param_dma_enable(core_if,
+						 dwc_otg_module_params.
+						 dma_enable);
+	}
+	if (dwc_otg_module_params.dma_desc_enable != -1) {
+		retval +=
+		    dwc_otg_set_param_dma_desc_enable(core_if,
+						      dwc_otg_module_params.
+						      dma_desc_enable);
+	}
+	if (dwc_otg_module_params.opt != -1) {
+		retval +=
+		    dwc_otg_set_param_opt(core_if, dwc_otg_module_params.opt);
+	}
+	if (dwc_otg_module_params.dma_burst_size != -1) {
+		retval +=
+		    dwc_otg_set_param_dma_burst_size(core_if,
+						     dwc_otg_module_params.
+						     dma_burst_size);
+	}
+	if (dwc_otg_module_params.host_support_fs_ls_low_power != -1) {
+		retval +=
+		    dwc_otg_set_param_host_support_fs_ls_low_power(core_if,
+								   dwc_otg_module_params.
+								   host_support_fs_ls_low_power);
+	}
+	if (dwc_otg_module_params.enable_dynamic_fifo != -1) {
+		retval +=
+		    dwc_otg_set_param_enable_dynamic_fifo(core_if,
+							  dwc_otg_module_params.
+							  enable_dynamic_fifo);
+	}
+	if (dwc_otg_module_params.data_fifo_size != -1) {
+		retval +=
+		    dwc_otg_set_param_data_fifo_size(core_if,
+						     dwc_otg_module_params.
+						     data_fifo_size);
+	}
+	if (dwc_otg_module_params.dev_rx_fifo_size != -1) {
+		retval +=
+		    dwc_otg_set_param_dev_rx_fifo_size(core_if,
+						       dwc_otg_module_params.
+						       dev_rx_fifo_size);
+	}
+	if (dwc_otg_module_params.dev_nperio_tx_fifo_size != -1) {
+		retval +=
+		    dwc_otg_set_param_dev_nperio_tx_fifo_size(core_if,
+							      dwc_otg_module_params.
+							      dev_nperio_tx_fifo_size);
+	}
+	if (dwc_otg_module_params.host_rx_fifo_size != -1) {
+		retval +=
+		    dwc_otg_set_param_host_rx_fifo_size(core_if,
+							dwc_otg_module_params.host_rx_fifo_size);
+	}
+	if (dwc_otg_module_params.host_nperio_tx_fifo_size != -1) {
+		retval +=
+		    dwc_otg_set_param_host_nperio_tx_fifo_size(core_if,
+							       dwc_otg_module_params.
+							       host_nperio_tx_fifo_size);
+	}
+	if (dwc_otg_module_params.host_perio_tx_fifo_size != -1) {
+		retval +=
+		    dwc_otg_set_param_host_perio_tx_fifo_size(core_if,
+							      dwc_otg_module_params.
+							      host_perio_tx_fifo_size);
+	}
+	if (dwc_otg_module_params.max_transfer_size != -1) {
+		retval +=
+		    dwc_otg_set_param_max_transfer_size(core_if,
+							dwc_otg_module_params.
+							max_transfer_size);
+	}
+	if (dwc_otg_module_params.max_packet_count != -1) {
+		retval +=
+		    dwc_otg_set_param_max_packet_count(core_if,
+						       dwc_otg_module_params.
+						       max_packet_count);
+	}
+	if (dwc_otg_module_params.host_channels != -1) {
+		retval +=
+		    dwc_otg_set_param_host_channels(core_if,
+						    dwc_otg_module_params.
+						    host_channels);
+	}
+	if (dwc_otg_module_params.dev_endpoints != -1) {
+		retval +=
+		    dwc_otg_set_param_dev_endpoints(core_if,
+						    dwc_otg_module_params.
+						    dev_endpoints);
+	}
+	if (dwc_otg_module_params.phy_type != -1) {
+		retval +=
+		    dwc_otg_set_param_phy_type(core_if,
+					       dwc_otg_module_params.phy_type);
+	}
+	if (dwc_otg_module_params.speed != -1) {
+		retval +=
+		    dwc_otg_set_param_speed(core_if,
+					    dwc_otg_module_params.speed);
+	}
+	if (dwc_otg_module_params.host_ls_low_power_phy_clk != -1) {
+		retval +=
+		    dwc_otg_set_param_host_ls_low_power_phy_clk(core_if,
+								dwc_otg_module_params.
+								host_ls_low_power_phy_clk);
+	}
+	if (dwc_otg_module_params.phy_ulpi_ddr != -1) {
+		retval +=
+		    dwc_otg_set_param_phy_ulpi_ddr(core_if,
+						   dwc_otg_module_params.
+						   phy_ulpi_ddr);
+	}
+	if (dwc_otg_module_params.phy_ulpi_ext_vbus != -1) {
+		retval +=
+		    dwc_otg_set_param_phy_ulpi_ext_vbus(core_if,
+							dwc_otg_module_params.
+							phy_ulpi_ext_vbus);
+	}
+	if (dwc_otg_module_params.phy_utmi_width != -1) {
+		retval +=
+		    dwc_otg_set_param_phy_utmi_width(core_if,
+						     dwc_otg_module_params.
+						     phy_utmi_width);
+	}
+	if (dwc_otg_module_params.ulpi_fs_ls != -1) {
+		retval +=
+		    dwc_otg_set_param_ulpi_fs_ls(core_if,
+						 dwc_otg_module_params.ulpi_fs_ls);
+	}
+	if (dwc_otg_module_params.ts_dline != -1) {
+		retval +=
+		    dwc_otg_set_param_ts_dline(core_if,
+					       dwc_otg_module_params.ts_dline);
+	}
+	if (dwc_otg_module_params.i2c_enable != -1) {
+		retval +=
+		    dwc_otg_set_param_i2c_enable(core_if,
+						 dwc_otg_module_params.
+						 i2c_enable);
+	}
+	if (dwc_otg_module_params.en_multiple_tx_fifo != -1) {
+		retval +=
+		    dwc_otg_set_param_en_multiple_tx_fifo(core_if,
+							  dwc_otg_module_params.
+							  en_multiple_tx_fifo);
+	}
+	for (i = 0; i < 15; i++) {
+		if (dwc_otg_module_params.dev_perio_tx_fifo_size[i] != -1) {
+			retval +=
+			    dwc_otg_set_param_dev_perio_tx_fifo_size(core_if,
+								     dwc_otg_module_params.
+								     dev_perio_tx_fifo_size
+								     [i], i);
+		}
+	}
+
+	for (i = 0; i < 15; i++) {
+		if (dwc_otg_module_params.dev_tx_fifo_size[i] != -1) {
+			retval += dwc_otg_set_param_dev_tx_fifo_size(core_if,
+								     dwc_otg_module_params.
+								     dev_tx_fifo_size
+								     [i], i);
+		}
+	}
+	if (dwc_otg_module_params.thr_ctl != -1) {
+		retval +=
+		    dwc_otg_set_param_thr_ctl(core_if,
+					      dwc_otg_module_params.thr_ctl);
+	}
+	if (dwc_otg_module_params.mpi_enable != -1) {
+		retval +=
+		    dwc_otg_set_param_mpi_enable(core_if,
+						 dwc_otg_module_params.
+						 mpi_enable);
+	}
+	if (dwc_otg_module_params.pti_enable != -1) {
+		retval +=
+		    dwc_otg_set_param_pti_enable(core_if,
+						 dwc_otg_module_params.
+						 pti_enable);
+	}
+	if (dwc_otg_module_params.lpm_enable != -1) {
+		retval +=
+		    dwc_otg_set_param_lpm_enable(core_if,
+						 dwc_otg_module_params.
+						 lpm_enable);
+	}
+	if (dwc_otg_module_params.ic_usb_cap != -1) {
+		retval +=
+		    dwc_otg_set_param_ic_usb_cap(core_if,
+						 dwc_otg_module_params.
+						 ic_usb_cap);
+	}
+	if (dwc_otg_module_params.tx_thr_length != -1) {
+		retval +=
+		    dwc_otg_set_param_tx_thr_length(core_if,
+						    dwc_otg_module_params.tx_thr_length);
+	}
+	if (dwc_otg_module_params.rx_thr_length != -1) {
+		retval +=
+		    dwc_otg_set_param_rx_thr_length(core_if,
+						    dwc_otg_module_params.
+						    rx_thr_length);
+	}
+	if (dwc_otg_module_params.ahb_thr_ratio != -1) {
+		retval +=
+		    dwc_otg_set_param_ahb_thr_ratio(core_if,
+						    dwc_otg_module_params.ahb_thr_ratio);
+	}
+	if (dwc_otg_module_params.power_down != -1) {
+		retval +=
+		    dwc_otg_set_param_power_down(core_if,
+						 dwc_otg_module_params.power_down);
+	}
+	if (dwc_otg_module_params.reload_ctl != -1) {
+		retval +=
+		    dwc_otg_set_param_reload_ctl(core_if,
+						 dwc_otg_module_params.reload_ctl);
+	}
+
+	if (dwc_otg_module_params.dev_out_nak != -1) {
+		retval +=
+			dwc_otg_set_param_dev_out_nak(core_if,
+			dwc_otg_module_params.dev_out_nak);
+	}
+
+	if (dwc_otg_module_params.cont_on_bna != -1) {
+		retval +=
+			dwc_otg_set_param_cont_on_bna(core_if,
+			dwc_otg_module_params.cont_on_bna);
+	}
+
+	if (dwc_otg_module_params.ahb_single != -1) {
+		retval +=
+			dwc_otg_set_param_ahb_single(core_if,
+			dwc_otg_module_params.ahb_single);
+	}
+
+	if (dwc_otg_module_params.otg_ver != -1) {
+		retval +=
+		    dwc_otg_set_param_otg_ver(core_if,
+					      dwc_otg_module_params.otg_ver);
+	}
+	if (dwc_otg_module_params.adp_enable != -1) {
+		retval +=
+		    dwc_otg_set_param_adp_enable(core_if,
+						 dwc_otg_module_params.
+						 adp_enable);
+	}
+	return retval;
+}
+
+/**
+ * This function is the top level interrupt handler for the Common
+ * (Device and host modes) interrupts.
+ */
+static irqreturn_t dwc_otg_common_irq(int irq, void *dev)
+{
+	int32_t retval = IRQ_NONE;
+
+	retval = dwc_otg_handle_common_intr(dev);
+	if (retval != 0) {
+		S3C2410X_CLEAR_EINTPEND();
+	}
+	return IRQ_RETVAL(retval);
+}
+
+/**
+ * This function is called when a lm_device is unregistered with the
+ * dwc_otg_driver. This happens, for example, when the rmmod command is
+ * executed. The device may or may not be electrically present. If it is
+ * present, the driver stops device processing. Any resources used on behalf
+ * of this device are freed.
+ *
+ * @param _dev
+ */
+#ifdef LM_INTERFACE
+#define REM_RETVAL(n)
+static void dwc_otg_driver_remove(	 struct lm_device *_dev )
+{       dwc_otg_device_t *otg_dev = lm_get_drvdata(_dev);
+#elif  defined(PCI_INTERFACE)
+#define REM_RETVAL(n)
+static void dwc_otg_driver_remove(	 struct pci_dev *_dev )
+{	dwc_otg_device_t *otg_dev = pci_get_drvdata(_dev);
+#elif  defined(PLATFORM_INTERFACE)
+#define REM_RETVAL(n) n
+static int dwc_otg_driver_remove(        struct platform_device *_dev )
+{       dwc_otg_device_t *otg_dev = platform_get_drvdata(_dev);
+#endif
+
+	DWC_DEBUGPL(DBG_ANY, "%s(%p) otg_dev %p\n", __func__, _dev, otg_dev);
+
+	if (!otg_dev) {
+		/* Memory allocation for the dwc_otg_device failed. */
+		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev NULL!\n", __func__);
+                return REM_RETVAL(-ENOMEM);
+	}
+#ifndef DWC_DEVICE_ONLY
+	if (otg_dev->hcd) {
+		hcd_remove(_dev);
+	} else {
+		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev->hcd NULL!\n", __func__);
+                return REM_RETVAL(-EINVAL);
+	}
+#endif
+
+#ifndef DWC_HOST_ONLY
+	if (otg_dev->pcd) {
+		pcd_remove(_dev);
+	} else {
+		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev->pcd NULL!\n", __func__);
+                return REM_RETVAL(-EINVAL);
+	}
+#endif
+	/*
+	 * Free the IRQ
+	 */
+	if (otg_dev->common_irq_installed) {
+#ifdef PLATFORM_INTERFACE
+		free_irq(platform_get_irq(_dev, 0), otg_dev);
+#else
+		free_irq(_dev->irq, otg_dev);
+#endif
+        } else {
+		DWC_DEBUGPL(DBG_ANY, "%s: There is no installed irq!\n", __func__);
+		return REM_RETVAL(-ENXIO);
+	}
+
+	if (otg_dev->core_if) {
+		dwc_otg_cil_remove(otg_dev->core_if);
+	} else {
+		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev->core_if NULL!\n", __func__);
+		return REM_RETVAL(-ENXIO);
+	}
+
+	/*
+	 * Remove the device attributes
+	 */
+	dwc_otg_attr_remove(_dev);
+
+	/*
+	 * Return the memory.
+	 */
+	if (otg_dev->os_dep.base) {
+		iounmap(otg_dev->os_dep.base);
+	}
+	DWC_FREE(otg_dev);
+
+	/*
+	 * Clear the drvdata pointer.
+	 */
+#ifdef LM_INTERFACE
+	lm_set_drvdata(_dev, 0);
+#elif defined(PCI_INTERFACE)
+        release_mem_region(otg_dev->os_dep.rsrc_start,
+                           otg_dev->os_dep.rsrc_len);
+	pci_set_drvdata(_dev, 0);
+#elif  defined(PLATFORM_INTERFACE)
+        platform_set_drvdata(_dev, 0);
+#endif
+        return REM_RETVAL(0);
+}
+
+/**
+ * This function is called when an lm_device is bound to a
+ * dwc_otg_driver. It creates the driver components required to
+ * control the device (CIL, HCD, and PCD) and it initializes the
+ * device. The driver components are stored in a dwc_otg_device
+ * structure. A reference to the dwc_otg_device is saved in the
+ * lm_device. This allows the driver to access the dwc_otg_device
+ * structure on subsequent calls to driver methods for this device.
+ *
+ * @param _dev Bus device
+ */
+static int dwc_otg_driver_probe(
+#ifdef LM_INTERFACE
+				       struct lm_device *_dev
+#elif defined(PCI_INTERFACE)
+				       struct pci_dev *_dev,
+				       const struct pci_device_id *id
+#elif  defined(PLATFORM_INTERFACE)
+                                       struct platform_device *_dev
+#endif
+    )
+{
+	int retval = 0;
+	dwc_otg_device_t *dwc_otg_device;
+        int devirq;
+
+	dev_dbg(&_dev->dev, "dwc_otg_driver_probe(%p)\n", _dev);
+#ifdef LM_INTERFACE
+	dev_dbg(&_dev->dev, "start=0x%08x\n", (unsigned)_dev->resource.start);
+#elif defined(PCI_INTERFACE)
+	if (!id) {
+		DWC_ERROR("Invalid pci_device_id %p", id);
+		return -EINVAL;
+	}
+
+	if (!_dev || (pci_enable_device(_dev) < 0)) {
+		DWC_ERROR("Invalid pci_device %p", _dev);
+		return -ENODEV;
+	}
+	dev_dbg(&_dev->dev, "start=0x%08x\n", (unsigned)pci_resource_start(_dev,0));
+	/* other stuff needed as well? */
+
+#elif  defined(PLATFORM_INTERFACE)
+	dev_dbg(&_dev->dev, "start=0x%08x (len 0x%x)\n",
+                (unsigned)_dev->resource->start,
+                (unsigned)(_dev->resource->end - _dev->resource->start));
+#endif
+
+	dwc_otg_device = DWC_ALLOC(sizeof(dwc_otg_device_t));
+
+	if (!dwc_otg_device) {
+		dev_err(&_dev->dev, "kmalloc of dwc_otg_device failed\n");
+		return -ENOMEM;
+	}
+
+	memset(dwc_otg_device, 0, sizeof(*dwc_otg_device));
+	dwc_otg_device->os_dep.reg_offset = 0xFFFFFFFF;
+	dwc_otg_device->os_dep.platformdev = _dev;
+
+	/*
+	 * Map the DWC_otg Core memory into virtual address space.
+	 */
+#ifdef LM_INTERFACE
+	dwc_otg_device->os_dep.base = ioremap(_dev->resource.start, SZ_256K);
+
+	if (!dwc_otg_device->os_dep.base) {
+		dev_err(&_dev->dev, "ioremap() failed\n");
+		DWC_FREE(dwc_otg_device);
+		return -ENOMEM;
+	}
+	dev_dbg(&_dev->dev, "base=0x%08x\n",
+		(unsigned)dwc_otg_device->os_dep.base);
+#elif defined(PCI_INTERFACE)
+	_dev->current_state = PCI_D0;
+	_dev->dev.power.power_state = PMSG_ON;
+
+	if (!_dev->irq) {
+		DWC_ERROR("Found HC with no IRQ. Check BIOS/PCI %s setup!",
+			  pci_name(_dev));
+		iounmap(dwc_otg_device->os_dep.base);
+		DWC_FREE(dwc_otg_device);
+		return -ENODEV;
+	}
+
+	dwc_otg_device->os_dep.rsrc_start = pci_resource_start(_dev, 0);
+	dwc_otg_device->os_dep.rsrc_len = pci_resource_len(_dev, 0);
+	DWC_DEBUGPL(DBG_ANY, "PCI resource: start=%08x, len=%08x\n",
+		    (unsigned)dwc_otg_device->os_dep.rsrc_start,
+		    (unsigned)dwc_otg_device->os_dep.rsrc_len);
+	if (!request_mem_region
+	    (dwc_otg_device->os_dep.rsrc_start, dwc_otg_device->os_dep.rsrc_len,
+	     "dwc_otg")) {
+		dev_dbg(&_dev->dev, "error requesting memory\n");
+		iounmap(dwc_otg_device->os_dep.base);
+		DWC_FREE(dwc_otg_device);
+		return -EFAULT;
+	}
+
+	dwc_otg_device->os_dep.base =
+	    ioremap_nocache(dwc_otg_device->os_dep.rsrc_start,
+			    dwc_otg_device->os_dep.rsrc_len);
+	if (dwc_otg_device->os_dep.base == NULL) {
+		dev_dbg(&_dev->dev, "error mapping memory\n");
+		release_mem_region(dwc_otg_device->os_dep.rsrc_start,
+				   dwc_otg_device->os_dep.rsrc_len);
+		iounmap(dwc_otg_device->os_dep.base);
+		DWC_FREE(dwc_otg_device);
+		return -EFAULT;
+	}
+	dev_dbg(&_dev->dev, "base=0x%p (before adjust) \n",
+		dwc_otg_device->os_dep.base);
+	dwc_otg_device->os_dep.base = (char *)dwc_otg_device->os_dep.base;
+	dev_dbg(&_dev->dev, "base=0x%p (after adjust) \n",
+		dwc_otg_device->os_dep.base);
+	dev_dbg(&_dev->dev, "%s: mapped PA 0x%x to VA 0x%p\n", __func__,
+		(unsigned)dwc_otg_device->os_dep.rsrc_start,
+		dwc_otg_device->os_dep.base);
+
+	pci_set_master(_dev);
+	pci_set_drvdata(_dev, dwc_otg_device);
+#elif defined(PLATFORM_INTERFACE)
+        DWC_DEBUGPL(DBG_ANY,"Platform resource: start=%08x, len=%08x\n",
+                    _dev->resource->start,
+                    _dev->resource->end - _dev->resource->start + 1);
+#if 1
+        if (!request_mem_region(_dev->resource[0].start,
+                                _dev->resource[0].end - _dev->resource[0].start + 1,
+                                "dwc_otg")) {
+          dev_dbg(&_dev->dev, "error reserving mapped memory\n");
+          retval = -EFAULT;
+          goto fail;
+        }
+
+	dwc_otg_device->os_dep.base = ioremap_nocache(_dev->resource[0].start,
+                                                      _dev->resource[0].end -
+                                                      _dev->resource[0].start+1);
+	if (fiq_enable)
+	{
+		if (!request_mem_region(_dev->resource[1].start,
+	                                _dev->resource[1].end - _dev->resource[1].start + 1,
+	                                "dwc_otg")) {
+	          dev_dbg(&_dev->dev, "error reserving mapped memory\n");
+	          retval = -EFAULT;
+	          goto fail;
+	}
+
+		dwc_otg_device->os_dep.mphi_base = ioremap_nocache(_dev->resource[1].start,
+							    _dev->resource[1].end -
+							    _dev->resource[1].start + 1);
+	}
+
+#else
+        {
+                struct map_desc desc = {
+                    .virtual = IO_ADDRESS((unsigned)_dev->resource->start),
+                    .pfn     = __phys_to_pfn((unsigned)_dev->resource->start),
+                    .length  = SZ_128K,
+                    .type    = MT_DEVICE
+                };
+                iotable_init(&desc, 1);
+                dwc_otg_device->os_dep.base = (void *)desc.virtual;
+        }
+#endif
+	if (!dwc_otg_device->os_dep.base) {
+		dev_err(&_dev->dev, "ioremap() failed\n");
+		retval = -ENOMEM;
+		goto fail;
+	}
+	dev_dbg(&_dev->dev, "base=0x%08x\n",
+                (unsigned)dwc_otg_device->os_dep.base);
+#endif
+
+	/*
+	 * Initialize driver data to point to the global DWC_otg
+	 * Device structure.
+	 */
+#ifdef LM_INTERFACE
+	lm_set_drvdata(_dev, dwc_otg_device);
+#elif defined(PLATFORM_INTERFACE)
+	platform_set_drvdata(_dev, dwc_otg_device);
+#endif
+	dev_dbg(&_dev->dev, "dwc_otg_device=0x%p\n", dwc_otg_device);
+
+	dwc_otg_device->core_if = dwc_otg_cil_init(dwc_otg_device->os_dep.base);
+        DWC_DEBUGPL(DBG_HCDV, "probe of device %p given core_if %p\n",
+                    dwc_otg_device, dwc_otg_device->core_if);//GRAYG
+
+	if (!dwc_otg_device->core_if) {
+		dev_err(&_dev->dev, "CIL initialization failed!\n");
+		retval = -ENOMEM;
+		goto fail;
+	}
+
+	dev_dbg(&_dev->dev, "Calling get_gsnpsid\n");
+	/*
+	 * Attempt to ensure this device is really a DWC_otg Controller.
+	 * Read and verify the SNPSID register contents. The value should be
+	 * 0x45F42XXX or 0x45F42XXX, which corresponds to either "OT2" or "OTG3",
+	 * as in "OTG version 2.XX" or "OTG version 3.XX".
+	 */
+
+	if (((dwc_otg_get_gsnpsid(dwc_otg_device->core_if) & 0xFFFFF000) !=	0x4F542000) &&
+		((dwc_otg_get_gsnpsid(dwc_otg_device->core_if) & 0xFFFFF000) != 0x4F543000)) {
+		dev_err(&_dev->dev, "Bad value for SNPSID: 0x%08x\n",
+			dwc_otg_get_gsnpsid(dwc_otg_device->core_if));
+		retval = -EINVAL;
+		goto fail;
+	}
+
+	/*
+	 * Validate parameter values.
+	 */
+	dev_dbg(&_dev->dev, "Calling set_parameters\n");
+	if (set_parameters(dwc_otg_device->core_if)) {
+		retval = -EINVAL;
+		goto fail;
+	}
+
+	/*
+	 * Create Device Attributes in sysfs
+	 */
+	dev_dbg(&_dev->dev, "Calling attr_create\n");
+	dwc_otg_attr_create(_dev);
+
+	/*
+	 * Disable the global interrupt until all the interrupt
+	 * handlers are installed.
+	 */
+	dev_dbg(&_dev->dev, "Calling disable_global_interrupts\n");
+	dwc_otg_disable_global_interrupts(dwc_otg_device->core_if);
+
+	/*
+	 * Install the interrupt handler for the common interrupts before
+	 * enabling common interrupts in core_init below.
+	 */
+
+#if defined(PLATFORM_INTERFACE)
+	devirq = platform_get_irq(_dev, fiq_enable ? 0 : 1);
+#else
+	devirq = _dev->irq;
+#endif
+	DWC_DEBUGPL(DBG_CIL, "registering (common) handler for irq%d\n",
+		    devirq);
+	dev_dbg(&_dev->dev, "Calling request_irq(%d)\n", devirq);
+	retval = request_irq(devirq, dwc_otg_common_irq,
+                             IRQF_SHARED,
+                             "dwc_otg", dwc_otg_device);
+	if (retval) {
+		DWC_ERROR("request of irq%d failed\n", devirq);
+		retval = -EBUSY;
+		goto fail;
+	} else {
+		dwc_otg_device->common_irq_installed = 1;
+	}
+
+#ifndef IRQF_TRIGGER_LOW
+#if defined(LM_INTERFACE) || defined(PLATFORM_INTERFACE)
+	dev_dbg(&_dev->dev, "Calling set_irq_type\n");
+	set_irq_type(devirq,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30))
+                     IRQT_LOW
+#else
+                     IRQ_TYPE_LEVEL_LOW
+#endif
+                    );
+#endif
+#endif /*IRQF_TRIGGER_LOW*/
+
+	/*
+	 * Initialize the DWC_otg core.
+	 */
+	dev_dbg(&_dev->dev, "Calling dwc_otg_core_init\n");
+	dwc_otg_core_init(dwc_otg_device->core_if);
+
+#ifndef DWC_HOST_ONLY
+	/*
+	 * Initialize the PCD
+	 */
+	dev_dbg(&_dev->dev, "Calling pcd_init\n");
+	retval = pcd_init(_dev);
+	if (retval != 0) {
+		DWC_ERROR("pcd_init failed\n");
+		dwc_otg_device->pcd = NULL;
+		goto fail;
+	}
+#endif
+#ifndef DWC_DEVICE_ONLY
+	/*
+	 * Initialize the HCD
+	 */
+	dev_dbg(&_dev->dev, "Calling hcd_init\n");
+	retval = hcd_init(_dev);
+	if (retval != 0) {
+		DWC_ERROR("hcd_init failed\n");
+		dwc_otg_device->hcd = NULL;
+		goto fail;
+	}
+#endif
+        /* Recover from drvdata having been overwritten by hcd_init() */
+#ifdef LM_INTERFACE
+	lm_set_drvdata(_dev, dwc_otg_device);
+#elif defined(PLATFORM_INTERFACE)
+	platform_set_drvdata(_dev, dwc_otg_device);
+#elif defined(PCI_INTERFACE)
+	pci_set_drvdata(_dev, dwc_otg_device);
+	dwc_otg_device->os_dep.pcidev = _dev;
+#endif
+
+	/*
+	 * Enable the global interrupt after all the interrupt
+	 * handlers are installed if there is no ADP support else
+	 * perform initial actions required for Internal ADP logic.
+	 */
+	if (!dwc_otg_get_param_adp_enable(dwc_otg_device->core_if)) {
+	        dev_dbg(&_dev->dev, "Calling enable_global_interrupts\n");
+		dwc_otg_enable_global_interrupts(dwc_otg_device->core_if);
+	        dev_dbg(&_dev->dev, "Done\n");
+	} else
+		dwc_otg_adp_start(dwc_otg_device->core_if,
+							dwc_otg_is_host_mode(dwc_otg_device->core_if));
+
+	return 0;
+
+fail:
+	dwc_otg_driver_remove(_dev);
+	return retval;
+}
+
+/**
+ * This structure defines the methods to be called by a bus driver
+ * during the lifecycle of a device on that bus. Both drivers and
+ * devices are registered with a bus driver. The bus driver matches
+ * devices to drivers based on information in the device and driver
+ * structures.
+ *
+ * The probe function is called when the bus driver matches a device
+ * to this driver. The remove function is called when a device is
+ * unregistered with the bus driver.
+ */
+#ifdef LM_INTERFACE
+static struct lm_driver dwc_otg_driver = {
+	.drv = {.name = (char *)dwc_driver_name,},
+	.probe = dwc_otg_driver_probe,
+	.remove = dwc_otg_driver_remove,
+        // 'suspend' and 'resume' absent
+};
+#elif defined(PCI_INTERFACE)
+static const struct pci_device_id pci_ids[] = { {
+						 PCI_DEVICE(0x16c3, 0xabcd),
+						 .driver_data =
+						 (unsigned long)0xdeadbeef,
+						 }, { /* end: all zeroes */ }
+};
+
+MODULE_DEVICE_TABLE(pci, pci_ids);
+
+/* pci driver glue; this is a "new style" PCI driver module */
+static struct pci_driver dwc_otg_driver = {
+	.name = "dwc_otg",
+	.id_table = pci_ids,
+
+	.probe = dwc_otg_driver_probe,
+	.remove = dwc_otg_driver_remove,
+
+	.driver = {
+		   .name = (char *)dwc_driver_name,
+		   },
+};
+#elif defined(PLATFORM_INTERFACE)
+static struct platform_device_id platform_ids[] = {
+        {
+              .name = "bcm2708_usb",
+              .driver_data = (kernel_ulong_t) 0xdeadbeef,
+        },
+        { /* end: all zeroes */ }
+};
+MODULE_DEVICE_TABLE(platform, platform_ids);
+
+static const struct of_device_id dwc_otg_of_match_table[] = {
+	{ .compatible = "brcm,bcm2708-usb", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, dwc_otg_of_match_table);
+
+static struct platform_driver dwc_otg_driver = {
+	.driver = {
+		.name = (char *)dwc_driver_name,
+		.of_match_table = dwc_otg_of_match_table,
+		},
+        .id_table = platform_ids,
+
+	.probe = dwc_otg_driver_probe,
+	.remove = dwc_otg_driver_remove,
+        // no 'shutdown', 'suspend', 'resume', 'suspend_late' or 'resume_early'
+};
+#endif
+
+/**
+ * This function is called when the dwc_otg_driver is installed with the
+ * insmod command. It registers the dwc_otg_driver structure with the
+ * appropriate bus driver. This will cause the dwc_otg_driver_probe function
+ * to be called. In addition, the bus driver will automatically expose
+ * attributes defined for the device and driver in the special sysfs file
+ * system.
+ *
+ * @return
+ */
+static int __init dwc_otg_driver_init(void)
+{
+	int retval = 0;
+	int error;
+        struct device_driver *drv;
+
+	if(fiq_fsm_enable && !fiq_enable) {
+		printk(KERN_WARNING "dwc_otg: fiq_fsm_enable was set without fiq_enable! Correcting.\n");
+		fiq_enable = 1;
+	}
+
+	printk(KERN_INFO "%s: version %s (%s bus)\n", dwc_driver_name,
+	       DWC_DRIVER_VERSION,
+#ifdef LM_INTERFACE
+               "logicmodule");
+	retval = lm_driver_register(&dwc_otg_driver);
+        drv = &dwc_otg_driver.drv;
+#elif defined(PCI_INTERFACE)
+               "pci");
+	retval = pci_register_driver(&dwc_otg_driver);
+        drv = &dwc_otg_driver.driver;
+#elif defined(PLATFORM_INTERFACE)
+               "platform");
+	retval = platform_driver_register(&dwc_otg_driver);
+        drv = &dwc_otg_driver.driver;
+#endif
+	if (retval < 0) {
+		printk(KERN_ERR "%s retval=%d\n", __func__, retval);
+		return retval;
+	}
+	printk(KERN_DEBUG "dwc_otg: FIQ %s\n", fiq_enable ? "enabled":"disabled");
+	printk(KERN_DEBUG "dwc_otg: NAK holdoff %s\n", nak_holdoff ? "enabled":"disabled");
+	printk(KERN_DEBUG "dwc_otg: FIQ split-transaction FSM %s\n", fiq_fsm_enable ? "enabled":"disabled");
+
+	error = driver_create_file(drv, &driver_attr_version);
+#ifdef DEBUG
+	error = driver_create_file(drv, &driver_attr_debuglevel);
+#endif
+	return retval;
+}
+
+module_init(dwc_otg_driver_init);
+
+/**
+ * This function is called when the driver is removed from the kernel
+ * with the rmmod command. The driver unregisters itself with its bus
+ * driver.
+ *
+ */
+static void __exit dwc_otg_driver_cleanup(void)
+{
+	printk(KERN_DEBUG "dwc_otg_driver_cleanup()\n");
+
+#ifdef LM_INTERFACE
+	driver_remove_file(&dwc_otg_driver.drv, &driver_attr_debuglevel);
+	driver_remove_file(&dwc_otg_driver.drv, &driver_attr_version);
+	lm_driver_unregister(&dwc_otg_driver);
+#elif defined(PCI_INTERFACE)
+	driver_remove_file(&dwc_otg_driver.driver, &driver_attr_debuglevel);
+	driver_remove_file(&dwc_otg_driver.driver, &driver_attr_version);
+	pci_unregister_driver(&dwc_otg_driver);
+#elif defined(PLATFORM_INTERFACE)
+	driver_remove_file(&dwc_otg_driver.driver, &driver_attr_debuglevel);
+	driver_remove_file(&dwc_otg_driver.driver, &driver_attr_version);
+	platform_driver_unregister(&dwc_otg_driver);
+#endif
+
+	printk(KERN_INFO "%s module removed\n", dwc_driver_name);
+}
+
+module_exit(dwc_otg_driver_cleanup);
+
+MODULE_DESCRIPTION(DWC_DRIVER_DESC);
+MODULE_AUTHOR("Synopsys Inc.");
+MODULE_LICENSE("GPL");
+
+module_param_named(otg_cap, dwc_otg_module_params.otg_cap, int, 0444);
+MODULE_PARM_DESC(otg_cap, "OTG Capabilities 0=HNP&SRP 1=SRP Only 2=None");
+module_param_named(opt, dwc_otg_module_params.opt, int, 0444);
+MODULE_PARM_DESC(opt, "OPT Mode");
+module_param_named(dma_enable, dwc_otg_module_params.dma_enable, int, 0444);
+MODULE_PARM_DESC(dma_enable, "DMA Mode 0=Slave 1=DMA enabled");
+
+module_param_named(dma_desc_enable, dwc_otg_module_params.dma_desc_enable, int,
+		   0444);
+MODULE_PARM_DESC(dma_desc_enable,
+		 "DMA Desc Mode 0=Address DMA 1=DMA Descriptor enabled");
+
+module_param_named(dma_burst_size, dwc_otg_module_params.dma_burst_size, int,
+		   0444);
+MODULE_PARM_DESC(dma_burst_size,
+		 "DMA Burst Size 1, 4, 8, 16, 32, 64, 128, 256");
+module_param_named(speed, dwc_otg_module_params.speed, int, 0444);
+MODULE_PARM_DESC(speed, "Speed 0=High Speed 1=Full Speed");
+module_param_named(host_support_fs_ls_low_power,
+		   dwc_otg_module_params.host_support_fs_ls_low_power, int,
+		   0444);
+MODULE_PARM_DESC(host_support_fs_ls_low_power,
+		 "Support Low Power w/FS or LS 0=Support 1=Don't Support");
+module_param_named(host_ls_low_power_phy_clk,
+		   dwc_otg_module_params.host_ls_low_power_phy_clk, int, 0444);
+MODULE_PARM_DESC(host_ls_low_power_phy_clk,
+		 "Low Speed Low Power Clock 0=48Mhz 1=6Mhz");
+module_param_named(enable_dynamic_fifo,
+		   dwc_otg_module_params.enable_dynamic_fifo, int, 0444);
+MODULE_PARM_DESC(enable_dynamic_fifo, "0=cC Setting 1=Allow Dynamic Sizing");
+module_param_named(data_fifo_size, dwc_otg_module_params.data_fifo_size, int,
+		   0444);
+MODULE_PARM_DESC(data_fifo_size,
+		 "Total number of words in the data FIFO memory 32-32768");
+module_param_named(dev_rx_fifo_size, dwc_otg_module_params.dev_rx_fifo_size,
+		   int, 0444);
+MODULE_PARM_DESC(dev_rx_fifo_size, "Number of words in the Rx FIFO 16-32768");
+module_param_named(dev_nperio_tx_fifo_size,
+		   dwc_otg_module_params.dev_nperio_tx_fifo_size, int, 0444);
+MODULE_PARM_DESC(dev_nperio_tx_fifo_size,
+		 "Number of words in the non-periodic Tx FIFO 16-32768");
+module_param_named(dev_perio_tx_fifo_size_1,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[0], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_1,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_2,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[1], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_2,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_3,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[2], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_3,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_4,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[3], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_4,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_5,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[4], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_5,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_6,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[5], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_6,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_7,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[6], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_7,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_8,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[7], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_8,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_9,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[8], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_9,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_10,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[9], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_10,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_11,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[10], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_11,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_12,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[11], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_12,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_13,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[12], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_13,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_14,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[13], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_14,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(dev_perio_tx_fifo_size_15,
+		   dwc_otg_module_params.dev_perio_tx_fifo_size[14], int, 0444);
+MODULE_PARM_DESC(dev_perio_tx_fifo_size_15,
+		 "Number of words in the periodic Tx FIFO 4-768");
+module_param_named(host_rx_fifo_size, dwc_otg_module_params.host_rx_fifo_size,
+		   int, 0444);
+MODULE_PARM_DESC(host_rx_fifo_size, "Number of words in the Rx FIFO 16-32768");
+module_param_named(host_nperio_tx_fifo_size,
+		   dwc_otg_module_params.host_nperio_tx_fifo_size, int, 0444);
+MODULE_PARM_DESC(host_nperio_tx_fifo_size,
+		 "Number of words in the non-periodic Tx FIFO 16-32768");
+module_param_named(host_perio_tx_fifo_size,
+		   dwc_otg_module_params.host_perio_tx_fifo_size, int, 0444);
+MODULE_PARM_DESC(host_perio_tx_fifo_size,
+		 "Number of words in the host periodic Tx FIFO 16-32768");
+module_param_named(max_transfer_size, dwc_otg_module_params.max_transfer_size,
+		   int, 0444);
+/** @todo Set the max to 512K, modify checks */
+MODULE_PARM_DESC(max_transfer_size,
+		 "The maximum transfer size supported in bytes 2047-65535");
+module_param_named(max_packet_count, dwc_otg_module_params.max_packet_count,
+		   int, 0444);
+MODULE_PARM_DESC(max_packet_count,
+		 "The maximum number of packets in a transfer 15-511");
+module_param_named(host_channels, dwc_otg_module_params.host_channels, int,
+		   0444);
+MODULE_PARM_DESC(host_channels,
+		 "The number of host channel registers to use 1-16");
+module_param_named(dev_endpoints, dwc_otg_module_params.dev_endpoints, int,
+		   0444);
+MODULE_PARM_DESC(dev_endpoints,
+		 "The number of endpoints in addition to EP0 available for device mode 1-15");
+module_param_named(phy_type, dwc_otg_module_params.phy_type, int, 0444);
+MODULE_PARM_DESC(phy_type, "0=Reserved 1=UTMI+ 2=ULPI");
+module_param_named(phy_utmi_width, dwc_otg_module_params.phy_utmi_width, int,
+		   0444);
+MODULE_PARM_DESC(phy_utmi_width, "Specifies the UTMI+ Data Width 8 or 16 bits");
+module_param_named(phy_ulpi_ddr, dwc_otg_module_params.phy_ulpi_ddr, int, 0444);
+MODULE_PARM_DESC(phy_ulpi_ddr,
+		 "ULPI at double or single data rate 0=Single 1=Double");
+module_param_named(phy_ulpi_ext_vbus, dwc_otg_module_params.phy_ulpi_ext_vbus,
+		   int, 0444);
+MODULE_PARM_DESC(phy_ulpi_ext_vbus,
+		 "ULPI PHY using internal or external vbus 0=Internal");
+module_param_named(i2c_enable, dwc_otg_module_params.i2c_enable, int, 0444);
+MODULE_PARM_DESC(i2c_enable, "FS PHY Interface");
+module_param_named(ulpi_fs_ls, dwc_otg_module_params.ulpi_fs_ls, int, 0444);
+MODULE_PARM_DESC(ulpi_fs_ls, "ULPI PHY FS/LS mode only");
+module_param_named(ts_dline, dwc_otg_module_params.ts_dline, int, 0444);
+MODULE_PARM_DESC(ts_dline, "Term select Dline pulsing for all PHYs");
+module_param_named(debug, g_dbg_lvl, int, 0444);
+MODULE_PARM_DESC(debug, "");
+
+module_param_named(en_multiple_tx_fifo,
+		   dwc_otg_module_params.en_multiple_tx_fifo, int, 0444);
+MODULE_PARM_DESC(en_multiple_tx_fifo,
+		 "Dedicated Non Periodic Tx FIFOs 0=disabled 1=enabled");
+module_param_named(dev_tx_fifo_size_1,
+		   dwc_otg_module_params.dev_tx_fifo_size[0], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_1, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_2,
+		   dwc_otg_module_params.dev_tx_fifo_size[1], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_2, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_3,
+		   dwc_otg_module_params.dev_tx_fifo_size[2], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_3, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_4,
+		   dwc_otg_module_params.dev_tx_fifo_size[3], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_4, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_5,
+		   dwc_otg_module_params.dev_tx_fifo_size[4], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_5, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_6,
+		   dwc_otg_module_params.dev_tx_fifo_size[5], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_6, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_7,
+		   dwc_otg_module_params.dev_tx_fifo_size[6], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_7, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_8,
+		   dwc_otg_module_params.dev_tx_fifo_size[7], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_8, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_9,
+		   dwc_otg_module_params.dev_tx_fifo_size[8], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_9, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_10,
+		   dwc_otg_module_params.dev_tx_fifo_size[9], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_10, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_11,
+		   dwc_otg_module_params.dev_tx_fifo_size[10], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_11, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_12,
+		   dwc_otg_module_params.dev_tx_fifo_size[11], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_12, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_13,
+		   dwc_otg_module_params.dev_tx_fifo_size[12], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_13, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_14,
+		   dwc_otg_module_params.dev_tx_fifo_size[13], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_14, "Number of words in the Tx FIFO 4-768");
+module_param_named(dev_tx_fifo_size_15,
+		   dwc_otg_module_params.dev_tx_fifo_size[14], int, 0444);
+MODULE_PARM_DESC(dev_tx_fifo_size_15, "Number of words in the Tx FIFO 4-768");
+
+module_param_named(thr_ctl, dwc_otg_module_params.thr_ctl, int, 0444);
+MODULE_PARM_DESC(thr_ctl,
+		 "Thresholding enable flag bit 0 - non ISO Tx thr., 1 - ISO Tx thr., 2 - Rx thr.- bit 0=disabled 1=enabled");
+module_param_named(tx_thr_length, dwc_otg_module_params.tx_thr_length, int,
+		   0444);
+MODULE_PARM_DESC(tx_thr_length, "Tx Threshold length in 32 bit DWORDs");
+module_param_named(rx_thr_length, dwc_otg_module_params.rx_thr_length, int,
+		   0444);
+MODULE_PARM_DESC(rx_thr_length, "Rx Threshold length in 32 bit DWORDs");
+
+module_param_named(pti_enable, dwc_otg_module_params.pti_enable, int, 0444);
+module_param_named(mpi_enable, dwc_otg_module_params.mpi_enable, int, 0444);
+module_param_named(lpm_enable, dwc_otg_module_params.lpm_enable, int, 0444);
+MODULE_PARM_DESC(lpm_enable, "LPM Enable 0=LPM Disabled 1=LPM Enabled");
+module_param_named(ic_usb_cap, dwc_otg_module_params.ic_usb_cap, int, 0444);
+MODULE_PARM_DESC(ic_usb_cap,
+		 "IC_USB Capability 0=IC_USB Disabled 1=IC_USB Enabled");
+module_param_named(ahb_thr_ratio, dwc_otg_module_params.ahb_thr_ratio, int,
+		   0444);
+MODULE_PARM_DESC(ahb_thr_ratio, "AHB Threshold Ratio");
+module_param_named(power_down, dwc_otg_module_params.power_down, int, 0444);
+MODULE_PARM_DESC(power_down, "Power Down Mode");
+module_param_named(reload_ctl, dwc_otg_module_params.reload_ctl, int, 0444);
+MODULE_PARM_DESC(reload_ctl, "HFIR Reload Control");
+module_param_named(dev_out_nak, dwc_otg_module_params.dev_out_nak, int, 0444);
+MODULE_PARM_DESC(dev_out_nak, "Enable Device OUT NAK");
+module_param_named(cont_on_bna, dwc_otg_module_params.cont_on_bna, int, 0444);
+MODULE_PARM_DESC(cont_on_bna, "Enable Enable Continue on BNA");
+module_param_named(ahb_single, dwc_otg_module_params.ahb_single, int, 0444);
+MODULE_PARM_DESC(ahb_single, "Enable AHB Single Support");
+module_param_named(adp_enable, dwc_otg_module_params.adp_enable, int, 0444);
+MODULE_PARM_DESC(adp_enable, "ADP Enable 0=ADP Disabled 1=ADP Enabled");
+module_param_named(otg_ver, dwc_otg_module_params.otg_ver, int, 0444);
+MODULE_PARM_DESC(otg_ver, "OTG revision supported 0=OTG 1.3 1=OTG 2.0");
+module_param(microframe_schedule, bool, 0444);
+MODULE_PARM_DESC(microframe_schedule, "Enable the microframe scheduler");
+
+module_param(fiq_enable, bool, 0444);
+MODULE_PARM_DESC(fiq_enable, "Enable the FIQ");
+module_param(nak_holdoff, ushort, 0644);
+MODULE_PARM_DESC(nak_holdoff, "Throttle duration for bulk split-transaction endpoints on a NAK. Default 8");
+module_param(fiq_fsm_enable, bool, 0444);
+MODULE_PARM_DESC(fiq_fsm_enable, "Enable the FIQ to perform split transactions as defined by fiq_fsm_mask");
+module_param(fiq_fsm_mask, ushort, 0444);
+MODULE_PARM_DESC(fiq_fsm_mask, "Bitmask of transactions to perform in the FIQ.\n"
+					"Bit 0 : Non-periodic split transactions\n"
+					"Bit 1 : Periodic split transactions\n"
+					"Bit 2 : High-speed multi-transfer isochronous\n"
+					"All other bits should be set 0.");
+module_param(int_ep_interval_min, ushort, 0644);
+MODULE_PARM_DESC(int_ep_interval_min, "Clamp high-speed Interrupt endpoints to a minimum polling interval.\n"
+					"0..1 = Use endpoint default\n"
+					"2..n = Minimum interval n microframes. Use powers of 2.\n");
+
+module_param(cil_force_host, bool, 0644);
+MODULE_PARM_DESC(cil_force_host, "On a connector-ID status change, "
+					"force Host Mode regardless of OTG state.");
+
+/** @page "Module Parameters"
+ *
+ * The following parameters may be specified when starting the module.
+ * These parameters define how the DWC_otg controller should be
+ * configured. Parameter values are passed to the CIL initialization
+ * function dwc_otg_cil_init
+ *
+ * Example: <code>modprobe dwc_otg speed=1 otg_cap=1</code>
+ *
+
+ <table>
+ <tr><td>Parameter Name</td><td>Meaning</td></tr>
+
+ <tr>
+ <td>otg_cap</td>
+ <td>Specifies the OTG capabilities. The driver will automatically detect the
+ value for this parameter if none is specified.
+ - 0: HNP and SRP capable (default, if available)
+ - 1: SRP Only capable
+ - 2: No HNP/SRP capable
+ </td></tr>
+
+ <tr>
+ <td>dma_enable</td>
+ <td>Specifies whether to use slave or DMA mode for accessing the data FIFOs.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - 0: Slave
+ - 1: DMA (default, if available)
+ </td></tr>
+
+ <tr>
+ <td>dma_burst_size</td>
+ <td>The DMA Burst size (applicable only for External DMA Mode).
+ - Values: 1, 4, 8 16, 32, 64, 128, 256 (default 32)
+ </td></tr>
+
+ <tr>
+ <td>speed</td>
+ <td>Specifies the maximum speed of operation in host and device mode. The
+ actual speed depends on the speed of the attached device and the value of
+ phy_type.
+ - 0: High Speed (default)
+ - 1: Full Speed
+ </td></tr>
+
+ <tr>
+ <td>host_support_fs_ls_low_power</td>
+ <td>Specifies whether low power mode is supported when attached to a Full
+ Speed or Low Speed device in host mode.
+ - 0: Don't support low power mode (default)
+ - 1: Support low power mode
+ </td></tr>
+
+ <tr>
+ <td>host_ls_low_power_phy_clk</td>
+ <td>Specifies the PHY clock rate in low power mode when connected to a Low
+ Speed device in host mode. This parameter is applicable only if
+ HOST_SUPPORT_FS_LS_LOW_POWER is enabled.
+ - 0: 48 MHz (default)
+ - 1: 6 MHz
+ </td></tr>
+
+ <tr>
+ <td>enable_dynamic_fifo</td>
+ <td> Specifies whether FIFOs may be resized by the driver software.
+ - 0: Use cC FIFO size parameters
+ - 1: Allow dynamic FIFO sizing (default)
+ </td></tr>
+
+ <tr>
+ <td>data_fifo_size</td>
+ <td>Total number of 4-byte words in the data FIFO memory. This memory
+ includes the Rx FIFO, non-periodic Tx FIFO, and periodic Tx FIFOs.
+ - Values: 32 to 32768 (default 8192)
+
+ Note: The total FIFO memory depth in the FPGA configuration is 8192.
+ </td></tr>
+
+ <tr>
+ <td>dev_rx_fifo_size</td>
+ <td>Number of 4-byte words in the Rx FIFO in device mode when dynamic
+ FIFO sizing is enabled.
+ - Values: 16 to 32768 (default 1064)
+ </td></tr>
+
+ <tr>
+ <td>dev_nperio_tx_fifo_size</td>
+ <td>Number of 4-byte words in the non-periodic Tx FIFO in device mode when
+ dynamic FIFO sizing is enabled.
+ - Values: 16 to 32768 (default 1024)
+ </td></tr>
+
+ <tr>
+ <td>dev_perio_tx_fifo_size_n (n = 1 to 15)</td>
+ <td>Number of 4-byte words in each of the periodic Tx FIFOs in device mode
+ when dynamic FIFO sizing is enabled.
+ - Values: 4 to 768 (default 256)
+ </td></tr>
+
+ <tr>
+ <td>host_rx_fifo_size</td>
+ <td>Number of 4-byte words in the Rx FIFO in host mode when dynamic FIFO
+ sizing is enabled.
+ - Values: 16 to 32768 (default 1024)
+ </td></tr>
+
+ <tr>
+ <td>host_nperio_tx_fifo_size</td>
+ <td>Number of 4-byte words in the non-periodic Tx FIFO in host mode when
+ dynamic FIFO sizing is enabled in the core.
+ - Values: 16 to 32768 (default 1024)
+ </td></tr>
+
+ <tr>
+ <td>host_perio_tx_fifo_size</td>
+ <td>Number of 4-byte words in the host periodic Tx FIFO when dynamic FIFO
+ sizing is enabled.
+ - Values: 16 to 32768 (default 1024)
+ </td></tr>
+
+ <tr>
+ <td>max_transfer_size</td>
+ <td>The maximum transfer size supported in bytes.
+ - Values: 2047 to 65,535 (default 65,535)
+ </td></tr>
+
+ <tr>
+ <td>max_packet_count</td>
+ <td>The maximum number of packets in a transfer.
+ - Values: 15 to 511 (default 511)
+ </td></tr>
+
+ <tr>
+ <td>host_channels</td>
+ <td>The number of host channel registers to use.
+ - Values: 1 to 16 (default 12)
+
+ Note: The FPGA configuration supports a maximum of 12 host channels.
+ </td></tr>
+
+ <tr>
+ <td>dev_endpoints</td>
+ <td>The number of endpoints in addition to EP0 available for device mode
+ operations.
+ - Values: 1 to 15 (default 6 IN and OUT)
+
+ Note: The FPGA configuration supports a maximum of 6 IN and OUT endpoints in
+ addition to EP0.
+ </td></tr>
+
+ <tr>
+ <td>phy_type</td>
+ <td>Specifies the type of PHY interface to use. By default, the driver will
+ automatically detect the phy_type.
+ - 0: Full Speed
+ - 1: UTMI+ (default, if available)
+ - 2: ULPI
+ </td></tr>
+
+ <tr>
+ <td>phy_utmi_width</td>
+ <td>Specifies the UTMI+ Data Width. This parameter is applicable for a
+ phy_type of UTMI+. Also, this parameter is applicable only if the
+ OTG_HSPHY_WIDTH cC parameter was set to "8 and 16 bits", meaning that the
+ core has been configured to work at either data path width.
+ - Values: 8 or 16 bits (default 16)
+ </td></tr>
+
+ <tr>
+ <td>phy_ulpi_ddr</td>
+ <td>Specifies whether the ULPI operates at double or single data rate. This
+ parameter is only applicable if phy_type is ULPI.
+ - 0: single data rate ULPI interface with 8 bit wide data bus (default)
+ - 1: double data rate ULPI interface with 4 bit wide data bus
+ </td></tr>
+
+ <tr>
+ <td>i2c_enable</td>
+ <td>Specifies whether to use the I2C interface for full speed PHY. This
+ parameter is only applicable if PHY_TYPE is FS.
+ - 0: Disabled (default)
+ - 1: Enabled
+ </td></tr>
+
+ <tr>
+ <td>ulpi_fs_ls</td>
+ <td>Specifies whether to use ULPI FS/LS mode only.
+ - 0: Disabled (default)
+ - 1: Enabled
+ </td></tr>
+
+ <tr>
+ <td>ts_dline</td>
+ <td>Specifies whether term select D-Line pulsing for all PHYs is enabled.
+ - 0: Disabled (default)
+ - 1: Enabled
+ </td></tr>
+
+ <tr>
+ <td>en_multiple_tx_fifo</td>
+ <td>Specifies whether dedicatedto tx fifos are enabled for non periodic IN EPs.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - 0: Disabled
+ - 1: Enabled (default, if available)
+ </td></tr>
+
+ <tr>
+ <td>dev_tx_fifo_size_n (n = 1 to 15)</td>
+ <td>Number of 4-byte words in each of the Tx FIFOs in device mode
+ when dynamic FIFO sizing is enabled.
+ - Values: 4 to 768 (default 256)
+ </td></tr>
+
+ <tr>
+ <td>tx_thr_length</td>
+ <td>Transmit Threshold length in 32 bit double words
+ - Values: 8 to 128 (default 64)
+ </td></tr>
+
+ <tr>
+ <td>rx_thr_length</td>
+ <td>Receive Threshold length in 32 bit double words
+ - Values: 8 to 128 (default 64)
+ </td></tr>
+
+<tr>
+ <td>thr_ctl</td>
+ <td>Specifies whether to enable Thresholding for Device mode. Bits 0, 1, 2 of
+ this parmater specifies if thresholding is enabled for non-Iso Tx, Iso Tx and
+ Rx transfers accordingly.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - Values: 0 to 7 (default 0)
+ Bit values indicate:
+ - 0: Thresholding disabled
+ - 1: Thresholding enabled
+ </td></tr>
+
+<tr>
+ <td>dma_desc_enable</td>
+ <td>Specifies whether to enable Descriptor DMA mode.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - 0: Descriptor DMA disabled
+ - 1: Descriptor DMA (default, if available)
+ </td></tr>
+
+<tr>
+ <td>mpi_enable</td>
+ <td>Specifies whether to enable MPI enhancement mode.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - 0: MPI disabled (default)
+ - 1: MPI enable
+ </td></tr>
+
+<tr>
+ <td>pti_enable</td>
+ <td>Specifies whether to enable PTI enhancement support.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - 0: PTI disabled (default)
+ - 1: PTI enable
+ </td></tr>
+
+<tr>
+ <td>lpm_enable</td>
+ <td>Specifies whether to enable LPM support.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - 0: LPM disabled
+ - 1: LPM enable (default, if available)
+ </td></tr>
+
+<tr>
+ <td>ic_usb_cap</td>
+ <td>Specifies whether to enable IC_USB capability.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - 0: IC_USB disabled (default, if available)
+ - 1: IC_USB enable
+ </td></tr>
+
+<tr>
+ <td>ahb_thr_ratio</td>
+ <td>Specifies AHB Threshold ratio.
+ - Values: 0 to 3 (default 0)
+ </td></tr>
+
+<tr>
+ <td>power_down</td>
+ <td>Specifies Power Down(Hibernation) Mode.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - 0: Power Down disabled (default)
+ - 2: Power Down enabled
+ </td></tr>
+
+ <tr>
+ <td>reload_ctl</td>
+ <td>Specifies whether dynamic reloading of the HFIR register is allowed during
+ run time. The driver will automatically detect the value for this parameter if
+ none is specified. In case the HFIR value is reloaded when HFIR.RldCtrl == 1'b0
+ the core might misbehave.
+ - 0: Reload Control disabled (default)
+ - 1: Reload Control enabled
+ </td></tr>
+
+ <tr>
+ <td>dev_out_nak</td>
+ <td>Specifies whether  Device OUT NAK enhancement enabled or no.
+ The driver will automatically detect the value for this parameter if
+ none is specified. This parameter is valid only when OTG_EN_DESC_DMA == 1b1.
+ - 0: The core does not set NAK after Bulk OUT transfer complete (default)
+ - 1: The core sets NAK after Bulk OUT transfer complete
+ </td></tr>
+
+ <tr>
+ <td>cont_on_bna</td>
+ <td>Specifies whether Enable Continue on BNA enabled or no.
+ After receiving BNA interrupt the core disables the endpoint,when the
+ endpoint is re-enabled by the application the
+ - 0: Core starts processing from the DOEPDMA descriptor (default)
+ - 1: Core starts processing from the descriptor which received the BNA.
+ This parameter is valid only when OTG_EN_DESC_DMA == 1b1.
+ </td></tr>
+
+ <tr>
+ <td>ahb_single</td>
+ <td>This bit when programmed supports SINGLE transfers for remainder data
+ in a transfer for DMA mode of operation.
+ - 0: The remainder data will be sent using INCR burst size (default)
+ - 1: The remainder data will be sent using SINGLE burst size.
+ </td></tr>
+
+<tr>
+ <td>adp_enable</td>
+ <td>Specifies whether ADP feature is enabled.
+ The driver will automatically detect the value for this parameter if none is
+ specified.
+ - 0: ADP feature disabled (default)
+ - 1: ADP feature enabled
+ </td></tr>
+
+  <tr>
+ <td>otg_ver</td>
+ <td>Specifies whether OTG is performing as USB OTG Revision 2.0 or Revision 1.3
+ USB OTG device.
+ - 0: OTG 2.0 support disabled (default)
+ - 1: OTG 2.0 support enabled
+ </td></tr>
+
+*/
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_driver.h b/drivers/usb/host/dwc_otg/dwc_otg_driver.h
new file mode 100644
index 000000000000..6a8be63a0ab2
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_driver.h
@@ -0,0 +1,86 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_driver.h $
+ * $Revision: #19 $
+ * $Date: 2010/11/15 $
+ * $Change: 1627671 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+#ifndef __DWC_OTG_DRIVER_H__
+#define __DWC_OTG_DRIVER_H__
+
+/** @file
+ * This file contains the interface to the Linux driver.
+ */
+#include "dwc_otg_os_dep.h"
+#include "dwc_otg_core_if.h"
+
+/* Type declarations */
+struct dwc_otg_pcd;
+struct dwc_otg_hcd;
+
+/**
+ * This structure is a wrapper that encapsulates the driver components used to
+ * manage a single DWC_otg controller.
+ */
+typedef struct dwc_otg_device {
+	/** Structure containing OS-dependent stuff. KEEP THIS STRUCT AT THE
+	 * VERY BEGINNING OF THE DEVICE STRUCT. OSes such as FreeBSD and NetBSD
+	 * require this. */
+	struct os_dependent os_dep;
+
+	/** Pointer to the core interface structure. */
+	dwc_otg_core_if_t *core_if;
+
+	/** Pointer to the PCD structure. */
+	struct dwc_otg_pcd *pcd;
+
+	/** Pointer to the HCD structure. */
+	struct dwc_otg_hcd *hcd;
+
+	/** Flag to indicate whether the common IRQ handler is installed. */
+	uint8_t common_irq_installed;
+
+} dwc_otg_device_t;
+
+/*We must clear S3C24XX_EINTPEND external interrupt register
+ * because after clearing in this register trigerred IRQ from
+ * H/W core in kernel interrupt can be occured again before OTG
+ * handlers clear all IRQ sources of Core registers because of
+ * timing latencies and Low Level IRQ Type.
+ */
+#ifdef CONFIG_MACH_IPMATE
+#define  S3C2410X_CLEAR_EINTPEND()   \
+do { \
+	__raw_writel(1UL << 11,S3C24XX_EINTPEND); \
+} while (0)
+#else
+#define  S3C2410X_CLEAR_EINTPEND()   do { } while (0)
+#endif
+
+#endif
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
new file mode 100644
index 000000000000..ca362db1602a
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.c
@@ -0,0 +1,1418 @@
+/*
+ * dwc_otg_fiq_fsm.c - The finite state machine FIQ
+ *
+ * Copyright (c) 2013 Raspberry Pi Foundation
+ *
+ * Author: Jonathan Bell <jonathan@raspberrypi.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *	* Redistributions of source code must retain the above copyright
+ *	  notice, this list of conditions and the following disclaimer.
+ *	* Redistributions in binary form must reproduce the above copyright
+ *	  notice, this list of conditions and the following disclaimer in the
+ *	  documentation and/or other materials provided with the distribution.
+ *	* Neither the name of Raspberry Pi nor the
+ *	  names of its contributors may be used to endorse or promote products
+ *	  derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * This FIQ implements functionality that performs split transactions on
+ * the dwc_otg hardware without any outside intervention. A split transaction
+ * is "queued" by nominating a specific host channel to perform the entirety
+ * of a split transaction. This FIQ will then perform the microframe-precise
+ * scheduling required in each phase of the transaction until completion.
+ *
+ * The FIQ functionality is glued into the Synopsys driver via the entry point
+ * in the FSM enqueue function, and at the exit point in handling a HC interrupt
+ * for a FSM-enabled channel.
+ *
+ * NB: Large parts of this implementation have architecture-specific code.
+ * For porting this functionality to other ARM machines, the minimum is required:
+ * - An interrupt controller allowing the top-level dwc USB interrupt to be routed
+ *   to the FIQ
+ * - A method of forcing a software generated interrupt from FIQ mode that then
+ *   triggers an IRQ entry (with the dwc USB handler called by this IRQ number)
+ * - Guaranteed interrupt routing such that both the FIQ and SGI occur on the same
+ *   processor core - there is no locking between the FIQ and IRQ (aside from
+ *   local_fiq_disable)
+ *
+ */
+
+#include "dwc_otg_fiq_fsm.h"
+
+
+char buffer[1000*16];
+int wptr;
+void notrace _fiq_print(enum fiq_debug_level dbg_lvl, volatile struct fiq_state *state, char *fmt, ...)
+{
+	enum fiq_debug_level dbg_lvl_req = FIQDBG_ERR;
+	va_list args;
+	char text[17];
+	hfnum_data_t hfnum = { .d32 = FIQ_READ(state->dwc_regs_base + 0x408) };
+
+	if((dbg_lvl & dbg_lvl_req) || dbg_lvl == FIQDBG_ERR)
+	{
+		snprintf(text, 9, " %4d:%1u  ", hfnum.b.frnum/8, hfnum.b.frnum & 7);
+		va_start(args, fmt);
+		vsnprintf(text+8, 9, fmt, args);
+		va_end(args);
+
+		memcpy(buffer + wptr, text, 16);
+		wptr = (wptr + 16) % sizeof(buffer);
+	}
+}
+
+
+#ifdef CONFIG_ARM64
+
+inline void fiq_fsm_spin_lock(fiq_lock_t *lock)
+{
+	spin_lock((spinlock_t *)lock);
+}
+
+inline void fiq_fsm_spin_unlock(fiq_lock_t *lock)
+{
+	spin_unlock((spinlock_t *)lock);
+}
+
+#else
+
+/**
+ * fiq_fsm_spin_lock() - ARMv6+ bare bones spinlock
+ * Must be called with local interrupts and FIQ disabled.
+ */
+#if defined(CONFIG_ARCH_BCM2835) && defined(CONFIG_SMP)
+inline void fiq_fsm_spin_lock(fiq_lock_t *lock)
+{
+	unsigned long tmp;
+	uint32_t newval;
+	fiq_lock_t lockval;
+	/* Nested locking, yay. If we are on the same CPU as the fiq, then the disable
+	 * will be sufficient. If we are on a different CPU, then the lock protects us. */
+	prefetchw(&lock->slock);
+	asm volatile (
+	"1:     ldrex   %0, [%3]\n"
+	"       add     %1, %0, %4\n"
+	"       strex   %2, %1, [%3]\n"
+	"       teq     %2, #0\n"
+	"       bne     1b"
+	: "=&r" (lockval), "=&r" (newval), "=&r" (tmp)
+	: "r" (&lock->slock), "I" (1 << 16)
+	: "cc");
+
+	while (lockval.tickets.next != lockval.tickets.owner) {
+		wfe();
+		lockval.tickets.owner = ACCESS_ONCE(lock->tickets.owner);
+	}
+	smp_mb();
+}
+#else
+inline void fiq_fsm_spin_lock(fiq_lock_t *lock) { }
+#endif
+
+/**
+ * fiq_fsm_spin_unlock() - ARMv6+ bare bones spinunlock
+ */
+#if defined(CONFIG_ARCH_BCM2835) && defined(CONFIG_SMP)
+inline void fiq_fsm_spin_unlock(fiq_lock_t *lock)
+{
+	smp_mb();
+	lock->tickets.owner++;
+	dsb_sev();
+}
+#else
+inline void fiq_fsm_spin_unlock(fiq_lock_t *lock) { }
+#endif
+
+#endif
+
+/**
+ * fiq_fsm_restart_channel() - Poke channel enable bit for a split transaction
+ * @channel: channel to re-enable
+ */
+static void fiq_fsm_restart_channel(struct fiq_state *st, int n, int force)
+{
+	hcchar_data_t hcchar = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR) };
+
+	hcchar.b.chen = 0;
+	if (st->channel[n].hcchar_copy.b.eptype & 0x1) {
+		hfnum_data_t hfnum = { .d32 = FIQ_READ(st->dwc_regs_base + HFNUM) };
+		/* Hardware bug workaround: update the ssplit index */
+		if (st->channel[n].hcsplt_copy.b.spltena)
+			st->channel[n].expected_uframe = (hfnum.b.frnum + 1) & 0x3FFF;
+
+		hcchar.b.oddfrm = (hfnum.b.frnum & 0x1) ? 0	: 1;
+	}
+
+	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR, hcchar.d32);
+	hcchar.d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
+	hcchar.b.chen = 1;
+
+	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR, hcchar.d32);
+	fiq_print(FIQDBG_INT, st, "HCGO %01d %01d", n, force);
+}
+
+/**
+ * fiq_fsm_setup_csplit() - Prepare a host channel for a CSplit transaction stage
+ * @st: Pointer to the channel's state
+ * @n : channel number
+ *
+ * Change host channel registers to perform a complete-split transaction. Being mindful of the
+ * endpoint direction, set control regs up correctly.
+ */
+static void notrace fiq_fsm_setup_csplit(struct fiq_state *st, int n)
+{
+	hcsplt_data_t hcsplt = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCSPLT) };
+	hctsiz_data_t hctsiz = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ) };
+
+	hcsplt.b.compsplt = 1;
+	if (st->channel[n].hcchar_copy.b.epdir == 1) {
+		// If IN, the CSPLIT result contains the data or a hub handshake. hctsiz = maxpacket.
+		hctsiz.b.xfersize = st->channel[n].hctsiz_copy.b.xfersize;
+	} else {
+		// If OUT, the CSPLIT result contains handshake only.
+		hctsiz.b.xfersize = 0;
+	}
+	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCSPLT, hcsplt.d32);
+	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ, hctsiz.d32);
+	mb();
+}
+
+/**
+ * fiq_fsm_restart_np_pending() - Restart a single non-periodic contended transfer
+ * @st: Pointer to the channel's state
+ * @num_channels: Total number of host channels
+ * @orig_channel: Channel index of completed transfer
+ *
+ * In the case where an IN and OUT transfer are simultaneously scheduled to the
+ * same device/EP, inadequate hub implementations will misbehave. Once the first
+ * transfer is complete, a pending non-periodic split can then be issued.
+ */
+static void notrace fiq_fsm_restart_np_pending(struct fiq_state *st, int num_channels, int orig_channel)
+{
+	int i;
+	int dev_addr = st->channel[orig_channel].hcchar_copy.b.devaddr;
+	int ep_num = st->channel[orig_channel].hcchar_copy.b.epnum;
+	for (i = 0; i < num_channels; i++) {
+		if (st->channel[i].fsm == FIQ_NP_SSPLIT_PENDING &&
+			st->channel[i].hcchar_copy.b.devaddr == dev_addr &&
+			st->channel[i].hcchar_copy.b.epnum == ep_num) {
+			st->channel[i].fsm = FIQ_NP_SSPLIT_STARTED;
+			fiq_fsm_restart_channel(st, i, 0);
+			break;
+		}
+	}
+}
+
+static inline int notrace fiq_get_xfer_len(struct fiq_state *st, int n)
+{
+	/* The xfersize register is a bit wonky. For IN transfers, it decrements by the packet size. */
+	hctsiz_data_t hctsiz = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ) };
+
+	if (st->channel[n].hcchar_copy.b.epdir == 0) {
+		return st->channel[n].hctsiz_copy.b.xfersize;
+	} else {
+		return st->channel[n].hctsiz_copy.b.xfersize - hctsiz.b.xfersize;
+	}
+
+}
+
+
+/**
+ * fiq_increment_dma_buf() - update DMA address for bounce buffers after a CSPLIT
+ *
+ * Of use only for IN periodic transfers.
+ */
+static int notrace fiq_increment_dma_buf(struct fiq_state *st, int num_channels, int n)
+{
+	hcdma_data_t hcdma;
+	int i = st->channel[n].dma_info.index;
+	int len;
+	struct fiq_dma_blob *blob = (struct fiq_dma_blob *) st->dma_base;
+
+	len = fiq_get_xfer_len(st, n);
+	fiq_print(FIQDBG_INT, st, "LEN: %03d", len);
+	st->channel[n].dma_info.slot_len[i] = len;
+	i++;
+	if (i > 6)
+		BUG();
+
+	hcdma.d32 = (dma_addr_t) &blob->channel[n].index[i].buf[0];
+	FIQ_WRITE(st->dwc_regs_base + HC_DMA + (HC_OFFSET * n), hcdma.d32);
+	st->channel[n].dma_info.index = i;
+	return 0;
+}
+
+/**
+ * fiq_reload_hctsiz() - for IN transactions, reset HCTSIZ
+ */
+static void notrace fiq_fsm_reload_hctsiz(struct fiq_state *st, int n)
+{
+	hctsiz_data_t hctsiz = { .d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ) };
+	hctsiz.b.xfersize = st->channel[n].hctsiz_copy.b.xfersize;
+	hctsiz.b.pktcnt = 1;
+	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ, hctsiz.d32);
+}
+
+/**
+ * fiq_fsm_reload_hcdma() - for OUT transactions, rewind DMA pointer
+ */
+static void notrace fiq_fsm_reload_hcdma(struct fiq_state *st, int n)
+{
+	hcdma_data_t hcdma = st->channel[n].hcdma_copy;
+	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HC_DMA, hcdma.d32);
+}
+
+/**
+ * fiq_iso_out_advance() - update DMA address and split position bits
+ * for isochronous OUT transactions.
+ *
+ * Returns 1 if this is the last packet queued, 0 otherwise. Split-ALL and
+ * Split-BEGIN states are not handled - this is done when the transaction was queued.
+ *
+ * This function must only be called from the FIQ_ISO_OUT_ACTIVE state.
+ */
+static int notrace fiq_iso_out_advance(struct fiq_state *st, int num_channels, int n)
+{
+	hcsplt_data_t hcsplt;
+	hctsiz_data_t hctsiz;
+	hcdma_data_t hcdma;
+	struct fiq_dma_blob *blob = (struct fiq_dma_blob *) st->dma_base;
+	int last = 0;
+	int i = st->channel[n].dma_info.index;
+
+	fiq_print(FIQDBG_INT, st, "ADV %01d %01d ", n, i);
+	i++;
+	if (i == 4)
+		last = 1;
+	if (st->channel[n].dma_info.slot_len[i+1] == 255)
+		last = 1;
+
+	/* New DMA address - address of bounce buffer referred to in index */
+	hcdma.d32 = (uint32_t) &blob->channel[n].index[i].buf[0];
+	//hcdma.d32 = FIQ_READ(st->dwc_regs_base + HC_DMA + (HC_OFFSET * n));
+	//hcdma.d32 += st->channel[n].dma_info.slot_len[i];
+	fiq_print(FIQDBG_INT, st, "LAST: %01d ", last);
+	fiq_print(FIQDBG_INT, st, "LEN: %03d", st->channel[n].dma_info.slot_len[i]);
+	hcsplt.d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCSPLT);
+	hctsiz.d32 = FIQ_READ(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ);
+	hcsplt.b.xactpos = (last) ? ISOC_XACTPOS_END : ISOC_XACTPOS_MID;
+	/* Set up new packet length */
+	hctsiz.b.pktcnt = 1;
+	hctsiz.b.xfersize = st->channel[n].dma_info.slot_len[i];
+	fiq_print(FIQDBG_INT, st, "%08x", hctsiz.d32);
+
+	st->channel[n].dma_info.index++;
+	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCSPLT, hcsplt.d32);
+	FIQ_WRITE(st->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ, hctsiz.d32);
+	FIQ_WRITE(st->dwc_regs_base + HC_DMA + (HC_OFFSET * n), hcdma.d32);
+	return last;
+}
+
+/**
+ * fiq_fsm_tt_next_isoc() - queue next pending isochronous out start-split on a TT
+ *
+ * Despite the limitations of the DWC core, we can force a microframe pipeline of
+ * isochronous OUT start-split transactions while waiting for a corresponding other-type
+ * of endpoint to finish its CSPLITs. TTs have big periodic buffers therefore it
+ * is very unlikely that filling the start-split FIFO will cause data loss.
+ * This allows much better interleaving of transactions in an order-independent way-
+ * there is no requirement to prioritise isochronous, just a state-space search has
+ * to be performed on each periodic start-split complete interrupt.
+ */
+static int notrace fiq_fsm_tt_next_isoc(struct fiq_state *st, int num_channels, int n)
+{
+	int hub_addr = st->channel[n].hub_addr;
+	int port_addr = st->channel[n].port_addr;
+	int i, poked = 0;
+	for (i = 0; i < num_channels; i++) {
+		if (i == n || st->channel[i].fsm == FIQ_PASSTHROUGH)
+			continue;
+		if (st->channel[i].hub_addr == hub_addr &&
+			st->channel[i].port_addr == port_addr) {
+			switch (st->channel[i].fsm) {
+			case FIQ_PER_ISO_OUT_PENDING:
+				if (st->channel[i].nrpackets == 1) {
+					st->channel[i].fsm = FIQ_PER_ISO_OUT_LAST;
+				} else {
+					st->channel[i].fsm = FIQ_PER_ISO_OUT_ACTIVE;
+				}
+				fiq_fsm_restart_channel(st, i, 0);
+				poked = 1;
+				break;
+
+			default:
+				break;
+			}
+		}
+		if (poked)
+			break;
+	}
+	return poked;
+}
+
+/**
+ * fiq_fsm_tt_in_use() - search for host channels using this TT
+ * @n: Channel to use as reference
+ *
+ */
+int notrace noinline fiq_fsm_tt_in_use(struct fiq_state *st, int num_channels, int n)
+{
+	int hub_addr = st->channel[n].hub_addr;
+	int port_addr = st->channel[n].port_addr;
+	int i, in_use = 0;
+	for (i = 0; i < num_channels; i++) {
+		if (i == n || st->channel[i].fsm == FIQ_PASSTHROUGH)
+			continue;
+		switch (st->channel[i].fsm) {
+		/* TT is reserved for channels that are in the middle of a periodic
+		 * split transaction.
+		 */
+		case FIQ_PER_SSPLIT_STARTED:
+		case FIQ_PER_CSPLIT_WAIT:
+		case FIQ_PER_CSPLIT_NYET1:
+		//case FIQ_PER_CSPLIT_POLL:
+		case FIQ_PER_ISO_OUT_ACTIVE:
+		case FIQ_PER_ISO_OUT_LAST:
+			if (st->channel[i].hub_addr == hub_addr &&
+				st->channel[i].port_addr == port_addr) {
+				in_use = 1;
+			}
+			break;
+		default:
+			break;
+		}
+		if (in_use)
+			break;
+	}
+	return in_use;
+}
+
+/**
+ * fiq_fsm_more_csplits() - determine whether additional CSPLITs need
+ * 			to be issued for this IN transaction.
+ *
+ * We cannot tell the inbound PID of a data packet due to hardware limitations.
+ * we need to make an educated guess as to whether we need to queue another CSPLIT
+ * or not. A no-brainer is when we have received enough data to fill the endpoint
+ * size, but for endpoints that give variable-length data then we have to resort
+ * to heuristics.
+ *
+ * We also return whether this is the last CSPLIT to be queued, again based on
+ * heuristics. This is to allow a 1-uframe overlap of periodic split transactions.
+ * Note: requires at least 1 CSPLIT to have been performed prior to being called.
+ */
+
+/*
+ * We need some way of guaranteeing if a returned periodic packet of size X
+ * has a DATA0 PID.
+ * The heuristic value of 144 bytes assumes that the received data has maximal
+ * bit-stuffing and the clock frequency of the transmitting device is at the lowest
+ * permissible limit. If the transfer length results in a final packet size
+ * 144 < p <= 188, then an erroneous CSPLIT will be issued.
+ * Also used to ensure that an endpoint will nominally only return a single
+ * complete-split worth of data.
+ */
+#define DATA0_PID_HEURISTIC 144
+
+static int notrace noinline fiq_fsm_more_csplits(struct fiq_state *state, int n, int *probably_last)
+{
+
+	int i;
+	int total_len = 0;
+	int more_needed = 1;
+	struct fiq_channel_state *st = &state->channel[n];
+
+	for (i = 0; i < st->dma_info.index; i++) {
+			total_len += st->dma_info.slot_len[i];
+	}
+
+	*probably_last = 0;
+
+	if (st->hcchar_copy.b.eptype == 0x3) {
+		/*
+		 * An interrupt endpoint will take max 2 CSPLITs. if we are receiving data
+		 * then this is definitely the last CSPLIT.
+		 */
+		*probably_last = 1;
+	} else {
+		/* Isoc IN. This is a bit risky if we are the first transaction:
+		 * we may have been held off slightly. */
+		if (i > 1 && st->dma_info.slot_len[st->dma_info.index-1] <= DATA0_PID_HEURISTIC) {
+			more_needed = 0;
+		}
+		/* If in the next uframe we will receive enough data to fill the endpoint,
+		 * then only issue 1 more csplit.
+		 */
+		if (st->hctsiz_copy.b.xfersize - total_len <= DATA0_PID_HEURISTIC)
+			*probably_last = 1;
+	}
+
+	if (total_len >= st->hctsiz_copy.b.xfersize ||
+		i == 6 || total_len == 0)
+		/* Note: due to bit stuffing it is possible to have > 6 CSPLITs for
+		 * a single endpoint. Accepting more would completely break our scheduling mechanism though
+		 * - in these extreme cases we will pass through a truncated packet.
+		 */
+		more_needed = 0;
+
+	return more_needed;
+}
+
+/**
+ * fiq_fsm_too_late() - Test transaction for lateness
+ *
+ * If a SSPLIT for a large IN transaction is issued too late in a frame,
+ * the hub will disable the port to the device and respond with ERR handshakes.
+ * The hub status endpoint will not reflect this change.
+ * Returns 1 if we will issue a SSPLIT that will result in a device babble.
+ */
+int notrace fiq_fsm_too_late(struct fiq_state *st, int n)
+{
+	int uframe;
+	hfnum_data_t hfnum = { .d32 = FIQ_READ(st->dwc_regs_base + HFNUM) };
+	uframe = hfnum.b.frnum & 0x7;
+	if ((uframe < 6) && (st->channel[n].nrpackets + 1 + uframe > 7)) {
+		return 1;
+	} else {
+		return 0;
+	}
+}
+
+
+/**
+ * fiq_fsm_start_next_periodic() - A half-arsed attempt at a microframe pipeline
+ *
+ * Search pending transactions in the start-split pending state and queue them.
+ * Don't queue packets in uframe .5 (comes out in .6) (USB2.0 11.18.4).
+ * Note: we specifically don't do isochronous OUT transactions first because better
+ * use of the TT's start-split fifo can be achieved by pipelining an IN before an OUT.
+ */
+static void notrace noinline fiq_fsm_start_next_periodic(struct fiq_state *st, int num_channels)
+{
+	int n;
+	hfnum_data_t hfnum = { .d32 = FIQ_READ(st->dwc_regs_base + HFNUM) };
+	if ((hfnum.b.frnum & 0x7) == 5)
+		return;
+	for (n = 0; n < num_channels; n++) {
+		if (st->channel[n].fsm == FIQ_PER_SSPLIT_QUEUED) {
+			/* Check to see if any other transactions are using this TT */
+			if(!fiq_fsm_tt_in_use(st, num_channels, n)) {
+				if (!fiq_fsm_too_late(st, n)) {
+					st->channel[n].fsm = FIQ_PER_SSPLIT_STARTED;
+					fiq_print(FIQDBG_INT, st, "NEXTPER ");
+					fiq_fsm_restart_channel(st, n, 0);
+				} else {
+					st->channel[n].fsm = FIQ_PER_SPLIT_TIMEOUT;
+				}
+				break;
+			}
+		}
+	}
+	for (n = 0; n < num_channels; n++) {
+		if (st->channel[n].fsm == FIQ_PER_ISO_OUT_PENDING) {
+			if (!fiq_fsm_tt_in_use(st, num_channels, n)) {
+				fiq_print(FIQDBG_INT, st, "NEXTISO ");
+				if (st->channel[n].nrpackets == 1)
+					st->channel[n].fsm = FIQ_PER_ISO_OUT_LAST;
+				else
+					st->channel[n].fsm = FIQ_PER_ISO_OUT_ACTIVE;
+				fiq_fsm_restart_channel(st, n, 0);
+				break;
+			}
+		}
+	}
+}
+
+/**
+ * fiq_fsm_update_hs_isoc() - update isochronous frame and transfer data
+ * @state:	Pointer to fiq_state
+ * @n:		Channel transaction is active on
+ * @hcint:	Copy of host channel interrupt register
+ *
+ * Returns 0 if there are no more transactions for this HC to do, 1
+ * otherwise.
+ */
+static int notrace noinline fiq_fsm_update_hs_isoc(struct fiq_state *state, int n, hcint_data_t hcint)
+{
+	struct fiq_channel_state *st = &state->channel[n];
+	int xfer_len = 0, nrpackets = 0;
+	hcdma_data_t hcdma;
+	fiq_print(FIQDBG_INT, state, "HSISO %02d", n);
+
+	xfer_len = fiq_get_xfer_len(state, n);
+	st->hs_isoc_info.iso_desc[st->hs_isoc_info.index].actual_length = xfer_len;
+
+	st->hs_isoc_info.iso_desc[st->hs_isoc_info.index].status = hcint.d32;
+
+	st->hs_isoc_info.index++;
+	if (st->hs_isoc_info.index == st->hs_isoc_info.nrframes) {
+		return 0;
+	}
+
+	/* grab the next DMA address offset from the array */
+	hcdma.d32 = st->hcdma_copy.d32 + st->hs_isoc_info.iso_desc[st->hs_isoc_info.index].offset;
+	FIQ_WRITE(state->dwc_regs_base + HC_DMA + (HC_OFFSET * n), hcdma.d32);
+
+	/* We need to set multi_count. This is a bit tricky - has to be set per-transaction as
+	 * the core needs to be told to send the correct number. Caution: for IN transfers,
+	 * this is always set to the maximum size of the endpoint. */
+	xfer_len = st->hs_isoc_info.iso_desc[st->hs_isoc_info.index].length;
+	/* Integer divide in a FIQ: fun. FIXME: make this not suck */
+	nrpackets = (xfer_len + st->hcchar_copy.b.mps - 1) / st->hcchar_copy.b.mps;
+	if (nrpackets == 0)
+		nrpackets = 1;
+	st->hcchar_copy.b.multicnt = nrpackets;
+	st->hctsiz_copy.b.pktcnt = nrpackets;
+
+	/* Initial PID also needs to be set */
+	if (st->hcchar_copy.b.epdir == 0) {
+		st->hctsiz_copy.b.xfersize = xfer_len;
+		switch (st->hcchar_copy.b.multicnt) {
+		case 1:
+			st->hctsiz_copy.b.pid = DWC_PID_DATA0;
+			break;
+		case 2:
+		case 3:
+			st->hctsiz_copy.b.pid = DWC_PID_MDATA;
+			break;
+		}
+
+	} else {
+		st->hctsiz_copy.b.xfersize = nrpackets * st->hcchar_copy.b.mps;
+		switch (st->hcchar_copy.b.multicnt) {
+		case 1:
+			st->hctsiz_copy.b.pid = DWC_PID_DATA0;
+			break;
+		case 2:
+			st->hctsiz_copy.b.pid = DWC_PID_DATA1;
+			break;
+		case 3:
+			st->hctsiz_copy.b.pid = DWC_PID_DATA2;
+			break;
+		}
+	}
+	FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCTSIZ, st->hctsiz_copy.d32);
+	FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR, st->hcchar_copy.d32);
+	/* Channel is enabled on hcint handler exit */
+	fiq_print(FIQDBG_INT, state, "HSISOOUT");
+	return 1;
+}
+
+
+/**
+ * fiq_fsm_do_sof() - FSM start-of-frame interrupt handler
+ * @state:	Pointer to the state struct passed from banked FIQ mode registers.
+ * @num_channels:	set according to the DWC hardware configuration
+ *
+ * The SOF handler in FSM mode has two functions
+ * 1. Hold off SOF from causing schedule advancement in IRQ context if there's
+ *    nothing to do
+ * 2. Advance certain FSM states that require either a microframe delay, or a microframe
+ *    of holdoff.
+ *
+ * The second part is architecture-specific to mach-bcm2835 -
+ * a sane interrupt controller would have a mask register for ARM interrupt sources
+ * to be promoted to the nFIQ line, but it doesn't. Instead a single interrupt
+ * number (USB) can be enabled. This means that certain parts of the USB specification
+ * that require "wait a little while, then issue another packet" cannot be fulfilled with
+ * the timing granularity required to achieve optimal throughout. The workaround is to use
+ * the SOF "timer" (125uS) to perform this task.
+ */
+static int notrace noinline fiq_fsm_do_sof(struct fiq_state *state, int num_channels)
+{
+	hfnum_data_t hfnum = { .d32 = FIQ_READ(state->dwc_regs_base + HFNUM) };
+	int n;
+	int kick_irq = 0;
+
+	if ((hfnum.b.frnum & 0x7) == 1) {
+		/* We cannot issue csplits for transactions in the last frame past (n+1).1
+		 * Check to see if there are any transactions that are stale.
+		 * Boot them out.
+		 */
+		for (n = 0; n < num_channels; n++) {
+			switch (state->channel[n].fsm) {
+			case FIQ_PER_CSPLIT_WAIT:
+			case FIQ_PER_CSPLIT_NYET1:
+			case FIQ_PER_CSPLIT_POLL:
+			case FIQ_PER_CSPLIT_LAST:
+				/* Check if we are no longer in the same full-speed frame. */
+				if (((state->channel[n].expected_uframe & 0x3FFF) & ~0x7) <
+						(hfnum.b.frnum & ~0x7))
+					state->channel[n].fsm = FIQ_PER_SPLIT_TIMEOUT;
+				break;
+			default:
+				break;
+			}
+		}
+	}
+
+	for (n = 0; n < num_channels; n++) {
+		switch (state->channel[n].fsm) {
+
+		case FIQ_NP_SSPLIT_RETRY:
+		case FIQ_NP_IN_CSPLIT_RETRY:
+		case FIQ_NP_OUT_CSPLIT_RETRY:
+			fiq_fsm_restart_channel(state, n, 0);
+			break;
+
+		case FIQ_HS_ISOC_SLEEPING:
+			/* Is it time to wake this channel yet? */
+			if (--state->channel[n].uframe_sleeps == 0) {
+				state->channel[n].fsm = FIQ_HS_ISOC_TURBO;
+				fiq_fsm_restart_channel(state, n, 0);
+			}
+			break;
+
+		case FIQ_PER_SSPLIT_QUEUED:
+			if ((hfnum.b.frnum & 0x7) == 5)
+				break;
+			if(!fiq_fsm_tt_in_use(state, num_channels, n)) {
+				if (!fiq_fsm_too_late(state, n)) {
+					fiq_print(FIQDBG_INT, state, "SOF GO %01d", n);
+					fiq_fsm_restart_channel(state, n, 0);
+					state->channel[n].fsm = FIQ_PER_SSPLIT_STARTED;
+				} else {
+					/* Transaction cannot be started without risking a device babble error */
+					state->channel[n].fsm = FIQ_PER_SPLIT_TIMEOUT;
+					state->haintmsk_saved.b2.chint &= ~(1 << n);
+					FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINTMSK, 0);
+					kick_irq |= 1;
+				}
+			}
+			break;
+
+		case FIQ_PER_ISO_OUT_PENDING:
+			/* Ordinarily, this should be poked after the SSPLIT
+			 * complete interrupt for a competing transfer on the same
+			 * TT. Doesn't happen for aborted transactions though.
+			 */
+			if ((hfnum.b.frnum & 0x7) >= 5)
+				break;
+			if (!fiq_fsm_tt_in_use(state, num_channels, n)) {
+				/* Hardware bug. SOF can sometimes occur after the channel halt interrupt
+				 * that caused this.
+				 */
+					fiq_fsm_restart_channel(state, n, 0);
+					fiq_print(FIQDBG_INT, state, "SOF ISOC");
+					if (state->channel[n].nrpackets == 1) {
+						state->channel[n].fsm = FIQ_PER_ISO_OUT_LAST;
+					} else {
+						state->channel[n].fsm = FIQ_PER_ISO_OUT_ACTIVE;
+					}
+			}
+			break;
+
+		case FIQ_PER_CSPLIT_WAIT:
+			/* we are guaranteed to be in this state if and only if the SSPLIT interrupt
+			 * occurred when the bus transaction occurred. The SOF interrupt reversal bug
+			 * will utterly bugger this up though.
+			 */
+			if (hfnum.b.frnum != state->channel[n].expected_uframe) {
+				fiq_print(FIQDBG_INT, state, "SOFCS %d ", n);
+				state->channel[n].fsm = FIQ_PER_CSPLIT_POLL;
+				fiq_fsm_restart_channel(state, n, 0);
+				fiq_fsm_start_next_periodic(state, num_channels);
+
+			}
+			break;
+
+		case FIQ_PER_SPLIT_TIMEOUT:
+		case FIQ_DEQUEUE_ISSUED:
+			/* Ugly: we have to force a HCD interrupt.
+			 * Poke the mask for the channel in question.
+			 * We will take a fake SOF because of this, but
+			 * that's OK.
+			 */
+			state->haintmsk_saved.b2.chint &= ~(1 << n);
+			FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINTMSK, 0);
+			kick_irq |= 1;
+			break;
+
+		default:
+			break;
+		}
+	}
+
+	if (state->kick_np_queues ||
+			dwc_frame_num_le(state->next_sched_frame, hfnum.b.frnum))
+		kick_irq |= 1;
+
+	return !kick_irq;
+}
+
+
+/**
+ * fiq_fsm_do_hcintr() - FSM host channel interrupt handler
+ * @state: Pointer to the FIQ state struct
+ * @num_channels: Number of channels as per hardware config
+ * @n: channel for which HAINT(i) was raised
+ *
+ * An important property is that only the CHHLT interrupt is unmasked. Unfortunately, AHBerr is as well.
+ */
+static int notrace noinline fiq_fsm_do_hcintr(struct fiq_state *state, int num_channels, int n)
+{
+	hcint_data_t hcint;
+	hcintmsk_data_t hcintmsk;
+	hcint_data_t hcint_probe;
+	hcchar_data_t hcchar;
+	int handled = 0;
+	int restart = 0;
+	int last_csplit = 0;
+	int start_next_periodic = 0;
+	struct fiq_channel_state *st = &state->channel[n];
+	hfnum_data_t hfnum;
+
+	hcint.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINT);
+	hcintmsk.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINTMSK);
+	hcint_probe.d32 = hcint.d32 & hcintmsk.d32;
+
+	if (st->fsm != FIQ_PASSTHROUGH) {
+		fiq_print(FIQDBG_INT, state, "HC%01d ST%02d", n, st->fsm);
+		fiq_print(FIQDBG_INT, state, "%08x", hcint.d32);
+	}
+
+	switch (st->fsm) {
+
+	case FIQ_PASSTHROUGH:
+	case FIQ_DEQUEUE_ISSUED:
+		/* doesn't belong to us, kick it upstairs */
+		break;
+
+	case FIQ_PASSTHROUGH_ERRORSTATE:
+		/* We are here to emulate the error recovery mechanism of the dwc HCD.
+		 * Several interrupts are unmasked if a previous transaction failed - it's
+		 * death for the FIQ to attempt to handle them as the channel isn't halted.
+		 * Emulate what the HCD does in this situation: mask and continue.
+		 * The FSM has no other state setup so this has to be handled out-of-band.
+		 */
+		fiq_print(FIQDBG_ERR, state, "ERRST %02d", n);
+		if (hcint_probe.b.nak || hcint_probe.b.ack || hcint_probe.b.datatglerr) {
+			fiq_print(FIQDBG_ERR, state, "RESET %02d", n);
+			/* In some random cases we can get a NAK interrupt coincident with a Xacterr
+			 * interrupt, after the device has disappeared.
+			 */
+			if (!hcint.b.xacterr)
+				st->nr_errors = 0;
+			hcintmsk.b.nak = 0;
+			hcintmsk.b.ack = 0;
+			hcintmsk.b.datatglerr = 0;
+			FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINTMSK, hcintmsk.d32);
+			return 1;
+		}
+		if (hcint_probe.b.chhltd) {
+			fiq_print(FIQDBG_ERR, state, "CHHLT %02d", n);
+			fiq_print(FIQDBG_ERR, state, "%08x", hcint.d32);
+			return 0;
+		}
+		break;
+
+	/* Non-periodic state groups */
+	case FIQ_NP_SSPLIT_STARTED:
+	case FIQ_NP_SSPLIT_RETRY:
+		/* Got a HCINT for a NP SSPLIT. Expected ACK / NAK / fail */
+		if (hcint.b.ack) {
+			/* SSPLIT complete. For OUT, the data has been sent. For IN, the LS transaction
+			 * will start shortly. SOF needs to kick the transaction to prevent a NYET flood.
+			 */
+			if(st->hcchar_copy.b.epdir == 1)
+				st->fsm = FIQ_NP_IN_CSPLIT_RETRY;
+			else
+				st->fsm = FIQ_NP_OUT_CSPLIT_RETRY;
+			st->nr_errors = 0;
+			handled = 1;
+			fiq_fsm_setup_csplit(state, n);
+		} else if (hcint.b.nak) {
+			// No buffer space in TT. Retry on a uframe boundary.
+			fiq_fsm_reload_hcdma(state, n);
+			st->fsm = FIQ_NP_SSPLIT_RETRY;
+			handled = 1;
+		} else if (hcint.b.xacterr) {
+			// The only other one we care about is xacterr. This implies HS bus error - retry.
+			st->nr_errors++;
+			if(st->hcchar_copy.b.epdir == 0)
+				fiq_fsm_reload_hcdma(state, n);
+			st->fsm = FIQ_NP_SSPLIT_RETRY;
+			if (st->nr_errors >= 3) {
+				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
+			} else {
+				handled = 1;
+				restart = 1;
+			}
+		} else {
+			st->fsm = FIQ_NP_SPLIT_LS_ABORTED;
+			handled = 0;
+			restart = 0;
+		}
+		break;
+
+	case FIQ_NP_IN_CSPLIT_RETRY:
+		/* Received a CSPLIT done interrupt.
+		 * Expected Data/NAK/STALL/NYET for IN.
+		 */
+		if (hcint.b.xfercomp) {
+			/* For IN, data is present. */
+			st->fsm = FIQ_NP_SPLIT_DONE;
+		} else if (hcint.b.nak) {
+			/* no endpoint data. Punt it upstairs */
+			st->fsm = FIQ_NP_SPLIT_DONE;
+		} else if (hcint.b.nyet) {
+			/* CSPLIT NYET - retry on a uframe boundary. */
+			handled = 1;
+			st->nr_errors = 0;
+		} else if (hcint.b.datatglerr) {
+			/* data toggle errors do not set the xfercomp bit. */
+			st->fsm = FIQ_NP_SPLIT_LS_ABORTED;
+		} else if (hcint.b.xacterr) {
+			/* HS error. Retry immediate */
+			st->fsm = FIQ_NP_IN_CSPLIT_RETRY;
+			st->nr_errors++;
+			if (st->nr_errors >= 3) {
+				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
+			} else {
+				handled = 1;
+				restart = 1;
+			}
+		} else if (hcint.b.stall || hcint.b.bblerr) {
+			/* A STALL implies either a LS bus error or a genuine STALL. */
+			st->fsm = FIQ_NP_SPLIT_LS_ABORTED;
+		} else {
+			/*  Hardware bug. It's possible in some cases to
+			 *  get a channel halt with nothing else set when
+			 *  the response was a NYET. Treat as local 3-strikes retry.
+			 */
+			hcint_data_t hcint_test = hcint;
+			hcint_test.b.chhltd = 0;
+			if (!hcint_test.d32) {
+				st->nr_errors++;
+				if (st->nr_errors >= 3) {
+					st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
+				} else {
+					handled = 1;
+				}
+			} else {
+				/* Bail out if something unexpected happened */
+				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
+			}
+		}
+		if (st->fsm != FIQ_NP_IN_CSPLIT_RETRY) {
+			fiq_fsm_restart_np_pending(state, num_channels, n);
+		}
+		break;
+
+	case FIQ_NP_OUT_CSPLIT_RETRY:
+		/* Received a CSPLIT done interrupt.
+		 * Expected ACK/NAK/STALL/NYET/XFERCOMP for OUT.*/
+		if (hcint.b.xfercomp) {
+			st->fsm = FIQ_NP_SPLIT_DONE;
+		} else if (hcint.b.nak) {
+			// The HCD will implement the holdoff on frame boundaries.
+			st->fsm = FIQ_NP_SPLIT_DONE;
+		} else if (hcint.b.nyet) {
+			// Hub still processing.
+			st->fsm = FIQ_NP_OUT_CSPLIT_RETRY;
+			handled = 1;
+			st->nr_errors = 0;
+			//restart = 1;
+		} else if (hcint.b.xacterr) {
+			/* HS error. retry immediate */
+			st->fsm = FIQ_NP_OUT_CSPLIT_RETRY;
+			st->nr_errors++;
+			if (st->nr_errors >= 3) {
+				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
+			} else {
+				handled = 1;
+				restart = 1;
+			}
+		} else if (hcint.b.stall) {
+			/* LS bus error or genuine stall */
+			st->fsm = FIQ_NP_SPLIT_LS_ABORTED;
+		} else {
+			/*
+			 * Hardware bug. It's possible in some cases to get a
+			 * channel halt with nothing else set when the response was a NYET.
+			 * Treat as local 3-strikes retry.
+			 */
+			hcint_data_t hcint_test = hcint;
+			hcint_test.b.chhltd = 0;
+			if (!hcint_test.d32) {
+				st->nr_errors++;
+				if (st->nr_errors >= 3) {
+					st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
+				} else {
+					handled = 1;
+				}
+			} else {
+				// Something unexpected happened. AHBerror or babble perhaps. Let the IRQ deal with it.
+				st->fsm = FIQ_NP_SPLIT_HS_ABORTED;
+			}
+		}
+		if (st->fsm != FIQ_NP_OUT_CSPLIT_RETRY) {
+			fiq_fsm_restart_np_pending(state, num_channels, n);
+		}
+		break;
+
+	/* Periodic split states (except isoc out) */
+	case FIQ_PER_SSPLIT_STARTED:
+		/* Expect an ACK or failure for SSPLIT */
+		if (hcint.b.ack) {
+			/*
+			 * SSPLIT transfer complete interrupt - the generation of this interrupt is fraught with bugs.
+			 * For a packet queued in microframe n-3 to appear in n-2, if the channel is enabled near the EOF1
+			 * point for microframe n-3, the packet will not appear on the bus until microframe n.
+			 * Additionally, the generation of the actual interrupt is dodgy. For a packet appearing on the bus
+			 * in microframe n, sometimes the interrupt is generated immediately. Sometimes, it appears in n+1
+			 * coincident with SOF for n+1.
+			 * SOF is also buggy. It can sometimes be raised AFTER the first bus transaction has taken place.
+			 * These appear to be caused by timing/clock crossing bugs within the core itself.
+			 * State machine workaround.
+			 */
+			hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
+			hcchar.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
+			fiq_fsm_setup_csplit(state, n);
+			/* Poke the oddfrm bit. If we are equivalent, we received the interrupt at the correct
+			 * time. If not, then we're in the next SOF.
+			 */
+			if ((hfnum.b.frnum & 0x1) == hcchar.b.oddfrm) {
+				fiq_print(FIQDBG_INT, state, "CSWAIT %01d", n);
+				st->expected_uframe = hfnum.b.frnum;
+				st->fsm = FIQ_PER_CSPLIT_WAIT;
+			} else {
+				fiq_print(FIQDBG_INT, state, "CSPOL  %01d", n);
+				/* For isochronous IN endpoints,
+				 * we need to hold off if we are expecting a lot of data */
+				if (st->hcchar_copy.b.mps < DATA0_PID_HEURISTIC) {
+					start_next_periodic = 1;
+				}
+				/* Danger will robinson: we are in a broken state. If our first interrupt after
+				 * this is a NYET, it will be delayed by 1 uframe and result in an unrecoverable
+				 * lag. Unmask the NYET interrupt.
+				 */
+				st->expected_uframe = (hfnum.b.frnum + 1) & 0x3FFF;
+				st->fsm = FIQ_PER_CSPLIT_BROKEN_NYET1;
+				restart = 1;
+			}
+			handled = 1;
+		} else if (hcint.b.xacterr) {
+			/* 3-strikes retry is enabled, we have hit our max nr_errors */
+			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
+			start_next_periodic = 1;
+		} else {
+			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
+			start_next_periodic = 1;
+		}
+		/* We can now queue the next isochronous OUT transaction, if one is pending. */
+		if(fiq_fsm_tt_next_isoc(state, num_channels, n)) {
+			fiq_print(FIQDBG_INT, state, "NEXTISO ");
+		}
+		break;
+
+	case FIQ_PER_CSPLIT_NYET1:
+		/* First CSPLIT attempt was a NYET. If we get a subsequent NYET,
+		 * we are too late and the TT has dropped its CSPLIT fifo.
+		 */
+		hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
+		hcchar.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
+		start_next_periodic = 1;
+		if (hcint.b.nak) {
+			st->fsm = FIQ_PER_SPLIT_DONE;
+		} else if (hcint.b.xfercomp) {
+			fiq_increment_dma_buf(state, num_channels, n);
+			st->fsm = FIQ_PER_CSPLIT_POLL;
+			st->nr_errors = 0;
+			if (fiq_fsm_more_csplits(state, n, &last_csplit)) {
+				handled = 1;
+				restart = 1;
+				if (!last_csplit)
+					start_next_periodic = 0;
+			} else {
+				st->fsm = FIQ_PER_SPLIT_DONE;
+			}
+		} else if (hcint.b.nyet) {
+			/* Doh. Data lost. */
+			st->fsm = FIQ_PER_SPLIT_NYET_ABORTED;
+		} else if (hcint.b.xacterr || hcint.b.stall || hcint.b.bblerr) {
+			st->fsm = FIQ_PER_SPLIT_LS_ABORTED;
+		} else {
+			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
+		}
+		break;
+
+	case FIQ_PER_CSPLIT_BROKEN_NYET1:
+		/*
+		 * we got here because our host channel is in the delayed-interrupt
+		 * state and we cannot take a NYET interrupt any later than when it
+		 * occurred. Disable then re-enable the channel if this happens to force
+		 * CSPLITs to occur at the right time.
+		 */
+		hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
+		hcchar.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
+		fiq_print(FIQDBG_INT, state, "BROK: %01d ", n);
+		if (hcint.b.nak) {
+			st->fsm = FIQ_PER_SPLIT_DONE;
+			start_next_periodic = 1;
+		} else if (hcint.b.xfercomp) {
+			fiq_increment_dma_buf(state, num_channels, n);
+			if (fiq_fsm_more_csplits(state, n, &last_csplit)) {
+				st->fsm = FIQ_PER_CSPLIT_POLL;
+				handled = 1;
+				restart = 1;
+				start_next_periodic = 1;
+				/* Reload HCTSIZ for the next transfer */
+				fiq_fsm_reload_hctsiz(state, n);
+				if (!last_csplit)
+					start_next_periodic = 0;
+			} else {
+				st->fsm = FIQ_PER_SPLIT_DONE;
+			}
+		} else if (hcint.b.nyet) {
+			st->fsm = FIQ_PER_SPLIT_NYET_ABORTED;
+			start_next_periodic = 1;
+		} else if (hcint.b.xacterr || hcint.b.stall || hcint.b.bblerr) {
+			/* Local 3-strikes retry is handled by the core. This is a ERR response.*/
+			st->fsm = FIQ_PER_SPLIT_LS_ABORTED;
+		} else {
+			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
+		}
+		break;
+
+	case FIQ_PER_CSPLIT_POLL:
+		hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
+		hcchar.d32 = FIQ_READ(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCCHAR);
+		start_next_periodic = 1;
+		if (hcint.b.nak) {
+			st->fsm = FIQ_PER_SPLIT_DONE;
+		} else if (hcint.b.xfercomp) {
+			fiq_increment_dma_buf(state, num_channels, n);
+			if (fiq_fsm_more_csplits(state, n, &last_csplit)) {
+				handled = 1;
+				restart = 1;
+				/* Reload HCTSIZ for the next transfer */
+				fiq_fsm_reload_hctsiz(state, n);
+				if (!last_csplit)
+					start_next_periodic = 0;
+			} else {
+				st->fsm = FIQ_PER_SPLIT_DONE;
+			}
+		} else if (hcint.b.nyet) {
+			/* Are we a NYET after the first data packet? */
+			if (st->nrpackets == 0) {
+				st->fsm = FIQ_PER_CSPLIT_NYET1;
+				handled = 1;
+				restart = 1;
+			} else {
+				/* We got a NYET when polling CSPLITs. Can happen
+				 * if our heuristic fails, or if someone disables us
+				 * for any significant length of time.
+				 */
+				if (st->nr_errors >= 3) {
+					st->fsm = FIQ_PER_SPLIT_NYET_ABORTED;
+				} else {
+					st->fsm = FIQ_PER_SPLIT_DONE;
+				}
+			}
+		} else if (hcint.b.xacterr || hcint.b.stall || hcint.b.bblerr) {
+			/* For xacterr, Local 3-strikes retry is handled by the core. This is a ERR response.*/
+			st->fsm = FIQ_PER_SPLIT_LS_ABORTED;
+		} else {
+			st->fsm = FIQ_PER_SPLIT_HS_ABORTED;
+		}
+		break;
+
+	case FIQ_HS_ISOC_TURBO:
+		if (fiq_fsm_update_hs_isoc(state, n, hcint)) {
+			/* more transactions to come */
+			handled = 1;
+			fiq_print(FIQDBG_INT, state, "HSISO M ");
+			/* For strided transfers, put ourselves to sleep */
+			if (st->hs_isoc_info.stride > 1) {
+				st->uframe_sleeps = st->hs_isoc_info.stride - 1;
+				st->fsm = FIQ_HS_ISOC_SLEEPING;
+			} else {
+				restart = 1;
+			}
+		} else {
+			st->fsm = FIQ_HS_ISOC_DONE;
+			fiq_print(FIQDBG_INT, state, "HSISO F ");
+		}
+		break;
+
+	case FIQ_HS_ISOC_ABORTED:
+		/* This abort is called by the driver rewriting the state mid-transaction
+		 * which allows the dequeue mechanism to work more effectively.
+		 */
+		break;
+
+	case FIQ_PER_ISO_OUT_ACTIVE:
+		if (hcint.b.ack) {
+			if(fiq_iso_out_advance(state, num_channels, n)) {
+				/* last OUT transfer */
+				st->fsm = FIQ_PER_ISO_OUT_LAST;
+				/*
+				 * Assuming the periodic FIFO in the dwc core
+				 * actually does its job properly, we can queue
+				 * the next ssplit now and in theory, the wire
+				 * transactions will be in-order.
+				 */
+				// No it doesn't. It appears to process requests in host channel order.
+				//start_next_periodic = 1;
+			}
+			handled = 1;
+			restart = 1;
+		} else {
+			/*
+			 * Isochronous transactions carry on regardless. Log the error
+			 * and continue.
+			 */
+			//explode += 1;
+			st->nr_errors++;
+			if(fiq_iso_out_advance(state, num_channels, n)) {
+				st->fsm = FIQ_PER_ISO_OUT_LAST;
+				//start_next_periodic = 1;
+			}
+			handled = 1;
+			restart = 1;
+		}
+		break;
+
+	case FIQ_PER_ISO_OUT_LAST:
+		if (hcint.b.ack) {
+			/* All done here */
+			st->fsm = FIQ_PER_ISO_OUT_DONE;
+		} else {
+			st->fsm = FIQ_PER_ISO_OUT_DONE;
+			st->nr_errors++;
+		}
+		start_next_periodic = 1;
+		break;
+
+	case FIQ_PER_SPLIT_TIMEOUT:
+		/* SOF kicked us because we overran. */
+		start_next_periodic = 1;
+		break;
+
+	default:
+		break;
+	}
+
+	if (handled) {
+		FIQ_WRITE(state->dwc_regs_base + HC_START + (HC_OFFSET * n) + HCINT, hcint.d32);
+	} else {
+		/* Copy the regs into the state so the IRQ knows what to do */
+		st->hcint_copy.d32 = hcint.d32;
+	}
+
+	if (restart) {
+		/* Restart always implies handled. */
+		if (restart == 2) {
+			/* For complete-split INs, the show must go on.
+			 * Force a channel restart */
+			fiq_fsm_restart_channel(state, n, 1);
+		} else {
+			fiq_fsm_restart_channel(state, n, 0);
+		}
+	}
+	if (start_next_periodic) {
+		fiq_fsm_start_next_periodic(state, num_channels);
+	}
+	if (st->fsm != FIQ_PASSTHROUGH)
+		fiq_print(FIQDBG_INT, state, "FSMOUT%02d", st->fsm);
+
+	return handled;
+}
+
+
+/**
+ * dwc_otg_fiq_fsm() - Flying State Machine (monster) FIQ
+ * @state:		pointer to state struct passed from the banked FIQ mode registers.
+ * @num_channels:	set according to the DWC hardware configuration
+ * @dma:		pointer to DMA bounce buffers for split transaction slots
+ *
+ * The FSM FIQ performs the low-level tasks that normally would be performed by the microcode
+ * inside an EHCI or similar host controller regarding split transactions. The DWC core
+ * interrupts each and every time a split transaction packet is received or sent successfully.
+ * This results in either an interrupt storm when everything is working "properly", or
+ * the interrupt latency of the system in general breaks time-sensitive periodic split
+ * transactions. Pushing the low-level, but relatively easy state machine work into the FIQ
+ * solves these problems.
+ *
+ * Return: void
+ */
+void notrace dwc_otg_fiq_fsm(struct fiq_state *state, int num_channels)
+{
+	gintsts_data_t gintsts, gintsts_handled;
+	gintmsk_data_t gintmsk;
+	//hfnum_data_t hfnum;
+	haint_data_t haint, haint_handled;
+	haintmsk_data_t haintmsk;
+	int kick_irq = 0;
+
+	gintsts_handled.d32 = 0;
+	haint_handled.d32 = 0;
+
+	fiq_fsm_spin_lock(&state->lock);
+	gintsts.d32 = FIQ_READ(state->dwc_regs_base + GINTSTS);
+	gintmsk.d32 = FIQ_READ(state->dwc_regs_base + GINTMSK);
+	gintsts.d32 &= gintmsk.d32;
+
+	if (gintsts.b.sofintr) {
+		/* For FSM mode, SOF is required to keep the state machine advance for
+		 * certain stages of the periodic pipeline. It's death to mask this
+		 * interrupt in that case.
+		 */
+
+		if (!fiq_fsm_do_sof(state, num_channels)) {
+			/* Kick IRQ once. Queue advancement means that all pending transactions
+			 * will get serviced when the IRQ finally executes.
+			 */
+			if (state->gintmsk_saved.b.sofintr == 1)
+				kick_irq |= 1;
+			state->gintmsk_saved.b.sofintr = 0;
+		}
+		gintsts_handled.b.sofintr = 1;
+	}
+
+	if (gintsts.b.hcintr) {
+		int i;
+		haint.d32 = FIQ_READ(state->dwc_regs_base + HAINT);
+		haintmsk.d32 = FIQ_READ(state->dwc_regs_base + HAINTMSK);
+		haint.d32 &= haintmsk.d32;
+		haint_handled.d32 = 0;
+		for (i=0; i<num_channels; i++) {
+			if (haint.b2.chint & (1 << i)) {
+				if(!fiq_fsm_do_hcintr(state, num_channels, i)) {
+					/* HCINT was not handled in FIQ
+					 * HAINT is level-sensitive, leading to level-sensitive ginststs.b.hcint bit.
+					 * Mask HAINT(i) but keep top-level hcint unmasked.
+					 */
+					state->haintmsk_saved.b2.chint &= ~(1 << i);
+				} else {
+					/* do_hcintr cleaned up after itself, but clear haint */
+					haint_handled.b2.chint |= (1 << i);
+				}
+			}
+		}
+
+		if (haint_handled.b2.chint) {
+			FIQ_WRITE(state->dwc_regs_base + HAINT, haint_handled.d32);
+		}
+
+		if (haintmsk.d32 != (haintmsk.d32 & state->haintmsk_saved.d32)) {
+			/*
+			 * This is necessary to avoid multiple retriggers of the MPHI in the case
+			 * where interrupts are held off and HCINTs start to pile up.
+			 * Only wake up the IRQ if a new interrupt came in, was not handled and was
+			 * masked.
+			 */
+			haintmsk.d32 &= state->haintmsk_saved.d32;
+			FIQ_WRITE(state->dwc_regs_base + HAINTMSK, haintmsk.d32);
+			kick_irq |= 1;
+		}
+		/* Top-Level interrupt - always handled because it's level-sensitive */
+		gintsts_handled.b.hcintr = 1;
+	}
+
+
+	/* Clear the bits in the saved register that were not handled but were triggered. */
+	state->gintmsk_saved.d32 &= ~(gintsts.d32 & ~gintsts_handled.d32);
+
+	/* FIQ didn't handle something - mask has changed - write new mask */
+	if (gintmsk.d32 != (gintmsk.d32 & state->gintmsk_saved.d32)) {
+		gintmsk.d32 &= state->gintmsk_saved.d32;
+		gintmsk.b.sofintr = 1;
+		FIQ_WRITE(state->dwc_regs_base + GINTMSK, gintmsk.d32);
+//		fiq_print(FIQDBG_INT, state, "KICKGINT");
+//		fiq_print(FIQDBG_INT, state, "%08x", gintmsk.d32);
+//		fiq_print(FIQDBG_INT, state, "%08x", state->gintmsk_saved.d32);
+		kick_irq |= 1;
+	}
+
+	if (gintsts_handled.d32) {
+		/* Only applies to edge-sensitive bits in GINTSTS */
+		FIQ_WRITE(state->dwc_regs_base + GINTSTS, gintsts_handled.d32);
+	}
+
+	/* We got an interrupt, didn't handle it. */
+	if (kick_irq) {
+		state->mphi_int_count++;
+		FIQ_WRITE(state->mphi_regs.outdda, (int) state->dummy_send);
+		FIQ_WRITE(state->mphi_regs.outddb, (1<<29));
+
+	}
+	state->fiq_done++;
+	mb();
+	fiq_fsm_spin_unlock(&state->lock);
+}
+
+
+/**
+ * dwc_otg_fiq_nop() - FIQ "lite"
+ * @state:	pointer to state struct passed from the banked FIQ mode registers.
+ *
+ * The "nop" handler does not intervene on any interrupts other than SOF.
+ * It is limited in scope to deciding at each SOF if the IRQ SOF handler (which deals
+ * with non-periodic/periodic queues) needs to be kicked.
+ *
+ * This is done to hold off the SOF interrupt, which occurs at a rate of 8000 per second.
+ *
+ * Return: void
+ */
+void notrace dwc_otg_fiq_nop(struct fiq_state *state)
+{
+	gintsts_data_t gintsts, gintsts_handled;
+	gintmsk_data_t gintmsk;
+	hfnum_data_t hfnum;
+
+	fiq_fsm_spin_lock(&state->lock);
+	hfnum.d32 = FIQ_READ(state->dwc_regs_base + HFNUM);
+	gintsts.d32 = FIQ_READ(state->dwc_regs_base + GINTSTS);
+	gintmsk.d32 = FIQ_READ(state->dwc_regs_base + GINTMSK);
+	gintsts.d32 &= gintmsk.d32;
+	gintsts_handled.d32 = 0;
+
+	if (gintsts.b.sofintr) {
+		if (!state->kick_np_queues &&
+				dwc_frame_num_gt(state->next_sched_frame, hfnum.b.frnum)) {
+			/* SOF handled, no work to do, just ACK interrupt */
+			gintsts_handled.b.sofintr = 1;
+		} else {
+			/* Kick IRQ */
+			state->gintmsk_saved.b.sofintr = 0;
+		}
+	}
+
+	/* Reset handled interrupts */
+	if(gintsts_handled.d32) {
+		FIQ_WRITE(state->dwc_regs_base + GINTSTS, gintsts_handled.d32);
+	}
+
+	/* Clear the bits in the saved register that were not handled but were triggered. */
+	state->gintmsk_saved.d32 &= ~(gintsts.d32 & ~gintsts_handled.d32);
+
+	/* We got an interrupt, didn't handle it and want to mask it */
+	if (~(state->gintmsk_saved.d32)) {
+		state->mphi_int_count++;
+		gintmsk.d32 &= state->gintmsk_saved.d32;
+		FIQ_WRITE(state->dwc_regs_base + GINTMSK, gintmsk.d32);
+		/* Force a clear before another dummy send */
+		FIQ_WRITE(state->mphi_regs.intstat, (1<<29));
+		FIQ_WRITE(state->mphi_regs.outdda, (int) state->dummy_send);
+		FIQ_WRITE(state->mphi_regs.outddb, (1<<29));
+
+	}
+	state->fiq_done++;
+	mb();
+	fiq_fsm_spin_unlock(&state->lock);
+}
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
new file mode 100644
index 000000000000..ed088f34f210
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_fsm.h
@@ -0,0 +1,396 @@
+/*
+ * dwc_otg_fiq_fsm.h - Finite state machine FIQ header definitions
+ *
+ * Copyright (c) 2013 Raspberry Pi Foundation
+ *
+ * Author: Jonathan Bell <jonathan@raspberrypi.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *	* Redistributions of source code must retain the above copyright
+ *	  notice, this list of conditions and the following disclaimer.
+ *	* Redistributions in binary form must reproduce the above copyright
+ *	  notice, this list of conditions and the following disclaimer in the
+ *	  documentation and/or other materials provided with the distribution.
+ *	* Neither the name of Raspberry Pi nor the
+ *	  names of its contributors may be used to endorse or promote products
+ *	  derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * This FIQ implements functionality that performs split transactions on
+ * the dwc_otg hardware without any outside intervention. A split transaction
+ * is "queued" by nominating a specific host channel to perform the entirety
+ * of a split transaction. This FIQ will then perform the microframe-precise
+ * scheduling required in each phase of the transaction until completion.
+ *
+ * The FIQ functionality has been surgically implanted into the Synopsys
+ * vendor-provided driver.
+ *
+ */
+
+#ifndef DWC_OTG_FIQ_FSM_H_
+#define DWC_OTG_FIQ_FSM_H_
+
+#include "dwc_otg_regs.h"
+#include "dwc_otg_cil.h"
+#include "dwc_otg_hcd.h"
+#include <linux/kernel.h>
+#include <linux/irqflags.h>
+#include <linux/string.h>
+#include <asm/barrier.h>
+
+#if 0
+#define FLAME_ON(x)					\
+do {							\
+	int gpioreg;                                    \
+							\
+	gpioreg = readl(__io_address(0x20200000+0x8));	\
+	gpioreg &= ~(7 << (x-20)*3);			\
+	gpioreg |= 0x1 << (x-20)*3;			\
+	writel(gpioreg, __io_address(0x20200000+0x8));	\
+							\
+	writel(1<<x, __io_address(0x20200000+(0x1C)));	\
+} while (0)
+
+#define FLAME_OFF(x)					\
+do {							\
+	writel(1<<x, __io_address(0x20200000+(0x28)));	\
+} while (0)
+#else
+#define FLAME_ON(x) do { } while (0)
+#define FLAME_OFF(X) do { } while (0)
+#endif
+
+/* This is a quick-and-dirty arch-specific register read/write. We know that
+ * writes to a peripheral on BCM2835 will always arrive in-order, also that
+ * reads and writes are executed in-order therefore the need for memory barriers
+ * is obviated if we're only talking to USB.
+ */
+#define FIQ_WRITE(_addr_,_data_) (*(volatile unsigned int *) (_addr_) = (_data_))
+#define FIQ_READ(_addr_) (*(volatile unsigned int *) (_addr_))
+
+/* FIQ-ified register definitions. Offsets are from dwc_regs_base. */
+#define GINTSTS		0x014
+#define GINTMSK		0x018
+/* Debug register. Poll the top of the received packets FIFO. */
+#define GRXSTSR		0x01C
+#define HFNUM		0x408
+#define HAINT		0x414
+#define HAINTMSK	0x418
+#define HPRT0		0x440
+
+/* HC_regs start from an offset of 0x500 */
+#define HC_START	0x500
+#define HC_OFFSET	0x020
+
+#define HC_DMA		0x514
+
+#define HCCHAR		0x00
+#define HCSPLT		0x04
+#define HCINT		0x08
+#define HCINTMSK	0x0C
+#define HCTSIZ		0x10
+
+#define ISOC_XACTPOS_ALL 	0b11
+#define ISOC_XACTPOS_BEGIN	0b10
+#define ISOC_XACTPOS_MID	0b00
+#define ISOC_XACTPOS_END	0b01
+
+#define DWC_PID_DATA2	0b01
+#define DWC_PID_MDATA	0b11
+#define DWC_PID_DATA1	0b10
+#define DWC_PID_DATA0	0b00
+
+typedef struct {
+	volatile void* base;
+	volatile void* ctrl;
+	volatile void* outdda;
+	volatile void* outddb;
+	volatile void* intstat;
+} mphi_regs_t;
+
+enum fiq_debug_level {
+	FIQDBG_SCHED = (1 << 0),
+	FIQDBG_INT   = (1 << 1),
+	FIQDBG_ERR   = (1 << 2),
+	FIQDBG_PORTHUB = (1 << 3),
+};
+
+#ifdef CONFIG_ARM64
+
+typedef spinlock_t fiq_lock_t;
+
+#else
+
+typedef struct {
+	union {
+		uint32_t slock;
+		struct _tickets {
+			uint16_t owner;
+			uint16_t next;
+		} tickets;
+	};
+} fiq_lock_t;
+
+#endif
+
+struct fiq_state;
+
+extern void _fiq_print (enum fiq_debug_level dbg_lvl, volatile struct fiq_state *state, char *fmt, ...);
+#if 0
+#define fiq_print _fiq_print
+#else
+#define fiq_print(x, y, ...)
+#endif
+
+extern bool fiq_enable, fiq_fsm_enable;
+extern ushort nak_holdoff;
+
+/**
+ * enum fiq_fsm_state - The FIQ FSM states.
+ *
+ * This is the "core" of the FIQ FSM. Broadly, the FSM states follow the
+ * USB2.0 specification for host responses to various transaction states.
+ * There are modifications to this host state machine because of a variety of
+ * quirks and limitations in the dwc_otg hardware.
+ *
+ * The fsm state is also used to communicate back to the driver on completion of
+ * a split transaction. The end states are used in conjunction with the interrupts
+ * raised by the final transaction.
+ */
+enum fiq_fsm_state {
+	/* FIQ isn't enabled for this host channel */
+	FIQ_PASSTHROUGH = 0,
+	/* For the first interrupt received for this channel,
+	 * the FIQ has to ack any interrupts indicating success. */
+	FIQ_PASSTHROUGH_ERRORSTATE = 31,
+	/* Nonperiodic state groups */
+	FIQ_NP_SSPLIT_STARTED = 1,
+	FIQ_NP_SSPLIT_RETRY = 2,
+	/* TT contention - working around hub bugs */
+	FIQ_NP_SSPLIT_PENDING = 33,
+	FIQ_NP_OUT_CSPLIT_RETRY = 3,
+	FIQ_NP_IN_CSPLIT_RETRY = 4,
+	FIQ_NP_SPLIT_DONE = 5,
+	FIQ_NP_SPLIT_LS_ABORTED = 6,
+	/* This differentiates a HS transaction error from a LS one
+	 * (handling the hub state is different) */
+	FIQ_NP_SPLIT_HS_ABORTED = 7,
+
+	/* Periodic state groups */
+	/* Periodic transactions are either started directly by the IRQ handler
+	 * or deferred if the TT is already in use.
+	 */
+	FIQ_PER_SSPLIT_QUEUED = 8,
+	FIQ_PER_SSPLIT_STARTED = 9,
+	FIQ_PER_SSPLIT_LAST = 10,
+
+
+	FIQ_PER_ISO_OUT_PENDING = 11,
+	FIQ_PER_ISO_OUT_ACTIVE = 12,
+	FIQ_PER_ISO_OUT_LAST = 13,
+	FIQ_PER_ISO_OUT_DONE = 27,
+
+	FIQ_PER_CSPLIT_WAIT = 14,
+	FIQ_PER_CSPLIT_NYET1 = 15,
+	FIQ_PER_CSPLIT_BROKEN_NYET1 = 28,
+	FIQ_PER_CSPLIT_NYET_FAFF = 29,
+	/* For multiple CSPLITs (large isoc IN, or delayed interrupt) */
+	FIQ_PER_CSPLIT_POLL = 16,
+	/* The last CSPLIT for a transaction has been issued, differentiates
+	 * for the state machine to queue the next packet.
+	 */
+	FIQ_PER_CSPLIT_LAST = 17,
+
+	FIQ_PER_SPLIT_DONE = 18,
+	FIQ_PER_SPLIT_LS_ABORTED = 19,
+	FIQ_PER_SPLIT_HS_ABORTED = 20,
+	FIQ_PER_SPLIT_NYET_ABORTED = 21,
+	/* Frame rollover has occurred without the transaction finishing. */
+	FIQ_PER_SPLIT_TIMEOUT = 22,
+
+	/* FIQ-accelerated HS Isochronous state groups */
+	FIQ_HS_ISOC_TURBO = 23,
+	/* For interval > 1, SOF wakes up the isochronous FSM */
+	FIQ_HS_ISOC_SLEEPING = 24,
+	FIQ_HS_ISOC_DONE = 25,
+	FIQ_HS_ISOC_ABORTED = 26,
+	FIQ_DEQUEUE_ISSUED = 30,
+	FIQ_TEST = 32,
+};
+
+struct fiq_stack {
+	int magic1;
+	uint8_t stack[2048];
+	int magic2;
+};
+
+
+/**
+ * struct fiq_dma_info - DMA bounce buffer utilisation information (per-channel)
+ * @index:	Number of slots reported used for IN transactions / number of slots
+ *			transmitted for an OUT transaction
+ * @slot_len[6]: Number of actual transfer bytes in each slot (255 if unused)
+ *
+ * Split transaction transfers can have variable length depending on other bus
+ * traffic. The OTG core DMA engine requires 4-byte aligned addresses therefore
+ * each transaction needs a guaranteed aligned address. A maximum of 6 split transfers
+ * can happen per-frame.
+ */
+struct fiq_dma_info {
+	u8 index;
+	u8 slot_len[6];
+};
+
+struct __attribute__((packed)) fiq_split_dma_slot {
+	u8 buf[188];
+};
+
+struct fiq_dma_channel {
+	struct __attribute__((packed)) fiq_split_dma_slot index[6];
+};
+
+struct fiq_dma_blob {
+	struct __attribute__((packed)) fiq_dma_channel channel[0];
+};
+
+/**
+ * struct fiq_hs_isoc_info - USB2.0 isochronous data
+ * @iso_frame:	Pointer to the array of OTG URB iso_frame_descs.
+ * @nrframes:	Total length of iso_frame_desc array
+ * @index:	Current index (FIQ-maintained)
+ * @stride:	Interval in uframes between HS isoc transactions
+ */
+struct fiq_hs_isoc_info {
+	struct dwc_otg_hcd_iso_packet_desc *iso_desc;
+	unsigned int nrframes;
+	unsigned int index;
+	unsigned int stride;
+};
+
+/**
+ * struct fiq_channel_state - FIQ state machine storage
+ * @fsm:	Current state of the channel as understood by the FIQ
+ * @nr_errors:	Number of transaction errors on this split-transaction
+ * @hub_addr:   SSPLIT/CSPLIT destination hub
+ * @port_addr:  SSPLIT/CSPLIT destination port - always 1 if single TT hub
+ * @nrpackets:  For isoc OUT, the number of split-OUT packets to transmit. For
+ * 		split-IN, number of CSPLIT data packets that were received.
+ * @hcchar_copy:
+ * @hcsplt_copy:
+ * @hcintmsk_copy:
+ * @hctsiz_copy:	Copies of the host channel registers.
+ * 			For use as scratch, or for returning state.
+ *
+ * The fiq_channel_state is state storage between interrupts for a host channel. The
+ * FSM state is stored here. Members of this structure must only be set up by the
+ * driver prior to enabling the FIQ for this host channel, and not touched until the FIQ
+ * has updated the state to either a COMPLETE state group or ABORT state group.
+ */
+
+struct fiq_channel_state {
+	enum fiq_fsm_state fsm;
+	unsigned int nr_errors;
+	unsigned int hub_addr;
+	unsigned int port_addr;
+	/* Hardware bug workaround: sometimes channel halt interrupts are
+	 * delayed until the next SOF. Keep track of when we expected to get interrupted. */
+	unsigned int expected_uframe;
+	/* number of uframes remaining (for interval > 1 HS isoc transfers) before next transfer */
+	unsigned int uframe_sleeps;
+	/* in/out for communicating number of dma buffers used, or number of ISOC to do */
+	unsigned int nrpackets;
+	struct fiq_dma_info dma_info;
+	struct fiq_hs_isoc_info hs_isoc_info;
+	/* Copies of HC registers - in/out communication from/to IRQ handler
+	 * and for ease of channel setup. A bit of mungeing is performed - for
+	 * example the hctsiz.b.maxp is _always_ the max packet size of the endpoint.
+	 */
+	hcchar_data_t hcchar_copy;
+	hcsplt_data_t hcsplt_copy;
+	hcint_data_t hcint_copy;
+	hcintmsk_data_t hcintmsk_copy;
+	hctsiz_data_t hctsiz_copy;
+	hcdma_data_t hcdma_copy;
+};
+
+/**
+ * struct fiq_state - top-level FIQ state machine storage
+ * @mphi_regs:		virtual address of the MPHI peripheral register file
+ * @dwc_regs_base:	virtual address of the base of the DWC core register file
+ * @dma_base:		physical address for the base of the DMA bounce buffers
+ * @dummy_send:		Scratch area for sending a fake message to the MPHI peripheral
+ * @gintmsk_saved:	Top-level mask of interrupts that the FIQ has not handled.
+ * 			Used for determining which interrupts fired to set off the IRQ handler.
+ * @haintmsk_saved:	Mask of interrupts from host channels that the FIQ did not handle internally.
+ * @np_count:		Non-periodic transactions in the active queue
+ * @np_sent:		Count of non-periodic transactions that have completed
+ * @next_sched_frame:	For periodic transactions handled by the driver's SOF-driven queuing mechanism,
+ * 			this is the next frame on which a SOF interrupt is required. Used to hold off
+ * 			passing SOF through to the driver until necessary.
+ * @channel[n]:		Per-channel FIQ state. Allocated during init depending on the number of host
+ * 			channels configured into the core logic.
+ *
+ * This is passed as the first argument to the dwc_otg_fiq_fsm top-level FIQ handler from the asm stub.
+ * It contains top-level state information.
+ */
+struct fiq_state {
+	fiq_lock_t lock;
+	mphi_regs_t mphi_regs;
+	void *dwc_regs_base;
+	dma_addr_t dma_base;
+	struct fiq_dma_blob *fiq_dmab;
+	void *dummy_send;
+	gintmsk_data_t gintmsk_saved;
+	haintmsk_data_t haintmsk_saved;
+	int mphi_int_count;
+	unsigned int fiq_done;
+	unsigned int kick_np_queues;
+	unsigned int next_sched_frame;
+#ifdef FIQ_DEBUG
+	char * buffer;
+	unsigned int bufsiz;
+#endif
+	struct fiq_channel_state channel[0];
+};
+
+#ifdef CONFIG_ARM64
+
+#ifdef local_fiq_enable
+#undef local_fiq_enable
+#endif
+
+#ifdef local_fiq_disable
+#undef local_fiq_disable
+#endif
+
+extern void local_fiq_enable(void);
+
+extern void local_fiq_disable(void);
+
+#endif
+
+extern void fiq_fsm_spin_lock(fiq_lock_t *lock);
+
+extern void fiq_fsm_spin_unlock(fiq_lock_t *lock);
+
+extern int fiq_fsm_too_late(struct fiq_state *st, int n);
+
+extern int fiq_fsm_tt_in_use(struct fiq_state *st, int num_channels, int n);
+
+extern void dwc_otg_fiq_fsm(struct fiq_state *state, int num_channels);
+
+extern void dwc_otg_fiq_nop(struct fiq_state *state);
+
+#endif /* DWC_OTG_FIQ_FSM_H_ */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_fiq_stub.S b/drivers/usb/host/dwc_otg/dwc_otg_fiq_stub.S
new file mode 100644
index 000000000000..ffa8d21bc61e
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_fiq_stub.S
@@ -0,0 +1,80 @@
+/*
+ * dwc_otg_fiq_fsm.S - assembly stub for the FSM FIQ
+ *
+ * Copyright (c) 2013 Raspberry Pi Foundation
+ *
+ * Author: Jonathan Bell <jonathan@raspberrypi.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *	* Redistributions of source code must retain the above copyright
+ *	  notice, this list of conditions and the following disclaimer.
+ *	* Redistributions in binary form must reproduce the above copyright
+ *	  notice, this list of conditions and the following disclaimer in the
+ *	  documentation and/or other materials provided with the distribution.
+ *	* Neither the name of Raspberry Pi nor the
+ *	  names of its contributors may be used to endorse or promote products
+ *	  derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#include <asm/assembler.h>
+#include <linux/linkage.h>
+
+
+.text
+
+.global _dwc_otg_fiq_stub_end;
+
+/**
+  * _dwc_otg_fiq_stub() - entry copied to the FIQ vector page to allow
+  * a C-style function call with arguments from the FIQ banked registers.
+  * r0 = &hcd->fiq_state
+  * r1 = &hcd->num_channels
+  * r2 = &hcd->dma_buffers
+  * Tramples: r0, r1, r2, r4, fp, ip
+  */
+
+ENTRY(_dwc_otg_fiq_stub)
+	/* Stash unbanked regs - SP will have been set up for us */
+	mov ip, sp;
+	stmdb sp!, {r0-r12, lr};
+#ifdef FIQ_DEBUG
+	// Cycle profiling - read cycle counter at start
+	mrc p15, 0, r5, c15, c12, 1;
+#endif
+	/* r11 = fp, don't trample it */
+	mov r4, fp;
+	/* set EABI frame size */
+	sub fp, ip, #512;
+
+	/* for fiq NOP mode - just need state */
+	mov r0, r8;
+	/* r9 = num_channels */
+	mov r1, r9;
+	/* r10 = struct *dma_bufs */
+//	mov r2, r10;
+
+	/* r4 = &fiq_c_function */
+	blx r4;
+#ifdef FIQ_DEBUG
+	mrc p15, 0, r4, c15, c12, 1;
+	subs r5, r5, r4;
+	// r5 is now the cycle count time for executing the FIQ. Store it somewhere?
+#endif
+	ldmia sp!, {r0-r12, lr};
+	subs pc, lr, #4;
+_dwc_otg_fiq_stub_end:
+END(_dwc_otg_fiq_stub)
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
new file mode 100644
index 000000000000..e59747cee7ab
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd.c
@@ -0,0 +1,4301 @@
+
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd.c $
+ * $Revision: #104 $
+ * $Date: 2011/10/24 $
+ * $Change: 1871159 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_DEVICE_ONLY
+
+/** @file
+ * This file implements HCD Core. All code in this file is portable and doesn't
+ * use any OS specific functions.
+ * Interface provided by HCD Core is defined in <code><hcd_if.h></code>
+ * header file.
+ */
+
+#include <linux/usb.h>
+#include <linux/usb/hcd.h>
+
+#include "dwc_otg_hcd.h"
+#include "dwc_otg_regs.h"
+#include "dwc_otg_fiq_fsm.h"
+
+extern bool microframe_schedule;
+extern uint16_t fiq_fsm_mask, nak_holdoff;
+
+//#define DEBUG_HOST_CHANNELS
+#ifdef DEBUG_HOST_CHANNELS
+static int last_sel_trans_num_per_scheduled = 0;
+static int last_sel_trans_num_nonper_scheduled = 0;
+static int last_sel_trans_num_avail_hc_at_start = 0;
+static int last_sel_trans_num_avail_hc_at_end = 0;
+#endif /* DEBUG_HOST_CHANNELS */
+
+
+dwc_otg_hcd_t *dwc_otg_hcd_alloc_hcd(void)
+{
+	return DWC_ALLOC(sizeof(dwc_otg_hcd_t));
+}
+
+/**
+ * Connection timeout function.  An OTG host is required to display a
+ * message if the device does not connect within 10 seconds.
+ */
+void dwc_otg_hcd_connect_timeout(void *ptr)
+{
+	DWC_DEBUGPL(DBG_HCDV, "%s(%p)\n", __func__, ptr);
+	DWC_PRINTF("Connect Timeout\n");
+	__DWC_ERROR("Device Not Connected/Responding\n");
+}
+
+#if defined(DEBUG)
+static void dump_channel_info(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	if (qh->channel != NULL) {
+		dwc_hc_t *hc = qh->channel;
+		dwc_list_link_t *item;
+		dwc_otg_qh_t *qh_item;
+		int num_channels = hcd->core_if->core_params->host_channels;
+		int i;
+
+		dwc_otg_hc_regs_t *hc_regs;
+		hcchar_data_t hcchar;
+		hcsplt_data_t hcsplt;
+		hctsiz_data_t hctsiz;
+		uint32_t hcdma;
+
+		hc_regs = hcd->core_if->host_if->hc_regs[hc->hc_num];
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+		hcsplt.d32 = DWC_READ_REG32(&hc_regs->hcsplt);
+		hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
+		hcdma = DWC_READ_REG32(&hc_regs->hcdma);
+
+		DWC_PRINTF("  Assigned to channel %p:\n", hc);
+		DWC_PRINTF("    hcchar 0x%08x, hcsplt 0x%08x\n", hcchar.d32,
+			   hcsplt.d32);
+		DWC_PRINTF("    hctsiz 0x%08x, hcdma 0x%08x\n", hctsiz.d32,
+			   hcdma);
+		DWC_PRINTF("    dev_addr: %d, ep_num: %d, ep_is_in: %d\n",
+			   hc->dev_addr, hc->ep_num, hc->ep_is_in);
+		DWC_PRINTF("    ep_type: %d\n", hc->ep_type);
+		DWC_PRINTF("    max_packet: %d\n", hc->max_packet);
+		DWC_PRINTF("    data_pid_start: %d\n", hc->data_pid_start);
+		DWC_PRINTF("    xfer_started: %d\n", hc->xfer_started);
+		DWC_PRINTF("    halt_status: %d\n", hc->halt_status);
+		DWC_PRINTF("    xfer_buff: %p\n", hc->xfer_buff);
+		DWC_PRINTF("    xfer_len: %d\n", hc->xfer_len);
+		DWC_PRINTF("    qh: %p\n", hc->qh);
+		DWC_PRINTF("  NP inactive sched:\n");
+		DWC_LIST_FOREACH(item, &hcd->non_periodic_sched_inactive) {
+			qh_item =
+			    DWC_LIST_ENTRY(item, dwc_otg_qh_t, qh_list_entry);
+			DWC_PRINTF("    %p\n", qh_item);
+		}
+		DWC_PRINTF("  NP active sched:\n");
+		DWC_LIST_FOREACH(item, &hcd->non_periodic_sched_active) {
+			qh_item =
+			    DWC_LIST_ENTRY(item, dwc_otg_qh_t, qh_list_entry);
+			DWC_PRINTF("    %p\n", qh_item);
+		}
+		DWC_PRINTF("  Channels: \n");
+		for (i = 0; i < num_channels; i++) {
+			dwc_hc_t *hc = hcd->hc_ptr_array[i];
+			DWC_PRINTF("    %2d: %p\n", i, hc);
+		}
+	}
+}
+#else
+#define dump_channel_info(hcd, qh)
+#endif /* DEBUG */
+
+/**
+ * Work queue function for starting the HCD when A-Cable is connected.
+ * The hcd_start() must be called in a process context.
+ */
+static void hcd_start_func(void *_vp)
+{
+	dwc_otg_hcd_t *hcd = (dwc_otg_hcd_t *) _vp;
+
+	DWC_DEBUGPL(DBG_HCDV, "%s() %p\n", __func__, hcd);
+	if (hcd) {
+		hcd->fops->start(hcd);
+	}
+}
+
+static void del_xfer_timers(dwc_otg_hcd_t * hcd)
+{
+#ifdef DEBUG
+	int i;
+	int num_channels = hcd->core_if->core_params->host_channels;
+	for (i = 0; i < num_channels; i++) {
+		DWC_TIMER_CANCEL(hcd->core_if->hc_xfer_timer[i]);
+	}
+#endif
+}
+
+static void del_timers(dwc_otg_hcd_t * hcd)
+{
+	del_xfer_timers(hcd);
+	DWC_TIMER_CANCEL(hcd->conn_timer);
+}
+
+/**
+ * Processes all the URBs in a single list of QHs. Completes them with
+ * -ESHUTDOWN and frees the QTD.
+ */
+static void kill_urbs_in_qh_list(dwc_otg_hcd_t * hcd, dwc_list_link_t * qh_list)
+{
+	dwc_list_link_t *qh_item, *qh_tmp;
+	dwc_otg_qh_t *qh;
+	dwc_otg_qtd_t *qtd, *qtd_tmp;
+
+	DWC_LIST_FOREACH_SAFE(qh_item, qh_tmp, qh_list) {
+		qh = DWC_LIST_ENTRY(qh_item, dwc_otg_qh_t, qh_list_entry);
+		DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp,
+					 &qh->qtd_list, qtd_list_entry) {
+			qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
+			if (qtd->urb != NULL) {
+				hcd->fops->complete(hcd, qtd->urb->priv,
+						    qtd->urb, -DWC_E_SHUTDOWN);
+				dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
+			}
+
+		}
+		if(qh->channel) {
+			int n = qh->channel->hc_num;
+			/* Using hcchar.chen == 1 is not a reliable test.
+			 * It is possible that the channel has already halted
+			 * but not yet been through the IRQ handler.
+			 */
+			if (fiq_fsm_enable && (hcd->fiq_state->channel[qh->channel->hc_num].fsm != FIQ_PASSTHROUGH)) {
+				local_fiq_disable();
+				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+				qh->channel->halt_status = DWC_OTG_HC_XFER_URB_DEQUEUE;
+				qh->channel->halt_pending = 1;
+				if (hcd->fiq_state->channel[n].fsm == FIQ_HS_ISOC_TURBO ||
+					hcd->fiq_state->channel[n].fsm == FIQ_HS_ISOC_SLEEPING)
+					hcd->fiq_state->channel[n].fsm = FIQ_HS_ISOC_ABORTED;
+				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+				local_fiq_enable();
+			} else {
+				dwc_otg_hc_halt(hcd->core_if, qh->channel,
+						DWC_OTG_HC_XFER_URB_DEQUEUE);
+			}
+			qh->channel = NULL;
+		}
+		dwc_otg_hcd_qh_remove(hcd, qh);
+	}
+}
+
+/**
+ * Responds with an error status of ESHUTDOWN to all URBs in the non-periodic
+ * and periodic schedules. The QTD associated with each URB is removed from
+ * the schedule and freed. This function may be called when a disconnect is
+ * detected or when the HCD is being stopped.
+ */
+static void kill_all_urbs(dwc_otg_hcd_t * hcd)
+{
+	kill_urbs_in_qh_list(hcd, &hcd->non_periodic_sched_inactive);
+	kill_urbs_in_qh_list(hcd, &hcd->non_periodic_sched_active);
+	kill_urbs_in_qh_list(hcd, &hcd->periodic_sched_inactive);
+	kill_urbs_in_qh_list(hcd, &hcd->periodic_sched_ready);
+	kill_urbs_in_qh_list(hcd, &hcd->periodic_sched_assigned);
+	kill_urbs_in_qh_list(hcd, &hcd->periodic_sched_queued);
+}
+
+/**
+ * Start the connection timer.  An OTG host is required to display a
+ * message if the device does not connect within 10 seconds.  The
+ * timer is deleted if a port connect interrupt occurs before the
+ * timer expires.
+ */
+static void dwc_otg_hcd_start_connect_timer(dwc_otg_hcd_t * hcd)
+{
+	DWC_TIMER_SCHEDULE(hcd->conn_timer, 10000 /* 10 secs */ );
+}
+
+/**
+ * HCD Callback function for disconnect of the HCD.
+ *
+ * @param p void pointer to the <code>struct usb_hcd</code>
+ */
+static int32_t dwc_otg_hcd_session_start_cb(void *p)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd;
+	DWC_DEBUGPL(DBG_HCDV, "%s(%p)\n", __func__, p);
+	dwc_otg_hcd = p;
+	dwc_otg_hcd_start_connect_timer(dwc_otg_hcd);
+	return 1;
+}
+
+/**
+ * HCD Callback function for starting the HCD when A-Cable is
+ * connected.
+ *
+ * @param p void pointer to the <code>struct usb_hcd</code>
+ */
+static int32_t dwc_otg_hcd_start_cb(void *p)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd = p;
+	dwc_otg_core_if_t *core_if;
+	hprt0_data_t hprt0;
+
+	core_if = dwc_otg_hcd->core_if;
+
+	if (core_if->op_state == B_HOST) {
+		/*
+		 * Reset the port.  During a HNP mode switch the reset
+		 * needs to occur within 1ms and have a duration of at
+		 * least 50ms.
+		 */
+		hprt0.d32 = dwc_otg_read_hprt0(core_if);
+		hprt0.b.prtrst = 1;
+		DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+	}
+	DWC_WORKQ_SCHEDULE_DELAYED(core_if->wq_otg,
+				   hcd_start_func, dwc_otg_hcd, 50,
+				   "start hcd");
+
+	return 1;
+}
+
+/**
+ * HCD Callback function for disconnect of the HCD.
+ *
+ * @param p void pointer to the <code>struct usb_hcd</code>
+ */
+static int32_t dwc_otg_hcd_disconnect_cb(void *p)
+{
+	gintsts_data_t intr;
+	dwc_otg_hcd_t *dwc_otg_hcd = p;
+
+	DWC_SPINLOCK(dwc_otg_hcd->lock);
+	/*
+	 * Set status flags for the hub driver.
+	 */
+	dwc_otg_hcd->flags.b.port_connect_status_change = 1;
+	dwc_otg_hcd->flags.b.port_connect_status = 0;
+	if(fiq_enable) {
+		local_fiq_disable();
+		fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
+	}
+	/*
+	 * Shutdown any transfers in process by clearing the Tx FIFO Empty
+	 * interrupt mask and status bits and disabling subsequent host
+	 * channel interrupts.
+	 */
+	intr.d32 = 0;
+	intr.b.nptxfempty = 1;
+	intr.b.ptxfempty = 1;
+	intr.b.hcintr = 1;
+	DWC_MODIFY_REG32(&dwc_otg_hcd->core_if->core_global_regs->gintmsk,
+			 intr.d32, 0);
+	DWC_MODIFY_REG32(&dwc_otg_hcd->core_if->core_global_regs->gintsts,
+			 intr.d32, 0);
+
+	del_timers(dwc_otg_hcd);
+
+	/*
+	 * Turn off the vbus power only if the core has transitioned to device
+	 * mode. If still in host mode, need to keep power on to detect a
+	 * reconnection.
+	 */
+	if (dwc_otg_is_device_mode(dwc_otg_hcd->core_if)) {
+		if (dwc_otg_hcd->core_if->op_state != A_SUSPEND) {
+			hprt0_data_t hprt0 = {.d32 = 0 };
+			DWC_PRINTF("Disconnect: PortPower off\n");
+			hprt0.b.prtpwr = 0;
+			DWC_WRITE_REG32(dwc_otg_hcd->core_if->host_if->hprt0,
+					hprt0.d32);
+		}
+
+		dwc_otg_disable_host_interrupts(dwc_otg_hcd->core_if);
+	}
+
+	/* Respond with an error status to all URBs in the schedule. */
+	kill_all_urbs(dwc_otg_hcd);
+
+	if (dwc_otg_is_host_mode(dwc_otg_hcd->core_if)) {
+		/* Clean up any host channels that were in use. */
+		int num_channels;
+		int i;
+		dwc_hc_t *channel;
+		dwc_otg_hc_regs_t *hc_regs;
+		hcchar_data_t hcchar;
+
+		num_channels = dwc_otg_hcd->core_if->core_params->host_channels;
+
+		if (!dwc_otg_hcd->core_if->dma_enable) {
+			/* Flush out any channel requests in slave mode. */
+			for (i = 0; i < num_channels; i++) {
+				channel = dwc_otg_hcd->hc_ptr_array[i];
+				if (DWC_CIRCLEQ_EMPTY_ENTRY
+				    (channel, hc_list_entry)) {
+					hc_regs =
+					    dwc_otg_hcd->core_if->
+					    host_if->hc_regs[i];
+					hcchar.d32 =
+					    DWC_READ_REG32(&hc_regs->hcchar);
+					if (hcchar.b.chen) {
+						hcchar.b.chen = 0;
+						hcchar.b.chdis = 1;
+						hcchar.b.epdir = 0;
+						DWC_WRITE_REG32
+						    (&hc_regs->hcchar,
+						     hcchar.d32);
+					}
+				}
+			}
+		}
+
+		if(fiq_fsm_enable) {
+			for(i=0; i < 128; i++) {
+				dwc_otg_hcd->hub_port[i] = 0;
+			}
+		}
+	}
+
+	if(fiq_enable) {
+		fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
+		local_fiq_enable();
+	}
+
+	if (dwc_otg_hcd->fops->disconnect) {
+		dwc_otg_hcd->fops->disconnect(dwc_otg_hcd);
+	}
+
+	DWC_SPINUNLOCK(dwc_otg_hcd->lock);
+	return 1;
+}
+
+/**
+ * HCD Callback function for stopping the HCD.
+ *
+ * @param p void pointer to the <code>struct usb_hcd</code>
+ */
+static int32_t dwc_otg_hcd_stop_cb(void *p)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd = p;
+
+	DWC_DEBUGPL(DBG_HCDV, "%s(%p)\n", __func__, p);
+	dwc_otg_hcd_stop(dwc_otg_hcd);
+	return 1;
+}
+
+#ifdef CONFIG_USB_DWC_OTG_LPM
+/**
+ * HCD Callback function for sleep of HCD.
+ *
+ * @param p void pointer to the <code>struct usb_hcd</code>
+ */
+static int dwc_otg_hcd_sleep_cb(void *p)
+{
+	dwc_otg_hcd_t *hcd = p;
+
+	dwc_otg_hcd_free_hc_from_lpm(hcd);
+
+	return 0;
+}
+#endif
+
+
+/**
+ * HCD Callback function for Remote Wakeup.
+ *
+ * @param p void pointer to the <code>struct usb_hcd</code>
+ */
+static int dwc_otg_hcd_rem_wakeup_cb(void *p)
+{
+	dwc_otg_hcd_t *hcd = p;
+
+	if (hcd->core_if->lx_state == DWC_OTG_L2) {
+		hcd->flags.b.port_suspend_change = 1;
+	}
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	else {
+		hcd->flags.b.port_l1_change = 1;
+	}
+#endif
+	return 0;
+}
+
+/**
+ * Halts the DWC_otg host mode operations in a clean manner. USB transfers are
+ * stopped.
+ */
+void dwc_otg_hcd_stop(dwc_otg_hcd_t * hcd)
+{
+	hprt0_data_t hprt0 = {.d32 = 0 };
+
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD STOP\n");
+
+	/*
+	 * The root hub should be disconnected before this function is called.
+	 * The disconnect will clear the QTD lists (via ..._hcd_urb_dequeue)
+	 * and the QH lists (via ..._hcd_endpoint_disable).
+	 */
+
+	/* Turn off all host-specific interrupts. */
+	dwc_otg_disable_host_interrupts(hcd->core_if);
+
+	/* Turn off the vbus power */
+	DWC_PRINTF("PortPower off\n");
+	hprt0.b.prtpwr = 0;
+	DWC_WRITE_REG32(hcd->core_if->host_if->hprt0, hprt0.d32);
+	dwc_mdelay(1);
+}
+
+int dwc_otg_hcd_urb_enqueue(dwc_otg_hcd_t * hcd,
+			    dwc_otg_hcd_urb_t * dwc_otg_urb, void **ep_handle,
+			    int atomic_alloc)
+{
+	int retval = 0;
+	uint8_t needs_scheduling = 0;
+	dwc_otg_transaction_type_e tr_type;
+	dwc_otg_qtd_t *qtd;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	hprt0_data_t hprt0 = { .d32 = 0 };
+
+#ifdef DEBUG /* integrity checks (Broadcom) */
+	if (NULL == hcd->core_if) {
+		DWC_ERROR("**** DWC OTG HCD URB Enqueue - HCD has NULL core_if\n");
+		/* No longer connected. */
+		return -DWC_E_INVALID;
+	}
+#endif
+	if (!hcd->flags.b.port_connect_status) {
+		/* No longer connected. */
+		DWC_ERROR("Not connected\n");
+		return -DWC_E_NO_DEVICE;
+	}
+
+	/* Some core configurations cannot support LS traffic on a FS root port */
+	if ((hcd->fops->speed(hcd, dwc_otg_urb->priv) == USB_SPEED_LOW) &&
+		(hcd->core_if->hwcfg2.b.fs_phy_type == 1) &&
+		(hcd->core_if->hwcfg2.b.hs_phy_type == 1)) {
+			hprt0.d32 = DWC_READ_REG32(hcd->core_if->host_if->hprt0);
+			if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_FULL_SPEED) {
+				return -DWC_E_NO_DEVICE;
+			}
+	}
+
+	qtd = dwc_otg_hcd_qtd_create(dwc_otg_urb, atomic_alloc);
+	if (qtd == NULL) {
+		DWC_ERROR("DWC OTG HCD URB Enqueue failed creating QTD\n");
+		return -DWC_E_NO_MEMORY;
+	}
+#ifdef DEBUG /* integrity checks (Broadcom) */
+	if (qtd->urb == NULL) {
+		DWC_ERROR("**** DWC OTG HCD URB Enqueue created QTD with no URBs\n");
+		return -DWC_E_NO_MEMORY;
+	}
+	if (qtd->urb->priv == NULL) {
+		DWC_ERROR("**** DWC OTG HCD URB Enqueue created QTD URB with no URB handle\n");
+		return -DWC_E_NO_MEMORY;
+	}
+#endif
+	intr_mask.d32 = DWC_READ_REG32(&hcd->core_if->core_global_regs->gintmsk);
+	if(!intr_mask.b.sofintr || fiq_enable) needs_scheduling = 1;
+	if((((dwc_otg_qh_t *)ep_handle)->ep_type == UE_BULK) && !(qtd->urb->flags & URB_GIVEBACK_ASAP))
+		/* Do not schedule SG transactions until qtd has URB_GIVEBACK_ASAP set */
+		needs_scheduling = 0;
+
+	retval = dwc_otg_hcd_qtd_add(qtd, hcd, (dwc_otg_qh_t **) ep_handle, atomic_alloc);
+            // creates a new queue in ep_handle if it doesn't exist already
+	if (retval < 0) {
+		DWC_ERROR("DWC OTG HCD URB Enqueue failed adding QTD. "
+			  "Error status %d\n", retval);
+		dwc_otg_hcd_qtd_free(qtd);
+		return retval;
+	}
+
+	if(needs_scheduling) {
+		tr_type = dwc_otg_hcd_select_transactions(hcd);
+		if (tr_type != DWC_OTG_TRANSACTION_NONE) {
+			dwc_otg_hcd_queue_transactions(hcd, tr_type);
+		}
+	}
+	return retval;
+}
+
+int dwc_otg_hcd_urb_dequeue(dwc_otg_hcd_t * hcd,
+			    dwc_otg_hcd_urb_t * dwc_otg_urb)
+{
+	dwc_otg_qh_t *qh;
+	dwc_otg_qtd_t *urb_qtd;
+	BUG_ON(!hcd);
+	BUG_ON(!dwc_otg_urb);
+
+#ifdef DEBUG /* integrity checks (Broadcom) */
+
+	if (hcd == NULL) {
+		DWC_ERROR("**** DWC OTG HCD URB Dequeue has NULL HCD\n");
+		return -DWC_E_INVALID;
+	}
+	if (dwc_otg_urb == NULL) {
+		DWC_ERROR("**** DWC OTG HCD URB Dequeue has NULL URB\n");
+		return -DWC_E_INVALID;
+	}
+	if (dwc_otg_urb->qtd == NULL) {
+		DWC_ERROR("**** DWC OTG HCD URB Dequeue with NULL QTD\n");
+		return -DWC_E_INVALID;
+	}
+	urb_qtd = dwc_otg_urb->qtd;
+	BUG_ON(!urb_qtd);
+	if (urb_qtd->qh == NULL) {
+		DWC_ERROR("**** DWC OTG HCD URB Dequeue with QTD with NULL Q handler\n");
+		return -DWC_E_INVALID;
+	}
+#else
+	urb_qtd = dwc_otg_urb->qtd;
+	BUG_ON(!urb_qtd);
+#endif
+	qh = urb_qtd->qh;
+	BUG_ON(!qh);
+	if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
+		if (urb_qtd->in_process) {
+			dump_channel_info(hcd, qh);
+		}
+	}
+#ifdef DEBUG /* integrity checks (Broadcom) */
+	if (hcd->core_if == NULL) {
+		DWC_ERROR("**** DWC OTG HCD URB Dequeue HCD has NULL core_if\n");
+		return -DWC_E_INVALID;
+	}
+#endif
+	if (urb_qtd->in_process && qh->channel) {
+		/* The QTD is in process (it has been assigned to a channel). */
+		if (hcd->flags.b.port_connect_status) {
+			int n = qh->channel->hc_num;
+			/*
+			 * If still connected (i.e. in host mode), halt the
+			 * channel so it can be used for other transfers. If
+			 * no longer connected, the host registers can't be
+			 * written to halt the channel since the core is in
+			 * device mode.
+			 */
+			/* In FIQ FSM mode, we need to shut down carefully.
+			 * The FIQ may attempt to restart a disabled channel */
+			if (fiq_fsm_enable && (hcd->fiq_state->channel[n].fsm != FIQ_PASSTHROUGH)) {
+				local_fiq_disable();
+				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+				qh->channel->halt_status = DWC_OTG_HC_XFER_URB_DEQUEUE;
+				qh->channel->halt_pending = 1;
+				if (hcd->fiq_state->channel[n].fsm == FIQ_HS_ISOC_TURBO ||
+					hcd->fiq_state->channel[n].fsm == FIQ_HS_ISOC_SLEEPING)
+					hcd->fiq_state->channel[n].fsm = FIQ_HS_ISOC_ABORTED;
+				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+				local_fiq_enable();
+			} else {
+				dwc_otg_hc_halt(hcd->core_if, qh->channel,
+						DWC_OTG_HC_XFER_URB_DEQUEUE);
+			}
+		}
+	}
+
+	/*
+	 * Free the QTD and clean up the associated QH. Leave the QH in the
+	 * schedule if it has any remaining QTDs.
+	 */
+
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Dequeue - "
+                    "delete %sQueue handler\n",
+                    hcd->core_if->dma_desc_enable?"DMA ":"");
+	if (!hcd->core_if->dma_desc_enable) {
+		uint8_t b = urb_qtd->in_process;
+		if (nak_holdoff && qh->do_split && dwc_qh_is_non_per(qh))
+			qh->nak_frame = 0xFFFF;
+		dwc_otg_hcd_qtd_remove_and_free(hcd, urb_qtd, qh);
+		if (b) {
+			dwc_otg_hcd_qh_deactivate(hcd, qh, 0);
+			qh->channel = NULL;
+		} else if (DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
+			dwc_otg_hcd_qh_remove(hcd, qh);
+		}
+	} else {
+		dwc_otg_hcd_qtd_remove_and_free(hcd, urb_qtd, qh);
+	}
+	return 0;
+}
+
+int dwc_otg_hcd_endpoint_disable(dwc_otg_hcd_t * hcd, void *ep_handle,
+				 int retry)
+{
+	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
+	int retval = 0;
+	dwc_irqflags_t flags;
+
+	if (retry < 0) {
+		retval = -DWC_E_INVALID;
+		goto done;
+	}
+
+	if (!qh) {
+		retval = -DWC_E_INVALID;
+		goto done;
+	}
+
+	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
+
+	while (!DWC_CIRCLEQ_EMPTY(&qh->qtd_list) && retry) {
+		DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
+		retry--;
+		dwc_msleep(5);
+		DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
+	}
+
+	dwc_otg_hcd_qh_remove(hcd, qh);
+
+	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
+	/*
+	 * Split dwc_otg_hcd_qh_remove_and_free() into qh_remove
+	 * and qh_free to prevent stack dump on DWC_DMA_FREE() with
+	 * irq_disabled (spinlock_irqsave) in dwc_otg_hcd_desc_list_free()
+	 * and dwc_otg_hcd_frame_list_alloc().
+	 */
+	dwc_otg_hcd_qh_free(hcd, qh);
+
+done:
+	return retval;
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
+int dwc_otg_hcd_endpoint_reset(dwc_otg_hcd_t * hcd, void *ep_handle)
+{
+	int retval = 0;
+	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
+	if (!qh)
+		return -DWC_E_INVALID;
+
+	qh->data_toggle = DWC_OTG_HC_PID_DATA0;
+	return retval;
+}
+#endif
+
+/**
+ * HCD Callback structure for handling mode switching.
+ */
+static dwc_otg_cil_callbacks_t hcd_cil_callbacks = {
+	.start = dwc_otg_hcd_start_cb,
+	.stop = dwc_otg_hcd_stop_cb,
+	.disconnect = dwc_otg_hcd_disconnect_cb,
+	.session_start = dwc_otg_hcd_session_start_cb,
+	.resume_wakeup = dwc_otg_hcd_rem_wakeup_cb,
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	.sleep = dwc_otg_hcd_sleep_cb,
+#endif
+	.p = 0,
+};
+
+/**
+ * Reset tasklet function
+ */
+static void reset_tasklet_func(void *data)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd = (dwc_otg_hcd_t *) data;
+	dwc_otg_core_if_t *core_if = dwc_otg_hcd->core_if;
+	hprt0_data_t hprt0;
+
+	DWC_DEBUGPL(DBG_HCDV, "USB RESET tasklet called\n");
+
+	hprt0.d32 = dwc_otg_read_hprt0(core_if);
+	hprt0.b.prtrst = 1;
+	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+	dwc_mdelay(60);
+
+	hprt0.b.prtrst = 0;
+	DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+	dwc_otg_hcd->flags.b.port_reset_change = 1;
+}
+
+static void completion_tasklet_func(void *ptr)
+{
+	dwc_otg_hcd_t *hcd = (dwc_otg_hcd_t *) ptr;
+	struct urb *urb;
+	urb_tq_entry_t *item;
+	dwc_irqflags_t flags;
+
+	/* This could just be spin_lock_irq */
+	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
+	while (!DWC_TAILQ_EMPTY(&hcd->completed_urb_list)) {
+		item = DWC_TAILQ_FIRST(&hcd->completed_urb_list);
+		urb = item->urb;
+		DWC_TAILQ_REMOVE(&hcd->completed_urb_list, item,
+				urb_tq_entries);
+		DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
+		DWC_FREE(item);
+
+		usb_hcd_giveback_urb(hcd->priv, urb, urb->status);
+
+
+		DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
+	}
+	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
+	return;
+}
+
+static void qh_list_free(dwc_otg_hcd_t * hcd, dwc_list_link_t * qh_list)
+{
+	dwc_list_link_t *item;
+	dwc_otg_qh_t *qh;
+	dwc_irqflags_t flags;
+
+	if (!qh_list->next) {
+		/* The list hasn't been initialized yet. */
+		return;
+	}
+	/*
+	 * Hold spinlock here. Not needed in that case if bellow
+	 * function is being called from ISR
+	 */
+	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
+	/* Ensure there are no QTDs or URBs left. */
+	kill_urbs_in_qh_list(hcd, qh_list);
+	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
+
+	DWC_LIST_FOREACH(item, qh_list) {
+		qh = DWC_LIST_ENTRY(item, dwc_otg_qh_t, qh_list_entry);
+		dwc_otg_hcd_qh_remove_and_free(hcd, qh);
+	}
+}
+
+/**
+ * Exit from Hibernation if Host did not detect SRP from connected SRP capable
+ * Device during SRP time by host power up.
+ */
+void dwc_otg_hcd_power_up(void *ptr)
+{
+	gpwrdn_data_t gpwrdn = {.d32 = 0 };
+	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) ptr;
+
+	DWC_PRINTF("%s called\n", __FUNCTION__);
+
+	if (!core_if->hibernation_suspend) {
+		DWC_PRINTF("Already exited from Hibernation\n");
+		return;
+	}
+
+	/* Switch on the voltage to the core */
+	gpwrdn.b.pwrdnswtch = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Reset the core */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Disable power clamps */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnclmp = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	/* Remove reset the core signal */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pwrdnrstn = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0, gpwrdn.d32);
+	dwc_udelay(10);
+
+	/* Disable PMU interrupt */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuintsel = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	core_if->hibernation_suspend = 0;
+
+	/* Disable PMU */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.pmuactv = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+	dwc_udelay(10);
+
+	/* Enable VBUS */
+	gpwrdn.d32 = 0;
+	gpwrdn.b.dis_vbus = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, gpwrdn.d32, 0);
+
+	core_if->op_state = A_HOST;
+	dwc_otg_core_init(core_if);
+	dwc_otg_enable_global_interrupts(core_if);
+	cil_hcd_start(core_if);
+}
+
+void dwc_otg_cleanup_fiq_channel(dwc_otg_hcd_t *hcd, uint32_t num)
+{
+	struct fiq_channel_state *st = &hcd->fiq_state->channel[num];
+	struct fiq_dma_blob *blob = hcd->fiq_dmab;
+	int i;
+
+	st->fsm = FIQ_PASSTHROUGH;
+	st->hcchar_copy.d32 = 0;
+	st->hcsplt_copy.d32 = 0;
+	st->hcint_copy.d32 = 0;
+	st->hcintmsk_copy.d32 = 0;
+	st->hctsiz_copy.d32 = 0;
+	st->hcdma_copy.d32 = 0;
+	st->nr_errors = 0;
+	st->hub_addr = 0;
+	st->port_addr = 0;
+	st->expected_uframe = 0;
+	st->nrpackets = 0;
+	st->dma_info.index = 0;
+	for (i = 0; i < 6; i++)
+		st->dma_info.slot_len[i] = 255;
+	st->hs_isoc_info.index = 0;
+	st->hs_isoc_info.iso_desc = NULL;
+	st->hs_isoc_info.nrframes = 0;
+
+	DWC_MEMSET(&blob->channel[num].index[0], 0x6b, 1128);
+}
+
+/**
+ * Frees secondary storage associated with the dwc_otg_hcd structure contained
+ * in the struct usb_hcd field.
+ */
+static void dwc_otg_hcd_free(dwc_otg_hcd_t * dwc_otg_hcd)
+{
+	struct device *dev = dwc_otg_hcd_to_dev(dwc_otg_hcd);
+	int i;
+
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD FREE\n");
+
+	del_timers(dwc_otg_hcd);
+
+	/* Free memory for QH/QTD lists */
+	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->non_periodic_sched_inactive);
+	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->non_periodic_sched_active);
+	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->periodic_sched_inactive);
+	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->periodic_sched_ready);
+	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->periodic_sched_assigned);
+	qh_list_free(dwc_otg_hcd, &dwc_otg_hcd->periodic_sched_queued);
+
+	/* Free memory for the host channels. */
+	for (i = 0; i < MAX_EPS_CHANNELS; i++) {
+		dwc_hc_t *hc = dwc_otg_hcd->hc_ptr_array[i];
+
+#ifdef DEBUG
+		if (dwc_otg_hcd->core_if->hc_xfer_timer[i]) {
+			DWC_TIMER_FREE(dwc_otg_hcd->core_if->hc_xfer_timer[i]);
+		}
+#endif
+		if (hc != NULL) {
+			DWC_DEBUGPL(DBG_HCDV, "HCD Free channel #%i, hc=%p\n",
+				    i, hc);
+			DWC_FREE(hc);
+		}
+	}
+
+	if (dwc_otg_hcd->core_if->dma_enable) {
+		if (dwc_otg_hcd->status_buf_dma) {
+			DWC_DMA_FREE(dev, DWC_OTG_HCD_STATUS_BUF_SIZE,
+				     dwc_otg_hcd->status_buf,
+				     dwc_otg_hcd->status_buf_dma);
+		}
+	} else if (dwc_otg_hcd->status_buf != NULL) {
+		DWC_FREE(dwc_otg_hcd->status_buf);
+	}
+	DWC_SPINLOCK_FREE(dwc_otg_hcd->lock);
+	/* Set core_if's lock pointer to NULL */
+	dwc_otg_hcd->core_if->lock = NULL;
+
+	DWC_TIMER_FREE(dwc_otg_hcd->conn_timer);
+	DWC_TASK_FREE(dwc_otg_hcd->reset_tasklet);
+	DWC_TASK_FREE(dwc_otg_hcd->completion_tasklet);
+	DWC_FREE(dwc_otg_hcd->fiq_state);
+
+#ifdef DWC_DEV_SRPCAP
+	if (dwc_otg_hcd->core_if->power_down == 2 &&
+	    dwc_otg_hcd->core_if->pwron_timer) {
+		DWC_TIMER_FREE(dwc_otg_hcd->core_if->pwron_timer);
+	}
+#endif
+	DWC_FREE(dwc_otg_hcd);
+}
+
+int dwc_otg_hcd_init(dwc_otg_hcd_t * hcd, dwc_otg_core_if_t * core_if)
+{
+	struct device *dev = dwc_otg_hcd_to_dev(hcd);
+	int retval = 0;
+	int num_channels;
+	int i;
+	dwc_hc_t *channel;
+
+#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK))
+	DWC_SPINLOCK_ALLOC_LINUX_DEBUG(hcd->lock);
+#else
+	hcd->lock = DWC_SPINLOCK_ALLOC();
+#endif
+        DWC_DEBUGPL(DBG_HCDV, "init of HCD %p given core_if %p\n",
+                    hcd, core_if);
+	if (!hcd->lock) {
+		DWC_ERROR("Could not allocate lock for pcd");
+		DWC_FREE(hcd);
+		retval = -DWC_E_NO_MEMORY;
+		goto out;
+	}
+	hcd->core_if = core_if;
+
+	/* Register the HCD CIL Callbacks */
+	dwc_otg_cil_register_hcd_callbacks(hcd->core_if,
+					   &hcd_cil_callbacks, hcd);
+
+	/* Initialize the non-periodic schedule. */
+	DWC_LIST_INIT(&hcd->non_periodic_sched_inactive);
+	DWC_LIST_INIT(&hcd->non_periodic_sched_active);
+
+	/* Initialize the periodic schedule. */
+	DWC_LIST_INIT(&hcd->periodic_sched_inactive);
+	DWC_LIST_INIT(&hcd->periodic_sched_ready);
+	DWC_LIST_INIT(&hcd->periodic_sched_assigned);
+	DWC_LIST_INIT(&hcd->periodic_sched_queued);
+	DWC_TAILQ_INIT(&hcd->completed_urb_list);
+	/*
+	 * Create a host channel descriptor for each host channel implemented
+	 * in the controller. Initialize the channel descriptor array.
+	 */
+	DWC_CIRCLEQ_INIT(&hcd->free_hc_list);
+	num_channels = hcd->core_if->core_params->host_channels;
+	DWC_MEMSET(hcd->hc_ptr_array, 0, sizeof(hcd->hc_ptr_array));
+	for (i = 0; i < num_channels; i++) {
+		channel = DWC_ALLOC(sizeof(dwc_hc_t));
+		if (channel == NULL) {
+			retval = -DWC_E_NO_MEMORY;
+			DWC_ERROR("%s: host channel allocation failed\n",
+				  __func__);
+			dwc_otg_hcd_free(hcd);
+			goto out;
+		}
+		channel->hc_num = i;
+		hcd->hc_ptr_array[i] = channel;
+#ifdef DEBUG
+		hcd->core_if->hc_xfer_timer[i] =
+		    DWC_TIMER_ALLOC("hc timer", hc_xfer_timeout,
+				    &hcd->core_if->hc_xfer_info[i]);
+#endif
+		DWC_DEBUGPL(DBG_HCDV, "HCD Added channel #%d, hc=%p\n", i,
+			    channel);
+	}
+
+	if (fiq_enable) {
+		hcd->fiq_state = DWC_ALLOC(sizeof(struct fiq_state) + (sizeof(struct fiq_channel_state) * num_channels));
+		if (!hcd->fiq_state) {
+			retval = -DWC_E_NO_MEMORY;
+			DWC_ERROR("%s: cannot allocate fiq_state structure\n", __func__);
+			dwc_otg_hcd_free(hcd);
+			goto out;
+		}
+		DWC_MEMSET(hcd->fiq_state, 0, (sizeof(struct fiq_state) + (sizeof(struct fiq_channel_state) * num_channels)));
+
+#ifdef CONFIG_ARM64
+		spin_lock_init(&hcd->fiq_state->lock);
+#endif
+
+		for (i = 0; i < num_channels; i++) {
+			hcd->fiq_state->channel[i].fsm = FIQ_PASSTHROUGH;
+		}
+		hcd->fiq_state->dummy_send = DWC_ALLOC_ATOMIC(16);
+
+		hcd->fiq_stack = DWC_ALLOC(sizeof(struct fiq_stack));
+		if (!hcd->fiq_stack) {
+			retval = -DWC_E_NO_MEMORY;
+			DWC_ERROR("%s: cannot allocate fiq_stack structure\n", __func__);
+			dwc_otg_hcd_free(hcd);
+			goto out;
+		}
+		hcd->fiq_stack->magic1 = 0xDEADBEEF;
+		hcd->fiq_stack->magic2 = 0xD00DFEED;
+		hcd->fiq_state->gintmsk_saved.d32 = ~0;
+		hcd->fiq_state->haintmsk_saved.b2.chint = ~0;
+
+		/* This bit is terrible and uses no API, but necessary. The FIQ has no concept of DMA pools
+		 * (and if it did, would be a lot slower). This allocates a chunk of memory (~9kiB for 8 host channels)
+		 * for use as transaction bounce buffers in a 2-D array. Our access into this chunk is done by some
+		 * moderately readable array casts.
+		 */
+		hcd->fiq_dmab = DWC_DMA_ALLOC(dev, (sizeof(struct fiq_dma_channel) * num_channels), &hcd->fiq_state->dma_base);
+		DWC_WARN("FIQ DMA bounce buffers: virt = 0x%08x dma = 0x%08x len=%d",
+				(unsigned int)hcd->fiq_dmab, (unsigned int)hcd->fiq_state->dma_base,
+				sizeof(struct fiq_dma_channel) * num_channels);
+
+		DWC_MEMSET(hcd->fiq_dmab, 0x6b, 9024);
+
+		/* pointer for debug in fiq_print */
+		hcd->fiq_state->fiq_dmab = hcd->fiq_dmab;
+		if (fiq_fsm_enable) {
+			int i;
+			for (i=0; i < hcd->core_if->core_params->host_channels; i++) {
+				dwc_otg_cleanup_fiq_channel(hcd, i);
+			}
+			DWC_PRINTF("FIQ FSM acceleration enabled for :\n%s%s%s%s",
+				(fiq_fsm_mask & 0x1) ? "Non-periodic Split Transactions\n" : "",
+				(fiq_fsm_mask & 0x2) ? "Periodic Split Transactions\n" : "",
+				(fiq_fsm_mask & 0x4) ? "High-Speed Isochronous Endpoints\n" : "",
+				(fiq_fsm_mask & 0x8) ? "Interrupt/Control Split Transaction hack enabled\n" : "");
+		}
+	}
+
+	/* Initialize the Connection timeout timer. */
+	hcd->conn_timer = DWC_TIMER_ALLOC("Connection timer",
+					  dwc_otg_hcd_connect_timeout, 0);
+
+	printk(KERN_DEBUG "dwc_otg: Microframe scheduler %s\n", microframe_schedule ? "enabled":"disabled");
+	if (microframe_schedule)
+		init_hcd_usecs(hcd);
+
+	/* Initialize reset tasklet. */
+	hcd->reset_tasklet = DWC_TASK_ALLOC("reset_tasklet", reset_tasklet_func, hcd);
+
+	hcd->completion_tasklet = DWC_TASK_ALLOC("completion_tasklet",
+						completion_tasklet_func, hcd);
+#ifdef DWC_DEV_SRPCAP
+	if (hcd->core_if->power_down == 2) {
+		/* Initialize Power on timer for Host power up in case hibernation */
+		hcd->core_if->pwron_timer = DWC_TIMER_ALLOC("PWRON TIMER",
+									dwc_otg_hcd_power_up, core_if);
+	}
+#endif
+
+	/*
+	 * Allocate space for storing data on status transactions. Normally no
+	 * data is sent, but this space acts as a bit bucket. This must be
+	 * done after usb_add_hcd since that function allocates the DMA buffer
+	 * pool.
+	 */
+	if (hcd->core_if->dma_enable) {
+		hcd->status_buf =
+		    DWC_DMA_ALLOC(dev, DWC_OTG_HCD_STATUS_BUF_SIZE,
+				  &hcd->status_buf_dma);
+	} else {
+		hcd->status_buf = DWC_ALLOC(DWC_OTG_HCD_STATUS_BUF_SIZE);
+	}
+	if (!hcd->status_buf) {
+		retval = -DWC_E_NO_MEMORY;
+		DWC_ERROR("%s: status_buf allocation failed\n", __func__);
+		dwc_otg_hcd_free(hcd);
+		goto out;
+	}
+
+	hcd->otg_port = 1;
+	hcd->frame_list = NULL;
+	hcd->frame_list_dma = 0;
+	hcd->periodic_qh_count = 0;
+
+	DWC_MEMSET(hcd->hub_port, 0, sizeof(hcd->hub_port));
+#ifdef FIQ_DEBUG
+	DWC_MEMSET(hcd->hub_port_alloc, -1, sizeof(hcd->hub_port_alloc));
+#endif
+
+out:
+	return retval;
+}
+
+void dwc_otg_hcd_remove(dwc_otg_hcd_t * hcd)
+{
+	/* Turn off all host-specific interrupts. */
+	dwc_otg_disable_host_interrupts(hcd->core_if);
+
+	dwc_otg_hcd_free(hcd);
+}
+
+/**
+ * Initializes dynamic portions of the DWC_otg HCD state.
+ */
+static void dwc_otg_hcd_reinit(dwc_otg_hcd_t * hcd)
+{
+	int num_channels;
+	int i;
+	dwc_hc_t *channel;
+	dwc_hc_t *channel_tmp;
+
+	hcd->flags.d32 = 0;
+
+	hcd->non_periodic_qh_ptr = &hcd->non_periodic_sched_active;
+	if (!microframe_schedule) {
+		hcd->non_periodic_channels = 0;
+		hcd->periodic_channels = 0;
+	} else {
+		hcd->available_host_channels = hcd->core_if->core_params->host_channels;
+	}
+	/*
+	 * Put all channels in the free channel list and clean up channel
+	 * states.
+	 */
+	DWC_CIRCLEQ_FOREACH_SAFE(channel, channel_tmp,
+				 &hcd->free_hc_list, hc_list_entry) {
+		DWC_CIRCLEQ_REMOVE(&hcd->free_hc_list, channel, hc_list_entry);
+	}
+
+	num_channels = hcd->core_if->core_params->host_channels;
+	for (i = 0; i < num_channels; i++) {
+		channel = hcd->hc_ptr_array[i];
+		DWC_CIRCLEQ_INSERT_TAIL(&hcd->free_hc_list, channel,
+					hc_list_entry);
+		dwc_otg_hc_cleanup(hcd->core_if, channel);
+	}
+
+	/* Initialize the DWC core for host mode operation. */
+	dwc_otg_core_host_init(hcd->core_if);
+
+	/* Set core_if's lock pointer to the hcd->lock */
+	hcd->core_if->lock = hcd->lock;
+}
+
+/**
+ * Assigns transactions from a QTD to a free host channel and initializes the
+ * host channel to perform the transactions. The host channel is removed from
+ * the free list.
+ *
+ * @param hcd The HCD state structure.
+ * @param qh Transactions from the first QTD for this QH are selected and
+ * assigned to a free host channel.
+ */
+static void assign_and_init_hc(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	dwc_hc_t *hc;
+	dwc_otg_qtd_t *qtd;
+	dwc_otg_hcd_urb_t *urb;
+	void* ptr = NULL;
+	uint32_t intr_enable;
+	unsigned long flags;
+	gintmsk_data_t gintmsk = { .d32 = 0, };
+	struct device *dev = dwc_otg_hcd_to_dev(hcd);
+
+	qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
+
+	urb = qtd->urb;
+
+	DWC_DEBUGPL(DBG_HCDV, "%s(%p,%p) - urb %x, actual_length %d\n", __func__, hcd, qh, (unsigned int)urb, urb->actual_length);
+
+	if (((urb->actual_length < 0) || (urb->actual_length > urb->length)) && !dwc_otg_hcd_is_pipe_in(&urb->pipe_info))
+		urb->actual_length = urb->length;
+
+
+	hc = DWC_CIRCLEQ_FIRST(&hcd->free_hc_list);
+
+	/* Remove the host channel from the free list. */
+	DWC_CIRCLEQ_REMOVE_INIT(&hcd->free_hc_list, hc, hc_list_entry);
+
+	qh->channel = hc;
+
+	qtd->in_process = 1;
+
+	/*
+	 * Use usb_pipedevice to determine device address. This address is
+	 * 0 before the SET_ADDRESS command and the correct address afterward.
+	 */
+	hc->dev_addr = dwc_otg_hcd_get_dev_addr(&urb->pipe_info);
+	hc->ep_num = dwc_otg_hcd_get_ep_num(&urb->pipe_info);
+	hc->speed = qh->dev_speed;
+	hc->max_packet = dwc_max_packet(qh->maxp);
+
+	hc->xfer_started = 0;
+	hc->halt_status = DWC_OTG_HC_XFER_NO_HALT_STATUS;
+	hc->error_state = (qtd->error_count > 0);
+	hc->halt_on_queue = 0;
+	hc->halt_pending = 0;
+	hc->requests = 0;
+
+	/*
+	 * The following values may be modified in the transfer type section
+	 * below. The xfer_len value may be reduced when the transfer is
+	 * started to accommodate the max widths of the XferSize and PktCnt
+	 * fields in the HCTSIZn register.
+	 */
+
+	hc->ep_is_in = (dwc_otg_hcd_is_pipe_in(&urb->pipe_info) != 0);
+	if (hc->ep_is_in) {
+		hc->do_ping = 0;
+	} else {
+		hc->do_ping = qh->ping_state;
+	}
+
+	hc->data_pid_start = qh->data_toggle;
+	hc->multi_count = 1;
+
+	if (hcd->core_if->dma_enable) {
+		hc->xfer_buff = (uint8_t *) urb->dma + urb->actual_length;
+
+		/* For non-dword aligned case */
+		if (((unsigned long)hc->xfer_buff & 0x3)
+		    && !hcd->core_if->dma_desc_enable) {
+			ptr = (uint8_t *) urb->buf + urb->actual_length;
+		}
+	} else {
+		hc->xfer_buff = (uint8_t *) urb->buf + urb->actual_length;
+	}
+	hc->xfer_len = urb->length - urb->actual_length;
+	hc->xfer_count = 0;
+
+	/*
+	 * Set the split attributes
+	 */
+	hc->do_split = 0;
+	if (qh->do_split) {
+		uint32_t hub_addr, port_addr;
+		hc->do_split = 1;
+		hc->start_pkt_count = 1;
+		hc->xact_pos = qtd->isoc_split_pos;
+		/* We don't need to do complete splits anymore */
+//		if(fiq_fsm_enable)
+		if (0)
+			hc->complete_split = qtd->complete_split = 0;
+		else
+			hc->complete_split = qtd->complete_split;
+
+		hcd->fops->hub_info(hcd, urb->priv, &hub_addr, &port_addr);
+		hc->hub_addr = (uint8_t) hub_addr;
+		hc->port_addr = (uint8_t) port_addr;
+	}
+
+	switch (dwc_otg_hcd_get_pipe_type(&urb->pipe_info)) {
+	case UE_CONTROL:
+		hc->ep_type = DWC_OTG_EP_TYPE_CONTROL;
+		switch (qtd->control_phase) {
+		case DWC_OTG_CONTROL_SETUP:
+			DWC_DEBUGPL(DBG_HCDV, "  Control setup transaction\n");
+			hc->do_ping = 0;
+			hc->ep_is_in = 0;
+			hc->data_pid_start = DWC_OTG_HC_PID_SETUP;
+			if (hcd->core_if->dma_enable) {
+				hc->xfer_buff = (uint8_t *) urb->setup_dma;
+			} else {
+				hc->xfer_buff = (uint8_t *) urb->setup_packet;
+			}
+			hc->xfer_len = 8;
+			ptr = NULL;
+			break;
+		case DWC_OTG_CONTROL_DATA:
+			DWC_DEBUGPL(DBG_HCDV, "  Control data transaction\n");
+			hc->data_pid_start = qtd->data_toggle;
+			break;
+		case DWC_OTG_CONTROL_STATUS:
+			/*
+			 * Direction is opposite of data direction or IN if no
+			 * data.
+			 */
+			DWC_DEBUGPL(DBG_HCDV, "  Control status transaction\n");
+			if (urb->length == 0) {
+				hc->ep_is_in = 1;
+			} else {
+				hc->ep_is_in =
+				    dwc_otg_hcd_is_pipe_out(&urb->pipe_info);
+			}
+			if (hc->ep_is_in) {
+				hc->do_ping = 0;
+			}
+
+			hc->data_pid_start = DWC_OTG_HC_PID_DATA1;
+
+			hc->xfer_len = 0;
+			if (hcd->core_if->dma_enable) {
+				hc->xfer_buff = (uint8_t *) hcd->status_buf_dma;
+			} else {
+				hc->xfer_buff = (uint8_t *) hcd->status_buf;
+			}
+			ptr = NULL;
+			break;
+		}
+		break;
+	case UE_BULK:
+		hc->ep_type = DWC_OTG_EP_TYPE_BULK;
+		break;
+	case UE_INTERRUPT:
+		hc->ep_type = DWC_OTG_EP_TYPE_INTR;
+		break;
+	case UE_ISOCHRONOUS:
+		{
+			struct dwc_otg_hcd_iso_packet_desc *frame_desc;
+
+			hc->ep_type = DWC_OTG_EP_TYPE_ISOC;
+
+			if (hcd->core_if->dma_desc_enable)
+				break;
+
+			frame_desc = &urb->iso_descs[qtd->isoc_frame_index];
+
+			frame_desc->status = 0;
+
+			if (hcd->core_if->dma_enable) {
+				hc->xfer_buff = (uint8_t *) urb->dma;
+			} else {
+				hc->xfer_buff = (uint8_t *) urb->buf;
+			}
+			hc->xfer_buff +=
+			    frame_desc->offset + qtd->isoc_split_offset;
+			hc->xfer_len =
+			    frame_desc->length - qtd->isoc_split_offset;
+
+			/* For non-dword aligned buffers */
+			if (((unsigned long)hc->xfer_buff & 0x3)
+			    && hcd->core_if->dma_enable) {
+				ptr =
+				    (uint8_t *) urb->buf + frame_desc->offset +
+				    qtd->isoc_split_offset;
+			} else
+				ptr = NULL;
+
+			if (hc->xact_pos == DWC_HCSPLIT_XACTPOS_ALL) {
+				if (hc->xfer_len <= 188) {
+					hc->xact_pos = DWC_HCSPLIT_XACTPOS_ALL;
+				} else {
+					hc->xact_pos =
+					    DWC_HCSPLIT_XACTPOS_BEGIN;
+				}
+			}
+		}
+		break;
+	}
+	/* non DWORD-aligned buffer case */
+	if (ptr) {
+		uint32_t buf_size;
+		if (hc->ep_type != DWC_OTG_EP_TYPE_ISOC) {
+			buf_size = hcd->core_if->core_params->max_transfer_size;
+		} else {
+			buf_size = 4096;
+		}
+		if (!qh->dw_align_buf) {
+			qh->dw_align_buf = DWC_DMA_ALLOC_ATOMIC(dev, buf_size,
+							 &qh->dw_align_buf_dma);
+			if (!qh->dw_align_buf) {
+				DWC_ERROR
+				    ("%s: Failed to allocate memory to handle "
+				     "non-dword aligned buffer case\n",
+				     __func__);
+				return;
+			}
+		}
+		if (!hc->ep_is_in) {
+			dwc_memcpy(qh->dw_align_buf, ptr, hc->xfer_len);
+		}
+		hc->align_buff = qh->dw_align_buf_dma;
+	} else {
+		hc->align_buff = 0;
+	}
+
+	if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
+	    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
+		/*
+		 * This value may be modified when the transfer is started to
+		 * reflect the actual transfer length.
+		 */
+		hc->multi_count = dwc_hb_mult(qh->maxp);
+	}
+
+	if (hcd->core_if->dma_desc_enable)
+		hc->desc_list_addr = qh->desc_list_dma;
+
+	dwc_otg_hc_init(hcd->core_if, hc);
+
+	local_irq_save(flags);
+
+	if (fiq_enable) {
+		local_fiq_disable();
+		fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+	}
+
+	/* Enable the top level host channel interrupt. */
+	intr_enable = (1 << hc->hc_num);
+	DWC_MODIFY_REG32(&hcd->core_if->host_if->host_global_regs->haintmsk, 0, intr_enable);
+
+	/* Make sure host channel interrupts are enabled. */
+	gintmsk.b.hcintr = 1;
+	DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, 0, gintmsk.d32);
+
+	if (fiq_enable) {
+		fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+		local_fiq_enable();
+	}
+
+	local_irq_restore(flags);
+	hc->qh = qh;
+}
+
+
+/**
+ * fiq_fsm_transaction_suitable() - Test a QH for compatibility with the FIQ
+ * @hcd:	Pointer to the dwc_otg_hcd struct
+ * @qh:	pointer to the endpoint's queue head
+ *
+ * Transaction start/end control flow is grafted onto the existing dwc_otg
+ * mechanisms, to avoid spaghettifying the functions more than they already are.
+ * This function's eligibility check is altered by debug parameter.
+ *
+ * Returns: 0 for unsuitable, 1 implies the FIQ can be enabled for this transaction.
+ */
+
+int fiq_fsm_transaction_suitable(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh)
+{
+	if (qh->do_split) {
+		switch (qh->ep_type) {
+		case UE_CONTROL:
+		case UE_BULK:
+			if (fiq_fsm_mask & (1 << 0))
+				return 1;
+			break;
+		case UE_INTERRUPT:
+		case UE_ISOCHRONOUS:
+			if (fiq_fsm_mask & (1 << 1))
+				return 1;
+			break;
+		default:
+			break;
+		}
+	} else if (qh->ep_type == UE_ISOCHRONOUS) {
+		if (fiq_fsm_mask & (1 << 2)) {
+			/* ISOCH support. We test for compatibility:
+			 * - DWORD aligned buffers
+			 * - Must be at least 2 transfers (otherwise pointless to use the FIQ)
+			 * If yes, then the fsm enqueue function will handle the state machine setup.
+			 */
+			dwc_otg_qtd_t *qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
+			dwc_otg_hcd_urb_t *urb = qtd->urb;
+			dwc_dma_t ptr;
+			int i;
+
+			if (urb->packet_count < 2)
+				return 0;
+			for (i = 0; i < urb->packet_count; i++) {
+				ptr = urb->dma + urb->iso_descs[i].offset;
+				if (ptr & 0x3)
+					return 0;
+			}
+			return 1;
+		}
+	}
+	return 0;
+}
+
+/**
+ * fiq_fsm_setup_periodic_dma() - Set up DMA bounce buffers
+ * @hcd: Pointer to the dwc_otg_hcd struct
+ * @qh: Pointer to the endpoint's queue head
+ *
+ * Periodic split transactions are transmitted modulo 188 bytes.
+ * This necessitates slicing data up into buckets for isochronous out
+ * and fixing up the DMA address for all IN transfers.
+ *
+ * Returns 1 if the DMA bounce buffers have been used, 0 if the default
+ * HC buffer has been used.
+ */
+int fiq_fsm_setup_periodic_dma(dwc_otg_hcd_t *hcd, struct fiq_channel_state *st, dwc_otg_qh_t *qh)
+ {
+	int frame_length, i = 0;
+	uint8_t *ptr = NULL;
+	dwc_hc_t *hc = qh->channel;
+	struct fiq_dma_blob *blob;
+	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
+
+	for (i = 0; i < 6; i++) {
+		st->dma_info.slot_len[i] = 255;
+	}
+	st->dma_info.index = 0;
+	i = 0;
+	if (hc->ep_is_in) {
+		/*
+		 * Set dma_regs to bounce buffer. FIQ will update the
+		 * state depending on transaction progress.
+		 */
+		blob = (struct fiq_dma_blob *) hcd->fiq_state->dma_base;
+		st->hcdma_copy.d32 = (uint32_t) &blob->channel[hc->hc_num].index[0].buf[0];
+		/* Calculate the max number of CSPLITS such that the FIQ can time out
+		 * a transaction if it fails.
+		 */
+		frame_length = st->hcchar_copy.b.mps;
+		do {
+			i++;
+			frame_length -= 188;
+		} while (frame_length >= 0);
+		st->nrpackets = i;
+		return 1;
+	} else {
+		if (qh->ep_type == UE_ISOCHRONOUS) {
+
+			dwc_otg_qtd_t *qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
+
+			frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
+			frame_length = frame_desc->length;
+
+			/* Virtual address for bounce buffers */
+			blob = hcd->fiq_dmab;
+
+			ptr = qtd->urb->buf + frame_desc->offset;
+			if (frame_length == 0) {
+				/*
+				 * for isochronous transactions, we must still transmit a packet
+				 * even if the length is zero.
+				 */
+				st->dma_info.slot_len[0] = 0;
+				st->nrpackets = 1;
+			} else {
+				do {
+					if (frame_length <= 188) {
+						dwc_memcpy(&blob->channel[hc->hc_num].index[i].buf[0], ptr, frame_length);
+						st->dma_info.slot_len[i] = frame_length;
+						ptr += frame_length;
+					} else {
+						dwc_memcpy(&blob->channel[hc->hc_num].index[i].buf[0], ptr, 188);
+						st->dma_info.slot_len[i] = 188;
+						ptr += 188;
+					}
+					i++;
+					frame_length -= 188;
+				} while (frame_length > 0);
+				st->nrpackets = i;
+			}
+			ptr = qtd->urb->buf + frame_desc->offset;
+			/* Point the HC at the DMA address of the bounce buffers */
+			blob = (struct fiq_dma_blob *) hcd->fiq_state->dma_base;
+			st->hcdma_copy.d32 = (uint32_t) &blob->channel[hc->hc_num].index[0].buf[0];
+
+			/* fixup xfersize to the actual packet size */
+			st->hctsiz_copy.b.pid = 0;
+			st->hctsiz_copy.b.xfersize = st->dma_info.slot_len[0];
+			return 1;
+		} else {
+			/* For interrupt, single OUT packet required, goes in the SSPLIT from hc_buff. */
+			return 0;
+		}
+	}
+}
+
+/**
+ * fiq_fsm_np_tt_contended() - Avoid performing contended non-periodic transfers
+ * @hcd: Pointer to the dwc_otg_hcd struct
+ * @qh: Pointer to the endpoint's queue head
+ *
+ * Certain hub chips don't differentiate between IN and OUT non-periodic pipes
+ * with the same endpoint number. If transfers get completed out of order
+ * (disregarding the direction token) then the hub can lock up
+ * or return erroneous responses.
+ *
+ * Returns 1 if initiating the transfer would cause contention, 0 otherwise.
+ */
+int fiq_fsm_np_tt_contended(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh)
+{
+	int i;
+	struct fiq_channel_state *st;
+	int dev_addr = qh->channel->dev_addr;
+	int ep_num = qh->channel->ep_num;
+	for (i = 0; i < hcd->core_if->core_params->host_channels; i++) {
+		if (i == qh->channel->hc_num)
+			continue;
+		st = &hcd->fiq_state->channel[i];
+		switch (st->fsm) {
+		case FIQ_NP_SSPLIT_STARTED:
+		case FIQ_NP_SSPLIT_RETRY:
+		case FIQ_NP_SSPLIT_PENDING:
+		case FIQ_NP_OUT_CSPLIT_RETRY:
+		case FIQ_NP_IN_CSPLIT_RETRY:
+			if (st->hcchar_copy.b.devaddr == dev_addr &&
+				st->hcchar_copy.b.epnum == ep_num)
+				return 1;
+			break;
+		default:
+			break;
+		}
+	}
+	return 0;
+}
+
+/*
+ * Pushing a periodic request into the queue near the EOF1 point
+ * in a microframe causes erroneous behaviour (frmovrun) interrupt.
+ * Usually, the request goes out on the bus causing a transfer but
+ * the core does not transfer the data to memory.
+ * This guard interval (in number of 60MHz clocks) is required which
+ * must cater for CPU latency between reading the value and enabling
+ * the channel.
+ */
+#define PERIODIC_FRREM_BACKOFF 1000
+
+int fiq_fsm_queue_isoc_transaction(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh)
+{
+	dwc_hc_t *hc = qh->channel;
+	dwc_otg_hc_regs_t *hc_regs = hcd->core_if->host_if->hc_regs[hc->hc_num];
+	dwc_otg_qtd_t *qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
+	int frame;
+	struct fiq_channel_state *st = &hcd->fiq_state->channel[hc->hc_num];
+	int xfer_len, nrpackets;
+	hcdma_data_t hcdma;
+	hfnum_data_t hfnum;
+
+	if (st->fsm != FIQ_PASSTHROUGH)
+		return 0;
+
+	st->nr_errors = 0;
+
+	st->hcchar_copy.d32 = 0;
+	st->hcchar_copy.b.mps = hc->max_packet;
+	st->hcchar_copy.b.epdir = hc->ep_is_in;
+	st->hcchar_copy.b.devaddr = hc->dev_addr;
+	st->hcchar_copy.b.epnum = hc->ep_num;
+	st->hcchar_copy.b.eptype = hc->ep_type;
+
+	st->hcintmsk_copy.b.chhltd = 1;
+
+	frame = dwc_otg_hcd_get_frame_number(hcd);
+	st->hcchar_copy.b.oddfrm = (frame & 0x1) ? 0 : 1;
+
+	st->hcchar_copy.b.lspddev = 0;
+	/* Enable the channel later as a final register write. */
+
+	st->hcsplt_copy.d32 = 0;
+
+	st->hs_isoc_info.iso_desc = (struct dwc_otg_hcd_iso_packet_desc *) &qtd->urb->iso_descs;
+	st->hs_isoc_info.nrframes = qtd->urb->packet_count;
+	/* grab the next DMA address offset from the array */
+	st->hcdma_copy.d32 = qtd->urb->dma;
+	hcdma.d32 = st->hcdma_copy.d32 + st->hs_isoc_info.iso_desc[0].offset;
+
+	/* We need to set multi_count. This is a bit tricky - has to be set per-transaction as
+	 * the core needs to be told to send the correct number. Caution: for IN transfers,
+	 * this is always set to the maximum size of the endpoint. */
+	xfer_len = st->hs_isoc_info.iso_desc[0].length;
+	nrpackets = (xfer_len + st->hcchar_copy.b.mps - 1) / st->hcchar_copy.b.mps;
+	if (nrpackets == 0)
+		nrpackets = 1;
+	st->hcchar_copy.b.multicnt = nrpackets;
+	st->hctsiz_copy.b.pktcnt = nrpackets;
+
+	/* Initial PID also needs to be set */
+	if (st->hcchar_copy.b.epdir == 0) {
+		st->hctsiz_copy.b.xfersize = xfer_len;
+		switch (st->hcchar_copy.b.multicnt) {
+		case 1:
+			st->hctsiz_copy.b.pid = DWC_PID_DATA0;
+			break;
+		case 2:
+		case 3:
+			st->hctsiz_copy.b.pid = DWC_PID_MDATA;
+			break;
+		}
+
+	} else {
+		st->hctsiz_copy.b.xfersize = nrpackets * st->hcchar_copy.b.mps;
+		switch (st->hcchar_copy.b.multicnt) {
+		case 1:
+			st->hctsiz_copy.b.pid = DWC_PID_DATA0;
+			break;
+		case 2:
+			st->hctsiz_copy.b.pid = DWC_PID_DATA1;
+			break;
+		case 3:
+			st->hctsiz_copy.b.pid = DWC_PID_DATA2;
+			break;
+		}
+	}
+
+	st->hs_isoc_info.stride = qh->interval;
+	st->uframe_sleeps = 0;
+
+	fiq_print(FIQDBG_INT, hcd->fiq_state, "FSMQ  %01d ", hc->hc_num);
+	fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hcchar_copy.d32);
+	fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hctsiz_copy.d32);
+	fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hcdma_copy.d32);
+	hfnum.d32 = DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hfnum);
+	local_fiq_disable();
+	fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+	DWC_WRITE_REG32(&hc_regs->hctsiz, st->hctsiz_copy.d32);
+	DWC_WRITE_REG32(&hc_regs->hcsplt, st->hcsplt_copy.d32);
+	DWC_WRITE_REG32(&hc_regs->hcdma, st->hcdma_copy.d32);
+	DWC_WRITE_REG32(&hc_regs->hcchar, st->hcchar_copy.d32);
+	DWC_WRITE_REG32(&hc_regs->hcintmsk, st->hcintmsk_copy.d32);
+	if (hfnum.b.frrem < PERIODIC_FRREM_BACKOFF) {
+		/* Prevent queueing near EOF1. Bad things happen if a periodic
+		 * split transaction is queued very close to EOF. SOF interrupt handler
+		 * will wake this channel at the next interrupt.
+		 */
+		st->fsm = FIQ_HS_ISOC_SLEEPING;
+		st->uframe_sleeps = 1;
+	} else {
+		st->fsm = FIQ_HS_ISOC_TURBO;
+		st->hcchar_copy.b.chen = 1;
+		DWC_WRITE_REG32(&hc_regs->hcchar, st->hcchar_copy.d32);
+	}
+	mb();
+	st->hcchar_copy.b.chen = 0;
+	fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+	local_fiq_enable();
+	return 0;
+}
+
+
+/**
+ * fiq_fsm_queue_split_transaction() - Set up a host channel and FIQ state
+ * @hcd: Pointer to the dwc_otg_hcd struct
+ * @qh: Pointer to the endpoint's queue head
+ *
+ * This overrides the dwc_otg driver's normal method of queueing a transaction.
+ * Called from dwc_otg_hcd_queue_transactions(), this performs specific setup
+ * for the nominated host channel.
+ *
+ * For periodic transfers, it also peeks at the FIQ state to see if an immediate
+ * start is possible. If not, then the FIQ is left to start the transfer.
+ */
+int fiq_fsm_queue_split_transaction(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh)
+{
+	int start_immediate = 1, i;
+	hfnum_data_t hfnum;
+	dwc_hc_t *hc = qh->channel;
+	dwc_otg_hc_regs_t *hc_regs = hcd->core_if->host_if->hc_regs[hc->hc_num];
+	/* Program HC registers, setup FIQ_state, examine FIQ if periodic, start transfer (not if uframe 5) */
+	int hub_addr, port_addr, frame, uframe;
+	struct fiq_channel_state *st = &hcd->fiq_state->channel[hc->hc_num];
+
+	/*
+	 * Non-periodic channel assignments stay in the non_periodic_active queue.
+	 * Therefore we get repeatedly called until the FIQ's done processing this channel.
+	 */
+	if (qh->channel->xfer_started == 1)
+		return 0;
+
+	if (st->fsm != FIQ_PASSTHROUGH) {
+		pr_warn_ratelimited("%s:%d: Queue called for an active channel\n", __func__, __LINE__);
+		return 0;
+	}
+
+	qh->channel->xfer_started = 1;
+
+	st->nr_errors = 0;
+
+	st->hcchar_copy.d32 = 0;
+	st->hcchar_copy.b.mps = hc->max_packet;
+	st->hcchar_copy.b.epdir = hc->ep_is_in;
+	st->hcchar_copy.b.devaddr = hc->dev_addr;
+	st->hcchar_copy.b.epnum = hc->ep_num;
+	st->hcchar_copy.b.eptype = hc->ep_type;
+	if (hc->ep_type & 0x1) {
+		if (hc->ep_is_in)
+			st->hcchar_copy.b.multicnt = 3;
+		else
+			/* Docs say set this to 1, but driver sets to 0! */
+			st->hcchar_copy.b.multicnt = 0;
+	} else {
+		st->hcchar_copy.b.multicnt = 1;
+		st->hcchar_copy.b.oddfrm = 0;
+	}
+	st->hcchar_copy.b.lspddev = (hc->speed == DWC_OTG_EP_SPEED_LOW) ? 1 : 0;
+	/* Enable the channel later as a final register write. */
+
+	st->hcsplt_copy.d32 = 0;
+	if(qh->do_split) {
+		hcd->fops->hub_info(hcd, DWC_CIRCLEQ_FIRST(&qh->qtd_list)->urb->priv, &hub_addr, &port_addr);
+		st->hcsplt_copy.b.compsplt = 0;
+		st->hcsplt_copy.b.spltena = 1;
+		// XACTPOS is for isoc-out only but needs initialising anyway.
+		st->hcsplt_copy.b.xactpos = ISOC_XACTPOS_ALL;
+		if((qh->ep_type == DWC_OTG_EP_TYPE_ISOC) && (!qh->ep_is_in)) {
+			/* For packetsize 0 < L < 188, ISOC_XACTPOS_ALL.
+			 * for longer than this, ISOC_XACTPOS_BEGIN and the FIQ
+			 * will update as necessary.
+			 */
+			if (hc->xfer_len > 188) {
+				st->hcsplt_copy.b.xactpos = ISOC_XACTPOS_BEGIN;
+			}
+		}
+		st->hcsplt_copy.b.hubaddr = (uint8_t) hub_addr;
+		st->hcsplt_copy.b.prtaddr = (uint8_t) port_addr;
+		st->hub_addr = hub_addr;
+		st->port_addr = port_addr;
+	}
+
+	st->hctsiz_copy.d32 = 0;
+	st->hctsiz_copy.b.dopng = 0;
+	st->hctsiz_copy.b.pid = hc->data_pid_start;
+
+	if (hc->ep_is_in || (hc->xfer_len > hc->max_packet)) {
+		hc->xfer_len = hc->max_packet;
+	} else if (!hc->ep_is_in && (hc->xfer_len > 188)) {
+		hc->xfer_len = 188;
+	}
+	st->hctsiz_copy.b.xfersize = hc->xfer_len;
+
+	st->hctsiz_copy.b.pktcnt = 1;
+
+	if (hc->ep_type & 0x1) {
+		/*
+		 * For potentially multi-packet transfers, must use the DMA bounce buffers. For IN transfers,
+		 * the DMA address is the address of the first 188byte slot buffer in the bounce buffer array.
+		 * For multi-packet OUT transfers, we need to copy the data into the bounce buffer array so the FIQ can punt
+		 * the right address out as necessary. hc->xfer_buff and hc->xfer_len have already been set
+		 * in assign_and_init_hc(), but this is for the eventual transaction completion only. The FIQ
+		 * must not touch internal driver state.
+		 */
+		if(!fiq_fsm_setup_periodic_dma(hcd, st, qh)) {
+			if (hc->align_buff) {
+				st->hcdma_copy.d32 = hc->align_buff;
+			} else {
+				st->hcdma_copy.d32 = ((unsigned long) hc->xfer_buff & 0xFFFFFFFF);
+			}
+		}
+	} else {
+		if (hc->align_buff) {
+			st->hcdma_copy.d32 = hc->align_buff;
+		} else {
+			st->hcdma_copy.d32 = ((unsigned long) hc->xfer_buff & 0xFFFFFFFF);
+		}
+	}
+	/* The FIQ depends upon no other interrupts being enabled except channel halt.
+	 * Fixup channel interrupt mask. */
+	st->hcintmsk_copy.d32 = 0;
+	st->hcintmsk_copy.b.chhltd = 1;
+	st->hcintmsk_copy.b.ahberr = 1;
+
+	/* Hack courtesy of FreeBSD: apparently forcing Interrupt Split transactions
+	 * as Control puts the transfer into the non-periodic request queue and the
+	 * non-periodic handler in the hub. Makes things lots easier.
+	 */
+	if ((fiq_fsm_mask & 0x8) && hc->ep_type == UE_INTERRUPT) {
+		st->hcchar_copy.b.multicnt = 0;
+		st->hcchar_copy.b.oddfrm = 0;
+		st->hcchar_copy.b.eptype = UE_CONTROL;
+		if (hc->align_buff) {
+			st->hcdma_copy.d32 = hc->align_buff;
+		} else {
+			st->hcdma_copy.d32 = ((unsigned long) hc->xfer_buff & 0xFFFFFFFF);
+		}
+	}
+	DWC_WRITE_REG32(&hc_regs->hcdma, st->hcdma_copy.d32);
+	DWC_WRITE_REG32(&hc_regs->hctsiz, st->hctsiz_copy.d32);
+	DWC_WRITE_REG32(&hc_regs->hcsplt, st->hcsplt_copy.d32);
+	DWC_WRITE_REG32(&hc_regs->hcchar, st->hcchar_copy.d32);
+	DWC_WRITE_REG32(&hc_regs->hcintmsk, st->hcintmsk_copy.d32);
+
+	local_fiq_disable();
+	fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+
+	if (hc->ep_type & 0x1) {
+		hfnum.d32 = DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hfnum);
+		frame = (hfnum.b.frnum & ~0x7) >> 3;
+		uframe = hfnum.b.frnum & 0x7;
+		if (hfnum.b.frrem < PERIODIC_FRREM_BACKOFF) {
+			/* Prevent queueing near EOF1. Bad things happen if a periodic
+			 * split transaction is queued very close to EOF.
+			 */
+			start_immediate = 0;
+		} else if (uframe == 5) {
+			start_immediate = 0;
+		} else if (hc->ep_type == UE_ISOCHRONOUS && !hc->ep_is_in) {
+			start_immediate = 0;
+		} else if (hc->ep_is_in && fiq_fsm_too_late(hcd->fiq_state, hc->hc_num)) {
+			start_immediate = 0;
+		} else {
+			/* Search through all host channels to determine if a transaction
+			 * is currently in progress */
+			for (i = 0; i < hcd->core_if->core_params->host_channels; i++) {
+				if (i == hc->hc_num || hcd->fiq_state->channel[i].fsm == FIQ_PASSTHROUGH)
+					continue;
+				switch (hcd->fiq_state->channel[i].fsm) {
+				/* TT is reserved for channels that are in the middle of a periodic
+				 * split transaction.
+				 */
+				case FIQ_PER_SSPLIT_STARTED:
+				case FIQ_PER_CSPLIT_WAIT:
+				case FIQ_PER_CSPLIT_NYET1:
+				case FIQ_PER_CSPLIT_POLL:
+				case FIQ_PER_ISO_OUT_ACTIVE:
+				case FIQ_PER_ISO_OUT_LAST:
+					if (hcd->fiq_state->channel[i].hub_addr == hub_addr &&
+							hcd->fiq_state->channel[i].port_addr == port_addr) {
+						start_immediate = 0;
+					}
+					break;
+				default:
+					break;
+				}
+				if (!start_immediate)
+					break;
+			}
+		}
+	}
+	if ((fiq_fsm_mask & 0x8) && hc->ep_type == UE_INTERRUPT)
+		start_immediate = 1;
+
+	fiq_print(FIQDBG_INT, hcd->fiq_state, "FSMQ %01d %01d", hc->hc_num, start_immediate);
+	fiq_print(FIQDBG_INT, hcd->fiq_state, "%08d", hfnum.b.frrem);
+	//fiq_print(FIQDBG_INT, hcd->fiq_state, "H:%02dP:%02d", hub_addr, port_addr);
+	//fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hctsiz_copy.d32);
+	//fiq_print(FIQDBG_INT, hcd->fiq_state, "%08x", st->hcdma_copy.d32);
+	switch (hc->ep_type) {
+		case UE_CONTROL:
+		case UE_BULK:
+			if (fiq_fsm_np_tt_contended(hcd, qh)) {
+				st->fsm = FIQ_NP_SSPLIT_PENDING;
+				start_immediate = 0;
+			} else {
+				st->fsm = FIQ_NP_SSPLIT_STARTED;
+			}
+			break;
+		case UE_ISOCHRONOUS:
+			if (hc->ep_is_in) {
+				if (start_immediate) {
+					st->fsm = FIQ_PER_SSPLIT_STARTED;
+				} else {
+					st->fsm = FIQ_PER_SSPLIT_QUEUED;
+				}
+			} else {
+				if (start_immediate) {
+					/* Single-isoc OUT packets don't require FIQ involvement */
+					if (st->nrpackets == 1) {
+						st->fsm = FIQ_PER_ISO_OUT_LAST;
+					} else {
+						st->fsm = FIQ_PER_ISO_OUT_ACTIVE;
+					}
+				} else {
+					st->fsm = FIQ_PER_ISO_OUT_PENDING;
+				}
+			}
+			break;
+		case UE_INTERRUPT:
+			if (fiq_fsm_mask & 0x8) {
+				if (fiq_fsm_np_tt_contended(hcd, qh)) {
+					st->fsm = FIQ_NP_SSPLIT_PENDING;
+					start_immediate = 0;
+				} else {
+					st->fsm = FIQ_NP_SSPLIT_STARTED;
+				}
+			} else if (start_immediate) {
+					st->fsm = FIQ_PER_SSPLIT_STARTED;
+			} else {
+				st->fsm = FIQ_PER_SSPLIT_QUEUED;
+			}
+		default:
+			break;
+	}
+	if (start_immediate) {
+		/* Set the oddfrm bit as close as possible to actual queueing */
+		frame = dwc_otg_hcd_get_frame_number(hcd);
+		st->expected_uframe = (frame + 1) & 0x3FFF;
+		st->hcchar_copy.b.oddfrm = (frame & 0x1) ? 0 : 1;
+		st->hcchar_copy.b.chen = 1;
+		DWC_WRITE_REG32(&hc_regs->hcchar, st->hcchar_copy.d32);
+	}
+	mb();
+	fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+	local_fiq_enable();
+	return 0;
+}
+
+
+/**
+ * This function selects transactions from the HCD transfer schedule and
+ * assigns them to available host channels. It is called from HCD interrupt
+ * handler functions.
+ *
+ * @param hcd The HCD state structure.
+ *
+ * @return The types of new transactions that were assigned to host channels.
+ */
+dwc_otg_transaction_type_e dwc_otg_hcd_select_transactions(dwc_otg_hcd_t * hcd)
+{
+	dwc_list_link_t *qh_ptr;
+	dwc_otg_qh_t *qh;
+	int num_channels;
+	dwc_otg_transaction_type_e ret_val = DWC_OTG_TRANSACTION_NONE;
+
+#ifdef DEBUG_HOST_CHANNELS
+	last_sel_trans_num_per_scheduled = 0;
+	last_sel_trans_num_nonper_scheduled = 0;
+	last_sel_trans_num_avail_hc_at_start = hcd->available_host_channels;
+#endif /* DEBUG_HOST_CHANNELS */
+
+	/* Process entries in the periodic ready list. */
+	qh_ptr = DWC_LIST_FIRST(&hcd->periodic_sched_ready);
+
+	while (qh_ptr != &hcd->periodic_sched_ready &&
+	       !DWC_CIRCLEQ_EMPTY(&hcd->free_hc_list)) {
+
+		qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
+
+		if (microframe_schedule) {
+			// Make sure we leave one channel for non periodic transactions.
+			if (hcd->available_host_channels <= 1) {
+				break;
+			}
+			hcd->available_host_channels--;
+#ifdef DEBUG_HOST_CHANNELS
+			last_sel_trans_num_per_scheduled++;
+#endif /* DEBUG_HOST_CHANNELS */
+		}
+		qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
+		assign_and_init_hc(hcd, qh);
+
+		/*
+		 * Move the QH from the periodic ready schedule to the
+		 * periodic assigned schedule.
+		 */
+		qh_ptr = DWC_LIST_NEXT(qh_ptr);
+		DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_assigned,
+				   &qh->qh_list_entry);
+	}
+
+	/*
+	 * Process entries in the inactive portion of the non-periodic
+	 * schedule. Some free host channels may not be used if they are
+	 * reserved for periodic transfers.
+	 */
+	qh_ptr = hcd->non_periodic_sched_inactive.next;
+	num_channels = hcd->core_if->core_params->host_channels;
+	while (qh_ptr != &hcd->non_periodic_sched_inactive &&
+	       (microframe_schedule || hcd->non_periodic_channels <
+		num_channels - hcd->periodic_channels) &&
+	       !DWC_CIRCLEQ_EMPTY(&hcd->free_hc_list)) {
+
+		qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
+		/*
+		 * Check to see if this is a NAK'd retransmit, in which case ignore for retransmission
+		 * we hold off on bulk retransmissions to reduce NAK interrupt overhead for full-speed
+		 * cheeky devices that just hold off using NAKs
+		 */
+		if (fiq_enable && nak_holdoff && qh->do_split) {
+			if (qh->nak_frame != 0xffff) {
+				uint16_t next_frame = dwc_frame_num_inc(qh->nak_frame, (qh->ep_type == UE_BULK) ? nak_holdoff : 8);
+				uint16_t frame = dwc_otg_hcd_get_frame_number(hcd);
+				if (dwc_frame_num_le(frame, next_frame)) {
+					if(dwc_frame_num_le(next_frame, hcd->fiq_state->next_sched_frame)) {
+						hcd->fiq_state->next_sched_frame = next_frame;
+					}
+					qh_ptr = DWC_LIST_NEXT(qh_ptr);
+					continue;
+				} else {
+					qh->nak_frame = 0xFFFF;
+				}
+			}
+		}
+
+		if (microframe_schedule) {
+				if (hcd->available_host_channels < 1) {
+					break;
+				}
+				hcd->available_host_channels--;
+#ifdef DEBUG_HOST_CHANNELS
+				last_sel_trans_num_nonper_scheduled++;
+#endif /* DEBUG_HOST_CHANNELS */
+		}
+
+		assign_and_init_hc(hcd, qh);
+
+		/*
+		 * Move the QH from the non-periodic inactive schedule to the
+		 * non-periodic active schedule.
+		 */
+		qh_ptr = DWC_LIST_NEXT(qh_ptr);
+		DWC_LIST_MOVE_HEAD(&hcd->non_periodic_sched_active,
+				   &qh->qh_list_entry);
+
+		if (!microframe_schedule)
+			hcd->non_periodic_channels++;
+	}
+	/* we moved a non-periodic QH to the active schedule. If the inactive queue is empty,
+	 * stop the FIQ from kicking us. We could potentially still have elements here if we
+	 * ran out of host channels.
+	 */
+	if (fiq_enable) {
+		if (DWC_LIST_EMPTY(&hcd->non_periodic_sched_inactive)) {
+			hcd->fiq_state->kick_np_queues = 0;
+		} else {
+			/* For each entry remaining in the NP inactive queue,
+			* if this a NAK'd retransmit then don't set the kick flag.
+			*/
+			if(nak_holdoff) {
+				DWC_LIST_FOREACH(qh_ptr, &hcd->non_periodic_sched_inactive) {
+					qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
+					if (qh->nak_frame == 0xFFFF) {
+						hcd->fiq_state->kick_np_queues = 1;
+					}
+				}
+			}
+		}
+	}
+	if(!DWC_LIST_EMPTY(&hcd->periodic_sched_assigned))
+		ret_val |= DWC_OTG_TRANSACTION_PERIODIC;
+
+	if(!DWC_LIST_EMPTY(&hcd->non_periodic_sched_active))
+		ret_val |= DWC_OTG_TRANSACTION_NON_PERIODIC;
+
+
+#ifdef DEBUG_HOST_CHANNELS
+	last_sel_trans_num_avail_hc_at_end = hcd->available_host_channels;
+#endif /* DEBUG_HOST_CHANNELS */
+	return ret_val;
+}
+
+/**
+ * Attempts to queue a single transaction request for a host channel
+ * associated with either a periodic or non-periodic transfer. This function
+ * assumes that there is space available in the appropriate request queue. For
+ * an OUT transfer or SETUP transaction in Slave mode, it checks whether space
+ * is available in the appropriate Tx FIFO.
+ *
+ * @param hcd The HCD state structure.
+ * @param hc Host channel descriptor associated with either a periodic or
+ * non-periodic transfer.
+ * @param fifo_dwords_avail Number of DWORDs available in the periodic Tx
+ * FIFO for periodic transfers or the non-periodic Tx FIFO for non-periodic
+ * transfers.
+ *
+ * @return 1 if a request is queued and more requests may be needed to
+ * complete the transfer, 0 if no more requests are required for this
+ * transfer, -1 if there is insufficient space in the Tx FIFO.
+ */
+static int queue_transaction(dwc_otg_hcd_t * hcd,
+			     dwc_hc_t * hc, uint16_t fifo_dwords_avail)
+{
+	int retval;
+
+	if (hcd->core_if->dma_enable) {
+		if (hcd->core_if->dma_desc_enable) {
+			if (!hc->xfer_started
+			    || (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)) {
+				dwc_otg_hcd_start_xfer_ddma(hcd, hc->qh);
+				hc->qh->ping_state = 0;
+			}
+		} else if (!hc->xfer_started) {
+			if (fiq_fsm_enable && hc->error_state) {
+				hcd->fiq_state->channel[hc->hc_num].nr_errors =
+					DWC_CIRCLEQ_FIRST(&hc->qh->qtd_list)->error_count;
+				hcd->fiq_state->channel[hc->hc_num].fsm =
+					FIQ_PASSTHROUGH_ERRORSTATE;
+			}
+			dwc_otg_hc_start_transfer(hcd->core_if, hc);
+			hc->qh->ping_state = 0;
+		}
+		retval = 0;
+	} else if (hc->halt_pending) {
+		/* Don't queue a request if the channel has been halted. */
+		retval = 0;
+	} else if (hc->halt_on_queue) {
+		dwc_otg_hc_halt(hcd->core_if, hc, hc->halt_status);
+		retval = 0;
+	} else if (hc->do_ping) {
+		if (!hc->xfer_started) {
+			dwc_otg_hc_start_transfer(hcd->core_if, hc);
+		}
+		retval = 0;
+	} else if (!hc->ep_is_in || hc->data_pid_start == DWC_OTG_HC_PID_SETUP) {
+		if ((fifo_dwords_avail * 4) >= hc->max_packet) {
+			if (!hc->xfer_started) {
+				dwc_otg_hc_start_transfer(hcd->core_if, hc);
+				retval = 1;
+			} else {
+				retval =
+				    dwc_otg_hc_continue_transfer(hcd->core_if,
+								 hc);
+			}
+		} else {
+			retval = -1;
+		}
+	} else {
+		if (!hc->xfer_started) {
+			dwc_otg_hc_start_transfer(hcd->core_if, hc);
+			retval = 1;
+		} else {
+			retval = dwc_otg_hc_continue_transfer(hcd->core_if, hc);
+		}
+	}
+
+	return retval;
+}
+
+/**
+ * Processes periodic channels for the next frame and queues transactions for
+ * these channels to the DWC_otg controller. After queueing transactions, the
+ * Periodic Tx FIFO Empty interrupt is enabled if there are more transactions
+ * to queue as Periodic Tx FIFO or request queue space becomes available.
+ * Otherwise, the Periodic Tx FIFO Empty interrupt is disabled.
+ */
+static void process_periodic_channels(dwc_otg_hcd_t * hcd)
+{
+	hptxsts_data_t tx_status;
+	dwc_list_link_t *qh_ptr;
+	dwc_otg_qh_t *qh;
+	int status = 0;
+	int no_queue_space = 0;
+	int no_fifo_space = 0;
+
+	dwc_otg_host_global_regs_t *host_regs;
+	host_regs = hcd->core_if->host_if->host_global_regs;
+
+	DWC_DEBUGPL(DBG_HCDV, "Queue periodic transactions\n");
+#ifdef DEBUG
+	tx_status.d32 = DWC_READ_REG32(&host_regs->hptxsts);
+	DWC_DEBUGPL(DBG_HCDV,
+		    "  P Tx Req Queue Space Avail (before queue): %d\n",
+		    tx_status.b.ptxqspcavail);
+	DWC_DEBUGPL(DBG_HCDV, "  P Tx FIFO Space Avail (before queue): %d\n",
+		    tx_status.b.ptxfspcavail);
+#endif
+
+	qh_ptr = hcd->periodic_sched_assigned.next;
+	while (qh_ptr != &hcd->periodic_sched_assigned) {
+		tx_status.d32 = DWC_READ_REG32(&host_regs->hptxsts);
+		if (tx_status.b.ptxqspcavail == 0) {
+			no_queue_space = 1;
+			break;
+		}
+
+		qh = DWC_LIST_ENTRY(qh_ptr, dwc_otg_qh_t, qh_list_entry);
+
+		// Do not send a split start transaction any later than frame .6
+		// Note, we have to schedule a periodic in .5 to make it go in .6
+		if(fiq_fsm_enable && qh->do_split && ((dwc_otg_hcd_get_frame_number(hcd) + 1) & 7) > 6)
+		{
+			qh_ptr = qh_ptr->next;
+			hcd->fiq_state->next_sched_frame = dwc_otg_hcd_get_frame_number(hcd) | 7;
+			continue;
+		}
+
+		if (fiq_fsm_enable && fiq_fsm_transaction_suitable(hcd, qh)) {
+			if (qh->do_split)
+				fiq_fsm_queue_split_transaction(hcd, qh);
+			else
+				fiq_fsm_queue_isoc_transaction(hcd, qh);
+		} else {
+
+			/*
+			 * Set a flag if we're queueing high-bandwidth in slave mode.
+			 * The flag prevents any halts to get into the request queue in
+			 * the middle of multiple high-bandwidth packets getting queued.
+			 */
+			if (!hcd->core_if->dma_enable && qh->channel->multi_count > 1) {
+				hcd->core_if->queuing_high_bandwidth = 1;
+			}
+			status = queue_transaction(hcd, qh->channel,
+							tx_status.b.ptxfspcavail);
+			if (status < 0) {
+				no_fifo_space = 1;
+				break;
+			}
+		}
+
+		/*
+		 * In Slave mode, stay on the current transfer until there is
+		 * nothing more to do or the high-bandwidth request count is
+		 * reached. In DMA mode, only need to queue one request. The
+		 * controller automatically handles multiple packets for
+		 * high-bandwidth transfers.
+		 */
+		if (hcd->core_if->dma_enable || status == 0 ||
+		    qh->channel->requests == qh->channel->multi_count) {
+			qh_ptr = qh_ptr->next;
+			/*
+			 * Move the QH from the periodic assigned schedule to
+			 * the periodic queued schedule.
+			 */
+			DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_queued,
+					   &qh->qh_list_entry);
+
+			/* done queuing high bandwidth */
+			hcd->core_if->queuing_high_bandwidth = 0;
+		}
+	}
+
+	if (!hcd->core_if->dma_enable) {
+		dwc_otg_core_global_regs_t *global_regs;
+		gintmsk_data_t intr_mask = {.d32 = 0 };
+
+		global_regs = hcd->core_if->core_global_regs;
+		intr_mask.b.ptxfempty = 1;
+#ifdef DEBUG
+		tx_status.d32 = DWC_READ_REG32(&host_regs->hptxsts);
+		DWC_DEBUGPL(DBG_HCDV,
+			    "  P Tx Req Queue Space Avail (after queue): %d\n",
+			    tx_status.b.ptxqspcavail);
+		DWC_DEBUGPL(DBG_HCDV,
+			    "  P Tx FIFO Space Avail (after queue): %d\n",
+			    tx_status.b.ptxfspcavail);
+#endif
+		if (!DWC_LIST_EMPTY(&hcd->periodic_sched_assigned) ||
+		    no_queue_space || no_fifo_space) {
+			/*
+			 * May need to queue more transactions as the request
+			 * queue or Tx FIFO empties. Enable the periodic Tx
+			 * FIFO empty interrupt. (Always use the half-empty
+			 * level to ensure that new requests are loaded as
+			 * soon as possible.)
+			 */
+			DWC_MODIFY_REG32(&global_regs->gintmsk, 0,
+					 intr_mask.d32);
+		} else {
+			/*
+			 * Disable the Tx FIFO empty interrupt since there are
+			 * no more transactions that need to be queued right
+			 * now. This function is called from interrupt
+			 * handlers to queue more transactions as transfer
+			 * states change.
+			 */
+			DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32,
+					 0);
+		}
+	}
+}
+
+/**
+ * Processes active non-periodic channels and queues transactions for these
+ * channels to the DWC_otg controller. After queueing transactions, the NP Tx
+ * FIFO Empty interrupt is enabled if there are more transactions to queue as
+ * NP Tx FIFO or request queue space becomes available. Otherwise, the NP Tx
+ * FIFO Empty interrupt is disabled.
+ */
+static void process_non_periodic_channels(dwc_otg_hcd_t * hcd)
+{
+	gnptxsts_data_t tx_status;
+	dwc_list_link_t *orig_qh_ptr;
+	dwc_otg_qh_t *qh;
+	int status;
+	int no_queue_space = 0;
+	int no_fifo_space = 0;
+	int more_to_do = 0;
+
+	dwc_otg_core_global_regs_t *global_regs =
+	    hcd->core_if->core_global_regs;
+
+	DWC_DEBUGPL(DBG_HCDV, "Queue non-periodic transactions\n");
+#ifdef DEBUG
+	tx_status.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
+	DWC_DEBUGPL(DBG_HCDV,
+		    "  NP Tx Req Queue Space Avail (before queue): %d\n",
+		    tx_status.b.nptxqspcavail);
+	DWC_DEBUGPL(DBG_HCDV, "  NP Tx FIFO Space Avail (before queue): %d\n",
+		    tx_status.b.nptxfspcavail);
+#endif
+	/*
+	 * Keep track of the starting point. Skip over the start-of-list
+	 * entry.
+	 */
+	if (hcd->non_periodic_qh_ptr == &hcd->non_periodic_sched_active) {
+		hcd->non_periodic_qh_ptr = hcd->non_periodic_qh_ptr->next;
+	}
+	orig_qh_ptr = hcd->non_periodic_qh_ptr;
+
+	/*
+	 * Process once through the active list or until no more space is
+	 * available in the request queue or the Tx FIFO.
+	 */
+	do {
+		tx_status.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
+		if (!hcd->core_if->dma_enable && tx_status.b.nptxqspcavail == 0) {
+			no_queue_space = 1;
+			break;
+		}
+
+		qh = DWC_LIST_ENTRY(hcd->non_periodic_qh_ptr, dwc_otg_qh_t,
+				    qh_list_entry);
+
+		if(fiq_fsm_enable && fiq_fsm_transaction_suitable(hcd, qh)) {
+			fiq_fsm_queue_split_transaction(hcd, qh);
+		} else {
+			status = queue_transaction(hcd, qh->channel,
+						tx_status.b.nptxfspcavail);
+
+			if (status > 0) {
+				more_to_do = 1;
+			} else if (status < 0) {
+				no_fifo_space = 1;
+				break;
+			}
+		}
+		/* Advance to next QH, skipping start-of-list entry. */
+		hcd->non_periodic_qh_ptr = hcd->non_periodic_qh_ptr->next;
+		if (hcd->non_periodic_qh_ptr == &hcd->non_periodic_sched_active) {
+			hcd->non_periodic_qh_ptr =
+			    hcd->non_periodic_qh_ptr->next;
+		}
+
+	} while (hcd->non_periodic_qh_ptr != orig_qh_ptr);
+
+	if (!hcd->core_if->dma_enable) {
+		gintmsk_data_t intr_mask = {.d32 = 0 };
+		intr_mask.b.nptxfempty = 1;
+
+#ifdef DEBUG
+		tx_status.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
+		DWC_DEBUGPL(DBG_HCDV,
+			    "  NP Tx Req Queue Space Avail (after queue): %d\n",
+			    tx_status.b.nptxqspcavail);
+		DWC_DEBUGPL(DBG_HCDV,
+			    "  NP Tx FIFO Space Avail (after queue): %d\n",
+			    tx_status.b.nptxfspcavail);
+#endif
+		if (more_to_do || no_queue_space || no_fifo_space) {
+			/*
+			 * May need to queue more transactions as the request
+			 * queue or Tx FIFO empties. Enable the non-periodic
+			 * Tx FIFO empty interrupt. (Always use the half-empty
+			 * level to ensure that new requests are loaded as
+			 * soon as possible.)
+			 */
+			DWC_MODIFY_REG32(&global_regs->gintmsk, 0,
+					 intr_mask.d32);
+		} else {
+			/*
+			 * Disable the Tx FIFO empty interrupt since there are
+			 * no more transactions that need to be queued right
+			 * now. This function is called from interrupt
+			 * handlers to queue more transactions as transfer
+			 * states change.
+			 */
+			DWC_MODIFY_REG32(&global_regs->gintmsk, intr_mask.d32,
+					 0);
+		}
+	}
+}
+
+/**
+ * This function processes the currently active host channels and queues
+ * transactions for these channels to the DWC_otg controller. It is called
+ * from HCD interrupt handler functions.
+ *
+ * @param hcd The HCD state structure.
+ * @param tr_type The type(s) of transactions to queue (non-periodic,
+ * periodic, or both).
+ */
+void dwc_otg_hcd_queue_transactions(dwc_otg_hcd_t * hcd,
+				    dwc_otg_transaction_type_e tr_type)
+{
+#ifdef DEBUG_SOF
+	DWC_DEBUGPL(DBG_HCD, "Queue Transactions\n");
+#endif
+	/* Process host channels associated with periodic transfers. */
+	if ((tr_type == DWC_OTG_TRANSACTION_PERIODIC ||
+	     tr_type == DWC_OTG_TRANSACTION_ALL) &&
+	    !DWC_LIST_EMPTY(&hcd->periodic_sched_assigned)) {
+
+		process_periodic_channels(hcd);
+	}
+
+	/* Process host channels associated with non-periodic transfers. */
+	if (tr_type == DWC_OTG_TRANSACTION_NON_PERIODIC ||
+	    tr_type == DWC_OTG_TRANSACTION_ALL) {
+		if (!DWC_LIST_EMPTY(&hcd->non_periodic_sched_active)) {
+			process_non_periodic_channels(hcd);
+		} else {
+			/*
+			 * Ensure NP Tx FIFO empty interrupt is disabled when
+			 * there are no non-periodic transfers to process.
+			 */
+			gintmsk_data_t gintmsk = {.d32 = 0 };
+			gintmsk.b.nptxfempty = 1;
+
+			if (fiq_enable) {
+				local_fiq_disable();
+				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, gintmsk.d32, 0);
+				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+				local_fiq_enable();
+			} else {
+				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, gintmsk.d32, 0);
+			}
+		}
+	}
+}
+
+#ifdef DWC_HS_ELECT_TST
+/*
+ * Quick and dirty hack to implement the HS Electrical Test
+ * SINGLE_STEP_GET_DEVICE_DESCRIPTOR feature.
+ *
+ * This code was copied from our userspace app "hset". It sends a
+ * Get Device Descriptor control sequence in two parts, first the
+ * Setup packet by itself, followed some time later by the In and
+ * Ack packets. Rather than trying to figure out how to add this
+ * functionality to the normal driver code, we just hijack the
+ * hardware, using these two function to drive the hardware
+ * directly.
+ */
+
+static dwc_otg_core_global_regs_t *global_regs;
+static dwc_otg_host_global_regs_t *hc_global_regs;
+static dwc_otg_hc_regs_t *hc_regs;
+static uint32_t *data_fifo;
+
+static void do_setup(void)
+{
+	gintsts_data_t gintsts;
+	hctsiz_data_t hctsiz;
+	hcchar_data_t hcchar;
+	haint_data_t haint;
+	hcint_data_t hcint;
+
+	/* Enable HAINTs */
+	DWC_WRITE_REG32(&hc_global_regs->haintmsk, 0x0001);
+
+	/* Enable HCINTs */
+	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0x04a3);
+
+	/* Read GINTSTS */
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/* Read HAINT */
+	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
+
+	/* Read HCINT */
+	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+
+	/* Read HCCHAR */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+	/* Clear HCINT */
+	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
+
+	/* Clear HAINT */
+	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
+
+	/* Clear GINTSTS */
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	/* Read GINTSTS */
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/*
+	 * Send Setup packet (Get Device Descriptor)
+	 */
+
+	/* Make sure channel is disabled */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	if (hcchar.b.chen) {
+		hcchar.b.chdis = 1;
+//              hcchar.b.chen = 1;
+		DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+		//sleep(1);
+		dwc_mdelay(1000);
+
+		/* Read GINTSTS */
+		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+		/* Read HAINT */
+		haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
+
+		/* Read HCINT */
+		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+
+		/* Read HCCHAR */
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+		/* Clear HCINT */
+		DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
+
+		/* Clear HAINT */
+		DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
+
+		/* Clear GINTSTS */
+		DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	}
+
+	/* Set HCTSIZ */
+	hctsiz.d32 = 0;
+	hctsiz.b.xfersize = 8;
+	hctsiz.b.pktcnt = 1;
+	hctsiz.b.pid = DWC_OTG_HC_PID_SETUP;
+	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
+
+	/* Set HCCHAR */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	hcchar.b.eptype = DWC_OTG_EP_TYPE_CONTROL;
+	hcchar.b.epdir = 0;
+	hcchar.b.epnum = 0;
+	hcchar.b.mps = 8;
+	hcchar.b.chen = 1;
+	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+
+	/* Fill FIFO with Setup data for Get Device Descriptor */
+	data_fifo = (uint32_t *) ((char *)global_regs + 0x1000);
+	DWC_WRITE_REG32(data_fifo++, 0x01000680);
+	DWC_WRITE_REG32(data_fifo++, 0x00080000);
+
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/* Wait for host channel interrupt */
+	do {
+		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+	} while (gintsts.b.hcintr == 0);
+
+	/* Disable HCINTs */
+	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0x0000);
+
+	/* Disable HAINTs */
+	DWC_WRITE_REG32(&hc_global_regs->haintmsk, 0x0000);
+
+	/* Read HAINT */
+	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
+
+	/* Read HCINT */
+	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+
+	/* Read HCCHAR */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+	/* Clear HCINT */
+	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
+
+	/* Clear HAINT */
+	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
+
+	/* Clear GINTSTS */
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	/* Read GINTSTS */
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+}
+
+static void do_in_ack(void)
+{
+	gintsts_data_t gintsts;
+	hctsiz_data_t hctsiz;
+	hcchar_data_t hcchar;
+	haint_data_t haint;
+	hcint_data_t hcint;
+	host_grxsts_data_t grxsts;
+
+	/* Enable HAINTs */
+	DWC_WRITE_REG32(&hc_global_regs->haintmsk, 0x0001);
+
+	/* Enable HCINTs */
+	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0x04a3);
+
+	/* Read GINTSTS */
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/* Read HAINT */
+	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
+
+	/* Read HCINT */
+	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+
+	/* Read HCCHAR */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+	/* Clear HCINT */
+	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
+
+	/* Clear HAINT */
+	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
+
+	/* Clear GINTSTS */
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	/* Read GINTSTS */
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/*
+	 * Receive Control In packet
+	 */
+
+	/* Make sure channel is disabled */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	if (hcchar.b.chen) {
+		hcchar.b.chdis = 1;
+		hcchar.b.chen = 1;
+		DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+		//sleep(1);
+		dwc_mdelay(1000);
+
+		/* Read GINTSTS */
+		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+		/* Read HAINT */
+		haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
+
+		/* Read HCINT */
+		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+
+		/* Read HCCHAR */
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+		/* Clear HCINT */
+		DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
+
+		/* Clear HAINT */
+		DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
+
+		/* Clear GINTSTS */
+		DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	}
+
+	/* Set HCTSIZ */
+	hctsiz.d32 = 0;
+	hctsiz.b.xfersize = 8;
+	hctsiz.b.pktcnt = 1;
+	hctsiz.b.pid = DWC_OTG_HC_PID_DATA1;
+	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
+
+	/* Set HCCHAR */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	hcchar.b.eptype = DWC_OTG_EP_TYPE_CONTROL;
+	hcchar.b.epdir = 1;
+	hcchar.b.epnum = 0;
+	hcchar.b.mps = 8;
+	hcchar.b.chen = 1;
+	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/* Wait for receive status queue interrupt */
+	do {
+		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+	} while (gintsts.b.rxstsqlvl == 0);
+
+	/* Read RXSTS */
+	grxsts.d32 = DWC_READ_REG32(&global_regs->grxstsp);
+
+	/* Clear RXSTSQLVL in GINTSTS */
+	gintsts.d32 = 0;
+	gintsts.b.rxstsqlvl = 1;
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	switch (grxsts.b.pktsts) {
+	case DWC_GRXSTS_PKTSTS_IN:
+		/* Read the data into the host buffer */
+		if (grxsts.b.bcnt > 0) {
+			int i;
+			int word_count = (grxsts.b.bcnt + 3) / 4;
+
+			data_fifo = (uint32_t *) ((char *)global_regs + 0x1000);
+
+			for (i = 0; i < word_count; i++) {
+				(void)DWC_READ_REG32(data_fifo++);
+			}
+		}
+		break;
+
+	default:
+		break;
+	}
+
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/* Wait for receive status queue interrupt */
+	do {
+		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+	} while (gintsts.b.rxstsqlvl == 0);
+
+	/* Read RXSTS */
+	grxsts.d32 = DWC_READ_REG32(&global_regs->grxstsp);
+
+	/* Clear RXSTSQLVL in GINTSTS */
+	gintsts.d32 = 0;
+	gintsts.b.rxstsqlvl = 1;
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	switch (grxsts.b.pktsts) {
+	case DWC_GRXSTS_PKTSTS_IN_XFER_COMP:
+		break;
+
+	default:
+		break;
+	}
+
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/* Wait for host channel interrupt */
+	do {
+		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+	} while (gintsts.b.hcintr == 0);
+
+	/* Read HAINT */
+	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
+
+	/* Read HCINT */
+	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+
+	/* Read HCCHAR */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+	/* Clear HCINT */
+	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
+
+	/* Clear HAINT */
+	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
+
+	/* Clear GINTSTS */
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	/* Read GINTSTS */
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+//      usleep(100000);
+//      mdelay(100);
+	dwc_mdelay(1);
+
+	/*
+	 * Send handshake packet
+	 */
+
+	/* Read HAINT */
+	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
+
+	/* Read HCINT */
+	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+
+	/* Read HCCHAR */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+	/* Clear HCINT */
+	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
+
+	/* Clear HAINT */
+	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
+
+	/* Clear GINTSTS */
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	/* Read GINTSTS */
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/* Make sure channel is disabled */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	if (hcchar.b.chen) {
+		hcchar.b.chdis = 1;
+		hcchar.b.chen = 1;
+		DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+		//sleep(1);
+		dwc_mdelay(1000);
+
+		/* Read GINTSTS */
+		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+		/* Read HAINT */
+		haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
+
+		/* Read HCINT */
+		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+
+		/* Read HCCHAR */
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+		/* Clear HCINT */
+		DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
+
+		/* Clear HAINT */
+		DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
+
+		/* Clear GINTSTS */
+		DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	}
+
+	/* Set HCTSIZ */
+	hctsiz.d32 = 0;
+	hctsiz.b.xfersize = 0;
+	hctsiz.b.pktcnt = 1;
+	hctsiz.b.pid = DWC_OTG_HC_PID_DATA1;
+	DWC_WRITE_REG32(&hc_regs->hctsiz, hctsiz.d32);
+
+	/* Set HCCHAR */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	hcchar.b.eptype = DWC_OTG_EP_TYPE_CONTROL;
+	hcchar.b.epdir = 0;
+	hcchar.b.epnum = 0;
+	hcchar.b.mps = 8;
+	hcchar.b.chen = 1;
+	DWC_WRITE_REG32(&hc_regs->hcchar, hcchar.d32);
+
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+
+	/* Wait for host channel interrupt */
+	do {
+		gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+	} while (gintsts.b.hcintr == 0);
+
+	/* Disable HCINTs */
+	DWC_WRITE_REG32(&hc_regs->hcintmsk, 0x0000);
+
+	/* Disable HAINTs */
+	DWC_WRITE_REG32(&hc_global_regs->haintmsk, 0x0000);
+
+	/* Read HAINT */
+	haint.d32 = DWC_READ_REG32(&hc_global_regs->haint);
+
+	/* Read HCINT */
+	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+
+	/* Read HCCHAR */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+
+	/* Clear HCINT */
+	DWC_WRITE_REG32(&hc_regs->hcint, hcint.d32);
+
+	/* Clear HAINT */
+	DWC_WRITE_REG32(&hc_global_regs->haint, haint.d32);
+
+	/* Clear GINTSTS */
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	/* Read GINTSTS */
+	gintsts.d32 = DWC_READ_REG32(&global_regs->gintsts);
+}
+#endif
+
+/** Handles hub class-specific requests. */
+int dwc_otg_hcd_hub_control(dwc_otg_hcd_t * dwc_otg_hcd,
+			    uint16_t typeReq,
+			    uint16_t wValue,
+			    uint16_t wIndex, uint8_t * buf, uint16_t wLength)
+{
+	int retval = 0;
+
+	dwc_otg_core_if_t *core_if = dwc_otg_hcd->core_if;
+	usb_hub_descriptor_t *hub_desc;
+	hprt0_data_t hprt0 = {.d32 = 0 };
+
+	uint32_t port_status;
+
+	switch (typeReq) {
+	case UCR_CLEAR_HUB_FEATURE:
+		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+			    "ClearHubFeature 0x%x\n", wValue);
+		switch (wValue) {
+		case UHF_C_HUB_LOCAL_POWER:
+		case UHF_C_HUB_OVER_CURRENT:
+			/* Nothing required here */
+			break;
+		default:
+			retval = -DWC_E_INVALID;
+			DWC_ERROR("DWC OTG HCD - "
+				  "ClearHubFeature request %xh unknown\n",
+				  wValue);
+		}
+		break;
+	case UCR_CLEAR_PORT_FEATURE:
+#ifdef CONFIG_USB_DWC_OTG_LPM
+		if (wValue != UHF_PORT_L1)
+#endif
+			if (!wIndex || wIndex > 1)
+				goto error;
+
+		switch (wValue) {
+		case UHF_PORT_ENABLE:
+			DWC_DEBUGPL(DBG_ANY, "DWC OTG HCD HUB CONTROL - "
+				    "ClearPortFeature USB_PORT_FEAT_ENABLE\n");
+			hprt0.d32 = dwc_otg_read_hprt0(core_if);
+			hprt0.b.prtena = 1;
+			DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+			break;
+		case UHF_PORT_SUSPEND:
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "ClearPortFeature USB_PORT_FEAT_SUSPEND\n");
+
+			if (core_if->power_down == 2) {
+				dwc_otg_host_hibernation_restore(core_if, 0, 0);
+			} else {
+				DWC_WRITE_REG32(core_if->pcgcctl, 0);
+				dwc_mdelay(5);
+
+				hprt0.d32 = dwc_otg_read_hprt0(core_if);
+				hprt0.b.prtres = 1;
+				DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+				hprt0.b.prtsusp = 0;
+				/* Clear Resume bit */
+				dwc_mdelay(100);
+				hprt0.b.prtres = 0;
+				DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+			}
+			break;
+#ifdef CONFIG_USB_DWC_OTG_LPM
+		case UHF_PORT_L1:
+			{
+				pcgcctl_data_t pcgcctl = {.d32 = 0 };
+				glpmcfg_data_t lpmcfg = {.d32 = 0 };
+
+				lpmcfg.d32 =
+				    DWC_READ_REG32(&core_if->
+						   core_global_regs->glpmcfg);
+				lpmcfg.b.en_utmi_sleep = 0;
+				lpmcfg.b.hird_thres &= (~(1 << 4));
+				lpmcfg.b.prt_sleep_sts = 1;
+				DWC_WRITE_REG32(&core_if->
+						core_global_regs->glpmcfg,
+						lpmcfg.d32);
+
+				/* Clear Enbl_L1Gating bit. */
+				pcgcctl.b.enbl_sleep_gating = 1;
+				DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32,
+						 0);
+
+				dwc_mdelay(5);
+
+				hprt0.d32 = dwc_otg_read_hprt0(core_if);
+				hprt0.b.prtres = 1;
+				DWC_WRITE_REG32(core_if->host_if->hprt0,
+						hprt0.d32);
+				/* This bit will be cleared in wakeup interrupt handle */
+				break;
+			}
+#endif
+		case UHF_PORT_POWER:
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "ClearPortFeature USB_PORT_FEAT_POWER\n");
+			hprt0.d32 = dwc_otg_read_hprt0(core_if);
+			hprt0.b.prtpwr = 0;
+			DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+			break;
+		case UHF_PORT_INDICATOR:
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "ClearPortFeature USB_PORT_FEAT_INDICATOR\n");
+			/* Port inidicator not supported */
+			break;
+		case UHF_C_PORT_CONNECTION:
+			/* Clears drivers internal connect status change
+			 * flag */
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "ClearPortFeature USB_PORT_FEAT_C_CONNECTION\n");
+			dwc_otg_hcd->flags.b.port_connect_status_change = 0;
+			break;
+		case UHF_C_PORT_RESET:
+			/* Clears the driver's internal Port Reset Change
+			 * flag */
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "ClearPortFeature USB_PORT_FEAT_C_RESET\n");
+			dwc_otg_hcd->flags.b.port_reset_change = 0;
+			break;
+		case UHF_C_PORT_ENABLE:
+			/* Clears the driver's internal Port
+			 * Enable/Disable Change flag */
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "ClearPortFeature USB_PORT_FEAT_C_ENABLE\n");
+			dwc_otg_hcd->flags.b.port_enable_change = 0;
+			break;
+		case UHF_C_PORT_SUSPEND:
+			/* Clears the driver's internal Port Suspend
+			 * Change flag, which is set when resume signaling on
+			 * the host port is complete */
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "ClearPortFeature USB_PORT_FEAT_C_SUSPEND\n");
+			dwc_otg_hcd->flags.b.port_suspend_change = 0;
+			break;
+#ifdef CONFIG_USB_DWC_OTG_LPM
+		case UHF_C_PORT_L1:
+			dwc_otg_hcd->flags.b.port_l1_change = 0;
+			break;
+#endif
+		case UHF_C_PORT_OVER_CURRENT:
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "ClearPortFeature USB_PORT_FEAT_C_OVER_CURRENT\n");
+			dwc_otg_hcd->flags.b.port_over_current_change = 0;
+			break;
+		default:
+			retval = -DWC_E_INVALID;
+			DWC_ERROR("DWC OTG HCD - "
+				  "ClearPortFeature request %xh "
+				  "unknown or unsupported\n", wValue);
+		}
+		break;
+	case UCR_GET_HUB_DESCRIPTOR:
+		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+			    "GetHubDescriptor\n");
+		hub_desc = (usb_hub_descriptor_t *) buf;
+		hub_desc->bDescLength = 9;
+		hub_desc->bDescriptorType = 0x29;
+		hub_desc->bNbrPorts = 1;
+		USETW(hub_desc->wHubCharacteristics, 0x08);
+		hub_desc->bPwrOn2PwrGood = 1;
+		hub_desc->bHubContrCurrent = 0;
+		hub_desc->DeviceRemovable[0] = 0;
+		hub_desc->DeviceRemovable[1] = 0xff;
+		break;
+	case UCR_GET_HUB_STATUS:
+		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+			    "GetHubStatus\n");
+		DWC_MEMSET(buf, 0, 4);
+		break;
+	case UCR_GET_PORT_STATUS:
+		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+			    "GetPortStatus wIndex = 0x%04x FLAGS=0x%08x\n",
+			    wIndex, dwc_otg_hcd->flags.d32);
+		if (!wIndex || wIndex > 1)
+			goto error;
+
+		port_status = 0;
+
+		if (dwc_otg_hcd->flags.b.port_connect_status_change)
+			port_status |= (1 << UHF_C_PORT_CONNECTION);
+
+		if (dwc_otg_hcd->flags.b.port_enable_change)
+			port_status |= (1 << UHF_C_PORT_ENABLE);
+
+		if (dwc_otg_hcd->flags.b.port_suspend_change)
+			port_status |= (1 << UHF_C_PORT_SUSPEND);
+
+		if (dwc_otg_hcd->flags.b.port_l1_change)
+			port_status |= (1 << UHF_C_PORT_L1);
+
+		if (dwc_otg_hcd->flags.b.port_reset_change) {
+			port_status |= (1 << UHF_C_PORT_RESET);
+		}
+
+		if (dwc_otg_hcd->flags.b.port_over_current_change) {
+			DWC_WARN("Overcurrent change detected\n");
+			port_status |= (1 << UHF_C_PORT_OVER_CURRENT);
+		}
+
+		if (!dwc_otg_hcd->flags.b.port_connect_status) {
+			/*
+			 * The port is disconnected, which means the core is
+			 * either in device mode or it soon will be. Just
+			 * return 0's for the remainder of the port status
+			 * since the port register can't be read if the core
+			 * is in device mode.
+			 */
+			*((__le32 *) buf) = dwc_cpu_to_le32(&port_status);
+			break;
+		}
+
+		hprt0.d32 = DWC_READ_REG32(core_if->host_if->hprt0);
+		DWC_DEBUGPL(DBG_HCDV, "  HPRT0: 0x%08x\n", hprt0.d32);
+
+		if (hprt0.b.prtconnsts)
+			port_status |= (1 << UHF_PORT_CONNECTION);
+
+		if (hprt0.b.prtena)
+			port_status |= (1 << UHF_PORT_ENABLE);
+
+		if (hprt0.b.prtsusp)
+			port_status |= (1 << UHF_PORT_SUSPEND);
+
+		if (hprt0.b.prtovrcurract)
+			port_status |= (1 << UHF_PORT_OVER_CURRENT);
+
+		if (hprt0.b.prtrst)
+			port_status |= (1 << UHF_PORT_RESET);
+
+		if (hprt0.b.prtpwr)
+			port_status |= (1 << UHF_PORT_POWER);
+
+		if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_HIGH_SPEED)
+			port_status |= (1 << UHF_PORT_HIGH_SPEED);
+		else if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_LOW_SPEED)
+			port_status |= (1 << UHF_PORT_LOW_SPEED);
+
+		if (hprt0.b.prttstctl)
+			port_status |= (1 << UHF_PORT_TEST);
+		if (dwc_otg_get_lpm_portsleepstatus(dwc_otg_hcd->core_if)) {
+			port_status |= (1 << UHF_PORT_L1);
+		}
+		/*
+		   For Synopsys HW emulation of Power down wkup_control asserts the
+		   hreset_n and prst_n on suspned. This causes the HPRT0 to be zero.
+		   We intentionally tell the software that port is in L2Suspend state.
+		   Only for STE.
+		*/
+		if ((core_if->power_down == 2)
+		    && (core_if->hibernation_suspend == 1)) {
+			port_status |= (1 << UHF_PORT_SUSPEND);
+		}
+		/* USB_PORT_FEAT_INDICATOR unsupported always 0 */
+
+		*((__le32 *) buf) = dwc_cpu_to_le32(&port_status);
+
+		break;
+	case UCR_SET_HUB_FEATURE:
+		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+			    "SetHubFeature\n");
+		/* No HUB features supported */
+		break;
+	case UCR_SET_PORT_FEATURE:
+		if (wValue != UHF_PORT_TEST && (!wIndex || wIndex > 1))
+			goto error;
+
+		if (!dwc_otg_hcd->flags.b.port_connect_status) {
+			/*
+			 * The port is disconnected, which means the core is
+			 * either in device mode or it soon will be. Just
+			 * return without doing anything since the port
+			 * register can't be written if the core is in device
+			 * mode.
+			 */
+			break;
+		}
+
+		switch (wValue) {
+		case UHF_PORT_SUSPEND:
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "SetPortFeature - USB_PORT_FEAT_SUSPEND\n");
+			if (dwc_otg_hcd_otg_port(dwc_otg_hcd) != wIndex) {
+				goto error;
+			}
+			if (core_if->power_down == 2) {
+				int timeout = 300;
+				dwc_irqflags_t flags;
+				pcgcctl_data_t pcgcctl = {.d32 = 0 };
+				gpwrdn_data_t gpwrdn = {.d32 = 0 };
+				gusbcfg_data_t gusbcfg = {.d32 = 0 };
+#ifdef DWC_DEV_SRPCAP
+				int32_t otg_cap_param = core_if->core_params->otg_cap;
+#endif
+				DWC_PRINTF("Preparing for complete power-off\n");
+
+				/* Save registers before hibernation */
+				dwc_otg_save_global_regs(core_if);
+				dwc_otg_save_host_regs(core_if);
+
+				hprt0.d32 = dwc_otg_read_hprt0(core_if);
+				hprt0.b.prtsusp = 1;
+				hprt0.b.prtena = 0;
+				DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+				/* Spin hprt0.b.prtsusp to became 1 */
+				do {
+					hprt0.d32 = dwc_otg_read_hprt0(core_if);
+					if (hprt0.b.prtsusp) {
+						break;
+					}
+					dwc_mdelay(1);
+				} while (--timeout);
+				if (!timeout) {
+					DWC_WARN("Suspend wasn't genereted\n");
+				}
+				dwc_udelay(10);
+
+				/*
+				 * We need to disable interrupts to prevent servicing of any IRQ
+				 * during going to hibernation
+				 */
+				DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
+				core_if->lx_state = DWC_OTG_L2;
+#ifdef DWC_DEV_SRPCAP
+				hprt0.d32 = dwc_otg_read_hprt0(core_if);
+				hprt0.b.prtpwr = 0;
+				hprt0.b.prtena = 0;
+				DWC_WRITE_REG32(core_if->host_if->hprt0,
+						hprt0.d32);
+#endif
+				gusbcfg.d32 =
+				    DWC_READ_REG32(&core_if->core_global_regs->
+						   gusbcfg);
+				if (gusbcfg.b.ulpi_utmi_sel == 1) {
+					/* ULPI interface */
+					/* Suspend the Phy Clock */
+					pcgcctl.d32 = 0;
+					pcgcctl.b.stoppclk = 1;
+					DWC_MODIFY_REG32(core_if->pcgcctl, 0,
+							 pcgcctl.d32);
+					dwc_udelay(10);
+					gpwrdn.b.pmuactv = 1;
+					DWC_MODIFY_REG32(&core_if->
+							 core_global_regs->
+							 gpwrdn, 0, gpwrdn.d32);
+				} else {
+					/* UTMI+ Interface */
+					gpwrdn.b.pmuactv = 1;
+					DWC_MODIFY_REG32(&core_if->
+							 core_global_regs->
+							 gpwrdn, 0, gpwrdn.d32);
+					dwc_udelay(10);
+					pcgcctl.b.stoppclk = 1;
+					DWC_MODIFY_REG32(core_if->pcgcctl, 0, pcgcctl.d32);
+					dwc_udelay(10);
+				}
+#ifdef DWC_DEV_SRPCAP
+				gpwrdn.d32 = 0;
+				gpwrdn.b.dis_vbus = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+#endif
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pmuintsel = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+				dwc_udelay(10);
+
+				gpwrdn.d32 = 0;
+#ifdef DWC_DEV_SRPCAP
+				gpwrdn.b.srp_det_msk = 1;
+#endif
+				gpwrdn.b.disconn_det_msk = 1;
+				gpwrdn.b.lnstchng_msk = 1;
+				gpwrdn.b.sts_chngint_msk = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+				dwc_udelay(10);
+
+				/* Enable Power Down Clamp and all interrupts in GPWRDN */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pwrdnclmp = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+				dwc_udelay(10);
+
+				/* Switch off VDD */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pwrdnswtch = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+
+#ifdef DWC_DEV_SRPCAP
+				if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE)
+				{
+					core_if->pwron_timer_started = 1;
+					DWC_TIMER_SCHEDULE(core_if->pwron_timer, 6000 /* 6 secs */ );
+				}
+#endif
+				/* Save gpwrdn register for further usage if stschng interrupt */
+				core_if->gr_backup->gpwrdn_local =
+						DWC_READ_REG32(&core_if->core_global_regs->gpwrdn);
+
+				/* Set flag to indicate that we are in hibernation */
+				core_if->hibernation_suspend = 1;
+				DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock,flags);
+
+				DWC_PRINTF("Host hibernation completed\n");
+				// Exit from case statement
+				break;
+
+			}
+			if (dwc_otg_hcd_otg_port(dwc_otg_hcd) == wIndex &&
+			    dwc_otg_hcd->fops->get_b_hnp_enable(dwc_otg_hcd)) {
+				gotgctl_data_t gotgctl = {.d32 = 0 };
+				gotgctl.b.hstsethnpen = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gotgctl, 0, gotgctl.d32);
+				core_if->op_state = A_SUSPEND;
+			}
+			hprt0.d32 = dwc_otg_read_hprt0(core_if);
+			hprt0.b.prtsusp = 1;
+			DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+			{
+				dwc_irqflags_t flags;
+				/* Update lx_state */
+				DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
+				core_if->lx_state = DWC_OTG_L2;
+				DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, flags);
+			}
+			/* Suspend the Phy Clock */
+			{
+				pcgcctl_data_t pcgcctl = {.d32 = 0 };
+				pcgcctl.b.stoppclk = 1;
+				DWC_MODIFY_REG32(core_if->pcgcctl, 0,
+						 pcgcctl.d32);
+				dwc_udelay(10);
+			}
+
+			/* For HNP the bus must be suspended for at least 200ms. */
+			if (dwc_otg_hcd->fops->get_b_hnp_enable(dwc_otg_hcd)) {
+				pcgcctl_data_t pcgcctl = {.d32 = 0 };
+				pcgcctl.b.stoppclk = 1;
+                DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
+				dwc_mdelay(200);
+			}
+
+			/** @todo - check how sw can wait for 1 sec to check asesvld??? */
+#if 0 //vahrama !!!!!!!!!!!!!!!!!!
+			if (core_if->adp_enable) {
+				gotgctl_data_t gotgctl = {.d32 = 0 };
+				gpwrdn_data_t gpwrdn;
+
+				while (gotgctl.b.asesvld == 1) {
+					gotgctl.d32 =
+					    DWC_READ_REG32(&core_if->
+							   core_global_regs->
+							   gotgctl);
+					dwc_mdelay(100);
+				}
+
+				/* Enable Power Down Logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pmuactv = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+
+				/* Unmask SRP detected interrupt from Power Down Logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.srp_det_msk = 1;
+				DWC_MODIFY_REG32(&core_if->core_global_regs->
+						 gpwrdn, 0, gpwrdn.d32);
+
+				dwc_otg_adp_probe_start(core_if);
+			}
+#endif
+			break;
+		case UHF_PORT_POWER:
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "SetPortFeature - USB_PORT_FEAT_POWER\n");
+			hprt0.d32 = dwc_otg_read_hprt0(core_if);
+			hprt0.b.prtpwr = 1;
+			DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+			break;
+		case UHF_PORT_RESET:
+			if ((core_if->power_down == 2)
+			    && (core_if->hibernation_suspend == 1)) {
+				/* If we are going to exit from Hibernated
+				 * state via USB RESET.
+				 */
+				dwc_otg_host_hibernation_restore(core_if, 0, 1);
+			} else {
+				hprt0.d32 = dwc_otg_read_hprt0(core_if);
+
+				DWC_DEBUGPL(DBG_HCD,
+					    "DWC OTG HCD HUB CONTROL - "
+					    "SetPortFeature - USB_PORT_FEAT_RESET\n");
+				{
+					pcgcctl_data_t pcgcctl = {.d32 = 0 };
+					pcgcctl.b.enbl_sleep_gating = 1;
+					pcgcctl.b.stoppclk = 1;
+					DWC_MODIFY_REG32(core_if->pcgcctl, pcgcctl.d32, 0);
+					DWC_WRITE_REG32(core_if->pcgcctl, 0);
+				}
+#ifdef CONFIG_USB_DWC_OTG_LPM
+				{
+					glpmcfg_data_t lpmcfg;
+					lpmcfg.d32 =
+						DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+					if (lpmcfg.b.prt_sleep_sts) {
+						lpmcfg.b.en_utmi_sleep = 0;
+						lpmcfg.b.hird_thres &= (~(1 << 4));
+						DWC_WRITE_REG32
+						    (&core_if->core_global_regs->glpmcfg,
+						     lpmcfg.d32);
+						dwc_mdelay(1);
+					}
+				}
+#endif
+				hprt0.d32 = dwc_otg_read_hprt0(core_if);
+				/* Clear suspend bit if resetting from suspended state. */
+				hprt0.b.prtsusp = 0;
+				/* When B-Host the Port reset bit is set in
+				 * the Start HCD Callback function, so that
+				 * the reset is started within 1ms of the HNP
+				 * success interrupt. */
+				if (!dwc_otg_hcd_is_b_host(dwc_otg_hcd)) {
+					hprt0.b.prtpwr = 1;
+					hprt0.b.prtrst = 1;
+					DWC_PRINTF("Indeed it is in host mode hprt0 = %08x\n",hprt0.d32);
+					DWC_WRITE_REG32(core_if->host_if->hprt0,
+							hprt0.d32);
+				}
+				/* Clear reset bit in 10ms (FS/LS) or 50ms (HS) */
+				dwc_mdelay(60);
+				hprt0.b.prtrst = 0;
+				DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+				core_if->lx_state = DWC_OTG_L0;	/* Now back to the on state */
+			}
+			break;
+#ifdef DWC_HS_ELECT_TST
+		case UHF_PORT_TEST:
+			{
+				uint32_t t;
+				gintmsk_data_t gintmsk;
+
+				t = (wIndex >> 8);	/* MSB wIndex USB */
+				DWC_DEBUGPL(DBG_HCD,
+					    "DWC OTG HCD HUB CONTROL - "
+					    "SetPortFeature - USB_PORT_FEAT_TEST %d\n",
+					    t);
+				DWC_WARN("USB_PORT_FEAT_TEST %d\n", t);
+				if (t < 6) {
+					hprt0.d32 = dwc_otg_read_hprt0(core_if);
+					hprt0.b.prttstctl = t;
+					DWC_WRITE_REG32(core_if->host_if->hprt0,
+							hprt0.d32);
+				} else {
+					/* Setup global vars with reg addresses (quick and
+					 * dirty hack, should be cleaned up)
+					 */
+					global_regs = core_if->core_global_regs;
+					hc_global_regs =
+					    core_if->host_if->host_global_regs;
+					hc_regs =
+					    (dwc_otg_hc_regs_t *) ((char *)
+								   global_regs +
+								   0x500);
+					data_fifo =
+					    (uint32_t *) ((char *)global_regs +
+							  0x1000);
+
+					if (t == 6) {	/* HS_HOST_PORT_SUSPEND_RESUME */
+						/* Save current interrupt mask */
+						gintmsk.d32 =
+						    DWC_READ_REG32
+						    (&global_regs->gintmsk);
+
+						/* Disable all interrupts while we muck with
+						 * the hardware directly
+						 */
+						DWC_WRITE_REG32(&global_regs->gintmsk, 0);
+
+						/* 15 second delay per the test spec */
+						dwc_mdelay(15000);
+
+						/* Drive suspend on the root port */
+						hprt0.d32 =
+						    dwc_otg_read_hprt0(core_if);
+						hprt0.b.prtsusp = 1;
+						hprt0.b.prtres = 0;
+						DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+
+						/* 15 second delay per the test spec */
+						dwc_mdelay(15000);
+
+						/* Drive resume on the root port */
+						hprt0.d32 =
+						    dwc_otg_read_hprt0(core_if);
+						hprt0.b.prtsusp = 0;
+						hprt0.b.prtres = 1;
+						DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+						dwc_mdelay(100);
+
+						/* Clear the resume bit */
+						hprt0.b.prtres = 0;
+						DWC_WRITE_REG32(core_if->host_if->hprt0, hprt0.d32);
+
+						/* Restore interrupts */
+						DWC_WRITE_REG32(&global_regs->gintmsk, gintmsk.d32);
+					} else if (t == 7) {	/* SINGLE_STEP_GET_DEVICE_DESCRIPTOR setup */
+						/* Save current interrupt mask */
+						gintmsk.d32 =
+						    DWC_READ_REG32
+						    (&global_regs->gintmsk);
+
+						/* Disable all interrupts while we muck with
+						 * the hardware directly
+						 */
+						DWC_WRITE_REG32(&global_regs->gintmsk, 0);
+
+						/* 15 second delay per the test spec */
+						dwc_mdelay(15000);
+
+						/* Send the Setup packet */
+						do_setup();
+
+						/* 15 second delay so nothing else happens for awhile */
+						dwc_mdelay(15000);
+
+						/* Restore interrupts */
+						DWC_WRITE_REG32(&global_regs->gintmsk, gintmsk.d32);
+					} else if (t == 8) {	/* SINGLE_STEP_GET_DEVICE_DESCRIPTOR execute */
+						/* Save current interrupt mask */
+						gintmsk.d32 =
+						    DWC_READ_REG32
+						    (&global_regs->gintmsk);
+
+						/* Disable all interrupts while we muck with
+						 * the hardware directly
+						 */
+						DWC_WRITE_REG32(&global_regs->gintmsk, 0);
+
+						/* Send the Setup packet */
+						do_setup();
+
+						/* 15 second delay so nothing else happens for awhile */
+						dwc_mdelay(15000);
+
+						/* Send the In and Ack packets */
+						do_in_ack();
+
+						/* 15 second delay so nothing else happens for awhile */
+						dwc_mdelay(15000);
+
+						/* Restore interrupts */
+						DWC_WRITE_REG32(&global_regs->gintmsk, gintmsk.d32);
+					}
+				}
+				break;
+			}
+#endif /* DWC_HS_ELECT_TST */
+
+		case UHF_PORT_INDICATOR:
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB CONTROL - "
+				    "SetPortFeature - USB_PORT_FEAT_INDICATOR\n");
+			/* Not supported */
+			break;
+		default:
+			retval = -DWC_E_INVALID;
+			DWC_ERROR("DWC OTG HCD - "
+				  "SetPortFeature request %xh "
+				  "unknown or unsupported\n", wValue);
+			break;
+		}
+		break;
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	case UCR_SET_AND_TEST_PORT_FEATURE:
+		if (wValue != UHF_PORT_L1) {
+			goto error;
+		}
+		{
+			int portnum, hird, devaddr, remwake;
+			glpmcfg_data_t lpmcfg;
+			uint32_t time_usecs;
+			gintsts_data_t gintsts;
+			gintmsk_data_t gintmsk;
+
+			if (!dwc_otg_get_param_lpm_enable(core_if)) {
+				goto error;
+			}
+			if (wValue != UHF_PORT_L1 || wLength != 1) {
+				goto error;
+			}
+			/* Check if the port currently is in SLEEP state */
+			lpmcfg.d32 =
+			    DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+			if (lpmcfg.b.prt_sleep_sts) {
+				DWC_INFO("Port is already in sleep mode\n");
+				buf[0] = 0;	/* Return success */
+				break;
+			}
+
+			portnum = wIndex & 0xf;
+			hird = (wIndex >> 4) & 0xf;
+			devaddr = (wIndex >> 8) & 0x7f;
+			remwake = (wIndex >> 15);
+
+			if (portnum != 1) {
+				retval = -DWC_E_INVALID;
+				DWC_WARN
+				    ("Wrong port number(%d) in SetandTestPortFeature request\n",
+				     portnum);
+				break;
+			}
+
+			DWC_PRINTF
+			    ("SetandTestPortFeature request: portnum = %d, hird = %d, devaddr = %d, rewake = %d\n",
+			     portnum, hird, devaddr, remwake);
+			/* Disable LPM interrupt */
+			gintmsk.d32 = 0;
+			gintmsk.b.lpmtranrcvd = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk,
+					 gintmsk.d32, 0);
+
+			if (dwc_otg_hcd_send_lpm
+			    (dwc_otg_hcd, devaddr, hird, remwake)) {
+				retval = -DWC_E_INVALID;
+				break;
+			}
+
+			time_usecs = 10 * (lpmcfg.b.retry_count + 1);
+			/* We will consider timeout if time_usecs microseconds pass,
+			 * and we don't receive LPM transaction status.
+			 * After receiving non-error responce(ACK/NYET/STALL) from device,
+			 *  core will set lpmtranrcvd bit.
+			 */
+			do {
+				gintsts.d32 =
+				    DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+				if (gintsts.b.lpmtranrcvd) {
+					break;
+				}
+				dwc_udelay(1);
+			} while (--time_usecs);
+			/* lpm_int bit will be cleared in LPM interrupt handler */
+
+			/* Now fill status
+			 * 0x00 - Success
+			 * 0x10 - NYET
+			 * 0x11 - Timeout
+			 */
+			if (!gintsts.b.lpmtranrcvd) {
+				buf[0] = 0x3;	/* Completion code is Timeout */
+				dwc_otg_hcd_free_hc_from_lpm(dwc_otg_hcd);
+			} else {
+				lpmcfg.d32 =
+				    DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+				if (lpmcfg.b.lpm_resp == 0x3) {
+					/* ACK responce from the device */
+					buf[0] = 0x00;	/* Success */
+				} else if (lpmcfg.b.lpm_resp == 0x2) {
+					/* NYET responce from the device */
+					buf[0] = 0x2;
+				} else {
+					/* Otherwise responce with Timeout */
+					buf[0] = 0x3;
+				}
+			}
+			DWC_PRINTF("Device responce to LPM trans is %x\n",
+				   lpmcfg.b.lpm_resp);
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, 0,
+					 gintmsk.d32);
+
+			break;
+		}
+#endif /* CONFIG_USB_DWC_OTG_LPM */
+	default:
+error:
+		retval = -DWC_E_INVALID;
+		DWC_WARN("DWC OTG HCD - "
+			 "Unknown hub control request type or invalid typeReq: %xh wIndex: %xh wValue: %xh\n",
+			 typeReq, wIndex, wValue);
+		break;
+	}
+
+	return retval;
+}
+
+#ifdef CONFIG_USB_DWC_OTG_LPM
+/** Returns index of host channel to perform LPM transaction. */
+int dwc_otg_hcd_get_hc_for_lpm_tran(dwc_otg_hcd_t * hcd, uint8_t devaddr)
+{
+	dwc_otg_core_if_t *core_if = hcd->core_if;
+	dwc_hc_t *hc;
+	hcchar_data_t hcchar;
+	gintmsk_data_t gintmsk = {.d32 = 0 };
+
+	if (DWC_CIRCLEQ_EMPTY(&hcd->free_hc_list)) {
+		DWC_PRINTF("No free channel to select for LPM transaction\n");
+		return -1;
+	}
+
+	hc = DWC_CIRCLEQ_FIRST(&hcd->free_hc_list);
+
+	/* Mask host channel interrupts. */
+	gintmsk.b.hcintr = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, gintmsk.d32, 0);
+
+	/* Fill fields that core needs for LPM transaction */
+	hcchar.b.devaddr = devaddr;
+	hcchar.b.epnum = 0;
+	hcchar.b.eptype = DWC_OTG_EP_TYPE_CONTROL;
+	hcchar.b.mps = 64;
+	hcchar.b.lspddev = (hc->speed == DWC_OTG_EP_SPEED_LOW);
+	hcchar.b.epdir = 0;	/* OUT */
+	DWC_WRITE_REG32(&core_if->host_if->hc_regs[hc->hc_num]->hcchar,
+			hcchar.d32);
+
+	/* Remove the host channel from the free list. */
+	DWC_CIRCLEQ_REMOVE_INIT(&hcd->free_hc_list, hc, hc_list_entry);
+
+	DWC_PRINTF("hcnum = %d devaddr = %d\n", hc->hc_num, devaddr);
+
+	return hc->hc_num;
+}
+
+/** Release hc after performing LPM transaction */
+void dwc_otg_hcd_free_hc_from_lpm(dwc_otg_hcd_t * hcd)
+{
+	dwc_hc_t *hc;
+	glpmcfg_data_t lpmcfg;
+	uint8_t hc_num;
+
+	lpmcfg.d32 = DWC_READ_REG32(&hcd->core_if->core_global_regs->glpmcfg);
+	hc_num = lpmcfg.b.lpm_chan_index;
+
+	hc = hcd->hc_ptr_array[hc_num];
+
+	DWC_PRINTF("Freeing channel %d after LPM\n", hc_num);
+	/* Return host channel to free list */
+	DWC_CIRCLEQ_INSERT_TAIL(&hcd->free_hc_list, hc, hc_list_entry);
+}
+
+int dwc_otg_hcd_send_lpm(dwc_otg_hcd_t * hcd, uint8_t devaddr, uint8_t hird,
+			 uint8_t bRemoteWake)
+{
+	glpmcfg_data_t lpmcfg;
+	pcgcctl_data_t pcgcctl = {.d32 = 0 };
+	int channel;
+
+	channel = dwc_otg_hcd_get_hc_for_lpm_tran(hcd, devaddr);
+	if (channel < 0) {
+		return channel;
+	}
+
+	pcgcctl.b.enbl_sleep_gating = 1;
+	DWC_MODIFY_REG32(hcd->core_if->pcgcctl, 0, pcgcctl.d32);
+
+	/* Read LPM config register */
+	lpmcfg.d32 = DWC_READ_REG32(&hcd->core_if->core_global_regs->glpmcfg);
+
+	/* Program LPM transaction fields */
+	lpmcfg.b.rem_wkup_en = bRemoteWake;
+	lpmcfg.b.hird = hird;
+	lpmcfg.b.hird_thres = 0x1c;
+	lpmcfg.b.lpm_chan_index = channel;
+	lpmcfg.b.en_utmi_sleep = 1;
+	/* Program LPM config register */
+	DWC_WRITE_REG32(&hcd->core_if->core_global_regs->glpmcfg, lpmcfg.d32);
+
+	/* Send LPM transaction */
+	lpmcfg.b.send_lpm = 1;
+	DWC_WRITE_REG32(&hcd->core_if->core_global_regs->glpmcfg, lpmcfg.d32);
+
+	return 0;
+}
+
+#endif /* CONFIG_USB_DWC_OTG_LPM */
+
+int dwc_otg_hcd_is_status_changed(dwc_otg_hcd_t * hcd, int port)
+{
+	int retval;
+
+	if (port != 1) {
+		return -DWC_E_INVALID;
+	}
+
+	retval = (hcd->flags.b.port_connect_status_change ||
+		  hcd->flags.b.port_reset_change ||
+		  hcd->flags.b.port_enable_change ||
+		  hcd->flags.b.port_suspend_change ||
+		  hcd->flags.b.port_over_current_change);
+#ifdef DEBUG
+	if (retval) {
+		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD HUB STATUS DATA:"
+			    " Root port status changed\n");
+		DWC_DEBUGPL(DBG_HCDV, "  port_connect_status_change: %d\n",
+			    hcd->flags.b.port_connect_status_change);
+		DWC_DEBUGPL(DBG_HCDV, "  port_reset_change: %d\n",
+			    hcd->flags.b.port_reset_change);
+		DWC_DEBUGPL(DBG_HCDV, "  port_enable_change: %d\n",
+			    hcd->flags.b.port_enable_change);
+		DWC_DEBUGPL(DBG_HCDV, "  port_suspend_change: %d\n",
+			    hcd->flags.b.port_suspend_change);
+		DWC_DEBUGPL(DBG_HCDV, "  port_over_current_change: %d\n",
+			    hcd->flags.b.port_over_current_change);
+	}
+#endif
+	return retval;
+}
+
+int dwc_otg_hcd_get_frame_number(dwc_otg_hcd_t * dwc_otg_hcd)
+{
+	hfnum_data_t hfnum;
+	hfnum.d32 =
+	    DWC_READ_REG32(&dwc_otg_hcd->core_if->host_if->host_global_regs->
+			   hfnum);
+
+#ifdef DEBUG_SOF
+	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD GET FRAME NUMBER %d\n",
+		    hfnum.b.frnum);
+#endif
+	return hfnum.b.frnum;
+}
+
+int dwc_otg_hcd_start(dwc_otg_hcd_t * hcd,
+		      struct dwc_otg_hcd_function_ops *fops)
+{
+	int retval = 0;
+
+	hcd->fops = fops;
+	if (!dwc_otg_is_device_mode(hcd->core_if) &&
+		(!hcd->core_if->adp_enable || hcd->core_if->adp.adp_started)) {
+		dwc_otg_hcd_reinit(hcd);
+	} else {
+		retval = -DWC_E_NO_DEVICE;
+	}
+
+	return retval;
+}
+
+void *dwc_otg_hcd_get_priv_data(dwc_otg_hcd_t * hcd)
+{
+	return hcd->priv;
+}
+
+void dwc_otg_hcd_set_priv_data(dwc_otg_hcd_t * hcd, void *priv_data)
+{
+	hcd->priv = priv_data;
+}
+
+uint32_t dwc_otg_hcd_otg_port(dwc_otg_hcd_t * hcd)
+{
+	return hcd->otg_port;
+}
+
+uint32_t dwc_otg_hcd_is_b_host(dwc_otg_hcd_t * hcd)
+{
+	uint32_t is_b_host;
+	if (hcd->core_if->op_state == B_HOST) {
+		is_b_host = 1;
+	} else {
+		is_b_host = 0;
+	}
+
+	return is_b_host;
+}
+
+dwc_otg_hcd_urb_t *dwc_otg_hcd_urb_alloc(dwc_otg_hcd_t * hcd,
+					 int iso_desc_count, int atomic_alloc)
+{
+	dwc_otg_hcd_urb_t *dwc_otg_urb;
+	uint32_t size;
+
+	size =
+	    sizeof(*dwc_otg_urb) +
+	    iso_desc_count * sizeof(struct dwc_otg_hcd_iso_packet_desc);
+	if (atomic_alloc)
+		dwc_otg_urb = DWC_ALLOC_ATOMIC(size);
+	else
+		dwc_otg_urb = DWC_ALLOC(size);
+
+        if (dwc_otg_urb)
+		dwc_otg_urb->packet_count = iso_desc_count;
+        else {
+		DWC_ERROR("**** DWC OTG HCD URB alloc - "
+			"%salloc of %db failed\n",
+			atomic_alloc?"atomic ":"", size);
+	}
+	return dwc_otg_urb;
+}
+
+void dwc_otg_hcd_urb_set_pipeinfo(dwc_otg_hcd_urb_t * dwc_otg_urb,
+				  uint8_t dev_addr, uint8_t ep_num,
+				  uint8_t ep_type, uint8_t ep_dir, uint16_t mps)
+{
+	dwc_otg_hcd_fill_pipe(&dwc_otg_urb->pipe_info, dev_addr, ep_num,
+			      ep_type, ep_dir, mps);
+#if 0
+	DWC_PRINTF
+	    ("addr = %d, ep_num = %d, ep_dir = 0x%x, ep_type = 0x%x, mps = %d\n",
+	     dev_addr, ep_num, ep_dir, ep_type, mps);
+#endif
+}
+
+void dwc_otg_hcd_urb_set_params(dwc_otg_hcd_urb_t * dwc_otg_urb,
+				void *urb_handle, void *buf, dwc_dma_t dma,
+				uint32_t buflen, void *setup_packet,
+				dwc_dma_t setup_dma, uint32_t flags,
+				uint16_t interval)
+{
+	dwc_otg_urb->priv = urb_handle;
+	dwc_otg_urb->buf = buf;
+	dwc_otg_urb->dma = dma;
+	dwc_otg_urb->length = buflen;
+	dwc_otg_urb->setup_packet = setup_packet;
+	dwc_otg_urb->setup_dma = setup_dma;
+	dwc_otg_urb->flags = flags;
+	dwc_otg_urb->interval = interval;
+	dwc_otg_urb->status = -DWC_E_IN_PROGRESS;
+}
+
+uint32_t dwc_otg_hcd_urb_get_status(dwc_otg_hcd_urb_t * dwc_otg_urb)
+{
+	return dwc_otg_urb->status;
+}
+
+uint32_t dwc_otg_hcd_urb_get_actual_length(dwc_otg_hcd_urb_t * dwc_otg_urb)
+{
+	return dwc_otg_urb->actual_length;
+}
+
+uint32_t dwc_otg_hcd_urb_get_error_count(dwc_otg_hcd_urb_t * dwc_otg_urb)
+{
+	return dwc_otg_urb->error_count;
+}
+
+void dwc_otg_hcd_urb_set_iso_desc_params(dwc_otg_hcd_urb_t * dwc_otg_urb,
+					 int desc_num, uint32_t offset,
+					 uint32_t length)
+{
+	dwc_otg_urb->iso_descs[desc_num].offset = offset;
+	dwc_otg_urb->iso_descs[desc_num].length = length;
+}
+
+uint32_t dwc_otg_hcd_urb_get_iso_desc_status(dwc_otg_hcd_urb_t * dwc_otg_urb,
+					     int desc_num)
+{
+	return dwc_otg_urb->iso_descs[desc_num].status;
+}
+
+uint32_t dwc_otg_hcd_urb_get_iso_desc_actual_length(dwc_otg_hcd_urb_t *
+						    dwc_otg_urb, int desc_num)
+{
+	return dwc_otg_urb->iso_descs[desc_num].actual_length;
+}
+
+int dwc_otg_hcd_is_bandwidth_allocated(dwc_otg_hcd_t * hcd, void *ep_handle)
+{
+	int allocated = 0;
+	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
+
+	if (qh) {
+		if (!DWC_LIST_EMPTY(&qh->qh_list_entry)) {
+			allocated = 1;
+		}
+	}
+	return allocated;
+}
+
+int dwc_otg_hcd_is_bandwidth_freed(dwc_otg_hcd_t * hcd, void *ep_handle)
+{
+	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
+	int freed = 0;
+	DWC_ASSERT(qh, "qh is not allocated\n");
+
+	if (DWC_LIST_EMPTY(&qh->qh_list_entry)) {
+		freed = 1;
+	}
+
+	return freed;
+}
+
+uint8_t dwc_otg_hcd_get_ep_bandwidth(dwc_otg_hcd_t * hcd, void *ep_handle)
+{
+	dwc_otg_qh_t *qh = (dwc_otg_qh_t *) ep_handle;
+	DWC_ASSERT(qh, "qh is not allocated\n");
+	return qh->usecs;
+}
+
+void dwc_otg_hcd_dump_state(dwc_otg_hcd_t * hcd)
+{
+#ifdef DEBUG
+	int num_channels;
+	int i;
+	gnptxsts_data_t np_tx_status;
+	hptxsts_data_t p_tx_status;
+
+	num_channels = hcd->core_if->core_params->host_channels;
+	DWC_PRINTF("\n");
+	DWC_PRINTF
+	    ("************************************************************\n");
+	DWC_PRINTF("HCD State:\n");
+	DWC_PRINTF("  Num channels: %d\n", num_channels);
+	for (i = 0; i < num_channels; i++) {
+		dwc_hc_t *hc = hcd->hc_ptr_array[i];
+		DWC_PRINTF("  Channel %d:\n", i);
+		DWC_PRINTF("    dev_addr: %d, ep_num: %d, ep_is_in: %d\n",
+			   hc->dev_addr, hc->ep_num, hc->ep_is_in);
+		DWC_PRINTF("    speed: %d\n", hc->speed);
+		DWC_PRINTF("    ep_type: %d\n", hc->ep_type);
+		DWC_PRINTF("    max_packet: %d\n", hc->max_packet);
+		DWC_PRINTF("    data_pid_start: %d\n", hc->data_pid_start);
+		DWC_PRINTF("    multi_count: %d\n", hc->multi_count);
+		DWC_PRINTF("    xfer_started: %d\n", hc->xfer_started);
+		DWC_PRINTF("    xfer_buff: %p\n", hc->xfer_buff);
+		DWC_PRINTF("    xfer_len: %d\n", hc->xfer_len);
+		DWC_PRINTF("    xfer_count: %d\n", hc->xfer_count);
+		DWC_PRINTF("    halt_on_queue: %d\n", hc->halt_on_queue);
+		DWC_PRINTF("    halt_pending: %d\n", hc->halt_pending);
+		DWC_PRINTF("    halt_status: %d\n", hc->halt_status);
+		DWC_PRINTF("    do_split: %d\n", hc->do_split);
+		DWC_PRINTF("    complete_split: %d\n", hc->complete_split);
+		DWC_PRINTF("    hub_addr: %d\n", hc->hub_addr);
+		DWC_PRINTF("    port_addr: %d\n", hc->port_addr);
+		DWC_PRINTF("    xact_pos: %d\n", hc->xact_pos);
+		DWC_PRINTF("    requests: %d\n", hc->requests);
+		DWC_PRINTF("    qh: %p\n", hc->qh);
+		if (hc->xfer_started) {
+			hfnum_data_t hfnum;
+			hcchar_data_t hcchar;
+			hctsiz_data_t hctsiz;
+			hcint_data_t hcint;
+			hcintmsk_data_t hcintmsk;
+			hfnum.d32 =
+			    DWC_READ_REG32(&hcd->core_if->
+					   host_if->host_global_regs->hfnum);
+			hcchar.d32 =
+			    DWC_READ_REG32(&hcd->core_if->host_if->
+					   hc_regs[i]->hcchar);
+			hctsiz.d32 =
+			    DWC_READ_REG32(&hcd->core_if->host_if->
+					   hc_regs[i]->hctsiz);
+			hcint.d32 =
+			    DWC_READ_REG32(&hcd->core_if->host_if->
+					   hc_regs[i]->hcint);
+			hcintmsk.d32 =
+			    DWC_READ_REG32(&hcd->core_if->host_if->
+					   hc_regs[i]->hcintmsk);
+			DWC_PRINTF("    hfnum: 0x%08x\n", hfnum.d32);
+			DWC_PRINTF("    hcchar: 0x%08x\n", hcchar.d32);
+			DWC_PRINTF("    hctsiz: 0x%08x\n", hctsiz.d32);
+			DWC_PRINTF("    hcint: 0x%08x\n", hcint.d32);
+			DWC_PRINTF("    hcintmsk: 0x%08x\n", hcintmsk.d32);
+		}
+		if (hc->xfer_started && hc->qh) {
+			dwc_otg_qtd_t *qtd;
+			dwc_otg_hcd_urb_t *urb;
+
+			DWC_CIRCLEQ_FOREACH(qtd, &hc->qh->qtd_list, qtd_list_entry) {
+				if (!qtd->in_process)
+					break;
+
+				urb = qtd->urb;
+			DWC_PRINTF("    URB Info:\n");
+			DWC_PRINTF("      qtd: %p, urb: %p\n", qtd, urb);
+			if (urb) {
+				DWC_PRINTF("      Dev: %d, EP: %d %s\n",
+					   dwc_otg_hcd_get_dev_addr(&urb->
+								    pipe_info),
+					   dwc_otg_hcd_get_ep_num(&urb->
+								  pipe_info),
+					   dwc_otg_hcd_is_pipe_in(&urb->
+								  pipe_info) ?
+					   "IN" : "OUT");
+				DWC_PRINTF("      Max packet size: %d\n",
+					   dwc_otg_hcd_get_mps(&urb->
+							       pipe_info));
+				DWC_PRINTF("      transfer_buffer: %p\n",
+					   urb->buf);
+				DWC_PRINTF("      transfer_dma: %p\n",
+					   (void *)urb->dma);
+				DWC_PRINTF("      transfer_buffer_length: %d\n",
+					   urb->length);
+					DWC_PRINTF("      actual_length: %d\n",
+						   urb->actual_length);
+				}
+			}
+		}
+	}
+	DWC_PRINTF("  non_periodic_channels: %d\n", hcd->non_periodic_channels);
+	DWC_PRINTF("  periodic_channels: %d\n", hcd->periodic_channels);
+	DWC_PRINTF("  periodic_usecs: %d\n", hcd->periodic_usecs);
+	np_tx_status.d32 =
+	    DWC_READ_REG32(&hcd->core_if->core_global_regs->gnptxsts);
+	DWC_PRINTF("  NP Tx Req Queue Space Avail: %d\n",
+		   np_tx_status.b.nptxqspcavail);
+	DWC_PRINTF("  NP Tx FIFO Space Avail: %d\n",
+		   np_tx_status.b.nptxfspcavail);
+	p_tx_status.d32 =
+	    DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hptxsts);
+	DWC_PRINTF("  P Tx Req Queue Space Avail: %d\n",
+		   p_tx_status.b.ptxqspcavail);
+	DWC_PRINTF("  P Tx FIFO Space Avail: %d\n", p_tx_status.b.ptxfspcavail);
+	dwc_otg_hcd_dump_frrem(hcd);
+	dwc_otg_dump_global_registers(hcd->core_if);
+	dwc_otg_dump_host_registers(hcd->core_if);
+	DWC_PRINTF
+	    ("************************************************************\n");
+	DWC_PRINTF("\n");
+#endif
+}
+
+#ifdef DEBUG
+void dwc_print_setup_data(uint8_t * setup)
+{
+	int i;
+	if (CHK_DEBUG_LEVEL(DBG_HCD)) {
+		DWC_PRINTF("Setup Data = MSB ");
+		for (i = 7; i >= 0; i--)
+			DWC_PRINTF("%02x ", setup[i]);
+		DWC_PRINTF("\n");
+		DWC_PRINTF("  bmRequestType Tranfer = %s\n",
+			   (setup[0] & 0x80) ? "Device-to-Host" :
+			   "Host-to-Device");
+		DWC_PRINTF("  bmRequestType Type = ");
+		switch ((setup[0] & 0x60) >> 5) {
+		case 0:
+			DWC_PRINTF("Standard\n");
+			break;
+		case 1:
+			DWC_PRINTF("Class\n");
+			break;
+		case 2:
+			DWC_PRINTF("Vendor\n");
+			break;
+		case 3:
+			DWC_PRINTF("Reserved\n");
+			break;
+		}
+		DWC_PRINTF("  bmRequestType Recipient = ");
+		switch (setup[0] & 0x1f) {
+		case 0:
+			DWC_PRINTF("Device\n");
+			break;
+		case 1:
+			DWC_PRINTF("Interface\n");
+			break;
+		case 2:
+			DWC_PRINTF("Endpoint\n");
+			break;
+		case 3:
+			DWC_PRINTF("Other\n");
+			break;
+		default:
+			DWC_PRINTF("Reserved\n");
+			break;
+		}
+		DWC_PRINTF("  bRequest = 0x%0x\n", setup[1]);
+		DWC_PRINTF("  wValue = 0x%0x\n", *((uint16_t *) & setup[2]));
+		DWC_PRINTF("  wIndex = 0x%0x\n", *((uint16_t *) & setup[4]));
+		DWC_PRINTF("  wLength = 0x%0x\n\n", *((uint16_t *) & setup[6]));
+	}
+}
+#endif
+
+void dwc_otg_hcd_dump_frrem(dwc_otg_hcd_t * hcd)
+{
+#if 0
+	DWC_PRINTF("Frame remaining at SOF:\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->frrem_samples, hcd->frrem_accum,
+		   (hcd->frrem_samples > 0) ?
+		   hcd->frrem_accum / hcd->frrem_samples : 0);
+
+	DWC_PRINTF("\n");
+	DWC_PRINTF("Frame remaining at start_transfer (uframe 7):\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->core_if->hfnum_7_samples,
+		   hcd->core_if->hfnum_7_frrem_accum,
+		   (hcd->core_if->hfnum_7_samples >
+		    0) ? hcd->core_if->hfnum_7_frrem_accum /
+		   hcd->core_if->hfnum_7_samples : 0);
+	DWC_PRINTF("Frame remaining at start_transfer (uframe 0):\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->core_if->hfnum_0_samples,
+		   hcd->core_if->hfnum_0_frrem_accum,
+		   (hcd->core_if->hfnum_0_samples >
+		    0) ? hcd->core_if->hfnum_0_frrem_accum /
+		   hcd->core_if->hfnum_0_samples : 0);
+	DWC_PRINTF("Frame remaining at start_transfer (uframe 1-6):\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->core_if->hfnum_other_samples,
+		   hcd->core_if->hfnum_other_frrem_accum,
+		   (hcd->core_if->hfnum_other_samples >
+		    0) ? hcd->core_if->hfnum_other_frrem_accum /
+		   hcd->core_if->hfnum_other_samples : 0);
+
+	DWC_PRINTF("\n");
+	DWC_PRINTF("Frame remaining at sample point A (uframe 7):\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->hfnum_7_samples_a, hcd->hfnum_7_frrem_accum_a,
+		   (hcd->hfnum_7_samples_a > 0) ?
+		   hcd->hfnum_7_frrem_accum_a / hcd->hfnum_7_samples_a : 0);
+	DWC_PRINTF("Frame remaining at sample point A (uframe 0):\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->hfnum_0_samples_a, hcd->hfnum_0_frrem_accum_a,
+		   (hcd->hfnum_0_samples_a > 0) ?
+		   hcd->hfnum_0_frrem_accum_a / hcd->hfnum_0_samples_a : 0);
+	DWC_PRINTF("Frame remaining at sample point A (uframe 1-6):\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->hfnum_other_samples_a, hcd->hfnum_other_frrem_accum_a,
+		   (hcd->hfnum_other_samples_a > 0) ?
+		   hcd->hfnum_other_frrem_accum_a /
+		   hcd->hfnum_other_samples_a : 0);
+
+	DWC_PRINTF("\n");
+	DWC_PRINTF("Frame remaining at sample point B (uframe 7):\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->hfnum_7_samples_b, hcd->hfnum_7_frrem_accum_b,
+		   (hcd->hfnum_7_samples_b > 0) ?
+		   hcd->hfnum_7_frrem_accum_b / hcd->hfnum_7_samples_b : 0);
+	DWC_PRINTF("Frame remaining at sample point B (uframe 0):\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->hfnum_0_samples_b, hcd->hfnum_0_frrem_accum_b,
+		   (hcd->hfnum_0_samples_b > 0) ?
+		   hcd->hfnum_0_frrem_accum_b / hcd->hfnum_0_samples_b : 0);
+	DWC_PRINTF("Frame remaining at sample point B (uframe 1-6):\n");
+	DWC_PRINTF("  samples %u, accum %llu, avg %llu\n",
+		   hcd->hfnum_other_samples_b, hcd->hfnum_other_frrem_accum_b,
+		   (hcd->hfnum_other_samples_b > 0) ?
+		   hcd->hfnum_other_frrem_accum_b /
+		   hcd->hfnum_other_samples_b : 0);
+#endif
+}
+
+#endif /* DWC_DEVICE_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd.h b/drivers/usb/host/dwc_otg/dwc_otg_hcd.h
new file mode 100644
index 000000000000..5ed8dccf0395
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd.h
@@ -0,0 +1,870 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd.h $
+ * $Revision: #58 $
+ * $Date: 2011/09/15 $
+ * $Change: 1846647 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_DEVICE_ONLY
+#ifndef __DWC_HCD_H__
+#define __DWC_HCD_H__
+
+#include "dwc_otg_os_dep.h"
+#include "usb.h"
+#include "dwc_otg_hcd_if.h"
+#include "dwc_otg_core_if.h"
+#include "dwc_list.h"
+#include "dwc_otg_cil.h"
+#include "dwc_otg_fiq_fsm.h"
+#include "dwc_otg_driver.h"
+
+
+/**
+ * @file
+ *
+ * This file contains the structures, constants, and interfaces for
+ * the Host Contoller Driver (HCD).
+ *
+ * The Host Controller Driver (HCD) is responsible for translating requests
+ * from the USB Driver into the appropriate actions on the DWC_otg controller.
+ * It isolates the USBD from the specifics of the controller by providing an
+ * API to the USBD.
+ */
+
+struct dwc_otg_hcd_pipe_info {
+	uint8_t dev_addr;
+	uint8_t ep_num;
+	uint8_t pipe_type;
+	uint8_t pipe_dir;
+	uint16_t mps;
+};
+
+struct dwc_otg_hcd_iso_packet_desc {
+	uint32_t offset;
+	uint32_t length;
+	uint32_t actual_length;
+	uint32_t status;
+};
+
+struct dwc_otg_qtd;
+
+struct dwc_otg_hcd_urb {
+	void *priv;
+	struct dwc_otg_qtd *qtd;
+	void *buf;
+	dwc_dma_t dma;
+	void *setup_packet;
+	dwc_dma_t setup_dma;
+	uint32_t length;
+	uint32_t actual_length;
+	uint32_t status;
+	uint32_t error_count;
+	uint32_t packet_count;
+	uint32_t flags;
+	uint16_t interval;
+	struct dwc_otg_hcd_pipe_info pipe_info;
+	struct dwc_otg_hcd_iso_packet_desc iso_descs[0];
+};
+
+static inline uint8_t dwc_otg_hcd_get_ep_num(struct dwc_otg_hcd_pipe_info *pipe)
+{
+	return pipe->ep_num;
+}
+
+static inline uint8_t dwc_otg_hcd_get_pipe_type(struct dwc_otg_hcd_pipe_info
+						*pipe)
+{
+	return pipe->pipe_type;
+}
+
+static inline uint16_t dwc_otg_hcd_get_mps(struct dwc_otg_hcd_pipe_info *pipe)
+{
+	return pipe->mps;
+}
+
+static inline uint8_t dwc_otg_hcd_get_dev_addr(struct dwc_otg_hcd_pipe_info
+					       *pipe)
+{
+	return pipe->dev_addr;
+}
+
+static inline uint8_t dwc_otg_hcd_is_pipe_isoc(struct dwc_otg_hcd_pipe_info
+					       *pipe)
+{
+	return (pipe->pipe_type == UE_ISOCHRONOUS);
+}
+
+static inline uint8_t dwc_otg_hcd_is_pipe_int(struct dwc_otg_hcd_pipe_info
+					      *pipe)
+{
+	return (pipe->pipe_type == UE_INTERRUPT);
+}
+
+static inline uint8_t dwc_otg_hcd_is_pipe_bulk(struct dwc_otg_hcd_pipe_info
+					       *pipe)
+{
+	return (pipe->pipe_type == UE_BULK);
+}
+
+static inline uint8_t dwc_otg_hcd_is_pipe_control(struct dwc_otg_hcd_pipe_info
+						  *pipe)
+{
+	return (pipe->pipe_type == UE_CONTROL);
+}
+
+static inline uint8_t dwc_otg_hcd_is_pipe_in(struct dwc_otg_hcd_pipe_info *pipe)
+{
+	return (pipe->pipe_dir == UE_DIR_IN);
+}
+
+static inline uint8_t dwc_otg_hcd_is_pipe_out(struct dwc_otg_hcd_pipe_info
+					      *pipe)
+{
+	return (!dwc_otg_hcd_is_pipe_in(pipe));
+}
+
+static inline void dwc_otg_hcd_fill_pipe(struct dwc_otg_hcd_pipe_info *pipe,
+					 uint8_t devaddr, uint8_t ep_num,
+					 uint8_t pipe_type, uint8_t pipe_dir,
+					 uint16_t mps)
+{
+	pipe->dev_addr = devaddr;
+	pipe->ep_num = ep_num;
+	pipe->pipe_type = pipe_type;
+	pipe->pipe_dir = pipe_dir;
+	pipe->mps = mps;
+}
+
+/**
+ * Phases for control transfers.
+ */
+typedef enum dwc_otg_control_phase {
+	DWC_OTG_CONTROL_SETUP,
+	DWC_OTG_CONTROL_DATA,
+	DWC_OTG_CONTROL_STATUS
+} dwc_otg_control_phase_e;
+
+/** Transaction types. */
+typedef enum dwc_otg_transaction_type {
+	DWC_OTG_TRANSACTION_NONE          = 0,
+	DWC_OTG_TRANSACTION_PERIODIC      = 1,
+	DWC_OTG_TRANSACTION_NON_PERIODIC  = 2,
+	DWC_OTG_TRANSACTION_ALL           = DWC_OTG_TRANSACTION_PERIODIC + DWC_OTG_TRANSACTION_NON_PERIODIC
+} dwc_otg_transaction_type_e;
+
+struct dwc_otg_qh;
+
+/**
+ * A Queue Transfer Descriptor (QTD) holds the state of a bulk, control,
+ * interrupt, or isochronous transfer. A single QTD is created for each URB
+ * (of one of these types) submitted to the HCD. The transfer associated with
+ * a QTD may require one or multiple transactions.
+ *
+ * A QTD is linked to a Queue Head, which is entered in either the
+ * non-periodic or periodic schedule for execution. When a QTD is chosen for
+ * execution, some or all of its transactions may be executed. After
+ * execution, the state of the QTD is updated. The QTD may be retired if all
+ * its transactions are complete or if an error occurred. Otherwise, it
+ * remains in the schedule so more transactions can be executed later.
+ */
+typedef struct dwc_otg_qtd {
+	/**
+	 * Determines the PID of the next data packet for the data phase of
+	 * control transfers. Ignored for other transfer types.<br>
+	 * One of the following values:
+	 *	- DWC_OTG_HC_PID_DATA0
+	 *	- DWC_OTG_HC_PID_DATA1
+	 */
+	uint8_t data_toggle;
+
+	/** Current phase for control transfers (Setup, Data, or Status). */
+	dwc_otg_control_phase_e control_phase;
+
+	/** Keep track of the current split type
+	 * for FS/LS endpoints on a HS Hub */
+	uint8_t complete_split;
+
+	/** How many bytes transferred during SSPLIT OUT */
+	uint32_t ssplit_out_xfer_count;
+
+	/**
+	 * Holds the number of bus errors that have occurred for a transaction
+	 * within this transfer.
+	 */
+	uint8_t error_count;
+
+	/**
+	 * Index of the next frame descriptor for an isochronous transfer. A
+	 * frame descriptor describes the buffer position and length of the
+	 * data to be transferred in the next scheduled (micro)frame of an
+	 * isochronous transfer. It also holds status for that transaction.
+	 * The frame index starts at 0.
+	 */
+	uint16_t isoc_frame_index;
+
+	/** Position of the ISOC split on full/low speed */
+	uint8_t isoc_split_pos;
+
+	/** Position of the ISOC split in the buffer for the current frame */
+	uint16_t isoc_split_offset;
+
+	/** URB for this transfer */
+	struct dwc_otg_hcd_urb *urb;
+
+	struct dwc_otg_qh *qh;
+
+	/** This list of QTDs */
+	 DWC_CIRCLEQ_ENTRY(dwc_otg_qtd) qtd_list_entry;
+
+	/** Indicates if this QTD is currently processed by HW. */
+	uint8_t in_process;
+
+	/** Number of DMA descriptors for this QTD */
+	uint8_t n_desc;
+
+	/**
+	 * Last activated frame(packet) index.
+	 * Used in Descriptor DMA mode only.
+	 */
+	uint16_t isoc_frame_index_last;
+
+} dwc_otg_qtd_t;
+
+DWC_CIRCLEQ_HEAD(dwc_otg_qtd_list, dwc_otg_qtd);
+
+/**
+ * A Queue Head (QH) holds the static characteristics of an endpoint and
+ * maintains a list of transfers (QTDs) for that endpoint. A QH structure may
+ * be entered in either the non-periodic or periodic schedule.
+ */
+typedef struct dwc_otg_qh {
+	/**
+	 * Endpoint type.
+	 * One of the following values:
+	 *	- UE_CONTROL
+	 *	- UE_BULK
+	 *	- UE_INTERRUPT
+	 *	- UE_ISOCHRONOUS
+	 */
+	uint8_t ep_type;
+	uint8_t ep_is_in;
+
+	/** wMaxPacketSize Field of Endpoint Descriptor. */
+	uint16_t maxp;
+
+	/**
+	 * Device speed.
+	 * One of the following values:
+	 *	- DWC_OTG_EP_SPEED_LOW
+	 *	- DWC_OTG_EP_SPEED_FULL
+	 *	- DWC_OTG_EP_SPEED_HIGH
+	 */
+	uint8_t dev_speed;
+
+	/**
+	 * Determines the PID of the next data packet for non-control
+	 * transfers. Ignored for control transfers.<br>
+	 * One of the following values:
+	 *	- DWC_OTG_HC_PID_DATA0
+	 *	- DWC_OTG_HC_PID_DATA1
+	 */
+	uint8_t data_toggle;
+
+	/** Ping state if 1. */
+	uint8_t ping_state;
+
+	/**
+	 * List of QTDs for this QH.
+	 */
+	struct dwc_otg_qtd_list qtd_list;
+
+	/** Host channel currently processing transfers for this QH. */
+	struct dwc_hc *channel;
+
+	/** Full/low speed endpoint on high-speed hub requires split. */
+	uint8_t do_split;
+
+	/** @name Periodic schedule information */
+	/** @{ */
+
+	/** Bandwidth in microseconds per (micro)frame. */
+	uint16_t usecs;
+
+	/** Interval between transfers in (micro)frames. */
+	uint16_t interval;
+
+	/**
+	 * (micro)frame to initialize a periodic transfer. The transfer
+	 * executes in the following (micro)frame.
+	 */
+	uint16_t sched_frame;
+
+	/*
+	** Frame a NAK was received on this queue head, used to minimise NAK retransmission
+	*/
+	uint16_t nak_frame;
+
+	/** (micro)frame at which last start split was initialized. */
+	uint16_t start_split_frame;
+
+	/** @} */
+
+	/**
+	 * Used instead of original buffer if
+	 * it(physical address) is not dword-aligned.
+	 */
+	uint8_t *dw_align_buf;
+	dwc_dma_t dw_align_buf_dma;
+
+	/** Entry for QH in either the periodic or non-periodic schedule. */
+	dwc_list_link_t qh_list_entry;
+
+	/** @name Descriptor DMA support */
+	/** @{ */
+
+	/** Descriptor List. */
+	dwc_otg_host_dma_desc_t *desc_list;
+
+	/** Descriptor List physical address. */
+	dwc_dma_t desc_list_dma;
+
+	/**
+	 * Xfer Bytes array.
+	 * Each element corresponds to a descriptor and indicates
+	 * original XferSize size value for the descriptor.
+	 */
+	uint32_t *n_bytes;
+
+	/** Actual number of transfer descriptors in a list. */
+	uint16_t ntd;
+
+	/** First activated isochronous transfer descriptor index. */
+	uint8_t td_first;
+	/** Last activated isochronous transfer descriptor index. */
+	uint8_t td_last;
+
+	/** @} */
+
+
+	uint16_t speed;
+	uint16_t frame_usecs[8];
+
+	uint32_t skip_count;
+} dwc_otg_qh_t;
+
+DWC_CIRCLEQ_HEAD(hc_list, dwc_hc);
+
+typedef struct urb_tq_entry {
+	struct urb *urb;
+	DWC_TAILQ_ENTRY(urb_tq_entry) urb_tq_entries;
+} urb_tq_entry_t;
+
+DWC_TAILQ_HEAD(urb_list, urb_tq_entry);
+
+/**
+ * This structure holds the state of the HCD, including the non-periodic and
+ * periodic schedules.
+ */
+struct dwc_otg_hcd {
+	/** The DWC otg device pointer */
+	struct dwc_otg_device *otg_dev;
+	/** DWC OTG Core Interface Layer */
+	dwc_otg_core_if_t *core_if;
+
+	/** Function HCD driver callbacks */
+	struct dwc_otg_hcd_function_ops *fops;
+
+	/** Internal DWC HCD Flags */
+	volatile union dwc_otg_hcd_internal_flags {
+		uint32_t d32;
+		struct {
+			unsigned port_connect_status_change:1;
+			unsigned port_connect_status:1;
+			unsigned port_reset_change:1;
+			unsigned port_enable_change:1;
+			unsigned port_suspend_change:1;
+			unsigned port_over_current_change:1;
+			unsigned port_l1_change:1;
+			unsigned port_speed:2;
+			unsigned reserved:24;
+		} b;
+	} flags;
+
+	/**
+	 * Inactive items in the non-periodic schedule. This is a list of
+	 * Queue Heads. Transfers associated with these Queue Heads are not
+	 * currently assigned to a host channel.
+	 */
+	dwc_list_link_t non_periodic_sched_inactive;
+
+	/**
+	 * Active items in the non-periodic schedule. This is a list of
+	 * Queue Heads. Transfers associated with these Queue Heads are
+	 * currently assigned to a host channel.
+	 */
+	dwc_list_link_t non_periodic_sched_active;
+
+	/**
+	 * Pointer to the next Queue Head to process in the active
+	 * non-periodic schedule.
+	 */
+	dwc_list_link_t *non_periodic_qh_ptr;
+
+	/**
+	 * Inactive items in the periodic schedule. This is a list of QHs for
+	 * periodic transfers that are _not_ scheduled for the next frame.
+	 * Each QH in the list has an interval counter that determines when it
+	 * needs to be scheduled for execution. This scheduling mechanism
+	 * allows only a simple calculation for periodic bandwidth used (i.e.
+	 * must assume that all periodic transfers may need to execute in the
+	 * same frame). However, it greatly simplifies scheduling and should
+	 * be sufficient for the vast majority of OTG hosts, which need to
+	 * connect to a small number of peripherals at one time.
+	 *
+	 * Items move from this list to periodic_sched_ready when the QH
+	 * interval counter is 0 at SOF.
+	 */
+	dwc_list_link_t periodic_sched_inactive;
+
+	/**
+	 * List of periodic QHs that are ready for execution in the next
+	 * frame, but have not yet been assigned to host channels.
+	 *
+	 * Items move from this list to periodic_sched_assigned as host
+	 * channels become available during the current frame.
+	 */
+	dwc_list_link_t periodic_sched_ready;
+
+	/**
+	 * List of periodic QHs to be executed in the next frame that are
+	 * assigned to host channels.
+	 *
+	 * Items move from this list to periodic_sched_queued as the
+	 * transactions for the QH are queued to the DWC_otg controller.
+	 */
+	dwc_list_link_t periodic_sched_assigned;
+
+	/**
+	 * List of periodic QHs that have been queued for execution.
+	 *
+	 * Items move from this list to either periodic_sched_inactive or
+	 * periodic_sched_ready when the channel associated with the transfer
+	 * is released. If the interval for the QH is 1, the item moves to
+	 * periodic_sched_ready because it must be rescheduled for the next
+	 * frame. Otherwise, the item moves to periodic_sched_inactive.
+	 */
+	dwc_list_link_t periodic_sched_queued;
+
+	/**
+	 * Total bandwidth claimed so far for periodic transfers. This value
+	 * is in microseconds per (micro)frame. The assumption is that all
+	 * periodic transfers may occur in the same (micro)frame.
+	 */
+	uint16_t periodic_usecs;
+
+	/**
+	 * Total bandwidth claimed so far for all periodic transfers
+	 * in a frame.
+	 * This will include a mixture of HS and FS transfers.
+	 * Units are microseconds per (micro)frame.
+	 * We have a budget per frame and have to schedule
+	 * transactions accordingly.
+	 * Watch out for the fact that things are actually scheduled for the
+	 * "next frame".
+	 */
+	uint16_t                frame_usecs[8];
+
+
+	/**
+	 * Frame number read from the core at SOF. The value ranges from 0 to
+	 * DWC_HFNUM_MAX_FRNUM.
+	 */
+	uint16_t frame_number;
+
+	/**
+	 * Count of periodic QHs, if using several eps. For SOF enable/disable.
+	 */
+	uint16_t periodic_qh_count;
+
+	/**
+	 * Free host channels in the controller. This is a list of
+	 * dwc_hc_t items.
+	 */
+	struct hc_list free_hc_list;
+	/**
+	 * Number of host channels assigned to periodic transfers. Currently
+	 * assuming that there is a dedicated host channel for each periodic
+	 * transaction and at least one host channel available for
+	 * non-periodic transactions.
+	 */
+	int periodic_channels; /* microframe_schedule==0 */
+
+	/**
+	 * Number of host channels assigned to non-periodic transfers.
+	 */
+	int non_periodic_channels; /* microframe_schedule==0 */
+
+	/**
+	 * Number of host channels assigned to non-periodic transfers.
+	 */
+	int available_host_channels;
+
+	/**
+	 * Array of pointers to the host channel descriptors. Allows accessing
+	 * a host channel descriptor given the host channel number. This is
+	 * useful in interrupt handlers.
+	 */
+	struct dwc_hc *hc_ptr_array[MAX_EPS_CHANNELS];
+
+	/**
+	 * Buffer to use for any data received during the status phase of a
+	 * control transfer. Normally no data is transferred during the status
+	 * phase. This buffer is used as a bit bucket.
+	 */
+	uint8_t *status_buf;
+
+	/**
+	 * DMA address for status_buf.
+	 */
+	dma_addr_t status_buf_dma;
+#define DWC_OTG_HCD_STATUS_BUF_SIZE 64
+
+	/**
+	 * Connection timer. An OTG host must display a message if the device
+	 * does not connect. Started when the VBus power is turned on via
+	 * sysfs attribute "buspower".
+	 */
+	dwc_timer_t *conn_timer;
+
+	/* Tasket to do a reset */
+	dwc_tasklet_t *reset_tasklet;
+
+	dwc_tasklet_t *completion_tasklet;
+	struct urb_list completed_urb_list;
+
+	/*  */
+	dwc_spinlock_t *lock;
+	/**
+	 * Private data that could be used by OS wrapper.
+	 */
+	void *priv;
+
+	uint8_t otg_port;
+
+	/** Frame List */
+	uint32_t *frame_list;
+
+	/** Hub - Port assignment */
+	int hub_port[128];
+#ifdef FIQ_DEBUG
+	int hub_port_alloc[2048];
+#endif
+
+	/** Frame List DMA address */
+	dma_addr_t frame_list_dma;
+
+	struct fiq_stack *fiq_stack;
+	struct fiq_state *fiq_state;
+
+	/** Virtual address for split transaction DMA bounce buffers */
+	struct fiq_dma_blob *fiq_dmab;
+
+#ifdef DEBUG
+	uint32_t frrem_samples;
+	uint64_t frrem_accum;
+
+	uint32_t hfnum_7_samples_a;
+	uint64_t hfnum_7_frrem_accum_a;
+	uint32_t hfnum_0_samples_a;
+	uint64_t hfnum_0_frrem_accum_a;
+	uint32_t hfnum_other_samples_a;
+	uint64_t hfnum_other_frrem_accum_a;
+
+	uint32_t hfnum_7_samples_b;
+	uint64_t hfnum_7_frrem_accum_b;
+	uint32_t hfnum_0_samples_b;
+	uint64_t hfnum_0_frrem_accum_b;
+	uint32_t hfnum_other_samples_b;
+	uint64_t hfnum_other_frrem_accum_b;
+#endif
+};
+
+static inline struct device *dwc_otg_hcd_to_dev(struct dwc_otg_hcd *hcd)
+{
+	return &hcd->otg_dev->os_dep.platformdev->dev;
+}
+
+/** @name Transaction Execution Functions */
+/** @{ */
+extern dwc_otg_transaction_type_e dwc_otg_hcd_select_transactions(dwc_otg_hcd_t
+								  * hcd);
+extern void dwc_otg_hcd_queue_transactions(dwc_otg_hcd_t * hcd,
+					   dwc_otg_transaction_type_e tr_type);
+
+int dwc_otg_hcd_allocate_port(dwc_otg_hcd_t * hcd, dwc_otg_qh_t *qh);
+void dwc_otg_hcd_release_port(dwc_otg_hcd_t * dwc_otg_hcd, dwc_otg_qh_t *qh);
+
+extern int fiq_fsm_queue_transaction(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh);
+extern int fiq_fsm_transaction_suitable(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh);
+extern void dwc_otg_cleanup_fiq_channel(dwc_otg_hcd_t *hcd, uint32_t num);
+
+/** @} */
+
+/** @name Interrupt Handler Functions */
+/** @{ */
+extern int32_t dwc_otg_hcd_handle_intr(dwc_otg_hcd_t * dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_sof_intr(dwc_otg_hcd_t * dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_rx_status_q_level_intr(dwc_otg_hcd_t *
+							 dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_np_tx_fifo_empty_intr(dwc_otg_hcd_t *
+							dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_perio_tx_fifo_empty_intr(dwc_otg_hcd_t *
+							   dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_incomplete_periodic_intr(dwc_otg_hcd_t *
+							   dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_port_intr(dwc_otg_hcd_t * dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_conn_id_status_change_intr(dwc_otg_hcd_t *
+							     dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_disconnect_intr(dwc_otg_hcd_t * dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_hc_intr(dwc_otg_hcd_t * dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_hc_n_intr(dwc_otg_hcd_t * dwc_otg_hcd,
+					    uint32_t num);
+extern int32_t dwc_otg_hcd_handle_session_req_intr(dwc_otg_hcd_t * dwc_otg_hcd);
+extern int32_t dwc_otg_hcd_handle_wakeup_detected_intr(dwc_otg_hcd_t *
+						       dwc_otg_hcd);
+/** @} */
+
+/** @name Schedule Queue Functions */
+/** @{ */
+
+/* Implemented in dwc_otg_hcd_queue.c */
+extern dwc_otg_qh_t *dwc_otg_hcd_qh_create(dwc_otg_hcd_t * hcd,
+					   dwc_otg_hcd_urb_t * urb, int atomic_alloc);
+extern void dwc_otg_hcd_qh_free(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
+extern int dwc_otg_hcd_qh_add(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
+extern void dwc_otg_hcd_qh_remove(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
+extern void dwc_otg_hcd_qh_deactivate(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh,
+				      int sched_csplit);
+
+/** Remove and free a QH */
+static inline void dwc_otg_hcd_qh_remove_and_free(dwc_otg_hcd_t * hcd,
+						  dwc_otg_qh_t * qh)
+{
+	dwc_irqflags_t flags;
+	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
+	dwc_otg_hcd_qh_remove(hcd, qh);
+	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
+	dwc_otg_hcd_qh_free(hcd, qh);
+}
+
+/** Allocates memory for a QH structure.
+ * @return Returns the memory allocate or NULL on error. */
+static inline dwc_otg_qh_t *dwc_otg_hcd_qh_alloc(int atomic_alloc)
+{
+	if (atomic_alloc)
+		return (dwc_otg_qh_t *) DWC_ALLOC_ATOMIC(sizeof(dwc_otg_qh_t));
+	else
+		return (dwc_otg_qh_t *) DWC_ALLOC(sizeof(dwc_otg_qh_t));
+}
+
+extern dwc_otg_qtd_t *dwc_otg_hcd_qtd_create(dwc_otg_hcd_urb_t * urb,
+					     int atomic_alloc);
+extern void dwc_otg_hcd_qtd_init(dwc_otg_qtd_t * qtd, dwc_otg_hcd_urb_t * urb);
+extern int dwc_otg_hcd_qtd_add(dwc_otg_qtd_t * qtd, dwc_otg_hcd_t * dwc_otg_hcd,
+			       dwc_otg_qh_t ** qh, int atomic_alloc);
+
+/** Allocates memory for a QTD structure.
+ * @return Returns the memory allocate or NULL on error. */
+static inline dwc_otg_qtd_t *dwc_otg_hcd_qtd_alloc(int atomic_alloc)
+{
+	if (atomic_alloc)
+		return (dwc_otg_qtd_t *) DWC_ALLOC_ATOMIC(sizeof(dwc_otg_qtd_t));
+	else
+		return (dwc_otg_qtd_t *) DWC_ALLOC(sizeof(dwc_otg_qtd_t));
+}
+
+/** Frees the memory for a QTD structure.  QTD should already be removed from
+ * list.
+ * @param qtd QTD to free.*/
+static inline void dwc_otg_hcd_qtd_free(dwc_otg_qtd_t * qtd)
+{
+	DWC_FREE(qtd);
+}
+
+/** Removes a QTD from list.
+ * @param hcd HCD instance.
+ * @param qtd QTD to remove from list.
+ * @param qh QTD belongs to.
+ */
+static inline void dwc_otg_hcd_qtd_remove(dwc_otg_hcd_t * hcd,
+					  dwc_otg_qtd_t * qtd,
+					  dwc_otg_qh_t * qh)
+{
+	DWC_CIRCLEQ_REMOVE(&qh->qtd_list, qtd, qtd_list_entry);
+}
+
+/** Remove and free a QTD
+  * Need to disable IRQ and hold hcd lock while calling this function out of
+  * interrupt servicing chain */
+static inline void dwc_otg_hcd_qtd_remove_and_free(dwc_otg_hcd_t * hcd,
+						   dwc_otg_qtd_t * qtd,
+						   dwc_otg_qh_t * qh)
+{
+	dwc_otg_hcd_qtd_remove(hcd, qtd, qh);
+	dwc_otg_hcd_qtd_free(qtd);
+}
+
+/** @} */
+
+/** @name Descriptor DMA Supporting Functions */
+/** @{ */
+
+extern void dwc_otg_hcd_start_xfer_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
+extern void dwc_otg_hcd_complete_xfer_ddma(dwc_otg_hcd_t * hcd,
+					   dwc_hc_t * hc,
+					   dwc_otg_hc_regs_t * hc_regs,
+					   dwc_otg_halt_status_e halt_status);
+
+extern int dwc_otg_hcd_qh_init_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
+extern void dwc_otg_hcd_qh_free_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh);
+
+/** @} */
+
+/** @name Internal Functions */
+/** @{ */
+dwc_otg_qh_t *dwc_urb_to_qh(dwc_otg_hcd_urb_t * urb);
+/** @} */
+
+#ifdef CONFIG_USB_DWC_OTG_LPM
+extern int dwc_otg_hcd_get_hc_for_lpm_tran(dwc_otg_hcd_t * hcd,
+					   uint8_t devaddr);
+extern void dwc_otg_hcd_free_hc_from_lpm(dwc_otg_hcd_t * hcd);
+#endif
+
+/** Gets the QH that contains the list_head */
+#define dwc_list_to_qh(_list_head_ptr_) container_of(_list_head_ptr_, dwc_otg_qh_t, qh_list_entry)
+
+/** Gets the QTD that contains the list_head */
+#define dwc_list_to_qtd(_list_head_ptr_) container_of(_list_head_ptr_, dwc_otg_qtd_t, qtd_list_entry)
+
+/** Check if QH is non-periodic  */
+#define dwc_qh_is_non_per(_qh_ptr_) ((_qh_ptr_->ep_type == UE_BULK) || \
+				     (_qh_ptr_->ep_type == UE_CONTROL))
+
+/** High bandwidth multiplier as encoded in highspeed endpoint descriptors */
+#define dwc_hb_mult(wMaxPacketSize) (1 + (((wMaxPacketSize) >> 11) & 0x03))
+
+/** Packet size for any kind of endpoint descriptor */
+#define dwc_max_packet(wMaxPacketSize) ((wMaxPacketSize) & 0x07ff)
+
+/**
+ * Returns true if _frame1 is less than or equal to _frame2. The comparison is
+ * done modulo DWC_HFNUM_MAX_FRNUM. This accounts for the rollover of the
+ * frame number when the max frame number is reached.
+ */
+static inline int dwc_frame_num_le(uint16_t frame1, uint16_t frame2)
+{
+	return ((frame2 - frame1) & DWC_HFNUM_MAX_FRNUM) <=
+	    (DWC_HFNUM_MAX_FRNUM >> 1);
+}
+
+/**
+ * Returns true if _frame1 is greater than _frame2. The comparison is done
+ * modulo DWC_HFNUM_MAX_FRNUM. This accounts for the rollover of the frame
+ * number when the max frame number is reached.
+ */
+static inline int dwc_frame_num_gt(uint16_t frame1, uint16_t frame2)
+{
+	return (frame1 != frame2) &&
+	    (((frame1 - frame2) & DWC_HFNUM_MAX_FRNUM) <
+	     (DWC_HFNUM_MAX_FRNUM >> 1));
+}
+
+/**
+ * Increments _frame by the amount specified by _inc. The addition is done
+ * modulo DWC_HFNUM_MAX_FRNUM. Returns the incremented value.
+ */
+static inline uint16_t dwc_frame_num_inc(uint16_t frame, uint16_t inc)
+{
+	return (frame + inc) & DWC_HFNUM_MAX_FRNUM;
+}
+
+static inline uint16_t dwc_full_frame_num(uint16_t frame)
+{
+	return (frame & DWC_HFNUM_MAX_FRNUM) >> 3;
+}
+
+static inline uint16_t dwc_micro_frame_num(uint16_t frame)
+{
+	return frame & 0x7;
+}
+
+extern void init_hcd_usecs(dwc_otg_hcd_t *_hcd);
+
+void dwc_otg_hcd_save_data_toggle(dwc_hc_t * hc,
+				  dwc_otg_hc_regs_t * hc_regs,
+				  dwc_otg_qtd_t * qtd);
+
+#ifdef DEBUG
+/**
+ * Macro to sample the remaining PHY clocks left in the current frame. This
+ * may be used during debugging to determine the average time it takes to
+ * execute sections of code. There are two possible sample points, "a" and
+ * "b", so the _letter argument must be one of these values.
+ *
+ * To dump the average sample times, read the "hcd_frrem" sysfs attribute. For
+ * example, "cat /sys/devices/lm0/hcd_frrem".
+ */
+#define dwc_sample_frrem(_hcd, _qh, _letter) \
+{ \
+	hfnum_data_t hfnum; \
+	dwc_otg_qtd_t *qtd; \
+	qtd = list_entry(_qh->qtd_list.next, dwc_otg_qtd_t, qtd_list_entry); \
+	if (usb_pipeint(qtd->urb->pipe) && _qh->start_split_frame != 0 && !qtd->complete_split) { \
+		hfnum.d32 = DWC_READ_REG32(&_hcd->core_if->host_if->host_global_regs->hfnum); \
+		switch (hfnum.b.frnum & 0x7) { \
+		case 7: \
+			_hcd->hfnum_7_samples_##_letter++; \
+			_hcd->hfnum_7_frrem_accum_##_letter += hfnum.b.frrem; \
+			break; \
+		case 0: \
+			_hcd->hfnum_0_samples_##_letter++; \
+			_hcd->hfnum_0_frrem_accum_##_letter += hfnum.b.frrem; \
+			break; \
+		default: \
+			_hcd->hfnum_other_samples_##_letter++; \
+			_hcd->hfnum_other_frrem_accum_##_letter += hfnum.b.frrem; \
+			break; \
+		} \
+	} \
+}
+#else
+#define dwc_sample_frrem(_hcd, _qh, _letter)
+#endif
+#endif
+#endif /* DWC_DEVICE_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c
new file mode 100644
index 000000000000..bd8a20403713
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c
@@ -0,0 +1,1134 @@
+/*==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_ddma.c $
+ * $Revision: #10 $
+ * $Date: 2011/10/20 $
+ * $Change: 1869464 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_DEVICE_ONLY
+
+/** @file
+ * This file contains Descriptor DMA support implementation for host mode.
+ */
+
+#include "dwc_otg_hcd.h"
+#include "dwc_otg_regs.h"
+
+extern bool microframe_schedule;
+
+static inline uint8_t frame_list_idx(uint16_t frame)
+{
+	return (frame & (MAX_FRLIST_EN_NUM - 1));
+}
+
+static inline uint16_t desclist_idx_inc(uint16_t idx, uint16_t inc, uint8_t speed)
+{
+	return (idx + inc) &
+	    (((speed ==
+	       DWC_OTG_EP_SPEED_HIGH) ? MAX_DMA_DESC_NUM_HS_ISOC :
+	      MAX_DMA_DESC_NUM_GENERIC) - 1);
+}
+
+static inline uint16_t desclist_idx_dec(uint16_t idx, uint16_t inc, uint8_t speed)
+{
+	return (idx - inc) &
+	    (((speed ==
+	       DWC_OTG_EP_SPEED_HIGH) ? MAX_DMA_DESC_NUM_HS_ISOC :
+	      MAX_DMA_DESC_NUM_GENERIC) - 1);
+}
+
+static inline uint16_t max_desc_num(dwc_otg_qh_t * qh)
+{
+	return (((qh->ep_type == UE_ISOCHRONOUS)
+		 && (qh->dev_speed == DWC_OTG_EP_SPEED_HIGH))
+		? MAX_DMA_DESC_NUM_HS_ISOC : MAX_DMA_DESC_NUM_GENERIC);
+}
+static inline uint16_t frame_incr_val(dwc_otg_qh_t * qh)
+{
+	return ((qh->dev_speed == DWC_OTG_EP_SPEED_HIGH)
+		? ((qh->interval + 8 - 1) / 8)
+		: qh->interval);
+}
+
+static int desc_list_alloc(struct device *dev, dwc_otg_qh_t * qh)
+{
+	int retval = 0;
+
+	qh->desc_list = (dwc_otg_host_dma_desc_t *)
+	    DWC_DMA_ALLOC(dev, sizeof(dwc_otg_host_dma_desc_t) * max_desc_num(qh),
+			  &qh->desc_list_dma);
+
+	if (!qh->desc_list) {
+		retval = -DWC_E_NO_MEMORY;
+		DWC_ERROR("%s: DMA descriptor list allocation failed\n", __func__);
+
+	}
+
+	dwc_memset(qh->desc_list, 0x00,
+		   sizeof(dwc_otg_host_dma_desc_t) * max_desc_num(qh));
+
+	qh->n_bytes =
+	    (uint32_t *) DWC_ALLOC(sizeof(uint32_t) * max_desc_num(qh));
+
+	if (!qh->n_bytes) {
+		retval = -DWC_E_NO_MEMORY;
+		DWC_ERROR
+		    ("%s: Failed to allocate array for descriptors' size actual values\n",
+		     __func__);
+
+	}
+	return retval;
+
+}
+
+static void desc_list_free(struct device *dev, dwc_otg_qh_t * qh)
+{
+	if (qh->desc_list) {
+		DWC_DMA_FREE(dev, max_desc_num(qh), qh->desc_list,
+			     qh->desc_list_dma);
+		qh->desc_list = NULL;
+	}
+
+	if (qh->n_bytes) {
+		DWC_FREE(qh->n_bytes);
+		qh->n_bytes = NULL;
+	}
+}
+
+static int frame_list_alloc(dwc_otg_hcd_t * hcd)
+{
+	struct device *dev = dwc_otg_hcd_to_dev(hcd);
+	int retval = 0;
+
+	if (hcd->frame_list)
+		return 0;
+
+	hcd->frame_list = DWC_DMA_ALLOC(dev, 4 * MAX_FRLIST_EN_NUM,
+					&hcd->frame_list_dma);
+	if (!hcd->frame_list) {
+		retval = -DWC_E_NO_MEMORY;
+		DWC_ERROR("%s: Frame List allocation failed\n", __func__);
+	}
+
+	dwc_memset(hcd->frame_list, 0x00, 4 * MAX_FRLIST_EN_NUM);
+
+	return retval;
+}
+
+static void frame_list_free(dwc_otg_hcd_t * hcd)
+{
+	struct device *dev = dwc_otg_hcd_to_dev(hcd);
+
+	if (!hcd->frame_list)
+		return;
+
+	DWC_DMA_FREE(dev, 4 * MAX_FRLIST_EN_NUM, hcd->frame_list, hcd->frame_list_dma);
+	hcd->frame_list = NULL;
+}
+
+static void per_sched_enable(dwc_otg_hcd_t * hcd, uint16_t fr_list_en)
+{
+
+	hcfg_data_t hcfg;
+
+	hcfg.d32 = DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hcfg);
+
+	if (hcfg.b.perschedena) {
+		/* already enabled */
+		return;
+	}
+
+	DWC_WRITE_REG32(&hcd->core_if->host_if->host_global_regs->hflbaddr,
+			hcd->frame_list_dma);
+
+	switch (fr_list_en) {
+	case 64:
+		hcfg.b.frlisten = 3;
+		break;
+	case 32:
+		hcfg.b.frlisten = 2;
+		break;
+	case 16:
+		hcfg.b.frlisten = 1;
+		break;
+	case 8:
+		hcfg.b.frlisten = 0;
+		break;
+	default:
+		break;
+	}
+
+	hcfg.b.perschedena = 1;
+
+	DWC_DEBUGPL(DBG_HCD, "Enabling Periodic schedule\n");
+	DWC_WRITE_REG32(&hcd->core_if->host_if->host_global_regs->hcfg, hcfg.d32);
+
+}
+
+static void per_sched_disable(dwc_otg_hcd_t * hcd)
+{
+	hcfg_data_t hcfg;
+
+	hcfg.d32 = DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hcfg);
+
+	if (!hcfg.b.perschedena) {
+		/* already disabled */
+		return;
+	}
+	hcfg.b.perschedena = 0;
+
+	DWC_DEBUGPL(DBG_HCD, "Disabling Periodic schedule\n");
+	DWC_WRITE_REG32(&hcd->core_if->host_if->host_global_regs->hcfg, hcfg.d32);
+}
+
+/*
+ * Activates/Deactivates FrameList entries for the channel
+ * based on endpoint servicing period.
+ */
+void update_frame_list(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh, uint8_t enable)
+{
+	uint16_t i, j, inc;
+	dwc_hc_t *hc = NULL;
+
+	if (!qh->channel) {
+		DWC_ERROR("qh->channel = %p", qh->channel);
+		return;
+	}
+
+	if (!hcd) {
+		DWC_ERROR("------hcd = %p", hcd);
+		return;
+	}
+
+	if (!hcd->frame_list) {
+		DWC_ERROR("-------hcd->frame_list = %p", hcd->frame_list);
+		return;
+	}
+
+	hc = qh->channel;
+	inc = frame_incr_val(qh);
+	if (qh->ep_type == UE_ISOCHRONOUS)
+		i = frame_list_idx(qh->sched_frame);
+	else
+		i = 0;
+
+	j = i;
+	do {
+		if (enable)
+			hcd->frame_list[j] |= (1 << hc->hc_num);
+		else
+			hcd->frame_list[j] &= ~(1 << hc->hc_num);
+		j = (j + inc) & (MAX_FRLIST_EN_NUM - 1);
+	}
+	while (j != i);
+	if (!enable)
+		return;
+	hc->schinfo = 0;
+	if (qh->channel->speed == DWC_OTG_EP_SPEED_HIGH) {
+		j = 1;
+		/* TODO - check this */
+		inc = (8 + qh->interval - 1) / qh->interval;
+		for (i = 0; i < inc; i++) {
+			hc->schinfo |= j;
+			j = j << qh->interval;
+		}
+	} else {
+		hc->schinfo = 0xff;
+	}
+}
+
+#if 1
+void dump_frame_list(dwc_otg_hcd_t * hcd)
+{
+	int i = 0;
+	DWC_PRINTF("--FRAME LIST (hex) --\n");
+	for (i = 0; i < MAX_FRLIST_EN_NUM; i++) {
+		DWC_PRINTF("%x\t", hcd->frame_list[i]);
+		if (!(i % 8) && i)
+			DWC_PRINTF("\n");
+	}
+	DWC_PRINTF("\n----\n");
+
+}
+#endif
+
+static void release_channel_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	dwc_hc_t *hc = qh->channel;
+	if (dwc_qh_is_non_per(qh)) {
+		if (!microframe_schedule)
+			hcd->non_periodic_channels--;
+		else
+			hcd->available_host_channels++;
+	} else
+		update_frame_list(hcd, qh, 0);
+
+	/*
+	 * The condition is added to prevent double cleanup try in case of device
+	 * disconnect. See channel cleanup in dwc_otg_hcd_disconnect_cb().
+	 */
+	if (hc->qh) {
+		dwc_otg_hc_cleanup(hcd->core_if, hc);
+		DWC_CIRCLEQ_INSERT_TAIL(&hcd->free_hc_list, hc, hc_list_entry);
+		hc->qh = NULL;
+	}
+
+	qh->channel = NULL;
+	qh->ntd = 0;
+
+	if (qh->desc_list) {
+		dwc_memset(qh->desc_list, 0x00,
+			   sizeof(dwc_otg_host_dma_desc_t) * max_desc_num(qh));
+	}
+}
+
+/**
+ * Initializes a QH structure's Descriptor DMA related members.
+ * Allocates memory for descriptor list.
+ * On first periodic QH, allocates memory for FrameList
+ * and enables periodic scheduling.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param qh The QH to init.
+ *
+ * @return 0 if successful, negative error code otherwise.
+ */
+int dwc_otg_hcd_qh_init_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	struct device *dev = dwc_otg_hcd_to_dev(hcd);
+	int retval = 0;
+
+	if (qh->do_split) {
+		DWC_ERROR("SPLIT Transfers are not supported in Descriptor DMA.\n");
+		return -1;
+	}
+
+	retval = desc_list_alloc(dev, qh);
+
+	if ((retval == 0)
+	    && (qh->ep_type == UE_ISOCHRONOUS || qh->ep_type == UE_INTERRUPT)) {
+		if (!hcd->frame_list) {
+			retval = frame_list_alloc(hcd);
+			/* Enable periodic schedule on first periodic QH */
+			if (retval == 0)
+				per_sched_enable(hcd, MAX_FRLIST_EN_NUM);
+		}
+	}
+
+	qh->ntd = 0;
+
+	return retval;
+}
+
+/**
+ * Frees descriptor list memory associated with the QH.
+ * If QH is periodic and the last, frees FrameList memory
+ * and disables periodic scheduling.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param qh The QH to init.
+ */
+void dwc_otg_hcd_qh_free_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	struct device *dev = dwc_otg_hcd_to_dev(hcd);
+
+	desc_list_free(dev, qh);
+
+	/*
+	 * Channel still assigned due to some reasons.
+	 * Seen on Isoc URB dequeue. Channel halted but no subsequent
+	 * ChHalted interrupt to release the channel. Afterwards
+	 * when it comes here from endpoint disable routine
+	 * channel remains assigned.
+	 */
+	if (qh->channel)
+		release_channel_ddma(hcd, qh);
+
+	if ((qh->ep_type == UE_ISOCHRONOUS || qh->ep_type == UE_INTERRUPT)
+	    && (microframe_schedule || !hcd->periodic_channels) && hcd->frame_list) {
+
+		per_sched_disable(hcd);
+		frame_list_free(hcd);
+	}
+}
+
+static uint8_t frame_to_desc_idx(dwc_otg_qh_t * qh, uint16_t frame_idx)
+{
+	if (qh->dev_speed == DWC_OTG_EP_SPEED_HIGH) {
+		/*
+		 * Descriptor set(8 descriptors) index
+		 * which is 8-aligned.
+		 */
+		return (frame_idx & ((MAX_DMA_DESC_NUM_HS_ISOC / 8) - 1)) * 8;
+	} else {
+		return (frame_idx & (MAX_DMA_DESC_NUM_GENERIC - 1));
+	}
+}
+
+/*
+ * Determine starting frame for Isochronous transfer.
+ * Few frames skipped to prevent race condition with HC.
+ */
+static uint8_t calc_starting_frame(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh,
+				   uint8_t * skip_frames)
+{
+	uint16_t frame = 0;
+	hcd->frame_number = dwc_otg_hcd_get_frame_number(hcd);
+
+	/* sched_frame is always frame number(not uFrame) both in FS and HS !! */
+
+	/*
+	 * skip_frames is used to limit activated descriptors number
+	 * to avoid the situation when HC services the last activated
+	 * descriptor firstly.
+	 * Example for FS:
+	 * Current frame is 1, scheduled frame is 3. Since HC always fetches the descriptor
+	 * corresponding to curr_frame+1, the descriptor corresponding to frame 2
+	 * will be fetched. If the number of descriptors is max=64 (or greather) the
+	 * list will be fully programmed with Active descriptors and it is possible
+	 * case(rare) that the latest descriptor(considering rollback) corresponding
+	 * to frame 2 will be serviced first. HS case is more probable because, in fact,
+	 * up to 11 uframes(16 in the code) may be skipped.
+	 */
+	if (qh->dev_speed == DWC_OTG_EP_SPEED_HIGH) {
+		/*
+		 * Consider uframe counter also, to start xfer asap.
+		 * If half of the frame elapsed skip 2 frames otherwise
+		 * just 1 frame.
+		 * Starting descriptor index must be 8-aligned, so
+		 * if the current frame is near to complete the next one
+		 * is skipped as well.
+		 */
+
+		if (dwc_micro_frame_num(hcd->frame_number) >= 5) {
+			*skip_frames = 2 * 8;
+			frame = dwc_frame_num_inc(hcd->frame_number, *skip_frames);
+		} else {
+			*skip_frames = 1 * 8;
+			frame = dwc_frame_num_inc(hcd->frame_number, *skip_frames);
+		}
+
+		frame = dwc_full_frame_num(frame);
+	} else {
+		/*
+		 * Two frames are skipped for FS - the current and the next.
+		 * But for descriptor programming, 1 frame(descriptor) is enough,
+		 * see example above.
+		 */
+		*skip_frames = 1;
+		frame = dwc_frame_num_inc(hcd->frame_number, 2);
+	}
+
+	return frame;
+}
+
+/*
+ * Calculate initial descriptor index for isochronous transfer
+ * based on scheduled frame.
+ */
+static uint8_t recalc_initial_desc_idx(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	uint16_t frame = 0, fr_idx, fr_idx_tmp;
+	uint8_t skip_frames = 0;
+	/*
+	 * With current ISOC processing algorithm the channel is being
+	 * released when no more QTDs in the list(qh->ntd == 0).
+	 * Thus this function is called only when qh->ntd == 0 and qh->channel == 0.
+	 *
+	 * So qh->channel != NULL branch is not used and just not removed from the
+	 * source file. It is required for another possible approach which is,
+	 * do not disable and release the channel when ISOC session completed,
+	 * just move QH to inactive schedule until new QTD arrives.
+	 * On new QTD, the QH moved back to 'ready' schedule,
+	 * starting frame and therefore starting desc_index are recalculated.
+	 * In this case channel is released only on ep_disable.
+	 */
+
+	/* Calculate starting descriptor index. For INTERRUPT endpoint it is always 0. */
+	if (qh->channel) {
+		frame = calc_starting_frame(hcd, qh, &skip_frames);
+		/*
+		 * Calculate initial descriptor index based on FrameList current bitmap
+		 * and servicing period.
+		 */
+		fr_idx_tmp = frame_list_idx(frame);
+		fr_idx =
+		    (MAX_FRLIST_EN_NUM + frame_list_idx(qh->sched_frame) -
+		     fr_idx_tmp)
+		    % frame_incr_val(qh);
+		fr_idx = (fr_idx + fr_idx_tmp) % MAX_FRLIST_EN_NUM;
+	} else {
+		qh->sched_frame = calc_starting_frame(hcd, qh, &skip_frames);
+		fr_idx = frame_list_idx(qh->sched_frame);
+	}
+
+	qh->td_first = qh->td_last = frame_to_desc_idx(qh, fr_idx);
+
+	return skip_frames;
+}
+
+#define	ISOC_URB_GIVEBACK_ASAP
+
+#define MAX_ISOC_XFER_SIZE_FS 1023
+#define MAX_ISOC_XFER_SIZE_HS 3072
+#define DESCNUM_THRESHOLD 4
+
+static void init_isoc_dma_desc(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh,
+			       uint8_t skip_frames)
+{
+	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
+	dwc_otg_qtd_t *qtd;
+	dwc_otg_host_dma_desc_t *dma_desc;
+	uint16_t idx, inc, n_desc, ntd_max, max_xfer_size;
+
+	idx = qh->td_last;
+	inc = qh->interval;
+	n_desc = 0;
+
+	ntd_max = (max_desc_num(qh) + qh->interval - 1) / qh->interval;
+	if (skip_frames && !qh->channel)
+		ntd_max = ntd_max - skip_frames / qh->interval;
+
+	max_xfer_size =
+	    (qh->dev_speed ==
+	     DWC_OTG_EP_SPEED_HIGH) ? MAX_ISOC_XFER_SIZE_HS :
+	    MAX_ISOC_XFER_SIZE_FS;
+
+	DWC_CIRCLEQ_FOREACH(qtd, &qh->qtd_list, qtd_list_entry) {
+		while ((qh->ntd < ntd_max)
+		       && (qtd->isoc_frame_index_last <
+			   qtd->urb->packet_count)) {
+
+			dma_desc = &qh->desc_list[idx];
+			dwc_memset(dma_desc, 0x00, sizeof(dwc_otg_host_dma_desc_t));
+
+			frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index_last];
+
+			if (frame_desc->length > max_xfer_size)
+				qh->n_bytes[idx] = max_xfer_size;
+			else
+				qh->n_bytes[idx] = frame_desc->length;
+			dma_desc->status.b_isoc.n_bytes = qh->n_bytes[idx];
+			dma_desc->status.b_isoc.a = 1;
+			dma_desc->status.b_isoc.sts = 0;
+
+			dma_desc->buf = qtd->urb->dma + frame_desc->offset;
+
+			qh->ntd++;
+
+			qtd->isoc_frame_index_last++;
+
+#ifdef	ISOC_URB_GIVEBACK_ASAP
+			/*
+			 * Set IOC for each descriptor corresponding to the
+			 * last frame of the URB.
+			 */
+			if (qtd->isoc_frame_index_last ==
+			    qtd->urb->packet_count)
+				dma_desc->status.b_isoc.ioc = 1;
+
+#endif
+			idx = desclist_idx_inc(idx, inc, qh->dev_speed);
+			n_desc++;
+
+		}
+		qtd->in_process = 1;
+	}
+
+	qh->td_last = idx;
+
+#ifdef	ISOC_URB_GIVEBACK_ASAP
+	/* Set IOC for the last descriptor if descriptor list is full */
+	if (qh->ntd == ntd_max) {
+		idx = desclist_idx_dec(qh->td_last, inc, qh->dev_speed);
+		qh->desc_list[idx].status.b_isoc.ioc = 1;
+	}
+#else
+	/*
+	 * Set IOC bit only for one descriptor.
+	 * Always try to be ahead of HW processing,
+	 * i.e. on IOC generation driver activates next descriptors but
+	 * core continues to process descriptors followed the one with IOC set.
+	 */
+
+	if (n_desc > DESCNUM_THRESHOLD) {
+		/*
+		 * Move IOC "up". Required even if there is only one QTD
+		 * in the list, cause QTDs migth continue to be queued,
+		 * but during the activation it was only one queued.
+		 * Actually more than one QTD might be in the list if this function called
+		 * from XferCompletion - QTDs was queued during HW processing of the previous
+		 * descriptor chunk.
+		 */
+		idx = dwc_desclist_idx_dec(idx, inc * ((qh->ntd + 1) / 2), qh->dev_speed);
+	} else {
+		/*
+		 * Set the IOC for the latest descriptor
+		 * if either number of descriptor is not greather than threshold
+		 * or no more new descriptors activated.
+		 */
+		idx = dwc_desclist_idx_dec(qh->td_last, inc, qh->dev_speed);
+	}
+
+	qh->desc_list[idx].status.b_isoc.ioc = 1;
+#endif
+}
+
+static void init_non_isoc_dma_desc(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+
+	dwc_hc_t *hc;
+	dwc_otg_host_dma_desc_t *dma_desc;
+	dwc_otg_qtd_t *qtd;
+	int num_packets, len, n_desc = 0;
+
+	hc = qh->channel;
+
+	/*
+	 * Start with hc->xfer_buff initialized in
+	 * assign_and_init_hc(), then if SG transfer consists of multiple URBs,
+	 * this pointer re-assigned to the buffer of the currently processed QTD.
+	 * For non-SG request there is always one QTD active.
+	 */
+
+	DWC_CIRCLEQ_FOREACH(qtd, &qh->qtd_list, qtd_list_entry) {
+
+		if (n_desc) {
+			/* SG request - more than 1 QTDs */
+			hc->xfer_buff = (uint8_t *)qtd->urb->dma + qtd->urb->actual_length;
+			hc->xfer_len = qtd->urb->length - qtd->urb->actual_length;
+		}
+
+		qtd->n_desc = 0;
+
+		do {
+			dma_desc = &qh->desc_list[n_desc];
+			len = hc->xfer_len;
+
+			if (len > MAX_DMA_DESC_SIZE)
+				len = MAX_DMA_DESC_SIZE - hc->max_packet + 1;
+
+			if (hc->ep_is_in) {
+				if (len > 0) {
+					num_packets = (len + hc->max_packet - 1) / hc->max_packet;
+				} else {
+					/* Need 1 packet for transfer length of 0. */
+					num_packets = 1;
+				}
+				/* Always program an integral # of max packets for IN transfers. */
+				len = num_packets * hc->max_packet;
+			}
+
+			dma_desc->status.b.n_bytes = len;
+
+			qh->n_bytes[n_desc] = len;
+
+			if ((qh->ep_type == UE_CONTROL)
+			    && (qtd->control_phase == DWC_OTG_CONTROL_SETUP))
+				dma_desc->status.b.sup = 1;	/* Setup Packet */
+
+			dma_desc->status.b.a = 1;	/* Active descriptor */
+			dma_desc->status.b.sts = 0;
+
+			dma_desc->buf =
+			    ((unsigned long)hc->xfer_buff & 0xffffffff);
+
+			/*
+			 * Last descriptor(or single) of IN transfer
+			 * with actual size less than MaxPacket.
+			 */
+			if (len > hc->xfer_len) {
+				hc->xfer_len = 0;
+			} else {
+				hc->xfer_buff += len;
+				hc->xfer_len -= len;
+			}
+
+			qtd->n_desc++;
+			n_desc++;
+		}
+		while ((hc->xfer_len > 0) && (n_desc != MAX_DMA_DESC_NUM_GENERIC));
+
+
+		qtd->in_process = 1;
+
+		if (qh->ep_type == UE_CONTROL)
+			break;
+
+		if (n_desc == MAX_DMA_DESC_NUM_GENERIC)
+			break;
+	}
+
+	if (n_desc) {
+		/* Request Transfer Complete interrupt for the last descriptor */
+		qh->desc_list[n_desc - 1].status.b.ioc = 1;
+		/* End of List indicator */
+		qh->desc_list[n_desc - 1].status.b.eol = 1;
+
+		hc->ntd = n_desc;
+	}
+}
+
+/**
+ * For Control and Bulk endpoints initializes descriptor list
+ * and starts the transfer.
+ *
+ * For Interrupt and Isochronous endpoints initializes descriptor list
+ * then updates FrameList, marking appropriate entries as active.
+ * In case of Isochronous, the starting descriptor index is calculated based
+ * on the scheduled frame, but only on the first transfer descriptor within a session.
+ * Then starts the transfer via enabling the channel.
+ * For Isochronous endpoint the channel is not halted on XferComplete
+ * interrupt so remains assigned to the endpoint(QH) until session is done.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param qh The QH to init.
+ *
+ * @return 0 if successful, negative error code otherwise.
+ */
+void dwc_otg_hcd_start_xfer_ddma(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	/* Channel is already assigned */
+	dwc_hc_t *hc = qh->channel;
+	uint8_t skip_frames = 0;
+
+	switch (hc->ep_type) {
+	case DWC_OTG_EP_TYPE_CONTROL:
+	case DWC_OTG_EP_TYPE_BULK:
+		init_non_isoc_dma_desc(hcd, qh);
+
+		dwc_otg_hc_start_transfer_ddma(hcd->core_if, hc);
+		break;
+	case DWC_OTG_EP_TYPE_INTR:
+		init_non_isoc_dma_desc(hcd, qh);
+
+		update_frame_list(hcd, qh, 1);
+
+		dwc_otg_hc_start_transfer_ddma(hcd->core_if, hc);
+		break;
+	case DWC_OTG_EP_TYPE_ISOC:
+
+		if (!qh->ntd)
+			skip_frames = recalc_initial_desc_idx(hcd, qh);
+
+		init_isoc_dma_desc(hcd, qh, skip_frames);
+
+		if (!hc->xfer_started) {
+
+			update_frame_list(hcd, qh, 1);
+
+			/*
+			 * Always set to max, instead of actual size.
+			 * Otherwise ntd will be changed with
+			 * channel being enabled. Not recommended.
+			 *
+			 */
+			hc->ntd = max_desc_num(qh);
+			/* Enable channel only once for ISOC */
+			dwc_otg_hc_start_transfer_ddma(hcd->core_if, hc);
+		}
+
+		break;
+	default:
+
+		break;
+	}
+}
+
+static void complete_isoc_xfer_ddma(dwc_otg_hcd_t * hcd,
+				    dwc_hc_t * hc,
+				    dwc_otg_hc_regs_t * hc_regs,
+				    dwc_otg_halt_status_e halt_status)
+{
+	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
+	dwc_otg_qtd_t *qtd, *qtd_tmp;
+	dwc_otg_qh_t *qh;
+	dwc_otg_host_dma_desc_t *dma_desc;
+	uint16_t idx, remain;
+	uint8_t urb_compl;
+
+	qh = hc->qh;
+	idx = qh->td_first;
+
+	if (hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE) {
+		DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &hc->qh->qtd_list, qtd_list_entry)
+		    qtd->in_process = 0;
+		return;
+	} else if ((halt_status == DWC_OTG_HC_XFER_AHB_ERR) ||
+		   (halt_status == DWC_OTG_HC_XFER_BABBLE_ERR)) {
+		/*
+		 * Channel is halted in these error cases.
+		 * Considered as serious issues.
+		 * Complete all URBs marking all frames as failed,
+		 * irrespective whether some of the descriptors(frames) succeeded or no.
+		 * Pass error code to completion routine as well, to
+		 * update urb->status, some of class drivers might use it to stop
+		 * queing transfer requests.
+		 */
+		int err = (halt_status == DWC_OTG_HC_XFER_AHB_ERR)
+		    ? (-DWC_E_IO)
+		    : (-DWC_E_OVERFLOW);
+
+		DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &hc->qh->qtd_list, qtd_list_entry) {
+			for (idx = 0; idx < qtd->urb->packet_count; idx++) {
+				frame_desc = &qtd->urb->iso_descs[idx];
+				frame_desc->status = err;
+			}
+			hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, err);
+			dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
+		}
+		return;
+	}
+
+	DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &hc->qh->qtd_list, qtd_list_entry) {
+
+		if (!qtd->in_process)
+			break;
+
+		urb_compl = 0;
+
+		do {
+
+			dma_desc = &qh->desc_list[idx];
+
+			frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
+			remain = hc->ep_is_in ? dma_desc->status.b_isoc.n_bytes : 0;
+
+			if (dma_desc->status.b_isoc.sts == DMA_DESC_STS_PKTERR) {
+				/*
+				 * XactError or, unable to complete all the transactions
+				 * in the scheduled micro-frame/frame,
+				 * both indicated by DMA_DESC_STS_PKTERR.
+				 */
+				qtd->urb->error_count++;
+				frame_desc->actual_length = qh->n_bytes[idx] - remain;
+				frame_desc->status = -DWC_E_PROTOCOL;
+			} else {
+				/* Success */
+
+				frame_desc->actual_length = qh->n_bytes[idx] - remain;
+				frame_desc->status = 0;
+			}
+
+			if (++qtd->isoc_frame_index == qtd->urb->packet_count) {
+				/*
+				 * urb->status is not used for isoc transfers here.
+				 * The individual frame_desc status are used instead.
+				 */
+
+				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
+				dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
+
+				/*
+				 * This check is necessary because urb_dequeue can be called
+				 * from urb complete callback(sound driver example).
+				 * All pending URBs are dequeued there, so no need for
+				 * further processing.
+				 */
+				if (hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE) {
+					return;
+				}
+
+				urb_compl = 1;
+
+			}
+
+			qh->ntd--;
+
+			/* Stop if IOC requested descriptor reached */
+			if (dma_desc->status.b_isoc.ioc) {
+				idx = desclist_idx_inc(idx, qh->interval, hc->speed);
+				goto stop_scan;
+			}
+
+			idx = desclist_idx_inc(idx, qh->interval, hc->speed);
+
+			if (urb_compl)
+				break;
+		}
+		while (idx != qh->td_first);
+	}
+stop_scan:
+	qh->td_first = idx;
+}
+
+uint8_t update_non_isoc_urb_state_ddma(dwc_otg_hcd_t * hcd,
+				       dwc_hc_t * hc,
+				       dwc_otg_qtd_t * qtd,
+				       dwc_otg_host_dma_desc_t * dma_desc,
+				       dwc_otg_halt_status_e halt_status,
+				       uint32_t n_bytes, uint8_t * xfer_done)
+{
+
+	uint16_t remain = hc->ep_is_in ? dma_desc->status.b.n_bytes : 0;
+	dwc_otg_hcd_urb_t *urb = qtd->urb;
+
+	if (halt_status == DWC_OTG_HC_XFER_AHB_ERR) {
+		urb->status = -DWC_E_IO;
+		return 1;
+	}
+	if (dma_desc->status.b.sts == DMA_DESC_STS_PKTERR) {
+		switch (halt_status) {
+		case DWC_OTG_HC_XFER_STALL:
+			urb->status = -DWC_E_PIPE;
+			break;
+		case DWC_OTG_HC_XFER_BABBLE_ERR:
+			urb->status = -DWC_E_OVERFLOW;
+			break;
+		case DWC_OTG_HC_XFER_XACT_ERR:
+			urb->status = -DWC_E_PROTOCOL;
+			break;
+		default:
+			DWC_ERROR("%s: Unhandled descriptor error status (%d)\n", __func__,
+				  halt_status);
+			break;
+		}
+		return 1;
+	}
+
+	if (dma_desc->status.b.a == 1) {
+		DWC_DEBUGPL(DBG_HCDV,
+			    "Active descriptor encountered on channel %d\n",
+			    hc->hc_num);
+		return 0;
+	}
+
+	if (hc->ep_type == DWC_OTG_EP_TYPE_CONTROL) {
+		if (qtd->control_phase == DWC_OTG_CONTROL_DATA) {
+			urb->actual_length += n_bytes - remain;
+			if (remain || urb->actual_length == urb->length) {
+				/*
+				 * For Control Data stage do not set urb->status=0 to prevent
+				 * URB callback. Set it when Status phase done. See below.
+				 */
+				*xfer_done = 1;
+			}
+
+		} else if (qtd->control_phase == DWC_OTG_CONTROL_STATUS) {
+			urb->status = 0;
+			*xfer_done = 1;
+		}
+		/* No handling for SETUP stage */
+	} else {
+		/* BULK and INTR */
+		urb->actual_length += n_bytes - remain;
+		if (remain || urb->actual_length == urb->length) {
+			urb->status = 0;
+			*xfer_done = 1;
+		}
+	}
+
+	return 0;
+}
+
+static void complete_non_isoc_xfer_ddma(dwc_otg_hcd_t * hcd,
+					dwc_hc_t * hc,
+					dwc_otg_hc_regs_t * hc_regs,
+					dwc_otg_halt_status_e halt_status)
+{
+	dwc_otg_hcd_urb_t *urb = NULL;
+	dwc_otg_qtd_t *qtd, *qtd_tmp;
+	dwc_otg_qh_t *qh;
+	dwc_otg_host_dma_desc_t *dma_desc;
+	uint32_t n_bytes, n_desc, i;
+	uint8_t failed = 0, xfer_done;
+
+	n_desc = 0;
+
+	qh = hc->qh;
+
+	if (hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE) {
+		DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &hc->qh->qtd_list, qtd_list_entry) {
+			qtd->in_process = 0;
+		}
+		return;
+	}
+
+	DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &qh->qtd_list, qtd_list_entry) {
+
+		urb = qtd->urb;
+
+		n_bytes = 0;
+		xfer_done = 0;
+
+		for (i = 0; i < qtd->n_desc; i++) {
+			dma_desc = &qh->desc_list[n_desc];
+
+			n_bytes = qh->n_bytes[n_desc];
+
+			failed =
+			    update_non_isoc_urb_state_ddma(hcd, hc, qtd,
+							   dma_desc,
+							   halt_status, n_bytes,
+							   &xfer_done);
+
+			if (failed
+			    || (xfer_done
+				&& (urb->status != -DWC_E_IN_PROGRESS))) {
+
+				hcd->fops->complete(hcd, urb->priv, urb,
+						    urb->status);
+				dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
+
+				if (failed)
+					goto stop_scan;
+			} else if (qh->ep_type == UE_CONTROL) {
+				if (qtd->control_phase == DWC_OTG_CONTROL_SETUP) {
+					if (urb->length > 0) {
+						qtd->control_phase = DWC_OTG_CONTROL_DATA;
+					} else {
+						qtd->control_phase = DWC_OTG_CONTROL_STATUS;
+					}
+					DWC_DEBUGPL(DBG_HCDV, "  Control setup transaction done\n");
+				} else if (qtd->control_phase == DWC_OTG_CONTROL_DATA) {
+					if (xfer_done) {
+						qtd->control_phase = DWC_OTG_CONTROL_STATUS;
+						DWC_DEBUGPL(DBG_HCDV, "  Control data transfer done\n");
+					} else if (i + 1 == qtd->n_desc) {
+						/*
+						 * Last descriptor for Control data stage which is
+						 * not completed yet.
+						 */
+						dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+					}
+				}
+			}
+
+			n_desc++;
+		}
+
+	}
+
+stop_scan:
+
+	if (qh->ep_type != UE_CONTROL) {
+		/*
+		 * Resetting the data toggle for bulk
+		 * and interrupt endpoints in case of stall. See handle_hc_stall_intr()
+		 */
+		if (halt_status == DWC_OTG_HC_XFER_STALL)
+			qh->data_toggle = DWC_OTG_HC_PID_DATA0;
+		else
+			dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+	}
+
+	if (halt_status == DWC_OTG_HC_XFER_COMPLETE) {
+		hcint_data_t hcint;
+		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+		if (hcint.b.nyet) {
+			/*
+			 * Got a NYET on the last transaction of the transfer. It
+			 * means that the endpoint should be in the PING state at the
+			 * beginning of the next transfer.
+			 */
+			qh->ping_state = 1;
+			clear_hc_int(hc_regs, nyet);
+		}
+
+	}
+
+}
+
+/**
+ * This function is called from interrupt handlers.
+ * Scans the descriptor list, updates URB's status and
+ * calls completion routine for the URB if it's done.
+ * Releases the channel to be used by other transfers.
+ * In case of Isochronous endpoint the channel is not halted until
+ * the end of the session, i.e. QTD list is empty.
+ * If periodic channel released the FrameList is updated accordingly.
+ *
+ * Calls transaction selection routines to activate pending transfers.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param hc Host channel, the transfer is completed on.
+ * @param hc_regs Host channel registers.
+ * @param halt_status Reason the channel is being halted,
+ *		      or just XferComplete for isochronous transfer
+ */
+void dwc_otg_hcd_complete_xfer_ddma(dwc_otg_hcd_t * hcd,
+				    dwc_hc_t * hc,
+				    dwc_otg_hc_regs_t * hc_regs,
+				    dwc_otg_halt_status_e halt_status)
+{
+	uint8_t continue_isoc_xfer = 0;
+	dwc_otg_transaction_type_e tr_type;
+	dwc_otg_qh_t *qh = hc->qh;
+
+	if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
+
+		complete_isoc_xfer_ddma(hcd, hc, hc_regs, halt_status);
+
+		/* Release the channel if halted or session completed */
+		if (halt_status != DWC_OTG_HC_XFER_COMPLETE ||
+		    DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
+
+			/* Halt the channel if session completed */
+			if (halt_status == DWC_OTG_HC_XFER_COMPLETE) {
+				dwc_otg_hc_halt(hcd->core_if, hc, halt_status);
+			}
+
+			release_channel_ddma(hcd, qh);
+			dwc_otg_hcd_qh_remove(hcd, qh);
+		} else {
+			/* Keep in assigned schedule to continue transfer */
+			DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_assigned,
+					   &qh->qh_list_entry);
+			continue_isoc_xfer = 1;
+
+		}
+		/** @todo Consider the case when period exceeds FrameList size.
+		 *  Frame Rollover interrupt should be used.
+		 */
+	} else {
+		/* Scan descriptor list to complete the URB(s), then release the channel */
+		complete_non_isoc_xfer_ddma(hcd, hc, hc_regs, halt_status);
+
+		release_channel_ddma(hcd, qh);
+		dwc_otg_hcd_qh_remove(hcd, qh);
+
+		if (!DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
+			/* Add back to inactive non-periodic schedule on normal completion */
+			dwc_otg_hcd_qh_add(hcd, qh);
+		}
+
+	}
+	tr_type = dwc_otg_hcd_select_transactions(hcd);
+	if (tr_type != DWC_OTG_TRANSACTION_NONE || continue_isoc_xfer) {
+		if (continue_isoc_xfer) {
+			if (tr_type == DWC_OTG_TRANSACTION_NONE) {
+				tr_type = DWC_OTG_TRANSACTION_PERIODIC;
+			} else if (tr_type == DWC_OTG_TRANSACTION_NON_PERIODIC) {
+				tr_type = DWC_OTG_TRANSACTION_ALL;
+			}
+		}
+		dwc_otg_hcd_queue_transactions(hcd, tr_type);
+	}
+}
+
+#endif /* DWC_DEVICE_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h b/drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h
new file mode 100644
index 000000000000..a384db5e7ac2
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_if.h
@@ -0,0 +1,421 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_if.h $
+ * $Revision: #12 $
+ * $Date: 2011/10/26 $
+ * $Change: 1873028 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_DEVICE_ONLY
+#ifndef __DWC_HCD_IF_H__
+#define __DWC_HCD_IF_H__
+
+#include "dwc_otg_core_if.h"
+
+/** @file
+ * This file defines DWC_OTG HCD Core API.
+ */
+
+struct dwc_otg_hcd;
+typedef struct dwc_otg_hcd dwc_otg_hcd_t;
+
+struct dwc_otg_hcd_urb;
+typedef struct dwc_otg_hcd_urb dwc_otg_hcd_urb_t;
+
+/** @name HCD Function Driver Callbacks */
+/** @{ */
+
+/** This function is called whenever core switches to host mode. */
+typedef int (*dwc_otg_hcd_start_cb_t) (dwc_otg_hcd_t * hcd);
+
+/** This function is called when device has been disconnected */
+typedef int (*dwc_otg_hcd_disconnect_cb_t) (dwc_otg_hcd_t * hcd);
+
+/** Wrapper provides this function to HCD to core, so it can get hub information to which device is connected */
+typedef int (*dwc_otg_hcd_hub_info_from_urb_cb_t) (dwc_otg_hcd_t * hcd,
+						   void *urb_handle,
+						   uint32_t * hub_addr,
+						   uint32_t * port_addr);
+/** Via this function HCD core gets device speed */
+typedef int (*dwc_otg_hcd_speed_from_urb_cb_t) (dwc_otg_hcd_t * hcd,
+						void *urb_handle);
+
+/** This function is called when urb is completed */
+typedef int (*dwc_otg_hcd_complete_urb_cb_t) (dwc_otg_hcd_t * hcd,
+					      void *urb_handle,
+					      dwc_otg_hcd_urb_t * dwc_otg_urb,
+					      int32_t status);
+
+/** Via this function HCD core gets b_hnp_enable parameter */
+typedef int (*dwc_otg_hcd_get_b_hnp_enable) (dwc_otg_hcd_t * hcd);
+
+struct dwc_otg_hcd_function_ops {
+	dwc_otg_hcd_start_cb_t start;
+	dwc_otg_hcd_disconnect_cb_t disconnect;
+	dwc_otg_hcd_hub_info_from_urb_cb_t hub_info;
+	dwc_otg_hcd_speed_from_urb_cb_t speed;
+	dwc_otg_hcd_complete_urb_cb_t complete;
+	dwc_otg_hcd_get_b_hnp_enable get_b_hnp_enable;
+};
+/** @} */
+
+/** @name HCD Core API */
+/** @{ */
+/** This function allocates dwc_otg_hcd structure and returns pointer on it. */
+extern dwc_otg_hcd_t *dwc_otg_hcd_alloc_hcd(void);
+
+/** This function should be called to initiate HCD Core.
+ *
+ * @param hcd The HCD
+ * @param core_if The DWC_OTG Core
+ *
+ * Returns -DWC_E_NO_MEMORY if no enough memory.
+ * Returns 0 on success
+ */
+extern int dwc_otg_hcd_init(dwc_otg_hcd_t * hcd, dwc_otg_core_if_t * core_if);
+
+/** Frees HCD
+ *
+ * @param hcd The HCD
+ */
+extern void dwc_otg_hcd_remove(dwc_otg_hcd_t * hcd);
+
+/** This function should be called on every hardware interrupt.
+ *
+ * @param dwc_otg_hcd The HCD
+ *
+ * Returns non zero if interrupt is handled
+ * Return 0 if interrupt is not handled
+ */
+extern int32_t dwc_otg_hcd_handle_intr(dwc_otg_hcd_t * dwc_otg_hcd);
+
+/** This function is used to handle the fast interrupt
+ *
+ */
+#ifdef CONFIG_ARM64
+extern void dwc_otg_hcd_handle_fiq(void);
+#else
+extern void __attribute__ ((naked)) dwc_otg_hcd_handle_fiq(void);
+#endif
+
+/**
+ * Returns private data set by
+ * dwc_otg_hcd_set_priv_data function.
+ *
+ * @param hcd The HCD
+ */
+extern void *dwc_otg_hcd_get_priv_data(dwc_otg_hcd_t * hcd);
+
+/**
+ * Set private data.
+ *
+ * @param hcd The HCD
+ * @param priv_data pointer to be stored in private data
+ */
+extern void dwc_otg_hcd_set_priv_data(dwc_otg_hcd_t * hcd, void *priv_data);
+
+/**
+ * This function initializes the HCD Core.
+ *
+ * @param hcd The HCD
+ * @param fops The Function Driver Operations data structure containing pointers to all callbacks.
+ *
+ * Returns -DWC_E_NO_DEVICE if Core is currently is in device mode.
+ * Returns 0 on success
+ */
+extern int dwc_otg_hcd_start(dwc_otg_hcd_t * hcd,
+			     struct dwc_otg_hcd_function_ops *fops);
+
+/**
+ * Halts the DWC_otg host mode operations in a clean manner. USB transfers are
+ * stopped.
+ *
+ * @param hcd The HCD
+ */
+extern void dwc_otg_hcd_stop(dwc_otg_hcd_t * hcd);
+
+/**
+ * Handles hub class-specific requests.
+ *
+ * @param dwc_otg_hcd The HCD
+ * @param typeReq Request Type
+ * @param wValue wValue from control request
+ * @param wIndex wIndex from control request
+ * @param buf data buffer
+ * @param wLength data buffer length
+ *
+ * Returns -DWC_E_INVALID if invalid argument is passed
+ * Returns 0 on success
+ */
+extern int dwc_otg_hcd_hub_control(dwc_otg_hcd_t * dwc_otg_hcd,
+				   uint16_t typeReq, uint16_t wValue,
+				   uint16_t wIndex, uint8_t * buf,
+				   uint16_t wLength);
+
+/**
+ * Returns otg port number.
+ *
+ * @param hcd The HCD
+ */
+extern uint32_t dwc_otg_hcd_otg_port(dwc_otg_hcd_t * hcd);
+
+/**
+ * Returns OTG version - either 1.3 or 2.0.
+ *
+ * @param core_if The core_if structure pointer
+ */
+extern uint16_t dwc_otg_get_otg_version(dwc_otg_core_if_t * core_if);
+
+/**
+ * Returns 1 if currently core is acting as B host, and 0 otherwise.
+ *
+ * @param hcd The HCD
+ */
+extern uint32_t dwc_otg_hcd_is_b_host(dwc_otg_hcd_t * hcd);
+
+/**
+ * Returns current frame number.
+ *
+ * @param hcd The HCD
+ */
+extern int dwc_otg_hcd_get_frame_number(dwc_otg_hcd_t * hcd);
+
+/**
+ * Dumps hcd state.
+ *
+ * @param hcd The HCD
+ */
+extern void dwc_otg_hcd_dump_state(dwc_otg_hcd_t * hcd);
+
+/**
+ * Dump the average frame remaining at SOF. This can be used to
+ * determine average interrupt latency. Frame remaining is also shown for
+ * start transfer and two additional sample points.
+ * Currently this function is not implemented.
+ *
+ * @param hcd The HCD
+ */
+extern void dwc_otg_hcd_dump_frrem(dwc_otg_hcd_t * hcd);
+
+/**
+ * Sends LPM transaction to the local device.
+ *
+ * @param hcd The HCD
+ * @param devaddr Device Address
+ * @param hird Host initiated resume duration
+ * @param bRemoteWake Value of bRemoteWake field in LPM transaction
+ *
+ * Returns negative value if sending LPM transaction was not succeeded.
+ * Returns 0 on success.
+ */
+extern int dwc_otg_hcd_send_lpm(dwc_otg_hcd_t * hcd, uint8_t devaddr,
+				uint8_t hird, uint8_t bRemoteWake);
+
+/* URB interface */
+
+/**
+ * Allocates memory for dwc_otg_hcd_urb structure.
+ * Allocated memory should be freed by call of DWC_FREE.
+ *
+ * @param hcd The HCD
+ * @param iso_desc_count Count of ISOC descriptors
+ * @param atomic_alloc Specefies whether to perform atomic allocation.
+ */
+extern dwc_otg_hcd_urb_t *dwc_otg_hcd_urb_alloc(dwc_otg_hcd_t * hcd,
+						int iso_desc_count,
+						int atomic_alloc);
+
+/**
+ * Set pipe information in URB.
+ *
+ * @param hcd_urb DWC_OTG URB
+ * @param devaddr Device Address
+ * @param ep_num Endpoint Number
+ * @param ep_type Endpoint Type
+ * @param ep_dir Endpoint Direction
+ * @param mps Max Packet Size
+ */
+extern void dwc_otg_hcd_urb_set_pipeinfo(dwc_otg_hcd_urb_t * hcd_urb,
+					 uint8_t devaddr, uint8_t ep_num,
+					 uint8_t ep_type, uint8_t ep_dir,
+					 uint16_t mps);
+
+/* Transfer flags */
+#define URB_GIVEBACK_ASAP 0x1
+#define URB_SEND_ZERO_PACKET 0x2
+
+/**
+ * Sets dwc_otg_hcd_urb parameters.
+ *
+ * @param urb DWC_OTG URB allocated by dwc_otg_hcd_urb_alloc function.
+ * @param urb_handle Unique handle for request, this will be passed back
+ * to function driver in completion callback.
+ * @param buf The buffer for the data
+ * @param dma The DMA buffer for the data
+ * @param buflen Transfer length
+ * @param sp Buffer for setup data
+ * @param sp_dma DMA address of setup data buffer
+ * @param flags Transfer flags
+ * @param interval Polling interval for interrupt or isochronous transfers.
+ */
+extern void dwc_otg_hcd_urb_set_params(dwc_otg_hcd_urb_t * urb,
+				       void *urb_handle, void *buf,
+				       dwc_dma_t dma, uint32_t buflen, void *sp,
+				       dwc_dma_t sp_dma, uint32_t flags,
+				       uint16_t interval);
+
+/** Gets status from dwc_otg_hcd_urb
+ *
+ * @param dwc_otg_urb DWC_OTG URB
+ */
+extern uint32_t dwc_otg_hcd_urb_get_status(dwc_otg_hcd_urb_t * dwc_otg_urb);
+
+/** Gets actual length from dwc_otg_hcd_urb
+ *
+ * @param dwc_otg_urb DWC_OTG URB
+ */
+extern uint32_t dwc_otg_hcd_urb_get_actual_length(dwc_otg_hcd_urb_t *
+						  dwc_otg_urb);
+
+/** Gets error count from dwc_otg_hcd_urb. Only for ISOC URBs
+ *
+ * @param dwc_otg_urb DWC_OTG URB
+ */
+extern uint32_t dwc_otg_hcd_urb_get_error_count(dwc_otg_hcd_urb_t *
+						dwc_otg_urb);
+
+/** Set ISOC descriptor offset and length
+ *
+ * @param dwc_otg_urb DWC_OTG URB
+ * @param desc_num ISOC descriptor number
+ * @param offset Offset from beginig of buffer.
+ * @param length Transaction length
+ */
+extern void dwc_otg_hcd_urb_set_iso_desc_params(dwc_otg_hcd_urb_t * dwc_otg_urb,
+						int desc_num, uint32_t offset,
+						uint32_t length);
+
+/** Get status of ISOC descriptor, specified by desc_num
+ *
+ * @param dwc_otg_urb DWC_OTG URB
+ * @param desc_num ISOC descriptor number
+ */
+extern uint32_t dwc_otg_hcd_urb_get_iso_desc_status(dwc_otg_hcd_urb_t *
+						    dwc_otg_urb, int desc_num);
+
+/** Get actual length of ISOC descriptor, specified by desc_num
+ *
+ * @param dwc_otg_urb DWC_OTG URB
+ * @param desc_num ISOC descriptor number
+ */
+extern uint32_t dwc_otg_hcd_urb_get_iso_desc_actual_length(dwc_otg_hcd_urb_t *
+							   dwc_otg_urb,
+							   int desc_num);
+
+/** Queue URB. After transfer is completes, the complete callback will be called with the URB status
+ *
+ * @param dwc_otg_hcd The HCD
+ * @param dwc_otg_urb DWC_OTG URB
+ * @param ep_handle Out parameter for returning endpoint handle
+ * @param atomic_alloc Flag to do atomic allocation if needed
+ *
+ * Returns -DWC_E_NO_DEVICE if no device is connected.
+ * Returns -DWC_E_NO_MEMORY if there is no enough memory.
+ * Returns 0 on success.
+ */
+extern int dwc_otg_hcd_urb_enqueue(dwc_otg_hcd_t * dwc_otg_hcd,
+				   dwc_otg_hcd_urb_t * dwc_otg_urb,
+				   void **ep_handle, int atomic_alloc);
+
+/** De-queue the specified URB
+ *
+ * @param dwc_otg_hcd The HCD
+ * @param dwc_otg_urb DWC_OTG URB
+ */
+extern int dwc_otg_hcd_urb_dequeue(dwc_otg_hcd_t * dwc_otg_hcd,
+				   dwc_otg_hcd_urb_t * dwc_otg_urb);
+
+/** Frees resources in the DWC_otg controller related to a given endpoint.
+ * Any URBs for the endpoint must already be dequeued.
+ *
+ * @param hcd The HCD
+ * @param ep_handle Endpoint handle, returned by dwc_otg_hcd_urb_enqueue function
+ * @param retry Number of retries if there are queued transfers.
+ *
+ * Returns -DWC_E_INVALID if invalid arguments are passed.
+ * Returns 0 on success
+ */
+extern int dwc_otg_hcd_endpoint_disable(dwc_otg_hcd_t * hcd, void *ep_handle,
+					int retry);
+
+/* Resets the data toggle in qh structure. This function can be called from
+ * usb_clear_halt routine.
+ *
+ * @param hcd The HCD
+ * @param ep_handle Endpoint handle, returned by dwc_otg_hcd_urb_enqueue function
+ *
+ * Returns -DWC_E_INVALID if invalid arguments are passed.
+ * Returns 0 on success
+ */
+extern int dwc_otg_hcd_endpoint_reset(dwc_otg_hcd_t * hcd, void *ep_handle);
+
+/** Returns 1 if status of specified port is changed and 0 otherwise.
+ *
+ * @param hcd The HCD
+ * @param port Port number
+ */
+extern int dwc_otg_hcd_is_status_changed(dwc_otg_hcd_t * hcd, int port);
+
+/** Call this function to check if bandwidth was allocated for specified endpoint.
+ * Only for ISOC and INTERRUPT endpoints.
+ *
+ * @param hcd The HCD
+ * @param ep_handle Endpoint handle
+ */
+extern int dwc_otg_hcd_is_bandwidth_allocated(dwc_otg_hcd_t * hcd,
+					      void *ep_handle);
+
+/** Call this function to check if bandwidth was freed for specified endpoint.
+ *
+ * @param hcd The HCD
+ * @param ep_handle Endpoint handle
+ */
+extern int dwc_otg_hcd_is_bandwidth_freed(dwc_otg_hcd_t * hcd, void *ep_handle);
+
+/** Returns bandwidth allocated for specified endpoint in microseconds.
+ * Only for ISOC and INTERRUPT endpoints.
+ *
+ * @param hcd The HCD
+ * @param ep_handle Endpoint handle
+ */
+extern uint8_t dwc_otg_hcd_get_ep_bandwidth(dwc_otg_hcd_t * hcd,
+					    void *ep_handle);
+
+/** @} */
+
+#endif /* __DWC_HCD_IF_H__ */
+#endif /* DWC_DEVICE_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
new file mode 100644
index 000000000000..6947e98b87ad
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
@@ -0,0 +1,2753 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_intr.c $
+ * $Revision: #89 $
+ * $Date: 2011/10/20 $
+ * $Change: 1869487 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_DEVICE_ONLY
+
+#include "dwc_otg_hcd.h"
+#include "dwc_otg_regs.h"
+
+#include <linux/jiffies.h>
+#ifdef CONFIG_ARM
+#include <asm/fiq.h>
+#endif
+
+extern bool microframe_schedule;
+
+/** @file
+ * This file contains the implementation of the HCD Interrupt handlers.
+ */
+
+int fiq_done, int_done;
+
+#ifdef FIQ_DEBUG
+char buffer[1000*16];
+int wptr;
+void notrace _fiq_print(FIQDBG_T dbg_lvl, char *fmt, ...)
+{
+	FIQDBG_T dbg_lvl_req = FIQDBG_PORTHUB;
+	va_list args;
+	char text[17];
+	hfnum_data_t hfnum = { .d32 = FIQ_READ(dwc_regs_base + 0x408) };
+
+	if(dbg_lvl & dbg_lvl_req || dbg_lvl == FIQDBG_ERR)
+	{
+		local_fiq_disable();
+		snprintf(text, 9, "%4d%d:%d ", hfnum.b.frnum/8, hfnum.b.frnum%8, 8 - hfnum.b.frrem/937);
+		va_start(args, fmt);
+		vsnprintf(text+8, 9, fmt, args);
+		va_end(args);
+
+		memcpy(buffer + wptr, text, 16);
+		wptr = (wptr + 16) % sizeof(buffer);
+		local_fiq_enable();
+	}
+}
+#endif
+
+/** This function handles interrupts for the HCD. */
+int32_t dwc_otg_hcd_handle_intr(dwc_otg_hcd_t * dwc_otg_hcd)
+{
+	int retval = 0;
+	static int last_time;
+	dwc_otg_core_if_t *core_if = dwc_otg_hcd->core_if;
+	gintsts_data_t gintsts;
+	gintmsk_data_t gintmsk;
+	hfnum_data_t hfnum;
+	haintmsk_data_t haintmsk;
+
+#ifdef DEBUG
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+
+#endif
+
+	gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+	gintmsk.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
+
+	/* Exit from ISR if core is hibernated */
+	if (core_if->hibernation_suspend == 1) {
+		goto exit_handler_routine;
+	}
+	DWC_SPINLOCK(dwc_otg_hcd->lock);
+	/* Check if HOST Mode */
+	if (dwc_otg_is_host_mode(core_if)) {
+		if (fiq_enable) {
+			local_fiq_disable();
+			fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
+			/* Pull in from the FIQ's disabled mask */
+			gintmsk.d32 = gintmsk.d32 | ~(dwc_otg_hcd->fiq_state->gintmsk_saved.d32);
+			dwc_otg_hcd->fiq_state->gintmsk_saved.d32 = ~0;
+		}
+
+		if (fiq_fsm_enable && ( 0x0000FFFF & ~(dwc_otg_hcd->fiq_state->haintmsk_saved.b2.chint))) {
+			gintsts.b.hcintr = 1;
+		}
+
+		/* Danger will robinson: fake a SOF if necessary */
+		if (fiq_fsm_enable && (dwc_otg_hcd->fiq_state->gintmsk_saved.b.sofintr == 1)) {
+			gintsts.b.sofintr = 1;
+		}
+		gintsts.d32 &= gintmsk.d32;
+
+		if (fiq_enable) {
+			fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
+			local_fiq_enable();
+		}
+
+		if (!gintsts.d32) {
+			goto exit_handler_routine;
+		}
+
+#ifdef DEBUG
+		// We should be OK doing this because the common interrupts should already have been serviced
+		/* Don't print debug message in the interrupt handler on SOF */
+#ifndef DEBUG_SOF
+		if (gintsts.d32 != DWC_SOF_INTR_MASK)
+#endif
+			DWC_DEBUGPL(DBG_HCDI, "\n");
+#endif
+
+#ifdef DEBUG
+#ifndef DEBUG_SOF
+		if (gintsts.d32 != DWC_SOF_INTR_MASK)
+#endif
+			DWC_DEBUGPL(DBG_HCDI,
+				    "DWC OTG HCD Interrupt Detected gintsts&gintmsk=0x%08x core_if=%p\n",
+				    gintsts.d32, core_if);
+#endif
+		hfnum.d32 = DWC_READ_REG32(&dwc_otg_hcd->core_if->host_if->host_global_regs->hfnum);
+		if (gintsts.b.sofintr) {
+			retval |= dwc_otg_hcd_handle_sof_intr(dwc_otg_hcd);
+		}
+
+		if (gintsts.b.rxstsqlvl) {
+			retval |=
+			    dwc_otg_hcd_handle_rx_status_q_level_intr
+			    (dwc_otg_hcd);
+		}
+		if (gintsts.b.nptxfempty) {
+			retval |=
+			    dwc_otg_hcd_handle_np_tx_fifo_empty_intr
+			    (dwc_otg_hcd);
+		}
+		if (gintsts.b.i2cintr) {
+			/** @todo Implement i2cintr handler. */
+		}
+		if (gintsts.b.portintr) {
+
+			gintmsk_data_t gintmsk = { .b.portintr = 1};
+			retval |= dwc_otg_hcd_handle_port_intr(dwc_otg_hcd);
+			if (fiq_enable) {
+				local_fiq_disable();
+				fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
+				DWC_MODIFY_REG32(&dwc_otg_hcd->core_if->core_global_regs->gintmsk, 0, gintmsk.d32);
+				fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
+				local_fiq_enable();
+			} else {
+				DWC_MODIFY_REG32(&dwc_otg_hcd->core_if->core_global_regs->gintmsk, 0, gintmsk.d32);
+			}
+		}
+		if (gintsts.b.hcintr) {
+			retval |= dwc_otg_hcd_handle_hc_intr(dwc_otg_hcd);
+		}
+		if (gintsts.b.ptxfempty) {
+			retval |=
+			    dwc_otg_hcd_handle_perio_tx_fifo_empty_intr
+			    (dwc_otg_hcd);
+		}
+#ifdef DEBUG
+#ifndef DEBUG_SOF
+		if (gintsts.d32 != DWC_SOF_INTR_MASK)
+#endif
+		{
+			DWC_DEBUGPL(DBG_HCDI,
+				    "DWC OTG HCD Finished Servicing Interrupts\n");
+			DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD gintsts=0x%08x\n",
+				    DWC_READ_REG32(&global_regs->gintsts));
+			DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD gintmsk=0x%08x\n",
+				    DWC_READ_REG32(&global_regs->gintmsk));
+		}
+#endif
+
+#ifdef DEBUG
+#ifndef DEBUG_SOF
+		if (gintsts.d32 != DWC_SOF_INTR_MASK)
+#endif
+			DWC_DEBUGPL(DBG_HCDI, "\n");
+#endif
+
+	}
+
+exit_handler_routine:
+	if (fiq_enable)	{
+		gintmsk_data_t gintmsk_new;
+		haintmsk_data_t haintmsk_new;
+		local_fiq_disable();
+		fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
+		gintmsk_new.d32 = *(volatile uint32_t *)&dwc_otg_hcd->fiq_state->gintmsk_saved.d32;
+		if(fiq_fsm_enable)
+			haintmsk_new.d32 = *(volatile uint32_t *)&dwc_otg_hcd->fiq_state->haintmsk_saved.d32;
+		else
+			haintmsk_new.d32 = 0x0000FFFF;
+
+		/* The FIQ could have sneaked another interrupt in. If so, don't clear MPHI */
+		if ((gintmsk_new.d32 == ~0) && (haintmsk_new.d32 == 0x0000FFFF)) {
+				DWC_WRITE_REG32(dwc_otg_hcd->fiq_state->mphi_regs.intstat, (1<<16));
+				if (dwc_otg_hcd->fiq_state->mphi_int_count >= 50) {
+					fiq_print(FIQDBG_INT, dwc_otg_hcd->fiq_state, "MPHI CLR");
+					DWC_WRITE_REG32(dwc_otg_hcd->fiq_state->mphi_regs.ctrl, ((1<<31) + (1<<16)));
+					while (!(DWC_READ_REG32(dwc_otg_hcd->fiq_state->mphi_regs.ctrl) & (1 << 17)))
+						;
+					DWC_WRITE_REG32(dwc_otg_hcd->fiq_state->mphi_regs.ctrl, (1<<31));
+					dwc_otg_hcd->fiq_state->mphi_int_count = 0;
+				}
+				int_done++;
+		}
+		haintmsk.d32 = DWC_READ_REG32(&core_if->host_if->host_global_regs->haintmsk);
+		/* Re-enable interrupts that the FIQ masked (first time round) */
+		FIQ_WRITE(dwc_otg_hcd->fiq_state->dwc_regs_base + GINTMSK, gintmsk.d32);
+		fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
+		local_fiq_enable();
+
+		if ((jiffies / HZ) > last_time) {
+			//dwc_otg_qh_t *qh;
+			//dwc_list_link_t *cur;
+			/* Once a second output the fiq and irq numbers, useful for debug */
+			last_time = jiffies / HZ;
+		//	 DWC_WARN("np_kick=%d AHC=%d sched_frame=%d cur_frame=%d int_done=%d fiq_done=%d",
+		//	dwc_otg_hcd->fiq_state->kick_np_queues, dwc_otg_hcd->available_host_channels,
+		//	dwc_otg_hcd->fiq_state->next_sched_frame, hfnum.b.frnum, int_done, dwc_otg_hcd->fiq_state->fiq_done);
+			 //printk(KERN_WARNING "Periodic queues:\n");
+		}
+	}
+
+	DWC_SPINUNLOCK(dwc_otg_hcd->lock);
+	return retval;
+}
+
+#ifdef DWC_TRACK_MISSED_SOFS
+
+#warning Compiling code to track missed SOFs
+#define FRAME_NUM_ARRAY_SIZE 1000
+/**
+ * This function is for debug only.
+ */
+static inline void track_missed_sofs(uint16_t curr_frame_number)
+{
+	static uint16_t frame_num_array[FRAME_NUM_ARRAY_SIZE];
+	static uint16_t last_frame_num_array[FRAME_NUM_ARRAY_SIZE];
+	static int frame_num_idx = 0;
+	static uint16_t last_frame_num = DWC_HFNUM_MAX_FRNUM;
+	static int dumped_frame_num_array = 0;
+
+	if (frame_num_idx < FRAME_NUM_ARRAY_SIZE) {
+		if (((last_frame_num + 1) & DWC_HFNUM_MAX_FRNUM) !=
+		    curr_frame_number) {
+			frame_num_array[frame_num_idx] = curr_frame_number;
+			last_frame_num_array[frame_num_idx++] = last_frame_num;
+		}
+	} else if (!dumped_frame_num_array) {
+		int i;
+		DWC_PRINTF("Frame     Last Frame\n");
+		DWC_PRINTF("-----     ----------\n");
+		for (i = 0; i < FRAME_NUM_ARRAY_SIZE; i++) {
+			DWC_PRINTF("0x%04x    0x%04x\n",
+				   frame_num_array[i], last_frame_num_array[i]);
+		}
+		dumped_frame_num_array = 1;
+	}
+	last_frame_num = curr_frame_number;
+}
+#endif
+
+/**
+ * Handles the start-of-frame interrupt in host mode. Non-periodic
+ * transactions may be queued to the DWC_otg controller for the current
+ * (micro)frame. Periodic transactions may be queued to the controller for the
+ * next (micro)frame.
+ */
+int32_t dwc_otg_hcd_handle_sof_intr(dwc_otg_hcd_t * hcd)
+{
+	hfnum_data_t hfnum;
+	gintsts_data_t gintsts = { .d32 = 0 };
+	dwc_list_link_t *qh_entry;
+	dwc_otg_qh_t *qh;
+	dwc_otg_transaction_type_e tr_type;
+	int did_something = 0;
+	int32_t next_sched_frame = -1;
+
+	hfnum.d32 =
+	    DWC_READ_REG32(&hcd->core_if->host_if->host_global_regs->hfnum);
+
+#ifdef DEBUG_SOF
+	DWC_DEBUGPL(DBG_HCD, "--Start of Frame Interrupt--\n");
+#endif
+	hcd->frame_number = hfnum.b.frnum;
+
+#ifdef DEBUG
+	hcd->frrem_accum += hfnum.b.frrem;
+	hcd->frrem_samples++;
+#endif
+
+#ifdef DWC_TRACK_MISSED_SOFS
+	track_missed_sofs(hcd->frame_number);
+#endif
+	/* Determine whether any periodic QHs should be executed. */
+	qh_entry = DWC_LIST_FIRST(&hcd->periodic_sched_inactive);
+	while (qh_entry != &hcd->periodic_sched_inactive) {
+		qh = DWC_LIST_ENTRY(qh_entry, dwc_otg_qh_t, qh_list_entry);
+		qh_entry = qh_entry->next;
+		if (dwc_frame_num_le(qh->sched_frame, hcd->frame_number)) {
+
+			/*
+			 * Move QH to the ready list to be executed next
+			 * (micro)frame.
+			 */
+			DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_ready,
+					   &qh->qh_list_entry);
+
+			did_something = 1;
+		}
+		else
+		{
+			if(next_sched_frame < 0 || dwc_frame_num_le(qh->sched_frame, next_sched_frame))
+			{
+				next_sched_frame = qh->sched_frame;
+			}
+		}
+	}
+	if (fiq_enable)
+		hcd->fiq_state->next_sched_frame = next_sched_frame;
+
+	tr_type = dwc_otg_hcd_select_transactions(hcd);
+	if (tr_type != DWC_OTG_TRANSACTION_NONE) {
+		dwc_otg_hcd_queue_transactions(hcd, tr_type);
+		did_something = 1;
+	}
+
+	/* Clear interrupt - but do not trample on the FIQ sof */
+	if (!fiq_fsm_enable) {
+		gintsts.b.sofintr = 1;
+		DWC_WRITE_REG32(&hcd->core_if->core_global_regs->gintsts, gintsts.d32);
+	}
+	return 1;
+}
+
+/** Handles the Rx Status Queue Level Interrupt, which indicates that there is at
+ * least one packet in the Rx FIFO.  The packets are moved from the FIFO to
+ * memory if the DWC_otg controller is operating in Slave mode. */
+int32_t dwc_otg_hcd_handle_rx_status_q_level_intr(dwc_otg_hcd_t * dwc_otg_hcd)
+{
+	host_grxsts_data_t grxsts;
+	dwc_hc_t *hc = NULL;
+
+	DWC_DEBUGPL(DBG_HCD, "--RxStsQ Level Interrupt--\n");
+
+	grxsts.d32 =
+	    DWC_READ_REG32(&dwc_otg_hcd->core_if->core_global_regs->grxstsp);
+
+	hc = dwc_otg_hcd->hc_ptr_array[grxsts.b.chnum];
+	if (!hc) {
+		DWC_ERROR("Unable to get corresponding channel\n");
+		return 0;
+	}
+
+	/* Packet Status */
+	DWC_DEBUGPL(DBG_HCDV, "    Ch num = %d\n", grxsts.b.chnum);
+	DWC_DEBUGPL(DBG_HCDV, "    Count = %d\n", grxsts.b.bcnt);
+	DWC_DEBUGPL(DBG_HCDV, "    DPID = %d, hc.dpid = %d\n", grxsts.b.dpid,
+		    hc->data_pid_start);
+	DWC_DEBUGPL(DBG_HCDV, "    PStatus = %d\n", grxsts.b.pktsts);
+
+	switch (grxsts.b.pktsts) {
+	case DWC_GRXSTS_PKTSTS_IN:
+		/* Read the data into the host buffer. */
+		if (grxsts.b.bcnt > 0) {
+			dwc_otg_read_packet(dwc_otg_hcd->core_if,
+					    hc->xfer_buff, grxsts.b.bcnt);
+
+			/* Update the HC fields for the next packet received. */
+			hc->xfer_count += grxsts.b.bcnt;
+			hc->xfer_buff += grxsts.b.bcnt;
+		}
+
+	case DWC_GRXSTS_PKTSTS_IN_XFER_COMP:
+	case DWC_GRXSTS_PKTSTS_DATA_TOGGLE_ERR:
+	case DWC_GRXSTS_PKTSTS_CH_HALTED:
+		/* Handled in interrupt, just ignore data */
+		break;
+	default:
+		DWC_ERROR("RX_STS_Q Interrupt: Unknown status %d\n",
+			  grxsts.b.pktsts);
+		break;
+	}
+
+	return 1;
+}
+
+/** This interrupt occurs when the non-periodic Tx FIFO is half-empty. More
+ * data packets may be written to the FIFO for OUT transfers. More requests
+ * may be written to the non-periodic request queue for IN transfers. This
+ * interrupt is enabled only in Slave mode. */
+int32_t dwc_otg_hcd_handle_np_tx_fifo_empty_intr(dwc_otg_hcd_t * dwc_otg_hcd)
+{
+	DWC_DEBUGPL(DBG_HCD, "--Non-Periodic TxFIFO Empty Interrupt--\n");
+	dwc_otg_hcd_queue_transactions(dwc_otg_hcd,
+				       DWC_OTG_TRANSACTION_NON_PERIODIC);
+	return 1;
+}
+
+/** This interrupt occurs when the periodic Tx FIFO is half-empty. More data
+ * packets may be written to the FIFO for OUT transfers. More requests may be
+ * written to the periodic request queue for IN transfers. This interrupt is
+ * enabled only in Slave mode. */
+int32_t dwc_otg_hcd_handle_perio_tx_fifo_empty_intr(dwc_otg_hcd_t * dwc_otg_hcd)
+{
+	DWC_DEBUGPL(DBG_HCD, "--Periodic TxFIFO Empty Interrupt--\n");
+	dwc_otg_hcd_queue_transactions(dwc_otg_hcd,
+				       DWC_OTG_TRANSACTION_PERIODIC);
+	return 1;
+}
+
+/** There are multiple conditions that can cause a port interrupt. This function
+ * determines which interrupt conditions have occurred and handles them
+ * appropriately. */
+int32_t dwc_otg_hcd_handle_port_intr(dwc_otg_hcd_t * dwc_otg_hcd)
+{
+	int retval = 0;
+	hprt0_data_t hprt0;
+	hprt0_data_t hprt0_modify;
+
+	hprt0.d32 = DWC_READ_REG32(dwc_otg_hcd->core_if->host_if->hprt0);
+	hprt0_modify.d32 = DWC_READ_REG32(dwc_otg_hcd->core_if->host_if->hprt0);
+
+	/* Clear appropriate bits in HPRT0 to clear the interrupt bit in
+	 * GINTSTS */
+
+	hprt0_modify.b.prtena = 0;
+	hprt0_modify.b.prtconndet = 0;
+	hprt0_modify.b.prtenchng = 0;
+	hprt0_modify.b.prtovrcurrchng = 0;
+
+	/* Port Connect Detected
+	 * Set flag and clear if detected */
+	if (dwc_otg_hcd->core_if->hibernation_suspend == 1) {
+		// Dont modify port status if we are in hibernation state
+		hprt0_modify.b.prtconndet = 1;
+		hprt0_modify.b.prtenchng = 1;
+		DWC_WRITE_REG32(dwc_otg_hcd->core_if->host_if->hprt0, hprt0_modify.d32);
+		hprt0.d32 = DWC_READ_REG32(dwc_otg_hcd->core_if->host_if->hprt0);
+		return retval;
+	}
+
+	if (hprt0.b.prtconndet) {
+		/** @todo - check if steps performed in 'else' block should be perfromed regardles adp */
+		if (dwc_otg_hcd->core_if->adp_enable &&
+				dwc_otg_hcd->core_if->adp.vbuson_timer_started == 1) {
+			DWC_PRINTF("PORT CONNECT DETECTED ----------------\n");
+			DWC_TIMER_CANCEL(dwc_otg_hcd->core_if->adp.vbuson_timer);
+			dwc_otg_hcd->core_if->adp.vbuson_timer_started = 0;
+			/* TODO - check if this is required, as
+			 * host initialization was already performed
+			 * after initial ADP probing
+			 */
+			/*dwc_otg_hcd->core_if->adp.vbuson_timer_started = 0;
+			dwc_otg_core_init(dwc_otg_hcd->core_if);
+			dwc_otg_enable_global_interrupts(dwc_otg_hcd->core_if);
+			cil_hcd_start(dwc_otg_hcd->core_if);*/
+		} else {
+
+			DWC_DEBUGPL(DBG_HCD, "--Port Interrupt HPRT0=0x%08x "
+				    "Port Connect Detected--\n", hprt0.d32);
+			dwc_otg_hcd->flags.b.port_connect_status_change = 1;
+			dwc_otg_hcd->flags.b.port_connect_status = 1;
+			hprt0_modify.b.prtconndet = 1;
+
+			/* B-Device has connected, Delete the connection timer. */
+			DWC_TIMER_CANCEL(dwc_otg_hcd->conn_timer);
+		}
+		/* The Hub driver asserts a reset when it sees port connect
+		 * status change flag */
+		retval |= 1;
+	}
+
+	/* Port Enable Changed
+	 * Clear if detected - Set internal flag if disabled */
+	if (hprt0.b.prtenchng) {
+		DWC_DEBUGPL(DBG_HCD, "  --Port Interrupt HPRT0=0x%08x "
+			    "Port Enable Changed--\n", hprt0.d32);
+		hprt0_modify.b.prtenchng = 1;
+		if (hprt0.b.prtena == 1) {
+			hfir_data_t hfir;
+			int do_reset = 0;
+			dwc_otg_core_params_t *params =
+			    dwc_otg_hcd->core_if->core_params;
+			dwc_otg_core_global_regs_t *global_regs =
+			    dwc_otg_hcd->core_if->core_global_regs;
+			dwc_otg_host_if_t *host_if =
+			    dwc_otg_hcd->core_if->host_if;
+
+			dwc_otg_hcd->flags.b.port_speed = hprt0.b.prtspd;
+			if (microframe_schedule)
+				init_hcd_usecs(dwc_otg_hcd);
+
+			/* Every time when port enables calculate
+			 * HFIR.FrInterval
+			 */
+			hfir.d32 = DWC_READ_REG32(&host_if->host_global_regs->hfir);
+			hfir.b.frint = calc_frame_interval(dwc_otg_hcd->core_if);
+			DWC_WRITE_REG32(&host_if->host_global_regs->hfir, hfir.d32);
+
+			/* Check if we need to adjust the PHY clock speed for
+			 * low power and adjust it */
+			if (params->host_support_fs_ls_low_power) {
+				gusbcfg_data_t usbcfg;
+
+				usbcfg.d32 =
+				    DWC_READ_REG32(&global_regs->gusbcfg);
+
+				if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_LOW_SPEED
+				    || hprt0.b.prtspd ==
+				    DWC_HPRT0_PRTSPD_FULL_SPEED) {
+					/*
+					 * Low power
+					 */
+					hcfg_data_t hcfg;
+					if (usbcfg.b.phylpwrclksel == 0) {
+						/* Set PHY low power clock select for FS/LS devices */
+						usbcfg.b.phylpwrclksel = 1;
+						DWC_WRITE_REG32
+						    (&global_regs->gusbcfg,
+						     usbcfg.d32);
+						do_reset = 1;
+					}
+
+					hcfg.d32 =
+					    DWC_READ_REG32
+					    (&host_if->host_global_regs->hcfg);
+
+					if (hprt0.b.prtspd ==
+					    DWC_HPRT0_PRTSPD_LOW_SPEED
+					    && params->host_ls_low_power_phy_clk
+					    ==
+					    DWC_HOST_LS_LOW_POWER_PHY_CLK_PARAM_6MHZ)
+					{
+						/* 6 MHZ */
+						DWC_DEBUGPL(DBG_CIL,
+							    "FS_PHY programming HCFG to 6 MHz (Low Power)\n");
+						if (hcfg.b.fslspclksel !=
+						    DWC_HCFG_6_MHZ) {
+							hcfg.b.fslspclksel =
+							    DWC_HCFG_6_MHZ;
+							DWC_WRITE_REG32
+							    (&host_if->host_global_regs->hcfg,
+							     hcfg.d32);
+							do_reset = 1;
+						}
+					} else {
+						/* 48 MHZ */
+						DWC_DEBUGPL(DBG_CIL,
+							    "FS_PHY programming HCFG to 48 MHz ()\n");
+						if (hcfg.b.fslspclksel !=
+						    DWC_HCFG_48_MHZ) {
+							hcfg.b.fslspclksel =
+							    DWC_HCFG_48_MHZ;
+							DWC_WRITE_REG32
+							    (&host_if->host_global_regs->hcfg,
+							     hcfg.d32);
+							do_reset = 1;
+						}
+					}
+				} else {
+					/*
+					 * Not low power
+					 */
+					if (usbcfg.b.phylpwrclksel == 1) {
+						usbcfg.b.phylpwrclksel = 0;
+						DWC_WRITE_REG32
+						    (&global_regs->gusbcfg,
+						     usbcfg.d32);
+						do_reset = 1;
+					}
+				}
+
+				if (do_reset) {
+					DWC_TASK_SCHEDULE(dwc_otg_hcd->reset_tasklet);
+				}
+			}
+
+			if (!do_reset) {
+				/* Port has been enabled set the reset change flag */
+				dwc_otg_hcd->flags.b.port_reset_change = 1;
+			}
+		} else {
+			dwc_otg_hcd->flags.b.port_enable_change = 1;
+		}
+		retval |= 1;
+	}
+
+	/** Overcurrent Change Interrupt */
+	if (hprt0.b.prtovrcurrchng) {
+		DWC_DEBUGPL(DBG_HCD, "  --Port Interrupt HPRT0=0x%08x "
+			    "Port Overcurrent Changed--\n", hprt0.d32);
+		dwc_otg_hcd->flags.b.port_over_current_change = 1;
+		hprt0_modify.b.prtovrcurrchng = 1;
+		retval |= 1;
+	}
+
+	/* Clear Port Interrupts */
+	DWC_WRITE_REG32(dwc_otg_hcd->core_if->host_if->hprt0, hprt0_modify.d32);
+
+	return retval;
+}
+
+/** This interrupt indicates that one or more host channels has a pending
+ * interrupt. There are multiple conditions that can cause each host channel
+ * interrupt. This function determines which conditions have occurred for each
+ * host channel interrupt and handles them appropriately. */
+int32_t dwc_otg_hcd_handle_hc_intr(dwc_otg_hcd_t * dwc_otg_hcd)
+{
+	int i;
+	int retval = 0;
+	haint_data_t haint = { .d32 = 0 } ;
+
+	/* Clear appropriate bits in HCINTn to clear the interrupt bit in
+	 * GINTSTS */
+
+	if (!fiq_fsm_enable)
+		haint.d32 = dwc_otg_read_host_all_channels_intr(dwc_otg_hcd->core_if);
+
+	// Overwrite with saved interrupts from fiq handler
+	if(fiq_fsm_enable)
+	{
+		/* check the mask? */
+		local_fiq_disable();
+		fiq_fsm_spin_lock(&dwc_otg_hcd->fiq_state->lock);
+		haint.b2.chint |= ~(dwc_otg_hcd->fiq_state->haintmsk_saved.b2.chint);
+		dwc_otg_hcd->fiq_state->haintmsk_saved.b2.chint = ~0;
+		fiq_fsm_spin_unlock(&dwc_otg_hcd->fiq_state->lock);
+		local_fiq_enable();
+	}
+
+	for (i = 0; i < dwc_otg_hcd->core_if->core_params->host_channels; i++) {
+		if (haint.b2.chint & (1 << i)) {
+			retval |= dwc_otg_hcd_handle_hc_n_intr(dwc_otg_hcd, i);
+		}
+	}
+
+	return retval;
+}
+
+/**
+ * Gets the actual length of a transfer after the transfer halts. _halt_status
+ * holds the reason for the halt.
+ *
+ * For IN transfers where halt_status is DWC_OTG_HC_XFER_COMPLETE,
+ * *short_read is set to 1 upon return if less than the requested
+ * number of bytes were transferred. Otherwise, *short_read is set to 0 upon
+ * return. short_read may also be NULL on entry, in which case it remains
+ * unchanged.
+ */
+static uint32_t get_actual_xfer_length(dwc_hc_t * hc,
+				       dwc_otg_hc_regs_t * hc_regs,
+				       dwc_otg_qtd_t * qtd,
+				       dwc_otg_halt_status_e halt_status,
+				       int *short_read)
+{
+	hctsiz_data_t hctsiz;
+	uint32_t length;
+
+	if (short_read != NULL) {
+		*short_read = 0;
+	}
+	hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
+
+	if (halt_status == DWC_OTG_HC_XFER_COMPLETE) {
+		if (hc->ep_is_in) {
+			length = hc->xfer_len - hctsiz.b.xfersize;
+			if (short_read != NULL) {
+				*short_read = (hctsiz.b.xfersize != 0);
+			}
+		} else if (hc->qh->do_split) {
+				//length = split_out_xfersize[hc->hc_num];
+				length = qtd->ssplit_out_xfer_count;
+		} else {
+			length = hc->xfer_len;
+		}
+	} else {
+		/*
+		 * Must use the hctsiz.pktcnt field to determine how much data
+		 * has been transferred. This field reflects the number of
+		 * packets that have been transferred via the USB. This is
+		 * always an integral number of packets if the transfer was
+		 * halted before its normal completion. (Can't use the
+		 * hctsiz.xfersize field because that reflects the number of
+		 * bytes transferred via the AHB, not the USB).
+		 */
+		length =
+		    (hc->start_pkt_count - hctsiz.b.pktcnt) * hc->max_packet;
+	}
+
+	return length;
+}
+
+/**
+ * Updates the state of the URB after a Transfer Complete interrupt on the
+ * host channel. Updates the actual_length field of the URB based on the
+ * number of bytes transferred via the host channel. Sets the URB status
+ * if the data transfer is finished.
+ *
+ * @return 1 if the data transfer specified by the URB is completely finished,
+ * 0 otherwise.
+ */
+static int update_urb_state_xfer_comp(dwc_hc_t * hc,
+				      dwc_otg_hc_regs_t * hc_regs,
+				      dwc_otg_hcd_urb_t * urb,
+				      dwc_otg_qtd_t * qtd)
+{
+	int xfer_done = 0;
+	int short_read = 0;
+
+	int xfer_length;
+
+	xfer_length = get_actual_xfer_length(hc, hc_regs, qtd,
+					     DWC_OTG_HC_XFER_COMPLETE,
+					     &short_read);
+
+	if (urb->actual_length + xfer_length > urb->length) {
+		printk_once(KERN_DEBUG "dwc_otg: DEVICE:%03d : %s:%d:trimming xfer length\n",
+			hc->dev_addr, __func__, __LINE__);
+		xfer_length = urb->length - urb->actual_length;
+	}
+
+	/* non DWORD-aligned buffer case handling. */
+	if (hc->align_buff && xfer_length && hc->ep_is_in) {
+		dwc_memcpy(urb->buf + urb->actual_length, hc->qh->dw_align_buf,
+			   xfer_length);
+	}
+
+	urb->actual_length += xfer_length;
+
+	if (xfer_length && (hc->ep_type == DWC_OTG_EP_TYPE_BULK) &&
+	    (urb->flags & URB_SEND_ZERO_PACKET)
+	    && (urb->actual_length == urb->length)
+	    && !(urb->length % hc->max_packet)) {
+		xfer_done = 0;
+	} else if (short_read || urb->actual_length >= urb->length) {
+		xfer_done = 1;
+		urb->status = 0;
+	}
+
+#ifdef DEBUG
+	{
+		hctsiz_data_t hctsiz;
+		hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
+		DWC_DEBUGPL(DBG_HCDV, "DWC_otg: %s: %s, channel %d\n",
+			    __func__, (hc->ep_is_in ? "IN" : "OUT"),
+			    hc->hc_num);
+		DWC_DEBUGPL(DBG_HCDV, "  hc->xfer_len %d\n", hc->xfer_len);
+		DWC_DEBUGPL(DBG_HCDV, "  hctsiz.xfersize %d\n",
+			    hctsiz.b.xfersize);
+		DWC_DEBUGPL(DBG_HCDV, "  urb->transfer_buffer_length %d\n",
+			    urb->length);
+		DWC_DEBUGPL(DBG_HCDV, "  urb->actual_length %d\n",
+			    urb->actual_length);
+		DWC_DEBUGPL(DBG_HCDV, "  short_read %d, xfer_done %d\n",
+			    short_read, xfer_done);
+	}
+#endif
+
+	return xfer_done;
+}
+
+/*
+ * Save the starting data toggle for the next transfer. The data toggle is
+ * saved in the QH for non-control transfers and it's saved in the QTD for
+ * control transfers.
+ */
+void dwc_otg_hcd_save_data_toggle(dwc_hc_t * hc,
+			     dwc_otg_hc_regs_t * hc_regs, dwc_otg_qtd_t * qtd)
+{
+	hctsiz_data_t hctsiz;
+	hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
+
+	if (hc->ep_type != DWC_OTG_EP_TYPE_CONTROL) {
+		dwc_otg_qh_t *qh = hc->qh;
+		if (hctsiz.b.pid == DWC_HCTSIZ_DATA0) {
+			qh->data_toggle = DWC_OTG_HC_PID_DATA0;
+		} else {
+			qh->data_toggle = DWC_OTG_HC_PID_DATA1;
+		}
+	} else {
+		if (hctsiz.b.pid == DWC_HCTSIZ_DATA0) {
+			qtd->data_toggle = DWC_OTG_HC_PID_DATA0;
+		} else {
+			qtd->data_toggle = DWC_OTG_HC_PID_DATA1;
+		}
+	}
+}
+
+/**
+ * Updates the state of an Isochronous URB when the transfer is stopped for
+ * any reason. The fields of the current entry in the frame descriptor array
+ * are set based on the transfer state and the input _halt_status. Completes
+ * the Isochronous URB if all the URB frames have been completed.
+ *
+ * @return DWC_OTG_HC_XFER_COMPLETE if there are more frames remaining to be
+ * transferred in the URB. Otherwise return DWC_OTG_HC_XFER_URB_COMPLETE.
+ */
+static dwc_otg_halt_status_e
+update_isoc_urb_state(dwc_otg_hcd_t * hcd,
+		      dwc_hc_t * hc,
+		      dwc_otg_hc_regs_t * hc_regs,
+		      dwc_otg_qtd_t * qtd, dwc_otg_halt_status_e halt_status)
+{
+	dwc_otg_hcd_urb_t *urb = qtd->urb;
+	dwc_otg_halt_status_e ret_val = halt_status;
+	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
+
+	frame_desc = &urb->iso_descs[qtd->isoc_frame_index];
+	switch (halt_status) {
+	case DWC_OTG_HC_XFER_COMPLETE:
+		frame_desc->status = 0;
+		frame_desc->actual_length =
+		    get_actual_xfer_length(hc, hc_regs, qtd, halt_status, NULL);
+
+		/* non DWORD-aligned buffer case handling. */
+		if (hc->align_buff && frame_desc->actual_length && hc->ep_is_in) {
+			dwc_memcpy(urb->buf + frame_desc->offset + qtd->isoc_split_offset,
+				   hc->qh->dw_align_buf, frame_desc->actual_length);
+		}
+
+		break;
+	case DWC_OTG_HC_XFER_FRAME_OVERRUN:
+		urb->error_count++;
+		if (hc->ep_is_in) {
+			frame_desc->status = -DWC_E_NO_STREAM_RES;
+		} else {
+			frame_desc->status = -DWC_E_COMMUNICATION;
+		}
+		frame_desc->actual_length = 0;
+		break;
+	case DWC_OTG_HC_XFER_BABBLE_ERR:
+		urb->error_count++;
+		frame_desc->status = -DWC_E_OVERFLOW;
+		/* Don't need to update actual_length in this case. */
+		break;
+	case DWC_OTG_HC_XFER_XACT_ERR:
+		urb->error_count++;
+		frame_desc->status = -DWC_E_PROTOCOL;
+		frame_desc->actual_length =
+		    get_actual_xfer_length(hc, hc_regs, qtd, halt_status, NULL);
+
+		/* non DWORD-aligned buffer case handling. */
+		if (hc->align_buff && frame_desc->actual_length && hc->ep_is_in) {
+			dwc_memcpy(urb->buf + frame_desc->offset + qtd->isoc_split_offset,
+				   hc->qh->dw_align_buf, frame_desc->actual_length);
+		}
+		/* Skip whole frame */
+		if (hc->qh->do_split && (hc->ep_type == DWC_OTG_EP_TYPE_ISOC) &&
+		    hc->ep_is_in && hcd->core_if->dma_enable) {
+			qtd->complete_split = 0;
+			qtd->isoc_split_offset = 0;
+		}
+
+		break;
+	default:
+		DWC_ASSERT(1, "Unhandled _halt_status (%d)\n", halt_status);
+		break;
+	}
+	if (++qtd->isoc_frame_index == urb->packet_count) {
+		/*
+		 * urb->status is not used for isoc transfers.
+		 * The individual frame_desc statuses are used instead.
+		 */
+		hcd->fops->complete(hcd, urb->priv, urb, 0);
+		ret_val = DWC_OTG_HC_XFER_URB_COMPLETE;
+	} else {
+		ret_val = DWC_OTG_HC_XFER_COMPLETE;
+	}
+	return ret_val;
+}
+
+/**
+ * Frees the first QTD in the QH's list if free_qtd is 1. For non-periodic
+ * QHs, removes the QH from the active non-periodic schedule. If any QTDs are
+ * still linked to the QH, the QH is added to the end of the inactive
+ * non-periodic schedule. For periodic QHs, removes the QH from the periodic
+ * schedule if no more QTDs are linked to the QH.
+ */
+static void deactivate_qh(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh, int free_qtd)
+{
+	int continue_split = 0;
+	dwc_otg_qtd_t *qtd;
+
+	DWC_DEBUGPL(DBG_HCDV, "  %s(%p,%p,%d)\n", __func__, hcd, qh, free_qtd);
+
+	qtd = DWC_CIRCLEQ_FIRST(&qh->qtd_list);
+
+	if (qtd->complete_split) {
+		continue_split = 1;
+	} else if (qtd->isoc_split_pos == DWC_HCSPLIT_XACTPOS_MID ||
+		   qtd->isoc_split_pos == DWC_HCSPLIT_XACTPOS_END) {
+		continue_split = 1;
+	}
+
+	if (free_qtd) {
+		dwc_otg_hcd_qtd_remove_and_free(hcd, qtd, qh);
+		continue_split = 0;
+	}
+
+	qh->channel = NULL;
+	dwc_otg_hcd_qh_deactivate(hcd, qh, continue_split);
+}
+
+/**
+ * Releases a host channel for use by other transfers. Attempts to select and
+ * queue more transactions since at least one host channel is available.
+ *
+ * @param hcd The HCD state structure.
+ * @param hc The host channel to release.
+ * @param qtd The QTD associated with the host channel. This QTD may be freed
+ * if the transfer is complete or an error has occurred.
+ * @param halt_status Reason the channel is being released. This status
+ * determines the actions taken by this function.
+ */
+static void release_channel(dwc_otg_hcd_t * hcd,
+			    dwc_hc_t * hc,
+			    dwc_otg_qtd_t * qtd,
+			    dwc_otg_halt_status_e halt_status)
+{
+	dwc_otg_transaction_type_e tr_type;
+	int free_qtd;
+
+	int hog_port = 0;
+
+	DWC_DEBUGPL(DBG_HCDV, "  %s: channel %d, halt_status %d, xfer_len %d\n",
+		    __func__, hc->hc_num, halt_status, hc->xfer_len);
+
+	if(fiq_fsm_enable && hc->do_split) {
+		if(!hc->ep_is_in && hc->ep_type == UE_ISOCHRONOUS) {
+			if(hc->xact_pos == DWC_HCSPLIT_XACTPOS_MID ||
+					hc->xact_pos == DWC_HCSPLIT_XACTPOS_BEGIN) {
+				hog_port = 0;
+			}
+		}
+	}
+
+	switch (halt_status) {
+	case DWC_OTG_HC_XFER_URB_COMPLETE:
+		free_qtd = 1;
+		break;
+	case DWC_OTG_HC_XFER_AHB_ERR:
+	case DWC_OTG_HC_XFER_STALL:
+	case DWC_OTG_HC_XFER_BABBLE_ERR:
+		free_qtd = 1;
+		break;
+	case DWC_OTG_HC_XFER_XACT_ERR:
+		if (qtd->error_count >= 3) {
+			DWC_DEBUGPL(DBG_HCDV,
+				    "  Complete URB with transaction error\n");
+			free_qtd = 1;
+			qtd->urb->status = -DWC_E_PROTOCOL;
+			hcd->fops->complete(hcd, qtd->urb->priv,
+					    qtd->urb, -DWC_E_PROTOCOL);
+		} else {
+			free_qtd = 0;
+		}
+		break;
+	case DWC_OTG_HC_XFER_URB_DEQUEUE:
+		/*
+		 * The QTD has already been removed and the QH has been
+		 * deactivated. Don't want to do anything except release the
+		 * host channel and try to queue more transfers.
+		 */
+		goto cleanup;
+	case DWC_OTG_HC_XFER_NO_HALT_STATUS:
+		free_qtd = 0;
+		break;
+	case DWC_OTG_HC_XFER_PERIODIC_INCOMPLETE:
+		DWC_DEBUGPL(DBG_HCDV,
+			"  Complete URB with I/O error\n");
+		free_qtd = 1;
+		qtd->urb->status = -DWC_E_IO;
+		hcd->fops->complete(hcd, qtd->urb->priv,
+			qtd->urb, -DWC_E_IO);
+		break;
+	default:
+		free_qtd = 0;
+		break;
+	}
+
+	deactivate_qh(hcd, hc->qh, free_qtd);
+
+cleanup:
+	/*
+	 * Release the host channel for use by other transfers. The cleanup
+	 * function clears the channel interrupt enables and conditions, so
+	 * there's no need to clear the Channel Halted interrupt separately.
+	 */
+	if (fiq_fsm_enable && hcd->fiq_state->channel[hc->hc_num].fsm != FIQ_PASSTHROUGH)
+		dwc_otg_cleanup_fiq_channel(hcd, hc->hc_num);
+	dwc_otg_hc_cleanup(hcd->core_if, hc);
+	DWC_CIRCLEQ_INSERT_TAIL(&hcd->free_hc_list, hc, hc_list_entry);
+
+	if (!microframe_schedule) {
+		switch (hc->ep_type) {
+		case DWC_OTG_EP_TYPE_CONTROL:
+		case DWC_OTG_EP_TYPE_BULK:
+			hcd->non_periodic_channels--;
+			break;
+
+		default:
+			/*
+			 * Don't release reservations for periodic channels here.
+			 * That's done when a periodic transfer is descheduled (i.e.
+			 * when the QH is removed from the periodic schedule).
+			 */
+			break;
+		}
+	} else {
+		hcd->available_host_channels++;
+		fiq_print(FIQDBG_INT, hcd->fiq_state, "AHC = %d ", hcd->available_host_channels);
+	}
+
+	/* Try to queue more transfers now that there's a free channel. */
+	tr_type = dwc_otg_hcd_select_transactions(hcd);
+	if (tr_type != DWC_OTG_TRANSACTION_NONE) {
+		dwc_otg_hcd_queue_transactions(hcd, tr_type);
+	}
+}
+
+/**
+ * Halts a host channel. If the channel cannot be halted immediately because
+ * the request queue is full, this function ensures that the FIFO empty
+ * interrupt for the appropriate queue is enabled so that the halt request can
+ * be queued when there is space in the request queue.
+ *
+ * This function may also be called in DMA mode. In that case, the channel is
+ * simply released since the core always halts the channel automatically in
+ * DMA mode.
+ */
+static void halt_channel(dwc_otg_hcd_t * hcd,
+			 dwc_hc_t * hc,
+			 dwc_otg_qtd_t * qtd, dwc_otg_halt_status_e halt_status)
+{
+	if (hcd->core_if->dma_enable) {
+		release_channel(hcd, hc, qtd, halt_status);
+		return;
+	}
+
+	/* Slave mode processing... */
+	dwc_otg_hc_halt(hcd->core_if, hc, halt_status);
+
+	if (hc->halt_on_queue) {
+		gintmsk_data_t gintmsk = {.d32 = 0 };
+		dwc_otg_core_global_regs_t *global_regs;
+		global_regs = hcd->core_if->core_global_regs;
+
+		if (hc->ep_type == DWC_OTG_EP_TYPE_CONTROL ||
+		    hc->ep_type == DWC_OTG_EP_TYPE_BULK) {
+			/*
+			 * Make sure the Non-periodic Tx FIFO empty interrupt
+			 * is enabled so that the non-periodic schedule will
+			 * be processed.
+			 */
+			gintmsk.b.nptxfempty = 1;
+			if (fiq_enable) {
+				local_fiq_disable();
+				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+				DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmsk.d32);
+				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+				local_fiq_enable();
+			} else {
+				DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmsk.d32);
+			}
+		} else {
+			/*
+			 * Move the QH from the periodic queued schedule to
+			 * the periodic assigned schedule. This allows the
+			 * halt to be queued when the periodic schedule is
+			 * processed.
+			 */
+			DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_assigned,
+					   &hc->qh->qh_list_entry);
+
+			/*
+			 * Make sure the Periodic Tx FIFO Empty interrupt is
+			 * enabled so that the periodic schedule will be
+			 * processed.
+			 */
+			gintmsk.b.ptxfempty = 1;
+			if (fiq_enable) {
+				local_fiq_disable();
+				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+				DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmsk.d32);
+				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+				local_fiq_enable();
+			} else {
+				DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmsk.d32);
+			}
+		}
+	}
+}
+
+/**
+ * Performs common cleanup for non-periodic transfers after a Transfer
+ * Complete interrupt. This function should be called after any endpoint type
+ * specific handling is finished to release the host channel.
+ */
+static void complete_non_periodic_xfer(dwc_otg_hcd_t * hcd,
+				       dwc_hc_t * hc,
+				       dwc_otg_hc_regs_t * hc_regs,
+				       dwc_otg_qtd_t * qtd,
+				       dwc_otg_halt_status_e halt_status)
+{
+	hcint_data_t hcint;
+
+	qtd->error_count = 0;
+
+	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+	if (hcint.b.nyet) {
+		/*
+		 * Got a NYET on the last transaction of the transfer. This
+		 * means that the endpoint should be in the PING state at the
+		 * beginning of the next transfer.
+		 */
+		hc->qh->ping_state = 1;
+		clear_hc_int(hc_regs, nyet);
+	}
+
+	/*
+	 * Always halt and release the host channel to make it available for
+	 * more transfers. There may still be more phases for a control
+	 * transfer or more data packets for a bulk transfer at this point,
+	 * but the host channel is still halted. A channel will be reassigned
+	 * to the transfer when the non-periodic schedule is processed after
+	 * the channel is released. This allows transactions to be queued
+	 * properly via dwc_otg_hcd_queue_transactions, which also enables the
+	 * Tx FIFO Empty interrupt if necessary.
+	 */
+	if (hc->ep_is_in) {
+		/*
+		 * IN transfers in Slave mode require an explicit disable to
+		 * halt the channel. (In DMA mode, this call simply releases
+		 * the channel.)
+		 */
+		halt_channel(hcd, hc, qtd, halt_status);
+	} else {
+		/*
+		 * The channel is automatically disabled by the core for OUT
+		 * transfers in Slave mode.
+		 */
+		release_channel(hcd, hc, qtd, halt_status);
+	}
+}
+
+/**
+ * Performs common cleanup for periodic transfers after a Transfer Complete
+ * interrupt. This function should be called after any endpoint type specific
+ * handling is finished to release the host channel.
+ */
+static void complete_periodic_xfer(dwc_otg_hcd_t * hcd,
+				   dwc_hc_t * hc,
+				   dwc_otg_hc_regs_t * hc_regs,
+				   dwc_otg_qtd_t * qtd,
+				   dwc_otg_halt_status_e halt_status)
+{
+	hctsiz_data_t hctsiz;
+	qtd->error_count = 0;
+
+	hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
+	if (!hc->ep_is_in || hctsiz.b.pktcnt == 0) {
+		/* Core halts channel in these cases. */
+		release_channel(hcd, hc, qtd, halt_status);
+	} else {
+		/* Flush any outstanding requests from the Tx queue. */
+		halt_channel(hcd, hc, qtd, halt_status);
+	}
+}
+
+static int32_t handle_xfercomp_isoc_split_in(dwc_otg_hcd_t * hcd,
+					     dwc_hc_t * hc,
+					     dwc_otg_hc_regs_t * hc_regs,
+					     dwc_otg_qtd_t * qtd)
+{
+	uint32_t len;
+	struct dwc_otg_hcd_iso_packet_desc *frame_desc;
+	frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
+
+	len = get_actual_xfer_length(hc, hc_regs, qtd,
+				     DWC_OTG_HC_XFER_COMPLETE, NULL);
+
+	if (!len) {
+		qtd->complete_split = 0;
+		qtd->isoc_split_offset = 0;
+		return 0;
+	}
+	frame_desc->actual_length += len;
+
+	if (hc->align_buff && len)
+		dwc_memcpy(qtd->urb->buf + frame_desc->offset +
+			   qtd->isoc_split_offset, hc->qh->dw_align_buf, len);
+	qtd->isoc_split_offset += len;
+
+	if (frame_desc->length == frame_desc->actual_length) {
+		frame_desc->status = 0;
+		qtd->isoc_frame_index++;
+		qtd->complete_split = 0;
+		qtd->isoc_split_offset = 0;
+	}
+
+	if (qtd->isoc_frame_index == qtd->urb->packet_count) {
+		hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
+		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+	} else {
+		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+	}
+
+	return 1;		/* Indicates that channel released */
+}
+
+/**
+ * Handles a host channel Transfer Complete interrupt. This handler may be
+ * called in either DMA mode or Slave mode.
+ */
+static int32_t handle_hc_xfercomp_intr(dwc_otg_hcd_t * hcd,
+				       dwc_hc_t * hc,
+				       dwc_otg_hc_regs_t * hc_regs,
+				       dwc_otg_qtd_t * qtd)
+{
+	int urb_xfer_done;
+	dwc_otg_halt_status_e halt_status = DWC_OTG_HC_XFER_COMPLETE;
+	dwc_otg_hcd_urb_t *urb = qtd->urb;
+	int pipe_type = dwc_otg_hcd_get_pipe_type(&urb->pipe_info);
+
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		    "Transfer Complete--\n", hc->hc_num);
+
+	if (hcd->core_if->dma_desc_enable) {
+		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs, halt_status);
+		if (pipe_type == UE_ISOCHRONOUS) {
+			/* Do not disable the interrupt, just clear it */
+			clear_hc_int(hc_regs, xfercomp);
+			return 1;
+		}
+		goto handle_xfercomp_done;
+	}
+
+	/*
+	 * Handle xfer complete on CSPLIT.
+	 */
+
+	if (hc->qh->do_split) {
+		if ((hc->ep_type == DWC_OTG_EP_TYPE_ISOC) && hc->ep_is_in
+		    && hcd->core_if->dma_enable) {
+			if (qtd->complete_split
+			    && handle_xfercomp_isoc_split_in(hcd, hc, hc_regs,
+							     qtd))
+				goto handle_xfercomp_done;
+		} else {
+			qtd->complete_split = 0;
+		}
+	}
+
+	/* Update the QTD and URB states. */
+	switch (pipe_type) {
+	case UE_CONTROL:
+		switch (qtd->control_phase) {
+		case DWC_OTG_CONTROL_SETUP:
+			if (urb->length > 0) {
+				qtd->control_phase = DWC_OTG_CONTROL_DATA;
+			} else {
+				qtd->control_phase = DWC_OTG_CONTROL_STATUS;
+			}
+			DWC_DEBUGPL(DBG_HCDV,
+				    "  Control setup transaction done\n");
+			halt_status = DWC_OTG_HC_XFER_COMPLETE;
+			break;
+		case DWC_OTG_CONTROL_DATA:{
+				urb_xfer_done =
+				    update_urb_state_xfer_comp(hc, hc_regs, urb,
+							       qtd);
+				if (urb_xfer_done) {
+					qtd->control_phase =
+					    DWC_OTG_CONTROL_STATUS;
+					DWC_DEBUGPL(DBG_HCDV,
+						    "  Control data transfer done\n");
+				} else {
+					dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+				}
+				halt_status = DWC_OTG_HC_XFER_COMPLETE;
+				break;
+			}
+		case DWC_OTG_CONTROL_STATUS:
+			DWC_DEBUGPL(DBG_HCDV, "  Control transfer complete\n");
+			if (urb->status == -DWC_E_IN_PROGRESS) {
+				urb->status = 0;
+			}
+			hcd->fops->complete(hcd, urb->priv, urb, urb->status);
+			halt_status = DWC_OTG_HC_XFER_URB_COMPLETE;
+			break;
+		}
+
+		complete_non_periodic_xfer(hcd, hc, hc_regs, qtd, halt_status);
+		break;
+	case UE_BULK:
+		DWC_DEBUGPL(DBG_HCDV, "  Bulk transfer complete\n");
+		urb_xfer_done =
+		    update_urb_state_xfer_comp(hc, hc_regs, urb, qtd);
+		if (urb_xfer_done) {
+			hcd->fops->complete(hcd, urb->priv, urb, urb->status);
+			halt_status = DWC_OTG_HC_XFER_URB_COMPLETE;
+		} else {
+			halt_status = DWC_OTG_HC_XFER_COMPLETE;
+		}
+
+		dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+		complete_non_periodic_xfer(hcd, hc, hc_regs, qtd, halt_status);
+		break;
+	case UE_INTERRUPT:
+		DWC_DEBUGPL(DBG_HCDV, "  Interrupt transfer complete\n");
+		urb_xfer_done =
+			update_urb_state_xfer_comp(hc, hc_regs, urb, qtd);
+
+		/*
+		 * Interrupt URB is done on the first transfer complete
+		 * interrupt.
+		 */
+		if (urb_xfer_done) {
+				hcd->fops->complete(hcd, urb->priv, urb, urb->status);
+				halt_status = DWC_OTG_HC_XFER_URB_COMPLETE;
+		} else {
+				halt_status = DWC_OTG_HC_XFER_COMPLETE;
+		}
+
+		dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+		complete_periodic_xfer(hcd, hc, hc_regs, qtd, halt_status);
+		break;
+	case UE_ISOCHRONOUS:
+		DWC_DEBUGPL(DBG_HCDV, "  Isochronous transfer complete\n");
+		if (qtd->isoc_split_pos == DWC_HCSPLIT_XACTPOS_ALL) {
+			halt_status =
+			    update_isoc_urb_state(hcd, hc, hc_regs, qtd,
+						  DWC_OTG_HC_XFER_COMPLETE);
+		}
+		complete_periodic_xfer(hcd, hc, hc_regs, qtd, halt_status);
+		break;
+	}
+
+handle_xfercomp_done:
+	disable_hc_int(hc_regs, xfercompl);
+
+	return 1;
+}
+
+/**
+ * Handles a host channel STALL interrupt. This handler may be called in
+ * either DMA mode or Slave mode.
+ */
+static int32_t handle_hc_stall_intr(dwc_otg_hcd_t * hcd,
+				    dwc_hc_t * hc,
+				    dwc_otg_hc_regs_t * hc_regs,
+				    dwc_otg_qtd_t * qtd)
+{
+	dwc_otg_hcd_urb_t *urb = qtd->urb;
+	int pipe_type = dwc_otg_hcd_get_pipe_type(&urb->pipe_info);
+
+	DWC_DEBUGPL(DBG_HCD, "--Host Channel %d Interrupt: "
+		    "STALL Received--\n", hc->hc_num);
+
+	if (hcd->core_if->dma_desc_enable) {
+		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs, DWC_OTG_HC_XFER_STALL);
+		goto handle_stall_done;
+	}
+
+	if (pipe_type == UE_CONTROL) {
+		hcd->fops->complete(hcd, urb->priv, urb, -DWC_E_PIPE);
+	}
+
+	if (pipe_type == UE_BULK || pipe_type == UE_INTERRUPT) {
+		hcd->fops->complete(hcd, urb->priv, urb, -DWC_E_PIPE);
+		/*
+		 * USB protocol requires resetting the data toggle for bulk
+		 * and interrupt endpoints when a CLEAR_FEATURE(ENDPOINT_HALT)
+		 * setup command is issued to the endpoint. Anticipate the
+		 * CLEAR_FEATURE command since a STALL has occurred and reset
+		 * the data toggle now.
+		 */
+		hc->qh->data_toggle = 0;
+	}
+
+	halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_STALL);
+
+handle_stall_done:
+	disable_hc_int(hc_regs, stall);
+
+	return 1;
+}
+
+/*
+ * Updates the state of the URB when a transfer has been stopped due to an
+ * abnormal condition before the transfer completes. Modifies the
+ * actual_length field of the URB to reflect the number of bytes that have
+ * actually been transferred via the host channel.
+ */
+static void update_urb_state_xfer_intr(dwc_hc_t * hc,
+				       dwc_otg_hc_regs_t * hc_regs,
+				       dwc_otg_hcd_urb_t * urb,
+				       dwc_otg_qtd_t * qtd,
+				       dwc_otg_halt_status_e halt_status)
+{
+	uint32_t bytes_transferred = get_actual_xfer_length(hc, hc_regs, qtd,
+							    halt_status, NULL);
+
+	if (urb->actual_length + bytes_transferred > urb->length) {
+		printk_once(KERN_DEBUG "dwc_otg: DEVICE:%03d : %s:%d:trimming xfer length\n",
+			hc->dev_addr, __func__, __LINE__);
+		bytes_transferred = urb->length - urb->actual_length;
+	}
+
+	/* non DWORD-aligned buffer case handling. */
+	if (hc->align_buff && bytes_transferred && hc->ep_is_in) {
+		dwc_memcpy(urb->buf + urb->actual_length, hc->qh->dw_align_buf,
+			   bytes_transferred);
+	}
+
+	urb->actual_length += bytes_transferred;
+
+#ifdef DEBUG
+	{
+		hctsiz_data_t hctsiz;
+		hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
+		DWC_DEBUGPL(DBG_HCDV, "DWC_otg: %s: %s, channel %d\n",
+			    __func__, (hc->ep_is_in ? "IN" : "OUT"),
+			    hc->hc_num);
+		DWC_DEBUGPL(DBG_HCDV, "  hc->start_pkt_count %d\n",
+			    hc->start_pkt_count);
+		DWC_DEBUGPL(DBG_HCDV, "  hctsiz.pktcnt %d\n", hctsiz.b.pktcnt);
+		DWC_DEBUGPL(DBG_HCDV, "  hc->max_packet %d\n", hc->max_packet);
+		DWC_DEBUGPL(DBG_HCDV, "  bytes_transferred %d\n",
+			    bytes_transferred);
+		DWC_DEBUGPL(DBG_HCDV, "  urb->actual_length %d\n",
+			    urb->actual_length);
+		DWC_DEBUGPL(DBG_HCDV, "  urb->transfer_buffer_length %d\n",
+			    urb->length);
+	}
+#endif
+}
+
+/**
+ * Handles a host channel NAK interrupt. This handler may be called in either
+ * DMA mode or Slave mode.
+ */
+static int32_t handle_hc_nak_intr(dwc_otg_hcd_t * hcd,
+				  dwc_hc_t * hc,
+				  dwc_otg_hc_regs_t * hc_regs,
+				  dwc_otg_qtd_t * qtd)
+{
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		    "NAK Received--\n", hc->hc_num);
+
+	/*
+	 * When we get bulk NAKs then remember this so we holdoff on this qh until
+	 * the beginning of the next frame
+	 */
+	switch(dwc_otg_hcd_get_pipe_type(&qtd->urb->pipe_info)) {
+		case UE_BULK:
+		case UE_CONTROL:
+		if (nak_holdoff && qtd->qh->do_split)
+			hc->qh->nak_frame = dwc_otg_hcd_get_frame_number(hcd);
+	}
+
+	/*
+	 * Handle NAK for IN/OUT SSPLIT/CSPLIT transfers, bulk, control, and
+	 * interrupt.  Re-start the SSPLIT transfer.
+	 */
+	if (hc->do_split) {
+		if (hc->complete_split) {
+			qtd->error_count = 0;
+		}
+		qtd->complete_split = 0;
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NAK);
+		goto handle_nak_done;
+	}
+
+	switch (dwc_otg_hcd_get_pipe_type(&qtd->urb->pipe_info)) {
+	case UE_CONTROL:
+	case UE_BULK:
+		if (hcd->core_if->dma_enable && hc->ep_is_in) {
+			/*
+			 * NAK interrupts are enabled on bulk/control IN
+			 * transfers in DMA mode for the sole purpose of
+			 * resetting the error count after a transaction error
+			 * occurs. The core will continue transferring data.
+			 * Disable other interrupts unmasked for the same
+			 * reason.
+			 */
+			disable_hc_int(hc_regs, datatglerr);
+			disable_hc_int(hc_regs, ack);
+			qtd->error_count = 0;
+			goto handle_nak_done;
+		}
+
+		/*
+		 * NAK interrupts normally occur during OUT transfers in DMA
+		 * or Slave mode. For IN transfers, more requests will be
+		 * queued as request queue space is available.
+		 */
+		qtd->error_count = 0;
+
+		if (!hc->qh->ping_state) {
+			update_urb_state_xfer_intr(hc, hc_regs,
+						   qtd->urb, qtd,
+						   DWC_OTG_HC_XFER_NAK);
+			dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+
+			if (hc->speed == DWC_OTG_EP_SPEED_HIGH)
+				hc->qh->ping_state = 1;
+		}
+
+		/*
+		 * Halt the channel so the transfer can be re-started from
+		 * the appropriate point or the PING protocol will
+		 * start/continue.
+		 */
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NAK);
+		break;
+	case UE_INTERRUPT:
+		qtd->error_count = 0;
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NAK);
+		break;
+	case UE_ISOCHRONOUS:
+		/* Should never get called for isochronous transfers. */
+		DWC_ASSERT(1, "NACK interrupt for ISOC transfer\n");
+		break;
+	}
+
+handle_nak_done:
+	disable_hc_int(hc_regs, nak);
+
+	return 1;
+}
+
+/**
+ * Handles a host channel ACK interrupt. This interrupt is enabled when
+ * performing the PING protocol in Slave mode, when errors occur during
+ * either Slave mode or DMA mode, and during Start Split transactions.
+ */
+static int32_t handle_hc_ack_intr(dwc_otg_hcd_t * hcd,
+				  dwc_hc_t * hc,
+				  dwc_otg_hc_regs_t * hc_regs,
+				  dwc_otg_qtd_t * qtd)
+{
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		    "ACK Received--\n", hc->hc_num);
+
+	if (hc->do_split) {
+		/*
+		 * Handle ACK on SSPLIT.
+		 * ACK should not occur in CSPLIT.
+		 */
+		if (!hc->ep_is_in && hc->data_pid_start != DWC_OTG_HC_PID_SETUP) {
+			qtd->ssplit_out_xfer_count = hc->xfer_len;
+		}
+		if (!(hc->ep_type == DWC_OTG_EP_TYPE_ISOC && !hc->ep_is_in)) {
+			/* Don't need complete for isochronous out transfers. */
+			qtd->complete_split = 1;
+		}
+
+		/* ISOC OUT */
+		if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC && !hc->ep_is_in) {
+			switch (hc->xact_pos) {
+			case DWC_HCSPLIT_XACTPOS_ALL:
+				break;
+			case DWC_HCSPLIT_XACTPOS_END:
+				qtd->isoc_split_pos = DWC_HCSPLIT_XACTPOS_ALL;
+				qtd->isoc_split_offset = 0;
+				break;
+			case DWC_HCSPLIT_XACTPOS_BEGIN:
+			case DWC_HCSPLIT_XACTPOS_MID:
+				/*
+				 * For BEGIN or MID, calculate the length for
+				 * the next microframe to determine the correct
+				 * SSPLIT token, either MID or END.
+				 */
+				{
+					struct dwc_otg_hcd_iso_packet_desc
+					*frame_desc;
+
+					frame_desc =
+					    &qtd->urb->
+					    iso_descs[qtd->isoc_frame_index];
+					qtd->isoc_split_offset += 188;
+
+					if ((frame_desc->length -
+					     qtd->isoc_split_offset) <= 188) {
+						qtd->isoc_split_pos =
+						    DWC_HCSPLIT_XACTPOS_END;
+					} else {
+						qtd->isoc_split_pos =
+						    DWC_HCSPLIT_XACTPOS_MID;
+					}
+
+				}
+				break;
+			}
+		} else {
+			halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_ACK);
+		}
+	} else {
+		/*
+		 * An unmasked ACK on a non-split DMA transaction is
+		 * for the sole purpose of resetting error counts. Disable other
+		 * interrupts unmasked for the same reason.
+		 */
+		if(hcd->core_if->dma_enable) {
+			disable_hc_int(hc_regs, datatglerr);
+			disable_hc_int(hc_regs, nak);
+		}
+		qtd->error_count = 0;
+
+		if (hc->qh->ping_state) {
+			hc->qh->ping_state = 0;
+			/*
+			 * Halt the channel so the transfer can be re-started
+			 * from the appropriate point. This only happens in
+			 * Slave mode. In DMA mode, the ping_state is cleared
+			 * when the transfer is started because the core
+			 * automatically executes the PING, then the transfer.
+			 */
+			halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_ACK);
+		}
+	}
+
+	/*
+	 * If the ACK occurred when _not_ in the PING state, let the channel
+	 * continue transferring data after clearing the error count.
+	 */
+
+	disable_hc_int(hc_regs, ack);
+
+	return 1;
+}
+
+/**
+ * Handles a host channel NYET interrupt. This interrupt should only occur on
+ * Bulk and Control OUT endpoints and for complete split transactions. If a
+ * NYET occurs at the same time as a Transfer Complete interrupt, it is
+ * handled in the xfercomp interrupt handler, not here. This handler may be
+ * called in either DMA mode or Slave mode.
+ */
+static int32_t handle_hc_nyet_intr(dwc_otg_hcd_t * hcd,
+				   dwc_hc_t * hc,
+				   dwc_otg_hc_regs_t * hc_regs,
+				   dwc_otg_qtd_t * qtd)
+{
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		    "NYET Received--\n", hc->hc_num);
+
+	/*
+	 * NYET on CSPLIT
+	 * re-do the CSPLIT immediately on non-periodic
+	 */
+	if (hc->do_split && hc->complete_split) {
+		if (hc->ep_is_in && (hc->ep_type == DWC_OTG_EP_TYPE_ISOC)
+		    && hcd->core_if->dma_enable) {
+			qtd->complete_split = 0;
+			qtd->isoc_split_offset = 0;
+			if (++qtd->isoc_frame_index == qtd->urb->packet_count) {
+				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+			}
+			else
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+			goto handle_nyet_done;
+		}
+
+		if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
+		    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
+			int frnum = dwc_otg_hcd_get_frame_number(hcd);
+
+			// With the FIQ running we only ever see the failed NYET
+			if (dwc_full_frame_num(frnum) !=
+			    dwc_full_frame_num(hc->qh->sched_frame) ||
+			    fiq_fsm_enable) {
+				/*
+				 * No longer in the same full speed frame.
+				 * Treat this as a transaction error.
+				 */
+#if 0
+				/** @todo Fix system performance so this can
+				 * be treated as an error. Right now complete
+				 * splits cannot be scheduled precisely enough
+				 * due to other system activity, so this error
+				 * occurs regularly in Slave mode.
+				 */
+				qtd->error_count++;
+#endif
+				qtd->complete_split = 0;
+				halt_channel(hcd, hc, qtd,
+					     DWC_OTG_HC_XFER_XACT_ERR);
+				/** @todo add support for isoc release */
+				goto handle_nyet_done;
+			}
+		}
+
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NYET);
+		goto handle_nyet_done;
+	}
+
+	hc->qh->ping_state = 1;
+	qtd->error_count = 0;
+
+	update_urb_state_xfer_intr(hc, hc_regs, qtd->urb, qtd,
+				   DWC_OTG_HC_XFER_NYET);
+	dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+
+	/*
+	 * Halt the channel and re-start the transfer so the PING
+	 * protocol will start.
+	 */
+	halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NYET);
+
+handle_nyet_done:
+	disable_hc_int(hc_regs, nyet);
+	return 1;
+}
+
+/**
+ * Handles a host channel babble interrupt. This handler may be called in
+ * either DMA mode or Slave mode.
+ */
+static int32_t handle_hc_babble_intr(dwc_otg_hcd_t * hcd,
+				     dwc_hc_t * hc,
+				     dwc_otg_hc_regs_t * hc_regs,
+				     dwc_otg_qtd_t * qtd)
+{
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		    "Babble Error--\n", hc->hc_num);
+
+	if (hcd->core_if->dma_desc_enable) {
+		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs,
+					       DWC_OTG_HC_XFER_BABBLE_ERR);
+		goto handle_babble_done;
+	}
+
+	if (hc->ep_type != DWC_OTG_EP_TYPE_ISOC) {
+		hcd->fops->complete(hcd, qtd->urb->priv,
+				    qtd->urb, -DWC_E_OVERFLOW);
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_BABBLE_ERR);
+	} else {
+		dwc_otg_halt_status_e halt_status;
+		halt_status = update_isoc_urb_state(hcd, hc, hc_regs, qtd,
+						    DWC_OTG_HC_XFER_BABBLE_ERR);
+		halt_channel(hcd, hc, qtd, halt_status);
+	}
+
+handle_babble_done:
+	disable_hc_int(hc_regs, bblerr);
+	return 1;
+}
+
+/**
+ * Handles a host channel AHB error interrupt. This handler is only called in
+ * DMA mode.
+ */
+static int32_t handle_hc_ahberr_intr(dwc_otg_hcd_t * hcd,
+				     dwc_hc_t * hc,
+				     dwc_otg_hc_regs_t * hc_regs,
+				     dwc_otg_qtd_t * qtd)
+{
+	hcchar_data_t hcchar;
+	hcsplt_data_t hcsplt;
+	hctsiz_data_t hctsiz;
+	uint32_t hcdma;
+	char *pipetype, *speed;
+
+	dwc_otg_hcd_urb_t *urb = qtd->urb;
+
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		    "AHB Error--\n", hc->hc_num);
+
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	hcsplt.d32 = DWC_READ_REG32(&hc_regs->hcsplt);
+	hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
+	hcdma = DWC_READ_REG32(&hc_regs->hcdma);
+
+	DWC_ERROR("AHB ERROR, Channel %d\n", hc->hc_num);
+	DWC_ERROR("  hcchar 0x%08x, hcsplt 0x%08x\n", hcchar.d32, hcsplt.d32);
+	DWC_ERROR("  hctsiz 0x%08x, hcdma 0x%08x\n", hctsiz.d32, hcdma);
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Enqueue\n");
+	DWC_ERROR("  Device address: %d\n",
+		  dwc_otg_hcd_get_dev_addr(&urb->pipe_info));
+	DWC_ERROR("  Endpoint: %d, %s\n",
+		  dwc_otg_hcd_get_ep_num(&urb->pipe_info),
+		  (dwc_otg_hcd_is_pipe_in(&urb->pipe_info) ? "IN" : "OUT"));
+
+	switch (dwc_otg_hcd_get_pipe_type(&urb->pipe_info)) {
+	case UE_CONTROL:
+		pipetype = "CONTROL";
+		break;
+	case UE_BULK:
+		pipetype = "BULK";
+		break;
+	case UE_INTERRUPT:
+		pipetype = "INTERRUPT";
+		break;
+	case UE_ISOCHRONOUS:
+		pipetype = "ISOCHRONOUS";
+		break;
+	default:
+		pipetype = "UNKNOWN";
+		break;
+	}
+
+	DWC_ERROR("  Endpoint type: %s\n", pipetype);
+
+	switch (hc->speed) {
+	case DWC_OTG_EP_SPEED_HIGH:
+		speed = "HIGH";
+		break;
+	case DWC_OTG_EP_SPEED_FULL:
+		speed = "FULL";
+		break;
+	case DWC_OTG_EP_SPEED_LOW:
+		speed = "LOW";
+		break;
+	default:
+		speed = "UNKNOWN";
+		break;
+	};
+
+	DWC_ERROR("  Speed: %s\n", speed);
+
+	DWC_ERROR("  Max packet size: %d\n",
+		  dwc_otg_hcd_get_mps(&urb->pipe_info));
+	DWC_ERROR("  Data buffer length: %d\n", urb->length);
+	DWC_ERROR("  Transfer buffer: %p, Transfer DMA: %p\n",
+		  urb->buf, (void *)urb->dma);
+	DWC_ERROR("  Setup buffer: %p, Setup DMA: %p\n",
+		  urb->setup_packet, (void *)urb->setup_dma);
+	DWC_ERROR("  Interval: %d\n", urb->interval);
+
+	/* Core haltes the channel for Descriptor DMA mode */
+	if (hcd->core_if->dma_desc_enable) {
+		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs,
+					       DWC_OTG_HC_XFER_AHB_ERR);
+		goto handle_ahberr_done;
+	}
+
+	hcd->fops->complete(hcd, urb->priv, urb, -DWC_E_IO);
+
+	/*
+	 * Force a channel halt. Don't call halt_channel because that won't
+	 * write to the HCCHARn register in DMA mode to force the halt.
+	 */
+	dwc_otg_hc_halt(hcd->core_if, hc, DWC_OTG_HC_XFER_AHB_ERR);
+handle_ahberr_done:
+	disable_hc_int(hc_regs, ahberr);
+	return 1;
+}
+
+/**
+ * Handles a host channel transaction error interrupt. This handler may be
+ * called in either DMA mode or Slave mode.
+ */
+static int32_t handle_hc_xacterr_intr(dwc_otg_hcd_t * hcd,
+				      dwc_hc_t * hc,
+				      dwc_otg_hc_regs_t * hc_regs,
+				      dwc_otg_qtd_t * qtd)
+{
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		    "Transaction Error--\n", hc->hc_num);
+
+	if (hcd->core_if->dma_desc_enable) {
+		dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs,
+					       DWC_OTG_HC_XFER_XACT_ERR);
+		goto handle_xacterr_done;
+	}
+
+	switch (dwc_otg_hcd_get_pipe_type(&qtd->urb->pipe_info)) {
+	case UE_CONTROL:
+	case UE_BULK:
+		qtd->error_count++;
+		if (!hc->qh->ping_state) {
+
+			update_urb_state_xfer_intr(hc, hc_regs,
+						   qtd->urb, qtd,
+						   DWC_OTG_HC_XFER_XACT_ERR);
+			dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+			if (!hc->ep_is_in && hc->speed == DWC_OTG_EP_SPEED_HIGH) {
+				hc->qh->ping_state = 1;
+			}
+		}
+
+		/*
+		 * Halt the channel so the transfer can be re-started from
+		 * the appropriate point or the PING protocol will start.
+		 */
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
+		break;
+	case UE_INTERRUPT:
+		qtd->error_count++;
+		if (hc->do_split && hc->complete_split) {
+			qtd->complete_split = 0;
+		}
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
+		break;
+	case UE_ISOCHRONOUS:
+		{
+			dwc_otg_halt_status_e halt_status;
+			halt_status =
+			    update_isoc_urb_state(hcd, hc, hc_regs, qtd,
+						  DWC_OTG_HC_XFER_XACT_ERR);
+
+			halt_channel(hcd, hc, qtd, halt_status);
+		}
+		break;
+	}
+handle_xacterr_done:
+	disable_hc_int(hc_regs, xacterr);
+
+	return 1;
+}
+
+/**
+ * Handles a host channel frame overrun interrupt. This handler may be called
+ * in either DMA mode or Slave mode.
+ */
+static int32_t handle_hc_frmovrun_intr(dwc_otg_hcd_t * hcd,
+				       dwc_hc_t * hc,
+				       dwc_otg_hc_regs_t * hc_regs,
+				       dwc_otg_qtd_t * qtd)
+{
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		    "Frame Overrun--\n", hc->hc_num);
+
+	switch (dwc_otg_hcd_get_pipe_type(&qtd->urb->pipe_info)) {
+	case UE_CONTROL:
+	case UE_BULK:
+		break;
+	case UE_INTERRUPT:
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_FRAME_OVERRUN);
+		break;
+	case UE_ISOCHRONOUS:
+		{
+			dwc_otg_halt_status_e halt_status;
+			halt_status =
+			    update_isoc_urb_state(hcd, hc, hc_regs, qtd,
+						  DWC_OTG_HC_XFER_FRAME_OVERRUN);
+
+			halt_channel(hcd, hc, qtd, halt_status);
+		}
+		break;
+	}
+
+	disable_hc_int(hc_regs, frmovrun);
+
+	return 1;
+}
+
+/**
+ * Handles a host channel data toggle error interrupt. This handler may be
+ * called in either DMA mode or Slave mode.
+ */
+static int32_t handle_hc_datatglerr_intr(dwc_otg_hcd_t * hcd,
+					 dwc_hc_t * hc,
+					 dwc_otg_hc_regs_t * hc_regs,
+					 dwc_otg_qtd_t * qtd)
+{
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		"Data Toggle Error on %s transfer--\n",
+		hc->hc_num, (hc->ep_is_in ? "IN" : "OUT"));
+
+	/* Data toggles on split transactions cause the hc to halt.
+	 * restart transfer */
+	if(hc->qh->do_split)
+	{
+		qtd->error_count++;
+		dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+		update_urb_state_xfer_intr(hc, hc_regs,
+			qtd->urb, qtd, DWC_OTG_HC_XFER_XACT_ERR);
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
+	} else if (hc->ep_is_in) {
+		/* An unmasked data toggle error on a non-split DMA transaction is
+		 * for the sole purpose of resetting error counts. Disable other
+		 * interrupts unmasked for the same reason.
+		 */
+		if(hcd->core_if->dma_enable) {
+			disable_hc_int(hc_regs, ack);
+			disable_hc_int(hc_regs, nak);
+		}
+		qtd->error_count = 0;
+	}
+
+	disable_hc_int(hc_regs, datatglerr);
+
+	return 1;
+}
+
+#ifdef DEBUG
+/**
+ * This function is for debug only. It checks that a valid halt status is set
+ * and that HCCHARn.chdis is clear. If there's a problem, corrective action is
+ * taken and a warning is issued.
+ * @return 1 if halt status is ok, 0 otherwise.
+ */
+static inline int halt_status_ok(dwc_otg_hcd_t * hcd,
+				 dwc_hc_t * hc,
+				 dwc_otg_hc_regs_t * hc_regs,
+				 dwc_otg_qtd_t * qtd)
+{
+	hcchar_data_t hcchar;
+	hctsiz_data_t hctsiz;
+	hcint_data_t hcint;
+	hcintmsk_data_t hcintmsk;
+	hcsplt_data_t hcsplt;
+
+	if (hc->halt_status == DWC_OTG_HC_XFER_NO_HALT_STATUS) {
+		/*
+		 * This code is here only as a check. This condition should
+		 * never happen. Ignore the halt if it does occur.
+		 */
+		hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+		hctsiz.d32 = DWC_READ_REG32(&hc_regs->hctsiz);
+		hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+		hcintmsk.d32 = DWC_READ_REG32(&hc_regs->hcintmsk);
+		hcsplt.d32 = DWC_READ_REG32(&hc_regs->hcsplt);
+		DWC_WARN
+		    ("%s: hc->halt_status == DWC_OTG_HC_XFER_NO_HALT_STATUS, "
+		     "channel %d, hcchar 0x%08x, hctsiz 0x%08x, "
+		     "hcint 0x%08x, hcintmsk 0x%08x, "
+		     "hcsplt 0x%08x, qtd->complete_split %d\n", __func__,
+		     hc->hc_num, hcchar.d32, hctsiz.d32, hcint.d32,
+		     hcintmsk.d32, hcsplt.d32, qtd->complete_split);
+
+		DWC_WARN("%s: no halt status, channel %d, ignoring interrupt\n",
+			 __func__, hc->hc_num);
+		DWC_WARN("\n");
+		clear_hc_int(hc_regs, chhltd);
+		return 0;
+	}
+
+	/*
+	 * This code is here only as a check. hcchar.chdis should
+	 * never be set when the halt interrupt occurs. Halt the
+	 * channel again if it does occur.
+	 */
+	hcchar.d32 = DWC_READ_REG32(&hc_regs->hcchar);
+	if (hcchar.b.chdis) {
+		DWC_WARN("%s: hcchar.chdis set unexpectedly, "
+			 "hcchar 0x%08x, trying to halt again\n",
+			 __func__, hcchar.d32);
+		clear_hc_int(hc_regs, chhltd);
+		hc->halt_pending = 0;
+		halt_channel(hcd, hc, qtd, hc->halt_status);
+		return 0;
+	}
+
+	return 1;
+}
+#endif
+
+/**
+ * Handles a host Channel Halted interrupt in DMA mode. This handler
+ * determines the reason the channel halted and proceeds accordingly.
+ */
+static void handle_hc_chhltd_intr_dma(dwc_otg_hcd_t * hcd,
+				      dwc_hc_t * hc,
+				      dwc_otg_hc_regs_t * hc_regs,
+				      dwc_otg_qtd_t * qtd)
+{
+	int out_nak_enh = 0;
+	hcint_data_t hcint;
+	hcintmsk_data_t hcintmsk;
+	/* For core with OUT NAK enhancement, the flow for high-
+	 * speed CONTROL/BULK OUT is handled a little differently.
+	 */
+	if (hcd->core_if->snpsid >= OTG_CORE_REV_2_71a) {
+		if (hc->speed == DWC_OTG_EP_SPEED_HIGH && !hc->ep_is_in &&
+		    (hc->ep_type == DWC_OTG_EP_TYPE_CONTROL ||
+		     hc->ep_type == DWC_OTG_EP_TYPE_BULK)) {
+			out_nak_enh = 1;
+		}
+	}
+
+	if (hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE ||
+	    (hc->halt_status == DWC_OTG_HC_XFER_AHB_ERR
+	     && !hcd->core_if->dma_desc_enable)) {
+		/*
+		 * Just release the channel. A dequeue can happen on a
+		 * transfer timeout. In the case of an AHB Error, the channel
+		 * was forced to halt because there's no way to gracefully
+		 * recover.
+		 */
+		if (hcd->core_if->dma_desc_enable)
+			dwc_otg_hcd_complete_xfer_ddma(hcd, hc, hc_regs,
+						       hc->halt_status);
+		else
+			release_channel(hcd, hc, qtd, hc->halt_status);
+		return;
+	}
+
+	/* Read the HCINTn register to determine the cause for the halt. */
+
+	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+	hcintmsk.d32 = DWC_READ_REG32(&hc_regs->hcintmsk);
+
+	if (hcint.b.xfercomp) {
+		/** @todo This is here because of a possible hardware bug.  Spec
+		 * says that on SPLIT-ISOC OUT transfers in DMA mode that a HALT
+		 * interrupt w/ACK bit set should occur, but I only see the
+		 * XFERCOMP bit, even with it masked out.  This is a workaround
+		 * for that behavior.  Should fix this when hardware is fixed.
+		 */
+		if (hc->ep_type == DWC_OTG_EP_TYPE_ISOC && !hc->ep_is_in) {
+			handle_hc_ack_intr(hcd, hc, hc_regs, qtd);
+		}
+		handle_hc_xfercomp_intr(hcd, hc, hc_regs, qtd);
+	} else if (hcint.b.stall) {
+		handle_hc_stall_intr(hcd, hc, hc_regs, qtd);
+	} else if (hcint.b.xacterr && !hcd->core_if->dma_desc_enable) {
+		if (out_nak_enh) {
+			if (hcint.b.nyet || hcint.b.nak || hcint.b.ack) {
+				DWC_DEBUGPL(DBG_HCD, "XactErr with NYET/NAK/ACK\n");
+				qtd->error_count = 0;
+			} else {
+				DWC_DEBUGPL(DBG_HCD, "XactErr without NYET/NAK/ACK\n");
+			}
+		}
+
+		/*
+		 * Must handle xacterr before nak or ack. Could get a xacterr
+		 * at the same time as either of these on a BULK/CONTROL OUT
+		 * that started with a PING. The xacterr takes precedence.
+		 */
+		handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
+	} else if (hcint.b.xcs_xact && hcd->core_if->dma_desc_enable) {
+		handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
+	} else if (hcint.b.ahberr && hcd->core_if->dma_desc_enable) {
+		handle_hc_ahberr_intr(hcd, hc, hc_regs, qtd);
+	} else if (hcint.b.bblerr) {
+		handle_hc_babble_intr(hcd, hc, hc_regs, qtd);
+	} else if (hcint.b.frmovrun) {
+		handle_hc_frmovrun_intr(hcd, hc, hc_regs, qtd);
+	} else if (hcint.b.datatglerr) {
+		handle_hc_datatglerr_intr(hcd, hc, hc_regs, qtd);
+	} else if (!out_nak_enh) {
+		if (hcint.b.nyet) {
+			/*
+			 * Must handle nyet before nak or ack. Could get a nyet at the
+			 * same time as either of those on a BULK/CONTROL OUT that
+			 * started with a PING. The nyet takes precedence.
+			 */
+			handle_hc_nyet_intr(hcd, hc, hc_regs, qtd);
+		} else if (hcint.b.nak && !hcintmsk.b.nak) {
+			/*
+			 * If nak is not masked, it's because a non-split IN transfer
+			 * is in an error state. In that case, the nak is handled by
+			 * the nak interrupt handler, not here. Handle nak here for
+			 * BULK/CONTROL OUT transfers, which halt on a NAK to allow
+			 * rewinding the buffer pointer.
+			 */
+			handle_hc_nak_intr(hcd, hc, hc_regs, qtd);
+		} else if (hcint.b.ack && !hcintmsk.b.ack) {
+			/*
+			 * If ack is not masked, it's because a non-split IN transfer
+			 * is in an error state. In that case, the ack is handled by
+			 * the ack interrupt handler, not here. Handle ack here for
+			 * split transfers. Start splits halt on ACK.
+			 */
+			handle_hc_ack_intr(hcd, hc, hc_regs, qtd);
+		} else {
+			if (hc->ep_type == DWC_OTG_EP_TYPE_INTR ||
+			    hc->ep_type == DWC_OTG_EP_TYPE_ISOC) {
+				/*
+				 * A periodic transfer halted with no other channel
+				 * interrupts set. Assume it was halted by the core
+				 * because it could not be completed in its scheduled
+				 * (micro)frame.
+				 */
+#ifdef DEBUG
+				DWC_PRINTF
+				    ("%s: Halt channel %d (assume incomplete periodic transfer)\n",
+				     __func__, hc->hc_num);
+#endif
+				halt_channel(hcd, hc, qtd,
+					     DWC_OTG_HC_XFER_PERIODIC_INCOMPLETE);
+			} else {
+				DWC_ERROR
+				    ("%s: Channel %d, DMA Mode -- ChHltd set, but reason "
+				     "for halting is unknown, hcint 0x%08x, intsts 0x%08x\n",
+				     __func__, hc->hc_num, hcint.d32,
+				     DWC_READ_REG32(&hcd->
+						    core_if->core_global_regs->
+						    gintsts));
+				/* Failthrough: use 3-strikes rule */
+				qtd->error_count++;
+				dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+				update_urb_state_xfer_intr(hc, hc_regs,
+					   qtd->urb, qtd, DWC_OTG_HC_XFER_XACT_ERR);
+				halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
+			}
+
+		}
+	} else {
+		DWC_PRINTF("NYET/NAK/ACK/other in non-error case, 0x%08x\n",
+			   hcint.d32);
+		/* Failthrough: use 3-strikes rule */
+		qtd->error_count++;
+		dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+		update_urb_state_xfer_intr(hc, hc_regs,
+			   qtd->urb, qtd, DWC_OTG_HC_XFER_XACT_ERR);
+		halt_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_XACT_ERR);
+	}
+}
+
+/**
+ * Handles a host channel Channel Halted interrupt.
+ *
+ * In slave mode, this handler is called only when the driver specifically
+ * requests a halt. This occurs during handling other host channel interrupts
+ * (e.g. nak, xacterr, stall, nyet, etc.).
+ *
+ * In DMA mode, this is the interrupt that occurs when the core has finished
+ * processing a transfer on a channel. Other host channel interrupts (except
+ * ahberr) are disabled in DMA mode.
+ */
+static int32_t handle_hc_chhltd_intr(dwc_otg_hcd_t * hcd,
+				     dwc_hc_t * hc,
+				     dwc_otg_hc_regs_t * hc_regs,
+				     dwc_otg_qtd_t * qtd)
+{
+	DWC_DEBUGPL(DBG_HCDI, "--Host Channel %d Interrupt: "
+		    "Channel Halted--\n", hc->hc_num);
+
+	if (hcd->core_if->dma_enable) {
+		handle_hc_chhltd_intr_dma(hcd, hc, hc_regs, qtd);
+	} else {
+#ifdef DEBUG
+		if (!halt_status_ok(hcd, hc, hc_regs, qtd)) {
+			return 1;
+		}
+#endif
+		release_channel(hcd, hc, qtd, hc->halt_status);
+	}
+
+	return 1;
+}
+
+
+/**
+ * dwc_otg_fiq_unmangle_isoc() - Update the iso_frame_desc structure on
+ * FIQ transfer completion
+ * @hcd:	Pointer to dwc_otg_hcd struct
+ * @num:	Host channel number
+ *
+ * 1. Un-mangle the status as recorded in each iso_frame_desc status
+ * 2. Copy it from the dwc_otg_urb into the real URB
+ */
+void dwc_otg_fiq_unmangle_isoc(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh, dwc_otg_qtd_t *qtd, uint32_t num)
+{
+	struct dwc_otg_hcd_urb *dwc_urb = qtd->urb;
+	int nr_frames = dwc_urb->packet_count;
+	int i;
+	hcint_data_t frame_hcint;
+
+	for (i = 0; i < nr_frames; i++) {
+		frame_hcint.d32 = dwc_urb->iso_descs[i].status;
+		if (frame_hcint.b.xfercomp) {
+			dwc_urb->iso_descs[i].status = 0;
+			dwc_urb->actual_length += dwc_urb->iso_descs[i].actual_length;
+		} else if (frame_hcint.b.frmovrun) {
+			if (qh->ep_is_in)
+				dwc_urb->iso_descs[i].status = -DWC_E_NO_STREAM_RES;
+			else
+				dwc_urb->iso_descs[i].status = -DWC_E_COMMUNICATION;
+			dwc_urb->error_count++;
+			dwc_urb->iso_descs[i].actual_length = 0;
+		} else if (frame_hcint.b.xacterr) {
+			dwc_urb->iso_descs[i].status = -DWC_E_PROTOCOL;
+			dwc_urb->error_count++;
+			dwc_urb->iso_descs[i].actual_length = 0;
+		} else if (frame_hcint.b.bblerr) {
+			dwc_urb->iso_descs[i].status = -DWC_E_OVERFLOW;
+			dwc_urb->error_count++;
+			dwc_urb->iso_descs[i].actual_length = 0;
+		} else {
+			/* Something went wrong */
+			dwc_urb->iso_descs[i].status = -1;
+			dwc_urb->iso_descs[i].actual_length = 0;
+			dwc_urb->error_count++;
+		}
+	}
+	qh->sched_frame = dwc_frame_num_inc(qh->sched_frame, qh->interval * (nr_frames - 1));
+
+	//printk_ratelimited(KERN_INFO "%s: HS isochronous of %d/%d frames with %d errors complete\n",
+	//			__FUNCTION__, i, dwc_urb->packet_count, dwc_urb->error_count);
+}
+
+/**
+ * dwc_otg_fiq_unsetup_per_dma() - Remove data from bounce buffers for split transactions
+ * @hcd:	Pointer to dwc_otg_hcd struct
+ * @num:	Host channel number
+ *
+ * Copies data from the FIQ bounce buffers into the URB's transfer buffer. Does not modify URB state.
+ * Returns total length of data or -1 if the buffers were not used.
+ *
+ */
+int dwc_otg_fiq_unsetup_per_dma(dwc_otg_hcd_t *hcd, dwc_otg_qh_t *qh, dwc_otg_qtd_t *qtd, uint32_t num)
+{
+	dwc_hc_t *hc = qh->channel;
+	struct fiq_dma_blob *blob = hcd->fiq_dmab;
+	struct fiq_channel_state *st = &hcd->fiq_state->channel[num];
+	uint8_t *ptr = NULL;
+	int index = 0, len = 0;
+	int i = 0;
+	if (hc->ep_is_in) {
+		/* Copy data out of the DMA bounce buffers to the URB's buffer.
+		 * The align_buf is ignored as this is ignored on FSM enqueue. */
+		ptr = qtd->urb->buf;
+		if (qh->ep_type == UE_ISOCHRONOUS) {
+			/* Isoc IN transactions - grab the offset of the iso_frame_desc into the URB transfer buffer */
+			index = qtd->isoc_frame_index;
+			ptr += qtd->urb->iso_descs[index].offset;
+		} else {
+			/* Need to increment by actual_length for interrupt IN */
+			ptr += qtd->urb->actual_length;
+		}
+
+		for (i = 0; i < st->dma_info.index; i++) {
+			len += st->dma_info.slot_len[i];
+			dwc_memcpy(ptr, &blob->channel[num].index[i].buf[0], st->dma_info.slot_len[i]);
+			ptr += st->dma_info.slot_len[i];
+		}
+		return len;
+	} else {
+		/* OUT endpoints - nothing to do. */
+		return -1;
+	}
+
+}
+/**
+ * dwc_otg_hcd_handle_hc_fsm() - handle an unmasked channel interrupt
+ * 				 from a channel handled in the FIQ
+ * @hcd:	Pointer to dwc_otg_hcd struct
+ * @num:	Host channel number
+ *
+ * If a host channel interrupt was received by the IRQ and this was a channel
+ * used by the FIQ, the execution flow for transfer completion is substantially
+ * different from the normal (messy) path. This function and its friends handles
+ * channel cleanup and transaction completion from a FIQ transaction.
+ */
+void dwc_otg_hcd_handle_hc_fsm(dwc_otg_hcd_t *hcd, uint32_t num)
+{
+	struct fiq_channel_state *st = &hcd->fiq_state->channel[num];
+	dwc_hc_t *hc = hcd->hc_ptr_array[num];
+	dwc_otg_qtd_t *qtd;
+	dwc_otg_hc_regs_t *hc_regs = hcd->core_if->host_if->hc_regs[num];
+	hcint_data_t hcint = hcd->fiq_state->channel[num].hcint_copy;
+	hctsiz_data_t hctsiz = hcd->fiq_state->channel[num].hctsiz_copy;
+	int hostchannels  = 0;
+	fiq_print(FIQDBG_INT, hcd->fiq_state, "OUT %01d %01d ", num , st->fsm);
+
+	hostchannels = hcd->available_host_channels;
+	if (hc->halt_pending) {
+		/* Dequeue: The FIQ was allowed to complete the transfer but state has been cleared. */
+		if (hc->qh && st->fsm == FIQ_NP_SPLIT_DONE &&
+				hcint.b.xfercomp && hc->qh->ep_type == UE_BULK) {
+			if (hctsiz.b.pid == DWC_HCTSIZ_DATA0) {
+				hc->qh->data_toggle = DWC_OTG_HC_PID_DATA1;
+			} else {
+				hc->qh->data_toggle = DWC_OTG_HC_PID_DATA0;
+			}
+		}
+		release_channel(hcd, hc, NULL, hc->halt_status);
+		return;
+	}
+
+	qtd = DWC_CIRCLEQ_FIRST(&hc->qh->qtd_list);
+	switch (st->fsm) {
+	case FIQ_TEST:
+		break;
+
+	case FIQ_DEQUEUE_ISSUED:
+		/* Handled above, but keep for posterity */
+		release_channel(hcd, hc, NULL, hc->halt_status);
+		break;
+
+	case FIQ_NP_SPLIT_DONE:
+		/* Nonperiodic transaction complete. */
+		if (!hc->ep_is_in) {
+			qtd->ssplit_out_xfer_count = hc->xfer_len;
+		}
+		if (hcint.b.xfercomp) {
+			handle_hc_xfercomp_intr(hcd, hc, hc_regs, qtd);
+		} else if (hcint.b.nak) {
+			handle_hc_nak_intr(hcd, hc, hc_regs, qtd);
+		} else {
+			DWC_WARN("Unexpected IRQ state on FSM transaction:"
+					"dev_addr=%d ep=%d fsm=%d, hcint=0x%08x\n",
+				hc->dev_addr, hc->ep_num, st->fsm, hcint.d32);
+			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+		}
+		break;
+
+	case FIQ_NP_SPLIT_HS_ABORTED:
+		/* A HS abort is a 3-strikes on the HS bus at any point in the transaction.
+		 * Normally a CLEAR_TT_BUFFER hub command would be required: we can't do that
+		 * because there's no guarantee which order a non-periodic split happened in.
+		 * We could end up clearing a perfectly good transaction out of the buffer.
+		 */
+		if (hcint.b.xacterr) {
+			qtd->error_count += st->nr_errors;
+			handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
+		} else if (hcint.b.ahberr) {
+			handle_hc_ahberr_intr(hcd, hc, hc_regs, qtd);
+		} else {
+			DWC_WARN("Unexpected IRQ state on FSM transaction:"
+					"dev_addr=%d ep=%d fsm=%d, hcint=0x%08x\n",
+				hc->dev_addr, hc->ep_num, st->fsm, hcint.d32);
+			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+		}
+		break;
+
+	case FIQ_NP_SPLIT_LS_ABORTED:
+		/* A few cases can cause this - either an unknown state on a SSPLIT or
+		 * STALL/data toggle error response on a CSPLIT */
+		if (hcint.b.stall) {
+			handle_hc_stall_intr(hcd, hc, hc_regs, qtd);
+		} else if (hcint.b.datatglerr) {
+			handle_hc_datatglerr_intr(hcd, hc, hc_regs, qtd);
+		} else if (hcint.b.bblerr) {
+			handle_hc_babble_intr(hcd, hc, hc_regs, qtd);
+		} else if (hcint.b.ahberr) {
+			handle_hc_ahberr_intr(hcd, hc, hc_regs, qtd);
+		} else {
+			DWC_WARN("Unexpected IRQ state on FSM transaction:"
+					"dev_addr=%d ep=%d fsm=%d, hcint=0x%08x\n",
+				hc->dev_addr, hc->ep_num, st->fsm, hcint.d32);
+			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+		}
+		break;
+
+	case FIQ_PER_SPLIT_DONE:
+		/* Isoc IN or Interrupt IN/OUT */
+
+		/* Flow control here is different from the normal execution by the driver.
+		* We need to completely ignore most of the driver's method of handling
+		* split transactions and do it ourselves.
+		*/
+		if (hc->ep_type == UE_INTERRUPT) {
+			if (hcint.b.nak) {
+					handle_hc_nak_intr(hcd, hc, hc_regs, qtd);
+			} else if (hc->ep_is_in) {
+				int len;
+				len = dwc_otg_fiq_unsetup_per_dma(hcd, hc->qh, qtd, num);
+				//printk(KERN_NOTICE "FIQ Transaction: hc=%d len=%d urb_len = %d\n", num, len, qtd->urb->length);
+				qtd->urb->actual_length += len;
+				if (qtd->urb->actual_length >= qtd->urb->length) {
+					qtd->urb->status = 0;
+					hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, qtd->urb->status);
+					release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+				} else {
+					/* Interrupt transfer not complete yet - is it a short read? */
+					if (len < hc->max_packet) {
+						/* Interrupt transaction complete */
+						qtd->urb->status = 0;
+						hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, qtd->urb->status);
+						release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+					} else {
+						/* Further transactions required */
+						release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
+					}
+				}
+			} else {
+				/* Interrupt OUT complete. */
+				dwc_otg_hcd_save_data_toggle(hc, hc_regs, qtd);
+				qtd->urb->actual_length += hc->xfer_len;
+				if (qtd->urb->actual_length >= qtd->urb->length) {
+					qtd->urb->status = 0;
+					hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, qtd->urb->status);
+					release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+				} else {
+					release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
+				}
+			}
+		} else {
+			/* ISOC IN complete. */
+			struct dwc_otg_hcd_iso_packet_desc *frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
+			int len = 0;
+			/* Record errors, update qtd. */
+			if (st->nr_errors) {
+				frame_desc->actual_length = 0;
+				frame_desc->status = -DWC_E_PROTOCOL;
+			} else {
+				frame_desc->status = 0;
+				/* Unswizzle dma */
+				len = dwc_otg_fiq_unsetup_per_dma(hcd, hc->qh, qtd, num);
+				frame_desc->actual_length = len;
+			}
+			qtd->isoc_frame_index++;
+			if (qtd->isoc_frame_index == qtd->urb->packet_count) {
+				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+			} else {
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
+			}
+		}
+		break;
+
+	case FIQ_PER_ISO_OUT_DONE: {
+			struct dwc_otg_hcd_iso_packet_desc *frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
+			/* Record errors, update qtd. */
+			if (st->nr_errors) {
+				frame_desc->actual_length = 0;
+				frame_desc->status = -DWC_E_PROTOCOL;
+			} else {
+				frame_desc->status = 0;
+				frame_desc->actual_length = frame_desc->length;
+			}
+			qtd->isoc_frame_index++;
+			qtd->isoc_split_offset = 0;
+			if (qtd->isoc_frame_index == qtd->urb->packet_count) {
+				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+			} else {
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
+			}
+		}
+		break;
+
+	case FIQ_PER_SPLIT_NYET_ABORTED:
+		/* Doh. lost the data. */
+		printk_ratelimited(KERN_INFO "Transfer to device %d endpoint 0x%x frame %d failed "
+				"- FIQ reported NYET. Data may have been lost.\n",
+				hc->dev_addr, hc->ep_num, dwc_otg_hcd_get_frame_number(hcd) >> 3);
+		if (hc->ep_type == UE_ISOCHRONOUS) {
+			struct dwc_otg_hcd_iso_packet_desc *frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
+			/* Record errors, update qtd. */
+			frame_desc->actual_length = 0;
+			frame_desc->status = -DWC_E_PROTOCOL;
+			qtd->isoc_frame_index++;
+			qtd->isoc_split_offset = 0;
+			if (qtd->isoc_frame_index == qtd->urb->packet_count) {
+				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+			} else {
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
+			}
+		} else {
+			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+		}
+		break;
+
+	case FIQ_HS_ISOC_DONE:
+		/* The FIQ has performed a whole pile of isochronous transactions.
+		 * The status is recorded as the interrupt state should the transaction
+		 * fail.
+		 */
+		dwc_otg_fiq_unmangle_isoc(hcd, hc->qh, qtd, num);
+		hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
+		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+		break;
+
+	case FIQ_PER_SPLIT_LS_ABORTED:
+		if (hcint.b.xacterr) {
+			/* Hub has responded with an ERR packet. Device
+			 * has been unplugged or the port has been disabled.
+			 * TODO: need to issue a reset to the hub port. */
+			qtd->error_count += 3;
+			handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
+		} else if (hcint.b.stall) {
+			handle_hc_stall_intr(hcd, hc, hc_regs, qtd);
+		} else if (hcint.b.bblerr) {
+			handle_hc_babble_intr(hcd, hc, hc_regs, qtd);
+		} else {
+			printk_ratelimited(KERN_INFO "Transfer to device %d endpoint 0x%x failed "
+				"- FIQ reported FSM=%d. Data may have been lost.\n",
+				st->fsm, hc->dev_addr, hc->ep_num);
+			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+		}
+		break;
+
+	case FIQ_PER_SPLIT_HS_ABORTED:
+		/* Either the SSPLIT phase suffered transaction errors or something
+		 * unexpected happened.
+		 */
+		qtd->error_count += 3;
+		handle_hc_xacterr_intr(hcd, hc, hc_regs, qtd);
+		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+		break;
+
+	case FIQ_PER_SPLIT_TIMEOUT:
+		/* Couldn't complete in the nominated frame */
+		printk(KERN_INFO "Transfer to device %d endpoint 0x%x frame %d failed "
+				"- FIQ timed out. Data may have been lost.\n",
+				hc->dev_addr, hc->ep_num, dwc_otg_hcd_get_frame_number(hcd) >> 3);
+		if (hc->ep_type == UE_ISOCHRONOUS) {
+			struct dwc_otg_hcd_iso_packet_desc *frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
+			/* Record errors, update qtd. */
+			frame_desc->actual_length = 0;
+			if (hc->ep_is_in) {
+				frame_desc->status = -DWC_E_NO_STREAM_RES;
+			} else {
+				frame_desc->status = -DWC_E_COMMUNICATION;
+			}
+			qtd->isoc_frame_index++;
+			if (qtd->isoc_frame_index == qtd->urb->packet_count) {
+				hcd->fops->complete(hcd, qtd->urb->priv, qtd->urb, 0);
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_URB_COMPLETE);
+			} else {
+				release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_COMPLETE);
+			}
+		} else {
+			release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+		}
+		break;
+
+	default:
+		DWC_WARN("Unexpected state received on hc=%d fsm=%d on transfer to device %d ep 0x%x", 
+					hc->hc_num, st->fsm, hc->dev_addr, hc->ep_num);
+		qtd->error_count++;
+		release_channel(hcd, hc, qtd, DWC_OTG_HC_XFER_NO_HALT_STATUS);
+	}
+	return;
+}
+
+/** Handles interrupt for a specific Host Channel */
+int32_t dwc_otg_hcd_handle_hc_n_intr(dwc_otg_hcd_t * dwc_otg_hcd, uint32_t num)
+{
+	int retval = 0;
+	hcint_data_t hcint;
+	hcintmsk_data_t hcintmsk;
+	dwc_hc_t *hc;
+	dwc_otg_hc_regs_t *hc_regs;
+	dwc_otg_qtd_t *qtd;
+
+	DWC_DEBUGPL(DBG_HCDV, "--Host Channel Interrupt--, Channel %d\n", num);
+
+	hc = dwc_otg_hcd->hc_ptr_array[num];
+	hc_regs = dwc_otg_hcd->core_if->host_if->hc_regs[num];
+	if(hc->halt_status == DWC_OTG_HC_XFER_URB_DEQUEUE) {
+		/* A dequeue was issued for this transfer. Our QTD has gone away
+		 * but in the case of a FIQ transfer, the transfer would have run
+		 * to completion.
+		 */
+		if (fiq_fsm_enable && dwc_otg_hcd->fiq_state->channel[num].fsm != FIQ_PASSTHROUGH) {
+			dwc_otg_hcd_handle_hc_fsm(dwc_otg_hcd, num);
+		} else {
+			release_channel(dwc_otg_hcd, hc, NULL, hc->halt_status);
+		}
+		return 1;
+	}
+	qtd = DWC_CIRCLEQ_FIRST(&hc->qh->qtd_list);
+
+	/*
+	 * FSM mode: Check to see if this is a HC interrupt from a channel handled by the FIQ.
+	 * Execution path is fundamentally different for the channels after a FIQ has completed
+	 * a split transaction.
+	 */
+	if (fiq_fsm_enable) {
+		switch (dwc_otg_hcd->fiq_state->channel[num].fsm) {
+			case FIQ_PASSTHROUGH:
+				break;
+			case FIQ_PASSTHROUGH_ERRORSTATE:
+				/* Hook into the error count */
+				fiq_print(FIQDBG_ERR, dwc_otg_hcd->fiq_state, "HCDERR%02d", num);
+				if (!dwc_otg_hcd->fiq_state->channel[num].nr_errors) {
+					qtd->error_count = 0;
+					fiq_print(FIQDBG_ERR, dwc_otg_hcd->fiq_state, "RESET   ");
+				}
+				break;
+			default:
+				dwc_otg_hcd_handle_hc_fsm(dwc_otg_hcd, num);
+				return 1;
+		}
+	}
+
+	hcint.d32 = DWC_READ_REG32(&hc_regs->hcint);
+	hcintmsk.d32 = DWC_READ_REG32(&hc_regs->hcintmsk);
+	hcint.d32 = hcint.d32 & hcintmsk.d32;
+	if (!dwc_otg_hcd->core_if->dma_enable) {
+		if (hcint.b.chhltd && hcint.d32 != 0x2) {
+			hcint.b.chhltd = 0;
+		}
+	}
+
+	if (hcint.b.xfercomp) {
+		retval |=
+		    handle_hc_xfercomp_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+		/*
+		 * If NYET occurred at same time as Xfer Complete, the NYET is
+		 * handled by the Xfer Complete interrupt handler. Don't want
+		 * to call the NYET interrupt handler in this case.
+		 */
+		hcint.b.nyet = 0;
+	}
+	if (hcint.b.chhltd) {
+		retval |= handle_hc_chhltd_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+	if (hcint.b.ahberr) {
+		retval |= handle_hc_ahberr_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+	if (hcint.b.stall) {
+		retval |= handle_hc_stall_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+	if (hcint.b.nak) {
+		retval |= handle_hc_nak_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+	if (hcint.b.ack) {
+		if(!hcint.b.chhltd)
+			retval |= handle_hc_ack_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+	if (hcint.b.nyet) {
+		retval |= handle_hc_nyet_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+	if (hcint.b.xacterr) {
+		retval |= handle_hc_xacterr_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+	if (hcint.b.bblerr) {
+		retval |= handle_hc_babble_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+	if (hcint.b.frmovrun) {
+		retval |=
+		    handle_hc_frmovrun_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+	if (hcint.b.datatglerr) {
+		retval |=
+		    handle_hc_datatglerr_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+	}
+
+	return retval;
+}
+#endif /* DWC_DEVICE_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
new file mode 100644
index 000000000000..ed9694058ed0
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
@@ -0,0 +1,1074 @@
+
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_linux.c $
+ * $Revision: #20 $
+ * $Date: 2011/10/26 $
+ * $Change: 1872981 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_DEVICE_ONLY
+
+/**
+ * @file
+ *
+ * This file contains the implementation of the HCD. In Linux, the HCD
+ * implements the hc_driver API.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/init.h>
+#include <linux/device.h>
+#include <linux/errno.h>
+#include <linux/list.h>
+#include <linux/interrupt.h>
+#include <linux/string.h>
+#include <linux/dma-mapping.h>
+#include <linux/version.h>
+#include <asm/io.h>
+#ifdef CONFIG_ARM
+#include <asm/fiq.h>
+#endif
+#include <linux/usb.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35)
+#include <../drivers/usb/core/hcd.h>
+#else
+#include <linux/usb/hcd.h>
+#endif
+#include <asm/bug.h>
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30))
+#define USB_URB_EP_LINKING 1
+#else
+#define USB_URB_EP_LINKING 0
+#endif
+
+#include "dwc_otg_hcd_if.h"
+#include "dwc_otg_dbg.h"
+#include "dwc_otg_driver.h"
+#include "dwc_otg_hcd.h"
+
+#ifndef __virt_to_bus
+#define __virt_to_bus	__virt_to_phys
+#define __bus_to_virt	__phys_to_virt
+#define __pfn_to_bus(x)	__pfn_to_phys(x)
+#define __bus_to_pfn(x)	__phys_to_pfn(x)
+#endif
+
+extern unsigned char  _dwc_otg_fiq_stub, _dwc_otg_fiq_stub_end;
+
+/**
+ * Gets the endpoint number from a _bEndpointAddress argument. The endpoint is
+ * qualified with its direction (possible 32 endpoints per device).
+ */
+#define dwc_ep_addr_to_endpoint(_bEndpointAddress_) ((_bEndpointAddress_ & USB_ENDPOINT_NUMBER_MASK) | \
+						     ((_bEndpointAddress_ & USB_DIR_IN) != 0) << 4)
+
+static const char dwc_otg_hcd_name[] = "dwc_otg_hcd";
+
+extern bool fiq_enable;
+
+/** @name Linux HC Driver API Functions */
+/** @{ */
+/* manage i/o requests, device state */
+static int dwc_otg_urb_enqueue(struct usb_hcd *hcd,
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+		       struct usb_host_endpoint *ep,
+#endif
+		       struct urb *urb, gfp_t mem_flags);
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30)
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+static int dwc_otg_urb_dequeue(struct usb_hcd *hcd, struct urb *urb);
+#endif
+#else /* kernels at or post 2.6.30 */
+static int dwc_otg_urb_dequeue(struct usb_hcd *hcd,
+                               struct urb *urb, int status);
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30) */
+
+static void endpoint_disable(struct usb_hcd *hcd, struct usb_host_endpoint *ep);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
+static void endpoint_reset(struct usb_hcd *hcd, struct usb_host_endpoint *ep);
+#endif
+static irqreturn_t dwc_otg_hcd_irq(struct usb_hcd *hcd);
+extern int hcd_start(struct usb_hcd *hcd);
+extern void hcd_stop(struct usb_hcd *hcd);
+static int get_frame_number(struct usb_hcd *hcd);
+extern int hub_status_data(struct usb_hcd *hcd, char *buf);
+extern int hub_control(struct usb_hcd *hcd,
+		       u16 typeReq,
+		       u16 wValue, u16 wIndex, char *buf, u16 wLength);
+
+struct wrapper_priv_data {
+	dwc_otg_hcd_t *dwc_otg_hcd;
+};
+
+/** @} */
+
+static struct hc_driver dwc_otg_hc_driver = {
+
+	.description = dwc_otg_hcd_name,
+	.product_desc = "DWC OTG Controller",
+	.hcd_priv_size = sizeof(struct wrapper_priv_data),
+
+	.irq = dwc_otg_hcd_irq,
+
+	.flags = HCD_MEMORY | HCD_USB2,
+
+	//.reset =
+	.start = hcd_start,
+	//.suspend =
+	//.resume =
+	.stop = hcd_stop,
+
+	.urb_enqueue = dwc_otg_urb_enqueue,
+	.urb_dequeue = dwc_otg_urb_dequeue,
+	.endpoint_disable = endpoint_disable,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
+	.endpoint_reset = endpoint_reset,
+#endif
+	.get_frame_number = get_frame_number,
+
+	.hub_status_data = hub_status_data,
+	.hub_control = hub_control,
+	//.bus_suspend =
+	//.bus_resume =
+};
+
+/** Gets the dwc_otg_hcd from a struct usb_hcd */
+static inline dwc_otg_hcd_t *hcd_to_dwc_otg_hcd(struct usb_hcd *hcd)
+{
+	struct wrapper_priv_data *p;
+	p = (struct wrapper_priv_data *)(hcd->hcd_priv);
+	return p->dwc_otg_hcd;
+}
+
+/** Gets the struct usb_hcd that contains a dwc_otg_hcd_t. */
+static inline struct usb_hcd *dwc_otg_hcd_to_hcd(dwc_otg_hcd_t * dwc_otg_hcd)
+{
+	return dwc_otg_hcd_get_priv_data(dwc_otg_hcd);
+}
+
+/** Gets the usb_host_endpoint associated with an URB. */
+inline struct usb_host_endpoint *dwc_urb_to_endpoint(struct urb *urb)
+{
+	struct usb_device *dev = urb->dev;
+	int ep_num = usb_pipeendpoint(urb->pipe);
+
+	if (usb_pipein(urb->pipe))
+		return dev->ep_in[ep_num];
+	else
+		return dev->ep_out[ep_num];
+}
+
+static int _disconnect(dwc_otg_hcd_t * hcd)
+{
+	struct usb_hcd *usb_hcd = dwc_otg_hcd_to_hcd(hcd);
+
+	usb_hcd->self.is_b_host = 0;
+	return 0;
+}
+
+static int _start(dwc_otg_hcd_t * hcd)
+{
+	struct usb_hcd *usb_hcd = dwc_otg_hcd_to_hcd(hcd);
+
+	usb_hcd->self.is_b_host = dwc_otg_hcd_is_b_host(hcd);
+	hcd_start(usb_hcd);
+
+	return 0;
+}
+
+static int _hub_info(dwc_otg_hcd_t * hcd, void *urb_handle, uint32_t * hub_addr,
+		     uint32_t * port_addr)
+{
+   struct urb *urb = (struct urb *)urb_handle;
+   struct usb_bus *bus;
+#if 1 //GRAYG - temporary
+   if (NULL == urb_handle)
+      DWC_ERROR("**** %s - NULL URB handle\n", __func__);//GRAYG
+   if (NULL == urb->dev)
+      DWC_ERROR("**** %s - URB has no device\n", __func__);//GRAYG
+   if (NULL == port_addr)
+      DWC_ERROR("**** %s - NULL port_address\n", __func__);//GRAYG
+#endif
+   if (urb->dev->tt) {
+        if (NULL == urb->dev->tt->hub) {
+                DWC_ERROR("**** %s - (URB's transactor has no TT - giving no hub)\n",
+                           __func__); //GRAYG
+                //*hub_addr = (u8)usb_pipedevice(urb->pipe); //GRAYG
+                *hub_addr = 0; //GRAYG
+                // we probably shouldn't have a transaction translator if
+                // there's no associated hub?
+        } else {
+		bus = hcd_to_bus(dwc_otg_hcd_to_hcd(hcd));
+		if (urb->dev->tt->hub == bus->root_hub)
+			*hub_addr = 0;
+		else
+			*hub_addr = urb->dev->tt->hub->devnum;
+	}
+	*port_addr = urb->dev->tt->multi ? urb->dev->ttport : 1;
+   } else {
+        *hub_addr = 0;
+	*port_addr = urb->dev->ttport;
+   }
+   return 0;
+}
+
+static int _speed(dwc_otg_hcd_t * hcd, void *urb_handle)
+{
+	struct urb *urb = (struct urb *)urb_handle;
+	return urb->dev->speed;
+}
+
+static int _get_b_hnp_enable(dwc_otg_hcd_t * hcd)
+{
+	struct usb_hcd *usb_hcd = dwc_otg_hcd_to_hcd(hcd);
+	return usb_hcd->self.b_hnp_enable;
+}
+
+static void allocate_bus_bandwidth(struct usb_hcd *hcd, uint32_t bw,
+				   struct urb *urb)
+{
+	hcd_to_bus(hcd)->bandwidth_allocated += bw / urb->interval;
+	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+		hcd_to_bus(hcd)->bandwidth_isoc_reqs++;
+	} else {
+		hcd_to_bus(hcd)->bandwidth_int_reqs++;
+	}
+}
+
+static void free_bus_bandwidth(struct usb_hcd *hcd, uint32_t bw,
+			       struct urb *urb)
+{
+	hcd_to_bus(hcd)->bandwidth_allocated -= bw / urb->interval;
+	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+		hcd_to_bus(hcd)->bandwidth_isoc_reqs--;
+	} else {
+		hcd_to_bus(hcd)->bandwidth_int_reqs--;
+	}
+}
+
+/**
+ * Sets the final status of an URB and returns it to the device driver. Any
+ * required cleanup of the URB is performed.  The HCD lock should be held on
+ * entry.
+ */
+static int _complete(dwc_otg_hcd_t * hcd, void *urb_handle,
+		     dwc_otg_hcd_urb_t * dwc_otg_urb, int32_t status)
+{
+	struct urb *urb = (struct urb *)urb_handle;
+	urb_tq_entry_t *new_entry;
+	int rc = 0;
+	if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
+		DWC_PRINTF("%s: urb %p, device %d, ep %d %s, status=%d\n",
+			   __func__, urb, usb_pipedevice(urb->pipe),
+			   usb_pipeendpoint(urb->pipe),
+			   usb_pipein(urb->pipe) ? "IN" : "OUT", status);
+		if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+			int i;
+			for (i = 0; i < urb->number_of_packets; i++) {
+				DWC_PRINTF("  ISO Desc %d status: %d\n",
+					   i, urb->iso_frame_desc[i].status);
+			}
+		}
+	}
+	new_entry = DWC_ALLOC_ATOMIC(sizeof(urb_tq_entry_t));
+	urb->actual_length = dwc_otg_hcd_urb_get_actual_length(dwc_otg_urb);
+	/* Convert status value. */
+	switch (status) {
+	case -DWC_E_PROTOCOL:
+		status = -EPROTO;
+		break;
+	case -DWC_E_IN_PROGRESS:
+		status = -EINPROGRESS;
+		break;
+	case -DWC_E_PIPE:
+		status = -EPIPE;
+		break;
+	case -DWC_E_IO:
+		status = -EIO;
+		break;
+	case -DWC_E_TIMEOUT:
+		status = -ETIMEDOUT;
+		break;
+	case -DWC_E_OVERFLOW:
+		status = -EOVERFLOW;
+		break;
+	case -DWC_E_SHUTDOWN:
+		status = -ESHUTDOWN;
+		break;
+	default:
+		if (status) {
+			DWC_PRINTF("Uknown urb status %d\n", status);
+
+		}
+	}
+
+	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+		int i;
+
+		urb->error_count = dwc_otg_hcd_urb_get_error_count(dwc_otg_urb);
+		urb->actual_length = 0;
+		for (i = 0; i < urb->number_of_packets; ++i) {
+			urb->iso_frame_desc[i].actual_length =
+			    dwc_otg_hcd_urb_get_iso_desc_actual_length
+			    (dwc_otg_urb, i);
+			urb->actual_length += urb->iso_frame_desc[i].actual_length;
+			urb->iso_frame_desc[i].status =
+			    dwc_otg_hcd_urb_get_iso_desc_status(dwc_otg_urb, i);
+		}
+	}
+
+	urb->status = status;
+	urb->hcpriv = NULL;
+	if (!status) {
+		if ((urb->transfer_flags & URB_SHORT_NOT_OK) &&
+		    (urb->actual_length < urb->transfer_buffer_length)) {
+			urb->status = -EREMOTEIO;
+		}
+	}
+
+	if ((usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) ||
+	    (usb_pipetype(urb->pipe) == PIPE_INTERRUPT)) {
+		struct usb_host_endpoint *ep = dwc_urb_to_endpoint(urb);
+		if (ep) {
+			free_bus_bandwidth(dwc_otg_hcd_to_hcd(hcd),
+					   dwc_otg_hcd_get_ep_bandwidth(hcd,
+									ep->hcpriv),
+					   urb);
+		}
+	}
+	DWC_FREE(dwc_otg_urb);
+	if (!new_entry) {
+		DWC_ERROR("dwc_otg_hcd: complete: cannot allocate URB TQ entry\n");
+		urb->status = -EPROTO;
+		/* don't schedule the tasklet -
+		 * directly return the packet here with error. */
+#if USB_URB_EP_LINKING
+		usb_hcd_unlink_urb_from_ep(dwc_otg_hcd_to_hcd(hcd), urb);
+#endif
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+		usb_hcd_giveback_urb(dwc_otg_hcd_to_hcd(hcd), urb);
+#else
+		usb_hcd_giveback_urb(dwc_otg_hcd_to_hcd(hcd), urb, urb->status);
+#endif
+	} else {
+		new_entry->urb = urb;
+#if USB_URB_EP_LINKING
+		rc = usb_hcd_check_unlink_urb(dwc_otg_hcd_to_hcd(hcd), urb, urb->status);
+		if(0 == rc) {
+			usb_hcd_unlink_urb_from_ep(dwc_otg_hcd_to_hcd(hcd), urb);
+		}
+#endif
+		if(0 == rc) {
+			DWC_TAILQ_INSERT_TAIL(&hcd->completed_urb_list, new_entry,
+						urb_tq_entries);
+			DWC_TASK_HI_SCHEDULE(hcd->completion_tasklet);
+		}
+	}
+	return 0;
+}
+
+static struct dwc_otg_hcd_function_ops hcd_fops = {
+	.start = _start,
+	.disconnect = _disconnect,
+	.hub_info = _hub_info,
+	.speed = _speed,
+	.complete = _complete,
+	.get_b_hnp_enable = _get_b_hnp_enable,
+};
+
+#ifdef CONFIG_ARM64
+
+static int simfiq_irq = -1;
+
+void local_fiq_enable(void)
+{
+	if (simfiq_irq >= 0)
+		enable_irq(simfiq_irq);
+}
+
+void local_fiq_disable(void)
+{
+	if (simfiq_irq >= 0)
+		disable_irq(simfiq_irq);
+}
+
+irqreturn_t fiq_irq_handler(int irq, void *dev_id)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd = (dwc_otg_hcd_t *)dev_id;
+
+	if (fiq_fsm_enable)
+		dwc_otg_fiq_fsm(dwc_otg_hcd->fiq_state, dwc_otg_hcd->core_if->core_params->host_channels);
+	else
+		dwc_otg_fiq_nop(dwc_otg_hcd->fiq_state);
+
+	return IRQ_HANDLED;
+}
+
+#else
+static struct fiq_handler fh = {
+  .name = "usb_fiq",
+};
+
+#endif
+
+static void hcd_init_fiq(void *cookie)
+{
+	dwc_otg_device_t *otg_dev = cookie;
+	dwc_otg_hcd_t *dwc_otg_hcd = otg_dev->hcd;
+#ifdef CONFIG_ARM64
+	int retval = 0;
+	int irq;
+#else
+	struct pt_regs regs;
+	int irq;
+
+	if (claim_fiq(&fh)) {
+		DWC_ERROR("Can't claim FIQ");
+		BUG();
+	}
+	DWC_WARN("FIQ on core %d at 0x%08x",
+				smp_processor_id(),
+				(fiq_fsm_enable ? (int)&dwc_otg_fiq_fsm : (int)&dwc_otg_fiq_nop));
+	DWC_WARN("FIQ ASM at 0x%08x length %d", (int)&_dwc_otg_fiq_stub, (int)(&_dwc_otg_fiq_stub_end - &_dwc_otg_fiq_stub));
+		set_fiq_handler((void *) &_dwc_otg_fiq_stub, &_dwc_otg_fiq_stub_end - &_dwc_otg_fiq_stub);
+	memset(&regs,0,sizeof(regs));
+
+	regs.ARM_r8 = (long) dwc_otg_hcd->fiq_state;
+	if (fiq_fsm_enable) {
+		regs.ARM_r9 = dwc_otg_hcd->core_if->core_params->host_channels;
+		//regs.ARM_r10 = dwc_otg_hcd->dma;
+		regs.ARM_fp = (long) dwc_otg_fiq_fsm;
+	} else {
+		regs.ARM_fp = (long) dwc_otg_fiq_nop;
+	}
+
+	regs.ARM_sp = (long) dwc_otg_hcd->fiq_stack + (sizeof(struct fiq_stack) - 4);
+
+//		__show_regs(&regs);
+	set_fiq_regs(&regs);
+#endif
+
+	//Set the mphi periph to  the required registers
+	dwc_otg_hcd->fiq_state->mphi_regs.base    = otg_dev->os_dep.mphi_base;
+	dwc_otg_hcd->fiq_state->mphi_regs.ctrl    = otg_dev->os_dep.mphi_base + 0x4c;
+	dwc_otg_hcd->fiq_state->mphi_regs.outdda  = otg_dev->os_dep.mphi_base + 0x28;
+	dwc_otg_hcd->fiq_state->mphi_regs.outddb  = otg_dev->os_dep.mphi_base + 0x2c;
+	dwc_otg_hcd->fiq_state->mphi_regs.intstat = otg_dev->os_dep.mphi_base + 0x50;
+	dwc_otg_hcd->fiq_state->dwc_regs_base = otg_dev->os_dep.base;
+	DWC_WARN("MPHI regs_base at 0x%08x", (int)dwc_otg_hcd->fiq_state->mphi_regs.base);
+	//Enable mphi peripheral
+	writel((1<<31),dwc_otg_hcd->fiq_state->mphi_regs.ctrl);
+#ifdef DEBUG
+	if (readl(dwc_otg_hcd->fiq_state->mphi_regs.ctrl) & 0x80000000)
+		DWC_WARN("MPHI periph has been enabled");
+	else
+		DWC_WARN("MPHI periph has NOT been enabled");
+#endif
+	// Enable FIQ interrupt from USB peripheral
+#ifdef CONFIG_ARM64
+	irq = platform_get_irq(otg_dev->os_dep.platformdev, 1);
+
+	if (irq < 0) {
+		DWC_ERROR("Can't get SIM-FIQ irq");
+		return;
+	}
+
+	retval = request_irq(irq, fiq_irq_handler, 0, "dwc_otg_sim-fiq", dwc_otg_hcd);
+
+	if (retval < 0) {
+		DWC_ERROR("Unable to request SIM-FIQ irq\n");
+		return;
+	}
+
+	simfiq_irq = irq;
+#else
+#ifdef CONFIG_MULTI_IRQ_HANDLER
+	irq = platform_get_irq(otg_dev->os_dep.platformdev, 1);
+#else
+	irq = INTERRUPT_VC_USB;
+#endif
+	if (irq < 0) {
+		DWC_ERROR("Can't get FIQ irq");
+		return;
+	}
+	/*
+	 * We could take an interrupt immediately after enabling the FIQ.
+	 * Ensure coherency of hcd->fiq_state.
+	 */
+	smp_mb();
+	enable_fiq(irq);
+	local_fiq_enable();
+#endif
+
+}
+
+/**
+ * Initializes the HCD. This function allocates memory for and initializes the
+ * static parts of the usb_hcd and dwc_otg_hcd structures. It also registers the
+ * USB bus with the core and calls the hc_driver->start() function. It returns
+ * a negative error on failure.
+ */
+int hcd_init(dwc_bus_dev_t *_dev)
+{
+	struct usb_hcd *hcd = NULL;
+	dwc_otg_hcd_t *dwc_otg_hcd = NULL;
+	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
+	int retval = 0;
+        u64 dmamask;
+
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD INIT otg_dev=%p\n", otg_dev);
+
+	/* Set device flags indicating whether the HCD supports DMA. */
+	if (dwc_otg_is_dma_enable(otg_dev->core_if))
+                dmamask = DMA_BIT_MASK(32);
+        else
+                dmamask = 0;
+
+#if    defined(LM_INTERFACE) || defined(PLATFORM_INTERFACE)
+        dma_set_mask(&_dev->dev, dmamask);
+        dma_set_coherent_mask(&_dev->dev, dmamask);
+#elif  defined(PCI_INTERFACE)
+        pci_set_dma_mask(_dev, dmamask);
+        pci_set_consistent_dma_mask(_dev, dmamask);
+#endif
+
+	/*
+	 * Allocate memory for the base HCD plus the DWC OTG HCD.
+	 * Initialize the base HCD.
+	 */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30)
+	hcd = usb_create_hcd(&dwc_otg_hc_driver, &_dev->dev, _dev->dev.bus_id);
+#else
+	hcd = usb_create_hcd(&dwc_otg_hc_driver, &_dev->dev, dev_name(&_dev->dev));
+	hcd->has_tt = 1;
+//      hcd->uses_new_polling = 1;
+//      hcd->poll_rh = 0;
+#endif
+	if (!hcd) {
+		retval = -ENOMEM;
+		goto error1;
+	}
+
+	hcd->regs = otg_dev->os_dep.base;
+
+
+	/* Initialize the DWC OTG HCD. */
+	dwc_otg_hcd = dwc_otg_hcd_alloc_hcd();
+	if (!dwc_otg_hcd) {
+		goto error2;
+	}
+	((struct wrapper_priv_data *)(hcd->hcd_priv))->dwc_otg_hcd =
+	    dwc_otg_hcd;
+	otg_dev->hcd = dwc_otg_hcd;
+	otg_dev->hcd->otg_dev = otg_dev;
+
+#ifdef CONFIG_ARM64
+	if (dwc_otg_hcd_init(dwc_otg_hcd, otg_dev->core_if))
+		goto error2;
+
+	if (fiq_enable)
+		hcd_init_fiq(otg_dev);
+#else
+	if (dwc_otg_hcd_init(dwc_otg_hcd, otg_dev->core_if)) {
+		goto error2;
+	}
+
+	if (fiq_enable) {
+		if (num_online_cpus() > 1) {
+			/*
+			 * bcm2709: can run the FIQ on a separate core to IRQs.
+			 * Ensure driver state is visible to other cores before setting up the FIQ.
+			 */
+			smp_mb();
+			smp_call_function_single(1, hcd_init_fiq, otg_dev, 1);
+		} else {
+			smp_call_function_single(0, hcd_init_fiq, otg_dev, 1);
+		}
+	}
+#endif
+
+	hcd->self.otg_port = dwc_otg_hcd_otg_port(dwc_otg_hcd);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,33) //don't support for LM(with 2.6.20.1 kernel)
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,35) //version field absent later
+	hcd->self.otg_version = dwc_otg_get_otg_version(otg_dev->core_if);
+#endif
+	/* Don't support SG list at this point */
+	hcd->self.sg_tablesize = 0;
+#endif
+	/*
+	 * Finish generic HCD initialization and start the HCD. This function
+	 * allocates the DMA buffer pool, registers the USB bus, requests the
+	 * IRQ line, and calls hcd_start method.
+	 */
+#ifdef PLATFORM_INTERFACE
+	retval = usb_add_hcd(hcd, platform_get_irq(_dev, fiq_enable ? 0 : 1), IRQF_SHARED);
+#else
+	retval = usb_add_hcd(hcd, _dev->irq, IRQF_SHARED);
+#endif
+	if (retval < 0) {
+		goto error2;
+	}
+
+	dwc_otg_hcd_set_priv_data(dwc_otg_hcd, hcd);
+	return 0;
+
+error2:
+	usb_put_hcd(hcd);
+error1:
+	return retval;
+}
+
+/**
+ * Removes the HCD.
+ * Frees memory and resources associated with the HCD and deregisters the bus.
+ */
+void hcd_remove(dwc_bus_dev_t *_dev)
+{
+	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
+	dwc_otg_hcd_t *dwc_otg_hcd;
+	struct usb_hcd *hcd;
+
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD REMOVE otg_dev=%p\n", otg_dev);
+
+	if (!otg_dev) {
+		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev NULL!\n", __func__);
+		return;
+	}
+
+	dwc_otg_hcd = otg_dev->hcd;
+
+	if (!dwc_otg_hcd) {
+		DWC_DEBUGPL(DBG_ANY, "%s: otg_dev->hcd NULL!\n", __func__);
+		return;
+	}
+
+	hcd = dwc_otg_hcd_to_hcd(dwc_otg_hcd);
+
+	if (!hcd) {
+		DWC_DEBUGPL(DBG_ANY,
+			    "%s: dwc_otg_hcd_to_hcd(dwc_otg_hcd) NULL!\n",
+			    __func__);
+		return;
+	}
+	usb_remove_hcd(hcd);
+	dwc_otg_hcd_set_priv_data(dwc_otg_hcd, NULL);
+	dwc_otg_hcd_remove(dwc_otg_hcd);
+	usb_put_hcd(hcd);
+}
+
+/* =========================================================================
+ *  Linux HC Driver Functions
+ * ========================================================================= */
+
+/** Initializes the DWC_otg controller and its root hub and prepares it for host
+ * mode operation. Activates the root port. Returns 0 on success and a negative
+ * error code on failure. */
+int hcd_start(struct usb_hcd *hcd)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+	struct usb_bus *bus;
+
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD START\n");
+	bus = hcd_to_bus(hcd);
+
+	hcd->state = HC_STATE_RUNNING;
+	if (dwc_otg_hcd_start(dwc_otg_hcd, &hcd_fops)) {
+		return 0;
+	}
+
+	/* Initialize and connect root hub if one is not already attached */
+	if (bus->root_hub) {
+		DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD Has Root Hub\n");
+		/* Inform the HUB driver to resume. */
+		usb_hcd_resume_root_hub(hcd);
+	}
+
+	return 0;
+}
+
+/**
+ * Halts the DWC_otg host mode operations in a clean manner. USB transfers are
+ * stopped.
+ */
+void hcd_stop(struct usb_hcd *hcd)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+
+	dwc_otg_hcd_stop(dwc_otg_hcd);
+}
+
+/** Returns the current frame number. */
+static int get_frame_number(struct usb_hcd *hcd)
+{
+	hprt0_data_t hprt0;
+	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+	hprt0.d32 = DWC_READ_REG32(dwc_otg_hcd->core_if->host_if->hprt0);
+	if (hprt0.b.prtspd == DWC_HPRT0_PRTSPD_HIGH_SPEED)
+		return dwc_otg_hcd_get_frame_number(dwc_otg_hcd) >> 3;
+	else
+		return dwc_otg_hcd_get_frame_number(dwc_otg_hcd);
+}
+
+#ifdef DEBUG
+static void dump_urb_info(struct urb *urb, char *fn_name)
+{
+	DWC_PRINTF("%s, urb %p\n", fn_name, urb);
+	DWC_PRINTF("  Device address: %d\n", usb_pipedevice(urb->pipe));
+	DWC_PRINTF("  Endpoint: %d, %s\n", usb_pipeendpoint(urb->pipe),
+		   (usb_pipein(urb->pipe) ? "IN" : "OUT"));
+	DWC_PRINTF("  Endpoint type: %s\n", ( {
+					     char *pipetype;
+					     switch (usb_pipetype(urb->pipe)) {
+case PIPE_CONTROL:
+pipetype = "CONTROL"; break; case PIPE_BULK:
+pipetype = "BULK"; break; case PIPE_INTERRUPT:
+pipetype = "INTERRUPT"; break; case PIPE_ISOCHRONOUS:
+pipetype = "ISOCHRONOUS"; break; default:
+					     pipetype = "UNKNOWN"; break;};
+					     pipetype;}
+		   )) ;
+	DWC_PRINTF("  Speed: %s\n", ( {
+				     char *speed; switch (urb->dev->speed) {
+case USB_SPEED_HIGH:
+speed = "HIGH"; break; case USB_SPEED_FULL:
+speed = "FULL"; break; case USB_SPEED_LOW:
+speed = "LOW"; break; default:
+				     speed = "UNKNOWN"; break;};
+				     speed;}
+		   )) ;
+	DWC_PRINTF("  Max packet size: %d\n",
+		   usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe)));
+	DWC_PRINTF("  Data buffer length: %d\n", urb->transfer_buffer_length);
+	DWC_PRINTF("  Transfer buffer: %p, Transfer DMA: %p\n",
+		   urb->transfer_buffer, (void *)urb->transfer_dma);
+	DWC_PRINTF("  Setup buffer: %p, Setup DMA: %p\n",
+		   urb->setup_packet, (void *)urb->setup_dma);
+	DWC_PRINTF("  Interval: %d\n", urb->interval);
+	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
+		int i;
+		for (i = 0; i < urb->number_of_packets; i++) {
+			DWC_PRINTF("  ISO Desc %d:\n", i);
+			DWC_PRINTF("    offset: %d, length %d\n",
+				   urb->iso_frame_desc[i].offset,
+				   urb->iso_frame_desc[i].length);
+		}
+	}
+}
+#endif
+
+/** Starts processing a USB transfer request specified by a USB Request Block
+ * (URB). mem_flags indicates the type of memory allocation to use while
+ * processing this URB. */
+static int dwc_otg_urb_enqueue(struct usb_hcd *hcd,
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+		       struct usb_host_endpoint *ep,
+#endif
+		       struct urb *urb, gfp_t mem_flags)
+{
+	int retval = 0;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28)
+	struct usb_host_endpoint *ep = urb->ep;
+#endif
+	dwc_irqflags_t irqflags;
+        void **ref_ep_hcpriv = &ep->hcpriv;
+	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+	dwc_otg_hcd_urb_t *dwc_otg_urb;
+	int i;
+	int alloc_bandwidth = 0;
+	uint8_t ep_type = 0;
+	uint32_t flags = 0;
+	void *buf;
+
+#ifdef DEBUG
+	if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
+		dump_urb_info(urb, "dwc_otg_urb_enqueue");
+	}
+#endif
+
+	if (!urb->transfer_buffer && urb->transfer_buffer_length)
+		return -EINVAL;
+
+	if ((usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
+	    || (usb_pipetype(urb->pipe) == PIPE_INTERRUPT)) {
+		if (!dwc_otg_hcd_is_bandwidth_allocated
+		    (dwc_otg_hcd, ref_ep_hcpriv)) {
+			alloc_bandwidth = 1;
+		}
+	}
+
+	switch (usb_pipetype(urb->pipe)) {
+	case PIPE_CONTROL:
+		ep_type = USB_ENDPOINT_XFER_CONTROL;
+		break;
+	case PIPE_ISOCHRONOUS:
+		ep_type = USB_ENDPOINT_XFER_ISOC;
+		break;
+	case PIPE_BULK:
+		ep_type = USB_ENDPOINT_XFER_BULK;
+		break;
+	case PIPE_INTERRUPT:
+		ep_type = USB_ENDPOINT_XFER_INT;
+		break;
+	default:
+                DWC_WARN("Wrong EP type - %d\n", usb_pipetype(urb->pipe));
+	}
+
+        /* # of packets is often 0 - do we really need to call this then? */
+	dwc_otg_urb = dwc_otg_hcd_urb_alloc(dwc_otg_hcd,
+					    urb->number_of_packets,
+					    mem_flags == GFP_ATOMIC ? 1 : 0);
+
+	if(dwc_otg_urb == NULL)
+		return -ENOMEM;
+
+	if (!dwc_otg_urb && urb->number_of_packets)
+		return -ENOMEM;
+
+	dwc_otg_hcd_urb_set_pipeinfo(dwc_otg_urb, usb_pipedevice(urb->pipe),
+				     usb_pipeendpoint(urb->pipe), ep_type,
+				     usb_pipein(urb->pipe),
+				     usb_maxpacket(urb->dev, urb->pipe,
+						   !(usb_pipein(urb->pipe))));
+
+	buf = urb->transfer_buffer;
+	if (hcd->self.uses_dma && !buf && urb->transfer_buffer_length) {
+		/*
+		 * Calculate virtual address from physical address,
+		 * because some class driver may not fill transfer_buffer.
+		 * In Buffer DMA mode virual address is used,
+		 * when handling non DWORD aligned buffers.
+		 */
+		buf = (void *)__bus_to_virt((unsigned long)urb->transfer_dma);
+		dev_warn_once(&urb->dev->dev,
+			      "USB transfer_buffer was NULL, will use __bus_to_virt(%pad)=%p\n",
+			      &urb->transfer_dma, buf);
+	}
+
+	if (!(urb->transfer_flags & URB_NO_INTERRUPT))
+		flags |= URB_GIVEBACK_ASAP;
+	if (urb->transfer_flags & URB_ZERO_PACKET)
+		flags |= URB_SEND_ZERO_PACKET;
+
+	dwc_otg_hcd_urb_set_params(dwc_otg_urb, urb, buf,
+				   urb->transfer_dma,
+				   urb->transfer_buffer_length,
+				   urb->setup_packet,
+				   urb->setup_dma, flags, urb->interval);
+
+	for (i = 0; i < urb->number_of_packets; ++i) {
+		dwc_otg_hcd_urb_set_iso_desc_params(dwc_otg_urb, i,
+						    urb->
+						    iso_frame_desc[i].offset,
+						    urb->
+						    iso_frame_desc[i].length);
+	}
+
+	DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &irqflags);
+	urb->hcpriv = dwc_otg_urb;
+#if USB_URB_EP_LINKING
+	retval = usb_hcd_link_urb_to_ep(hcd, urb);
+	if (0 == retval)
+#endif
+	{
+		retval = dwc_otg_hcd_urb_enqueue(dwc_otg_hcd, dwc_otg_urb,
+						/*(dwc_otg_qh_t **)*/
+						ref_ep_hcpriv, 1);
+		if (0 == retval) {
+			if (alloc_bandwidth) {
+				allocate_bus_bandwidth(hcd,
+						dwc_otg_hcd_get_ep_bandwidth(
+							dwc_otg_hcd, *ref_ep_hcpriv),
+						urb);
+			}
+		} else {
+			DWC_DEBUGPL(DBG_HCD, "DWC OTG dwc_otg_hcd_urb_enqueue failed rc %d\n", retval);
+#if USB_URB_EP_LINKING
+			usb_hcd_unlink_urb_from_ep(hcd, urb);
+#endif
+			DWC_FREE(dwc_otg_urb);
+			urb->hcpriv = NULL;
+			if (retval == -DWC_E_NO_DEVICE)
+				retval = -ENODEV;
+		}
+	}
+#if USB_URB_EP_LINKING
+	else
+	{
+		DWC_FREE(dwc_otg_urb);
+		urb->hcpriv = NULL;
+	}
+#endif
+	DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, irqflags);
+	return retval;
+}
+
+/** Aborts/cancels a USB transfer request. Always returns 0 to indicate
+ * success.  */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+static int dwc_otg_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
+#else
+static int dwc_otg_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
+#endif
+{
+	dwc_irqflags_t flags;
+	dwc_otg_hcd_t *dwc_otg_hcd;
+        int rc;
+
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Dequeue\n");
+
+	dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+
+#ifdef DEBUG
+	if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
+		dump_urb_info(urb, "dwc_otg_urb_dequeue");
+	}
+#endif
+
+	DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
+	rc = usb_hcd_check_unlink_urb(hcd, urb, status);
+	if (0 == rc) {
+		if(urb->hcpriv != NULL) {
+	                dwc_otg_hcd_urb_dequeue(dwc_otg_hcd,
+	                                    (dwc_otg_hcd_urb_t *)urb->hcpriv);
+
+		        DWC_FREE(urb->hcpriv);
+			urb->hcpriv = NULL;
+		}
+        }
+
+        if (0 == rc) {
+		/* Higher layer software sets URB status. */
+#if USB_URB_EP_LINKING
+                usb_hcd_unlink_urb_from_ep(hcd, urb);
+#endif
+		DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, flags);
+
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+                usb_hcd_giveback_urb(hcd, urb);
+#else
+                usb_hcd_giveback_urb(hcd, urb, status);
+#endif
+                if (CHK_DEBUG_LEVEL(DBG_HCDV | DBG_HCD_URB)) {
+                        DWC_PRINTF("Called usb_hcd_giveback_urb() \n");
+                        DWC_PRINTF("  1urb->status = %d\n", urb->status);
+                }
+                DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Dequeue OK\n");
+        } else {
+		DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, flags);
+                DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD URB Dequeue failed - rc %d\n",
+                            rc);
+        }
+
+	return rc;
+}
+
+/* Frees resources in the DWC_otg controller related to a given endpoint. Also
+ * clears state in the HCD related to the endpoint. Any URBs for the endpoint
+ * must already be dequeued. */
+static void endpoint_disable(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+
+	DWC_DEBUGPL(DBG_HCD,
+		    "DWC OTG HCD EP DISABLE: _bEndpointAddress=0x%02x, "
+		    "endpoint=%d\n", ep->desc.bEndpointAddress,
+		    dwc_ep_addr_to_endpoint(ep->desc.bEndpointAddress));
+	dwc_otg_hcd_endpoint_disable(dwc_otg_hcd, ep->hcpriv, 250);
+	ep->hcpriv = NULL;
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30)
+/* Resets endpoint specific parameter values, in current version used to reset
+ * the data toggle(as a WA). This function can be called from usb_clear_halt routine */
+static void endpoint_reset(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
+{
+	dwc_irqflags_t flags;
+	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD EP RESET: Endpoint Num=0x%02d\n", epnum);
+
+	DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
+	if (ep->hcpriv) {
+		dwc_otg_hcd_endpoint_reset(dwc_otg_hcd, ep->hcpriv);
+	}
+	DWC_SPINUNLOCK_IRQRESTORE(dwc_otg_hcd->lock, flags);
+}
+#endif
+
+/** Handles host mode interrupts for the DWC_otg controller. Returns IRQ_NONE if
+ * there was no interrupt to handle. Returns IRQ_HANDLED if there was a valid
+ * interrupt.
+ *
+ * This function is called by the USB core when an interrupt occurs */
+static irqreturn_t dwc_otg_hcd_irq(struct usb_hcd *hcd)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+	int32_t retval = dwc_otg_hcd_handle_intr(dwc_otg_hcd);
+	if (retval != 0) {
+		S3C2410X_CLEAR_EINTPEND();
+	}
+	return IRQ_RETVAL(retval);
+}
+
+/** Creates Status Change bitmap for the root hub and root port. The bitmap is
+ * returned in buf. Bit 0 is the status change indicator for the root hub. Bit 1
+ * is the status change indicator for the single root port. Returns 1 if either
+ * change indicator is 1, otherwise returns 0. */
+int hub_status_data(struct usb_hcd *hcd, char *buf)
+{
+	dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
+
+	buf[0] = 0;
+	buf[0] |= (dwc_otg_hcd_is_status_changed(dwc_otg_hcd, 1)) << 1;
+
+	return (buf[0] != 0);
+}
+
+/** Handles hub class-specific requests. */
+int hub_control(struct usb_hcd *hcd,
+		u16 typeReq, u16 wValue, u16 wIndex, char *buf, u16 wLength)
+{
+	int retval;
+
+	retval = dwc_otg_hcd_hub_control(hcd_to_dwc_otg_hcd(hcd),
+					 typeReq, wValue, wIndex, buf, wLength);
+
+	switch (retval) {
+	case -DWC_E_INVALID:
+		retval = -EINVAL;
+		break;
+	}
+
+	return retval;
+}
+
+#endif /* DWC_DEVICE_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c
new file mode 100644
index 000000000000..fe8e8f841f03
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_queue.c
@@ -0,0 +1,971 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_hcd_queue.c $
+ * $Revision: #44 $
+ * $Date: 2011/10/26 $
+ * $Change: 1873028 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_DEVICE_ONLY
+
+/**
+ * @file
+ *
+ * This file contains the functions to manage Queue Heads and Queue
+ * Transfer Descriptors.
+ */
+
+#include "dwc_otg_hcd.h"
+#include "dwc_otg_regs.h"
+
+extern bool microframe_schedule;
+extern unsigned short int_ep_interval_min;
+
+/**
+ * Free each QTD in the QH's QTD-list then free the QH.  QH should already be
+ * removed from a list.  QTD list should already be empty if called from URB
+ * Dequeue.
+ *
+ * @param hcd HCD instance.
+ * @param qh The QH to free.
+ */
+void dwc_otg_hcd_qh_free(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	dwc_otg_qtd_t *qtd, *qtd_tmp;
+	dwc_irqflags_t flags;
+	uint32_t buf_size = 0;
+	uint8_t *align_buf_virt = NULL;
+	dwc_dma_t align_buf_dma;
+	struct device *dev = dwc_otg_hcd_to_dev(hcd);
+
+	/* Free each QTD in the QTD list */
+	DWC_SPINLOCK_IRQSAVE(hcd->lock, &flags);
+	DWC_CIRCLEQ_FOREACH_SAFE(qtd, qtd_tmp, &qh->qtd_list, qtd_list_entry) {
+		DWC_CIRCLEQ_REMOVE(&qh->qtd_list, qtd, qtd_list_entry);
+		dwc_otg_hcd_qtd_free(qtd);
+	}
+
+	if (hcd->core_if->dma_desc_enable) {
+		dwc_otg_hcd_qh_free_ddma(hcd, qh);
+	} else if (qh->dw_align_buf) {
+		if (qh->ep_type == UE_ISOCHRONOUS) {
+			buf_size = 4096;
+		} else {
+			buf_size = hcd->core_if->core_params->max_transfer_size;
+		}
+		align_buf_virt = qh->dw_align_buf;
+		align_buf_dma = qh->dw_align_buf_dma;
+	}
+
+	DWC_FREE(qh);
+	DWC_SPINUNLOCK_IRQRESTORE(hcd->lock, flags);
+	if (align_buf_virt)
+		DWC_DMA_FREE(dev, buf_size, align_buf_virt, align_buf_dma);
+	return;
+}
+
+#define BitStuffTime(bytecount)  ((8 * 7* bytecount) / 6)
+#define HS_HOST_DELAY		5	/* nanoseconds */
+#define FS_LS_HOST_DELAY	1000	/* nanoseconds */
+#define HUB_LS_SETUP		333	/* nanoseconds */
+#define NS_TO_US(ns)		((ns + 500) / 1000)
+				/* convert & round nanoseconds to microseconds */
+
+static uint32_t calc_bus_time(int speed, int is_in, int is_isoc, int bytecount)
+{
+	unsigned long retval;
+
+	switch (speed) {
+	case USB_SPEED_HIGH:
+		if (is_isoc) {
+			retval =
+			    ((38 * 8 * 2083) +
+			     (2083 * (3 + BitStuffTime(bytecount)))) / 1000 +
+			    HS_HOST_DELAY;
+		} else {
+			retval =
+			    ((55 * 8 * 2083) +
+			     (2083 * (3 + BitStuffTime(bytecount)))) / 1000 +
+			    HS_HOST_DELAY;
+		}
+		break;
+	case USB_SPEED_FULL:
+		if (is_isoc) {
+			retval =
+			    (8354 * (31 + 10 * BitStuffTime(bytecount))) / 1000;
+			if (is_in) {
+				retval = 7268 + FS_LS_HOST_DELAY + retval;
+			} else {
+				retval = 6265 + FS_LS_HOST_DELAY + retval;
+			}
+		} else {
+			retval =
+			    (8354 * (31 + 10 * BitStuffTime(bytecount))) / 1000;
+			retval = 9107 + FS_LS_HOST_DELAY + retval;
+		}
+		break;
+	case USB_SPEED_LOW:
+		if (is_in) {
+			retval =
+			    (67667 * (31 + 10 * BitStuffTime(bytecount))) /
+			    1000;
+			retval =
+			    64060 + (2 * HUB_LS_SETUP) + FS_LS_HOST_DELAY +
+			    retval;
+		} else {
+			retval =
+			    (66700 * (31 + 10 * BitStuffTime(bytecount))) /
+			    1000;
+			retval =
+			    64107 + (2 * HUB_LS_SETUP) + FS_LS_HOST_DELAY +
+			    retval;
+		}
+		break;
+	default:
+		DWC_WARN("Unknown device speed\n");
+		retval = -1;
+	}
+
+	return NS_TO_US(retval);
+}
+
+/**
+ * Initializes a QH structure.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param qh  The QH to init.
+ * @param urb Holds the information about the device/endpoint that we need
+ * 	      to initialize the QH.
+ */
+#define SCHEDULE_SLOP 10
+void qh_init(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh, dwc_otg_hcd_urb_t * urb)
+{
+	char *speed, *type;
+	int dev_speed;
+	uint32_t hub_addr, hub_port;
+
+	dwc_memset(qh, 0, sizeof(dwc_otg_qh_t));
+
+	/* Initialize QH */
+	qh->ep_type = dwc_otg_hcd_get_pipe_type(&urb->pipe_info);
+	qh->ep_is_in = dwc_otg_hcd_is_pipe_in(&urb->pipe_info) ? 1 : 0;
+
+	qh->data_toggle = DWC_OTG_HC_PID_DATA0;
+	qh->maxp = dwc_otg_hcd_get_mps(&urb->pipe_info);
+	DWC_CIRCLEQ_INIT(&qh->qtd_list);
+	DWC_LIST_INIT(&qh->qh_list_entry);
+	qh->channel = NULL;
+
+	/* FS/LS Enpoint on HS Hub
+	 * NOT virtual root hub */
+	dev_speed = hcd->fops->speed(hcd, urb->priv);
+
+	hcd->fops->hub_info(hcd, urb->priv, &hub_addr, &hub_port);
+	qh->do_split = 0;
+	if (microframe_schedule)
+		qh->speed = dev_speed;
+
+	qh->nak_frame = 0xffff;
+
+	if (((dev_speed == USB_SPEED_LOW) ||
+	     (dev_speed == USB_SPEED_FULL)) &&
+	    (hub_addr != 0 && hub_addr != 1)) {
+		DWC_DEBUGPL(DBG_HCD,
+			    "QH init: EP %d: TT found at hub addr %d, for port %d\n",
+			    dwc_otg_hcd_get_ep_num(&urb->pipe_info), hub_addr,
+			    hub_port);
+		qh->do_split = 1;
+		qh->skip_count = 0;
+	}
+
+	if (qh->ep_type == UE_INTERRUPT || qh->ep_type == UE_ISOCHRONOUS) {
+		/* Compute scheduling parameters once and save them. */
+		hprt0_data_t hprt;
+
+		/** @todo Account for split transfers in the bus time. */
+		int bytecount =
+		    dwc_hb_mult(qh->maxp) * dwc_max_packet(qh->maxp);
+
+		qh->usecs =
+		    calc_bus_time((qh->do_split ? USB_SPEED_HIGH : dev_speed),
+				  qh->ep_is_in, (qh->ep_type == UE_ISOCHRONOUS),
+				  bytecount);
+		/* Start in a slightly future (micro)frame. */
+		qh->sched_frame = dwc_frame_num_inc(hcd->frame_number,
+						    SCHEDULE_SLOP);
+		qh->interval = urb->interval;
+
+		hprt.d32 = DWC_READ_REG32(hcd->core_if->host_if->hprt0);
+		if (hprt.b.prtspd == DWC_HPRT0_PRTSPD_HIGH_SPEED) {
+			if (dev_speed == USB_SPEED_LOW ||
+					dev_speed == USB_SPEED_FULL) {
+				qh->interval *= 8;
+				qh->sched_frame |= 0x7;
+				qh->start_split_frame = qh->sched_frame;
+			} else if (int_ep_interval_min >= 2 &&
+					qh->interval < int_ep_interval_min &&
+					qh->ep_type == UE_INTERRUPT) {
+				qh->interval = int_ep_interval_min;
+			}
+		}
+	}
+
+	DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD QH Initialized\n");
+	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - qh = %p\n", qh);
+	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - Device Address = %d\n",
+		    dwc_otg_hcd_get_dev_addr(&urb->pipe_info));
+	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - Endpoint %d, %s\n",
+		    dwc_otg_hcd_get_ep_num(&urb->pipe_info),
+		    dwc_otg_hcd_is_pipe_in(&urb->pipe_info) ? "IN" : "OUT");
+	switch (dev_speed) {
+	case USB_SPEED_LOW:
+		qh->dev_speed = DWC_OTG_EP_SPEED_LOW;
+		speed = "low";
+		break;
+	case USB_SPEED_FULL:
+		qh->dev_speed = DWC_OTG_EP_SPEED_FULL;
+		speed = "full";
+		break;
+	case USB_SPEED_HIGH:
+		qh->dev_speed = DWC_OTG_EP_SPEED_HIGH;
+		speed = "high";
+		break;
+	default:
+		speed = "?";
+		break;
+	}
+	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - Speed = %s\n", speed);
+
+	switch (qh->ep_type) {
+	case UE_ISOCHRONOUS:
+		type = "isochronous";
+		break;
+	case UE_INTERRUPT:
+		type = "interrupt";
+		break;
+	case UE_CONTROL:
+		type = "control";
+		break;
+	case UE_BULK:
+		type = "bulk";
+		break;
+	default:
+		type = "?";
+		break;
+	}
+
+	DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH  - Type = %s\n", type);
+
+#ifdef DEBUG
+	if (qh->ep_type == UE_INTERRUPT) {
+		DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH - usecs = %d\n",
+			    qh->usecs);
+		DWC_DEBUGPL(DBG_HCDV, "DWC OTG HCD QH - interval = %d\n",
+			    qh->interval);
+	}
+#endif
+
+}
+
+/**
+ * This function allocates and initializes a QH.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param urb Holds the information about the device/endpoint that we need
+ * 	      to initialize the QH.
+ * @param atomic_alloc Flag to do atomic allocation if needed
+ *
+ * @return Returns pointer to the newly allocated QH, or NULL on error. */
+dwc_otg_qh_t *dwc_otg_hcd_qh_create(dwc_otg_hcd_t * hcd,
+				    dwc_otg_hcd_urb_t * urb, int atomic_alloc)
+{
+	dwc_otg_qh_t *qh;
+
+	/* Allocate memory */
+	/** @todo add memflags argument */
+	qh = dwc_otg_hcd_qh_alloc(atomic_alloc);
+	if (qh == NULL) {
+		DWC_ERROR("qh allocation failed");
+		return NULL;
+	}
+
+	qh_init(hcd, qh, urb);
+
+	if (hcd->core_if->dma_desc_enable
+	    && (dwc_otg_hcd_qh_init_ddma(hcd, qh) < 0)) {
+		dwc_otg_hcd_qh_free(hcd, qh);
+		return NULL;
+	}
+
+	return qh;
+}
+
+/* microframe_schedule=0 start */
+
+/**
+ * Checks that a channel is available for a periodic transfer.
+ *
+ * @return 0 if successful, negative error code otherise.
+ */
+static int periodic_channel_available(dwc_otg_hcd_t * hcd)
+{
+	/*
+	 * Currently assuming that there is a dedicated host channnel for each
+	 * periodic transaction plus at least one host channel for
+	 * non-periodic transactions.
+	 */
+	int status;
+	int num_channels;
+
+	num_channels = hcd->core_if->core_params->host_channels;
+	if ((hcd->periodic_channels + hcd->non_periodic_channels < num_channels)
+	    && (hcd->periodic_channels < num_channels - 1)) {
+		status = 0;
+	} else {
+		DWC_INFO("%s: Total channels: %d, Periodic: %d, Non-periodic: %d\n",
+			__func__, num_channels, hcd->periodic_channels, hcd->non_periodic_channels);	//NOTICE
+		status = -DWC_E_NO_SPACE;
+	}
+
+	return status;
+}
+
+/**
+ * Checks that there is sufficient bandwidth for the specified QH in the
+ * periodic schedule. For simplicity, this calculation assumes that all the
+ * transfers in the periodic schedule may occur in the same (micro)frame.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param qh QH containing periodic bandwidth required.
+ *
+ * @return 0 if successful, negative error code otherwise.
+ */
+static int check_periodic_bandwidth(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	int status;
+	int16_t max_claimed_usecs;
+
+	status = 0;
+
+	if ((qh->dev_speed == DWC_OTG_EP_SPEED_HIGH) || qh->do_split) {
+		/*
+		 * High speed mode.
+		 * Max periodic usecs is 80% x 125 usec = 100 usec.
+		 */
+
+		max_claimed_usecs = 100 - qh->usecs;
+	} else {
+		/*
+		 * Full speed mode.
+		 * Max periodic usecs is 90% x 1000 usec = 900 usec.
+		 */
+		max_claimed_usecs = 900 - qh->usecs;
+	}
+
+	if (hcd->periodic_usecs > max_claimed_usecs) {
+		DWC_INFO("%s: already claimed usecs %d, required usecs %d\n", __func__, hcd->periodic_usecs, qh->usecs);	//NOTICE
+		status = -DWC_E_NO_SPACE;
+	}
+
+	return status;
+}
+
+/* microframe_schedule=0 end */
+
+/**
+ * Microframe scheduler
+ * track the total use in hcd->frame_usecs
+ * keep each qh use in qh->frame_usecs
+ * when surrendering the qh then donate the time back
+ */
+const unsigned short max_uframe_usecs[]={ 100, 100, 100, 100, 100, 100, 30, 0 };
+
+/*
+ * called from dwc_otg_hcd.c:dwc_otg_hcd_init
+ */
+void init_hcd_usecs(dwc_otg_hcd_t *_hcd)
+{
+	int i;
+	if (_hcd->flags.b.port_speed == DWC_HPRT0_PRTSPD_FULL_SPEED) {
+		_hcd->frame_usecs[0] = 900;
+		for (i = 1; i < 8; i++)
+			_hcd->frame_usecs[i] = 0;
+	} else {
+		for (i = 0; i < 8; i++)
+			_hcd->frame_usecs[i] = max_uframe_usecs[i];
+	}
+}
+
+static int find_single_uframe(dwc_otg_hcd_t * _hcd, dwc_otg_qh_t * _qh)
+{
+	int i;
+	unsigned short utime;
+	int t_left;
+	int ret;
+	int done;
+
+	ret = -1;
+	utime = _qh->usecs;
+	t_left = utime;
+	i = 0;
+	done = 0;
+	while (done == 0) {
+		/* At the start _hcd->frame_usecs[i] = max_uframe_usecs[i]; */
+		if (utime <= _hcd->frame_usecs[i]) {
+			_hcd->frame_usecs[i] -= utime;
+			_qh->frame_usecs[i] += utime;
+			t_left -= utime;
+			ret = i;
+			done = 1;
+			return ret;
+		} else {
+			i++;
+			if (i == 8) {
+				done = 1;
+				ret = -1;
+			}
+		}
+	}
+	return ret;
+ }
+
+/*
+ * use this for FS apps that can span multiple uframes
+  */
+static int find_multi_uframe(dwc_otg_hcd_t * _hcd, dwc_otg_qh_t * _qh)
+{
+	int i;
+	int j;
+	unsigned short utime;
+	int t_left;
+	int ret;
+	int done;
+	unsigned short xtime;
+
+	ret = -1;
+	utime = _qh->usecs;
+	t_left = utime;
+	i = 0;
+	done = 0;
+loop:
+	while (done == 0) {
+		if(_hcd->frame_usecs[i] <= 0) {
+			i++;
+			if (i == 8) {
+				done = 1;
+				ret = -1;
+			}
+			goto loop;
+		}
+
+		/*
+		 * we need n consecutive slots
+		 * so use j as a start slot j plus j+1 must be enough time (for now)
+		 */
+		xtime= _hcd->frame_usecs[i];
+		for (j = i+1 ; j < 8 ; j++ ) {
+                       /*
+                        * if we add this frame remaining time to xtime we may
+                        * be OK, if not we need to test j for a complete frame
+                        */
+                       if ((xtime+_hcd->frame_usecs[j]) < utime) {
+                               if (_hcd->frame_usecs[j] < max_uframe_usecs[j]) {
+                                       j = 8;
+                                       ret = -1;
+                                       continue;
+                               }
+                       }
+                       if (xtime >= utime) {
+                               ret = i;
+                               j = 8;  /* stop loop with a good value ret */
+                               continue;
+                       }
+                       /* add the frame time to x time */
+                       xtime += _hcd->frame_usecs[j];
+		       /* we must have a fully available next frame or break */
+		       if ((xtime < utime)
+				       && (_hcd->frame_usecs[j] == max_uframe_usecs[j])) {
+			       ret = -1;
+			       j = 8;  /* stop loop with a bad value ret */
+			       continue;
+		       }
+		}
+		if (ret >= 0) {
+			t_left = utime;
+			for (j = i; (t_left>0) && (j < 8); j++ ) {
+				t_left -= _hcd->frame_usecs[j];
+				if ( t_left <= 0 ) {
+					_qh->frame_usecs[j] += _hcd->frame_usecs[j] + t_left;
+					_hcd->frame_usecs[j]= -t_left;
+					ret = i;
+					done = 1;
+				} else {
+					_qh->frame_usecs[j] += _hcd->frame_usecs[j];
+					_hcd->frame_usecs[j] = 0;
+				}
+			}
+		} else {
+			i++;
+			if (i == 8) {
+				done = 1;
+				ret = -1;
+			}
+		}
+	}
+	return ret;
+}
+
+static int find_uframe(dwc_otg_hcd_t * _hcd, dwc_otg_qh_t * _qh)
+{
+	int ret;
+	ret = -1;
+
+	if (_qh->speed == USB_SPEED_HIGH ||
+		_hcd->flags.b.port_speed == DWC_HPRT0_PRTSPD_FULL_SPEED) {
+		/* if this is a hs transaction we need a full frame - or account for FS usecs */
+		ret = find_single_uframe(_hcd, _qh);
+	} else {
+		/* if this is a fs transaction we may need a sequence of frames */
+		ret = find_multi_uframe(_hcd, _qh);
+	}
+	return ret;
+}
+
+/**
+ * Checks that the max transfer size allowed in a host channel is large enough
+ * to handle the maximum data transfer in a single (micro)frame for a periodic
+ * transfer.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param qh QH for a periodic endpoint.
+ *
+ * @return 0 if successful, negative error code otherwise.
+ */
+static int check_max_xfer_size(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	int status;
+	uint32_t max_xfer_size;
+	uint32_t max_channel_xfer_size;
+
+	status = 0;
+
+	max_xfer_size = dwc_max_packet(qh->maxp) * dwc_hb_mult(qh->maxp);
+	max_channel_xfer_size = hcd->core_if->core_params->max_transfer_size;
+
+	if (max_xfer_size > max_channel_xfer_size) {
+		DWC_INFO("%s: Periodic xfer length %d > " "max xfer length for channel %d\n",
+				__func__, max_xfer_size, max_channel_xfer_size);	//NOTICE
+		status = -DWC_E_NO_SPACE;
+	}
+
+	return status;
+}
+
+
+
+/**
+ * Schedules an interrupt or isochronous transfer in the periodic schedule.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param qh QH for the periodic transfer. The QH should already contain the
+ * scheduling information.
+ *
+ * @return 0 if successful, negative error code otherwise.
+ */
+static int schedule_periodic(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	int status = 0;
+
+	if (microframe_schedule) {
+		int frame;
+		status = find_uframe(hcd, qh);
+		frame = -1;
+		if (status == 0) {
+			frame = 7;
+		} else {
+			if (status > 0 )
+				frame = status-1;
+		}
+
+		/* Set the new frame up */
+		if (frame > -1) {
+			qh->sched_frame &= ~0x7;
+			qh->sched_frame |= (frame & 7);
+		}
+
+		if (status != -1)
+			status = 0;
+	} else {
+		status = periodic_channel_available(hcd);
+		if (status) {
+			DWC_INFO("%s: No host channel available for periodic " "transfer.\n", __func__);	//NOTICE
+			return status;
+		}
+
+		status = check_periodic_bandwidth(hcd, qh);
+	}
+	if (status) {
+		DWC_INFO("%s: Insufficient periodic bandwidth for "
+			    "periodic transfer.\n", __func__);
+		return -DWC_E_NO_SPACE;
+	}
+	status = check_max_xfer_size(hcd, qh);
+	if (status) {
+		DWC_INFO("%s: Channel max transfer size too small "
+			    "for periodic transfer.\n", __func__);
+		return status;
+	}
+
+	if (hcd->core_if->dma_desc_enable) {
+		/* Don't rely on SOF and start in ready schedule */
+		DWC_LIST_INSERT_TAIL(&hcd->periodic_sched_ready, &qh->qh_list_entry);
+	}
+	else {
+		if(fiq_enable && (DWC_LIST_EMPTY(&hcd->periodic_sched_inactive) || dwc_frame_num_le(qh->sched_frame, hcd->fiq_state->next_sched_frame)))
+		{
+			hcd->fiq_state->next_sched_frame = qh->sched_frame;
+
+		}
+		/* Always start in the inactive schedule. */
+		DWC_LIST_INSERT_TAIL(&hcd->periodic_sched_inactive, &qh->qh_list_entry);
+	}
+
+	if (!microframe_schedule) {
+		/* Reserve the periodic channel. */
+		hcd->periodic_channels++;
+	}
+
+	/* Update claimed usecs per (micro)frame. */
+	hcd->periodic_usecs += qh->usecs;
+
+	return status;
+}
+
+
+/**
+ * This function adds a QH to either the non periodic or periodic schedule if
+ * it is not already in the schedule. If the QH is already in the schedule, no
+ * action is taken.
+ *
+ * @return 0 if successful, negative error code otherwise.
+ */
+int dwc_otg_hcd_qh_add(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	int status = 0;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	if (!DWC_LIST_EMPTY(&qh->qh_list_entry)) {
+		/* QH already in a schedule. */
+		return status;
+	}
+
+	/* Add the new QH to the appropriate schedule */
+	if (dwc_qh_is_non_per(qh)) {
+		/* Always start in the inactive schedule. */
+		DWC_LIST_INSERT_TAIL(&hcd->non_periodic_sched_inactive,
+				     &qh->qh_list_entry);
+		//hcd->fiq_state->kick_np_queues = 1;
+	} else {
+		status = schedule_periodic(hcd, qh);
+		if ( !hcd->periodic_qh_count ) {
+			intr_mask.b.sofintr = 1;
+			if (fiq_enable) {
+				local_fiq_disable();
+				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, intr_mask.d32, intr_mask.d32);
+				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+				local_fiq_enable();
+			} else {
+				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, intr_mask.d32, intr_mask.d32);
+			}
+		}
+		hcd->periodic_qh_count++;
+	}
+
+	return status;
+}
+
+/**
+ * Removes an interrupt or isochronous transfer from the periodic schedule.
+ *
+ * @param hcd The HCD state structure for the DWC OTG controller.
+ * @param qh QH for the periodic transfer.
+ */
+static void deschedule_periodic(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	int i;
+	DWC_LIST_REMOVE_INIT(&qh->qh_list_entry);
+
+	/* Update claimed usecs per (micro)frame. */
+	hcd->periodic_usecs -= qh->usecs;
+
+	if (!microframe_schedule) {
+		/* Release the periodic channel reservation. */
+		hcd->periodic_channels--;
+	} else {
+		for (i = 0; i < 8; i++) {
+			hcd->frame_usecs[i] += qh->frame_usecs[i];
+			qh->frame_usecs[i] = 0;
+		}
+	}
+}
+
+/**
+ * Removes a QH from either the non-periodic or periodic schedule.  Memory is
+ * not freed.
+ *
+ * @param hcd The HCD state structure.
+ * @param qh QH to remove from schedule. */
+void dwc_otg_hcd_qh_remove(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh)
+{
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	if (DWC_LIST_EMPTY(&qh->qh_list_entry)) {
+		/* QH is not in a schedule. */
+		return;
+	}
+
+	if (dwc_qh_is_non_per(qh)) {
+		if (hcd->non_periodic_qh_ptr == &qh->qh_list_entry) {
+			hcd->non_periodic_qh_ptr =
+			    hcd->non_periodic_qh_ptr->next;
+		}
+		DWC_LIST_REMOVE_INIT(&qh->qh_list_entry);
+		//if (!DWC_LIST_EMPTY(&hcd->non_periodic_sched_inactive))
+		//	hcd->fiq_state->kick_np_queues = 1;
+	} else {
+		deschedule_periodic(hcd, qh);
+		hcd->periodic_qh_count--;
+		if( !hcd->periodic_qh_count && !fiq_fsm_enable ) {
+			intr_mask.b.sofintr = 1;
+			if (fiq_enable) {
+				local_fiq_disable();
+				fiq_fsm_spin_lock(&hcd->fiq_state->lock);
+				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, intr_mask.d32, 0);
+				fiq_fsm_spin_unlock(&hcd->fiq_state->lock);
+				local_fiq_enable();
+			} else {
+				DWC_MODIFY_REG32(&hcd->core_if->core_global_regs->gintmsk, intr_mask.d32, 0);
+			}
+		}
+	}
+}
+
+/**
+ * Deactivates a QH. For non-periodic QHs, removes the QH from the active
+ * non-periodic schedule. The QH is added to the inactive non-periodic
+ * schedule if any QTDs are still attached to the QH.
+ *
+ * For periodic QHs, the QH is removed from the periodic queued schedule. If
+ * there are any QTDs still attached to the QH, the QH is added to either the
+ * periodic inactive schedule or the periodic ready schedule and its next
+ * scheduled frame is calculated. The QH is placed in the ready schedule if
+ * the scheduled frame has been reached already. Otherwise it's placed in the
+ * inactive schedule. If there are no QTDs attached to the QH, the QH is
+ * completely removed from the periodic schedule.
+ */
+void dwc_otg_hcd_qh_deactivate(dwc_otg_hcd_t * hcd, dwc_otg_qh_t * qh,
+			       int sched_next_periodic_split)
+{
+	if (dwc_qh_is_non_per(qh)) {
+		dwc_otg_hcd_qh_remove(hcd, qh);
+		if (!DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
+			/* Add back to inactive non-periodic schedule. */
+			dwc_otg_hcd_qh_add(hcd, qh);
+			//hcd->fiq_state->kick_np_queues = 1;
+		} else {
+			if(nak_holdoff && qh->do_split) {
+				qh->nak_frame = 0xFFFF;
+			}
+		}
+	} else {
+		uint16_t frame_number = dwc_otg_hcd_get_frame_number(hcd);
+
+		if (qh->do_split) {
+			/* Schedule the next continuing periodic split transfer */
+			if (sched_next_periodic_split) {
+
+				qh->sched_frame = frame_number;
+
+				if (dwc_frame_num_le(frame_number,
+						     dwc_frame_num_inc
+						     (qh->start_split_frame,
+						      1))) {
+					/*
+					 * Allow one frame to elapse after start
+					 * split microframe before scheduling
+					 * complete split, but DONT if we are
+					 * doing the next start split in the
+					 * same frame for an ISOC out.
+					 */
+					if ((qh->ep_type != UE_ISOCHRONOUS) ||
+					    (qh->ep_is_in != 0)) {
+						qh->sched_frame =
+						    dwc_frame_num_inc(qh->sched_frame, 1);
+					}
+				}
+			} else {
+				qh->sched_frame =
+				    dwc_frame_num_inc(qh->start_split_frame,
+						      qh->interval);
+				if (dwc_frame_num_le
+				    (qh->sched_frame, frame_number)) {
+					qh->sched_frame = frame_number;
+				}
+				qh->sched_frame |= 0x7;
+				qh->start_split_frame = qh->sched_frame;
+			}
+		} else {
+			qh->sched_frame =
+			    dwc_frame_num_inc(qh->sched_frame, qh->interval);
+			if (dwc_frame_num_le(qh->sched_frame, frame_number)) {
+				qh->sched_frame = frame_number;
+			}
+		}
+
+		if (DWC_CIRCLEQ_EMPTY(&qh->qtd_list)) {
+			dwc_otg_hcd_qh_remove(hcd, qh);
+		} else {
+			/*
+			 * Remove from periodic_sched_queued and move to
+			 * appropriate queue.
+			 */
+			if ((microframe_schedule && dwc_frame_num_le(qh->sched_frame, frame_number)) ||
+			(!microframe_schedule && qh->sched_frame == frame_number)) {
+				DWC_LIST_MOVE_HEAD(&hcd->periodic_sched_ready,
+						   &qh->qh_list_entry);
+			} else {
+				if(fiq_enable && !dwc_frame_num_le(hcd->fiq_state->next_sched_frame, qh->sched_frame))
+				{
+					hcd->fiq_state->next_sched_frame = qh->sched_frame;
+				}
+
+				DWC_LIST_MOVE_HEAD
+				    (&hcd->periodic_sched_inactive,
+				     &qh->qh_list_entry);
+			}
+		}
+	}
+}
+
+/**
+ * This function allocates and initializes a QTD.
+ *
+ * @param urb The URB to create a QTD from.  Each URB-QTD pair will end up
+ * 	      pointing to each other so each pair should have a unique correlation.
+ * @param atomic_alloc Flag to do atomic alloc if needed
+ *
+ * @return Returns pointer to the newly allocated QTD, or NULL on error. */
+dwc_otg_qtd_t *dwc_otg_hcd_qtd_create(dwc_otg_hcd_urb_t * urb, int atomic_alloc)
+{
+	dwc_otg_qtd_t *qtd;
+
+	qtd = dwc_otg_hcd_qtd_alloc(atomic_alloc);
+	if (qtd == NULL) {
+		return NULL;
+	}
+
+	dwc_otg_hcd_qtd_init(qtd, urb);
+	return qtd;
+}
+
+/**
+ * Initializes a QTD structure.
+ *
+ * @param qtd The QTD to initialize.
+ * @param urb The URB to use for initialization.  */
+void dwc_otg_hcd_qtd_init(dwc_otg_qtd_t * qtd, dwc_otg_hcd_urb_t * urb)
+{
+	dwc_memset(qtd, 0, sizeof(dwc_otg_qtd_t));
+	qtd->urb = urb;
+	if (dwc_otg_hcd_get_pipe_type(&urb->pipe_info) == UE_CONTROL) {
+		/*
+		 * The only time the QTD data toggle is used is on the data
+		 * phase of control transfers. This phase always starts with
+		 * DATA1.
+		 */
+		qtd->data_toggle = DWC_OTG_HC_PID_DATA1;
+		qtd->control_phase = DWC_OTG_CONTROL_SETUP;
+	}
+
+	/* start split */
+	qtd->complete_split = 0;
+	qtd->isoc_split_pos = DWC_HCSPLIT_XACTPOS_ALL;
+	qtd->isoc_split_offset = 0;
+	qtd->in_process = 0;
+
+	/* Store the qtd ptr in the urb to reference what QTD. */
+	urb->qtd = qtd;
+	return;
+}
+
+/**
+ * This function adds a QTD to the QTD-list of a QH.  It will find the correct
+ * QH to place the QTD into.  If it does not find a QH, then it will create a
+ * new QH. If the QH to which the QTD is added is not currently scheduled, it
+ * is placed into the proper schedule based on its EP type.
+ * HCD lock must be held and interrupts must be disabled on entry
+ *
+ * @param[in] qtd The QTD to add
+ * @param[in] hcd The DWC HCD structure
+ * @param[out] qh out parameter to return queue head
+ * @param atomic_alloc Flag to do atomic alloc if needed
+ *
+ * @return 0 if successful, negative error code otherwise.
+ */
+int dwc_otg_hcd_qtd_add(dwc_otg_qtd_t * qtd,
+			dwc_otg_hcd_t * hcd, dwc_otg_qh_t ** qh, int atomic_alloc)
+{
+	int retval = 0;
+	dwc_otg_hcd_urb_t *urb = qtd->urb;
+
+	/*
+	 * Get the QH which holds the QTD-list to insert to. Create QH if it
+	 * doesn't exist.
+	 */
+	if (*qh == NULL) {
+		*qh = dwc_otg_hcd_qh_create(hcd, urb, atomic_alloc);
+		if (*qh == NULL) {
+			retval = -DWC_E_NO_MEMORY;
+			goto done;
+		} else {
+			if (fiq_enable)
+				hcd->fiq_state->kick_np_queues = 1;
+		}
+	}
+	retval = dwc_otg_hcd_qh_add(hcd, *qh);
+	if (retval == 0) {
+		DWC_CIRCLEQ_INSERT_TAIL(&((*qh)->qtd_list), qtd,
+					qtd_list_entry);
+		qtd->qh = *qh;
+	}
+done:
+
+	return retval;
+}
+
+#endif /* DWC_DEVICE_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h b/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
new file mode 100644
index 000000000000..d7b700ff1782
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_os_dep.h
@@ -0,0 +1,190 @@
+#ifndef _DWC_OS_DEP_H_
+#define _DWC_OS_DEP_H_
+
+/**
+ * @file
+ *
+ * This file contains OS dependent structures.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/init.h>
+#include <linux/device.h>
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/interrupt.h>
+#include <linux/ctype.h>
+#include <linux/string.h>
+#include <linux/dma-mapping.h>
+#include <linux/jiffies.h>
+#include <linux/delay.h>
+#include <linux/timer.h>
+#include <linux/workqueue.h>
+#include <linux/stat.h>
+#include <linux/pci.h>
+
+#include <linux/version.h>
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,20)
+# include <linux/irq.h>
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,21)
+# include <linux/usb/ch9.h>
+#else
+# include <linux/usb_ch9.h>
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24)
+# include <linux/usb/gadget.h>
+#else
+# include <linux/usb_gadget.h>
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
+# include <asm/irq.h>
+#endif
+
+#ifdef PCI_INTERFACE
+# include <asm/io.h>
+#endif
+
+#ifdef LM_INTERFACE
+# include <asm/unaligned.h>
+# include <asm/sizes.h>
+# include <asm/param.h>
+# include <asm/io.h>
+# if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30))
+#  include <asm/arch/hardware.h>
+#  include <asm/arch/lm.h>
+#  include <asm/arch/irqs.h>
+#  include <asm/arch/regs-irq.h>
+# else
+/* in 2.6.31, at least, we seem to have lost the generic LM infrastructure -
+   here we assume that the machine architecture provides definitions
+   in its own header
+*/
+#  include <mach/lm.h>
+#  include <mach/hardware.h>
+# endif
+#endif
+
+#ifdef PLATFORM_INTERFACE
+#include <linux/platform_device.h>
+#ifdef CONFIG_ARM
+#include <asm/mach/map.h>
+#endif
+#endif
+
+/** The OS page size */
+#define DWC_OS_PAGE_SIZE	PAGE_SIZE
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
+typedef int gfp_t;
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,18)
+# define IRQF_SHARED SA_SHIRQ
+#endif
+
+typedef struct os_dependent {
+	/** Base address returned from ioremap() */
+	void *base;
+
+	/** Register offset for Diagnostic API */
+	uint32_t reg_offset;
+
+	/** Base address for MPHI peripheral */
+	void *mphi_base;
+
+#ifdef LM_INTERFACE
+	struct lm_device *lmdev;
+#elif  defined(PCI_INTERFACE)
+	struct pci_dev *pcidev;
+
+	/** Start address of a PCI region */
+	resource_size_t rsrc_start;
+
+	/** Length address of a PCI region */
+	resource_size_t rsrc_len;
+#elif  defined(PLATFORM_INTERFACE)
+	struct platform_device *platformdev;
+#endif
+
+} os_dependent_t;
+
+#ifdef __cplusplus
+}
+#endif
+
+
+
+/* Type for the our device on the chosen bus */
+#if   defined(LM_INTERFACE)
+typedef struct lm_device       dwc_bus_dev_t;
+#elif defined(PCI_INTERFACE)
+typedef struct pci_dev         dwc_bus_dev_t;
+#elif defined(PLATFORM_INTERFACE)
+typedef struct platform_device dwc_bus_dev_t;
+#endif
+
+/* Helper macro to retrieve drvdata from the device on the chosen bus */
+#if    defined(LM_INTERFACE)
+#define DWC_OTG_BUSDRVDATA(_dev) lm_get_drvdata(_dev)
+#elif  defined(PCI_INTERFACE)
+#define DWC_OTG_BUSDRVDATA(_dev) pci_get_drvdata(_dev)
+#elif  defined(PLATFORM_INTERFACE)
+#define DWC_OTG_BUSDRVDATA(_dev) platform_get_drvdata(_dev)
+#endif
+
+/**
+ * Helper macro returning the otg_device structure of a given struct device
+ *
+ * c.f. static dwc_otg_device_t *dwc_otg_drvdev(struct device *_dev)
+ */
+#ifdef LM_INTERFACE
+#define DWC_OTG_GETDRVDEV(_var, _dev) do { \
+                struct lm_device *lm_dev = \
+                        container_of(_dev, struct lm_device, dev); \
+                _var = lm_get_drvdata(lm_dev); \
+        } while (0)
+
+#elif defined(PCI_INTERFACE)
+#define DWC_OTG_GETDRVDEV(_var, _dev) do { \
+                _var = dev_get_drvdata(_dev); \
+        } while (0)
+
+#elif defined(PLATFORM_INTERFACE)
+#define DWC_OTG_GETDRVDEV(_var, _dev) do { \
+                struct platform_device *platform_dev = \
+                        container_of(_dev, struct platform_device, dev); \
+                _var = platform_get_drvdata(platform_dev); \
+        } while (0)
+#endif
+
+
+/**
+ * Helper macro returning the struct dev of the given struct os_dependent
+ *
+ * c.f. static struct device *dwc_otg_getdev(struct os_dependent *osdep)
+ */
+#ifdef LM_INTERFACE
+#define DWC_OTG_OS_GETDEV(_osdep) \
+        ((_osdep).lmdev == NULL? NULL: &(_osdep).lmdev->dev)
+#elif defined(PCI_INTERFACE)
+#define DWC_OTG_OS_GETDEV(_osdep) \
+        ((_osdep).pci_dev == NULL? NULL: &(_osdep).pci_dev->dev)
+#elif defined(PLATFORM_INTERFACE)
+#define DWC_OTG_OS_GETDEV(_osdep) \
+        ((_osdep).platformdev == NULL? NULL: &(_osdep).platformdev->dev)
+#endif
+
+
+
+
+#endif /* _DWC_OS_DEP_H_ */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_pcd.c b/drivers/usb/host/dwc_otg/dwc_otg_pcd.c
new file mode 100644
index 000000000000..9dabbe5c9791
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd.c
@@ -0,0 +1,2725 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd.c $
+ * $Revision: #101 $
+ * $Date: 2012/08/10 $
+ * $Change: 2047372 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_HOST_ONLY
+
+/** @file
+ * This file implements PCD Core. All code in this file is portable and doesn't
+ * use any OS specific functions.
+ * PCD Core provides Interface, defined in <code><dwc_otg_pcd_if.h></code>
+ * header file, which can be used to implement OS specific PCD interface.
+ *
+ * An important function of the PCD is managing interrupts generated
+ * by the DWC_otg controller. The implementation of the DWC_otg device
+ * mode interrupt service routines is in dwc_otg_pcd_intr.c.
+ *
+ * @todo Add Device Mode test modes (Test J mode, Test K mode, etc).
+ * @todo Does it work when the request size is greater than DEPTSIZ
+ * transfer size
+ *
+ */
+
+#include "dwc_otg_pcd.h"
+
+#ifdef DWC_UTE_CFI
+#include "dwc_otg_cfi.h"
+
+extern int init_cfi(cfiobject_t * cfiobj);
+#endif
+
+/**
+ * Choose endpoint from ep arrays using usb_ep structure.
+ */
+static dwc_otg_pcd_ep_t *get_ep_from_handle(dwc_otg_pcd_t * pcd, void *handle)
+{
+	int i;
+	if (pcd->ep0.priv == handle) {
+		return &pcd->ep0;
+	}
+	for (i = 0; i < MAX_EPS_CHANNELS - 1; i++) {
+		if (pcd->in_ep[i].priv == handle)
+			return &pcd->in_ep[i];
+		if (pcd->out_ep[i].priv == handle)
+			return &pcd->out_ep[i];
+	}
+
+	return NULL;
+}
+
+/**
+ * This function completes a request.  It call's the request call back.
+ */
+void dwc_otg_request_done(dwc_otg_pcd_ep_t * ep, dwc_otg_pcd_request_t * req,
+			  int32_t status)
+{
+	unsigned stopped = ep->stopped;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(ep %p req %p)\n", __func__, ep, req);
+	DWC_CIRCLEQ_REMOVE_INIT(&ep->queue, req, queue_entry);
+
+	/* don't modify queue heads during completion callback */
+	ep->stopped = 1;
+	/* spin_unlock/spin_lock now done in fops->complete() */
+	ep->pcd->fops->complete(ep->pcd, ep->priv, req->priv, status,
+				req->actual);
+
+	if (ep->pcd->request_pending > 0) {
+		--ep->pcd->request_pending;
+	}
+
+	ep->stopped = stopped;
+	DWC_FREE(req);
+}
+
+/**
+ * This function terminates all the requsts in the EP request queue.
+ */
+void dwc_otg_request_nuke(dwc_otg_pcd_ep_t * ep)
+{
+	dwc_otg_pcd_request_t *req;
+
+	ep->stopped = 1;
+
+	/* called with irqs blocked?? */
+	while (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+		req = DWC_CIRCLEQ_FIRST(&ep->queue);
+		dwc_otg_request_done(ep, req, -DWC_E_SHUTDOWN);
+	}
+}
+
+void dwc_otg_pcd_start(dwc_otg_pcd_t * pcd,
+		       const struct dwc_otg_pcd_function_ops *fops)
+{
+	pcd->fops = fops;
+}
+
+/**
+ * PCD Callback function for initializing the PCD when switching to
+ * device mode.
+ *
+ * @param p void pointer to the <code>dwc_otg_pcd_t</code>
+ */
+static int32_t dwc_otg_pcd_start_cb(void *p)
+{
+	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) p;
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+
+	/*
+	 * Initialized the Core for Device mode.
+	 */
+	if (dwc_otg_is_device_mode(core_if)) {
+		dwc_otg_core_dev_init(core_if);
+		/* Set core_if's lock pointer to the pcd->lock */
+		core_if->lock = pcd->lock;
+	}
+	return 1;
+}
+
+/** CFI-specific buffer allocation function for EP */
+#ifdef DWC_UTE_CFI
+uint8_t *cfiw_ep_alloc_buffer(dwc_otg_pcd_t * pcd, void *pep, dwc_dma_t * addr,
+			      size_t buflen, int flags)
+{
+	dwc_otg_pcd_ep_t *ep;
+	ep = get_ep_from_handle(pcd, pep);
+	if (!ep) {
+		DWC_WARN("bad ep\n");
+		return -DWC_E_INVALID;
+	}
+
+	return pcd->cfi->ops.ep_alloc_buf(pcd->cfi, pcd, ep, addr, buflen,
+					  flags);
+}
+#else
+uint8_t *cfiw_ep_alloc_buffer(dwc_otg_pcd_t * pcd, void *pep, dwc_dma_t * addr,
+			      size_t buflen, int flags);
+#endif
+
+/**
+ * PCD Callback function for notifying the PCD when resuming from
+ * suspend.
+ *
+ * @param p void pointer to the <code>dwc_otg_pcd_t</code>
+ */
+static int32_t dwc_otg_pcd_resume_cb(void *p)
+{
+	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) p;
+
+	if (pcd->fops->resume) {
+		pcd->fops->resume(pcd);
+	}
+
+	/* Stop the SRP timeout timer. */
+	if ((GET_CORE_IF(pcd)->core_params->phy_type != DWC_PHY_TYPE_PARAM_FS)
+	    || (!GET_CORE_IF(pcd)->core_params->i2c_enable)) {
+		if (GET_CORE_IF(pcd)->srp_timer_started) {
+			GET_CORE_IF(pcd)->srp_timer_started = 0;
+			DWC_TIMER_CANCEL(GET_CORE_IF(pcd)->srp_timer);
+		}
+	}
+	return 1;
+}
+
+/**
+ * PCD Callback function for notifying the PCD device is suspended.
+ *
+ * @param p void pointer to the <code>dwc_otg_pcd_t</code>
+ */
+static int32_t dwc_otg_pcd_suspend_cb(void *p)
+{
+	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) p;
+
+	if (pcd->fops->suspend) {
+		DWC_SPINUNLOCK(pcd->lock);
+		pcd->fops->suspend(pcd);
+		DWC_SPINLOCK(pcd->lock);
+	}
+
+	return 1;
+}
+
+/**
+ * PCD Callback function for stopping the PCD when switching to Host
+ * mode.
+ *
+ * @param p void pointer to the <code>dwc_otg_pcd_t</code>
+ */
+static int32_t dwc_otg_pcd_stop_cb(void *p)
+{
+	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) p;
+	extern void dwc_otg_pcd_stop(dwc_otg_pcd_t * _pcd);
+
+	dwc_otg_pcd_stop(pcd);
+	return 1;
+}
+
+/**
+ * PCD Callback structure for handling mode switching.
+ */
+static dwc_otg_cil_callbacks_t pcd_callbacks = {
+	.start = dwc_otg_pcd_start_cb,
+	.stop = dwc_otg_pcd_stop_cb,
+	.suspend = dwc_otg_pcd_suspend_cb,
+	.resume_wakeup = dwc_otg_pcd_resume_cb,
+	.p = 0,			/* Set at registration */
+};
+
+/**
+ * This function allocates a DMA Descriptor chain for the Endpoint
+ * buffer to be used for a transfer to/from the specified endpoint.
+ */
+dwc_otg_dev_dma_desc_t *dwc_otg_ep_alloc_desc_chain(struct device *dev,
+						    dwc_dma_t * dma_desc_addr,
+						    uint32_t count)
+{
+	return DWC_DMA_ALLOC_ATOMIC(dev, count * sizeof(dwc_otg_dev_dma_desc_t),
+							dma_desc_addr);
+}
+
+/**
+ * This function frees a DMA Descriptor chain that was allocated by ep_alloc_desc.
+ */
+void dwc_otg_ep_free_desc_chain(struct device *dev,
+				dwc_otg_dev_dma_desc_t * desc_addr,
+				uint32_t dma_desc_addr, uint32_t count)
+{
+	DWC_DMA_FREE(dev, count * sizeof(dwc_otg_dev_dma_desc_t), desc_addr,
+		     dma_desc_addr);
+}
+
+#ifdef DWC_EN_ISOC
+
+/**
+ * This function initializes a descriptor chain for Isochronous transfer
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param dwc_ep The EP to start the transfer on.
+ *
+ */
+void dwc_otg_iso_ep_start_ddma_transfer(dwc_otg_core_if_t * core_if,
+					dwc_ep_t * dwc_ep)
+{
+
+	dsts_data_t dsts = {.d32 = 0 };
+	depctl_data_t depctl = {.d32 = 0 };
+	volatile uint32_t *addr;
+	int i, j;
+	uint32_t len;
+
+	if (dwc_ep->is_in)
+		dwc_ep->desc_cnt = dwc_ep->buf_proc_intrvl / dwc_ep->bInterval;
+	else
+		dwc_ep->desc_cnt =
+		    dwc_ep->buf_proc_intrvl * dwc_ep->pkt_per_frm /
+		    dwc_ep->bInterval;
+
+	/** Allocate descriptors for double buffering */
+	dwc_ep->iso_desc_addr =
+	    dwc_otg_ep_alloc_desc_chain(&dwc_ep->iso_dma_desc_addr,
+					dwc_ep->desc_cnt * 2);
+	if (dwc_ep->desc_addr) {
+		DWC_WARN("%s, can't allocate DMA descriptor chain\n", __func__);
+		return;
+	}
+
+	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
+
+	/** ISO OUT EP */
+	if (dwc_ep->is_in == 0) {
+		dev_dma_desc_sts_t sts = {.d32 = 0 };
+		dwc_otg_dev_dma_desc_t *dma_desc = dwc_ep->iso_desc_addr;
+		dma_addr_t dma_ad;
+		uint32_t data_per_desc;
+		dwc_otg_dev_out_ep_regs_t *out_regs =
+		    core_if->dev_if->out_ep_regs[dwc_ep->num];
+		int offset;
+
+		addr = &core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl;
+		dma_ad = (dma_addr_t) DWC_READ_REG32(&(out_regs->doepdma));
+
+		/** Buffer 0 descriptors setup */
+		dma_ad = dwc_ep->dma_addr0;
+
+		sts.b_iso_out.bs = BS_HOST_READY;
+		sts.b_iso_out.rxsts = 0;
+		sts.b_iso_out.l = 0;
+		sts.b_iso_out.sp = 0;
+		sts.b_iso_out.ioc = 0;
+		sts.b_iso_out.pid = 0;
+		sts.b_iso_out.framenum = 0;
+
+		offset = 0;
+		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
+		     i += dwc_ep->pkt_per_frm) {
+
+			for (j = 0; j < dwc_ep->pkt_per_frm; ++j) {
+				uint32_t len = (j + 1) * dwc_ep->maxpacket;
+				if (len > dwc_ep->data_per_frame)
+					data_per_desc =
+					    dwc_ep->data_per_frame -
+					    j * dwc_ep->maxpacket;
+				else
+					data_per_desc = dwc_ep->maxpacket;
+				len = data_per_desc % 4;
+				if (len)
+					data_per_desc += 4 - len;
+
+				sts.b_iso_out.rxbytes = data_per_desc;
+				dma_desc->buf = dma_ad;
+				dma_desc->status.d32 = sts.d32;
+
+				offset += data_per_desc;
+				dma_desc++;
+				dma_ad += data_per_desc;
+			}
+		}
+
+		for (j = 0; j < dwc_ep->pkt_per_frm - 1; ++j) {
+			uint32_t len = (j + 1) * dwc_ep->maxpacket;
+			if (len > dwc_ep->data_per_frame)
+				data_per_desc =
+				    dwc_ep->data_per_frame -
+				    j * dwc_ep->maxpacket;
+			else
+				data_per_desc = dwc_ep->maxpacket;
+			len = data_per_desc % 4;
+			if (len)
+				data_per_desc += 4 - len;
+			sts.b_iso_out.rxbytes = data_per_desc;
+			dma_desc->buf = dma_ad;
+			dma_desc->status.d32 = sts.d32;
+
+			offset += data_per_desc;
+			dma_desc++;
+			dma_ad += data_per_desc;
+		}
+
+		sts.b_iso_out.ioc = 1;
+		len = (j + 1) * dwc_ep->maxpacket;
+		if (len > dwc_ep->data_per_frame)
+			data_per_desc =
+			    dwc_ep->data_per_frame - j * dwc_ep->maxpacket;
+		else
+			data_per_desc = dwc_ep->maxpacket;
+		len = data_per_desc % 4;
+		if (len)
+			data_per_desc += 4 - len;
+		sts.b_iso_out.rxbytes = data_per_desc;
+
+		dma_desc->buf = dma_ad;
+		dma_desc->status.d32 = sts.d32;
+		dma_desc++;
+
+		/** Buffer 1 descriptors setup */
+		sts.b_iso_out.ioc = 0;
+		dma_ad = dwc_ep->dma_addr1;
+
+		offset = 0;
+		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
+		     i += dwc_ep->pkt_per_frm) {
+			for (j = 0; j < dwc_ep->pkt_per_frm; ++j) {
+				uint32_t len = (j + 1) * dwc_ep->maxpacket;
+				if (len > dwc_ep->data_per_frame)
+					data_per_desc =
+					    dwc_ep->data_per_frame -
+					    j * dwc_ep->maxpacket;
+				else
+					data_per_desc = dwc_ep->maxpacket;
+				len = data_per_desc % 4;
+				if (len)
+					data_per_desc += 4 - len;
+
+				data_per_desc =
+				    sts.b_iso_out.rxbytes = data_per_desc;
+				dma_desc->buf = dma_ad;
+				dma_desc->status.d32 = sts.d32;
+
+				offset += data_per_desc;
+				dma_desc++;
+				dma_ad += data_per_desc;
+			}
+		}
+		for (j = 0; j < dwc_ep->pkt_per_frm - 1; ++j) {
+			data_per_desc =
+			    ((j + 1) * dwc_ep->maxpacket >
+			     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
+			    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
+			data_per_desc +=
+			    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
+			sts.b_iso_out.rxbytes = data_per_desc;
+			dma_desc->buf = dma_ad;
+			dma_desc->status.d32 = sts.d32;
+
+			offset += data_per_desc;
+			dma_desc++;
+			dma_ad += data_per_desc;
+		}
+
+		sts.b_iso_out.ioc = 1;
+		sts.b_iso_out.l = 1;
+		data_per_desc =
+		    ((j + 1) * dwc_ep->maxpacket >
+		     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
+		    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
+		data_per_desc +=
+		    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
+		sts.b_iso_out.rxbytes = data_per_desc;
+
+		dma_desc->buf = dma_ad;
+		dma_desc->status.d32 = sts.d32;
+
+		dwc_ep->next_frame = 0;
+
+		/** Write dma_ad into DOEPDMA register */
+		DWC_WRITE_REG32(&(out_regs->doepdma),
+				(uint32_t) dwc_ep->iso_dma_desc_addr);
+
+	}
+	/** ISO IN EP */
+	else {
+		dev_dma_desc_sts_t sts = {.d32 = 0 };
+		dwc_otg_dev_dma_desc_t *dma_desc = dwc_ep->iso_desc_addr;
+		dma_addr_t dma_ad;
+		dwc_otg_dev_in_ep_regs_t *in_regs =
+		    core_if->dev_if->in_ep_regs[dwc_ep->num];
+		unsigned int frmnumber;
+		fifosize_data_t txfifosize, rxfifosize;
+
+		txfifosize.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[dwc_ep->num]->
+				   dtxfsts);
+		rxfifosize.d32 =
+		    DWC_READ_REG32(&core_if->core_global_regs->grxfsiz);
+
+		addr = &core_if->dev_if->in_ep_regs[dwc_ep->num]->diepctl;
+
+		dma_ad = dwc_ep->dma_addr0;
+
+		dsts.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
+
+		sts.b_iso_in.bs = BS_HOST_READY;
+		sts.b_iso_in.txsts = 0;
+		sts.b_iso_in.sp =
+		    (dwc_ep->data_per_frame % dwc_ep->maxpacket) ? 1 : 0;
+		sts.b_iso_in.ioc = 0;
+		sts.b_iso_in.pid = dwc_ep->pkt_per_frm;
+
+		frmnumber = dwc_ep->next_frame;
+
+		sts.b_iso_in.framenum = frmnumber;
+		sts.b_iso_in.txbytes = dwc_ep->data_per_frame;
+		sts.b_iso_in.l = 0;
+
+		/** Buffer 0 descriptors setup */
+		for (i = 0; i < dwc_ep->desc_cnt - 1; i++) {
+			dma_desc->buf = dma_ad;
+			dma_desc->status.d32 = sts.d32;
+			dma_desc++;
+
+			dma_ad += dwc_ep->data_per_frame;
+			sts.b_iso_in.framenum += dwc_ep->bInterval;
+		}
+
+		sts.b_iso_in.ioc = 1;
+		dma_desc->buf = dma_ad;
+		dma_desc->status.d32 = sts.d32;
+		++dma_desc;
+
+		/** Buffer 1 descriptors setup */
+		sts.b_iso_in.ioc = 0;
+		dma_ad = dwc_ep->dma_addr1;
+
+		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
+		     i += dwc_ep->pkt_per_frm) {
+			dma_desc->buf = dma_ad;
+			dma_desc->status.d32 = sts.d32;
+			dma_desc++;
+
+			dma_ad += dwc_ep->data_per_frame;
+			sts.b_iso_in.framenum += dwc_ep->bInterval;
+
+			sts.b_iso_in.ioc = 0;
+		}
+		sts.b_iso_in.ioc = 1;
+		sts.b_iso_in.l = 1;
+
+		dma_desc->buf = dma_ad;
+		dma_desc->status.d32 = sts.d32;
+
+		dwc_ep->next_frame = sts.b_iso_in.framenum + dwc_ep->bInterval;
+
+		/** Write dma_ad into diepdma register */
+		DWC_WRITE_REG32(&(in_regs->diepdma),
+				(uint32_t) dwc_ep->iso_dma_desc_addr);
+	}
+	/** Enable endpoint, clear nak  */
+	depctl.d32 = 0;
+	depctl.b.epena = 1;
+	depctl.b.usbactep = 1;
+	depctl.b.cnak = 1;
+
+	DWC_MODIFY_REG32(addr, depctl.d32, depctl.d32);
+	depctl.d32 = DWC_READ_REG32(addr);
+}
+
+/**
+ * This function initializes a descriptor chain for Isochronous transfer
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ *
+ */
+void dwc_otg_iso_ep_start_buf_transfer(dwc_otg_core_if_t * core_if,
+				       dwc_ep_t * ep)
+{
+	depctl_data_t depctl = {.d32 = 0 };
+	volatile uint32_t *addr;
+
+	if (ep->is_in) {
+		addr = &core_if->dev_if->in_ep_regs[ep->num]->diepctl;
+	} else {
+		addr = &core_if->dev_if->out_ep_regs[ep->num]->doepctl;
+	}
+
+	if (core_if->dma_enable == 0 || core_if->dma_desc_enable != 0) {
+		return;
+	} else {
+		deptsiz_data_t deptsiz = {.d32 = 0 };
+
+		ep->xfer_len =
+		    ep->data_per_frame * ep->buf_proc_intrvl / ep->bInterval;
+		ep->pkt_cnt =
+		    (ep->xfer_len - 1 + ep->maxpacket) / ep->maxpacket;
+		ep->xfer_count = 0;
+		ep->xfer_buff =
+		    (ep->proc_buf_num) ? ep->xfer_buff1 : ep->xfer_buff0;
+		ep->dma_addr =
+		    (ep->proc_buf_num) ? ep->dma_addr1 : ep->dma_addr0;
+
+		if (ep->is_in) {
+			/* Program the transfer size and packet count
+			 *      as follows: xfersize = N * maxpacket +
+			 *      short_packet pktcnt = N + (short_packet
+			 *      exist ? 1 : 0)
+			 */
+			deptsiz.b.mc = ep->pkt_per_frm;
+			deptsiz.b.xfersize = ep->xfer_len;
+			deptsiz.b.pktcnt =
+			    (ep->xfer_len - 1 + ep->maxpacket) / ep->maxpacket;
+			DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
+					dieptsiz, deptsiz.d32);
+
+			/* Write the DMA register */
+			DWC_WRITE_REG32(&
+					(core_if->dev_if->in_ep_regs[ep->num]->
+					 diepdma), (uint32_t) ep->dma_addr);
+
+		} else {
+			deptsiz.b.pktcnt =
+			    (ep->xfer_len + (ep->maxpacket - 1)) /
+			    ep->maxpacket;
+			deptsiz.b.xfersize = deptsiz.b.pktcnt * ep->maxpacket;
+
+			DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[ep->num]->
+					doeptsiz, deptsiz.d32);
+
+			/* Write the DMA register */
+			DWC_WRITE_REG32(&
+					(core_if->dev_if->out_ep_regs[ep->num]->
+					 doepdma), (uint32_t) ep->dma_addr);
+
+		}
+		/** Enable endpoint, clear nak  */
+		depctl.d32 = 0;
+		depctl.b.epena = 1;
+		depctl.b.cnak = 1;
+
+		DWC_MODIFY_REG32(addr, depctl.d32, depctl.d32);
+	}
+}
+
+/**
+ * This function does the setup for a data transfer for an EP and
+ * starts the transfer. For an IN transfer, the packets will be
+ * loaded into the appropriate Tx FIFO in the ISR. For OUT transfers,
+ * the packets are unloaded from the Rx FIFO in the ISR.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ */
+
+static void dwc_otg_iso_ep_start_transfer(dwc_otg_core_if_t * core_if,
+					  dwc_ep_t * ep)
+{
+	if (core_if->dma_enable) {
+		if (core_if->dma_desc_enable) {
+			if (ep->is_in) {
+				ep->desc_cnt = ep->pkt_cnt / ep->pkt_per_frm;
+			} else {
+				ep->desc_cnt = ep->pkt_cnt;
+			}
+			dwc_otg_iso_ep_start_ddma_transfer(core_if, ep);
+		} else {
+			if (core_if->pti_enh_enable) {
+				dwc_otg_iso_ep_start_buf_transfer(core_if, ep);
+			} else {
+				ep->cur_pkt_addr =
+				    (ep->proc_buf_num) ? ep->xfer_buff1 : ep->
+				    xfer_buff0;
+				ep->cur_pkt_dma_addr =
+				    (ep->proc_buf_num) ? ep->dma_addr1 : ep->
+				    dma_addr0;
+				dwc_otg_iso_ep_start_frm_transfer(core_if, ep);
+			}
+		}
+	} else {
+		ep->cur_pkt_addr =
+		    (ep->proc_buf_num) ? ep->xfer_buff1 : ep->xfer_buff0;
+		ep->cur_pkt_dma_addr =
+		    (ep->proc_buf_num) ? ep->dma_addr1 : ep->dma_addr0;
+		dwc_otg_iso_ep_start_frm_transfer(core_if, ep);
+	}
+}
+
+/**
+ * This function stops transfer for an EP and
+ * resets the ep's variables.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ */
+
+void dwc_otg_iso_ep_stop_transfer(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	depctl_data_t depctl = {.d32 = 0 };
+	volatile uint32_t *addr;
+
+	if (ep->is_in == 1) {
+		addr = &core_if->dev_if->in_ep_regs[ep->num]->diepctl;
+	} else {
+		addr = &core_if->dev_if->out_ep_regs[ep->num]->doepctl;
+	}
+
+	/* disable the ep */
+	depctl.d32 = DWC_READ_REG32(addr);
+
+	depctl.b.epdis = 1;
+	depctl.b.snak = 1;
+
+	DWC_WRITE_REG32(addr, depctl.d32);
+
+	if (core_if->dma_desc_enable &&
+	    ep->iso_desc_addr && ep->iso_dma_desc_addr) {
+		dwc_otg_ep_free_desc_chain(ep->iso_desc_addr,
+					   ep->iso_dma_desc_addr,
+					   ep->desc_cnt * 2);
+	}
+
+	/* reset varibales */
+	ep->dma_addr0 = 0;
+	ep->dma_addr1 = 0;
+	ep->xfer_buff0 = 0;
+	ep->xfer_buff1 = 0;
+	ep->data_per_frame = 0;
+	ep->data_pattern_frame = 0;
+	ep->sync_frame = 0;
+	ep->buf_proc_intrvl = 0;
+	ep->bInterval = 0;
+	ep->proc_buf_num = 0;
+	ep->pkt_per_frm = 0;
+	ep->pkt_per_frm = 0;
+	ep->desc_cnt = 0;
+	ep->iso_desc_addr = 0;
+	ep->iso_dma_desc_addr = 0;
+}
+
+int dwc_otg_pcd_iso_ep_start(dwc_otg_pcd_t * pcd, void *ep_handle,
+			     uint8_t * buf0, uint8_t * buf1, dwc_dma_t dma0,
+			     dwc_dma_t dma1, int sync_frame, int dp_frame,
+			     int data_per_frame, int start_frame,
+			     int buf_proc_intrvl, void *req_handle,
+			     int atomic_alloc)
+{
+	dwc_otg_pcd_ep_t *ep;
+	dwc_irqflags_t flags = 0;
+	dwc_ep_t *dwc_ep;
+	int32_t frm_data;
+	dsts_data_t dsts;
+	dwc_otg_core_if_t *core_if;
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+
+	if (!ep || !ep->desc || ep->dwc_ep.num == 0) {
+		DWC_WARN("bad ep\n");
+		return -DWC_E_INVALID;
+	}
+
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+	core_if = GET_CORE_IF(pcd);
+	dwc_ep = &ep->dwc_ep;
+
+	if (ep->iso_req_handle) {
+		DWC_WARN("ISO request in progress\n");
+	}
+
+	dwc_ep->dma_addr0 = dma0;
+	dwc_ep->dma_addr1 = dma1;
+
+	dwc_ep->xfer_buff0 = buf0;
+	dwc_ep->xfer_buff1 = buf1;
+
+	dwc_ep->data_per_frame = data_per_frame;
+
+	/** @todo - pattern data support is to be implemented in the future */
+	dwc_ep->data_pattern_frame = dp_frame;
+	dwc_ep->sync_frame = sync_frame;
+
+	dwc_ep->buf_proc_intrvl = buf_proc_intrvl;
+
+	dwc_ep->bInterval = 1 << (ep->desc->bInterval - 1);
+
+	dwc_ep->proc_buf_num = 0;
+
+	dwc_ep->pkt_per_frm = 0;
+	frm_data = ep->dwc_ep.data_per_frame;
+	while (frm_data > 0) {
+		dwc_ep->pkt_per_frm++;
+		frm_data -= ep->dwc_ep.maxpacket;
+	}
+
+	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
+
+	if (start_frame == -1) {
+		dwc_ep->next_frame = dsts.b.soffn + 1;
+		if (dwc_ep->bInterval != 1) {
+			dwc_ep->next_frame =
+			    dwc_ep->next_frame + (dwc_ep->bInterval - 1 -
+						  dwc_ep->next_frame %
+						  dwc_ep->bInterval);
+		}
+	} else {
+		dwc_ep->next_frame = start_frame;
+	}
+
+	if (!core_if->pti_enh_enable) {
+		dwc_ep->pkt_cnt =
+		    dwc_ep->buf_proc_intrvl * dwc_ep->pkt_per_frm /
+		    dwc_ep->bInterval;
+	} else {
+		dwc_ep->pkt_cnt =
+		    (dwc_ep->data_per_frame *
+		     (dwc_ep->buf_proc_intrvl / dwc_ep->bInterval)
+		     - 1 + dwc_ep->maxpacket) / dwc_ep->maxpacket;
+	}
+
+	if (core_if->dma_desc_enable) {
+		dwc_ep->desc_cnt =
+		    dwc_ep->buf_proc_intrvl * dwc_ep->pkt_per_frm /
+		    dwc_ep->bInterval;
+	}
+
+	if (atomic_alloc) {
+		dwc_ep->pkt_info =
+		    DWC_ALLOC_ATOMIC(sizeof(iso_pkt_info_t) * dwc_ep->pkt_cnt);
+	} else {
+		dwc_ep->pkt_info =
+		    DWC_ALLOC(sizeof(iso_pkt_info_t) * dwc_ep->pkt_cnt);
+	}
+	if (!dwc_ep->pkt_info) {
+		DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+		return -DWC_E_NO_MEMORY;
+	}
+	if (core_if->pti_enh_enable) {
+		dwc_memset(dwc_ep->pkt_info, 0,
+			   sizeof(iso_pkt_info_t) * dwc_ep->pkt_cnt);
+	}
+
+	dwc_ep->cur_pkt = 0;
+	ep->iso_req_handle = req_handle;
+
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+	dwc_otg_iso_ep_start_transfer(core_if, dwc_ep);
+	return 0;
+}
+
+int dwc_otg_pcd_iso_ep_stop(dwc_otg_pcd_t * pcd, void *ep_handle,
+			    void *req_handle)
+{
+	dwc_irqflags_t flags = 0;
+	dwc_otg_pcd_ep_t *ep;
+	dwc_ep_t *dwc_ep;
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+	if (!ep || !ep->desc || ep->dwc_ep.num == 0) {
+		DWC_WARN("bad ep\n");
+		return -DWC_E_INVALID;
+	}
+	dwc_ep = &ep->dwc_ep;
+
+	dwc_otg_iso_ep_stop_transfer(GET_CORE_IF(pcd), dwc_ep);
+
+	DWC_FREE(dwc_ep->pkt_info);
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+	if (ep->iso_req_handle != req_handle) {
+		DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+		return -DWC_E_INVALID;
+	}
+
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+
+	ep->iso_req_handle = 0;
+	return 0;
+}
+
+/**
+ * This function is used for perodical data exchnage between PCD and gadget drivers.
+ * for Isochronous EPs
+ *
+ *	- Every time a sync period completes this function is called to
+ *	  perform data exchange between PCD and gadget
+ */
+void dwc_otg_iso_buffer_done(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * ep,
+			     void *req_handle)
+{
+	int i;
+	dwc_ep_t *dwc_ep;
+
+	dwc_ep = &ep->dwc_ep;
+
+	DWC_SPINUNLOCK(ep->pcd->lock);
+	pcd->fops->isoc_complete(pcd, ep->priv, ep->iso_req_handle,
+				 dwc_ep->proc_buf_num ^ 0x1);
+	DWC_SPINLOCK(ep->pcd->lock);
+
+	for (i = 0; i < dwc_ep->pkt_cnt; ++i) {
+		dwc_ep->pkt_info[i].status = 0;
+		dwc_ep->pkt_info[i].offset = 0;
+		dwc_ep->pkt_info[i].length = 0;
+	}
+}
+
+int dwc_otg_pcd_get_iso_packet_count(dwc_otg_pcd_t * pcd, void *ep_handle,
+				     void *iso_req_handle)
+{
+	dwc_otg_pcd_ep_t *ep;
+	dwc_ep_t *dwc_ep;
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+	if (!ep->desc || ep->dwc_ep.num == 0) {
+		DWC_WARN("bad ep\n");
+		return -DWC_E_INVALID;
+	}
+	dwc_ep = &ep->dwc_ep;
+
+	return dwc_ep->pkt_cnt;
+}
+
+void dwc_otg_pcd_get_iso_packet_params(dwc_otg_pcd_t * pcd, void *ep_handle,
+				       void *iso_req_handle, int packet,
+				       int *status, int *actual, int *offset)
+{
+	dwc_otg_pcd_ep_t *ep;
+	dwc_ep_t *dwc_ep;
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+	if (!ep)
+		DWC_WARN("bad ep\n");
+
+	dwc_ep = &ep->dwc_ep;
+
+	*status = dwc_ep->pkt_info[packet].status;
+	*actual = dwc_ep->pkt_info[packet].length;
+	*offset = dwc_ep->pkt_info[packet].offset;
+}
+
+#endif /* DWC_EN_ISOC */
+
+static void dwc_otg_pcd_init_ep(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * pcd_ep,
+				uint32_t is_in, uint32_t ep_num)
+{
+	/* Init EP structure */
+	pcd_ep->desc = 0;
+	pcd_ep->pcd = pcd;
+	pcd_ep->stopped = 1;
+	pcd_ep->queue_sof = 0;
+
+	/* Init DWC ep structure */
+	pcd_ep->dwc_ep.is_in = is_in;
+	pcd_ep->dwc_ep.num = ep_num;
+	pcd_ep->dwc_ep.active = 0;
+	pcd_ep->dwc_ep.tx_fifo_num = 0;
+	/* Control until ep is actvated */
+	pcd_ep->dwc_ep.type = DWC_OTG_EP_TYPE_CONTROL;
+	pcd_ep->dwc_ep.maxpacket = MAX_PACKET_SIZE;
+	pcd_ep->dwc_ep.dma_addr = 0;
+	pcd_ep->dwc_ep.start_xfer_buff = 0;
+	pcd_ep->dwc_ep.xfer_buff = 0;
+	pcd_ep->dwc_ep.xfer_len = 0;
+	pcd_ep->dwc_ep.xfer_count = 0;
+	pcd_ep->dwc_ep.sent_zlp = 0;
+	pcd_ep->dwc_ep.total_len = 0;
+	pcd_ep->dwc_ep.desc_addr = 0;
+	pcd_ep->dwc_ep.dma_desc_addr = 0;
+	DWC_CIRCLEQ_INIT(&pcd_ep->queue);
+}
+
+/**
+ * Initialize ep's
+ */
+static void dwc_otg_pcd_reinit(dwc_otg_pcd_t * pcd)
+{
+	int i;
+	uint32_t hwcfg1;
+	dwc_otg_pcd_ep_t *ep;
+	int in_ep_cntr, out_ep_cntr;
+	uint32_t num_in_eps = (GET_CORE_IF(pcd))->dev_if->num_in_eps;
+	uint32_t num_out_eps = (GET_CORE_IF(pcd))->dev_if->num_out_eps;
+
+	/**
+	 * Initialize the EP0 structure.
+	 */
+	ep = &pcd->ep0;
+	dwc_otg_pcd_init_ep(pcd, ep, 0, 0);
+
+	in_ep_cntr = 0;
+	hwcfg1 = (GET_CORE_IF(pcd))->hwcfg1.d32 >> 3;
+	for (i = 1; in_ep_cntr < num_in_eps; i++) {
+		if ((hwcfg1 & 0x1) == 0) {
+			dwc_otg_pcd_ep_t *ep = &pcd->in_ep[in_ep_cntr];
+			in_ep_cntr++;
+			/**
+			 * @todo NGS: Add direction to EP, based on contents
+			 * of HWCFG1.  Need a copy of HWCFG1 in pcd structure?
+			 * sprintf(";r
+			 */
+			dwc_otg_pcd_init_ep(pcd, ep, 1 /* IN */ , i);
+
+			DWC_CIRCLEQ_INIT(&ep->queue);
+		}
+		hwcfg1 >>= 2;
+	}
+
+	out_ep_cntr = 0;
+	hwcfg1 = (GET_CORE_IF(pcd))->hwcfg1.d32 >> 2;
+	for (i = 1; out_ep_cntr < num_out_eps; i++) {
+		if ((hwcfg1 & 0x1) == 0) {
+			dwc_otg_pcd_ep_t *ep = &pcd->out_ep[out_ep_cntr];
+			out_ep_cntr++;
+			/**
+			 * @todo NGS: Add direction to EP, based on contents
+			 * of HWCFG1.  Need a copy of HWCFG1 in pcd structure?
+			 * sprintf(";r
+			 */
+			dwc_otg_pcd_init_ep(pcd, ep, 0 /* OUT */ , i);
+			DWC_CIRCLEQ_INIT(&ep->queue);
+		}
+		hwcfg1 >>= 2;
+	}
+
+	pcd->ep0state = EP0_DISCONNECT;
+	pcd->ep0.dwc_ep.maxpacket = MAX_EP0_SIZE;
+	pcd->ep0.dwc_ep.type = DWC_OTG_EP_TYPE_CONTROL;
+}
+
+/**
+ * This function is called when the SRP timer expires. The SRP should
+ * complete within 6 seconds.
+ */
+static void srp_timeout(void *ptr)
+{
+	gotgctl_data_t gotgctl;
+	dwc_otg_core_if_t *core_if = (dwc_otg_core_if_t *) ptr;
+	volatile uint32_t *addr = &core_if->core_global_regs->gotgctl;
+
+	gotgctl.d32 = DWC_READ_REG32(addr);
+
+	core_if->srp_timer_started = 0;
+
+	if (core_if->adp_enable) {
+		if (gotgctl.b.bsesvld == 0) {
+			gpwrdn_data_t gpwrdn = {.d32 = 0 };
+			DWC_PRINTF("SRP Timeout BSESSVLD = 0\n");
+			/* Power off the core */
+			if (core_if->power_down == 2) {
+				gpwrdn.b.pwrdnswtch = 1;
+				DWC_MODIFY_REG32(&core_if->
+						 core_global_regs->gpwrdn,
+						 gpwrdn.d32, 0);
+			}
+
+			gpwrdn.d32 = 0;
+			gpwrdn.b.pmuintsel = 1;
+			gpwrdn.b.pmuactv = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gpwrdn, 0,
+					 gpwrdn.d32);
+			dwc_otg_adp_probe_start(core_if);
+		} else {
+			DWC_PRINTF("SRP Timeout BSESSVLD = 1\n");
+			core_if->op_state = B_PERIPHERAL;
+			dwc_otg_core_init(core_if);
+			dwc_otg_enable_global_interrupts(core_if);
+			cil_pcd_start(core_if);
+		}
+	}
+
+	if ((core_if->core_params->phy_type == DWC_PHY_TYPE_PARAM_FS) &&
+	    (core_if->core_params->i2c_enable)) {
+		DWC_PRINTF("SRP Timeout\n");
+
+		if ((core_if->srp_success) && (gotgctl.b.bsesvld)) {
+			if (core_if->pcd_cb && core_if->pcd_cb->resume_wakeup) {
+				core_if->pcd_cb->resume_wakeup(core_if->pcd_cb->p);
+			}
+
+			/* Clear Session Request */
+			gotgctl.d32 = 0;
+			gotgctl.b.sesreq = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gotgctl,
+					 gotgctl.d32, 0);
+
+			core_if->srp_success = 0;
+		} else {
+			__DWC_ERROR("Device not connected/responding\n");
+			gotgctl.b.sesreq = 0;
+			DWC_WRITE_REG32(addr, gotgctl.d32);
+		}
+	} else if (gotgctl.b.sesreq) {
+		DWC_PRINTF("SRP Timeout\n");
+
+		__DWC_ERROR("Device not connected/responding\n");
+		gotgctl.b.sesreq = 0;
+		DWC_WRITE_REG32(addr, gotgctl.d32);
+	} else {
+		DWC_PRINTF(" SRP GOTGCTL=%0x\n", gotgctl.d32);
+	}
+}
+
+/**
+ * Tasklet
+ *
+ */
+extern void start_next_request(dwc_otg_pcd_ep_t * ep);
+
+static void start_xfer_tasklet_func(void *data)
+{
+	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) data;
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+
+	int i;
+	depctl_data_t diepctl;
+
+	DWC_DEBUGPL(DBG_PCDV, "Start xfer tasklet\n");
+
+	diepctl.d32 = DWC_READ_REG32(&core_if->dev_if->in_ep_regs[0]->diepctl);
+
+	if (pcd->ep0.queue_sof) {
+		pcd->ep0.queue_sof = 0;
+		start_next_request(&pcd->ep0);
+		// break;
+	}
+
+	for (i = 0; i < core_if->dev_if->num_in_eps; i++) {
+		depctl_data_t diepctl;
+		diepctl.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[i]->diepctl);
+
+		if (pcd->in_ep[i].queue_sof) {
+			pcd->in_ep[i].queue_sof = 0;
+			start_next_request(&pcd->in_ep[i]);
+			// break;
+		}
+	}
+
+	return;
+}
+
+/**
+ * This function initialized the PCD portion of the driver.
+ *
+ */
+dwc_otg_pcd_t *dwc_otg_pcd_init(dwc_otg_device_t *otg_dev)
+{
+	struct device *dev = &otg_dev->os_dep.platformdev->dev;
+	dwc_otg_core_if_t *core_if = otg_dev->core_if;
+	dwc_otg_pcd_t *pcd = NULL;
+	dwc_otg_dev_if_t *dev_if;
+	int i;
+
+	/*
+	 * Allocate PCD structure
+	 */
+	pcd = DWC_ALLOC(sizeof(dwc_otg_pcd_t));
+
+	if (pcd == NULL) {
+		return NULL;
+	}
+
+#if (defined(DWC_LINUX) && defined(CONFIG_DEBUG_SPINLOCK))
+	DWC_SPINLOCK_ALLOC_LINUX_DEBUG(pcd->lock);
+#else
+	pcd->lock = DWC_SPINLOCK_ALLOC();
+#endif
+        DWC_DEBUGPL(DBG_HCDV, "Init of PCD %p given core_if %p\n",
+                    pcd, core_if);//GRAYG
+	if (!pcd->lock) {
+		DWC_ERROR("Could not allocate lock for pcd");
+		DWC_FREE(pcd);
+		return NULL;
+	}
+	/* Set core_if's lock pointer to hcd->lock */
+	core_if->lock = pcd->lock;
+	pcd->core_if = core_if;
+
+	dev_if = core_if->dev_if;
+	dev_if->isoc_ep = NULL;
+
+	if (core_if->hwcfg4.b.ded_fifo_en) {
+		DWC_PRINTF("Dedicated Tx FIFOs mode\n");
+	} else {
+		DWC_PRINTF("Shared Tx FIFO mode\n");
+	}
+
+	/*
+	 * Initialized the Core for Device mode here if there is nod ADP support.
+	 * Otherwise it will be done later in dwc_otg_adp_start routine.
+	 */
+	if (dwc_otg_is_device_mode(core_if) /*&& !core_if->adp_enable*/) {
+		dwc_otg_core_dev_init(core_if);
+	}
+
+	/*
+	 * Register the PCD Callbacks.
+	 */
+	dwc_otg_cil_register_pcd_callbacks(core_if, &pcd_callbacks, pcd);
+
+	/*
+	 * Initialize the DMA buffer for SETUP packets
+	 */
+	if (GET_CORE_IF(pcd)->dma_enable) {
+		pcd->setup_pkt =
+		    DWC_DMA_ALLOC(dev, sizeof(*pcd->setup_pkt) * 5,
+				  &pcd->setup_pkt_dma_handle);
+		if (pcd->setup_pkt == NULL) {
+			DWC_FREE(pcd);
+			return NULL;
+		}
+
+		pcd->status_buf =
+		    DWC_DMA_ALLOC(dev, sizeof(uint16_t),
+				  &pcd->status_buf_dma_handle);
+		if (pcd->status_buf == NULL) {
+			DWC_DMA_FREE(dev, sizeof(*pcd->setup_pkt) * 5,
+				     pcd->setup_pkt, pcd->setup_pkt_dma_handle);
+			DWC_FREE(pcd);
+			return NULL;
+		}
+
+		if (GET_CORE_IF(pcd)->dma_desc_enable) {
+			dev_if->setup_desc_addr[0] =
+			    dwc_otg_ep_alloc_desc_chain(dev,
+				&dev_if->dma_setup_desc_addr[0], 1);
+			dev_if->setup_desc_addr[1] =
+			    dwc_otg_ep_alloc_desc_chain(dev,
+				&dev_if->dma_setup_desc_addr[1], 1);
+			dev_if->in_desc_addr =
+			    dwc_otg_ep_alloc_desc_chain(dev,
+				&dev_if->dma_in_desc_addr, 1);
+			dev_if->out_desc_addr =
+			    dwc_otg_ep_alloc_desc_chain(dev,
+				&dev_if->dma_out_desc_addr, 1);
+			pcd->data_terminated = 0;
+
+			if (dev_if->setup_desc_addr[0] == 0
+			    || dev_if->setup_desc_addr[1] == 0
+			    || dev_if->in_desc_addr == 0
+			    || dev_if->out_desc_addr == 0) {
+
+				if (dev_if->out_desc_addr)
+					dwc_otg_ep_free_desc_chain(dev,
+					     dev_if->out_desc_addr,
+					     dev_if->dma_out_desc_addr, 1);
+				if (dev_if->in_desc_addr)
+					dwc_otg_ep_free_desc_chain(dev,
+					     dev_if->in_desc_addr,
+					     dev_if->dma_in_desc_addr, 1);
+				if (dev_if->setup_desc_addr[1])
+					dwc_otg_ep_free_desc_chain(dev,
+					     dev_if->setup_desc_addr[1],
+					     dev_if->dma_setup_desc_addr[1], 1);
+				if (dev_if->setup_desc_addr[0])
+					dwc_otg_ep_free_desc_chain(dev,
+					     dev_if->setup_desc_addr[0],
+					     dev_if->dma_setup_desc_addr[0], 1);
+
+				DWC_DMA_FREE(dev, sizeof(*pcd->setup_pkt) * 5,
+					     pcd->setup_pkt,
+					     pcd->setup_pkt_dma_handle);
+				DWC_DMA_FREE(dev, sizeof(*pcd->status_buf),
+					     pcd->status_buf,
+					     pcd->status_buf_dma_handle);
+
+				DWC_FREE(pcd);
+
+				return NULL;
+			}
+		}
+	} else {
+		pcd->setup_pkt = DWC_ALLOC(sizeof(*pcd->setup_pkt) * 5);
+		if (pcd->setup_pkt == NULL) {
+			DWC_FREE(pcd);
+			return NULL;
+		}
+
+		pcd->status_buf = DWC_ALLOC(sizeof(uint16_t));
+		if (pcd->status_buf == NULL) {
+			DWC_FREE(pcd->setup_pkt);
+			DWC_FREE(pcd);
+			return NULL;
+		}
+	}
+
+	dwc_otg_pcd_reinit(pcd);
+
+	/* Allocate the cfi object for the PCD */
+#ifdef DWC_UTE_CFI
+	pcd->cfi = DWC_ALLOC(sizeof(cfiobject_t));
+	if (NULL == pcd->cfi)
+		goto fail;
+	if (init_cfi(pcd->cfi)) {
+		CFI_INFO("%s: Failed to init the CFI object\n", __func__);
+		goto fail;
+	}
+#endif
+
+	/* Initialize tasklets */
+	pcd->start_xfer_tasklet = DWC_TASK_ALLOC("xfer_tasklet",
+						 start_xfer_tasklet_func, pcd);
+	pcd->test_mode_tasklet = DWC_TASK_ALLOC("test_mode_tasklet",
+						do_test_mode, pcd);
+
+	/* Initialize SRP timer */
+	core_if->srp_timer = DWC_TIMER_ALLOC("SRP TIMER", srp_timeout, core_if);
+
+	if (core_if->core_params->dev_out_nak) {
+		/**
+		* Initialize xfer timeout timer. Implemented for
+		* 2.93a feature "Device DDMA OUT NAK Enhancement"
+		*/
+		for(i = 0; i < MAX_EPS_CHANNELS; i++) {
+			pcd->core_if->ep_xfer_timer[i] =
+				DWC_TIMER_ALLOC("ep timer", ep_xfer_timeout,
+				&pcd->core_if->ep_xfer_info[i]);
+		}
+	}
+
+	return pcd;
+#ifdef DWC_UTE_CFI
+fail:
+#endif
+	if (pcd->setup_pkt)
+		DWC_FREE(pcd->setup_pkt);
+	if (pcd->status_buf)
+		DWC_FREE(pcd->status_buf);
+#ifdef DWC_UTE_CFI
+	if (pcd->cfi)
+		DWC_FREE(pcd->cfi);
+#endif
+	if (pcd)
+		DWC_FREE(pcd);
+	return NULL;
+
+}
+
+/**
+ * Remove PCD specific data
+ */
+void dwc_otg_pcd_remove(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_dev_if_t *dev_if = GET_CORE_IF(pcd)->dev_if;
+	struct device *dev = dwc_otg_pcd_to_dev(pcd);
+	int i;
+
+	if (pcd->core_if->core_params->dev_out_nak) {
+		for (i = 0; i < MAX_EPS_CHANNELS; i++) {
+			DWC_TIMER_CANCEL(pcd->core_if->ep_xfer_timer[i]);
+			pcd->core_if->ep_xfer_info[i].state = 0;
+		}
+	}
+
+	if (GET_CORE_IF(pcd)->dma_enable) {
+		DWC_DMA_FREE(dev, sizeof(*pcd->setup_pkt) * 5, pcd->setup_pkt,
+			     pcd->setup_pkt_dma_handle);
+		DWC_DMA_FREE(dev, sizeof(uint16_t), pcd->status_buf,
+			     pcd->status_buf_dma_handle);
+		if (GET_CORE_IF(pcd)->dma_desc_enable) {
+			dwc_otg_ep_free_desc_chain(dev,
+						   dev_if->setup_desc_addr[0],
+						   dev_if->dma_setup_desc_addr
+						   [0], 1);
+			dwc_otg_ep_free_desc_chain(dev,
+						   dev_if->setup_desc_addr[1],
+						   dev_if->dma_setup_desc_addr
+						   [1], 1);
+			dwc_otg_ep_free_desc_chain(dev,
+						   dev_if->in_desc_addr,
+						   dev_if->dma_in_desc_addr, 1);
+			dwc_otg_ep_free_desc_chain(dev,
+						   dev_if->out_desc_addr,
+						   dev_if->dma_out_desc_addr,
+						   1);
+		}
+	} else {
+		DWC_FREE(pcd->setup_pkt);
+		DWC_FREE(pcd->status_buf);
+	}
+	DWC_SPINLOCK_FREE(pcd->lock);
+	/* Set core_if's lock pointer to NULL */
+	pcd->core_if->lock = NULL;
+
+	DWC_TASK_FREE(pcd->start_xfer_tasklet);
+	DWC_TASK_FREE(pcd->test_mode_tasklet);
+	if (pcd->core_if->core_params->dev_out_nak) {
+		for (i = 0; i < MAX_EPS_CHANNELS; i++) {
+			if (pcd->core_if->ep_xfer_timer[i]) {
+					DWC_TIMER_FREE(pcd->core_if->ep_xfer_timer[i]);
+			}
+		}
+	}
+
+/* Release the CFI object's dynamic memory */
+#ifdef DWC_UTE_CFI
+	if (pcd->cfi->ops.release) {
+		pcd->cfi->ops.release(pcd->cfi);
+	}
+#endif
+
+	DWC_FREE(pcd);
+}
+
+/**
+ * Returns whether registered pcd is dual speed or not
+ */
+uint32_t dwc_otg_pcd_is_dualspeed(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+
+	if ((core_if->core_params->speed == DWC_SPEED_PARAM_FULL) ||
+	    ((core_if->hwcfg2.b.hs_phy_type == 2) &&
+	     (core_if->hwcfg2.b.fs_phy_type == 1) &&
+	     (core_if->core_params->ulpi_fs_ls))) {
+		return 0;
+	}
+
+	return 1;
+}
+
+/**
+ * Returns whether registered pcd is OTG capable or not
+ */
+uint32_t dwc_otg_pcd_is_otg(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	gusbcfg_data_t usbcfg = {.d32 = 0 };
+
+	usbcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->gusbcfg);
+	if (!usbcfg.b.srpcap || !usbcfg.b.hnpcap) {
+		return 0;
+	}
+
+	return 1;
+}
+
+/**
+ * This function assigns periodic Tx FIFO to an periodic EP
+ * in shared Tx FIFO mode
+ */
+static uint32_t assign_tx_fifo(dwc_otg_core_if_t * core_if)
+{
+	uint32_t TxMsk = 1;
+	int i;
+
+	for (i = 0; i < core_if->hwcfg4.b.num_in_eps; ++i) {
+		if ((TxMsk & core_if->tx_msk) == 0) {
+			core_if->tx_msk |= TxMsk;
+			return i + 1;
+		}
+		TxMsk <<= 1;
+	}
+	return 0;
+}
+
+/**
+ * This function assigns periodic Tx FIFO to an periodic EP
+ * in shared Tx FIFO mode
+ */
+static uint32_t assign_perio_tx_fifo(dwc_otg_core_if_t * core_if)
+{
+	uint32_t PerTxMsk = 1;
+	int i;
+	for (i = 0; i < core_if->hwcfg4.b.num_dev_perio_in_ep; ++i) {
+		if ((PerTxMsk & core_if->p_tx_msk) == 0) {
+			core_if->p_tx_msk |= PerTxMsk;
+			return i + 1;
+		}
+		PerTxMsk <<= 1;
+	}
+	return 0;
+}
+
+/**
+ * This function releases periodic Tx FIFO
+ * in shared Tx FIFO mode
+ */
+static void release_perio_tx_fifo(dwc_otg_core_if_t * core_if,
+				  uint32_t fifo_num)
+{
+	core_if->p_tx_msk =
+	    (core_if->p_tx_msk & (1 << (fifo_num - 1))) ^ core_if->p_tx_msk;
+}
+
+/**
+ * This function releases periodic Tx FIFO
+ * in shared Tx FIFO mode
+ */
+static void release_tx_fifo(dwc_otg_core_if_t * core_if, uint32_t fifo_num)
+{
+	core_if->tx_msk =
+	    (core_if->tx_msk & (1 << (fifo_num - 1))) ^ core_if->tx_msk;
+}
+
+/**
+ * This function is being called from gadget
+ * to enable PCD endpoint.
+ */
+int dwc_otg_pcd_ep_enable(dwc_otg_pcd_t * pcd,
+			  const uint8_t * ep_desc, void *usb_ep)
+{
+	int num, dir;
+	dwc_otg_pcd_ep_t *ep = NULL;
+	const usb_endpoint_descriptor_t *desc;
+	dwc_irqflags_t flags;
+	fifosize_data_t dptxfsiz = {.d32 = 0 };
+	gdfifocfg_data_t gdfifocfg = {.d32 = 0 };
+	gdfifocfg_data_t gdfifocfgbase = {.d32 = 0 };
+	int retval = 0;
+	int i, epcount;
+	struct device *dev = dwc_otg_pcd_to_dev(pcd);
+
+	desc = (const usb_endpoint_descriptor_t *)ep_desc;
+
+	if (!desc) {
+		pcd->ep0.priv = usb_ep;
+		ep = &pcd->ep0;
+		retval = -DWC_E_INVALID;
+		goto out;
+	}
+
+	num = UE_GET_ADDR(desc->bEndpointAddress);
+	dir = UE_GET_DIR(desc->bEndpointAddress);
+
+	if (!desc->wMaxPacketSize) {
+		DWC_WARN("bad maxpacketsize\n");
+		retval = -DWC_E_INVALID;
+		goto out;
+	}
+
+	if (dir == UE_DIR_IN) {
+		epcount = pcd->core_if->dev_if->num_in_eps;
+		for (i = 0; i < epcount; i++) {
+			if (num == pcd->in_ep[i].dwc_ep.num) {
+				ep = &pcd->in_ep[i];
+				break;
+			}
+		}
+	} else {
+		epcount = pcd->core_if->dev_if->num_out_eps;
+		for (i = 0; i < epcount; i++) {
+			if (num == pcd->out_ep[i].dwc_ep.num) {
+				ep = &pcd->out_ep[i];
+				break;
+			}
+		}
+	}
+
+	if (!ep) {
+		DWC_WARN("bad address\n");
+		retval = -DWC_E_INVALID;
+		goto out;
+	}
+
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+
+	ep->desc = desc;
+	ep->priv = usb_ep;
+
+	/*
+	 * Activate the EP
+	 */
+	ep->stopped = 0;
+
+	ep->dwc_ep.is_in = (dir == UE_DIR_IN);
+	ep->dwc_ep.maxpacket = UGETW(desc->wMaxPacketSize);
+
+	ep->dwc_ep.type = desc->bmAttributes & UE_XFERTYPE;
+
+	if (ep->dwc_ep.is_in) {
+		if (!GET_CORE_IF(pcd)->en_multiple_tx_fifo) {
+			ep->dwc_ep.tx_fifo_num = 0;
+
+			if (ep->dwc_ep.type == UE_ISOCHRONOUS) {
+				/*
+				 * if ISOC EP then assign a Periodic Tx FIFO.
+				 */
+				ep->dwc_ep.tx_fifo_num =
+				    assign_perio_tx_fifo(GET_CORE_IF(pcd));
+			}
+		} else {
+			/*
+			 * if Dedicated FIFOs mode is on then assign a Tx FIFO.
+			 */
+			ep->dwc_ep.tx_fifo_num =
+			    assign_tx_fifo(GET_CORE_IF(pcd));
+		}
+
+		/* Calculating EP info controller base address */
+		if (ep->dwc_ep.tx_fifo_num
+		    && GET_CORE_IF(pcd)->en_multiple_tx_fifo) {
+			gdfifocfg.d32 =
+			    DWC_READ_REG32(&GET_CORE_IF(pcd)->
+					   core_global_regs->gdfifocfg);
+			gdfifocfgbase.d32 = gdfifocfg.d32 >> 16;
+			dptxfsiz.d32 =
+			    (DWC_READ_REG32
+			     (&GET_CORE_IF(pcd)->core_global_regs->
+			      dtxfsiz[ep->dwc_ep.tx_fifo_num - 1]) >> 16);
+			gdfifocfg.b.epinfobase =
+			    gdfifocfgbase.d32 + dptxfsiz.d32;
+			if (GET_CORE_IF(pcd)->snpsid <= OTG_CORE_REV_2_94a) {
+				DWC_WRITE_REG32(&GET_CORE_IF(pcd)->
+						core_global_regs->gdfifocfg,
+						gdfifocfg.d32);
+			}
+		}
+	}
+	/* Set initial data PID. */
+	if (ep->dwc_ep.type == UE_BULK) {
+		ep->dwc_ep.data_pid_start = 0;
+	}
+
+	/* Alloc DMA Descriptors */
+	if (GET_CORE_IF(pcd)->dma_desc_enable) {
+#ifndef DWC_UTE_PER_IO
+		if (ep->dwc_ep.type != UE_ISOCHRONOUS) {
+#endif
+			ep->dwc_ep.desc_addr =
+			    dwc_otg_ep_alloc_desc_chain(dev,
+						&ep->dwc_ep.dma_desc_addr,
+						MAX_DMA_DESC_CNT);
+			if (!ep->dwc_ep.desc_addr) {
+				DWC_WARN("%s, can't allocate DMA descriptor\n",
+					 __func__);
+				retval = -DWC_E_SHUTDOWN;
+				DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+				goto out;
+			}
+#ifndef DWC_UTE_PER_IO
+		}
+#endif
+	}
+
+	DWC_DEBUGPL(DBG_PCD, "Activate %s: type=%d, mps=%d desc=%p\n",
+		    (ep->dwc_ep.is_in ? "IN" : "OUT"),
+		    ep->dwc_ep.type, ep->dwc_ep.maxpacket, ep->desc);
+#ifdef DWC_UTE_PER_IO
+	ep->dwc_ep.xiso_bInterval = 1 << (ep->desc->bInterval - 1);
+#endif
+	if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
+		ep->dwc_ep.bInterval = 1 << (ep->desc->bInterval - 1);
+		ep->dwc_ep.frame_num = 0xFFFFFFFF;
+	}
+
+	dwc_otg_ep_activate(GET_CORE_IF(pcd), &ep->dwc_ep);
+
+#ifdef DWC_UTE_CFI
+	if (pcd->cfi->ops.ep_enable) {
+		pcd->cfi->ops.ep_enable(pcd->cfi, pcd, ep);
+	}
+#endif
+
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+
+out:
+	return retval;
+}
+
+/**
+ * This function is being called from gadget
+ * to disable PCD endpoint.
+ */
+int dwc_otg_pcd_ep_disable(dwc_otg_pcd_t * pcd, void *ep_handle)
+{
+	dwc_otg_pcd_ep_t *ep;
+	dwc_irqflags_t flags;
+	dwc_otg_dev_dma_desc_t *desc_addr;
+	dwc_dma_t dma_desc_addr;
+	gdfifocfg_data_t gdfifocfgbase = {.d32 = 0 };
+	gdfifocfg_data_t gdfifocfg = {.d32 = 0 };
+	fifosize_data_t dptxfsiz = {.d32 = 0 };
+	struct device *dev = dwc_otg_pcd_to_dev(pcd);
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+
+	if (!ep || !ep->desc) {
+		DWC_DEBUGPL(DBG_PCD, "bad ep address\n");
+		return -DWC_E_INVALID;
+	}
+
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+
+	dwc_otg_request_nuke(ep);
+
+	dwc_otg_ep_deactivate(GET_CORE_IF(pcd), &ep->dwc_ep);
+	if (pcd->core_if->core_params->dev_out_nak) {
+		DWC_TIMER_CANCEL(pcd->core_if->ep_xfer_timer[ep->dwc_ep.num]);
+		pcd->core_if->ep_xfer_info[ep->dwc_ep.num].state = 0;
+	}
+	ep->desc = NULL;
+	ep->stopped = 1;
+
+	gdfifocfg.d32 =
+	    DWC_READ_REG32(&GET_CORE_IF(pcd)->core_global_regs->gdfifocfg);
+	gdfifocfgbase.d32 = gdfifocfg.d32 >> 16;
+
+	if (ep->dwc_ep.is_in) {
+		if (GET_CORE_IF(pcd)->en_multiple_tx_fifo) {
+			/* Flush the Tx FIFO */
+			dwc_otg_flush_tx_fifo(GET_CORE_IF(pcd),
+					      ep->dwc_ep.tx_fifo_num);
+		}
+		release_perio_tx_fifo(GET_CORE_IF(pcd), ep->dwc_ep.tx_fifo_num);
+		release_tx_fifo(GET_CORE_IF(pcd), ep->dwc_ep.tx_fifo_num);
+		if (GET_CORE_IF(pcd)->en_multiple_tx_fifo) {
+			/* Decreasing EPinfo Base Addr */
+			dptxfsiz.d32 =
+			    (DWC_READ_REG32
+			     (&GET_CORE_IF(pcd)->
+				core_global_regs->dtxfsiz[ep->dwc_ep.tx_fifo_num-1]) >> 16);
+			gdfifocfg.b.epinfobase = gdfifocfgbase.d32 - dptxfsiz.d32;
+			if (GET_CORE_IF(pcd)->snpsid <= OTG_CORE_REV_2_94a) {
+				DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gdfifocfg,
+					gdfifocfg.d32);
+			}
+		}
+	}
+
+	/* Free DMA Descriptors */
+	if (GET_CORE_IF(pcd)->dma_desc_enable) {
+		if (ep->dwc_ep.type != UE_ISOCHRONOUS) {
+			desc_addr = ep->dwc_ep.desc_addr;
+			dma_desc_addr = ep->dwc_ep.dma_desc_addr;
+
+			/* Cannot call dma_free_coherent() with IRQs disabled */
+			DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+			dwc_otg_ep_free_desc_chain(dev, desc_addr, dma_desc_addr,
+						   MAX_DMA_DESC_CNT);
+
+			goto out_unlocked;
+		}
+	}
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+
+out_unlocked:
+	DWC_DEBUGPL(DBG_PCD, "%d %s disabled\n", ep->dwc_ep.num,
+		    ep->dwc_ep.is_in ? "IN" : "OUT");
+	return 0;
+
+}
+
+/******************************************************************************/
+#ifdef DWC_UTE_PER_IO
+
+/**
+ * Free the request and its extended parts
+ *
+ */
+void dwc_pcd_xiso_ereq_free(dwc_otg_pcd_ep_t * ep, dwc_otg_pcd_request_t * req)
+{
+	DWC_FREE(req->ext_req.per_io_frame_descs);
+	DWC_FREE(req);
+}
+
+/**
+ * Start the next request in the endpoint's queue.
+ *
+ */
+int dwc_otg_pcd_xiso_start_next_request(dwc_otg_pcd_t * pcd,
+					dwc_otg_pcd_ep_t * ep)
+{
+	int i;
+	dwc_otg_pcd_request_t *req = NULL;
+	dwc_ep_t *dwcep = NULL;
+	struct dwc_iso_xreq_port *ereq = NULL;
+	struct dwc_iso_pkt_desc_port *ddesc_iso;
+	uint16_t nat;
+	depctl_data_t diepctl;
+
+	dwcep = &ep->dwc_ep;
+
+	if (dwcep->xiso_active_xfers > 0) {
+#if 0	//Disable this to decrease s/w overhead that is crucial for Isoc transfers
+		DWC_WARN("There are currently active transfers for EP%d \
+				(active=%d; queued=%d)", dwcep->num, dwcep->xiso_active_xfers,
+				dwcep->xiso_queued_xfers);
+#endif
+		return 0;
+	}
+
+	nat = UGETW(ep->desc->wMaxPacketSize);
+	nat = (nat >> 11) & 0x03;
+
+	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+		req = DWC_CIRCLEQ_FIRST(&ep->queue);
+		ereq = &req->ext_req;
+		ep->stopped = 0;
+
+		/* Get the frame number */
+		dwcep->xiso_frame_num =
+		    dwc_otg_get_frame_number(GET_CORE_IF(pcd));
+		DWC_DEBUG("FRM_NUM=%d", dwcep->xiso_frame_num);
+
+		ddesc_iso = ereq->per_io_frame_descs;
+
+		if (dwcep->is_in) {
+			/* Setup DMA Descriptor chain for IN Isoc request */
+			for (i = 0; i < ereq->pio_pkt_count; i++) {
+				//if ((i % (nat + 1)) == 0)
+				if ( i > 0 )
+					dwcep->xiso_frame_num =
+					    (dwcep->xiso_bInterval +
+										dwcep->xiso_frame_num) & 0x3FFF;
+				dwcep->desc_addr[i].buf =
+				    req->dma + ddesc_iso[i].offset;
+				dwcep->desc_addr[i].status.b_iso_in.txbytes =
+				    ddesc_iso[i].length;
+				dwcep->desc_addr[i].status.b_iso_in.framenum =
+				    dwcep->xiso_frame_num;
+				dwcep->desc_addr[i].status.b_iso_in.bs =
+				    BS_HOST_READY;
+				dwcep->desc_addr[i].status.b_iso_in.txsts = 0;
+				dwcep->desc_addr[i].status.b_iso_in.sp =
+				    (ddesc_iso[i].length %
+				     dwcep->maxpacket) ? 1 : 0;
+				dwcep->desc_addr[i].status.b_iso_in.ioc = 0;
+				dwcep->desc_addr[i].status.b_iso_in.pid = nat + 1;
+				dwcep->desc_addr[i].status.b_iso_in.l = 0;
+
+				/* Process the last descriptor */
+				if (i == ereq->pio_pkt_count - 1) {
+					dwcep->desc_addr[i].status.b_iso_in.ioc = 1;
+					dwcep->desc_addr[i].status.b_iso_in.l = 1;
+				}
+			}
+
+			/* Setup and start the transfer for this endpoint */
+			dwcep->xiso_active_xfers++;
+			DWC_WRITE_REG32(&GET_CORE_IF(pcd)->dev_if->
+					in_ep_regs[dwcep->num]->diepdma,
+					dwcep->dma_desc_addr);
+			diepctl.d32 = 0;
+			diepctl.b.epena = 1;
+			diepctl.b.cnak = 1;
+			DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->dev_if->
+					 in_ep_regs[dwcep->num]->diepctl, 0,
+					 diepctl.d32);
+		} else {
+			/* Setup DMA Descriptor chain for OUT Isoc request */
+			for (i = 0; i < ereq->pio_pkt_count; i++) {
+				//if ((i % (nat + 1)) == 0)
+				dwcep->xiso_frame_num = (dwcep->xiso_bInterval +
+										dwcep->xiso_frame_num) & 0x3FFF;
+				dwcep->desc_addr[i].buf =
+				    req->dma + ddesc_iso[i].offset;
+				dwcep->desc_addr[i].status.b_iso_out.rxbytes =
+				    ddesc_iso[i].length;
+				dwcep->desc_addr[i].status.b_iso_out.framenum =
+				    dwcep->xiso_frame_num;
+				dwcep->desc_addr[i].status.b_iso_out.bs =
+				    BS_HOST_READY;
+				dwcep->desc_addr[i].status.b_iso_out.rxsts = 0;
+				dwcep->desc_addr[i].status.b_iso_out.sp =
+				    (ddesc_iso[i].length %
+				     dwcep->maxpacket) ? 1 : 0;
+				dwcep->desc_addr[i].status.b_iso_out.ioc = 0;
+				dwcep->desc_addr[i].status.b_iso_out.pid = nat + 1;
+				dwcep->desc_addr[i].status.b_iso_out.l = 0;
+
+				/* Process the last descriptor */
+				if (i == ereq->pio_pkt_count - 1) {
+					dwcep->desc_addr[i].status.b_iso_out.ioc = 1;
+					dwcep->desc_addr[i].status.b_iso_out.l = 1;
+				}
+			}
+
+			/* Setup and start the transfer for this endpoint */
+			dwcep->xiso_active_xfers++;
+			DWC_WRITE_REG32(&GET_CORE_IF(pcd)->
+					dev_if->out_ep_regs[dwcep->num]->
+					doepdma, dwcep->dma_desc_addr);
+			diepctl.d32 = 0;
+			diepctl.b.epena = 1;
+			diepctl.b.cnak = 1;
+			DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->
+					 dev_if->out_ep_regs[dwcep->num]->
+					 doepctl, 0, diepctl.d32);
+		}
+
+	} else {
+		ep->stopped = 1;
+	}
+
+	return 0;
+}
+
+/**
+ *	- Remove the request from the queue
+ */
+void complete_xiso_ep(dwc_otg_pcd_ep_t * ep)
+{
+	dwc_otg_pcd_request_t *req = NULL;
+	struct dwc_iso_xreq_port *ereq = NULL;
+	struct dwc_iso_pkt_desc_port *ddesc_iso = NULL;
+	dwc_ep_t *dwcep = NULL;
+	int i;
+
+	//DWC_DEBUG();
+	dwcep = &ep->dwc_ep;
+
+	/* Get the first pending request from the queue */
+	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+		req = DWC_CIRCLEQ_FIRST(&ep->queue);
+		if (!req) {
+			DWC_PRINTF("complete_ep 0x%p, req = NULL!\n", ep);
+			return;
+		}
+		dwcep->xiso_active_xfers--;
+		dwcep->xiso_queued_xfers--;
+		/* Remove this request from the queue */
+		DWC_CIRCLEQ_REMOVE_INIT(&ep->queue, req, queue_entry);
+	} else {
+		DWC_PRINTF("complete_ep 0x%p, ep->queue empty!\n", ep);
+		return;
+	}
+
+	ep->stopped = 1;
+	ereq = &req->ext_req;
+	ddesc_iso = ereq->per_io_frame_descs;
+
+	if (dwcep->xiso_active_xfers < 0) {
+		DWC_WARN("EP#%d (xiso_active_xfers=%d)", dwcep->num,
+			 dwcep->xiso_active_xfers);
+	}
+
+	/* Fill the Isoc descs of portable extended req from dma descriptors */
+	for (i = 0; i < ereq->pio_pkt_count; i++) {
+		if (dwcep->is_in) {	/* IN endpoints */
+			ddesc_iso[i].actual_length = ddesc_iso[i].length -
+			    dwcep->desc_addr[i].status.b_iso_in.txbytes;
+			ddesc_iso[i].status =
+			    dwcep->desc_addr[i].status.b_iso_in.txsts;
+		} else {	/* OUT endpoints */
+			ddesc_iso[i].actual_length = ddesc_iso[i].length -
+			    dwcep->desc_addr[i].status.b_iso_out.rxbytes;
+			ddesc_iso[i].status =
+			    dwcep->desc_addr[i].status.b_iso_out.rxsts;
+		}
+	}
+
+	DWC_SPINUNLOCK(ep->pcd->lock);
+
+	/* Call the completion function in the non-portable logic */
+	ep->pcd->fops->xisoc_complete(ep->pcd, ep->priv, req->priv, 0,
+				      &req->ext_req);
+
+	DWC_SPINLOCK(ep->pcd->lock);
+
+	/* Free the request - specific freeing needed for extended request object */
+	dwc_pcd_xiso_ereq_free(ep, req);
+
+	/* Start the next request */
+	dwc_otg_pcd_xiso_start_next_request(ep->pcd, ep);
+
+	return;
+}
+
+/**
+ * Create and initialize the Isoc pkt descriptors of the extended request.
+ *
+ */
+static int dwc_otg_pcd_xiso_create_pkt_descs(dwc_otg_pcd_request_t * req,
+					     void *ereq_nonport,
+					     int atomic_alloc)
+{
+	struct dwc_iso_xreq_port *ereq = NULL;
+	struct dwc_iso_xreq_port *req_mapped = NULL;
+	struct dwc_iso_pkt_desc_port *ipds = NULL;	/* To be created in this function */
+	uint32_t pkt_count;
+	int i;
+
+	ereq = &req->ext_req;
+	req_mapped = (struct dwc_iso_xreq_port *)ereq_nonport;
+	pkt_count = req_mapped->pio_pkt_count;
+
+	/* Create the isoc descs */
+	if (atomic_alloc) {
+		ipds = DWC_ALLOC_ATOMIC(sizeof(*ipds) * pkt_count);
+	} else {
+		ipds = DWC_ALLOC(sizeof(*ipds) * pkt_count);
+	}
+
+	if (!ipds) {
+		DWC_ERROR("Failed to allocate isoc descriptors");
+		return -DWC_E_NO_MEMORY;
+	}
+
+	/* Initialize the extended request fields */
+	ereq->per_io_frame_descs = ipds;
+	ereq->error_count = 0;
+	ereq->pio_alloc_pkt_count = pkt_count;
+	ereq->pio_pkt_count = pkt_count;
+	ereq->tr_sub_flags = req_mapped->tr_sub_flags;
+
+	/* Init the Isoc descriptors */
+	for (i = 0; i < pkt_count; i++) {
+		ipds[i].length = req_mapped->per_io_frame_descs[i].length;
+		ipds[i].offset = req_mapped->per_io_frame_descs[i].offset;
+		ipds[i].status = req_mapped->per_io_frame_descs[i].status;	/* 0 */
+		ipds[i].actual_length =
+		    req_mapped->per_io_frame_descs[i].actual_length;
+	}
+
+	return 0;
+}
+
+static void prn_ext_request(struct dwc_iso_xreq_port *ereq)
+{
+	struct dwc_iso_pkt_desc_port *xfd = NULL;
+	int i;
+
+	DWC_DEBUG("per_io_frame_descs=%p", ereq->per_io_frame_descs);
+	DWC_DEBUG("tr_sub_flags=%d", ereq->tr_sub_flags);
+	DWC_DEBUG("error_count=%d", ereq->error_count);
+	DWC_DEBUG("pio_alloc_pkt_count=%d", ereq->pio_alloc_pkt_count);
+	DWC_DEBUG("pio_pkt_count=%d", ereq->pio_pkt_count);
+	DWC_DEBUG("res=%d", ereq->res);
+
+	for (i = 0; i < ereq->pio_pkt_count; i++) {
+		xfd = &ereq->per_io_frame_descs[0];
+		DWC_DEBUG("FD #%d", i);
+
+		DWC_DEBUG("xfd->actual_length=%d", xfd->actual_length);
+		DWC_DEBUG("xfd->length=%d", xfd->length);
+		DWC_DEBUG("xfd->offset=%d", xfd->offset);
+		DWC_DEBUG("xfd->status=%d", xfd->status);
+	}
+}
+
+/**
+ *
+ */
+int dwc_otg_pcd_xiso_ep_queue(dwc_otg_pcd_t * pcd, void *ep_handle,
+			      uint8_t * buf, dwc_dma_t dma_buf, uint32_t buflen,
+			      int zero, void *req_handle, int atomic_alloc,
+			      void *ereq_nonport)
+{
+	dwc_otg_pcd_request_t *req = NULL;
+	dwc_otg_pcd_ep_t *ep;
+	dwc_irqflags_t flags;
+	int res;
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+	if (!ep) {
+		DWC_WARN("bad ep\n");
+		return -DWC_E_INVALID;
+	}
+
+	/* We support this extension only for DDMA mode */
+	if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC)
+		if (!GET_CORE_IF(pcd)->dma_desc_enable)
+			return -DWC_E_INVALID;
+
+	/* Create a dwc_otg_pcd_request_t object */
+	if (atomic_alloc) {
+		req = DWC_ALLOC_ATOMIC(sizeof(*req));
+	} else {
+		req = DWC_ALLOC(sizeof(*req));
+	}
+
+	if (!req) {
+		return -DWC_E_NO_MEMORY;
+	}
+
+	/* Create the Isoc descs for this request which shall be the exact match
+	 * of the structure sent to us from the non-portable logic */
+	res =
+	    dwc_otg_pcd_xiso_create_pkt_descs(req, ereq_nonport, atomic_alloc);
+	if (res) {
+		DWC_WARN("Failed to init the Isoc descriptors");
+		DWC_FREE(req);
+		return res;
+	}
+
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+
+	DWC_CIRCLEQ_INIT_ENTRY(req, queue_entry);
+	req->buf = buf;
+	req->dma = dma_buf;
+	req->length = buflen;
+	req->sent_zlp = zero;
+	req->priv = req_handle;
+
+	//DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+	ep->dwc_ep.dma_addr = dma_buf;
+	ep->dwc_ep.start_xfer_buff = buf;
+	ep->dwc_ep.xfer_buff = buf;
+	ep->dwc_ep.xfer_len = 0;
+	ep->dwc_ep.xfer_count = 0;
+	ep->dwc_ep.sent_zlp = 0;
+	ep->dwc_ep.total_len = buflen;
+
+	/* Add this request to the tail */
+	DWC_CIRCLEQ_INSERT_TAIL(&ep->queue, req, queue_entry);
+	ep->dwc_ep.xiso_queued_xfers++;
+
+//DWC_DEBUG("CP_0");
+//DWC_DEBUG("req->ext_req.tr_sub_flags=%d", req->ext_req.tr_sub_flags);
+//prn_ext_request((struct dwc_iso_xreq_port *) ereq_nonport);
+//prn_ext_request(&req->ext_req);
+
+	//DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+
+	/* If the req->status == ASAP  then check if there is any active transfer
+	 * for this endpoint. If no active transfers, then get the first entry
+	 * from the queue and start that transfer
+	 */
+	if (req->ext_req.tr_sub_flags == DWC_EREQ_TF_ASAP) {
+		res = dwc_otg_pcd_xiso_start_next_request(pcd, ep);
+		if (res) {
+			DWC_WARN("Failed to start the next Isoc transfer");
+			DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+			DWC_FREE(req);
+			return res;
+		}
+	}
+
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+	return 0;
+}
+
+#endif
+/* END ifdef DWC_UTE_PER_IO ***************************************************/
+int dwc_otg_pcd_ep_queue(dwc_otg_pcd_t * pcd, void *ep_handle,
+			 uint8_t * buf, dwc_dma_t dma_buf, uint32_t buflen,
+			 int zero, void *req_handle, int atomic_alloc)
+{
+	struct device *dev = dwc_otg_pcd_to_dev(pcd);
+	dwc_irqflags_t flags;
+	dwc_otg_pcd_request_t *req;
+	dwc_otg_pcd_ep_t *ep;
+	uint32_t max_transfer;
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+	if (!ep || (!ep->desc && ep->dwc_ep.num != 0)) {
+		DWC_WARN("bad ep\n");
+		return -DWC_E_INVALID;
+	}
+
+	if (atomic_alloc) {
+		req = DWC_ALLOC_ATOMIC(sizeof(*req));
+	} else {
+		req = DWC_ALLOC(sizeof(*req));
+	}
+
+	if (!req) {
+		return -DWC_E_NO_MEMORY;
+	}
+	DWC_CIRCLEQ_INIT_ENTRY(req, queue_entry);
+	if (!GET_CORE_IF(pcd)->core_params->opt) {
+		if (ep->dwc_ep.num != 0) {
+			DWC_ERROR("queue req %p, len %d buf %p\n",
+				  req_handle, buflen, buf);
+		}
+	}
+
+	req->buf = buf;
+	req->dma = dma_buf;
+	req->length = buflen;
+	req->sent_zlp = zero;
+	req->priv = req_handle;
+	req->dw_align_buf = NULL;
+	if ((dma_buf & 0x3) && GET_CORE_IF(pcd)->dma_enable
+			&& !GET_CORE_IF(pcd)->dma_desc_enable)
+		req->dw_align_buf = DWC_DMA_ALLOC(dev, buflen,
+				 &req->dw_align_buf_dma);
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+
+	/*
+	 * After adding request to the queue for IN ISOC wait for In Token Received
+	 * when TX FIFO is empty interrupt and for OUT ISOC wait for OUT Token
+	 * Received when EP is disabled interrupt to obtain starting microframe
+	 * (odd/even) start transfer
+	 */
+	if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
+		if (req != 0) {
+			depctl_data_t depctl = {.d32 =
+				    DWC_READ_REG32(&pcd->core_if->dev_if->
+						   in_ep_regs[ep->dwc_ep.num]->
+						   diepctl) };
+			++pcd->request_pending;
+
+			DWC_CIRCLEQ_INSERT_TAIL(&ep->queue, req, queue_entry);
+			if (ep->dwc_ep.is_in) {
+				depctl.b.cnak = 1;
+				DWC_WRITE_REG32(&pcd->core_if->dev_if->
+						in_ep_regs[ep->dwc_ep.num]->
+						diepctl, depctl.d32);
+			}
+
+			DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+		}
+		return 0;
+	}
+
+	/*
+	 * For EP0 IN without premature status, zlp is required?
+	 */
+	if (ep->dwc_ep.num == 0 && ep->dwc_ep.is_in) {
+		DWC_DEBUGPL(DBG_PCDV, "%d-OUT ZLP\n", ep->dwc_ep.num);
+		//_req->zero = 1;
+	}
+
+	/* Start the transfer */
+	if (DWC_CIRCLEQ_EMPTY(&ep->queue) && !ep->stopped) {
+		/* EP0 Transfer? */
+		if (ep->dwc_ep.num == 0) {
+			switch (pcd->ep0state) {
+			case EP0_IN_DATA_PHASE:
+				DWC_DEBUGPL(DBG_PCD,
+					    "%s ep0: EP0_IN_DATA_PHASE\n",
+					    __func__);
+				break;
+
+			case EP0_OUT_DATA_PHASE:
+				DWC_DEBUGPL(DBG_PCD,
+					    "%s ep0: EP0_OUT_DATA_PHASE\n",
+					    __func__);
+				if (pcd->request_config) {
+					/* Complete STATUS PHASE */
+					ep->dwc_ep.is_in = 1;
+					pcd->ep0state = EP0_IN_STATUS_PHASE;
+				}
+				break;
+
+			case EP0_IN_STATUS_PHASE:
+				DWC_DEBUGPL(DBG_PCD,
+					    "%s ep0: EP0_IN_STATUS_PHASE\n",
+					    __func__);
+				break;
+
+			default:
+				DWC_DEBUGPL(DBG_ANY, "ep0: odd state %d\n",
+					    pcd->ep0state);
+				DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+				return -DWC_E_SHUTDOWN;
+			}
+
+			ep->dwc_ep.dma_addr = dma_buf;
+			ep->dwc_ep.start_xfer_buff = buf;
+			ep->dwc_ep.xfer_buff = buf;
+			ep->dwc_ep.xfer_len = buflen;
+			ep->dwc_ep.xfer_count = 0;
+			ep->dwc_ep.sent_zlp = 0;
+			ep->dwc_ep.total_len = ep->dwc_ep.xfer_len;
+
+			if (zero) {
+				if ((ep->dwc_ep.xfer_len %
+				     ep->dwc_ep.maxpacket == 0)
+				    && (ep->dwc_ep.xfer_len != 0)) {
+					ep->dwc_ep.sent_zlp = 1;
+				}
+
+			}
+
+			dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd),
+						   &ep->dwc_ep);
+		}		// non-ep0 endpoints
+		else {
+#ifdef DWC_UTE_CFI
+			if (ep->dwc_ep.buff_mode != BM_STANDARD) {
+				/* store the request length */
+				ep->dwc_ep.cfi_req_len = buflen;
+				pcd->cfi->ops.build_descriptors(pcd->cfi, pcd,
+								ep, req);
+			} else {
+#endif
+				max_transfer =
+				    GET_CORE_IF(ep->pcd)->core_params->
+				    max_transfer_size;
+
+				/* Setup and start the Transfer */
+				if (req->dw_align_buf){
+					if (ep->dwc_ep.is_in)
+						dwc_memcpy(req->dw_align_buf,
+							   buf, buflen);
+					ep->dwc_ep.dma_addr =
+					    req->dw_align_buf_dma;
+					ep->dwc_ep.start_xfer_buff =
+					    req->dw_align_buf;
+					ep->dwc_ep.xfer_buff =
+					    req->dw_align_buf;
+				} else {
+					ep->dwc_ep.dma_addr = dma_buf;
+					ep->dwc_ep.start_xfer_buff = buf;
+                                        ep->dwc_ep.xfer_buff = buf;
+				}
+				ep->dwc_ep.xfer_len = 0;
+				ep->dwc_ep.xfer_count = 0;
+				ep->dwc_ep.sent_zlp = 0;
+				ep->dwc_ep.total_len = buflen;
+
+				ep->dwc_ep.maxxfer = max_transfer;
+				if (GET_CORE_IF(pcd)->dma_desc_enable) {
+					uint32_t out_max_xfer =
+					    DDMA_MAX_TRANSFER_SIZE -
+					    (DDMA_MAX_TRANSFER_SIZE % 4);
+					if (ep->dwc_ep.is_in) {
+						if (ep->dwc_ep.maxxfer >
+						    DDMA_MAX_TRANSFER_SIZE) {
+							ep->dwc_ep.maxxfer =
+							    DDMA_MAX_TRANSFER_SIZE;
+						}
+					} else {
+						if (ep->dwc_ep.maxxfer >
+						    out_max_xfer) {
+							ep->dwc_ep.maxxfer =
+							    out_max_xfer;
+						}
+					}
+				}
+				if (ep->dwc_ep.maxxfer < ep->dwc_ep.total_len) {
+					ep->dwc_ep.maxxfer -=
+					    (ep->dwc_ep.maxxfer %
+					     ep->dwc_ep.maxpacket);
+				}
+
+				if (zero) {
+					if ((ep->dwc_ep.total_len %
+					     ep->dwc_ep.maxpacket == 0)
+					    && (ep->dwc_ep.total_len != 0)) {
+						ep->dwc_ep.sent_zlp = 1;
+					}
+				}
+#ifdef DWC_UTE_CFI
+			}
+#endif
+			dwc_otg_ep_start_transfer(GET_CORE_IF(pcd),
+						  &ep->dwc_ep);
+		}
+	}
+
+	if (req != 0) {
+		++pcd->request_pending;
+		DWC_CIRCLEQ_INSERT_TAIL(&ep->queue, req, queue_entry);
+		if (ep->dwc_ep.is_in && ep->stopped
+		    && !(GET_CORE_IF(pcd)->dma_enable)) {
+			/** @todo NGS Create a function for this. */
+			diepmsk_data_t diepmsk = {.d32 = 0 };
+			diepmsk.b.intktxfemp = 1;
+			if (GET_CORE_IF(pcd)->multiproc_int_enable) {
+				DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->
+						 dev_if->dev_global_regs->diepeachintmsk
+						 [ep->dwc_ep.num], 0,
+						 diepmsk.d32);
+			} else {
+				DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->
+						 dev_if->dev_global_regs->
+						 diepmsk, 0, diepmsk.d32);
+			}
+
+		}
+	}
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+
+	return 0;
+}
+
+int dwc_otg_pcd_ep_dequeue(dwc_otg_pcd_t * pcd, void *ep_handle,
+			   void *req_handle)
+{
+	dwc_irqflags_t flags;
+	dwc_otg_pcd_request_t *req;
+	dwc_otg_pcd_ep_t *ep;
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+	if (!ep || (!ep->desc && ep->dwc_ep.num != 0)) {
+		DWC_WARN("bad argument\n");
+		return -DWC_E_INVALID;
+	}
+
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+
+	/* make sure it's actually queued on this endpoint */
+	DWC_CIRCLEQ_FOREACH(req, &ep->queue, queue_entry) {
+		if (req->priv == (void *)req_handle) {
+			break;
+		}
+	}
+
+	if (req->priv != (void *)req_handle) {
+		DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+		return -DWC_E_INVALID;
+	}
+
+	if (!DWC_CIRCLEQ_EMPTY_ENTRY(req, queue_entry)) {
+		dwc_otg_request_done(ep, req, -DWC_E_RESTART);
+	} else {
+		req = NULL;
+	}
+
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+
+	return req ? 0 : -DWC_E_SHUTDOWN;
+
+}
+
+/**
+ * dwc_otg_pcd_ep_wedge - sets the halt feature and ignores clear requests
+ *
+ * Use this to stall an endpoint and ignore CLEAR_FEATURE(HALT_ENDPOINT)
+ * requests. If the gadget driver clears the halt status, it will
+ * automatically unwedge the endpoint.
+ *
+ * Returns zero on success, else negative DWC error code.
+ */
+int dwc_otg_pcd_ep_wedge(dwc_otg_pcd_t * pcd, void *ep_handle)
+{
+	dwc_otg_pcd_ep_t *ep;
+	dwc_irqflags_t flags;
+	int retval = 0;
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+
+	if ((!ep->desc && ep != &pcd->ep0) ||
+	    (ep->desc && (ep->desc->bmAttributes == UE_ISOCHRONOUS))) {
+		DWC_WARN("%s, bad ep\n", __func__);
+		return -DWC_E_INVALID;
+	}
+
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+		DWC_WARN("%d %s XFer In process\n", ep->dwc_ep.num,
+			 ep->dwc_ep.is_in ? "IN" : "OUT");
+		retval = -DWC_E_AGAIN;
+	} else {
+                /* This code needs to be reviewed */
+		if (ep->dwc_ep.is_in == 1 && GET_CORE_IF(pcd)->dma_desc_enable) {
+			dtxfsts_data_t txstatus;
+			fifosize_data_t txfifosize;
+
+			txfifosize.d32 =
+			    DWC_READ_REG32(&GET_CORE_IF(pcd)->
+					   core_global_regs->dtxfsiz[ep->dwc_ep.
+								     tx_fifo_num]);
+			txstatus.d32 =
+			    DWC_READ_REG32(&GET_CORE_IF(pcd)->
+					   dev_if->in_ep_regs[ep->dwc_ep.num]->
+					   dtxfsts);
+
+			if (txstatus.b.txfspcavail < txfifosize.b.depth) {
+				DWC_WARN("%s() Data In Tx Fifo\n", __func__);
+				retval = -DWC_E_AGAIN;
+			} else {
+				if (ep->dwc_ep.num == 0) {
+					pcd->ep0state = EP0_STALL;
+				}
+
+				ep->stopped = 1;
+				dwc_otg_ep_set_stall(GET_CORE_IF(pcd),
+						     &ep->dwc_ep);
+			}
+		} else {
+			if (ep->dwc_ep.num == 0) {
+				pcd->ep0state = EP0_STALL;
+			}
+
+			ep->stopped = 1;
+			dwc_otg_ep_set_stall(GET_CORE_IF(pcd), &ep->dwc_ep);
+		}
+	}
+
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+
+	return retval;
+}
+
+int dwc_otg_pcd_ep_halt(dwc_otg_pcd_t * pcd, void *ep_handle, int value)
+{
+	dwc_otg_pcd_ep_t *ep;
+	dwc_irqflags_t flags;
+	int retval = 0;
+
+	ep = get_ep_from_handle(pcd, ep_handle);
+
+	if (!ep || (!ep->desc && ep != &pcd->ep0) ||
+	    (ep->desc && (ep->desc->bmAttributes == UE_ISOCHRONOUS))) {
+		DWC_WARN("%s, bad ep\n", __func__);
+		return -DWC_E_INVALID;
+	}
+
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+		DWC_WARN("%d %s XFer In process\n", ep->dwc_ep.num,
+			 ep->dwc_ep.is_in ? "IN" : "OUT");
+		retval = -DWC_E_AGAIN;
+	} else if (value == 0) {
+		dwc_otg_ep_clear_stall(GET_CORE_IF(pcd), &ep->dwc_ep);
+	} else if (value == 1) {
+		if (ep->dwc_ep.is_in == 1 && GET_CORE_IF(pcd)->dma_desc_enable) {
+			dtxfsts_data_t txstatus;
+			fifosize_data_t txfifosize;
+
+			txfifosize.d32 =
+			    DWC_READ_REG32(&GET_CORE_IF(pcd)->core_global_regs->
+					   dtxfsiz[ep->dwc_ep.tx_fifo_num]);
+			txstatus.d32 =
+			    DWC_READ_REG32(&GET_CORE_IF(pcd)->dev_if->
+					   in_ep_regs[ep->dwc_ep.num]->dtxfsts);
+
+			if (txstatus.b.txfspcavail < txfifosize.b.depth) {
+				DWC_WARN("%s() Data In Tx Fifo\n", __func__);
+				retval = -DWC_E_AGAIN;
+			} else {
+				if (ep->dwc_ep.num == 0) {
+					pcd->ep0state = EP0_STALL;
+				}
+
+				ep->stopped = 1;
+				dwc_otg_ep_set_stall(GET_CORE_IF(pcd),
+						     &ep->dwc_ep);
+			}
+		} else {
+			if (ep->dwc_ep.num == 0) {
+				pcd->ep0state = EP0_STALL;
+			}
+
+			ep->stopped = 1;
+			dwc_otg_ep_set_stall(GET_CORE_IF(pcd), &ep->dwc_ep);
+		}
+	} else if (value == 2) {
+		ep->dwc_ep.stall_clear_flag = 0;
+	} else if (value == 3) {
+		ep->dwc_ep.stall_clear_flag = 1;
+	}
+
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+
+	return retval;
+}
+
+/**
+ * This function initiates remote wakeup of the host from suspend state.
+ */
+void dwc_otg_pcd_rem_wkup_from_suspend(dwc_otg_pcd_t * pcd, int set)
+{
+	dctl_data_t dctl = { 0 };
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dsts_data_t dsts;
+
+	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
+	if (!dsts.b.suspsts) {
+		DWC_WARN("Remote wakeup while is not in suspend state\n");
+	}
+	/* Check if DEVICE_REMOTE_WAKEUP feature enabled */
+	if (pcd->remote_wakeup_enable) {
+		if (set) {
+
+			if (core_if->adp_enable) {
+				gpwrdn_data_t gpwrdn;
+
+				dwc_otg_adp_probe_stop(core_if);
+
+				/* Mask SRP detected interrupt from Power Down Logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.srp_det_msk = 1;
+				DWC_MODIFY_REG32(&core_if->
+						 core_global_regs->gpwrdn,
+						 gpwrdn.d32, 0);
+
+				/* Disable Power Down Logic */
+				gpwrdn.d32 = 0;
+				gpwrdn.b.pmuactv = 1;
+				DWC_MODIFY_REG32(&core_if->
+						 core_global_regs->gpwrdn,
+						 gpwrdn.d32, 0);
+
+				/*
+				 * Initialize the Core for Device mode.
+				 */
+				core_if->op_state = B_PERIPHERAL;
+				dwc_otg_core_init(core_if);
+				dwc_otg_enable_global_interrupts(core_if);
+				cil_pcd_start(core_if);
+
+				dwc_otg_initiate_srp(core_if);
+			}
+
+			dctl.b.rmtwkupsig = 1;
+			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
+					 dctl, 0, dctl.d32);
+			DWC_DEBUGPL(DBG_PCD, "Set Remote Wakeup\n");
+
+			dwc_mdelay(2);
+			DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
+					 dctl, dctl.d32, 0);
+			DWC_DEBUGPL(DBG_PCD, "Clear Remote Wakeup\n");
+		}
+	} else {
+		DWC_DEBUGPL(DBG_PCD, "Remote Wakeup is disabled\n");
+	}
+}
+
+#ifdef CONFIG_USB_DWC_OTG_LPM
+/**
+ * This function initiates remote wakeup of the host from L1 sleep state.
+ */
+void dwc_otg_pcd_rem_wkup_from_sleep(dwc_otg_pcd_t * pcd, int set)
+{
+	glpmcfg_data_t lpmcfg;
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+
+	/* Check if we are in L1 state */
+	if (!lpmcfg.b.prt_sleep_sts) {
+		DWC_DEBUGPL(DBG_PCD, "Device is not in sleep state\n");
+		return;
+	}
+
+	/* Check if host allows remote wakeup */
+	if (!lpmcfg.b.rem_wkup_en) {
+		DWC_DEBUGPL(DBG_PCD, "Host does not allow remote wakeup\n");
+		return;
+	}
+
+	/* Check if Resume OK */
+	if (!lpmcfg.b.sleep_state_resumeok) {
+		DWC_DEBUGPL(DBG_PCD, "Sleep state resume is not OK\n");
+		return;
+	}
+
+	lpmcfg.d32 = DWC_READ_REG32(&core_if->core_global_regs->glpmcfg);
+	lpmcfg.b.en_utmi_sleep = 0;
+	lpmcfg.b.hird_thres &= (~(1 << 4));
+	DWC_WRITE_REG32(&core_if->core_global_regs->glpmcfg, lpmcfg.d32);
+
+	if (set) {
+		dctl_data_t dctl = {.d32 = 0 };
+		dctl.b.rmtwkupsig = 1;
+		/* Set RmtWkUpSig bit to start remote wakup signaling.
+		 * Hardware will automatically clear this bit.
+		 */
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl,
+				 0, dctl.d32);
+		DWC_DEBUGPL(DBG_PCD, "Set Remote Wakeup\n");
+	}
+
+}
+#endif
+
+/**
+ * Performs remote wakeup.
+ */
+void dwc_otg_pcd_remote_wakeup(dwc_otg_pcd_t * pcd, int set)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_irqflags_t flags;
+	if (dwc_otg_is_device_mode(core_if)) {
+		DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+#ifdef CONFIG_USB_DWC_OTG_LPM
+		if (core_if->lx_state == DWC_OTG_L1) {
+			dwc_otg_pcd_rem_wkup_from_sleep(pcd, set);
+		} else {
+#endif
+			dwc_otg_pcd_rem_wkup_from_suspend(pcd, set);
+#ifdef CONFIG_USB_DWC_OTG_LPM
+		}
+#endif
+		DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+	}
+	return;
+}
+
+void dwc_otg_pcd_disconnect_us(dwc_otg_pcd_t * pcd, int no_of_usecs)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dctl_data_t dctl = { 0 };
+
+	if (dwc_otg_is_device_mode(core_if)) {
+		dctl.b.sftdiscon = 1;
+		DWC_PRINTF("Soft disconnect for %d useconds\n",no_of_usecs);
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, 0, dctl.d32);
+		dwc_udelay(no_of_usecs);
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32,0);
+
+	} else{
+		DWC_PRINTF("NOT SUPPORTED IN HOST MODE\n");
+	}
+	return;
+
+}
+
+int dwc_otg_pcd_wakeup(dwc_otg_pcd_t * pcd)
+{
+	dsts_data_t dsts;
+	gotgctl_data_t gotgctl;
+
+	/*
+	 * This function starts the Protocol if no session is in progress. If
+	 * a session is already in progress, but the device is suspended,
+	 * remote wakeup signaling is started.
+	 */
+
+	/* Check if valid session */
+	gotgctl.d32 =
+	    DWC_READ_REG32(&(GET_CORE_IF(pcd)->core_global_regs->gotgctl));
+	if (gotgctl.b.bsesvld) {
+		/* Check if suspend state */
+		dsts.d32 =
+		    DWC_READ_REG32(&
+				   (GET_CORE_IF(pcd)->dev_if->
+				    dev_global_regs->dsts));
+		if (dsts.b.suspsts) {
+			dwc_otg_pcd_remote_wakeup(pcd, 1);
+		}
+	} else {
+		dwc_otg_pcd_initiate_srp(pcd);
+	}
+
+	return 0;
+
+}
+
+/**
+ * Start the SRP timer to detect when the SRP does not complete within
+ * 6 seconds.
+ *
+ * @param pcd the pcd structure.
+ */
+void dwc_otg_pcd_initiate_srp(dwc_otg_pcd_t * pcd)
+{
+	dwc_irqflags_t flags;
+	DWC_SPINLOCK_IRQSAVE(pcd->lock, &flags);
+	dwc_otg_initiate_srp(GET_CORE_IF(pcd));
+	DWC_SPINUNLOCK_IRQRESTORE(pcd->lock, flags);
+}
+
+int dwc_otg_pcd_get_frame_number(dwc_otg_pcd_t * pcd)
+{
+	return dwc_otg_get_frame_number(GET_CORE_IF(pcd));
+}
+
+int dwc_otg_pcd_is_lpm_enabled(dwc_otg_pcd_t * pcd)
+{
+	return GET_CORE_IF(pcd)->core_params->lpm_enable;
+}
+
+uint32_t get_b_hnp_enable(dwc_otg_pcd_t * pcd)
+{
+	return pcd->b_hnp_enable;
+}
+
+uint32_t get_a_hnp_support(dwc_otg_pcd_t * pcd)
+{
+	return pcd->a_hnp_support;
+}
+
+uint32_t get_a_alt_hnp_support(dwc_otg_pcd_t * pcd)
+{
+	return pcd->a_alt_hnp_support;
+}
+
+int dwc_otg_pcd_get_rmwkup_enable(dwc_otg_pcd_t * pcd)
+{
+	return pcd->remote_wakeup_enable;
+}
+
+#endif /* DWC_HOST_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_pcd.h b/drivers/usb/host/dwc_otg/dwc_otg_pcd.h
new file mode 100644
index 000000000000..a70ebd049d2c
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd.h
@@ -0,0 +1,273 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd.h $
+ * $Revision: #48 $
+ * $Date: 2012/08/10 $
+ * $Change: 2047372 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_HOST_ONLY
+#if !defined(__DWC_PCD_H__)
+#define __DWC_PCD_H__
+
+#include "dwc_otg_os_dep.h"
+#include "usb.h"
+#include "dwc_otg_cil.h"
+#include "dwc_otg_pcd_if.h"
+#include "dwc_otg_driver.h"
+
+struct cfiobject;
+
+/**
+ * @file
+ *
+ * This file contains the structures, constants, and interfaces for
+ * the Perpherial Contoller Driver (PCD).
+ *
+ * The Peripheral Controller Driver (PCD) for Linux will implement the
+ * Gadget API, so that the existing Gadget drivers can be used. For
+ * the Mass Storage Function driver the File-backed USB Storage Gadget
+ * (FBS) driver will be used.  The FBS driver supports the
+ * Control-Bulk (CB), Control-Bulk-Interrupt (CBI), and Bulk-Only
+ * transports.
+ *
+ */
+
+/** Invalid DMA Address */
+#define DWC_DMA_ADDR_INVALID	(~(dwc_dma_t)0)
+
+/** Max Transfer size for any EP */
+#define DDMA_MAX_TRANSFER_SIZE 65535
+
+/**
+ * Get the pointer to the core_if from the pcd pointer.
+ */
+#define GET_CORE_IF( _pcd ) (_pcd->core_if)
+
+/**
+ * States of EP0.
+ */
+typedef enum ep0_state {
+	EP0_DISCONNECT,		/* no host */
+	EP0_IDLE,
+	EP0_IN_DATA_PHASE,
+	EP0_OUT_DATA_PHASE,
+	EP0_IN_STATUS_PHASE,
+	EP0_OUT_STATUS_PHASE,
+	EP0_STALL,
+} ep0state_e;
+
+/** Fordward declaration.*/
+struct dwc_otg_pcd;
+
+/** DWC_otg iso request structure.
+ *
+ */
+typedef struct usb_iso_request dwc_otg_pcd_iso_request_t;
+
+#ifdef DWC_UTE_PER_IO
+
+/**
+ * This shall be the exact analogy of the same type structure defined in the
+ * usb_gadget.h. Each descriptor contains
+ */
+struct dwc_iso_pkt_desc_port {
+	uint32_t offset;
+	uint32_t length;	/* expected length */
+	uint32_t actual_length;
+	uint32_t status;
+};
+
+struct dwc_iso_xreq_port {
+	/** transfer/submission flag */
+	uint32_t tr_sub_flags;
+	/** Start the request ASAP */
+#define DWC_EREQ_TF_ASAP		0x00000002
+	/** Just enqueue the request w/o initiating a transfer */
+#define DWC_EREQ_TF_ENQUEUE		0x00000004
+
+	/**
+	* count of ISO packets attached to this request - shall
+	* not exceed the pio_alloc_pkt_count
+	*/
+	uint32_t pio_pkt_count;
+	/** count of ISO packets allocated for this request */
+	uint32_t pio_alloc_pkt_count;
+	/** number of ISO packet errors */
+	uint32_t error_count;
+	/** reserved for future extension */
+	uint32_t res;
+	/** Will be allocated and freed in the UTE gadget and based on the CFC value */
+	struct dwc_iso_pkt_desc_port *per_io_frame_descs;
+};
+#endif
+/** DWC_otg request structure.
+ * This structure is a list of requests.
+ */
+typedef struct dwc_otg_pcd_request {
+	void *priv;
+	void *buf;
+	dwc_dma_t dma;
+	uint32_t length;
+	uint32_t actual;
+	unsigned sent_zlp:1;
+    /**
+     * Used instead of original buffer if
+     * it(physical address) is not dword-aligned.
+     **/
+     uint8_t *dw_align_buf;
+     dwc_dma_t dw_align_buf_dma;
+
+	 DWC_CIRCLEQ_ENTRY(dwc_otg_pcd_request) queue_entry;
+#ifdef DWC_UTE_PER_IO
+	struct dwc_iso_xreq_port ext_req;
+	//void *priv_ereq_nport; /*  */
+#endif
+} dwc_otg_pcd_request_t;
+
+DWC_CIRCLEQ_HEAD(req_list, dwc_otg_pcd_request);
+
+/**	  PCD EP structure.
+ * This structure describes an EP, there is an array of EPs in the PCD
+ * structure.
+ */
+typedef struct dwc_otg_pcd_ep {
+	/** USB EP Descriptor */
+	const usb_endpoint_descriptor_t *desc;
+
+	/** queue of dwc_otg_pcd_requests. */
+	struct req_list queue;
+	unsigned stopped:1;
+	unsigned disabling:1;
+	unsigned dma:1;
+	unsigned queue_sof:1;
+
+#ifdef DWC_EN_ISOC
+	/** ISOC req handle passed */
+	void *iso_req_handle;
+#endif				//_EN_ISOC_
+
+	/** DWC_otg ep data. */
+	dwc_ep_t dwc_ep;
+
+	/** Pointer to PCD */
+	struct dwc_otg_pcd *pcd;
+
+	void *priv;
+} dwc_otg_pcd_ep_t;
+
+/** DWC_otg PCD Structure.
+ * This structure encapsulates the data for the dwc_otg PCD.
+ */
+struct dwc_otg_pcd {
+	const struct dwc_otg_pcd_function_ops *fops;
+	/** The DWC otg device pointer */
+	struct dwc_otg_device *otg_dev;
+	/** Core Interface */
+	dwc_otg_core_if_t *core_if;
+	/** State of EP0 */
+	ep0state_e ep0state;
+	/** EP0 Request is pending */
+	unsigned ep0_pending:1;
+	/** Indicates when SET CONFIGURATION Request is in process */
+	unsigned request_config:1;
+	/** The state of the Remote Wakeup Enable. */
+	unsigned remote_wakeup_enable:1;
+	/** The state of the B-Device HNP Enable. */
+	unsigned b_hnp_enable:1;
+	/** The state of A-Device HNP Support. */
+	unsigned a_hnp_support:1;
+	/** The state of the A-Device Alt HNP support. */
+	unsigned a_alt_hnp_support:1;
+	/** Count of pending Requests */
+	unsigned request_pending;
+
+	/** SETUP packet for EP0
+	 * This structure is allocated as a DMA buffer on PCD initialization
+	 * with enough space for up to 3 setup packets.
+	 */
+	union {
+		usb_device_request_t req;
+		uint32_t d32[2];
+	} *setup_pkt;
+
+	dwc_dma_t setup_pkt_dma_handle;
+
+	/* Additional buffer and flag for CTRL_WR premature case */
+	uint8_t *backup_buf;
+	unsigned data_terminated;
+
+	/** 2-byte dma buffer used to return status from GET_STATUS */
+	uint16_t *status_buf;
+	dwc_dma_t status_buf_dma_handle;
+
+	/** EP0 */
+	dwc_otg_pcd_ep_t ep0;
+
+	/** Array of IN EPs. */
+	dwc_otg_pcd_ep_t in_ep[MAX_EPS_CHANNELS - 1];
+	/** Array of OUT EPs. */
+	dwc_otg_pcd_ep_t out_ep[MAX_EPS_CHANNELS - 1];
+	/** number of valid EPs in the above array. */
+//        unsigned      num_eps : 4;
+	dwc_spinlock_t *lock;
+
+	/** Tasklet to defer starting of TEST mode transmissions until
+	 *	Status Phase has been completed.
+	 */
+	dwc_tasklet_t *test_mode_tasklet;
+
+	/** Tasklet to delay starting of xfer in DMA mode */
+	dwc_tasklet_t *start_xfer_tasklet;
+
+	/** The test mode to enter when the tasklet is executed. */
+	unsigned test_mode;
+	/** The cfi_api structure that implements most of the CFI API
+	 * and OTG specific core configuration functionality
+	 */
+#ifdef DWC_UTE_CFI
+	struct cfiobject *cfi;
+#endif
+
+};
+
+static inline struct device *dwc_otg_pcd_to_dev(struct dwc_otg_pcd *pcd)
+{
+	return &pcd->otg_dev->os_dep.platformdev->dev;
+}
+
+//FIXME this functions should be static, and this prototypes should be removed
+extern void dwc_otg_request_nuke(dwc_otg_pcd_ep_t * ep);
+extern void dwc_otg_request_done(dwc_otg_pcd_ep_t * ep,
+				 dwc_otg_pcd_request_t * req, int32_t status);
+
+void dwc_otg_iso_buffer_done(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * ep,
+			     void *req_handle);
+
+extern void do_test_mode(void *data);
+#endif
+#endif /* DWC_HOST_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_pcd_if.h b/drivers/usb/host/dwc_otg/dwc_otg_pcd_if.h
new file mode 100644
index 000000000000..4c1d591fbc09
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd_if.h
@@ -0,0 +1,361 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd_if.h $
+ * $Revision: #11 $
+ * $Date: 2011/10/26 $
+ * $Change: 1873028 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_HOST_ONLY
+
+#if !defined(__DWC_PCD_IF_H__)
+#define __DWC_PCD_IF_H__
+
+//#include "dwc_os.h"
+#include "dwc_otg_core_if.h"
+#include "dwc_otg_driver.h"
+
+/** @file
+ * This file defines DWC_OTG PCD Core API.
+ */
+
+struct dwc_otg_pcd;
+typedef struct dwc_otg_pcd dwc_otg_pcd_t;
+
+/** Maxpacket size for EP0 */
+#define MAX_EP0_SIZE	64
+/** Maxpacket size for any EP */
+#define MAX_PACKET_SIZE 1024
+
+/** @name Function Driver Callbacks */
+/** @{ */
+
+/** This function will be called whenever a previously queued request has
+ * completed.  The status value will be set to -DWC_E_SHUTDOWN to indicated a
+ * failed or aborted transfer, or -DWC_E_RESTART to indicate the device was reset,
+ * or -DWC_E_TIMEOUT to indicate it timed out, or -DWC_E_INVALID to indicate invalid
+ * parameters. */
+typedef int (*dwc_completion_cb_t) (dwc_otg_pcd_t * pcd, void *ep_handle,
+				    void *req_handle, int32_t status,
+				    uint32_t actual);
+/**
+ * This function will be called whenever a previousle queued ISOC request has
+ * completed. Count of ISOC packets could be read using dwc_otg_pcd_get_iso_packet_count
+ * function.
+ * The status of each ISOC packet could be read using dwc_otg_pcd_get_iso_packet_*
+ * functions.
+ */
+typedef int (*dwc_isoc_completion_cb_t) (dwc_otg_pcd_t * pcd, void *ep_handle,
+					 void *req_handle, int proc_buf_num);
+/** This function should handle any SETUP request that cannot be handled by the
+ * PCD Core.  This includes most GET_DESCRIPTORs, SET_CONFIGS, Any
+ * class-specific requests, etc.  The function must non-blocking.
+ *
+ * Returns 0 on success.
+ * Returns -DWC_E_NOT_SUPPORTED if the request is not supported.
+ * Returns -DWC_E_INVALID if the setup request had invalid parameters or bytes.
+ * Returns -DWC_E_SHUTDOWN on any other error. */
+typedef int (*dwc_setup_cb_t) (dwc_otg_pcd_t * pcd, uint8_t * bytes);
+/** This is called whenever the device has been disconnected.  The function
+ * driver should take appropriate action to clean up all pending requests in the
+ * PCD Core, remove all endpoints (except ep0), and initialize back to reset
+ * state. */
+typedef int (*dwc_disconnect_cb_t) (dwc_otg_pcd_t * pcd);
+/** This function is called when device has been connected. */
+typedef int (*dwc_connect_cb_t) (dwc_otg_pcd_t * pcd, int speed);
+/** This function is called when device has been suspended */
+typedef int (*dwc_suspend_cb_t) (dwc_otg_pcd_t * pcd);
+/** This function is called when device has received LPM tokens, i.e.
+ * device has been sent to sleep state. */
+typedef int (*dwc_sleep_cb_t) (dwc_otg_pcd_t * pcd);
+/** This function is called when device has been resumed
+ * from suspend(L2) or L1 sleep state. */
+typedef int (*dwc_resume_cb_t) (dwc_otg_pcd_t * pcd);
+/** This function is called whenever hnp params has been changed.
+ * User can call get_b_hnp_enable, get_a_hnp_support, get_a_alt_hnp_support functions
+ * to get hnp parameters. */
+typedef int (*dwc_hnp_params_changed_cb_t) (dwc_otg_pcd_t * pcd);
+/** This function is called whenever USB RESET is detected. */
+typedef int (*dwc_reset_cb_t) (dwc_otg_pcd_t * pcd);
+
+typedef int (*cfi_setup_cb_t) (dwc_otg_pcd_t * pcd, void *ctrl_req_bytes);
+
+/**
+ *
+ * @param ep_handle	Void pointer to the usb_ep structure
+ * @param ereq_port Pointer to the extended request structure created in the
+ *					portable part.
+ */
+typedef int (*xiso_completion_cb_t) (dwc_otg_pcd_t * pcd, void *ep_handle,
+				     void *req_handle, int32_t status,
+				     void *ereq_port);
+/** Function Driver Ops Data Structure */
+struct dwc_otg_pcd_function_ops {
+	dwc_connect_cb_t connect;
+	dwc_disconnect_cb_t disconnect;
+	dwc_setup_cb_t setup;
+	dwc_completion_cb_t complete;
+	dwc_isoc_completion_cb_t isoc_complete;
+	dwc_suspend_cb_t suspend;
+	dwc_sleep_cb_t sleep;
+	dwc_resume_cb_t resume;
+	dwc_reset_cb_t reset;
+	dwc_hnp_params_changed_cb_t hnp_changed;
+	cfi_setup_cb_t cfi_setup;
+#ifdef DWC_UTE_PER_IO
+	xiso_completion_cb_t xisoc_complete;
+#endif
+};
+/** @} */
+
+/** @name Function Driver Functions */
+/** @{ */
+
+/** Call this function to get pointer on dwc_otg_pcd_t,
+ * this pointer will be used for all PCD API functions.
+ *
+ * @param core_if The DWC_OTG Core
+ */
+extern dwc_otg_pcd_t *dwc_otg_pcd_init(dwc_otg_device_t *otg_dev);
+
+/** Frees PCD allocated by dwc_otg_pcd_init
+ *
+ * @param pcd The PCD
+ */
+extern void dwc_otg_pcd_remove(dwc_otg_pcd_t * pcd);
+
+/** Call this to bind the function driver to the PCD Core.
+ *
+ * @param pcd Pointer on dwc_otg_pcd_t returned by dwc_otg_pcd_init function.
+ * @param fops The Function Driver Ops data structure containing pointers to all callbacks.
+ */
+extern void dwc_otg_pcd_start(dwc_otg_pcd_t * pcd,
+			      const struct dwc_otg_pcd_function_ops *fops);
+
+/** Enables an endpoint for use.  This function enables an endpoint in
+ * the PCD.  The endpoint is described by the ep_desc which has the
+ * same format as a USB ep descriptor.  The ep_handle parameter is used to refer
+ * to the endpoint from other API functions and in callbacks.  Normally this
+ * should be called after a SET_CONFIGURATION/SET_INTERFACE to configure the
+ * core for that interface.
+ *
+ * Returns -DWC_E_INVALID if invalid parameters were passed.
+ * Returns -DWC_E_SHUTDOWN if any other error ocurred.
+ * Returns 0 on success.
+ *
+ * @param pcd The PCD
+ * @param ep_desc Endpoint descriptor
+ * @param usb_ep Handle on endpoint, that will be used to identify endpoint.
+ */
+extern int dwc_otg_pcd_ep_enable(dwc_otg_pcd_t * pcd,
+				 const uint8_t * ep_desc, void *usb_ep);
+
+/** Disable the endpoint referenced by ep_handle.
+ *
+ * Returns -DWC_E_INVALID if invalid parameters were passed.
+ * Returns -DWC_E_SHUTDOWN if any other error occurred.
+ * Returns 0 on success. */
+extern int dwc_otg_pcd_ep_disable(dwc_otg_pcd_t * pcd, void *ep_handle);
+
+/** Queue a data transfer request on the endpoint referenced by ep_handle.
+ * After the transfer is completes, the complete callback will be called with
+ * the request status.
+ *
+ * @param pcd The PCD
+ * @param ep_handle The handle of the endpoint
+ * @param buf The buffer for the data
+ * @param dma_buf The DMA buffer for the data
+ * @param buflen The length of the data transfer
+ * @param zero Specifies whether to send zero length last packet.
+ * @param req_handle Set this handle to any value to use to reference this
+ * request in the ep_dequeue function or from the complete callback
+ * @param atomic_alloc If driver need to perform atomic allocations
+ * for internal data structures.
+ *
+ * Returns -DWC_E_INVALID if invalid parameters were passed.
+ * Returns -DWC_E_SHUTDOWN if any other error ocurred.
+ * Returns 0 on success. */
+extern int dwc_otg_pcd_ep_queue(dwc_otg_pcd_t * pcd, void *ep_handle,
+				uint8_t * buf, dwc_dma_t dma_buf,
+				uint32_t buflen, int zero, void *req_handle,
+				int atomic_alloc);
+#ifdef DWC_UTE_PER_IO
+/**
+ *
+ * @param ereq_nonport	Pointer to the extended request part of the
+ *						usb_request structure defined in usb_gadget.h file.
+ */
+extern int dwc_otg_pcd_xiso_ep_queue(dwc_otg_pcd_t * pcd, void *ep_handle,
+				     uint8_t * buf, dwc_dma_t dma_buf,
+				     uint32_t buflen, int zero,
+				     void *req_handle, int atomic_alloc,
+				     void *ereq_nonport);
+
+#endif
+
+/** De-queue the specified data transfer that has not yet completed.
+ *
+ * Returns -DWC_E_INVALID if invalid parameters were passed.
+ * Returns -DWC_E_SHUTDOWN if any other error ocurred.
+ * Returns 0 on success. */
+extern int dwc_otg_pcd_ep_dequeue(dwc_otg_pcd_t * pcd, void *ep_handle,
+				  void *req_handle);
+
+/** Halt (STALL) an endpoint or clear it.
+ *
+ * Returns -DWC_E_INVALID if invalid parameters were passed.
+ * Returns -DWC_E_SHUTDOWN if any other error ocurred.
+ * Returns -DWC_E_AGAIN if the STALL cannot be sent and must be tried again later
+ * Returns 0 on success. */
+extern int dwc_otg_pcd_ep_halt(dwc_otg_pcd_t * pcd, void *ep_handle, int value);
+
+/** This function */
+extern int dwc_otg_pcd_ep_wedge(dwc_otg_pcd_t * pcd, void *ep_handle);
+
+/** This function should be called on every hardware interrupt */
+extern int32_t dwc_otg_pcd_handle_intr(dwc_otg_pcd_t * pcd);
+
+/** This function returns current frame number */
+extern int dwc_otg_pcd_get_frame_number(dwc_otg_pcd_t * pcd);
+
+/**
+ * Start isochronous transfers on the endpoint referenced by ep_handle.
+ * For isochronous transfers duble buffering is used.
+ * After processing each of buffers comlete callback will be called with
+ * status for each transaction.
+ *
+ * @param pcd The PCD
+ * @param ep_handle The handle of the endpoint
+ * @param buf0 The virtual address of first data buffer
+ * @param buf1 The virtual address of second data buffer
+ * @param dma0 The DMA address of first data buffer
+ * @param dma1 The DMA address of second data buffer
+ * @param sync_frame Data pattern frame number
+ * @param dp_frame Data size for pattern frame
+ * @param data_per_frame Data size for regular frame
+ * @param start_frame Frame number to start transfers, if -1 then start transfers ASAP.
+ * @param buf_proc_intrvl Interval of ISOC Buffer processing
+ * @param req_handle Handle of ISOC request
+ * @param atomic_alloc Specefies whether to perform atomic allocation for
+ * 			internal data structures.
+ *
+ * Returns -DWC_E_NO_MEMORY if there is no enough memory.
+ * Returns -DWC_E_INVALID if incorrect arguments are passed to the function.
+ * Returns -DW_E_SHUTDOWN for any other error.
+ * Returns 0 on success
+ */
+extern int dwc_otg_pcd_iso_ep_start(dwc_otg_pcd_t * pcd, void *ep_handle,
+				    uint8_t * buf0, uint8_t * buf1,
+				    dwc_dma_t dma0, dwc_dma_t dma1,
+				    int sync_frame, int dp_frame,
+				    int data_per_frame, int start_frame,
+				    int buf_proc_intrvl, void *req_handle,
+				    int atomic_alloc);
+
+/** Stop ISOC transfers on endpoint referenced by ep_handle.
+ *
+ * @param pcd The PCD
+ * @param ep_handle The handle of the endpoint
+ * @param req_handle Handle of ISOC request
+ *
+ * Returns -DWC_E_INVALID if incorrect arguments are passed to the function
+ * Returns 0 on success
+ */
+int dwc_otg_pcd_iso_ep_stop(dwc_otg_pcd_t * pcd, void *ep_handle,
+			    void *req_handle);
+
+/** Get ISOC packet status.
+ *
+ * @param pcd The PCD
+ * @param ep_handle The handle of the endpoint
+ * @param iso_req_handle Isochronoush request handle
+ * @param packet Number of packet
+ * @param status Out parameter for returning status
+ * @param actual Out parameter for returning actual length
+ * @param offset Out parameter for returning offset
+ *
+ */
+extern void dwc_otg_pcd_get_iso_packet_params(dwc_otg_pcd_t * pcd,
+					      void *ep_handle,
+					      void *iso_req_handle, int packet,
+					      int *status, int *actual,
+					      int *offset);
+
+/** Get ISOC packet count.
+ *
+ * @param pcd The PCD
+ * @param ep_handle The handle of the endpoint
+ * @param iso_req_handle
+ */
+extern int dwc_otg_pcd_get_iso_packet_count(dwc_otg_pcd_t * pcd,
+					    void *ep_handle,
+					    void *iso_req_handle);
+
+/** This function starts the SRP Protocol if no session is in progress. If
+ * a session is already in progress, but the device is suspended,
+ * remote wakeup signaling is started.
+ */
+extern int dwc_otg_pcd_wakeup(dwc_otg_pcd_t * pcd);
+
+/** This function returns 1 if LPM support is enabled, and 0 otherwise. */
+extern int dwc_otg_pcd_is_lpm_enabled(dwc_otg_pcd_t * pcd);
+
+/** This function returns 1 if remote wakeup is allowed and 0, otherwise. */
+extern int dwc_otg_pcd_get_rmwkup_enable(dwc_otg_pcd_t * pcd);
+
+/** Initiate SRP */
+extern void dwc_otg_pcd_initiate_srp(dwc_otg_pcd_t * pcd);
+
+/** Starts remote wakeup signaling. */
+extern void dwc_otg_pcd_remote_wakeup(dwc_otg_pcd_t * pcd, int set);
+
+/** Starts micorsecond soft disconnect. */
+extern void dwc_otg_pcd_disconnect_us(dwc_otg_pcd_t * pcd, int no_of_usecs);
+/** This function returns whether device is dualspeed.*/
+extern uint32_t dwc_otg_pcd_is_dualspeed(dwc_otg_pcd_t * pcd);
+
+/** This function returns whether device is otg. */
+extern uint32_t dwc_otg_pcd_is_otg(dwc_otg_pcd_t * pcd);
+
+/** These functions allow to get hnp parameters */
+extern uint32_t get_b_hnp_enable(dwc_otg_pcd_t * pcd);
+extern uint32_t get_a_hnp_support(dwc_otg_pcd_t * pcd);
+extern uint32_t get_a_alt_hnp_support(dwc_otg_pcd_t * pcd);
+
+/** CFI specific Interface functions */
+/** Allocate a cfi buffer */
+extern uint8_t *cfiw_ep_alloc_buffer(dwc_otg_pcd_t * pcd, void *pep,
+				     dwc_dma_t * addr, size_t buflen,
+				     int flags);
+
+/******************************************************************************/
+
+/** @} */
+
+#endif				/* __DWC_PCD_IF_H__ */
+
+#endif				/* DWC_HOST_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_pcd_intr.c b/drivers/usb/host/dwc_otg/dwc_otg_pcd_intr.c
new file mode 100644
index 000000000000..e55ea9c74be4
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd_intr.c
@@ -0,0 +1,5148 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd_intr.c $
+ * $Revision: #116 $
+ * $Date: 2012/08/10 $
+ * $Change: 2047372 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+#ifndef DWC_HOST_ONLY
+
+#include "dwc_otg_pcd.h"
+
+#ifdef DWC_UTE_CFI
+#include "dwc_otg_cfi.h"
+#endif
+
+#ifdef DWC_UTE_PER_IO
+extern void complete_xiso_ep(dwc_otg_pcd_ep_t * ep);
+#endif
+//#define PRINT_CFI_DMA_DESCS
+
+#define DEBUG_EP0
+
+/**
+ * This function updates OTG.
+ */
+static void dwc_otg_pcd_update_otg(dwc_otg_pcd_t * pcd, const unsigned reset)
+{
+
+	if (reset) {
+		pcd->b_hnp_enable = 0;
+		pcd->a_hnp_support = 0;
+		pcd->a_alt_hnp_support = 0;
+	}
+
+	if (pcd->fops->hnp_changed) {
+		pcd->fops->hnp_changed(pcd);
+	}
+}
+
+/** @file
+ * This file contains the implementation of the PCD Interrupt handlers.
+ *
+ * The PCD handles the device interrupts.  Many conditions can cause a
+ * device interrupt. When an interrupt occurs, the device interrupt
+ * service routine determines the cause of the interrupt and
+ * dispatches handling to the appropriate function. These interrupt
+ * handling functions are described below.
+ * All interrupt registers are processed from LSB to MSB.
+ */
+
+/**
+ * This function prints the ep0 state for debug purposes.
+ */
+static inline void print_ep0_state(dwc_otg_pcd_t * pcd)
+{
+#ifdef DEBUG
+	char str[40];
+
+	switch (pcd->ep0state) {
+	case EP0_DISCONNECT:
+		dwc_strcpy(str, "EP0_DISCONNECT");
+		break;
+	case EP0_IDLE:
+		dwc_strcpy(str, "EP0_IDLE");
+		break;
+	case EP0_IN_DATA_PHASE:
+		dwc_strcpy(str, "EP0_IN_DATA_PHASE");
+		break;
+	case EP0_OUT_DATA_PHASE:
+		dwc_strcpy(str, "EP0_OUT_DATA_PHASE");
+		break;
+	case EP0_IN_STATUS_PHASE:
+		dwc_strcpy(str, "EP0_IN_STATUS_PHASE");
+		break;
+	case EP0_OUT_STATUS_PHASE:
+		dwc_strcpy(str, "EP0_OUT_STATUS_PHASE");
+		break;
+	case EP0_STALL:
+		dwc_strcpy(str, "EP0_STALL");
+		break;
+	default:
+		dwc_strcpy(str, "EP0_INVALID");
+	}
+
+	DWC_DEBUGPL(DBG_ANY, "%s(%d)\n", str, pcd->ep0state);
+#endif
+}
+
+/**
+ * This function calculate the size of the payload in the memory
+ * for out endpoints and prints size for debug purposes(used in
+ * 2.93a DevOutNak feature).
+ */
+static inline void print_memory_payload(dwc_otg_pcd_t * pcd,  dwc_ep_t * ep)
+{
+#ifdef DEBUG
+	deptsiz_data_t deptsiz_init = {.d32 = 0 };
+	deptsiz_data_t deptsiz_updt = {.d32 = 0 };
+	int pack_num;
+	unsigned payload;
+
+	deptsiz_init.d32 = pcd->core_if->start_doeptsiz_val[ep->num];
+	deptsiz_updt.d32 =
+		DWC_READ_REG32(&pcd->core_if->dev_if->
+						out_ep_regs[ep->num]->doeptsiz);
+	/* Payload will be */
+	payload = deptsiz_init.b.xfersize - deptsiz_updt.b.xfersize;
+	/* Packet count is decremented every time a packet
+	 * is written to the RxFIFO not in to the external memory
+	 * So, if payload == 0, then it means no packet was sent to ext memory*/
+	pack_num = (!payload) ? 0 : (deptsiz_init.b.pktcnt - deptsiz_updt.b.pktcnt);
+	DWC_DEBUGPL(DBG_PCDV,
+		"Payload for EP%d-%s\n",
+		ep->num, (ep->is_in ? "IN" : "OUT"));
+	DWC_DEBUGPL(DBG_PCDV,
+		"Number of transfered bytes = 0x%08x\n", payload);
+	DWC_DEBUGPL(DBG_PCDV,
+		"Number of transfered packets = %d\n", pack_num);
+#endif
+}
+
+
+#ifdef DWC_UTE_CFI
+static inline void print_desc(struct dwc_otg_dma_desc *ddesc,
+			      const uint8_t * epname, int descnum)
+{
+	CFI_INFO
+	    ("%s DMA_DESC(%d) buf=0x%08x bytes=0x%04x; sp=0x%x; l=0x%x; sts=0x%02x; bs=0x%02x\n",
+	     epname, descnum, ddesc->buf, ddesc->status.b.bytes,
+	     ddesc->status.b.sp, ddesc->status.b.l, ddesc->status.b.sts,
+	     ddesc->status.b.bs);
+}
+#endif
+
+/**
+ * This function returns pointer to in ep struct with number ep_num
+ */
+static inline dwc_otg_pcd_ep_t *get_in_ep(dwc_otg_pcd_t * pcd, uint32_t ep_num)
+{
+	int i;
+	int num_in_eps = GET_CORE_IF(pcd)->dev_if->num_in_eps;
+	if (ep_num == 0) {
+		return &pcd->ep0;
+	} else {
+		for (i = 0; i < num_in_eps; ++i) {
+			if (pcd->in_ep[i].dwc_ep.num == ep_num)
+				return &pcd->in_ep[i];
+		}
+		return 0;
+	}
+}
+
+/**
+ * This function returns pointer to out ep struct with number ep_num
+ */
+static inline dwc_otg_pcd_ep_t *get_out_ep(dwc_otg_pcd_t * pcd, uint32_t ep_num)
+{
+	int i;
+	int num_out_eps = GET_CORE_IF(pcd)->dev_if->num_out_eps;
+	if (ep_num == 0) {
+		return &pcd->ep0;
+	} else {
+		for (i = 0; i < num_out_eps; ++i) {
+			if (pcd->out_ep[i].dwc_ep.num == ep_num)
+				return &pcd->out_ep[i];
+		}
+		return 0;
+	}
+}
+
+/**
+ * This functions gets a pointer to an EP from the wIndex address
+ * value of the control request.
+ */
+dwc_otg_pcd_ep_t *get_ep_by_addr(dwc_otg_pcd_t * pcd, u16 wIndex)
+{
+	dwc_otg_pcd_ep_t *ep;
+	uint32_t ep_num = UE_GET_ADDR(wIndex);
+
+	if (ep_num == 0) {
+		ep = &pcd->ep0;
+	} else if (UE_GET_DIR(wIndex) == UE_DIR_IN) {	/* in ep */
+		ep = &pcd->in_ep[ep_num - 1];
+	} else {
+		ep = &pcd->out_ep[ep_num - 1];
+	}
+
+	return ep;
+}
+
+/**
+ * This function checks the EP request queue, if the queue is not
+ * empty the next request is started.
+ */
+void start_next_request(dwc_otg_pcd_ep_t * ep)
+{
+	dwc_otg_pcd_request_t *req = 0;
+	uint32_t max_transfer =
+	    GET_CORE_IF(ep->pcd)->core_params->max_transfer_size;
+
+#ifdef DWC_UTE_CFI
+	struct dwc_otg_pcd *pcd;
+	pcd = ep->pcd;
+#endif
+
+	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+		req = DWC_CIRCLEQ_FIRST(&ep->queue);
+
+#ifdef DWC_UTE_CFI
+		if (ep->dwc_ep.buff_mode != BM_STANDARD) {
+			ep->dwc_ep.cfi_req_len = req->length;
+			pcd->cfi->ops.build_descriptors(pcd->cfi, pcd, ep, req);
+		} else {
+#endif
+			/* Setup and start the Transfer */
+			if (req->dw_align_buf) {
+				ep->dwc_ep.dma_addr = req->dw_align_buf_dma;
+				ep->dwc_ep.start_xfer_buff = req->dw_align_buf;
+				ep->dwc_ep.xfer_buff = req->dw_align_buf;
+			} else {
+				ep->dwc_ep.dma_addr = req->dma;
+				ep->dwc_ep.start_xfer_buff = req->buf;
+				ep->dwc_ep.xfer_buff = req->buf;
+			}
+			ep->dwc_ep.sent_zlp = 0;
+			ep->dwc_ep.total_len = req->length;
+			ep->dwc_ep.xfer_len = 0;
+			ep->dwc_ep.xfer_count = 0;
+
+			ep->dwc_ep.maxxfer = max_transfer;
+			if (GET_CORE_IF(ep->pcd)->dma_desc_enable) {
+				uint32_t out_max_xfer = DDMA_MAX_TRANSFER_SIZE
+				    - (DDMA_MAX_TRANSFER_SIZE % 4);
+				if (ep->dwc_ep.is_in) {
+					if (ep->dwc_ep.maxxfer >
+					    DDMA_MAX_TRANSFER_SIZE) {
+						ep->dwc_ep.maxxfer =
+						    DDMA_MAX_TRANSFER_SIZE;
+					}
+				} else {
+					if (ep->dwc_ep.maxxfer > out_max_xfer) {
+						ep->dwc_ep.maxxfer =
+						    out_max_xfer;
+					}
+				}
+			}
+			if (ep->dwc_ep.maxxfer < ep->dwc_ep.total_len) {
+				ep->dwc_ep.maxxfer -=
+				    (ep->dwc_ep.maxxfer % ep->dwc_ep.maxpacket);
+			}
+			if (req->sent_zlp) {
+				if ((ep->dwc_ep.total_len %
+				     ep->dwc_ep.maxpacket == 0)
+				    && (ep->dwc_ep.total_len != 0)) {
+					ep->dwc_ep.sent_zlp = 1;
+				}
+
+			}
+#ifdef DWC_UTE_CFI
+		}
+#endif
+		dwc_otg_ep_start_transfer(GET_CORE_IF(ep->pcd), &ep->dwc_ep);
+	} else if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
+		DWC_PRINTF("There are no more ISOC requests \n");
+		ep->dwc_ep.frame_num = 0xFFFFFFFF;
+	}
+}
+
+/**
+ * This function handles the SOF Interrupts. At this time the SOF
+ * Interrupt is disabled.
+ */
+int32_t dwc_otg_pcd_handle_sof_intr(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+
+	gintsts_data_t gintsts;
+
+	DWC_DEBUGPL(DBG_PCD, "SOF\n");
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.sofintr = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * This function handles the Rx Status Queue Level Interrupt, which
+ * indicates that there is a least one packet in the Rx FIFO.  The
+ * packets are moved from the FIFO to memory, where they will be
+ * processed when the Endpoint Interrupt Register indicates Transfer
+ * Complete or SETUP Phase Done.
+ *
+ * Repeat the following until the Rx Status Queue is empty:
+ *	 -# Read the Receive Status Pop Register (GRXSTSP) to get Packet
+ *		info
+ *	 -# If Receive FIFO is empty then skip to step Clear the interrupt
+ *		and exit
+ *	 -# If SETUP Packet call dwc_otg_read_setup_packet to copy the
+ *		SETUP data to the buffer
+ *	 -# If OUT Data Packet call dwc_otg_read_packet to copy the data
+ *		to the destination buffer
+ */
+int32_t dwc_otg_pcd_handle_rx_status_q_level_intr(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	gintmsk_data_t gintmask = {.d32 = 0 };
+	device_grxsts_data_t status;
+	dwc_otg_pcd_ep_t *ep;
+	gintsts_data_t gintsts;
+#ifdef DEBUG
+	static char *dpid_str[] = { "D0", "D2", "D1", "MDATA" };
+#endif
+
+	//DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, _pcd);
+	/* Disable the Rx Status Queue Level interrupt */
+	gintmask.b.rxstsqlvl = 1;
+	DWC_MODIFY_REG32(&global_regs->gintmsk, gintmask.d32, 0);
+
+	/* Get the Status from the top of the FIFO */
+	status.d32 = DWC_READ_REG32(&global_regs->grxstsp);
+
+	DWC_DEBUGPL(DBG_PCD, "EP:%d BCnt:%d DPID:%s "
+		    "pktsts:%x Frame:%d(0x%0x)\n",
+		    status.b.epnum, status.b.bcnt,
+		    dpid_str[status.b.dpid],
+		    status.b.pktsts, status.b.fn, status.b.fn);
+	/* Get pointer to EP structure */
+	ep = get_out_ep(pcd, status.b.epnum);
+
+	switch (status.b.pktsts) {
+	case DWC_DSTS_GOUT_NAK:
+		DWC_DEBUGPL(DBG_PCDV, "Global OUT NAK\n");
+		break;
+	case DWC_STS_DATA_UPDT:
+		DWC_DEBUGPL(DBG_PCDV, "OUT Data Packet\n");
+		if (status.b.bcnt && ep->dwc_ep.xfer_buff) {
+			/** @todo NGS Check for buffer overflow? */
+			dwc_otg_read_packet(core_if,
+					    ep->dwc_ep.xfer_buff,
+					    status.b.bcnt);
+			ep->dwc_ep.xfer_count += status.b.bcnt;
+			ep->dwc_ep.xfer_buff += status.b.bcnt;
+		}
+		break;
+	case DWC_STS_XFER_COMP:
+		DWC_DEBUGPL(DBG_PCDV, "OUT Complete\n");
+		break;
+	case DWC_DSTS_SETUP_COMP:
+#ifdef DEBUG_EP0
+		DWC_DEBUGPL(DBG_PCDV, "Setup Complete\n");
+#endif
+		break;
+	case DWC_DSTS_SETUP_UPDT:
+		dwc_otg_read_setup_packet(core_if, pcd->setup_pkt->d32);
+#ifdef DEBUG_EP0
+		DWC_DEBUGPL(DBG_PCD,
+			    "SETUP PKT: %02x.%02x v%04x i%04x l%04x\n",
+			    pcd->setup_pkt->req.bmRequestType,
+			    pcd->setup_pkt->req.bRequest,
+			    UGETW(pcd->setup_pkt->req.wValue),
+			    UGETW(pcd->setup_pkt->req.wIndex),
+			    UGETW(pcd->setup_pkt->req.wLength));
+#endif
+		ep->dwc_ep.xfer_count += status.b.bcnt;
+		break;
+	default:
+		DWC_DEBUGPL(DBG_PCDV, "Invalid Packet Status (0x%0x)\n",
+			    status.b.pktsts);
+		break;
+	}
+
+	/* Enable the Rx Status Queue Level interrupt */
+	DWC_MODIFY_REG32(&global_regs->gintmsk, 0, gintmask.d32);
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.rxstsqlvl = 1;
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	//DWC_DEBUGPL(DBG_PCDV, "EXIT: %s\n", __func__);
+	return 1;
+}
+
+/**
+ * This function examines the Device IN Token Learning Queue to
+ * determine the EP number of the last IN token received.  This
+ * implementation is for the Mass Storage device where there are only
+ * 2 IN EPs (Control-IN and BULK-IN).
+ *
+ * The EP numbers for the first six IN Tokens are in DTKNQR1 and there
+ * are 8 EP Numbers in each of the other possible DTKNQ Registers.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ *
+ */
+static inline int get_ep_of_last_in_token(dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_device_global_regs_t *dev_global_regs =
+	    core_if->dev_if->dev_global_regs;
+	const uint32_t TOKEN_Q_DEPTH = core_if->hwcfg2.b.dev_token_q_depth;
+	/* Number of Token Queue Registers */
+	const int DTKNQ_REG_CNT = (TOKEN_Q_DEPTH + 7) / 8;
+	dtknq1_data_t dtknqr1;
+	uint32_t in_tkn_epnums[4];
+	int ndx = 0;
+	int i = 0;
+	volatile uint32_t *addr = &dev_global_regs->dtknqr1;
+	int epnum = 0;
+
+	//DWC_DEBUGPL(DBG_PCD,"dev_token_q_depth=%d\n",TOKEN_Q_DEPTH);
+
+	/* Read the DTKNQ Registers */
+	for (i = 0; i < DTKNQ_REG_CNT; i++) {
+		in_tkn_epnums[i] = DWC_READ_REG32(addr);
+		DWC_DEBUGPL(DBG_PCDV, "DTKNQR%d=0x%08x\n", i + 1,
+			    in_tkn_epnums[i]);
+		if (addr == &dev_global_regs->dvbusdis) {
+			addr = &dev_global_regs->dtknqr3_dthrctl;
+		} else {
+			++addr;
+		}
+
+	}
+
+	/* Copy the DTKNQR1 data to the bit field. */
+	dtknqr1.d32 = in_tkn_epnums[0];
+	/* Get the EP numbers */
+	in_tkn_epnums[0] = dtknqr1.b.epnums0_5;
+	ndx = dtknqr1.b.intknwptr - 1;
+
+	//DWC_DEBUGPL(DBG_PCDV,"ndx=%d\n",ndx);
+	if (ndx == -1) {
+		/** @todo Find a simpler way to calculate the max
+		 * queue position.*/
+		int cnt = TOKEN_Q_DEPTH;
+		if (TOKEN_Q_DEPTH <= 6) {
+			cnt = TOKEN_Q_DEPTH - 1;
+		} else if (TOKEN_Q_DEPTH <= 14) {
+			cnt = TOKEN_Q_DEPTH - 7;
+		} else if (TOKEN_Q_DEPTH <= 22) {
+			cnt = TOKEN_Q_DEPTH - 15;
+		} else {
+			cnt = TOKEN_Q_DEPTH - 23;
+		}
+		epnum = (in_tkn_epnums[DTKNQ_REG_CNT - 1] >> (cnt * 4)) & 0xF;
+	} else {
+		if (ndx <= 5) {
+			epnum = (in_tkn_epnums[0] >> (ndx * 4)) & 0xF;
+		} else if (ndx <= 13) {
+			ndx -= 6;
+			epnum = (in_tkn_epnums[1] >> (ndx * 4)) & 0xF;
+		} else if (ndx <= 21) {
+			ndx -= 14;
+			epnum = (in_tkn_epnums[2] >> (ndx * 4)) & 0xF;
+		} else if (ndx <= 29) {
+			ndx -= 22;
+			epnum = (in_tkn_epnums[3] >> (ndx * 4)) & 0xF;
+		}
+	}
+	//DWC_DEBUGPL(DBG_PCD,"epnum=%d\n",epnum);
+	return epnum;
+}
+
+/**
+ * This interrupt occurs when the non-periodic Tx FIFO is half-empty.
+ * The active request is checked for the next packet to be loaded into
+ * the non-periodic Tx FIFO.
+ */
+int32_t dwc_otg_pcd_handle_np_tx_fifo_empty_intr(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	dwc_otg_dev_in_ep_regs_t *ep_regs;
+	gnptxsts_data_t txstatus = {.d32 = 0 };
+	gintsts_data_t gintsts;
+
+	int epnum = 0;
+	dwc_otg_pcd_ep_t *ep = 0;
+	uint32_t len = 0;
+	int dwords;
+
+	/* Get the epnum from the IN Token Learning Queue. */
+	epnum = get_ep_of_last_in_token(core_if);
+	ep = get_in_ep(pcd, epnum);
+
+	DWC_DEBUGPL(DBG_PCD, "NP TxFifo Empty: %d \n", epnum);
+
+	ep_regs = core_if->dev_if->in_ep_regs[epnum];
+
+	len = ep->dwc_ep.xfer_len - ep->dwc_ep.xfer_count;
+	if (len > ep->dwc_ep.maxpacket) {
+		len = ep->dwc_ep.maxpacket;
+	}
+	dwords = (len + 3) / 4;
+
+	/* While there is space in the queue and space in the FIFO and
+	 * More data to tranfer, Write packets to the Tx FIFO */
+	txstatus.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
+	DWC_DEBUGPL(DBG_PCDV, "b4 GNPTXSTS=0x%08x\n", txstatus.d32);
+
+	while (txstatus.b.nptxqspcavail > 0 &&
+	       txstatus.b.nptxfspcavail > dwords &&
+	       ep->dwc_ep.xfer_count < ep->dwc_ep.xfer_len) {
+		/* Write the FIFO */
+		dwc_otg_ep_write_packet(core_if, &ep->dwc_ep, 0);
+		len = ep->dwc_ep.xfer_len - ep->dwc_ep.xfer_count;
+
+		if (len > ep->dwc_ep.maxpacket) {
+			len = ep->dwc_ep.maxpacket;
+		}
+
+		dwords = (len + 3) / 4;
+		txstatus.d32 = DWC_READ_REG32(&global_regs->gnptxsts);
+		DWC_DEBUGPL(DBG_PCDV, "GNPTXSTS=0x%08x\n", txstatus.d32);
+	}
+
+	DWC_DEBUGPL(DBG_PCDV, "GNPTXSTS=0x%08x\n",
+		    DWC_READ_REG32(&global_regs->gnptxsts));
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.nptxfempty = 1;
+	DWC_WRITE_REG32(&global_regs->gintsts, gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * This function is called when dedicated Tx FIFO Empty interrupt occurs.
+ * The active request is checked for the next packet to be loaded into
+ * apropriate Tx FIFO.
+ */
+static int32_t write_empty_tx_fifo(dwc_otg_pcd_t * pcd, uint32_t epnum)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	dwc_otg_dev_in_ep_regs_t *ep_regs;
+	dtxfsts_data_t txstatus = {.d32 = 0 };
+	dwc_otg_pcd_ep_t *ep = 0;
+	uint32_t len = 0;
+	int dwords;
+
+	ep = get_in_ep(pcd, epnum);
+
+	DWC_DEBUGPL(DBG_PCD, "Dedicated TxFifo Empty: %d \n", epnum);
+
+	ep_regs = core_if->dev_if->in_ep_regs[epnum];
+
+	len = ep->dwc_ep.xfer_len - ep->dwc_ep.xfer_count;
+
+	if (len > ep->dwc_ep.maxpacket) {
+		len = ep->dwc_ep.maxpacket;
+	}
+
+	dwords = (len + 3) / 4;
+
+	/* While there is space in the queue and space in the FIFO and
+	 * More data to tranfer, Write packets to the Tx FIFO */
+	txstatus.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts);
+	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", epnum, txstatus.d32);
+
+	while (txstatus.b.txfspcavail > dwords &&
+	       ep->dwc_ep.xfer_count < ep->dwc_ep.xfer_len &&
+	       ep->dwc_ep.xfer_len != 0) {
+		/* Write the FIFO */
+		dwc_otg_ep_write_packet(core_if, &ep->dwc_ep, 0);
+
+		len = ep->dwc_ep.xfer_len - ep->dwc_ep.xfer_count;
+		if (len > ep->dwc_ep.maxpacket) {
+			len = ep->dwc_ep.maxpacket;
+		}
+
+		dwords = (len + 3) / 4;
+		txstatus.d32 =
+		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts);
+		DWC_DEBUGPL(DBG_PCDV, "dtxfsts[%d]=0x%08x\n", epnum,
+			    txstatus.d32);
+	}
+
+	DWC_DEBUGPL(DBG_PCDV, "b4 dtxfsts[%d]=0x%08x\n", epnum,
+		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dtxfsts));
+
+	return 1;
+}
+
+/**
+ * This function is called when the Device is disconnected. It stops
+ * any active requests and informs the Gadget driver of the
+ * disconnect.
+ */
+void dwc_otg_pcd_stop(dwc_otg_pcd_t * pcd)
+{
+	int i, num_in_eps, num_out_eps;
+	dwc_otg_pcd_ep_t *ep;
+
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_SPINLOCK(pcd->lock);
+
+	num_in_eps = GET_CORE_IF(pcd)->dev_if->num_in_eps;
+	num_out_eps = GET_CORE_IF(pcd)->dev_if->num_out_eps;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s() \n", __func__);
+	/* don't disconnect drivers more than once */
+	if (pcd->ep0state == EP0_DISCONNECT) {
+		DWC_DEBUGPL(DBG_ANY, "%s() Already Disconnected\n", __func__);
+		DWC_SPINUNLOCK(pcd->lock);
+		return;
+	}
+	pcd->ep0state = EP0_DISCONNECT;
+
+	/* Reset the OTG state. */
+	dwc_otg_pcd_update_otg(pcd, 1);
+
+	/* Disable the NP Tx Fifo Empty Interrupt. */
+	intr_mask.b.nptxfempty = 1;
+	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
+			 intr_mask.d32, 0);
+
+	/* Flush the FIFOs */
+	/**@todo NGS Flush Periodic FIFOs */
+	dwc_otg_flush_tx_fifo(GET_CORE_IF(pcd), 0x10);
+	dwc_otg_flush_rx_fifo(GET_CORE_IF(pcd));
+
+	/* prevent new request submissions, kill any outstanding requests  */
+	ep = &pcd->ep0;
+	dwc_otg_request_nuke(ep);
+	/* prevent new request submissions, kill any outstanding requests  */
+	for (i = 0; i < num_in_eps; i++) {
+		dwc_otg_pcd_ep_t *ep = &pcd->in_ep[i];
+		dwc_otg_request_nuke(ep);
+	}
+	/* prevent new request submissions, kill any outstanding requests  */
+	for (i = 0; i < num_out_eps; i++) {
+		dwc_otg_pcd_ep_t *ep = &pcd->out_ep[i];
+		dwc_otg_request_nuke(ep);
+	}
+
+	/* report disconnect; the driver is already quiesced */
+	if (pcd->fops->disconnect) {
+		DWC_SPINUNLOCK(pcd->lock);
+		pcd->fops->disconnect(pcd);
+		DWC_SPINLOCK(pcd->lock);
+	}
+	DWC_SPINUNLOCK(pcd->lock);
+}
+
+/**
+ * This interrupt indicates that ...
+ */
+int32_t dwc_otg_pcd_handle_i2c_intr(dwc_otg_pcd_t * pcd)
+{
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	gintsts_data_t gintsts;
+
+	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n", "i2cintr");
+	intr_mask.b.i2cintr = 1;
+	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
+			 intr_mask.d32, 0);
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.i2cintr = 1;
+	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
+			gintsts.d32);
+	return 1;
+}
+
+/**
+ * This interrupt indicates that ...
+ */
+int32_t dwc_otg_pcd_handle_early_suspend_intr(dwc_otg_pcd_t * pcd)
+{
+	gintsts_data_t gintsts;
+#if defined(VERBOSE)
+	DWC_PRINTF("Early Suspend Detected\n");
+#endif
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.erlysuspend = 1;
+	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
+			gintsts.d32);
+	return 1;
+}
+
+/**
+ * This function configures EPO to receive SETUP packets.
+ *
+ * @todo NGS: Update the comments from the HW FS.
+ *
+ *	-# Program the following fields in the endpoint specific registers
+ *	for Control OUT EP 0, in order to receive a setup packet
+ *	- DOEPTSIZ0.Packet Count = 3 (To receive up to 3 back to back
+ *	  setup packets)
+ *	- DOEPTSIZE0.Transfer Size = 24 Bytes (To receive up to 3 back
+ *	  to back setup packets)
+ *		- In DMA mode, DOEPDMA0 Register with a memory address to
+ *		  store any setup packets received
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param pcd	  Programming view of the PCD.
+ */
+static inline void ep0_out_start(dwc_otg_core_if_t * core_if,
+				 dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	deptsiz0_data_t doeptsize0 = {.d32 = 0 };
+	dwc_otg_dev_dma_desc_t *dma_desc;
+	depctl_data_t doepctl = {.d32 = 0 };
+
+#ifdef VERBOSE
+	DWC_DEBUGPL(DBG_PCDV, "%s() doepctl0=%0x\n", __func__,
+		    DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl));
+#endif
+	if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
+		doepctl.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl);
+		if (doepctl.b.epena) {
+			return;
+		}
+	}
+
+	doeptsize0.b.supcnt = 3;
+	doeptsize0.b.pktcnt = 1;
+	doeptsize0.b.xfersize = 8 * 3;
+
+	if (core_if->dma_enable) {
+		if (!core_if->dma_desc_enable) {
+			/** put here as for Hermes mode deptisz register should not be written */
+			DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doeptsiz,
+					doeptsize0.d32);
+
+			/** @todo dma needs to handle multiple setup packets (up to 3) */
+			DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doepdma,
+					pcd->setup_pkt_dma_handle);
+		} else {
+			dev_if->setup_desc_index =
+			    (dev_if->setup_desc_index + 1) & 1;
+			dma_desc =
+			    dev_if->setup_desc_addr[dev_if->setup_desc_index];
+
+			/** DMA Descriptor Setup */
+			dma_desc->status.b.bs = BS_HOST_BUSY;
+			if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
+				dma_desc->status.b.sr = 0;
+				dma_desc->status.b.mtrf = 0;
+			}
+			dma_desc->status.b.l = 1;
+			dma_desc->status.b.ioc = 1;
+			dma_desc->status.b.bytes = pcd->ep0.dwc_ep.maxpacket;
+			dma_desc->buf = pcd->setup_pkt_dma_handle;
+			dma_desc->status.b.sts = 0;
+			dma_desc->status.b.bs = BS_HOST_READY;
+
+			/** DOEPDMA0 Register write */
+			DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doepdma,
+					dev_if->dma_setup_desc_addr
+					[dev_if->setup_desc_index]);
+		}
+
+	} else {
+		/** put here as for Hermes mode deptisz register should not be written */
+		DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doeptsiz,
+				doeptsize0.d32);
+	}
+
+	/** DOEPCTL0 Register write cnak will be set after setup interrupt */
+	doepctl.d32 = 0;
+	doepctl.b.epena = 1;
+	if (core_if->snpsid <= OTG_CORE_REV_2_94a) {
+	doepctl.b.cnak = 1;
+	DWC_WRITE_REG32(&dev_if->out_ep_regs[0]->doepctl, doepctl.d32);
+	} else {
+		DWC_MODIFY_REG32(&dev_if->out_ep_regs[0]->doepctl, 0, doepctl.d32);
+	}
+
+#ifdef VERBOSE
+	DWC_DEBUGPL(DBG_PCDV, "doepctl0=%0x\n",
+		    DWC_READ_REG32(&dev_if->out_ep_regs[0]->doepctl));
+	DWC_DEBUGPL(DBG_PCDV, "diepctl0=%0x\n",
+		    DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl));
+#endif
+}
+
+/**
+ * This interrupt occurs when a USB Reset is detected. When the USB
+ * Reset Interrupt occurs the device state is set to DEFAULT and the
+ * EP0 state is set to IDLE.
+ *	-#	Set the NAK bit for all OUT endpoints (DOEPCTLn.SNAK = 1)
+ *	-#	Unmask the following interrupt bits
+ *		- DAINTMSK.INEP0 = 1 (Control 0 IN endpoint)
+ *	- DAINTMSK.OUTEP0 = 1 (Control 0 OUT endpoint)
+ *	- DOEPMSK.SETUP = 1
+ *	- DOEPMSK.XferCompl = 1
+ *	- DIEPMSK.XferCompl = 1
+ *	- DIEPMSK.TimeOut = 1
+ *	-# Program the following fields in the endpoint specific registers
+ *	for Control OUT EP 0, in order to receive a setup packet
+ *	- DOEPTSIZ0.Packet Count = 3 (To receive up to 3 back to back
+ *	  setup packets)
+ *	- DOEPTSIZE0.Transfer Size = 24 Bytes (To receive up to 3 back
+ *	  to back setup packets)
+ *		- In DMA mode, DOEPDMA0 Register with a memory address to
+ *		  store any setup packets received
+ * At this point, all the required initialization, except for enabling
+ * the control 0 OUT endpoint is done, for receiving SETUP packets.
+ */
+int32_t dwc_otg_pcd_handle_usb_reset_intr(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	depctl_data_t doepctl = {.d32 = 0 };
+	depctl_data_t diepctl = {.d32 = 0 };
+	daint_data_t daintmsk = {.d32 = 0 };
+	doepmsk_data_t doepmsk = {.d32 = 0 };
+	diepmsk_data_t diepmsk = {.d32 = 0 };
+	dcfg_data_t dcfg = {.d32 = 0 };
+	grstctl_t resetctl = {.d32 = 0 };
+	dctl_data_t dctl = {.d32 = 0 };
+	int i = 0;
+	gintsts_data_t gintsts;
+	pcgcctl_data_t power = {.d32 = 0 };
+
+	power.d32 = DWC_READ_REG32(core_if->pcgcctl);
+	if (power.b.stoppclk) {
+		power.d32 = 0;
+		power.b.stoppclk = 1;
+		DWC_MODIFY_REG32(core_if->pcgcctl, power.d32, 0);
+
+		power.b.pwrclmp = 1;
+		DWC_MODIFY_REG32(core_if->pcgcctl, power.d32, 0);
+
+		power.b.rstpdwnmodule = 1;
+		DWC_MODIFY_REG32(core_if->pcgcctl, power.d32, 0);
+	}
+
+	core_if->lx_state = DWC_OTG_L0;
+
+	DWC_PRINTF("USB RESET\n");
+#ifdef DWC_EN_ISOC
+	for (i = 1; i < 16; ++i) {
+		dwc_otg_pcd_ep_t *ep;
+		dwc_ep_t *dwc_ep;
+		ep = get_in_ep(pcd, i);
+		if (ep != 0) {
+			dwc_ep = &ep->dwc_ep;
+			dwc_ep->next_frame = 0xffffffff;
+		}
+	}
+#endif /* DWC_EN_ISOC */
+
+	/* reset the HNP settings */
+	dwc_otg_pcd_update_otg(pcd, 1);
+
+	/* Clear the Remote Wakeup Signalling */
+	dctl.b.rmtwkupsig = 1;
+	DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32, 0);
+
+	/* Set NAK for all OUT EPs */
+	doepctl.b.snak = 1;
+	for (i = 0; i <= dev_if->num_out_eps; i++) {
+		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepctl, doepctl.d32);
+	}
+
+	/* Flush the NP Tx FIFO */
+	dwc_otg_flush_tx_fifo(core_if, 0x10);
+	/* Flush the Learning Queue */
+	resetctl.b.intknqflsh = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->grstctl, resetctl.d32);
+
+	if (!core_if->core_params->en_multiple_tx_fifo && core_if->dma_enable) {
+		core_if->start_predict = 0;
+		for (i = 0; i<= core_if->dev_if->num_in_eps; ++i) {
+			core_if->nextep_seq[i] = 0xff;	// 0xff - EP not active
+		}
+		core_if->nextep_seq[0] = 0;
+		core_if->first_in_nextep_seq = 0;
+		diepctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[0]->diepctl);
+		diepctl.b.nextep = 0;
+		DWC_WRITE_REG32(&dev_if->in_ep_regs[0]->diepctl, diepctl.d32);
+
+		/* Update IN Endpoint Mismatch Count by active IN NP EP count + 1 */
+		dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
+		dcfg.b.epmscnt = 2;
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
+
+		DWC_DEBUGPL(DBG_PCDV,
+			    "%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
+			__func__, core_if->first_in_nextep_seq);
+		for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
+			DWC_DEBUGPL(DBG_PCDV, "%2d\n", core_if->nextep_seq[i]);
+		}
+	}
+
+	if (core_if->multiproc_int_enable) {
+		daintmsk.b.inep0 = 1;
+		daintmsk.b.outep0 = 1;
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->deachintmsk,
+				daintmsk.d32);
+
+		doepmsk.b.setup = 1;
+		doepmsk.b.xfercompl = 1;
+		doepmsk.b.ahberr = 1;
+		doepmsk.b.epdisabled = 1;
+
+		if ((core_if->dma_desc_enable) ||
+		    (core_if->dma_enable
+		     && core_if->snpsid >= OTG_CORE_REV_3_00a)) {
+			doepmsk.b.stsphsercvd = 1;
+		}
+		if (core_if->dma_desc_enable)
+			doepmsk.b.bna = 1;
+/*
+		doepmsk.b.babble = 1;
+		doepmsk.b.nyet = 1;
+
+		if (core_if->dma_enable) {
+			doepmsk.b.nak = 1;
+		}
+*/
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->doepeachintmsk[0],
+				doepmsk.d32);
+
+		diepmsk.b.xfercompl = 1;
+		diepmsk.b.timeout = 1;
+		diepmsk.b.epdisabled = 1;
+		diepmsk.b.ahberr = 1;
+		diepmsk.b.intknepmis = 1;
+		if (!core_if->en_multiple_tx_fifo && core_if->dma_enable)
+			diepmsk.b.intknepmis = 0;
+
+/*		if (core_if->dma_desc_enable) {
+			diepmsk.b.bna = 1;
+		}
+*/
+/*
+		if (core_if->dma_enable) {
+			diepmsk.b.nak = 1;
+		}
+*/
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->diepeachintmsk[0],
+				diepmsk.d32);
+	} else {
+		daintmsk.b.inep0 = 1;
+		daintmsk.b.outep0 = 1;
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->daintmsk,
+				daintmsk.d32);
+
+		doepmsk.b.setup = 1;
+		doepmsk.b.xfercompl = 1;
+		doepmsk.b.ahberr = 1;
+		doepmsk.b.epdisabled = 1;
+
+		if ((core_if->dma_desc_enable) ||
+		    (core_if->dma_enable
+		     && core_if->snpsid >= OTG_CORE_REV_3_00a)) {
+			doepmsk.b.stsphsercvd = 1;
+		}
+		if (core_if->dma_desc_enable)
+			doepmsk.b.bna = 1;
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->doepmsk, doepmsk.d32);
+
+		diepmsk.b.xfercompl = 1;
+		diepmsk.b.timeout = 1;
+		diepmsk.b.epdisabled = 1;
+		diepmsk.b.ahberr = 1;
+		if (!core_if->en_multiple_tx_fifo && core_if->dma_enable)
+			diepmsk.b.intknepmis = 0;
+/*
+		if (core_if->dma_desc_enable) {
+			diepmsk.b.bna = 1;
+		}
+*/
+
+		DWC_WRITE_REG32(&dev_if->dev_global_regs->diepmsk, diepmsk.d32);
+	}
+
+	/* Reset Device Address */
+	dcfg.d32 = DWC_READ_REG32(&dev_if->dev_global_regs->dcfg);
+	dcfg.b.devaddr = 0;
+	DWC_WRITE_REG32(&dev_if->dev_global_regs->dcfg, dcfg.d32);
+
+	/* setup EP0 to receive SETUP packets */
+	if (core_if->snpsid <= OTG_CORE_REV_2_94a)
+		ep0_out_start(core_if, pcd);
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.usbreset = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * Get the device speed from the device status register and convert it
+ * to USB speed constant.
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ */
+static int get_device_speed(dwc_otg_core_if_t * core_if)
+{
+	dsts_data_t dsts;
+	int speed = 0;
+	dsts.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dsts);
+
+	switch (dsts.b.enumspd) {
+	case DWC_DSTS_ENUMSPD_HS_PHY_30MHZ_OR_60MHZ:
+		speed = USB_SPEED_HIGH;
+		break;
+	case DWC_DSTS_ENUMSPD_FS_PHY_30MHZ_OR_60MHZ:
+	case DWC_DSTS_ENUMSPD_FS_PHY_48MHZ:
+		speed = USB_SPEED_FULL;
+		break;
+
+	case DWC_DSTS_ENUMSPD_LS_PHY_6MHZ:
+		speed = USB_SPEED_LOW;
+		break;
+	}
+
+	return speed;
+}
+
+/**
+ * Read the device status register and set the device speed in the
+ * data structure.
+ * Set up EP0 to receive SETUP packets by calling dwc_ep0_activate.
+ */
+int32_t dwc_otg_pcd_handle_enum_done_intr(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
+	gintsts_data_t gintsts;
+	gusbcfg_data_t gusbcfg;
+	dwc_otg_core_global_regs_t *global_regs =
+	    GET_CORE_IF(pcd)->core_global_regs;
+	uint8_t utmi16b, utmi8b;
+	int speed;
+	DWC_DEBUGPL(DBG_PCD, "SPEED ENUM\n");
+
+	if (GET_CORE_IF(pcd)->snpsid >= OTG_CORE_REV_2_60a) {
+		utmi16b = 6;	//vahrama old value was 6;
+		utmi8b = 9;
+	} else {
+		utmi16b = 4;
+		utmi8b = 8;
+	}
+	dwc_otg_ep0_activate(GET_CORE_IF(pcd), &ep0->dwc_ep);
+	if (GET_CORE_IF(pcd)->snpsid >= OTG_CORE_REV_3_00a) {
+		ep0_out_start(GET_CORE_IF(pcd), pcd);
+	}
+
+#ifdef DEBUG_EP0
+	print_ep0_state(pcd);
+#endif
+
+	if (pcd->ep0state == EP0_DISCONNECT) {
+		pcd->ep0state = EP0_IDLE;
+	} else if (pcd->ep0state == EP0_STALL) {
+		pcd->ep0state = EP0_IDLE;
+	}
+
+	pcd->ep0state = EP0_IDLE;
+
+	ep0->stopped = 0;
+
+	speed = get_device_speed(GET_CORE_IF(pcd));
+	pcd->fops->connect(pcd, speed);
+
+	/* Set USB turnaround time based on device speed and PHY interface. */
+	gusbcfg.d32 = DWC_READ_REG32(&global_regs->gusbcfg);
+	if (speed == USB_SPEED_HIGH) {
+		if (GET_CORE_IF(pcd)->hwcfg2.b.hs_phy_type ==
+		    DWC_HWCFG2_HS_PHY_TYPE_ULPI) {
+			/* ULPI interface */
+			gusbcfg.b.usbtrdtim = 9;
+		}
+		if (GET_CORE_IF(pcd)->hwcfg2.b.hs_phy_type ==
+		    DWC_HWCFG2_HS_PHY_TYPE_UTMI) {
+			/* UTMI+ interface */
+			if (GET_CORE_IF(pcd)->hwcfg4.b.utmi_phy_data_width == 0) {
+				gusbcfg.b.usbtrdtim = utmi8b;
+			} else if (GET_CORE_IF(pcd)->hwcfg4.
+				   b.utmi_phy_data_width == 1) {
+				gusbcfg.b.usbtrdtim = utmi16b;
+			} else if (GET_CORE_IF(pcd)->
+				   core_params->phy_utmi_width == 8) {
+				gusbcfg.b.usbtrdtim = utmi8b;
+			} else {
+				gusbcfg.b.usbtrdtim = utmi16b;
+			}
+		}
+		if (GET_CORE_IF(pcd)->hwcfg2.b.hs_phy_type ==
+		    DWC_HWCFG2_HS_PHY_TYPE_UTMI_ULPI) {
+			/* UTMI+  OR  ULPI interface */
+			if (gusbcfg.b.ulpi_utmi_sel == 1) {
+				/* ULPI interface */
+				gusbcfg.b.usbtrdtim = 9;
+			} else {
+				/* UTMI+ interface */
+				if (GET_CORE_IF(pcd)->
+				    core_params->phy_utmi_width == 16) {
+					gusbcfg.b.usbtrdtim = utmi16b;
+				} else {
+					gusbcfg.b.usbtrdtim = utmi8b;
+				}
+			}
+		}
+	} else {
+		/* Full or low speed */
+		gusbcfg.b.usbtrdtim = 9;
+	}
+	DWC_WRITE_REG32(&global_regs->gusbcfg, gusbcfg.d32);
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.enumdone = 1;
+	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
+			gintsts.d32);
+	return 1;
+}
+
+/**
+ * This interrupt indicates that the ISO OUT Packet was dropped due to
+ * Rx FIFO full or Rx Status Queue Full.  If this interrupt occurs
+ * read all the data from the Rx FIFO.
+ */
+int32_t dwc_otg_pcd_handle_isoc_out_packet_dropped_intr(dwc_otg_pcd_t * pcd)
+{
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	gintsts_data_t gintsts;
+
+	DWC_WARN("INTERRUPT Handler not implemented for %s\n",
+		 "ISOC Out Dropped");
+
+	intr_mask.b.isooutdrop = 1;
+	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
+			 intr_mask.d32, 0);
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.isooutdrop = 1;
+	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
+			gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * This interrupt indicates the end of the portion of the micro-frame
+ * for periodic transactions.  If there is a periodic transaction for
+ * the next frame, load the packets into the EP periodic Tx FIFO.
+ */
+int32_t dwc_otg_pcd_handle_end_periodic_frame_intr(dwc_otg_pcd_t * pcd)
+{
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	gintsts_data_t gintsts;
+	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n", "EOP");
+
+	intr_mask.b.eopframe = 1;
+	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
+			 intr_mask.d32, 0);
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.eopframe = 1;
+	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
+			gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * This interrupt indicates that EP of the packet on the top of the
+ * non-periodic Tx FIFO does not match EP of the IN Token received.
+ *
+ * The "Device IN Token Queue" Registers are read to determine the
+ * order the IN Tokens have been received. The non-periodic Tx FIFO
+ * is flushed, so it can be reloaded in the order seen in the IN Token
+ * Queue.
+ */
+int32_t dwc_otg_pcd_handle_ep_mismatch_intr(dwc_otg_pcd_t * pcd)
+{
+	gintsts_data_t gintsts;
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dctl_data_t dctl;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	if (!core_if->en_multiple_tx_fifo && core_if->dma_enable) {
+		core_if->start_predict = 1;
+
+		DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, core_if);
+
+		gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+		if (!gintsts.b.ginnakeff) {
+			/* Disable EP Mismatch interrupt */
+			intr_mask.d32 = 0;
+			intr_mask.b.epmismatch = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, intr_mask.d32, 0);
+			/* Enable the Global IN NAK Effective Interrupt */
+			intr_mask.d32 = 0;
+			intr_mask.b.ginnakeff = 1;
+			DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, 0, intr_mask.d32);
+			/* Set the global non-periodic IN NAK handshake */
+			dctl.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
+			dctl.b.sgnpinnak = 1;
+			DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32);
+		} else {
+			DWC_PRINTF("gintsts.b.ginnakeff = 1! dctl.b.sgnpinnak not set\n");
+		}
+		/* Disabling of all EP's will be done in dwc_otg_pcd_handle_in_nak_effective()
+		 * handler after Global IN NAK Effective interrupt will be asserted */
+	}
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.epmismatch = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * This interrupt is valid only in DMA mode. This interrupt indicates that the
+ * core has stopped fetching data for IN endpoints due to the unavailability of
+ * TxFIFO space or Request Queue space. This interrupt is used by the
+ * application for an endpoint mismatch algorithm.
+ *
+ * @param pcd The PCD
+ */
+int32_t dwc_otg_pcd_handle_ep_fetsusp_intr(dwc_otg_pcd_t * pcd)
+{
+	gintsts_data_t gintsts;
+	gintmsk_data_t gintmsk_data;
+	dctl_data_t dctl;
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, core_if);
+
+	/* Clear the global non-periodic IN NAK handshake */
+	dctl.d32 = 0;
+	dctl.b.cgnpinnak = 1;
+	DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
+
+	/* Mask GINTSTS.FETSUSP interrupt */
+	gintmsk_data.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
+	gintmsk_data.b.fetsusp = 0;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, gintmsk_data.d32);
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.fetsusp = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->gintsts, gintsts.d32);
+
+	return 1;
+}
+/**
+ * This funcion stalls EP0.
+ */
+static inline void ep0_do_stall(dwc_otg_pcd_t * pcd, const int err_val)
+{
+	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
+	usb_device_request_t *ctrl = &pcd->setup_pkt->req;
+	DWC_WARN("req %02x.%02x protocol STALL; err %d\n",
+		 ctrl->bmRequestType, ctrl->bRequest, err_val);
+
+	ep0->dwc_ep.is_in = 1;
+	dwc_otg_ep_set_stall(GET_CORE_IF(pcd), &ep0->dwc_ep);
+	pcd->ep0.stopped = 1;
+	pcd->ep0state = EP0_IDLE;
+	ep0_out_start(GET_CORE_IF(pcd), pcd);
+}
+
+/**
+ * This functions delegates the setup command to the gadget driver.
+ */
+static inline void do_gadget_setup(dwc_otg_pcd_t * pcd,
+				   usb_device_request_t * ctrl)
+{
+	int ret = 0;
+	DWC_SPINUNLOCK(pcd->lock);
+	ret = pcd->fops->setup(pcd, (uint8_t *) ctrl);
+	DWC_SPINLOCK(pcd->lock);
+	if (ret < 0) {
+		ep0_do_stall(pcd, ret);
+	}
+
+	/** @todo This is a g_file_storage gadget driver specific
+	 * workaround: a DELAYED_STATUS result from the fsg_setup
+	 * routine will result in the gadget queueing a EP0 IN status
+	 * phase for a two-stage control transfer. Exactly the same as
+	 * a SET_CONFIGURATION/SET_INTERFACE except that this is a class
+	 * specific request.  Need a generic way to know when the gadget
+	 * driver will queue the status phase. Can we assume when we
+	 * call the gadget driver setup() function that it will always
+	 * queue and require the following flag? Need to look into
+	 * this.
+	 */
+
+	if (ret == 256 + 999) {
+		pcd->request_config = 1;
+	}
+}
+
+#ifdef DWC_UTE_CFI
+/**
+ * This functions delegates the CFI setup commands to the gadget driver.
+ * This function will return a negative value to indicate a failure.
+ */
+static inline int cfi_gadget_setup(dwc_otg_pcd_t * pcd,
+				   struct cfi_usb_ctrlrequest *ctrl_req)
+{
+	int ret = 0;
+
+	if (pcd->fops && pcd->fops->cfi_setup) {
+		DWC_SPINUNLOCK(pcd->lock);
+		ret = pcd->fops->cfi_setup(pcd, ctrl_req);
+		DWC_SPINLOCK(pcd->lock);
+		if (ret < 0) {
+			ep0_do_stall(pcd, ret);
+			return ret;
+		}
+	}
+
+	return ret;
+}
+#endif
+
+/**
+ * This function starts the Zero-Length Packet for the IN status phase
+ * of a 2 stage control transfer.
+ */
+static inline void do_setup_in_status_phase(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
+	if (pcd->ep0state == EP0_STALL) {
+		return;
+	}
+
+	pcd->ep0state = EP0_IN_STATUS_PHASE;
+
+	/* Prepare for more SETUP Packets */
+	DWC_DEBUGPL(DBG_PCD, "EP0 IN ZLP\n");
+	if ((GET_CORE_IF(pcd)->snpsid >= OTG_CORE_REV_3_00a)
+	    && (pcd->core_if->dma_desc_enable)
+	    && (ep0->dwc_ep.xfer_count < ep0->dwc_ep.total_len)) {
+		DWC_DEBUGPL(DBG_PCDV,
+			    "Data terminated wait next packet in out_desc_addr\n");
+		pcd->backup_buf = phys_to_virt(ep0->dwc_ep.dma_addr);
+		pcd->data_terminated = 1;
+	}
+	ep0->dwc_ep.xfer_len = 0;
+	ep0->dwc_ep.xfer_count = 0;
+	ep0->dwc_ep.is_in = 1;
+	ep0->dwc_ep.dma_addr = pcd->setup_pkt_dma_handle;
+	dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd), &ep0->dwc_ep);
+
+	/* Prepare for more SETUP Packets */
+	//ep0_out_start(GET_CORE_IF(pcd), pcd);
+}
+
+/**
+ * This function starts the Zero-Length Packet for the OUT status phase
+ * of a 2 stage control transfer.
+ */
+static inline void do_setup_out_status_phase(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
+	if (pcd->ep0state == EP0_STALL) {
+		DWC_DEBUGPL(DBG_PCD, "EP0 STALLED\n");
+		return;
+	}
+	pcd->ep0state = EP0_OUT_STATUS_PHASE;
+
+	DWC_DEBUGPL(DBG_PCD, "EP0 OUT ZLP\n");
+	ep0->dwc_ep.xfer_len = 0;
+	ep0->dwc_ep.xfer_count = 0;
+	ep0->dwc_ep.is_in = 0;
+	ep0->dwc_ep.dma_addr = pcd->setup_pkt_dma_handle;
+	dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd), &ep0->dwc_ep);
+
+	/* Prepare for more SETUP Packets */
+	if (GET_CORE_IF(pcd)->dma_enable == 0) {
+		ep0_out_start(GET_CORE_IF(pcd), pcd);
+	}
+}
+
+/**
+ * Clear the EP halt (STALL) and if pending requests start the
+ * transfer.
+ */
+static inline void pcd_clear_halt(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * ep)
+{
+	if (ep->dwc_ep.stall_clear_flag == 0)
+		dwc_otg_ep_clear_stall(GET_CORE_IF(pcd), &ep->dwc_ep);
+
+	/* Reactive the EP */
+	dwc_otg_ep_activate(GET_CORE_IF(pcd), &ep->dwc_ep);
+	if (ep->stopped) {
+		ep->stopped = 0;
+		/* If there is a request in the EP queue start it */
+
+		/** @todo FIXME: this causes an EP mismatch in DMA mode.
+		 * epmismatch not yet implemented. */
+
+		/*
+		 * Above fixme is solved by implmenting a tasklet to call the
+		 * start_next_request(), outside of interrupt context at some
+		 * time after the current time, after a clear-halt setup packet.
+		 * Still need to implement ep mismatch in the future if a gadget
+		 * ever uses more than one endpoint at once
+		 */
+		ep->queue_sof = 1;
+		DWC_TASK_SCHEDULE(pcd->start_xfer_tasklet);
+	}
+	/* Start Control Status Phase */
+	do_setup_in_status_phase(pcd);
+}
+
+/**
+ * This function is called when the SET_FEATURE TEST_MODE Setup packet
+ * is sent from the host.  The Device Control register is written with
+ * the Test Mode bits set to the specified Test Mode.  This is done as
+ * a tasklet so that the "Status" phase of the control transfer
+ * completes before transmitting the TEST packets.
+ *
+ * @todo This has not been tested since the tasklet struct was put
+ * into the PCD struct!
+ *
+ */
+void do_test_mode(void *data)
+{
+	dctl_data_t dctl;
+	dwc_otg_pcd_t *pcd = (dwc_otg_pcd_t *) data;
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	int test_mode = pcd->test_mode;
+
+//        DWC_WARN("%s() has not been tested since being rewritten!\n", __func__);
+
+	dctl.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
+	switch (test_mode) {
+	case 1:		// TEST_J
+		dctl.b.tstctl = 1;
+		break;
+
+	case 2:		// TEST_K
+		dctl.b.tstctl = 2;
+		break;
+
+	case 3:		// TEST_SE0_NAK
+		dctl.b.tstctl = 3;
+		break;
+
+	case 4:		// TEST_PACKET
+		dctl.b.tstctl = 4;
+		break;
+
+	case 5:		// TEST_FORCE_ENABLE
+		dctl.b.tstctl = 5;
+		break;
+	}
+	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32);
+}
+
+/**
+ * This function process the GET_STATUS Setup Commands.
+ */
+static inline void do_get_status(dwc_otg_pcd_t * pcd)
+{
+	usb_device_request_t ctrl = pcd->setup_pkt->req;
+	dwc_otg_pcd_ep_t *ep;
+	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
+	uint16_t *status = pcd->status_buf;
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+
+#ifdef DEBUG_EP0
+	DWC_DEBUGPL(DBG_PCD,
+		    "GET_STATUS %02x.%02x v%04x i%04x l%04x\n",
+		    ctrl.bmRequestType, ctrl.bRequest,
+		    UGETW(ctrl.wValue), UGETW(ctrl.wIndex),
+		    UGETW(ctrl.wLength));
+#endif
+
+	switch (UT_GET_RECIPIENT(ctrl.bmRequestType)) {
+	case UT_DEVICE:
+		if(UGETW(ctrl.wIndex) == 0xF000) { /* OTG Status selector */
+			DWC_PRINTF("wIndex - %d\n", UGETW(ctrl.wIndex));
+			DWC_PRINTF("OTG VERSION - %d\n", core_if->otg_ver);
+			DWC_PRINTF("OTG CAP - %d, %d\n",
+				   core_if->core_params->otg_cap,
+						DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE);
+			if (core_if->otg_ver == 1
+			    && core_if->core_params->otg_cap ==
+			    DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE) {
+				uint8_t *otgsts = (uint8_t*)pcd->status_buf;
+				*otgsts = (core_if->otg_sts & 0x1);
+				pcd->ep0_pending = 1;
+				ep0->dwc_ep.start_xfer_buff =
+				    (uint8_t *) otgsts;
+				ep0->dwc_ep.xfer_buff = (uint8_t *) otgsts;
+				ep0->dwc_ep.dma_addr =
+				    pcd->status_buf_dma_handle;
+				ep0->dwc_ep.xfer_len = 1;
+				ep0->dwc_ep.xfer_count = 0;
+				ep0->dwc_ep.total_len = ep0->dwc_ep.xfer_len;
+				dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd),
+							   &ep0->dwc_ep);
+				return;
+			} else {
+				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
+				return;
+			}
+			break;
+		} else {
+			*status = 0x1;	/* Self powered */
+			*status |= pcd->remote_wakeup_enable << 1;
+			break;
+		}
+	case UT_INTERFACE:
+		*status = 0;
+		break;
+
+	case UT_ENDPOINT:
+		ep = get_ep_by_addr(pcd, UGETW(ctrl.wIndex));
+		if (ep == 0 || UGETW(ctrl.wLength) > 2) {
+			ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
+			return;
+		}
+		/** @todo check for EP stall */
+		*status = ep->stopped;
+		break;
+	}
+	pcd->ep0_pending = 1;
+	ep0->dwc_ep.start_xfer_buff = (uint8_t *) status;
+	ep0->dwc_ep.xfer_buff = (uint8_t *) status;
+	ep0->dwc_ep.dma_addr = pcd->status_buf_dma_handle;
+	ep0->dwc_ep.xfer_len = 2;
+	ep0->dwc_ep.xfer_count = 0;
+	ep0->dwc_ep.total_len = ep0->dwc_ep.xfer_len;
+	dwc_otg_ep0_start_transfer(GET_CORE_IF(pcd), &ep0->dwc_ep);
+}
+
+/**
+ * This function process the SET_FEATURE Setup Commands.
+ */
+static inline void do_set_feature(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+	usb_device_request_t ctrl = pcd->setup_pkt->req;
+	dwc_otg_pcd_ep_t *ep = 0;
+	int32_t otg_cap_param = core_if->core_params->otg_cap;
+	gotgctl_data_t gotgctl = {.d32 = 0 };
+
+	DWC_DEBUGPL(DBG_PCD, "SET_FEATURE:%02x.%02x v%04x i%04x l%04x\n",
+		    ctrl.bmRequestType, ctrl.bRequest,
+		    UGETW(ctrl.wValue), UGETW(ctrl.wIndex),
+		    UGETW(ctrl.wLength));
+	DWC_DEBUGPL(DBG_PCD, "otg_cap=%d\n", otg_cap_param);
+
+	switch (UT_GET_RECIPIENT(ctrl.bmRequestType)) {
+	case UT_DEVICE:
+		switch (UGETW(ctrl.wValue)) {
+		case UF_DEVICE_REMOTE_WAKEUP:
+			pcd->remote_wakeup_enable = 1;
+			break;
+
+		case UF_TEST_MODE:
+			/* Setup the Test Mode tasklet to do the Test
+			 * Packet generation after the SETUP Status
+			 * phase has completed. */
+
+			/** @todo This has not been tested since the
+			 * tasklet struct was put into the PCD
+			 * struct! */
+			pcd->test_mode = UGETW(ctrl.wIndex) >> 8;
+			DWC_TASK_SCHEDULE(pcd->test_mode_tasklet);
+			break;
+
+		case UF_DEVICE_B_HNP_ENABLE:
+			DWC_DEBUGPL(DBG_PCDV,
+				    "SET_FEATURE: USB_DEVICE_B_HNP_ENABLE\n");
+
+			/* dev may initiate HNP */
+			if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE) {
+				pcd->b_hnp_enable = 1;
+				dwc_otg_pcd_update_otg(pcd, 0);
+				DWC_DEBUGPL(DBG_PCD, "Request B HNP\n");
+				/**@todo Is the gotgctl.devhnpen cleared
+				 * by a USB Reset? */
+				gotgctl.b.devhnpen = 1;
+				gotgctl.b.hnpreq = 1;
+				DWC_WRITE_REG32(&global_regs->gotgctl,
+						gotgctl.d32);
+			} else {
+				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
+				return;
+			}
+			break;
+
+		case UF_DEVICE_A_HNP_SUPPORT:
+			/* RH port supports HNP */
+			DWC_DEBUGPL(DBG_PCDV,
+				    "SET_FEATURE: USB_DEVICE_A_HNP_SUPPORT\n");
+			if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE) {
+				pcd->a_hnp_support = 1;
+				dwc_otg_pcd_update_otg(pcd, 0);
+			} else {
+				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
+				return;
+			}
+			break;
+
+		case UF_DEVICE_A_ALT_HNP_SUPPORT:
+			/* other RH port does */
+			DWC_DEBUGPL(DBG_PCDV,
+				    "SET_FEATURE: USB_DEVICE_A_ALT_HNP_SUPPORT\n");
+			if (otg_cap_param == DWC_OTG_CAP_PARAM_HNP_SRP_CAPABLE) {
+				pcd->a_alt_hnp_support = 1;
+				dwc_otg_pcd_update_otg(pcd, 0);
+			} else {
+				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
+				return;
+			}
+			break;
+
+		default:
+			ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
+			return;
+
+		}
+		do_setup_in_status_phase(pcd);
+		break;
+
+	case UT_INTERFACE:
+		do_gadget_setup(pcd, &ctrl);
+		break;
+
+	case UT_ENDPOINT:
+		if (UGETW(ctrl.wValue) == UF_ENDPOINT_HALT) {
+			ep = get_ep_by_addr(pcd, UGETW(ctrl.wIndex));
+			if (ep == 0) {
+				ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
+				return;
+			}
+			ep->stopped = 1;
+			dwc_otg_ep_set_stall(core_if, &ep->dwc_ep);
+		}
+		do_setup_in_status_phase(pcd);
+		break;
+	}
+}
+
+/**
+ * This function process the CLEAR_FEATURE Setup Commands.
+ */
+static inline void do_clear_feature(dwc_otg_pcd_t * pcd)
+{
+	usb_device_request_t ctrl = pcd->setup_pkt->req;
+	dwc_otg_pcd_ep_t *ep = 0;
+
+	DWC_DEBUGPL(DBG_PCD,
+		    "CLEAR_FEATURE:%02x.%02x v%04x i%04x l%04x\n",
+		    ctrl.bmRequestType, ctrl.bRequest,
+		    UGETW(ctrl.wValue), UGETW(ctrl.wIndex),
+		    UGETW(ctrl.wLength));
+
+	switch (UT_GET_RECIPIENT(ctrl.bmRequestType)) {
+	case UT_DEVICE:
+		switch (UGETW(ctrl.wValue)) {
+		case UF_DEVICE_REMOTE_WAKEUP:
+			pcd->remote_wakeup_enable = 0;
+			break;
+
+		case UF_TEST_MODE:
+			/** @todo Add CLEAR_FEATURE for TEST modes. */
+			break;
+
+		default:
+			ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
+			return;
+		}
+		do_setup_in_status_phase(pcd);
+		break;
+
+	case UT_ENDPOINT:
+		ep = get_ep_by_addr(pcd, UGETW(ctrl.wIndex));
+		if (ep == 0) {
+			ep0_do_stall(pcd, -DWC_E_NOT_SUPPORTED);
+			return;
+		}
+
+		pcd_clear_halt(pcd, ep);
+
+		break;
+	}
+}
+
+/**
+ * This function process the SET_ADDRESS Setup Commands.
+ */
+static inline void do_set_address(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_dev_if_t *dev_if = GET_CORE_IF(pcd)->dev_if;
+	usb_device_request_t ctrl = pcd->setup_pkt->req;
+
+	if (ctrl.bmRequestType == UT_DEVICE) {
+		dcfg_data_t dcfg = {.d32 = 0 };
+
+#ifdef DEBUG_EP0
+//                      DWC_DEBUGPL(DBG_PCDV, "SET_ADDRESS:%d\n", ctrl.wValue);
+#endif
+		dcfg.b.devaddr = UGETW(ctrl.wValue);
+		DWC_MODIFY_REG32(&dev_if->dev_global_regs->dcfg, 0, dcfg.d32);
+		do_setup_in_status_phase(pcd);
+	}
+}
+
+/**
+ *	This function processes SETUP commands. In Linux, the USB Command
+ *	processing is done in two places - the first being the PCD and the
+ *	second in the Gadget Driver (for example, the File-Backed Storage
+ *	Gadget Driver).
+ *
+ * <table>
+ * <tr><td>Command	</td><td>Driver </td><td>Description</td></tr>
+ *
+ * <tr><td>GET_STATUS </td><td>PCD </td><td>Command is processed as
+ * defined in chapter 9 of the USB 2.0 Specification chapter 9
+ * </td></tr>
+ *
+ * <tr><td>CLEAR_FEATURE </td><td>PCD </td><td>The Device and Endpoint
+ * requests are the ENDPOINT_HALT feature is procesed, all others the
+ * interface requests are ignored.</td></tr>
+ *
+ * <tr><td>SET_FEATURE </td><td>PCD </td><td>The Device and Endpoint
+ * requests are processed by the PCD.  Interface requests are passed
+ * to the Gadget Driver.</td></tr>
+ *
+ * <tr><td>SET_ADDRESS </td><td>PCD </td><td>Program the DCFG reg,
+ * with device address received </td></tr>
+ *
+ * <tr><td>GET_DESCRIPTOR </td><td>Gadget Driver </td><td>Return the
+ * requested descriptor</td></tr>
+ *
+ * <tr><td>SET_DESCRIPTOR </td><td>Gadget Driver </td><td>Optional -
+ * not implemented by any of the existing Gadget Drivers.</td></tr>
+ *
+ * <tr><td>SET_CONFIGURATION </td><td>Gadget Driver </td><td>Disable
+ * all EPs and enable EPs for new configuration.</td></tr>
+ *
+ * <tr><td>GET_CONFIGURATION </td><td>Gadget Driver </td><td>Return
+ * the current configuration</td></tr>
+ *
+ * <tr><td>SET_INTERFACE </td><td>Gadget Driver </td><td>Disable all
+ * EPs and enable EPs for new configuration.</td></tr>
+ *
+ * <tr><td>GET_INTERFACE </td><td>Gadget Driver </td><td>Return the
+ * current interface.</td></tr>
+ *
+ * <tr><td>SYNC_FRAME </td><td>PCD </td><td>Display debug
+ * message.</td></tr>
+ * </table>
+ *
+ * When the SETUP Phase Done interrupt occurs, the PCD SETUP commands are
+ * processed by pcd_setup. Calling the Function Driver's setup function from
+ * pcd_setup processes the gadget SETUP commands.
+ */
+static inline void pcd_setup(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	usb_device_request_t ctrl = pcd->setup_pkt->req;
+	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
+
+	deptsiz0_data_t doeptsize0 = {.d32 = 0 };
+
+#ifdef DWC_UTE_CFI
+	int retval = 0;
+	struct cfi_usb_ctrlrequest cfi_req;
+#endif
+
+	doeptsize0.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[0]->doeptsiz);
+
+	/** In BDMA more then 1 setup packet is not supported till 3.00a */
+	if (core_if->dma_enable && core_if->dma_desc_enable == 0
+	    && (doeptsize0.b.supcnt < 2)
+	    && (core_if->snpsid < OTG_CORE_REV_2_94a)) {
+		DWC_ERROR
+		    ("\n\n-----------	 CANNOT handle > 1 setup packet in DMA mode\n\n");
+	}
+	if ((core_if->snpsid >= OTG_CORE_REV_3_00a)
+	    && (core_if->dma_enable == 1) && (core_if->dma_desc_enable == 0)) {
+		ctrl =
+		    (pcd->setup_pkt +
+		     (3 - doeptsize0.b.supcnt - 1 +
+		      ep0->dwc_ep.stp_rollover))->req;
+	}
+#ifdef DEBUG_EP0
+	DWC_DEBUGPL(DBG_PCD, "SETUP %02x.%02x v%04x i%04x l%04x\n",
+		    ctrl.bmRequestType, ctrl.bRequest,
+		    UGETW(ctrl.wValue), UGETW(ctrl.wIndex),
+		    UGETW(ctrl.wLength));
+#endif
+
+	/* Clean up the request queue */
+	dwc_otg_request_nuke(ep0);
+	ep0->stopped = 0;
+
+	if (ctrl.bmRequestType & UE_DIR_IN) {
+		ep0->dwc_ep.is_in = 1;
+		pcd->ep0state = EP0_IN_DATA_PHASE;
+	} else {
+		ep0->dwc_ep.is_in = 0;
+		pcd->ep0state = EP0_OUT_DATA_PHASE;
+	}
+
+	if (UGETW(ctrl.wLength) == 0) {
+		ep0->dwc_ep.is_in = 1;
+		pcd->ep0state = EP0_IN_STATUS_PHASE;
+	}
+
+	if (UT_GET_TYPE(ctrl.bmRequestType) != UT_STANDARD) {
+
+#ifdef DWC_UTE_CFI
+		DWC_MEMCPY(&cfi_req, &ctrl, sizeof(usb_device_request_t));
+
+		//printk(KERN_ALERT "CFI: req_type=0x%02x; req=0x%02x\n",
+				ctrl.bRequestType, ctrl.bRequest);
+		if (UT_GET_TYPE(cfi_req.bRequestType) == UT_VENDOR) {
+			if (cfi_req.bRequest > 0xB0 && cfi_req.bRequest < 0xBF) {
+				retval = cfi_setup(pcd, &cfi_req);
+				if (retval < 0) {
+					ep0_do_stall(pcd, retval);
+					pcd->ep0_pending = 0;
+					return;
+				}
+
+				/* if need gadget setup then call it and check the retval */
+				if (pcd->cfi->need_gadget_att) {
+					retval =
+					    cfi_gadget_setup(pcd,
+							     &pcd->
+							     cfi->ctrl_req);
+					if (retval < 0) {
+						pcd->ep0_pending = 0;
+						return;
+					}
+				}
+
+				if (pcd->cfi->need_status_in_complete) {
+					do_setup_in_status_phase(pcd);
+				}
+				return;
+			}
+		}
+#endif
+
+		/* handle non-standard (class/vendor) requests in the gadget driver */
+		do_gadget_setup(pcd, &ctrl);
+		return;
+	}
+
+	/** @todo NGS: Handle bad setup packet? */
+
+///////////////////////////////////////////
+//// --- Standard Request handling --- ////
+
+	switch (ctrl.bRequest) {
+	case UR_GET_STATUS:
+		do_get_status(pcd);
+		break;
+
+	case UR_CLEAR_FEATURE:
+		do_clear_feature(pcd);
+		break;
+
+	case UR_SET_FEATURE:
+		do_set_feature(pcd);
+		break;
+
+	case UR_SET_ADDRESS:
+		do_set_address(pcd);
+		break;
+
+	case UR_SET_INTERFACE:
+	case UR_SET_CONFIG:
+//              _pcd->request_config = 1;       /* Configuration changed */
+		do_gadget_setup(pcd, &ctrl);
+		break;
+
+	case UR_SYNCH_FRAME:
+		do_gadget_setup(pcd, &ctrl);
+		break;
+
+	default:
+		/* Call the Gadget Driver's setup functions */
+		do_gadget_setup(pcd, &ctrl);
+		break;
+	}
+}
+
+/**
+ * This function completes the ep0 control transfer.
+ */
+static int32_t ep0_complete_request(dwc_otg_pcd_ep_t * ep)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(ep->pcd);
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	dwc_otg_dev_in_ep_regs_t *in_ep_regs =
+	    dev_if->in_ep_regs[ep->dwc_ep.num];
+#ifdef DEBUG_EP0
+	dwc_otg_dev_out_ep_regs_t *out_ep_regs =
+	    dev_if->out_ep_regs[ep->dwc_ep.num];
+#endif
+	deptsiz0_data_t deptsiz;
+	dev_dma_desc_sts_t desc_sts;
+	dwc_otg_pcd_request_t *req;
+	int is_last = 0;
+	dwc_otg_pcd_t *pcd = ep->pcd;
+
+#ifdef DWC_UTE_CFI
+	struct cfi_usb_ctrlrequest *ctrlreq;
+	int retval = -DWC_E_NOT_SUPPORTED;
+#endif
+
+        desc_sts.b.bytes = 0;
+
+	if (pcd->ep0_pending && DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+		if (ep->dwc_ep.is_in) {
+#ifdef DEBUG_EP0
+			DWC_DEBUGPL(DBG_PCDV, "Do setup OUT status phase\n");
+#endif
+			do_setup_out_status_phase(pcd);
+		} else {
+#ifdef DEBUG_EP0
+			DWC_DEBUGPL(DBG_PCDV, "Do setup IN status phase\n");
+#endif
+
+#ifdef DWC_UTE_CFI
+			ctrlreq = &pcd->cfi->ctrl_req;
+
+			if (UT_GET_TYPE(ctrlreq->bRequestType) == UT_VENDOR) {
+				if (ctrlreq->bRequest > 0xB0
+				    && ctrlreq->bRequest < 0xBF) {
+
+					/* Return if the PCD failed to handle the request */
+					if ((retval =
+					     pcd->cfi->ops.
+					     ctrl_write_complete(pcd->cfi,
+								 pcd)) < 0) {
+						CFI_INFO
+						    ("ERROR setting a new value in the PCD(%d)\n",
+						     retval);
+						ep0_do_stall(pcd, retval);
+						pcd->ep0_pending = 0;
+						return 0;
+					}
+
+					/* If the gadget needs to be notified on the request */
+					if (pcd->cfi->need_gadget_att == 1) {
+						//retval = do_gadget_setup(pcd, &pcd->cfi->ctrl_req);
+						retval =
+						    cfi_gadget_setup(pcd,
+								     &pcd->cfi->
+								     ctrl_req);
+
+						/* Return from the function if the gadget failed to process
+						 * the request properly - this should never happen !!!
+						 */
+						if (retval < 0) {
+							CFI_INFO
+							    ("ERROR setting a new value in the gadget(%d)\n",
+							     retval);
+							pcd->ep0_pending = 0;
+							return 0;
+						}
+					}
+
+					CFI_INFO("%s: RETVAL=%d\n", __func__,
+						 retval);
+					/* If we hit here then the PCD and the gadget has properly
+					 * handled the request - so send the ZLP IN to the host.
+					 */
+					/* @todo: MAS - decide whether we need to start the setup
+					 * stage based on the need_setup value of the cfi object
+					 */
+					do_setup_in_status_phase(pcd);
+					pcd->ep0_pending = 0;
+					return 1;
+				}
+			}
+#endif
+
+			do_setup_in_status_phase(pcd);
+		}
+		pcd->ep0_pending = 0;
+		return 1;
+	}
+
+	if (DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+		return 0;
+	}
+	req = DWC_CIRCLEQ_FIRST(&ep->queue);
+
+	if (pcd->ep0state == EP0_OUT_STATUS_PHASE
+	    || pcd->ep0state == EP0_IN_STATUS_PHASE) {
+		is_last = 1;
+	} else if (ep->dwc_ep.is_in) {
+		deptsiz.d32 = DWC_READ_REG32(&in_ep_regs->dieptsiz);
+		if (core_if->dma_desc_enable != 0)
+			desc_sts = dev_if->in_desc_addr->status;
+#ifdef DEBUG_EP0
+		DWC_DEBUGPL(DBG_PCDV, "%d len=%d  xfersize=%d pktcnt=%d\n",
+			    ep->dwc_ep.num, ep->dwc_ep.xfer_len,
+			    deptsiz.b.xfersize, deptsiz.b.pktcnt);
+#endif
+
+		if (((core_if->dma_desc_enable == 0)
+		     && (deptsiz.b.xfersize == 0))
+		    || ((core_if->dma_desc_enable != 0)
+			&& (desc_sts.b.bytes == 0))) {
+			req->actual = ep->dwc_ep.xfer_count;
+			/* Is a Zero Len Packet needed? */
+			if (req->sent_zlp) {
+#ifdef DEBUG_EP0
+				DWC_DEBUGPL(DBG_PCD, "Setup Rx ZLP\n");
+#endif
+				req->sent_zlp = 0;
+			}
+			do_setup_out_status_phase(pcd);
+		}
+	} else {
+		/* ep0-OUT */
+#ifdef DEBUG_EP0
+		deptsiz.d32 = DWC_READ_REG32(&out_ep_regs->doeptsiz);
+		DWC_DEBUGPL(DBG_PCDV, "%d len=%d xsize=%d pktcnt=%d\n",
+			    ep->dwc_ep.num, ep->dwc_ep.xfer_len,
+			    deptsiz.b.xfersize, deptsiz.b.pktcnt);
+#endif
+		req->actual = ep->dwc_ep.xfer_count;
+
+		/* Is a Zero Len Packet needed? */
+		if (req->sent_zlp) {
+#ifdef DEBUG_EP0
+			DWC_DEBUGPL(DBG_PCDV, "Setup Tx ZLP\n");
+#endif
+			req->sent_zlp = 0;
+		}
+		/* For older cores do setup in status phase in Slave/BDMA modes,
+		 * starting from 3.00 do that only in slave, and for DMA modes
+		 * just re-enable ep 0 OUT here*/
+		if (core_if->dma_enable == 0
+		    || (core_if->dma_desc_enable == 0
+			&& core_if->snpsid <= OTG_CORE_REV_2_94a)) {
+			do_setup_in_status_phase(pcd);
+		} else if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
+			DWC_DEBUGPL(DBG_PCDV,
+				    "Enable out ep before in status phase\n");
+			ep0_out_start(core_if, pcd);
+		}
+	}
+
+	/* Complete the request */
+	if (is_last) {
+		dwc_otg_request_done(ep, req, 0);
+		ep->dwc_ep.start_xfer_buff = 0;
+		ep->dwc_ep.xfer_buff = 0;
+		ep->dwc_ep.xfer_len = 0;
+		return 1;
+	}
+	return 0;
+}
+
+#ifdef DWC_UTE_CFI
+/**
+ * This function calculates traverses all the CFI DMA descriptors and
+ * and accumulates the bytes that are left to be transfered.
+ *
+ * @return The total bytes left to transfered, or a negative value as failure
+ */
+static inline int cfi_calc_desc_residue(dwc_otg_pcd_ep_t * ep)
+{
+	int32_t ret = 0;
+	int i;
+	struct dwc_otg_dma_desc *ddesc = NULL;
+	struct cfi_ep *cfiep;
+
+	/* See if the pcd_ep has its respective cfi_ep mapped */
+	cfiep = get_cfi_ep_by_pcd_ep(ep->pcd->cfi, ep);
+	if (!cfiep) {
+		CFI_INFO("%s: Failed to find ep\n", __func__);
+		return -1;
+	}
+
+	ddesc = ep->dwc_ep.descs;
+
+	for (i = 0; (i < cfiep->desc_count) && (i < MAX_DMA_DESCS_PER_EP); i++) {
+
+#if defined(PRINT_CFI_DMA_DESCS)
+		print_desc(ddesc, ep->ep.name, i);
+#endif
+		ret += ddesc->status.b.bytes;
+		ddesc++;
+	}
+
+	if (ret)
+		CFI_INFO("!!!!!!!!!! WARNING (%s) - residue=%d\n", __func__,
+			 ret);
+
+	return ret;
+}
+#endif
+
+/**
+ * This function completes the request for the EP. If there are
+ * additional requests for the EP in the queue they will be started.
+ */
+static void complete_ep(dwc_otg_pcd_ep_t * ep)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(ep->pcd);
+	struct device *dev = dwc_otg_pcd_to_dev(ep->pcd);
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	dwc_otg_dev_in_ep_regs_t *in_ep_regs =
+	    dev_if->in_ep_regs[ep->dwc_ep.num];
+	deptsiz_data_t deptsiz;
+	dev_dma_desc_sts_t desc_sts;
+	dwc_otg_pcd_request_t *req = 0;
+	dwc_otg_dev_dma_desc_t *dma_desc;
+	uint32_t byte_count = 0;
+	int is_last = 0;
+	int i;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s() %d-%s\n", __func__, ep->dwc_ep.num,
+		    (ep->dwc_ep.is_in ? "IN" : "OUT"));
+
+	/* Get any pending requests */
+	if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+		req = DWC_CIRCLEQ_FIRST(&ep->queue);
+		if (!req) {
+			DWC_PRINTF("complete_ep 0x%p, req = NULL!\n", ep);
+			return;
+		}
+	} else {
+		DWC_PRINTF("complete_ep 0x%p, ep->queue empty!\n", ep);
+		return;
+	}
+
+	DWC_DEBUGPL(DBG_PCD, "Requests %d\n", ep->pcd->request_pending);
+
+	if (ep->dwc_ep.is_in) {
+		deptsiz.d32 = DWC_READ_REG32(&in_ep_regs->dieptsiz);
+
+		if (core_if->dma_enable) {
+			if (core_if->dma_desc_enable == 0) {
+				if (deptsiz.b.xfersize == 0
+				    && deptsiz.b.pktcnt == 0) {
+					byte_count =
+					    ep->dwc_ep.xfer_len -
+					    ep->dwc_ep.xfer_count;
+
+					ep->dwc_ep.xfer_buff += byte_count;
+					ep->dwc_ep.dma_addr += byte_count;
+					ep->dwc_ep.xfer_count += byte_count;
+
+					DWC_DEBUGPL(DBG_PCDV,
+						    "%d-%s len=%d  xfersize=%d pktcnt=%d\n",
+						    ep->dwc_ep.num,
+						    (ep->dwc_ep.
+						     is_in ? "IN" : "OUT"),
+						    ep->dwc_ep.xfer_len,
+						    deptsiz.b.xfersize,
+						    deptsiz.b.pktcnt);
+
+					if (ep->dwc_ep.xfer_len <
+					    ep->dwc_ep.total_len) {
+						dwc_otg_ep_start_transfer
+						    (core_if, &ep->dwc_ep);
+					} else if (ep->dwc_ep.sent_zlp) {
+						/*
+						 * This fragment of code should initiate 0
+						 * length transfer in case if it is queued
+						 * a transfer with size divisible to EPs max
+						 * packet size and with usb_request zero field
+						 * is set, which means that after data is transfered,
+						 * it is also should be transfered
+						 * a 0 length packet at the end. For Slave and
+						 * Buffer DMA modes in this case SW has
+						 * to initiate 2 transfers one with transfer size,
+						 * and the second with 0 size. For Descriptor
+						 * DMA mode SW is able to initiate a transfer,
+						 * which will handle all the packets including
+						 * the last  0 length.
+						 */
+						ep->dwc_ep.sent_zlp = 0;
+						dwc_otg_ep_start_zl_transfer
+						    (core_if, &ep->dwc_ep);
+					} else {
+						is_last = 1;
+					}
+				} else {
+					if (ep->dwc_ep.type ==
+					    DWC_OTG_EP_TYPE_ISOC) {
+						req->actual = 0;
+						dwc_otg_request_done(ep, req, 0);
+
+						ep->dwc_ep.start_xfer_buff = 0;
+						ep->dwc_ep.xfer_buff = 0;
+						ep->dwc_ep.xfer_len = 0;
+
+						/* If there is a request in the queue start it. */
+						start_next_request(ep);
+					} else
+						DWC_WARN
+						("Incomplete transfer (%d - %s [siz=%d pkt=%d])\n",
+						ep->dwc_ep.num,
+						(ep->dwc_ep.is_in ? "IN" : "OUT"),
+						deptsiz.b.xfersize,
+						deptsiz.b.pktcnt);
+				}
+			} else {
+				dma_desc = ep->dwc_ep.desc_addr;
+				byte_count = 0;
+				ep->dwc_ep.sent_zlp = 0;
+
+#ifdef DWC_UTE_CFI
+				CFI_INFO("%s: BUFFER_MODE=%d\n", __func__,
+					 ep->dwc_ep.buff_mode);
+				if (ep->dwc_ep.buff_mode != BM_STANDARD) {
+					int residue;
+
+					residue = cfi_calc_desc_residue(ep);
+					if (residue < 0)
+						return;
+
+					byte_count = residue;
+				} else {
+#endif
+					for (i = 0; i < ep->dwc_ep.desc_cnt;
+					     ++i) {
+					desc_sts = dma_desc->status;
+					byte_count += desc_sts.b.bytes;
+					dma_desc++;
+				}
+#ifdef DWC_UTE_CFI
+				}
+#endif
+				if (byte_count == 0) {
+					ep->dwc_ep.xfer_count =
+					    ep->dwc_ep.total_len;
+					is_last = 1;
+				} else {
+					DWC_WARN("Incomplete transfer\n");
+				}
+			}
+		} else {
+			if (deptsiz.b.xfersize == 0 && deptsiz.b.pktcnt == 0) {
+				DWC_DEBUGPL(DBG_PCDV,
+					    "%d-%s len=%d  xfersize=%d pktcnt=%d\n",
+					    ep->dwc_ep.num,
+					    ep->dwc_ep.is_in ? "IN" : "OUT",
+					    ep->dwc_ep.xfer_len,
+					    deptsiz.b.xfersize,
+					    deptsiz.b.pktcnt);
+
+				/*      Check if the whole transfer was completed,
+				 *      if no, setup transfer for next portion of data
+				 */
+				if (ep->dwc_ep.xfer_len < ep->dwc_ep.total_len) {
+					dwc_otg_ep_start_transfer(core_if,
+								  &ep->dwc_ep);
+				} else if (ep->dwc_ep.sent_zlp) {
+					/*
+					 * This fragment of code should initiate 0
+					 * length trasfer in case if it is queued
+					 * a trasfer with size divisible to EPs max
+					 * packet size and with usb_request zero field
+					 * is set, which means that after data is transfered,
+					 * it is also should be transfered
+					 * a 0 length packet at the end. For Slave and
+					 * Buffer DMA modes in this case SW has
+					 * to initiate 2 transfers one with transfer size,
+					 * and the second with 0 size. For Desriptor
+					 * DMA mode SW is able to initiate a transfer,
+					 * which will handle all the packets including
+					 * the last  0 legth.
+					 */
+					ep->dwc_ep.sent_zlp = 0;
+					dwc_otg_ep_start_zl_transfer(core_if,
+								     &ep->dwc_ep);
+				} else {
+					is_last = 1;
+				}
+			} else {
+				DWC_WARN
+				    ("Incomplete transfer (%d-%s [siz=%d pkt=%d])\n",
+				     ep->dwc_ep.num,
+				     (ep->dwc_ep.is_in ? "IN" : "OUT"),
+				     deptsiz.b.xfersize, deptsiz.b.pktcnt);
+			}
+		}
+	} else {
+		dwc_otg_dev_out_ep_regs_t *out_ep_regs =
+		    dev_if->out_ep_regs[ep->dwc_ep.num];
+		desc_sts.d32 = 0;
+		if (core_if->dma_enable) {
+			if (core_if->dma_desc_enable) {
+				dma_desc = ep->dwc_ep.desc_addr;
+				byte_count = 0;
+				ep->dwc_ep.sent_zlp = 0;
+
+#ifdef DWC_UTE_CFI
+				CFI_INFO("%s: BUFFER_MODE=%d\n", __func__,
+					 ep->dwc_ep.buff_mode);
+				if (ep->dwc_ep.buff_mode != BM_STANDARD) {
+					int residue;
+					residue = cfi_calc_desc_residue(ep);
+					if (residue < 0)
+						return;
+					byte_count = residue;
+				} else {
+#endif
+
+					for (i = 0; i < ep->dwc_ep.desc_cnt;
+					     ++i) {
+						desc_sts = dma_desc->status;
+						byte_count += desc_sts.b.bytes;
+						dma_desc++;
+					}
+
+#ifdef DWC_UTE_CFI
+				}
+#endif
+				/* Checking for interrupt Out transfers with not
+				 * dword aligned mps sizes
+				 */
+				if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_INTR &&
+							(ep->dwc_ep.maxpacket%4)) {
+					ep->dwc_ep.xfer_count =
+					    ep->dwc_ep.total_len - byte_count;
+					if ((ep->dwc_ep.xfer_len %
+					     ep->dwc_ep.maxpacket)
+					    && (ep->dwc_ep.xfer_len /
+						ep->dwc_ep.maxpacket <
+						MAX_DMA_DESC_CNT))
+						ep->dwc_ep.xfer_len -=
+						    (ep->dwc_ep.desc_cnt -
+						     1) * ep->dwc_ep.maxpacket +
+						    ep->dwc_ep.xfer_len %
+						    ep->dwc_ep.maxpacket;
+					else
+						ep->dwc_ep.xfer_len -=
+						    ep->dwc_ep.desc_cnt *
+						    ep->dwc_ep.maxpacket;
+					if (ep->dwc_ep.xfer_len > 0) {
+						dwc_otg_ep_start_transfer
+						    (core_if, &ep->dwc_ep);
+					} else {
+						is_last = 1;
+					}
+				} else {
+					ep->dwc_ep.xfer_count =
+					    ep->dwc_ep.total_len - byte_count +
+					    ((4 -
+					      (ep->dwc_ep.
+					       total_len & 0x3)) & 0x3);
+					is_last = 1;
+				}
+			} else {
+				deptsiz.d32 = 0;
+				deptsiz.d32 =
+				    DWC_READ_REG32(&out_ep_regs->doeptsiz);
+
+				byte_count = (ep->dwc_ep.xfer_len -
+					      ep->dwc_ep.xfer_count -
+					      deptsiz.b.xfersize);
+				ep->dwc_ep.xfer_buff += byte_count;
+				ep->dwc_ep.dma_addr += byte_count;
+				ep->dwc_ep.xfer_count += byte_count;
+
+				/*      Check if the whole transfer was completed,
+				 *      if no, setup transfer for next portion of data
+				 */
+				if (ep->dwc_ep.xfer_len < ep->dwc_ep.total_len) {
+					dwc_otg_ep_start_transfer(core_if,
+								  &ep->dwc_ep);
+				} else if (ep->dwc_ep.sent_zlp) {
+					/*
+					 * This fragment of code should initiate 0
+					 * length trasfer in case if it is queued
+					 * a trasfer with size divisible to EPs max
+					 * packet size and with usb_request zero field
+					 * is set, which means that after data is transfered,
+					 * it is also should be transfered
+					 * a 0 length packet at the end. For Slave and
+					 * Buffer DMA modes in this case SW has
+					 * to initiate 2 transfers one with transfer size,
+					 * and the second with 0 size. For Desriptor
+					 * DMA mode SW is able to initiate a transfer,
+					 * which will handle all the packets including
+					 * the last  0 legth.
+					 */
+					ep->dwc_ep.sent_zlp = 0;
+					dwc_otg_ep_start_zl_transfer(core_if,
+								     &ep->dwc_ep);
+				} else {
+					is_last = 1;
+				}
+			}
+		} else {
+			/*      Check if the whole transfer was completed,
+			 *      if no, setup transfer for next portion of data
+			 */
+			if (ep->dwc_ep.xfer_len < ep->dwc_ep.total_len) {
+				dwc_otg_ep_start_transfer(core_if, &ep->dwc_ep);
+			} else if (ep->dwc_ep.sent_zlp) {
+				/*
+				 * This fragment of code should initiate 0
+				 * length transfer in case if it is queued
+				 * a transfer with size divisible to EPs max
+				 * packet size and with usb_request zero field
+				 * is set, which means that after data is transfered,
+				 * it is also should be transfered
+				 * a 0 length packet at the end. For Slave and
+				 * Buffer DMA modes in this case SW has
+				 * to initiate 2 transfers one with transfer size,
+				 * and the second with 0 size. For Descriptor
+				 * DMA mode SW is able to initiate a transfer,
+				 * which will handle all the packets including
+				 * the last  0 length.
+				 */
+				ep->dwc_ep.sent_zlp = 0;
+				dwc_otg_ep_start_zl_transfer(core_if,
+							     &ep->dwc_ep);
+			} else {
+				is_last = 1;
+			}
+		}
+
+		DWC_DEBUGPL(DBG_PCDV,
+			    "addr %p,	 %d-%s len=%d cnt=%d xsize=%d pktcnt=%d\n",
+			    &out_ep_regs->doeptsiz, ep->dwc_ep.num,
+			    ep->dwc_ep.is_in ? "IN" : "OUT",
+			    ep->dwc_ep.xfer_len, ep->dwc_ep.xfer_count,
+			    deptsiz.b.xfersize, deptsiz.b.pktcnt);
+	}
+
+	/* Complete the request */
+	if (is_last) {
+#ifdef DWC_UTE_CFI
+		if (ep->dwc_ep.buff_mode != BM_STANDARD) {
+			req->actual = ep->dwc_ep.cfi_req_len - byte_count;
+		} else {
+#endif
+			req->actual = ep->dwc_ep.xfer_count;
+#ifdef DWC_UTE_CFI
+		}
+#endif
+		if (req->dw_align_buf) {
+			if (!ep->dwc_ep.is_in) {
+				dwc_memcpy(req->buf, req->dw_align_buf, req->length);
+			}
+			DWC_DMA_FREE(dev, req->length, req->dw_align_buf,
+				     req->dw_align_buf_dma);
+		}
+
+		dwc_otg_request_done(ep, req, 0);
+
+		ep->dwc_ep.start_xfer_buff = 0;
+		ep->dwc_ep.xfer_buff = 0;
+		ep->dwc_ep.xfer_len = 0;
+
+		/* If there is a request in the queue start it. */
+		start_next_request(ep);
+	}
+}
+
+#ifdef DWC_EN_ISOC
+
+/**
+ * This function BNA interrupt for Isochronous EPs
+ *
+ */
+static void dwc_otg_pcd_handle_iso_bna(dwc_otg_pcd_ep_t * ep)
+{
+	dwc_ep_t *dwc_ep = &ep->dwc_ep;
+	volatile uint32_t *addr;
+	depctl_data_t depctl = {.d32 = 0 };
+	dwc_otg_pcd_t *pcd = ep->pcd;
+	dwc_otg_dev_dma_desc_t *dma_desc;
+	int i;
+
+	dma_desc =
+	    dwc_ep->iso_desc_addr + dwc_ep->desc_cnt * (dwc_ep->proc_buf_num);
+
+	if (dwc_ep->is_in) {
+		dev_dma_desc_sts_t sts = {.d32 = 0 };
+		for (i = 0; i < dwc_ep->desc_cnt; ++i, ++dma_desc) {
+			sts.d32 = dma_desc->status.d32;
+			sts.b_iso_in.bs = BS_HOST_READY;
+			dma_desc->status.d32 = sts.d32;
+		}
+	} else {
+		dev_dma_desc_sts_t sts = {.d32 = 0 };
+		for (i = 0; i < dwc_ep->desc_cnt; ++i, ++dma_desc) {
+			sts.d32 = dma_desc->status.d32;
+			sts.b_iso_out.bs = BS_HOST_READY;
+			dma_desc->status.d32 = sts.d32;
+		}
+	}
+
+	if (dwc_ep->is_in == 0) {
+		addr =
+		    &GET_CORE_IF(pcd)->dev_if->out_ep_regs[dwc_ep->
+							   num]->doepctl;
+	} else {
+		addr =
+		    &GET_CORE_IF(pcd)->dev_if->in_ep_regs[dwc_ep->num]->diepctl;
+	}
+	depctl.b.epena = 1;
+	DWC_MODIFY_REG32(addr, depctl.d32, depctl.d32);
+}
+
+/**
+ * This function sets latest iso packet information(non-PTI mode)
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ *
+ */
+void set_current_pkt_info(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	deptsiz_data_t deptsiz = {.d32 = 0 };
+	dma_addr_t dma_addr;
+	uint32_t offset;
+
+	if (ep->proc_buf_num)
+		dma_addr = ep->dma_addr1;
+	else
+		dma_addr = ep->dma_addr0;
+
+	if (ep->is_in) {
+		deptsiz.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->
+				   in_ep_regs[ep->num]->dieptsiz);
+		offset = ep->data_per_frame;
+	} else {
+		deptsiz.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->
+				   out_ep_regs[ep->num]->doeptsiz);
+		offset =
+		    ep->data_per_frame +
+		    (0x4 & (0x4 - (ep->data_per_frame & 0x3)));
+	}
+
+	if (!deptsiz.b.xfersize) {
+		ep->pkt_info[ep->cur_pkt].length = ep->data_per_frame;
+		ep->pkt_info[ep->cur_pkt].offset =
+		    ep->cur_pkt_dma_addr - dma_addr;
+		ep->pkt_info[ep->cur_pkt].status = 0;
+	} else {
+		ep->pkt_info[ep->cur_pkt].length = ep->data_per_frame;
+		ep->pkt_info[ep->cur_pkt].offset =
+		    ep->cur_pkt_dma_addr - dma_addr;
+		ep->pkt_info[ep->cur_pkt].status = -DWC_E_NO_DATA;
+	}
+	ep->cur_pkt_addr += offset;
+	ep->cur_pkt_dma_addr += offset;
+	ep->cur_pkt++;
+}
+
+/**
+ * This function sets latest iso packet information(DDMA mode)
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param dwc_ep The EP to start the transfer on.
+ *
+ */
+static void set_ddma_iso_pkts_info(dwc_otg_core_if_t * core_if,
+				   dwc_ep_t * dwc_ep)
+{
+	dwc_otg_dev_dma_desc_t *dma_desc;
+	dev_dma_desc_sts_t sts = {.d32 = 0 };
+	iso_pkt_info_t *iso_packet;
+	uint32_t data_per_desc;
+	uint32_t offset;
+	int i, j;
+
+	iso_packet = dwc_ep->pkt_info;
+
+	/** Reinit closed DMA Descriptors*/
+	/** ISO OUT EP */
+	if (dwc_ep->is_in == 0) {
+		dma_desc =
+		    dwc_ep->iso_desc_addr +
+		    dwc_ep->desc_cnt * dwc_ep->proc_buf_num;
+		offset = 0;
+
+		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
+		     i += dwc_ep->pkt_per_frm) {
+			for (j = 0; j < dwc_ep->pkt_per_frm; ++j) {
+				data_per_desc =
+				    ((j + 1) * dwc_ep->maxpacket >
+				     dwc_ep->
+				     data_per_frame) ? dwc_ep->data_per_frame -
+				    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
+				data_per_desc +=
+				    (data_per_desc % 4) ? (4 -
+							   data_per_desc %
+							   4) : 0;
+
+				sts.d32 = dma_desc->status.d32;
+
+				/* Write status in iso_packet_decsriptor  */
+				iso_packet->status =
+				    sts.b_iso_out.rxsts +
+				    (sts.b_iso_out.bs ^ BS_DMA_DONE);
+				if (iso_packet->status) {
+					iso_packet->status = -DWC_E_NO_DATA;
+				}
+
+				/* Received data length */
+				if (!sts.b_iso_out.rxbytes) {
+					iso_packet->length =
+					    data_per_desc -
+					    sts.b_iso_out.rxbytes;
+				} else {
+					iso_packet->length =
+					    data_per_desc -
+					    sts.b_iso_out.rxbytes + (4 -
+								     dwc_ep->data_per_frame
+								     % 4);
+				}
+
+				iso_packet->offset = offset;
+
+				offset += data_per_desc;
+				dma_desc++;
+				iso_packet++;
+			}
+		}
+
+		for (j = 0; j < dwc_ep->pkt_per_frm - 1; ++j) {
+			data_per_desc =
+			    ((j + 1) * dwc_ep->maxpacket >
+			     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
+			    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
+			data_per_desc +=
+			    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
+
+			sts.d32 = dma_desc->status.d32;
+
+			/* Write status in iso_packet_decsriptor  */
+			iso_packet->status =
+			    sts.b_iso_out.rxsts +
+			    (sts.b_iso_out.bs ^ BS_DMA_DONE);
+			if (iso_packet->status) {
+				iso_packet->status = -DWC_E_NO_DATA;
+			}
+
+			/* Received data length */
+			iso_packet->length =
+			    dwc_ep->data_per_frame - sts.b_iso_out.rxbytes;
+
+			iso_packet->offset = offset;
+
+			offset += data_per_desc;
+			iso_packet++;
+			dma_desc++;
+		}
+
+		sts.d32 = dma_desc->status.d32;
+
+		/* Write status in iso_packet_decsriptor  */
+		iso_packet->status =
+		    sts.b_iso_out.rxsts + (sts.b_iso_out.bs ^ BS_DMA_DONE);
+		if (iso_packet->status) {
+			iso_packet->status = -DWC_E_NO_DATA;
+		}
+		/* Received data length */
+		if (!sts.b_iso_out.rxbytes) {
+			iso_packet->length =
+			    dwc_ep->data_per_frame - sts.b_iso_out.rxbytes;
+		} else {
+			iso_packet->length =
+			    dwc_ep->data_per_frame - sts.b_iso_out.rxbytes +
+			    (4 - dwc_ep->data_per_frame % 4);
+		}
+
+		iso_packet->offset = offset;
+	} else {
+/** ISO IN EP */
+
+		dma_desc =
+		    dwc_ep->iso_desc_addr +
+		    dwc_ep->desc_cnt * dwc_ep->proc_buf_num;
+
+		for (i = 0; i < dwc_ep->desc_cnt - 1; i++) {
+			sts.d32 = dma_desc->status.d32;
+
+			/* Write status in iso packet descriptor */
+			iso_packet->status =
+			    sts.b_iso_in.txsts +
+			    (sts.b_iso_in.bs ^ BS_DMA_DONE);
+			if (iso_packet->status != 0) {
+				iso_packet->status = -DWC_E_NO_DATA;
+
+			}
+			/* Bytes has been transfered */
+			iso_packet->length =
+			    dwc_ep->data_per_frame - sts.b_iso_in.txbytes;
+
+			dma_desc++;
+			iso_packet++;
+		}
+
+		sts.d32 = dma_desc->status.d32;
+		while (sts.b_iso_in.bs == BS_DMA_BUSY) {
+			sts.d32 = dma_desc->status.d32;
+		}
+
+		/* Write status in iso packet descriptor ??? do be done with ERROR codes */
+		iso_packet->status =
+		    sts.b_iso_in.txsts + (sts.b_iso_in.bs ^ BS_DMA_DONE);
+		if (iso_packet->status != 0) {
+			iso_packet->status = -DWC_E_NO_DATA;
+		}
+
+		/* Bytes has been transfered */
+		iso_packet->length =
+		    dwc_ep->data_per_frame - sts.b_iso_in.txbytes;
+	}
+}
+
+/**
+ * This function reinitialize DMA Descriptors for Isochronous transfer
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param dwc_ep The EP to start the transfer on.
+ *
+ */
+static void reinit_ddma_iso_xfer(dwc_otg_core_if_t * core_if, dwc_ep_t * dwc_ep)
+{
+	int i, j;
+	dwc_otg_dev_dma_desc_t *dma_desc;
+	dma_addr_t dma_ad;
+	volatile uint32_t *addr;
+	dev_dma_desc_sts_t sts = {.d32 = 0 };
+	uint32_t data_per_desc;
+
+	if (dwc_ep->is_in == 0) {
+		addr = &core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl;
+	} else {
+		addr = &core_if->dev_if->in_ep_regs[dwc_ep->num]->diepctl;
+	}
+
+	if (dwc_ep->proc_buf_num == 0) {
+		/** Buffer 0 descriptors setup */
+		dma_ad = dwc_ep->dma_addr0;
+	} else {
+		/** Buffer 1 descriptors setup */
+		dma_ad = dwc_ep->dma_addr1;
+	}
+
+	/** Reinit closed DMA Descriptors*/
+	/** ISO OUT EP */
+	if (dwc_ep->is_in == 0) {
+		dma_desc =
+		    dwc_ep->iso_desc_addr +
+		    dwc_ep->desc_cnt * dwc_ep->proc_buf_num;
+
+		sts.b_iso_out.bs = BS_HOST_READY;
+		sts.b_iso_out.rxsts = 0;
+		sts.b_iso_out.l = 0;
+		sts.b_iso_out.sp = 0;
+		sts.b_iso_out.ioc = 0;
+		sts.b_iso_out.pid = 0;
+		sts.b_iso_out.framenum = 0;
+
+		for (i = 0; i < dwc_ep->desc_cnt - dwc_ep->pkt_per_frm;
+		     i += dwc_ep->pkt_per_frm) {
+			for (j = 0; j < dwc_ep->pkt_per_frm; ++j) {
+				data_per_desc =
+				    ((j + 1) * dwc_ep->maxpacket >
+				     dwc_ep->
+				     data_per_frame) ? dwc_ep->data_per_frame -
+				    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
+				data_per_desc +=
+				    (data_per_desc % 4) ? (4 -
+							   data_per_desc %
+							   4) : 0;
+				sts.b_iso_out.rxbytes = data_per_desc;
+				dma_desc->buf = dma_ad;
+				dma_desc->status.d32 = sts.d32;
+
+				dma_ad += data_per_desc;
+				dma_desc++;
+			}
+		}
+
+		for (j = 0; j < dwc_ep->pkt_per_frm - 1; ++j) {
+
+			data_per_desc =
+			    ((j + 1) * dwc_ep->maxpacket >
+			     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
+			    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
+			data_per_desc +=
+			    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
+			sts.b_iso_out.rxbytes = data_per_desc;
+
+			dma_desc->buf = dma_ad;
+			dma_desc->status.d32 = sts.d32;
+
+			dma_desc++;
+			dma_ad += data_per_desc;
+		}
+
+		sts.b_iso_out.ioc = 1;
+		sts.b_iso_out.l = dwc_ep->proc_buf_num;
+
+		data_per_desc =
+		    ((j + 1) * dwc_ep->maxpacket >
+		     dwc_ep->data_per_frame) ? dwc_ep->data_per_frame -
+		    j * dwc_ep->maxpacket : dwc_ep->maxpacket;
+		data_per_desc +=
+		    (data_per_desc % 4) ? (4 - data_per_desc % 4) : 0;
+		sts.b_iso_out.rxbytes = data_per_desc;
+
+		dma_desc->buf = dma_ad;
+		dma_desc->status.d32 = sts.d32;
+	} else {
+/** ISO IN EP */
+
+		dma_desc =
+		    dwc_ep->iso_desc_addr +
+		    dwc_ep->desc_cnt * dwc_ep->proc_buf_num;
+
+		sts.b_iso_in.bs = BS_HOST_READY;
+		sts.b_iso_in.txsts = 0;
+		sts.b_iso_in.sp = 0;
+		sts.b_iso_in.ioc = 0;
+		sts.b_iso_in.pid = dwc_ep->pkt_per_frm;
+		sts.b_iso_in.framenum = dwc_ep->next_frame;
+		sts.b_iso_in.txbytes = dwc_ep->data_per_frame;
+		sts.b_iso_in.l = 0;
+
+		for (i = 0; i < dwc_ep->desc_cnt - 1; i++) {
+			dma_desc->buf = dma_ad;
+			dma_desc->status.d32 = sts.d32;
+
+			sts.b_iso_in.framenum += dwc_ep->bInterval;
+			dma_ad += dwc_ep->data_per_frame;
+			dma_desc++;
+		}
+
+		sts.b_iso_in.ioc = 1;
+		sts.b_iso_in.l = dwc_ep->proc_buf_num;
+
+		dma_desc->buf = dma_ad;
+		dma_desc->status.d32 = sts.d32;
+
+		dwc_ep->next_frame =
+		    sts.b_iso_in.framenum + dwc_ep->bInterval * 1;
+	}
+	dwc_ep->proc_buf_num = (dwc_ep->proc_buf_num ^ 1) & 0x1;
+}
+
+/**
+ * This function is to handle Iso EP transfer complete interrupt
+ * in case Iso out packet was dropped
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param dwc_ep The EP for wihich transfer complete was asserted
+ *
+ */
+static uint32_t handle_iso_out_pkt_dropped(dwc_otg_core_if_t * core_if,
+					   dwc_ep_t * dwc_ep)
+{
+	uint32_t dma_addr;
+	uint32_t drp_pkt;
+	uint32_t drp_pkt_cnt;
+	deptsiz_data_t deptsiz = {.d32 = 0 };
+	depctl_data_t depctl = {.d32 = 0 };
+	int i;
+
+	deptsiz.d32 =
+	    DWC_READ_REG32(&core_if->dev_if->
+			   out_ep_regs[dwc_ep->num]->doeptsiz);
+
+	drp_pkt = dwc_ep->pkt_cnt - deptsiz.b.pktcnt;
+	drp_pkt_cnt = dwc_ep->pkt_per_frm - (drp_pkt % dwc_ep->pkt_per_frm);
+
+	/* Setting dropped packets status */
+	for (i = 0; i < drp_pkt_cnt; ++i) {
+		dwc_ep->pkt_info[drp_pkt].status = -DWC_E_NO_DATA;
+		drp_pkt++;
+		deptsiz.b.pktcnt--;
+	}
+
+	if (deptsiz.b.pktcnt > 0) {
+		deptsiz.b.xfersize =
+		    dwc_ep->xfer_len - (dwc_ep->pkt_cnt -
+					deptsiz.b.pktcnt) * dwc_ep->maxpacket;
+	} else {
+		deptsiz.b.xfersize = 0;
+		deptsiz.b.pktcnt = 0;
+	}
+
+	DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doeptsiz,
+			deptsiz.d32);
+
+	if (deptsiz.b.pktcnt > 0) {
+		if (dwc_ep->proc_buf_num) {
+			dma_addr =
+			    dwc_ep->dma_addr1 + dwc_ep->xfer_len -
+			    deptsiz.b.xfersize;
+		} else {
+			dma_addr =
+			    dwc_ep->dma_addr0 + dwc_ep->xfer_len -
+			    deptsiz.b.xfersize;;
+		}
+
+		DWC_WRITE_REG32(&core_if->dev_if->
+				out_ep_regs[dwc_ep->num]->doepdma, dma_addr);
+
+		/** Re-enable endpoint, clear nak  */
+		depctl.d32 = 0;
+		depctl.b.epena = 1;
+		depctl.b.cnak = 1;
+
+		DWC_MODIFY_REG32(&core_if->dev_if->
+				 out_ep_regs[dwc_ep->num]->doepctl, depctl.d32,
+				 depctl.d32);
+		return 0;
+	} else {
+		return 1;
+	}
+}
+
+/**
+ * This function sets iso packets information(PTI mode)
+ *
+ * @param core_if Programming view of DWC_otg controller.
+ * @param ep The EP to start the transfer on.
+ *
+ */
+static uint32_t set_iso_pkts_info(dwc_otg_core_if_t * core_if, dwc_ep_t * ep)
+{
+	int i, j;
+	dma_addr_t dma_ad;
+	iso_pkt_info_t *packet_info = ep->pkt_info;
+	uint32_t offset;
+	uint32_t frame_data;
+	deptsiz_data_t deptsiz;
+
+	if (ep->proc_buf_num == 0) {
+		/** Buffer 0 descriptors setup */
+		dma_ad = ep->dma_addr0;
+	} else {
+		/** Buffer 1 descriptors setup */
+		dma_ad = ep->dma_addr1;
+	}
+
+	if (ep->is_in) {
+		deptsiz.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->in_ep_regs[ep->num]->
+				   dieptsiz);
+	} else {
+		deptsiz.d32 =
+		    DWC_READ_REG32(&core_if->dev_if->out_ep_regs[ep->num]->
+				   doeptsiz);
+	}
+
+	if (!deptsiz.b.xfersize) {
+		offset = 0;
+		for (i = 0; i < ep->pkt_cnt; i += ep->pkt_per_frm) {
+			frame_data = ep->data_per_frame;
+			for (j = 0; j < ep->pkt_per_frm; ++j) {
+
+				/* Packet status - is not set as initially
+				 * it is set to 0 and if packet was sent
+				 successfully, status field will remain 0*/
+
+				/* Bytes has been transfered */
+				packet_info->length =
+				    (ep->maxpacket <
+				     frame_data) ? ep->maxpacket : frame_data;
+
+				/* Received packet offset */
+				packet_info->offset = offset;
+				offset += packet_info->length;
+				frame_data -= packet_info->length;
+
+				packet_info++;
+			}
+		}
+		return 1;
+	} else {
+		/* This is a workaround for in case of Transfer Complete with
+		 * PktDrpSts interrupts merging - in this case Transfer complete
+		 * interrupt for Isoc Out Endpoint is asserted without PktDrpSts
+		 * set and with DOEPTSIZ register non zero. Investigations showed,
+		 * that this happens when Out packet is dropped, but because of
+		 * interrupts merging during first interrupt handling PktDrpSts
+		 * bit is cleared and for next merged interrupts it is not reset.
+		 * In this case SW hadles the interrupt as if PktDrpSts bit is set.
+		 */
+		if (ep->is_in) {
+			return 1;
+		} else {
+			return handle_iso_out_pkt_dropped(core_if, ep);
+		}
+	}
+}
+
+/**
+ * This function is to handle Iso EP transfer complete interrupt
+ *
+ * @param pcd The PCD
+ * @param ep The EP for which transfer complete was asserted
+ *
+ */
+static void complete_iso_ep(dwc_otg_pcd_t * pcd, dwc_otg_pcd_ep_t * ep)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(ep->pcd);
+	dwc_ep_t *dwc_ep = &ep->dwc_ep;
+	uint8_t is_last = 0;
+
+	if (ep->dwc_ep.next_frame == 0xffffffff) {
+		DWC_WARN("Next frame is not set!\n");
+		return;
+	}
+
+	if (core_if->dma_enable) {
+		if (core_if->dma_desc_enable) {
+			set_ddma_iso_pkts_info(core_if, dwc_ep);
+			reinit_ddma_iso_xfer(core_if, dwc_ep);
+			is_last = 1;
+		} else {
+			if (core_if->pti_enh_enable) {
+				if (set_iso_pkts_info(core_if, dwc_ep)) {
+					dwc_ep->proc_buf_num =
+					    (dwc_ep->proc_buf_num ^ 1) & 0x1;
+					dwc_otg_iso_ep_start_buf_transfer
+					    (core_if, dwc_ep);
+					is_last = 1;
+				}
+			} else {
+				set_current_pkt_info(core_if, dwc_ep);
+				if (dwc_ep->cur_pkt >= dwc_ep->pkt_cnt) {
+					is_last = 1;
+					dwc_ep->cur_pkt = 0;
+					dwc_ep->proc_buf_num =
+					    (dwc_ep->proc_buf_num ^ 1) & 0x1;
+					if (dwc_ep->proc_buf_num) {
+						dwc_ep->cur_pkt_addr =
+						    dwc_ep->xfer_buff1;
+						dwc_ep->cur_pkt_dma_addr =
+						    dwc_ep->dma_addr1;
+					} else {
+						dwc_ep->cur_pkt_addr =
+						    dwc_ep->xfer_buff0;
+						dwc_ep->cur_pkt_dma_addr =
+						    dwc_ep->dma_addr0;
+					}
+
+				}
+				dwc_otg_iso_ep_start_frm_transfer(core_if,
+								  dwc_ep);
+			}
+		}
+	} else {
+		set_current_pkt_info(core_if, dwc_ep);
+		if (dwc_ep->cur_pkt >= dwc_ep->pkt_cnt) {
+			is_last = 1;
+			dwc_ep->cur_pkt = 0;
+			dwc_ep->proc_buf_num = (dwc_ep->proc_buf_num ^ 1) & 0x1;
+			if (dwc_ep->proc_buf_num) {
+				dwc_ep->cur_pkt_addr = dwc_ep->xfer_buff1;
+				dwc_ep->cur_pkt_dma_addr = dwc_ep->dma_addr1;
+			} else {
+				dwc_ep->cur_pkt_addr = dwc_ep->xfer_buff0;
+				dwc_ep->cur_pkt_dma_addr = dwc_ep->dma_addr0;
+			}
+
+		}
+		dwc_otg_iso_ep_start_frm_transfer(core_if, dwc_ep);
+	}
+	if (is_last)
+		dwc_otg_iso_buffer_done(pcd, ep, ep->iso_req_handle);
+}
+#endif /* DWC_EN_ISOC */
+
+/**
+ * This function handle BNA interrupt for Non Isochronous EPs
+ *
+ */
+static void dwc_otg_pcd_handle_noniso_bna(dwc_otg_pcd_ep_t * ep)
+{
+	dwc_ep_t *dwc_ep = &ep->dwc_ep;
+	volatile uint32_t *addr;
+	depctl_data_t depctl = {.d32 = 0 };
+	dwc_otg_pcd_t *pcd = ep->pcd;
+	dwc_otg_dev_dma_desc_t *dma_desc;
+	dev_dma_desc_sts_t sts = {.d32 = 0 };
+	dwc_otg_core_if_t *core_if = ep->pcd->core_if;
+	int i, start;
+
+	if (!dwc_ep->desc_cnt)
+		DWC_WARN("Ep%d %s Descriptor count = %d \n", dwc_ep->num,
+			 (dwc_ep->is_in ? "IN" : "OUT"), dwc_ep->desc_cnt);
+
+	if (core_if->core_params->cont_on_bna && !dwc_ep->is_in
+							&& dwc_ep->type != DWC_OTG_EP_TYPE_CONTROL) {
+		uint32_t doepdma;
+		dwc_otg_dev_out_ep_regs_t *out_regs =
+			core_if->dev_if->out_ep_regs[dwc_ep->num];
+		doepdma = DWC_READ_REG32(&(out_regs->doepdma));
+		start = (doepdma - dwc_ep->dma_desc_addr)/sizeof(dwc_otg_dev_dma_desc_t);
+		dma_desc = &(dwc_ep->desc_addr[start]);
+	} else {
+		start = 0;
+		dma_desc = dwc_ep->desc_addr;
+	}
+
+
+	for (i = start; i < dwc_ep->desc_cnt; ++i, ++dma_desc) {
+		sts.d32 = dma_desc->status.d32;
+		sts.b.bs = BS_HOST_READY;
+		dma_desc->status.d32 = sts.d32;
+	}
+
+	if (dwc_ep->is_in == 0) {
+		addr =
+		    &GET_CORE_IF(pcd)->dev_if->out_ep_regs[dwc_ep->num]->
+		    doepctl;
+	} else {
+		addr =
+		    &GET_CORE_IF(pcd)->dev_if->in_ep_regs[dwc_ep->num]->diepctl;
+	}
+	depctl.b.epena = 1;
+	depctl.b.cnak = 1;
+	DWC_MODIFY_REG32(addr, 0, depctl.d32);
+}
+
+/**
+ * This function handles EP0 Control transfers.
+ *
+ * The state of the control transfers are tracked in
+ * <code>ep0state</code>.
+ */
+static void handle_ep0(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_pcd_ep_t *ep0 = &pcd->ep0;
+	dev_dma_desc_sts_t desc_sts;
+	deptsiz0_data_t deptsiz;
+	uint32_t byte_count;
+
+#ifdef DEBUG_EP0
+	DWC_DEBUGPL(DBG_PCDV, "%s()\n", __func__);
+	print_ep0_state(pcd);
+#endif
+
+//      DWC_PRINTF("HANDLE EP0\n");
+
+	switch (pcd->ep0state) {
+	case EP0_DISCONNECT:
+		break;
+
+	case EP0_IDLE:
+		pcd->request_config = 0;
+
+		pcd_setup(pcd);
+		break;
+
+	case EP0_IN_DATA_PHASE:
+#ifdef DEBUG_EP0
+		DWC_DEBUGPL(DBG_PCD, "DATA_IN EP%d-%s: type=%d, mps=%d\n",
+			    ep0->dwc_ep.num, (ep0->dwc_ep.is_in ? "IN" : "OUT"),
+			    ep0->dwc_ep.type, ep0->dwc_ep.maxpacket);
+#endif
+
+		if (core_if->dma_enable != 0) {
+			/*
+			 * For EP0 we can only program 1 packet at a time so we
+			 * need to do the make calculations after each complete.
+			 * Call write_packet to make the calculations, as in
+			 * slave mode, and use those values to determine if we
+			 * can complete.
+			 */
+			if (core_if->dma_desc_enable == 0) {
+				deptsiz.d32 =
+				    DWC_READ_REG32(&core_if->
+						   dev_if->in_ep_regs[0]->
+						   dieptsiz);
+				byte_count =
+				    ep0->dwc_ep.xfer_len - deptsiz.b.xfersize;
+			} else {
+				desc_sts =
+				    core_if->dev_if->in_desc_addr->status;
+				byte_count =
+				    ep0->dwc_ep.xfer_len - desc_sts.b.bytes;
+			}
+			ep0->dwc_ep.xfer_count += byte_count;
+			ep0->dwc_ep.xfer_buff += byte_count;
+			ep0->dwc_ep.dma_addr += byte_count;
+		}
+		if (ep0->dwc_ep.xfer_count < ep0->dwc_ep.total_len) {
+			dwc_otg_ep0_continue_transfer(GET_CORE_IF(pcd),
+						      &ep0->dwc_ep);
+			DWC_DEBUGPL(DBG_PCD, "CONTINUE TRANSFER\n");
+		} else if (ep0->dwc_ep.sent_zlp) {
+			dwc_otg_ep0_continue_transfer(GET_CORE_IF(pcd),
+						      &ep0->dwc_ep);
+			ep0->dwc_ep.sent_zlp = 0;
+			DWC_DEBUGPL(DBG_PCD, "CONTINUE TRANSFER sent zlp\n");
+		} else {
+			ep0_complete_request(ep0);
+			DWC_DEBUGPL(DBG_PCD, "COMPLETE TRANSFER\n");
+		}
+		break;
+	case EP0_OUT_DATA_PHASE:
+#ifdef DEBUG_EP0
+		DWC_DEBUGPL(DBG_PCD, "DATA_OUT EP%d-%s: type=%d, mps=%d\n",
+			    ep0->dwc_ep.num, (ep0->dwc_ep.is_in ? "IN" : "OUT"),
+			    ep0->dwc_ep.type, ep0->dwc_ep.maxpacket);
+#endif
+		if (core_if->dma_enable != 0) {
+			if (core_if->dma_desc_enable == 0) {
+				deptsiz.d32 =
+				    DWC_READ_REG32(&core_if->
+						   dev_if->out_ep_regs[0]->
+						   doeptsiz);
+				byte_count =
+				    ep0->dwc_ep.maxpacket - deptsiz.b.xfersize;
+			} else {
+				desc_sts =
+				    core_if->dev_if->out_desc_addr->status;
+				byte_count =
+				    ep0->dwc_ep.maxpacket - desc_sts.b.bytes;
+			}
+			ep0->dwc_ep.xfer_count += byte_count;
+			ep0->dwc_ep.xfer_buff += byte_count;
+			ep0->dwc_ep.dma_addr += byte_count;
+		}
+		if (ep0->dwc_ep.xfer_count < ep0->dwc_ep.total_len) {
+			dwc_otg_ep0_continue_transfer(GET_CORE_IF(pcd),
+						      &ep0->dwc_ep);
+			DWC_DEBUGPL(DBG_PCD, "CONTINUE TRANSFER\n");
+		} else if (ep0->dwc_ep.sent_zlp) {
+			dwc_otg_ep0_continue_transfer(GET_CORE_IF(pcd),
+						      &ep0->dwc_ep);
+			ep0->dwc_ep.sent_zlp = 0;
+			DWC_DEBUGPL(DBG_PCD, "CONTINUE TRANSFER sent zlp\n");
+		} else {
+			ep0_complete_request(ep0);
+			DWC_DEBUGPL(DBG_PCD, "COMPLETE TRANSFER\n");
+		}
+		break;
+
+	case EP0_IN_STATUS_PHASE:
+	case EP0_OUT_STATUS_PHASE:
+		DWC_DEBUGPL(DBG_PCD, "CASE: EP0_STATUS\n");
+		ep0_complete_request(ep0);
+		pcd->ep0state = EP0_IDLE;
+		ep0->stopped = 1;
+		ep0->dwc_ep.is_in = 0;	/* OUT for next SETUP */
+
+		/* Prepare for more SETUP Packets */
+		if (core_if->dma_enable) {
+			ep0_out_start(core_if, pcd);
+		}
+		break;
+
+	case EP0_STALL:
+		DWC_ERROR("EP0 STALLed, should not get here pcd_setup()\n");
+		break;
+	}
+#ifdef DEBUG_EP0
+	print_ep0_state(pcd);
+#endif
+}
+
+/**
+ * Restart transfer
+ */
+static void restart_transfer(dwc_otg_pcd_t * pcd, const uint32_t epnum)
+{
+	dwc_otg_core_if_t *core_if;
+	dwc_otg_dev_if_t *dev_if;
+	deptsiz_data_t dieptsiz = {.d32 = 0 };
+	dwc_otg_pcd_ep_t *ep;
+
+	ep = get_in_ep(pcd, epnum);
+
+#ifdef DWC_EN_ISOC
+	if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
+		return;
+	}
+#endif /* DWC_EN_ISOC  */
+
+	core_if = GET_CORE_IF(pcd);
+	dev_if = core_if->dev_if;
+
+	dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dieptsiz);
+
+	DWC_DEBUGPL(DBG_PCD, "xfer_buff=%p xfer_count=%0x xfer_len=%0x"
+		    " stopped=%d\n", ep->dwc_ep.xfer_buff,
+		    ep->dwc_ep.xfer_count, ep->dwc_ep.xfer_len, ep->stopped);
+	/*
+	 * If xfersize is 0 and pktcnt in not 0, resend the last packet.
+	 */
+	if (dieptsiz.b.pktcnt && dieptsiz.b.xfersize == 0 &&
+	    ep->dwc_ep.start_xfer_buff != 0) {
+		if (ep->dwc_ep.total_len <= ep->dwc_ep.maxpacket) {
+			ep->dwc_ep.xfer_count = 0;
+			ep->dwc_ep.xfer_buff = ep->dwc_ep.start_xfer_buff;
+			ep->dwc_ep.xfer_len = ep->dwc_ep.xfer_count;
+		} else {
+			ep->dwc_ep.xfer_count -= ep->dwc_ep.maxpacket;
+			/* convert packet size to dwords. */
+			ep->dwc_ep.xfer_buff -= ep->dwc_ep.maxpacket;
+			ep->dwc_ep.xfer_len = ep->dwc_ep.xfer_count;
+		}
+		ep->stopped = 0;
+		DWC_DEBUGPL(DBG_PCD, "xfer_buff=%p xfer_count=%0x "
+			    "xfer_len=%0x stopped=%d\n",
+			    ep->dwc_ep.xfer_buff,
+			    ep->dwc_ep.xfer_count, ep->dwc_ep.xfer_len,
+			    ep->stopped);
+		if (epnum == 0) {
+			dwc_otg_ep0_start_transfer(core_if, &ep->dwc_ep);
+		} else {
+			dwc_otg_ep_start_transfer(core_if, &ep->dwc_ep);
+		}
+	}
+}
+
+/*
+ * This function create new nextep sequnce based on Learn Queue.
+ *
+ * @param core_if Programming view of DWC_otg controller
+ */
+void predict_nextep_seq( dwc_otg_core_if_t * core_if)
+{
+	dwc_otg_device_global_regs_t *dev_global_regs =
+	    core_if->dev_if->dev_global_regs;
+	const uint32_t TOKEN_Q_DEPTH = core_if->hwcfg2.b.dev_token_q_depth;
+	/* Number of Token Queue Registers */
+	const int DTKNQ_REG_CNT = (TOKEN_Q_DEPTH + 7) / 8;
+	dtknq1_data_t dtknqr1;
+	uint32_t in_tkn_epnums[4];
+	uint8_t seqnum[MAX_EPS_CHANNELS];
+	uint8_t intkn_seq[TOKEN_Q_DEPTH];
+	grstctl_t resetctl = {.d32 = 0 };
+	uint8_t temp;
+	int ndx = 0;
+	int start = 0;
+	int end = 0;
+	int sort_done = 0;
+	int i = 0;
+	volatile uint32_t *addr = &dev_global_regs->dtknqr1;
+
+
+	DWC_DEBUGPL(DBG_PCD,"dev_token_q_depth=%d\n",TOKEN_Q_DEPTH);
+
+	/* Read the DTKNQ Registers */
+	for (i = 0; i < DTKNQ_REG_CNT; i++) {
+		in_tkn_epnums[i] = DWC_READ_REG32(addr);
+		DWC_DEBUGPL(DBG_PCDV, "DTKNQR%d=0x%08x\n", i + 1,
+			    in_tkn_epnums[i]);
+		if (addr == &dev_global_regs->dvbusdis) {
+			addr = &dev_global_regs->dtknqr3_dthrctl;
+		} else {
+			++addr;
+		}
+
+	}
+
+	/* Copy the DTKNQR1 data to the bit field. */
+	dtknqr1.d32 = in_tkn_epnums[0];
+	if (dtknqr1.b.wrap_bit) {
+		ndx = dtknqr1.b.intknwptr;
+		end = ndx -1;
+		if (end < 0)
+			end = TOKEN_Q_DEPTH -1;
+	} else {
+		ndx = 0;
+		end = dtknqr1.b.intknwptr -1;
+		if (end < 0)
+			end = 0;
+	}
+	start = ndx;
+
+	/* Fill seqnum[] by initial values: EP number + 31 */
+	for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
+		seqnum[i] = i +31;
+	}
+
+	/* Fill intkn_seq[] from in_tkn_epnums[0] */
+	for (i=0; i < 6; i++)
+		intkn_seq[i] = (in_tkn_epnums[0] >> ((7-i) * 4)) & 0xf;
+
+	if (TOKEN_Q_DEPTH > 6) {
+		/* Fill intkn_seq[] from in_tkn_epnums[1] */
+		for (i=6; i < 14; i++)
+			intkn_seq[i] =
+			    (in_tkn_epnums[1] >> ((7 - (i - 6)) * 4)) & 0xf;
+	}
+
+	if (TOKEN_Q_DEPTH > 14) {
+		/* Fill intkn_seq[] from in_tkn_epnums[1] */
+		for (i=14; i < 22; i++)
+			intkn_seq[i] =
+			    (in_tkn_epnums[2] >> ((7 - (i - 14)) * 4)) & 0xf;
+	}
+
+	if (TOKEN_Q_DEPTH > 22) {
+		/* Fill intkn_seq[] from in_tkn_epnums[1] */
+		for (i=22; i < 30; i++)
+			intkn_seq[i] =
+			    (in_tkn_epnums[3] >> ((7 - (i - 22)) * 4)) & 0xf;
+	}
+
+	DWC_DEBUGPL(DBG_PCDV, "%s start=%d end=%d intkn_seq[]:\n", __func__,
+		    start, end);
+	for (i=0; i<TOKEN_Q_DEPTH; i++)
+		DWC_DEBUGPL(DBG_PCDV,"%d\n", intkn_seq[i]);
+
+	/* Update seqnum based on intkn_seq[] */
+	i = 0;
+	do {
+		seqnum[intkn_seq[ndx]] = i;
+		ndx++;
+		i++;
+		if (ndx == TOKEN_Q_DEPTH)
+			ndx = 0;
+	} while ( i < TOKEN_Q_DEPTH );
+
+	/* Mark non active EP's in seqnum[] by 0xff */
+	for (i=0; i<=core_if->dev_if->num_in_eps; i++) {
+		if (core_if->nextep_seq[i] == 0xff )
+			seqnum[i] = 0xff;
+	}
+
+	/* Sort seqnum[] */
+	sort_done = 0;
+	while (!sort_done) {
+		sort_done = 1;
+		for (i=0; i<core_if->dev_if->num_in_eps; i++) {
+			if (seqnum[i] > seqnum[i+1]) {
+				temp = seqnum[i];
+				seqnum[i] = seqnum[i+1];
+				seqnum[i+1] = temp;
+				sort_done = 0;
+			}
+		}
+	}
+
+	ndx = start + seqnum[0];
+	if (ndx >= TOKEN_Q_DEPTH)
+		ndx = ndx % TOKEN_Q_DEPTH;
+	core_if->first_in_nextep_seq = intkn_seq[ndx];
+
+	/* Update seqnum[] by EP numbers  */
+	for (i=0; i<=core_if->dev_if->num_in_eps; i++) {
+		ndx = start + i;
+		if (seqnum[i] < 31) {
+			ndx = start + seqnum[i];
+			if (ndx >= TOKEN_Q_DEPTH)
+				ndx = ndx % TOKEN_Q_DEPTH;
+			seqnum[i] = intkn_seq[ndx];
+		} else {
+			if (seqnum[i] < 0xff) {
+				seqnum[i] = seqnum[i] - 31;
+			} else {
+				break;
+			}
+		}
+	}
+
+	/* Update nextep_seq[] based on seqnum[] */
+	for (i=0; i<core_if->dev_if->num_in_eps; i++) {
+		if (seqnum[i] != 0xff) {
+			if (seqnum[i+1] != 0xff) {
+				core_if->nextep_seq[seqnum[i]] = seqnum[i+1];
+			} else {
+				core_if->nextep_seq[seqnum[i]] = core_if->first_in_nextep_seq;
+				break;
+			}
+		} else {
+			break;
+		}
+	}
+
+	DWC_DEBUGPL(DBG_PCDV, "%s first_in_nextep_seq= %2d; nextep_seq[]:\n",
+		__func__, core_if->first_in_nextep_seq);
+	for (i=0; i <= core_if->dev_if->num_in_eps; i++) {
+		DWC_DEBUGPL(DBG_PCDV,"%2d\n", core_if->nextep_seq[i]);
+	}
+
+	/* Flush the Learning Queue */
+	resetctl.d32 = DWC_READ_REG32(&core_if->core_global_regs->grstctl);
+	resetctl.b.intknqflsh = 1;
+	DWC_WRITE_REG32(&core_if->core_global_regs->grstctl, resetctl.d32);
+
+
+}
+
+/**
+ * handle the IN EP disable interrupt.
+ */
+static inline void handle_in_ep_disable_intr(dwc_otg_pcd_t * pcd,
+					     const uint32_t epnum)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	deptsiz_data_t dieptsiz = {.d32 = 0 };
+	dctl_data_t dctl = {.d32 = 0 };
+	dwc_otg_pcd_ep_t *ep;
+	dwc_ep_t *dwc_ep;
+	gintmsk_data_t gintmsk_data;
+	depctl_data_t depctl;
+	uint32_t diepdma;
+	uint32_t remain_to_transfer = 0;
+	uint8_t i;
+	uint32_t xfer_size;
+
+	ep = get_in_ep(pcd, epnum);
+	dwc_ep = &ep->dwc_ep;
+
+	if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
+		dwc_otg_flush_tx_fifo(core_if, dwc_ep->tx_fifo_num);
+		complete_ep(ep);
+		return;
+	}
+
+	DWC_DEBUGPL(DBG_PCD, "diepctl%d=%0x\n", epnum,
+		    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->diepctl));
+	dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->dieptsiz);
+	depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->diepctl);
+
+	DWC_DEBUGPL(DBG_ANY, "pktcnt=%d size=%d\n",
+		    dieptsiz.b.pktcnt, dieptsiz.b.xfersize);
+
+	if ((core_if->start_predict == 0) || (depctl.b.eptype & 1)) {
+		if (ep->stopped) {
+			if (core_if->en_multiple_tx_fifo)
+				/* Flush the Tx FIFO */
+				dwc_otg_flush_tx_fifo(core_if, dwc_ep->tx_fifo_num);
+			/* Clear the Global IN NP NAK */
+			dctl.d32 = 0;
+			dctl.b.cgnpinnak = 1;
+			DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
+			/* Restart the transaction */
+			if (dieptsiz.b.pktcnt != 0 || dieptsiz.b.xfersize != 0) {
+				restart_transfer(pcd, epnum);
+			}
+		} else {
+			/* Restart the transaction */
+			if (dieptsiz.b.pktcnt != 0 || dieptsiz.b.xfersize != 0) {
+				restart_transfer(pcd, epnum);
+			}
+			DWC_DEBUGPL(DBG_ANY, "STOPPED!!!\n");
+		}
+		return;
+	}
+
+	if (core_if->start_predict > 2) {	// NP IN EP
+		core_if->start_predict--;
+		return;
+	}
+
+	core_if->start_predict--;
+
+	if (core_if->start_predict == 1) {	// All NP IN Ep's disabled now
+
+		predict_nextep_seq(core_if);
+
+		/* Update all active IN EP's NextEP field based of nextep_seq[] */
+		for ( i = 0; i <= core_if->dev_if->num_in_eps; i++) {
+			depctl.d32 =
+			    DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
+			if (core_if->nextep_seq[i] != 0xff) {	// Active NP IN EP
+				depctl.b.nextep = core_if->nextep_seq[i];
+				DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepctl, depctl.d32);
+			}
+		}
+		/* Flush Shared NP TxFIFO */
+		dwc_otg_flush_tx_fifo(core_if, 0);
+		/* Rewind buffers */
+		if (!core_if->dma_desc_enable) {
+			i = core_if->first_in_nextep_seq;
+			do {
+				ep = get_in_ep(pcd, i);
+				dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->dieptsiz);
+				xfer_size = ep->dwc_ep.total_len - ep->dwc_ep.xfer_count;
+				if (xfer_size > ep->dwc_ep.maxxfer)
+					xfer_size = ep->dwc_ep.maxxfer;
+				depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
+				if (dieptsiz.b.pktcnt != 0) {
+					if (xfer_size == 0) {
+						remain_to_transfer = 0;
+					} else {
+						if ((xfer_size % ep->dwc_ep.maxpacket) == 0) {
+							remain_to_transfer =
+								dieptsiz.b.pktcnt * ep->dwc_ep.maxpacket;
+						} else {
+							remain_to_transfer = ((dieptsiz.b.pktcnt -1) * ep->dwc_ep.maxpacket)
+								+ (xfer_size % ep->dwc_ep.maxpacket);
+						}
+					}
+					diepdma = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepdma);
+					dieptsiz.b.xfersize = remain_to_transfer;
+					DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->dieptsiz, dieptsiz.d32);
+					diepdma = ep->dwc_ep.dma_addr + (xfer_size - remain_to_transfer);
+					DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepdma, diepdma);
+				}
+				i = core_if->nextep_seq[i];
+			} while (i != core_if->first_in_nextep_seq);
+		} else { // dma_desc_enable
+				DWC_PRINTF("%s Learning Queue not supported in DDMA\n", __func__);
+		}
+
+		/* Restart transfers in predicted sequences */
+		i = core_if->first_in_nextep_seq;
+		do {
+			dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->dieptsiz);
+			depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
+			if (dieptsiz.b.pktcnt != 0) {
+				depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
+				depctl.b.epena = 1;
+				depctl.b.cnak = 1;
+				DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepctl, depctl.d32);
+			}
+			i = core_if->nextep_seq[i];
+		} while (i != core_if->first_in_nextep_seq);
+
+		/* Clear the global non-periodic IN NAK handshake */
+		dctl.d32 = 0;
+		dctl.b.cgnpinnak = 1;
+		DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
+
+		/* Unmask EP Mismatch interrupt */
+		gintmsk_data.d32 = 0;
+		gintmsk_data.b.epmismatch = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, 0, gintmsk_data.d32);
+
+		core_if->start_predict = 0;
+
+	}
+}
+
+/**
+ * Handler for the IN EP timeout handshake interrupt.
+ */
+static inline void handle_in_ep_timeout_intr(dwc_otg_pcd_t * pcd,
+					     const uint32_t epnum)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+
+#ifdef DEBUG
+	deptsiz_data_t dieptsiz = {.d32 = 0 };
+	uint32_t num = 0;
+#endif
+	dctl_data_t dctl = {.d32 = 0 };
+	dwc_otg_pcd_ep_t *ep;
+
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	ep = get_in_ep(pcd, epnum);
+
+	/* Disable the NP Tx Fifo Empty Interrrupt */
+	if (!core_if->dma_enable) {
+		intr_mask.b.nptxfempty = 1;
+		DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk,
+				 intr_mask.d32, 0);
+	}
+	/** @todo NGS Check EP type.
+	 * Implement for Periodic EPs */
+	/*
+	 * Non-periodic EP
+	 */
+	/* Enable the Global IN NAK Effective Interrupt */
+	intr_mask.b.ginnakeff = 1;
+	DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk, 0, intr_mask.d32);
+
+	/* Set Global IN NAK */
+	dctl.b.sgnpinnak = 1;
+	DWC_MODIFY_REG32(&dev_if->dev_global_regs->dctl, dctl.d32, dctl.d32);
+
+	ep->stopped = 1;
+
+#ifdef DEBUG
+	dieptsiz.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[num]->dieptsiz);
+	DWC_DEBUGPL(DBG_ANY, "pktcnt=%d size=%d\n",
+		    dieptsiz.b.pktcnt, dieptsiz.b.xfersize);
+#endif
+
+#ifdef DISABLE_PERIODIC_EP
+	/*
+	 * Set the NAK bit for this EP to
+	 * start the disable process.
+	 */
+	diepctl.d32 = 0;
+	diepctl.b.snak = 1;
+	DWC_MODIFY_REG32(&dev_if->in_ep_regs[num]->diepctl, diepctl.d32,
+			 diepctl.d32);
+	ep->disabling = 1;
+	ep->stopped = 1;
+#endif
+}
+
+/**
+ * Handler for the IN EP NAK interrupt.
+ */
+static inline int32_t handle_in_ep_nak_intr(dwc_otg_pcd_t * pcd,
+					    const uint32_t epnum)
+{
+	/** @todo implement ISR */
+	dwc_otg_core_if_t *core_if;
+	diepmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n", "IN EP NAK");
+	core_if = GET_CORE_IF(pcd);
+	intr_mask.b.nak = 1;
+
+	if (core_if->multiproc_int_enable) {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
+				 diepeachintmsk[epnum], intr_mask.d32, 0);
+	} else {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->diepmsk,
+				 intr_mask.d32, 0);
+	}
+
+	return 1;
+}
+
+/**
+ * Handler for the OUT EP Babble interrupt.
+ */
+static inline int32_t handle_out_ep_babble_intr(dwc_otg_pcd_t * pcd,
+						const uint32_t epnum)
+{
+	/** @todo implement ISR */
+	dwc_otg_core_if_t *core_if;
+	doepmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n",
+		   "OUT EP Babble");
+	core_if = GET_CORE_IF(pcd);
+	intr_mask.b.babble = 1;
+
+	if (core_if->multiproc_int_enable) {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
+				 doepeachintmsk[epnum], intr_mask.d32, 0);
+	} else {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->doepmsk,
+				 intr_mask.d32, 0);
+	}
+
+	return 1;
+}
+
+/**
+ * Handler for the OUT EP NAK interrupt.
+ */
+static inline int32_t handle_out_ep_nak_intr(dwc_otg_pcd_t * pcd,
+					     const uint32_t epnum)
+{
+	/** @todo implement ISR */
+	dwc_otg_core_if_t *core_if;
+	doepmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_DEBUGPL(DBG_ANY, "INTERRUPT Handler not implemented for %s\n", "OUT EP NAK");
+	core_if = GET_CORE_IF(pcd);
+	intr_mask.b.nak = 1;
+
+	if (core_if->multiproc_int_enable) {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
+				 doepeachintmsk[epnum], intr_mask.d32, 0);
+	} else {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->doepmsk,
+				 intr_mask.d32, 0);
+	}
+
+	return 1;
+}
+
+/**
+ * Handler for the OUT EP NYET interrupt.
+ */
+static inline int32_t handle_out_ep_nyet_intr(dwc_otg_pcd_t * pcd,
+					      const uint32_t epnum)
+{
+	/** @todo implement ISR */
+	dwc_otg_core_if_t *core_if;
+	doepmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_PRINTF("INTERRUPT Handler not implemented for %s\n", "OUT EP NYET");
+	core_if = GET_CORE_IF(pcd);
+	intr_mask.b.nyet = 1;
+
+	if (core_if->multiproc_int_enable) {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->
+				 doepeachintmsk[epnum], intr_mask.d32, 0);
+	} else {
+		DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->doepmsk,
+				 intr_mask.d32, 0);
+	}
+
+	return 1;
+}
+
+/**
+ * This interrupt indicates that an IN EP has a pending Interrupt.
+ * The sequence for handling the IN EP interrupt is shown below:
+ * -#	Read the Device All Endpoint Interrupt register
+ * -#	Repeat the following for each IN EP interrupt bit set (from
+ *		LSB to MSB).
+ * -#	Read the Device Endpoint Interrupt (DIEPINTn) register
+ * -#	If "Transfer Complete" call the request complete function
+ * -#	If "Endpoint Disabled" complete the EP disable procedure.
+ * -#	If "AHB Error Interrupt" log error
+ * -#	If "Time-out Handshake" log error
+ * -#	If "IN Token Received when TxFIFO Empty" write packet to Tx
+ *		FIFO.
+ * -#	If "IN Token EP Mismatch" (disable, this is handled by EP
+ *		Mismatch Interrupt)
+ */
+static int32_t dwc_otg_pcd_handle_in_ep_intr(dwc_otg_pcd_t * pcd)
+{
+#define CLEAR_IN_EP_INTR(__core_if,__epnum,__intr) \
+do { \
+		diepint_data_t diepint = {.d32=0}; \
+		diepint.b.__intr = 1; \
+		DWC_WRITE_REG32(&__core_if->dev_if->in_ep_regs[__epnum]->diepint, \
+		diepint.d32); \
+} while (0)
+
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	dwc_otg_dev_if_t *dev_if = core_if->dev_if;
+	diepint_data_t diepint = {.d32 = 0 };
+	depctl_data_t depctl = {.d32 = 0 };
+	uint32_t ep_intr;
+	uint32_t epnum = 0;
+	dwc_otg_pcd_ep_t *ep;
+	dwc_ep_t *dwc_ep;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, pcd);
+
+	/* Read in the device interrupt bits */
+	ep_intr = dwc_otg_read_dev_all_in_ep_intr(core_if);
+
+	/* Service the Device IN interrupts for each endpoint */
+	while (ep_intr) {
+		if (ep_intr & 0x1) {
+			uint32_t empty_msk;
+			/* Get EP pointer */
+			ep = get_in_ep(pcd, epnum);
+			dwc_ep = &ep->dwc_ep;
+
+			depctl.d32 =
+			    DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->diepctl);
+			empty_msk =
+			    DWC_READ_REG32(&dev_if->
+					   dev_global_regs->dtknqr4_fifoemptymsk);
+
+			DWC_DEBUGPL(DBG_PCDV,
+				    "IN EP INTERRUPT - %d\nepmty_msk - %8x  diepctl - %8x\n",
+				    epnum, empty_msk, depctl.d32);
+
+			DWC_DEBUGPL(DBG_PCD,
+				    "EP%d-%s: type=%d, mps=%d\n",
+				    dwc_ep->num, (dwc_ep->is_in ? "IN" : "OUT"),
+				    dwc_ep->type, dwc_ep->maxpacket);
+
+			diepint.d32 =
+			    dwc_otg_read_dev_in_ep_intr(core_if, dwc_ep);
+
+			DWC_DEBUGPL(DBG_PCDV,
+				    "EP %d Interrupt Register - 0x%x\n", epnum,
+				    diepint.d32);
+			/* Transfer complete */
+			if (diepint.b.xfercompl) {
+				/* Disable the NP Tx FIFO Empty
+				 * Interrupt */
+				if (core_if->en_multiple_tx_fifo == 0) {
+					intr_mask.b.nptxfempty = 1;
+					DWC_MODIFY_REG32
+					    (&core_if->core_global_regs->gintmsk,
+					     intr_mask.d32, 0);
+				} else {
+					/* Disable the Tx FIFO Empty Interrupt for this EP */
+					uint32_t fifoemptymsk =
+					    0x1 << dwc_ep->num;
+					DWC_MODIFY_REG32(&core_if->
+							 dev_if->dev_global_regs->dtknqr4_fifoemptymsk,
+							 fifoemptymsk, 0);
+				}
+				/* Clear the bit in DIEPINTn for this interrupt */
+				CLEAR_IN_EP_INTR(core_if, epnum, xfercompl);
+
+				/* Complete the transfer */
+				if (epnum == 0) {
+					handle_ep0(pcd);
+				}
+#ifdef DWC_EN_ISOC
+				else if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
+					if (!ep->stopped)
+						complete_iso_ep(pcd, ep);
+				}
+#endif /* DWC_EN_ISOC */
+#ifdef DWC_UTE_PER_IO
+				else if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
+					if (!ep->stopped)
+						complete_xiso_ep(ep);
+				}
+#endif /* DWC_UTE_PER_IO */
+				else {
+					if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC &&
+							dwc_ep->bInterval > 1) {
+						dwc_ep->frame_num += dwc_ep->bInterval;
+						if (dwc_ep->frame_num > 0x3FFF)
+						{
+							dwc_ep->frm_overrun = 1;
+							dwc_ep->frame_num &= 0x3FFF;
+						} else
+							dwc_ep->frm_overrun = 0;
+					}
+					complete_ep(ep);
+					if(diepint.b.nak)
+						CLEAR_IN_EP_INTR(core_if, epnum, nak);
+				}
+			}
+			/* Endpoint disable      */
+			if (diepint.b.epdisabled) {
+				DWC_DEBUGPL(DBG_ANY, "EP%d IN disabled\n",
+					    epnum);
+				handle_in_ep_disable_intr(pcd, epnum);
+
+				/* Clear the bit in DIEPINTn for this interrupt */
+				CLEAR_IN_EP_INTR(core_if, epnum, epdisabled);
+			}
+			/* AHB Error */
+			if (diepint.b.ahberr) {
+				DWC_ERROR("EP%d IN AHB Error\n", epnum);
+				/* Clear the bit in DIEPINTn for this interrupt */
+				CLEAR_IN_EP_INTR(core_if, epnum, ahberr);
+			}
+			/* TimeOUT Handshake (non-ISOC IN EPs) */
+			if (diepint.b.timeout) {
+				DWC_ERROR("EP%d IN Time-out\n", epnum);
+				handle_in_ep_timeout_intr(pcd, epnum);
+
+				CLEAR_IN_EP_INTR(core_if, epnum, timeout);
+			}
+			/** IN Token received with TxF Empty */
+			if (diepint.b.intktxfemp) {
+				DWC_DEBUGPL(DBG_ANY,
+					    "EP%d IN TKN TxFifo Empty\n",
+					    epnum);
+				if (!ep->stopped && epnum != 0) {
+
+					diepmsk_data_t diepmsk = {.d32 = 0 };
+					diepmsk.b.intktxfemp = 1;
+
+					if (core_if->multiproc_int_enable) {
+						DWC_MODIFY_REG32
+						    (&dev_if->dev_global_regs->diepeachintmsk
+						     [epnum], diepmsk.d32, 0);
+					} else {
+						DWC_MODIFY_REG32
+						    (&dev_if->dev_global_regs->diepmsk,
+						     diepmsk.d32, 0);
+					}
+				} else if (core_if->dma_desc_enable
+					   && epnum == 0
+					   && pcd->ep0state ==
+					   EP0_OUT_STATUS_PHASE) {
+					// EP0 IN set STALL
+					depctl.d32 =
+					    DWC_READ_REG32(&dev_if->in_ep_regs
+							   [epnum]->diepctl);
+
+					/* set the disable and stall bits */
+					if (depctl.b.epena) {
+						depctl.b.epdis = 1;
+					}
+					depctl.b.stall = 1;
+					DWC_WRITE_REG32(&dev_if->in_ep_regs
+							[epnum]->diepctl,
+							depctl.d32);
+				}
+				CLEAR_IN_EP_INTR(core_if, epnum, intktxfemp);
+			}
+			/** IN Token Received with EP mismatch */
+			if (diepint.b.intknepmis) {
+				DWC_DEBUGPL(DBG_ANY,
+					    "EP%d IN TKN EP Mismatch\n", epnum);
+				CLEAR_IN_EP_INTR(core_if, epnum, intknepmis);
+			}
+			/** IN Endpoint NAK Effective */
+			if (diepint.b.inepnakeff) {
+				DWC_DEBUGPL(DBG_ANY,
+					    "EP%d IN EP NAK Effective\n",
+					    epnum);
+				/* Periodic EP */
+				if (ep->disabling) {
+					depctl.d32 = 0;
+					depctl.b.snak = 1;
+					depctl.b.epdis = 1;
+					DWC_MODIFY_REG32(&dev_if->in_ep_regs
+							 [epnum]->diepctl,
+							 depctl.d32,
+							 depctl.d32);
+				}
+				CLEAR_IN_EP_INTR(core_if, epnum, inepnakeff);
+
+			}
+
+			/** IN EP Tx FIFO Empty Intr */
+			if (diepint.b.emptyintr) {
+				DWC_DEBUGPL(DBG_ANY,
+					    "EP%d Tx FIFO Empty Intr \n",
+					    epnum);
+				write_empty_tx_fifo(pcd, epnum);
+
+				CLEAR_IN_EP_INTR(core_if, epnum, emptyintr);
+
+			}
+
+			/** IN EP BNA Intr */
+			if (diepint.b.bna) {
+				CLEAR_IN_EP_INTR(core_if, epnum, bna);
+				if (core_if->dma_desc_enable) {
+#ifdef DWC_EN_ISOC
+					if (dwc_ep->type ==
+					    DWC_OTG_EP_TYPE_ISOC) {
+						/*
+						 * This checking is performed to prevent first "false" BNA
+						 * handling occuring right after reconnect
+						 */
+						if (dwc_ep->next_frame !=
+						    0xffffffff)
+							dwc_otg_pcd_handle_iso_bna(ep);
+					} else
+#endif				/* DWC_EN_ISOC */
+					{
+						dwc_otg_pcd_handle_noniso_bna(ep);
+					}
+				}
+			}
+			/* NAK Interrutp */
+			if (diepint.b.nak) {
+				DWC_DEBUGPL(DBG_ANY, "EP%d IN NAK Interrupt\n",
+					    epnum);
+				if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
+					depctl_data_t depctl;
+					if (ep->dwc_ep.frame_num == 0xFFFFFFFF) {
+						ep->dwc_ep.frame_num = core_if->frame_num;
+						if (ep->dwc_ep.bInterval > 1) {
+							depctl.d32 = 0;
+							depctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[epnum]->diepctl);
+							if (ep->dwc_ep.frame_num & 0x1) {
+								depctl.b.setd1pid = 1;
+								depctl.b.setd0pid = 0;
+							} else {
+								depctl.b.setd0pid = 1;
+								depctl.b.setd1pid = 0;
+							}
+							DWC_WRITE_REG32(&dev_if->in_ep_regs[epnum]->diepctl, depctl.d32);
+						}
+						start_next_request(ep);
+					}
+					ep->dwc_ep.frame_num += ep->dwc_ep.bInterval;
+					if (dwc_ep->frame_num > 0x3FFF)	{
+						dwc_ep->frm_overrun = 1;
+						dwc_ep->frame_num &= 0x3FFF;
+					} else
+						dwc_ep->frm_overrun = 0;
+				}
+
+				CLEAR_IN_EP_INTR(core_if, epnum, nak);
+			}
+		}
+		epnum++;
+		ep_intr >>= 1;
+	}
+
+	return 1;
+#undef CLEAR_IN_EP_INTR
+}
+
+/**
+ * This interrupt indicates that an OUT EP has a pending Interrupt.
+ * The sequence for handling the OUT EP interrupt is shown below:
+ * -#	Read the Device All Endpoint Interrupt register
+ * -#	Repeat the following for each OUT EP interrupt bit set (from
+ *		LSB to MSB).
+ * -#	Read the Device Endpoint Interrupt (DOEPINTn) register
+ * -#	If "Transfer Complete" call the request complete function
+ * -#	If "Endpoint Disabled" complete the EP disable procedure.
+ * -#	If "AHB Error Interrupt" log error
+ * -#	If "Setup Phase Done" process Setup Packet (See Standard USB
+ *		Command Processing)
+ */
+static int32_t dwc_otg_pcd_handle_out_ep_intr(dwc_otg_pcd_t * pcd)
+{
+#define CLEAR_OUT_EP_INTR(__core_if,__epnum,__intr) \
+do { \
+		doepint_data_t doepint = {.d32=0}; \
+		doepint.b.__intr = 1; \
+		DWC_WRITE_REG32(&__core_if->dev_if->out_ep_regs[__epnum]->doepint, \
+		doepint.d32); \
+} while (0)
+
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	uint32_t ep_intr;
+	doepint_data_t doepint = {.d32 = 0 };
+	uint32_t epnum = 0;
+	dwc_otg_pcd_ep_t *ep;
+	dwc_ep_t *dwc_ep;
+	dctl_data_t dctl = {.d32 = 0 };
+	gintmsk_data_t gintmsk = {.d32 = 0 };
+
+
+	DWC_DEBUGPL(DBG_PCDV, "%s()\n", __func__);
+
+	/* Read in the device interrupt bits */
+	ep_intr = dwc_otg_read_dev_all_out_ep_intr(core_if);
+
+	while (ep_intr) {
+		if (ep_intr & 0x1) {
+			/* Get EP pointer */
+			ep = get_out_ep(pcd, epnum);
+			dwc_ep = &ep->dwc_ep;
+
+#ifdef VERBOSE
+			DWC_DEBUGPL(DBG_PCDV,
+				    "EP%d-%s: type=%d, mps=%d\n",
+				    dwc_ep->num, (dwc_ep->is_in ? "IN" : "OUT"),
+				    dwc_ep->type, dwc_ep->maxpacket);
+#endif
+			doepint.d32 =
+			    dwc_otg_read_dev_out_ep_intr(core_if, dwc_ep);
+			/* Moved this interrupt upper due to core deffect of asserting
+			 * OUT EP 0 xfercompl along with stsphsrcvd in BDMA */
+			if (doepint.b.stsphsercvd) {
+				deptsiz0_data_t deptsiz;
+				CLEAR_OUT_EP_INTR(core_if, epnum, stsphsercvd);
+				deptsiz.d32 =
+				    DWC_READ_REG32(&core_if->dev_if->
+						   out_ep_regs[0]->doeptsiz);
+				if (core_if->snpsid >= OTG_CORE_REV_3_00a
+				    && core_if->dma_enable
+				    && core_if->dma_desc_enable == 0
+				    && doepint.b.xfercompl
+				    && deptsiz.b.xfersize == 24) {
+					CLEAR_OUT_EP_INTR(core_if, epnum,
+							  xfercompl);
+					doepint.b.xfercompl = 0;
+					ep0_out_start(core_if, pcd);
+				}
+				if ((core_if->dma_desc_enable) ||
+				    (core_if->dma_enable
+				     && core_if->snpsid >=
+				     OTG_CORE_REV_3_00a)) {
+					do_setup_in_status_phase(pcd);
+				}
+			}
+			/* Transfer complete */
+			if (doepint.b.xfercompl) {
+
+				if (epnum == 0) {
+					/* Clear the bit in DOEPINTn for this interrupt */
+					CLEAR_OUT_EP_INTR(core_if, epnum, xfercompl);
+					if (core_if->snpsid >= OTG_CORE_REV_3_00a) {
+						DWC_DEBUGPL(DBG_PCDV, "DOEPINT=%x doepint=%x\n",
+							DWC_READ_REG32(&core_if->dev_if->out_ep_regs[0]->doepint),
+							doepint.d32);
+						DWC_DEBUGPL(DBG_PCDV, "DOEPCTL=%x \n",
+							DWC_READ_REG32(&core_if->dev_if->out_ep_regs[0]->doepctl));
+
+						if (core_if->snpsid >= OTG_CORE_REV_3_00a
+							&& core_if->dma_enable == 0) {
+							doepint_data_t doepint;
+							doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
+														out_ep_regs[0]->doepint);
+							if (pcd->ep0state == EP0_IDLE && doepint.b.sr) {
+								CLEAR_OUT_EP_INTR(core_if, epnum, sr);
+								goto exit_xfercompl;
+							}
+						}
+						/* In case of DDMA  look at SR bit to go to the Data Stage */
+						if (core_if->dma_desc_enable) {
+							dev_dma_desc_sts_t status = {.d32 = 0};
+							if (pcd->ep0state == EP0_IDLE) {
+								status.d32 = core_if->dev_if->setup_desc_addr[core_if->
+											dev_if->setup_desc_index]->status.d32;
+								if(pcd->data_terminated) {
+									 pcd->data_terminated = 0;
+									 status.d32 = core_if->dev_if->out_desc_addr->status.d32;
+									 dwc_memcpy(&pcd->setup_pkt->req, pcd->backup_buf, 8);
+								}
+								if (status.b.sr) {
+									if (doepint.b.setup) {
+										DWC_DEBUGPL(DBG_PCDV, "DMA DESC EP0_IDLE SR=1 setup=1\n");
+										/* Already started data stage, clear setup */
+										CLEAR_OUT_EP_INTR(core_if, epnum, setup);
+										doepint.b.setup = 0;
+										handle_ep0(pcd);
+										/* Prepare for more setup packets */
+										if (pcd->ep0state == EP0_IN_STATUS_PHASE ||
+											pcd->ep0state == EP0_IN_DATA_PHASE) {
+											ep0_out_start(core_if, pcd);
+										}
+
+										goto exit_xfercompl;
+									} else {
+										/* Prepare for more setup packets */
+										DWC_DEBUGPL(DBG_PCDV,
+											"EP0_IDLE SR=1 setup=0 new setup comes\n");
+										ep0_out_start(core_if, pcd);
+									}
+								}
+							} else {
+								dwc_otg_pcd_request_t *req;
+								dev_dma_desc_sts_t status = {.d32 = 0};
+								diepint_data_t diepint0;
+								diepint0.d32 = DWC_READ_REG32(&core_if->dev_if->
+															in_ep_regs[0]->diepint);
+
+								if (pcd->ep0state == EP0_STALL || pcd->ep0state == EP0_DISCONNECT) {
+									DWC_ERROR("EP0 is stalled/disconnected\n");
+								}
+
+								/* Clear IN xfercompl if set */
+								if (diepint0.b.xfercompl && (pcd->ep0state == EP0_IN_STATUS_PHASE
+									|| pcd->ep0state == EP0_IN_DATA_PHASE)) {
+									DWC_WRITE_REG32(&core_if->dev_if->
+										in_ep_regs[0]->diepint, diepint0.d32);
+								}
+
+								status.d32 = core_if->dev_if->setup_desc_addr[core_if->
+									dev_if->setup_desc_index]->status.d32;
+
+								if (ep->dwc_ep.xfer_count != ep->dwc_ep.total_len
+									&& (pcd->ep0state == EP0_OUT_DATA_PHASE))
+									status.d32 = core_if->dev_if->out_desc_addr->status.d32;
+								if (pcd->ep0state == EP0_OUT_STATUS_PHASE)
+									status.d32 = core_if->dev_if->
+									out_desc_addr->status.d32;
+
+								if (status.b.sr) {
+									if (DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+										DWC_DEBUGPL(DBG_PCDV, "Request queue empty!!\n");
+									} else {
+										DWC_DEBUGPL(DBG_PCDV, "complete req!!\n");
+										req = DWC_CIRCLEQ_FIRST(&ep->queue);
+										if (ep->dwc_ep.xfer_count != ep->dwc_ep.total_len &&
+											pcd->ep0state == EP0_OUT_DATA_PHASE) {
+												/* Read arrived setup packet from req->buf */
+												dwc_memcpy(&pcd->setup_pkt->req,
+													req->buf + ep->dwc_ep.xfer_count, 8);
+										}
+										req->actual = ep->dwc_ep.xfer_count;
+										dwc_otg_request_done(ep, req, -ECONNRESET);
+										ep->dwc_ep.start_xfer_buff = 0;
+										ep->dwc_ep.xfer_buff = 0;
+										ep->dwc_ep.xfer_len = 0;
+									}
+									pcd->ep0state = EP0_IDLE;
+									if (doepint.b.setup) {
+										DWC_DEBUGPL(DBG_PCDV, "EP0_IDLE SR=1 setup=1\n");
+										/* Data stage started, clear setup */
+										CLEAR_OUT_EP_INTR(core_if, epnum, setup);
+										doepint.b.setup = 0;
+										handle_ep0(pcd);
+										/* Prepare for setup packets if ep0in was enabled*/
+										if (pcd->ep0state == EP0_IN_STATUS_PHASE) {
+											ep0_out_start(core_if, pcd);
+										}
+
+										goto exit_xfercompl;
+									} else {
+										/* Prepare for more setup packets */
+										DWC_DEBUGPL(DBG_PCDV,
+											"EP0_IDLE SR=1 setup=0 new setup comes 2\n");
+										ep0_out_start(core_if, pcd);
+									}
+								}
+							}
+						}
+						if (core_if->snpsid >= OTG_CORE_REV_2_94a && core_if->dma_enable
+							&& core_if->dma_desc_enable == 0) {
+							doepint_data_t doepint_temp = {.d32 = 0};
+							deptsiz0_data_t doeptsize0 = {.d32 = 0 };
+							doepint_temp.d32 = DWC_READ_REG32(&core_if->dev_if->
+															out_ep_regs[ep->dwc_ep.num]->doepint);
+							doeptsize0.d32 = DWC_READ_REG32(&core_if->dev_if->
+															out_ep_regs[ep->dwc_ep.num]->doeptsiz);
+							if (pcd->ep0state == EP0_IDLE) {
+								if (doepint_temp.b.sr) {
+									CLEAR_OUT_EP_INTR(core_if, epnum, sr);
+								}
+									doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
+																	out_ep_regs[0]->doepint);
+									if (doeptsize0.b.supcnt == 3) {
+										DWC_DEBUGPL(DBG_ANY, "Rolling over!!!!!!!\n");
+										ep->dwc_ep.stp_rollover = 1;
+									}
+									if (doepint.b.setup) {
+retry:
+										/* Already started data stage, clear setup */
+										CLEAR_OUT_EP_INTR(core_if, epnum, setup);
+										doepint.b.setup = 0;
+										handle_ep0(pcd);
+										ep->dwc_ep.stp_rollover = 0;
+										/* Prepare for more setup packets */
+										if (pcd->ep0state == EP0_IN_STATUS_PHASE ||
+											pcd->ep0state == EP0_IN_DATA_PHASE) {
+											ep0_out_start(core_if, pcd);
+										}
+										goto exit_xfercompl;
+									} else {
+										/* Prepare for more setup packets */
+										DWC_DEBUGPL(DBG_ANY,
+											"EP0_IDLE SR=1 setup=0 new setup comes\n");
+										doepint.d32 = DWC_READ_REG32(&core_if->dev_if->
+																	out_ep_regs[0]->doepint);
+										if(doepint.b.setup)
+											goto retry;
+										ep0_out_start(core_if, pcd);
+									}
+							} else {
+								dwc_otg_pcd_request_t *req;
+								diepint_data_t diepint0 = {.d32 = 0};
+								doepint_data_t doepint_temp = {.d32 = 0};
+								depctl_data_t diepctl0;
+								diepint0.d32 = DWC_READ_REG32(&core_if->dev_if->
+																in_ep_regs[0]->diepint);
+								diepctl0.d32 = DWC_READ_REG32(&core_if->dev_if->
+																in_ep_regs[0]->diepctl);
+
+								if (pcd->ep0state == EP0_IN_DATA_PHASE
+									|| pcd->ep0state == EP0_IN_STATUS_PHASE) {
+									if (diepint0.b.xfercompl) {
+										DWC_WRITE_REG32(&core_if->dev_if->
+											in_ep_regs[0]->diepint, diepint0.d32);
+									}
+									if (diepctl0.b.epena) {
+										diepint_data_t diepint = {.d32 = 0};
+										diepctl0.b.snak = 1;
+										DWC_WRITE_REG32(&core_if->dev_if->
+														in_ep_regs[0]->diepctl, diepctl0.d32);
+										do {
+											dwc_udelay(10);
+											diepint.d32 = DWC_READ_REG32(&core_if->dev_if->
+												in_ep_regs[0]->diepint);
+										} while (!diepint.b.inepnakeff);
+										diepint.b.inepnakeff = 1;
+										DWC_WRITE_REG32(&core_if->dev_if->
+											in_ep_regs[0]->diepint, diepint.d32);
+										diepctl0.d32 = 0;
+										diepctl0.b.epdis = 1;
+										DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[0]->diepctl,
+														diepctl0.d32);
+										do {
+											dwc_udelay(10);
+											diepint.d32 = DWC_READ_REG32(&core_if->dev_if->
+												in_ep_regs[0]->diepint);
+										} while (!diepint.b.epdisabled);
+										diepint.b.epdisabled = 1;
+										DWC_WRITE_REG32(&core_if->dev_if->in_ep_regs[0]->diepint,
+															diepint.d32);
+									}
+								}
+								doepint_temp.d32 = DWC_READ_REG32(&core_if->dev_if->
+																out_ep_regs[ep->dwc_ep.num]->doepint);
+								if (doepint_temp.b.sr) {
+									CLEAR_OUT_EP_INTR(core_if, epnum, sr);
+									if (DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+										DWC_DEBUGPL(DBG_PCDV, "Request queue empty!!\n");
+									} else {
+										DWC_DEBUGPL(DBG_PCDV, "complete req!!\n");
+										req = DWC_CIRCLEQ_FIRST(&ep->queue);
+										if (ep->dwc_ep.xfer_count != ep->dwc_ep.total_len &&
+											pcd->ep0state == EP0_OUT_DATA_PHASE) {
+												/* Read arrived setup packet from req->buf */
+												dwc_memcpy(&pcd->setup_pkt->req,
+													req->buf + ep->dwc_ep.xfer_count, 8);
+										}
+										req->actual = ep->dwc_ep.xfer_count;
+										dwc_otg_request_done(ep, req, -ECONNRESET);
+										ep->dwc_ep.start_xfer_buff = 0;
+										ep->dwc_ep.xfer_buff = 0;
+										ep->dwc_ep.xfer_len = 0;
+									}
+									pcd->ep0state = EP0_IDLE;
+									if (doepint.b.setup) {
+										DWC_DEBUGPL(DBG_PCDV, "EP0_IDLE SR=1 setup=1\n");
+										/* Data stage started, clear setup */
+										CLEAR_OUT_EP_INTR(core_if, epnum, setup);
+										doepint.b.setup = 0;
+										handle_ep0(pcd);
+										/* Prepare for setup packets if ep0in was enabled*/
+										if (pcd->ep0state == EP0_IN_STATUS_PHASE) {
+											ep0_out_start(core_if, pcd);
+										}
+										goto exit_xfercompl;
+									} else {
+										/* Prepare for more setup packets */
+										DWC_DEBUGPL(DBG_PCDV,
+											"EP0_IDLE SR=1 setup=0 new setup comes 2\n");
+										ep0_out_start(core_if, pcd);
+									}
+								}
+							}
+						}
+						if (core_if->dma_enable == 0 || pcd->ep0state != EP0_IDLE)
+							handle_ep0(pcd);
+exit_xfercompl:
+						DWC_DEBUGPL(DBG_PCDV, "DOEPINT=%x doepint=%x\n",
+							dwc_otg_read_dev_out_ep_intr(core_if, dwc_ep), doepint.d32);
+					} else {
+					if (core_if->dma_desc_enable == 0
+					    || pcd->ep0state != EP0_IDLE)
+						handle_ep0(pcd);
+					}
+#ifdef DWC_EN_ISOC
+				} else if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
+					if (doepint.b.pktdrpsts == 0) {
+						/* Clear the bit in DOEPINTn for this interrupt */
+						CLEAR_OUT_EP_INTR(core_if,
+								  epnum,
+								  xfercompl);
+						complete_iso_ep(pcd, ep);
+					} else {
+
+						doepint_data_t doepint = {.d32 = 0 };
+						doepint.b.xfercompl = 1;
+						doepint.b.pktdrpsts = 1;
+						DWC_WRITE_REG32
+						    (&core_if->dev_if->out_ep_regs
+						     [epnum]->doepint,
+						     doepint.d32);
+						if (handle_iso_out_pkt_dropped
+						    (core_if, dwc_ep)) {
+							complete_iso_ep(pcd,
+									ep);
+						}
+					}
+#endif /* DWC_EN_ISOC */
+#ifdef DWC_UTE_PER_IO
+				} else if (dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
+					CLEAR_OUT_EP_INTR(core_if, epnum, xfercompl);
+					if (!ep->stopped)
+						complete_xiso_ep(ep);
+#endif /* DWC_UTE_PER_IO */
+				} else {
+					/* Clear the bit in DOEPINTn for this interrupt */
+					CLEAR_OUT_EP_INTR(core_if, epnum,
+							  xfercompl);
+
+					if (core_if->core_params->dev_out_nak) {
+						DWC_TIMER_CANCEL(pcd->core_if->ep_xfer_timer[epnum]);
+						pcd->core_if->ep_xfer_info[epnum].state = 0;
+#ifdef DEBUG
+						print_memory_payload(pcd, dwc_ep);
+#endif
+					}
+					complete_ep(ep);
+				}
+
+			}
+
+			/* Endpoint disable      */
+			if (doepint.b.epdisabled) {
+
+				/* Clear the bit in DOEPINTn for this interrupt */
+				CLEAR_OUT_EP_INTR(core_if, epnum, epdisabled);
+				if (core_if->core_params->dev_out_nak) {
+#ifdef DEBUG
+					print_memory_payload(pcd, dwc_ep);
+#endif
+					/* In case of timeout condition */
+					if (core_if->ep_xfer_info[epnum].state == 2) {
+						dctl.d32 = DWC_READ_REG32(&core_if->dev_if->
+										dev_global_regs->dctl);
+						dctl.b.cgoutnak = 1;
+						DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl,
+																dctl.d32);
+						/* Unmask goutnakeff interrupt which was masked
+						 * during handle nak out interrupt */
+						gintmsk.b.goutnakeff = 1;
+						DWC_MODIFY_REG32(&core_if->core_global_regs->gintmsk,
+																0, gintmsk.d32);
+
+						complete_ep(ep);
+					}
+				}
+				if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC)
+				{
+					dctl_data_t dctl;
+					gintmsk_data_t intr_mask = {.d32 = 0};
+					dwc_otg_pcd_request_t *req = 0;
+
+					dctl.d32 = DWC_READ_REG32(&core_if->dev_if->
+						dev_global_regs->dctl);
+					dctl.b.cgoutnak = 1;
+					DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl,
+						dctl.d32);
+
+					intr_mask.d32 = 0;
+					intr_mask.b.incomplisoout = 1;
+
+					/* Get any pending requests */
+					if (!DWC_CIRCLEQ_EMPTY(&ep->queue)) {
+						req = DWC_CIRCLEQ_FIRST(&ep->queue);
+						if (!req) {
+							DWC_PRINTF("complete_ep 0x%p, req = NULL!\n", ep);
+						} else {
+							dwc_otg_request_done(ep, req, 0);
+							start_next_request(ep);
+						}
+					} else {
+						DWC_PRINTF("complete_ep 0x%p, ep->queue empty!\n", ep);
+					}
+				}
+			}
+			/* AHB Error */
+			if (doepint.b.ahberr) {
+				DWC_ERROR("EP%d OUT AHB Error\n", epnum);
+				DWC_ERROR("EP%d DEPDMA=0x%08x \n",
+					  epnum, core_if->dev_if->out_ep_regs[epnum]->doepdma);
+				CLEAR_OUT_EP_INTR(core_if, epnum, ahberr);
+			}
+			/* Setup Phase Done (contorl EPs) */
+			if (doepint.b.setup) {
+#ifdef DEBUG_EP0
+				DWC_DEBUGPL(DBG_PCD, "EP%d SETUP Done\n", epnum);
+#endif
+				CLEAR_OUT_EP_INTR(core_if, epnum, setup);
+
+				handle_ep0(pcd);
+			}
+
+			/** OUT EP BNA Intr */
+			if (doepint.b.bna) {
+				CLEAR_OUT_EP_INTR(core_if, epnum, bna);
+				if (core_if->dma_desc_enable) {
+#ifdef DWC_EN_ISOC
+					if (dwc_ep->type ==
+					    DWC_OTG_EP_TYPE_ISOC) {
+						/*
+						 * This checking is performed to prevent first "false" BNA
+						 * handling occuring right after reconnect
+						 */
+						if (dwc_ep->next_frame !=
+						    0xffffffff)
+							dwc_otg_pcd_handle_iso_bna(ep);
+					} else
+#endif				/* DWC_EN_ISOC */
+					{
+						dwc_otg_pcd_handle_noniso_bna(ep);
+					}
+				}
+			}
+			/* Babble Interrupt */
+			if (doepint.b.babble) {
+				DWC_DEBUGPL(DBG_ANY, "EP%d OUT Babble\n",
+					    epnum);
+				handle_out_ep_babble_intr(pcd, epnum);
+
+				CLEAR_OUT_EP_INTR(core_if, epnum, babble);
+			}
+			if (doepint.b.outtknepdis) {
+				DWC_DEBUGPL(DBG_ANY, "EP%d OUT Token received when EP is \
+					disabled\n",epnum);
+				if (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
+					doepmsk_data_t doepmsk = {.d32 = 0};
+					ep->dwc_ep.frame_num = core_if->frame_num;
+					if (ep->dwc_ep.bInterval > 1) {
+						depctl_data_t depctl;
+						depctl.d32 = DWC_READ_REG32(&core_if->dev_if->
+													out_ep_regs[epnum]->doepctl);
+						if (ep->dwc_ep.frame_num & 0x1) {
+							depctl.b.setd1pid = 1;
+							depctl.b.setd0pid = 0;
+						} else {
+							depctl.b.setd0pid = 1;
+							depctl.b.setd1pid = 0;
+						}
+						DWC_WRITE_REG32(&core_if->dev_if->
+										out_ep_regs[epnum]->doepctl, depctl.d32);
+					}
+					start_next_request(ep);
+					doepmsk.b.outtknepdis = 1;
+					DWC_MODIFY_REG32(&core_if->dev_if->dev_global_regs->doepmsk,
+								 doepmsk.d32, 0);
+				}
+				CLEAR_OUT_EP_INTR(core_if, epnum, outtknepdis);
+			}
+
+			/* NAK Interrutp */
+			if (doepint.b.nak) {
+				DWC_DEBUGPL(DBG_ANY, "EP%d OUT NAK\n", epnum);
+				handle_out_ep_nak_intr(pcd, epnum);
+
+				CLEAR_OUT_EP_INTR(core_if, epnum, nak);
+			}
+			/* NYET Interrutp */
+			if (doepint.b.nyet) {
+				DWC_DEBUGPL(DBG_ANY, "EP%d OUT NYET\n", epnum);
+				handle_out_ep_nyet_intr(pcd, epnum);
+
+				CLEAR_OUT_EP_INTR(core_if, epnum, nyet);
+			}
+		}
+
+		epnum++;
+		ep_intr >>= 1;
+	}
+
+	return 1;
+
+#undef CLEAR_OUT_EP_INTR
+}
+static int drop_transfer(uint32_t trgt_fr, uint32_t curr_fr, uint8_t frm_overrun)
+{
+	int retval = 0;
+	if(!frm_overrun && curr_fr >= trgt_fr)
+		retval = 1;
+	else if (frm_overrun
+		 && (curr_fr >= trgt_fr && ((curr_fr - trgt_fr) < 0x3FFF / 2)))
+		retval = 1;
+	return retval;
+}
+/**
+ * Incomplete ISO IN Transfer Interrupt.
+ * This interrupt indicates one of the following conditions occurred
+ * while transmitting an ISOC transaction.
+ * - Corrupted IN Token for ISOC EP.
+ * - Packet not complete in FIFO.
+ * The follow actions will be taken:
+ *	-#	Determine the EP
+ *	-#	Set incomplete flag in dwc_ep structure
+ *	-#	Disable EP; when "Endpoint Disabled" interrupt is received
+ *		Flush FIFO
+ */
+int32_t dwc_otg_pcd_handle_incomplete_isoc_in_intr(dwc_otg_pcd_t * pcd)
+{
+	gintsts_data_t gintsts;
+
+#ifdef DWC_EN_ISOC
+	dwc_otg_dev_if_t *dev_if;
+	deptsiz_data_t deptsiz = {.d32 = 0 };
+	depctl_data_t depctl = {.d32 = 0 };
+	dsts_data_t dsts = {.d32 = 0 };
+	dwc_ep_t *dwc_ep;
+	int i;
+
+	dev_if = GET_CORE_IF(pcd)->dev_if;
+
+	for (i = 1; i <= dev_if->num_in_eps; ++i) {
+		dwc_ep = &pcd->in_ep[i].dwc_ep;
+		if (dwc_ep->active && dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
+			deptsiz.d32 =
+			    DWC_READ_REG32(&dev_if->in_ep_regs[i]->dieptsiz);
+			depctl.d32 =
+			    DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
+
+			if (depctl.b.epdis && deptsiz.d32) {
+				set_current_pkt_info(GET_CORE_IF(pcd), dwc_ep);
+				if (dwc_ep->cur_pkt >= dwc_ep->pkt_cnt) {
+					dwc_ep->cur_pkt = 0;
+					dwc_ep->proc_buf_num =
+					    (dwc_ep->proc_buf_num ^ 1) & 0x1;
+
+					if (dwc_ep->proc_buf_num) {
+						dwc_ep->cur_pkt_addr =
+						    dwc_ep->xfer_buff1;
+						dwc_ep->cur_pkt_dma_addr =
+						    dwc_ep->dma_addr1;
+					} else {
+						dwc_ep->cur_pkt_addr =
+						    dwc_ep->xfer_buff0;
+						dwc_ep->cur_pkt_dma_addr =
+						    dwc_ep->dma_addr0;
+					}
+
+				}
+
+				dsts.d32 =
+				    DWC_READ_REG32(&GET_CORE_IF(pcd)->dev_if->
+						   dev_global_regs->dsts);
+				dwc_ep->next_frame = dsts.b.soffn;
+
+				dwc_otg_iso_ep_start_frm_transfer(GET_CORE_IF
+								  (pcd),
+								  dwc_ep);
+			}
+		}
+	}
+
+#else
+	depctl_data_t depctl = {.d32 = 0 };
+	dwc_ep_t *dwc_ep;
+	dwc_otg_dev_if_t *dev_if;
+	int i;
+	dev_if = GET_CORE_IF(pcd)->dev_if;
+
+	DWC_DEBUGPL(DBG_PCD,"Incomplete ISO IN \n");
+
+	for (i = 1; i <= dev_if->num_in_eps; ++i) {
+		dwc_ep = &pcd->in_ep[i-1].dwc_ep;
+		depctl.d32 =
+			DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
+		if (depctl.b.epena && dwc_ep->type == DWC_OTG_EP_TYPE_ISOC) {
+			if (drop_transfer(dwc_ep->frame_num, GET_CORE_IF(pcd)->frame_num,
+							dwc_ep->frm_overrun))
+			{
+				depctl.d32 =
+					DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
+				depctl.b.snak = 1;
+				depctl.b.epdis = 1;
+				DWC_MODIFY_REG32(&dev_if->in_ep_regs[i]->diepctl, depctl.d32, depctl.d32);
+			}
+		}
+	}
+
+	/*intr_mask.b.incomplisoin = 1;
+	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
+			 intr_mask.d32, 0);	 */
+#endif				//DWC_EN_ISOC
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.incomplisoin = 1;
+	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
+			gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * Incomplete ISO OUT Transfer Interrupt.
+ *
+ * This interrupt indicates that the core has dropped an ISO OUT
+ * packet. The following conditions can be the cause:
+ * - FIFO Full, the entire packet would not fit in the FIFO.
+ * - CRC Error
+ * - Corrupted Token
+ * The follow actions will be taken:
+ *	-#	Determine the EP
+ *	-#	Set incomplete flag in dwc_ep structure
+ *	-#	Read any data from the FIFO
+ *	-#	Disable EP. When "Endpoint Disabled" interrupt is received
+ *		re-enable EP.
+ */
+int32_t dwc_otg_pcd_handle_incomplete_isoc_out_intr(dwc_otg_pcd_t * pcd)
+{
+
+	gintsts_data_t gintsts;
+
+#ifdef DWC_EN_ISOC
+	dwc_otg_dev_if_t *dev_if;
+	deptsiz_data_t deptsiz = {.d32 = 0 };
+	depctl_data_t depctl = {.d32 = 0 };
+	dsts_data_t dsts = {.d32 = 0 };
+	dwc_ep_t *dwc_ep;
+	int i;
+
+	dev_if = GET_CORE_IF(pcd)->dev_if;
+
+	for (i = 1; i <= dev_if->num_out_eps; ++i) {
+		dwc_ep = &pcd->in_ep[i].dwc_ep;
+		if (pcd->out_ep[i].dwc_ep.active &&
+		    pcd->out_ep[i].dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) {
+			deptsiz.d32 =
+			    DWC_READ_REG32(&dev_if->out_ep_regs[i]->doeptsiz);
+			depctl.d32 =
+			    DWC_READ_REG32(&dev_if->out_ep_regs[i]->doepctl);
+
+			if (depctl.b.epdis && deptsiz.d32) {
+				set_current_pkt_info(GET_CORE_IF(pcd),
+						     &pcd->out_ep[i].dwc_ep);
+				if (dwc_ep->cur_pkt >= dwc_ep->pkt_cnt) {
+					dwc_ep->cur_pkt = 0;
+					dwc_ep->proc_buf_num =
+					    (dwc_ep->proc_buf_num ^ 1) & 0x1;
+
+					if (dwc_ep->proc_buf_num) {
+						dwc_ep->cur_pkt_addr =
+						    dwc_ep->xfer_buff1;
+						dwc_ep->cur_pkt_dma_addr =
+						    dwc_ep->dma_addr1;
+					} else {
+						dwc_ep->cur_pkt_addr =
+						    dwc_ep->xfer_buff0;
+						dwc_ep->cur_pkt_dma_addr =
+						    dwc_ep->dma_addr0;
+					}
+
+				}
+
+				dsts.d32 =
+				    DWC_READ_REG32(&GET_CORE_IF(pcd)->dev_if->
+						   dev_global_regs->dsts);
+				dwc_ep->next_frame = dsts.b.soffn;
+
+				dwc_otg_iso_ep_start_frm_transfer(GET_CORE_IF
+								  (pcd),
+								  dwc_ep);
+			}
+		}
+	}
+#else
+	/** @todo implement ISR */
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	dwc_otg_core_if_t *core_if;
+	deptsiz_data_t deptsiz = {.d32 = 0 };
+	depctl_data_t depctl = {.d32 = 0 };
+	dctl_data_t dctl = {.d32 = 0 };
+	dwc_ep_t *dwc_ep = NULL;
+	int i;
+	core_if = GET_CORE_IF(pcd);
+
+	for (i = 0; i < core_if->dev_if->num_out_eps; ++i) {
+		dwc_ep = &pcd->out_ep[i].dwc_ep;
+		depctl.d32 =
+			DWC_READ_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl);
+		if (depctl.b.epena && depctl.b.dpid == (core_if->frame_num & 0x1)) {
+			core_if->dev_if->isoc_ep = dwc_ep;
+			deptsiz.d32 =
+					DWC_READ_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doeptsiz);
+				break;
+		}
+	}
+	dctl.d32 = DWC_READ_REG32(&core_if->dev_if->dev_global_regs->dctl);
+	gintsts.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintsts);
+	intr_mask.d32 = DWC_READ_REG32(&core_if->core_global_regs->gintmsk);
+
+	if (!intr_mask.b.goutnakeff) {
+		/* Unmask it */
+		intr_mask.b.goutnakeff = 1;
+		DWC_WRITE_REG32(&core_if->core_global_regs->gintmsk, intr_mask.d32);
+	}
+	if (!gintsts.b.goutnakeff) {
+		dctl.b.sgoutnak = 1;
+	}
+	DWC_WRITE_REG32(&core_if->dev_if->dev_global_regs->dctl, dctl.d32);
+
+	depctl.d32 = DWC_READ_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl);
+	if (depctl.b.epena) {
+		depctl.b.epdis = 1;
+		depctl.b.snak = 1;
+	}
+	DWC_WRITE_REG32(&core_if->dev_if->out_ep_regs[dwc_ep->num]->doepctl, depctl.d32);
+
+	intr_mask.d32 = 0;
+	intr_mask.b.incomplisoout = 1;
+
+#endif /* DWC_EN_ISOC */
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.incomplisoout = 1;
+	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
+			gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * This function handles the Global IN NAK Effective interrupt.
+ *
+ */
+int32_t dwc_otg_pcd_handle_in_nak_effective(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_dev_if_t *dev_if = GET_CORE_IF(pcd)->dev_if;
+	depctl_data_t diepctl = {.d32 = 0 };
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	gintsts_data_t gintsts;
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+	int i;
+
+	DWC_DEBUGPL(DBG_PCD, "Global IN NAK Effective\n");
+
+	/* Disable all active IN EPs */
+	for (i = 0; i <= dev_if->num_in_eps; i++) {
+		diepctl.d32 = DWC_READ_REG32(&dev_if->in_ep_regs[i]->diepctl);
+		if (!(diepctl.b.eptype & 1) && diepctl.b.epena) {
+			if (core_if->start_predict > 0)
+				core_if->start_predict++;
+			diepctl.b.epdis = 1;
+			diepctl.b.snak = 1;
+			DWC_WRITE_REG32(&dev_if->in_ep_regs[i]->diepctl, diepctl.d32);
+		}
+	}
+
+
+	/* Disable the Global IN NAK Effective Interrupt */
+	intr_mask.b.ginnakeff = 1;
+	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
+			 intr_mask.d32, 0);
+
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.ginnakeff = 1;
+	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
+			gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * OUT NAK Effective.
+ *
+ */
+int32_t dwc_otg_pcd_handle_out_nak_effective(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_dev_if_t *dev_if = GET_CORE_IF(pcd)->dev_if;
+	gintmsk_data_t intr_mask = {.d32 = 0 };
+	gintsts_data_t gintsts;
+	depctl_data_t doepctl;
+	int i;
+
+	/* Disable the Global OUT NAK Effective Interrupt */
+	intr_mask.b.goutnakeff = 1;
+	DWC_MODIFY_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintmsk,
+		intr_mask.d32, 0);
+
+	/* If DEV OUT NAK enabled*/
+	if (pcd->core_if->core_params->dev_out_nak) {
+		/* Run over all out endpoints to determine the ep number on
+		 * which the timeout has happened
+		 */
+		for (i = 0; i <= dev_if->num_out_eps; i++) {
+			if ( pcd->core_if->ep_xfer_info[i].state == 2 )
+				break;
+		}
+		if (i > dev_if->num_out_eps) {
+			dctl_data_t dctl;
+			dctl.d32 =
+			    DWC_READ_REG32(&dev_if->dev_global_regs->dctl);
+			dctl.b.cgoutnak = 1;
+			DWC_WRITE_REG32(&dev_if->dev_global_regs->dctl,
+				dctl.d32);
+			goto out;
+		}
+
+		/* Disable the endpoint */
+		doepctl.d32 = DWC_READ_REG32(&dev_if->out_ep_regs[i]->doepctl);
+		if (doepctl.b.epena) {
+			doepctl.b.epdis = 1;
+			doepctl.b.snak = 1;
+		}
+		DWC_WRITE_REG32(&dev_if->out_ep_regs[i]->doepctl, doepctl.d32);
+		return 1;
+	}
+	/* We come here from Incomplete ISO OUT handler */
+	if (dev_if->isoc_ep) {
+		dwc_ep_t *dwc_ep = (dwc_ep_t *)dev_if->isoc_ep;
+		uint32_t epnum = dwc_ep->num;
+		doepint_data_t doepint;
+		doepint.d32 =
+		    DWC_READ_REG32(&dev_if->out_ep_regs[dwc_ep->num]->doepint);
+		dev_if->isoc_ep = NULL;
+		doepctl.d32 =
+		    DWC_READ_REG32(&dev_if->out_ep_regs[epnum]->doepctl);
+		DWC_PRINTF("Before disable DOEPCTL = %08x\n", doepctl.d32);
+		if (doepctl.b.epena) {
+			doepctl.b.epdis = 1;
+			doepctl.b.snak = 1;
+		}
+		DWC_WRITE_REG32(&dev_if->out_ep_regs[epnum]->doepctl,
+				doepctl.d32);
+		return 1;
+	} else
+		DWC_PRINTF("INTERRUPT Handler not implemented for %s\n",
+			   "Global OUT NAK Effective\n");
+
+out:
+	/* Clear interrupt */
+	gintsts.d32 = 0;
+	gintsts.b.goutnakeff = 1;
+	DWC_WRITE_REG32(&GET_CORE_IF(pcd)->core_global_regs->gintsts,
+			gintsts.d32);
+
+	return 1;
+}
+
+/**
+ * PCD interrupt handler.
+ *
+ * The PCD handles the device interrupts.  Many conditions can cause a
+ * device interrupt. When an interrupt occurs, the device interrupt
+ * service routine determines the cause of the interrupt and
+ * dispatches handling to the appropriate function. These interrupt
+ * handling functions are described below.
+ *
+ * All interrupt registers are processed from LSB to MSB.
+ *
+ */
+int32_t dwc_otg_pcd_handle_intr(dwc_otg_pcd_t * pcd)
+{
+	dwc_otg_core_if_t *core_if = GET_CORE_IF(pcd);
+#ifdef VERBOSE
+	dwc_otg_core_global_regs_t *global_regs = core_if->core_global_regs;
+#endif
+	gintsts_data_t gintr_status;
+	int32_t retval = 0;
+
+	/* Exit from ISR if core is hibernated */
+	if (core_if->hibernation_suspend == 1) {
+		return retval;
+	}
+#ifdef VERBOSE
+	DWC_DEBUGPL(DBG_ANY, "%s() gintsts=%08x	 gintmsk=%08x\n",
+		    __func__,
+		    DWC_READ_REG32(&global_regs->gintsts),
+		    DWC_READ_REG32(&global_regs->gintmsk));
+#endif
+
+	if (dwc_otg_is_device_mode(core_if)) {
+		DWC_SPINLOCK(pcd->lock);
+#ifdef VERBOSE
+		DWC_DEBUGPL(DBG_PCDV, "%s() gintsts=%08x  gintmsk=%08x\n",
+			    __func__,
+			    DWC_READ_REG32(&global_regs->gintsts),
+			    DWC_READ_REG32(&global_regs->gintmsk));
+#endif
+
+		gintr_status.d32 = dwc_otg_read_core_intr(core_if);
+
+		DWC_DEBUGPL(DBG_PCDV, "%s: gintsts&gintmsk=%08x\n",
+			    __func__, gintr_status.d32);
+
+		if (gintr_status.b.sofintr) {
+			retval |= dwc_otg_pcd_handle_sof_intr(pcd);
+		}
+		if (gintr_status.b.rxstsqlvl) {
+			retval |=
+			    dwc_otg_pcd_handle_rx_status_q_level_intr(pcd);
+		}
+		if (gintr_status.b.nptxfempty) {
+			retval |= dwc_otg_pcd_handle_np_tx_fifo_empty_intr(pcd);
+		}
+		if (gintr_status.b.goutnakeff) {
+			retval |= dwc_otg_pcd_handle_out_nak_effective(pcd);
+		}
+		if (gintr_status.b.i2cintr) {
+			retval |= dwc_otg_pcd_handle_i2c_intr(pcd);
+		}
+		if (gintr_status.b.erlysuspend) {
+			retval |= dwc_otg_pcd_handle_early_suspend_intr(pcd);
+		}
+		if (gintr_status.b.usbreset) {
+			retval |= dwc_otg_pcd_handle_usb_reset_intr(pcd);
+		}
+		if (gintr_status.b.enumdone) {
+			retval |= dwc_otg_pcd_handle_enum_done_intr(pcd);
+		}
+		if (gintr_status.b.isooutdrop) {
+			retval |=
+			    dwc_otg_pcd_handle_isoc_out_packet_dropped_intr
+			    (pcd);
+		}
+		if (gintr_status.b.eopframe) {
+			retval |=
+			    dwc_otg_pcd_handle_end_periodic_frame_intr(pcd);
+		}
+		if (gintr_status.b.inepint) {
+			if (!core_if->multiproc_int_enable) {
+				retval |= dwc_otg_pcd_handle_in_ep_intr(pcd);
+			}
+		}
+		if (gintr_status.b.outepintr) {
+			if (!core_if->multiproc_int_enable) {
+				retval |= dwc_otg_pcd_handle_out_ep_intr(pcd);
+			}
+		}
+		if (gintr_status.b.epmismatch) {
+			retval |= dwc_otg_pcd_handle_ep_mismatch_intr(pcd);
+		}
+		if (gintr_status.b.fetsusp) {
+			retval |= dwc_otg_pcd_handle_ep_fetsusp_intr(pcd);
+		}
+		if (gintr_status.b.ginnakeff) {
+			retval |= dwc_otg_pcd_handle_in_nak_effective(pcd);
+		}
+		if (gintr_status.b.incomplisoin) {
+			retval |=
+			    dwc_otg_pcd_handle_incomplete_isoc_in_intr(pcd);
+		}
+		if (gintr_status.b.incomplisoout) {
+			retval |=
+			    dwc_otg_pcd_handle_incomplete_isoc_out_intr(pcd);
+		}
+
+		/* In MPI mode Device Endpoints interrupts are asserted
+		 * without setting outepintr and inepint bits set, so these
+		 * Interrupt handlers are called without checking these bit-fields
+		 */
+		if (core_if->multiproc_int_enable) {
+			retval |= dwc_otg_pcd_handle_in_ep_intr(pcd);
+			retval |= dwc_otg_pcd_handle_out_ep_intr(pcd);
+		}
+#ifdef VERBOSE
+		DWC_DEBUGPL(DBG_PCDV, "%s() gintsts=%0x\n", __func__,
+			    DWC_READ_REG32(&global_regs->gintsts));
+#endif
+		DWC_SPINUNLOCK(pcd->lock);
+	}
+	return retval;
+}
+
+#endif /* DWC_HOST_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c b/drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c
new file mode 100644
index 000000000000..e799f15f2947
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_pcd_linux.c
@@ -0,0 +1,1280 @@
+ /* ==========================================================================
+  * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_pcd_linux.c $
+  * $Revision: #21 $
+  * $Date: 2012/08/10 $
+  * $Change: 2047372 $
+  *
+  * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+  * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+  * otherwise expressly agreed to in writing between Synopsys and you.
+  *
+  * The Software IS NOT an item of Licensed Software or Licensed Product under
+  * any End User Software License Agreement or Agreement for Licensed Product
+  * with Synopsys or any supplement thereto. You are permitted to use and
+  * redistribute this Software in source and binary forms, with or without
+  * modification, provided that redistributions of source code must retain this
+  * notice. You may not view, use, disclose, copy or distribute this file or
+  * any information contained herein except pursuant to this license grant from
+  * Synopsys. If you do not agree with this notice, including the disclaimer
+  * below, then you are not authorized to use the Software.
+  *
+  * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+  * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+  * DAMAGE.
+  * ========================================================================== */
+#ifndef DWC_HOST_ONLY
+
+/** @file
+ * This file implements the Peripheral Controller Driver.
+ *
+ * The Peripheral Controller Driver (PCD) is responsible for
+ * translating requests from the Function Driver into the appropriate
+ * actions on the DWC_otg controller. It isolates the Function Driver
+ * from the specifics of the controller by providing an API to the
+ * Function Driver.
+ *
+ * The Peripheral Controller Driver for Linux will implement the
+ * Gadget API, so that the existing Gadget drivers can be used.
+ * (Gadget Driver is the Linux terminology for a Function Driver.)
+ *
+ * The Linux Gadget API is defined in the header file
+ * <code><linux/usb_gadget.h></code>.  The USB EP operations API is
+ * defined in the structure <code>usb_ep_ops</code> and the USB
+ * Controller API is defined in the structure
+ * <code>usb_gadget_ops</code>.
+ *
+ */
+
+#include "dwc_otg_os_dep.h"
+#include "dwc_otg_pcd_if.h"
+#include "dwc_otg_pcd.h"
+#include "dwc_otg_driver.h"
+#include "dwc_otg_dbg.h"
+
+extern bool fiq_enable;
+
+static struct gadget_wrapper {
+	dwc_otg_pcd_t *pcd;
+
+	struct usb_gadget gadget;
+	struct usb_gadget_driver *driver;
+
+	struct usb_ep ep0;
+	struct usb_ep in_ep[16];
+	struct usb_ep out_ep[16];
+
+} *gadget_wrapper;
+
+/* Display the contents of the buffer */
+extern void dump_msg(const u8 * buf, unsigned int length);
+/**
+ * Get the dwc_otg_pcd_ep_t* from usb_ep* pointer - NULL in case
+ * if the endpoint is not found
+ */
+static struct dwc_otg_pcd_ep *ep_from_handle(dwc_otg_pcd_t * pcd, void *handle)
+{
+	int i;
+	if (pcd->ep0.priv == handle) {
+		return &pcd->ep0;
+	}
+
+	for (i = 0; i < MAX_EPS_CHANNELS - 1; i++) {
+		if (pcd->in_ep[i].priv == handle)
+			return &pcd->in_ep[i];
+		if (pcd->out_ep[i].priv == handle)
+			return &pcd->out_ep[i];
+	}
+
+	return NULL;
+}
+
+/* USB Endpoint Operations */
+/*
+ * The following sections briefly describe the behavior of the Gadget
+ * API endpoint operations implemented in the DWC_otg driver
+ * software. Detailed descriptions of the generic behavior of each of
+ * these functions can be found in the Linux header file
+ * include/linux/usb_gadget.h.
+ *
+ * The Gadget API provides wrapper functions for each of the function
+ * pointers defined in usb_ep_ops. The Gadget Driver calls the wrapper
+ * function, which then calls the underlying PCD function. The
+ * following sections are named according to the wrapper
+ * functions. Within each section, the corresponding DWC_otg PCD
+ * function name is specified.
+ *
+ */
+
+/**
+ * This function is called by the Gadget Driver for each EP to be
+ * configured for the current configuration (SET_CONFIGURATION).
+ *
+ * This function initializes the dwc_otg_ep_t data structure, and then
+ * calls dwc_otg_ep_activate.
+ */
+static int ep_enable(struct usb_ep *usb_ep,
+		     const struct usb_endpoint_descriptor *ep_desc)
+{
+	int retval;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%p)\n", __func__, usb_ep, ep_desc);
+
+	if (!usb_ep || !ep_desc || ep_desc->bDescriptorType != USB_DT_ENDPOINT) {
+		DWC_WARN("%s, bad ep or descriptor\n", __func__);
+		return -EINVAL;
+	}
+	if (usb_ep == &gadget_wrapper->ep0) {
+		DWC_WARN("%s, bad ep(0)\n", __func__);
+		return -EINVAL;
+	}
+
+	/* Check FIFO size? */
+	if (!ep_desc->wMaxPacketSize) {
+		DWC_WARN("%s, bad %s maxpacket\n", __func__, usb_ep->name);
+		return -ERANGE;
+	}
+
+	if (!gadget_wrapper->driver ||
+	    gadget_wrapper->gadget.speed == USB_SPEED_UNKNOWN) {
+		DWC_WARN("%s, bogus device state\n", __func__);
+		return -ESHUTDOWN;
+	}
+
+	/* Delete after check - MAS */
+#if 0
+	nat = (uint32_t) ep_desc->wMaxPacketSize;
+	printk(KERN_ALERT "%s: nat (before) =%d\n", __func__, nat);
+	nat = (nat >> 11) & 0x03;
+	printk(KERN_ALERT "%s: nat (after) =%d\n", __func__, nat);
+#endif
+	retval = dwc_otg_pcd_ep_enable(gadget_wrapper->pcd,
+				       (const uint8_t *)ep_desc,
+				       (void *)usb_ep);
+	if (retval) {
+		DWC_WARN("dwc_otg_pcd_ep_enable failed\n");
+		return -EINVAL;
+	}
+
+	usb_ep->maxpacket = le16_to_cpu(ep_desc->wMaxPacketSize);
+
+	return 0;
+}
+
+/**
+ * This function is called when an EP is disabled due to disconnect or
+ * change in configuration. Any pending requests will terminate with a
+ * status of -ESHUTDOWN.
+ *
+ * This function modifies the dwc_otg_ep_t data structure for this EP,
+ * and then calls dwc_otg_ep_deactivate.
+ */
+static int ep_disable(struct usb_ep *usb_ep)
+{
+	int retval;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, usb_ep);
+	if (!usb_ep) {
+		DWC_DEBUGPL(DBG_PCD, "%s, %s not enabled\n", __func__,
+			    usb_ep ? usb_ep->name : NULL);
+		return -EINVAL;
+	}
+
+	retval = dwc_otg_pcd_ep_disable(gadget_wrapper->pcd, usb_ep);
+	if (retval) {
+		retval = -EINVAL;
+	}
+
+	return retval;
+}
+
+/**
+ * This function allocates a request object to use with the specified
+ * endpoint.
+ *
+ * @param ep The endpoint to be used with with the request
+ * @param gfp_flags the GFP_* flags to use.
+ */
+static struct usb_request *dwc_otg_pcd_alloc_request(struct usb_ep *ep,
+						     gfp_t gfp_flags)
+{
+	struct usb_request *usb_req;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%d)\n", __func__, ep, gfp_flags);
+	if (0 == ep) {
+		DWC_WARN("%s() %s\n", __func__, "Invalid EP!\n");
+		return 0;
+	}
+	usb_req = kzalloc(sizeof(*usb_req), gfp_flags);
+	if (0 == usb_req) {
+		DWC_WARN("%s() %s\n", __func__, "request allocation failed!\n");
+		return 0;
+	}
+	usb_req->dma = DWC_DMA_ADDR_INVALID;
+
+	return usb_req;
+}
+
+/**
+ * This function frees a request object.
+ *
+ * @param ep The endpoint associated with the request
+ * @param req The request being freed
+ */
+static void dwc_otg_pcd_free_request(struct usb_ep *ep, struct usb_request *req)
+{
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%p)\n", __func__, ep, req);
+
+	if (0 == ep || 0 == req) {
+		DWC_WARN("%s() %s\n", __func__,
+			 "Invalid ep or req argument!\n");
+		return;
+	}
+
+	kfree(req);
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+/**
+ * This function allocates an I/O buffer to be used for a transfer
+ * to/from the specified endpoint.
+ *
+ * @param usb_ep The endpoint to be used with with the request
+ * @param bytes The desired number of bytes for the buffer
+ * @param dma Pointer to the buffer's DMA address; must be valid
+ * @param gfp_flags the GFP_* flags to use.
+ * @return address of a new buffer or null is buffer could not be allocated.
+ */
+static void *dwc_otg_pcd_alloc_buffer(struct usb_ep *usb_ep, unsigned bytes,
+				      dma_addr_t * dma, gfp_t gfp_flags)
+{
+	void *buf;
+	dwc_otg_pcd_t *pcd = 0;
+
+	pcd = gadget_wrapper->pcd;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%d,%p,%0x)\n", __func__, usb_ep, bytes,
+		    dma, gfp_flags);
+
+	/* Check dword alignment */
+	if ((bytes & 0x3UL) != 0) {
+		DWC_WARN("%s() Buffer size is not a multiple of"
+			 "DWORD size (%d)", __func__, bytes);
+	}
+
+	buf = dma_alloc_coherent(NULL, bytes, dma, gfp_flags);
+	WARN_ON(!buf);
+
+	/* Check dword alignment */
+	if (((int)buf & 0x3UL) != 0) {
+		DWC_WARN("%s() Buffer is not DWORD aligned (%p)",
+			 __func__, buf);
+	}
+
+	return buf;
+}
+
+/**
+ * This function frees an I/O buffer that was allocated by alloc_buffer.
+ *
+ * @param usb_ep the endpoint associated with the buffer
+ * @param buf address of the buffer
+ * @param dma The buffer's DMA address
+ * @param bytes The number of bytes of the buffer
+ */
+static void dwc_otg_pcd_free_buffer(struct usb_ep *usb_ep, void *buf,
+				    dma_addr_t dma, unsigned bytes)
+{
+	dwc_otg_pcd_t *pcd = 0;
+
+	pcd = gadget_wrapper->pcd;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%0x,%d)\n", __func__, buf, dma, bytes);
+
+	dma_free_coherent(NULL, bytes, buf, dma);
+}
+#endif
+
+/**
+ * This function is used to submit an I/O Request to an EP.
+ *
+ *	- When the request completes the request's completion callback
+ *	  is called to return the request to the driver.
+ *	- An EP, except control EPs, may have multiple requests
+ *	  pending.
+ *	- Once submitted the request cannot be examined or modified.
+ *	- Each request is turned into one or more packets.
+ *	- A BULK EP can queue any amount of data; the transfer is
+ *	  packetized.
+ *	- Zero length Packets are specified with the request 'zero'
+ *	  flag.
+ */
+static int ep_queue(struct usb_ep *usb_ep, struct usb_request *usb_req,
+		    gfp_t gfp_flags)
+{
+	dwc_otg_pcd_t *pcd;
+	struct dwc_otg_pcd_ep *ep = NULL;
+	int retval = 0, is_isoc_ep = 0;
+	dma_addr_t dma_addr = DWC_DMA_ADDR_INVALID;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%p,%d)\n",
+		    __func__, usb_ep, usb_req, gfp_flags);
+
+	if (!usb_req || !usb_req->complete || !usb_req->buf) {
+		DWC_WARN("bad params\n");
+		return -EINVAL;
+	}
+
+	if (!usb_ep) {
+		DWC_WARN("bad ep\n");
+		return -EINVAL;
+	}
+
+	pcd = gadget_wrapper->pcd;
+	if (!gadget_wrapper->driver ||
+	    gadget_wrapper->gadget.speed == USB_SPEED_UNKNOWN) {
+		DWC_DEBUGPL(DBG_PCDV, "gadget.speed=%d\n",
+			    gadget_wrapper->gadget.speed);
+		DWC_WARN("bogus device state\n");
+		return -ESHUTDOWN;
+	}
+
+	DWC_DEBUGPL(DBG_PCD, "%s queue req %p, len %d buf %p\n",
+		    usb_ep->name, usb_req, usb_req->length, usb_req->buf);
+
+	usb_req->status = -EINPROGRESS;
+	usb_req->actual = 0;
+
+	ep = ep_from_handle(pcd, usb_ep);
+	if (ep == NULL)
+		is_isoc_ep = 0;
+	else
+		is_isoc_ep = (ep->dwc_ep.type == DWC_OTG_EP_TYPE_ISOC) ? 1 : 0;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+	dma_addr = usb_req->dma;
+#else
+	if (GET_CORE_IF(pcd)->dma_enable) {
+                dwc_otg_device_t *otg_dev = gadget_wrapper->pcd->otg_dev;
+                struct device *dev = NULL;
+
+                if (otg_dev != NULL)
+                        dev = DWC_OTG_OS_GETDEV(otg_dev->os_dep);
+
+		if (usb_req->length != 0 &&
+                    usb_req->dma == DWC_DMA_ADDR_INVALID) {
+                        dma_addr = dma_map_single(dev, usb_req->buf,
+                                                  usb_req->length,
+                                                  ep->dwc_ep.is_in ?
+                                                        DMA_TO_DEVICE:
+                                                        DMA_FROM_DEVICE);
+		}
+	}
+#endif
+
+#ifdef DWC_UTE_PER_IO
+	if (is_isoc_ep == 1) {
+		retval = dwc_otg_pcd_xiso_ep_queue(pcd, usb_ep, usb_req->buf, dma_addr,
+			usb_req->length, usb_req->zero, usb_req,
+			gfp_flags == GFP_ATOMIC ? 1 : 0, &usb_req->ext_req);
+		if (retval)
+			return -EINVAL;
+
+		return 0;
+	}
+#endif
+	retval = dwc_otg_pcd_ep_queue(pcd, usb_ep, usb_req->buf, dma_addr,
+				      usb_req->length, usb_req->zero, usb_req,
+				      gfp_flags == GFP_ATOMIC ? 1 : 0);
+	if (retval) {
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/**
+ * This function cancels an I/O request from an EP.
+ */
+static int ep_dequeue(struct usb_ep *usb_ep, struct usb_request *usb_req)
+{
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p,%p)\n", __func__, usb_ep, usb_req);
+
+	if (!usb_ep || !usb_req) {
+		DWC_WARN("bad argument\n");
+		return -EINVAL;
+	}
+	if (!gadget_wrapper->driver ||
+	    gadget_wrapper->gadget.speed == USB_SPEED_UNKNOWN) {
+		DWC_WARN("bogus device state\n");
+		return -ESHUTDOWN;
+	}
+	if (dwc_otg_pcd_ep_dequeue(gadget_wrapper->pcd, usb_ep, usb_req)) {
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/**
+ * usb_ep_set_halt stalls an endpoint.
+ *
+ * usb_ep_clear_halt clears an endpoint halt and resets its data
+ * toggle.
+ *
+ * Both of these functions are implemented with the same underlying
+ * function. The behavior depends on the value argument.
+ *
+ * @param[in] usb_ep the Endpoint to halt or clear halt.
+ * @param[in] value
+ *	- 0 means clear_halt.
+ *	- 1 means set_halt,
+ *	- 2 means clear stall lock flag.
+ *	- 3 means set  stall lock flag.
+ */
+static int ep_halt(struct usb_ep *usb_ep, int value)
+{
+	int retval = 0;
+
+	DWC_DEBUGPL(DBG_PCD, "HALT %s %d\n", usb_ep->name, value);
+
+	if (!usb_ep) {
+		DWC_WARN("bad ep\n");
+		return -EINVAL;
+	}
+
+	retval = dwc_otg_pcd_ep_halt(gadget_wrapper->pcd, usb_ep, value);
+	if (retval == -DWC_E_AGAIN) {
+		return -EAGAIN;
+	} else if (retval) {
+		retval = -EINVAL;
+	}
+
+	return retval;
+}
+
+//#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,30))
+#if 0
+/**
+ * ep_wedge: sets the halt feature and ignores clear requests
+ *
+ * @usb_ep: the endpoint being wedged
+ *
+ * Use this to stall an endpoint and ignore CLEAR_FEATURE(HALT_ENDPOINT)
+ * requests. If the gadget driver clears the halt status, it will
+ * automatically unwedge the endpoint.
+ *
+ * Returns zero on success, else negative errno. *
+ * Check usb_ep_set_wedge() at "usb_gadget.h" for details
+ */
+static int ep_wedge(struct usb_ep *usb_ep)
+{
+	int retval = 0;
+
+	DWC_DEBUGPL(DBG_PCD, "WEDGE %s\n", usb_ep->name);
+
+	if (!usb_ep) {
+		DWC_WARN("bad ep\n");
+		return -EINVAL;
+	}
+
+	retval = dwc_otg_pcd_ep_wedge(gadget_wrapper->pcd, usb_ep);
+	if (retval == -DWC_E_AGAIN) {
+		retval = -EAGAIN;
+	} else if (retval) {
+		retval = -EINVAL;
+	}
+
+	return retval;
+}
+#endif
+
+#ifdef DWC_EN_ISOC
+/**
+ * This function is used to submit an ISOC Transfer Request to an EP.
+ *
+ *	- Every time a sync period completes the request's completion callback
+ *	  is called to provide data to the gadget driver.
+ *	- Once submitted the request cannot be modified.
+ *	- Each request is turned into periodic data packets untill ISO
+ *	  Transfer is stopped..
+ */
+static int iso_ep_start(struct usb_ep *usb_ep, struct usb_iso_request *req,
+			gfp_t gfp_flags)
+{
+	int retval = 0;
+
+	if (!req || !req->process_buffer || !req->buf0 || !req->buf1) {
+		DWC_WARN("bad params\n");
+		return -EINVAL;
+	}
+
+	if (!usb_ep) {
+		DWC_PRINTF("bad params\n");
+		return -EINVAL;
+	}
+
+	req->status = -EINPROGRESS;
+
+	retval =
+	    dwc_otg_pcd_iso_ep_start(gadget_wrapper->pcd, usb_ep, req->buf0,
+				     req->buf1, req->dma0, req->dma1,
+				     req->sync_frame, req->data_pattern_frame,
+				     req->data_per_frame,
+				     req->
+				     flags & USB_REQ_ISO_ASAP ? -1 :
+				     req->start_frame, req->buf_proc_intrvl,
+				     req, gfp_flags == GFP_ATOMIC ? 1 : 0);
+
+	if (retval) {
+		return -EINVAL;
+	}
+
+	return retval;
+}
+
+/**
+ * This function stops ISO EP Periodic Data Transfer.
+ */
+static int iso_ep_stop(struct usb_ep *usb_ep, struct usb_iso_request *req)
+{
+	int retval = 0;
+	if (!usb_ep) {
+		DWC_WARN("bad ep\n");
+	}
+
+	if (!gadget_wrapper->driver ||
+	    gadget_wrapper->gadget.speed == USB_SPEED_UNKNOWN) {
+		DWC_DEBUGPL(DBG_PCDV, "gadget.speed=%d\n",
+			    gadget_wrapper->gadget.speed);
+		DWC_WARN("bogus device state\n");
+	}
+
+	dwc_otg_pcd_iso_ep_stop(gadget_wrapper->pcd, usb_ep, req);
+	if (retval) {
+		retval = -EINVAL;
+	}
+
+	return retval;
+}
+
+static struct usb_iso_request *alloc_iso_request(struct usb_ep *ep,
+						 int packets, gfp_t gfp_flags)
+{
+	struct usb_iso_request *pReq = NULL;
+	uint32_t req_size;
+
+	req_size = sizeof(struct usb_iso_request);
+	req_size +=
+	    (2 * packets * (sizeof(struct usb_gadget_iso_packet_descriptor)));
+
+	pReq = kmalloc(req_size, gfp_flags);
+	if (!pReq) {
+		DWC_WARN("Can't allocate Iso Request\n");
+		return 0;
+	}
+	pReq->iso_packet_desc0 = (void *)(pReq + 1);
+
+	pReq->iso_packet_desc1 = pReq->iso_packet_desc0 + packets;
+
+	return pReq;
+}
+
+static void free_iso_request(struct usb_ep *ep, struct usb_iso_request *req)
+{
+	kfree(req);
+}
+
+static struct usb_isoc_ep_ops dwc_otg_pcd_ep_ops = {
+	.ep_ops = {
+		   .enable = ep_enable,
+		   .disable = ep_disable,
+
+		   .alloc_request = dwc_otg_pcd_alloc_request,
+		   .free_request = dwc_otg_pcd_free_request,
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+		   .alloc_buffer = dwc_otg_pcd_alloc_buffer,
+		   .free_buffer = dwc_otg_pcd_free_buffer,
+#endif
+
+		   .queue = ep_queue,
+		   .dequeue = ep_dequeue,
+
+		   .set_halt = ep_halt,
+		   .fifo_status = 0,
+		   .fifo_flush = 0,
+		   },
+	.iso_ep_start = iso_ep_start,
+	.iso_ep_stop = iso_ep_stop,
+	.alloc_iso_request = alloc_iso_request,
+	.free_iso_request = free_iso_request,
+};
+
+#else
+
+	int (*enable) (struct usb_ep *ep,
+		const struct usb_endpoint_descriptor *desc);
+	int (*disable) (struct usb_ep *ep);
+
+	struct usb_request *(*alloc_request) (struct usb_ep *ep,
+		gfp_t gfp_flags);
+	void (*free_request) (struct usb_ep *ep, struct usb_request *req);
+
+	int (*queue) (struct usb_ep *ep, struct usb_request *req,
+		gfp_t gfp_flags);
+	int (*dequeue) (struct usb_ep *ep, struct usb_request *req);
+
+	int (*set_halt) (struct usb_ep *ep, int value);
+	int (*set_wedge) (struct usb_ep *ep);
+
+	int (*fifo_status) (struct usb_ep *ep);
+	void (*fifo_flush) (struct usb_ep *ep);
+static struct usb_ep_ops dwc_otg_pcd_ep_ops = {
+	.enable = ep_enable,
+	.disable = ep_disable,
+
+	.alloc_request = dwc_otg_pcd_alloc_request,
+	.free_request = dwc_otg_pcd_free_request,
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+	.alloc_buffer = dwc_otg_pcd_alloc_buffer,
+	.free_buffer = dwc_otg_pcd_free_buffer,
+#else
+	/* .set_wedge = ep_wedge, */
+        .set_wedge = NULL, /* uses set_halt instead */
+#endif
+
+	.queue = ep_queue,
+	.dequeue = ep_dequeue,
+
+	.set_halt = ep_halt,
+	.fifo_status = 0,
+	.fifo_flush = 0,
+
+};
+
+#endif /* _EN_ISOC_ */
+/*	Gadget Operations */
+/**
+ * The following gadget operations will be implemented in the DWC_otg
+ * PCD. Functions in the API that are not described below are not
+ * implemented.
+ *
+ * The Gadget API provides wrapper functions for each of the function
+ * pointers defined in usb_gadget_ops. The Gadget Driver calls the
+ * wrapper function, which then calls the underlying PCD function. The
+ * following sections are named according to the wrapper functions
+ * (except for ioctl, which doesn't have a wrapper function). Within
+ * each section, the corresponding DWC_otg PCD function name is
+ * specified.
+ *
+ */
+
+/**
+ *Gets the USB Frame number of the last SOF.
+ */
+static int get_frame_number(struct usb_gadget *gadget)
+{
+	struct gadget_wrapper *d;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, gadget);
+
+	if (gadget == 0) {
+		return -ENODEV;
+	}
+
+	d = container_of(gadget, struct gadget_wrapper, gadget);
+	return dwc_otg_pcd_get_frame_number(d->pcd);
+}
+
+#ifdef CONFIG_USB_DWC_OTG_LPM
+static int test_lpm_enabled(struct usb_gadget *gadget)
+{
+	struct gadget_wrapper *d;
+
+	d = container_of(gadget, struct gadget_wrapper, gadget);
+
+	return dwc_otg_pcd_is_lpm_enabled(d->pcd);
+}
+#endif
+
+/**
+ * Initiates Session Request Protocol (SRP) to wakeup the host if no
+ * session is in progress. If a session is already in progress, but
+ * the device is suspended, remote wakeup signaling is started.
+ *
+ */
+static int wakeup(struct usb_gadget *gadget)
+{
+	struct gadget_wrapper *d;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, gadget);
+
+	if (gadget == 0) {
+		return -ENODEV;
+	} else {
+		d = container_of(gadget, struct gadget_wrapper, gadget);
+	}
+	dwc_otg_pcd_wakeup(d->pcd);
+	return 0;
+}
+
+static const struct usb_gadget_ops dwc_otg_pcd_ops = {
+	.get_frame = get_frame_number,
+	.wakeup = wakeup,
+#ifdef CONFIG_USB_DWC_OTG_LPM
+	.lpm_support = test_lpm_enabled,
+#endif
+	// current versions must always be self-powered
+};
+
+static int _setup(dwc_otg_pcd_t * pcd, uint8_t * bytes)
+{
+	int retval = -DWC_E_NOT_SUPPORTED;
+	if (gadget_wrapper->driver && gadget_wrapper->driver->setup) {
+		retval = gadget_wrapper->driver->setup(&gadget_wrapper->gadget,
+						       (struct usb_ctrlrequest
+							*)bytes);
+	}
+
+	if (retval == -ENOTSUPP) {
+		retval = -DWC_E_NOT_SUPPORTED;
+	} else if (retval < 0) {
+		retval = -DWC_E_INVALID;
+	}
+
+	return retval;
+}
+
+#ifdef DWC_EN_ISOC
+static int _isoc_complete(dwc_otg_pcd_t * pcd, void *ep_handle,
+			  void *req_handle, int proc_buf_num)
+{
+	int i, packet_count;
+	struct usb_gadget_iso_packet_descriptor *iso_packet = 0;
+	struct usb_iso_request *iso_req = req_handle;
+
+	if (proc_buf_num) {
+		iso_packet = iso_req->iso_packet_desc1;
+	} else {
+		iso_packet = iso_req->iso_packet_desc0;
+	}
+	packet_count =
+	    dwc_otg_pcd_get_iso_packet_count(pcd, ep_handle, req_handle);
+	for (i = 0; i < packet_count; ++i) {
+		int status;
+		int actual;
+		int offset;
+		dwc_otg_pcd_get_iso_packet_params(pcd, ep_handle, req_handle,
+						  i, &status, &actual, &offset);
+		switch (status) {
+		case -DWC_E_NO_DATA:
+			status = -ENODATA;
+			break;
+		default:
+			if (status) {
+				DWC_PRINTF("unknown status in isoc packet\n");
+			}
+
+		}
+		iso_packet[i].status = status;
+		iso_packet[i].offset = offset;
+		iso_packet[i].actual_length = actual;
+	}
+
+	iso_req->status = 0;
+	iso_req->process_buffer(ep_handle, iso_req);
+
+	return 0;
+}
+#endif /* DWC_EN_ISOC */
+
+#ifdef DWC_UTE_PER_IO
+/**
+ * Copy the contents of the extended request to the Linux usb_request's
+ * extended part and call the gadget's completion.
+ *
+ * @param pcd			Pointer to the pcd structure
+ * @param ep_handle		Void pointer to the usb_ep structure
+ * @param req_handle	Void pointer to the usb_request structure
+ * @param status		Request status returned from the portable logic
+ * @param ereq_port		Void pointer to the extended request structure
+ *						created in the the portable part that contains the
+ *						results of the processed iso packets.
+ */
+static int _xisoc_complete(dwc_otg_pcd_t * pcd, void *ep_handle,
+			   void *req_handle, int32_t status, void *ereq_port)
+{
+	struct dwc_ute_iso_req_ext *ereqorg = NULL;
+	struct dwc_iso_xreq_port *ereqport = NULL;
+	struct dwc_ute_iso_packet_descriptor *desc_org = NULL;
+	int i;
+	struct usb_request *req;
+	//struct dwc_ute_iso_packet_descriptor *
+	//int status = 0;
+
+	req = (struct usb_request *)req_handle;
+	ereqorg = &req->ext_req;
+	ereqport = (struct dwc_iso_xreq_port *)ereq_port;
+	desc_org = ereqorg->per_io_frame_descs;
+
+	if (req && req->complete) {
+		/* Copy the request data from the portable logic to our request */
+		for (i = 0; i < ereqport->pio_pkt_count; i++) {
+			desc_org[i].actual_length =
+			    ereqport->per_io_frame_descs[i].actual_length;
+			desc_org[i].status =
+			    ereqport->per_io_frame_descs[i].status;
+		}
+
+		switch (status) {
+		case -DWC_E_SHUTDOWN:
+			req->status = -ESHUTDOWN;
+			break;
+		case -DWC_E_RESTART:
+			req->status = -ECONNRESET;
+			break;
+		case -DWC_E_INVALID:
+			req->status = -EINVAL;
+			break;
+		case -DWC_E_TIMEOUT:
+			req->status = -ETIMEDOUT;
+			break;
+		default:
+			req->status = status;
+		}
+
+		/* And call the gadget's completion */
+		req->complete(ep_handle, req);
+	}
+
+	return 0;
+}
+#endif /* DWC_UTE_PER_IO */
+
+static int _complete(dwc_otg_pcd_t * pcd, void *ep_handle,
+		     void *req_handle, int32_t status, uint32_t actual)
+{
+	struct usb_request *req = (struct usb_request *)req_handle;
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27)
+	struct dwc_otg_pcd_ep *ep = NULL;
+#endif
+
+	if (req && req->complete) {
+		switch (status) {
+		case -DWC_E_SHUTDOWN:
+			req->status = -ESHUTDOWN;
+			break;
+		case -DWC_E_RESTART:
+			req->status = -ECONNRESET;
+			break;
+		case -DWC_E_INVALID:
+			req->status = -EINVAL;
+			break;
+		case -DWC_E_TIMEOUT:
+			req->status = -ETIMEDOUT;
+			break;
+		default:
+			req->status = status;
+
+		}
+
+		req->actual = actual;
+		DWC_SPINUNLOCK(pcd->lock);
+		req->complete(ep_handle, req);
+		DWC_SPINLOCK(pcd->lock);
+	}
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27)
+	ep = ep_from_handle(pcd, ep_handle);
+	if (GET_CORE_IF(pcd)->dma_enable) {
+                if (req->length != 0) {
+                        dwc_otg_device_t *otg_dev = gadget_wrapper->pcd->otg_dev;
+                        struct device *dev = NULL;
+
+                        if (otg_dev != NULL)
+                                  dev = DWC_OTG_OS_GETDEV(otg_dev->os_dep);
+
+			dma_unmap_single(dev, req->dma, req->length,
+                                         ep->dwc_ep.is_in ?
+                                                DMA_TO_DEVICE: DMA_FROM_DEVICE);
+                }
+	}
+#endif
+
+	return 0;
+}
+
+static int _connect(dwc_otg_pcd_t * pcd, int speed)
+{
+	gadget_wrapper->gadget.speed = speed;
+	return 0;
+}
+
+static int _disconnect(dwc_otg_pcd_t * pcd)
+{
+	if (gadget_wrapper->driver && gadget_wrapper->driver->disconnect) {
+		gadget_wrapper->driver->disconnect(&gadget_wrapper->gadget);
+	}
+	return 0;
+}
+
+static int _resume(dwc_otg_pcd_t * pcd)
+{
+	if (gadget_wrapper->driver && gadget_wrapper->driver->resume) {
+		gadget_wrapper->driver->resume(&gadget_wrapper->gadget);
+	}
+
+	return 0;
+}
+
+static int _suspend(dwc_otg_pcd_t * pcd)
+{
+	if (gadget_wrapper->driver && gadget_wrapper->driver->suspend) {
+		gadget_wrapper->driver->suspend(&gadget_wrapper->gadget);
+	}
+	return 0;
+}
+
+/**
+ * This function updates the otg values in the gadget structure.
+ */
+static int _hnp_changed(dwc_otg_pcd_t * pcd)
+{
+
+	if (!gadget_wrapper->gadget.is_otg)
+		return 0;
+
+	gadget_wrapper->gadget.b_hnp_enable = get_b_hnp_enable(pcd);
+	gadget_wrapper->gadget.a_hnp_support = get_a_hnp_support(pcd);
+	gadget_wrapper->gadget.a_alt_hnp_support = get_a_alt_hnp_support(pcd);
+	return 0;
+}
+
+static int _reset(dwc_otg_pcd_t * pcd)
+{
+	return 0;
+}
+
+#ifdef DWC_UTE_CFI
+static int _cfi_setup(dwc_otg_pcd_t * pcd, void *cfi_req)
+{
+	int retval = -DWC_E_INVALID;
+	if (gadget_wrapper->driver->cfi_feature_setup) {
+		retval =
+		    gadget_wrapper->driver->
+		    cfi_feature_setup(&gadget_wrapper->gadget,
+				      (struct cfi_usb_ctrlrequest *)cfi_req);
+	}
+
+	return retval;
+}
+#endif
+
+static const struct dwc_otg_pcd_function_ops fops = {
+	.complete = _complete,
+#ifdef DWC_EN_ISOC
+	.isoc_complete = _isoc_complete,
+#endif
+	.setup = _setup,
+	.disconnect = _disconnect,
+	.connect = _connect,
+	.resume = _resume,
+	.suspend = _suspend,
+	.hnp_changed = _hnp_changed,
+	.reset = _reset,
+#ifdef DWC_UTE_CFI
+	.cfi_setup = _cfi_setup,
+#endif
+#ifdef DWC_UTE_PER_IO
+	.xisoc_complete = _xisoc_complete,
+#endif
+};
+
+/**
+ * This function is the top level PCD interrupt handler.
+ */
+static irqreturn_t dwc_otg_pcd_irq(int irq, void *dev)
+{
+	dwc_otg_pcd_t *pcd = dev;
+	int32_t retval = IRQ_NONE;
+
+	retval = dwc_otg_pcd_handle_intr(pcd);
+	if (retval != 0) {
+		S3C2410X_CLEAR_EINTPEND();
+	}
+	return IRQ_RETVAL(retval);
+}
+
+/**
+ * This function initialized the usb_ep structures to there default
+ * state.
+ *
+ * @param d Pointer on gadget_wrapper.
+ */
+void gadget_add_eps(struct gadget_wrapper *d)
+{
+	static const char *names[] = {
+
+		"ep0",
+		"ep1in",
+		"ep2in",
+		"ep3in",
+		"ep4in",
+		"ep5in",
+		"ep6in",
+		"ep7in",
+		"ep8in",
+		"ep9in",
+		"ep10in",
+		"ep11in",
+		"ep12in",
+		"ep13in",
+		"ep14in",
+		"ep15in",
+		"ep1out",
+		"ep2out",
+		"ep3out",
+		"ep4out",
+		"ep5out",
+		"ep6out",
+		"ep7out",
+		"ep8out",
+		"ep9out",
+		"ep10out",
+		"ep11out",
+		"ep12out",
+		"ep13out",
+		"ep14out",
+		"ep15out"
+	};
+
+	int i;
+	struct usb_ep *ep;
+	int8_t dev_endpoints;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s\n", __func__);
+
+	INIT_LIST_HEAD(&d->gadget.ep_list);
+	d->gadget.ep0 = &d->ep0;
+	d->gadget.speed = USB_SPEED_UNKNOWN;
+
+	INIT_LIST_HEAD(&d->gadget.ep0->ep_list);
+
+	/**
+	 * Initialize the EP0 structure.
+	 */
+	ep = &d->ep0;
+
+	/* Init the usb_ep structure. */
+	ep->name = names[0];
+	ep->ops = (struct usb_ep_ops *)&dwc_otg_pcd_ep_ops;
+
+	/**
+	 * @todo NGS: What should the max packet size be set to
+	 * here?  Before EP type is set?
+	 */
+	ep->maxpacket = MAX_PACKET_SIZE;
+	dwc_otg_pcd_ep_enable(d->pcd, NULL, ep);
+
+	list_add_tail(&ep->ep_list, &d->gadget.ep_list);
+
+	/**
+	 * Initialize the EP structures.
+	 */
+	dev_endpoints = d->pcd->core_if->dev_if->num_in_eps;
+
+	for (i = 0; i < dev_endpoints; i++) {
+		ep = &d->in_ep[i];
+
+		/* Init the usb_ep structure. */
+		ep->name = names[d->pcd->in_ep[i].dwc_ep.num];
+		ep->ops = (struct usb_ep_ops *)&dwc_otg_pcd_ep_ops;
+
+		/**
+		 * @todo NGS: What should the max packet size be set to
+		 * here?  Before EP type is set?
+		 */
+		ep->maxpacket = MAX_PACKET_SIZE;
+		list_add_tail(&ep->ep_list, &d->gadget.ep_list);
+	}
+
+	dev_endpoints = d->pcd->core_if->dev_if->num_out_eps;
+
+	for (i = 0; i < dev_endpoints; i++) {
+		ep = &d->out_ep[i];
+
+		/* Init the usb_ep structure. */
+		ep->name = names[15 + d->pcd->out_ep[i].dwc_ep.num];
+		ep->ops = (struct usb_ep_ops *)&dwc_otg_pcd_ep_ops;
+
+		/**
+		 * @todo NGS: What should the max packet size be set to
+		 * here?  Before EP type is set?
+		 */
+		ep->maxpacket = MAX_PACKET_SIZE;
+
+		list_add_tail(&ep->ep_list, &d->gadget.ep_list);
+	}
+
+	/* remove ep0 from the list.  There is a ep0 pointer. */
+	list_del_init(&d->ep0.ep_list);
+
+	d->ep0.maxpacket = MAX_EP0_SIZE;
+}
+
+/**
+ * This function releases the Gadget device.
+ * required by device_unregister().
+ *
+ * @todo Should this do something?	Should it free the PCD?
+ */
+static void dwc_otg_pcd_gadget_release(struct device *dev)
+{
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p)\n", __func__, dev);
+}
+
+static struct gadget_wrapper *alloc_wrapper(dwc_bus_dev_t *_dev)
+{
+	static char pcd_name[] = "dwc_otg_pcd";
+	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
+	struct gadget_wrapper *d;
+	int retval;
+
+	d = DWC_ALLOC(sizeof(*d));
+	if (d == NULL) {
+		return NULL;
+	}
+
+	memset(d, 0, sizeof(*d));
+
+	d->gadget.name = pcd_name;
+	d->pcd = otg_dev->pcd;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,30)
+	strcpy(d->gadget.dev.bus_id, "gadget");
+#else
+	dev_set_name(&d->gadget.dev, "%s", "gadget");
+#endif
+
+	d->gadget.dev.parent = &_dev->dev;
+	d->gadget.dev.release = dwc_otg_pcd_gadget_release;
+	d->gadget.ops = &dwc_otg_pcd_ops;
+	d->gadget.max_speed = dwc_otg_pcd_is_dualspeed(otg_dev->pcd) ? USB_SPEED_HIGH:USB_SPEED_FULL;
+	d->gadget.is_otg = dwc_otg_pcd_is_otg(otg_dev->pcd);
+
+	d->driver = 0;
+	/* Register the gadget device */
+	retval = device_register(&d->gadget.dev);
+	if (retval != 0) {
+		DWC_ERROR("device_register failed\n");
+		DWC_FREE(d);
+		return NULL;
+	}
+
+	return d;
+}
+
+static void free_wrapper(struct gadget_wrapper *d)
+{
+	if (d->driver) {
+		/* should have been done already by driver model core */
+		DWC_WARN("driver '%s' is still registered\n",
+			 d->driver->driver.name);
+#ifdef CONFIG_USB_GADGET
+		usb_gadget_unregister_driver(d->driver);
+#endif
+	}
+
+	device_unregister(&d->gadget.dev);
+	DWC_FREE(d);
+}
+
+/**
+ * This function initialized the PCD portion of the driver.
+ *
+ */
+int pcd_init(dwc_bus_dev_t *_dev)
+{
+	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
+	int retval = 0;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p) otg_dev=%p\n", __func__, _dev, otg_dev);
+
+	otg_dev->pcd = dwc_otg_pcd_init(otg_dev);
+
+	if (!otg_dev->pcd) {
+		DWC_ERROR("dwc_otg_pcd_init failed\n");
+		return -ENOMEM;
+	}
+
+	otg_dev->pcd->otg_dev = otg_dev;
+	gadget_wrapper = alloc_wrapper(_dev);
+
+	/*
+	 * Initialize EP structures
+	 */
+	gadget_add_eps(gadget_wrapper);
+	/*
+	 * Setup interupt handler
+	 */
+#ifdef PLATFORM_INTERFACE
+	DWC_DEBUGPL(DBG_ANY, "registering handler for irq%d\n",
+                    platform_get_irq(_dev, fiq_enable ? 0 : 1));
+	retval = request_irq(platform_get_irq(_dev, fiq_enable ? 0 : 1), dwc_otg_pcd_irq,
+			     IRQF_SHARED, gadget_wrapper->gadget.name,
+			     otg_dev->pcd);
+	if (retval != 0) {
+		DWC_ERROR("request of irq%d failed\n",
+                          platform_get_irq(_dev, fiq_enable ? 0 : 1));
+		free_wrapper(gadget_wrapper);
+		return -EBUSY;
+	}
+#else
+	DWC_DEBUGPL(DBG_ANY, "registering handler for irq%d\n",
+                    _dev->irq);
+	retval = request_irq(_dev->irq, dwc_otg_pcd_irq,
+			     IRQF_SHARED | IRQF_DISABLED,
+			     gadget_wrapper->gadget.name, otg_dev->pcd);
+	if (retval != 0) {
+		DWC_ERROR("request of irq%d failed\n", _dev->irq);
+		free_wrapper(gadget_wrapper);
+		return -EBUSY;
+	}
+#endif
+
+	dwc_otg_pcd_start(gadget_wrapper->pcd, &fops);
+
+	return retval;
+}
+
+/**
+ * Cleanup the PCD.
+ */
+void pcd_remove(dwc_bus_dev_t *_dev)
+{
+	dwc_otg_device_t *otg_dev = DWC_OTG_BUSDRVDATA(_dev);
+	dwc_otg_pcd_t *pcd = otg_dev->pcd;
+
+	DWC_DEBUGPL(DBG_PCDV, "%s(%p) otg_dev %p\n", __func__, _dev, otg_dev);
+
+	/*
+	 * Free the IRQ
+	 */
+#ifdef PLATFORM_INTERFACE
+	free_irq(platform_get_irq(_dev, 0), pcd);
+#else
+	free_irq(_dev->irq, pcd);
+#endif
+	dwc_otg_pcd_remove(otg_dev->pcd);
+	free_wrapper(gadget_wrapper);
+	otg_dev->pcd = 0;
+}
+
+#endif /* DWC_HOST_ONLY */
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_regs.h b/drivers/usb/host/dwc_otg/dwc_otg_regs.h
new file mode 100644
index 000000000000..8e0e7b569f1a
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/dwc_otg_regs.h
@@ -0,0 +1,2550 @@
+/* ==========================================================================
+ * $File: //dwh/usb_iip/dev/software/otg/linux/drivers/dwc_otg_regs.h $
+ * $Revision: #98 $
+ * $Date: 2012/08/10 $
+ * $Change: 2047372 $
+ *
+ * Synopsys HS OTG Linux Software Driver and documentation (hereinafter,
+ * "Software") is an Unsupported proprietary work of Synopsys, Inc. unless
+ * otherwise expressly agreed to in writing between Synopsys and you.
+ *
+ * The Software IS NOT an item of Licensed Software or Licensed Product under
+ * any End User Software License Agreement or Agreement for Licensed Product
+ * with Synopsys or any supplement thereto. You are permitted to use and
+ * redistribute this Software in source and binary forms, with or without
+ * modification, provided that redistributions of source code must retain this
+ * notice. You may not view, use, disclose, copy or distribute this file or
+ * any information contained herein except pursuant to this license grant from
+ * Synopsys. If you do not agree with this notice, including the disclaimer
+ * below, then you are not authorized to use the Software.
+ *
+ * THIS SOFTWARE IS BEING DISTRIBUTED BY SYNOPSYS SOLELY ON AN "AS IS" BASIS
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE HEREBY DISCLAIMED. IN NO EVENT SHALL SYNOPSYS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ * ========================================================================== */
+
+#ifndef __DWC_OTG_REGS_H__
+#define __DWC_OTG_REGS_H__
+
+#include "dwc_otg_core_if.h"
+
+/**
+ * @file
+ *
+ * This file contains the data structures for accessing the DWC_otg core registers.
+ *
+ * The application interfaces with the HS OTG core by reading from and
+ * writing to the Control and Status Register (CSR) space through the
+ * AHB Slave interface. These registers are 32 bits wide, and the
+ * addresses are 32-bit-block aligned.
+ * CSRs are classified as follows:
+ * - Core Global Registers
+ * - Device Mode Registers
+ * - Device Global Registers
+ * - Device Endpoint Specific Registers
+ * - Host Mode Registers
+ * - Host Global Registers
+ * - Host Port CSRs
+ * - Host Channel Specific Registers
+ *
+ * Only the Core Global registers can be accessed in both Device and
+ * Host modes. When the HS OTG core is operating in one mode, either
+ * Device or Host, the application must not access registers from the
+ * other mode. When the core switches from one mode to another, the
+ * registers in the new mode of operation must be reprogrammed as they
+ * would be after a power-on reset.
+ */
+
+/****************************************************************************/
+/** DWC_otg Core registers .
+ * The dwc_otg_core_global_regs structure defines the size
+ * and relative field offsets for the Core Global registers.
+ */
+typedef struct dwc_otg_core_global_regs {
+	/** OTG Control and Status Register.  <i>Offset: 000h</i> */
+	volatile uint32_t gotgctl;
+	/** OTG Interrupt Register.	 <i>Offset: 004h</i> */
+	volatile uint32_t gotgint;
+	/**Core AHB Configuration Register.	 <i>Offset: 008h</i> */
+	volatile uint32_t gahbcfg;
+
+#define DWC_GLBINTRMASK		0x0001
+#define DWC_DMAENABLE		0x0020
+#define DWC_NPTXEMPTYLVL_EMPTY	0x0080
+#define DWC_NPTXEMPTYLVL_HALFEMPTY	0x0000
+#define DWC_PTXEMPTYLVL_EMPTY	0x0100
+#define DWC_PTXEMPTYLVL_HALFEMPTY	0x0000
+
+	/**Core USB Configuration Register.	 <i>Offset: 00Ch</i> */
+	volatile uint32_t gusbcfg;
+	/**Core Reset Register.	 <i>Offset: 010h</i> */
+	volatile uint32_t grstctl;
+	/**Core Interrupt Register.	 <i>Offset: 014h</i> */
+	volatile uint32_t gintsts;
+	/**Core Interrupt Mask Register.  <i>Offset: 018h</i> */
+	volatile uint32_t gintmsk;
+	/**Receive Status Queue Read Register (Read Only).	<i>Offset: 01Ch</i> */
+	volatile uint32_t grxstsr;
+	/**Receive Status Queue Read & POP Register (Read Only).  <i>Offset: 020h</i>*/
+	volatile uint32_t grxstsp;
+	/**Receive FIFO Size Register.	<i>Offset: 024h</i> */
+	volatile uint32_t grxfsiz;
+	/**Non Periodic Transmit FIFO Size Register.  <i>Offset: 028h</i> */
+	volatile uint32_t gnptxfsiz;
+	/**Non Periodic Transmit FIFO/Queue Status Register (Read
+	 * Only). <i>Offset: 02Ch</i> */
+	volatile uint32_t gnptxsts;
+	/**I2C Access Register.	 <i>Offset: 030h</i> */
+	volatile uint32_t gi2cctl;
+	/**PHY Vendor Control Register.	 <i>Offset: 034h</i> */
+	volatile uint32_t gpvndctl;
+	/**General Purpose Input/Output Register.  <i>Offset: 038h</i> */
+	volatile uint32_t ggpio;
+	/**User ID Register.  <i>Offset: 03Ch</i> */
+	volatile uint32_t guid;
+	/**Synopsys ID Register (Read Only).  <i>Offset: 040h</i> */
+	volatile uint32_t gsnpsid;
+	/**User HW Config1 Register (Read Only).  <i>Offset: 044h</i> */
+	volatile uint32_t ghwcfg1;
+	/**User HW Config2 Register (Read Only).  <i>Offset: 048h</i> */
+	volatile uint32_t ghwcfg2;
+#define DWC_SLAVE_ONLY_ARCH 0
+#define DWC_EXT_DMA_ARCH 1
+#define DWC_INT_DMA_ARCH 2
+
+#define DWC_MODE_HNP_SRP_CAPABLE	0
+#define DWC_MODE_SRP_ONLY_CAPABLE	1
+#define DWC_MODE_NO_HNP_SRP_CAPABLE		2
+#define DWC_MODE_SRP_CAPABLE_DEVICE		3
+#define DWC_MODE_NO_SRP_CAPABLE_DEVICE	4
+#define DWC_MODE_SRP_CAPABLE_HOST	5
+#define DWC_MODE_NO_SRP_CAPABLE_HOST	6
+
+	/**User HW Config3 Register (Read Only).  <i>Offset: 04Ch</i> */
+	volatile uint32_t ghwcfg3;
+	/**User HW Config4 Register (Read Only).  <i>Offset: 050h</i>*/
+	volatile uint32_t ghwcfg4;
+	/** Core LPM Configuration register <i>Offset: 054h</i>*/
+	volatile uint32_t glpmcfg;
+	/** Global PowerDn Register <i>Offset: 058h</i> */
+	volatile uint32_t gpwrdn;
+	/** Global DFIFO SW Config Register  <i>Offset: 05Ch</i> */
+	volatile uint32_t gdfifocfg;
+	/** ADP Control Register  <i>Offset: 060h</i> */
+	volatile uint32_t adpctl;
+	/** Reserved  <i>Offset: 064h-0FFh</i> */
+	volatile uint32_t reserved39[39];
+	/** Host Periodic Transmit FIFO Size Register. <i>Offset: 100h</i> */
+	volatile uint32_t hptxfsiz;
+	/** Device Periodic Transmit FIFO#n Register if dedicated fifos are disabled,
+		otherwise Device Transmit FIFO#n Register.
+	 * <i>Offset: 104h + (FIFO_Number-1)*04h, 1 <= FIFO Number <= 15 (1<=n<=15).</i> */
+	volatile uint32_t dtxfsiz[15];
+} dwc_otg_core_global_regs_t;
+
+/**
+ * This union represents the bit fields of the Core OTG Control
+ * and Status Register (GOTGCTL).  Set the bits using the bit
+ * fields then write the <i>d32</i> value to the register.
+ */
+typedef union gotgctl_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned sesreqscs:1;
+		unsigned sesreq:1;
+		unsigned vbvalidoven:1;
+		unsigned vbvalidovval:1;
+		unsigned avalidoven:1;
+		unsigned avalidovval:1;
+		unsigned bvalidoven:1;
+		unsigned bvalidovval:1;
+		unsigned hstnegscs:1;
+		unsigned hnpreq:1;
+		unsigned hstsethnpen:1;
+		unsigned devhnpen:1;
+		unsigned reserved12_15:4;
+		unsigned conidsts:1;
+		unsigned dbnctime:1;
+		unsigned asesvld:1;
+		unsigned bsesvld:1;
+		unsigned otgver:1;
+		unsigned reserved1:1;
+		unsigned multvalidbc:5;
+		unsigned chirpen:1;
+		unsigned reserved28_31:4;
+	} b;
+} gotgctl_data_t;
+
+/**
+ * This union represents the bit fields of the Core OTG Interrupt Register
+ * (GOTGINT).  Set/clear the bits using the bit fields then write the <i>d32</i>
+ * value to the register.
+ */
+typedef union gotgint_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Current Mode */
+		unsigned reserved0_1:2;
+
+		/** Session End Detected */
+		unsigned sesenddet:1;
+
+		unsigned reserved3_7:5;
+
+		/** Session Request Success Status Change */
+		unsigned sesreqsucstschng:1;
+		/** Host Negotiation Success Status Change */
+		unsigned hstnegsucstschng:1;
+
+		unsigned reserved10_16:7;
+
+		/** Host Negotiation Detected */
+		unsigned hstnegdet:1;
+		/** A-Device Timeout Change */
+		unsigned adevtoutchng:1;
+		/** Debounce Done */
+		unsigned debdone:1;
+		/** Multi-Valued input changed */
+		unsigned mvic:1;
+
+		unsigned reserved31_21:11;
+
+	} b;
+} gotgint_data_t;
+
+/**
+ * This union represents the bit fields of the Core AHB Configuration
+ * Register (GAHBCFG). Set/clear the bits using the bit fields then
+ * write the <i>d32</i> value to the register.
+ */
+typedef union gahbcfg_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned glblintrmsk:1;
+#define DWC_GAHBCFG_GLBINT_ENABLE		1
+
+		unsigned hburstlen:4;
+#define DWC_GAHBCFG_INT_DMA_BURST_SINGLE	0
+#define DWC_GAHBCFG_INT_DMA_BURST_INCR		1
+#define DWC_GAHBCFG_INT_DMA_BURST_INCR4		3
+#define DWC_GAHBCFG_INT_DMA_BURST_INCR8		5
+#define DWC_GAHBCFG_INT_DMA_BURST_INCR16	7
+
+		unsigned dmaenable:1;
+#define DWC_GAHBCFG_DMAENABLE			1
+		unsigned reserved:1;
+		unsigned nptxfemplvl_txfemplvl:1;
+		unsigned ptxfemplvl:1;
+#define DWC_GAHBCFG_TXFEMPTYLVL_EMPTY		1
+#define DWC_GAHBCFG_TXFEMPTYLVL_HALFEMPTY	0
+		unsigned reserved9_20:12;
+		unsigned remmemsupp:1;
+		unsigned notialldmawrit:1;
+		unsigned ahbsingle:1;
+		unsigned reserved24_31:8;
+	} b;
+} gahbcfg_data_t;
+
+/**
+ * This union represents the bit fields of the Core USB Configuration
+ * Register (GUSBCFG). Set the bits using the bit fields then write
+ * the <i>d32</i> value to the register.
+ */
+typedef union gusbcfg_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned toutcal:3;
+		unsigned phyif:1;
+		unsigned ulpi_utmi_sel:1;
+		unsigned fsintf:1;
+		unsigned physel:1;
+		unsigned ddrsel:1;
+		unsigned srpcap:1;
+		unsigned hnpcap:1;
+		unsigned usbtrdtim:4;
+		unsigned reserved1:1;
+		unsigned phylpwrclksel:1;
+		unsigned otgutmifssel:1;
+		unsigned ulpi_fsls:1;
+		unsigned ulpi_auto_res:1;
+		unsigned ulpi_clk_sus_m:1;
+		unsigned ulpi_ext_vbus_drv:1;
+		unsigned ulpi_int_vbus_indicator:1;
+		unsigned term_sel_dl_pulse:1;
+		unsigned indicator_complement:1;
+		unsigned indicator_pass_through:1;
+		unsigned ulpi_int_prot_dis:1;
+		unsigned ic_usb_cap:1;
+		unsigned ic_traffic_pull_remove:1;
+		unsigned tx_end_delay:1;
+		unsigned force_host_mode:1;
+		unsigned force_dev_mode:1;
+		unsigned reserved31:1;
+	} b;
+} gusbcfg_data_t;
+
+/**
+ * This union represents the bit fields of the Core Reset Register
+ * (GRSTCTL).  Set/clear the bits using the bit fields then write the
+ * <i>d32</i> value to the register.
+ */
+typedef union grstctl_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Core Soft Reset (CSftRst) (Device and Host)
+		 *
+		 * The application can flush the control logic in the
+		 * entire core using this bit. This bit resets the
+		 * pipelines in the AHB Clock domain as well as the
+		 * PHY Clock domain.
+		 *
+		 * The state machines are reset to an IDLE state, the
+		 * control bits in the CSRs are cleared, all the
+		 * transmit FIFOs and the receive FIFO are flushed.
+		 *
+		 * The status mask bits that control the generation of
+		 * the interrupt, are cleared, to clear the
+		 * interrupt. The interrupt status bits are not
+		 * cleared, so the application can get the status of
+		 * any events that occurred in the core after it has
+		 * set this bit.
+		 *
+		 * Any transactions on the AHB are terminated as soon
+		 * as possible following the protocol. Any
+		 * transactions on the USB are terminated immediately.
+		 *
+		 * The configuration settings in the CSRs are
+		 * unchanged, so the software doesn't have to
+		 * reprogram these registers (Device
+		 * Configuration/Host Configuration/Core System
+		 * Configuration/Core PHY Configuration).
+		 *
+		 * The application can write to this bit, any time it
+		 * wants to reset the core. This is a self clearing
+		 * bit and the core clears this bit after all the
+		 * necessary logic is reset in the core, which may
+		 * take several clocks, depending on the current state
+		 * of the core.
+		 */
+		unsigned csftrst:1;
+		/** Hclk Soft Reset
+		 *
+		 * The application uses this bit to reset the control logic in
+		 * the AHB clock domain. Only AHB clock domain pipelines are
+		 * reset.
+		 */
+		unsigned hsftrst:1;
+		/** Host Frame Counter Reset (Host Only)<br>
+		 *
+		 * The application can reset the (micro)frame number
+		 * counter inside the core, using this bit. When the
+		 * (micro)frame counter is reset, the subsequent SOF
+		 * sent out by the core, will have a (micro)frame
+		 * number of 0.
+		 */
+		unsigned hstfrm:1;
+		/** In Token Sequence Learning Queue Flush
+		 * (INTknQFlsh) (Device Only)
+		 */
+		unsigned intknqflsh:1;
+		/** RxFIFO Flush (RxFFlsh) (Device and Host)
+		 *
+		 * The application can flush the entire Receive FIFO
+		 * using this bit. The application must first
+		 * ensure that the core is not in the middle of a
+		 * transaction. The application should write into
+		 * this bit, only after making sure that neither the
+		 * DMA engine is reading from the RxFIFO nor the MAC
+		 * is writing the data in to the FIFO. The
+		 * application should wait until the bit is cleared
+		 * before performing any other operations. This bit
+		 * will takes 8 clocks (slowest of PHY or AHB clock)
+		 * to clear.
+		 */
+		unsigned rxfflsh:1;
+		/** TxFIFO Flush (TxFFlsh) (Device and Host).
+		 *
+		 * This bit is used to selectively flush a single or
+		 * all transmit FIFOs. The application must first
+		 * ensure that the core is not in the middle of a
+		 * transaction. The application should write into
+		 * this bit, only after making sure that neither the
+		 * DMA engine is writing into the TxFIFO nor the MAC
+		 * is reading the data out of the FIFO. The
+		 * application should wait until the core clears this
+		 * bit, before performing any operations. This bit
+		 * will takes 8 clocks (slowest of PHY or AHB clock)
+		 * to clear.
+		 */
+		unsigned txfflsh:1;
+
+		/** TxFIFO Number (TxFNum) (Device and Host).
+		 *
+		 * This is the FIFO number which needs to be flushed,
+		 * using the TxFIFO Flush bit. This field should not
+		 * be changed until the TxFIFO Flush bit is cleared by
+		 * the core.
+		 *	 - 0x0 : Non Periodic TxFIFO Flush
+		 *	 - 0x1 : Periodic TxFIFO #1 Flush in device mode
+		 *	   or Periodic TxFIFO in host mode
+		 *	 - 0x2 : Periodic TxFIFO #2 Flush in device mode.
+		 *	 - ...
+		 *	 - 0xF : Periodic TxFIFO #15 Flush in device mode
+		 *	 - 0x10: Flush all the Transmit NonPeriodic and
+		 *	   Transmit Periodic FIFOs in the core
+		 */
+		unsigned txfnum:5;
+		/** Reserved */
+		unsigned reserved11_29:19;
+		/** DMA Request Signal.	 Indicated DMA request is in
+		 * probress. Used for debug purpose. */
+		unsigned dmareq:1;
+		/** AHB Master Idle.  Indicates the AHB Master State
+		 * Machine is in IDLE condition. */
+		unsigned ahbidle:1;
+	} b;
+} grstctl_t;
+
+/**
+ * This union represents the bit fields of the Core Interrupt Mask
+ * Register (GINTMSK). Set/clear the bits using the bit fields then
+ * write the <i>d32</i> value to the register.
+ */
+typedef union gintmsk_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned reserved0:1;
+		unsigned modemismatch:1;
+		unsigned otgintr:1;
+		unsigned sofintr:1;
+		unsigned rxstsqlvl:1;
+		unsigned nptxfempty:1;
+		unsigned ginnakeff:1;
+		unsigned goutnakeff:1;
+		unsigned ulpickint:1;
+		unsigned i2cintr:1;
+		unsigned erlysuspend:1;
+		unsigned usbsuspend:1;
+		unsigned usbreset:1;
+		unsigned enumdone:1;
+		unsigned isooutdrop:1;
+		unsigned eopframe:1;
+		unsigned restoredone:1;
+		unsigned epmismatch:1;
+		unsigned inepintr:1;
+		unsigned outepintr:1;
+		unsigned incomplisoin:1;
+		unsigned incomplisoout:1;
+		unsigned fetsusp:1;
+		unsigned resetdet:1;
+		unsigned portintr:1;
+		unsigned hcintr:1;
+		unsigned ptxfempty:1;
+		unsigned lpmtranrcvd:1;
+		unsigned conidstschng:1;
+		unsigned disconnect:1;
+		unsigned sessreqintr:1;
+		unsigned wkupintr:1;
+	} b;
+} gintmsk_data_t;
+/**
+ * This union represents the bit fields of the Core Interrupt Register
+ * (GINTSTS).  Set/clear the bits using the bit fields then write the
+ * <i>d32</i> value to the register.
+ */
+typedef union gintsts_data {
+	/** raw register data */
+	uint32_t d32;
+#define DWC_SOF_INTR_MASK 0x0008
+	/** register bits */
+	struct {
+#define DWC_HOST_MODE 1
+		unsigned curmode:1;
+		unsigned modemismatch:1;
+		unsigned otgintr:1;
+		unsigned sofintr:1;
+		unsigned rxstsqlvl:1;
+		unsigned nptxfempty:1;
+		unsigned ginnakeff:1;
+		unsigned goutnakeff:1;
+		unsigned ulpickint:1;
+		unsigned i2cintr:1;
+		unsigned erlysuspend:1;
+		unsigned usbsuspend:1;
+		unsigned usbreset:1;
+		unsigned enumdone:1;
+		unsigned isooutdrop:1;
+		unsigned eopframe:1;
+		unsigned restoredone:1;
+		unsigned epmismatch:1;
+		unsigned inepint:1;
+		unsigned outepintr:1;
+		unsigned incomplisoin:1;
+		unsigned incomplisoout:1;
+		unsigned fetsusp:1;
+		unsigned resetdet:1;
+		unsigned portintr:1;
+		unsigned hcintr:1;
+		unsigned ptxfempty:1;
+		unsigned lpmtranrcvd:1;
+		unsigned conidstschng:1;
+		unsigned disconnect:1;
+		unsigned sessreqintr:1;
+		unsigned wkupintr:1;
+	} b;
+} gintsts_data_t;
+
+/**
+ * This union represents the bit fields in the Device Receive Status Read and
+ * Pop Registers (GRXSTSR, GRXSTSP) Read the register into the <i>d32</i>
+ * element then read out the bits using the <i>b</i>it elements.
+ */
+typedef union device_grxsts_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned epnum:4;
+		unsigned bcnt:11;
+		unsigned dpid:2;
+
+#define DWC_STS_DATA_UPDT		0x2	// OUT Data Packet
+#define DWC_STS_XFER_COMP		0x3	// OUT Data Transfer Complete
+
+#define DWC_DSTS_GOUT_NAK		0x1	// Global OUT NAK
+#define DWC_DSTS_SETUP_COMP		0x4	// Setup Phase Complete
+#define DWC_DSTS_SETUP_UPDT 0x6	// SETUP Packet
+		unsigned pktsts:4;
+		unsigned fn:4;
+		unsigned reserved25_31:7;
+	} b;
+} device_grxsts_data_t;
+
+/**
+ * This union represents the bit fields in the Host Receive Status Read and
+ * Pop Registers (GRXSTSR, GRXSTSP) Read the register into the <i>d32</i>
+ * element then read out the bits using the <i>b</i>it elements.
+ */
+typedef union host_grxsts_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned chnum:4;
+		unsigned bcnt:11;
+		unsigned dpid:2;
+
+		unsigned pktsts:4;
+#define DWC_GRXSTS_PKTSTS_IN			  0x2
+#define DWC_GRXSTS_PKTSTS_IN_XFER_COMP	  0x3
+#define DWC_GRXSTS_PKTSTS_DATA_TOGGLE_ERR 0x5
+#define DWC_GRXSTS_PKTSTS_CH_HALTED		  0x7
+
+		unsigned reserved21_31:11;
+	} b;
+} host_grxsts_data_t;
+
+/**
+ * This union represents the bit fields in the FIFO Size Registers (HPTXFSIZ,
+ * GNPTXFSIZ, DPTXFSIZn, DIEPTXFn). Read the register into the <i>d32</i> element
+ * then read out the bits using the <i>b</i>it elements.
+ */
+typedef union fifosize_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned startaddr:16;
+		unsigned depth:16;
+	} b;
+} fifosize_data_t;
+
+/**
+ * This union represents the bit fields in the Non-Periodic Transmit
+ * FIFO/Queue Status Register (GNPTXSTS). Read the register into the
+ * <i>d32</i> element then read out the bits using the <i>b</i>it
+ * elements.
+ */
+typedef union gnptxsts_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned nptxfspcavail:16;
+		unsigned nptxqspcavail:8;
+		/** Top of the Non-Periodic Transmit Request Queue
+		 *	- bit 24 - Terminate (Last entry for the selected
+		 *	  channel/EP)
+		 *	- bits 26:25 - Token Type
+		 *	  - 2'b00 - IN/OUT
+		 *	  - 2'b01 - Zero Length OUT
+		 *	  - 2'b10 - PING/Complete Split
+		 *	  - 2'b11 - Channel Halt
+		 *	- bits 30:27 - Channel/EP Number
+		 */
+		unsigned nptxqtop_terminate:1;
+		unsigned nptxqtop_token:2;
+		unsigned nptxqtop_chnep:4;
+		unsigned reserved:1;
+	} b;
+} gnptxsts_data_t;
+
+/**
+ * This union represents the bit fields in the Transmit
+ * FIFO Status Register (DTXFSTS). Read the register into the
+ * <i>d32</i> element then read out the bits using the <i>b</i>it
+ * elements.
+ */
+typedef union dtxfsts_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned txfspcavail:16;
+		unsigned reserved:16;
+	} b;
+} dtxfsts_data_t;
+
+/**
+ * This union represents the bit fields in the I2C Control Register
+ * (I2CCTL). Read the register into the <i>d32</i> element then read out the
+ * bits using the <i>b</i>it elements.
+ */
+typedef union gi2cctl_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned rwdata:8;
+		unsigned regaddr:8;
+		unsigned addr:7;
+		unsigned i2cen:1;
+		unsigned ack:1;
+		unsigned i2csuspctl:1;
+		unsigned i2cdevaddr:2;
+		unsigned i2cdatse0:1;
+		unsigned reserved:1;
+		unsigned rw:1;
+		unsigned bsydne:1;
+	} b;
+} gi2cctl_data_t;
+
+/**
+ * This union represents the bit fields in the PHY Vendor Control Register
+ * (GPVNDCTL). Read the register into the <i>d32</i> element then read out the
+ * bits using the <i>b</i>it elements.
+ */
+typedef union gpvndctl_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned regdata:8;
+		unsigned vctrl:8;
+		unsigned regaddr16_21:6;
+		unsigned regwr:1;
+		unsigned reserved23_24:2;
+		unsigned newregreq:1;
+		unsigned vstsbsy:1;
+		unsigned vstsdone:1;
+		unsigned reserved28_30:3;
+		unsigned disulpidrvr:1;
+	} b;
+} gpvndctl_data_t;
+
+/**
+ * This union represents the bit fields in the General Purpose
+ * Input/Output Register (GGPIO).
+ * Read the register into the <i>d32</i> element then read out the
+ * bits using the <i>b</i>it elements.
+ */
+typedef union ggpio_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned gpi:16;
+		unsigned gpo:16;
+	} b;
+} ggpio_data_t;
+
+/**
+ * This union represents the bit fields in the User ID Register
+ * (GUID). Read the register into the <i>d32</i> element then read out the
+ * bits using the <i>b</i>it elements.
+ */
+typedef union guid_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned rwdata:32;
+	} b;
+} guid_data_t;
+
+/**
+ * This union represents the bit fields in the Synopsys ID Register
+ * (GSNPSID). Read the register into the <i>d32</i> element then read out the
+ * bits using the <i>b</i>it elements.
+ */
+typedef union gsnpsid_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned rwdata:32;
+	} b;
+} gsnpsid_data_t;
+
+/**
+ * This union represents the bit fields in the User HW Config1
+ * Register.  Read the register into the <i>d32</i> element then read
+ * out the bits using the <i>b</i>it elements.
+ */
+typedef union hwcfg1_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned ep_dir0:2;
+		unsigned ep_dir1:2;
+		unsigned ep_dir2:2;
+		unsigned ep_dir3:2;
+		unsigned ep_dir4:2;
+		unsigned ep_dir5:2;
+		unsigned ep_dir6:2;
+		unsigned ep_dir7:2;
+		unsigned ep_dir8:2;
+		unsigned ep_dir9:2;
+		unsigned ep_dir10:2;
+		unsigned ep_dir11:2;
+		unsigned ep_dir12:2;
+		unsigned ep_dir13:2;
+		unsigned ep_dir14:2;
+		unsigned ep_dir15:2;
+	} b;
+} hwcfg1_data_t;
+
+/**
+ * This union represents the bit fields in the User HW Config2
+ * Register.  Read the register into the <i>d32</i> element then read
+ * out the bits using the <i>b</i>it elements.
+ */
+typedef union hwcfg2_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/* GHWCFG2 */
+		unsigned op_mode:3;
+#define DWC_HWCFG2_OP_MODE_HNP_SRP_CAPABLE_OTG 0
+#define DWC_HWCFG2_OP_MODE_SRP_ONLY_CAPABLE_OTG 1
+#define DWC_HWCFG2_OP_MODE_NO_HNP_SRP_CAPABLE_OTG 2
+#define DWC_HWCFG2_OP_MODE_SRP_CAPABLE_DEVICE 3
+#define DWC_HWCFG2_OP_MODE_NO_SRP_CAPABLE_DEVICE 4
+#define DWC_HWCFG2_OP_MODE_SRP_CAPABLE_HOST 5
+#define DWC_HWCFG2_OP_MODE_NO_SRP_CAPABLE_HOST 6
+
+		unsigned architecture:2;
+		unsigned point2point:1;
+		unsigned hs_phy_type:2;
+#define DWC_HWCFG2_HS_PHY_TYPE_NOT_SUPPORTED 0
+#define DWC_HWCFG2_HS_PHY_TYPE_UTMI 1
+#define DWC_HWCFG2_HS_PHY_TYPE_ULPI 2
+#define DWC_HWCFG2_HS_PHY_TYPE_UTMI_ULPI 3
+
+		unsigned fs_phy_type:2;
+		unsigned num_dev_ep:4;
+		unsigned num_host_chan:4;
+		unsigned perio_ep_supported:1;
+		unsigned dynamic_fifo:1;
+		unsigned multi_proc_int:1;
+		unsigned reserved21:1;
+		unsigned nonperio_tx_q_depth:2;
+		unsigned host_perio_tx_q_depth:2;
+		unsigned dev_token_q_depth:5;
+		unsigned otg_enable_ic_usb:1;
+	} b;
+} hwcfg2_data_t;
+
+/**
+ * This union represents the bit fields in the User HW Config3
+ * Register.  Read the register into the <i>d32</i> element then read
+ * out the bits using the <i>b</i>it elements.
+ */
+typedef union hwcfg3_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/* GHWCFG3 */
+		unsigned xfer_size_cntr_width:4;
+		unsigned packet_size_cntr_width:3;
+		unsigned otg_func:1;
+		unsigned i2c:1;
+		unsigned vendor_ctrl_if:1;
+		unsigned optional_features:1;
+		unsigned synch_reset_type:1;
+		unsigned adp_supp:1;
+		unsigned otg_enable_hsic:1;
+		unsigned bc_support:1;
+		unsigned otg_lpm_en:1;
+		unsigned dfifo_depth:16;
+	} b;
+} hwcfg3_data_t;
+
+/**
+ * This union represents the bit fields in the User HW Config4
+ * Register.  Read the register into the <i>d32</i> element then read
+ * out the bits using the <i>b</i>it elements.
+ */
+typedef union hwcfg4_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned num_dev_perio_in_ep:4;
+		unsigned power_optimiz:1;
+		unsigned min_ahb_freq:1;
+		unsigned hiber:1;
+		unsigned xhiber:1;
+		unsigned reserved:6;
+		unsigned utmi_phy_data_width:2;
+		unsigned num_dev_mode_ctrl_ep:4;
+		unsigned iddig_filt_en:1;
+		unsigned vbus_valid_filt_en:1;
+		unsigned a_valid_filt_en:1;
+		unsigned b_valid_filt_en:1;
+		unsigned session_end_filt_en:1;
+		unsigned ded_fifo_en:1;
+		unsigned num_in_eps:4;
+		unsigned desc_dma:1;
+		unsigned desc_dma_dyn:1;
+	} b;
+} hwcfg4_data_t;
+
+/**
+ * This union represents the bit fields of the Core LPM Configuration
+ * Register (GLPMCFG). Set the bits using bit fields then write
+ * the <i>d32</i> value to the register.
+ */
+typedef union glpmctl_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** LPM-Capable (LPMCap) (Device and Host)
+		 * The application uses this bit to control
+		 * the DWC_otg core LPM capabilities.
+		 */
+		unsigned lpm_cap_en:1;
+		/** LPM response programmed by application (AppL1Res) (Device)
+		 * Handshake response to LPM token pre-programmed
+		 * by device application software.
+		 */
+		unsigned appl_resp:1;
+		/** Host Initiated Resume Duration (HIRD) (Device and Host)
+		 * In Host mode this field indicates the value of HIRD
+		 * to be sent in an LPM transaction.
+		 * In Device mode this field is updated with the
+		 * Received LPM Token HIRD bmAttribute
+		 * when an ACK/NYET/STALL response is sent
+		 * to an LPM transaction.
+		 */
+		unsigned hird:4;
+		/** RemoteWakeEnable (bRemoteWake) (Device and Host)
+		 * In Host mode this bit indicates the value of remote
+		 * wake up to be sent in wIndex field of LPM transaction.
+		 * In Device mode this field is updated with the
+		 * Received LPM Token bRemoteWake bmAttribute
+		 * when an ACK/NYET/STALL response is sent
+		 * to an LPM transaction.
+		 */
+		unsigned rem_wkup_en:1;
+		/** Enable utmi_sleep_n (EnblSlpM) (Device and Host)
+		 * The application uses this bit to control
+		 * the utmi_sleep_n assertion to the PHY when in L1 state.
+		 */
+		unsigned en_utmi_sleep:1;
+		/** HIRD Threshold (HIRD_Thres) (Device and Host)
+		 */
+		unsigned hird_thres:5;
+		/** LPM Response (CoreL1Res) (Device and Host)
+		 * In Host mode this bit contains handsake response to
+		 * LPM transaction.
+		 * In Device mode the response of the core to
+		 * LPM transaction received is reflected in these two bits.
+			- 0x0 : ERROR (No handshake response)
+			- 0x1 : STALL
+			- 0x2 : NYET
+			- 0x3 : ACK
+		 */
+		unsigned lpm_resp:2;
+		/** Port Sleep Status (SlpSts) (Device and Host)
+		 * This bit is set as long as a Sleep condition
+		 * is present on the USB bus.
+		 */
+		unsigned prt_sleep_sts:1;
+		/** Sleep State Resume OK (L1ResumeOK) (Device and Host)
+		 * Indicates that the application or host
+		 * can start resume from Sleep state.
+		 */
+		unsigned sleep_state_resumeok:1;
+		/** LPM channel Index (LPM_Chnl_Indx) (Host)
+		 * The channel number on which the LPM transaction
+		 * has to be applied while sending
+		 * an LPM transaction to the local device.
+		 */
+		unsigned lpm_chan_index:4;
+		/** LPM Retry Count (LPM_Retry_Cnt) (Host)
+		 * Number host retries that would be performed
+		 * if the device response was not valid response.
+		 */
+		unsigned retry_count:3;
+		/** Send LPM Transaction (SndLPM) (Host)
+		 * When set by application software,
+		 * an LPM transaction containing two tokens
+		 * is sent.
+		 */
+		unsigned send_lpm:1;
+		/** LPM Retry status (LPM_RetryCnt_Sts) (Host)
+		 * Number of LPM Host Retries still remaining
+		 * to be transmitted for the current LPM sequence
+		 */
+		unsigned retry_count_sts:3;
+		unsigned reserved28_29:2;
+		/** In host mode once this bit is set, the host
+		 * configures to drive the HSIC Idle state on the bus.
+		 * It then waits for the  device to initiate the Connect sequence.
+		 * In device mode once this bit is set, the device waits for
+		 * the HSIC Idle line state on the bus. Upon receving the Idle
+		 * line state, it initiates the HSIC Connect sequence.
+		 */
+		unsigned hsic_connect:1;
+		/** This bit overrides and functionally inverts
+		 * the if_select_hsic input port signal.
+		 */
+		unsigned inv_sel_hsic:1;
+	} b;
+} glpmcfg_data_t;
+
+/**
+ * This union represents the bit fields of the Core ADP Timer, Control and
+ * Status Register (ADPTIMCTLSTS). Set the bits using bit fields then write
+ * the <i>d32</i> value to the register.
+ */
+typedef union adpctl_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Probe Discharge (PRB_DSCHG)
+		 *  These bits set the times for TADP_DSCHG.
+		 *  These bits are defined as follows:
+		 *  2'b00 - 4 msec
+		 *  2'b01 - 8 msec
+		 *  2'b10 - 16 msec
+		 *  2'b11 - 32 msec
+		 */
+		unsigned prb_dschg:2;
+		/** Probe Delta (PRB_DELTA)
+		 *  These bits set the resolution for RTIM   value.
+		 *  The bits are defined in units of 32 kHz clock cycles as follows:
+		 *  2'b00  -  1 cycles
+		 *  2'b01  -  2 cycles
+		 *  2'b10 -  3 cycles
+		 *  2'b11 - 4 cycles
+		 *  For example if this value is chosen to 2'b01, it means that RTIM
+		 *  increments for every 3(three) 32Khz clock cycles.
+		 */
+		unsigned prb_delta:2;
+		/** Probe Period (PRB_PER)
+		 *  These bits sets the TADP_PRD as shown in Figure 4 as follows:
+		 *  2'b00  -  0.625 to 0.925 sec (typical 0.775 sec)
+		 *  2'b01  -  1.25 to 1.85 sec (typical 1.55 sec)
+		 *  2'b10  -  1.9 to 2.6 sec (typical 2.275 sec)
+		 *  2'b11  -  Reserved
+		 */
+		unsigned prb_per:2;
+		/** These bits capture the latest time it took for VBUS to ramp from
+		 *  VADP_SINK to VADP_PRB.
+		 *  0x000  -  1 cycles
+		 *  0x001  -  2 cycles
+		 *  0x002  -  3 cycles
+		 *  etc
+		 *  0x7FF  -  2048 cycles
+		 *  A time of 1024 cycles at 32 kHz corresponds to a time of 32 msec.
+		*/
+		unsigned rtim:11;
+		/** Enable Probe (EnaPrb)
+		 *  When programmed to 1'b1, the core performs a probe operation.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned enaprb:1;
+		/** Enable Sense (EnaSns)
+		 *  When programmed to 1'b1, the core performs a Sense operation.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned enasns:1;
+		/** ADP Reset (ADPRes)
+		 *  When set, ADP controller is reset.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned adpres:1;
+		/** ADP Enable (ADPEn)
+		 *  When set, the core performs either ADP probing or sensing
+		 *  based on EnaPrb or EnaSns.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned adpen:1;
+		/** ADP Probe Interrupt (ADP_PRB_INT)
+		 *  When this bit is set, it means that the VBUS
+		 *  voltage is greater than VADP_PRB or VADP_PRB is reached.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned adp_prb_int:1;
+		/**
+		 *  ADP Sense Interrupt (ADP_SNS_INT)
+		 *  When this bit is set, it means that the VBUS voltage is greater than
+		 *  VADP_SNS value or VADP_SNS is reached.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned adp_sns_int:1;
+		/** ADP Tomeout Interrupt (ADP_TMOUT_INT)
+		 *  This bit is relevant only for an ADP probe.
+		 *  When this bit is set, it means that the ramp time has
+		 *  completed ie ADPCTL.RTIM has reached its terminal value
+		 *  of 0x7FF.  This is a debug feature that allows software
+		 *  to read the ramp time after each cycle.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned adp_tmout_int:1;
+		/** ADP Probe Interrupt Mask (ADP_PRB_INT_MSK)
+		 *  When this bit is set, it unmasks the interrupt due to ADP_PRB_INT.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned adp_prb_int_msk:1;
+		/** ADP Sense Interrupt Mask (ADP_SNS_INT_MSK)
+		 *  When this bit is set, it unmasks the interrupt due to ADP_SNS_INT.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned adp_sns_int_msk:1;
+		/** ADP Timoeout Interrupt Mask (ADP_TMOUT_MSK)
+		 *  When this bit is set, it unmasks the interrupt due to ADP_TMOUT_INT.
+		 *  This bit is valid only if OTG_Ver = 1'b1.
+		 */
+		unsigned adp_tmout_int_msk:1;
+		/** Access Request
+		 * 2'b00 - Read/Write Valid (updated by the core)
+		 * 2'b01 - Read
+		 * 2'b00 - Write
+		 * 2'b00 - Reserved
+		 */
+		unsigned ar:2;
+		 /** Reserved */
+		unsigned reserved29_31:3;
+	} b;
+} adpctl_data_t;
+
+////////////////////////////////////////////
+// Device Registers
+/**
+ * Device Global Registers. <i>Offsets 800h-BFFh</i>
+ *
+ * The following structures define the size and relative field offsets
+ * for the Device Mode Registers.
+ *
+ * <i>These registers are visible only in Device mode and must not be
+ * accessed in Host mode, as the results are unknown.</i>
+ */
+typedef struct dwc_otg_dev_global_regs {
+	/** Device Configuration Register. <i>Offset 800h</i> */
+	volatile uint32_t dcfg;
+	/** Device Control Register. <i>Offset: 804h</i> */
+	volatile uint32_t dctl;
+	/** Device Status Register (Read Only). <i>Offset: 808h</i> */
+	volatile uint32_t dsts;
+	/** Reserved. <i>Offset: 80Ch</i> */
+	uint32_t unused;
+	/** Device IN Endpoint Common Interrupt Mask
+	 * Register. <i>Offset: 810h</i> */
+	volatile uint32_t diepmsk;
+	/** Device OUT Endpoint Common Interrupt Mask
+	 * Register. <i>Offset: 814h</i> */
+	volatile uint32_t doepmsk;
+	/** Device All Endpoints Interrupt Register.  <i>Offset: 818h</i> */
+	volatile uint32_t daint;
+	/** Device All Endpoints Interrupt Mask Register.  <i>Offset:
+	 * 81Ch</i> */
+	volatile uint32_t daintmsk;
+	/** Device IN Token Queue Read Register-1 (Read Only).
+	 * <i>Offset: 820h</i> */
+	volatile uint32_t dtknqr1;
+	/** Device IN Token Queue Read Register-2 (Read Only).
+	 * <i>Offset: 824h</i> */
+	volatile uint32_t dtknqr2;
+	/** Device VBUS	 discharge Register.  <i>Offset: 828h</i> */
+	volatile uint32_t dvbusdis;
+	/** Device VBUS Pulse Register.	 <i>Offset: 82Ch</i> */
+	volatile uint32_t dvbuspulse;
+	/** Device IN Token Queue Read Register-3 (Read Only). /
+	 *	Device Thresholding control register (Read/Write)
+	 * <i>Offset: 830h</i> */
+	volatile uint32_t dtknqr3_dthrctl;
+	/** Device IN Token Queue Read Register-4 (Read Only). /
+	 *	Device IN EPs empty Inr. Mask Register (Read/Write)
+	 * <i>Offset: 834h</i> */
+	volatile uint32_t dtknqr4_fifoemptymsk;
+	/** Device Each Endpoint Interrupt Register (Read Only). /
+	 * <i>Offset: 838h</i> */
+	volatile uint32_t deachint;
+	/** Device Each Endpoint Interrupt mask Register (Read/Write). /
+	 * <i>Offset: 83Ch</i> */
+	volatile uint32_t deachintmsk;
+	/** Device Each In Endpoint Interrupt mask Register (Read/Write). /
+	 * <i>Offset: 840h</i> */
+	volatile uint32_t diepeachintmsk[MAX_EPS_CHANNELS];
+	/** Device Each Out Endpoint Interrupt mask Register (Read/Write). /
+	 * <i>Offset: 880h</i> */
+	volatile uint32_t doepeachintmsk[MAX_EPS_CHANNELS];
+} dwc_otg_device_global_regs_t;
+
+/**
+ * This union represents the bit fields in the Device Configuration
+ * Register.  Read the register into the <i>d32</i> member then
+ * set/clear the bits using the <i>b</i>it elements.  Write the
+ * <i>d32</i> member to the dcfg register.
+ */
+typedef union dcfg_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Device Speed */
+		unsigned devspd:2;
+		/** Non Zero Length Status OUT Handshake */
+		unsigned nzstsouthshk:1;
+#define DWC_DCFG_SEND_STALL 1
+
+		unsigned ena32khzs:1;
+		/** Device Addresses */
+		unsigned devaddr:7;
+		/** Periodic Frame Interval */
+		unsigned perfrint:2;
+#define DWC_DCFG_FRAME_INTERVAL_80 0
+#define DWC_DCFG_FRAME_INTERVAL_85 1
+#define DWC_DCFG_FRAME_INTERVAL_90 2
+#define DWC_DCFG_FRAME_INTERVAL_95 3
+
+		/** Enable Device OUT NAK for bulk in DDMA mode */
+		unsigned endevoutnak:1;
+
+		unsigned reserved14_17:4;
+		/** In Endpoint Mis-match count */
+		unsigned epmscnt:5;
+		/** Enable Descriptor DMA in Device mode */
+		unsigned descdma:1;
+		unsigned perschintvl:2;
+		unsigned resvalid:6;
+	} b;
+} dcfg_data_t;
+
+/**
+ * This union represents the bit fields in the Device Control
+ * Register.  Read the register into the <i>d32</i> member then
+ * set/clear the bits using the <i>b</i>it elements.
+ */
+typedef union dctl_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Remote Wakeup */
+		unsigned rmtwkupsig:1;
+		/** Soft Disconnect */
+		unsigned sftdiscon:1;
+		/** Global Non-Periodic IN NAK Status */
+		unsigned gnpinnaksts:1;
+		/** Global OUT NAK Status */
+		unsigned goutnaksts:1;
+		/** Test Control */
+		unsigned tstctl:3;
+		/** Set Global Non-Periodic IN NAK */
+		unsigned sgnpinnak:1;
+		/** Clear Global Non-Periodic IN NAK */
+		unsigned cgnpinnak:1;
+		/** Set Global OUT NAK */
+		unsigned sgoutnak:1;
+		/** Clear Global OUT NAK */
+		unsigned cgoutnak:1;
+		/** Power-On Programming Done */
+		unsigned pwronprgdone:1;
+		/** Reserved */
+		unsigned reserved:1;
+		/** Global Multi Count */
+		unsigned gmc:2;
+		/** Ignore Frame Number for ISOC EPs */
+		unsigned ifrmnum:1;
+		/** NAK on Babble */
+		unsigned nakonbble:1;
+		/** Enable Continue on BNA */
+		unsigned encontonbna:1;
+
+		unsigned reserved18_31:14;
+	} b;
+} dctl_data_t;
+
+/**
+ * This union represents the bit fields in the Device Status
+ * Register.  Read the register into the <i>d32</i> member then
+ * set/clear the bits using the <i>b</i>it elements.
+ */
+typedef union dsts_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Suspend Status */
+		unsigned suspsts:1;
+		/** Enumerated Speed */
+		unsigned enumspd:2;
+#define DWC_DSTS_ENUMSPD_HS_PHY_30MHZ_OR_60MHZ 0
+#define DWC_DSTS_ENUMSPD_FS_PHY_30MHZ_OR_60MHZ 1
+#define DWC_DSTS_ENUMSPD_LS_PHY_6MHZ		   2
+#define DWC_DSTS_ENUMSPD_FS_PHY_48MHZ		   3
+		/** Erratic Error */
+		unsigned errticerr:1;
+		unsigned reserved4_7:4;
+		/** Frame or Microframe Number of the received SOF */
+		unsigned soffn:14;
+		unsigned reserved22_31:10;
+	} b;
+} dsts_data_t;
+
+/**
+ * This union represents the bit fields in the Device IN EP Interrupt
+ * Register and the Device IN EP Common Mask Register.
+ *
+ * - Read the register into the <i>d32</i> member then set/clear the
+ *	 bits using the <i>b</i>it elements.
+ */
+typedef union diepint_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Transfer complete mask */
+		unsigned xfercompl:1;
+		/** Endpoint disable mask */
+		unsigned epdisabled:1;
+		/** AHB Error mask */
+		unsigned ahberr:1;
+		/** TimeOUT Handshake mask (non-ISOC EPs) */
+		unsigned timeout:1;
+		/** IN Token received with TxF Empty mask */
+		unsigned intktxfemp:1;
+		/** IN Token Received with EP mismatch mask */
+		unsigned intknepmis:1;
+		/** IN Endpoint NAK Effective mask */
+		unsigned inepnakeff:1;
+		/** Reserved */
+		unsigned emptyintr:1;
+
+		unsigned txfifoundrn:1;
+
+		/** BNA Interrupt mask */
+		unsigned bna:1;
+
+		unsigned reserved10_12:3;
+		/** BNA Interrupt mask */
+		unsigned nak:1;
+
+		unsigned reserved14_31:18;
+	} b;
+} diepint_data_t;
+
+/**
+ * This union represents the bit fields in the Device IN EP
+ * Common/Dedicated Interrupt Mask Register.
+ */
+typedef union diepint_data diepmsk_data_t;
+
+/**
+ * This union represents the bit fields in the Device OUT EP Interrupt
+ * Registerand Device OUT EP Common Interrupt Mask Register.
+ *
+ * - Read the register into the <i>d32</i> member then set/clear the
+ *	 bits using the <i>b</i>it elements.
+ */
+typedef union doepint_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Transfer complete */
+		unsigned xfercompl:1;
+		/** Endpoint disable  */
+		unsigned epdisabled:1;
+		/** AHB Error */
+		unsigned ahberr:1;
+		/** Setup Phase Done (contorl EPs) */
+		unsigned setup:1;
+		/** OUT Token Received when Endpoint Disabled */
+		unsigned outtknepdis:1;
+
+		unsigned stsphsercvd:1;
+		/** Back-to-Back SETUP Packets Received */
+		unsigned back2backsetup:1;
+
+		unsigned reserved7:1;
+		/** OUT packet Error */
+		unsigned outpkterr:1;
+		/** BNA Interrupt */
+		unsigned bna:1;
+
+		unsigned reserved10:1;
+		/** Packet Drop Status */
+		unsigned pktdrpsts:1;
+		/** Babble Interrupt */
+		unsigned babble:1;
+		/** NAK Interrupt */
+		unsigned nak:1;
+		/** NYET Interrupt */
+		unsigned nyet:1;
+		/** Bit indicating setup packet received */
+		unsigned sr:1;
+
+		unsigned reserved16_31:16;
+	} b;
+} doepint_data_t;
+
+/**
+ * This union represents the bit fields in the Device OUT EP
+ * Common/Dedicated Interrupt Mask Register.
+ */
+typedef union doepint_data doepmsk_data_t;
+
+/**
+ * This union represents the bit fields in the Device All EP Interrupt
+ * and Mask Registers.
+ * - Read the register into the <i>d32</i> member then set/clear the
+ *	 bits using the <i>b</i>it elements.
+ */
+typedef union daint_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** IN Endpoint bits */
+		unsigned in:16;
+		/** OUT Endpoint bits */
+		unsigned out:16;
+	} ep;
+	struct {
+		/** IN Endpoint bits */
+		unsigned inep0:1;
+		unsigned inep1:1;
+		unsigned inep2:1;
+		unsigned inep3:1;
+		unsigned inep4:1;
+		unsigned inep5:1;
+		unsigned inep6:1;
+		unsigned inep7:1;
+		unsigned inep8:1;
+		unsigned inep9:1;
+		unsigned inep10:1;
+		unsigned inep11:1;
+		unsigned inep12:1;
+		unsigned inep13:1;
+		unsigned inep14:1;
+		unsigned inep15:1;
+		/** OUT Endpoint bits */
+		unsigned outep0:1;
+		unsigned outep1:1;
+		unsigned outep2:1;
+		unsigned outep3:1;
+		unsigned outep4:1;
+		unsigned outep5:1;
+		unsigned outep6:1;
+		unsigned outep7:1;
+		unsigned outep8:1;
+		unsigned outep9:1;
+		unsigned outep10:1;
+		unsigned outep11:1;
+		unsigned outep12:1;
+		unsigned outep13:1;
+		unsigned outep14:1;
+		unsigned outep15:1;
+	} b;
+} daint_data_t;
+
+/**
+ * This union represents the bit fields in the Device IN Token Queue
+ * Read Registers.
+ * - Read the register into the <i>d32</i> member.
+ * - READ-ONLY Register
+ */
+typedef union dtknq1_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** In Token Queue Write Pointer */
+		unsigned intknwptr:5;
+		/** Reserved */
+		unsigned reserved05_06:2;
+		/** write pointer has wrapped. */
+		unsigned wrap_bit:1;
+		/** EP Numbers of IN Tokens 0 ... 4 */
+		unsigned epnums0_5:24;
+	} b;
+} dtknq1_data_t;
+
+/**
+ * This union represents Threshold control Register
+ * - Read and write the register into the <i>d32</i> member.
+ * - READ-WRITABLE Register
+ */
+typedef union dthrctl_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** non ISO Tx Thr. Enable */
+		unsigned non_iso_thr_en:1;
+		/** ISO Tx Thr. Enable */
+		unsigned iso_thr_en:1;
+		/** Tx Thr. Length */
+		unsigned tx_thr_len:9;
+		/** AHB Threshold ratio */
+		unsigned ahb_thr_ratio:2;
+		/** Reserved */
+		unsigned reserved13_15:3;
+		/** Rx Thr. Enable */
+		unsigned rx_thr_en:1;
+		/** Rx Thr. Length */
+		unsigned rx_thr_len:9;
+		unsigned reserved26:1;
+		/** Arbiter Parking Enable*/
+		unsigned arbprken:1;
+		/** Reserved */
+		unsigned reserved28_31:4;
+	} b;
+} dthrctl_data_t;
+
+/**
+ * Device Logical IN Endpoint-Specific Registers. <i>Offsets
+ * 900h-AFCh</i>
+ *
+ * There will be one set of endpoint registers per logical endpoint
+ * implemented.
+ *
+ * <i>These registers are visible only in Device mode and must not be
+ * accessed in Host mode, as the results are unknown.</i>
+ */
+typedef struct dwc_otg_dev_in_ep_regs {
+	/** Device IN Endpoint Control Register. <i>Offset:900h +
+	 * (ep_num * 20h) + 00h</i> */
+	volatile uint32_t diepctl;
+	/** Reserved. <i>Offset:900h + (ep_num * 20h) + 04h</i> */
+	uint32_t reserved04;
+	/** Device IN Endpoint Interrupt Register. <i>Offset:900h +
+	 * (ep_num * 20h) + 08h</i> */
+	volatile uint32_t diepint;
+	/** Reserved. <i>Offset:900h + (ep_num * 20h) + 0Ch</i> */
+	uint32_t reserved0C;
+	/** Device IN Endpoint Transfer Size
+	 * Register. <i>Offset:900h + (ep_num * 20h) + 10h</i> */
+	volatile uint32_t dieptsiz;
+	/** Device IN Endpoint DMA Address Register. <i>Offset:900h +
+	 * (ep_num * 20h) + 14h</i> */
+	volatile uint32_t diepdma;
+	/** Device IN Endpoint Transmit FIFO Status Register. <i>Offset:900h +
+	 * (ep_num * 20h) + 18h</i> */
+	volatile uint32_t dtxfsts;
+	/** Device IN Endpoint DMA Buffer Register. <i>Offset:900h +
+	 * (ep_num * 20h) + 1Ch</i> */
+	volatile uint32_t diepdmab;
+} dwc_otg_dev_in_ep_regs_t;
+
+/**
+ * Device Logical OUT Endpoint-Specific Registers. <i>Offsets:
+ * B00h-CFCh</i>
+ *
+ * There will be one set of endpoint registers per logical endpoint
+ * implemented.
+ *
+ * <i>These registers are visible only in Device mode and must not be
+ * accessed in Host mode, as the results are unknown.</i>
+ */
+typedef struct dwc_otg_dev_out_ep_regs {
+	/** Device OUT Endpoint Control Register. <i>Offset:B00h +
+	 * (ep_num * 20h) + 00h</i> */
+	volatile uint32_t doepctl;
+	/** Reserved. <i>Offset:B00h + (ep_num * 20h) + 04h</i> */
+	uint32_t reserved04;
+	/** Device OUT Endpoint Interrupt Register. <i>Offset:B00h +
+	 * (ep_num * 20h) + 08h</i> */
+	volatile uint32_t doepint;
+	/** Reserved. <i>Offset:B00h + (ep_num * 20h) + 0Ch</i> */
+	uint32_t reserved0C;
+	/** Device OUT Endpoint Transfer Size Register. <i>Offset:
+	 * B00h + (ep_num * 20h) + 10h</i> */
+	volatile uint32_t doeptsiz;
+	/** Device OUT Endpoint DMA Address Register. <i>Offset:B00h
+	 * + (ep_num * 20h) + 14h</i> */
+	volatile uint32_t doepdma;
+	/** Reserved. <i>Offset:B00h + 	 * (ep_num * 20h) + 18h</i> */
+	uint32_t unused;
+	/** Device OUT Endpoint DMA Buffer Register. <i>Offset:B00h
+	 * + (ep_num * 20h) + 1Ch</i> */
+	uint32_t doepdmab;
+} dwc_otg_dev_out_ep_regs_t;
+
+/**
+ * This union represents the bit fields in the Device EP Control
+ * Register.  Read the register into the <i>d32</i> member then
+ * set/clear the bits using the <i>b</i>it elements.
+ */
+typedef union depctl_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Maximum Packet Size
+		 * IN/OUT EPn
+		 * IN/OUT EP0 - 2 bits
+		 *	 2'b00: 64 Bytes
+		 *	 2'b01: 32
+		 *	 2'b10: 16
+		 *	 2'b11: 8 */
+		unsigned mps:11;
+#define DWC_DEP0CTL_MPS_64	 0
+#define DWC_DEP0CTL_MPS_32	 1
+#define DWC_DEP0CTL_MPS_16	 2
+#define DWC_DEP0CTL_MPS_8	 3
+
+		/** Next Endpoint
+		 * IN EPn/IN EP0
+		 * OUT EPn/OUT EP0 - reserved */
+		unsigned nextep:4;
+
+		/** USB Active Endpoint */
+		unsigned usbactep:1;
+
+		/** Endpoint DPID (INTR/Bulk IN and OUT endpoints)
+		 * This field contains the PID of the packet going to
+		 * be received or transmitted on this endpoint. The
+		 * application should program the PID of the first
+		 * packet going to be received or transmitted on this
+		 * endpoint , after the endpoint is
+		 * activated. Application use the SetD1PID and
+		 * SetD0PID fields of this register to program either
+		 * D0 or D1 PID.
+		 *
+		 * The encoding for this field is
+		 *	 - 0: D0
+		 *	 - 1: D1
+		 */
+		unsigned dpid:1;
+
+		/** NAK Status */
+		unsigned naksts:1;
+
+		/** Endpoint Type
+		 *	2'b00: Control
+		 *	2'b01: Isochronous
+		 *	2'b10: Bulk
+		 *	2'b11: Interrupt */
+		unsigned eptype:2;
+
+		/** Snoop Mode
+		 * OUT EPn/OUT EP0
+		 * IN EPn/IN EP0 - reserved */
+		unsigned snp:1;
+
+		/** Stall Handshake */
+		unsigned stall:1;
+
+		/** Tx Fifo Number
+		 * IN EPn/IN EP0
+		 * OUT EPn/OUT EP0 - reserved */
+		unsigned txfnum:4;
+
+		/** Clear NAK */
+		unsigned cnak:1;
+		/** Set NAK */
+		unsigned snak:1;
+		/** Set DATA0 PID (INTR/Bulk IN and OUT endpoints)
+		 * Writing to this field sets the Endpoint DPID (DPID)
+		 * field in this register to DATA0. Set Even
+		 * (micro)frame (SetEvenFr) (ISO IN and OUT Endpoints)
+		 * Writing to this field sets the Even/Odd
+		 * (micro)frame (EO_FrNum) field to even (micro)
+		 * frame.
+		 */
+		unsigned setd0pid:1;
+		/** Set DATA1 PID (INTR/Bulk IN and OUT endpoints)
+		 * Writing to this field sets the Endpoint DPID (DPID)
+		 * field in this register to DATA1 Set Odd
+		 * (micro)frame (SetOddFr) (ISO IN and OUT Endpoints)
+		 * Writing to this field sets the Even/Odd
+		 * (micro)frame (EO_FrNum) field to odd (micro) frame.
+		 */
+		unsigned setd1pid:1;
+
+		/** Endpoint Disable */
+		unsigned epdis:1;
+		/** Endpoint Enable */
+		unsigned epena:1;
+	} b;
+} depctl_data_t;
+
+/**
+ * This union represents the bit fields in the Device EP Transfer
+ * Size Register.  Read the register into the <i>d32</i> member then
+ * set/clear the bits using the <i>b</i>it elements.
+ */
+typedef union deptsiz_data {
+		/** raw register data */
+	uint32_t d32;
+		/** register bits */
+	struct {
+		/** Transfer size */
+		unsigned xfersize:19;
+/** Max packet count for EP (pow(2,10)-1) */
+#define MAX_PKT_CNT 1023
+		/** Packet Count */
+		unsigned pktcnt:10;
+		/** Multi Count - Periodic IN endpoints */
+		unsigned mc:2;
+		unsigned reserved:1;
+	} b;
+} deptsiz_data_t;
+
+/**
+ * This union represents the bit fields in the Device EP 0 Transfer
+ * Size Register.  Read the register into the <i>d32</i> member then
+ * set/clear the bits using the <i>b</i>it elements.
+ */
+typedef union deptsiz0_data {
+		/** raw register data */
+	uint32_t d32;
+		/** register bits */
+	struct {
+		/** Transfer size */
+		unsigned xfersize:7;
+				/** Reserved */
+		unsigned reserved7_18:12;
+		/** Packet Count */
+		unsigned pktcnt:2;
+				/** Reserved */
+		unsigned reserved21_28:8;
+				/**Setup Packet Count (DOEPTSIZ0 Only) */
+		unsigned supcnt:2;
+		unsigned reserved31;
+	} b;
+} deptsiz0_data_t;
+
+/////////////////////////////////////////////////
+// DMA Descriptor Specific Structures
+//
+
+/** Buffer status definitions */
+
+#define BS_HOST_READY	0x0
+#define BS_DMA_BUSY		0x1
+#define BS_DMA_DONE		0x2
+#define BS_HOST_BUSY	0x3
+
+/** Receive/Transmit status definitions */
+
+#define RTS_SUCCESS		0x0
+#define RTS_BUFFLUSH	0x1
+#define RTS_RESERVED	0x2
+#define RTS_BUFERR		0x3
+
+/**
+ * This union represents the bit fields in the DMA Descriptor
+ * status quadlet. Read the quadlet into the <i>d32</i> member then
+ * set/clear the bits using the <i>b</i>it, <i>b_iso_out</i> and
+ * <i>b_iso_in</i> elements.
+ */
+typedef union dev_dma_desc_sts {
+		/** raw register data */
+	uint32_t d32;
+		/** quadlet bits */
+	struct {
+		/** Received number of bytes */
+		unsigned bytes:16;
+		/** NAK bit - only for OUT EPs */
+		unsigned nak:1;
+		unsigned reserved17_22:6;
+		/** Multiple Transfer - only for OUT EPs */
+		unsigned mtrf:1;
+		/** Setup Packet received - only for OUT EPs */
+		unsigned sr:1;
+		/** Interrupt On Complete */
+		unsigned ioc:1;
+		/** Short Packet */
+		unsigned sp:1;
+		/** Last */
+		unsigned l:1;
+		/** Receive Status */
+		unsigned sts:2;
+		/** Buffer Status */
+		unsigned bs:2;
+	} b;
+
+//#ifdef DWC_EN_ISOC
+		/** iso out quadlet bits */
+	struct {
+		/** Received number of bytes */
+		unsigned rxbytes:11;
+
+		unsigned reserved11:1;
+		/** Frame Number */
+		unsigned framenum:11;
+		/** Received ISO Data PID */
+		unsigned pid:2;
+		/** Interrupt On Complete */
+		unsigned ioc:1;
+		/** Short Packet */
+		unsigned sp:1;
+		/** Last */
+		unsigned l:1;
+		/** Receive Status */
+		unsigned rxsts:2;
+		/** Buffer Status */
+		unsigned bs:2;
+	} b_iso_out;
+
+		/** iso in quadlet bits */
+	struct {
+		/** Transmited number of bytes */
+		unsigned txbytes:12;
+		/** Frame Number */
+		unsigned framenum:11;
+		/** Transmited ISO Data PID */
+		unsigned pid:2;
+		/** Interrupt On Complete */
+		unsigned ioc:1;
+		/** Short Packet */
+		unsigned sp:1;
+		/** Last */
+		unsigned l:1;
+		/** Transmit Status */
+		unsigned txsts:2;
+		/** Buffer Status */
+		unsigned bs:2;
+	} b_iso_in;
+//#endif                                /* DWC_EN_ISOC */
+} dev_dma_desc_sts_t;
+
+/**
+ * DMA Descriptor structure
+ *
+ * DMA Descriptor structure contains two quadlets:
+ * Status quadlet and Data buffer pointer.
+ */
+typedef struct dwc_otg_dev_dma_desc {
+	/** DMA Descriptor status quadlet */
+	dev_dma_desc_sts_t status;
+	/** DMA Descriptor data buffer pointer */
+	uint32_t buf;
+} dwc_otg_dev_dma_desc_t;
+
+/**
+ * The dwc_otg_dev_if structure contains information needed to manage
+ * the DWC_otg controller acting in device mode. It represents the
+ * programming view of the device-specific aspects of the controller.
+ */
+typedef struct dwc_otg_dev_if {
+	/** Pointer to device Global registers.
+	 * Device Global Registers starting at offset 800h
+	 */
+	dwc_otg_device_global_regs_t *dev_global_regs;
+#define DWC_DEV_GLOBAL_REG_OFFSET 0x800
+
+	/**
+	 * Device Logical IN Endpoint-Specific Registers 900h-AFCh
+	 */
+	dwc_otg_dev_in_ep_regs_t *in_ep_regs[MAX_EPS_CHANNELS];
+#define DWC_DEV_IN_EP_REG_OFFSET 0x900
+#define DWC_EP_REG_OFFSET 0x20
+
+	/** Device Logical OUT Endpoint-Specific Registers B00h-CFCh */
+	dwc_otg_dev_out_ep_regs_t *out_ep_regs[MAX_EPS_CHANNELS];
+#define DWC_DEV_OUT_EP_REG_OFFSET 0xB00
+
+	/* Device configuration information */
+	uint8_t speed;				 /**< Device Speed	0: Unknown, 1: LS, 2:FS, 3: HS */
+	uint8_t num_in_eps;		 /**< Number # of Tx EP range: 0-15 exept ep0 */
+	uint8_t num_out_eps;		 /**< Number # of Rx EP range: 0-15 exept ep 0*/
+
+	/** Size of periodic FIFOs (Bytes) */
+	uint16_t perio_tx_fifo_size[MAX_PERIO_FIFOS];
+
+	/** Size of Tx FIFOs (Bytes) */
+	uint16_t tx_fifo_size[MAX_TX_FIFOS];
+
+	/** Thresholding enable flags and length varaiables **/
+	uint16_t rx_thr_en;
+	uint16_t iso_tx_thr_en;
+	uint16_t non_iso_tx_thr_en;
+
+	uint16_t rx_thr_length;
+	uint16_t tx_thr_length;
+
+	/**
+	 * Pointers to the DMA Descriptors for EP0 Control
+	 * transfers (virtual and physical)
+	 */
+
+	/** 2 descriptors for SETUP packets */
+	dwc_dma_t dma_setup_desc_addr[2];
+	dwc_otg_dev_dma_desc_t *setup_desc_addr[2];
+
+	/** Pointer to Descriptor with latest SETUP packet */
+	dwc_otg_dev_dma_desc_t *psetup;
+
+	/** Index of current SETUP handler descriptor */
+	uint32_t setup_desc_index;
+
+	/** Descriptor for Data In or Status In phases */
+	dwc_dma_t dma_in_desc_addr;
+	dwc_otg_dev_dma_desc_t *in_desc_addr;
+
+	/** Descriptor for Data Out or Status Out phases */
+	dwc_dma_t dma_out_desc_addr;
+	dwc_otg_dev_dma_desc_t *out_desc_addr;
+
+	/** Setup Packet Detected - if set clear NAK when queueing */
+	uint32_t spd;
+	/** Isoc ep pointer on which incomplete happens */
+	void *isoc_ep;
+
+} dwc_otg_dev_if_t;
+
+/////////////////////////////////////////////////
+// Host Mode Register Structures
+//
+/**
+ * The Host Global Registers structure defines the size and relative
+ * field offsets for the Host Mode Global Registers.  Host Global
+ * Registers offsets 400h-7FFh.
+*/
+typedef struct dwc_otg_host_global_regs {
+	/** Host Configuration Register.   <i>Offset: 400h</i> */
+	volatile uint32_t hcfg;
+	/** Host Frame Interval Register.	<i>Offset: 404h</i> */
+	volatile uint32_t hfir;
+	/** Host Frame Number / Frame Remaining Register. <i>Offset: 408h</i> */
+	volatile uint32_t hfnum;
+	/** Reserved.	<i>Offset: 40Ch</i> */
+	uint32_t reserved40C;
+	/** Host Periodic Transmit FIFO/ Queue Status Register. <i>Offset: 410h</i> */
+	volatile uint32_t hptxsts;
+	/** Host All Channels Interrupt Register. <i>Offset: 414h</i> */
+	volatile uint32_t haint;
+	/** Host All Channels Interrupt Mask Register. <i>Offset: 418h</i> */
+	volatile uint32_t haintmsk;
+	/** Host Frame List Base Address Register . <i>Offset: 41Ch</i> */
+	volatile uint32_t hflbaddr;
+} dwc_otg_host_global_regs_t;
+
+/**
+ * This union represents the bit fields in the Host Configuration Register.
+ * Read the register into the <i>d32</i> member then set/clear the bits using
+ * the <i>b</i>it elements. Write the <i>d32</i> member to the hcfg register.
+ */
+typedef union hcfg_data {
+	/** raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		/** FS/LS Phy Clock Select */
+		unsigned fslspclksel:2;
+#define DWC_HCFG_30_60_MHZ 0
+#define DWC_HCFG_48_MHZ	   1
+#define DWC_HCFG_6_MHZ	   2
+
+		/** FS/LS Only Support */
+		unsigned fslssupp:1;
+		unsigned reserved3_6:4;
+		/** Enable 32-KHz Suspend Mode */
+		unsigned ena32khzs:1;
+		/** Resume Validation Periiod */
+		unsigned resvalid:8;
+		unsigned reserved16_22:7;
+		/** Enable Scatter/gather DMA in Host mode */
+		unsigned descdma:1;
+		/** Frame List Entries */
+		unsigned frlisten:2;
+		/** Enable Periodic Scheduling */
+		unsigned perschedena:1;
+		unsigned reserved27_30:4;
+		unsigned modechtimen:1;
+	} b;
+} hcfg_data_t;
+
+/**
+ * This union represents the bit fields in the Host Frame Remaing/Number
+ * Register.
+ */
+typedef union hfir_data {
+	/** raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		unsigned frint:16;
+		unsigned hfirrldctrl:1;
+		unsigned reserved:15;
+	} b;
+} hfir_data_t;
+
+/**
+ * This union represents the bit fields in the Host Frame Remaing/Number
+ * Register.
+ */
+typedef union hfnum_data {
+	/** raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		unsigned frnum:16;
+#define DWC_HFNUM_MAX_FRNUM 0x3FFF
+		unsigned frrem:16;
+	} b;
+} hfnum_data_t;
+
+typedef union hptxsts_data {
+	/** raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		unsigned ptxfspcavail:16;
+		unsigned ptxqspcavail:8;
+		/** Top of the Periodic Transmit Request Queue
+		 *	- bit 24 - Terminate (last entry for the selected channel)
+		 *	- bits 26:25 - Token Type
+		 *	  - 2'b00 - Zero length
+		 *	  - 2'b01 - Ping
+		 *	  - 2'b10 - Disable
+		 *	- bits 30:27 - Channel Number
+		 *	- bit 31 - Odd/even microframe
+		 */
+		unsigned ptxqtop_terminate:1;
+		unsigned ptxqtop_token:2;
+		unsigned ptxqtop_chnum:4;
+		unsigned ptxqtop_odd:1;
+	} b;
+} hptxsts_data_t;
+
+/**
+ * This union represents the bit fields in the Host Port Control and Status
+ * Register. Read the register into the <i>d32</i> member then set/clear the
+ * bits using the <i>b</i>it elements. Write the <i>d32</i> member to the
+ * hprt0 register.
+ */
+typedef union hprt0_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned prtconnsts:1;
+		unsigned prtconndet:1;
+		unsigned prtena:1;
+		unsigned prtenchng:1;
+		unsigned prtovrcurract:1;
+		unsigned prtovrcurrchng:1;
+		unsigned prtres:1;
+		unsigned prtsusp:1;
+		unsigned prtrst:1;
+		unsigned reserved9:1;
+		unsigned prtlnsts:2;
+		unsigned prtpwr:1;
+		unsigned prttstctl:4;
+		unsigned prtspd:2;
+#define DWC_HPRT0_PRTSPD_HIGH_SPEED 0
+#define DWC_HPRT0_PRTSPD_FULL_SPEED 1
+#define DWC_HPRT0_PRTSPD_LOW_SPEED	2
+		unsigned reserved19_31:13;
+	} b;
+} hprt0_data_t;
+
+/**
+ * This union represents the bit fields in the Host All Interrupt
+ * Register.
+ */
+typedef union haint_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned ch0:1;
+		unsigned ch1:1;
+		unsigned ch2:1;
+		unsigned ch3:1;
+		unsigned ch4:1;
+		unsigned ch5:1;
+		unsigned ch6:1;
+		unsigned ch7:1;
+		unsigned ch8:1;
+		unsigned ch9:1;
+		unsigned ch10:1;
+		unsigned ch11:1;
+		unsigned ch12:1;
+		unsigned ch13:1;
+		unsigned ch14:1;
+		unsigned ch15:1;
+		unsigned reserved:16;
+	} b;
+
+	struct {
+		unsigned chint:16;
+		unsigned reserved:16;
+	} b2;
+} haint_data_t;
+
+/**
+ * This union represents the bit fields in the Host All Interrupt
+ * Register.
+ */
+typedef union haintmsk_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned ch0:1;
+		unsigned ch1:1;
+		unsigned ch2:1;
+		unsigned ch3:1;
+		unsigned ch4:1;
+		unsigned ch5:1;
+		unsigned ch6:1;
+		unsigned ch7:1;
+		unsigned ch8:1;
+		unsigned ch9:1;
+		unsigned ch10:1;
+		unsigned ch11:1;
+		unsigned ch12:1;
+		unsigned ch13:1;
+		unsigned ch14:1;
+		unsigned ch15:1;
+		unsigned reserved:16;
+	} b;
+
+	struct {
+		unsigned chint:16;
+		unsigned reserved:16;
+	} b2;
+} haintmsk_data_t;
+
+/**
+ * Host Channel Specific Registers. <i>500h-5FCh</i>
+ */
+typedef struct dwc_otg_hc_regs {
+	/** Host Channel 0 Characteristic Register. <i>Offset: 500h + (chan_num * 20h) + 00h</i> */
+	volatile uint32_t hcchar;
+	/** Host Channel 0 Split Control Register. <i>Offset: 500h + (chan_num * 20h) + 04h</i> */
+	volatile uint32_t hcsplt;
+	/** Host Channel 0 Interrupt Register. <i>Offset: 500h + (chan_num * 20h) + 08h</i> */
+	volatile uint32_t hcint;
+	/** Host Channel 0 Interrupt Mask Register. <i>Offset: 500h + (chan_num * 20h) + 0Ch</i> */
+	volatile uint32_t hcintmsk;
+	/** Host Channel 0 Transfer Size Register. <i>Offset: 500h + (chan_num * 20h) + 10h</i> */
+	volatile uint32_t hctsiz;
+	/** Host Channel 0 DMA Address Register. <i>Offset: 500h + (chan_num * 20h) + 14h</i> */
+	volatile uint32_t hcdma;
+	volatile uint32_t reserved;
+	/** Host Channel 0 DMA Buffer Address Register. <i>Offset: 500h + (chan_num * 20h) + 1Ch</i> */
+	volatile uint32_t hcdmab;
+} dwc_otg_hc_regs_t;
+
+/**
+ * This union represents the bit fields in the Host Channel Characteristics
+ * Register. Read the register into the <i>d32</i> member then set/clear the
+ * bits using the <i>b</i>it elements. Write the <i>d32</i> member to the
+ * hcchar register.
+ */
+typedef union hcchar_data {
+	/** raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		/** Maximum packet size in bytes */
+		unsigned mps:11;
+
+		/** Endpoint number */
+		unsigned epnum:4;
+
+		/** 0: OUT, 1: IN */
+		unsigned epdir:1;
+
+		unsigned reserved:1;
+
+		/** 0: Full/high speed device, 1: Low speed device */
+		unsigned lspddev:1;
+
+		/** 0: Control, 1: Isoc, 2: Bulk, 3: Intr */
+		unsigned eptype:2;
+
+		/** Packets per frame for periodic transfers. 0 is reserved. */
+		unsigned multicnt:2;
+
+		/** Device address */
+		unsigned devaddr:7;
+
+		/**
+		 * Frame to transmit periodic transaction.
+		 * 0: even, 1: odd
+		 */
+		unsigned oddfrm:1;
+
+		/** Channel disable */
+		unsigned chdis:1;
+
+		/** Channel enable */
+		unsigned chen:1;
+	} b;
+} hcchar_data_t;
+
+typedef union hcsplt_data {
+	/** raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		/** Port Address */
+		unsigned prtaddr:7;
+
+		/** Hub Address */
+		unsigned hubaddr:7;
+
+		/** Transaction Position */
+		unsigned xactpos:2;
+#define DWC_HCSPLIT_XACTPOS_MID 0
+#define DWC_HCSPLIT_XACTPOS_END 1
+#define DWC_HCSPLIT_XACTPOS_BEGIN 2
+#define DWC_HCSPLIT_XACTPOS_ALL 3
+
+		/** Do Complete Split */
+		unsigned compsplt:1;
+
+		/** Reserved */
+		unsigned reserved:14;
+
+		/** Split Enble */
+		unsigned spltena:1;
+	} b;
+} hcsplt_data_t;
+
+/**
+ * This union represents the bit fields in the Host All Interrupt
+ * Register.
+ */
+typedef union hcint_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** Transfer Complete */
+		unsigned xfercomp:1;
+		/** Channel Halted */
+		unsigned chhltd:1;
+		/** AHB Error */
+		unsigned ahberr:1;
+		/** STALL Response Received */
+		unsigned stall:1;
+		/** NAK Response Received */
+		unsigned nak:1;
+		/** ACK Response Received */
+		unsigned ack:1;
+		/** NYET Response Received */
+		unsigned nyet:1;
+		/** Transaction Err */
+		unsigned xacterr:1;
+		/** Babble Error */
+		unsigned bblerr:1;
+		/** Frame Overrun */
+		unsigned frmovrun:1;
+		/** Data Toggle Error */
+		unsigned datatglerr:1;
+		/** Buffer Not Available (only for DDMA mode) */
+		unsigned bna:1;
+		/** Exessive transaction error (only for DDMA mode) */
+		unsigned xcs_xact:1;
+		/** Frame List Rollover interrupt */
+		unsigned frm_list_roll:1;
+		/** Reserved */
+		unsigned reserved14_31:18;
+	} b;
+} hcint_data_t;
+
+/**
+ * This union represents the bit fields in the Host Channel Interrupt Mask
+ * Register. Read the register into the <i>d32</i> member then set/clear the
+ * bits using the <i>b</i>it elements. Write the <i>d32</i> member to the
+ * hcintmsk register.
+ */
+typedef union hcintmsk_data {
+	/** raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		unsigned xfercompl:1;
+		unsigned chhltd:1;
+		unsigned ahberr:1;
+		unsigned stall:1;
+		unsigned nak:1;
+		unsigned ack:1;
+		unsigned nyet:1;
+		unsigned xacterr:1;
+		unsigned bblerr:1;
+		unsigned frmovrun:1;
+		unsigned datatglerr:1;
+		unsigned bna:1;
+		unsigned xcs_xact:1;
+		unsigned frm_list_roll:1;
+		unsigned reserved14_31:18;
+	} b;
+} hcintmsk_data_t;
+
+/**
+ * This union represents the bit fields in the Host Channel Transfer Size
+ * Register. Read the register into the <i>d32</i> member then set/clear the
+ * bits using the <i>b</i>it elements. Write the <i>d32</i> member to the
+ * hcchar register.
+ */
+
+typedef union hctsiz_data {
+	/** raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		/** Total transfer size in bytes */
+		unsigned xfersize:19;
+
+		/** Data packets to transfer */
+		unsigned pktcnt:10;
+
+		/**
+		 * Packet ID for next data packet
+		 * 0: DATA0
+		 * 1: DATA2
+		 * 2: DATA1
+		 * 3: MDATA (non-Control), SETUP (Control)
+		 */
+		unsigned pid:2;
+#define DWC_HCTSIZ_DATA0 0
+#define DWC_HCTSIZ_DATA1 2
+#define DWC_HCTSIZ_DATA2 1
+#define DWC_HCTSIZ_MDATA 3
+#define DWC_HCTSIZ_SETUP 3
+
+		/** Do PING protocol when 1 */
+		unsigned dopng:1;
+	} b;
+
+	/** register bits */
+	struct {
+		/** Scheduling information */
+		unsigned schinfo:8;
+
+		/** Number of transfer descriptors.
+		 * Max value:
+		 * 64 in general,
+		 * 256 only for HS isochronous endpoint.
+		 */
+		unsigned ntd:8;
+
+		/** Data packets to transfer */
+		unsigned reserved16_28:13;
+
+		/**
+		 * Packet ID for next data packet
+		 * 0: DATA0
+		 * 1: DATA2
+		 * 2: DATA1
+		 * 3: MDATA (non-Control)
+		 */
+		unsigned pid:2;
+
+		/** Do PING protocol when 1 */
+		unsigned dopng:1;
+	} b_ddma;
+} hctsiz_data_t;
+
+/**
+ * This union represents the bit fields in the Host DMA Address
+ * Register used in Descriptor DMA mode.
+ */
+typedef union hcdma_data {
+	/** raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		unsigned reserved0_2:3;
+		/** Current Transfer Descriptor. Not used for ISOC */
+		unsigned ctd:8;
+		/** Start Address of Descriptor List */
+		unsigned dma_addr:21;
+	} b;
+} hcdma_data_t;
+
+/**
+ * This union represents the bit fields in the DMA Descriptor
+ * status quadlet for host mode. Read the quadlet into the <i>d32</i> member then
+ * set/clear the bits using the <i>b</i>it elements.
+ */
+typedef union host_dma_desc_sts {
+	/** raw register data */
+	uint32_t d32;
+	/** quadlet bits */
+
+	/* for non-isochronous  */
+	struct {
+		/** Number of bytes */
+		unsigned n_bytes:17;
+		/** QTD offset to jump when Short Packet received - only for IN EPs */
+		unsigned qtd_offset:6;
+		/**
+		 * Set to request the core to jump to alternate QTD if
+		 * Short Packet received - only for IN EPs
+		 */
+		unsigned a_qtd:1;
+		 /**
+		  * Setup Packet bit. When set indicates that buffer contains
+		  * setup packet.
+		  */
+		unsigned sup:1;
+		/** Interrupt On Complete */
+		unsigned ioc:1;
+		/** End of List */
+		unsigned eol:1;
+		unsigned reserved27:1;
+		/** Rx/Tx Status */
+		unsigned sts:2;
+#define DMA_DESC_STS_PKTERR	1
+		unsigned reserved30:1;
+		/** Active Bit */
+		unsigned a:1;
+	} b;
+	/* for isochronous */
+	struct {
+		/** Number of bytes */
+		unsigned n_bytes:12;
+		unsigned reserved12_24:13;
+		/** Interrupt On Complete */
+		unsigned ioc:1;
+		unsigned reserved26_27:2;
+		/** Rx/Tx Status */
+		unsigned sts:2;
+		unsigned reserved30:1;
+		/** Active Bit */
+		unsigned a:1;
+	} b_isoc;
+} host_dma_desc_sts_t;
+
+#define	MAX_DMA_DESC_SIZE		131071
+#define MAX_DMA_DESC_NUM_GENERIC	64
+#define MAX_DMA_DESC_NUM_HS_ISOC	256
+#define MAX_FRLIST_EN_NUM		64
+/**
+ * Host-mode DMA Descriptor structure
+ *
+ * DMA Descriptor structure contains two quadlets:
+ * Status quadlet and Data buffer pointer.
+ */
+typedef struct dwc_otg_host_dma_desc {
+	/** DMA Descriptor status quadlet */
+	host_dma_desc_sts_t status;
+	/** DMA Descriptor data buffer pointer */
+	uint32_t buf;
+} dwc_otg_host_dma_desc_t;
+
+/** OTG Host Interface Structure.
+ *
+ * The OTG Host Interface Structure structure contains information
+ * needed to manage the DWC_otg controller acting in host mode. It
+ * represents the programming view of the host-specific aspects of the
+ * controller.
+ */
+typedef struct dwc_otg_host_if {
+	/** Host Global Registers starting at offset 400h.*/
+	dwc_otg_host_global_regs_t *host_global_regs;
+#define DWC_OTG_HOST_GLOBAL_REG_OFFSET 0x400
+
+	/** Host Port 0 Control and Status Register */
+	volatile uint32_t *hprt0;
+#define DWC_OTG_HOST_PORT_REGS_OFFSET 0x440
+
+	/** Host Channel Specific Registers at offsets 500h-5FCh. */
+	dwc_otg_hc_regs_t *hc_regs[MAX_EPS_CHANNELS];
+#define DWC_OTG_HOST_CHAN_REGS_OFFSET 0x500
+#define DWC_OTG_CHAN_REGS_OFFSET 0x20
+
+	/* Host configuration information */
+	/** Number of Host Channels (range: 1-16) */
+	uint8_t num_host_channels;
+	/** Periodic EPs supported (0: no, 1: yes) */
+	uint8_t perio_eps_supported;
+	/** Periodic Tx FIFO Size (Only 1 host periodic Tx FIFO) */
+	uint16_t perio_tx_fifo_size;
+
+} dwc_otg_host_if_t;
+
+/**
+ * This union represents the bit fields in the Power and Clock Gating Control
+ * Register. Read the register into the <i>d32</i> member then set/clear the
+ * bits using the <i>b</i>it elements.
+ */
+typedef union pcgcctl_data {
+	/** raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		/** Stop Pclk */
+		unsigned stoppclk:1;
+		/** Gate Hclk */
+		unsigned gatehclk:1;
+		/** Power Clamp */
+		unsigned pwrclmp:1;
+		/** Reset Power Down Modules */
+		unsigned rstpdwnmodule:1;
+		/** Reserved */
+		unsigned reserved:1;
+		/** Enable Sleep Clock Gating (Enbl_L1Gating) */
+		unsigned enbl_sleep_gating:1;
+		/** PHY In Sleep (PhySleep) */
+		unsigned phy_in_sleep:1;
+		/** Deep Sleep*/
+		unsigned deep_sleep:1;
+		unsigned resetaftsusp:1;
+		unsigned restoremode:1;
+		unsigned enbl_extnd_hiber:1;
+		unsigned extnd_hiber_pwrclmp:1;
+		unsigned extnd_hiber_switch:1;
+		unsigned ess_reg_restored:1;
+		unsigned prt_clk_sel:2;
+		unsigned port_power:1;
+		unsigned max_xcvrselect:2;
+		unsigned max_termsel:1;
+		unsigned mac_dev_addr:7;
+		unsigned p2hd_dev_enum_spd:2;
+		unsigned p2hd_prt_spd:2;
+		unsigned if_dev_mode:1;
+	} b;
+} pcgcctl_data_t;
+
+/**
+ * This union represents the bit fields in the Global Data FIFO Software
+ * Configuration Register. Read the register into the <i>d32</i> member then
+ * set/clear the bits using the <i>b</i>it elements.
+ */
+typedef union gdfifocfg_data {
+	/* raw register data */
+	uint32_t d32;
+	/** register bits */
+	struct {
+		/** OTG Data FIFO depth */
+		unsigned gdfifocfg:16;
+		/** Start address of EP info controller */
+		unsigned epinfobase:16;
+	} b;
+} gdfifocfg_data_t;
+
+/**
+ * This union represents the bit fields in the Global Power Down Register
+ * Register. Read the register into the <i>d32</i> member then set/clear the
+ * bits using the <i>b</i>it elements.
+ */
+typedef union gpwrdn_data {
+	/* raw register data */
+	uint32_t d32;
+
+	/** register bits */
+	struct {
+		/** PMU Interrupt Select */
+		unsigned pmuintsel:1;
+		/** PMU Active */
+		unsigned pmuactv:1;
+		/** Restore */
+		unsigned restore:1;
+		/** Power Down Clamp */
+		unsigned pwrdnclmp:1;
+		/** Power Down Reset */
+		unsigned pwrdnrstn:1;
+		/** Power Down Switch */
+		unsigned pwrdnswtch:1;
+		/** Disable VBUS */
+		unsigned dis_vbus:1;
+		/** Line State Change */
+		unsigned lnstschng:1;
+		/** Line state change mask */
+		unsigned lnstchng_msk:1;
+		/** Reset Detected */
+		unsigned rst_det:1;
+		/** Reset Detect mask */
+		unsigned rst_det_msk:1;
+		/** Disconnect Detected */
+		unsigned disconn_det:1;
+		/** Disconnect Detect mask */
+		unsigned disconn_det_msk:1;
+		/** Connect Detected*/
+		unsigned connect_det:1;
+		/** Connect Detected Mask*/
+		unsigned connect_det_msk:1;
+		/** SRP Detected */
+		unsigned srp_det:1;
+		/** SRP Detect mask */
+		unsigned srp_det_msk:1;
+		/** Status Change Interrupt */
+		unsigned sts_chngint:1;
+		/** Status Change Interrupt Mask */
+		unsigned sts_chngint_msk:1;
+		/** Line State */
+		unsigned linestate:2;
+		/** Indicates current mode(status of IDDIG signal) */
+		unsigned idsts:1;
+		/** B Session Valid signal status*/
+		unsigned bsessvld:1;
+		/** ADP Event Detected */
+		unsigned adp_int:1;
+		/** Multi Valued ID pin */
+		unsigned mult_val_id_bc:5;
+		/** Reserved 24_31 */
+		unsigned reserved29_31:3;
+	} b;
+} gpwrdn_data_t;
+
+#endif
diff --git a/drivers/usb/host/dwc_otg/test/Makefile b/drivers/usb/host/dwc_otg/test/Makefile
new file mode 100644
index 000000000000..fc453759dea3
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/test/Makefile
@@ -0,0 +1,16 @@
+
+PERL=/usr/bin/perl
+PL_TESTS=test_sysfs.pl test_mod_param.pl
+
+.PHONY : test
+test : perl_tests
+
+perl_tests :
+	@echo
+	@echo Running perl tests
+	@for test in $(PL_TESTS); do \
+	  if $(PERL) ./$$test ; then \
+	    echo "=======> $$test, PASSED" ; \
+	  else echo "=======> $$test, FAILED" ; \
+	  fi \
+	done
diff --git a/drivers/usb/host/dwc_otg/test/dwc_otg_test.pm b/drivers/usb/host/dwc_otg/test/dwc_otg_test.pm
new file mode 100644
index 000000000000..85e55fd6ddbc
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/test/dwc_otg_test.pm
@@ -0,0 +1,337 @@
+package dwc_otg_test;
+
+use strict;
+use Exporter ();
+
+use vars qw(@ISA @EXPORT
+$sysfsdir $paramdir $errors $params
+);
+
+@ISA = qw(Exporter);
+
+#
+# Globals
+#
+$sysfsdir = "/sys/devices/lm0";
+$paramdir = "/sys/module/dwc_otg";
+$errors = 0;
+
+$params = [
+	   {
+	    NAME => "otg_cap",
+	    DEFAULT => 0,
+	    ENUM => [],
+	    LOW => 0,
+	    HIGH => 2
+	   },
+	   {
+	    NAME => "dma_enable",
+	    DEFAULT => 0,
+	    ENUM => [],
+	    LOW => 0,
+	    HIGH => 1
+	   },
+	   {
+	    NAME => "dma_burst_size",
+	    DEFAULT => 32,
+	    ENUM => [1, 4, 8, 16, 32, 64, 128, 256],
+	    LOW => 1,
+	    HIGH => 256
+	   },
+	   {
+	    NAME => "host_speed",
+	    DEFAULT => 0,
+	    ENUM => [],
+	    LOW => 0,
+	    HIGH => 1
+	   },
+	   {
+	    NAME => "host_support_fs_ls_low_power",
+	    DEFAULT => 0,
+	    ENUM => [],
+	    LOW => 0,
+	    HIGH => 1
+	   },
+	   {
+	    NAME => "host_ls_low_power_phy_clk",
+	    DEFAULT => 0,
+	    ENUM => [],
+	    LOW => 0,
+	    HIGH => 1
+	   },
+	   {
+	    NAME => "dev_speed",
+	    DEFAULT => 0,
+	    ENUM => [],
+	    LOW => 0,
+	    HIGH => 1
+	   },
+	   {
+	    NAME => "enable_dynamic_fifo",
+	    DEFAULT => 1,
+	    ENUM => [],
+	    LOW => 0,
+	    HIGH => 1
+	   },
+	   {
+	    NAME => "data_fifo_size",
+	    DEFAULT => 8192,
+	    ENUM => [],
+	    LOW => 32,
+	    HIGH => 32768
+	   },
+	   {
+	    NAME => "dev_rx_fifo_size",
+	    DEFAULT => 1064,
+	    ENUM => [],
+	    LOW => 16,
+	    HIGH => 32768
+	   },
+	   {
+	    NAME => "dev_nperio_tx_fifo_size",
+	    DEFAULT => 1024,
+	    ENUM => [],
+	    LOW => 16,
+	    HIGH => 32768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_1",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_2",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_3",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_4",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_5",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_6",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_7",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_8",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_9",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_10",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_11",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_12",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_13",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_14",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "dev_perio_tx_fifo_size_15",
+	    DEFAULT => 256,
+	    ENUM => [],
+	    LOW => 4,
+	    HIGH => 768
+	   },
+	   {
+	    NAME => "host_rx_fifo_size",
+	    DEFAULT => 1024,
+	    ENUM => [],
+	    LOW => 16,
+	    HIGH => 32768
+	   },
+	   {
+	    NAME => "host_nperio_tx_fifo_size",
+	    DEFAULT => 1024,
+	    ENUM => [],
+	    LOW => 16,
+	    HIGH => 32768
+	   },
+	   {
+	    NAME => "host_perio_tx_fifo_size",
+	    DEFAULT => 1024,
+	    ENUM => [],
+	    LOW => 16,
+	    HIGH => 32768
+	   },
+	   {
+	    NAME => "max_transfer_size",
+	    DEFAULT => 65535,
+	    ENUM => [],
+	    LOW => 2047,
+	    HIGH => 65535
+	   },
+	   {
+	    NAME => "max_packet_count",
+	    DEFAULT => 511,
+	    ENUM => [],
+	    LOW => 15,
+	    HIGH => 511
+	   },
+	   {
+	    NAME => "host_channels",
+	    DEFAULT => 12,
+	    ENUM => [],
+	    LOW => 1,
+	    HIGH => 16
+	   },
+	   {
+	    NAME => "dev_endpoints",
+	    DEFAULT => 6,
+	    ENUM => [],
+	    LOW => 1,
+	    HIGH => 15
+	   },
+	   {
+	    NAME => "phy_type",
+	    DEFAULT => 1,
+	    ENUM => [],
+	    LOW => 0,
+	    HIGH => 2
+	   },
+	   {
+	    NAME => "phy_utmi_width",
+	    DEFAULT => 16,
+	    ENUM => [8, 16],
+	    LOW => 8,
+	    HIGH => 16
+	   },
+	   {
+	    NAME => "phy_ulpi_ddr",
+	    DEFAULT => 0,
+	    ENUM => [],
+	    LOW => 0,
+	    HIGH => 1
+	   },
+	  ];
+
+
+#
+#
+sub check_arch {
+  $_ = `uname -m`;
+  chomp;
+  unless (m/armv4tl/) {
+    warn "# \n# Can't execute on $_.  Run on integrator platform.\n# \n";
+    return 0;
+  }
+  return 1;
+}
+
+#
+#
+sub load_module {
+  my $params = shift;
+  print "\nRemoving Module\n";
+  system "rmmod dwc_otg";
+  print "Loading Module\n";
+  if ($params ne "") {
+    print "Module Parameters: $params\n";
+  }
+  if (system("modprobe dwc_otg $params")) {
+    warn "Unable to load module\n";
+    return 0;
+  }
+  return 1;
+}
+
+#
+#
+sub test_status {
+  my $arg = shift;
+
+  print "\n";
+
+  if (defined $arg) {
+    warn "WARNING: $arg\n";
+  }
+
+  if ($errors > 0) {
+    warn "TEST FAILED with $errors errors\n";
+    return 0;
+  } else {
+    print "TEST PASSED\n";
+    return 0 if (defined $arg);
+  }
+  return 1;
+}
+
+#
+#
+@EXPORT = qw(
+$sysfsdir
+$paramdir
+$params
+$errors
+check_arch
+load_module
+test_status
+);
+
+1;
diff --git a/drivers/usb/host/dwc_otg/test/test_mod_param.pl b/drivers/usb/host/dwc_otg/test/test_mod_param.pl
new file mode 100644
index 000000000000..dc3820df577b
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/test/test_mod_param.pl
@@ -0,0 +1,133 @@
+#!/usr/bin/perl -w
+#
+# Run this program on the integrator.
+#
+# - Tests module parameter default values.
+# - Tests setting of valid module parameter values via modprobe.
+# - Tests invalid module parameter values.
+# -----------------------------------------------------------------------------
+use strict;
+use dwc_otg_test;
+
+check_arch() or die;
+
+#
+#
+sub test {
+  my ($param,$expected) = @_;
+  my $value = get($param);
+
+  if ($value == $expected) {
+    print "$param = $value, okay\n";
+  }
+
+  else {
+    warn "ERROR: value of $param != $expected, $value\n";
+    $errors ++;
+  }
+}
+
+#
+#
+sub get {
+  my $param = shift;
+  my $tmp = `cat $paramdir/$param`;
+  chomp $tmp;
+  return $tmp;
+}
+
+#
+#
+sub test_main {
+
+  print "\nTesting Module Parameters\n";
+
+  load_module("") or die;
+
+  # Test initial values
+  print "\nTesting Default Values\n";
+  foreach (@{$params}) {
+    test ($_->{NAME}, $_->{DEFAULT});
+  }
+
+  # Test low value
+  print "\nTesting Low Value\n";
+  my $cmd_params = "";
+  foreach (@{$params}) {
+    $cmd_params = $cmd_params . "$_->{NAME}=$_->{LOW} ";
+  }
+  load_module($cmd_params) or die;
+
+  foreach (@{$params}) {
+    test ($_->{NAME}, $_->{LOW});
+  }
+
+  # Test high value
+  print "\nTesting High Value\n";
+  $cmd_params = "";
+  foreach (@{$params}) {
+    $cmd_params = $cmd_params . "$_->{NAME}=$_->{HIGH} ";
+  }
+  load_module($cmd_params) or die;
+
+  foreach (@{$params}) {
+    test ($_->{NAME}, $_->{HIGH});
+  }
+
+  # Test Enum
+  print "\nTesting Enumerated\n";
+  foreach (@{$params}) {
+    if (defined $_->{ENUM}) {
+      my $value;
+      foreach $value (@{$_->{ENUM}}) {
+	$cmd_params = "$_->{NAME}=$value";
+	load_module($cmd_params) or die;
+	test ($_->{NAME}, $value);
+      }
+    }
+  }
+
+  # Test Invalid Values
+  print "\nTesting Invalid Values\n";
+  $cmd_params = "";
+  foreach (@{$params}) {
+    $cmd_params = $cmd_params . sprintf "$_->{NAME}=%d ", $_->{LOW}-1;
+  }
+  load_module($cmd_params) or die;
+
+  foreach (@{$params}) {
+    test ($_->{NAME}, $_->{DEFAULT});
+  }
+
+  $cmd_params = "";
+  foreach (@{$params}) {
+    $cmd_params = $cmd_params . sprintf "$_->{NAME}=%d ", $_->{HIGH}+1;
+  }
+  load_module($cmd_params) or die;
+
+  foreach (@{$params}) {
+    test ($_->{NAME}, $_->{DEFAULT});
+  }
+
+  print "\nTesting Enumerated\n";
+  foreach (@{$params}) {
+    if (defined $_->{ENUM}) {
+      my $value;
+      foreach $value (@{$_->{ENUM}}) {
+	$value = $value + 1;
+	$cmd_params = "$_->{NAME}=$value";
+	load_module($cmd_params) or die;
+	test ($_->{NAME}, $_->{DEFAULT});
+	$value = $value - 2;
+	$cmd_params = "$_->{NAME}=$value";
+	load_module($cmd_params) or die;
+	test ($_->{NAME}, $_->{DEFAULT});
+      }
+    }
+  }
+
+  test_status() or die;
+}
+
+test_main();
+0;
diff --git a/drivers/usb/host/dwc_otg/test/test_sysfs.pl b/drivers/usb/host/dwc_otg/test/test_sysfs.pl
new file mode 100644
index 000000000000..cdc9963176e5
--- /dev/null
+++ b/drivers/usb/host/dwc_otg/test/test_sysfs.pl
@@ -0,0 +1,193 @@
+#!/usr/bin/perl -w
+#
+# Run this program on the integrator
+# - Tests select sysfs attributes.
+# - Todo ... test more attributes, hnp/srp, buspower/bussuspend, etc.
+# -----------------------------------------------------------------------------
+use strict;
+use dwc_otg_test;
+
+check_arch() or die;
+
+#
+#
+sub test {
+  my ($attr,$expected) = @_;
+  my $string = get($attr);
+
+  if ($string eq $expected) {
+    printf("$attr = $string, okay\n");
+  }
+  else {
+    warn "ERROR: value of $attr != $expected, $string\n";
+    $errors ++;
+  }
+}
+
+#
+#
+sub set {
+  my ($reg, $value) = @_;
+  system "echo $value > $sysfsdir/$reg";
+}
+
+#
+#
+sub get {
+  my $attr = shift;
+  my $string = `cat $sysfsdir/$attr`;
+  chomp $string;
+  if ($string =~ m/\s\=\s/) {
+    my $tmp;
+    ($tmp, $string) = split /\s=\s/, $string;
+  }
+  return $string;
+}
+
+#
+#
+sub test_main {
+  print("\nTesting Sysfs Attributes\n");
+
+  load_module("") or die;
+
+  # Test initial values of regoffset/regvalue/guid/gsnpsid
+  print("\nTesting Default Values\n");
+
+  test("regoffset", "0xffffffff");
+  test("regvalue", "invalid offset");
+  test("guid", "0x12345678");	# this will fail if it has been changed
+  test("gsnpsid", "0x4f54200a");
+
+  # Test operation of regoffset/regvalue
+  print("\nTesting regoffset\n");
+  set('regoffset', '5a5a5a5a');
+  test("regoffset", "0xffffffff");
+
+  set('regoffset', '0');
+  test("regoffset", "0x00000000");
+
+  set('regoffset', '40000');
+  test("regoffset", "0x00000000");
+
+  set('regoffset', '3ffff');
+  test("regoffset", "0x0003ffff");
+
+  set('regoffset', '1');
+  test("regoffset", "0x00000001");
+
+  print("\nTesting regvalue\n");
+  set('regoffset', '3c');
+  test("regvalue", "0x12345678");
+  set('regvalue', '5a5a5a5a');
+  test("regvalue", "0x5a5a5a5a");
+  set('regvalue','a5a5a5a5');
+  test("regvalue", "0xa5a5a5a5");
+  set('guid','12345678');
+
+  # Test HNP Capable
+  print("\nTesting HNP Capable bit\n");
+  set('hnpcapable', '1');
+  test("hnpcapable", "0x1");
+  set('hnpcapable','0');
+  test("hnpcapable", "0x0");
+
+  set('regoffset','0c');
+
+  my $old = get('gusbcfg');
+  print("setting hnpcapable\n");
+  set('hnpcapable', '1');
+  test("hnpcapable", "0x1");
+  test('gusbcfg', sprintf "0x%08x", (oct ($old) | (1<<9)));
+  test('regvalue', sprintf "0x%08x", (oct ($old) | (1<<9)));
+
+  $old = get('gusbcfg');
+  print("clearing hnpcapable\n");
+  set('hnpcapable', '0');
+  test("hnpcapable", "0x0");
+  test ('gusbcfg', sprintf "0x%08x", oct ($old) & (~(1<<9)));
+  test ('regvalue', sprintf "0x%08x", oct ($old) & (~(1<<9)));
+
+  # Test SRP Capable
+  print("\nTesting SRP Capable bit\n");
+  set('srpcapable', '1');
+  test("srpcapable", "0x1");
+  set('srpcapable','0');
+  test("srpcapable", "0x0");
+
+  set('regoffset','0c');
+
+  $old = get('gusbcfg');
+  print("setting srpcapable\n");
+  set('srpcapable', '1');
+  test("srpcapable", "0x1");
+  test('gusbcfg', sprintf "0x%08x", (oct ($old) | (1<<8)));
+  test('regvalue', sprintf "0x%08x", (oct ($old) | (1<<8)));
+
+  $old = get('gusbcfg');
+  print("clearing srpcapable\n");
+  set('srpcapable', '0');
+  test("srpcapable", "0x0");
+  test('gusbcfg', sprintf "0x%08x", oct ($old) & (~(1<<8)));
+  test('regvalue', sprintf "0x%08x", oct ($old) & (~(1<<8)));
+
+  # Test GGPIO
+  print("\nTesting GGPIO\n");
+  set('ggpio','5a5a5a5a');
+  test('ggpio','0x5a5a0000');
+  set('ggpio','a5a5a5a5');
+  test('ggpio','0xa5a50000');
+  set('ggpio','11110000');
+  test('ggpio','0x11110000');
+  set('ggpio','00001111');
+  test('ggpio','0x00000000');
+
+  # Test DEVSPEED
+  print("\nTesting DEVSPEED\n");
+  set('regoffset','800');
+  $old = get('regvalue');
+  set('devspeed','0');
+  test('devspeed','0x0');
+  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3)));
+  set('devspeed','1');
+  test('devspeed','0x1');
+  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3) | 1));
+  set('devspeed','2');
+  test('devspeed','0x2');
+  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3) | 2));
+  set('devspeed','3');
+  test('devspeed','0x3');
+  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3) | 3));
+  set('devspeed','4');
+  test('devspeed','0x0');
+  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3)));
+  set('devspeed','5');
+  test('devspeed','0x1');
+  test('regvalue',sprintf("0x%08x", oct($old) & ~(0x3) | 1));
+
+
+  #  mode	Returns the current mode:0 for device mode1 for host mode	Read
+  #  hnp	Initiate the Host Negotiation Protocol.  Read returns the status.	Read/Write
+  #  srp	Initiate the Session Request Protocol.  Read returns the status.	Read/Write
+  #  buspower	Get or Set the Power State of the bus (0 - Off or 1 - On) 	Read/Write
+  #  bussuspend	Suspend the USB bus.	Read/Write
+  #  busconnected	Get the connection status of the bus 	Read
+
+  #  gotgctl	Get or set the Core Control Status Register.	Read/Write
+  ##  gusbcfg	Get or set the Core USB Configuration Register	Read/Write
+  #  grxfsiz	Get or set the Receive FIFO Size Register	Read/Write
+  #  gnptxfsiz	Get or set the non-periodic Transmit Size Register	Read/Write
+  #  gpvndctl	Get or set the PHY Vendor Control Register	Read/Write
+  ##  ggpio	Get the value in the lower 16-bits of the General Purpose IO Register or Set the upper 16 bits.	Read/Write
+  ##  guid	Get or set the value of the User ID Register	Read/Write
+  ##  gsnpsid	Get the value of the Synopsys ID Regester	Read
+  ##  devspeed	Get or set the device speed setting in the DCFG register	Read/Write
+  #  enumspeed	Gets the device enumeration Speed.	Read
+  #  hptxfsiz	Get the value of the Host Periodic Transmit FIFO	Read
+  #  hprt0	Get or Set the value in the Host Port Control and Status Register	Read/Write
+
+  test_status("TEST NYI") or die;
+}
+
+test_main();
+0;
diff --git a/drivers/video/backlight/Kconfig b/drivers/video/backlight/Kconfig
index 4e1d2ad50ba1..9244f2f7b642 100644
--- a/drivers/video/backlight/Kconfig
+++ b/drivers/video/backlight/Kconfig
@@ -265,6 +265,13 @@ config BACKLIGHT_PWM
 	  If you have a LCD backlight adjustable by PWM, say Y to enable
 	  this driver.
 
+config BACKLIGHT_RPI
+	tristate "Raspberry Pi display firmware driven backlight"
+	depends on RASPBERRYPI_FIRMWARE
+	help
+	  If you have the Raspberry Pi DSI touchscreen display, say Y to
+	  enable the mailbox-controlled backlight driver.
+
 config BACKLIGHT_DA903X
 	tristate "Backlight Driver for DA9030/DA9034 using WLED"
 	depends on PMIC_DA903X
diff --git a/drivers/video/backlight/Makefile b/drivers/video/backlight/Makefile
index 5e28f01c8391..2a4d0ed47377 100644
--- a/drivers/video/backlight/Makefile
+++ b/drivers/video/backlight/Makefile
@@ -51,6 +51,7 @@ obj-$(CONFIG_BACKLIGHT_PANDORA)		+= pandora_bl.o
 obj-$(CONFIG_BACKLIGHT_PCF50633)	+= pcf50633-backlight.o
 obj-$(CONFIG_BACKLIGHT_PM8941_WLED)	+= pm8941-wled.o
 obj-$(CONFIG_BACKLIGHT_PWM)		+= pwm_bl.o
+obj-$(CONFIG_BACKLIGHT_RPI)			+= rpi_backlight.o
 obj-$(CONFIG_BACKLIGHT_SAHARA)		+= kb3886_bl.o
 obj-$(CONFIG_BACKLIGHT_SKY81452)	+= sky81452-backlight.o
 obj-$(CONFIG_BACKLIGHT_TOSA)		+= tosa_bl.o
diff --git a/drivers/video/backlight/rpi_backlight.c b/drivers/video/backlight/rpi_backlight.c
new file mode 100644
index 000000000000..14a0d9b03739
--- /dev/null
+++ b/drivers/video/backlight/rpi_backlight.c
@@ -0,0 +1,119 @@
+/*
+ * rpi_bl.c - Backlight controller through VPU
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/backlight.h>
+#include <linux/err.h>
+#include <linux/fb.h>
+#include <linux/gpio.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+struct rpi_backlight {
+	struct device *dev;
+	struct device *fbdev;
+	struct rpi_firmware *fw;
+};
+
+static int rpi_backlight_update_status(struct backlight_device *bl)
+{
+	struct rpi_backlight *gbl = bl_get_data(bl);
+	int brightness = bl->props.brightness;
+	int ret;
+
+	if (bl->props.power != FB_BLANK_UNBLANK ||
+	    bl->props.fb_blank != FB_BLANK_UNBLANK ||
+	    bl->props.state & (BL_CORE_SUSPENDED | BL_CORE_FBBLANK))
+		brightness = 0;
+
+	ret = rpi_firmware_property(gbl->fw,
+			RPI_FIRMWARE_FRAMEBUFFER_SET_BACKLIGHT,
+			&brightness, sizeof(brightness));
+	if (ret) {
+		dev_err(gbl->dev, "Failed to set brightness\n");
+		return ret;
+	}
+
+	if (brightness < 0) {
+		dev_err(gbl->dev, "Backlight change failed\n");
+		return -EAGAIN;
+	}
+
+	return 0;
+}
+
+static const struct backlight_ops rpi_backlight_ops = {
+	.options	= BL_CORE_SUSPENDRESUME,
+	.update_status	= rpi_backlight_update_status,
+};
+
+static int rpi_backlight_probe(struct platform_device *pdev)
+{
+	struct backlight_properties props;
+	struct backlight_device *bl;
+	struct rpi_backlight *gbl;
+	struct device_node *fw_node;
+
+	gbl = devm_kzalloc(&pdev->dev, sizeof(*gbl), GFP_KERNEL);
+	if (gbl == NULL)
+		return -ENOMEM;
+
+	gbl->dev = &pdev->dev;
+
+	fw_node = of_parse_phandle(pdev->dev.of_node, "firmware", 0);
+	if (!fw_node) {
+		dev_err(&pdev->dev, "Missing firmware node\n");
+		return -ENOENT;
+	}
+
+	gbl->fw = rpi_firmware_get(fw_node);
+	if (!gbl->fw)
+		return -EPROBE_DEFER;
+
+	memset(&props, 0, sizeof(props));
+	props.type = BACKLIGHT_RAW;
+	props.max_brightness = 255;
+	bl = devm_backlight_device_register(&pdev->dev, dev_name(&pdev->dev),
+					&pdev->dev, gbl, &rpi_backlight_ops,
+					&props);
+	if (IS_ERR(bl)) {
+		dev_err(&pdev->dev, "failed to register backlight\n");
+		return PTR_ERR(bl);
+	}
+
+	bl->props.brightness = 255;
+	backlight_update_status(bl);
+
+	platform_set_drvdata(pdev, bl);
+	return 0;
+}
+
+static const struct of_device_id rpi_backlight_of_match[] = {
+	{ .compatible = "raspberrypi,rpi-backlight" },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, rpi_backlight_of_match);
+
+static struct platform_driver rpi_backlight_driver = {
+	.driver		= {
+		.name		= "rpi-backlight",
+		.of_match_table = of_match_ptr(rpi_backlight_of_match),
+	},
+	.probe		= rpi_backlight_probe,
+};
+
+module_platform_driver(rpi_backlight_driver);
+
+MODULE_AUTHOR("Gordon Hollingworth <gordon@raspberrypi.org>");
+MODULE_DESCRIPTION("Raspberry Pi mailbox based Backlight Driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
index 5e58f5ec0a28..c20eade6598b 100644
--- a/drivers/video/fbdev/Kconfig
+++ b/drivers/video/fbdev/Kconfig
@@ -236,6 +236,20 @@ config FB_TILEBLITTING
 comment "Frame buffer hardware drivers"
 	depends on FB
 
+config FB_BCM2708
+	tristate "BCM2708 framebuffer support"
+	depends on FB && RASPBERRYPI_FIRMWARE
+	select FB_CFB_FILLRECT
+	select FB_CFB_COPYAREA
+	select FB_CFB_IMAGEBLIT
+	help
+	  This framebuffer device driver is for the BCM2708 framebuffer.
+
+	  If you want to compile this as a module (=code which can be
+	  inserted into and removed from the running kernel), say M
+	  here and read <file:Documentation/kbuild/modules.txt>.  The module
+	  will be called bcm2708_fb.
+
 config FB_GRVGA
 	tristate "Aeroflex Gaisler framebuffer support"
 	depends on FB && SPARC
@@ -2496,3 +2510,16 @@ config FB_SM712
 	  This driver is also available as a module. The module will be
 	  called sm712fb. If you want to compile it as a module, say M
 	  here and read <file:Documentation/kbuild/modules.txt>.
+
+config FB_RPISENSE
+	tristate "Raspberry Pi Sense HAT framebuffer"
+	depends on FB
+	select MFD_RPISENSE_CORE
+	select FB_SYS_FOPS
+	select FB_SYS_FILLRECT
+	select FB_SYS_COPYAREA
+	select FB_SYS_IMAGEBLIT
+	select FB_DEFERRED_IO
+
+	help
+	  This is the framebuffer driver for the Raspberry Pi Sense HAT
diff --git a/drivers/video/fbdev/Makefile b/drivers/video/fbdev/Makefile
index 8895536a20d6..0367887317a7 100644
--- a/drivers/video/fbdev/Makefile
+++ b/drivers/video/fbdev/Makefile
@@ -11,6 +11,7 @@ obj-$(CONFIG_FB_MACMODES)      += macmodes.o
 obj-$(CONFIG_FB_WMT_GE_ROPS)   += wmt_ge_rops.o
 
 # Hardware specific drivers go first
+obj-$(CONFIG_FB_BCM2708)	  += bcm2708_fb.o
 obj-$(CONFIG_FB_AMIGA)            += amifb.o c2p_planar.o
 obj-$(CONFIG_FB_ARC)              += arcfb.o
 obj-$(CONFIG_FB_CLPS711X)	  += clps711x-fb.o
@@ -147,6 +148,7 @@ obj-$(CONFIG_FB_DA8XX)		  += da8xx-fb.o
 obj-$(CONFIG_FB_MXS)		  += mxsfb.o
 obj-$(CONFIG_FB_SSD1307)	  += ssd1307fb.o
 obj-$(CONFIG_FB_SIMPLE)           += simplefb.o
+obj-$(CONFIG_FB_RPISENSE)	  += rpisense-fb.o
 
 # the test framebuffer is last
 obj-$(CONFIG_FB_VIRTUAL)          += vfb.o
diff --git a/drivers/video/fbdev/bcm2708_fb.c b/drivers/video/fbdev/bcm2708_fb.c
new file mode 100644
index 000000000000..6c9ee9ca8ee2
--- /dev/null
+++ b/drivers/video/fbdev/bcm2708_fb.c
@@ -0,0 +1,981 @@
+/*
+ *  linux/drivers/video/bcm2708_fb.c
+ *
+ * Copyright (C) 2010 Broadcom
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file COPYING in the main directory of this archive
+ * for more details.
+ *
+ * Broadcom simple framebuffer driver
+ *
+ * This file is derived from cirrusfb.c
+ * Copyright 1999-2001 Jeff Garzik <jgarzik@pobox.com>
+ *
+ */
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+#include <linux/slab.h>
+#include <linux/mm.h>
+#include <linux/fb.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/ioport.h>
+#include <linux/list.h>
+#include <linux/platform_data/dma-bcm2708.h>
+#include <linux/platform_device.h>
+#include <linux/clk.h>
+#include <linux/printk.h>
+#include <linux/console.h>
+#include <linux/debugfs.h>
+#include <asm/sizes.h>
+#include <linux/uaccess.h>
+#include <linux/io.h>
+#include <linux/dma-mapping.h>
+#include <linux/cred.h>
+#include <soc/bcm2835/raspberrypi-firmware.h>
+
+//#define BCM2708_FB_DEBUG
+#define MODULE_NAME "bcm2708_fb"
+
+#ifdef BCM2708_FB_DEBUG
+#define print_debug(fmt, ...) pr_debug("%s:%s:%d: "fmt, \
+			MODULE_NAME, __func__, __LINE__, ##__VA_ARGS__)
+#else
+#define print_debug(fmt, ...)
+#endif
+
+/* This is limited to 16 characters when displayed by X startup */
+static const char *bcm2708_name = "BCM2708 FB";
+
+#define DRIVER_NAME "bcm2708_fb"
+
+static int fbwidth = 800;	/* module parameter */
+static int fbheight = 480;	/* module parameter */
+static int fbdepth = 32;	/* module parameter */
+static int fbswap;		/* module parameter */
+
+static u32 dma_busy_wait_threshold = 1<<15;
+module_param(dma_busy_wait_threshold, int, 0644);
+MODULE_PARM_DESC(dma_busy_wait_threshold, "Busy-wait for DMA completion below this area");
+
+struct fb_alloc_tags {
+	struct rpi_firmware_property_tag_header tag1;
+	u32 xres, yres;
+	struct rpi_firmware_property_tag_header tag2;
+	u32 xres_virtual, yres_virtual;
+	struct rpi_firmware_property_tag_header tag3;
+	u32 bpp;
+	struct rpi_firmware_property_tag_header tag4;
+	u32 xoffset, yoffset;
+	struct rpi_firmware_property_tag_header tag5;
+	u32 base, screen_size;
+	struct rpi_firmware_property_tag_header tag6;
+	u32 pitch;
+};
+
+struct bcm2708_fb_stats {
+	struct debugfs_regset32 regset;
+	u32 dma_copies;
+	u32 dma_irqs;
+};
+
+struct bcm2708_fb {
+	struct fb_info fb;
+	struct platform_device *dev;
+	struct rpi_firmware *fw;
+	u32 cmap[16];
+	u32 gpu_cmap[256];
+	int dma_chan;
+	int dma_irq;
+	void __iomem *dma_chan_base;
+	void *cb_base;		/* DMA control blocks */
+	dma_addr_t cb_handle;
+	struct dentry *debugfs_dir;
+	wait_queue_head_t dma_waitq;
+	struct bcm2708_fb_stats stats;
+	unsigned long fb_bus_address;
+	struct { u32 base, length; } gpu;
+};
+
+#define to_bcm2708(info)	container_of(info, struct bcm2708_fb, fb)
+
+static void bcm2708_fb_debugfs_deinit(struct bcm2708_fb *fb)
+{
+	debugfs_remove_recursive(fb->debugfs_dir);
+	fb->debugfs_dir = NULL;
+}
+
+static int bcm2708_fb_debugfs_init(struct bcm2708_fb *fb)
+{
+	static struct debugfs_reg32 stats_registers[] = {
+		{
+			"dma_copies",
+			offsetof(struct bcm2708_fb_stats, dma_copies)
+		},
+		{
+			"dma_irqs",
+			offsetof(struct bcm2708_fb_stats, dma_irqs)
+		},
+	};
+
+	fb->debugfs_dir = debugfs_create_dir(DRIVER_NAME, NULL);
+	if (!fb->debugfs_dir) {
+		pr_warn("%s: could not create debugfs entry\n",
+			__func__);
+		return -EFAULT;
+	}
+
+	fb->stats.regset.regs = stats_registers;
+	fb->stats.regset.nregs = ARRAY_SIZE(stats_registers);
+	fb->stats.regset.base = &fb->stats;
+
+	if (!debugfs_create_regset32(
+		"stats", 0444, fb->debugfs_dir, &fb->stats.regset)) {
+		pr_warn("%s: could not create statistics registers\n",
+			__func__);
+		goto fail;
+	}
+	return 0;
+
+fail:
+	bcm2708_fb_debugfs_deinit(fb);
+	return -EFAULT;
+}
+
+static int bcm2708_fb_set_bitfields(struct fb_var_screeninfo *var)
+{
+	int ret = 0;
+
+	memset(&var->transp, 0, sizeof(var->transp));
+
+	var->red.msb_right = 0;
+	var->green.msb_right = 0;
+	var->blue.msb_right = 0;
+
+	switch (var->bits_per_pixel) {
+	case 1:
+	case 2:
+	case 4:
+	case 8:
+		var->red.length = var->bits_per_pixel;
+		var->red.offset = 0;
+		var->green.length = var->bits_per_pixel;
+		var->green.offset = 0;
+		var->blue.length = var->bits_per_pixel;
+		var->blue.offset = 0;
+		break;
+	case 16:
+		var->red.length = 5;
+		var->blue.length = 5;
+		/*
+		 * Green length can be 5 or 6 depending whether
+		 * we're operating in RGB555 or RGB565 mode.
+		 */
+		if (var->green.length != 5 && var->green.length != 6)
+			var->green.length = 6;
+		break;
+	case 24:
+		var->red.length = 8;
+		var->blue.length = 8;
+		var->green.length = 8;
+		break;
+	case 32:
+		var->red.length = 8;
+		var->green.length = 8;
+		var->blue.length = 8;
+		var->transp.length = 8;
+		break;
+	default:
+		ret = -EINVAL;
+		break;
+	}
+
+	/*
+	 * >= 16bpp displays have separate colour component bitfields
+	 * encoded in the pixel data.  Calculate their position from
+	 * the bitfield length defined above.
+	 */
+	if (ret == 0 && var->bits_per_pixel >= 24 && fbswap) {
+		var->blue.offset = 0;
+		var->green.offset = var->blue.offset + var->blue.length;
+		var->red.offset = var->green.offset + var->green.length;
+		var->transp.offset = var->red.offset + var->red.length;
+	} else if (ret == 0 && var->bits_per_pixel >= 24) {
+		var->red.offset = 0;
+		var->green.offset = var->red.offset + var->red.length;
+		var->blue.offset = var->green.offset + var->green.length;
+		var->transp.offset = var->blue.offset + var->blue.length;
+	} else if (ret == 0 && var->bits_per_pixel >= 16) {
+		var->blue.offset = 0;
+		var->green.offset = var->blue.offset + var->blue.length;
+		var->red.offset = var->green.offset + var->green.length;
+		var->transp.offset = var->red.offset + var->red.length;
+	}
+
+	return ret;
+}
+
+static int bcm2708_fb_check_var(struct fb_var_screeninfo *var,
+				struct fb_info *info)
+{
+	/* info input, var output */
+	print_debug("%s(%p) %dx%d (%dx%d), %d, %d\n",
+		__func__,
+		info,
+		info->var.xres, info->var.yres, info->var.xres_virtual,
+		info->var.yres_virtual, (int)info->screen_size,
+		info->var.bits_per_pixel);
+	print_debug("%s(%p) %dx%d (%dx%d), %d\n", __func__, var,
+		var->xres, var->yres, var->xres_virtual, var->yres_virtual,
+		var->bits_per_pixel);
+
+	if (!var->bits_per_pixel)
+		var->bits_per_pixel = 16;
+
+	if (bcm2708_fb_set_bitfields(var) != 0) {
+		pr_err("%s: invalid bits_per_pixel %d\n", __func__,
+		     var->bits_per_pixel);
+		return -EINVAL;
+	}
+
+
+	if (var->xres_virtual < var->xres)
+		var->xres_virtual = var->xres;
+	/* use highest possible virtual resolution */
+	if (var->yres_virtual == -1) {
+		var->yres_virtual = 480;
+
+		pr_err("%s: virtual resolution set to maximum of %dx%d\n",
+		     __func__, var->xres_virtual, var->yres_virtual);
+	}
+	if (var->yres_virtual < var->yres)
+		var->yres_virtual = var->yres;
+
+	if (var->xoffset < 0)
+		var->xoffset = 0;
+	if (var->yoffset < 0)
+		var->yoffset = 0;
+
+	/* truncate xoffset and yoffset to maximum if too high */
+	if (var->xoffset > var->xres_virtual - var->xres)
+		var->xoffset = var->xres_virtual - var->xres - 1;
+	if (var->yoffset > var->yres_virtual - var->yres)
+		var->yoffset = var->yres_virtual - var->yres - 1;
+
+	return 0;
+}
+
+static int bcm2708_fb_set_par(struct fb_info *info)
+{
+	struct bcm2708_fb *fb = to_bcm2708(info);
+	struct fb_alloc_tags fbinfo = {
+		.tag1 = { RPI_FIRMWARE_FRAMEBUFFER_SET_PHYSICAL_WIDTH_HEIGHT,
+			  8, 0, },
+			.xres = info->var.xres,
+			.yres = info->var.yres,
+		.tag2 = { RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_WIDTH_HEIGHT,
+			  8, 0, },
+			.xres_virtual = info->var.xres_virtual,
+			.yres_virtual = info->var.yres_virtual,
+		.tag3 = { RPI_FIRMWARE_FRAMEBUFFER_SET_DEPTH, 4, 0 },
+			.bpp = info->var.bits_per_pixel,
+		.tag4 = { RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_OFFSET, 8, 0 },
+			.xoffset = info->var.xoffset,
+			.yoffset = info->var.yoffset,
+		.tag5 = { RPI_FIRMWARE_FRAMEBUFFER_ALLOCATE, 8, 0 },
+			.base = 0,
+			.screen_size = 0,
+		.tag6 = { RPI_FIRMWARE_FRAMEBUFFER_GET_PITCH, 4, 0 },
+			.pitch = 0,
+	};
+	int ret;
+
+	print_debug("%s(%p) %dx%d (%dx%d), %d, %d\n", __func__, info,
+		info->var.xres, info->var.yres, info->var.xres_virtual,
+		info->var.yres_virtual, (int)info->screen_size,
+		info->var.bits_per_pixel);
+
+	ret = rpi_firmware_property_list(fb->fw, &fbinfo, sizeof(fbinfo));
+	if (ret) {
+		dev_err(info->device,
+			"Failed to allocate GPU framebuffer (%d)\n", ret);
+		return ret;
+	}
+
+	if (info->var.bits_per_pixel <= 8)
+		fb->fb.fix.visual = FB_VISUAL_PSEUDOCOLOR;
+	else
+		fb->fb.fix.visual = FB_VISUAL_TRUECOLOR;
+
+	fb->fb.fix.line_length = fbinfo.pitch;
+	fbinfo.base |= 0x40000000;
+	fb->fb_bus_address = fbinfo.base;
+	fbinfo.base &= ~0xc0000000;
+	fb->fb.fix.smem_start = fbinfo.base;
+	fb->fb.fix.smem_len = fbinfo.pitch * fbinfo.yres_virtual;
+	fb->fb.screen_size = fbinfo.screen_size;
+	if (fb->fb.screen_base)
+		iounmap(fb->fb.screen_base);
+	fb->fb.screen_base = ioremap_wc(fbinfo.base, fb->fb.screen_size);
+	if (!fb->fb.screen_base) {
+		/* the console may currently be locked */
+		console_trylock();
+		console_unlock();
+		dev_err(info->device, "Failed to set screen_base\n");
+		return -ENOMEM;
+	}
+
+	print_debug(
+	  "%s: start = %p,%p width=%d, height=%d, bpp=%d, pitch=%d size=%d\n",
+	  __func__,
+	  (void *)fb->fb.screen_base, (void *)fb->fb_bus_address,
+	  fbinfo.xres, fbinfo.yres, fbinfo.bpp,
+	  fbinfo.pitch, (int)fb->fb.screen_size);
+
+	return 0;
+}
+
+static inline u32 convert_bitfield(int val, struct fb_bitfield *bf)
+{
+	unsigned int mask = (1 << bf->length) - 1;
+
+	return (val >> (16 - bf->length) & mask) << bf->offset;
+}
+
+
+static int bcm2708_fb_setcolreg(unsigned int regno, unsigned int red,
+				unsigned int green, unsigned int blue,
+				unsigned int transp, struct fb_info *info)
+{
+	struct bcm2708_fb *fb = to_bcm2708(info);
+
+	if (fb->fb.var.bits_per_pixel <= 8) {
+		if (regno < 256) {
+			/* blue [23:16], green [15:8], red [7:0] */
+			fb->gpu_cmap[regno] = ((red   >> 8) & 0xff) << 0 |
+					      ((green >> 8) & 0xff) << 8 |
+					      ((blue  >> 8) & 0xff) << 16;
+		}
+		/* Hack: we need to tell GPU the palette has changed, but
+		 * currently bcm2708_fb_set_par takes noticeable time when
+		 * called for every (256) colour
+		 * So just call it for what looks like the last colour in a
+		 * list for now.
+		 */
+		if (regno == 15 || regno == 255) {
+			struct packet {
+				u32 offset;
+				u32 length;
+				u32 cmap[256];
+			} *packet;
+			int ret;
+
+			packet = kmalloc(sizeof(*packet), GFP_KERNEL);
+			if (!packet)
+				return -ENOMEM;
+			packet->offset = 0;
+			packet->length = regno + 1;
+			memcpy(packet->cmap, fb->gpu_cmap,
+				sizeof(packet->cmap));
+			ret = rpi_firmware_property(fb->fw,
+					RPI_FIRMWARE_FRAMEBUFFER_SET_PALETTE,
+					packet,
+					(2 + packet->length) * sizeof(u32));
+			if (ret || packet->offset)
+				dev_err(info->device,
+					"Failed to set palette (%d,%u)\n",
+					ret, packet->offset);
+			kfree(packet);
+		}
+	} else if (regno < 16) {
+		fb->cmap[regno] = convert_bitfield(transp, &fb->fb.var.transp) |
+		convert_bitfield(blue, &fb->fb.var.blue) |
+		convert_bitfield(green, &fb->fb.var.green) |
+		convert_bitfield(red, &fb->fb.var.red);
+	}
+	return regno > 255;
+}
+
+static int bcm2708_fb_blank(int blank_mode, struct fb_info *info)
+{
+	struct bcm2708_fb *fb = to_bcm2708(info);
+	u32 value;
+	int ret;
+
+	switch (blank_mode) {
+	case FB_BLANK_UNBLANK:
+		value = 0;
+		break;
+	case FB_BLANK_NORMAL:
+	case FB_BLANK_VSYNC_SUSPEND:
+	case FB_BLANK_HSYNC_SUSPEND:
+	case FB_BLANK_POWERDOWN:
+		value = 1;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	ret = rpi_firmware_property(fb->fw, RPI_FIRMWARE_FRAMEBUFFER_BLANK,
+				    &value, sizeof(value));
+	if (ret)
+		dev_err(info->device, "%s(%d) failed: %d\n", __func__,
+			blank_mode, ret);
+
+	return ret;
+}
+
+static int bcm2708_fb_pan_display(struct fb_var_screeninfo *var,
+				  struct fb_info *info)
+{
+	s32 result;
+
+	info->var.xoffset = var->xoffset;
+	info->var.yoffset = var->yoffset;
+	result = bcm2708_fb_set_par(info);
+	if (result != 0)
+		pr_err("%s(%d,%d) returns=%d\n", __func__,
+			var->xoffset, var->yoffset, result);
+	return result;
+}
+
+static void dma_memcpy(struct bcm2708_fb *fb, dma_addr_t dst, dma_addr_t src,
+		       int size)
+{
+	int burst_size = (fb->dma_chan == 0) ? 8 : 2;
+	struct bcm2708_dma_cb *cb = fb->cb_base;
+
+	cb->info = BCM2708_DMA_BURST(burst_size) | BCM2708_DMA_S_WIDTH |
+		   BCM2708_DMA_S_INC | BCM2708_DMA_D_WIDTH |
+		   BCM2708_DMA_D_INC;
+	cb->dst = dst;
+	cb->src = src;
+	cb->length = size;
+	cb->stride = 0;
+	cb->pad[0] = 0;
+	cb->pad[1] = 0;
+	cb->next = 0;
+
+	if (size < dma_busy_wait_threshold) {
+		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
+		bcm_dma_wait_idle(fb->dma_chan_base);
+	} else {
+		void __iomem *dma_chan = fb->dma_chan_base;
+
+		cb->info |= BCM2708_DMA_INT_EN;
+		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
+		while (bcm_dma_is_busy(dma_chan)) {
+			wait_event_interruptible(
+				fb->dma_waitq,
+				!bcm_dma_is_busy(dma_chan));
+		}
+		fb->stats.dma_irqs++;
+	}
+	fb->stats.dma_copies++;
+}
+
+/* address with no aliases */
+#define INTALIAS_NORMAL(x) ((x)&~0xc0000000)
+/* cache coherent but non-allocating in L1 and L2 */
+#define INTALIAS_L1L2_NONALLOCATING(x) (((x)&~0xc0000000)|0x80000000)
+
+static long vc_mem_copy(struct bcm2708_fb *fb, unsigned long arg)
+{
+	struct fb_dmacopy ioparam;
+	size_t size = PAGE_SIZE;
+	u32 *buf = NULL;
+	dma_addr_t bus_addr;
+	long rc = 0;
+	size_t offset;
+
+	/* restrict this to root user */
+	if (!uid_eq(current_euid(), GLOBAL_ROOT_UID)) {
+		rc = -EFAULT;
+		goto out;
+	}
+
+	/* Get the parameter data.
+	 */
+	if (copy_from_user
+	    (&ioparam, (void *)arg, sizeof(ioparam)) != 0) {
+		pr_err("[%s]: failed to copy-from-user\n",
+				__func__);
+		rc = -EFAULT;
+		goto out;
+	}
+
+	if (fb->gpu.base == 0 || fb->gpu.length == 0) {
+		pr_err("[%s]: Unable to determine gpu memory (%x,%x)\n",
+			__func__, fb->gpu.base, fb->gpu.length);
+		return -EFAULT;
+	}
+
+	if (INTALIAS_NORMAL(ioparam.src) < fb->gpu.base ||
+		INTALIAS_NORMAL(ioparam.src) >= fb->gpu.base + fb->gpu.length) {
+		pr_err("[%s]: Invalid memory access %x (%x-%x)", __func__,
+			INTALIAS_NORMAL(ioparam.src), fb->gpu.base,
+			fb->gpu.base + fb->gpu.length);
+		return -EFAULT;
+	}
+
+	buf = dma_alloc_coherent(fb->fb.device, PAGE_ALIGN(size), &bus_addr,
+				 GFP_ATOMIC);
+	if (!buf) {
+		pr_err("[%s]: failed to dma_alloc_coherent(%d)\n",
+				__func__, size);
+		rc = -ENOMEM;
+		goto out;
+	}
+
+	for (offset = 0; offset < ioparam.length; offset += size) {
+		size_t remaining = ioparam.length - offset;
+		size_t s = min(size, remaining);
+		unsigned char *p = (unsigned char *)ioparam.src + offset;
+		unsigned char *q = (unsigned char *)ioparam.dst + offset;
+
+		dma_memcpy(fb, bus_addr,
+			   INTALIAS_L1L2_NONALLOCATING((dma_addr_t)p), size);
+		if (copy_to_user(q, buf, s) != 0) {
+			pr_err("[%s]: failed to copy-to-user\n",
+					__func__);
+			rc = -EFAULT;
+			goto out;
+		}
+	}
+out:
+	if (buf)
+		dma_free_coherent(fb->fb.device, PAGE_ALIGN(size), buf,
+				  bus_addr);
+	return rc;
+}
+
+static int bcm2708_ioctl(struct fb_info *info, unsigned int cmd,
+			 unsigned long arg)
+{
+	struct bcm2708_fb *fb = to_bcm2708(info);
+	u32 dummy = 0;
+	int ret;
+
+	switch (cmd) {
+	case FBIO_WAITFORVSYNC:
+		ret = rpi_firmware_property(fb->fw,
+					    RPI_FIRMWARE_FRAMEBUFFER_SET_VSYNC,
+					    &dummy, sizeof(dummy));
+		break;
+	case FBIODMACOPY:
+		ret = vc_mem_copy(fb, arg);
+		break;
+	default:
+		dev_dbg(info->device, "Unknown ioctl 0x%x\n", cmd);
+		return -ENOTTY;
+	}
+
+	if (ret)
+		dev_err(info->device, "ioctl 0x%x failed (%d)\n", cmd, ret);
+
+	return ret;
+}
+static void bcm2708_fb_fillrect(struct fb_info *info,
+				const struct fb_fillrect *rect)
+{
+	/* (is called) print_debug("bcm2708_fb_fillrect\n"); */
+	cfb_fillrect(info, rect);
+}
+
+/* A helper function for configuring dma control block */
+static void set_dma_cb(struct bcm2708_dma_cb *cb,
+		       int        burst_size,
+		       dma_addr_t dst,
+		       int        dst_stride,
+		       dma_addr_t src,
+		       int        src_stride,
+		       int        w,
+		       int        h)
+{
+	cb->info = BCM2708_DMA_BURST(burst_size) | BCM2708_DMA_S_WIDTH |
+		   BCM2708_DMA_S_INC | BCM2708_DMA_D_WIDTH |
+		   BCM2708_DMA_D_INC | BCM2708_DMA_TDMODE;
+	cb->dst = dst;
+	cb->src = src;
+	/*
+	 * This is not really obvious from the DMA documentation,
+	 * but the top 16 bits must be programmmed to "height -1"
+	 * and not "height" in 2D mode.
+	 */
+	cb->length = ((h - 1) << 16) | w;
+	cb->stride = ((dst_stride - w) << 16) | (u16)(src_stride - w);
+	cb->pad[0] = 0;
+	cb->pad[1] = 0;
+}
+
+static void bcm2708_fb_copyarea(struct fb_info *info,
+				const struct fb_copyarea *region)
+{
+	struct bcm2708_fb *fb = to_bcm2708(info);
+	struct bcm2708_dma_cb *cb = fb->cb_base;
+	int bytes_per_pixel = (info->var.bits_per_pixel + 7) >> 3;
+
+	/* Channel 0 supports larger bursts and is a bit faster */
+	int burst_size = (fb->dma_chan == 0) ? 8 : 2;
+	int pixels = region->width * region->height;
+
+	/* Fallback to cfb_copyarea() if we don't like something */
+	if (bytes_per_pixel > 4 ||
+	    info->var.xres * info->var.yres > 1920 * 1200 ||
+	    region->width <= 0 || region->width > info->var.xres ||
+	    region->height <= 0 || region->height > info->var.yres ||
+	    region->sx < 0 || region->sx >= info->var.xres ||
+	    region->sy < 0 || region->sy >= info->var.yres ||
+	    region->dx < 0 || region->dx >= info->var.xres ||
+	    region->dy < 0 || region->dy >= info->var.yres ||
+	    region->sx + region->width > info->var.xres ||
+	    region->dx + region->width > info->var.xres ||
+	    region->sy + region->height > info->var.yres ||
+	    region->dy + region->height > info->var.yres) {
+		cfb_copyarea(info, region);
+		return;
+	}
+
+	if (region->dy == region->sy && region->dx > region->sx) {
+		/*
+		 * A difficult case of overlapped copy. Because DMA can't
+		 * copy individual scanlines in backwards direction, we need
+		 * two-pass processing. We do it by programming a chain of dma
+		 * control blocks in the first 16K part of the buffer and use
+		 * the remaining 48K as the intermediate temporary scratch
+		 * buffer. The buffer size is sufficient to handle up to
+		 * 1920x1200 resolution at 32bpp pixel depth.
+		 */
+		int y;
+		dma_addr_t control_block_pa = fb->cb_handle;
+		dma_addr_t scratchbuf = fb->cb_handle + 16 * 1024;
+		int scanline_size = bytes_per_pixel * region->width;
+		int scanlines_per_cb = (64 * 1024 - 16 * 1024) / scanline_size;
+
+		for (y = 0; y < region->height; y += scanlines_per_cb) {
+			dma_addr_t src =
+				fb->fb_bus_address +
+				bytes_per_pixel * region->sx +
+				(region->sy + y) * fb->fb.fix.line_length;
+			dma_addr_t dst =
+				fb->fb_bus_address +
+				bytes_per_pixel * region->dx +
+				(region->dy + y) * fb->fb.fix.line_length;
+
+			if (region->height - y < scanlines_per_cb)
+				scanlines_per_cb = region->height - y;
+
+			set_dma_cb(cb, burst_size, scratchbuf, scanline_size,
+				   src, fb->fb.fix.line_length,
+				   scanline_size, scanlines_per_cb);
+			control_block_pa += sizeof(struct bcm2708_dma_cb);
+			cb->next = control_block_pa;
+			cb++;
+
+			set_dma_cb(cb, burst_size, dst, fb->fb.fix.line_length,
+				   scratchbuf, scanline_size,
+				   scanline_size, scanlines_per_cb);
+			control_block_pa += sizeof(struct bcm2708_dma_cb);
+			cb->next = control_block_pa;
+			cb++;
+		}
+		/* move the pointer back to the last dma control block */
+		cb--;
+	} else {
+		/* A single dma control block is enough. */
+		int sy, dy, stride;
+
+		if (region->dy <= region->sy) {
+			/* processing from top to bottom */
+			dy = region->dy;
+			sy = region->sy;
+			stride = fb->fb.fix.line_length;
+		} else {
+			/* processing from bottom to top */
+			dy = region->dy + region->height - 1;
+			sy = region->sy + region->height - 1;
+			stride = -fb->fb.fix.line_length;
+		}
+		set_dma_cb(cb, burst_size,
+			   fb->fb_bus_address + dy * fb->fb.fix.line_length +
+						   bytes_per_pixel * region->dx,
+			   stride,
+			   fb->fb_bus_address + sy * fb->fb.fix.line_length +
+						   bytes_per_pixel * region->sx,
+			   stride,
+			   region->width * bytes_per_pixel,
+			   region->height);
+	}
+
+	/* end of dma control blocks chain */
+	cb->next = 0;
+
+
+	if (pixels < dma_busy_wait_threshold) {
+		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
+		bcm_dma_wait_idle(fb->dma_chan_base);
+	} else {
+		void __iomem *dma_chan = fb->dma_chan_base;
+
+		cb->info |= BCM2708_DMA_INT_EN;
+		bcm_dma_start(fb->dma_chan_base, fb->cb_handle);
+		while (bcm_dma_is_busy(dma_chan)) {
+			wait_event_interruptible(
+				fb->dma_waitq,
+				!bcm_dma_is_busy(dma_chan));
+		}
+		fb->stats.dma_irqs++;
+	}
+	fb->stats.dma_copies++;
+}
+
+static void bcm2708_fb_imageblit(struct fb_info *info,
+				 const struct fb_image *image)
+{
+	/* (is called) print_debug("bcm2708_fb_imageblit\n"); */
+	cfb_imageblit(info, image);
+}
+
+static irqreturn_t bcm2708_fb_dma_irq(int irq, void *cxt)
+{
+	struct bcm2708_fb *fb = cxt;
+
+	/* FIXME: should read status register to check if this is
+	 * actually interrupting us or not, in case this interrupt
+	 * ever becomes shared amongst several DMA channels
+	 *
+	 * readl(dma_chan_base + BCM2708_DMA_CS) & BCM2708_DMA_IRQ;
+	 */
+
+	/* acknowledge the interrupt */
+	writel(BCM2708_DMA_INT, fb->dma_chan_base + BCM2708_DMA_CS);
+
+	wake_up(&fb->dma_waitq);
+	return IRQ_HANDLED;
+}
+
+static struct fb_ops bcm2708_fb_ops = {
+	.owner = THIS_MODULE,
+	.fb_check_var = bcm2708_fb_check_var,
+	.fb_set_par = bcm2708_fb_set_par,
+	.fb_setcolreg = bcm2708_fb_setcolreg,
+	.fb_blank = bcm2708_fb_blank,
+	.fb_fillrect = bcm2708_fb_fillrect,
+	.fb_copyarea = bcm2708_fb_copyarea,
+	.fb_imageblit = bcm2708_fb_imageblit,
+	.fb_pan_display = bcm2708_fb_pan_display,
+	.fb_ioctl = bcm2708_ioctl,
+};
+
+static int bcm2708_fb_register(struct bcm2708_fb *fb)
+{
+	int ret;
+
+	fb->fb.fbops = &bcm2708_fb_ops;
+	fb->fb.flags = FBINFO_FLAG_DEFAULT | FBINFO_HWACCEL_COPYAREA;
+	fb->fb.pseudo_palette = fb->cmap;
+
+	strncpy(fb->fb.fix.id, bcm2708_name, sizeof(fb->fb.fix.id));
+	fb->fb.fix.type = FB_TYPE_PACKED_PIXELS;
+	fb->fb.fix.type_aux = 0;
+	fb->fb.fix.xpanstep = 1;
+	fb->fb.fix.ypanstep = 1;
+	fb->fb.fix.ywrapstep = 0;
+	fb->fb.fix.accel = FB_ACCEL_NONE;
+
+	fb->fb.var.xres = fbwidth;
+	fb->fb.var.yres = fbheight;
+	fb->fb.var.xres_virtual = fbwidth;
+	fb->fb.var.yres_virtual = fbheight;
+	fb->fb.var.bits_per_pixel = fbdepth;
+	fb->fb.var.vmode = FB_VMODE_NONINTERLACED;
+	fb->fb.var.activate = FB_ACTIVATE_NOW;
+	fb->fb.var.nonstd = 0;
+	fb->fb.var.height = -1;		/* height of picture in mm    */
+	fb->fb.var.width = -1;		/* width of picture in mm    */
+	fb->fb.var.accel_flags = 0;
+
+	fb->fb.monspecs.hfmin = 0;
+	fb->fb.monspecs.hfmax = 100000;
+	fb->fb.monspecs.vfmin = 0;
+	fb->fb.monspecs.vfmax = 400;
+	fb->fb.monspecs.dclkmin = 1000000;
+	fb->fb.monspecs.dclkmax = 100000000;
+
+	bcm2708_fb_set_bitfields(&fb->fb.var);
+	init_waitqueue_head(&fb->dma_waitq);
+
+	/*
+	 * Allocate colourmap.
+	 */
+
+	fb_set_var(&fb->fb, &fb->fb.var);
+	ret = bcm2708_fb_set_par(&fb->fb);
+	if (ret)
+		return ret;
+
+	print_debug("BCM2708FB: registering framebuffer (%dx%d@%d) (%d)\n",
+		fbwidth, fbheight, fbdepth, fbswap);
+
+	ret = register_framebuffer(&fb->fb);
+	print_debug("BCM2708FB: register framebuffer (%d)\n", ret);
+	if (ret == 0)
+		goto out;
+
+	print_debug("BCM2708FB: cannot register framebuffer (%d)\n", ret);
+out:
+	return ret;
+}
+
+static int bcm2708_fb_probe(struct platform_device *dev)
+{
+	struct device_node *fw_np;
+	struct rpi_firmware *fw;
+	struct bcm2708_fb *fb;
+	int ret;
+
+	fw_np = of_parse_phandle(dev->dev.of_node, "firmware", 0);
+/* Remove comment when booting without Device Tree is no longer supported
+ *	if (!fw_np) {
+ *		dev_err(&dev->dev, "Missing firmware node\n");
+ *		return -ENOENT;
+ *	}
+ */
+	fw = rpi_firmware_get(fw_np);
+	if (!fw)
+		return -EPROBE_DEFER;
+
+	fb = kzalloc(sizeof(struct bcm2708_fb), GFP_KERNEL);
+	if (!fb) {
+		ret = -ENOMEM;
+		goto free_region;
+	}
+
+	fb->fw = fw;
+	bcm2708_fb_debugfs_init(fb);
+
+	fb->cb_base = dma_alloc_writecombine(&dev->dev, SZ_64K,
+					     &fb->cb_handle, GFP_KERNEL);
+	if (!fb->cb_base) {
+		dev_err(&dev->dev, "cannot allocate DMA CBs\n");
+		ret = -ENOMEM;
+		goto free_fb;
+	}
+
+	pr_info("BCM2708FB: allocated DMA memory %08x\n",
+	       fb->cb_handle);
+
+	ret = bcm_dma_chan_alloc(BCM_DMA_FEATURE_BULK,
+				 &fb->dma_chan_base, &fb->dma_irq);
+	if (ret < 0) {
+		dev_err(&dev->dev, "couldn't allocate a DMA channel\n");
+		goto free_cb;
+	}
+	fb->dma_chan = ret;
+
+	ret = request_irq(fb->dma_irq, bcm2708_fb_dma_irq,
+			  0, "bcm2708_fb dma", fb);
+	if (ret) {
+		pr_err("%s: failed to request DMA irq\n", __func__);
+		goto free_dma_chan;
+	}
+
+
+	pr_info("BCM2708FB: allocated DMA channel %d @ %p\n",
+	       fb->dma_chan, fb->dma_chan_base);
+
+	fb->dev = dev;
+	fb->fb.device = &dev->dev;
+
+	/* failure here isn't fatal, but we'll fail in vc_mem_copy if
+	 * fb->gpu is not valid
+	 */
+	rpi_firmware_property(fb->fw,
+				    RPI_FIRMWARE_GET_VC_MEMORY,
+				    &fb->gpu, sizeof(fb->gpu));
+
+	ret = bcm2708_fb_register(fb);
+	if (ret == 0) {
+		platform_set_drvdata(dev, fb);
+		goto out;
+	}
+
+free_dma_chan:
+	bcm_dma_chan_free(fb->dma_chan);
+free_cb:
+	dma_free_writecombine(&dev->dev, SZ_64K, fb->cb_base, fb->cb_handle);
+free_fb:
+	kfree(fb);
+free_region:
+	dev_err(&dev->dev, "probe failed, err %d\n", ret);
+out:
+	return ret;
+}
+
+static int bcm2708_fb_remove(struct platform_device *dev)
+{
+	struct bcm2708_fb *fb = platform_get_drvdata(dev);
+
+	platform_set_drvdata(dev, NULL);
+
+	if (fb->fb.screen_base)
+		iounmap(fb->fb.screen_base);
+	unregister_framebuffer(&fb->fb);
+
+	dma_free_writecombine(&dev->dev, SZ_64K, fb->cb_base, fb->cb_handle);
+	bcm_dma_chan_free(fb->dma_chan);
+
+	bcm2708_fb_debugfs_deinit(fb);
+
+	free_irq(fb->dma_irq, fb);
+
+	kfree(fb);
+
+	return 0;
+}
+
+static const struct of_device_id bcm2708_fb_of_match_table[] = {
+	{ .compatible = "brcm,bcm2708-fb", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, bcm2708_fb_of_match_table);
+
+static struct platform_driver bcm2708_fb_driver = {
+	.probe = bcm2708_fb_probe,
+	.remove = bcm2708_fb_remove,
+	.driver = {
+		   .name = DRIVER_NAME,
+		   .owner = THIS_MODULE,
+		   .of_match_table = bcm2708_fb_of_match_table,
+		   },
+};
+
+static int __init bcm2708_fb_init(void)
+{
+	return platform_driver_register(&bcm2708_fb_driver);
+}
+
+module_init(bcm2708_fb_init);
+
+static void __exit bcm2708_fb_exit(void)
+{
+	platform_driver_unregister(&bcm2708_fb_driver);
+}
+
+module_exit(bcm2708_fb_exit);
+
+module_param(fbwidth, int, 0644);
+module_param(fbheight, int, 0644);
+module_param(fbdepth, int, 0644);
+module_param(fbswap, int, 0644);
+
+MODULE_DESCRIPTION("BCM2708 framebuffer driver");
+MODULE_LICENSE("GPL");
+
+MODULE_PARM_DESC(fbwidth, "Width of ARM Framebuffer");
+MODULE_PARM_DESC(fbheight, "Height of ARM Framebuffer");
+MODULE_PARM_DESC(fbdepth, "Bit depth of ARM Framebuffer");
+MODULE_PARM_DESC(fbswap, "Swap order of red and blue in 24 and 32 bit modes");
diff --git a/drivers/video/fbdev/core/cfbimgblt.c b/drivers/video/fbdev/core/cfbimgblt.c
index a2bb276a8b24..436494fba15a 100644
--- a/drivers/video/fbdev/core/cfbimgblt.c
+++ b/drivers/video/fbdev/core/cfbimgblt.c
@@ -28,6 +28,11 @@
  *
  *  Also need to add code to deal with cards endians that are different than
  *  the native cpu endians. I also need to deal with MSB position in the word.
+ *  Modified by Harm Hanemaaijer (fgenfb@yahoo.com) 2013:
+ *  - Provide optimized versions of fast_imageblit for 16 and 32bpp that are
+ *    significantly faster than the previous implementation.
+ *  - Simplify the fast/slow_imageblit selection code, avoiding integer
+ *    divides.
  */
 #include <linux/module.h>
 #include <linux/string.h>
@@ -262,6 +267,133 @@ static inline void fast_imageblit(const struct fb_image *image, struct fb_info *
 	}
 }	
 	
+/*
+ * Optimized fast_imageblit for bpp == 16. ppw = 2, bit_mask = 3 folded
+ * into the code, main loop unrolled.
+ */
+
+static inline void fast_imageblit16(const struct fb_image *image,
+				    struct fb_info *p, u8 __iomem * dst1,
+				    u32 fgcolor, u32 bgcolor)
+{
+	u32 fgx = fgcolor, bgx = bgcolor;
+	u32 spitch = (image->width + 7) / 8;
+	u32 end_mask, eorx;
+	const char *s = image->data, *src;
+	u32 __iomem *dst;
+	const u32 *tab = NULL;
+	int i, j, k;
+
+	tab = fb_be_math(p) ? cfb_tab16_be : cfb_tab16_le;
+
+	fgx <<= 16;
+	bgx <<= 16;
+	fgx |= fgcolor;
+	bgx |= bgcolor;
+
+	eorx = fgx ^ bgx;
+	k = image->width / 2;
+
+	for (i = image->height; i--;) {
+		dst = (u32 __iomem *) dst1;
+		src = s;
+
+		j = k;
+		while (j >= 4) {
+			u8 bits = *src;
+			end_mask = tab[(bits >> 6) & 3];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[(bits >> 4) & 3];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[(bits >> 2) & 3];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[bits & 3];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			src++;
+			j -= 4;
+		}
+		if (j != 0) {
+			u8 bits = *src;
+			end_mask = tab[(bits >> 6) & 3];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			if (j >= 2) {
+				end_mask = tab[(bits >> 4) & 3];
+				FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+				if (j == 3) {
+					end_mask = tab[(bits >> 2) & 3];
+					FB_WRITEL((end_mask & eorx) ^ bgx, dst);
+				}
+			}
+		}
+		dst1 += p->fix.line_length;
+		s += spitch;
+	}
+}
+
+/*
+ * Optimized fast_imageblit for bpp == 32. ppw = 1, bit_mask = 1 folded
+ * into the code, main loop unrolled.
+ */
+
+static inline void fast_imageblit32(const struct fb_image *image,
+				    struct fb_info *p, u8 __iomem * dst1,
+				    u32 fgcolor, u32 bgcolor)
+{
+	u32 fgx = fgcolor, bgx = bgcolor;
+	u32 spitch = (image->width + 7) / 8;
+	u32 end_mask, eorx;
+	const char *s = image->data, *src;
+	u32 __iomem *dst;
+	const u32 *tab = NULL;
+	int i, j, k;
+
+	tab = cfb_tab32;
+
+	eorx = fgx ^ bgx;
+	k = image->width;
+
+	for (i = image->height; i--;) {
+		dst = (u32 __iomem *) dst1;
+		src = s;
+
+		j = k;
+		while (j >= 8) {
+			u8 bits = *src;
+			end_mask = tab[(bits >> 7) & 1];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[(bits >> 6) & 1];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[(bits >> 5) & 1];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[(bits >> 4) & 1];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[(bits >> 3) & 1];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[(bits >> 2) & 1];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[(bits >> 1) & 1];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			end_mask = tab[bits & 1];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+			src++;
+			j -= 8;
+		}
+		if (j != 0) {
+			u32 bits = (u32) * src;
+			while (j > 1) {
+				end_mask = tab[(bits >> 7) & 1];
+				FB_WRITEL((end_mask & eorx) ^ bgx, dst++);
+				bits <<= 1;
+				j--;
+			}
+			end_mask = tab[(bits >> 7) & 1];
+			FB_WRITEL((end_mask & eorx) ^ bgx, dst);
+		}
+		dst1 += p->fix.line_length;
+		s += spitch;
+	}
+}
+
 void cfb_imageblit(struct fb_info *p, const struct fb_image *image)
 {
 	u32 fgcolor, bgcolor, start_index, bitstart, pitch_index = 0;
@@ -294,11 +426,21 @@ void cfb_imageblit(struct fb_info *p, const struct fb_image *image)
 			bgcolor = image->bg_color;
 		}	
 		
-		if (32 % bpp == 0 && !start_index && !pitch_index && 
-		    ((width & (32/bpp-1)) == 0) &&
-		    bpp >= 8 && bpp <= 32) 			
-			fast_imageblit(image, p, dst1, fgcolor, bgcolor);
-		else 
+		if (!start_index && !pitch_index) {
+			if (bpp == 32)
+				fast_imageblit32(image, p, dst1, fgcolor,
+						 bgcolor);
+			else if (bpp == 16 && (width & 1) == 0)
+				fast_imageblit16(image, p, dst1, fgcolor,
+						 bgcolor);
+			else if (bpp == 8 && (width & 3) == 0)
+				fast_imageblit(image, p, dst1, fgcolor,
+					       bgcolor);
+			else
+				slow_imageblit(image, p, dst1, fgcolor,
+					       bgcolor,
+					       start_index, pitch_index);
+		} else
 			slow_imageblit(image, p, dst1, fgcolor, bgcolor,
 					start_index, pitch_index);
 	} else
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index f741ba8df01b..be8c43d62698 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -1086,6 +1086,31 @@ fb_blank(struct fb_info *info, int blank)
 }
 EXPORT_SYMBOL(fb_blank);
 
+static int fb_copyarea_user(struct fb_info *info,
+			    struct fb_copyarea *copy)
+{
+	int ret = 0;
+	if (!lock_fb_info(info))
+		return -ENODEV;
+	if (copy->dx >= info->var.xres ||
+	    copy->sx >= info->var.xres ||
+	    copy->width > info->var.xres ||
+	    copy->dy >= info->var.yres ||
+	    copy->sy >= info->var.yres ||
+	    copy->height > info->var.yres ||
+	    copy->dx + copy->width > info->var.xres ||
+	    copy->sx + copy->width > info->var.xres ||
+	    copy->dy + copy->height > info->var.yres ||
+	    copy->sy + copy->height > info->var.yres) {
+		ret = -EINVAL;
+		goto out;
+	}
+	info->fbops->fb_copyarea(info, copy);
+out:
+	unlock_fb_info(info);
+	return ret;
+}
+
 static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
 			unsigned long arg)
 {
@@ -1096,6 +1121,7 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
 	struct fb_cmap cmap_from;
 	struct fb_cmap_user cmap;
 	struct fb_event event;
+	struct fb_copyarea copy;
 	void __user *argp = (void __user *)arg;
 	long ret = 0;
 
@@ -1213,6 +1239,15 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
 		unlock_fb_info(info);
 		console_unlock();
 		break;
+	case FBIOCOPYAREA:
+		if (info->flags & FBINFO_HWACCEL_COPYAREA) {
+			/* only provide this ioctl if it is accelerated */
+			if (copy_from_user(&copy, argp, sizeof(copy)))
+				return -EFAULT;
+			ret = fb_copyarea_user(info, &copy);
+			break;
+		}
+		/* fall through */
 	default:
 		if (!lock_fb_info(info))
 			return -ENODEV;
@@ -1358,6 +1393,7 @@ static long fb_compat_ioctl(struct file *file, unsigned int cmd,
 	case FBIOPAN_DISPLAY:
 	case FBIOGET_CON2FBMAP:
 	case FBIOPUT_CON2FBMAP:
+	case FBIOCOPYAREA:
 		arg = (unsigned long) compat_ptr(arg);
 	case FBIOBLANK:
 		ret = do_fb_ioctl(info, cmd, arg);
diff --git a/drivers/video/fbdev/rpisense-fb.c b/drivers/video/fbdev/rpisense-fb.c
new file mode 100644
index 000000000000..26432a5a0b4b
--- /dev/null
+++ b/drivers/video/fbdev/rpisense-fb.c
@@ -0,0 +1,293 @@
+/*
+ * Raspberry Pi Sense HAT framebuffer driver
+ * http://raspberrypi.org
+ *
+ * Copyright (C) 2015 Raspberry Pi
+ *
+ * Author: Serge Schneider
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include <linux/delay.h>
+#include <linux/fb.h>
+#include <linux/init.h>
+
+#include <linux/mfd/rpisense/framebuffer.h>
+#include <linux/mfd/rpisense/core.h>
+
+static bool lowlight;
+module_param(lowlight, bool, 0);
+MODULE_PARM_DESC(lowlight, "Reduce LED matrix brightness to one third");
+
+static struct rpisense *rpisense;
+
+struct rpisense_fb_param {
+	char __iomem *vmem;
+	u8 *vmem_work;
+	u32 vmemsize;
+	u8 *gamma;
+};
+
+static u8 gamma_default[32] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01,
+			       0x02, 0x02, 0x03, 0x03, 0x04, 0x05, 0x06, 0x07,
+			       0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0E, 0x0F, 0x11,
+			       0x12, 0x14, 0x15, 0x17, 0x19, 0x1B, 0x1D, 0x1F,};
+
+static u8 gamma_low[32] = {0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
+			   0x01, 0x01, 0x01, 0x01, 0x01, 0x02, 0x02, 0x02,
+			   0x03, 0x03, 0x03, 0x04, 0x04, 0x05, 0x05, 0x06,
+			   0x06, 0x07, 0x07, 0x08, 0x08, 0x09, 0x0A, 0x0A,};
+
+static u8 gamma_user[32];
+
+static struct rpisense_fb_param rpisense_fb_param = {
+	.vmem = NULL,
+	.vmemsize = 128,
+	.gamma = gamma_default,
+};
+
+static struct fb_deferred_io rpisense_fb_defio;
+
+static struct fb_fix_screeninfo rpisense_fb_fix = {
+	.id =		"RPi-Sense FB",
+	.type =		FB_TYPE_PACKED_PIXELS,
+	.visual =	FB_VISUAL_TRUECOLOR,
+	.xpanstep =	0,
+	.ypanstep =	0,
+	.ywrapstep =	0,
+	.accel =	FB_ACCEL_NONE,
+	.line_length =	16,
+};
+
+static struct fb_var_screeninfo rpisense_fb_var = {
+	.xres		= 8,
+	.yres		= 8,
+	.xres_virtual	= 8,
+	.yres_virtual	= 8,
+	.bits_per_pixel = 16,
+	.red		= {11, 5, 0},
+	.green		= {5, 6, 0},
+	.blue		= {0, 5, 0},
+};
+
+static ssize_t rpisense_fb_write(struct fb_info *info,
+				 const char __user *buf, size_t count,
+				 loff_t *ppos)
+{
+	ssize_t res = fb_sys_write(info, buf, count, ppos);
+
+	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
+	return res;
+}
+
+static void rpisense_fb_fillrect(struct fb_info *info,
+				 const struct fb_fillrect *rect)
+{
+	sys_fillrect(info, rect);
+	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
+}
+
+static void rpisense_fb_copyarea(struct fb_info *info,
+				 const struct fb_copyarea *area)
+{
+	sys_copyarea(info, area);
+	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
+}
+
+static void rpisense_fb_imageblit(struct fb_info *info,
+				  const struct fb_image *image)
+{
+	sys_imageblit(info, image);
+	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
+}
+
+static void rpisense_fb_deferred_io(struct fb_info *info,
+				struct list_head *pagelist)
+{
+	int i;
+	int j;
+	u8 *vmem_work = rpisense_fb_param.vmem_work;
+	u16 *mem = (u16 *)rpisense_fb_param.vmem;
+	u8 *gamma = rpisense_fb_param.gamma;
+
+	vmem_work[0] = 0;
+	for (j = 0; j < 8; j++) {
+		for (i = 0; i < 8; i++) {
+			vmem_work[(j * 24) + i + 1] =
+				gamma[(mem[(j * 8) + i] >> 11) & 0x1F];
+			vmem_work[(j * 24) + (i + 8) + 1] =
+				gamma[(mem[(j * 8) + i] >> 6) & 0x1F];
+			vmem_work[(j * 24) + (i + 16) + 1] =
+				gamma[(mem[(j * 8) + i]) & 0x1F];
+		}
+	}
+	rpisense_block_write(rpisense, vmem_work, 193);
+}
+
+static struct fb_deferred_io rpisense_fb_defio = {
+	.delay		= HZ/100,
+	.deferred_io	= rpisense_fb_deferred_io,
+};
+
+static int rpisense_fb_ioctl(struct fb_info *info, unsigned int cmd,
+			     unsigned long arg)
+{
+	switch (cmd) {
+	case SENSEFB_FBIOGET_GAMMA:
+		if (copy_to_user((void __user *) arg, rpisense_fb_param.gamma,
+				 sizeof(u8[32])))
+			return -EFAULT;
+		return 0;
+	case SENSEFB_FBIOSET_GAMMA:
+		if (copy_from_user(gamma_user, (void __user *)arg,
+				   sizeof(u8[32])))
+			return -EFAULT;
+		rpisense_fb_param.gamma = gamma_user;
+		schedule_delayed_work(&info->deferred_work,
+				      rpisense_fb_defio.delay);
+		return 0;
+	case SENSEFB_FBIORESET_GAMMA:
+		switch (arg) {
+		case 0:
+			rpisense_fb_param.gamma = gamma_default;
+			break;
+		case 1:
+			rpisense_fb_param.gamma = gamma_low;
+			break;
+		case 2:
+			rpisense_fb_param.gamma = gamma_user;
+			break;
+		default:
+			return -EINVAL;
+		}
+		schedule_delayed_work(&info->deferred_work,
+				      rpisense_fb_defio.delay);
+		break;
+	default:
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static struct fb_ops rpisense_fb_ops = {
+	.owner		= THIS_MODULE,
+	.fb_read	= fb_sys_read,
+	.fb_write	= rpisense_fb_write,
+	.fb_fillrect	= rpisense_fb_fillrect,
+	.fb_copyarea	= rpisense_fb_copyarea,
+	.fb_imageblit	= rpisense_fb_imageblit,
+	.fb_ioctl	= rpisense_fb_ioctl,
+};
+
+static int rpisense_fb_probe(struct platform_device *pdev)
+{
+	struct fb_info *info;
+	int ret = -ENOMEM;
+	struct rpisense_fb *rpisense_fb;
+
+	rpisense = rpisense_get_dev();
+	rpisense_fb = &rpisense->framebuffer;
+
+	rpisense_fb_param.vmem = vzalloc(rpisense_fb_param.vmemsize);
+	if (!rpisense_fb_param.vmem)
+		return ret;
+
+	rpisense_fb_param.vmem_work = devm_kmalloc(&pdev->dev, 193, GFP_KERNEL);
+	if (!rpisense_fb_param.vmem_work)
+		goto err_malloc;
+
+	info = framebuffer_alloc(0, &pdev->dev);
+	if (!info) {
+		dev_err(&pdev->dev, "Could not allocate framebuffer.\n");
+		goto err_malloc;
+	}
+	rpisense_fb->info = info;
+
+	rpisense_fb_fix.smem_start = (unsigned long)rpisense_fb_param.vmem;
+	rpisense_fb_fix.smem_len = rpisense_fb_param.vmemsize;
+
+	info->fbops = &rpisense_fb_ops;
+	info->fix = rpisense_fb_fix;
+	info->var = rpisense_fb_var;
+	info->fbdefio = &rpisense_fb_defio;
+	info->flags = FBINFO_FLAG_DEFAULT | FBINFO_VIRTFB;
+	info->screen_base = rpisense_fb_param.vmem;
+	info->screen_size = rpisense_fb_param.vmemsize;
+
+	if (lowlight)
+		rpisense_fb_param.gamma = gamma_low;
+
+	fb_deferred_io_init(info);
+
+	ret = register_framebuffer(info);
+	if (ret < 0) {
+		dev_err(&pdev->dev, "Could not register framebuffer.\n");
+		goto err_fballoc;
+	}
+
+	fb_info(info, "%s frame buffer device\n", info->fix.id);
+	schedule_delayed_work(&info->deferred_work, rpisense_fb_defio.delay);
+	return 0;
+err_fballoc:
+	framebuffer_release(info);
+err_malloc:
+	vfree(rpisense_fb_param.vmem);
+	return ret;
+}
+
+static int rpisense_fb_remove(struct platform_device *pdev)
+{
+	struct rpisense_fb *rpisense_fb = &rpisense->framebuffer;
+	struct fb_info *info = rpisense_fb->info;
+
+	if (info) {
+		unregister_framebuffer(info);
+		fb_deferred_io_cleanup(info);
+		framebuffer_release(info);
+		vfree(rpisense_fb_param.vmem);
+	}
+
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id rpisense_fb_id[] = {
+	{ .compatible = "rpi,rpi-sense-fb" },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, rpisense_fb_id);
+#endif
+
+static struct platform_device_id rpisense_fb_device_id[] = {
+	{ .name = "rpi-sense-fb" },
+	{ },
+};
+MODULE_DEVICE_TABLE(platform, rpisense_fb_device_id);
+
+static struct platform_driver rpisense_fb_driver = {
+	.probe = rpisense_fb_probe,
+	.remove = rpisense_fb_remove,
+	.driver = {
+		.name = "rpi-sense-fb",
+		.owner = THIS_MODULE,
+	},
+};
+
+module_platform_driver(rpisense_fb_driver);
+
+MODULE_DESCRIPTION("Raspberry Pi Sense HAT framebuffer driver");
+MODULE_AUTHOR("Serge Schneider <serge@raspberrypi.org>");
+MODULE_LICENSE("GPL");
+
diff --git a/drivers/video/logo/logo_linux_clut224.ppm b/drivers/video/logo/logo_linux_clut224.ppm
index 3c14e43b82fe..7626beb6a5bb 100644
--- a/drivers/video/logo/logo_linux_clut224.ppm
+++ b/drivers/video/logo/logo_linux_clut224.ppm
@@ -1,1604 +1,883 @@
 P3
-# Standard 224-color Linux logo
-80 80
+63 80
 255
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6   6   6   6  10  10  10  10  10  10
- 10  10  10   6   6   6   6   6   6   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   6   6   6  10  10  10  14  14  14
- 22  22  22  26  26  26  30  30  30  34  34  34
- 30  30  30  30  30  30  26  26  26  18  18  18
- 14  14  14  10  10  10   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   1   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6  14  14  14  26  26  26  42  42  42
- 54  54  54  66  66  66  78  78  78  78  78  78
- 78  78  78  74  74  74  66  66  66  54  54  54
- 42  42  42  26  26  26  18  18  18  10  10  10
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   1   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 22  22  22  42  42  42  66  66  66  86  86  86
- 66  66  66  38  38  38  38  38  38  22  22  22
- 26  26  26  34  34  34  54  54  54  66  66  66
- 86  86  86  70  70  70  46  46  46  26  26  26
- 14  14  14   6   6   6   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   1   0   0   1   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0  10  10  10  26  26  26
- 50  50  50  82  82  82  58  58  58   6   6   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  6   6   6  54  54  54  86  86  86  66  66  66
- 38  38  38  18  18  18   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   6   6   6  22  22  22  50  50  50
- 78  78  78  34  34  34   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   6   6   6  70  70  70
- 78  78  78  46  46  46  22  22  22   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   1   0   0   1   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6  18  18  18  42  42  42  82  82  82
- 26  26  26   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  14  14  14
- 46  46  46  34  34  34   6   6   6   2   2   6
- 42  42  42  78  78  78  42  42  42  18  18  18
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   1   0   0   0   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
- 10  10  10  30  30  30  66  66  66  58  58  58
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  26  26  26
- 86  86  86 101 101 101  46  46  46  10  10  10
-  2   2   6  58  58  58  70  70  70  34  34  34
- 10  10  10   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   1   0   0   1   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
- 14  14  14  42  42  42  86  86  86  10  10  10
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  30  30  30
- 94  94  94  94  94  94  58  58  58  26  26  26
-  2   2   6   6   6   6  78  78  78  54  54  54
- 22  22  22   6   6   6   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 22  22  22  62  62  62  62  62  62   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  26  26  26
- 54  54  54  38  38  38  18  18  18  10  10  10
-  2   2   6   2   2   6  34  34  34  82  82  82
- 38  38  38  14  14  14   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   1   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 30  30  30  78  78  78  30  30  30   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  10  10  10
- 10  10  10   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  78  78  78
- 50  50  50  18  18  18   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   1   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 38  38  38  86  86  86  14  14  14   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  54  54  54
- 66  66  66  26  26  26   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   1   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 42  42  42  82  82  82   2   2   6   2   2   6
-  2   2   6   6   6   6  10  10  10   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   6   6   6
- 14  14  14  10  10  10   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  18  18  18
- 82  82  82  34  34  34  10  10  10   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   1   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 46  46  46  86  86  86   2   2   6   2   2   6
-  6   6   6   6   6   6  22  22  22  34  34  34
-  6   6   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6  18  18  18  34  34  34
- 10  10  10  50  50  50  22  22  22   2   2   6
-  2   2   6   2   2   6   2   2   6  10  10  10
- 86  86  86  42  42  42  14  14  14   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   1   0   0   1   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 46  46  46  86  86  86   2   2   6   2   2   6
- 38  38  38 116 116 116  94  94  94  22  22  22
- 22  22  22   2   2   6   2   2   6   2   2   6
- 14  14  14  86  86  86 138 138 138 162 162 162
-154 154 154  38  38  38  26  26  26   6   6   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 86  86  86  46  46  46  14  14  14   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 46  46  46  86  86  86   2   2   6  14  14  14
-134 134 134 198 198 198 195 195 195 116 116 116
- 10  10  10   2   2   6   2   2   6   6   6   6
-101  98  89 187 187 187 210 210 210 218 218 218
-214 214 214 134 134 134  14  14  14   6   6   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 86  86  86  50  50  50  18  18  18   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   1   0   0   0
-  0   0   1   0   0   1   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 46  46  46  86  86  86   2   2   6  54  54  54
-218 218 218 195 195 195 226 226 226 246 246 246
- 58  58  58   2   2   6   2   2   6  30  30  30
-210 210 210 253 253 253 174 174 174 123 123 123
-221 221 221 234 234 234  74  74  74   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 70  70  70  58  58  58  22  22  22   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 46  46  46  82  82  82   2   2   6 106 106 106
-170 170 170  26  26  26  86  86  86 226 226 226
-123 123 123  10  10  10  14  14  14  46  46  46
-231 231 231 190 190 190   6   6   6  70  70  70
- 90  90  90 238 238 238 158 158 158   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 70  70  70  58  58  58  22  22  22   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   1   0   0   0
-  0   0   1   0   0   1   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 42  42  42  86  86  86   6   6   6 116 116 116
-106 106 106   6   6   6  70  70  70 149 149 149
-128 128 128  18  18  18  38  38  38  54  54  54
-221 221 221 106 106 106   2   2   6  14  14  14
- 46  46  46 190 190 190 198 198 198   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 74  74  74  62  62  62  22  22  22   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   1   0   0   0
-  0   0   1   0   0   0   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 42  42  42  94  94  94  14  14  14 101 101 101
-128 128 128   2   2   6  18  18  18 116 116 116
-118  98  46 121  92   8 121  92   8  98  78  10
-162 162 162 106 106 106   2   2   6   2   2   6
-  2   2   6 195 195 195 195 195 195   6   6   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 74  74  74  62  62  62  22  22  22   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   1   0   0   1
-  0   0   1   0   0   0   0   0   1   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 38  38  38  90  90  90  14  14  14  58  58  58
-210 210 210  26  26  26  54  38   6 154 114  10
-226 170  11 236 186  11 225 175  15 184 144  12
-215 174  15 175 146  61  37  26   9   2   2   6
- 70  70  70 246 246 246 138 138 138   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 70  70  70  66  66  66  26  26  26   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 38  38  38  86  86  86  14  14  14  10  10  10
-195 195 195 188 164 115 192 133   9 225 175  15
-239 182  13 234 190  10 232 195  16 232 200  30
-245 207  45 241 208  19 232 195  16 184 144  12
-218 194 134 211 206 186  42  42  42   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 50  50  50  74  74  74  30  30  30   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 34  34  34  86  86  86  14  14  14   2   2   6
-121  87  25 192 133   9 219 162  10 239 182  13
-236 186  11 232 195  16 241 208  19 244 214  54
-246 218  60 246 218  38 246 215  20 241 208  19
-241 208  19 226 184  13 121  87  25   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 50  50  50  82  82  82  34  34  34  10  10  10
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 34  34  34  82  82  82  30  30  30  61  42   6
-180 123   7 206 145  10 230 174  11 239 182  13
-234 190  10 238 202  15 241 208  19 246 218  74
-246 218  38 246 215  20 246 215  20 246 215  20
-226 184  13 215 174  15 184 144  12   6   6   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 26  26  26  94  94  94  42  42  42  14  14  14
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 30  30  30  78  78  78  50  50  50 104  69   6
-192 133   9 216 158  10 236 178  12 236 186  11
-232 195  16 241 208  19 244 214  54 245 215  43
-246 215  20 246 215  20 241 208  19 198 155  10
-200 144  11 216 158  10 156 118  10   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  6   6   6  90  90  90  54  54  54  18  18  18
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 30  30  30  78  78  78  46  46  46  22  22  22
-137  92   6 210 162  10 239 182  13 238 190  10
-238 202  15 241 208  19 246 215  20 246 215  20
-241 208  19 203 166  17 185 133  11 210 150  10
-216 158  10 210 150  10 102  78  10   2   2   6
-  6   6   6  54  54  54  14  14  14   2   2   6
-  2   2   6  62  62  62  74  74  74  30  30  30
- 10  10  10   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 34  34  34  78  78  78  50  50  50   6   6   6
- 94  70  30 139 102  15 190 146  13 226 184  13
-232 200  30 232 195  16 215 174  15 190 146  13
-168 122  10 192 133   9 210 150  10 213 154  11
-202 150  34 182 157 106 101  98  89   2   2   6
-  2   2   6  78  78  78 116 116 116  58  58  58
-  2   2   6  22  22  22  90  90  90  46  46  46
- 18  18  18   6   6   6   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 38  38  38  86  86  86  50  50  50   6   6   6
-128 128 128 174 154 114 156 107  11 168 122  10
-198 155  10 184 144  12 197 138  11 200 144  11
-206 145  10 206 145  10 197 138  11 188 164 115
-195 195 195 198 198 198 174 174 174  14  14  14
-  2   2   6  22  22  22 116 116 116 116 116 116
- 22  22  22   2   2   6  74  74  74  70  70  70
- 30  30  30  10  10  10   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  18  18  18
- 50  50  50 101 101 101  26  26  26  10  10  10
-138 138 138 190 190 190 174 154 114 156 107  11
-197 138  11 200 144  11 197 138  11 192 133   9
-180 123   7 190 142  34 190 178 144 187 187 187
-202 202 202 221 221 221 214 214 214  66  66  66
-  2   2   6   2   2   6  50  50  50  62  62  62
-  6   6   6   2   2   6  10  10  10  90  90  90
- 50  50  50  18  18  18   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0  10  10  10  34  34  34
- 74  74  74  74  74  74   2   2   6   6   6   6
-144 144 144 198 198 198 190 190 190 178 166 146
-154 121  60 156 107  11 156 107  11 168 124  44
-174 154 114 187 187 187 190 190 190 210 210 210
-246 246 246 253 253 253 253 253 253 182 182 182
-  6   6   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  62  62  62
- 74  74  74  34  34  34  14  14  14   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0  10  10  10  22  22  22  54  54  54
- 94  94  94  18  18  18   2   2   6  46  46  46
-234 234 234 221 221 221 190 190 190 190 190 190
-190 190 190 187 187 187 187 187 187 190 190 190
-190 190 190 195 195 195 214 214 214 242 242 242
-253 253 253 253 253 253 253 253 253 253 253 253
- 82  82  82   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  14  14  14
- 86  86  86  54  54  54  22  22  22   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6  18  18  18  46  46  46  90  90  90
- 46  46  46  18  18  18   6   6   6 182 182 182
-253 253 253 246 246 246 206 206 206 190 190 190
-190 190 190 190 190 190 190 190 190 190 190 190
-206 206 206 231 231 231 250 250 250 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-202 202 202  14  14  14   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 42  42  42  86  86  86  42  42  42  18  18  18
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 14  14  14  38  38  38  74  74  74  66  66  66
-  2   2   6   6   6   6  90  90  90 250 250 250
-253 253 253 253 253 253 238 238 238 198 198 198
-190 190 190 190 190 190 195 195 195 221 221 221
-246 246 246 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253  82  82  82   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6  78  78  78  70  70  70  34  34  34
- 14  14  14   6   6   6   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 34  34  34  66  66  66  78  78  78   6   6   6
-  2   2   6  18  18  18 218 218 218 253 253 253
-253 253 253 253 253 253 253 253 253 246 246 246
-226 226 226 231 231 231 246 246 246 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 178 178 178   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6  18  18  18  90  90  90  62  62  62
- 30  30  30  10  10  10   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0  10  10  10  26  26  26
- 58  58  58  90  90  90  18  18  18   2   2   6
-  2   2   6 110 110 110 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-250 250 250 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 231 231 231  18  18  18   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6  18  18  18  94  94  94
- 54  54  54  26  26  26  10  10  10   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   6   6   6  22  22  22  50  50  50
- 90  90  90  26  26  26   2   2   6   2   2   6
- 14  14  14 195 195 195 250 250 250 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-250 250 250 242 242 242  54  54  54   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6  38  38  38
- 86  86  86  50  50  50  22  22  22   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6  14  14  14  38  38  38  82  82  82
- 34  34  34   2   2   6   2   2   6   2   2   6
- 42  42  42 195 195 195 246 246 246 253 253 253
-253 253 253 253 253 253 253 253 253 250 250 250
-242 242 242 242 242 242 250 250 250 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 250 250 250 246 246 246 238 238 238
-226 226 226 231 231 231 101 101 101   6   6   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
- 38  38  38  82  82  82  42  42  42  14  14  14
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
- 10  10  10  26  26  26  62  62  62  66  66  66
-  2   2   6   2   2   6   2   2   6   6   6   6
- 70  70  70 170 170 170 206 206 206 234 234 234
-246 246 246 250 250 250 250 250 250 238 238 238
-226 226 226 231 231 231 238 238 238 250 250 250
-250 250 250 250 250 250 246 246 246 231 231 231
-214 214 214 206 206 206 202 202 202 202 202 202
-198 198 198 202 202 202 182 182 182  18  18  18
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6  62  62  62  66  66  66  30  30  30
- 10  10  10   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
- 14  14  14  42  42  42  82  82  82  18  18  18
-  2   2   6   2   2   6   2   2   6  10  10  10
- 94  94  94 182 182 182 218 218 218 242 242 242
-250 250 250 253 253 253 253 253 253 250 250 250
-234 234 234 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 246 246 246
-238 238 238 226 226 226 210 210 210 202 202 202
-195 195 195 195 195 195 210 210 210 158 158 158
-  6   6   6  14  14  14  50  50  50  14  14  14
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   6   6   6  86  86  86  46  46  46
- 18  18  18   6   6   6   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 22  22  22  54  54  54  70  70  70   2   2   6
-  2   2   6  10  10  10   2   2   6  22  22  22
-166 166 166 231 231 231 250 250 250 253 253 253
-253 253 253 253 253 253 253 253 253 250 250 250
-242 242 242 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 246 246 246
-231 231 231 206 206 206 198 198 198 226 226 226
- 94  94  94   2   2   6   6   6   6  38  38  38
- 30  30  30   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6  62  62  62  66  66  66
- 26  26  26  10  10  10   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 30  30  30  74  74  74  50  50  50   2   2   6
- 26  26  26  26  26  26   2   2   6 106 106 106
-238 238 238 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 246 246 246 218 218 218 202 202 202
-210 210 210  14  14  14   2   2   6   2   2   6
- 30  30  30  22  22  22   2   2   6   2   2   6
-  2   2   6   2   2   6  18  18  18  86  86  86
- 42  42  42  14  14  14   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 42  42  42  90  90  90  22  22  22   2   2   6
- 42  42  42   2   2   6  18  18  18 218 218 218
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 250 250 250 221 221 221
-218 218 218 101 101 101   2   2   6  14  14  14
- 18  18  18  38  38  38  10  10  10   2   2   6
-  2   2   6   2   2   6   2   2   6  78  78  78
- 58  58  58  22  22  22   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  18  18  18
- 54  54  54  82  82  82   2   2   6  26  26  26
- 22  22  22   2   2   6 123 123 123 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 250 250 250
-238 238 238 198 198 198   6   6   6  38  38  38
- 58  58  58  26  26  26  38  38  38   2   2   6
-  2   2   6   2   2   6   2   2   6  46  46  46
- 78  78  78  30  30  30  10  10  10   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0  10  10  10  30  30  30
- 74  74  74  58  58  58   2   2   6  42  42  42
-  2   2   6  22  22  22 231 231 231 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 250 250 250
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 246 246 246  46  46  46  38  38  38
- 42  42  42  14  14  14  38  38  38  14  14  14
-  2   2   6   2   2   6   2   2   6   6   6   6
- 86  86  86  46  46  46  14  14  14   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   6   6   6  14  14  14  42  42  42
- 90  90  90  18  18  18  18  18  18  26  26  26
-  2   2   6 116 116 116 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 250 250 250 238 238 238
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253  94  94  94   6   6   6
-  2   2   6   2   2   6  10  10  10  34  34  34
-  2   2   6   2   2   6   2   2   6   2   2   6
- 74  74  74  58  58  58  22  22  22   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0  10  10  10  26  26  26  66  66  66
- 82  82  82   2   2   6  38  38  38   6   6   6
- 14  14  14 210 210 210 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 246 246 246 242 242 242
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 144 144 144   2   2   6
-  2   2   6   2   2   6   2   2   6  46  46  46
-  2   2   6   2   2   6   2   2   6   2   2   6
- 42  42  42  74  74  74  30  30  30  10  10  10
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6  14  14  14  42  42  42  90  90  90
- 26  26  26   6   6   6  42  42  42   2   2   6
- 74  74  74 250 250 250 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 242 242 242 242 242 242
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 182 182 182   2   2   6
-  2   2   6   2   2   6   2   2   6  46  46  46
-  2   2   6   2   2   6   2   2   6   2   2   6
- 10  10  10  86  86  86  38  38  38  10  10  10
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
- 10  10  10  26  26  26  66  66  66  82  82  82
-  2   2   6  22  22  22  18  18  18   2   2   6
-149 149 149 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 234 234 234 242 242 242
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 206 206 206   2   2   6
-  2   2   6   2   2   6   2   2   6  38  38  38
-  2   2   6   2   2   6   2   2   6   2   2   6
-  6   6   6  86  86  86  46  46  46  14  14  14
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 18  18  18  46  46  46  86  86  86  18  18  18
-  2   2   6  34  34  34  10  10  10   6   6   6
-210 210 210 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 234 234 234 242 242 242
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 221 221 221   6   6   6
-  2   2   6   2   2   6   6   6   6  30  30  30
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6  82  82  82  54  54  54  18  18  18
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 26  26  26  66  66  66  62  62  62   2   2   6
-  2   2   6  38  38  38  10  10  10  26  26  26
-238 238 238 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 231 231 231 238 238 238
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 231 231 231   6   6   6
-  2   2   6   2   2   6  10  10  10  30  30  30
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6  66  66  66  58  58  58  22  22  22
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 38  38  38  78  78  78   6   6   6   2   2   6
-  2   2   6  46  46  46  14  14  14  42  42  42
-246 246 246 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 231 231 231 242 242 242
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 234 234 234  10  10  10
-  2   2   6   2   2   6  22  22  22  14  14  14
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6  66  66  66  62  62  62  22  22  22
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  18  18  18
- 50  50  50  74  74  74   2   2   6   2   2   6
- 14  14  14  70  70  70  34  34  34  62  62  62
-250 250 250 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 231 231 231 246 246 246
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 234 234 234  14  14  14
-  2   2   6   2   2   6  30  30  30   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6  66  66  66  62  62  62  22  22  22
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  18  18  18
- 54  54  54  62  62  62   2   2   6   2   2   6
-  2   2   6  30  30  30  46  46  46  70  70  70
-250 250 250 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 231 231 231 246 246 246
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 226 226 226  10  10  10
-  2   2   6   6   6   6  30  30  30   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6  66  66  66  58  58  58  22  22  22
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  22  22  22
- 58  58  58  62  62  62   2   2   6   2   2   6
-  2   2   6   2   2   6  30  30  30  78  78  78
-250 250 250 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 231 231 231 246 246 246
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 206 206 206   2   2   6
- 22  22  22  34  34  34  18  14   6  22  22  22
- 26  26  26  18  18  18   6   6   6   2   2   6
-  2   2   6  82  82  82  54  54  54  18  18  18
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  26  26  26
- 62  62  62 106 106 106  74  54  14 185 133  11
-210 162  10 121  92   8   6   6   6  62  62  62
-238 238 238 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 231 231 231 246 246 246
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 158 158 158  18  18  18
- 14  14  14   2   2   6   2   2   6   2   2   6
-  6   6   6  18  18  18  66  66  66  38  38  38
-  6   6   6  94  94  94  50  50  50  18  18  18
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 10  10  10  10  10  10  18  18  18  38  38  38
- 78  78  78 142 134 106 216 158  10 242 186  14
-246 190  14 246 190  14 156 118  10  10  10  10
- 90  90  90 238 238 238 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 231 231 231 250 250 250
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 246 230 190
-238 204  91 238 204  91 181 142  44  37  26   9
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6  38  38  38  46  46  46
- 26  26  26 106 106 106  54  54  54  18  18  18
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   6   6   6  14  14  14  22  22  22
- 30  30  30  38  38  38  50  50  50  70  70  70
-106 106 106 190 142  34 226 170  11 242 186  14
-246 190  14 246 190  14 246 190  14 154 114  10
-  6   6   6  74  74  74 226 226 226 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 231 231 231 250 250 250
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 228 184  62
-241 196  14 241 208  19 232 195  16  38  30  10
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   6   6   6  30  30  30  26  26  26
-203 166  17 154 142  90  66  66  66  26  26  26
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6  18  18  18  38  38  38  58  58  58
- 78  78  78  86  86  86 101 101 101 123 123 123
-175 146  61 210 150  10 234 174  13 246 186  14
-246 190  14 246 190  14 246 190  14 238 190  10
-102  78  10   2   2   6  46  46  46 198 198 198
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 234 234 234 242 242 242
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 224 178  62
-242 186  14 241 196  14 210 166  10  22  18   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   6   6   6 121  92   8
-238 202  15 232 195  16  82  82  82  34  34  34
- 10  10  10   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
- 14  14  14  38  38  38  70  70  70 154 122  46
-190 142  34 200 144  11 197 138  11 197 138  11
-213 154  11 226 170  11 242 186  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-225 175  15  46  32   6   2   2   6  22  22  22
-158 158 158 250 250 250 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 250 250 250 242 242 242 224 178  62
-239 182  13 236 186  11 213 154  11  46  32   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6  61  42   6 225 175  15
-238 190  10 236 186  11 112 100  78  42  42  42
- 14  14  14   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 22  22  22  54  54  54 154 122  46 213 154  11
-226 170  11 230 174  11 226 170  11 226 170  11
-236 178  12 242 186  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-241 196  14 184 144  12  10  10  10   2   2   6
-  6   6   6 116 116 116 242 242 242 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 231 231 231 198 198 198 214 170  54
-236 178  12 236 178  12 210 150  10 137  92   6
- 18  14   6   2   2   6   2   2   6   2   2   6
-  6   6   6  70  47   6 200 144  11 236 178  12
-239 182  13 239 182  13 124 112  88  58  58  58
- 22  22  22   6   6   6   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 30  30  30  70  70  70 180 133  36 226 170  11
-239 182  13 242 186  14 242 186  14 246 186  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 232 195  16  98  70   6   2   2   6
-  2   2   6   2   2   6  66  66  66 221 221 221
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 206 206 206 198 198 198 214 166  58
-230 174  11 230 174  11 216 158  10 192 133   9
-163 110   8 116  81   8 102  78  10 116  81   8
-167 114   7 197 138  11 226 170  11 239 182  13
-242 186  14 242 186  14 162 146  94  78  78  78
- 34  34  34  14  14  14   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 30  30  30  78  78  78 190 142  34 226 170  11
-239 182  13 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 241 196  14 203 166  17  22  18   6
-  2   2   6   2   2   6   2   2   6  38  38  38
-218 218 218 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-250 250 250 206 206 206 198 198 198 202 162  69
-226 170  11 236 178  12 224 166  10 210 150  10
-200 144  11 197 138  11 192 133   9 197 138  11
-210 150  10 226 170  11 242 186  14 246 190  14
-246 190  14 246 186  14 225 175  15 124 112  88
- 62  62  62  30  30  30  14  14  14   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 30  30  30  78  78  78 174 135  50 224 166  10
-239 182  13 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 241 196  14 139 102  15
-  2   2   6   2   2   6   2   2   6   2   2   6
- 78  78  78 250 250 250 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-250 250 250 214 214 214 198 198 198 190 150  46
-219 162  10 236 178  12 234 174  13 224 166  10
-216 158  10 213 154  11 213 154  11 216 158  10
-226 170  11 239 182  13 246 190  14 246 190  14
-246 190  14 246 190  14 242 186  14 206 162  42
-101 101 101  58  58  58  30  30  30  14  14  14
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 30  30  30  74  74  74 174 135  50 216 158  10
-236 178  12 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 241 196  14 226 184  13
- 61  42   6   2   2   6   2   2   6   2   2   6
- 22  22  22 238 238 238 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 226 226 226 187 187 187 180 133  36
-216 158  10 236 178  12 239 182  13 236 178  12
-230 174  11 226 170  11 226 170  11 230 174  11
-236 178  12 242 186  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 186  14 239 182  13
-206 162  42 106 106 106  66  66  66  34  34  34
- 14  14  14   6   6   6   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 26  26  26  70  70  70 163 133  67 213 154  11
-236 178  12 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 241 196  14
-190 146  13  18  14   6   2   2   6   2   2   6
- 46  46  46 246 246 246 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 221 221 221  86  86  86 156 107  11
-216 158  10 236 178  12 242 186  14 246 186  14
-242 186  14 239 182  13 239 182  13 242 186  14
-242 186  14 246 186  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-242 186  14 225 175  15 142 122  72  66  66  66
- 30  30  30  10  10  10   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 26  26  26  70  70  70 163 133  67 210 150  10
-236 178  12 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-232 195  16 121  92   8  34  34  34 106 106 106
-221 221 221 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-242 242 242  82  82  82  18  14   6 163 110   8
-216 158  10 236 178  12 242 186  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 242 186  14 163 133  67
- 46  46  46  18  18  18   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  10  10  10
- 30  30  30  78  78  78 163 133  67 210 150  10
-236 178  12 246 186  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-241 196  14 215 174  15 190 178 144 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 218 218 218
- 58  58  58   2   2   6  22  18   6 167 114   7
-216 158  10 236 178  12 246 186  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 186  14 242 186  14 190 150  46
- 54  54  54  22  22  22   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 38  38  38  86  86  86 180 133  36 213 154  11
-236 178  12 246 186  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 232 195  16 190 146  13 214 214 214
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 250 250 250 170 170 170  26  26  26
-  2   2   6   2   2   6  37  26   9 163 110   8
-219 162  10 239 182  13 246 186  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 186  14 236 178  12 224 166  10 142 122  72
- 46  46  46  18  18  18   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  18  18  18
- 50  50  50 109 106  95 192 133   9 224 166  10
-242 186  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-242 186  14 226 184  13 210 162  10 142 110  46
-226 226 226 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-253 253 253 253 253 253 253 253 253 253 253 253
-198 198 198  66  66  66   2   2   6   2   2   6
-  2   2   6   2   2   6  50  34   6 156 107  11
-219 162  10 239 182  13 246 186  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 242 186  14
-234 174  13 213 154  11 154 122  46  66  66  66
- 30  30  30  10  10  10   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  22  22  22
- 58  58  58 154 121  60 206 145  10 234 174  13
-242 186  14 246 186  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 186  14 236 178  12 210 162  10 163 110   8
- 61  42   6 138 138 138 218 218 218 250 250 250
-253 253 253 253 253 253 253 253 253 250 250 250
-242 242 242 210 210 210 144 144 144  66  66  66
-  6   6   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6  61  42   6 163 110   8
-216 158  10 236 178  12 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 239 182  13 230 174  11 216 158  10
-190 142  34 124 112  88  70  70  70  38  38  38
- 18  18  18   6   6   6   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  22  22  22
- 62  62  62 168 124  44 206 145  10 224 166  10
-236 178  12 239 182  13 242 186  14 242 186  14
-246 186  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 236 178  12 216 158  10 175 118   6
- 80  54   7   2   2   6   6   6   6  30  30  30
- 54  54  54  62  62  62  50  50  50  38  38  38
- 14  14  14   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   6   6   6  80  54   7 167 114   7
-213 154  11 236 178  12 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 190  14 242 186  14 239 182  13 239 182  13
-230 174  11 210 150  10 174 135  50 124 112  88
- 82  82  82  54  54  54  34  34  34  18  18  18
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  18  18  18
- 50  50  50 158 118  36 192 133   9 200 144  11
-216 158  10 219 162  10 224 166  10 226 170  11
-230 174  11 236 178  12 239 182  13 239 182  13
-242 186  14 246 186  14 246 190  14 246 190  14
-246 190  14 246 190  14 246 190  14 246 190  14
-246 186  14 230 174  11 210 150  10 163 110   8
-104  69   6  10  10  10   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   6   6   6  91  60   6 167 114   7
-206 145  10 230 174  11 242 186  14 246 190  14
-246 190  14 246 190  14 246 186  14 242 186  14
-239 182  13 230 174  11 224 166  10 213 154  11
-180 133  36 124 112  88  86  86  86  58  58  58
- 38  38  38  22  22  22  10  10  10   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0  14  14  14
- 34  34  34  70  70  70 138 110  50 158 118  36
-167 114   7 180 123   7 192 133   9 197 138  11
-200 144  11 206 145  10 213 154  11 219 162  10
-224 166  10 230 174  11 239 182  13 242 186  14
-246 186  14 246 186  14 246 186  14 246 186  14
-239 182  13 216 158  10 185 133  11 152  99   6
-104  69   6  18  14   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   2   2   6   2   2   6   2   2   6
-  2   2   6   6   6   6  80  54   7 152  99   6
-192 133   9 219 162  10 236 178  12 239 182  13
-246 186  14 242 186  14 239 182  13 236 178  12
-224 166  10 206 145  10 192 133   9 154 121  60
- 94  94  94  62  62  62  42  42  42  22  22  22
- 14  14  14   6   6   6   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 18  18  18  34  34  34  58  58  58  78  78  78
-101  98  89 124 112  88 142 110  46 156 107  11
-163 110   8 167 114   7 175 118   6 180 123   7
-185 133  11 197 138  11 210 150  10 219 162  10
-226 170  11 236 178  12 236 178  12 234 174  13
-219 162  10 197 138  11 163 110   8 130  83   6
- 91  60   6  10  10  10   2   2   6   2   2   6
- 18  18  18  38  38  38  38  38  38  38  38  38
- 38  38  38  38  38  38  38  38  38  38  38  38
- 38  38  38  38  38  38  26  26  26   2   2   6
-  2   2   6   6   6   6  70  47   6 137  92   6
-175 118   6 200 144  11 219 162  10 230 174  11
-234 174  13 230 174  11 219 162  10 210 150  10
-192 133   9 163 110   8 124 112  88  82  82  82
- 50  50  50  30  30  30  14  14  14   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6  14  14  14  22  22  22  34  34  34
- 42  42  42  58  58  58  74  74  74  86  86  86
-101  98  89 122 102  70 130  98  46 121  87  25
-137  92   6 152  99   6 163 110   8 180 123   7
-185 133  11 197 138  11 206 145  10 200 144  11
-180 123   7 156 107  11 130  83   6 104  69   6
- 50  34   6  54  54  54 110 110 110 101  98  89
- 86  86  86  82  82  82  78  78  78  78  78  78
- 78  78  78  78  78  78  78  78  78  78  78  78
- 78  78  78  82  82  82  86  86  86  94  94  94
-106 106 106 101 101 101  86  66  34 124  80   6
-156 107  11 180 123   7 192 133   9 200 144  11
-206 145  10 200 144  11 192 133   9 175 118   6
-139 102  15 109 106  95  70  70  70  42  42  42
- 22  22  22  10  10  10   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   6   6   6  10  10  10
- 14  14  14  22  22  22  30  30  30  38  38  38
- 50  50  50  62  62  62  74  74  74  90  90  90
-101  98  89 112 100  78 121  87  25 124  80   6
-137  92   6 152  99   6 152  99   6 152  99   6
-138  86   6 124  80   6  98  70   6  86  66  30
-101  98  89  82  82  82  58  58  58  46  46  46
- 38  38  38  34  34  34  34  34  34  34  34  34
- 34  34  34  34  34  34  34  34  34  34  34  34
- 34  34  34  34  34  34  38  38  38  42  42  42
- 54  54  54  82  82  82  94  86  76  91  60   6
-134  86   6 156 107  11 167 114   7 175 118   6
-175 118   6 167 114   7 152  99   6 121  87  25
-101  98  89  62  62  62  34  34  34  18  18  18
-  6   6   6   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   6   6   6   6   6   6  10  10  10
- 18  18  18  22  22  22  30  30  30  42  42  42
- 50  50  50  66  66  66  86  86  86 101  98  89
-106  86  58  98  70   6 104  69   6 104  69   6
-104  69   6  91  60   6  82  62  34  90  90  90
- 62  62  62  38  38  38  22  22  22  14  14  14
- 10  10  10  10  10  10  10  10  10  10  10  10
- 10  10  10  10  10  10   6   6   6  10  10  10
- 10  10  10  10  10  10  10  10  10  14  14  14
- 22  22  22  42  42  42  70  70  70  89  81  66
- 80  54   7 104  69   6 124  80   6 137  92   6
-134  86   6 116  81   8 100  82  52  86  86  86
- 58  58  58  30  30  30  14  14  14   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   6   6   6  10  10  10  14  14  14
- 18  18  18  26  26  26  38  38  38  54  54  54
- 70  70  70  86  86  86  94  86  76  89  81  66
- 89  81  66  86  86  86  74  74  74  50  50  50
- 30  30  30  14  14  14   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6  18  18  18  34  34  34  58  58  58
- 82  82  82  89  81  66  89  81  66  89  81  66
- 94  86  66  94  86  76  74  74  74  50  50  50
- 26  26  26  14  14  14   6   6   6   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  6   6   6   6   6   6  14  14  14  18  18  18
- 30  30  30  38  38  38  46  46  46  54  54  54
- 50  50  50  42  42  42  30  30  30  18  18  18
- 10  10  10   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   6   6   6  14  14  14  26  26  26
- 38  38  38  50  50  50  58  58  58  58  58  58
- 54  54  54  42  42  42  30  30  30  18  18  18
- 10  10  10   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
-  6   6   6  10  10  10  14  14  14  18  18  18
- 18  18  18  14  14  14  10  10  10   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   6   6   6
- 14  14  14  18  18  18  22  22  22  22  22  22
- 18  18  18  14  14  14  10  10  10   6   6   6
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
-  0   0   0   0   0   0   0   0   0   0   0   0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 1 0  0 0 0  0 0 0  1 1 0
+0 1 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  1 1 0  0 0 0  0 0 0
+0 1 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 1 0
+10 15 3  2 3 1  12 18 4  42 61 14  19 27 6  11 16 4
+38 55 13  10 15 3  3 4 1  10 15 3  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  2 3 1
+12 18 4  1 1 0  23 34 8  31 45 11  10 15 3  32 47 11
+34 49 12  3 4 1  3 4 1  3 4 1  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  10 15 3  29 42 10  26 37 9  12 18 4
+55 80 19  81 118 28  55 80 19  92 132 31  106 153 36  69 100 23
+100 144 34  80 116 27  42 61 14  81 118 28  23 34 8  27 40 9
+15 21 5  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  1 1 0  29 42 10  15 21 5  50 72 17
+74 107 25  45 64 15  102 148 35  80 116 27  84 121 28  111 160 38
+69 100 23  65 94 22  81 118 28  29 42 10  17 25 6  29 42 10
+23 34 8  2 3 1  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  3 4 1
+15 21 5  15 21 5  34 49 12  101 146 34  111 161 38  97 141 33
+97 141 33  119 172 41  117 170 40  116 167 40  118 170 40  118 171 40
+117 169 40  118 170 40  111 160 38  118 170 40  96 138 32  89 128 30
+81 118 28  11 16 4  10 15 3  1 1 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+3 4 1  3 4 1  34 49 12  101 146 34  79 115 27  111 160 38
+114 165 39  113 163 39  118 170 40  117 169 40  118 171 40  117 169 40
+116 167 40  119 172 41  113 163 39  92 132 31  105 151 36  113 163 39
+75 109 26  19 27 6  16 23 5  11 16 4  0 1 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  10 15 3
+80 116 27  106 153 36  105 151 36  114 165 39  118 170 40  118 171 40
+118 171 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 170 40  117 169 40  118 170 40  118 170 40
+117 170 40  75 109 26  75 109 26  34 49 12  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  3 4 1
+64 92 22  65 94 22  100 144 34  118 171 40  118 170 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  118 171 41  118 170 40  117 169 40
+109 158 37  105 151 36  104 150 35  47 69 16  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+42 61 14  115 167 39  118 170 40  117 169 40  117 169 40  117 169 40
+117 170 40  117 170 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  118 170 40  96 138 32  17 25 6  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  47 69 16
+114 165 39  117 168 40  117 170 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  118 170 40  117 169 40  117 169 40  117 169 40
+117 170 40  119 172 41  96 138 32  12 18 4  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  10 15 3
+32 47 11  105 151 36  118 170 40  117 169 40  117 169 40  116 168 40
+109 157 37  111 160 38  117 169 40  118 171 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  118 171 40  69 100 23  2 3 1
+0 0 0  0 0 0  0 0 0  0 0 0  19 27 6  101 146 34
+118 171 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 170 40
+118 171 40  115 166 39  107 154 36  111 161 38  117 169 40  117 169 40
+117 169 40  118 171 40  75 109 26  19 27 6  2 3 1  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  16 23 5
+89 128 30  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+111 160 38  92 132 31  79 115 27  96 138 32  115 166 39  119 171 41
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  118 170 40  109 157 37  26 37 9
+0 0 0  0 0 0  0 0 0  0 0 0  64 92 22  118 171 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  118 170 40  118 171 40  109 157 37
+89 128 30  81 118 28  100 144 34  115 166 39  117 169 40  117 169 40
+117 169 40  117 170 40  113 163 39  60 86 20  1 1 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+27 40 9  96 138 32  118 170 40  117 169 40  117 169 40  117 169 40
+117 170 40  117 169 40  101 146 34  67 96 23  55 80 19  84 121 28
+113 163 39  119 171 41  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  119 171 41  65 94 22
+0 0 0  0 0 0  0 0 0  15 21 5  101 146 34  118 171 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  118 170 40  118 171 40  104 150 35  69 100 23  53 76 18
+81 118 28  111 160 38  118 170 40  117 169 40  117 169 40  117 169 40
+117 169 40  114 165 39  69 100 23  10 15 3  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 1 0
+31 45 11  77 111 26  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  118 170 40  116 168 40  92 132 31  47 69 16
+38 55 13  81 118 28  113 163 39  119 171 41  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  118 171 41  92 132 31
+10 15 3  0 0 0  0 0 0  36 52 12  115 166 39  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  118 170 40
+118 171 40  102 148 35  64 92 22  34 49 12  65 94 22  106 153 36
+118 171 40  117 170 40  117 169 40  117 169 40  117 169 40  117 169 40
+118 170 40  107 154 36  55 80 19  15 21 5  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+29 42 10  101 146 34  118 171 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  118 171 40  113 163 39
+75 109 26  27 40 9  36 52 12  89 128 30  116 167 40  118 171 40
+117 169 40  117 169 40  117 169 40  117 169 40  118 170 40  104 150 35
+16 23 5  0 0 0  0 0 0  53 76 18  118 171 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  119 171 41  109 157 37
+67 96 23  23 34 8  42 61 14  96 138 32  118 170 40  118 170 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  74 107 25  10 15 3  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  31 45 11  101 146 34  118 170 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+119 171 41  102 148 35  47 69 16  14 20 5  50 72 17  102 148 35
+118 171 40  117 169 40  117 169 40  117 169 40  118 170 40  102 148 35
+15 21 5  0 0 0  0 0 0  50 72 17  118 170 40  117 169 40
+117 169 40  117 169 40  118 170 40  116 167 40  84 121 28  27 40 9
+19 27 6  74 107 25  114 165 39  118 171 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  75 109 26  10 15 4  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  38 55 13  102 148 35  118 171 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  118 170 40  115 167 39  77 111 26  17 25 6  19 27 6
+77 111 26  115 166 39  118 170 40  117 169 40  119 172 41  81 118 28
+3 4 1  0 0 0  0 0 0  27 40 9  111 160 38  118 170 40
+117 169 40  118 171 40  105 151 36  50 72 17  10 15 3  38 55 13
+100 144 34  118 171 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  79 115 27  15 21 5  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  10 15 3  64 92 22  111 160 38  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  118 171 40  96 138 32  32 47 11
+3 4 1  50 72 17  107 154 36  120 173 41  105 151 36  31 45 11
+0 0 0  0 0 0  0 0 0  3 4 1  65 94 22  117 169 40
+118 170 40  89 128 30  26 37 9  3 4 1  60 86 20  111 161 38
+118 171 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+97 141 33  36 52 12  1 1 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  14 20 5  75 109 26  117 168 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  118 171 40  107 154 36
+45 64 15  2 3 1  31 45 11  75 109 26  32 47 11  0 1 0
+0 0 0  0 0 0  0 0 0  0 0 0  10 15 3  55 80 19
+65 94 22  11 16 4  11 16 4  75 109 26  116 168 40  118 170 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  118 170 40  107 154 36
+47 69 16  3 4 1  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  12 18 4  69 100 23  111 161 38  118 171 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  118 170 40
+111 160 38  50 72 17  2 3 1  2 3 1  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 1 0
+1 1 0  12 18 4  81 118 28  118 170 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 170 40  118 171 40  101 146 34
+42 61 14  2 3 1  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  3 4 1  36 52 12  89 128 30
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+118 171 41  101 146 34  14 20 5  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  47 69 16  118 170 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 170 40  111 160 38  69 100 23  19 27 6
+0 1 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  11 16 4  69 100 23
+115 167 39  119 172 41  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+119 172 41  75 109 26  3 4 1  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  23 34 8  106 153 36  118 170 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+117 169 40  118 170 40  119 172 41  105 151 36  42 61 14  2 3 1
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  1 1 0  15 21 5
+45 64 15  80 116 27  114 165 39  118 170 40  117 169 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  119 172 41
+97 141 33  20 30 7  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  1 1 0  53 76 18  114 165 39  118 171 40  117 169 40
+117 169 40  117 169 40  117 169 40  117 169 40  117 169 40  117 169 40
+118 171 40  104 150 35  64 92 22  31 45 11  10 15 3  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  36 52 12  97 141 33  109 158 37  113 163 39  116 168 40
+117 169 40  117 170 40  118 170 40  119 172 41  115 167 39  84 121 28
+23 34 8  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  3 4 1  50 72 17  102 148 35  118 171 40
+119 171 41  118 170 40  117 169 40  117 169 40  115 166 39  111 161 38
+109 157 37  79 115 27  12 18 4  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  3 4 1  15 21 5  23 34 8  45 64 15  106 153 36
+116 167 40  111 160 38  101 146 34  79 115 27  42 61 14  10 15 3
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  1 1 0  20 30 7  60 86 20
+89 128 30  106 153 36  113 163 39  117 169 40  84 121 28  29 42 10
+19 27 6  10 15 3  2 3 1  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  16 23 5  38 55 13
+36 52 12  26 37 9  12 18 4  2 3 1  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  1 0 0  19 2 7  52 5 18
+78 7 27  88 8 31  81 7 29  56 5 19  25 2 9  3 0 1
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+3 4 1  19 27 6  31 45 11  38 55 13  32 47 11  3 4 1
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  3 0 1
+9 0 3  12 1 4  9 0 3  4 0 1  0 0 0  0 0 0
+0 0 0  0 0 0  28 3 10  99 9 35  156 14 55  182 16 64
+189 17 66  190 17 67  189 17 66  184 17 65  166 15 58  118 13 41
+45 4 16  3 0 1  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  11 1 4  52 5 18  101 9 35  134 12 47
+151 14 53  154 14 54  151 14 53  113 10 40  11 1 4  0 0 0
+3 0 1  67 6 24  159 14 56  190 17 67  190 17 67  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  191 17 67
+174 16 61  101 9 35  14 1 5  0 0 0  35 3 12  108 10 38
+122 11 43  122 11 43  112 10 39  87 8 30  50 5 17  13 1 5
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+3 0 1  56 5 19  141 13 49  182 16 64  191 17 67  191 17 67
+190 17 67  190 17 67  191 17 67  113 10 40  3 0 1  1 0 0
+79 7 28  180 16 63  190 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+189 17 66  188 17 66  122 11 43  11 1 4  41 4 14  176 16 62
+191 17 67  191 17 67  191 17 67  190 17 67  181 16 63  146 13 51
+75 7 26  10 1 4  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  7 1 2
+90 8 32  178 16 62  191 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  190 17 67  141 13 49  22 2 8  0 0 0  41 4 14
+173 16 61  190 17 67  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  88 8 31  1 0 0  89 8 31
+185 17 65  189 17 66  188 17 66  188 17 66  189 17 66  191 17 67
+186 17 65  124 11 43  25 2 9  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  2 0 1  89 8 31
+184 17 65  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+190 17 67  151 14 53  34 3 12  0 0 0  0 0 0  79 7 28
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  191 17 67  146 13 51  9 1 3  7 1 2
+108 10 38  187 17 66  189 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  190 17 67  141 13 49  22 2 8  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  52 5 18  176 16 62
+189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
+151 14 53  38 3 13  0 0 0  0 0 0  0 0 0  50 5 17
+180 16 63  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  191 17 67  141 13 49  7 1 3  0 0 0
+11 1 4  112 10 39  187 17 66  189 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  190 17 67  113 10 40  5 0 2  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  7 1 3  132 12 46  191 17 67
+188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  146 13 51
+35 3 12  0 0 0  0 0 0  0 0 0  0 0 0  5 0 2
+101 9 35  185 17 65  190 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  190 17 67  180 16 63  67 6 24  0 0 0  0 0 0
+0 0 0  11 1 4  108 10 38  186 17 65  189 17 66  188 17 66
+188 17 66  188 17 66  189 17 66  180 16 63  56 5 19  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  44 4 15  177 16 62  189 17 66
+188 17 66  188 17 66  189 17 66  189 17 66  134 12 47  28 3 10
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+8 1 3  79 7 28  159 14 56  188 17 66  191 17 67  190 17 67
+189 17 66  189 17 66  189 17 66  189 17 66  190 17 67  191 17 67
+188 17 66  158 14 55  72 7 25  4 0 1  0 0 0  0 0 0
+0 0 0  0 0 0  8 1 3  95 9 33  182 16 64  189 17 67
+188 17 66  188 17 66  188 17 66  191 17 67  122 11 43  3 0 1
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  88 8 31  190 17 67  188 17 66
+188 17 66  189 17 66  185 17 65  113 10 40  18 2 6  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  1 0 0  24 2 8  77 7 27  124 11 43  154 14 54
+168 15 59  173 16 61  173 16 61  168 15 59  154 14 54  124 11 43
+77 7 27  22 2 8  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  5 0 2  77 7 27  173 16 61
+190 17 67  188 17 66  188 17 66  190 17 67  164 15 57  23 2 8
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  1 0 0  118 13 41  191 17 67  188 17 66
+190 17 67  174 16 61  87 8 30  8 1 3  0 0 0  0 0 0
+0 0 0  0 0 0  10 1 4  29 3 10  40 4 14  36 3 13
+18 2 6  2 0 1  0 0 0  0 0 0  3 0 1  14 1 5
+26 2 9  33 3 11  32 3 11  25 2 9  13 1 5  3 0 1
+0 0 0  14 1 5  56 5 19  95 9 33  109 10 38  101 9 35
+77 7 27  35 3 12  5 0 2  0 0 0  1 0 0  56 5 19
+156 14 55  190 17 67  188 17 66  188 17 66  182 16 64  50 5 17
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  5 0 2  134 12 47  191 17 67  189 17 66
+151 14 53  52 5 18  2 0 1  0 0 0  0 0 0  1 0 0
+28 3 10  90 8 32  146 13 51  170 15 60  178 16 62  174 16 61
+158 14 55  112 10 39  40 4 14  1 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  3 0 1
+56 5 19  146 13 51  183 17 64  191 17 67  191 17 67  191 17 67
+188 17 66  173 16 61  122 11 43  41 4 14  1 0 0  0 0 0
+30 3 10  124 11 43  185 17 65  190 17 67  187 17 66  67 6 24
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  6 1 2  134 12 47  168 15 59  99 9 35
+21 2 7  0 0 0  0 0 0  0 0 0  6 1 2  77 7 27
+162 15 57  190 17 67  191 17 67  189 17 66  189 17 66  189 17 66
+190 17 67  191 17 67  169 15 59  75 7 26  3 0 1  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  2 0 1  79 7 28
+178 16 62  191 17 67  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  189 17 66  191 17 67  170 15 60  79 7 28  5 0 2
+0 0 0  10 1 3  78 7 27  159 14 56  188 17 66  75 7 26
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  1 0 0  35 3 12  29 3 10  2 0 1
+0 0 0  0 0 0  0 0 0  9 1 3  101 9 35  183 17 64
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  190 17 67  178 16 63  67 6 23  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  52 5 18  174 16 61
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  190 17 67  182 16 64  89 8 31
+4 0 1  0 0 0  0 0 0  25 2 9  73 7 26  31 3 11
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  4 0 1  98 9 34  187 17 66  189 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  190 17 67  158 14 55  25 2 9
+0 0 0  0 0 0  0 0 0  8 1 3  134 12 47  191 17 67
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  189 17 66  180 16 63
+68 6 24  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  6 1 2  19 2 7  3 0 1  0 0 0  0 0 0
+0 0 0  0 0 0  65 6 23  180 16 63  189 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  189 17 66  83 8 29
+0 0 0  0 0 0  0 0 0  41 4 14  177 16 62  189 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
+159 14 56  28 3 10  0 0 0  0 0 0  0 0 0  23 2 8
+41 4 14  5 0 2  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+23 2 8  113 10 40  159 14 56  65 6 23  0 0 0  0 0 0
+0 0 0  16 1 6  146 13 51  191 17 67  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  191 17 67  132 12 46
+5 0 2  0 0 0  0 0 0  77 7 27  189 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+190 17 67  98 9 34  0 0 0  0 0 0  12 1 4  134 12 47
+178 16 63  108 10 38  16 1 6  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  30 3 10
+141 13 49  190 17 67  191 17 67  134 12 47  6 1 2  0 0 0
+0 0 0  68 6 24  186 17 65  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  156 14 55
+14 1 5  0 0 0  0 0 0  98 9 34  191 17 67  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+190 17 67  156 14 55  19 2 7  0 0 0  47 4 16  181 16 63
+190 17 67  189 17 66  126 14 44  17 2 6  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  16 1 6  134 12 47
+191 17 67  188 17 66  190 17 67  162 15 57  19 2 7  0 0 0
+3 0 1  123 11 43  191 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  163 15 57
+20 2 7  0 0 0  0 0 0  101 9 35  191 17 67  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  182 16 64  52 5 18  0 0 0  73 7 26  188 17 66
+188 17 66  188 17 66  189 17 66  109 10 38  5 0 2  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  95 9 33  189 17 66
+188 17 66  188 17 66  189 17 66  171 15 60  29 3 10  0 0 0
+16 1 6  156 14 55  190 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  158 14 55
+17 2 6  0 0 0  0 0 0  85 8 30  190 17 67  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  189 17 66  81 7 29  0 0 0  85 8 30  190 17 67
+188 17 66  188 17 66  189 17 66  180 16 63  56 5 19  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  25 2 9  162 15 57  190 17 67
+188 17 66  188 17 66  189 17 66  173 16 61  31 3 11  0 0 0
+30 3 10  171 15 60  189 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  191 17 67  141 13 49
+7 1 2  0 0 0  0 0 0  56 5 19  183 17 64  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  191 17 67  98 9 34  0 0 0  88 8 31  190 17 67
+188 17 66  188 17 66  188 17 66  191 17 67  124 11 43  5 0 2
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  68 6 24  187 17 66  188 17 66
+188 17 66  188 17 66  189 17 66  170 15 60  28 3 10  0 0 0
+34 3 12  174 16 61  189 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  191 17 67  101 9 35
+0 0 0  0 0 0  0 0 0  21 2 7  159 14 56  190 17 67
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  191 17 67  98 9 34  0 0 0  81 7 29  189 17 66
+188 17 66  188 17 66  188 17 66  189 17 66  168 15 59  28 3 10
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  109 10 38  191 17 67  188 17 66
+188 17 66  188 17 66  190 17 67  163 15 57  21 2 7  0 0 0
+26 2 9  168 15 59  189 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  189 17 66  180 16 63  47 4 16
+0 0 0  0 0 0  0 0 0  0 0 0  108 10 38  190 17 67
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  189 17 66  78 7 27  0 0 0  68 6 24  187 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  183 17 64  56 5 19
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  3 0 1  131 12 46  191 17 67  188 17 66
+188 17 66  188 17 66  190 17 67  151 14 53  12 1 4  0 0 0
+11 1 4  146 13 51  190 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  191 17 67  126 14 44  7 1 2
+0 0 0  0 0 0  0 0 0  0 0 0  32 3 11  164 15 58
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+189 17 66  178 16 62  44 4 15  0 0 0  50 5 17  182 16 64
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  72 7 25
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  5 0 2  134 12 47  191 17 67  188 17 66
+188 17 66  188 17 66  191 17 67  131 12 46  3 0 1  0 0 0
+0 0 0  101 9 35  190 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  190 17 67  170 15 60  44 4 15  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  77 7 27
+183 17 64  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+191 17 67  134 12 47  9 1 3  0 0 0  31 3 11  171 15 60
+189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  72 7 25
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  2 0 1  124 11 43  191 17 67  188 17 66
+188 17 66  188 17 66  191 17 67  101 9 35  0 0 0  0 0 0
+0 0 0  35 3 12  168 15 59  190 17 67  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  189 17 66  182 16 64  77 7 27  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  6 1 2
+99 9 35  185 17 65  189 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  189 17 66
+177 16 62  56 5 19  0 0 0  0 0 0  13 1 5  151 14 53
+190 17 67  188 17 66  188 17 66  188 17 66  185 17 65  56 5 19
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  99 9 35  191 17 67  188 17 66
+188 17 66  188 17 66  186 17 65  65 6 23  0 0 0  0 0 0
+0 0 0  0 0 0  79 7 28  182 16 64  190 17 67  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+191 17 67  177 16 62  83 8 29  4 0 1  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+8 1 3  89 8 31  175 16 62  191 17 67  189 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  181 16 63
+85 8 30  3 0 1  0 0 0  0 0 0  1 0 0  118 13 41
+191 17 67  188 17 66  188 17 66  189 17 66  173 16 61  34 3 12
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  56 5 19  183 17 64  188 17 66
+188 17 66  189 17 66  169 15 59  30 3 10  0 0 0  0 0 0
+0 0 0  0 0 0  5 0 2  83 8 29  173 16 61  191 17 67
+190 17 67  189 17 66  189 17 66  190 17 67  191 17 67  187 17 66
+151 14 53  56 5 19  3 0 1  0 0 0  16 1 6  50 5 17
+79 7 28  95 9 33  95 9 33  75 7 26  41 4 14  10 1 4
+0 0 0  2 0 1  50 5 17  132 12 46  178 16 62  190 17 67
+191 17 67  191 17 67  191 17 67  186 17 65  154 14 54  68 6 24
+4 0 1  0 0 0  0 0 0  0 0 0  0 0 0  72 7 25
+187 17 66  188 17 66  188 17 66  191 17 67  141 13 49  9 1 3
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  14 1 5  151 14 53  190 17 67
+188 17 66  191 17 67  131 12 46  5 0 2  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  2 0 1  44 4 15  113 10 40
+156 14 55  173 16 61  174 16 61  164 15 58  134 12 47  77 7 27
+18 2 6  0 0 0  16 1 6  85 8 30  151 14 53  182 16 64
+189 17 66  191 17 67  190 17 67  188 17 66  177 16 62  141 13 49
+68 6 24  8 1 3  0 0 0  8 1 3  44 4 15  88 8 31
+113 10 40  122 11 43  108 10 38  67 6 24  20 2 7  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  28 3 10
+166 15 58  190 17 67  188 17 66  187 17 66  79 7 28  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  73 7 26  185 17 65
+189 17 66  184 17 65  65 6 23  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  2 0 1
+17 2 6  32 3 11  34 3 12  22 2 8  6 1 2  0 0 0
+0 0 0  38 3 13  141 13 49  188 17 66  190 17 67  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  189 17 66  191 17 67
+184 17 65  122 11 43  21 2 7  0 0 0  0 0 0  0 0 0
+0 0 0  1 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 0 0
+108 10 38  191 17 67  191 17 67  141 13 49  16 1 6  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  8 1 3  112 10 39
+186 17 65  124 11 43  10 1 4  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+36 3 13  156 14 55  191 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+189 17 66  190 17 67  134 12 47  18 2 6  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  7 1 2  41 4 14  75 7 26  66 5 23  19 2 7
+26 2 9  144 13 50  154 14 54  40 4 14  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  13 1 5
+56 5 19  19 2 7  0 0 0  7 1 2  29 3 10  35 3 12
+19 2 7  2 0 1  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  13 1 5
+134 12 47  191 17 67  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  189 17 67  108 10 38  3 0 1  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 0 0
+40 4 14  124 11 43  177 16 62  188 17 66  187 17 66  144 13 50
+24 2 8  17 2 6  22 2 8  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  19 2 7  122 11 43  171 15 60  175 16 62
+159 14 56  112 10 39  40 4 14  2 0 1  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  72 7 25
+186 17 65  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  189 17 66  174 16 61  41 4 14  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  3 0 1  72 7 25
+168 15 59  191 17 67  189 17 66  188 17 66  188 17 66  190 17 67
+95 9 33  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  95 9 33  191 17 67  189 17 66  189 17 66
+190 17 67  191 17 67  171 15 60  90 8 32  12 1 4  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  5 0 2  132 12 46
+191 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  190 17 67  98 9 34  0 0 0
+0 0 0  0 0 0  0 0 0  5 0 2  88 8 31  180 16 63
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  191 17 67
+146 13 51  11 1 4  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  9 1 3  144 13 50  191 17 67  188 17 66  188 17 66
+188 17 66  188 17 66  189 17 66  187 17 66  123 11 43  20 2 7
+0 0 0  0 0 0  0 0 0  0 0 0  21 2 7  163 15 57
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  191 17 67  134 12 47  5 0 2
+0 0 0  0 0 0  3 0 1  88 8 31  182 16 64  189 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  189 17 66
+171 15 60  31 3 11  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  20 2 7  162 15 57  190 17 67  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  132 12 46
+20 2 7  0 0 0  0 0 0  0 0 0  32 3 11  173 16 61
+189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  190 17 67  151 14 53  12 1 4
+0 0 0  0 0 0  72 7 25  180 16 63  189 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+181 16 63  47 4 16  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  21 2 7  163 15 57  190 17 67  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
+122 11 43  9 1 3  0 0 0  0 0 0  30 3 10  171 15 60
+189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  190 17 67  146 13 51  10 1 4
+0 0 0  38 3 13  166 15 58  190 17 67  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+183 17 64  52 5 18  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  13 1 5  154 14 54  190 17 67  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+186 17 65  79 7 28  0 0 0  0 0 0  14 1 5  156 14 54
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  191 17 67  124 11 43  2 0 1
+5 0 2  122 11 43  191 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+182 16 64  47 4 16  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  3 0 1  126 14 44  191 17 67  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+190 17 67  158 14 55  23 2 8  0 0 0  1 0 0  113 10 40
+191 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  78 7 27  0 0 0
+47 4 16  177 16 62  189 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  189 17 66
+173 16 61  34 3 12  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  85 8 30  189 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  79 7 28  0 0 0  0 0 0  47 4 16
+175 16 62  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  190 17 67  156 14 55  22 2 8  0 0 0
+109 10 38  191 17 67  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
+151 14 53  13 1 5  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  35 3 12  173 16 61  189 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  191 17 67  134 12 47  7 1 2  0 0 0  3 0 1
+99 9 35  188 17 66  189 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  189 17 66  181 16 63  68 6 24  0 0 0  18 2 6
+156 14 55  190 17 67  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  190 17 67
+101 9 35  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  3 0 1  118 13 41  191 17 67  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  189 17 66  168 15 59  28 3 10  0 0 0  0 0 0
+12 1 4  113 10 40  187 17 66  189 17 67  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+190 17 67  180 16 63  88 8 31  4 0 1  0 0 0  47 4 16
+180 16 63  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  190 17 67  168 15 59
+36 3 13  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  38 3 13  164 15 58  190 17 67
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  182 16 64  50 5 17  0 0 0  0 0 0
+0 0 0  11 1 4  90 8 32  169 15 59  190 17 67  190 17 67
+189 17 66  189 17 66  189 17 66  189 17 66  191 17 67  189 17 66
+158 14 55  68 6 24  4 0 1  0 0 0  0 0 0  73 7 26
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  189 17 66  185 17 65  83 8 29
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  65 6 23  174 16 61
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  185 17 65  56 5 19  0 0 0  0 0 0
+0 0 0  0 0 0  2 0 1  35 3 12  99 9 35  146 13 51
+170 15 60  177 16 62  177 16 62  166 15 58  141 13 49  85 8 30
+24 2 8  0 0 0  0 0 0  0 0 0  0 0 0  85 8 30
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  189 17 66  112 10 39  8 1 3
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  1 0 0  68 6 24
+170 15 60  191 17 67  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  182 16 64  50 5 17  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  1 0 0  11 1 4
+28 3 10  40 4 14  38 3 13  25 2 9  8 1 3  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  78 7 27
+189 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  189 17 66  187 17 66  113 10 40  14 1 5  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  1 0 0
+47 4 16  141 13 49  186 17 65  191 17 67  190 17 67  189 17 66
+189 17 66  191 17 67  156 14 55  20 2 7  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  44 4 15
+178 16 62  190 17 67  188 17 66  188 17 66  188 17 66  190 17 67
+191 17 67  173 16 61  90 8 32  10 1 4  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  14 1 5  68 6 24  131 12 46  162 15 57  174 16 61
+171 15 60  146 13 51  56 5 19  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  3 0 1  14 1 5  29 3 10
+41 4 14  47 4 16  50 5 17  45 4 16  34 3 12  18 2 6
+5 0 2  0 0 0  0 0 0  0 0 0  0 0 0  5 0 2
+90 8 32  169 15 59  185 17 65  187 17 66  182 16 64  163 15 57
+113 10 40  41 4 14  2 0 1  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  5 0 2  21 2 7  34 3 12
+29 3 10  11 1 4  0 0 0  0 0 0  0 0 0  0 0 0
+3 0 1  32 3 11  79 7 28  124 11 43  154 14 54  171 15 60
+180 16 63  182 16 64  182 16 64  180 16 63  174 16 61  159 14 56
+132 12 46  88 8 31  34 3 12  3 0 1  0 0 0  0 0 0
+3 0 1  29 3 10  56 5 19  65 6 23  50 5 17  23 2 8
+3 0 1  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  25 2 9
+109 10 38  169 15 59  189 17 66  191 17 67  190 17 67  189 17 66
+189 17 66  188 17 66  188 17 66  188 17 66  189 17 66  190 17 67
+191 17 67  190 17 67  171 15 60  98 9 34  10 1 3  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  14 1 5  141 13 49
+191 17 67  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  189 17 67  186 17 65  65 6 23  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  23 2 8  166 15 58
+190 17 67  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  189 17 66  176 16 62  45 4 16  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  1 0 0  83 8 29
+183 17 64  189 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+188 17 66  189 17 66  185 17 65  95 9 33  3 0 1  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  5 0 2
+85 8 30  176 16 62  191 17 67  188 17 66  188 17 66  188 17 66
+188 17 66  188 17 66  188 17 66  188 17 66  188 17 66  188 17 66
+191 17 67  180 16 63  95 9 33  7 1 3  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+2 0 1  52 5 18  141 13 49  185 17 65  191 17 67  189 17 67
+189 17 66  188 17 66  188 17 66  189 17 66  191 17 67  187 17 66
+146 13 51  56 5 19  4 0 1  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  14 1 5  68 6 24  131 12 46  166 15 58
+180 16 63  183 17 64  180 16 63  168 15 59  134 12 47  75 7 26
+17 2 6  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  5 0 2  24 2 8
+44 4 15  52 5 18  45 4 16  26 2 9  6 1 2  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0  0 0 0  0 0 0  0 0 0
+0 0 0  0 0 0  0 0 0
diff --git a/drivers/w1/masters/w1-gpio.c b/drivers/w1/masters/w1-gpio.c
index a90728ceec5a..43286a26b596 100644
--- a/drivers/w1/masters/w1-gpio.c
+++ b/drivers/w1/masters/w1-gpio.c
@@ -22,6 +22,19 @@
 
 #include <linux/w1.h>
 
+static int w1_gpio_pullup = 0;
+static int w1_gpio_pullup_orig = 0;
+module_param_named(pullup, w1_gpio_pullup, int, 0);
+MODULE_PARM_DESC(pullup, "Enable parasitic power (power on data) mode");
+static int w1_gpio_pullup_pin = -1;
+static int w1_gpio_pullup_pin_orig = -1;
+module_param_named(extpullup, w1_gpio_pullup_pin, int, 0);
+MODULE_PARM_DESC(extpullup, "GPIO external pullup pin number");
+static int w1_gpio_pin = -1;
+static int w1_gpio_pin_orig = -1;
+module_param_named(gpiopin, w1_gpio_pin, int, 0);
+MODULE_PARM_DESC(gpiopin, "GPIO pin number");
+
 static u8 w1_gpio_set_pullup(void *data, int delay)
 {
 	struct w1_gpio_platform_data *pdata = data;
@@ -66,6 +79,16 @@ static u8 w1_gpio_read_bit(void *data)
 	return gpio_get_value(pdata->pin) ? 1 : 0;
 }
 
+static void w1_gpio_bitbang_pullup(void *data, u8 on)
+{
+	struct w1_gpio_platform_data *pdata = data;
+
+	if (on)
+		gpio_direction_output(pdata->pin, 1);
+	else
+		gpio_direction_input(pdata->pin);
+}
+
 #if defined(CONFIG_OF)
 static const struct of_device_id w1_gpio_dt_ids[] = {
 	{ .compatible = "w1-gpio" },
@@ -79,6 +102,7 @@ static int w1_gpio_probe_dt(struct platform_device *pdev)
 	struct w1_gpio_platform_data *pdata = dev_get_platdata(&pdev->dev);
 	struct device_node *np = pdev->dev.of_node;
 	int gpio;
+	u32 value;
 
 	pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
 	if (!pdata)
@@ -87,6 +111,9 @@ static int w1_gpio_probe_dt(struct platform_device *pdev)
 	if (of_get_property(np, "linux,open-drain", NULL))
 		pdata->is_open_drain = 1;
 
+	if (of_property_read_u32(np, "rpi,parasitic-power", &value) == 0)
+	    pdata->parasitic_power = (value != 0);
+
 	gpio = of_get_gpio(np, 0);
 	if (gpio < 0) {
 		if (gpio != -EPROBE_DEFER)
@@ -102,7 +129,7 @@ static int w1_gpio_probe_dt(struct platform_device *pdev)
 	if (gpio == -EPROBE_DEFER)
 		return gpio;
 	/* ignore other errors as the pullup gpio is optional */
-	pdata->ext_pullup_enable_pin = gpio;
+	pdata->ext_pullup_enable_pin = (gpio >= 0) ? gpio : -1;
 
 	pdev->dev.platform_data = pdata;
 
@@ -112,13 +139,15 @@ static int w1_gpio_probe_dt(struct platform_device *pdev)
 static int w1_gpio_probe(struct platform_device *pdev)
 {
 	struct w1_bus_master *master;
-	struct w1_gpio_platform_data *pdata;
+	struct w1_gpio_platform_data *pdata = pdev->dev.platform_data;
 	int err;
 
-	if (of_have_populated_dt()) {
-		err = w1_gpio_probe_dt(pdev);
-		if (err < 0)
-			return err;
+	if(pdata == NULL) {
+		if (of_have_populated_dt()) {
+			err = w1_gpio_probe_dt(pdev);
+			if (err < 0)
+				return err;
+		}
 	}
 
 	pdata = dev_get_platdata(&pdev->dev);
@@ -135,6 +164,22 @@ static int w1_gpio_probe(struct platform_device *pdev)
 		return -ENOMEM;
 	}
 
+	w1_gpio_pin_orig = pdata->pin;
+	w1_gpio_pullup_pin_orig = pdata->ext_pullup_enable_pin;
+	w1_gpio_pullup_orig = pdata->parasitic_power;
+
+	if(gpio_is_valid(w1_gpio_pin)) {
+		pdata->pin = w1_gpio_pin;
+		pdata->ext_pullup_enable_pin = -1;
+		pdata->parasitic_power = -1;
+	}
+	pdata->parasitic_power |= w1_gpio_pullup;
+	if(gpio_is_valid(w1_gpio_pullup_pin)) {
+		pdata->ext_pullup_enable_pin = w1_gpio_pullup_pin;
+	}
+
+	dev_info(&pdev->dev, "gpio pin %d, external pullup pin %d, parasitic power %d\n", pdata->pin, pdata->ext_pullup_enable_pin, pdata->parasitic_power);
+
 	err = devm_gpio_request(&pdev->dev, pdata->pin, "w1");
 	if (err) {
 		dev_err(&pdev->dev, "gpio_request (pin) failed\n");
@@ -164,6 +209,14 @@ static int w1_gpio_probe(struct platform_device *pdev)
 		master->set_pullup = w1_gpio_set_pullup;
 	}
 
+	if (pdata->parasitic_power) {
+		if (pdata->is_open_drain)
+			printk(KERN_ERR "w1-gpio 'pullup'(parasitic power) "
+			       "option doesn't work with open drain GPIO\n");
+		else
+			master->bitbang_pullup = w1_gpio_bitbang_pullup;
+	}
+
 	err = w1_add_master_device(master);
 	if (err) {
 		dev_err(&pdev->dev, "w1_add_master device failed\n");
@@ -194,6 +247,10 @@ static int w1_gpio_remove(struct platform_device *pdev)
 
 	w1_remove_master_device(master);
 
+	pdata->pin = w1_gpio_pin_orig;
+	pdata->ext_pullup_enable_pin = w1_gpio_pullup_pin_orig;
+	pdata->parasitic_power = w1_gpio_pullup_orig;
+
 	return 0;
 }
 
diff --git a/drivers/w1/w1_int.c b/drivers/w1/w1_int.c
index 1c776178f598..d17bc2db1c26 100644
--- a/drivers/w1/w1_int.c
+++ b/drivers/w1/w1_int.c
@@ -114,6 +114,20 @@ int w1_add_master_device(struct w1_bus_master *master)
 		return(-EINVAL);
 	}
 
+	/* bitbanging hardware uses bitbang_pullup, other hardware uses set_pullup
+	 * and takes care of timing itself */
+	if (!master->write_byte && !master->touch_bit && master->set_pullup) {
+		printk(KERN_ERR "w1_add_master_device: set_pullup requires "
+			"write_byte or touch_bit, disabling\n");
+		master->set_pullup = NULL;
+	}
+
+	if (master->set_pullup && master->bitbang_pullup) {
+		printk(KERN_ERR "w1_add_master_device: set_pullup should not "
+		       "be set when bitbang_pullup is used, disabling\n");
+		master->set_pullup = NULL;
+	}
+
 	/* Lock until the device is added (or not) to w1_masters. */
 	mutex_lock(&w1_mlock);
 	/* Search for the first available id (starting at 1). */
diff --git a/drivers/w1/w1_io.c b/drivers/w1/w1_io.c
index d191e1f80579..81d4efd57b8e 100644
--- a/drivers/w1/w1_io.c
+++ b/drivers/w1/w1_io.c
@@ -126,10 +126,22 @@ static void w1_pre_write(struct w1_master *dev)
 static void w1_post_write(struct w1_master *dev)
 {
 	if (dev->pullup_duration) {
-		if (dev->enable_pullup && dev->bus_master->set_pullup)
-			dev->bus_master->set_pullup(dev->bus_master->data, 0);
-		else
+		if (dev->enable_pullup) {
+			if (dev->bus_master->set_pullup) {
+				dev->bus_master->set_pullup(dev->
+							    bus_master->data,
+							    0);
+			} else if (dev->bus_master->bitbang_pullup) {
+				dev->bus_master->
+				    bitbang_pullup(dev->bus_master->data, 1);
+			msleep(dev->pullup_duration);
+				dev->bus_master->
+				    bitbang_pullup(dev->bus_master->data, 0);
+			}
+		} else {
 			msleep(dev->pullup_duration);
+		}
+
 		dev->pullup_duration = 0;
 	}
 }
diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
index b339e0e67b4c..26b7177573fa 100644
--- a/drivers/watchdog/bcm2835_wdt.c
+++ b/drivers/watchdog/bcm2835_wdt.c
@@ -34,13 +34,7 @@
 #define PM_RSTC_WRCFG_SET		0x00000030
 #define PM_RSTC_WRCFG_FULL_RESET	0x00000020
 #define PM_RSTC_RESET			0x00000102
-
-/*
- * The Raspberry Pi firmware uses the RSTS register to know which partition
- * to boot from. The partition value is spread into bits 0, 2, 4, 6, 8, 10.
- * Partition 63 is a special partition used by the firmware to indicate halt.
- */
-#define PM_RSTS_RASPBERRYPI_HALT	0x555
+#define PM_RSTS_PARTITION_CLR          0xfffffaaa
 
 #define SECS_TO_WDOG_TICKS(x) ((x) << 16)
 #define WDOG_TICKS_TO_SECS(x) ((x) >> 16)
@@ -97,9 +91,24 @@ static unsigned int bcm2835_wdt_get_timeleft(struct watchdog_device *wdog)
 	return WDOG_TICKS_TO_SECS(ret & PM_WDOG_TIME_SET);
 }
 
-static void __bcm2835_restart(struct bcm2835_wdt *wdt)
+/*
+ * The Raspberry Pi firmware uses the RSTS register to know which partiton
+ * to boot from. The partiton value is spread into bits 0, 2, 4, 6, 8, 10.
+ * Partiton 63 is a special partition used by the firmware to indicate halt.
+ */
+
+static void __bcm2835_restart(struct bcm2835_wdt *wdt, u8 partition)
 {
-	u32 val;
+	u32 val, rsts;
+
+	rsts = (partition & BIT(0)) | ((partition & BIT(1)) << 1) |
+	       ((partition & BIT(2)) << 2) | ((partition & BIT(3)) << 3) |
+	       ((partition & BIT(4)) << 4) | ((partition & BIT(5)) << 5);
+
+	val = readl_relaxed(wdt->base + PM_RSTS);
+	val &= PM_RSTS_PARTITION_CLR;
+	val |= PM_PASSWORD | rsts;
+	writel_relaxed(val, wdt->base + PM_RSTS);
 
 	/* use a timeout of 10 ticks (~150us) */
 	writel_relaxed(10 | PM_PASSWORD, wdt->base + PM_WDOG);
@@ -117,7 +126,13 @@ static int bcm2835_restart(struct watchdog_device *wdog,
 {
 	struct bcm2835_wdt *wdt = watchdog_get_drvdata(wdog);
 
-	__bcm2835_restart(wdt);
+	unsigned long long val;
+	u8 partition = 0;
+
+	if (data && !kstrtoull(data, 0, &val) && val <= 63)
+		partition = val;
+
+	__bcm2835_restart(wdt, partition);
 
 	return 0;
 }
@@ -155,19 +170,9 @@ static void bcm2835_power_off(void)
 		of_find_compatible_node(NULL, NULL, "brcm,bcm2835-pm-wdt");
 	struct platform_device *pdev = of_find_device_by_node(np);
 	struct bcm2835_wdt *wdt = platform_get_drvdata(pdev);
-	u32 val;
-
-	/*
-	 * We set the watchdog hard reset bit here to distinguish this reset
-	 * from the normal (full) reset. bootcode.bin will not reboot after a
-	 * hard reset.
-	 */
-	val = readl_relaxed(wdt->base + PM_RSTS);
-	val |= PM_PASSWORD | PM_RSTS_RASPBERRYPI_HALT;
-	writel_relaxed(val, wdt->base + PM_RSTS);
 
-	/* Continue with normal reset mechanism */
-	__bcm2835_restart(wdt);
+	/* Partition 63 tells the firmware that this is a halt */
+	__bcm2835_restart(wdt, 63);
 }
 
 static int bcm2835_wdt_probe(struct platform_device *pdev)
diff --git a/include/linux/broadcom/bcm2835_smi.h b/include/linux/broadcom/bcm2835_smi.h
new file mode 100644
index 000000000000..ee3a75edfc03
--- /dev/null
+++ b/include/linux/broadcom/bcm2835_smi.h
@@ -0,0 +1,391 @@
+/**
+ * Declarations and definitions for Broadcom's Secondary Memory Interface
+ *
+ * Written by Luke Wren <luke@raspberrypi.org>
+ * Copyright (c) 2015, Raspberry Pi (Trading) Ltd.
+ * Copyright (c) 2010-2012 Broadcom. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2, as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BCM2835_SMI_H
+#define BCM2835_SMI_H
+
+#include <linux/ioctl.h>
+
+#ifndef __KERNEL__
+#include <stdint.h>
+#include <stdbool.h>
+#endif
+
+#define BCM2835_SMI_IOC_MAGIC 0x1
+#define BCM2835_SMI_INVALID_HANDLE (~0)
+
+/* IOCTLs 0x100...0x1ff are not device-specific - we can use them */
+#define BCM2835_SMI_IOC_GET_SETTINGS    _IO(BCM2835_SMI_IOC_MAGIC, 0)
+#define BCM2835_SMI_IOC_WRITE_SETTINGS  _IO(BCM2835_SMI_IOC_MAGIC, 1)
+#define BCM2835_SMI_IOC_ADDRESS	 _IO(BCM2835_SMI_IOC_MAGIC, 2)
+#define BCM2835_SMI_IOC_MAX	     2
+
+#define SMI_WIDTH_8BIT 0
+#define SMI_WIDTH_16BIT 1
+#define SMI_WIDTH_9BIT 2
+#define SMI_WIDTH_18BIT 3
+
+/* max number of bytes where DMA will not be used */
+#define DMA_THRESHOLD_BYTES 128
+#define DMA_BOUNCE_BUFFER_SIZE (1024 * 1024 / 2)
+#define DMA_BOUNCE_BUFFER_COUNT 3
+
+
+struct smi_settings {
+	int data_width;
+	/* Whether or not to pack multiple SMI transfers into a
+	   single 32 bit FIFO word */
+	bool pack_data;
+
+	/* Timing for reads (writes the same but for WE)
+	 *
+	 * OE ----------+	   +--------------------
+	 *		|	   |
+	 *		+----------+
+	 * SD -<==============================>-----------
+	 * SA -<=========================================>-
+	 *    <-setup->  <-strobe ->  <-hold ->  <- pace ->
+	 */
+
+	int read_setup_time;
+	int read_hold_time;
+	int read_pace_time;
+	int read_strobe_time;
+
+	int write_setup_time;
+	int write_hold_time;
+	int write_pace_time;
+	int write_strobe_time;
+
+	bool dma_enable;		/* DREQs */
+	bool dma_passthrough_enable;	/* External DREQs */
+	int dma_read_thresh;
+	int dma_write_thresh;
+	int dma_panic_read_thresh;
+	int dma_panic_write_thresh;
+};
+
+/****************************************************************************
+*
+*   Declare exported SMI functions
+*
+***************************************************************************/
+
+#ifdef __KERNEL__
+
+#include <linux/dmaengine.h> /* for enum dma_transfer_direction */
+#include <linux/of.h>
+#include <linux/semaphore.h>
+
+struct bcm2835_smi_instance;
+
+struct bcm2835_smi_bounce_info {
+	struct semaphore callback_sem;
+	void *buffer[DMA_BOUNCE_BUFFER_COUNT];
+	dma_addr_t phys[DMA_BOUNCE_BUFFER_COUNT];
+	struct scatterlist sgl[DMA_BOUNCE_BUFFER_COUNT];
+};
+
+
+void bcm2835_smi_set_regs_from_settings(struct bcm2835_smi_instance *);
+
+struct smi_settings *bcm2835_smi_get_settings_from_regs(
+	struct bcm2835_smi_instance *inst);
+
+void bcm2835_smi_write_buf(
+	struct bcm2835_smi_instance *inst,
+	const void *buf,
+	size_t n_bytes);
+
+void bcm2835_smi_read_buf(
+	struct bcm2835_smi_instance *inst,
+	void *buf,
+	size_t n_bytes);
+
+void bcm2835_smi_set_address(struct bcm2835_smi_instance *inst,
+	unsigned int address);
+
+ssize_t bcm2835_smi_user_dma(
+	struct bcm2835_smi_instance *inst,
+	enum dma_transfer_direction dma_dir,
+	char __user *user_ptr,
+	size_t count,
+	struct bcm2835_smi_bounce_info **bounce);
+
+struct bcm2835_smi_instance *bcm2835_smi_get(struct device_node *node);
+
+#endif /* __KERNEL__ */
+
+/****************************************************************
+*
+*	Implementation-only declarations
+*
+****************************************************************/
+
+#ifdef BCM2835_SMI_IMPLEMENTATION
+
+/* Clock manager registers for SMI clock: */
+#define CM_SMI_BASE_ADDRESS ((BCM2708_PERI_BASE) + 0x1010b0)
+/* Clock manager "password" to protect registers from spurious writes */
+#define CM_PWD (0x5a << 24)
+
+#define CM_SMI_CTL	0x00
+#define CM_SMI_DIV	0x04
+
+#define CM_SMI_CTL_FLIP (1 << 8)
+#define CM_SMI_CTL_BUSY (1 << 7)
+#define CM_SMI_CTL_KILL (1 << 5)
+#define CM_SMI_CTL_ENAB (1 << 4)
+#define CM_SMI_CTL_SRC_MASK (0xf)
+#define CM_SMI_CTL_SRC_OFFS (0)
+
+#define CM_SMI_DIV_DIVI_MASK (0xf <<  12)
+#define CM_SMI_DIV_DIVI_OFFS (12)
+#define CM_SMI_DIV_DIVF_MASK (0xff << 4)
+#define CM_SMI_DIV_DIVF_OFFS (4)
+
+/* SMI register mapping:*/
+#define SMI_BASE_ADDRESS ((BCM2708_PERI_BASE) + 0x600000)
+
+#define SMICS	0x00	/* control + status register		*/
+#define SMIL	0x04	/* length/count (n external txfers)	*/
+#define SMIA	0x08	/* address register			*/
+#define SMID	0x0c	/* data register			*/
+#define SMIDSR0	0x10	/* device 0 read settings		*/
+#define SMIDSW0	0x14	/* device 0 write settings		*/
+#define SMIDSR1	0x18	/* device 1 read settings		*/
+#define SMIDSW1	0x1c	/* device 1 write settings		*/
+#define SMIDSR2	0x20	/* device 2 read settings		*/
+#define SMIDSW2	0x24	/* device 2 write settings		*/
+#define SMIDSR3	0x28	/* device 3 read settings		*/
+#define SMIDSW3	0x2c	/* device 3 write settings		*/
+#define SMIDC	0x30	/* DMA control registers		*/
+#define SMIDCS	0x34	/* direct control/status register	*/
+#define SMIDA	0x38	/* direct address register		*/
+#define SMIDD	0x3c	/* direct data registers		*/
+#define SMIFD	0x40	/* FIFO debug register			*/
+
+
+
+/* Control and Status register bits:
+ * SMICS_RXF	: RX fifo full: 1 when RX fifo is full
+ * SMICS_TXE	: TX fifo empty: 1 when empty.
+ * SMICS_RXD	: RX fifo contains data: 1 when there is data.
+ * SMICS_TXD	: TX fifo can accept data: 1 when true.
+ * SMICS_RXR	: RX fifo needs reading: 1 when fifo more than 3/4 full, or
+ *		  when "DONE" and fifo not emptied.
+ * SMICS_TXW	: TX fifo needs writing: 1 when less than 1/4 full.
+ * SMICS_AFERR	: AXI FIFO error: 1 when fifo read when empty or written
+ *		  when full. Write 1 to clear.
+ * SMICS_EDREQ	: 1 when external DREQ received.
+ * SMICS_PXLDAT	:  Pixel data:	write 1 to enable pixel transfer modes.
+ * SMICS_SETERR	: 1 if there was an error writing to setup regs (e.g.
+ *		  tx was in progress). Write 1 to clear.
+ * SMICS_PVMODE	: Set to 1 to enable pixel valve mode.
+ * SMICS_INTR	: Set to 1 to enable interrupt on RX.
+ * SMICS_INTT	: Set to 1 to enable interrupt on TX.
+ * SMICS_INTD	: Set to 1 to enable interrupt on DONE condition.
+ * SMICS_TEEN	: Tear effect mode enabled: Programmed transfers will wait
+ *		  for a TE trigger before writing.
+ * SMICS_PAD1	: Padding settings for external transfers. For writes: the
+ *		  number of bytes initially written to  the TX fifo that
+ * SMICS_PAD0	: should be ignored. For reads: the number of bytes that will
+ *		  be read before the data, and should be dropped.
+ * SMICS_WRITE	: Transfer direction: 1 = write to external device, 0 = read
+ * SMICS_CLEAR	: Write 1 to clear the FIFOs.
+ * SMICS_START	: Write 1 to start the programmed transfer.
+ * SMICS_ACTIVE	: Reads as 1 when a programmed transfer is underway.
+ * SMICS_DONE	: Reads as 1 when transfer finished. For RX, not set until
+ *		  FIFO emptied.
+ * SMICS_ENABLE	: Set to 1 to enable the SMI peripheral, 0 to disable.
+ */
+
+#define SMICS_RXF	(1 << 31)
+#define SMICS_TXE	(1 << 30)
+#define SMICS_RXD	(1 << 29)
+#define SMICS_TXD	(1 << 28)
+#define SMICS_RXR	(1 << 27)
+#define SMICS_TXW	(1 << 26)
+#define SMICS_AFERR	(1 << 25)
+#define SMICS_EDREQ	(1 << 15)
+#define SMICS_PXLDAT	(1 << 14)
+#define SMICS_SETERR	(1 << 13)
+#define SMICS_PVMODE	(1 << 12)
+#define SMICS_INTR	(1 << 11)
+#define SMICS_INTT	(1 << 10)
+#define SMICS_INTD	(1 << 9)
+#define SMICS_TEEN	(1 << 8)
+#define SMICS_PAD1	(1 << 7)
+#define SMICS_PAD0	(1 << 6)
+#define SMICS_WRITE	(1 << 5)
+#define SMICS_CLEAR	(1 << 4)
+#define SMICS_START	(1 << 3)
+#define SMICS_ACTIVE	(1 << 2)
+#define SMICS_DONE	(1 << 1)
+#define SMICS_ENABLE	(1 << 0)
+
+/* Address register bits: */
+
+#define SMIA_DEVICE_MASK ((1 << 9) | (1 << 8))
+#define SMIA_DEVICE_OFFS (8)
+#define SMIA_ADDR_MASK (0x3f)	/* bits 5 -> 0 */
+#define SMIA_ADDR_OFFS (0)
+
+/* DMA control register bits:
+ * SMIDC_DMAEN	: DMA enable: set 1: DMA requests will be issued.
+ * SMIDC_DMAP	: DMA passthrough: when set to 0, top two data pins are used by
+ *		  SMI as usual. When set to 1, the top two pins are used for
+ *		  external DREQs: pin 16 read request, 17 write.
+ * SMIDC_PANIC*	: Threshold at which DMA will panic during read/write.
+ * SMIDC_REQ*	: Threshold at which DMA will generate a DREQ.
+ */
+
+#define SMIDC_DMAEN		(1 << 28)
+#define SMIDC_DMAP		(1 << 24)
+#define SMIDC_PANICR_MASK	(0x3f << 18)
+#define SMIDC_PANICR_OFFS	(18)
+#define SMIDC_PANICW_MASK	(0x3f << 12)
+#define SMIDC_PANICW_OFFS	(12)
+#define SMIDC_REQR_MASK		(0x3f << 6)
+#define SMIDC_REQR_OFFS		(6)
+#define SMIDC_REQW_MASK		(0x3f)
+#define SMIDC_REQW_OFFS		(0)
+
+/* Device settings register bits: same for all 4 (or 3?) device register sets.
+ * Device read settings:
+ * SMIDSR_RWIDTH	: Read transfer width. 00 = 8bit, 01 = 16bit,
+ *			  10 = 18bit, 11 = 9bit.
+ * SMIDSR_RSETUP	: Read setup time: number of core cycles between chip
+ *			  select/address and read strobe. Min 1, max 64.
+ * SMIDSR_MODE68	: 1 for System 68 mode (i.e. enable + direction pins,
+ *			  rather than OE + WE pin)
+ * SMIDSR_FSETUP	: If set to 1, setup time only applies to first
+ *			  transfer after address change.
+ * SMIDSR_RHOLD		: Number of core cycles between read strobe going
+ *			  inactive and CS/address going inactive. Min 1, max 64
+ * SMIDSR_RPACEALL	: When set to 1, this device's RPACE value will always
+ *			  be used for the next transaction, even if it is not
+ *			  to this device.
+ * SMIDSR_RPACE		: Number of core cycles spent waiting between CS
+ *			  deassert and start of next transfer. Min 1, max 128
+ * SMIDSR_RDREQ		: 1 = use external DMA request on SD16 to pace reads
+ *			  from device. Must also set DMAP in SMICS.
+ * SMIDSR_RSTROBE	: Number of cycles to assert the read strobe.
+ *			  min 1, max 128.
+ */
+#define SMIDSR_RWIDTH_MASK	((1<<31)|(1<<30))
+#define SMIDSR_RWIDTH_OFFS	(30)
+#define SMIDSR_RSETUP_MASK	(0x3f << 24)
+#define SMIDSR_RSETUP_OFFS	(24)
+#define SMIDSR_MODE68		(1 << 23)
+#define SMIDSR_FSETUP		(1 << 22)
+#define SMIDSR_RHOLD_MASK	(0x3f << 16)
+#define SMIDSR_RHOLD_OFFS	(16)
+#define SMIDSR_RPACEALL		(1 << 15)
+#define SMIDSR_RPACE_MASK	(0x7f << 8)
+#define SMIDSR_RPACE_OFFS	(8)
+#define SMIDSR_RDREQ		(1 << 7)
+#define SMIDSR_RSTROBE_MASK	(0x7f)
+#define SMIDSR_RSTROBE_OFFS	(0)
+
+/* Device write settings:
+ * SMIDSW_WWIDTH	: Write transfer width. 00 = 8bit, 01 = 16bit,
+ *			  10= 18bit, 11 = 9bit.
+ * SMIDSW_WSETUP	: Number of cycles between CS assert and write strobe.
+ *			  Min 1, max 64.
+ * SMIDSW_WFORMAT	: Pixel format of input. 0 = 16bit RGB 565,
+ *			  1 = 32bit RGBA 8888
+ * SMIDSW_WSWAP		: 1 = swap pixel data bits. (Use with SMICS_PXLDAT)
+ * SMIDSW_WHOLD		: Time between WE deassert and CS deassert. 1 to 64
+ * SMIDSW_WPACEALL	: 1: this device's WPACE will be used for the next
+ *			  transfer, regardless of that transfer's device.
+ * SMIDSW_WPACE		: Cycles between CS deassert and next CS assert.
+ *			  Min 1, max 128
+ * SMIDSW_WDREQ		: Use external DREQ on pin 17 to pace writes. DMAP must
+ *			  be set in SMICS.
+ * SMIDSW_WSTROBE	: Number of cycles to assert the write strobe.
+ *			  Min 1, max 128
+ */
+#define SMIDSW_WWIDTH_MASK	 ((1<<31)|(1<<30))
+#define SMIDSW_WWIDTH_OFFS	(30)
+#define SMIDSW_WSETUP_MASK	(0x3f << 24)
+#define SMIDSW_WSETUP_OFFS	(24)
+#define SMIDSW_WFORMAT		(1 << 23)
+#define SMIDSW_WSWAP		(1 << 22)
+#define SMIDSW_WHOLD_MASK	(0x3f << 16)
+#define SMIDSW_WHOLD_OFFS	(16)
+#define SMIDSW_WPACEALL		(1 << 15)
+#define SMIDSW_WPACE_MASK	(0x7f << 8)
+#define SMIDSW_WPACE_OFFS	(8)
+#define SMIDSW_WDREQ		(1 << 7)
+#define SMIDSW_WSTROBE_MASK	 (0x7f)
+#define SMIDSW_WSTROBE_OFFS	 (0)
+
+/* Direct transfer control + status register
+ * SMIDCS_WRITE	: Direction of transfer: 1 -> write, 0 -> read
+ * SMIDCS_DONE	: 1 when a transfer has finished. Write 1 to clear.
+ * SMIDCS_START	: Write 1 to start a transfer, if one is not already underway.
+ * SMIDCE_ENABLE: Write 1 to enable SMI in direct mode.
+ */
+
+#define SMIDCS_WRITE		(1 << 3)
+#define SMIDCS_DONE		(1 << 2)
+#define SMIDCS_START		(1 << 1)
+#define SMIDCS_ENABLE		(1 << 0)
+
+/* Direct transfer address register
+ * SMIDA_DEVICE	: Indicates which of the device settings banks should be used.
+ * SMIDA_ADDR	: The value to be asserted on the address pins.
+ */
+
+#define SMIDA_DEVICE_MASK	((1<<9)|(1<<8))
+#define SMIDA_DEVICE_OFFS	(8)
+#define SMIDA_ADDR_MASK		(0x3f)
+#define SMIDA_ADDR_OFFS		(0)
+
+/* FIFO debug register
+ * SMIFD_FLVL	: The high-tide mark of FIFO count during the most recent txfer
+ * SMIFD_FCNT	: The current FIFO count.
+ */
+#define SMIFD_FLVL_MASK		(0x3f << 8)
+#define SMIFD_FLVL_OFFS		(8)
+#define SMIFD_FCNT_MASK		(0x3f)
+#define SMIFD_FCNT_OFFS		(0)
+
+#endif /* BCM2835_SMI_IMPLEMENTATION */
+
+#endif /* BCM2835_SMI_H */
diff --git a/include/linux/broadcom/vc_mem.h b/include/linux/broadcom/vc_mem.h
new file mode 100644
index 000000000000..20a475377eb3
--- /dev/null
+++ b/include/linux/broadcom/vc_mem.h
@@ -0,0 +1,35 @@
+/*****************************************************************************
+* Copyright 2010 - 2011 Broadcom Corporation.  All rights reserved.
+*
+* Unless you and Broadcom execute a separate written software license
+* agreement governing use of this software, this software is licensed to you
+* under the terms of the GNU General Public License version 2, available at
+* http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+*
+* Notwithstanding the above, under no circumstances may you combine this
+* software in any way with any other Broadcom software provided under a
+* license other than the GPL, without Broadcom's express prior written
+* consent.
+*****************************************************************************/
+
+#ifndef _VC_MEM_H
+#define _VC_MEM_H
+
+#include <linux/ioctl.h>
+
+#define VC_MEM_IOC_MAGIC  'v'
+
+#define VC_MEM_IOC_MEM_PHYS_ADDR    _IOR( VC_MEM_IOC_MAGIC, 0, unsigned long )
+#define VC_MEM_IOC_MEM_SIZE         _IOR( VC_MEM_IOC_MAGIC, 1, unsigned int )
+#define VC_MEM_IOC_MEM_BASE         _IOR( VC_MEM_IOC_MAGIC, 2, unsigned int )
+#define VC_MEM_IOC_MEM_LOAD         _IOR( VC_MEM_IOC_MAGIC, 3, unsigned int )
+
+#if defined( __KERNEL__ )
+#define VC_MEM_TO_ARM_ADDR_MASK 0x3FFFFFFF
+
+extern unsigned long mm_vc_mem_phys_addr;
+extern unsigned int  mm_vc_mem_size;
+extern int vc_mem_get_current_size( void );
+#endif
+
+#endif  /* _VC_MEM_H */
diff --git a/include/linux/broadcom/vmcs_sm_ioctl.h b/include/linux/broadcom/vmcs_sm_ioctl.h
new file mode 100644
index 000000000000..a4492b921b48
--- /dev/null
+++ b/include/linux/broadcom/vmcs_sm_ioctl.h
@@ -0,0 +1,289 @@
+/*****************************************************************************
+*  Copyright 2011 Broadcom Corporation.  All rights reserved.
+*
+*  Unless you and Broadcom execute a separate written software license
+*  agreement governing use of this software, this software is licensed to you
+*  under the terms of the GNU General Public License version 2, available at
+*  http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+*
+*  Notwithstanding the above, under no circumstances may you combine this
+*  software in any way with any other Broadcom software provided under a
+*  license other than the GPL, without Broadcom's express prior written
+*  consent.
+*
+*****************************************************************************/
+
+#if !defined(__VMCS_SM_IOCTL_H__INCLUDED__)
+#define __VMCS_SM_IOCTL_H__INCLUDED__
+
+/* ---- Include Files ---------------------------------------------------- */
+
+#if defined(__KERNEL__)
+#include <linux/types.h>	/* Needed for standard types */
+#else
+#include <stdint.h>
+#endif
+
+#include <linux/ioctl.h>
+
+/* ---- Constants and Types ---------------------------------------------- */
+
+#define VMCS_SM_RESOURCE_NAME               32
+#define VMCS_SM_RESOURCE_NAME_DEFAULT       "sm-host-resource"
+
+/* Type define used to create unique IOCTL number */
+#define VMCS_SM_MAGIC_TYPE                  'I'
+
+/* IOCTL commands */
+enum vmcs_sm_cmd_e {
+	VMCS_SM_CMD_ALLOC = 0x5A,	/* Start at 0x5A arbitrarily */
+	VMCS_SM_CMD_ALLOC_SHARE,
+	VMCS_SM_CMD_LOCK,
+	VMCS_SM_CMD_LOCK_CACHE,
+	VMCS_SM_CMD_UNLOCK,
+	VMCS_SM_CMD_RESIZE,
+	VMCS_SM_CMD_UNMAP,
+	VMCS_SM_CMD_FREE,
+	VMCS_SM_CMD_FLUSH,
+	VMCS_SM_CMD_INVALID,
+
+	VMCS_SM_CMD_SIZE_USR_HANDLE,
+	VMCS_SM_CMD_CHK_USR_HANDLE,
+
+	VMCS_SM_CMD_MAPPED_USR_HANDLE,
+	VMCS_SM_CMD_MAPPED_USR_ADDRESS,
+	VMCS_SM_CMD_MAPPED_VC_HDL_FROM_ADDR,
+	VMCS_SM_CMD_MAPPED_VC_HDL_FROM_HDL,
+	VMCS_SM_CMD_MAPPED_VC_ADDR_FROM_HDL,
+
+	VMCS_SM_CMD_VC_WALK_ALLOC,
+	VMCS_SM_CMD_HOST_WALK_MAP,
+	VMCS_SM_CMD_HOST_WALK_PID_ALLOC,
+	VMCS_SM_CMD_HOST_WALK_PID_MAP,
+
+	VMCS_SM_CMD_CLEAN_INVALID,
+	VMCS_SM_CMD_CLEAN_INVALID2,
+
+	VMCS_SM_CMD_IMPORT_DMABUF,
+
+	VMCS_SM_CMD_LAST	/* Do not delete */
+};
+
+/* Cache type supported, conveniently matches the user space definition in
+** user-vcsm.h.
+*/
+enum vmcs_sm_cache_e {
+	VMCS_SM_CACHE_NONE,
+	VMCS_SM_CACHE_HOST,
+	VMCS_SM_CACHE_VC,
+	VMCS_SM_CACHE_BOTH,
+};
+
+/* IOCTL Data structures */
+struct vmcs_sm_ioctl_alloc {
+	/* user -> kernel */
+	unsigned int size;
+	unsigned int num;
+	enum vmcs_sm_cache_e cached;
+	char name[VMCS_SM_RESOURCE_NAME];
+
+	/* kernel -> user */
+	unsigned int handle;
+	/* unsigned int base_addr; */
+};
+
+struct vmcs_sm_ioctl_alloc_share {
+	/* user -> kernel */
+	unsigned int handle;
+	unsigned int size;
+};
+
+struct vmcs_sm_ioctl_free {
+	/* user -> kernel */
+	unsigned int handle;
+	/* unsigned int base_addr; */
+};
+
+struct vmcs_sm_ioctl_lock_unlock {
+	/* user -> kernel */
+	unsigned int handle;
+
+	/* kernel -> user */
+	unsigned int addr;
+};
+
+struct vmcs_sm_ioctl_lock_cache {
+	/* user -> kernel */
+	unsigned int handle;
+	enum vmcs_sm_cache_e cached;
+};
+
+struct vmcs_sm_ioctl_resize {
+	/* user -> kernel */
+	unsigned int handle;
+	unsigned int new_size;
+
+	/* kernel -> user */
+	unsigned int old_size;
+};
+
+struct vmcs_sm_ioctl_map {
+	/* user -> kernel */
+	/* and kernel -> user */
+	unsigned int pid;
+	unsigned int handle;
+	unsigned int addr;
+
+	/* kernel -> user */
+	unsigned int size;
+};
+
+struct vmcs_sm_ioctl_walk {
+	/* user -> kernel */
+	unsigned int pid;
+};
+
+struct vmcs_sm_ioctl_chk {
+	/* user -> kernel */
+	unsigned int handle;
+
+	/* kernel -> user */
+	unsigned int addr;
+	unsigned int size;
+	enum vmcs_sm_cache_e cache;
+};
+
+struct vmcs_sm_ioctl_size {
+	/* user -> kernel */
+	unsigned int handle;
+
+	/* kernel -> user */
+	unsigned int size;
+};
+
+struct vmcs_sm_ioctl_cache {
+	/* user -> kernel */
+	unsigned int handle;
+	unsigned int addr;
+	unsigned int size;
+};
+
+/*
+ * Cache functions to be set to struct vmcs_sm_ioctl_clean_invalid cmd and
+ * vmcs_sm_ioctl_clean_invalid2 invalidate_mode.
+ */
+#define VCSM_CACHE_OP_NOP       0x00
+#define VCSM_CACHE_OP_INV       0x01
+#define VCSM_CACHE_OP_CLEAN     0x02
+#define VCSM_CACHE_OP_FLUSH     0x03
+
+struct vmcs_sm_ioctl_clean_invalid {
+	/* user -> kernel */
+	struct {
+		unsigned int cmd;
+		unsigned int handle;
+		unsigned int addr;
+		unsigned int size;
+	} s[8];
+};
+
+struct vmcs_sm_ioctl_clean_invalid2 {
+	uint8_t op_count;
+	uint8_t zero[3];
+	struct vmcs_sm_ioctl_clean_invalid_block {
+		uint16_t invalidate_mode;
+		uint16_t block_count;
+		void *   start_address;
+		uint32_t block_size;
+		uint32_t inter_block_stride;
+	} s[0];
+};
+
+struct vmcs_sm_ioctl_import_dmabuf {
+	/* user -> kernel */
+	int dmabuf_fd;
+	enum vmcs_sm_cache_e cached;
+	char name[VMCS_SM_RESOURCE_NAME];
+
+	/* kernel -> user */
+	unsigned int handle;
+};
+
+/* IOCTL numbers */
+#define VMCS_SM_IOCTL_MEM_ALLOC\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_ALLOC,\
+	 struct vmcs_sm_ioctl_alloc)
+#define VMCS_SM_IOCTL_MEM_ALLOC_SHARE\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_ALLOC_SHARE,\
+	 struct vmcs_sm_ioctl_alloc_share)
+#define VMCS_SM_IOCTL_MEM_LOCK\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_LOCK,\
+	 struct vmcs_sm_ioctl_lock_unlock)
+#define VMCS_SM_IOCTL_MEM_LOCK_CACHE\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_LOCK_CACHE,\
+	 struct vmcs_sm_ioctl_lock_cache)
+#define VMCS_SM_IOCTL_MEM_UNLOCK\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_UNLOCK,\
+	 struct vmcs_sm_ioctl_lock_unlock)
+#define VMCS_SM_IOCTL_MEM_RESIZE\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_RESIZE,\
+	 struct vmcs_sm_ioctl_resize)
+#define VMCS_SM_IOCTL_MEM_FREE\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_FREE,\
+	 struct vmcs_sm_ioctl_free)
+#define VMCS_SM_IOCTL_MEM_FLUSH\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_FLUSH,\
+	 struct vmcs_sm_ioctl_cache)
+#define VMCS_SM_IOCTL_MEM_INVALID\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_INVALID,\
+	 struct vmcs_sm_ioctl_cache)
+#define VMCS_SM_IOCTL_MEM_CLEAN_INVALID\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_CLEAN_INVALID,\
+	 struct vmcs_sm_ioctl_clean_invalid)
+#define VMCS_SM_IOCTL_MEM_CLEAN_INVALID2\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_CLEAN_INVALID2,\
+	 struct vmcs_sm_ioctl_clean_invalid2)
+
+#define VMCS_SM_IOCTL_SIZE_USR_HDL\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_SIZE_USR_HANDLE,\
+	 struct vmcs_sm_ioctl_size)
+#define VMCS_SM_IOCTL_CHK_USR_HDL\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_CHK_USR_HANDLE,\
+	 struct vmcs_sm_ioctl_chk)
+
+#define VMCS_SM_IOCTL_MAP_USR_HDL\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_MAPPED_USR_HANDLE,\
+	 struct vmcs_sm_ioctl_map)
+#define VMCS_SM_IOCTL_MAP_USR_ADDRESS\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_MAPPED_USR_ADDRESS,\
+	 struct vmcs_sm_ioctl_map)
+#define VMCS_SM_IOCTL_MAP_VC_HDL_FR_ADDR\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_MAPPED_VC_HDL_FROM_ADDR,\
+	 struct vmcs_sm_ioctl_map)
+#define VMCS_SM_IOCTL_MAP_VC_HDL_FR_HDL\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_MAPPED_VC_HDL_FROM_HDL,\
+	 struct vmcs_sm_ioctl_map)
+#define VMCS_SM_IOCTL_MAP_VC_ADDR_FR_HDL\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_MAPPED_VC_ADDR_FROM_HDL,\
+	 struct vmcs_sm_ioctl_map)
+
+#define VMCS_SM_IOCTL_VC_WALK_ALLOC\
+	_IO(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_VC_WALK_ALLOC)
+#define VMCS_SM_IOCTL_HOST_WALK_MAP\
+	_IO(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_HOST_WALK_MAP)
+#define VMCS_SM_IOCTL_HOST_WALK_PID_ALLOC\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_HOST_WALK_PID_ALLOC,\
+	 struct vmcs_sm_ioctl_walk)
+#define VMCS_SM_IOCTL_HOST_WALK_PID_MAP\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_HOST_WALK_PID_MAP,\
+	 struct vmcs_sm_ioctl_walk)
+
+#define VMCS_SM_IOCTL_MEM_IMPORT_DMABUF\
+	_IOR(VMCS_SM_MAGIC_TYPE, VMCS_SM_CMD_IMPORT_DMABUF,\
+	 struct vmcs_sm_ioctl_import_dmabuf)
+
+/* ---- Variable Externs ------------------------------------------------- */
+
+/* ---- Function Prototypes ---------------------------------------------- */
+
+#endif /* __VMCS_SM_IOCTL_H__INCLUDED__ */
diff --git a/include/linux/irqchip/irq-bcm2836.h b/include/linux/irqchip/irq-bcm2836.h
new file mode 100644
index 000000000000..218a6e1b18d8
--- /dev/null
+++ b/include/linux/irqchip/irq-bcm2836.h
@@ -0,0 +1,70 @@
+/*
+ * Root interrupt controller for the BCM2836 (Raspberry Pi 2).
+ *
+ * Copyright 2015 Broadcom
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#define LOCAL_CONTROL			0x000
+#define LOCAL_PRESCALER			0x008
+
+/*
+ * The low 2 bits identify the CPU that the GPU IRQ goes to, and the
+ * next 2 bits identify the CPU that the GPU FIQ goes to.
+ */
+#define LOCAL_GPU_ROUTING		0x00c
+/* When setting bits 0-3, enables PMU interrupts on that CPU. */
+#define LOCAL_PM_ROUTING_SET		0x010
+/* When setting bits 0-3, disables PMU interrupts on that CPU. */
+#define LOCAL_PM_ROUTING_CLR		0x014
+/*
+ * The low 4 bits of this are the CPU's timer IRQ enables, and the
+ * next 4 bits are the CPU's timer FIQ enables (which override the IRQ
+ * bits).
+ */
+#define LOCAL_TIMER_INT_CONTROL0	0x040
+/*
+ * The low 4 bits of this are the CPU's per-mailbox IRQ enables, and
+ * the next 4 bits are the CPU's per-mailbox FIQ enables (which
+ * override the IRQ bits).
+ */
+#define LOCAL_MAILBOX_INT_CONTROL0	0x050
+/*
+ * The CPU's interrupt status register.  Bits are defined by the the
+ * LOCAL_IRQ_* bits below.
+ */
+#define LOCAL_IRQ_PENDING0		0x060
+/* Same status bits as above, but for FIQ. */
+#define LOCAL_FIQ_PENDING0		0x070
+/*
+ * Mailbox write-to-set bits.  There are 16 mailboxes, 4 per CPU, and
+ * these bits are organized by mailbox number and then CPU number.  We
+ * use mailbox 0 for IPIs.  The mailbox's interrupt is raised while
+ * any bit is set.
+ */
+#define LOCAL_MAILBOX0_SET0		0x080
+#define LOCAL_MAILBOX3_SET0		0x08c
+/* Mailbox write-to-clear bits. */
+#define LOCAL_MAILBOX0_CLR0		0x0c0
+#define LOCAL_MAILBOX3_CLR0		0x0cc
+
+#define LOCAL_IRQ_CNTPSIRQ	0
+#define LOCAL_IRQ_CNTPNSIRQ	1
+#define LOCAL_IRQ_CNTHPIRQ	2
+#define LOCAL_IRQ_CNTVIRQ	3
+#define LOCAL_IRQ_MAILBOX0	4
+#define LOCAL_IRQ_MAILBOX1	5
+#define LOCAL_IRQ_MAILBOX2	6
+#define LOCAL_IRQ_MAILBOX3	7
+#define LOCAL_IRQ_GPU_FAST	8
+#define LOCAL_IRQ_PMU_FAST	9
+#define LAST_IRQ		LOCAL_IRQ_PMU_FAST
diff --git a/include/linux/leds.h b/include/linux/leds.h
index bf6db4fe895b..8741dca6dba6 100644
--- a/include/linux/leds.h
+++ b/include/linux/leds.h
@@ -50,6 +50,9 @@ struct led_classdev {
 #define LED_PANIC_INDICATOR	(1 << 20)
 #define LED_BRIGHT_HW_CHANGED	(1 << 21)
 #define LED_RETAIN_AT_SHUTDOWN	(1 << 22)
+	/* Additions for Raspberry Pi PWR LED */
+#define SET_GPIO_INPUT		(1 << 30)
+#define SET_GPIO_OUTPUT		(1 << 31)
 
 	/* set_brightness_work / blink_timer flags, atomic, private. */
 	unsigned long		work_flags;
diff --git a/include/linux/mdio.h b/include/linux/mdio.h
index ca08ab16ecdc..34796e29c90c 100644
--- a/include/linux/mdio.h
+++ b/include/linux/mdio.h
@@ -257,6 +257,9 @@ static inline u16 ethtool_adv_to_mmd_eee_adv_t(u32 adv)
 	return reg;
 }
 
+int __mdiobus_read(struct mii_bus *bus, int addr, u32 regnum);
+int __mdiobus_write(struct mii_bus *bus, int addr, u32 regnum, u16 val);
+
 int mdiobus_read(struct mii_bus *bus, int addr, u32 regnum);
 int mdiobus_read_nested(struct mii_bus *bus, int addr, u32 regnum);
 int mdiobus_write(struct mii_bus *bus, int addr, u32 regnum, u16 val);
diff --git a/include/linux/mfd/rpisense/core.h b/include/linux/mfd/rpisense/core.h
new file mode 100644
index 000000000000..4856aa3c8b06
--- /dev/null
+++ b/include/linux/mfd/rpisense/core.h
@@ -0,0 +1,47 @@
+/*
+ * Raspberry Pi Sense HAT core driver
+ * http://raspberrypi.org
+ *
+ * Copyright (C) 2015 Raspberry Pi
+ *
+ * Author: Serge Schneider
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ */
+
+#ifndef __LINUX_MFD_RPISENSE_CORE_H_
+#define __LINUX_MFD_RPISENSE_CORE_H_
+
+#include <linux/mfd/rpisense/joystick.h>
+#include <linux/mfd/rpisense/framebuffer.h>
+
+/*
+ * Register values.
+ */
+#define RPISENSE_FB			0x00
+#define RPISENSE_WAI			0xF0
+#define RPISENSE_VER			0xF1
+#define RPISENSE_KEYS			0xF2
+#define RPISENSE_EE_WP			0xF3
+
+#define RPISENSE_ID			's'
+
+struct rpisense {
+	struct device *dev;
+	struct i2c_client *i2c_client;
+
+	/* Client devices */
+	struct rpisense_js joystick;
+	struct rpisense_fb framebuffer;
+};
+
+struct rpisense *rpisense_get_dev(void);
+s32 rpisense_reg_read(struct rpisense *rpisense, int reg);
+int rpisense_reg_write(struct rpisense *rpisense, int reg, u16 val);
+int rpisense_block_write(struct rpisense *rpisense, const char *buf, int count);
+
+#endif
diff --git a/include/linux/mfd/rpisense/framebuffer.h b/include/linux/mfd/rpisense/framebuffer.h
new file mode 100644
index 000000000000..2ba95d7eebaf
--- /dev/null
+++ b/include/linux/mfd/rpisense/framebuffer.h
@@ -0,0 +1,32 @@
+/*
+ * Raspberry Pi Sense HAT framebuffer driver
+ * http://raspberrypi.org
+ *
+ * Copyright (C) 2015 Raspberry Pi
+ *
+ * Author: Serge Schneider
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ */
+
+#ifndef __LINUX_RPISENSE_FB_H_
+#define __LINUX_RPISENSE_FB_H_
+
+#define SENSEFB_FBIO_IOC_MAGIC 0xF1
+
+#define SENSEFB_FBIOGET_GAMMA _IO(SENSEFB_FBIO_IOC_MAGIC, 0)
+#define SENSEFB_FBIOSET_GAMMA _IO(SENSEFB_FBIO_IOC_MAGIC, 1)
+#define SENSEFB_FBIORESET_GAMMA _IO(SENSEFB_FBIO_IOC_MAGIC, 2)
+
+struct rpisense;
+
+struct rpisense_fb {
+	struct platform_device *pdev;
+	struct fb_info *info;
+};
+
+#endif
diff --git a/include/linux/mfd/rpisense/joystick.h b/include/linux/mfd/rpisense/joystick.h
new file mode 100644
index 000000000000..56196dc2af10
--- /dev/null
+++ b/include/linux/mfd/rpisense/joystick.h
@@ -0,0 +1,35 @@
+/*
+ * Raspberry Pi Sense HAT joystick driver
+ * http://raspberrypi.org
+ *
+ * Copyright (C) 2015 Raspberry Pi
+ *
+ * Author: Serge Schneider
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ */
+
+#ifndef __LINUX_RPISENSE_JOYSTICK_H_
+#define __LINUX_RPISENSE_JOYSTICK_H_
+
+#include <linux/input.h>
+#include <linux/interrupt.h>
+#include <linux/gpio/consumer.h>
+#include <linux/platform_device.h>
+
+struct rpisense;
+
+struct rpisense_js {
+	struct platform_device *pdev;
+	struct input_dev *keys_dev;
+	struct gpio_desc *keys_desc;
+	struct work_struct keys_work_s;
+	int keys_irq;
+};
+
+
+#endif
diff --git a/include/linux/microchipphy.h b/include/linux/microchipphy.h
index eb492d47f717..8f9c90379732 100644
--- a/include/linux/microchipphy.h
+++ b/include/linux/microchipphy.h
@@ -70,4 +70,12 @@
 #define	LAN88XX_MMD3_CHIP_ID			(32877)
 #define	LAN88XX_MMD3_CHIP_REV			(32878)
 
+/* DSP registers */
+#define PHY_ARDENNES_MMD_DEV_3_PHY_CFG		(0x806A)
+#define PHY_ARDENNES_MMD_DEV_3_PHY_CFG_ZD_DLY_EN_	(0x2000)
+#define LAN88XX_EXT_PAGE_ACCESS_TR		(0x52B5)
+#define LAN88XX_EXT_PAGE_TR_CR			16
+#define LAN88XX_EXT_PAGE_TR_LOW_DATA		17
+#define LAN88XX_EXT_PAGE_TR_HIGH_DATA		18
+
 #endif /* _MICROCHIPPHY_H */
diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h
index 279b39008a33..49bdea5791a2 100644
--- a/include/linux/mmc/card.h
+++ b/include/linux/mmc/card.h
@@ -269,6 +269,8 @@ struct mmc_card {
 #define MMC_QUIRK_TRIM_BROKEN	(1<<12)		/* Skip trim */
 #define MMC_QUIRK_BROKEN_HPI	(1<<13)		/* Disable broken HPI support */
 
+#define MMC_QUIRK_ERASE_BROKEN	(1<<31)		/* Skip erase */
+
 	bool			reenable_cmdq;	/* Re-enable Command Queue */
 
 	unsigned int		erase_size;	/* erase size in sectors */
diff --git a/include/linux/phy.h b/include/linux/phy.h
index dca9e926b88f..2ac6fa7dd785 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -632,6 +632,9 @@ struct phy_driver {
 	int (*write_mmd)(struct phy_device *dev, int devnum, u16 regnum,
 			 u16 val);
 
+	int (*read_page)(struct phy_device *dev);
+	int (*write_page)(struct phy_device *dev, int page);
+
 	/* Get the size and type of the eeprom contained within a plug-in
 	 * module */
 	int (*module_info)(struct phy_device *dev,
@@ -713,6 +716,18 @@ static inline int phy_read(struct phy_device *phydev, u32 regnum)
 	return mdiobus_read(phydev->mdio.bus, phydev->mdio.addr, regnum);
 }
 
+/**
+ * __phy_read - convenience function for reading a given PHY register
+ * @phydev: the phy_device struct
+ * @regnum: register number to read
+ *
+ * The caller must have taken the MDIO bus lock.
+ */
+static inline int __phy_read(struct phy_device *phydev, u32 regnum)
+{
+	return __mdiobus_read(phydev->mdio.bus, phydev->mdio.addr, regnum);
+}
+
 /**
  * phy_write - Convenience function for writing a given PHY register
  * @phydev: the phy_device struct
@@ -728,6 +743,22 @@ static inline int phy_write(struct phy_device *phydev, u32 regnum, u16 val)
 	return mdiobus_write(phydev->mdio.bus, phydev->mdio.addr, regnum, val);
 }
 
+/**
+ * __phy_write - Convenience function for writing a given PHY register
+ * @phydev: the phy_device struct
+ * @regnum: register number to write
+ * @val: value to write to @regnum
+ *
+ * The caller must have taken the MDIO bus lock.
+ */
+static inline int __phy_write(struct phy_device *phydev, u32 regnum, u16 val)
+{
+	return __mdiobus_write(phydev->mdio.bus, phydev->mdio.addr, regnum,
+			       val);
+}
+
+int __phy_modify(struct phy_device *phydev, u32 regnum, u16 mask, u16 set);
+
 /**
  * phy_interrupt_is_valid - Convenience function for testing a given PHY irq
  * @phydev: the phy_device struct
@@ -792,6 +823,14 @@ static inline bool phy_is_pseudo_fixed_link(struct phy_device *phydev)
  */
 int phy_write_mmd(struct phy_device *phydev, int devad, u32 regnum, u16 val);
 
+int phy_save_page(struct phy_device *phydev);
+int phy_select_page(struct phy_device *phydev, int page);
+int phy_restore_page(struct phy_device *phydev, int oldpage, int ret);
+int phy_read_paged(struct phy_device *phydev, int page, u32 regnum);
+int phy_write_paged(struct phy_device *phydev, int page, u32 regnum, u16 val);
+int phy_modify_paged(struct phy_device *phydev, int page, u32 regnum,
+		     u16 mask, u16 set);
+
 struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id,
 				     bool is_c45,
 				     struct phy_c45_device_ids *c45_ids);
diff --git a/include/linux/platform_data/bcm2708.h b/include/linux/platform_data/bcm2708.h
new file mode 100644
index 000000000000..fb69624ccef0
--- /dev/null
+++ b/include/linux/platform_data/bcm2708.h
@@ -0,0 +1,23 @@
+/*
+ * include/linux/platform_data/bcm2708.h
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * (C) 2014 Julian Scheel <julian@jusst.de>
+ *
+ */
+#ifndef __BCM2708_H_
+#define __BCM2708_H_
+
+typedef enum {
+	BCM2708_PULL_OFF,
+	BCM2708_PULL_UP,
+	BCM2708_PULL_DOWN
+} bcm2708_gpio_pull_t;
+
+extern int bcm2708_gpio_setpull(struct gpio_chip *gc, unsigned offset,
+		bcm2708_gpio_pull_t value);
+
+#endif
diff --git a/include/linux/platform_data/dma-bcm2708.h b/include/linux/platform_data/dma-bcm2708.h
new file mode 100644
index 000000000000..6ca874d332a8
--- /dev/null
+++ b/include/linux/platform_data/dma-bcm2708.h
@@ -0,0 +1,143 @@
+/*
+ *  Copyright (C) 2010 Broadcom
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef _PLAT_BCM2708_DMA_H
+#define _PLAT_BCM2708_DMA_H
+
+/* DMA CS Control and Status bits */
+#define BCM2708_DMA_ACTIVE	BIT(0)
+#define BCM2708_DMA_INT		BIT(2)
+#define BCM2708_DMA_ISPAUSED	BIT(4)  /* Pause requested or not active */
+#define BCM2708_DMA_ISHELD	BIT(5)  /* Is held by DREQ flow control */
+#define BCM2708_DMA_ERR		BIT(8)
+#define BCM2708_DMA_ABORT	BIT(30) /* stop current CB, go to next, WO */
+#define BCM2708_DMA_RESET	BIT(31) /* WO, self clearing */
+
+/* DMA control block "info" field bits */
+#define BCM2708_DMA_INT_EN	BIT(0)
+#define BCM2708_DMA_TDMODE	BIT(1)
+#define BCM2708_DMA_WAIT_RESP	BIT(3)
+#define BCM2708_DMA_D_INC	BIT(4)
+#define BCM2708_DMA_D_WIDTH	BIT(5)
+#define BCM2708_DMA_D_DREQ	BIT(6)
+#define BCM2708_DMA_S_INC	BIT(8)
+#define BCM2708_DMA_S_WIDTH	BIT(9)
+#define BCM2708_DMA_S_DREQ	BIT(10)
+
+#define	BCM2708_DMA_BURST(x)	(((x) & 0xf) << 12)
+#define	BCM2708_DMA_PER_MAP(x)	((x) << 16)
+#define	BCM2708_DMA_WAITS(x)	(((x) & 0x1f) << 21)
+
+#define BCM2708_DMA_DREQ_EMMC	11
+#define BCM2708_DMA_DREQ_SDHOST	13
+
+#define BCM2708_DMA_CS		0x00 /* Control and Status */
+#define BCM2708_DMA_ADDR	0x04
+/* the current control block appears in the following registers - read only */
+#define BCM2708_DMA_INFO	0x08
+#define BCM2708_DMA_SOURCE_AD	0x0c
+#define BCM2708_DMA_DEST_AD	0x10
+#define BCM2708_DMA_NEXTCB	0x1C
+#define BCM2708_DMA_DEBUG	0x20
+
+#define BCM2708_DMA4_CS		(BCM2708_DMA_CHAN(4) + BCM2708_DMA_CS)
+#define BCM2708_DMA4_ADDR	(BCM2708_DMA_CHAN(4) + BCM2708_DMA_ADDR)
+
+#define BCM2708_DMA_TDMODE_LEN(w, h) ((h) << 16 | (w))
+
+/* When listing features we can ask for when allocating DMA channels give
+   those with higher priority smaller ordinal numbers */
+#define BCM_DMA_FEATURE_FAST_ORD	0
+#define BCM_DMA_FEATURE_BULK_ORD	1
+#define BCM_DMA_FEATURE_NORMAL_ORD	2
+#define BCM_DMA_FEATURE_LITE_ORD	3
+#define BCM_DMA_FEATURE_FAST		BIT(BCM_DMA_FEATURE_FAST_ORD)
+#define BCM_DMA_FEATURE_BULK		BIT(BCM_DMA_FEATURE_BULK_ORD)
+#define BCM_DMA_FEATURE_NORMAL		BIT(BCM_DMA_FEATURE_NORMAL_ORD)
+#define BCM_DMA_FEATURE_LITE		BIT(BCM_DMA_FEATURE_LITE_ORD)
+#define BCM_DMA_FEATURE_COUNT		4
+
+struct bcm2708_dma_cb {
+	u32 info;
+	u32 src;
+	u32 dst;
+	u32 length;
+	u32 stride;
+	u32 next;
+	u32 pad[2];
+};
+
+struct scatterlist;
+struct platform_device;
+
+#if defined(CONFIG_DMA_BCM2708) || defined(CONFIG_DMA_BCM2708_MODULE)
+
+int bcm_sg_suitable_for_dma(struct scatterlist *sg_ptr, int sg_len);
+void bcm_dma_start(void __iomem *dma_chan_base, dma_addr_t control_block);
+void bcm_dma_wait_idle(void __iomem *dma_chan_base);
+bool bcm_dma_is_busy(void __iomem *dma_chan_base);
+int bcm_dma_abort(void __iomem *dma_chan_base);
+
+/* return channel no or -ve error */
+int bcm_dma_chan_alloc(unsigned preferred_feature_set,
+		       void __iomem **out_dma_base, int *out_dma_irq);
+int bcm_dma_chan_free(int channel);
+
+int bcm_dmaman_probe(struct platform_device *pdev, void __iomem *base,
+		     u32 chans_available);
+int bcm_dmaman_remove(struct platform_device *pdev);
+
+#else /* CONFIG_DMA_BCM2708 */
+
+static inline int bcm_sg_suitable_for_dma(struct scatterlist *sg_ptr,
+					  int sg_len)
+{
+	return 0;
+}
+
+static inline void bcm_dma_start(void __iomem *dma_chan_base,
+				 dma_addr_t control_block) { }
+
+static inline void bcm_dma_wait_idle(void __iomem *dma_chan_base) { }
+
+static inline bool bcm_dma_is_busy(void __iomem *dma_chan_base)
+{
+	return false;
+}
+
+static inline int bcm_dma_abort(void __iomem *dma_chan_base)
+{
+	return -EINVAL;
+}
+
+static inline int bcm_dma_chan_alloc(unsigned preferred_feature_set,
+				     void __iomem **out_dma_base,
+				     int *out_dma_irq)
+{
+	return -EINVAL;
+}
+
+static inline int bcm_dma_chan_free(int channel)
+{
+	return -EINVAL;
+}
+
+static inline int bcm_dmaman_probe(struct platform_device *pdev,
+				   void __iomem *base, u32 chans_available)
+{
+	return 0;
+}
+
+static inline int bcm_dmaman_remove(struct platform_device *pdev)
+{
+	return 0;
+}
+
+#endif /* CONFIG_DMA_BCM2708 || CONFIG_DMA_BCM2708_MODULE */
+
+#endif /* _PLAT_BCM2708_DMA_H */
diff --git a/include/linux/w1-gpio.h b/include/linux/w1-gpio.h
index d58594a32324..feae94256256 100644
--- a/include/linux/w1-gpio.h
+++ b/include/linux/w1-gpio.h
@@ -18,6 +18,7 @@
 struct w1_gpio_platform_data {
 	unsigned int pin;
 	unsigned int is_open_drain:1;
+	unsigned int parasitic_power:1;
 	void (*enable_external_pullup)(int enable);
 	unsigned int ext_pullup_enable_pin;
 	unsigned int pullup_duration;
diff --git a/include/linux/w1.h b/include/linux/w1.h
index 5b2972946dda..b3558b7c9efb 100644
--- a/include/linux/w1.h
+++ b/include/linux/w1.h
@@ -157,6 +157,12 @@ struct w1_bus_master {
 
 	u8		(*set_pullup)(void *, int);
 
+	/**
+	 * Turns the pullup on/off in bitbanging mode, takes an on/off argument.
+	 * @return -1=Error, 0=completed
+	 */
+	void (*bitbang_pullup) (void *, u8);
+
 	void		(*search)(void *, struct w1_master *,
 		u8, w1_slave_found_callback);
 };
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index cb979ad90401..3c57f456a0e4 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -12,6 +12,8 @@
 #include <linux/types.h>
 #include <linux/of_device.h>
 
+#define RPI_FIRMWARE_CHAN_FB		1
+
 struct rpi_firmware;
 
 enum rpi_firmware_property_status {
@@ -63,6 +65,7 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_GET_MIN_VOLTAGE =                        0x00030008,
 	RPI_FIRMWARE_GET_TURBO =                              0x00030009,
 	RPI_FIRMWARE_GET_MAX_TEMPERATURE =                    0x0003000a,
+	RPI_FIRMWARE_GET_STC =                                0x0003000b,
 	RPI_FIRMWARE_ALLOCATE_MEMORY =                        0x0003000c,
 	RPI_FIRMWARE_LOCK_MEMORY =                            0x0003000d,
 	RPI_FIRMWARE_UNLOCK_MEMORY =                          0x0003000e,
@@ -72,12 +75,25 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_SET_ENABLE_QPU =                         0x00030012,
 	RPI_FIRMWARE_GET_DISPMANX_RESOURCE_MEM_HANDLE =       0x00030014,
 	RPI_FIRMWARE_GET_EDID_BLOCK =                         0x00030020,
+	RPI_FIRMWARE_GET_CUSTOMER_OTP =                       0x00030021,
 	RPI_FIRMWARE_GET_DOMAIN_STATE =                       0x00030030,
+	RPI_FIRMWARE_GET_THROTTLED =                          0x00030046,
+	RPI_FIRMWARE_GET_CLOCK_MEASURED =                     0x00030047,
+	RPI_FIRMWARE_NOTIFY_REBOOT =                          0x00030048,
 	RPI_FIRMWARE_SET_CLOCK_STATE =                        0x00038001,
 	RPI_FIRMWARE_SET_CLOCK_RATE =                         0x00038002,
 	RPI_FIRMWARE_SET_VOLTAGE =                            0x00038003,
 	RPI_FIRMWARE_SET_TURBO =                              0x00038009,
+	RPI_FIRMWARE_SET_CUSTOMER_OTP =                       0x00038021,
 	RPI_FIRMWARE_SET_DOMAIN_STATE =                       0x00038030,
+	RPI_FIRMWARE_GET_GPIO_STATE =                         0x00030041,
+	RPI_FIRMWARE_SET_GPIO_STATE =                         0x00038041,
+	RPI_FIRMWARE_SET_SDHOST_CLOCK =                       0x00038042,
+	RPI_FIRMWARE_GET_GPIO_CONFIG =                        0x00030043,
+	RPI_FIRMWARE_SET_GPIO_CONFIG =                        0x00038043,
+	RPI_FIRMWARE_GET_PERIPH_REG =                         0x00030045,
+	RPI_FIRMWARE_SET_PERIPH_REG =                         0x00038045,
+
 
 	/* Dispmanx TAGS */
 	RPI_FIRMWARE_FRAMEBUFFER_ALLOCATE =                   0x00040001,
@@ -91,6 +107,8 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_FRAMEBUFFER_GET_VIRTUAL_OFFSET =         0x00040009,
 	RPI_FIRMWARE_FRAMEBUFFER_GET_OVERSCAN =               0x0004000a,
 	RPI_FIRMWARE_FRAMEBUFFER_GET_PALETTE =                0x0004000b,
+	RPI_FIRMWARE_FRAMEBUFFER_GET_TOUCHBUF =               0x0004000f,
+	RPI_FIRMWARE_FRAMEBUFFER_GET_GPIOVIRTBUF =            0x00040010,
 	RPI_FIRMWARE_FRAMEBUFFER_RELEASE =                    0x00048001,
 	RPI_FIRMWARE_FRAMEBUFFER_TEST_PHYSICAL_WIDTH_HEIGHT = 0x00044003,
 	RPI_FIRMWARE_FRAMEBUFFER_TEST_VIRTUAL_WIDTH_HEIGHT =  0x00044004,
@@ -100,6 +118,7 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_FRAMEBUFFER_TEST_VIRTUAL_OFFSET =        0x00044009,
 	RPI_FIRMWARE_FRAMEBUFFER_TEST_OVERSCAN =              0x0004400a,
 	RPI_FIRMWARE_FRAMEBUFFER_TEST_PALETTE =               0x0004400b,
+	RPI_FIRMWARE_FRAMEBUFFER_TEST_VSYNC =                 0x0004400e,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_PHYSICAL_WIDTH_HEIGHT =  0x00048003,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_WIDTH_HEIGHT =   0x00048004,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_DEPTH =                  0x00048005,
@@ -108,6 +127,10 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_OFFSET =         0x00048009,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_OVERSCAN =               0x0004800a,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_PALETTE =                0x0004800b,
+	RPI_FIRMWARE_FRAMEBUFFER_SET_TOUCHBUF =               0x0004801f,
+	RPI_FIRMWARE_FRAMEBUFFER_SET_GPIOVIRTBUF =            0x00048020,
+	RPI_FIRMWARE_FRAMEBUFFER_SET_VSYNC =                  0x0004800e,
+	RPI_FIRMWARE_FRAMEBUFFER_SET_BACKLIGHT =              0x0004800f,
 
 	RPI_FIRMWARE_VCHIQ_INIT =                             0x00048010,
 
@@ -139,5 +162,6 @@ static inline struct rpi_firmware *rpi_firmware_get(struct device_node *firmware
 	return NULL;
 }
 #endif
+int rpi_firmware_transaction(struct rpi_firmware *fw, u32 chan, u32 data);
 
 #endif /* __SOC_RASPBERRY_FIRMWARE_H__ */
diff --git a/include/uapi/drm/vc4_drm.h b/include/uapi/drm/vc4_drm.h
index afae87004963..52263b575bdc 100644
--- a/include/uapi/drm/vc4_drm.h
+++ b/include/uapi/drm/vc4_drm.h
@@ -41,6 +41,7 @@ extern "C" {
 #define DRM_VC4_SET_TILING                        0x08
 #define DRM_VC4_GET_TILING                        0x09
 #define DRM_VC4_LABEL_BO                          0x0a
+#define DRM_VC4_GEM_MADVISE                       0x0b
 
 #define DRM_IOCTL_VC4_SUBMIT_CL           DRM_IOWR(DRM_COMMAND_BASE + DRM_VC4_SUBMIT_CL, struct drm_vc4_submit_cl)
 #define DRM_IOCTL_VC4_WAIT_SEQNO          DRM_IOWR(DRM_COMMAND_BASE + DRM_VC4_WAIT_SEQNO, struct drm_vc4_wait_seqno)
@@ -53,6 +54,7 @@ extern "C" {
 #define DRM_IOCTL_VC4_SET_TILING          DRM_IOWR(DRM_COMMAND_BASE + DRM_VC4_SET_TILING, struct drm_vc4_set_tiling)
 #define DRM_IOCTL_VC4_GET_TILING          DRM_IOWR(DRM_COMMAND_BASE + DRM_VC4_GET_TILING, struct drm_vc4_get_tiling)
 #define DRM_IOCTL_VC4_LABEL_BO            DRM_IOWR(DRM_COMMAND_BASE + DRM_VC4_LABEL_BO, struct drm_vc4_label_bo)
+#define DRM_IOCTL_VC4_GEM_MADVISE         DRM_IOWR(DRM_COMMAND_BASE + DRM_VC4_GEM_MADVISE, struct drm_vc4_gem_madvise)
 
 struct drm_vc4_submit_rcl_surface {
 	__u32 hindex; /* Handle index, or ~0 if not present. */
@@ -305,6 +307,7 @@ struct drm_vc4_get_hang_state {
 #define DRM_VC4_PARAM_SUPPORTS_ETC1		4
 #define DRM_VC4_PARAM_SUPPORTS_THREADED_FS	5
 #define DRM_VC4_PARAM_SUPPORTS_FIXED_RCL_ORDER	6
+#define DRM_VC4_PARAM_SUPPORTS_MADVISE		7
 
 struct drm_vc4_get_param {
 	__u32 param;
@@ -333,6 +336,22 @@ struct drm_vc4_label_bo {
 	__u64 name;
 };
 
+/*
+ * States prefixed with '__' are internal states and cannot be passed to the
+ * DRM_IOCTL_VC4_GEM_MADVISE ioctl.
+ */
+#define VC4_MADV_WILLNEED			0
+#define VC4_MADV_DONTNEED			1
+#define __VC4_MADV_PURGED			2
+#define __VC4_MADV_NOTSUPP			3
+
+struct drm_vc4_gem_madvise {
+	__u32 handle;
+	__u32 madv;
+	__u32 retained;
+	__u32 pad;
+};
+
 #if defined(__cplusplus)
 }
 #endif
diff --git a/include/uapi/linux/fb.h b/include/uapi/linux/fb.h
index 6cd9b198b7c6..f36c92c2da74 100644
--- a/include/uapi/linux/fb.h
+++ b/include/uapi/linux/fb.h
@@ -35,6 +35,12 @@
 #define FBIOPUT_MODEINFO        0x4617
 #define FBIOGET_DISPINFO        0x4618
 #define FBIO_WAITFORVSYNC	_IOW('F', 0x20, __u32)
+/*
+ * HACK: use 'z' in order not to clash with any other ioctl numbers which might
+ * be concurrently added to the mainline kernel
+ */
+#define FBIOCOPYAREA		_IOW('z', 0x21, struct fb_copyarea)
+#define FBIODMACOPY 		_IOW('z', 0x22, struct fb_dmacopy)
 
 #define FB_TYPE_PACKED_PIXELS		0	/* Packed Pixels	*/
 #define FB_TYPE_PLANES			1	/* Non interleaved planes */
@@ -347,6 +353,12 @@ struct fb_copyarea {
 	__u32 sy;
 };
 
+struct fb_dmacopy {
+	void *dst;
+	__u32 src;
+	__u32 length;
+};
+
 struct fb_fillrect {
 	__u32 dx;	/* screen-relative */
 	__u32 dy;
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 76c0ef2cb509..b866bfb347f3 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -5147,6 +5147,8 @@ int __init cgroup_init_early(void)
 }
 
 static u16 cgroup_disable_mask __initdata;
+static u16 cgroup_enable_mask __initdata;
+static int __init cgroup_disable(char *str);
 
 /**
  * cgroup_init - cgroup initialization
@@ -5185,6 +5187,12 @@ int __init cgroup_init(void)
 
 	mutex_unlock(&cgroup_mutex);
 
+	/* Apply an implicit disable... */
+	cgroup_disable("memory");
+
+	/* ...knowing that an explicit enable will override it. */
+	cgroup_disable_mask &= ~cgroup_enable_mask;
+
 	for_each_subsys(ss, ssid) {
 		if (ss->early_init) {
 			struct cgroup_subsys_state *css =
@@ -5565,6 +5573,28 @@ static int __init cgroup_disable(char *str)
 }
 __setup("cgroup_disable=", cgroup_disable);
 
+static int __init cgroup_enable(char *str)
+{
+	struct cgroup_subsys *ss;
+	char *token;
+	int i;
+
+	while ((token = strsep(&str, ",")) != NULL) {
+		if (!*token)
+			continue;
+
+		for_each_subsys(ss, i) {
+			if (strcmp(token, ss->name) &&
+			    strcmp(token, ss->legacy_name))
+				continue;
+
+			cgroup_enable_mask |= 1 << i;
+		}
+	}
+	return 1;
+}
+__setup("cgroup_enable=", cgroup_enable);
+
 /**
  * css_tryget_online_from_dir - get corresponding css from a cgroup dentry
  * @dentry: directory dentry of interest
diff --git a/kernel/resource.c b/kernel/resource.c
index 7ee3dd1ad2af..26cb8d8fac8c 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -246,6 +246,12 @@ static int __release_resource(struct resource *old, bool release_child)
 {
 	struct resource *tmp, **p, *chd;
 
+	if (!old->parent) {
+		WARN(old->sibling, "sibling but no parent");
+		if (old->sibling)
+			return -EINVAL;
+		return 0;
+	}
 	p = &old->parent->child;
 	for (;;) {
 		tmp = *p;
diff --git a/kernel/softirq.c b/kernel/softirq.c
index e89c3b0cff6d..3f3fbc230579 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -77,17 +77,6 @@ static void wakeup_softirqd(void)
 		wake_up_process(tsk);
 }
 
-/*
- * If ksoftirqd is scheduled, we do not want to process pending softirqs
- * right now. Let ksoftirqd handle this at its own rate, to get fairness.
- */
-static bool ksoftirqd_running(void)
-{
-	struct task_struct *tsk = __this_cpu_read(ksoftirqd);
-
-	return tsk && (tsk->state == TASK_RUNNING);
-}
-
 /*
  * preempt_count and SOFTIRQ_OFFSET usage:
  * - preempt_count is changed by SOFTIRQ_OFFSET on entering or leaving
@@ -324,7 +313,7 @@ asmlinkage __visible void do_softirq(void)
 
 	pending = local_softirq_pending();
 
-	if (pending && !ksoftirqd_running())
+	if (pending)
 		do_softirq_own_stack();
 
 	local_irq_restore(flags);
@@ -351,9 +340,6 @@ void irq_enter(void)
 
 static inline void invoke_softirq(void)
 {
-	if (ksoftirqd_running())
-		return;
-
 	if (!force_irqthreads) {
 #ifdef CONFIG_HAVE_IRQ_EXIT_ON_IRQ_STACK
 		/*
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 1d7693c35424..5872325d2545 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -7622,8 +7622,6 @@ int alloc_contig_range(unsigned long start, unsigned long end,
 
 	/* Make sure the range is really isolated. */
 	if (test_pages_isolated(outer_start, end, false)) {
-		pr_info_ratelimited("%s: [%lx, %lx) PFNs busy\n",
-			__func__, outer_start, end);
 		ret = -EBUSY;
 		goto done;
 	}
diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
index 97769465de13..00bf540b8026 100644
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -293,7 +293,7 @@ ksym_dep_filter =                                                            \
 	    $(CPP) $(call flags_nodeps,c_flags) -D__KSYM_DEPS__ $< ;;        \
 	  as_*_S|cpp_s_S)                                                    \
 	    $(CPP) $(call flags_nodeps,a_flags) -D__KSYM_DEPS__ $< ;;        \
-	  boot*|build*|cpp_its_S|*cpp_lds_S|dtc|host*|vdso*) : ;;            \
+	  boot*|build*|cpp_its_S|*cpp_lds_S|dtc*|host*|vdso*) : ;;            \
 	  *) echo "Don't know how to preprocess $(1)" >&2; false ;;          \
 	esac | tr ";" "\n" | sed -rn 's/^.*=== __KSYM_(.*) ===.*$$/KSYM_\1/p'
 
diff --git a/scripts/Makefile.dtbinst b/scripts/Makefile.dtbinst
index c8ba6e7f9868..e1190ddfe462 100644
--- a/scripts/Makefile.dtbinst
+++ b/scripts/Makefile.dtbinst
@@ -22,6 +22,7 @@ include scripts/Kbuild.include
 include $(src)/Makefile
 
 dtbinst-files	:= $(dtb-y)
+dtboinst-files	:= $(dtbo-y)
 dtbinst-dirs	:= $(dts-dirs)
 
 # Helper targets for Installing DTBs into the boot directory
@@ -33,10 +34,13 @@ install-dir = $(patsubst $(dtbinst_root)%,$(INSTALL_DTBS_PATH)%,$(obj))
 $(dtbinst-files): %.dtb: $(obj)/%.dtb
 	$(call cmd,dtb_install,$(install-dir))
 
+$(dtboinst-files): %.dtbo: $(obj)/%.dtbo
+	$(call cmd,dtb_install,$(install-dir))
+
 $(dtbinst-dirs):
 	$(Q)$(MAKE) $(dtbinst)=$(obj)/$@
 
-PHONY += $(dtbinst-files) $(dtbinst-dirs)
-__dtbs_install: $(dtbinst-files) $(dtbinst-dirs)
+PHONY += $(dtbinst-files) $(dtboinst-files) $(dtbinst-dirs)
+__dtbs_install: $(dtbinst-files) $(dtboinst-files) $(dtbinst-dirs)
 
 .PHONY: $(PHONY)
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index aac94d962ed6..0d100ca47d6f 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -316,6 +316,17 @@ cmd_dtc = mkdir -p $(dir ${dtc-tmp}) ; \
 $(obj)/%.dtb: $(src)/%.dts FORCE
 	$(call if_changed_dep,dtc)
 
+quiet_cmd_dtco = DTCO    $@
+cmd_dtco = mkdir -p $(dir ${dtc-tmp}) ; \
+	$(CPP) $(dtc_cpp_flags) -x assembler-with-cpp -o $(dtc-tmp) $< ; \
+	$(DTC) -@ -H epapr -O dtb -o $@ -b 0 \
+		-i $(dir $<) $(DTC_FLAGS) \
+		-d $(depfile).dtc.tmp $(dtc-tmp) ; \
+	cat $(depfile).pre.tmp $(depfile).dtc.tmp > $(depfile)
+
+$(obj)/%.dtbo: $(src)/%-overlay.dts FORCE
+	$(call if_changed_dep,dtco)
+
 dtc-tmp = $(subst $(comma),_,$(dot-target).dts.tmp)
 
 # Bzip2
diff --git a/scripts/knlinfo b/scripts/knlinfo
new file mode 100755
index 000000000000..263ec937eaa7
--- /dev/null
+++ b/scripts/knlinfo
@@ -0,0 +1,171 @@
+#!/usr/bin/env perl
+# ----------------------------------------------------------------------
+# knlinfo by Phil Elwell for Raspberry Pi
+#
+# (c) 2014,2015 Raspberry Pi (Trading) Limited <info@raspberrypi.org>
+#
+# Licensed under the terms of the GNU General Public License.
+# ----------------------------------------------------------------------
+
+use strict;
+use integer;
+
+use Fcntl ":seek";
+
+my $trailer_magic = 'RPTL';
+
+my %atom_formats =
+(
+    'DDTK' => \&format_bool,
+    'DTOK' => \&format_bool,
+    'KVer' => \&format_string,
+    '270X' => \&format_bool,
+    '283X' => \&format_bool,
+    '283x' => \&format_bool,
+);
+
+if (@ARGV != 1)
+{
+	print ("Usage: knlinfo <kernel image>\n");
+	exit(1);
+}
+
+my $kernel_file = $ARGV[0];
+
+
+my ($atoms, $pos) = read_trailer($kernel_file);
+
+exit(1) if (!$atoms);
+
+printf("Kernel trailer found at %d/0x%x:\n", $pos, $pos);
+
+foreach my $atom (@$atoms)
+{
+    printf("  %s: %s\n", $atom->[0], format_atom($atom));
+}
+
+exit(0);
+
+sub read_trailer
+{
+	my ($kernel_file) = @_;
+	my $fh;
+
+	if (!open($fh, '<', $kernel_file))
+	{
+		print ("* Failed to open '$kernel_file'\n");
+		return undef;
+	}
+
+	if (!seek($fh, -12, SEEK_END))
+	{
+		print ("* seek error in '$kernel_file'\n");
+		return undef;
+	}
+
+	my $last_bytes;
+	sysread($fh, $last_bytes, 12);
+
+	my ($trailer_len, $data_len, $magic) = unpack('VVa4', $last_bytes);
+
+	if (($magic ne $trailer_magic) || ($data_len != 4))
+	{
+		print ("* no trailer\n");
+		return undef;
+	}
+	if (!seek($fh, -12, SEEK_END))
+	{
+		print ("* seek error in '$kernel_file'\n");
+		return undef;
+	}
+
+	$trailer_len -= 12;
+
+	while ($trailer_len > 0)
+	{
+		if ($trailer_len < 8)
+		{
+			print ("* truncated atom header in trailer\n");
+			return undef;
+		}
+		if (!seek($fh, -8, SEEK_CUR))
+		{
+			print ("* seek error in '$kernel_file'\n");
+			return undef;
+		}
+		$trailer_len -= 8;
+
+		my $atom_hdr;
+		sysread($fh, $atom_hdr, 8);
+		my ($atom_len, $atom_type) = unpack('Va4', $atom_hdr);
+
+		if ($trailer_len < $atom_len)
+		{
+			print ("* truncated atom data in trailer\n");
+			return undef;
+		}
+
+		my $rounded_len = (($atom_len + 3) & ~3);
+		if (!seek($fh, -(8 + $rounded_len), SEEK_CUR))
+		{
+			print ("* seek error in '$kernel_file'\n");
+			return undef;
+		}
+		$trailer_len -= $rounded_len;
+
+		my $atom_data;
+		sysread($fh, $atom_data, $atom_len);
+
+		if (!seek($fh, -$atom_len, SEEK_CUR))
+		{
+			print ("* seek error in '$kernel_file'\n");
+			return undef;
+		}
+
+		push @$atoms, [ $atom_type, $atom_data ];
+	}
+
+ 	if (($$atoms[-1][0] eq "\x00\x00\x00\x00") &&
+	    ($$atoms[-1][1] eq ""))
+	{
+		pop @$atoms;
+	}
+	else
+	{
+		print ("* end marker missing from trailer\n");
+	}
+
+	return ($atoms, tell($fh));
+}
+
+sub format_atom
+{
+    my ($atom) = @_;
+
+    my $format_func = $atom_formats{$atom->[0]} || \&format_hex;
+    return $format_func->($atom->[1]);
+}
+
+sub format_bool
+{
+    my ($data) = @_;
+    return unpack('V', $data) ? 'y' : 'n';
+}
+
+sub format_int
+{
+    my ($data) = @_;
+    return unpack('V', $data);
+}
+
+sub format_string
+{
+    my ($data) = @_;
+    return '"'.$data.'"';
+}
+
+sub format_hex
+{
+    my ($data) = @_;
+    return unpack('H*', $data);
+}
diff --git a/scripts/mkknlimg b/scripts/mkknlimg
new file mode 100755
index 000000000000..d72e15224232
--- /dev/null
+++ b/scripts/mkknlimg
@@ -0,0 +1,262 @@
+#!/usr/bin/env perl
+# ----------------------------------------------------------------------
+# mkknlimg by Phil Elwell for Raspberry Pi
+# based on extract-ikconfig by Dick Streefland
+#
+# (c) 2009,2010 Dick Streefland <dick@streefland.net>
+# (c) 2014,2015 Raspberry Pi (Trading) Limited <info@raspberrypi.org>
+#
+# Licensed under the terms of the GNU General Public License.
+# ----------------------------------------------------------------------
+
+use strict;
+use warnings;
+use integer;
+
+use constant FLAG_PI   => 0x01;
+use constant FLAG_DTOK => 0x02;
+use constant FLAG_DDTK => 0x04;
+use constant FLAG_270X => 0x08;
+use constant FLAG_283X => 0x10;
+
+my $trailer_magic = 'RPTL';
+
+my $tmpfile1 = "/tmp/mkknlimg_$$.1";
+my $tmpfile2 = "/tmp/mkknlimg_$$.2";
+
+my $dtok = 0;
+my $ddtk = 0;
+my $is_270x = 0;
+my $is_283x = 0;
+
+while (@ARGV && ($ARGV[0] =~ /^-/))
+{
+    my $arg = shift(@ARGV);
+    if ($arg eq '--dtok')
+    {
+	$dtok = 1;
+    }
+    elsif ($arg eq '--ddtk')
+    {
+	$ddtk = 1;
+    }
+    elsif ($arg eq '--270x')
+    {
+	$is_270x = 1;
+    }
+    elsif ($arg eq '--283x')
+    {
+	$is_283x = 1;
+    }
+    else
+    {
+	print ("* Unknown option '$arg'\n");
+	usage();
+    }
+}
+
+usage() if (@ARGV != 2);
+
+my $kernel_file = $ARGV[0];
+my $out_file = $ARGV[1];
+
+if (! -r $kernel_file)
+{
+    print ("* File '$kernel_file' not found\n");
+    usage();
+}
+
+my $wanted_strings =
+{
+	'brcm,bcm2835-mmc' => FLAG_PI,
+	'brcm,bcm2835-sdhost' => FLAG_PI,
+	'brcm,bcm2835-gpio' => FLAG_PI | FLAG_DTOK,
+	'brcm,bcm2708-fb'   => FLAG_PI | FLAG_DTOK | FLAG_270X,
+	'brcm,bcm2708-usb'  => FLAG_PI | FLAG_DTOK | FLAG_270X,
+	'brcm,bcm2835' => FLAG_PI | FLAG_DTOK | FLAG_283X,
+	'brcm,bcm2836' => FLAG_PI | FLAG_DTOK | FLAG_283X,
+	'brcm,bcm2837' => FLAG_PI | FLAG_DTOK | FLAG_283X,
+	'of_cfs_init' => FLAG_DTOK | FLAG_DDTK,
+};
+
+my $res = try_extract($kernel_file, $tmpfile1);
+$res ||= try_decompress('\037\213\010', 'xy',    'gunzip', 0,
+			$kernel_file, $tmpfile1, $tmpfile2);
+$res ||= try_decompress('\3757zXZ\000', 'abcde', 'unxz --single-stream', -1,
+			$kernel_file, $tmpfile1, $tmpfile2);
+$res ||= try_decompress('BZh',          'xy',    'bunzip2', 0,
+			$kernel_file, $tmpfile1, $tmpfile2);
+$res ||= try_decompress('\135\0\0\0',   'xxx',   'unlzma', 0,
+			$kernel_file, $tmpfile1, $tmpfile2);
+$res ||= try_decompress('\211\114\132', 'xy',    'lzop -d', 0,
+			$kernel_file, $tmpfile1, $tmpfile2);
+$res ||= try_decompress('\002\041\114\030', 'xy',    'lz4 -d', 1,
+			$kernel_file, $tmpfile1, $tmpfile2);
+
+my $append_trailer;
+my $trailer;
+my $kver = '?';
+
+$append_trailer = 1;
+
+if ($res)
+{
+    $kver = $res->{'kver'} || '?';
+    my $flags = $res->{'flags'};
+    print("Version: $kver\n");
+
+    if ($flags & FLAG_PI)
+    {
+	$dtok ||= ($flags & FLAG_DTOK) != 0;
+	$is_270x ||= ($flags & FLAG_270X) != 0;
+	$is_283x ||= ($flags & FLAG_283X) != 0;
+	$ddtk ||= ($flags & FLAG_DDTK) != 0;
+    }
+    else
+    {
+	print ("* This doesn't look like a Raspberry Pi kernel.\n");
+    }
+}
+elsif (!$dtok)
+{
+    print ("* Is this a valid kernel?\n");
+}
+
+if ($append_trailer)
+{
+    printf("DT: %s\n", $dtok ? "y" : "n");
+    printf("DDT: %s\n", $ddtk ? "y" : "n");
+    printf("270x: %s\n", $is_270x ? "y" : "n");
+    printf("283x: %s\n", $is_283x ? "y" : "n");
+
+    my @atoms;
+
+    push @atoms, [ $trailer_magic, pack('V', 0) ];
+    push @atoms, [ 'KVer', $kver ];
+    push @atoms, [ 'DTOK', pack('V', $dtok) ];
+    push @atoms, [ 'DDTK', pack('V', $ddtk) ];
+    push @atoms, [ '270X', pack('V', $is_270x) ];
+    push @atoms, [ '283X', pack('V', $is_283x) ];
+    push @atoms, [ '283x', pack('V', $is_283x && !$is_270x) ];
+
+    $trailer = pack_trailer(\@atoms);
+    $atoms[0]->[1] = pack('V', length($trailer));
+
+    $trailer = pack_trailer(\@atoms);
+}
+
+my $ofh;
+my $total_len = 0;
+
+if ($out_file eq $kernel_file)
+{
+    die "* Failed to open '$out_file' for append\n"
+	if (!open($ofh, '>>', $out_file));
+    $total_len = tell($ofh);
+}
+else
+{
+    die "* Failed to open '$kernel_file'\n"
+	if (!open(my $ifh, '<', $kernel_file));
+    die "* Failed to create '$out_file'\n"
+	if (!open($ofh, '>', $out_file));
+
+    my $copybuf;
+    while (1)
+    {
+	my $bytes = sysread($ifh, $copybuf, 64*1024);
+	last if (!$bytes);
+	syswrite($ofh, $copybuf, $bytes);
+	$total_len += $bytes;
+    }
+    close($ifh);
+}
+
+if ($trailer)
+{
+    # Pad to word-alignment
+    syswrite($ofh, "\x000\x000\x000", (-$total_len & 0x3));
+    syswrite($ofh, $trailer);
+}
+
+close($ofh);
+
+exit($trailer ? 0 : 1);
+
+END {
+	unlink($tmpfile1) if ($tmpfile1);
+	unlink($tmpfile2) if ($tmpfile2);
+}
+
+
+sub usage
+{
+	print ("Usage: mkknlimg [--dtok] [--270x] [--283x] <vmlinux|zImage|bzImage> <outfile>\n");
+	exit(1);
+}
+
+sub try_extract
+{
+	my ($knl, $tmp) = @_;
+
+	my $ver = `strings "$knl" | grep -a -E "^Linux version [1-9]"`;
+
+	return undef if (!$ver);
+
+	chomp($ver);
+
+	my $res = { 'kver'=>$ver };
+	$res->{'flags'} = strings_to_flags($knl, $wanted_strings);
+
+	return $res;
+}
+
+
+sub try_decompress
+{
+	my ($magic, $subst, $zcat, $idx, $knl, $tmp1, $tmp2) = @_;
+
+	my $pos = `tr "$magic\n$subst" "\n$subst=" < "$knl" | grep -abo "^$subst"`;
+	if ($pos)
+	{
+		chomp($pos);
+		$pos = (split(/[\r\n]+/, $pos))[$idx];
+		return undef if (!defined($pos));
+		$pos =~ s/:.*[\r\n]*$//s;
+		my $cmd = "tail -c+$pos \"$knl\" | $zcat > $tmp2 2> /dev/null";
+		my $err = (system($cmd) >> 8);
+		return undef if (($err != 0) && ($err != 2));
+
+		return try_extract($tmp2, $tmp1);
+	}
+
+	return undef;
+}
+
+sub strings_to_flags
+{
+	my ($knl, $strings) = @_;
+	my $string_pattern = '^('.join('|', keys(%$strings)).')$';
+	my $flags = 0;
+
+	my @matches = `strings \"$knl\" | grep -E \"$string_pattern\"`;
+	foreach my $match (@matches)
+	{
+	    chomp($match);
+	    $flags |= $strings->{$match};
+	}
+
+	return $flags;
+}
+
+sub pack_trailer
+{
+	my ($atoms) = @_;
+	my $trailer = pack('VV', 0, 0);
+	for (my $i = $#$atoms; $i>=0; $i--)
+	{
+		my $atom = $atoms->[$i];
+		$trailer .= pack('a*x!4Va4', $atom->[1], length($atom->[1]), $atom->[0]);
+	}
+	return $trailer;
+}
diff --git a/sound/soc/bcm/Kconfig b/sound/soc/bcm/Kconfig
index edf367100ebd..21622eda8c60 100644
--- a/sound/soc/bcm/Kconfig
+++ b/sound/soc/bcm/Kconfig
@@ -16,4 +16,184 @@ config SND_SOC_CYGNUS
 	  Say Y if you want to add support for ASoC audio on Broadcom
 	  Cygnus chips (bcm958300, bcm958305, bcm911360)
 
-	  If you don't know what to do here, say N.
\ No newline at end of file
+	  If you don't know what to do here, say N.
+
+config SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD
+	tristate "Support for Google voiceHAT soundcard"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_VOICEHAT
+	help
+          Say Y or M if you want to add support for voiceHAT soundcard.
+
+config SND_BCM2708_SOC_HIFIBERRY_DAC
+        tristate "Support for HifiBerry DAC"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+        select SND_SOC_PCM5102A
+        help
+         Say Y or M if you want to add support for HifiBerry DAC.
+
+config SND_BCM2708_SOC_HIFIBERRY_DACPLUS
+        tristate "Support for HifiBerry DAC+"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+        select SND_SOC_PCM512x
+        help
+         Say Y or M if you want to add support for HifiBerry DAC+.
+
+config SND_BCM2708_SOC_HIFIBERRY_DIGI
+        tristate "Support for HifiBerry Digi"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+        select SND_SOC_WM8804
+        help
+         Say Y or M if you want to add support for HifiBerry Digi S/PDIF output board.
+
+config SND_BCM2708_SOC_HIFIBERRY_AMP
+        tristate "Support for the HifiBerry Amp"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+        select SND_SOC_TAS5713
+        help
+         Say Y or M if you want to add support for the HifiBerry Amp amplifier board.
+
+config SND_BCM2708_SOC_RPI_CIRRUS
+        tristate "Support for Cirrus Logic Audio Card"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+        select SND_SOC_WM5102
+        select SND_SOC_WM8804
+        help
+         Say Y or M if you want to add support for the Wolfson and
+         Cirrus Logic audio cards.
+
+config SND_BCM2708_SOC_RPI_DAC
+        tristate "Support for RPi-DAC"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+        select SND_SOC_PCM1794A
+        help
+         Say Y or M if you want to add support for RPi-DAC.
+
+config SND_BCM2708_SOC_RPI_PROTO
+	tristate "Support for Rpi-PROTO"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_WM8731
+	help
+	  Say Y or M if you want to add support for Audio Codec Board PROTO (WM8731).
+
+config SND_BCM2708_SOC_JUSTBOOM_DAC
+	tristate "Support for JustBoom DAC"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_PCM512x
+	help
+	  Say Y or M if you want to add support for JustBoom DAC.
+
+config SND_BCM2708_SOC_JUSTBOOM_DIGI
+	tristate "Support for JustBoom Digi"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_WM8804
+	help
+	  Say Y or M if you want to add support for JustBoom Digi.
+
+config SND_BCM2708_SOC_IQAUDIO_DAC
+	tristate "Support for IQaudIO-DAC"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_PCM512x_I2C
+	help
+	  Say Y or M if you want to add support for IQaudIO-DAC.
+
+config SND_BCM2708_SOC_IQAUDIO_DIGI
+        tristate "Support for IQAudIO Digi"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+        select SND_SOC_WM8804
+        help
+         Say Y or M if you want to add support for IQAudIO Digital IO board.
+
+config SND_BCM2708_SOC_ADAU1977_ADC
+	tristate "Support for ADAU1977 ADC"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_ADAU1977_I2C
+	help
+	  Say Y or M if you want to add support for ADAU1977 ADC.
+
+config SND_AUDIOINJECTOR_PI_SOUNDCARD
+	tristate "Support for audioinjector.net Pi add on soundcard"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_WM8731
+	help
+	  Say Y or M if you want to add support for audioinjector.net Pi Hat
+
+config SND_AUDIOINJECTOR_OCTO_SOUNDCARD
+	tristate "Support for audioinjector.net Octo channel (Hat) soundcard"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_CS42XX8_I2C
+	help
+	  Say Y or M if you want to add support for audioinjector.net octo add on
+
+config SND_DIGIDAC1_SOUNDCARD
+        tristate "Support for Red Rocks Audio DigiDAC1"
+        depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+        select SND_SOC_WM8804
+        select SND_SOC_WM8741
+        help
+         Say Y or M if you want to add support for Red Rocks Audio DigiDAC1 board.
+
+config SND_BCM2708_SOC_DIONAUDIO_LOCO
+	tristate "Support for Dion Audio LOCO DAC-AMP"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_PCM5102a
+	help
+	  Say Y or M if you want to add support for Dion Audio LOCO.
+
+config SND_BCM2708_SOC_DIONAUDIO_LOCO_V2
+	tristate "Support for Dion Audio LOCO-V2 DAC-AMP"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_PCM5122
+	help
+	  Say Y or M if you want to add support for Dion Audio LOCO-V2.
+
+config SND_BCM2708_SOC_ALLO_PIANO_DAC
+	tristate "Support for Allo Piano DAC"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_PCM512x_I2C
+	help
+	  Say Y or M if you want to add support for Allo Piano DAC.
+
+config SND_BCM2708_SOC_ALLO_PIANO_DAC_PLUS
+	tristate "Support for Allo Piano DAC Plus"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_PCM512x_I2C
+	help
+	  Say Y or M if you want to add support for Allo Piano DAC Plus.
+
+config SND_BCM2708_SOC_ALLO_BOSS_DAC
+	tristate "Support for Allo Boss DAC"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_PCM512x_I2C
+	help
+	  Say Y or M if you want to add support for Allo Boss DAC.
+
+config SND_BCM2708_SOC_ALLO_DIGIONE 
+        tristate "Support for Allo DigiOne"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_PCM512x_I2C
+	help
+	  Say Y or M if you want to add support for Allo DigiOne.
+
+config SND_BCM2708_SOC_ALLO_KATANA_DAC
+	tristate "Support for Allo Katana DAC"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	depends on I2C
+	select REGMAP_I2C
+	select SND_AUDIO_GRAPH_CARD
+	help
+	  Say Y or M if you want to add support for Allo Katana DAC.
+
+config SND_BCM2708_SOC_FE_PI_AUDIO
+	tristate "Support for Fe-Pi-Audio"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_SOC_SGTL5000
+	help
+	  Say Y or M if you want to add support for Fe-Pi-Audio.
+
+config SND_PISOUND
+	tristate "Support for Blokas Labs pisound"
+	depends on SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
+	select SND_RAWMIDI
+	help
+	  Say Y or M if you want to add support for Blokas Labs pisound.
diff --git a/sound/soc/bcm/Makefile b/sound/soc/bcm/Makefile
index fc739d007884..e96022b866b5 100644
--- a/sound/soc/bcm/Makefile
+++ b/sound/soc/bcm/Makefile
@@ -8,3 +8,59 @@ snd-soc-cygnus-objs := cygnus-pcm.o cygnus-ssp.o
 
 obj-$(CONFIG_SND_SOC_CYGNUS) += snd-soc-cygnus.o
 
+# Google voiceHAT custom codec support
+snd-soc-googlevoicehat-codec-objs := googlevoicehat-codec.o
+
+# BCM2708 Machine Support
+snd-soc-adau1977-adc-objs := adau1977-adc.o
+snd-soc-googlevoicehat-soundcard-objs := googlevoicehat-soundcard.o
+snd-soc-hifiberry-amp-objs := hifiberry_amp.o
+snd-soc-hifiberry-dac-objs := hifiberry_dac.o
+snd-soc-hifiberry-dacplus-objs := hifiberry_dacplus.o
+snd-soc-hifiberry-digi-objs := hifiberry_digi.o
+snd-soc-justboom-dac-objs := justboom-dac.o
+snd-soc-justboom-digi-objs := justboom-digi.o
+snd-soc-rpi-cirrus-objs := rpi-cirrus.o
+snd-soc-rpi-dac-objs := rpi-dac.o
+snd-soc-rpi-proto-objs := rpi-proto.o
+snd-soc-iqaudio-dac-objs := iqaudio-dac.o
+snd-soc-iqaudio-digi-objs := iqaudio_digi.o
+snd-soc-audioinjector-pi-soundcard-objs := audioinjector-pi-soundcard.o
+snd-soc-audioinjector-octo-soundcard-objs := audioinjector-octo-soundcard.o
+snd-soc-digidac1-soundcard-objs := digidac1-soundcard.o
+snd-soc-dionaudio-loco-objs := dionaudio_loco.o
+snd-soc-dionaudio-loco-v2-objs := dionaudio_loco-v2.o
+snd-soc-allo-boss-dac-objs := allo-boss-dac.o
+snd-soc-allo-piano-dac-objs := allo-piano-dac.o
+snd-soc-allo-piano-dac-plus-objs := allo-piano-dac-plus.o
+snd-soc-allo-digione-objs := allo-digione.o
+snd-soc-allo-katana-codec-objs := allo-katana-codec.o
+snd-soc-pisound-objs := pisound.o
+snd-soc-fe-pi-audio-objs := fe-pi-audio.o
+
+obj-$(CONFIG_SND_BCM2708_SOC_ADAU1977_ADC) += snd-soc-adau1977-adc.o
+obj-$(CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD) += snd-soc-googlevoicehat-soundcard.o
+obj-$(CONFIG_SND_BCM2708_SOC_GOOGLEVOICEHAT_SOUNDCARD)  += snd-soc-googlevoicehat-codec.o
+obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_AMP) += snd-soc-hifiberry-amp.o
+obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DAC) += snd-soc-hifiberry-dac.o
+obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DACPLUS) += snd-soc-hifiberry-dacplus.o
+obj-$(CONFIG_SND_BCM2708_SOC_HIFIBERRY_DIGI) += snd-soc-hifiberry-digi.o
+obj-$(CONFIG_SND_BCM2708_SOC_JUSTBOOM_DAC) += snd-soc-justboom-dac.o
+obj-$(CONFIG_SND_BCM2708_SOC_JUSTBOOM_DIGI) += snd-soc-justboom-digi.o
+obj-$(CONFIG_SND_BCM2708_SOC_RPI_CIRRUS) += snd-soc-rpi-cirrus.o
+obj-$(CONFIG_SND_BCM2708_SOC_RPI_DAC) += snd-soc-rpi-dac.o
+obj-$(CONFIG_SND_BCM2708_SOC_RPI_PROTO) += snd-soc-rpi-proto.o
+obj-$(CONFIG_SND_BCM2708_SOC_IQAUDIO_DAC) += snd-soc-iqaudio-dac.o
+obj-$(CONFIG_SND_BCM2708_SOC_IQAUDIO_DIGI) += snd-soc-iqaudio-digi.o
+obj-$(CONFIG_SND_AUDIOINJECTOR_PI_SOUNDCARD) += snd-soc-audioinjector-pi-soundcard.o
+obj-$(CONFIG_SND_AUDIOINJECTOR_OCTO_SOUNDCARD) += snd-soc-audioinjector-octo-soundcard.o
+obj-$(CONFIG_SND_DIGIDAC1_SOUNDCARD) += snd-soc-digidac1-soundcard.o
+obj-$(CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO) += snd-soc-dionaudio-loco.o
+obj-$(CONFIG_SND_BCM2708_SOC_DIONAUDIO_LOCO_V2) += snd-soc-dionaudio-loco-v2.o
+obj-$(CONFIG_SND_BCM2708_SOC_ALLO_BOSS_DAC) += snd-soc-allo-boss-dac.o
+obj-$(CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC) += snd-soc-allo-piano-dac.o
+obj-$(CONFIG_SND_BCM2708_SOC_ALLO_PIANO_DAC_PLUS) += snd-soc-allo-piano-dac-plus.o
+obj-$(CONFIG_SND_BCM2708_SOC_ALLO_DIGIONE) += snd-soc-allo-digione.o
+obj-$(CONFIG_SND_BCM2708_SOC_ALLO_KATANA_DAC) += snd-soc-allo-katana-codec.o
+obj-$(CONFIG_SND_PISOUND) += snd-soc-pisound.o
+obj-$(CONFIG_SND_BCM2708_SOC_FE_PI_AUDIO) += snd-soc-fe-pi-audio.o
diff --git a/sound/soc/bcm/adau1977-adc.c b/sound/soc/bcm/adau1977-adc.c
new file mode 100644
index 000000000000..f3d7e5db7bb9
--- /dev/null
+++ b/sound/soc/bcm/adau1977-adc.c
@@ -0,0 +1,125 @@
+/*
+ * ASoC Driver for ADAU1977 ADC
+ *
+ * Author:	Andrey Grodzovsky <andrey2805@gmail.com>
+ *		Copyright 2016
+ *
+ * This file is based on hifibery_dac driver by Florian Meier.
+ * 
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+enum adau1977_clk_id {
+    ADAU1977_SYSCLK,
+};
+ 
+enum adau1977_sysclk_src {
+    ADAU1977_SYSCLK_SRC_MCLK,
+    ADAU1977_SYSCLK_SRC_LRCLK,
+};
+
+static int eval_adau1977_init(struct snd_soc_pcm_runtime *rtd)
+{
+	int ret;
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+	
+	ret = snd_soc_dai_set_tdm_slot(codec_dai, 0, 0, 0, 0);
+	if (ret < 0)
+		return ret;
+
+	return snd_soc_codec_set_sysclk(rtd->codec, ADAU1977_SYSCLK,
+			ADAU1977_SYSCLK_SRC_MCLK, 11289600, SND_SOC_CLOCK_IN);
+}
+ 
+static struct snd_soc_dai_link snd_rpi_adau1977_dai[] = {
+	{
+	.name = "adau1977",
+	.stream_name = "ADAU1977", 
+	.cpu_dai_name = "bcm2708-i2s.0", 
+	.codec_dai_name = "adau1977-hifi",
+	.platform_name = "bcm2708-i2s.0",
+	.codec_name = "adau1977.1-0011",
+	.init = eval_adau1977_init,
+	.dai_fmt = SND_SOC_DAIFMT_I2S |
+		SND_SOC_DAIFMT_NB_NF |
+		SND_SOC_DAIFMT_CBM_CFM,
+	},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_adau1977_adc = {
+	.name         = "snd_rpi_adau1977_adc",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_rpi_adau1977_dai,
+	.num_links    = ARRAY_SIZE(snd_rpi_adau1977_dai),
+};
+
+static int snd_adau1977_adc_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_adau1977_adc.dev = &pdev->dev;
+	if (pdev->dev.of_node) {
+	    struct device_node *i2s_node;
+	    struct snd_soc_dai_link *dai = &snd_rpi_adau1977_dai[0];
+	    i2s_node = of_parse_phandle(pdev->dev.of_node,
+					"i2s-controller", 0);
+
+	    if (i2s_node) {
+		dai->cpu_dai_name = NULL;
+		dai->cpu_of_node = i2s_node;
+		dai->platform_name = NULL;
+		dai->platform_of_node = i2s_node;
+	    }
+	}
+
+	ret = snd_soc_register_card(&snd_adau1977_adc);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+static int snd_adau1977_adc_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&snd_adau1977_adc);
+}
+
+static const struct of_device_id snd_adau1977_adc_of_match[] = {
+	{ .compatible = "adi,adau1977-adc", },
+	{},
+};
+
+MODULE_DEVICE_TABLE(of, snd_adau1977_adc_of_match);
+
+static struct platform_driver snd_adau1977_adc_driver = {
+        .driver = {
+                .name   = "snd-adau1977-adc",
+                .owner  = THIS_MODULE,
+		.of_match_table = snd_adau1977_adc_of_match,
+        },
+        .probe          = snd_adau1977_adc_probe,
+        .remove         = snd_adau1977_adc_remove,
+};
+
+module_platform_driver(snd_adau1977_adc_driver);
+
+MODULE_AUTHOR("Andrey Grodzovsky <andrey2805@gmail.com>");
+MODULE_DESCRIPTION("ASoC Driver for ADAU1977 ADC");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/allo-boss-dac.c b/sound/soc/bcm/allo-boss-dac.c
new file mode 100644
index 000000000000..08b710c7babc
--- /dev/null
+++ b/sound/soc/bcm/allo-boss-dac.c
@@ -0,0 +1,456 @@
+/*
+ * ALSA ASoC Machine Driver for Allo Boss DAC
+ *
+ * Author:	Baswaraj K <jaikumar@cem-solutions.net>
+ *		Copyright 2017
+ *		based on code by Daniel Matuschek,
+ *				 Stuart MacLean <stuart@hifiberry.com>
+ *		based on code by Florian Meier <florian.meier@koalo.de>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/gpio/consumer.h>
+#include <linux/platform_device.h>
+#include <linux/clk.h>
+#include <linux/delay.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include "../codecs/pcm512x.h"
+
+#define ALLO_BOSS_NOCLOCK 0
+#define ALLO_BOSS_CLK44EN 1
+#define ALLO_BOSS_CLK48EN 2
+
+struct pcm512x_priv {
+	struct regmap *regmap;
+	struct clk *sclk;
+};
+
+static struct gpio_desc *mute_gpio;
+
+/* Clock rate of CLK44EN attached to GPIO6 pin */
+#define CLK_44EN_RATE 45158400UL
+/* Clock rate of CLK48EN attached to GPIO3 pin */
+#define CLK_48EN_RATE 49152000UL
+
+static bool slave;
+static bool snd_soc_allo_boss_master;
+static bool digital_gain_0db_limit = true;
+
+static void snd_allo_boss_select_clk(struct snd_soc_codec *codec,
+	int clk_id)
+{
+	switch (clk_id) {
+	case ALLO_BOSS_NOCLOCK:
+		snd_soc_update_bits(codec, PCM512x_GPIO_CONTROL_1, 0x24, 0x00);
+		break;
+	case ALLO_BOSS_CLK44EN:
+		snd_soc_update_bits(codec, PCM512x_GPIO_CONTROL_1, 0x24, 0x20);
+		break;
+	case ALLO_BOSS_CLK48EN:
+		snd_soc_update_bits(codec, PCM512x_GPIO_CONTROL_1, 0x24, 0x04);
+		break;
+	}
+}
+
+static void snd_allo_boss_clk_gpio(struct snd_soc_codec *codec)
+{
+	snd_soc_update_bits(codec, PCM512x_GPIO_EN, 0x24, 0x24);
+	snd_soc_update_bits(codec, PCM512x_GPIO_OUTPUT_3, 0x0f, 0x02);
+	snd_soc_update_bits(codec, PCM512x_GPIO_OUTPUT_6, 0x0f, 0x02);
+}
+
+static bool snd_allo_boss_is_sclk(struct snd_soc_codec *codec)
+{
+	int sck;
+
+	sck = snd_soc_read(codec, PCM512x_RATE_DET_4);
+	return (!(sck & 0x40));
+}
+
+static bool snd_allo_boss_is_sclk_sleep(
+	struct snd_soc_codec *codec)
+{
+	msleep(2);
+	return snd_allo_boss_is_sclk(codec);
+}
+
+static bool snd_allo_boss_is_master_card(struct snd_soc_codec *codec)
+{
+	bool isClk44EN, isClk48En, isNoClk;
+
+	snd_allo_boss_clk_gpio(codec);
+
+	snd_allo_boss_select_clk(codec, ALLO_BOSS_CLK44EN);
+	isClk44EN = snd_allo_boss_is_sclk_sleep(codec);
+
+	snd_allo_boss_select_clk(codec, ALLO_BOSS_NOCLOCK);
+	isNoClk = snd_allo_boss_is_sclk_sleep(codec);
+
+	snd_allo_boss_select_clk(codec, ALLO_BOSS_CLK48EN);
+	isClk48En = snd_allo_boss_is_sclk_sleep(codec);
+
+	return (isClk44EN && isClk48En && !isNoClk);
+}
+
+static int snd_allo_boss_clk_for_rate(int sample_rate)
+{
+	int type;
+
+	switch (sample_rate) {
+	case 11025:
+	case 22050:
+	case 44100:
+	case 88200:
+	case 176400:
+	case 352800:
+		type = ALLO_BOSS_CLK44EN;
+		break;
+	default:
+		type = ALLO_BOSS_CLK48EN;
+		break;
+	}
+	return type;
+}
+
+static void snd_allo_boss_set_sclk(struct snd_soc_codec *codec,
+	int sample_rate)
+{
+	struct pcm512x_priv *pcm512x = snd_soc_codec_get_drvdata(codec);
+
+	if (!IS_ERR(pcm512x->sclk)) {
+		int ctype;
+
+		ctype =	snd_allo_boss_clk_for_rate(sample_rate);
+		clk_set_rate(pcm512x->sclk, (ctype == ALLO_BOSS_CLK44EN)
+				? CLK_44EN_RATE : CLK_48EN_RATE);
+		snd_allo_boss_select_clk(codec, ctype);
+	}
+}
+
+static int snd_allo_boss_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_codec *codec = rtd->codec;
+	struct pcm512x_priv *priv = snd_soc_codec_get_drvdata(codec);
+
+	if (slave)
+		snd_soc_allo_boss_master = false;
+	else
+		snd_soc_allo_boss_master =
+			snd_allo_boss_is_master_card(codec);
+
+	if (snd_soc_allo_boss_master) {
+		struct snd_soc_dai_link *dai = rtd->dai_link;
+
+		dai->name = "BossDAC";
+		dai->stream_name = "Boss DAC HiFi [Master]";
+		dai->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
+			| SND_SOC_DAIFMT_CBM_CFM;
+
+		snd_soc_update_bits(codec, PCM512x_BCLK_LRCLK_CFG, 0x31, 0x11);
+		snd_soc_update_bits(codec, PCM512x_MASTER_MODE, 0x03, 0x03);
+		snd_soc_update_bits(codec, PCM512x_MASTER_CLKDIV_2, 0x7f, 63);
+		/*
+		* Default sclk to CLK_48EN_RATE, otherwise codec
+		*  pcm512x_dai_startup_master method could call
+		*  snd_pcm_hw_constraint_ratnums using CLK_44EN/64
+		*  which will mask 384k sample rate.
+		*/
+		if (!IS_ERR(priv->sclk))
+			clk_set_rate(priv->sclk, CLK_48EN_RATE);
+	} else {
+		priv->sclk = ERR_PTR(-ENOENT);
+	}
+
+	snd_soc_update_bits(codec, PCM512x_GPIO_EN, 0x08, 0x08);
+	snd_soc_update_bits(codec, PCM512x_GPIO_OUTPUT_4, 0x0f, 0x02);
+	snd_soc_update_bits(codec, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
+
+	if (digital_gain_0db_limit) {
+		int ret;
+		struct snd_soc_card *card = rtd->card;
+
+		ret = snd_soc_limit_volume(card, "Digital Playback Volume",
+				207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n",
+					ret);
+	}
+
+	return 0;
+}
+
+static int snd_allo_boss_update_rate_den(
+	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_codec *codec = rtd->codec;
+	struct pcm512x_priv *pcm512x = snd_soc_codec_get_drvdata(codec);
+	struct snd_ratnum *rats_no_pll;
+	unsigned int num = 0, den = 0;
+	int err;
+
+	rats_no_pll = devm_kzalloc(rtd->dev, sizeof(*rats_no_pll), GFP_KERNEL);
+	if (!rats_no_pll)
+		return -ENOMEM;
+
+	rats_no_pll->num = clk_get_rate(pcm512x->sclk) / 64;
+	rats_no_pll->den_min = 1;
+	rats_no_pll->den_max = 128;
+	rats_no_pll->den_step = 1;
+
+	err = snd_interval_ratnum(hw_param_interval(params,
+		SNDRV_PCM_HW_PARAM_RATE), 1, rats_no_pll, &num, &den);
+	if (err >= 0 && den) {
+		params->rate_num = num;
+		params->rate_den = den;
+	}
+
+	devm_kfree(rtd->dev, rats_no_pll);
+	return 0;
+}
+
+static void snd_allo_boss_gpio_mute(struct snd_soc_card *card)
+{
+	if (mute_gpio)
+		gpiod_set_value_cansleep(mute_gpio, 1);
+}
+
+static void snd_allo_boss_gpio_unmute(struct snd_soc_card *card)
+{
+	if (mute_gpio)
+		gpiod_set_value_cansleep(mute_gpio, 0);
+}
+
+static int snd_allo_boss_set_bias_level(struct snd_soc_card *card,
+	struct snd_soc_dapm_context *dapm, enum snd_soc_bias_level level)
+{
+	struct snd_soc_pcm_runtime *rtd;
+	struct snd_soc_dai *codec_dai;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	codec_dai = rtd->codec_dai;
+
+	if (dapm->dev != codec_dai->dev)
+		return 0;
+
+	switch (level) {
+	case SND_SOC_BIAS_PREPARE:
+		if (dapm->bias_level != SND_SOC_BIAS_STANDBY)
+			break;
+		/* UNMUTE DAC */
+		snd_allo_boss_gpio_unmute(card);
+		break;
+
+	case SND_SOC_BIAS_STANDBY:
+		if (dapm->bias_level != SND_SOC_BIAS_PREPARE)
+			break;
+		/* MUTE DAC */
+		snd_allo_boss_gpio_mute(card);
+		break;
+
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+static int snd_allo_boss_hw_params(
+	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
+{
+	int ret = 0;
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	int channels = params_channels(params);
+	int width = snd_pcm_format_physical_width(params_format(params));
+
+	if (snd_soc_allo_boss_master) {
+		struct snd_soc_codec *codec = rtd->codec;
+
+		snd_allo_boss_set_sclk(codec,
+			params_rate(params));
+
+		ret = snd_allo_boss_update_rate_den(
+			substream, params);
+		if (ret)
+			return ret;
+	}
+
+	ret = snd_soc_dai_set_tdm_slot(rtd->cpu_dai, 0x03, 0x03,
+		channels, width);
+	if (ret)
+		return ret;
+	ret = snd_soc_dai_set_tdm_slot(rtd->codec_dai, 0x03, 0x03,
+		channels, width);
+	return ret;
+}
+
+static int snd_allo_boss_startup(
+	struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_codec *codec = rtd->codec;
+	struct snd_soc_card *card = rtd->card;
+
+	snd_soc_update_bits(codec, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
+	snd_allo_boss_gpio_mute(card);
+
+	if (snd_soc_allo_boss_master) {
+		struct pcm512x_priv *priv = snd_soc_codec_get_drvdata(codec);
+		/*
+		 * Default sclk to CLK_48EN_RATE, otherwise codec
+		 * pcm512x_dai_startup_master method could call
+		 * snd_pcm_hw_constraint_ratnums using CLK_44EN/64
+		 * which will mask 384k sample rate.
+		 */
+		if (!IS_ERR(priv->sclk))
+			clk_set_rate(priv->sclk, CLK_48EN_RATE);
+	}
+
+	return 0;
+}
+
+static void snd_allo_boss_shutdown(
+	struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_codec *codec = rtd->codec;
+
+	snd_soc_update_bits(codec, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
+}
+
+static int snd_allo_boss_prepare(
+	struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_card *card = rtd->card;
+
+	snd_allo_boss_gpio_unmute(card);
+	return 0;
+}
+/* machine stream operations */
+static struct snd_soc_ops snd_allo_boss_ops = {
+	.hw_params = snd_allo_boss_hw_params,
+	.startup = snd_allo_boss_startup,
+	.shutdown = snd_allo_boss_shutdown,
+	.prepare = snd_allo_boss_prepare,
+};
+
+static struct snd_soc_dai_link snd_allo_boss_dai[] = {
+{
+	.name		= "Boss DAC",
+	.stream_name	= "Boss DAC HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "pcm512x-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "pcm512x.1-004d",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S |
+			  SND_SOC_DAIFMT_NB_NF |
+			  SND_SOC_DAIFMT_CBS_CFS,
+	.ops		= &snd_allo_boss_ops,
+	.init		= snd_allo_boss_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_allo_boss = {
+	.name         = "BossDAC",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_allo_boss_dai,
+	.num_links    = ARRAY_SIZE(snd_allo_boss_dai),
+};
+
+static int snd_allo_boss_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_allo_boss.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai;
+
+		dai = &snd_allo_boss_dai[0];
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+					    "i2s-controller", 0);
+
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+
+		digital_gain_0db_limit = !of_property_read_bool(
+			pdev->dev.of_node, "allo,24db_digital_gain");
+		slave = of_property_read_bool(pdev->dev.of_node,
+						"allo,slave");
+
+		mute_gpio = devm_gpiod_get_optional(&pdev->dev, "mute",
+							GPIOD_OUT_LOW);
+		if (IS_ERR(mute_gpio)) {
+			ret = PTR_ERR(mute_gpio);
+			dev_err(&pdev->dev,
+				"failed to get mute gpio: %d\n", ret);
+			return ret;
+		}
+
+		if (mute_gpio)
+			snd_allo_boss.set_bias_level =
+				snd_allo_boss_set_bias_level;
+
+		ret = snd_soc_register_card(&snd_allo_boss);
+		if (ret) {
+			dev_err(&pdev->dev,
+				"snd_soc_register_card() failed: %d\n", ret);
+			return ret;
+		}
+
+		if (mute_gpio)
+			snd_allo_boss_gpio_mute(&snd_allo_boss);
+
+		return 0;
+	}
+
+	return -EINVAL;
+}
+
+static int snd_allo_boss_remove(struct platform_device *pdev)
+{
+	snd_allo_boss_gpio_mute(&snd_allo_boss);
+	return snd_soc_unregister_card(&snd_allo_boss);
+}
+
+static const struct of_device_id snd_allo_boss_of_match[] = {
+	{ .compatible = "allo,boss-dac", },
+	{ /* sentinel */ },
+};
+MODULE_DEVICE_TABLE(of, snd_allo_boss_of_match);
+
+static struct platform_driver snd_allo_boss_driver = {
+	.driver = {
+		.name   = "snd-allo-boss-dac",
+		.owner  = THIS_MODULE,
+		.of_match_table = snd_allo_boss_of_match,
+	},
+	.probe          = snd_allo_boss_probe,
+	.remove         = snd_allo_boss_remove,
+};
+
+module_platform_driver(snd_allo_boss_driver);
+
+MODULE_AUTHOR("Baswaraj K <jaikumar@cem-solutions.net>");
+MODULE_DESCRIPTION("ALSA ASoC Machine Driver for Allo Boss DAC");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/allo-digione.c b/sound/soc/bcm/allo-digione.c
new file mode 100644
index 000000000000..9387b055875f
--- /dev/null
+++ b/sound/soc/bcm/allo-digione.c
@@ -0,0 +1,265 @@
+/*
+ * ASoC Driver for Allo DigiOne
+ *
+ * Author: Baswaraj <jaikumar@cemsolutions.net>
+ *	   Copyright 2017
+ * based on code by Daniel Matuschek <info@crazy-audio.com>
+ * based on code by Florian Meier <florian.meier@koalo.de>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+#include <linux/gpio/consumer.h>
+
+#include "../codecs/wm8804.h"
+
+static short int auto_shutdown_output;
+module_param(auto_shutdown_output, short,
+		S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
+MODULE_PARM_DESC(auto_shutdown_output, "Shutdown SP/DIF output if playback is stopped");
+
+#define CLK_44EN_RATE 22579200UL
+#define CLK_48EN_RATE 24576000UL
+
+static struct gpio_desc *snd_allo_clk44gpio;
+static struct gpio_desc *snd_allo_clk48gpio;
+
+static int samplerate = 44100;
+
+static uint32_t snd_allo_digione_enable_clock(int sample_rate)
+{
+	switch (sample_rate) {
+	case 11025:
+	case 22050:
+	case 44100:
+	case 88200:
+	case 176400:
+		gpiod_set_value_cansleep(snd_allo_clk44gpio, 1);
+		gpiod_set_value_cansleep(snd_allo_clk48gpio, 0);
+		return CLK_44EN_RATE;
+	default:
+		gpiod_set_value_cansleep(snd_allo_clk48gpio, 1);
+		gpiod_set_value_cansleep(snd_allo_clk44gpio, 0);
+		return CLK_48EN_RATE;
+	}
+}
+
+
+static int snd_allo_digione_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_codec *codec = rtd->codec;
+
+	/* enable TX output */
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x4, 0x0);
+
+	return 0;
+}
+
+static int snd_allo_digione_startup(struct snd_pcm_substream *substream)
+{
+	/* turn on digital output */
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_codec *codec = rtd->codec;
+
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x3c, 0x00);
+	return 0;
+}
+
+static void snd_allo_digione_shutdown(struct snd_pcm_substream *substream)
+{
+	/* turn off output */
+	if (auto_shutdown_output) {
+		/* turn off output */
+		struct snd_soc_pcm_runtime *rtd = substream->private_data;
+		struct snd_soc_codec *codec = rtd->codec;
+
+		snd_soc_update_bits(codec, WM8804_PWRDN, 0x3c, 0x3c);
+	}
+}
+
+static int snd_allo_digione_hw_params(struct snd_pcm_substream *substream,
+				       struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+	struct snd_soc_codec *codec = rtd->codec;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+
+	int sysclk = 27000000; /* This is fixed on this board */
+
+	long mclk_freq = 0;
+	int mclk_div = 1;
+	int sampling_freq = 1;
+
+	int ret;
+
+	samplerate = params_rate(params);
+	mclk_freq = samplerate * 256;
+	mclk_div = WM8804_MCLKDIV_256FS;
+
+	sysclk = snd_allo_digione_enable_clock(samplerate);
+
+	switch (samplerate) {
+	case 32000:
+		sampling_freq = 0x03;
+		break;
+	case 44100:
+		sampling_freq = 0x00;
+		break;
+	case 48000:
+		sampling_freq = 0x02;
+		break;
+	case 88200:
+		sampling_freq = 0x08;
+		break;
+	case 96000:
+		sampling_freq = 0x0a;
+		break;
+	case 176400:
+		sampling_freq = 0x0c;
+		break;
+	case 192000:
+		sampling_freq = 0x0e;
+		break;
+	default:
+		dev_err(codec->dev,
+		"Failed to set WM8804 SYSCLK, unsupported samplerate %d\n",
+		samplerate);
+	}
+
+	snd_soc_dai_set_clkdiv(codec_dai, WM8804_MCLK_DIV, mclk_div);
+	snd_soc_dai_set_pll(codec_dai, 0, 0, sysclk, mclk_freq);
+
+	ret = snd_soc_dai_set_sysclk(codec_dai, WM8804_TX_CLKSRC_PLL,
+					sysclk, SND_SOC_CLOCK_OUT);
+
+	if (ret < 0) {
+		dev_err(codec->dev,
+		"Failed to set WM8804 SYSCLK: %d\n", ret);
+		return ret;
+	}
+
+	/* Enable TX output */
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x4, 0x0);
+
+	/* Power on */
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x9, 0);
+
+	/* set sampling frequency status bits */
+	snd_soc_update_bits(codec, WM8804_SPDTX4, 0x0f, sampling_freq);
+
+	return snd_soc_dai_set_bclk_ratio(cpu_dai, 64);
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_allo_digione_ops = {
+	.hw_params	= snd_allo_digione_hw_params,
+	.startup	= snd_allo_digione_startup,
+	.shutdown	= snd_allo_digione_shutdown,
+};
+
+static struct snd_soc_dai_link snd_allo_digione_dai[] = {
+{
+	.name		= "Allo DigiOne",
+	.stream_name	= "Allo DigiOne HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "wm8804-spdif",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "wm8804.1-003b",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S |
+			  SND_SOC_DAIFMT_NB_NF |
+			  SND_SOC_DAIFMT_CBM_CFM,
+	.ops		= &snd_allo_digione_ops,
+	.init		= snd_allo_digione_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_allo_digione = {
+	.name         = "snd_allo_digione",
+	.driver_name  = "AlloDigiOne",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_allo_digione_dai,
+	.num_links    = ARRAY_SIZE(snd_allo_digione_dai),
+};
+
+static int snd_allo_digione_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_allo_digione.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai = &snd_allo_digione_dai[0];
+
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+				"i2s-controller", 0);
+
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+
+		snd_allo_clk44gpio =
+			devm_gpiod_get(&pdev->dev, "clock44", GPIOD_OUT_LOW);
+		if (IS_ERR(snd_allo_clk44gpio))
+			dev_err(&pdev->dev, "devm_gpiod_get() failed\n");
+
+		snd_allo_clk48gpio =
+			devm_gpiod_get(&pdev->dev, "clock48", GPIOD_OUT_LOW);
+		if (IS_ERR(snd_allo_clk48gpio))
+			dev_err(&pdev->dev, "devm_gpiod_get() failed\n");
+	}
+
+	ret = snd_soc_register_card(&snd_allo_digione);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
+			ret);
+
+	return ret;
+}
+
+static int snd_allo_digione_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&snd_allo_digione);
+}
+
+static const struct of_device_id snd_allo_digione_of_match[] = {
+	{ .compatible = "allo,allo-digione", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_allo_digione_of_match);
+
+static struct platform_driver snd_allo_digione_driver = {
+	.driver = {
+		.name		= "snd-allo-digione",
+		.owner		= THIS_MODULE,
+		.of_match_table	= snd_allo_digione_of_match,
+	},
+	.probe  = snd_allo_digione_probe,
+	.remove = snd_allo_digione_remove,
+};
+
+module_platform_driver(snd_allo_digione_driver);
+
+MODULE_AUTHOR("Baswaraj <jaikumar@cem-solutions.net>");
+MODULE_DESCRIPTION("ASoC Driver for Allo DigiOne");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/allo-katana-codec.c b/sound/soc/bcm/allo-katana-codec.c
new file mode 100644
index 000000000000..2b4892f645d9
--- /dev/null
+++ b/sound/soc/bcm/allo-katana-codec.c
@@ -0,0 +1,363 @@
+/*
+ * Driver for the ALLO KATANA CODEC
+ *
+ * Author: Jaikumar <jaikumar@cem-solutions.net>
+ *		Copyright 2018
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/clk.h>
+#include <linux/kernel.h>
+#include <linux/regmap.h>
+#include <linux/regulator/consumer.h>
+#include <linux/gcd.h>
+#include <sound/soc.h>
+#include <sound/soc-dapm.h>
+#include <sound/pcm_params.h>
+#include <sound/tlv.h>
+#include <linux/i2c.h>
+
+
+#define KATANA_CODEC_CHIP_ID		0x30
+#define KATANA_CODEC_VIRT_BASE		0x100
+#define KATANA_CODEC_PAGE			0
+
+#define KATANA_CODEC_CHIP_ID_REG	(KATANA_CODEC_VIRT_BASE + 0)
+#define KATANA_CODEC_RESET			(KATANA_CODEC_VIRT_BASE + 1)
+#define KATANA_CODEC_VOLUME_1		(KATANA_CODEC_VIRT_BASE + 2)
+#define KATANA_CODEC_VOLUME_2		(KATANA_CODEC_VIRT_BASE + 3)
+#define KATANA_CODEC_MUTE			(KATANA_CODEC_VIRT_BASE + 4)
+#define KATANA_CODEC_DSP_PROGRAM	(KATANA_CODEC_VIRT_BASE + 5)
+#define KATANA_CODEC_DEEMPHASIS		(KATANA_CODEC_VIRT_BASE + 6)
+#define KATANA_CODEC_DOP			(KATANA_CODEC_VIRT_BASE + 7)
+#define KATANA_CODEC_FORMAT			(KATANA_CODEC_VIRT_BASE + 8)
+#define KATANA_CODEC_COMMAND		(KATANA_CODEC_VIRT_BASE + 9)
+#define KATANA_CODEC_MAX_REGISTER	(KATANA_CODEC_VIRT_BASE + 9)
+
+#define KATANA_CODEC_FMT			0xff
+#define KATANA_CODEC_CHAN_MONO		0x00
+#define KATANA_CODEC_CHAN_STEREO	0x80
+#define KATANA_CODEC_ALEN_16		0x10
+#define KATANA_CODEC_ALEN_24		0x20
+#define KATANA_CODEC_ALEN_32		0x30
+#define KATANA_CODEC_RATE_11025		0x01
+#define KATANA_CODEC_RATE_22050		0x02
+#define KATANA_CODEC_RATE_32000		0x03
+#define KATANA_CODEC_RATE_44100		0x04
+#define KATANA_CODEC_RATE_48000		0x05
+#define KATANA_CODEC_RATE_88200		0x06
+#define KATANA_CODEC_RATE_96000		0x07
+#define KATANA_CODEC_RATE_176400	0x08
+#define KATANA_CODEC_RATE_192000	0x09
+#define KATANA_CODEC_RATE_352800	0x0a
+#define KATANA_CODEC_RATE_384000	0x0b
+
+
+struct katana_codec_priv {
+	struct regmap *regmap;
+	int fmt;
+};
+
+static const struct reg_default katana_codec_reg_defaults[] = {
+	{ KATANA_CODEC_RESET,		0x00 },
+	{ KATANA_CODEC_VOLUME_1,	0xF0 },
+	{ KATANA_CODEC_VOLUME_2,	0xF0 },
+	{ KATANA_CODEC_MUTE,		0x00 },
+	{ KATANA_CODEC_DSP_PROGRAM,	0x04 },
+	{ KATANA_CODEC_DEEMPHASIS,	0x00 },
+	{ KATANA_CODEC_DOP,			0x01 },
+	{ KATANA_CODEC_FORMAT,		0xb4 },
+};
+
+static const char * const katana_codec_dsp_program_texts[] = {
+	"Linear Phase Fast Roll-off Filter",
+	"Linear Phase Slow Roll-off Filter",
+	"Minimum Phase Fast Roll-off Filter",
+	"Minimum Phase Slow Roll-off Filter",
+	"Apodizing Fast Roll-off Filter",
+	"Corrected Minimum Phase Fast Roll-off Filter",
+	"Brick Wall Filter",
+};
+
+static const unsigned int katana_codec_dsp_program_values[] = {
+	0,
+	1,
+	2,
+	3,
+	4,
+	6,
+	7,
+};
+
+static SOC_VALUE_ENUM_SINGLE_DECL(katana_codec_dsp_program,
+				  KATANA_CODEC_DSP_PROGRAM, 0, 0x07,
+				  katana_codec_dsp_program_texts,
+				  katana_codec_dsp_program_values);
+
+static const char * const katana_codec_deemphasis_texts[] = {
+	"Bypass",
+	"32kHz",
+	"44.1kHz",
+	"48kHz",
+};
+
+static const unsigned int katana_codec_deemphasis_values[] = {
+	0,
+	1,
+	2,
+	3,
+};
+
+static SOC_VALUE_ENUM_SINGLE_DECL(katana_codec_deemphasis,
+				  KATANA_CODEC_DEEMPHASIS, 0, 0x03,
+				  katana_codec_deemphasis_texts,
+				  katana_codec_deemphasis_values);
+
+static const SNDRV_CTL_TLVD_DECLARE_DB_MINMAX(master_tlv, -12700, 0);
+
+static const struct snd_kcontrol_new katana_codec_controls[] = {
+	SOC_DOUBLE_R_TLV("Master Playback Volume", KATANA_CODEC_VOLUME_1,
+			KATANA_CODEC_VOLUME_2, 0, 255, 1, master_tlv),
+	SOC_DOUBLE("Master Playback Switch", KATANA_CODEC_MUTE, 0, 0, 1, 1),
+	SOC_ENUM("DSP Program Route", katana_codec_dsp_program),
+	SOC_ENUM("Deemphasis Route", katana_codec_deemphasis),
+	SOC_SINGLE("DoP Playback Switch", KATANA_CODEC_DOP, 0, 1, 1)
+};
+
+static bool katana_codec_readable_register(struct device *dev, unsigned int reg)
+{
+	switch (reg) {
+	case KATANA_CODEC_CHIP_ID_REG:
+		return true;
+	default:
+		return reg < 0xff;
+	}
+}
+
+static int katana_codec_hw_params(struct snd_pcm_substream *substream,
+			     struct snd_pcm_hw_params *params,
+			     struct snd_soc_dai *dai)
+{
+	struct snd_soc_codec *codec = dai->codec;
+	struct katana_codec_priv *katana_codec = snd_soc_codec_get_drvdata(codec);
+	int fmt = 0;
+	int ret;
+
+	dev_dbg(codec->dev, "hw_params %u Hz, %u channels\n",
+			params_rate(params),
+			params_channels(params));
+
+	switch (katana_codec->fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+	case SND_SOC_DAIFMT_CBM_CFM: // master
+		if (params_channels(params) == 2)
+			fmt = KATANA_CODEC_CHAN_STEREO;
+		else
+			fmt = KATANA_CODEC_CHAN_MONO;
+
+		switch (params_width(params)) {
+		case 16:
+			fmt |= KATANA_CODEC_ALEN_16;
+			break;
+		case 24:
+			fmt |= KATANA_CODEC_ALEN_24;
+			break;
+		case 32:
+			fmt |= KATANA_CODEC_ALEN_32;
+			break;
+		default:
+			dev_err(codec->dev, "Bad frame size: %d\n",
+					params_width(params));
+			return -EINVAL;
+		}
+
+		switch (params_rate(params)) {
+		case 44100:
+			fmt |= KATANA_CODEC_RATE_44100;
+			break;
+		case 48000:
+			fmt |= KATANA_CODEC_RATE_48000;
+			break;
+		case 88200:
+			fmt |= KATANA_CODEC_RATE_88200;
+			break;
+		case 96000:
+			fmt |= KATANA_CODEC_RATE_96000;
+			break;
+		case 176400:
+			fmt |= KATANA_CODEC_RATE_176400;
+			break;
+		case 192000:
+			fmt |= KATANA_CODEC_RATE_192000;
+			break;
+		case 352800:
+			fmt |= KATANA_CODEC_RATE_352800;
+			break;
+		case 384000:
+			fmt |= KATANA_CODEC_RATE_384000;
+			break;
+		default:
+			dev_err(codec->dev, "Bad sample rate: %d\n",
+					params_rate(params));
+			return -EINVAL;
+		}
+
+		ret = regmap_write(katana_codec->regmap, KATANA_CODEC_FORMAT, fmt);
+		if (ret != 0) {
+			dev_err(codec->dev, "Failed to set format: %d\n", ret);
+			return ret;
+		}
+		break;
+
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int katana_codec_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+{
+	struct snd_soc_codec *codec = dai->codec;
+	struct katana_codec_priv *katana_codec = snd_soc_codec_get_drvdata(codec);
+
+	katana_codec->fmt = fmt;
+
+	return 0;
+}
+
+static const struct snd_soc_dai_ops katana_codec_dai_ops = {
+	.hw_params = katana_codec_hw_params,
+	.set_fmt = katana_codec_set_fmt,
+};
+
+static struct snd_soc_dai_driver katana_codec_dai = {
+	.name = "allo-katana-codec",
+	.playback = {
+		.stream_name = "Playback",
+		.channels_min = 2,
+		.channels_max = 2,
+		.rates = SNDRV_PCM_RATE_CONTINUOUS,
+		.rate_min = 44100,
+		.rate_max = 384000,
+		.formats = SNDRV_PCM_FMTBIT_S16_LE |
+			SNDRV_PCM_FMTBIT_S32_LE
+	},
+	.ops = &katana_codec_dai_ops,
+};
+
+static struct snd_soc_codec_driver katana_codec_codec_driver = {
+	.idle_bias_off = false,
+
+	.component_driver = {
+		.controls		= katana_codec_controls,
+		.num_controls	= ARRAY_SIZE(katana_codec_controls),
+	},
+};
+
+static const struct regmap_range_cfg katana_codec_range = {
+	.name = "Pages", .range_min = KATANA_CODEC_VIRT_BASE,
+	.range_max = KATANA_CODEC_MAX_REGISTER,
+	.selector_reg = KATANA_CODEC_PAGE,
+	.selector_mask = 0xff,
+	.window_start = 0, .window_len = 0x100,
+};
+
+const struct regmap_config katana_codec_regmap = {
+	.reg_bits = 8,
+	.val_bits = 8,
+
+	.ranges = &katana_codec_range,
+	.num_ranges = 1,
+
+	.max_register = KATANA_CODEC_MAX_REGISTER,
+	.readable_reg = katana_codec_readable_register,
+	.reg_defaults = katana_codec_reg_defaults,
+	.num_reg_defaults = ARRAY_SIZE(katana_codec_reg_defaults),
+	.cache_type = REGCACHE_RBTREE,
+};
+
+static int allo_katana_codec_probe(struct i2c_client *i2c,
+			     const struct i2c_device_id *id)
+{
+	struct regmap *regmap;
+	struct regmap_config config = katana_codec_regmap;
+	struct device *dev = &i2c->dev;
+	struct katana_codec_priv *katana_codec;
+	unsigned int chip_id = 0;
+	int ret;
+
+	regmap = devm_regmap_init_i2c(i2c, &config);
+	if (IS_ERR(regmap))
+		return PTR_ERR(regmap);
+
+	katana_codec = devm_kzalloc(dev, sizeof(struct katana_codec_priv),
+								GFP_KERNEL);
+	if (!katana_codec)
+		return -ENOMEM;
+
+	dev_set_drvdata(dev, katana_codec);
+	katana_codec->regmap = regmap;
+
+	ret = regmap_read(regmap, KATANA_CODEC_CHIP_ID_REG, &chip_id);
+	if ((ret != 0) || (chip_id != KATANA_CODEC_CHIP_ID)) {
+		dev_err(dev, "Failed to read Chip or wrong Chip id: %d\n", ret);
+		return ret;
+	}
+	regmap_update_bits(regmap, KATANA_CODEC_RESET, 0x01, 0x01);
+	msleep(10);
+
+	ret = snd_soc_register_codec(dev, &katana_codec_codec_driver,
+				    &katana_codec_dai, 1);
+	if (ret != 0) {
+		dev_err(dev, "failed to register codec: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+static int allo_katana_codec_remove(struct i2c_client *i2c)
+{
+	snd_soc_unregister_codec(&i2c->dev);
+	return 0;
+}
+
+static const struct i2c_device_id allo_katana_codec_id[] = {
+	{ "allo-katana-codec", },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, allo_katana_codec_id);
+
+static const struct of_device_id allo_katana_codec_of_match[] = {
+	{ .compatible = "allo,allo-katana-codec", },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, allo_katana_codec_of_match);
+
+static struct i2c_driver allo_katana_codec_driver = {
+	.probe		= allo_katana_codec_probe,
+	.remove		= allo_katana_codec_remove,
+	.id_table	= allo_katana_codec_id,
+	.driver		= {
+		.name	= "allo-katana-codec",
+		.of_match_table = allo_katana_codec_of_match,
+	},
+};
+
+module_i2c_driver(allo_katana_codec_driver);
+
+MODULE_DESCRIPTION("ASoC Allo Katana Codec Driver");
+MODULE_AUTHOR("Jaikumar <jaikumar@cem-solutions.net>");
+MODULE_LICENSE("GPL v2");
+
diff --git a/sound/soc/bcm/allo-piano-dac-plus.c b/sound/soc/bcm/allo-piano-dac-plus.c
new file mode 100644
index 000000000000..bede9bdec3c7
--- /dev/null
+++ b/sound/soc/bcm/allo-piano-dac-plus.c
@@ -0,0 +1,1008 @@
+/*
+ * ALSA ASoC Machine Driver for Allo Piano DAC Plus Subwoofer
+ *
+ * Author:	Baswaraj K <jaikumar@cem-solutions.net>
+ *		Copyright 2016
+ *		based on code by Daniel Matuschek <info@crazy-audio.com>
+ *		based on code by Florian Meier <florian.meier@koalo.de>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/gpio/consumer.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <linux/firmware.h>
+#include <linux/delay.h>
+#include <sound/tlv.h>
+#include "../codecs/pcm512x.h"
+
+#define P_DAC_LEFT_MUTE		0x10
+#define P_DAC_RIGHT_MUTE	0x01
+#define P_DAC_MUTE		0x11
+#define P_DAC_UNMUTE		0x00
+#define P_MUTE			1
+#define P_UNMUTE		0
+
+struct dsp_code {
+	char i2c_addr;
+	char offset;
+	char val;
+};
+
+struct glb_pool {
+	struct mutex lock;
+	unsigned int dual_mode;
+	unsigned int set_lowpass;
+	unsigned int set_mode;
+	unsigned int set_rate;
+	unsigned int dsp_page_number;
+};
+
+static bool digital_gain_0db_limit = true;
+bool glb_mclk;
+
+static struct gpio_desc *mute_gpio[2];
+
+static const char * const allo_piano_mode_texts[] = {
+	"None",
+	"2.0",
+	"2.1",
+	"2.2",
+};
+
+static const SOC_ENUM_SINGLE_DECL(allo_piano_mode_enum,
+		0, 0, allo_piano_mode_texts);
+
+static const char * const allo_piano_dual_mode_texts[] = {
+	"None",
+	"Dual-Mono",
+	"Dual-Stereo",
+};
+
+static const SOC_ENUM_SINGLE_DECL(allo_piano_dual_mode_enum,
+		0, 0, allo_piano_dual_mode_texts);
+
+static const char * const allo_piano_dsp_low_pass_texts[] = {
+	"60",
+	"70",
+	"80",
+	"90",
+	"100",
+	"110",
+	"120",
+	"130",
+	"140",
+	"150",
+	"160",
+	"170",
+	"180",
+	"190",
+	"200",
+};
+
+static const SOC_ENUM_SINGLE_DECL(allo_piano_enum,
+		0, 0, allo_piano_dsp_low_pass_texts);
+
+static int __snd_allo_piano_dsp_program(struct snd_soc_pcm_runtime *rtd,
+		unsigned int mode, unsigned int rate, unsigned int lowpass)
+{
+	const struct firmware *fw;
+	struct snd_soc_card *card = rtd->card;
+	struct glb_pool *glb_ptr = card->drvdata;
+	char firmware_name[60];
+	int ret = 0, dac = 0;
+
+	if (rate <= 46000)
+		rate = 44100;
+	else if (rate <= 68000)
+		rate = 48000;
+	else if (rate <= 92000)
+		rate = 88200;
+	else if (rate <= 136000)
+		rate = 96000;
+	else if (rate <= 184000)
+		rate = 176400;
+	else
+		rate = 192000;
+
+	if (lowpass > 14)
+		glb_ptr->set_lowpass = lowpass = 0;
+
+	if (mode > 3)
+		glb_ptr->set_mode = mode = 0;
+
+	if (mode > 0)
+		glb_ptr->dual_mode = 0;
+
+	/* same configuration loaded */
+	if ((rate == glb_ptr->set_rate) && (lowpass == glb_ptr->set_lowpass)
+			&& (mode == glb_ptr->set_mode))
+		return 0;
+
+	switch (mode) {
+	case 0: /* None */
+		return 1;
+
+	case 1: /* 2.0 */
+		snd_soc_write(rtd->codec_dais[0]->codec,
+				PCM512x_MUTE, P_DAC_UNMUTE);
+		snd_soc_write(rtd->codec_dais[1]->codec,
+				PCM512x_MUTE, P_DAC_MUTE);
+		glb_ptr->set_rate = rate;
+		glb_ptr->set_mode = mode;
+		glb_ptr->set_lowpass = lowpass;
+		return 1;
+
+	default:
+		snd_soc_write(rtd->codec_dais[0]->codec,
+				PCM512x_MUTE, P_DAC_UNMUTE);
+		snd_soc_write(rtd->codec_dais[1]->codec,
+				PCM512x_MUTE, P_DAC_UNMUTE);
+	}
+
+	for (dac = 0; dac < rtd->num_codecs; dac++) {
+		struct dsp_code *dsp_code_read;
+		struct snd_soc_codec *codec = rtd->codec_dais[dac]->codec;
+		int i = 1;
+
+		if (dac == 0) { /* high */
+			snprintf(firmware_name, sizeof(firmware_name),
+				"allo/piano/2.2/allo-piano-dsp-%d-%d-%d.bin",
+				rate, ((lowpass * 10) + 60), dac);
+		} else { /* low */
+			snprintf(firmware_name, sizeof(firmware_name),
+				"allo/piano/2.%d/allo-piano-dsp-%d-%d-%d.bin",
+				(mode - 1), rate, ((lowpass * 10) + 60), dac);
+		}
+
+		dev_info(codec->dev, "Dsp Firmware File Name: %s\n",
+				firmware_name);
+
+		ret = request_firmware(&fw, firmware_name, codec->dev);
+		if (ret < 0) {
+			dev_err(codec->dev,
+				"Error: Allo Piano Firmware %s missing. %d\n",
+				firmware_name, ret);
+			goto err;
+		}
+
+		while (i < (fw->size - 1)) {
+			dsp_code_read = (struct dsp_code *)&fw->data[i];
+
+			if (dsp_code_read->offset == 0) {
+				glb_ptr->dsp_page_number = dsp_code_read->val;
+				ret = snd_soc_write(rtd->codec_dais[dac]->codec,
+						PCM512x_PAGE_BASE(0),
+						dsp_code_read->val);
+
+			} else if (dsp_code_read->offset != 0) {
+				ret = snd_soc_write(rtd->codec_dais[dac]->codec,
+					(PCM512x_PAGE_BASE(
+						glb_ptr->dsp_page_number) +
+					dsp_code_read->offset),
+					dsp_code_read->val);
+			}
+			if (ret < 0) {
+				dev_err(codec->dev,
+					"Failed to write Register: %d\n", ret);
+				release_firmware(fw);
+				goto err;
+			}
+			i = i + 3;
+		}
+		release_firmware(fw);
+	}
+	glb_ptr->set_rate = rate;
+	glb_ptr->set_mode = mode;
+	glb_ptr->set_lowpass = lowpass;
+	return 1;
+
+err:
+	return ret;
+}
+
+static int snd_allo_piano_dsp_program(struct snd_soc_pcm_runtime *rtd,
+		unsigned int mode, unsigned int rate, unsigned int lowpass)
+{
+	struct snd_soc_card *card = rtd->card;
+	struct glb_pool *glb_ptr = card->drvdata;
+	int ret = 0;
+
+	mutex_lock(&glb_ptr->lock);
+
+	ret = __snd_allo_piano_dsp_program(rtd, mode, rate, lowpass);
+
+	mutex_unlock(&glb_ptr->lock);
+
+	return ret;
+}
+
+static int snd_allo_piano_dual_mode_get(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct glb_pool *glb_ptr = card->drvdata;
+
+	ucontrol->value.integer.value[0] = glb_ptr->dual_mode;
+
+	return 0;
+}
+
+static int snd_allo_piano_dual_mode_put(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct glb_pool *glb_ptr = card->drvdata;
+	struct snd_soc_pcm_runtime *rtd;
+	struct snd_card *snd_card_ptr = card->snd_card;
+	struct snd_kcontrol *kctl;
+	struct soc_mixer_control *mc;
+	unsigned int left_val = 0, right_val = 0;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+
+	if (ucontrol->value.integer.value[0] > 0) {
+		glb_ptr->dual_mode = ucontrol->value.integer.value[0];
+		glb_ptr->set_mode = 0;
+	} else {
+		if (glb_ptr->set_mode <= 0) {
+			glb_ptr->dual_mode = 1;
+			glb_ptr->set_mode = 0;
+		} else {
+			glb_ptr->dual_mode = 0;
+			return 0;
+		}
+	}
+
+	if (glb_ptr->dual_mode == 1) { // Dual Mono
+		snd_soc_write(rtd->codec_dais[0]->codec,
+				PCM512x_MUTE, P_DAC_RIGHT_MUTE);
+		snd_soc_write(rtd->codec_dais[1]->codec,
+				PCM512x_MUTE, P_DAC_LEFT_MUTE);
+		snd_soc_write(rtd->codec_dais[0]->codec,
+				PCM512x_DIGITAL_VOLUME_3, 0xff);
+		snd_soc_write(rtd->codec_dais[1]->codec,
+				PCM512x_DIGITAL_VOLUME_2, 0xff);
+
+		list_for_each_entry(kctl, &snd_card_ptr->controls, list) {
+			if (!strncmp(kctl->id.name, "Digital Playback Volume",
+					sizeof(kctl->id.name))) {
+				mc = (struct soc_mixer_control *)
+					kctl->private_value;
+				mc->rreg = mc->reg;
+				break;
+			}
+		}
+	} else {
+		left_val = snd_soc_read(rtd->codec_dais[0]->codec,
+						PCM512x_DIGITAL_VOLUME_2);
+		right_val = snd_soc_read(rtd->codec_dais[1]->codec,
+						PCM512x_DIGITAL_VOLUME_3);
+
+		list_for_each_entry(kctl, &snd_card_ptr->controls, list) {
+			if (!strncmp(kctl->id.name, "Digital Playback Volume",
+					sizeof(kctl->id.name))) {
+				mc = (struct soc_mixer_control *)
+					kctl->private_value;
+				mc->rreg = PCM512x_DIGITAL_VOLUME_3;
+				break;
+			}
+		}
+
+		snd_soc_write(rtd->codec_dais[0]->codec,
+				PCM512x_DIGITAL_VOLUME_3, left_val);
+		snd_soc_write(rtd->codec_dais[1]->codec,
+				PCM512x_DIGITAL_VOLUME_2, right_val);
+		snd_soc_write(rtd->codec_dais[0]->codec,
+				PCM512x_MUTE, P_DAC_UNMUTE);
+		snd_soc_write(rtd->codec_dais[1]->codec,
+				PCM512x_MUTE, P_DAC_UNMUTE);
+	}
+
+	return 0;
+}
+
+static int snd_allo_piano_mode_get(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct glb_pool *glb_ptr = card->drvdata;
+
+	ucontrol->value.integer.value[0] = glb_ptr->set_mode;
+	return 0;
+}
+
+static int snd_allo_piano_mode_put(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_pcm_runtime *rtd;
+	struct glb_pool *glb_ptr = card->drvdata;
+	struct snd_card *snd_card_ptr = card->snd_card;
+	struct snd_kcontrol *kctl;
+	struct soc_mixer_control *mc;
+	unsigned int left_val = 0, right_val = 0;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+
+	if ((glb_ptr->dual_mode == 1) &&
+			(ucontrol->value.integer.value[0] > 0)) {
+		left_val = snd_soc_read(rtd->codec_dais[0]->codec,
+						PCM512x_DIGITAL_VOLUME_2);
+		right_val = snd_soc_read(rtd->codec_dais[1]->codec,
+						PCM512x_DIGITAL_VOLUME_2);
+
+		list_for_each_entry(kctl, &snd_card_ptr->controls, list) {
+			if (!strncmp(kctl->id.name, "Digital Playback Volume",
+					sizeof(kctl->id.name))) {
+				mc = (struct soc_mixer_control *)
+					kctl->private_value;
+				mc->rreg = PCM512x_DIGITAL_VOLUME_3;
+				break;
+			}
+		}
+		snd_soc_write(rtd->codec_dais[0]->codec,
+				PCM512x_DIGITAL_VOLUME_3, left_val);
+		snd_soc_write(rtd->codec_dais[1]->codec,
+				PCM512x_DIGITAL_VOLUME_3, right_val);
+	}
+
+	return(snd_allo_piano_dsp_program(rtd,
+				ucontrol->value.integer.value[0],
+				glb_ptr->set_rate, glb_ptr->set_lowpass));
+}
+
+static int snd_allo_piano_lowpass_get(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct glb_pool *glb_ptr = card->drvdata;
+
+	ucontrol->value.integer.value[0] = glb_ptr->set_lowpass;
+	return 0;
+}
+
+static int snd_allo_piano_lowpass_put(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_pcm_runtime *rtd;
+	struct glb_pool *glb_ptr = card->drvdata;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	return(snd_allo_piano_dsp_program(rtd,
+				glb_ptr->set_mode, glb_ptr->set_rate,
+				ucontrol->value.integer.value[0]));
+}
+
+static int pcm512x_get_reg_sub(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct soc_mixer_control *mc =
+		(struct soc_mixer_control *)kcontrol->private_value;
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct glb_pool *glb_ptr = card->drvdata;
+	struct snd_soc_pcm_runtime *rtd;
+	unsigned int left_val = 0;
+	unsigned int right_val = 0;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	right_val = snd_soc_read(rtd->codec_dais[1]->codec,
+			PCM512x_DIGITAL_VOLUME_3);
+	if (right_val < 0)
+		return right_val;
+
+	if (glb_ptr->dual_mode != 1) {
+		left_val = snd_soc_read(rtd->codec_dais[1]->codec,
+				PCM512x_DIGITAL_VOLUME_2);
+		if (left_val < 0)
+			return left_val;
+
+	} else {
+		left_val = right_val;
+	}
+
+	ucontrol->value.integer.value[0] =
+				(~(left_val >> mc->shift)) & mc->max;
+	ucontrol->value.integer.value[1] =
+				(~(right_val >> mc->shift)) & mc->max;
+
+	return 0;
+}
+
+static int pcm512x_set_reg_sub(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct soc_mixer_control *mc =
+		(struct soc_mixer_control *)kcontrol->private_value;
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct glb_pool *glb_ptr = card->drvdata;
+	struct snd_soc_pcm_runtime *rtd;
+	unsigned int left_val = (ucontrol->value.integer.value[0] & mc->max);
+	unsigned int right_val = (ucontrol->value.integer.value[1] & mc->max);
+	int ret = 0;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	if (glb_ptr->dual_mode != 1) {
+		ret = snd_soc_write(rtd->codec_dais[1]->codec,
+				PCM512x_DIGITAL_VOLUME_2, (~left_val));
+		if (ret < 0)
+			return ret;
+	}
+
+	if (digital_gain_0db_limit) {
+		ret = snd_soc_limit_volume(card, "Subwoofer Playback Volume",
+					207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n",
+				ret);
+	}
+
+	ret = snd_soc_write(rtd->codec_dais[1]->codec,
+			PCM512x_DIGITAL_VOLUME_3, (~right_val));
+	if (ret < 0)
+		return ret;
+
+	return 1;
+}
+
+static int pcm512x_get_reg_sub_switch(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_pcm_runtime *rtd;
+	int val = 0;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	val = snd_soc_read(rtd->codec_dais[1]->codec, PCM512x_MUTE);
+	if (val < 0)
+		return val;
+
+	ucontrol->value.integer.value[0] =
+			(val & P_DAC_LEFT_MUTE) ? P_UNMUTE : P_MUTE;
+	ucontrol->value.integer.value[1] =
+			(val & P_DAC_RIGHT_MUTE) ? P_UNMUTE : P_MUTE;
+
+	return val;
+}
+
+static int pcm512x_set_reg_sub_switch(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_pcm_runtime *rtd;
+	struct glb_pool *glb_ptr = card->drvdata;
+	unsigned int left_val = (ucontrol->value.integer.value[0]);
+	unsigned int right_val = (ucontrol->value.integer.value[1]);
+	int ret = 0;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	if (glb_ptr->set_mode != 1) {
+		ret = snd_soc_write(rtd->codec_dais[1]->codec, PCM512x_MUTE,
+				~((left_val & 0x01)<<4 | (right_val & 0x01)));
+		if (ret < 0)
+			return ret;
+	}
+	return 1;
+
+}
+
+static int pcm512x_get_reg_master(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct soc_mixer_control *mc =
+		(struct soc_mixer_control *)kcontrol->private_value;
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct glb_pool *glb_ptr = card->drvdata;
+	struct snd_soc_pcm_runtime *rtd;
+	unsigned int left_val = 0, right_val = 0;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+
+	left_val = snd_soc_read(rtd->codec_dais[0]->codec,
+			PCM512x_DIGITAL_VOLUME_2);
+	if (left_val < 0)
+		return left_val;
+
+	if (glb_ptr->dual_mode == 1) {
+		right_val = snd_soc_read(rtd->codec_dais[1]->codec,
+				PCM512x_DIGITAL_VOLUME_3);
+		if (right_val < 0)
+			return right_val;
+	} else {
+		right_val = snd_soc_read(rtd->codec_dais[0]->codec,
+				PCM512x_DIGITAL_VOLUME_3);
+		if (right_val < 0)
+			return right_val;
+	}
+
+	ucontrol->value.integer.value[0] =
+		(~(left_val  >> mc->shift)) & mc->max;
+	ucontrol->value.integer.value[1] =
+		(~(right_val >> mc->shift)) & mc->max;
+
+	return 0;
+}
+
+static int pcm512x_set_reg_master(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct soc_mixer_control *mc =
+		(struct soc_mixer_control *)kcontrol->private_value;
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct glb_pool *glb_ptr = card->drvdata;
+	struct snd_soc_pcm_runtime *rtd;
+	unsigned int left_val = (ucontrol->value.integer.value[0] & mc->max);
+	unsigned int right_val = (ucontrol->value.integer.value[1] & mc->max);
+	int ret = 0;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+
+	if (digital_gain_0db_limit) {
+		ret = snd_soc_limit_volume(card, "Master Playback Volume",
+					207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n",
+				ret);
+	}
+
+	if (glb_ptr->dual_mode != 1) {
+		ret = snd_soc_write(rtd->codec_dais[1]->codec,
+				PCM512x_DIGITAL_VOLUME_2, (~left_val));
+		if (ret < 0)
+			return ret;
+
+		ret = snd_soc_write(rtd->codec_dais[0]->codec,
+				PCM512x_DIGITAL_VOLUME_3, (~right_val));
+		if (ret < 0)
+			return ret;
+
+	}
+
+	ret = snd_soc_write(rtd->codec_dais[1]->codec,
+			PCM512x_DIGITAL_VOLUME_3, (~right_val));
+	if (ret < 0)
+		return ret;
+
+	ret = snd_soc_write(rtd->codec_dais[0]->codec,
+			PCM512x_DIGITAL_VOLUME_2, (~left_val));
+	if (ret < 0)
+		return ret;
+	return 1;
+}
+
+static int pcm512x_get_reg_master_switch(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct glb_pool *glb_ptr = card->drvdata;
+	struct snd_soc_pcm_runtime *rtd;
+	int val = 0;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+
+	val = snd_soc_read(rtd->codec_dais[0]->codec, PCM512x_MUTE);
+	if (val < 0)
+		return val;
+
+	ucontrol->value.integer.value[0] =
+			(val & P_DAC_LEFT_MUTE) ? P_UNMUTE : P_MUTE;
+
+	if (glb_ptr->dual_mode == 1) {
+		val = snd_soc_read(rtd->codec_dais[1]->codec, PCM512x_MUTE);
+		if (val < 0)
+			return val;
+	}
+	ucontrol->value.integer.value[1] =
+			(val & P_DAC_RIGHT_MUTE) ? P_UNMUTE : P_MUTE;
+
+	return val;
+}
+
+static int pcm512x_set_reg_master_switch(struct snd_kcontrol *kcontrol,
+		struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_pcm_runtime *rtd;
+	struct glb_pool *glb_ptr = card->drvdata;
+	unsigned int left_val = (ucontrol->value.integer.value[0]);
+	unsigned int right_val = (ucontrol->value.integer.value[1]);
+	int ret = 0;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	if (glb_ptr->dual_mode == 1) {
+		ret = snd_soc_write(rtd->codec_dais[0]->codec, PCM512x_MUTE,
+				~((left_val & 0x01)<<4));
+		if (ret < 0)
+			return ret;
+		ret = snd_soc_write(rtd->codec_dais[1]->codec, PCM512x_MUTE,
+				~((right_val & 0x01)));
+		if (ret < 0)
+			return ret;
+
+	} else if (glb_ptr->set_mode == 1) {
+		ret = snd_soc_write(rtd->codec_dais[0]->codec, PCM512x_MUTE,
+				~((left_val & 0x01)<<4 | (right_val & 0x01)));
+		if (ret < 0)
+			return ret;
+
+	} else {
+		ret = snd_soc_write(rtd->codec_dais[0]->codec, PCM512x_MUTE,
+				~((left_val & 0x01)<<4 | (right_val & 0x01)));
+		if (ret < 0)
+			return ret;
+
+		ret = snd_soc_write(rtd->codec_dais[1]->codec, PCM512x_MUTE,
+				~((left_val & 0x01)<<4 | (right_val & 0x01)));
+		if (ret < 0)
+			return ret;
+	}
+	return 1;
+}
+
+static const DECLARE_TLV_DB_SCALE(digital_tlv_sub, -10350, 50, 1);
+static const DECLARE_TLV_DB_SCALE(digital_tlv_master, -10350, 50, 1);
+
+static const struct snd_kcontrol_new allo_piano_controls[] = {
+	SOC_ENUM_EXT("Subwoofer mode Route",
+			allo_piano_mode_enum,
+			snd_allo_piano_mode_get,
+			snd_allo_piano_mode_put),
+
+	SOC_ENUM_EXT("Dual Mode Route",
+			allo_piano_dual_mode_enum,
+			snd_allo_piano_dual_mode_get,
+			snd_allo_piano_dual_mode_put),
+
+	SOC_ENUM_EXT("Lowpass Route", allo_piano_enum,
+			snd_allo_piano_lowpass_get,
+			snd_allo_piano_lowpass_put),
+
+	SOC_DOUBLE_R_EXT_TLV("Subwoofer Playback Volume",
+			PCM512x_DIGITAL_VOLUME_2,
+			PCM512x_DIGITAL_VOLUME_3, 0, 255, 1,
+			pcm512x_get_reg_sub,
+			pcm512x_set_reg_sub,
+			digital_tlv_sub),
+
+	SOC_DOUBLE_EXT("Subwoofer Playback Switch",
+			PCM512x_MUTE,
+			PCM512x_RQML_SHIFT,
+			PCM512x_RQMR_SHIFT, 1, 1,
+			pcm512x_get_reg_sub_switch,
+			pcm512x_set_reg_sub_switch),
+
+	SOC_DOUBLE_R_EXT_TLV("Master Playback Volume",
+			PCM512x_DIGITAL_VOLUME_2,
+			PCM512x_DIGITAL_VOLUME_3, 0, 255, 1,
+			pcm512x_get_reg_master,
+			pcm512x_set_reg_master,
+			digital_tlv_master),
+
+	SOC_DOUBLE_EXT("Master Playback Switch",
+			PCM512x_MUTE,
+			PCM512x_RQML_SHIFT,
+			PCM512x_RQMR_SHIFT, 1, 1,
+			pcm512x_get_reg_master_switch,
+			pcm512x_set_reg_master_switch),
+};
+
+static int snd_allo_piano_dac_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_card *card = rtd->card;
+	struct glb_pool *glb_ptr;
+
+	glb_ptr = kzalloc(sizeof(struct glb_pool), GFP_KERNEL);
+	if (!glb_ptr)
+		return -ENOMEM;
+
+	card->drvdata = glb_ptr;
+	glb_ptr->dual_mode = 2;
+	glb_ptr->set_mode = 0;
+
+	mutex_init(&glb_ptr->lock);
+
+	if (digital_gain_0db_limit) {
+		int ret;
+
+		ret = snd_soc_limit_volume(card, "Digital Playback Volume",
+					207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n",
+				ret);
+	}
+	return 0;
+}
+
+static void snd_allo_piano_gpio_mute(struct snd_soc_card *card)
+{
+	if (mute_gpio[0])
+		gpiod_set_value_cansleep(mute_gpio[0], P_MUTE);
+
+	if (mute_gpio[1])
+		gpiod_set_value_cansleep(mute_gpio[1], P_MUTE);
+}
+
+static void snd_allo_piano_gpio_unmute(struct snd_soc_card *card)
+{
+	if (mute_gpio[0])
+		gpiod_set_value_cansleep(mute_gpio[0], P_UNMUTE);
+
+	if (mute_gpio[1])
+		gpiod_set_value_cansleep(mute_gpio[1], P_UNMUTE);
+}
+
+static int snd_allo_piano_set_bias_level(struct snd_soc_card *card,
+	struct snd_soc_dapm_context *dapm, enum snd_soc_bias_level level)
+{
+	struct snd_soc_pcm_runtime *rtd;
+	struct snd_soc_dai *codec_dai;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	codec_dai = rtd->codec_dai;
+
+	if (dapm->dev != codec_dai->dev)
+		return 0;
+
+	switch (level) {
+	case SND_SOC_BIAS_PREPARE:
+		if (dapm->bias_level != SND_SOC_BIAS_STANDBY)
+			break;
+		/* UNMUTE DAC */
+		snd_allo_piano_gpio_unmute(card);
+		break;
+
+	case SND_SOC_BIAS_STANDBY:
+		if (dapm->bias_level != SND_SOC_BIAS_PREPARE)
+			break;
+		/* MUTE DAC */
+		snd_allo_piano_gpio_mute(card);
+		break;
+
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+static int snd_allo_piano_dac_startup(
+	struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_card *card = rtd->card;
+
+	snd_allo_piano_gpio_mute(card);
+
+	return 0;
+}
+
+static int snd_allo_piano_dac_hw_params(
+		struct snd_pcm_substream *substream,
+		struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	unsigned int rate = params_rate(params);
+	struct snd_soc_card *card = rtd->card;
+	struct glb_pool *glb_ptr = card->drvdata;
+	int ret = 0, val = 0, dac;
+
+	for (dac = 0; (glb_mclk && dac < 2); dac++) {
+		/* Configure the PLL clock reference for both the Codecs */
+		val = snd_soc_read(rtd->codec_dais[dac]->codec,
+					PCM512x_RATE_DET_4);
+		if (val < 0) {
+			dev_err(rtd->codec_dais[dac]->codec->dev,
+				"Failed to read register PCM512x_RATE_DET_4\n");
+			return val;
+		}
+
+		if (val & 0x40) {
+			snd_soc_write(rtd->codec_dais[dac]->codec,
+					PCM512x_PLL_REF,
+					PCM512x_SREF_BCK);
+
+			dev_info(rtd->codec_dais[dac]->codec->dev,
+				"Setting BCLK as input clock & Enable PLL\n");
+		} else {
+			snd_soc_write(rtd->codec_dais[dac]->codec,
+					PCM512x_PLL_EN,
+					0x00);
+
+			snd_soc_write(rtd->codec_dais[dac]->codec,
+					PCM512x_PLL_REF,
+					PCM512x_SREF_SCK);
+
+			dev_info(rtd->codec_dais[dac]->codec->dev,
+				"Setting SCLK as input clock & disabled PLL\n");
+		}
+	}
+
+	ret = snd_allo_piano_dsp_program(rtd, glb_ptr->set_mode, rate,
+						glb_ptr->set_lowpass);
+	if (ret < 0)
+		return ret;
+
+	return ret;
+}
+
+static int snd_allo_piano_dac_prepare(
+	struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_card *card = rtd->card;
+
+	snd_allo_piano_gpio_unmute(card);
+
+	return 0;
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_allo_piano_dac_ops = {
+	.startup = snd_allo_piano_dac_startup,
+	.hw_params = snd_allo_piano_dac_hw_params,
+	.prepare = snd_allo_piano_dac_prepare,
+};
+
+static struct snd_soc_dai_link_component allo_piano_2_1_codecs[] = {
+	{
+		.dai_name = "pcm512x-hifi",
+	},
+	{
+		.dai_name = "pcm512x-hifi",
+	},
+};
+
+static struct snd_soc_dai_link snd_allo_piano_dac_dai[] = {
+	{
+		.name		= "PianoDACPlus",
+		.stream_name	= "PianoDACPlus",
+		.cpu_dai_name	= "bcm2708-i2s.0",
+		.platform_name	= "bcm2708-i2s.0",
+		.codecs		= allo_piano_2_1_codecs,
+		.num_codecs	= 2,
+		.dai_fmt	= SND_SOC_DAIFMT_I2S |
+				SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBS_CFS,
+		.ops		= &snd_allo_piano_dac_ops,
+		.init		= snd_allo_piano_dac_init,
+	},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_allo_piano_dac = {
+	.name = "PianoDACPlus",
+	.owner = THIS_MODULE,
+	.dai_link = snd_allo_piano_dac_dai,
+	.num_links = ARRAY_SIZE(snd_allo_piano_dac_dai),
+	.controls = allo_piano_controls,
+	.num_controls = ARRAY_SIZE(allo_piano_controls),
+};
+
+static int snd_allo_piano_dac_probe(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = &snd_allo_piano_dac;
+	int ret = 0, i = 0;
+
+	card->dev = &pdev->dev;
+	platform_set_drvdata(pdev, &snd_allo_piano_dac);
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai;
+
+		dai = &snd_allo_piano_dac_dai[0];
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+						"i2s-controller", 0);
+		if (i2s_node) {
+			for (i = 0; i < card->num_links; i++) {
+				dai->cpu_dai_name = NULL;
+				dai->cpu_of_node = i2s_node;
+				dai->platform_name = NULL;
+				dai->platform_of_node = i2s_node;
+			}
+		}
+		digital_gain_0db_limit =
+			!of_property_read_bool(pdev->dev.of_node,
+						"allo,24db_digital_gain");
+
+		glb_mclk = of_property_read_bool(pdev->dev.of_node,
+						"allo,glb_mclk");
+
+		allo_piano_2_1_codecs[0].of_node =
+			of_parse_phandle(pdev->dev.of_node, "audio-codec", 0);
+		if (!allo_piano_2_1_codecs[0].of_node) {
+			dev_err(&pdev->dev,
+				"Property 'audio-codec' missing or invalid\n");
+			return -EINVAL;
+		}
+
+		allo_piano_2_1_codecs[1].of_node =
+			of_parse_phandle(pdev->dev.of_node, "audio-codec", 1);
+		if (!allo_piano_2_1_codecs[1].of_node) {
+			dev_err(&pdev->dev,
+				"Property 'audio-codec' missing or invalid\n");
+			return -EINVAL;
+		}
+
+		mute_gpio[0] = devm_gpiod_get_optional(&pdev->dev, "mute1",
+							GPIOD_OUT_LOW);
+		if (IS_ERR(mute_gpio[0])) {
+			ret = PTR_ERR(mute_gpio[0]);
+			dev_err(&pdev->dev,
+				"failed to get mute1 gpio6: %d\n", ret);
+			return ret;
+		}
+
+		mute_gpio[1] = devm_gpiod_get_optional(&pdev->dev, "mute2",
+							GPIOD_OUT_LOW);
+		if (IS_ERR(mute_gpio[1])) {
+			ret = PTR_ERR(mute_gpio[1]);
+			dev_err(&pdev->dev,
+				"failed to get mute2 gpio25: %d\n", ret);
+			return ret;
+		}
+
+		if (mute_gpio[0] && mute_gpio[1])
+			snd_allo_piano_dac.set_bias_level =
+				snd_allo_piano_set_bias_level;
+
+		ret = snd_soc_register_card(&snd_allo_piano_dac);
+		if (ret < 0) {
+			dev_err(&pdev->dev,
+				"snd_soc_register_card() failed: %d\n", ret);
+			return ret;
+		}
+
+		if ((mute_gpio[0]) && (mute_gpio[1]))
+			snd_allo_piano_gpio_mute(&snd_allo_piano_dac);
+
+		return 0;
+	}
+
+	return -EINVAL;
+}
+
+static int snd_allo_piano_dac_remove(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = platform_get_drvdata(pdev);
+
+	kfree(&card->drvdata);
+	snd_allo_piano_gpio_mute(&snd_allo_piano_dac);
+	return snd_soc_unregister_card(&snd_allo_piano_dac);
+}
+
+static const struct of_device_id snd_allo_piano_dac_of_match[] = {
+	{ .compatible = "allo,piano-dac-plus", },
+	{ /* sentinel */ },
+};
+
+MODULE_DEVICE_TABLE(of, snd_allo_piano_dac_of_match);
+
+static struct platform_driver snd_allo_piano_dac_driver = {
+	.driver = {
+		.name = "snd-allo-piano-dac-plus",
+		.owner = THIS_MODULE,
+		.of_match_table = snd_allo_piano_dac_of_match,
+	},
+	.probe = snd_allo_piano_dac_probe,
+	.remove = snd_allo_piano_dac_remove,
+};
+
+module_platform_driver(snd_allo_piano_dac_driver);
+
+MODULE_AUTHOR("Baswaraj K <jaikumar@cem-solutions.net>");
+MODULE_DESCRIPTION("ALSA ASoC Machine Driver for Allo Piano DAC Plus");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/allo-piano-dac.c b/sound/soc/bcm/allo-piano-dac.c
new file mode 100644
index 000000000000..cfe81c946271
--- /dev/null
+++ b/sound/soc/bcm/allo-piano-dac.c
@@ -0,0 +1,126 @@
+/*
+ * ALSA ASoC Machine Driver for Allo Piano DAC
+ *
+ * Author:	Baswaraj K <jaikumar@cem-solutions.net>
+ *		Copyright 2016
+ *		based on code by Daniel Matuschek <info@crazy-audio.com>
+ *		based on code by Florian Meier <florian.meier@koalo.de>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+
+static bool digital_gain_0db_limit = true;
+
+static int snd_allo_piano_dac_init(struct snd_soc_pcm_runtime *rtd)
+{
+	if (digital_gain_0db_limit) {
+		int ret;
+		struct snd_soc_card *card = rtd->card;
+
+		ret = snd_soc_limit_volume(card, "Digital Playback Volume",
+					   207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n",
+				 ret);
+	}
+
+	return 0;
+}
+
+static struct snd_soc_dai_link snd_allo_piano_dac_dai[] = {
+{
+	.name		= "Piano DAC",
+	.stream_name	= "Piano DAC HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "pcm512x-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "pcm512x.1-004c",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S |
+			  SND_SOC_DAIFMT_NB_NF |
+			  SND_SOC_DAIFMT_CBS_CFS,
+	.init		= snd_allo_piano_dac_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_allo_piano_dac = {
+	.name         = "PianoDAC",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_allo_piano_dac_dai,
+	.num_links    = ARRAY_SIZE(snd_allo_piano_dac_dai),
+};
+
+static int snd_allo_piano_dac_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_allo_piano_dac.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai;
+
+		dai = &snd_allo_piano_dac_dai[0];
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+					    "i2s-controller", 0);
+
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+
+		digital_gain_0db_limit = !of_property_read_bool(
+			pdev->dev.of_node, "allo,24db_digital_gain");
+	}
+
+	ret = snd_soc_register_card(&snd_allo_piano_dac);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev,
+			"snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+static int snd_allo_piano_dac_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&snd_allo_piano_dac);
+}
+
+static const struct of_device_id snd_allo_piano_dac_of_match[] = {
+	{ .compatible = "allo,piano-dac", },
+	{ /* sentinel */ },
+};
+MODULE_DEVICE_TABLE(of, snd_allo_piano_dac_of_match);
+
+static struct platform_driver snd_allo_piano_dac_driver = {
+	.driver = {
+		.name   = "snd-allo-piano-dac",
+		.owner  = THIS_MODULE,
+		.of_match_table = snd_allo_piano_dac_of_match,
+	},
+	.probe          = snd_allo_piano_dac_probe,
+	.remove         = snd_allo_piano_dac_remove,
+};
+
+module_platform_driver(snd_allo_piano_dac_driver);
+
+MODULE_AUTHOR("Baswaraj K <jaikumar@cem-solutions.net>");
+MODULE_DESCRIPTION("ALSA ASoC Machine Driver for Allo Piano DAC");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/audioinjector-octo-soundcard.c b/sound/soc/bcm/audioinjector-octo-soundcard.c
new file mode 100644
index 000000000000..2ad83c40473f
--- /dev/null
+++ b/sound/soc/bcm/audioinjector-octo-soundcard.c
@@ -0,0 +1,344 @@
+/*
+ * ASoC Driver for AudioInjector Pi octo channel soundcard (hat)
+ *
+ *  Created on: 27-October-2016
+ *      Author: flatmax@flatmax.org
+ *              based on audioinjector-pi-soundcard.c
+ *
+ * Copyright (C) 2016 Flatmax Pty. Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/gpio/consumer.h>
+
+#include <sound/core.h>
+#include <sound/soc.h>
+#include <sound/pcm_params.h>
+#include <sound/control.h>
+
+static struct gpio_descs *mult_gpios;
+static struct gpio_desc *codec_rst_gpio;
+static unsigned int audioinjector_octo_rate;
+static bool non_stop_clocks;
+
+static const unsigned int audioinjector_octo_rates[] = {
+	96000, 48000, 32000, 24000, 16000, 8000, 88200, 44100, 29400, 22050, 14700,
+};
+
+static struct snd_pcm_hw_constraint_list audioinjector_octo_constraints = {
+	.list = audioinjector_octo_rates,
+	.count = ARRAY_SIZE(audioinjector_octo_rates),
+};
+
+static int audioinjector_octo_dai_init(struct snd_soc_pcm_runtime *rtd)
+{
+	return snd_soc_dai_set_bclk_ratio(rtd->cpu_dai, 64);
+}
+
+static int audioinjector_octo_startup(struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	rtd->cpu_dai->driver->playback.channels_min = 8;
+	rtd->cpu_dai->driver->playback.channels_max = 8;
+	rtd->cpu_dai->driver->capture.channels_min = 8;
+	rtd->cpu_dai->driver->capture.channels_max = 8;
+	rtd->codec_dai->driver->capture.channels_max = 8;
+	
+	snd_pcm_hw_constraint_list(substream->runtime, 0,
+				SNDRV_PCM_HW_PARAM_RATE,
+				&audioinjector_octo_constraints);
+
+	return 0;
+}
+
+static void audioinjector_octo_shutdown(struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	rtd->cpu_dai->driver->playback.channels_min = 2;
+	rtd->cpu_dai->driver->playback.channels_max = 2;
+	rtd->cpu_dai->driver->capture.channels_min = 2;
+	rtd->cpu_dai->driver->capture.channels_max = 2;
+	rtd->codec_dai->driver->capture.channels_max = 6;
+}
+
+static int audioinjector_octo_hw_params(struct snd_pcm_substream *substream,
+	struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+
+	// set codec DAI configuration
+	int ret = snd_soc_dai_set_fmt(rtd->codec_dai,
+			SND_SOC_DAIFMT_CBS_CFS|SND_SOC_DAIFMT_DSP_A|
+			SND_SOC_DAIFMT_NB_NF);
+	if (ret < 0)
+		return ret;
+
+	// set cpu DAI configuration
+	ret = snd_soc_dai_set_fmt(rtd->cpu_dai,
+			SND_SOC_DAIFMT_CBM_CFM|SND_SOC_DAIFMT_I2S|
+			SND_SOC_DAIFMT_NB_NF);
+	if (ret < 0)
+		return ret;
+
+	audioinjector_octo_rate = params_rate(params);
+
+	// Set the correct sysclock for the codec
+	switch (audioinjector_octo_rate) {
+	case 96000:
+	case 48000:
+		return snd_soc_dai_set_sysclk(rtd->codec_dai, 0, 49152000,
+									0);
+		break;
+	case 24000:
+		return snd_soc_dai_set_sysclk(rtd->codec_dai, 0, 49152000/2,
+									0);
+		break;
+	case 32000:
+	case 16000:
+		return snd_soc_dai_set_sysclk(rtd->codec_dai, 0, 49152000/3,
+									0);
+		break;
+	case 8000:
+		return snd_soc_dai_set_sysclk(rtd->codec_dai, 0, 49152000/6,
+									0);
+		break;
+	case 88200:
+	case 44100:
+		return snd_soc_dai_set_sysclk(rtd->codec_dai, 0, 45185400,
+									0);
+		break;
+	case 22050:
+		return snd_soc_dai_set_sysclk(rtd->codec_dai, 0, 45185400/2,
+									0);
+		break;
+	case 29400:
+	case 14700:
+		return snd_soc_dai_set_sysclk(rtd->codec_dai, 0, 45185400/3,
+									0);
+		break;
+	default:
+		return -EINVAL;
+	}
+}
+
+static int audioinjector_octo_trigger(struct snd_pcm_substream *substream,
+								int cmd){
+	int mult[4];
+
+	memset(mult, 0, sizeof(mult));
+
+	switch (cmd) {
+	case SNDRV_PCM_TRIGGER_STOP:
+	case SNDRV_PCM_TRIGGER_SUSPEND:
+	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+		if (!non_stop_clocks)
+			break;
+		/* Drop through... */
+	case SNDRV_PCM_TRIGGER_START:
+	case SNDRV_PCM_TRIGGER_RESUME:
+	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+		switch (audioinjector_octo_rate) {
+		case 96000:
+			mult[3] = 1;
+		case 88200:
+			mult[1] = 1;
+			mult[2] = 1;
+			break;
+		case 48000:
+			mult[3] = 1;
+		case 44100:
+			mult[2] = 1;
+			break;
+		case 32000:
+			mult[3] = 1;
+		case 29400:
+			mult[0] = 1;
+			mult[1] = 1;
+			break;
+		case 24000:
+			mult[3] = 1;
+		case 22050:
+			mult[1] = 1;
+			break;
+		case 16000:
+			mult[3] = 1;
+		case 14700:
+			mult[0] = 1;
+			break;
+		case 8000:
+			mult[3] = 1;
+			break;
+		default:
+			return -EINVAL;
+		}
+		break;
+	default:
+		return -EINVAL;
+	}
+	gpiod_set_array_value_cansleep(mult_gpios->ndescs, mult_gpios->desc,
+									mult);
+
+	return 0;
+}
+
+static struct snd_soc_ops audioinjector_octo_ops = {
+	.startup	= audioinjector_octo_startup,
+	.shutdown	= audioinjector_octo_shutdown,
+	.hw_params = audioinjector_octo_hw_params,
+	.trigger = audioinjector_octo_trigger,
+};
+
+static struct snd_soc_dai_link audioinjector_octo_dai[] = {
+	{
+		.name = "AudioInjector Octo",
+		.stream_name = "AudioInject-HIFI",
+		.codec_dai_name = "cs42448",
+		.ops = &audioinjector_octo_ops,
+		.init = audioinjector_octo_dai_init,
+		.symmetric_rates = 1,
+		.symmetric_channels = 1,
+	},
+};
+
+static const struct snd_soc_dapm_widget audioinjector_octo_widgets[] = {
+	SND_SOC_DAPM_OUTPUT("OUTPUTS0"),
+	SND_SOC_DAPM_OUTPUT("OUTPUTS1"),
+	SND_SOC_DAPM_OUTPUT("OUTPUTS2"),
+	SND_SOC_DAPM_OUTPUT("OUTPUTS3"),
+	SND_SOC_DAPM_INPUT("INPUTS0"),
+	SND_SOC_DAPM_INPUT("INPUTS1"),
+	SND_SOC_DAPM_INPUT("INPUTS2"),
+};
+
+static const struct snd_soc_dapm_route audioinjector_octo_route[] = {
+	/* Balanced outputs */
+	{"OUTPUTS0", NULL, "AOUT1L"},
+	{"OUTPUTS0", NULL, "AOUT1R"},
+	{"OUTPUTS1", NULL, "AOUT2L"},
+	{"OUTPUTS1", NULL, "AOUT2R"},
+	{"OUTPUTS2", NULL, "AOUT3L"},
+	{"OUTPUTS2", NULL, "AOUT3R"},
+	{"OUTPUTS3", NULL, "AOUT4L"},
+	{"OUTPUTS3", NULL, "AOUT4R"},
+
+	/* Balanced inputs */
+	{"AIN1L", NULL, "INPUTS0"},
+	{"AIN1R", NULL, "INPUTS0"},
+	{"AIN2L", NULL, "INPUTS1"},
+	{"AIN2R", NULL, "INPUTS1"},
+	{"AIN3L", NULL, "INPUTS2"},
+	{"AIN3R", NULL, "INPUTS2"},
+};
+
+static struct snd_soc_card snd_soc_audioinjector_octo = {
+	.name = "audioinjector-octo-soundcard",
+	.dai_link = audioinjector_octo_dai,
+	.num_links = ARRAY_SIZE(audioinjector_octo_dai),
+
+	.dapm_widgets = audioinjector_octo_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(audioinjector_octo_widgets),
+	.dapm_routes = audioinjector_octo_route,
+	.num_dapm_routes = ARRAY_SIZE(audioinjector_octo_route),
+};
+
+static int audioinjector_octo_probe(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = &snd_soc_audioinjector_octo;
+	int ret;
+
+	card->dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct snd_soc_dai_link *dai = &audioinjector_octo_dai[0];
+		struct device_node *i2s_node =
+					of_parse_phandle(pdev->dev.of_node,
+							"i2s-controller", 0);
+		struct device_node *codec_node =
+					of_parse_phandle(pdev->dev.of_node,
+								"codec", 0);
+
+		mult_gpios = devm_gpiod_get_array_optional(&pdev->dev, "mult",
+								GPIOD_OUT_LOW);
+		if (IS_ERR(mult_gpios))
+			return PTR_ERR(mult_gpios);
+
+		codec_rst_gpio = devm_gpiod_get_optional(&pdev->dev, "reset",
+								GPIOD_OUT_LOW);
+		if (IS_ERR(codec_rst_gpio))
+			return PTR_ERR(codec_rst_gpio);
+
+		non_stop_clocks = of_property_read_bool(pdev->dev.of_node, "non-stop-clocks");
+
+		if (codec_rst_gpio)
+			gpiod_set_value(codec_rst_gpio, 1);
+		msleep(500);
+		if (codec_rst_gpio)
+			gpiod_set_value(codec_rst_gpio, 0);
+		msleep(500);
+		if (codec_rst_gpio)
+			gpiod_set_value(codec_rst_gpio, 1);
+		msleep(500);
+
+		if (i2s_node && codec_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+			dai->codec_name = NULL;
+			dai->codec_of_node = codec_node;
+		} else
+			if (!dai->cpu_of_node) {
+				dev_err(&pdev->dev,
+				"i2s-controller missing or invalid in DT\n");
+				return -EINVAL;
+			} else {
+				dev_err(&pdev->dev,
+				"Property 'codec' missing or invalid\n");
+				return -EINVAL;
+			}
+	}
+
+	ret = snd_soc_register_card(card);
+	if (ret != 0)
+		dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret);
+	return ret;
+}
+
+static int audioinjector_octo_remove(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = platform_get_drvdata(pdev);
+
+	return snd_soc_unregister_card(card);
+}
+
+static const struct of_device_id audioinjector_octo_of_match[] = {
+	{ .compatible = "ai,audioinjector-octo-soundcard", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, audioinjector_octo_of_match);
+
+static struct platform_driver audioinjector_octo_driver = {
+	.driver	= {
+		.name			= "audioinjector-octo",
+		.owner			= THIS_MODULE,
+		.of_match_table = audioinjector_octo_of_match,
+	},
+	.probe	= audioinjector_octo_probe,
+	.remove	= audioinjector_octo_remove,
+};
+
+module_platform_driver(audioinjector_octo_driver);
+MODULE_AUTHOR("Matt Flax <flatmax@flatmax.org>");
+MODULE_DESCRIPTION("AudioInjector.net octo Soundcard");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:audioinjector-octo-soundcard");
diff --git a/sound/soc/bcm/audioinjector-pi-soundcard.c b/sound/soc/bcm/audioinjector-pi-soundcard.c
new file mode 100644
index 000000000000..491906bbf446
--- /dev/null
+++ b/sound/soc/bcm/audioinjector-pi-soundcard.c
@@ -0,0 +1,193 @@
+/*
+ * ASoC Driver for AudioInjector Pi add on soundcard
+ *
+ *  Created on: 13-May-2016
+ *      Author: flatmax@flatmax.org
+ *              based on code by  Cliff Cai <Cliff.Cai@analog.com> for the ssm2602 machine blackfin.
+ *              with help from Lars-Peter Clausen for simplifying the original code to use the dai_fmt field.
+ *		i2s_node code taken from the other sound/soc/bcm machine drivers.
+ *
+ * Copyright (C) 2016 Flatmax Pty. Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+
+#include <sound/core.h>
+#include <sound/soc.h>
+#include <sound/pcm_params.h>
+#include <sound/control.h>
+
+#include "../codecs/wm8731.h"
+
+static const unsigned int bcm2835_rates_12000000[] = {
+	8000, 16000, 32000, 44100, 48000, 96000, 88200,
+};
+
+static struct snd_pcm_hw_constraint_list bcm2835_constraints_12000000 = {
+	.list = bcm2835_rates_12000000,
+	.count = ARRAY_SIZE(bcm2835_rates_12000000),
+};
+
+static int snd_audioinjector_pi_soundcard_startup(struct snd_pcm_substream *substream)
+{
+	/* Setup constraints, because there is a 12 MHz XTAL on the board */
+	snd_pcm_hw_constraint_list(substream->runtime, 0,
+				SNDRV_PCM_HW_PARAM_RATE,
+				&bcm2835_constraints_12000000);
+	return 0;
+}
+
+static int snd_audioinjector_pi_soundcard_hw_params(struct snd_pcm_substream *substream,
+				       struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+
+	switch (params_rate(params)){
+		case 8000:
+			return snd_soc_dai_set_bclk_ratio(cpu_dai, 1);
+		case 16000:
+			return snd_soc_dai_set_bclk_ratio(cpu_dai, 750);
+		case 32000:
+			return snd_soc_dai_set_bclk_ratio(cpu_dai, 375);
+		case 44100:
+			return snd_soc_dai_set_bclk_ratio(cpu_dai, 272);
+		case 48000:
+			return snd_soc_dai_set_bclk_ratio(cpu_dai, 250);
+		case 88200:
+			return snd_soc_dai_set_bclk_ratio(cpu_dai, 136);
+		case 96000:
+			return snd_soc_dai_set_bclk_ratio(cpu_dai, 125);
+		default:
+			return snd_soc_dai_set_bclk_ratio(cpu_dai, 125);
+	}
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_audioinjector_pi_soundcard_ops = {
+	.startup = snd_audioinjector_pi_soundcard_startup,
+	.hw_params = snd_audioinjector_pi_soundcard_hw_params,
+};
+
+static int audioinjector_pi_soundcard_dai_init(struct snd_soc_pcm_runtime *rtd)
+{
+	return snd_soc_dai_set_sysclk(rtd->codec_dai, WM8731_SYSCLK_XTAL, 12000000, SND_SOC_CLOCK_IN);
+}
+
+static struct snd_soc_dai_link audioinjector_pi_soundcard_dai[] = {
+	{
+		.name = "AudioInjector audio",
+		.stream_name = "AudioInjector audio",
+		.cpu_dai_name	= "bcm2708-i2s.0",
+		.codec_dai_name = "wm8731-hifi",
+		.platform_name	= "bcm2835-i2s.0",
+		.codec_name = "wm8731.1-001a",
+		.ops = &snd_audioinjector_pi_soundcard_ops,
+		.init = audioinjector_pi_soundcard_dai_init,
+		.dai_fmt = SND_SOC_DAIFMT_CBM_CFM|SND_SOC_DAIFMT_I2S|SND_SOC_DAIFMT_NB_NF,
+	},
+};
+
+static const struct snd_soc_dapm_widget wm8731_dapm_widgets[] = {
+	SND_SOC_DAPM_HP("Headphone Jack", NULL),
+	SND_SOC_DAPM_SPK("Ext Spk", NULL),
+	SND_SOC_DAPM_LINE("Line In Jacks", NULL),
+	SND_SOC_DAPM_MIC("Microphone", NULL),
+};
+
+static const struct snd_soc_dapm_route audioinjector_audio_map[] = {
+	/* headphone connected to LHPOUT, RHPOUT */
+	{"Headphone Jack", NULL, "LHPOUT"},
+	{"Headphone Jack", NULL, "RHPOUT"},
+
+	/* speaker connected to LOUT, ROUT */
+	{"Ext Spk", NULL, "ROUT"},
+	{"Ext Spk", NULL, "LOUT"},
+
+	/* line inputs */
+	{"Line In Jacks", NULL, "Line Input"},
+
+	/* mic is connected to Mic Jack, with WM8731 Mic Bias */
+	{"Microphone", NULL, "Mic Bias"},
+};
+
+static struct snd_soc_card snd_soc_audioinjector = {
+	.name = "audioinjector-pi-soundcard",
+	.dai_link = audioinjector_pi_soundcard_dai,
+	.num_links = ARRAY_SIZE(audioinjector_pi_soundcard_dai),
+
+	.dapm_widgets = wm8731_dapm_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(wm8731_dapm_widgets),
+	.dapm_routes = audioinjector_audio_map,
+	.num_dapm_routes = ARRAY_SIZE(audioinjector_audio_map),
+};
+
+static int audioinjector_pi_soundcard_probe(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = &snd_soc_audioinjector;
+	int ret;
+	
+	card->dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct snd_soc_dai_link *dai = &audioinjector_pi_soundcard_dai[0];
+		struct device_node *i2s_node = of_parse_phandle(pdev->dev.of_node,
+								"i2s-controller", 0);
+
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		} else
+			if (!dai->cpu_of_node) {
+				dev_err(&pdev->dev, "Property 'i2s-controller' missing or invalid\n");
+				return -EINVAL;
+			}
+	}
+
+	if ((ret = snd_soc_register_card(card))) {
+		dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret);
+	}
+	return ret;
+}
+
+static int audioinjector_pi_soundcard_remove(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = platform_get_drvdata(pdev);
+	return snd_soc_unregister_card(card);
+
+}
+
+static const struct of_device_id audioinjector_pi_soundcard_of_match[] = {
+	{ .compatible = "ai,audioinjector-pi-soundcard", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, audioinjector_pi_soundcard_of_match);
+
+static struct platform_driver audioinjector_pi_soundcard_driver = {
+       .driver         = {
+		.name   = "audioinjector-stereo",
+		.owner  = THIS_MODULE,
+		.of_match_table = audioinjector_pi_soundcard_of_match,
+       },
+       .probe          = audioinjector_pi_soundcard_probe,
+       .remove         = audioinjector_pi_soundcard_remove,
+};
+
+module_platform_driver(audioinjector_pi_soundcard_driver);
+MODULE_AUTHOR("Matt Flax <flatmax@flatmax.org>");
+MODULE_DESCRIPTION("AudioInjector.net Pi Soundcard");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:audioinjector-pi-soundcard");
+
diff --git a/sound/soc/bcm/bcm2835-i2s.c b/sound/soc/bcm/bcm2835-i2s.c
index 6ba20498202e..d5f73a8ab893 100644
--- a/sound/soc/bcm/bcm2835-i2s.c
+++ b/sound/soc/bcm/bcm2835-i2s.c
@@ -31,6 +31,7 @@
  * General Public License for more details.
  */
 
+#include <linux/bitops.h>
 #include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/device.h>
@@ -99,6 +100,8 @@
 #define BCM2835_I2S_CHWID(v)		(v)
 #define BCM2835_I2S_CH1(v)		((v) << 16)
 #define BCM2835_I2S_CH2(v)		(v)
+#define BCM2835_I2S_CH1_POS(v)		BCM2835_I2S_CH1(BCM2835_I2S_CHPOS(v))
+#define BCM2835_I2S_CH2_POS(v)		BCM2835_I2S_CH2(BCM2835_I2S_CHPOS(v))
 
 #define BCM2835_I2S_TX_PANIC(v)	((v) << 24)
 #define BCM2835_I2S_RX_PANIC(v)	((v) << 16)
@@ -110,16 +113,24 @@
 #define BCM2835_I2S_INT_RXR		BIT(1)
 #define BCM2835_I2S_INT_TXW		BIT(0)
 
+/* Frame length register is 10 bit, maximum length 1024 */
+#define BCM2835_I2S_MAX_FRAME_LENGTH	1024
+
 /* General device struct */
 struct bcm2835_i2s_dev {
 	struct device				*dev;
 	struct snd_dmaengine_dai_dma_data	dma_data[2];
 	unsigned int				fmt;
-	unsigned int				bclk_ratio;
+	unsigned int				tdm_slots;
+	unsigned int				rx_mask;
+	unsigned int				tx_mask;
+	unsigned int				slot_width;
+	unsigned int				frame_length;
 
 	struct regmap				*i2s_regmap;
 	struct clk				*clk;
 	bool					clk_prepared;
+	int					clk_rate;
 };
 
 static void bcm2835_i2s_start_clock(struct bcm2835_i2s_dev *dev)
@@ -225,19 +236,120 @@ static int bcm2835_i2s_set_dai_bclk_ratio(struct snd_soc_dai *dai,
 				      unsigned int ratio)
 {
 	struct bcm2835_i2s_dev *dev = snd_soc_dai_get_drvdata(dai);
-	dev->bclk_ratio = ratio;
+
+	if (!ratio) {
+		dev->tdm_slots = 0;
+		return 0;
+	}
+
+	if (ratio > BCM2835_I2S_MAX_FRAME_LENGTH)
+		return -EINVAL;
+
+	dev->tdm_slots = 2;
+	dev->rx_mask = 0x03;
+	dev->tx_mask = 0x03;
+	dev->slot_width = ratio / 2;
+	dev->frame_length = ratio;
+
+	return 0;
+}
+
+static int bcm2835_i2s_set_dai_tdm_slot(struct snd_soc_dai *dai,
+	unsigned int tx_mask, unsigned int rx_mask,
+	int slots, int width)
+{
+	struct bcm2835_i2s_dev *dev = snd_soc_dai_get_drvdata(dai);
+
+	if (slots) {
+		if (slots < 0 || width < 0)
+			return -EINVAL;
+
+		/* Limit masks to available slots */
+		rx_mask &= GENMASK(slots - 1, 0);
+		tx_mask &= GENMASK(slots - 1, 0);
+
+		/*
+		 * The driver is limited to 2-channel setups.
+		 * Check that exactly 2 bits are set in the masks.
+		 */
+		if (hweight_long((unsigned long) rx_mask) != 2
+		    || hweight_long((unsigned long) tx_mask) != 2)
+			return -EINVAL;
+
+		if (slots * width > BCM2835_I2S_MAX_FRAME_LENGTH)
+			return -EINVAL;
+	}
+
+	dev->tdm_slots = slots;
+
+	dev->rx_mask = rx_mask;
+	dev->tx_mask = tx_mask;
+	dev->slot_width = width;
+	dev->frame_length = slots * width;
+
 	return 0;
 }
 
+/*
+ * Convert logical slot number into physical slot number.
+ *
+ * If odd_offset is 0 sequential number is identical to logical number.
+ * This is used for DSP modes with slot numbering 0 1 2 3 ...
+ *
+ * Otherwise odd_offset defines the physical offset for odd numbered
+ * slots. This is used for I2S and left/right justified modes to
+ * translate from logical slot numbers 0 1 2 3 ... into physical slot
+ * numbers 0 2 ... 3 4 ...
+ */
+static int bcm2835_i2s_convert_slot(unsigned int slot, unsigned int odd_offset)
+{
+	if (!odd_offset)
+		return slot;
+
+	if (slot & 1)
+		return (slot >> 1) + odd_offset;
+
+	return slot >> 1;
+}
+
+/*
+ * Calculate channel position from mask and slot width.
+ *
+ * Mask must contain exactly 2 set bits.
+ * Lowest set bit is channel 1 position, highest set bit channel 2.
+ * The constant offset is added to both channel positions.
+ *
+ * If odd_offset is > 0 slot positions are translated to
+ * I2S-style TDM slot numbering ( 0 2 ... 3 4 ...) with odd
+ * logical slot numbers starting at physical slot odd_offset.
+ */
+static void bcm2835_i2s_calc_channel_pos(
+	unsigned int *ch1_pos, unsigned int *ch2_pos,
+	unsigned int mask, unsigned int width,
+	unsigned int bit_offset, unsigned int odd_offset)
+{
+	*ch1_pos = bcm2835_i2s_convert_slot((ffs(mask) - 1), odd_offset)
+			* width + bit_offset;
+	*ch2_pos = bcm2835_i2s_convert_slot((fls(mask) - 1), odd_offset)
+			* width + bit_offset;
+}
+
 static int bcm2835_i2s_hw_params(struct snd_pcm_substream *substream,
 				 struct snd_pcm_hw_params *params,
 				 struct snd_soc_dai *dai)
 {
 	struct bcm2835_i2s_dev *dev = snd_soc_dai_get_drvdata(dai);
-	unsigned int sampling_rate = params_rate(params);
-	unsigned int data_length, data_delay, bclk_ratio;
-	unsigned int ch1pos, ch2pos, mode, format;
+	unsigned int data_length, data_delay, framesync_length;
+	unsigned int slots, slot_width, odd_slot_offset;
+	int frame_length, bclk_rate;
+	unsigned int rx_mask, tx_mask;
+	unsigned int rx_ch1_pos, rx_ch2_pos, tx_ch1_pos, tx_ch2_pos;
+	unsigned int mode, format;
+	bool bit_clock_master = false;
+	bool frame_sync_master = false;
+	bool frame_start_falling_edge = false;
 	uint32_t csreg;
+	int ret = 0;
 
 	/*
 	 * If a stream is already enabled,
@@ -248,42 +360,79 @@ static int bcm2835_i2s_hw_params(struct snd_pcm_substream *substream,
 	if (csreg & (BCM2835_I2S_TXON | BCM2835_I2S_RXON))
 		return 0;
 
-	/*
-	 * Adjust the data length according to the format.
-	 * We prefill the half frame length with an integer
-	 * divider of 2400 as explained at the clock settings.
-	 * Maybe it is overwritten there, if the Integer mode
-	 * does not apply.
-	 */
-	switch (params_format(params)) {
-	case SNDRV_PCM_FORMAT_S16_LE:
-		data_length = 16;
-		break;
-	case SNDRV_PCM_FORMAT_S24_LE:
-		data_length = 24;
+	data_length = params_width(params);
+	data_delay = 0;
+	odd_slot_offset = 0;
+	mode = 0;
+
+	if (dev->tdm_slots) {
+		slots = dev->tdm_slots;
+		slot_width = dev->slot_width;
+		frame_length = dev->frame_length;
+		rx_mask = dev->rx_mask;
+		tx_mask = dev->tx_mask;
+		bclk_rate = dev->frame_length * params_rate(params);
+	} else {
+		slots = 2;
+		slot_width = params_width(params);
+		rx_mask = 0x03;
+		tx_mask = 0x03;
+
+		frame_length = snd_soc_params_to_frame_size(params);
+		if (frame_length < 0)
+			return frame_length;
+
+		bclk_rate = snd_soc_params_to_bclk(params);
+		if (bclk_rate < 0)
+			return bclk_rate;
+	}
+
+	/* Check if data fits into slots */
+	if (data_length > slot_width)
+		return -EINVAL;
+
+	/* Check if CPU is bit clock master */
+	switch (dev->fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+	case SND_SOC_DAIFMT_CBS_CFS:
+	case SND_SOC_DAIFMT_CBS_CFM:
+		bit_clock_master = true;
 		break;
-	case SNDRV_PCM_FORMAT_S32_LE:
-		data_length = 32;
+	case SND_SOC_DAIFMT_CBM_CFS:
+	case SND_SOC_DAIFMT_CBM_CFM:
+		bit_clock_master = false;
 		break;
 	default:
 		return -EINVAL;
 	}
 
-	/* If bclk_ratio already set, use that one. */
-	if (dev->bclk_ratio)
-		bclk_ratio = dev->bclk_ratio;
-	else
-		/* otherwise calculate a fitting block ratio */
-		bclk_ratio = 2 * data_length;
-
-	/* Clock should only be set up here if CPU is clock master */
+	/* Check if CPU is frame sync master */
 	switch (dev->fmt & SND_SOC_DAIFMT_MASTER_MASK) {
 	case SND_SOC_DAIFMT_CBS_CFS:
+	case SND_SOC_DAIFMT_CBM_CFS:
+		frame_sync_master = true;
+		break;
 	case SND_SOC_DAIFMT_CBS_CFM:
-		clk_set_rate(dev->clk, sampling_rate * bclk_ratio);
+	case SND_SOC_DAIFMT_CBM_CFM:
+		frame_sync_master = false;
 		break;
 	default:
-		break;
+		return -EINVAL;
+	}
+
+	/* Clock should only be set up here if CPU is clock master */
+	if (bit_clock_master &&
+	    (!dev->clk_prepared || dev->clk_rate != bclk_rate)) {
+		if (dev->clk_prepared)
+			bcm2835_i2s_stop_clock(dev);
+
+		if (dev->clk_rate != bclk_rate) {
+			ret = clk_set_rate(dev->clk, bclk_rate);
+			if (ret)
+				return ret;
+			dev->clk_rate = bclk_rate;
+		}
+
+		bcm2835_i2s_start_clock(dev);
 	}
 
 	/* Setup the frame format */
@@ -294,43 +443,94 @@ static int bcm2835_i2s_hw_params(struct snd_pcm_substream *substream,
 
 	format |= BCM2835_I2S_CHWID((data_length-8)&0xf);
 
+	/* CH2 format is the same as for CH1 */
+	format = BCM2835_I2S_CH1(format) | BCM2835_I2S_CH2(format);
+
 	switch (dev->fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
 	case SND_SOC_DAIFMT_I2S:
-		data_delay = 1;
-		break;
-	default:
+		/* I2S mode needs an even number of slots */
+		if (slots & 1)
+			return -EINVAL;
+
 		/*
-		 * TODO
-		 * Others are possible but are not implemented at the moment.
+		 * Use I2S-style logical slot numbering: even slots
+		 * are in first half of frame, odd slots in second half.
 		 */
-		dev_err(dev->dev, "%s:bad format\n", __func__);
-		return -EINVAL;
-	}
+		odd_slot_offset = slots >> 1;
 
-	ch1pos = data_delay;
-	ch2pos = bclk_ratio / 2 + data_delay;
+		/* MSB starts one cycle after frame start */
+		data_delay = 1;
 
-	switch (params_channels(params)) {
-	case 2:
-		format = BCM2835_I2S_CH1(format) | BCM2835_I2S_CH2(format);
-		format |= BCM2835_I2S_CH1(BCM2835_I2S_CHPOS(ch1pos));
-		format |= BCM2835_I2S_CH2(BCM2835_I2S_CHPOS(ch2pos));
+		/* Setup frame sync signal for 50% duty cycle */
+		framesync_length = frame_length / 2;
+		frame_start_falling_edge = true;
+		break;
+	case SND_SOC_DAIFMT_LEFT_J:
+		if (slots & 1)
+			return -EINVAL;
+
+		odd_slot_offset = slots >> 1;
+		data_delay = 0;
+		framesync_length = frame_length / 2;
+		frame_start_falling_edge = false;
+		break;
+	case SND_SOC_DAIFMT_RIGHT_J:
+		if (slots & 1)
+			return -EINVAL;
+
+		/* Odd frame lengths aren't supported */
+		if (frame_length & 1)
+			return -EINVAL;
+
+		odd_slot_offset = slots >> 1;
+		data_delay = slot_width - data_length;
+		framesync_length = frame_length / 2;
+		frame_start_falling_edge = false;
+		break;
+	case SND_SOC_DAIFMT_DSP_A:
+		data_delay = 1;
+		framesync_length = 1;
+		frame_start_falling_edge = false;
+		break;
+	case SND_SOC_DAIFMT_DSP_B:
+		data_delay = 0;
+		framesync_length = 1;
+		frame_start_falling_edge = false;
 		break;
 	default:
 		return -EINVAL;
 	}
 
+	bcm2835_i2s_calc_channel_pos(&rx_ch1_pos, &rx_ch2_pos,
+		rx_mask, slot_width, data_delay, odd_slot_offset);
+	bcm2835_i2s_calc_channel_pos(&tx_ch1_pos, &tx_ch2_pos,
+		tx_mask, slot_width, data_delay, odd_slot_offset);
+
+	/*
+	 * Transmitting data immediately after frame start, eg
+	 * in left-justified or DSP mode A, only works stable
+	 * if bcm2835 is the frame clock master.
+	 */
+	if ((!rx_ch1_pos || !tx_ch1_pos) && !frame_sync_master)
+		dev_warn(dev->dev,
+			"Unstable slave config detected, L/R may be swapped");
+
 	/*
 	 * Set format for both streams.
 	 * We cannot set another frame length
 	 * (and therefore word length) anyway,
 	 * so the format will be the same.
 	 */
-	regmap_write(dev->i2s_regmap, BCM2835_I2S_RXC_A_REG, format);
-	regmap_write(dev->i2s_regmap, BCM2835_I2S_TXC_A_REG, format);
+	regmap_write(dev->i2s_regmap, BCM2835_I2S_RXC_A_REG, 
+		  format
+		| BCM2835_I2S_CH1_POS(rx_ch1_pos)
+		| BCM2835_I2S_CH2_POS(rx_ch2_pos));
+	regmap_write(dev->i2s_regmap, BCM2835_I2S_TXC_A_REG, 
+		  format
+		| BCM2835_I2S_CH1_POS(tx_ch1_pos)
+		| BCM2835_I2S_CH2_POS(tx_ch2_pos));
 
 	/* Setup the I2S mode */
-	mode = 0;
 
 	if (data_length <= 16) {
 		/*
@@ -342,65 +542,41 @@ static int bcm2835_i2s_hw_params(struct snd_pcm_substream *substream,
 		mode |= BCM2835_I2S_FTXP | BCM2835_I2S_FRXP;
 	}
 
-	mode |= BCM2835_I2S_FLEN(bclk_ratio - 1);
-	mode |= BCM2835_I2S_FSLEN(bclk_ratio / 2);
+	mode |= BCM2835_I2S_FLEN(frame_length - 1);
+	mode |= BCM2835_I2S_FSLEN(framesync_length);
 
-	/* Master or slave? */
-	switch (dev->fmt & SND_SOC_DAIFMT_MASTER_MASK) {
-	case SND_SOC_DAIFMT_CBS_CFS:
-		/* CPU is master */
-		break;
-	case SND_SOC_DAIFMT_CBM_CFS:
-		/*
-		 * CODEC is bit clock master
-		 * CPU is frame master
-		 */
+	/* CLKM selects bcm2835 clock slave mode */
+	if (!bit_clock_master)
 		mode |= BCM2835_I2S_CLKM;
-		break;
-	case SND_SOC_DAIFMT_CBS_CFM:
-		/*
-		 * CODEC is frame master
-		 * CPU is bit clock master
-		 */
+
+	/* FSM selects bcm2835 frame sync slave mode */
+	if (!frame_sync_master)
 		mode |= BCM2835_I2S_FSM;
+
+	/* CLKI selects normal clocking mode, sampling on rising edge */
+        switch (dev->fmt & SND_SOC_DAIFMT_INV_MASK) {
+	case SND_SOC_DAIFMT_NB_NF:
+	case SND_SOC_DAIFMT_NB_IF:
+		mode |= BCM2835_I2S_CLKI;
 		break;
-	case SND_SOC_DAIFMT_CBM_CFM:
-		/* CODEC is master */
-		mode |= BCM2835_I2S_CLKM;
-		mode |= BCM2835_I2S_FSM;
+	case SND_SOC_DAIFMT_IB_NF:
+	case SND_SOC_DAIFMT_IB_IF:
 		break;
 	default:
-		dev_err(dev->dev, "%s:bad master\n", __func__);
 		return -EINVAL;
 	}
 
-	/*
-	 * Invert clocks?
-	 *
-	 * The BCM approach seems to be inverted to the classical I2S approach.
-	 */
+	/* FSI selects frame start on falling edge */
 	switch (dev->fmt & SND_SOC_DAIFMT_INV_MASK) {
 	case SND_SOC_DAIFMT_NB_NF:
-		/* None. Therefore, both for BCM */
-		mode |= BCM2835_I2S_CLKI;
-		mode |= BCM2835_I2S_FSI;
-		break;
-	case SND_SOC_DAIFMT_IB_IF:
-		/* Both. Therefore, none for BCM */
+	case SND_SOC_DAIFMT_IB_NF:
+		if (frame_start_falling_edge)
+			mode |= BCM2835_I2S_FSI;
 		break;
 	case SND_SOC_DAIFMT_NB_IF:
-		/*
-		 * Invert only frame sync. Therefore,
-		 * invert only bit clock for BCM
-		 */
-		mode |= BCM2835_I2S_CLKI;
-		break;
-	case SND_SOC_DAIFMT_IB_NF:
-		/*
-		 * Invert only bit clock. Therefore,
-		 * invert only frame sync for BCM
-		 */
-		mode |= BCM2835_I2S_FSI;
+	case SND_SOC_DAIFMT_IB_IF:
+		if (!frame_start_falling_edge)
+			mode |= BCM2835_I2S_FSI;
 		break;
 	default:
 		return -EINVAL;
@@ -423,7 +599,27 @@ static int bcm2835_i2s_hw_params(struct snd_pcm_substream *substream,
 	/* Clear FIFOs */
 	bcm2835_i2s_clear_fifos(dev, true, true);
 
-	return 0;
+	dev_dbg(dev->dev,
+		"slots: %d width: %d rx mask: 0x%02x tx_mask: 0x%02x\n",
+		slots, slot_width, rx_mask, tx_mask);
+
+	dev_dbg(dev->dev, "frame len: %d sync len: %d data len: %d\n",
+		frame_length, framesync_length, data_length);
+
+	dev_dbg(dev->dev, "rx pos: %d,%d tx pos: %d,%d\n",
+		rx_ch1_pos, rx_ch2_pos, tx_ch1_pos, tx_ch2_pos);
+
+	dev_dbg(dev->dev, "sampling rate: %d bclk rate: %d\n",
+		params_rate(params), bclk_rate);
+
+	dev_dbg(dev->dev, "CLKM: %d CLKI: %d FSM: %d FSI: %d frame start: %s edge\n",
+		!!(mode & BCM2835_I2S_CLKM),
+		!!(mode & BCM2835_I2S_CLKI),
+		!!(mode & BCM2835_I2S_FSM),
+		!!(mode & BCM2835_I2S_FSI),
+		(mode & BCM2835_I2S_FSI) ? "falling" : "rising");
+
+	return ret;
 }
 
 static int bcm2835_i2s_prepare(struct snd_pcm_substream *substream,
@@ -432,8 +628,6 @@ static int bcm2835_i2s_prepare(struct snd_pcm_substream *substream,
 	struct bcm2835_i2s_dev *dev = snd_soc_dai_get_drvdata(dai);
 	uint32_t cs_reg;
 
-	bcm2835_i2s_start_clock(dev);
-
 	/*
 	 * Clear both FIFOs if the one that should be started
 	 * is not empty at the moment. This should only happen
@@ -559,6 +753,7 @@ static const struct snd_soc_dai_ops bcm2835_i2s_dai_ops = {
 	.hw_params	= bcm2835_i2s_hw_params,
 	.set_fmt	= bcm2835_i2s_set_dai_fmt,
 	.set_bclk_ratio	= bcm2835_i2s_set_dai_bclk_ratio,
+	.set_tdm_slot	= bcm2835_i2s_set_dai_tdm_slot,
 };
 
 static int bcm2835_i2s_dai_probe(struct snd_soc_dai *dai)
@@ -578,7 +773,9 @@ static struct snd_soc_dai_driver bcm2835_i2s_dai = {
 	.playback = {
 		.channels_min = 2,
 		.channels_max = 2,
-		.rates =	SNDRV_PCM_RATE_8000_192000,
+		.rates =	SNDRV_PCM_RATE_CONTINUOUS,
+		.rate_min =	8000,
+		.rate_max =	384000,
 		.formats =	SNDRV_PCM_FMTBIT_S16_LE
 				| SNDRV_PCM_FMTBIT_S24_LE
 				| SNDRV_PCM_FMTBIT_S32_LE
@@ -586,13 +783,16 @@ static struct snd_soc_dai_driver bcm2835_i2s_dai = {
 	.capture = {
 		.channels_min = 2,
 		.channels_max = 2,
-		.rates =	SNDRV_PCM_RATE_8000_192000,
+		.rates =	SNDRV_PCM_RATE_CONTINUOUS,
+		.rate_min =	8000,
+		.rate_max =	384000,
 		.formats =	SNDRV_PCM_FMTBIT_S16_LE
 				| SNDRV_PCM_FMTBIT_S24_LE
 				| SNDRV_PCM_FMTBIT_S32_LE
 		},
 	.ops = &bcm2835_i2s_dai_ops,
-	.symmetric_rates = 1
+	.symmetric_rates = 1,
+	.symmetric_samplebits = 1,
 };
 
 static bool bcm2835_i2s_volatile_reg(struct device *dev, unsigned int reg)
@@ -699,9 +899,6 @@ static int bcm2835_i2s_probe(struct platform_device *pdev)
 	dev->dma_data[SNDRV_PCM_STREAM_CAPTURE].flags =
 		SND_DMAENGINE_PCM_DAI_FLAG_PACK;
 
-	/* BCLK ratio - use default */
-	dev->bclk_ratio = 0;
-
 	/* Store the pdev */
 	dev->dev = &pdev->dev;
 	dev_set_drvdata(&pdev->dev, dev);
diff --git a/sound/soc/bcm/digidac1-soundcard.c b/sound/soc/bcm/digidac1-soundcard.c
new file mode 100644
index 000000000000..f200688bb4ae
--- /dev/null
+++ b/sound/soc/bcm/digidac1-soundcard.c
@@ -0,0 +1,422 @@
+/*
+ * ASoC Driver for RRA DigiDAC1
+ * Copyright 2016
+ * Author: José M. Tasende <vintage@redrocksaudio.es>
+ * based on the HifiBerry DAC driver by Florian Meier <florian.meier@koalo.de>
+ * and the Wolfson card driver by Nikesh Oswal, <Nikesh.Oswal@wolfsonmicro.com>
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/i2c.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+#include <sound/soc-dapm.h>
+#include <sound/tlv.h>
+#include <linux/regulator/consumer.h>
+
+#include "../codecs/wm8804.h"
+#include "../codecs/wm8741.h"
+
+#define WM8741_NUM_SUPPLIES 2
+
+/* codec private data */
+struct wm8741_priv {
+	struct wm8741_platform_data pdata;
+	struct regmap *regmap;
+	struct regulator_bulk_data supplies[WM8741_NUM_SUPPLIES];
+	unsigned int sysclk;
+	const struct snd_pcm_hw_constraint_list *sysclk_constraints;
+};
+
+static int samplerate = 44100;
+
+/* New Alsa Controls not exposed by original wm8741 codec driver	*/
+/* in actual driver the att. adjustment is wrong because		*/
+/* this DAC has a coarse attenuation register with 4dB steps		*/
+/* and a fine level register with 0.125dB steps				*/
+/* each register has 32 steps so combining both we have	1024 steps	*/
+/* of 0.125 dB.								*/
+/* The original level controls from driver are removed at startup	*/
+/* and replaced by the corrected ones.					*/
+/* The same wm8741 driver can be used for wm8741 and wm8742 devices	*/
+
+static const DECLARE_TLV_DB_SCALE(dac_tlv_fine, 0, 13, 0);
+static const DECLARE_TLV_DB_SCALE(dac_tlv_coarse, -12700, 400, 1);
+static const char *w8741_dither[4] = {"Off", "RPDF", "TPDF", "HPDF"};
+static const char *w8741_filter[5] = {
+		"Type 1", "Type 2", "Type 3", "Type 4", "Type 5"};
+static const char *w8741_switch[2] = {"Off", "On"};
+static const struct soc_enum w8741_enum[] = {
+SOC_ENUM_SINGLE(WM8741_MODE_CONTROL_2, 0, 4, w8741_dither),/* dithering type */
+SOC_ENUM_SINGLE(WM8741_FILTER_CONTROL, 0, 5, w8741_filter),/* filter type */
+SOC_ENUM_SINGLE(WM8741_FORMAT_CONTROL, 6, 2, w8741_switch),/* phase invert */
+SOC_ENUM_SINGLE(WM8741_VOLUME_CONTROL, 0, 2, w8741_switch),/* volume ramp */
+SOC_ENUM_SINGLE(WM8741_VOLUME_CONTROL, 3, 2, w8741_switch),/* soft mute */
+};
+
+static const struct snd_kcontrol_new w8741_snd_controls_stereo[] = {
+SOC_DOUBLE_R_TLV("DAC Fine Playback Volume", WM8741_DACLLSB_ATTENUATION,
+		WM8741_DACRLSB_ATTENUATION, 0, 31, 1, dac_tlv_fine),
+SOC_DOUBLE_R_TLV("Digital Playback Volume", WM8741_DACLMSB_ATTENUATION,
+		WM8741_DACRMSB_ATTENUATION, 0, 31, 1, dac_tlv_coarse),
+SOC_ENUM("DAC Dither", w8741_enum[0]),
+SOC_ENUM("DAC Digital Filter", w8741_enum[1]),
+SOC_ENUM("DAC Phase Invert", w8741_enum[2]),
+SOC_ENUM("DAC Volume Ramp", w8741_enum[3]),
+SOC_ENUM("DAC Soft Mute", w8741_enum[4]),
+};
+
+static const struct snd_kcontrol_new w8741_snd_controls_mono_left[] = {
+SOC_SINGLE_TLV("DAC Fine Playback Volume", WM8741_DACLLSB_ATTENUATION,
+		0, 31, 0, dac_tlv_fine),
+SOC_SINGLE_TLV("Digital Playback Volume", WM8741_DACLMSB_ATTENUATION,
+		0, 31, 1, dac_tlv_coarse),
+SOC_ENUM("DAC Dither", w8741_enum[0]),
+SOC_ENUM("DAC Digital Filter", w8741_enum[1]),
+SOC_ENUM("DAC Phase Invert", w8741_enum[2]),
+SOC_ENUM("DAC Volume Ramp", w8741_enum[3]),
+SOC_ENUM("DAC Soft Mute", w8741_enum[4]),
+};
+
+static const struct snd_kcontrol_new w8741_snd_controls_mono_right[] = {
+SOC_SINGLE_TLV("DAC Fine Playback Volume", WM8741_DACRLSB_ATTENUATION,
+	0, 31, 0, dac_tlv_fine),
+SOC_SINGLE_TLV("Digital Playback Volume", WM8741_DACRMSB_ATTENUATION,
+	0, 31, 1, dac_tlv_coarse),
+SOC_ENUM("DAC Dither", w8741_enum[0]),
+SOC_ENUM("DAC Digital Filter", w8741_enum[1]),
+SOC_ENUM("DAC Phase Invert", w8741_enum[2]),
+SOC_ENUM("DAC Volume Ramp", w8741_enum[3]),
+SOC_ENUM("DAC Soft Mute", w8741_enum[4]),
+};
+
+static int w8741_add_controls(struct snd_soc_codec *codec)
+{
+	struct wm8741_priv *wm8741 = snd_soc_codec_get_drvdata(codec);
+
+	switch (wm8741->pdata.diff_mode) {
+	case WM8741_DIFF_MODE_STEREO:
+	case WM8741_DIFF_MODE_STEREO_REVERSED:
+		snd_soc_add_codec_controls(codec,
+				w8741_snd_controls_stereo,
+				ARRAY_SIZE(w8741_snd_controls_stereo));
+		break;
+	case WM8741_DIFF_MODE_MONO_LEFT:
+		snd_soc_add_codec_controls(codec,
+				w8741_snd_controls_mono_left,
+				ARRAY_SIZE(w8741_snd_controls_mono_left));
+		break;
+	case WM8741_DIFF_MODE_MONO_RIGHT:
+		snd_soc_add_codec_controls(codec,
+				w8741_snd_controls_mono_right,
+				ARRAY_SIZE(w8741_snd_controls_mono_right));
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int digidac1_soundcard_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_codec *codec = rtd->codec;
+	struct snd_soc_card *card = rtd->card;
+	struct snd_soc_pcm_runtime *wm8741_rtd;
+	struct snd_soc_codec *wm8741_codec;
+	struct snd_card *sound_card = card->snd_card;
+	struct snd_kcontrol *kctl;
+	int ret;
+
+	wm8741_rtd = snd_soc_get_pcm_runtime(card, card->dai_link[1].name);
+	if (!wm8741_rtd) {
+		dev_warn(card->dev, "digidac1_soundcard_init: couldn't get wm8741 rtd\n");
+		return -EFAULT;
+	}
+	wm8741_codec = wm8741_rtd->codec;
+	ret = w8741_add_controls(wm8741_codec);
+	if (ret < 0)
+		dev_warn(card->dev, "Failed to add new wm8741 controls: %d\n",
+		ret);
+
+	/* enable TX output */
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x4, 0x0);
+
+	kctl = snd_soc_card_get_kcontrol(card,
+		"Playback Volume");
+	if (kctl) {
+		kctl->vd[0].access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
+		snd_ctl_remove(sound_card, kctl);
+		}
+	kctl = snd_soc_card_get_kcontrol(card,
+		"Fine Playback Volume");
+	if (kctl) {
+		kctl->vd[0].access = SNDRV_CTL_ELEM_ACCESS_READWRITE;
+		snd_ctl_remove(sound_card, kctl);
+		}
+	return 0;
+}
+
+static int digidac1_soundcard_startup(struct snd_pcm_substream *substream)
+{
+	/* turn on wm8804 digital output */
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_codec *codec = rtd->codec;
+	struct snd_soc_card *card = rtd->card;
+	struct snd_soc_pcm_runtime *wm8741_rtd;
+	struct snd_soc_codec *wm8741_codec;
+
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x3c, 0x00);
+	wm8741_rtd = snd_soc_get_pcm_runtime(card, card->dai_link[1].name);
+	if (!wm8741_rtd) {
+		dev_warn(card->dev, "digidac1_soundcard_startup: couldn't get WM8741 rtd\n");
+		return -EFAULT;
+	}
+	wm8741_codec = wm8741_rtd->codec;
+
+	/* latch wm8741 level */
+	snd_soc_update_bits(wm8741_codec, WM8741_DACLLSB_ATTENUATION,
+		WM8741_UPDATELL, WM8741_UPDATELL);
+	snd_soc_update_bits(wm8741_codec, WM8741_DACLMSB_ATTENUATION,
+		WM8741_UPDATELM, WM8741_UPDATELM);
+	snd_soc_update_bits(wm8741_codec, WM8741_DACRLSB_ATTENUATION,
+		WM8741_UPDATERL, WM8741_UPDATERL);
+	snd_soc_update_bits(wm8741_codec, WM8741_DACRMSB_ATTENUATION,
+		WM8741_UPDATERM, WM8741_UPDATERM);
+
+	return 0;
+}
+
+static void digidac1_soundcard_shutdown(struct snd_pcm_substream *substream)
+{
+	/* turn off wm8804 digital output */
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_codec *codec = rtd->codec;
+
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x3c, 0x3c);
+}
+
+static int digidac1_soundcard_hw_params(struct snd_pcm_substream *substream,
+				       struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+	struct snd_soc_codec *codec = rtd->codec;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+	struct snd_soc_card *card = rtd->card;
+	struct snd_soc_pcm_runtime *wm8741_rtd;
+	struct snd_soc_codec *wm8741_codec;
+
+	int sysclk = 27000000;
+	long mclk_freq = 0;
+	int mclk_div = 1;
+	int sampling_freq = 1;
+	int ret;
+
+	wm8741_rtd = snd_soc_get_pcm_runtime(card, card->dai_link[1].name);
+	if (!wm8741_rtd) {
+		dev_warn(card->dev, "digidac1_soundcard_hw_params: couldn't get WM8741 rtd\n");
+		return -EFAULT;
+	}
+	wm8741_codec = wm8741_rtd->codec;
+	samplerate = params_rate(params);
+
+	if (samplerate <= 96000) {
+		mclk_freq = samplerate*256;
+		mclk_div = WM8804_MCLKDIV_256FS;
+	} else {
+		mclk_freq = samplerate*128;
+		mclk_div = WM8804_MCLKDIV_128FS;
+		}
+
+	switch (samplerate) {
+	case 32000:
+		sampling_freq = 0x03;
+		break;
+	case 44100:
+		sampling_freq = 0x00;
+		break;
+	case 48000:
+		sampling_freq = 0x02;
+		break;
+	case 88200:
+		sampling_freq = 0x08;
+		break;
+	case 96000:
+		sampling_freq = 0x0a;
+		break;
+	case 176400:
+		sampling_freq = 0x0c;
+		break;
+	case 192000:
+		sampling_freq = 0x0e;
+		break;
+	default:
+		dev_err(codec->dev,
+		"Failed to set WM8804 SYSCLK, unsupported samplerate %d\n",
+		samplerate);
+	}
+
+	snd_soc_dai_set_clkdiv(codec_dai, WM8804_MCLK_DIV, mclk_div);
+	snd_soc_dai_set_pll(codec_dai, 0, 0, sysclk, mclk_freq);
+
+	ret = snd_soc_dai_set_sysclk(codec_dai, WM8804_TX_CLKSRC_PLL,
+		sysclk, SND_SOC_CLOCK_OUT);
+	if (ret < 0) {
+		dev_err(codec->dev,
+		"Failed to set WM8804 SYSCLK: %d\n", ret);
+		return ret;
+	}
+	/* Enable wm8804 TX output */
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x4, 0x0);
+
+	/* wm8804 Power on */
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x9, 0);
+
+	/* wm8804 set sampling frequency status bits */
+	snd_soc_update_bits(codec, WM8804_SPDTX4, 0x0f, sampling_freq);
+
+	/* Now update wm8741 registers for the correct oversampling */
+	if (samplerate <= 48000)
+		snd_soc_update_bits(wm8741_codec, WM8741_MODE_CONTROL_1,
+		 WM8741_OSR_MASK, 0x00);
+	else if (samplerate <= 96000)
+		snd_soc_update_bits(wm8741_codec, WM8741_MODE_CONTROL_1,
+		 WM8741_OSR_MASK, 0x20);
+	else
+		snd_soc_update_bits(wm8741_codec, WM8741_MODE_CONTROL_1,
+		 WM8741_OSR_MASK, 0x40);
+
+	/* wm8741 bit size */
+	switch (params_width(params)) {
+	case 16:
+		snd_soc_update_bits(wm8741_codec, WM8741_FORMAT_CONTROL,
+		 WM8741_IWL_MASK, 0x00);
+		break;
+	case 20:
+		snd_soc_update_bits(wm8741_codec, WM8741_FORMAT_CONTROL,
+		 WM8741_IWL_MASK, 0x01);
+		break;
+	case 24:
+		snd_soc_update_bits(wm8741_codec, WM8741_FORMAT_CONTROL,
+		 WM8741_IWL_MASK, 0x02);
+		break;
+	case 32:
+		snd_soc_update_bits(wm8741_codec, WM8741_FORMAT_CONTROL,
+		 WM8741_IWL_MASK, 0x03);
+		break;
+	default:
+		dev_dbg(codec->dev, "wm8741_hw_params:    Unsupported bit size param = %d",
+			params_width(params));
+		return -EINVAL;
+	}
+
+	return snd_soc_dai_set_bclk_ratio(cpu_dai, 64);
+}
+/* machine stream operations */
+static struct snd_soc_ops digidac1_soundcard_ops = {
+	.hw_params	= digidac1_soundcard_hw_params,
+	.startup	= digidac1_soundcard_startup,
+	.shutdown	= digidac1_soundcard_shutdown,
+};
+
+static struct snd_soc_dai_link digidac1_soundcard_dai[] = {
+	{
+	.name		= "RRA DigiDAC1",
+	.stream_name	= "RRA DigiDAC1 HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "wm8804-spdif",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "wm8804.1-003b",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBM_CFM,
+	.ops		= &digidac1_soundcard_ops,
+	.init		= digidac1_soundcard_init,
+	},
+	{
+	.name		= "RRA DigiDAC11",
+	.stream_name	= "RRA DigiDAC11 HiFi",
+	.cpu_dai_name	= "wm8804-spdif",
+	.codec_dai_name	= "wm8741",
+	.codec_name	= "wm8741.1-001a",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S
+			| SND_SOC_DAIFMT_NB_NF
+			| SND_SOC_DAIFMT_CBS_CFS,
+	},
+};
+
+/* audio machine driver */
+static struct snd_soc_card digidac1_soundcard = {
+	.name		= "digidac1-soundcard",
+	.owner		= THIS_MODULE,
+	.dai_link	= digidac1_soundcard_dai,
+	.num_links	= ARRAY_SIZE(digidac1_soundcard_dai),
+};
+
+static int digidac1_soundcard_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	digidac1_soundcard.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai = &digidac1_soundcard_dai[0];
+
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+					"i2s-controller", 0);
+
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+	}
+
+	ret = snd_soc_register_card(&digidac1_soundcard);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
+			ret);
+
+	return ret;
+}
+
+static int digidac1_soundcard_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&digidac1_soundcard);
+}
+
+static const struct of_device_id digidac1_soundcard_of_match[] = {
+	{ .compatible = "rra,digidac1-soundcard", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, digidac1_soundcard_of_match);
+
+static struct platform_driver digidac1_soundcard_driver = {
+	.driver = {
+			.name		= "digidac1-audio",
+			.owner		= THIS_MODULE,
+			.of_match_table	= digidac1_soundcard_of_match,
+	},
+	.probe		= digidac1_soundcard_probe,
+	.remove		= digidac1_soundcard_remove,
+};
+
+module_platform_driver(digidac1_soundcard_driver);
+
+MODULE_AUTHOR("José M. Tasende <vintage@redrocksaudio.es>");
+MODULE_DESCRIPTION("ASoC Driver for RRA DigiDAC1");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/dionaudio_loco-v2.c b/sound/soc/bcm/dionaudio_loco-v2.c
new file mode 100644
index 000000000000..8f522deb2a48
--- /dev/null
+++ b/sound/soc/bcm/dionaudio_loco-v2.c
@@ -0,0 +1,121 @@
+/*
+ * ASoC Driver for Dion Audio LOCO-V2 DAC-AMP
+ *
+ * Author:      Miquel Blauw <info@dionaudio.nl>
+ *              Copyright 2017
+ *
+ * Based on the software of the RPi-DAC writen by Florian Meier
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+static bool digital_gain_0db_limit = true;
+
+static int snd_rpi_dionaudio_loco_v2_init(struct snd_soc_pcm_runtime *rtd)
+{
+	if (digital_gain_0db_limit) {
+		int ret;
+		struct snd_soc_card *card = rtd->card;
+
+		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
+	}
+
+	return 0;
+}
+
+static struct snd_soc_dai_link snd_rpi_dionaudio_loco_v2_dai[] = {
+{
+	.name		= "DionAudio LOCO-V2",
+	.stream_name	= "DionAudio LOCO-V2 DAC-AMP",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "pcm512x-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "pcm512x.1-004d",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+			  SND_SOC_DAIFMT_CBS_CFS,
+	.init		= snd_rpi_dionaudio_loco_v2_init,
+},};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_dionaudio_loco_v2 = {
+	.name         = "Dion Audio LOCO-V2",
+	.dai_link     = snd_rpi_dionaudio_loco_v2_dai,
+	.num_links    = ARRAY_SIZE(snd_rpi_dionaudio_loco_v2_dai),
+};
+
+static int snd_rpi_dionaudio_loco_v2_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_rpi_dionaudio_loco_v2.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai =
+					&snd_rpi_dionaudio_loco_v2_dai[0];
+
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+					    "i2s-controller", 0);
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+
+		digital_gain_0db_limit = !of_property_read_bool(
+			pdev->dev.of_node, "dionaudio,24db_digital_gain");
+	}
+
+	ret = snd_soc_register_card(&snd_rpi_dionaudio_loco_v2);
+	if (ret)
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
+			ret);
+
+	return ret;
+}
+
+static int snd_rpi_dionaudio_loco_v2_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&snd_rpi_dionaudio_loco_v2);
+}
+
+static const struct of_device_id dionaudio_of_match[] = {
+	{ .compatible = "dionaudio,dionaudio-loco-v2", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, dionaudio_of_match);
+
+static struct platform_driver snd_rpi_dionaudio_loco_v2_driver = {
+	.driver = {
+		.name   = "snd-rpi-dionaudio-loco-v2",
+		.owner  = THIS_MODULE,
+		.of_match_table = dionaudio_of_match,
+	},
+	.probe          = snd_rpi_dionaudio_loco_v2_probe,
+	.remove         = snd_rpi_dionaudio_loco_v2_remove,
+};
+
+module_platform_driver(snd_rpi_dionaudio_loco_v2_driver);
+
+MODULE_AUTHOR("Miquel Blauw <info@dionaudio.nl>");
+MODULE_DESCRIPTION("ASoC Driver for DionAudio LOCO-V2");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/dionaudio_loco.c b/sound/soc/bcm/dionaudio_loco.c
new file mode 100644
index 000000000000..65e03741d349
--- /dev/null
+++ b/sound/soc/bcm/dionaudio_loco.c
@@ -0,0 +1,121 @@
+/*
+ * ASoC Driver for Dion Audio LOCO DAC-AMP
+ *
+ * Author:      Miquel Blauw <info@dionaudio.nl>
+ *              Copyright 2016
+ *
+ * Based on the software of the RPi-DAC writen by Florian Meier
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+static int snd_rpi_dionaudio_loco_hw_params(
+	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+
+	unsigned int sample_bits =
+		snd_pcm_format_physical_width(params_format(params));
+
+	return snd_soc_dai_set_bclk_ratio(cpu_dai, sample_bits * 2);
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_rpi_dionaudio_loco_ops = {
+	.hw_params = snd_rpi_dionaudio_loco_hw_params,
+};
+
+static struct snd_soc_dai_link snd_rpi_dionaudio_loco_dai[] = {
+{
+	.name		= "DionAudio LOCO",
+	.stream_name	= "DionAudio LOCO DAC-AMP",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "pcm5102a-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "pcm5102a-codec",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S |
+			  SND_SOC_DAIFMT_NB_NF |
+			  SND_SOC_DAIFMT_CBS_CFS,
+	.ops		= &snd_rpi_dionaudio_loco_ops,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_dionaudio_loco = {
+	.name		= "snd_rpi_dionaudio_loco",
+	.dai_link	= snd_rpi_dionaudio_loco_dai,
+	.num_links	= ARRAY_SIZE(snd_rpi_dionaudio_loco_dai),
+};
+
+static int snd_rpi_dionaudio_loco_probe(struct platform_device *pdev)
+{
+	struct device_node *np;
+	int ret = 0;
+
+	snd_rpi_dionaudio_loco.dev = &pdev->dev;
+
+	np = pdev->dev.of_node;
+	if (np) {
+		struct snd_soc_dai_link *dai = &snd_rpi_dionaudio_loco_dai[0];
+		struct device_node *i2s_np;
+
+		i2s_np = of_parse_phandle(np, "i2s-controller", 0);
+		if (i2s_np) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_np;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_np;
+		}
+	}
+
+	ret = snd_soc_register_card(&snd_rpi_dionaudio_loco);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
+			ret);
+
+	return ret;
+}
+
+static int snd_rpi_dionaudio_loco_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&snd_rpi_dionaudio_loco);
+}
+
+static const struct of_device_id snd_rpi_dionaudio_loco_of_match[] = {
+	{ .compatible = "dionaudio,loco-pcm5242-tpa3118", },
+	{ /* sentinel */ },
+};
+MODULE_DEVICE_TABLE(of, snd_rpi_dionaudio_loco_of_match);
+
+static struct platform_driver snd_rpi_dionaudio_loco_driver = {
+	.driver = {
+		.name		= "snd-dionaudio-loco",
+		.owner		= THIS_MODULE,
+		.of_match_table	= snd_rpi_dionaudio_loco_of_match,
+	},
+	.probe  = snd_rpi_dionaudio_loco_probe,
+	.remove = snd_rpi_dionaudio_loco_remove,
+};
+
+module_platform_driver(snd_rpi_dionaudio_loco_driver);
+
+MODULE_AUTHOR("Miquel Blauw <info@dionaudio.nl>");
+MODULE_DESCRIPTION("ASoC Driver for DionAudio LOCO");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/fe-pi-audio.c b/sound/soc/bcm/fe-pi-audio.c
new file mode 100644
index 000000000000..015b56fd73cc
--- /dev/null
+++ b/sound/soc/bcm/fe-pi-audio.c
@@ -0,0 +1,158 @@
+/*
+ * ASoC Driver for Fe-Pi Audio Sound Card
+ *
+ * Author:	Henry Kupis <kuupaz@gmail.com>
+ *		Copyright 2016
+ *		based on code by Florian Meier <florian.meier@koalo.de>
+ *		based on code by Shawn Guo <shawn.guo@linaro.org>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+#include "../codecs/sgtl5000.h"
+
+static int snd_fe_pi_audio_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_card *card = rtd->card;
+	struct snd_soc_codec *codec = rtd->codec;
+
+	snd_soc_dapm_force_enable_pin(&card->dapm, "LO");
+	snd_soc_dapm_force_enable_pin(&card->dapm, "ADC");
+	snd_soc_dapm_force_enable_pin(&card->dapm, "DAC");
+	snd_soc_dapm_force_enable_pin(&card->dapm, "HP");
+	snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER,
+			SGTL5000_VAG_POWERUP, SGTL5000_VAG_POWERUP);
+
+	return 0;
+}
+
+static int snd_fe_pi_audio_hw_params(struct snd_pcm_substream *substream,
+	struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct device *dev = rtd->card->dev;
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+
+	int ret;
+
+	/* Set SGTL5000's SYSCLK */
+	ret = snd_soc_dai_set_sysclk(codec_dai, SGTL5000_SYSCLK, 12288000, SND_SOC_CLOCK_IN);
+	if (ret) {
+		dev_err(dev, "could not set codec driver clock params\n");
+		return ret;
+	}
+
+	return 0;
+}
+
+
+static struct snd_soc_ops snd_fe_pi_audio_ops = {
+	.hw_params = snd_fe_pi_audio_hw_params,
+};
+
+static struct snd_soc_dai_link snd_fe_pi_audio_dai[] = {
+	{
+		.name		= "FE-PI",
+		.stream_name	= "Fe-Pi HiFi",
+		.cpu_dai_name	= "bcm2708-i2s.0",
+		.codec_dai_name	= "sgtl5000",
+		.platform_name	= "bcm2708-i2s.0",
+		.codec_name	= "sgtl5000.1-000a",
+		.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+					SND_SOC_DAIFMT_CBM_CFM,
+		.ops		= &snd_fe_pi_audio_ops,
+		.init		= snd_fe_pi_audio_init,
+	},
+};
+
+static const struct snd_soc_dapm_route fe_pi_audio_dapm_routes[] = {
+	{"ADC", NULL, "Mic Bias"},
+};
+
+
+static struct snd_soc_card fe_pi_audio = {
+	.name         = "Fe-Pi Audio",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_fe_pi_audio_dai,
+	.num_links    = ARRAY_SIZE(snd_fe_pi_audio_dai),
+
+	.dapm_routes = fe_pi_audio_dapm_routes,
+	.num_dapm_routes = ARRAY_SIZE(fe_pi_audio_dapm_routes),
+};
+
+static int snd_fe_pi_audio_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+	struct snd_soc_card *card = &fe_pi_audio;
+	struct device_node *np = pdev->dev.of_node;
+	struct device_node *i2s_node;
+	struct snd_soc_dai_link *dai = &snd_fe_pi_audio_dai[0];
+
+	fe_pi_audio.dev = &pdev->dev;
+
+	i2s_node = of_parse_phandle(np, "i2s-controller", 0);
+	if (!i2s_node) {
+		dev_err(&pdev->dev, "i2s_node phandle missing or invalid\n");
+		return -EINVAL;
+	}
+
+	dai->cpu_dai_name = NULL;
+	dai->cpu_of_node = i2s_node;
+	dai->platform_name = NULL;
+	dai->platform_of_node = i2s_node;
+
+	of_node_put(i2s_node);
+
+	card->dev = &pdev->dev;
+	platform_set_drvdata(pdev, card);
+
+	ret = snd_soc_register_card(card);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+static int snd_fe_pi_audio_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&fe_pi_audio);
+}
+
+static const struct of_device_id snd_fe_pi_audio_of_match[] = {
+	{ .compatible = "fe-pi,fe-pi-audio", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_fe_pi_audio_of_match);
+
+static struct platform_driver snd_fe_pi_audio_driver = {
+        .driver = {
+                .name   = "snd-fe-pi-audio",
+                .owner  = THIS_MODULE,
+                .of_match_table = snd_fe_pi_audio_of_match,
+        },
+        .probe          = snd_fe_pi_audio_probe,
+        .remove         = snd_fe_pi_audio_remove,
+};
+
+module_platform_driver(snd_fe_pi_audio_driver);
+
+MODULE_AUTHOR("Henry Kupis <fe-pi@cox.net>");
+MODULE_DESCRIPTION("ASoC Driver for Fe-Pi Audio");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/googlevoicehat-codec.c b/sound/soc/bcm/googlevoicehat-codec.c
new file mode 100644
index 000000000000..7e31c9c54652
--- /dev/null
+++ b/sound/soc/bcm/googlevoicehat-codec.c
@@ -0,0 +1,199 @@
+/*
+ * Driver for the Google voiceHAT audio codec for Raspberry Pi.
+ *
+ * Author:	Peter Malkin <petermalkin@google.com>
+ *		Copyright 2016
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/device.h>
+#include <linux/err.h>
+#include <linux/gpio.h>
+#include <linux/gpio/consumer.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/version.h>
+#include <sound/pcm.h>
+#include <sound/soc.h>
+#include <sound/soc-dai.h>
+#include <sound/soc-dapm.h>
+
+#define ICS43432_RATE_MIN_HZ 7190  /* from data sheet */
+#define ICS43432_RATE_MAX_HZ 52800 /* from data sheet */
+#define SDMODE_DELAY_MS \
+  5 /* Delay in enabling SDMODE after clock settles to remove pop */
+
+struct voicehat_priv {
+  struct delayed_work enable_sdmode_work;
+  struct gpio_desc *sdmode_gpio;
+  unsigned int sdmode_delay;
+};
+
+static void voicehat_enable_sdmode_work(struct work_struct *work) {
+  struct voicehat_priv *voicehat =
+      container_of(work, struct voicehat_priv, enable_sdmode_work.work);
+  gpiod_set_value(voicehat->sdmode_gpio, 1);
+}
+
+static int voicehat_codec_probe(struct snd_soc_codec *codec) {
+  struct voicehat_priv *voicehat = snd_soc_codec_get_drvdata(codec);
+
+  voicehat->sdmode_gpio = devm_gpiod_get(codec->dev, "sdmode", GPIOD_OUT_LOW);
+  if (IS_ERR(voicehat->sdmode_gpio)) {
+    dev_err(codec->dev, "Unable to allocate GPIO pin\n");
+    return PTR_ERR(voicehat->sdmode_gpio);
+  }
+
+  INIT_DELAYED_WORK(&voicehat->enable_sdmode_work, voicehat_enable_sdmode_work);
+  return 0;
+}
+
+static int voicehat_codec_remove(struct snd_soc_codec *codec) {
+  struct voicehat_priv *voicehat = snd_soc_codec_get_drvdata(codec);
+
+  cancel_delayed_work_sync(&voicehat->enable_sdmode_work);
+
+  return 0;
+}
+
+static const struct snd_soc_dapm_widget voicehat_dapm_widgets[] = {
+    SND_SOC_DAPM_OUTPUT("Speaker"),
+};
+
+static const struct snd_soc_dapm_route voicehat_dapm_routes[] = {
+    {"Speaker", NULL, "HiFi Playback"},
+};
+
+static struct snd_soc_codec_driver voicehat_codec_driver = {
+    .probe = voicehat_codec_probe,
+    .remove = voicehat_codec_remove,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 0)
+    .component_driver = {
+#endif
+    .dapm_widgets = voicehat_dapm_widgets,
+    .num_dapm_widgets = ARRAY_SIZE(voicehat_dapm_widgets),
+    .dapm_routes = voicehat_dapm_routes,
+    .num_dapm_routes = ARRAY_SIZE(voicehat_dapm_routes),
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 0)
+    },
+#endif
+};
+
+static int voicehat_daiops_trigger(struct snd_pcm_substream *substream, int cmd,
+                                struct snd_soc_dai *dai) {
+  struct snd_soc_codec *codec = dai->codec;
+  struct voicehat_priv *voicehat = snd_soc_codec_get_drvdata(codec);
+
+  if (voicehat->sdmode_delay == 0) return 0;
+
+  dev_dbg(dai->dev, "CMD             %d", cmd);
+  dev_dbg(dai->dev, "Playback Active %d", dai->playback_active);
+  dev_dbg(dai->dev, "Capture Active  %d", dai->capture_active);
+
+  switch (cmd) {
+    case SNDRV_PCM_TRIGGER_START:
+    case SNDRV_PCM_TRIGGER_RESUME:
+    case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+      if (dai->playback_active) {
+        dev_info(dai->dev, "Enabling audio amp...\n");
+        queue_delayed_work(system_power_efficient_wq,
+                           &voicehat->enable_sdmode_work,
+                           msecs_to_jiffies(voicehat->sdmode_delay));
+      }
+      break;
+    case SNDRV_PCM_TRIGGER_STOP:
+    case SNDRV_PCM_TRIGGER_SUSPEND:
+    case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+      if (dai->playback_active) {
+        cancel_delayed_work(&voicehat->enable_sdmode_work);
+        dev_info(dai->dev, "Disabling audio amp...\n");
+        gpiod_set_value(voicehat->sdmode_gpio, 0);
+      }
+      break;
+  }
+  return 0;
+}
+
+static const struct snd_soc_dai_ops voicehat_dai_ops = {
+    .trigger = voicehat_daiops_trigger,
+};
+
+static struct snd_soc_dai_driver voicehat_dai = {
+    .name = "voicehat-hifi",
+    .capture = {.stream_name = "HiFi Capture",
+                .channels_min = 2,
+                .channels_max = 2,
+                .rates = SNDRV_PCM_RATE_48000,
+                .formats = SNDRV_PCM_FMTBIT_S32_LE},
+    .playback = {.stream_name = "HiFi Playback",
+                 .channels_min = 2,
+                 .channels_max = 2,
+                 .rates = SNDRV_PCM_RATE_48000,
+                 .formats = SNDRV_PCM_FMTBIT_S32_LE},
+    .ops = &voicehat_dai_ops,
+    .symmetric_rates = 1};
+
+#ifdef CONFIG_OF
+static const struct of_device_id voicehat_ids[] = {
+    {
+        .compatible = "google,voicehat",
+    },
+    {}};
+MODULE_DEVICE_TABLE(of, voicehat_ids);
+#endif
+
+static int voicehat_platform_probe(struct platform_device *pdev) {
+  struct voicehat_priv *voicehat;
+  int ret;
+
+  voicehat = devm_kzalloc(&pdev->dev, sizeof(*voicehat), GFP_KERNEL);
+  if (!voicehat) return -ENOMEM;
+
+  ret = device_property_read_u32(&pdev->dev, "voicehat_sdmode_delay",
+                                 &voicehat->sdmode_delay);
+
+  if (ret) {
+    voicehat->sdmode_delay = SDMODE_DELAY_MS;
+    dev_info(&pdev->dev,
+             "property 'voicehat_sdmode_delay' not found default 5 mS");
+  } else {
+    dev_info(&pdev->dev, "property 'voicehat_sdmode_delay' found delay= %d mS",
+             voicehat->sdmode_delay);
+  }
+
+  dev_set_drvdata(&pdev->dev, voicehat);
+
+  return snd_soc_register_codec(&pdev->dev, &voicehat_codec_driver, &voicehat_dai, 1);
+}
+
+static int voicehat_platform_remove(struct platform_device *pdev) {
+  snd_soc_unregister_codec(&pdev->dev);
+  return 0;
+}
+
+static struct platform_driver voicehat_driver = {
+    .driver =
+        {
+            .name = "voicehat-codec", .of_match_table = of_match_ptr(voicehat_ids),
+        },
+    .probe = voicehat_platform_probe,
+    .remove = voicehat_platform_remove,
+};
+
+module_platform_driver(voicehat_driver);
+
+MODULE_DESCRIPTION("Google voiceHAT Codec driver");
+MODULE_AUTHOR("Peter Malkin <petermalkin@google.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/googlevoicehat-soundcard.c b/sound/soc/bcm/googlevoicehat-soundcard.c
new file mode 100644
index 000000000000..225854b8e529
--- /dev/null
+++ b/sound/soc/bcm/googlevoicehat-soundcard.c
@@ -0,0 +1,124 @@
+/*
+ * ASoC Driver for Google voiceHAT SoundCard
+ *
+ * Author: Peter Malkin <petermalkin@google.com>
+ *         Copyright 2016
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+static int snd_rpi_googlevoicehat_soundcard_init(struct snd_soc_pcm_runtime *rtd)
+{
+	return 0;
+}
+
+static int snd_rpi_googlevoicehat_soundcard_hw_params(
+	struct snd_pcm_substream *substream,
+	struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+
+	unsigned int sample_bits =
+		snd_pcm_format_physical_width(params_format(params));
+
+	return snd_soc_dai_set_bclk_ratio(cpu_dai, sample_bits * 2);
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_rpi_googlevoicehat_soundcard_ops = {
+	.hw_params = snd_rpi_googlevoicehat_soundcard_hw_params,
+};
+
+static struct snd_soc_dai_link snd_rpi_googlevoicehat_soundcard_dai[] = {
+{
+	.name		= "Google voiceHAT SoundCard",
+	.stream_name	= "Google voiceHAT SoundCard HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "voicehat-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "voicehat-codec",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBS_CFS,
+	.ops		= &snd_rpi_googlevoicehat_soundcard_ops,
+	.init		= snd_rpi_googlevoicehat_soundcard_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_googlevoicehat_soundcard = {
+	.name         = "snd_rpi_googlevoicehat_soundcard",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_rpi_googlevoicehat_soundcard_dai,
+	.num_links    = ARRAY_SIZE(snd_rpi_googlevoicehat_soundcard_dai),
+};
+
+static int snd_rpi_googlevoicehat_soundcard_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_rpi_googlevoicehat_soundcard.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai = &snd_rpi_googlevoicehat_soundcard_dai[0];
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+					"i2s-controller", 0);
+
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+	}
+
+	ret = snd_soc_register_card(&snd_rpi_googlevoicehat_soundcard);
+	if (ret)
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+static int snd_rpi_googlevoicehat_soundcard_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&snd_rpi_googlevoicehat_soundcard);
+}
+
+static const struct of_device_id snd_rpi_googlevoicehat_soundcard_of_match[] = {
+	{ .compatible = "googlevoicehat,googlevoicehat-soundcard", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_rpi_googlevoicehat_soundcard_of_match);
+
+static struct platform_driver snd_rpi_googlevoicehat_soundcard_driver = {
+	.driver = {
+		.name   = "snd-googlevoicehat-soundcard",
+		.owner  = THIS_MODULE,
+		.of_match_table = snd_rpi_googlevoicehat_soundcard_of_match,
+	},
+	.probe          = snd_rpi_googlevoicehat_soundcard_probe,
+	.remove         = snd_rpi_googlevoicehat_soundcard_remove,
+};
+
+module_platform_driver(snd_rpi_googlevoicehat_soundcard_driver);
+
+MODULE_AUTHOR("Peter Malkin <petermalkin@google.com>");
+MODULE_DESCRIPTION("ASoC Driver for Google voiceHAT SoundCard");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/hifiberry_amp.c b/sound/soc/bcm/hifiberry_amp.c
new file mode 100644
index 000000000000..221c6c38e646
--- /dev/null
+++ b/sound/soc/bcm/hifiberry_amp.c
@@ -0,0 +1,128 @@
+/*
+ * ASoC Driver for HifiBerry AMP
+ *
+ * Author:	Sebastian Eickhoff <basti.eickhoff@googlemail.com>
+ *		Copyright 2014
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+static int snd_rpi_hifiberry_amp_init(struct snd_soc_pcm_runtime *rtd)
+{
+	// ToDo: init of the dsp-registers.
+	return 0;
+}
+
+static int snd_rpi_hifiberry_amp_hw_params( struct snd_pcm_substream *substream,
+				       struct snd_pcm_hw_params *params )
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+
+	return snd_soc_dai_set_bclk_ratio(cpu_dai, 64);
+}
+
+static struct snd_soc_ops snd_rpi_hifiberry_amp_ops = {
+	.hw_params = snd_rpi_hifiberry_amp_hw_params,
+};
+
+static struct snd_soc_dai_link snd_rpi_hifiberry_amp_dai[] = {
+    {
+		.name			= "HifiBerry AMP",
+		.stream_name	= "HifiBerry AMP HiFi",
+		.cpu_dai_name	= "bcm2708-i2s.0",
+		.codec_dai_name	= "tas5713-hifi",
+		.platform_name	= "bcm2708-i2s.0",
+		.codec_name		= "tas5713.1-001b",
+		.dai_fmt		= SND_SOC_DAIFMT_I2S |
+						  SND_SOC_DAIFMT_NB_NF |
+						  SND_SOC_DAIFMT_CBS_CFS,
+		.ops			= &snd_rpi_hifiberry_amp_ops,
+		.init			= snd_rpi_hifiberry_amp_init,
+	},
+};
+
+
+static struct snd_soc_card snd_rpi_hifiberry_amp = {
+	.name         = "snd_rpi_hifiberry_amp",
+	.driver_name  = "HifiberryAmp",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_rpi_hifiberry_amp_dai,
+	.num_links    = ARRAY_SIZE(snd_rpi_hifiberry_amp_dai),
+};
+
+static const struct of_device_id snd_rpi_hifiberry_amp_of_match[] = {
+        { .compatible = "hifiberry,hifiberry-amp", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, snd_rpi_hifiberry_amp_of_match);
+
+
+static int snd_rpi_hifiberry_amp_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_rpi_hifiberry_amp.dev = &pdev->dev;
+
+        if (pdev->dev.of_node) {
+            struct device_node *i2s_node;
+            struct snd_soc_dai_link *dai = &snd_rpi_hifiberry_amp_dai[0];
+            i2s_node = of_parse_phandle(pdev->dev.of_node,
+                                        "i2s-controller", 0);
+
+            if (i2s_node) {
+                dai->cpu_dai_name = NULL;
+                dai->cpu_of_node = i2s_node;
+                dai->platform_name = NULL;
+                dai->platform_of_node = i2s_node;
+            }
+        }
+
+	ret = snd_soc_register_card(&snd_rpi_hifiberry_amp);
+
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+
+static int snd_rpi_hifiberry_amp_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&snd_rpi_hifiberry_amp);
+}
+
+
+static struct platform_driver snd_rpi_hifiberry_amp_driver = {
+        .driver = {
+                .name   = "snd-hifiberry-amp",
+                .owner  = THIS_MODULE,
+		.of_match_table = snd_rpi_hifiberry_amp_of_match,
+        },
+        .probe          = snd_rpi_hifiberry_amp_probe,
+        .remove         = snd_rpi_hifiberry_amp_remove,
+};
+
+
+module_platform_driver(snd_rpi_hifiberry_amp_driver);
+
+
+MODULE_AUTHOR("Sebastian Eickhoff <basti.eickhoff@googlemail.com>");
+MODULE_DESCRIPTION("ASoC driver for HiFiBerry-AMP");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/hifiberry_dac.c b/sound/soc/bcm/hifiberry_dac.c
new file mode 100644
index 000000000000..ee9f13395354
--- /dev/null
+++ b/sound/soc/bcm/hifiberry_dac.c
@@ -0,0 +1,124 @@
+/*
+ * ASoC Driver for HifiBerry DAC
+ *
+ * Author:	Florian Meier <florian.meier@koalo.de>
+ *		Copyright 2013
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+static int snd_rpi_hifiberry_dac_init(struct snd_soc_pcm_runtime *rtd)
+{
+	return 0;
+}
+
+static int snd_rpi_hifiberry_dac_hw_params(struct snd_pcm_substream *substream,
+				       struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+
+	unsigned int sample_bits =
+		snd_pcm_format_physical_width(params_format(params));
+
+	return snd_soc_dai_set_bclk_ratio(cpu_dai, sample_bits * 2);
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_rpi_hifiberry_dac_ops = {
+	.hw_params = snd_rpi_hifiberry_dac_hw_params,
+};
+
+static struct snd_soc_dai_link snd_rpi_hifiberry_dac_dai[] = {
+{
+	.name		= "HifiBerry DAC",
+	.stream_name	= "HifiBerry DAC HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "pcm5102a-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "pcm5102a-codec",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBS_CFS,
+	.ops		= &snd_rpi_hifiberry_dac_ops,
+	.init		= snd_rpi_hifiberry_dac_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_hifiberry_dac = {
+	.name         = "snd_rpi_hifiberry_dac",
+	.driver_name  = "HifiberryDac",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_rpi_hifiberry_dac_dai,
+	.num_links    = ARRAY_SIZE(snd_rpi_hifiberry_dac_dai),
+};
+
+static int snd_rpi_hifiberry_dac_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_rpi_hifiberry_dac.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+	    struct device_node *i2s_node;
+	    struct snd_soc_dai_link *dai = &snd_rpi_hifiberry_dac_dai[0];
+	    i2s_node = of_parse_phandle(pdev->dev.of_node,
+					"i2s-controller", 0);
+
+	    if (i2s_node) {
+		dai->cpu_dai_name = NULL;
+		dai->cpu_of_node = i2s_node;
+		dai->platform_name = NULL;
+		dai->platform_of_node = i2s_node;
+	    }
+	}
+
+	ret = snd_soc_register_card(&snd_rpi_hifiberry_dac);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+static int snd_rpi_hifiberry_dac_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&snd_rpi_hifiberry_dac);
+}
+
+static const struct of_device_id snd_rpi_hifiberry_dac_of_match[] = {
+	{ .compatible = "hifiberry,hifiberry-dac", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_rpi_hifiberry_dac_of_match);
+
+static struct platform_driver snd_rpi_hifiberry_dac_driver = {
+        .driver = {
+                .name   = "snd-hifiberry-dac",
+                .owner  = THIS_MODULE,
+		.of_match_table = snd_rpi_hifiberry_dac_of_match,
+        },
+        .probe          = snd_rpi_hifiberry_dac_probe,
+        .remove         = snd_rpi_hifiberry_dac_remove,
+};
+
+module_platform_driver(snd_rpi_hifiberry_dac_driver);
+
+MODULE_AUTHOR("Florian Meier <florian.meier@koalo.de>");
+MODULE_DESCRIPTION("ASoC Driver for HifiBerry DAC");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/hifiberry_dacplus.c b/sound/soc/bcm/hifiberry_dacplus.c
new file mode 100644
index 000000000000..e36c4ba1e9a6
--- /dev/null
+++ b/sound/soc/bcm/hifiberry_dacplus.c
@@ -0,0 +1,357 @@
+/*
+ * ASoC Driver for HiFiBerry DAC+ / DAC Pro
+ *
+ * Author:	Daniel Matuschek, Stuart MacLean <stuart@hifiberry.com>
+ *		Copyright 2014-2015
+ *		based on code by Florian Meier <florian.meier@koalo.de>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/kernel.h>
+#include <linux/clk.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+#include "../codecs/pcm512x.h"
+
+#define HIFIBERRY_DACPRO_NOCLOCK 0
+#define HIFIBERRY_DACPRO_CLK44EN 1
+#define HIFIBERRY_DACPRO_CLK48EN 2
+
+struct pcm512x_priv {
+	struct regmap *regmap;
+	struct clk *sclk;
+};
+
+/* Clock rate of CLK44EN attached to GPIO6 pin */
+#define CLK_44EN_RATE 22579200UL
+/* Clock rate of CLK48EN attached to GPIO3 pin */
+#define CLK_48EN_RATE 24576000UL
+
+static bool slave;
+static bool snd_rpi_hifiberry_is_dacpro;
+static bool digital_gain_0db_limit = true;
+
+static void snd_rpi_hifiberry_dacplus_select_clk(struct snd_soc_codec *codec,
+	int clk_id)
+{
+	switch (clk_id) {
+	case HIFIBERRY_DACPRO_NOCLOCK:
+		snd_soc_update_bits(codec, PCM512x_GPIO_CONTROL_1, 0x24, 0x00);
+		break;
+	case HIFIBERRY_DACPRO_CLK44EN:
+		snd_soc_update_bits(codec, PCM512x_GPIO_CONTROL_1, 0x24, 0x20);
+		break;
+	case HIFIBERRY_DACPRO_CLK48EN:
+		snd_soc_update_bits(codec, PCM512x_GPIO_CONTROL_1, 0x24, 0x04);
+		break;
+	}
+}
+
+static void snd_rpi_hifiberry_dacplus_clk_gpio(struct snd_soc_codec *codec)
+{
+	snd_soc_update_bits(codec, PCM512x_GPIO_EN, 0x24, 0x24);
+	snd_soc_update_bits(codec, PCM512x_GPIO_OUTPUT_3, 0x0f, 0x02);
+	snd_soc_update_bits(codec, PCM512x_GPIO_OUTPUT_6, 0x0f, 0x02);
+}
+
+static bool snd_rpi_hifiberry_dacplus_is_sclk(struct snd_soc_codec *codec)
+{
+	int sck;
+
+	sck = snd_soc_read(codec, PCM512x_RATE_DET_4);
+	return (!(sck & 0x40));
+}
+
+static bool snd_rpi_hifiberry_dacplus_is_sclk_sleep(
+	struct snd_soc_codec *codec)
+{
+	msleep(2);
+	return snd_rpi_hifiberry_dacplus_is_sclk(codec);
+}
+
+static bool snd_rpi_hifiberry_dacplus_is_pro_card(struct snd_soc_codec *codec)
+{
+	bool isClk44EN, isClk48En, isNoClk;
+
+	snd_rpi_hifiberry_dacplus_clk_gpio(codec);
+
+	snd_rpi_hifiberry_dacplus_select_clk(codec, HIFIBERRY_DACPRO_CLK44EN);
+	isClk44EN = snd_rpi_hifiberry_dacplus_is_sclk_sleep(codec);
+
+	snd_rpi_hifiberry_dacplus_select_clk(codec, HIFIBERRY_DACPRO_NOCLOCK);
+	isNoClk = snd_rpi_hifiberry_dacplus_is_sclk_sleep(codec);
+
+	snd_rpi_hifiberry_dacplus_select_clk(codec, HIFIBERRY_DACPRO_CLK48EN);
+	isClk48En = snd_rpi_hifiberry_dacplus_is_sclk_sleep(codec);
+
+	return (isClk44EN && isClk48En && !isNoClk);
+}
+
+static int snd_rpi_hifiberry_dacplus_clk_for_rate(int sample_rate)
+{
+	int type;
+
+	switch (sample_rate) {
+	case 11025:
+	case 22050:
+	case 44100:
+	case 88200:
+	case 176400:
+	case 352800:
+		type = HIFIBERRY_DACPRO_CLK44EN;
+		break;
+	default:
+		type = HIFIBERRY_DACPRO_CLK48EN;
+		break;
+	}
+	return type;
+}
+
+static void snd_rpi_hifiberry_dacplus_set_sclk(struct snd_soc_codec *codec,
+	int sample_rate)
+{
+	struct pcm512x_priv *pcm512x = snd_soc_codec_get_drvdata(codec);
+
+	if (!IS_ERR(pcm512x->sclk)) {
+		int ctype;
+
+		ctype = snd_rpi_hifiberry_dacplus_clk_for_rate(sample_rate);
+		clk_set_rate(pcm512x->sclk, (ctype == HIFIBERRY_DACPRO_CLK44EN)
+			? CLK_44EN_RATE : CLK_48EN_RATE);
+		snd_rpi_hifiberry_dacplus_select_clk(codec, ctype);
+	}
+}
+
+static int snd_rpi_hifiberry_dacplus_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_codec *codec = rtd->codec;
+	struct pcm512x_priv *priv;
+
+	if (slave)
+		snd_rpi_hifiberry_is_dacpro = false;
+	else
+		snd_rpi_hifiberry_is_dacpro =
+				snd_rpi_hifiberry_dacplus_is_pro_card(codec);
+
+	if (snd_rpi_hifiberry_is_dacpro) {
+		struct snd_soc_dai_link *dai = rtd->dai_link;
+
+		dai->name = "HiFiBerry DAC+ Pro";
+		dai->stream_name = "HiFiBerry DAC+ Pro HiFi";
+		dai->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
+			| SND_SOC_DAIFMT_CBM_CFM;
+
+		snd_soc_update_bits(codec, PCM512x_BCLK_LRCLK_CFG, 0x31, 0x11);
+		snd_soc_update_bits(codec, PCM512x_MASTER_MODE, 0x03, 0x03);
+		snd_soc_update_bits(codec, PCM512x_MASTER_CLKDIV_2, 0x7f, 63);
+	} else {
+		priv = snd_soc_codec_get_drvdata(codec);
+		priv->sclk = ERR_PTR(-ENOENT);
+	}
+
+	snd_soc_update_bits(codec, PCM512x_GPIO_EN, 0x08, 0x08);
+	snd_soc_update_bits(codec, PCM512x_GPIO_OUTPUT_4, 0x0f, 0x02);
+	snd_soc_update_bits(codec, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
+
+	if (digital_gain_0db_limit)
+	{
+		int ret;
+		struct snd_soc_card *card = rtd->card;
+
+		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
+	}
+
+	return 0;
+}
+
+static int snd_rpi_hifiberry_dacplus_update_rate_den(
+	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_codec *codec = rtd->codec;
+	struct pcm512x_priv *pcm512x = snd_soc_codec_get_drvdata(codec);
+	struct snd_ratnum *rats_no_pll;
+	unsigned int num = 0, den = 0;
+	int err;
+
+	rats_no_pll = devm_kzalloc(rtd->dev, sizeof(*rats_no_pll), GFP_KERNEL);
+	if (!rats_no_pll)
+		return -ENOMEM;
+
+	rats_no_pll->num = clk_get_rate(pcm512x->sclk) / 64;
+	rats_no_pll->den_min = 1;
+	rats_no_pll->den_max = 128;
+	rats_no_pll->den_step = 1;
+
+	err = snd_interval_ratnum(hw_param_interval(params,
+		SNDRV_PCM_HW_PARAM_RATE), 1, rats_no_pll, &num, &den);
+	if (err >= 0 && den) {
+		params->rate_num = num;
+		params->rate_den = den;
+	}
+
+	devm_kfree(rtd->dev, rats_no_pll);
+	return 0;
+}
+
+static int snd_rpi_hifiberry_dacplus_hw_params(
+	struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params)
+{
+	int ret = 0;
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	int channels = params_channels(params);
+	int width = 32;
+
+	if (snd_rpi_hifiberry_is_dacpro) {
+		struct snd_soc_codec *codec = rtd->codec;
+
+		width = snd_pcm_format_physical_width(params_format(params));
+
+		snd_rpi_hifiberry_dacplus_set_sclk(codec,
+			params_rate(params));
+
+		ret = snd_rpi_hifiberry_dacplus_update_rate_den(
+			substream, params);
+	}
+
+	ret = snd_soc_dai_set_tdm_slot(rtd->cpu_dai, 0x03, 0x03,
+		channels, width);
+	if (ret)
+		return ret;
+	ret = snd_soc_dai_set_tdm_slot(rtd->codec_dai, 0x03, 0x03,
+		channels, width);
+	return ret;
+}
+
+static int snd_rpi_hifiberry_dacplus_startup(
+	struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_codec *codec = rtd->codec;
+
+	snd_soc_update_bits(codec, PCM512x_GPIO_CONTROL_1, 0x08, 0x08);
+	return 0;
+}
+
+static void snd_rpi_hifiberry_dacplus_shutdown(
+	struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_codec *codec = rtd->codec;
+
+	snd_soc_update_bits(codec, PCM512x_GPIO_CONTROL_1, 0x08, 0x00);
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_rpi_hifiberry_dacplus_ops = {
+	.hw_params = snd_rpi_hifiberry_dacplus_hw_params,
+	.startup = snd_rpi_hifiberry_dacplus_startup,
+	.shutdown = snd_rpi_hifiberry_dacplus_shutdown,
+};
+
+static struct snd_soc_dai_link snd_rpi_hifiberry_dacplus_dai[] = {
+{
+	.name		= "HiFiBerry DAC+",
+	.stream_name	= "HiFiBerry DAC+ HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "pcm512x-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "pcm512x.1-004d",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBS_CFS,
+	.ops		= &snd_rpi_hifiberry_dacplus_ops,
+	.init		= snd_rpi_hifiberry_dacplus_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_hifiberry_dacplus = {
+	.name         = "snd_rpi_hifiberry_dacplus",
+	.driver_name  = "HifiberryDacp",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_rpi_hifiberry_dacplus_dai,
+	.num_links    = ARRAY_SIZE(snd_rpi_hifiberry_dacplus_dai),
+};
+
+static int snd_rpi_hifiberry_dacplus_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_rpi_hifiberry_dacplus.dev = &pdev->dev;
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai;
+
+		dai = &snd_rpi_hifiberry_dacplus_dai[0];
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+			"i2s-controller", 0);
+
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+
+		digital_gain_0db_limit = !of_property_read_bool(
+			pdev->dev.of_node, "hifiberry,24db_digital_gain");
+		slave = of_property_read_bool(pdev->dev.of_node,
+						"hifiberry-dacplus,slave");
+	}
+
+	ret = snd_soc_register_card(&snd_rpi_hifiberry_dacplus);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev,
+			"snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+static int snd_rpi_hifiberry_dacplus_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&snd_rpi_hifiberry_dacplus);
+}
+
+static const struct of_device_id snd_rpi_hifiberry_dacplus_of_match[] = {
+	{ .compatible = "hifiberry,hifiberry-dacplus", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_rpi_hifiberry_dacplus_of_match);
+
+static struct platform_driver snd_rpi_hifiberry_dacplus_driver = {
+	.driver = {
+		.name   = "snd-rpi-hifiberry-dacplus",
+		.owner  = THIS_MODULE,
+		.of_match_table = snd_rpi_hifiberry_dacplus_of_match,
+	},
+	.probe          = snd_rpi_hifiberry_dacplus_probe,
+	.remove         = snd_rpi_hifiberry_dacplus_remove,
+};
+
+module_platform_driver(snd_rpi_hifiberry_dacplus_driver);
+
+MODULE_AUTHOR("Daniel Matuschek <daniel@hifiberry.com>");
+MODULE_DESCRIPTION("ASoC Driver for HiFiBerry DAC+");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/hifiberry_digi.c b/sound/soc/bcm/hifiberry_digi.c
new file mode 100644
index 000000000000..7620dd02de40
--- /dev/null
+++ b/sound/soc/bcm/hifiberry_digi.c
@@ -0,0 +1,276 @@
+/*
+ * ASoC Driver for HifiBerry Digi
+ *
+ * Author: Daniel Matuschek <info@crazy-audio.com>
+ * based on the HifiBerry DAC driver by Florian Meier <florian.meier@koalo.de>
+ *	Copyright 2013
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+#include <linux/gpio/consumer.h>
+
+#include "../codecs/wm8804.h"
+
+static short int auto_shutdown_output = 0;
+module_param(auto_shutdown_output, short, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
+MODULE_PARM_DESC(auto_shutdown_output, "Shutdown SP/DIF output if playback is stopped");
+
+#define CLK_44EN_RATE 22579200UL
+#define CLK_48EN_RATE 24576000UL
+
+static bool snd_rpi_hifiberry_is_digipro;
+static struct gpio_desc *snd_rpi_hifiberry_clk44gpio;
+static struct gpio_desc *snd_rpi_hifiberry_clk48gpio;
+
+static int samplerate=44100;
+
+static uint32_t snd_rpi_hifiberry_digi_enable_clock(int sample_rate)
+{
+	switch (sample_rate) {
+	case 11025:
+	case 22050:
+	case 44100:
+	case 88200:
+	case 176400:
+		gpiod_set_value_cansleep(snd_rpi_hifiberry_clk44gpio, 1);
+		gpiod_set_value_cansleep(snd_rpi_hifiberry_clk48gpio, 0);
+		return CLK_44EN_RATE;
+	default:
+		gpiod_set_value_cansleep(snd_rpi_hifiberry_clk48gpio, 1);
+		gpiod_set_value_cansleep(snd_rpi_hifiberry_clk44gpio, 0);
+		return CLK_48EN_RATE;
+	}
+}
+
+
+static int snd_rpi_hifiberry_digi_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_codec *codec = rtd->codec;
+
+	/* enable TX output */
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x4, 0x0);
+
+	/* Initialize Digi+ Pro hardware */
+	if (snd_rpi_hifiberry_is_digipro) {
+		struct snd_soc_dai_link *dai = rtd->dai_link;
+
+		dai->name = "HiFiBerry Digi+ Pro";
+		dai->stream_name = "HiFiBerry Digi+ Pro HiFi";
+	}
+
+	return 0;
+}
+
+static int snd_rpi_hifiberry_digi_startup(struct snd_pcm_substream *substream) {
+	/* turn on digital output */
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_codec *codec = rtd->codec;
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x3c, 0x00);
+	return 0;
+}
+
+static void snd_rpi_hifiberry_digi_shutdown(struct snd_pcm_substream *substream) {
+	/* turn off output */
+	if (auto_shutdown_output) {
+		/* turn off output */
+		struct snd_soc_pcm_runtime *rtd = substream->private_data;
+		struct snd_soc_codec *codec = rtd->codec;
+		snd_soc_update_bits(codec, WM8804_PWRDN, 0x3c, 0x3c);
+	}
+}
+
+
+static int snd_rpi_hifiberry_digi_hw_params(struct snd_pcm_substream *substream,
+				       struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+	struct snd_soc_codec *codec = rtd->codec;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+
+	int sysclk = 27000000; /* This is fixed on this board */
+
+	long mclk_freq=0;
+	int mclk_div=1;
+	int sampling_freq=1;
+
+	int ret;
+
+	samplerate = params_rate(params);
+
+	if (samplerate<=96000) {
+		mclk_freq=samplerate*256;
+		mclk_div=WM8804_MCLKDIV_256FS;
+	} else {
+		mclk_freq=samplerate*128;
+		mclk_div=WM8804_MCLKDIV_128FS;
+	}
+
+	if (snd_rpi_hifiberry_is_digipro)
+		sysclk = snd_rpi_hifiberry_digi_enable_clock(samplerate);
+	
+	switch (samplerate) {
+		case 32000:
+			sampling_freq=0x03;
+			break;
+		case 44100:
+			sampling_freq=0x00;
+			break;
+		case 48000:
+			sampling_freq=0x02;
+			break;
+		case 88200:
+			sampling_freq=0x08;
+			break;
+		case 96000:
+			sampling_freq=0x0a;
+			break;
+		case 176400:
+			sampling_freq=0x0c;
+			break;
+		case 192000:
+			sampling_freq=0x0e;
+			break;
+		default:
+			dev_err(codec->dev,
+			"Failed to set WM8804 SYSCLK, unsupported samplerate %d\n",
+			samplerate);
+	}
+
+	snd_soc_dai_set_clkdiv(codec_dai, WM8804_MCLK_DIV, mclk_div);
+	snd_soc_dai_set_pll(codec_dai, 0, 0, sysclk, mclk_freq);
+
+	ret = snd_soc_dai_set_sysclk(codec_dai, WM8804_TX_CLKSRC_PLL,
+					sysclk, SND_SOC_CLOCK_OUT);
+
+	if (ret < 0) {
+		dev_err(codec->dev,
+		"Failed to set WM8804 SYSCLK: %d\n", ret);
+		return ret;
+	}
+
+	/* Enable TX output */
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x4, 0x0);
+
+	/* Power on */
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x9, 0);
+
+	/* set sampling frequency status bits */
+	snd_soc_update_bits(codec, WM8804_SPDTX4, 0x0f, sampling_freq);
+
+	return snd_soc_dai_set_bclk_ratio(cpu_dai,64);
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_rpi_hifiberry_digi_ops = {
+	.hw_params = snd_rpi_hifiberry_digi_hw_params,
+        .startup = snd_rpi_hifiberry_digi_startup,
+        .shutdown = snd_rpi_hifiberry_digi_shutdown,
+};
+
+static struct snd_soc_dai_link snd_rpi_hifiberry_digi_dai[] = {
+{
+	.name		= "HifiBerry Digi",
+	.stream_name	= "HifiBerry Digi HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "wm8804-spdif",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "wm8804.1-003b",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBM_CFM,
+	.ops		= &snd_rpi_hifiberry_digi_ops,
+	.init		= snd_rpi_hifiberry_digi_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_hifiberry_digi = {
+	.name         = "snd_rpi_hifiberry_digi",
+	.driver_name  = "HifiberryDigi",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_rpi_hifiberry_digi_dai,
+	.num_links    = ARRAY_SIZE(snd_rpi_hifiberry_digi_dai),
+};
+
+static int snd_rpi_hifiberry_digi_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_rpi_hifiberry_digi.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+	    struct device_node *i2s_node;
+	    struct snd_soc_dai_link *dai = &snd_rpi_hifiberry_digi_dai[0];
+	    i2s_node = of_parse_phandle(pdev->dev.of_node,
+					"i2s-controller", 0);
+
+	    if (i2s_node) {
+		dai->cpu_dai_name = NULL;
+		dai->cpu_of_node = i2s_node;
+		dai->platform_name = NULL;
+		dai->platform_of_node = i2s_node;
+	    }
+
+	    snd_rpi_hifiberry_is_digipro = 1;
+
+	    snd_rpi_hifiberry_clk44gpio =
+		devm_gpiod_get(&pdev->dev, "clock44", GPIOD_OUT_LOW);
+	    if (IS_ERR(snd_rpi_hifiberry_clk44gpio))
+		snd_rpi_hifiberry_is_digipro = 0;
+
+	    snd_rpi_hifiberry_clk48gpio =
+		devm_gpiod_get(&pdev->dev, "clock48", GPIOD_OUT_LOW);
+	    if (IS_ERR(snd_rpi_hifiberry_clk48gpio))
+		snd_rpi_hifiberry_is_digipro = 0;
+
+	}
+
+	ret = snd_soc_register_card(&snd_rpi_hifiberry_digi);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+static int snd_rpi_hifiberry_digi_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&snd_rpi_hifiberry_digi);
+}
+
+static const struct of_device_id snd_rpi_hifiberry_digi_of_match[] = {
+	{ .compatible = "hifiberry,hifiberry-digi", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_rpi_hifiberry_digi_of_match);
+
+static struct platform_driver snd_rpi_hifiberry_digi_driver = {
+	.driver = {
+		.name   = "snd-hifiberry-digi",
+		.owner  = THIS_MODULE,
+		.of_match_table = snd_rpi_hifiberry_digi_of_match,
+	},
+	.probe          = snd_rpi_hifiberry_digi_probe,
+	.remove         = snd_rpi_hifiberry_digi_remove,
+};
+
+module_platform_driver(snd_rpi_hifiberry_digi_driver);
+
+MODULE_AUTHOR("Daniel Matuschek <info@crazy-audio.com>");
+MODULE_DESCRIPTION("ASoC Driver for HifiBerry Digi");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/iqaudio-dac.c b/sound/soc/bcm/iqaudio-dac.c
new file mode 100644
index 000000000000..4583d199fd83
--- /dev/null
+++ b/sound/soc/bcm/iqaudio-dac.c
@@ -0,0 +1,221 @@
+/*
+ * ASoC Driver for IQaudIO DAC
+ *
+ * Author:	Florian Meier <florian.meier@koalo.de>
+ *		Copyright 2013
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/gpio/consumer.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+static bool digital_gain_0db_limit = true;
+
+static struct gpio_desc *mute_gpio;
+
+static int snd_rpi_iqaudio_dac_init(struct snd_soc_pcm_runtime *rtd)
+{
+	if (digital_gain_0db_limit)
+	{
+		int ret;
+		struct snd_soc_card *card = rtd->card;
+
+		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
+	}
+
+	return 0;
+}
+
+static void snd_rpi_iqaudio_gpio_mute(struct snd_soc_card *card)
+{
+	if (mute_gpio) {
+		dev_info(card->dev, "%s: muting amp using GPIO22\n",
+			 __func__);
+		gpiod_set_value_cansleep(mute_gpio, 0);
+	}
+}
+
+static void snd_rpi_iqaudio_gpio_unmute(struct snd_soc_card *card)
+{
+	if (mute_gpio) {
+		dev_info(card->dev, "%s: un-muting amp using GPIO22\n",
+			 __func__);
+		gpiod_set_value_cansleep(mute_gpio, 1);
+	}
+}
+
+static int snd_rpi_iqaudio_set_bias_level(struct snd_soc_card *card,
+	struct snd_soc_dapm_context *dapm, enum snd_soc_bias_level level)
+{
+	struct snd_soc_pcm_runtime *rtd;
+	struct snd_soc_dai *codec_dai;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	codec_dai = rtd->codec_dai;
+
+	if (dapm->dev != codec_dai->dev)
+		return 0;
+
+	switch (level) {
+	case SND_SOC_BIAS_PREPARE:
+		if (dapm->bias_level != SND_SOC_BIAS_STANDBY)
+			break;
+
+		/* UNMUTE AMP */
+		snd_rpi_iqaudio_gpio_unmute(card);
+
+		break;
+	case SND_SOC_BIAS_STANDBY:
+		if (dapm->bias_level != SND_SOC_BIAS_PREPARE)
+			break;
+
+		/* MUTE AMP */
+		snd_rpi_iqaudio_gpio_mute(card);
+
+		break;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+static struct snd_soc_dai_link snd_rpi_iqaudio_dac_dai[] = {
+{
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "pcm512x-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "pcm512x.1-004c",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBS_CFS,
+	.init		= snd_rpi_iqaudio_dac_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_iqaudio_dac = {
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_rpi_iqaudio_dac_dai,
+	.num_links    = ARRAY_SIZE(snd_rpi_iqaudio_dac_dai),
+};
+
+static int snd_rpi_iqaudio_dac_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+	bool gpio_unmute = false;
+
+	snd_rpi_iqaudio_dac.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_card *card = &snd_rpi_iqaudio_dac;
+		struct snd_soc_dai_link *dai = &snd_rpi_iqaudio_dac_dai[0];
+		bool auto_gpio_mute = false;
+
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+					    "i2s-controller", 0);
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+
+		digital_gain_0db_limit = !of_property_read_bool(
+			pdev->dev.of_node, "iqaudio,24db_digital_gain");
+
+		if (of_property_read_string(pdev->dev.of_node, "card_name",
+					    &card->name))
+			card->name = "IQaudIODAC";
+
+		if (of_property_read_string(pdev->dev.of_node, "dai_name",
+					    &dai->name))
+			dai->name = "IQaudIO DAC";
+
+		if (of_property_read_string(pdev->dev.of_node,
+					"dai_stream_name", &dai->stream_name))
+			dai->stream_name = "IQaudIO DAC HiFi";
+
+		/* gpio_unmute - one time unmute amp using GPIO */
+		gpio_unmute = of_property_read_bool(pdev->dev.of_node,
+						    "iqaudio-dac,unmute-amp");
+
+		/* auto_gpio_mute - mute/unmute amp using GPIO */
+		auto_gpio_mute = of_property_read_bool(pdev->dev.of_node,
+						"iqaudio-dac,auto-mute-amp");
+
+		if (auto_gpio_mute || gpio_unmute) {
+			mute_gpio = devm_gpiod_get_optional(&pdev->dev, "mute",
+							    GPIOD_OUT_LOW);
+			if (IS_ERR(mute_gpio)) {
+				ret = PTR_ERR(mute_gpio);
+				dev_err(&pdev->dev,
+					"Failed to get mute gpio: %d\n", ret);
+				return ret;
+			}
+
+			if (auto_gpio_mute && mute_gpio)
+				snd_rpi_iqaudio_dac.set_bias_level =
+						snd_rpi_iqaudio_set_bias_level;
+		}
+	}
+
+	ret = snd_soc_register_card(&snd_rpi_iqaudio_dac);
+	if (ret) {
+		if (ret != -EPROBE_DEFER)
+			dev_err(&pdev->dev,
+				"snd_soc_register_card() failed: %d\n", ret);
+		return ret;
+	}
+
+	if (gpio_unmute && mute_gpio)
+		snd_rpi_iqaudio_gpio_unmute(&snd_rpi_iqaudio_dac);
+
+	return 0;
+}
+
+static int snd_rpi_iqaudio_dac_remove(struct platform_device *pdev)
+{
+	snd_rpi_iqaudio_gpio_mute(&snd_rpi_iqaudio_dac);
+
+	return snd_soc_unregister_card(&snd_rpi_iqaudio_dac);
+}
+
+static const struct of_device_id iqaudio_of_match[] = {
+	{ .compatible = "iqaudio,iqaudio-dac", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, iqaudio_of_match);
+
+static struct platform_driver snd_rpi_iqaudio_dac_driver = {
+	.driver = {
+		.name   = "snd-rpi-iqaudio-dac",
+		.owner  = THIS_MODULE,
+		.of_match_table = iqaudio_of_match,
+	},
+	.probe          = snd_rpi_iqaudio_dac_probe,
+	.remove         = snd_rpi_iqaudio_dac_remove,
+};
+
+module_platform_driver(snd_rpi_iqaudio_dac_driver);
+
+MODULE_AUTHOR("Florian Meier <florian.meier@koalo.de>");
+MODULE_DESCRIPTION("ASoC Driver for IQAudio DAC");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/iqaudio_digi.c b/sound/soc/bcm/iqaudio_digi.c
new file mode 100644
index 000000000000..33aa2be8a43a
--- /dev/null
+++ b/sound/soc/bcm/iqaudio_digi.c
@@ -0,0 +1,239 @@
+/*
+ * ASoC Driver for IQAudIO WM8804 Digi
+ *
+ * Author: Daniel Matuschek <info@crazy-audio.com>
+ * based on the HifiBerry DAC driver by Florian Meier <florian.meier@koalo.de>
+ *	Copyright 2013
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+#include "../codecs/wm8804.h"
+
+static short int auto_shutdown_output;
+module_param(auto_shutdown_output, short,
+	      S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
+MODULE_PARM_DESC(auto_shutdown_output, "Shutdown SP/DIF output if playback is stopped");
+
+static int snd_rpi_iqaudio_digi_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_codec *codec = rtd->codec;
+
+	/* enable TX output */
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x4, 0x0);
+
+	return 0;
+}
+
+static int snd_rpi_iqaudio_digi_startup(struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_codec *codec = rtd->codec;
+
+	/* turn on digital output */
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x3c, 0x00);
+
+	return 0;
+}
+
+static void snd_rpi_iqaudio_digi_shutdown(struct snd_pcm_substream *substream)
+{
+	if (auto_shutdown_output) {
+		struct snd_soc_pcm_runtime *rtd = substream->private_data;
+		struct snd_soc_codec *codec = rtd->codec;
+
+		/* turn off digital output */
+		snd_soc_update_bits(codec, WM8804_PWRDN, 0x3c, 0x3c);
+	}
+}
+
+
+static int snd_rpi_iqaudio_digi_hw_params(struct snd_pcm_substream *substream,
+	struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+	struct snd_soc_codec *codec = rtd->codec;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+
+	int sysclk = 27000000; /* This is fixed on this board */
+
+	long mclk_freq = 0;
+	int mclk_div = 1;
+	int sampling_freq = 1;
+
+	int ret;
+
+	int samplerate = params_rate(params);
+
+	if (samplerate <= 96000) {
+		mclk_freq = samplerate * 256;
+		mclk_div = WM8804_MCLKDIV_256FS;
+	} else {
+		mclk_freq = samplerate * 128;
+		mclk_div = WM8804_MCLKDIV_128FS;
+	}
+
+	switch (samplerate) {
+	case 32000:
+		sampling_freq = 0x03;
+		break;
+	case 44100:
+		sampling_freq = 0x00;
+		break;
+	case 48000:
+		sampling_freq = 0x02;
+		break;
+	case 88200:
+		sampling_freq = 0x08;
+		break;
+	case 96000:
+		sampling_freq = 0x0a;
+		break;
+	case 176400:
+		sampling_freq = 0x0c;
+		break;
+	case 192000:
+		sampling_freq = 0x0e;
+		break;
+	default:
+		dev_err(codec->dev, "Failed to set WM8804 SYSCLK, unsupported samplerate %d\n",
+			samplerate);
+	}
+
+	snd_soc_dai_set_clkdiv(codec_dai, WM8804_MCLK_DIV, mclk_div);
+	snd_soc_dai_set_pll(codec_dai, 0, 0, sysclk, mclk_freq);
+
+	ret = snd_soc_dai_set_sysclk(codec_dai, WM8804_TX_CLKSRC_PLL,
+					sysclk, SND_SOC_CLOCK_OUT);
+	if (ret < 0) {
+		dev_err(codec->dev, "Failed to set WM8804 SYSCLK: %d\n", ret);
+		return ret;
+	}
+
+	/* Enable TX output */
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x4, 0x0);
+
+	/* Power on */
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x9, 0);
+
+	/* set sampling frequency status bits */
+	snd_soc_update_bits(codec, WM8804_SPDTX4, 0x0f, sampling_freq);
+
+	return snd_soc_dai_set_bclk_ratio(cpu_dai, 64);
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_rpi_iqaudio_digi_ops = {
+	.hw_params	= snd_rpi_iqaudio_digi_hw_params,
+	.startup	= snd_rpi_iqaudio_digi_startup,
+	.shutdown	= snd_rpi_iqaudio_digi_shutdown,
+};
+
+static struct snd_soc_dai_link snd_rpi_iqaudio_digi_dai[] = {
+{
+	.name		= "IQAudIO Digi",
+	.stream_name	= "IQAudIO Digi HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "wm8804-spdif",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "wm8804.1-003b",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S |
+			  SND_SOC_DAIFMT_NB_NF |
+			  SND_SOC_DAIFMT_CBM_CFM,
+	.ops		= &snd_rpi_iqaudio_digi_ops,
+	.init		= snd_rpi_iqaudio_digi_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_iqaudio_digi = {
+	.name		= "IQAudIODigi",
+	.owner		= THIS_MODULE,
+	.dai_link	= snd_rpi_iqaudio_digi_dai,
+	.num_links	= ARRAY_SIZE(snd_rpi_iqaudio_digi_dai),
+};
+
+static int snd_rpi_iqaudio_digi_probe(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = &snd_rpi_iqaudio_digi;
+	char *prefix = "wm8804-digi,";
+	char prop[128];
+	struct device_node *np;
+	int ret = 0;
+
+	snd_rpi_iqaudio_digi.dev = &pdev->dev;
+
+	np = pdev->dev.of_node;
+	if (np) {
+		struct snd_soc_dai_link *dai = &snd_rpi_iqaudio_digi_dai[0];
+		struct device_node *i2s_node;
+
+		i2s_node = of_parse_phandle(np, "i2s-controller", 0);
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+
+		snprintf(prop, sizeof(prop), "%scard-name", prefix);
+		of_property_read_string(np, prop, &card->name);
+
+		snprintf(prop, sizeof(prop), "%sdai-name", prefix);
+		of_property_read_string(np, prop, &dai->name);
+
+		snprintf(prop, sizeof(prop), "%sdai-stream-name", prefix);
+		of_property_read_string(np, prop, &dai->stream_name);
+	}
+
+	ret = snd_soc_register_card(card);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
+			ret);
+
+	return ret;
+}
+
+static int snd_rpi_iqaudio_digi_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&snd_rpi_iqaudio_digi);
+}
+
+static const struct of_device_id snd_rpi_iqaudio_digi_of_match[] = {
+	{ .compatible = "iqaudio,wm8804-digi", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_rpi_iqaudio_digi_of_match);
+
+static struct platform_driver snd_rpi_iqaudio_digi_driver = {
+	.driver = {
+		.name		= "IQAudIODigi",
+		.owner		= THIS_MODULE,
+		.of_match_table	= snd_rpi_iqaudio_digi_of_match,
+	},
+	.probe  = snd_rpi_iqaudio_digi_probe,
+	.remove = snd_rpi_iqaudio_digi_remove,
+};
+
+module_platform_driver(snd_rpi_iqaudio_digi_driver);
+
+MODULE_AUTHOR("Daniel Matuschek <info@crazy-audio.com>");
+MODULE_DESCRIPTION("ASoC Driver for IQAudIO WM8804 Digi");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/justboom-dac.c b/sound/soc/bcm/justboom-dac.c
new file mode 100644
index 000000000000..217626cdad6c
--- /dev/null
+++ b/sound/soc/bcm/justboom-dac.c
@@ -0,0 +1,151 @@
+/*
+ * ASoC Driver for JustBoom DAC Raspberry Pi HAT Sound Card
+ *
+ * Author:	Milan Neskovic
+ *		Copyright 2016
+ *		based on code by Daniel Matuschek <info@crazy-audio.com>
+ *		based on code by Florian Meier <florian.meier@koalo.de>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+#include "../codecs/pcm512x.h"
+
+static bool digital_gain_0db_limit = true;
+
+static int snd_rpi_justboom_dac_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_codec *codec = rtd->codec;
+	snd_soc_update_bits(codec, PCM512x_GPIO_EN, 0x08, 0x08);
+	snd_soc_update_bits(codec, PCM512x_GPIO_OUTPUT_4, 0xf, 0x02);
+	snd_soc_update_bits(codec, PCM512x_GPIO_CONTROL_1, 0x08,0x08);
+
+	if (digital_gain_0db_limit)
+	{
+		int ret;
+		struct snd_soc_card *card = rtd->card;
+
+		ret = snd_soc_limit_volume(card, "Digital Playback Volume", 207);
+		if (ret < 0)
+			dev_warn(card->dev, "Failed to set volume limit: %d\n", ret);
+	}
+
+	return 0;
+}
+
+static int snd_rpi_justboom_dac_startup(struct snd_pcm_substream *substream) {
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_codec *codec = rtd->codec;
+	snd_soc_update_bits(codec, PCM512x_GPIO_CONTROL_1, 0x08,0x08);
+	return 0;
+}
+
+static void snd_rpi_justboom_dac_shutdown(struct snd_pcm_substream *substream) {
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_codec *codec = rtd->codec;
+	snd_soc_update_bits(codec, PCM512x_GPIO_CONTROL_1, 0x08,0x00);
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_rpi_justboom_dac_ops = {
+	.startup = snd_rpi_justboom_dac_startup,
+	.shutdown = snd_rpi_justboom_dac_shutdown,
+};
+
+static struct snd_soc_dai_link snd_rpi_justboom_dac_dai[] = {
+{
+	.name		= "JustBoom DAC",
+	.stream_name	= "JustBoom DAC HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "pcm512x-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "pcm512x.1-004d",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBS_CFS,
+	.ops		= &snd_rpi_justboom_dac_ops,
+	.init		= snd_rpi_justboom_dac_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_justboom_dac = {
+	.name         = "snd_rpi_justboom_dac",
+	.driver_name  = "JustBoomDac",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_rpi_justboom_dac_dai,
+	.num_links    = ARRAY_SIZE(snd_rpi_justboom_dac_dai),
+};
+
+static int snd_rpi_justboom_dac_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_rpi_justboom_dac.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+	    struct device_node *i2s_node;
+	    struct snd_soc_dai_link *dai = &snd_rpi_justboom_dac_dai[0];
+	    i2s_node = of_parse_phandle(pdev->dev.of_node,
+					"i2s-controller", 0);
+
+	    if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+	    }
+
+	    digital_gain_0db_limit = !of_property_read_bool(
+			pdev->dev.of_node, "justboom,24db_digital_gain");
+	}
+
+	ret = snd_soc_register_card(&snd_rpi_justboom_dac);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev,
+			"snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+static int snd_rpi_justboom_dac_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&snd_rpi_justboom_dac);
+}
+
+static const struct of_device_id snd_rpi_justboom_dac_of_match[] = {
+	{ .compatible = "justboom,justboom-dac", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_rpi_justboom_dac_of_match);
+
+static struct platform_driver snd_rpi_justboom_dac_driver = {
+	.driver = {
+		.name   = "snd-rpi-justboom-dac",
+		.owner  = THIS_MODULE,
+		.of_match_table = snd_rpi_justboom_dac_of_match,
+	},
+	.probe          = snd_rpi_justboom_dac_probe,
+	.remove         = snd_rpi_justboom_dac_remove,
+};
+
+module_platform_driver(snd_rpi_justboom_dac_driver);
+
+MODULE_AUTHOR("Milan Neskovic <info@justboom.co>");
+MODULE_DESCRIPTION("ASoC Driver for JustBoom PI DAC HAT Sound Card");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/justboom-digi.c b/sound/soc/bcm/justboom-digi.c
new file mode 100644
index 000000000000..909cf8928f2f
--- /dev/null
+++ b/sound/soc/bcm/justboom-digi.c
@@ -0,0 +1,216 @@
+/*
+ * ASoC Driver for JustBoom Raspberry Pi Digi HAT Sound Card
+ *
+ * Author:	Milan Neskovic
+ *		Copyright 2016
+ *		based on code by Daniel Matuschek <info@crazy-audio.com>
+ *		based on code by Florian Meier <florian.meier@koalo.de>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+#include "../codecs/wm8804.h"
+
+static int snd_rpi_justboom_digi_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_codec *codec = rtd->codec;
+
+	/* enable TX output */
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x4, 0x0);
+
+	return 0;
+}
+
+static int snd_rpi_justboom_digi_startup(struct snd_pcm_substream *substream) {
+	/* turn on digital output */
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_codec *codec = rtd->codec;
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x3c, 0x00);
+	return 0;
+}
+
+static void snd_rpi_justboom_digi_shutdown(struct snd_pcm_substream *substream) {
+	/* turn off output */
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_codec *codec = rtd->codec;
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x3c, 0x3c);
+}
+
+static int snd_rpi_justboom_digi_hw_params(struct snd_pcm_substream *substream,
+				       struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+	struct snd_soc_codec *codec = rtd->codec;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+
+	int sysclk = 27000000; /* This is fixed on this board */
+
+	long mclk_freq=0;
+	int mclk_div=1;
+	int sampling_freq=1;
+
+	int ret;
+
+	int samplerate = params_rate(params);
+
+	if (samplerate<=96000) {
+		mclk_freq=samplerate*256;
+		mclk_div=WM8804_MCLKDIV_256FS;
+	} else {
+		mclk_freq=samplerate*128;
+		mclk_div=WM8804_MCLKDIV_128FS;
+	}
+
+	switch (samplerate) {
+		case 32000:
+			sampling_freq=0x03;
+			break;
+		case 44100:
+			sampling_freq=0x00;
+			break;
+		case 48000:
+			sampling_freq=0x02;
+			break;
+		case 88200:
+			sampling_freq=0x08;
+			break;
+		case 96000:
+			sampling_freq=0x0a;
+			break;
+		case 176400:
+			sampling_freq=0x0c;
+			break;
+		case 192000:
+			sampling_freq=0x0e;
+			break;
+		default:
+			dev_err(codec->dev,
+			"Failed to set WM8804 SYSCLK, unsupported samplerate %d\n",
+			samplerate);
+	}
+
+	snd_soc_dai_set_clkdiv(codec_dai, WM8804_MCLK_DIV, mclk_div);
+	snd_soc_dai_set_pll(codec_dai, 0, 0, sysclk, mclk_freq);
+
+	ret = snd_soc_dai_set_sysclk(codec_dai, WM8804_TX_CLKSRC_PLL,
+					sysclk, SND_SOC_CLOCK_OUT);
+	if (ret < 0) {
+		dev_err(codec->dev,
+		"Failed to set WM8804 SYSCLK: %d\n", ret);
+		return ret;
+	}
+
+	/* Enable TX output */
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x4, 0x0);
+
+	/* Power on */
+	snd_soc_update_bits(codec, WM8804_PWRDN, 0x9, 0);
+
+	/* set sampling frequency status bits */
+	snd_soc_update_bits(codec, WM8804_SPDTX4, 0x0f, sampling_freq);
+
+	return snd_soc_dai_set_bclk_ratio(cpu_dai,64);
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_rpi_justboom_digi_ops = {
+	.hw_params = snd_rpi_justboom_digi_hw_params,
+        .startup = snd_rpi_justboom_digi_startup,
+        .shutdown = snd_rpi_justboom_digi_shutdown,
+};
+
+static struct snd_soc_dai_link snd_rpi_justboom_digi_dai[] = {
+{
+	.name		= "JustBoom Digi",
+	.stream_name	= "JustBoom Digi HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "wm8804-spdif",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "wm8804.1-003b",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBM_CFM,
+	.ops		= &snd_rpi_justboom_digi_ops,
+	.init		= snd_rpi_justboom_digi_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_justboom_digi = {
+	.name         = "snd_rpi_justboom_digi",
+	.driver_name  = "JustBoomDigi",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_rpi_justboom_digi_dai,
+	.num_links    = ARRAY_SIZE(snd_rpi_justboom_digi_dai),
+};
+
+static int snd_rpi_justboom_digi_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_rpi_justboom_digi.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+	    struct device_node *i2s_node;
+	    struct snd_soc_dai_link *dai = &snd_rpi_justboom_digi_dai[0];
+	    i2s_node = of_parse_phandle(pdev->dev.of_node,
+					"i2s-controller", 0);
+
+	    if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+	    }
+	}
+
+	ret = snd_soc_register_card(&snd_rpi_justboom_digi);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev,
+			"snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+static int snd_rpi_justboom_digi_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&snd_rpi_justboom_digi);
+}
+
+static const struct of_device_id snd_rpi_justboom_digi_of_match[] = {
+	{ .compatible = "justboom,justboom-digi", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_rpi_justboom_digi_of_match);
+
+static struct platform_driver snd_rpi_justboom_digi_driver = {
+	.driver = {
+		.name   = "snd-rpi-justboom-digi",
+		.owner  = THIS_MODULE,
+		.of_match_table = snd_rpi_justboom_digi_of_match,
+	},
+	.probe          = snd_rpi_justboom_digi_probe,
+	.remove         = snd_rpi_justboom_digi_remove,
+};
+
+module_platform_driver(snd_rpi_justboom_digi_driver);
+
+MODULE_AUTHOR("Milan Neskovic <info@justboom.co>");
+MODULE_DESCRIPTION("ASoC Driver for JustBoom PI Digi HAT Sound Card");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/pisound.c b/sound/soc/bcm/pisound.c
new file mode 100644
index 000000000000..ab9ea1f32931
--- /dev/null
+++ b/sound/soc/bcm/pisound.c
@@ -0,0 +1,1204 @@
+/*
+ * Pisound Linux kernel module.
+ * Copyright (C) 2016-2017  Vilniaus Blokas UAB, https://blokas.io/pisound
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; version 2 of the
+ * License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA  02110-1301, USA.
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/gpio.h>
+#include <linux/kobject.h>
+#include <linux/sysfs.h>
+#include <linux/delay.h>
+#include <linux/spi/spi.h>
+#include <linux/interrupt.h>
+#include <linux/kfifo.h>
+#include <linux/jiffies.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+#include <sound/rawmidi.h>
+#include <sound/asequencer.h>
+#include <sound/control.h>
+
+static int pisnd_spi_init(struct device *dev);
+static void pisnd_spi_uninit(void);
+
+static void pisnd_spi_flush(void);
+static void pisnd_spi_start(void);
+static uint8_t pisnd_spi_recv(uint8_t *buffer, uint8_t length);
+
+typedef void (*pisnd_spi_recv_cb)(void *data);
+static void pisnd_spi_set_callback(pisnd_spi_recv_cb cb, void *data);
+
+static const char *pisnd_spi_get_serial(void);
+static const char *pisnd_spi_get_id(void);
+static const char *pisnd_spi_get_version(void);
+
+static int pisnd_midi_init(struct snd_card *card);
+static void pisnd_midi_uninit(void);
+
+enum task_e {
+	TASK_PROCESS = 0,
+};
+
+static void pisnd_schedule_process(enum task_e task);
+
+#define PISOUND_LOG_PREFIX "pisound: "
+
+#ifdef PISOUND_DEBUG
+#	define printd(...) pr_alert(PISOUND_LOG_PREFIX __VA_ARGS__)
+#else
+#	define printd(...) do {} while (0)
+#endif
+
+#define printe(...) pr_err(PISOUND_LOG_PREFIX __VA_ARGS__)
+#define printi(...) pr_info(PISOUND_LOG_PREFIX __VA_ARGS__)
+
+static struct snd_rawmidi *g_rmidi;
+static struct snd_rawmidi_substream *g_midi_output_substream;
+
+static int pisnd_output_open(struct snd_rawmidi_substream *substream)
+{
+	g_midi_output_substream = substream;
+	return 0;
+}
+
+static int pisnd_output_close(struct snd_rawmidi_substream *substream)
+{
+	g_midi_output_substream = NULL;
+	return 0;
+}
+
+static void pisnd_output_trigger(
+	struct snd_rawmidi_substream *substream,
+	int up
+	)
+{
+	if (substream != g_midi_output_substream) {
+		printe("MIDI output trigger called for an unexpected stream!");
+		return;
+	}
+
+	if (!up)
+		return;
+
+	pisnd_spi_start();
+}
+
+static void pisnd_output_drain(struct snd_rawmidi_substream *substream)
+{
+	pisnd_spi_flush();
+}
+
+static int pisnd_input_open(struct snd_rawmidi_substream *substream)
+{
+	return 0;
+}
+
+static int pisnd_input_close(struct snd_rawmidi_substream *substream)
+{
+	return 0;
+}
+
+static void pisnd_midi_recv_callback(void *substream)
+{
+	uint8_t data[128];
+	uint8_t n = 0;
+
+	while ((n = pisnd_spi_recv(data, sizeof(data)))) {
+		int res = snd_rawmidi_receive(substream, data, n);
+		(void)res;
+		printd("midi recv %u bytes, res = %d\n", n, res);
+	}
+}
+
+static void pisnd_input_trigger(struct snd_rawmidi_substream *substream, int up)
+{
+	if (up) {
+		pisnd_spi_set_callback(pisnd_midi_recv_callback, substream);
+		pisnd_schedule_process(TASK_PROCESS);
+	} else {
+		pisnd_spi_set_callback(NULL, NULL);
+	}
+}
+
+static struct snd_rawmidi_ops pisnd_output_ops = {
+	.open = pisnd_output_open,
+	.close = pisnd_output_close,
+	.trigger = pisnd_output_trigger,
+	.drain = pisnd_output_drain,
+};
+
+static struct snd_rawmidi_ops pisnd_input_ops = {
+	.open = pisnd_input_open,
+	.close = pisnd_input_close,
+	.trigger = pisnd_input_trigger,
+};
+
+static void pisnd_get_port_info(
+	struct snd_rawmidi *rmidi,
+	int number,
+	struct snd_seq_port_info *seq_port_info
+	)
+{
+	seq_port_info->type =
+		SNDRV_SEQ_PORT_TYPE_MIDI_GENERIC |
+		SNDRV_SEQ_PORT_TYPE_HARDWARE |
+		SNDRV_SEQ_PORT_TYPE_PORT;
+	seq_port_info->midi_voices = 0;
+}
+
+static struct snd_rawmidi_global_ops pisnd_global_ops = {
+	.get_port_info = pisnd_get_port_info,
+};
+
+static int pisnd_midi_init(struct snd_card *card)
+{
+	int err;
+
+	g_midi_output_substream = NULL;
+
+	err = snd_rawmidi_new(card, "pisound MIDI", 0, 1, 1, &g_rmidi);
+
+	if (err < 0) {
+		printe("snd_rawmidi_new failed: %d\n", err);
+		return err;
+	}
+
+	strcpy(g_rmidi->name, "pisound MIDI ");
+	strcat(g_rmidi->name, pisnd_spi_get_serial());
+
+	g_rmidi->info_flags =
+		SNDRV_RAWMIDI_INFO_OUTPUT |
+		SNDRV_RAWMIDI_INFO_INPUT |
+		SNDRV_RAWMIDI_INFO_DUPLEX;
+
+	g_rmidi->ops = &pisnd_global_ops;
+
+	g_rmidi->private_data = (void *)0;
+
+	snd_rawmidi_set_ops(
+		g_rmidi,
+		SNDRV_RAWMIDI_STREAM_OUTPUT,
+		&pisnd_output_ops
+		);
+
+	snd_rawmidi_set_ops(
+		g_rmidi,
+		SNDRV_RAWMIDI_STREAM_INPUT,
+		&pisnd_input_ops
+		);
+
+	return 0;
+}
+
+static void pisnd_midi_uninit(void)
+{
+}
+
+static void *g_recvData;
+static pisnd_spi_recv_cb g_recvCallback;
+
+#define FIFO_SIZE 4096
+
+static char g_serial_num[11];
+static char g_id[25];
+static char g_version[5];
+
+static uint8_t g_ledFlashDuration;
+static bool    g_ledFlashDurationChanged;
+
+DEFINE_KFIFO(spi_fifo_in,  uint8_t, FIFO_SIZE);
+DEFINE_KFIFO(spi_fifo_out, uint8_t, FIFO_SIZE);
+
+static struct gpio_desc *data_available;
+static struct gpio_desc *spi_reset;
+
+static struct spi_device *pisnd_spi_device;
+
+static struct workqueue_struct *pisnd_workqueue;
+static struct work_struct pisnd_work_process;
+
+static void pisnd_work_handler(struct work_struct *work);
+
+static void spi_transfer(const uint8_t *txbuf, uint8_t *rxbuf, int len);
+static uint16_t spi_transfer16(uint16_t val);
+
+static int pisnd_init_workqueues(void)
+{
+	pisnd_workqueue = create_singlethread_workqueue("pisnd_workqueue");
+	INIT_WORK(&pisnd_work_process, pisnd_work_handler);
+
+	return 0;
+}
+
+static void pisnd_uninit_workqueues(void)
+{
+	flush_workqueue(pisnd_workqueue);
+	destroy_workqueue(pisnd_workqueue);
+
+	pisnd_workqueue = NULL;
+}
+
+static bool pisnd_spi_has_more(void)
+{
+	return gpiod_get_value(data_available);
+}
+
+static void pisnd_schedule_process(enum task_e task)
+{
+	if (pisnd_spi_device != NULL &&
+		pisnd_workqueue != NULL &&
+		!work_pending(&pisnd_work_process)
+		) {
+		printd("schedule: has more = %d\n", pisnd_spi_has_more());
+		if (task == TASK_PROCESS)
+			queue_work(pisnd_workqueue, &pisnd_work_process);
+	}
+}
+
+static irqreturn_t data_available_interrupt_handler(int irq, void *dev_id)
+{
+	if (irq == gpiod_to_irq(data_available) && pisnd_spi_has_more()) {
+		printd("schedule from irq\n");
+		pisnd_schedule_process(TASK_PROCESS);
+	}
+
+	return IRQ_HANDLED;
+}
+
+static DEFINE_SPINLOCK(spilock);
+static unsigned long spilockflags;
+
+static uint16_t spi_transfer16(uint16_t val)
+{
+	uint8_t txbuf[2];
+	uint8_t rxbuf[2];
+
+	if (!pisnd_spi_device) {
+		printe("pisnd_spi_device null, returning\n");
+		return 0;
+	}
+
+	txbuf[0] = val >> 8;
+	txbuf[1] = val & 0xff;
+
+	spi_transfer(txbuf, rxbuf, sizeof(txbuf));
+
+	printd("received: %02x%02x\n", rxbuf[0], rxbuf[1]);
+
+	return (rxbuf[0] << 8) | rxbuf[1];
+}
+
+static void spi_transfer(const uint8_t *txbuf, uint8_t *rxbuf, int len)
+{
+	int err;
+	struct spi_transfer transfer;
+	struct spi_message msg;
+
+	memset(rxbuf, 0, len);
+
+	if (!pisnd_spi_device) {
+		printe("pisnd_spi_device null, returning\n");
+		return;
+	}
+
+	spi_message_init(&msg);
+
+	memset(&transfer, 0, sizeof(transfer));
+
+	transfer.tx_buf = txbuf;
+	transfer.rx_buf = rxbuf;
+	transfer.len = len;
+	transfer.speed_hz = 100000;
+	transfer.delay_usecs = 10;
+	spi_message_add_tail(&transfer, &msg);
+
+	spin_lock_irqsave(&spilock, spilockflags);
+	err = spi_sync(pisnd_spi_device, &msg);
+	spin_unlock_irqrestore(&spilock, spilockflags);
+
+	if (err < 0) {
+		printe("spi_sync error %d\n", err);
+		return;
+	}
+
+	printd("hasMore %d\n", pisnd_spi_has_more());
+}
+
+static int spi_read_bytes(char *dst, size_t length, uint8_t *bytesRead)
+{
+	uint16_t rx;
+	uint8_t size;
+	uint8_t i;
+
+	memset(dst, 0, length);
+	*bytesRead = 0;
+
+	rx = spi_transfer16(0);
+	if (!(rx >> 8))
+		return -EINVAL;
+
+	size = rx & 0xff;
+
+	if (size > length)
+		return -EINVAL;
+
+	for (i = 0; i < size; ++i) {
+		rx = spi_transfer16(0);
+		if (!(rx >> 8))
+			return -EINVAL;
+
+		dst[i] = rx & 0xff;
+	}
+
+	*bytesRead = i;
+
+	return 0;
+}
+
+static int spi_device_match(struct device *dev, void *data)
+{
+	struct spi_device *spi = container_of(dev, struct spi_device, dev);
+
+	printd("      %s %s %dkHz %d bits mode=0x%02X\n",
+		spi->modalias, dev_name(dev), spi->max_speed_hz/1000,
+		spi->bits_per_word, spi->mode);
+
+	if (strcmp("pisound-spi", spi->modalias) == 0) {
+		printi("\tFound!\n");
+		return 1;
+	}
+
+	printe("\tNot found!\n");
+	return 0;
+}
+
+static struct spi_device *pisnd_spi_find_device(void)
+{
+	struct device *dev;
+
+	printi("Searching for spi device...\n");
+	dev = bus_find_device(&spi_bus_type, NULL, NULL, spi_device_match);
+	if (dev != NULL)
+		return container_of(dev, struct spi_device, dev);
+	else
+		return NULL;
+}
+
+static void pisnd_work_handler(struct work_struct *work)
+{
+	enum { TRANSFER_SIZE = 4 };
+	enum { PISOUND_OUTPUT_BUFFER_SIZE = 128 };
+	enum { MIDI_BYTES_PER_SECOND = 3125 };
+	int out_buffer_used = 0;
+	unsigned long now;
+	uint8_t val;
+	uint8_t txbuf[TRANSFER_SIZE];
+	uint8_t rxbuf[TRANSFER_SIZE];
+	uint8_t midibuf[TRANSFER_SIZE];
+	int i, n;
+	bool had_data;
+
+	unsigned long last_transfer_at = jiffies;
+
+	if (work == &pisnd_work_process) {
+		if (pisnd_spi_device == NULL)
+			return;
+
+		do {
+			if (g_midi_output_substream &&
+				kfifo_avail(&spi_fifo_out) >= sizeof(midibuf)) {
+
+				n = snd_rawmidi_transmit_peek(
+					g_midi_output_substream,
+					midibuf, sizeof(midibuf)
+				);
+
+				if (n > 0) {
+					for (i = 0; i < n; ++i)
+						kfifo_put(
+							&spi_fifo_out,
+							midibuf[i]
+							);
+					snd_rawmidi_transmit_ack(
+						g_midi_output_substream,
+						i
+						);
+				}
+			}
+
+			had_data = false;
+			memset(txbuf, 0, sizeof(txbuf));
+			for (i = 0; i < sizeof(txbuf) &&
+				out_buffer_used < PISOUND_OUTPUT_BUFFER_SIZE;
+				i += 2) {
+
+				val = 0;
+
+				if (g_ledFlashDurationChanged) {
+					txbuf[i+0] = 0xf0;
+					txbuf[i+1] = g_ledFlashDuration;
+					g_ledFlashDuration = 0;
+					g_ledFlashDurationChanged = false;
+				} else if (kfifo_get(&spi_fifo_out, &val)) {
+					txbuf[i+0] = 0x0f;
+					txbuf[i+1] = val;
+					++out_buffer_used;
+				}
+			}
+
+			spi_transfer(txbuf, rxbuf, sizeof(txbuf));
+			/* Estimate the Pisound's MIDI output buffer usage, so
+			 * that we don't overflow it. Space in the buffer should
+			 * be becoming available at the UART MIDI byte transfer
+			 * rate.
+			 */
+			now = jiffies;
+			out_buffer_used -=
+				(MIDI_BYTES_PER_SECOND / HZ) /
+				(now - last_transfer_at);
+			if (out_buffer_used < 0)
+				out_buffer_used = 0;
+			last_transfer_at = now;
+
+			for (i = 0; i < sizeof(rxbuf); i += 2) {
+				if (rxbuf[i]) {
+					kfifo_put(&spi_fifo_in, rxbuf[i+1]);
+					if (kfifo_len(&spi_fifo_in) > 16 &&
+						g_recvCallback)
+						g_recvCallback(g_recvData);
+					had_data = true;
+				}
+			}
+		} while (had_data
+			|| !kfifo_is_empty(&spi_fifo_out)
+			|| pisnd_spi_has_more()
+			|| g_ledFlashDurationChanged
+			);
+
+		if (!kfifo_is_empty(&spi_fifo_in) && g_recvCallback)
+			g_recvCallback(g_recvData);
+	}
+}
+
+static int pisnd_spi_gpio_init(struct device *dev)
+{
+	spi_reset = gpiod_get_index(dev, "reset", 1, GPIOD_ASIS);
+	data_available = gpiod_get_index(dev, "data_available", 0, GPIOD_ASIS);
+
+	gpiod_direction_output(spi_reset, 1);
+	gpiod_direction_input(data_available);
+
+	/* Reset the slave. */
+	gpiod_set_value(spi_reset, false);
+	mdelay(1);
+	gpiod_set_value(spi_reset, true);
+
+	/* Give time for spi slave to start. */
+	mdelay(64);
+
+	return 0;
+}
+
+static void pisnd_spi_gpio_uninit(void)
+{
+	gpiod_set_value(spi_reset, false);
+	gpiod_put(spi_reset);
+	spi_reset = NULL;
+
+	gpiod_put(data_available);
+	data_available = NULL;
+}
+
+static int pisnd_spi_gpio_irq_init(struct device *dev)
+{
+	return request_irq(
+		gpiod_to_irq(data_available),
+		data_available_interrupt_handler,
+		IRQF_TIMER | IRQF_TRIGGER_RISING,
+		"data_available_int",
+		NULL
+		);
+}
+
+static void pisnd_spi_gpio_irq_uninit(void)
+{
+	free_irq(gpiod_to_irq(data_available), NULL);
+}
+
+static int spi_read_info(void)
+{
+	uint16_t tmp;
+	uint8_t count;
+	uint8_t n;
+	uint8_t i;
+	uint8_t j;
+	char buffer[257];
+	int ret;
+	char *p;
+
+	memset(g_serial_num, 0, sizeof(g_serial_num));
+	memset(g_version, 0, sizeof(g_version));
+	memset(g_id, 0, sizeof(g_id));
+
+	tmp = spi_transfer16(0);
+
+	if (!(tmp >> 8))
+		return -EINVAL;
+
+	count = tmp & 0xff;
+
+	for (i = 0; i < count; ++i) {
+		memset(buffer, 0, sizeof(buffer));
+		ret = spi_read_bytes(buffer, sizeof(buffer)-1, &n);
+
+		if (ret < 0)
+			return ret;
+
+		switch (i) {
+		case 0:
+			if (n != 2)
+				return -EINVAL;
+
+			snprintf(
+				g_version,
+				sizeof(g_version),
+				"%x.%02x",
+				buffer[0],
+				buffer[1]
+				);
+			break;
+		case 1:
+			if (n >= sizeof(g_serial_num))
+				return -EINVAL;
+
+			memcpy(g_serial_num, buffer, sizeof(g_serial_num));
+			break;
+		case 2:
+			{
+				if (n >= sizeof(g_id))
+					return -EINVAL;
+
+				p = g_id;
+				for (j = 0; j < n; ++j)
+					p += sprintf(p, "%02x", buffer[j]);
+			}
+			break;
+		default:
+			break;
+		}
+	}
+
+	return 0;
+}
+
+static int pisnd_spi_init(struct device *dev)
+{
+	int ret;
+	struct spi_device *spi;
+
+	memset(g_serial_num, 0, sizeof(g_serial_num));
+	memset(g_id, 0, sizeof(g_id));
+	memset(g_version, 0, sizeof(g_version));
+
+	spi = pisnd_spi_find_device();
+
+	if (spi != NULL) {
+		printd("initializing spi!\n");
+		pisnd_spi_device = spi;
+		ret = spi_setup(pisnd_spi_device);
+	} else {
+		printe("SPI device not found, deferring!\n");
+		return -EPROBE_DEFER;
+	}
+
+	ret = pisnd_spi_gpio_init(dev);
+
+	if (ret < 0) {
+		printe("SPI GPIO init failed: %d\n", ret);
+		spi_dev_put(pisnd_spi_device);
+		pisnd_spi_device = NULL;
+		pisnd_spi_gpio_uninit();
+		return ret;
+	}
+
+	ret = spi_read_info();
+
+	if (ret < 0) {
+		printe("Reading card info failed: %d\n", ret);
+		spi_dev_put(pisnd_spi_device);
+		pisnd_spi_device = NULL;
+		pisnd_spi_gpio_uninit();
+		return ret;
+	}
+
+	/* Flash the LEDs. */
+	spi_transfer16(0xf008);
+
+	ret = pisnd_spi_gpio_irq_init(dev);
+	if (ret < 0) {
+		printe("SPI irq request failed: %d\n", ret);
+		spi_dev_put(pisnd_spi_device);
+		pisnd_spi_device = NULL;
+		pisnd_spi_gpio_irq_uninit();
+		pisnd_spi_gpio_uninit();
+	}
+
+	ret = pisnd_init_workqueues();
+	if (ret != 0) {
+		printe("Workqueue initialization failed: %d\n", ret);
+		spi_dev_put(pisnd_spi_device);
+		pisnd_spi_device = NULL;
+		pisnd_spi_gpio_irq_uninit();
+		pisnd_spi_gpio_uninit();
+		pisnd_uninit_workqueues();
+		return ret;
+	}
+
+	if (pisnd_spi_has_more()) {
+		printd("data is available, scheduling from init\n");
+		pisnd_schedule_process(TASK_PROCESS);
+	}
+
+	return 0;
+}
+
+static void pisnd_spi_uninit(void)
+{
+	pisnd_uninit_workqueues();
+
+	spi_dev_put(pisnd_spi_device);
+	pisnd_spi_device = NULL;
+
+	pisnd_spi_gpio_irq_uninit();
+	pisnd_spi_gpio_uninit();
+}
+
+static void pisnd_spi_flash_leds(uint8_t duration)
+{
+	g_ledFlashDuration = duration;
+	g_ledFlashDurationChanged = true;
+	printd("schedule from spi_flash_leds\n");
+	pisnd_schedule_process(TASK_PROCESS);
+}
+
+static void pisnd_spi_flush(void)
+{
+	while (!kfifo_is_empty(&spi_fifo_out)) {
+		pisnd_spi_start();
+		flush_workqueue(pisnd_workqueue);
+	}
+}
+
+static void pisnd_spi_start(void)
+{
+	printd("schedule from spi_start\n");
+	pisnd_schedule_process(TASK_PROCESS);
+}
+
+static uint8_t pisnd_spi_recv(uint8_t *buffer, uint8_t length)
+{
+	return kfifo_out(&spi_fifo_in, buffer, length);
+}
+
+static void pisnd_spi_set_callback(pisnd_spi_recv_cb cb, void *data)
+{
+	g_recvData = data;
+	g_recvCallback = cb;
+}
+
+static const char *pisnd_spi_get_serial(void)
+{
+	if (strlen(g_serial_num))
+		return g_serial_num;
+
+	return "";
+}
+
+static const char *pisnd_spi_get_id(void)
+{
+	if (strlen(g_id))
+		return g_id;
+
+	return "";
+}
+
+static const char *pisnd_spi_get_version(void)
+{
+	if (strlen(g_version))
+		return g_version;
+
+	return "";
+}
+
+static const struct of_device_id pisound_of_match[] = {
+	{ .compatible = "blokaslabs,pisound", },
+	{ .compatible = "blokaslabs,pisound-spi", },
+	{},
+};
+
+enum {
+	SWITCH = 0,
+	VOLUME = 1,
+};
+
+static int pisnd_ctl_info(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_info *uinfo)
+{
+	if (kcontrol->private_value == SWITCH) {
+		uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
+		uinfo->count = 1;
+		uinfo->value.integer.min = 0;
+		uinfo->value.integer.max = 1;
+		return 0;
+	} else if (kcontrol->private_value == VOLUME) {
+		uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
+		uinfo->count = 1;
+		uinfo->value.integer.min = 0;
+		uinfo->value.integer.max = 100;
+		return 0;
+	}
+	return -EINVAL;
+}
+
+static int pisnd_ctl_get(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	if (kcontrol->private_value == SWITCH) {
+		ucontrol->value.integer.value[0] = 1;
+		return 0;
+	} else if (kcontrol->private_value == VOLUME) {
+		ucontrol->value.integer.value[0] = 100;
+		return 0;
+	}
+
+	return -EINVAL;
+}
+
+static struct snd_kcontrol_new pisnd_ctl[] = {
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "PCM Playback Switch",
+		.index = 0,
+		.private_value = SWITCH,
+		.access = SNDRV_CTL_ELEM_ACCESS_READ,
+		.info = pisnd_ctl_info,
+		.get = pisnd_ctl_get,
+	},
+	{
+		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name = "PCM Playback Volume",
+		.index = 0,
+		.private_value = VOLUME,
+		.access = SNDRV_CTL_ELEM_ACCESS_READ,
+		.info = pisnd_ctl_info,
+		.get = pisnd_ctl_get,
+	},
+};
+
+static int pisnd_ctl_init(struct snd_card *card)
+{
+	int err, i;
+
+	for (i = 0; i < ARRAY_SIZE(pisnd_ctl); ++i) {
+		err = snd_ctl_add(card, snd_ctl_new1(&pisnd_ctl[i], NULL));
+		if (err < 0)
+			return err;
+	}
+
+	return 0;
+}
+
+static int pisnd_ctl_uninit(void)
+{
+	return 0;
+}
+
+static struct gpio_desc *osr0, *osr1, *osr2;
+static struct gpio_desc *reset;
+static struct gpio_desc *button;
+
+static int pisnd_hw_params(
+	struct snd_pcm_substream *substream,
+	struct snd_pcm_hw_params *params
+	)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+
+	/* Pisound runs on fixed 32 clock counts per channel,
+	 * as generated by the master ADC.
+	 */
+	snd_soc_dai_set_bclk_ratio(cpu_dai, 32*2);
+
+	printd("rate   = %d\n", params_rate(params));
+	printd("ch     = %d\n", params_channels(params));
+	printd("bits   = %u\n",
+		snd_pcm_format_physical_width(params_format(params)));
+	printd("format = %d\n", params_format(params));
+
+	gpiod_set_value(reset, false);
+
+	switch (params_rate(params)) {
+	case 48000:
+		gpiod_set_value(osr0, true);
+		gpiod_set_value(osr1, false);
+		gpiod_set_value(osr2, false);
+		break;
+	case 96000:
+		gpiod_set_value(osr0, true);
+		gpiod_set_value(osr1, false);
+		gpiod_set_value(osr2, true);
+		break;
+	case 192000:
+		gpiod_set_value(osr0, true);
+		gpiod_set_value(osr1, true);
+		gpiod_set_value(osr2, true);
+		break;
+	default:
+		printe("Unsupported rate %u!\n", params_rate(params));
+		return -EINVAL;
+	}
+
+	gpiod_set_value(reset, true);
+
+	return 0;
+}
+
+static unsigned int rates[3] = {
+	48000, 96000, 192000
+};
+
+static struct snd_pcm_hw_constraint_list constraints_rates = {
+	.count = ARRAY_SIZE(rates),
+	.list = rates,
+	.mask = 0,
+};
+
+static int pisnd_startup(struct snd_pcm_substream *substream)
+{
+	int err = snd_pcm_hw_constraint_list(
+		substream->runtime,
+		0,
+		SNDRV_PCM_HW_PARAM_RATE,
+		&constraints_rates
+		);
+
+	if (err < 0)
+		return err;
+
+	err = snd_pcm_hw_constraint_single(
+		substream->runtime,
+		SNDRV_PCM_HW_PARAM_CHANNELS,
+		2
+		);
+
+	if (err < 0)
+		return err;
+
+	err = snd_pcm_hw_constraint_mask64(
+		substream->runtime,
+		SNDRV_PCM_HW_PARAM_FORMAT,
+		SNDRV_PCM_FMTBIT_S16_LE |
+		SNDRV_PCM_FMTBIT_S24_LE |
+		SNDRV_PCM_FMTBIT_S32_LE
+		);
+
+	if (err < 0)
+		return err;
+
+	return 0;
+}
+
+static struct snd_soc_ops pisnd_ops = {
+	.startup = pisnd_startup,
+	.hw_params = pisnd_hw_params,
+};
+
+static struct snd_soc_dai_link pisnd_dai[] = {
+	{
+		.name           = "pisound",
+		.stream_name    = "pisound",
+		.cpu_dai_name   = "bcm2708-i2s.0",
+		.codec_dai_name = "snd-soc-dummy-dai",
+		.platform_name  = "bcm2708-i2s.0",
+		.codec_name     = "snd-soc-dummy",
+		.dai_fmt        =
+			SND_SOC_DAIFMT_I2S |
+			SND_SOC_DAIFMT_NB_NF |
+			SND_SOC_DAIFMT_CBM_CFM,
+		.ops            = &pisnd_ops,
+	},
+};
+
+static int pisnd_card_probe(struct snd_soc_card *card)
+{
+	int err = pisnd_midi_init(card->snd_card);
+
+	if (err < 0) {
+		printe("pisnd_midi_init failed: %d\n", err);
+		return err;
+	}
+
+	err = pisnd_ctl_init(card->snd_card);
+	if (err < 0) {
+		printe("pisnd_ctl_init failed: %d\n", err);
+		return err;
+	}
+
+	return 0;
+}
+
+static int pisnd_card_remove(struct snd_soc_card *card)
+{
+	pisnd_ctl_uninit();
+	pisnd_midi_uninit();
+	return 0;
+}
+
+static struct snd_soc_card pisnd_card = {
+	.name         = "pisound",
+	.owner        = THIS_MODULE,
+	.dai_link     = pisnd_dai,
+	.num_links    = ARRAY_SIZE(pisnd_dai),
+	.probe        = pisnd_card_probe,
+	.remove       = pisnd_card_remove,
+};
+
+static int pisnd_init_gpio(struct device *dev)
+{
+	osr0 = gpiod_get_index(dev, "osr", 0, GPIOD_ASIS);
+	osr1 = gpiod_get_index(dev, "osr", 1, GPIOD_ASIS);
+	osr2 = gpiod_get_index(dev, "osr", 2, GPIOD_ASIS);
+
+	reset = gpiod_get_index(dev, "reset", 0, GPIOD_ASIS);
+
+	button = gpiod_get_index(dev, "button", 0, GPIOD_ASIS);
+
+	gpiod_direction_output(osr0,  1);
+	gpiod_direction_output(osr1,  1);
+	gpiod_direction_output(osr2,  1);
+	gpiod_direction_output(reset, 1);
+
+	gpiod_set_value(reset, false);
+	gpiod_set_value(osr0,   true);
+	gpiod_set_value(osr1,  false);
+	gpiod_set_value(osr2,  false);
+	gpiod_set_value(reset,  true);
+
+	gpiod_export(button, false);
+
+	return 0;
+}
+
+static int pisnd_uninit_gpio(void)
+{
+	int i;
+
+	struct gpio_desc **gpios[] = {
+		&osr0, &osr1, &osr2, &reset, &button,
+	};
+
+	gpiod_unexport(button);
+
+	for (i = 0; i < ARRAY_SIZE(gpios); ++i) {
+		if (*gpios[i] == NULL) {
+			printd("weird, GPIO[%d] is NULL already\n", i);
+			continue;
+		}
+
+		gpiod_put(*gpios[i]);
+		*gpios[i] = NULL;
+	}
+
+	return 0;
+}
+
+static struct kobject *pisnd_kobj;
+
+static ssize_t pisnd_serial_show(
+	struct kobject *kobj,
+	struct kobj_attribute *attr,
+	char *buf
+	)
+{
+	return sprintf(buf, "%s\n", pisnd_spi_get_serial());
+}
+
+static ssize_t pisnd_id_show(
+	struct kobject *kobj,
+	struct kobj_attribute *attr,
+	char *buf
+	)
+{
+	return sprintf(buf, "%s\n", pisnd_spi_get_id());
+}
+
+static ssize_t pisnd_version_show(
+	struct kobject *kobj,
+	struct kobj_attribute *attr,
+	char *buf
+	)
+{
+	return sprintf(buf, "%s\n", pisnd_spi_get_version());
+}
+
+static ssize_t pisnd_led_store(
+	struct kobject *kobj,
+	struct kobj_attribute *attr,
+	const char *buf,
+	size_t length
+	)
+{
+	uint32_t timeout;
+	int err;
+
+	err = kstrtou32(buf, 10, &timeout);
+
+	if (err == 0 && timeout <= 255)
+		pisnd_spi_flash_leds(timeout);
+
+	return length;
+}
+
+static struct kobj_attribute pisnd_serial_attribute =
+	__ATTR(serial, 0444, pisnd_serial_show, NULL);
+static struct kobj_attribute pisnd_id_attribute =
+	__ATTR(id, 0444, pisnd_id_show, NULL);
+static struct kobj_attribute pisnd_version_attribute =
+	__ATTR(version, 0444, pisnd_version_show, NULL);
+static struct kobj_attribute pisnd_led_attribute =
+	__ATTR(led, 0644, NULL, pisnd_led_store);
+
+static struct attribute *attrs[] = {
+	&pisnd_serial_attribute.attr,
+	&pisnd_id_attribute.attr,
+	&pisnd_version_attribute.attr,
+	&pisnd_led_attribute.attr,
+	NULL
+};
+
+static struct attribute_group attr_group = { .attrs = attrs };
+
+static int pisnd_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+	int i;
+
+	ret = pisnd_spi_init(&pdev->dev);
+	if (ret < 0) {
+		printe("pisnd_spi_init failed: %d\n", ret);
+		return ret;
+	}
+
+	printi("Detected Pisound card:\n");
+	printi("\tSerial:  %s\n", pisnd_spi_get_serial());
+	printi("\tVersion: %s\n", pisnd_spi_get_version());
+	printi("\tId:      %s\n", pisnd_spi_get_id());
+
+	pisnd_kobj = kobject_create_and_add("pisound", kernel_kobj);
+	if (!pisnd_kobj) {
+		pisnd_spi_uninit();
+		return -ENOMEM;
+	}
+
+	ret = sysfs_create_group(pisnd_kobj, &attr_group);
+	if (ret < 0) {
+		pisnd_spi_uninit();
+		kobject_put(pisnd_kobj);
+		return -ENOMEM;
+	}
+
+	pisnd_init_gpio(&pdev->dev);
+	pisnd_card.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+
+		i2s_node = of_parse_phandle(
+			pdev->dev.of_node,
+			"i2s-controller",
+			0
+			);
+
+		for (i = 0; i < pisnd_card.num_links; ++i) {
+			struct snd_soc_dai_link *dai = &pisnd_dai[i];
+
+			if (i2s_node) {
+				dai->cpu_dai_name = NULL;
+				dai->cpu_of_node = i2s_node;
+				dai->platform_name = NULL;
+				dai->platform_of_node = i2s_node;
+				dai->stream_name = pisnd_spi_get_serial();
+			}
+		}
+	}
+
+	ret = snd_soc_register_card(&pisnd_card);
+
+	if (ret < 0) {
+		if (ret != -EPROBE_DEFER)
+			printe("snd_soc_register_card() failed: %d\n", ret);
+		pisnd_uninit_gpio();
+		kobject_put(pisnd_kobj);
+		pisnd_spi_uninit();
+	}
+
+	return ret;
+}
+
+static int pisnd_remove(struct platform_device *pdev)
+{
+	printi("Unloading.\n");
+
+	if (pisnd_kobj) {
+		kobject_put(pisnd_kobj);
+		pisnd_kobj = NULL;
+	}
+
+	pisnd_spi_uninit();
+
+	/* Turn off */
+	gpiod_set_value(reset, false);
+	pisnd_uninit_gpio();
+
+	return snd_soc_unregister_card(&pisnd_card);
+}
+
+MODULE_DEVICE_TABLE(of, pisound_of_match);
+
+static struct platform_driver pisnd_driver = {
+	.driver = {
+		.name           = "snd-rpi-pisound",
+		.owner          = THIS_MODULE,
+		.of_match_table = pisound_of_match,
+	},
+	.probe              = pisnd_probe,
+	.remove             = pisnd_remove,
+};
+
+module_platform_driver(pisnd_driver);
+
+MODULE_AUTHOR("Giedrius Trainavicius <giedrius@blokas.io>");
+MODULE_DESCRIPTION("ASoC Driver for Pisound, https://blokas.io/pisound");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/rpi-cirrus.c b/sound/soc/bcm/rpi-cirrus.c
new file mode 100644
index 000000000000..ac8651ddff7b
--- /dev/null
+++ b/sound/soc/bcm/rpi-cirrus.c
@@ -0,0 +1,1003 @@
+/*
+ * ASoC machine driver for Cirrus Logic Audio Card
+ * (with WM5102 and WM8804 codecs)
+ *
+ * Copyright 2015-2017 Matthias Reichl <hias@horus.com>
+ *
+ * Based on rpi-cirrus-sound-pi driver (c) Wolfson / Cirrus Logic Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/delay.h>
+#include <sound/pcm_params.h>
+
+#include <linux/mfd/arizona/registers.h>
+
+#include "../codecs/wm5102.h"
+#include "../codecs/wm8804.h"
+
+#define WM8804_CLKOUT_HZ 12000000
+
+#define RPI_CIRRUS_DEFAULT_RATE 44100
+#define WM5102_MAX_SYSCLK_1 49152000 /* max sysclk for 4K family */
+#define WM5102_MAX_SYSCLK_2 45158400 /* max sysclk for 11.025K family */
+
+static inline unsigned int calc_sysclk(unsigned int rate)
+{
+	return (rate % 4000) ? WM5102_MAX_SYSCLK_2 : WM5102_MAX_SYSCLK_1;
+}
+
+enum {
+	DAI_WM5102 = 0,
+	DAI_WM8804,
+};
+
+struct rpi_cirrus_priv {
+	/* mutex for synchronzing FLL1 access with DAPM */
+	struct mutex lock;
+	unsigned int card_rate;
+	int sync_path_enable;
+	int fll1_freq; /* negative means RefClock in spdif rx case */
+
+	/* track hw params/free for substreams */
+	unsigned int params_set;
+	unsigned int min_rate_idx, max_rate_idx;
+	unsigned char iec958_status[4];
+};
+
+/* helper functions */
+static inline struct snd_soc_pcm_runtime *get_wm5102_runtime(
+	struct snd_soc_card *card) {
+	return snd_soc_get_pcm_runtime(card, card->dai_link[DAI_WM5102].name);
+}
+
+static inline struct snd_soc_pcm_runtime *get_wm8804_runtime(
+	struct snd_soc_card *card) {
+	return snd_soc_get_pcm_runtime(card, card->dai_link[DAI_WM8804].name);
+}
+
+
+struct rate_info {
+	unsigned int value;
+	char *text;
+};
+
+static struct rate_info min_rates[] = {
+	{     0, "off"},
+	{ 32000, "32kHz"},
+	{ 44100, "44.1kHz"}
+};
+
+#define NUM_MIN_RATES ARRAY_SIZE(min_rates)
+
+static int rpi_cirrus_min_rate_info(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_info *uinfo)
+{
+	uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
+	uinfo->count = 1;
+	uinfo->value.enumerated.items = NUM_MIN_RATES;
+
+	if (uinfo->value.enumerated.item >= NUM_MIN_RATES)
+		uinfo->value.enumerated.item = NUM_MIN_RATES - 1;
+	strcpy(uinfo->value.enumerated.name,
+		min_rates[uinfo->value.enumerated.item].text);
+	return 0;
+}
+
+static int rpi_cirrus_min_rate_get(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+
+	ucontrol->value.enumerated.item[0] = priv->min_rate_idx;
+	return 0;
+}
+
+static int rpi_cirrus_min_rate_put(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	int changed = 0;
+
+	if (priv->min_rate_idx != ucontrol->value.enumerated.item[0]) {
+		changed = 1;
+		priv->min_rate_idx = ucontrol->value.enumerated.item[0];
+	}
+
+	return changed;
+}
+
+static struct rate_info max_rates[] = {
+	{     0, "off"},
+	{ 48000, "48kHz"},
+	{ 96000, "96kHz"}
+};
+
+#define NUM_MAX_RATES ARRAY_SIZE(max_rates)
+
+static int rpi_cirrus_max_rate_info(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_info *uinfo)
+{
+	uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
+	uinfo->count = 1;
+	uinfo->value.enumerated.items = NUM_MAX_RATES;
+	if (uinfo->value.enumerated.item >= NUM_MAX_RATES)
+		uinfo->value.enumerated.item = NUM_MAX_RATES - 1;
+	strcpy(uinfo->value.enumerated.name,
+		max_rates[uinfo->value.enumerated.item].text);
+	return 0;
+}
+
+static int rpi_cirrus_max_rate_get(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+
+	ucontrol->value.enumerated.item[0] = priv->max_rate_idx;
+	return 0;
+}
+
+static int rpi_cirrus_max_rate_put(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	int changed = 0;
+
+	if (priv->max_rate_idx != ucontrol->value.enumerated.item[0]) {
+		changed = 1;
+		priv->max_rate_idx = ucontrol->value.enumerated.item[0];
+	}
+
+	return changed;
+}
+
+static int rpi_cirrus_spdif_info(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_info *uinfo)
+{
+	uinfo->type = SNDRV_CTL_ELEM_TYPE_IEC958;
+	uinfo->count = 1;
+	return 0;
+}
+
+static int rpi_cirrus_spdif_playback_get(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	int i;
+
+	for (i = 0; i < 4; i++)
+		ucontrol->value.iec958.status[i] = priv->iec958_status[i];
+
+	return 0;
+}
+
+static int rpi_cirrus_spdif_playback_put(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_codec *wm8804_codec = get_wm8804_runtime(card)->codec;
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	unsigned char *stat = priv->iec958_status;
+	unsigned char *ctrl_stat = ucontrol->value.iec958.status;
+	unsigned int mask;
+	int i, changed = 0;
+
+	for (i = 0; i < 4; i++) {
+		mask = (i == 3) ? 0x3f : 0xff;
+		if ((ctrl_stat[i] & mask) != (stat[i] & mask)) {
+			changed = 1;
+			stat[i] = ctrl_stat[i] & mask;
+			snd_soc_update_bits(wm8804_codec,
+				WM8804_SPDTX1 + i, mask, stat[i]);
+		}
+	}
+
+	return changed;
+}
+
+static int rpi_cirrus_spdif_mask_get(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	ucontrol->value.iec958.status[0] = 0xff;
+	ucontrol->value.iec958.status[1] = 0xff;
+	ucontrol->value.iec958.status[2] = 0xff;
+	ucontrol->value.iec958.status[3] = 0x3f;
+
+	return 0;
+}
+
+static int rpi_cirrus_spdif_capture_get(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_codec *wm8804_codec = get_wm8804_runtime(card)->codec;
+	unsigned int mask;
+	int i;
+
+	for (i = 0; i < 4; i++) {
+		mask = (i == 3) ? 0x3f : 0xff;
+		ucontrol->value.iec958.status[i] =
+			snd_soc_read(wm8804_codec, WM8804_RXCHAN1 + i) & mask;
+	}
+
+	return 0;
+}
+
+#define SPDIF_FLAG_CTRL(desc, reg, bit, invert) \
+{ \
+		.access =  SNDRV_CTL_ELEM_ACCESS_READ \
+			   | SNDRV_CTL_ELEM_ACCESS_VOLATILE, \
+		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER, \
+		.name =    SNDRV_CTL_NAME_IEC958("", CAPTURE, NONE) \
+				desc " Flag", \
+		.info =    snd_ctl_boolean_mono_info, \
+		.get =     rpi_cirrus_spdif_status_flag_get, \
+		.private_value = \
+			(bit) | ((reg) << 8) | ((invert) << 16) \
+}
+
+static int rpi_cirrus_spdif_status_flag_get(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_codec *wm8804_codec = get_wm8804_runtime(card)->codec;
+
+	unsigned int bit = kcontrol->private_value & 0xff;
+	unsigned int reg = (kcontrol->private_value >> 8) & 0xff;
+	unsigned int invert = (kcontrol->private_value >> 16) & 0xff;
+
+	bool flag = snd_soc_read(wm8804_codec, reg) & (1 << bit);
+
+	ucontrol->value.integer.value[0] = invert ? !flag : flag;
+
+	return 0;
+}
+
+static const char * const recovered_frequency_texts[] = {
+	"176.4/192 kHz",
+	"88.2/96 kHz",
+	"44.1/48 kHz",
+	"32 kHz"
+};
+
+#define NUM_RECOVERED_FREQUENCIES \
+	ARRAY_SIZE(recovered_frequency_texts)
+
+static int rpi_cirrus_recovered_frequency_info(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_info *uinfo)
+{
+	uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
+	uinfo->count = 1;
+	uinfo->value.enumerated.items = NUM_RECOVERED_FREQUENCIES;
+	if (uinfo->value.enumerated.item >= NUM_RECOVERED_FREQUENCIES)
+		uinfo->value.enumerated.item = NUM_RECOVERED_FREQUENCIES - 1;
+	strcpy(uinfo->value.enumerated.name,
+		recovered_frequency_texts[uinfo->value.enumerated.item]);
+	return 0;
+}
+
+static int rpi_cirrus_recovered_frequency_get(struct snd_kcontrol *kcontrol,
+	struct snd_ctl_elem_value *ucontrol)
+{
+	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
+	struct snd_soc_codec *wm8804_codec = get_wm8804_runtime(card)->codec;
+
+	ucontrol->value.enumerated.item[0] =
+		(snd_soc_read(wm8804_codec, WM8804_SPDSTAT) >> 4) & 0x03;
+	return 0;
+}
+
+static const struct snd_kcontrol_new rpi_cirrus_controls[] = {
+	{
+		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name =    "Min Sample Rate",
+		.info =    rpi_cirrus_min_rate_info,
+		.get =     rpi_cirrus_min_rate_get,
+		.put =     rpi_cirrus_min_rate_put,
+	},
+	{
+		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name =    "Max Sample Rate",
+		.info =    rpi_cirrus_max_rate_info,
+		.get =     rpi_cirrus_max_rate_get,
+		.put =     rpi_cirrus_max_rate_put,
+	},
+	{
+		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name =    SNDRV_CTL_NAME_IEC958("", PLAYBACK, DEFAULT),
+		.info =    rpi_cirrus_spdif_info,
+		.get =     rpi_cirrus_spdif_playback_get,
+		.put =     rpi_cirrus_spdif_playback_put,
+	},
+	{
+		.access =  SNDRV_CTL_ELEM_ACCESS_READ
+			   | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name =    SNDRV_CTL_NAME_IEC958("", CAPTURE, DEFAULT),
+		.info =    rpi_cirrus_spdif_info,
+		.get =     rpi_cirrus_spdif_capture_get,
+	},
+	{
+		.access =  SNDRV_CTL_ELEM_ACCESS_READ,
+		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name =    SNDRV_CTL_NAME_IEC958("", PLAYBACK, MASK),
+		.info =    rpi_cirrus_spdif_info,
+		.get =     rpi_cirrus_spdif_mask_get,
+	},
+	{
+		.access =  SNDRV_CTL_ELEM_ACCESS_READ
+			   | SNDRV_CTL_ELEM_ACCESS_VOLATILE,
+		.iface =   SNDRV_CTL_ELEM_IFACE_MIXER,
+		.name =    SNDRV_CTL_NAME_IEC958("", CAPTURE, NONE)
+				"Recovered Frequency",
+		.info =    rpi_cirrus_recovered_frequency_info,
+		.get =     rpi_cirrus_recovered_frequency_get,
+	},
+	SPDIF_FLAG_CTRL("Audio", WM8804_SPDSTAT, 0, 1),
+	SPDIF_FLAG_CTRL("Non-PCM", WM8804_SPDSTAT, 1, 0),
+	SPDIF_FLAG_CTRL("Copyright", WM8804_SPDSTAT, 2, 1),
+	SPDIF_FLAG_CTRL("De-Emphasis", WM8804_SPDSTAT, 3, 0),
+	SPDIF_FLAG_CTRL("Lock", WM8804_SPDSTAT, 6, 1),
+	SPDIF_FLAG_CTRL("Invalid", WM8804_INTSTAT, 1, 0),
+	SPDIF_FLAG_CTRL("TransErr", WM8804_INTSTAT, 3, 0),
+};
+
+static const char * const linein_micbias_texts[] = {
+	"off", "on",
+};
+
+static SOC_ENUM_SINGLE_VIRT_DECL(linein_micbias_enum,
+	linein_micbias_texts);
+
+static const struct snd_kcontrol_new linein_micbias_mux =
+	SOC_DAPM_ENUM("Route", linein_micbias_enum);
+
+static int rpi_cirrus_spdif_rx_enable_event(struct snd_soc_dapm_widget *w,
+	struct snd_kcontrol *kcontrol, int event);
+
+const struct snd_soc_dapm_widget rpi_cirrus_dapm_widgets[] = {
+	SND_SOC_DAPM_MIC("DMIC", NULL),
+	SND_SOC_DAPM_MIC("Headset Mic", NULL),
+	SND_SOC_DAPM_INPUT("Line Input"),
+	SND_SOC_DAPM_MIC("Line Input with Micbias", NULL),
+	SND_SOC_DAPM_MUX("Line Input Micbias", SND_SOC_NOPM, 0, 0,
+		&linein_micbias_mux),
+	SND_SOC_DAPM_INPUT("dummy SPDIF in"),
+	SND_SOC_DAPM_PGA_E("dummy SPDIFRX", SND_SOC_NOPM, 0, 0, NULL, 0,
+		rpi_cirrus_spdif_rx_enable_event,
+		SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
+	SND_SOC_DAPM_INPUT("Dummy Input"),
+	SND_SOC_DAPM_OUTPUT("Dummy Output"),
+};
+
+const struct snd_soc_dapm_route rpi_cirrus_dapm_routes[] = {
+	{ "IN1L", NULL, "Headset Mic" },
+	{ "IN1R", NULL, "Headset Mic" },
+	{ "Headset Mic", NULL, "MICBIAS1" },
+
+	{ "IN2L", NULL, "DMIC" },
+	{ "IN2R", NULL, "DMIC" },
+	{ "DMIC", NULL, "MICBIAS2" },
+
+	{ "IN3L", NULL, "Line Input Micbias" },
+	{ "IN3R", NULL, "Line Input Micbias" },
+
+	{ "Line Input Micbias", "off", "Line Input" },
+	{ "Line Input Micbias", "on", "Line Input with Micbias" },
+
+	/* Make sure MICVDD is enabled, otherwise we get noise */
+	{ "Line Input", NULL, "MICVDD" },
+	{ "Line Input with Micbias", NULL, "MICBIAS3" },
+
+	/* Dummy routes to check whether SPDIF RX is enabled or not */
+	{"dummy SPDIFRX", NULL, "dummy SPDIF in"},
+	{"AIFTX", NULL, "dummy SPDIFRX"},
+
+	/*
+	 * Dummy routes to keep wm5102 from staying off on
+	 * playback/capture if all mixers are off.
+	 */
+	{ "Dummy Output", NULL, "AIF1RX1" },
+	{ "Dummy Output", NULL, "AIF1RX2" },
+	{ "AIF1TX1", NULL, "Dummy Input" },
+	{ "AIF1TX2", NULL, "Dummy Input" },
+};
+
+static int rpi_cirrus_clear_flls(struct snd_soc_card *card,
+	struct snd_soc_codec *wm5102_codec) {
+
+	int ret1, ret2;
+
+	ret1 = snd_soc_codec_set_pll(wm5102_codec,
+		WM5102_FLL1, ARIZONA_FLL_SRC_NONE, 0, 0);
+	ret2 = snd_soc_codec_set_pll(wm5102_codec,
+		WM5102_FLL1_REFCLK, ARIZONA_FLL_SRC_NONE, 0, 0);
+
+	if (ret1) {
+		dev_warn(card->dev,
+			"setting FLL1 to zero failed: %d\n", ret1);
+		return ret1;
+	}
+	if (ret2) {
+		dev_warn(card->dev,
+			"setting FLL1_REFCLK to zero failed: %d\n", ret2);
+		return ret2;
+	}
+	return 0;
+}
+
+static int rpi_cirrus_set_fll(struct snd_soc_card *card,
+	struct snd_soc_codec *wm5102_codec, unsigned int clk_freq)
+{
+	int ret = snd_soc_codec_set_pll(wm5102_codec,
+		WM5102_FLL1,
+		ARIZONA_CLK_SRC_MCLK1,
+		WM8804_CLKOUT_HZ,
+		clk_freq);
+	if (ret)
+		dev_err(card->dev, "Failed to set FLL1 to %d: %d\n",
+			clk_freq, ret);
+
+	usleep_range(1000, 2000);
+	return ret;
+}
+
+static int rpi_cirrus_set_fll_refclk(struct snd_soc_card *card,
+	struct snd_soc_codec *wm5102_codec,
+	unsigned int clk_freq, unsigned int aif2_freq)
+{
+	int ret = snd_soc_codec_set_pll(wm5102_codec,
+		WM5102_FLL1_REFCLK,
+		ARIZONA_CLK_SRC_MCLK1,
+		WM8804_CLKOUT_HZ,
+		clk_freq);
+	if (ret) {
+		dev_err(card->dev,
+			"Failed to set FLL1_REFCLK to %d: %d\n",
+			clk_freq, ret);
+		return ret;
+	}
+
+	ret = snd_soc_codec_set_pll(wm5102_codec,
+		WM5102_FLL1,
+		ARIZONA_CLK_SRC_AIF2BCLK,
+		aif2_freq, clk_freq);
+	if (ret)
+		dev_err(card->dev,
+			"Failed to set FLL1 with Sync Clock %d to %d: %d\n",
+			aif2_freq, clk_freq, ret);
+
+	usleep_range(1000, 2000);
+	return ret;
+}
+
+static int rpi_cirrus_spdif_rx_enable_event(struct snd_soc_dapm_widget *w,
+	struct snd_kcontrol *kcontrol, int event)
+{
+	struct snd_soc_card *card = w->dapm->card;
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	struct snd_soc_codec *wm5102_codec = get_wm5102_runtime(card)->codec;
+
+	unsigned int clk_freq, aif2_freq;
+	int ret = 0;
+
+	switch (event) {
+	case SND_SOC_DAPM_POST_PMU:
+		mutex_lock(&priv->lock);
+
+		/* Enable sync path in case of SPDIF capture use case */
+
+		clk_freq = calc_sysclk(priv->card_rate);
+		aif2_freq = 64 * priv->card_rate;
+
+		dev_dbg(card->dev,
+			"spdif_rx: changing FLL1 to use Ref Clock clk: %d spdif: %d\n",
+			clk_freq, aif2_freq);
+
+		ret = rpi_cirrus_clear_flls(card, wm5102_codec);
+		if (ret) {
+			dev_err(card->dev, "spdif_rx: failed to clear FLLs\n");
+			goto out;
+		}
+
+		ret = rpi_cirrus_set_fll_refclk(card, wm5102_codec,
+			clk_freq, aif2_freq);
+
+		if (ret) {
+			dev_err(card->dev, "spdif_rx: failed to set FLLs\n");
+			goto out;
+		}
+
+		/* set to negative to indicate we're doing spdif rx */
+		priv->fll1_freq = -clk_freq;
+		priv->sync_path_enable = 1;
+		break;
+
+	case SND_SOC_DAPM_POST_PMD:
+		mutex_lock(&priv->lock);
+		priv->sync_path_enable = 0;
+		break;
+
+	default:
+		return 0;
+	}
+
+out:
+	mutex_unlock(&priv->lock);
+	return ret;
+}
+
+static int rpi_cirrus_set_bias_level(struct snd_soc_card *card,
+	struct snd_soc_dapm_context *dapm,
+	enum snd_soc_bias_level level)
+{
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	struct snd_soc_pcm_runtime *wm5102_runtime = get_wm5102_runtime(card);
+	struct snd_soc_codec *wm5102_codec = wm5102_runtime->codec;
+
+	int ret = 0;
+	unsigned int clk_freq;
+
+	if (dapm->dev != wm5102_runtime->codec_dai->dev)
+		return 0;
+
+	switch (level) {
+	case SND_SOC_BIAS_PREPARE:
+		if (dapm->bias_level == SND_SOC_BIAS_ON)
+			break;
+
+		mutex_lock(&priv->lock);
+
+		if (!priv->sync_path_enable) {
+			clk_freq = calc_sysclk(priv->card_rate);
+
+			dev_dbg(card->dev,
+				"set_bias: changing FLL1 from %d to %d\n",
+				priv->fll1_freq, clk_freq);
+
+			ret = rpi_cirrus_set_fll(card, wm5102_codec, clk_freq);
+			if (ret)
+				dev_err(card->dev,
+					"set_bias: Failed to set FLL1\n");
+			else
+				priv->fll1_freq = clk_freq;
+		}
+		mutex_unlock(&priv->lock);
+		break;
+	default:
+		break;
+	}
+
+	return ret;
+}
+
+static int rpi_cirrus_set_bias_level_post(struct snd_soc_card *card,
+	struct snd_soc_dapm_context *dapm,
+	enum snd_soc_bias_level level)
+{
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	struct snd_soc_pcm_runtime *wm5102_runtime = get_wm5102_runtime(card);
+	struct snd_soc_codec *wm5102_codec = wm5102_runtime->codec;
+
+	if (dapm->dev != wm5102_runtime->codec_dai->dev)
+		return 0;
+
+	switch (level) {
+	case SND_SOC_BIAS_STANDBY:
+		mutex_lock(&priv->lock);
+
+		dev_dbg(card->dev,
+			"set_bias_post: changing FLL1 from %d to off\n",
+				priv->fll1_freq);
+
+		if (rpi_cirrus_clear_flls(card, wm5102_codec))
+			dev_err(card->dev,
+				"set_bias_post: failed to clear FLLs\n");
+		else
+			priv->fll1_freq = 0;
+
+		mutex_unlock(&priv->lock);
+
+		break;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+static int rpi_cirrus_set_wm8804_pll(struct snd_soc_card *card,
+	struct snd_soc_dai *wm8804_dai, unsigned int rate)
+{
+	int ret;
+
+	/* use 256fs */
+	unsigned int clk_freq = rate * 256;
+
+	ret = snd_soc_dai_set_pll(wm8804_dai, 0, 0,
+		WM8804_CLKOUT_HZ, clk_freq);
+	if (ret) {
+		dev_err(card->dev,
+			"Failed to set WM8804 PLL to %d: %d\n", clk_freq, ret);
+		return ret;
+	}
+
+	/* Set MCLK as PLL Output */
+	ret = snd_soc_dai_set_sysclk(wm8804_dai,
+		WM8804_TX_CLKSRC_PLL, clk_freq, 0);
+	if (ret) {
+		dev_err(card->dev,
+			"Failed to set MCLK as PLL Output: %d\n", ret);
+		return ret;
+	}
+
+	return ret;
+}
+
+static int rpi_cirrus_startup(struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_card *card = rtd->card;
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	unsigned int min_rate = min_rates[priv->min_rate_idx].value;
+	unsigned int max_rate = max_rates[priv->max_rate_idx].value;
+
+	if (min_rate || max_rate) {
+		if (max_rate == 0)
+			max_rate = UINT_MAX;
+
+		dev_dbg(card->dev,
+			"startup: limiting rate to %u-%u\n",
+			min_rate, max_rate);
+
+		snd_pcm_hw_constraint_minmax(substream->runtime,
+			SNDRV_PCM_HW_PARAM_RATE, min_rate, max_rate);
+	}
+
+	return 0;
+}
+
+static struct snd_soc_pcm_stream rpi_cirrus_dai_link2_params = {
+	.formats = SNDRV_PCM_FMTBIT_S24_LE,
+	.channels_min = 2,
+	.channels_max = 2,
+	.rate_min = RPI_CIRRUS_DEFAULT_RATE,
+	.rate_max = RPI_CIRRUS_DEFAULT_RATE,
+};
+
+static int rpi_cirrus_hw_params(struct snd_pcm_substream *substream,
+	struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_card *card = rtd->card;
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	struct snd_soc_dai *bcm_i2s_dai = rtd->cpu_dai;
+	struct snd_soc_codec *wm5102_codec = rtd->codec;
+	struct snd_soc_dai *wm8804_dai = get_wm8804_runtime(card)->codec_dai;
+
+	int ret;
+
+	unsigned int width = snd_pcm_format_physical_width(
+		params_format(params));
+	unsigned int rate = params_rate(params);
+	unsigned int clk_freq = calc_sysclk(rate);
+
+	mutex_lock(&priv->lock);
+
+	dev_dbg(card->dev, "hw_params: setting rate to %d\n", rate);
+
+	ret = snd_soc_dai_set_bclk_ratio(bcm_i2s_dai, 2 * width);
+	if (ret) {
+		dev_err(card->dev, "set_bclk_ratio failed: %d\n", ret);
+		goto out;
+	}
+
+	ret = snd_soc_dai_set_tdm_slot(rtd->codec_dai, 0x03, 0x03, 2, width);
+	if (ret) {
+		dev_err(card->dev, "set_tdm_slot failed: %d\n", ret);
+		goto out;
+	}
+
+	/* WM8804 supports sample rates from 32k only */
+	if (rate >= 32000) {
+		ret = rpi_cirrus_set_wm8804_pll(card, wm8804_dai, rate);
+		if (ret)
+			goto out;
+	}
+
+	ret = snd_soc_codec_set_sysclk(wm5102_codec,
+		ARIZONA_CLK_SYSCLK,
+		ARIZONA_CLK_SRC_FLL1,
+		clk_freq,
+		SND_SOC_CLOCK_IN);
+	if (ret) {
+		dev_err(card->dev, "Failed to set SYSCLK: %d\n", ret);
+		goto out;
+	}
+
+	if ((priv->fll1_freq > 0) && (priv->fll1_freq != clk_freq)) {
+		dev_dbg(card->dev,
+			"hw_params: changing FLL1 from %d to %d\n",
+			priv->fll1_freq, clk_freq);
+
+		if (rpi_cirrus_clear_flls(card, wm5102_codec)) {
+			dev_err(card->dev, "hw_params: failed to clear FLLs\n");
+			goto out;
+		}
+
+		if (rpi_cirrus_set_fll(card, wm5102_codec, clk_freq)) {
+			dev_err(card->dev, "hw_params: failed to set FLL\n");
+			goto out;
+		}
+
+		priv->fll1_freq = clk_freq;
+	}
+
+	priv->card_rate = rate;
+	rpi_cirrus_dai_link2_params.rate_min = rate;
+	rpi_cirrus_dai_link2_params.rate_max = rate;
+
+	priv->params_set |= 1 << substream->stream;
+
+out:
+	mutex_unlock(&priv->lock);
+
+	return ret;
+}
+
+static int rpi_cirrus_hw_free(struct snd_pcm_substream *substream)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_card *card = rtd->card;
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	struct snd_soc_codec *wm5102_codec = rtd->codec;
+	int ret;
+	unsigned int old_params_set = priv->params_set;
+
+	priv->params_set &= ~(1 << substream->stream);
+
+	/* disable sysclk if this was the last open stream */
+	if (priv->params_set == 0 && old_params_set) {
+		dev_dbg(card->dev,
+			"hw_free: Setting SYSCLK to Zero\n");
+
+		ret = snd_soc_codec_set_sysclk(wm5102_codec,
+			ARIZONA_CLK_SYSCLK,
+			ARIZONA_CLK_SRC_FLL1,
+			0,
+			SND_SOC_CLOCK_IN);
+		if (ret)
+			dev_err(card->dev,
+				"hw_free: Failed to set SYSCLK to Zero: %d\n",
+				ret);
+	}
+	return 0;
+}
+
+static int rpi_cirrus_init_wm5102(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_codec *codec = rtd->codec;
+	int ret;
+
+	/* no 32kHz input, derive it from sysclk if needed  */
+	snd_soc_update_bits(codec,
+			ARIZONA_CLOCK_32K_1, ARIZONA_CLK_32K_SRC_MASK, 2);
+
+	if (rpi_cirrus_clear_flls(rtd->card, codec))
+		dev_warn(rtd->card->dev,
+			"init_wm5102: failed to clear FLLs\n");
+
+	ret = snd_soc_codec_set_sysclk(codec,
+		ARIZONA_CLK_SYSCLK, ARIZONA_CLK_SRC_FLL1,
+		0, SND_SOC_CLOCK_IN);
+	if (ret) {
+		dev_err(rtd->card->dev,
+			"Failed to set SYSCLK to Zero: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+static int rpi_cirrus_init_wm8804(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_codec *codec = rtd->codec;
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+	struct snd_soc_card *card = rtd->card;
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	unsigned int mask;
+	int i, ret;
+
+	for (i = 0; i < 4; i++) {
+		mask = (i == 3) ? 0x3f : 0xff;
+		priv->iec958_status[i] =
+			snd_soc_read(codec, WM8804_SPDTX1 + i) & mask;
+	}
+
+	/* Setup for 256fs */
+	ret = snd_soc_dai_set_clkdiv(codec_dai,
+		WM8804_MCLK_DIV, WM8804_MCLKDIV_256FS);
+	if (ret) {
+		dev_err(card->dev,
+			"init_wm8804: Failed to set MCLK_DIV to 256fs: %d\n",
+			ret);
+		return ret;
+	}
+
+	/* Output OSC on CLKOUT */
+	ret = snd_soc_dai_set_sysclk(codec_dai,
+		WM8804_CLKOUT_SRC_OSCCLK, WM8804_CLKOUT_HZ, 0);
+	if (ret)
+		dev_err(card->dev,
+			"init_wm8804: Failed to set CLKOUT as OSC Frequency: %d\n",
+			ret);
+
+	/* Init PLL with default samplerate */
+	ret = rpi_cirrus_set_wm8804_pll(card, codec_dai,
+		RPI_CIRRUS_DEFAULT_RATE);
+	if (ret)
+		dev_err(card->dev,
+			"init_wm8804: Failed to setup PLL for %dHz: %d\n",
+			RPI_CIRRUS_DEFAULT_RATE, ret);
+
+	return ret;
+}
+
+static struct snd_soc_ops rpi_cirrus_ops = {
+	.startup = rpi_cirrus_startup,
+	.hw_params = rpi_cirrus_hw_params,
+	.hw_free = rpi_cirrus_hw_free,
+};
+
+static struct snd_soc_dai_link rpi_cirrus_dai[] = {
+	[DAI_WM5102] = {
+		.name		= "WM5102",
+		.stream_name	= "WM5102 AiFi",
+		.codec_dai_name	= "wm5102-aif1",
+		.codec_name	= "wm5102-codec",
+		.dai_fmt	=   SND_SOC_DAIFMT_I2S
+				  | SND_SOC_DAIFMT_NB_NF
+				  | SND_SOC_DAIFMT_CBM_CFM,
+		.ops		= &rpi_cirrus_ops,
+		.init		= rpi_cirrus_init_wm5102,
+	},
+	[DAI_WM8804] = {
+		.name		= "WM5102 SPDIF",
+		.stream_name	= "SPDIF Tx/Rx",
+		.cpu_dai_name	= "wm5102-aif2",
+		.codec_dai_name	= "wm8804-spdif",
+		.codec_name	= "wm8804.1-003b",
+		.dai_fmt	=   SND_SOC_DAIFMT_I2S
+				  | SND_SOC_DAIFMT_NB_NF
+				  | SND_SOC_DAIFMT_CBM_CFM,
+		.ignore_suspend = 1,
+		.params		= &rpi_cirrus_dai_link2_params,
+		.init		= rpi_cirrus_init_wm8804,
+	},
+};
+
+
+static int rpi_cirrus_late_probe(struct snd_soc_card *card)
+{
+	struct rpi_cirrus_priv *priv = snd_soc_card_get_drvdata(card);
+	struct snd_soc_pcm_runtime *wm5102_runtime = get_wm5102_runtime(card);
+	struct snd_soc_pcm_runtime *wm8804_runtime = get_wm8804_runtime(card);
+	int ret;
+
+	dev_dbg(card->dev, "iec958_bits: %02x %02x %02x %02x\n",
+		priv->iec958_status[0],
+		priv->iec958_status[1],
+		priv->iec958_status[2],
+		priv->iec958_status[3]);
+
+	ret = snd_soc_dai_set_sysclk(
+		wm5102_runtime->codec_dai, ARIZONA_CLK_SYSCLK, 0, 0);
+	if (ret) {
+		dev_err(card->dev,
+			"Failed to set WM5102 codec dai clk domain: %d\n", ret);
+		return ret;
+	}
+
+	ret = snd_soc_dai_set_sysclk(
+		wm8804_runtime->cpu_dai, ARIZONA_CLK_SYSCLK, 0, 0);
+	if (ret)
+		dev_err(card->dev,
+			"Failed to set WM8804 codec dai clk domain: %d\n", ret);
+
+	return ret;
+}
+
+/* audio machine driver */
+static struct snd_soc_card rpi_cirrus_card = {
+	.name			= "RPi-Cirrus",
+	.driver_name		= "RPiCirrus",
+	.owner			= THIS_MODULE,
+	.dai_link		= rpi_cirrus_dai,
+	.num_links		= ARRAY_SIZE(rpi_cirrus_dai),
+	.late_probe		= rpi_cirrus_late_probe,
+	.controls		= rpi_cirrus_controls,
+	.num_controls		= ARRAY_SIZE(rpi_cirrus_controls),
+	.dapm_widgets		= rpi_cirrus_dapm_widgets,
+	.num_dapm_widgets	= ARRAY_SIZE(rpi_cirrus_dapm_widgets),
+	.dapm_routes		= rpi_cirrus_dapm_routes,
+	.num_dapm_routes	= ARRAY_SIZE(rpi_cirrus_dapm_routes),
+	.set_bias_level		= rpi_cirrus_set_bias_level,
+	.set_bias_level_post	= rpi_cirrus_set_bias_level_post,
+};
+
+static int rpi_cirrus_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+	struct rpi_cirrus_priv *priv;
+	struct device_node *i2s_node;
+
+	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->min_rate_idx = 1; /* min samplerate 32kHz */
+	priv->card_rate = RPI_CIRRUS_DEFAULT_RATE;
+
+	mutex_init(&priv->lock);
+
+	snd_soc_card_set_drvdata(&rpi_cirrus_card, priv);
+
+	if (!pdev->dev.of_node)
+		return -ENODEV;
+
+	i2s_node = of_parse_phandle(
+			pdev->dev.of_node, "i2s-controller", 0);
+	if (!i2s_node) {
+		dev_err(&pdev->dev, "i2s-controller missing in DT\n");
+		return -ENODEV;
+	}
+
+	rpi_cirrus_dai[DAI_WM5102].cpu_of_node = i2s_node;
+	rpi_cirrus_dai[DAI_WM5102].platform_of_node = i2s_node;
+
+	rpi_cirrus_card.dev = &pdev->dev;
+
+	ret = devm_snd_soc_register_card(&pdev->dev, &rpi_cirrus_card);
+	if (ret) {
+		if (ret == -EPROBE_DEFER)
+			dev_dbg(&pdev->dev,
+				"register card requested probe deferral\n");
+		else
+			dev_err(&pdev->dev,
+				"Failed to register card: %d\n", ret);
+	}
+
+	return ret;
+}
+
+static const struct of_device_id rpi_cirrus_of_match[] = {
+	{ .compatible = "wlf,rpi-cirrus", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, rpi_cirrus_of_match);
+
+static struct platform_driver rpi_cirrus_driver = {
+	.driver	= {
+		.name   = "snd-rpi-cirrus",
+		.of_match_table = of_match_ptr(rpi_cirrus_of_match),
+	},
+	.probe	= rpi_cirrus_probe,
+};
+
+module_platform_driver(rpi_cirrus_driver);
+
+MODULE_AUTHOR("Matthias Reichl <hias@horus.com>");
+MODULE_DESCRIPTION("ASoC driver for Cirrus Logic Audio Card");
+MODULE_LICENSE("GPL");
diff --git a/sound/soc/bcm/rpi-dac.c b/sound/soc/bcm/rpi-dac.c
new file mode 100644
index 000000000000..38224467cbab
--- /dev/null
+++ b/sound/soc/bcm/rpi-dac.c
@@ -0,0 +1,119 @@
+/*
+ * ASoC Driver for RPi-DAC.
+ *
+ * Author:	Florian Meier <florian.meier@koalo.de>
+ *		Copyright 2013
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+static int snd_rpi_rpi_dac_init(struct snd_soc_pcm_runtime *rtd)
+{
+	return 0;
+}
+
+static int snd_rpi_rpi_dac_hw_params(struct snd_pcm_substream *substream,
+				       struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+
+	return snd_soc_dai_set_bclk_ratio(cpu_dai, 32*2);
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_rpi_rpi_dac_ops = {
+	.hw_params = snd_rpi_rpi_dac_hw_params,
+};
+
+static struct snd_soc_dai_link snd_rpi_rpi_dac_dai[] = {
+{
+	.name		= "RPi-DAC",
+	.stream_name	= "RPi-DAC HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "pcm1794a-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "pcm1794a-codec",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+				SND_SOC_DAIFMT_CBS_CFS,
+	.ops		= &snd_rpi_rpi_dac_ops,
+	.init		= snd_rpi_rpi_dac_init,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_rpi_dac = {
+	.name         = "snd_rpi_rpi_dac",
+	.owner        = THIS_MODULE,
+	.dai_link     = snd_rpi_rpi_dac_dai,
+	.num_links    = ARRAY_SIZE(snd_rpi_rpi_dac_dai),
+};
+
+static int snd_rpi_rpi_dac_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_rpi_rpi_dac.dev = &pdev->dev;
+	
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai = &snd_rpi_rpi_dac_dai[0];
+		i2s_node = of_parse_phandle(pdev->dev.of_node, "i2s-controller", 0);
+
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+	}
+	
+	ret = snd_soc_register_card(&snd_rpi_rpi_dac);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+static int snd_rpi_rpi_dac_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&snd_rpi_rpi_dac);
+}
+
+static const struct of_device_id snd_rpi_rpi_dac_of_match[] = {
+	{ .compatible = "rpi,rpi-dac", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_rpi_rpi_dac_of_match);
+
+static struct platform_driver snd_rpi_rpi_dac_driver = {
+        .driver = {
+                .name   = "snd-rpi-dac",
+                .owner  = THIS_MODULE,
+                .of_match_table = snd_rpi_rpi_dac_of_match,
+        },
+        .probe          = snd_rpi_rpi_dac_probe,
+        .remove         = snd_rpi_rpi_dac_remove,
+};
+
+module_platform_driver(snd_rpi_rpi_dac_driver);
+
+MODULE_AUTHOR("Florian Meier <florian.meier@koalo.de>");
+MODULE_DESCRIPTION("ASoC Driver for RPi-DAC");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/bcm/rpi-proto.c b/sound/soc/bcm/rpi-proto.c
new file mode 100644
index 000000000000..fadbfade1002
--- /dev/null
+++ b/sound/soc/bcm/rpi-proto.c
@@ -0,0 +1,153 @@
+/*
+ * ASoC driver for PROTO AudioCODEC (with a WM8731)
+ * connected to a Raspberry Pi
+ *
+ * Author:      Florian Meier, <koalo@koalo.de>
+ *	      Copyright 2013
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+#include "../codecs/wm8731.h"
+
+static const unsigned int wm8731_rates_12288000[] = {
+	8000, 32000, 48000, 96000,
+};
+
+static struct snd_pcm_hw_constraint_list wm8731_constraints_12288000 = {
+	.list = wm8731_rates_12288000,
+	.count = ARRAY_SIZE(wm8731_rates_12288000),
+};
+
+static int snd_rpi_proto_startup(struct snd_pcm_substream *substream)
+{
+	/* Setup constraints, because there is a 12.288 MHz XTAL on the board */
+	snd_pcm_hw_constraint_list(substream->runtime, 0,
+				SNDRV_PCM_HW_PARAM_RATE,
+				&wm8731_constraints_12288000);
+	return 0;
+}
+
+static int snd_rpi_proto_hw_params(struct snd_pcm_substream *substream,
+				       struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_codec *codec = rtd->codec;
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+	struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+	int sysclk = 12288000; /* This is fixed on this board */
+
+	/* Set proto bclk */
+	int ret = snd_soc_dai_set_bclk_ratio(cpu_dai,32*2);
+	if (ret < 0){
+		dev_err(codec->dev,
+				"Failed to set BCLK ratio %d\n", ret);
+		return ret;
+	}
+
+	/* Set proto sysclk */
+	ret = snd_soc_dai_set_sysclk(codec_dai, WM8731_SYSCLK_XTAL,
+			sysclk, SND_SOC_CLOCK_IN);
+	if (ret < 0) {
+		dev_err(codec->dev,
+				"Failed to set WM8731 SYSCLK: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+/* machine stream operations */
+static struct snd_soc_ops snd_rpi_proto_ops = {
+	.startup = snd_rpi_proto_startup,
+	.hw_params = snd_rpi_proto_hw_params,
+};
+
+static struct snd_soc_dai_link snd_rpi_proto_dai[] = {
+{
+	.name		= "WM8731",
+	.stream_name	= "WM8731 HiFi",
+	.cpu_dai_name	= "bcm2708-i2s.0",
+	.codec_dai_name	= "wm8731-hifi",
+	.platform_name	= "bcm2708-i2s.0",
+	.codec_name	= "wm8731.1-001a",
+	.dai_fmt	= SND_SOC_DAIFMT_I2S
+				| SND_SOC_DAIFMT_NB_NF
+				| SND_SOC_DAIFMT_CBM_CFM,
+	.ops		= &snd_rpi_proto_ops,
+},
+};
+
+/* audio machine driver */
+static struct snd_soc_card snd_rpi_proto = {
+	.name		= "snd_rpi_proto",
+	.owner		= THIS_MODULE,
+	.dai_link	= snd_rpi_proto_dai,
+	.num_links	= ARRAY_SIZE(snd_rpi_proto_dai),
+};
+
+static int snd_rpi_proto_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+
+	snd_rpi_proto.dev = &pdev->dev;
+
+	if (pdev->dev.of_node) {
+		struct device_node *i2s_node;
+		struct snd_soc_dai_link *dai = &snd_rpi_proto_dai[0];
+		i2s_node = of_parse_phandle(pdev->dev.of_node,
+				            "i2s-controller", 0);
+
+		if (i2s_node) {
+			dai->cpu_dai_name = NULL;
+			dai->cpu_of_node = i2s_node;
+			dai->platform_name = NULL;
+			dai->platform_of_node = i2s_node;
+		}
+	}
+
+	ret = snd_soc_register_card(&snd_rpi_proto);
+	if (ret && ret != -EPROBE_DEFER)
+		dev_err(&pdev->dev,
+				"snd_soc_register_card() failed: %d\n", ret);
+
+	return ret;
+}
+
+
+static int snd_rpi_proto_remove(struct platform_device *pdev)
+{
+	return snd_soc_unregister_card(&snd_rpi_proto);
+}
+
+static const struct of_device_id snd_rpi_proto_of_match[] = {
+	{ .compatible = "rpi,rpi-proto", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_rpi_proto_of_match);
+
+static struct platform_driver snd_rpi_proto_driver = {
+	.driver = {
+		.name   = "snd-rpi-proto",
+		.owner  = THIS_MODULE,
+		.of_match_table = snd_rpi_proto_of_match,
+	},
+	.probe	  = snd_rpi_proto_probe,
+	.remove	 = snd_rpi_proto_remove,
+};
+
+module_platform_driver(snd_rpi_proto_driver);
+
+MODULE_AUTHOR("Florian Meier");
+MODULE_DESCRIPTION("ASoC Driver for Raspberry Pi connected to PROTO board (WM8731)");
+MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index c367d11079bc..b3c63d86e5ef 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -109,6 +109,7 @@ config SND_SOC_ALL_CODECS
 	select SND_SOC_PCM1681 if I2C
 	select SND_SOC_PCM179X_I2C if I2C
 	select SND_SOC_PCM179X_SPI if SPI_MASTER
+	select SND_SOC_PCM1794A if I2C
 	select SND_SOC_PCM3008
 	select SND_SOC_PCM3168A_I2C if I2C
 	select SND_SOC_PCM3168A_SPI if SPI_MASTER
@@ -151,6 +152,7 @@ config SND_SOC_ALL_CODECS
 	select SND_SOC_TFA9879 if I2C
 	select SND_SOC_TLV320AIC23_I2C if I2C
 	select SND_SOC_TLV320AIC23_SPI if SPI_MASTER
+	select SND_SOC_TAS5713 if I2C
 	select SND_SOC_TLV320AIC26 if SPI_MASTER
 	select SND_SOC_TLV320AIC31XX if I2C
 	select SND_SOC_TLV320AIC32X4_I2C if I2C
@@ -579,7 +581,7 @@ config SND_SOC_HDAC_HDMI
 	select HDMI
 
 config SND_SOC_ICS43432
-	tristate
+	tristate "InvenSense ICS43432 I2S microphone codec"
 
 config SND_SOC_INNO_RK3036
 	tristate "Inno codec driver for RK3036 SoC"
@@ -753,6 +755,10 @@ config SND_SOC_RT5616
 	tristate "Realtek RT5616 CODEC"
 	depends on I2C
 
+config SND_SOC_PCM1794A
+	tristate
+	depends on I2C
+
 config SND_SOC_RT5631
 	tristate "Realtek ALC5631/RT5631 CODEC"
 	depends on I2C
@@ -883,6 +889,9 @@ config SND_SOC_TFA9879
 	tristate "NXP Semiconductors TFA9879 amplifier"
 	depends on I2C
 
+config SND_SOC_TAS5713
+	tristate
+
 config SND_SOC_TLV320AIC23
 	tristate
 
diff --git a/sound/soc/codecs/Makefile b/sound/soc/codecs/Makefile
index 05018b7ca72b..f910415bdd31 100644
--- a/sound/soc/codecs/Makefile
+++ b/sound/soc/codecs/Makefile
@@ -105,6 +105,7 @@ snd-soc-pcm1681-objs := pcm1681.o
 snd-soc-pcm179x-codec-objs := pcm179x.o
 snd-soc-pcm179x-i2c-objs := pcm179x-i2c.o
 snd-soc-pcm179x-spi-objs := pcm179x-spi.o
+snd-soc-pcm1794a-objs := pcm1794a.o
 snd-soc-pcm3008-objs := pcm3008.o
 snd-soc-pcm3168a-objs := pcm3168a.o
 snd-soc-pcm3168a-i2c-objs := pcm3168a-i2c.o
@@ -157,6 +158,7 @@ snd-soc-tas5086-objs := tas5086.o
 snd-soc-tas571x-objs := tas571x.o
 snd-soc-tas5720-objs := tas5720.o
 snd-soc-tfa9879-objs := tfa9879.o
+snd-soc-tas5713-objs := tas5713.o
 snd-soc-tlv320aic23-objs := tlv320aic23.o
 snd-soc-tlv320aic23-i2c-objs := tlv320aic23-i2c.o
 snd-soc-tlv320aic23-spi-objs := tlv320aic23-spi.o
@@ -353,6 +355,7 @@ obj-$(CONFIG_SND_SOC_PCM5102A)	+= snd-soc-pcm5102a.o
 obj-$(CONFIG_SND_SOC_PCM512x)	+= snd-soc-pcm512x.o
 obj-$(CONFIG_SND_SOC_PCM512x_I2C)	+= snd-soc-pcm512x-i2c.o
 obj-$(CONFIG_SND_SOC_PCM512x_SPI)	+= snd-soc-pcm512x-spi.o
+obj-$(CONFIG_SND_SOC_PCM1794A)	+= snd-soc-pcm1794a.o
 obj-$(CONFIG_SND_SOC_RL6231)	+= snd-soc-rl6231.o
 obj-$(CONFIG_SND_SOC_RL6347A)	+= snd-soc-rl6347a.o
 obj-$(CONFIG_SND_SOC_RT274)	+= snd-soc-rt274.o
@@ -395,6 +398,7 @@ obj-$(CONFIG_SND_SOC_TAS5086)	+= snd-soc-tas5086.o
 obj-$(CONFIG_SND_SOC_TAS571X)	+= snd-soc-tas571x.o
 obj-$(CONFIG_SND_SOC_TAS5720)	+= snd-soc-tas5720.o
 obj-$(CONFIG_SND_SOC_TFA9879)	+= snd-soc-tfa9879.o
+obj-$(CONFIG_SND_SOC_TAS5713)	+= snd-soc-tas5713.o
 obj-$(CONFIG_SND_SOC_TLV320AIC23)	+= snd-soc-tlv320aic23.o
 obj-$(CONFIG_SND_SOC_TLV320AIC23_I2C)	+= snd-soc-tlv320aic23-i2c.o
 obj-$(CONFIG_SND_SOC_TLV320AIC23_SPI)	+= snd-soc-tlv320aic23-spi.o
diff --git a/sound/soc/codecs/pcm1794a.c b/sound/soc/codecs/pcm1794a.c
new file mode 100644
index 000000000000..afe1b419582a
--- /dev/null
+++ b/sound/soc/codecs/pcm1794a.c
@@ -0,0 +1,69 @@
+/*
+ * Driver for the PCM1794A codec
+ *
+ * Author:	Florian Meier <florian.meier@koalo.de>
+ *		Copyright 2013
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <sound/soc.h>
+
+static struct snd_soc_dai_driver pcm1794a_dai = {
+	.name = "pcm1794a-hifi",
+	.playback = {
+		.channels_min = 2,
+		.channels_max = 2,
+		.rates = SNDRV_PCM_RATE_8000_192000,
+		.formats = SNDRV_PCM_FMTBIT_S16_LE |
+			   SNDRV_PCM_FMTBIT_S24_LE
+	},
+};
+
+static struct snd_soc_codec_driver soc_codec_dev_pcm1794a;
+
+static int pcm1794a_probe(struct platform_device *pdev)
+{
+	return snd_soc_register_codec(&pdev->dev, &soc_codec_dev_pcm1794a,
+			&pcm1794a_dai, 1);
+}
+
+static int pcm1794a_remove(struct platform_device *pdev)
+{
+	snd_soc_unregister_codec(&pdev->dev);
+	return 0;
+}
+
+static const struct of_device_id pcm1794a_of_match[] = {
+	{ .compatible = "ti,pcm1794a", },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, pcm1794a_of_match);
+
+static struct platform_driver pcm1794a_codec_driver = {
+	.probe 		= pcm1794a_probe,
+	.remove 	= pcm1794a_remove,
+	.driver		= {
+		.name	= "pcm1794a-codec",
+		.owner	= THIS_MODULE,
+		.of_match_table = of_match_ptr(pcm1794a_of_match),
+	},
+};
+
+module_platform_driver(pcm1794a_codec_driver);
+
+MODULE_DESCRIPTION("ASoC PCM1794A codec driver");
+MODULE_AUTHOR("Florian Meier <florian.meier@koalo.de>");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/codecs/pcm512x.c b/sound/soc/codecs/pcm512x.c
index 68feae262476..795e9eb3c863 100644
--- a/sound/soc/codecs/pcm512x.c
+++ b/sound/soc/codecs/pcm512x.c
@@ -53,6 +53,7 @@ struct pcm512x_priv {
 	unsigned long overclock_pll;
 	unsigned long overclock_dac;
 	unsigned long overclock_dsp;
+	int lrclk_div;
 };
 
 /*
@@ -851,7 +852,10 @@ static int pcm512x_set_dividers(struct snd_soc_dai *dai,
 	int fssp;
 	int gpio;
 
-	lrclk_div = snd_soc_params_to_frame_size(params);
+	if (pcm512x->lrclk_div)
+		lrclk_div = pcm512x->lrclk_div;
+	else
+		lrclk_div = snd_soc_params_to_frame_size(params);
 	if (lrclk_div == 0) {
 		dev_err(dev, "No LRCLK?\n");
 		return -EINVAL;
@@ -1319,10 +1323,32 @@ static int pcm512x_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
 	return 0;
 }
 
+static int pcm512x_set_tdm_slot(struct snd_soc_dai *dai,
+	unsigned int tx_mask, unsigned int rx_mask,
+	int slots, int width)
+{
+	struct snd_soc_codec *codec = dai->codec;
+	struct pcm512x_priv *pcm512x = snd_soc_codec_get_drvdata(codec);
+
+	switch (slots) {
+	case 0:
+		pcm512x->lrclk_div = 0;
+		return 0;
+	case 2:
+		if (tx_mask != 0x03 || rx_mask != 0x03)
+			return -EINVAL;
+		pcm512x->lrclk_div = slots * width;
+		return 0;
+	default:
+		return -EINVAL;
+	}
+}
+
 static const struct snd_soc_dai_ops pcm512x_dai_ops = {
 	.startup = pcm512x_dai_startup,
 	.hw_params = pcm512x_hw_params,
 	.set_fmt = pcm512x_set_fmt,
+	.set_tdm_slot = pcm512x_set_tdm_slot,
 };
 
 static struct snd_soc_dai_driver pcm512x_dai = {
diff --git a/sound/soc/codecs/tas5713.c b/sound/soc/codecs/tas5713.c
new file mode 100644
index 000000000000..560234d58a6b
--- /dev/null
+++ b/sound/soc/codecs/tas5713.c
@@ -0,0 +1,371 @@
+/*
+ * ASoC Driver for TAS5713
+ *
+ * Author:	Sebastian Eickhoff <basti.eickhoff@googlemail.com>
+ *		Copyright 2014
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/pm.h>
+#include <linux/i2c.h>
+#include <linux/of_device.h>
+#include <linux/spi/spi.h>
+#include <linux/regmap.h>
+#include <linux/regulator/consumer.h>
+#include <linux/slab.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/initval.h>
+#include <sound/tlv.h>
+
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/fs.h>
+#include <asm/uaccess.h>
+
+#include "tas5713.h"
+
+
+static struct i2c_client *i2c;
+
+struct tas5713_priv {
+	struct regmap *regmap;
+	int mclk_div;
+	struct snd_soc_codec *codec;
+};
+
+static struct tas5713_priv *priv_data;
+
+
+
+
+/*
+ *    _   _    ___   _      ___         _           _
+ *   /_\ | |  / __| /_\    / __|___ _ _| |_ _ _ ___| |___
+ *  / _ \| |__\__ \/ _ \  | (__/ _ \ ' \  _| '_/ _ \ (_-<
+ * /_/ \_\____|___/_/ \_\  \___\___/_||_\__|_| \___/_/__/
+ *
+ */
+
+static const DECLARE_TLV_DB_SCALE(tas5713_vol_tlv, -10000, 50, 1);
+
+
+static const struct snd_kcontrol_new tas5713_snd_controls[] = {
+	SOC_SINGLE_TLV  ("Master"    , TAS5713_VOL_MASTER, 0, 248, 1, tas5713_vol_tlv),
+	SOC_DOUBLE_R_TLV("Channels"  , TAS5713_VOL_CH1, TAS5713_VOL_CH2, 0, 248, 1, tas5713_vol_tlv)
+};
+
+
+
+
+/*
+ *  __  __         _    _            ___      _
+ * |  \/  |__ _ __| |_ (_)_ _  ___  |   \ _ _(_)_ _____ _ _
+ * | |\/| / _` / _| ' \| | ' \/ -_) | |) | '_| \ V / -_) '_|
+ * |_|  |_\__,_\__|_||_|_|_||_\___| |___/|_| |_|\_/\___|_|
+ *
+ */
+
+static int tas5713_hw_params(struct snd_pcm_substream *substream,
+			    struct snd_pcm_hw_params *params,
+			    struct snd_soc_dai *dai)
+{
+	u16 blen = 0x00;
+
+	struct snd_soc_codec *codec;
+	codec = dai->codec;
+	priv_data->codec = dai->codec;
+
+	switch (params_format(params)) {
+	case SNDRV_PCM_FORMAT_S16_LE:
+		blen = 0x03;
+		break;
+	case SNDRV_PCM_FORMAT_S20_3LE:
+		blen = 0x1;
+		break;
+	case SNDRV_PCM_FORMAT_S24_LE:
+		blen = 0x04;
+		break;
+	case SNDRV_PCM_FORMAT_S32_LE:
+		blen = 0x05;
+		break;
+	default:
+		dev_err(dai->dev, "Unsupported word length: %u\n",
+			params_format(params));
+		return -EINVAL;
+	}
+
+	// set word length
+	snd_soc_update_bits(codec, TAS5713_SERIAL_DATA_INTERFACE, 0x7, blen);
+
+	return 0;
+}
+
+
+static int tas5713_mute_stream(struct snd_soc_dai *dai, int mute, int stream)
+{
+	unsigned int val = 0;
+
+	struct tas5713_priv *tas5713;
+	struct snd_soc_codec *codec = dai->codec;
+	tas5713 = snd_soc_codec_get_drvdata(codec);
+
+	if (mute) {
+		val = TAS5713_SOFT_MUTE_ALL;
+	}
+
+	return regmap_write(tas5713->regmap, TAS5713_SOFT_MUTE, val);
+}
+
+
+static const struct snd_soc_dai_ops tas5713_dai_ops = {
+	.hw_params 		= tas5713_hw_params,
+	.mute_stream	= tas5713_mute_stream,
+};
+
+
+static struct snd_soc_dai_driver tas5713_dai = {
+	.name		= "tas5713-hifi",
+	.playback 	= {
+		.stream_name	= "Playback",
+		.channels_min	= 2,
+		.channels_max	= 2,
+		.rates		    = SNDRV_PCM_RATE_8000_48000,
+		.formats	    = (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S32_LE ),
+	},
+	.ops        = &tas5713_dai_ops,
+};
+
+
+
+
+/*
+ *   ___         _          ___      _
+ *  / __|___  __| |___ __  |   \ _ _(_)_ _____ _ _
+ * | (__/ _ \/ _` / -_) _| | |) | '_| \ V / -_) '_|
+ *  \___\___/\__,_\___\__| |___/|_| |_|\_/\___|_|
+ *
+ */
+
+static int tas5713_remove(struct snd_soc_codec *codec)
+{
+	struct tas5713_priv *tas5713;
+
+	tas5713 = snd_soc_codec_get_drvdata(codec);
+
+	return 0;
+}
+
+
+static int tas5713_probe(struct snd_soc_codec *codec)
+{
+	struct tas5713_priv *tas5713;
+	int i, ret;
+
+	i2c = container_of(codec->dev, struct i2c_client, dev);
+
+	tas5713 = snd_soc_codec_get_drvdata(codec);
+
+	// Reset error
+	ret = snd_soc_write(codec, TAS5713_ERROR_STATUS, 0x00);
+	if (ret < 0) return ret;
+
+	// Trim oscillator
+	ret = snd_soc_write(codec, TAS5713_OSC_TRIM, 0x00);
+	if (ret < 0) return ret;
+	msleep(1000);
+
+	// Reset error
+	ret = snd_soc_write(codec, TAS5713_ERROR_STATUS, 0x00);
+	if (ret < 0) return ret;
+
+	// Clock mode: 44/48kHz, MCLK=64xfs
+	ret = snd_soc_write(codec, TAS5713_CLOCK_CTRL, 0x60);
+	if (ret < 0) return ret;
+
+	// I2S 24bit
+	ret = snd_soc_write(codec, TAS5713_SERIAL_DATA_INTERFACE, 0x05);
+	if (ret < 0) return ret;
+
+	// Unmute
+	ret = snd_soc_write(codec, TAS5713_SYSTEM_CTRL2, 0x00);
+	if (ret < 0) return ret;
+	ret = snd_soc_write(codec, TAS5713_SOFT_MUTE, 0x00);
+	if (ret < 0) return ret;
+
+	// Set volume to 0db
+	ret = snd_soc_write(codec, TAS5713_VOL_MASTER, 0x00);
+	if (ret < 0) return ret;
+
+	// Now start programming the default initialization sequence
+	for (i = 0; i < ARRAY_SIZE(tas5713_init_sequence); ++i) {
+		ret = i2c_master_send(i2c,
+				     tas5713_init_sequence[i].data,
+				     tas5713_init_sequence[i].size);
+		if (ret < 0) {
+			printk(KERN_INFO "TAS5713 CODEC PROBE: InitSeq returns: %d\n", ret);
+		}
+	}
+
+	// Unmute
+	ret = snd_soc_write(codec, TAS5713_SYSTEM_CTRL2, 0x00);
+	if (ret < 0) return ret;
+
+	return 0;
+}
+
+
+static struct snd_soc_codec_driver soc_codec_dev_tas5713 = {
+	.probe = tas5713_probe,
+	.remove = tas5713_remove,
+	.component_driver = {
+		.controls = tas5713_snd_controls,
+		.num_controls = ARRAY_SIZE(tas5713_snd_controls),
+	},
+};
+
+
+
+
+/*
+ *   ___ ___ ___   ___      _
+ *  |_ _|_  ) __| |   \ _ _(_)_ _____ _ _
+ *   | | / / (__  | |) | '_| \ V / -_) '_|
+ *  |___/___\___| |___/|_| |_|\_/\___|_|
+ *
+ */
+
+static const struct reg_default tas5713_reg_defaults[] = {
+	{ 0x07 ,0x80 },     // R7  - VOL_MASTER    - -40dB
+	{ 0x08 ,  30 },     // R8  - VOL_CH1	   -   0dB
+	{ 0x09 ,  30 },     // R9  - VOL_CH2       -   0dB
+	{ 0x0A ,0x80 },     // R10 - VOL_HEADPHONE - -40dB
+};
+
+
+static bool tas5713_reg_volatile(struct device *dev, unsigned int reg)
+{
+	switch (reg) {
+		case TAS5713_DEVICE_ID:
+		case TAS5713_ERROR_STATUS:
+			return true;
+	default:
+			return false;
+	}
+}
+
+
+static const struct of_device_id tas5713_of_match[] = {
+	{ .compatible = "ti,tas5713", },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, tas5713_of_match);
+
+
+static struct regmap_config tas5713_regmap_config = {
+	.reg_bits = 8,
+	.val_bits = 8,
+
+	.max_register = TAS5713_MAX_REGISTER,
+	.volatile_reg = tas5713_reg_volatile,
+
+	.cache_type = REGCACHE_RBTREE,
+	.reg_defaults = tas5713_reg_defaults,
+	.num_reg_defaults = ARRAY_SIZE(tas5713_reg_defaults),
+};
+
+
+static int tas5713_i2c_probe(struct i2c_client *i2c,
+			    const struct i2c_device_id *id)
+{
+	int ret;
+
+	priv_data = devm_kzalloc(&i2c->dev, sizeof *priv_data, GFP_KERNEL);
+	if (!priv_data)
+		return -ENOMEM;
+
+	priv_data->regmap = devm_regmap_init_i2c(i2c, &tas5713_regmap_config);
+	if (IS_ERR(priv_data->regmap)) {
+		ret = PTR_ERR(priv_data->regmap);
+		return ret;
+	}
+
+	i2c_set_clientdata(i2c, priv_data);
+
+	ret = snd_soc_register_codec(&i2c->dev,
+				     &soc_codec_dev_tas5713, &tas5713_dai, 1);
+
+	return ret;
+}
+
+
+static int tas5713_i2c_remove(struct i2c_client *i2c)
+{
+	snd_soc_unregister_codec(&i2c->dev);
+	i2c_set_clientdata(i2c, NULL);
+
+	kfree(priv_data);
+
+	return 0;
+}
+
+
+static const struct i2c_device_id tas5713_i2c_id[] = {
+	{ "tas5713", 0 },
+	{ }
+};
+
+MODULE_DEVICE_TABLE(i2c, tas5713_i2c_id);
+
+
+static struct i2c_driver tas5713_i2c_driver = {
+	.driver = {
+		.name = "tas5713",
+		.owner = THIS_MODULE,
+		.of_match_table = tas5713_of_match,
+	},
+	.probe = tas5713_i2c_probe,
+	.remove = tas5713_i2c_remove,
+	.id_table = tas5713_i2c_id
+};
+
+
+static int __init tas5713_modinit(void)
+{
+	int ret = 0;
+
+	ret = i2c_add_driver(&tas5713_i2c_driver);
+	if (ret) {
+		printk(KERN_ERR "Failed to register tas5713 I2C driver: %d\n",
+		       ret);
+	}
+
+	return ret;
+}
+module_init(tas5713_modinit);
+
+
+static void __exit tas5713_exit(void)
+{
+	i2c_del_driver(&tas5713_i2c_driver);
+}
+module_exit(tas5713_exit);
+
+
+MODULE_AUTHOR("Sebastian Eickhoff <basti.eickhoff@googlemail.com>");
+MODULE_DESCRIPTION("ASoC driver for TAS5713");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/codecs/tas5713.h b/sound/soc/codecs/tas5713.h
new file mode 100644
index 000000000000..8f019e048987
--- /dev/null
+++ b/sound/soc/codecs/tas5713.h
@@ -0,0 +1,210 @@
+/*
+ * ASoC Driver for TAS5713
+ *
+ * Author:      Sebastian Eickhoff <basti.eickhoff@googlemail.com>
+ *              Copyright 2014
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+
+#ifndef _TAS5713_H
+#define _TAS5713_H
+
+
+// TAS5713 I2C-bus register addresses
+
+#define TAS5713_CLOCK_CTRL              0x00
+#define TAS5713_DEVICE_ID               0x01
+#define TAS5713_ERROR_STATUS            0x02
+#define TAS5713_SYSTEM_CTRL1            0x03
+#define TAS5713_SERIAL_DATA_INTERFACE   0x04
+#define TAS5713_SYSTEM_CTRL2            0x05
+#define TAS5713_SOFT_MUTE               0x06
+#define TAS5713_VOL_MASTER              0x07
+#define TAS5713_VOL_CH1                 0x08
+#define TAS5713_VOL_CH2                 0x09
+#define TAS5713_VOL_HEADPHONE           0x0A
+#define TAS5713_VOL_CONFIG              0x0E
+#define TAS5713_MODULATION_LIMIT        0x10
+#define TAS5713_IC_DLY_CH1              0x11
+#define TAS5713_IC_DLY_CH2              0x12
+#define TAS5713_IC_DLY_CH3              0x13
+#define TAS5713_IC_DLY_CH4              0x14
+
+#define TAS5713_START_STOP_PERIOD       0x1A
+#define TAS5713_OSC_TRIM                0x1B
+#define TAS5713_BKND_ERR                0x1C
+
+#define TAS5713_INPUT_MUX               0x20
+#define TAS5713_SRC_SELECT_CH4          0x21
+#define TAS5713_PWM_MUX                 0x25
+
+#define TAS5713_CH1_BQ0                 0x29
+#define TAS5713_CH1_BQ1                 0x2A
+#define TAS5713_CH1_BQ2                 0x2B
+#define TAS5713_CH1_BQ3                 0x2C
+#define TAS5713_CH1_BQ4                 0x2D
+#define TAS5713_CH1_BQ5                 0x2E
+#define TAS5713_CH1_BQ6                 0x2F
+#define TAS5713_CH1_BQ7                 0x58
+#define TAS5713_CH1_BQ8                 0x59
+
+#define TAS5713_CH2_BQ0                 0x30
+#define TAS5713_CH2_BQ1                 0x31
+#define TAS5713_CH2_BQ2                 0x32
+#define TAS5713_CH2_BQ3                 0x33
+#define TAS5713_CH2_BQ4                 0x34
+#define TAS5713_CH2_BQ5                 0x35
+#define TAS5713_CH2_BQ6                 0x36
+#define TAS5713_CH2_BQ7                 0x5C
+#define TAS5713_CH2_BQ8                 0x5D
+
+#define TAS5713_CH4_BQ0                 0x5A
+#define TAS5713_CH4_BQ1                 0x5B
+#define TAS5713_CH3_BQ0                 0x5E
+#define TAS5713_CH3_BQ1                 0x5F
+
+#define TAS5713_DRC1_SOFTENING_FILTER_ALPHA_OMEGA       0x3B
+#define TAS5713_DRC1_ATTACK_RELEASE_RATE                0x3C
+#define TAS5713_DRC2_SOFTENING_FILTER_ALPHA_OMEGA       0x3E
+#define TAS5713_DRC2_ATTACK_RELEASE_RATE                0x3F
+#define TAS5713_DRC1_ATTACK_RELEASE_THRES               0x40
+#define TAS5713_DRC2_ATTACK_RELEASE_THRES               0x43
+#define TAS5713_DRC_CTRL                                0x46
+
+#define TAS5713_BANK_SW_CTRL            0x50
+#define TAS5713_CH1_OUTPUT_MIXER        0x51
+#define TAS5713_CH2_OUTPUT_MIXER        0x52
+#define TAS5713_CH1_INPUT_MIXER         0x53
+#define TAS5713_CH2_INPUT_MIXER         0x54
+#define TAS5713_OUTPUT_POST_SCALE       0x56
+#define TAS5713_OUTPUT_PRESCALE         0x57
+
+#define TAS5713_IDF_POST_SCALE          0x62
+
+#define TAS5713_CH1_INLINE_MIXER        0x70
+#define TAS5713_CH1_INLINE_DRC_EN_MIXER 0x71
+#define TAS5713_CH1_R_CHANNEL_MIXER     0x72
+#define TAS5713_CH1_L_CHANNEL_MIXER     0x73
+#define TAS5713_CH2_INLINE_MIXER        0x74
+#define TAS5713_CH2_INLINE_DRC_EN_MIXER 0x75
+#define TAS5713_CH2_L_CHANNEL_MIXER     0x76
+#define TAS5713_CH2_R_CHANNEL_MIXER     0x77
+
+#define TAS5713_UPDATE_DEV_ADDR_KEY     0xF8
+#define TAS5713_UPDATE_DEV_ADDR_REG     0xF9
+
+#define TAS5713_REGISTER_COUNT          0x46
+#define TAS5713_MAX_REGISTER            0xF9
+
+
+// Bitmasks for registers
+#define TAS5713_SOFT_MUTE_ALL           0x07
+
+
+
+struct tas5713_init_command {
+        const int size;
+        const char *const data;
+};
+
+static const struct tas5713_init_command tas5713_init_sequence[] = {
+
+        // Trim oscillator
+    { .size = 2,  .data = "\x1B\x00" },
+    // System control register 1 (0x03): block DC
+    { .size = 2,  .data = "\x03\x80" },
+    // Mute everything
+    { .size = 2,  .data = "\x05\x40" },
+    // Modulation limit register (0x10): 97.7%
+    { .size = 2,  .data = "\x10\x02" },
+    // Interchannel delay registers
+    // (0x11, 0x12, 0x13, and 0x14): BD mode
+    { .size = 2,  .data = "\x11\xB8" },
+    { .size = 2,  .data = "\x12\x60" },
+    { .size = 2,  .data = "\x13\xA0" },
+    { .size = 2,  .data = "\x14\x48" },
+    // PWM shutdown group register (0x19): no shutdown
+    { .size = 2,  .data = "\x19\x00" },
+    // Input multiplexer register (0x20): BD mode
+    { .size = 2,  .data = "\x20\x00\x89\x77\x72" },
+    // PWM output mux register (0x25)
+    // Channel 1 --> OUTA, channel 1 neg --> OUTB
+    // Channel 2 --> OUTC, channel 2 neg --> OUTD
+    { .size = 5,  .data = "\x25\x01\x02\x13\x45" },
+    // DRC control (0x46): DRC off
+    { .size = 5,  .data = "\x46\x00\x00\x00\x00" },
+    // BKND_ERR register (0x1C): 299ms reset period
+    { .size = 2,  .data = "\x1C\x07" },
+    // Mute channel 3
+    { .size = 2,  .data = "\x0A\xFF" },
+    // Volume configuration register (0x0E): volume slew 512 steps
+    { .size = 2,  .data = "\x0E\x90" },
+    // Clock control register (0x00): 44/48kHz, MCLK=64xfs
+    { .size = 2,  .data = "\x00\x60" },
+    // Bank switch and eq control (0x50): no bank switching
+    { .size = 5,  .data = "\x50\x00\x00\x00\x00" },
+    // Volume registers (0x07, 0x08, 0x09, 0x0A)
+    { .size = 2,  .data = "\x07\x20" },
+    { .size = 2,  .data = "\x08\x30" },
+    { .size = 2,  .data = "\x09\x30" },
+    { .size = 2,  .data = "\x0A\xFF" },
+    // 0x72, 0x73, 0x76, 0x77 input mixer:
+    // no intermix between channels
+    { .size = 5,  .data = "\x72\x00\x00\x00\x00" },
+    { .size = 5,  .data = "\x73\x00\x80\x00\x00" },
+    { .size = 5,  .data = "\x76\x00\x00\x00\x00" },
+    { .size = 5,  .data = "\x77\x00\x80\x00\x00" },
+    // 0x70, 0x71, 0x74, 0x75 inline DRC mixer:
+    // no inline DRC inmix
+    { .size = 5,  .data = "\x70\x00\x80\x00\x00" },
+    { .size = 5,  .data = "\x71\x00\x00\x00\x00" },
+    { .size = 5,  .data = "\x74\x00\x80\x00\x00" },
+    { .size = 5,  .data = "\x75\x00\x00\x00\x00" },
+    // 0x56, 0x57 Output scale
+    { .size = 5,  .data = "\x56\x00\x80\x00\x00" },
+    { .size = 5,  .data = "\x57\x00\x02\x00\x00" },
+    // 0x3B, 0x3c
+    { .size = 9,  .data = "\x3B\x00\x08\x00\x00\x00\x78\x00\x00" },
+    { .size = 9,  .data = "\x3C\x00\x00\x01\x00\xFF\xFF\xFF\x00" },
+    { .size = 9,  .data = "\x3E\x00\x08\x00\x00\x00\x78\x00\x00" },
+    { .size = 9,  .data = "\x3F\x00\x00\x01\x00\xFF\xFF\xFF\x00" },
+    { .size = 9,  .data = "\x40\x00\x00\x01\x00\xFF\xFF\xFF\x00" },
+    { .size = 9,  .data = "\x43\x00\x00\x01\x00\xFF\xFF\xFF\x00" },
+    // 0x51, 0x52: output mixer
+    { .size = 9,  .data = "\x51\x00\x80\x00\x00\x00\x00\x00\x00" },
+    { .size = 9,  .data = "\x52\x00\x80\x00\x00\x00\x00\x00\x00" },
+    // PEQ defaults
+    { .size = 21,  .data = "\x29\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x2A\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x2B\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x2C\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x2D\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x2E\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x2F\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x30\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x31\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x32\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x33\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x34\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x35\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x36\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x58\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x59\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x5C\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x5D\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x5E\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x5F\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x5A\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+    { .size = 21,  .data = "\x5B\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" },
+};
+
+
+#endif  /* _TAS5713_H */
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index fee4b0ef5566..c728a4148903 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1124,7 +1124,7 @@ static int soc_bind_dai_link(struct snd_soc_card *card,
 	cpu_dai_component.dai_name = dai_link->cpu_dai_name;
 	rtd->cpu_dai = snd_soc_find_dai(&cpu_dai_component);
 	if (!rtd->cpu_dai) {
-		dev_err(card->dev, "ASoC: CPU DAI %s not registered\n",
+		dev_info(card->dev, "ASoC: CPU DAI %s not registered - will retry\n",
 			dai_link->cpu_dai_name);
 		goto _err_defer;
 	}
@@ -1137,7 +1137,7 @@ static int soc_bind_dai_link(struct snd_soc_card *card,
 	for (i = 0; i < rtd->num_codecs; i++) {
 		codec_dais[i] = snd_soc_find_dai(&codecs[i]);
 		if (!codec_dais[i]) {
-			dev_err(card->dev, "ASoC: CODEC DAI %s not registered\n",
+			dev_info(card->dev, "ASoC: CODEC DAI %s not registered - will retry\n",
 				codecs[i].dai_name);
 			goto _err_defer;
 		}
